From 38f5c38e4b1f20dc6084b5cfb4e620594c7d1c27 Mon Sep 17 00:00:00 2001 From: BubnovAS Date: Mon, 2 Jun 2025 10:38:08 +0300 Subject: [PATCH] =?UTF-8?q?=D0=94=D0=BE=D0=B1=D0=B0=D0=B2=D0=BB=D0=B5?= =?UTF-8?q?=D0=BD=D0=B0=20=D0=B1=D0=B8=D0=B1=D0=BB=D0=B8=D0=BE=D1=82=D0=B5?= =?UTF-8?q?=D0=BA=D0=B0=20curl=20=D0=B8=20=D1=80=D0=B5=D1=88=D0=B5=D0=BD?= =?UTF-8?q?=D1=8B=20=D0=BF=D1=80=D0=BE=D0=B1=D0=BB=D0=B5=D0=BC=D1=8B=20?= =?UTF-8?q?=D0=BF=D1=80=D0=B8=20=D0=B7=D0=B0=D0=BF=D1=83=D1=81=D0=BA=D0=B5?= =?UTF-8?q?=20=D0=BF=D1=80=D0=BE=D0=B3=D1=80=D0=B0=D0=BC=D0=BC=D1=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- curl/BUILD-HASHES.txt | 120 + curl/BUILD-MANIFEST.txt | 13 + curl/BUILD-README.url | 2 + curl/COPYING.txt | 22 + curl/README.txt | 55 + curl/RELEASE-NOTES.txt | 520 + curl/dep/brotli/LICENSE.txt | 19 + curl/dep/brotli/README.md | 95 + curl/dep/cacert/LICENSE.url | 2 + curl/dep/libpsl/AUTHORS.txt | 24 + curl/dep/libpsl/COPYING.txt | 19 + curl/dep/libpsl/NEWS.txt | 237 + curl/dep/libressl/COPYING.txt | 133 + curl/dep/libressl/ChangeLog.txt | 3239 +++++ curl/dep/libressl/README.md | 238 + curl/dep/libssh2/COPYING.txt | 43 + curl/dep/libssh2/NEWS.txt | 10896 +++++++++++++++++ curl/dep/libssh2/README.txt | 19 + curl/dep/libssh2/RELEASE-NOTES.txt | 325 + curl/dep/libssh2/docs/AUTHORS.txt | 80 + curl/dep/libssh2/docs/HACKING-CRYPTO.txt | 989 ++ curl/dep/libssh2/docs/INSTALL_AUTOTOOLS.txt | 316 + curl/dep/libssh2/docs/TODO.txt | 180 + curl/dep/nghttp2/AUTHORS.txt | 168 + curl/dep/nghttp2/COPYING.txt | 23 + curl/dep/nghttp2/ChangeLog.txt | 927 ++ curl/dep/nghttp2/README.rst | 1466 +++ curl/dep/nghttp3/AUTHORS.txt | 29 + curl/dep/nghttp3/COPYING.txt | 22 + curl/dep/nghttp3/ChangeLog.txt | 15 + curl/dep/nghttp3/README.rst | 73 + curl/dep/ngtcp2/AUTHORS.txt | 67 + curl/dep/ngtcp2/COPYING.txt | 22 + curl/dep/ngtcp2/ChangeLog.txt | 620 + curl/dep/ngtcp2/README.rst | 379 + curl/dep/zlibng/LICENSE.md | 19 + curl/dep/zlibng/README.md | 228 + curl/dep/zstd/CHANGELOG.txt | 863 ++ curl/dep/zstd/LICENSE.txt | 30 + curl/dep/zstd/README.md | 237 + curl/docs/ALTSVC.md | 43 + curl/docs/BINDINGS.md | 148 + curl/docs/BUG-BOUNTY.md | 94 + curl/docs/BUGS.md | 270 + curl/docs/CIPHERS-TLS12.md | 336 + curl/docs/CIPHERS.md | 273 + curl/docs/CODE_OF_CONDUCT.md | 38 + curl/docs/CODE_REVIEW.md | 174 + curl/docs/CONTRIBUTE.md | 367 + curl/docs/CURL-DISABLE.md | 191 + curl/docs/CURLDOWN.md | 168 + curl/docs/DEPRECATE.md | 77 + curl/docs/DISTROS.md | 287 + curl/docs/EARLY-RELEASE.md | 73 + curl/docs/ECH.md | 496 + curl/docs/EXPERIMENTAL.md | 90 + curl/docs/FAQ.txt | 1560 +++ curl/docs/FEATURES.md | 249 + curl/docs/GOVERNANCE.md | 202 + curl/docs/HELP-US.md | 94 + curl/docs/HISTORY.md | 486 + curl/docs/HSTS.md | 48 + curl/docs/HTTP-COOKIES.md | 171 + curl/docs/HTTP3.md | 481 + curl/docs/HTTPSRR.md | 100 + curl/docs/INFRASTRUCTURE.md | 209 + curl/docs/INSTALL-CMAKE.md | 605 + curl/docs/INSTALL.md | 665 + curl/docs/INSTALL.txt | 9 + curl/docs/INTERNALS.md | 63 + curl/docs/IPFS.md | 133 + curl/docs/KNOWN_BUGS.txt | 661 + curl/docs/MAIL-ETIQUETTE.md | 258 + curl/docs/MANUAL.md | 1008 ++ curl/docs/README.md | 18 + curl/docs/RELEASE-PROCEDURE.md | 145 + curl/docs/RELEASE-TOOLS.md | 28 + curl/docs/ROADMAP.md | 17 + curl/docs/RUSTLS.md | 85 + curl/docs/SECURITY-ADVISORY.md | 135 + curl/docs/SPONSORS.md | 55 + curl/docs/SSL-PROBLEMS.md | 97 + curl/docs/SSLCERTS.md | 124 + curl/docs/THANKS.txt | 3433 ++++++ curl/docs/TODO.txt | 1375 +++ curl/docs/TheArtOfHttpScripting.md | 712 ++ curl/docs/URL-SYNTAX.md | 396 + curl/docs/VERSIONS.md | 338 + curl/docs/VULN-DISCLOSURE-POLICY.md | 349 + curl/docs/curl-config.md | 124 + curl/docs/examples/10-at-a-time.c | 153 + curl/docs/examples/address-scope.c | 62 + curl/docs/examples/altsvc.c | 58 + curl/docs/examples/anyauthput.c | 164 + curl/docs/examples/block_ip.c | 356 + curl/docs/examples/certinfo.c | 87 + curl/docs/examples/chkspeed.c | 224 + curl/docs/examples/connect-to.c | 70 + curl/docs/examples/cookie_interface.c | 139 + curl/docs/examples/debug.c | 155 + curl/docs/examples/default-scheme.c | 57 + curl/docs/examples/externalsocket.c | 182 + curl/docs/examples/fileupload.c | 103 + curl/docs/examples/ftp-wildcard.c | 153 + curl/docs/examples/ftpget.c | 94 + curl/docs/examples/ftpgetinfo.c | 93 + curl/docs/examples/ftpgetresp.c | 85 + curl/docs/examples/ftpsget.c | 101 + curl/docs/examples/ftpupload.c | 150 + curl/docs/examples/ftpuploadfrommem.c | 126 + curl/docs/examples/ftpuploadresume.c | 167 + curl/docs/examples/getinfo.c | 54 + curl/docs/examples/getinmemory.c | 118 + curl/docs/examples/getredirect.c | 72 + curl/docs/examples/getreferrer.c | 59 + curl/docs/examples/headerapi.c | 81 + curl/docs/examples/hsts-preload.c | 118 + curl/docs/examples/http-options.c | 59 + curl/docs/examples/http-post.c | 61 + curl/docs/examples/http2-download.c | 236 + curl/docs/examples/http2-pushinmemory.c | 186 + curl/docs/examples/http2-serverpush.c | 273 + curl/docs/examples/http2-upload.c | 342 + curl/docs/examples/http3-present.c | 49 + curl/docs/examples/http3.c | 55 + curl/docs/examples/httpcustomheader.c | 72 + curl/docs/examples/httpput-postfields.c | 104 + curl/docs/examples/httpput.c | 130 + curl/docs/examples/https.c | 83 + curl/docs/examples/imap-append.c | 130 + curl/docs/examples/imap-authzid.c | 73 + curl/docs/examples/imap-copy.c | 73 + curl/docs/examples/imap-create.c | 69 + curl/docs/examples/imap-delete.c | 69 + curl/docs/examples/imap-examine.c | 69 + curl/docs/examples/imap-fetch.c | 67 + curl/docs/examples/imap-list.c | 68 + curl/docs/examples/imap-lsub.c | 70 + curl/docs/examples/imap-multi.c | 83 + curl/docs/examples/imap-noop.c | 69 + curl/docs/examples/imap-search.c | 73 + curl/docs/examples/imap-ssl.c | 94 + curl/docs/examples/imap-store.c | 84 + curl/docs/examples/imap-tls.c | 94 + curl/docs/examples/interface.c | 52 + curl/docs/examples/ipv6.c | 48 + curl/docs/examples/keepalive.c | 58 + curl/docs/examples/localport.c | 53 + curl/docs/examples/maxconnects.c | 66 + curl/docs/examples/multi-app.c | 115 + curl/docs/examples/multi-debugcallback.c | 161 + curl/docs/examples/multi-double.c | 93 + curl/docs/examples/multi-formadd.c | 120 + curl/docs/examples/multi-legacy.c | 191 + curl/docs/examples/multi-post.c | 104 + curl/docs/examples/multi-single.c | 80 + curl/docs/examples/netrc.c | 49 + curl/docs/examples/parseurl.c | 80 + curl/docs/examples/persistent.c | 70 + curl/docs/examples/pop3-authzid.c | 72 + curl/docs/examples/pop3-dele.c | 72 + curl/docs/examples/pop3-list.c | 66 + curl/docs/examples/pop3-multi.c | 84 + curl/docs/examples/pop3-noop.c | 72 + curl/docs/examples/pop3-retr.c | 66 + curl/docs/examples/pop3-ssl.c | 93 + curl/docs/examples/pop3-stat.c | 72 + curl/docs/examples/pop3-tls.c | 93 + curl/docs/examples/pop3-top.c | 69 + curl/docs/examples/pop3-uidl.c | 69 + curl/docs/examples/post-callback.c | 156 + curl/docs/examples/postinmemory.c | 113 + curl/docs/examples/postit2-formadd.c | 119 + curl/docs/examples/postit2.c | 104 + curl/docs/examples/progressfunc.c | 97 + curl/docs/examples/protofeats.c | 52 + curl/docs/examples/range.c | 45 + curl/docs/examples/resolve.c | 58 + curl/docs/examples/rtsp-options.c | 55 + curl/docs/examples/sendrecv.c | 179 + curl/docs/examples/sepheaders.c | 95 + curl/docs/examples/sftpget.c | 112 + curl/docs/examples/sftpuploadresume.c | 139 + curl/docs/examples/shared-connection-cache.c | 87 + curl/docs/examples/simple.c | 53 + curl/docs/examples/simplepost.c | 58 + curl/docs/examples/simplessl.c | 154 + curl/docs/examples/smtp-authzid.c | 162 + curl/docs/examples/smtp-expn.c | 81 + curl/docs/examples/smtp-mail.c | 150 + curl/docs/examples/smtp-mime.c | 168 + curl/docs/examples/smtp-multi.c | 153 + curl/docs/examples/smtp-ssl.c | 170 + curl/docs/examples/smtp-tls.c | 173 + curl/docs/examples/smtp-vrfy.c | 81 + curl/docs/examples/sslbackend.c | 79 + curl/docs/examples/unixsocket.c | 67 + curl/docs/examples/url2file.c | 87 + curl/docs/examples/urlapi.c | 77 + curl/docs/examples/websocket-cb.c | 68 + curl/docs/examples/websocket.c | 135 + curl/docs/libcurl/symbols-in-versions.txt | 1171 ++ curl/docs/mk-ca-bundle.md | 127 + curl/docs/options-in-versions.txt | 281 + curl/docs/wcurl.md | 145 + curl/include/brotli/decode.h | 409 + curl/include/brotli/encode.h | 501 + curl/include/brotli/port.h | 305 + curl/include/brotli/shared_dictionary.h | 100 + curl/include/brotli/types.h | 83 + curl/include/curl/curl.h | 3348 +++++ curl/include/curl/curlver.h | 79 + curl/include/curl/easy.h | 125 + curl/include/curl/header.h | 74 + curl/include/curl/mprintf.h | 85 + curl/include/curl/multi.h | 481 + curl/include/curl/options.h | 70 + curl/include/curl/stdcheaders.h | 35 + curl/include/curl/system.h | 450 + curl/include/curl/typecheck-gcc.h | 867 ++ curl/include/curl/urlapi.h | 155 + curl/include/curl/websockets.h | 85 + curl/include/libpsl.h | 210 + curl/include/libssh2.h | 1516 +++ curl/include/libssh2_publickey.h | 128 + curl/include/libssh2_sftp.h | 382 + curl/include/nghttp2/nghttp2.h | 6838 +++++++++++ curl/include/nghttp2/nghttp2ver.h | 42 + curl/include/nghttp3/nghttp3.h | 2939 +++++ curl/include/nghttp3/version.h | 46 + curl/include/ngtcp2/ngtcp2.h | 5969 +++++++++ curl/include/ngtcp2/ngtcp2_crypto.h | 963 ++ curl/include/ngtcp2/ngtcp2_crypto_quictls.h | 147 + curl/include/ngtcp2/version.h | 51 + curl/include/openssl/aes.h | 120 + curl/include/openssl/asn1.h | 1124 ++ curl/include/openssl/asn1t.h | 904 ++ curl/include/openssl/bio.h | 717 ++ curl/include/openssl/blowfish.h | 106 + curl/include/openssl/bn.h | 520 + curl/include/openssl/buffer.h | 102 + curl/include/openssl/camellia.h | 121 + curl/include/openssl/cast.h | 99 + curl/include/openssl/chacha.h | 54 + curl/include/openssl/cmac.h | 81 + curl/include/openssl/cms.h | 534 + curl/include/openssl/comp.h | 7 + curl/include/openssl/conf.h | 189 + curl/include/openssl/crypto.h | 458 + curl/include/openssl/ct.h | 567 + curl/include/openssl/curve25519.h | 104 + curl/include/openssl/des.h | 206 + curl/include/openssl/dh.h | 245 + curl/include/openssl/dsa.h | 263 + curl/include/openssl/dtls1.h | 107 + curl/include/openssl/ec.h | 675 + curl/include/openssl/ecdh.h | 6 + curl/include/openssl/ecdsa.h | 6 + curl/include/openssl/engine.h | 215 + curl/include/openssl/err.h | 396 + curl/include/openssl/evp.h | 1292 ++ curl/include/openssl/hkdf.h | 65 + curl/include/openssl/hmac.h | 101 + curl/include/openssl/idea.h | 94 + curl/include/openssl/kdf.h | 137 + curl/include/openssl/lhash.h | 179 + curl/include/openssl/md4.h | 105 + curl/include/openssl/md5.h | 99 + curl/include/openssl/modes.h | 118 + curl/include/openssl/obj_mac.h | 4643 +++++++ curl/include/openssl/objects.h | 137 + curl/include/openssl/ocsp.h | 484 + curl/include/openssl/opensslconf.h | 149 + curl/include/openssl/opensslfeatures.h | 153 + curl/include/openssl/opensslv.h | 18 + curl/include/openssl/ossl_typ.h | 196 + curl/include/openssl/pem.h | 546 + curl/include/openssl/pkcs12.h | 284 + curl/include/openssl/pkcs7.h | 522 + curl/include/openssl/poly1305.h | 45 + curl/include/openssl/posix_time.h | 54 + curl/include/openssl/rand.h | 118 + curl/include/openssl/rc2.h | 96 + curl/include/openssl/rc4.h | 83 + curl/include/openssl/ripemd.h | 107 + curl/include/openssl/rsa.h | 603 + curl/include/openssl/safestack.h | 1739 +++ curl/include/openssl/sha.h | 190 + curl/include/openssl/sm3.h | 49 + curl/include/openssl/sm4.h | 47 + curl/include/openssl/srtp.h | 148 + curl/include/openssl/ssl.h | 2343 ++++ curl/include/openssl/ssl3.h | 441 + curl/include/openssl/stack.h | 99 + curl/include/openssl/tls1.h | 764 ++ curl/include/openssl/ts.h | 660 + curl/include/openssl/txt_db.h | 112 + curl/include/openssl/ui.h | 397 + curl/include/openssl/x509.h | 1053 ++ curl/include/openssl/x509_vfy.h | 463 + curl/include/openssl/x509v3.h | 1041 ++ curl/include/zconf.h | 206 + curl/include/zdict.h | 481 + curl/include/zlib.h | 1859 +++ curl/include/zlib_name_mangling.h | 8 + curl/include/zstd.h | 3198 +++++ curl/include/zstd_errors.h | 107 + curl/lib/libbrotlicommon.a | Bin 0 -> 134894 bytes curl/lib/libbrotlidec.a | Bin 0 -> 57530 bytes curl/lib/libcrypto.a | Bin 0 -> 3402990 bytes curl/lib/libcurl.a | Bin 0 -> 1859298 bytes curl/lib/libcurl.dll.a | Bin 0 -> 21386 bytes curl/lib/libnghttp2.a | Bin 0 -> 303960 bytes curl/lib/libnghttp3.a | Bin 0 -> 262600 bytes curl/lib/libngtcp2.a | Bin 0 -> 484062 bytes curl/lib/libngtcp2_crypto_quictls.a | Bin 0 -> 45570 bytes curl/lib/libpsl.a | Bin 0 -> 69072 bytes curl/lib/libssh2.a | Bin 0 -> 450518 bytes curl/lib/libssl.a | Bin 0 -> 694208 bytes curl/lib/libz.a | Bin 0 -> 226094 bytes curl/lib/libzstd.a | Bin 0 -> 867656 bytes curl/mk-ca-bundle.pl | 667 + main.cpp | 3 + 323 files changed, 114579 insertions(+) create mode 100644 curl/BUILD-HASHES.txt create mode 100644 curl/BUILD-MANIFEST.txt create mode 100644 curl/BUILD-README.url create mode 100644 curl/COPYING.txt create mode 100644 curl/README.txt create mode 100644 curl/RELEASE-NOTES.txt create mode 100644 curl/dep/brotli/LICENSE.txt create mode 100644 curl/dep/brotli/README.md create mode 100644 curl/dep/cacert/LICENSE.url create mode 100644 curl/dep/libpsl/AUTHORS.txt create mode 100644 curl/dep/libpsl/COPYING.txt create mode 100644 curl/dep/libpsl/NEWS.txt create mode 100644 curl/dep/libressl/COPYING.txt create mode 100644 curl/dep/libressl/ChangeLog.txt create mode 100644 curl/dep/libressl/README.md create mode 100644 curl/dep/libssh2/COPYING.txt create mode 100644 curl/dep/libssh2/NEWS.txt create mode 100644 curl/dep/libssh2/README.txt create mode 100644 curl/dep/libssh2/RELEASE-NOTES.txt create mode 100644 curl/dep/libssh2/docs/AUTHORS.txt create mode 100644 curl/dep/libssh2/docs/HACKING-CRYPTO.txt create mode 100644 curl/dep/libssh2/docs/INSTALL_AUTOTOOLS.txt create mode 100644 curl/dep/libssh2/docs/TODO.txt create mode 100644 curl/dep/nghttp2/AUTHORS.txt create mode 100644 curl/dep/nghttp2/COPYING.txt create mode 100644 curl/dep/nghttp2/ChangeLog.txt create mode 100644 curl/dep/nghttp2/README.rst create mode 100644 curl/dep/nghttp3/AUTHORS.txt create mode 100644 curl/dep/nghttp3/COPYING.txt create mode 100644 curl/dep/nghttp3/ChangeLog.txt create mode 100644 curl/dep/nghttp3/README.rst create mode 100644 curl/dep/ngtcp2/AUTHORS.txt create mode 100644 curl/dep/ngtcp2/COPYING.txt create mode 100644 curl/dep/ngtcp2/ChangeLog.txt create mode 100644 curl/dep/ngtcp2/README.rst create mode 100644 curl/dep/zlibng/LICENSE.md create mode 100644 curl/dep/zlibng/README.md create mode 100644 curl/dep/zstd/CHANGELOG.txt create mode 100644 curl/dep/zstd/LICENSE.txt create mode 100644 curl/dep/zstd/README.md create mode 100644 curl/docs/ALTSVC.md create mode 100644 curl/docs/BINDINGS.md create mode 100644 curl/docs/BUG-BOUNTY.md create mode 100644 curl/docs/BUGS.md create mode 100644 curl/docs/CIPHERS-TLS12.md create mode 100644 curl/docs/CIPHERS.md create mode 100644 curl/docs/CODE_OF_CONDUCT.md create mode 100644 curl/docs/CODE_REVIEW.md create mode 100644 curl/docs/CONTRIBUTE.md create mode 100644 curl/docs/CURL-DISABLE.md create mode 100644 curl/docs/CURLDOWN.md create mode 100644 curl/docs/DEPRECATE.md create mode 100644 curl/docs/DISTROS.md create mode 100644 curl/docs/EARLY-RELEASE.md create mode 100644 curl/docs/ECH.md create mode 100644 curl/docs/EXPERIMENTAL.md create mode 100644 curl/docs/FAQ.txt create mode 100644 curl/docs/FEATURES.md create mode 100644 curl/docs/GOVERNANCE.md create mode 100644 curl/docs/HELP-US.md create mode 100644 curl/docs/HISTORY.md create mode 100644 curl/docs/HSTS.md create mode 100644 curl/docs/HTTP-COOKIES.md create mode 100644 curl/docs/HTTP3.md create mode 100644 curl/docs/HTTPSRR.md create mode 100644 curl/docs/INFRASTRUCTURE.md create mode 100644 curl/docs/INSTALL-CMAKE.md create mode 100644 curl/docs/INSTALL.md create mode 100644 curl/docs/INSTALL.txt create mode 100644 curl/docs/INTERNALS.md create mode 100644 curl/docs/IPFS.md create mode 100644 curl/docs/KNOWN_BUGS.txt create mode 100644 curl/docs/MAIL-ETIQUETTE.md create mode 100644 curl/docs/MANUAL.md create mode 100644 curl/docs/README.md create mode 100644 curl/docs/RELEASE-PROCEDURE.md create mode 100644 curl/docs/RELEASE-TOOLS.md create mode 100644 curl/docs/ROADMAP.md create mode 100644 curl/docs/RUSTLS.md create mode 100644 curl/docs/SECURITY-ADVISORY.md create mode 100644 curl/docs/SPONSORS.md create mode 100644 curl/docs/SSL-PROBLEMS.md create mode 100644 curl/docs/SSLCERTS.md create mode 100644 curl/docs/THANKS.txt create mode 100644 curl/docs/TODO.txt create mode 100644 curl/docs/TheArtOfHttpScripting.md create mode 100644 curl/docs/URL-SYNTAX.md create mode 100644 curl/docs/VERSIONS.md create mode 100644 curl/docs/VULN-DISCLOSURE-POLICY.md create mode 100644 curl/docs/curl-config.md create mode 100644 curl/docs/examples/10-at-a-time.c create mode 100644 curl/docs/examples/address-scope.c create mode 100644 curl/docs/examples/altsvc.c create mode 100644 curl/docs/examples/anyauthput.c create mode 100644 curl/docs/examples/block_ip.c create mode 100644 curl/docs/examples/certinfo.c create mode 100644 curl/docs/examples/chkspeed.c create mode 100644 curl/docs/examples/connect-to.c create mode 100644 curl/docs/examples/cookie_interface.c create mode 100644 curl/docs/examples/debug.c create mode 100644 curl/docs/examples/default-scheme.c create mode 100644 curl/docs/examples/externalsocket.c create mode 100644 curl/docs/examples/fileupload.c create mode 100644 curl/docs/examples/ftp-wildcard.c create mode 100644 curl/docs/examples/ftpget.c create mode 100644 curl/docs/examples/ftpgetinfo.c create mode 100644 curl/docs/examples/ftpgetresp.c create mode 100644 curl/docs/examples/ftpsget.c create mode 100644 curl/docs/examples/ftpupload.c create mode 100644 curl/docs/examples/ftpuploadfrommem.c create mode 100644 curl/docs/examples/ftpuploadresume.c create mode 100644 curl/docs/examples/getinfo.c create mode 100644 curl/docs/examples/getinmemory.c create mode 100644 curl/docs/examples/getredirect.c create mode 100644 curl/docs/examples/getreferrer.c create mode 100644 curl/docs/examples/headerapi.c create mode 100644 curl/docs/examples/hsts-preload.c create mode 100644 curl/docs/examples/http-options.c create mode 100644 curl/docs/examples/http-post.c create mode 100644 curl/docs/examples/http2-download.c create mode 100644 curl/docs/examples/http2-pushinmemory.c create mode 100644 curl/docs/examples/http2-serverpush.c create mode 100644 curl/docs/examples/http2-upload.c create mode 100644 curl/docs/examples/http3-present.c create mode 100644 curl/docs/examples/http3.c create mode 100644 curl/docs/examples/httpcustomheader.c create mode 100644 curl/docs/examples/httpput-postfields.c create mode 100644 curl/docs/examples/httpput.c create mode 100644 curl/docs/examples/https.c create mode 100644 curl/docs/examples/imap-append.c create mode 100644 curl/docs/examples/imap-authzid.c create mode 100644 curl/docs/examples/imap-copy.c create mode 100644 curl/docs/examples/imap-create.c create mode 100644 curl/docs/examples/imap-delete.c create mode 100644 curl/docs/examples/imap-examine.c create mode 100644 curl/docs/examples/imap-fetch.c create mode 100644 curl/docs/examples/imap-list.c create mode 100644 curl/docs/examples/imap-lsub.c create mode 100644 curl/docs/examples/imap-multi.c create mode 100644 curl/docs/examples/imap-noop.c create mode 100644 curl/docs/examples/imap-search.c create mode 100644 curl/docs/examples/imap-ssl.c create mode 100644 curl/docs/examples/imap-store.c create mode 100644 curl/docs/examples/imap-tls.c create mode 100644 curl/docs/examples/interface.c create mode 100644 curl/docs/examples/ipv6.c create mode 100644 curl/docs/examples/keepalive.c create mode 100644 curl/docs/examples/localport.c create mode 100644 curl/docs/examples/maxconnects.c create mode 100644 curl/docs/examples/multi-app.c create mode 100644 curl/docs/examples/multi-debugcallback.c create mode 100644 curl/docs/examples/multi-double.c create mode 100644 curl/docs/examples/multi-formadd.c create mode 100644 curl/docs/examples/multi-legacy.c create mode 100644 curl/docs/examples/multi-post.c create mode 100644 curl/docs/examples/multi-single.c create mode 100644 curl/docs/examples/netrc.c create mode 100644 curl/docs/examples/parseurl.c create mode 100644 curl/docs/examples/persistent.c create mode 100644 curl/docs/examples/pop3-authzid.c create mode 100644 curl/docs/examples/pop3-dele.c create mode 100644 curl/docs/examples/pop3-list.c create mode 100644 curl/docs/examples/pop3-multi.c create mode 100644 curl/docs/examples/pop3-noop.c create mode 100644 curl/docs/examples/pop3-retr.c create mode 100644 curl/docs/examples/pop3-ssl.c create mode 100644 curl/docs/examples/pop3-stat.c create mode 100644 curl/docs/examples/pop3-tls.c create mode 100644 curl/docs/examples/pop3-top.c create mode 100644 curl/docs/examples/pop3-uidl.c create mode 100644 curl/docs/examples/post-callback.c create mode 100644 curl/docs/examples/postinmemory.c create mode 100644 curl/docs/examples/postit2-formadd.c create mode 100644 curl/docs/examples/postit2.c create mode 100644 curl/docs/examples/progressfunc.c create mode 100644 curl/docs/examples/protofeats.c create mode 100644 curl/docs/examples/range.c create mode 100644 curl/docs/examples/resolve.c create mode 100644 curl/docs/examples/rtsp-options.c create mode 100644 curl/docs/examples/sendrecv.c create mode 100644 curl/docs/examples/sepheaders.c create mode 100644 curl/docs/examples/sftpget.c create mode 100644 curl/docs/examples/sftpuploadresume.c create mode 100644 curl/docs/examples/shared-connection-cache.c create mode 100644 curl/docs/examples/simple.c create mode 100644 curl/docs/examples/simplepost.c create mode 100644 curl/docs/examples/simplessl.c create mode 100644 curl/docs/examples/smtp-authzid.c create mode 100644 curl/docs/examples/smtp-expn.c create mode 100644 curl/docs/examples/smtp-mail.c create mode 100644 curl/docs/examples/smtp-mime.c create mode 100644 curl/docs/examples/smtp-multi.c create mode 100644 curl/docs/examples/smtp-ssl.c create mode 100644 curl/docs/examples/smtp-tls.c create mode 100644 curl/docs/examples/smtp-vrfy.c create mode 100644 curl/docs/examples/sslbackend.c create mode 100644 curl/docs/examples/unixsocket.c create mode 100644 curl/docs/examples/url2file.c create mode 100644 curl/docs/examples/urlapi.c create mode 100644 curl/docs/examples/websocket-cb.c create mode 100644 curl/docs/examples/websocket.c create mode 100644 curl/docs/libcurl/symbols-in-versions.txt create mode 100644 curl/docs/mk-ca-bundle.md create mode 100644 curl/docs/options-in-versions.txt create mode 100644 curl/docs/wcurl.md create mode 100644 curl/include/brotli/decode.h create mode 100644 curl/include/brotli/encode.h create mode 100644 curl/include/brotli/port.h create mode 100644 curl/include/brotli/shared_dictionary.h create mode 100644 curl/include/brotli/types.h create mode 100644 curl/include/curl/curl.h create mode 100644 curl/include/curl/curlver.h create mode 100644 curl/include/curl/easy.h create mode 100644 curl/include/curl/header.h create mode 100644 curl/include/curl/mprintf.h create mode 100644 curl/include/curl/multi.h create mode 100644 curl/include/curl/options.h create mode 100644 curl/include/curl/stdcheaders.h create mode 100644 curl/include/curl/system.h create mode 100644 curl/include/curl/typecheck-gcc.h create mode 100644 curl/include/curl/urlapi.h create mode 100644 curl/include/curl/websockets.h create mode 100644 curl/include/libpsl.h create mode 100644 curl/include/libssh2.h create mode 100644 curl/include/libssh2_publickey.h create mode 100644 curl/include/libssh2_sftp.h create mode 100644 curl/include/nghttp2/nghttp2.h create mode 100644 curl/include/nghttp2/nghttp2ver.h create mode 100644 curl/include/nghttp3/nghttp3.h create mode 100644 curl/include/nghttp3/version.h create mode 100644 curl/include/ngtcp2/ngtcp2.h create mode 100644 curl/include/ngtcp2/ngtcp2_crypto.h create mode 100644 curl/include/ngtcp2/ngtcp2_crypto_quictls.h create mode 100644 curl/include/ngtcp2/version.h create mode 100644 curl/include/openssl/aes.h create mode 100644 curl/include/openssl/asn1.h create mode 100644 curl/include/openssl/asn1t.h create mode 100644 curl/include/openssl/bio.h create mode 100644 curl/include/openssl/blowfish.h create mode 100644 curl/include/openssl/bn.h create mode 100644 curl/include/openssl/buffer.h create mode 100644 curl/include/openssl/camellia.h create mode 100644 curl/include/openssl/cast.h create mode 100644 curl/include/openssl/chacha.h create mode 100644 curl/include/openssl/cmac.h create mode 100644 curl/include/openssl/cms.h create mode 100644 curl/include/openssl/comp.h create mode 100644 curl/include/openssl/conf.h create mode 100644 curl/include/openssl/crypto.h create mode 100644 curl/include/openssl/ct.h create mode 100644 curl/include/openssl/curve25519.h create mode 100644 curl/include/openssl/des.h create mode 100644 curl/include/openssl/dh.h create mode 100644 curl/include/openssl/dsa.h create mode 100644 curl/include/openssl/dtls1.h create mode 100644 curl/include/openssl/ec.h create mode 100644 curl/include/openssl/ecdh.h create mode 100644 curl/include/openssl/ecdsa.h create mode 100644 curl/include/openssl/engine.h create mode 100644 curl/include/openssl/err.h create mode 100644 curl/include/openssl/evp.h create mode 100644 curl/include/openssl/hkdf.h create mode 100644 curl/include/openssl/hmac.h create mode 100644 curl/include/openssl/idea.h create mode 100644 curl/include/openssl/kdf.h create mode 100644 curl/include/openssl/lhash.h create mode 100644 curl/include/openssl/md4.h create mode 100644 curl/include/openssl/md5.h create mode 100644 curl/include/openssl/modes.h create mode 100644 curl/include/openssl/obj_mac.h create mode 100644 curl/include/openssl/objects.h create mode 100644 curl/include/openssl/ocsp.h create mode 100644 curl/include/openssl/opensslconf.h create mode 100644 curl/include/openssl/opensslfeatures.h create mode 100644 curl/include/openssl/opensslv.h create mode 100644 curl/include/openssl/ossl_typ.h create mode 100644 curl/include/openssl/pem.h create mode 100644 curl/include/openssl/pkcs12.h create mode 100644 curl/include/openssl/pkcs7.h create mode 100644 curl/include/openssl/poly1305.h create mode 100644 curl/include/openssl/posix_time.h create mode 100644 curl/include/openssl/rand.h create mode 100644 curl/include/openssl/rc2.h create mode 100644 curl/include/openssl/rc4.h create mode 100644 curl/include/openssl/ripemd.h create mode 100644 curl/include/openssl/rsa.h create mode 100644 curl/include/openssl/safestack.h create mode 100644 curl/include/openssl/sha.h create mode 100644 curl/include/openssl/sm3.h create mode 100644 curl/include/openssl/sm4.h create mode 100644 curl/include/openssl/srtp.h create mode 100644 curl/include/openssl/ssl.h create mode 100644 curl/include/openssl/ssl3.h create mode 100644 curl/include/openssl/stack.h create mode 100644 curl/include/openssl/tls1.h create mode 100644 curl/include/openssl/ts.h create mode 100644 curl/include/openssl/txt_db.h create mode 100644 curl/include/openssl/ui.h create mode 100644 curl/include/openssl/x509.h create mode 100644 curl/include/openssl/x509_vfy.h create mode 100644 curl/include/openssl/x509v3.h create mode 100644 curl/include/zconf.h create mode 100644 curl/include/zdict.h create mode 100644 curl/include/zlib.h create mode 100644 curl/include/zlib_name_mangling.h create mode 100644 curl/include/zstd.h create mode 100644 curl/include/zstd_errors.h create mode 100644 curl/lib/libbrotlicommon.a create mode 100644 curl/lib/libbrotlidec.a create mode 100644 curl/lib/libcrypto.a create mode 100644 curl/lib/libcurl.a create mode 100644 curl/lib/libcurl.dll.a create mode 100644 curl/lib/libnghttp2.a create mode 100644 curl/lib/libnghttp3.a create mode 100644 curl/lib/libngtcp2.a create mode 100644 curl/lib/libngtcp2_crypto_quictls.a create mode 100644 curl/lib/libpsl.a create mode 100644 curl/lib/libssh2.a create mode 100644 curl/lib/libssl.a create mode 100644 curl/lib/libz.a create mode 100644 curl/lib/libzstd.a create mode 100644 curl/mk-ca-bundle.pl diff --git a/curl/BUILD-HASHES.txt b/curl/BUILD-HASHES.txt new file mode 100644 index 0000000..59548d6 --- /dev/null +++ b/curl/BUILD-HASHES.txt @@ -0,0 +1,120 @@ +SHA2-256(./bin/curl-ca-bundle.crt)= ab3ee3651977a4178a702b0b828a4ee7b2bbb9127235b0ab740e2e15974bf5db +SHA2-256(./bin/curl.exe)= 57ae04dfc5c82dce19b1241d88e45e21b0a3307aa432f7e090295441b4e6c375 +SHA2-256(./bin/libcurl-x64.def)= fc8449996b7661b9ae9c0ed67c847f1c7241a9ef3db717a5d578012f34fb00da +SHA2-256(./bin/libcurl-x64.dll)= 3027a2941b76e9127ac95fd27b603b30cf401dbe30786c51113c985b79c53a28 +SHA2-256(./include/brotli/decode.h)= 20d0a87a96bc25a3af7557075be87be4393e88a5fb564db08e92884dee17d841 +SHA2-256(./include/brotli/encode.h)= 3403a597eff24ff45903128feb471e4dd5138f624104ebe058a9d90ed905550c +SHA2-256(./include/brotli/port.h)= d87dae6cce00aff76192a1db4fedc2a817967e14e652829349b8a75088f9e467 +SHA2-256(./include/brotli/shared_dictionary.h)= 86230f0aaf533044d85d92f84b5aec8b7e4e231d4b64b098604083e7866e8097 +SHA2-256(./include/brotli/types.h)= 96c9330e790aa6fe53f4cdd328d0a4b98e361b82913baa3219db73aadb11272c +SHA2-256(./include/curl/curl.h)= 6452473ab94ffe4a15f148b94c2b9f6b9faadc55a541923d974471d3e5273696 +SHA2-256(./include/curl/curlver.h)= b5f1670b94bdc5f60501bbe9cf24fcabaa9fa88ec8f81f77e51443bfc82a46fb +SHA2-256(./include/curl/easy.h)= 3a9a663e57fa4104ae479e513a41d99b069f735543d118c90f73c5b5b0f37291 +SHA2-256(./include/curl/header.h)= 614be48a86f4e5d304c5aa40ef1c85245e25b97732921c3631840146669d992f +SHA2-256(./include/curl/mprintf.h)= 5254b33e5e351298cdc25303381edc15889a41e129d41821bbd186dc2ddcbd40 +SHA2-256(./include/curl/multi.h)= 83ae673f7655768bf70b141c9cf845b09695aa801d4d1d56362c3928c38e397c +SHA2-256(./include/curl/options.h)= 5716018d27e783283825bed2a8a051190487722fdeb64b7aa2d03a997e99b8d1 +SHA2-256(./include/curl/stdcheaders.h)= d7588b86814a35ffc3766ff6242e6f6705e04401fc9c208a195caff3503af81c +SHA2-256(./include/curl/system.h)= ad9637bbe3988e08745b9a6edf53b9651b240cd15b60da60e54ac7c61439cc57 +SHA2-256(./include/curl/typecheck-gcc.h)= 907a5e676377c5a4849d55bc38614b21750e85f7278cb057daedb1f9fc2e7918 +SHA2-256(./include/curl/urlapi.h)= 4366e8eead1d92742c679b14dd3c65b92087226e1cebecc7803d619eded6a868 +SHA2-256(./include/curl/websockets.h)= e5e4883b6de1a62d28cbfad75b45e4a428e160871715ebc34dc696b7c38efb48 +SHA2-256(./include/libpsl.h)= c18414f8fbcf2c16ce4cf4038dd27a0e8b64d8dc9c117d5b982016d830852f4e +SHA2-256(./include/libssh2.h)= 86cc9fcfd0daa10ba25442e5ecea23db618027362bc85fdc591ec7f5d9d39a91 +SHA2-256(./include/libssh2_publickey.h)= f1cd086f3950e65635827ee3332c1c6ca62887c0f84369ec58e31974debb36e9 +SHA2-256(./include/libssh2_sftp.h)= b5d864f19af69521278ed953b20b76a32cfdc08014da81d38f59964e7e2e2575 +SHA2-256(./include/nghttp2/nghttp2.h)= 711ec7c2f6851f6c744cc54e279bdda113824adbd0e4e7d8a62703ca9c7b90ec +SHA2-256(./include/nghttp2/nghttp2ver.h)= d487680fae998aedc5527ea49a264a1d2ffbf850700510ab1bbf17645b1be168 +SHA2-256(./include/nghttp3/nghttp3.h)= 0105d267ae01429f21fa45966652d5df6f7dc37a66ba0e6108ec3cd0b0785741 +SHA2-256(./include/nghttp3/version.h)= bea9967f40d23eb49e9d15abc02866344330150d8ab9ce7ef77cc8afa6f61976 +SHA2-256(./include/ngtcp2/ngtcp2.h)= 29b826058cdd7124d140dc1df37a02cced4ca483efde3fadb9dd52fde8fb126f +SHA2-256(./include/ngtcp2/ngtcp2_crypto.h)= 998aed2a9b3c866ca1fb29aa766f2d1eaeebb58aa79dc9335c8fa40eb0f60886 +SHA2-256(./include/ngtcp2/ngtcp2_crypto_quictls.h)= 1790e0356644fe51c2239839c68cd1ded53cd729b4730c6f7068db14845216b2 +SHA2-256(./include/ngtcp2/version.h)= 12f43f12ce8463922e49288d94f90d249249077a6d12803f87154f6ec97401c0 +SHA2-256(./include/openssl/aes.h)= 61a5846af3aabc2eaf0fffd0109b82982d6e70c2e58a874e0713907d2c649dec +SHA2-256(./include/openssl/asn1.h)= 687538926de7e7abb5e633e496352f28cd8850bcfa6299f80f460f1166a511f3 +SHA2-256(./include/openssl/asn1t.h)= ff2f110c85b1389ebed09059eb47a5337cc57c67c4e84bd7ae897124886c27fc +SHA2-256(./include/openssl/bio.h)= 1bcab470bff5f8834effa967eea18ef1a2cf70c2cefb9d5d00f5b85e0d8d6ff0 +SHA2-256(./include/openssl/blowfish.h)= 436eea2ac8bd10f5bfd320bb11bfdd1c982bfdaac507f45db6a064915fc2ca17 +SHA2-256(./include/openssl/bn.h)= 4331c86e4e8b3ea9e1bac19a648b71926001e91f7e37b3be29c8012a8a918a7e +SHA2-256(./include/openssl/buffer.h)= a60e861037ec534a80289dce8a5fda46ef72cb3248a29fdc86bd12559c0dfb93 +SHA2-256(./include/openssl/camellia.h)= 8dc3a54e09392f539b38a6dabcd54daed7bec233de0b42b3d81986a58bc8d033 +SHA2-256(./include/openssl/cast.h)= 3abc7cd1651f36958c013c12934119e545633be4a1c80c79dfc124690d24cfc9 +SHA2-256(./include/openssl/chacha.h)= df0728ed1a2678969a7a40a83290a26173b396154a873f2d408343a4ef0d34c7 +SHA2-256(./include/openssl/cmac.h)= 1e298a02b96233ae382ff8fad42ec6b7e04bdbc62ee7faab3479dbe7c7962c7e +SHA2-256(./include/openssl/cms.h)= df710537b6d99b10ff98576c89def33a8bfe4d0c7781da41a6f35932a6669622 +SHA2-256(./include/openssl/comp.h)= 827b2d6d9ddebb4345aef8ff92e4a350e7bfa01de0f684fadf354ff891389f97 +SHA2-256(./include/openssl/conf.h)= 49e7d1603fc727d252b9f876f2ebe0fbfcfd2ff238ed55d922747b70f62666b2 +SHA2-256(./include/openssl/crypto.h)= 0e3cc0d17c8adccefec9494cafd6db230df62f504edee93e5b4c900e7b91bbce +SHA2-256(./include/openssl/ct.h)= 059a0cf146e35736dac7c2d34ad344f8b00fe364324112de4fe1c7a10a13edc3 +SHA2-256(./include/openssl/curve25519.h)= d7534da0a98ef1827761beae60ca00d67b1acc0c6977e919591401f2777dd4d2 +SHA2-256(./include/openssl/des.h)= c8ea5e61f053b10cf55f20b4d7c9b9481acd17c07b096cf75e56809add2a37c4 +SHA2-256(./include/openssl/dh.h)= 8f4ec3a8703935fab16ddddbf4a6ea9214a41cc8a16cf4833643ca69cc06bf50 +SHA2-256(./include/openssl/dsa.h)= ee29903a3f30967ad3e0e7b260d41fc92c5c5e7f3985e98346c2ce40ba872b6b +SHA2-256(./include/openssl/dtls1.h)= 9c9837a45861f79f4ecd54761bc74aa503265778be1dd76c68433d7994fabb3b +SHA2-256(./include/openssl/ec.h)= 3b2a21eadbed07db95a825aedca03d14410c1211b3e7f0acb5e170050253d1b9 +SHA2-256(./include/openssl/ecdh.h)= bfef80e1a0152c23c29a04323302c6a592e55104a5add4c458301ef1da45bade +SHA2-256(./include/openssl/ecdsa.h)= 298d675ce2985b1ba12d7da1245fbc5327f193dc3a477a9aada2208162fdd542 +SHA2-256(./include/openssl/engine.h)= e8bfa460b4ab7f443e1e43151f814db001d0c6c2a6f5d692b1d4ec8e9035ca76 +SHA2-256(./include/openssl/err.h)= 36756914d0c756c4bfbd30a02372eff0f41fcdca7d6e1e5e9b727d492d5af72b +SHA2-256(./include/openssl/evp.h)= 153c2259c8de3e848b9bf7f3829f09125aee342289f47ed59fa17d10e16758e7 +SHA2-256(./include/openssl/hkdf.h)= 47294d3c2c3df67590090a7262032d2ed83a249d053f9c81be01878faffdc4d2 +SHA2-256(./include/openssl/hmac.h)= 69eb59fcb034781a014a11f8d2c22335ac32a37cb4a6887ca466f8233da8beb9 +SHA2-256(./include/openssl/idea.h)= 610d9932439efb64d8898938d4b044e608ed16ed1ad0754ae4925ea32b8b8a08 +SHA2-256(./include/openssl/kdf.h)= c7ecfc60364c4a47d86fb55c6087f4c8e8ae59b9ee60b9fce7e4c70c7d903141 +SHA2-256(./include/openssl/lhash.h)= 053f21efa3da78055e2763b90fd69a4b810606c91b36bbc055290685eeee6f71 +SHA2-256(./include/openssl/md4.h)= 8dc31cf435f33e35905a6369f5a87591ad176c5c4df5ce0913b30ff5965568ed +SHA2-256(./include/openssl/md5.h)= 20a6ed75c52e68e82438140604f921e04367a148814c494e222117b327040c5d +SHA2-256(./include/openssl/modes.h)= a8993a5bdfad225b207971039657000250b3239d7ca095238fabb895d73bafc6 +SHA2-256(./include/openssl/obj_mac.h)= 4270ca80a060fdcaf77e31ce3dcd85ed92cceeb23aed7a6af8d92c84aff54075 +SHA2-256(./include/openssl/objects.h)= dcf127aedcc6a9fbf4abc6dfacbf6d234a003d5c390025f4785c3407cbe99cf2 +SHA2-256(./include/openssl/ocsp.h)= 74bf587344a632fee6721e93a3991de1c5cdafe762fc7ff3d22ea614ea8505f7 +SHA2-256(./include/openssl/opensslconf.h)= 12907133aec34951c7154f85b0a4b716dd9f8522e1f88935e971b7e32e100293 +SHA2-256(./include/openssl/opensslfeatures.h)= b6cb250da81ac43dfe8fe76f512f7b4ee81c036a76a98a0f9f656bcf218d86e7 +SHA2-256(./include/openssl/opensslv.h)= 223b94f36e5212aa3ea042e56ef39787f6ec316f9e622bcba0fb5c48907598be +SHA2-256(./include/openssl/ossl_typ.h)= 74a337679d1a99aee06bdd11a3b7d814932f0ed772a1c09cbf799c6b7297158c +SHA2-256(./include/openssl/pem.h)= fd8e0bf923e6878d03a07b6401266a6cff4089082dca60db3426b8640fb5e6f6 +SHA2-256(./include/openssl/pkcs12.h)= 144bf41de4f93ddcbfb44a3ebb82611e776205d744524a94c2c760dea6c997be +SHA2-256(./include/openssl/pkcs7.h)= 4966b5892e545b20553ca746739dba0d4a1a6684934433d7eb095984ad2edf56 +SHA2-256(./include/openssl/poly1305.h)= b751992c10df319c0309b31e0206aad4597edc9d1496267002b433537419e7ec +SHA2-256(./include/openssl/posix_time.h)= 9b403139b6e0a2212b5c3ad5d387631f19f5bec74d8831d3fc4c3ab34f58840b +SHA2-256(./include/openssl/rand.h)= 9e4957207431d97886e6589aef8ce9cd15579bda226baf5c980dcb47876068cd +SHA2-256(./include/openssl/rc2.h)= a6bccbf74dd468343b127f80f1d04f69680860d5283c85a460325969bdf50e76 +SHA2-256(./include/openssl/rc4.h)= e4b7f178300a7978f5904f06b559569c9aef128adf65dcd2b2a686ce36c439ed +SHA2-256(./include/openssl/ripemd.h)= 4c2c3459de4a53949fb92dba4fc76b253deaea6ca673b8150f2031b16031534f +SHA2-256(./include/openssl/rsa.h)= 2c14f09faefcd786eb62aa1343524dc94714b7962c790d145f5317fea94f74da +SHA2-256(./include/openssl/safestack.h)= 3ba8e3cf36e174528a5d581dfa897012dba82d820d2da07b2e4705ec6547ad22 +SHA2-256(./include/openssl/sha.h)= 0c0076f1213121540ea71da9d583262b09ed02a113e26d84b28efee621a3492f +SHA2-256(./include/openssl/sm3.h)= dfc2175a2ed2d8a7ae3cd867f989fb154f1f8652564a97e3080f575835ec733f +SHA2-256(./include/openssl/sm4.h)= 6030457a506d6fbde00aebbff45b345a831a0673f4517bc278f7d5f72cf482ea +SHA2-256(./include/openssl/srtp.h)= ae58c4d9c667f74b8f3c44039072c6d45232a2af09539c414028aa6e9eb57f90 +SHA2-256(./include/openssl/ssl.h)= d3956af6322899a607665a5a4841ad69aac79a4fe66835024787afdd6b927f45 +SHA2-256(./include/openssl/ssl3.h)= 1b874f840ab4a34ff78de5009bf432e42d088716c17c43b6e45bbfde58d6c30a +SHA2-256(./include/openssl/stack.h)= cec4d77b15c66fcbadc05d6946ad6fb8a77430472302798ac25b52aeaa990b92 +SHA2-256(./include/openssl/tls1.h)= 70a7c812a910dbe74a36a2725596413ed9da2a22e805de65b714d5346f2689bf +SHA2-256(./include/openssl/ts.h)= 28cb12962438d5c655fe5a46cad53e9f4a334497d4411446d5974601485a28cc +SHA2-256(./include/openssl/txt_db.h)= 7c50364dd59d167b14db35ff210327d57cabfb14be2ae40e440de2aad14d5b27 +SHA2-256(./include/openssl/ui.h)= 42762d29440f35fc4bfac041716a7e4d6034e74b3a1f8b77ff4e7074ea6784dd +SHA2-256(./include/openssl/x509.h)= 0f8c800eef16ae00047f8a01f97dc48b8489e814c965340e562197278187dbe4 +SHA2-256(./include/openssl/x509_vfy.h)= aa9c34d6eb48543408cb97a9859a7c40bddaaa0d903d2c678d4cb0b9e3834321 +SHA2-256(./include/openssl/x509v3.h)= ba90f7955cb292501715d0d0756d5b057a06c6afaaab95a3fa6780ac9c99458a +SHA2-256(./include/zconf.h)= dcb0a2b20ac38181012fbc430d1c229cf6eb7758ce8ab26a618c8a0808c3e76e +SHA2-256(./include/zdict.h)= abacadb94e3f79e591f4b1648e839b0160fbf4291211fd01bdba1380269b245c +SHA2-256(./include/zlib.h)= 0f502ab19b9200f6c390945c0fc860816fd0a082e6a01925f7322564f9445565 +SHA2-256(./include/zlib_name_mangling.h)= 38e51a846d6c2bd6100298c55328dba4437c08fa1dceda4eb2e06ecb1d142058 +SHA2-256(./include/zstd.h)= 9b4bc8245565c98ccfc61c07749928b57e7c0f6fddb0530c4f6aa1971893d88b +SHA2-256(./include/zstd_errors.h)= 66a8c3f71d12ea6e797e4f622f31f3f8f81c41b36f48cad4f5de7d8bfb6aac0a +SHA2-256(./lib/libbrotlicommon.a)= 1c6a6ff41a2a1ec0bfe8bdfe8e27127fce59e16df88e0b9060e63b11e0a9ddaf +SHA2-256(./lib/libbrotlidec.a)= 8c5a2d2004888de89972cbb9f3299fe385ca1953068cd1a573ed79d84d53b7e9 +SHA2-256(./lib/libcrypto.a)= 6b8fff99effdad113e32b4a2389b2a10e2da7788771b213b3f8fab98bfb12f65 +SHA2-256(./lib/libcurl.a)= 9ec43d5db9869d0030456827cd497946a063571b72d7217fef6aa0b9992cc10c +SHA2-256(./lib/libcurl.dll.a)= 48d31aeb7eeb9efcee391765bd7f18dabfcb9e36fd4bc9b7d7dac37658d9c634 +SHA2-256(./lib/libnghttp2.a)= c516ac51da540e32535b6d4e8a5df7b399abd3edda55c9a180b478e501bf07e7 +SHA2-256(./lib/libnghttp3.a)= 4f705100a92ad0f19648c40310c0c88f12c0414127fca01e90073b23e7d16d3d +SHA2-256(./lib/libngtcp2.a)= dfabed9661b686258629122fe24685e920e4d538f8e6cfb3619127bbbecc96c4 +SHA2-256(./lib/libngtcp2_crypto_quictls.a)= 7439d28649e8fbc4b02bf69de8028812357fd934cc41cceedc4baf6d5ab7026c +SHA2-256(./lib/libpsl.a)= 711865fc20f356bebbfe55f2a2b9a4be49b935d151015c64b104c773d3e69c8a +SHA2-256(./lib/libssh2.a)= ae90e3a9e7da4bc572102d4886b9833620b8bb7c65d291703df9c938c538a66b +SHA2-256(./lib/libssl.a)= 4db85abf49d73206ecda2233b1efed68f4c367bb35c92c34a02a83ed6e2d1eaf +SHA2-256(./lib/libz.a)= 7d6f8b7f7033e72a6f6a4f1815a081ff14a1a22abdf3e19799aa743f11bc3c30 +SHA2-256(./lib/libzstd.a)= dca30484c301668b263f154d060f225d7f1d2f3339527c5183bc42673aa86565 diff --git a/curl/BUILD-MANIFEST.txt b/curl/BUILD-MANIFEST.txt new file mode 100644 index 0000000..3c63b8d --- /dev/null +++ b/curl/BUILD-MANIFEST.txt @@ -0,0 +1,13 @@ +.clang 19.1.7 +.mingw-w64 12.0.0-5 +zlibng 2.2.4 https://github.com/zlib-ng/zlib-ng/archive/refs/tags/2.2.4.tar.gz +zstd 1.5.7 https://github.com/facebook/zstd/releases/download/v1.5.7/zstd-1.5.7.tar.gz +brotli 1.1.0 https://github.com/google/brotli/archive/v1.1.0.tar.gz +libpsl 0.21.5 https://github.com/rockdaboot/libpsl/releases/download/0.21.5/libpsl-0.21.5.tar.gz +nghttp3 1.10.1 https://github.com/ngtcp2/nghttp3/releases/download/v1.10.1/nghttp3-1.10.1.tar.xz +libressl 4.1.0 https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.1.0.tar.gz +ngtcp2 1.13.0 https://github.com/ngtcp2/ngtcp2/releases/download/v1.13.0/ngtcp2-1.13.0.tar.xz +nghttp2 1.65.0 https://github.com/nghttp2/nghttp2/releases/download/v1.65.0/nghttp2-1.65.0.tar.xz +libssh2 1.11.1 https://libssh2.org/download/libssh2-1.11.1.tar.xz +cacert 2025-05-20 https://curl.se/ca/cacert-2025-05-20.pem +curl 8.14.0 https://curl.se/download/curl-8.14.0.tar.xz diff --git a/curl/BUILD-README.url b/curl/BUILD-README.url new file mode 100644 index 0000000..36278f8 --- /dev/null +++ b/curl/BUILD-README.url @@ -0,0 +1,2 @@ +[InternetShortcut] +URL=https://github.com/curl/curl-for-win diff --git a/curl/COPYING.txt b/curl/COPYING.txt new file mode 100644 index 0000000..3fa85eb --- /dev/null +++ b/curl/COPYING.txt @@ -0,0 +1,22 @@ +COPYRIGHT AND PERMISSION NOTICE + +Copyright (c) 1996 - 2025, Daniel Stenberg, , and many +contributors, see the THANKS file. + +All rights reserved. + +Permission to use, copy, modify, and distribute this software for any purpose +with or without fee is hereby granted, provided that the above copyright +notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN +NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, +DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR +OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE +OR OTHER DEALINGS IN THE SOFTWARE. + +Except as contained in this notice, the name of a copyright holder shall not +be used in advertising or otherwise to promote the sale, use or other dealings +in this Software without prior written authorization of the copyright holder. diff --git a/curl/README.txt b/curl/README.txt new file mode 100644 index 0000000..f5efbd7 --- /dev/null +++ b/curl/README.txt @@ -0,0 +1,55 @@ + _ _ ____ _ + ___| | | | _ \| | + / __| | | | |_) | | + | (__| |_| | _ <| |___ + \___|\___/|_| \_\_____| + +README + + Curl is a command line tool for transferring data specified with URL + syntax. Find out how to use curl by reading the curl.1 man page or the + MANUAL document. Find out how to install Curl by reading the INSTALL + document. + + libcurl is the library curl is using to do its job. It is readily + available to be used by your software. Read the libcurl.3 man page to + learn how. + + You find answers to the most frequent questions we get in the FAQ document. + + Study the COPYING file for distribution terms. + + Those documents and more can be found in the docs/ directory. + +CONTACT + + If you have problems, questions, ideas or suggestions, please contact us + by posting to a suitable mailing list. See https://curl.se/mail/ + + All contributors to the project are listed in the THANKS document. + +WEBSITE + + Visit the curl website for the latest news and downloads: + + https://curl.se/ + +GIT + + To download the latest source code off the GIT server, do this: + + git clone https://github.com/curl/curl.git + + (you will get a directory named curl created, filled with the source code) + +SECURITY PROBLEMS + + Report suspected security problems via our HackerOne page and not in public. + + https://hackerone.com/curl + +NOTICE + + Curl contains pieces of source code that is Copyright (c) 1998, 1999 + Kungliga Tekniska Högskolan. This notice is included here to comply with the + distribution terms. diff --git a/curl/RELEASE-NOTES.txt b/curl/RELEASE-NOTES.txt new file mode 100644 index 0000000..832e4a6 --- /dev/null +++ b/curl/RELEASE-NOTES.txt @@ -0,0 +1,520 @@ +curl and libcurl 8.14.0 + + Public curl releases: 267 + Command line options: 269 + curl_easy_setopt() options: 308 + Public functions in libcurl: 96 + Contributors: 3427 + +This release includes the following changes: + + o mqtt: send ping at upkeep interval [49] + o schannel: handle pkcs12 client certificates containing CA certificates [58] + o TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs [113] + o vquic: ngtcp2 + openssl support [96] + o wcurl: import v2025.04.20 script + docs [97] + o websocket: add option to disable auto-pong reply [52] + +This release includes the following bugfixes: + + o _SEEALSO.md: remove spaces around command and man page section [166] + o asny-thrdd: fix detach from running thread [191] + o asnyc-thrdd: explain how this is okay with a comment [200] + o asyn resolver code improvements [50] + o async-threaded resolver: use ref counter [10] + o async: DoH improvements [99] + o autotools: detect `wolfSSL_set_quic_use_legacy_code` like cmake does [104] + o autotools: install shell completion files on cross build [119] + o aws-sigv4: allow a blank string [86] + o build: check required rustls-ffi version [46] + o build: enable gcc-12/13+, clang-10+ picky warnings [147] + o build: enable gcc-15 picky warnings [133] + o certs: drop unused `default_bits` from `.prm` files [45] + o cf-https-connect: use the passed in dns struct pointer [64] + o cf-socket: fix FTP accept connect [153] + o cfilters: remove assert [120] + o cmake/FindNGTCP2: simplify multi-pkg-config detection [27] + o cmake: append picky warnings to `CMAKE_REQUIRED_FLAGS` as string [68] + o cmake: avoid 'target is imported but not globally visible' when consuming libcurl with old cmake [125] + o cmake: do not install `mk-ca-bundle` script and manpage [101] + o cmake: enable `-Wall` for MSVC when `PICKY_COMPILER=ON` [100] + o cmake: extend integration tests [139] + o cmake: fix `fish` install directory detection via `pkg-config` [123] + o cmake: fix nghttp3 static linking with `USE_OPENSSL_QUIC=ON` [79] + o cmake: fix option() and mark_as_advanced() mixed order [111] + o cmake: fix shell completion install when just one flavor is enabled [73] + o cmake: honor individual picky option overrides found in `CMAKE_C_FLAGS` [146] + o cmake: install shell completions for cross-builds [112] + o cmake: link `crypt32` for OpenSSL feature detection [105] + o cmake: merge `CURL_WERROR` logic into `PickyWarnings.cmake` [66] + o cmake: prefer `COMPILE_OPTIONS` over `CMAKE_C_FLAGS` for custom C options [72] + o cmake: quotes, whitespace, use `VERSION_GREATER_EQUAL` [33] + o cmake: revert `CURL_LTO` behavior for multi-config generators [74] + o cmake: set `BUILDING_LIBCURL` directly for unit test targets [174] + o cmake: stop deleting `-W` from `CMAKE_C_FLAGS` (MSVC) [155] + o cmake: tidy up and document feature detections in dependencies [107] + o cmake: use `CMAKE_COMPILE_WARNING_AS_ERROR` if available [154] + o cmake: use `INCLUDE_DIRECTORIES` prop to specify local header dirs [47] + o cmake: use `LIB_NAME` in `curl-config.cmake.in` [148] + o cmake: use absolute paths for completion targets [40] + o cmake: use the `LINK_OPTIONS` property with CMake 3.13+ [78] + o configure: catch asking for double resolver without https-rr [82] + o configure: fix --disable-rt [20] + o configure: restore link checks [25] + o configure: suppress command not found for brew [235] + o conncache: make Curl_cpool_init return void [15] + o connect: shutdown timer fix [132] + o content_encoding: Transfer-Encoding parser improvements [31] + o CONTRIBUTE: add project guidelines for AI use [76] + o contrithanks.sh: drop set -e [6] + o cpool/cshutdown: force close connections under pressure [80] + o curl: fix memory leak when -h is used in config file [161] + o curl: only warn once for --manual in manual-disabled build [205] + o curl_get_line: handle lines ending on the buffer boundary [62] + o curl_krb5: only use functions if FTP is still enabled [21] + o curl_multibyte: fixup low-level calls, include in unity builds [55] + o curl_osslq: remove a leftover debug fprintf() call [140] + o curl_url_get.md: don't call it normalized [212] + o curl_version_info.md: clarify ssl_version for MultiSSL [145] + o CURLMOPT_TIMERFUNCTION.md: correct the example [162] + o CURLOPT_ERRORBUFFER.md: buffer is read only after curl takes ownership [93] + o CURLOPT_FOLLOWLOCATION.md: switch to GET => no body [208] + o CURLOPT_READFUNCTION.md: mention the seek callback [209] + o CURLOPT_XFERINFOFUNCTION.md: fix the callback return type in example [122] + o curlx: move the docs to docs/internals/ [184] + o DEPRECATE.md: drop support for VS2008 [214] + o DEPRECATE.md: drop Windows CE support [216] + o dist: drop duplicate entry from `CMAKE_DIST` [88] + o dns_entry: move from conn to data->state [178] + o Dockerfile: update debian:bookworm-slim Docker digest to 90522ee [211] + o docs/INSTALL.md: drop reference to removed configure option [83] + o docs/libcurl: fix type and prototype problems in examples [121] + o docs/libcurl: make examples build with picky compiler options [84] + o docs/libcurl: mention sensitive data/headers [206] + o docs: add missing return statement in examples [85] + o docs: fix incorrect shell substitution in docker run example command [51] + o docs: fix typo in retry.md [192] + o docs: update distros links + o doh: httpsrr fix [71] + o doh: make sure CURLOPT_PROTOCOLS is set a with a "long" arg [124] + o doh: reduce the DNS request buffer size [70] + o easy_reset: fix dohfor_mid member [63] + o ECH: reference the OpenSSL ECH feature branch [186] + o etag-save.md: mention how using both options is a good idea [108] + o eventfd: fix feature guards [24] + o formdata: cleanups [219] + o ftp: fix bug in failed init [179] + o ftp: fix race in upload handling [207] + o ftplistparser: add two overflow preventions [173] + o ftplistparser: split up into more functions [215] + o generate.bat: exclude curlinfo.c from legacy VS projects [175] + o genserv.pl: fail with a message if `openssl` is missing or failing [14] + o headers: enforce a max number of response header to accept [163] + o headers: set an error message on illegal response headers [181] + o hostip: fix build without threaded-resolver and without DoH [17] + o hostip: show the correct name on proxy resolve error [37] + o http2: fix stream window size after unpausing [34] + o HTTP3.md: fix incorrect variable placeholders [30] + o http: fix a build error when all auths are disabled [16] + o http: fix HTTP/2 handling of TE request header using "trailers" [130] + o http: in alt-svc negotiation only allow supported HTTP versions [59] + o http_aws_sigv4: add additional verbose log statements [39] + o http_aws_sigv4: improve sigv4 url encoding and canonicalization [240] + o http_chunks: narrow variable scope for 'trlen' [199] + o http_negotiate: fix non-SSL build with GSSAPI [23] + o https-connect: fix httpsrr target check [36] + o HTTPSRR.md: clarify somewhat [137] + o if2ip: build the function also if FTP is present [19] + o imap: remove redundant condition [196] + o INSTALL-CMAKE.md: fix typo + o INSTALL.md: update the minimal libcurl size example + o KNOWN_BUGS: fix link in sivg4 issue 16.3 [26] + o lib/src/docs/test: improve curl_easy_setopt() calls [116] + o lib1560: use hex notation, drop non-ASCII exception [182] + o lib3026: drop DLL pre-load perf mitigation for old mingw [222] + o lib: add const to clientwriter tables + o lib: drop curlx_getpid, use fake pid in SMB [172] + o lib: include files using known path [48] + o lib: make Curl_easyopts const [44] + o lib: unify conversions to/from hex [3] + o libcurl-tutorial.md: fix read callback explanation [118] + o libssh: add NULL check for Curl_meta_get() [201] + o libssh: fix memory leak [168] + o libssh: remove a condition that always equals false [202] + o libtest/first: stop defining MEMDEBUG_NODEFINES [32] + o libtests: define CURL_DISABLE_DEPRECATION first [177] + o make: clean tests better [60] + o mbedtls: TLS 1.3 is max when mbedtls has 1.3 support [109] + o metahash: add asserts to help analyzers [171] + o mk-ca-bundle.pl: follow redirects [53] + o mk-ca-bundle: switch URLs to GitHub versions [195] + o mkhelp: fix to not generate a line-ending space in some cases [103] + o mqtt: use conn/easy meta hash [141] + o multi: do transfer book keeping using mid [91] + o multi: init_do(): check result [114] + o netrc: avoid NULL deref on weird input [167] + o netrc: avoid strdup NULL [198] + o netrc: deal with null token better [150] + o ngtcp2: clarify ignoring of result [131] + o openssl-quic: avoid potential `-Wnull-dereference`, add assert [126] + o openssl-quic: fix printf mask [102] + o openssl-quic: fix shutdown when stream not open [11] + o openssl: enable builds for *both* engines and providers [115] + o openssl: set the cipher string before doing private cert [138] + o parsedate: provide Curl_wkday also for GnuTLS builds [13] + o processhelp.pm: always call `taskkill` with `-f` (force) [69] + o processhelp.pm: avoid potential endless loop, log more (Windows) [5] + o progress: avoid integer overflow when gathering total transfer size [128] + o pytest tls: extend coverage [217] + o pytest-xdist: pytest in parallel [204] + o pytest: add pinnedpubkey test cases [232] + o pytest: give parameterised tests better ids for read- and parsability [142] + o pytest: make test_07_22 more lenient to exit codes [90] + o quic: no local idle connection timeout, ngtcp2 keep-alive [61] + o rand: update comment on Curl_rand_bytes weak random [35] + o RELEASE-PROCEDURE.md: release candidate git tagging explained [143] + o rtsp: remove redundant condition [197] + o runtests: add retry option to reduce flakiness [106] + o runtests: fix indentation + o runtests: recognize lowercase `windows` in `curl -V` [77] + o runtests: remove server verification after start [89] + o runtests: split `SSH_PWD` into `SCP_PWD` and `SFTP_PWD`, and more [75] + o rustls: make max size of cert and key reasonable [41] + o sasl: give help when unable to select AUTH [213] + o scripts: completion.pl: sort the completion file for all shells [9] + o scripts: drop unused import, formatting [95] + o scripts: fix --opts-dir help in completion.pl + o scripts: fix perl indentation, whitespace, semicolons [127] + o sectransp: fix building for macOS Sierra and older [151] + o setopt: provide info for CURLE_BAD_FUNCTION_ARGUMENT [180] + o smb: avoid integer overflow on weird input date [129] + o socket: use accept4 when available [7] + o socketpair: support pipe2 where available [56] + o spacecheck.pl: check for non-ASCII chars, fix fallouts [187] + o spacecheck.pl: verify `tests/data/test*` for non-ASCII chars [189] + o src: drop strcase.[ch] from tool builds [157] + o src: include memdebug.h consistently with angle brackets <> [160] + o src: rename curlx_safefree to tool_safefree [164] + o test1173.pl: whitelist some option-looking names that aren't options [203] + o test1658: add unit test for the HTTPS RR decoder [28] + o test: make unittest 1308 into a libtest [4] + o tests/ech_tests.sh: sync shebang with rest of bash scripts [42] + o tests/FILEFORMAT.md: clarify %hex[] formatting [188] + o tests/FILEFORMAT.md: document the aws feature [156] + o tests/README.md: document --test-duphandle [8] + o tests/README.md: list the openssl tool among the prerequisites [12] + o tests/server/dnsd: basic DNS server for test suite [92] + o tests/server: check for `stream != NULL` in mqttd [194] + o tests/server: fix typo in comment + o tests/server: stop using libcurl string comparisons [185] + o tests/server: stop using libcurl's printf functions [190] + o tests/serverhelp: remove last remnants of http-pipe server [1] + o tests/tunit: make a separate directory for tool-based unit tests [54] + o tests: add aws feature to the related tests [159] + o tests: Add https-mtls server to force client auth [57] + o tests: fix some test tag mismatches + o tests: mark ipfs tests to require ipfs [2] + o tests: move a boolean variable out of the path section + o tests: prefer `--insecure` over `-k` [43] + o tests: provide all non-ascii data hex encoded [183] + o tests: remove some unused test case sections + o tests: require IPv6 for 1265, 1324, 2086 [87] + o tests: separate tunit tests from unit tests more [176] + o tests: stop using libcurl's strdup [170] + o tests: unify test case keywords + o tests: use a more portable null device path [38] + o TODO: remove "nicer lacking perl message" [117] + o tool_cb_write.c: handle EINTR on flush [65] + o tool_getparam: clear argument only when needed [98] + o tool_operate: make retrycheck() a separate function [218] + o tool_operate: when retrying, only truncate regular files [165] + o tool_paramhlp: avoid integer overflow in secs2ms() [152] + o tool_parsecfg: make get_line handle lines ending on the buffer boundary [81] + o typecheck-gcc.h: fix the typechecks [110] + o urlapi: redirecting to "" is considered fine [149] + o urlapi: remove unneeded guards around PUNY2IDN [193] + o urldata: remove the unused struct field 'hide_progress' [220] + o VERSIONS: list all past releases [22] + o vquic: consistent name for the stream struct across backends [135] + o vquic: init for every call to recvmsg [134] + o vtls: avoid NULL deref on bad PEM input [169] + o vtls: fix build with ssl but without http [18] + o VULN-DISCLOSURE-POLICY: use of weak algos [94] + o winbuild: add the deprecation warning to the README [29] + o winbuild: curl_get_line is not used for tool builds [158] + o windows: fix builds targeting WinXP, test it in CI [227] + o wolfssl: fix to enable ALPN when available [67] + o ws: fix the header replace check [144] + o ws: store protocol context as connection meta data [136] + +This release includes the following known bugs: + + See https://curl.se/docs/knownbugs.html + +For all changes ever done in curl: + + See https://curl.se/changes.html + +Planned upcoming removals include: + + o Support for the msh3 HTTP/3 backend + o Supporting curl builds using VS2008 + o The Secure Transport and BearSSL TLS backends + o The winbuild build system + o Windows CE support + + See https://curl.se/dev/deprecate.html + +This release would not have looked like this without help, code, reports and +advice from friends like these: + + Abhinav Singhal, Aditya Garg, Alberto Leiva Popper, Andreas Westin, + Andrei Florea, Andrew Kirillov, Andy Pan, antypanty on hackerone, + Arian van Putten, bo0tzz on github, Bo Anderson, Brendan Dolan-Gavitt, + Brian Chrzanowski, bruce.yoon, bsr13 on hackerone, calvin2021y on github, + Calvin Ruocco, Carlos Henrique Lima Melara, Christian Schmitz, + Christoph Jabs, Cole Helbling, Corinna Brandt, Dagobert Michelsen, + Dan Fandrich, Daniel Engberg, Daniel Fosco, Daniel McCarney, Daniel Stenberg, + Demi Marie Obenour, dependabot[bot], Dirk Feytons, epicmkirzinger on github, + Eric Knibbe, Fujii Hironori, gkarracer on github, Gordon Parke, + Graham Christensen, Harry Sintonen, Helmut Grohne, Hiroki Kurosawa, + Int64x86 on github, Jacob Mealey, Jake Yuesong Li, James Fuller, + Jean-Christophe Amiel, Jeroen Ooms, Jimmy Sjölund, Jixinqi, + Jochen Sprickerhof, Joe Cise, JoelAtWisetech on github, Joel Depooter, + Johan Eliasson, John Bampton, John Haugabook, Jonathan Rosa, Kai Pastor, + kkalganov on github, Maksim Ściepanienka, Manuel Strehl, Marius Kleidl, + Mathieu Garaud, Matt Jolly, Max Eliaser, mschroeder-fzj on github, NeimadTL, + Niall O'Reilly, Nigel Brittain, Nils Goroll, Pavel Kropachev, PleaseJustDont, + Rasmus Melchior Jacobsen, Ray Satiro, renovate[bot], Samuel Henrique, + Sarah Gooding, sbernatsky on github, Sergey, Sören Tempel, Stefan Eissing, + Stephen Farrell, Tal Regev, Thomas Klausner, Tomas Volf, Travis Lane, + Viktor Szakats, wolfsage on hackerone, x1sc0 on github, xiadnoring on github, + Yedaya Katsman, zopsicle on github + (91 contributors) + +References to bug reports and discussions on issues: + + [1] = https://curl.se/bug/?i=16924 + [2] = https://curl.se/bug/?i=16947 + [3] = https://curl.se/bug/?i=16888 + [4] = https://curl.se/bug/?i=16891 + [5] = https://curl.se/bug/?i=16908 + [6] = https://curl.se/bug/?i=16914 + [7] = https://curl.se/bug/?i=16979 + [8] = https://curl.se/bug/?i=16944 + [9] = https://curl.se/bug/?i=16985 + [10] = https://curl.se/bug/?i=16916 + [11] = https://curl.se/bug/?i=16998 + [12] = https://curl.se/bug/?i=16942 + [13] = https://curl.se/bug/?i=16943 + [14] = https://curl.se/bug/?i=16926 + [15] = https://curl.se/bug/?i=16936 + [16] = https://curl.se/bug/?i=16939 + [17] = https://curl.se/bug/?i=16938 + [18] = https://curl.se/bug/?i=16935 + [19] = https://curl.se/bug/?i=16933 + [20] = https://curl.se/bug/?i=16932 + [21] = https://curl.se/bug/?i=16925 + [22] = https://curl.se/bug/?i=16907 + [23] = https://curl.se/bug/?i=16919 + [24] = https://curl.se/mail/lib-2025-04/0000.html + [25] = https://curl.se/mail/lib-2025-04/0004.html + [26] = https://curl.se/bug/?i=17007 + [27] = https://curl.se/bug/?i=16980 + [28] = https://curl.se/bug/?i=16972 + [29] = https://curl.se/bug/?i=16957 + [30] = https://curl.se/bug/?i=17008 + [31] = https://curl.se/bug/?i=16956 + [32] = https://curl.se/bug/?i=16978 + [33] = https://curl.se/bug/?i=17002 + [34] = https://curl.se/bug/?i=16955 + [35] = https://curl.se/bug/?i=16965 + [36] = https://curl.se/bug/?i=16966 + [37] = https://curl.se/bug/?i=16958 + [38] = https://curl.se/bug/?i=16929 + [39] = https://curl.se/bug/?i=16952 + [40] = https://curl.se/bug/?i=16946 + [41] = https://curl.se/bug/?i=16951 + [42] = https://curl.se/bug/?i=17001 + [43] = https://curl.se/bug/?i=16878 + [44] = https://curl.se/bug/?i=16950 + [45] = https://curl.se/bug/?i=16999 + [46] = https://curl.se/bug/?i=16922 + [47] = https://curl.se/bug/?i=16993 + [48] = https://curl.se/bug/?i=16991 + [49] = https://curl.se/bug/?i=16975 + [50] = https://curl.se/bug/?i=16963 + [51] = https://curl.se/bug/?i=16990 + [52] = https://curl.se/bug/?i=16744 + [53] = https://curl.se/bug/?i=16995 + [54] = https://curl.se/bug/?i=16983 + [55] = https://curl.se/bug/?i=16742 + [56] = https://curl.se/bug/?i=16987 + [57] = https://curl.se/bug/?i=16923 + [58] = https://curl.se/bug/?i=16825 + [59] = https://curl.se/bug/?i=17037 + [60] = https://curl.se/bug/?i=16986 + [61] = https://curl.se/bug/?i=17057 + [62] = https://curl.se/bug/?i=17036 + [63] = https://curl.se/bug/?i=17052 + [64] = https://curl.se/bug/?i=17092 + [65] = https://curl.se/bug/?i=17061 + [66] = https://curl.se/bug/?i=17062 + [67] = https://curl.se/bug/?i=17056 + [68] = https://curl.se/bug/?i=17055 + [69] = https://curl.se/bug/?i=17054 + [70] = https://curl.se/bug/?i=17087 + [71] = https://curl.se/bug/?i=17099 + [72] = https://curl.se/bug/?i=17047 + [73] = https://curl.se/bug/?i=16946 + [74] = https://curl.se/bug/?i=17042 + [75] = https://curl.se/bug/?i=17041 + [76] = https://curl.se/bug/?i=17325 + [77] = https://curl.se/bug/?i=17088 + [78] = https://curl.se/bug/?i=17039 + [79] = https://curl.se/bug/?i=17010 + [80] = https://curl.se/bug/?i=17020 + [81] = https://curl.se/bug/?i=17030 + [82] = https://curl.se/bug/?i=17025 + [83] = https://curl.se/bug/?i=17023 + [84] = https://curl.se/bug/?i=17028 + [85] = https://curl.se/bug/?i=17024 + [86] = https://curl.se/bug/?i=17176 + [87] = https://curl.se/bug/?i=17014 + [88] = https://curl.se/bug/?i=17012 + [89] = https://curl.se/bug/?i=17005 + [90] = https://curl.se/bug/?i=17083 + [91] = https://curl.se/bug/?i=16761 + [92] = https://curl.se/bug/?i=17015 + [93] = https://curl.se/bug/?i=17105 + [94] = https://curl.se/bug/?i=17220 + [95] = https://curl.se/bug/?i=17077 + [96] = https://curl.se/bug/?i=17027 + [97] = https://curl.se/bug/?i=17035 + [98] = https://curl.se/bug/?i=17112 + [99] = https://curl.se/bug/?i=16384 + [100] = https://curl.se/bug/?i=17050 + [101] = https://curl.se/bug/?i=17035 + [102] = https://curl.se/bug/?i=17106 + [103] = https://curl.se/bug/?i=17240 + [104] = https://curl.se/bug/?i=17172 + [105] = https://curl.se/bug/?i=17101 + [106] = https://curl.se/bug/?i=17091 + [107] = https://curl.se/bug/?i=17082 + [108] = https://curl.se/bug/?i=17217 + [109] = https://curl.se/bug/?i=17048 + [110] = https://curl.se/bug/?i=17143 + [111] = https://curl.se/bug/?i=17163 + [112] = https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103938 + [113] = https://curl.se/bug/?i=12982 + [114] = https://curl.se/bug/?i=17139 + [115] = https://curl.se/bug/?i=17165 + [116] = https://curl.se/bug/?i=17160 + [117] = https://curl.se/bug/?i=17233 + [118] = https://curl.se/bug/?i=17138 + [119] = https://curl.se/bug/?i=17159 + [120] = https://curl.se/bug/?i=17211 + [121] = https://curl.se/bug/?i=17231 + [122] = https://curl.se/bug/?i=17228 + [123] = https://curl.se/bug/?i=17147 + [124] = https://curl.se/bug/?i=17142 + [125] = https://curl.se/bug/?i=17140 + [126] = https://curl.se/bug/?i=17107 + [127] = https://curl.se/bug/?i=17209 + [128] = https://curl.se/bug/?i=17207 + [129] = https://curl.se/bug/?i=17206 + [130] = https://curl.se/bug/?i=17122 + [131] = https://curl.se/bug/?i=17354 + [132] = https://curl.se/bug/?i=17130 + [133] = https://curl.se/bug/?i=17199 + [134] = https://curl.se/bug/?i=17120 + [135] = https://curl.se/bug/?i=17113 + [136] = https://curl.se/bug/?i=17146 + [137] = https://curl.se/bug/?i=17204 + [138] = https://curl.se/bug/?i=17227 + [139] = https://curl.se/bug/?i=17203 + [140] = https://curl.se/bug/?i=17198 + [141] = https://curl.se/bug/?i=17221 + [142] = https://curl.se/bug/?i=17340 + [143] = https://curl.se/bug/?i=17177 + [144] = https://curl.se/bug/?i=17170 + [145] = https://curl.se/bug/?i=17308 + [146] = https://curl.se/bug/?i=17197 + [147] = https://curl.se/bug/?i=17196 + [148] = https://curl.se/bug/?i=17195 + [149] = https://curl.se/bug/?i=17188 + [150] = https://curl.se/bug/?i=17351 + [151] = https://curl.se/bug/?i=16581 + [152] = https://curl.se/bug/?i=17184 + [153] = https://curl.se/bug/?i=17186 + [154] = https://curl.se/bug/?i=17183 + [155] = https://curl.se/bug/?i=17179 + [156] = https://curl.se/bug/?i=17350 + [157] = https://curl.se/bug/?i=17289 + [158] = https://curl.se/bug/?i=17286 + [159] = https://curl.se/bug/?i=17347 + [160] = https://curl.se/bug/?i=17284 + [161] = https://curl.se/bug/?i=17306 + [162] = https://curl.se/bug/?i=17301 + [163] = https://curl.se/bug/?i=17281 + [164] = https://curl.se/bug/?i=17270 + [165] = https://curl.se/bug/?i=17371 + [166] = https://curl.se/bug/?i=17348 + [167] = https://curl.se/bug/?i=17275 + [168] = https://curl.se/bug/?i=17346 + [169] = https://curl.se/bug/?i=17274 + [170] = https://curl.se/bug/?i=17297 + [171] = https://curl.se/bug/?i=17268 + [172] = https://curl.se/bug/?i=17298 + [173] = https://curl.se/bug/?i=17397 + [174] = https://curl.se/bug/?i=17264 + [175] = https://curl.se/bug/?i=17263 + [176] = https://curl.se/bug/?i=17259 + [177] = https://curl.se/bug/?i=17373 + [178] = https://curl.se/bug/?i=17383 + [179] = https://curl.se/bug/?i=17258 + [180] = https://curl.se/bug/?i=17337 + [181] = https://curl.se/bug/?i=17330 + [182] = https://curl.se/bug/?i=17334 + [183] = https://curl.se/bug/?i=17331 + [184] = https://curl.se/bug/?i=17333 + [185] = https://curl.se/bug/?i=17328 + [186] = https://curl.se/bug/?i=17251 + [187] = https://curl.se/bug/?i=17247 + [188] = https://curl.se/bug/?i=17332 + [189] = https://curl.se/bug/?i=17329 + [190] = https://curl.se/bug/?i=17294 + [191] = https://curl.se/bug/?i=17256 + [192] = https://curl.se/bug/?i=17443 + [193] = https://curl.se/bug/?i=17364 + [194] = https://curl.se/bug/?i=17294 + [195] = https://curl.se/bug/?i=17321 + [196] = https://curl.se/bug/?i=17318 + [197] = https://curl.se/bug/?i=17317 + [198] = https://curl.se/bug/?i=17319 + [199] = https://curl.se/bug/?i=17316 + [200] = https://curl.se/bug/?i=17365 + [201] = https://curl.se/bug/?i=17359 + [202] = https://curl.se/bug/?i=17358 + [203] = https://curl.se/bug/?i=17361 + [204] = https://curl.se/bug/?i=17295 + [205] = https://curl.se/bug/?i=17441 + [206] = https://curl.se/bug/?i=17353 + [207] = https://curl.se/bug/?i=17394 + [208] = https://curl.se/bug/?i=17454 + [209] = https://curl.se/bug/?i=17455 + [211] = https://curl.se/bug/?i=17416 + [212] = https://curl.se/bug/?i=16829 + [213] = https://curl.se/bug/?i=17420 + [214] = https://curl.se/bug/?i=17380 + [215] = https://curl.se/bug/?i=17384 + [216] = https://curl.se/bug/?i=17379 + [217] = https://curl.se/bug/?i=17382 + [218] = https://curl.se/bug/?i=17381 + [219] = https://curl.se/bug/?i=17370 + [220] = https://curl.se/bug/?i=17430 + [222] = https://curl.se/bug/?i=17414 + [227] = https://curl.se/bug/?i=17415 + [232] = https://curl.se/bug/?i=17412 + [235] = https://curl.se/bug/?i=17407 + [240] = https://curl.se/bug/?i=17129 diff --git a/curl/dep/brotli/LICENSE.txt b/curl/dep/brotli/LICENSE.txt new file mode 100644 index 0000000..33b7cdd --- /dev/null +++ b/curl/dep/brotli/LICENSE.txt @@ -0,0 +1,19 @@ +Copyright (c) 2009, 2010, 2013-2016 by the Brotli Authors. + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/curl/dep/brotli/README.md b/curl/dep/brotli/README.md new file mode 100644 index 0000000..67bf4d9 --- /dev/null +++ b/curl/dep/brotli/README.md @@ -0,0 +1,95 @@ +

+ GitHub Actions Build Status + Fuzzing Status +

+

Brotli

+ +### Introduction + +Brotli is a generic-purpose lossless compression algorithm that compresses data +using a combination of a modern variant of the LZ77 algorithm, Huffman coding +and 2nd order context modeling, with a compression ratio comparable to the best +currently available general-purpose compression methods. It is similar in speed +with deflate but offers more dense compression. + +The specification of the Brotli Compressed Data Format is defined in [RFC 7932](https://tools.ietf.org/html/rfc7932). + +Brotli is open-sourced under the MIT License, see the LICENSE file. + +> **Please note:** brotli is a "stream" format; it does not contain +> meta-information, like checksums or uncompresssed data length. It is possible +> to modify "raw" ranges of the compressed stream and the decoder will not +> notice that. + +### Build instructions + +#### Vcpkg + +You can download and install brotli using the [vcpkg](https://github.com/Microsoft/vcpkg/) dependency manager: + + git clone https://github.com/Microsoft/vcpkg.git + cd vcpkg + ./bootstrap-vcpkg.sh + ./vcpkg integrate install + ./vcpkg install brotli + +The brotli port in vcpkg is kept up to date by Microsoft team members and community contributors. If the version is out of date, please [create an issue or pull request](https://github.com/Microsoft/vcpkg) on the vcpkg repository. + +#### Bazel + +See [Bazel](http://www.bazel.build/) + +#### CMake + +The basic commands to build and install brotli are: + + $ mkdir out && cd out + $ cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=./installed .. + $ cmake --build . --config Release --target install + +You can use other [CMake](https://cmake.org/) configuration. + +#### Python + +To install the latest release of the Python module, run the following: + + $ pip install brotli + +To install the tip-of-the-tree version, run: + + $ pip install --upgrade git+https://github.com/google/brotli + +See the [Python readme](python/README.md) for more details on installing +from source, development, and testing. + +### Contributing + +We glad to answer/library related questions in +[brotli mailing list](https://groups.google.com/forum/#!forum/brotli). + +Regular issues / feature requests should be reported in +[issue tracker](https://github.com/google/brotli/issues). + +For reporting vulnerability please read [SECURITY](SECURITY.md). + +For contributing changes please read [CONTRIBUTING](CONTRIBUTING.md). + +### Benchmarks +* [Squash Compression Benchmark](https://quixdb.github.io/squash-benchmark/) / [Unstable Squash Compression Benchmark](https://quixdb.github.io/squash-benchmark/unstable/) +* [Large Text Compression Benchmark](http://mattmahoney.net/dc/text.html) +* [Lzturbo Benchmark](https://sites.google.com/site/powturbo/home/benchmark) + +### Related projects +> **Disclaimer:** Brotli authors take no responsibility for the third party projects mentioned in this section. + +Independent [decoder](https://github.com/madler/brotli) implementation by Mark Adler, based entirely on format specification. + +JavaScript port of brotli [decoder](https://github.com/devongovett/brotli.js). Could be used directly via `npm install brotli` + +Hand ported [decoder / encoder](https://github.com/dominikhlbg/BrotliHaxe) in haxe by Dominik Homberger. Output source code: JavaScript, PHP, Python, Java and C# + +7Zip [plugin](https://github.com/mcmilk/7-Zip-Zstd) + +Dart [native bindings](https://github.com/thosakwe/brotli) + +Dart compression framework with [fast FFI-based Brotli implementation](https://pub.dev/documentation/es_compression/latest/brotli/brotli-library.html) with ready-to-use prebuilt binaries for Win/Linux/Mac diff --git a/curl/dep/cacert/LICENSE.url b/curl/dep/cacert/LICENSE.url new file mode 100644 index 0000000..3819c02 --- /dev/null +++ b/curl/dep/cacert/LICENSE.url @@ -0,0 +1,2 @@ +[InternetShortcut] +URL=https://www.mozilla.org/media/MPL/2.0/index.txt diff --git a/curl/dep/libpsl/AUTHORS.txt b/curl/dep/libpsl/AUTHORS.txt new file mode 100644 index 0000000..7613332 --- /dev/null +++ b/curl/dep/libpsl/AUTHORS.txt @@ -0,0 +1,24 @@ +Authors of and contributors to libpsl. +Thank you very much for spending your time ! + +Also many thanks for anyone who contributed ideas, +took part in discussions or 'just' asked questions. + +Please drop me a note if you feel you should have +been mentioned here. + +Tim Ruehsen (Implementation of libpsl) +Daniel Kahn Gillmor (Discussion, Ideas, Organization, Code) +Daniel Stenberg (Discussion, Ideas) +Darshit Shah (Patching Wget to work with libpsl) +Dagobert Michelsen (Fixed Solaris building) +Christopher Meng (Fedora building) +Jakub Čajka +Giuseppe Scrivano +Ryan Sleevi (Discussion, Requested DAFSA format and ICANN/PRIVATE support) +Daurnimator (Code review, discussion, reports) +Olle Liljenzin (Original DAFSA implementation and UTF-8 patch) +Claudio Saveedra (Add support for PSL_TYPE_NO_STAR_RULE) +Chun-wei Fan (Add NMake files) +Xavier Claessens (Add Meson build system) +Ignacio Casal Quinteiro (Improve Meson build) diff --git a/curl/dep/libpsl/COPYING.txt b/curl/dep/libpsl/COPYING.txt new file mode 100644 index 0000000..85945e7 --- /dev/null +++ b/curl/dep/libpsl/COPYING.txt @@ -0,0 +1,19 @@ +Copyright (C) 2014-2024 Tim Rühsen + +Permission is hereby granted, free of charge, to any person obtaining a +copy of this software and associated documentation files (the "Software"), +to deal in the Software without restriction, including without limitation +the rights to use, copy, modify, merge, publish, distribute, sublicense, +and/or sell copies of the Software, and to permit persons to whom the +Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. diff --git a/curl/dep/libpsl/NEWS.txt b/curl/dep/libpsl/NEWS.txt new file mode 100644 index 0000000..f0c56d0 --- /dev/null +++ b/curl/dep/libpsl/NEWS.txt @@ -0,0 +1,237 @@ +Copyright (C) 2014-2024 Tim Rühsen + +13.01.2024 Release V0.21.5 + * Fix version.txt + +13.01.2024 Release V0.21.4 + * Fix meson build (missing ICONV_CONST in config.h) + +13.01.2024 Release V0.21.3 + * Improved build with meson + * Fixed and improved build on Windows + * Improved build instructions + * Install psl-make-dafsa + +26.12.2022 Release V0.21.2 + * Increased internal label size + * Meson build improvements (needs meson >= 0.60.0) + * Autoconf build improvements + * Add instructions on how to build from tarball + * Add WSAStartup() for Windows psl tool and tests + * Bump gettext version to 0.19.3 + * Fix stack buffer overflow WRITE 1 in domain_to_punycode() + (Relevant only when built without any IDNA library.) + * Fix undefined behavior in library code + * Ensures that calls to fopen() and stat() can handle largefiles + * Several minor (non-functional) changes + +18.07.2020 Release V0.21.1 + * Fixing a test due to recent changes in upstream PSL + * Meson build improvements + * Documentation cleanups + * Use semantic versioning for git tags + +16.04.2019 Release V0.21.0 + * Add -b/--batch to 'psl' to suppress printing the domain + * Add support for Meson build system + * Improve build system + * Improve Windows compatibility + * Remove NLS / gettext + * Several cleanups and cosmetics + +26.04.2018 Release V0.20.2 + * Fix non srcdir builds + * Add API decoration + * Fix for MSVC/Win32 builds + * Detection fallback from libidn2 to libcu, libidn + * Fix MinGW cross builds on Linux + * Add NMake Makefiles for Visual Studio builds + +26.02.2018 Release V0.20.1 + * Fix issue introduced with PSL_TYPE_NO_STAR_RULE in V0.20.0 + * Fix SO_VERSION to 8:0:3 + * Improve unit tests + +22.02.2018 Release V0.20.0 + * Remove hard-coded gcc flag in Makefile.am + * Prevent excessive CPU cycles on large inputs + * New flag PSL_TYPE_NO_STAR_RULE to skip star rule + +09.11.2017 Release V0.19.1 + * Add the forgotten commit with NEWS and configure.ac + +09.11.2017 Release V0.19.0 + * New function psl_free_string() + * psl_make_dafsa now works with python2 and python3 + * psl_*count() functions now return -1 if info is not available + * Fixed unsigned integer overflow in _mem_is_ascii() + * Add -fsanitize-address-use-after-scope to --enable-asan if available + +20.07.2017 Release V0.18.0 + * Fix order of files in psl_latest() + * Add fuzzing architecture + * Fix memleak in _psl_is_public_suffix() + * Add configure option --enable-asan (Address sanitizer) + * Add configure option --enable-usan (Undefined sanitizer) + * Add configure option --enable-cfi (Control Flow Integrity) + * Fix finding libidn2 for static builds + * Fix use of uninitialized stack value + * Fix buffer overflow in libicu build + * Use libidn2 as default for builds (former libicu) + * Add pkg-config support for libidn and libidn2 + +16.01.2017 Release V0.17.0 + * Use TR46 non-transitional for IDNA (libicu, libidn2 >= 0.14) + * Fix coverage upload from TravisCI to Coveralls + * New tests to cover psl_latest() and psl_dist_filename() + +15.12.2016 Release V0.16.1 + * Fix SO_VERSION to 6:0:1 + * Add --use-latest-psl to tools/psl as default + +16.12.2016 Release V0.16.0 + * Add functions psl_latest() and psl_dist_filename() + * Do not taint out variable on error in psl_str_to_utf8lower() + * Replace psl2c by psl-make-dafsa + * Add missing includes for OpenBSD + * Fix typos + * Update copyright year + +14.11.2016 Release V0.15.0 + * Python3 compatibility for psl-make-dafsa + * Support for UTF-8 in DAFSA data + * Skip punycode conversion if DAFSA has UTF-8 + * Better code coverage by test suite + * Code cleanup and enhancements + * Install man pages for psl-make-dafsa and psl + * Enhancements to the documentation + +30.07.2016 Release V0.14.0 + * Remove unneeded libraries from tools/psl link step + * Use https instead of http where possible + * Add man page for tools/psl + * Add header magic to DAFSA files + * Rename make_dafsa.py to psl-make-dafsa + * Add man page for psl-make-dafsa + +02.03.2016 Release V0.13.0 + * Use tests.txt as PSL test file by default + * Slightly shorter DAFSA array when sorting input + * Check for python 2.7+ in configure.ac + * Fix python3 incompatibilities in make_dafsa.py + +02.01.2016 Release V0.12.0 + * Load DAFSA binaries via psl_load_file() via auto-detection + * Add more tests + * Remove psl_builtin_compile_time() + * Compile PSL into DAFSA using make_dafsa.py + * Avoid libicu dependency with --enable-runtime=no + * Test on new Travis-CI build farm + * Use DAFSA format for builtin PSL data + * Add function psl_is_public_suffix2() + * Fix psl_builtin_outdated() + * Fix several bugs + * Cleanup code + +23.09.2015 Release V0.11.0 + * Add new function psl_check_version_number() + * Add version defines to include file + +19.09.2015 Release V0.10.0 + * Code simplified + * Less data entries, faster lookups + * Add new function psl_suffix_wildcard_count() + * Add new helper function psl_builtin_outdated() + +15.09.2015 Release V0.9.0 + * Added semantic checks to PSL entries when generating built-in data + * Fix test suite for TLD exceptions (not used yet in reality) + * Removed wrong assumption from test suite + * Support explicit combination of 'foo.bar' and '*.foo.bar' + +14.08.2015 Release V0.8.1 + * Fix documentation + * Add syntax checking of tests_psl.txt + +06.08.2015 Release V0.8.0 + * Add https://github.com/publicsuffix as git submodule + * Support Debian 'Reproducible Builds' + * Fix generation of docs + * Check UTF-8 sequences for validity (for libidn<=1.30) + * Add LICENSE to distribution tarball + * Fix compatibility function strndup + +21.02.2015 Release V0.7.1 + * include configured PSL file into tarball + +30.01.2015 Release V0.7.0 + * include effective_tld_names.dat of date 29.12.2014 + * do not install docs when gtk-doc is not installed + * fix several compatibility issues with Solaris + * fix 'make distcheck' after 'make clean' + * mark API as stable + * use pkg-config to detect libicu + +14.11.2014 Release V0.6.2 + * revoked commit from 0.6.1 to satisfy Travis-CI + +14.11.2014 Release V0.6.1 + * include effective_tld_names.dat of date 04.11.2014 + * fix pkg-config configuration + +28.10.2014 Release V0.6.0 + * added support for IP addresses in psl_is_cookie_domain_acceptable() + * removed qsort_r() for compatibility + * check for alloca.h before including + * include effective_tld_names.dat of date 27.10.2014 + +03.08.2014 Release V0.5.1 + * fix ASCII check for architectures where char <> signed char + +02.07.2014 Release V0.5.0 + * added configure --enable-runtime to allow for IDNA library + selection as runtime dependency + * added configure --enable-builtin to allow for IDNA library + selection for generating the built-in PSL data + * fixed psl_str_to_utf8lower prototype + * fixed authors name to UTF-8 + +23.06.2014 Release V0.4.0 + * depend on libicu for punycode, utf-8 and lowercase conversions + * added function psl_str_to_utf8lower() + * fixed locale issues + * introducing psl_error_t for error codes + defines + * removed redundant code from psl2c.c + * updated docs + * psl utility reads from stdin if no argument specified + +10.06.2014 Release V0.3.1 + * link psl utility dynamically + * fix output of psl_filename() + * cleanup for psl --help + * removed check for idn2 in autogen.sh + +05.06.2014 Release V0.3.0 + * added support for libicu in psl2c (IDNA2008 UTS#46) + this needs pkg-config and libicu-dev installed + * added --version to psl utility + +31.05.2014 Release V0.2.5 + * added psl_get_version() + * removed version from library name + +30.05.2014 Release V0.2.4 + * fixed psl_builtin() to return NULL if no built-in PSL data is available + +27.05.2014 Release V0.2.3 + * changed API version to 0.2 + +26.05.2014 Release V0.2.2 + * changed code to C89 + * added a few test cases + * build static library by default + +25.04.2014 Hotfix release V0.2.1 + * updated to the latest Publix Suffix List + +25.04.2014 Initial release V0.2 diff --git a/curl/dep/libressl/COPYING.txt b/curl/dep/libressl/COPYING.txt new file mode 100644 index 0000000..892e14a --- /dev/null +++ b/curl/dep/libressl/COPYING.txt @@ -0,0 +1,133 @@ + + LibReSSL files are retained under the copyright of the authors. New + additions are ISC licensed as per OpenBSD's normal licensing policy, + or are placed in the public domain. + + The OpenSSL code is distributed under the terms of the original OpenSSL + licenses which follow: + + LICENSE ISSUES + ============== + + The OpenSSL toolkit stays under a dual license, i.e. both the conditions of + the OpenSSL License and the original SSLeay license apply to the toolkit. + See below for the actual license texts. In case of any license issues + related to OpenSSL please contact openssl-core@openssl.org. + + OpenSSL License + --------------- + +/* ==================================================================== + * Copyright (c) 1998-2011 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + + Original SSLeay License + ----------------------- + +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + diff --git a/curl/dep/libressl/ChangeLog.txt b/curl/dep/libressl/ChangeLog.txt new file mode 100644 index 0000000..0ab115b --- /dev/null +++ b/curl/dep/libressl/ChangeLog.txt @@ -0,0 +1,3239 @@ +Because this project is maintained both in the OpenBSD tree using CVS and in +Git, it can be confusing following all of the changes. + +Most of the libssl and libcrypto source code is here in OpenBSD CVS: + + https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/ + +Some of the libcrypto and OS-compatibility files for entropy and random number +generation are here: + + https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libcrypto/ + +A simplified TLS wrapper library is here: + + https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libtls/ + +The LibreSSL Portable project copies these portions of the OpenBSD tree, along +with relevant portions of the C library, to a Git repository. This makes it +easier to follow all of the relevant changes to the upstream project in a +single place: + + https://github.com/libressl/openbsd + +The portable bits of the project are largely maintained out-of-tree, and their +history is also available from Git. + + https://github.com/libressl/portable + +LibreSSL Portable Release Notes: + +4.1.0 - Stable release + + * Portable changes + - Added initial experimental support for loongarch64. + - Fixed compilation for mips32 and reenable CI. + - Fixed CMake builds on FreeBSD. + - Fixed the --prefix option for cmake --install. + - Fixed tests for MinGW due to missing sh(1). + * Internal improvements + - Cleaned up the error implementation. + - Many bug fixes and simplifications in the EC ASN.1 code. + - Corrected DER encoding for EC keys and parameters. + - Polished EC_POINT_{oct2point,point2oct}() internals. + - Rewrote the wNAF code for fast ECDSA verification. + - Improved the code setting compressed coordinates for EC points. + - Reworked CPU capabilities detection for amd64 and aarch64. + - New SHA-1, SHA-256 and SHA-512 assembly implementations for amd64. + These make use of the SHA-NI instruction if it is available and + replace the perl-generated assembly optimized for museum pieces. + These are not yet enabled in libressl-portable. + - New SHA-256 and SHA-512 assembly implementations for aarch64 + making use of the ARM Cryptographic Extension (CE). Not yet + enabled in libressl-portable. + - New simplified, readable MD5 implementation for amd64. + - Rewrote BN_bn2binpad() and its lebin siblings. + - The BIGNUMs in EC_GROUP and EC_POINT are now heap allocated. + - Rewrote TS_ASN1_INTEGER_print_bio(). + - Improved bit counter handling in MD5. + - Simplified and cleaned up the BN_RECP_CTX internals. + - Improved SM4 to match other symmetric ciphers more closely. + - Rewrote X509_NAME_oneline() and X509_NAME_print() using CBS/CBB. + - CRLs are now cached in the issuer cache like certificates. + - Replaced combinations of BN_MONT_CTX_new/set with an internal + BN_MONT_CTX_create(). + - Replaced BN_bn2hex() reimplementation in openssl(1) ca with + a proper API call. + - Fixed integer overflows due to signed shift in obj_dat.c. + - Improved some X509_VERIFY_PARAM internals and avoid an out of + bounds read from public API. + - Imported ML-KEM 768 and 1024 from BoringSSL (not yet public API). + * Compatibility changes + - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). + It has no effect since LibreSSL doesn't call atexit(). + - Elliptic curve parameters are only accepted if they encode a + built-in curve. + - EC_METHOD is no longer public and the API exposing it has been + removed. This includes EC_GROUP_new(), EC_GFp_mont_method(), + EC_GROUP_method_of() and EC_METHOD_get_field_type(). + - The precomputation stubs for EC_GROUP were removed. + - The API setting Jacobian projective coordinates for a point was + removed as were EC_POINTs_{mul,make_affine}(). + - All elliptic curves over fields with less than 224 bits and a + few more were removed from the built-in curves. This includes + all WTLS curves and P-192. + - It is no longer necessary to set RSA_FLAG_SIGN_VER to use the + sign and verify handlers set with RSA_meth_set_{sign,verify}. + - Removed the -C option to generate "C code" from the openssl(1) + dh, dhparam, dsaparam, ecparam, and x509 subcommands. + - Removed #error in headers when OPENSSL_NO_* is defined. + - CRYPTO_set_mem_functions() now matches OpenSSL 1.1 and + CRYPTO_set_mem_ex_functions() was removed. + - The tls_session_secret_cb_fn type now matches OpenSSL 1.1. + - Unexport X509_NAME_print() and X509_OBJECT_up_ref_count(). + - const corrected UI_OpenSSL() and BN_MONT_CTX_copy(). + - Support OPENSSL_NO_FILENAMES. + - Support SSL_OP_NO_RENEGOTIATION and SSL_OP_ALLOW_CLIENT_RENEGOTIATION. + - Export PKCS12_key_gen_uni() again. + * New features + - libtls has a new tls_peer_cert_common_name() API call to retrieve + the peer's common name without having to inspect the PEM. + * Bug fixes + - Plugged a leak in eckey_compute_pubkey(). + - Again allow the magic values -1, -2 and -3 for the salt length + of an RSA-PSS key in the EVP_PKEY_CTX_ctrl_str() interface. + - Fixed a few memory leaks in legacy code. + * Documentation + - The remaining undocumented public EVP API is now documented. + - Reorganization of existing documentation for clarity and accuracy. + * Testing and proactive security + - Improved regress coverage of the EC code. + +4.0.0 - Stable release + + * Portable changes + - Added initial Emscripten support in CMake builds. + - Removed timegm() compatibility layer since all uses were replaced + with OPENSSL_timegm(). Cleaned up the corresponding test harness. + - The mips32 platform is no longer actively supported. + - Fixed Windows support for dates beyond 2038. + * Internal improvements + - Cleaned up parts of the conf directory. Simplified some logic, + fixed memory leaks. + - Simplified X509_check_trust() internals to be somewhat readable. + - Removed last internal uses of gmtime() and timegm() and replaced + them with BoringSSL's posix time conversion API. + - Removed unnecessary stat calls in by_dir. + - Split parsing and processing of TLS extensions to ensure that + extension callbacks are called in a predefined order. + - Cleaned up the MD4 and MD5 implementations. + - Assembly functions are no longer exposed in the public API, they + are all wrapped by C functions. + - Removed assembly implementations of legacy ciphers on legacy + architectures. + - Merged most multi-file implementations of ciphers into one or two + C files. + - Removed the cache of certificate validity. This was added for + performance reasons which no longer apply since BoringSSL's time + conversion API isn't slow. Also, a recently added error check led + to obscure, undesirable validation failures. + - Stopped calling OPENSSL_cpuid_setup() from the .init section on + amd64 and i386. + - Rewrote various BN conversion functions. + - Improved certification request internals. + - Removed unused DSA methods. + - Improved X.509v3 extension internals. Fixed various bugs and leaks + in X509V3_add1_i2d() and X509V3_get_d2i(). Their implementations + now vaguely resemble code. + - Rewrote BN_bn2mpi() using CBB. + - Made most error string tables const. + - Removed handling for SSLv2 client hello messages. + - Improvements in the openssl(1) speed app's signal handler. + - Cleaned up various X509v3_* extension API. + - Unified the X.509v3 extension methods. + - Cleaned up cipher handling in SSL_SESSION. + - Removed get_cipher from SSL_METHOD. + - Rewrote CRYPTO_EX_DATA from scratch. The only intentional change of + behavior is that there is now a hard limit on the number of indexes + that can be allocated. + - Removed bogus connect() call from netcat. + - Uses of atoi() and strtol() in libcrypto were replaced with + strtonum(). + - Introduced crypto_arch.h which will contain the architecture + dependent code and defines rather than the public opensslconf.h. + - OPENSSL_cpu_caps() is now architecture independent. + - Reorganized the DES implementation to use fewer files and removed + optimizations for ancient processors and compilers. + * New features + - Added CRLfile option to the cms command of openssl(1) to specify + additional CRLs for use during verification. + * Documentation improvements + - Removed documentation of no longer existing API. + - Unified the description of the obsolete ENGINE parameter that + needs to remain in many functions and should always be NULL. + * Testing and proactive security + - Switched the remaining tests to new certs. + * Compatibility changes + - Protocol parsing in libtls was changed. The unsupported TLSv1.1 + and TLSv1.0 protocols are ignored and no longer enable or disable + TLSv1.2 in surprising ways. + - The dangerous EVP_PKEY*_check(3) family of functions was removed. + The openssl(1) pkey and pkeyparam commands no longer support the + -check and -pubcheck flags. + - The one-step hashing functions, MD4(), MD5(), RIPEMD160(), SHA1(), + all SHA-2, and HMAC() no longer support returning a static buffer. + Callers must pass in a correctly sized buffer. + - Support for Whirlpool was removed. Applications still using this + should honor OPENSSL_NO_WHIRLPOOL. + - Removed workaround for F5 middle boxes. + - Removed the useless pem2.h, a public header that was added since + it was too hard to add a single prototype to one file. + - Removed conf_api.h and the public API therein. + - Removed ssl2.h, ssl23.h and ui_compat.h. + - Numerous conf and attribute functions were removed. Some unused + types were removed, others were made opaque. + - Removed the deprecated HMAC_Init() function. + - Removed OPENSSL_load_builtin_modules(). + - Removed X509_REQ_{get,set}_extension_nids(). + - X509_check_trust() and was removed, X509_VAL was made opaque. + - Only specified versions can be set on certs, CRLs and CSRs. + - Removed unused PEM_USER and PEM_CTX types from pem.h. + - Removed typdefs for COMP_CTX, COMP_METHOD, X509_CRL_METHOD, STORE, + STORE_METHOD, and SSL_AEAD_CTX. + - i2d_ASN1_OBJECT() now returns -1 on error like most other i2d_*. + - SPKAC support was removed from openssl(1). + - Added TLS1-PRF support to the EVP interface. + - Support for attributes in EVP_PKEYs was removed. + - The X509at_* API is no longer public. + - SSL_CTX_set1_cert_store() and SSL_CIPHER_get_handshake_digest() + were added to libssl. + - The completely broken UI_UTIL password API was removed. + - The OpenSSL pkcs12 command and PKCS12_create() no longer support + setting the Microsoft-specific Local Key Set and Cryptographic + Service Provider attributes. + * Bug fixes + - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match + their documentation. They always set an RFC 5280 conformant time. + - Improved standards compliance for supported groups and key shares + extensions: + - Duplicate key shares are disallowed. + - Duplicate supported groups are disallowed. + - Key shares must be sent in the order of supported groups. + - Key shares will only be selected if they match the most + preferred supported group by client preference order. + - Fixed signed integer overflow in bnrand(). + - Prevent negative zero from being created via BN_clear_bit() and + BN_mask_bits(). Avoids a one byte overread in BN_bn2mpi(). + - Add guard to avoid contracting the number linear hash buckets + to zero, which could lead to a crash due to accessing a zero + sized allocation. + - Fixed i2d_ASN1_OBJECT() with an output buffer pointing to NULL. + - Implemented RSA key exchange in constant time. This is done by + decrypting with RSA_NO_PADDING and checking the padding in libssl + in constant time. This is possible because the pre-master secret + is of known length based on the size of the RSA key. + - Rewrote SSL_select_next_proto() using CBS, also fixing a buffer + overread that wasn't reachable when used as intended from an + ALPN callback. + - Avoid pushing a spurious error onto the error stack in + ssl_sigalg_select(). + - Made fatal alerts fatal in QUIC. + +3.9.2 - Stable release + + * Bugfixes + - OpenBSD 7.5 errata 003. A missing bounds check could lead to a crash + due to dereferencing a zero-sized allocation. + +3.9.1 - Stable release + + * Portable changes + - Updated tests with expiring certificates + - CET-related build fixes for Windows and macOS targets + - update libtls linker script to include libssl and libcrypto again + +3.9.0 - Development release + + * Portable changes + - libcrypto no longer exports compat symbols in cmake builds. + - Most compatibility symbols are prefixed with libressl_ to avoid + symbol clashes in static links. + - Fixed various warnings on Windows. + - Removed assert pop-ups with Windows debug builds. + - Fixed crashes and hangs in Windows ARM64 builds. + - Improved control-flow enforcement (CET) support. + * Internal improvements + - Converted uses of OBJ_bsearch_() to standard bsearch(). + - Greatly simplified by_file_ctrl(). + - Simplified and cleaned up the OBJ_ API. + - Cleaned up the EVP_Cipher{Init,Update,Final}() implementations. + - Removed unused function pointers from X.509 stores and contexts. + - A lot of cleanup and reorganization in EVP. + - Removed all remaining ENGINE tentacles. + - Simplified internals of X509_TRUST handling. + - Made deletion from a lhash doall callback safe. + - Rewrote BIO_dump*(3) internals to be less bad. + * Documentation improvements + - ENGINE documentation was updated to reflect reality. + - Made EVP API documentation more accurate and less incoherent. + - Call out some shortcomings of the EC_KEY_set_* API explicitly. + * Testing and proactive security + - Bug fixes and simplifications in the Wycheproof tests. + * Compatibility changes + - Added ChaCha20 and chacha20 aliases for ChaCha. + - SSL_library_init() now has the same effect as OPENSSL_init_ssl(). + - EVP_add_{cipher,digest}() were removed. From the OBJ_NAME API, + only OBJ_NAME_do_all*() remain. In particular, it is no longer + possible to add aliases for ciphers and digests. + - The thread unsafe global tables are no longer supported. It is no + longer possible to add aliases for ciphers and digests, custom ASN.1 + strings table entries, ASN.1 methods, PKEY methods, digest methods, + CRL methods, purpose and trust identifiers, or X.509 extensions. + - Removed the _cb() and _fp() versions of BIO_dump{,_indent}(). + - BIO_set() was removed. + - BIO_{sn,v,vsn}printf() were removed. + - Turn the long dysfunctional openssl(1) s_client -pause into a noop. + - openssl(1) x509 now supports -new -force_pubkey, -multivalue-rdn, + -set_issuer, -set_subject, and -utf8. + - Support ECDSA with SHA-3 signature algorithms. + - Support HMAC with truncated SHA-2 and SHA-3 as PBE PRF. + - GOST and STREEBOG support was removed. + - CRYPTO_THREADID, _LHASH, _STACK, X509_PURPOSE are now opaque, + X509_CERT_AUX and X509_TRUST were removed from the public API. + - ASN1_STRING_TABLE_get() and X509_PURPOSE_get0*() now return const + pointers. + - EVP_{CIPHER,MD}_CTX_init()'s signatures and semantics now match + OpenSSL's behavior. + - sk_find_ex() and OBJ_bsearch_() were removed. + - CRYPTO_malloc() was fixed to use size_t argument. CRYPTO_malloc() + and CRYPTO_free() now accept file and line arguments. + - A lot of decrepit CRYPTO memory API was removed. + * Bug fixes + - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). + - Fixed numerous misuses of X509_ALGOR_set0() resulting in leaks and + potentially incorrect encodings. + - Fixed potential double free in X509v3_asid_add_id_or_range(). + - Stopped using ASN1_time_parse() outside of libcrypto. + - Prepared OPENSSL_gmtime() and OPENSSL_timegm() as public API + wrappers of internal functions compatible with BoringSSL API. + - Removed print_bin() to avoid overwriting the stack with 5 bytes + of ' ' when ECPK parameters are printed with large indentation. + - Avoid a NULL dereference after memory allocation failure during TLS + version downgrade. + - Fixed various bugs in CMAC internals. + - Fixed 4-byte overreads in GHASH assembly on amd64 and i386. + - Fixed various NULL dereferences in PKCS #12 code due to mishandling + of OPTIONAL content in PKCS #7 ContentInfo. + - Aligned SSL_shutdown() behavior in TLSv1.3 with the legacy stack. + - Fixed the new X.509 verifier to find trust anchors in the trusted + stack. + - Made in-place decryption work for EVP_chacha20_poly1305(). + +3.8.4 - Stable release + + * Portable changes + - Updated tests with expiring certificates + - CET-related build fixes for Windows and macOS targets + - update libtls linker script to include libssl and libcrypto again + +3.8.3 - Stable release + + * Portable changes + - Removed assert pop-ups with Windows debug builds. + - Fixed crashes and hangs in Windows ARM64 builds. + - Improved control-flow enforcement (CET) support. + +3.8.2 - Stable release + + * Portable changes + - Fixed processor detection for CMake targets. + Thanks to @jiegec from github. + - Enabled building oscpcheck with MSVC. + Thanks to @FtZPetruska from github. + - Improve CMake package detection and installation. + Thanks to @mark-groundctl from github. + - Fixed assembly optimizations on x64 Windows targets. + - Allow disabling warnings about WINCRYPT overrides. + - Use system arc4random on FreeBSD 12 and newer. + * Documentation improvements + - Documented the RFC 3779 API. + * Compatibility changes + - Restrict the RFC 3779 code to IPv4 and IPv6. It was not written + to be able to deal with anything else. + - Fixed EVP_CIPHER_CTX_iv_length() to return what was set with + EVP_CTRL_AEAD_SET_IVLEN or one of its aliases. + * Bug fixes + - Fixed EVP_PKEY_get{0,1}_RSA for RSA-PSS. + - Plug a potential memory leak in ASN1_TIME_normalize(). + - Avoid memory leak in EVP_CipherInit(). + - Redirect EVP_PKEY_get1_* through their get0 siblings. + - Fixed a use of uninitialized in i2r_IPAddrBlocks(). + - Rewrote CMS_SignerInfo_{sign,verify}(). + - Further cleanup and refactoring in the EC code. + - Allow IP addresses to be specified in a URI. + - Fixed a copy-paste error in ASN1_TIME_compare() that could lead + to two UTCTimes or two GeneralizedTimes incorrectly being compared + as equal. + +3.8.1 - Development release + + * Portable changes + - Applications bundled as part of the LibreSSL package internally, + nc(1) and openssl(1), now are linked statically if static libraries + are built. + - Internal compatibility function symbols are no longer exported from + libcrypto. Instead, the libcompat library is linked to libcrypto, + libssl, and libtls separately. This increases size a little, but + ensures that the libraries are not exporting symbols to programs + unintentionally. + - Selective removal of CET implementation on platforms where it is + not supported (macOS). + - Integrated four more tests. + - Added Windows ARM64 architecture to tested platforms. + - Removed Solaris 10 support, fixed Solaris 11. + - libtls no longer links statically to libcrypto / libssl unless + '--enable-libtls-only' is specified at configure time. + - Improved Windows compatibility library, namely handling of files vs + sockets, correcting an exception when operating on a closed socket. + - CMake builds no longer hardcode '-O2' into the compiler flags, instead + using flags from the CMake build type instead. + - Set the CMake default build type to 'Release'. This can be overridden + during configuration. + - Fixed broken ASM support with MinGW builds. + * Internal improvements + - Fixed alignment handling in SHA-512. + - Moved the verified_chain to the correct internal struct. + - Improved checks for commonName in libtls. + - Fixed error check for X509_get_ext_d2i() failure in libtls. + - Improved BIGNUM internals and performance. + - Significantly improved Montgomery multiplication performance. + - Initial cleanup passes for SHA-256 internals. + - Converted more libcrypto internals API using CBB and CBS. + - Removed code guarded by #ifdef ZLIB. + - Changed ASN1_item_sign_ctx() and ASN1_item_verify() to work with + Ed25519 and fixed a few bugs in there. + - Fixed various issues with EVP_PKEY_CTX_{new,dup}(). + - Improved X.509 certificate version checks. + - Cleaned up handling of elliptic curve cofactors. + - Made BN_num_bits() independent of bn->top. + - Rewrote and simplified bn_sqr(). + - Removed EC_GROUP precomp machinery. + - Ensure no X.509v3 extensions appear more than once in certificates. + - Cleaned up various ECDH, ECDSA and EC internals. + - Replaced ASN1_bn_print with a cleaner internal implementation. + - Simplified ASN1_item_sign_ctx(). + - Rewrote OBJ_find_sigid_algs() and OBJ_find_sigid_by_algs(). + - Various improvements in the 'simple' EC code. + - Fix OPENSSL_cpuid_setup() invocations on arm/aarch64. + - Reduced the dependency of hash implementations on many layers of + macros. This results in significant speedups since modern compilers + are now less confused. + - Significantly simplified the BN_BLINDING internals used in RSA. + * New features + * Compatibility changes + - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain + valid UTF-8 without embedded NUL. + - Moved libtls from ECDSA_METHOD to EC_KEY_METHOD. + - Removed support for ECDH_METHOD and ECDSA_METHOD. + - BN_is_prime{,_fasttest}_ex() refuse to check numbers larger than + 32 kbits for primality. This mitigates various DoS vectors. + - Comp was removed. + - Dynamic loading of conf modules is no longer supported. + - DSO was removed and OPENSSL_NO_DSO is defined. + - ENGINE support was removed and OPENSSL_NO_ENGINE is set. In spite + of this, some stub functions are provided to avoid patching some + applications that do not honor OPENSSL_NO_ENGINE. + - It is no longer possible to make the library use your own error + stack or ex_data implementation. + * Bug fixes + - Fixed aliasing issue in BN_mod_inverse(). + - Made CRYPTO_get_ex_new_index() not return 0 to allow applications + to use *_{get,set}_app_data() and *_{get,set}_ex_data() alongside + each other. + - Made EVP_PKEY_set1_hkdf_key() fail on a NULL key. + - Plugged leaks in BIO_chain_dup(). + - Fixed numerous leaks and other minor bugs in RSA, DH, DSA and EC + ASN.1 methods. Unified the coding style. + - On socket errors in the poll loop, netcat could issue system calls + on invalidated file descriptors. + * Documentation improvements + - Made it very explicit that the verify callback should not be used. + - Called out that the CRL lastUpdate is standardized as thisUpdate. + * Testing and Proactive Security + - As always, new test coverage is added as bugs are fixed and subsystems + are cleaned up. + * Security fixes + - Disabled TLSv1.0 and TLSv1.1 in libssl so that they may no longer + be selected for use. + +3.8.0 - Development release + + * Portable changes + - Extended the endian.h compat header with hto* and *toh macros. + - Adapted more tests to the portable framework. + - Internal tools are now statically linked. + * Internal improvements + - Improved sieve of Eratosthenes script used for generating a table + of small primes. + - Started cleaning up and rewriting SHA internals. + - Replace internal use of BN_copy() with bn_copy() for consistency. + - Rewrote and improved BN_exp() and BN_copy(). + - Add branch target information (BTI) support to arm64 assembly. + - Replaced BN_mod_sqrt() with a new implementation. + - Removed incomplete and dangerous BN_RECURSION code. + - Added endbr64 instructions to amd64 assembly. + - Imported RFC 5280 policy checking code from BoringSSL and used it + to replace the old exponential time code. + - Converted more of libcrypto to use CBB/CBS. + - Cleaned up and simplified the code dealing with builtin curves. + * New features + - Added support for truncated SHA-2 and for SHA-3. + - The BPSW primality test performs additional Miller-Rabin rounds + with random bases to reduce the likelihood of composites passing. + - Allow testing of ciphers and digests using badly aligned buffers + in openssl speed. + - Added a workaround for a poorly thought-out change in OpenSSL 3 that + broke privilege separation support in libtls. + * Compatibility changes + - Support for GF2m was removed: BIGNUM no longer supports binary extension + field arithmetic and all binary elliptic builtin curves were removed. + - Removed dangerous, "fast" NIST prime and elliptic curve implementations. + In particular, EC_GFp_nist_method() is no longer available. + - Removed most public symbols that were deprecated in OpenSSL 0.9.8. + - Removed the public X9.31 API (RSA_X931_PADDING is still available). + - Removed Cipher Text Stealing mode. + - Removed SXNET and NETSCAPE_CERT_SEQUENCE support including the + openssl(1) nseq command. + - Dropped proxy certificate (RFC 3820) support. + - The POLICY_TREE and its related structures and API were removed. + - The explicitText user notice uses UTF8String instead of VisibleString + to reduce the risk of emitting certificates with invalid DER-encoding. + - Initial fixes for RSA-PSS support to make the TLSv1.3 stack more + compliant with RFC 8446. + * Bug fixes + - Correctly handle negative input to various BIGNUM functions. + - Ensure ERR_load_ERR_strings() does not set errno unexpectedly. + - Fix error checking of i2d_ECDSA_SIG() in ossl_ecdsa_sign(). + - Fixed detection of extended operations (XOP) on AMD hardware. + - Ensure Montgomery exponentiation is used for the initial RSA blinding. + - Policy is always checked in X509 validation. Critical policy extensions + are no longer silently ignored. + - Fixed error handling in tls_check_common_name(). + - Add missing pointer invalidation in SSL_free(). + - Fixed X509err() and X509V3err() and their internal versions. + - Ensure that OBJ_obj2txt() always returns a C string again. + - In X509_VERIFY_PARAM_inherit() copy hostflags independently of the + host list. + * Documentation improvements + - Improved documentation of BIO_ctrl(3), BIO_set_info_callback(3), + BIO_get_info_callback(3), BIO_method_type(3), and BIO_method_name(3). + - Marked BIO_CB_return(), BIO_cb_pre(), and BIO_cb_post() as intentionally + undocumented. + * Testing and Proactive Security + - Significantly improved test coverage of BN_mod_sqrt() and GCD. + - As always, new test coverage is added as bugs are fixed and subsystems + are cleaned up. + +3.7.3 - Bug and reliability fixes + + * Bug fix + - Hostflags in the verify parameters would not propagate from an + SSL_CTX to newly created SSL. + * Reliability fix + - A double free or use after free could occur after SSL_clear(3). + +3.7.2 - Stable release + + * Portable changes + - Moved official Github project to https://github.com/libressl/. + - Build support for Apple Silicon. + - Installed opensslconf.h is now architecture-specific. + - Removed internal defines from opensslconf.h. + - Support reproducible builds on tagged commits in main branch. + +3.7.1 - Development release + + * Internal improvements + - Initial overhaul of the BIGNUM code: + - Added a new framework that allows architecture-dependent + replacement implementations for bignum primitives. + - Imported various s2n-bignum's constant time assembly primitives + and switched amd64 to them. + - Lots of cleanup, simplification and bug fixes. + - Changed Perl assembly generators to move constants into .rodata, + allowing code to run with execute-only permissions. + - Capped the number of iterations in DSA and ECDSA signing (avoiding + infinite loops), added additional sanity checks to DSA. + - ASN.1 parsing improvements. + - Made UI_destroy_method() NULL safe. + - Various improvements to nc(1). + - Always clear EC groups and points on free. + - Cleanup and improvements in EC code. + - Various openssl(1) improvements. + * Bug fixes + - Fixed a memory leak, a double free and various other issues in + BIO_new_NDEF(). + - Fixed various crashes in the openssl(1) testing utility. + - Do not check policies by default in the new X.509 verifier. + - Added missing error checking in PKCS7. + - Call CRYPTO_cleanup_all_ex_data() from OPENSSL_cleanup(). + * New features + - Added UI_null() + - Added X509_STORE_*check_issued() + - Added X509_CRL_get0_tbs_sigalg() and X509_get0_uids() accessors. + - Added EVP_CIPHER_meth_*() setter API. + * Documentation improvements + - Marked BIO_s_log(3) BIO_nread0(3), BIO_nread(3), BIO_nwrite0(3), BIO_nwrite(3), + BIO_dump_cb(3) and BIO_dump_indent_cb(3) as intentionally undocumented. + - Document BIO_number_read(3), BIO_number_written(3), + BIO_set_retry_read(3), BIO_set_retry_write(3), + BIO_set_retry_special(3), BIO_clear_retry_flags(3), + BIO_get_retry_flags(3), BIO_dup_chain(3), BIO_set_flags(3), + BIO_clear_flags(3), BIO_test_flags(3), BIO_get_flags(3). + BIO_callback_fn_ex(3), BIO_set_callback_ex(3), BIO_get_callback_ex(3), + BIO_callback_fn(3), and the BIO_FLAGS_* constants + - Correct the prototypes of BIO_get_conn_ip(3) and BIO_get_conn_int_port(3). + - Document ED25519_keypair(3), ED25519_sign(3), and ED25519_verify(3). + - Document EVP_PKEY_new_raw_private_key(3), + EVP_PKEY_new_raw_public_key(3), EVP_PKEY_get_raw_private_key(3), and + EVP_PKEY_get_raw_public_key(3). + - Document ASN1_buf_print(3). + - Document DH_get0_*, DSA_get0_*, ECDSA_SIG_get0_{r,s}() and RSA_get0_*. + - Merged documentation of UI_null() from OpenSSL 1.1 + - Various spelling and other documentation improvements. + * Testing and Proactive Security + - As always, new test coverage is added as bugs are fixed and subsystems + are cleaned up. + - New Wycheproof tests added. + - OpenSSL 3.0 Interop tests added. + - Many old tests rewritten, cleaned up and extended. + * Security fixes + - A malicious certificate revocation list or timestamp response token + would allow an attacker to read arbitrary memory. + +3.7.0 - Development release + + * Internal improvements + - Remove dependency on system timegm() and gmtime() by replacing + traditional Julian date conversion with POSIX epoch-seconds date + conversion from BoringSSL. + - Clean old and unused BN code dealing with primes. + - Start rewriting name constraints code using CBS. + - Remove support for the HMAC PRIVATE KEY. + - Rework DSA signing and verifying internals. + - First few passes on cleaning up the BN code. + - Internal headers coming from OpenSSL are all called *_local.h now. + - Rewrite TLSv1.2 key exporter. + - Cleaned up and refactored various aspects of the legacy TLS stack. + * Compatibility changes + - BIO_read() and BIO_write() now behave more closely to OpenSSL 3 in + various corner cases. More work is needed here. + * Bug fixes + - Add EVP_chacha20_poly1305() to the list of all ciphers. + - Fix potential leaks of EVP_PKEY in various printing functions + - Fix potential leak in OBJ_NAME_add(). + - Avoid signed overflow in i2c_ASN1_BIT_STRING(). + - Clean up EVP_PKEY_ASN1_METHOD related tables and code. + - Fix long standing bugs BN_GF2m_poly2arr() and BN_GF2m_mod(). + - Fix segfaults in BN_{dec,hex}2bn(). + - Fix NULL dereference in x509_constraints_uri_host() reachable only + in the process of generating certificates. + - Fixed a variety of memory corruption issues in BIO chains coming + from poor old and new API: BIO_push(), BIO_pop(), BIO_set_next(). + - Avoid potential divide by zero in BIO_dump_indent_cb() + * Documentation improvements + - Numerous improvements and additions for ASN.1, BIO, BN, and X.509. + - The BN documentation is now considered to be complete. + * Testing and Proactive Security + - As always, new test coverage is added as bugs are fixed and + subsystems are cleaned up. + - Many old tests rewritten, cleaned up and extended. + * New features + - Added Ed25519 support both as a primitive and via OpenSSL's EVP + interfaces. + - X25519 is now also supported via EVP. + - The OpenSSL 1.1 raw public and private key API is available with + support for EVP_PKEY_ED25519, EVP_PKEY_HMAC and EVP_PKEY_X25519. + Poly1305 is not currently supported via this interface. + +3.6.3 - Bug and reliability fixes + + * Bug fix + - Hostflags in the verify parameters would not propagate from an + SSL_CTX to newly created SSL. + * Reliability fix + - A double free or use after free could occur after SSL_clear(3). + +3.6.2 - Security release + + * Security fix + - A malicious certificate revocation list or timestamp response token + would allow an attacker to read arbitrary memory. + +3.6.1 - Stable release + + * Bug fixes + - Custom verification callbacks could cause the X.509 verifier to + fail to store errors resulting from leaf certificate verification. + Reported by Ilya Shipitsin. + - Unbreak ASN.1 indefinite length encoding. + Reported by Niklas Hallqvist. + +3.6.0 - Development release + + * Internal improvements + - Avoid expensive RFC 3779 checks during cert verification. + - The templated ASN.1 decoder has been cleaned up, refactored, + modernized with parts rewritten using CBB and CBS. + - The ASN.1 time parser has been rewritten. + - Rewrite and fix ASN1_STRING_to_UTF8(). + - Use asn1_abs_set_unused_bits() rather than inlining it. + - Simplify ec_asn1_group2curve(). + - First pass at a clean up of ASN1_item_sign_ctx() + - ssl_txt.c was cleaned up. + - Internal function arguments and struct member have been changed + to size_t. + - Lots of missing error checks of EVP API were added. + - Clean up and clarify BN_kronecker(). + - Simplify ASN1_INTEGER_cmp() + - Rewrite ASN1_INTEGER_{get,set}() using CBS and CBB and reuse + the ASN1_INTEGER functions for ASN1_ENUMERATED. + - Use ASN1_INTEGER to parse and build {Z,}LONG_it + - Refactored and cleaned up group (elliptic curve) handling in + t1_lib.c. + - Simplify certificate list handling code in the legacy server. + - Make CBB_finish() fail if *out_data is not NULL. + - Remove tls_buffer_set_data() and remove/revise callers. + - Rewrite SSL{_CTX,}_set_alpn_protos() using CBS. + - Simplify tlsext_supported_groups_server_parse(). + - Remove redundant length checks in tlsext parse functions. + - Simplify tls13_server_encrypted_extensions_recv(). + - Add read and write support to tls_buffer. + - Convert TLS transcript from BUF_MEM to tls_buffer. + - Clear key on exit in PKCS12_gen_mac(). + - Minor fixes in PKCS12_parse(). + - Provide and use a primitive clear function for BIGNUM_it. + - Use ASN1_INTEGER to encode/decode BIGNUM_it. + - Add stack frames to AES-NI x86_64 assembly. + - Use named initialisers for BIGNUMs. + - Tidy up some of BN_nist_mod_*. + - Expand BLOCK_CIPHER_* and related macros. + - Avoid shadowing the cbs function parameter in + tlsext_alpn_server_parse() + - Deduplicate peer certificate chain processing code. + - Make it possible to signal an error from an i2c_* function. + - Rewrite i2c_ASN1_INTEGER() using CBB/CBS. + - Remove UINT32_MAX limitation on ChaCha() and CRYPTO_chacha_20(). + - Remove bogus length checks from EVP_aead_chacha20_poly1305(). + - Reworked DSA_size() and ECDSA_size(). + - Stop using CBIGNUM_it internal to libcrypto. + - Provide c2i_ASN1_ENUMERATED_cbs() and call it from + asn1_c2i_primitive(). + - Ensure ASN.1 types are appropriately encoded. + - Avoid recycling ASN1_STRINGs when decoding ASN.1. + - Tidy up asn1_c2i_primitive() slightly. + - Mechanically expand IMPLEMENT_BLOCK_CIPHER, IMPLEMENT_CFBR, + BLOCK_CIPHER and the looney M_do_cipher macros. + - Use correct length for EVP CFB mode ciphers. + - Provide a version of ssl_msg_callback() that takes a CBS. + - Use CBS to parse TLS alerts in the legacy stack. + - Increment the input and output position for EVP AES CFB1. + - Ensure there is no trailing data for a CCS received by the + TLSv1.3 stack. + - Use CBS when procesing a CCS message in the legacy stack. + - Be stricter with middlebox compatibility mode in the TLSv1.3 + server. + * Compatibility changes + - The ASN.1 time parser has been refactored and rewritten using CBS. + It has been made stricter in that it now enforces the rules from + RFC 5280. + - ASN1_AFLG_BROKEN was removed. + - Error check tls_session_secret_cb() like OpenSSL. + - Added ASN1_INTEGER_{get,set}_{u,}int64() + - Move leaf certificate checks to the last thing after chain + validation. + - Added -s option to openssl(1) ciphers that only shows the ciphers + supported by the specified protocol. + - Use TLS_client_method() instead of TLSv1_client_method() in + the openssl(1) ciphers command. + - Validate the protocols in SSL{_CTX,}_set_alpn_protos(). + - Made TS and PKCS12 opaque. + - Per RFC 7292, safeContentsBag is a SEQUENCE OF, not a SET OF. + - Align PKCS12_key_gen_uni() with OpenSSL + - Various PKCS12 and TS accessors were added. In particular, the + TS_RESP_CTX_set_time_cb() function was added back. + - Allow a NULL header in PEM_write{,_bio}() + - Allow empty attribute sets in CSRs. + - Adjust signatures of BIO_ctrl functions. + - Provide additional defines for EVP AEAD. + - Provide OPENSSL_cleanup(). + - Make BIO_info_cb() identical to bio_info_cb(). + * Bug fixes + - Avoid use of uninitialized in BN_mod_exp_recp(). + - Fix X509_get_extension_flags() by ensuring that EXFLAG_INVALID is + set on X509_get_purpose() failure. + - Fix HMAC() with NULL key. + - Add ERR_load_{COMP,CT,KDF}_strings() to ERR_load_crypto_strings(). + - Avoid strict aliasing violations in BN_nist_mod_*(). + - Do not return X509_V_ERR_UNSPECIFIED from X509_check_ca(). + No return value of X509_check_ca() indicates failure. Application + code should therefore issue a checked call to X509_check_purpose() + before calling X509_check_ca(). + - Rewrite and fix X509v3_asid_subset() to avoid segfaults on some + valid input. + - Call the ASN1_OP_D2I_PRE callback after ASN1_item_ex_new(). + - Fix d2i_ASN1_OBJECT to advance the *der_in pointer correctly. + - Avoid use of uninitialized in ASN1_STRING_to_UTF8(). + - Do not pass uninitialized pointer to ASN1_STRING_to_UTF8(). + - Do not refuse valid IPv6 addresses in nc(1)'s HTTP CONNECT proxy. + - Do not reject primes in trial divisions. + - Error out on negative shifts in BN_{r,l}shift() instead of + accessing arrays out of bounds. + - Fix URI name constraints, allow for URI's with no host part. + - Fix the legacy verifier callback behaviour for untrusted certs. + - Correct serfver-side handling of TLSv1.3 key updates. + - Plug leak in PKCS12_setup_mac(). + - Plug leak in X509V3_add1_i2d(). + - Only print X.509 versions we know about. + - Avoid signed integer overflow due to unary negation + - Initialize readbytes in BIO_gets(). + - Plug memory leak in CMS_add_simple_smimecap(). + - Plug memory leak in X509_REQ_print_ex(). + - Check HMAC() return value to avoid a later use of uninitialized. + - Avoid potential NULL dereference in ssl_set_pkey(). + - Check return values in ssl_print_tmp_key(). + - Switch loop bounds from size_t to int in check_hosts(). + - Avoid division by zero if no connection was made in s_time.c. + - Check sk_SSL_CIPHER_push() return value + - Avoid out-of-bounds read in ssl_cipher_process_rulestr(). + - Use LONG_MAX as the limit for ciphers with long based APIs. + * New features + - EVP API for HKDF ported from OpenSSL and subsequently cleaned up. + - The security level API (SSL_{,CTX}_{get,set}_security_level()) is + now available. Callbacks and ex_data are not supported. Sane + software will not be using this. + - Experimental support for the BoringSSL QUIC API. + - Add initial support for TS ESSCertIDv2 verification. + - LibreSSL now uses the Baillie-PSW primality test instead of + Miller-Rabin . + +3.5.3 - Reliability fix + + * Fix d2i_ASN1_OBJECT(). A confusion of two CBS resulted in advancing + the passed *der_in pointer incorrectly. Thanks to Aram Sargsyan for + reporting the issue and testing the fix. + +3.5.2 - Stable release + + * Bug fixes + - Avoid single byte overread in asn1_parse2(). + - Allow name constraints with a leading dot. From Alex Wilson. + - Relax a check in x509_constraints_dirname() to allow prefixes. + From Alex Wilson. + - Fix NULL dereferences in openssl(1) cms option parsing. + - Do not zero the computed cofactor on ec_guess_cofactor() success. + - Bound cofactor in EC_GROUP_set_generator() to reduce the number of + bogus groups that can be described with nonsensical parameters. + - Avoid various potential segfaults in EVP_PKEY_CTX_free() in low + memory conditions. Reported for HMAC by Masaru Masuda. + - Plug leak in ASN1_TIME_adj_internal(). + - Avoid infinite loop for custom curves of order 1. + Issue reported by Hanno Boeck, comments by David Benjamin. + - Avoid an infinite loop on parsing DSA private keys by validating + that the provided parameters conform to FIPS 186-4. + Issue reported by Hanno Boeck, comments by David Benjamin. + * Compatibility improvements + - Allow non-standard name constraints of the form @domain.com. + * Internal improvements + - Limit OID text conversion to 64 bits per arc. + - Clean up and simplify memory BIO code. + - Reduce number of memmove() calls in memory BIOs. + - Factor out alert handling code in the legacy stack. + - Add sanity checks on p and q in old_dsa_priv_decode() + - Cache the SHA-512 hash instead of the SHA-1 for CRLs. + - Suppress various compiler warnings for old gcc versions. + - Remove free_cont from asn1_d2i_ex_primitive()/asn1_ex_c2i(). + - Rework ownership handling in x509_constraints_validate(). + - Rework ASN1_STRING_set(). + - Remove const from tls1_transcript_hash_value(). + - Clean up and simplify ssl3_renegotiate{,_check}(). + - Rewrite legacy TLS and DTLS unexpected handshake message handling. + - Simplify SSL_do_handshake(). + - Rewrite ASCII/text to ASN.1 object conversion. + - Provide t2i_ASN1_OBJECT_internal() and use it for OBJ_txt2obj(). + - Split armv7 and aarch64 code into separate locations. + - Rewrote openssl(1) ts to use the new option handling and cleaned + up the C code. + - Provide asn1_get_primitive(). + - Convert {c2i,d2i}_ASN1_OBJECT() to CBS. + - Remove the minimum record length checks from dtls1_read_bytes(). + - Clean up {dtls1,ssl3}_read_bytes(). + - Be more careful with embedded and terminating NULs in the new + name constraints code. + - Check EVP_Digest* return codes in openssl(1) ts + - Various minor code cleanup in openssl(1) pkcs12 + - Use calloc() in pkey_hmac_init(). + - Simplify priv_key handling in d2i_ECPrivateKey(). + * Documentation improvements + - Update d2i_ASN1_OBJECT(3) documentation to reflect reality after + refactoring and bug fixes. + - Fixed numerous minor grammar, spelling, wording, and punctuation + issues. + +3.5.1 - Security release + + * A malicious certificate can cause an infinite loop. + Reported by and fix from Tavis Ormandy and David Benjamin, Google. + +3.5.0 - Development release + + * New Features + - The RFC 3779 API was ported from OpenSSL. Many bugs were fixed, + regression tests were added and the code was cleaned up. + - Certificate Transparency was ported from OpenSSL. Many internal + improvements were made, resulting in cleaner and safer code. + Regress coverage was added. libssl does not yet make use of it. + * Portable Improvements + - Fixed various POSIX compliance and other portability issues + found by the port to the Sortix operating system. + - Add libmd as platform specific libraries for Solaris. + Issue reported from (ihsan opencsw org) on libressl ML. + - Set IA-64 compiler flag only if it is HP-UX with IA-64. + Suggested from Larkin Nickle (me larbob org) by libressl ML. + - Enabled and scheduled Coverity scan. + Contributed by Ilya Shipitsin (chipitsine gmail com> on github. + * Compatibility Changes + - Most structs that were previously defined in the following headers + are now opaque as they are in OpenSSL 1.1: + bio.h, bn.h, comp.h, dh.h, dsa.h, evp.h, hmac.h, ocsp.h, rsa.h, + x509.h, x509v3.h, x509_vfy.h + - Switch TLSv1.3 cipher names from AEAD- to OpenSSL's TLS_ + OpenSSL added the TLSv1.3 ciphersuites with "RFC names" instead + of using something consistent with the previous naming. Various + test suites expect these names (instead of checking for the much + more sensible cipher numbers). The old names are still accepted + as aliases. + - Subject alternative names and name constraints are now validated + when they are added to certificates. Various interoperability + problems with stacks that validate certificates more strictly + than OpenSSL can be avoided this way. + - Attempt to opportunistically use the host name for SNI in s_client + * Bug fixes + - In some situations, the verifier would discard the error on an + unvalidated certificate chain. This would happen when the + verification callback was in use, instructing the verifier to + continue unconditionally. This could lead to incorrect decisions + being made in software. + - Avoid an infinite loop in SSL_shutdown() + - Fix another return 0 bug in SSL_shutdown() + - Handle zero byte reads/writes that trigger handshakes in the + TLSv1.3 stack + - A long standing memleak in libtls CRL handling was fixed + * Internal Improvements + - Cache the SHA-512 hash instead of the SHA-1 hash and cache + notBefore and notAfter times when X.509 certificates are parsed. + - The X.509 lookup code has been simplified and cleaned up. + - Fixed numerous issues flagged by coverity and the cryptofuzz + project + - Increased the number of Miller-Rabin checks in DH and DSA + key/parameter generation + - Started using the bytestring API in libcrypto for cleaner and + safer code + - Convert {i2d,d2i}_{,EC_,DSA_,RSA_}PUBKEY{,_bio,_fp}() to templated + ASN1 + - Convert ASN1_OBJECT_new() to calloc() + - Convert ASN1_STRING_type_new() to calloc() + - Rewrite ASN1_STRING_cmp() + - Use calloc() for X509_CRL_METHOD_new() instead of malloc() + - Convert ASN1_PCTX_new() to calloc() + - Replace asn1_tlc_clear and asn1_tlc_clear_nc macros with a + function + - Consolidate {d2i,i2d}_{pr,pu}.c + - Remove handling of a NULL BUF_MEM from asn1_collect() + - Pull the recursion depth check up to the top of asn1_collect() + - Inline collect_data() in asn1_collect() + - Convert asn1_d2i_ex_primitive()/asn1_collect() from BUF_MEM to CBB + - Clean up d2i_ASN1_BOOLEAN() and i2d_ASN1_BOOLEAN() + - Consolidate ASN.1 universal tag type data + - Rewrite ASN.1 identifier/length parsing in CBS + - Make OBJ_obj2nid() work correctly with NID_undef + - tlsext_tick_lifetime_hint is now an uint32_t + - Untangle ssl3_get_message() return values + - Rename tls13_buffer to tls_buffer + - Fold DTLS_STATE_INTERNAL into DTLS1_STATE + - Provide a way to determine our maximum legacy version + - Mop up enc_read_ctx and read_hash + - Fold SSL_SESSION_INTERNAL into SSL_SESSION + - Use ssl_force_want_read in the DTLS code + - Add record processing limit to DTLS code + - Add explicit CBS_contains_zero_byte() check in CBS_strdup() + - Improve SNI hostname validation + - Ensure SSL_set_tlsext_host_name() is given a valid hostname + - Fix a strange check in the auto DH codepath + - Factor out/rewrite DHE key exchange + - Convert server serialisation of DHE parameters/public key to new + functions + - Check DH public key in ssl_kex_peer_public_dhe() + - Move the minimum DHE key size check into ssl_kex_peer_params_dhe() + - Clean up and refactor server side DHE key exchange + - Provide CBS_get_last_u8() + - Provide CBS_get_u64() + - Provide CBS_add_u64() + - Provide various CBS_peek_* functions + - Use CBS_get_last_u8() to find the content type in TLSv1.3 records + - unifdef TLS13_USE_LEGACY_CLIENT_AUTH + - Correct SSL_get_peer_cert_chain() when used with the TLSv1.3 stack + - Only allow zero length key shares when we know we're doing HRR + - Pull key share group/length CBB code up from + tls13_key_share_public() + - Refactor ssl3_get_server_kex_ecdhe() to separate parsing and + validation + - Return 0 on failure from send/get kex functions in the legacy + stack + - Rename tls13_key_share to tls_key_share + - Allocate and free the EVP_AEAD_CTX struct in + tls13_record_protection + - Convert legacy TLS client to tls_key_share + - Convert legacy TLS server to tls_key_share + - Stop attempting to duplicate the public and private key of dh_tmp + - Rename dh_tmp to dhe_params + - Rename CERT to SSL_CERT and CERT_PKEY to SSL_CERT_PKEY + - Clean up pkey handling in ssl3_get_server_key_exchange() + - Fix GOST skip certificate verify handling + - Simplify tlsext_keyshare_server_parse() + - Plumb decode errors through key share parsing code + - Simplify SSL_get_peer_certificate() + - Cleanup/simplify ssl_cert_type() + - The S3I macro was removed + - The openssl(1) cms and smime subcommands option handling was + converted and the C source was cleaned up. + * Documentation improvements + - 45 new manual pages, most of which were written from scratch. + Documentation coverage of ASN.1 and X.509 code has been + significantly improved. + * API additions and removals + - libssl + API additions + SSL_get0_verified_chain SSL_peek_ex SSL_read_ex SSL_write_ex + API stubs for compatibility + SSL_CTX_get_keylog_callback SSL_CTX_get_num_tickets + SSL_CTX_set_keylog_callback SSL_CTX_set_num_tickets + SSL_get_num_tickets SSL_set_num_tickets + - libcrypto + added API (some of these were previously available as macros): + ASIdOrRange_free ASIdOrRange_new ASIdentifierChoice_free + ASIdentifierChoice_new ASIdentifiers_free ASIdentifiers_new + ASN1_TIME_diff ASRange_free ASRange_new BIO_get_callback_ex + BIO_get_init BIO_set_callback_ex BIO_set_next + BIO_set_retry_reason BN_GENCB_set BN_GENCB_set_old + BN_abs_is_word BN_get_flags BN_is_negative + BN_is_odd BN_is_one BN_is_word BN_is_zero BN_set_flags + BN_to_montgomery BN_with_flags BN_zero_ex CTLOG_STORE_free + CTLOG_STORE_get0_log_by_id CTLOG_STORE_load_default_file + CTLOG_STORE_load_file CTLOG_STORE_new CTLOG_free + CTLOG_get0_log_id CTLOG_get0_name CTLOG_get0_public_key + CTLOG_new CTLOG_new_from_base64 CT_POLICY_EVAL_CTX_free + CT_POLICY_EVAL_CTX_get0_cert CT_POLICY_EVAL_CTX_get0_issuer + CT_POLICY_EVAL_CTX_get0_log_store CT_POLICY_EVAL_CTX_get_time + CT_POLICY_EVAL_CTX_new CT_POLICY_EVAL_CTX_set1_cert + CT_POLICY_EVAL_CTX_set1_issuer + CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE + CT_POLICY_EVAL_CTX_set_time DH_get0_g DH_get0_p DH_get0_priv_key + DH_get0_pub_key DH_get0_q DH_get_length DSA_bits DSA_get0_g + DSA_get0_p DSA_get0_priv_key DSA_get0_pub_key DSA_get0_q + ECDSA_SIG_get0_r ECDSA_SIG_get0_s EVP_AEAD_CTX_free + EVP_AEAD_CTX_new EVP_CIPHER_CTX_buf_noconst + EVP_CIPHER_CTX_get_cipher_data EVP_CIPHER_CTX_set_cipher_data + EVP_MD_CTX_md_data EVP_MD_CTX_pkey_ctx EVP_MD_CTX_set_pkey_ctx + EVP_MD_meth_dup EVP_MD_meth_free EVP_MD_meth_new + EVP_MD_meth_set_app_datasize EVP_MD_meth_set_cleanup + EVP_MD_meth_set_copy EVP_MD_meth_set_ctrl EVP_MD_meth_set_final + EVP_MD_meth_set_flags EVP_MD_meth_set_init + EVP_MD_meth_set_input_blocksize EVP_MD_meth_set_result_size + EVP_MD_meth_set_update EVP_PKEY_asn1_set_check + EVP_PKEY_asn1_set_param_check EVP_PKEY_asn1_set_public_check + EVP_PKEY_check EVP_PKEY_meth_set_check + EVP_PKEY_meth_set_param_check EVP_PKEY_meth_set_public_check + EVP_PKEY_param_check EVP_PKEY_public_check FIPS_mode + FIPS_mode_set IPAddressChoice_free IPAddressChoice_new + IPAddressFamily_free IPAddressFamily_new IPAddressOrRange_free + IPAddressOrRange_new IPAddressRange_free IPAddressRange_new + OBJ_get0_data OBJ_length OCSP_resp_get0_certs OCSP_resp_get0_id + OCSP_resp_get0_produced_at OCSP_resp_get0_respdata + OCSP_resp_get0_signature OCSP_resp_get0_signer + OCSP_resp_get0_tbs_sigalg PEM_write_bio_PrivateKey_traditional + RSA_get0_d RSA_get0_dmp1 RSA_get0_dmq1 RSA_get0_e RSA_get0_iqmp + RSA_get0_n RSA_get0_p RSA_get0_pss_params RSA_get0_q + SCT_LIST_free SCT_LIST_print SCT_LIST_validate SCT_free + SCT_get0_extensions SCT_get0_log_id SCT_get0_signature + SCT_get_log_entry_type SCT_get_signature_nid SCT_get_source + SCT_get_timestamp SCT_get_validation_status SCT_get_version + SCT_new SCT_new_from_base64 SCT_print SCT_set0_extensions + SCT_set0_log_id SCT_set0_signature SCT_set1_extensions + SCT_set1_log_id SCT_set1_signature SCT_set_log_entry_type + SCT_set_signature_nid SCT_set_source SCT_set_timestamp + SCT_set_version SCT_validate SCT_validation_status_string + X509_OBJECT_free X509_OBJECT_new X509_REQ_get0_pubkey + X509_SIG_get0 X509_SIG_getm X509_STORE_CTX_get_by_subject + X509_STORE_CTX_get_num_untrusted + X509_STORE_CTX_get_obj_by_subject X509_STORE_CTX_get_verify + X509_STORE_CTX_get_verify_cb X509_STORE_CTX_set0_verified_chain + X509_STORE_CTX_set_current_cert X509_STORE_CTX_set_error_depth + X509_STORE_CTX_set_verify X509_STORE_get_verify + X509_STORE_get_verify_cb X509_STORE_set_verify + X509_get_X509_PUBKEY X509_get_extended_key_usage + X509_get_extension_flags X509_get_key_usage + X509v3_addr_add_inherit X509v3_addr_add_prefix + X509v3_addr_add_range X509v3_addr_canonize X509v3_addr_get_afi + X509v3_addr_get_range X509v3_addr_inherits + X509v3_addr_is_canonical X509v3_addr_subset + X509v3_addr_validate_path X509v3_addr_validate_resource_set + X509v3_asid_add_id_or_range X509v3_asid_add_inherit + X509v3_asid_canonize X509v3_asid_inherits + X509v3_asid_is_canonical X509v3_asid_subset + X509v3_asid_validate_path X509v3_asid_validate_resource_set + d2i_ASIdOrRange d2i_ASIdentifierChoice d2i_ASIdentifiers + d2i_ASRange d2i_IPAddressChoice d2i_IPAddressFamily + d2i_IPAddressOrRange d2i_IPAddressRange d2i_SCT_LIST + i2d_ASIdOrRange i2d_ASIdentifierChoice i2d_ASIdentifiers + i2d_ASRange i2d_IPAddressChoice i2d_IPAddressFamily + i2d_IPAddressOrRange i2d_IPAddressRange i2d_SCT_LIST + i2d_re_X509_CRL_tbs i2d_re_X509_REQ_tbs i2d_re_X509_tbs i2o_SCT + i2o_SCT_LIST o2i_SCT o2i_SCT_LIST + removed API: + ASN1_check_infinite_end ASN1_const_check_infinite_end EVP_dss + EVP_dss1 EVP_ecdsa HMAC_CTX_cleanup HMAC_CTX_init + NETSCAPE_ENCRYPTED_PKEY_free NETSCAPE_ENCRYPTED_PKEY_new + NETSCAPE_PKEY_free NETSCAPE_PKEY_new NETSCAPE_X509_free + NETSCAPE_X509_new OBJ_bsearch_ex_ PEM_SealFinal PEM_SealInit + PEM_SealUpdate PEM_read_X509_CERT_PAIR + PEM_read_bio_X509_CERT_PAIR PEM_write_X509_CERT_PAIR + PEM_write_bio_X509_CERT_PAIR X509_CERT_PAIR_free + X509_CERT_PAIR_new X509_OBJECT_free_contents asn1_do_adb + asn1_do_lock asn1_enc_free asn1_enc_init asn1_enc_restore + asn1_enc_save asn1_ex_c2i asn1_get_choice_selector + asn1_get_field_ptr asn1_set_choice_selector check_defer + d2i_ASN1_BOOLEAN d2i_NETSCAPE_ENCRYPTED_PKEY d2i_NETSCAPE_PKEY + d2i_NETSCAPE_X509 d2i_Netscape_RSA d2i_RSA_NET + d2i_X509_CERT_PAIR i2d_ASN1_BOOLEAN i2d_NETSCAPE_ENCRYPTED_PKEY + i2d_NETSCAPE_PKEY i2d_NETSCAPE_X509 i2d_Netscape_RSA i2d_RSA_NET + i2d_X509_CERT_PAIR name_cmp obj_cleanup_defer + +3.4.1 - Stable release + + * New Features + - Added support for OpenSSL 1.1.1 TLSv1.3 APIs. + - Enabled the new X.509 validator to allow verification of + modern certificate chains. + * Portable Improvements + - Ported continuous integration and test infrastructure to Github + actions. + - Added Universal Windows Platform (UWP) build support. + - Fixed mingw-w64 builds on newer versions with missing SSP support. + - Added non-executable stack annotations for CMake builds. + * API and Documentation Enhancements + - Added the following APIs from OpenSSL + BN_bn2binpad BN_bn2lebinpad BN_lebin2bn EC_GROUP_get_curve + EC_GROUP_order_bits EC_GROUP_set_curve + EC_POINT_get_affine_coordinates + EC_POINT_set_affine_coordinates + EC_POINT_set_compressed_coordinates EVP_DigestSign + EVP_DigestVerify SSL_CIPHER_find SSL_CTX_get0_privatekey + SSL_CTX_get_max_early_data SSL_CTX_get_ssl_method + SSL_CTX_set_ciphersuites SSL_CTX_set_max_early_data + SSL_CTX_set_post_handshake_auth SSL_SESSION_get0_cipher + SSL_SESSION_get_max_early_data SSL_SESSION_is_resumable + SSL_SESSION_set_max_early_data SSL_get_early_data_status + SSL_get_max_early_data SSL_read_early_data SSL_set0_rbio + SSL_set_ciphersuites SSL_set_max_early_data + SSL_set_post_handshake_auth + SSL_set_psk_use_session_callback + SSL_verify_client_post_handshake SSL_write_early_data + - Added AES-GCM constants from RFC 7714 for SRTP. + * Compatibility Changes + - Implement flushing for TLSv1.3 handshakes behavior, needed for Apache. + - Call the info callback on connect/accept exit in TLSv1.3, + needed for p5-Net-SSLeay. + - Default to using named curve parameter encoding from + pre-OpenSSL 1.1.0, adding OPENSSL_EC_EXPLICIT_CURVE. + - Do not ignore SSL_TLSEXT_ERR_FATAL from the ALPN callback. + * Testing and Proactive Security + - Added additional state machine test coverage. + - Improved integration test support with ruby/openssl tests. + - Error codes and callback support in new X.509 validator made + compatible with p5-Net_SSLeay tests. + * Internal Improvements + - Numerous fixes and improvements to the new X.509 validator to + ensure compatible error codes and callback support compatible + with the legacy OpenSSL validator. + +3.4.0 - Development release + + * Add support for OpenSSL 1.1.1 TLSv1.3 APIs. + + * Enable new x509 validator. + + * More details to come, testing is appreciated. + +3.3.5 - Security fix + + * A stack overread could occur when checking X.509 name constraints. + From GoldBinocle on GitHub. + + * Enable X509_V_FLAG_TRUSTED_FIRST by default in the legacy verifier. + This compensates for the expiry of the DST Root X3 certificate. + +3.3.4 - Security fix + + * In LibreSSL, printing a certificate can result in a crash in + X509_CERT_AUX_print(). + From Ingo Schwarze + + * Ensure GNU-stack is set on ELF platforms when building with CMake to + enable non-executable stack annotations for the GNU toolchain. + From Tobias Heider + +3.3.3 - Stable release + + * This is the first stable release from the 3.3.x series. + There are no changes from 3.3.2. + +3.3.2 - Development release + + * This release adds support for DTLSv1.2 and continues the rewrite + of the record layer for the legacy stack. Numerous bugs and + interoperability issues were fixed in the new verifier. A few bugs + and incompatibilities remain, so this release uses the old verifier + by default. The OpenSSL 1.1 TLSv1.3 API is not yet available. + + * Switch finish{,_peer}_md_len from an int to a size_t. + + * Make SSL_get{,_peer}_finished() work when used with TLSv1.3. + + * Use EVP_MD_MAX_MD_SIZE instead of 2 * EVP_MD_MAX_MD_SIZE as size + for cert_verify_md[], finish_md[] and peer_finish_md[]. The factor 2 + was a historical artefact. + + * Correct the return value type from ERR_peek_error() to a long. + + * Avoid use of uninitialized in ASN1_time_parse() which could happen + on parsing UTCTime if the caller did not initialise the passed + struct tm. + + * Destroy the mutex in a tls_config object on tls_config_free(). + + * Free alert_data and phh_data in tls13_record_layer_free() + these could leak if SSL_shutdown() or tls_close() were called + after closing the underlying socket(). + + * Free struct members in tls13_record_layer_free() in their natural + order for reviewability. + + * Gracefully handle root certificates being both trusted and + untrusted. + + * Handle X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE in the new + verifier. + + * Use the legacy verifier when building auto chains for TLS. + + * Use consistent names in tls13_{client,server}_finished_{recv,send}(). + + * Add tls13_secret_{init,cleanup}() and use them throughout the + TLSv1.3 code base. + + * Move the read MAC key into the TLSv1.2 record layer. + + * Make tls12_record_layer_free() NULL safe. + + * Search the intermediates only after searching the root certs in the + new verifier to avoid problems with the legacy callback. + + * Bail out early after finding a single chain in the new verifier, if + we have been called via the legacy verifier API. + + * Set (invalid and likely incomplete) chain on the xsc on chain build + failure prior to calling the callback. This is required by various + callers, including auto chain. + + * Align SSL_get_shared_ciphers() with OpenSSL. This takes into account + that it never returned server ciphers, so now it will fail when + called from the client side. + + * Add support for SSL_get_shared_ciphers() with TLSv1.3. + + * Split the record protection from the TLSv1.2 record layer. + + * Clean up sequence number handling in the new TLSv1.2 record layer. + + * Clean up sequence number handling in DTLS. + + * Clean up dtls1_reset_seq_numbers(). + + * Factor out code for explicit IV length, block size and MAC length + from tls12_record_layer_open_record_protected_cipher(). + + * Provide record layer overhead for DTLS. + + * Provide functions to determine if TLSv1.2 record protection is + engaged. + + * Add code to handle change of cipher state in the new TLSv1.2 record + layer. + + * Mop up now unused dtls1_build_sequence_numbers() function. + + * Allow setting a keypair on a tls context without specifying the + private key, and fake it internally in libtls. This removes the + need for privsep engines like relayd to use bogus keys. + + * Skip the private key check for fake private keys. + + * Move the private key setup from tls_configure_ssl_keypair() to a + helper function with proper error checking. + + * Change the internal tls_configure_ssl_keypair() function to + return -1 instead of 1 on failure. + + * Move sequence numbers into the new TLSv1.2 record layer. + + * Move AEAD handling into the new TLSv1.2 record layer. + + * Remove direct assignment of aead_ctx to avoid a leak. + + * Add a number of RPKI OIDs from RFC 6482, 6484, 6493, 8182, 8360, + draft-ietf-sidrops-rpki-rta, and draft-ietf-opsawg-finding-geofeeds. + + * Fail early in legacy exporter if the master secret is not available + to avoid a segfault if it is called when the handshake is not + completed. + + * Factor out legacy stack version checks. + + * Correct handshake MAC/PRF for various TLSv1.2 cipher suites which + were originally added with the default handshake MAC and PRF rather + than the SHA256 handshake MAC and PRF. + + * Absorb ssl3_get_algorithm2() into ssl_get_handshake_evp_md(). + + * Use dtls1_record_retrieve_buffered_record() to load buffered + application data. + + * Enforce read ahead with DTLS. + + * Remove bogus DTLS checks that disabled ECC and OCSP. + + * Sync cert.pem with Mozilla NSS root CAs except "GeoTrust Global CA". + + * Only print the certificate file once on verification failure. + + * Pull in fix for EVP_CipherUpdate() overflow from OpenSSL. + + * Clean up and simplify dtls1_get_cipher(). + + * Group HelloVerifyRequest decoding and add missing check for trailing + data. + + * Revise HelloVerifyRequest handling for DTLSv1.2. + + * Handle DTLS1_2_VERSION in various places. + + * Add DTLSv1.2 methods. + + * Make SSL{_CTX,}_get_{min,max}_proto_version() return a version of + zero if the minimum or maximum has been set to zero to match + OpenSSL's behavior. + + * Rename the "truncated" label into "decode_err" and the "f_err" + label into "fatal_err". + + * Factor out and change some of the legacy client version code. + + * Simplify version checks in the TLSv1.3 client. Ensure that the + server announced TLSv1.3 and nothing higher and check that the + legacy_version is set to TLSv1.2 as required by RFC 8446. + + * Fix an off-by-one in x509_verify_set_xsc_chain() to make sure that + the new validator checks for EXFLAG_CRITICAL in + x509_vfy_check_chain_extension() for all untrusted certs in the + chain. Take into account that the root is not necessarily trusted. + + * Avoid passing last and depth to x509_verify_cert_error() on ENOMEM. + + * Rename depth to num_untrusted. + + * Only use TLS versions internally rather than both TLS and DTLS + versions since the latter are the one's complement of the human + readable version numbers, which means that newer versions decrease + in value. + + * Fix two bugs in the legacy verifier that resulted from refactoring + of X509_verify_cert() for the new verifier: a return value was + incorrectly treated as boolean, making it insufficient to decide + whether validation should carry on or not. + + * Identify DTLS based on the version major value. + + * Move handling of cipher/hash based cipher suites into the new record + layer. + + * Add tls12_record_protection_unused() and call it from CCS functions. + + * Move key/IV length checks closer to usage sites. Also add explicit + checks against EVP_CIPHER_{iv,key}_length(). + + * Replace two handrolled tls12_record_protection_engaged(). + + * Improve internal version handling: add handshake fields for our + minimum version, our maximum version and the TLS version negotiated + during the handshake. Convert most of the internal code to use these + version fields. + + * Guard against future internal use of TLS1_get_{client,}_version() + macros. + + * Remove the internal ssl_downgrade_max_version() function which is no + longer needed. + + * Fix checks for memory caps of constraints names. There are internal + caps on the number of name constraints and other names, that the new + name constraints code allocates per cert chain. These limits were + checked too late, making them only partially effective. + + * Use EXFLAG_INVALID to handle out of memory and parse errors in + x509v3_cache_extensions(). + + * Add support for DTLSv1.2 version handling. + + * Enable DTLSv1.2 support. + + * Add DTLSv1.2 support to openssl s_client/s_server. + + * Remove no longer needed read ahead workarounds in the s_client and + s_server. + + * Fix a copy-paste error - skid was confused with an akid when + checking for EXFLAG_INVALID. This broke OCSP validation with + certain mirrors. + + * Make supported protocols and options for DHE params more prominent + in tls_config_set_protocols.3. + + * Avoid a use-after-scope in tls13_cert_add(). + + * Split TLSv1.3 record protection from record layer. + + * Move the TLSv1.3 handshake struct inside the shared handshake + struct. + + * Fully initialize rrec in tls12_record_layer_open_record_protected() + to avoid confusing some static analyzers. + + * Use tls_set_errorx() on OCSP_basic_verify() failure since the latter + does not set errno. + + * Convert openssl(1) x509 to new option handling and do the usual + clean up that goes along with it. + + * Add SSL_HANDSHAKE_TLS12 for TLSv1.2 specific handshake data. + + * Rename new_cipher to cipher to align naming with keyblock or other + parts of the handshake data. + + * Avoid mangled output in BIO_debug_callback(). + + * Fix client initiated renegotiation by replacing use of s->internal-type + with s->server. + + * Move the TLSv1.2 record number increment into the new record layer. + + * Move finished and peer finished into the handshake struct. + + * Avoid transcript initialization when sending a TLS HelloRequest, + fixing server initiated renegotiation. + + * Remove pointless assignment in SSL_get0_alpn_selected(). + + * Provide EVP_PKEY_new_CMAC_KEY(3). + + * Add missing prototype for d2i_DSAPrivateKey_fp(3) to x509.h. + + * Add DTLSv1.2 to openssl(1) s_server and s_client protocol message + logging. + + * Avoid leaking param->name in x509_verify_param_zero(). + + * Avoid a leak in an error path in openssl(1) x509. + + * Add some error checking to openssl(1) x509. + + * When sending an alert in TLSv1.3, only set its error code when no + other error was set previously. Certain clients rely on specific + SSL_R_ error codes to identify that they are dealing with a self + signed cert. + + * Switch to the legacy verifier for the stable release. + + * Provide SSL_use_certificate_chain_file(3). + + * Provide SSL_set_hostflags(3) and SSL_get0_peername(3). + + * Provide various DTLSv1.2 specific functions and defines. + + * Document meaning of '*' in the genrsa output. + + * Updated documentation for SSL_get_shared_ciphers(3). + + * Add documentation for SSL_get_finished(3). + + * Document EVP_PKEY_new_CMAC_key(3) + + * Document SSL_use_certificate_chain_file(3). + + * Document SSL_set_hostflags(3) and SSL_get0_peername(3). + + * Update SSL_get_version.3 manual for DTLSv.1.2 support. + + * Added '--enable-libtls-only' build option, which builds and installs a + statically-linked libtls, skipping libcrypto and libssl. This is useful + for systems that ship with OpenSSL but wish to also package libtls. + +3.3.1 - Security fix + + * Malformed ASN.1 in a certificate revocation list or a timestamp + response token can lead to a NULL pointer dereference. + + Bug fixes + + * Move point-on-curve check to set_affine_coordinates to avoid + verifying ECDSA signatures with unchecked public keys. + + * Fix SSL_is_server() to behave as documented by re-introducing the + client-specific methods. + + * Avoid undefined behavior due to memcpy(NULL, NULL, 0). + + * Mark a few more internal static tables const. + +3.3.0 - Development release + + * Make openssl(1) s_server ignore -4 and -6 for compatibility with + OpenSSL. + + * Further cleanup of the DTLS record handling. + + * Continue the replacement of the TLSv1.2 record layer by + reimplementing the read side of the TLSv1.2 record handling. + + * Replace DTLSv1_enc_data() with TLSv1_1_enc_data(). + + * Merge d1_{clnt,srvr}.c into ssl_{clnt,srvr}.c. + + * When switching from the TLSv1.3 stack to the legacy stack include + a TLS record header. This is necessary if there is more than one + handshake message in the TLS plaintext record. + + * Set SO_REUSEADDR on the server socket in the openssl(1) ocsp + command. + + * Fix resource handling on error in OCSP_request_add0_id(). + + * Add const to ssl_ciphers and tls1[23]_sigalgs* to push them into + .data.rel.ro and .rodata, respectively. + + * Add a const qualifier to srtp_known_profiles. + + * Simplify TLS method by removing the client and server specific + methods internally. + + * Avoid casting away const in ssl_ctx_make_profiles(). + + * Make sure there is enough room for stashing the handshake message + when switching to the legacy TLS stack. + + * Avoid explicitly conditioning an assert on DTLS1_VERSION to make + the assert work for newer DTLS versions. + + * Merge SSL_ENC_METHOD into SSL_METHOD_INTERNAL. + + * Send a host header with OCSP queries to make openssl(1) ocsp + work with some widely used OCSP responders. + + * Fix a memory leak in the openssl(1) s_client. + + * Add a flag to mark DTLS methods as DTLS to have an easy way to + recognize DTLS methods that avoids inspecting the version number. + + * Implement SSL_is_dtls() and use it internally in place of the + SSL_IS_DTLS macro. + + * Unbreak DTLS retransmissions for flights that include a CCS. + + * Add ability to ocspcheck(8) to parse a port in the specified + OCSP URL. + + * Refactor and clean up ocspcheck(8) and add regression tests. + + * If x509_verify() fails, ensure that the error is set on both + the x509_verify_ctx() and its store context to make some failures + visible from SSL_get_verify_result(). + + * Use the X509_STORE_CTX get_issuer() callback from the new X.509 + verifier to fix hashed certificate directories. + + * Only check BIO_should_read() on read and BIO_should_write() on + write. Previously, BIO_should_write() was also checked after read + and BIO_should_read() after write which could cause stalls in + software that uses the same BIO for read and write. + + * In openssl(1) verify, also check for error on the store context + since the return value of X509_verify_cert() is unreliable in + presence of a callback that returns 1 too often. + + * Update getentropy on Windows to use Cryptography Next Generation + (CNG). wincrypt is deprecated and no longer works with newer Windows + environments, such as in Windows Store apps. + + * Implement auto chain for the TLSv1.3 server since some software + relies on this. + + * Handle additional certificate error cases in the new X.509 verifier. + Keep track of the errors encountered if a verify callback tells the + verifier to continue and report them back via the error on the store + context. This mimics the behavior of the old verifier that would + persist the first error encountered while building the chain. + + * Report specific failures for "self signed certificates" in a way + compatible with the old verifier since software relies on the + error code. + + * Implement key exporter for TLSv1.3. + + * Plug a large memory leak in the new verifier caused by calling + X509_policy_check() repeatedly. + + * Avoid leaking memory in x509_verify_chain_dup(). + + * Various documentation improvements, particularly around TLS methods. + +3.2.3 - Security fix + + * Malformed ASN.1 in a certificate revocation list or a timestamp + response token can lead to a NULL pointer dereference. + +3.2.2 - Stable release + + * This is the first stable release with the new TLSv1.3 + implementation enabled by default for both client and server. The + OpenSSL 1.1 TLSv1.3 API is not yet available and will be provided + in an upcoming release. + + * New X509 certificate chain validator that correctly handles + multiple paths through intermediate certificates. Loosely based on + Go's X509 validator. + + * New name constraints verification implementation which passes the + bettertls.com certificate validation check suite. + + * Improve the handling of BIO_read()/BIO_write() failures in the + TLSv1.3 stack. + + * Start replacing the existing TLSv1.2 record layer. + + * Define OPENSSL_NO_SSL_TRACE in opensslfeatures.h. + + * Make SSL_CTX_get_ciphers(NULL) return NULL rather than crash. + + * Send alert on ssl_get_prev_session() failure. + + * Zero out variable on the stack to avoid leaving garbage in the tail + of short session IDs. + + * Move state initialization from SSL_clear() to ssl3_clear() to ensure + that it gets correctly reinitialized across a SSL_set_ssl_method() + call. + + * Avoid an out-of-bounds write in BN_rand(). + + * Fix numerous leaks in the UI_dup_* functions. Simplify and tidy up + the code in ui_lib.c. + + * Correctly track selected ALPN length to avoid a potential segmentation + fault with SSL_get0_alpn_selected() when alpn_selected is NULL. + + * Include machine/endian.h gost2814789.c in order to pick up the + __STRICT_ALIGNMENT define. + + * Simplify SSL method lookups. + + * Clean up and simplify SSL_get_ciphers(), SSL_set_session(), + SSL_set_ssl_method() and several internal functions. + + * Correctly handle ssl_cert_dup() failure in SSL_set_SSL_CTX(). + + * Refactor dtls1_new(), dtls1_hm_fragment_new(), + dtls1_drain_fragments(), dtls1_clear_queues(). + + * Copy the session ID directly in ssl_get_prev_session() instead of + handing it through several functions for copying. + + * Clean up and refactor ssl_get_prev_session(); simplify + tls_decrypt_ticket() and tls1_process_ticket() exit paths. + + * Avoid memset() before memcpy() in CBS_add_bytes(). + + * Rewrite X509_INFO_{new,free}() more idiomatically. + + * Remove unnecessary zeroing after recallocarray() in + ASN1_BIT_STRING_set_bit(). + + * Convert openssl(1) ocsp new option handling. + + * Document SSL_set1_host(3), SSL_set_SSL_CTX(3). + + * Document return value from EC_KEY_get0_public_key(3). + + * Greatly expanded test coverage via the tlsfuzzer test scripts. + + * Expanded test coverage via the bettertls certificate test suite. + + * Test interoperability with the Botan TLS client. + + * Make pthread_mutex static initialisation work on Windows. + + * Get __STRICT_ALIGNMENT from machine/endian.h with portable build. + +3.2.1 - Development release + + * Propagate alerts from the read half of the TLSv1.3 record layer to I/O + functions. + + * Send a record overflow alert for TLSv1.3 messages having overlong + plaintext or inner plaintext. + + * Send an illegal parameter alert if a client sends an invalid DH key + share. + + * Document PKCS7_final(3), PKCS7_add_attribute(3). + + * Collapse x509v3 directory into x509. + + * Improve TLSv1.3 client certificate selection to allow EC certificates + instead of only RSA certificates. + + * Fail on receiving an invalid NID in X509_ATTRIBUTE_create() instead + of constructing a broken objects that may cause NULL pointer accesses. + + * Add support for additional GOST curves from RFC 7836 and + draft-deremin-rfc4491-bis. + + * Add OIDs for HMAC using the Streebog hash function. + + * Allow GOST R 34.11-2012 in PBE/PBKDF2/PKCS#5. + + * Enable GOST_SIG_FORMAT_RS_LE when verifying certificate signatures. + + * Handle GOST in ssl_cert_dup(). + + * Stop sending GOST R 34.10-94 as a CertificateType. + + * Use IANA allocated GOST ClientCertificateTypes. + + * Add a custom copy handler for AES keywrap to fix a use-after-free. + + * Enforce in the TLSv1.3 server that that ClientHello messages after + a HelloRetryRequest match the original ClientHello as per RFC 8446 + section 4.1.2 + + * Document more PKCS7 attribute functions. + + * Document PKCS7_get_signer_info(3). + + * Document PEM_ASN1_read(3) and PEM_ASN1_read_bio(3). + + * Document PEM_def_callback(3). + + * Document EVP_read_pw_string_min(3). + + * Merge documentation of X509_get0_serialNumber from OpenSSL 1.1.1. + + * Document error handling of X509_PUBKEY_get0(3) and X509_PUBKEY_get(3) + + * Document X509_get0_pubkey_bitstr(3). + + * Fix an off-by-one in the CBC padding removal. From BoringSSL. + + * Enforce restrictions on extensions present in the ClientHello as per + RFC 8446, section 9.2. + + * Add new CMAC_Init(3) and ChaCha(3) manual pages. + + * Fix SSL_shutdown behavior to match the legacy stack. The previous + behavior could cause a hang. + + * Add initial support for openbsd/powerpc64. + + * Make the message type available in the internal TLS extensions API + functions. + + * Enable TLSv1.3 for the generic TLS_method(). + + * Convert openssl(1) s_client option handling. + + * Document openssl(1) certhash. + + * Convert openssl(1) verify option handling. + + * Fix a longstanding bug in PEM_X509_INFO_read_bio(3) that could cause + use-after-free and double-free issues in calling programs. + + * Document PEM_X509_INFO_read(3) and PEM_X509_INFO_read_bio(3). + + * Handle SSL_MODE_AUTO_RETRY being changed during a TLSv1.3 session. + + * Convert openssl(1) s_server option handling. + + * Add minimal info callback support for TLSv1.3. + + * Refactor, clean up and simplify some SSL3/DTLS1 record writing code. + + * Correctly handle server requests for an OCSP response. + + * Add the P-521 curve to the list of curves supported by default + in the client. + + * Convert openssl(1) req option handling. + + * Avoid calling freezero with a negative size if a server sends a + malformed plaintext of all zeroes. + + * Send an unexpected message alert if no valid content type is found + in a TLSv1.3 record. + +3.2.0 - Development release + + * Enable TLS 1.3 server side in addition to client by default. + With this change TLS 1.3 is handled entirely on the new stack + and state machine, with fallback to the legacy stack and + state machine for older versions. Note that the OpenSSL TLS 1.3 + API is not yet visible/available. + + * Improve length checks in the TLS 1.3 record layer and provide + appropriate alerts for violations of record layer limits. + + * Enforce that SNI hostnames received by the TLS server are correctly + formed as per RFC 5890 and RFC 6066, responding with illegal parameter + for a nonconformant host name. + + * Support SSL_MODE_AUTO_RETRY in TLS 1.3 to allow the automatic + retry of handshake messages. + + * Modify I/O behavior so that SSL_MODE_AUTO_RETRY is the default + similar to new OpenSSL releases. + + * Modify openssl(1) to clear SSL_MODE_AUTO_RETRY appropriately in + various commands. + + * Add tlsfuzzer based regression tests. + + * Support sending certificate status requests from the TLS 1.3 + client to request OCSP staples for leaf certificates. + + * Support sending certificate status replies from the TLS 1.3 server + in order to send OCSP staples for leaf certificates. + + * Send correct alerts when handling failed key share extensions + on the TLS 1.3 server. + + * Various compatibility fixes for TLS 1.3 to 1.2 fallback for + switching from the new to legacy stacks. + + * Support TLS 1.3 options in the openssl(1) command. + + * Many alert cleanups in TLS 1.3 to provide expected alerts in failure + conditions. + + * Modify "openssl x509" to display invalid certificate times as + invalid, and correctly deal with the failing return case from + X509_cmp_time so that a certificate with an invalid NotAfter does + not appear valid. + + * Support sending dummy change_cipher_spec records for TLS 1.3 middlebox + compatibility. + + * Ensure only PSS signatures are used with RSA in TLS 1.3. + + * Ensure that TLS 1.3 clients advertise exactly the "null" compression + method in its legacy_compression_methods. + + * Correct use of sockaddr_storage instead of sockaddr in openssl(1) + s_client, which could lead to using 14 bytes of stack garbage instead + of an IPv6 address in DTLS mode. + + * Use non-expired certificates first when building a certificate chain. + +3.1.5 - Security fix + + * Malformed ASN.1 in a certificate revocation list or a timestamp + response token can lead to a NULL pointer dereference. + +3.1.4 - Interoperability and bug fixes for the TLSv1.3 client: + + * Improve client certificate selection to allow EC certificates + instead of only RSA certificates. + + * Do not error out if a TLSv1.3 server requests an OCSP response as + part of a certificate request. + + * Fix SSL_shutdown behavior to match the legacy stack. The previous + behaviour could cause a hang. + + * Fix a memory leak and add a missing error check in the handling of + the key update message. + + * Fix a memory leak in tls13_record_layer_set_traffic_key. + + * Avoid calling freezero with a negative size if a server sends a + malformed plaintext of all zeroes. + + * Ensure that only PSS may be used with RSA in TLSv1.3 in order + to avoid using PKCS1-based signatures. + + * Add the P-521 curve to the list of curves supported by default + in the client. + +3.1.3 - Bug fix + + * libcrypto may fail to build a valid certificate chain due to + expired untrusted issuer certificates. + +3.1.2 - Bug fix + + * A TLS client with peer verification disabled may crash when + contacting a server that sends an empty certificate list. + +3.1.1 - Stable release + + * Improved cipher suite handling to automatically include TLSv1.3 + cipher suites when they are not explicitly referred to in the + cipher string. + + * Improved handling of TLSv1.3 HelloRetryRequests, simplifying + state transitions and ensuring that the legacy session identifer + retains the same value across the handshake. + + * Provided TLSv1.3 cipher suite aliases to match the names used + in RFC 8446. + + * Improved TLSv1.3 client key share handling to allow the use of + any groups in our configured NID list. + + * Fixed printing the serialNumber with X509_print_ex() fall back to + the colon separated hex bytes in case greater than int value. + + * Fix to disallow setting the AES-GCM IV length to zero. + + * Added -groups option to openssl(1) s_server subcommand. + + * Fix to show TLSv1.3 extension types with openssl(1) -tlsextdebug. + + * Improved portable builds to support the use of static MSVC runtimes. + + * Fixed portable builds to avoid exporting a sleep() symbol. + +3.1.0 - Development release + + * Completed initial TLS 1.3 implementation with a completely new state + machine and record layer. TLS 1.3 is now enabled by default for the + client side, with the server side to be enabled in a future release. + Note that the OpenSSL TLS 1.3 API is not yet visible/available. + + * Many more code cleanups, fixes, and improvements to memory handling + and protocol parsing. + + * Added RSA-PSS and RSA-OAEP methods from OpenSSL 1.1.1. + + * Ported Cryptographic Message Syntax (CMS) implementation from OpenSSL + 1.1.1 and enabled by default. + + * Improved compatibility by backporting functionality and documentation + from OpenSSL 1.1.1. + + * Added many new additional crypto test vectors. + + * Adjusted EVP_chacha20()'s behavior to match OpenSSL's semantics. + + * Default CA bundle location is now configurable in portable builds. + + * Added cms subcommand to openssl(1). + + * Added -addext option to openssl(1) req subcommand. + +3.0.2 - Stable release + + * Use a valid curve when constructing an EC_KEY that looks like X25519. + The recent EC group cofactor change results in stricter validation, + which causes the EC_GROUP_set_generator() call to fail. + Issue reported and fix tested by rsadowski@ + + * Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey. + (Note that the CMS code is currently disabled) + Port of Edlinger's Fix for CVE-2019-1563 from OpenSSL 1.1.1 (old license) + + * Avoid a path traversal bug in s_server on Windows when run with the -WWW + or -HTTP options, due to incomplete path check logic. + Issue reported and fix tested by Jobert Abma + +3.0.1 - Development release + + * Ported Billy Brumley's fix for CVE-2019-1547 in OpenSSL 1.1.1. If a NULL + or zero cofactor is passed to EC_GROUP_set_generator(), try to compute + it using Hasse's bound. This works as long as the cofactor is small + enough. + + * Fixed a memory leak in error paths for eckey_type2param(). + + * Initial work on supporting Cryptographic Message Syntax (CMS) in + libcrypto (not enabled). + + * Various manual page improvements and additions. + + * Added a CMake check for an existing uninstall target, facilitating + embedding LibreSSL in larger CMake projects, from Matthew Albrecht. + +3.0.0 - Development release + + * Completed the port of RSA_METHOD accessors from the OpenSSL 1.1 API. + + * Documented undescribed options and removed unfunctional options + description in openssl(1) manual. + + * A plethora of small fixes due to regular oss-fuzz testing. + + * Various side channels in DSA and ECDSA were addressed. These are some of + the many issues found in an extensive systematic analysis of bignum usage + by Samuel Weiser, David Schrammel et al. + + * Enabled openssl(1) speed subcommand on Windows platform. + + * Enabled performance optimizations when building with Visual Studio on Windows. + + * Fixed incorrect carry operation in 512 addition for Streebog. + + * Fixed -modulus option with openssl(1) dsa subcommand. + + * Fixed PVK format output issue with openssl(1) dsa and rsa subcommand. + +2.9.2 - Bug fixes + + * Fixed portable builds with older versions of MacOS, + Android targets < API 21, and Solaris 10 + + * Fixed SRTP profile advertisement for DTLS servers. + +2.9.1 - Stable release + + * Added support for XChaCha20 and XChaCha20-Poly1305. + + * Added support for AES key wrap constructions via the EVP interface. + + * Partial port of the OpenSSL EC_KEY_METHOD API for use by OpenSSH. + + * Added pbkdf2 key derivation support to openssl(1) + + * Removed SHA224 based handshake signatures from consideration for use in a TLS 1.2 handshake. + + * Changed the default digest type of openssl(1) enc to to sha256. + + * Changed the default digest type of openssl(1) dgst to sha256. + + * Changed the default digest type of openssl(1) x509 -fingerprint to sha256. + + * Changed the default digest type of openssl(1) crl -fingerprint to sha256. + + * Improved Windows, Android, and ARM compatibility, including assembly + optimizations on Mingw-w64 targets. + +2.9.0 - Development release + + * Added the SM4 block cipher from the Chinese standard GB/T 32907-2016. + + * Fixed warnings about clock_gettime on Windows Visual Studio builds. + + * Fixed CMake builds on systems where getpagesize is defined as an + inline function. + + * CRYPTO_LOCK is now automatically initialized, with the legacy + callbacks stubbed for compatibility. + + * Added the SM3 hash function from the Chinese standard GB/T 32905-2016. + + * Added more OPENSSL_NO_* macros for compatibility with OpenSSL. + + * Added extensive interoperability tests between LibreSSL and OpenSSL + 1.0 and 1.1. + + * Added additional Wycheproof tests and related bug fixes. + + * Simplified sigalgs option processing and handshake signing algorithm + + * Added the ability to use the RSA PSS algorithm for handshake + signatures. + + * Added bn_rand_interval() and use it in code needing ranges of random + bn values. + + * Added functionality to derive early, handshake, and application + secrets as per RFC8446. + + * Added handshake state machine from RFC8446. + + * Removed some ASN.1 related code from libcrypto that had not been used + since around 2000. + + * Unexported internal symbols and internalized more record layer structs. + + * Added support for assembly optimizations on 32-bit ARM ELF targets. + + * Improved protection against timing side channels in ECDSA signature + generation. + + * Coordinate blinding was added to some elliptic curves. This is the + last bit of the work by Brumley et al. to protect against the + Portsmash vulnerability. + + * Ensure transcript handshake is always freed with TLS 1.2. + +2.8.2 - Stable release + + * Added Wycheproof support for ECDH and ECDSA Web Crypto test vectors, + along with test harness fixes. + + * Fixed memory leak in nc(1) + +2.8.1 - Test and compatibility improvements + + * Added Wycheproof support for ECDH, RSASSA-PSS, AES-GCM, + AES-CMAC, AES-CCM, AES-CBC-PKCS5, DSA, ChaCha20-Poly1305, ECDSA, and + X25519 test vectors. Applied appropriate fixes for errors uncovered + by tests. + + * Simplified key exchange signature generation and verification. + + * Fixed a one-byte buffer overrun in callers of EVP_read_pw_string + + * Converted more code paths to use CBB/CBS. All handshake messages are + now created by CBB. + + * Fixed various memory leaks found by Coverity. + + * Simplified session ticket parsing and handling, inspired by + BoringSSL. + + * Modified signature of CRYPTO_mem_leaks_* to return -1. This function + is a no-op in LibreSSL, so this function returns an error to not + indicate the (non-)existence of memory leaks. + + * SSL_copy_session_id, PEM_Sign, EVP_EncodeUpdate, BIO_set_cipher, + X509_OBJECT_up_ref_count now return an int for error handling, + matching OpenSSL. + + * Converted a number of #defines into proper functions, matching + OpenSSL's ABI. + + * Added X509_get0_serialNumber from OpenSSL. + + * Removed EVP_PKEY2PKCS8_broken and PKCS8_set_broken, while adding + PKCS8_pkey_add1_attr_by_NID and PKCS8_pkey_get0_attrs, matching + OpenSSL. + + * Removed broken pkcs8 formats from openssl(1). + + * Converted more functions in public API to use const arguments. + + * Stopped handing AES-GCM in ssl_cipher_get_evp, since they use the + EVP_AEAD interface. + + * Stopped using composite EVP_CIPHER AEADs. + + * Added timing-safe compares for checking results of signature + verification. There are no known attacks, this is just inexpensive + prudence. + + * Correctly clear the current cipher state, when changing cipher state. + This fixed an issue where renegotiation of cipher suites would fail + when switched from AEAD to non-AEAD or vice-versa. + Issue reported by Bernard Spil. + + * Added more cipher tests to appstest.sh, including all TLSv1.2 + ciphers. + + * Added RSA_meth_get_finish() RSA_meth_set1_name() from OpenSSL. + + * Added new EVP_CIPHER_CTX_(get|set)_iv() API that allows the IV to be + retrieved and set with appropriate validation. + +2.8.0 - Bug fixes, security, and compatibility improvements + + * Extensive documentation updates and additional API history. + + * Fixed a pair of 20+ year-old bugs in X509_NAME_add_entry + + * Tighten up checks for various X509_VERIFY_PARAM functions, + 'poisoning' parameters so that an unverified certificate cannot be + used if it fails verification. + + * Fixed a potential memory leak on failure in ASN1_item_digest + + * Fixed a potential memory alignment crash in asn1_item_combine_free + + * Removed unused SSL3_FLAGS_DELAY_CLIENT_FINISHED and + SSL3_FLAGS_POP_BUFFER flags in write path, simplifying IO paths. + + * Removed SSL_OP_TLS_ROLLBACK_BUG buggy client workarounds. + + * Made ENGINE_finish and ENGINE_free succeed on NULL and simplify callers + and matching OpenSSL behavior, rewrote ENGINE_* documentation. + + * Added const annotations to many existing APIs from OpenSSL, making + interoperability easier for downstream applications. + + * Fixed small timing side-channels in ecdsa_sign_setup and + dsa_sign_setup. + + * Documented security pitfalls with BN_FLG_CONSTTIME and constant-time + operation of BN_* functions. + + * Updated BN_clear to use explicit_bzero. + + * Added a missing bounds check in c2i_ASN1_BIT_STRING. + + * More CBS conversions, including simplifications to RSA key exchange, + and converted code to use dedicated buffers for secrets. + + * Removed three remaining single DES cipher suites. + + * Fixed a potential leak/incorrect return value in DSA signature + generation. + + * Added a blinding value when generating DSA and ECDSA signatures, in + order to reduce the possibility of a side-channel attack leaking the + private key. + + * Added ECC constant time scalar multiplication support. + From Billy Brumley and his team at Tampere University of Technology. + + * Revised the implementation of RSASSA-PKCS1-v1_5 to match the + specification in RFC 8017. Based on an OpenSSL commit by David + Benjamin. + + * Cleaned up BN_* implementations following changes made in OpenSSL by + Davide Galassi and others. + +2.7.4 - Security fixes + + * Avoid a timing side-channel leak when generating DSA and ECDSA + signatures. This is caused by an attempt to do fast modular + arithmetic, which introduces branches that leak information + regarding secret values. Issue identified and reported by Keegan + Ryan of NCC Group. + + * Reject excessively large primes in DH key generation. Problem + reported by Guido Vranken to OpenSSL + (https://github.com/openssl/openssl/pull/6457) and based on his + diff. + +2.7.3 - Bug fixes + + * Removed incorrect NULL checks in DH_set0_key(). Reported by Ondrej + Sury + + * Fixed an issue normalizing CPU architecture in the configure script, + which disabled assembly optimizations on platforms that get detected + as 'amd64', opposed to 'x86_64' + + * Limited tls_config_clear_keys() to only clear private keys. + This was inadvertently clearing the keypair, which includes the OCSP + staple and pubkey hash - if an application called tls_configure() + followed by tls_config_clear_keys(), this would prevent OCSP staples + from working. + +2.7.2 - Stable release + + * Updated and added extensive new HISTORY sections to API manuals. + + * Added support for shared library builds with CMake on all supported + platforms. Note that some of the CMake options have changed, consult + the README for details. + +2.7.1 - Bug fixes + + * Fixed a bug in int_x509_param_set_hosts, calling strlen() if name + length provided is 0 to match the OpenSSL behaviour. Issue noticed + by Christian Heimes . + + * Fixed builds macOS 10.11 and older. + +2.7.0 - Bug fixes and improvements + + * Added support for many OpenSSL 1.0.2 and 1.1 APIs, based on + observations of real-world usage in applications. These are + implemented in parallel with existing OpenSSL 1.0.1 APIs - visibility + changes have not been made to existing structs, allowing code written + for older OpenSSL APIs to continue working. + + * Extensive corrections, improvements, and additions to the + API documentation, including new public APIs from OpenSSL that had + no pre-existing documentation. + + * Added support for automatic library initialization in libcrypto, + libssl, and libtls. Support for pthread_once or a compatible + equivalent is now required of the target operating system. As a + side-effect, minimum Windows support is Vista or higher. + + * Converted more packet handling methods to CBB, which improves + resiliency when generating TLS messages. + + * Completed TLS extension handling rewrite, improving consistency of + checks for malformed and duplicate extensions. + + * Rewrote ASN1_TYPE_{get,set}_octetstring() using templated ASN.1. + This removes the last remaining use of the old M_ASN1_* macros + (asn1_mac.h) from API that needs to continue to exist. + + * Added support for client-side session resumption in libtls. + A libtls client can specify a session file descriptor (a regular + file with appropriate ownership and permissions) and libtls will + manage reading and writing of session data across TLS handshakes. + + * Improved support for strict alignment on ARMv7 architectures, + conditionally enabling assembly in those cases. + + * Fixed a memory leak in libtls when reusing a tls_config. + + * Merged more DTLS support into the regular TLS code path, removing + duplicated code. + + * Many improvements to Windows Cmake-based builds and tests, + especially when targeting Visual Studio. + +2.6.4 - Bug fixes + + * Make tls_config_parse_protocols() work correctly when passed a NULL + pointer for a protocol string. Issue found by semarie@, who also + provided the diff. + + * Correct TLS extensions handling when no extensions are present. + If no TLS extensions are present in a client hello or server hello, + omit the entire extensions block, rather than including it with a + length of zero. Thanks to Eric Elena for + providing packet captures and testing the fix. + + * Fixed portable builds on older Android systems, and systems with out + IPV6_TCLASS support. + +2.6.3 - OpenBSD 6.2 Release + + * No core changes from LibreSSL 2.6.2 + + * Minor compatibility fixes in portable version. + +2.6.2 - Bug fixes + + * Provide a useful error with libtls if there are no OCSP URLs in a + peer certificate. + + * Keep track of which keypair is in use by a TLS context, fixing a bug + where a TLS server with SNI would only return the OCSP staple for the + default keypair. Issue reported by William Graeber and confirmed by + Andreas Bartelt. + + * Fixed various issues in the OCSP extension parsing code. + The original code incorrectly passes the pointer allocated via + CBS_stow() (using malloc()) to a d2i_*() function and then calls + free() on the now incremented pointer, most likely resulting in a + crash. This issue was reported by Robert Swiecki who found the issue + using honggfuzz. + + * If tls_config_parse_protocols() is called with a NULL pointer, + return the default protocols instead of crashing - this makes the + behaviour more useful and mirrors what we already do in + tls_config_set_ciphers() et al. + +2.6.1 - Code removal, rewrites + + * Added a "-T tlscompat" option to nc(1), which enables the use of all + TLS protocols and "compat" ciphers. This allows for TLS connections + to TLS servers that are using less than ideal cipher suites, without + having to resort to "-T tlsall" which enables all known cipher + suites. Diff from Kyle J. McKay. + + * Added a new TLS extension handling framework, somewhat analogous to + BoringSSL, and converted all TLS extensions to use it. Added new TLS + extension regression tests. + + * Improved and added many new manpages. Updated *check_private_key + manpages with additional cautions regarding their use. + + * Cleaned up the EC key/curve configuration handling. + + * Added tls_config_set_ecdhecurves() to libtls, which allows the names + of the eliptical curves that may be used during client and server + key exchange to be specified. + + * Converted more code paths to use CBB/CBS. + + * Removed support for DSS/DSA, since we removed the cipher suites a + while back. + + * Removed NPN support. NPN was never standardised and the last draft + expired in October 2012. ALPN was standardised in July 2014 and has + been supported in LibreSSL since December 2014. NPN has also been + removed from Chromium in May 2016. + + * Removed SSL_OP_CRYPTOPRO_TLSEXT_BUG workaround for old/broken + CryptoPro clients. + + * Removed support for the TLS padding extension, which was added as a + workaround for an old bug in F5's TLS termination. + + * Worked around another bug in F5's TLS termination handling of the + elliptical curves extension. RFC 4492 only defines elliptic_curves + for ClientHello. However, F5 is sending it in ServerHello. We need + to skip over it since our TLS extension parsing code is now more + strict. Thanks to Armin Wolfermann and WJ Liu for reporting. + + * Added ability to clamp notafter valies in certificates for systems + with 32-bit time_t. This is necessary to conform to RFC 5280 + 4.1.2.5. + + * Implemented the SSL_CTX_set_min_proto_version(3) API. + + * Removed the original (pre-IETF) chacha20-poly1305 cipher suites. + + * Reclassified ECDHE-RSA-DES-CBC3-SHA from HIGH to MEDIUM. + +2.6.0 - New APIs, bug fixes and improvements + + * Added support for providing CRLs to libtls. Once a CRL is provided we + enable CRL checking for the full certificate chain. Based on a diff + from Jack Burton + + * Allow non-compliant clients using IP literal addresses with SNI + to connect to a server using libtls. + + * Avoid a potential NULL pointer dereference in d2i_ECPrivateKey(). + Reported by Robert Swiecki, who found the issue using honggfuzz. + + * Added definitions for three OIDs used in EV certificates. + From Kyle J. McKay + + * Added tls_peer_cert_chain_pem to libtls, useful in private + certificate validation callbacks such as those in relayd. + + * Converted explicit clear/free sequences to use freezero(3). + + * Reworked TLS certificate name verification code to more strictly + follow RFC 6125. + + * Cleaned up and simplified server key exchange EC point handling. + + * Added tls_keypair_clear_key for clearing key material. + + * Removed inconsistent IPv6 handling from BIO_get_accept_socket, + simplified BIO_get_host_ip and BIO_accept. + + * Fixed the openssl(1) ca command so that is generates certificates + with RFC 5280-conformant time. Problem noticed by Harald Dunkel. + + * Added ASN1_TIME_set_tm to set an asn1 from a struct tm * + + * Added SSL{,_CTX}_set_{min,max}_proto_version() functions. + + * Added HKDF (HMAC Key Derivation Function) from BoringSSL + + * Provided a tls_unload_file() function that frees the memory returned + from a tls_load_file() call, ensuring that it the contents become + inaccessible. This is specifically needed on platforms where the + library allocators may be different from the application allocator. + + * Perform reference counting for tls_config. This allows + tls_config_free() to be called as soon as it has been passed to the + final tls_configure() call, simplifying lifetime tracking for the + application. + + * Moved internal state of SSL and other structures to be opaque. + + * Dropped cipher suites with DSS authentication. + + * nc(1) improvements, including: + nc -W to terminate nc after receiving a number of packets + nc -Z for saving the peer certificate and chain in a pem file + +2.5.5 - Bug fixes + + * Distinguish between self-issued certificates and self-signed + certificates. The certificate verification code has special cases + for self-signed certificates and without this change, self-issued + certificates (which it seems are common place with + openvpn/easyrsa) were also being included in this category. + + * Added getpagesize fallback, needed for Android bionic libc. + +2.5.4 - Security Updates + + * Revert a previous change that forced consistency between return + value and error code when specifing a certificate verification + callback, since this breaks the documented API. When a user supplied + callback always returns 1, and later code checks the error code to + potentially abort post verification, this will result in incorrect + successul certificate verification. + + * Switched Linux getrandom() usage to non-blocking mode, continuing to + use fallback mechanims if unsuccessful. This works around a design + flaw in Linux getrandom(2) where early boot usage in a library makes + it impossible to recover if getrandom(2) is not yet initialized. + + * Fixed a bug caused by the return value being set early to signal + successful DTLS cookie validation. This can mask a later failure and + result in a positive return value being returned from + ssl3_get_client_hello(), when it should return a negative value to + propagate the error. + + * Fixed a build error on non-x86/x86_64 systems running Solaris. + +2.5.3 - OpenBSD 6.1 Release + + * Documentation updates + + * Improved ocspcheck(1) error handling + +2.5.2 - Security features and bugfixes + + * Added the recallocarray(3) memory allocation function, and converted + various places in the library to use it, such as CBB and BUF_MEM_grow. + recallocarray(3) is similar to reallocarray. Newly allocated memory + is cleared similar to calloc(3). Memory that becomes unallocated + while shrinking or moving existing allocations is explicitly + discarded by unmapping or clearing to 0 + + * Added new root CAs from SECOM Trust Systems / Security Communication + of Japan. + + * Added EVP interface for MD5+SHA1 hashes. + + * Fixed DTLS client failures when the server sends a certificate + request. + + * Correct handling of padding when upgrading an SSLv2 challenge into + an SSLv3/TLS connection. + + * Allow protocols and ciphers to be set on a TLS config object in + libtls. + + * Improved nc(1) TLS handshake CPU usage and server-side error + reporting. + +2.5.1 - Bug and security fixes, new features, documentation updates + + * X509_cmp_time() now passes a malformed GeneralizedTime field as an + error. Reported by Theofilos Petsios. + + * Detect zero-length encrypted session data early, instead of when + malloc(0) fails or the HMAC check fails. Noted independently by + jsing@ and Kurt Cancemi. + + * Check for and handle failure of HMAC_{Update,Final} or + EVP_DecryptUpdate(). + + * Massive update and normalization of manpages, conversion to + mandoc format. Many pages were rewritten for clarity and accuracy. + Portable doc links are up-to-date with a new conversion tool. + + * Curve25519 Key Exchange support. + + * Support for alternate chains for certificate verification. + + * Code cleanups, CBS conversions, further unification of DTLS/SSL + handshake code, further ASN1 macro expansion and removal. + + * Private symbol are now hidden in libssl and libcryto. + + * Friendly certificate verification error messages in libtls, peer + verification is now always enabled. + + * Added OCSP stapling support to libtls and netcat. + + * Added ocspcheck utility to validate a certificate against its OCSP + responder and save the reply for stapling + + * Enhanced regression tests and error handling for libtls. + + * Added explicit constant and non-constant time BN functions, + defaulting to constant time wherever possible. + + * Moved many leaked implementation details in public structs behind + opaque pointers. + + * Added ticket support to libtls. + + * Added support for setting the supported EC curves via + SSL{_CTX}_set1_groups{_list}() - also provide defines for the previous + SSL{_CTX}_set1_curves{_list} names. This also changes the default + list of curves to be X25519, P-256 and P-384. All other curves must + be manually enabled. + + * Added -groups option to openssl(1) s_client for specifying the curves + to be used in a colon-separated list. + + * Merged client/server version negotiation code paths into one, + reducing much duplicate code. + + * Removed error function codes from libssl and libcrypto. + + * Fixed an issue where a truncated packet could crash via an OOB read. + + * Added SSL_OP_NO_CLIENT_RENEGOTIATION option that disallows + client-initiated renegotiation. This is the default for libtls + servers. + + * Avoid a side-channel cache-timing attack that can leak the ECDSA + private keys when signing. This is due to BN_mod_inverse() being + used without the constant time flag being set. Reported by Cesar + Pereida Garcia and Billy Brumley (Tampere University of Technology). + The fix was developed by Cesar Pereida Garcia. + + * iOS and MacOS compatibility updates from Simone Basso and Jacob + Berkman. + + +2.5.0 - New APIs, bug fixes and improvements + + * libtls now supports ALPN and SNI + + * libtls adds a new callback interface for integrating custom IO + functions. Thanks to Tobias Pape. + + * libtls now handles 4 cipher suite groups: + "secure" (TLSv1.2+AEAD+PFS) + "compat" (HIGH:!aNULL) + "legacy" (HIGH:MEDIUM:!aNULL) + "insecure" (ALL:!aNULL:!eNULL) + + This allows for flexibility and finer grained control, rather than + having two extremes (an issue raised by Marko Kreen some time ago). + + * Tightened error handling for tls_config_set_ciphers(). + + * libtls now always loads CA, key and certificate files at the time the + configuration function is called. This simplifies code and results in + a single memory based code path being used to provide data to libssl. + + * Add support for OCSP intermediate certificates. + + * Added functions used by stunnel and exim from BoringSSL - this + brings in X509_check_host, X509_check_email, X509_check_ip, and + X509_check_ip_asc. + + * Added initial support for iOS, thanks to Jacob Berkman. + + * Improved behavior of arc4random on Windows when using memory leak + analysis software. + + * Correctly handle an EOF that occurs prior to the TLS handshake + completing. Reported by Vasily Kolobkov, based on a diff from Marko + Kreen. + + * Limit the support of the "backward compatible" ssl2 handshake to + only be used if TLS 1.0 is enabled. + + * Fix incorrect results in certain cases on 64-bit systems when + BN_mod_word() can return incorrect results. BN_mod_word() now can + return an error condition. Thanks to Brian Smith. + + * Added constant-time updates to address CVE-2016-0702 + + * Fixed undefined behavior in BN_GF2m_mod_arr() + + * Removed unused Cryptographic Message Support (CMS) + + * More conversions of long long idioms to time_t + + * Improved compatibility by avoiding printing NULL strings with + printf. + + * Reverted change that cleans up the EVP cipher context in + EVP_EncryptFinal() and EVP_DecryptFinal(). Some software relies on the + previous behaviour. + + * Avoid unbounded memory growth in libssl, which can be triggered by a + TLS client repeatedly renegotiating and sending OCSP Status Request + TLS extensions. + + * Avoid falling back to a weak digest for (EC)DH when using SNI with + libssl. + +2.4.2 - Bug fixes and improvements + + * Fixed loading default certificate locations with openssl s_client. + + * Ensured OCSP only uses and compares GENERALIZEDTIME values as per + RFC6960. Also added fixes for OCSP to work with intermediate + certificates provided in responses. + + * Improved behavior of arc4random on Windows to not appear to leak + memory in debug tools, reduced privileges of allocated memory. + + * Fixed incorrect results from BN_mod_word() when the modulus is too + large, thanks to Brian Smith from BoringSSL. + + * Correctly handle an EOF prior to completing the TLS handshake in + libtls. + + * Improved libtls ceritificate loading and cipher string validation. + + * Updated libtls cipher group suites into four categories: + "secure" (TLSv1.2+AEAD+PFS) + "compat" (HIGH:!aNULL) + "legacy" (HIGH:MEDIUM:!aNULL) + "insecure" (ALL:!aNULL:!eNULL) + This allows for flexibility and finer grained control, rather than + having two extremes. + + * Limited support for 'backward compatible' SSLv2 handshake packets to + when TLS 1.0 is enabled, providing more restricted compatibility + with TLS 1.0 clients. + + * openssl(1) and other documentation improvements. + + * Removed flags for disabling constant-time operations. + This removes support for DSA_FLAG_NO_EXP_CONSTTIME, + DH_FLAG_NO_EXP_CONSTTIME, and RSA_FLAG_NO_CONSTTIME flags, making + all of these operations unconditionally constant-time. + + +2.4.1 - Security fix + + * Correct a problem that prevents the DSA signing algorithm from + running in constant time even if the flag BN_FLG_CONSTTIME is set. + This issue was reported by Cesar Pereida (Aalto University), Billy + Brumley (Tampere University of Technology), and Yuval Yarom (The + University of Adelaide and NICTA). The fix was developed by Cesar + Pereida. + +2.4.0 - Build improvements, new features + + * Many improvements to the CMake build infrastructure, including + Solaris, mingw-w64, Cygwin, and HP-UX support. Thanks to Kinichiro + Inoguchi for this work. + + * Added missing error handling around bn_wexpand() calls. + + * Added explicit_bzero calls for freed ASN.1 objects. + + * Fixed X509_*set_object functions to return 0 on allocation failure. + + * Implemented the IETF ChaCha20-Poly1305 cipher suites. + + * Changed default EVP_aead_chacha20_poly1305() implementation to the + IETF version, which is now the default. + + * Fixed password prompts from openssl(1) to properly handle ^C. + + * Reworked error handling in libtls so that configuration errors are + visible. + + * Deprecated internal use of EVP_[Cipher|Encrypt|Decrypt]_Final. + + * Manpage fixes and updates + +2.3.5 - Reliability fix + + * Fixed an error in libcrypto when parsing some ASN.1 elements > 16k. + +2.3.4 - Security Update + + * Fix multiple vulnerabilities in libcrypto relating to ASN.1 and encoding. + From OpenSSL. + + * Minor build fixes + +2.3.3 - OpenBSD 5.9 release branch tagged + + * Reworked build scripts to better sync with OpenNTPD-portable + + * Fixed broken manpage links + + * Fixed an nginx compatibility issue by adding an 'install_sw' make alias + + * Fixed HP-UX builds + + * Changed the default configuration directory to c:\LibreSSL\ssl on Windows + binary builds + + * cert.pem has been reorganized and synced with Mozilla's certificate store + +2.3.2 - Compatibility and Reliability fixes + + * Changed format of LIBRESSL_VERSION_NUMBER to match that of + OPENSSL_VERSION_NUMBER, see: + https://wiki.openssl.org/index.php/Manual:OPENSSL_VERSION_NUMBER(3) + + * Added EVP_aead_chacha20_poly1305_ietf() which matches the AEAD + construction introduced in RFC 7539, which is different than that + already used in TLS with EVP_aead_chacha20_poly1305() + + * Avoid a potential undefined C99+ behavior due to shift overflow in + AES_decrypt, reported by Pascal Cuoq + + * More man pages converted from pod to mdoc format + + * Added COMODO RSA Certification Authority and QuoVadis + root certificates to cert.pem + + * Removed Remove "C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification + Authority" (serial 3c:91:31:cb:1f:f6:d0:1b:0e:9a:b8:d0:44:bf:12:be) root + certificate from cert.pem + + * Added support for building nc(1) on Solaris + + * Fixed GCC 5.x+ preprocessor checks, reported by Ruslan Babayev + + * Improved console handling with openssl(1) on Windows + + * Ensure the network stack is enabled on Windows when running + tls_init() + + * Fixed incorrect TLS certificate loading by nc(1) + + * Added support for Solaris 11.3's getentropy(2) system call + + * Enabled support for using NetBSD 7.0's arc4random(3) implementation + + * Deprecated the SSL_OP_SINGLE_DH_USE flag by disabling its effect + + * Fixes from OpenSSL 1.0.1q + - CVE-2015-3194 - NULL pointer dereference in client side certificate + validation. + - CVE-2015-3195 - Memory leak in PKCS7 - not reachable from TLS/SSL + + * The following OpenSSL CVEs did not apply to LibreSSL + - CVE-2015-3193 - Carry propagating bug in the x86_64 Montgomery + squaring procedure. + - CVE-2015-3196 - Double free race condition of the identify hint + data. + + See https://marc.info/?l=openbsd-announce&m=144925068504102 + +2.3.1 - ASN.1 and time handling cleanups + + * ASN.1 cleanups and RFC5280 compliance fixes. + + * Time representations switched from 'unsigned long' to 'time_t'. LibreSSL + now checks if the host OS supports 64-bit time_t. + + * Fixed a leak in SSL_new in the error path. + + * Support always extracting the peer cipher and version with libtls. + + * Added ability to check certificate validity times with libtls, + tls_peer_cert_notbefore and tls_peer_cert_notafter. + + * Changed tls_connect_servername to use the first address that resolves with + getaddrinfo(). + + * Remove broken conditional EVP_CHECK_DES_KEY code (non-functional since + initial commit in 2004). + + * Fixed a memory leak and out-of-bounds access in OBJ_obj2txt, reported + by Qualys Security. + + * Fixed an up-to 7 byte overflow in RC4 when len is not a multiple of + sizeof(RC4_CHUNK), reported by Pascal Cuoq . + + * Reject too small bits value in BN_generate_prime_ex(), so that it does + not risk becoming negative in probable_prime_dh_safe(), reported by + Franck Denis. + + * Enable nc(1) builds on more platforms. + +2.3.0 - SSLv3 removed, libtls API changes, portability improvements + + * SSLv3 is now permanently removed from the tree. + + * The libtls API is changed from the 2.2.x series. + + The read/write functions work correctly with external event + libraries. See the tls_init man page for examples of using libtls + correctly in asynchronous mode. + + Client-side verification is now supported, with the client supplying + the certificate to the server. + + Also, when using tls_connect_fds, tls_connect_socket or + tls_accept_fds, libtls no longer implicitly closes the passed in + sockets. The caller is responsible for closing them in this case. + + * When loading a DSA key from an raw (without DH parameters) ASN.1 + serialization, perform some consistency checks on its `p' and `q' + values, and return an error if the checks failed. + + Thanks for Georgi Guninski (guninski at guninski dot com) for + mentioning the possibility of a weak (non prime) q value and + providing a test case. + + See + https://cpunks.org/pipermail/cypherpunks/2015-September/009007.html + for a longer discussion. + + * Fixed a bug in ECDH_compute_key that can lead to silent truncation + of the result key without error. A coding error could cause software + to use much shorter keys than intended. + + * Removed support for DTLS_BAD_VER. Pre-DTLSv1 implementations are no + longer supported. + + * The engine command and parameters are removed from the openssl(1). + Previous releases removed dynamic and builtin engine support + already. + + * SHA-0 is removed, which was withdrawn shortly after publication 20 + years ago. + + * Added Certplus CA root certificate to the default cert.pem file. + + * New interface OPENSSL_cpu_caps is provided that does not allow + software to inadvertently modify cpu capability flags. + OPENSSL_ia32cap and OPENSSL_ia32cap_loc are removed. + + * The out_len argument of AEAD changed from ssize_t to size_t. + + * Deduplicated DTLS code, sharing bugfixes and improvements with + TLS. + + * Converted 'nc' to use libtls for client and server operations; it is + included in the libressl-portable distribution as an example of how + to use the library. + +2.2.3 - Bug fixes, build enhancements + + * LibreSSL 2.2.2 incorrectly handles ClientHello messages that do not + include TLS extensions, resulting in such handshakes being aborted. + This release corrects the handling of such messages. Thanks to + Ligushka from github for reporting the issue. + + * Added install target for cmake builds. Thanks to TheNietsnie from + github. + + * Updated pkgconfig files to correctly report the release version + number, not the individual library ABI version numbers. Thanks to + Jan Engelhardt for reporting the issue. + +2.2.2 - More TLS parser rework, bug fixes, expanded portable build support + + * Switched 'openssl dhparam' default from 512 to 2048 bits + + * Reworked openssl(1) option handling + + * More CRYPTO ByteString (CBC) packet parsing conversions + + * Fixed 'openssl pkeyutl -verify' to exit with a 0 on success + + * Fixed dozens of Coverity issues including dead code, memory leaks, + logic errors and more. + + * Ensure that openssl(1) restores terminal echo state after reading a + password. + + * Incorporated fix for OpenSSL Issue #3683 + + * LibreSSL version define LIBRESSL_VERSION_NUMBER will now be bumped + for each portable release. + + * Removed workarounds for TLS client padding bugs. + + * No longer disable ECDHE-ECDSA on OS X + + * Removed SSLv3 support from openssl(1) + + * Removed IE 6 SSLv3 workarounds. + + * Modified tls_write in libtls to allow partial writes, clarified with + examples in the documentation. + + * Removed RSAX engine + + * Tested SSLv3 removal with the OpenBSD ports tree and found several + applications that were not ready to build without SSLv3 yet. For + now, building a program that intentionally uses SSLv3 will result in + a linker warning. + + * Added TLS_method, TLS_client_method and TLS_server_method as a + replacement for the SSLv23_*method calls. + + * Added initial cmake build support, including support for building with + Visual Studio, currently tested with Visual Studio 2013 Community + Edition. + + * --with-enginesdir is removed as a configuration parameter + + * Default cert.pem, openssl.cnf, and x509v3.cnf files are now + installed under $sysconfdir/ssl or the directory specified by + --with-openssldir. Previous versions of LibreSSL left these empty. + +2.2.1 - Build fixes, feature added, features removed + + * Assorted build fixes for musl, HP-UX, Mingw, Solaris. + + * Initial support for Windows Embedded 2009, Server 2003, XP + + * Protocol parsing conversions to BoringSSL's CRYPTO ByteString (CBS) API + + * Added EC_curve_nid2nist and EC_curve_nist2nid from OpenSSL + + * Removed Dynamic Engine support + + * Removed unused and obsolete MDC-2DES cipher + + * Removed workarounds for obsolete SSL implementations + +2.2.0 - Build cleanups and new OS support, Security Updates + + * AIX Support - thanks to Michael Felt + + * Cygwin Support - thanks to Corinna Vinschen + + * Refactored build macros, support packaging libtls independently. + There are more pieces required to support building and using OpenSSL + with libtls, but this is an initial start at providing an + independent package for people to start hacking on. + + * Removal of OPENSSL_issetugid and all library getenv calls. + Applications can and should no longer rely on environment variables + for changing library behavior. OPENSSL_CONF/SSLEAY_CONF is still + supported with the openssl(1) command. + + * libtls API and documentation additions + + * Various bug fixes and simplifications to libssl and libcrypto + + * Fixes for the following issues are integrated into LibreSSL 2.2.0: + - CVE-2015-1788 - Malformed ECParameters causes infinite loop + - CVE-2015-1789 - Exploitable out-of-bounds read in X509_cmp_time + - CVE-2015-1792 - CMS verify infinite loop with unknown hash function + + * The following CVEs did not apply to LibreSSL or were fixed in + earlier releases: + - CVE-2015-4000 - DHE man-in-the-middle protection (Logjam) + - CVE-2015-1790 - PKCS7 crash with missing EnvelopedContent + - CVE-2014-8176 - Invalid free in DTLS + + * Fixes for the following CVEs are still in review for LibreSSL + - CVE-2015-1791 - Race condition handling NewSessionTicket + +2.1.6 - Security update + + * Fixes for the following issues are integrated into LibreSSL 2.1.6: + - CVE-2015-0209 - Use After Free following d2i_ECPrivatekey error + - CVE-2015-0286 - Segmentation fault in ASN1_TYPE_cmp + - CVE-2015-0287 - ASN.1 structure reuse memory corruption + - CVE-2015-0288 - X509_to_X509_REQ NULL pointer deref + - CVE-2015-0289 - PKCS7 NULL pointer dereferences + + * The fix for CVE-2015-0207 - Segmentation fault in DTLSv1_listen + is integrated for safety, but LibreSSL is not vulnerable. + + * Libtls is now built by default. The --enable-libtls + configuration option is no longer required. + The libtls API is now stable for the 2.1.x series. + +2.1.5 - Bug fixes and a security update + * Fix incorrect comparison function in openssl(1) certhash command. + Thanks to Christian Neukirchen / Void Linux. + + * Windows port improvements and bug fixes. + - Removed a dependency on libgcc in 32-bit dynamic libraries. + - Correct a hang in openssl(1) reading from stdin on an connection. + - Initialize winsock in openssl(1) earlier, allow 'openssl ocsp' and + any other network-related commands to function properly. + + * Reject all server DH keys smaller than 1024 bits. + +2.1.4 - Security and feature updates + * Improvements to libtls: + - a new API for loading CA chains directly from memory instead of a + file, allowing verification with privilege separation in a chroot + without direct access to CA certificate files. + + - Ciphers default to TLSv1.2 with AEAD and PFS. + + - Improved error handling and message generation + + - New APIs and improved documentation + + * Added X509_STORE_load_mem API for loading certificates from memory. + This facilitates accessing certificates from a chrooted environment. + + * New AEAD "MAC alias" allows configuring TLSv1.2 AEAD ciphers by + using 'TLSv1.2+AEAD' as the cipher selection string. + + * Dead and disabled code removal including MD5, Netscape workarounds, + non-POSIX IO, SCTP, RFC 3779 support, many #if 0 sections, and more. + + * ASN1 macro maze expanded to aid reading and searching the code. + + * NULL pointer asserts removed in favor of letting the OS/signal + handler catch them. + + * Refactored argument handling in openssl(1) for consistency and + maintainability. + + * New openssl(1) command 'certhash' replaces the c_rehash script. + + * Support for building with OPENSSL_NO_DEPRECATED + + * Server-side support for TLS_FALLBACK_SCSV for compatibility with + various auditor and vulnerability scanners. + + * Dozens of issues found with the Coverity scanner fixed. + + * Security Updates: + + - Fix a minor information leak that was introduced in t1_lib.c + r1.71, whereby an additional 28 bytes of .rodata (or .data) is + provided to the network. In most cases this is a non-issue since + the memory content is already public. Issue found and reported by + Felix Groebert of the Google Security Team. + + - Fixes for the following low-severity issues were integrated into + LibreSSL from OpenSSL 1.0.1k: + + CVE-2015-0205 - DH client certificates accepted without + verification + CVE-2014-3570 - Bignum squaring may produce incorrect results + CVE-2014-8275 - Certificate fingerprints can be modified + CVE-2014-3572 - ECDHE silently downgrades to ECDH [Client] + Reported by Karthikeyan Bhargavan of the PROSECCO team at INRIA. + + The following CVEs were fixed in earlier LibreSSL releases: + CVE-2015-0206 - Memory leak handling repeated DLTS records + CVE-2014-3510 - Flaw handling DTLS anonymous EC(DH) ciphersuites. + + The following CVEs did not apply to LibreSSL: + CVE-2014-3571 - DTLS segmentation fault in dtls1_get_record + CVE-2014-3569 - no-ssl3 configuration sets method to NULL + CVE-2015-0204 - RSA silently downgrades to EXPORT_RSA + +2.1.3 - Security update and OS support improvements + * Fixed various memory leaks in DTLS, including fixes for + CVE-2015-0206. + + * Added Application-Layer Protocol Negotiation (ALPN) support. + + * Removed GOST R 34.10-94 signature authentication. + + * Removed nonfunctional Netscape browser-hang workaround code. + + * Simplified and refactored SSL/DTLS handshake code. + + * Added SHA256 Camellia cipher suites for TLS 1.2 from RFC 5932. + + * Hide timing info about padding errors during handshakes. + + * Improved libtls support for non-blocking sockets, added randomized + session ID contexts. Work is ongoing with this library - feedback + and potential use-cases are welcome. + + * Support building Windows DLLs. + Thanks to Jan Engelhard. + + * Packaged config wrapper for better compatibility with OpenSSL-based + build systems. + Thanks to @technion from github + + * Ensure the stack is marked non-executable for assembly sections. + Thanks to Anthony G. Bastile. + + * Enable extra compiler hardening flags by default, where applicable. + The default set of hardening features can vary by OS to OS, so + feedback is welcome on this. To disable the default hardening flags, + specify '--disable-hardening' during configure. + Thanks to Jim Barlow + + * Initial HP-UX support, tested with HP-UX 11.31 ia64 + Thanks to Kinichiro Inoguchi + + * Initial NetBSD support, tested with NetBSD 6.1.5 x86_64 + Imported from OpenNTPD, thanks to @gitisihara from github + +2.1.2 - Many new features and improvements + * Added reworked GOST cipher suite support + thanks to Dmitry Eremin-Solenikov + + * Enabled Camellia ciphers due to improved patent situation + + * Use builtin arc4random implementation on OS X and FreeBSD + this addresses some deficiencies in the native implementations of + these operating systems, see commit logs for more information + + * Added initial Windows mingw-w64 support (32 and 64-bit) + thanks to Song Dongsheng and others for code and feedback + + * Enabled assembly optimizations on x86_64 CPUs + supports Linux, *BSD, Solaris and OS X operating systems + thanks to Wouter Clarie for the initial implementation + + * Added no_ssl3/no_tls1_1/no_tls1_2 options to openssl(1) + + * Improved build infrastructure, 'make distcheck' now passes + this simplifies and speeds developer efficiency + thanks to Dmitry Eremin-Solenikov and Wouter Clarie + + * Allow conditional building of the libtls library + expect the API and ABI of the library to change + feedback is welcome + + * Fixes for more memory leaks, cleanups, etc. + +2.1.1 - Security update + * Address POODLE attack by disabling SSLv3 by default + + * Fix Eliptical Curve cipher selection bug + (https://github.com/libressl/portable/issues/35) + +2.1.0 - First release from the OpenBSD 5.7 tree + * Added support for automatic ephemeral EC keys + + * Fixes for many memory leaks and overflows in error handlers + + * The TLS padding extension (that works around bugs in F5 terminators) is + off by default + + * support for getrandom(2) on Linux 3.17 + + * the NO_ASM macro is no longer being set, providing the first bits toward + enabling other assembly offloads. + +2.0.5 - Fixes for CVEs from OpenSSL 1.0.1i + * CVE-2014-3506 + * CVE-2014-3507 + * CVE-2014-3508 (partially vulnerable)he + * CVE-2014-3509 + * CVE-2014-3510 + * CVE-2014-3511 + * Synced LibreSSL Portable with the release version of OpenBSD 5.6 + +2.0.4 - Portability fixes, deleted unused SRP code + +2.0.3 - Portability fixes, improvements to fork detection + +2.0.2 - Address arc4random fork PID wraparound issues with pthread_atfork + +2.0.1 - Portability fixes: + * Removed -Werror and and other non-portable compiler flags + + * Allow setting OPENSSLDIR and ENGINSDIR + +2.0.0 - First release from the OpenBSD 5.6 tree + * Removal of many obsolete features and coding conventions from the OpenSSL + 1.0.1h source diff --git a/curl/dep/libressl/README.md b/curl/dep/libressl/README.md new file mode 100644 index 0000000..598188c --- /dev/null +++ b/curl/dep/libressl/README.md @@ -0,0 +1,238 @@ +![LibreSSL image](https://www.libressl.org/images/libressl.jpg) + +## Official portable version of [LibreSSL](https://www.libressl.org) + +[![Linux Build Status](https://github.com/libressl/portable/actions/workflows/linux.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux.yml) +[![macOS Build Status](https://github.com/libressl/portable/actions/workflows/macos.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/macos.yml) +[![Windows Build Status](https://github.com/libressl/portable/actions/workflows/windows.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/windows.yml) +[![Android Build Status](https://github.com/libressl/portable/actions/workflows/android.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/android.yml) +[![Solaris Build Status](https://github.com/libressl/portable/actions/workflows/solaris.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/solaris.yml) +[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/libressl.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:libressl) + +LibreSSL is a fork of [OpenSSL](https://www.openssl.org) 1.0.1g developed by the +[OpenBSD](https://www.openbsd.org) project. Our goal is to modernize the codebase, +improve security, and apply best practice development processes from OpenBSD. + +## Compatibility with OpenSSL + +LibreSSL provides much of the OpenSSL 1.1 API. The OpenSSL 3 API is not currently +supported. Incompatibilities between the projects exist and are unavoidable since +both evolve with different goals and priorities. Important incompatibilities will +be addressed if possible and as long as they are not too detrimental to LibreSSL's +goals of simplicity, security and sanity. We do not add new features, ciphers and +API without a solid reason and require that new code be clean and of high quality. + +LibreSSL is not ABI compatible with any release of OpenSSL, or necessarily +earlier releases of LibreSSL. You will need to relink your programs to +LibreSSL in order to use it, just as in moving between major versions of OpenSSL. +LibreSSL's installed library version numbers are incremented to account for +ABI and API changes. + +## Compatibility with other operating systems + +While primarily developed on and taking advantage of APIs available on OpenBSD, +the LibreSSL portable project attempts to provide working alternatives for +other operating systems, and assists with improving OS-native implementations +where possible. + +At the time of this writing, LibreSSL is known to build and work on: + +* Linux (kernel 3.17 or later recommended) +* FreeBSD (tested with 9.2 and later) +* NetBSD (7.0 or later recommended) +* HP-UX (11i) +* Solaris 11 and later +* Mac OS X (tested with 10.8 and later) +* AIX (5.3 and later) +* Emscripten (3.1.44 and later) + +LibreSSL also supports the following Windows environments: + +* Microsoft Windows (Windows 7 / Windows Server 2008r2 or later, x86 and x64) +* Wine (32-bit and 64-bit) +* MinGW-w64, Cygwin, and Visual Studio + +Official release tarballs are available at your friendly neighborhood +OpenBSD mirror in directory +[LibreSSL](https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/), +although we suggest that you use a [mirror](https://www.openbsd.org/ftp.html). + +The LibreSSL portable build framework is also +[mirrored](https://github.com/libressl/portable) on GitHub. + +Please report bugs either to the public libressl@openbsd.org mailing list, +or to the GitHub +[issue tracker](https://github.com/libressl/portable/issues) + +Severe vulnerabilities or bugs requiring coordination with OpenSSL can be +sent to the core team at libressl-security@openbsd.org. + +# Building LibreSSL + +## Building from a Git checkout + +If you have checked out this source using Git, or have downloaded a source +tarball from GitHub, follow these initial steps to prepare the source tree for +building. _Note: Your build will fail if you do not follow these instructions! +If you cannot follow these instructions or cannot meet these prerequisites, +please download an official release distribution from +https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/ instead. Using official +releases is strongly advised if you are not a developer._ + +1. Ensure that you have a bash shell. This is also required on Windows. +2. Ensure that you have the following packages installed: + automake, autoconf, git, libtool, perl. +3. Run `./autogen.sh` to prepare the source tree for building. + +## Build steps using configure + +Once you have the source tree prepared, run these commands to build and install: + +```sh +./configure # see ./configure --help for configuration options +make check # runs builtin unit tests +make install # set DESTDIR= to install to an alternate location +``` + +Alternatively, it is possible to run `./dist.sh` to prepare a tarball. + +## Build steps using CMake + +Once you have the source tree prepared, run these commands to build and install: + +```sh +mkdir build +cd build +cmake .. +make +make test +``` + +For faster builds, you can use Ninja: + +```sh +mkdir build-ninja +cd build-ninja +cmake -G"Ninja" .. +ninja +ninja test +``` + +Or another supported build system like Visual Studio: + +```sh +mkdir build-vs2022 +cd build-vs2022 +cmake -G"Visual Studio 17 2022" .. +``` + +#### Additional CMake Options + +| Option Name | Default | Description | +|-------------------------|--------:|-----------------------------------------------------------------------------------------------------------------| +| `LIBRESSL_SKIP_INSTALL` | `OFF` | allows skipping install() rules. Can be specified from command line using
```-DLIBRESSL_SKIP_INSTALL=ON``` | +| `LIBRESSL_APPS` | `ON` | allows skipping application builds. Apps are required to run tests | +| `LIBRESSL_TESTS` | `ON` | allows skipping of tests. Tests are only available in static builds | +| `BUILD_SHARED_LIBS` | `OFF` | CMake option for building shared libraries. | +| `ENABLE_ASM` | `ON` | builds assembly optimized rules. | +| `ENABLE_EXTRATESTS` | `OFF` | Enable extra tests that may be unreliable on some platforms | +| `ENABLE_NC` | `OFF` | Enable installing TLS-enabled nc(1) | +| `OPENSSLDIR` | Blank | Set the default openssl directory. Can be specified from command line using
```-DOPENSSLDIR=``` | + +## Build information for specific systems + +### HP-UX (11i) + +Set the UNIX_STD environment variable to `2003` before running `configure` +in order to build with the HP C/aC++ compiler. See the "standards(5)" man +page for more details. + +```sh +export UNIX_STD=2003 +./configure +make +``` + +### MinGW-w64 - Windows + +LibreSSL builds against relatively recent versions of [MinGW-w64](https://www.mingw-w64.org/), not to be +confused with the original mingw.org project. MinGW-w64 3.2 or later +should work. See [README.mingw.md](README.mingw.md) for more information. + +### Emscripten + +When configuring LibreSSL for use with Emscripten, make sure to prepend +`emcmake` to your `cmake` configuration command. Once configured, you can +proceed with your usual `cmake` commands. For example: + +```sh +emcmake cmake . -Bbuild +cmake --build build --config Release +ctest --test-dir build -C Release --output-on-failure +``` + +# Using LibreSSL + +## CMake + +Make a new folder in your project root (where your main `CMakeLists.txt` file is +located) called CMake. Copy the `FindLibreSSL.cmake` file to that folder, and +add the following line to your main `CMakeLists.txt`: + +```cmake +set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/CMake;${CMAKE_MODULE_PATH}") +``` + +After your `add_executable` or `add_library` line in your `CMakeLists.txt` file +add the following: + +```cmake +find_package(LibreSSL REQUIRED) +``` + +It will tell CMake to find LibreSSL and if found will let you use the following +3 interfaces in your `CMakeLists.txt` file: + +* LibreSSL::Crypto +* LibreSSL::SSL +* LibreSSL::TLS + +If you for example want to use the LibreSSL TLS library in your test program, +include it like so (SSL and Crypto are required by TLS and included +automatically too): + +```cmake +target_link_libraries(test LibreSSL::TLS) +``` + +Full example: + +```cmake +cmake_minimum_required(VERSION 3.10.0) + +set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/CMake;${CMAKE_MODULE_PATH}") + +project(test) + +add_executable(test Main.cpp) + +find_package(LibreSSL REQUIRED) + +target_link_libraries(test LibreSSL::TLS) +``` + +#### Linux + +Following the guide in the sections above to compile LibreSSL using make and +running `sudo make install` will install LibreSSL to the `/usr/local/` folder, +and will be found automatically by find_package. If your system installs it to +another location, or you have placed them yourself in a different location, you +can set the CMake variable `LIBRESSL_ROOT_DIR` to the correct path, to help +CMake find the library. + +#### Windows + +Placing the library files in `C:/Program Files/LibreSSL/lib` and the include +files in `C:/Program Files/LibreSSL/include` should let CMake find them +automatically, but it is recommended that you use CMake-GUI to set the paths. +It is more convenient as you can have the files in any folder you choose. diff --git a/curl/dep/libssh2/COPYING.txt b/curl/dep/libssh2/COPYING.txt new file mode 100644 index 0000000..6eb5146 --- /dev/null +++ b/curl/dep/libssh2/COPYING.txt @@ -0,0 +1,43 @@ +/* Copyright (C) 2004-2007 Sara Golemon + * Copyright (C) 2005,2006 Mikhail Gusarov + * Copyright (C) 2006-2007 The Written Word, Inc. + * Copyright (C) 2007 Eli Fant + * Copyright (C) 2009-2023 Daniel Stenberg + * Copyright (C) 2008, 2009 Simon Josefsson + * Copyright (C) 2000 Markus Friedl + * Copyright (C) 2015 Microsoft Corp. + * All rights reserved. + * + * Redistribution and use in source and binary forms, + * with or without modification, are permitted provided + * that the following conditions are met: + * + * Redistributions of source code must retain the above + * copyright notice, this list of conditions and the + * following disclaimer. + * + * Redistributions in binary form must reproduce the above + * copyright notice, this list of conditions and the following + * disclaimer in the documentation and/or other materials + * provided with the distribution. + * + * Neither the name of the copyright holder nor the names + * of any other contributors may be used to endorse or + * promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND + * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY + * OF SUCH DAMAGE. + */ diff --git a/curl/dep/libssh2/NEWS.txt b/curl/dep/libssh2/NEWS.txt new file mode 100644 index 0000000..b3bd14c --- /dev/null +++ b/curl/dep/libssh2/NEWS.txt @@ -0,0 +1,10896 @@ + Changelog for the libssh2 project. Generated with git2news.pl + +Daniel Stenberg (16 Oct 2024) +- RELEASE-NOTES: 1.11.1 + +Viktor Szakats (8 Oct 2024) +- RELEASE-NOTES: sync [ci skip] + +- [Anders Borum brought this change] + + session: support server banners up to 8192 bytes (was: 256) + + If server had banner exceeding 256 bytes there wasn't enough room in + `_LIBSSH2_SESSION.banner_TxRx_banner`. Only the first 256 bytes would be + read making the first packet read fail but also dooming key exchange as + `session->remote.banner` didn't include everything. + + This change bumps the banner buffer to 8KB to match OpenSSH. + + Fixes #1442 + Closes #1443 + +- RELEASE-NOTES: sync [ci skip] + +- cmake: sync and improve Find modules, add `pkg-config` native detection + + - sync code between Find modules. + - wolfssl: replace `pkg-config` hints with native detection. + - libgcrypt, mbedtls: add `pkg-config`-based native detection. + - libgcrypt: add version detection. + - limit `pkg-config` use for `UNIX`, vcpkg, and non-cross MinGW builds, + and builds with no manual customization via `*_INCLUDE_DIR` or + `*_LIBRARY`. + - replace and sync Find module header comments. + - ci: delete manual mbedTLS config that's now redundant. + + Based on similar work done in curl. + + Second attempt at #1420 + Closes #1445 + +- cmake: initialize `LIBSSH2_LIBDIRS` [ci skip] + + Follow-up to c87f12963037b22e6b60411c9c2d6513c06e2f03 #1466 + +- ci/appveyor: fix and bump OpenSSL 3 path, add path check + + Follow-up to b5e68bdc37c6afa0dc777794dda8307167919d04 #1461 + Closes #1468 + +- cmake: link to OpenSSL::Crypto, not OpenSSL::SSL + + Follow-up to 82b09f9b3aae97f641fbcc2d746d2a6383abe857 #1322 + Follow-up to c84745e34e53f863ffba997ceeee7d43d1c63a4b #1128 + Cherry-picked from #1445 + Closes #1467 + +- cmake: generate `LIBSSH2_PC_LIBS_PRIVATE` dynamically + + Generate `LIBSSH2_PC_LIBS_PRIVATE` from `LIBSSH2_LIBS`. + + Also add extra libdirs (`-L`) to `Libs` and `Libs.private`. + + Logic copied from curl. + + Closes #1466 + +- cmake: initialize `LIBSSH2_PC_REQUIRES_PRIVATE` [ci skip] + + Follow-up to 0fce9dcc2909ffff5f4a1a1bc3d359fc7f409299 #1464 + +- cmake: add comment about `ibssh2.pc.in` variables [ci skip] + +- cmake: support absolute `CMAKE_INSTALL_INCLUDEDIR`/`CMAKE_INSTALL_LIBDIR` + + in `libssh2.pc`. + + Also use `${exec_prefix}` (instead of `${prefix}`) as a base for `libdir`. + + Closes #1465 + +- cmake: rename two variables and initialize them + + - `LIBRARIES` -> `LIBSSH2_LIBS` + - `SOCKET_LIBRARIES` -> `LIBSSH2_LIBS_SOCKET` + + Also initialize them before use. + + Cherry-picked from #1445 + Closes #1464 + +- ci/appveyor: reduce test runs (workaround for infrastructure permafails) + + Jobs consistently fail to connect to the test server (run in GHA) since + 2024-Aug-29: + https://ci.appveyor.com/project/libssh2org/libssh2/builds/50498393 + + There was an earlier phase of failures one month before that, that got + fixed by increasing the wait for the server in + bf3af90b3f1bb14cf452df7a8eb55cc9088f3e7f. + + Thus, skip running tests in AppVeyor CI jobs, except: After some + experiments, it seems that running tests with the last OpenSSL job and + the last WinCrypt job _work_, which still leaves some coverage. + It remains to be seen how stable this is. + + This is meant as a temporary fix till there is a solution to make all + jobs run tests reliable like up until a few months ago. + + Closes #1461 + +- [Patrick Monnerat brought this change] + + os400: drop vsprintf() use + + Follow-up to discussion in #1457 + + Plus e-mail address update. + + Closes #1462 + +- RELEASE-NOTES: sync [ci skip] + +Daniel Stenberg (30 Sep 2024) +- openssl: free allocated resources when using openssl3 + + Reproduces consistently with curl test case 638 + + Closes #1459 + +Viktor Szakats (28 Sep 2024) +- checksrc: update, check all sources, fix fallouts + + update from curl: + https://github.com/curl/curl/blob/cff75acfeca65738da8297aee0b30427b004b240/scripts/checksrc.pl + + Closes #1457 + +- cmake: prefer `find_dependency()` in `libssh2-config.cmake` + + CMake manual suggest using `find_dependency()` (over `find_package()`) + in `config.cmake` scripts. + + Ref: https://cmake.org/cmake/help/latest/module/CMakeFindDependencyMacro.html + + Closes #1460 + +- ci: use Ninja with cmake + + Closes #1458 + +GitHub (27 Sep 2024) +- [dksslq brought this change] + + Fix memory leaks in _libssh2_ecdsa_curve_name_with_octal_new and _libssh2_ecdsa_verify (#1449) + + Better error handling in`_libssh2_ecdsa_curve_name_with_octal_new` and `_libssh2_ecdsa_verify` to prevent leaks. + + Credit: dksslq + +- [rolag brought this change] + + Fix unstable connections over nonblocking sockets (#1454) + + The `send_existing()` function allows partially sent packets to be sent + fully before any further packets are sent. Originally this returned + `LIBSSH2_ERROR_BAD_USE` when a different caller or thread tried to send + an existing packet created by a different caller or thread causing the + connection to disconnect. Commit 33dddd2f8ac3bc81 removed the return + allowing any caller to continue sending another caller's packet. This + caused connection instability as discussed in #1397 and confused the + client and server causing occasional duplicate packets to be sent and + giving the error `rcvd too much data` as discussed in #1431. We return + `LIBSSH2_ERROR_EAGAIN` instead to allow existing callers to finish + sending their own packets. + + Fixes #1397 + Fixes #1431 + Related #720 + + Credit: klux21, rolag + +- [Will Cosgrove brought this change] + + Prevent possible double free of hostkey (#1452) + + NULL server hostkey based on fuzzer failure case. + +Viktor Szakats (7 Sep 2024) +- cmake: tidy up syntax, minor improvements + + - make internal variables underscore-lowercase. + - unfold lines. + - fold lines setting header directories. + - fix indent. + - drop interim variable `EXAMPLES`. + - initialize some variables before populating them. + - clear a variable after use. + - add `libssh2_dumpvars()` function for debugging. + - allow to override default `CMAKE_UNITY_BUILD_BATCH_SIZE`. + - bump up default `CMAKE_UNITY_BUILD_BATCH_SIZE` to 0 (was 32). + - tidy up option descriptions. + + Closes #1446 + +- cmake: rename mbedTLS and wolfSSL Find modules + + To match the curl ones. + + Cherry-picked from #1445 + +- RELEASE-NOTES: sync [ci skip] + +- cmake: fixup version detection in mbedTLS find module + + - avoid warning with 2.x versions about missing header file while + extracting the version number. + + - clear temp variables. + + Closes #1444 + +- buildconf: drop + + Use `autoreconf -fi` instead. + + Follow-up to fc5d77881eb6bb179f831e626d15f4f29179aad5 + Closes #1441 + +- [Michael Buckley brought this change] + + Implement chacha20-poly1305@openssh.com + + Probably the biggest and potentially most controversial change we have + to upstream. + + Because earlier versions of OpenSSL implemented the algorithm before + standardization, using an older version of OpenSSL can cause problems + connecting to OpenSSH servers. Because of this, we use the public domain + reference implementation instead of the crypto backends, just like + OpenSSH does. + + We've been holding this one for a few years. We were about to upstream + it around the same time as aes128gcm landed upstream, and the two + changes were completely incompatible. Honestly, it took me weeks to + reconcile these two implementations, and it could be much better. + + Our original implementation changed every crypt method to decrypt the + entire message at once. the AESGCM implementation instead went with this + firstlast design, where a firstlast paramater indicates whether this is + the first or last call to the crypt method for each message. That added + a lot of bookkeeping overhead, and wasn't compatible with the chacha + public domain implementation. + + As far as I could tell, OpenSSH uses the technique of decrypting the + entire message in one go, and doesn't have anything like firstlast. + However, I could not get out aes128gcm implementation to work that way, + nor could I get the chacha implementation to work with firstlast, so I + split it down the middle and let each implementation work differently. + It's kind of a mess, and probably should be cleaned up, but I don't have + the time to spend on it anymore, and it's probably better to have + everything upstream. + + Fixes #584 + Closes #1426 + +- tidy-up: do/while formatting + + Also fix an indentation and delete empty lines. + + Closes #1440 + +- wolfssl: drop header path hack + + The wolfSSL OpenSSL headers reside in `wolfssl/openssl/*.h`. + + Before this patch the wolfSSL OpenSSL compatibilty header includes were + shared with the native OpenSSL codepath, and used `openssl/*h`. For + wolfSSL builds this required a hack to append the + `/wolfssl` directory to the header search path, to find + the headers. + + This patch changes the source to use the correct header references, + allowing to drop the header path hack. + + Also fix to use the correct variable to set up the header path in CMake: + `WOLFSSL_INCLUDE_DIRS` (was: `WOLFSSL_INCLUDE_DIR`, without the `S`) + + Closes #1439 + +- cmake: mbedTLS detection tidy-ups + + - set and use `MBEDTLS_INCLUDE_DIRS`. + - stop marking `MBEDTLS_LIBRARIES` as advanced. + + Closes #1438 + +- cmake: add quotes, delete ending dirseps + + Follow-up to 3fa5282d6284efba62dc591697e6a687152bdcb1 #1166 + Closes #1437 + +- CI/appveyor: increase wait for SSH server on GHA [ci skip] + + Blind attempt to make AppVeyor CI tests work again. + +- disable DSA by default + + Also: + - add `LIBSSH2_DSA_ENABLE` to enable it explicitly. + - test the above option in CI. + - say 'deprecated' in docs and public header. + - disable DSA in the CI server config. + (OpenSSH 9.8 no longer builds with it by default) + https://www.openssh.com/txt/release-9.8 + Patch-by: Jose Quaresma + - disable more DSA code when not enabled. + + Fixes #1433 + Closes #1435 + +GitHub (30 Jul 2024) +- [Viktor Szakats brought this change] + + tidy-up: link updates (#1434) + +Marc Hoersken (27 Jul 2024) +- ci/GHA: revert concurrency and improve permissions + + Statuses are per AppVeyor event and commit, not pull-request. + Also align permissions approach with curl, least priviledge. + + Partially reverts b08cfbc99fa4df3459db4e1ccf4263fd260e9b15. + +GitHub (23 Jul 2024) +- [Will Cosgrove brought this change] + + Always init mbedtls_pk_context (#1430) + + In the failure case, mbedtls_pk_context could be free'd without first being initialized. + +- [Viktor Szakats brought this change] + + mbedtls: tidy-up (#1429) + +- [Will Cosgrove brought this change] + + Correctly initialize values (#1428) + + Fix regression with commit from #1421 + +Viktor Szakats (14 Jul 2024) +- RELEASE-NOTES: sync [ci skip] + +- [Seo Suchan brought this change] + + mbedtls: expose `mbedtls_pk_load_file()` for our use + + While it's moved to pk_internal, it won't removed in mbedTLS 3.6 LTS + so it's safe to redeclare it on our side to find it. + + This is implementing emergency fix suggested from + https://github.com/libssh2/libssh2/commit/2e4c5ec4627b3ecf4b6da16f365c011dec9a31b4#commitcomment-141379351 + + Follow-up to e973493f992313b3be73f51d3f7ca6d52e288558 #1393 + Follow-up to 2e4c5ec4627b3ecf4b6da16f365c011dec9a31b4 #1349 + Closes #1421 + +GitHub (13 Jul 2024) +- [Viktor Szakats brought this change] + + ci/GHA: simplify mbedTLS build hack for autotools (#1425) + + Follow-up to e973493f992313b3be73f51d3f7ca6d52e288558 #1393 + +- [Michael Buckley brought this change] + + Always check for null pointers before calling _libssh2_bn_set_word (#1423) + +- [Viktor Szakats brought this change] + + ci/GHA: FreeBSD 14.1, actions bump (#1424) + +- [Michael Buckley brought this change] + + Increase SFTP_HANDLE_MAXLEN back to 4092 (#1422) + + Match OpenSSH for compatibility. + +Viktor Szakats (10 Jul 2024) +- ci/GHA: tidy up casing [ci skip] + +- REUSE: fix typo in comment + +- REUSE: shorten and improve + + Follow-up to 70b8bf314cf4566a7529c5d6eae63097a926abb0 #1419 + +- REUSE: upgrade to `REUSE.toml` + + Closes #1419 + +- build: stop detecting `sys/param.h` header + + This header is no longer used. + + Follow-up to 12427f4fb8e789adcee4a6e30974932883915e88 #1415 + Closes #1418 + +- [Nicolas Mora brought this change] + + tests: avoid using `MAXPATHLEN`, for portability + + `MAXPATHLEN` is not present in some systems, e.g. GNU Hurd. + + Co-authored-by: Viktor Szakats + Ref: 54bef4c5dad868a9d45fdbfca9729b191c0abab5 #198 + Fixes #1414 + Closes #1415 + +- cmake: sync formatting in `cmake/Find*` modules + +- [Michael Buckley brought this change] + + sftp: implement posix-rename@openssh.com + + Add a new function `libssh2_sftp_posix_rename_ex()` and + `libssh2_sftp_posix_rename()`, which implement + the posix-rename@openssh.com extension. + + If the server does not support this extension, the function returns + `LIBSSH2_FX_OP_UNSUPPORTED` and it's up to the user to recover, possibly + by calling `libssh2_sftp_rename()`. + + Co-authored-by: Viktor Szakats (bump to size_t) + Closes #1386 + +- src: use `UINT32_MAX` + + Needs to be defined for platforms missing it, e.g. VS2008. + + Closes #1413 + +GitHub (25 Jun 2024) +- [Michael Buckley brought this change] + + Fix a memory leak in key exchange. (#1412) + + Original fix submitted as a patch by Trzik. + + Co-authored-by: Michael Buckley + +Viktor Szakats (25 Jun 2024) +- RELEASE-NOTES: sync [ci skip] + +- wolfssl: fix `EVP_Cipher()` use with v5.6.0 and older + + Add workaround for the wolfSSL `EVP_Cipher(*p, NULL, NULL, 0)` bug to + make libssh2 work with wolfSSL v5.6.0 and older. + + wolfSSL fixed this issue in v5.7.0: + https://github.com/wolfSSL/wolfssl/pull/7143 + https://github.com/wolfSSL/wolfssl/commit/b0de0a1c95119786cf5651dd76dd7d7bdfac5a04 + + Without our local workaround: + + - v5.3.0 and older fail most tests: + Ref: https://github.com/libssh2/libssh2/actions/runs/9646827522/job/26604211476#step:17:1263 + + - v5.4.0, v5.5.x, v5.6.0 fail these: + ``` + 29 - test_read-aes128-cbc (Failed) + 30 - test_read-aes128-ctr (Failed) + 32 - test_read-aes192-cbc (Failed) + 33 - test_read-aes192-ctr (Failed) + 34 - test_read-aes256-cbc (Failed) + 35 - test_read-aes256-ctr (Failed) + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/9646827522/job/26604233819#step:17:978 + + Oddly enough the workaround breaks OpenSSL tests, so only enable it for + the affected wolfSSL versions. + + Also add new build-from-source wolfSSL CI job to test the new codepath. + + wolfSSL has a build bug where `wolfssl/options.h` and + `wolfssl/version.h` are not copied to the `install` destination with + autotools. With CMake it has a different bug where `wolfcrypt/sp_int.h` + is not copied (with v5.4.0). And another with CMake where `FIPS_mode()` + remains missing (with v5.6.0 and earlier.) + + Therefore use CMake with v5.5.4 and a workaround for `FIPS_mode()`. + Another option is autotools with v5.4.0 and a workaround for `install`, + but CMake builds quicker. + + Regression-from 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797 + Fixes #1020 + Fixes #1299 + Assisted-by: Michael Buckley via #1394 + Closes #1394 (another attempt to fix the mentioned wolfSSL bug) + Closes #1407 + +- wolfssl: bump version in upstream issue comment [ci skip] + +- wolfssl: require v5.4.0 for AES-GCM + + Earlier versions crash while running tests. + + This patch is part of a series of fixes to make wolfSSL AES-GCM support + work together with libssh2. + + Possibly related is this wolfSSL bugfix patch, released in v5.4.0: + https://github.com/wolfSSL/wolfssl/pull/5205 + https://github.com/wolfSSL/wolfssl/commit/fb3c611275dfe454c331baa0818445a0406c208a + "Fix another AES-GCM EVP control command issue" + + Ref: #1020 + Ref: #1299 + Cherry-picked from #1407 + Closes #1411 + +- tests: fix excluding AES-GCM tests + + Replace hard-coded crypto backends and rely on `LIBSSH2_GCM` macro + to decide whether to run AES-GCM tests. + + Without this, build attempted to run AES-GCM tests (and failed) + for crypto backends that have conditional support for this feature, e.g. + wolfSSL without the necessary features built-in + (as in before Homewbrew wolfssl 5.7.0_1, or OpenSSL v1.1.0 and older). + + This patch is part of a series of fixes to make wolfSSL AES-GCM support + work together with libssh2. + + Cherry-picked from #1407 + Closes #1410 + +- ci/GHA: fix wolfSSL-from-source AES-GCM tests + + Turns out these tests: + ``` + 31 - test_read-aes128-gcm@openssh.com (Failed) + 36 - test_read-aes256-gcm@openssh.com (Failed) + ``` + were failing because AES-GCM wasn't enabled in libssh2. This in turn + happened because the `WOLFSSL_AESGCM_STREAM` macro wasn't enabled while + building wolfSSL. Which happened because this macro isn't enabled by + any CMake-level wolfSSL option. Passing it as `CPPFLAGS` fixes it. + + This allows enabling tests with wolfSSL 5.7.0. + + Follow-up to d4cea53f53c78febad14b4caa600e25d1aaf92fd #1408 + Closes #1409 + +- ci/GHA: add Linux job with latest wolfSSL built from source + + After this patch it's possible to run tests with wolfSSL 5.7.0. + + wolfSSL 5.7.0 fixes this bug that affects open issues #1020 and #1299: + https://github.com/wolfSSL/wolfssl/pull/7143 + + `-DWOLFSSL_OPENSSLALL=ON` is necessary for `wolfSSL_FIPS_mode()` + + Closes #1408 + +- ci/GHA: tidy up build-from-source steps [ci skip] + + - make curl downloads less verbose. + + - fix cmake warning: + ``` + CMake Warning: + No source or binary directory provided. Both will be assumed to be the + same as the current working directory, but note that this warning will + become a fatal error in future CMake releases. + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/9509866494/job/26213472410#step:5:32 + +- [Adam brought this change] + + src: fix type warning in `libssh2_sftp_unlink` macro + + The `libssh2_sftp_unlink` macro was implicitly casting the `size_t` + returned by `strlen` to the `unsigned int` type expected by + `libssh2_sftp_unlink_ex`. + + This fix adds an explicit cast to match similar macro definitions in + the same file (e.g. `libssh2_sftp_rename`, `libssh2_sftp_mkdir`). + + Closes #1406 + +- libssh2.pc: reference mbedcrypto pkgconfig + + mbedtls 3.6.0 got pkgconfig support: + https://github.com/Mbed-TLS/mbedtls/commit/a4d17b34f354557838e05d2cb47200e8dcaaf59b + + Reference it from `libssh2.pc`. + + Closes #1405 + +- tidy-up: typo in comment [ci skip] + +- RELEASE-NOTES: sync [ci skip] + + Also bump planned deprecation dates. + +- ci/GHA: show configure logs on failure and other tidy-ups + + - dump cmake error log on configure failure. (for cmake 3.26 and newer) + - dump `config.log` on autotools configure failure. + - convert specs filename to Windows format before passing to CMake. + - add missing quotes. + + Closes #1403 + +- ci/GHA: bump parallel jobs to nproc+1 + + Ref: https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners#standard-github-hosted-runners-for-public-repositories + + Closes #1402 + +- ci/GHA: show test logs on failure + + Closes #1401 + +- ci/GHA: fix `Dockerfile` failing after Ubuntu package update + + Likely due an upstream Ubuntu package update (requiring an apt-get + install call beforehand), tests run via autotools started failing with + no change in the libssh2 repo: + ``` + FAIL: test_aa_warmup + ==================== + + Error running command 'docker build --quiet -t libssh2/openssh_server %s' (exit 256): Dockerfile:10 + -------------------- + 8 | && apt-get clean \ + 9 | && rm -rf /var/lib/apt/lists/* + 10 | >>> RUN mkdir /var/run/sshd + 11 | + 12 | # Chmodding because, when building on Windows, files are copied in with + -------------------- + ERROR: failed to solve: process "/bin/sh -c mkdir /var/run/sshd" did not complete successfully: exit code: 1 + + Failed to build docker image + Cannot stop session - none started + Cannot stop container - none started + Command: docker build --quiet -t libssh2/openssh_server ../../tests/openssh_server + FAIL test_aa_warmup (exit status: 1) + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/9322194756/job/25662748095#step:11:390 + + Fix it by skipping `mkdir` if `/var/run/sshd` already exists. + + (Why cmake-based jobs aren't affected, I don't know.) + + Ref: https://github.com/libssh2/libssh2/commit/50143d5867d35df76a6cf589ca8a13b22105aa64#commitcomment-142560875 + Closes #1400 + +- ci/GHA: use ubuntu-latest with OmniOS job + + It's the same as ubuntu-22.04. + + Also update OmniOS package search link. + +- ci: disable dependency tracking in autotools builds + + For better build performance. Dependency tracking causes a build + overhead while compiling to help a subsequent build, but in CI there is + never one and the extra work is discarded. + + Closes #1396 + +- mbedtls: fail to compile with v3.6.0 outside CI + + A compile-time failure is preferred over an unexpected one at + runtime. + + The problem is silenced with a macro in CI and this macro will have + to be added to more platforms when mbedTLS v3.6.0 reaches them. + + Follow-up to 2e4c5ec4627b3ecf4b6da16f365c011dec9a31b4 #1349 + Closes #1393 + +- tests: drop default cygpath option `-u` + +- tidy-up: fix typo found by codespell + + Ref: https://github.com/libssh2/libssh2/actions/runs/9224795055/job/25380857082?pr=1393#step:4:5 + +- ci/GHA: shell syntax tidy-up + + Closes #1390 + +- RELEASE-NOTES: sync [ci skip] + +- ci/GHA: bump NetBSD/OpenBSD, add NetBSD arm64 job + + OpenBSD arm64 jobs were very slow, so skipped that. + + Closes #1388 + +- autotools: fix to update `LDFLAGS` for each detected dependency + + autotools lib detection routine failed to extend LDFLAGS for each + detection. This could cause successful detection of a dependency, but + later failing to use it. This did not cause an issue as long as all + dependencies lived under the same prefix, but started breaking on macOS + ARM + Homebrew where this was no longer true for mbedTLS and zlib in + particular. + + Follow-up to 844115393bffb4e92c6569204cbe4cd8e553480d #1381 + Follow-up to ae2770de25949bc7c74e60b4cc6a011bbe1d3d7c #1377 + Closes #1384 + +GitHub (8 May 2024) +- [Michael Buckley brought this change] + + OpenSSL 3: Fix calculating DSA public key (#1380) + +Viktor Szakats (8 May 2024) +- ci/GHA: tidy-up wolfSSL autotools config on macOS + + Closes #1383 + +- ci/GHA: shorter mbedTLS autotools workaround + + Follow-up to 844115393bffb4e92c6569204cbe4cd8e553480d #1381 + Closes #1382 + +GitHub (8 May 2024) +- [Michael Buckley brought this change] + + ci: fix mbedtls runners on macOS (#1381) + + Sets LDFLAGS while configuring the autoconf mbedTLS build for macOS. + +Viktor Szakats (29 Apr 2024) +- RELEASE-NOTES: sync [ci skip] + +- [binary1248 brought this change] + + wincng: fix `DH_GEX_MAXGROUP` set higher than supported + + In 1c3a03ebc3166cf69735111aba2b8cee57cdba51 #493, + `LIBSSH2_DH_GEX_MAXGROUP` was introduced to specify + crypto-backend-specific modulus sizes. Unfortunately, the max size for + the wincng DH modulus was defined to 8192, probably because this is the + value most other backends support. + + According to Microsoft documentation [1], `BCryptGenerateKeyPair` + currently only supports up to 4096-bit keys when the selected algorithm + is `BCRYPT_DH_ALGORITHM`. Requesting larger keys when calling + `BCryptGenerateKeyPair` in `_libssh2_dh_key_pair` always results in + `STATUS_INVALID_PARAMETER` being returned and ultimately key exchange + failing. + + When attempting to connect to any server that offers 8192 bit DH, this + causes key exchange to always fail when using the wincng backend. + Reducing `LIBSSH2_DH_GEX_MAXGROUP` to 4096 fixes the issue. + + [1] https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgeneratekeypair + + Closes #1372 + +- build: silence warnings inside `FD_SET()`/`FD_ISSET()` macros + + Use an ugly workaround to silence `-Wsign-conversion` warnings triggered + by the internals of `FD_SET()`/`FD_ISSET()` macros. They've been showing + up in OmniOS CI builds when compiling `example` programs. They also have + been seen with older Cygwin and other envs and configurations. + + Also scope two related variables in examples. + + E.g.: + ``` + ../../example/direct_tcpip.c:251:9: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion] + 251 | FD_SET(forwardsock, &fds); + | ^~~~~~ + ../../example/direct_tcpip.c:251:9: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion] + ../../example/direct_tcpip.c:251:9: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion] + ../../example/direct_tcpip.c:251:9: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion] + ../../example/direct_tcpip.c:259:18: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion] + 259 | if(rc && FD_ISSET(forwardsock, &fds)) { + | ^~~~~~~~ + ../../example/direct_tcpip.c:259:18: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion] + ../../example/direct_tcpip.c:259:18: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion] + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/8854199687/job/24316762831#step:3:2020 + + Closes #1379 + +- autotools: use `AM_CFLAGS` + + Use `AM_CFLAGS` to pass custom, per-target C flags. This replaces using + `CFLAGS` which triggered this warning when running `autoreconf -fi`: + ``` + tests/Makefile.am:8: warning: 'CFLAGS' is a user variable, you should not override it; + tests/Makefile.am:8: use 'AM_CFLAGS' instead + ``` + (Only for `tests`, even though `example` and `src` also used this + method. The warning is also missing from curl, that also uses + `CFLAGS`.) + + Follow-up to 3ec53f3ea26f61cbf2e0fbbeccb852fca7f9b156 #1286 + Closes #1378 + +GitHub (25 Apr 2024) +- [Viktor Szakats brought this change] + + ci/GHA: fix gcrypt with autotools/macOS/Homebrew/ARM64 (#1377) + + mbedtls configure fails to detect anything due to this: + ``` + configure:23101: gcc -o conftest -g -O2 -I/opt/homebrew/include conftest.c -lmbedcrypto -lz >&5 + ld: library 'mbedcrypto' not found + clang: error: linker command failed with exit code 1 (use -v to see invocation) + ``` + +Viktor Szakats (25 Apr 2024) +- autotools: delete bogus square bracket from help text [ci skip] + + Follow-up to 3f98bfb0900b5e68445a339cfebc60b307a24650 #1368 + +GitHub (25 Apr 2024) +- [Viktor Szakats brought this change] + + ci/GHA: fix verbose option for autotools jobs (#1376) + + Also enable verbose for macOS `make` step. + +- [Viktor Szakats brought this change] + + ci/GHA: dump `config.log` on failure for macOS autotools jobs (#1375) + +- [Viktor Szakats brought this change] + + ci/GHA: fix `autoreconf` failure on macOS/Homebrew (#1374) + + By manually installing `libtool`. + + ``` + autoreconf -fi + shell: /bin/bash -e {0} + configure.ac:75: error: possibly undefined macro: AC_LIBTOOL_WIN32_DLL + If this token and others are legitimate, please use m4_pattern_allow. + See the Autoconf documentation. + configure.ac:76: error: possibly undefined macro: AC_PROG_LIBTOOL + autoreconf: error: /opt/homebrew/Cellar/autoconf/2.72/bin/autoconf failed with exit status: 1 + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/8833608758/job/24253334557#step:4:1 + +- [Viktor Szakats brought this change] + + ci/GHA: fixup Homebrew location (for ARM runners) (#1373) + + GHA macOS runners became ARM64 machines. Make the Homebrew prefix + dynamic to adapt to these installations. + +Viktor Szakats (14 Apr 2024) +- RELEASE-NOTES: sync [ci skip] + +- [Patrick Monnerat brought this change] + + os400: Add two recent files to the distribution + + Closes #1364 + +- wincng: add to ci/GHA, add `./configure` option `--enable-ecdsa-wincng` + + - add `./configure` option `--enable-ecdsa-wincng` + + - add WinCNG autotools jobs to GHA. + + - enable WinCNG ECDSA in some GHA jobs (both CMake and autotools). + + Follow-up to 3e72343737e5b17ac98236c03d5591d429b119ae #1315 + Closes #1368 + +GitHub (14 Apr 2024) +- [Johannes Passing brought this change] + + wincng: add ECDSA support for host and user authentication (#1315) + + The WinCNG backend currently only supports DSA and RSA. This PR + adds ECDSA support for host and user authentication. + + * Disable WinCNG ECDSA support by default to maintain backward + compatibility for projects that target versions below Windows 10. + + * Add cmake option `ENABLE_ECDSA_WINCNG` to guard ECDSA support. + + * Update AppVeyor job matrix to only enable ECDSA on Server 2016+ + +Viktor Szakats (14 Apr 2024) +- ci: enable Unity mode for most CMake builds + + Ref: 7129ea9ca8cca86dac80a6bac2d63937987efe9d #1034 + Closes #1367 + +- os400: fix shellcheck warnings in scripts (fixups) + + - Build scripts must be executed by the os/400 shell (sh), not bash which + is a PASE program: The `-ot` non-POSIX test extension works in os/400 as + well. Ref: https://github.com/libssh2/libssh2/pull/1364#issue-2241646754 + + - Drop/fixup mods trying to make some syntax highlighters happier. + + Follow-up to c6625707b94d9093f38f1a0a4d89c11b64f12ba8 #1358 + Assisted-by: Patrick Monnerat + Closes #1364 + Closes #1366 + +- cmake: style tidy-up (more) + + Follow-up to 3fa5282d6284efba62dc591697e6a687152bdcb1 #1166 + Closes #1365 + +- RELEASE-NOTES: sync [ci skip] + +- os400: fix shellcheck warnings in scripts + + - use `$()` instead of backticks, and re-arrange double-quotes inside. + - add missing `|| exit 1` to `cd` calls. (could be dropped by using `set -eu`.) + - add `-n` to a few `if`s. + - shorten redirections by using `{} >` (as shellcheck recommended). + - silence warnings where variables were detected as unused (SC2034). + - a couple misc updates to silence warnings. + - switch to bash shebang for `-ot` feature. + - split two lines to unbreak syntax highlighting in my editor. (`$(expr \`, `$(dirname \`) + + Also enable CI checks for OS/400 shell scripts. + + Ref: d88b9bcdafe9d19aad2fb120d0a0acb3edab64f7 + Closes #1358 + +- RELEASE-NOTES: sync [ci skip] + +- ci: add shellcheck job and script + + Add FIXME for OS/400 scripts. + + Cherry-picked from #1358 + +- tests: fix shellcheck issues in `test_sshd.test` + + Cherry-picked from #1358 + +- RELEASE-NOTES: sync [ci skip] + +GitHub (9 Apr 2024) +- [Viktor Szakats brought this change] + + ci/appveyor: re-enable OpenSSL 3, also bump to 3.2.1 (#1363) + + Ref: 104744f4a523de574ce3767c50948d9b8385be4c #1348 + +Viktor Szakats (9 Apr 2024) +- ci: use a better test timestamp [ci skip] + + Mar 27 2024 08:00:00 GMT+0000 + + Follow-up to 2d765e454d98b794a5e5bbc497b1fcba4a9b8c4b #1360 + +GitHub (9 Apr 2024) +- [Viktor Szakats brought this change] + + ci: verify build and install from tarball (#1362) + + Install verification based on: + https://github.com/curl/curl/blob/28c5ddf13ac311d10bc4e8f9fc4ce0858a19b888/scripts/installcheck.sh + +Viktor Szakats (9 Apr 2024) +- tidy-up: dir names, command-line [ci skip] + + Follow-up to 2d765e454d98b794a5e5bbc497b1fcba4a9b8c4b #1360 + +- cmake: tidy up function name casing in `CopyRuntimeDependencies.cmake` + + Use lowercase to match callers. + +GitHub (9 Apr 2024) +- [Viktor Szakats brought this change] + + ci: add reproducibility test for `maketgz` (#1360) + +Viktor Szakats (9 Apr 2024) +- maketgz: add reproducible dir entries to tarballs + + In the initial implementation of reproducible tarballs, they were + missing directory entries, while .zip archives had them. It meant + that on extracting the tarball, on-disk directory entries got the + current timestamp. + + This patch fixes this by including directory entries in the tarball, + with reproducible timestamps. It also moves sorting inside tar, + to ensure reproducible directory entry timestamps on extract + (without the need of `--delay-directory-restore` option, when + extracting with GNU tar. BSD tar got that right by default.) + + GNU tar 1.28 (2014-07-28) introduced `--sort=`. + + Follow-up to d52fe1b4358fab891037d86b5c73c098079567db #1357 + Closes #1359 + +- ci/GHA: improve version number in `maketgz` test + + Follow-up to cba7f97506c1b8e5ff131bbbc57b5796ac634c56 #1353 + +GitHub (8 Apr 2024) +- [Michael Buckley brought this change] + + src: check the return value from `_libssh2_bn_*()` functions (#1354) + + Found by oss-fuzz. In `diffie_hellman_sha_algo()`, we were calling + `_libssh2_bn_from_bin()` with data recieved by the server without + checking whether that data was zero-length or ridiculously long. + In the OpenSSL backend, this would cause `_libssh2_bn_from_bin()` + to fail an allocation, which would eventually lead to a NULL + dereference when the bignum was used. + + Add the same check for `_libssh2_bn_set_word()` and + `_libssh2_bn_to_bin()`. + +Viktor Szakats (8 Apr 2024) +- maketgz: reproducible tarballs/zip, display tarball hashes + + - support `SOURCE_DATE_EPOCH` for reproducibility. + - make tarballs reproducible. + - make file timestamps in tarball/zip reproducible. + - make directory timestamps in zip reproducible. + - make timestamps of tarballs/zip reproducible. + - make file order in tarball/zip reproducible. + - use POSIX ustar tarball format to avoid supply chain vulnerability: https://seclists.org/oss-sec/2021/q4/0 + - make uid/gid in tarball reproducible. + - omit owner user/group names from tarball for reproducibility and privacy. + - omit current timestamp from .gz header for reproducibility. + - display SHA-256 hashes of produced tarballs/zip. (Requires `sha256sum`) + - re-sync formatting with curl's `maketgz`. + + Closes #1357 + +- maketgz: `set -eu`, reproducibility, improve zip, add CI test + + - set bash `-eu`. + - fix bash `-eu` issues. + - apply `TZ=UTC` and `LC_ALL=C` for reproducibility. + - sort `.zip` entries for reproducibility. + - zip with `--no-extra` for reproducibliity. + - use maximum zip compression. + - add the gpg sign command-line. Copied from curl. + - add CI test for `maketgz`. + + Closes #1353 + +- RELEASE-NOTES: sync and cleanups [ci skip] + +GitHub (3 Apr 2024) +- [Tejaswikandula brought this change] + + Support RSA SHA2 cert-based authentication (rsa-sha2-512_cert and rsa-sha2-256_cert) (#1314) + + Replicating OpenSSH's behavior to handle RSA certificate authentication + differently based on the remote server version. + + 1. For OpenSSH versions >= 7.8, ascertain server's support for RSA Cert + types by checking if the certificate's signature type is present in + the `server-sig-algs`. + + 2. For OpenSSH versions < 7.8, Set the "SSH_BUG_SIGTYPE" flag when the + RSA key in question is a certificate to ignore `server-sig-algs` and + only offer ssh-rsa signature algorithm for RSA certs. + + This arises from the fact that OpenSSH versions up to 7.7 accept + RSA-SHA2 keys but not RSA-SHA2 certificate types. Although OpenSSH <=7.7 + includes RSA-SHA2 keys in the `server-sig-algs`, versions <=7.7 do not + actually support RSA certs. Therefore, server sending RSA-SHA2 keys in + `server-sig-algs` should not be interpreted as indicating support for + RSA-SHA2 certs. So, `server-sig-algs` are ignored when the RSA key in + question is a cert, and the remote server version is 7.7 or below. + + Relevant sections of the OpenSSH source code: + + + + + Assisted-by: Will Cosgrove + Reviewed-by: Viktor Szakats + +Viktor Szakats (3 Apr 2024) +- RELEASE-NOTES: sync [ci skip] + + Also fix to include 3-digit issue/PR references. + +- mbedtls: add workaround + FIXME to build with 3.6.0 + + This is just a stub to make `_libssh2_mbedtls_ecdsa_new_private` + compile. + + mbedtls 3.6.0 silently deleted its public API `mbedtls_pk_load_file`, + which this function relies on. + + Closes #1349 + +GitHub (3 Apr 2024) +- [Viktor Szakats brought this change] + + ci/appveyor: OpenSSL 3 no longer found by CMake, revert to 1.1.1 (#1348) + + Ref: https://github.com/appveyor/build-images/commit/702e8cdca01f28f6a40687783f493c786cebbe2c + Ref: https://github.com/appveyor/build-images/pull/149 + +Viktor Szakats (3 Apr 2024) +- docs: improve `libssh2_userauth_publickey_from*` manpages + + Reported-by: Lyndon Brown + Assisted-by: Ryan Kelley + Fixes #652 + Closes #1308 + Closes #xxxx + +- RELEASE-NOTES: sync [ci skip] + +GitHub (2 Apr 2024) +- [Viktor Szakats brought this change] + + test debian:testing-slim post xz backdoor removal (#1346) + + The unexplained CI fallouts are gone with the latest debian:testing (20240330). + + Ref #1328 #1329 #1338. + Closes #1346 + +Viktor Szakats (30 Mar 2024) +- ci: use Linux runner for BSDs, add arm64 FreeBSD 14 job + + - bump cross-platform-actions to 0.23.0. + Ref: https://github.com/cross-platform-actions/action/releases/tag/v0.23.0 + + - switch to Linux runners (from macOS) for cross-platform-actions. + It's significantly faster. + + - switch back FreeBSD 14 job to cross-platform-actions. + Also switch back to default shell. + + - add FreeBSD 14 arm64 job. + + Closes #1343 + +- ci: use single quotes in yaml [ci skip] + +- ci: tidy-up job order [ci skip] + +- build: drop `-Wformat-nonliteral` warning suppressions + + Also markup a vararg function as such. + + In functions marked up as vararg functions, there is no need to suppress + `-Wformat-nonliteral` warnings. It's done automatically by the compiler. + + Closes #1342 + +- ci: delete flaky FreeBSD 13.2 job + + Keep FreeBSD 14. + +- RELEASE-NOTES: sync [ci skip] + +- example: restore `sys/time.h` for AIX + + In AIX, `time.h` header file doesn't have definitions like + `fd_set`, `struct timeval`, which are found in `sys/time.h`. + + Add `sys/time.h` to files affected when available. + + Regression from e53aae0e16dbf53ddd1a4fcfc50e365a15fcb8b9 #1001. + + Reported-by: shubhamhii on GitHub + Assisted-by: shubhamhii on GitHub + Fixes #1334 + Fixes #1335 + Closes #1340 + +- userauth: avoid oob with huge interactive kbd response + + - If the length of a response is `UINT_MAX - 3` or larger, an unsigned + integer overflow occurs on 64-bit systems. Avoid such truncation to + always allocate enough memory to avoid subsequent out of boundary + writes. + + Patch-by: Tobias Stoeckmann + + - also add FIXME to bump up length field to `size_t` (ABI break) + + Closes #1337 + +GitHub (28 Mar 2024) +- [Josef Cejka brought this change] + + transport: check ETM on remote end when receiving (#1332) + + We should check if encrypt-then-MAC feature is enabled in remote end's + configuration. + + Fixes #1331 + +- [Josef Cejka brought this change] + + kex: always add extension indicators to kex_algorithms (#1327) + + KEX pseudo-methods "ext-info-c" and "kex-strict-c-v00@openssh.com" + are in default kex method list but they were lost after configuring + custom kex method list in libssh2_session_method_pref(). + + Fixes #1326 + +- [Jiwoo Park brought this change] + + cmake: use the imported target of FindOpenSSL module (#1322) + + * Use the imported target of FindOpenSSL module + * Build libssh2 before test runner + * Use find_package() in the CMake config file + * Use find_dependency() rather than find_package() + * Install CMake module files and use them in the config file + * Use elseif() to choose the crypto backend + +- [Andrei Augustin brought this change] + + docs: update INSTALL_AUTOTOOLS (#1316) + + corrected --with-libmbedtls-prefix to current option --with-libmbedcrypto-prefix + +Viktor Szakats (28 Mar 2024) +- ci: don't parallelize `distcheck` job + + A while ago the `distcheck` CI job became flaky. This continued after + switching to Debian stable (from testing). Try stabilzing it by running + it single-threaded. + + Closes #1339 + +- Dockerfile: switch to Debian stable (from testing) + + This fixes flakiness experienced recently with two OpenSSL jobs and one + libgcrypt job, and/or intermittently causing all Docker-based tests to + fail. + + Reported-by: András Fekete + Fixes #1328 + Fixes #1329 + Closes #1338 + +GitHub (22 Feb 2024) +- [Michael Buckley brought this change] + + Supply empty hash functions for mac_method_hmac_aesgcm to avoid a crash when e.g. setting LIBSSH2_METHOD_CRYPT_CS (#1321) + +- [Michael Buckley brought this change] + + gen_publickey_from_dsa: Initialize BIGNUMs to NULL for OpenSSL 3 (#1320) + +Viktor Szakats (23 Jan 2024) +- RELEASE-NOTES: add algo deprecation notices [ci skip] + + Closes #1307 + +- RELEASE-NOTES: sync [ci skip] + +GitHub (22 Jan 2024) +- [Juliusz Sosinowicz brought this change] + + wolfssl: enable debug logging in wolfSSL when compiled in (#1310) + + Co-authored-by: Viktor Szakats + +- [monnerat brought this change] + + os400: maintain up to date (#1309) + + - Handle MD5 conditionals in os400qc3. + - Check for errors in os400qc3 pbkdf1. + - Implement an optional build options override file. + - Sync ILE/RPG copy files with current C header files. + - Allow a null session within a string conversion cache. + - Add an ILE/RPG example. + - Adjust outdated copyrights in changed files. + +Viktor Szakats (18 Jan 2024) +- RELEASE-NOTES: sync + +- src: check hash update/final success + + Also: + - delete unused internal macro `libssh2_md5()` where defined. + - prefix `libssh2_os400qc3_hash*()` function names with underscore. + These are public/visible, but internal. + - add FIXMEs to OS/400 code to verify update/final calls; some OS API, + some internal. + + Ref: https://github.com/libssh2/libssh2/pull/1301#discussion_r1446861650 + Reviewed-by: Michael Buckley + Reviewed-by: Patrick Monnerat + Closes #1303 + +- RELEASE-NOTES: sync [ci skip] + +GitHub (18 Jan 2024) +- [Ryan Kelley brought this change] + + openssl: fix cppcheck found NULL dereferences (#1304) + + * Fix NULL dereference in gen_publickey_from_rsa_evp and + gen_publickey_from_dsa_evp. + * Add checks for en_publickey_from_ec_evp and en_publickey_from_ed_evp + +Viktor Szakats (12 Jan 2024) +- openssl: delete internal `read_openssh_private_key_from_memory()` + + It was wrapping another internal function with no added logic. + + Closes #1306 + +- openssl: formatting/whitespace + + Also use `NULL` instead of `0` for pointers. + + Closes #1305 + +- HACKING-CRYPTO: more fixups [ci skip] + + Follow-up to f64885b6ab9bbdae2da9ebd70f4dd5cea56e838a #1297 + +- HACKING-CRYPTO: fixups [ci skip] + + Follow-up to f64885b6ab9bbdae2da9ebd70f4dd5cea56e838a #1297 + +- RELEASE-NOTES: sync [ci skip] + +- src: check hash init success + + Before this patch, SHA2 and SHA1 init function results were cast to + `void`. This patch makes sure to verify these values. + + Also: + - exclude an `assert(0)` from release builds in `_libssh2_sha_algo_ctx_init()`. + (return error instead) + - fix indentation / whitespace + + Reviewed-by: Michael Buckley + Closes #1301 + +- mac: handle low-level errors + + - update low-level hmac functions from macros to functions. + - libgcrypt: propagate low-level hmac errors. + - libgcrypt: add error checks for hmac calls. + - os400qc3: add error checks, propagate them. + Assisted-by: Patrick Monnerat + - mbedtls: fix propagating low-level hmac errors. + - wincng: fix propagating low-level hmac errors. + - mac: verify success of low-level hmac functions. + - knownhost: verify success of low-level hmac functions. + - transport: verify success of MAC hash call. + - minor type cleanup in wincng. + - delete unused ripemd wrapper in wincng. + - delete unused SHA384 wrapper in mbedtls. + + Reported-by: Paul Howarth + Reviewed-by: Michael Buckley + Closes #1297 + +GitHub (8 Jan 2024) +- [Michael Buckley brought this change] + + Fix an out-of-bounds read in _libssh2_kex_agree_instr when searching for a KEX not in the server list (#1302) + +Viktor Szakats (21 Dec 2023) +- RELEASE-NOTES: sync [ci skip] + +- ci/appveyor: re-enable parallel mode + + The comment cited earlier is no longer true with recent CMake versions. + This options does actually enable parallel builds with MSVC since CMake + v3.26.0: https://gitlab.kitware.com/cmake/cmake/-/issues/20564 + + The effect isn't much for libssh2, because it spends most time in tests, + but let's enable it anyway for efficiency. + + Ref: 0d08974633cfc02641e6593db8d569ddb3644255 #884 + Ref: 7a039d9a7a2945c10b4622f38eeed21ba6b4ec55 #867 + + Closes #1294 + +- ci/gha: review/fixup auto-cancel settings + + - use the group expression from `reuse.yml` (via curl). + - add auto-cancel for `ci` and `cifuzz`. + - add auto-cancel to `appveyor_docker`. I'm just guessing here. + The hope is that it fixes AppVeyor CI runs when re-pushing a PR. + This frequently caused the freshly pushed session to fail waiting for + a connection. + - sync group expression in `appveyor_status` with `reuse`. + + Closes #1292 + +- RELEASE-NOTES: fix casing in GitHub names [ci skip] + +- RELEASE-NOTES: synced [ci skip] + + Closes #1279 + +- [Michael Buckley brought this change] + + src: add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" + + Refs: + https://terrapin-attack.com/ + https://seclists.org/oss-sec/2023/q4/292 + https://osv.dev/list?ecosystem=&q=CVE-2023-48795 + https://github.com/advisories/GHSA-45x7-px36-x8w8 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795 + + Fixes #1290 + Closes #1291 + +- session: add `libssh2_session_callback_set2()` + + Add new `libssh2_session_callback_set2()` API that deprecates + `libssh2_session_callback_set()`. + + The new implementation offers the same functionality, but accepts and + returns a generic function pointer (of type `libssh2_cb_generic *`), as + opposed to the old function that used data pointers (`void *`). The new + solution thus avoids data to function (and vice versa) pointer + conversions, which has undefined behaviour in standard C. + + About the name: It seems the `*2` suffix was used in the past for + replacement functions for deprecated ones. Let's stick with that. + `*_ex` was preferred for new functions that extend existing ones with + new features. + + Closes #1285 + +- build: enable `-pedantic-errors` + + According to the manual, this isn't the same as `-Werror -pedantic`. + Enable it together with `-Werror`. + + https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-pedantic-errors-1 + + This option results in autotools feature detection going into crazies. + To avoid this, we add it to `CFLAGS` late. Idea copied from curl. + + This option has an effect only with gcc 5.0 and newer as of this commit. + Let's enable it for clang and older versions too for simplicity. Ref: + https://github.com/curl/curl/commit/d5c0351055d5709da8f3e16c91348092fdb481aa + https://github.com/curl/curl/pull/2747 + + Closes #1286 + +- build: add mingw-w64 support to `LIBSSH2_PRINTF()` attribute + + And fix the warning it detected. + + Closes #1287 + +- libssh2.h: add deprecated function warnings + + With deprecated-at versions and suggested replacement function. + + It's possible to silence them by defining `LIBSSH2_DISABLE_DEPRECATION`. + + Also add depcreated-at versions to documentation, and unify wording. + + Ref: https://github.com/libssh2/libssh2/pull/1260#issuecomment-1837017987 + Closes #1289 + +- ci/spellcheck: delete redundant option [ci skip] + + `--check-hidden` not necessary when passing filenames explicitly. + + Follow-up to a79218d3a058a333bb9de14079548a3511679a04 + +- tidy-up: add empty line for clarity [ci skip] + +- build: FIXME `-Wsign-conversion` to be errors [ci skip] + +- src: disable `-Wsign-conversion` warnings, add option to re-enable + + To avoid the log noise till we fix those ~360 compiler warnings. + + Also add macro `LIBSSH2_WARN_SIGN_CONVERSION` to re-enable them. + + Follow-up to afa6b865604019ab27ec033294edfe3ded9ae0c0 #1257 + + Closes #1284 + +- cmake: fix indentation [ci skip] + +- example, tests: call `WSACleanup()` for each `WSAStartup()` + + On Windows. + + Closes #1283 + +- RELEASE-NOTES: update credits [ci skip] + + Ref: https://github.com/libssh2/libssh2/pull/1241#issuecomment-1830118584 + +- RELEASE-NOTES: avoid splitting names, fix typo, refine order [ci skip] + +- RELEASE-NOTES: synced [ci skip] + +- add portable `LIBSSH2_SOCKET_CLOSE()` macro + + Add `LIBSSH2_SOCKET_CLOSE()` to the public `libssh2.h` header, for user + code. It translates to `closesocket()` on Windows and `close()` on other + platforms. + + Use it in example code. + + It makes them more readable by reducing the number of `_WIN32` guards. + + Closes #1278 + +- ci: add FreeBSD 14 job, fix issues + + - install bash to fix error when running tests: + ``` + ERROR: test_sshd.test - missing test plan + ERROR: test_sshd.test - exited with status 127 (command not found?) + ===================================== + [...] + # TOTAL: 4 + # PASS: 2 + # SKIP: 0 + # XFAIL: 0 + # FAIL: 0 + # XPASS: 0 + # ERROR: 2 + [...] + env: bash: No such file or directory + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/7133852508/job/19427420687#step:3:3998 + + - fix sshd issue when running tests: + ``` + # sshd log: + # Server listening on :: port 4711. + # Server listening on 0.0.0.0 port 4711. + # Authentication refused: bad ownership or modes for file /home/runner/work/libssh2/libssh2/tests/key_rsa.pub + # Authentication refused: bad ownership or modes for file /home/runner/work/libssh2/libssh2/tests/openssh_server/authorized_keys + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/7134629175/job/19429828342#step:3:4059 + + Cherry-picked from #1277 + Closes #1277 + +- ci: add OmniOS job, fix issues + + - use GNU Make, to avoid errors: + ``` + make: Fatal error in reader: Makefile, line 983: Badly formed macro assignment + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/7134629175/job/19429838379#step:3:1956 + + Caused by `?=` in `Makefile.am`. Fix it just in case. + + ``` + make: Fatal error in reader: Makefile, line 438: Unexpected end of line seen + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/7135524843/job/19432451767#step:3:1966 + + It's around line 43 in `Makefile.am`, reason undiscovered. + + - fix error: + ``` + ../../src/hostkey.c:1227:44: error: pointer targets in passing argument 5 of '_libssh2_ed25519_sign' differ in signedness [-Werror=pointer-sign] + 1227 | datavec[0].iov_base, datavec[0].iov_len); + | ~~~~~~~~~~^~~~~~~~~ + | | + | caddr_t {aka char *} + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/7135102832/job/19431233967#step:3:2225 + + https://docs.oracle.com/cd/E36784_01/html/E36887/iovec-9s.html + + - FIXME: new `-Wsign-conversion` warnings appeared in examples: + ``` + ../../example/direct_tcpip.c:251:9: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion] + 251 | FD_SET(forwardsock, &fds); + | ^~~~~~ + ../../example/direct_tcpip.c:251:9: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion] + ../../example/direct_tcpip.c:251:9: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion] + ../../example/direct_tcpip.c:251:9: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion] + ../../example/direct_tcpip.c:259:18: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion] + 259 | if(rc && FD_ISSET(forwardsock, &fds)) { + | ^~~~~~~~ + ../../example/direct_tcpip.c:259:18: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion] + ../../example/direct_tcpip.c:259:18: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion] + [...] + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/7136086865/job/19433997429#step:3:3450 + + Cherry-picked from #1277 + +- example: use `libssh2_socket_t` in X11 example + + Cherry-picked from #1277 + +- [Aaron Stone brought this change] + + Handle EINTR from send/recv/poll/select to try again as the error is not fatal + + Integration-patches-by: Viktor Szakats + Fixes #955 + Closes #1058 + +- appveyor: delete UWP job broken since Visual Studio upgrade + + Few days ago UWP job started permafailing. + + fail: https://ci.appveyor.com/project/libssh2org/libssh2/builds/48678129/job/yb8n2pox8mfjwv6m + good: https://ci.appveyor.com/project/libssh2org/libssh2/builds/48673013 + + Other projects also affected: + https://ci.appveyor.com/project/c-ares/c-ares/builds/48687390/job/l0fo4b0sijvqkw9r + + No related local update. Same CMake version. Same CI image. + + This seems to be the culprit, which could mean that this update broke + CMake detection, needs a different CMake configuration on our end, or + that this MSVC update pulled support for UWP apps: + + fail: -- The C compiler identification is MSVC 19.38.33130.0 (~ Visual Studio 2022 v17.8) + good: -- The C compiler identification is MSVC 19.37.32825.0 (~ Visual Studio 2022 v17.7) + + If this is v17.8, release notes don't readily suggest a feature removal: + https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes-v17.8 + + So it might just be UWP accidentally broken in this release. + + Closes #1275 + +- checksrc: sync with curl + + Closes #1272 + +- autotools: delete `--disable-tests` option, fix CI tests + + Originally added to improve build performance by skipping building + tests. But, there seems to be no point in this, because autotools + doesn't build tests by default, unless explicitly invoking + `make check`. + + Delete this option from Cygwin and FreeBSD CI tests, where it caused + `make check` to do nothing. Tests are built now, and runtime tests are + too, where supported. + + Also disable Docker-based tests for these, and add a missing `make -j3` + for FreeBSD. + + Reverts 7483edfada1f7e17cf8f9ac1c87ffa3d814c987e #715 + + Closes #1271 + +GitHub (6 Dec 2023) +- [ren mingshuai brought this change] + + build: add `LIBSSH2_NO_DEPRECATED` option (#1266) + + The following APIs have been deprecated for over 10 years and + use `LIBSSH2_NO_DEPRECATED` to mark them as deprecated: + + libssh2_session_startup() + libssh2_banner_set() + libssh2_channel_receive_window_adjust() + libssh2_channel_handle_extended_data() + libssh2_scp_recv() + + Add these options to disable them: + - autotools: `--disable-deprecated` + - cmake: `-DLIBSSH2_NO_DEPRECATED=ON` + - `CPPFLAGS`: `-DLIBSSH2_NO_DEPRECATED` + + Fixes #1259 + Replaces #1260 + Co-authored-by: Viktor Szakats + Closes #1267 + +Viktor Szakats (5 Dec 2023) +- autotools: show the default for `hidden-symbols` option + + Closes #1269 + +- tidy-up: bump casts from int to long for large C99 types in printfs + + Cast large integer types to avoid dealing with printf masks for + `size_t` and other C99 types. Some of existing code used `int` + for this, bump them to `long`. + + Ref: afa6b865604019ab27ec033294edfe3ded9ae0c0 #1257 + + Closes #1264 + +- build: enable missing OpenSSF-recommended warnings, with fixes + + Ref: + https://best.openssf.org/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.html + (2023-11-29) + + Enable new warnings: + + - replace `-Wno-sign-conversion` with `-Wsign-conversion`. + + Fix them in example, tests and wincng. There remain about 360 of these + warnings in `src`. Add a TODO item for those and disable `-Werror` for + this particular warning. + + - enable `-Wformat=2` for clang (in both cmake and autotools). + + - enable `__attribute__((format))` for `_libssh2_debug()`, + `_libssh2_snprintf()` and in tests for `run_command()`. + + `LIBSSH2_PRINTF()` copied from `CURL_TEMP_PRINTF()` in curl. + + - enable `-Wimplicit-fallthrough`. + + - enable `-Wtrampolines`. + + Fix them: + + - src: replace obsolete fall-through-comments with + `__attribute__((fallthrough))`. + + - wincng: fix `-Wsign-conversion` warnings. + + - tests: fix `-Wsign-conversion` warnings. + + - example: fix `-Wsign-conversion` warnings. + + - src: fix `-Wformat` issues in trace calls. + + Also, where necessary fix `int` and `unsigned char` casts to + `unsigned int` and adjust printf format strings. These were not + causing compiler warnings. + + Cast large types to `long` to avoid dealing with printf masks for + `size_t` and other C99 types. Existing code often used `int` for this. + I'll update them to `long` in an upcoming commit. + + - tests: fix `-Wformat` warning. + + - silence `-Wformat-nonliteral` warnings. + + - mbedtls: silence `-Wsign-conversion`/`-Warith-conversion` + in external header. + + Closes #1257 + +- packet: whitespace fix + + Tested via #1257 + +- tidy-up: unsigned -> unsigned int + + In the `interval` argument of public `libssh2_keepalive_config()`. + + Tested via #1257 + +- tests: sync port number type with the rest of codebase + + Tested via #1257 + +- autotools: enable `-Wunused-macros` with gcc + + It works with gcc without the libtool warnings seen with clang + on Windows in 96682bd5e14c20828e18bf10ed5b4b5c7543924a #1227. + + Sync usage of of this macro with CMake and + autotools + clang + non-Windows. Making it enabled everywhere except + autotools + clang + Windows due to the libtool stub issue. + + Follow-up to 7ecc309cd10454c54814b478c4f85d0041da6721 #1224 + + Closes #1262 + +- TODO: disable or drop weak algos [ci skip] + + Closes #1261 + +- example, tests: fix/silence `-Wformat-truncation=2` gcc warnings + + Then sync this warning option with curl. + + Seems like a false positive and/or couldn't figure how to fix it, so silence: + ``` + example/ssh2.c:227:38: error: '%s' directive output may be truncated writing likely 1 or more bytes into a region of size 0 [-Werror=format-truncation=] + 227 | snprintf(fn1, fn1sz, "%s/%s", h, pubkey); + | ^~ + example/ssh2.c:227:34: note: assuming directive output of 1 byte + 227 | snprintf(fn1, fn1sz, "%s/%s", h, pubkey); + | ^~~~~~~ + example/ssh2.c:227:13: note: 'snprintf' output 3 or more bytes (assuming 4) into a destination of size 2 + 227 | snprintf(fn1, fn1sz, "%s/%s", h, pubkey); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + example/ssh2.c:228:38: error: '%s' directive output may be truncated writing likely 1 or more bytes into a region of size 0 [-Werror=format-truncation=] + 228 | snprintf(fn2, fn2sz, "%s/%s", h, privkey); + | ^~ + example/ssh2.c:228:34: note: assuming directive output of 1 byte + 228 | snprintf(fn2, fn2sz, "%s/%s", h, privkey); + | ^~~~~~~ + example/ssh2.c:228:13: note: 'snprintf' output 3 or more bytes (assuming 4) into a destination of size 2 + 228 | snprintf(fn2, fn2sz, "%s/%s", h, privkey); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/7055480458/job/19205970397#step:10:98 + + Fix: + ``` + tests/openssh_fixture.c:116:38: error: ' 2>&1' directive output may be truncated writing 5 bytes into a region of size between 1 and 1024 [-Werror=format-truncation=] + tests/openssh_fixture.c:116:11: note: 'snprintf' output between 6 and 1029 bytes into a destination of size 1024 + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/7055480458/job/19205969221#step:10:51 + + Tested via #1257 + +- example: fix indentation follow-up + + Fix long line and fix more indentations. + + Follow-up to 9e896e1b80911a53d6aabb322e034e6ca51b6898 + +- example: fix indentation + + Tested via #1257 + +- autotools: fix missed `-pedantic` and `-Wall` options for gcc + + Follow-up to 5996fefe2bad80cfba85b2569ce6ab6ef575142c #1223 + + Tested via #1257 + +- ci: show compiler in cross/cygwin job names + + Tested via #1257 + +- mbedtls: further improve disabling `-Wredundant-decls` + + Move warning option suppression to `src/mbedtls.h` to surround the actual + external header #includes that need it. + + Follow-up to ecec68a2c13a9c63fe8c2dc457ae785a513e157c #1226 + Follow-up to 7ecc309cd10454c54814b478c4f85d0041da6721 #1224 + + Tested via #1257 + +GitHub (1 Dec 2023) +- [ren mingshuai brought this change] + + example: replace remaining libssh2_scp_recv with libssh2_scp_recv2 in output messages (#1258) + + libssh2_scp_recv is deprecated and has been replaced by libssh2_scp_recv2 + in prior commit. + + Follow-up to 6c84a426beb494980579e5c1d244ea54d3fc1a3f + +Viktor Szakats (27 Nov 2023) +- openssl: use OpenSSL 3 HMAC API, add `no-deprecated` CI job + + - use OpenSSL 3 API when available for HMAC. + This fixes building with OpenSSL 3 `no-deprecated` builds. + + - ensure we support pure OpenSSL 3 API by adding a CI job using + OpenSSL 3 custom-built with `no-deprecated`. + + Follow-up to b0ab005fe79260e6e9fe08f8d73b58dd4856943d #1207 + + Fixes #1235 + Closes #1243 + +- ci: restore lost comment for FreeBSD [ci skip] + + Follow-up to eee4e8055ab375c9f9061d4feb39086737f41a9c + +- ci: add OpenBSD (v7.4) job + fix build error in example + + - Use CMake, LibreSSL and clang from the base install. + + - This uncovered a build error in `example/subsystem_netconf.c`, caused + by using the `%n` printf mask. This is a security risk and some + systems (notably OpenBSD) disable this feature. + + Fix it by applying this patch from OpenBSD ports (from 2021-09-11): + https://cvsweb.openbsd.org/ports/security/libssh2/patches/patch-example_subsystem_netconf_c?rev=1.1&content-type=text/x-cvsweb-markup + https://github.com/openbsd/ports/commit/2c5b2f3e94381914a3e8ade960ce8c997ca9d6d7 + "The old code is also broken, as it passes a pointer to a variable + of a different size (on LP64). There is no check for truncation, + but buf[] is 1MB in size." + Patch-by: naddy + + ``` + /home/runner/work/libssh2/libssh2/example/subsystem_netconf.c:252:17: error: '%n' format specifier support is deactivated and will call abort(3) [-Werror] + "]]>]]>\n%n", (int *)&len); + ~^ + /home/runner/work/libssh2/libssh2/example/subsystem_netconf.c:270:17: error: '%n' format specifier support is deactivated and will call abort(3) [-Werror] + "]]>]]>\n%n", (int *)&len); + ~^ + 2 errors generated. + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/6991449778/job/19022024280#step:3:420 + + Also made tests with arm64, but it takes consistently almost 14m to + finish the job, vs. 2-3m for the native amd64: + https://github.com/libssh2/libssh2/actions/runs/6991648984/job/19022440525 + https://github.com/libssh2/libssh2/actions/runs/6991551220/job/19022233651 + + Cherry-picked from #1250 + Closes #1250 + +- ci: add NetBSD (v9.3) job + + Use CMake, OpenSSL (v1.1) and clang from the base install. + + Cherry-picked from #1250 + +- ci: update and speed up FreeBSD job + + - switch to an alternate GitHub action. This one seems (more) actively + maintained, and runs faster: + https://github.com/cross-platform-actions/action + + - use clang instead of gcc. clang is already present in the base + install, saving install time and bandwidth. + + - stop installing `openssl-quictls` and use the OpenSSL (v1.1) from + the base system. + (I'm suspecting that quictls before this patch wasn't detected by + the build.) + https://wiki.freebsd.org/OpenSSL + + Cherry-picked from #1250 + +- stop using leading underscores in macro names + + Underscored macros are reserved for the compiler / standard lib / etc. + Stop using them in user code. + + We used them as header guards in `src` and in `__FILESIZE` in `example`. + + Closes #1248 + +- ci: use absolute path in `CMAKE_INSTALL_PREFIX` + + To make the installed locations unambiguous in the build logs. + + Closes #1247 + +- openssl: make a function static, add `#ifdef` comments + + Follow-up to 03092292597ac601c3f9f0c267ecb145dda75e4e #248 + where the function was added. + + Also add comments to make `#ifdef` branches easier to follow in + `openssl.h`. + + Closes #1246 + +- ci: boost mbedTLS build speed + + Build times down to 4 seconds (from 18-20). + + Closes #1245 + +- openssl: fix DSA code to use OpenSSL 3 API + + - fix missing `DSA` type when building for OpenSSL 3 `no-deprecated`. + - fix fallouts after fixing the above by switching away from `DSA` + with OpenSSL 3. + + Follow-up to b0ab005fe79260e6e9fe08f8d73b58dd4856943d #1207 + + Closes #1244 + +- openssl: formatting (delete empty lines) [ci skip] + +- tests: fall back to `$LOGNAME` for username + + If the `$USER` variable is empty, fall back to using `$LOGNAME` to + retrieve the logged-in username. + + In POSIX, `$LOGNAME` is a mandatory variable, while `$USER` isn't, and + on some systems it may not be set. Without this value, tests were unable + to provide the correct username when logging into the SSH server running + under the active user's session. + + Reported-by: Nicolas Mora + Suggested-by: Nicolas Mora + Ref: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056348 + Fixes #1240 + Closes #1241 + +- libssh2.h: use `_WIN32` for Windows detection instead of rolling our own + + Sync up `libssh2.h` Windows detection with the libssh2 source code. + + `libssh2.h` was using `WIN32` and `LIBSSH2_WIN32` for Windows detection, + next to the official `_WIN32`. After this patch it only uses `_WIN32` + for this. Also, make it stop defining `LIBSSH2_WIN32`. + + There is a slight chance these break compatibility with Windows + compilers that fail to define `_WIN32`. I'm not aware of any obsolete + or modern compiler affected, but in case there is one, one possible + solution is to define this macro manually. + + Closes #1238 + +- openssl: fix `EC_KEY` reference with OpenSSL 3 `no-deprecated` build + + Fixes: + ``` + src/openssl.c:650:5: error: use of undeclared identifier 'EC_KEY' + EC_KEY *ec_key = EC_KEY_new_by_curve_name(curve); + ^ + src/openssl.c:650:13: error: use of undeclared identifier 'ec_key' + EC_KEY *ec_key = EC_KEY_new_by_curve_name(curve); + ^ + src/openssl.c:650:22: error: implicit declaration of function 'EC_KEY_new_by_curve_name' is invalid in C99 [-Werror,-Wimplicit-function-declaration] + EC_KEY *ec_key = EC_KEY_new_by_curve_name(curve); + ^ + src/openssl.c:650:22: note: did you mean 'EC_GROUP_new_by_curve_name'? + ./quictls/_a64-mac-sys/usr/include/openssl/ec.h:483:11: note: 'EC_GROUP_new_by_curve_name' declared here + EC_GROUP *EC_GROUP_new_by_curve_name(int nid); + ^ + In file included from ./_a64-mac-sys-bld/src/CMakeFiles/libssh2_static.dir/Unity/unity_0_c.c:19: + In file included from src/crypto.c:10: + src/openssl.c:652:8: error: use of undeclared identifier 'ec_key' + if(ec_key) { + ^ + ``` + Ref: https://github.com/curl/curl-for-win/actions/runs/6950001225/job/18909297867#step:3:4341 + + Follow-up to b0ab005fe79260e6e9fe08f8d73b58dd4856943d #1207 + + Bug #1235 + Closes #1236 + +- openssl: formatting + + Sync up these lines with the other two similar occurrences in the code. + + Cherry-picked from #1236 + +GitHub (21 Nov 2023) +- [Michael Buckley brought this change] + + openssl: use non-deprecated APIs with OpenSSL 3.x (#1207) + + Assisted-by: Viktor Szakats + +Viktor Szakats (21 Nov 2023) +- ci: add BoringSSL job (cmake, gcc, amd64) + + Closes #1233 + +- autotools: fix dotless gcc and Apple clang version detections + + - fix parsing dotless (major-only) gcc versions. + Follow-up to 00a3b88c51cdb407fbbb347a2e38c5c7d89875ad #1187 + + - sync gcc detection variable names with curl. + + - fix Apple clang version detection for releases between + 'Apple LLVM version 7.3.0' and 'Apple LLVM version 10.0.1' where the + version was under-detected as 3.7 llvm/clang equivalent. + + - fix Apple clang version detection for 'Apple clang version 11.0.0' + and newer where the Apple clang version was detected, instead of its + llvm/clang equivalent. + + - revert to show `clang` instead of `Apple clang`, because we follow it + with an llvm/clang version number. (Apple-ness still visible in raw + version.) + + Used this collection for Apple clang / llvm/clang translation and test + inputs: https://gist.github.com/yamaya/2924292 + + Closes #1232 + +- acinclude.m4: revert accidental edit [ci skip] + + Follow-up to 8c320a93a48775b74f40415e46f84bf68b4d5ae8 + +- autotools: show more clang/gcc version details + + Also: + - show if we detected Apple clang. + - delete duplicate version detection for clang. + + Closes #1230 + +- acinclude.m4: re-sync with curl [ci skip] + +- autotools: avoid warnings in libtool stub code + + Seen on Windows with clang64, in libtool-generated stub code for + examples and tests. + + The error didn't break the CI job for some reason. + + msys2 (autotools, clang64, clang-x86_64: + ``` + [...] + 2023-11-17T20:14:17.8639574Z ./.libs/lt-test_read.c:91:10: error: macro is not used [-Werror,-Wunused-macros] + [...] + 2023-11-17T20:14:39.8729255Z ./.libs/lt-sftp_write_nonblock.c:91:10: error: macro is not used [-Werror,-Wunused-macros] + [...] + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/6908585056/job/18798193405?pr=1226#step:8:474 + + Follow-up to 7ecc309cd10454c54814b478c4f85d0041da6721 #1224 + + Closes #1227 + +- mbedtls: improve disabling `-Wredundant-decls` + + Disable these warnings specifically for the mbedTLS public headers + and leave it on for the the rest of the code. This also fixes this + issue for autotools. Previous solution was globally disabling this + warning for the whole code when using mbedTLS and only with CMake. + + Follow-up to 7ecc309cd10454c54814b478c4f85d0041da6721 #1224 + + Closes #1226 + +- cmake: rename picky warnings script + + To match the camel-case style used in other CMake scripts and also + to match the name used in curl. + + Closes #1225 + +- build: enable more compiler warnings and fix them + + Enable more picky compiler warnings. I've found these options in the + nghttp3 project when implementing the CMake quick picky warning + functionality for it. + + Fix issues found along the way: + + - wincng, mbedtls: delete duplicate function declarations. + Most of this was due to re-#defining crypto functions to + crypto-backend specific implementations These redefines also remapped + the declarations in `crypto.h`, making the backend-specific + declarations duplicates. + This patch deletes the backend-specific declarations. + + - wincng mapped two crypto functions to the same local function. + Also causing double declarations. + Fix this by adding two disctinct wrappers and moving + the common function to a static one. + + - delete unreachable `break;` statements. + + - kex: disable macros when unused. + + - agent: disable unused constants. + + - mbedtls: disable double declaration warnings because public mbedTLS + headers trigger it. (with function `psa_set_key_domain_parameters`) + + - crypto.h: formatting. + + Ref: https://github.com/ngtcp2/nghttp3/blob/a70edb08e954d690e8fb2c1df999b5a056f8bf9f/cmake/PickyWarningsC.cmake + + Closes #1224 + +- autotools: sync warning enabler code with curl + + Tiny changes and minor updates to bring this code closer + to curl's `m4/curl-compilers.m4`. + + Closes #1223 + +- acinclude.m4: fix indentation [ci skip] + + Also match indentation of curl's `m4/curl-compilers.m4` for + easier syncing. + +- autotool: rename variable + + `WARN` -> `tmp_CFLAGS` + + To match curl and make syncing this code easier. + + Ref: https://github.com/curl/curl/blob/d1820768cce0e797d1f072343868ce1902170e93/m4/curl-compilers.m4#L479 + + Closes #1222 + +- autotools: picky warning options tidy-up + + - sync clang warning version limits with CMake. + - make `WARN=` vs. `CURL_ADD_COMPILER_WARNINGS()` consistent with curl + and between clang and gcc (`WARN=` is for `no-` options in general). + + Closes #1221 + +- build: picky warning updates + + - cmake, autotools: sync picky gcc warnings with curl. + - cmake, autotools: add `-Wold-style-definition` for clang too. + - cmake, autotools: add comment for `-Wformat-truncation=1`. + - cmake: more precise version info for old clang options. + + Closes #1219 + +- ci: fixup FreeBSD version, bump mbedtls + + We haven't been using the FreeBSD version. Also it turns out, + the single version supported is 13.2 at the moment: + https://github.com/vmactions/freebsd-vm/tree/main/conf + + Stop trying to set the version and instead rely on the action + providing the latest supported one automatically. + + Follow-up to a7d2a573be26238cc2b55e5ff6649bbe620cb8d9 + + Also: + - add more details to the FreeBSD job description. + - bump mbedtls version while here. + + Closes #1217 + +- cmake: fix multiple include of libssh2 package + + Also extend our integration test double inclusion. It will still not + catch this case, because that requires + `cmake_minimum_required(VERSION 3.18)` or higher. + + Fixes: + ``` + CMake Error at .../lib/cmake/libssh2/libssh2-config.cmake:8 (add_library): + add_library cannot create ALIAS target "libssh2::libssh2" because another + target with the same name already exists. + Call Stack (most recent call first): + CMakeLists.txt:24 (find_package) + + CMake Error at .../lib/cmake/libssh2/libssh2-config.cmake:13 (add_library): + add_library cannot create ALIAS target "Libssh2::libssh2" because another + target with the same name already exists. + Call Stack (most recent call first): + CMakeLists.txt:24 (find_package) + ``` + + Test to reproduce: + ```cmake + cmake_minimum_required(VERSION 3.18) # must be 3.18 or higher + + project(test) + + find_package(libssh2 CONFIG) + find_package(libssh2 CONFIG) # fails + + add_executable(test main.c) + target_link_libraries(test libssh2::libssh2) + ``` + + Ref: https://cmake.org/cmake/help/latest/release/3.18.html#other-changes + Ref: https://cmake.org/cmake/help/v3.18/policy/CMP0107.html + + Assisted-by: Kai Pastor + Assisted-by: Harry Mallon + Ref: https://github.com/curl/curl/pull/11913 + + Closes #1216 + +- ci: add FreeBSD 13.2 job + + It runs over Linux via qemu. First two runs were (very) slow, then it + became (much) more performant at just 2x slower than a native Linux + build. Then got slow again, then fast again. Still seems acceptable + for the value this adds. + + The build uses autotools and quictls. + + Successful builds: + 1. https://github.com/libssh2/libssh2/actions/runs/6802676786/job/18496286419 (13m59s, -j3) + 2. https://github.com/libssh2/libssh2/actions/runs/6802976375/job/18497243225 (11m5s, -j2) + 3. https://github.com/libssh2/libssh2/actions/runs/6803142201/job/18497785049 (3m6s, -j1) + 4. https://github.com/libssh2/libssh2/actions/runs/6803194839/job/18497962766 (3m10s, -j2) + 5. https://github.com/libssh2/libssh2/actions/runs/6803267201/job/18498208501 (3m13s) + 6. https://github.com/libssh2/libssh2/actions/runs/6803510333/job/18498993698 (15m25s) + 7. https://github.com/libssh2/libssh2/actions/runs/6813602863/job/18528571057 (3m13s) + + Similar solution exists for Solaris (over macOS via VirtualBox), but it + hangs forever at `Waiting for text: solaris console login`: + https://github.com/libssh2/libssh2/actions/runs/6802388128/job/18495391869#step:4:185 + + Idea taken from LibreSSL. + + FIXME: Unrelated, the `distcheck` job became flaky in recent days: + https://github.com/libssh2/libssh2/actions/runs/6802976375/job/18497256437#step:10:536 + ``` + FAIL: test_auth_pubkey_ok_rsa_aes256gcm + ``` + https://github.com/libssh2/libssh2/actions/runs/6813602863/job/18528588933#step:10:533 + ``` + FAIL: test_read + ``` + + Closes #1215 + +- reuse: fix duplicate copyright warning + + ``` + PendingDeprecationWarning: + Copyright and licensing information for 'tests/openssh_server/Dockerfile' + has been found in both 'tests/openssh_server/Dockerfile' and in the DEP5 + file located at '.reuse/dep5'. The information for these two sources has + been aggregated. In the future this behaviour will change, and you will + need to explicitly enable aggregation. [...] + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/6789274955/job/18456085964#step:4:4 + +- Makefile.mk: delete Windows-focused raw GNU Make build + + We recommend using CMake instead. Especially in unity mode, it's faster + and probably more familiar for most. It's also easily portable. + + (`Makefile.mk` was also portable, but in practice only usable for + Windows. Other platforms required a manual config header.) + + Also: + - migrate `LIBSSH2_NO_*` option CI tests to CMake. + - make MSYS2 CMake builds verbose to show compilation options. + + Closes #1204 + +- tidy-up: around `stdint.h` + + - os400: delete unused `HAVE_STDINT_H`. + + - fuzz: delete redundant `stdint.h` use. + `inttypes.h` is already included via `testinput.h`. + + - docs/TODO: adjust type in planned function. + + Closes #1212 + +- cmake: show crypto backend in feature summary + + This was visible as an enabled package before this patch, but it missed + to show WinCNG. + + Closes #1211 + +- man: fix double spaces and dash escaping + + - `- ` -> `- ` + - `. ` -> `. ` + - `\- ` -> `- ` + - `-1` -> `\-1` + - fold long lines along the way + + This makes the minus sign come out as a Unicode minus sign + (0x2212), and title separator dashes as Unicode hyphen (0x2010), + with `groff -Tutf8` v1.23.0. + + Ref: https://lwn.net/Articles/947941/ + + Closes #1210 + +- src: fix gcc 13 `-Wconversion` warning on Darwin + + ``` + src/session.c: In function 'libssh2_poll': + src/session.c:1776:22: warning: conversion from 'long int' to '__darwin_suseconds_t' {aka 'int'} may change value [-Wconversion] + 1776 | tv.tv_usec = (timeout_remaining % 1000) * 1000; + | ^ + ``` + Ref: https://github.com/curl/curl-for-win/actions/runs/6711735060/job/18239768548#step:3:4368 + + Follow-up to 08354e0abbe86d4cc5088d210d53531be6d8981a + + Closes #1209 + +- openssl: silence `-Wunused-value` warnings + + Seen with gcc 12. + + Manual: https://www.openssl.org/docs/man3.1/man3/BIO_reset.html + + ``` + ./quictls/linux-a64-musl/usr/include/openssl/bio.h:555:34: warning: value computed is not used [-Wunused-value] + 555 | # define BIO_reset(b) (int)BIO_ctrl(b,BIO_CTRL_RESET,0,NULL) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + ./libssh2/src/openssl.c:3518:5: note: in expansion of macro 'BIO_reset' + ./libssh2/src/openssl.c:3884:5: note: in expansion of macro 'BIO_reset' + ./libssh2/src/openssl.c:3995:5: note: in expansion of macro 'BIO_reset' + ``` + Ref: https://github.com/curl/curl-for-win/actions/runs/6696392318/job/18194032712#step:3:5060 + + Closes #1205 + +- Makefile.am: fix `cp` to preserve attributes and timestamp + +- cmake: simplify showing CMake version + + Move it to `CMakeLists.txt`. Drop `cmake --version` commands. + + Credit to the `zlib-ng` project for the idea: + https://github.com/zlib-ng/zlib-ng/blob/61e181c8ae93dbf56040336179c9954078bd1399/CMakeLists.txt#L7 + + Closes #1203 + +- ci: mbedtls 3.5.0 + + v3.5.0 needs extra compiler option for i386 to avoid: + ``` + #error "Must use `-mpclmul -msse2 -maes` for MBEDTLS_AESNI_C" + ``` + + Closes #1202 + +- tests: show cmake version used in integration tests + + Closes #1201 + +- readme.vms: fix typo [ci skip] + + Detected by codespell 2.2.6 + +- appveyor: YAML/PowerShell formatting, shorten variable name + + - use single-quotes in yaml and PowerShell. + + - shorten a variable name. + + - use indentation 2 for scripts. + + - use C else-style in PowerShell. + + Closes #1200 + +- ci: update actions, use shallow clones with appveyor + + - update GitHub Actions to their latest versions. + + - use shallow git clones in AppVeyor CI to save data over the wire. + + Closes #1199 + +- appveyor: move to pure PowerShell + + - replace batch commands with PowerShell. + + - merge separate command entries into single PowerShell blocks. + + Closes #1197 + +- windows: use built-in `_WIN32` macro to detect Windows + + Instead of `WIN32`. + + The compiler defines `_WIN32`. Windows SDK headers or build env defines + `WIN32`, or we have to take care of it. The agreement seems to be that + `_WIN32` is the preferred practice here. + + Minor downside is that CMake uses `WIN32` and we also adopted it in + `Makefile.mk`. + + In public libssh2 headers we stick with accepting either `_WIN32` or + `WIN32` and define our own namespaced `LIBSSH2_WIN32` based on them. + + grepping for `WIN32` remains useful to detect Windows-specific code. + + Closes #1195 + +- cmake: cleanup mbedTLS version detection more + + - lowercase, underscored local variables. + - fix `find_library()` to use the multiple names passed. + - rely more on `find_package_handle_standard_args()`. + Logic based on our `Findwolfssl.cmake`. + - delete ignored/unused `MBEDTLS_LIBRARY_DIR`. + - revert CI configuration to use `MBEDCRTYPO_LIBRARY`. + - clarify inputs/outputs in comment header. + - use variable for regex. + - formatting. + + Follow-up to 41594675072c578294674230d4cf5f47fa828778 #1192 + + Closes #1196 + +- cmake: delete duplicate `include()` + +- cmake: improve/fix mbedTLS detection + + - libssh2 needs the crypto lib only, stop dealing with the rest. + + - simplify logic. + + - drop hard-wired toolchain specific options that broke with e.g. MSVC. + + Reported by: AR Visions + Fixes #1191 + + - add mbedTLS version detection for recent releases. + + - merge custom detection results display into a single line. + + - shorten mbedTLS configuration in macOS CI job. + + Used the curl mbedTLS detection logic for ideas: + https://github.com/curl/curl/blob/a8c773845f4fdbfb09b08a6ec4b656c812568995/CMake/FindMbedTLS.cmake + + Closes #1192 + +GitHub (24 Sep 2023) +- [concussious brought this change] + + libssh2_session_get_blocking.3: Add description (#1185) + +Viktor Szakats (21 Sep 2023) +- autotools: fix selecting wincng in cross-builds (and more) + + - Fix explicitly selecting WinCNG in autotools cross-builds by moving + `windows.h` header check before the WinCNG availability check. + Follow-up to d43b8d9b0b9cd62668459fe5d582ed83aabf77e7 + + Reported-by: Jack L + Fixes #1186 + + - Add Linux -> mingw-w64 cross-builds for autotools and CMake. This + doesn't detect #1186, because that happened when explicitly specifying + WinCNG via `--with-crypto=wincng`, but not when falling back to WinCNG + by default. + + - autotools: fix to strip suffix from gcc version + + Before this patch we expected `n.n` `-dumpversion` output, but Ubuntu + may return `n-win32` (also with `-dumpfullversion`). Causing these + errors and failing to enable picky warnings: + ``` + ../configure: line 23845: test: : integer expression expected + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/6263453828/job/17007893718#step:5:143 + + Fix that by stripping any dash-suffix. + + gcc version detection is still half broken because we translate '10' + to '10.10' because `cut -d. -f2` returns the first word if the + delimiter missing. + + More possible `-dumpversion` output: `10-posix`, `10-win32`, + `9.3-posix`, `9.3-win32`, `6`, `9.3.0`, `11`, `11.2`, `11.2.0` + Ref: https://github.com/mamedev/mame/pull/9767 + + Closes #1187 + +GitHub (28 Aug 2023) +- [Michael Buckley brought this change] + + Properly bounds check packet_authagent_open() (#1179) + + * Properly bounds check packet_authagent_open + * packet.c: use strlen instead of sizeof for strings + * Make LIBSSH_CHANNEL's channel_type_len a size_t + * packet_authagent_open: use size_t for offset + + Credit: + Michael Buckley, signed off by Will Cosgrove + +Viktor Szakats (28 Aug 2023) +- os400qc3: move FIXME comment [ci skip] + + Follow-up to eb9f9de2c19ec67d12a444cce34bdd059fd26ddc + +- md5: allow disabling old-style encrypted private keys at build-time + + Before this patch, this happened at runtime when using an old (pre-3.0), + FIPS-enabled OpenSSL backend. + + This patch makes it possible to disable this via the build-time option + `LIBSSH2_NO_MD5_PEM`. + + Also: + - make sure to exclude all MD5 internal APIs when both the above and + `LIBSSH2_NO_MD5` are enabled. + - fix tests to support build with`LIBSSH2_NO_MD5`, `LIBSSH2_NO_MD5_PEM` + and `LIBSSH2_NO_3DES`. + - add FIXME to apply this change to `os400qc3.*`. + + Old-style encrypted private keys require MD5 and they look like this: + ``` + -----BEGIN RSA PRIVATE KEY----- + Proc-Type: 4,ENCRYPTED + DEK-Info: AES-128-CBC, + + + -----END RSA PRIVATE KEY----- + ``` + + E.g.: `tests/key_rsa_encrypted` + + Ref: https://github.com/libssh2/www/issues/20 + Closes #1181 + +- cmake: tidy-up `foreach()` syntax + + Use `IN LISTS` and `IN ITEMS`. This appears to be the preferred way + within CMake's own source code and possibly improves readability. + + Fixup a side-effect of `IN LISTS`, where it retains empty values at + the end of the list, as opposed to the syntax used before, which + dropped it. In our case this happened with lines read from a text + file via `file(READ)`. + + https://cmake.org/cmake/help/v3.7/command/foreach.html + + Closes #1180 + +- ci: replace `mv` + `chmod` with `install` in `Dockerfile` + + Cherry-picked from #1175 + Closes #1175 + +- ci: set file mode early in `appveyor_docker.yml` + + Also: + - replace tab with spaces in generated config file + - formatting + + Cherry-picked from #1175 + +- ci: add spellcheck (codespell) + + Also rename a variable in `src/os400qc3.c` to avoid a false positive. + + Cherry-picked from #1175 + +- cmake: also test for `libssh2_VERSION` + + Cherry-picked from #1175 + +- cmake: show cmake versions in ci + + Cherry-picked from #1175 + +- tests: formatting and tidy-ups + + - Dockerfile: use standard sep with `sed` + - Dockerfile: use single quotes in shell command + - appveyor.yml: use long-form option with `choco` + - tests/cmake: add language to test project + - reuse.yml: fix indentation + ``` + $ yamllint reuse.yml + reuse.yml + [...] + 11:5 error wrong indentation: expected 6 but found 4 (indentation) + 15:5 error wrong indentation: expected 6 but found 4 (indentation) + [...] + 27:5 error wrong indentation: expected 6 but found 4 (indentation) + ``` + + Cherry-picked from #1175 + +- openssl.c: whitespace fixes + + Cherry-picked from #1175 + +- checksrc: fix spelling in comment [ci skip] + +- cmake: quote more strings + + Follow-up to 3fa5282d6284efba62dc591697e6a687152bdcb1 + + Closes #1173 + +- drop `www.` from `www.libssh2.org` + + is now a 301 permanent redirect to + . + + Update all references to point directly to the new destination. + + Ref: https://github.com/libssh2/www/commit/ccf4a7de7f702a8ee17e2c697bcbef47fcf485ed + + Closes #1172 + +- cmake: add `ExternalProject` integration test + + - via `ExternalProject_Add()`: + https://cmake.org/cmake/help/latest/module/ExternalProject.html + (as documented in `docs/INSTALL_CMAKE.md`) + + - also make `FetchContent` fetch from local repo instead of live master. + + Closes #1171 + +- cmake: add integration tests + + Add a small project to test dependent/downstream CMake build using + libssh2. Also added to the GHA CI, and you can also run it locally with + `tests/cmake/test.sh`. + + Test three methods of integrating libssh2 into a project: + - via `find_package()`: + https://cmake.org/cmake/help/latest/command/find_package.html + - via `add_subdirectory()`: + https://cmake.org/cmake/help/latest/command/add_subdirectory.html + - via `FetchContent`: + https://cmake.org/cmake/help/latest/module/FetchContent.html + + Closes #1170 + +- cmake: (re-)add aliases for `add_subdirectory()` builds + + Add internal libssh2 library aliases to make these available for + downstream/dependent projects building libssh2 via `add_subdirectory()`: + + - `libssh2:libssh2_static` + - `libssh2:libssh2_shared` + - `libssh2:libssh2` (shared, or static when not building shared) + - `libssh2` (shared, or static when not building shared) + + Of these, `libssh2` was present in v1.10.0 and earlier releases, but + missing from v1.11.0. + + Closes #1169 + +- cmake: delete empty line [ci skip] + + Follow-up to 3fa5282d6284efba62dc591697e6a687152bdcb1 + +- cmake: reflect minimum version in docs [ci skip] + + Follow-up to 9cd18f4578baa41dfca197f60557063cad12cd59 + +- cmake: style tidy up + + - quote text literals to improve readability. + (exceptions: `FILES` items, `add_subdirectory` names, `find_package` + names, literal target names, version numbers, 0/1, built-in CMake + values and CMake keywords, list items in `cmake/max_warnings.cmake`) + - quote standalone variables that could break syntax on empty values. + - replace `libssh2_SOURCE_DIR` with `PROJECT_SOURCE_DIR`. + - add missing mode to `message()` call. + - `TRUE`/`FALSE` → `ON`/`OFF`. + - add missing default value `OFF` to `option()` for clarity. + - unfold some lines. + - `INSTALL_CMAKE.md` fixes and updates. Show defaults. + + Closes #1166 + +- wincng: prefer `ULONG`/`DWORD` over `unsigned long` + + To match with the types used by the `Crypt*()` (uses `DWORD`) and + `BCrypt*()` (uses `ULONG`) Windows APIs. + + This patch doesn't change data width or signedness. + + Closes #1165 + +- wincng: tidy-ups + + - make `_libssh2_wincng_key_sha_verify` static. + + - prefer `unsigned long` over `size_t` in two static functions. + + - prefer `ULONG` over `DWORD` to match `BCryptImportKeyPair()` + and `BCryptGenerateKeyPair()`. + + - add a newline. + + Closes #1164 + +- ci: add MSYS builds (autotools and cmake) + + Use existing MSYS2 section and extend it with builds for the MSYS + environment with both autotools and cmake. + + MSYS builds resemble Cygwin ones: The env is Unixy, where Windows + headers are all available but we don't use them. + + Also: + + - extend existing autotools logic for Cygwin to skip detecting + `windows.h` for MSYS targets too. + + - require `windows.h` for the WinCNG backend in autotools. Before this + patch, autotools allowed selecting WinCNG on the Cygwin and MSYS + platforms, but the builds then fell apart due to the resulting mixed + Unixy + Windowsy environment. The general expectation for Cygwin/MSYS + builds is not to use the Windows API directly in them. + + - stop manually selecting the `MSYS Makefiles` CMake generator for + MSYS2-based GHA CI builds. mingw-w64 builds work fine without it, but + it broke MSYS build which use `Unix Makefiles`. Deleting this setting + fixes all build flavours. + + Closes #1162 + +- ci: cygwin job tidy-ups + + `CMAKE_C_COMPILER=gcc` not necessary, delete it. + + Follow-up to f1e96e733fefb495bc31b07f5c2a5845ff877c9c + + Cherry-picked from #1163 + Closes #1163 + +- ci: add Cygwin builds (autotools and cmake) + + To avoid builds picking up non-Cygwin components coming by default with + the CI machine, I used the solution recommended by Cygwin [1] and set + `PATH` manually. To avoid repeating this for each step, I merged steps + into a single one. Let us know if there is a more elegant way. + + Cygwin's Github Action uses cleartext HTTP. We upgrade this to HTTPS. + + autotools build seemed to take slightly longer than other jobs. To save + turnaround time I disabled building tests. + + Cygwin package search: https://cygwin.com/cgi-bin2/package-grep.cgi + + [1] https://github.com/cygwin/cygwin-install-action/tree/v4#path + + Closes #1161 + +- cmake: add `LIB_NAME` variable + + It holds the name `libssh2`. Mainly to document its uses, and also + syncing up with the same variable in libcurl. + + Closes #1159 + +- cmake: add one missed `PROJECT_NAME` variable + + Follow-up to 72fd25958a7dc6f8e68f2b2d5d72839a2da98f9c + + Closes #1158 + +- cmake: tidy-up concatenation in `CMAKE_MODULE_PATH` + + Former solution was appending an empty element to the array if + `CMAKE_MODULE_PATH` was originally empty. The new syntax doesn't have + this side-effect. + + There is no known issue caused by this. Fixing it for good measure. + + Closes #1157 + +- ci: add mingw-w64 UWP build + + Add a CI test for Windows UWP builds using mingw-w64. Before this patch + we had UWP builds tested with MSVC only. + + Alike existing UWP jobs, it's not possible to run the binaries due to + the missing UWP runtime DLL: + https://github.com/libssh2/libssh2/actions/runs/5821297010/job/15783475118#step:11:42 + + We could install `winstorecompat-git` in the setup-msys2 step, but opted + to do it manually to avoid the overhead for every matrix job. + + All this would work smoother with llvm-mingw, which features an UWP + toolchain prefix and provides all necessary implibs by default. + + This also hit a CMake bug (with v3.26.4), where CMake gets confused and + sets up `windres.exe` to use the MSVC rc.exe-style command-line: + https://github.com/libssh2/libssh2/actions/runs/5819232677/job/15777236773#step:9:126 + + Notice that MS "sunset" UWP in 2021: + https://github.com/microsoft/WindowsAppSDK/discussions/1615 + + If this particular CI job turns out to be not worth the maintenance + burden or CPU time, or too much of a hack, feel free to delete it. + + Ref: https://github.com/libssh2/libssh2/pull/1147#issuecomment-1670850890 + Closes #1155 + +- cmake: replace `libssh2` literals with `PROJECT_NAME` variable + + Where applicable. + + This also makes it more obvious which `libssh2` uses were referring + to the project itself. + + Closes #1152 + +- cmake: fix `STREQUAL` check in error branch + + This caused a CMake error instead of our custom error when manually + selecting the `WinCNG` crypto-backend for a non-Windows target. + + Also cleanup `STREQUAL` checks to use variable name without `${}` on + the left side and quoted string literals on the right. + + Closes #1151 + +- misc: flatten `_libssh2_explicit_zero` if tree + + Closes #1149 + +- src: drop a redundant `#include` + + We include `misc.h` via `libssh2_priv.h` already. + + Closes #1153 + +- openssl: use automatic initialization with LibreSSL 2.7.0+ + + Stop calling `OpenSSL_add_all_*()` for LibreSSL 2.7.0 and later. + + LibreSSL 2.7.0 (2018-03-21) introduced automatic initialization and + deprecated these functions. Stop calling these functions manually for + LibreSSL version that no longer need them. + + Ref: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.0-relnotes.txt + Ref: https://github.com/libressl/openbsd/commit/46f29f11977800547519ee65e2d1850f2483720b + Ref: https://github.com/libssh2/libssh2/issues/302 + + Also stop calling `ENGINE_*()` functions when initialization is + automatic with LibreSSL 2.7.0+ and OpenSSL 1.1.0+. Engines are also + initializated automatically with these. + + Closes #1146 + +- gha: restore curly braces in `if` + + Without curly braces it was less obvious which string is a GHA expression. + + Also fix an `if` expression that always missed its curly braces. + + Reverts cab3db588769d6deed97ba89ca9221fd7503405e + + Closes #1145 + +- ci: bump mbedtls + +- [renmingshuai brought this change] + + Add a new structure to separate memory read and file read. + We use different APIs when we read one private key from memory, + so it is improper to store the private key information in the + structure that stores the private key file information. + + Fixes https://github.com/libssh2/libssh2/issues/773 + Reported-by: mike-jumper + +- tests: replace FIXME with comments + + `key_dsa_wrong` is the same kind of (valid) key as `key_dsa`, both with + an empty passphrase. Named "wrong" because it's intentionally not added + to our `openssh_server/authorized_keys` file. + +- tidy-up: delete duplicate word from comment + +- cmake: cache more config values on Windows + + Set two cases of non-detection to save the time dynamically detecting + these on each build init. Affects old MSVC versions. + + Before: + https://ci.appveyor.com/project/libssh2org/libssh2/builds/47668870/job/i17e0e9yx8rgpv4i + + After: + https://ci.appveyor.com/project/libssh2org/libssh2/builds/47674950/job/ysa1jq0pxtyhui3f + + Closes #1142 + +- revert: build: respect autotools `DLL_EXPORT` in `libssh2.h` + + Revert fb1195cf88268a11e2709b9912ab9dca8c23739c #917 + + On a second look this change did not improve anything with autotools + builds. autotools seems to handle the dll export matter without it. + + This patch also broke (e.g.) curl-for-win autotools builds, where the + curl build defines `DLL_EXPORT` while building libcurl DLL. `libssh2.h` + picks it up, resulting in unresolved symbols while trying to link a + static libssh2 on Windows. The best fix seems to be to revert this, + instead of adding extra tweaks to dependents. + + Fixes: + https://ci.appveyor.com/project/curlorg/curl-for-win/builds/47667412#L11035 + ``` + ld.lld-15: error: undefined symbol: __declspec(dllimport) libssh2_session_block_directions + >>> referenced by vssh/.libs/libcurl_la-libssh2.o:(ssh_do) + >>> referenced by vssh/.libs/libcurl_la-libssh2.o:(ssh_connect) + >>> referenced by vssh/.libs/libcurl_la-libssh2.o:(ssh_multi_statemach) + >>> referenced 8 more times + + ld.lld-15: error: undefined symbol: __declspec(dllimport) libssh2_session_init_ex + >>> referenced by vssh/.libs/libcurl_la-libssh2.o:(ssh_connect) + + ld.lld-15: error: undefined symbol: __declspec(dllimport) libssh2_session_set_read_timeout + [...] + ``` + + Closes #1141 + +- gha: simplify `if` strings + + Closes #1140 + +- test_read: make it run without Docker + + Apply an existing fix to `test_read`, so that it falls back to use + the current username instead of the hardcoded `libssh2` when run + outside Docker. + + This allows to run algo tests with this command: + ```shell + cd tests + ./test_sshd.test ./test_read_algos.test + ``` + + Closes #1139 + +- cmake: streamline invocation + + Stop specifiying the current directory. + Simplify build instructions. + + Closes #1138 + +- NMakefile: delete + + This make file was for long time unmaintained (last updated in 2014). + Despite best efforts to keep it working in the recent round of major + overhauls, it appears to be broken now. There is also no way to test it + without an actual MSVC env and it's also missing from our CI. Based on + our Issue tracker, it's also not widely used. + + Since its addition in 2005, libssh2 got support for CMake in 2014. + CMake should be able to generate NMake makefiles with the option + `-G "NMake Makefiles"`. (I haven't tested this.) + + Ref: https://github.com/libssh2/libssh2/discussions/1129 + Closes #1134 + +- tests: add aes256-gcm encrypted key test + + Follow-up to #1133 + + Also update `tests/gen_keys.sh` to set `aes256-ctr` encryption method + for `key_ed25519_encrypted' explicitly. + + Closes #1135 + +GitHub (26 Jul 2023) +- [Jakob Egger brought this change] + + Fix private keys encrypted with aes-gcm methods (#1133) + + libssh2 1.11.0 fails to decrypt private keys encrypted with + aes128-gcm@openssh.com and aes256-gcm@openssh.com ciphers. + + To reproduce the issue, you can create a test key with a command like + the following: + + ```bash + ssh-keygen -Z aes256-gcm@openssh.com -f id_aes256-gcm + ``` + + If you attempt to use this key for authentication, libssh2 returns the + not-so-helpful error message "Wrong passphrase or invalid/unrecognized + private key file format". + + The problem is that OpenSSH encrypts keys differently than packets. It + does not include the length as AAD, and the 16 byte authentication tag + is appended after the encrypted key. The length of the authentication + tag is not included in the encrypted key length. + + I have not found any documentation for this behaviour -- I discovered it + by looking at the OpenSSH source. See the `private2_decrypt` function in + . + + This patch fixes the code for reading OpenSSH private keys encrypted + with AES-GCM methods. + +Viktor Szakats (26 Jul 2023) +- ci: add missing timeout to 'autotools distcheck' step + +- cmake: merge `set_target_properties()` calls + + Also rename variable `LIBSSH2_VERSION` to `LIBSSH2_LIBVERSION` in + context of lib versioning to avoid collision with another use. + + Closes #1132 + +- cmake: formatting [ci skip] + +- cmake: (re-)add zlib to `Libs.private` in `libssh2.pc` + + We mistakently added transitive zlib to `Requires.private` before, then + removed it. This patch re-adds zlib, but this time to `Libs.private`, + which is listing raw libs and should include transitive libs as well. + + Also add zlib when used as a direct dependency when zlib compression + support is enabled. + + Follow-up to ef538069a661a43134fe7b848b1fe66b2b43bdac + + Closes #1131 + +- cmake: formatting [ci skip] + +- cmake: use `wolfssl/options.h` for detection, like autotools + + Closes #1130 + +- build: stop requiring libssl from openssl + + libssh2 does not use or need the TLS/SSL library of OpenSSL. + It only needs libcrypto. + + Closes #1128 + +- cmake: add openssl libs to `Libs.private` in `libssh2.pc` + + Also to sync up with autotools-generated `libssh2.pc`, that + already added them. + + Closes #1127 + +- Makefile.mk: stop linking unused mbedtls libs + + Stop linking libmbedtls and libmbedx509 (similarly to autotools). + Only libmbedcrypto is necessary for libssh2. + +- cmake: bump minimum CMake version to v3.7.0 + + Fixes the warning below, which appeared in CMake v3.27.0: + ``` + CMake Deprecation Warning at CMakeLists.txt:39 (cmake_minimum_required): + Compatibility with CMake < 3.5 will be removed from a future version of + CMake. + + Update the VERSION argument value or use a ... suffix to tell + CMake that the project does not need compatibility with older versions. + ``` + + Bump straight up to v3.7.0 to sync up with the curl project: + https://github.com/curl/curl/blob/2900c29218d2d24ab519853589da84caa850e8c7/CMakeLists.txt#L64 + + CMake release dates: + v3.7.0 2016-11-11 + v3.5.0 2016-03-08 + v3.1.0 2014-12-17 + + Closes #1126 + +- build: tidy-up `libssh2.pc.in` variable names + + - prefix with `LIBSSH2_PC_` + + - match with the names of `pkg-config` values. + + - use the same names in autotools and CMake scripts. + + - use `LIBSSH2_VERSION` for the version number in autotools scripts, + to match the name used in CMake. + + Closes #1125 + +- libssh2.pc: re-add & extend support for static-only libssh2 builds + + Adapted for libssh2 from the curl commit message by James Le Cuirot: + + "A project built entirely statically will call `pkg-config` with + `--static`, which utilises the `Libs.private:` field. Conversely it will + not use `--static` when not being built entirely statically, even if + there is only a static build of libssh2 available. This will most + likely cause the build to fail due to underlinking unless we merge the + `Libs:` fields. + + Consider that this is what the Meson build system does when it generates + `pkg-config` files." + + This patch extends the above to `Requires:`, to mirror `Libs:` with + `pkg-config` package names. + + Follow-up to 1209c16d93cba3c5e0f68c12fa4a5049f49c00d8 #1114 + + Ref: https://github.com/libssh2/libssh2/pull/1114#issuecomment-1634334809 + Ref: https://github.com/curl/curl/commit/98e5904165859679cd78825bcccb52306ee3bb66 + Ref: https://github.com/curl/curl/pull/5373 + Closes #1119 + +GitHub (14 Jul 2023) +- [Nursan Valeyev brought this change] + + cmake: CMAKE_SOURCE_DIR -> PROJECT_SOURCE_DIR (#1121) + + Fixes compiling as dependency with FetchContent + + Co-authored-by: Viktor Szakats + +Viktor Szakats (14 Jul 2023) +- autotools: use comma separator in `Requires.private` of `libssh2.pc` + + In `Requires*:`, the documented name separator is comma. We already used + it in the CMake-generated `libssh2.pc`. Adjust the autotools-generated + one to use it too, instead of spaces. + + Ref: https://linux.die.net/man/1/pkg-config + Ref: https://gitlab.freedesktop.org/pkg-config/pkg-config/-/blob/d97db4fae4c1cd099b506970b285dc2afd818ea2/pkg-config.1 + + Closes #1124 + +- build: add/fix `Requires.private` packages in `libssh2.pc` + + - autotools was using `libwolfssl`. CMake left it empty. wolfSSL + provides `wolfssl.pc`. This patch sets `Requires.private: wolfssl` + with both build tools. + + - add `libgcrypt` to `Requires.private` with both autotools and CMake. + Ref: + https://github.com/gpg/libgcrypt/blob/e76e88eef7811ada4c6e1d57520ba8c439139782/src/libgcrypt.pc.in + Present since 2005-04-22: + https://github.com/gpg/libgcrypt/commit/32bf3f13e8b45497322177645bebf0b5d0c9cb8e + Released in v1.3.0 2007-05-04: + https://github.com/gpg/libgcrypt/releases/tag/libgcrypt-1.3.0 + + - also stop adding transitive `zlib` deps to `Requires.private`. + The referenced crypto package is adding it as nedded. + This makes deduplication of the list redundant, so stop doing it. + Follow-up to 2fc367900701e6149efc42bd674c4b69127756dd + + (`libssh2.pc` not tested as a project dependency.) + + Closes #1123 + +- cmake: tidy-ups + + - dedupe `Requires.private` in `libssh2.pc`. + `zlib` could appear on the list twice: + ``` + Requires.private: libssl,libcrypto,zlib,zlib + ``` + According to CMake docs `list(REMOVE_DUPLICATES ...)`, is supported by + our minimum required CMake version (and by earlier ones even): + https://cmake.org/cmake/help/v3.1/command/list.html#remove-duplicates + + - move `cmake_minimum_required()` to the top. + + - move `set(CMAKE_MODULE_PATH)` to the top. + + - delete duplicate `set(CMAKE_MODULE_PATH)`. + + - replace `CMAKE_CURRENT_SOURCE_DIR` with `PROJECT_SOURCE_DIR` in root + `CMakeLists.txt` for robustness. + + - replace `gcovr` option with long-form for readability/consistency. + + - rename `GCOV_OPTIONS` to `GCOV_CFLAGS`. These are C options we enable + when using gcov, not gcov tooling options. + + Closes #1122 + +- openssl: add missing check for `LIBRESSL_VERSION_NUMBER` before use + + Fixes: + ``` + openssl.h:101:5: warning: "LIBRESSL_VERSION_NUMBER" is not defined [-Wundef] + LIBRESSL_VERSION_NUMBER >= 0x3050000fL + ^ + ``` + + Ref: https://github.com/libssh2/libssh2/issues/1115#issuecomment-1631845640 + Closes #1117 + +- [Harmen Stoppels brought this change] + + Don't put `@LIBS@` in pc file + +- misc: delete redundant NULL check and assignment + + Follow-up to 724effcb47ebb713d3ef1776684b8f6407b4b6a5 #1109 + + Ref: https://github.com/libssh2/libssh2/pull/1109#discussion_r1246613274 + Closes #1111 + +- [renmingshuai brought this change] + + We should check whether *key_method is a NULL pointer instead of key_method + + Signed-off-by: renmingshuai + +GitHub (30 Jun 2023) +- [ren mingshuai brought this change] + + Add NULL pointer check for outlen before use (#1109) + + Before assigning a value to the outlen, we need to check whether it is NULL. + + Credit: Ren Mingshuai + +Viktor Szakats (25 Jun 2023) +- cmake: re-add `Libssh2:libssh2` for compatibiliy + lowercase namespace + + - add `libssh2:libssh2` target that selects the shared lib if built, + otherwise the static one. + + - re-add `Libssh2:libssh2` target for compatibility with v1.10.0 and + earlier. This is an alias for `libssh2:libssh2`. + + - keep `libssh2:libssh2_shared` and `libssh2_libssh2_static` targets. + + - allow using `find_package(libssh2)` in dependents as an alternative + to `find_package(Libssh2)`. + + Co-authored-by: Radek Brich + Suggested-by: Haowei Hsu + + Fixes #1103 + Fixes #731 + Closes #1104 + +- example: fix regression in `ssh2_exec.c` + + Regression from b13936bd6a89993cd3bf4a18317ca5bd84bb08d7 #861 #846. + Update a variable name missed above. + + Reported-by: PewPewPew + Fixes #1105 + Closes #1106 + +- docs: replace SHA1 with SHA256 in CMake example + +- checksrc: modernise perl file open + + Use regular variables and separate file open modes from filenames. + + Suggested by perlcritic + + Copied from https://github.com/curl/curl/commit/7f669aa0f1d40ef5d64543981f22bdc5af1272f5 + Copied from https://github.com/curl/trurl/commit/f2784a9240f47ee28a845 + +- reuse: comply with 3.1 spec and 2.0.0 checker + + The checker tool was upgraded upstream to 2.0.0 and the REUSE + Specification to version 3.1 (from 3.0), causing these new errors: + ``` + reuse.project - WARNING - Copyright and licensing information for 'docs/INSTALL_AUTOTOOLS' have been found in 'docs/INSTALL_AUTOTOOLS' and the DEP5 file located at '.reuse/dep5'. The information in the DEP5 file has been overridden. Please ensure that this is correct. + reuse.project - WARNING - Copyright and licensing information for 'tests/openssh_server/Dockerfile' have been found in 'tests/openssh_server/Dockerfile' and the DEP5 file located at '.reuse/dep5'. The information in the DEP5 file has been overridden. Please ensure that this is correct. + + The following files have no licensing information: + * docs/INSTALL_AUTOTOOLS + * tests/openssh_server/Dockerfile + ``` + Via: https://github.com/libssh2/libssh2/actions/runs/5333572682/jobs/9664211341?pr=1098#step:4:4 + + Ref: https://github.com/fsfe/reuse-tool/releases/tag/v2.0.0 + Ref: https://git.fsfe.org/reuse/docs/src/branch/stable/CHANGELOG.md#3-1-2023-06-21 + + Original discovery: https://github.com/libssh2/libssh2/pull/1098#issuecomment-1600719575 + + Fixes #1101 + Closes #1102 + +- tests: trap signals in scripts + + Closes #1098 + +- test_sshd.test: fixup to distcheck failure + + Fixes: + ``` + ERROR: test_sshd.test - missing test plan + ERROR: test_sshd.test - exited with status 1 + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/5322354271/jobs/9638694218#step:10:532 + + Caused by trying to create the log file in a read-only directory. + + Follow-up to 299c2040625830d06ad757d687807a166b57d6de + Closes #1099 + +GitHub (21 Jun 2023) +- [Viktor Szakats brought this change] + + test_sshd.test: show sshd and test connect logs on harness failure (#1097) + +- [Joel Depooter brought this change] + + Fix incorrect byte offset in debug message (#1096) + + Fixes debug log message + + Credit: + Joel Depooter + +Viktor Szakats (16 Jun 2023) +- tidy-up: delete whitespace at EOL [ci skip] + +- mbedtls: include `version.h` for `MBEDTLS_VERSION_NUMBER` + + Older (2021 or earlier?) mbedTLS releases require this. + + Reported-by: rahmanih on Github + Fixes #1094 + Closes #1095 + +- hostkey: do not advertise ssh-rsa when SHA1 is disabled + + Before this patch OpenSSL, mbedTLS, WinCNG and OS/400 advertised both + SHA2 and SHA1 host key algos, even when SHA1 was not supported by the + crypto backend or when forcefully disabled via `LIBSSH2_NO_RSA_SHA1`. + + Reported-by: João M. S. Silva + Fixes #1092 + Closes #1093 + +- openssl.h: whitespace tidy-up [ci skip] + +GitHub (14 Jun 2023) +- [Dan Fandrich brought this change] + + test_sshd.test: set a safe PID directory (#1089) + + The compiled in default to sshd can be a non-writable location since it + expects to be run as root. + +Viktor Szakats (13 Jun 2023) +- mingw: fix printf mask for 64-bit integers + + Before 02f2700a61157ce5a264319bdb80754c92a40a24 #846 #876, we used + `%I64d'. That patch changed this to `%lld`. This patch uses `PRId64` + (defined in `inttypes.h`). + + Fixes #1090 + Closes #1091 + +- test_sshd.test: minor cleanups + +Daniel Stenberg (7 Jun 2023) +- provide SPDX identifiers + + - All files have prominent copyright and SPDX identifier + - If not embedded in the file, in the .reuse/dep5 file + - All used licenses are in LICENSES/ (not shipped in tarballs) + - A new REUSE CI job verify that all files are OK + + Assisted-by: Viktor Szakats + + Closes #1084 + +Viktor Szakats (6 Jun 2023) +- src: improve MSVC C4701 warning fix + + Simplify the code to avoid this warning. This might also help avoiding + it with other compilers (e.g. gcc?). + + Improves 02f2700a61157ce5a264319bdb80754c92a40a24 #876 + Might fix #1083 + Closes #1086 + +Daniel Stenberg (5 Jun 2023) +- configure.ac: remove AB_INIT + + Not used. Remove m4/autobuild.m4 as well + +Viktor Szakats (4 Jun 2023) +- copyright: remove years from copyright headers + + Also: + - uppercase `(C)`. + - add missing 'All rights reserved.' lines. + - drop duplicate 'Author' lines. + - add copyright headers where missing. + - enable copyright header check in checksrc. + + Reasons for deleting years (copied as-is from curl): + - they are mostly pointless in all major jurisdictions + - many big corporations and projects already don't use them + - saves us from pointless churn + - git keeps history for us + - the year range is kept in COPYING + + Closes #1082 + +- tests: cast to avoid `-Wchar-subscripts` with Cygwin + + ``` + In file included from $HOME/src/cygwin/libssh2/libssh2-1.11.0-1.x86_64/src/libssh2-1.11.0/tests/openssh_fixture.c:57: + $HOME/src/cygwin/libssh2/libssh2-1.11.0-1.x86_64/src/libssh2-1.11.0/tests/openssh_fixture.c: In function 'run_command_varg': + $HOME/src/cygwin/libssh2/libssh2-1.11.0-1.x86_64/src/libssh2-1.11.0/tests/openssh_fixture.c:136:37: warning: array subscript has type 'char' [-Wchar-subscripts] + 136 | while(end > 0 && isspace(buf[end - 1])) { + | ~~~^~~~~~~~~ + ``` + Ref: https://github.com/libssh2/libssh2/files/11644340/cygwin-x86_64-libssh2-1.11.0-1-check.log + + Reported-by: Brian Inglis + Fixes #1080 + Closes #1081 + +- tidy-up: avoid exclamations, prefer single quotes, in outputs + + Closes #1079 + +- autotools: improve libz position + + We repositioned crypto libs in 4f0f4bff5a92dce6a6cd7a5600a8ee5660402c3f + via #941 and subsequently in d4f58f03438e326b8696edd31acadd6f3e028763 + from d93ccf4901ef26443707d341553994715414e207 via #1013. + + This patch moves libz accordingly, to unbreak certain build scenarios. + + Reported-by: Kenneth Davidson + Regression from 4f0f4bff5a92dce6a6cd7a5600a8ee5660402c3f #941 + Fixes #1075 + Closes #1077 + +- src: bump `hash_len` to `size_t` in `LIBSSH2_HOSTKEY_METHOD` + + Follow-up to 7b8e02257f01a6dac5f65305b18bb74a157fb5c4 + Closes #1076 + +- ci: add non-static autotools i386 build, ignore GHA updates on AppVeyor + + Add a non-static autotools build to GitHub Actions. Make this build + target i386 and libgcrypt, to test a new build combination if we are at + it. + + Also: + - GHA: add necessary generic bits for i386 autotools builds. + - AppVeyor CI: teach it to ignore commits updating our GHA config. + + Follow-up to 572c57c9d8d4e89cfce19dde40125d55481256d1 #1072 + Closes #1074 + +GitHub (31 May 2023) +- [Xi Ruoyao brought this change] + + autotools: skip tests requiring static lib if `--disable-static` (#1072) + + Co-authored-by: Viktor Szakats + Regression from 83853f8aea0e2f739cacd491632eb7fd3d03ad2d #663 + Fixes #1056 + +Viktor Szakats (31 May 2023) +- ci: prefer `=` operator in shell snippets + + Closes #1073 + +- src: bump DSA and ECDSA sign `hash_len` to `size_t` + + Closes #1055 + +- scp: fix missing cast for targets without large file support + + E.g. on 32-bit Linux. Issue revealed after adding i386 Linux CI build + in abdf40c741c575f94bdea1c67a9d1182ff813ccb #1057. + + ``` + /home/runner/work/libssh2/libssh2/src/scp.c: In function 'scp_recv': + /home/runner/work/libssh2/libssh2/src/scp.c:765:23: error: conversion from 'libssh2_int64_t' {aka 'long long int'} to '__off_t' {aka 'long int'} may change value [-Werror=conversion] + 765 | sb->st_size = session->scpRecv_size; + | ^~~~~~~ + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/5126803482/jobs/9221746299?pr=1054#step:12:51 + + Regression from 5db836b2a829c6fff1e8c7acaa4b21b246ae1757 #1002 + Closes #1060 + +- mbedtls.h: formatting [ci skip] + + For consistency with `mbedtls.c`. + + Follow-up to 1153ebdeba563ac657b525edd6bf6da68b1fe5e2 + +- libssh2.h: bump to 1.11.1_DEV [ci skip] + +- mbedtls: use more `size_t` to sync up with `crypto.h` + + Ref: 5a96f494ee0b00282afb2db2e091246fc5e1774a #846 #879 + + Fixes #1053 + Closes #1054 + +- ci: drop redundant/unused vars, sync var names + + Closes #1059 + +- ci: add i386 Linux build (with mbedTLS) + + Also: + - reorder Linux build matrix to make build tool more visible. + - hide apt-get progress bar. + - prepare package install step for i386 builds. + + Detects bug #1053 + Closes #1057 + +- checksrc: switch to dot file + + Closes #1052 + +Version 1.11.0 (30 May 2023) + +Daniel Stenberg (30 May 2023) +- libssh2.h: bump to 1.11.0 for release + +GitHub (30 May 2023) +- [Will Cosgrove brought this change] + + Libssh2 1.11 release notes, copyright (#1048) + + * Libssh2 1.11 release notes, copyright + +Viktor Szakats (29 May 2023) +- add copyright/credits + + Closes #1050 + +- ci: add LIBSSH2_NO_AES_CBC to GNU Make build + + Closes #1049 + +- ci: add wolfSSL Linux builds + + Exclude wolfSSL builds from tests. All fail: + + ``` + 2/43 Test #2: test_aa_warmup ............................***Failed 5.59 sec + libssh2_session_handshake failed (-44): Unable to ask for ssh-userauth service + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/5085775952/jobs/9139583212#step:12:942 (with logging) + Ref: https://github.com/libssh2/libssh2/actions/runs/5085586301/jobs/9139192562#step:12:225 + + wolfSSL version: + ``` + Get:1 http://azure.archive.ubuntu.com/ubuntu jammy/universe amd64 libwolfssl32 amd64 5.2.0-2 [818 kB] + Get:2 http://azure.archive.ubuntu.com/ubuntu jammy/universe amd64 libwolfssl-dev amd64 5.2.0-2 [1194 kB] + ``` + + Cherry-picked from #1046 + Closes #1046 + +- ci: mbedTLS build config tidy-up + + Cherry-picked from #1046 + +- wolfssl: fix detection of AES-GCM feature + + Follow-up to df513c0128e1a811ad863d153892618e728845f0 + + Ref: https://github.com/libssh2/libssh2/issues/1020#issuecomment-1562069241 + Closes #1045 + +- build: fix 'unused' compiler warnings with all `NO` options set + + - add `LIBSSH2_NO_ED25519` build-time option to force-disable ED25519 + support. Useful to replicate crypto-backend builds without ED25519, + such as wolfSSL. + + - openssl: fix unused variable and function warnings with all supported + `LIBSSH2_NO_*` options enabled. + + - mbedtls: fix misplaced `#endif` leaving out the required internal + public function `libssh2_supported_key_sign_algorithms()`. + + - mbedtls: add missing prototype for two internal public functions. + + - delete a redundant block. + + All `NO` options: + ```shell + CPPFLAGS=' + -DLIBSSH2_NO_MD5 -DLIBSSH2_NO_HMAC_RIPEMD -DLIBSSH2_NO_DSA + -DLIBSSH2_NO_RSA -DLIBSSH2_NO_RSA_SHA1 + -DLIBSSH2_NO_ECDSA -DLIBSSH2_NO_ED25519 -DLIBSSH2_NO_AES_CTR + -DLIBSSH2_NO_BLOWFISH -DLIBSSH2_NO_RC4 -DLIBSSH2_NO_CAST + -DLIBSSH2_NO_3DES' + ``` + + Closes #1044 + +- cmake: avoid `list(PREPEND)` for compatibility + + `list(PREPEND)` requires CMake v3.15, our minimum is v3.1. `APPEND` + should work fine for headers anyway. + + Also fix a wrongly placed comment. + + Ref: https://cmake.org/cmake/help/latest/command/list.html#prepend + + Regression from 1e3319a167d2f32d295603167486e9e88af9bb4e + + Closes #1043 + +- checksrc: verify label indent, fix fallouts + + Also update two labels to match the rest of the source. + + checksrc update credit: Emanuele Torre @emanuele6 + + Ref: https://github.com/curl/curl/pull/11134 + + Closes #1042 + +- tidy-up: minor nits + +- ci: drop default shared/static configuration options + + Both autotools and cmake build both shared and static lib by default. + + Ref: 896154bc17f000c0a1bb89b74bc879692ac0d47c + + Delete configuration enabling these explicitly in CI jobs. + + Cherry-picked from #1036 + Closes #1036 + +- cmake: enable shared libssh2 library by default + + This brings default behaviour in sync with autotools, which builds both + lib flavours by default. + + (Notice that on Windows, autotools includes the Windows Resource in the + static library, when building both at the same time. CMake doesn't have + this issue.) + + Enabling both lib flavours has a side-effect when using non-MinGW + toolchains (e.g. MSVC): to resolve the filename conflict between import + and static libraries, we add a suffix to the static lib, naming it + `libssh2_static.lib`. This can break dependent builds relying on + `libssh2.lib` for linking the static libssh2. + + Workarounds: + + - disable either shared or static libssh2 via + `-DBUILD_STATIC_LIBS=OFF` or + `-DBUILD_SHARED_LIBS=OFF`. This results in a libssh2 library (either + static or shared) without a prefix: `libssh2.lib`. + + - set a custom static library suffix via: + `-DSTATIC_LIB_SUFFIX=_my_static`. Resulting in + `libssh2_my_static.lib`, and import library + `libssh2.lib`. + + - set a custom import library suffix via: + `-DIMPORT_LIB_SUFFIX=_my_implib`. Resulting in + `libssh2_my_implib.lib` import library, and static library + `libssh2.lib`. + + - customize the default static/import library suffix (incl. extension) + via + `-DCMAKE_STATIC_LIBRARY_SUFFIX=_my_static_suffix.lib` or + `-DCMAKE_IMPORT_LIBRARY_SUFFIX=_my_import_suffix.lib`. + + Cherry-picked from #1036 + +- cmake: tweak static/import lib name collision avoidance logic + + The collision issue affects (typically) MSVC, when building both shared + and static libssh2 in one go. + + Ref: https://stackoverflow.com/questions/2140129/what-is-proper-naming-convention-for-msvc-dlls-static-libraries-and-import-libr + + Initially we handled this by appending the `_imp` suffix to the import + library filename. This is how curl tackles this, but on a second look, + this solution seem to be accidental and has no widespread use. + + It seems more widely accepted to use the '_static' suffix for the static + library. This patch implements this. + + (MinGW, Cygwin and unixy platforms are not affected by this issue.) + + Follow-up to 4e2580628dd1f8dc51ac65ac747ebcf0e93fa3d1 + + Cherry-picked from #1036 + +- cmake: add `IMPORT_LIB_SUFFIX` (like `STATIC_LIB_SUFFIX`) + + Allow resolving the import/static library name collision also by setting + a custom _import_ library name suffix. + + Follow-up to 4e2580628dd1f8dc51ac65ac747ebcf0e93fa3d1 + + Cherry-picked from #1036 + +- ci: do not disable shared lib with msys2/autotools in GHA + + Cherry-picked from #1036 + +- Makefile.mk: fix `DYN=1 test` by skipping tests needing static lib + + `DYN=1` means to build examples/tests against the shared libssh2. + + Before this patch this was broken for building tests. This patch skips + building tests that require the static libssh2 library, so the build now + succeeds. + + Also move the list of tests that require static lib from + `CMakeLists.txt` to `Makefile.inc`, so that we can reuse it in + `Makefile.mk`. + + Couldn't find a way to also reuse it in `Makefile.am`. Move the + `Makefile.am` specific definitions close to the shared list, to make it + easier to keep them synced. + + Cherry-picked from #1036 + +- ci: make one of the AppVeyor CMake jobs shared-only + + This build combination did not have a CI test before. + + Cherry-picked from #1036 + +- cmake: allow tests with `BUILD_STATIC_LIBS=OFF` + + Before this patch, the CMake build did not allow to disable static + libssh2 library while also building tests. + + This patch removes this constraint, and makes this combination possible. + In this case the 3 (at the moment) tests that require a static libssh2 + library, are skipped from the build and test runs. + + Cherry-picked from #1036 + +- build: fix to set `-DLIBSSH2DEBUG` for tests + + Required for tests using libssh2 internals. These are the ones + requiring the libssh2 _static_ lib. + + Before this patch, `src` and `tests` declared the `session` structure + differently, due to extra struct members added with the `LIBSSH2DEBUG` + macro set. But, the macro was only set for `src` when using CMake. At + runtime this caused struct members to be at different offsets between + lib and test code, resulting in the test failures below. + + Due to another bug in the affected test, these failures did not reflect + in the exit code, which always returned success, so this went unnoticed + for a good while. Fixed in: 84d31d0ca7b647ad4c2aa92bf8f4a94b233f5d3b + + ``` + Start 5: test_auth_keyboard_info_request + [...] + 5: Test case 1 passed + 5: Test case 2 passed + 5: Test case 3: expected return code to be 0 got -1 + 5: Test case 4: expected last error code to be "-6" got "-38" + 5: Test case 5: expected last error code to be "-6" got "-38" + 5: Test case 6: expected last error code to be "-6" got "-38" + 5: Test case 7: expected last error message to be "Unable to decode keyboard-interactive number of keyboard prompts" got "userauth keyboard data buffer too small to get l + 5: Test case 8: expected last error code to be "-41" got "-38" + 5: Test case 9: expected return code to be 0 got -1 + 5: Test case 10: expected return code to be 0 got -1 + 5: Test case 11: expected last error code to be "-6" got "-38" + 5: Test case 12: expected last error message to be "Unable to decode user auth keyboard prompt echo" got "userauth keyboard data buffer too small to get length" + 5: Test case 13: expected return code to be 0 got -1 + 5: Test case 14: expected return code to be 0 got -1 + 5: Test case 15: expected last error code to be "-6" got "-38" + 5: Test case 16: expected last error code to be "-6" got "-38" + 5: Test case 17: expected last error code to be "-6" got "-38" + 5: Test case 18: expected last error code to be "-6" got "-38" + ``` + Ref: https://ci.appveyor.com/project/libssh2org/libssh2/builds/46925869/job/i9uasceu3coss0i2#L440 + Ref: https://ci.appveyor.com/project/libssh2org/libssh2/builds/46983040/job/c3vag25c26a77lyr#L485 + + Cherry-picked from #1037 + Closes #1037 + +- test_auth_keyboard_info_request: fix to return failure + + Before this patch, this test returned success even when one of its tests + failed. Fix it by returning 1 in case any of the tests fails. + + This issue masked a CMake build bug with logging enabled. Subject to an + upcoming patch. + + Cherry-picked from #1037 + +- test_auth_keyboard_info_request: fix indentation + + Cherry-picked from #1037 + +- tidy-up: move comment off from copyright header + + Cherry-picked from #1037 + +- ci: enable shared libs in msys2/macOS cmake builds + + Shared libs improve example/tests build times. For "unity" + builds the overhead of building shared lib is negligible, so + this even reduced the overall build-time. + + Follow-up to 3d64a3f5100f7f4cf52202396eb4f1c3f3567771 + Follow-up to d93ccf4901ef26443707d341553994715414e207 + + Tests: + https://github.com/libssh2/libssh2/actions/runs/4906586658: unity builds enabled + https://github.com/libssh2/libssh2/actions/runs/4906925743: unity builds enabled + parallel msys2 builds + https://github.com/libssh2/libssh2/actions/runs/4906777629: unity + shared lib (this commit) + https://github.com/libssh2/libssh2/actions/runs/4906927190: unity + shared lib (this commit) + parallel msys2 builds + + Consider making shared libs enabled by default also in CMake, to sync it with autotools? + + Closes #1035 + +- ci: add missed --parallel 3 from msys2 cmake builds + + Follow-up to 3d64a3f5100f7f4cf52202396eb4f1c3f3567771 + +- cmake: add and test "unity" builds + + "Unity" (aka "jumbo", aka "amalgamation" builds concatenate source files + before compiling. It has these benefits for example: faster builds, + improved code optimization, cleaner code. Let's support and test this. + + - enable unity builds for some existing CI builds to test this build + scenario. + - tune `UNITY_BUILD_BATCH_SIZE` size. + - disable unity build for example and test programs (they use one source + each already). + + You can enable it by passing `-DCMAKE_UNITY_BUILD=ON` to cmake. + Supported by CMake 3.16 and newer. + + Ref: https://cmake.org/cmake/help/latest/prop_tgt/UNITY_BUILD.html + + Closes #1034 + +- tests: simplify passing `srcdir` to tests + + Before this patch libssh2 used a variety of solutions to pass the source + directory to tests: `FIXTURE_WORKDIR` build-time macro (cmake), + `FIXTURE_WORKDIR` envvar (unused), setting `srcdir` manually + (autotools), setting current directory (cmake), and also `builddir` + envvar (autotools) for passing current working dir to `mansyntax.sh`. + + This patch reduces this to using existing `srcdir` with autotools and + setting it ourselves in CMake. This was mostly enabled by this recent + patch: 4c9ed51f962f542b98789b15bedaaa427f4029a2 + + Details: + + - cmake: replace baked-in `FIXTURE_WORKDIR` macro with env. + + Added in 54bef4c5dad868a9d45fdbfca9729b191c0abab5 #198 (2018-03-21) + + - rename `FIXTURE_WORKDIR` to `srcdir`, to match autotools. + + - cmake: add missing `srcdir` for algo and sshd tests. + + - session_fixture: stop `chdir()`-ing, rely on prefixing with `srcdir`. + + Changing current directory should be unnecessary after + 4c9ed51f962f542b98789b15bedaaa427f4029a2 #801 (2023-02-24), + that prefixes referenced input filenames with the `srcdir` envvar. + + The `srcdir` envvar was already exported by autotools, and now we're + also setting it from CMake. + + - cmake: stop setting `WORKING_DIRECTORY`, rely on `srcdir` env. + + `WORKING_DIRECTORY` is no longer necessary, after passing `srcdir` to + all tests, so they can find our source tree and keys/etc in it + regardless of the current directory. + + Also this past commit hints that `WORKING_DIRECTORY` wasn't always + working for this purpose as expected: + "tests: Xcode doesn't obey CMake's test working directory" + Ref: https://github.com/libssh2/libssh2/pull/198/commits/10a5cbf945abcc60153ee3d59284d09fc64ea152 + + - autotools: delete explicit `srcdir` for test env. + + Added in 13f8addd1bc17e6c55d52491cc6304319ac38c6d (2015-07-02) + + automake documents `srcdir` as exported to the test environment: + https://github.com/autotools-mirror/automake/blob/c04c4e8856e3c933239959ce18e16599fcc04a8b/doc/automake.texi#L9302-L9304 + https://www.gnu.org/software/automake/manual/html_node/Scripts_002dbased-Testsuites.html + It's mentioned in the docs back in 1997 and got a regression test in + 2012. We can safely assume it to be available without setting it + ourselves. + + - autotools: delete explicit `builddir`. + + Added in 13f8addd1bc17e6c55d52491cc6304319ac38c6d (2015-07-02) + + It seems this wasn't necessary to make the above fix work, and + `mansyntax.sh` is able to figure out the build workdir by reading + `$PWD`. Our out-of-tree and `make distcheck` CI builds also work + without it. + + Let us know if there is a scenario we're missing and needs this. + + Closes #1032 + +- src: fix `libssh2_store_*()` for >u32 inputs + + `_libssh2_store_str()` and `_libssh2_store_bignum2_bytes()` accept + inputs of `size_t` max, store the size as 32-bit unsigned integer, then + store the complete input buffer. + + With inputs larger than `UINT_MAX` this means the stored size is smaller + than the data that follows it. + + This patch truncates the stored data to the stored size, and now returns + a boolean with false if the stored length differs from the requested + one. Also add `assert()`s for this condition. + + This is still not a correct fix, as we now dump consistent, but still + truncated data which is not what the caller wants. In future steps we'll + need to update all callers that might pass large data to this function + to check the return value and handle an error, or make sure to not call + this function with more than UINT_MAX bytes of data. + + Ref: c3bcdd88a44c4636818407aeb894fabc90bb0ecd (2010-04-17) + Ref: ed439a29bb0b4d1c3f681f87ccfcd3e5a66c3ba0 (2022-09-29) + + Closes #1025 + +- cmake: limit WinCNG to Windows + + After deleting the `bcrypt.h` check, no check remained. Restore + a `WIN32` check here to ensure WinCNG is not enabled outside Windows. + + Follow-up to 1289033598546ee5089ff0fc4369d24e1e2be81f + + Tested-in #1032 + +- cmake: move `CMAKE_VS_GLOBALS` setting to CI configs + + To not force this setting for local builds where they might serve + a good purpose. + + It makes our CI runs slightly faster and we don't need to track + file changes in unattended, single, CI runs. + + Cherry-picked from #1031 + +- cmake: prefill for faster config phase on Windows + + Prefill known detection results on Windows with MinGW and MSVC, to + avoid spending time on detecting these on every cmake configuration + run. + + With MinGW + clang and MSVC, this elminates all detections. + With MinGW + gcc, it reduces them to 3. + + Cherry-picked from #1031 + +- libssh2_setup.h: set `HAVE_INTTYPES_H` for MSVC + + To sync up the hand-crafted config with actual detection results + by CMake and autotools. Sources compiled fine without it anyway. + + Cherry-picked from #1031 + +- cmake: re-add `select()` detection (regression) + + `select()` detection suffered two regressions: First I accidentally + deleted it for non-Windows [1]. Then the Windows-specific setting got + missed from the generated `libssh2_config.h` after a rearrangement in + `CMakeLists.txt` files. + + [1] 31fb8860dbaae3e0b7d38f2a647ee527b4b2a95f (2023-03-07) + [2] 803f19f004eb6a5b525c48fff6f46a493d25775c (2023-04-18) + + This patch restores detection. For Windows, enable it unconditionally, + not only for speed reasons, but because detection needs `ws2_32`, and + even that is broken on the x86 platform. According to the original + `cmake/SocketLibraries.cmake`, caused by a calling convention mismatch. + FWIW autotools detects it correctly. + + Cherry-picked from #1031 + +- ci: merge make job into msys2 section, enable zlib + openssl + + Follow up to dd625766271a0ba13f5ac661bdc2fa40bbfa580a + + Cherry-picked from #1030 + +- ci: add missing timeouts for autotools tests + + Cherry-picked from #1030 + +- ci: add mingw-w64 clang and gcc CMake jobs + + Cherry-picked from #1030 + +- cmake: assume `bcrypt.h` with WinCNG + + autotools already didn't check for `bcrypt.h`, and such check is only + required for old/legacy mingw without obsolete/incomplete Windows + headers. + + curl deprecated old-mingw support just recently and will delete support + in September 2023. + + This patch saves some complexity and detection time by dropping this + check for CMake. Meaning that mingw-w64 is now required to compile + libssh2 when using the WinCNG backend for 32-bit builds. Other backends + and CPU platforms are not affected. + + Ref: https://github.com/curl/curl/commit/e4d5685cb5d6eb07e1b43156fd7e3ba3563afba5 + + Closes #1026 + +- cmake: do not check for `poll()` on Windows + + While it seems to exist on mingw in theory, it's not detected as of this + writing. It also has issues, and not ready for production use: + https://stackoverflow.com/questions/1671827/poll-c-function-on-windows + + On MSVC it's even less supported. + + Skip checking this to save CMake detection time. + + Closes #1027 + +- agent_win: make a struct static and other build improvements + + Also: + - merge back `agent.h` into `agent.c` where it was earlier. + Ref: c998f79384116e9f6633cb69c2731c60d3a442bb + - introduce `HAVE_WIN32_AGENT` internal macro. + - fix two guards to exclude more code unused in UWP builds. + + Follow-up to 1c1317cb768688eee0e5496c72683190aaf63b29 + + Closes #1028 + +- tidy-up: formatting nits + + Whitespace and redundant parenthesis in `return`s. + + Closes #1029 + +GitHub (3 May 2023) +- [Nick Woodruff brought this change] + + sftp: parse attribute extensions, if present, to avoid stream parsing errors (#1019) + + Prevents directory listing errors when attribute extensions are present + by advancing stream parsing past extensions. + +Viktor Szakats (3 May 2023) +- tests: merge `sshd_fixture.sh` into `test_sshd.test` + + Merge the loop executing multiple tests and the script that actually + launches the tests into a single script. This same script is now called + from both autotools and CMake. autotools loads the list of tests from + `Makefile.inc`, CMake passes it via the command-line. It's also possible + to call the script manually with a custom list of tests or individual + ones. + + With this setup we're now launching a single sshd session for all tests, + instead of launching and killing it for each test. This did not improve + reliability of these test on CI machines, and it's easy to go back to + the previous behaviour if necessary. + + Also: + + - allow passing custom sshd options via `SSHD_FLAGS`. + + - add `SSHD_TESTS_LIMIT_TO` to limit the number of tests to its value. + E.g. `SSHD_TESTS_LIMIT_TO=1` executes the first test only. Meant for + debugging. + + - use `ssh` to test the connection (if available) instead of fixed + amount of wait. Made to also work on Windows. + + - set `PermitRootLogin yes` in `sshd`, to allow running tests as root. + + - show `sshd` path and version. + + Cherry-picked from #1017 (the last one) + Closes #1024 + +- ci: make sure to run tests after all builds in GHA + + Whenever possible. Due to flakiness/hangs/timeouts, keep sshd + tests disabled on Windows and macOS. + + Also keep Docker tests disabled on these platforms, they do not work: + + GHA Windows: + ``` + no matching manifest for windows/amd64 in the manifest list entries + ``` + + GHA macOS: + ``` + sh: docker: command not found + ``` + + It's not possible to run UWP and ARM64 binaries: + UWP: + ``` + Test #2: test_simple ......................Exit code 0xc0000135 + ``` + Needs but doesn't find: `VCRUNTIME140_APP.dll`. + + ARM64 + ``` + D:/a/libssh2/libssh2/bld/tests/Release/test_ssh2.exe: cannot execute binary file: Exec format error + ``` + + Cherry-picked from #1017 + +- tests: disable sshd tests on Windows via new options + + Instead of using hacks inside the build systems. + + `SSHD` variable added to GitHub Actions is not currently used. + Added there to make it easy to experiment with these tests and + the path is non-trivial to discover. Using the Windows built-in + sshd server is another option (haven't discovered its path yet). + + Cherry-picked from #1017 + +- tests: add cmake/autotools options to disable running tests + + autotools: + - `--disable-docker-tests` + - `--disable-sshd-tests` + + cmake: + - `RUN_DOCKER_TESTS` + - `RUN_SSHD_TESTS` + + Update automake and ci to use this new flag and delete former logic + of relying on Windows detection and `HOST_WINDOWS`. Also fix honoring + this when running `test_read_algos.test`. + + This allows to disable these individually and on per-CI/local-job basis. + To run as much tests as the env allows. + + Cherry-picked from #1017 + +- ci: add `make distcheck` job + + Cherry-picked from #1017 + +- ci: switch to out-of-tree autotools builds + + Cherry-picked from #1017 + +- ci: restore parallel builds with cmake + + Also add missing -j3 for macOS builds. + + Partial revert of 0d08974633cfc02641e6593db8d569ddb3644255 + + Cherry-picked from #1017 + +- ci: sync names, steps, syntax, build dirname between jobs + + Also: + + - delete an unused 64-bit option for Linux (all jobs are 64-bit). + + - fix to not install libgcrypt and openssl when doing mbedTLS builds. + + [ Empty lines after multiline run commands are solely to unbreak + my editor's syntax highlighting. They can be deleted in the future ] + + Cherry-picked from #1017 + +- ci: add `Makefile.mk` test, with `LIBSSH2_NO_*` options + + Cherry-picked from #1017 + +- Makefile.mk: use Makefile.inc from example and tests + + Instead of assembling the list using `$(wildcard ...)`. + + Also split off a `tests/Makefile.inc` from `tests/Makefile.am`. With its + simpler syntax, this also allows to delete some complexity from the + CMake loader. + + Cherry-picked from #1017 + +- example, tests: fix ssh2 to correctly return failure + + Before this patch ssh2 and test_ssh2 returned success even if the session + failed at `libssh2_session_handshake()` or after. + + This patch depends on cda41f7cb87c3af5258ba48ccef19d3efdbd3d3b, that fixed + running test_ssh2 on Windows via sshd_fixture. + + Cherry-picked from #1017 + +- tests: set -e -u in shell scripts + + Cherry-picked from #1017 + +- cmake: use shared libs again in example and tests + + Re-sync with autotools and v1.10.0 behavior. + + This improves build times. It also allows to stop building our special + shared test target to test shared builds. + + Follow-up to 4e2580628dd1f8dc51ac65ac747ebcf0e93fa3d1 + + Cherry-picked from #1017 + Closes #1022 + +- tests: retry KEX failures when using the WinCNG backend + + Twice. This tests are flaky and we haven't figured out why. In the + meantime use this workaround to test and log these issues, but also + ensure that CI run aren't flagged red because of it. + + Also: + - kex: add debug message when hostkey `sig_verify` fails, + to help tracking WinCNG KEX failures. + - test_ssh2: also add retry logic. + I'm not quite sure this is correct. Please let me know. + - session_fixture: bump up `src_path` slots to fit retries and show + message when hitting the limit. + - session_fixture: clear `kbd_password` static variable after use. + - session_fixture: close and deinit socket after use. + - session_fixture: deinit libssh2 after use. + + Ref: #804 #846 #979 #1012 #1015 + + Cherry-picked from #1017 + Closes #1023 + +- example, test_ssh2: shutdown socket before close + + Syncing them with `tests/session_fixture.c`. + + Cherry-picked from #1017 + +- ci.yml: fix indentation [ci skip] + + Cherry-picked from #1017 + +- Makefile.mk: make tests depend on runner lib + + Cherry-picked from #1017 + +- build: compile agent_win.c via agent.c + + Silences these warnings on non-Windows: + ``` + ranlib: file: libssh2.a(agent_win.c.o) has no symbols + ``` + + Cherry-picked from #1017 + +- cmake: delete obsolete comment + + Follow-up to 80175921638fa0a345237d23206a2ad1644cdd9b + + Cherry-picked from #1017 + +- checksrc.sh: fix it to run from any current directory + + Also silence a shellcheck warning. + + Cherry-picked from #1017 + +- ISSUE_TEMPLATE: ask for crypto backend version + + Also fix casing in backend names. + + Cherry-picked from #1017 + +- tests: fix newlines in test keys for sshd on Windows + + Make sure these files get LF newlines on checkout. Before this patch + a checked out libssh2 Git repository may have used CRLF newlines in text + files, include test keys. Private keys with CRLF newlines could confuse + sshd on Windows: + + ``` + # sshd version: 'OpenSSH_9.2, OpenSSL 1.1.1t 7 Feb 2023' + Unable to load host key "/d/a/libssh2/libssh2/tests/openssh_server/ssh_host_ed25519_key": invalid format + Unable to load host key: /d/a/libssh2/libssh2/tests/openssh_server/ssh_host_ed25519_key + ``` + Ref: https://github.com/libssh2/libssh2/actions/runs/4846188677/jobs/8635575847#step:6:39 + + Cherry-picked from #1017 + +- cmake: move option descriptions next to definition + + Cherry-picked from #1017 + +- checksrc: sync with curl + + There were no new issues detected. + + Cherry-picked from #1017 + +- openssl: enable AES-GCM with wolfSSL + + Follow-up to 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797 + + There is pending issue with wolfSSL, where encryption/decryption is not + working (both with and without this patch). Ref: #1020 + + Cherry-picked from #1017 + +- appveyor: add a UWP OpenSSL 3 build + + Cherry-picked from #1017 + +- appveyor: skip `before_test` when not doing tests + + Also merge `before_test` section into `test_script`. + + Cherry-picked from #1017 + +- docs: delete two stray characters + + Cherry-picked from #1017 + +- tidy-up: avoid expression 'of course' + + Cherry-picked from #1017 + +- tidy-up: avoid word 'just' + + Cherry-picked from #1017 + +- tidy-up: avoid word 'simply' + + Cherry-picked from #1017 + +- tests: teach to use the `USERNAME` envvar on Windows + + Necessary to pick the correct local username when run on Windows. + + Cherry-picked from #1017 + +- test_ssh2: support `FIXTURE_TRACE_ALL*` envvars + + Cherry-picked from #1017 + +- tidy-up: add missing newline to error msg, formatting + + Also: + - fix indent + - lowercase variables names + - fix formatting in `src/global.c` + + Cherry-picked from #1017 + +- appveyor: wait more for SSH connection from GHA + + Cherry-picked from #1017 + +- ci: restrict permissions in GitHub Actions + + Cherry-picked from #1017 + +- build: fix autoreconf warnings + + - update `AC_HELP_STRING' to 'AS_HELP_STRING`: + ``` + configure.ac:[...]: warning: The macro `AC_HELP_STRING' is obsolete. + ``` + "AC_HELP_STRING is deprecated in 2.70+ and I believe AS_HELP_STRING works + already since 2.59 so bump the minimum required version to that." + + Ref: https://github.com/curl/curl/commit/a59f04611629f0db9ad8e768b9def73b9b4d9423 + + - simplify to avoid: + ``` + src/Makefile.inc:48: warning: variable 'EXTRA_DIST_SOURCES' is defined but no program or + src/Makefile.inc:48: library has 'DIST' as canonical name (possible typo) + ``` + Regression from 2c18b6fc8df060c770fa7e5da704c32cf40a5757 + + - `AC_TRY_LINK`/`AC_TRY_COMPILE`: + ``` + configure.ac:335: warning: The macro `AC_TRY_COMPILE' is obsolete. + configure.ac:335: warning: The macro `AC_TRY_LINK' is obsolete. + ``` + + - `libtool`-related ones: + ``` + configure.ac:70: warning: The macro `AC_LIBTOOL_WIN32_DLL' is obsolete. + configure.ac:70: warning: AC_LIBTOOL_WIN32_DLL: Remove this warning and the call to _LT_SET_OPTION when you + configure.ac:70: put the 'win32-dll' option into LT_INIT's first parameter. + configure.ac:71: warning: The macro `AC_PROG_LIBTOOL' is obsolete. + ``` + Using code copied from curl: + https://github.com/curl/curl/blob/9ce7eee07042605045dcfd02a6f5b38ad5c8a05d/m4/xc-lt-iface.m4#L157-L163 + + - delete commented and obsolete `AC_HEADER_STDC`. + + - formatting. + + Most cherry-picked from `autoupdate` updates. + + Cherry-picked from #1017 + Closes #1021 + +- docker-bridge.ps1: use native newlines + + Also add a shebang and exec flag to ease testing/handling on *nix. + PowerShell accepts both LF and CRLF. + + Cherry-picked from #1017 + +GitHub (1 May 2023) +- [Zenju brought this change] + + sftp: remove packet limit for directory reading (#791) + + Currently libssh2 cannot read huge directory listings when the package + size of `LIBSSH2_SFTP_PACKET_MAXLEN` (256KB) is hit. For example AWS + always sends a single package with all files of a directory, no matter + how big it is: https://freefilesync.org/forum/viewtopic.php?t=10020 + Package size is probably around 7MB in this case! + + `LIBSSH2_SFTP_PACKET_MAXLEN` is a good idea in general, but there + doesn't seem to be a one size fits all. While almost all(?) SFTP + responses come in very small packages, I believe the `SSH_FXP_READDIR` + request should be exempted. + + The proposed patch, enhances the package size reading to include parsing + the full SFTP packet header. And in case a package is of type + `SSH_FXP_NAME` and matches an expected `readdir_request_id`, it does not + fail if `LIBSSH2_SFTP_PACKET_MAXLEN` is hit. The chances of accidentally + hiding data-corruption are pretty non-existent, because both SFTP + `request_id` and packet type must match. No change in behavior + otherwise. + + Best, Zenju + + Previous discussion: #268 #269 + + With the above changes, the `LIBSSH2_SFTP_PACKET_MAXLEN` value could + (and should?) probably be set back to a small number again. + + Integration-patches-by: Viktor Szakats + +Viktor Szakats (28 Apr 2023) +- checksrc: update and apply fixes + + Update to latest revision and fix new issues detected. + + Closes #1014 + +- ci: add macOS CI jobs + fix issues revealed + + Add macOS CI jobs, both cmake and autotools for all supported crypto + backends (except BoringSSL), with debug, zlib enabled. Without running + tests. It also introduces OpenSSL 1.1 into the CI with a non-MSVC + compiler. + + Credits to curl's `macos.yml`, that I used as a base. + + Fix these issues uncovered by the new tests: + + - openssl: fix warning when built with wolfSSL, or OpenSSL 1.1 and + earlier. CI missed it because apparently the only OpenSSL 1.1 test + we had used MSVC, which did not complain. + + ``` + ../src/openssl.c:3852:19: error: variable 'sslError' set but not used [-Werror,-Wunused-but-set-variable] + unsigned long sslError; + ^ + ``` + + Regression from 097c8f0dae558643d43051947a1c35b65e1c5761 + + - pem: add hack to build without MD5 crypto-backend support. + + The Homebrew wolfSSL build comes with MD5 support disabled. We can + expect this becoming the norm. FIPS also requires MD5 disabled. + + We deleted the same hack from `hostkey.c` a month ago: + ad6aae302aaec84afbfacf0c1dfdc446d46eaf21 + + A better fix would be to guard the MD5 logic with our `LIBSSH2_MD5` + macro. + + ``` + pem.c:214:32: error: use of undeclared identifier 'MD5_DIGEST_LENGTH'; did you mean 'SHA_DIGEST_LENGTH'? + unsigned char secret[2*MD5_DIGEST_LENGTH]; + ^~~~~~~~~~~~~~~~~ + SHA_DIGEST_LENGTH + ``` + + Regression from 386e012292a96fcf0dc6861588397845df0aba2c + + - `configure.ac`: add crypto libs late. + + Fix it by adding crypto libs to `LIBS` at the end of the configuration + process. + + Otherwise `configure` links crypto libs while doing feature tests, + which can cause unwanted detections. For example LibreSSL publishes + the function `explicit_bzero()`, which masks the system alternative, + e.g. `memset_s()` on macOS. Then when trying to compile libssh2, its + declaration is missing: + + ``` + bcrypt_pbkdf.c:93:5: error: implicit declaration of function 'explicit_bzero' is invalid in C99 [-Werror,-Wimplicit-function-declaration] + _libssh2_explicit_zero(ciphertext, sizeof(ciphertext)); + ^ + ../src/misc.h:50:43: note: expanded from macro '_libssh2_explicit_zero' + ^ + ``` + + Regression from 4f0f4bff5a92dce6a6cd7a5600a8ee5660402c3f + + - cmake: fix to list our own include directory before the crypto libs', + when building tests. + + Otherwise a global crypto header path, such as `/usr/local/include`, + containing an external `libssh2.h` of a different version, could cause + weird errors: + + ``` + cc -DHAVE_CONFIG_H -DLIBSSH2_LIBGCRYPT \ + -I../src -I../../src -I/usr/local/include -I[...]/libssh2/include \ + -g -isysroot /Library/Developer/CommandLineTools/SDKs/MacOSX13.1.sdk \ + -mmacosx-version-min=12.6 -MD -MT \ + tests/CMakeFiles/test_aa_warmup.dir/test_aa_warmup.c.o \ + -MF CMakeFiles/test_aa_warmup.dir/test_aa_warmup.c.o.d \ + -o CMakeFiles/test_aa_warmup.dir/test_aa_warmup.c.o -c \ + [...]/libssh2/tests/test_aa_warmup.c + ``` + + ``` + [ 62%] Building C object tests/CMakeFiles/test_aa_warmup.dir/test_aa_warmup.c.o + In file included from /Users/runner/work/libssh2/libssh2/tests/test_aa_warmup.c:4: + In file included from /Users/runner/work/libssh2/libssh2/tests/runner.h:42: + In file included from /Users/runner/work/libssh2/libssh2/tests/session_fixture.h:43: + /Users/runner/work/libssh2/libssh2/tests/../src/libssh2_priv.h:649:5: error: type name requires a specifier or qualifier + LIBSSH2_AUTHAGENT_FUNC((*authagent)); + ^ + /Users/runner/work/libssh2/libssh2/tests/../src/libssh2_priv.h:649:30: error: type specifier missing, defaults to 'int' [-Werror,-Wimplicit-int] + LIBSSH2_AUTHAGENT_FUNC((*authagent)); + ^ + /Users/runner/work/libssh2/libssh2/tests/../src/libssh2_priv.h:650:5: error: type name requires a specifier or qualifier + LIBSSH2_ADD_IDENTITIES_FUNC((*addLocalIdentities)); + ^ + /Users/runner/work/libssh2/libssh2/tests/../src/libssh2_priv.h:650:35: error: type specifier missing, defaults to 'int' [-Werror,-Wimplicit-int] + LIBSSH2_ADD_IDENTITIES_FUNC((*addLocalIdentities)); + ^ + /Users/runner/work/libssh2/libssh2/tests/../src/libssh2_priv.h:651:5: error: type name requires a specifier or qualifier + LIBSSH2_AUTHAGENT_SIGN_FUNC((*agentSignCallback)); + ^ + /Users/runner/work/libssh2/libssh2/tests/../src/libssh2_priv.h:651:35: error: type specifier missing, defaults to 'int' [-Werror,-Wimplicit-int] + LIBSSH2_AUTHAGENT_SIGN_FUNC((*agentSignCallback)); + ^ + 6 errors generated. + ``` + + - `tests/session_fixture.h`: delete duplicate `libssh2.h`, + `libssh2_priv.h` already includes it. + + Follow-up to a683133dfe96de126194f58f183131a84c7d36a2 + + CI logs with these errors: + https://github.com/libssh2/libssh2/actions/runs/4824079094 + https://github.com/libssh2/libssh2/actions/runs/4824270819 + + curl's `macos.yml`: https://github.com/curl/curl/blob/da2470de96e94e1c8d276b9ae6e4c97c2cf54239/.github/workflows/macos.yml + + Tidying-up while here: + + - tests/session_fixture.h: delete duplicate `libssh2.h`. + `libssh2_priv.h` includes it already. + + Follow-up to a683133dfe96de126194f58f183131a84c7d36a2 + + - ci.yml: yamllint warnings and formatting. + + - ci.yml: msvc section formatting and step-naming sync with macOS. + + Follow-up to f4a4c05dc3bcd62ecaa1b0cac5997faefe16c83f + + - ci.yml: enable `--enable-werror` for msys2 jobs. + + Follow-up to 71cae949d577fdd632a271da0bec89f977dc5dd2 + + - appveyor.yml: show OpenSSL versions, link to image content. + + Closes #1013 + +- ci: convert `docker-bridge.bat` to shell script + + Convert `ci/appveyor/docker-bridge.bat` to a POSIX shell script. + + Also bump the tunnel to use ed25519 (was RSA-2048). + + Closes #997 + +- kex: use distinctive error strings + + Use unique error strings to help localize errors. + + Closes #1011 + +- tidy-up: C header use + + - drop unused or duplicate C headers. + - add missing ones (that worked by chance). + (`string.h`, `stdlib.h`) + - mention the functions that need certain headers. + - move some headers from crypto header to crypto C source. + - reorder headers in some places. + - simplify the #if tree for `sys/select.h` in `libssh2_priv.h`. + - move scp-specific macros next to their header to `scp.c` + Follow-up to 5db836b2a829c6fff1e8c7acaa4b21b246ae1757 + + Closes #999 + +- tidy-up: text nits, English contractions [ci skip] + + In input/output text and docs mostly. + +- ci: add MSVC and UWP builds to GitHub Actions + + - add MSVC jobs to GitHub Actions. They are similar to the 'Build-only' + jobs we have on AppVeyor CI, though only the ARM64 Windows one is + identical. Major disadvantage is that we don't run tests here. Major + advantage is they only take a few minutes to complete, compared to + an hour on AppVeyor, so WinCNG build results now appear quicker. + + Docker tests might be possible, but my light attempts failed. + Finding ZLIB also failed, so we still miss an MSVC test with it. + + Tool versions as of now: Server 2022, VS2022, OpenSSL 1.1.1 + + - add UWP builds for both ARM64 and x64. This hasn't been CI tested + before. + + (We could probably enable UWP on AppVeyor CI as well. + I haven't tried.) + + - fix two uncovered UWP issues in tests. + + - rename internal macro `LIBSSH2_WINDOWS_APP` to `LIBSSH2_WINDOWS_UWP`. + + Follow-up to 2addafb77b662e64248d156c71c69b91ba7b926e + + - fold long lines and quote truthy values in `.github/workflows/ci.yml`. + + Closes #1010 + +- session_fixture: avoid no-op `chdir(getcwd())` + + If no `FIXTURE_WORKDIR` macro or envvar is present to set the cwd, + avoid querying the cwd and then calling chdir with the result. + + Ref: 54bef4c5dad868a9d45fdbfca9729b191c0abab5 (patch) + Ref: 10a5cbf945abcc60153ee3d59284d09fc64ea152 (individual commit) + + Closes #1009 + +- tests/sshd_fixture.sh: convert back to POSIX + + There was no strong reason to require bash. Let's use POSIX shell + like before the recent overhaul. + + Follow-up to a459a25302a31f6e2aba3c4e15b1472b83b596fc + + Closes #1008 + +GitHub (26 Apr 2023) +- [Miguel de Icaza brought this change] + + If SFTP fails to initialize, do not busy loop waiting for IO to happen (#720) + + Currently SFTP's init will busy loop waiting for the channel to close, + even if the underlying transport returns EAGAIN. While this works for + sockets, it might not work out if you have a different transport that + needs to do some additional processing on the side. + + Integration-patches-by: Viktor Szakats + +Viktor Szakats (26 Apr 2023) +- docs: simplify `.TH` header & other cleanups [ci skip] + + - simplify `.TH` headers. + - delete empty lines before sections. + - update template with an `AVAILABILITY` section. + + Left libssh2 version number in the `.TH` header for entries without an + `AVAILABILITY` section, or where there was a different version number + there. + +- tidy-up: formatting nits [ci skip] + +- vms: fix to include `sys/socket.h` + + Due to a typo in the `HAVE_*` macro, this header was never included. + + A comment suggests that `socklen_t` is not defined on VMS and defines it + manually. This symbol is usually in `sys/socket.h`, so the typo may have + been the reason for it to be missing. + + Closes #1007 + +- build: fix `make distcheck` regressions + + - add #included C files to `EXTRA_DIST`. + + Regression from 4f0f4bff5a92dce6a6cd7a5600a8ee5660402c3f + + - fix `tests/sshd_fixture.sh` to not write into the test dir, by using + a pre-assembled `TrustedUserCAKeys` file. Update `Dockerfile` too to + use this. + + Regression from a459a25302a31f6e2aba3c4e15b1472b83b596fc + + Also update `tests/sshd_fixture.sh` to use + `openssh_server/authorized_keys` like `Dockerfile` does. And a few more + cosmetic updates. + + Closes #1006 + +- libssh2_priv.h: assume `HAVE_LONGLONG` + + Unless I'm missing something, it looks like `libssh2.h` has been using + `libssh2_int64_t` unconditionally since at least 2010-04-17 when + `libssh2_scp_send64()` landed via commit + be9ee7095e2d5021985f57d88f5f889d3c2b9d8f. + + This makes it redundant to detect `HAVE_LONGLONG` to fallback to a + 32-bit `scpRecv_size` in `libssh2_priv.h`. Then deal with possible + combinations of this flag and `strtoll()` options, which was + error-prone. + + Instead, assume in `libssh2_priv.h` that we have `libssh2_int64_t`, and + use it always. + + For MSVC, this means `_MSC_VER` `1310` (from year 2003) is now + required. Based on the above, this was already so before this patch. + + If there happens to be no 64-bit `strtoll()` detected, fall back to the + 32-bit `strtol()` (this should never happen with MSVC, and probably + neither with any other reasonably modern toolchain.) + + Also make sure to set `HAVE_STRTOI64` for older, non-CMake, MSVC builds + (e.g. `Makefile.mk` or `NMakefile` ones). + + Closes #1002 + +GitHub (26 Apr 2023) +- [Miguel de Icaza brought this change] + + fix a couple of small regressions (#1004) + + - openssl: fix potentially missing `ERR_*` constants by including + `openssl/err.h`. This could happen with recent version of Xcode + or when building against OpenSSL built with the `OPENSSL_NO_ENGINE` + option. + + Regression from 097c8f0dae558643d43051947a1c35b65e1c5761 (#789) + + - channel: fix an issue that would corrupt the data stream when + attempting to initialize the agent in non-blocking mode, as it is + necessary to propagate the `EAGAIN` signal upstream when the transport + returns `EAGAIN`. + + Regression from bc4e619e76071393e466c29220fc4ef5764c2820 (#752) + + - packet: the current code does not set the state machine upon reaching + this point which means that if the code is suspended due to the + transport returning an `EAGAIN`, this will re-initialize the structure + every time. + + The issue is that this keeps assigning a new channel-id downstream, + which does not match the initial channel-id that is initially + generated, causing a lookup later to fail as there is no matching + channel. + + Regression from bc4e619e76071393e466c29220fc4ef5764c2820 (#752) + +Viktor Szakats (26 Apr 2023) +- tidy-up: `gettimeofday()` fallback and use + + Simplify the way we handle `gettimeofday()` fallback for platforms + without native support or without any support. Make it similar to + how we handle `snprintf()`. + + In case of no native `gettimeofday()` support and a non-Windows + platform, our local fallback returns zero in `tv_usec` and `tv_sec`, + ending up with a zero `timeout_remaining` in `session.c`, same as + before this patch. + + Also: + - drop unused `sys/time.h` headers. + - fix our fallback code to compile with any Windows compilers + (not just MSVC) + - delete unnecessary casts. + + Closes #1001 + +- libssh2_priv.h: fix checksrc warning [ci skip] + + Regression from 9ef75298fae0728305d9d38ba1e3c838ad0513f7 + +- libssh2_priv.h: whitespace fixes cont. [ci skip] + +- libssh2_priv.h: whitespace fixes [ci skip] + +- cmake: use portable mkdir for tests/coverage target [ci skip] + + Makes `make coverage` work without a POSIX mkdir. + + Tested locally. + + Ref: https://cmake.org/cmake/help/latest/manual/cmake.1.html#cmdoption-cmake-E-arg-make_directory + +- kex: fix overlapping memcpy() to memmove() + + Noticed this when libasan started kicking out errors when sending in + MACs preferences that were not supported yet. + + Reported-by: fourierules on github + Fixes #611 + Closes #1000 + +- test/CMakeLists.txt: reuse `Makefile.am` librunner source list + + Follow-up to a459a25302a31f6e2aba3c4e15b1472b83b596fc + + Closes #998 + +GitHub (25 Apr 2023) +- [Zenju brought this change] + + openssl: fix misleading error message if wrong passphrase (#789) + + Fixes #608 + +Viktor Szakats (25 Apr 2023) +- tidy-up: tiny nits [ci skip] + +- tests: improve running tests + + TL;DR: Sync test builds between autotools and CMake. Sync sshd + configuration between Docker and non-Docker fixtures. Bump up + sshd_config for recent OpenSSH releases. + + This also opens up the path to have non-Docker tests that use a + local sshd process. Though sshd is practically unusable on Windows + CI machines out of the box, so this will need further efforts. + + Details: + + - cmake: run sshd fixture test just like autotool did already. + + - sync tests and their order between autotools and CMake. + + It makes `test_aa_warmup` the first test with both. + + - cmake: load test lists from `Makefile.am`. + + Needed to update the loader to throw away certain lines to keep the + converted output conform CMake syntax. Using regexp might be an + alternative way of doing this, but couldn't make it work. + + - cmake: use the official way to configure test environment variables. + Switch to syntax that's extendable. + + - cmake: allow to run the same test both under Docker and sshd fixture. + + Useful for testing the sshd fixture runner, or how the same test + behaves in each fixture. + + - update test fixture to read the username from `USER` envvar instead of + using the Dockfile-specific hardwired one, when running outside Docker. + + - rework `ssh2.sh` into `sshd_fixture.sh`, to: + + - allow running any tests (not just `test_ssh2`). + - configure Docker tests for running outside Docker. + - fixup `SSHD` path when running on Windows (e.g. in AppVeyor CI). + Fixes: `sshd re-exec requires execution with an absolute path` + - allow overriding `PUBKEY` and `PRIVKEY` envvars. + - allow overriding `ssh_config` via `SSHD_FIXTURE_CONFIG`. + + - prepare support for running multiple tests via sshd_fixture. + + Add a TAP runner for autotools and extend CMake logic. The TAP runner + loads the test list from `Makefile.am`. + + Notice however that on Windows, `sshd_fixture.sh` is very flaky with + GitHub Actions. And consistently broken for subsequent tests in + AppVeyor CI: + 'libssh2_session_handshake failed (-43): Failed getting banner' + + Another way to try is a single sshd instance serving all tests. + For CMake this would probably mean using an external script. + + - ed25519 test keys were identical for auth and host. Regenerate the + auth keypair to make them distinct. + + - sync the sshd environment between Docker and sshd_fixture. + + - use common via `openssh_server/sshd_config`. + - accept same auth keys. + - offer the same host keys. + - sync TrustedUserCAKeys. + - delete now unused keypairs: `etc/host*`, `etc/user*`. + - bump up startup delay for Windows (randomly, to 5 secs, from 3). + - delete `UsePrivilegeSeparation no` to avoid deprecation warnings. + `command-line line 0: Deprecated option UsePrivilegeSeparation` + - delete `Protocol 2` to avoid deprecation warnings. + It has been the default since OpenSSH 3.0 (2001-11-06). + - delete `StrictModes no` (CI tests work without it, Docker tests + never used it). + + - bump `Dockerfile` base image to `testing-slim` (from `bullseye-slim`). + + It needed `sshd_config` updates to keep things working with + OpenSSH 9.2 (compared to bullseye's 8.4). + + - replace `ChallengeResponseAuthentication` alias with + `KbdInteractiveAuthentication`. + The former is no longer present in default `sshd_config` since + OpenSSH 8.7 (2021-08-20). This broke the `Dockerfile` script. + The new name is documented since OpenSSH 4.9 (2008-03-31) + + - add `PubkeyAcceptedKeyTypes +ssh-rsa,ssh-dss,ssh-rsa-cert-v01@openssh.com` + and `HostKeyAlgorithms +ssh-rsa`. + + Original-patch-by: Eric van Gyzen (@vangyzen on github) + Fixes #691 + + There is a new name for `PubkeyAcceptedKeyTypes`: + `PubkeyAcceptedAlgorithms`. + It requires OpenSSH 8.5 (2021-03-03) and breaks some envs so we're + not using it just yet. + + - drop `rijndael-cbc@lysator.liu.se` tests and references from config. + + This is a draft alias for `aes256-cbc`. No need to test it twice. + Also this alias is no longer recognized by OpenSSH 8.5 (2021-03-03). + + - update `mansyntax.sh` and `sshd_fixture.sh` to not rely on `srcdir`. + + Hopefully this works with out-of-tree builds. + + - fix `test_read_algos.test` to honor CRLF EOLs in their inputs + (necessary when running on Windows.) + + - fix `test_read_algos.test` to honor `EXEEXT`. Might be useful when + running tests under cross-builds? + + - `test_ssh2.c`: + + - use libssh2 API to set blocking mode. This makes it support all + platforms. + - adapt socket open timeout logic from `openssh_fixture.c`. + Sadly this did not help fix flakiness on GHA Windows. + + - tests: delete unused C headers and variable initialization. + + - delete unused test files: `sshd_fixture.sh.in`, `sshdwrap`, + `etc/sshd_config`. + + Ref: cf80f2f4b5255cc85a04ee43b27a29c678c1edb1 + + - autotools: delete stray `.c` test sources from `EXTRA_DIST` in tests. + + - `tests/.gitignore`: drop two stray tests. + + - autotools: fix passing `SSHD` containing space (Windows needs this). + + - autotools: sort `EXTRA_DIST` in tests. + + - cmake: fix to add `test_ssh2` to `TEST_TARGETS`. + + - fix `authorized_key` order in `tests/gen_keys.sh`. + + - silence shellcheck warning in `ci/checksrc.sh`. + + - set `SSHD` for autotools on GitHub Actions Windows. [skipped] + + Auto-detection doesn't work (maybe because sshd is installed via + Git for Windows and we're using MSYS2's shell.) + + It enables running sshd fixture (non-Docker) tests in these jobs. + + I did not include this in the final patch due to flakiness: + ``` + Connection to 127.0.0.1:4711 attempt #0 failed: retrying... + Connection to 127.0.0.1:4711 attempt #1 failed: retrying... + Connection to 127.0.0.1:4711 attempt #2 failed: retrying... + Failure establishing SSH session: -43 + ``` + + Can be enabled with: + `export SSHD='C:/Program Files/Git/usr/bin/sshd.exe'` + + Closes #996 + +- ci: reduce algo test runtime on AppVeyor + + Make the block count customizable in `test_read` via environment + `FIXTURE_XFER_COUNT`. + + Set the custom count lower than the default when running on AppVeyor. + + The goal is to reduce CI roundtrip times. + + Closes #995 + +GitHub (22 Apr 2023) +- [Michael Buckley brought this change] + + Agent forwarding implementation (#752) + + This PR contains a series of patches that date back many years and I + believe were discussed on the mailing list, but never merged. We have + been using these in our local copy of libssh2 without issue since 2015, + if not earlier. I believe this is the full set of changes, as we tried + to use comments to mark where our copy of libssh2 differs from the + canonical version. + + This also contains changes I made earlier this year, but which were not + discussed on the mailing list, to support certificates and FIDO2 keys + with agent forwarding. + + Note that this is not a complete implementation of agent forwarding, as + that is outside the scope of libssh2. Clients still need to provide + their own implementation that parses ssh-agent methods after calling + libssh2_channel_read() and calls the appropriate callback messages in + libssh2. See the man page changes in this PR for more details. + + Integration-patches-by: Viktor Szakats + + * prefer size_t + * prefer unsigned int over u_int in public function + * add const + * docs, indent, checksrc, debug call, compiler warning fixes + +Viktor Szakats (21 Apr 2023) +- ci: add Windows Server 2016 into the test mix + + We had Windows Server 2012 R2 (8.1) and Windows Server 2019 (10) before + this patch. After, we also have Windows Server 2016 (10). + + The WinCNG flakey tests should have a better chance when running on the + newer OS. + + This update does not change the compiler mix. + + Also change the test fixture to not use the `--quiet` option with the + `docker pull` commant. This option requires docker v19.03, and + AppVeyor's Visual Studio 2017 image doesn't support it. Log output did + not change without `--quiet`, so it seems safe to delete it. In case + we'd need it, another solution is to retry without `--quiet` if the + command fails. docker's exit status is 125 in that case. + + Ref: https://github.com/libssh2/libssh2/issues/804#issuecomment-1515232799 + Ref: https://www.appveyor.com/docs/windows-images-software/ + + Closes #994 + +- build: add autotools test_read support and more + + Keep a single list for mac and crypt algos that we use in both CMake + and autotools. Use the same test names across build tools. + + Use the TAP protocol to track individual tests run from a single shell + script. + + Also: + + - enable the rest of our tests with autotools. + + - set `make check` verbose to see errors in case they happen. + + - silence stray 'command not found' error when running `mansyntax.sh` + on Windows. + + GitHub Actions Windows docker tests disabled due to: + ``` + Command: docker build --quiet -t libssh2/openssh_server ../tests/openssh_server + Error running command 'docker build --quiet -t libssh2/openssh_server ../tests/openssh_server' (exit 1): Sending build context to Docker daemon 22.02kB + Step 1/42 : FROM debian:bullseye-slim + bullseye-slim: Pulling from library/debian + no matching manifest for windows/amd64 10.0.20348 in the manifest list entries + Failed to build docker image + ``` + + Closes #993 + +- cmake: restore a dash char in comment [ci skip] + + It's a CMake comment header convention. + +GitHub (21 Apr 2023) +- [Dan Fandrich brought this change] + + tests: add AES-GCM protocol read tests (#992) + + Closes #992 + +- [Viktor Szakats brought this change] + + support encrypt-then-mac (etm) MACs (#987) + + Support for calculating MAC (message authentication code) on encrypted + data instead of plain text data. + + This adds support for the following MACs: + - `hmac-sha1-etm@openssh.com` + - `hmac-sha2-256-etm@openssh.com` + - `hmac-sha2-512-etm@openssh.com` + + Integration-patches-by: Viktor Szakats + + * rebase on master + * fix checksec warnings + * fix compiler warning + * fix indent/whitespace/eol + * rebase/manual merge onto AES-GCM patch #797 + * more manual merge of `libssh2_transport_send()` based + on dfandrich/shellfish + + Fixes #582 + Closes #655 + Closes #987 + +Viktor Szakats (20 Apr 2023) +- docs: fix typo in argument name [ci skip] + +- [Keith Dart brought this change] + + channel: add support for "signal" message + + Can send specific signals to remote process. Allows for slightly + improved remote process management, if the server supports it. + + Integration-patches-by: Viktor Szakats + + * doc updates + * change `signame_len` to `size_t` + * variable scopes + * fix checksrc warnings + + Closes #672 + Closes #991 + +- crypto: add `LIBSSH2_NO_AES_CBC` option + + Also rename internal `LIBSSH2_AES` to `LIBSSH2_AES_CBC`. + + Follow-up to 857e431648df6edcb3e17138d877f2e65d2d769d + + Closes #990 + +- tidy-up: indentation fixes [ci skip] + +GitHub (20 Apr 2023) +- [Dan Fandrich brought this change] + + Add support for AES-GCM crypto protocols (#797) + + Add support for aes256-gcm@openssh.com and aes128-gcm@openssh.com + ciphers, which are the OpenSSH implementations of AES-GCM cryptography. + It is similar to RFC5647 but has changes to the MAC protocol + negotiation. These are implemented for recent versions of OpenSSL only. + + The ciphers work differently than most previous ones in two big areas: + the cipher includes its own integrated MAC, and the packet length field + in the SSH frame is left unencrypted. The code changes necessary are + gated by flags in the LIBSSH2_CRYPT_METHOD configuration structure. + + These differences mean that both the first and last parts of a block + require special handling during encryption. The first part is where the + packet length field is, which must be kept out of the encryption path + but in the authenticated part (as AAD). The last part is where the + Authentication Tag is found, which is calculated and appended during + encryption or removed and validated on decryption. As encryption/ + decryption is performed on each packet in a loop, one block at a time, + flags indicating when the first and last blocks are being processed are + passed down to the encryption layers. + + The strict block-by-block encryption that occurs with other protocols is + inappropriate for AES-GCM, since the packet length shifts the first + encrypted byte 4 bytes into the block. Additionally, the final part of + the block must contain the AES-GCM's Authentication Tag, so it must be + presented to the lower encryption layer whole. These requirements mean + added code to consolidate blocks as they are passed down. + + When AES-GCM is negotiated as the cipher, its built-in MAC is + automatically used as the SSH MAC so further MAC negotiation is not + necessary. The SSH negotiation is skipped when _libssh2_mac_override() + indicates that such a cipher is in use. The virtual MAC configuration + block mac_method_hmac_aesgcm is then used as the MAC placeholder. + + This work was sponsored by Anders Borum. + + Integration-patches-by: Viktor Szakats + + * fix checksrc errors + * fix openssl.c warning + * fix transport.c warnings + * switch to `LIBSSH2_MIN/MAX()` from `MIN()`/`MAX()` + * fix indent + * fix libgcrypt unused warning + * fix mbedtls unused warning + * fix wincng unused warning + * fix old openssl unused variable warnings + * delete blank lines + * updates to help merging with the ETM patch + +Viktor Szakats (20 Apr 2023) +- tidy-up: align comments [ci skip] + +- tidy-up: whitespace nits [ci skip] + +- crypto: add/fix algo guards and extend `NO` options + + Add new guard `LIBSSH2_RSA_SHA1`. Add missing guards for `LIBSSH2_RSA`, + `LIBSSH2_DSA`. + + Fix warnings when all options are disabled. + + This is still not complete and it's possible to break a build with + certain crypto backends (e.g. mbedTLS) and/or combination of options. + It's not guaranteed that all bits everywhere get disabled by these + settings. Consider this a "best effort". + + Add these new options to disable certain crypto elements: + - `LIBSSH2_NO_3DES` + - `LIBSSH2_NO_AES_CTR` + - `LIBSSH2_NO_BLOWFISH` + - `LIBSSH2_NO_CAST` + - `LIBSSH2_NO_ECDSA` + - `LIBSSH2_NO_RC4` + - `LIBSSH2_NO_RSA_SHA1` + - `LIBSSH2_NO_RSA` + + The goal is to offer a way to disable legacy/obsolete/insecure ones. + + See also: 146a25a06dd2365a4330dad34fefcdcee1a206aa `LIBSSH2_NO_HMAC_RIPEMD` + See also: 38015f4e46d8dbeea522dc7ee664522d4f47fc75 `LIBSSH2_NO_DSA` + See also: be31457f3071686b555a0f0b19e5dcf63d67fc27 `LIBSSH2_NO_MD5` + + Closes #986 + +- scp: fix typo in comments [ci skip] + + Follow-up to 0a500b3554c29451708353279eefce750f4bca6c + +- base64: do not use `snprintf()` on encoding + + This also significantly (by 7-8x in my limited tests with a short + string) speeds up this function. The impact is still minor as this + function is only used in `knownhost.c` in release builds. + + Closes #985 + +- wincng: constify data arg of `libssh2_wincng_hash()` + + Tested in #979 + +- wincng: fix unused variables with `LIBSSH2_RSA_SHA2` disabled + + Tested in #979 + +- ci: delete config elements for unused 32-bit Linux builds + + They have been disabled since d9b4222ef1c5ab9b9e499fe6234556e5cca7c4fe + + Tested in #979 + +- ci: enable FIXTURE_TRACE_ALL_CONNECT for WinCNG tests + + To hopefully help finding the WinCNG hostkey verification + intermittent failure #804. + + Tested in #979 + +- tests: add `FIXTURE_TRACE_ALL_CONNECT` option + + Works like the `FIXTURE_TRACE_ALL` envvar, but enables full trace for + the connection phase only. + + Also fix a possible NULL deref with `FIXTURE_TRACE_ALL` and a failed + `libssh2_session_init_ex()`. + + Tested in #979 + +- ci: really enable logging in AppVeyor CMake builds + + `CONFIGURATION` was never passed to the cmake command, so it had + never enabled logging when set to `Debug`. + + Also `CONFIGURATION` is ambiguous depending on the "generator" used + by CMake. In case of Visual Studio, this is a build/ctest-time + setting, not a cmake-config parameter. + + So set this permanently to `Release` and enable logging via our + dedicated CMake option `ENABLE_DEBUG_LOGGING`. + + Tested in #979 + +- HACKING-CRYPTO: fix stray whitespace + +- tidy-up: fix more nits + + - fix indentation errors. + - reformat `cmake/FindmbedTLS.cmake` + - replace a macro with a variable in `example/sftp_RW_nonblock.c`. + - delete macOS macro `_DARWIN_USE_64_BIT_INODE` from the + OS/400 config header, `os400/libssh2_config.h`. + - fix other minor nits. + + Closes #983 + +- mansyntax: make it work on macOS, check reqs locally + + - use `gman` alias if present. This makes it work when the correct `man` + command is provided via `brew` on macOS. + + - move CMake attempts to detect tools necessary to run `mansyntax.sh` + into the script itself. + + - delete CMake TODO to move more test logic into CMake. This would make + it CMake-specific and require maintaining it separately for each build + tool. Just use our external script when a POSIX shell is available. + + Closes #982 + +- cmake: dedupe setting `-DHAVE_CONFIG_H` + + Move `libssh2_config.h` generation and setting `-DHAVE_CONFIG_H` to + the root `CMakeFile.txt`. + + Also move symbol hiding setup there. It needs to be done before + generating the config file for `LIBSSH2_API` value to be set in it. + + After this change the `HIDE_SYMBOLS` setting is accepted without an + annoying CMake warning when not actually building a shared libssh2 lib. + + Closes #981 + +- build: assume non-blocking I/O on Windows + + Drop checks from Windows builds and enable it based on `WIN32`. + + This saves detection time and also makes 3rd party builds simpler. + + Also: + + - delete `HAVE_DISABLED_NONBLOCKING`, that we used in build tools to + explicitly disable an explicit `#error` in `session.c`. + + - replace existing `WSAEWOULDBLOCK` check for Windows support with + `WIN32`. Cleaner with the same result. + + Follow-up to f1e80d8d8ce9570d81836da96ba02f4d4552a7b3 + Follow-up to 5644eea2161b17f7c16e18f3a10465ebb217ca1f + + Closes #980 + +- ci: rename Logging to Debug in AppVeyor + +- switch to internal base64 decode that uses size_t + + Make the public `libssh2_base64_decode()` a wrapper for that. + Bump up length sizes in callers. + + Also fix output size calculation to first divide then multiply. + + Closes #978 + +- tests: switch to debian:bullseye-slim in Dockerfile + + 'slim' provides all we need, with less bloat. + + Tested in #976 + + Follow-up to 78cb64a85955f2cd9700c4fbad3f02d589dd7169 + +- tests: build improvements and more + + - rename tests to have more succint names and a more useful natural + order. + + - rename `simple` and `ssh2` in tests to have the `test_` prefix. + + This avoids a name collisions with `ssh2` in examples. + + - cmake: drop the `example-` prefix for generated examples. + + Bringing their names in sync with other build tools, like autotools. + + - move common auth test code into the fixture and simplify tests by + using that. + + - move feature guards from CMake to preprocessor for auth tests. + + Now it works with all build tools and it's easier to keep it in sync + with the lib itself. + + For this we need to include `libssh2_priv.h` in tests, which in turn + needs tweaking on the trick we use to suppress extra MSVS warnings + when building tests and examples. + + - move mbedTLS blocklist for crypto tests from CMake to the test + fixture. + + - add ed25519 hostkey tests to `test_hostkey` and `test_hostkey_hash`. + + - add shell script to regenerate all test keys used for our tests. + + - alpha-sort tests. + + - rename `signed_*` keys to begin with `key` like the rest of the keys + do. + + - whitespace fixes. + + Closes #969 + +- autotools: rename a variable + + To match its counterpart we use for clang and to better match + the original code in curl. + + Follow-up to ec0feae7920d695ce234a5aba13014bf29824c09 + + Closes #977 + +- ssh2.sh: revert likely wrong quoting [ci skip] + + Follow-up to 50124428509ffc2f5d08d8d3c152fa36546c9a75 + +- build: add `-Wbad-function-cast` picky warning + + Also adjust minimum gcc versions in comment. + + Closes #975 + +- tests: restore debian:bullseye in Dockerfile + + Follow-up to 78cb64a85955f2cd9700c4fbad3f02d589dd7169 + +- session: simplify preprocessor logic + + - by using #elif + - by merging two blocks + + Closes #972 + +- tests: try debian:testing for Dockerfile + + Follow-up to 78cb64a85955f2cd9700c4fbad3f02d589dd7169 + +- src: add and use `LIBSSH2_MIN/MAX` macros + + Also for #797 + + Closes #974 + +- tests: switch Dockerfile to debian:testing-slim + + From debian:bullseye + + - doesn't need manual bumps. + - is ahead of stable and should be stable enough for our purpose. + - slim is saving resources. + + Closes #971 + +- cmake: optimize non-blocking tests on WIN32/non-WIN32 + + Skip testing unixy methods on Windows and vice versa. + + I continue to assume that CMake doesn't define `WIN32` with Cygwin + (as Cygwin doesn't define `_WIN32`/`WIN32` for C), though I haven't + tested this. + + Closes #970 + +GitHub (15 Apr 2023) +- [Jörgen Sigvardsson brought this change] + + scp: option to not quote paths (#803) + + A new flag named `LIBSSH2_FLAG_QUOTE_PATHS` has been added, to make + libssh2 not quote file paths sent to the remote's scp subsystem. Some + custom ssh daemons cannot handle quoted paths, and this makes this flag + useful. + + Authored-by: Jörgen Sigvardsson + +Viktor Szakats (15 Apr 2023) +- cmake: make Windows builds initialize faster + + By skipping unixy header checks that always fail with + the MSVC toolchain or all Windows toolchains. + + Closes #968 + +- cmake: use a single build rule for all tests + + - use the complete filename of test sources in the input list. + + - build all tests with the ability to access libssh2 internals. + + This is necessary for `test_keyboard_interactive_auth_info_request` + now and might be necessary for others in the future, e.g. to avoid + the depreacted public base64 decoding API. + + - move `test_keyboard_interactive_auth_info_request` into the main + test build loop. + + - move `simple` into the main test build loop too. + + - build `ssh2` also in static mode. + + - cleanup the way we detect and enable gcov. + + - fix indentation. + + Closes #967 + +- tidy-up: more whitespace in src + + Closes #966 + +- checksrc: fix `EQUALSNULL` warnings + + `s/([a-z0-9._>*-]+) == NULL/!\1/g` + + Closes #964 + +- Makefile.am: add new OS400 header [ci skip] + + Follow-up to 6dc42e9d625deb816a051d312d09e68926959e78 + +- checksrc: fix `NOTEQUALSZERO` warnings + + Closes #963 + +- checksrc: fix `SIZEOFNOPAREN` warnings + + `s/sizeof ([a-z0-9._>*-]+)/sizeof(\1)/g` + + Closes #962 + +- crypto: add `LIBSSH2_NO_HMAC_RIPEMD` option + + See also: 38015f4e46d8dbeea522dc7ee664522d4f47fc75 + See also: be31457f3071686b555a0f0b19e5dcf63d67fc27 + + Ref: https://github.com/stribika/stribika.github.io/issues/46 + + Closes #965 + +- tidy-up: example, tests continued + + - fix skip auth if `userauthlist` is NULL. + Closes #836 (Reported-by: @sudipm-mukherjee on github) + - fix most silenced `checksrc` warnings. + - sync examples/tests code between each other. + (output messages, error handling, declaration order, comments) + - stop including unnecessary headers. + - always deinitialize in case of error. + - drop some redundant variables. + - add error handling where missing. + - show more error codes. + - switch `perror()` to `fprintf()`. + - fix some `printf()`s to be `fprintf()`. + - formatting. + + Closes #960 + +- src: fix indentation of macro definitions (follow-up) + + Follow-up to d5438f4ba9036e8028f35258dd1ab97cc2edb37c + +- src: fix indentation of macro definitions + + And some comment cleanup. + + Closes #958 + +- example/ssh2_exec: drop conditional code for deprecated API + +GitHub (13 Apr 2023) +- [monnerat brought this change] + + Make OS/400 implementation work again (#953) + + * os400: support QADRT development files in a non-standard directory + + This enables the possibility to compile libssh2 even if the ascii + runtime development files are not installed system-wide. + + * userauth_kbd_packet: fix a pointer target type mismatch. + + A temporary variable matching the parameter type is used before copying + to the real target and checking for overflow (that should not occur!). + + * os400qc3: move and fix big number procedures + + A bug added by a previous code style cleaning is fixed. + _libssh2_random() now checks and return the success status. + + * os400qc3: fix cipher definition block lengths + + They were wrongly set to the key size. + + * Diffie-Hellman min/max modulus sizes are dependent of crypto-backend + + In particular, os400qc3 limits the maximum group size to 2048-bits. + Move definitions of these parameters to crypto backend header files. + + * kex: return an error if Diffie-Hellman key pair generation fails + + * os400: add an ascii assert.h header file + + * os400qc3: implement RSA SHA2 256/512 + +Viktor Szakats (13 Apr 2023) +- sftp: add open functions with custom attribute support + + Before this patch, libssh2 sent hardcoded `LIBSSH2_SFTP_ATTRIBUTES` + struct on handle open. This can be problematic on some special OS, + where the file size should be known on new file creation. I added + two new functions to resolve this issue. + + Patch-by: @vajdaakos on github via #506 + + Changes compared to #506: + - drop attr size fixup in favour of #946. + - move `memcpy()` under the state where we need it. + - bump filename length type to `size_t`. + - fix filenames in documentation and other nits. + + Closes #506 + Closes #947 + +- build: speed up and extend picky compiler options + + Implement picky warnings with clang in autotools. Extend picky gcc + warnings, sync them between build tools and compilers and greatly + speed up detection in CMake. + + - autotools: enable clang compiler warnings with `--enable-debug`. + + - autotools: enable more gcc compiler warnings with `--enable-debug`. + + - autotools/cmake: sync compiler warning options between gcc and clang. + + - sync compiler warning options between autotools and cmake. + + - cmake: reduce option-checks to speed up the detection phase. + Bring them down to 3 (from 35). Leaving some checks to keep the + CMake logic alive and for an easy way to add new options. + + clang 3.0 (2011-11-29) and gcc 2.95 (1999-07-31) now required. + + - autotools logic copied from curl, with these differences: + + - delete `-Wimplicit-fallthrough=4` due to a false positive. + + - reduce `-Wformat-truncation=2` to `1` due to a false positive. + + - simplify MinGW detection for `-Wno-pedantic-ms-format`. + + - cmake: show enabled picky compiler options (like autotools). + + - cmake: do compile `tests/simple.c` and `tests/ssh2.c`. + + - fix new compiler warnings. + + - `tests/CMakeLists.txt`: fix indentation. + + Original source of autotools logic: + - https://github.com/curl/curl/blob/a8fbdb461cecbfe1ac6ecc5d8f6cf181e1507da8/acinclude.m4 + - https://github.com/curl/curl/blob/a8fbdb461cecbfe1ac6ecc5d8f6cf181e1507da8/m4/curl-compilers.m4 + + Notice that the autotools implementation considers Apple clang as + legacy clang 3.7. CMake detection works more accurately, at the same + time more error-prone and difficult to update due to the sparsely + documented nature of Apple clang option evolution. + + Closes #952 + +- include: delete leading underscore from macro name + + It can cause compiler warnings in 3rd-party code. + + Follow-up to 59666e03f04927e5fe3e8d8772d40729f63c570e + + Closes #957 + +- ci: use OpenSSL 3 on AppVeyor VS2022 images + + Closes #954 + +- build: be friendly with 3rd-party build tools + + After recent build changes, 3rd party build that took the list of + C source to compile them as-is, stopped working as expected, due to + `blowfish.c` and crypto-backend C sources no longer expected to compile + separately but via `bcrypt_pbkdf.c` and `crypto.c`, respectively. + + This patch ensures that compiling these files directly result in an + empty object instead of redundant code and duplicated symbols. + + Also: + - add a compile-time error if none of the supported crypto backends + are enabled. + - fix `libssh2_crypto_engine()` for wolfSSL and os400qc3. + Rearrange code to avoid a hard-to-find copy of crypto-backend + selection guards. + + Follow-up to 4f0f4bff5a92dce6a6cd7a5600a8ee5660402c3f + Follow-up to ff3c774e03585252b70a9ee0fcf254de7b14a767 + + Closes #951 + +- sftp: calculate attr size based on attr content in `sftp_open()` + + Improve robustness by replacing constant argument of `sftp_attrsize()` + in `sftp_open()` with the actual `flag` value read from the `attr` we + plan to transfer. Restores state of this before + 37624b61e3ec4aa65a608800613d00b55ced56d7. + + Prerequisite for #947, #506. + + Also improve readability a bit and link to SFTP specs. Delete comment + about version 6: The latest spec no longer features the mentioned + "DO NOT IMPLEMENT" notice. + + Closes #946 + +- man: fixups + + - add missing `.fi` tags. + - fix misplaced `.nf` tags. + - add `.nf`/`.fi` tags `SYNOPSIS` where missing. + - fix missing/wrong function name from `SH NAME`. + - fix wrong function name in `TH`. + - keep return values in a separate line. + - indent. + - fold long lines. + - deleted `libssh2_channel_direct_streamlocal()`, there is no such function. + - add missing types. + - add missing headers. + + Closes #949 + +- include: indentation fixes + +- tidy-up: misc & minor cmake MSVS fix + + - `libssh2.rc`: document language/codepage codes. + + Ref: https://learn.microsoft.com/windows/win32/intl/code-page-identifiers + + - convert to Markdown: `docs/BINDINGS`, `docs/HACKING` + + Blind update for `vms/libssh2_make_help.dcl`. Please double-check. + + - cmake: fix to recognize dash-style warning options (`-Wn`) with MSVC. + + - `NMakefile`: sync `rd` command with `Makefile.mk`. + + - delete a CVS header. + + - cmake: simplify a `LIBSSH2_HAVE_ZLIB` macro. + + - few other nits and whitespace mods. + + Closes #943 + +GitHub (10 Apr 2023) +- [Viktor Szakats brought this change] + + Support for direct-streamlocal@openssh.com UNIX socket connection (#945) + + This patch allow to use direct-streamlocal service from OpenSSH 6.7, + that allows UNIX socket connections. + + Mods: + - delete unrelated condition: + Ref: https://github.com/libssh2/libssh2/pull/216#discussion_r374748111 + - rebase on master, whitespace updates. + + Patch-by: @gjalves Gustavo Junior Alves + + Closes #216 + Closes #632 + Closes #945 + +Viktor Szakats (10 Apr 2023) +- build: support `libssh2.rc` with autotools + + Caveat: When building `--enable-static` and `--enable-shared` at the + same time, the compiled Windows resource is also included in the + static library. This appears to be an autotools limitation, with no + way to have different input lists (or different custom options) for + shared and static libraries, even though it builds them separately. + + The workaround is to build static libraries in a separate + `./configure` + `make` pass. + + Closes #944 + +- crypto: add `LIBSSH2_NO_DSA` to disable DSA support + + See also: be31457f3071686b555a0f0b19e5dcf63d67fc27 + + Closes #942 + +- build: unify source lists + + - introduce `src/crypto.c` as an umbrella source that does nothing else + than include the selected crypto backend source. Moving this job from + the built-tool to the C preprocessor. + + - this allows dropping the various techniques to pick the correct crypto + backend sources in autotools, CMake and other build method. Including + the per-backend `Makefile..inc` makefiles. + + - copy a trick from curl and instead of maintaining duplicate source + lists for CMake, convert the GNU Makefile kept for autotools + automatically. Do this in `docs`, `examples` and `src`. + + Ref: https://github.com/curl/curl/blob/dfabe8bca218d2524af052bd551aa87e13b8a10b/CMakeLists.txt#L1399-L1413 + + Also fixes missing `libssh2_setup.h` from `src/CMakeFiles.txt` after + 59666e03f04927e5fe3e8d8772d40729f63c570e. + + - move `Makefile.inc` from root to `src`. + + - reformat `src/Makefile.inc` to list each source in separate lines, + re-align the continuation character and sort the lists alphabetically. + + - update `docs/HACKING-CRYPTO` accordingly. + + - autotools: update the way we add crypto-backends to `LIBS`. + + - delete old CSV headers, indent, and merge two lines in + `docs/Makefile.am` and `src/Makefile.am`. + + - add `libssh2.pc` to `.gitignore`, while there. + + Closes #941 + +GitHub (9 Apr 2023) +- [Zenju brought this change] + + sftp: always clear protocol error (#787) + +Viktor Szakats (9 Apr 2023) +- cmake: add `HIDE_SYMBOLS` option & do symbol hiding on *nix + + - implement symbol hiding on non-Windows platforms. + + The essence of the detection logic was copied from: + https://github.com/curl/curl/blob/dfabe8bca218d2524af052bd551aa87e13b8a10b/CMake/CurlSymbolHiding.cmake + + Then simplified and shortened. This method doesn't require a recent + CMake version, nor an external, auto-generated C header. + + Move `configure_file()` after `set(LIBSSH2_API ...)`, for the config + file to pick up `LIBSSH2_API`s value. + + Closes #602 + + - add CMake option `HIDE_SYMBOLS`. + + This setting means to hide non-public functions from the libssh2 + dynamic library when set to `ON`. The default. + + When set to `OFF`, make all non-static/internal functions visible + in the dynamic library. + + This setting requires `BUILD_SHARED_LIBS=ON`. + + - honor this setting on Windows. + + By setting the `LIBSSH2_EXPORTS` manual macro again, and stop + recognizing the automatic CMake macro for this purpose: + `libssh2_shared_EXPORT`. + + Closes #939 + +- build: make `windows.h` even leaner + + Disable GDI and NLS features in `windows.h`. libssh2 doesn't use these. + + Closes #940 + +- blowfish: build improvements + + - include `blowfish.c` into `bcrypt_pbkdf.c`, instead of + compiling it as a distinct object. + + - make low-level blowfish functions static. This prevents this symbols + to pollute the public namespace of libssh2. It also allows the + compiler to inline these functions. + + - integrate `blf.h` header into `bcrypt_pbkdf.c` as well. + + - use `_DEBUG_BLOWFISH` instead of `#if 0`. + + - fix `_DEBUG_BLOWFISH` compiler warnings and other nits. + + - `#undef` `inline` before redefining it in `libssh2_priv.h`. + (copied from `blowfish.c`) + + - delete unused `inline` redefinitions from `blowfish.c`. + + - disable unused low-level blowfish functions. + + - formatting, header order. + + Closes #938 + +- libssh2.rc: fix debug flag, other cleanups + + - fix to use `LIBSSH2DEBUG` macro to set the debug flag. + (was `DEBUGBUILD`, a curl-specific macro) + + - use manifest constants instead of literals + + - change language to neutral + + Closes #937 + +- tidy-up: example, tests + + - drop unnecessary `WIN32`-specific branches. + + - add `static`. + + - sync header inclusion order. + + - sync some common code between examples/tests. + + - fix formatting/indentation. + + - fix some `checksrc` errors not caught by `checksrc`. + + Closes #936 + +- tests/mansyntax.sh: avoid `if !` for portability + + Ref: https://www.gnu.org/software/autoconf/manual/autoconf-2.69/html_node/Limitations-of-Builtins.html#Limitations-of-Builtins + + Fixes #704 + Closes #935 + +- tidy-up: indentation in guarded #includes [ci skip] + +- Makefile.mk: drop `PROOT` variable [ci skip] + +- build: hand-crafted config rework & header tidy-up + + - introduce the concept of a project level setup header + `src/libssh2_setup.h`, that is used by `src`, `example` and `tests` + alike. Move there all common platform/compiler configuration from + `src/libssh2_priv.h`, individual sources and `CMakeFiles.txt` files. + Also move there our hand-crafted (= not auto-generated by CMake or + autotools) configuration `win32/libssh2-config.h`. + + - `win32` directory is empty now, delete it. + + - `Makefile.mk`: adapt to the above. Build-directory is the target + triplet, or any custom name set via `BLD_DIR`. + + - sync header path order between build systems: + build/src -> source/src -> source/include + + - delete redundant references to `windows.h`, `winsock2.h`, + `ws2tcpip.h`. + + - delete unnecessary #includes, update order (`libssh2_setup.h` first, + `winsock2.h` first), simplify where possible. + + This makes the code warning-free without `WIN32_LEAN_AND_MEAN`. + At the same time this patch applies this macro globally, to avoid + header bloat. + + - example: add missing *nix header guards. + + - example: fix misindented `HAVE_UNISTD_H` `#ifdef`s. + + - set `WIN32` with all build-tools. + + - set `HAVE_SYS_PARAM_H` in the hand-crafted config for MinGW. + To match auto-detection. + + - move a source-specific macro to `misc.c` from `libssh2_priv.h`. + + See the PR's individual commits for step-by-step updates. + + Closes #932 + +- Makefile.mk: build tests and other improvements [ci skip] + + - use `example` target for building examples (was: `test`). + + - add support for building tests via the `test` target. + + - accept lib-only options in a new `LIBSSH2_CPPFLAGS_LIB` variable. + + Useful to pass `-DLIBSSH2_EXPORTS` for correct `dllexport` in + `libssh2.dll`. + + - fix to put dynamic library in lib directory for non-Windows builds + + - fix to not delete lib objects on `testclean` + +- test_warmup: re-implement as `test()` + + Instead of overriding `main()`. To align with the other tests. + + Overriding `main()` can cause duplicate symbols without using a lib for + the `runner` code. + + Follow-up to 40ac6b230a309d35c57aa65a8f6d7ab6654aa3d8 + + Closes #934 + +- NMakefile: drop `/DEBUG` linker option in release mode [ci skip] + +- NMakefile: simplify [ci skip] + +- Makefile.mk: merge two rules [ci skip] + +- TODO: update item about compiler warnings [ci skip] + + Follow-up to 08354e0abbe86d4cc5088d210d53531be6d8981a + Follow-up to 29347905721d2e7fbb97dabfb0071bee51db3013 + Follow-up to 5a96f494ee0b00282afb2db2e091246fc5e1774a + Follow-up to 463449fb9ee7dbe5fbe71a28494579a9a6890d6d + Follow-up to 02f2700a61157ce5a264319bdb80754c92a40a24 + +GitHub (5 Apr 2023) +- [ihsinme brought this change] + + example/x11: Add null-termination (#749) + +Viktor Szakats (5 Apr 2023) +- crypto: fix `LIBSSH2_NO_MD5` compiler warnings + + Follow-up to be31457f3071686b555a0f0b19e5dcf63d67fc27 + + Closes #933 + +- build: add new man pages + + Follow-up to c20c81ab105cdf27f5a4e2604bd13085f46e21de + +GitHub (5 Apr 2023) +- [Daniel Silverstone brought this change] + + Configurable session read timeout (#892) + + This set of changes provides a mechanism to runtime-configure the + previously #define'd timeout for reading packets from a session. The + intention here is to also extend libcurl to be able to use this + interface so that when fetching from sftp servers which are very slow + to return directory listings, connections do not time-out so much. + + * Add new field to session to hold configurable read timeout + + * Updated `_libssh2_packet_require()`, `_libssh2_packet_requirev()`, + and `sftp_packet_requirev()` to use new field in session structure + + * Updated docs for API functions to set/get read timeout field in + session structure + + * Updated `libssh2.h` to declare the get/set read timeout functions + + Co-authored-by: Jon Axtell + Credit: Daniel Silverstone + +Viktor Szakats (4 Apr 2023) +- cmake: whitespace fixes [ci skip] + +- libssh2.h: bump LIBSSH2_COPYRIGHT year [ci skip] + +- Makefile.mk: move portable GNU Make file to the root + + Move the GNU Make file formerly known as `win32/GNUmakefile` to the + root directory from `win32`. It now supports any platform with a + GCC-like toolchain, while also keeping support for win32. + + For non-Windows platforms it's necessary to provide a hand-crafted + `libssh2_config.h` header for now. + + Usage: `make -f Makefile.mk` + +- src: include `limits.h` for `*_MAX` macros + + Follow-up to 5a96f494ee0b00282afb2db2e091246fc5e1774a + + Reported-by: OldWorldOrdr on github + Fixes #928 + Closes #930 + +- build: MSVS warning suppression option tidy-up + + - in `win32/libssh2_config.h` replace `_CRT_SECURE_NO_DEPRECATE` with + `_CRT_SECURE_NO_WARNINGS`, to use the official macro for this, like + in CMake. + + Also, it's now safe to move it back under `_MSC_VER`. + + Suppressing: + + `warning C4996: 'fopen': This function or variable may be unsafe. Consider using fopen_s instead.` + `warning C4996: 'getenv': This function or variable may be unsafe. Consider using _dupenv_s instead.` + + - move `_CRT_NONSTDC_NO_DEPRECATE` to `example` and `tests`. + Not needed for `src`. + + Suppressing: + + `warning C4996: 'strdup': The POSIX name for this item is deprecated. Instead, use the ISO C and C++ conformant name: _strdup.` + `warning C4996: 'write': The POSIX name for this item is deprecated. Instead, use the ISO C and C++ conformant name: _write.` + + - move `_WINSOCK_DEPRECATED_NO_WARNINGS` from source files to + CMake files, in `example` and `tests`. Also limit this to MSVC. + + Suppressing: + + `warning C4996: 'inet_addr': Use inet_pton() or InetPton() instead` + + TODO: try fixing these instead of suppressing. + + Closes #929 + +- win32/GNUmakefile: make it movable [ci skip] + + - add `BLD_DIR` to customize the output directory (where libs, .zip, + obj subdir will go). This directory must exist. + + It remains `./win32` for Windows builds. + + - add `CONFIG_H_DIR` option to customize `libssh2_config.h` location. + + It remains `./win32` for Windows builds. + + - include `.def` in distro zip for Windows. + + - ready to move to the root directory. + +- win32/GNUmakefile: drop an unnecessary variable [ci skip] + +- windows: re-add `libssh2.rc` + + Lost while moving it from the win32 directory + + Follow-up to 194cfc0f84192809c87f846140e5bf06b7a864af + +- crypto: add `LIBSSH2_NO_MD5` to disable MD5 support + + Closes #927 + +- hostkey: fix `hash_len` field constants + + Replace incorrect `MD5_DIGEST_LENGTH` with `SHA_DIGEST_LENGTH` for these + hostkey algos: + + - `ssh-rsa` and `ssh-dss` + + Ref: 7a5ffc8cee259bbde82ab92515cd8fea2166854b (2004-12-07 Initial) + + - `ssh-rsa-cert-v01@openssh.com` + + Ref: 4b21e49d9d2db74579b18804ed1f5eeb16578b2f (2022-07-28) + Ref: #710 + + Also delete local fall-back definition of `MD5_DIGEST_LENGTH` (added + in 9af7eb48dc3854ce8ee0589f7e2beb944e064847). Macro is no longer used. + + Reported-by: Markus-Schmidt on github + Fixes #919 + Closes #926 + +- ci: add MSVS 2008/2010 build tests and fix warnings + + Also: + + - fix newly surfaced (bogus) warnings in examples with MSVS 2010: + + ``` + ..\..\example\direct_tcpip.c(262): warning C4127: conditional expression is constant + ``` + Happens for every `FD_SET()` macro reference. + + Ref: https://ci.appveyor.com/project/libssh2org/libssh2/builds/46677835/job/ni4hs97bh18c14ap + + - silence MSVS 2010 predefined Windows macro warnings: + + ``` + ..\..\src\wincng.c(867): warning C4306: 'type cast' : conversion from 'int' to 'LPCSTR' of greater size + ..\..\src\wincng.c(897): warning C4306: 'type cast' : conversion from 'int' to 'LPCSTR' of greater size + ..\..\src\wincng.c(1132): warning C4306: 'type cast' : conversion from 'int' to 'LPCSTR' of greater size + ``` + + Ref: https://ci.appveyor.com/project/libssh2org/libssh2/builds/46678071/job/08t5ktvkcgdghp7r + + Closes #925 + +- transport: rename local `RANDOM_PADDING` macro + + Rename `RANDOM_PADDING` macro used internally to enable some code. + + Committed in the initial version of `transport.c` in + 9d55db6501aa4e21f0858cf36cdc2ddc11b96e83 (2007-02-02). libssh2 code + never defined it. + + The name happens to collide with a Windows macro in `wincrypt.h`. + `transport.c` doesn't include this header, but it includes `winsock2.h`, + and it turns out it can also define this macro in some cases, e.g. + when `WIN32_LEAN_AND_MEAN` is not set. + + To be on the safe side, prefix the name with `LIBSSH2_` to avoid + enabling it by accident. + + Q: Maybe it'd be best to delete it with the guarded code? + + Reported-by: Markus-Schmidt on github + Fixes #921 + Closes #924 + +- windows: move `libssh2.rc` to the `src` directory + + Closes #918 + +- autotools: delete unused conditional `HAVE_SYS_UN_H` + + No longer necessary after moving the disabling/enabling logic from + build tool to `example/x11.c`. + + Reverts 4774d500e724bc4e548f743a0cb644ab05599474 + Follow-up to d245c66cc0029e480674394c23e8be1c9410f7ad + +- win32/GNUmakefile: update help & exit without crypto backend [ci skip] + + Follow-up to: 5bcd25c4c980e9765c00a2f20ac5348635063aad + Follow-up to: 68fd02fba002c8c6af3ba51a2780de46b47b3787 + +- build: respect autotools `DLL_EXPORT` in `libssh2.h` + + The `DLL_EXPORT` macro is automatically set by autotools when building + the libssh2 DLL. Certain toolchains might require this to correctly + export symbols, so make sure to respect it in `libssh2.h` to enable + `declspec(dllexport)`. + + With this patch we have a manual macro for that (`LIBSSH2_EXPORT`), + this autotools one, the CMake one, and `_WINDLL` (added in + c355d31ff94a1622526c4988b9d09074f7f7605d), possibly defined by Visual + Studio. + + Closes #917 + +- build: make `HAVE_LIBCRYPT32` local to `wincng.c` + + libssh2 uses `wincrypt.h` aka the `crypt32` Windows system library + for the function `CryptDecodeObjectEx()` [1]. This function has been + available for Win32 (and UWP/WinRT apps) for a long while. Even old + MinGW supports it, and also Watcom 1.9, of the rare/old compilers + I checked. + + CMake had it permanently enabled, while it also did an extra check + for the header to add the lib to the lib list. Autotools did the + detection proper. Other builds had it permanently enabled. + + It seems safe to assume this function/header/lib is available in all + environments we support. + + In this patch we simplify by deleting these detections and feature + flags from all build tools. + + Keep the feature flag internal to `wincng.h`, and for extra safety add + the new macro `LIBSSH2_WINCNG_DISABLE_WINCRYPT` do disable it via + custom `CPPFLAGS`. + + WinCNG's other requirement is `bcrypt`. That also has been universally + available for a long time. Here the only known outlier is old/legacy + MinGW, which is missing support. + + [1] https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptdecodeobjectex + + Closes #916 + +- autotools: delete `src/libssh2.pc.in` reference [ci skip] + + Follow-up to 06f281921907fa077884c7020917661ca805b9d3 + +- tidy-up: null-mac/cipher documentation + + Move documentation for these deleted build-level options from + autotools/cmake docs to the source code itself. + + Follow-up to 50c9bf868e833258d23c5f55ed546d1fcd5687d0 + + Closes #915 + +- cmake: re-use existing `libssh2.pc` template + + Instead of maintaining a second copy of `libssh2.pc.in` in `src` just + for CMake, teach CMake to use the existing template in the root dir, + that we already use with autotools. + + Closes #914 + +- delete redundant `HAVE_STDLIB_H` + + libssh2 used this standard C89 header unconditionally before this patch. + + Delete the feature checks and all unnecessary header guards. + + Closes #913 + +- NMakefile: drop redundant variable and assignments [ci skip] + +- delete redundant `HAVE_WINSOCK2_H` + + `libssh2.h` required `winsock2.h` for `_WIN32` since + 81d53de4dc5ee39bd6215958c7dce3b12731195e (2011-06-04). + + Apply that to the whole codebase. This makes it unnecessary to detect + `HAVE_WINSOCK2_H` and allows to drop all its uses. + + Completes TODO from b66d7317ca6c882afbe52fe426f68c119c40d348 + + TODO: Straighten out the use a mixture of `HAVE_WINDOWS_H`, + `WIN32`, `_WIN32` to detect Windows. + +- cmake: detect WinCNG last + + This gives a chance to auto-detect mbedTLS on Windows with CMake. + +- NMakefile: rename config variables, default to WinCNG [ci skip] + + - replace `OPENSSLINC` and `OPENSSLLIB` with `OPENSSL_PATH`. + Assume `include` and `lib` subdirs for headers and libs. + + - replace `WITH_ZLIB`, `ZLIBINC` and `ZLIBLIB` with `ZLIB_PATH`. + Assume `include` and `lib` subdirs for header and lib. + + - make WinCNG the default if `WITH_OPENSSL` is not set. + +- win32/GNUmakefile: rename object dir and update .gitignore [ci skip] + + From `-{release|debug}` to `{release|debug}-`. + + Follow-up to 68fd02fba002c8c6af3ba51a2780de46b47b3787 + +- win32/GNUmakefile: add libgcrypt support [ci skip] + + In the previous commit 969487113aae856e43d3d905c3f2260246d44f9b, + the commit message should read `win32/GNUmakefile: ` instead of + `libssh2-gnumake.sh: `. Sorry for the mixup. + +- libssh2-gnumake.sh: make variable names platform-agnostic [ci skip] + + Also more consistent. Refer to DLL/SO/shared as 'dyn'. + + Also add comment on how to find customizable environment variables. + +- win32/GNUmakefile: make it support non-Windows builds [ci skip] + + With 20-ish extra lines, make this Makefile support all GCC-like + toolchains. + + The temporary directory becomes `-{release|debug}` from + the former `{release|debug}`. + + Also change the lib directory name in the `dist` package from + `win32` to `lib`, to match other packages and build tools. + +- win32/GNUmakefile: default to WinCNG [ci skip] + + Also check for wolfSSL before mbedTLS to match CMake. + +- win32/GNUmakefile: fixups to previous commit [ci skip] + + - `-lws2_32` is necessary when building examples. + + - drop a temporary variable. + + Follow-up to d245c66cc0029e480674394c23e8be1c9410f7ad + +- delete redundant `HAVE_WS2TCPIP_H` + + It was used once in `src/libssh2_priv.h`, but without any effect. + The header included `ws2tcpip.h` twice, once guarded by + `HAVE_WS2TCPIP_H` and another time by `HAVE_WINSOCK2_H`. + + Dedupe these to not use `HAVE_WS2TCPIP_H`. Then delete detection + of this feature from all build methods. + + TODO: Replace `HAVE_WINSOCK2_H` with `_WIN32`/`WIN32`. + +- win32/libssh2_config.h: set `HAVE_LONGLONG` & `HAVE_STDLIB_H` [ci skip] + + - enable `HAVE_LONGLONG` for MinGW and MSVC versions supporting it. + + Necessary for `GNUmakefile`/`NMakefile` builds to create the same + binaries as CMake/autotools ones do. + + - enable `HAVE_STDLIB_H`. It has been universally available on + Windows for a long time. + + Fixes these clang-cl warnings: + ``` + src\wincng.c(444,5) : warning: implicit declaration of function 'free' is invalid in C99 [-Wimplicit-function-declaration] + free(buf); + ^ + src\wincng.c(491,20) : warning: implicitly declaring library function 'malloc' with type 'void *(unsigned long long)' [-Wimplicit-function-declaration] + pbHashObject = malloc(dwHashObject); + ^ + src\wincng.c(491,20) : note: include the header or explicitly provide a declaration for 'malloc' + src\wincng.c(2106,14) : warning: implicitly declaring library function 'realloc' with type 'void *(void *, unsigned long long)' [-Wimplicit-function-declaration] + bignum = realloc(bn->bignum, length); + ^ + src\wincng.c(2106,14) : note: include the header or explicitly provide a declaration for 'realloc' + 3 warnings generated. + ``` + +- example: make `x11` exclusion build-tool-agnostic + + Whether to build the `x11` example or not was decided by each build + tool. CMake didn't build it even on supported platforms. GNUMakefile + used a specific blocklist for it, while autotools enabled it based on + feature-detection. + + Migrate the enabler logic to an #ifdef in source and build `x11` + unconditionally with all build tools. + + On unsupported platforms (=Windows) this program now displays a short + message stating that fact. + + Also: + + - fix `x11.c` warnings uncovered after CMake started building it. + + - use `libssh2_socket_t` type for portability in `x11.c` too. + + - use detected header guards in `x11.c`. + + - delete a duplicate reference to `-lws2_32` from `win32/GNUmakefile` + while there. + + Closes #909 + +- .gitignore updates [ci skip] + +- tidy-up: whitespace, sorting, comment and naming fixups + +- cmake: add missing man pages + +- cmake: dedupe and merge config detection + + Before this patch CMake did feature detections in three files: + `src/CMakefiles.txt`, `examples/CMakefiles.txt` and + `tests/CMakefiles.txt`. + + Merge and move them to the root `CMakefiles.txt`. + + After this patch we end up with a single `src/libssh2_config.h`. This + brings CMake in sync with autotools builds, which already worked with + a single config header. + + This also prevents mistakes where feature detection went out of sync + between `src` & `tests` (see ae90a35d15d97154ac0c8554bce99ebfb18ee825). + `tests` do compile sources from `src` directly, so these should always + be in sync. + + It also allows to better integrate hand-crafted, platform-specific + config headers into the builds, like the one currently residing in + the `win32` directory (and also in `vms` and `os400`). Subject to an + upcoming PR. + + Also fix a warning revealed after this patch made CMake correctly + enable `HAVE_GETTIMEOFDAY` for `example` programs. + + Closes #906 + +- cmake: dedupe crypto-backend detection + + Before this patch CMake did crypto-backend detection in both + `src/CMakefiles.txt` and `tests/CMakefiles.txt`. + + Merge them and move it to the root `CMakefiles.txt`. + + While here, also add zlib for OpenSSL. Necessary when using OpenSSL + builds with zlib enabled. + + Closes #905 + +- cmake: add missing #cmakedefines to src + + - `HAVE_MEMSET_S` missing since + 03092292597ac601c3f9f0c267ecb145dda75e4e (2018-08-02) + + - `HAVE_EXPLICIT_BZERO` and `HAVE_EXPLICIT_MEMSET` missing since + 00005682f7b9a1aa42be50e269056ea873637047 (2023-03-28) + +GitHub (31 Mar 2023) +- [Viktor Szakats brought this change] + + tidy-up: NMakefile (#903) + +Viktor Szakats (30 Mar 2023) +- GNUmakefile: adjust win32/.gitignore [ci skip] + +- build: delete references to deleted NMake files [ci skip] + + Follow-up to 057522bb0f15c10c33159e12899ecc60e40aa6ef + +GitHub (30 Mar 2023) +- [Viktor Szakats brought this change] + + NMakefile: merge them into a single file [ci skip] (#902) + + Also: + + - allow to override `AR` and `ARFLAGS`. + + - The extra `src` subdir in the target directory is no longer, to + simplify things. + + - gone the dynamically generated `objects.mk`. Now replaced with some + tricky logic to do that inline. + + - add necessary `LIBS` for WinCNG. (untested) + + Lightly tested via clang-cl. + +- [Viktor Szakats brought this change] + + maketgz: tidy-up [ci skip] (#901) + + - fix shellcheck warnings: + - use quotes + - use `$()` + - use `printf` (instead of calling perl). + - indent. + - copy/adapt header comment from curl to `maketgz`. + +- [Viktor Szakats brought this change] + + ci: flatten AppVeyor jobs, add debug builds (#900) + + This results in better job names (now including CPU), avoiding the + complex exception rules, and fine-tuning the order and variation of + these tests. + + Enable `LIBSSH2DEBUG` for two of the existing jobs. + +- [Viktor Szakats brought this change] + + ci: add VS2022 builds (incl. ARM64) to AppVeyor (#899) + + - add MSVS 2022 WinCNG builds for x64 and ARM64, + replacing MSVS 2013 WinCNG builds for x64 and x86. + + - add MSVS 2022 OpenSSL builds for x64. + + - fix a compiler warning uncovered by the new ARM64 build: + + ``` + tests\openssh_fixture.c(393,17): warning C4477: 'fprintf' : format string '%d' requires an argument of type 'int', but variadic argument 1 has type 'libssh2_socket_t' + tests\openssh_fixture.c(393,17): message : consider using '%lld' in the format string + tests\openssh_fixture.c(393,17): message : consider using '%Id' in the format string + tests\openssh_fixture.c(393,17): message : consider using '%I64d' in the format string + ``` + + - echo the actual CMake command-line. + + - cmake: echo the DLL filenames found by the OpenSSL DLL-finder + heuristics. + + - cmake: delete `libcrypto.dll` and `libssl.dll` names from the above + logic. + + I've added these in 19884e5055b6c65f0df93d7cc776a01c518a2f06. That + resulted in CMake picking up a rogue `libcrypto.dll` (with no + `libssl.dll` pair) from `C:\Windows\System32\` on the + `Visual Studio 2022` image, breaking tests. + + Turns out, OpenSSL v1.0.2 uses the "EAY" names, but let's not re-add + those either, because CMake mis-picks those up from + `C:/OpenSSL-Win64/bin/`, even while pointing `OPENSSL_ROOT_DIR` to a + v1.1.1 installation. + + - cmake: set `NO_DEFAULT_PATH` for OpenSSL DLL lookup to avoid picking + up all kinds of wrong DLLs. CMake considers not the first, but the + _last_ hit the valid one. This happened to be + `C:/Program Files/Meson/lib*-1_1.dll` when using the + `Visual Studio 2022` image. + + Ref: https://cmake.org/cmake/help/latest/command/find_file.html + + - cmake: leave two commented debug lines that will be useful next time + the DLL detection lookup goes wrong. + + Ref: https://cmake.org/cmake/help/latest/variable/CMAKE_FIND_DEBUG_MODE.html + + - on error, also dump `CMakeFiles/CMakeConfigureLog.yaml` if it exists + (requires CMake 3.26 and newer) + +- [Viktor Szakats brought this change] + + src: fix compiler warning on Darwin (#898) + + ``` + src/session.c:675:52: warning: implicit conversion loses integer precision: 'long' to '__darwin_suseconds_t' (aka 'int') [-Wshorten-64-to-32] + tv.tv_usec = (ms_to_next - tv.tv_sec*1000) * 1000; + ~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~ + ``` + +Viktor Szakats (29 Mar 2023) +- tidy-up: tabs to spaces in Makefile.am [ci skip] + + Follow-up to 2f16d8105c9491beb2a02b3081f4f1c2a224fa62 + +GitHub (29 Mar 2023) +- [Viktor Szakats brought this change] + + netware: delete support (#888) + + Last related commit happened 15 years ago. + NetWare had it last release in 2009. + + All links referenced from the make file are inaccessible. + +- [Viktor Szakats brought this change] + + wolfssl: add workaround for HMAC_Update() len arg difference (#897) + + It's `int` in wolfSSL. `size_t` in OpenSSL/quictls/LibreSSL/BoringSSL. + + Ref: https://github.com/wolfSSL/wolfssl/blob/ba47562d182e10e59813da012e0ab8ef20892231/wolfssl/openssl/hmac.h#L60-L61 + + /cc @wolfSSL + +- [Viktor Szakats brought this change] + + cmake: introduce variables for lib target names (#896) + + Make our CMake config more self-documenting by introducing variables + for the shared and static lib target names. Without this, it might be + non-trivial to find out which line is referring to a target name vs + libname, export name or other occurrences of `libssh2`. + + This allows to rename back the shared lib target name to the value used + before 4e2580628dd1f8dc51ac65ac747ebcf0e93fa3d1: + `libssh2_shared` -> `libssh2`, if necessary for compatibility. Notice: + before that patch, `libssh2` name referred to either the static or + shared lib, depending on build settings. + +- [Viktor Szakats brought this change] + + detect and use explicit_bzero() and explicit_memset() (#895) + + Also skip detecting these and `memset_s()` for Windows targets in CMake, + to save detection time. On Windows we always use `SecureZeroMemory()`. + +- [Viktor Szakats brought this change] + + ci: bump mbedtls (#894) + +- [Viktor Szakats brought this change] + + GNUmakefile: minor fix for DYN mode [ci skip] (#893) + + Follow-up to b8762c1003d97e109efa587bdc760ff9873949eb + +- [Viktor Szakats brought this change] + + build: delete MS Dev Studio build files (#891) + + Last updated in 2007. + + Also delete `VCPROJ` target remains (necessary files seem to have + been missing from the repo all along) for Visual Studio 2008. + +Viktor Szakats (28 Mar 2023) +- checksrc: fix reference in Makefile.am, update options [ci skip] + +GitHub (28 Mar 2023) +- [Viktor Szakats brought this change] + + build: delete native Watcom wmake support with Win32 (#889) + + CMake supports generating Watcom wmake files: + https://cmake.org/cmake/help/v3.1/generator/Watcom%20WMake.html + +- [Viktor Szakats brought this change] + + checksrc: update and fix warnings (#890) + + Update from: + https://github.com/curl/curl/blob/5fec927374e4d9553205d861f2dcb39ec78002cc/scripts/checksrc.pl + + - suppress these new checks: + + - EQUALSNULL: 320 warnings + - NOTEQUALSZERO: 142 warnings + - TYPEDEFSTRUCT: 16 warnings + + We can enabled them in the future. + + - fix all other new ones. + + - also fix whitespace in two `NMakefile` files. + +- [Viktor Szakats brought this change] + + tidy-up: fix/update URLs (#887) + +- [Viktor Szakats brought this change] + + tidy-up: fix typos (#886) + + detected by codespell 2.2.4. + +- [Viktor Szakats brought this change] + + tidy-up: replace tabs and other whitespace (#885) + + There are a few non-whitespace changes, see them here: + https://github.com/libssh2/libssh2/pull/885/files?w=1 + +- [Viktor Szakats brought this change] + + ci: drop cmake --parallel (#884) + + `--parallel 2` did not seem to make builds faster. Neither did 4 or 6. + + Delete this option from both GHA and AppVeyor jobs. + + On AppVeyor, with VS, it uses MSBuild under the hood where apparently + `--parallel` doesn't do much [1]. The suggested MSBuild-specific option + `/p:CL_MPcount=2` did not improve build times either. + + CMake spends significant time (comparable to building the project + itself) on feature detection, it'd be nice to execute those in parallel, + but I found not such CMake option. + + [1] https://discourse.cmake.org/t/parallel-does-not-really-enable-parallel-compiles-with-msbuild/964 + + Partial revert of 7a039d9a7a2945c10b4622f38eeed21ba6b4ec55 + +- [Viktor Szakats brought this change] + + rework how to enable insecure null-cipher/null-MAC (#873) + + Null-cipher and null-MAC are security footguns we want to avoid. + + Existing option names to toggle these were ambiguous and gave room for + misinterpretation. Some projects may have had these options enabled by + accident. + + This patch aims to make it more difficult to enable them, and making + sure that existing methods require an update to stay enabled. + + - delete CMake/autotools settings to enable the "none" cipher and MAC. + + - rename existing C macros that can enable them. + + To use them, pass them as custom `CPPFLAGS` to the build. + + - enable them only if `LIBSSH2DEBUG` is also enabled. + + Best would be to delete them, though they may have some use while + developing libssh2 itself, or debugging. + +- [Viktor Szakats brought this change] + + delete old gex (SSH2_MSG_KEX_DH_GEX_REQUEST_OLD) build option (#872) + + libssh2 supports an "old" style KEX message + `SSH2_MSG_KEX_DH_GEX_REQUEST_OLD`, as an off-by-default build option. + + OpenSSH deprecated/disabled this feature in v6.9 (2015-07-01): + https://www.openssh.com/releasenotes.html#6.9 + + This patch deletes this obsolete feature from libssh2, with no option + to enable it. + + Added to libssh2 in: cf8ca63ea0c9388c8ae9079961d7e6a91b72b5c8 (2004-12-31) + RFC: https://datatracker.ietf.org/doc/html/rfc4419 (2006-03) + +- [Viktor Szakats brought this change] + + src: more tolerant snprintf() local override (#881) + + `#undef snprintf` before redefining it, when `HAVE_SNPRINTF` is not + defined, even though `snprintf` is available and it should have been. + Possibly with 3rd party builds. + + Downside is that cases of missing `HAVE_SNPRINTF` are less trivially + detected at compile-time. + +- [Viktor Szakats brought this change] + + ci: fix cmake warning with AppVeyor WinCNG builds (#883) + + ``` + CMake Warning: + Manually-specified variables were not used by the project: + + OPENSSL_ROOT_DIR + ``` + + Follow-up to 0834b9bcc85b90c78afff103f909b5a909b95e45 + +- [Viktor Szakats brought this change] + + ci: cmake `ENABLE_WERROR` -> `ON` (#877) + + Consider warnings as errors for CMake jobs in CI. + +Viktor Szakats (26 Mar 2023) +- src: silence compiler warnings 4 (alignment in WinCNG) + + Silence alignment warnings in WinCNG, by reworking the code. + + Also add two unrelated casts to avoid gcc compiler warnings + in surrounding code. + + `increases required alignment from 1 to 4 [-Wcast-align]` + `increases required alignment from 1 to 8 [-Wcast-align]` + + See warning details in the PR's individual commits. + + Reviewed-by: Marc Hörsken in + Cherry-picked from #846 + Closes #880 + +- src: silence compiler warnings 3 (change types) + + Apply type changes to avoid casts and warnings. In most cases this + means changing to a larger type, usually `size_t` or `ssize_t`. + + Change signedness in a few places. + + Also introduce new variables to avoid reusing them for multiple + purposes, to avoid casts and warnings. + + - add FIXME for public `libssh2_sftp_readdir_ex()` return type. + + - fix `_libssh2_mbedtls_rsa_sha2_verify()` to verify if `sig_len` + is large enough. + + - fix `_libssh2_dh_key_pair()` in `wincng.c` to return error if + `group_order` input is negative. + + Maybe we should also reject zero? + + - bump `_libssh2_random()` size type `int` -> `size_t`. Add checks + for WinCNG and OpenSSL to return error if requested more than they + support (`ULONG_MAX`, `INT_MAX` respectively). + + - change `_libssh2_ntohu32()` return value `unsigned int` -> `uint32_t`. + + - fix `_libssh2_mbedtls_bignum_random()` to check for a negative `top` + input. + + - size down `_libssh2_wincng_key_sha_verify()` `hashlen` to match + Windows'. + + - fix `session_disconnect()` to limit length of `lang_len` + (to 256 bytes). + + - fix bad syntax in an `assert()`. + + - add a few `const` to casts. + + - `while(1)` -> `for(;;)`. + + - add casts that didn't fit into #876. + + - update `docs/HACKING-CRYPTO` with new sizes. + + May need review for OS400QC3: /cc @monnerat @jonrumsey + + See warning details in the PR's individual commits. + + Cherry-picked from #846 + Closes #879 + +- src: silence compiler warnings 2 (ZLIB interface) + + Silence warnings in the ZLIB interface by adding casts and changing + types. + + See PR for individual commits. + + Cherry-picked from #846 + Closes #878 + +- src: silence compiler warnings 1 + + Most of the changes aim to silence warnings by adding casts. + + An assortment of other issues, mainly compiler warnings, resolved: + + - unreachable code fixed by using `goto` in + `publickey_response_success()` in `publickey.c`. + + - potentially uninitialized variable in `sftp_open()`. + + - MSVS-specific bogus warnings with `nid_type` in `kex.c`. + + - check result of `kex_session_ecdh_curve_type()`. + + - add missing function declarations. + + - type changes to fit values without casts: + - `cmd_len` in `scp_recv()` and `scp_send()`: `int` -> `size_t` + - `Blowfish_expandstate()`, `Blowfish_expand0state()` loop counters: + `uint16_t` -> `int` + - `RECV_SEND_ALL()`: `int` -> `ssize_t` + - `shell_quotearg()` -> `unsigned` -> `size_t` + - `sig_len` in `_libssh2_mbedtls_rsa_sha2_sign()`: + `unsigned` -> `size_t` + - `prefs_len` in `libssh2_session_method_pref()`: `int` -> `size_t` + - `firstsec` in `_libssh2_debug_low()`: `int` -> `long` + - `method_len` in `libssh2_session_method_pref()`: `int` -> `size_t` + + - simplify `_libssh2_ntohu64()`. + + - fix `LIBSSH2_INT64_T_FORMAT` for MinGW. + + - fix gcc warning by not using a bit field for + `burn_optimistic_kexinit`. + + - fix unused variable warning in `_libssh2_cipher_crypt()` in + `libgcrypt.c`. + + - fix unused variables with `HAVE_DISABLED_NONBLOCKING`. + + - avoid const stripping with `BIO_new_mem_buf()` and OpenSSL 1.0.2 and + newer. + + - add a missing const in `wincng.h`. + + - FIXME added for public: + - `libssh2_channel_window_read_ex()` `read_avail` argument type. + - `libssh2_base64_decode()` `datalen` argument type. + + - fix possible overflow in `sftp_read()`. + + Ref: 4552c73cd58fccb1fc49cb0f25f86619133e560f + + - formatting in `wincng.h`. + + See warning details in the PR's individual commits. + + Cherry-picked from #846 + Closes #876 + +GitHub (24 Mar 2023) +- [Viktor Szakats brought this change] + + cmake: automatic exports macro tidy-up (#875) + + In a recent CMake update I left the original CMake EXPORTS macro + unchanged (`libssh2_EXPORTS`) for compatibility. + + However, that macro was also recently added [1] and not present in an + official release yet, so we might as well just use the new native one + instead (`libssh2_shared_EXPORTS`), defined by CMake automatically. + This way we don't need to define the old macro manually. + + CMake forms this macro from the lib's internal name as defined in + `add_library()` by appending `_EXPORTS`. That target name changed from + `libssh2` to `libssh2_shared` after introducing dual shared + static + builds in the recent update. + + If we're here, add a new, stable, build-tool agnostic macro with the + same effect, for non-CMake use: `LIBSSH2_EXPORTS` + + [1] 1f0fe7443a1ecddd320f2c693607b2afee9bbe2f (2021-10-26) + + Follow-up to 4e2580628dd1f8dc51ac65ac747ebcf0e93fa3d1 + +- [Viktor Szakats brought this change] + + maketgz: add .xz, .bz2, .zip source archive formats (#874) + + Copied from curl: + https://github.com/curl/curl/blob/4528690cd51e5445df74aef8f83470a602683797/maketgz#L174-L222 + + [ci skip] + +Viktor Szakats (23 Mar 2023) +- dist: delete reference to recently deleted file [ci skip] + + Follow-up to b8762c1003d97e109efa587bdc760ff9873949eb + +GitHub (23 Mar 2023) +- [Viktor Szakats brought this change] + + cmake: separate compilation passes for shared/static (#871) + + Before this patch, cmake did a single compilation pass when we enabled + both shared and static lib targets. This saves build time (esp. with + MinGW targets and cross-compiling), but has the disadvantage that static + libs built this way must have PIC enabled (offering slightly less + performance) and `dllexport` enabled also, which means that executables + linking the static libssh2 lib export its public symbols. + + To avoid these downsides, this patch separates the two passes and + creates a non-PIC, non-`dllexport` static lib, even when also building + the shared lib. + +- [Viktor Szakats brought this change] + + ci: test with OpenSSL v1.1.1 on AppVeyor (#870) + + Was: v1.0.2. + + Keep using v1.0.2 with the static-only test. To make sure we don't break + support. + +- [Viktor Szakats brought this change] + + ci: speed up static-only build tests on AppVeyor (#868) + + - limit static-only build to a single platform (x64). + + - skip running ctest for the static-only build. + + - use MSVS 2013 for static-only builds. It's faster. + + - run static-only test before WinCNG ones. Otherwise it's often skipped + due to WinCNG failures (#804). + +- [Viktor Szakats brought this change] + + cmake: fix error with static lib off and example/tests on (#869) + + Regression from 4e2580628dd1f8dc51ac65ac747ebcf0e93fa3d1 + +- [Viktor Szakats brought this change] + + ci: parallelize more (#867) + +- [Viktor Szakats brought this change] + + cmake/src: move build options before target definitions (#864) + + To allow more flexibility when defining targets. + +- [Viktor Szakats brought this change] + + ci: use static+shared builds to cut number of cmake jobs (#865) + + With CMake builds supporting static-shared libssh2 builds in a single + pass, we no longer need to run static and shared jobs separately. For + the same effect it's enough to run builds with both shared and static + builds enabled. Halving CI jobs. + + We add an extra run to test the CMake config-path without shared builds + enabled. + + This allows to add useful jobs, e.g. MSVS 2022 or ZLIB-enabled builds + for Windows, valgrind builds or other useful stuff, without stretching + CI run times further. + + Ref: #863 + +Viktor Szakats (22 Mar 2023) +- cmake: allow building static + shared libs in a single pass + + - `BUILD_SHARED_LIBS=ON` no longer disables building static lib. + + When set, we build the static lib with PIC enabled. + + For shared lib only, set `BUILD_STATIC_LIBS=OFF`. For static lib + without PIC, leave this option disabled. + + - new setting: `BUILD_STATIC_LIBS`. `ON` by default. + + Force-enabled when building examples or tests (we build those in + static mode always.) + + - fix to exclude Windows Resource from the static lib. + + - fix to not overwrite static lib with shared implib on Windows + platforms using identical suffix for them (MSVS). By using + `libssh2_imp<.ext>` implib filename. + + - add support for `STATIC_LIB_SUFFIX` setting to set an optional suffix + (e.g. `_static`) for the static lib. (experimental, not documented). + Overrides the above when set. + + - fix to set `dllexport` when building shared lib. + + - set `TrackFileAccess=false` for MSVS. + + For faster builds, shorter verbose logs. + + - tests: new test linking against shared libssh2: `test_warmup_shared` + + - tests: simplify 'runner' lib by merging 3 libs into a single one. + + - tests: drop hack from `test_keyboard_interactive_auth_info_request` + build. + + We no longer need to compile `src/misc.c` because we always link + libssh2 statically. + + - tests: limit `FIXTURE_WORKDIR=` to the `runner` target. + + TL;DR: Default behavior unchanged: static (no-PIC), no shared. + Enabling shared unchanged, but now also builds a static (PIC) + lib by default. + + Based-on: b60dca8b6450a9729670986d2899cca54ccdbb6d #547 by berney on github + Fixes: #547 + Fixes: #675 + Closes: #863 + +- include: silence warnings with casts in public `libssh2_sftp.h` + + Avoid triggering warnings in macros coming from public libssh2 headers. + + Cherry-picked from: #846 + Closes #862 + +- example, tests: address compiler warnings + + Fix or silence all C compiler warnings discovered with (or without) + `PICKY_COMPILER=ON` (in CMake). This means all warnings showing up in + CI (gcc, clang, MSVS 2013/2015), in local tests on macOS (clang 14) and + Windows cross-builds using gcc (12) and llvm/clang (14/15). + + Also fix the expression `nread -= nread` in `sftp_RW_nonblock.c`. + + Cherry-picked from: #846 + Closes #861 + +- openssl: require `EVP_aes_128_ctr()` support + + libssh2 built with OpenSSL and without its `EVP_aes_128_ctr()`, aka + `HAVE_EVP_AES_128_CTR`, option are working incorrectly. This option + wasn't always auto-detected by autotools up until recently (#811). + Non-cmake, non-autotools build methods never enabled it automatically. + + OpenSSL supports this options since at least v1.0.2, which is already + EOLed and considered obsolete. OpenSSL forks (LibreSSL, BoringSSL) + supported it all along. + + In this patch we enable this option unconditionally, now requiring + OpenSSL supporting this function, or one of its forks. + + Also modernize OpenSSL lib references to what 1.0.2 and newer versions + have been using. + + Fixes #739 + +- wincng: fix memory leak in `_libssh2_dh_secret()` + + Patch-by: iruis on github + Assisted-by: Marc Hörsken + Bug #846, commit e3487092ef9553af67633c6747cb9ab2f86465e0. + Fixes #856 + Closes #858 + +GitHub (19 Mar 2023) +- [Viktor Szakats brought this change] + + nw, os400, watcom: stop setting unused macros [ci skip] (#859) + +Viktor Szakats (19 Mar 2023) +- cmake: fix `ENABLE_WERROR=ON` breaking auto-detections + + - cmake: fix compiler warnings in `CheckNonblockingSocketSupport`. + detection functions. + + Without this, these detections fail when `ENABLE_WERROR=ON`. + + - cmake: disable ENABLE_WERROR for MSVC during symbol checks in `src`. + + CMake's built-in symbol check function `check_symbol_exists()` + generate warnings with MSVC. With warnings considered errors, these + detections fail permanently. Our workaround is to disable + warnings-as-errors while running these checks. + + ``` + CheckSymbolExists.c(8): warning C4054: 'type cast': from function pointer '__int64 (__cdecl *)(const char *,char **,int)' to data pointer 'int *' + in `return ((int*)(&strtoll))[argc];` + ``` + + Ref: https://ci.appveyor.com/project/libssh2org/libssh2/builds/46537222/job/4vg4yg333mu2lg9b + + - example: replace `strcasecmp()` with C89 `strcmp()`. + + To avoid using CMake symbol checks in `example`. + + Another option is to duplicate the `check_symbol_exists()` workaround + from `src`, but I figure it's not worth the complexity. We use + `strcasecmp()` solely to check optional command-line options for + example programs, and those are fine as lower-case. + + Without this, these detections fail when `ENABLE_WERROR=ON`. + + - also delete `__function__` detection/use in `example`. + + To avoid the complexity for the sake of using it at a single place in + of the example's error branch. Replace that use with a literal name of + the function. + + - cmake: also use `CMakePushCheckState` functions instead of manual + save/restore. + + Closes #857 + +- build: improve a test build workaround with bcrypt + + - cmake: extend workaround for linking a test with shared libssh2. + + One of the tests uses internal libssh2 functions, and with CMake it + compiles `src/misc.c` directly for this. `misc.c` references bcrypt / + blowfish code. This needs a workaround for build configs where libssh2 + doesn't export these. + + Before this patch, we enabled this workaround for MSVC. + + In the patch we extend this to all Windows. There is no CI test for + this, but gcc and llvm/clang + mingw64 builds also need it. This may + well apply to other configurations (it should, as shared libs are not + supposed to export internal functions), so also make it easy to enable + it at a single point. + + [ autotools builds force-link this one test against static libssh2. ] + + - make `misc.c` not depend on bcrypt. + + By moving out our `bcrypt_pbkdf()` wrapper into `bcrypt_pbkdf.c` + itself. + + This allows to compile `misc.c` into tests without pulling in bcrypt / + blowfish functions, and simplify the above workaround. + + Source code uses `HAVE_BCRYPT_PBKDF`, a leftover from original bcrypt + source. We never define this inside libssh2. Defining it breaks the + build, and this patch doesn't change that. + + - make `bcrypt_pbkdf()` static. + + While here, make the low-level `bcrypt_pbkdf()` function static to + avoid namespace pollution. + + Closes #855 + +GitHub (17 Mar 2023) +- [Viktor Szakats brought this change] + + ci: more timeout adjustments (#853) + + - add timeout to SSH connection wait loop in AppVeyor test prep. + (2 minutes) + + - switch to per-step timeout for GitHub CI cmake/ctest runs. + (10 minutes) + + ctest timeout (of 450 seconds) didn't seem to make any difference. + +Viktor Szakats (17 Mar 2023) +- ci: set timeout to ctest and GitHub CI jobs + + - `ctest` shows a the default timeout '10000000' (turns out to be + in seconds), cause infinite waits e.g. in case the necessary server + worker is not available. + + CMake CI tests take approx: + - GitHub / Linux : 125 seconds + - AppVeyor / Windows: 300 seconds + + New timeouts are: 450 and 900 seconds respectively. + + - set timeouts for style-check, fuzz, Linux and Windows GitHub CI + jobs to avoid hanging forever. + + Also: + + - move `choco install` to before_test to make builds start faster + in `appveyor.yml`. + + - fix some yamllint `ON`/`OFF`-confusion issue by quoting these + values in `appveyor.yml`. + + - fix indentation in `appveyor.yml`. + + - convert to GitHub workflows to LF line-ending. + + Ref: https://github.com/libssh2/libssh2/pull/655#issuecomment-1472853493 + + Closes #851 + +GitHub (17 Mar 2023) +- [Viktor Szakats brought this change] + + ci: update mbedTLS repo URL, delete Travis CI (#850) + + Last Travis CI session run on 2021-11-18. + + Ref: https://app.travis-ci.com/github/libssh2/libssh2 + Ref: https://travis-ci.org/github/libssh2/libssh2/builds + +- [Viktor Szakats brought this change] + + appveyor.yml: reorder tests to return relevant feedback earlier (#849) + + - build x64 first + + x64 is the more interesting target. Most type conversion issues are + revealed here. Also more commonly used by now. + + - test VS 2013 earlier + + - test WinCNG earlier + + - delete reference to no longer used VS 2008 + + After this patch we end up starting with all Shared builds (2015, 2013, + OpenSSL, WinCNG), then continue with Static ones. Shared/Static makes + a minor if any difference in builds/tests compared to different VS + versions of TLS backends. + + -- + + CI run times: + + Preparation + build takes: + 8 x VS2015 4.5 mins -> total: 36 + 8 x VS2013 2 mins -> total: 16 + Total: 52 mins + + with our 30 tests, it increases to: + 8 x VS2015 8-10 mins -> total: 72 + 8 x VS2013 6- 9 mins -> total: 60 + Total: 132 mins + + Without tests: https://ci.appveyor.com/project/libssh2org/libssh2/builds/46475315 + With tests: https://ci.appveyor.com/project/libssh2org/libssh2/builds/46480549 + +Dan Fandrich (14 Mar 2023) +- src: check for NULL pointer passed to _libssh2_get_string + + Callers should be protecting against this, but it's prudent to check + here anyway. + + Fixes #802 + Closes #848 + +Viktor Szakats (14 Mar 2023) +- appveyor.yml: choco install improvements [ci skip] + + - avoid outputting 4000 log lines by hiding the progress bar. + Reduces log size by 5x. + + - decrease timeout (from the default 2700 seconds). + + - omit unnecessary output. + + Tested as part of #846 + +GitHub (14 Mar 2023) +- [Jakob Egger brought this change] + + build: update instructions for autoreconf (#847) + + The "convenience script" talks about the "buildconf" file, + which is no longer recommended. + +- [Viktor Szakats brought this change] + + win32: set HAVE_STRTOLL with MSVS 2013 and newer (#845) + + As in curl: + https://github.com/curl/curl/blob/7fa6e36583b52dd8f1e639b370c9a2849be81b54/lib/config-win32.h#L221 + +- [Viktor Szakats brought this change] + + GNUmakefile: move HAVE_STRTOLL to libssh2_config.h [ci skip] (#844) + +- [Viktor Szakats brought this change] + + src: silence unused variable warnings (#843) + +Viktor Szakats (13 Mar 2023) +- GNUmakefile: add wolfSSL support + major rework + + - add wolfSSL support. + - reduce size and redundant logic. + - fix a bunch of small issues. + - rework configuration, now with: `CC`, `AR`, `RC`, `TRIPLET`, `CFLAGS`, + `CPPFLAGS`, `LDFLAGS`, `RCFLAGS`, `LIBS`, `LIBSSH2_DLL_SUFFIX`, + `LIBSSH2_LDFLAGS_LIB`, `LIBSSH2_LDFLAGS_BIN` (and more). + - merge examples build into the main Makefile. + - relative dependency paths are now the same for building libssh2 or + examples. + - drop detection for obsolete OpenSSL versions (can be configure via new + `OPENSSL_LIBS`). + - merge dev/dist distribution zip options. + - build libssh2 with `-DHAVE_STRTOLL`. + - tidy-up. + - build examples in static mode by default (use `DYN` to build them in + shared mode). + - drop forced (in non-debug mode) `-O2`. + - drop Win9x support. + - deprecate `ARCH` in favour of custom options and `TRIPLET`. + - drop Windows resources from examples for simplicity + - drop `WITH_ZLIB`. Default `ZLIB_PATH` to enable zlib support. + - drop `LIBSSH2_DLL_A_SUFFIX`, use standard value `.dll` (as in + `libssh2.dll.a`). + - always link `bcrypt` (for LibreSSL and OpenSSL) and `crypt32` + (for wolfSSL). + - unhide executed build commands. + - fix mbedTLS `lib` path + - drop specific options to force static linking. Custom options seems + a better way for this. + - based on similar work made for curl: + https://github.com/curl/curl/commit/a8861b6ccdd7ca35b6115588a578e36d765c9e38 + + Closes #842 + +GitHub (13 Mar 2023) +- [Viktor Szakats brought this change] + + wincng: fix memory leak in libssh2_dh_key_pair() (#829) + + Fixes #722 + +- [Viktor Szakats brought this change] + + src: C89-compliant _libssh2_debug() macro (#831) + + Before this patch, with debug logging disabled, libssh2 code used a + variadic macro to catch `_libssh2_debug()` calls, and convert them to + no-ops. In certain conditions, it used an empty inline function instead. + + Variadic macro is a C99 feature. It means that depending on compiler, + and build settings, it littered the build log with warnings about this. + + The new solution uses the trick of passing the variable arg list as a + single argument and pass that down to the debug function with a regular + macro. When disabled, another regular C89-compatible macro converts it + to a no-op. + + This makes inlining, C99 variadic macros and maintaining the conditions + for each unnecessary and also makes the codebase compile more + consistently, e.g. with forced C standards and/or picky warnings. + + TL;DR: It makes this feature C89-compliant. + +- [Viktor Szakats brought this change] + + openssl: fix possible compiler warning in macro condition (#839) + + Building with wolfSSL or pre-OpenSSL v1.1.1 triggered it. + + ``` + ../src/openssl.h:130:5: warning: 'LIBRESSL_VERSION_NUMBER' is not defined, evaluates to 0 [-Wundef] + LIBRESSL_VERSION_NUMBER >= 0x3070000fL + ^ + ``` + + Regression from 2e2812dde8c1fc9b48eca592823770ab2e601f7a + +- [Viktor Szakats brought this change] + + GNUmakefile: cleanups [ci skip] (#840) + + - indent + - sync `test/GNUmakefile` with main + - delete `RANLIB` + - use `else if` + - use more `?=` + - use ASCII-7 copyright symbol (in test) + +- [Viktor Szakats brought this change] + + win32: convert tabs to spaces [ci skip] (#838) + + Also strip stray newlines from `win32/rules.mk`. + +- [Viktor Szakats brought this change] + + ci: retry choco install on appveyor (#837) + + Trying to mitigate occasional intermittent failures while installing + docker. + + Ref: https://ci.appveyor.com/project/libssh2org/libssh2/builds/46460704/job/g3t7bro6ta6n3pk6#L52 + +- [Viktor Szakats brought this change] + + cmake: drop unnecessary exception for warmup build (#835) + +- [Viktor Szakats brought this change] + + cmake: reflect minimum version in docs (#834) + + Follow-up to 505ea626b6e125b7ce15caf453b522192008a884 + +- [Viktor Szakats brought this change] + + cmake: add wolfSSL support to tests (#833) + + wolfSSL supports building with zlib as a dependency, that's the reason + for the ZLIB logic in the patch. + + Also add it to `docs/INSTALL_CMAKE.md` and to the help text in + `src/CMakeLists.txt`. + + Running tests not actually tested. + + Follow-up to 9f217a17f6f3c2047c4a1668a5c037a75a02abfd + + Ref: #817 + +- [Viktor Szakats brought this change] + + tests: workaround for intermittent first test failures (#832) + + Flakiness got continously worse these last days. It didn't seem related + to recent commits. Flakiness also picked up in GitHub CI runs, something + rarely seen before. Manual restart consistently fixed them. + + The repeating pattern was the _first_ test (`test_hostkey`) failing, + with `libssh2_session_handshake failed (-13): Failed getting banner`. + Failures came after a lengthy wait, suggesting a timeout. + + I then reversed the order of the first two tests, and it turned out that + the _first_ test failed again (`test_hostkey_hash`). Also pointing to a + timeout issue. + + Then I added a dummy test to "warm up" whatever needs warming up in the + layers of CI + Docker + ssh server and their interconnects. This helped, + and GitHub CI tests run without failure right for the first time. + AppVeyor CI also improved a little. + + This patch adds a new first test called `test_warmup`, that creates a + new libssh2 session, and exits with success even if that attempt failed. + + A stop-gap solution at best, and there is no guarantee it will continue + to fix this or similar future issues, but it's also untenable to have + almost every CI run fail for intermittent reasons. + + In some [1] cases [2] it's not the first test failing intermittently. + That's a different issue, and this patch doesn't fix it. + + [1] #804 + [2] https://ci.appveyor.com/project/libssh2org/libssh2/builds/46440828/job/8rej6cq6itg7vc4w#L500 + +- [Viktor Szakats brought this change] + + cmake: detect HAVE_SNPRINTF for tests (#830) + + Turns out `test_keyboard_interactive_auth_info_request.c` requires + `src/libssh2_priv.h`, which in turn requires a correctly set + `HAVE_SNPRINTF`. + + Follow-up to 4cdf785cd313c3272d04c2ef7458a35d44533d8b. + +- [Viktor Szakats brought this change] + + cmake: unset forced CMAKE_C_STANDARD 90 (#822) + + Added in cf80f2f4b5255cc85a04ee43b27a29c678c1edb1 (on 2016-08-14), + with the title "Basic dockerised test suite". + + It's not clear why a C standard was explicitly set, but a side-effect + of this is that CMake-built binaries diverged from ones built with + autotools or GNU Make (using the same compiler and configuration). + + Another issue is that this may introduce ABI incompatibility with + binaries built with a different C standard flag, e.g. the C compiler + default or one used for other components of a final app. + + Seems unlikely, but if our tests require this option, we should set it + for the CI builds only? + +- [Viktor Szakats brought this change] + + example: silence MSVS 2013 C4127 warnings (#828) + +- [Viktor Szakats brought this change] + + cmake: reposition ws2_32 to make binutils ld work again (#827) + + This restores socket libs to their pre-regression positions. + + Without this, `ld` doesn't find `ws2_32` symbols when referenced + from TLS libs. + + Regression from 31fb8860dbaae3e0b7d38f2a647ee527b4b2a95f + +- [Viktor Szakats brought this change] + + fix compiling with LIBSSH2_NO_CLEAR_MEMORY and OpenSSL (#825) + + Regression from a0e424a51c27cc27af611ba20d134f9a9ae35273 + + Fixes #824 + +- [Viktor Szakats brought this change] + + snprintf: add missing prototype for local replacement (#820) + + Should fix these warnings with MSVS 2013 and older: + `agent.c(294): warning C4013: '_libssh2_snprintf' undefined; assuming extern returning int` + + Follow-up to 4cdf785cd313c3272d04c2ef7458a35d44533d8b. + +- [Viktor Szakats brought this change] + + build: set _FILE_OFFSET_BITS=64 for mingw-w64 (#821) + + autotools builds already did auto-detect and set this mingw-specific + macro, but CMake and GNU Make builds did not. This patch fixes that. + + Necessary for `src/scp.c`. + +- [Viktor Szakats brought this change] + + cmake: add os400qc3.c to SOURCES (#826) + + This re-syncs the list of compiled objects in cmake builds with + non-cmake builds. + + Follow-up to 16619a8eddec35bb8582d1c334db0fc13b0817c4. + +- [Viktor Szakats brought this change] + + build: silence bogus C4127 warnings with MSVS 2013 and earlier (#819) + + E.g.: + `channel.c(370): warning C4127: conditional expression is constant` + Ref: + https://ci.appveyor.com/project/libssh2org/libssh2/builds/46437333/job/5rak1vcl9hue31ei#L190 + +- [Viktor Szakats brought this change] + + cmake: use only needed socket libs when checking non-blocking sockets (#816) + + Based on patch by Christian Beier. + + Fixes #694 + Closes #712 + +- [Viktor Szakats brought this change] + + cmake: update openssl dll list (#818) + + Add OpenSSL 3 and versionless DLL names. Also modernize warning messages + and variable names. + + Do we need the OpenSSL-Windows-specific check and the related + `RUNTIME_DEPENDENCIES` feature? The list of OpenSSL DLLs was out of date + for 1.5 years without anybody noticing. Keeping it fresh is a chore and + copying around DLL dependencies rarely helps as much as expected. This + check also results in unuseful warnings in certain build scenarios, e.g. + when linking to OpenSSL statically. + +- [Viktor Szakats brought this change] + + cmake: add wolfSSL support (#817) + + Implement wolfSSL support for libssh2 when building with CMake. + + Configuration example from curl-for-win: + ``` + -DCRYPTO_BACKEND=wolfSSL + -DWOLFSSL_LIBRARY=/path-to/wolfssl/lib/libwolfssl.a + -DWOLFSSL_INCLUDE_DIR=/path-to/wolfssl/include + ``` + + Module `cmake/Findwolfssl.cmake` copied from: + https://github.com/ngtcp2/ngtcp2/blob/e4d920c4b7a350d63b6978c68b216b76faa12635/cmake/Findwolfssl.cmake + via commit: + https://github.com/ngtcp2/ngtcp2/commit/296396d3730b721ad97f9de22f525400f8524c0e + by Stefan Eissing + +- [Viktor Szakats brought this change] + + cmake: restore non-Windows socket lib detection (#815) + + I mistakenly pruned some non-Windows logic, also missing the fact that + our local `check_function_exists_may_need_library()` set the `NEED_*` + variables. Oddly, only `src` imported this function, yet also `examples` + and `tests` called it indirectly. The referenced `HAVE_SOCKET` / + `HAVE_INET_ADDR` variables might be coming from an upstream CMake + project? Leaving those there also, just in case. + + Regression from 31fb8860dbaae3e0b7d38f2a647ee527b4b2a95f + +Viktor Szakats (7 Mar 2023) +- build: more fixes and tidy-up (mostly for Windows) + + - cmake: always link `ws2_32` on Windows. Also add it to `libssh2.pc`. + + Fixes #745 + + - agent: fix gcc compiler warning: + `src/agent.c:296:35: warning: 'snprintf' output truncated before the last format character [-Wformat-truncation=]` + + - autotools: fix `EVP_aes_128_ctr` detection with binutils `ld` + + The prerequisite for a successful detection is setting + `LIBS=-lbcrypt` if the chosen openssl-compatible library requires + it, e.g. libressl, or quictls/openssl built with + `-DUSE_BCRYPTGENRANDOM`. + + With llvm `lld`, detection works out of the box. With binutils `ld`, + it does not. The reason is `ld`s world-famous pickiness with lib + order. + + To fix it, we pass all custom libs before and after the TLS libs. + This ugly hack makes `ld` happy and detection succeed. + + - agent: fix Windows-specific warning: + `src/agent.c:318:10: warning: implicit conversion loses integer precision: 'LRESULT' (aka 'long long') to 'int' [-Wshorten-64-to-32]` + + - src: fix llvm/clang compiler warning: + `src/libssh2_priv.h:987:28: warning: variadic macros are a C99 feature [-Wvariadic-macros]` + + - src: support `inline` with `__GNUC__` (llvm/clang and gcc), fixing: + ``` + src/libssh2_priv.h:990:8: warning: extension used [-Wlanguage-extension-token] + static inline void + ^ + ``` + + - blowfish: support `inline` keyword with MSVC. + + Also switch to `__inline__` (from `__inline`) for `__GNUC__`: + https://gcc.gnu.org/onlinedocs/gcc/Inline.html + https://clang.llvm.org/docs/UsersManual.html#differences-between-various-standard-modes + + - example/test: fix MSVC compiler warnings: + + - `example\direct_tcpip.c(209): warning C4244: 'function': conversion from 'unsigned int' to 'u_short', possible loss of data` + - `tests\session_fixture.c(96): warning C4013: 'getcwd' undefined; assuming extern returning int` + - `tests\session_fixture.c(100): warning C4013: 'chdir' undefined; assuming extern returning int` + + - delete unused macros: + - `HAVE_SOCKET` + - `HAVE_INET_ADDR` + - `NEED_LIB_NSL` + - `NEED_LIB_SOCKET` + - `HAVE_NTSTATUS_H` + - `HAVE_NTDEF_H` + + - build: delete stale zlib/openssl version numbers from path defaults. + + - cmake: convert tabs to spaces, add newline at EOFs. + + Closes #811 + +- cmake: make `test_read` runs cross-build-friendly + + Improve tests added in 7487dcf4b4ddae54b2a850737789b57b4251b0ae by + running `test_read` commands directly. This makes external shell/batch + files unnecessary, and is friendlier with cross-builds and when run + from non-default shells, like MSYS2. + + Also extend CRYPT/MAC test error messages with the CRYPT/MAC name. + + External runner shell scripts kept for future use. + + Closes #814 + +- src: enable clear memory on all platforms + + - convert `_libssh2_explicit_zero()` to macro. This allows inlining + where supported (e.g. `SecureZeroMemory()`). + + - replace `SecureZeroMemory()` (in `wincng.c`) and + `LIBSSH2_CLEAR_MEMORY`-guarded `memset()` (in `os400qc3.c`) with + `_libssh2_explicit_zero()` macro. + + - delete `LIBSSH2_CLEAR_MEMORY` guards, which enables secure-zeroing + universally. + + - add `LIBSSH2_NO_CLEAR_MEMORY` option to disable secure-zeroing. + + - while here, delete double/triple inclusion of `misc.h`. + `libssh2_priv.h` included it already. + + Closes #810 + +- cmake: bump minimum version to 3.1 (from 2.8.12) + + This allows to delete some fallback code. + + CMake release dates: + - 2014-12-15: 3.1 + - 2013-10-07: 2.8.12 + + Closes #813 + +- snprintf: unify fallback logic + + Before this patch, the `snprintf()` fallback logic for envs not + supporting this function (i.e. Visual Studio 2013 and older) varied + depending on build tool, and used different techniques in examples, + tests and libssh2 itself. + + This patch aims to apply a common logic to libssh2 and examples/tests. + + - libssh2: use local `snprintf()` fallback with all build tools. + + We already had a local implementation, but only with CMake. Move that + to the library as `_libssh2_snprintf()`, and map `snprintf()` to it + when `HAVE_SNPRINTF` is not set. + + Also change the length type from `int` to `size_t`, and fix + formatting. + + - set or detect `HAVE_SNPRINTF` in non-CMake builds. + + Detect in autotools. Keep existing logic in `win32/libssh2_config.h`. + Always set for OS/400, NetWare and VMS, keeping existing behaviour. + (OS/400 builds use a different local implementation) + + - examples/tests: drop the CMake-specific fallback logic and map + `snprintf()` to `_snprintf()` for old MSVC versions, like we did + before with other build tools. This is unsafe, but should be fine for + these uses. + + - `win32/libssh2_config.h`: make it easier to read. + + Closes #812 + +- cmake: build fixes with OpenSSL/LibreSSL on Windows + + - Link `bcrypt` for newer (non-fork) OpenSSL. + + - Link `bcrypt` and `ws2_32` when using (non-fork) OpenSSL or LibreSSL, + to allow `Looking for EVP_aes_128_ctr` detecting this feature. + + With the feature available, but not found by CMake, build failed with: + `openssl.c:636:21: error: incompatible integer to pointer conversion assigning to 'EVP_CIPHER *' (aka 'struct evp_cipher_st *') from 'int' [-Wint-conversion]` + + Closes #809 + +- build fixes and improvements (mostly for Windows) + + - in `hostkey.c` check the result of `libssh2_sha256_init()` and + `libssh2_sha512_init()` calls. This avoid the warning that we're + ignoring the return values. + + - fix code using `int` (or `SOCKET`) for sockets. Use libssh2's + dedicated `libssh2_socket_t` and `LIBSSH2_INVALID_SOCKET` instead. + + - fix compiler warnings due to `STATUS_*` macro redefinitions between + `ntstatus.h` / `winnt.h`. Solve it by manually defining the single + `STATUS` value we need from `ntstatus.h` and stop including the whole + header. + Fixes #733 + + - improve Windows UWP/WinRT builds by detecting it with code copied + from the curl project. Then excluding problematic libssh2 parts + according to PR by Dmitry Kostjučenko. + Fixes #734 + + - always use `SecureZeroMemory()` on Windows. + + We can tweak this if not found or not inlined by a C compiler which + we otherwise support. Same if it causes issues with UWP apps. + + Ref: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa366877(v=vs.85) + Ref: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-rtlsecurezeromemory + + - always enable `LIBSSH2_CLEAR_MEMORY` on Windows. CMake and + curl-for-win builds already did that. Delete `SecureZeroMemory()` + detection from autotools' WinCNG backend logic, that this + setting used to depend on. + + TODO: Enable it for all platforms in a separate PR. + TODO: For clearing buffers in WinCNG, call `_libssh2_explicit_zero()`, + insead of a local function or explicit `SecureZeroMemory()`. + + - Makefile.inc: move `os400qc3.h` to `HEADERS`. This fixes + compilation on non-unixy platforms. Recent regression. + + - `libssh2.rc`: replace copyright with plain ASCII, as in curl. + + Ref: curl/curl@1ca62bb + Ref: curl/curl#7765 + Ref: curl/curl#7776 + + - CMake fixes and improvements: + + - enable warnings with llvm/clang. + - enable more comprehensive warnings with gcc and llvm/clang. + Logic copied from curl: + https://github.com/curl/curl/blob/233810bb5f6c5e7bedfc10bdd36607b958c0cfe4/CMakeLists.txt#L131-L148 + - fix `Policy CMP0080` CMake warning by deleting that reference. + - add `ENABLE_WERROR` (default: `OFF`) option. Ported from curl. + - add `PICKY_COMPILER` (default: `ON`) option, as known from curl. + + It controls both the newly added picky warnings for llvm/clang and + gcc, and also the pre-existing ones for MSVC. + + - `win32/GNUmakefile` fixes and improvements: + + - delete `_AMD64_` and add missing `-m64` for x64 builds under test. + - add support for `ARCH=custom`. + It disables hardcoded Intel 64-bit and Intel 32-bit options, + allowing ARM64 builds. + - add support for `LIBSSH2_RCFLAG_EXTRAS`. + To pass custom options to windres, e.g. in ARM64 builds. + - add support for `LIBSSH2_RC`. To override `windres`. + - delete support for Metrowerks C. Last released in 2004. + + - `win32/libssh2_config.h`: delete unnecessary socket #includes + + `src/libssh2_priv.h` includes `winsock2.h` and `ws2tcpip.h` further + down the line, triggered by `HAVE_WINSOCK2_H`. + + `mswsock.h` does not seem to be necessary anymore. + + Double-including these (before `windows.h`) caused compiler failures + when building against BoringSSL and warnings with LibreSSL. We could + work this around by passing `-DNOCRYPT`. Deleting the duplicates + fixes these issues. + + Timeline: + 2013: c910cd382dfa07fed2adaabf688af9e4a084fa1d deleted `mswsock.h` from `src/libssh2_priv.h` + 2008: 8c43bc52b1e3de2c8fc7899a80aec0e98de4e2d8 added `winsock2.h` and `ws2tcpip.h` to `src/libssh2_priv.h` + 2005: dc4bb1af967d2c53e90349f2f37324c622e714f5 added the now deleted #includes + + - delete or replace `LIBSSH2_WIN32` with `WIN32`. + + - replace hand-rolled `HAVE_WINDOWS_H` macro with `WIN32`. Also delete + its detections/definitions. + + - delete unused `LIBSSH2_DARWIN` macro. + + - delete unused `writev()` Windows implementation + + There is no reference to `writev()` since 2007-02-02, commit + 9d55db6501aa4e21f0858cf36cdc2ddc11b96e83. + + - fix a bunch of MSVC / llvm/clang / gcc compiler warnings: + + - `warning C4100: '...': unreferenced formal parameter` + - using value of undefined PP macro `LIBSSH2DEBUG` + - missing void from function definition + - `if()` block missing in non-debug builds + - unreferenced variable in non-debug builds + - `warning: must specify at least one argument for '...' parameter of variadic macro [-Wgnu-zero-variadic-macro-arguments]` + in `_libssh2_debug()` + - `warning C4295: 'ciphertext' : array is too small to include a terminating null character` + - `warning C4706: assignment within conditional expression` + - `warning C4996: 'inet_addr': Use inet_pton() or InetPton() instead or + define _WINSOCK_DEPRECATED_NO_WARNINGS to disable deprecated API warnings` + By suppressning it. Would be best to use inet_pton() as suggested. + On Windows this needs Vista though. + - `warning C4152: nonstandard extension, function/data pointer conversion in expression` + (silenced locally) + - `warning C4068: unknown pragma` + + Ref: https://ci.appveyor.com/project/libssh2org/libssh2/builds/46354480/job/j7d0m34qgq8rag5w + + Closes #808 + +Dan Fandrich (1 Mar 2023) +- Add tests to check individual crypt & HMAC methods + + One specific crypt or hmac method is requested to be negotiated, then + several MB of data is transferred. + +- Add test to read lots of data over a channel + + Connects to the ssh server then downloads several MB of data. This + tests the data transfer path as well as boundary cases in packet + handling as data is split into smaller SSH blocks. + +GitHub (27 Feb 2023) +- [Will Cosgrove brought this change] + + Disable deprecated warnings for OpenSSL 3 #805 (#806) + + Disable deprecated warnings (for now) when building against OpenSSL 3 for a clean build. + + Reported: + Daniel Stenberg + +Dan Fandrich (24 Feb 2023) +- Fix a couple of warnings of errors in MSVC builds + + Two warnings (in tests & examples) in particular would cause problems: + bad format causing invalid data output or a bad chdir due to out of + scope buffer use. + +- tests: Support running tests in out-of-tree builds + + Various files are found by referencing the srcdir environment variable + in that case. + + Closes #801 + +- Improve the ssh2 example program to run a command + + This performs better as an example since it shows more working code, and + in the simplest possible way. It also turns the program into an actually + useful tool out of the box, able to run an arbitrary command (with one + restriction) on a remote machine and return the response, without + needing to touch the source. + + Closes #800 + +GitHub (14 Feb 2023) +- [Will Cosgrove brought this change] + + Add NULL session check to _libssh2_error_flags() (#796) + + Don't dereference null if a null session happens to make it into _libssh2_error_flags() + +Dan Fandrich (7 Feb 2023) +- Reorder AES crypt methods so stronger ones are first + + This make it more likely that a stronger one will be negotiated rather + than a weaker variant. + +- CI: update uses: dependencies to the latest versions + + We were seeing some deprecation warning messages on some of the older + ones. + +- transport.c: Add some comments + +- Add missing files to automake makefiles & build tests + + Many files have been added to the cmake build files but not the automake + ones in recent years. Missing ones have been added so automake "make + dist" will now create a usable tar ball. + + The integration tests using Docker are now built with automake as well + (with "make check"). They are not run yet since they aren't working yet + on Linux. + +- tests: Fix gcc compile warnings + + These were mostly due to missing and non-ANSI prototypes. + +- Enable trace debugging in example/ssh2 + + This is intended to be a test program, so debugging is likely to be + useful by default. + +- Improve example/ssh2 to allow unmodified use of public key auth + + The previous hard-coded key file paths were not valid for normal users. + Make the paths relative to the user's home directory instead so they + can work out of the box. Add a banner showing what connection will be + attempted to make it easier for the user to see what is being attempted. + Enable trace debugging since this is designed as a test program. + +GitHub (13 Dec 2022) +- [Viktor Szakats brought this change] + + openssl.h: enable ed25519 for LibreSSL 3.7.0 (#778) + + This brings LibreSSL libssh2 builds on par with OpenSSL. + +Dan Fandrich (5 Dec 2022) +- configure.ac: check for sys/param.h + + This file is required by glibc for the test suite. + +GitHub (12 Nov 2022) +- [Viktor Szakats brought this change] + + tests: add option to run tests without docker (#762) + + via `export OPENSSH_NO_DOCKER=1`. + + SSH server host can be set via: + `export OPENSSH_SERVER_HOST=127.0.0.1` + + SSH server port via existing: + `export OPENSSH_SERVER_PORT=4711` + + This requires more work to be usable out of the box. The necessery sshd + config is (partly) embedded into `tests/openssh_server/Dockerfile`. + + After this patch, it is possible to run tests in envs where docker is + not installed or not available, by running a preconfigured, + non-containerized sshd. + +- [Michael Buckley brought this change] + + Skip leading \r and \n characters in banner_receive() (#769) + + Fixes #768 + + Credit: + Michael Buckley + +- [Zenju brought this change] + + Fixed error handling of _libssh2_packet_requirev callers (#767) + + Notes: + + some callers of _libssh2_packet_requirev() fail to set _libssh2_error(). + This creates the situation where e.g. libssh2_session_handshake() fails, but libssh2_session_last_error() confusingly returns LIBSSH2_ERROR_NONE. + + Credit: + Zenju + +- [Will Cosgrove brought this change] + + Revert usage of EVP_CipherUpdate #764 #739 (#765) + + Revert usage of EVP_CipherUpdate from wolfSSL PR to fix #764 #739. + +- [Will Cosgrove brought this change] + + Fix regression with rsa_sha2_verify #758 (#763) + + Fixes comparison with the result value coming from `mbedtls_rsa_pkcs1_verify`. Success is 0, not 1. + +Marc Hoersken (24 Oct 2022) +- CI: fix AppVeyor status failing for starting jobs + +Viktor Szakats (24 Oct 2022) +- delete cast5 - null-cipher mapping + +- more feature guard cleanup + +- indent + +- formatting + +- fold long lines + +- cleanup + +- temporarily silence checksrc + +- add mbedTLS 3.x support + + Make libssh2 compile cleanly with mbedTLS 3.x and later. + + This patch makes use of `MBEDTLS_PRIVATE()`, which is not the + recommended, future-proof way to access mbedTLS data structures. This + method may break with a minor upgrade, according to the authors. This + is also the method used by libcurl. + + Also: + + - Fix a potentially uninitialized variable in + `libssh2_mbedtls_rsa_sha2_sign()`. This happened in an error path, + resulting in an unnecessary mbedTLS API call, with an uninitialized + `md_type`. + + - Bump mbedTLS version used in CI tests to 3.2.1. + + Fixes #751 + +- tests: add option to enable all trace messages in fixture + + via `export FIXTURE_TRACE_ALL=1`. + +- win32/GNUmakefile: add mbedTLS support + + via `export MBEDTLS_PATH=`. + +Marc Hoersken (21 Oct 2022) +- CI: fix AppVeyor job links only working for most recent build + + Ref: https://github.com/curl/curl/pull/9768#issuecomment-1286675916 + Reported-by: Daniel Stenberg + + Follow up to #754 + +- CI: add missing permission section to AppVeyor status workflow + + Follow up to #754 + +- Remove OSSFuzz integration which was replaced with CIFuzz (#756) + + Confirmed-by: Max Dymond + +- Rename workflow file appveyor.yml to appveyor_docker.yml + +- Streamline names of CI workflow jobs + +- [Jeroen Ooms brought this change] + + Add CI for mingw-w64 via msys2 (#742) + + Credit: Jeroen Ooms + +- CI: report AppVeyor build status for each job (#754) + + Also give each job on AppVeyor CI a human-readable name. + + This aims to make job and therefore build failures more visible. + +GitHub (29 Sep 2022) +- [Michael Buckley brought this change] + + Support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys, FIDO (#698) + + Notes: + Add support for sk-ecdsa-sha2-nistp256@openssh.com and sk-ssh-ed25519@openssh.com key exchange for FIDO auth using the OpenSSL backend. Stub API for other backends. + + Credit: + Michael Buckley + +- [Y. Yang brought this change] + + Fix DLL import library name (#711) + + Notes: + Fix DLL import library name + + https://aur.archlinux.org/packages/mingw-w64-libssh2 + https://cmake.org/cmake/help/latest/prop_tgt/IMPORT_PREFIX.html + + Credit: + metab0t + Y. Yang + +- [skundu07 brought this change] + + Add RSA-SHA2 support for the WinCNG backend (#736) + + Notes: + Added code to support RSA-SHA2 for WinCNG backend. + + Credit: + skundu07 + +- [Gabriel Smith brought this change] + + sftp: Prevent files from being skipped if the output buffer is too small (#746) + + Notes: + LIBSSH2_ERROR_BUFFER_TOO_SMALL is returned if the buffer is too small + to contain a returned directory entry. On this condition we jump to the + label `end`. At this point the number of names left is decremented + despite no name being returned. + + As suggested in #714, this commit moves the error label after the + decrement of `names_left`. + + Fixes #714 + + Credit: + Co-authored-by: Gabriel Smith + +- [bgermann brought this change] + + Drop advertisement clause on Blowfish (#747) + + Originally driven by https://github.com/pyca/bcrypt/issues/169, OpenBSD + removed Niels Provos's BSD advertisement clause in version 7.1: + + https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/lib/libsa/blowfish.c.diff?r1=1.1&r2=1.2 + https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/lib/libsa/blowfish.h.diff?r1=1.1&r2=1.2 + + This enables using libssh2 in GPL software. + +- [zhaochongliu brought this change] + + Support building with gcc < version 8 + + Files: CMakeLists.txt + + Notes: don't use gcc arguments that don't exist in gcc versions lower than 8 if building with older gcc. + + Credit: + zhaochongliu + +- [Miguel de Icaza brought this change] + + Document the obscure LIBSSH2_ERROR_BAD_USE when writing to a channel (#713) + + Document the obscure LIBSSH2_ERROR_BAD_USE when writing to a channel + + Credit: + Miguel de Icaza + +- [Michael Buckley brought this change] + + Don't erroneously log SSH_MSG_REQUEST_FAILURE packets from keepalive (#727) + + Notes: + When setting a ServerAliveInterval using libssh2_keepalive_config() with want_reply set to true, some servers will reply to the keep-alive requests with a single SSH_MSG_REQUEST_FAILURE packet. This is an allowed behavior in RFC 4254, section 4. + + Credit: + Michael Buckley + +- [Ryan Kelley brought this change] + + Updating docs for libssh2_channel_flush_ex (#728) + + Notes: + In #614 it was identified the docs do not accurately show how libssh2_channel_flush_ex() return value is set. I have updated the doc's to correctly show what the function is returning. + + Credit: + Ryan Kelley + +- [Sandeep Bansal brought this change] + + Support RSA certificate authentication (#710) + + * Adding support for signed RSA keys and unit test + + Credit: + Sandeep Bansal + +Viktor Szakats (2 Jul 2022) +- configure: add --disable-tests option + +- cmake: do not add libssh2.rc to the static library + +GitHub (23 May 2022) +- [AyushiN brought this change] + + Fixed typo #697 (#701) + + Credit: + AyushiN + +- [Viktor Szakats brought this change] + + Openssl: add support for LibreSSL 3.5.x (#700) + + LibreSSL 3.5.0 made more structures opaque, so let's enable existing + support for that when building against these LibreSSL versions. + + Ref: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.5.0-relnotes.txt + + Credit: + Viktor Szakats + +- [Michael Buckley brought this change] + + Ensure KEX replies don't include extra bytes (#696) + + Addresses #695 + + Credit: + Michael Buckley, reported by Harry Sintonen + +- [Zenju brought this change] + + Fix buffer overflow during SSH_MSG_USERAUTH_BANNER (#693) + + File: userauth.c + Notes: + This patch fixes application crashes due to heap corruption. Turns out the null terminator is written one byte outside of the allocated area. + Credit: + Zenju + +- [Will Cosgrove brought this change] + + Changed NULL check to avoid logic change + +- [Will Cosgrove brought this change] + + NULL check before calling session_handshake + +- [Harry Sintonen brought this change] + + Fix build since openssl 1.1.0 when ECDSA and/or RIPEMD are disabled (#666) + + File: openssl.h + + Notes: + In openssl 1.1.0 and later openssl decided to change some of the defines used to check if certain features are not compiled in the libraries. This updates the define checks. + + Credit: + Harry Sintonen + Co-authored-by: Harry Sintonen + +- [gbaraldi brought this change] + + Add RSA-SHA2 support for the mbedtls backend (#688) + + File: mbedtls.c + + Notes: + * Add sha2 support for RSA key upgrading to mbedTLS backend + + Credit: + gbaraldi + +Daniel Stenberg (21 Mar 2022) +- misc/libssh2_copy_string: avoid malloc zero bytes + + Avoids the inconsistent malloc return code for malloc(0) + + Closes #686 + +Marc Hoersken (17 Mar 2022) +- wincng: rename struct field referring to the DH private big number + + Closes #684 + +- tests/openssh_fixture.c: print command after variable expansion + +- CI: store and reuse OpenSSH Server docker image used for tests + + Supersedes #588 + Fixes #665 + Closes #685 + +GitHub (26 Feb 2022) +- [Will Cosgrove brought this change] + + Added LibreSSL to crypto backend list + +- [Will Cosgrove brought this change] + + Added crypto backend list to template + + Added OS version as well + +- [Will Cosgrove brought this change] + + Revert "Option to build both static and shared libraries (#547)" (#675) + + This reverts commit b60dca8b6450a9729670986d2899cca54ccdbb6d. + + #547 doesn't build clean anymore with the keyboard interactive changes. + +- [berney brought this change] + + Option to build both static and shared libraries (#547) + + files: cmakelists.txt + + Notes: + * Option to build both static and shared libraries when using CMake + + Credit: + berney + +- [xalopp brought this change] + + Use modern API in userauth_keyboard_interactive() (#663) + + Files: userauth_kbd_packet.c, userauth_kbd_packet.h, test_keyboard_interactive_auth_info_request.c, userauth.c + + Notes: + This refactors `SSH_MSG_USERAUTH_INFO_REQUEST` processing in `userauth_keyboard_interactive()` in order to improve robustness, correctness and readability or the code. + + * Refactor userauth_keyboard_interactive to use new api for packet parsing + * add unit test for userauth_keyboard_interactive_parse_response() + * add _libssh2_get_boolean() and _libssh2_get_byte() utility functions + + Credit: + xalopp + +- [xalopp brought this change] + + Fix formatting in manual page (#667) + + Fixed formatting of `LIBSSH2_ERROR_AUTHENTICATION_FAILED` in the errors section. + + credit: xalopp + +- [tihmstar brought this change] + + NULL terminate server_sign_algorithms string (#669) + + files: packet.c, libssh2_priv.h + + notes: + * Fix heap buffer overflow in _libssh2_key_sign_algorithm + + When allocating `session->server_sign_algorithms` which is a `char*` is is important to also allocate space for the string-terminating null byte at the end and make sure the string is actually null terminated. + + Without this fix, the `strchr()` call inside the `_libssh2_key_sign_algorithm` (line 1219) function will try to parse the string and go out of buffer on the last invocation. + + Credit: tihmstar + Co-authored-by: Will Cosgrove + +- [Will Cosgrove brought this change] + + free RSA2 related memory (#664) + + Free `server_sign_algorithms` and `sign_algo_prefs`. + +- [Will Cosgrove brought this change] + + Legacy Agent support for rsa2 key upgrading/downgrading #659 (#662) + + Files: libssh2.h, agent.c, userauth.c + + Notes: + Part 2 of the fix for #659. This adds rsa key downgrading for agents that don't support sha2 upgrading. It also adds better trace output for debugging/logging around key upgrading. + + Credit: + Will Cosgrove (signed off by Michael Buckley) + +- [Ian Hattendorf brought this change] + + Support rsa-sha2 agent flags (#661) + + File: agent.c + Notes: implements rsa-sha2 flags used to tell the agent which signing algo to use. + https://tools.ietf.org/id/draft-miller-ssh-agent-01.html#rfc.section.4.5.1 + + Credit: + Ian Hattendorf + +Daniel Stenberg (13 Jan 2022) +- [Sunil Nimmagadda brought this change] + + ssh: Add support for userauth banner. + + The new libssh2_userauth_banner API allows to get an optional + userauth banner sent with SSH_MSG_USERAUTH_BANNER packet by the + server. + + Closes #610 + +GitHub (6 Jan 2022) +- [Michael Buckley brought this change] + + Fix a memcmp errors in code that was changed from memmem to memcmp (#656) + + Notes: + Fixed supported algo prefs list check when upgrading rsa keys + + Credit: Michael Buckley + +- [Hayden Roche brought this change] + + Add support for a wolfSSL crypto backend. (#629) + + It uses wolfSSL's OpenSSL compatibility layer, so rather than introduce new + wolfssl.h/c files, the new backend just reuses openssl.h/c. Additionally, + replace EVP_Cipher() calls with EVP_CipherUpdate(), since EVP_Cipher() is not + recommended. + + Credit: Hayden Roche + +- [Bastien Durel brought this change] + + Runtime engine detection with libssh2_crypto_engine() (#643) + + File: + version.c, HACKING-CRYPTO, libssh2.h, libssh2_crypto_engine.3, makefile. + + Notes: + libssh2_crypto_engine() API to get crypto engine at runtime. + + Credit: Bastien Durel + +- [Will Cosgrove brought this change] + + RSA SHA2 256/512 key upgrade support RFC 8332 #536 (#626) + + Notes: + * Host Key RSA 256/512 support #536 + * Client side key hash upgrading for RFC 8332 + * Support for server-sig-algs, ext-info-c server messages + * Customizing preferred server-sig-algs via the preference LIBSSH2_METHOD_SIGN_ALGO + + Credit: Anders Borum, Will Cosgrove + +- [xalopp brought this change] + + fix: use userauth name length to check memory boundaries for userauth name, fixes #653 (#654) + + File: userauth.c + + Notes: + Fixes `userauth_kybd_auth_name_len` length check + + Co-authored-by: Xaver Lopenstedt + +- [Daniel Stenberg brought this change] + + agent: handle overly large comment lengths (#651) + + Reported-by: Harry Sintonen + +- [Daniel Stenberg brought this change] + + userauth: check for too large userauth_kybd_auth_name_len (#650) + + ... before using it. + + Reported-by: MarcoPoloPie + Fixes #649 + +Daniel Stenberg (17 Dec 2021) +- .github/SECURITY.md: fix the URL + +- .github/SECURITY.md: add security policy + +GitHub (30 Nov 2021) +- [Will Cosgrove brought this change] + + hostkey_method_ssh_ed25519_init() check key bounds (#645) + + * hostkey_method_ssh_ed25519_init() check key bounds + + File: hostkey.c + + Notes: + Additional key length checking before calling _libssh2_ed25519_new_public() + + Credit: + Will Cosgrove + +- [Will Cosgrove brought this change] + + Fix error message in memory_read_privatekey #636 + + file: userauth.c + note: fix error message + credit: + volund + +- [cntrump brought this change] + + Update maketgz for macOS (#543) + + File: + maketgz + + Notes: + Fix error on macOS: sed: -e: No such file or directory + + Credit: + cntrump + +- [Jun Tseng brought this change] + + CMake update minimum version to 2.8.12 (#639) + + File: + CMakeLists.txt + + Notes: + Following CMake's advice, Update the minimum required version. + + Credit: + Jun Tseng + +Daniel Stenberg (8 Nov 2021) +- [David Korczynski brought this change] + + ci: Add CIFuzz integration + + Notes: + Add CIFuzz integration to run fuzzer using the OSS-Fuzz infrastructure + at each PR. + + Signed-off-by: David Korczynski + Closes #635 + +GitHub (26 Oct 2021) +- [Uwe L. Korn brought this change] + + Use libssh2_EXPORTS as an alternative to _WINDLL (#470) + + Files: libssh2.h + + Notes: + `_WINDLL` is only defined when a Visual Studio CMake generator is used, `libssh2_EXPORTS` is used though for all CMake generator if a shared libssh2 library is being built. + + Credit: + Uwe L. Korn + +Viktor Szakats (1 Oct 2021) +- windows: fix clang and WinCNG warnings + + Fix these categories of warning: + + - in `wincng.c` disagreement in signed/unsigned char when passing around + the passphrase string: + `warning: pointer targets in passing argument [...] differ in signedness [-Wpointer-sign]` + Fixed by using `const unsigned char *` in all static functions and + applying/updating casts as necessary. + + - in each use of `libssh2_*_init()` macros where the result is not used: + `warning: value computed is not used [-Wunused-value]` + Fixed by using `(void)` casts. + + - `channel.c:1171:7: warning: 'rc' may be used uninitialized in this function [-Wmaybe-uninitialized]` + Fixed by initializing this variable with `LIBSSH2_ERROR_CHANNEL_UNKNOWN`. + While there I replaced a few 0 literals with `LIBSSH2_ERROR_NONE`. + + - in `sftp.c`, several of these two warnings: + `warning: 'data' may be used uninitialized in this function [-Wmaybe-uninitialized]` + `warning: 'data_len' may be used uninitialized in this function [-Wmaybe-uninitialized]` + Fixed by initializing these variables with NULL and 0 respectively. + + - Also removed the exec attribute from `wincng.h`. + + Notes: + - There are many pre-existing checksrc issues. + - The `sftp.c` and `channel.c` warnings may apply to other platforms as well. + + Closes #628 + +Daniel Stenberg (25 Sep 2021) +- README: use www.libssh2.org for the license link + +- libssh2.h: bump it to 1.10.1-dev + +- mailing list: moved to lists.haxx.se + +GitHub (2 Sep 2021) +- [Laurent Stacul brought this change] + + openssh_fixture.c: Fix openssh_server build not working (#616) (#620) + + File: openssh_fixture.c + + Notes: + fixes too long of output lines building docker image + + Credit: + Laurent Stacul + +- [Will Cosgrove brought this change] + + openssh_fixture.c: fix warning (#621) + + File: openssh_fixture.c + + Notes: + Fix `portable_sleep` return type warning + + Credit: + Will Cosgrove + +- [Will Cosgrove brought this change] + + Update CI to use latest Ubuntu #624 (#625) + + File: ci.yml + + Notes: + Update CI to use latest Ubuntu #624 + + Also removed 32 bit building in the matrix. + + Credit: + Will Cosgrove + +- [Will Cosgrove brought this change] + + Update .gitignore + + Add .DS_Store files for macOS + +- [Laurent Stacul brought this change] + + Makefile.am: Add missing key in case openssl > 1.1.0 (#617) + + File: Makefile.am + + Notes: fix missing test keys + + Credit: + Laurent Stacul + +Version 1.10.0 (29 Aug 2021) + +Daniel Stenberg (29 Aug 2021) +- [Will Cosgrove brought this change] + + updated docs for 1.10.0 release + +Marc Hörsken (30 May 2021) +- [Laurent Stacul brought this change] + + [tests] Try several times to connect the ssh server + + Sometimes, as the OCI container is run in detached mode, it is possible + the actual server is not ready yet to handle SSH traffic. The goal of + this PR is to try several times (max 3). The mechanism is the same as + for the connection to the docker machine. + +- [Laurent Stacul brought this change] + + Remove openssh_server container on test exit + +- [Laurent Stacul brought this change] + + Allow the tests to run inside a container + + The current tests suite starts SSH server as OCI container. This commit + add the possibility to run the tests in a container provided that: + + * the docker client is installed builder container + * the host docker daemon unix socket has been mounted in the builder + container (with, if needed, the DOCKER_HOST environment variable + accordingly set, and the permission to write on this socket) + * the builder container is run on the default bridge network, or the + host network. This PR does not handle the case where the builder + container is on another network. + +Marc Hoersken (28 May 2021) +- CI/appveyor: run SSH server for tests on GitHub Actions (#607) + + No longer rely on DigitalOcean to host the Docker container. + + Unfortunately we require a small dispatcher script that has + access to a GitHub access token with scope repo in order to + trigger the daemon workflow on GitHub Actions also for PRs. + + This script is hosted by myself for the time being until GitHub + provides a tighter scope to trigger the workflow_dispatch event. + +GitHub (26 May 2021) +- [Will Cosgrove brought this change] + + openssl.c: guards around calling FIPS_mode() #596 (#603) + + Notes: + FIPS_mode() is not implemented in LibreSSL and this API is removed in OpenSSL 3.0 and was introduced in 0.9.7. Added guards around making this call. + + Credit: + Will Cosgrove + +- [Will Cosgrove brought this change] + + configure.ac: don't undefine scoped variable (#594) + + * configure.ac: don't undefine scoped variable + + To get this script to run with Autoconf 2.71 on macOS I had to remove the undefine of the backend for loop variable. It seems scoped to the for loop and also isn't referenced later in the script so it seems OK to remove it. + + * configure.ac: remove cygwin specific CFLAGS #598 + + Notes: + Remove cygwin specific Win32 CFLAGS and treat the build like a posix build + + Credit: + Will Cosgrove, Brian Inglis + +- [Laurent Stacul brought this change] + + tests: Makefile.am: Add missing tests client keys in distribution tarball (#604) + + Notes: + Added missing test keys. + + Credit: + Laurent Stacul + +- [Laurent Stacul brought this change] + + Makefile.am: Add missing test keys in the distribution tarball (#601) + + Notes: + Fix tests missing key to build the OCI image + + Credit: + Laurent Stacul + +Daniel Stenberg (16 May 2021) +- dist: add src/agent.h + + Fixes #597 + Closes #599 + +GitHub (12 May 2021) +- [Will Cosgrove brought this change] + + packet.c: Reset read timeout after received a packet (#576) (#586) + + File: + packet.c + + Notes: + Attempt keyboard interactive login (Azure AD 2FA login) and use more than 60 seconds to complete the login, the connection fails. + + The _libssh2_packet_require function does almost the same as _libssh2_packet_requirev but this function sets state->start = 0 before returning. + + Credit: + teottin, Co-authored-by: Tor Erik Ottinsen + +- [kkoenig brought this change] + + Support ECDSA certificate authentication (#570) + + Files: hostkey.c, userauth.c, test_public_key_auth_succeeds_with_correct_ecdsa_key.c + + Notes: + Support ECDSA certificate authentication + + Add a test for: + - Existing ecdsa basic public key authentication + - ecdsa public key authentication with a signed public key + + Credit: + kkoenig + +- [Gabriel Smith brought this change] + + agent.c: Add support for Windows OpenSSH agent (#517) + + Files: agent.c, agent.h, agent_win.c + + Notes: + * agent: Add support for Windows OpenSSH agent + + The implementation was partially taken and modified from that found in + the Portable OpenSSH port to Win32 by the PowerShell team, but mostly + based on the existing Unix OpenSSH agent support. + + https://github.com/PowerShell/openssh-portable + + Regarding the partial transfer support implementation: partial transfers + are easy to deal with, but you need to track additional state when + non-blocking IO enters the picture. A tracker of how many bytes have + been transfered has been placed in the transfer context struct as that's + where it makes most sense. This tracker isn't placed behind a WIN32 + #ifdef as it will probably be useful for other agent implementations. + + * agent: win32 openssh: Disable overlapped IO + + Non-blocking IO is not currently supported by the surrounding agent + code, despite a lot of the code having everything set up to handle it. + + Credit: + Co-authored-by: Gabriel Smith + +- [Zenju brought this change] + + Fix detailed _libssh2_error being overwritten (#473) + + Files: openssl.c, pem.c, userauth.c + + Notes: + * Fix detailed _libssh2_error being overwritten by generic errors + * Unified error handling + + Credit: + Zenju + +- [Paul Capron brought this change] + + Fix _libssh2_random() silently discarding errors (#520) + + Notes: + * Make _libssh2_random return code consistent + + Previously, _libssh2_random was advertized in HACKING.CRYPTO as + returning `void` (and was implemented that way in os400qc3.c), but that + was in other crypto backends a lie; _libssh2_random is (a macro + expanding) to an int-value expression or function. + + Moreover, that returned code was: + — 0 or success, -1 on error for the MbedTLS & WinCNG crypto backends + But also: + — 1 on success, -1 or 0 on error for the OpenSSL backend! + – 1 on success, error cannot happen for libgcrypt! + + This commit makes explicit that _libssh2_random can fail (because most of + the underlying crypto functions can indeed fail!), and it makes its result + code consistent: 0 on success, -1 on error. + + This is related to issue #519 https://github.com/libssh2/libssh2/issues/519 + It fixes the first half of it. + + * Don't silent errors of _libssh2_random + + Make sure to check the returned code of _libssh2_random(), and + propagates any failure. + + A new LIBSSH_ERROR_RANDGEN constant is added to libssh2.h + None of the existing error constants seemed fit. + + This commit is related to d74285b68450c0e9ea6d5f8070450837fb1e74a7 + and to https://github.com/libssh2/libssh2/issues/519 (see the issue + for more info.) It closes #519. + + Credit: + Paul Capron + +- [Gabriel Smith brought this change] + + ci: Remove caching of docker image layers (#589) + + Notes: + continued ci reliability work. + + Credit: + Gabriel Smith + +- [Gabriel Smith brought this change] + + ci: Speed up docker builds for tests (#587) + + Notes: + The OpenSSH server docker image used for tests is pre-built to prevent + wasting time building it during a test, and unneeded rebuilds are + prevented by caching the image layers. + + Credit: + Gabriel Smith + +- [Will Cosgrove brought this change] + + userauth.c: don't error if using keys without RSA (#555) + + file: userauth.c + + notes: libssh2 now supports many other key types besides RSA, if the library is built without RSA support and a user attempts RSA auth it shouldn't be an automatic error + + credit: + Will Cosgrove + +- [Marc brought this change] + + openssl.c: Avoid OpenSSL latent error in FIPS mode (#528) + + File: + openssl.c + + Notes: + Avoid initing MD5 digest, which is not permitted in OpenSSL FIPS certified cryptography mode. + + Credit: + Marc + +- [Laurent Stacul brought this change] + + openssl.c: Fix EVP_Cipher interface change in openssl 3 #463 + + File: + openssl.c + + Notes: + Fixes building with OpenSSL 3, #463. + + The change is described there: + https://github.com/openssl/openssl/commit/f7397f0d58ce7ddf4c5366cd1846f16b341fbe43 + + Credit: + Laurent Stacul, reported by Sergei + +- [Gabriel Smith brought this change] + + openssh_fixture.c: Fix potential overwrite of buffer when reading stdout of command (#580) + + File: + openssh_fixture.c + Notes: + If reading the full output from the executed command took multiple + passes (such as when reading multiple lines) the old code would read + into the buffer starting at the some position (the start) every time. + The old code only works if fgets updated p or had an offset parameter, + both of which are not true. + + Credit: + Gabriel Smith + +- [Gabriel Smith brought this change] + + ci: explicitly state the default branch (#585) + + Notes: + It looks like the $default-branch macro only works in templates, not + workflows. This is not explicitly stated anywhere except the linked PR + comment. + + https://github.com/actions/starter-workflows/pull/590#issuecomment-672360634 + + credit: + Gabriel Smith + +- [Gabriel Smith brought this change] + + ci: Swap from Travis to Github Actions (#581) + + Files: ci files + + Notes: + Move Linux CI using Github Actions + + Credit: + Gabriel Smith, Marc Hörsken + +- [Mary brought this change] + + libssh2_priv.h: add iovec on 3ds (#575) + + file: libssh2_priv.h + note: include iovec for 3DS + credit: Mary Mstrodl + +- [Laurent Stacul brought this change] + + Tests: Fix unused variables warning (#561) + + file: test_public_key_auth_succeeds_with_correct_ed25519_key_from_mem.c + + notes: fixed unused vars + + credit: + Laurent Stacul + +- [Viktor Szakats brought this change] + + bcrypt_pbkdf.c: fix clang10 false positive warning (#563) + + File: bcrypt_pbkdf.c + + Notes: + blf_enc() takes a number of 64-bit blocks to encrypt, but using + sizeof(uint64_t) in the calculation triggers a warning with + clang 10 because the actual data type is uint32_t. Pass + BCRYPT_BLOCKS / 2 for the number of blocks like libc bcrypt(3) + does. + + Ref: https://github.com/openbsd/src/commit/04a2240bd8f465bcae6b595d912af3e2965856de + + Fixes #562 + + Credit: + Viktor Szakats + +- [Will Cosgrove brought this change] + + transport.c: release payload on error (#554) + + file: transport.c + notes: If the payload is invalid and there is an early return, we could leak the payload + credit: + Will Cosgrove + +- [Will Cosgrove brought this change] + + ssh2_client_fuzzer.cc: fixed building + + The GitHub web editor did some funky things + +- [Will Cosgrove brought this change] + + ssh_client_fuzzer.cc: set blocking mode on (#553) + + file: ssh_client_fuzzer.cc + + notes: the session needs blocking mode turned on to avoid EAGAIN being returned from libssh2_session_handshake() + + credit: + Will Cosgrove, reviewed by Michael Buckley + +- [Etienne Samson brought this change] + + Add a LINT option to CMake (#372) + + * ci: make style-checking available locally + + * cmake: add a linting target + + * tests: check test suite syntax with checksrc.pl + +- [Will Cosgrove brought this change] + + kex.c: kex_agree_instr() improve string reading (#552) + + * kex.c: kex_agree_instr() improve string reading + + file: kex.c + notes: if haystack isn't null terminated we should use memchr() not strchar(). We should also make sure we don't walk off the end of the buffer. + credit: + Will Cosgrove, reviewed by Michael Buckley + +- [Will Cosgrove brought this change] + + kex.c: use string_buf in ecdh_sha2_nistp (#551) + + * kex.c: use string_buf in ecdh_sha2_nistp + + file: kex.c + + notes: + use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data + +- [Will Cosgrove brought this change] + + kex.c: move EC macro outside of if check #549 (#550) + + File: kex.c + + Notes: + Moved the macro LIBSSH2_KEX_METHOD_EC_SHA_HASH_CREATE_VERIFY outside of the LIBSSH2_ECDSA since it's also now used by the ED25519 code. + + Sha 256, 384 and 512 need to be defined for all backends now even if they aren't used directly. I believe this is already the case, but just a heads up. + + Credit: + Stefan-Ghinea + +- [Tim Gates brought this change] + + kex.c: fix simple typo, niumber -> number (#545) + + File: kex.c + + Notes: + There is a small typo in src/kex.c. + + Should read `number` rather than `niumber`. + + Credit: + Tim Gates + +- [Tseng Jun brought this change] + + session.c: Correct a typo which may lead to stack overflow (#533) + + File: session.c + + Notes: + Seems the author intend to terminate banner_dup buffer, later, print it to the debug console. + + Author: + Tseng Jun + +Marc Hoersken (10 Oct 2020) +- wincng: fix random big number generation to match openssl + + The old function would set the least significant bits in + the most significant byte instead of the most significant bits. + + The old function would also zero pad too much bits in the + most significant byte. This lead to a reduction of key space + in the most significant byte according to the following listing: + - 8 bits reduced to 0 bits => eg. 2048 bits to 2040 bits DH key + - 7 bits reduced to 1 bits => eg. 2047 bits to 2041 bits DH key + - 6 bits reduced to 2 bits => eg. 2046 bits to 2042 bits DH key + - 5 bits reduced to 3 bits => eg. 2045 bits to 2043 bits DH key + + No change would occur for the case of 4 significant bits. + For 1 to 3 significant bits in the most significant byte + the DH key would actually be expanded instead of reduced: + - 3 bits expanded to 5 bits => eg. 2043 bits to 2045 bits DH key + - 2 bits expanded to 6 bits => eg. 2042 bits to 2046 bits DH key + - 1 bits expanded to 7 bits => eg. 2041 bits to 2047 bits DH key + + There is no case of 0 significant bits in the most significant byte + since this would be a case of 8 significant bits in the next byte. + + At the moment only the following case applies due to a fixed + DH key size value currently being used in libssh2: + + The DH group_order is fixed to 256 (bytes) which leads to a + 2047 bits DH key size by calculating (256 * 8) - 1. + + This means the DH keyspace was previously reduced from 2047 bits + to 2041 bits (while the top and bottom bits are always set), so the + keyspace is actually always reduced from 2045 bits to 2039 bits. + + All of this is only relevant for Windows versions supporting the + WinCNG backend (Vista or newer) before Windows 10 version 1903. + + Closes #521 + +Daniel Stenberg (28 Sep 2020) +- libssh2_session_callback_set.3: explain the recv/send callbacks + + Describe how to actually use these callbacks. + + Closes #518 + +GitHub (23 Sep 2020) +- [Will Cosgrove brought this change] + + agent.c: formatting + + Improved formatting of RECV_SEND_ALL macro. + +- [Will Cosgrove brought this change] + + CMakeLists.txt: respect install lib dir #405 (#515) + + Files: + CMakeLists.txt + + Notes: + Use CMAKE_INSTALL_LIBDIR directory + + Credit: Arfrever + +- [Will Cosgrove brought this change] + + kex.c: group16-sha512 and group18-sha512 support #457 (#468) + + Files: kex.c + + Notes: + Added key exchange group16-sha512 and group18-sha512. As a result did the following: + + Abstracted diffie_hellman_sha256() to diffie_hellman_sha_algo() which is now algorithm agnostic and takes the algorithm as a parameter since we needed sha512 support. Unfortunately it required some helper functions but they are simple. + Deleted diffie_hellman_sha1() + Deleted diffie_hellman_sha1 specific macro + Cleaned up some formatting + Defined sha384 in os400 and wincng backends + Defined LIBSSH2_DH_MAX_MODULUS_BITS to abort the connection if we receive too large of p from the server doing sha1 key exchange. + Reorder the default key exchange list to match OpenSSH and improve security + + Credit: + Will Cosgrove + +- [Igor Klevanets brought this change] + + agent.c: Recv and send all bytes via network in agent_transact_unix() (#510) + + Files: agent.c + + Notes: + Handle sending/receiving partial packet replies in agent.c API. + + Credit: Klevanets Igor + +- [Daniel Stenberg brought this change] + + Makefile.am: include all test files in the dist #379 + + File: + Makefile.am + + Notes: + No longer conditionally include OpenSSL specific test files, they aren't run if we're not building against OpenSSL 1.1.x anyway. + + Credit: + Daniel Stenberg + +- [Max Dymond brought this change] + + Add support for an OSS Fuzzer fuzzing target (#392) + + Files: + .travis.yml, configure.ac, ossfuzz + + Notes: + This adds support for an OSS-Fuzz fuzzing target in ssh2_client_fuzzer, + which is a cut down example of ssh2.c. Future enhancements can improve + coverage. + + Credit: + Max Dymond + +- [Sebastián Katzer brought this change] + + mbedtls.c: ECDSA support for mbed TLS (#385) + + Files: + mbedtls.c, mbedtls.h, .travis.yml + + Notes: + This PR adds support for ECDSA for both key exchange and host key algorithms. + + The following elliptic curves are supported: + + 256-bit curve defined by FIPS 186-4 and SEC1 + 384-bit curve defined by FIPS 186-4 and SEC1 + 521-bit curve defined by FIPS 186-4 and SEC1 + + Credit: + Sebastián Katzer + +Marc Hoersken (1 Sep 2020) +- buildconf: exec autoreconf to avoid additional process (#512) + + Also make buildconf exit with the return code of autoreconf. + + Follow up to #224 + +- scp.c: fix indentation in shell_quotearg documentation + +- wincng: make more use of new helper functions (#496) + +- wincng: make sure algorithm providers are closed once (#496) + +GitHub (10 Jul 2020) +- [David Benjamin brought this change] + + openssl.c: clean up curve25519 code (#499) + + File: openssl.c, openssl.h, crypto.h, kex.c + + Notes: + This cleans up a few things in the curve25519 implementation: + + - There is no need to create X509_PUBKEYs or PKCS8_PRIV_KEY_INFOs to + extract key material. EVP_PKEY_get_raw_private_key and + EVP_PKEY_get_raw_public_key work fine. + + - libssh2_x25519_ctx was never used (and occasionally mis-typedefed to + libssh2_ed25519_ctx). Remove it. The _libssh2_curve25519_new and + _libssh2_curve25519_gen_k interfaces use the bytes. Note, if it needs + to be added back, there is no need to roundtrip through + EVP_PKEY_new_raw_private_key. EVP_PKEY_keygen already generated an + EVP_PKEY. + + - Add some missing error checks. + + Credit: + David Benjamin + +- [Will Cosgrove brought this change] + + transport.c: socket is disconnected, return error (#500) + + File: transport.c + + Notes: + This is to fix #102, instead of continuing to attempt to read a disconnected socket, it will now error out. + + Credit: + TDi-jonesds + +- [Will Cosgrove brought this change] + + stale.yml + + Increasing stale values. + +Marc Hoersken (6 Jul 2020) +- wincng: try newer DH API first, fallback to legacy RSA API + + Avoid the use of RtlGetVersion or similar Win32 functions, + since these depend on version information from manifests. + + This commit makes the WinCNG backend first try to use the + new DH algorithm API with the raw secret derivation feature. + In case this feature is not available the WinCNG backend + will fallback to the classic approach of using RSA-encrypt + to perform the required modular exponentiation of BigNums. + + The feature availability test is done during the first handshake + and the result is stored in the crypto backends global state. + + Follow up to #397 + Closes #484 + +- wincng: fix indentation of function arguments and comments + + Follow up to #397 + +- [Wez Furlong brought this change] + + wincng: use newer DH API for Windows 8.1+ + + Since Windows 1903 the approach used to perform DH kex with the CNG + API has been failing. + + This commit switches to using the `DH` algorithm provider to perform + generation of the key pair and derivation of the shared secret. + + It uses a feature of CNG that is not yet documented. The sources of + information that I've found on this are: + + * https://stackoverflow.com/a/56378698/149111 + * https://github.com/wbenny/mini-tor/blob/5d39011e632be8e2b6b1819ee7295e8bd9b7a769/mini/crypto/cng/dh.inl#L355 + + With this change I am able to successfully connect from Windows 10 to my + ubuntu system. + + Refs: https://github.com/alexcrichton/ssh2-rs/issues/122 + Fixes: https://github.com/libssh2/libssh2/issues/388 + Closes: https://github.com/libssh2/libssh2/pull/397 + +GitHub (1 Jul 2020) +- [Zenju brought this change] + + comp.c: Fix name clash with ZLIB macro "compress" (#418) + + File: comp.c + + Notes: + * Fix name clash with ZLIB macro "compress". + + Credit: + Zenju + +- [yann-morin-1998 brought this change] + + buildsystem: drop custom buildconf script, rely on autoreconf (#224) + + Notes: + The buildconf script is currently required, because we need to copy a + header around, because it is used both from the library and the examples + sources. + + However, having a custom 'buildconf'-like script is not needed if we can + ensure that the header exists by the time it is needed. For that, we can + just append the src/ directory to the headers search path for the + examples. + + And then it means we no longer need to generate the same header twice, + so we remove the second one from configure.ac. + + Now, we can just call "autoreconf -fi" to generate the autotools files, + instead of relying on the canned sequence in "buildconf", since + autoreconf has now long known what to do at the correct moment (future + versions of autotools, automake, autopoint, autoheader etc... may + require an other ordering, or other intermediate steps, etc...). + + Eventually, get rid of buildconf now it is no longer needed. In fact, we + really keep it for legacy, but have it just call autoreconf (and print a + nice user-friendly warning). Don't include it in the release tarballs, + though. + + Update doc, gitignore, and travis-CI jobs accordingly. + + Credit: + Signed-off-by: "Yann E. MORIN" + Cc: Sam Voss + +- [Will Cosgrove brought this change] + + libssh2.h: Update Diffie Hellman group values (#493) + + File: libssh2.h + + Notes: + Update the min, preferred and max DH group values based on RFC 8270. + + Credit: + Will Cosgrove, noted from email list by Mitchell Holland + +Marc Hoersken (22 Jun 2020) +- travis: use existing Makefile target to run checksrc + +- Makefile: also run checksrc on test source files + +- tests: avoid use of deprecated function _sleep (#490) + +- tests: avoid use of banned function strncat (#489) + +- tests: satisfy checksrc regarding max line length of 79 chars + + Follow up to 2764bc8e06d51876b6796d6080c6ac51e20f3332 + +- tests: satisfy checksrc with whitespace only fixes + + checksrc.pl -i4 -m79 -ASIZEOFNOPAREN -ASNPRINTF + -ACOPYRIGHT -AFOPENMODE tests/*.[ch] + +- tests: add support for ports published via Docker for Windows + +- tests: restore retry behaviour for docker-machine ip command + +- tests: fix mix of declarations and code failing C89 compliance + +- wincng: add and improve checks in bit counting function + +- wincng: align bits to bytes calculation in all functions + +- wincng: do not disable key validation that can be enabled + + The modular exponentiation also works with key validation enabled. + +- wincng: fix return value in _libssh2_dh_secret + + Do not ignore return value of modular exponentiation. + +- appveyor: build and run tests for WinCNG crypto backend + +GitHub (1 Jun 2020) +- [suryakalpo brought this change] + + INSTALL_CMAKE.md: Update formatting (#481) + + File: INSTALL_CMAKE.md + + Notes: + Although the original text would be immediately clear to seasoned users of CMAKE and/or Unix shell, the lack of newlines may cause some confusion for newcomers. Hence, wrapping the texts in a md code-block such that the newlines appear as intended. + + credit: + suryakalpo + +Marc Hoersken (31 May 2020) +- src: add new and align include guards in header files (#480) + + Make sure all include guards exist and follow the same format. + +- wincng: fix multiple definition of `_libssh2_wincng' (#479) + + Add missing include guard and move global state + from header to source file by using extern. + +GitHub (28 May 2020) +- [Will Cosgrove brought this change] + + transport.c: moving total_num check from #476 (#478) + + file: transport.c + + notes: + moving total_num zero length check from #476 up to the prior bounds check which already includes a total_num check. Makes it slightly more readable. + + credit: + Will Cosgrove + +- [lutianxiong brought this change] + + transport.c: fix use-of-uninitialized-value (#476) + + file:transport.c + + notes: + return error if malloc(0) + + credit: + lutianxiong + +- [Dr. Koutheir Attouchi brought this change] + + libssh2_sftp.h: Changed type of LIBSSH2_FX_* constants to unsigned long, fixes #474 + + File: + libssh2_sftp.h + + Notes: + Error constants `LIBSSH2_FX_*` are only returned by `libssh2_sftp_last_error()` which returns `unsigned long`. + Therefore these constants should be defined as unsigned long literals, instead of int literals. + + Credit: + Dr. Koutheir Attouchi + +- [monnerat brought this change] + + os400qc3.c: constify libssh2_os400qc3_hash_update() data parameter. (#469) + + Files: os400qc3.c, os400qc3.h + + Notes: + Fixes building on OS400. #426 + + Credit: + Reported-by: hjindra on github, dev by Monnerat + +- [monnerat brought this change] + + HACKING.CRYPTO: keep up to date with new crypto definitions from code. (#466) + + File: HACKING.CRYPTO + + Notes: + This commit updates the HACKING.CRYPTO documentation file in an attempt to make it in sync with current code. + New documented features are: + + SHA384 + SHA512 + ECDSA + ED25519 + + Credit: + monnerat + +- [Harry Sintonen brought this change] + + kex.c: Add diffie-hellman-group14-sha256 Key Exchange Method (#464) + + File: kex.c + + Notes: Added diffie-hellman-group14-sha256 kex + + Credit: Harry Sintonen + +- [Will Cosgrove brought this change] + + os400qc3.h: define sha512 macros (#465) + + file: os400qc3.h + notes: fixes for building libssh2 1.9.x + +- [Will Cosgrove brought this change] + + os400qc3.h: define EC types to fix building #426 (#462) + + File: os400qc3.h + Notes: define missing EC types which prevents building + Credit: hjindra + +- [Brendan Shanks brought this change] + + hostkey.c: Fix 'unsigned int'/'uint32_t' mismatch (#461) + + File: hostkey.c + + Notes: + These types are the same size so most compilers are fine with it, but CodeWarrior (on classic MacOS) throws an ‘illegal implicit conversion’ error + + Credit: Brendan Shanks + +- [Thomas Klausner brought this change] + + Makefile.am: Fix unportable test(1) operator. (#459) + + file: Makefile.am + + Notes: + The POSIX comparison operator for test(1) is =; bash supports == but not even test from GNU coreutils does. + + Credit: + Thomas Klausner + +- [Tseng Jun brought this change] + + openssl.c: minor changes of coding style (#454) + + File: openssl.c + + Notes: + minor changes of coding style and align preprocessor conditional for #439 + + Credit: + Tseng Jun + +- [Hans Meier brought this change] + + openssl.c: Fix for use of uninitialized aes_ctr_cipher.key_len (#453) + + File: + Openssl.c + + Notes: + * Fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression from #439 + + Credit: + Hans Meirer, Tseng Jun + +- [Zenju brought this change] + + agent.c: Fix Unicode builds on Windows (#417) + + File: agent.c + + Notes: + Fixes unicode builds for Windows in Visual Studio 16.3.2. + + Credit: + Zenju + +- [Hans Meier brought this change] + + openssl.c: Fix use-after-free crash in openssl backend without memory leak (#439) + + Files: openssl.c + + Notes: + Fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. + + Credit: + Hans Meier + +- [Romain Geissler @ Amadeus brought this change] + + Session.c: Fix undefined warning when mixing with LTO-enabled libcurl. (#449) + + File: Session.c + + Notes: + With gcc 9, libssh2, libcurl and LTO enabled for all binaries I see this + warning (error with -Werror): + + vssh/libssh2.c: In function ‘ssh_statemach_act’: + /data/mwrep/rgeissler/ospack/ssh2/BUILD/libssh2-libssh2-03c7c4a/src/session.c:579:9: error: ‘seconds_to_next’ is used uninitialized in this function [-Werror=uninitialized] + 579 | int seconds_to_next; + | ^ + lto1: all warnings being treated as errors + + Gcc normally issues -Wuninitialized when it is sure there is a problem, + and -Wmaybe-uninitialized when it's not sure, but it's possible. Here + the compiler seems to have find a real case where this could happen. I + looked in your code and overall it seems you always check if the return + code is non null, not often that it's below zero. I think we should do + the same here. With this patch, gcc is fine. + + Credit: + Romain-Geissler-1A + +- [Zenju brought this change] + + transport.c: Fix crash with delayed compression (#443) + + Files: transport.c + + Notes: + Fixes crash with delayed compression option using Bitvise server. + + Contributor: + Zenju + +- [Will Cosgrove brought this change] + + Update INSTALL_MAKE path to INSTALL_MAKE.md (#446) + + Included for #429 + +- [Will Cosgrove brought this change] + + Update INSTALL_CMAKE filename to INSTALL_CMAKE.md (#445) + + Fixing for #429 + +- [Wallace Souza brought this change] + + Rename INSTALL_CMAKE to INTALL_CMAKE.md (#429) + + Adding Markdown file extension in order to Github render the instructions properly + +Will Cosgrove (17 Dec 2019) +- [Daniel Stenberg brought this change] + + include/libssh2.h: fix comment: the known host key uses 4 bits (#438) + +- [Zenju brought this change] + + ssh-ed25519: Support PKIX + calc pubkey from private (#416) + + Files: openssl.c/h + Author: Zenju + Notes: + Adds support for PKIX key reading by fixing: + + _libssh2_pub_priv_keyfile() is missing the code to extract the ed25519 public key from a given private key + + _libssh2_ed25519_new_private_frommemory is only parsing the openssh key format but does not understand PKIX (as retrieved via PEM_read_bio_PrivateKey) + +GitHub (15 Oct 2019) +- [Will Cosgrove brought this change] + + .travis.yml: Fix Chrome and 32 bit builds (#423) + + File: .travis.yml + + Notes: + * Fix Chrome installing by using Travis build in directive + * Update to use libgcrypt20-dev package to fix 32 bit builds based on comments found here: + https://launchpad.net/ubuntu/xenial/i386/libgcrypt11-dev + +- [Will Cosgrove brought this change] + + packet.c: improved parsing in packet_x11_open (#410) + + Use new API to parse data in packet_x11_open() for better bounds checking. + +Will Cosgrove (12 Sep 2019) +- [Michael Buckley brought this change] + + knownhost.c: Double the static buffer size when reading and writing known hosts (#409) + + Notes: + We had a user who was being repeatedly prompted to accept a server key repeatedly. It turns out the base64-encoded key was larger than the static buffers allocated to read and write known hosts. I doubled the size of these buffers. + + Credit: + Michael Buckley + +GitHub (4 Sep 2019) +- [Will Cosgrove brought this change] + + packet.c: improved packet parsing in packet_queue_listener (#404) + + * improved bounds checking in packet_queue_listener + + file: packet.c + + notes: + improved parsing packet in packet_queue_listener + +- [Will Cosgrove brought this change] + + packet.c: improve message parsing (#402) + + * packet.c: improve parsing of packets + + file: packet.c + + notes: + Use _libssh2_get_string API in SSH_MSG_DEBUG/SSH_MSG_DISCONNECT. Additional uint32 bounds check in SSH_MSG_GLOBAL_REQUEST. + +- [Will Cosgrove brought this change] + + misc.c: _libssh2_ntohu32 cast bit shifting (#401) + + To quite overly aggressive analyzers. + + Note, the builds pass, Travis is having some issues with Docker images. + +- [Will Cosgrove brought this change] + + kex.c: improve bounds checking in kex_agree_methods() (#399) + + file: kex.c + + notes: + use _libssh2_get_string instead of kex_string_pair which does additional checks + +Will Cosgrove (23 Aug 2019) +- [Fabrice Fontaine brought this change] + + acinclude.m4: add mbedtls to LIBS (#371) + + Notes: + This is useful for static builds so that the Libs.private field in + libssh2.pc contains correct info for the benefit of pkg-config users. + Static link with libssh2 requires this information. + + Signed-off-by: Baruch Siach + [Retrieved from: + https://git.buildroot.net/buildroot/tree/package/libssh2/0002-acinclude.m4-add-mbedtls-to-LIBS.patch] + Signed-off-by: Fabrice Fontaine + + Credit: + Fabrice Fontaine + +- [jethrogb brought this change] + + Generate debug info when building with MSVC (#178) + + files: CMakeLists.txt + + notes: Generate debug info when building with MSVC + + credit: + jethrogb + +- [Panos brought this change] + + Add agent forwarding implementation (#219) + + files: channel.c, test_agent_forward_succeeds.c, libssh2_priv.h, libssh2.h, ssh2_agent_forwarding.c + + notes: + * Adding SSH agent forwarding. + * Fix agent forwarding message, updated example. + Added integration test code and cmake target. Added example to cmake list. + + credit: + pkittenis + +GitHub (2 Aug 2019) +- [Will Cosgrove brought this change] + + Update EditorConfig + + Added max_line_length = 80 + +- [Will Cosgrove brought this change] + + global.c : fixed call to libssh2_crypto_exit #394 (#396) + + * global.c : fixed call to libssh2_crypto_exit #394 + + File: global.c + + Notes: Don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. + + Credit: seba30 + +Will Cosgrove (30 Jul 2019) +- [hlefebvre brought this change] + + misc.c : Add an EWOULDBLOCK check for better portability (#172) + + File: misc.c + + Notes: Added support for all OS' that implement EWOULDBLOCK, not only VMS + + Credit: hlefebvre + +- [Etienne Samson brought this change] + + userauth.c: fix off by one error when loading public keys with no id (#386) + + File: userauth.c + + Credit: + Etienne Samson + + Notes: + Caught by ASAN: + + ================================================================= + ==73797==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60700001bcf0 at pc 0x00010026198d bp 0x7ffeefbfed30 sp 0x7ffeefbfe4d8 + READ of size 69 at 0x60700001bcf0 thread T0 + 2019-07-04 08:35:30.292502+0200 atos[73890:2639175] examining /Users/USER/*/libssh2_clar [73797] + #0 0x10026198c in wrap_memchr (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x1f98c) + #1 0x1000f8e66 in file_read_publickey userauth.c:633 + #2 0x1000f2dc9 in userauth_publickey_fromfile userauth.c:1513 + #3 0x1000f2948 in libssh2_userauth_publickey_fromfile_ex userauth.c:1590 + #4 0x10000e254 in test_userauth_publickey__ed25519_auth_ok publickey.c:69 + #5 0x1000090c3 in clar_run_test clar.c:260 + #6 0x1000038f3 in clar_run_suite clar.c:343 + #7 0x100003272 in clar_test_run clar.c:522 + #8 0x10000c3cc in main runner.c:60 + #9 0x7fff5b43b3d4 in start (libdyld.dylib:x86_64+0x163d4) + + 0x60700001bcf0 is located 0 bytes to the right of 80-byte region [0x60700001bca0,0x60700001bcf0) + allocated by thread T0 here: + #0 0x10029e053 in wrap_malloc (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x5c053) + #1 0x1000b4978 in libssh2_default_alloc session.c:67 + #2 0x1000f8aba in file_read_publickey userauth.c:597 + #3 0x1000f2dc9 in userauth_publickey_fromfile userauth.c:1513 + #4 0x1000f2948 in libssh2_userauth_publickey_fromfile_ex userauth.c:1590 + #5 0x10000e254 in test_userauth_publickey__ed25519_auth_ok publickey.c:69 + #6 0x1000090c3 in clar_run_test clar.c:260 + #7 0x1000038f3 in clar_run_suite clar.c:343 + #8 0x100003272 in clar_test_run clar.c:522 + #9 0x10000c3cc in main runner.c:60 + #10 0x7fff5b43b3d4 in start (libdyld.dylib:x86_64+0x163d4) + + SUMMARY: AddressSanitizer: heap-buffer-overflow (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x1f98c) in wrap_memchr + Shadow bytes around the buggy address: + 0x1c0e00003740: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fd fd + 0x1c0e00003750: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00 + 0x1c0e00003760: 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 + 0x1c0e00003770: 00 00 00 fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x1c0e00003780: fd fd fa fa fa fa fd fd fd fd fd fd fd fd fd fa + =>0x1c0e00003790: fa fa fa fa 00 00 00 00 00 00 00 00 00 00[fa]fa + 0x1c0e000037a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x1c0e000037b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x1c0e000037c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x1c0e000037d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x1c0e000037e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc + +- [Thilo Schulz brought this change] + + openssl.c : Fix use-after-free crash on reinitialization of openssl backend + + file : openssl.c + + notes : + libssh2's openssl backend has a use-after-free condition if HAVE_OPAQUE_STRUCTS is defined and you call libssh2_init() again after prior initialisation/deinitialisation of libssh2 + + credit : Thilo Schulz + +- [axjowa brought this change] + + openssl.h : Use of ifdef where if should be used (#389) + + File : openssl.h + + Notes : + LIBSSH2_ECDSA and LIBSSH2_ED25519 are always defined so the #ifdef + checks would never be false. + + This change makes it possible to build libssh2 against OpenSSL built + without EC support. + + Change-Id: I0a2f07c2d80178314dcb7d505d1295d19cf15afd + + Credit : axjowa + +- [Zenju brought this change] + + Agent.c : Preserve error info from agent_list_identities() (#374) + + Files : agent.c + + Notes : + Currently the error details as returned by agent_transact_pageant() are overwritten by a generic "agent list id failed" message by int agent_list_identities(LIBSSH2_AGENT* agent). + + Credit : + Zenju + +- [Who? Me?! brought this change] + + Channel.c: Make sure the error code is set in _libssh2_channel_open() (#381) + + File : Channel.c + + Notes : + if _libssh2_channel_open() fails, set the error code. + + Credit : + mark-i-m + +- [Orgad Shaneh brought this change] + + Kex.c, Remove unneeded call to strlen (#373) + + File : Kex.c + + Notes : + Removed call to strlen + + Credit : + Orgad Shaneh + +- [Pedro Monreal brought this change] + + Spelling corrections (#380) + + Files : + libssh2.h, libssh2_sftp.h, bcrypt_pbkdf.c, mbedtls.c, sftp.c, ssh2.c + + Notes : + * Fixed misspellings + + Credit : + Pedro Monreal + +- [Sebastián Katzer brought this change] + + Fix Potential typecast error for `_libssh2_ecdsa_key_get_curve_type` (#383) + + Issue : #383 + + Files : hostkey.c, crypto.h, openssl.c + + Notes : + * Fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` + * Rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type + + Credit : + Sebastián Katzer + +GitHub (20 Jun 2019) +- [Will Cosgrove brought this change] + + bump copyright date + +Version 1.9.0 (19 Jun 2019) + +GitHub (19 Jun 2019) +- [Will Cosgrove brought this change] + + 1.9 Formatting + +- [Will Cosgrove brought this change] + + 1.9 Release notes + +Will Cosgrove (17 May 2019) +- [Alexander Curtiss brought this change] + + libgcrypt.c : Fixed _libssh2_rsa_sha1_sign memory leak. (#370) + + File: libgcrypt.c + + Notes : Added calls to gcry_sexp_release to free memory allocated by gcry_sexp_find_token + + Credit : + Reporter : beckmi + PR by: Alexander Curtiss + +- [Orivej Desh brought this change] + + libssh2_priv.h : Fix musl build warning on sys/poll.h (#346) + + File : libssh2_priv.h + + Notes : + musl prints `redirecting incorrect #include to ` + http://git.musl-libc.org/cgit/musl/commit/include/sys/poll.h?id=54446d730cfb17c5f7bcf57f139458678f5066cc + + poll is defined by POSIX to be in poll.h: + http://pubs.opengroup.org/onlinepubs/7908799/xsh/poll.html + + Credit : Orivej Desh + +GitHub (1 May 2019) +- [Will Cosgrove brought this change] + + kex.c : additional bounds checks in diffie_hellman_sha1/256 (#361) + + Files : kex.c, misc.c, misc.h + + Notes : + Fixed possible out of bounds memory access when reading malformed data in diffie_hellman_sha1() and diffie_hellman_sha256(). + + Added _libssh2_copy_string() to misc.c to return an allocated and filled char buffer from a string_buf offset. Removed no longer needed s var in kmdhgGPshakex_state_t. + +Will Cosgrove (26 Apr 2019) +- [Tseng Jun brought this change] + + sftp.c : sftp_bin2attr() Correct attrs->gid assignment (#366) + + Regression with fix for #339 + + Credit : Tseng Jun + +- [Tseng Jun brought this change] + + kex.c : Correct type cast in curve25519_sha256() (#365) + +GitHub (24 Apr 2019) +- [Will Cosgrove brought this change] + + transport.c : scope local total_num var (#364) + + file : transport.c + notes : move local `total_num` variable inside of if block to prevent scope access issues which caused #360. + +Will Cosgrove (24 Apr 2019) +- [doublex brought this change] + + transport.c : fixes bounds check if partial packet is read + + Files : transport.c + + Issue : #360 + + Notes : + 'p->total_num' instead of local value total_num when doing bounds check. + + Credit : Doublex + +GitHub (23 Apr 2019) +- [Will Cosgrove brought this change] + + Editor config file for source files (#322) + + Simple start to an editor config file when editing source files to make sure they are configured correctly. + +- [Will Cosgrove brought this change] + + misc.c : String buffer API improvements (#332) + + Files : misc.c, hostkey.c, kex.c, misc.h, openssl.c, sftp.c + + Notes : + * updated _libssh2_get_bignum_bytes and _libssh2_get_string. Now pass in length as an argument instead of returning it to keep signedness correct. Now returns -1 for failure, 0 for success. + + _libssh2_check_length now returns 0 on success and -1 on failure to match the other string_buf functions. Added comment to _libssh2_check_length. + + Credit : Will Cosgrove + +Will Cosgrove (19 Apr 2019) +- [doublex brought this change] + + mbedtls.c : _libssh2_mbedtls_rsa_new_private_frommemory() allow private-key from memory (#359) + + File : mbedtls.c + + Notes: _libssh2_mbedtls_rsa_new_private_frommemory() fixes private-key from memory reading to by adding NULL terminator before parsing; adds passphrase support. + + Credit: doublex + +- [Ryan Kelley brought this change] + + Session.c : banner_receive() from leaking when accessing non ssh ports (#356) + + File : session.c + + Release previous banner in banner_receive() if the session is reused after a failed connection. + + Credit : Ryan Kelley + +GitHub (11 Apr 2019) +- [Will Cosgrove brought this change] + + Formatting in agent.c + + Removed whitespace. + +- [Will Cosgrove brought this change] + + Fixed formatting in agent.c + + Quiet linter around a couple if blocks and pointer. + +Will Cosgrove (11 Apr 2019) +- [Zhen-Huan HWANG brought this change] + + sftp.c : discard and reset oversized packet in sftp_packet_read() (#269) + + file : sftp.c + + notes : when sftp_packet_read() encounters an sftp packet which exceeds SFTP max packet size it now resets the reading state so it can continue reading. + + credit : Zhen-Huan HWANG + +GitHub (11 Apr 2019) +- [Will Cosgrove brought this change] + + Add agent functions libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() (#308) + + File : agent.c + + Notes : + Libssh2 uses the SSH_AUTH_SOCK env variable to read the system agent location. However, when using a custom agent path you have to set this value using setenv which is not thread-safe. The new functions allow for a way to set a custom agent socket path in a thread safe manor. + +- [Will Cosgrove brought this change] + + Simplified _libssh2_check_length (#350) + + * Simplified _libssh2_check_length + + misc.c : _libssh2_check_length() + + Removed cast and improved bounds checking and format. + + Credit : Yuriy M. Kaminskiy + +- [Will Cosgrove brought this change] + + _libssh2_check_length() : additional bounds check (#348) + + Misc.c : _libssh2_check_length() + + Ensure the requested length is less than the total length before doing the additional bounds check + +Daniel Stenberg (25 Mar 2019) +- misc: remove 'offset' from string_buf + + It isn't necessary. + + Closes #343 + +- sftp: repair mtime from e1ead35e475 + + A regression from e1ead35e4759 broke the SFTP mtime logic in + sftp_bin2attr + + Also simplified the _libssh2_get_u32/u64 functions slightly. + + Closes #342 + +- session_disconnect: don't zero state, just clear the right bit + + If we clear the entire field, the freeing of data in session_free() is + skipped. Instead just clear the bit that risk making the code get stuck + in the transport functions. + + Regression from 4d66f6762ca3fc45d9. + + Reported-by: dimmaq on github + Fixes #338 + Closes #340 + +- libssh2_sftp.h: restore broken ABI + + Commit 41fbd44 changed variable sizes/types in a public struct which + broke the ABI, which breaks applications! + + This reverts that change. + + Closes #339 + +- style: make includes and examples code style strict + + make travis and the makefile rule verify them too + + Closes #334 + +GitHub (21 Mar 2019) +- [Daniel Stenberg brought this change] + + create a github issue template + +Daniel Stenberg (21 Mar 2019) +- stale-bot: activated + + The stale bot will automatically mark stale issues (inactive for 90 + days) and if still untouched after 21 more days, close them. + + See https://probot.github.io/apps/stale/ + +- libssh2_session_supported_algs.3: fix formatting mistakes + + Reported-by: Max Horn + Fixes #57 + +- [Zenju brought this change] + + libssh2.h: Fix Error C2371 'ssize_t': redefinition + + Closes #331 + +- travis: add code style check + + Closes #324 + +- code style: unify code style + + Indent-level: 4 + Max columns: 79 + No spaces after if/for/while + Unified brace positions + Unified white spaces + +- src/checksrc.pl: code style checker + + imported as-is from curl + +Will Cosgrove (19 Mar 2019) +- Merge branch 'MichaelBuckley-michaelbuckley-security-fixes' + +- Silence unused var warnings (#329) + + Silence warnings about unused variables in this test + +- Removed unneeded > 0 check + + When checking `userauth_kybd_num_prompts > 100` we don't care if it's also above zero. + +- [Matthew D. Fuller brought this change] + + Spell OpenSS_H_ right when talking about their specific private key (#321) + + Good catch, thanks. + +GitHub (19 Mar 2019) +- [Will Cosgrove brought this change] + + Silence unused var warnings (#329) + + Silence warnings about unused variables in this test + +Michael Buckley (19 Mar 2019) +- Fix more scope and printf warning errors + +- Silence unused variable warning + +GitHub (19 Mar 2019) +- [Will Cosgrove brought this change] + + Removed unneeded > 0 check + + When checking `userauth_kybd_num_prompts > 100` we don't care if it's also above zero. + +Will Cosgrove (19 Mar 2019) +- [Matthew D. Fuller brought this change] + + Spell OpenSS_H_ right when talking about their specific private key (#321) + + Good catch, thanks. + +Michael Buckley (18 Mar 2019) +- Fix errors identified by the build process + +- Fix casting errors after merge + +GitHub (18 Mar 2019) +- [Michael Buckley brought this change] + + Merge branch 'master' into michaelbuckley-security-fixes + +Michael Buckley (18 Mar 2019) +- Move fallback SIZE_MAX and UINT_MAX to libssh2_priv.h + +- Fix type and logic issues with _libssh2_get_u64 + +Daniel Stenberg (17 Mar 2019) +- examples: fix various compiler warnings + +- lib: fix various compiler warnings + +- session: ignore pedantic warnings for funcpointer <=> void * + +- travis: add a build using configure + + Closes #320 + +- configure: provide --enable-werror + +- appveyor: remove old builds that mostly cause failures + + ... and only run on master branch. + + Closes #323 + +- cmake: add two missing man pages to get installed too + + Both libssh2_session_handshake.3 and + libssh2_userauth_publickey_frommemory.3 were installed by the configure + build already. + + Reported-by: Arfrever on github + Fixes #278 + +- include/libssh2.h: warning: "_WIN64" is not defined, evaluates to 0 + + We don't use #if for defines that might not be defined. + +- pem: //-comments are not allowed + +Will Cosgrove (14 Mar 2019) +- [Daniel Stenberg brought this change] + + userauth: fix "Function call argument is an uninitialized value" (#318) + + Detected by scan-build. + +- fixed unsigned/signed issue + +Daniel Stenberg (15 Mar 2019) +- session_disconnect: clear state + + If authentication is started but not completed before the application + gives up and instead wants to shut down the session, the '->state' field + might still be set and thus effectively dead-lock session_disconnect. + + This happens because both _libssh2_transport_send() and + _libssh2_transport_read() refuse to do anything as long as state is set + without the LIBSSH2_STATE_KEX_ACTIVE bit. + + Reported in curl bug https://github.com/curl/curl/issues/3650 + + Closes #310 + +Will Cosgrove (14 Mar 2019) +- Release notes from 1.8.1 + +Michael Buckley (14 Mar 2019) +- Use string_buf in sftp_init(). + +- Guard against out-of-bounds reads in publickey.c + +- Guard against out-of-bounds reads in session.c + +- Guard against out-of-bounds reads in userauth.c + +- Use LIBSSH2_ERROR_BUFFER_TOO_SMALL instead of LIBSSH2_ERROR_OUT_OF_BOUNDARY in sftp.c + +- Additional bounds checking in sftp.c + +- Additional length checks to prevent out-of-bounds reads and writes in _libssh2_packet_add(). https://libssh2.org/CVE-2019-3862.html + +- Add a required_size parameter to sftp_packet_require et. al. to require callers of these functions to handle packets that are too short. https://libssh2.org/CVE-2019-3860.html + +- Check the length of data passed to sftp_packet_add() to prevent out-of-bounds reads. + +- Prevent zero-byte allocation in sftp_packet_read() which could lead to an out-of-bounds read. https://libssh2.org/CVE-2019-3858.html + +- Sanitize padding_length - _libssh2_transport_read(). https://libssh2.org/CVE-2019-3861.html + + This prevents an underflow resulting in a potential out-of-bounds read if a server sends a too-large padding_length, possibly with malicious intent. + +- Defend against writing beyond the end of the payload in _libssh2_transport_read(). + +- Defend against possible integer overflows in comp_method_zlib_decomp. + +GitHub (14 Mar 2019) +- [Will Cosgrove brought this change] + + Security fixes (#315) + + * Bounds checks + + Fixes for CVEs + https://www.libssh2.org/CVE-2019-3863.html + https://www.libssh2.org/CVE-2019-3856.html + + * Packet length bounds check + + CVE + https://www.libssh2.org/CVE-2019-3855.html + + * Response length check + + CVE + https://www.libssh2.org/CVE-2019-3859.html + + * Bounds check + + CVE + https://www.libssh2.org/CVE-2019-3857.html + + * Bounds checking + + CVE + https://www.libssh2.org/CVE-2019-3859.html + + and additional data validation + + * Check bounds before reading into buffers + + * Bounds checking + + CVE + https://www.libssh2.org/CVE-2019-3859.html + + * declare SIZE_MAX and UINT_MAX if needed + +- [Will Cosgrove brought this change] + + fixed type warnings (#309) + +- [Will Cosgrove brought this change] + + Bumping version number for pending 1.8.1 release + +Will Cosgrove (4 Mar 2019) +- [Daniel Stenberg brought this change] + + _libssh2_string_buf_free: use correct free (#304) + + Use LIBSSH2_FREE() here, not free(). We allow memory function + replacements so free() is rarely the right choice... + +GitHub (26 Feb 2019) +- [Will Cosgrove brought this change] + + Fix for building against libreSSL #302 + + Changed to use the check we use elsewhere. + +- [Will Cosgrove brought this change] + + Fix for when building against LibreSSL #302 + +Will Cosgrove (25 Feb 2019) +- [gartens brought this change] + + docs: update libssh2_hostkey_hash.3 [ci skip] (#301) + +GitHub (21 Feb 2019) +- [Will Cosgrove brought this change] + + fix malloc/free mismatches #296 (#297) + +- [Will Cosgrove brought this change] + + Replaced malloc with calloc #295 + +- [Will Cosgrove brought this change] + + Abstracted OpenSSL calls out of hostkey.c (#294) + +- [Will Cosgrove brought this change] + + Fix memory dealloc impedance mis-match #292 (#293) + + When using ed25519 host keys and a custom memory allocator. + +- [Will Cosgrove brought this change] + + Added call to OpenSSL_add_all_digests() #288 + + For OpenSSL 1.0.x we need to call OpenSSL_add_all_digests(). + +Will Cosgrove (12 Feb 2019) +- [Zhen-Huan HWANG brought this change] + + SFTP: increase maximum packet size to 256K (#268) + + to match implementations like OpenSSH. + +- [Zenju brought this change] + + Fix https://github.com/libssh2/libssh2/pull/271 (#284) + +GitHub (16 Jan 2019) +- [Will Cosgrove brought this change] + + Agent NULL check in shutdown #281 + +Will Cosgrove (15 Jan 2019) +- [Adrian Moran brought this change] + + mbedtls: Fix leak of 12 bytes by each key exchange. (#280) + + Correctly free ducts by calling _libssh2_mbedtls_bignum_free() in dtor. + +- [alex-weaver brought this change] + + Fix error compiling on Win32 with STDCALL=ON (#275) + +GitHub (8 Nov 2018) +- [Will Cosgrove brought this change] + + Allow default permissions to be used in sftp_mkdir (#271) + + Added constant LIBSSH2_SFTP_DEFAULT_MODE to use the server default permissions when making a new directory + +Will Cosgrove (13 Sep 2018) +- [Giulio Benetti brought this change] + + openssl: fix dereferencing ambiguity potentially causing build failure (#267) + + When dereferencing from *aes_ctr_cipher, being a pointer itself, + ambiguity can occur; fixed possible build errors. + +Viktor Szakats (12 Sep 2018) +- win32/GNUmakefile: define HAVE_WINDOWS_H + + This macro was only used in test/example code before, now it is + also used in library code, but only defined automatically by + automake/cmake, so let's do the same for the standalone win32 + make file. + + It'd be probably better to just rely on the built-in _WIN32 macro + to detect the presence of windows.h though. It's already used + in most of libssh2 library code. There is a 3rd, similar macro + named LIBSSH2_WIN32, which might also be replaced with _WIN32. + + Ref: https://github.com/libssh2/libssh2/commit/8b870ad771cbd9cd29edbb3dbb0878e950f868ab + Closes https://github.com/libssh2/libssh2/pull/266 + +Marc Hoersken (2 Sep 2018) +- Fix conditional check for HAVE_DECL_SECUREZEROMEMORY + + "Unlike the other `AC_CHECK_*S' macros, when a symbol is not declared, + HAVE_DECL_symbol is defined to `0' instead of leaving HAVE_DECL_symbol + undeclared. When you are sure that the check was performed, + use HAVE_DECL_symbol in #if." + + Source: autoconf documentation for AC_CHECK_DECLS. + +- Fix implicit declaration of function 'SecureZeroMemory' + + Include window.h in order to use SecureZeroMemory on Windows. + +- Fix implicit declaration of function 'free' by including stdlib.h + +GitHub (27 Aug 2018) +- [Will Cosgrove brought this change] + + Use malloc abstraction function in pem parse + + Fix warning on WinCNG build. + +- [Will Cosgrove brought this change] + + Fixed possible junk memory read in sftp_stat #258 + +- [Will Cosgrove brought this change] + + removed INT64_C define (#260) + + No longer used. + +- [Will Cosgrove brought this change] + + Added conditional around engine.h include + +Will Cosgrove (6 Aug 2018) +- [Alex Crichton brought this change] + + Fix OpenSSL link error with `no-engine` support (#259) + + This commit fixes linking against an OpenSSL library that was compiled with + `no-engine` support by bypassing the initialization routines as they won't be + available anyway. + +GitHub (2 Aug 2018) +- [Will Cosgrove brought this change] + + ED25519 Key Support #39 (#248) + + OpenSSH Key and ED25519 support #39 + Added _libssh2_explicit_zero() to explicitly zero sensitive data in memory #120 + + * ED25519 Key file support - Requires OpenSSL 1.1.1 or later + * OpenSSH Key format reading support - Supports RSA/DSA/ECDSA/ED25519 types + * New string buffer reading functions - These add build-in bounds checking and convenance methods. Used for OpenSSL PEM file reading. + * Added new tests for OpenSSH formatted Keys + +- [Will Cosgrove brought this change] + + ECDSA key types are now explicit (#251) + + * ECDSA key types are now explicit + + Issue was brough up in pull request #248 diff --git a/curl/dep/libssh2/README.txt b/curl/dep/libssh2/README.txt new file mode 100644 index 0000000..fca539d --- /dev/null +++ b/curl/dep/libssh2/README.txt @@ -0,0 +1,19 @@ +libssh2 - SSH2 library +====================== + +libssh2 is a library implementing the SSH2 protocol, available under +the revised BSD license. + +Web site: https://libssh2.org/ + +Mailing list: https://lists.haxx.se/listinfo/libssh2-devel + +License: see COPYING + +Source code: https://github.com/libssh2/libssh2 + +Web site source code: https://github.com/libssh2/www + +Installation instructions are in: + - docs/INSTALL_CMAKE for CMake + - docs/INSTALL_AUTOTOOLS for Autotools diff --git a/curl/dep/libssh2/RELEASE-NOTES.txt b/curl/dep/libssh2/RELEASE-NOTES.txt new file mode 100644 index 0000000..d9af168 --- /dev/null +++ b/curl/dep/libssh2/RELEASE-NOTES.txt @@ -0,0 +1,325 @@ +libssh2 1.11.1 + +Deprecation notices: + +- Starting October 2024, the following algos go deprecated and will be + disabled in default builds (with an option to enable them): + + - DSA: `ssh-dss` hostkeys. + You can enable it now with `-DLIBSSH2_DSA_ENABLE`. + Disabled by default in OpenSSH 7.0 (2015-08-11). + Support to be removed by early 2025 from OpenSSH. + - MD5-based MACs and hashes: `hmac-md5`, `hmac-md5-96`, + `LIBSSH2_HOSTKEY_HASH_MD5` + You can disable it now with `-DLIBSSH2_NO_MD5`. + Disabled by default since OpenSSH 7.2 (2016-02-29). + - 3DES cipher: `3des-cbc` + You can disable it now with `-DLIBSSH2_NO_3DES`. + Disabled by default since OpenSSH 7.4 (2016-12-19). + - RIPEMD-160 MACs: `hmac-ripemd160`, `hmac-ripemd160@openssh.com` + You can disable it now with `-DLIBSSH2_NO_HMAC_RIPEMD`. + Removed in OpenSSH 7.6 (2017-10-03). + - Blowfish cipher: `blowfish-cbc` + You can disable it now with `-DLIBSSH2_NO_BLOWFISH`. + Removed in OpenSSH 7.6 (2017-10-03). + - RC4 ciphers: `arcfour`, `arcfour128` + You can disable it now with `-DLIBSSH2_NO_RC4`. + Removed in OpenSSH 7.6 (2017-10-03). + - CAST cipher: `cast128-cbc` + You can disable it now with `-DLIBSSH2_NO_CAST`. + Removed in OpenSSH 7.6 (2017-10-03). + +- Starting April 2025, above options will be deleted from the + libssh2 codebase. + + - Default builds will also disable support for old-style, MD5-based + encrypted private keys. + You can disable it now with `-DLIBSSH2_NO_MD5_PEM`. + +This release includes the following enhancements and bugfixes: + +- autotools: fix to update `LDFLAGS` for each detected dependency (d19b6190 #1384 #1381 #1377) +- autotools: delete `--disable-tests` option, fix CI tests (e051ae34 #1271 #715 revert: 7483edfa) +- autotools: show the default for `hidden-symbols` option (a3f5594a #1269) +- autotools: enable `-Wunused-macros` with gcc (ecdf5199 #1262 #1227 #1224) +- autotools: fix dotless gcc and Apple clang version detections (89ccc83c #1232 #1187) +- autotools: show more clang/gcc version details (fb580161 #1230) +- autotools: avoid warnings in libtool stub code (96682bd5 #1227 #1224) +- autotools: sync warning enabler code with curl (5996fefe #1223) +- autotools: rename variable (ce5f208a #1222) +- autotools: picky warning options tidy-up (cdca8cff #1221) +- autotools: fix `cp` to preserve attributes and timestamp in `Makefile.am` (f64e6318) +- autotools: fix selecting WinCNG in cross-builds (and more) (00a3b88c #1187 #1186) +- autotools: use comma separator in `Requires.private` of `libssh2.pc` (7f83de14 #1124) +- autotools: remove `AB_INIT` from `configure.ac` (f4f52ccc) +- autotools: improve libz position (c89174a7 #1077 #941 #1075 #1013 regr: 4f0f4bff) +- autotools: skip tests requiring static lib if `--disable-static` (572c57c9 #1072 #663 #1056 regr: 83853f8a) +- build: stop detecting `sys/param.h` header (2677d3b0 #1418 #1415) +- build: silence warnings inside `FD_SET()`/`FD_ISSET()` macros (323a14b2 #1379) +- build: drop `-Wformat-nonliteral` warning suppressions (c452c5cc #1342) +- build: enable `-pedantic-errors` (3ec53f3e #1286) +- build: add mingw-w64 support to `LIBSSH2_PRINTF()` attribute (f8c45794 #1287) +- build: add `LIBSSH2_NO_DEPRECATED` option (b1414503 #1267 #1266 #1260 #1259) +- build: enable missing OpenSSF-recommended warnings, with fixes (afa6b865 #1257) +- build: enable more compiler warnings and fix them (7ecc309c #1224) +- build: picky warning updates (328a96b3 #1219) +- build: revert: respect autotools `DLL_EXPORT` in `libssh2.h` (481be044 #1141 #917 revert: fb1195cf) +- build: stop requiring libssl from openssl (c84745e3 #1128) +- build: tidy-up `libssh2.pc.in` variable names (5720dd9f #1125) +- build: add/fix `Requires.private` packages in `libssh2.pc` (ef538069 #1123) +- buildconf: drop (814a850c #1441 follow: fc5d7788) +- checksrc: update, check all sources, fix fallouts (1117b677 #1457) +- checksrc: sync with curl (8cd473c9 #1272) +- checksrc: fix spelling in comment (a95d401f) +- checksrc: modernise Perl file open (3d309f9b) +- checksrc: switch to dot file (d67a91aa #1052) +- ci: use Ninja with cmake (20ad047d #1458) +- ci: disable dependency tracking in autotools builds (e44f0418 #1396) +- ci: fix mbedtls runners on macOS (84411539 #1381) +- ci: enable Unity mode for most CMake builds (1bfae57b #1367 #1034) +- ci: add shellcheck job and script (d88b9bcd) +- ci: verify build and install from tarball (a86e27e8 #1362) +- ci: add reproducibility test for `maketgz` (2d765e45 #1360) +- ci: use Linux runner for BSDs, add arm64 FreeBSD 14 job (6f86b196 #1343) +- ci: do not parallelize `distcheck` job (5e65dd87 #1339) +- ci: add FreeBSD 14 job, fix issues (46333adf #1277) +- ci: add OmniOS job, fix issues (5e0ec991) +- ci: show compiler in cross/cygwin job names (c9124088) +- ci: add OpenBSD (v7.4) job + fix build error in example (0c9a8e35 #1250) +- ci: add NetBSD (v9.3) job (65c7a7a5) +- ci: update and speed up FreeBSD job (eee4e805) +- ci: use absolute path in `CMAKE_INSTALL_PREFIX` (74948816 #1247) +- ci: boost mbedTLS build speed (236e79a1 #1245) +- ci: add BoringSSL job (cmake, gcc, amd64) (c9dd3566 #1233) +- ci: fixup FreeBSD version, bump mbedTLS (fea6664e #1217) +- ci: add FreeBSD 13.2 job (a7d2a573 #1215) +- ci: mbedTLS 3.5.0 (5e190442 #1202) +- ci: update actions, use shallow clones with appveyor (d468a33f #1199) +- ci: replace `mv` + `chmod` with `install` in `Dockerfile` (5754fed6 #1175) +- ci: set file mode early in `appveyor_docker.yml` (633db55f) +- ci: add spellcheck (codespell) (a79218d3) +- ci: add MSYS builds (autotools and cmake) (d43b8d9b #1162) +- ci: add Cygwin builds (autotools and cmake) (f1e96e73 #1161) +- ci: add mingw-w64 UWP build (1215aa5f #1155 #1147) +- ci: add missing timeout to 'autotools distcheck' step (6265ffdb) +- ci: add non-static autotools i386 build, ignore GHA updates on AppVeyor (c6e137f7 #1074 #1072) +- ci: prefer `=` operator in shell snippets (e5c03043 #1073) +- ci: drop redundant/unused vars, sync var names (ab8e95bc #1059) +- ci: add i386 Linux build (with mbedTLS) (abdf40c7 #1057 #1053) +- ci/appveyor: reduce test runs (workaround for infrastructure permafails) (b5e68bdc #1461) +- ci/appveyor: increase wait for SSH server on GHA (bf3af90b) +- ci/appveyor: bump to OpenSSL 3.2.1 (53d9c1a6 #1363 #1348) +- ci/appveyor: re-enable parallel mode (e190e5b2 #1294 #884 #867) +- ci/appveyor: delete UWP job broken since Visual Studio upgrade (d0a7f1da #1275) +- ci/appveyor: YAML/PowerShell formatting, shorten variable name (06fd721f #1200) +- ci/appveyor: move to pure PowerShell (8a081fd9 #1197) +- ci/GHA: revert concurrency and improve permissions (e4c042f6) +- ci/GHA: FreeBSD 14.1, actions bump (ae04b1b9 #1424) +- ci/GHA: fix wolfSSL-from-source AES-GCM tests (1c0b07a7 #1409 #1408) +- ci/GHA: add Linux job with latest wolfSSL built from source (d4cea53f #1408 #1299 #1020) +- ci/GHA: tidy up build-from-source steps (2c633033) +- ci/GHA: show configure logs on failure and other tidy-ups (dab48398 #1403) +- ci/GHA: bump parallel jobs to nproc+1 (6f3d3bc8 #1402) +- ci/GHA: show test logs on failure (b8ffa7a5 #1401) +- ci/GHA: fix `Dockerfile` failing after Ubuntu package update (839bb84e #1400) +- ci/GHA: use ubuntu-latest with OmniOS job (50143d58) +- ci/GHA: shell syntax tidy-up (3b23e039 #1390) +- ci/GHA: bump NetBSD/OpenBSD, add NetBSD arm64 job (e980af72 #1388) +- ci/GHA: tidy up wolfSSL autotools config on macOS (5953c1f1 #1383) +- ci/GHA: shorter mbedTLS autotools workaround (736e3d7d #1382 #1381) +- ci/GHA: fix gcrypt with autotools/macOS/Homebrew/ARM64 (ae2770de #1377) +- ci/GHA: fix verbose option for autotools jobs (499b27ae #1376) +- ci/GHA: dump `config.log` on failure for macOS autotools jobs (4fa69214 #1375) +- ci/GHA: fix `autoreconf` failure on macOS/Homebrew (0b64b30b #1374) +- ci/GHA: fixup Homebrew location (for ARM runners) (6128aee0 #1373) +- ci/GHA: review/fixup auto-cancel settings (b08cfbc9 #1292) +- ci/GHA: restore curly braces in `if` (36748270 #1145) +- ci/GHA: simplify `if` strings (cab3db58 #1140) +- cmake: sync and improve Find modules, add `pkg-config` native detection (45064137 #1445 #1420) +- cmake: generate `LIBSSH2_PC_LIBS_PRIVATE` dynamically (c87f1296 #1466) +- cmake: add comment about `ibssh2.pc.in` variables (14b1b9d0) +- cmake: support absolute `CMAKE_INSTALL_INCLUDEDIR`/`CMAKE_INSTALL_LIBDIR` (d70cee36 #1465) +- cmake: rename two variables and initialize them (0fce9dcc #1464) +- cmake: prefer `find_dependency()` in `libssh2-config.cmake` (d9c2e550 #1460) +- cmake: tidy up syntax, minor improvements (9d9ee780 #1446) +- cmake: rename mbedTLS and wolfSSL Find modules (570de0f2) +- cmake: fixup version detection in mbedTLS Find module (8e3c40b2 #1444) +- cmake: mbedTLS detection tidy-ups (6d1d13c2 #1438) +- cmake: add quotes, delete ending dirseps (2bb46d44 #1437 #1166) +- cmake: sync formatting in `cmake/Find*` modules (a0310699) +- cmake: tidy up function name casing in `CopyRuntimeDependencies.cmake` (03547cb8) +- cmake: use the imported target of FindOpenSSL module (82b09f9b #1322) +- cmake: rename picky warnings script (64d6789f #1225) +- cmake: fix multiple include of libssh2 package (932d6a32 #1216) +- cmake: show crypto backend in feature summary (20387285 #1211) +- cmake: simplify showing CMake version (fc00bdd7 #1203) +- cmake: cleanup mbedTLS version detection more (4c241d5c #1196 #1192) +- cmake: delete duplicate `include()` (30eef0a6) +- cmake: improve/fix mbedTLS detection (41594675 #1192 #1191) +- cmake: tidy-up `foreach()` syntax (4a64ca14 #1180) +- cmake: verify `libssh2_VERSION` in integration tests (a20572e9) +- cmake: show cmake versions in ci (87f5769b) +- cmake: quote more strings (e9c7d3af #1173) +- cmake: add `ExternalProject` integration test (aeaefaf6 #1171) +- cmake: add integration tests (8715c3d5 #1170) +- cmake: (re-)add aliases for `add_subdirectory()` builds (4ff64ae3 #1169) +- cmake: style tidy-up (3fa5282d #1166) +- cmake: add `LIB_NAME` variable (5453fc80 #1159) +- cmake: tidy-up concatenation in `CMAKE_MODULE_PATH` (ae7d5108 #1157) +- cmake: replace `libssh2` literals with `PROJECT_NAME` variable (72fd2595 #1152) +- cmake: fix `STREQUAL` check in error branch (42d3bf13 #1151) +- cmake: cache more config values on Windows (11a03690 #1142) +- cmake: streamline invocation (f58f77b5 #1138) +- cmake: merge `set_target_properties()` calls (a9091007 #1132) +- cmake: (re-)add zlib to `Libs.private` in `libssh2.pc` (64643018 #1131) +- cmake: use `wolfssl/options.h` for detection, like autotools (c5ec6c49 #1130) +- cmake: add openssl libs to `Libs.private` in `libssh2.pc` (5cfa59d3 #1127) +- cmake: bump minimum CMake version to v3.7.0 (9cd18f45 #1126) +- cmake: CMAKE_SOURCE_DIR -> PROJECT_SOURCE_DIR (0f396aa9 #1121) +- cmake: tidy-ups (2fc36790 #1122) +- cmake: re-add `Libssh2:libssh2` for compatibility + lowercase namespace (2da13c13 #1104 #731 #1103) +- copyright: remove years from copyright headers (187d89bb #1082) +- disable DSA by default (b7ab0faa #1435 #1433) +- docs: update `INSTALL_AUTOTOOLS` (2f0efde3 #1316) +- docs: replace SHA1 with SHA256 in CMake example (766bde9f) +- example: restore `sys/time.h` for AIX (24503cb9 #1340 #1335 #1334 #1001 regr: e53aae0e) +- example: use `libssh2_socket_t` in X11 example (3f60ccb7) +- example: replace remaining libssh2_scp_recv with libssh2_scp_recv2 in output messages (8d69e63d #1258 follow: 6c84a426) +- example: fix regression in `ssh2_exec.c` (279a2e57 #1106 #861 #846 #1105 regr: b13936bd) +- example, tests: call `WSACleanup()` for each `WSAStartup()` (94b6bad3 #1283) +- example, tests: fix/silence `-Wformat-truncation=2` gcc warnings (744e059f) +- hostkey: do not advertise ssh-rsa when SHA1 is disabled (82d1b8ff #1093 #1092) +- kex: prevent possible double free of hostkey (b3465418 #1452) +- kex: always check for null pointers before calling _libssh2_bn_set_word (9f23a3bb #1423) +- kex: fix a memory leak in key exchange (19101843 #1412 #1404) +- kex: always add extension indicators to kex_algorithms (00e2a07e #1327 #1326) +- libssh2.h: add deprecated function warnings (9839ebe5 #1289 #1260) +- libssh2.h: add portable `LIBSSH2_SOCKET_CLOSE()` macro (28dbf016 #1278) +- libssh2.h: use `_WIN32` for Windows detection instead of rolling our own (631e7734 #1238) +- libssh2.pc: reference mbedcrypto pkgconfig (c149a127 #1405) +- libssh2.pc: re-add & extend support for static-only libssh2 builds (624abe27 #1119 #1114) +- libssh2.pc: don't put `@LIBS@` in pc file (1209c16d) +- mac: add empty hash functions for `mac_method_hmac_aesgcm` to not crash when e.g. setting `LIBSSH2_METHOD_CRYPT_CS` (b2738391 #1321) +- mac: handle low-level errors (f64885b6 #1297) +- Makefile.mk: delete Windows-focused raw GNU Make build (43485579 #1204) +- maketgz: reproducible tarballs/zip, display tarball hashes (d52fe1b4 #1357 #1359) +- maketgz: `set -eu`, reproducibility, improve zip, add CI test (cba7f975 #1353) +- man: improve `libssh2_userauth_publickey_from*` manpages (581b72aa #1347 #1308 #652) +- man: fix double spaces and dash escaping (a3ffc422 #1210) +- man: add description to `libssh2_session_get_blocking.3` (67e39091 #1185) +- mbedtls: always init ECDSA mbedtls_pk_context (a50d7deb #1430) +- mbedtls: correctly initialize values (ECDSA) (1701d5c0 #1428 #1421) +- mbedtls: expose `mbedtls_pk_load_file()` for our use (1628f6ca #1421 #1393 #1349 follow: e973493f) +- mbedtls: add workaround + FIXME to build with 3.6.0 (2e4c5ec4 #1349) +- mbedtls: improve disabling `-Wredundant-decls` (ecec68a2 #1226 #1224) +- mbedtls: include `version.h` for `MBEDTLS_VERSION_NUMBER` (9d7bc253 #1095 #1094) +- mbedtls: use more `size_t` to sync up with `crypto.h` (1153ebde #1054 #879 #846 #1053) +- md5: allow disabling old-style encrypted private keys at build-time (eb9f9de2 #1181) +- mingw: fix printf mask for 64-bit integers (36c1e1d1 #1091 #876 #846 #1090) +- misc: flatten `_libssh2_explicit_zero` if tree (74e74288 #1149) +- NMakefile: delete (c515eed3 #1134 #1129) +- openssl: free allocated resources when using openssl3 (b942bad1 #1459) +- openssl: fix memory leaks in `_libssh2_ecdsa_curve_name_with_octal_new` and `_libssh2_ecdsa_verify` (8d3bc19b #1449) +- openssl: fix calculating DSA public key with OpenSSL 3 (8b3c6e9d #1380) +- openssl: initialize BIGNUMs to NULL in `gen_publickey_from_dsa` for OpenSSL 3 (f1133c75 #1320) +- openssl: fix cppcheck found NULL dereferences (f2945905 #1304) +- openssl: delete internal `read_openssh_private_key_from_memory()` (34aff5ff #1306) +- openssl: use OpenSSL 3 HMAC API, add `no-deprecated` CI job (363dcbf4 #1243 #1235 #1207) +- openssl: make a function static, add `#ifdef` comments (efee9133 #1246 #248 follow: 03092292) +- openssl: fix DSA code to use OpenSSL 3 API (82581941 #1244 #1207) +- openssl: fix `EC_KEY` reference with OpenSSL 3 `no-deprecated` build (487152f4 #1236 #1235 #1207) +- openssl: use non-deprecated APIs with OpenSSL 3.x (b0ab005f #1207) +- openssl: silence `-Wunused-value` warnings (bf285500 #1205) +- openssl: use automatic initialization with LibreSSL 2.7.0+ (d79047c9 #1146 #302) +- openssl: add missing check for `LIBRESSL_VERSION_NUMBER` before use (4a42f42e #1117 #1115) +- os400: drop vsprintf() use (40e817ff #1462 #1457) +- os400: Add two recent files to the distribution (e4c65e5b #1364) +- os400: fix shellcheck warnings in scripts (fixups) (81341e1e #1366 #1364 #1358) +- os400: fix shellcheck warnings in scripts (c6625707 #1358) +- os400: maintain up to date (8457c37a #1309) +- packet: properly bounds check packet_authagent_open() (88a960a8 #1179) +- pem: fix private keys encrypted with AES-GCM methods (e87bdefa #1133) +- reuse: upgrade to `REUSE.toml` (70b8bf31 #1419) +- reuse: fix duplicate copyright warning (b9a4ed83) +- reuse: comply with 3.1 spec and 2.0.0 checker (fe6239a1 #1102 #1101 #1098) +- reuse: provide SPDX identifiers (f6aa31f4 #1084) +- scp: fix missing cast for targets without large file support (c317e06f #1060 #1057 #1002 regr: 5db836b2) +- session: support server banners up to 8192 bytes (was: 256) (1a9e8811 #1443 #1442) +- session: add `libssh2_session_callback_set2()` (c0f69548 #1285) +- session: handle EINTR from send/recv/poll/select to try again as the error is not fatal (798ed4a7 #1058 #955) +- sftp: increase SFTP_HANDLE_MAXLEN back to 4092 (75de6a37 #1422) +- sftp: implement posix-rename@openssh.com (fb652746 #1386) +- src: implement chacha20-poly1305@openssh.com (492bc543 #1426 #584) +- src: use `UINT32_MAX` (dc206408 #1413) +- src: fix type warning in `libssh2_sftp_unlink` macro (ac2e8c73 #1406) +- src: check the return value from `_libssh2_bn_*()` functions (95c824d5 #1354) +- src: support RSA-SHA2 cert-based authentication (rsa-sha2-512_cert and rsa-sha2-256_cert) (3a6ab70d #1314) +- src: check hash update/final success (4718ede4 #1303 #1301) +- src: check hash init success (2ed9eb92 #1301) +- src: add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" (d34d9258 #1291 #1290) +- src: disable `-Wsign-conversion` warnings, add option to re-enable (6e451669 #1284 #1257) +- src: fix gcc 13 `-Wconversion` warning on Darwin (8cca7b77 #1209 follow: 08354e0a) +- src: drop a redundant `#include` (1f0174d0 #1153) +- src: improve MSVC C4701 warning fix (8b924999 #1086 #876 #1083) +- src: bump `hash_len` to `size_t` in `LIBSSH2_HOSTKEY_METHOD` (8b917d76 #1076) +- src: bump DSA and ECDSA sign `hash_len` to `size_t` (7b8e0225 #1055) +- tests: avoid using `MAXPATHLEN`, for portability (12427f4f #1415 #198 #1414) +- tests: fix excluding AES-GCM tests (fbd9d192 #1410) +- tests: drop default cygpath option `-u` (38e50aa0) +- tests: fix shellcheck issues in `test_sshd.test` (a2ac8c55) +- tests: sync port number type with the rest of codebase (eb996af8) +- tests: fall back to `$LOGNAME` for username (5326a5ce #1241 #1240) +- tests: show cmake version used in integration tests (2cd2f40e #1201) +- tests: formatting and tidy-ups (e61987a3) +- tests: replace FIXME with comments (1a99a86a) +- tests: add aes256-gcm encrypted key test (802336cf #1135 #1133) +- tests: trap signals in scripts (b2916b28 #1098) +- tests: cast to avoid `-Wchar-subscripts` with Cygwin (43df6a46 #1081 #1080) +- test_read: make it run without Docker (57e9d18e #1139) +- test_sshd.test: show sshd and test connect logs on harness failure (299c2040 #1097) +- test_sshd.test: set a safe PID directory (e8cabdcf #1089) +- test_sshd.test: minor cleanups (d29eea1d) +- tidy-up: link updates (c905bfd2 #1434) +- tidy-up: typo in comment (792e1b6f) +- tidy-up: fix typo found by codespell (706ec36d) +- tidy-up: bump casts from int to long for large C99 types in printfs (2e5a8719 #1264 #1257) +- tidy-up: `unsigned` -> `unsigned int` (b136c379) +- tidy-up: stop using leading underscores in macro names (c6589b88 #1248) +- tidy-up: around `stdint.h` (bfa00f1b #1212) +- tidy-up: fix typo in `readme.vms` (a9a79e7a) +- tidy-up: use built-in `_WIN32` macro to detect Windows (6fbc9505 #1195) +- tidy-up: drop `www.` from `www.libssh2.org` (6e3e8839 #1172) +- tidy-up: delete duplicate word from comment (76307435) +- tidy-up: avoid exclamations, prefer single quotes, in outputs (003fb454 #1079) +- TODO: disable or drop weak algos (0b4bdc85 #1261) +- transport: fix unstable connections over non-blocking sockets (de004875 #1454 #720 #1431 #1397) +- transport: check ETM on remote end when receiving (bde10825 #1332 #1331) +- transport: fix incorrect byte offset in debug message (2388a3aa #1096) +- userauth: avoid oob with huge interactive kbd response (f3a85cad #1337) +- userauth: add a new structure to separate memory read and file read (63b4c20e #773) +- userauth: check whether `*key_method` is a NULL pointer instead of `key_method` (bec57c40) +- wincng: fix `DH_GEX_MAXGROUP` set higher than supported (48584671 #1372 #493) +- wincng: add to ci/GHA, add `./configure` option `--enable-ecdsa-wincng` (3f98bfb0 #1368 #1315) +- wincng: add ECDSA support for host and user authentication (3e723437 #1315) +- wincng: prefer `ULONG`/`DWORD` over `unsigned long` (186c1d63 #1165) +- wincng: tidy-ups (7bb669b5 #1164) +- wolfssl: drop header path hack (8ae1b2d7 #1439) +- wolfssl: fix `EVP_Cipher()` use with v5.6.0 and older (a5b0fac2 #1407 #1394 #797 #1299 #1020) +- wolfssl: bump version in upstream issue comment (5cab802c) +- wolfssl: require v5.4.0 for AES-GCM (260a721c #1411 #1299 #1020) +- wolfssl: enable debug logging in wolfSSL when compiled in (76e7a68a #1310) + +This release would not have looked like this without help, code, reports and +advice from friends like these: + + Viktor Szakats, Michael Buckley, Patrick Monnerat, Ren Mingshuai, + Will Cosgrove, Daniel Stenberg, Josef Cejka, Nicolas Mora, Ryan Kelley, + Aaron Stone, Adam, Anders Borum, András Fekete, Andrei Augustin, binary1248, + Brian Inglis, brucsc on GitHub, concussious on github, Dan Fandrich, + dksslq on github, Haowei Hsu, Harmen Stoppels, Harry Mallon, Jack L, + Jakob Egger, Jiwoo Park, João M. S. Silva, Joel Depooter, Johannes Passing, + Jose Quaresma, Juliusz Sosinowicz, Kai Pastor, Kenneth Davidson, + klux21 on github, Lyndon Brown, Marc Hoersken, mike-jumper, naddy, + Nursan Valeyev, Paul Howarth, PewPewPew, Radek Brich, rahmanih on github, + rolag on github, Seo Suchan, shubhamhii on github, Steve McIntyre, + Tejaswi Kandula, Tobias Stoeckmann, Trzik, Xi Ruoyao diff --git a/curl/dep/libssh2/docs/AUTHORS.txt b/curl/dep/libssh2/docs/AUTHORS.txt new file mode 100644 index 0000000..e94299f --- /dev/null +++ b/curl/dep/libssh2/docs/AUTHORS.txt @@ -0,0 +1,80 @@ + libssh2 is the result of many friendly people. This list is an attempt to + mention all contributors. If we have missed anyone, tell us! + + This list of names is a-z sorted. + +Adam Gobiowski +Alexander Holyapin +Alexander Lamaison +Alfred Gebert +Ben Kibbey +Bjorn Stenborg +Carlo Bramini +Cristian Rodríguez +Daiki Ueno +Dan Casey +Dan Fandrich +Daniel Stenberg +Dave Hayden +Dave McCaldon +David J Sullivan +David Robins +Dmitry Smirnov +Douglas Masterson +Edink Kadribasic +Erik Brossler +Francois Dupoux +Gellule Xg +Grubsky Grigory +Guenter Knauf +Heiner Steven +Henrik Nordstrom +James Housleys +Jasmeet Bagga +Jean-Louis Charton +Jernej Kovacic +Joey Degges +John Little +Jose Baars +Jussi Mononen +Kamil Dudka +Lars Nordin +Mark McPherson +Mark Smith +Markus Moeller +Matt Lilley +Matthew Booth +Maxime Larocque +Mike Protts +Mikhail Gusarov +Neil Gierman +Olivier Hervieu +Paul Howarth +Paul Querna +Paul Veldkamp +Peter Krempa +Peter O'Gorman +Peter Stuge +Pierre Joye +Rafael Kitover +Romain Bondue +Sara Golemon +Satish Mittal +Sean Peterson +Selcuk Gueney +Simon Hart +Simon Josefsson +Sofian Brabez +Steven Ayre +Steven Dake +Steven Van Ingelgem +TJ Saunders +Tommy Lindgren +Tor Arntsen +Viktor Szakats +Vincent Jaulin +Vincent Torri +Vlad Grachov +Wez Furlong +Yang Tse +Zl Liu diff --git a/curl/dep/libssh2/docs/HACKING-CRYPTO.txt b/curl/dep/libssh2/docs/HACKING-CRYPTO.txt new file mode 100644 index 0000000..1ef6c44 --- /dev/null +++ b/curl/dep/libssh2/docs/HACKING-CRYPTO.txt @@ -0,0 +1,989 @@ + Definitions needed to implement a specific crypto library + +This document offers some hints about implementing a new crypto library +interface. + +A crypto library interface consists of at least a header file, defining +entities referenced from the libssh2 core modules. +Real code implementation (if needed), is left at the implementor's choice. + +This document lists the entities that must/may be defined in the header file. + +Procedures listed as "void" may indeed have a result type: the void indication +indicates the libssh2 core modules never use the function result. + + +0) Build system. + +Adding a crypto backend to the autotools build system (./configure) is easy: + +0.1) Add one new line in configure.ac + +m4_set_add([crypto_backends], [newname]) + +This automatically creates a --with-crypto=newname option. + +0.2) Add an m4_case stanza to LIBSSH2_CRYPTO_CHECK in acinclude.m4 + +This must check for all required libraries, and if found set and AC_SUBST a +variable with the library linking flags. The recommended method is to use +LIBSSH2_LIB_HAVE_LINKFLAGS from LIBSSH2_CRYPTO_CHECK, which automatically +creates and handles a --with-$newname-prefix option and sets an +LTLIBNEWNAME variable on success. + +0.3) Add new header to src/Makefile.inc + +0.4) Include new source in src/crypto.c + +0.5) Add a new block in configure.ac + +``` +elif test "$found_crypto" = "newname"; then + LIBS="${LIBS} ${LTLIBNEWNAME}" +``` + +0.6) Add CMake detection logic to CMakeLists.txt + +1) Crypto library initialization/termination. + +void libssh2_crypto_init(void); +Initializes the crypto library. May be an empty macro if not needed. + +void libssh2_crypto_exit(void); +Terminates the crypto library use. May be an empty macro if not needed. + +1.1) Crypto runtime detection + +The libssh2_crypto_engine_t enum must include the new engine, and +libssh2_crypto_engine() must return it when it is built in. + +2) HMAC + +libssh2_hmac_ctx +Type of an HMAC computation context. Generally a struct. +Used for all hash algorithms. + +int _libssh2_hmac_ctx_init(libssh2_hmac_ctx *ctx); +Initializes the HMAC computation context ctx. +Called before setting-up the hash algorithm. +Must return 1 for success and 0 for failure. + +int _libssh2_hmac_update(libssh2_hmac_ctx *ctx, + const void *data, int datalen); +Continue computation of an HMAC on datalen bytes at data using context ctx. +Must return 1 for success and 0 for failure. + +int _libssh2_hmac_final(libssh2_hmac_ctx *ctx, + void output[]); +Get the computed HMAC from context ctx into the output buffer. The +minimum data buffer size depends on the HMAC hash algorithm. +Must return 1 for success and 0 for failure. + +void _libssh2_hmac_cleanup(libssh2_hmac_ctx *ctx); +Releases the HMAC computation context at ctx. + + +3) Hash algorithms. + +3.1) SHA-1 +Must always be implemented. + +SHA_DIGEST_LENGTH +#define to 20, the SHA-1 digest length. + +libssh2_sha1_ctx +Type of an SHA-1 computation context. Generally a struct. + +int libssh2_sha1_init(libssh2_sha1_ctx *x); +Initializes the SHA-1 computation context at x. +Returns 1 for success and 0 for failure + +int libssh2_sha1_update(libssh2_sha1_ctx ctx, + const unsigned char *data, + size_t len); +Continue computation of SHA-1 on len bytes at data using context ctx. +Note: if the ctx parameter is modified by the underlying code, +this procedure must be implemented as a macro to map ctx --> &ctx. +Must return 1 for success and 0 for failure. + +int libssh2_sha1_final(libssh2_sha1_ctx ctx, + unsigned char output[SHA_DIGEST_LEN]); +Get the computed SHA-1 signature from context ctx and store it into the +output buffer. +Release the context. +Note: if the ctx parameter is modified by the underlying code, +this procedure must be implemented as a macro to map ctx --> &ctx. +Must return 1 for success and 0 for failure. + +int libssh2_hmac_sha1_init(libssh2_hmac_ctx *ctx, + const void *key, + int keylen); +Setup the HMAC computation context ctx for an HMAC-SHA-1 computation using the +keylen-byte key. Is invoked just after libssh2_hmac_ctx_init(). +Returns 1 for success and 0 for failure. + +3.2) SHA-256 +Must always be implemented. + +SHA256_DIGEST_LENGTH +#define to 32, the SHA-256 digest length. + +libssh2_sha256_ctx +Type of an SHA-256 computation context. Generally a struct. + +int libssh2_sha256_init(libssh2_sha256_ctx *x); +Initializes the SHA-256 computation context at x. +Returns 1 for success and 0 for failure + +int libssh2_sha256_update(libssh2_sha256_ctx ctx, + const unsigned char *data, + size_t len); +Continue computation of SHA-256 on len bytes at data using context ctx. +Note: if the ctx parameter is modified by the underlying code, +this procedure must be implemented as a macro to map ctx --> &ctx. +Must return 1 for success and 0 for failure. + +int libssh2_sha256_final(libssh2_sha256_ctx ctx, + unsigned char output[SHA256_DIGEST_LENGTH]); +Gets the computed SHA-256 signature from context ctx into the output buffer. +Release the context. +Note: if the ctx parameter is modified by the underlying code, +this procedure must be implemented as a macro to map ctx --> &ctx. +Must return 1 for success and 0 for failure. + +int libssh2_sha256(const unsigned char *message, + size_t len, + unsigned char output[SHA256_DIGEST_LENGTH]); +Computes the SHA-256 signature over the given message of length len and +store the result into the output buffer. +Return 1 if error, else 0. +Note: Seems unused in current code, but defined in each crypto library backend. + +LIBSSH2_HMAC_SHA256 +#define as 1 if the crypto library supports HMAC-SHA-256, else 0. +If defined as 0, the rest of this section can be omitted. + +int libssh2_hmac_sha256_init(libssh2_hmac_ctx *ctx, + const void *key, + int keylen); +Setup the HMAC computation context ctx for an HMAC-256 computation using the +keylen-byte key. Is invoked just after libssh2_hmac_ctx_init(). +Returns 1 for success and 0 for failure. + +3.3) SHA-384 +Mandatory if ECDSA is implemented. Can be omitted otherwise. + +SHA384_DIGEST_LENGTH +#define to 48, the SHA-384 digest length. + +libssh2_sha384_ctx +Type of an SHA-384 computation context. Generally a struct. + +int libssh2_sha384_init(libssh2_sha384_ctx *x); +Initializes the SHA-384 computation context at x. +Returns 1 for success and 0 for failure + +int libssh2_sha384_update(libssh2_sha384_ctx ctx, + const unsigned char *data, + size_t len); +Continue computation of SHA-384 on len bytes at data using context ctx. +Note: if the ctx parameter is modified by the underlying code, +this procedure must be implemented as a macro to map ctx --> &ctx. +Must return 1 for success and 0 for failure. + +int libssh2_sha384_final(libssh2_sha384_ctx ctx, + unsigned char output[SHA384_DIGEST_LENGTH]); +Gets the computed SHA-384 signature from context ctx into the output buffer. +Release the context. +Note: if the ctx parameter is modified by the underlying code, +this procedure must be implemented as a macro to map ctx --> &ctx. +Must return 1 for success and 0 for failure. + +int libssh2_sha384(const unsigned char *message, + size_t len, + unsigned char output[SHA384_DIGEST_LENGTH]); +Computes the SHA-384 signature over the given message of length len and +store the result into the output buffer. +Return 1 if error, else 0. + +3.4) SHA-512 +Must always be implemented. + +SHA512_DIGEST_LENGTH +#define to 64, the SHA-512 digest length. + +libssh2_sha512_ctx +Type of an SHA-512 computation context. Generally a struct. + +int libssh2_sha512_init(libssh2_sha512_ctx *x); +Initializes the SHA-512 computation context at x. +Returns 1 for success and 0 for failure + +int libssh2_sha512_update(libssh2_sha512_ctx ctx, + const unsigned char *data, + size_t len); +Continue computation of SHA-512 on len bytes at data using context ctx. +Note: if the ctx parameter is modified by the underlying code, +this procedure must be implemented as a macro to map ctx --> &ctx. +Must return 1 for success and 0 for failure. + +int libssh2_sha512_final(libssh2_sha512_ctx ctx, + unsigned char output[SHA512_DIGEST_LENGTH]); +Gets the computed SHA-512 signature from context ctx into the output buffer. +Release the context. +Note: if the ctx parameter is modified by the underlying code, +this procedure must be implemented as a macro to map ctx --> &ctx. +Must return 1 for success and 0 for failure. + +int libssh2_sha512(const unsigned char *message, + size_t len, + unsigned char output[SHA512_DIGEST_LENGTH]); +Computes the SHA-512 signature over the given message of length len and +store the result into the output buffer. +Return 1 if error, else 0. +Note: Seems unused in current code, but defined in each crypto library backend. + +LIBSSH2_HMAC_SHA512 +#define as 1 if the crypto library supports HMAC-SHA-512, else 0. +If defined as 0, the rest of this section can be omitted. + +int libssh2_hmac_sha512_init(libssh2_hmac_ctx *ctx, + const void *key, + int keylen); +Setup the HMAC computation context ctx for an HMAC-512 computation using the +keylen-byte key. Is invoked just after libssh2_hmac_ctx_init(). +Returns 1 for success and 0 for failure. + +3.5) MD5 +LIBSSH2_MD5 +#define to 1 if the crypto library supports MD5, else 0. +If defined as 0, the rest of this section can be omitted. + +MD5_DIGEST_LENGTH +#define to 16, the MD5 digest length. + +libssh2_md5_ctx +Type of an MD5 computation context. Generally a struct. + +int libssh2_md5_init(libssh2_md5_ctx *x); +Initializes the MD5 computation context at x. +Returns 1 for success and 0 for failure + +int libssh2_md5_update(libssh2_md5_ctx ctx, + const unsigned char *data, + size_t len); +Continues computation of MD5 on len bytes at data using context ctx. +Returns 1 for success and 0 for failure. +Note: if the ctx parameter is modified by the underlying code, +this procedure must be implemented as a macro to map ctx --> &ctx. +Must return 1 for success and 0 for failure. + +int libssh2_md5_final(libssh2_md5_ctx ctx, + unsigned char output[MD5_DIGEST_LENGTH]); +Gets the computed MD5 signature from context ctx into the output buffer. +Release the context. +Note: if the ctx parameter is modified by the underlying code, +this procedure must be implemented as a macro to map ctx --> &ctx. +Must return 1 for success and 0 for failure. + +int libssh2_hmac_md5_init(libssh2_hmac_ctx *ctx, + const void *key, + int keylen); +Setup the HMAC computation context ctx for an HMAC-MD5 computation using the +keylen-byte key. Is invoked just after libssh2_hmac_ctx_init(). +Returns 1 for success and 0 for failure. + +3.6) RIPEMD-160 +LIBSSH2_HMAC_RIPEMD +#define as 1 if the crypto library supports HMAC-RIPEMD-160, else 0. +If defined as 0, the rest of this section can be omitted. + +int libssh2_hmac_ripemd160_init(libssh2_hmac_ctx *ctx, + const void *key, + int keylen); +Setup the HMAC computation context ctx for an HMAC-RIPEMD-160 computation using +the keylen-byte key. Is invoked just after libssh2_hmac_ctx_init(). +Returns 1 for success and 0 for failure. + + +4) Bidirectional key ciphers. + +_libssh2_cipher_ctx +Type of a cipher computation context. + +_libssh2_cipher_type(name); +Macro defining name as storage identifying a cipher algorithm for +the crypto library interface. No trailing semicolon. + +int _libssh2_cipher_init(_libssh2_cipher_ctx *h, + _libssh2_cipher_type(algo), + unsigned char *iv, + unsigned char *secret, + int encrypt); +Creates a cipher context for the given algorithm with the initialization vector +iv and the secret key secret. Prepare for encryption or decryption depending on +encrypt. +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_cipher_crypt(_libssh2_cipher_ctx *ctx, + _libssh2_cipher_type(algo), + int encrypt, + unsigned char *block, + size_t blocksize, + int firstlast); +Encrypt or decrypt in-place data at (block, blocksize) using the given +context and/or algorithm. +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +void _libssh2_cipher_dtor(_libssh2_cipher_ctx *ctx); +Release cipher context at ctx. + +4.1) AES +4.1.1) AES in CBC block mode. +LIBSSH2_AES +#define as 1 if the crypto library supports AES in CBC mode, else 0. +If defined as 0, the rest of this section can be omitted. + +_libssh2_cipher_aes128 +AES-128-CBC algorithm identifier initializer. +#define with constant value of type _libssh2_cipher_type(). + +_libssh2_cipher_aes192 +AES-192-CBC algorithm identifier initializer. +#define with constant value of type _libssh2_cipher_type(). + +_libssh2_cipher_aes256 +AES-256-CBC algorithm identifier initializer. +#define with constant value of type _libssh2_cipher_type(). + +4.1.2) AES in CTR block mode. +LIBSSH2_AES_CTR +#define as 1 if the crypto library supports AES in CTR mode, else 0. +If defined as 0, the rest of this section can be omitted. + +_libssh2_cipher_aes128ctr +AES-128-CTR algorithm identifier initializer. +#define with constant value of type _libssh2_cipher_type(). + +_libssh2_cipher_aes192ctr +AES-192-CTR algorithm identifier initializer. +#define with constant value of type _libssh2_cipher_type(). + +_libssh2_cipher_aes256ctr +AES-256-CTR algorithm identifier initializer. +#define with constant value of type _libssh2_cipher_type(). + +4.2) Blowfish in CBC block mode. +LIBSSH2_BLOWFISH +#define as 1 if the crypto library supports blowfish in CBC mode, else 0. +If defined as 0, the rest of this section can be omitted. + +_libssh2_cipher_blowfish +Blowfish-CBC algorithm identifier initializer. +#define with constant value of type _libssh2_cipher_type(). + +4.3) RC4. +LIBSSH2_RC4 +#define as 1 if the crypto library supports RC4 (arcfour), else 0. +If defined as 0, the rest of this section can be omitted. + +_libssh2_cipher_arcfour +RC4 algorithm identifier initializer. +#define with constant value of type _libssh2_cipher_type(). + +4.4) CAST5 in CBC block mode. +LIBSSH2_CAST +#define 1 if the crypto library supports cast, else 0. +If defined as 0, the rest of this section can be omitted. + +_libssh2_cipher_cast5 +CAST5-CBC algorithm identifier initializer. +#define with constant value of type _libssh2_cipher_type(). + +4.5) Triple DES in CBC block mode. +LIBSSH2_3DES +#define as 1 if the crypto library supports TripleDES in CBC mode, else 0. +If defined as 0, the rest of this section can be omitted. + +_libssh2_cipher_3des +TripleDES-CBC algorithm identifier initializer. +#define with constant value of type _libssh2_cipher_type(). + + +5) Diffie-Hellman support. + +LIBSSH2_DH_GEX_MINGROUP +The minimum Diffie-Hellman group length in bits supported by the backend. +Usually defined as 2048. + +LIBSSH2_DH_GEX_OPTGROUP +The preferred Diffie-Hellman group length in bits. Usually defined as 4096. + +LIBSSH2_DH_GEX_MAXGROUP +The maximum Diffie-Hellman group length in bits supported by the backend. +Usually defined as 8192. + +LIBSSH2_DH_MAX_MODULUS_BITS +The maximum Diffie-Hellman modulus bit count accepted from the server. This +value must be supported by the backend. Usually 16384. + +5.1) Diffie-Hellman context. +_libssh2_dh_ctx +Type of a Diffie-Hellman computation context. +Must always be defined. + +5.2) Diffie-Hellman computation procedures. +void libssh2_dh_init(_libssh2_dh_ctx *dhctx); +Initializes the Diffie-Hellman context at `dhctx'. No effective context +creation needed here. + +int libssh2_dh_key_pair(_libssh2_dh_ctx *dhctx, _libssh2_bn *public, + _libssh2_bn *g, _libssh2_bn *p, int group_order, + _libssh2_bn_ctx *bnctx); +Generates a Diffie-Hellman key pair using base `g', prime `p' and the given +`group_order'. Can use the given big number context `bnctx' if needed. +The private key is stored as opaque in the Diffie-Hellman context `*dhctx' and +the public key is returned in `public'. +0 is returned upon success, else -1. + +int libssh2_dh_secret(_libssh2_dh_ctx *dhctx, _libssh2_bn *secret, + _libssh2_bn *f, _libssh2_bn *p, _libssh2_bn_ctx * bnctx) +Computes the Diffie-Hellman secret from the previously created context `*dhctx', +the public key `f' from the other party and the same prime `p' used at +context creation. The result is stored in `secret'. +0 is returned upon success, else -1. + +void libssh2_dh_dtor(_libssh2_dh_ctx *dhctx) +Destroys Diffie-Hellman context at `dhctx' and resets its storage. + + +6) Big numbers. +Positive multi-byte integers support is sufficient. + +6.1) Computation contexts. +This has a real meaning if the big numbers computations need some context +storage. If not, use a dummy type and functions (macros). + +_libssh2_bn_ctx +Type of multiple precision computation context. May not be empty. if not used, +#define as char, for example. + +_libssh2_bn_ctx _libssh2_bn_ctx_new(void); +Returns a new multiple precision computation context. + +void _libssh2_bn_ctx_free(_libssh2_bn_ctx ctx); +Releases a multiple precision computation context. + +6.2) Computation support. +_libssh2_bn +Type of multiple precision numbers (aka bignumbers or huge integers) for the +crypto library. + +_libssh2_bn * _libssh2_bn_init(void); +Creates a multiple precision number (preset to zero). + +_libssh2_bn * _libssh2_bn_init_from_bin(void); +Create a multiple precision number intended to be set by the +_libssh2_bn_from_bin() function (see below). Unlike _libssh2_bn_init(), this +code may be a dummy initializer if the _libssh2_bn_from_bin() actually +allocates the number. Returns a value of type _libssh2_bn *. + +void _libssh2_bn_free(_libssh2_bn *bn); +Destroys the multiple precision number at bn. + +unsigned long _libssh2_bn_bytes(_libssh2_bn *bn); +Get the number of bytes needed to store the bits of the multiple precision +number at bn. + +unsigned long _libssh2_bn_bits(_libssh2_bn *bn); +Returns the number of bits of multiple precision number at bn. + +int _libssh2_bn_set_word(_libssh2_bn *bn, unsigned long val); +Sets the value of bn to val. +Returns 1 on success, 0 otherwise. + +_libssh2_bn * _libssh2_bn_from_bin(_libssh2_bn *bn, int len, + const unsigned char *val); +Converts the positive integer in big-endian form of length len at val +into a _libssh2_bn and place it in bn. If bn is NULL, a new _libssh2_bn is +created. +Returns a pointer to target _libssh2_bn or NULL if error. + +int _libssh2_bn_to_bin(_libssh2_bn *bn, unsigned char *val); +Converts the absolute value of bn into big-endian form and store it at +val. val must point to _libssh2_bn_bytes(bn) bytes of memory. +Returns the length of the big-endian number. + + +7) Private key algorithms. +Format of an RSA public key: +a) "ssh-rsa". +b) RSA exponent, MSB first, with high order bit = 0. +c) RSA modulus, MSB first, with high order bit = 0. +Each item is preceded by its 32-bit byte length, MSB first. + +Format of a DSA public key: +a) "ssh-dss". +b) p, MSB first, with high order bit = 0. +c) q, MSB first, with high order bit = 0. +d) g, MSB first, with high order bit = 0. +e) pub_key, MSB first, with high order bit = 0. +Each item is preceded by its 32-bit byte length, MSB first. + +Format of an ECDSA public key: +a) "ecdsa-sha2-nistp256" or "ecdsa-sha2-nistp384" or "ecdsa-sha2-nistp521". +b) domain: "nistp256", "nistp384" or "nistp521" matching a). +c) raw public key ("octal"). +Each item is preceded by its 32-bit byte length, MSB first. + +Format of an ED25519 public key: +a) "ssh-ed25519". +b) raw key (32 bytes). +Each item is preceded by its 32-bit byte length, MSB first. + +int _libssh2_pub_priv_keyfile(LIBSSH2_SESSION *session, + unsigned char **method, + size_t *method_len, + unsigned char **pubkeydata, + size_t *pubkeydata_len, + const char *privatekey, + const char *passphrase); +Reads a private key from file privatekey and extract the public key --> +(pubkeydata, pubkeydata_len). Store the associated method (ssh-rsa or ssh-dss) +into (method, method_len). +Both buffers have to be allocated using LIBSSH2_ALLOC(). +Returns 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_pub_priv_keyfilememory(LIBSSH2_SESSION *session, + unsigned char **method, + size_t *method_len, + unsigned char **pubkeydata, + size_t *pubkeydata_len, + const char *privatekeydata, + size_t privatekeydata_len, + const char *passphrase); +Gets a private key from bytes at (privatekeydata, privatekeydata_len) and +extract the public key --> (pubkeydata, pubkeydata_len). Store the associated +method (ssh-rsa or ssh-dss) into (method, method_len). +Both buffers have to be allocated using LIBSSH2_ALLOC(). +Returns 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + + +7.1) RSA +LIBSSH2_RSA +#define as 1 if the crypto library supports RSA, else 0. +If defined as 0, the rest of this section can be omitted. + +libssh2_rsa_ctx +Type of an RSA computation context. Generally a struct. + +int _libssh2_rsa_new(libssh2_rsa_ctx **rsa, + const unsigned char *edata, + unsigned long elen, + const unsigned char *ndata, + unsigned long nlen, + const unsigned char *ddata, + unsigned long dlen, + const unsigned char *pdata, + unsigned long plen, + const unsigned char *qdata, + unsigned long qlen, + const unsigned char *e1data, + unsigned long e1len, + const unsigned char *e2data, + unsigned long e2len, + const unsigned char *coeffdata, unsigned long coefflen); +Creates a new context for RSA computations from key source values: + pdata, plen Prime number p. Only used if private key known (ddata). + qdata, qlen Prime number q. Only used if private key known (ddata). + ndata, nlen Modulus n. + edata, elen Exponent e. + ddata, dlen e^-1 % phi(n) = private key. May be NULL if unknown. + e1data, e1len dp = d % (p-1). Only used if private key known (dtata). + e2data, e2len dq = d % (q-1). Only used if private key known (dtata). + coeffdata, coefflen q^-1 % p. Only used if private key known. +Returns 0 if OK. +This procedure is already prototyped in crypto.h. +Note: the current generic code only calls this function with e and n (public +key parameters): unless used internally by the backend, it is not needed to +support the private key and the other parameters here. + +int _libssh2_rsa_new_private(libssh2_rsa_ctx **rsa, + LIBSSH2_SESSION *session, + const char *filename, + unsigned const char *passphrase); +Reads an RSA private key from file filename into a new RSA context. +Must call _libssh2_init_if_needed(). +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_rsa_new_private_frommemory(libssh2_rsa_ctx **rsa, + LIBSSH2_SESSION *session, + const char *data, + size_t data_len, + unsigned const char *passphrase); +Gets an RSA private key from data into a new RSA context. +Must call _libssh2_init_if_needed(). +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_rsa_sha1_verify(libssh2_rsa_ctx *rsa, + const unsigned char *sig, + size_t sig_len, + const unsigned char *m, size_t m_len); +Verify (sig, sig_len) signature of (m, m_len) using an SHA-1 hash and the +RSA context. +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_rsa_sha1_signv(LIBSSH2_SESSION *session, + unsigned char **sig, size_t *siglen, + int count, const struct iovec vector[], + libssh2_rsa_ctx *ctx); +RSA signs the SHA-1 hash computed over the count data chunks in vector. +Signature is stored at (sig, siglen). +Signature buffer must be allocated from the given session. +Returns 0 if OK, else -1. +Note: this procedure is optional: if provided, it MUST be defined as a macro. + +int _libssh2_rsa_sha1_sign(LIBSSH2_SESSION *session, + libssh2_rsa_ctx *rsactx, + const unsigned char *hash, + size_t hash_len, + unsigned char **signature, + size_t *signature_len); +RSA signs the (hash, hashlen) SHA-1 hash bytes and stores the allocated +signature at (signature, signature_len). +Signature buffer must be allocated from the given session. +Returns 0 if OK, else -1. +This procedure is already prototyped in crypto.h. +Note: this procedure is not used if macro _libssh2_rsa_sha1_signv() is defined. + +void _libssh2_rsa_free(libssh2_rsa_ctx *rsactx); +Releases the RSA computation context at rsactx. + +LIBSSH2_RSA_SHA2 +#define as 1 if the crypto library supports RSA SHA2 256/512, else 0. +If defined as 0, the rest of this section can be omitted. + +int _libssh2_rsa_sha2_sign(LIBSSH2_SESSION * session, + libssh2_rsa_ctx * rsactx, + const unsigned char *hash, + size_t hash_len, + unsigned char **signature, + size_t *signature_len); +RSA signs the (hash, hashlen) SHA-2 hash bytes based on hash length and stores +the allocated signature at (signature, signature_len). +Signature buffer must be allocated from the given session. +Returns 0 if OK, else -1. +This procedure is already prototyped in crypto.h. +Note: this procedure is not used if both macros _libssh2_rsa_sha2_256_signv() +and _libssh2_rsa_sha2_512_signv are defined. + +int _libssh2_rsa_sha2_256_signv(LIBSSH2_SESSION *session, + unsigned char **sig, size_t *siglen, + int count, const struct iovec vector[], + libssh2_rsa_ctx *ctx); +RSA signs the SHA-256 hash computed over the count data chunks in vector. +Signature is stored at (sig, siglen). +Signature buffer must be allocated from the given session. +Returns 0 if OK, else -1. +Note: this procedure is optional: if provided, it MUST be defined as a macro. + +int _libssh2_rsa_sha2_512_signv(LIBSSH2_SESSION *session, + unsigned char **sig, size_t *siglen, + int count, const struct iovec vector[], + libssh2_rsa_ctx *ctx); +RSA signs the SHA-512 hash computed over the count data chunks in vector. +Signature is stored at (sig, siglen). +Signature buffer must be allocated from the given session. +Returns 0 if OK, else -1. +Note: this procedure is optional: if provided, it MUST be defined as a macro. + +int _libssh2_rsa_sha2_verify(libssh2_rsa_ctx * rsa, + size_t hash_len, + const unsigned char *sig, + size_t sig_len, + const unsigned char *m, size_t m_len); +Verify (sig, sig_len) signature of (m, m_len) using an SHA-2 hash based on +hash length and the RSA context. +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +7.2) DSA +LIBSSH2_DSA +#define as 1 if the crypto library supports DSA, else 0. +If defined as 0, the rest of this section can be omitted. + + +libssh2_dsa_ctx +Type of a DSA computation context. Generally a struct. + +int _libssh2_dsa_new(libssh2_dsa_ctx **dsa, + const unsigned char *pdata, + unsigned long plen, + const unsigned char *qdata, + unsigned long qlen, + const unsigned char *gdata, + unsigned long glen, + const unsigned char *ydata, + unsigned long ylen, + const unsigned char *x, unsigned long x_len); +Creates a new context for DSA computations from source key values: + pdata, plen Prime number p. Only used if private key known (ddata). + qdata, qlen Prime number q. Only used if private key known (ddata). + gdata, glen G number. + ydata, ylen Public key. + xdata, xlen Private key. Only taken if xlen non-zero. +Returns 0 if OK. +This procedure is already prototyped in crypto.h. + +int _libssh2_dsa_new_private(libssh2_dsa_ctx **dsa, + LIBSSH2_SESSION *session, + const char *filename, + unsigned const char *passphrase); +Gets a DSA private key from file filename into a new DSA context. +Must call _libssh2_init_if_needed(). +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_dsa_new_private_frommemory(libssh2_dsa_ctx **dsa, + LIBSSH2_SESSION *session, + const char *data, + size_t data_len, + unsigned const char *passphrase); +Gets a DSA private key from the data_len-bytes data into a new DSA context. +Must call _libssh2_init_if_needed(). +Returns 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_dsa_sha1_verify(libssh2_dsa_ctx *dsactx, + const unsigned char *sig, + const unsigned char *m, size_t m_len); +Verify (sig, siglen) signature of (m, m_len) using an SHA-1 hash and the +DSA context. +Returns 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_dsa_sha1_sign(libssh2_dsa_ctx *dsactx, + const unsigned char *hash, + size_t hash_len, unsigned char *sig); +DSA signs the (hash, hash_len) data using SHA-1 and store the signature at sig. +Returns 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +void _libssh2_dsa_free(libssh2_dsa_ctx *dsactx); +Releases the DSA computation context at dsactx. + + +7.3) ECDSA +LIBSSH2_ECDSA +#define as 1 if the crypto library supports ECDSA, else 0. +If defined as 0, _libssh2_ec_key should be defined as void and the rest of +this section can be omitted. + +EC_MAX_POINT_LEN +Maximum point length. Usually defined as ((528 * 2 / 8) + 1) (= 133). + +libssh2_ecdsa_ctx +Type of an ECDSA computation context. Generally a struct. + +_libssh2_ec_key +Type of an elliptic curve key. + +libssh2_curve_type +An enum type defining curve types. Current supported identifiers are: + LIBSSH2_EC_CURVE_NISTP256 + LIBSSH2_EC_CURVE_NISTP384 + LIBSSH2_EC_CURVE_NISTP521 + +int _libssh2_ecdsa_create_key(_libssh2_ec_key **out_private_key, + unsigned char **out_public_key_octal, + size_t *out_public_key_octal_len, + libssh2_curve_type curve_type); +Create a new ECDSA private key of type curve_type and return it at +out_private_key. If out_public_key_octal is not NULL, store an allocated +pointer to the associated public key in "octal" form in it and its length +at out_public_key_octal_len. +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_ecdsa_new_private(libssh2_ecdsa_ctx **ec_ctx, + LIBSSH2_SESSION * session, + const char *filename, + unsigned const char *passphrase); +Reads an ECDSA private key from PEM file filename into a new ECDSA context. +Must call _libssh2_init_if_needed(). +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_ecdsa_new_private_frommemory(libssh2_ecdsa_ctx ** ec_ctx, + LIBSSH2_SESSION * session, + const char *filedata, + size_t filedata_len, + unsigned const char *passphrase); +Builds an ECDSA private key from PEM data at filedata of length filedata_len +into a new ECDSA context stored at ec_ctx. +Must call _libssh2_init_if_needed(). +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_ecdsa_curve_name_with_octal_new(libssh2_ecdsa_ctx **ecdsactx, + const unsigned char *k, + size_t k_len, + libssh2_curve_type type); +Stores at ecdsactx a new ECDSA context associated with the given curve type +and with "octal" form public key (k, k_len). +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_ecdsa_new_openssh_private(libssh2_ecdsa_ctx **ec_ctx, + LIBSSH2_SESSION * session, + const char *filename, + unsigned const char *passphrase); +Reads a PEM-encoded ECDSA private key from file filename encrypted with +passphrase and stores at ec_ctx a new ECDSA context for it. +Return 0 if OK, else -1. +Currently used only from openssl backend (ought to be private). +This procedure is already prototyped in crypto.h. + +int _libssh2_ecdsa_sign(LIBSSH2_SESSION *session, libssh2_ecdsa_ctx *ec_ctx, + const unsigned char *hash, unsigned long hash_len, + unsigned char **signature, size_t *signature_len); +ECDSA signs the (hash, hashlen) hash bytes and stores the allocated +signature at (signature, signature_len). Hash algorithm used should be +SHA-256, SHA-384 or SHA-512 depending on type stored in ECDSA context at ec_ctx. +Signature buffer must be allocated from the given session. +Returns 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_ecdsa_verify(libssh2_ecdsa_ctx *ctx, + const unsigned char *r, size_t r_len, + const unsigned char *s, size_t s_len, + const unsigned char *m, size_t m_len); +Verify the ECDSA signature made of (r, r_len) and (s, s_len) of (m, m_len) +using the hash algorithm configured in the ECDSA context ctx. +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +libssh2_curve_type _libssh2_ecdsa_get_curve_type(libssh2_ecdsa_ctx *ecdsactx); +Returns the curve type associated with given context. +This procedure is already prototyped in crypto.h. + +int _libssh2_ecdsa_curve_type_from_name(const char *name, + libssh2_curve_type *out_type); +Stores in out_type the curve type matching string name of the form +"ecdsa-sha2-nistpxxx". +Return 0 if OK, else -1. +Currently used only from openssl backend (ought to be private). +This procedure is already prototyped in crypto.h. + +void _libssh2_ecdsa_free(libssh2_ecdsa_ctx *ecdsactx); +Releases the ECDSA computation context at ecdsactx. + + +7.4) ED25519 +LIBSSH2_ED25519 +#define as 1 if the crypto library supports ED25519, else 0. +If defined as 0, the rest of this section can be omitted. + + +libssh2_ed25519_ctx +Type of an ED25519 computation context. Generally a struct. + +int _libssh2_curve25519_new(LIBSSH2_SESSION *session, libssh2_ed25519_ctx **ctx, + uint8_t **out_public_key, + uint8_t **out_private_key); +Generates an ED25519 key pair, stores a pointer to them at out_private_key +and out_public_key respectively and stores at ctx a new ED25519 context for +this key. +Argument ctx, out_private_key and out_public key may be NULL to disable storing +the corresponding value. +Length of each key is LIBSSH2_ED25519_KEY_LEN (32 bytes). +Key buffers are allocated and should be released by caller after use. +Returns 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_ed25519_new_private(libssh2_ed25519_ctx **ed_ctx, + LIBSSH2_SESSION *session, + const char *filename, + const uint8_t *passphrase); +Reads an ED25519 private key from PEM file filename into a new ED25519 context. +Must call _libssh2_init_if_needed(). +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_ed25519_new_public(libssh2_ed25519_ctx **ed_ctx, + LIBSSH2_SESSION *session, + const unsigned char *raw_pub_key, + const size_t key_len); +Stores at ed_ctx a new ED25519 key context for raw public key (raw_pub_key, +key_len). +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_ed25519_new_private_frommemory(libssh2_ed25519_ctx **ed_ctx, + LIBSSH2_SESSION *session, + const char *filedata, + size_t filedata_len, + unsigned const char *passphrase); +Builds an ED25519 private key from PEM data at filedata of length filedata_len +into a new ED25519 context stored at ed_ctx. +Must call _libssh2_init_if_needed(). +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_ed25519_sign(libssh2_ed25519_ctx *ctx, LIBSSH2_SESSION *session, + uint8_t **out_sig, size_t *out_sig_len, + const uint8_t *message, size_t message_len); +ED25519 signs the (message, message_len) bytes and stores the allocated +signature at (sig, sig_len). +Signature buffer is allocated from the given session. +Returns 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_ed25519_verify(libssh2_ed25519_ctx *ctx, const uint8_t *s, + size_t s_len, const uint8_t *m, size_t m_len); +Verify (s, s_len) signature of (m, m_len) using the given ED25519 context. +Return 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +int _libssh2_curve25519_gen_k(_libssh2_bn **k, + uint8_t private_key[LIBSSH2_ED25519_KEY_LEN], + uint8_t srvr_public_key[LIBSSH2_ED25519_KEY_LEN]); +Computes a shared ED25519 secret key from the given raw server public key and +raw client public key and stores it as a big number in *k. Big number should +have been initialized before calling this function. +Returns 0 if OK, else -1. +This procedure is already prototyped in crypto.h. + +void _libssh2_ed25519_free(libssh2_ed25519_ctx *ed25519ctx); +Releases the ED25519 computation context at ed25519ctx. + + +8) Miscellaneous + +void libssh2_prepare_iovec(struct iovec *vector, unsigned int len); +Prepare len consecutive iovec slots before using them. +In example, this is needed to preset unused structure slacks on platforms +requiring it. +If this is not needed, it should be defined as an empty macro. + +int _libssh2_random(unsigned char *buf, size_t len); +Store len random bytes at buf. +Returns 0 if OK, else -1. + +const char * _libssh2_supported_key_sign_algorithms(LIBSSH2_SESSION *session, + unsigned char *key_method, + size_t key_method_len); + +This function is for implementing key hash upgrading as defined in RFC 8332. + +Based on the incoming key_method value, this function will return a +list of supported algorithms that can upgrade the original key method algorithm +as a comma separated list, if there is no upgrade option this function should +return NULL. diff --git a/curl/dep/libssh2/docs/INSTALL_AUTOTOOLS.txt b/curl/dep/libssh2/docs/INSTALL_AUTOTOOLS.txt new file mode 100644 index 0000000..46584d7 --- /dev/null +++ b/curl/dep/libssh2/docs/INSTALL_AUTOTOOLS.txt @@ -0,0 +1,316 @@ +Installation Instructions +************************* + +Copyright (C) 1994, 1995, 1996, 1999, 2000, 2001, 2002, 2004, 2005 Free +Software Foundation, Inc. + +This file is free documentation; the Free Software Foundation gives +unlimited permission to copy, distribute and modify it. + +SPDX-License-Identifier: FSFULLR + +When Building directly from Master +================================== + +If you want to build directly from the git repository, you must first +generate the configure script and Makefile using autotools. Make +sure that autoconf, automake and libtool are installed on your system, +then execute: + + autoreconf -fi + +After executing this script, you can build the project as usual: + + ./configure + make + +Basic Installation +================== + +These are generic installation instructions. + + The `configure' shell script attempts to guess correct values for +various system-dependent variables used during compilation. It uses +those values to create a `Makefile' in each directory of the package. +It may also create one or more `.h' files containing system-dependent +definitions. Finally, it creates a shell script `config.status' that +you can run in the future to recreate the current configuration, and a +file `config.log' containing compiler output (useful mainly for +debugging `configure'). + + It can also use an optional file (typically called `config.cache' +and enabled with `--cache-file=config.cache' or shortly `-C') that saves +the results of its tests to speed up reconfiguring. (Caching is +disabled by default to prevent problems with accidental use of stale +cache files.) + + If you need to do unusual things to compile the package, please try +to figure out how `configure' could check whether to do them, and mail +diffs or instructions to the address given in the `README' so they can +be considered for the next release. If you are using the cache, and at +some point `config.cache' contains results you do not want to keep, you +may remove or edit it. + + The file `configure.ac' (or `configure.in') is used to create +`configure' by a program called `autoconf'. You only need +`configure.ac' if you want to change it or regenerate `configure' using +a newer version of `autoconf'. + +The simplest way to compile this package is: + + 1. `cd' to the directory containing the package's source code and type + `./configure' to configure the package for your system. If you are + using `csh' on an old version of System V, you might need to type + `sh ./configure' instead to prevent `csh' from trying to execute + `configure' itself. + + Running `configure' takes awhile. While running, it prints some + messages telling which features it is checking for. + + 2. Type `make' to compile the package. + + 3. Optionally, type `make check' to run any self-tests that come with + the package. + + 4. Type `make install' to install the programs and any data files and + documentation. + + 5. You can remove the program binaries and object files from the + source code directory by typing `make clean'. To also remove the + files that `configure' created (so you can compile the package for + a different kind of computer), type `make distclean'. There is + also a `make maintainer-clean' target, but that is intended mainly + for the package's developers. If you use it, you may have to get + all sorts of other programs in order to regenerate files that came + with the distribution. + +Compilers and Options +===================== + +Some systems require unusual options for compilation or linking that the +`configure' script does not know about. Run `./configure --help' for +details on some of the pertinent environment variables. + + You can give `configure' initial values for configuration parameters +by setting variables in the command line or in the environment. Here +is an example: + + ./configure CC=c89 CFLAGS=-O2 LIBS=-lposix + + *Note Defining Variables::, for more details. + +Compiling For Multiple Architectures +==================================== + +You can compile the package for more than one kind of computer at the +same time, by placing the object files for each architecture in their +own directory. To do this, you must use a version of `make' that +supports the `VPATH' variable, such as GNU `make'. `cd' to the +directory where you want the object files and executables to go and run +the `configure' script. `configure' automatically checks for the +source code in the directory that `configure' is in and in `..'. + + If you have to use a `make' that does not support the `VPATH' +variable, you have to compile the package for one architecture at a +time in the source code directory. After you have installed the +package for one architecture, use `make distclean' before reconfiguring +for another architecture. + +Installation Names +================== + +By default, `make install' installs the package's commands under +`/usr/local/bin', include files under `/usr/local/include', etc. You +can specify an installation prefix other than `/usr/local' by giving +`configure' the option `--prefix=PREFIX'. + + You can specify separate installation prefixes for +architecture-specific files and architecture-independent files. If you +pass the option `--exec-prefix=PREFIX' to `configure', the package uses +PREFIX as the prefix for installing programs and libraries. +Documentation and other data files still use the regular prefix. + + In addition, if you use an unusual directory layout you can give +options like `--bindir=DIR' to specify different values for particular +kinds of files. Run `configure --help' for a list of the directories +you can set and what kinds of files go in them. + + If the package supports it, you can cause programs to be installed +with an extra prefix or suffix on their names by giving `configure' the +option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'. + +Optional Features +================= + +Some packages pay attention to `--enable-FEATURE' options to +`configure', where FEATURE indicates an optional part of the package. +They may also pay attention to `--with-PACKAGE' options, where PACKAGE +is something like `gnu-as' or `x' (for the X Window System). The +`README' should mention any `--enable-' and `--with-' options that the +package recognizes. + + For packages that use the X Window System, `configure' can usually +find the X include and library files automatically, but if it does not, +you can use the `configure' options `--x-includes=DIR' and +`--x-libraries=DIR' to specify their locations. + +Specifying the System Type +========================== + +There may be some features `configure' cannot figure out automatically, +but needs to determine by the type of machine the package will run on. +Usually, assuming the package is built to be run on the _same_ +architectures, `configure' can figure that out, but if it prints a +message saying it cannot guess the machine type, give it the +`--build=TYPE' option. TYPE can either be a short name for the system +type, such as `sun4', or a canonical name which has the form: + + CPU-COMPANY-SYSTEM + +where SYSTEM can have one of these forms: + + OS KERNEL-OS + + See the file `config.sub' for the possible values of each field. If +`config.sub' is not included in this package, then this package does not +need to know the machine type. + + If you are _building_ compiler tools for cross-compiling, you should +use the option `--target=TYPE' to select the type of system they will +produce code for. + + If you want to _use_ a cross compiler, that generates code for a +platform different from the build platform, you should specify the +"host" platform (i.e., that on which the generated programs will +eventually be run) with `--host=TYPE'. + +Sharing Defaults +================ + +If you want to set default values for `configure' scripts to share, you +can create a site shell script called `config.site' that gives default +values for variables like `CC', `cache_file', and `prefix'. +`configure' looks for `PREFIX/share/config.site' if it exists, then +`PREFIX/etc/config.site' if it exists. Or, you can set the +`CONFIG_SITE' environment variable to the location of the site script. +A warning: not all `configure' scripts look for a site script. + +Defining Variables +================== + +Variables not defined in a site shell script can be set in the +environment passed to `configure'. However, some packages may run +configure again during the build, and the customized values of these +variables may be lost. In order to avoid this problem, you should set +them in the `configure' command line, using `VAR=value'. For example: + + ./configure CC=/usr/local2/bin/gcc + +causes the specified `gcc' to be used as the C compiler (unless it is +overridden in the site shell script). Here is a another example: + + /bin/bash ./configure CONFIG_SHELL=/bin/bash + +Here the `CONFIG_SHELL=/bin/bash' operand causes subsequent +configuration-related scripts to be executed by `/bin/bash'. + +`configure' Invocation +====================== + +`configure' recognizes the following options to control how it operates. + +`--help' +`-h' + Print a summary of the options to `configure', and exit. + +`--version' +`-V' + Print the version of Autoconf used to generate the `configure' + script, and exit. + +`--cache-file=FILE' + Enable the cache: use and save the results of the tests in FILE, + traditionally `config.cache'. FILE defaults to `/dev/null' to + disable caching. + +`--config-cache' +`-C' + Alias for `--cache-file=config.cache'. + +`--quiet' +`--silent' +`-q' + Do not print messages saying which checks are being made. To + suppress all normal output, redirect it to `/dev/null' (any error + messages will still be shown). + +`--srcdir=DIR' + Look for the package's source code in directory DIR. Usually + `configure' can determine that directory automatically. + +`configure' also accepts some other, not widely useful, options. Run +`configure --help' for more details. + +More configure options +====================== + +Some ./configure options deserve additional comments: + + * --with-libgcrypt + * --without-libgcrypt + * --with-libgcrypt-prefix=DIR + + libssh2 can use the Libgcrypt library + (https://www.gnupg.org/) for cryptographic operations. + One of the cryptographic libraries is required. + + Configure will attempt to locate Libgcrypt + automatically. + + If your installation of Libgcrypt is in another + location, specify it using --with-libgcrypt-prefix. + + * --with-openssl + * --without-openssl + * --with-libssl-prefix=[DIR] + + libssh2 can use the OpenSSL library + (https://www.openssl-library.org/) for cryptographic operations. + One of the cryptographic libraries is required. + + Configure will attempt to locate OpenSSL in the + default location. + + If your installation of OpenSSL is in another + location, specify it using --with-libssl-prefix. + + * --with-mbedtls + * --without-mbedtls + * --with-libmbedcrypto-prefix=[DIR] + + libssh2 can use the mbedTLS library + (https://tls.mbed.org) for cryptographic operations. + One of the cryptographic libraries is required. + + Configure will attempt to locate mbedTLS in the + default location. + + If your installation of mbedTLS is in another + location, specify it using --with-libmbedcrypto-prefix. + + * --with-libz + * --without-libz + * --with-libz-prefix=[DIR] + + If present, libssh2 will attempt to use the zlib + (https://zlib.net/) for payload compression, however + zlib is not required. + + If your installation of Libz is in another location, + specify it using --with-libz-prefix. + + * --enable-debug + + Will make the build use more pedantic and strict compiler + options as well as enable the libssh2_trace() function (for + showing debug traces). diff --git a/curl/dep/libssh2/docs/TODO.txt b/curl/dep/libssh2/docs/TODO.txt new file mode 100644 index 0000000..256a233 --- /dev/null +++ b/curl/dep/libssh2/docs/TODO.txt @@ -0,0 +1,180 @@ +Things TODO +=========== + +* Fix -Wsign-conversion warnings in src + +* Fix the numerous malloc+copy operations for sending data, see "Buffering + Improvements" below for details + +* make sure the windowing code adapts better to slow situations so that it + does not then use as much memory as today. Possibly by an app-controllable + "Window mode"? + +* Decrease the number of mallocs. Everywhere. Will get easier once the + buffering improvements have been done. + +* Use SO_NOSIGPIPE for Mac OS/BSD systems where MSG_NOSIGNAL does not + exist/work + +* Extend the test suite to actually test lots of aspects of libssh2 + +* Update public API to drop casts added to fix compiler warnings + +* Expose error messages sent by the server + +* select() is troublesome with libssh2 when using multiple channels over + the same session. See "New Transport API" below for more details. + +* for obsolete/weak/insecure algorithms: either stop enabling them by default + at build-time, or delete support for them completely. + +At next SONAME bump +=================== + +* stop using #defined macros as part of the official API. The macros should + either be turned into real functions or discarded from the API. + +* delete or deprecate libssh2_session_callback_set() + +* bump length arguments in callback functions to size_t/ssize_t + +* remove the following functions from the API/ABI + + libssh2_base64_decode() + libssh2_session_flag() + libssh2_channel_handle_extended_data() + libssh2_channel_receive_window_adjust() + libssh2_poll() + libssh2_poll_channel_read() + libssh2_session_startup() (libssh2_session_handshake() is the replacement) + libssh2_banner_set() (libssh2_session_banner_set() is the replacement) + +* Rename a few function: + + libssh2_hostkey_hash => libssh2_session_hostkey_hash + libssh2_banner_set => libssh2_session_banner_set + +* change 'int' to 'libssh2_socket_t' in the public API for sockets. + +* Use 'size_t' for string lengths in all functions. + +* Add a comment field to struct libssh2_knownhost. + +* remove the existing libssh2_knownhost_add() function and rename + libssh2_knownhost_addc to become the new libssh2_knownhost_add instead + +* remove the existing libssh2_scp_send_ex() function and rename + libssh2_scp_send64 to become the new libssh2_scp_send instead. + +* remove the existing libssh2_knownhost_check() function and rename + libssh2_knownhost_checkp() to become the new libssh2_knownhost_check instead + +Buffering Improvements +====================== + +transport_write + + - If this function gets called with a total packet size that is larger than + 32K, it should create more than one SSH packet so that it keeps the largest + one below 32K + +sftp_write + + - should not copy/allocate anything for the data, only create a header chunk + and pass on the payload data to channel_write "pointed to" + +New Transport API +================= + +THE PROBLEM + +The problem in a nutshell is that when an application opens up multiple +channels over a single session, those are all using the same socket. If the +application is then using select() to wait for traffic (like any sensible app +does) and wants to act on the data when select() tells there is something to +for example read, what does an application do? + +With our current API, you have to loop over all the channels and read from +them to see if they have data. This effectively makes blocking reads +impossible. If the app has many channels in a setup like this, it even becomes +slow. (The original API had the libssh2_poll_channel_read() and libssh2_poll() +to somewhat overcome this hurdle, but they too have pretty much the same +problems plus a few others.) + +Traffic in the other direction is similarly limited: the app has to try +sending to all channels, even though some of them may very well not accept any +data at that point. + +A SOLUTION + +I suggest we introduce two new helper functions: + + libssh2_transport_read() + + - Read "a bunch" of data from the given socket and returns information to the + app about what channels that are now readable (ie they will not block when + read from). The function can be called over and over and it will repeatedly + return info about what channels that are readable at that moment. + + libssh2_transport_write() + + - Returns information about what channels that are writable, in the sense + that they have windows set from the remote side that allows data to get + sent. Writing to one of those channels will not block. Of course, the + underlying socket may only accept a certain amount of data, so at the first + short return, nothing more should be attempted to get sent until select() + (or equivalent) has been used on the master socket again. + +I have not yet figured out a sensible API for how these functions should return +that info, but if we agree on the general principles I guess we can work that +out. + +VOLUNTARY + + I wanted to mention that these two helper functions would not be mandatory + in any way. They would just be there for those who want them, and existing + programs can remain using the old functions only if they prefer to. + +New SFTP API +============ + +PURPOSE + + Provide API functions that explicitly tells at once that a (full) SFTP file + transfer is wanted, to allow libssh2 to leverage on that knowledge to speed + up things internally. It can for example do read ahead, buffer writes (merge + small writes into larger chunks), better tune the SSH window and more. This + sort of API is already provided for SCP transfers. + +API + + New functions: + + LIBSSH2_SFTP_HANDLE *libssh2_sftp_send(SFTP_SESSION *sftp, + libssh2_uint64_t filesize, + char *remote_path, + size_t remote_path_len, + long mode); + + Tell libssh2 that a local file with a given size is about to get sent to + the SFTP server. + + LIBSSH2_SFTP_HANDLE *libssh2_sftp_recv(); + + Tell libssh2 that a remote file is requested to get downloaded from the SFTP + server. + + Only the setup of the file transfer is different from an application's point + of view. Depending on direction of the transfer(s), the following already + existing functions should then be used until the transfer is complete: + + libssh2_sftp_read() + libssh2_sftp_write() + +HOW TO USE + + 1. Setup the transfer using one of the two new functions. + + 2. Loop through the reading or writing of data. + + 3. Cleanup the transfer diff --git a/curl/dep/nghttp2/AUTHORS.txt b/curl/dep/nghttp2/AUTHORS.txt new file mode 100644 index 0000000..7ec2651 --- /dev/null +++ b/curl/dep/nghttp2/AUTHORS.txt @@ -0,0 +1,168 @@ +nghttp2 project was started as a fork of spdylay project [1]. Both +projects were started by Tatsuhiro Tsujikawa, who is still the main +author of these projects. Meanwhile, we have many contributions, and +we are not here without them. We sincerely thank you to all who made +a contribution. Here is the all individuals/organizations who +contributed to nghttp2 and spdylay project at which we forked. These +names are retrieved from git commit log. If you have made a +contribution, but you are missing in the list, please let us know via +github issues [2]. + +[1] https://github.com/tatsuhiro-t/spdylay +[2] https://github.com/nghttp2/nghttp2/issues + +-------- + +187j3x1 +Adam Gołębiowski +Alek Storm +Alex Nalivko +Alexandr Vlasov +Alexandros Konstantinakis-Karmis +Alexis La Goutte +Alyssa Ross +Amir Livneh +Amir Pakdel +Anders Bakken +Andreas Pohl +Andrew Penkrat +Andy Davies +Angus Gratton +Anna Henningsen +Ant Bryan +Anthony Alayo +Asra Ali +Benedikt Christoph Wolters +Benjamin Peterson +Bernard Spil +Bernhard Walle +Brendan Heinonen +Brian Card +Brian Suh +Daniel Bevenius +Daniel Evers +Daniel Stenberg +Dave Reisner +David Beitey +David Korczynski +David Weekly +Deel +Deep Chordia +Dimitris Apostolou +Dmitri Tikhonov +Dmitriy Vetutnev +Don +Dylan Plecki +Etienne Cimon +Fabian Möller +Fabian Wiesel +Fred Sundvik +Gabi Davar +Gaël PORTAY +Geoff Hill +George Liu +Gitai +Google Inc. +Hajime Fujita +Jacky Tian +Jacky_Yin +Jacob Champion +James M Snell +Jan Kundrát +Jan-E +Janusz Dziemidowicz +Jay Satiro +Jeff 'Raid' Baitis +Jianqing Wang +Jim Morrison +Jiwoo Park +Jonas Kvinge +Josh Braegger +José F. Calcerrada +Kamil Dudka +Kazuho Oku +Kenny (kang-yen) Peng +Kenny Peng +Kit Chan +Kyle Schomp +LazyHamster +Leo Neat +Lorenz Nickel +Lucas Pardue +MATSUMOTO Ryosuke +Marc Bachmann +Marcelo Trylesinski +Mark Boddington +Matt Rudary +Matt Way +Michael Kaufmann +Mike Conlen +Mike Frysinger +Mike Lothian +Nicholas Hurley +Nora Shoemaker +Paweł Wegner +Pedro Santos +Peeyush Aggarwal +Peter Wu +Piotr Sikora +PufferOverflow +Raul Gutierrez Segales +Remo E +Renaud +Reza Tavakoli +Richard Wolfert +Rick Lei +Ross Smith II +Rudi Heitbaum +Ryan Carsten Schmidt +Ryo Ota +Scott Mitchell +Sebastiaan Deckers +Sergey Fedorov +Shelley Vohr +Simon Frankenberger +Simone Basso +Soham Sinha +Stefan Eissing +Stephen Ludin +Sunpoet Po-Chuan Hsieh +Svante Signell +Syohei YOSHIDA +Tapanito +Tatsuhiko Kubo +Tatsuhiro Tsujikawa +Thomas Devoogdt +Tobias Geerinckx-Rice +Tom Harwood +Tomas Krizek +Tomasz Buchert +Tomasz Torcz +Vernon Tang +Viacheslav Biriukov +Viktor Szakats +Viktor Szépe +Ville Vesilehto +Wenfeng Liu +William A Rowe Jr +Xiaoguang Sun +Zhuoyun Wei +acesso +ayanamist +bxshi +clemahieu +dalf +dawg +es +fangdingjun +hrxi +jwchoi +kumagi +lhuang04 +lstefani +makovich +mod-h2-dev +moparisthebest +robaho +snnn +yuuki-kodama diff --git a/curl/dep/nghttp2/COPYING.txt b/curl/dep/nghttp2/COPYING.txt new file mode 100644 index 0000000..8020179 --- /dev/null +++ b/curl/dep/nghttp2/COPYING.txt @@ -0,0 +1,23 @@ +The MIT License + +Copyright (c) 2012, 2014, 2015, 2016 Tatsuhiro Tsujikawa +Copyright (c) 2012, 2014, 2015, 2016 nghttp2 contributors + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/curl/dep/nghttp2/ChangeLog.txt b/curl/dep/nghttp2/ChangeLog.txt new file mode 100644 index 0000000..2a36715 --- /dev/null +++ b/curl/dep/nghttp2/ChangeLog.txt @@ -0,0 +1,927 @@ +commit 319bf015de8fa38e21ac271ce2f7d61aa77d90cb +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-03-02 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-03-02 + + Update bash_completion + +commit 99c572448ac94f122a27cc088fe9cd8998222278 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-03-02 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-03-02 + + Update manual pages + +commit a5007158dfdc76cd308e731c629d963406e25965 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-03-02 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-03-02 + + Bump package and library versions + +commit 0b210f072d60db111d6abb44c98cfa754e4d9c99 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-03-02 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-03-02 + + Update AUTHORS + +commit 5ca289471f681ed6c62a9f29e0cc4ea980506fdf +Merge: 2141edda 1459db27 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-03-02 +Commit: GitHub +CommitDate: 2025-03-02 + + Merge pull request #2311 from nghttp2/bump-libbpf + + Bump libbpf to v1.5.0 + +commit 2141edda0cbf8a85bd46c041cc4b421d505d0cd5 +Merge: 133cc56e d9793fce +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-03-01 +Commit: GitHub +CommitDate: 2025-03-01 + + Merge pull request #2312 from nghttp2/fix-coverity-check + + Fix errors reported by coverity + +commit d9793fceafdf44dbdea727dfb3e6d35023f46105 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-03-01 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-03-01 + + Fix errors reported by coverity + +commit 1459db27fb5daf83d418729ab781d4cdd14c07ad +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-02-28 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-02-28 + + Bump libbpf to v1.5.0 + +commit 133cc56e70a31897088a75d38d24dfedf413060e +Merge: ce5329a3 cd9a021a +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-02-27 +Commit: GitHub +CommitDate: 2025-02-27 + + Merge pull request #2310 from nghttp2/bump-ngtcp2 + + Bump ngtcp2 + +commit cd9a021a19c7f6b83250be5dbb3ac01a12793a7f +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-02-27 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-02-27 + + Suppress warning when building C++ code with wolfSSL + +commit 2e8124eadb41808b1de787131de1b6f58c83ed05 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-02-27 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-02-27 + + Bump ngtcp2 and its dependencies + +commit ce5329a3109cda508f4d84e5c46a206d4d5ef3a6 +Merge: 6b74e009 1049ce0a +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-02-18 +Commit: GitHub +CommitDate: 2025-02-18 + + Merge pull request #2309 from nghttp2/nghttpx-rework-quic-conn + + nghttpx: Rework QUIC connection handling + +commit 1049ce0a99b121f85768a3d1c3a3dd461fe6bd10 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-11 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-02-18 + + nghttpx: Rework QUIC connection handling + +commit 6b74e0097ba30b1273843776a20395319f441987 +Merge: 321b71ae 785b0b54 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-02-18 +Commit: GitHub +CommitDate: 2025-02-18 + + Merge pull request #2308 from nghttp2/dependabot/go_modules/golang.org/x/net-0.35.0 + + build(deps): bump golang.org/x/net from 0.34.0 to 0.35.0 + +commit 785b0b541d4152e5e07e33a611fa85e2ddd3593a +Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> +AuthorDate: 2025-02-17 +Commit: GitHub +CommitDate: 2025-02-17 + + build(deps): bump golang.org/x/net from 0.34.0 to 0.35.0 + + Bumps [golang.org/x/net](https://github.com/golang/net) from 0.34.0 to 0.35.0. + - [Commits](https://github.com/golang/net/compare/v0.34.0...v0.35.0) + + --- + updated-dependencies: + - dependency-name: golang.org/x/net + dependency-type: direct:production + update-type: version-update:semver-minor + ... + + Signed-off-by: dependabot[bot] + +commit 321b71aedb54eaab20456828f316212ec203c8fa +Merge: e2e73723 1dbbcc35 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-02-08 +Commit: GitHub +CommitDate: 2025-02-08 + + Merge pull request #2306 from nghttp2/clang-format + + clang-format + +commit 1dbbcc35e1c5365d3ca94b6509ed7fe06d5b2444 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-02-08 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-02-08 + + clang-format + +commit e2e737234e9d292d3cdbabd947c05e16b57ee19e +Merge: e01c9f10 2b7ad6e6 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-02-05 +Commit: GitHub +CommitDate: 2025-02-05 + + Merge pull request #2305 from qnx-ports/master + + Add QNX Support + +commit 2b7ad6e6f376d47943347b2dc4b0b9ac2223870b +Author: Deep Chordia +AuthorDate: 2025-02-05 +Commit: Deep Chordia +CommitDate: 2025-02-05 + + Add QNX Support + +commit e01c9f10a3b7d1df1b50f7ff190dee474cc15d0b +Merge: fd4505cf a2db898d +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-02-03 +Commit: GitHub +CommitDate: 2025-02-03 + + Merge pull request #2304 from nghttp2/cmake-src-tests + + cmake: Disable src tests if BUILD_TESTING is OFF + +commit a2db898d7094899c3dc8cb0b32ac1cf35ee362c8 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-02-03 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-02-03 + + cmake: Disable src tests if BUILD_TESTING is OFF + +commit fd4505cfb21710ee9ca54a128001184472a9ab46 +Merge: d037dc32 9c23c72d +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-29 +Commit: GitHub +CommitDate: 2025-01-29 + + Merge pull request #2302 from nghttp2/min-quic-pktlen + + The minimum length of a valid QUIC packet is 21 + +commit 9c23c72d9997465205b62e061f317e8845e7dbb0 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-29 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-29 + + The minimum length of a valid QUIC packet is 21 + +commit d037dc32b4ddac267b0ede89f5f6f334319c636b +Merge: a4dad6d3 e045b463 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-28 +Commit: GitHub +CommitDate: 2025-01-28 + + Merge pull request #2301 from nghttp2/dependabot/go_modules/github.com/quic-go/quic-go-0.49.0 + + build(deps): bump github.com/quic-go/quic-go from 0.48.2 to 0.49.0 + +commit e045b46352a9a36834c7157c77e873d570717c26 +Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> +AuthorDate: 2025-01-27 +Commit: GitHub +CommitDate: 2025-01-27 + + build(deps): bump github.com/quic-go/quic-go from 0.48.2 to 0.49.0 + + Bumps [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) from 0.48.2 to 0.49.0. + - [Release notes](https://github.com/quic-go/quic-go/releases) + - [Changelog](https://github.com/quic-go/quic-go/blob/master/Changelog.md) + - [Commits](https://github.com/quic-go/quic-go/compare/v0.48.2...v0.49.0) + + --- + updated-dependencies: + - dependency-name: github.com/quic-go/quic-go + dependency-type: direct:production + update-type: version-update:semver-minor + ... + + Signed-off-by: dependabot[bot] + +commit a4dad6d36acde0f2a511632ba8fa395e70159b41 +Merge: 0c9fdf26 bdf7f14b +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-27 +Commit: GitHub +CommitDate: 2025-01-27 + + Merge pull request #2300 from nghttp2/stale-exempt-pr + + GHA: Exempt pull request from actions/stale + +commit bdf7f14b3d914d43ca7f9d1c6641331e7970b155 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-27 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-27 + + GHA: Exempt pull request from actions/stale + +commit 0c9fdf26397d6f46595dd0f0df4091dd50606f70 +Merge: 280110ca dd59dd8b +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-26 +Commit: GitHub +CommitDate: 2025-01-26 + + Merge pull request #2299 from nghttp2/nullptr + + src: nullptr + +commit dd59dd8ba99b3e40ed6a1bfb4ba5f676be8e386d +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-26 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-26 + + src: nullptr + +commit 280110ca8dd1563b9fe1597bd33fbf0607fb5f5c +Merge: e25e68f2 f9958255 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-26 +Commit: GitHub +CommitDate: 2025-01-26 + + Merge pull request #2298 from nghttp2/fix-stale-action + + Workaround actions/stale cache issue + +commit f9958255ee08011a7d72060bcb1675a8f0842635 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-26 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-26 + + Workaround actions/stale cache issue + +commit e25e68f23408720c11812ece06ffadb1b635f931 +Merge: ab19019b 01accaef +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-25 +Commit: GitHub +CommitDate: 2025-01-25 + + Merge pull request #2297 from thevilledev/fix/hd-int-overflow-check + + fix: Add defensive bounds checking in hd_ringbuf_init() + +commit 01accaef55254ffeeebf99b1b0ceeb9cc0592d8e +Author: Ville Vesilehto +AuthorDate: 2025-01-24 +Commit: GitHub +CommitDate: 2025-01-24 + + fix: remove redundant sizeof check + + Co-authored-by: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> + +commit d06472b2c170cc898f9722b55005ef8cdbb07a63 +Author: Ville Vesilehto +AuthorDate: 2025-01-24 +Commit: GitHub +CommitDate: 2025-01-24 + + fix: optimise for conditions + + Co-authored-by: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> + +commit 8ada192e6942eb4f5b85d73b648de73185a3e112 +Author: Ville Vesilehto +AuthorDate: 2025-01-24 +Commit: GitHub +CommitDate: 2025-01-24 + + fix: set max_size as const + + Co-authored-by: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> + +commit 639b14710b83c831b5c2bc75d33e385da4cde22e +Author: Ville Vesilehto +AuthorDate: 2025-01-20 +Commit: Ville Vesilehto +CommitDate: 2025-01-20 + + fix: Add defensive integer overflow checks in hd ringbuf init + + Add bounds checking in hd_ringbuf_init() to prevent potential integer + overflow during size calculations. While HPACK decoder controls its own + buffer size (4-8K typical) and is not vulnerable to remote exploitation, + this adds defensive programming guards for robustness. + + Signed-off-by: Ville Vesilehto + +commit ab19019b77bc04925cbede25307720af056b83d3 +Merge: f88c0985 15d75404 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-18 +Commit: GitHub +CommitDate: 2025-01-18 + + Merge pull request #2296 from nghttp2/xmlfree + + HtmlParser: Use xmlFree + +commit 15d754040a03101bed219fd4ae910f56446b1b84 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-18 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-18 + + HtmlParser: Use xmlFree + +commit f88c09857dc8819c3a849a67a5e1d8e10503b49f +Merge: e5309612 3cb06f11 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-14 +Commit: GitHub +CommitDate: 2025-01-14 + + Merge pull request #2295 from nghttp2/dependabot/go_modules/golang.org/x/net-0.34.0 + + build(deps): bump golang.org/x/net from 0.33.0 to 0.34.0 + +commit 3cb06f116d662843cc4fbd82ffd251cd90842532 +Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> +AuthorDate: 2025-01-13 +Commit: GitHub +CommitDate: 2025-01-13 + + build(deps): bump golang.org/x/net from 0.33.0 to 0.34.0 + + Bumps [golang.org/x/net](https://github.com/golang/net) from 0.33.0 to 0.34.0. + - [Commits](https://github.com/golang/net/compare/v0.33.0...v0.34.0) + + --- + updated-dependencies: + - dependency-name: golang.org/x/net + dependency-type: direct:production + update-type: version-update:semver-minor + ... + + Signed-off-by: dependabot[bot] + +commit e53096123c961357302442fb1e0ac14cf7bc7e03 +Merge: 6494f056 48cdba35 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-12 +Commit: GitHub +CommitDate: 2025-01-12 + + Merge pull request #2294 from nghttp2/remove-nghttp2-dependency-based-priority-section + + Remove nghttp2 dependency based priority section + +commit 48cdba3553b294a470651f040d4c9dfff9fdea74 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-12 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-12 + + Update manual pages + +commit 71498767046147f87bb3a5b01d5e4ff35dfba4c3 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-12 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-12 + + nghttp: Remove DEPENDENCY BASED PRIORITY section from its manual page + +commit 6494f0563818cbc27a351769c1bc649f89177140 +Merge: 1f581807 db12ee7a +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-12 +Commit: GitHub +CommitDate: 2025-01-12 + + Merge pull request #2293 from nghttp2/update-priority-doc + + Update Stream priorities section + +commit 1f5818070d0500822f03bc1194a655494a724dc9 +Merge: d928ceb7 82602821 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-12 +Commit: GitHub +CommitDate: 2025-01-12 + + Merge pull request #2292 from nghttp2/nghttp-show-deprecation-warn-no-rfc7540-pri + + nghttp: Show deprecation warning for --no-rfc7540-pri option + +commit db12ee7a37bbd2ba7d2a59b3c31b0dd1f31aac1d +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-12 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-12 + + Update Stream priorities section + +commit 82602821d00ff42eae0c7cf8cfe4a7eba2d0c563 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-12 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-12 + + nghttp: Show deprecation warning for --no-rfc7540-pri option + +commit d928ceb75a364f1e199b841eae1548cc9897c9c2 +Merge: 7e096cbc 7f871f63 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-12 +Commit: GitHub +CommitDate: 2025-01-12 + + Merge pull request #2291 from nghttp2/nghttpd-remove-rfc7540-pri + + nghttpd: Remove RFC 7540 priorities + +commit 7f871f63ea0935c9a09c3eab6b310f051806a672 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-12 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-12 + + nghttpd: Remove RFC 7540 priorities + + This change deprecates --no-rfc7540-pri option. + SETTINGS_NO_RFC7540_PRIORITIES is now always sent. + +commit 7e096cbc4131b1473e91e0e672a2bc2ca2ad91cf +Merge: c8bcf5a6 f25a8dca +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-11 +Commit: GitHub +CommitDate: 2025-01-11 + + Merge pull request #2290 from nghttp2/nghttp-remove-rfc7540-pri + + nghttp: Remove RFC 7540 priorities + +commit f25a8dca17446f525ce2930918e503536dcd4374 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-10 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-11 + + nghttp: Remove RFC 7540 priorities + + This change removes RFC 7540 priorities from nghttp. nghttp now does + not create the initial dependency tree. --no-dep and --no-rfc7540-pri + options have been removed. + + nghttp now always sends NGHTTP2_SETTINGS_NO_RFC7540_PRIORITIES. + --extpri option has been added to set priority for a given URI. + +commit c8bcf5a6a2157b316444dddd8d262778b41f2821 +Merge: 26a33cf9 b2a3299e +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-11 +Commit: GitHub +CommitDate: 2025-01-11 + + Merge pull request #2289 from nghttp2/deprecate-nghttp2_option_set_no_closed_streams + + Deprecate nghttp2_option_set_no_closed_streams + +commit b2a3299e8ecec9a879c41415373a46f8eb4cb286 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-10 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-11 + + Deprecate nghttp2_option_set_no_closed_streams + +commit 26a33cf99bd30d4be24c6f6e534286cbddd86d05 +Merge: cb8421e3 96e06509 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-10 +Commit: GitHub +CommitDate: 2025-01-10 + + Merge pull request #2288 from nghttp2/deprecate-nghttp2_option_set_server_fallback_rfc7540_priorities + + Deprecate nghttp2_option_set_server_fallback_rfc7540_priorities + +commit cb8421e3537154536dfaf8d1d8fdea77de672b21 +Merge: 8c83772f 3dd61f8e +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-10 +Commit: GitHub +CommitDate: 2025-01-10 + + Merge pull request #2287 from nghttp2/remove-rfc7540-priority + + Remove RFC 7540 priorities + +commit 96e06509ac558d1b740cc62e2e6bf442b4d4667b +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-10 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-10 + + Deprecate nghttp2_option_set_server_fallback_rfc7540_priorities + +commit 3dd61f8ec3990928ee5f2606353d2b291f771aab +Author: Tatsuhiro Tsujikawa +AuthorDate: 2024-03-25 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-10 + + Remove RFC 7540 priorities + + Summary of the behavioral changes in public API functions: + + - nghttp2_session_change_stream_priority: This function is noop. It + always returns 0. + - nghttp2_session_create_idle_stream: This function is noop. It + always returns 0. + - nghttp2_submit_request: pri_spec is ignored. + - nghttp2_submit_request2: pri_spec is ignored. + - nghttp2_submit_headers: pri_spec is ignored. + - nghttp2_submit_priority: This function is noop. It always returns + 0. + - nghttp2_stream_get_parent: This function always returns NULL. + - nghttp2_stream_get_next_sibling: This function always returns NULL. + - nghttp2_stream_get_previous_sibling: This function always returns + NULL. + - nghttp2_stream_get_first_child: This function always returns NULL. + - nghttp2_stream_get_weight: This function always returns + NGHTTP2_DEFAULT_WEIGHT. + - nghttp2_stream_get_sum_dependency_weight: This function always + returns 0. + +commit 8c83772f6c45a571fb209e9ec91729a360b8490f +Merge: 5ca0bca1 a8d731d8 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-01-03 +Commit: GitHub +CommitDate: 2025-01-03 + + Merge pull request #2286 from nghttp2/bump-munit + + Bump munit + +commit a8d731d81fb34fa253cc9cb7c8874f096914ee00 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-01-03 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-01-03 + + Bump munit + +commit 5ca0bca19992fbb08792a25a6657a61c16f78710 +Merge: 89f27a59 23a17d00 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2024-12-19 +Commit: GitHub +CommitDate: 2024-12-19 + + Merge pull request #2283 from nghttp2/bump-ngtcp2 + + Bump ngtcp2 and QUIC dependencies + +commit 89f27a597f4237d1c70a7d2b1b6c559ff4182ed6 +Merge: 59f85c5d 947928bc +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2024-12-19 +Commit: GitHub +CommitDate: 2024-12-19 + + Merge pull request #2282 from nghttp2/bump-golang.org/x/net + + Bump golang.org/x/net to v0.33.0 + +commit 947928bcc2a8a5951a7ff15ea032501bae98927b +Author: Tatsuhiro Tsujikawa +AuthorDate: 2024-12-19 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2024-12-19 + + Bump golang.org/x/net to v0.33.0 + +commit 23a17d0048f581856a363f6e3498815b0a4e4844 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2024-12-19 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2024-12-19 + + Bump ngtcp2 and QUIC dependencies + +commit 59f85c5d622ba46826f11e6d02b5aa39439cf7f8 +Merge: 92fa43ac c7bf69c8 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2024-12-10 +Commit: GitHub +CommitDate: 2024-12-10 + + Merge pull request #2281 from nghttp2/dependabot/go_modules/golang.org/x/net-0.32.0 + + build(deps): bump golang.org/x/net from 0.31.0 to 0.32.0 + +commit c7bf69c8e1d8646b249ef08ad58f3bca06ff0f3b +Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> +AuthorDate: 2024-12-09 +Commit: GitHub +CommitDate: 2024-12-09 + + build(deps): bump golang.org/x/net from 0.31.0 to 0.32.0 + + Bumps [golang.org/x/net](https://github.com/golang/net) from 0.31.0 to 0.32.0. + - [Commits](https://github.com/golang/net/compare/v0.31.0...v0.32.0) + + --- + updated-dependencies: + - dependency-name: golang.org/x/net + dependency-type: direct:production + update-type: version-update:semver-minor + ... + + Signed-off-by: dependabot[bot] + +commit 92fa43ac912b6c3b3d8bbfde55416eaa4f4ad508 +Merge: 68c3600d b05ee704 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2024-12-10 +Commit: GitHub +CommitDate: 2024-12-10 + + Merge pull request #2279 from nghttp2/dependabot/go_modules/github.com/quic-go/quic-go-0.48.2 + + build(deps): bump github.com/quic-go/quic-go from 0.48.1 to 0.48.2 + +commit b05ee704dd020e9dd0a8ff329686241fdbaeb897 +Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> +AuthorDate: 2024-12-02 +Commit: GitHub +CommitDate: 2024-12-02 + + build(deps): bump github.com/quic-go/quic-go from 0.48.1 to 0.48.2 + + Bumps [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) from 0.48.1 to 0.48.2. + - [Release notes](https://github.com/quic-go/quic-go/releases) + - [Changelog](https://github.com/quic-go/quic-go/blob/master/Changelog.md) + - [Commits](https://github.com/quic-go/quic-go/compare/v0.48.1...v0.48.2) + + --- + updated-dependencies: + - dependency-name: github.com/quic-go/quic-go + dependency-type: direct:production + update-type: version-update:semver-patch + ... + + Signed-off-by: dependabot[bot] + +commit 68c3600d9fe729b8c66424384472a23ae8b45cec +Merge: eb22cc12 f51e9b30 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2024-11-25 +Commit: GitHub +CommitDate: 2024-11-25 + + Merge pull request #2275 from nghttp2/bump-ngtcp2 + + Bump ngtcp2 + +commit f51e9b300f35ab50b16d3cdece1acf6ff9425357 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2024-11-25 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2024-11-25 + + GHA: Fix build error on Mac OS 14 + +commit f61d304ef38f92fb4c898664c48df9eadde36f9f +Author: Tatsuhiro Tsujikawa +AuthorDate: 2024-11-25 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2024-11-25 + + Bump ngtcp2 and its dependencies + +commit eb22cc1231a6b57b384abcd9948eb3ddfb844755 +Merge: 55c5adf9 41c8940a +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2024-11-18 +Commit: GitHub +CommitDate: 2024-11-18 + + Merge pull request #2274 from nghttp2/bump-sfparse + + Bump sfparse to 7eaf5b651f67123edf2605391023ed2fd7e2ef16 + +commit 41c8940a4ca9875b6ada4d432d8d2f2beeda0e60 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2024-11-18 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2024-11-18 + + Bump sfparse to 7eaf5b651f67123edf2605391023ed2fd7e2ef16 + +commit 55c5adf9676ecb49e8083fe3458381e751796123 +Merge: da14a31c db315a45 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2024-11-16 +Commit: GitHub +CommitDate: 2024-11-16 + + Merge pull request #2273 from nghttp2/urlparse + + Replace url-parser with urlparse + +commit db315a458810adb7d30be01315d48addd2a9fc40 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2024-11-16 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2024-11-16 + + Replace url-parser with urlparse + +commit da14a31cfb7dd05ee0b5cbbc6ec9d04cc87da365 +Merge: 7a96731c f5b0c5bf +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2024-11-15 +Commit: GitHub +CommitDate: 2024-11-15 + + Merge pull request #2272 from nghttp2/dependabot/go_modules/golang.org/x/net-0.31.0 + + build(deps): bump golang.org/x/net from 0.30.0 to 0.31.0 + +commit f5b0c5bf06354d8cdb5fc46ee1c736e818bb2933 +Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> +AuthorDate: 2024-11-11 +Commit: GitHub +CommitDate: 2024-11-11 + + build(deps): bump golang.org/x/net from 0.30.0 to 0.31.0 + + Bumps [golang.org/x/net](https://github.com/golang/net) from 0.30.0 to 0.31.0. + - [Commits](https://github.com/golang/net/compare/v0.30.0...v0.31.0) + + --- + updated-dependencies: + - dependency-name: golang.org/x/net + dependency-type: direct:production + update-type: version-update:semver-minor + ... + + Signed-off-by: dependabot[bot] + +commit 7a96731c6b03810bb5f45b3bd34806b895d7446e +Merge: 82ec1af2 ce70fb2a +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2024-10-30 +Commit: GitHub +CommitDate: 2024-10-30 + + Merge pull request #2268 from TuxInvader/conn-close-bytes + + account for bytes on closing connections + +commit ce70fb2a3e46a60a73ffe5526be9d1bdc87bd8ba +Author: Mark Boddington +AuthorDate: 2024-10-29 +Commit: GitHub +CommitDate: 2024-10-29 + + remove len check + +commit 82ec1af20e05b6f3d7c3b9106f777dcd28e732a1 +Merge: 55d4de79 5024c1b2 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2024-10-29 +Commit: GitHub +CommitDate: 2024-10-29 + + Merge pull request #2270 from nghttp2/dependabot/go_modules/github.com/quic-go/quic-go-0.48.1 + + build(deps): bump github.com/quic-go/quic-go from 0.48.0 to 0.48.1 + +commit 5024c1b2409a35c670fe945eb27c944f0e03d0c9 +Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> +AuthorDate: 2024-10-28 +Commit: GitHub +CommitDate: 2024-10-28 + + build(deps): bump github.com/quic-go/quic-go from 0.48.0 to 0.48.1 + + Bumps [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) from 0.48.0 to 0.48.1. + - [Release notes](https://github.com/quic-go/quic-go/releases) + - [Changelog](https://github.com/quic-go/quic-go/blob/master/Changelog.md) + - [Commits](https://github.com/quic-go/quic-go/compare/v0.48.0...v0.48.1) + + --- + updated-dependencies: + - dependency-name: github.com/quic-go/quic-go + dependency-type: direct:production + update-type: version-update:semver-patch + ... + + Signed-off-by: dependabot[bot] + +commit a30bc25ac7327764863b430da3a713095afbe9df +Author: Mark Boddington +AuthorDate: 2024-10-25 +Commit: GitHub +CommitDate: 2024-10-25 + + account for bytes on closing connections + +commit 55d4de7963bc8c2c849cf4ca0c195a6d9f8e12eb +Merge: fcd4f266 69df6871 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2024-10-22 +Commit: GitHub +CommitDate: 2024-10-22 + + Merge pull request #2266 from nghttp2/dependabot/go_modules/github.com/quic-go/quic-go-0.48.0 + + build(deps): bump github.com/quic-go/quic-go from 0.47.0 to 0.48.0 + +commit 69df6871f63994fa41b09f2d1972ee43982e894b +Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> +AuthorDate: 2024-10-21 +Commit: GitHub +CommitDate: 2024-10-21 + + build(deps): bump github.com/quic-go/quic-go from 0.47.0 to 0.48.0 + + Bumps [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) from 0.47.0 to 0.48.0. + - [Release notes](https://github.com/quic-go/quic-go/releases) + - [Changelog](https://github.com/quic-go/quic-go/blob/master/Changelog.md) + - [Commits](https://github.com/quic-go/quic-go/compare/v0.47.0...v0.48.0) + + --- + updated-dependencies: + - dependency-name: github.com/quic-go/quic-go + dependency-type: direct:production + update-type: version-update:semver-minor + ... + + Signed-off-by: dependabot[bot] + +commit fcd4f2663a61d1098cb2fca7d4da7e009f285569 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2024-10-21 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2024-10-21 + + Bump package version diff --git a/curl/dep/nghttp2/README.rst b/curl/dep/nghttp2/README.rst new file mode 100644 index 0000000..d2020ef --- /dev/null +++ b/curl/dep/nghttp2/README.rst @@ -0,0 +1,1466 @@ +nghttp2 - HTTP/2 C Library +========================== + +This is an implementation of the Hypertext Transfer Protocol version 2 +in C. + +The framing layer of HTTP/2 is implemented as a reusable C library. +On top of that, we have implemented an HTTP/2 client, server and +proxy. We have also developed load test and benchmarking tools for +HTTP/2. + +An HPACK encoder and decoder are available as a public API. + +Development Status +------------------ + +nghttp2 was originally developed based on `RFC 7540 +`_ HTTP/2 and `RFC 7541 +`_ HPACK - Header Compression for +HTTP/2. Now we are updating our code to implement `RFC 9113 +`_. + +The nghttp2 code base was forked from the spdylay +(https://github.com/tatsuhiro-t/spdylay) project. + +Public Test Server +------------------ + +The following endpoints are available to try out our nghttp2 +implementation. + +* https://nghttp2.org/ (TLS + ALPN and HTTP/3) + + This endpoint supports ``h2``, ``h2-16``, ``h2-14``, and + ``http/1.1`` via ALPN and requires TLSv1.2 for HTTP/2 + connection. + + It also supports HTTP/3. + +* http://nghttp2.org/ (HTTP Upgrade and HTTP/2 Direct) + + ``h2c`` and ``http/1.1``. + +Requirements +------------ + +The following package is required to build the libnghttp2 library: + +* pkg-config >= 0.20 + +To build the documentation, you need to install: + +* sphinx (http://sphinx-doc.org/) + +If you need libnghttp2 (C library) only, then the above packages are +all you need. Use ``--enable-lib-only`` to ensure that only +libnghttp2 is built. This avoids potential build error related to +building bundled applications. + +To build and run the application programs (``nghttp``, ``nghttpd``, +``nghttpx`` and ``h2load``) in the ``src`` directory, the following packages +are required: + +* OpenSSL >= 1.1.1; or wolfSSL >= 5.7.0; or LibreSSL >= 3.8.1; or + aws-lc >= 1.19.0; or BoringSSL +* libev >= 4.11 +* zlib >= 1.2.3 +* libc-ares >= 1.7.5 + +To enable ``-a`` option (getting linked assets from the downloaded +resource) in ``nghttp``, the following package is required: + +* libxml2 >= 2.6.26 + +To enable systemd support in nghttpx, the following package is +required: + +* libsystemd-dev >= 209 + +The HPACK tools require the following package: + +* jansson >= 2.5 + +To build sources under the examples directory, libevent is required: + +* libevent-openssl >= 2.0.8 + +To mitigate heap fragmentation in long running server programs +(``nghttpd`` and ``nghttpx``), jemalloc is recommended: + +* jemalloc + + .. note:: + + Alpine Linux currently does not support malloc replacement + due to musl limitations. See details in issue `#762 `_. + +For BoringSSL or aws-lc build, to enable :rfc:`8879` TLS Certificate +Compression in applications, the following library is required: + +* libbrotli-dev >= 1.0.9 + +To enable mruby support for nghttpx, `mruby +`_ is required. We need to build +mruby with C++ ABI explicitly turned on, and probably need other +mrgems, mruby is managed by git submodule under third-party/mruby +directory. Currently, mruby support for nghttpx is disabled by +default. To enable mruby support, use ``--with-mruby`` configure +option. Note that at the time of this writing, libmruby-dev and mruby +packages in Debian/Ubuntu are not usable for nghttp2, since they do +not enable C++ ABI. To build mruby, the following packages are +required: + +* ruby +* bison + +nghttpx supports `neverbleed `_, +privilege separation engine for OpenSSL. In short, it minimizes the +risk of private key leakage when serious bug like Heartbleed is +exploited. The neverbleed is disabled by default. To enable it, use +``--with-neverbleed`` configure option. + +To enable the experimental HTTP/3 support for h2load and nghttpx, the +following libraries are required: + +* `OpenSSL with QUIC support + `_; or + wolfSSL; or LibreSSL (does not support 0RTT); or aws-lc; or + `BoringSSL `_ (commit + 294ab9730c570213b496cfc2fc14b3c0bfcd4bcc) +* `ngtcp2 `_ >= 1.4.0 +* `nghttp3 `_ >= 1.1.0 + +Use ``--enable-http3`` configure option to enable HTTP/3 feature for +h2load and nghttpx. + +In order to build optional eBPF program to direct an incoming QUIC UDP +datagram to a correct socket for nghttpx, the following libraries are +required: + +* libbpf-dev >= 0.7.0 + +Use ``--with-libbpf`` configure option to build eBPF program. +libelf-dev is needed to build libbpf. + +For Ubuntu 20.04, you can build libbpf from `the source code +`_. nghttpx requires eBPF +program for reloading its configuration and hot swapping its +executable. + +Compiling libnghttp2 C source code requires a C99 compiler. gcc 4.8 +is known to be adequate. In order to compile the C++ source code, +C++20 compliant compiler is required. At least g++ >= 12 and +clang++ >= 15 are known to work. + +.. note:: + + To enable mruby support in nghttpx, and use ``--with-mruby`` + configure option. + +.. note:: + + Mac OS X users may need the ``--disable-threads`` configure option to + disable multi-threading in nghttpd, nghttpx and h2load to prevent + them from crashing. A patch is welcome to make multi threading work + on Mac OS X platform. + +.. note:: + + To compile the associated applications (nghttp, nghttpd, nghttpx + and h2load), you must use the ``--enable-app`` configure option and + ensure that the specified requirements above are met. Normally, + configure script checks required dependencies to build these + applications, and enable ``--enable-app`` automatically, so you + don't have to use it explicitly. But if you found that + applications were not built, then using ``--enable-app`` may find + that cause, such as the missing dependency. + +.. note:: + + In order to detect third party libraries, pkg-config is used + (however we don't use pkg-config for some libraries (e.g., libev)). + By default, pkg-config searches ``*.pc`` file in the standard + locations (e.g., /usr/lib/pkgconfig). If it is necessary to use + ``*.pc`` file in the custom location, specify paths to + ``PKG_CONFIG_PATH`` environment variable, and pass it to configure + script, like so: + + .. code-block:: text + + $ ./configure PKG_CONFIG_PATH=/path/to/pkgconfig + + For pkg-config managed libraries, ``*_CFLAG`` and ``*_LIBS`` + environment variables are defined (e.g., ``OPENSSL_CFLAGS``, + ``OPENSSL_LIBS``). Specifying non-empty string to these variables + completely overrides pkg-config. In other words, if they are + specified, pkg-config is not used for detection, and user is + responsible to specify the correct values to these variables. For + complete list of these variables, run ``./configure -h``. + +If you are using Ubuntu 22.04 LTS, run the following to install the +required packages: + +.. code-block:: text + + sudo apt-get install g++ clang make binutils autoconf automake \ + autotools-dev libtool pkg-config \ + zlib1g-dev libssl-dev libxml2-dev libev-dev \ + libevent-dev libjansson-dev \ + libc-ares-dev libjemalloc-dev libsystemd-dev \ + ruby-dev bison libelf-dev + +Building nghttp2 from release tar archive +----------------------------------------- + +The nghttp2 project regularly releases tar archives which includes +nghttp2 source code, and generated build files. They can be +downloaded from `Releases +`_ page. + +Building nghttp2 from git requires autotools development packages. +Building from tar archives does not require them, and thus it is much +easier. The usual build step is as follows: + +.. code-block:: text + + $ tar xf nghttp2-X.Y.Z.tar.bz2 + $ cd nghttp2-X.Y.Z + $ ./configure + $ make + +Building from git +----------------- + +Building from git is easy, but please be sure that at least autoconf 2.68 is +used: + +.. code-block:: text + + $ git submodule update --init + $ autoreconf -i + $ automake + $ autoconf + $ ./configure + $ make + +Notes for building on Windows (MSVC) +------------------------------------ + +The easiest way to build native Windows nghttp2 dll is use `cmake +`_. The free version of `Visual C++ Build Tools +`_ works +fine. + +1. Install cmake for windows +2. Open "Visual C++ ... Native Build Tool Command Prompt", and inside + nghttp2 directly, run ``cmake``. +3. Then run ``cmake --build`` to build library. +4. nghttp2.dll, nghttp2.lib, nghttp2.exp are placed under lib directory. + +Note that the above steps most likely produce nghttp2 library only. +No bundled applications are compiled. + +Notes for building on Windows (Mingw/Cygwin) +-------------------------------------------- + +Under Mingw environment, you can only compile the library, it's +``libnghttp2-X.dll`` and ``libnghttp2.a``. + +If you want to compile the applications(``h2load``, ``nghttp``, +``nghttpx``, ``nghttpd``), you need to use the Cygwin environment. + +Under Cygwin environment, to compile the applications you need to +compile and install the libev first. + +Secondly, you need to undefine the macro ``__STRICT_ANSI__``, if you +not, the functions ``fdopen``, ``fileno`` and ``strptime`` will not +available. + +the sample command like this: + +.. code-block:: text + + $ export CFLAGS="-U__STRICT_ANSI__ -I$libev_PREFIX/include -L$libev_PREFIX/lib" + $ export CXXFLAGS=$CFLAGS + $ ./configure + $ make + +If you want to compile the applications under ``examples/``, you need +to remove or rename the ``event.h`` from libev's installation, because +it conflicts with libevent's installation. + +Notes for installation on Linux systems +-------------------------------------------- +After installing nghttp2 tool suite with ``make install`` one might experience a similar error: + +.. code-block:: text + + nghttpx: error while loading shared libraries: libnghttp2.so.14: cannot open shared object file: No such file or directory + +This means that the tool is unable to locate the ``libnghttp2.so`` shared library. + +To update the shared library cache run ``sudo ldconfig``. + +Building the documentation +-------------------------- + +.. note:: + + Documentation is still incomplete. + +To build the documentation, run: + +.. code-block:: text + + $ make html + +The documents will be generated under ``doc/manual/html/``. + +The generated documents will not be installed with ``make install``. + +The online documentation is available at +https://nghttp2.org/documentation/ + +Build HTTP/3 enabled h2load and nghttpx +--------------------------------------- + +To build h2load and nghttpx with HTTP/3 feature enabled, run the +configure script with ``--enable-http3``. + +For nghttpx to reload configurations and swapping its executable while +gracefully terminating old worker processes, eBPF is required. Run +the configure script with ``--enable-http3 --with-libbpf`` to build +eBPF program. The QUIC keying material must be set with +``--frontend-quic-secret-file`` in order to keep the existing +connections alive during reload. + +The detailed steps to build HTTP/3 enabled h2load and nghttpx follow. + +Build aws-lc: + +.. code-block:: text + + $ git clone --depth 1 -b v1.46.1 https://github.com/aws/aws-lc + $ cd aws-lc + $ cmake -B build -DDISABLE_GO=ON --install-prefix=$PWD/opt + $ make -j$(nproc) -C build + $ cmake --install build + $ cd .. + +Build nghttp3: + +.. code-block:: text + + $ git clone --depth 1 -b v1.8.0 https://github.com/ngtcp2/nghttp3 + $ cd nghttp3 + $ git submodule update --init --depth 1 + $ autoreconf -i + $ ./configure --prefix=$PWD/build --enable-lib-only + $ make -j$(nproc) + $ make install + $ cd .. + +Build ngtcp2: + +.. code-block:: text + + $ git clone --depth 1 -b v1.11.0 https://github.com/ngtcp2/ngtcp2 + $ cd ngtcp2 + $ git submodule update --init --depth 1 + $ autoreconf -i + $ ./configure --prefix=$PWD/build --enable-lib-only --with-boringssl \ + BORINGSSL_CFLAGS="-I$PWD/../aws-lc/opt/include" \ + BORINGSSL_LIBS="-L$PWD/../aws-lc/opt/lib -lssl -lcrypto" + $ make -j$(nproc) + $ make install + $ cd .. + +If your Linux distribution does not have libbpf-dev >= 0.7.0, build +from source: + +.. code-block:: text + + $ git clone --depth 1 -b v1.5.0 https://github.com/libbpf/libbpf + $ cd libbpf + $ PREFIX=$PWD/build make -C src install + $ cd .. + +Build nghttp2: + +.. code-block:: text + + $ git clone https://github.com/nghttp2/nghttp2 + $ cd nghttp2 + $ git submodule update --init + $ autoreconf -i + $ ./configure --with-mruby --enable-http3 --with-libbpf \ + CC=clang-15 CXX=clang++-15 \ + PKG_CONFIG_PATH="$PWD/../aws-lc/opt/lib/pkgconfig:$PWD/../nghttp3/build/lib/pkgconfig:$PWD/../ngtcp2/build/lib/pkgconfig:$PWD/../libbpf/build/lib64/pkgconfig" \ + LDFLAGS="$LDFLAGS -Wl,-rpath,$PWD/../aws-lc/opt/lib -Wl,-rpath,$PWD/../libbpf/build/lib64" + $ make -j$(nproc) + +The eBPF program ``reuseport_kern.o`` should be found under bpf +directory. Pass ``--quic-bpf-program-file=bpf/reuseport_kern.o`` +option to nghttpx to load it. See also `HTTP/3 section in nghttpx - +HTTP/2 proxy - HOW-TO +`_. + +Unit tests +---------- + +Unit tests are done by simply running ``make check``. + +Integration tests +----------------- + +We have the integration tests for the nghttpx proxy server. The tests are +written in the `Go programming language `_ and uses +its testing framework. We depend on the following libraries: + +* golang.org/x/net/http2 +* golang.org/x/net/websocket +* https://github.com/tatsuhiro-t/go-nghttp2 + +Go modules will download these dependencies automatically. + +To run the tests, run the following command under +``integration-tests`` directory: + +.. code-block:: text + + $ make it + +Inside the tests, we use port 3009 to run the test subject server. + +Migration from v0.7.15 or earlier +--------------------------------- + +nghttp2 v1.0.0 introduced several backward incompatible changes. In +this section, we describe these changes and how to migrate to v1.0.0. + +ALPN protocol ID is now ``h2`` and ``h2c`` +++++++++++++++++++++++++++++++++++++++++++ + +Previously we announced ``h2-14`` and ``h2c-14``. v1.0.0 implements +final protocol version, and we changed ALPN ID to ``h2`` and ``h2c``. +The macros ``NGHTTP2_PROTO_VERSION_ID``, +``NGHTTP2_PROTO_VERSION_ID_LEN``, +``NGHTTP2_CLEARTEXT_PROTO_VERSION_ID``, and +``NGHTTP2_CLEARTEXT_PROTO_VERSION_ID_LEN`` have been updated to +reflect this change. + +Basically, existing applications do not have to do anything, just +recompiling is enough for this change. + +Use word "client magic" where we use "client connection preface" +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + +We use "client connection preface" to mean first 24 bytes of client +connection preface. This is technically not correct, since client +connection preface is composed of 24 bytes client magic byte string +followed by SETTINGS frame. For clarification, we call "client magic" +for this 24 bytes byte string and updated API. + +* ``NGHTTP2_CLIENT_CONNECTION_PREFACE`` was replaced with + ``NGHTTP2_CLIENT_MAGIC``. +* ``NGHTTP2_CLIENT_CONNECTION_PREFACE_LEN`` was replaced with + ``NGHTTP2_CLIENT_MAGIC_LEN``. +* ``NGHTTP2_BAD_PREFACE`` was renamed as ``NGHTTP2_BAD_CLIENT_MAGIC`` + +The already deprecated ``NGHTTP2_CLIENT_CONNECTION_HEADER`` and +``NGHTTP2_CLIENT_CONNECTION_HEADER_LEN`` were removed. + +If application uses these macros, just replace old ones with new ones. +Since v1.0.0, client magic is sent by library (see next subsection), +so client application may just remove these macro use. + +Client magic is sent by library ++++++++++++++++++++++++++++++++ + +Previously nghttp2 library did not send client magic, which is first +24 bytes byte string of client connection preface, and client +applications have to send it by themselves. Since v1.0.0, client +magic is sent by library via first call of ``nghttp2_session_send()`` +or ``nghttp2_session_mem_send2()``. + +The client applications which send client magic must remove the +relevant code. + +Remove HTTP Alternative Services (Alt-Svc) related code ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + +Alt-Svc specification is not finalized yet. To make our API stable, +we have decided to remove all Alt-Svc related API from nghttp2. + +* ``NGHTTP2_EXT_ALTSVC`` was removed. +* ``nghttp2_ext_altsvc`` was removed. + +We have already removed the functionality of Alt-Svc in v0.7 series +and they have been essentially noop. The application using these +macro and struct, remove those lines. + +Use nghttp2_error in nghttp2_on_invalid_frame_recv_callback ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + +Previously ``nghttp2_on_invalid_frame_recv_cb_called`` took the +``error_code``, defined in ``nghttp2_error_code``, as parameter. But +they are not detailed enough to debug. Therefore, we decided to use +more detailed ``nghttp2_error`` values instead. + +The application using this callback should update the callback +signature. If it treats ``error_code`` as HTTP/2 error code, update +the code so that it is treated as ``nghttp2_error``. + +Receive client magic by default ++++++++++++++++++++++++++++++++ + +Previously nghttp2 did not process client magic (24 bytes byte +string). To make it deal with it, we had to use +``nghttp2_option_set_recv_client_preface()``. Since v1.0.0, nghttp2 +processes client magic by default and +``nghttp2_option_set_recv_client_preface()`` was removed. + +Some application may want to disable this behaviour, so we added +``nghttp2_option_set_no_recv_client_magic()`` to achieve this. + +The application using ``nghttp2_option_set_recv_client_preface()`` +with nonzero value, just remove it. + +The application using ``nghttp2_option_set_recv_client_preface()`` +with zero value or not using it must use +``nghttp2_option_set_no_recv_client_magic()`` with nonzero value. + +Client, Server and Proxy programs +--------------------------------- + +The ``src`` directory contains the HTTP/2 client, server and proxy programs. + +nghttp - client ++++++++++++++++ + +``nghttp`` is a HTTP/2 client. It can connect to the HTTP/2 server +with prior knowledge, HTTP Upgrade and ALPN TLS extension. + +It has verbose output mode for framing information. Here is sample +output from ``nghttp`` client: + +.. code-block:: text + + $ nghttp -nv https://nghttp2.org + [ 0.190] Connected + The negotiated protocol: h2 + [ 0.212] recv SETTINGS frame + (niv=2) + [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100] + [SETTINGS_INITIAL_WINDOW_SIZE(0x04):65535] + [ 0.212] send SETTINGS frame + (niv=2) + [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100] + [SETTINGS_INITIAL_WINDOW_SIZE(0x04):65535] + [ 0.212] send SETTINGS frame + ; ACK + (niv=0) + [ 0.212] send PRIORITY frame + (dep_stream_id=0, weight=201, exclusive=0) + [ 0.212] send PRIORITY frame + (dep_stream_id=0, weight=101, exclusive=0) + [ 0.212] send PRIORITY frame + (dep_stream_id=0, weight=1, exclusive=0) + [ 0.212] send PRIORITY frame + (dep_stream_id=7, weight=1, exclusive=0) + [ 0.212] send PRIORITY frame + (dep_stream_id=3, weight=1, exclusive=0) + [ 0.212] send HEADERS frame + ; END_STREAM | END_HEADERS | PRIORITY + (padlen=0, dep_stream_id=11, weight=16, exclusive=0) + ; Open new stream + :method: GET + :path: / + :scheme: https + :authority: nghttp2.org + accept: */* + accept-encoding: gzip, deflate + user-agent: nghttp2/1.0.1-DEV + [ 0.221] recv SETTINGS frame + ; ACK + (niv=0) + [ 0.221] recv (stream_id=13) :method: GET + [ 0.221] recv (stream_id=13) :scheme: https + [ 0.221] recv (stream_id=13) :path: /stylesheets/screen.css + [ 0.221] recv (stream_id=13) :authority: nghttp2.org + [ 0.221] recv (stream_id=13) accept-encoding: gzip, deflate + [ 0.222] recv (stream_id=13) user-agent: nghttp2/1.0.1-DEV + [ 0.222] recv PUSH_PROMISE frame + ; END_HEADERS + (padlen=0, promised_stream_id=2) + [ 0.222] recv (stream_id=13) :status: 200 + [ 0.222] recv (stream_id=13) date: Thu, 21 May 2015 16:38:14 GMT + [ 0.222] recv (stream_id=13) content-type: text/html + [ 0.222] recv (stream_id=13) last-modified: Fri, 15 May 2015 15:38:06 GMT + [ 0.222] recv (stream_id=13) etag: W/"555612de-19f6" + [ 0.222] recv (stream_id=13) link: ; rel=preload; as=stylesheet + [ 0.222] recv (stream_id=13) content-encoding: gzip + [ 0.222] recv (stream_id=13) server: nghttpx nghttp2/1.0.1-DEV + [ 0.222] recv (stream_id=13) via: 1.1 nghttpx + [ 0.222] recv (stream_id=13) strict-transport-security: max-age=31536000 + [ 0.222] recv HEADERS frame + ; END_HEADERS + (padlen=0) + ; First response header + [ 0.222] recv DATA frame + ; END_STREAM + [ 0.222] recv (stream_id=2) :status: 200 + [ 0.222] recv (stream_id=2) date: Thu, 21 May 2015 16:38:14 GMT + [ 0.222] recv (stream_id=2) content-type: text/css + [ 0.222] recv (stream_id=2) last-modified: Fri, 15 May 2015 15:38:06 GMT + [ 0.222] recv (stream_id=2) etag: W/"555612de-9845" + [ 0.222] recv (stream_id=2) content-encoding: gzip + [ 0.222] recv (stream_id=2) server: nghttpx nghttp2/1.0.1-DEV + [ 0.222] recv (stream_id=2) via: 1.1 nghttpx + [ 0.222] recv (stream_id=2) strict-transport-security: max-age=31536000 + [ 0.222] recv HEADERS frame + ; END_HEADERS + (padlen=0) + ; First push response header + [ 0.228] recv DATA frame + ; END_STREAM + [ 0.228] send GOAWAY frame + (last_stream_id=2, error_code=NO_ERROR(0x00), opaque_data(0)=[]) + +The HTTP Upgrade is performed like so: + +.. code-block:: text + + $ nghttp -nvu http://nghttp2.org + [ 0.011] Connected + [ 0.011] HTTP Upgrade request + GET / HTTP/1.1 + Host: nghttp2.org + Connection: Upgrade, HTTP2-Settings + Upgrade: h2c + HTTP2-Settings: AAMAAABkAAQAAP__ + Accept: */* + User-Agent: nghttp2/1.0.1-DEV + + + [ 0.018] HTTP Upgrade response + HTTP/1.1 101 Switching Protocols + Connection: Upgrade + Upgrade: h2c + + + [ 0.018] HTTP Upgrade success + [ 0.018] recv SETTINGS frame + (niv=2) + [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100] + [SETTINGS_INITIAL_WINDOW_SIZE(0x04):65535] + [ 0.018] send SETTINGS frame + (niv=2) + [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100] + [SETTINGS_INITIAL_WINDOW_SIZE(0x04):65535] + [ 0.018] send SETTINGS frame + ; ACK + (niv=0) + [ 0.018] send PRIORITY frame + (dep_stream_id=0, weight=201, exclusive=0) + [ 0.018] send PRIORITY frame + (dep_stream_id=0, weight=101, exclusive=0) + [ 0.018] send PRIORITY frame + (dep_stream_id=0, weight=1, exclusive=0) + [ 0.018] send PRIORITY frame + (dep_stream_id=7, weight=1, exclusive=0) + [ 0.018] send PRIORITY frame + (dep_stream_id=3, weight=1, exclusive=0) + [ 0.018] send PRIORITY frame + (dep_stream_id=11, weight=16, exclusive=0) + [ 0.019] recv (stream_id=1) :method: GET + [ 0.019] recv (stream_id=1) :scheme: http + [ 0.019] recv (stream_id=1) :path: /stylesheets/screen.css + [ 0.019] recv (stream_id=1) host: nghttp2.org + [ 0.019] recv (stream_id=1) user-agent: nghttp2/1.0.1-DEV + [ 0.019] recv PUSH_PROMISE frame + ; END_HEADERS + (padlen=0, promised_stream_id=2) + [ 0.019] recv (stream_id=1) :status: 200 + [ 0.019] recv (stream_id=1) date: Thu, 21 May 2015 16:39:16 GMT + [ 0.019] recv (stream_id=1) content-type: text/html + [ 0.019] recv (stream_id=1) content-length: 6646 + [ 0.019] recv (stream_id=1) last-modified: Fri, 15 May 2015 15:38:06 GMT + [ 0.019] recv (stream_id=1) etag: "555612de-19f6" + [ 0.019] recv (stream_id=1) link: ; rel=preload; as=stylesheet + [ 0.019] recv (stream_id=1) accept-ranges: bytes + [ 0.019] recv (stream_id=1) server: nghttpx nghttp2/1.0.1-DEV + [ 0.019] recv (stream_id=1) via: 1.1 nghttpx + [ 0.019] recv HEADERS frame + ; END_HEADERS + (padlen=0) + ; First response header + [ 0.019] recv DATA frame + ; END_STREAM + [ 0.019] recv (stream_id=2) :status: 200 + [ 0.019] recv (stream_id=2) date: Thu, 21 May 2015 16:39:16 GMT + [ 0.019] recv (stream_id=2) content-type: text/css + [ 0.019] recv (stream_id=2) content-length: 38981 + [ 0.019] recv (stream_id=2) last-modified: Fri, 15 May 2015 15:38:06 GMT + [ 0.019] recv (stream_id=2) etag: "555612de-9845" + [ 0.019] recv (stream_id=2) accept-ranges: bytes + [ 0.019] recv (stream_id=2) server: nghttpx nghttp2/1.0.1-DEV + [ 0.019] recv (stream_id=2) via: 1.1 nghttpx + [ 0.019] recv HEADERS frame + ; END_HEADERS + (padlen=0) + ; First push response header + [ 0.026] recv DATA frame + [ 0.027] recv DATA frame + [ 0.027] send WINDOW_UPDATE frame + (window_size_increment=33343) + [ 0.032] send WINDOW_UPDATE frame + (window_size_increment=33707) + [ 0.032] recv DATA frame + ; END_STREAM + [ 0.032] recv SETTINGS frame + ; ACK + (niv=0) + [ 0.032] send GOAWAY frame + (last_stream_id=2, error_code=NO_ERROR(0x00), opaque_data(0)=[]) + +Using the ``-s`` option, ``nghttp`` prints out some timing information for +requests, sorted by completion time: + +.. code-block:: text + + $ nghttp -nas https://nghttp2.org/ + ***** Statistics ***** + + Request timing: + responseEnd: the time when last byte of response was received + relative to connectEnd + requestStart: the time just before first byte of request was sent + relative to connectEnd. If '*' is shown, this was + pushed by server. + process: responseEnd - requestStart + code: HTTP status code + size: number of bytes received as response body without + inflation. + URI: request URI + + see http://www.w3.org/TR/resource-timing/#processing-model + + sorted by 'complete' + + id responseEnd requestStart process code size request path + 13 +37.19ms +280us 36.91ms 200 2K / + 2 +72.65ms * +36.38ms 36.26ms 200 8K /stylesheets/screen.css + 17 +77.43ms +38.67ms 38.75ms 200 3K /javascripts/octopress.js + 15 +78.12ms +38.66ms 39.46ms 200 3K /javascripts/modernizr-2.0.js + +Using the ``-r`` option, ``nghttp`` writes more detailed timing data to +the given file in HAR format. + +nghttpd - server +++++++++++++++++ + +``nghttpd`` is a multi-threaded static web server. + +By default, it uses SSL/TLS connection. Use ``--no-tls`` option to +disable it. + +``nghttpd`` only accepts HTTP/2 connections via ALPN or direct HTTP/2 +connections. No HTTP Upgrade is supported. + +The ``-p`` option allows users to configure server push. + +Just like ``nghttp``, it has a verbose output mode for framing +information. Here is sample output from ``nghttpd``: + +.. code-block:: text + + $ nghttpd --no-tls -v 8080 + IPv4: listen 0.0.0.0:8080 + IPv6: listen :::8080 + [id=1] [ 1.521] send SETTINGS frame + (niv=1) + [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100] + [id=1] [ 1.521] recv SETTINGS frame + (niv=2) + [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100] + [SETTINGS_INITIAL_WINDOW_SIZE(0x04):65535] + [id=1] [ 1.521] recv SETTINGS frame + ; ACK + (niv=0) + [id=1] [ 1.521] recv PRIORITY frame + (dep_stream_id=0, weight=201, exclusive=0) + [id=1] [ 1.521] recv PRIORITY frame + (dep_stream_id=0, weight=101, exclusive=0) + [id=1] [ 1.521] recv PRIORITY frame + (dep_stream_id=0, weight=1, exclusive=0) + [id=1] [ 1.521] recv PRIORITY frame + (dep_stream_id=7, weight=1, exclusive=0) + [id=1] [ 1.521] recv PRIORITY frame + (dep_stream_id=3, weight=1, exclusive=0) + [id=1] [ 1.521] recv (stream_id=13) :method: GET + [id=1] [ 1.521] recv (stream_id=13) :path: / + [id=1] [ 1.521] recv (stream_id=13) :scheme: http + [id=1] [ 1.521] recv (stream_id=13) :authority: localhost:8080 + [id=1] [ 1.521] recv (stream_id=13) accept: */* + [id=1] [ 1.521] recv (stream_id=13) accept-encoding: gzip, deflate + [id=1] [ 1.521] recv (stream_id=13) user-agent: nghttp2/1.0.0-DEV + [id=1] [ 1.521] recv HEADERS frame + ; END_STREAM | END_HEADERS | PRIORITY + (padlen=0, dep_stream_id=11, weight=16, exclusive=0) + ; Open new stream + [id=1] [ 1.521] send SETTINGS frame + ; ACK + (niv=0) + [id=1] [ 1.521] send HEADERS frame + ; END_HEADERS + (padlen=0) + ; First response header + :status: 200 + server: nghttpd nghttp2/1.0.0-DEV + content-length: 10 + cache-control: max-age=3600 + date: Fri, 15 May 2015 14:49:04 GMT + last-modified: Tue, 30 Sep 2014 12:40:52 GMT + [id=1] [ 1.522] send DATA frame + ; END_STREAM + [id=1] [ 1.522] stream_id=13 closed + [id=1] [ 1.522] recv GOAWAY frame + (last_stream_id=0, error_code=NO_ERROR(0x00), opaque_data(0)=[]) + [id=1] [ 1.522] closed + +nghttpx - proxy ++++++++++++++++ + +``nghttpx`` is a multi-threaded reverse proxy for HTTP/3, HTTP/2, and +HTTP/1.1, and powers http://nghttp2.org and supports HTTP/2 server +push. + +We reworked ``nghttpx`` command-line interface, and as a result, there +are several incompatibles from 1.8.0 or earlier. This is necessary to +extend its capability, and secure the further feature enhancements in +the future release. Please read `Migration from nghttpx v1.8.0 or +earlier +`_ +to know how to migrate from earlier releases. + +``nghttpx`` implements `important performance-oriented features +`_ in TLS, such as +session IDs, session tickets (with automatic key rotation), OCSP +stapling, dynamic record sizing, ALPN, forward secrecy and HTTP/2. +``nghttpx`` also offers the functionality to share session cache and +ticket keys among multiple ``nghttpx`` instances via memcached. + +``nghttpx`` has 2 operation modes: + +================== ======================== ================ ============= +Mode option Frontend Backend Note +================== ======================== ================ ============= +default mode HTTP/3, HTTP/2, HTTP/1.1 HTTP/1.1, HTTP/2 Reverse proxy +``--http2-proxy`` HTTP/3, HTTP/2, HTTP/1.1 HTTP/1.1, HTTP/2 Forward proxy +================== ======================== ================ ============= + +The interesting mode at the moment is the default mode. It works like +a reverse proxy and listens for HTTP/3, HTTP/2, and HTTP/1.1 and can +be deployed as a SSL/TLS terminator for existing web server. + +In all modes, the frontend connections are encrypted by SSL/TLS by +default. To disable encryption, use the ``no-tls`` keyword in +``--frontend`` option. If encryption is disabled, incoming HTTP/1.1 +connections can be upgraded to HTTP/2 through HTTP Upgrade. On the +other hard, backend connections are not encrypted by default. To +encrypt backend connections, use ``tls`` keyword in ``--backend`` +option. + +``nghttpx`` supports a configuration file. See the ``--conf`` option and +sample configuration file ``nghttpx.conf.sample``. + +In the default mode, ``nghttpx`` works as reverse proxy to the backend +server: + +.. code-block:: text + + Client <-- (HTTP/3, HTTP/2, HTTP/1.1) --> nghttpx <-- (HTTP/1.1, HTTP/2) --> Web Server + [reverse proxy] + +With the ``--http2-proxy`` option, it works as forward proxy, and it +is so called secure HTTP/2 proxy: + +.. code-block:: text + + Client <-- (HTTP/3, HTTP/2, HTTP/1.1) --> nghttpx <-- (HTTP/1.1) --> Proxy + [secure proxy] (e.g., Squid, ATS) + +The ``Client`` in the above example needs to be configured to use +``nghttpx`` as secure proxy. + +At the time of this writing, both Chrome and Firefox support secure +HTTP/2 proxy. One way to configure Chrome to use a secure proxy is to +create a proxy.pac script like this: + +.. code-block:: javascript + + function FindProxyForURL(url, host) { + return "HTTPS SERVERADDR:PORT"; + } + +``SERVERADDR`` and ``PORT`` is the hostname/address and port of the +machine nghttpx is running on. Please note that Chrome requires a valid +certificate for secure proxy. + +Then run Chrome with the following arguments: + +.. code-block:: text + + $ google-chrome --proxy-pac-url=file:///path/to/proxy.pac --use-npn + +The backend HTTP/2 connections can be tunneled through an HTTP proxy. +The proxy is specified using ``--backend-http-proxy-uri``. The +following figure illustrates how nghttpx talks to the outside HTTP/2 +proxy through an HTTP proxy: + +.. code-block:: text + + Client <-- (HTTP/3, HTTP/2, HTTP/1.1) --> nghttpx <-- (HTTP/2) -- + + --===================---> HTTP/2 Proxy + (HTTP proxy tunnel) (e.g., nghttpx -s) + +Benchmarking tool +----------------- + +The ``h2load`` program is a benchmarking tool for HTTP/3, HTTP/2, and +HTTP/1.1. The UI of ``h2load`` is heavily inspired by ``weighttp`` +(https://github.com/lighttpd/weighttp). The typical usage is as +follows: + +.. code-block:: text + + $ h2load -n100000 -c100 -m100 https://localhost:8443/ + starting benchmark... + spawning thread #0: 100 concurrent clients, 100000 total requests + Protocol: TLSv1.2 + Cipher: ECDHE-RSA-AES128-GCM-SHA256 + Server Temp Key: ECDH P-256 256 bits + progress: 10% done + progress: 20% done + progress: 30% done + progress: 40% done + progress: 50% done + progress: 60% done + progress: 70% done + progress: 80% done + progress: 90% done + progress: 100% done + + finished in 771.26ms, 129658 req/s, 4.71MB/s + requests: 100000 total, 100000 started, 100000 done, 100000 succeeded, 0 failed, 0 errored + status codes: 100000 2xx, 0 3xx, 0 4xx, 0 5xx + traffic: 3812300 bytes total, 1009900 bytes headers, 1000000 bytes data + min max mean sd +/- sd + time for request: 25.12ms 124.55ms 51.07ms 15.36ms 84.87% + time for connect: 208.94ms 254.67ms 241.38ms 7.95ms 63.00% + time to 1st byte: 209.11ms 254.80ms 241.51ms 7.94ms 63.00% + +The above example issued total 100,000 requests, using 100 concurrent +clients (in other words, 100 HTTP/2 sessions), and a maximum of 100 streams +per client. With the ``-t`` option, ``h2load`` will use multiple native +threads to avoid saturating a single core on client side. + +.. warning:: + + **Don't use this tool against publicly available servers.** That is + considered a DOS attack. Please only use it against your private + servers. + +If the experimental HTTP/3 is enabled, h2load can send requests to +HTTP/3 server. To do this, specify ``h3`` to ``--alpn-list`` option +like so: + +.. code-block:: text + + $ h2load --alpn-list h3 https://127.0.0.1:4433 + +For nghttp2 v1.58 or earlier, use ``--npn-list`` instead of +``--alpn-list``. + +HPACK tools +----------- + +The ``src`` directory contains the HPACK tools. The ``deflatehd`` program is a +command-line header compression tool. The ``inflatehd`` program is a +command-line header decompression tool. Both tools read input from +stdin and write output to stdout. Errors are written to stderr. +They take JSON as input and output. We (mostly) use the same JSON data +format described at https://github.com/http2jp/hpack-test-case. + +deflatehd - header compressor ++++++++++++++++++++++++++++++ + +The ``deflatehd`` program reads JSON data or HTTP/1-style header fields from +stdin and outputs compressed header block in JSON. + +For the JSON input, the root JSON object must include a ``cases`` key. +Its value has to include the sequence of input header set. They share +the same compression context and are processed in the order they +appear. Each item in the sequence is a JSON object and it must +include a ``headers`` key. Its value is an array of JSON objects, +which includes exactly one name/value pair. + +Example: + +.. code-block:: json + + { + "cases": + [ + { + "headers": [ + { ":method": "GET" }, + { ":path": "/" } + ] + }, + { + "headers": [ + { ":method": "POST" }, + { ":path": "/" } + ] + } + ] + } + + +With the ``-t`` option, the program can accept more familiar HTTP/1 style +header field blocks. Each header set is delimited by an empty line: + +Example: + +.. code-block:: text + + :method: GET + :scheme: https + :path: / + + :method: POST + user-agent: nghttp2 + +The output is in JSON object. It should include a ``cases`` key and its +value is an array of JSON objects, which has at least the following keys: + +seq + The index of header set in the input. + +input_length + The sum of the length of the name/value pairs in the input. + +output_length + The length of the compressed header block. + +percentage_of_original_size + ``output_length`` / ``input_length`` * 100 + +wire + The compressed header block as a hex string. + +headers + The input header set. + +header_table_size + The header table size adjusted before deflating the header set. + +Examples: + +.. code-block:: json + + { + "cases": + [ + { + "seq": 0, + "input_length": 66, + "output_length": 20, + "percentage_of_original_size": 30.303030303030305, + "wire": "01881f3468e5891afcbf83868a3d856659c62e3f", + "headers": [ + { + ":authority": "example.org" + }, + { + ":method": "GET" + }, + { + ":path": "/" + }, + { + ":scheme": "https" + }, + { + "user-agent": "nghttp2" + } + ], + "header_table_size": 4096 + } + , + { + "seq": 1, + "input_length": 74, + "output_length": 10, + "percentage_of_original_size": 13.513513513513514, + "wire": "88448504252dd5918485", + "headers": [ + { + ":authority": "example.org" + }, + { + ":method": "POST" + }, + { + ":path": "/account" + }, + { + ":scheme": "https" + }, + { + "user-agent": "nghttp2" + } + ], + "header_table_size": 4096 + } + ] + } + + +The output can be used as the input for ``inflatehd`` and +``deflatehd``. + +With the ``-d`` option, the extra ``header_table`` key is added and its +associated value includes the state of dynamic header table after the +corresponding header set was processed. The value includes at least +the following keys: + +entries + The entry in the header table. If ``referenced`` is ``true``, it + is in the reference set. The ``size`` includes the overhead (32 + bytes). The ``index`` corresponds to the index of header table. + The ``name`` is the header field name and the ``value`` is the + header field value. + +size + The sum of the spaces entries occupied, this includes the + entry overhead. + +max_size + The maximum header table size. + +deflate_size + The sum of the spaces entries occupied within + ``max_deflate_size``. + +max_deflate_size + The maximum header table size the encoder uses. This can be smaller + than ``max_size``. In this case, the encoder only uses up to first + ``max_deflate_size`` buffer. Since the header table size is still + ``max_size``, the encoder has to keep track of entries outside the + ``max_deflate_size`` but inside the ``max_size`` and make sure + that they are no longer referenced. + +Example: + +.. code-block:: json + + { + "cases": + [ + { + "seq": 0, + "input_length": 66, + "output_length": 20, + "percentage_of_original_size": 30.303030303030305, + "wire": "01881f3468e5891afcbf83868a3d856659c62e3f", + "headers": [ + { + ":authority": "example.org" + }, + { + ":method": "GET" + }, + { + ":path": "/" + }, + { + ":scheme": "https" + }, + { + "user-agent": "nghttp2" + } + ], + "header_table_size": 4096, + "header_table": { + "entries": [ + { + "index": 1, + "name": "user-agent", + "value": "nghttp2", + "referenced": true, + "size": 49 + }, + { + "index": 2, + "name": ":scheme", + "value": "https", + "referenced": true, + "size": 44 + }, + { + "index": 3, + "name": ":path", + "value": "/", + "referenced": true, + "size": 38 + }, + { + "index": 4, + "name": ":method", + "value": "GET", + "referenced": true, + "size": 42 + }, + { + "index": 5, + "name": ":authority", + "value": "example.org", + "referenced": true, + "size": 53 + } + ], + "size": 226, + "max_size": 4096, + "deflate_size": 226, + "max_deflate_size": 4096 + } + } + , + { + "seq": 1, + "input_length": 74, + "output_length": 10, + "percentage_of_original_size": 13.513513513513514, + "wire": "88448504252dd5918485", + "headers": [ + { + ":authority": "example.org" + }, + { + ":method": "POST" + }, + { + ":path": "/account" + }, + { + ":scheme": "https" + }, + { + "user-agent": "nghttp2" + } + ], + "header_table_size": 4096, + "header_table": { + "entries": [ + { + "index": 1, + "name": ":method", + "value": "POST", + "referenced": true, + "size": 43 + }, + { + "index": 2, + "name": "user-agent", + "value": "nghttp2", + "referenced": true, + "size": 49 + }, + { + "index": 3, + "name": ":scheme", + "value": "https", + "referenced": true, + "size": 44 + }, + { + "index": 4, + "name": ":path", + "value": "/", + "referenced": false, + "size": 38 + }, + { + "index": 5, + "name": ":method", + "value": "GET", + "referenced": false, + "size": 42 + }, + { + "index": 6, + "name": ":authority", + "value": "example.org", + "referenced": true, + "size": 53 + } + ], + "size": 269, + "max_size": 4096, + "deflate_size": 269, + "max_deflate_size": 4096 + } + } + ] + } + +inflatehd - header decompressor ++++++++++++++++++++++++++++++++ + +The ``inflatehd`` program reads JSON data from stdin and outputs decompressed +name/value pairs in JSON. + +The root JSON object must include the ``cases`` key. Its value has to +include the sequence of compressed header blocks. They share the same +compression context and are processed in the order they appear. Each +item in the sequence is a JSON object and it must have at least a +``wire`` key. Its value is a compressed header block as a hex string. + +Example: + +.. code-block:: json + + { + "cases": + [ + { "wire": "8285" }, + { "wire": "8583" } + ] + } + +The output is a JSON object. It should include a ``cases`` key and its +value is an array of JSON objects, which has at least following keys: + +seq + The index of the header set in the input. + +headers + A JSON array that includes decompressed name/value pairs. + +wire + The compressed header block as a hex string. + +header_table_size + The header table size adjusted before inflating compressed header + block. + +Example: + +.. code-block:: json + + { + "cases": + [ + { + "seq": 0, + "wire": "01881f3468e5891afcbf83868a3d856659c62e3f", + "headers": [ + { + ":authority": "example.org" + }, + { + ":method": "GET" + }, + { + ":path": "/" + }, + { + ":scheme": "https" + }, + { + "user-agent": "nghttp2" + } + ], + "header_table_size": 4096 + } + , + { + "seq": 1, + "wire": "88448504252dd5918485", + "headers": [ + { + ":method": "POST" + }, + { + ":path": "/account" + }, + { + "user-agent": "nghttp2" + }, + { + ":scheme": "https" + }, + { + ":authority": "example.org" + } + ], + "header_table_size": 4096 + } + ] + } + +The output can be used as the input for ``deflatehd`` and +``inflatehd``. + +With the ``-d`` option, the extra ``header_table`` key is added and its +associated value includes the state of the dynamic header table after the +corresponding header set was processed. The format is the same as +``deflatehd``. + +Contribution +------------ + +[This text was composed based on 1.2. License section of curl/libcurl +project.] + +When contributing with code, you agree to put your changes and new +code under the same license nghttp2 is already using unless stated and +agreed otherwise. + +When changing existing source code, do not alter the copyright of +the original file(s). The copyright will still be owned by the +original creator(s) or those who have been assigned copyright by the +original author(s). + +By submitting a patch to the nghttp2 project, you (or your employer, as +the case may be) agree to assign the copyright of your submission to us. +.. the above really needs to be reworded to pass legal muster. +We will credit you for your +changes as far as possible, to give credit but also to keep a trace +back to who made what changes. Please always provide us with your +full real name when contributing! + +See `Contribution Guidelines +`_ for more +details. + +Versioning +---------- + +In general, we follow `Semantic Versioning `_. + +We may release PATCH releases between the regular releases, mainly for +severe security bug fixes. + +We have no plan to break API compatibility changes involving soname +bump, so MAJOR version will stay 1 for the foreseeable future. + +License +------- + +The MIT License diff --git a/curl/dep/nghttp3/AUTHORS.txt b/curl/dep/nghttp3/AUTHORS.txt new file mode 100644 index 0000000..1993a2a --- /dev/null +++ b/curl/dep/nghttp3/AUTHORS.txt @@ -0,0 +1,29 @@ +Alexis La Goutte +Amir Livneh +Bruno S Marques +Bryan Call +Cheng Zhao +Daniel Bevenius +Daniel Stenberg +Deel +Dimitris Apostolou +Don +Don Olmstead +Dusk_NM02 +Force Charlie +James M Snell +Javier Blazquez +Li Xinwei +Marek Ludha +Nishant Nori +Ondřej Koláček +Peter Wu +Tal Regev +Tatsuhiro Tsujikawa +Tim Gates +Toni Uhlig +Valère Plantevin +Viktor Szakats +Your Name +lhuang04 +mbuhl diff --git a/curl/dep/nghttp3/COPYING.txt b/curl/dep/nghttp3/COPYING.txt new file mode 100644 index 0000000..37562ea --- /dev/null +++ b/curl/dep/nghttp3/COPYING.txt @@ -0,0 +1,22 @@ +The MIT License + +Copyright (c) 2019 nghttp3 contributors + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/curl/dep/nghttp3/ChangeLog.txt b/curl/dep/nghttp3/ChangeLog.txt new file mode 100644 index 0000000..1f79c62 --- /dev/null +++ b/curl/dep/nghttp3/ChangeLog.txt @@ -0,0 +1,15 @@ +commit df0d504b60a2600f57ab300ca2b61f64905e7d15 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-05-27 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-27 + + Bump package and library versions + +commit 7abad8b0c920c1e587ee52ee8a5f76241d177828 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-05-27 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-27 + + Revert "Tighten up :path validation" diff --git a/curl/dep/nghttp3/README.rst b/curl/dep/nghttp3/README.rst new file mode 100644 index 0000000..950c7c5 --- /dev/null +++ b/curl/dep/nghttp3/README.rst @@ -0,0 +1,73 @@ +nghttp3 +======= + +nghttp3 is an implementation of `RFC 9114 +`_ HTTP/3 mapping over +QUIC and `RFC 9204 `_ +QPACK in C. + +It does not depend on any particular QUIC transport implementation. + +Documentation +------------- + +`Online documentation `_ is available. + +Build from git +--------------- + +.. code-block:: shell + + $ git clone https://github.com/ngtcp2/nghttp3 + $ cd nghttp3 + $ git submodule update --init + $ autoreconf -i + $ ./configure + $ make -j$(nproc) check + +HTTP/3 +------ + +This library implements `RFC 9114 +`_ HTTP/3. It does not +support server push. + +The following extensions have been implemented: + +- `Extensible Prioritization Scheme for HTTP + `_ +- `Bootstrapping WebSockets with HTTP/3 + `_ + +It can also send and receive `SETTINGS_H3_DATAGRAM` from `HTTP +Datagrams and the Capsule Protocol +`_. + +QPACK +----- + +This library implements `RFC 9204 +`_ QPACK. It supports +dynamic table. + +Optimizations +------------- + +This library optionally uses AVX2, if available, to optimize its +performance. To compile with AVX2, add ``-mavx2`` to CFLAGS. Note +that by default, CFLAGS is set to ``-g -O2``. When specifying CFLAGS, +include them as well (e.g., ``-g -O2 -mavx2``). + +Examples +-------- + +- client: https://github.com/ngtcp2/ngtcp2/blob/main/examples/client.cc +- server: https://github.com/ngtcp2/ngtcp2/blob/main/examples/server.cc +- curl: https://github.com/curl/curl/blob/master/lib/vquic/curl_ngtcp2.c + +License +------- + +The MIT License + +Copyright (c) 2019 nghttp3 contributors diff --git a/curl/dep/ngtcp2/AUTHORS.txt b/curl/dep/ngtcp2/AUTHORS.txt new file mode 100644 index 0000000..d7fd73e --- /dev/null +++ b/curl/dep/ngtcp2/AUTHORS.txt @@ -0,0 +1,67 @@ +Alexis La Goutte +Amir Livneh +Anna Henningsen +Atle Solbakken +Bas van den Berg +Billy Robert O'Neal III +Bruno S Marques +Bryan Call +Cheng Zhao +Daan De Meyer +Daiki Ueno +Daniel Bevenius +Daniel Stenberg +Dave Reisner +Don +Don Olmstead +Frank Osterfeld +Frédéric Lécaille +Félix Dagenais +Irina Guberman +James M Snell +Jan Doskočil +Jason Rhinelander +Javier Blazquez +Jay Satiro +Jean-Philippe Boivin +Jiawen Geng +Jixinqi +Junqi Wang +Karthikdasari0423 +Kazu Yamamoto +Ken-ichi ICHINO +Kenjiro Nakayama +Lars Eggert +Liang Ma +Marin Rukavina +Mark Chiou +Martin Thomson +Michael White +Moritz Buhl +NKTelnet +Natris +Nishant Nori +Patrick Griffis +Pavel Otchertsov +Peter Wu +Samuel Henrique +Stefan Eissing +Tal Regev +Tatsuhiro Tsujikawa +Tim Gates +Tomas Mraz +Toni Uhlig +Valère Plantevin +Victor Loh +Viktor Szakats +Your Name +Zizhong Zhang +flx413 +hondaxiao +hyunjic +junqiw +msoxzw +nickfajones +rhoxn +scw00 +shibin k v diff --git a/curl/dep/ngtcp2/COPYING.txt b/curl/dep/ngtcp2/COPYING.txt new file mode 100644 index 0000000..9b367cd --- /dev/null +++ b/curl/dep/ngtcp2/COPYING.txt @@ -0,0 +1,22 @@ +The MIT License + +Copyright (c) 2016 ngtcp2 contributors + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/curl/dep/ngtcp2/ChangeLog.txt b/curl/dep/ngtcp2/ChangeLog.txt new file mode 100644 index 0000000..cc9d895 --- /dev/null +++ b/curl/dep/ngtcp2/ChangeLog.txt @@ -0,0 +1,620 @@ +commit 7dd482f949f145632c482d01af2184954b471795 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-05-26 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-26 + + Bump package and library versions + +commit c1550b0fb8c864df021417744d2beac6f2a61f26 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-05-26 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-26 + + Update AUTHORS + +commit dec3e0ccd3dbff5457d76003b6e34c71063497ec +Merge: f0c08bc9 1db3624d +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-05-26 +Commit: GitHub +CommitDate: 2025-05-26 + + Merge pull request #1654 from ngtcp2/bump-aws-lc + + Bump aws-lc to v1.52.0 + +commit 1db3624dc774603d28473c949c7a3a1125df800a +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-05-26 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-26 + + Bump aws-lc to v1.52.0 + +commit f0c08bc94f6a06f05c468ec4174f05f605606d22 +Merge: 51fb9608 c5235a75 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-05-26 +Commit: GitHub +CommitDate: 2025-05-26 + + Merge pull request #1653 from ngtcp2/bump-boringssl + + Bump boringssl + +commit c5235a75c92b0444b3fd9a5ac716c2f48dfb5435 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-05-26 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-26 + + Bump boringssl + +commit 51fb9608e18124ef98d2d6406da047c69593aaec +Merge: c483a8f1 8626ddd7 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-05-12 +Commit: GitHub +CommitDate: 2025-05-12 + + Merge pull request #1651 from ngtcp2/constexpr-istarts_with + + Make istarts_with constexpr + +commit 8626ddd7a6bca940138588508396bf766e9fbdfe +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-05-12 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-12 + + Make istarts_with constexpr + +commit c483a8f1b6c4ec8dc1fe704f925ec71c5106d2af +Merge: f7a4030a d61fb269 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-05-12 +Commit: GitHub +CommitDate: 2025-05-12 + + Merge pull request #1650 from ngtcp2/bump-munit + + Bump munit + +commit d61fb2693fb091ff1a0f631c17c21e2564465a38 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-05-11 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-11 + + Bump munit + +commit f7a4030ab25c3f481f38e6f3e87da9ea9b7139bd +Merge: c3ede479 210891fb +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-05-04 +Commit: GitHub +CommitDate: 2025-05-04 + + Merge pull request #1646 from nak3/bump-libressl-4.1.0 + + Bump libressl to v4.1.0 + +commit c3ede4793aacbe8b180fd9a4b3280e7f6264e115 +Merge: 4a1611ed 10ebe66c +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-05-04 +Commit: GitHub +CommitDate: 2025-05-04 + + Merge pull request #1647 from kazu-yamamoto/boringssl-mac + + putting important libdir and incdir first + +commit 210891fbaefde1995f5210fb3f63540f0ab07ff3 +Author: Kenjiro Nakayama +AuthorDate: 2025-05-01 +Commit: Kenjiro Nakayama +CommitDate: 2025-05-03 + + Bump libressl to v4.1.0 + +commit 10ebe66c5c204934a939ba314d40c5d9e9008b7f +Author: Kazu Yamamoto +AuthorDate: 2025-05-02 +Commit: Kazu Yamamoto +CommitDate: 2025-05-03 + + putting important libdir and incdir first + +commit 4a1611ed5b17bcfbf3bdf197edfb1c60c195066e +Merge: 1ab80a97 11216f47 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-05-01 +Commit: GitHub +CommitDate: 2025-05-01 + + Merge pull request #1645 from ngtcp2/avoid-mismatch + + Avoid slower std::ranges::mismatch + +commit 11216f47288543bbab9a301930affe898a8ff54f +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-05-01 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + Avoid slower std::ranges::mismatch + +commit 1ab80a974eee74246cf5684b130492661e161936 +Merge: 261d31d1 426a023f +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-05-01 +Commit: GitHub +CommitDate: 2025-05-01 + + Merge pull request #1644 from ngtcp2/as_uint8_span-consteval + + Make as_uint8_span consteval + +commit 426a023fc8d91d06a458dd7da39d434c02034e30 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-05-01 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + Make as_uint8_span consteval + +commit 261d31d13e6401d9719c0067064f05001a5a04e7 +Merge: 04313d14 0ee64591 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-05-01 +Commit: GitHub +CommitDate: 2025-05-01 + + Merge pull request #1643 from ngtcp2/refactor-examples + + Refactor examples + +commit 0ee645916789e121ce5b242125d9761785a2ca7d +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-05-01 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + Refactor parse_host_port + +commit 71f1985238d5d696c827f802140fd92163c8e957 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-05-01 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + examples/client: Adopt std::unordered_map + +commit edf55332b846ec1e7a924cdd063940f0c265a19c +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-05-01 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + Rewrite ALPN selection + +commit 8d765e0b0ff53a86d860db5a3584a3731d8261c9 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + Remove unused b64encode + +commit 9c50a92b862a1c81d8454346caec5b5cbda2bb84 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + C++ style cast + +commit 9fbfbf61251f1272bc6b87d7f1ecdb5f13658678 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + get_reason_phrase: Return std::string_view + +commit 9f04b6b5ed1d7665eafe070865f05d781d38e319 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + siphash: Adopt std::ranges + +commit c65071bf1c52cbd256d64599c05431c5c0f7519d +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + picotls: Adopt std::ranges + +commit e4901d2720ab3e467d5b60c4adc75c4796eb3ebe +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + picotls: Refactor ticket encryption/decryption function + +commit 9cdee080fb38b2c4388530c68abc3897332e6c4e +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + Refactor ALPN definitions + +commit 22fdfc6f7216400580ebceff4e75ff9a56fbb03e +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + examples/client: Adopt std::ranges + +commit 8d67312aaf5f29b69b6ea34d7efb9384b6bf40d4 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + tls_server_*: Adopt std::ranges + +commit 19e3af2520d206b18f91a91dc0672761bec4ec72 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + examples/server: Adopt std::ranges + +commit e27fd65169e410b19e979e4882d01886d504cefd +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + Append sv to string arguments to read_pem and write_pem + +commit 3795fde07f00991d5e9a9424c578bcb460906791 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + Refactor hexdump with std::span + +commit 846d45bc3926a4a3f16fede156d2387b9b0e65a8 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + Refactor parse_version + +commit 9a3d76654e86a63d81fabe676c632a3a9e3aa532 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + percent_decode: Take std::string_view + +commit b778aa08802ccb0f9866ea1b95e98a82598b9db4 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-30 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-05-01 + + examples/util: Adopt std::ranges + +commit 04313d145c7badc950853044673854212cbeb086 +Merge: 2ede338d b3eccce4 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-04-28 +Commit: GitHub +CommitDate: 2025-04-28 + + Merge pull request #1640 from ngtcp2/span-first + + examples: Adopt std::span::first + +commit b3eccce4173748f6ce2bceb11dd4e8116a73045f +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-28 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-28 + + examples: Adopt std::span::first + +commit 2ede338d96d3d9ded87b2641bfe83a15cf301ac5 +Merge: 0271af1c 4779b8bf +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-04-28 +Commit: GitHub +CommitDate: 2025-04-28 + + Merge pull request #1638 from ngtcp2/client-refactor-packet-write + + examples/client: Refactor packet write path + +commit 4779b8bfc7df59ad6c8493edc96496fa48230a0e +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-28 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-28 + + examples/client: Refactor packet write path + +commit 0271af1c504e769223214cd2138dfadb668f9b1f +Merge: fdf255b4 280c64ac +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-04-27 +Commit: GitHub +CommitDate: 2025-04-27 + + Merge pull request #1637 from ngtcp2/server-refactor-on_send_blocked + + examples/server: Refactor on_send_blocked + +commit 280c64ac6aad528f0d0bf2f6b41c80ca0a7a5c2b +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-27 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-27 + + examples/server: Refactor on_send_blocked + +commit fdf255b49593bf2333a6d357877bca170bd915ab +Merge: ab43336b 225fc54b +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-04-27 +Commit: GitHub +CommitDate: 2025-04-27 + + Merge pull request #1636 from ngtcp2/server-endpoint-const + + examples/server: Add const qualifier to Endpoint when passed to function + +commit 225fc54bd12a78b3fd03ebf9b4dd2941fc38ccc4 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-27 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-27 + + examples/server: Add const qualifier to Endpoint when passed to function + +commit ab43336bf514f8d6a82f1107dc52ee9f35d129b6 +Merge: f2ab5479 b25ba934 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-04-27 +Commit: GitHub +CommitDate: 2025-04-27 + + Merge pull request #1635 from ngtcp2/server-refactor-packet-write + + examples/server: Refactor packet write + +commit b25ba9345fe7cbc97d9220ef6a67a6ad84de159b +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-27 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-27 + + examples/server: Refactor packet write + +commit f2ab54791fdd664195a84692b08a84c35baefa29 +Merge: 709806d3 1be14245 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-04-27 +Commit: GitHub +CommitDate: 2025-04-27 + + Merge pull request #1634 from ngtcp2/bump-wolfssl + + Bump wolfssl to v5.8.0-stable + +commit 1be1424585ed09702d223ab9da313d508f2725e1 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-27 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-27 + + Bump wolfssl to v5.8.0-stable + +commit 709806d3fe258a0dd0b6cc40b5f03ec3c3c07f89 +Merge: a5d03dd7 95dadc5a +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-04-22 +Commit: GitHub +CommitDate: 2025-04-22 + + Merge pull request #1630 from ngtcp2/cubic-bound-time-delta + + cubic: Bound time_delta + +commit 95dadc5a484216edaecef46abbb4c85798e4e19d +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-22 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-22 + + cubic: Bound time_delta + +commit a5d03dd7c9b4b379770f22df8670d8c329faf518 +Merge: e92f7528 9fcff171 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-04-21 +Commit: GitHub +CommitDate: 2025-04-21 + + Merge pull request #1629 from ngtcp2/refactor-cubic + + Refactor cubic + +commit 9fcff171091382f58005705dfdb4b405015b1a2b +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-20 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-21 + + Refactor cubic + +commit e92f75288d9a66d3969e5b2f5b108b980037733d +Merge: 02ebe607 876c29af +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-04-20 +Commit: GitHub +CommitDate: 2025-04-20 + + Merge pull request #1628 from ngtcp2/pacing-interval + + Add extra precision to pacing_interval + +commit 876c29afd910dd5d69d2663dc9465507eefd78c6 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-20 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-20 + + Add extra precision to pacing_interval + +commit 02ebe6075a043f6f1eeaa7f81ff07f1f4775bf32 +Merge: 3e31700b b30e8c33 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-04-19 +Commit: GitHub +CommitDate: 2025-04-19 + + Merge pull request #1627 from ngtcp2/pacing-less-bursty + + Make pacing less bursty + +commit b30e8c33d9099472c9df66c072200a36ce0d3b76 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-19 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-19 + + Make pacing less bursty + +commit 3e31700b746dc612d0c8edbb23b8aaf842a3b1f2 +Merge: c239f04f 1a77af29 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-04-19 +Commit: GitHub +CommitDate: 2025-04-19 + + Merge pull request #1626 from ngtcp2/path-response-non-probing + + Make a packet containing PATH_RESPONSE to active path non-probing + +commit 1a77af297cd7391155a870896e2af1a6c9610a64 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-19 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-19 + + Make a packet containing PATH_RESPONSE to active path non-probing + +commit c239f04f982726df75afd2673256bb69b3f0a3fa +Merge: 438d4e9d d6d4f064 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-04-19 +Commit: GitHub +CommitDate: 2025-04-19 + + Merge pull request #1625 from ngtcp2/fix-path-response-padding + + Fix path response padding + +commit d6d4f064c917c5f60e61070821b6a67ee07e3d3a +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-19 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-19 + + Remove unnecessary conn->pkt.require_padding manipulation + + On first write call (!ppe_pending), + NGTCP2_WRITE_PKT_FLAG_REQUIRE_PADDING suggests padding requirement. + On the subsequent calls (ppe_pending), conn->pkt.require_padding is + used instead. + +commit 47a9f9044532448d9cedd452a7230feb1b3a4a34 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-19 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-19 + + Fix bug that packet is not padded with NGTCP2_WRITE_STREAM_FLAG_MORE + + Make sure that packet with PATH_RESPONSE to an active path is padded + with NGTCP2_WRITE_STREAM_FLAG_MORE. + +commit 438d4e9d7d4dad936a7cd57904ce1019568ce96d +Merge: 4408e690 48cba1d2 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-04-19 +Commit: GitHub +CommitDate: 2025-04-19 + + Merge pull request #1624 from jixinqi/jixinqi-patch-1 + + Update CMakeLists.txt to fix the error of check_symbol_exists() when static-link openssl. + +commit 48cba1d21c126070c4fe13c5cfd7b87f7f9f1e09 +Author: Jixinqi <4635756+jixinqi@users.noreply.github.com> +AuthorDate: 2025-04-19 +Commit: GitHub +CommitDate: 2025-04-19 + + Update CMakeLists.txt to fix the error of check_symbol_exists() when static-link openssl. + +commit 4408e6905274dc13131b67fdc6511193bf3ebf62 +Merge: 8e09f33f 4439eaa0 +Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com> +AuthorDate: 2025-04-18 +Commit: GitHub +CommitDate: 2025-04-18 + + Merge pull request #1623 from ngtcp2/update-doc + + Update doc + +commit 4439eaa08263a334968993649d2f42cb79f74d1a +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-18 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-18 + + Fix picotls crypto helper doc + +commit 4b6e1c3f9db8817d4250d7a22b7795a4c173dff1 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-18 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-18 + + Update packet padding flag docs + +commit 8e09f33ff0c53cf149607d177006e11b2bfbe0c0 +Author: Tatsuhiro Tsujikawa +AuthorDate: 2025-04-16 +Commit: Tatsuhiro Tsujikawa +CommitDate: 2025-04-16 + + Bump package version diff --git a/curl/dep/ngtcp2/README.rst b/curl/dep/ngtcp2/README.rst new file mode 100644 index 0000000..7ec1e9d --- /dev/null +++ b/curl/dep/ngtcp2/README.rst @@ -0,0 +1,379 @@ +ngtcp2 +====== + +"Call it TCP/2. One More Time." + +ngtcp2 project is an effort to implement `RFC9000 +`_ QUIC protocol. + +Documentation +------------- + +`Online documentation `_ is available. + +Public test server +------------------ + +The following endpoints are available to try out ngtcp2 +implementation: + +- https://nghttp2.org:4433 +- https://nghttp2.org:4434 (requires address validation token) +- https://nghttp2.org (powered by `nghttpx + `_) + + This endpoints sends Alt-Svc header field to clients if it is + accessed via HTTP/1.1 or HTTP/2 to tell them that HTTP/3 is + available at UDP 443. + +Requirements +------------ + +The libngtcp2 C library itself does not depend on any external +libraries. The example client, and server are written in C++20, and +should compile with the modern C++ compilers (e.g., clang >= 11.0, or +gcc >= 11.0). + +The following packages are required to configure the build system: + +- pkg-config >= 0.20 +- autoconf +- automake +- autotools-dev +- libtool + +To build sources under the examples directory, libev and nghttp3 are +required: + +- libev +- `nghttp3 `_ for HTTP/3 + +To enable `TLS Certificate Compression +`_ in bsslclient and +bsslserver (BoringSSL (aws-lc) examples client and server), the +following library is required: + +- libbrotli-dev >= 1.0.9 + +ngtcp2 crypto helper library, and client and server under examples +directory require at least one of the following TLS backends: + +- `quictls + `_ +- GnuTLS >= 3.7.5 +- BoringSSL (commit 9295969e1dad2c31d0d99481734c1c68dcbc6403); + or aws-lc >= 1.39.0 +- Picotls (commit bbcdbe6dc31ec5d4b72a7beece4daf58098bad42) +- wolfSSL >= 5.5.0 +- LibreSSL >= v3.9.2 +- OpenSSL >= 3.5.0 (experimental) + +Before building from git +------------------------ + +When build from git, run the following command to pull submodules: + +.. code-block:: shell + + $ git submodule update --init + +Build with wolfSSL +------------------ + +.. code-block:: shell + + $ git clone --depth 1 -b v5.8.0-stable https://github.com/wolfSSL/wolfssl + $ cd wolfssl + $ autoreconf -i + $ # For wolfSSL < v5.6.6, append --enable-quic. + $ ./configure --prefix=$PWD/build \ + --enable-all --enable-aesni --enable-harden --enable-keylog-export \ + --disable-ech + $ make -j$(nproc) + $ make install + $ cd .. + $ git clone --recursive https://github.com/ngtcp2/nghttp3 + $ cd nghttp3 + $ autoreconf -i + $ ./configure --prefix=$PWD/build --enable-lib-only + $ make -j$(nproc) check + $ make install + $ cd .. + $ git clone --recursive https://github.com/ngtcp2/ngtcp2 + $ cd ngtcp2 + $ autoreconf -i + $ # For Mac users who have installed libev with MacPorts, append + $ # LIBEV_CFLAGS="-I/opt/local/include" LIBEV_LIBS="-L/opt/local/lib -lev" + $ ./configure PKG_CONFIG_PATH=$PWD/../wolfssl/build/lib/pkgconfig:$PWD/../nghttp3/build/lib/pkgconfig \ + --with-wolfssl + $ make -j$(nproc) check + +Build with BoringSSL +-------------------- + +.. code-block:: shell + + $ git clone https://boringssl.googlesource.com/boringssl + $ cd boringssl + $ git checkout 9295969e1dad2c31d0d99481734c1c68dcbc6403 + $ cmake -B build -DCMAKE_POSITION_INDEPENDENT_CODE=ON + $ make -j$(nproc) -C build + $ cd .. + $ git clone --recursive https://github.com/ngtcp2/nghttp3 + $ cd nghttp3 + $ autoreconf -i + $ ./configure --prefix=$PWD/build --enable-lib-only + $ make -j$(nproc) check + $ make install + $ cd .. + $ git clone --recursive https://github.com/ngtcp2/ngtcp2 + $ cd ngtcp2 + $ autoreconf -i + $ # For Mac users who have installed libev with MacPorts, append + $ # LIBEV_CFLAGS="-I/opt/local/include" LIBEV_LIBS="-L/opt/local/lib -lev" + $ ./configure PKG_CONFIG_PATH=$PWD/../nghttp3/build/lib/pkgconfig \ + BORINGSSL_LIBS="-L$PWD/../boringssl/build -lssl -lcrypto" \ + BORINGSSL_CFLAGS="-I$PWD/../boringssl/include" \ + --with-boringssl + $ make -j$(nproc) check + +Build with aws-lc +----------------- + +.. code-block:: shell + + $ git clone --depth 1 -b v1.52.0 https://github.com/aws/aws-lc + $ cd aws-lc + $ cmake -B build -DDISABLE_GO=ON + $ make -j$(nproc) -C build + $ cd .. + $ git clone --recursive https://github.com/ngtcp2/nghttp3 + $ cd nghttp3 + $ autoreconf -i + $ ./configure --prefix=$PWD/build --enable-lib-only + $ make -j$(nproc) check + $ make install + $ cd .. + $ git clone --recursive https://github.com/ngtcp2/ngtcp2 + $ cd ngtcp2 + $ autoreconf -i + $ # For Mac users who have installed libev with MacPorts, append + $ # LIBEV_CFLAGS="-I/opt/local/include" LIBEV_LIBS="-L/opt/local/lib -lev" + $ ./configure PKG_CONFIG_PATH=$PWD/../nghttp3/build/lib/pkgconfig \ + BORINGSSL_CFLAGS="-I$PWD/../aws-lc/include" \ + BORINGSSL_LIBS="-L$PWD/../aws-lc/build/ssl -lssl -L$PWD/../aws-lc/build/crypto -lcrypto" \ + --with-boringssl + $ make -j$(nproc) check + +Build with libressl +----------------- + +.. code-block:: shell + + $ git clone --depth 1 -b v4.1.0 https://github.com/libressl/portable.git libressl + $ cd libressl + $ # Workaround autogen.sh failure + $ export LIBRESSL_GIT_OPTIONS="-b libressl-v4.1.0" + $ ./autogen.sh + $ ./configure --prefix=$PWD/build + $ make -j$(nproc) install + $ cd .. + $ git clone --recursive https://github.com/ngtcp2/nghttp3 + $ cd nghttp3 + $ autoreconf -i + $ ./configure --prefix=$PWD/build --enable-lib-only + $ make -j$(nproc) check + $ make install + $ cd .. + $ git clone --recursive https://github.com/ngtcp2/ngtcp2 + $ cd ngtcp2 + $ autoreconf -i + $ # For Mac users who have installed libev with MacPorts, append + $ # LIBEV_CFLAGS="-I/opt/homebrew/Cellar/libev/4.33/include" LIBEV_LIBS="-L/opt/homebrew/Cellar/libev/4.33/lib -lev" + $ ./configure PKG_CONFIG_PATH=$PWD/../nghttp3/build/lib/pkgconfig:$PWD/../libressl/build/lib/pkgconfig + $ make -j$(nproc) check + +Client/Server +------------- + +After successful build, the client and server executable should be +found under examples directory. They talk HTTP/3. + +Client +~~~~~~ + +.. code-block:: shell + + $ examples/wsslclient [OPTIONS] [...] + +The notable options are: + +- ``-d``, ``--data=``: Read data from and send it to a + peer. + +Server +~~~~~~ + +.. code-block:: shell + + $ examples/wsslserver [OPTIONS] + +The notable options are: + +- ``-V``, ``--validate-addr``: Enforce stateless address validation. + +H09wsslclient/H09wsslserver +--------------------------- + +There are h09wsslclient and h09wsslserver which speak HTTP/0.9. They +are written just for `quic-interop-runner +`_. They share +the basic functionalities with HTTP/3 client and server but have less +functions (e.g., h09wsslclient does not have a capability to send +request body, and h09wsslserver does not understand numeric request +path, like /1000). + +Resumption and 0-RTT +-------------------- + +In order to resume a session, a session ticket, and a transport +parameters must be fetched from server. First, run +examples/wsslclient with --session-file, and --tp-file options which +specify a path to session ticket, and transport parameter files +respectively to save them locally. + +Once these files are available, run examples/wsslclient with the same +arguments again. You will see that session is resumed in your log if +resumption succeeds. Resuming session makes server's first Handshake +packet pretty small because it does not send its certificates. + +To send 0-RTT data, after making sure that resumption works, use -d +option to specify a file which contains data to send. + +Token (Not something included in Retry packet) +---------------------------------------------- + +QUIC server might send a token to client after connection has been +established. Client can send this token in subsequent connection to +the server. Server verifies the token and if it succeeds, the address +validation completes and lifts some restrictions on server which might +speed up transfer. In order to save and/or load a token, +use --token-file option of examples/wsslclient. The given file is +overwritten if it already exists when storing a token. + +Crypto helper library +--------------------- + +In order to make TLS stack integration less painful, we provide a +crypto helper library which offers the basic crypto operations. + +The header file exists under crypto/includes/ngtcp2 directory. + +Each library file is built for a particular TLS backend. The +available crypto helper libraries are: + +- libngtcp2_crypto_quictls: Use quictls and libressl as TLS backend +- libngtcp2_crypto_gnutls: Use GnuTLS as TLS backend +- libngtcp2_crypto_boringssl: Use BoringSSL and aws-lc as TLS backend +- libngtcp2_crypto_picotls: Use Picotls as TLS backend +- libngtcp2_crypto_wolfssl: Use wolfSSL as TLS backend +- libngtcp2_crypto_ossl: Use OpenSSL as TLS backend (experimental) + +Because BoringSSL and Picotls are an unversioned product, we only +tested their particular revision. See Requirements section above. + +We use Picotls with OpenSSL as crypto backend. + +libngtcp2_crypto_ossl has some restrictions for its use because +OpenSSL QUIC TLS API requires us to keep crypto data in tact until it +says that they are no longer used. It also requires us to keep +transport parameter buffer. This extra book keeping is just done for +a couple of TLS messages exchanged during handshake and a couple of +session tickets after handshake. If you absolutely need to use +OpenSSL backend, your application must make sure that: + +- Keep `ngtcp2_conn` alive until ``SSL`` object is freed by + ``SSL_free``; or +- Call ``SSL_set_app_data(ssl, NULL)`` before calling ``SSL_free`` + +If you cannot make sure neither of them, it is a good time to migrate +your application to the other alternative (e.g., wolfSSL, aws-lc). + +libngtcp2_crypto_quictls and libngtcp2_crypto_ossl cannot be built at +the same time. + +The examples directory contains client and server that are linked to +those crypto helper libraries and TLS backends. They are only built +if their corresponding crypto helper library is built: + +- qtlsclient: quictls(libressl) client +- qtlsserver: quictls(libressl) server +- gtlsclient: GnuTLS client +- gtlsserver: GnuTLS server +- bsslclient: BoringSSL(aws-lc) client +- bsslserver: BoringSSL(aws-lc) server +- ptlsclient: Picotls client +- ptlsserver: Picotls server +- wsslclient: wolfSSL client +- wsslserver: wolfSSL server +- osslclient: OpenSSL client +- osslserver: OpenSSL server + +QUIC protocol extensions +------------------------- + +The library implements the following QUIC protocol extensions: + +- `An Unreliable Datagram Extension to QUIC + `_ +- `Greasing the QUIC Bit + `_ +- `Compatible Version Negotiation for QUIC + `_ +- `QUIC Version 2 + `_ + +Configuring Wireshark for QUIC +------------------------------ + +`Wireshark `_ can be configured to +analyze QUIC traffic using the following steps: + +1. Set *SSLKEYLOGFILE* environment variable: + + .. code-block:: shell + + $ export SSLKEYLOGFILE=quic_keylog_file + +2. Set the port that QUIC uses + + Go to *Preferences->Protocols->QUIC* and set the port the program + listens to. In the case of the example application this would be + the port specified on the command line. + +3. Set Pre-Master-Secret logfile + + Go to *Preferences->Protocols->TLS* and set the *Pre-Master-Secret + log file* to the same value that was specified for *SSLKEYLOGFILE*. + +4. Choose the correct network interface for capturing + + Make sure you choose the correct network interface for + capturing. For example, if using localhost choose the *loopback* + network interface on macos. + +5. Create a filter + + Create A filter for the udp.port and set the port to the port the + application is listening to. For example: + + .. code-block:: text + + udp.port == 7777 + +License +------- + +The MIT License + +Copyright (c) 2016 ngtcp2 contributors diff --git a/curl/dep/zlibng/LICENSE.md b/curl/dep/zlibng/LICENSE.md new file mode 100644 index 0000000..e866d7a --- /dev/null +++ b/curl/dep/zlibng/LICENSE.md @@ -0,0 +1,19 @@ +(C) 1995-2024 Jean-loup Gailly and Mark Adler + +This software is provided 'as-is', without any express or implied +warranty. In no event will the authors be held liable for any damages +arising from the use of this software. + +Permission is granted to anyone to use this software for any purpose, +including commercial applications, and to alter it and redistribute it +freely, subject to the following restrictions: + +1. The origin of this software must not be misrepresented; you must not + claim that you wrote the original software. If you use this software + in a product, an acknowledgment in the product documentation would be + appreciated but is not required. + +2. Altered source versions must be plainly marked as such, and must not be + misrepresented as being the original software. + +3. This notice may not be removed or altered from any source distribution. diff --git a/curl/dep/zlibng/README.md b/curl/dep/zlibng/README.md new file mode 100644 index 0000000..28aad7f --- /dev/null +++ b/curl/dep/zlibng/README.md @@ -0,0 +1,228 @@ +| CI | Stable | Develop | +|:---|:-------|:--------| +| GitHub Actions | [![Stable CMake](https://github.com/zlib-ng/zlib-ng/actions/workflows/cmake.yml/badge.svg?branch=stable)](https://github.com/zlib-ng/zlib-ng/actions/workflows/cmake.yml?query=branch%3Astable)
[![Stable Configure](https://github.com/zlib-ng/zlib-ng/actions/workflows/configure.yml/badge.svg?branch=stable)](https://github.com/zlib-ng/zlib-ng/actions/workflows/configure.yml?query=branch%3Astable)
[![Stable NMake](https://github.com/zlib-ng/zlib-ng/actions/workflows/nmake.yml/badge.svg?branch=stable)](https://github.com/zlib-ng/zlib-ng/actions/workflows/nmake.yml?query=branch%3Astable) | [![Develop CMake](https://github.com/zlib-ng/zlib-ng/actions/workflows/cmake.yml/badge.svg?branch=develop)](https://github.com/zlib-ng/zlib-ng/actions/workflows/cmake.yml?query=branch%3Adevelop)
[![Develop Configure](https://github.com/zlib-ng/zlib-ng/actions/workflows/configure.yml/badge.svg?branch=develop)](https://github.com/zlib-ng/zlib-ng/actions/workflows/configure.yml?query=branch%3Adevelop)
[![Develop NMake](https://github.com/zlib-ng/zlib-ng/actions/workflows/nmake.yml/badge.svg?branch=develop)](https://github.com/zlib-ng/zlib-ng/actions/workflows/nmake.yml?query=branch%3Adevelop) | +| CodeFactor | [![CodeFactor](https://www.codefactor.io/repository/github/zlib-ng/zlib-ng/badge/stable)](https://www.codefactor.io/repository/github/zlib-ng/zlib-ng/overview/stable) | [![CodeFactor](https://www.codefactor.io/repository/github/zlib-ng/zlib-ng/badge/develop)](https://www.codefactor.io/repository/github/zlib-ng/zlib-ng/overview/develop) | +| OSS-Fuzz | [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/zlib-ng.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:zlib-ng) | [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/zlib-ng.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:zlib-ng) | +| Codecov | [![codecov](https://codecov.io/github/zlib-ng/zlib-ng/branch/stable/graph/badge.svg?token=uKsgK9LIuC)](https://codecov.io/github/zlib-ng/zlib-ng/tree/stable) | [![codecov](https://codecov.io/github/zlib-ng/zlib-ng/branch/develop/graph/badge.svg?token=uKsgK9LIuC)](https://codecov.io/github/zlib-ng/zlib-ng/tree/develop) | + +## zlib-ng +*zlib data compression library for the next generation systems* + +Maintained by Hans Kristian Rosbach + aka Dead2 (zlib-ng àt circlestorm dót org) + +Features +-------- + +* Zlib compatible API with support for dual-linking +* Modernized native API based on zlib API for ease of porting +* Modern C11 syntax and a clean code layout +* Deflate medium and quick algorithms based on Intel’s zlib fork +* Support for CPU intrinsics when available + * Adler32 implementation using SSSE3, AVX2, AVX512, AVX512-VNNI, Neon, VMX & VSX + * CRC32-B implementation using PCLMULQDQ, VPCLMULQDQ, ACLE, & IBM Z + * Slide hash implementations using SSE2, AVX2, ARMv6, Neon, VMX & VSX + * Compare256 implementations using SSE2, AVX2, Neon, POWER9 & RVV + * Inflate chunk copying using SSE2, SSSE3, AVX, Neon & VSX + * Support for hardware-accelerated deflate using IBM Z DFLTCC +* Safe unaligned memory read/writes and large bit buffer improvements +* Includes improvements from Cloudflare and Intel forks +* Configure, CMake, and NMake build system support +* Comprehensive set of CMake unit tests +* Code sanitizers, fuzzing, and coverage +* GitHub Actions continuous integration on Windows, macOS, and Linux + * Emulated CI for ARM, AARCH64, PPC, PPC64, RISCV, SPARC64, S390x using qemu + + +History +------- + +The motivation for this fork was seeing several 3rd party contributions with new optimizations not getting +implemented into the official zlib repository. + +Mark Adler has been maintaining zlib for a very long time, and he has done a great job and hopefully he will continue +for a long time yet. The idea of zlib-ng is not to replace zlib, but to co-exist as a drop-in replacement with a +lower threshold for code change. + +zlib has a long history and is incredibly portable, even supporting many systems that predate the Internet.
+That is great, but it can complicate further development and maintainability. The zlib code contains many workarounds +for really old compilers or to accommodate systems with limitations such as operating in a 16-bit environment. + +Many of these workarounds are only maintenance burdens, some of them are pretty huge code-wise. With many workarounds +cluttered throughout the code, it makes it harder for new programmers with an idea/interest for zlib to contribute. + +I decided to make a fork, merge all the Intel optimizations, some of the Cloudflare optimizations, plus a couple other +smaller patches. Then started cleaning out workarounds, various dead code, all contrib and example code.
+The result is a better performing and easier to maintain zlib-ng. + +A lot of improvements have gone into zlib-ng since its start, and numerous people and companies have contributed both +small and big improvements, or valuable testing. + + +Build +----- +Please read LICENSE.md, it is very simple and very liberal. + +There are two ways to build zlib-ng: + +### Cmake + +To build zlib-ng using the cross-platform makefile generator cmake. + +``` +cmake . +cmake --build . --config Release +ctest --verbose -C Release +``` + +Alternatively, you can use the cmake configuration GUI tool ccmake: + +``` +ccmake . +``` + +### Configure + +To build zlib-ng using the bash configure script: + +``` +./configure +make +make test +``` + +Build Options +------------- + +| CMake | configure | Description | Default | +|:---------------------------|:-------------------------|:------------------------------------------------------------------------------------|---------| +| ZLIB_COMPAT | --zlib-compat | Compile with zlib compatible API | OFF | +| ZLIB_ENABLE_TESTS | | Build test binaries | ON | +| WITH_GZFILEOP | --without-gzfileops | Compile with support for gzFile related functions | ON | +| WITH_OPTIM | --without-optimizations | Build with optimisations | ON | +| WITH_NEW_STRATEGIES | --without-new-strategies | Use new strategies | ON | +| WITH_NATIVE_INSTRUCTIONS | | Compiles with full instruction set supported on this host (gcc/clang -march=native) | OFF | +| WITH_RUNTIME_CPU_DETECTION | | Compiles with runtime CPU detection | ON | +| WITH_SANITIZER | | Build with sanitizer (memory, address, undefined) | OFF | +| WITH_GTEST | | Build gtest_zlib | ON | +| WITH_FUZZERS | | Build test/fuzz | OFF | +| WITH_BENCHMARKS | | Build test/benchmarks | OFF | +| WITH_MAINTAINER_WARNINGS | | Build with project maintainer warnings | OFF | +| WITH_CODE_COVERAGE | | Enable code coverage reporting | OFF | + + +Install +------- + +WARNING: We do not recommend manually installing unless you really know what you are doing, because this can +potentially override the system default zlib library, and any incompatibility or wrong configuration of zlib-ng +can make the whole system unusable, requiring recovery or reinstall. +If you still want a manual install, we recommend using the /opt/ path prefix. + +For Linux distros, an alternative way to use zlib-ng (if compiled in zlib-compat mode) instead of zlib, is through +the use of the _LD_PRELOAD_ environment variable. If the program is dynamically linked with zlib, then the program +will temporarily attempt to use zlib-ng instead, without risking system-wide instability. + +``` +LD_PRELOAD=/opt/zlib-ng/libz.so.1.2.13.zlib-ng /usr/bin/program +``` + +### Cmake + +To install zlib-ng system-wide using cmake: + +```sh or powershell +cmake --build . --target install +``` + +### Configure + +To install zlib-ng system-wide using the configure script: + +```sh +make install +``` + +### CPack + +After building with cmake, an installation package can be created using cpack. By default a tgz package is created, +but you can append `-G ` to each command to generate alternative packages types (TGZ, ZIP, RPM, DEB). To easily +create a rpm or deb package, you would use `-G RPM` or `-G DEB` respectively. + +```sh or powershell +cd build +cpack --config CPackConfig.cmake +cpack --config CPackSourceConfig.cmake +``` + +### Vcpkg + +Alternatively, you can build and install zlib-ng using the [vcpkg](https://github.com/Microsoft/vcpkg/) dependency manager: + +```sh or powershell +git clone https://github.com/Microsoft/vcpkg.git +cd vcpkg +./bootstrap-vcpkg.sh # "./bootstrap-vcpkg.bat" for powershell +./vcpkg integrate install +./vcpkg install zlib-ng +``` + +The zlib-ng port in vcpkg is kept up to date by Microsoft team members and community contributors. +If the version is out of date, please [create an issue or pull request](https://github.com/Microsoft/vcpkg) on the vcpkg repository. + +Contributing +------------ + +Zlib-ng is aiming to be open to contributions, and we would be delighted to receive pull requests on github. +Help with testing and reviewing pull requests etc is also very much appreciated. + +Please check the Wiki for more info: [Contributing](https://github.com/zlib-ng/zlib-ng/wiki/Contributing) + +Acknowledgments +---------------- + +Thanks go out to all the people and companies who have taken the time to contribute +code reviews, testing and/or patches. Zlib-ng would not have been nearly as good without you. + +The deflate format used by zlib was defined by Phil Katz.
+The deflate and zlib specifications were written by L. Peter Deutsch. + +zlib was originally created by Jean-loup Gailly (compression) and Mark Adler (decompression). + + +Advanced Build Options +---------------------- + +| CMake | configure | Description | Default | +|:--------------------------------|:----------------------|:--------------------------------------------------------------------|------------------------| +| FORCE_SSE2 | --force-sse2 | Skip runtime check for SSE2 instructions (Always on for x86_64) | OFF (x86) | +| WITH_AVX2 | | Build with AVX2 intrinsics | ON | +| WITH_AVX512 | | Build with AVX512 intrinsics | ON | +| WITH_AVX512VNNI | | Build with AVX512VNNI intrinsics | ON | +| WITH_SSE2 | | Build with SSE2 intrinsics | ON | +| WITH_SSSE3 | | Build with SSSE3 intrinsics | ON | +| WITH_SSE42 | | Build with SSE42 intrinsics | ON | +| WITH_PCLMULQDQ | | Build with PCLMULQDQ intrinsics | ON | +| WITH_VPCLMULQDQ | --without-vpclmulqdq | Build with VPCLMULQDQ intrinsics | ON | +| WITH_ACLE | --without-acle | Build with ACLE intrinsics | ON | +| WITH_NEON | --without-neon | Build with NEON intrinsics | ON | +| WITH_ARMV6 | --without-armv6 | Build with ARMv6 intrinsics | ON | +| WITH_ALTIVEC | --without-altivec | Build with AltiVec (VMX) intrinsics | ON | +| WITH_POWER8 | --without-power8 | Build with POWER8 optimisations | ON | +| WITH_RVV | | Build with RVV intrinsics | ON | +| WITH_CRC32_VX | --without-crc32-vx | Build with vectorized CRC32 on IBM Z | ON | +| WITH_DFLTCC_DEFLATE | --with-dfltcc-deflate | Build with DFLTCC intrinsics for compression on IBM Z | OFF | +| WITH_DFLTCC_INFLATE | --with-dfltcc-inflate | Build with DFLTCC intrinsics for decompression on IBM Z | OFF | +| WITH_INFLATE_STRICT | | Build with strict inflate distance checking | OFF | +| WITH_INFLATE_ALLOW_INVALID_DIST | | Build with zero fill for inflate invalid distances | OFF | +| INSTALL_UTILS | | Copy minigzip and minideflate during install | OFF | +| ZLIBNG_ENABLE_TESTS | | Test zlib-ng specific API | ON | + + +Related Projects +---------------- + +* Fork of the popular minizip https://github.com/zlib-ng/minizip-ng +* Python tool to benchmark minigzip/minideflate https://github.com/zlib-ng/deflatebench +* Python tool to benchmark pigz https://github.com/zlib-ng/pigzbench +* 3rd party patches for zlib-ng compatibility https://github.com/zlib-ng/patches diff --git a/curl/dep/zstd/CHANGELOG.txt b/curl/dep/zstd/CHANGELOG.txt new file mode 100644 index 0000000..92df0f4 --- /dev/null +++ b/curl/dep/zstd/CHANGELOG.txt @@ -0,0 +1,863 @@ +V1.5.7 (Feb 2025) +fix: compression bug in 32-bit mode associated with long-lasting sessions +api: new method `ZSTD_compressSequencesAndLiterals()` (#4217, #4232) +api: `ZSTD_getFrameHeader()` works on skippable frames (#4228) +perf: substantial compression speed improvements (up to +30%) on small data, by @TocarIP (#4144) and @cyan4973 (#4165) +perf: improved compression speed (~+5%) for dictionary compression at low levels (#4170) +perf: much faster speed for `--patch-from` at high compression levels (#4276) +perf: higher `--patch-from` compression ratios, notably at high levels (#4288) +perf: better speed for binaries on Windows (@pps83) and when compiled with Visual Studio (@MessyHack) +perf: slight compression ratio improvement thanks to better block boundaries (#4136, #4176, #4178) +perf: slight compression ratio improvement for `dfast`, aka levels 3 and 4 (#4171) +perf: runtime bmi2 detection enabled on x86 32-bit mode (#4251) +cli: multi-threading as default CLI setting, by @daniellerozenblit +cli: new `--max` command (#4290) +build: improve `msbuild` version autodetection, support VS2022, by @ManuelBlanc +build: fix `meson` build by @artem and @Victor-C-Zhang, and on Windows by @bgilbert +build: compatibility with Apple Framework, by @Treata11 +build: improve icc/icx compatibility, by @josepho0918 and @luau-project +build: improve compatibility with Android NDK, by Adenilson Cavalcanti +portability: linux kernel branch, with improved support for Sequence producers (@embg, @gcabiddu, @cyan4973) +portability: improved qnx compatibility, suggested by @rainbowball +portability: improved install script for FreeBSD, by @sunpoet +portability: fixed test suite compatibility with gnu hurd, by @diegonc +doc: clarify specification, by @elasota +misc: improved tests/decodecorpus validation tool (#4102), by antmicro + +V1.5.6 (Mar 2024) +api: Promote `ZSTD_c_targetCBlockSize` to Stable API by @felixhandte +api: new `ZSTD_d_maxBlockSize` experimental parameter, to reduce streaming decompression memory, by @terrelln +perf: improve performance of param `ZSTD_c_targetCBlockSize`, by @Cyan4973 +perf: improved compression of arrays of integers at high compression, by @Cyan4973 +lib: reduce binary size with selective build-time exclusion, by @felixhandte +lib: improved huffman speed on small data and linux kernel, by @terrelln +lib: accept dictionaries with partial literal tables, by @terrelln +lib: fix CCtx size estimation with external sequence producer, by @embg +lib: fix corner case decoder behaviors, by @Cyan4973 and @aimuz +lib: fix zdict prototype mismatch in static_only mode, by @ldv-alt +lib: fix several bugs in magicless-format decoding, by @embg +cli: add common compressed file types to `--exclude-compressed`` by @daniellerozenblit +cli: fix mixing `-c` and `-o` commands with `--rm`, by @Cyan4973 +cli: fix erroneous exclusion of hidden files with `--output-dir-mirror` by @felixhandte +cli: improved time accuracy on BSD, by @felixhandte +cli: better errors on argument parsing, by @KapJI +tests: better compatibility with older versions of `grep`, by @Cyan4973 +tests: lorem ipsum generator as default backup content, by @Cyan4973 +build: cmake improvements by @terrelln, @sighingnow, @gjasny, @JohanMabille, @Saverio976, @gruenich, @teo-tsirpanis +build: bazel support, by @jondo2010 +build: fix cross-compiling for AArch64 with lld by @jcelerier +build: fix Apple platform compatibility, by @nidhijaju +build: fix Visual 2012 and lower compatibility, by @Cyan4973 +build: improve win32 support, by @DimitriPapadopoulos +build: better C90 compliance for zlibWrapper, by @emaste +port: make: fat binaries on macos, by @mredig +port: ARM64EC compatibility for Windows, by @dunhor +port: QNX support by @klausholstjacobsen +port: MSYS2 and Cygwin makefile installation and test support, by @QBos07 +port: risc-v support validation in CI, by @Cyan4973 +port: sparc64 support validation in CI, by @Cyan4973 +port: AIX compatibility, by @likema +port: HP-UX compatibility, by @likema +doc: Improved specification accuracy, by @elasota +bug: Fix and deprecate ZSTD_generateSequences (#3981) + +v1.5.5 (Apr 2023) +fix: fix rare corruption bug affecting the high compression mode, reported by @danlark1 (#3517, @terrelln) +perf: improve mid-level compression speed (#3529, #3533, #3543, @yoniko and #3552, @terrelln) +lib: deprecated bufferless block-level API (#3534) by @terrelln +cli: mmap large dictionaries to save memory, by @daniellerozenblit +cli: improve speed of --patch-from mode (~+50%) (#3545) by @daniellerozenblit +cli: improve i/o speed (~+10%) when processing lots of small files (#3479) by @felixhandte +cli: zstd no longer crashes when requested to write into write-protected directory (#3541) by @felixhandte +cli: fix decompression into block device using -o, reported by @georgmu (#3583) +build: fix zstd CLI compiled with lzma support but not zlib support (#3494) by @Hello71 +build: fix cmake does no longer require 3.18 as minimum version (#3510) by @kou +build: fix MSVC+ClangCL linking issue (#3569) by @tru +build: fix zstd-dll, version of zstd CLI that links to the dynamic library (#3496) by @yoniko +build: fix MSVC warnings (#3495) by @embg +doc: updated zstd specification to clarify corner cases, by @Cyan4973 +doc: document how to create fat binaries for macos (#3568) by @rickmark +misc: improve seekable format ingestion speed (~+100%) for very small chunk sizes (#3544) by @Cyan4973 +misc: tests/fullbench can benchmark multiple files (#3516) by @dloidolt + +v1.5.4 (Feb 2023) +perf: +20% faster huffman decompression for targets that can't compile x64 assembly (#3449, @terrelln) +perf: up to +10% faster streaming compression at levels 1-2 (#3114, @embg) +perf: +4-13% for levels 5-12 by optimizing function generation (#3295, @terrelln) +pref: +3-11% compression speed for `arm` target (#3199, #3164, #3145, #3141, #3138, @JunHe77 and #3139, #3160, @danlark1) +perf: +5-30% faster dictionary compression at levels 1-4 (#3086, #3114, #3152, @embg) +perf: +10-20% cold dict compression speed by prefetching CDict tables (#3177, @embg) +perf: +1% faster compression by removing a branch in ZSTD_fast_noDict (#3129, @felixhandte) +perf: Small compression ratio improvements in high compression mode (#2983, #3391, @Cyan4973 and #3285, #3302, @daniellerozenblit) +perf: small speed improvement by better detecting `STATIC_BMI2` for `clang` (#3080, @TocarIP) +perf: Improved streaming performance when `ZSTD_c_stableInBuffer` is set (#2974, @Cyan4973) +cli: Asynchronous I/O for improved cli speed (#2975, #2985, #3021, #3022, @yoniko) +cli: Change `zstdless` behavior to align with `zless` (#2909, @binhdvo) +cli: Keep original file if `-c` or `--stdout` is given (#3052, @dirkmueller) +cli: Keep original files when result is concatenated into a single output with `-o` (#3450, @Cyan4973) +cli: Preserve Permissions and Ownership of regular files (#3432, @felixhandte) +cli: Print zlib/lz4/lzma library versions with `-vv` (#3030, @terrelln) +cli: Print checksum value for single frame files with `-lv` (#3332, @Cyan4973) +cli: Print `dictID` when present with `-lv` (#3184, @htnhan) +cli: when `stderr` is *not* the console, disable status updates, but preserve final summary (#3458, @Cyan4973) +cli: support `--best` and `--no-name` in `gzip` compatibility mode (#3059, @dirkmueller) +cli: support for `posix` high resolution timer `clock_gettime()`, for improved benchmark accuracy (#3423, @Cyan4973) +cli: improved help/usage (`-h`, `-H`) formatting (#3094, @dirkmueller and #3385, @jonpalmisc) +cli: Fix better handling of bogus numeric values (#3268, @ctkhanhly) +cli: Fix input consists of multiple files _and_ `stdin` (#3222, @yoniko) +cli: Fix tiny files passthrough (#3215, @cgbur) +cli: Fix for `-r` on empty directory (#3027, @brailovich) +cli: Fix empty string as argument for `--output-dir-*` (#3220, @embg) +cli: Fix decompression memory usage reported by `-vv --long` (#3042, @u1f35c, and #3232, @zengyijing) +cli: Fix infinite loop when empty input is passed to trainer (#3081, @terrelln) +cli: Fix `--adapt` doesn't work when `--no-progress` is also set (#3354, @terrelln) +api: Support for Block-Level Sequence Producer (#3333, @embg) +api: Support for in-place decompression (#3432, @terrelln) +api: New `ZSTD_CCtx_setCParams()` function, set all parameters defined in a `ZSTD_compressionParameters` structure (#3403, @Cyan4973) +api: Streaming decompression detects incorrect header ID sooner (#3175, @Cyan4973) +api: Window size resizing optimization for edge case (#3345, @daniellerozenblit) +api: More accurate error codes for busy-loop scenarios (#3413, #3455, @Cyan4973) +api: Fix limit overflow in `compressBound` and `decompressBound` (#3362, #3373, Cyan4973) reported by @nigeltao +api: Deprecate several advanced experimental functions: streaming (#3408, @embg), copy (#3196, @mileshu) +bug: Fix corruption that rarely occurs in 32-bit mode with wlog=25 (#3361, @terrelln) +bug: Fix for block-splitter (#3033, @Cyan4973) +bug: Fixes for Sequence Compression API (#3023, #3040, @Cyan4973) +bug: Fix leaking thread handles on Windows (#3147, @animalize) +bug: Fix timing issues with cmake/meson builds (#3166, #3167, #3170, @Cyan4973) +build: Allow user to select legacy level for cmake (#3050, @shadchin) +build: Enable legacy support by default in cmake (#3079, @niamster) +build: Meson build script improvements (#3039, #3120, #3122, #3327, #3357, @eli-schwartz and #3276, @neheb) +build: Add aarch64 to supported architectures for zstd_trace (#3054, @ooosssososos) +build: support AIX architecture (#3219, @qiongsiwu) +build: Fix `ZSTD_LIB_MINIFY` build macro, which now reduces static library size by half (#3366, @terrelln) +build: Fix Windows issues with Multithreading translation layer (#3364, #3380, @yoniko) and ARM64 target (#3320, @cwoffenden) +build: Fix `cmake` script (#3382, #3392, @terrelln and #3252 @Tachi107 and #3167 @Cyan4973) +doc: Updated man page, providing more details for `--train` mode (#3112, @Cyan4973) +doc: Add decompressor errata document (#3092, @terrelln) +misc: Enable Intel CET (#2992, #2994, @hjl-tools) +misc: Fix `contrib/` seekable format (#3058, @yhoogstrate and #3346, @daniellerozenblit) +misc: Improve speed of the one-file library generator (#3241, @wahern and #3005, @cwoffenden) + +v1.5.3 (dev version, unpublished) + +v1.5.2 (Jan, 2022) +perf: Regain Minimal memset()-ing During Reuse of Compression Contexts (@Cyan4973, #2969) +build: Build Zstd with `noexecstack` on All Architectures (@felixhandte, #2964) +doc: Clarify Licensing (@terrelln, #2981) + +v1.5.1 (Dec, 2021) +perf: rebalanced compression levels, to better match the intended speed/level curve, by @senhuang42 +perf: faster huffman decoder, using x64 assembly, by @terrelln +perf: slightly faster high speed modes (strategies fast & dfast), by @felixhandte +perf: improved binary size and faster compilation times, by @terrelln +perf: new row64 mode, used notably in level 12, by @senhuang42 +perf: faster mid-level compression speed in presence of highly repetitive patterns, by @senhuang42 +perf: minor compression ratio improvements for small data at high levels, by @cyan4973 +perf: reduced stack usage (mostly useful for Linux Kernel), by @terrelln +perf: faster compression speed on incompressible data, by @bindhvo +perf: on-demand reduced ZSTD_DCtx state size, using build macro ZSTD_DECODER_INTERNAL_BUFFER, at a small cost of performance, by @bindhvo +build: allows hiding static symbols in the dynamic library, using build macro, by @skitt +build: support for m68k (Motorola 68000's), by @cyan4973 +build: improved AIX support, by @Helflym +build: improved meson unofficial build, by @eli-schwartz +cli : custom memory limit when training dictionary (#2925), by @embg +cli : report advanced parameters information when compressing in very verbose mode (`-vv`), by @Svetlitski-FB + +v1.5.0 (May 11, 2021) +api: Various functions promoted from experimental to stable API: (#2579-2581, @senhuang42) + `ZSTD_defaultCLevel()` + `ZSTD_getDictID_fromCDict()` +api: Several experimental functions have been deprecated and will emit a compiler warning (#2582, @senhuang42) + `ZSTD_compress_advanced()` + `ZSTD_compress_usingCDict_advanced()` + `ZSTD_compressBegin_advanced()` + `ZSTD_compressBegin_usingCDict_advanced()` + `ZSTD_initCStream_srcSize()` + `ZSTD_initCStream_usingDict()` + `ZSTD_initCStream_usingCDict()` + `ZSTD_initCStream_advanced()` + `ZSTD_initCStream_usingCDict_advanced()` + `ZSTD_resetCStream()` +api: ZSTDMT_NBWORKERS_MAX reduced to 64 for 32-bit environments (@Cyan4973) +perf: Significant speed improvements for middle compression levels (#2494, @senhuang42 @terrelln) +perf: Block splitter to improve compression ratio, enabled by default for high compression levels (#2447, @senhuang42) +perf: Decompression loop refactor, speed improvements on `clang` and for `--long` modes (#2614 #2630, @Cyan4973) +perf: Reduced stack usage during compression and decompression entropy stage (#2522 #2524, @terrelln) +bug: Improve setting permissions of created files (#2525, @felixhandte) +bug: Fix large dictionary non-determinism (#2607, @terrelln) +bug: Fix non-determinism test failures on Linux i686 (#2606, @terrelln) +bug: Fix various dedicated dictionary search bugs (#2540 #2586, @senhuang42 @felixhandte) +bug: Ensure `ZSTD_estimateCCtxSize*() `monotonically increases with compression level (#2538, @senhuang42) +bug: Fix --patch-from mode parameter bound bug with small files (#2637, @occivink) +bug: Fix UBSAN error in decompression (#2625, @terrelln) +bug: Fix superblock compression divide by zero bug (#2592, @senhuang42) +bug: Make the number of physical CPU cores detection more robust (#2517, @PaulBone) +doc: Improve `zdict.h` dictionary training API documentation (#2622, @terrelln) +doc: Note that public `ZSTD_free*()` functions accept NULL pointers (#2521, @animalize) +doc: Add style guide docs for open source contributors (#2626, @Cyan4973) +tests: Better regression test coverage for different dictionary modes (#2559, @senhuang42) +tests: Better test coverage of index reduction (#2603, @terrelln) +tests: OSS-Fuzz coverage for seekable format (#2617, @senhuang42) +tests: Test coverage for ZSTD threadpool API (#2604, @senhuang42) +build: Dynamic library built multithreaded by default (#2584, @senhuang42) +build: Move `zstd_errors.h` and `zdict.h` to `lib/` root (#2597, @terrelln) +build: Allow `ZSTDMT_JOBSIZE_MIN` to be configured at compile-time, reduce default to 512KB (#2611, @Cyan4973) +build: Single file library build script moved to `build/` directory (#2618, @felixhandte) +build: `ZBUFF_*()` is no longer built by default (#2583, @senhuang42) +build: Fixed Meson build (#2548, @SupervisedThinking @kloczek) +build: Fix excessive compiler warnings with clang-cl and CMake (#2600, @nickhutchinson) +build: Detect presence of `md5` on Darwin (#2609, @felixhandte) +build: Avoid SIGBUS on armv6 (#2633, @bmwiedmann) +cli: `--progress` flag added to always display progress bar (#2595, @senhuang42) +cli: Allow reading from block devices with `--force` (#2613, @felixhandte) +cli: Fix CLI filesize display bug (#2550, @Cyan4973) +cli: Fix windows CLI `--filelist` end-of-line bug (#2620, @Cyan4973) +contrib: Various fixes for linux kernel patch (#2539, @terrelln) +contrib: Seekable format - Decompression hanging edge case fix (#2516, @senhuang42) +contrib: Seekable format - New seek table-only API (#2113 #2518, @mdittmer @Cyan4973) +contrib: Seekable format - Fix seek table descriptor check when loading (#2534, @foxeng) +contrib: Seekable format - Decompression fix for large offsets, (#2594, @azat) +misc: Automatically published release tarballs available on Github (#2535, @felixhandte) + +v1.4.9 (Mar 1, 2021) +bug: Use `umask()` to Constrain Created File Permissions (#2495, @felixhandte) +bug: Make Simple Single-Pass Functions Ignore Advanced Parameters (#2498, @terrelln) +api: Add (De)Compression Tracing Functionality (#2482, @terrelln) +api: Support References to Multiple DDicts (#2446, @senhuang42) +api: Add Function to Generate Skippable Frame (#2439, @senhuang42) +perf: New Algorithms for the Long Distance Matcher (#2483, @mpu) +perf: Performance Improvements for Long Distance Matcher (#2464, @mpu) +perf: Don't Shrink Window Log when Streaming with a Dictionary (#2451, @terrelln) +cli: Fix `--output-dir-mirror` rejection of `..` -containing paths (#2512, @felixhandte) +cli: Allow Input From Console When `-f`/`--force` is Passed (#2466, @felixhandte) +cli: Improve Help Message (#2500, @senhuang42) +tests: Remove Flaky Tests (#2455, #2486, #2445, @Cyan4973) +tests: Correctly Invoke md5 Utility on NetBSD (#2492, @niacat) +tests: Avoid Using `stat -c` on NetBSD (#2513, @felixhandte) +build: Zstd CLI Can Now be Linked to Dynamic `libzstd` (#2457, #2454 @Cyan4973) +build: Hide and Avoid Using Static-Only Symbols (#2501, #2504, @skitt) +build: CMake: Enable Only C for lib/ and programs/ Projects (#2498, @concatime) +build: CMake: Use `configure_file()` to Create the `.pc` File (#2462, @lazka) +build: Fix Fuzzer Compiler Detection & Update UBSAN Flags (#2503, @terrelln) +build: Add Guards for `_LARGEFILE_SOURCE` and `_LARGEFILE64_SOURCE` (#2444, @indygreg) +build: Improve `zlibwrapper` Makefile (#2437, @Cyan4973) +contrib: Add `recover_directory` Program (#2473, @terrelln) +doc: Change License Year to 2021 (#2452 & #2465, @terrelln & @senhuang42) +doc: Fix Typos (#2459, @ThomasWaldmann) + +v1.4.8 (Dec 18, 2020) +hotfix: wrong alignment of an internal buffer + +v1.4.7 (Dec 16, 2020) +perf: stronger --long mode at high compression levels, by @senhuang42 +perf: stronger --patch-from at high compression levels, thanks to --long improvements +perf: faster dictionary compression at medium compression levels, by @felixhandte +perf: small speed & memory usage improvements for ZSTD_compress2(), by @terrelln +perf: improved fast compression speeds with Visual Studio, by @animalize +cli : Set nb of threads with environment variable ZSTD_NBTHREADS, by @senhuang42 +cli : accept decompressing files with *.zstd suffix +cli : provide a condensed summary by default when processing multiple files +cli : fix : stdin input no longer confused as user prompt +cli : improve accuracy of several error messages +api : new sequence ingestion API, by @senhuang42 +api : shared thread pool: control total nb of threads used by multiple compression jobs, by @marxin +api : new ZSTD_getDictID_fromCDict(), by @LuAPi +api : zlibWrapper only uses public API, and is compatible with dynamic library, by @terrelln +api : fix : multithreaded compression has predictable output even in special cases (see #2327) (issue not accessible from cli) +api : fix : dictionary compression correctly respects dictionary compression level (see #2303) (issue not accessible from cli) +build: fix cmake script when using path with spaces, by @terrelln +build: improved compile-time detection of aarch64/neon platforms, by @bsdimp +build: Fix building on AIX 5.1, by @likema +build: compile paramgrill with cmake on Windows, requested by @mirh +doc : clarify repcode updates in format specification, by @felixhandte + +v1.4.6 +fix : Always return dstSize_tooSmall when that is the case +fix : Fix ZSTD_initCStream_advanced() with static allocation and no dictionary +perf: Improve small block decompression speed by 20%+, by @terrelln +perf: Reduce compression stack usage by 1 KB, by @terrelln +perf: Improve decompression speed by improving ZSTD_wildcopy, by @helloguo (#2252, #2256) +perf: Improve histogram construction, by @cyan4973 (#2253) +cli : Add --output-dir-mirror option, by @xxie24 (#2219) +cli : Warn when (de)compressing multiple files into a single output, by @senhuang42 (#2279) +cli : Improved progress bar and status summary when (de)compressing multiple files, by @senhuang42 (#2283) +cli : Call stat less often, by @felixhandte (#2262) +cli : Allow --patch-from XXX and --filelist XXX in addition to --patch-from=XXX and --filelist=XXX, by @cyan4973 (#2250) +cli : Allow --patch-from to compress stdin with --stream-size, by @bimbashrestha (#2206) +api : Do not install zbuff.h, since it has long been deprecated, by @cyan4973 (#2166). +api : Fix ZSTD_CCtx_setParameter() with ZSTD_c_compressionLevel to make 0 mean default level, by @i-do-cpp (#2291) +api : Rename ZSTDMT_NBTHREADS_MAX to ZSTDMT_NBWORKERS_MAX, by @marxin (#2228). +build: Install pkg-config file with CMake and MinGW, by @tonytheodore (#2183) +build: Install DLL with CMake on Windows, by @BioDataAnalysis (#2221) +build: Fix DLL install location with CMake, by @xantares and @bimbashrestha (#2186) +build: Add ZSTD_NO_UNUSED_FUNCTIONS macro to hide unused functions +build: Add ZSTD_NO_INTRINSICS macro to avoid explicit intrinsics +build: Add STATIC_BMI2 macro for compile time detection of BMI2 on MSVC, by @Niadb (#2258) +build: Fix -Wcomma warnings, by @cwoffenden +build: Remove distutils requirement for meson build, by @neheb (#2197) +build: Fix cli compilation with uclibc +build: Fix cli compilation without st_mtime, by @ffontaine (#2246) +build: Fix shadowing warnings in library +build: Fix single file library compilation with Enscripten, by @yoshihitoh (#2227) +misc: Improve single file library and include dictBuilder, by @cwoffenden +misc: Allow compression dictionaries with missing symbols +misc: Add freestanding translation script in contrib/freestanding_lib +misc: Collect all of zstd's libc dependencies into zstd_deps.h +doc : Add ZSTD_versionString() to manual, by @animalize +doc : Fix documentation for ZSTD_CCtxParams_setParameter(), by @felixhandte (#2270) + +v1.4.5 (May 22, 2020) +fix : Compression ratio regression on huge files (> 3 GB) using high levels (--ultra) and multithreading, by @terrelln +perf: Improved decompression speed: x64 : +10% (clang) / +5% (gcc); ARM : from +15% to +50%, depending on SoC, by @terrelln +perf: Automatically downsizes ZSTD_DCtx when too large for too long (#2069, by @bimbashreshta) +perf: Improved fast compression speed on aarch64 (#2040, ~+3%, by @caoyzh) +perf: Small level 1 compression speed gains (depending on compiler) +cli : New --patch-from command, create and apply patches from files, by @bimbashreshta +cli : New --filelist= : Provide a list of files to operate upon from a file +cli : -b -d command can now benchmark decompression on multiple files +cli : New --no-content-size command +cli : New --show-default-cparams information command +api : ZDICT_finalizeDictionary() is promoted to stable (#2111) +api : new experimental parameter ZSTD_d_stableOutBuffer (#2094) +build: Generate a single-file libzstd library (#2065, by @cwoffenden) +build: Relative includes no longer require -I compiler flags for zstd lib subdirs (#2103, by @felixhandte) +build: zstd now compiles cleanly under -pedantic (#2099) +build: zstd now compiles with make-4.3 +build: Support mingw cross-compilation from Linux, by @Ericson2314 +build: Meson multi-thread build fix on windows +build: Some misc icc fixes backed by new ci test on travis +misc: bitflip analyzer tool, by @felixhandte +misc: Extend largeNbDicts benchmark to compression +misc: Edit-distance match finder in contrib/ +doc : Improved beginner CONTRIBUTING.md docs +doc : New issue templates for zstd + +v1.4.4 (Nov 6, 2019) +perf: Improved decompression speed, by > 10%, by @terrelln +perf: Better compression speed when re-using a context, by @felixhandte +perf: Fix compression ratio when compressing large files with small dictionary, by @senhuang42 +perf: zstd reference encoder can generate RLE blocks, by @bimbashrestha +perf: minor generic speed optimization, by @davidbolvansky +api: new ability to extract sequences from the parser for analysis, by @bimbashrestha +api: fixed decoding of magic-less frames, by @terrelln +api: fixed ZSTD_initCStream_advanced() performance with fast modes, reported by @QrczakMK +cli: Named pipes support, by @bimbashrestha +cli: short tar's extension support, by @stokito +cli: command --output-dir-flat= , generates target files into requested directory, by @senhuang42 +cli: commands --stream-size=# and --size-hint=#, by @nmagerko +cli: command --exclude-compressed, by @shashank0791 +cli: faster `-t` test mode +cli: improved some error messages, by @vangyzen +cli: fix command `-D dictionary` on Windows, reported by @artyompetrov +cli: fix rare deadlock condition within dictionary builder, by @terrelln +build: single-file decoder with emscripten compilation script, by @cwoffenden +build: fixed zlibWrapper compilation on Visual Studio, reported by @bluenlive +build: fixed deprecation warning for certain gcc version, reported by @jasonma163 +build: fix compilation on old gcc versions, by @cemeyer +build: improved installation directories for cmake script, by Dmitri Shubin +pack: modified pkgconfig, for better integration into openwrt, requested by @neheb +misc: Improved documentation : ZSTD_CLEVEL, DYNAMIC_BMI2, ZSTD_CDict, function deprecation, zstd format +misc: fixed educational decoder : accept larger literals section, and removed UNALIGNED() macro + +v1.4.3 (Aug 20, 2019) +bug: Fix Dictionary Compression Ratio Regression by @cyan4973 (#1709) +bug: Fix Buffer Overflow in legacy v0.3 decompression by @felixhandte (#1722) +build: Add support for IAR C/C++ Compiler for Arm by @joseph0918 (#1705) + +v1.4.2 (Jul 26, 2019) +bug: Fix bug in zstd-0.5 decoder by @terrelln (#1696) +bug: Fix seekable decompression in-memory API by @iburinoc (#1695) +misc: Validate blocks are smaller than size limit by @vivekmg (#1685) +misc: Restructure source files by @ephiepark (#1679) + +v1.4.1 (Jul 20, 2019) +bug: Fix data corruption in niche use cases by @terrelln (#1659) +bug: Fuzz legacy modes, fix uncovered bugs by @terrelln (#1593, #1594, #1595) +bug: Fix out of bounds read by @terrelln (#1590) +perf: Improve decode speed by ~7% @mgrice (#1668) +perf: Slightly improved compression ratio of level 3 and 4 (ZSTD_dfast) by @cyan4973 (#1681) +perf: Slightly faster compression speed when re-using a context by @cyan4973 (#1658) +perf: Improve compression ratio for small windowLog by @cyan4973 (#1624) +perf: Faster compression speed in high compression mode for repetitive data by @terrelln (#1635) +api: Add parameter to generate smaller dictionaries by @tyler-tran (#1656) +cli: Recognize symlinks when built in C99 mode by @felixhandte (#1640) +cli: Expose cpu load indicator for each file on -vv mode by @ephiepark (#1631) +cli: Restrict read permissions on destination files by @chungy (#1644) +cli: zstdgrep: handle -f flag by @felixhandte (#1618) +cli: zstdcat: follow symlinks by @vejnar (#1604) +doc: Remove extra size limit on compressed blocks by @felixhandte (#1689) +doc: Fix typo by @yk-tanigawa (#1633) +doc: Improve documentation on streaming buffer sizes by @cyan4973 (#1629) +build: CMake: support building with LZ4 @leeyoung624 (#1626) +build: CMake: install zstdless and zstdgrep by @leeyoung624 (#1647) +build: CMake: respect existing uninstall target by @j301scott (#1619) +build: Make: skip multithread tests when built without support by @michaelforney (#1620) +build: Make: Fix examples/ test target by @sjnam (#1603) +build: Meson: rename options out of deprecated namespace by @lzutao (#1665) +build: Meson: fix build by @lzutao (#1602) +build: Visual Studio: don't export symbols in static lib by @scharan (#1650) +build: Visual Studio: fix linking by @absotively (#1639) +build: Fix MinGW-W64 build by @myzhang1029 (#1600) +misc: Expand decodecorpus coverage by @ephiepark (#1664) + +v1.4.0 (Apr 17, 2019) +perf: Improve level 1 compression speed in most scenarios by 6% by @gbtucker and @terrelln +api: Move the advanced API, including all functions in the staging section, to the stable section +api: Make ZSTD_e_flush and ZSTD_e_end block for maximum forward progress +api: Rename ZSTD_CCtxParam_getParameter to ZSTD_CCtxParams_getParameter +api: Rename ZSTD_CCtxParam_setParameter to ZSTD_CCtxParams_setParameter +api: Don't export ZSTDMT functions from the shared library by default +api: Require ZSTD_MULTITHREAD to be defined to use ZSTDMT +api: Add ZSTD_decompressBound() to provide an upper bound on decompressed size by @shakeelrao +api: Fix ZSTD_decompressDCtx() corner cases with a dictionary +api: Move ZSTD_getDictID_*() functions to the stable section +api: Add ZSTD_c_literalCompressionMode flag to enable or disable literal compression by @terrelln +api: Allow compression parameters to be set when a dictionary is used +api: Allow setting parameters before or after ZSTD_CCtx_loadDictionary() is called +api: Fix ZSTD_estimateCStreamSize_usingCCtxParams() +api: Setting ZSTD_d_maxWindowLog to 0 means use the default +cli: Ensure that a dictionary is not used to compress itself by @shakeelrao +cli: Add --[no-]compress-literals flag to enable or disable literal compression +doc: Update the examples to use the advanced API +doc: Explain how to transition from old streaming functions to the advanced API in the header +build: Improve the Windows release packages +build: Improve CMake build by @hjmjohnson +build: Build fixes for FreeBSD by @lwhsu +build: Remove redundant warnings by @thatsafunnyname +build: Fix tests on OpenBSD by @bket +build: Extend fuzzer build system to work with the new clang engine +build: CMake now creates the libzstd.so.1 symlink +build: Improve Menson build by @lzutao +misc: Fix symbolic link detection on FreeBSD +misc: Use physical core count for -T0 on FreeBSD by @cemeyer +misc: Fix zstd --list on truncated files by @kostmo +misc: Improve logging in debug mode by @felixhandte +misc: Add CirrusCI tests by @lwhsu +misc: Optimize dictionary memory usage in corner cases +misc: Improve the dictionary builder on small or homogeneous data +misc: Fix spelling across the repo by @jsoref + +v1.3.8 (Dec 28, 2018) +perf: better decompression speed on large files (+7%) and cold dictionaries (+15%) +perf: slightly better compression ratio at high compression modes +api : finalized advanced API, last stage before "stable" status +api : new --rsyncable mode, by @terrelln +api : support decompression of empty frames into NULL (used to be an error) (#1385) +build: new set of macros to build a minimal size decoder, by @felixhandte +build: fix compilation on MIPS32, reported by @clbr (#1441) +build: fix compilation with multiple -arch flags, by @ryandesign +build: highly upgraded meson build, by @lzutao +build: improved buck support, by @obelisk +build: fix cmake script : can create debug build, by @pitrou +build: Makefile : grep works on both colored consoles and systems without color support +build: fixed zstd-pgo, by @bmwiedemann +cli : support ZSTD_CLEVEL environment variable, by @yijinfb (#1423) +cli : --no-progress flag, preserving final summary (#1371), by @terrelln +cli : ensure destination file is not source file (#1422) +cli : clearer error messages, especially when input file not present +doc : clarified zstd_compression_format.md, by @ulikunitz +misc: fixed zstdgrep, returns 1 on failure, by @lzutao +misc: NEWS renamed as CHANGELOG, in accordance with fboss + +v1.3.7 (Oct 20, 2018) +perf: slightly better decompression speed on clang (depending on hardware target) +fix : performance of dictionary compression for small input < 4 KB at levels 9 and 10 +build: no longer build backtrace by default in release mode; restrict further automatic mode +build: control backtrace support through build macro BACKTRACE +misc: added man pages for zstdless and zstdgrep, by @samrussell + +v1.3.6 (Oct 6, 2018) +perf: much faster dictionary builder, by @jenniferliu +perf: faster dictionary compression on small data when using multiple contexts, by @felixhandte +perf: faster dictionary decompression when using a very large number of dictionaries simultaneously +cli : fix : does no longer overwrite destination when source does not exist (#1082) +cli : new command --adapt, for automatic compression level adaptation +api : fix : block api can be streamed with > 4 GB, reported by @catid +api : reduced ZSTD_DDict size by 2 KB +api : minimum negative compression level is defined, and can be queried using ZSTD_minCLevel(). +build: support Haiku target, by @korli +build: Read Legacy format is limited to v0.5+ by default. Can be changed at compile time with macro ZSTD_LEGACY_SUPPORT. +doc : zstd_compression_format.md updated to match wording in IETF RFC 8478 +misc: tests/paramgrill, a parameter optimizer, by @GeorgeLu97 + +v1.3.5 (Jun 29, 2018) +perf: much faster dictionary compression, by @felixhandte +perf: small quality improvement for dictionary generation, by @terrelln +perf: slightly improved high compression levels (notably level 19) +mem : automatic memory release for long duration contexts +cli : fix : overlapLog can be manually set +cli : fix : decoding invalid lz4 frames +api : fix : performance degradation for dictionary compression when using advanced API, by @terrelln +api : change : clarify ZSTD_CCtx_reset() vs ZSTD_CCtx_resetParameters(), by @terrelln +build: select custom libzstd scope through control macros, by @GeorgeLu97 +build: OpenBSD patch, by @bket +build: make and make all are compatible with -j +doc : clarify zstd_compression_format.md, updated for IETF RFC process +misc: pzstd compatible with reproducible compilation, by @lamby + +v1.3.4 (Mar 27, 2018) +perf: faster speed (especially decoding speed) on recent cpus (haswell+) +perf: much better performance associating --long with multi-threading, by @terrelln +perf: better compression at levels 13-15 +cli : asynchronous compression by default, for faster experience (use --single-thread for former behavior) +cli : smoother status report in multi-threading mode +cli : added command --fast=#, for faster compression modes +cli : fix crash when not overwriting existing files, by Pádraig Brady (@pixelb) +api : `nbThreads` becomes `nbWorkers` : 1 triggers asynchronous mode +api : compression levels can be negative, for even more speed +api : ZSTD_getFrameProgression() : get precise progress status of ZSTDMT anytime +api : ZSTDMT can accept new compression parameters during compression +api : implemented all advanced dictionary decompression prototypes +build: improved meson recipe, by Shawn Landden (@shawnl) +build: VS2017 scripts, by @HaydnTrigg +misc: all /contrib projects fixed +misc: added /contrib/docker script by @gyscos + +v1.3.3 (Dec 21, 2017) +perf: faster zstd_opt strategy (levels 16-19) +fix : bug #944 : multithreading with shared dictionary and large data, reported by @gsliepen +cli : fix : content size written in header by default +cli : fix : improved LZ4 format support, by @felixhandte +cli : new : hidden command `-S`, to benchmark multiple files while generating one result per file +api : fix : support large skippable frames, by @terrelln +api : fix : streaming interface was adding a useless 3-bytes null block to small frames +api : change : when setting `pledgedSrcSize`, use `ZSTD_CONTENTSIZE_UNKNOWN` macro value to mean "unknown" +build: fix : compilation under rhel6 and centos6, reported by @pixelb +build: added `check` target + +v1.3.2 (Oct 10, 2017) +new : long range mode, using --long command, by Stella Lau (@stellamplau) +new : ability to generate and decode magicless frames (#591) +changed : maximum nb of threads reduced to 200, to avoid address space exhaustion in 32-bits mode +fix : multi-threading compression works with custom allocators +fix : ZSTD_sizeof_CStream() was over-evaluating memory usage +fix : a rare compression bug when compression generates very large distances and bunch of other conditions (only possible at --ultra -22) +fix : 32-bits build can now decode large offsets (levels 21+) +cli : added LZ4 frame support by default, by Felix Handte (@felixhandte) +cli : improved --list output +cli : new : can split input file for dictionary training, using command -B# +cli : new : clean operation artefact on Ctrl-C interruption +cli : fix : do not change /dev/null permissions when using command -t with root access, reported by @mike155 (#851) +cli : fix : write file size in header in multiple-files mode +api : added macro ZSTD_COMPRESSBOUND() for static allocation +api : experimental : new advanced decompression API +api : fix : sizeof_CCtx() used to over-estimate +build: fix : no-multithread variant compiles without pool.c dependency, reported by Mitchell Blank Jr (@mitchblank) (#819) +build: better compatibility with reproducible builds, by Bernhard M. Wiedemann (@bmwiedemann) (#818) +example : added streaming_memory_usage +license : changed /examples license to BSD + GPLv2 +license : fix a few header files to reflect new license (#825) + +v1.3.1 (Aug 21, 2017) +New license : BSD + GPLv2 +perf: substantially decreased memory usage in Multi-threading mode, thanks to reports by Tino Reichardt (@mcmilk) +perf: Multi-threading supports up to 256 threads. Cap at 256 when more are requested (#760) +cli : improved and fixed --list command, by @ib (#772) +cli : command -vV to list supported formats, by @ib (#771) +build : fixed binary variants, reported by @svenha (#788) +build : fix Visual compilation for non x86/x64 targets, reported by Greg Slazinski (@GregSlazinski) (#718) +API exp : breaking change : ZSTD_getframeHeader() provides more information +API exp : breaking change : pinned down values of error codes +doc : fixed huffman example, by Ulrich Kunitz (@ulikunitz) +new : contrib/adaptive-compression, I/O driven compression strength, by Paul Cruz (@paulcruz74) +new : contrib/long_distance_matching, statistics by Stella Lau (@stellamplau) +updated : contrib/linux-kernel, by Nick Terrell (@terrelln) + +v1.3.0 (Jul 6, 2017) +cli : new : `--list` command, by Paul Cruz +cli : changed : xz/lzma support enabled by default +cli : changed : `-t *` continue processing list after a decompression error +API : added : ZSTD_versionString() +API : promoted to stable status : ZSTD_getFrameContentSize(), by Sean Purcell +API exp : new advanced API : ZSTD_compress_generic(), ZSTD_CCtx_setParameter() +API exp : new : API for static or external allocation : ZSTD_initStatic?Ctx() +API exp : added : ZSTD_decompressBegin_usingDDict(), requested by Guy Riddle (#700) +API exp : clarified memory estimation / measurement functions. +API exp : changed : strongest strategy renamed ZSTD_btultra, fastest strategy ZSTD_fast set to 1 +tools : decodecorpus can generate random dictionary-compressed samples, by Paul Cruz +new : contrib/seekable_format, demo and API, by Sean Purcell +changed : contrib/linux-kernel, updated version and license, by Nick Terrell + +v1.2.0 (May 5, 2017) +cli : changed : Multithreading enabled by default (use target zstd-nomt or HAVE_THREAD=0 to disable) +cli : new : command -T0 means "detect and use nb of cores", by Sean Purcell +cli : new : zstdmt symlink hardwired to `zstd -T0` +cli : new : command --threads=# (#671) +cli : changed : cover dictionary builder by default, for improved quality, by Nick Terrell +cli : new : commands --train-cover and --train-legacy, to select dictionary algorithm and parameters +cli : experimental targets `zstd4` and `xzstd4`, with support for lz4 format, by Sean Purcell +cli : fix : does not output compressed data on console +cli : fix : ignore symbolic links unless --force specified, +API : breaking change : ZSTD_createCDict_advanced(), only use compressionParameters as argument +API : added : prototypes ZSTD_*_usingCDict_advanced(), for direct control over frameParameters. +API : improved: ZSTDMT_compressCCtx() reduced memory usage +API : fix : ZSTDMT_compressCCtx() now provides srcSize in header (#634) +API : fix : src size stored in frame header is controlled at end of frame +API : fix : enforced consistent rules for pledgedSrcSize==0 (#641) +API : fix : error code "GENERIC" replaced by "dstSizeTooSmall" when appropriate +build: improved cmake script, by @Majlen +build: enabled Multi-threading support for *BSD, by Baptiste Daroussin +tools: updated Paramgrill. Command -O# provides best parameters for sample and speed target. +new : contrib/linux-kernel version, by Nick Terrell + +v1.1.4 (Mar 18, 2017) +cli : new : can compress in *.gz format, using --format=gzip command, by Przemyslaw Skibinski +cli : new : advanced benchmark command --priority=rt +cli : fix : write on sparse-enabled file systems in 32-bits mode, by @ds77 +cli : fix : --rm remains silent when input is stdin +cli : experimental : xzstd, with support for xz/lzma decoding, by Przemyslaw Skibinski +speed : improved decompression speed in streaming mode for single shot scenarios (+5%) +memory: DDict (decompression dictionary) memory usage down from 150 KB to 20 KB +arch: 32-bits variant able to generate and decode very long matches (>32 MB), by Sean Purcell +API : new : ZSTD_findFrameCompressedSize(), ZSTD_getFrameContentSize(), ZSTD_findDecompressedSize() +API : changed : dropped support of legacy versions <= v0.3 (can be changed by modifying ZSTD_LEGACY_SUPPORT value) +build : new: meson build system in contrib/meson, by Dima Krasner +build : improved cmake script, by @Majlen +build : added -Wformat-security flag, as recommended by Padraig Brady +doc : new : educational decoder, by Sean Purcell + +v1.1.3 (Feb 7, 2017) +cli : zstd can decompress .gz files (can be disabled with `make zstd-nogz` or `make HAVE_ZLIB=0`) +cli : new : experimental target `make zstdmt`, with multi-threading support +cli : new : improved dictionary builder "cover" (experimental), by Nick Terrell, based on prior work by Giuseppe Ottaviano. +cli : new : advanced commands for detailed parameters, by Przemyslaw Skibinski +cli : fix zstdless on Mac OS-X, by Andrew Janke +cli : fix #232 "compress non-files" +dictBuilder : improved dictionary generation quality, thanks to Nick Terrell +API : new : lib/compress/ZSTDMT_compress.h multithreading API (experimental) +API : new : ZSTD_create?Dict_byReference(), requested by Bartosz Taudul +API : new : ZDICT_finalizeDictionary() +API : fix : ZSTD_initCStream_usingCDict() properly writes dictID into frame header, by Gregory Szorc (#511) +API : fix : all symbols properly exposed in libzstd, by Nick Terrell +build : support for Solaris target, by Przemyslaw Skibinski +doc : clarified specification, by Sean Purcell + +v1.1.2 (Dec 15, 2016) +API : streaming : decompression : changed : automatic implicit reset when chain-decoding new frames without init +API : experimental : added : dictID retrieval functions, and ZSTD_initCStream_srcSize() +API : zbuff : changed : prototypes now generate deprecation warnings +lib : improved : faster decompression speed at ultra compression settings and 32-bits mode +lib : changed : only public ZSTD_ symbols are now exposed +lib : changed : reduced usage of stack memory +lib : fixed : several corner case bugs, by Nick Terrell +cli : new : gzstd, experimental version able to decode .gz files, by Przemyslaw Skibinski +cli : new : preserve file attributes +cli : new : added zstdless and zstdgrep tools +cli : fixed : status displays total amount decoded, even for file consisting of multiple frames (like pzstd) +cli : fixed : zstdcat +zlib_wrapper : added support for gz* functions, by Przemyslaw Skibinski +install : better compatibility with FreeBSD, by Dimitry Andric +source tree : changed : zbuff source files moved to lib/deprecated + +v1.1.1 (Nov 2, 2016) +New : command -M#, --memory=, --memlimit=, --memlimit-decompress= to limit allowed memory consumption +New : doc/zstd_manual.html, by Przemyslaw Skibinski +Improved : slightly better compression ratio at --ultra levels (>= 20) +Improved : better memory usage when using streaming compression API, thanks to @Rogier-5 report +Added : API : ZSTD_initCStream_usingCDict(), ZSTD_initDStream_usingDDict() (experimental section) +Added : example/multiple_streaming_compression.c +Changed : zstd_errors.h is now installed within /include (and replaces errors_public.h) +Updated man page +Fixed : zstd-small, zstd-compress and zstd-decompress compilation targets + +v1.1.0 (Sep 28, 2016) +New : contrib/pzstd, parallel version of zstd, by Nick Terrell +added : NetBSD install target (#338) +Improved : speed for batches of small files +Improved : speed of zlib wrapper, by Przemyslaw Skibinski +Changed : libzstd on Windows supports legacy formats, by Christophe Chevalier +Fixed : CLI -d output to stdout by default when input is stdin (#322) +Fixed : CLI correctly detects console on Mac OS-X +Fixed : CLI supports recursive mode `-r` on Mac OS-X +Fixed : Legacy decoders use unified error codes, reported by benrg (#341), fixed by Przemyslaw Skibinski +Fixed : compatibility with OpenBSD, reported by Juan Francisco Cantero Hurtado (#319) +Fixed : compatibility with Hurd, by Przemyslaw Skibinski (#365) +Fixed : zstd-pgo, reported by octoploid (#329) + +v1.0.0 (Sep 1, 2016) +Change Licensing, all project is now BSD, Copyright Facebook +Small decompression speed improvement +API : Streaming API supports legacy format +API : ZDICT_getDictID(), ZSTD_sizeof_{CCtx, DCtx, CStream, DStream}(), ZSTD_setDStreamParameter() +CLI supports legacy formats v0.4+ +Fixed : compression fails on certain huge files, reported by Jesse McGrew +Enhanced documentation, by Przemyslaw Skibinski + +v0.8.1 (Aug 18, 2016) +New streaming API +Changed : --ultra now enables levels beyond 19 +Changed : -i# now selects benchmark time in second +Fixed : ZSTD_compress* can now compress > 4 GB in a single pass, reported by Nick Terrell +Fixed : speed regression on specific patterns (#272) +Fixed : support for Z_SYNC_FLUSH, by Dmitry Krot (#291) +Fixed : ICC compilation, by Przemyslaw Skibinski + +v0.8.0 (Aug 2, 2016) +Improved : better speed on clang and gcc -O2, thanks to Eric Biggers +New : Build on FreeBSD and DragonFly, thanks to JrMarino +Changed : modified API : ZSTD_compressEnd() +Fixed : legacy mode with ZSTD_HEAPMODE=0, by Christopher Bergqvist +Fixed : premature end of frame when zero-sized raw block, reported by Eric Biggers +Fixed : large dictionaries (> 384 KB), reported by Ilona Papava +Fixed : checksum correctly checked in single-pass mode +Fixed : combined --test amd --rm, reported by Andreas M. Nilsson +Modified : minor compression level adaptations +Updated : compression format specification to v0.2.0 +changed : zstd.h moved to /lib directory + +v0.7.5 (Aug 1, 2016) +Transition version, supporting decoding of v0.8.x + +v0.7.4 (Jul 17, 2016) +Added : homebrew for Mac, by Daniel Cade +Added : more examples +Fixed : segfault when using small dictionaries, reported by Felix Handte +Modified : default compression level for CLI is now 3 +Updated : specification, to v0.1.1 + +v0.7.3 (Jul 9, 2016) +New : compression format specification +New : `--` separator, stating that all following arguments are file names. Suggested by Chip Turner. +New : `ZSTD_getDecompressedSize()` +New : OpenBSD target, by Juan Francisco Cantero Hurtado +New : `examples` directory +fixed : dictBuilder using HC levels, reported by Bartosz Taudul +fixed : legacy support from ZSTD_decompress_usingDDict(), reported by Felix Handte +fixed : multi-blocks decoding with intermediate uncompressed blocks, reported by Greg Slazinski +modified : removed "mem.h" and "error_public.h" dependencies from "zstd.h" (experimental section) +modified : legacy functions no longer need magic number + +v0.7.2 (Jul 4, 2016) +fixed : ZSTD_decompressBlock() using multiple consecutive blocks. Reported by Greg Slazinski. +fixed : potential segfault on very large files (many gigabytes). Reported by Chip Turner. +fixed : CLI displays system error message when destination file cannot be created (#231). Reported by Chip Turner. + +v0.7.1 (Jun 23, 2016) +fixed : ZBUFF_compressEnd() called multiple times with too small `dst` buffer, reported by Christophe Chevalier +fixed : dictBuilder fails if first sample is too small, reported by Руслан Ковалёв +fixed : corruption issue, reported by cj +modified : checksum enabled by default in command line mode + +v0.7.0 (Jun 17, 2016) +New : Support for directory compression, using `-r`, thanks to Przemyslaw Skibinski +New : Command `--rm`, to remove source file after successful de/compression +New : Visual build scripts, by Christophe Chevalier +New : Support for Sparse File-systems (do not use space for zero-filled sectors) +New : Frame checksum support +New : Support pass-through mode (when using `-df`) +API : more efficient Dictionary API : `ZSTD_compress_usingCDict()`, `ZSTD_decompress_usingDDict()` +API : create dictionary files from custom content, by Giuseppe Ottaviano +API : support for custom malloc/free functions +New : controllable Dictionary ID +New : Support for skippable frames + +v0.6.1 (May 13, 2016) +New : zlib wrapper API, thanks to Przemyslaw Skibinski +New : Ability to compile compressor / decompressor separately +Changed : new lib directory structure +Fixed : Legacy codec v0.5 compatible with dictionary decompression +Fixed : Decoder corruption error (#173) +Fixed : null-string roundtrip (#176) +New : benchmark mode can select directory as input +Experimental : midipix support, VMS support + +v0.6.0 (Apr 13, 2016) +Stronger high compression modes, thanks to Przemyslaw Skibinski +API : ZSTD_getFrameParams() provides size of decompressed content +New : highest compression modes require `--ultra` command to fully unleash their capacity +Fixed : zstd cli return error code > 0 and removes dst file artifact when decompression fails, thanks to Chip Turner + +v0.5.1 (Feb 18, 2016) +New : Optimal parsing => Very high compression modes, thanks to Przemyslaw Skibinski +Changed : Dictionary builder integrated into libzstd and zstd cli +Changed (!) : zstd cli now uses "multiple input files" as default mode. See `zstd -h`. +Fix : high compression modes for big-endian platforms +New : zstd cli : `-t` | `--test` command + +v0.5.0 (Feb 5, 2016) +New : dictionary builder utility +Changed : streaming & dictionary API +Improved : better compression of small data + +v0.4.7 (Jan 22, 2016) +Improved : small compression speed improvement in HC mode +Changed : `zstd_decompress.c` has ZSTD_LEGACY_SUPPORT to 0 by default +fix : bt search bug + +v0.4.6 (Jan 13, 2016) +fix : fast compression mode on Windows +New : cmake configuration file, thanks to Artyom Dymchenko +Improved : high compression mode on repetitive data +New : block-level API +New : ZSTD_duplicateCCtx() + +v0.4.5 (Dec 18, 2015) +new : -m/--multiple : compress/decompress multiple files + +v0.4.4 (Dec 14, 2015) +Fixed : high compression modes for Windows 32 bits +new : external dictionary API extended to buffered mode and accessible through command line +new : windows DLL project, thanks to Christophe Chevalier + +v0.4.3 (Dec 7, 2015) +new : external dictionary API +new : zstd-frugal + +v0.4.2 (Dec 2, 2015) +Generic minor improvements for small blocks +Fixed : big-endian compatibility, by Peter Harris (#85) + +v0.4.1 (Dec 1, 2015) +Fixed : ZSTD_LEGACY_SUPPORT=0 build mode (reported by Luben) +removed `zstd.c` + +v0.4.0 (Nov 29, 2015) +Command line utility compatible with high compression levels +Removed zstdhc => merged into zstd +Added : ZBUFF API (see zstd_buffered.h) +Rolling buffer support + +v0.3.6 (Nov 10, 2015) +small blocks params + +v0.3.5 (Nov 9, 2015) +minor generic compression improvements + +v0.3.4 (Nov 6, 2015) +Faster fast cLevels + +v0.3.3 (Nov 5, 2015) +Small compression ratio improvement + +v0.3.2 (Nov 2, 2015) +Fixed Visual Studio + +v0.3.1 (Nov 2, 2015) +Small compression ratio improvement + +v0.3 (Oct 30, 2015) +HC mode : compression levels 2-26 + +v0.2.2 (Oct 28, 2015) +Fix : Visual Studio 2013 & 2015 release compilation, by Christophe Chevalier + +v0.2.1 (Oct 24, 2015) +Fix : Read errors, advanced fuzzer tests, by Hanno Böck + +v0.2.0 (Oct 22, 2015) +**Breaking format change** +Faster decompression speed +Can still decode v0.1 format + +v0.1.3 (Oct 15, 2015) +fix uninitialization warning, reported by Evan Nemerson + +v0.1.2 (Sep 11, 2015) +frame concatenation support + +v0.1.1 (Aug 27, 2015) +fix compression bug +detects write-flush errors + +v0.1.0 (Aug 25, 2015) +first release diff --git a/curl/dep/zstd/LICENSE.txt b/curl/dep/zstd/LICENSE.txt new file mode 100644 index 0000000..7580028 --- /dev/null +++ b/curl/dep/zstd/LICENSE.txt @@ -0,0 +1,30 @@ +BSD License + +For Zstandard software + +Copyright (c) Meta Platforms, Inc. and affiliates. All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, +are permitted provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. + + * Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + + * Neither the name Facebook, nor Meta, nor the names of its contributors may + be used to endorse or promote products derived from this software without + specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR +ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON +ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/curl/dep/zstd/README.md b/curl/dep/zstd/README.md new file mode 100644 index 0000000..d91ef5d --- /dev/null +++ b/curl/dep/zstd/README.md @@ -0,0 +1,237 @@ +

Zstandard

+ +__Zstandard__, or `zstd` as short version, is a fast lossless compression algorithm, +targeting real-time compression scenarios at zlib-level and better compression ratios. +It's backed by a very fast entropy stage, provided by [Huff0 and FSE library](https://github.com/Cyan4973/FiniteStateEntropy). + +Zstandard's format is stable and documented in [RFC8878](https://datatracker.ietf.org/doc/html/rfc8878). Multiple independent implementations are already available. +This repository represents the reference implementation, provided as an open-source dual [BSD](LICENSE) OR [GPLv2](COPYING) licensed **C** library, +and a command line utility producing and decoding `.zst`, `.gz`, `.xz` and `.lz4` files. +Should your project require another programming language, +a list of known ports and bindings is provided on [Zstandard homepage](https://facebook.github.io/zstd/#other-languages). + +**Development branch status:** + +[![Build Status][travisDevBadge]][travisLink] +[![Build status][CircleDevBadge]][CircleLink] +[![Build status][CirrusDevBadge]][CirrusLink] +[![Fuzzing Status][OSSFuzzBadge]][OSSFuzzLink] + +[travisDevBadge]: https://api.travis-ci.com/facebook/zstd.svg?branch=dev "Continuous Integration test suite" +[travisLink]: https://travis-ci.com/facebook/zstd +[CircleDevBadge]: https://circleci.com/gh/facebook/zstd/tree/dev.svg?style=shield "Short test suite" +[CircleLink]: https://circleci.com/gh/facebook/zstd +[CirrusDevBadge]: https://api.cirrus-ci.com/github/facebook/zstd.svg?branch=dev +[CirrusLink]: https://cirrus-ci.com/github/facebook/zstd +[OSSFuzzBadge]: https://oss-fuzz-build-logs.storage.googleapis.com/badges/zstd.svg +[OSSFuzzLink]: https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:zstd + +## Benchmarks + +For reference, several fast compression algorithms were tested and compared +on a desktop featuring a Core i7-9700K CPU @ 4.9GHz +and running Ubuntu 20.04 (`Linux ubu20 5.15.0-101-generic`), +using [lzbench], an open-source in-memory benchmark by @inikep +compiled with [gcc] 9.4.0, +on the [Silesia compression corpus]. + +[lzbench]: https://github.com/inikep/lzbench +[Silesia compression corpus]: https://sun.aei.polsl.pl//~sdeor/index.php?page=silesia +[gcc]: https://gcc.gnu.org/ + +| Compressor name | Ratio | Compression| Decompress.| +| --------------- | ------| -----------| ---------- | +| **zstd 1.5.6 -1** | 2.887 | 510 MB/s | 1580 MB/s | +| [zlib] 1.2.11 -1 | 2.743 | 95 MB/s | 400 MB/s | +| brotli 1.0.9 -0 | 2.702 | 395 MB/s | 430 MB/s | +| **zstd 1.5.6 --fast=1** | 2.437 | 545 MB/s | 1890 MB/s | +| **zstd 1.5.6 --fast=3** | 2.239 | 650 MB/s | 2000 MB/s | +| quicklz 1.5.0 -1 | 2.238 | 525 MB/s | 750 MB/s | +| lzo1x 2.10 -1 | 2.106 | 650 MB/s | 825 MB/s | +| [lz4] 1.9.4 | 2.101 | 700 MB/s | 4000 MB/s | +| lzf 3.6 -1 | 2.077 | 420 MB/s | 830 MB/s | +| snappy 1.1.9 | 2.073 | 530 MB/s | 1660 MB/s | + +[zlib]: https://www.zlib.net/ +[lz4]: https://lz4.github.io/lz4/ + +The negative compression levels, specified with `--fast=#`, +offer faster compression and decompression speed +at the cost of compression ratio. + +Zstd can also offer stronger compression ratios at the cost of compression speed. +Speed vs Compression trade-off is configurable by small increments. +Decompression speed is preserved and remains roughly the same at all settings, +a property shared by most LZ compression algorithms, such as [zlib] or lzma. + +The following tests were run +on a server running Linux Debian (`Linux version 4.14.0-3-amd64`) +with a Core i7-6700K CPU @ 4.0GHz, +using [lzbench], an open-source in-memory benchmark by @inikep +compiled with [gcc] 7.3.0, +on the [Silesia compression corpus]. + +Compression Speed vs Ratio | Decompression Speed +---------------------------|-------------------- +![Compression Speed vs Ratio](doc/images/CSpeed2.png "Compression Speed vs Ratio") | ![Decompression Speed](doc/images/DSpeed3.png "Decompression Speed") + +A few other algorithms can produce higher compression ratios at slower speeds, falling outside of the graph. +For a larger picture including slow modes, [click on this link](doc/images/DCspeed5.png). + + +## The case for Small Data compression + +Previous charts provide results applicable to typical file and stream scenarios (several MB). Small data comes with different perspectives. + +The smaller the amount of data to compress, the more difficult it is to compress. This problem is common to all compression algorithms, and reason is, compression algorithms learn from past data how to compress future data. But at the beginning of a new data set, there is no "past" to build upon. + +To solve this situation, Zstd offers a __training mode__, which can be used to tune the algorithm for a selected type of data. +Training Zstandard is achieved by providing it with a few samples (one file per sample). The result of this training is stored in a file called "dictionary", which must be loaded before compression and decompression. +Using this dictionary, the compression ratio achievable on small data improves dramatically. + +The following example uses the `github-users` [sample set](https://github.com/facebook/zstd/releases/tag/v1.1.3), created from [github public API](https://developer.github.com/v3/users/#get-all-users). +It consists of roughly 10K records weighing about 1KB each. + +Compression Ratio | Compression Speed | Decompression Speed +------------------|-------------------|-------------------- +![Compression Ratio](doc/images/dict-cr.png "Compression Ratio") | ![Compression Speed](doc/images/dict-cs.png "Compression Speed") | ![Decompression Speed](doc/images/dict-ds.png "Decompression Speed") + + +These compression gains are achieved while simultaneously providing _faster_ compression and decompression speeds. + +Training works if there is some correlation in a family of small data samples. The more data-specific a dictionary is, the more efficient it is (there is no _universal dictionary_). +Hence, deploying one dictionary per type of data will provide the greatest benefits. +Dictionary gains are mostly effective in the first few KB. Then, the compression algorithm will gradually use previously decoded content to better compress the rest of the file. + +### Dictionary compression How To: + +1. Create the dictionary + + `zstd --train FullPathToTrainingSet/* -o dictionaryName` + +2. Compress with dictionary + + `zstd -D dictionaryName FILE` + +3. Decompress with dictionary + + `zstd -D dictionaryName --decompress FILE.zst` + + +## Build instructions + +`make` is the officially maintained build system of this project. +All other build systems are "compatible" and 3rd-party maintained, +they may feature small differences in advanced options. +When your system allows it, prefer using `make` to build `zstd` and `libzstd`. + +### Makefile + +If your system is compatible with standard `make` (or `gmake`), +invoking `make` in root directory will generate `zstd` cli in root directory. +It will also create `libzstd` into `lib/`. + +Other available options include: +- `make install` : create and install zstd cli, library and man pages +- `make check` : create and run `zstd`, test its behavior on local platform + +The `Makefile` follows the [GNU Standard Makefile conventions](https://www.gnu.org/prep/standards/html_node/Makefile-Conventions.html), +allowing staged install, standard flags, directory variables and command variables. + +For advanced use cases, specialized compilation flags which control binary generation +are documented in [`lib/README.md`](lib/README.md#modular-build) for the `libzstd` library +and in [`programs/README.md`](programs/README.md#compilation-variables) for the `zstd` CLI. + +### cmake + +A `cmake` project generator is provided within `build/cmake`. +It can generate Makefiles or other build scripts +to create `zstd` binary, and `libzstd` dynamic and static libraries. + +By default, `CMAKE_BUILD_TYPE` is set to `Release`. + +#### Support for Fat (Universal2) Output + +`zstd` can be built and installed with support for both Apple Silicon (M1/M2) as well as Intel by using CMake's Universal2 support. +To perform a Fat/Universal2 build and install use the following commands: + +```bash +cmake -B build-cmake-debug -S build/cmake -G Ninja -DCMAKE_OSX_ARCHITECTURES="x86_64;x86_64h;arm64" +cd build-cmake-debug +ninja +sudo ninja install +``` + +### Meson + +A Meson project is provided within [`build/meson`](build/meson). Follow +build instructions in that directory. + +You can also take a look at [`.travis.yml`](.travis.yml) file for an +example about how Meson is used to build this project. + +Note that default build type is **release**. + +### VCPKG +You can build and install zstd [vcpkg](https://github.com/Microsoft/vcpkg/) dependency manager: + + git clone https://github.com/Microsoft/vcpkg.git + cd vcpkg + ./bootstrap-vcpkg.sh + ./vcpkg integrate install + ./vcpkg install zstd + +The zstd port in vcpkg is kept up to date by Microsoft team members and community contributors. +If the version is out of date, please [create an issue or pull request](https://github.com/Microsoft/vcpkg) on the vcpkg repository. + +### Conan + +You can install pre-built binaries for zstd or build it from source using [Conan](https://conan.io/). Use the following command: + +```bash +conan install --requires="zstd/[*]" --build=missing +``` + +The zstd Conan recipe is kept up to date by Conan maintainers and community contributors. +If the version is out of date, please [create an issue or pull request](https://github.com/conan-io/conan-center-index) on the ConanCenterIndex repository. + +### Visual Studio (Windows) + +Going into `build` directory, you will find additional possibilities: +- Projects for Visual Studio 2005, 2008 and 2010. + + VS2010 project is compatible with VS2012, VS2013, VS2015 and VS2017. +- Automated build scripts for Visual compiler by [@KrzysFR](https://github.com/KrzysFR), in `build/VS_scripts`, + which will build `zstd` cli and `libzstd` library without any need to open Visual Studio solution. + +### Buck + +You can build the zstd binary via buck by executing: `buck build programs:zstd` from the root of the repo. +The output binary will be in `buck-out/gen/programs/`. + +### Bazel + +You easily can integrate zstd into your Bazel project by using the module hosted on the [Bazel Central Repository](https://registry.bazel.build/modules/zstd). + +## Testing + +You can run quick local smoke tests by running `make check`. +If you can't use `make`, execute the `playTest.sh` script from the `src/tests` directory. +Two env variables `$ZSTD_BIN` and `$DATAGEN_BIN` are needed for the test script to locate the `zstd` and `datagen` binary. +For information on CI testing, please refer to `TESTING.md`. + +## Status + +Zstandard is currently deployed within Facebook and many other large cloud infrastructures. +It is run continuously to compress large amounts of data in multiple formats and use cases. +Zstandard is considered safe for production environments. + +## License + +Zstandard is dual-licensed under [BSD](LICENSE) OR [GPLv2](COPYING). + +## Contributing + +The `dev` branch is the one where all contributions are merged before reaching `release`. +If you plan to propose a patch, please commit into the `dev` branch, or its own feature branch. +Direct commit to `release` are not permitted. +For more information, please read [CONTRIBUTING](CONTRIBUTING.md). diff --git a/curl/docs/ALTSVC.md b/curl/docs/ALTSVC.md new file mode 100644 index 0000000..bcdf565 --- /dev/null +++ b/curl/docs/ALTSVC.md @@ -0,0 +1,43 @@ + + +# Alt-Svc + +curl features support for the Alt-Svc: HTTP header. + +## Enable Alt-Svc in build + +`./configure --enable-alt-svc` + +(enabled by default since 7.73.0) + +## Standard + +[RFC 7838](https://datatracker.ietf.org/doc/html/rfc7838) + +# Alt-Svc cache file format + +This is a text based file with one line per entry and each line consists of nine +space separated fields. + +## Example + + h2 quic.tech 8443 h3-22 quic.tech 8443 "20190808 06:18:37" 0 0 + +## Fields + +1. The ALPN id for the source origin +2. The hostname for the source origin +3. The port number for the source origin +4. The ALPN id for the destination host +5. The hostname for the destination host +6. The port number for the destination host +7. The expiration date and time of this entry within double quotes. The date format is "YYYYMMDD HH:MM:SS" and the time zone is GMT. +8. Boolean (1 or 0) if "persist" was set for this entry +9. Integer priority value (not currently used) + +If the hostname is an IPv6 numerical address, it is stored with brackets such +as `[::1]`. diff --git a/curl/docs/BINDINGS.md b/curl/docs/BINDINGS.md new file mode 100644 index 0000000..e628776 --- /dev/null +++ b/curl/docs/BINDINGS.md @@ -0,0 +1,148 @@ + + +libcurl bindings +================ + + Creative people have written bindings or interfaces for various environments + and programming languages. Using one of these allows you to take advantage of + curl powers from within your favourite language or system. + + This is a list of all known interfaces as of this writing. + + The bindings listed below are not part of the curl/libcurl distribution + archives, but must be downloaded and installed separately. + + + +[Ada95](https://web.archive.org/web/20070403105909/www.almroth.com/adacurl/index.html) Written by Andreas Almroth + +[Basic](https://scriptbasic.com/) ScriptBasic bindings written by Peter Verhas + +C++: [curlpp](https://github.com/jpbarrette/curlpp/) Written by Jean-Philippe Barrette-LaPierre, +[curlcpp](https://github.com/JosephP91/curlcpp) by Giuseppe Persico and [C++ +Requests](https://github.com/libcpr/cpr) by Huu Nguyen + +[Ch](https://chcurl.sourceforge.net/) Written by Stephen Nestinger and Jonathan Rogado + +Cocoa: [BBHTTP](https://github.com/biasedbit/BBHTTP) written by Bruno de Carvalho +[curlhandle](https://github.com/karelia/curlhandle) Written by Dan Wood + +Clojure: [clj-curl](https://github.com/lsevero/clj-curl) by Lucas Severo + +[D](https://dlang.org/library/std/net/curl.html) Written by Kenneth Bogert + +[Delphi](https://github.com/Mercury13/curl4delphi) Written by Mikhail Merkuryev + +[Dylan](https://dylanlibs.sourceforge.net/) Written by Chris Double + +[Eiffel](https://iron.eiffel.com/repository/20.11/package/ABEF6975-37AC-45FD-9C67-52D10BA0669B) Written by Eiffel Software + +[Euphoria](https://web.archive.org/web/20050204080544/rays-web.com/eulibcurl.htm) Written by Ray Smith + +[Falcon](http://www.falconpl.org/project_docs/curl/) + +[Ferite](https://web.archive.org/web/20150102192018/ferite.org/) Written by Paul Querna + +[Fortran](https://github.com/interkosmos/fortran-curl) Written by Philipp Engel + +[Gambas](https://gambas.sourceforge.net/) + +[glib/GTK+](https://web.archive.org/web/20100526203452/atterer.net/glibcurl) Written by Richard Atterer + +Go: [go-curl](https://github.com/andelf/go-curl) by ShuYu Wang + +[Guile](https://github.com/spk121/guile-curl) Written by Michael L. Gran + +[Harbour](https://github.com/vszakats/hb/tree/main/contrib/hbcurl) Written by Viktor Szakats + +[Haskell](https://hackage.haskell.org/package/curl) Written by Galois, Inc + +[Hollywood](https://www.hollywood-mal.com/download.html) hURL by Andreas Falkenhahn + +[Java](https://github.com/covers1624/curl4j) + +[Julia](https://github.com/JuliaWeb/LibCURL.jl) Written by Amit Murthy + +[Kapito](https://github.com/puzza007/katipo) is an Erlang HTTP library around libcurl. + +[Lisp](https://common-lisp.net/project/cl-curl/) Written by Liam Healy + +Lua: [luacurl](https://web.archive.org/web/20201205052437/luacurl.luaforge.net/) by Alexander Marinov, [Lua-cURL](https://github.com/Lua-cURL) by Jürgen Hötzel + +[Mono](https://web.archive.org/web/20070606064500/https://forge.novell.com/modules/xfmod/project/?libcurl-mono) Written by Jeffrey Phillips + +[.NET](https://sourceforge.net/projects/libcurl-net/) libcurl-net by Jeffrey Phillips + +[Nim](https://nimble.directory/pkg/libcurl) wrapper for libcurl + +[node.js](https://github.com/JCMais/node-libcurl) node-libcurl by Jonathan Cardoso Machado + +[Object-Pascal](https://web.archive.org/web/20020610214926/www.tekool.com/opcurl) Free Pascal, Delphi and Kylix binding written by Christophe Espern. + +[OCaml](https://opam.ocaml.org/packages/ocurl/) Written by Lars Nilsson and ygrek + +[Pascal](https://web.archive.org/web/20030804091414/houston.quik.com/jkp/curlpas/) Free Pascal, Delphi and Kylix binding written by Jeffrey Pohlmeyer. + +Perl: [WWW::Curl](https://github.com/szbalint/WWW--Curl) Maintained by Cris +Bailiff and Bálint Szilakszi, +[perl6-net-curl](https://github.com/azawawi/perl6-net-curl) by Ahmad M. Zawawi +[NET::Curl](https://metacpan.org/pod/Net::Curl) by Przemyslaw Iskra + +[PHP](https://php.net/curl) Originally written by Sterling Hughes + +[PostgreSQL](https://github.com/pramsey/pgsql-http) - HTTP client for PostgreSQL + +[PostgreSQL](https://github.com/RekGRpth/pg_curl) - cURL client for PostgreSQL + +[PureBasic](https://www.purebasic.com/documentation/http/index.html) uses libcurl in its "native" HTTP subsystem + +[Python](http://pycurl.io/) PycURL by Kjetil Jacobsen + +[Python](https://pypi.org/project/pymcurl/) mcurl by Ganesh Viswanathan + +[Q](https://q-lang.sourceforge.net/) The libcurl module is part of the default install + +[R](https://cran.r-project.org/package=curl) + +[Rexx](https://rexxcurl.sourceforge.net/) Written Mark Hessling + +[Ring](https://ring-lang.sourceforge.io/doc1.3/libcurl.html) RingLibCurl by Mahmoud Fayed + +RPG, support for ILE/RPG on OS/400 is included in source distribution + +Ruby: [curb](https://github.com/taf2/curb) written by Ross Bamford, +[ruby-curl-multi](https://github.com/kball/curl_multi.rb) by Kristjan Petursson and Keith Rarick + +[Rust](https://github.com/alexcrichton/curl-rust) curl-rust - by Carl Lerche + +[Scheme](https://www.metapaper.net/lisovsky/web/curl/) Bigloo binding by Kirill Lisovsky + +[Scilab](https://help.scilab.org/docs/current/fr_FR/getURL.html) binding by Sylvestre Ledru + +[S-Lang](https://www.jedsoft.org/slang/modules/curl.html) by John E Davis + +[Smalltalk](https://www.squeaksource.com/CurlPlugin/) Written by Danil Osipchuk + +[SP-Forth](https://sourceforge.net/p/spf/spf/ci/master/tree/devel/~ac/lib/lin/curl/) Written by Andrey Cherezov + +[SPL](https://web.archive.org/web/20210203022158/www.clifford.at/spl/spldoc/curl.html) Written by Clifford Wolf + +[Tcl](https://web.archive.org/web/20160826011806/mirror.yellow5.com/tclcurl/) Tclcurl by Andrés García + +[Vibe](https://github.com/ttytm/vibe) HTTP requests through libcurl in V + +[Visual Basic](https://sourceforge.net/projects/libcurl-vb/) libcurl-vb by Jeffrey Phillips + +[Visual Foxpro](https://web.archive.org/web/20130730181523/www.ctl32.com.ar/libcurl.asp) by Carlos Alloatti + +[wxWidgets](https://wxcode.sourceforge.net/components/wxcurl/) Written by Casey O'Donnell + +[XBLite](https://web.archive.org/web/20060426150418/perso.wanadoo.fr/xblite/libraries.html) Written by David Szafranski + +[Xojo](https://github.com/charonn0/RB-libcURL) Written by Andrew Lambert + +[Zig](https://github.com/jiacai2050/zig-curl) Written by Jiacai Liu, both easy and multi API are supported. diff --git a/curl/docs/BUG-BOUNTY.md b/curl/docs/BUG-BOUNTY.md new file mode 100644 index 0000000..399c4cf --- /dev/null +++ b/curl/docs/BUG-BOUNTY.md @@ -0,0 +1,94 @@ + + +# The curl bug bounty + +The curl project runs a bug bounty program in association with +[HackerOne](https://www.hackerone.com) and the [Internet Bug +Bounty](https://internetbugbounty.org). + +## How does it work? + +Start out by posting your suspected security vulnerability directly to [curl's +HackerOne program](https://hackerone.com/curl). + +After you have reported a security issue, it has been deemed credible, and a +patch and advisory has been made public, you may be eligible for a bounty from +this program. See the [Security Process](https://curl.se/dev/secprocess.html) +document for how we work with security issues. + +## What are the reward amounts? + +The curl project offers monetary compensation for reported and published +security vulnerabilities. The amount of money that is rewarded depends on how +serious the flaw is determined to be. + +Since 2021, the Bug Bounty is managed in association with the Internet Bug +Bounty and they set the reward amounts. If it would turn out that they set +amounts that are way lower than we can accept, the curl project intends to +"top up" rewards. + +In 2022, typical "Medium" rated vulnerabilities have been rewarded 2,400 USD +each. + +## Who is eligible for a reward? + +Everyone and anyone who reports a security problem in a released curl version +that has not already been reported can ask for a bounty. + +Dedicated - paid for - security audits that are performed in collaboration +with curl developers are not eligible for bounties. + +Vulnerabilities in features that are off by default and documented as +experimental are not eligible for a reward. + +The vulnerability has to be fixed and publicly announced (by the curl project) +before a bug bounty is considered. + +Once the vulnerability has been published by curl, the researcher can request +their bounty from the [Internet Bug Bounty](https://hackerone.com/ibb). + +Bounties need to be requested within twelve months from the publication of the +vulnerability. + +The curl security team reserves themselves the right to deny or allow bug +bounty payouts on its own discretion. There is no appeals process. + +## Product vulnerabilities only + +This bug bounty only concerns the curl and libcurl products and thus their +respective source codes - when running on existing hardware. It does not +include curl documentation, curl websites, or other curl related +infrastructure. + +The curl security team is the sole arbiter if a reported flaw is subject to a +bounty or not. + +## Third parties + +The curl bug bounty does not cover flaws in third party dependencies +(libraries) used by curl or libcurl. If the bug triggers because of curl +behaving wrongly or abusing a third party dependency, the problem is rather in +curl and not in the dependency and then the bounty might cover the problem. + +## How are vulnerabilities graded? + +The grading of each reported vulnerability that makes a reward claim is +performed by the curl security team. The grading is based on the CVSS (Common +Vulnerability Scoring System) 3.0. + +## How are reward amounts determined? + +The curl security team gives the vulnerability a score or severity level, as +mentioned above. The actual monetary reward amount is decided and paid by the +Internet Bug Bounty.. + +## Regarding taxes, etc. on the bounties + +In the event that the individual receiving a bug bounty needs to pay taxes on +the reward money, the responsibility lies with the receiver. The curl project +or its security team never actually receive any of this money, hold the money, +or pay out the money. diff --git a/curl/docs/BUGS.md b/curl/docs/BUGS.md new file mode 100644 index 0000000..83dde54 --- /dev/null +++ b/curl/docs/BUGS.md @@ -0,0 +1,270 @@ + + +# BUGS + +## There are still bugs + + curl and libcurl keep being developed. Adding features and changing code + means that bugs sneak in, no matter how hard we try to keep them out. + + Of course there are lots of bugs left. Not to mention misfeatures. + + To help us make curl the stable and solid product we want it to be, we need + bug reports and bug fixes. + +## Where to report + + If you cannot fix a bug yourself and submit a fix for it, try to report an as + detailed report as possible to a curl mailing list to allow one of us to have + a go at a solution. You can optionally also submit your problem in [curl's + bug tracking system](https://github.com/curl/curl/issues). + + Please read the rest of this document below first before doing that. + + If you feel you need to ask around first, find a suitable [mailing + list](https://curl.se/mail/) and post your questions there. + +## Security bugs + + If you find a bug or problem in curl or libcurl that you think has a security + impact, for example a bug that can put users in danger or make them + vulnerable if the bug becomes public knowledge, then please report that bug + using our security development process. + + Security related bugs or bugs that are suspected to have a security impact, + should be reported on the [curl security tracker at + HackerOne](https://hackerone.com/curl). + + This ensures that the report reaches the curl security team so that they + first can deal with the report away from the public to minimize the harm and + impact it has on existing users out there who might be using the vulnerable + versions. + + The curl project's process for handling security related issues is + [documented separately](https://curl.se/dev/secprocess.html). + +## What to report + + When reporting a bug, you should include all information to help us + understand what is wrong, what you expected to happen and how to repeat the + bad behavior. You therefore need to tell us: + + - your operating system's name and version number + + - what version of curl you are using (`curl -V` is fine) + + - versions of the used libraries that libcurl is built to use + + - what URL you were working with (if possible), at least which protocol + + and anything and everything else you think matters. Tell us what you expected + to happen, tell use what did happen, tell us how you could make it work + another way. Dig around, try out, test. Then include all the tiny bits and + pieces in your report. You benefit from this yourself, as it enables us to + help you quicker and more accurately. + + Since curl deals with networks, it often helps us if you include a protocol + debug dump with your bug report. The output you get by using the `-v` or + `--trace` options. + + If curl crashed, causing a core dump (in Unix), there is hardly any use to + send that huge file to anyone of us. Unless we have the same system setup as + you, we cannot do much with it. Instead, we ask you to get a stack trace and + send that (much smaller) output to us instead. + + The address and how to subscribe to the mailing lists are detailed in the + `MANUAL.md` file. + +## libcurl problems + + When you have written your own application with libcurl to perform transfers, + it is even more important to be specific and detailed when reporting bugs. + + Tell us the libcurl version and your operating system. Tell us the name and + version of all relevant sub-components like for example the SSL library + you are using and what name resolving your libcurl uses. If you use SFTP or + SCP, the libssh2 version is relevant etc. + + Showing us a real source code example repeating your problem is the best way + to get our attention and it greatly increases our chances to understand your + problem and to work on a fix (if we agree it truly is a problem). + + Lots of problems that appear to be libcurl problems are actually just abuses + of the libcurl API or other malfunctions in your applications. It is advised + that you run your problematic program using a memory debug tool like valgrind + or similar before you post memory-related or "crashing" problems to us. + +## Who fixes the problems + + If the problems or bugs you describe are considered to be bugs, we want to + have the problems fixed. + + There are no developers in the curl project that are paid to work on bugs. + All developers that take on reported bugs do this on a voluntary basis. We do + it out of an ambition to keep curl and libcurl excellent products and out of + pride. + + Please do not assume that you can just lump over something to us and it then + magically gets fixed after some given time. Most often we need feedback and + help to understand what you have experienced and how to repeat a problem. + Then we may only be able to assist YOU to debug the problem and to track down + the proper fix. + + We get reports from many people every month and each report can take a + considerable amount of time to really go to the bottom with. + +## How to get a stack trace + + First, you must make sure that you compile all sources with `-g` and that you + do not 'strip' the final executable. Try to avoid optimizing the code as well, + remove `-O`, `-O2` etc from the compiler options. + + Run the program until it cores. + + Run your debugger on the core file, like ` curl core`. `` + should be replaced with the name of your debugger, in most cases that is + `gdb`, but `dbx` and others also occur. + + When the debugger has finished loading the core file and presents you a + prompt, enter `where` (without quotes) and press return. + + The list that is presented is the stack trace. If everything worked, it is + supposed to contain the chain of functions that were called when curl + crashed. Include the stack trace with your detailed bug report, it helps a + lot. + +## Bugs in libcurl bindings + + There are of course bugs in libcurl bindings. You should then primarily + approach the team that works on that particular binding and see what you can + do to help them fix the problem. + + If you suspect that the problem exists in the underlying libcurl, then please + convert your program over to plain C and follow the steps outlined above. + +## Bugs in old versions + + The curl project typically releases new versions every other month, and we + fix several hundred bugs per year. For a huge table of releases, number of + bug fixes and more, see: https://curl.se/docs/releases.html + + The developers in the curl project do not have bandwidth or energy enough to + maintain several branches or to spend much time on hunting down problems in + old versions when chances are we already fixed them or at least that they have + changed nature and appearance in later versions. + + When you experience a problem and want to report it, you really SHOULD + include the version number of the curl you are using when you experience the + issue. If that version number shows us that you are using an out-of-date curl, + you should also try out a modern curl version to see if the problem persists + or how/if it has changed in appearance. + + Even if you cannot immediately upgrade your application/system to run the + latest curl version, you can most often at least run a test version or + experimental build or similar, to get this confirmed or not. + + At times people insist that they cannot upgrade to a modern curl version, but + instead, they "just want the bug fixed". That is fine, just do not count on us + spending many cycles on trying to identify which single commit, if that is + even possible, that at some point in the past fixed the problem you are now + experiencing. + + Security wise, it is almost always a bad idea to lag behind the current curl + versions by a lot. We keep discovering and reporting security problems + over time see you can see in [this + table](https://curl.se/docs/vulnerabilities.html) + +# Bug fixing procedure + +## What happens on first filing + + When a new issue is posted in the issue tracker or on the mailing list, the + team of developers first needs to see the report. Maybe they took the day off, + maybe they are off in the woods hunting. Have patience. Allow at least a few + days before expecting someone to have responded. + + In the issue tracker, you can expect that some labels are set on the issue to + help categorize it. + +## First response + + If your issue/bug report was not perfect at once (and few are), chances are + that someone asks follow-up questions. Which version did you use? Which + options did you use? How often does the problem occur? How can we reproduce + this problem? Which protocols does it involve? Or perhaps much more specific + and deep diving questions. It all depends on your specific issue. + + You should then respond to these follow-up questions and provide more info + about the problem, so that we can help you figure it out. Or maybe you can + help us figure it out. An active back-and-forth communication is important + and the key for finding a cure and landing a fix. + +## Not reproducible + + We may require further work from you who actually see or experience the + problem if we cannot reproduce it and cannot understand it even after having + gotten all the info we need and having studied the source code over again. + +## Unresponsive + + If the problem have not been understood or reproduced, and there is nobody + responding to follow-up questions or questions asking for clarifications or + for discussing possible ways to move forward with the task, we take that as a + strong suggestion that the bug is unimportant. + + Unimportant issues are closed as inactive sooner or later as they cannot be + fixed. The inactivity period (waiting for responses) should not be shorter + than two weeks but may extend months. + +## Lack of time/interest + + Bugs that are filed and are understood can unfortunately end up in the + "nobody cares enough about it to work on it" category. Such bugs are + perfectly valid problems that *should* get fixed but apparently are not. We + try to mark such bugs as `KNOWN_BUGS material` after a time of inactivity and + if no activity is noticed after yet some time those bugs are added to the + `KNOWN_BUGS` document and are closed in the issue tracker. + +## `KNOWN_BUGS` + + This is a list of known bugs. Bugs we know exist and that have been pointed + out but that have not yet been fixed. The reasons for why they have not been + fixed can involve anything really, but the primary reason is that nobody has + considered these problems to be important enough to spend the necessary time + and effort to have them fixed. + + The `KNOWN_BUGS` items are always up for grabs and we love the ones who bring + one of them back to life and offer solutions to them. + + The `KNOWN_BUGS` document has a sibling document known as `TODO`. + +## `TODO` + + Issues that are filed or reported that are not really bugs but more missing + features or ideas for future improvements and so on are marked as + *enhancement* or *feature-request* and get added to the `TODO` document and + the issues are closed. We do not keep TODO items open in the issue tracker. + + The `TODO` document is full of ideas and suggestions of what we can add or + fix one day. You are always encouraged and free to grab one of those items and + take up a discussion with the curl development team on how that could be + implemented or provided in the project so that you can work on ticking it odd + that document. + + If an issue is rather a bug and not a missing feature or functionality, it is + listed in `KNOWN_BUGS` instead. + +## Closing off stalled bugs + + The [issue and pull request trackers](https://github.com/curl/curl) only hold + "active" entries open (using a non-precise definition of what active actually + is, but they are at least not completely dead). Those that are abandoned or + in other ways dormant are closed and sometimes added to `TODO` and + `KNOWN_BUGS` instead. + + This way, we only have "active" issues open on GitHub. Irrelevant issues and + pull requests do not distract developers or casual visitors. diff --git a/curl/docs/CIPHERS-TLS12.md b/curl/docs/CIPHERS-TLS12.md new file mode 100644 index 0000000..d67c62b --- /dev/null +++ b/curl/docs/CIPHERS-TLS12.md @@ -0,0 +1,336 @@ + + +# TLS 1.2 cipher suites + +| Id | IANA name | OpenSSL name | RFC | +|--------|-----------------------------------------------|------------------------------------|--------------------| +| 0x0001 | TLS_RSA_WITH_NULL_MD5 | NULL-MD5 | [RFC5246] | +| 0x0002 | TLS_RSA_WITH_NULL_SHA | NULL-SHA | [RFC5246] | +| 0x0003 | TLS_RSA_EXPORT_WITH_RC4_40_MD5 | EXP-RC4-MD5 | [RFC4346][RFC6347] | +| 0x0004 | TLS_RSA_WITH_RC4_128_MD5 | RC4-MD5 | [RFC5246][RFC6347] | +| 0x0005 | TLS_RSA_WITH_RC4_128_SHA | RC4-SHA | [RFC5246][RFC6347] | +| 0x0006 | TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 | EXP-RC2-CBC-MD5 | [RFC4346] | +| 0x0007 | TLS_RSA_WITH_IDEA_CBC_SHA | IDEA-CBC-SHA | [RFC8996] | +| 0x0008 | TLS_RSA_EXPORT_WITH_DES40_CBC_SHA | EXP-DES-CBC-SHA | [RFC4346] | +| 0x0009 | TLS_RSA_WITH_DES_CBC_SHA | DES-CBC-SHA | [RFC8996] | +| 0x000A | TLS_RSA_WITH_3DES_EDE_CBC_SHA | DES-CBC3-SHA | [RFC5246] | +| 0x000B | TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA | EXP-DH-DSS-DES-CBC-SHA | [RFC4346] | +| 0x000C | TLS_DH_DSS_WITH_DES_CBC_SHA | DH-DSS-DES-CBC-SHA | [RFC8996] | +| 0x000D | TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA | DH-DSS-DES-CBC3-SHA | [RFC5246] | +| 0x000E | TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA | EXP-DH-RSA-DES-CBC-SHA | [RFC4346] | +| 0x000F | TLS_DH_RSA_WITH_DES_CBC_SHA | DH-RSA-DES-CBC-SHA | [RFC8996] | +| 0x0010 | TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA | DH-RSA-DES-CBC3-SHA | [RFC5246] | +| 0x0011 | TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA | EXP-DHE-DSS-DES-CBC-SHA | [RFC4346] | +| 0x0012 | TLS_DHE_DSS_WITH_DES_CBC_SHA | DHE-DSS-DES-CBC-SHA | [RFC8996] | +| 0x0013 | TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA | DHE-DSS-DES-CBC3-SHA | [RFC5246] | +| 0x0014 | TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA | EXP-DHE-RSA-DES-CBC-SHA | [RFC4346] | +| 0x0015 | TLS_DHE_RSA_WITH_DES_CBC_SHA | DHE-RSA-DES-CBC-SHA | [RFC8996] | +| 0x0016 | TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA | DHE-RSA-DES-CBC3-SHA | [RFC5246] | +| 0x0017 | TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 | EXP-ADH-RC4-MD5 | [RFC4346][RFC6347] | +| 0x0018 | TLS_DH_anon_WITH_RC4_128_MD5 | ADH-RC4-MD5 | [RFC5246][RFC6347] | +| 0x0019 | TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA | EXP-ADH-DES-CBC-SHA | [RFC4346] | +| 0x001A | TLS_DH_anon_WITH_DES_CBC_SHA | ADH-DES-CBC-SHA | [RFC8996] | +| 0x001B | TLS_DH_anon_WITH_3DES_EDE_CBC_SHA | ADH-DES-CBC3-SHA | [RFC5246] | +| 0x001C | | FZA-NULL-SHA | | +| 0x001D | | FZA-FZA-CBC-SHA | | +| 0x001E | TLS_KRB5_WITH_DES_CBC_SHA | KRB5-DES-CBC-SHA | [RFC2712] | +| 0x001F | TLS_KRB5_WITH_3DES_EDE_CBC_SHA | KRB5-DES-CBC3-SHA | [RFC2712] | +| 0x0020 | TLS_KRB5_WITH_RC4_128_SHA | KRB5-RC4-SHA | [RFC2712][RFC6347] | +| 0x0021 | TLS_KRB5_WITH_IDEA_CBC_SHA | KRB5-IDEA-CBC-SHA | [RFC2712] | +| 0x0022 | TLS_KRB5_WITH_DES_CBC_MD5 | KRB5-DES-CBC-MD5 | [RFC2712] | +| 0x0023 | TLS_KRB5_WITH_3DES_EDE_CBC_MD5 | KRB5-DES-CBC3-MD5 | [RFC2712] | +| 0x0024 | TLS_KRB5_WITH_RC4_128_MD5 | KRB5-RC4-MD5 | [RFC2712][RFC6347] | +| 0x0025 | TLS_KRB5_WITH_IDEA_CBC_MD5 | KRB5-IDEA-CBC-MD5 | [RFC2712] | +| 0x0026 | TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA | EXP-KRB5-DES-CBC-SHA | [RFC2712] | +| 0x0027 | TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA | EXP-KRB5-RC2-CBC-SHA | [RFC2712] | +| 0x0028 | TLS_KRB5_EXPORT_WITH_RC4_40_SHA | EXP-KRB5-RC4-SHA | [RFC2712][RFC6347] | +| 0x0029 | TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5 | EXP-KRB5-DES-CBC-MD5 | [RFC2712] | +| 0x002A | TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5 | EXP-KRB5-RC2-CBC-MD5 | [RFC2712] | +| 0x002B | TLS_KRB5_EXPORT_WITH_RC4_40_MD5 | EXP-KRB5-RC4-MD5 | [RFC2712][RFC6347] | +| 0x002C | TLS_PSK_WITH_NULL_SHA | PSK-NULL-SHA | [RFC4785] | +| 0x002D | TLS_DHE_PSK_WITH_NULL_SHA | DHE-PSK-NULL-SHA | [RFC4785] | +| 0x002E | TLS_RSA_PSK_WITH_NULL_SHA | RSA-PSK-NULL-SHA | [RFC4785] | +| 0x002F | TLS_RSA_WITH_AES_128_CBC_SHA | AES128-SHA | [RFC5246] | +| 0x0030 | TLS_DH_DSS_WITH_AES_128_CBC_SHA | DH-DSS-AES128-SHA | [RFC5246] | +| 0x0031 | TLS_DH_RSA_WITH_AES_128_CBC_SHA | DH-RSA-AES128-SHA | [RFC5246] | +| 0x0032 | TLS_DHE_DSS_WITH_AES_128_CBC_SHA | DHE-DSS-AES128-SHA | [RFC5246] | +| 0x0033 | TLS_DHE_RSA_WITH_AES_128_CBC_SHA | DHE-RSA-AES128-SHA | [RFC5246] | +| 0x0034 | TLS_DH_anon_WITH_AES_128_CBC_SHA | ADH-AES128-SHA | [RFC5246] | +| 0x0035 | TLS_RSA_WITH_AES_256_CBC_SHA | AES256-SHA | [RFC5246] | +| 0x0036 | TLS_DH_DSS_WITH_AES_256_CBC_SHA | DH-DSS-AES256-SHA | [RFC5246] | +| 0x0037 | TLS_DH_RSA_WITH_AES_256_CBC_SHA | DH-RSA-AES256-SHA | [RFC5246] | +| 0x0038 | TLS_DHE_DSS_WITH_AES_256_CBC_SHA | DHE-DSS-AES256-SHA | [RFC5246] | +| 0x0039 | TLS_DHE_RSA_WITH_AES_256_CBC_SHA | DHE-RSA-AES256-SHA | [RFC5246] | +| 0x003A | TLS_DH_anon_WITH_AES_256_CBC_SHA | ADH-AES256-SHA | [RFC5246] | +| 0x003B | TLS_RSA_WITH_NULL_SHA256 | NULL-SHA256 | [RFC5246] | +| 0x003C | TLS_RSA_WITH_AES_128_CBC_SHA256 | AES128-SHA256 | [RFC5246] | +| 0x003D | TLS_RSA_WITH_AES_256_CBC_SHA256 | AES256-SHA256 | [RFC5246] | +| 0x003E | TLS_DH_DSS_WITH_AES_128_CBC_SHA256 | DH-DSS-AES128-SHA256 | [RFC5246] | +| 0x003F | TLS_DH_RSA_WITH_AES_128_CBC_SHA256 | DH-RSA-AES128-SHA256 | [RFC5246] | +| 0x0040 | TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 | DHE-DSS-AES128-SHA256 | [RFC5246] | +| 0x0041 | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA | CAMELLIA128-SHA | [RFC5932] | +| 0x0042 | TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA | DH-DSS-CAMELLIA128-SHA | [RFC5932] | +| 0x0043 | TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA | DH-RSA-CAMELLIA128-SHA | [RFC5932] | +| 0x0044 | TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA | DHE-DSS-CAMELLIA128-SHA | [RFC5932] | +| 0x0045 | TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA | DHE-RSA-CAMELLIA128-SHA | [RFC5932] | +| 0x0046 | TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA | ADH-CAMELLIA128-SHA | [RFC5932] | +| 0x0060 | | EXP1024-RC4-MD5 | | +| 0x0061 | | EXP1024-RC2-CBC-MD5 | | +| 0x0062 | | EXP1024-DES-CBC-SHA | | +| 0x0063 | | EXP1024-DHE-DSS-DES-CBC-SHA | | +| 0x0064 | | EXP1024-RC4-SHA | | +| 0x0065 | | EXP1024-DHE-DSS-RC4-SHA | | +| 0x0066 | | DHE-DSS-RC4-SHA | | +| 0x0067 | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 | DHE-RSA-AES128-SHA256 | [RFC5246] | +| 0x0068 | TLS_DH_DSS_WITH_AES_256_CBC_SHA256 | DH-DSS-AES256-SHA256 | [RFC5246] | +| 0x0069 | TLS_DH_RSA_WITH_AES_256_CBC_SHA256 | DH-RSA-AES256-SHA256 | [RFC5246] | +| 0x006A | TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 | DHE-DSS-AES256-SHA256 | [RFC5246] | +| 0x006B | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 | DHE-RSA-AES256-SHA256 | [RFC5246] | +| 0x006C | TLS_DH_anon_WITH_AES_128_CBC_SHA256 | ADH-AES128-SHA256 | [RFC5246] | +| 0x006D | TLS_DH_anon_WITH_AES_256_CBC_SHA256 | ADH-AES256-SHA256 | [RFC5246] | +| 0x0080 | | GOST94-GOST89-GOST89 | | +| 0x0081 | | GOST2001-GOST89-GOST89 | | +| 0x0082 | | GOST94-NULL-GOST94 | | +| 0x0083 | | GOST2001-NULL-GOST94 | | +| 0x0084 | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA | CAMELLIA256-SHA | [RFC5932] | +| 0x0085 | TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA | DH-DSS-CAMELLIA256-SHA | [RFC5932] | +| 0x0086 | TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA | DH-RSA-CAMELLIA256-SHA | [RFC5932] | +| 0x0087 | TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA | DHE-DSS-CAMELLIA256-SHA | [RFC5932] | +| 0x0088 | TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA | DHE-RSA-CAMELLIA256-SHA | [RFC5932] | +| 0x0089 | TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA | ADH-CAMELLIA256-SHA | [RFC5932] | +| 0x008A | TLS_PSK_WITH_RC4_128_SHA | PSK-RC4-SHA | [RFC4279][RFC6347] | +| 0x008B | TLS_PSK_WITH_3DES_EDE_CBC_SHA | PSK-3DES-EDE-CBC-SHA | [RFC4279] | +| 0x008C | TLS_PSK_WITH_AES_128_CBC_SHA | PSK-AES128-CBC-SHA | [RFC4279] | +| 0x008D | TLS_PSK_WITH_AES_256_CBC_SHA | PSK-AES256-CBC-SHA | [RFC4279] | +| 0x008E | TLS_DHE_PSK_WITH_RC4_128_SHA | DHE-PSK-RC4-SHA | [RFC4279][RFC6347] | +| 0x008F | TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA | DHE-PSK-3DES-EDE-CBC-SHA | [RFC4279] | +| 0x0090 | TLS_DHE_PSK_WITH_AES_128_CBC_SHA | DHE-PSK-AES128-CBC-SHA | [RFC4279] | +| 0x0091 | TLS_DHE_PSK_WITH_AES_256_CBC_SHA | DHE-PSK-AES256-CBC-SHA | [RFC4279] | +| 0x0092 | TLS_RSA_PSK_WITH_RC4_128_SHA | RSA-PSK-RC4-SHA | [RFC4279][RFC6347] | +| 0x0093 | TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA | RSA-PSK-3DES-EDE-CBC-SHA | [RFC4279] | +| 0x0094 | TLS_RSA_PSK_WITH_AES_128_CBC_SHA | RSA-PSK-AES128-CBC-SHA | [RFC4279] | +| 0x0095 | TLS_RSA_PSK_WITH_AES_256_CBC_SHA | RSA-PSK-AES256-CBC-SHA | [RFC4279] | +| 0x0096 | TLS_RSA_WITH_SEED_CBC_SHA | SEED-SHA | [RFC4162] | +| 0x0097 | TLS_DH_DSS_WITH_SEED_CBC_SHA | DH-DSS-SEED-SHA | [RFC4162] | +| 0x0098 | TLS_DH_RSA_WITH_SEED_CBC_SHA | DH-RSA-SEED-SHA | [RFC4162] | +| 0x0099 | TLS_DHE_DSS_WITH_SEED_CBC_SHA | DHE-DSS-SEED-SHA | [RFC4162] | +| 0x009A | TLS_DHE_RSA_WITH_SEED_CBC_SHA | DHE-RSA-SEED-SHA | [RFC4162] | +| 0x009B | TLS_DH_anon_WITH_SEED_CBC_SHA | ADH-SEED-SHA | [RFC4162] | +| 0x009C | TLS_RSA_WITH_AES_128_GCM_SHA256 | AES128-GCM-SHA256 | [RFC5288] | +| 0x009D | TLS_RSA_WITH_AES_256_GCM_SHA384 | AES256-GCM-SHA384 | [RFC5288] | +| 0x009E | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | DHE-RSA-AES128-GCM-SHA256 | [RFC5288] | +| 0x009F | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | DHE-RSA-AES256-GCM-SHA384 | [RFC5288] | +| 0x00A0 | TLS_DH_RSA_WITH_AES_128_GCM_SHA256 | DH-RSA-AES128-GCM-SHA256 | [RFC5288] | +| 0x00A1 | TLS_DH_RSA_WITH_AES_256_GCM_SHA384 | DH-RSA-AES256-GCM-SHA384 | [RFC5288] | +| 0x00A2 | TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 | DHE-DSS-AES128-GCM-SHA256 | [RFC5288] | +| 0x00A3 | TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 | DHE-DSS-AES256-GCM-SHA384 | [RFC5288] | +| 0x00A4 | TLS_DH_DSS_WITH_AES_128_GCM_SHA256 | DH-DSS-AES128-GCM-SHA256 | [RFC5288] | +| 0x00A5 | TLS_DH_DSS_WITH_AES_256_GCM_SHA384 | DH-DSS-AES256-GCM-SHA384 | [RFC5288] | +| 0x00A6 | TLS_DH_anon_WITH_AES_128_GCM_SHA256 | ADH-AES128-GCM-SHA256 | [RFC5288] | +| 0x00A7 | TLS_DH_anon_WITH_AES_256_GCM_SHA384 | ADH-AES256-GCM-SHA384 | [RFC5288] | +| 0x00A8 | TLS_PSK_WITH_AES_128_GCM_SHA256 | PSK-AES128-GCM-SHA256 | [RFC5487] | +| 0x00A9 | TLS_PSK_WITH_AES_256_GCM_SHA384 | PSK-AES256-GCM-SHA384 | [RFC5487] | +| 0x00AA | TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 | DHE-PSK-AES128-GCM-SHA256 | [RFC5487] | +| 0x00AB | TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 | DHE-PSK-AES256-GCM-SHA384 | [RFC5487] | +| 0x00AC | TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 | RSA-PSK-AES128-GCM-SHA256 | [RFC5487] | +| 0x00AD | TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 | RSA-PSK-AES256-GCM-SHA384 | [RFC5487] | +| 0x00AE | TLS_PSK_WITH_AES_128_CBC_SHA256 | PSK-AES128-CBC-SHA256 | [RFC5487] | +| 0x00AF | TLS_PSK_WITH_AES_256_CBC_SHA384 | PSK-AES256-CBC-SHA384 | [RFC5487] | +| 0x00B0 | TLS_PSK_WITH_NULL_SHA256 | PSK-NULL-SHA256 | [RFC5487] | +| 0x00B1 | TLS_PSK_WITH_NULL_SHA384 | PSK-NULL-SHA384 | [RFC5487] | +| 0x00B2 | TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 | DHE-PSK-AES128-CBC-SHA256 | [RFC5487] | +| 0x00B3 | TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 | DHE-PSK-AES256-CBC-SHA384 | [RFC5487] | +| 0x00B4 | TLS_DHE_PSK_WITH_NULL_SHA256 | DHE-PSK-NULL-SHA256 | [RFC5487] | +| 0x00B5 | TLS_DHE_PSK_WITH_NULL_SHA384 | DHE-PSK-NULL-SHA384 | [RFC5487] | +| 0x00B6 | TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 | RSA-PSK-AES128-CBC-SHA256 | [RFC5487] | +| 0x00B7 | TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 | RSA-PSK-AES256-CBC-SHA384 | [RFC5487] | +| 0x00B8 | TLS_RSA_PSK_WITH_NULL_SHA256 | RSA-PSK-NULL-SHA256 | [RFC5487] | +| 0x00B9 | TLS_RSA_PSK_WITH_NULL_SHA384 | RSA-PSK-NULL-SHA384 | [RFC5487] | +| 0x00BA | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 | CAMELLIA128-SHA256 | [RFC5932] | +| 0x00BD | TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 | DHE-DSS-CAMELLIA128-SHA256 | [RFC5932] | +| 0x00BE | TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 | DHE-RSA-CAMELLIA128-SHA256 | [RFC5932] | +| 0x00BF | TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 | ADH-CAMELLIA128-SHA256 | [RFC5932] | +| 0x00C0 | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 | CAMELLIA256-SHA256 | [RFC5932] | +| 0x00C3 | TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 | DHE-DSS-CAMELLIA256-SHA256 | [RFC5932] | +| 0x00C4 | TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 | DHE-RSA-CAMELLIA256-SHA256 | [RFC5932] | +| 0x00C5 | TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 | ADH-CAMELLIA256-SHA256 | [RFC5932] | +| 0x00FF | TLS_EMPTY_RENEGOTIATION_INFO_SCSV | | [RFC5746] | +| 0x5600 | TLS_FALLBACK_SCSV | | [RFC7507] | +| 0xC001 | TLS_ECDH_ECDSA_WITH_NULL_SHA | ECDH-ECDSA-NULL-SHA | [RFC8422] | +| 0xC002 | TLS_ECDH_ECDSA_WITH_RC4_128_SHA | ECDH-ECDSA-RC4-SHA | [RFC8422][RFC6347] | +| 0xC003 | TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA | ECDH-ECDSA-DES-CBC3-SHA | [RFC8422] | +| 0xC004 | TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA | ECDH-ECDSA-AES128-SHA | [RFC8422] | +| 0xC005 | TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA | ECDH-ECDSA-AES256-SHA | [RFC8422] | +| 0xC006 | TLS_ECDHE_ECDSA_WITH_NULL_SHA | ECDHE-ECDSA-NULL-SHA | [RFC8422] | +| 0xC007 | TLS_ECDHE_ECDSA_WITH_RC4_128_SHA | ECDHE-ECDSA-RC4-SHA | [RFC8422][RFC6347] | +| 0xC008 | TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA | ECDHE-ECDSA-DES-CBC3-SHA | [RFC8422] | +| 0xC009 | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA | ECDHE-ECDSA-AES128-SHA | [RFC8422] | +| 0xC00A | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA | ECDHE-ECDSA-AES256-SHA | [RFC8422] | +| 0xC00B | TLS_ECDH_RSA_WITH_NULL_SHA | ECDH-RSA-NULL-SHA | [RFC8422] | +| 0xC00C | TLS_ECDH_RSA_WITH_RC4_128_SHA | ECDH-RSA-RC4-SHA | [RFC8422][RFC6347] | +| 0xC00D | TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA | ECDH-RSA-DES-CBC3-SHA | [RFC8422] | +| 0xC00E | TLS_ECDH_RSA_WITH_AES_128_CBC_SHA | ECDH-RSA-AES128-SHA | [RFC8422] | +| 0xC00F | TLS_ECDH_RSA_WITH_AES_256_CBC_SHA | ECDH-RSA-AES256-SHA | [RFC8422] | +| 0xC010 | TLS_ECDHE_RSA_WITH_NULL_SHA | ECDHE-RSA-NULL-SHA | [RFC8422] | +| 0xC011 | TLS_ECDHE_RSA_WITH_RC4_128_SHA | ECDHE-RSA-RC4-SHA | [RFC8422][RFC6347] | +| 0xC012 | TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA | ECDHE-RSA-DES-CBC3-SHA | [RFC8422] | +| 0xC013 | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | ECDHE-RSA-AES128-SHA | [RFC8422] | +| 0xC014 | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | ECDHE-RSA-AES256-SHA | [RFC8422] | +| 0xC015 | TLS_ECDH_anon_WITH_NULL_SHA | AECDH-NULL-SHA | [RFC8422] | +| 0xC016 | TLS_ECDH_anon_WITH_RC4_128_SHA | AECDH-RC4-SHA | [RFC8422][RFC6347] | +| 0xC017 | TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA | AECDH-DES-CBC3-SHA | [RFC8422] | +| 0xC018 | TLS_ECDH_anon_WITH_AES_128_CBC_SHA | AECDH-AES128-SHA | [RFC8422] | +| 0xC019 | TLS_ECDH_anon_WITH_AES_256_CBC_SHA | AECDH-AES256-SHA | [RFC8422] | +| 0xC01A | TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA | SRP-3DES-EDE-CBC-SHA | [RFC5054] | +| 0xC01B | TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA | SRP-RSA-3DES-EDE-CBC-SHA | [RFC5054] | +| 0xC01C | TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA | SRP-DSS-3DES-EDE-CBC-SHA | [RFC5054] | +| 0xC01D | TLS_SRP_SHA_WITH_AES_128_CBC_SHA | SRP-AES-128-CBC-SHA | [RFC5054] | +| 0xC01E | TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA | SRP-RSA-AES-128-CBC-SHA | [RFC5054] | +| 0xC01F | TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA | SRP-DSS-AES-128-CBC-SHA | [RFC5054] | +| 0xC020 | TLS_SRP_SHA_WITH_AES_256_CBC_SHA | SRP-AES-256-CBC-SHA | [RFC5054] | +| 0xC021 | TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA | SRP-RSA-AES-256-CBC-SHA | [RFC5054] | +| 0xC022 | TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA | SRP-DSS-AES-256-CBC-SHA | [RFC5054] | +| 0xC023 | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 | ECDHE-ECDSA-AES128-SHA256 | [RFC5289] | +| 0xC024 | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 | ECDHE-ECDSA-AES256-SHA384 | [RFC5289] | +| 0xC025 | TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 | ECDH-ECDSA-AES128-SHA256 | [RFC5289] | +| 0xC026 | TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 | ECDH-ECDSA-AES256-SHA384 | [RFC5289] | +| 0xC027 | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | ECDHE-RSA-AES128-SHA256 | [RFC5289] | +| 0xC028 | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | ECDHE-RSA-AES256-SHA384 | [RFC5289] | +| 0xC029 | TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 | ECDH-RSA-AES128-SHA256 | [RFC5289] | +| 0xC02A | TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 | ECDH-RSA-AES256-SHA384 | [RFC5289] | +| 0xC02B | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 | ECDHE-ECDSA-AES128-GCM-SHA256 | [RFC5289] | +| 0xC02C | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | ECDHE-ECDSA-AES256-GCM-SHA384 | [RFC5289] | +| 0xC02D | TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 | ECDH-ECDSA-AES128-GCM-SHA256 | [RFC5289] | +| 0xC02E | TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 | ECDH-ECDSA-AES256-GCM-SHA384 | [RFC5289] | +| 0xC02F | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | ECDHE-RSA-AES128-GCM-SHA256 | [RFC5289] | +| 0xC030 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | ECDHE-RSA-AES256-GCM-SHA384 | [RFC5289] | +| 0xC031 | TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 | ECDH-RSA-AES128-GCM-SHA256 | [RFC5289] | +| 0xC032 | TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 | ECDH-RSA-AES256-GCM-SHA384 | [RFC5289] | +| 0xC033 | TLS_ECDHE_PSK_WITH_RC4_128_SHA | ECDHE-PSK-RC4-SHA | [RFC5489][RFC6347] | +| 0xC034 | TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA | ECDHE-PSK-3DES-EDE-CBC-SHA | [RFC5489] | +| 0xC035 | TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA | ECDHE-PSK-AES128-CBC-SHA | [RFC5489] | +| 0xC036 | TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA | ECDHE-PSK-AES256-CBC-SHA | [RFC5489] | +| 0xC037 | TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 | ECDHE-PSK-AES128-CBC-SHA256 | [RFC5489] | +| 0xC038 | TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 | ECDHE-PSK-AES256-CBC-SHA384 | [RFC5489] | +| 0xC039 | TLS_ECDHE_PSK_WITH_NULL_SHA | ECDHE-PSK-NULL-SHA | [RFC5489] | +| 0xC03A | TLS_ECDHE_PSK_WITH_NULL_SHA256 | ECDHE-PSK-NULL-SHA256 | [RFC5489] | +| 0xC03B | TLS_ECDHE_PSK_WITH_NULL_SHA384 | ECDHE-PSK-NULL-SHA384 | [RFC5489] | +| 0xC03C | TLS_RSA_WITH_ARIA_128_CBC_SHA256 | ARIA128-SHA256 | [RFC6209] | +| 0xC03D | TLS_RSA_WITH_ARIA_256_CBC_SHA384 | ARIA256-SHA384 | [RFC6209] | +| 0xC044 | TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 | DHE-RSA-ARIA128-SHA256 | [RFC6209] | +| 0xC045 | TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 | DHE-RSA-ARIA256-SHA384 | [RFC6209] | +| 0xC048 | TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 | ECDHE-ECDSA-ARIA128-SHA256 | [RFC6209] | +| 0xC049 | TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 | ECDHE-ECDSA-ARIA256-SHA384 | [RFC6209] | +| 0xC04A | TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256 | ECDH-ECDSA-ARIA128-SHA256 | [RFC6209] | +| 0xC04B | TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384 | ECDH-ECDSA-ARIA256-SHA384 | [RFC6209] | +| 0xC04C | TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 | ECDHE-ARIA128-SHA256 | [RFC6209] | +| 0xC04D | TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 | ECDHE-ARIA256-SHA384 | [RFC6209] | +| 0xC04E | TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256 | ECDH-ARIA128-SHA256 | [RFC6209] | +| 0xC04F | TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384 | ECDH-ARIA256-SHA384 | [RFC6209] | +| 0xC050 | TLS_RSA_WITH_ARIA_128_GCM_SHA256 | ARIA128-GCM-SHA256 | [RFC6209] | +| 0xC051 | TLS_RSA_WITH_ARIA_256_GCM_SHA384 | ARIA256-GCM-SHA384 | [RFC6209] | +| 0xC052 | TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 | DHE-RSA-ARIA128-GCM-SHA256 | [RFC6209] | +| 0xC053 | TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 | DHE-RSA-ARIA256-GCM-SHA384 | [RFC6209] | +| 0xC056 | TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256 | DHE-DSS-ARIA128-GCM-SHA256 | [RFC6209] | +| 0xC057 | TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384 | DHE-DSS-ARIA256-GCM-SHA384 | [RFC6209] | +| 0xC05C | TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 | ECDHE-ECDSA-ARIA128-GCM-SHA256 | [RFC6209] | +| 0xC05D | TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 | ECDHE-ECDSA-ARIA256-GCM-SHA384 | [RFC6209] | +| 0xC05E | TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256 | ECDH-ECDSA-ARIA128-GCM-SHA256 | [RFC6209] | +| 0xC05F | TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384 | ECDH-ECDSA-ARIA256-GCM-SHA384 | [RFC6209] | +| 0xC060 | TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 | ECDHE-ARIA128-GCM-SHA256 | [RFC6209] | +| 0xC061 | TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 | ECDHE-ARIA256-GCM-SHA384 | [RFC6209] | +| 0xC062 | TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256 | ECDH-ARIA128-GCM-SHA256 | [RFC6209] | +| 0xC063 | TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384 | ECDH-ARIA256-GCM-SHA384 | [RFC6209] | +| 0xC064 | TLS_PSK_WITH_ARIA_128_CBC_SHA256 | PSK-ARIA128-SHA256 | [RFC6209] | +| 0xC065 | TLS_PSK_WITH_ARIA_256_CBC_SHA384 | PSK-ARIA256-SHA384 | [RFC6209] | +| 0xC066 | TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256 | DHE-PSK-ARIA128-SHA256 | [RFC6209] | +| 0xC067 | TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384 | DHE-PSK-ARIA256-SHA384 | [RFC6209] | +| 0xC068 | TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256 | RSA-PSK-ARIA128-SHA256 | [RFC6209] | +| 0xC069 | TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384 | RSA-PSK-ARIA256-SHA384 | [RFC6209] | +| 0xC06A | TLS_PSK_WITH_ARIA_128_GCM_SHA256 | PSK-ARIA128-GCM-SHA256 | [RFC6209] | +| 0xC06B | TLS_PSK_WITH_ARIA_256_GCM_SHA384 | PSK-ARIA256-GCM-SHA384 | [RFC6209] | +| 0xC06C | TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 | DHE-PSK-ARIA128-GCM-SHA256 | [RFC6209] | +| 0xC06D | TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 | DHE-PSK-ARIA256-GCM-SHA384 | [RFC6209] | +| 0xC06E | TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 | RSA-PSK-ARIA128-GCM-SHA256 | [RFC6209] | +| 0xC06F | TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 | RSA-PSK-ARIA256-GCM-SHA384 | [RFC6209] | +| 0xC070 | TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 | ECDHE-PSK-ARIA128-SHA256 | [RFC6209] | +| 0xC071 | TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 | ECDHE-PSK-ARIA256-SHA384 | [RFC6209] | +| 0xC072 | TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 | ECDHE-ECDSA-CAMELLIA128-SHA256 | [RFC6367] | +| 0xC073 | TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 | ECDHE-ECDSA-CAMELLIA256-SHA384 | [RFC6367] | +| 0xC074 | TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 | ECDH-ECDSA-CAMELLIA128-SHA256 | [RFC6367] | +| 0xC075 | TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 | ECDH-ECDSA-CAMELLIA256-SHA384 | [RFC6367] | +| 0xC076 | TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 | ECDHE-RSA-CAMELLIA128-SHA256 | [RFC6367] | +| 0xC077 | TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 | ECDHE-RSA-CAMELLIA256-SHA384 | [RFC6367] | +| 0xC078 | TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 | ECDH-CAMELLIA128-SHA256 | [RFC6367] | +| 0xC079 | TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 | ECDH-CAMELLIA256-SHA384 | [RFC6367] | +| 0xC07A | TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 | CAMELLIA128-GCM-SHA256 | [RFC6367] | +| 0xC07B | TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 | CAMELLIA256-GCM-SHA384 | [RFC6367] | +| 0xC07C | TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 | DHE-RSA-CAMELLIA128-GCM-SHA256 | [RFC6367] | +| 0xC07D | TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 | DHE-RSA-CAMELLIA256-GCM-SHA384 | [RFC6367] | +| 0xC086 | TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 | ECDHE-ECDSA-CAMELLIA128-GCM-SHA256 | [RFC6367] | +| 0xC087 | TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 | ECDHE-ECDSA-CAMELLIA256-GCM-SHA384 | [RFC6367] | +| 0xC088 | TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 | ECDH-ECDSA-CAMELLIA128-GCM-SHA256 | [RFC6367] | +| 0xC089 | TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 | ECDH-ECDSA-CAMELLIA256-GCM-SHA384 | [RFC6367] | +| 0xC08A | TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 | ECDHE-CAMELLIA128-GCM-SHA256 | [RFC6367] | +| 0xC08B | TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 | ECDHE-CAMELLIA256-GCM-SHA384 | [RFC6367] | +| 0xC08C | TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 | ECDH-CAMELLIA128-GCM-SHA256 | [RFC6367] | +| 0xC08D | TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 | ECDH-CAMELLIA256-GCM-SHA384 | [RFC6367] | +| 0xC08E | TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 | PSK-CAMELLIA128-GCM-SHA256 | [RFC6367] | +| 0xC08F | TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 | PSK-CAMELLIA256-GCM-SHA384 | [RFC6367] | +| 0xC090 | TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 | DHE-PSK-CAMELLIA128-GCM-SHA256 | [RFC6367] | +| 0xC091 | TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 | DHE-PSK-CAMELLIA256-GCM-SHA384 | [RFC6367] | +| 0xC092 | TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 | RSA-PSK-CAMELLIA128-GCM-SHA256 | [RFC6367] | +| 0xC093 | TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 | RSA-PSK-CAMELLIA256-GCM-SHA384 | [RFC6367] | +| 0xC094 | TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 | PSK-CAMELLIA128-SHA256 | [RFC6367] | +| 0xC095 | TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 | PSK-CAMELLIA256-SHA384 | [RFC6367] | +| 0xC096 | TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 | DHE-PSK-CAMELLIA128-SHA256 | [RFC6367] | +| 0xC097 | TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 | DHE-PSK-CAMELLIA256-SHA384 | [RFC6367] | +| 0xC098 | TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 | RSA-PSK-CAMELLIA128-SHA256 | [RFC6367] | +| 0xC099 | TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 | RSA-PSK-CAMELLIA256-SHA384 | [RFC6367] | +| 0xC09A | TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 | ECDHE-PSK-CAMELLIA128-SHA256 | [RFC6367] | +| 0xC09B | TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 | ECDHE-PSK-CAMELLIA256-SHA384 | [RFC6367] | +| 0xC09C | TLS_RSA_WITH_AES_128_CCM | AES128-CCM | [RFC6655] | +| 0xC09D | TLS_RSA_WITH_AES_256_CCM | AES256-CCM | [RFC6655] | +| 0xC09E | TLS_DHE_RSA_WITH_AES_128_CCM | DHE-RSA-AES128-CCM | [RFC6655] | +| 0xC09F | TLS_DHE_RSA_WITH_AES_256_CCM | DHE-RSA-AES256-CCM | [RFC6655] | +| 0xC0A0 | TLS_RSA_WITH_AES_128_CCM_8 | AES128-CCM8 | [RFC6655] | +| 0xC0A1 | TLS_RSA_WITH_AES_256_CCM_8 | AES256-CCM8 | [RFC6655] | +| 0xC0A2 | TLS_DHE_RSA_WITH_AES_128_CCM_8 | DHE-RSA-AES128-CCM8 | [RFC6655] | +| 0xC0A3 | TLS_DHE_RSA_WITH_AES_256_CCM_8 | DHE-RSA-AES256-CCM8 | [RFC6655] | +| 0xC0A4 | TLS_PSK_WITH_AES_128_CCM | PSK-AES128-CCM | [RFC6655] | +| 0xC0A5 | TLS_PSK_WITH_AES_256_CCM | PSK-AES256-CCM | [RFC6655] | +| 0xC0A6 | TLS_DHE_PSK_WITH_AES_128_CCM | DHE-PSK-AES128-CCM | [RFC6655] | +| 0xC0A7 | TLS_DHE_PSK_WITH_AES_256_CCM | DHE-PSK-AES256-CCM | [RFC6655] | +| 0xC0A8 | TLS_PSK_WITH_AES_128_CCM_8 | PSK-AES128-CCM8 | [RFC6655] | +| 0xC0A9 | TLS_PSK_WITH_AES_256_CCM_8 | PSK-AES256-CCM8 | [RFC6655] | +| 0xC0AA | TLS_PSK_DHE_WITH_AES_128_CCM_8 | DHE-PSK-AES128-CCM8 | [RFC6655] | +| 0xC0AB | TLS_PSK_DHE_WITH_AES_256_CCM_8 | DHE-PSK-AES256-CCM8 | [RFC6655] | +| 0xC0AC | TLS_ECDHE_ECDSA_WITH_AES_128_CCM | ECDHE-ECDSA-AES128-CCM | [RFC7251] | +| 0xC0AD | TLS_ECDHE_ECDSA_WITH_AES_256_CCM | ECDHE-ECDSA-AES256-CCM | [RFC7251] | +| 0xC0AE | TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 | ECDHE-ECDSA-AES128-CCM8 | [RFC7251] | +| 0xC0AF | TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 | ECDHE-ECDSA-AES256-CCM8 | [RFC7251] | +| 0xC100 | TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC | GOST2012-KUZNYECHIK-KUZNYECHIKOMAC | [RFC9189] | +| 0xC101 | TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC | GOST2012-MAGMA-MAGMAOMAC | [RFC9189] | +| 0xC102 | TLS_GOSTR341112_256_WITH_28147_CNT_IMIT | IANA-GOST2012-GOST8912-GOST8912 | [RFC9189] | +| 0xCC13 | | ECDHE-RSA-CHACHA20-POLY1305-OLD | | +| 0xCC14 | | ECDHE-ECDSA-CHACHA20-POLY1305-OLD | | +| 0xCC15 | | DHE-RSA-CHACHA20-POLY1305-OLD | | +| 0xCCA8 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | ECDHE-RSA-CHACHA20-POLY1305 | [RFC7905] | +| 0xCCA9 | TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 | ECDHE-ECDSA-CHACHA20-POLY1305 | [RFC7905] | +| 0xCCAA | TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | DHE-RSA-CHACHA20-POLY1305 | [RFC7905] | +| 0xCCAB | TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 | PSK-CHACHA20-POLY1305 | [RFC7905] | +| 0xCCAC | TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 | ECDHE-PSK-CHACHA20-POLY1305 | [RFC7905] | +| 0xCCAD | TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 | DHE-PSK-CHACHA20-POLY1305 | [RFC7905] | +| 0xCCAE | TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 | RSA-PSK-CHACHA20-POLY1305 | [RFC7905] | +| 0xD001 | TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 | ECDHE-PSK-AES128-GCM-SHA256 | [RFC8442] | +| 0xE011 | | ECDHE-ECDSA-SM4-CBC-SM3 | | +| 0xE051 | | ECDHE-ECDSA-SM4-GCM-SM3 | | +| 0xE052 | | ECDHE-ECDSA-SM4-CCM-SM3 | | +| 0xFF00 | | GOST-MD5 | | +| 0xFF01 | | GOST-GOST94 | | +| 0xFF02 | | GOST-GOST89MAC | | +| 0xFF03 | | GOST-GOST89STREAM | | diff --git a/curl/docs/CIPHERS.md b/curl/docs/CIPHERS.md new file mode 100644 index 0000000..8a8bc3d --- /dev/null +++ b/curl/docs/CIPHERS.md @@ -0,0 +1,273 @@ + + +## curl cipher options + +A TLS handshake involves many parameters which take part in the negotiation +between client and server in order to agree on the TLS version and set of +algorithms to use for a connection. + +What has become known as a "cipher" or better "cipher suite" in TLS +are names for specific combinations of +[key exchange](https://en.wikipedia.org/wiki/Key_exchange), +[bulk encryption](https://en.wikipedia.org/wiki/Link_encryption), +[message authentication code](https://en.wikipedia.org/wiki/Message_authentication_code) +and with TLSv1.3 the +[authenticated encryption](https://en.wikipedia.org/wiki/Authenticated_encryption). +In addition, there are other parameters that influence the TLS handshake, like +[DHE](https://en.wikipedia.org/wiki/Diffie%e2%80%93Hellman_key_exchange) "groups" +and [ECDHE](https://en.wikipedia.org/wiki/Elliptic-curve_Diffie%e2%80%93Hellman) +with its "curves". + +### History + +curl's way of letting users configure these settings closely followed OpenSSL +in its API. TLS learned new parameters, OpenSSL added new API functions and +curl added command line options. + +Several other TLS backends followed the OpenSSL approach, more or less closely, +and curl maps the command line options to these TLS backends. Some TLS +backends do not support all of it and command line options are either +ignored or lead to an error. + +Many examples below show the OpenSSL-like use of these options. GnuTLS +however chose a different approach. These are described in a separate +section further below. + +## ciphers, the OpenSSL way + +With curl's option +[`--tls13-ciphers`](https://curl.se/docs/manpage.html#--tls13-ciphers) +or +[`CURLOPT_TLS13_CIPHERS`](https://curl.se/libcurl/c/CURLOPT_TLS13_CIPHERS.html) +users can control which cipher suites to consider when negotiating TLS 1.3 +connections. With option +[`--ciphers`](https://curl.se/docs/manpage.html#--ciphers) +or +[`CURLOPT_SSL_CIPHER_LIST`](https://curl.se/libcurl/c/CURLOPT_SSL_CIPHER_LIST.html) +users can control which cipher suites to consider when negotiating +TLS 1.2 (1.1, 1.0) connections. + +By default, curl may negotiate TLS 1.3 and TLS 1.2 connections, so the cipher +suites considered when negotiating a TLS connection are a union of the TLS 1.3 +and TLS 1.2 cipher suites. If you want curl to consider only TLS 1.3 cipher +suites for the connection, you have to set the minimum TLS version to 1.3 by +using [`--tlsv1.3`](https://curl.se/docs/manpage.html#--tlsv13) +or [`CURLOPT_SSLVERSION`](https://curl.se/libcurl/c/CURLOPT_SSLVERSION.html) +with `CURL_SSLVERSION_TLSv1_3`. + +Both the TLS 1.3 and TLS 1.2 cipher options expect a list of cipher suites +separated by colons (`:`). This list is parsed opportunistically, cipher suites +that are not recognized or implemented are ignored. As long as there is at +least one recognized cipher suite in the list, the list is considered valid. + +For both the TLS 1.3 and TLS 1.2 cipher options, the order in which the +cipher suites are specified determine the preference of them. When negotiating +a TLS connection the server picks a cipher suite from the intersection of the +cipher suites supported by the server and the cipher suites sent by curl. If +the server is configured to honor the client's cipher preference, the first +common cipher suite in the list sent by curl is chosen. + +### TLS 1.3 cipher suites + +Setting TLS 1.3 cipher suites is supported by curl with +OpenSSL (1.1.1+, curl 7.61.0+), LibreSSL (3.4.1+, curl 8.3.0+), +wolfSSL (curl 8.10.0+) and mbedTLS (3.6.0+, curl 8.10.0+). + +The list of cipher suites that can be used for the `--tls13-ciphers` option: +``` +TLS_AES_128_GCM_SHA256 +TLS_AES_256_GCM_SHA384 +TLS_CHACHA20_POLY1305_SHA256 +TLS_AES_128_CCM_SHA256 +TLS_AES_128_CCM_8_SHA256 +``` + +#### wolfSSL notes + +In addition to above list the following cipher suites can be used: +`TLS_SM4_GCM_SM3` `TLS_SM4_CCM_SM3` `TLS_SHA256_SHA256` `TLS_SHA384_SHA384`. +Usage of these cipher suites is not recommended. (The last two cipher suites +are NULL ciphers, offering no encryption whatsoever.) + +### TLS 1.2 (1.1, 1.0) cipher suites + +Setting TLS 1.2 cipher suites is supported by curl with OpenSSL, LibreSSL, +BoringSSL, mbedTLS (curl 8.8.0+), wolfSSL (curl 7.53.0+), +Secure Transport (curl 7.77.0+) and BearSSL (curl 7.83.0+). Schannel does not +support setting cipher suites directly, but does support setting algorithms +(curl 7.61.0+), see Schannel notes below. + +For TLS 1.2 cipher suites there are multiple naming schemes, the two most used +are with OpenSSL names (e.g. `ECDHE-RSA-AES128-GCM-SHA256`) and IANA names +(e.g. `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`). IANA names of TLS 1.2 cipher +suites look similar to TLS 1.3 cipher suite names, to distinguish them note +that TLS 1.2 names contain `_WITH_`, while TLS 1.3 names do not. When setting +TLS 1.2 cipher suites with curl it is recommended that you use OpenSSL names +as these are most widely recognized by the supported SSL backends. + +The complete list of cipher suites that may be considered for the `--ciphers` +option is extensive, it consists of more than 300 ciphers suites. However, +nowadays for most of them their usage is discouraged, and support for a lot of +them have been removed from the various SSL backends, if ever implemented at +all. + +A shortened list (based on [recommendations by +Mozilla](https://wiki.mozilla.org/Security/Server_Side_TLS)) of cipher suites, +which are (mostly) supported by all SSL backends, that can be used for the +`--ciphers` option: +``` +ECDHE-ECDSA-AES128-GCM-SHA256 +ECDHE-RSA-AES128-GCM-SHA256 +ECDHE-ECDSA-AES256-GCM-SHA384 +ECDHE-RSA-AES256-GCM-SHA384 +ECDHE-ECDSA-CHACHA20-POLY1305 +ECDHE-RSA-CHACHA20-POLY1305 +DHE-RSA-AES128-GCM-SHA256 +DHE-RSA-AES256-GCM-SHA384 +DHE-RSA-CHACHA20-POLY1305 +ECDHE-ECDSA-AES128-SHA256 +ECDHE-RSA-AES128-SHA256 +ECDHE-ECDSA-AES128-SHA +ECDHE-RSA-AES128-SHA +ECDHE-ECDSA-AES256-SHA384 +ECDHE-RSA-AES256-SHA384 +ECDHE-ECDSA-AES256-SHA +ECDHE-RSA-AES256-SHA +DHE-RSA-AES128-SHA256 +DHE-RSA-AES256-SHA256 +AES128-GCM-SHA256 +AES256-GCM-SHA384 +AES128-SHA256 +AES256-SHA256 +AES128-SHA +AES256-SHA +DES-CBC3-SHA +``` + +See this [list](https://github.com/curl/curl/blob/master/docs/CIPHERS-TLS12.md) +for a complete list of TLS 1.2 cipher suites. + +#### OpenSSL notes + +In addition to specifying a list of cipher suites, OpenSSL also accepts a +format with specific cipher strings (like `TLSv1.2`, `AESGCM`, `CHACHA20`) and +`!`, `-` and `+` operators. Refer to the +[OpenSSL cipher documentation](https://docs.openssl.org/master/man1/openssl-ciphers/#cipher-list-format) +for further information on that format. + +#### Schannel notes + +Schannel does not support setting individual TLS 1.2 cipher suites directly. +It only allows the enabling and disabling of encryption algorithms. These are +in the form of `CALG_xxx`, see the [Schannel `ALG_ID` +documentation](https://docs.microsoft.com/windows/desktop/SecCrypto/alg-id) +for a list of these algorithms. Also, (since curl 7.77.0) +`SCH_USE_STRONG_CRYPTO` can be given to pass that flag to Schannel, lookup the +[documentation for the Windows version in +use](https://learn.microsoft.com/en-us/windows/win32/secauthn/cipher-suites-in-schannel) +to see how that affects the cipher suite selection. When not specifying the +`--ciphers` and `--tls13-ciphers` options curl passes this flag by default. + +### Examples + +```sh +curl \ + --tls13-ciphers TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 \ + --ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\ +ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 \ + https://example.com/ +``` +Restrict ciphers to `aes128-gcm` and `chacha20`. Works with OpenSSL, LibreSSL, +mbedTLS and wolfSSL. + +```sh +curl \ + --tlsv1.3 \ + --tls13-ciphers TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 \ + https://example.com/ +``` +Restrict to only TLS 1.3 with `aes128-gcm` and `chacha20` ciphers. Works with +OpenSSL, LibreSSL, mbedTLS, wolfSSL and Schannel. + +```sh +curl \ + --ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\ +ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 \ + https://example.com/ +``` +Restrict TLS 1.2 ciphers to `aes128-gcm` and `chacha20`, use default TLS 1.3 +ciphers (if TLS 1.3 is available). Works with OpenSSL, LibreSSL, BoringSSL, +mbedTLS, wolfSSL, Secure Transport and BearSSL. + +## ciphers, the GnuTLS way + +With GnuTLS, curl allows configuration of all TLS parameters via option +[`--ciphers`](https://curl.se/docs/manpage.html#--ciphers) +or +[`CURLOPT_SSL_CIPHER_LIST`](https://curl.se/libcurl/c/CURLOPT_SSL_CIPHER_LIST.html) +only. The option +[`--tls13-ciphers`](https://curl.se/docs/manpage.html#--tls13-ciphers) +or +[`CURLOPT_TLS13_CIPHERS`](https://curl.se/libcurl/c/CURLOPT_TLS13_CIPHERS.html) +is being ignored. + +`--ciphers` is used to set the GnuTLS **priority string** in +the following way: + +* When the set string starts with '+', '-' or '!' it is *appended* to the + priority string libcurl itself generates (separated by ':'). This initial + priority depends other settings such as CURLOPT_SSLVERSION(3), + CURLOPT_TLSAUTH_USERNAME(3) (for SRP) or if HTTP/3 (QUIC) + is being negotiated. +* Otherwise, the set string fully *replaces* the libcurl generated one. While + giving full control to the application, the set priority needs to + provide for everything the transfer may need to negotiate. Example: if + the set priority only allows TLSv1.2, all HTTP/3 attempts fail. + +Users may specify via `--ciphers` anything that GnuTLS supports: ciphers, +key exchange, MAC, compression, TLS versions, signature algorithms, groups, +elliptic curves, certificate types. In addition, GnuTLS has a variety of +other keywords that tweak its operations. Applications or a system +may define new alias names for priority strings that can then be used here. + +Since the order of items in priority strings is significant, it makes no +sense for curl to puzzle other ssl options somehow together. `--ciphers` +is the single way to change priority. + +### Examples + +```sh +curl \ + --ciphers '-CIPHER_ALL:+AES-128-GCM:+CHACHA20-POLY1305' \ + https://example.com/ +``` +Restrict ciphers to `aes128-gcm` and `chacha20` in GnuTLS. + +```sh +curl \ + --ciphers 'NORMAL:-VERS-ALL:+TLS1.3:-AES-256-GCM' \ + https://example.com/ +``` +Restrict to only TLS 1.3 without the `aes256-gcm` cipher. + +```sh +curl \ + --ciphers 'NORMAL:-VERS-ALL:+TLS1.2:-CIPHER_ALL:+CAMELLIA-128-GCM' \ + https://example.com/ +``` +Restrict to only TLS 1.2 with the `CAMELLIA-128-GCM` cipher. + +## Further reading +- [OpenSSL cipher suite names documentation](https://docs.openssl.org/master/man1/openssl-ciphers/#cipher-suite-names) +- [wolfSSL cipher support documentation](https://www.wolfssl.com/documentation/manuals/wolfssl/chapter04.html#cipher-support) +- [mbedTLS cipher suites reference](https://mbed-tls.readthedocs.io/projects/api/en/development/api/file/ssl__ciphersuites_8h/) +- [Schannel cipher suites documentation](https://learn.microsoft.com/en-us/windows/win32/secauthn/cipher-suites-in-schannel) +- [BearSSL supported crypto](https://www.bearssl.org/support.html) +- [Secure Transport cipher suite values](https://developer.apple.com/documentation/security/1550981-ssl_cipher_suite_values) +- [IANA cipher suites list](https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4) +- [Wikipedia cipher suite article](https://en.wikipedia.org/wiki/Cipher_suite) +- [GnuTLS Priority Strings](https://gnutls.org/manual/html_node/Priority-Strings.html) diff --git a/curl/docs/CODE_OF_CONDUCT.md b/curl/docs/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..5c88781 --- /dev/null +++ b/curl/docs/CODE_OF_CONDUCT.md @@ -0,0 +1,38 @@ + + +Contributor Code of Conduct +=========================== + +As contributors and maintainers of this project, we pledge to respect all +people who contribute through reporting issues, posting feature requests, +updating documentation, submitting pull requests or patches, and other +activities. + +We are committed to making participation in this project a harassment-free +experience for everyone, regardless of level of experience, gender, gender +identity and expression, sexual orientation, disability, personal appearance, +body size, race, ethnicity, age, or religion. + +Examples of unacceptable behavior by participants include the use of sexual +language or imagery, derogatory comments or personal attacks, trolling, public +or private harassment, insults, or other unprofessional conduct. + +Project maintainers have the right and responsibility to remove, edit, or +reject comments, commits, code, wiki edits, issues, and other contributions +that are not aligned to this Code of Conduct. Project maintainers who do not +follow the Code of Conduct may be removed from the project team. + +This code of conduct applies both within project spaces and in public spaces +when an individual is representing the project or its community. + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported by opening an issue or contacting one or more of the project +maintainers. + +This Code of Conduct is adapted from the [Contributor +Covenant](https://contributor-covenant.org/), version 1.1.0, available at +[https://contributor-covenant.org/version/1/1/0/](https://contributor-covenant.org/version/1/1/0/) diff --git a/curl/docs/CODE_REVIEW.md b/curl/docs/CODE_REVIEW.md new file mode 100644 index 0000000..bee26a3 --- /dev/null +++ b/curl/docs/CODE_REVIEW.md @@ -0,0 +1,174 @@ + + +# How to do code reviews for curl + +Anyone and everyone is encouraged and welcome to review code submissions in +curl. This is a guide on what to check for and how to perform a successful +code review. + +## All submissions should get reviewed + +All pull requests and patches submitted to the project should be reviewed by +at least one experienced curl maintainer before that code is accepted and +merged. + +## Let the tools and tests take the first rounds + +On initial pull requests, let the tools and tests do their job first and then +start out by helping the submitter understand the test failures and tool +alerts. + +## How to provide feedback to author + +Be nice. Ask questions. Provide examples or suggestions of improvements. +Assume the best intentions. Remember language barriers. + +All first-time contributors can become regulars. Let's help them go there. + +## Is this a change we want? + +If this is not a change that seems to be aligned with the project's path +forward and as such cannot be accepted, inform the author about this sooner +rather than later. Do it gently and explain why and possibly what could be +done to make it more acceptable. + +## API/ABI stability or changed behavior + +Changing the API and the ABI may be fine in a change but it needs to be done +deliberately and carefully. If not, a reviewer must help the author to realize +the mistake. + +curl and libcurl are similarly strict on not modifying existing behavior. API +and ABI stability is not enough, the behavior should also remain intact as far +as possible. + +## Code style + +Most code style nits are detected by checksrc but not all. Only leave remarks +on style deviation once checksrc does not find anymore. + +Minor nits from fresh submitters can also be handled by the maintainer when +merging, in case it seems like the submitter is not clear on what to do. We +want to make the process fun and exciting for new contributors. + +## Encourage consistency + +Make sure new code is written in a similar style as existing code. Naming, +logic, conditions, etc. + +## Are pointers always non-NULL? + +If a function or code rely on pointers being non-NULL, take an extra look if +that seems to be a fair assessment. + +## Asserts + +Conditions that should never be false can be verified with `DEBUGASSERT()` +calls to get caught in tests and debugging easier, while not having an impact +on final or release builds. + +## Memory allocation + +Can the mallocs be avoided? Do not introduce mallocs in any hot paths. If +there are (new) mallocs, can they be combined into fewer calls? + +Are all allocations handled in error paths to avoid leaks and crashes? + +## Thread-safety + +We do not like static variables as they break thread-safety and prevent +functions from being reentrant. + +## Should features be `#ifdef`ed? + +Features and functionality may not be present everywhere and should therefore +be `#ifdef`ed. Additionally, some features should be possible to switch on/off +in the build. + +Write `#ifdef`s to be as little of a "maze" as possible. + +## Does it look portable enough? + +curl runs "everywhere". Does the code take a reasonable stance and enough +precautions to be possible to build and run on most platforms? + +Remember that we live by C89 restrictions. + +## Tests and testability + +New features should be added in conjunction with one or more test cases. +Ideally, functions should also be written so that unit tests can be done to +test individual functions. + +## Documentation + +New features or changes to existing functionality **must** be accompanied by +updated documentation. Submitting that in a separate follow-up pull request is +not OK. A code review must also verify that the submitted documentation update +matches the code submission. + +English is not everyone's first language, be mindful of this and help the +submitter improve the text if it needs a rewrite to read better. + +## Code should not be hard to understand + +Source code should be written to maximize readability and be easy to +understand. + +## Functions should not be large + +A single function should never be large as that makes it hard to follow and +understand all the exit points and state changes. Some existing functions in +curl certainly violate this ground rule but when reviewing new code we should +propose splitting into smaller functions. + +## Duplication is evil + +Anything that looks like duplicated code is a red flag. Anything that seems to +introduce code that we *should* already have or provide needs a closer check. + +## Sensitive data + +When credentials are involved, take an extra look at what happens with this +data. Where it comes from and where it goes. + +## Variable types differ + +`size_t` is not a fixed size. `time_t` can be signed or unsigned and have +different sizes. Relying on variable sizes is a red flag. + +Also remember that endianness and >= 32-bit accesses to unaligned addresses +are problematic areas. + +## Integer overflows + +Be careful about integer overflows. Some variable types can be either 32-bit +or 64-bit. Integer overflows must be detected and acted on *before* they +happen. + +## Dangerous use of functions + +Maybe use of `realloc()` should rather use the dynbuf functions? + +Do not allow new code that grows buffers without using dynbuf. + +Use of C functions that rely on a terminating zero must only be used on data +that really do have a null-terminating zero. + +## Dangerous "data styles" + +Make extra precautions and verify that memory buffers that need a terminating +zero always have exactly that. Buffers *without* a null-terminator must not be +used as input to string functions. + +# Commit messages + +Tightly coupled with a code review is making sure that the commit message is +good. It is the responsibility of the person who merges the code to make sure +that the commit message follows our standard (detailed in the +[CONTRIBUTE](CONTRIBUTE.md) document). This includes making sure the PR +identifies related issues and giving credit to reporters and helpers. diff --git a/curl/docs/CONTRIBUTE.md b/curl/docs/CONTRIBUTE.md new file mode 100644 index 0000000..9904497 --- /dev/null +++ b/curl/docs/CONTRIBUTE.md @@ -0,0 +1,367 @@ + + +# Contributing to the curl project + +This document is intended to offer guidelines on how to best contribute to the +curl project. This concerns new features as well as corrections to existing +flaws or bugs. + +## Join the Community + +Skip over to [https://curl.se/mail/](https://curl.se/mail/) and join +the appropriate mailing list(s). Read up on details before you post +questions. Read this file before you start sending patches. We prefer +questions sent to and discussions being held on the mailing list(s), not sent +to individuals. + +Before posting to one of the curl mailing lists, please read up on the +[mailing list etiquette](https://curl.se/mail/etiquette.html). + +We also hang out on IRC in #curl on libera.chat + +If you are at all interested in the code side of things, consider clicking +'watch' on the [curl repository on GitHub](https://github.com/curl/curl) to be +notified of pull requests and new issues posted there. + +## License and copyright + +When contributing with code, you agree to put your changes and new code under +the same license curl and libcurl is already using unless stated and agreed +otherwise. + +If you add a larger piece of code, you can opt to make that file or set of +files to use a different license as long as they do not enforce any changes to +the rest of the package and they make sense. Such "separate parts" can not be +GPL licensed (as we do not want copyleft to affect users of libcurl) but they +must use "GPL compatible" licenses (as we want to allow users to use libcurl +properly in GPL licensed environments). + +When changing existing source code, you do not alter the copyright of the +original file(s). The copyright is still owned by the original creator(s) or +those who have been assigned copyright by the original author(s). + +By submitting a patch to the curl project, you are assumed to have the right +to the code and to be allowed by your employer or whatever to hand over that +patch/code to us. We credit you for your changes as far as possible, to give +credit but also to keep a trace back to who made what changes. Please always +provide us with your full real name when contributing, + +## What To Read + +Source code, the man pages, the [INTERNALS +document](https://curl.se/dev/internals.html), +[TODO](https://curl.se/docs/todo.html), +[KNOWN_BUGS](https://curl.se/docs/knownbugs.html) and the [most recent +changes](https://curl.se/dev/sourceactivity.html) in git. Just lurking on the +[curl-library mailing list](https://curl.se/mail/list.cgi?list=curl-library) +gives you a lot of insights on what's going on right now. Asking there is a +good idea too. + +## Write a good patch + +### Follow code style + +When writing C code, follow the +[CODE_STYLE](https://curl.se/dev/code-style.html) already established in +the project. Consistent style makes code easier to read and mistakes less +likely to happen. Run `make checksrc` before you submit anything, to make sure +you follow the basic style. That script does not verify everything, but if it +complains you know you have work to do. + +### Non-clobbering All Over + +When you write new functionality or fix bugs, it is important that you do not +fiddle all over the source files and functions. Remember that it is likely +that other people have done changes in the same source files as you have and +possibly even in the same functions. If you bring completely new +functionality, try writing it in a new source file. If you fix bugs, try to +fix one bug at a time and send them as separate patches. + +### Write Separate Changes + +It is annoying when you get a huge patch from someone that is said to fix 11 +odd problems, but discussions and opinions do not agree with 10 of them - or 9 +of them were already fixed in a different way. Then the person merging this +change needs to extract the single interesting patch from somewhere within the +huge pile of source, and that creates a lot of extra work. + +Preferably, each fix that corrects a problem should be in its own patch/commit +with its own description/commit message stating exactly what they correct so +that all changes can be selectively applied by the maintainer or other +interested parties. + +Also, separate changes enable bisecting much better for tracking problems +and regression in the future. + +### Patch Against Recent Sources + +Please try to get the latest available sources to make your patches against. +It makes the lives of the developers so much easier. The best is if you get +the most up-to-date sources from the git repository, but the latest release +archive is quite OK as well. + +### Documentation + +Writing docs is dead boring and one of the big problems with many open source +projects but someone's gotta do it. It makes things a lot easier if you submit +a small description of your fix or your new features with every contribution +so that it can be swiftly added to the package documentation. + +Documentation is mostly provided as manpages or plain ASCII files. The +manpages are rendered from their source files that are usually written using +markdown. Most HTML files on the website and in the release archives are +generated from corresponding markdown and ASCII files. + +### Test Cases + +Since the introduction of the test suite, we can quickly verify that the main +features are working as they are supposed to. To maintain this situation and +improve it, all new features and functions that are added need to be tested in +the test suite. Every feature that is added should get at least one valid test +case that verifies that it works as documented. If every submitter also posts +a few test cases, it does not end up a heavy burden on a single person. + +If you do not have test cases or perhaps you have done something that is hard +to write tests for, do explain exactly how you have otherwise tested and +verified your changes. + +# Submit Your Changes + +## Get your changes merged + +Ideally you file a [pull request on +GitHub](https://github.com/curl/curl/pulls), but you can also send your plain +patch to [the curl-library mailing +list](https://curl.se/mail/list.cgi?list=curl-library). + +If you opt to post a patch on the mailing list, chances are someone converts +it into a pull request for you, to have the CI jobs verify it proper before it +can be merged. Be prepared that some feedback on the proposed change might +then come on GitHub. + +Your changes be reviewed and discussed and you are expected to correct flaws +pointed out and update accordingly, or the change risks stalling and +eventually just getting deleted without action. As a submitter of a change, +you are the owner of that change until it has been merged. + +Respond on the list or on GitHub about the change and answer questions and/or +fix nits/flaws. This is important. We take lack of replies as a sign that you +are not anxious to get your patch accepted and we tend to simply drop such +changes. + +## About pull requests + +With GitHub it is easy to send a [pull +request](https://github.com/curl/curl/pulls) to the curl project to have +changes merged. + +We strongly prefer pull requests to mailed patches, as it makes it a proper +git commit that is easy to merge and they are easy to track and not that easy +to lose in the flood of many emails, like they sometimes do on the mailing +lists. + +Every pull request submitted is automatically tested in several different +ways. [See the CI document for more +information](https://github.com/curl/curl/blob/master/tests/CI.md). + +Sometimes the tests fail due to a dependency service temporarily being offline +or otherwise unavailable, e.g. package downloads. In this case you can just +try to update your pull requests to rerun the tests later as described below. + +You can update your pull requests by pushing new commits or force-pushing +changes to existing commits. Force-pushing an amended commit without any +actual content changed also allows you to retrigger the tests for that commit. + +When you adjust your pull requests after review, consider squashing the +commits so that we can review the full updated version more easily. + +A pull request sent to the project might get labeled `needs-votes` by a +project maintainer. This label means that in addition to meeting all other +checks and qualifications this pull request must also receive more "votes" of +user support. More signs that people want this to happen. It could be in the +form of messages saying so, or thumbs-up reactions on GitHub. + +## When the pull request is approved + +If it does not seem to get approved when you think it is ready - feel free to +ask for approval. + +Once your pull request has been approved it can be merged by a maintainer. + +For new features, or changes, we require that the *feature window* is open for +the pull request to be merged. This is typically a three week period that +starts ten days after a previous release. New features submitted as pull +requests while the window is closed simply have to wait until it opens to get +merged. + +If time passes without your approved pull request gets merged: feel free to +ask what more you can do to make it happen. + +## Making quality changes + +Make the patch against as recent source versions as possible. + +If you have followed the tips in this document and your patch still has not +been incorporated or responded to after some weeks, consider resubmitting it +to the list or better yet: change it to a pull request. + +## Commit messages + +How to write git commit messages in the curl project. + + ---- start ---- + [area]: [short line describing the main effect] + -- empty line -- + [full description, no wider than 72 columns that describes as much as + possible as to why this change is made, and possibly what things + it fixes and everything else that is related, + -- end -- + +The first line is a succinct description of the change and should ideally work +as a single line in the RELEASE NOTES. + + - use the imperative, present tense: **change** not "changed" nor "changes" + - do not capitalize the first letter + - no period (.) at the end + +The `[area]` in the first line can be `http2`, `cookies`, `openssl` or +similar. There is no fixed list to select from but using the same "area" as +other related changes could make sense. + +## Commit message keywords + +Use the following ways to improve the message and provide pointers to related +work. + +- `Follow-up to {shorthash}` - if this fixes or continues a previous commit; +add a `Ref:` that commit's PR or issue if it is not a small, obvious fix; +followed by an empty line + +- `Bug: URL` to the source of the report or more related discussion; use +`Fixes` for GitHub issues instead when that is appropriate. + +- `Approved-by: John Doe` - credit someone who approved the PR. + +- `Authored-by: John Doe` - credit the original author of the code; only use +this if you cannot use `git commit --author=...`. + +- `Signed-off-by: John Doe` - we do not use this, but do not bother removing + it. + +- `whatever-else-by:` credit all helpers, finders, doers; try to use one of +the following keywords if at all possible, for consistency: `Acked-by:`, +`Assisted-by:`, `Co-authored-by:`, `Found-by:`, `Reported-by:`, +`Reviewed-by:`, `Suggested-by:`, `Tested-by:`. + +- `Ref: #1234` - if this is related to a GitHub issue or PR, possibly one that +has already been closed. + +- `Ref: URL` to more information about the commit; use `Bug:` instead for a +reference to a bug on another bug tracker] + +- `Fixes #1234` - if this fixes a GitHub issue; GitHub closes the issue once +this commit is merged. + +- `Closes #1234` - if this merges a GitHub PR; GitHub closes the PR once this +commit is merged. + +Do not forget to use commit with `--author` if you commit someone else's work, +and make sure that you have your own user and email setup correctly in git +before you commit. + +Add whichever header lines as appropriate, with one line per person if more +than one person was involved. There is no need to credit yourself unless you +are using `--author` which hides your identity. Do not include people's email +addresses in headers to avoid spam, unless they are already public from a +previous commit; saying `{userid} on github` is OK. + +## Push Access + +If you are a frequent contributor, you may be given push access to the git +repository and then you are able to push your changes straight into the git +repository instead of sending changes as pull requests or by mail as patches. + +Just ask if this is what you would want. You are required to have posted +several high quality patches first, before you can be granted push access. + +## Useful resources + - [Webinar on getting code into cURL](https://www.youtube.com/watch?v=QmZ3W1d6LQI) + +# Update copyright and license information + +There is a CI job called **REUSE compliance / check** that runs on every pull +request and commit to verify that the *REUSE state* of all files are still +fine. + +This means that all files need to have their license and copyright information +clearly stated. Ideally by having the standard curl source code header, with +the `SPDX-License-Identifier` included. If the header does not work, you can +use a smaller header or add the information for a specific file to the +`REUSE.toml` file. + +You can manually verify the copyright and compliance status by running the +[REUSE helper tool](https://github.com/fsfe/reuse-tool): `reuse lint` + +# On AI use in curl + +Guidelines for AI use when contributing to curl. + +## For security reports and other issues + +If you asked an AI tool to find problems in curl, you **must** make sure to +reveal this fact in your report. + +You must also double-check the findings carefully before reporting them to us +to validate that the issues are indeed existing and working exactly as the AI +says. AI-based tools frequently generate inaccurate or fabricated results. + +Further: it is *rarely* a good idea to just copy and paste an AI generated +report to the project. Those generated reports typically are too wordy and +rarely to the point (in addition to the common fabricated details). If you +actually find a problem with an AI and you have verified it yourself to be +true: write the report yourself and explain the problem as you have learned +it. This makes sure the AI-generated inaccuracies and invented issues are +filtered out early before they waste more people's time. + +As we take security reports seriously, we investigate each report with +priority. This work is both time and energy consuming and pulls us away from +doing other meaningful work. Fake and otherwise made up security problems +effectively prevent us from doing real project work and make us waste time and +resources. + +We ban users immediately who submit made up fake reports to the project. + +## For pull requests + +When contributing content to the curl project, you give us permission to use +it as-is and you must make sure you are allowed to distribute it to us. By +submitting a change to us, you agree that the changes can and should be +adopted by curl and get redistributed under the curl license. Authors should +be explicitly aware that the burden is on them to ensure no unlicensed code is +submitted to the project. + +This is independent if AI is used or not. + +When contributing a pull request you should of course always make sure that +the proposal is good quality and a best effort that follows our guidelines. A +basic rule of thumb is that if someone can spot that the contribution was made +with the help of AI, you have more work to do. + +We can accept code written with the help of AI into the project, but the code +must still follow coding standards, be written clearly, be documented, feature +test cases and adhere to all the normal requirements we have. + +## For translation + +Translation services help users write reports, texts and documentation in +non-native languages and we encourage and welcome such contributors and +contributions. + +As AI-based translation tools sometimes have a way to make the output sound a +little robotic and add an "AI tone" to the text, you may want to consider +mentioning that you used such a tool. Failing to do so risks that maintainers +wrongly dismiss translated texts as AI slop. diff --git a/curl/docs/CURL-DISABLE.md b/curl/docs/CURL-DISABLE.md new file mode 100644 index 0000000..63de402 --- /dev/null +++ b/curl/docs/CURL-DISABLE.md @@ -0,0 +1,191 @@ + + +# Code defines to disable features and protocols + +## `CURL_DISABLE_ALTSVC` + +Disable support for Alt-Svc: HTTP headers. + +## `CURL_DISABLE_BINDLOCAL` + +Disable support for binding the local end of connections. + +## `CURL_DISABLE_COOKIES` + +Disable support for HTTP cookies. + +## `CURL_DISABLE_BASIC_AUTH` + +Disable support for the Basic authentication methods. + +## `CURL_DISABLE_BEARER_AUTH` + +Disable support for the Bearer authentication methods. + +## `CURL_DISABLE_DIGEST_AUTH` + +Disable support for the Digest authentication methods. + +## `CURL_DISABLE_KERBEROS_AUTH` + +Disable support for the Kerberos authentication methods. + +## `CURL_DISABLE_NEGOTIATE_AUTH` + +Disable support for the negotiate authentication methods. + +## `CURL_DISABLE_AWS` + +Disable **aws-sigv4** support. + +## `CURL_DISABLE_CA_SEARCH` + +Disable unsafe CA bundle search in PATH on Windows. + +## `CURL_DISABLE_DICT` + +Disable the DICT protocol + +## `CURL_DISABLE_DOH` + +Disable DNS-over-HTTPS + +## `CURL_DISABLE_FILE` + +Disable the FILE protocol + +## `CURL_DISABLE_FORM_API` + +Disable the form API + +## `CURL_DISABLE_FTP` + +Disable the FTP (and FTPS) protocol + +## `CURL_DISABLE_GETOPTIONS` + +Disable the `curl_easy_options` API calls that lets users get information +about existing options to `curl_easy_setopt`. + +## `CURL_DISABLE_GOPHER` + +Disable the GOPHER protocol. + +## `CURL_DISABLE_HEADERS_API` + +Disable the HTTP header API. + +## `CURL_DISABLE_HSTS` + +Disable the HTTP Strict Transport Security support. + +## `CURL_DISABLE_HTTP` + +Disable the HTTP(S) protocols. Note that this then also disable HTTP proxy +support. + +## `CURL_DISABLE_HTTP_AUTH` + +Disable support for all HTTP authentication methods. + +## `CURL_DISABLE_IMAP` + +Disable the IMAP(S) protocols. + +## `CURL_DISABLE_LDAP` + +Disable the LDAP(S) protocols. + +## `CURL_DISABLE_LDAPS` + +Disable the LDAPS protocol. + +## `CURL_DISABLE_LIBCURL_OPTION` + +Disable the --libcurl option from the curl tool. + +## `CURL_DISABLE_MIME` + +Disable MIME support. + +## `CURL_DISABLE_MQTT` + +Disable MQTT support. + +## `CURL_DISABLE_NETRC` + +Disable the netrc parser. + +## `CURL_DISABLE_NTLM` + +Disable support for NTLM. + +## `CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG` + +Disable the auto load config support in the OpenSSL backend. + +## `CURL_DISABLE_PARSEDATE` + +Disable date parsing + +## `CURL_DISABLE_POP3` + +Disable the POP3 protocol + +## `CURL_DISABLE_PROGRESS_METER` + +Disable the built-in progress meter + +## `CURL_DISABLE_PROXY` + +Disable support for proxies + +## `CURL_DISABLE_IPFS` + +Disable the IPFS/IPNS protocols. This affects the curl tool only, where +IPFS/IPNS protocol support is implemented. + +## `CURL_DISABLE_RTSP` + +Disable the RTSP protocol. + +## `CURL_DISABLE_SHA512_256` + +Disable the SHA-512/256 hash algorithm. + +## `CURL_DISABLE_SHUFFLE_DNS` + +Disable the shuffle DNS feature + +## `CURL_DISABLE_SMB` + +Disable the SMB(S) protocols + +## `CURL_DISABLE_SMTP` + +Disable the SMTP(S) protocols + +## `CURL_DISABLE_SOCKETPAIR` + +Disable the use of `socketpair()` internally to allow waking up and canceling +`curl_multi_poll()`. + +## `CURL_DISABLE_TELNET` + +Disable the TELNET protocol + +## `CURL_DISABLE_TFTP` + +Disable the TFTP protocol + +## `CURL_DISABLE_VERBOSE_STRINGS` + +Disable verbose strings and error messages. + +## `CURL_DISABLE_WEBSOCKETS` + +Disable the WebSocket protocols. diff --git a/curl/docs/CURLDOWN.md b/curl/docs/CURLDOWN.md new file mode 100644 index 0000000..18c1cbc --- /dev/null +++ b/curl/docs/CURLDOWN.md @@ -0,0 +1,168 @@ + + +# curldown + +A markdown-like syntax for libcurl man pages. + +## Purpose + +A text format for writing libcurl documentation in the shape of man pages. + +Make it easier for users to contribute and write documentation. A format that +is easier on the eye in its source format. + +Make it harder to do syntactical mistakes. + +Use a format that allows creating man pages that end up looking exactly like +the man pages did when we wrote them in nroff format. + +Take advantage of the fact that people these days are accustomed to markdown +by using a markdown-like syntax. + +This allows us to fix issues in the nroff format easier since now we generate +them. For example: escaping minus to prevent them from being turned into +Unicode by man. + +Generate nroff output that looks (next to) *identical* to the previous files, +so that the look, existing test cases, HTML conversions, existing +infrastructure etc remain mostly intact. + +Contains meta-data in a structured way to allow better output (for example the +see also information) and general awareness of what the file is about. + +## File extension + +Since curldown looks similar to markdown, we use `.md` extensions on the +files. + +## Conversion + +Convert **from curldown to nroff** with `cd2nroff`. Generates nroff man pages. + +Convert **from nroff to curldown** with `nroff2cd`. This is only meant to be +used for the initial conversion to curldown and should ideally never be needed +again. + +Convert, check or clean up an existing curldown to nicer, better, cleaner +curldown with **cd2cd**. + +Mass-convert all curldown files to nroff in specified directories with +`cdall`: + + cdall [dir1] [dir2] [dir3] .. + +## Known issues + +The `cd2nroff` tool does not yet handle *italics* or **bold** where the start +and the end markers are used on separate lines. + +The `nroff2cd` tool generates code style quotes for all `.fi` sections since +the nroff format does not carry a distinction. + +# Format + +Each curldown starts with a header with meta-data: + + --- + c: Copyright (C) Daniel Stenberg, , et al. + SPDX-License-Identifier: curl + Title: CURLOPT_AWS_SIGV4 + Section: 3 + Source: libcurl + Protocol: + - HTTP + See-also: + - CURLOPT_HEADEROPT (3) + - CURLOPT_HTTPAUTH (3) + TLS-backend: + - [name] + Added-in: [version or "n/a"] + --- + +All curldown files *must* have all the headers present and at least one +`See-also:` entry specified. + +If the man page is for section 3 (library related). The `Protocol` list must +contain at least one protocol, which can be `*` if the option is virtually for +everything. If `*` is used, it must be the only listed protocol. Recognized +protocols are either URL schemes (in uppercase), `TLS` or `TCP`. + +If the `Protocol` list contains `TLS`, then there must also be a `TLS-backend` +list, specifying `All` or a list of what TLS backends that work with this +option. The available TLS backends are: + +- `BearSSL` +- `GnuTLS` +- `mbedTLS` +- `OpenSSL` (also covers BoringSSL, LibreSSL, quictls, AWS-LC and AmiSSL) +- `rustls` +- `Schannel` +- `Secure Transport` +- `wolfSSL` +- `All`: all TLS backends + +Following the header in the file, is the manual page using markdown-like +syntax: + +~~~ + # NAME + a page - this is a page descriving something + + # SYNOPSIS + ~~~c + #include + + CURLcode curl_easy_setopt(CURL *handle, CURLOPT_AWS_SIGV4, char *param); + ~~~ +~~~ + +Quoted source code should start with `~~~c` and end with `~~~` while regular +quotes can start with `~~~` or just be indented with 4 spaces. + +Headers at top-level `#` get converted to `.SH`. + +`nroff2cd` supports the `##` next level header which gets converted to `.IP`. + +Write bold words or phrases within `**` like: + + This is a **bold** word. + +Write italics like: + + This is *italics*. + +Due to how man pages do not support backticks especially formatted, such +occurrences in the source are instead just using italics in the generated +output: + + This `word` appears in italics. + +When generating the nroff output, the tooling removes superfluous newlines, +meaning they can be used freely in the source file to make the text more +readable. + +To make sure curldown documents render correctly as markdown, all literal +occurrences of `<` or `>` need to be escaped by a leading backslash. + +## Generating contents + +`# %PROTOCOLS%` - inserts a **PROTOCOLS** section based on the metadata +provided in the header. + +`# %AVAILABILITY%` - inserts an **AVAILABILITY** section based on the metadata +provided in the header. + +## Symbols + +All mentioned curl symbols that have their own man pages, like +`curl_easy_perform(3)` are automatically rendered using italics in the output +without having to enclose it with asterisks. This helps ensuring that they get +converted to links properly later in the HTML version on the website, as +converted with `roffit`. This makes the curldown text easier to read even when +mentioning many curl symbols. + +This auto-linking works for patterns matching `(lib|)curl[^ ]*(3)`. diff --git a/curl/docs/DEPRECATE.md b/curl/docs/DEPRECATE.md new file mode 100644 index 0000000..c72580b --- /dev/null +++ b/curl/docs/DEPRECATE.md @@ -0,0 +1,77 @@ + + +# Items to be removed from future curl releases + +If any of these deprecated features is a cause for concern for you, please +email the +[curl-library mailing list](https://lists.haxx.se/listinfo/curl-library) +as soon as possible and explain to us why this is a problem for you and +how your use case cannot be satisfied properly using a workaround. + +## TLS libraries without 1.3 support + +curl drops support for TLS libraries without TLS 1.3 capability after May +2025. + +It requires that a curl build using the library should be able to negotiate +and use TLS 1.3, or else it is not good enough. + +As of May 2024, the libraries that need to get fixed to remain supported after +May 2025 are: BearSSL and Secure Transport. + +## msh3 support + +The msh3 backed for QUIC and HTTP/3 was introduced in April 2022 but has never +been made to work properly. It has seen no visible traction or developer +activity from the msh3 main author (or anyone else seemingly interested) in +two years. As a non-functional backend, it only adds friction and "weight" to +the development and maintenance. + +Meanwhile, we have a fully working backend in the ngtcp2 one and we have two +fully working backends in OpenSSL-QUIC and quiche well on their way of ending +their experimental status in a future. + +We remove msh3 support from the curl source tree in July 2025. + +## winbuild build system + +curl drops support for the winbuild build method after September 2025. + +We recommend migrating to CMake. See the migration guide in +`docs/INSTALL-CMAKE.md`. + +## Windows CE + +Windows CE "mainstream support" ended on October 9, 2018, and "Extended +Support" ended on October 10, 2023. + +curl drops all support in November 2025. + +## VS2008 + +curl drops support for getting built with Microsoft Visual Studio 2008 in +November 2025. + +The only reason we kept support for this version is for Windows CE - and we +intend to remove support for that Operating System in this time frame as well. +Bumping the minimum to VS2010. VS2008 is a pain to support. + +Previous discussion and details: https://github.com/curl/curl/discussions/15972 + +## Past removals + + - axTLS (removed in 7.63.0) + - Pipelining (removed in 7.65.0) + - PolarSSL (removed in 7.69.0) + - NPN (removed in 7.86.0) + - Support for systems without 64-bit data types (removed in 8.0.0) + - NSS (removed in 8.3.0) + - gskit (removed in 8.3.0) + - MinGW v1 (removed in 8.4.0) + - NTLM_WB (removed in 8.8.0) + - space-separated `NOPROXY` patterns (removed in 8.9.0) + - hyper (removed in 8.12.0) diff --git a/curl/docs/DISTROS.md b/curl/docs/DISTROS.md new file mode 100644 index 0000000..7db542e --- /dev/null +++ b/curl/docs/DISTROS.md @@ -0,0 +1,287 @@ + + +# curl distros + + + +Lots of organizations distribute curl packages to end users. This is a +collection of pointers to where to learn more about curl on and with each +distro. Those marked *Rolling Release* typically run the latest version of curl +and are therefore less likely to have back-ported patches to older versions. + +We discuss curl distro issues, patches and collaboration on the [curl-distros +mailing list](https://lists.haxx.se/listinfo/curl-distros) ([list +archives](https://curl.se/mail/list.cgi?list=curl-distros)). + +## AlmaLinux + +- curl package source and patches: https://git.almalinux.org/rpms/curl/ +- curl issues: https://bugs.almalinux.org/view_all_bug_page.php click Category and choose curl +- curl security: https://errata.almalinux.org/ search for curl + +## Alpine Linux + +- curl: https://pkgs.alpinelinux.org/package/edge/main/x86_64/curl +- curl issues: https://gitlab.alpinelinux.org/alpine/aports/-/issues +- curl security: https://security.alpinelinux.org/srcpkg/curl +- curl package source and patches: https://gitlab.alpinelinux.org/alpine/aports/-/tree/master/main/curl + +## Alt Linux + +- curl: https://packages.altlinux.org/en/search/?q=curl +- curl issues: https://packages.altlinux.org/en/sisyphus/srpms/curl/issues/ +- curl patches: https://git.altlinux.org/gears/c/curl.git?p=curl.git;a=tree;f=.gear + +## Arch Linux + +*Rolling Release* + +- curl: https://archlinux.org/packages/core/x86_64/curl/ +- curl issues: https://gitlab.archlinux.org/archlinux/packaging/packages/curl/-/issues +- curl security: https://security.archlinux.org/package/curl +- curl wiki: https://wiki.archlinux.org/title/CURL + +## Buildroot + +*Rolling Release* + +- curl package source and patches: https://git.buildroot.net/buildroot/tree/package/libcurl +- curl issues: https://bugs.buildroot.org/buglist.cgi?quicksearch=curl + +## Chimera + +- curl package source and patches: https://github.com/chimera-linux/cports/tree/master/main/curl + +## Clear Linux + +*Rolling Release* + +- curl: https://github.com/clearlinux-pkgs/curl +- curl issues: https://github.com/clearlinux/distribution/issues + +## Conary + +- curl: https://github.com/conan-io/conan-center-index/tree/master/recipes/libcurl +- curl issues: https://github.com/conan-io/conan-center-index/issues +- curl patches: https://github.com/conan-io/conan-center-index/tree/master/recipes/libcurl (in `all/patches/*`, if any) + +## conda-forge + +- curl: https://github.com/conda-forge/curl-feedstock +- curl issues: https://github.com/conda-forge/curl-feedstock/issues + +## CRUX + +- curl: https://crux.nu/portdb/?a=search&q=curl +- curl issues: https://git.crux.nu/ports/core/issues/?type=all&state=open&q=curl + +## curl-for-win + +(this is the official curl binaries for Windows shipped by the curl project) + +*Rolling Release* + +- curl: https://curl.se/windows/ +- curl patches: https://github.com/curl/curl-for-win/blob/main/curl.patch (if any) +- build-specific issues: https://github.com/curl/curl-for-win/issues + +Issues and patches for this are managed in the main curl project. + +## Cygwin + +- curl: https://cygwin.com/cgit/cygwin-packages/curl/tree/curl.cygport +- curl patches: https://cygwin.com/cgit/cygwin-packages/curl/tree +- curl issues: https://inbox.sourceware.org/cygwin/?q=s%3Acurl + +## Cygwin (cross mingw64) + +- mingw64-x86_64-curl: https://cygwin.com/cgit/cygwin-packages/mingw64-x86_64-curl/tree/mingw64-x86_64-curl.cygport +- mingw64-x86_64-curl patches: https://cygwin.com/cgit/cygwin-packages/mingw64-x86_64-curl/tree +- mingw64-x86_64-curl issues: https://inbox.sourceware.org/cygwin/?q=s%3Amingw64-x86_64-curl + +## Debian + +- curl: https://tracker.debian.org/pkg/curl +- curl issues: https://bugs.debian.org/cgi-bin/pkgreport.cgi?pkg=curl +- curl patches: https://udd.debian.org/patches.cgi?src=curl +- curl patches: https://salsa.debian.org/debian/curl (in debian/* branches, inside the folder debian/patches) + +## Fedora + +- curl: https://src.fedoraproject.org/rpms/curl +- curl issues: [bugzilla](https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&classification=Fedora&product=Fedora&product=Fedora%20EPEL&component=curl) +- curl patches: [list of patches in package git](https://src.fedoraproject.org/rpms/curl/tree/rawhide) + +## FreeBSD + +- curl: https://cgit.freebsd.org/ports/tree/ftp/curl +- curl patches: https://cgit.freebsd.org/ports/tree/ftp/curl +- curl issues: https://bugs.freebsd.org/bugzilla/buglist.cgi?bug_status=__open__&order=Importance&product=Ports%20%26%20Packages&query_format=advanced&short_desc=curl&short_desc_type=allwordssubstr + +## Gentoo Linux + +*Rolling Release* + +- curl: https://packages.gentoo.org/packages/net-misc/curl +- curl issues: https://bugs.gentoo.org/buglist.cgi?quicksearch=net-misc/curl +- curl package sources and patches: https://gitweb.gentoo.org/repo/gentoo.git/tree/net-misc/curl/ + +## GNU Guix + +*Rolling Release* + +- curl: https://git.savannah.gnu.org/gitweb/?p=guix.git;a=blob;f=gnu/packages/curl.scm;hb=HEAD +- curl issues: https://issues.guix.gnu.org/search?query=curl + +## Homebrew + +*Rolling Release* + +- curl: https://formulae.brew.sh/formula/curl + +Homebrew's policy is that all patches and issues should be submitted upstream +unless it is specific to Homebrew's way of packaging software. + +## MacPorts + +*Rolling Release* + +- curl: https://github.com/macports/macports-ports/tree/master/net/curl +- curl issues: https://trac.macports.org/query?0_port=curl&0_port_mode=%7E&0_status=%21closed +- curl patches: https://github.com/macports/macports-ports/tree/master/net/curl/files + +## Mageia + +- curl: https://svnweb.mageia.org/packages/cauldron/curl/current/SPECS/curl.spec?view=markup +- curl issues: https://bugs.mageia.org/buglist.cgi?bug_status=NEW&bug_status=UNCONFIRMED&bug_status=NEEDINFO&bug_status=UPSTREAM&bug_status=ASSIGNED&component=RPM%20Packages&f1=cf_rpmpkg&list_id=176576&o1=casesubstring&product=Mageia&query_format=advanced&v1=curl +- curl patches: https://svnweb.mageia.org/packages/cauldron/curl/current/SOURCES/ +- curl patches in stable distro releases: https://svnweb.mageia.org/packages/updates//curl/current/SOURCES/ +- curl security: https://advisories.mageia.org/src_curl.html + +## MSYS2 + +*Rolling Release* + +- curl: https://github.com/msys2/MSYS2-packages/tree/master/curl +- curl issues: https://github.com/msys2/MSYS2-packages/issues +- curl patches: https://github.com/msys2/MSYS2-packages/tree/master/curl (`*.patch`) + +## MSYS2 (mingw-w64) + +*Rolling Release* + +- curl: https://github.com/msys2/MINGW-packages/tree/master/mingw-w64-curl +- curl issues: https://github.com/msys2/MINGW-packages/issues +- curl patches: https://github.com/msys2/MINGW-packages/tree/master/mingw-w64-curl (`*.patch`) + +## Muldersoft + +*Rolling Release* + +- curl: https://github.com/lordmulder/cURL-build-win32 +- curl issues: https://github.com/lordmulder/cURL-build-win32/issues +- curl patches: https://github.com/lordmulder/cURL-build-win32/tree/master/patch + +## NixOS + +- curl: https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/networking/curl/default.nix + (TODO: page has moved) +- curl issues: https://github.com/NixOS/nixpkgs + +nixpkgs is the package repository used by the NixOS Linux distribution, but +can also be used on other distributions + +## OmniOS + +- curl: https://github.com/omniosorg/omnios-build/tree/master/build/curl +- curl issues: https://github.com/omniosorg/omnios-build/issues +- curl patches: https://github.com/omniosorg/omnios-build/tree/master/build/curl/patches + +## OpenIndiana + +- curl: https://github.com/OpenIndiana/oi-userland/tree/oi/hipster/components/web/curl +- curl issues: https://www.illumos.org/projects/openindiana/issues +- curl patches: https://github.com/OpenIndiana/oi-userland/tree/oi/hipster/components/web/curl/patches + +## OpenSUSE + +- curl source and patches: https://build.opensuse.org/package/show/openSUSE%3AFactory/curl + +## Oracle Solaris + +- curl: https://github.com/oracle/solaris-userland/tree/master/components/curl +- curl issues: https://support.oracle.com/ (requires support contract) +- curl patches: https://github.com/oracle/solaris-userland/tree/master/components/curl/patches + +## OpenEmbedded / Yocto Project + +*Rolling Release* + +- curl: https://layers.openembedded.org/layerindex/recipe/5765/ +- curl issues: https://bugzilla.yoctoproject.org/ +- curl patches: https://git.openembedded.org/openembedded-core/tree/meta/recipes-support/curl + +## PLD Linux + +- curl package source and patches: https://github.com/pld-linux/curl +- curl issues: https://bugs.launchpad.net/pld-linux?field.searchtext=curl&search=Search&field.status%3Alist=NEW&field.status%3Alist=INCOMPLETE_WITH_RESPONSE&field.status%3Alist=INCOMPLETE_WITHOUT_RESPONSE&field.status%3Alist=CONFIRMED&field.status%3Alist=TRIAGED&field.status%3Alist=INPROGRESS&field.status%3Alist=FIXCOMMITTED&field.assignee=&field.bug_reporter=&field.omit_dupes=on&field.has_patch=&field.has_no_package= + +## pkgsrc + +- curl: https://github.com/NetBSD/pkgsrc/tree/trunk/www/curl +- curl issues: https://github.com/NetBSD/pkgsrc/issues +- curl patches: https://github.com/NetBSD/pkgsrc/tree/trunk/www/curl/patches + +## Red Hat Enterprise Linux / CentOS Stream + +- curl: https://kojihub.stream.centos.org/koji/packageinfo?packageID=217 +- curl issues: https://issues.redhat.com/secure/CreateIssueDetails!init.jspa?pid=12332745&issuetype=1&components=12377466&priority=10300 +- curl patches: https://gitlab.com/redhat/centos-stream/rpms/curl + +## Rocky Linux + +- curl: https://git.rockylinux.org/staging/rpms/curl/-/blob/r9/SPECS/curl.spec +- curl issues: https://bugs.rockylinux.org +- curl patches: https://git.rockylinux.org/staging/rpms/curl/-/tree/r9/SOURCES + +## SerenityOS + +- curl: https://github.com/SerenityOS/serenity/tree/master/Ports/curl +- curl issues: https://github.com/SerenityOS/serenity/issues?q=label%3Aports +- curl patches: https://github.com/SerenityOS/serenity/tree/master/Ports/curl/patches + +## SmartOS + +- curl: https://github.com/TritonDataCenter/illumos-extra/tree/master/curl +- curl issues: https://github.com/TritonDataCenter/illumos-extra/issues +- curl patches: https://github.com/TritonDataCenter/illumos-extra/tree/master/curl/Patches + +## SPACK + +- curl package source and patches: https://github.com/spack/spack/tree/develop/var/spack/repos/builtin/packages/curl + +## vcpkg + +*Rolling Release* + +- curl: https://github.com/microsoft/vcpkg/tree/master/ports/curl +- curl issues: https://github.com/microsoft/vcpkg/issues +- curl patches: https://github.com/microsoft/vcpkg/tree/master/ports/curl (`*.patch`) + +## Void Linux + +*Rolling Release* + +- curl: https://github.com/void-linux/void-packages/tree/master/srcpkgs/curl +- curl issues: https://github.com/void-linux/void-packages/issues +- curl patches: https://github.com/void-linux/void-packages/tree/master/srcpkgs/curl/patches + +## Wolfi + +*Rolling Release* + +- curl: https://github.com/wolfi-dev/os/blob/main/curl.yaml diff --git a/curl/docs/EARLY-RELEASE.md b/curl/docs/EARLY-RELEASE.md new file mode 100644 index 0000000..e66dbbd --- /dev/null +++ b/curl/docs/EARLY-RELEASE.md @@ -0,0 +1,73 @@ + + +# How to determine if an early patch release is warranted + +In the curl project we do releases every 8 weeks. Unless we break the cycle +and do an early patch release. + +We do frequent releases partly to always have the next release "not too far +away". + +## Bugfix + +During the release cycle, and especially in the beginning of a new cycle (the +so-called "cool down" period), there are times when a bug is reported and +after it has been subsequently fixed correctly, the question might be asked: +is this bug and associated fix important enough for an early patch release? + +The question can only be properly asked when a fix has been created and landed +in the git master branch. + +## Early release + +An early patch release means that we ship a new, complete and full release +called `major.minor.patch` where the `patch` part is increased by one since +the previous release. A curl release is a curl release. There is no small or +big and we never release just a patch. There is only "release". + +## Questions to ask + + - Is there a security advisory rated high or critical? + - Is there a data corruption bug? + - Did the bug cause an API/ABI breakage? + - Does the problem annoy a significant share of the user population? + +If the answer is yes to one or more of the above, an early release might be +warranted. + +More questions to ask ourselves when doing the assessment if the answers to +the three ones above are all 'no'. + + - Does the bug cause curl to prematurely terminate? + - How common is the affected buggy option/feature/protocol/platform to get + used? + - How large is the estimated impacted user base? + - Does the bug block something crucial for applications or other adoption of + curl "out there" ? + - Does the bug cause problems for curl developers or others on "the curl + team" ? + - Is the bug limited to the curl tool only? That might have a smaller impact + than a bug also present in libcurl. + - Is there a (decent) workaround? + - Is it a regression? Is the bug introduced in this release? + - Can the bug be fixed "easily" by applying a patch? + - Does the bug break the build? Most users do not build curl themselves. + - How long is it until the already scheduled next release? + - Can affected users safely rather revert to a former release until the next + scheduled release? + - Is it a performance regression with no functionality side-effects? If so it + has to be substantial. + +## If an early release is deemed necessary + +Unless done for security or similarly important reasons, an early release +should not be done within a week of the previous release. + +This, to enable us to collect and bundle more fixes into the same release to +make the release more worthwhile for everyone and to allow more time for fixes +to settle and things to get tested. Getting a release in shape and done in +style is work that should not be rushed. diff --git a/curl/docs/ECH.md b/curl/docs/ECH.md new file mode 100644 index 0000000..969bbfa --- /dev/null +++ b/curl/docs/ECH.md @@ -0,0 +1,496 @@ + + +# Building curl with HTTPS-RR and ECH support + +We have added support for ECH to curl. It can use HTTPS RRs published in the +DNS if curl uses DoH, or else can accept the relevant ECHConfigList values +from the command line. This works with OpenSSL, wolfSSL, BoringSSL, AWS-LC +or rustls-ffi as the TLS provider. + +This feature is EXPERIMENTAL. DO NOT USE IN PRODUCTION. + +This should however provide enough of a proof-of-concept to prompt an informed +discussion about a good path forward for ECH support in curl. + +## OpenSSL Build + +To build the OpenSSL project's ECH feature branch: + +```bash + cd $HOME/code + git clone https://github.com/openssl/openssl + cd openssl + git checkout feature/ech + ./config --libdir=lib --prefix=$HOME/code/openssl-local-inst + ...stuff... + make -j8 + ...more stuff... + make install_sw + ...a little bit of stuff... +``` + +To build curl ECH-enabled, making use of the above: + +```bash + cd $HOME/code + git clone https://github.com/curl/curl + cd curl + autoreconf -fi + LDFLAGS="-Wl,-rpath,$HOME/code/openssl-local-inst/lib/" ./configure --with-ssl=$HOME/code/openssl-local-inst --enable-ech + ...lots of output... + WARNING: ECH HTTPSRR enabled but marked EXPERIMENTAL... + make + ...lots more output... +``` + +If you do not get that WARNING at the end of the ``configure`` command, then +ECH is not enabled, so go back some steps and re-do whatever needs re-doing:-) +If you want to debug curl then you should add ``--enable-debug`` to the +``configure`` command. + +In a recent (2024-05-20) build on one machine, configure failed to find the +ECH-enabled SSL library, apparently due to the existence of +``$HOME/code/openssl-local-inst/lib/pkgconfig`` as a directory containing +various settings. Deleting that directory worked around the problem but may +not be the best solution. + +## Using ECH and DoH + +curl supports using DoH for A/AAAA lookups so it was relatively easy to add +retrieval of HTTPS RRs in that situation. To use ECH and DoH together: + +```bash + cd $HOME/code/curl + LD_LIBRARY_PATH=$HOME/code/openssl ./src/curl --ech true --doh-url https://one.one.one.one/dns-query https://defo.ie/ech-check.php + ... + SSL_ECH_STATUS: success good
+ ... +``` + +The output snippet above is within the HTML for the webpage, when things work. + +The above works for these test sites: + +```bash + https://defo.ie/ech-check.php + https://draft-13.esni.defo.ie:8413/stats + https://draft-13.esni.defo.ie:8414/stats + https://crypto.cloudflare.com/cdn-cgi/trace + https://tls-ech.dev +``` + +The list above has 4 different server technologies, implemented by 3 different +parties, and includes a case (the port 8414 server) where HelloRetryRequest +(HRR) is forced. + +We currently support the following new curl command line arguments/options: + +- ``--ech `` - the ``config`` value can be one of: + - ``false`` says to not attempt ECH + - ``true`` says to attempt ECH, if possible + - ``grease`` if attempting ECH is not possible, then send a GREASE ECH extension + - ``hard`` hard-fail the connection if ECH cannot be attempted + - ``ecl:`` a base64 encoded ECHConfigList, rather than one accessed from the DNS + - ``pn:`` override the ``public_name`` from an ECHConfigList + +Note that in the above "attempt ECH" means the client emitting a TLS +ClientHello with a "real" ECH extension, but that does not mean that the +relevant server can succeed in decrypting, as things can fail for other +reasons. + +## Supplying an ECHConfigList on the command line + +To supply the ECHConfigList on the command line, you might need a bit of +cut-and-paste, e.g.: + +```bash + dig +short https defo.ie + 1 . ipv4hint=213.108.108.101 ech=AED+DQA8PAAgACD8WhlS7VwEt5bf3lekhHvXrQBGDrZh03n/LsNtAodbUAAEAAEAAQANY292ZXIuZGVmby5pZQAA ipv6hint=2a00:c6c0:0:116:5::10 +``` + +Then paste the base64 encoded ECHConfigList onto the curl command line: + +```bash + LD_LIBRARY_PATH=$HOME/code/openssl ./src/curl --ech ecl:AED+DQA8PAAgACD8WhlS7VwEt5bf3lekhHvXrQBGDrZh03n/LsNtAodbUAAEAAEAAQANY292ZXIuZGVmby5pZQAA https://defo.ie/ech-check.php + ... + SSL_ECH_STATUS: success good
+ ... +``` + +The output snippet above is within the HTML for the webpage. + +If you paste in the wrong ECHConfigList (it changes hourly for ``defo.ie``) you +should get an error like this: + +```bash + LD_LIBRARY_PATH=$HOME/code/openssl ./src/curl -vvv --ech ecl:AED+DQA8yAAgACDRMQo+qYNsNRNj+vfuQfFIkrrUFmM4vogucxKj/4nzYgAEAAEAAQANY292ZXIuZGVmby5pZQAA https://defo.ie/ech-check.php + ... + * OpenSSL/3.3.0: error:0A00054B:SSL routines::ech required + ... +``` + +There is a reason to want this command line option - for use before publishing +an ECHConfigList in the DNS as per the Internet-draft [A well-known URI for +publishing ECHConfigList values](https://datatracker.ietf.org/doc/draft-ietf-tls-wkech/). + +If you do use a wrong ECHConfigList value, then the server might return a +good value, via the ``retry_configs`` mechanism. You can see that value in +the verbose output, e.g.: + +```bash + LD_LIBRARY_PATH=$HOME/code/openssl ./src/curl -vvv --ech ecl:AED+DQA8yAAgACDRMQo+qYNsNRNj+vfuQfFIkrrUFmM4vogucxKj/4nzYgAEAAEAAQANY292ZXIuZGVmby5pZQAA https://defo.ie/ech-check.php + ... +* ECH: retry_configs AQD+DQA8DAAgACBvYqJy+Hgk33wh/ZLBzKSPgwxeop7gvojQzfASq7zeZQAEAAEAAQANY292ZXIuZGVmby5pZQAA/g0APEMAIAAgXkT5r4cYs8z19q5rdittyIX8gfQ3ENW4wj1fVoiJZBoABAABAAEADWNvdmVyLmRlZm8uaWUAAP4NADw2ACAAINXSE9EdXzEQIJZA7vpwCIQsWqsFohZARXChgPsnfI1kAAQAAQABAA1jb3Zlci5kZWZvLmllAAD+DQA8cQAgACASeiD5F+UoSnVoHvA2l1EifUVMFtbVZ76xwDqmMPraHQAEAAEAAQANY292ZXIuZGVmby5pZQAA +* ECH: retry_configs for defo.ie from cover.defo.ie, 319 + ... +``` + +At that point, you could copy the base64 encoded value above and try again. +For now, this only works for the OpenSSL and BoringSSL/AWS-LC builds. + +## Default settings + +curl has various ways to configure default settings, e.g. in ``$HOME/.curlrc``, +so one can set the DoH URL and enable ECH that way: + +```bash + cat ~/.curlrc + doh-url=https://one.one.one.one/dns-query + silent + ech=true +``` + +Note that when you use the system's curl command (rather than our ECH-enabled +build), it is liable to warn that ``ech`` is an unknown option. If that is an +issue (e.g. if some script re-directs stdout and stderr somewhere) then adding +the ``silent`` line above seems to be a good enough fix. (Though of +course, yet another script could depend on non-silent behavior, so you may have +to figure out what you prefer yourself.) That seems to have changed with the +latest build, previously ``silent=TRUE`` was what I used in ``~/.curlrc`` but +now that seems to cause a problem, so that the following line(s) are ignored. + +If you want to always use our OpenSSL build you can set ``LD_LIBRARY_PATH`` +in the environment: + +```bash + export LD_LIBRARY_PATH=$HOME/code/openssl +``` + +When you do the above, there can be a mismatch between OpenSSL versions +for applications that check that. A ``git push`` for example fails so you +should unset ``LD_LIBRARY_PATH`` before doing that or use a different shell. + +```bash + git push + OpenSSL version mismatch. Built against 30000080, you have 30200000 + ... +``` + +With all that setup as above the command line gets simpler: + +```bash + ./src/curl https://defo.ie/ech-check.php + ... + SSL_ECH_STATUS: success good
+ ... +``` + +The ``--ech true`` option is opportunistic, so tries to do ECH but does not fail if +the client for example cannot find any ECHConfig values. The ``--ech hard`` +option hard-fails if there is no ECHConfig found in DNS, so for now, that is not +a good option to set as a default. Once ECH has really been attempted by +the client, if decryption on the server side fails, then curl fails. + +## Code changes for ECH support when using DoH + +Code changes are ``#ifdef`` protected via ``USE_ECH`` or ``USE_HTTPSRR``: + +- ``USE_HTTPSRR`` is used for HTTPS RR retrieval code that could be generically + used should non-ECH uses for HTTPS RRs be identified, e.g. use of ALPN values + or IP address hints. + +- ``USE_ECH`` protects ECH specific code. + +There are various obvious code blocks for handling the new command line +arguments which are not described here, but should be fairly clear. + +As shown in the ``configure`` usage above, there are ``configure.ac`` changes +that allow separately dis/enabling ``USE_HTTPSRR`` and ``USE_ECH``. If ``USE_ECH`` +is enabled, then ``USE_HTTPSRR`` is forced. In both cases ``CURL_DISABLE_DOH`` +must not be enabled. (There may be some configuration conflicts available for the +determined :-) + +The main functional change, as you would expect, is in ``lib/vtls/openssl.c`` +where an ECHConfig, if available from command line or DNS cache, is fed into +the OpenSSL library via the new APIs implemented in our OpenSSL fork for that +purpose. This code also implements the opportunistic (``--ech true``) or hard-fail +(``--ech hard``) logic. + +Other than that, the main additions are in ``lib/doh.c`` +where we reuse ``dohprobe()`` to retrieve an HTTPS RR value for the target +domain. If such a value is found, that is stored using a new ``doh_store_https()`` +function in a new field in the ``dohentry`` structure. + +The qname for the DoH query is modified if the port number is not 443, as +defined in the SVCB specification. + +When the DoH process has worked, ``Curl_doh_is_resolved()`` now also returns +the relevant HTTPS RR value data in the ``Curl_dns_entry`` structure. +That is later accessed when the TLS session is being established, if ECH is +enabled (from ``lib/vtls/openssl.c`` as described above). + +## Limitations + +Things that need fixing, but that can probably be ignored for the +moment: + +- We could easily add code to make use of an ``alpn=`` value found in an HTTPS + RR, passing that on to OpenSSL for use as the "inner" ALPN value, but have +yet to do that. + +Current limitations (more interesting than the above): + +- Only the first HTTPS RR value retrieved is actually processed as described + above, that could be extended in future, though picking the "right" HTTPS RR +could be non-trivial if multiple RRs are published - matching IP address hints +versus A/AAAA values might be a good basis for that. Last I checked though, +browsers supporting ECH did not handle multiple HTTPS RRs well, though that +needs re-checking as it has been a while. + +- It is unclear how one should handle any IP address hints found in an HTTPS RR. + It may be that a bit of consideration of how "multi-CDN" deployments might +emerge would provide good answers there, but for now, it is not clear how best +curl might handle those values when present in the DNS. + +- The SVCB/HTTPS RR specification supports a new "CNAME at apex" indirection + ("aliasMode") - the current code takes no account of that at all. One could +envisage implementing the equivalent of following CNAMEs in such cases, but +it is not clear if that'd be a good plan. (As of now, chrome browsers do not seem +to have any support for that "aliasMode" and we have not checked Firefox for that +recently.) + +- We have not investigated what related changes or additions might be needed + for applications using libcurl, as opposed to use of curl as a command line +tool. + +- We have not yet implemented tests as part of the usual curl test harness as +doing so would seem to require re-implementing an ECH-enabled server as part +of the curl test harness. For now, we have a ``./tests/ech_test.sh`` script +that attempts ECH with various test servers and with many combinations of the +allowed command line options. While that is a useful test and has find issues, +it is not comprehensive and we are not (as yet) sure what would be the right +level of coverage. When running that script you should not have a +``$HOME/.curlrc`` file that affects ECH or some of the negative tests could +produce spurious failures. + +## Building with cmake + +To build with cmake, assuming our ECH-enabled OpenSSL is as before: + +```bash + cd $HOME/code + git clone https://github.com/curl/curl + cd curl + mkdir build + cd build + cmake -DOPENSSL_ROOT_DIR=$HOME/code/openssl -DUSE_ECH=1 .. + ... + make + ... + [100%] Built target curl +``` + +The binary produced by the cmake build does not need any ECH-specific +``LD_LIBRARY_PATH`` setting. + +## BoringSSL build + +BoringSSL is also supported by curl and also supports ECH, so to build +with that, instead of our ECH-enabled OpenSSL: + +```bash + cd $HOME/code + git clone https://boringssl.googlesource.com/boringssl + cd boringssl + cmake -DCMAKE_INSTALL_PREFIX:PATH=$HOME/code/boringssl/inst -DBUILD_SHARED_LIBS=1 + make + ... + make install +``` + +Then: + +```bash + cd $HOME/code + git clone https://github.com/curl/curl + cd curl + autoreconf -fi + LDFLAGS="-Wl,-rpath,$HOME/code/boringssl/inst/lib" ./configure --with-ssl=$HOME/code/boringssl/inst --enable-ech + ...lots of output... + WARNING: ECH HTTPSRR enabled but marked EXPERIMENTAL. Use with caution. + make +``` + +The BoringSSL/AWS-LC APIs are fairly similar to those in our ECH-enabled +OpenSSL fork, so code changes are also in ``lib/vtls/openssl.c``, protected +via ``#ifdef OPENSSL_IS_BORINGSSL`` and are mostly obvious API variations. + +The BoringSSL/AWS-LC APIs however do not support the ``--ech pn:`` command +line variant as of now. + +## wolfSSL build + +wolfSSL also supports ECH and can be used by curl, so here's how: + +```bash + cd $HOME/code + git clone https://github.com/wolfSSL/wolfssl + cd wolfssl + ./autogen.sh + ./configure --prefix=$HOME/code/wolfssl/inst --enable-ech --enable-debug --enable-opensslextra + make + make install +``` + +The install prefix (``inst``) in the above causes wolfSSL to be installed there +and we seem to need that for the curl configure command to work out. The +``--enable-opensslextra`` turns out (after much faffing about;-) to be +important or else we get build problems with curl below. + +```bash + cd $HOME/code + git clone https://github.com/curl/curl + cd curl + autoreconf -fi + ./configure --with-wolfssl=$HOME/code/wolfssl/inst --enable-ech + make +``` + +There are some known issues with the ECH implementation in wolfSSL: + +- The main issue is that the client currently handles HelloRetryRequest + incorrectly. [HRR issue](https://github.com/wolfSSL/wolfssl/issues/6802).) + The HRR issue means that the client does not work for + [this ECH test web site](https://tls-ech.dev) and any other similarly configured + sites. +- There is also an issue related to so-called middlebox compatibility mode. + [middlebox compatibility issue](https://github.com/wolfSSL/wolfssl/issues/6774) + +### Code changes to support wolfSSL + +There are what seem like oddball differences: + +- The DoH URL in``$HOME/.curlrc`` can use `1.1.1.1` for OpenSSL but has to be + `one.one.one.one` for wolfSSL. The latter works for both, so OK, we us that. +- There seems to be some difference in CA databases too - the wolfSSL version + does not like ``defo.ie``, whereas the system and OpenSSL ones do. We can + ignore that for our purposes via ``--insecure``/``-k`` but would need to fix + for a real setup. (Browsers do like those certificates though.) + +Then there are some functional code changes: + +- tweak to ``configure.ac`` to check if wolfSSL has ECH or not +- added code to ``lib/vtls/wolfssl.c`` mirroring what's done in the + OpenSSL equivalent above. +- wolfSSL does not support ``--ech false`` or the ``--ech pn:`` command line + argument. + +The lack of support for ``--ech false`` is because wolfSSL has decided to +always at least GREASE if built to support ECH. In other words, GREASE is +a compile time choice for wolfSSL, but a runtime choice for OpenSSL or +BoringSSL/AWS-LC. (Both are reasonable.) + +## Additional notes + +### Supporting ECH without DoH + +All of the above only applies if DoH is being used. There should be a use-case +for ECH when DoH is not used by curl - if a system stub resolver supports DoT +or DoH, then, considering only ECH and the network threat model, it would make +sense for curl to support ECH without curl itself using DoH. The author for +example uses a combination of stubby+unbound as the system resolver listening +on localhost:53, so would fit this use-case. That said, it is unclear if +this is a niche that is worth trying to address. (The author is just as happy to +let curl use DoH to talk to the same public recursive that stubby might use:-) + +Assuming for the moment this is a use-case we would like to support, then if +DoH is not being used by curl, it is not clear at this time how to provide +support for ECH. One option would seem to be to extend the ``c-ares`` library +to support HTTPS RRs, but in that case it is not now clear whether such +changes would be attractive to the ``c-ares`` maintainers, nor whether the +"tag=value" extensibility inherent in the HTTPS/SVCB specification is a good +match for the ``c-ares`` approach of defining structures specific to decoded +answers for each supported RRtype. We are also not sure how many downstream +curl deployments actually make use of the ``c-ares`` library, which would +affect the utility of such changes. Another option might be to consider using +some other generic DNS library that does support HTTPS RRs, but it is unclear +if such a library could or would be used by all or almost all curl builds and +downstream releases of curl. + +Our current conclusion is that doing the above is likely best left until we +have some experience with the "using DoH" approach, so we are going to punt on +this for now. + +### Debugging + +Just a note to self as remembering this is a nuisance: + +```bash +LD_LIBRARY_PATH=$HOME/code/openssl:./lib/.libs gdb ./src/.libs/curl +``` + +### Localhost testing + +It can be useful to be able to run against a localhost OpenSSL ``s_server`` +for testing. We have published instructions for such +[localhost tests](https://github.com/defo-project/ech-dev-utils/blob/main/howtos/localhost-tests.md) +in another repository. Once you have that set up, you can start a server +and then run curl against that: + +```bash + cd $HOME/code/ech-dev-utils + ./scripts/echsvr.sh -d + ... +``` + +The ``echsvr.sh`` script supports many ECH-related options. Use ``echsvr.sh -h`` +for details. + +In another window: + +```bash + cd $HOME/code/curl/ + ./src/curl -vvv --insecure --connect-to foo.example.com:8443:localhost:8443 --ech ecl:AD7+DQA6uwAgACBix2B78sX+EQhEbxMspDOc8Z3xVS5aQpYP0Cxpc2AWPAAEAAEAAQALZXhhbXBsZS5jb20AAA== +``` + +### Automated use of ``retry_configs`` not supported so far... + +As of now we have not added support for using ``retry_config`` handling in the +application - for a command line tool, one can just use ``dig`` (or ``kdig``) +to get the HTTPS RR and pass the ECHConfigList from that on the command line, +if needed, or one can access the value from command line output in verbose more +and then reuse that in another invocation. + +Both our OpenSSL fork and BoringSSL/AWS-LC have APIs for both controlling GREASE +and accessing and logging ``retry_configs``, it seems wolfSSL has neither. + +### Testing ECH + +We have yet to add a robust test setup for ECH as that requires an ECH-enabled +test server. + +We have added two basic tests though, aiming to ensure that the client sends a +GREASE or real ECH extension when requested, and reacts correctly to the +failure of ECH in the latter case. (Given that `stunnel` has no ECH support.) + +As with other similar tests, those tests require the `stunnel` tool be +installed. On Ubuntu `sudo apt install stunnel4` achieves that. + +The test cases are: + +- data/test4000: GREASE ECH, expected result: connection succeeds +- data/test4001: real ECH, connection fails with error 101 (ECH required) diff --git a/curl/docs/EXPERIMENTAL.md b/curl/docs/EXPERIMENTAL.md new file mode 100644 index 0000000..43fc0fd --- /dev/null +++ b/curl/docs/EXPERIMENTAL.md @@ -0,0 +1,90 @@ + + +# Experimental + +Some features and functionality in curl and libcurl are considered +**EXPERIMENTAL**. + +Experimental support in curl means: + +1. Experimental features are provided to allow users to try them out and + provide feedback on functionality and API etc before they ship and get + "carved in stone". +2. You must enable the feature when invoking configure as otherwise curl is + not built with the feature present. +3. We strongly advise against using this feature in production. +4. **We reserve the right to change behavior** of the feature without sticking + to our API/ABI rules as we do for regular features, as long as it is marked + experimental. +5. Experimental features are clearly marked so in documentation. Beware. + +## Graduation + +1. Each experimental feature should have a set of documented requirements of + what is needed for that feature to graduate. Graduation means being removed + from the list of experiments. +2. An experiment should NOT graduate if it needs test cases to be disabled, + unless they are for minor features that are clearly documented as not + provided by the experiment and then the disabling should be managed inside + each affected test case. + +## Experimental features right now + +### HTTP/3 support (non-ngtcp2 backends) + +Graduation requirements: + +- The used libraries should be considered out-of-beta with a reasonable + expectation of a stable API going forward. + +- Using HTTP/3 with the given build should perform without risking busy-loops + +### The Rustls backend + +Graduation requirements: + +- a reasonable expectation of a stable API going forward. + +## ECH + +Use of the HTTPS resource record and Encrypted Client Hello (ECH) when using +DoH + +Graduation requirements: + +- ECH support exists in at least one widely used TLS library apart from + BoringSSL and wolfSSL. + +- feedback from users saying that ECH works for their use cases + +- it has been given time to mature, so no earlier than April 2025 (twelve + months after being added here) + +## SSL session import/export + +Import/Export of SSL sessions tickets in libcurl and curl command line +option '--ssl-session ' for faster TLS handshakes and use +of TLSv1.3/QUIC Early Data (0-RTT). + +Graduation requirements: + +- the implementation is considered safe + +- feedback from users saying that session export works for their use cases + +## HTTPS RR + +HTTPS records support is a requirement for ECH but is provided as a +stand-alone feature that is itself considered EXPERIMENTAL. + +Graduation requirements: + +- HTTPS records work for DoH, c-ares and the threaded resolver + +- HTTPS records can control ALPN and port number, at least + +- There are options to control HTTPS use diff --git a/curl/docs/FAQ.txt b/curl/docs/FAQ.txt new file mode 100644 index 0000000..9fae793 --- /dev/null +++ b/curl/docs/FAQ.txt @@ -0,0 +1,1560 @@ + _ _ ____ _ + ___| | | | _ \| | + / __| | | | |_) | | + | (__| |_| | _ <| |___ + \___|\___/|_| \_\_____| + +FAQ + + 1. Philosophy + 1.1 What is cURL? + 1.2 What is libcurl? + 1.3 What is curl not? + 1.4 When will you make curl do XXXX ? + 1.5 Who makes curl? + 1.6 What do you get for making curl? + 1.7 What about CURL from curl.com? + 1.8 I have a problem, who do I mail? + 1.9 Where do I buy commercial support for curl? + 1.10 How many are using curl? + 1.11 Why do you not update ca-bundle.crt + 1.12 I have a problem, who can I chat with? + 1.13 curl's ECCN number? + 1.14 How do I submit my patch? + 1.15 How do I port libcurl to my OS? + + 2. Install Related Problems + 2.1 configure fails when using static libraries + 2.2 Does curl work/build with other SSL libraries? + 2.3 How do I upgrade curl.exe in Windows? + 2.4 Does curl support SOCKS (RFC 1928) ? + + 3. Usage Problems + 3.1 curl: (1) SSL is disabled, https: not supported + 3.2 How do I tell curl to resume a transfer? + 3.3 Why does my posting using -F not work? + 3.4 How do I tell curl to run custom FTP commands? + 3.5 How can I disable the Accept: */* header? + 3.6 Does curl support ASP, XML, XHTML or HTML version Y? + 3.7 Can I use curl to delete/rename a file through FTP? + 3.8 How do I tell curl to follow HTTP redirects? + 3.9 How do I use curl in my favorite programming language? + 3.10 What about SOAP, WebDAV, XML-RPC or similar protocols over HTTP? + 3.11 How do I POST with a different Content-Type? + 3.12 Why do FTP-specific features over HTTP proxy fail? + 3.13 Why do my single/double quotes fail? + 3.14 Does curl support JavaScript or PAC (automated proxy config)? + 3.15 Can I do recursive fetches with curl? + 3.16 What certificates do I need when I use SSL? + 3.17 How do I list the root directory of an FTP server? + 3.18 Can I use curl to send a POST/PUT and not wait for a response? + 3.19 How do I get HTTP from a host using a specific IP address? + 3.20 How to SFTP from my user's home directory? + 3.21 Protocol xxx not supported or disabled in libcurl + 3.22 curl -X gives me HTTP problems + + 4. Running Problems + 4.2 Why do I get problems when I use & or % in the URL? + 4.3 How can I use {, }, [ or ] to specify multiple URLs? + 4.4 Why do I get downloaded data even though the webpage does not exist? + 4.5 Why do I get return code XXX from an HTTP server? + 4.5.1 "400 Bad Request" + 4.5.2 "401 Unauthorized" + 4.5.3 "403 Forbidden" + 4.5.4 "404 Not Found" + 4.5.5 "405 Method Not Allowed" + 4.5.6 "301 Moved Permanently" + 4.6 Can you tell me what error code 142 means? + 4.7 How do I keep usernames and passwords secret in curl command lines? + 4.8 I found a bug + 4.9 curl cannot authenticate to a server that requires NTLM? + 4.10 My HTTP request using HEAD, PUT or DELETE does not work + 4.11 Why do my HTTP range requests return the full document? + 4.12 Why do I get "certificate verify failed" ? + 4.13 Why is curl -R on Windows one hour off? + 4.14 Redirects work in browser but not with curl + 4.15 FTPS does not work + 4.16 My HTTP POST or PUT requests are slow + 4.17 Non-functional connect timeouts on Windows + 4.18 file:// URLs containing drive letters (Windows, NetWare) + 4.19 Why does not curl return an error when the network cable is unplugged? + 4.20 curl does not return error for HTTP non-200 responses + + 5. libcurl Issues + 5.1 Is libcurl thread-safe? + 5.2 How can I receive all data into a large memory chunk? + 5.3 How do I fetch multiple files with libcurl? + 5.4 Does libcurl do Winsock initialization on Win32 systems? + 5.5 Does CURLOPT_WRITEDATA and CURLOPT_READDATA work on Win32 ? + 5.6 What about Keep-Alive or persistent connections? + 5.7 Link errors when building libcurl on Windows + 5.8 libcurl.so.X: open failed: No such file or directory + 5.9 How does libcurl resolve hostnames? + 5.10 How do I prevent libcurl from writing the response to stdout? + 5.11 How do I make libcurl not receive the whole HTTP response? + 5.12 Can I make libcurl fake or hide my real IP address? + 5.13 How do I stop an ongoing transfer? + 5.14 Using C++ non-static functions for callbacks? + 5.15 How do I get an FTP directory listing? + 5.16 I want a different time-out + 5.17 Can I write a server with libcurl? + 5.18 Does libcurl use threads? + + 6. License Issues + 6.1 I have a GPL program, can I use the libcurl library? + 6.2 I have a closed-source program, can I use the libcurl library? + 6.3 I have a BSD licensed program, can I use the libcurl library? + 6.4 I have a program that uses LGPL libraries, can I use libcurl? + 6.5 Can I modify curl/libcurl for my program and keep the changes secret? + 6.6 Can you please change the curl/libcurl license to XXXX? + 6.7 What are my obligations when using libcurl in my commercial apps? + + 7. PHP/CURL Issues + 7.1 What is PHP/CURL? + 7.2 Who wrote PHP/CURL? + 7.3 Can I perform multiple requests using the same handle? + 7.4 Does PHP/CURL have dependencies? + + 8. Development + 8.1 Why does curl use C89? + 8.2 Will curl be rewritten? + +============================================================================== + +1. Philosophy + + 1.1 What is cURL? + + cURL is the name of the project. The name is a play on 'Client for URLs', + originally with URL spelled in uppercase to make it obvious it deals with + URLs. The fact it can also be read as 'see URL' also helped, it works as + an abbreviation for "Client URL Request Library" or why not the recursive + version: "curl URL Request Library". + + The cURL project produces two products: + + libcurl + + A client-side URL transfer library, supporting DICT, FILE, FTP, FTPS, + GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, + RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS + and WSS. + + libcurl supports HTTPS certificates, HTTP POST, HTTP PUT, FTP uploading, + Kerberos, SPNEGO, HTTP form based upload, proxies, cookies, user+password + authentication, file transfer resume, http proxy tunneling and more. + + libcurl is highly portable, it builds and works identically on numerous + platforms, including Solaris, NetBSD, FreeBSD, OpenBSD, Darwin, HP-UX, + IRIX, AIX, Tru64, Linux, UnixWare, HURD, Windows, Amiga, OS/2, macOS, + Ultrix, QNX, OpenVMS, RISC OS, Novell NetWare, DOS, Symbian, OSF, Android, + Minix, IBM TPF and more... + + libcurl is free, thread-safe, IPv6 compatible, feature rich, well + supported and fast. + + curl + + A command line tool for getting or sending data using URL syntax. + + Since curl uses libcurl, curl supports the same wide range of common + Internet protocols that libcurl does. + + We pronounce curl with an initial k sound. It rhymes with words like girl + and earl. This is a short WAV file to help you: + + https://media.merriam-webster.com/soundc11/c/curl0001.wav + + There are numerous sub-projects and related projects that also use the word + curl in the project names in various combinations, but you should take + notice that this FAQ is directed at the command-line tool named curl (and + libcurl the library), and may therefore not be valid for other curl-related + projects. (There is however a small section for the PHP/CURL in this FAQ.) + + 1.2 What is libcurl? + + libcurl is a reliable and portable library for doing Internet data transfers + using one or more of its supported Internet protocols. + + You can use libcurl freely in your application, be it open source, + commercial or closed-source. + + libcurl is most probably the most portable, most powerful and most often + used C-based multi-platform file transfer library on this planet - be it + open source or commercial. + + 1.3 What is curl not? + + curl is not a wget clone. That is a common misconception. Never, during + curl's development, have we intended curl to replace wget or compete on its + market. curl is targeted at single-shot file transfers. + + curl is not a website mirroring program. If you want to use curl to mirror + something: fine, go ahead and write a script that wraps around curl or use + libcurl to make it reality. + + curl is not an FTP site mirroring program. Sure, get and send FTP with curl + but if you want systematic and sequential behavior you should write a + script (or write a new program that interfaces libcurl) and do it. + + curl is not a PHP tool, even though it works perfectly well when used from + or with PHP (when using the PHP/CURL module). + + curl is not a program for a single operating system. curl exists, compiles, + builds and runs under a wide range of operating systems, including all + modern Unixes (and a bunch of older ones too), Windows, Amiga, OS/2, macOS, + QNX etc. + + 1.4 When will you make curl do XXXX ? + + We love suggestions of what to change in order to make curl and libcurl + better. We do however believe in a few rules when it comes to the future of + curl: + + curl -- the command line tool -- is to remain a non-graphical command line + tool. If you want GUIs or fancy scripting capabilities, you should look for + another tool that uses libcurl. + + We do not add things to curl that other small and available tools already do + well at the side. curl's output can be piped into another program or + redirected to another file for the next program to interpret. + + We focus on protocol related issues and improvements. If you want to do more + magic with the supported protocols than curl currently does, chances are + good we will agree. If you want to add more protocols, we may agree. + + If you want someone else to do all the work while you wait for us to + implement it for you, that is not a friendly attitude. We spend a + considerable time already on maintaining and developing curl. In order to + get more out of us, you should consider trading in some of your time and + effort in return. Simply go to the GitHub repository which resides at + https://github.com/curl/curl, fork the project, and create pull requests + with your proposed changes. + + If you write the code, chances are better that it will get into curl faster. + + 1.5 Who makes curl? + + curl and libcurl are not made by any single individual. Daniel Stenberg is + project leader and main developer, but other persons' submissions are + important and crucial. Anyone can contribute and post their changes and + improvements and have them inserted in the main sources (of course on the + condition that developers agree that the fixes are good). + + The full list of all contributors is found in the docs/THANKS file. + + curl is developed by a community, with Daniel at the wheel. + + 1.6 What do you get for making curl? + + Project cURL is entirely free and open. We do this voluntarily, mostly in + our spare time. Companies may pay individual developers to work on curl. + This is not controlled by nor supervised in any way by the curl project. + + We get help from companies. Haxx provides website, bandwidth, mailing lists + etc, GitHub hosts the primary git repository and other services like the bug + tracker at https://github.com/curl/curl. Also again, some companies have + sponsored certain parts of the development in the past and I hope some will + continue to do so in the future. + + If you want to support our project, consider a donation or a banner-program + or even better: by helping us with coding, documenting or testing etc. + + See also: https://curl.se/sponsors.html + + 1.7 What about CURL from curl.com? + + During the summer of 2001, curl.com was busy advertising their client-side + programming language for the web, named CURL. + + We are in no way associated with curl.com or their CURL programming + language. + + Our project name curl has been in effective use since 1998. We were not the + first computer related project to use the name "curl" and do not claim any + rights to the name. + + We recognize that we will be living in parallel with curl.com and wish them + every success. + + 1.8 I have a problem, who do I mail? + + Please do not mail any single individual unless you really need to. Keep + curl-related questions on a suitable mailing list. All available mailing + lists are listed in the MANUAL document and online at + https://curl.se/mail/ + + Keeping curl-related questions and discussions on mailing lists allows + others to join in and help, to share their ideas, to contribute their + suggestions and to spread their wisdom. Keeping discussions on public mailing + lists also allows for others to learn from this (both current and future + users thanks to the web based archives of the mailing lists), thus saving us + from having to repeat ourselves even more. Thanks for respecting this. + + If you have found or simply suspect a security problem in curl or libcurl, + submit all the details at https://hackerone.one/curl. On there we keep the + issue private while we investigate, confirm it, work and validate a fix and + agree on a time schedule for publication etc. That way we produce a fix in a + timely manner before the flaw is announced to the world, reducing the impact + the problem risks having on existing users. + + Security issues can also be taking to the curl security team by emailing + security at curl.se (closed list of receivers, mails are not disclosed). + + 1.9 Where do I buy commercial support for curl? + + curl is fully open source. It means you can hire any skilled engineer to fix + your curl-related problems. + + We list available alternatives on the curl website: + https://curl.se/support.html + + 1.10 How many are using curl? + + It is impossible to tell. + + We do not know how many users that knowingly have installed and use curl. + + We do not know how many users that use curl without knowing that they are in + fact using it. + + We do not know how many users that downloaded or installed curl and then + never use it. + + In 2020, we estimate that curl runs in roughly ten billion installations + world wide. + + 1.11 Why do you not update ca-bundle.crt + + In the cURL project we have decided not to attempt to keep this file updated + (or even present) since deciding what to add to a ca cert bundle is an + undertaking we have not been ready to accept, and the one we can get from + Mozilla is perfectly fine so there is no need to duplicate that work. + + Today, with many services performed over HTTPS, every operating system + should come with a default ca cert bundle that can be deemed somewhat + trustworthy and that collection (if reasonably updated) should be deemed to + be a lot better than a private curl version. + + If you want the most recent collection of ca certs that Mozilla Firefox + uses, we recommend that you extract the collection yourself from Mozilla + Firefox (by running 'make ca-bundle), or by using our online service setup + for this purpose: https://curl.se/docs/caextract.html + + 1.12 I have a problem who, can I chat with? + + There is a bunch of friendly people hanging out in the #curl channel on the + IRC network libera.chat. If you are polite and nice, chances are good that + you can get -- or provide -- help instantly. + + 1.13 curl's ECCN number? + + The US government restricts exports of software that contains or uses + cryptography. When doing so, the Export Control Classification Number (ECCN) + is used to identify the level of export control etc. + + Apache Software Foundation gives a good explanation of ECCNs at + https://www.apache.org/dev/crypto.html + + We believe curl's number might be ECCN 5D002, another possibility is + 5D992. It seems necessary to write them (the authority that administers ECCN + numbers), asking to confirm. + + Comprehensible explanations of the meaning of such numbers and how to obtain + them (resp.) are here + + https://www.bis.doc.gov/licensing/exportingbasics.htm + https://www.bis.doc.gov/licensing/do_i_needaneccn.html + + An incomprehensible description of the two numbers above is here + https://www.bis.doc.gov/index.php/documents/new-encryption/1653-ccl5-pt2-3 + + 1.14 How do I submit my patch? + + We strongly encourage you to submit changes and improvements directly as + "pull requests" on GitHub: https://github.com/curl/curl/pulls + + If you for any reason cannot or will not deal with GitHub, send your patch to + the curl-library mailing list. We are many subscribers there and there are + lots of people who can review patches, comment on them and "receive" them + properly. + + Lots of more details are found in the CONTRIBUTE.md and INTERNALS.md + documents. + + 1.15 How do I port libcurl to my OS? + + Here's a rough step-by-step: + + 1. copy a suitable lib/config-*.h file as a start to lib/config-[youros].h + + 2. edit lib/config-[youros].h to match your OS and setup + + 3. edit lib/curl_setup.h to include config-[youros].h when your OS is + detected by the preprocessor, in the style others already exist + + 4. compile lib/*.c and make them into a library + + +2. Install Related Problems + + 2.1 configure fails when using static libraries + + You may find that configure fails to properly detect the entire dependency + chain of libraries when you provide static versions of the libraries that + configure checks for. + + The reason why static libraries is much harder to deal with is that for them + we do not get any help but the script itself must know or check what more + libraries that are needed (with shared libraries, that dependency "chain" is + handled automatically). This is an error-prone process and one that also + tends to vary over time depending on the release versions of the involved + components and may also differ between operating systems. + + For that reason, configure does few attempts to actually figure this out and + you are instead encouraged to set LIBS and LDFLAGS accordingly when you + invoke configure, and point out the needed libraries and set the necessary + flags yourself. + + 2.2 Does curl work with other SSL libraries? + + curl has been written to use a generic SSL function layer internally, and + that SSL functionality can then be provided by one out of many different SSL + backends. + + curl can be built to use one of the following SSL alternatives: OpenSSL, + LibreSSL, BoringSSL, AWS-LC, GnuTLS, wolfSSL, mbedTLS, Secure Transport + (native iOS/macOS), Schannel (native Windows), BearSSL or Rustls. They all + have their pros and cons, and we try to maintain a comparison of them here: + https://curl.se/docs/ssl-compared.html + + 2.3 How do I upgrade curl.exe in Windows? + + The curl tool that is shipped as an integrated component of Windows 10 and + Windows 11 is managed by Microsoft. If you were to delete the file or + replace it with a newer version downloaded from https://curl.se/windows, + then Windows Update will cease to work on your system. + + There is no way to independently force an upgrade of the curl.exe that is + part of Windows other than through the regular Windows update process. There + is also nothing the curl project itself can do about this, since this is + managed and controlled entirely by Microsoft as owners of the operating + system. + + You can always download and install the latest version of curl for Windows + from https://curl.se/windows into a separate location. + + 2.4 Does curl support SOCKS (RFC 1928) ? + + Yes, SOCKS 4 and 5 are supported. + +3. Usage problems + + 3.1 curl: (1) SSL is disabled, https: not supported + + If you get this output when trying to get anything from an HTTPS server, it + means that the instance of curl/libcurl that you are using was built without + support for this protocol. + + This could have happened if the configure script that was run at build time + could not find all libs and include files curl requires for SSL to work. If + the configure script fails to find them, curl is simply built without SSL + support. + + To get HTTPS support into a curl that was previously built but that reports + that HTTPS is not supported, you should dig through the document and logs + and check out why the configure script does not find the SSL libs and/or + include files. + + Also, check out the other paragraph in this FAQ labeled "configure does not + find OpenSSL even when it is installed". + + 3.2 How do I tell curl to resume a transfer? + + curl supports resumed transfers both ways on both FTP and HTTP. + Try the -C option. + + 3.3 Why does my posting using -F not work? + + You cannot arbitrarily use -F or -d, the choice between -F or -d depends on + the HTTP operation you need curl to do and what the web server that will + receive your post expects. + + If the form you are trying to submit uses the type 'multipart/form-data', + then and only then you must use the -F type. In all the most common cases, + you should use -d which then causes a posting with the type + 'application/x-www-form-urlencoded'. + + This is described in some detail in the MANUAL and TheArtOfHttpScripting + documents, and if you do not understand it the first time, read it again + before you post questions about this to the mailing list. Also, try reading + through the mailing list archives for old postings and questions regarding + this. + + 3.4 How do I tell curl to run custom FTP commands? + + You can tell curl to perform optional commands both before and/or after a + file transfer. Study the -Q/--quote option. + + Since curl is used for file transfers, you do not normally use curl to + perform FTP commands without transferring anything. Therefore you must + always specify a URL to transfer to/from even when doing custom FTP + commands, or use -I which implies the "no body" option sent to libcurl. + + 3.5 How can I disable the Accept: */* header? + + You can change all internally generated headers by adding a replacement with + the -H/--header option. By adding a header with empty contents you safely + disable that one. Use -H "Accept:" to disable that specific header. + + 3.6 Does curl support ASP, XML, XHTML or HTML version Y? + + To curl, all contents are alike. It does not matter how the page was + generated. It may be ASP, PHP, Perl, shell-script, SSI or plain HTML + files. There is no difference to curl and it does not even know what kind of + language that generated the page. + + See also item 3.14 regarding JavaScript. + + 3.7 Can I use curl to delete/rename a file through FTP? + + Yes. You specify custom FTP commands with -Q/--quote. + + One example would be to delete a file after you have downloaded it: + + curl -O ftp://example.com/coolfile -Q '-DELE coolfile' + + or rename a file after upload: + + curl -T infile ftp://example.com/dir/ -Q "-RNFR infile" -Q "-RNTO newname" + + 3.8 How do I tell curl to follow HTTP redirects? + + curl does not follow so-called redirects by default. The Location: header + that informs the client about this is only interpreted if you are using the + -L/--location option. As in: + + curl -L http://example.com + + Not all redirects are HTTP ones, see 4.14 + + 3.9 How do I use curl in my favorite programming language? + + Many programming languages have interfaces/bindings that allow you to use + curl without having to use the command line tool. If you are fluent in such + a language, you may prefer to use one of these interfaces instead. + + Find out more about which languages that support curl directly, and how to + install and use them, in the libcurl section of the curl website: + https://curl.se/libcurl/ + + All the various bindings to libcurl are made by other projects and people, + outside of the cURL project. The cURL project itself only produces libcurl + with its plain C API. If you do not find anywhere else to ask you can ask + about bindings on the curl-library list too, but be prepared that people on + that list may not know anything about bindings. + + In December 2021, there were interfaces available for the following + languages: Ada95, Basic, C, C++, Ch, Cocoa, D, Delphi, Dylan, Eiffel, + Euphoria, Falcon, Ferite, Gambas, glib/GTK+, Go, Guile, Harbour, Haskell, + Java, Julia, Lisp, Lua, Mono, .NET, node.js, Object-Pascal, OCaml, Pascal, + Perl, PHP, PostgreSQL, Python, R, Rexx, Ring, RPG, Ruby, Rust, Scheme, + Scilab, S-Lang, Smalltalk, SP-Forth, SPL, Tcl, Visual Basic, Visual FoxPro, + Q, wxwidgets, XBLite and Xoho. By the time you read this, additional ones + may have appeared. + + 3.10 What about SOAP, WebDAV, XML-RPC or similar protocols over HTTP? + + curl adheres to the HTTP spec, which basically means you can play with *any* + protocol that is built on top of HTTP. Protocols such as SOAP, WebDAV and + XML-RPC are all such ones. You can use -X to set custom requests and -H to + set custom headers (or replace internally generated ones). + + Using libcurl is of course just as good and you would just use the proper + library options to do the same. + + 3.11 How do I POST with a different Content-Type? + + You can always replace the internally generated headers with -H/--header. + To make a simple HTTP POST with text/xml as content-type, do something like: + + curl -d "datatopost" -H "Content-Type: text/xml" [URL] + + 3.12 Why do FTP-specific features over HTTP proxy fail? + + Because when you use an HTTP proxy, the protocol spoken on the network will + be HTTP, even if you specify an FTP URL. This effectively means that you + normally cannot use FTP-specific features such as FTP upload and FTP quote + etc. + + There is one exception to this rule, and that is if you can "tunnel through" + the given HTTP proxy. Proxy tunneling is enabled with a special option (-p) + and is generally not available as proxy admins usually disable tunneling to + ports other than 443 (which is used for HTTPS access through proxies). + + 3.13 Why do my single/double quotes fail? + + To specify a command line option that includes spaces, you might need to + put the entire option within quotes. Like in: + + curl -d " with spaces " example.com + + or perhaps + + curl -d ' with spaces ' example.com + + Exactly what kind of quotes and how to do this is entirely up to the shell + or command line interpreter that you are using. For most Unix shells, you + can more or less pick either single (') or double (") quotes. For + Windows/DOS command prompts you must use double (") quotes, and if the + option string contains inner double quotes you can escape them with a + backslash. + + For Windows powershell the arguments are not always passed on as expected + because curl is not a powershell script. You may or may not be able to use + single quotes. To escape inner double quotes seems to require a + backslash-backtick escape sequence and the outer quotes as double quotes. + + Please study the documentation for your particular environment. Examples in + the curl docs will use a mix of both of these as shown above. You must + adjust them to work in your environment. + + Remember that curl works and runs on more operating systems than most single + individuals have ever tried. + + 3.14 Does curl support JavaScript or PAC (automated proxy config)? + + Many webpages do magic stuff using embedded JavaScript. curl and libcurl + have no built-in support for that, so it will be treated just like any other + contents. + + .pac files are a Netscape invention and are sometimes used by organizations + to allow them to differentiate which proxies to use. The .pac contents is + just a JavaScript program that gets invoked by the browser and that returns + the name of the proxy to connect to. Since curl does not support JavaScript, + it cannot support .pac proxy configuration either. + + Some workarounds usually suggested to overcome this JavaScript dependency: + + Depending on the JavaScript complexity, write up a script that translates it + to another language and execute that. + + Read the JavaScript code and rewrite the same logic in another language. + + Implement a JavaScript interpreter, people have successfully used the + Mozilla JavaScript engine in the past. + + Ask your admins to stop this, for a static proxy setup or similar. + + 3.15 Can I do recursive fetches with curl? + + No. curl itself has no code that performs recursive operations, such as + those performed by wget and similar tools. + + There exists wrapper scripts with that functionality (for example the + curlmirror perl script), and you can write programs based on libcurl to do + it, but the command line tool curl itself cannot. + + 3.16 What certificates do I need when I use SSL? + + There are three different kinds of "certificates" to keep track of when we + talk about using SSL-based protocols (HTTPS or FTPS) using curl or libcurl. + + CLIENT CERTIFICATE + + The server you communicate with may require that you can provide this in + order to prove that you actually are who you claim to be. If the server + does not require this, you do not need a client certificate. + + A client certificate is always used together with a private key, and the + private key has a pass phrase that protects it. + + SERVER CERTIFICATE + + The server you communicate with has a server certificate. You can and should + verify this certificate to make sure that you are truly talking to the real + server and not a server impersonating it. + + CERTIFICATE AUTHORITY CERTIFICATE ("CA cert") + + You often have several CA certs in a CA cert bundle that can be used to + verify a server certificate that was signed by one of the authorities in the + bundle. curl does not come with a CA cert bundle but most curl installs + provide one. You can also override the default. + + The server certificate verification process is made by using a Certificate + Authority certificate ("CA cert") that was used to sign the server + certificate. Server certificate verification is enabled by default in curl + and libcurl and is often the reason for problems as explained in FAQ entry + 4.12 and the SSLCERTS document + (https://curl.se/docs/sslcerts.html). Server certificates that are + "self-signed" or otherwise signed by a CA that you do not have a CA cert + for, cannot be verified. If the verification during a connect fails, you are + refused access. You then need to explicitly disable the verification to + connect to the server. + + 3.17 How do I list the root directory of an FTP server? + + There are two ways. The way defined in the RFC is to use an encoded slash + in the first path part. List the "/tmp" directory like this: + + curl ftp://ftp.example.com/%2ftmp/ + + or the not-quite-kosher-but-more-readable way, by simply starting the path + section of the URL with a slash: + + curl ftp://ftp.example.com//tmp/ + + 3.18 Can I use curl to send a POST/PUT and not wait for a response? + + No. + + You can easily write your own program using libcurl to do such stunts. + + 3.19 How do I get HTTP from a host using a specific IP address? + + For example, you may be trying out a website installation that is not yet in + the DNS. Or you have a site using multiple IP addresses for a given host + name and you want to address a specific one out of the set. + + Set a custom Host: header that identifies the server name you want to reach + but use the target IP address in the URL: + + curl --header "Host: www.example.com" http://127.0.0.1/ + + You can also opt to add faked hostname entries to curl with the --resolve + option. That has the added benefit that things like redirects will also work + properly. The above operation would instead be done as: + + curl --resolve www.example.com:80:127.0.0.1 http://www.example.com/ + + 3.20 How to SFTP from my user's home directory? + + Contrary to how FTP works, SFTP and SCP URLs specify the exact directory to + work with. It means that if you do not specify that you want the user's home + directory, you get the actual root directory. + + To specify a file in your user's home directory, you need to use the correct + URL syntax which for SFTP might look similar to: + + curl -O -u user:password sftp://example.com/~/file.txt + + and for SCP it is just a different protocol prefix: + + curl -O -u user:password scp://example.com/~/file.txt + + 3.21 Protocol xxx not supported or disabled in libcurl + + When passing on a URL to curl to use, it may respond that the particular + protocol is not supported or disabled. The particular way this error message + is phrased is because curl does not make a distinction internally of whether + a particular protocol is not supported (i.e. never got any code added that + knows how to speak that protocol) or if it was explicitly disabled. curl can + be built to only support a given set of protocols, and the rest would then + be disabled or not supported. + + Note that this error will also occur if you pass a wrongly spelled protocol + part as in "htpt://example.com" or as in the less evident case if you prefix + the protocol part with a space as in " http://example.com/". + + 3.22 curl -X gives me HTTP problems + + In normal circumstances, -X should hardly ever be used. + + By default you use curl without explicitly saying which request method to + use when the URL identifies an HTTP transfer. If you just pass in a URL like + "curl http://example.com" it will use GET. If you use -d or -F curl will use + POST, -I will cause a HEAD and -T will make it a PUT. + + If for whatever reason you are not happy with these default choices that curl + does for you, you can override those request methods by specifying -X + [WHATEVER]. This way you can for example send a DELETE by doing "curl -X + DELETE [URL]". + + It is thus pointless to do "curl -XGET [URL]" as GET would be used anyway. + In the same vein it is pointless to do "curl -X POST -d data [URL]". You can + make a fun and somewhat rare request that sends a request-body in a GET + request with something like "curl -X GET -d data [URL]" + + Note that -X does not actually change curl's behavior as it only modifies the + actual string sent in the request, but that may of course trigger a + different set of events. + + Accordingly, by using -XPOST on a command line that for example would follow + a 303 redirect, you will effectively prevent curl from behaving + correctly. Be aware. + + +4. Running Problems + + 4.2 Why do I get problems when I use & or % in the URL? + + In general Unix shells, the & symbol is treated specially and when used, it + runs the specified command in the background. To safely send the & as a part + of a URL, you should quote the entire URL by using single (') or double (") + quotes around it. Similar problems can also occur on some shells with other + characters, including ?*!$~(){}<>\|;`. When in doubt, quote the URL. + + An example that would invoke a remote CGI that uses &-symbols could be: + + curl 'http://www.example.com/cgi-bin/query?text=yes&q=curl' + + In Windows, the standard DOS shell treats the percent sign specially and you + need to use TWO percent signs for each single one you want to use in the + URL. + + If you want a literal percent sign to be part of the data you pass in a POST + using -d/--data you must encode it as '%25' (which then also needs the + percent sign doubled on Windows machines). + + 4.3 How can I use {, }, [ or ] to specify multiple URLs? + + Because those letters have a special meaning to the shell, to be used in + a URL specified to curl you must quote them. + + An example that downloads two URLs (sequentially) would be: + + curl '{curl,www}.haxx.se' + + To be able to use those characters as actual parts of the URL (without using + them for the curl URL "globbing" system), use the -g/--globoff option: + + curl -g 'www.example.com/weirdname[].html' + + 4.4 Why do I get downloaded data even though the webpage does not exist? + + curl asks remote servers for the page you specify. If the page does not exist + at the server, the HTTP protocol defines how the server should respond and + that means that headers and a "page" will be returned. That is simply how + HTTP works. + + By using the --fail option you can tell curl explicitly to not get any data + if the HTTP return code does not say success. + + 4.5 Why do I get return code XXX from an HTTP server? + + RFC 2616 clearly explains the return codes. This is a short transcript. Go + read the RFC for exact details: + + 4.5.1 "400 Bad Request" + + The request could not be understood by the server due to malformed + syntax. The client SHOULD NOT repeat the request without modifications. + + 4.5.2 "401 Unauthorized" + + The request requires user authentication. + + 4.5.3 "403 Forbidden" + + The server understood the request, but is refusing to fulfill it. + Authorization will not help and the request SHOULD NOT be repeated. + + 4.5.4 "404 Not Found" + + The server has not found anything matching the Request-URI. No indication + is given as to whether the condition is temporary or permanent. + + 4.5.5 "405 Method Not Allowed" + + The method specified in the Request-Line is not allowed for the resource + identified by the Request-URI. The response MUST include an Allow header + containing a list of valid methods for the requested resource. + + 4.5.6 "301 Moved Permanently" + + If you get this return code and an HTML output similar to this: + +

Moved Permanently

The document has moved here. + + it might be because you requested a directory URL but without the trailing + slash. Try the same operation again _with_ the trailing URL, or use the + -L/--location option to follow the redirection. + + 4.6 Can you tell me what error code 142 means? + + All curl error codes are described at the end of the man page, in the + section called "EXIT CODES". + + Error codes that are larger than the highest documented error code means + that curl has exited due to a crash. This is a serious error, and we + appreciate a detailed bug report from you that describes how we could go + ahead and repeat this. + + 4.7 How do I keep usernames and passwords secret in curl command lines? + + This problem has two sides: + + The first part is to avoid having clear-text passwords in the command line + so that they do not appear in 'ps' outputs and similar. That is easily + avoided by using the "-K" option to tell curl to read parameters from a file + or stdin to which you can pass the secret info. curl itself will also + attempt to "hide" the given password by blanking out the option - this + does not work on all platforms. + + To keep the passwords in your account secret from the rest of the world is + not a task that curl addresses. You could of course encrypt them somehow to + at least hide them from being read by human eyes, but that is not what + anyone would call security. + + Also note that regular HTTP (using Basic authentication) and FTP passwords + are sent as cleartext across the network. All it takes for anyone to fetch + them is to listen on the network. Eavesdropping is easy. Use more secure + authentication methods (like Digest, Negotiate or even NTLM) or consider the + SSL-based alternatives HTTPS and FTPS. + + 4.8 I found a bug + + It is not a bug if the behavior is documented. Read the docs first. + Especially check out the KNOWN_BUGS file, it may be a documented bug. + + If it is a problem with a binary you have downloaded or a package for your + particular platform, try contacting the person who built the package/archive + you have. + + If there is a bug, read the BUGS document first. Then report it as described + in there. + + 4.9 curl cannot authenticate to a server that requires NTLM? + + NTLM support requires OpenSSL, GnuTLS, mbedTLS, Secure Transport, or + Microsoft Windows libraries at build-time to provide this functionality. + + 4.10 My HTTP request using HEAD, PUT or DELETE does not work + + Many web servers allow or demand that the administrator configures the + server properly for these requests to work on the web server. + + Some servers seem to support HEAD only on certain kinds of URLs. + + To fully grasp this, try the documentation for the particular server + software you are trying to interact with. This is not anything curl can do + anything about. + + 4.11 Why do my HTTP range requests return the full document? + + Because the range may not be supported by the server, or the server may + choose to ignore it and return the full document anyway. + + 4.12 Why do I get "certificate verify failed" ? + + When you invoke curl and get an error 60 error back it means that curl + could not verify that the server's certificate was good. curl verifies the + certificate using the CA cert bundle and verifying for which names the + certificate has been granted. + + To completely disable the certificate verification, use -k. This does + however enable man-in-the-middle attacks and makes the transfer INSECURE. + We strongly advise against doing this for more than experiments. + + If you get this failure with a CA cert bundle installed and used, the + server's certificate might not be signed by one of the CA's in your CA + store. It might for example be self-signed. You then correct this problem by + obtaining a valid CA cert for the server. Or again, decrease the security by + disabling this check. + + At times, you find that the verification works in your favorite browser but + fails in curl. When this happens, the reason is usually that the server + sends an incomplete cert chain. The server is mandated to send all + "intermediate certificates" but does not. This typically works with browsers + anyway since they A) cache such certs and B) supports AIA which downloads + such missing certificates on demand. This is a server misconfiguration. A + good way to figure out if this is the case it to use the SSL Labs server + test and check the certificate chain: https://www.ssllabs.com/ssltest/ + + Details are also in the SSLCERTS.md document, found online here: + https://curl.se/docs/sslcerts.html + + 4.13 Why is curl -R on Windows one hour off? + + Since curl 7.53.0 this issue should be fixed as long as curl was built with + any modern compiler that allows for a 64-bit curl_off_t type. For older + compilers or prior curl versions it may set a time that appears one hour off. + This happens due to a flaw in how Windows stores and uses file modification + times and it is not easily worked around. For more details read this: + https://www.codeproject.com/Articles/1144/Beating-the-Daylight-Savings-Time-bug-and-getting + + 4.14 Redirects work in browser but not with curl + + curl supports HTTP redirects well (see item 3.8). Browsers generally support + at least two other ways to perform redirects that curl does not: + + Meta tags. You can write an HTML tag that will cause the browser to redirect + to another given URL after a certain time. + + JavaScript. You can write a JavaScript program embedded in an HTML page that + redirects the browser to another given URL. + + There is no way to make curl follow these redirects. You must either + manually figure out what the page is set to do, or write a script that parses + the results and fetches the new URL. + + 4.15 FTPS does not work + + curl supports FTPS (sometimes known as FTP-SSL) both implicit and explicit + mode. + + When a URL is used that starts with FTPS://, curl assumes implicit SSL on + the control connection and will therefore immediately connect and try to + speak SSL. FTPS:// connections default to port 990. + + To use explicit FTPS, you use an FTP:// URL and the --ssl-reqd option (or one + of its related flavors). This is the most common method, and the one + mandated by RFC 4217. This kind of connection will then of course use the + standard FTP port 21 by default. + + 4.16 My HTTP POST or PUT requests are slow + + libcurl makes all POST and PUT requests (except for requests with a small + request body) use the "Expect: 100-continue" header. This header allows the + server to deny the operation early so that libcurl can bail out before having + to send any data. This is useful in authentication cases and others. + + However, many servers do not implement the Expect: stuff properly and if the + server does not respond (positively) within 1 second libcurl will continue + and send off the data anyway. + + You can disable libcurl's use of the Expect: header the same way you disable + any header, using -H / CURLOPT_HTTPHEADER, or by forcing it to use HTTP 1.0. + + 4.17 Non-functional connect timeouts + + In most Windows setups having a timeout longer than 21 seconds make no + difference, as it will only send 3 TCP SYN packets and no more. The second + packet sent three seconds after the first and the third six seconds after + the second. No more than three packets are sent, no matter how long the + timeout is set. + + See option TcpMaxConnectRetransmissions on this page: + https://support.microsoft.com/en-us/kb/175523/en-us + + Also, even on non-Windows systems there may run a firewall or anti-virus + software or similar that accepts the connection but does not actually do + anything else. This will make (lib)curl to consider the connection connected + and thus the connect timeout will not trigger. + + 4.18 file:// URLs containing drive letters (Windows, NetWare) + + When using curl to try to download a local file, one might use a URL + in this format: + + file://D:/blah.txt + + you will find that even if D:\blah.txt does exist, curl returns a 'file + not found' error. + + According to RFC 1738 (https://www.ietf.org/rfc/rfc1738.txt), + file:// URLs must contain a host component, but it is ignored by + most implementations. In the above example, 'D:' is treated as the + host component, and is taken away. Thus, curl tries to open '/blah.txt'. + If your system is installed to drive C:, that will resolve to 'C:\blah.txt', + and if that does not exist you will get the not found error. + + To fix this problem, use file:// URLs with *three* leading slashes: + + file:///D:/blah.txt + + Alternatively, if it makes more sense, specify 'localhost' as the host + component: + + file://localhost/D:/blah.txt + + In either case, curl should now be looking for the correct file. + + 4.19 Why does not curl return an error when the network cable is unplugged? + + Unplugging a cable is not an error situation. The TCP/IP protocol stack + was designed to be fault tolerant, so even though there may be a physical + break somewhere the connection should not be affected, just possibly + delayed. Eventually, the physical break will be fixed or the data will be + re-routed around the physical problem through another path. + + In such cases, the TCP/IP stack is responsible for detecting when the + network connection is irrevocably lost. Since with some protocols it is + perfectly legal for the client to wait indefinitely for data, the stack may + never report a problem, and even when it does, it can take up to 20 minutes + for it to detect an issue. The curl option --keepalive-time enables + keep-alive support in the TCP/IP stack which makes it periodically probe the + connection to make sure it is still available to send data. That should + reliably detect any TCP/IP network failure. + + TCP keep alive will not detect the network going down before the TCP/IP + connection is established (e.g. during a DNS lookup) or using protocols that + do not use TCP. To handle those situations, curl offers a number of timeouts + on its own. --speed-limit/--speed-time will abort if the data transfer rate + falls too low, and --connect-timeout and --max-time can be used to put an + overall timeout on the connection phase or the entire transfer. + + A libcurl-using application running in a known physical environment (e.g. + an embedded device with only a single network connection) may want to act + immediately if its lone network connection goes down. That can be achieved + by having the application monitor the network connection on its own using an + OS-specific mechanism, then signaling libcurl to abort (see also item 5.13). + + 4.20 curl does not return error for HTTP non-200 responses + + Correct. Unless you use -f (--fail). + + When doing HTTP transfers, curl will perform exactly what you are asking it + to do and if successful it will not return an error. You can use curl to + test your web server's "file not found" page (that gets 404 back), you can + use it to check your authentication protected webpages (that gets a 401 + back) and so on. + + The specific HTTP response code does not constitute a problem or error for + curl. It simply sends and delivers HTTP as you asked and if that worked, + everything is fine and dandy. The response code is generally providing more + higher level error information that curl does not care about. The error was + not in the HTTP transfer. + + If you want your command line to treat error codes in the 400 and up range + as errors and thus return a non-zero value and possibly show an error + message, curl has a dedicated option for that: -f (CURLOPT_FAILONERROR in + libcurl speak). + + You can also use the -w option and the variable %{response_code} to extract + the exact response code that was returned in the response. + +5. libcurl Issues + + 5.1 Is libcurl thread-safe? + + Yes. + + We have written the libcurl code specifically adjusted for multi-threaded + programs. libcurl will use thread-safe functions instead of non-safe ones if + your system has such. Note that you must never share the same handle in + multiple threads. + + There may be some exceptions to thread safety depending on how libcurl was + built. Please review the guidelines for thread safety to learn more: + https://curl.se/libcurl/c/threadsafe.html + + 5.2 How can I receive all data into a large memory chunk? + + [ See also the examples/getinmemory.c source ] + + You are in full control of the callback function that gets called every time + there is data received from the remote server. You can make that callback do + whatever you want. You do not have to write the received data to a file. + + One solution to this problem could be to have a pointer to a struct that you + pass to the callback function. You set the pointer using the + CURLOPT_WRITEDATA option. Then that pointer will be passed to the callback + instead of a FILE * to a file: + + /* imaginary struct */ + struct MemoryStruct { + char *memory; + size_t size; + }; + + /* imaginary callback function */ + size_t + WriteMemoryCallback(void *ptr, size_t size, size_t nmemb, void *data) + { + size_t realsize = size * nmemb; + struct MemoryStruct *mem = (struct MemoryStruct *)data; + + mem->memory = (char *)realloc(mem->memory, mem->size + realsize + 1); + if (mem->memory) { + memcpy(&(mem->memory[mem->size]), ptr, realsize); + mem->size += realsize; + mem->memory[mem->size] = 0; + } + return realsize; + } + + 5.3 How do I fetch multiple files with libcurl? + + libcurl has excellent support for transferring multiple files. You should + just repeatedly set new URLs with curl_easy_setopt() and then transfer it + with curl_easy_perform(). The handle you get from curl_easy_init() is not + only reusable, but you are even encouraged to reuse it if you can, as that + will enable libcurl to use persistent connections. + + 5.4 Does libcurl do Winsock initialization on Win32 systems? + + Yes, if told to in the curl_global_init() call. + + 5.5 Does CURLOPT_WRITEDATA and CURLOPT_READDATA work on Win32 ? + + Yes, but you cannot open a FILE * and pass the pointer to a DLL and have + that DLL use the FILE * (as the DLL and the client application cannot access + each others' variable memory areas). If you set CURLOPT_WRITEDATA you must + also use CURLOPT_WRITEFUNCTION as well to set a function that writes the + file, even if that simply writes the data to the specified FILE *. + Similarly, if you use CURLOPT_READDATA you must also specify + CURLOPT_READFUNCTION. + + 5.6 What about Keep-Alive or persistent connections? + + curl and libcurl have excellent support for persistent connections when + transferring several files from the same server. curl will attempt to reuse + connections for all URLs specified on the same command line/config file, and + libcurl will reuse connections for all transfers that are made using the + same libcurl handle. + + When you use the easy interface the connection cache is kept within the easy + handle. If you instead use the multi interface, the connection cache will be + kept within the multi handle and will be shared among all the easy handles + that are used within the same multi handle. + + 5.7 Link errors when building libcurl on Windows + + You need to make sure that your project, and all the libraries (both static + and dynamic) that it links against, are compiled/linked against the same run + time library. + + This is determined by the /MD, /ML, /MT (and their corresponding /M?d) + options to the command line compiler. /MD (linking against MSVCRT dll) seems + to be the most commonly used option. + + When building an application that uses the static libcurl library, you must + add -DCURL_STATICLIB to your CFLAGS. Otherwise the linker will look for + dynamic import symbols. If you are using Visual Studio, you need to instead + add CURL_STATICLIB in the "Preprocessor Definitions" section. + + If you get a linker error like "unknown symbol __imp__curl_easy_init ..." you + have linked against the wrong (static) library. If you want to use the + libcurl.dll and import lib, you do not need any extra CFLAGS, but use one of + the import libraries below. These are the libraries produced by the various + lib/Makefile.* files: + + Target: static lib. import lib for libcurl*.dll. + ----------------------------------------------------------- + MinGW: libcurl.a libcurldll.a + MSVC (release): libcurl.lib libcurl_imp.lib + MSVC (debug): libcurld.lib libcurld_imp.lib + Borland: libcurl.lib libcurl_imp.lib + + 5.8 libcurl.so.X: open failed: No such file or directory + + This is an error message you might get when you try to run a program linked + with a shared version of libcurl and your runtime linker (ld.so) could not + find the shared library named libcurl.so.X. (Where X is the number of the + current libcurl ABI, typically 3 or 4). + + You need to make sure that ld.so finds libcurl.so.X. You can do that + multiple ways, and it differs somewhat between different operating systems. + They are usually: + + * Add an option to the linker command line that specify the hard-coded path + the runtime linker should check for the lib (usually -R) + + * Set an environment variable (LD_LIBRARY_PATH for example) where ld.so + should check for libs + + * Adjust the system's config to check for libs in the directory where you have + put the library (like Linux's /etc/ld.so.conf) + + 'man ld.so' and 'man ld' will tell you more details + + 5.9 How does libcurl resolve hostnames? + + libcurl supports a large number of name resolve functions. One of them is + picked at build-time and will be used unconditionally. Thus, if you want to + change name resolver function you must rebuild libcurl and tell it to use a + different function. + + - The non-IPv6 resolver that can use one of four different hostname resolve + calls (depending on what your system supports): + + A - gethostbyname() + B - gethostbyname_r() with 3 arguments + C - gethostbyname_r() with 5 arguments + D - gethostbyname_r() with 6 arguments + + - The IPv6-resolver that uses getaddrinfo() + + - The c-ares based name resolver that uses the c-ares library for resolves. + Using this offers asynchronous name resolves. + + - The threaded resolver (default option on Windows). It uses: + + A - gethostbyname() on plain IPv4 hosts + B - getaddrinfo() on IPv6 enabled hosts + + Also note that libcurl never resolves or reverse-lookups addresses given as + pure numbers, such as 127.0.0.1 or ::1. + + 5.10 How do I prevent libcurl from writing the response to stdout? + + libcurl provides a default built-in write function that writes received data + to stdout. Set the CURLOPT_WRITEFUNCTION to receive the data, or possibly + set CURLOPT_WRITEDATA to a different FILE * handle. + + 5.11 How do I make libcurl not receive the whole HTTP response? + + You make the write callback (or progress callback) return an error and + libcurl will then abort the transfer. + + 5.12 Can I make libcurl fake or hide my real IP address? + + No. libcurl operates on a higher level. Besides, faking IP address would + imply sending IP packets with a made-up source address, and then you normally + get a problem with receiving the packet sent back as they would then not be + routed to you. + + If you use a proxy to access remote sites, the sites will not see your local + IP address but instead the address of the proxy. + + Also note that on many networks NATs or other IP-munging techniques are used + that makes you see and use a different IP address locally than what the + remote server will see you coming from. You may also consider using + https://www.torproject.org/ . + + 5.13 How do I stop an ongoing transfer? + + With the easy interface you make sure to return the correct error code from + one of the callbacks, but none of them are instant. There is no function you + can call from another thread or similar that will stop it immediately. + Instead, you need to make sure that one of the callbacks you use returns an + appropriate value that will stop the transfer. Suitable callbacks that you + can do this with include the progress callback, the read callback and the + write callback. + + If you are using the multi interface, you can also stop a transfer by + removing the particular easy handle from the multi stack at any moment you + think the transfer is done or when you wish to abort the transfer. + + 5.14 Using C++ non-static functions for callbacks? + + libcurl is a C library, it does not know anything about C++ member functions. + + You can overcome this "limitation" with relative ease using a static + member function that is passed a pointer to the class: + + // f is the pointer to your object. + static size_t YourClass::func(void *buffer, size_t sz, size_t n, void *f) + { + // Call non-static member function. + static_cast(f)->nonStaticFunction(); + } + + // This is how you pass pointer to the static function: + curl_easy_setopt(hcurl, CURLOPT_WRITEFUNCTION, YourClass::func); + curl_easy_setopt(hcurl, CURLOPT_WRITEDATA, this); + + 5.15 How do I get an FTP directory listing? + + If you end the FTP URL you request with a slash, libcurl will provide you + with a directory listing of that given directory. You can also set + CURLOPT_CUSTOMREQUEST to alter what exact listing command libcurl would use + to list the files. + + The follow-up question tends to be how is a program supposed to parse the + directory listing. How does it know what's a file and what's a directory and + what's a symlink etc. If the FTP server supports the MLSD command then it + will return data in a machine-readable format that can be parsed for type. + The types are specified by RFC 3659 section 7.5.1. If MLSD is not supported + then you have to work with what you are given. The LIST output format is + entirely at the server's own liking and the NLST output does not reveal any + types and in many cases does not even include all the directory entries. + Also, both LIST and NLST tend to hide Unix-style hidden files (those that + start with a dot) by default so you need to do "LIST -a" or similar to see + them. + + Example - List only directories. + ftp.funet.fi supports MLSD and ftp.kernel.org does not: + + curl -s ftp.funet.fi/pub/ -X MLSD | \ + perl -lne 'print if s/(?:^|;)type=dir;[^ ]+ (.+)$/$1/' + + curl -s ftp.kernel.org/pub/linux/kernel/ | \ + perl -lne 'print if s/^d[-rwx]{9}(?: +[^ ]+){7} (.+)$/$1/' + + If you need to parse LIST output in libcurl one such existing + list parser is available at https://cr.yp.to/ftpparse.html Versions of + libcurl since 7.21.0 also provide the ability to specify a wildcard to + download multiple files from one FTP directory. + + 5.16 I want a different time-out + + Sometimes users realize that CURLOPT_TIMEOUT and CURLOPT_CONNECTIMEOUT are + not sufficiently advanced or flexible to cover all the various use cases and + scenarios applications end up with. + + libcurl offers many more ways to time-out operations. A common alternative + is to use the CURLOPT_LOW_SPEED_LIMIT and CURLOPT_LOW_SPEED_TIME options to + specify the lowest possible speed to accept before to consider the transfer + timed out. + + The most flexible way is by writing your own time-out logic and using + CURLOPT_XFERINFOFUNCTION (perhaps in combination with other callbacks) and + use that to figure out exactly when the right condition is met when the + transfer should get stopped. + + 5.17 Can I write a server with libcurl? + + No. libcurl offers no functions or building blocks to build any kind of + Internet protocol server. libcurl is only a client-side library. For server + libraries, you need to continue your search elsewhere but there exist many + good open source ones out there for most protocols you could want a server + for. There are also really good stand-alone servers that have been tested + and proven for many years. There is no need for you to reinvent them. + + 5.18 Does libcurl use threads? + + Put simply: no, libcurl will execute in the same thread you call it in. All + callbacks will be called in the same thread as the one you call libcurl in. + + If you want to avoid your thread to be blocked by the libcurl call, you make + sure you use the non-blocking multi API which will do transfers + asynchronously - still in the same single thread. + + libcurl will potentially internally use threads for name resolving, if it + was built to work like that, but in those cases it will create the child + threads by itself and they will only be used and then killed internally by + libcurl and never exposed to the outside. + +6. License Issues + + curl and libcurl are released under a MIT/X derivative license. The license + is liberal and should not impose a problem for your project. This section is + just a brief summary for the cases we get the most questions. (Parts of this + section was much enhanced by Bjorn Reese.) + + We are not lawyers and this is not legal advice. You should probably consult + one if you want true and accurate legal insights without our prejudice. Note + especially that this section concerns the libcurl license only; compiling in + features of libcurl that depend on other libraries (e.g. OpenSSL) may affect + the licensing obligations of your application. + + 6.1 I have a GPL program, can I use the libcurl library? + + Yes + + Since libcurl may be distributed under the MIT/X derivative license, it can + be used together with GPL in any software. + + 6.2 I have a closed-source program, can I use the libcurl library? + + Yes + + libcurl does not put any restrictions on the program that uses the library. + + 6.3 I have a BSD licensed program, can I use the libcurl library? + + Yes + + libcurl does not put any restrictions on the program that uses the library. + + 6.4 I have a program that uses LGPL libraries, can I use libcurl? + + Yes + + The LGPL license does not clash with other licenses. + + 6.5 Can I modify curl/libcurl for my program and keep the changes secret? + + Yes + + The MIT/X derivative license practically allows you to do almost anything + with the sources, on the condition that the copyright texts in the sources + are left intact. + + 6.6 Can you please change the curl/libcurl license to XXXX? + + No. + + We have carefully picked this license after years of development and + discussions and a large amount of people have contributed with source code + knowing that this is the license we use. This license puts the restrictions + we want on curl/libcurl and it does not spread to other programs or + libraries that use it. It should be possible for everyone to use libcurl or + curl in their projects, no matter what license they already have in use. + + 6.7 What are my obligations when using libcurl in my commercial apps? + + Next to none. All you need to adhere to is the MIT-style license (stated in + the COPYING file) which basically says you have to include the copyright + notice in "all copies" and that you may not use the copyright holder's name + when promoting your software. + + You do not have to release any of your source code. + + You do not have to reveal or make public any changes to the libcurl source + code. + + You do not have to broadcast to the world that you are using libcurl within + your app. + + All we ask is that you disclose "the copyright notice and this permission + notice" somewhere. Most probably like in the documentation or in the section + where other third party dependencies already are mentioned and acknowledged. + + As can be seen here: https://curl.se/docs/companies.html and elsewhere, + more and more companies are discovering the power of libcurl and take + advantage of it even in commercial environments. + + +7. PHP/CURL Issues + + 7.1 What is PHP/CURL? + + The module for PHP that makes it possible for PHP programs to access curl- + functions from within PHP. + + In the cURL project we call this module PHP/CURL to differentiate it from + curl the command line tool and libcurl the library. The PHP team however + does not refer to it like this (for unknown reasons). They call it plain + CURL (often using all caps) or sometimes ext/curl, but both cause much + confusion to users which in turn gives us a higher question load. + + 7.2 Who wrote PHP/CURL? + + PHP/CURL was initially written by Sterling Hughes. + + 7.3 Can I perform multiple requests using the same handle? + + Yes - at least in PHP version 4.3.8 and later (this has been known to not + work in earlier versions, but the exact version when it started to work is + unknown to me). + + After a transfer, you just set new options in the handle and make another + transfer. This will make libcurl reuse the same connection if it can. + + 7.4 Does PHP/CURL have dependencies? + + PHP/CURL is a module that comes with the regular PHP package. It depends on + and uses libcurl, so you need to have libcurl installed properly before + PHP/CURL can be used. + +8. Development + + 8.1 Why does curl use C89? + + As with everything in curl, there is a history and we keep using what we have + used before until someone brings up the subject and argues for and works on + changing it. + + We started out using C89 in the 1990s because that was the only way to write + a truly portable C program and have it run as widely as possible. C89 was for + a long time even necessary to make things work on otherwise considered modern + platforms such as Windows. Today, we do not really know how many users that + still require the use of a C89 compiler. + + We will continue to use C89 for as long as nobody brings up a strong enough + reason for us to change our minds. The core developers of the project do not + feel restricted by this and we are not convinced that going C99 will offer us + enough of a benefit to warrant the risk of cutting off a share of users. + + 8.2 Will curl be rewritten? + + In one go: no. Little by little over time? Maybe. + + Over the years, new languages and clever operating environments come and go. + Every now and then the urge apparently arises to request that we rewrite curl + in another language. + + Some the most important properties in curl are maintaining the API and ABI + for libcurl and keeping the behavior for the command line tool. As long as we + can do that, everything else is up for discussion. To maintain the ABI, we + probably have to maintain a certain amount of code in C, and to remain rock + stable, we will never risk anything by rewriting a lot of things in one go. + That said, we can certainly offer more and more optional backends written in + other languages, as long as those backends can be plugged in at build-time. + Backends can be written in any language, but should probably provide APIs + usable from C to ease integration and transition. diff --git a/curl/docs/FEATURES.md b/curl/docs/FEATURES.md new file mode 100644 index 0000000..f366154 --- /dev/null +++ b/curl/docs/FEATURES.md @@ -0,0 +1,249 @@ + + +# Features -- what curl can do + +## curl tool + + - config file support + - multiple URLs in a single command line + - range "globbing" support: [0-13], {one,two,three} + - multiple file upload on a single command line + - redirect stderr + - parallel transfers + +## libcurl + + - URL RFC 3986 syntax + - custom maximum download time + - custom lowest download speed acceptable + - custom output result after completion + - guesses protocol from hostname unless specified + - supports .netrc + - progress bar with time statistics while downloading + - standard proxy environment variables support + - have run on 101 operating systems and 28 CPU architectures + - selectable network interface for outgoing traffic + - IPv6 support on Unix and Windows + - happy eyeballs dual-stack IPv4 + IPv6 connects + - persistent connections + - SOCKS 4 + 5 support, with or without local name resolving + - *pre-proxy* support, for *proxy chaining* + - supports username and password in proxy environment variables + - operations through HTTP proxy "tunnel" (using CONNECT) + - replaceable memory functions (malloc, free, realloc, etc) + - asynchronous name resolving + - both a push and a pull style interface + - international domain names (IDN) + - transfer rate limiting + - stable API and ABI + - TCP keep alive + - TCP Fast Open + - DNS cache (that can be shared between transfers) + - non-blocking single-threaded parallel transfers + - Unix domain sockets to server or proxy + - DNS-over-HTTPS + - uses non-blocking name resolves + - selectable name resolver backend + +## URL API + + - parses RFC 3986 URLs + - generates URLs from individual components + - manages "redirects" + +## Header API + + - easy access to HTTP response headers, from all contexts + - named headers + - iterate over headers + +## TLS + + - selectable TLS backend(s) + - TLS False Start + - TLS version control + - TLS session resumption + - key pinning + - mutual authentication + - Use dedicated CA cert bundle + - Use OS-provided CA store + - separate TLS options for HTTPS proxy + +## HTTP + + - HTTP/0.9 responses are optionally accepted + - HTTP/1.0 + - HTTP/1.1 + - HTTP/2, including multiplexing and server push + - GET + - PUT + - HEAD + - POST + - multipart formpost (RFC 1867-style) + - authentication: Basic, Digest, NTLM (9) and Negotiate (SPNEGO) + to server and proxy + - resume transfers + - follow redirects + - maximum amount of redirects to follow + - custom HTTP request + - cookie get/send fully parsed + - reads/writes the Netscape cookie file format + - custom headers (replace/remove internally generated headers) + - custom user-agent string + - custom referrer string + - range + - proxy authentication + - time conditions + - via HTTP proxy, HTTPS proxy or SOCKS proxy + - HTTP/2 or HTTP/1.1 to HTTPS proxy + - retrieve file modification date + - Content-Encoding support for deflate, gzip, brotli and zstd + - "Transfer-Encoding: chunked" support in uploads + - HSTS + - alt-svc + - ETags + - HTTP/1.1 trailers, both sending and getting + +## HTTPS + + - HTTP/3 + - using client certificates + - verify server certificate + - via HTTP proxy, HTTPS proxy or SOCKS proxy + - select desired encryption + - select usage of a specific TLS version + - ECH + +## FTP + + - download + - authentication + - Kerberos 5 + - active/passive using PORT, EPRT, PASV or EPSV + - single file size information (compare to HTTP HEAD) + - 'type=' URL support + - directory listing + - directory listing names-only + - upload + - upload append + - upload via http-proxy as HTTP PUT + - download resume + - upload resume + - custom ftp commands (before and/or after the transfer) + - simple "range" support + - via HTTP proxy, HTTPS proxy or SOCKS proxy + - all operations can be tunneled through proxy + - customizable to retrieve file modification date + - no directory depth limit + +## FTPS + + - implicit `ftps://` support that use SSL on both connections + - explicit "AUTH TLS" and "AUTH SSL" usage to "upgrade" plain `ftp://` + connection to use SSL for both or one of the connections + +## SSH (both SCP and SFTP) + + - selectable SSH backend + - known hosts support + - public key fingerprinting + - both password and public key auth + +## SFTP + + - both password and public key auth + - with custom commands sent before/after the transfer + - directory listing + +## TFTP + + - download + - upload + +## TELNET + + - connection negotiation + - custom telnet options + - stdin/stdout I/O + +## LDAP + + - full LDAP URL support + +## DICT + + - extended DICT URL support + +## FILE + + - URL support + - upload + - resume + +## SMB + + - SMBv1 over TCP and SSL + - download + - upload + - authentication with NTLMv1 + +## SMTP + + - authentication: Plain, Login, CRAM-MD5, Digest-MD5, NTLM, Kerberos 5 and + External + - send emails + - mail from support + - mail size support + - mail auth support for trusted server-to-server relaying + - multiple recipients + - via http-proxy + +## SMTPS + + - implicit `smtps://` support + - explicit "STARTTLS" usage to "upgrade" plain `smtp://` connections to use SSL + - via http-proxy + +## POP3 + + - authentication: Clear Text, APOP and SASL + - SASL based authentication: Plain, Login, CRAM-MD5, Digest-MD5, NTLM, + Kerberos 5 and External + - list emails + - retrieve emails + - enhanced command support for: CAPA, DELE, TOP, STAT, UIDL and NOOP via + custom requests + - via http-proxy + +## POP3S + + - implicit `pop3s://` support + - explicit `STLS` usage to "upgrade" plain `pop3://` connections to use SSL + - via http-proxy + +## IMAP + + - authentication: Clear Text and SASL + - SASL based authentication: Plain, Login, CRAM-MD5, Digest-MD5, NTLM, + Kerberos 5 and External + - list the folders of a mailbox + - select a mailbox with support for verifying the `UIDVALIDITY` + - fetch emails with support for specifying the UID and SECTION + - upload emails via the append command + - enhanced command support for: EXAMINE, CREATE, DELETE, RENAME, STATUS, + STORE, COPY and UID via custom requests + - via http-proxy + +## IMAPS + + - implicit `imaps://` support + - explicit "STARTTLS" usage to "upgrade" plain `imap://` connections to use SSL + - via http-proxy + +## MQTT + + - Subscribe to and publish topics using URL scheme `mqtt://broker/topic` diff --git a/curl/docs/GOVERNANCE.md b/curl/docs/GOVERNANCE.md new file mode 100644 index 0000000..4ab52a9 --- /dev/null +++ b/curl/docs/GOVERNANCE.md @@ -0,0 +1,202 @@ + + +# Decision making in the curl project + +A rough guide to how we make decisions and who does what. + +## BDFL + +This project was started by and has to some extent been pushed forward over +the years with Daniel Stenberg as the driving force. It matches a standard +BDFL (Benevolent Dictator For Life) style project. + +This setup has been used due to convenience and the fact that it has worked +fine this far. It is not because someone thinks of it as a superior project +leadership model. It also only works as long as Daniel manages to listen in to +what the project and the general user population wants and expects from us. + +## Legal entity + +There is no legal entity. The curl project is just a bunch of people scattered +around the globe with the common goal to produce source code that creates +great products. We are not part of any umbrella organization and we are not +located in any specific country. We are totally independent. + +The copyrights in the project are owned by the individuals and organizations +that wrote those parts of the code. + +## Decisions + +The curl project is not a democracy, but everyone is entitled to state their +opinion and may argue for their sake within the community. + +All and any changes that have been done or are done are eligible to bring up +for discussion, to object to or to praise. Ideally, we find consensus for the +appropriate way forward in any given situation or challenge. + +If there is no obvious consensus, a maintainer who's knowledgeable in the +specific area takes an "executive" decision that they think is the right for +the project. + +## Donations + +Donating plain money to curl is best done to curl's [Open Collective +fund](https://opencollective.com/curl). Open Collective is a US based +non-profit organization that holds on to funds for us. This fund is then used +for paying the curl security bug bounties, to reimburse project related +expenses etc. + +Donations to the project can also come in the form of server hosting, providing +services and paying for people to work on curl related code etc. Usually, such +donations are services paid for directly by the sponsors. + +We grade sponsors in a few different levels and if they meet the criteria, +they can be mentioned on the Sponsors page on the curl website. + +## Commercial Support + +The curl project does not do or offer commercial support. It only hosts +mailing lists, runs bug trackers etc to facilitate communication and work. + +However, Daniel works for wolfSSL and we offer commercial curl support there. + +# Key roles + +## User + +Someone who uses or has used curl or libcurl. + +## Contributor + +Someone who has helped the curl project, who has contributed to bring it +forward. Contributing could be to provide advice, debug a problem, file a bug +report, run test infrastructure or writing code etc. + +## Commit author + +Sometimes also called 'committer'. Someone who has authored a commit in the +curl source code repository. Committers are recorded as `Author` in git. + +## Maintainers + +A maintainer in the curl project is an individual who has been given +permissions to push commits to one of the git repositories. + +Maintainers are free to push commits to the repositories at they see fit. +Maintainers are however expected to listen to feedback from users and any +change that is non-trivial in size or nature *should* be brought to the +project as a Pull-Request (PR) to allow others to comment/object before merge. + +## Former maintainers + +A maintainer who stops being active in the project gets their push permissions +removed at some point. We do this for security reasons but also to make sure +that we always have the list of maintainers as "the team that push stuff to +curl". + +Getting push permissions removed is not a punishment. Everyone who ever worked +on maintaining curl is considered a hero, for all time hereafter. + +## Security team members + +We have a security team. That is the team of people who are subscribed to the +curl-security mailing list; the receivers of security reports from users and +developers. This list of people varies over time but they are all skilled +developers familiar with the curl project. + +The security team works best when it consists of a small set of active +persons. We invite new members when the team seems to need it, and we also +expect to retire security team members as they "drift off" from the project or +just find themselves unable to perform their duties there. + +## Core team + +There is a curl core team. It currently has the same set of members as the +security team. It can also be reached on the security email address. + +The core team nominates and invites new members to the team when it sees fit. +There is no open member voting or formal ways to be a candidate. Active +participants in the curl project who want to join the core team can ask to +join. + +The core team is a board of advisors. It deals with project management +subjects that need confidentiality or for other reasons cannot be dealt with +and discussed in the open (for example reports of code of conduct violations). +Project matters should always as far as possible be discussed on open mailing +lists. + +## Server admins + +We run a web server, a mailing list and more on the curl project's primary +server. That physical machine is owned and run by Haxx. Daniel is the primary +admin of all things curl related server stuff, but Björn Stenberg and Linus +Feltzing serve as backup admins for when Daniel is gone or unable. + +The primary server is paid for by Haxx. The machine is physically located in a +server bunker in Stockholm Sweden, operated by the company Glesys. + +The website contents are served to the web via Fastly and Daniel is the +primary curl contact with Fastly. + +## BDFL + +That is Daniel. + +# Maintainers + +A curl maintainer is a project volunteer who has the authority and rights to +merge changes into a git repository in the curl project. + +Anyone can aspire to become a curl maintainer. + +### Duties + +There are no mandatory duties. We hope and wish that maintainers consider +reviewing patches and help merging them, especially when the changes are +within the area of personal expertise and experience. + +### Requirements + +- only merge code that meets our quality and style guide requirements. +- *never* merge code without doing a PR first, unless the change is "trivial" +- if in doubt, ask for input/feedback from others + +### Recommendations + +- we require two-factor authentication enabled on your GitHub account to + reduce risk of malicious source code tampering +- consider enabling signed git commits for additional verification of changes + +### Merge advice + +When you are merging patches/pull requests... + +- make sure the commit messages follow our template +- squash patch sets into a few logical commits even if the PR did not, if + necessary +- avoid the "merge" button on GitHub, do it "manually" instead to get full + control and full audit trail (GitHub leaves out you as "Committer:") +- remember to credit the reporter and the helpers. + +## Who are maintainers? + +The [list of maintainers](https://github.com/orgs/curl/people). Be aware that +the level of presence and activity in the project vary greatly between +different individuals and over time. + +### Become a maintainer? + +If you think you can help making the project better by shouldering some +maintaining responsibilities, then please get in touch. + +You are expected to be familiar with the curl project and its ways of working. +You need to have gotten a few quality patches merged as a proof of this. + +### Stop being a maintainer + +If you (appear to) not be active in the project anymore, you may be removed as +a maintainer. Thank you for your service. diff --git a/curl/docs/HELP-US.md b/curl/docs/HELP-US.md new file mode 100644 index 0000000..0619aec --- /dev/null +++ b/curl/docs/HELP-US.md @@ -0,0 +1,94 @@ + + +# How to get started helping out in the curl project + +We are always in need of more help. If you are new to the project and are +looking for ways to contribute and help out, this document aims to give a few +good starting points. + +You may subscribe to the [curl-library mailing +list](https://lists.haxx.se/listinfo/curl-library) to keep track of the +current discussion topics; or if you are registered on GitHub, you can use the +[Discussions section](https://github.com/curl/curl/discussions) on the main +curl repository. + +## Scratch your own itch + +One of the best ways is to start working on any problems or issues you have +found yourself or perhaps got annoyed at in the past. It can be a spelling +error in an error text or a weirdly phrased section in a man page. Hunt it +down and report the bug. Or make your first pull request with a fix for that. + +## Smaller tasks + +Some projects mark small issues as "beginner friendly", "bite-sized" or +similar. We do not do that in curl since such issues never linger around long +enough. Simple issues get handled fast. + +If you are looking for a smaller or simpler task in the project to help out +with as an entry-point into the project, perhaps because you are a newcomer or +even maybe not a terribly experienced developer, here's our advice: + + - Read through this document to get a grasp on a general approach to use + - Consider adding a test case for something not currently tested (correctly) + - Consider updating or adding documentation + - One way to get started gently in the project, is to participate in an + existing issue/PR and help out by reproducing the issue, review the code in + the PR etc. + +## Help wanted + +In the issue tracker we occasionally mark bugs with [help +wanted](https://github.com/curl/curl/labels/help%20wanted), as a sign that the +bug is acknowledged to exist and that there is nobody known to work on this +issue for the moment. Those are bugs that are fine to "grab" and provide a +pull request for. The complexity level of these of course varies, so pick one +that piques your interest. + +## Work on known bugs + +Some bugs are known and have not yet received attention and work enough to get +fixed. We collect such known existing flaws in the +[KNOWN_BUGS](https://curl.se/docs/knownbugs.html) page. Many of them link +to the original bug report with some additional details, but some may also +have aged a bit and may require some verification that the bug still exists in +the same way and that what was said about it in the past is still valid. + +## Fix autobuild problems + +On the [autobuilds page](https://curl.se/dev/builds.html) we show a +collection of test results from the automatic curl build and tests that are +performed by volunteers. Fixing compiler warnings and errors shown there is +something we value greatly. Also, if you own or run systems or architectures +that are not already tested in the autobuilds, we also appreciate more +volunteers running builds automatically to help us keep curl portable. + +## TODO items + +Ideas for features and functions that we have considered worthwhile to +implement and provide are kept in the +[TODO](https://curl.se/docs/todo.html) file. Some of the ideas are +rough. Some are well thought out. Some probably are not really suitable +anymore. + +Before you invest a lot of time on a TODO item, do bring it up for discussion +on the mailing list. For discussion on applicability but also for ideas and +brainstorming on specific ways to do the implementation etc. + +## You decide + +You can also come up with a completely new thing you think we should do. Or +not do. Or fix. Or add to the project. You then either bring it to the mailing +list first to see if people shoot down the idea at once, or you bring a first +draft of the idea as a pull request and take the discussion there around the +specific implementation. Either way is fine. + +## CONTRIBUTE + +We offer [guidelines](https://curl.se/dev/contribute.html) that are suitable +to be familiar with before you decide to contribute to curl. If you are used +to open source development, you probably do not find many surprises there. diff --git a/curl/docs/HISTORY.md b/curl/docs/HISTORY.md new file mode 100644 index 0000000..21df56f --- /dev/null +++ b/curl/docs/HISTORY.md @@ -0,0 +1,486 @@ + + +How curl Became Like This +========================= + +Towards the end of 1996, Daniel Stenberg was spending time writing an IRC bot +for an Amiga related channel on EFnet. He then came up with the idea to make +currency-exchange calculations available to Internet Relay Chat (IRC) +users. All the necessary data were published on the Web; he just needed to +automate their retrieval. + +1996 +---- + +On November 11, 1996 the Brazilian developer Rafael Sagula wrote and released +HttpGet version 0.1. + +Daniel extended this existing command-line open-source tool. After a few minor +adjustments, it did just what he needed. The first release with Daniel's +additions was 0.2, released on December 17, 1996. Daniel quickly became the +new maintainer of the project. + +1997 +---- + +HttpGet 0.3 was released in January 1997 and now it accepted HTTP URLs on the +command line. + +HttpGet 1.0 was released on April 8 1997 with brand new HTTP proxy support. + +We soon found and fixed support for getting currencies over GOPHER. Once FTP +download support was added, the name of the project was changed and urlget 2.0 +was released in August 1997. The http-only days were already passed. + +Version 2.2 was released on August 14 1997 and introduced support to build for +and run on Windows and Solaris. + +November 24 1997: Version 3.1 added FTP upload support. + +Version 3.5 added support for HTTP POST. + +1998 +---- + +February 4: urlget 3.10 + +February 9: urlget 3.11 + +March 14: urlget 3.12 added proxy authentication. + +The project slowly grew bigger. With upload capabilities, the name was once +again misleading and a second name change was made. On March 20, 1998 curl 4 +was released. (The version numbering from the previous names was kept.) + +(Unrelated to this project a company called Curl Corporation registered a US +trademark on the name "CURL" on May 18 1998. That company had then already +registered the curl.com domain back in November of the previous year. All this +was revealed to us much later.) + +SSL support was added, powered by the SSLeay library. + +August: first announcement of curl on freshmeat.net. + +October: with the curl 4.9 release and the introduction of cookie support, +curl was no longer released under the GPL license. Now we are at 4000 lines of +code, we switched over to the MPL license to restrict the effects of +"copyleft". + +November: configure script and reported successful compiles on several +major operating systems. The never-quite-understood -F option was added and +curl could now simulate quite a lot of a browser. TELNET support was added. + +curl 5 was released in December 1998 and introduced the first ever curl man +page. People started making Linux RPM packages out of it. + +1999 +---- + +January: DICT support added. + +OpenSSL took over and SSLeay was abandoned. + +May: first Debian package. + +August: LDAP:// and FILE:// support added. The curl website gets 1300 visits +weekly. Moved site to curl.haxx.nu. + +September: Released curl 6.0. 15000 lines of code. + +December 28: added the project on Sourceforge and started using its services +for managing the project. + +2000 +---- + +Spring: major internal overhaul to provide a suitable library interface. +The first non-beta release was named 7.1 and arrived in August. This offered +the easy interface and turned out to be the beginning of actually getting +other software and programs to be based on and powered by libcurl. Almost +20000 lines of code. + +June: the curl site moves to "curl.haxx.se" + +August, the curl website gets 4000 visits weekly. + +The PHP guys adopted libcurl already the same month, when the first ever third +party libcurl binding showed up. CURL has been a supported module in PHP since +the release of PHP 4.0.2. This would soon get followers. More than 16 +different bindings exist at the time of this writing. + +September: kerberos4 support was added. + +November: started the work on a test suite for curl. It was later re-written +from scratch again. The libcurl major SONAME number was set to 1. + +2001 +---- + +January: Daniel released curl 7.5.2 under a new license again: MIT (or +MPL). The MIT license is extremely liberal and can be combined with GPL +in other projects. This would finally put an end to the "complaints" from +people involved in GPLed projects that previously were prohibited from using +libcurl while it was released under MPL only. (Due to the fact that MPL is +deemed "GPL incompatible".) + +March 22: curl supports HTTP 1.1 starting with the release of 7.7. This +also introduced libcurl's ability to do persistent connections. 24000 lines of +code. The libcurl major SONAME number was bumped to 2 due to this overhaul. +The first experimental ftps:// support was added. + +August: The curl website gets 8000 visits weekly. Curl Corporation contacted +Daniel to discuss "the name issue". After Daniel's reply, they have never +since got back in touch again. + +September: libcurl 7.9 introduces cookie jar and `curl_formadd()`. During the +forthcoming 7.9.x releases, we introduced the multi interface slowly and +without many whistles. + +September 25: curl (7.7.2) is bundled in Mac OS X (10.1) for the first time. It was +already becoming more and more of a standard utility of Linux distributions +and a regular in the BSD ports collections. + +2002 +---- + +June: the curl website gets 13000 visits weekly. curl and libcurl is +35000 lines of code. Reported successful compiles on more than 40 combinations +of CPUs and operating systems. + +To estimate the number of users of the curl tool or libcurl library is next to +impossible. Around 5000 downloaded packages each week from the main site gives +a hint, but the packages are mirrored extensively, bundled with numerous OS +distributions and otherwise retrieved as part of other software. + +October 1: with the release of curl 7.10 it is released under the MIT license +only. + +Starting with 7.10, curl verifies SSL server certificates by default. + +2003 +---- + +January: Started working on the distributed curl tests. The autobuilds. + +February: the curl site averages at 20000 visits weekly. At any given moment, +there is an average of 3 people browsing the website. + +Multiple new authentication schemes are supported: Digest (May), NTLM (June) +and Negotiate (June). + +November: curl 7.10.8 is released. 45000 lines of code. ~55000 unique visitors +to the website. Five official web mirrors. + +December: full-fledged SSL for FTP is supported. + +2004 +---- + +January: curl 7.11.0 introduced large file support. + +June: curl 7.12.0 introduced IDN support. 10 official web mirrors. + +This release bumped the major SONAME to 3 due to the removal of the +`curl_formparse()` function + +August: curl and libcurl 7.12.1 + + Public curl release number: 82 + Releases counted from the beginning: 109 + Available command line options: 96 + Available curl_easy_setopt() options: 120 + Number of public functions in libcurl: 36 + Amount of public website mirrors: 12 + Number of known libcurl bindings: 26 + +2005 +---- + +April: GnuTLS can now optionally be used for the secure layer when curl is +built. + +April: Added the multi_socket() API + +September: TFTP support was added. + +More than 100,000 unique visitors of the curl website. 25 mirrors. + +December: security vulnerability: libcurl URL Buffer Overflow + +2006 +---- + +January: We dropped support for Gopher. We found bugs in the implementation +that turned out to have been introduced years ago, so with the conclusion that +nobody had found out in all this time we removed it instead of fixing it. + +March: security vulnerability: libcurl TFTP Packet Buffer Overflow + +September: The major SONAME number for libcurl was bumped to 4 due to the +removal of ftp third party transfer support. + +November: Added SCP and SFTP support + +2007 +---- + +February: Added support for the Mozilla NSS library to do the SSL/TLS stuff + +July: security vulnerability: libcurl GnuTLS insufficient cert verification + +2008 +---- + +November: + + Command line options: 128 + curl_easy_setopt() options: 158 + Public functions in libcurl: 58 + Known libcurl bindings: 37 + Contributors: 683 + + 145,000 unique visitors. >100 GB downloaded. + +2009 +---- + +March: security vulnerability: libcurl Arbitrary File Access + +April: added CMake support + +August: security vulnerability: libcurl embedded zero in cert name + +December: Added support for IMAP, POP3 and SMTP + +2010 +---- + +January: Added support for RTSP + +February: security vulnerability: libcurl data callback excessive length + +March: The project switched over to use git (hosted by GitHub) instead of CVS +for source code control + +May: Added support for RTMP + +Added support for PolarSSL to do the SSL/TLS stuff + +August: + + Public curl releases: 117 + Command line options: 138 + curl_easy_setopt() options: 180 + Public functions in libcurl: 58 + Known libcurl bindings: 39 + Contributors: 808 + + Gopher support added (re-added actually, see January 2006) + +2011 +---- + +February: added support for the axTLS backend + +April: added the cyassl backend (later renamed to wolfSSL) + +2012 +---- + + July: Added support for Schannel (native Windows TLS backend) and Darwin SSL + (Native Mac OS X and iOS TLS backend). + + Supports Metalink + + October: SSH-agent support. + +2013 +---- + + February: Cleaned up internals to always uses the "multi" non-blocking + approach internally and only expose the blocking API with a wrapper. + + September: First small steps on supporting HTTP/2 with nghttp2. + + October: Removed krb4 support. + + December: Happy eyeballs. + +2014 +---- + + March: first real release supporting HTTP/2 + + September: Website had 245,000 unique visitors and served 236GB data + + SMB and SMBS support + +2015 +---- + + June: support for multiplexing with HTTP/2 + + August: support for HTTP/2 server push + + December: Public Suffix List + +2016 +---- + + January: the curl tool defaults to HTTP/2 for HTTPS URLs + + December: curl 7.52.0 introduced support for HTTPS-proxy + + First TLS 1.3 support + +2017 +---- + + July: OSS-Fuzz started fuzzing libcurl + + September: Added MultiSSL support + + The website serves 3100 GB/month + + Public curl releases: 169 + Command line options: 211 + curl_easy_setopt() options: 249 + Public functions in libcurl: 74 + Contributors: 1609 + + October: SSLKEYLOGFILE support, new MIME API + + October: Daniel received the Polhem Prize for his work on curl + + November: brotli + +2018 +---- + + January: new SSH backend powered by libssh + + March: starting with the 1803 release of Windows 10, curl is shipped bundled + with Microsoft's operating system. + + July: curl shows headers using bold type face + + October: added DNS-over-HTTPS (DoH) and the URL API + + MesaLink is a new supported TLS backend + + libcurl now does HTTP/2 (and multiplexing) by default on HTTPS URLs + + curl and libcurl are installed in an estimated 5 *billion* instances + world-wide. + + October 31: curl and libcurl 7.62.0 + + Public curl releases: 177 + Command line options: 219 + curl_easy_setopt() options: 261 + Public functions in libcurl: 80 + Contributors: 1808 + + December: removed axTLS support + +2019 +---- + + March: added experimental alt-svc support + + August: the first HTTP/3 requests with curl. + + September: 7.66.0 is released and the tool offers parallel downloads + +2020 +---- + + curl and libcurl are installed in an estimated 10 *billion* instances + world-wide. + + January: added BearSSL support + + March: removed support for PolarSSL, added wolfSSH support + + April: experimental MQTT support + + August: zstd support + + November: the website moves to curl.se. The website serves 10TB data monthly. + + December: alt-svc support + +2021 +---- + + February 3: curl 7.75.0 ships with support for Hyper as an HTTP backend + + March 31: curl 7.76.0 ships with support for Rustls + + July: HSTS is supported + +2022 +---- + +March: added --json, removed mesalink support + + Public curl releases: 206 + Command line options: 245 + curl_easy_setopt() options: 295 + Public functions in libcurl: 86 + Contributors: 2601 + + The curl.se website serves 16,500 GB/month over 462M requests, the + official docker image has been pulled 4,098,015,431 times. + +October: initial WebSocket support + +2023 +---- + +March: remove support for curl_off_t < 8 bytes + +March 31: we started working on a new command line tool for URL parsing and +manipulations: trurl. + +May: added support for HTTP/2 over HTTPS proxy. Refuse to resolve .onion. + +August: Dropped support for the NSS library + +September: added "variable" support in the command line tool. Dropped support +for the gskit TLS library. + +October: added support for IPFS via HTTP gateway + +December: HTTP/3 support with ngtcp2 is no longer experimental + +2024 +---- + +January: switched to "curldown" for all documentation + +April 24: the curl container has been pulled more than six billion times + +May: experimental support for ECH, dropped NTLM_WB + +August 9: we adopted the wcurl tool into the curl organization + +September 11: --help [option] + +November 6: TLS 1.3 early data, WebSocket is official + +December 21: dropped hyper + +2025 +---- + +February 5: first 0RTT for QUIC, ssl session import/export + +February: experimental HTTPS RR support + +February 22: The website served 62.95 TB/month; 12.43 billion requests + The docker image has been pulled 6373501745 times. diff --git a/curl/docs/HSTS.md b/curl/docs/HSTS.md new file mode 100644 index 0000000..85140ab --- /dev/null +++ b/curl/docs/HSTS.md @@ -0,0 +1,48 @@ + + +# HSTS support + +HTTP Strict-Transport-Security. Added as experimental in curl +7.74.0. Supported "for real" since 7.77.0. + +## Standard + +[HTTP Strict Transport Security](https://datatracker.ietf.org/doc/html/rfc6797) + +## Behavior + +libcurl features an in-memory cache for HSTS hosts, so that subsequent +HTTP-only requests to a hostname present in the cache gets internally +"redirected" to the HTTPS version. + +## `curl_easy_setopt()` options: + + - `CURLOPT_HSTS_CTRL` - enable HSTS for this easy handle + - `CURLOPT_HSTS` - specify filename where to store the HSTS cache on close + (and possibly read from at startup) + +## curl command line options + + - `--hsts [filename]` - enable HSTS, use the file as HSTS cache. If filename + is `""` (no length) then no file is used, only in-memory cache. + +## HSTS cache file format + +Lines starting with `#` are ignored. + +For each hsts entry: + + [host name] "YYYYMMDD HH:MM:SS" + +The `[host name]` is dot-prefixed if it includes subdomains. + +The time stamp is when the entry expires. + +## Possible future additions + + - `CURLOPT_HSTS_PRELOAD` - provide a set of HSTS hostnames to load first + - ability to save to something else than a file diff --git a/curl/docs/HTTP-COOKIES.md b/curl/docs/HTTP-COOKIES.md new file mode 100644 index 0000000..62905db --- /dev/null +++ b/curl/docs/HTTP-COOKIES.md @@ -0,0 +1,171 @@ + + +# HTTP Cookies + +## Cookie overview + + Cookies are `name=contents` pairs that an HTTP server tells the client to + hold and then the client sends back those to the server on subsequent + requests to the same domains and paths for which the cookies were set. + + Cookies are either "session cookies" which typically are forgotten when the + session is over which is often translated to equal when browser quits, or + the cookies are not session cookies they have expiration dates after which + the client throws them away. + + Cookies are set to the client with the Set-Cookie: header and are sent to + servers with the Cookie: header. + + For a long time, the only spec explaining how to use cookies was the + original [Netscape spec from 1994](https://curl.se/rfc/cookie_spec.html). + + In 2011, [RFC 6265](https://www.ietf.org/rfc/rfc6265.txt) was finally + published and details how cookies work within HTTP. In 2016, an update which + added support for prefixes was + [proposed](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-cookie-prefixes-00), + and in 2017, another update was + [drafted](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-cookie-alone-01) + to deprecate modification of 'secure' cookies from non-secure origins. Both + of these drafts have been incorporated into a proposal to + [replace](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-11) + RFC 6265. Cookie prefixes and secure cookie modification protection has been + implemented by curl. + + curl considers `http://localhost` to be a *secure context*, meaning that it + allows and uses cookies marked with the `secure` keyword even when done over + plain HTTP for this host. curl does this to match how popular browsers work + with secure cookies. + +## Super cookies + + A single cookie can be set for a domain that matches multiple hosts. Like if + set for `example.com` it gets sent to both `aa.example.com` as well as + `bb.example.com`. + + A challenge with this concept is that there are certain domains for which + cookies should not be allowed at all, because they are *Public + Suffixes*. Similarly, a client never accepts cookies set directly for the + top-level domain like for example `.com`. Cookies set for *too broad* + domains are generally referred to as *super cookies*. + + If curl is built with PSL (**Public Suffix List**) support, it detects and + discards cookies that are specified for such suffix domains that should not + be allowed to have cookies. + + if curl is *not* built with PSL support, it has no ability to stop super + cookies. + +## Cookies saved to disk + + Netscape once created a file format for storing cookies on disk so that they + would survive browser restarts. curl adopted that file format to allow + sharing the cookies with browsers, only to see browsers move away from that + format. Modern browsers no longer use it, while curl still does. + + The Netscape cookie file format stores one cookie per physical line in the + file with a bunch of associated meta data, each field separated with + TAB. That file is called the cookie jar in curl terminology. + + When libcurl saves a cookie jar, it creates a file header of its own in + which there is a URL mention that links to the web version of this document. + +## Cookie file format + + The cookie file format is text based and stores one cookie per line. Lines + that start with `#` are treated as comments. An exception is lines that + start with `#HttpOnly_`, which is a prefix for cookies that have the + `HttpOnly` attribute set. + + Each line that specifies a single cookie consists of seven text fields + separated with TAB characters. A valid line must end with a newline + character. + +### Fields in the file + + Field number, what type and example data and the meaning of it: + + 0. string `example.com` - the domain name + 1. boolean `FALSE` - include subdomains + 2. string `/foobar/` - path + 3. boolean `TRUE` - send/receive over HTTPS only + 4. number `1462299217` - expires at - seconds since Jan 1st 1970, or 0 + 5. string `person` - name of the cookie + 6. string `daniel` - value of the cookie + +## Cookies with curl the command line tool + + curl has a full cookie "engine" built in. If you just activate it, you can + have curl receive and send cookies exactly as mandated in the specs. + + Command line options: + + [`-b, --cookie`](https://curl.se/docs/manpage.html#-b) + + tell curl a file to read cookies from and start the cookie engine, or if it + is not a file it passes on the given string. `-b name=var` works and so does + `-b cookiefile`. + + [`-j, --junk-session-cookies`](https://curl.se/docs/manpage.html#-j) + + when used in combination with -b, it skips all "session cookies" on load so + as to appear to start a new cookie session. + + [`-c, --cookie-jar`](https://curl.se/docs/manpage.html#-c) + + tell curl to start the cookie engine and write cookies to the given file + after the request(s) + +## Cookies with libcurl + +libcurl offers several ways to enable and interface the cookie engine. These +options are the ones provided by the native API. libcurl bindings may offer +access to them using other means. + +[`CURLOPT_COOKIE`](https://curl.se/libcurl/c/CURLOPT_COOKIE.html) + +Is used when you want to specify the exact contents of a cookie header to +send to the server. + +[`CURLOPT_COOKIEFILE`](https://curl.se/libcurl/c/CURLOPT_COOKIEFILE.html) + +Tell libcurl to activate the cookie engine, and to read the initial set of +cookies from the given file. Read-only. + +[`CURLOPT_COOKIEJAR`](https://curl.se/libcurl/c/CURLOPT_COOKIEJAR.html) + +Tell libcurl to activate the cookie engine, and when the easy handle is +closed save all known cookies to the given cookie jar file. Write-only. + +[`CURLOPT_COOKIELIST`](https://curl.se/libcurl/c/CURLOPT_COOKIELIST.html) + +Provide detailed information about a single cookie to add to the internal +storage of cookies. Pass in the cookie as an HTTP header with all the +details set, or pass in a line from a Netscape cookie file. This option can +also be used to flush the cookies etc. + +[`CURLOPT_COOKIESESSION`](https://curl.se/libcurl/c/CURLOPT_COOKIESESSION.html) + +Tell libcurl to ignore all cookies it is about to load that are session +cookies. + +[`CURLINFO_COOKIELIST`](https://curl.se/libcurl/c/CURLINFO_COOKIELIST.html) + +Extract cookie information from the internal cookie storage as a linked +list. + +## Cookies with JavaScript + +These days a lot of the web is built up by JavaScript. The web browser loads +complete programs that render the page you see. These JavaScript programs +can also set and access cookies. + +Since curl and libcurl are plain HTTP clients without any knowledge of or +capability to handle JavaScript, such cookies are not detected or used. + +Often, if you want to mimic what a browser does on such websites, you can +record web browser HTTP traffic when using such a site and then repeat the +cookie operations using curl or libcurl. diff --git a/curl/docs/HTTP3.md b/curl/docs/HTTP3.md new file mode 100644 index 0000000..b75daa4 --- /dev/null +++ b/curl/docs/HTTP3.md @@ -0,0 +1,481 @@ + + +# HTTP3 (and QUIC) + +## Resources + +[HTTP/3 Explained](https://http3-explained.haxx.se/en/) - the online free +book describing the protocols involved. + +[quicwg.org](https://quicwg.org/) - home of the official protocol drafts + +## QUIC libraries + +QUIC libraries we are using: + +[ngtcp2](https://github.com/ngtcp2/ngtcp2) + +[quiche](https://github.com/cloudflare/quiche) - **EXPERIMENTAL** + +[OpenSSL 3.2+ QUIC](https://github.com/openssl/openssl) - **EXPERIMENTAL** + +[msh3](https://github.com/nibanks/msh3) (with [msquic](https://github.com/microsoft/msquic)) - **EXPERIMENTAL** + +## Experimental + +HTTP/3 support in curl is considered **EXPERIMENTAL** until further notice +when built to use *quiche* or *msh3*. Only the *ngtcp2* backend is not +experimental. + +Further development and tweaking of the HTTP/3 support in curl happens in the +master branch using pull-requests, just like ordinary changes. + +To fix before we remove the experimental label: + + - the used QUIC library needs to consider itself non-beta + - it is fine to "leave" individual backends as experimental if necessary + +# ngtcp2 version + +Building curl with ngtcp2 involves 3 components: `ngtcp2` itself, `nghttp3` and a QUIC supporting TLS library. The supported TLS libraries are covered below. + +While any version of `ngtcp2` and `nghttp3` from v1.0.0 on are expected to +work, using the latest versions often brings functional and performance +improvements. + +The build examples use `$NGHTTP3_VERSION` and `$NGTCP2_VERSION` as placeholders +for the version you build. + +## Build with OpenSSL + +OpenSSL v3.5.0+ offers APIs for integration with *ngtcp2* v1.12.0+. Earlier +versions do not work. + +Build OpenSSL (version 3.5.0 or newer): + + % git clone --quiet --depth=1 -b openssl-$OPENSSL_VERSION https://github.com/openssl/openssl + % cd openssl + % ./config --prefix= --libdir=lib + % make + % make install + +Build nghttp3: + + % cd .. + % git clone -b $NGHTTP3_VERSION https://github.com/ngtcp2/nghttp3 + % cd nghttp3 + % git submodule update --init + % autoreconf -fi + % ./configure --prefix= --enable-lib-only + % make + % make install + +Build ngtcp2: + + % cd .. + % git clone -b $NGTCP2_VERSION https://github.com/ngtcp2/ngtcp2 + % cd ngtcp2 + % autoreconf -fi + % ./configure PKG_CONFIG_PATH=/lib/pkgconfig:/lib/pkgconfig LDFLAGS="-Wl,-rpath,/lib" --prefix= --enable-lib-only --with-openssl + % make + % make install + +Build curl: + + % cd .. + % git clone https://github.com/curl/curl + % cd curl + % autoreconf -fi + % LDFLAGS="-Wl,-rpath,/lib" ./configure --with-openssl= --with-nghttp3= --with-ngtcp2= + % make + % make install + +## Build with quictls + +OpenSSL does not offer the required APIs for building a QUIC client. You need +to use a TLS library that has such APIs and that works with *ngtcp2*. + +Build quictls (any `+quic` tagged version works): + + % git clone --depth 1 -b openssl-3.1.4+quic https://github.com/quictls/openssl + % cd openssl + % ./config enable-tls1_3 --prefix= --libdir=lib + % make + % make install + +Build nghttp3: + + % cd .. + % git clone -b $NGHTTP3_VERSION https://github.com/ngtcp2/nghttp3 + % cd nghttp3 + % git submodule update --init + % autoreconf -fi + % ./configure --prefix= --enable-lib-only + % make + % make install + +Build ngtcp2: + + % cd .. + % git clone -b $NGTCP2_VERSION https://github.com/ngtcp2/ngtcp2 + % cd ngtcp2 + % autoreconf -fi + % ./configure PKG_CONFIG_PATH=/lib/pkgconfig:/lib/pkgconfig LDFLAGS="-Wl,-rpath,/lib" --prefix= --enable-lib-only + % make + % make install + +Build curl: + + % cd .. + % git clone https://github.com/curl/curl + % cd curl + % autoreconf -fi + % LDFLAGS="-Wl,-rpath,/lib" ./configure --with-openssl= --with-nghttp3= --with-ngtcp2= + % make + % make install + +## Build with GnuTLS + +Build GnuTLS: + + % git clone --depth 1 https://gitlab.com/gnutls/gnutls.git + % cd gnutls + % ./bootstrap + % ./configure --prefix= + % make + % make install + +Build nghttp3: + + % cd .. + % git clone -b $NGHTTP3_VERSION https://github.com/ngtcp2/nghttp3 + % cd nghttp3 + % git submodule update --init + % autoreconf -fi + % ./configure --prefix= --enable-lib-only + % make + % make install + +Build ngtcp2: + + % cd .. + % git clone -b $NGTCP2_VERSION https://github.com/ngtcp2/ngtcp2 + % cd ngtcp2 + % autoreconf -fi + % ./configure PKG_CONFIG_PATH=/lib/pkgconfig:/lib/pkgconfig LDFLAGS="-Wl,-rpath,/lib" --prefix= --enable-lib-only --with-gnutls + % make + % make install + +Build curl: + + % cd .. + % git clone https://github.com/curl/curl + % cd curl + % autoreconf -fi + % ./configure --with-gnutls= --with-nghttp3= --with-ngtcp2= + % make + % make install + +## Build with wolfSSL + +Build wolfSSL: + + % git clone https://github.com/wolfSSL/wolfssl.git + % cd wolfssl + % autoreconf -fi + % ./configure --prefix= --enable-quic --enable-session-ticket --enable-earlydata --enable-psk --enable-harden --enable-altcertchains + % make + % make install + +Build nghttp3: + + % cd .. + % git clone -b $NGHTTP3_VERSION https://github.com/ngtcp2/nghttp3 + % cd nghttp3 + % git submodule update --init + % autoreconf -fi + % ./configure --prefix= --enable-lib-only + % make + % make install + +Build ngtcp2: + + % cd .. + % git clone -b $NGTCP2_VERSION https://github.com/ngtcp2/ngtcp2 + % cd ngtcp2 + % autoreconf -fi + % ./configure PKG_CONFIG_PATH=/lib/pkgconfig:/lib/pkgconfig LDFLAGS="-Wl,-rpath,/lib" --prefix= --enable-lib-only --with-wolfssl + % make + % make install + +Build curl: + + % cd .. + % git clone https://github.com/curl/curl + % cd curl + % autoreconf -fi + % ./configure --with-wolfssl= --with-nghttp3= --with-ngtcp2= + % make + % make install + +# quiche version + +quiche support is **EXPERIMENTAL** + +Since the quiche build manages its dependencies, curl can be built against the latest version. You are *probably* able to build against their main branch, but in case of problems, we recommend their latest release tag. + +## Build + +Build quiche and BoringSSL: + + % git clone --recursive -b 0.22.0 https://github.com/cloudflare/quiche + % cd quiche + % cargo build --package quiche --release --features ffi,pkg-config-meta,qlog + % ln -s libquiche.so target/release/libquiche.so.0 + % mkdir quiche/deps/boringssl/src/lib + % ln -vnf $(find target/release -name libcrypto.a -o -name libssl.a) quiche/deps/boringssl/src/lib/ + +Build curl: + + % cd .. + % git clone https://github.com/curl/curl + % cd curl + % autoreconf -fi + % ./configure LDFLAGS="-Wl,-rpath,$PWD/../quiche/target/release" --with-openssl=$PWD/../quiche/quiche/deps/boringssl/src --with-quiche=$PWD/../quiche/target/release + % make + % make install + + If `make install` results in `Permission denied` error, you need to prepend + it with `sudo`. + +# OpenSSL version + +QUIC support is **EXPERIMENTAL** + +Use OpenSSL 3.3.1 or newer (QUIC support was added in 3.3.0, with +shortcomings on some platforms like macOS). 3.4.1 or newer is recommended. +Build via: + + % cd .. + % git clone -b $OPENSSL_VERSION https://github.com/openssl/openssl + % cd openssl + % ./config enable-tls1_3 --prefix= --libdir=lib + % make + % make install + +Build nghttp3: + + % cd .. + % git clone -b $NGHTTP3_VERSION https://github.com/ngtcp2/nghttp3 + % cd nghttp3 + % git submodule update --init + % autoreconf -fi + % ./configure --prefix= --enable-lib-only + % make + % make install + +Build curl: + + % cd .. + % git clone https://github.com/curl/curl + % cd curl + % autoreconf -fi + % LDFLAGS="-Wl,-rpath,/lib" ./configure --with-openssl= --with-openssl-quic --with-nghttp3= + % make + % make install + +You can build curl with cmake: + + % cd .. + % git clone https://github.com/curl/curl + % cd curl + % cmake -B bld -DCURL_USE_OPENSSL=ON -DUSE_OPENSSL_QUIC=ON + % cmake --build bld + % cmake --install bld + + If `make install` results in `Permission denied` error, you need to prepend + it with `sudo`. + +# msh3 (msquic) version + +**Note**: The msquic HTTP/3 backend is immature and is not properly functional +one as of September 2023. Feel free to help us test it and improve it, but +there is no point in filing bugs about it just yet. + +msh3 support is **EXPERIMENTAL** + +## Build Linux (with quictls fork of OpenSSL) + +Build msh3: + + % git clone -b v0.6.0 --depth 1 --recursive https://github.com/nibanks/msh3 + % cd msh3 && mkdir build && cd build + % cmake -G 'Unix Makefiles' -DCMAKE_BUILD_TYPE=RelWithDebInfo .. + % cmake --build . + % cmake --install . + +Build curl: + + % git clone https://github.com/curl/curl + % cd curl + % autoreconf -fi + % ./configure LDFLAGS="-Wl,-rpath,/usr/local/lib" --with-msh3=/usr/local --with-openssl + % make + % make install + +Run from `/usr/local/bin/curl`. + +## Build Windows + +Build msh3: + + % git clone -b v0.6.0 --depth 1 --recursive https://github.com/nibanks/msh3 + % cd msh3 && mkdir build && cd build + % cmake -G 'Visual Studio 17 2022' -DCMAKE_BUILD_TYPE=RelWithDebInfo .. + % cmake --build . --config Release + % cmake --install . --config Release + +**Note** - On Windows, Schannel is used for TLS support by default. If you +with to use (the quictls fork of) OpenSSL, specify the `-DQUIC_TLS=openssl` +option to the generate command above. Also note that OpenSSL brings with it an +additional set of build dependencies not specified here. + +Build curl (in [Visual Studio Command +prompt](../winbuild/README.md#open-a-command-prompt)): + + % git clone https://github.com/curl/curl + % cd curl/winbuild + % nmake /f Makefile.vc mode=dll WITH_MSH3=dll MSH3_PATH="C:/Program Files/msh3" MACHINE=x64 + +Run in the `C:/Program Files/msh3/lib` directory, copy `curl.exe` to that +directory, or copy `msquic.dll` and `msh3.dll` from that directory to the +`curl.exe` directory. For example: + + % C:\Program Files\msh3\lib> F:\curl\builds\libcurl-vc-x64-release-dll-ipv6-sspi-schannel-msh3\bin\curl.exe --http3 https://curl.se/ + +# `--http3` + +Use only HTTP/3: + + % curl --http3-only https://example.org:4433/ + +Use HTTP/3 with fallback to HTTP/2 or HTTP/1.1 (see "HTTPS eyeballing" below): + + % curl --http3 https://example.org:4433/ + +Upgrade via Alt-Svc: + + % curl --alt-svc altsvc.cache https://curl.se/ + +See this [list of public HTTP/3 servers](https://bagder.github.io/HTTP3-test/) + +### HTTPS eyeballing + +With option `--http3` curl attempts earlier HTTP versions as well should the +connect attempt via HTTP/3 not succeed "fast enough". This strategy is similar +to IPv4/6 happy eyeballing where the alternate address family is used in +parallel after a short delay. + +The IPv4/6 eyeballing has a default of 200ms and you may override that via +`--happy-eyeballs-timeout-ms value`. Since HTTP/3 is still relatively new, we +decided to use this timeout also for the HTTP eyeballing - with a slight +twist. + +The `happy-eyeballs-timeout-ms` value is the **hard** timeout, meaning after +that time expired, a TLS connection is opened in addition to negotiate HTTP/2 +or HTTP/1.1. At half of that value - currently - is the **soft** timeout. The +soft timeout fires, when there has been **no data at all** seen from the +server on the HTTP/3 connection. + +So, without you specifying anything, the hard timeout is 200ms and the soft is 100ms: + + * Ideally, the whole QUIC handshake happens and curl has an HTTP/3 connection + in less than 100ms. + * When QUIC is not supported (or UDP does not work for this network path), no + reply is seen and the HTTP/2 TLS+TCP connection starts 100ms later. + * In the worst case, UDP replies start before 100ms, but drag on. This starts + the TLS+TCP connection after 200ms. + * When the QUIC handshake fails, the TLS+TCP connection is attempted right + away. For example, when the QUIC server presents the wrong certificate. + +The whole transfer only fails, when **both** QUIC and TLS+TCP fail to +handshake or time out. + +Note that all this happens in addition to IP version happy eyeballing. If the +name resolution for the server gives more than one IP address, curl tries all +those until one succeeds - just as with all other protocols. If those IP +addresses contain both IPv6 and IPv4, those attempts happen, delayed, in +parallel (the actual eyeballing). + +## Known Bugs + +Check out the [list of known HTTP3 bugs](https://curl.se/docs/knownbugs.html#HTTP3). + +# HTTP/3 Test server + +This is not advice on how to run anything in production. This is for +development and experimenting. + +## Prerequisite(s) + +An existing local HTTP/1.1 server that hosts files. Preferably also a few huge +ones. You can easily create huge local files like `truncate -s=8G 8GB` - they +are huge but do not occupy that much space on disk since they are just big +holes. + +In a Debian setup you can install apache2. It runs on port 80 and has a +document root in `/var/www/html`. Download the 8GB file from apache with `curl +localhost/8GB -o dev/null` + +In this description we setup and run an HTTP/3 reverse-proxy in front of the +HTTP/1 server. + +## Setup + +You can select either or both of these server solutions. + +### nghttpx + +Get, build and install quictls, nghttp3 and ngtcp2 as described +above. + +Get, build and install nghttp2: + + % git clone https://github.com/nghttp2/nghttp2.git + % cd nghttp2 + % autoreconf -fi + % PKG_CONFIG_PATH=$PKG_CONFIG_PATH:/home/daniel/build-quictls/lib/pkgconfig:/home/daniel/build-nghttp3/lib/pkgconfig:/home/daniel/build-ngtcp2/lib/pkgconfig LDFLAGS=-L/home/daniel/build-quictls/lib CFLAGS=-I/home/daniel/build-quictls/include ./configure --enable-maintainer-mode --prefix=/home/daniel/build-nghttp2 --disable-shared --enable-app --enable-http3 --without-jemalloc --without-libxml2 --without-systemd + % make && make install + +Run the local h3 server on port 9443, make it proxy all traffic through to +HTTP/1 on localhost port 80. For local toying, we can just use the test cert +that exists in curl's test dir. + + % CERT=/path/to/stunnel.pem + % $HOME/bin/nghttpx $CERT $CERT --backend=localhost,80 \ + --frontend="localhost,9443;quic" + +### Caddy + +[Install Caddy](https://caddyserver.com/docs/install). For easiest use, the binary +should be either in your PATH or your current directory. + +Create a `Caddyfile` with the following content: +~~~ +localhost:7443 { + respond "Hello, world! you are using {http.request.proto}" +} +~~~ + +Then run Caddy: + + % ./caddy start + +Making requests to `https://localhost:7443` should tell you which protocol is being used. + +You can change the hard-coded response to something more useful by replacing `respond` +with `reverse_proxy` or `file_server`, for example: `reverse_proxy localhost:80` diff --git a/curl/docs/HTTPSRR.md b/curl/docs/HTTPSRR.md new file mode 100644 index 0000000..22184a2 --- /dev/null +++ b/curl/docs/HTTPSRR.md @@ -0,0 +1,100 @@ + + +# HTTPS RR + +[RFC 9460](https://www.rfc-editor.org/rfc/rfc9460.html) documents the HTTPS +DNS Resource Record. + +curl features **experimental** support for HTTPS RR. + +- The ALPN list from the record is parsed and used +- The ECH field is stored - and used if ECH is enabled in the build +- The port number is not used (Firefox supports it, Chrome does not) +- The target name is not used +- The IP addresses (`Ipv6hints`, `Ipv4hints`) from the HTTPS RR are not used +- It only supports a single HTTPS RR per hostname +- Hostnames without A/AAAA records but *with* HTTPS RR fails +- consider service profiles where the RR provides different addresses for TCP + vs QUIC etc + +`HTTPSRR` is listed as a feature in the `curl -V` output if curl contains +HTTPS RR support. If c-ares is not included in the build, the HTTPS RR support +is limited to DoH. + +`asyn-rr` is listed as a feature in the `curl -V` output if c-ares is used for +additional resolves in addition to a "normal" resolve done with the threaded +resolver. + +The data extracted from the HTTPS RR is stored in the in-memory DNS cache to +be reused on subsequent uses of the same hostnames. + +## limitations + +We have decided to work on the HTTPS RR support by following what seems to be +(widely) used, and simply wait with implementing the details of the record +that do not seem to be deployed. HTTPS RR is a DNS field with many odd corners +and complexities and we might as well avoid them if no one seems to want them. + +## build + + ./configure --enable-httpsrr + +or + + cmake -DUSE_HTTPSRR=ON + +## ALPN + +The list of ALPN IDs is parsed but may not be completely respected because of +what the HTTP version preference is set to, which is a problem we are working +on. Also, getting an `HTTP/1.1` ALPN in the HTTPS RR field for an HTTP:// +transfer should imply switching to HTTPS, HSTS style. Which curl currently +does not. + +## DoH + +When HTTPS RR is enabled in the curl build, The DoH code asks for an HTTPS +record in addition to the A and AAAA records, and if an HTTPS RR answer is +returned, curl parses it and stores the retrieved information. + +## Non-DoH + +If DoH is not used for name resolving in an HTTPS RR enabled build, we must +provide the ability using the regular resolver backends. We use the c-ares DNS +library for the HTTPS RR lookup. Version 1.28.0 or later. + +### c-ares + +If curl is built to use the c-ares library for name resolves, an HTTPS RR +enabled build makes a request for the HTTPS RR in addition to the regular +lookup. + +### Threaded resolver + +When built to use the threaded resolver, which is the default, an HTTPS RR +build still needs a c-ares installation provided so that a separate request +for the HTTPS record can be done in parallel to the regular getaddrinfo() +call. + +This is done by specifying both c-ares and threaded resolver to configure: + + ./configure --enable-ares=... --enable-threaded-resolver + +or to cmake: + + cmake -DENABLE_ARES=ON -DENABLE_THREADED_RESOLVER=ON + +Because the HTTPS record is handled separately from the A/AAAA record +retrieval, by a separate library, there is a small risk for discrepancies. + +When building curl using the threaded resolver with HTTPS RR support (using +c-ares), the `curl -V` output looks exactly like a c-ares resolver build. + +## HTTPS RR Options + +Because curl is a low level transfer tool for which users sometimes want +detailed control, we need to offer options to control HTTPS RR use. diff --git a/curl/docs/INFRASTRUCTURE.md b/curl/docs/INFRASTRUCTURE.md new file mode 100644 index 0000000..7dfd629 --- /dev/null +++ b/curl/docs/INFRASTRUCTURE.md @@ -0,0 +1,209 @@ + + +# Infrastructure in the curl project + +Overview of infrastructure we maintain, host and run in the project for the +project. + +## git repository + +Since 2010, the main curl git repository has been hosted by GitHub, available +at https://github.com/curl/curl. + +We also use the issue tracker, pull requests and discussions on GitHub. + +curl has an "enterprise account" on GitHub and is an "organization" on the +site. + +We accept sponsorship via GitHub Sponsors. + +## CI services + +For every pull request and git push to the master repository, a number of +build and testing jobs are run on a set of different CI services. The exact +services vary over time. GitHub Actions and AppVeyor are the primary ones +these days. + +## Test Clutch + +A [Test Clutch](https://github.com/dfandrich/testclutch) instance generates +regular reports on curl CI test results at https://testclutch.curl.se/ as well +as writing comments on curl pull requests whose tests have failed. The jobs +are hosted on a Virtuozzo Application Platform PaaS instance and is managed by +Dan Fandrich. The configuration code is is available and managed at +https://github.com/dfandrich/testclutch-curl-web + +## Autobuilds + +The curl autobuild system is a set of scripts that build and test curl and +send all output logs back to the autobuild server. The results are +continuously collected and visualized on the curl website at +. + +The autobuild system and server is maintained by Daniel Stenberg. + +## OSS-Fuzz + +Google runs the [OSS-Fuzz](https://google.github.io/oss-fuzz/) project which +also runs fuzzing on curl code, non-stop, in their infrastructure and they +send us emails in the rare instances they actually find something. + +OSS-Fuzz notifies those that are members in the "curl team". Any curl +maintainer who wants to is welcome to participate. It requires a Google +account. + +## Coverity + +We regularly run our code through the [Coverity static code +analyzer](https://scan.coverity.com/) thanks to them offering this service to +us for free. + +## CodeSonar + +[CodeSonar](https://codesecure.com/our-products/codesonar/) analyzes the curl +source code daily and emails Daniel Stenberg whenever it finds suspected +problems in the source code. I hope and expect that we can invite other +maintainers to access these reports soon. + +## Domain names + +The project runs services and website using a few different curl related +domain names, including `curl.se` and `curl.dev`. Daniel Stenberg owns these +domain names. + +Until a few years ago, the curl website was present at `curl.haxx.se`. The +`haxx.se` domain is owned by Haxx AB, administrated by Daniel Stenberg. The +curl.haxx.se name is meant to keep working and be redirecting to curl.se for +the foreseeable future. + +## Websites + +The main curl website at `curl.se` is maintained by curl maintainers and the +content is available and managed at https://github.com/curl/curl-www. The site +updates from git and runs make every 20 minutes. Any change pushed to git can +thus take up to 20 minutes until it takes effect on the origin server. + +The content on `curl.dev` is available and managed at +https://github.com/curl/curl.dev/ + +The content on `everything-curl.dev` is available and managed at +https://github.com/curl/everything-curl/ + +The machine hosting the website contents for these three sites is owned by +Haxx AB and is primarily managed by Daniel Stenberg (co-owner of the Haxx +company). The machine is physically located in Sweden. + +curl release tarballs are hosted on https://curl.se/download.html. They are +uploaded there at release-time by the release manager. + +curl-for-win downloads are hosted on https://curl.se/windows and are uploaded +to the server by Viktor Szakats. + +curl-for-QNX downloads are hosted on and are uploaded to +the server by Daniel Stenberg. + +Daily release tarball-like snapshots are generated automatically and are +provided for download at . + +CA certificate bundles are extracted from the Firefox source code, hosted by +Mozilla and converted to PEM file format and is offered for download. The +conversion checks for updates daily. The bundle is provided for download at +. + +There is an automated "download check bot" that runs twice daily to scan for +available curl downloads to populate the curl download page appropriately with +the correct updated information. The bot uses URLs and patterns for all +download packages and is maintained in a database, maintained by Daniel +Stenberg and Dan Fandrich. + +The TLS certificate for the origin curl web server is automatically updated +from Let's Encrypt. + +## CDN + +Fastly runs the Content Delivery Network (CDN) that fronts all the curl +websites. The CDN caches content that it gets from the origin server. +Recently, roughly 99.99% of web requests are satisfied by the CDN without +having to reach the origin. + +The CDN caches different content at different lengths depending on the +content-type. The caching thus adds to the time for a change to have an effect +on the site from the moment it gets pushed to the git repository. + +Using this setup, we provide four IPv4 addresses and eight IPv6 addresses for +anycast access to the site. Should be snappy from virtually everywhere across +the globe. + +The CDN servers support HTTP/1, HTTP/2 and HTTP/3. They set HSTS for a year. +The `HTTP://` version of the site redirects to `HTTPS://`. + +Fastly manages the TLS certificates from Let's Encrypt for the servers they +run on the behalf of curl. + +## Containers + +The curl project offer container builds of curl. The source repository for +them is located at . + +Container images are hosted at and + + +## DNS + +The primary domain name, `curl.se` is managed by Kirei and is offered over +fault-tolerant anycast servers. High availability and fast access for +everyone. + +The actual physical DNS files and origin bind instance is managed by Daniel +Stenberg. + +## Mailing lists + +The curl related mailing lists are hosted by Haxx AB on `lists.haxx.se` and +are maintained by Daniel Stenberg. This includes the mailman2 and Postfix +instances used for this. + +## Email + +We use a few rare additional curl related email aliases in the curl domains. +They go through the mail server `mail.haxx.se` maintained by Daniel Stenberg + +## Bug-bounty + +We run a [bug-bounty](https://curl.se/docs/bugbounty.html) on HackerOne. The +setup runs entirely at https://hackerone.com/curl. + +The money part for the bug bounty is sponsored by the [Internet Bug +Bounty](https://hackerone.com/ibb). + +## Open Collective + +We use [Open Collective](https://opencollective.com/curl) as our "fiscal +host". All money sent to and received by the curl project is managed by Open +Collective. + +## Merchandise + +We have stickers, coffee mugs and coasters. They are managed by Daniel who +sits on the inventory. The best way to get your hands on curl merchandise is +to attend events where Daniel is physically. + +## Chat + +Some curl developers, maintainers, users and enthusiasts use IRC for real-time +chat about curl and related topics. This done in the `#curl` channel on the +`libra.chat` IRC network. **Daniel Stenberg** (`bagder`) is registered owner +of the channel. We do not run any IRC servers or services ourselves. + +`curelbot` is a service in the channel that shows details about GitHub issues +and pull requests when publicly mentioned using #[number]. The bot is run by +user `TheAssassin`. + +There is a Matrix bridge to the IRC channel called `matrix.curl.se`. The +bridge is setup and run by **Sergio Durigan Junior** and **Daniel Stenberg**. + +[curl online chat documentation](https://curl.se/docs/irc.html) diff --git a/curl/docs/INSTALL-CMAKE.md b/curl/docs/INSTALL-CMAKE.md new file mode 100644 index 0000000..b7fec51 --- /dev/null +++ b/curl/docs/INSTALL-CMAKE.md @@ -0,0 +1,605 @@ + + +# Building with CMake + +This document describes how to configure, build and install curl and libcurl +from source code using the CMake build tool. To build with CMake, you of +course first have to install CMake. The minimum required version of CMake is +specified in the file `CMakeLists.txt` found in the top of the curl source +tree. Once the correct version of CMake is installed you can follow the +instructions below for the platform you are building on. + +CMake builds can be configured either from the command line, or from one of +CMake's GUIs. + +# Configuring + +A CMake configuration of curl is similar to the autotools build of curl. +It consists of the following steps after you have unpacked the source. + +We recommend building with CMake on Windows. For instructions on migrating +from the `projects/Windows` Visual Studio solution files, see +[this section](#migrating-from-visual-studio-ide-project-files). For +instructions on migrating from the winbuild builds, see +[the following section](#migrating-from-winbuild-builds). + +## Using `cmake` + +You can configure for in source tree builds or for a build tree +that is apart from the source tree. + + - Build in the source tree. + + $ cmake -B . + + - Build in a separate directory (parallel to the curl source tree in this + example). The build directory is created for you. This is recommended over + building in the source tree to separate source and build artifacts. + + $ cmake -B ../curl-build + +For the full list of CMake build configuration variables see +[the corresponding section](#cmake-build-options). + +### Fallback for CMake before version 3.13 + +CMake before version 3.13 does not support the `-B` option. In that case, +you must create the build directory yourself, `cd` to it and run `cmake` +from there: + + $ mkdir ../curl-build + $ cd ../curl-build + $ cmake ../curl + +If you want to build in the source tree, it is enough to do this: + + $ cmake . + +### Build system generator selection + +You can override CMake's default by using `-G `. For example +on Windows with multiple build systems if you have MinGW-w64 then you could use +`-G "MinGW Makefiles"`. +[List of generator names](https://cmake.org/cmake/help/latest/manual/cmake-generators.7.html). + +## Using `ccmake` + +CMake comes with a curses based interface called `ccmake`. To run `ccmake` +on a curl use the instructions for the command line cmake, but substitute +`ccmake` for `cmake`. + +This brings up a curses interface with instructions on the bottom of the +screen. You can press the "c" key to configure the project, and the "g" key to +generate the project. After the project is generated, you can run make. + +## Using `cmake-gui` + +CMake also comes with a Qt based GUI called `cmake-gui`. To configure with +`cmake-gui`, you run `cmake-gui` and follow these steps: + + 1. Fill in the "Where is the source code" combo box with the path to + the curl source tree. + 2. Fill in the "Where to build the binaries" combo box with the path to + the directory for your build tree, ideally this should not be the same + as the source tree, but a parallel directory called curl-build or + something similar. + 3. Once the source and binary directories are specified, press the + "Configure" button. + 4. Select the native build tool that you want to use. + 5. At this point you can change any of the options presented in the GUI. + Once you have selected all the options you want, click the "Generate" + button. + +# Building + +Build (you have to specify the build directory). + + $ cmake --build ../curl-build + +## Static builds + +The CMake build setup is primarily done to work with shared/dynamic third +party dependencies. When linking with shared libraries, the dependency "chain" +is handled automatically by the library loader - on all modern systems. + +If you instead link with a static library, you need to provide all the +dependency libraries already at the link command line. + +Figuring out all the dependency libraries for a given library is hard, as it +might involve figuring out the dependencies of the dependencies and they vary +between platforms and can change between versions. + +When using static dependencies, the build scripts mostly assume that you, the +user, provide all the necessary additional dependency libraries as additional +arguments in the build. + +Building statically is not for the faint of heart. + +### Fallback for CMake before version 3.13 + +CMake before version 3.13 does not support the `--build` option. In that +case, you have to `cd` to the build directory and use the building tool that +corresponds to the build files that CMake generated for you. This example +assumes that CMake generates `Makefile`: + + $ cd ../curl-build + $ make + +# Testing + +(The test suite does not yet work with the cmake build) + +# Installing + +Install to default location (you have to specify the build directory). + + $ cmake --install ../curl-build + +Do not use `--prefix` to change the installation prefix as the output produced +by the `curl-config` script is determined at CMake configure time. If you want +to set a custom install prefix for curl, set +[`CMAKE_INSTALL_PREFIX`](https://cmake.org/cmake/help/latest/variable/CMAKE_INSTALL_PREFIX.html) +when configuring the CMake build. + +### Fallback for CMake before version 3.15 + +CMake before version 3.15 does not support the `--install` option. In that +case, you have to `cd` to the build directory and use the building tool that +corresponds to the build files that CMake generated for you. This example +assumes that CMake generates `Makefile`: + + $ cd ../curl-build + $ make install + +# CMake usage + +Just as curl can be built and installed using CMake, it can also be used from +CMake. + +## Using `find_package` + +To locate libcurl from CMake, one can use the standard +[`find_package`](https://cmake.org/cmake/help/latest/command/find_package.html) +command in the typical fashion: + +```cmake +find_package(CURL 8.12.0 REQUIRED) # FATAL_ERROR if CURL is not found +``` + +This invokes the CMake-provided +[FindCURL](https://cmake.org/cmake/help/latest/module/FindCURL.html) find module, +which first performs a search using the `find_package` +[config mode](https://cmake.org/cmake/help/latest/command/find_package.html#config-mode-search-procedure). +This is supported by the `CURLConfig.cmake` CMake config script which is +available if the given CURL was built and installed using CMake. + +### Detecting CURL features/protocols + +Since version 8.12.0, `CURLConfig.cmake` publishes the supported CURL features +and protocols (see [release notes](https://curl.se/ch/8.12.0.html)). These can +be specified using the `find_package` keywords `COMPONENTS` and +`OPTIONAL_COMPONENTS`, with protocols in all caps, e.g. `HTTPS`, `LDAP`, while +features should be in their original sentence case, e.g. `AsynchDNS`, +`UnixSockets`. If any of the `COMPONENTS` are missing, then CURL is considered +as *not* found. + +Here is an example of using `COMPONENTS` and `OPTIONAL_COMPONENTS` in +`find_package` with CURL: + +```cmake +# CURL_FOUND is FALSE if no HTTPS but brotli and zstd can be missing +find_package(CURL 8.12.0 COMPONENTS HTTPS OPTIONAL_COMPONENTS brotli zstd) +``` + +One can also check the defined `CURL_SUPPORTS_` variables +if a particular feature/protocol is supported. For example: + +```cmake +# check HTTPS +if(CURL_SUPPORTS_HTTPS) + message(STATUS "CURL supports HTTPS") +else() + message(STATUS "CURL does NOT support HTTPS") +endif() +``` + +### Linking against libcurl + +To link a CMake target against libcurl one can use +[`target_link_libraries`](https://cmake.org/cmake/help/latest/command/target_link_libraries.html) +as usual: + +```cmake +target_link_libraries(my_target PRIVATE CURL::libcurl) +``` + +# CMake build options + +- `BUILD_CURL_EXE`: Build curl executable. Default: `ON` +- `BUILD_EXAMPLES`: Build libcurl examples. Default: `ON` +- `BUILD_LIBCURL_DOCS`: Build libcurl man pages. Default: `ON` +- `BUILD_MISC_DOCS`: Build misc man pages (e.g. `curl-config` and `mk-ca-bundle`). Default: `ON` +- `BUILD_SHARED_LIBS`: Build shared libraries. Default: `ON` +- `BUILD_STATIC_CURL`: Build curl executable with static libcurl. Default: `OFF` +- `BUILD_STATIC_LIBS`: Build static libraries. Default: `OFF` +- `BUILD_TESTING`: Build tests. Default: `ON` +- `CURL_CLANG_TIDY`: Run the build through `clang-tidy`. Default: `OFF` +- `CURL_CLANG_TIDYFLAGS`: Custom options to pass to `clang-tidy`. Default: (empty) +- `CURL_COMPLETION_FISH`: Install fish completions. Default: `OFF` +- `CURL_COMPLETION_FISH_DIR`: Custom fish completion install directory. +- `CURL_COMPLETION_ZSH`: Install zsh completions. Default: `OFF` +- `CURL_COMPLETION_ZSH_DIR`: Custom zsh completion install directory. +- `CURL_DEFAULT_SSL_BACKEND`: Override default TLS backend in MultiSSL builds. + Accepted values in order of default priority: + `wolfssl`, `gnutls`, `mbedtls`, `openssl`, `secure-transport`, `schannel`, `bearssl`, `rustls` +- `CURL_ENABLE_EXPORT_TARGET`: Enable CMake export target. Default: `ON` +- `CURL_HIDDEN_SYMBOLS`: Hide libcurl internal symbols (=hide all symbols that are not officially external). Default: `ON` +- `CURL_LIBCURL_SOVERSION`: Enable libcurl SOVERSION. Default: `ON` for supported platforms +- `CURL_LIBCURL_VERSIONED_SYMBOLS`: Enable libcurl versioned symbols. Default: `OFF` +- `CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX`: Override default versioned symbol prefix. Default: `_` or `MULTISSL_` +- `CURL_LTO`: Enable compiler Link Time Optimizations. Default: `OFF` +- `CURL_STATIC_CRT`: Build libcurl with static CRT with MSVC (`/MT`) (requires UCRT, static libcurl or no curl executable). Default: `OFF` +- `CURL_TARGET_WINDOWS_VERSION`: Minimum target Windows version as hex string. +- `CURL_TEST_BUNDLES`: Build tests into single-binary bundles. Default: `OFF` +- `CURL_WERROR`: Turn compiler warnings into errors. Default: `OFF` +- `ENABLE_CURLDEBUG`: Enable TrackMemory debug feature. Default: =`ENABLE_DEBUG` +- `ENABLE_CURL_MANUAL`: Build the man page for curl and enable its `-M`/`--manual` option. Default: `ON` +- `ENABLE_DEBUG`: Enable curl debug features (for developing curl itself). Default: `OFF` +- `ENABLE_SERVER_DEBUG`: Apply curl debug options to test servers. Default: `OFF` +- `IMPORT_LIB_SUFFIX`: Import library suffix. Default: `_imp` for MSVC-like toolchains, otherwise empty. +- `LIBCURL_OUTPUT_NAME`: Basename of the curl library. Default: `libcurl` +- `PICKY_COMPILER`: Enable picky compiler options. Default: `ON` +- `SHARE_LIB_OBJECT`: Build shared and static libcurl in a single pass (requires CMake 3.12 or newer). Default: `ON` for Windows +- `STATIC_LIB_SUFFIX`: Static library suffix. Default: (empty) + +## CA bundle options + +- `CURL_CA_BUNDLE`: Path to the CA bundle. Set `none` to disable or `auto` for auto-detection. Default: `auto` +- `CURL_CA_EMBED`: Path to the CA bundle to embed in the curl tool. Default: (disabled) +- `CURL_CA_FALLBACK`: Use built-in CA store of TLS backend. Default: `OFF` +- `CURL_CA_PATH`: Location of default CA path. Set `none` to disable or `auto` for auto-detection. Default: `auto` +- `CURL_CA_SEARCH_SAFE`: Enable safe CA bundle search (within the curl tool directory) on Windows. Default: `OFF` + +## Enabling features + +- `CURL_ENABLE_SSL`: Enable SSL support. Default: `ON` +- `CURL_WINDOWS_SSPI`: Enable SSPI on Windows. Default: =`CURL_USE_SCHANNEL` +- `ENABLE_IPV6`: Enable IPv6 support. Default: `ON` if target supports IPv6. +- `ENABLE_THREADED_RESOLVER`: Enable threaded DNS lookup. Default: `ON` if c-ares is not enabled and target supports threading. +- `ENABLE_UNICODE`: Use the Unicode version of the Windows API functions. Default: `OFF` +- `ENABLE_UNIX_SOCKETS`: Enable Unix domain sockets support. Default: `ON` +- `USE_ECH`: Enable ECH support. Default: `OFF` +- `USE_HTTPSRR`: Enable HTTPS RR support. Default: `OFF` +- `USE_OPENSSL_QUIC`: Use OpenSSL and nghttp3 libraries for HTTP/3 support. Default: `OFF` +- `USE_SSLS_EXPORT`: Enable experimental SSL session import/export. Default: `OFF` + +## Disabling features + +- `CURL_DISABLE_ALTSVC`: Disable alt-svc support. Default: `OFF` +- `CURL_DISABLE_AWS`: Disable **aws-sigv4**. Default: `OFF` +- `CURL_DISABLE_BASIC_AUTH`: Disable Basic authentication. Default: `OFF` +- `CURL_DISABLE_BEARER_AUTH`: Disable Bearer authentication. Default: `OFF` +- `CURL_DISABLE_BINDLOCAL`: Disable local binding support. Default: `OFF` +- `CURL_DISABLE_CA_SEARCH`: Disable unsafe CA bundle search in PATH on Windows. Default: `OFF` +- `CURL_DISABLE_COOKIES`: Disable cookies support. Default: `OFF` +- `CURL_DISABLE_DICT`: Disable DICT. Default: `OFF` +- `CURL_DISABLE_DIGEST_AUTH`: Disable Digest authentication. Default: `OFF` +- `CURL_DISABLE_DOH`: Disable DNS-over-HTTPS. Default: `OFF` +- `CURL_DISABLE_FILE`: Disable FILE. Default: `OFF` +- `CURL_DISABLE_FORM_API`: Disable **form-api**. Default: =`CURL_DISABLE_MIME` +- `CURL_DISABLE_FTP`: Disable FTP. Default: `OFF` +- `CURL_DISABLE_GETOPTIONS`: Disable `curl_easy_options` API for existing options to `curl_easy_setopt`. Default: `OFF` +- `CURL_DISABLE_GOPHER`: Disable Gopher. Default: `OFF` +- `CURL_DISABLE_HEADERS_API`: Disable **headers-api** support. Default: `OFF` +- `CURL_DISABLE_HSTS`: Disable HSTS support. Default: `OFF` +- `CURL_DISABLE_HTTP`: Disable HTTP. Default: `OFF` +- `CURL_DISABLE_HTTP_AUTH`: Disable all HTTP authentication methods. Default: `OFF` +- `CURL_DISABLE_IMAP`: Disable IMAP. Default: `OFF` +- `CURL_DISABLE_INSTALL`: Disable installation targets. Default: `OFF` +- `CURL_DISABLE_IPFS`: Disable IPFS. Default: `OFF` +- `CURL_DISABLE_KERBEROS_AUTH`: Disable Kerberos authentication. Default: `OFF` +- `CURL_DISABLE_LDAP`: Disable LDAP. Default: `OFF` +- `CURL_DISABLE_LDAPS`: Disable LDAPS. Default: =`CURL_DISABLE_LDAP` +- `CURL_DISABLE_LIBCURL_OPTION`: Disable `--libcurl` option from the curl tool. Default: `OFF` +- `CURL_DISABLE_MIME`: Disable MIME support. Default: `OFF` +- `CURL_DISABLE_MQTT`: Disable MQTT. Default: `OFF` +- `CURL_DISABLE_NEGOTIATE_AUTH`: Disable negotiate authentication. Default: `OFF` +- `CURL_DISABLE_NETRC`: Disable netrc parser. Default: `OFF` +- `CURL_DISABLE_NTLM`: Disable NTLM support. Default: `OFF` +- `CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG`: Disable automatic loading of OpenSSL configuration. Default: `OFF` +- `CURL_DISABLE_PARSEDATE`: Disable date parsing. Default: `OFF` +- `CURL_DISABLE_POP3`: Disable POP3. Default: `OFF` +- `CURL_DISABLE_PROGRESS_METER`: Disable built-in progress meter. Default: `OFF` +- `CURL_DISABLE_PROXY`: Disable proxy support. Default: `OFF` +- `CURL_DISABLE_RTSP`: Disable RTSP. Default: `OFF` +- `CURL_DISABLE_SHA512_256`: Disable SHA-512/256 hash algorithm. Default: `OFF` +- `CURL_DISABLE_SHUFFLE_DNS`: Disable shuffle DNS feature. Default: `OFF` +- `CURL_DISABLE_SMB`: Disable SMB. Default: `OFF` +- `CURL_DISABLE_SMTP`: Disable SMTP. Default: `OFF` +- `CURL_DISABLE_SOCKETPAIR`: Disable use of socketpair for curl_multi_poll. Default: `OFF` +- `CURL_DISABLE_SRP`: Disable TLS-SRP support. Default: `OFF` +- `CURL_DISABLE_TELNET`: Disable Telnet. Default: `OFF` +- `CURL_DISABLE_TFTP`: Disable TFTP. Default: `OFF` +- `CURL_DISABLE_VERBOSE_STRINGS`: Disable verbose strings. Default: `OFF` +- `CURL_DISABLE_WEBSOCKETS`: Disable WebSocket. Default: `OFF` +- `HTTP_ONLY`: Disable all protocols except HTTP (This overrides all `CURL_DISABLE_*` options). Default: `OFF` + +## Environment + +- `CI`: Assume running under CI if set. +- `CURL_BUILDINFO`: Print `buildinfo.txt` if set. +- `CURL_CI`: Assume running under CI if set. + +## CMake options + +- `CMAKE_BUILD_TYPE`: (see CMake) +- `CMAKE_DEBUG_POSTFIX`: Default: `-d` +- `CMAKE_IMPORT_LIBRARY_SUFFIX` (see CMake) +- `CMAKE_INSTALL_BINDIR` (see CMake) +- `CMAKE_INSTALL_INCLUDEDIR` (see CMake) +- `CMAKE_INSTALL_LIBDIR` (see CMake) +- `CMAKE_INSTALL_PREFIX` (see CMake) +- `CMAKE_STATIC_LIBRARY_SUFFIX` (see CMake) +- `CMAKE_UNITY_BUILD_BATCH_SIZE`: Set the number of sources in a "unity" unit. Default: `0` (all) +- `CMAKE_UNITY_BUILD`: Enable "unity" (aka jumbo) builds. Default: `OFF` + +Details via CMake +[variables](https://cmake.org/cmake/help/latest/manual/cmake-variables.7.html) and +[install directories](https://cmake.org/cmake/help/latest/module/GNUInstallDirs.html). + +## Dependencies + +- `CURL_BROTLI`: Use brotli (`ON`, `OFF` or `AUTO`). Default: `AUTO` +- `CURL_USE_BEARSSL`: Enable BearSSL for SSL/TLS. Default: `OFF` +- `CURL_USE_GNUTLS`: Enable GnuTLS for SSL/TLS. Default: `OFF` +- `CURL_USE_GSASL`: Use libgsasl. Default: `OFF` +- `CURL_USE_GSSAPI`: Use GSSAPI implementation. Default: `OFF` +- `CURL_USE_LIBPSL`: Use libpsl. Default: `ON` +- `CURL_USE_LIBSSH2`: Use libssh2. Default: `ON` +- `CURL_USE_LIBSSH`: Use libssh. Default: `OFF` +- `CURL_USE_LIBUV`: Use libuv for event-based tests. Default: `OFF` +- `CURL_USE_MBEDTLS`: Enable mbedTLS for SSL/TLS. Default: `OFF` +- `CURL_USE_OPENSSL`: Enable OpenSSL for SSL/TLS. Default: `ON` if no other TLS backend was enabled. +- `CURL_USE_PKGCONFIG`: Enable `pkg-config` to detect dependencies. Default: `ON` for Unix (except Android, Apple devices), vcpkg, MinGW if not cross-compiling. +- `CURL_USE_RUSTLS`: Enable Rustls for SSL/TLS. Default: `OFF` +- `CURL_USE_SCHANNEL`: Enable Windows native SSL/TLS (Schannel). Default: `OFF` +- `CURL_USE_SECTRANSP`: Enable Apple OS native SSL/TLS (Secure Transport). Default: `OFF` +- `CURL_USE_WOLFSSH`: Use wolfSSH. Default: `OFF` +- `CURL_USE_WOLFSSL`: Enable wolfSSL for SSL/TLS. Default: `OFF` +- `CURL_ZLIB`: Use zlib (`ON`, `OFF` or `AUTO`). Default: `AUTO` +- `CURL_ZSTD`: Use zstd (`ON`, `OFF` or `AUTO`). Default: `AUTO` +- `ENABLE_ARES`: Enable c-ares support. Default: `OFF` +- `USE_APPLE_IDN`: Use Apple built-in IDN support. Default: `OFF` +- `USE_LIBIDN2`: Use libidn2 for IDN support. Default: `ON` +- `USE_LIBRTMP`: Enable librtmp from rtmpdump. Default: `OFF` +- `USE_MSH3`: Use msh3/msquic library for HTTP/3 support. Default: `OFF` +- `USE_NGHTTP2`: Use nghttp2 library. Default: `ON` +- `USE_NGTCP2`: Use ngtcp2 and nghttp3 libraries for HTTP/3 support. Default: `OFF` +- `USE_QUICHE`: Use quiche library for HTTP/3 support. Default: `OFF` +- `USE_WIN32_IDN`: Use WinIDN for IDN support. Default: `OFF` +- `USE_WIN32_LDAP`: Use Windows LDAP implementation. Default: `ON` + +## Dependency options (via CMake) + +- `OPENSSL_ROOT_DIR`: Set this variable to the root installation of OpenSSL (and forks). +- `OPENSSL_USE_STATIC_LIBS`: Look for static OpenSSL libraries. +- `ZLIB_INCLUDE_DIR`: The zlib include directory. +- `ZLIB_LIBRARY`: Path to `zlib` library. +- `ZLIB_USE_STATIC_LIBS`: Look for static ZLIB library (requires CMake v3.24). + +## Dependency options (tools) + +- `CLANG_TIDY`: `clang-tidy` tool used with `CURL_CLANG_TIDY=ON`. Default: `clang-tidy` +- `PERL_EXECUTABLE`: Perl binary used throughout the build and tests. + +## Dependency options (libraries) + +- `AMISSL_INCLUDE_DIR`: The AmiSSL include directory. +- `AMISSL_STUBS_LIBRARY`: Path to `amisslstubs` library. +- `AMISSL_AUTO_LIBRARY`: Path to `amisslauto` library. +- `BEARSSL_INCLUDE_DIR`: The BearSSL include directory. +- `BEARSSL_LIBRARY`: Path to `bearssl` library. +- `BROTLI_INCLUDE_DIR`: The brotli include directory. +- `BROTLICOMMON_LIBRARY`: Path to `brotlicommon` library. +- `BROTLIDEC_LIBRARY`: Path to `brotlidec` library. +- `CARES_INCLUDE_DIR`: The c-ares include directory. +- `CARES_LIBRARY`: Path to `cares` library. +- `DL_LIBRARY`: Path to `dl` library. (for Rustls) +- `GSS_ROOT_DIR`: Set this variable to the root installation of GSS. (also supported as environment) +- `LDAP_LIBRARY`: Name or full path to `ldap` library. Default: `ldap` +- `LDAP_LBER_LIBRARY`: Name or full path to `lber` library. Default: `lber` +- `LDAP_INCLUDE_DIR`: Path to LDAP include directory. +- `LIBGSASL_INCLUDE_DIR`: The libgsasl include directory. +- `LIBGSASL_LIBRARY`: Path to `libgsasl` library. +- `LIBIDN2_INCLUDE_DIR`: The libidn2 include directory. +- `LIBIDN2_LIBRARY`: Path to `libidn2` library. +- `LIBPSL_INCLUDE_DIR`: The libpsl include directory. +- `LIBPSL_LIBRARY`: Path to `libpsl` library. +- `LIBRTMP_INCLUDE_DIR`: The librtmp include directory. +- `LIBRTMP_LIBRARY`: Path to `librtmp` library. +- `LIBSSH_INCLUDE_DIR`: The libssh include directory. +- `LIBSSH_LIBRARY`: Path to `libssh` library. +- `LIBSSH2_INCLUDE_DIR`: The libssh2 include directory. +- `LIBSSH2_LIBRARY`: Path to `libssh2` library. +- `LIBUV_INCLUDE_DIR`: The libuv include directory. +- `LIBUV_LIBRARY`: Path to `libuv` library. +- `MATH_LIBRARY`: Path to `m` library. (for Rustls, wolfSSL) +- `MBEDTLS_INCLUDE_DIR`: The mbedTLS include directory. +- `MBEDTLS_LIBRARY`: Path to `mbedtls` library. +- `MBEDX509_LIBRARY`: Path to `mbedx509` library. +- `MBEDCRYPTO_LIBRARY`: Path to `mbedcrypto` library. +- `MSH3_INCLUDE_DIR`: The msh3 include directory. +- `MSH3_LIBRARY`: Path to `msh3` library. +- `NGHTTP2_INCLUDE_DIR`: The nghttp2 include directory. +- `NGHTTP2_LIBRARY`: Path to `nghttp2` library. +- `NGHTTP3_INCLUDE_DIR`: The nghttp3 include directory. +- `NGHTTP3_LIBRARY`: Path to `nghttp3` library. +- `NGTCP2_INCLUDE_DIR`: The ngtcp2 include directory. +- `NGTCP2_LIBRARY`: Path to `ngtcp2` library. +- `NETTLE_INCLUDE_DIR`: The nettle include directory. +- `NETTLE_LIBRARY`: Path to `nettle` library. +- `PTHREAD_LIBRARY`: Path to `pthread` library. (for Rustls) +- `QUICHE_INCLUDE_DIR`: The quiche include directory. +- `QUICHE_LIBRARY`: Path to `quiche` library. +- `RUSTLS_INCLUDE_DIR`: The Rustls include directory. +- `RUSTLS_LIBRARY`: Path to `rustls` library. +- `WATT_ROOT`: Set this variable to the root installation of Watt-32. +- `WOLFSSH_INCLUDE_DIR`: The wolfSSH include directory. +- `WOLFSSH_LIBRARY`: Path to `wolfssh` library. +- `WOLFSSL_INCLUDE_DIR`: The wolfSSL include directory. +- `WOLFSSL_LIBRARY`: Path to `wolfssl` library. +- `ZSTD_INCLUDE_DIR`: The zstd include directory. +- `ZSTD_LIBRARY`: Path to `zstd` library. + +## Test tools + +- `APXS`: Default: `apxs` +- `CADDY`: Default: `caddy` +- `HTTPD_NGHTTPX`: Default: `nghttpx` +- `HTTPD`: Default: `apache2` +- `TEST_NGHTTPX`: Default: `nghttpx` +- `VSFTPD`: Default: `vsftps` + +## Feature detection variables + +By default this CMake build script detects the version of some dependencies +using `check_symbol_exists`. Those checks do not work in the case that both +CURL and its dependency are included as sub-projects in a larger build using +`FetchContent`. To support that case, additional variables may be defined by +the parent project, ideally in the "extra" find package redirect file: + + +Available variables: + +- `HAVE_GNUTLS_SRP`: `gnutls_srp_verifier` present in GnuTLS. +- `HAVE_GSS_C_NT_HOSTBASED_SERVICE`: `GSS_C_NT_HOSTBASED_SERVICE` present in GSS/Heimdal/Kerberos. +- `HAVE_LDAP_INIT_FD`: `ldap_init_fd` present in LDAP library. +- `HAVE_LDAP_URL_PARSE`: `ldap_url_parse` present in LDAP library. +- `HAVE_OPENSSL_SRP`: `SSL_CTX_set_srp_username` present in OpenSSL (or fork). +- `HAVE_QUICHE_CONN_SET_QLOG_FD`: `quiche_conn_set_qlog_fd` present in quiche. +- `HAVE_RUSTLS_SUPPORTED_HPKE`: `rustls_supported_hpke` present in Rustls (unused if Rustls is detected via `pkg-config`). +- `HAVE_SSL_SET0_WBIO`: `SSL_set0_wbio` present in OpenSSL (or fork). +- `HAVE_SSL_SET1_ECH_CONFIG_LIST`: `SSL_set1_ech_config_list` present in OpenSSL (or fork). +- `HAVE_SSL_SET_QUIC_TLS_CBS`: `SSL_set_quic_tls_cbs` in OpenSSL. +- `HAVE_SSL_SET_QUIC_USE_LEGACY_CODEPOINT`: `SSL_set_quic_use_legacy_codepoint` in OpenSSL fork. +- `HAVE_WOLFSSL_BIO_NEW`: `wolfSSL_BIO_new` present in wolfSSL. +- `HAVE_WOLFSSL_BIO_SET_SHUTDOWN`: `wolfSSL_BIO_set_shutdown` present in wolfSSL. +- `HAVE_WOLFSSL_CTX_GENERATEECHCONFIG`: `wolfSSL_CTX_GenerateEchConfig` present in wolfSSL. +- `HAVE_WOLFSSL_DES_ECB_ENCRYPT`: `wolfSSL_DES_ecb_encrypt` present in wolfSSL. +- `HAVE_WOLFSSL_GET_PEER_CERTIFICATE`: `wolfSSL_get_peer_certificate` present in wolfSSL. +- `HAVE_WOLFSSL_SET_QUIC_USE_LEGACY_CODEPOINT`: + `wolfSSL_set_quic_use_legacy_codepoint` present in wolfSSL. +- `HAVE_WOLFSSL_USEALPN`: `wolfSSL_UseALPN` present in wolfSSL. + +For each of the above variables, if the variable is *defined* (either to `ON` +or `OFF`), the symbol detection is skipped. If the variable is *not defined*, +the feature detection is performed. + +Note: These variables are internal and subject to change. + +# Migrating from Visual Studio IDE Project Files + +We recommend using CMake to build curl with MSVC. + +The project build files reside in project/Windows/VC\* for VS2010, VS2012 and +VS2013. + +These CMake Visual Studio generators require CMake v3.24 or older. You can +download them from . + +You can also use `-G "NMake Makefiles"`, which is supported by all CMake +versions. + +Configuration element | Equivalent CMake options +:-------------------------------- | :-------------------------------- +`VC10` | `-G "Visual Studio 10 2010"` +`VC11` | `-G "Visual Studio 11 2012"` +`VC12` | `-G "Visual Studio 12 2013"` +`x64` | `-A x64` +`Win32` | `-A Win32` +`DLL` | `BUILD_SHARED_LIBS=ON`, `BUILD_STATIC_LIBS=OFF`, (default) +`LIB` | `BUILD_SHARED_LIBS=OFF`, `BUILD_STATIC_LIBS=ON` +`Debug` | `CMAKE_BUILD_TYPE=Debug` (`-G "NMake Makefiles"` only) +`Release` | `CMAKE_BUILD_TYPE=Release` (`-G "NMake Makefiles"` only) +`DLL Windows SSPI` | `CURL_USE_SCHANNEL=ON` (with SSPI enabled by default) +`DLL OpenSSL` | `CURL_USE_OPENSSL=ON`, optional: `OPENSSL_ROOT_DIR`, `OPENSSL_USE_STATIC_LIBS=ON` +`DLL libssh2` | `CURL_USE_LIBSSH2=ON`, optional: `LIBSSH2_INCLUDE_DIR`, `LIBSSH2_LIBRARY` +`DLL WinIDN` | `USE_WIN32_IDN=ON` + +For example these commands: + + > cd projects + > ./generate.bat VC12 + > msbuild "-property:Configuration=DLL Debug - DLL Windows SSPI - DLL WinIDN" Windows/VC12/curl-all.sln + +translate to: + + > cmake . -G "Visual Studio 12 2013" -A x64 -DCURL_USE_SCHANNEL=ON -DUSE_WIN32_IDN=ON -DCURL_USE_LIBPSL=OFF + > cmake --build . --config Debug --parallel + +We do *not* specify `-DCMAKE_BUILD_TYPE=Debug` here as we might do for the +`"NMake Makefiles"` generator because the Visual Studio generators are +[multi-config generators](https://cmake.org/cmake/help/latest/prop_gbl/GENERATOR_IS_MULTI_CONFIG.html) +and therefore ignore the value of `CMAKE_BUILD_TYPE`. + +# Migrating from winbuild builds + +We recommend CMake to build curl with MSVC. The winbuild build system is +deprecated and is going to be removed in September 2025 in favor of the CMake +build system. + +In CMake you can customize the path of dependencies by passing the absolute +header path and the full path of the library via `*_INCLUDE_DIR` and +`*_LIBRARY` options (see the complete list in the option listing above). +The full path to the library can point to a static library or an import +library, which defines if the dependency is linked as a dll or statically. +For OpenSSL this works +[differently](https://cmake.org/cmake/help/latest/module/FindOpenSSL.html): +You can pass the root directory of the OpenSSL installation via +`OPENSSL_ROOT_DIR`, then pass `OPENSSL_USE_STATIC_LIBS=ON` to select static +libs. + +winbuild options | Equivalent CMake options +:-------------------------------- | :-------------------------------- +`DEBUG` | `CMAKE_BUILD_TYPE=Debug` +`GEN_PDB` | `CMAKE_EXE_LINKER_FLAGS=/Fd`, `CMAKE_SHARED_LINKER_FLAGS=/Fd` +`LIB_NAME_DLL`, `LIB_NAME_STATIC` | `IMPORT_LIB_SUFFIX`, `LIBCURL_OUTPUT_NAME`, `STATIC_LIB_SUFFIX` +`VC`: `` | see the CMake [Visual Studio generators](https://cmake.org/cmake/help/latest/manual/cmake-generators.7.html#visual-studio-generators) +`MACHINE`: `x64`, `x86` | `-A x64`, `-A Win32` +`MODE`: `dll`, `static` | `BUILD_SHARED_LIBS=ON/OFF`, `BUILD_STATIC_LIBS=ON/OFF`, `BUILD_STATIC_CURL=ON/OFF` (default: dll) +`RTLIBCFG`: `static` | `CURL_STATIC_CRT=ON` +`ENABLE_IDN` | `USE_WIN32_IDN=ON` +`ENABLE_IPV6` | `ENABLE_IPV6=ON` +`ENABLE_MSH3` | `USE_MSH3=ON` +`ENABLE_NGHTTP2` | `USE_NGHTTP2=ON` +`ENABLE_OPENSSL_AUTO_LOAD_CONFIG` | `CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG=OFF` (default) +`ENABLE_SCHANNEL` | `CURL_USE_SCHANNEL=ON` +`ENABLE_SSPI` | `CURL_WINDOWS_SSPI=ON` (default with Schannel) +`ENABLE_UNICODE` | `ENABLE_UNICODE=ON` +`WITH_PREFIX` | `CMAKE_INSTALL_PREFIX=` +`WITH_DEVEL` | see individual `*_INCLUDE_DIR` and `*_LIBRARY` options and `OPENSSL_ROOT_DIR` +`WITH_CARES`, `CARES_PATH` | `ENABLE_ARES=ON`, optional: `CARES_INCLUDE_DIR`, `CARES_LIBRARY` +`WITH_MBEDTLS`, `MBEDTLS_PATH` | `CURL_USE_MBEDTLS=ON`, optional: `MBEDTLS_INCLUDE_DIR`, `MBEDTLS_LIBRARY`, `MBEDX509_LIBRARY`, `MBEDCRYPTO_LIBRARY` +`WITH_MSH3`, `MSH_PATH` | `USE_MSH3=ON`, optional: `MSH3_INCLUDE_DIR`, `MSH3_LIBRARY` +`WITH_NGHTTP2`, `NGHTTP2_PATH` | `USE_NGHTTP2=ON`, optional: `NGHTTP2_INCLUDE_DIR`, `NGHTTP2_LIBRARY` +`WITH_SSH`, `SSH_PATH` | `CURL_USE_LIBSSH=ON`, optional: `LIBSSH_INCLUDE_DIR`, `LIBSSH_LIBRARY` +`WITH_SSH2`, `SSH2_PATH` | `CURL_USE_LIBSSH2=ON`, optional: `LIBSSH2_INCLUDE_DIR`, `LIBSSH2_LIBRARY` +`WITH_SSL`, `SSL_PATH` | `CURL_USE_OPENSSL=ON`, optional: `OPENSSL_ROOT_DIR`, `OPENSSL_USE_STATIC_LIBS=ON` +`WITH_WOLFSSL`, `WOLFSSL_PATH` | `CURL_USE_WOLFSSL=ON`, optional: `WOLFSSL_INCLUDE_DIR`, `WOLFSSL_LIBRARY` +`WITH_ZLIB`, `ZLIB_PATH` | `CURL_ZLIB=ON`, optional: `ZLIB_INCLUDE_DIR`, `ZLIB_LIBRARY` + +For example this command-line: + + > nmake -f Makefile.vc VC=17 MACHINE=x64 DEBUG=ON mode=dll SSL_PATH=C:\OpenSSL WITH_SSL=dll ENABLE_UNICODE=ON + +translates to: + + > cmake . -G "Visual Studio 17 2022" -A x64 -DBUILD_SHARED_LIBS=ON -DOPENSSL_ROOT_DIR=C:\OpenSSL -DCURL_USE_OPENSSL=ON -DENABLE_UNICODE=ON -DCURL_USE_LIBPSL=OFF + > cmake --build . --config Debug + +We use `--config` with `cmake --build` because the Visual Studio CMake +generators are multi-config and therefore ignore `CMAKE_BUILD_TYPE`. diff --git a/curl/docs/INSTALL.md b/curl/docs/INSTALL.md new file mode 100644 index 0000000..f61c0ea --- /dev/null +++ b/curl/docs/INSTALL.md @@ -0,0 +1,665 @@ + + +# How to install curl and libcurl + +## Installing Binary Packages + +Lots of people download binary distributions of curl and libcurl. This +document does not describe how to install curl or libcurl using such a binary +package. This document describes how to compile, build and install curl and +libcurl from source code. + +## Building using vcpkg + +You can download and install curl and libcurl using the [vcpkg](https://github.com/Microsoft/vcpkg/) dependency manager: + + git clone https://github.com/Microsoft/vcpkg.git + cd vcpkg + ./bootstrap-vcpkg.sh + ./vcpkg integrate install + vcpkg install curl[tool] + +The curl port in vcpkg is kept up to date by Microsoft team members and +community contributors. If the version is out of date, please [create an issue +or pull request](https://github.com/Microsoft/vcpkg) on the vcpkg repository. + +## Building from git + +If you get your code off a git repository instead of a release tarball, see +the `GIT-INFO.md` file in the root directory for specific instructions on how +to proceed. + +# Unix + +A normal Unix installation is made in three or four steps (after you have +unpacked the source archive): + + ./configure --with-openssl [--with-gnutls --with-wolfssl] + make + make test (optional) + make install + +(Adjust the configure line accordingly to use the TLS library you want.) + +You probably need to be root when doing the last command. + +Get a full listing of all available configure options by invoking it like: + + ./configure --help + +If you want to install curl in a different file hierarchy than `/usr/local`, +specify that when running configure: + + ./configure --prefix=/path/to/curl/tree + +If you have write permission in that directory, you can do 'make install' +without being root. An example of this would be to make a local install in +your own home directory: + + ./configure --prefix=$HOME + make + make install + +The configure script always tries to find a working SSL library unless +explicitly told not to. If you have OpenSSL installed in the default search +path for your compiler/linker, you do not need to do anything special. If you +have OpenSSL installed in `/usr/local/ssl`, you can run configure like: + + ./configure --with-openssl + +If you have OpenSSL installed somewhere else (for example, `/opt/OpenSSL`) and +you have pkg-config installed, set the pkg-config path first, like this: + + env PKG_CONFIG_PATH=/opt/OpenSSL/lib/pkgconfig ./configure --with-openssl + +Without pkg-config installed, use this: + + ./configure --with-openssl=/opt/OpenSSL + +If you insist on forcing a build without SSL support, you can run configure +like this: + + ./configure --without-ssl + +If you have OpenSSL installed, but with the libraries in one place and the +header files somewhere else, you have to set the `LDFLAGS` and `CPPFLAGS` +environment variables prior to running configure. Something like this should +work: + + CPPFLAGS="-I/path/to/ssl/include" LDFLAGS="-L/path/to/ssl/lib" ./configure + +If you have shared SSL libs installed in a directory where your runtime +linker does not find them (which usually causes configure failures), you can +provide this option to gcc to set a hard-coded path to the runtime linker: + + LDFLAGS=-Wl,-R/usr/local/ssl/lib ./configure --with-openssl + +## Static builds + +To force a static library compile, disable the shared library creation by +running configure like: + + ./configure --disable-shared + +The configure script is primarily done to work with shared/dynamic third party +dependencies. When linking with shared libraries, the dependency "chain" is +handled automatically by the library loader - on all modern systems. + +If you instead link with a static library, you need to provide all the +dependency libraries already at the link command line. + +Figuring out all the dependency libraries for a given library is hard, as it +might involve figuring out the dependencies of the dependencies and they vary +between platforms and change between versions. + +When using static dependencies, the build scripts mostly assume that you, the +user, provide all the necessary additional dependency libraries as additional +arguments in the build. With configure, by setting `LIBS` or `LDFLAGS` on the +command line. + +Building statically is not for the faint of heart. + +## Debug + +If you are a curl developer and use gcc, you might want to enable more debug +options with the `--enable-debug` option. + +curl can be built to use a whole range of libraries to provide various useful +services, and configure tries to auto-detect a decent default. If you want to +alter it, you can select how to deal with each individual library. + +## Select TLS backend + +These options are provided to select the TLS backend to use. + + - AmiSSL: `--with-amissl` + - BearSSL: `--with-bearssl` + - GnuTLS: `--with-gnutls`. + - mbedTLS: `--with-mbedtls` + - OpenSSL: `--with-openssl` (also for BoringSSL, AWS-LC, LibreSSL, and quictls) + - rustls: `--with-rustls` + - Schannel: `--with-schannel` + - Secure Transport: `--with-secure-transport` + - wolfSSL: `--with-wolfssl` + +You can build curl with *multiple* TLS backends at your choice, but some TLS +backends cannot be combined: if you build with an OpenSSL fork (or wolfSSL), +you cannot add another OpenSSL fork (or wolfSSL) simply because they have +conflicting identical symbol names. + +When you build with multiple TLS backends, you can select the active one at +runtime when curl starts up. + +## MultiSSL and HTTP/3 + +HTTP/3 needs QUIC and QUIC needs TLS. Building libcurl with HTTP/3 and QUIC +support is not compatible with the MultiSSL feature: they are mutually +exclusive. If you need MultiSSL in your build, you cannot have HTTP/3 support +and vice versa. + +libcurl can only use a single TLS library with QUIC and that *same* TLS +library needs to be used for the other TLS using protocols. + +## Configure finding libs in wrong directory + +When the configure script checks for third-party libraries, it adds those +directories to the `LDFLAGS` variable and then tries linking to see if it +works. When successful, the found directory is kept in the `LDFLAGS` variable +when the script continues to execute and do more tests and possibly check for +more libraries. + +This can make subsequent checks for libraries wrongly detect another +installation in a directory that was previously added to `LDFLAGS` by another +library check. + +# Windows + +Building for Windows XP is required as a minimum. + +You can build curl with: + +- Microsoft Visual Studio 2008 v9.0 or later (`_MSC_VER >= 1500`) +- MinGW-w64 + +## Building Windows DLLs and C runtime (CRT) linkage issues + + As a general rule, building a DLL with static CRT linkage is highly + discouraged, and intermixing CRTs in the same app is something to avoid at + any cost. + + Reading and comprehending Microsoft Knowledge Base articles KB94248 and + KB140584 is a must for any Windows developer. Especially important is full + understanding if you are not going to follow the advice given above. + + - [How To Use the C Runtime](https://support.microsoft.com/help/94248/how-to-use-the-c-run-time) + - [Runtime Library Compiler Options](https://docs.microsoft.com/cpp/build/reference/md-mt-ld-use-run-time-library) + - [Potential Errors Passing CRT Objects Across DLL Boundaries](https://docs.microsoft.com/cpp/c-runtime-library/potential-errors-passing-crt-objects-across-dll-boundaries) + +If your app is misbehaving in some strange way, or it is suffering from memory +corruption, before asking for further help, please try first to rebuild every +single library your app uses as well as your app using the debug +multi-threaded dynamic C runtime. + + If you get linkage errors read section 5.7 of the FAQ document. + +## Cygwin + +Almost identical to the Unix installation. Run the configure script in the +curl source tree root with `sh configure`. Make sure you have the `sh` +executable in `/bin/` or you see the configure fail toward the end. + +Run `make` + +## MS-DOS + +You can use either autotools or cmake: + + ./configure \ + CC=/path/to/djgpp/bin/i586-pc-msdosdjgpp-gcc \ + AR=/path/to/djgpp/bin/i586-pc-msdosdjgpp-ar \ + RANLIB=/path/to/djgpp/bin/i586-pc-msdosdjgpp-ranlib \ + WATT_ROOT=/path/to/djgpp/net/watt \ + --host=i586-pc-msdosdjgpp \ + --with-openssl=/path/to/djgpp \ + --with-zlib=/path/to/djgpp \ + --without-libpsl \ + --disable-shared + + cmake . \ + -DCMAKE_SYSTEM_NAME=DOS \ + -DCMAKE_C_COMPILER_TARGET=i586-pc-msdosdjgpp \ + -DCMAKE_C_COMPILER=/path/to/djgpp/bin/i586-pc-msdosdjgpp-gcc \ + -DWATT_ROOT=/path/to/djgpp/net/watt \ + -DOPENSSL_INCLUDE_DIR=/path/to/djgpp/include \ + -DOPENSSL_SSL_LIBRARY=/path/to/djgpp/lib/libssl.a \ + -DOPENSSL_CRYPTO_LIBRARY=/path/to/djgpp/lib/libcrypto.a \ + -DZLIB_INCLUDE_DIR=/path/to/djgpp/include \ + -DZLIB_LIBRARY=/path/to/djgpp/lib/libz.a \ + -DCURL_USE_LIBPSL=OFF + +Notes: + + - Requires DJGPP 2.04 or upper. + + - Compile Watt-32 (and OpenSSL) with the same version of DJGPP. Otherwise + things go wrong because things like FS-extensions and `errno` values have + been changed between releases. + +## AmigaOS + +You can use either autotools or cmake: + + ./configure \ + CC=/opt/amiga/bin/m68k-amigaos-gcc \ + AR=/opt/amiga/bin/m68k-amigaos-ar \ + RANLIB=/opt/amiga/bin/m68k-amigaos-ranlib \ + --host=m68k-amigaos \ + --with-amissl \ + CFLAGS='-O0 -msoft-float -mcrt=clib2' \ + CPPFLAGS=-I/path/to/AmiSSL/Developer/include \ + LDFLAGS=-L/path/to/AmiSSL/Developer/lib/AmigaOS3 \ + LIBS='-lnet -lm -latomic' \ + --without-libpsl \ + --disable-shared + + cmake . \ + -DAMIGA=1 \ + -DCMAKE_SYSTEM_NAME=Generic \ + -DCMAKE_C_COMPILER_TARGET=m68k-unknown-amigaos \ + -DCMAKE_C_COMPILER=/opt/amiga/bin/m68k-amigaos-gcc \ + -DCMAKE_C_FLAGS='-O0 -msoft-float -mcrt=clib2' \ + -DAMISSL_INCLUDE_DIR=/path/to/AmiSSL/Developer/include \ + -DAMISSL_STUBS_LIBRARY=/path/to/AmiSSL/Developer/lib/AmigaOS3/libamisslstubs.a \ + -DAMISSL_AUTO_LIBRARY=/path/to/AmiSSL/Developer/lib/AmigaOS3/libamisslauto.a \ + -DCURL_USE_LIBPSL=OFF + +## Disabling Specific Protocols in Windows builds + +The configure utility, unfortunately, is not available for the Windows +environment, therefore, you cannot use the various disable-protocol options of +the configure utility on this platform. + +You can use specific defines to disable specific protocols and features. See +[CURL-DISABLE](CURL-DISABLE.md) for the full list. + +If you want to set any of these defines you have the following options: + + - Modify `lib/config-win32.h` + - Modify `lib/curl_setup.h` + - Modify `winbuild/Makefile.vc` + - Modify the "Preprocessor Definitions" in the libcurl project + +Note: The pre-processor settings can be found using the Visual Studio IDE +under "Project -> Properties -> Configuration Properties -> C/C++ -> +Preprocessor". + +## Using BSD-style lwIP instead of Winsock TCP/IP stack in Windows builds + +In order to compile libcurl and curl using BSD-style lwIP TCP/IP stack it is +necessary to make the definition of the preprocessor symbol `USE_LWIPSOCK` +visible to libcurl and curl compilation processes. To set this definition you +have the following alternatives: + + - Modify `lib/config-win32.h` + - Modify `winbuild/Makefile.vc` + - Modify the "Preprocessor Definitions" in the libcurl project + +Note: The pre-processor settings can be found using the Visual Studio IDE +under "Project -> Properties -> Configuration Properties -> C/C++ -> +Preprocessor". + +Once that libcurl has been built with BSD-style lwIP TCP/IP stack support, in +order to use it with your program it is mandatory that your program includes +lwIP header file `` (or another lwIP header that includes this) +before including any libcurl header. Your program does not need the +`USE_LWIPSOCK` preprocessor definition which is for libcurl internals only. + +Compilation has been verified with lwIP 1.4.0. + +This BSD-style lwIP TCP/IP stack support must be considered experimental given +that it has been verified that lwIP 1.4.0 still needs some polish, and libcurl +might yet need some additional adjustment. + +## Important static libcurl usage note + +When building an application that uses the static libcurl library on Windows, +you must add `-DCURL_STATICLIB` to your `CFLAGS`. Otherwise the linker looks +for dynamic import symbols. + +## Legacy Windows and SSL + +Schannel (from Windows SSPI), is the native SSL library in Windows. However, +Schannel in Windows <= XP is unable to connect to servers that no longer +support the legacy handshakes and algorithms used by those versions. If you +are using curl in one of those earlier versions of Windows you should choose +another SSL backend such as OpenSSL. + +# Apple Platforms (macOS, iOS, tvOS, watchOS, and their simulator counterparts) + +On modern Apple operating systems, curl can be built to use Apple's SSL/TLS +implementation, Secure Transport, instead of OpenSSL. To build with Secure +Transport for SSL/TLS, use the configure option `--with-secure-transport`. + +When Secure Transport is in use, the curl options `--cacert` and `--capath` +and their libcurl equivalents, are ignored, because Secure Transport uses the +certificates stored in the Keychain to evaluate whether or not to trust the +server. This, of course, includes the root certificates that ship with the OS. +The `--cert` and `--engine` options, and their libcurl equivalents, are +currently unimplemented in curl with Secure Transport. + +In general, a curl build for an Apple `ARCH/SDK/DEPLOYMENT_TARGET` combination +can be taken by providing appropriate values for `ARCH`, `SDK`, `DEPLOYMENT_TARGET` +below and running the commands: + +```bash +# Set these three according to your needs +export ARCH=x86_64 +export SDK=macosx +export DEPLOYMENT_TARGET=10.8 + +export CFLAGS="-arch $ARCH -isysroot $(xcrun -sdk $SDK --show-sdk-path) -m$SDK-version-min=$DEPLOYMENT_TARGET" +./configure --host=$ARCH-apple-darwin --prefix $(pwd)/artifacts --with-secure-transport +make -j8 +make install +``` + +With CMake: + +```bash +cmake . \ + -DCMAKE_OSX_ARCHITECTURES=x86_64 \ + -DCMAKE_OSX_DEPLOYMENT_TARGET=10.8 \ + -DCMAKE_OSX_SYSROOT="$(xcrun --sdk macosx --show-sdk-path)" +``` + +The above command lines build curl for macOS platform with `x86_64` +architecture and `10.8` as deployment target. + +Here is an example for iOS device: + +```bash +export ARCH=arm64 +export SDK=iphoneos +export DEPLOYMENT_TARGET=11.0 + +export CFLAGS="-arch $ARCH -isysroot $(xcrun -sdk $SDK --show-sdk-path) -m$SDK-version-min=$DEPLOYMENT_TARGET" +./configure --host=$ARCH-apple-darwin --prefix $(pwd)/artifacts --with-secure-transport +make -j8 +make install +``` + +With CMake (3.16 or upper recommended): + +```bash +cmake . \ + -DCMAKE_SYSTEM_NAME=iOS \ + -DCMAKE_OSX_ARCHITECTURES=arm64 \ + -DCMAKE_OSX_DEPLOYMENT_TARGET=11.0 +``` + +Another example for watchOS simulator for macs with Apple Silicon: + +```bash +export ARCH=arm64 +export SDK=watchsimulator +export DEPLOYMENT_TARGET=5.0 + +export CFLAGS="-arch $ARCH -isysroot $(xcrun -sdk $SDK --show-sdk-path) -m$SDK-version-min=$DEPLOYMENT_TARGET" +./configure --host=$ARCH-apple-darwin --prefix $(pwd)/artifacts --with-secure-transport +make -j8 +make install +``` + +In all above, the built libraries and executables can be found in the +`artifacts` folder. + +# Android + +When building curl for Android you can you CMake or curl's `configure` script. + +Before you can build curl for Android, you need to install the Android NDK +first. This can be done using the SDK Manager that is part of Android Studio. +Once you have installed the Android NDK, you need to figure out where it has +been installed and then set up some environment variables before launching +the build. + +Examples to compile for `aarch64` and API level 29: + +with CMake, where `ANDROID_NDK_HOME` points into your NDK: + + cmake . \ + -DANDROID_ABI=arm64-v8a \ + -DANDROID_PLATFORM=android-29 \ + -DCMAKE_TOOLCHAIN_FILE="$ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake" \ + -DCURL_ENABLE_SSL=OFF \ + -DCURL_USE_LIBPSL=OFF + +with `configure`, on macOS: + +```bash +export ANDROID_NDK_HOME=~/Library/Android/sdk/ndk/25.1.8937393 # Point into your NDK. +export HOST_TAG=darwin-x86_64 # Same tag for Apple Silicon. Other OS values here: https://developer.android.com/ndk/guides/other_build_systems#overview +export TOOLCHAIN=$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/$HOST_TAG +export AR=$TOOLCHAIN/bin/llvm-ar +export AS=$TOOLCHAIN/bin/llvm-as +export CC=$TOOLCHAIN/bin/aarch64-linux-android29-clang +export CXX=$TOOLCHAIN/bin/aarch64-linux-android29-clang++ +export LD=$TOOLCHAIN/bin/ld +export RANLIB=$TOOLCHAIN/bin/llvm-ranlib +export STRIP=$TOOLCHAIN/bin/llvm-strip +``` + +When building on Linux or targeting other API levels or architectures, you need +to adjust those variables accordingly. After that you can build curl like this: + + ./configure --host aarch64-linux-android --with-pic --disable-shared + +Note that this does not give you SSL/TLS support. If you need SSL/TLS, you +have to build curl with a SSL/TLS library, e.g. OpenSSL, because it is +impossible for curl to access Android's native SSL/TLS layer. To build curl +for Android using OpenSSL, follow the OpenSSL build instructions and then +install `libssl.a` and `libcrypto.a` to `$TOOLCHAIN/sysroot/usr/lib` and copy +`include/openssl` to `$TOOLCHAIN/sysroot/usr/include`. Now you can build curl +for Android using OpenSSL like this: + +```bash +LIBS="-lssl -lcrypto -lc++" # For OpenSSL/BoringSSL. In general, you need to the SSL/TLS layer's transitive dependencies if you are linking statically. +./configure --host aarch64-linux-android --with-pic --disable-shared --with-openssl="$TOOLCHAIN/sysroot/usr" +``` + +# IBM i + +For IBM i (formerly OS/400), you can use curl in two different ways: + +- Natively, running in the **ILE**. The obvious use is being able to call curl + from ILE C or RPG applications. +- You need to build this from source. See `packages/OS400/README` for the ILE + specific build instructions. +- In the **PASE** environment, which runs AIX programs. curl is built as it + would be on AIX. +- IBM provides builds of curl in their Yum repository for PASE software. +- To build from source, follow the Unix instructions. + +There are some additional limitations and quirks with curl on this platform; +they affect both environments. + +## Multi-threading notes + +By default, jobs in IBM i does not start with threading enabled. (Exceptions +include interactive PASE sessions started by `QP2TERM` or SSH.) If you use +curl in an environment without threading when options like asynchronous DNS +were enabled, you get messages like: + +``` +getaddrinfo() thread failed to start +``` + +Do not panic. curl and your program are not broken. You can fix this by: + +- Set the environment variable `QIBM_MULTI_THREADED` to `Y` before starting + your program. This can be done at whatever scope you feel is appropriate. +- Alternatively, start the job with the `ALWMLTTHD` parameter set to `*YES`. + +# Cross compile + +Download and unpack the curl package. + +`cd` to the new directory. (e.g. `cd curl-7.12.3`) + +Set environment variables to point to the cross-compile toolchain and call +configure with any options you need. Be sure and specify the `--host` and +`--build` parameters at configuration time. The following script is an example +of cross-compiling for the IBM 405GP PowerPC processor using the toolchain on +Linux. + +```bash +#! /bin/sh + +export PATH=$PATH:/opt/hardhat/devkit/ppc/405/bin +export CPPFLAGS="-I/opt/hardhat/devkit/ppc/405/target/usr/include" +export AR=ppc_405-ar +export AS=ppc_405-as +export LD=ppc_405-ld +export RANLIB=ppc_405-ranlib +export CC=ppc_405-gcc +export NM=ppc_405-nm + +./configure --target=powerpc-hardhat-linux + --host=powerpc-hardhat-linux + --build=i586-pc-linux-gnu + --prefix=/opt/hardhat/devkit/ppc/405/target/usr/local + --exec-prefix=/usr/local +``` + +The `--prefix` parameter specifies where curl gets installed. If `configure` +completes successfully, do `make` and `make install` as usual. + +In some cases, you may be able to simplify the above commands to as little as: + + ./configure --host=ARCH-OS + +# REDUCING SIZE + +There are a number of configure options that can be used to reduce the size of +libcurl for embedded applications where binary size is an important factor. +First, be sure to set the `CFLAGS` variable when configuring with any relevant +compiler optimization flags to reduce the size of the binary. For gcc, this +would mean at minimum the `-Os` option, and others like the following that +may be relevant in some environments: `-march=X`, `-mthumb`, `-m32`, +`-mdynamic-no-pic`, `-flto`, `-fdata-sections`, `-ffunction-sections`, +`-fno-unwind-tables`, `-fno-asynchronous-unwind-tables`, +`-fno-record-gcc-switches`, `-fsection-anchors`, `-fno-plt`, +`-Wl,--gc-sections`, `-Wl,-Bsymbolic`, `-Wl,-s`, + +For example, this is how to combine a few of these options: + + ./configure CC=gcc CFLAGS='-Os -ffunction-sections' LDFLAGS='-Wl,--gc-sections'... + +Note that newer compilers often produce smaller code than older versions +due to improved optimization. + +Be sure to specify as many `--disable-` and `--without-` flags on the +configure command-line as you can to disable all the libcurl features that you +know your application is not going to need. Besides specifying the +`--disable-PROTOCOL` flags for all the types of URLs your application do not +use, here are some other flags that can reduce the size of the library by +disabling support for some features (run `./configure --help` to see them all): + + - `--disable-aws` (cryptographic authentication) + - `--disable-basic-auth` (cryptographic authentication) + - `--disable-bearer-auth` (cryptographic authentication) + - `--disable-digest-auth` (cryptographic authentication) + - `--disable-http-auth` (all HTTP authentication) + - `--disable-kerberos-auth` (cryptographic authentication) + - `--disable-negotiate-auth` (cryptographic authentication) + - `--disable-ntlm` (NTLM authentication) + - `--disable-alt-svc` (HTTP Alt-Svc) + - `--disable-ares` (the C-ARES DNS library) + - `--disable-cookies` (HTTP cookies) + - `--disable-dateparse` (date parsing for time conditionals) + - `--disable-dnsshuffle` (internal server load spreading) + - `--disable-doh` (DNS-over-HTTP) + - `--disable-form-api` (POST form API) + - `--disable-get-easy-options` (lookup easy options at runtime) + - `--disable-headers-api` (API to access headers) + - `--disable-hsts` (HTTP Strict Transport Security) + - `--disable-ipv6` (IPv6) + - `--disable-libcurl-option` (--libcurl C code generation support) + - `--disable-manual` (--manual built-in documentation) + - `--disable-mime` (MIME API) + - `--disable-netrc` (.netrc file) + - `--disable-progress-meter` (graphical progress meter in library) + - `--disable-proxy` (HTTP and SOCKS proxies) + - `--disable-socketpair` (socketpair for asynchronous name resolving) + - `--disable-threaded-resolver` (threaded name resolver) + - `--disable-tls-srp` (Secure Remote Password authentication for TLS) + - `--disable-unix-sockets` (Unix sockets) + - `--disable-verbose` (eliminates debugging strings and error code strings) + - `--disable-versioned-symbols` (versioned symbols) + - `--enable-symbol-hiding` (eliminates unneeded symbols in the shared library) + - `--without-brotli` (Brotli on-the-fly decompression) + - `--without-libpsl` (Public Suffix List in cookies) + - `--without-nghttp2` (HTTP/2 using nghttp2) + - `--without-ngtcp2` (HTTP/2 using ngtcp2) + - `--without-zstd` (Zstd on-the-fly decompression) + - `--without-libidn2` (internationalized domain names) + - `--without-librtmp` (RTMP) + - `--without-ssl` (SSL/TLS) + - `--without-zlib` (gzip/deflate on-the-fly decompression) + +Be sure also to strip debugging symbols from your binaries after compiling +using 'strip' or an option like `-s`. If space is really tight, you may be able +to gain a few bytes by removing some unneeded sections of the shared library +using the -R option to objcopy (e.g. the .comment section). + +Using these techniques it is possible to create a basic HTTP-only libcurl +shared library for i386 Linux platforms that is only 137 KiB in size +(as of libcurl version 8.13.0, using gcc 14.2.0). + +You may find that statically linking libcurl to your application results in a +lower total size than dynamically linking. + +The curl test harness can detect the use of some, but not all, of the +`--disable` statements suggested above. Use of these can cause tests relying +on those features to fail. The test harness can be manually forced to skip the +relevant tests by specifying certain key words on the `runtests.pl` command +line. Following is a list of appropriate key words for those configure options +that are not automatically detected: + + - `--disable-cookies` !cookies + - `--disable-dateparse` !RETRY-AFTER !`CURLOPT_TIMECONDITION` !`CURLINFO_FILETIME` !`If-Modified-Since` !`curl_getdate` !`-z` + - `--disable-libcurl-option` !`--libcurl` + - `--disable-verbose` !verbose\ logs + +# Ports + +This is a probably incomplete list of known CPU architectures and operating +systems that curl has been compiled for. If you know a system curl compiles +and runs on, that is not listed, please let us know. + +## 104 Operating Systems + + AIX, AmigaOS, Android, ArcoOS, Aros, Atari FreeMiNT, BeOS, Blackberry + 10, Blackberry Tablet OS, Cell OS, CheriBSD, Chrome OS, Cisco IOS, + DG/UX, DR DOS, Dragonfly BSD, eCOS, FreeBSD, FreeDOS, FreeRTOS, Fuchsia, + Garmin OS, Genode, Haiku, HardenedBSD, HP-UX, Hurd, IBM I, illumos, + Integrity, iOS, ipadOS, IRIX, Linux, Lua RTOS, Mac OS 9, macOS, Maemo, + Mbed, Meego, Micrium, MINIX, Minoca, Moblin, MorphOS, MPE/iX, MS-DOS, + NCR MP-RAS, NetBSD, Netware, NextStep, Nintendo 3DS Nintendo Switch, + NonStop OS, NuttX, OpenBSD, OpenStep, Orbis OS, OS/2, OS21, Plan 9, + PlayStation Portable, QNX, Qubes OS, ReactOS, Redox, RISC OS, ROS, + RTEMS, Sailfish OS, SCO Unix, Serenity, SINIX-Z, SkyOS, software, + Solaris, Sortix, SunOS, Syllable OS, Symbian, Tizen, TPF, Tru64, tvOS, + ucLinux, Ultrix, UNICOS, UnixWare, VMS, vxWorks, watchOS, Wear OS, + WebOS, Wii system Wii U, Windows CE, Windows, Xbox System, Xenix, z/OS, + z/TPF, z/VM, z/VSE, Zephyr + +## 28 CPU Architectures + + Alpha, ARC, ARM, AVR32, C-SKY, CompactRISC, Elbrus, ETRAX, HP-PA, Itanium, + LoongArch, m68k, m88k, MicroBlaze, MIPS, Nios, OpenRISC, POWER, PowerPC, + RISC-V, s390, SH4, SPARC, Tilera, VAX, x86, Xtensa, z/arch diff --git a/curl/docs/INSTALL.txt b/curl/docs/INSTALL.txt new file mode 100644 index 0000000..ff260b1 --- /dev/null +++ b/curl/docs/INSTALL.txt @@ -0,0 +1,9 @@ + _ _ ____ _ + ___| | | | _ \| | + / __| | | | |_) | | + | (__| |_| | _ <| |___ + \___|\___/|_| \_\_____| + + How To Compile + +see INSTALL.md diff --git a/curl/docs/INTERNALS.md b/curl/docs/INTERNALS.md new file mode 100644 index 0000000..a0b1adc --- /dev/null +++ b/curl/docs/INTERNALS.md @@ -0,0 +1,63 @@ + + +# curl internals + +The canonical libcurl internals documentation is now in the [everything +curl](https://everything.curl.dev/internals) book. This file lists supported +versions of libs and build tools. + +## Portability + + We write curl and libcurl to compile with C89 compilers on 32-bit and up + machines. Most of libcurl assumes more or less POSIX compliance but that is + not a requirement. + + We write libcurl to build and work with lots of third party tools, and we + want it to remain functional and buildable with these and later versions + (older versions may still work but is not what we work hard to maintain): + +## Dependencies + + We aim to support these or later versions. + + - OpenSSL 1.0.2a + - LibreSSL 2.9.1 + - GnuTLS 3.1.10 + - zlib 1.2.5.2 + - libssh2 1.2.8 + - c-ares 1.6.0 + - libssh 0.9.0 + - libidn2 2.0.0 + - wolfSSL 3.4.6 + - OpenLDAP 2.0 + - MIT Kerberos 1.2.4 + - Heimdal ? + - nghttp2 1.15.0 + - Winsock 2.2 (on Windows 95+ and Windows CE .NET 4.1+) + +## Build tools + + When writing code (mostly for generating stuff included in release tarballs) + we use a few "build tools" and we make sure that we remain functional with + these versions: + + - GNU Libtool 1.4.2 + - GNU Autoconf 2.59 + - GNU Automake 1.7 + - GNU M4 1.4 + - perl 5.8 + - roffit 0.5 + - cmake 3.7 + +Library Symbols +=============== + + All symbols used internally in libcurl must use a `Curl_` prefix if they are + used in more than a single file. Single-file symbols must be made static. + Public ("exported") symbols must use a `curl_` prefix. Public API functions + are marked with `CURL_EXTERN` in the public header files so that all others + can be hidden on platforms where this is possible. diff --git a/curl/docs/IPFS.md b/curl/docs/IPFS.md new file mode 100644 index 0000000..82dae94 --- /dev/null +++ b/curl/docs/IPFS.md @@ -0,0 +1,133 @@ + + +# IPFS +For an overview about IPFS, visit the [IPFS project site](https://ipfs.tech/). + +In IPFS there are two protocols. IPFS and IPNS (their workings are explained in detail [here](https://docs.ipfs.tech/concepts/)). The ideal way to access data on the IPFS network is through those protocols. For example to access the Big Buck Bunny video the ideal way to access it is like: `ipfs://bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi` + +## IPFS Gateways + +IPFS Gateway acts as a bridge between traditional HTTP clients and IPFS. +IPFS Gateway specifications of HTTP semantics can be found [here](https://specs.ipfs.tech/http-gateways/). + +### Deserialized responses + +By default, a gateway acts as a bridge between traditional HTTP clients and IPFS and performs necessary hash verification and deserialization. Through such gateway, users can download files, directories, and other content-addressed data stored with IPFS or IPNS as if they were stored in a traditional web server. + +### Verifiable responses + +By explicitly requesting [application/vnd.ipld.raw](https://www.iana.org/assignments/media-types/application/vnd.ipld.raw) or [application/vnd.ipld.car](https://www.iana.org/assignments/media-types/application/vnd.ipld.car) responses, by means defined in [Trustless Gateway Specification](https://specs.ipfs.tech/http-gateways/trustless-gateway/), the user is able to fetch raw content-addressed data and [perform hash verification themselves](https://docs.ipfs.tech/reference/http/gateway/#trustless-verifiable-retrieval). + +This enables users to use untrusted, public gateways without worrying they might return invalid/malicious bytes. + +## IPFS and IPNS protocol handling + +There are various ways to access data from the IPFS network. One such way is +through the concept of public +"[gateways](https://docs.ipfs.tech/concepts/ipfs-gateway/#overview)". The +short version is that entities can offer gateway services. An example here +that is hosted by Protocol Labs (who also makes IPFS) is `dweb.link` and +`ipfs.io`. Both sites expose gateway functionality. Getting a file through +`ipfs.io` looks like this: +`https://ipfs.io/ipfs/bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi` + +If you were to be [running your own IPFS +node](https://docs.ipfs.tech/how-to/command-line-quick-start/) then you, by +default, also have a [local gateway](https://specs.ipfs.tech/http-gateways/) +running. In its default configuration the earlier example would then also work +in this link: + +`http://127.0.0.1:8080/ipfs/bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi` + +## cURL handling of the IPFS protocols + +The IPFS integration in cURL hides this gateway logic for you. Instead of +providing a full URL to a file on IPFS like this: + +``` +curl http://127.0.0.1:8080/ipfs/bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi +``` + +You can provide it with the IPFS protocol instead: +``` +curl ipfs://bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi +``` + +With the IPFS protocol way of asking a file, cURL still needs to know the +gateway. curl essentially just rewrites the IPFS based URL to a gateway URL. + +### IPFS_GATEWAY environment variable + +If the `IPFS_GATEWAY` environment variable is found, its value is used as +gateway. + +### Automatic gateway detection + +When you provide no additional details to cURL then it: + +1. First looks for the `IPFS_GATEWAY` environment variable and use that if it + is set. +2. Looks for the file: `~/.ipfs/gateway`. If it can find that file then it + means that you have a local gateway running and that file contains the URL + to your local gateway. + +If cURL fails, you are presented with an error message and a link to this page +to the option most applicable to solving the issue. + +### `--ipfs-gateway` argument + +You can also provide a `--ipfs-gateway` argument to cURL. This overrules any +other gateway setting. curl does not fallback to the other options if the +provided gateway did not work. + +## Gateway redirects + +A gateway could redirect to another place. For example, `dweb.link` redirects +[path based](https://docs.ipfs.tech/how-to/address-ipfs-on-web/#path-gateway) +requests to [subdomain +based](https://docs.ipfs.tech/how-to/address-ipfs-on-web/#subdomain-gateway) +ones. A request using: + + curl ipfs://bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi --ipfs-gateway https://dweb.link + +Which would be translated to: + + https://dweb.link/ipfs/bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi + +redirects to: + + https://bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi.ipfs.dweb.link + +If you trust this behavior from your gateway of choice then passing the `-L` +option follows the redirect. + +## Error messages and hints + +Depending on the arguments, cURL could present the user with an error. + +### Gateway file and environment variable + +cURL tried to look for the file: `~/.ipfs/gateway` but could not find it. It +also tried to look for the `IPFS_GATEWAY` environment variable but could not +find that either. This happens when no extra arguments are passed to cURL and +letting it try to figure it out [automatically](#automatic-gateway-detection). + +Any IPFS implementation that has gateway support should expose its URL in +`~/.ipfs/gateway`. If you are already running a gateway, make sure it exposes +the file where cURL expects to find it. + +Alternatively you could set the `IPFS_GATEWAY` environment variable or pass +the `--ipfs-gateway` flag to the cURL command. + +### Malformed gateway URL + +The command executed evaluates in an invalid URL. This could be anywhere in +the URL, but a likely point is a wrong gateway URL. + +Inspect the URL set via the `IPFS_GATEWAY` environment variable or passed with +the `--ipfs-gateway` flag. Alternatively opt to go for the +[automatic](#automatic-gateway-detection) gateway detection. diff --git a/curl/docs/KNOWN_BUGS.txt b/curl/docs/KNOWN_BUGS.txt new file mode 100644 index 0000000..7ed5ee3 --- /dev/null +++ b/curl/docs/KNOWN_BUGS.txt @@ -0,0 +1,661 @@ + _ _ ____ _ + ___| | | | _ \| | + / __| | | | |_) | | + | (__| |_| | _ <| |___ + \___|\___/|_| \_\_____| + + Known Bugs + +These are problems and bugs known to exist at the time of this release. Feel +free to join in and help us correct one or more of these. Also be sure to +check the changelog of the current development status, as one or more of these +problems may have been fixed or changed somewhat since this was written. + + 1. HTTP + + 2. TLS + 2.1 IMAPS connection fails with Rustls error + 2.3 Unable to use PKCS12 certificate with Secure Transport + 2.4 Secure Transport does not import PKCS#12 client certificates without a password + 2.7 Client cert (MTLS) issues with Schannel + 2.11 Schannel TLS 1.2 handshake bug in old Windows versions + 2.13 CURLOPT_CERTINFO results in CURLE_OUT_OF_MEMORY with Schannel + 2.14 mbedTLS and CURLE_AGAIN handling + + 3. Email protocols + 3.1 IMAP SEARCH ALL truncated response + 3.2 No disconnect command + 3.4 AUTH PLAIN for SMTP is not working on all servers + 3.5 APOP authentication fails on POP3 + 3.6 POP3 issue when reading small chunks + + 4. Command line + 4.1 -T /dev/stdin may upload with an incorrect content length + 4.2 -T - always uploads chunked + + 5. Build and portability issues + 5.1 OS400 port requires deprecated IBM library + 5.2 curl-config --libs contains private details + 5.3 LDFLAGS passed too late making libs linked incorrectly + 5.6 Cygwin: make install installs curl-config.1 twice + 5.11 configure --with-gssapi with Heimdal is ignored on macOS + 5.12 flaky CI builds + 5.13 long paths are not fully supported on Windows + 5.15 Unicode on Windows + + 6. Authentication + 6.2 MIT Kerberos for Windows build + 6.3 NTLM in system context uses wrong name + 6.5 NTLM does not support password with Unicode 'SECTION SIGN' character + 6.6 libcurl can fail to try alternatives with --proxy-any + 6.7 Do not clear digest for single realm + 6.8 Heimdal memory leaks + 6.9 SHA-256 digest not supported in Windows SSPI builds + 6.10 curl never completes Negotiate over HTTP + 6.11 Negotiate on Windows fails + 6.12 cannot use Secure Transport with Crypto Token Kit + 6.13 Negotiate against Hadoop HDFS + + 7. FTP + 7.4 FTP with ACCT + 7.12 FTPS directory listing hangs on Windows with Schannel + + 9. SFTP and SCP + 9.1 SFTP does not do CURLOPT_POSTQUOTE correct + 9.2 wolfssh: publickey auth does not work + 9.3 Remote recursive folder creation with SFTP + 9.4 libssh blocking and infinite loop problem + 9.5 Cygwin: "WARNING: UNPROTECTED PRIVATE KEY FILE!" + 9.6 wolfssh: all tests fail + + 10. Connection + 10.1 --interface with link-scoped IPv6 address + + 11. Internals + 11.1 gssapi library name + version is missing in curl_version_info() + 11.2 error buffer not set if connection to multiple addresses fails + 11.3 TFTP tests fail on OpenBSD + 11.4 HTTP test server 'connection-monitor' problems + 11.5 Connection information when using TCP Fast Open + 11.6 test cases sometimes timeout + 11.7 CURLOPT_CONNECT_TO does not work for HTTPS proxy + 11.8 WinIDN test failures + 11.9 setting a disabled option should return CURLE_NOT_BUILT_IN + + 12. LDAP + 12.1 OpenLDAP hangs after returning results + 12.2 LDAP on Windows does authentication wrong? + 12.3 LDAP on Windows does not work + 12.4 LDAPS requests to ActiveDirectory server hang + + 13. TCP/IP + 13.2 Trying local ports fails on Windows + + 15. CMake + 15.1 cmake outputs: no version information available + 15.6 uses -lpthread instead of Threads::Threads + 15.7 generated .pc file contains strange entries + 15.13 CMake build with MIT Kerberos does not work + + 16. aws-sigv4 + 16.2 aws-sigv4 does not handle multipart/form-data correctly + + 17. HTTP/2 + 17.1 HTTP/2 prior knowledge over proxy + 17.2 HTTP/2 frames while in the connection pool kill reuse + 17.3 ENHANCE_YOUR_CALM causes infinite retries + 17.4 HTTP/2 + TLS spends a lot of time in recv + + 18. HTTP/3 + 18.1 connection migration does not work + 18.2 quiche: QUIC connection is draining + + 19. RTSP + 19.1 Some methods do not support response bodies + +============================================================================== + +1. HTTP + +2. TLS + +2.1 IMAPS connection fails with Rustls error + + https://github.com/curl/curl/issues/10457 + +2.3 Unable to use PKCS12 certificate with Secure Transport + + See https://github.com/curl/curl/issues/5403 + +2.4 Secure Transport does not import PKCS#12 client certificates without a password + + libcurl calls SecPKCS12Import with the PKCS#12 client certificate, but that + function rejects certificates that do not have a password. + https://github.com/curl/curl/issues/1308 + +2.7 Client cert (MTLS) issues with Schannel + + See https://github.com/curl/curl/issues/3145 + +2.11 Schannel TLS 1.2 handshake bug in old Windows versions + + In old versions of Windows such as 7 and 8.1 the Schannel TLS 1.2 handshake + implementation likely has a bug that can rarely cause the key exchange to + fail, resulting in error SEC_E_BUFFER_TOO_SMALL or SEC_E_MESSAGE_ALTERED. + + https://github.com/curl/curl/issues/5488 + +2.13 CURLOPT_CERTINFO results in CURLE_OUT_OF_MEMORY with Schannel + + https://github.com/curl/curl/issues/8741 + +2.14 mbedTLS and CURLE_AGAIN handling + + https://github.com/curl/curl/issues/15801 + +3. Email protocols + +3.1 IMAP SEARCH ALL truncated response + + IMAP "SEARCH ALL" truncates output on large boxes. "A quick search of the + code reveals that pingpong.c contains some truncation code, at line 408, when + it deems the server response to be too large truncating it to 40 characters" + https://curl.se/bug/view.cgi?id=1366 + +3.2 No disconnect command + + The disconnect commands (LOGOUT and QUIT) may not be sent by IMAP, POP3 and + SMTP if a failure occurs during the authentication phase of a connection. + +3.4 AUTH PLAIN for SMTP is not working on all servers + + Specifying "--login-options AUTH=PLAIN" on the command line does not seem to + work correctly. + + See https://github.com/curl/curl/issues/4080 + +3.5 APOP authentication fails on POP3 + + See https://github.com/curl/curl/issues/10073 + +3.6 POP3 issue when reading small chunks + + CURL_DBG_SOCK_RMAX=4 ./runtests.pl -v 982 + + See https://github.com/curl/curl/issues/12063 + +4. Command line + +4.1 -T /dev/stdin may upload with an incorrect content length + + -T stats the path to figure out its size in bytes to use it as Content-Length + if it is a regular file. + + The problem with that is that, on BSDs and some other UNIXes (not Linux), + open(path) may not give you a file descriptor with a 0 offset from the start + of the file. + + See https://github.com/curl/curl/issues/12177 + +4.2 -T - always uploads chunked + + When the `<` shell operator is used. curl should realise that stdin is a + regular file in this case, and that it can do a non-chunked upload, like it + would do if you used -T file. + + See https://github.com/curl/curl/issues/12171 + +5. Build and portability issues + +5.1 OS400 port requires deprecated IBM library + + curl for OS400 requires QADRT to build, which provides ASCII wrappers for + libc/POSIX functions in the ILE, but IBM no longer supports or even offers + this library to download. + + See https://github.com/curl/curl/issues/5176 + +5.2 curl-config --libs contains private details + + "curl-config --libs" include details set in LDFLAGS when configure is run + that might be needed only for building libcurl. Further, curl-config --cflags + suffers from the same effects with CFLAGS/CPPFLAGS. + +5.3 LDFLAGS passed too late making libs linked incorrectly + + Compiling latest curl on HP-UX and linking against a custom OpenSSL (which is + on the default loader/linker path), fails because the generated Makefile has + LDFLAGS passed on after LIBS. + + See https://github.com/curl/curl/issues/14893 + +5.6 Cygwin: make install installs curl-config.1 twice + + https://github.com/curl/curl/issues/8839 + +5.11 configure --with-gssapi with Heimdal is ignored on macOS + + ... unless you also pass --with-gssapi-libs + + https://github.com/curl/curl/issues/3841 + +5.12 flaky CI builds + + We run many CI builds for each commit and PR on github, and especially a + number of the Windows builds are flaky. This means that we rarely get all CI + builds go green and complete without errors. This is unfortunate as it makes + us sometimes miss actual build problems and it is surprising to newcomers to + the project who (rightfully) do not expect this. + + See https://github.com/curl/curl/issues/6972 + +5.13 long paths are not fully supported on Windows + + curl on Windows cannot access long paths (paths longer than 260 characters). + However, as a workaround, the Windows path prefix \\?\ which disables all + path interpretation may work to allow curl to access the path. For example: + \\?\c:\longpath. + + See https://github.com/curl/curl/issues/8361 + +5.15 Unicode on Windows + + Passing in a Unicode filename with -o: + + https://github.com/curl/curl/issues/11461 + + Passing in Unicode character with -d: + + https://github.com/curl/curl/issues/12231 + + Windows Unicode builds use homedir in current locale + + The Windows Unicode builds of curl use the current locale, but expect Unicode + UTF-8 encoded paths for internal use such as open, access and stat. The + user's home directory is retrieved via curl_getenv in the current locale and + not as UTF-8 encoded Unicode. + + See https://github.com/curl/curl/pull/7252 and + https://github.com/curl/curl/pull/7281 + + Cannot handle Unicode arguments in non-Unicode builds on Windows + + If a URL or filename cannot be encoded using the user's current codepage then + it can only be encoded properly in the Unicode character set. Windows uses + UTF-16 encoding for Unicode and stores it in wide characters, however curl + and libcurl are not equipped for that at the moment except when built with + _UNICODE and UNICODE defined. Except for Cygwin, Windows cannot use UTF-8 as + a locale. + + https://curl.se/bug/?i=345 + https://curl.se/bug/?i=731 + https://curl.se/bug/?i=3747 + + NTLM authentication and Unicode + + NTLM authentication involving Unicode username or password only works + properly if built with UNICODE defined together with the Schannel backend. + The original problem was mentioned in: + https://curl.se/mail/lib-2009-10/0024.html + https://curl.se/bug/view.cgi?id=896 + + The Schannel version verified to work as mentioned in + https://curl.se/mail/lib-2012-07/0073.html + +6. Authentication + +6.2 MIT Kerberos for Windows build + + libcurl fails to build with MIT Kerberos for Windows (KfW) due to KfW's + library header files exporting symbols/macros that should be kept private to + the KfW library. See ticket #5601 at https://krbdev.mit.edu/rt/ + +6.3 NTLM in system context uses wrong name + + NTLM authentication using SSPI (on Windows) when (lib)curl is running in + "system context" makes it use wrong(?) username - at least when compared to + what winhttp does. See https://curl.se/bug/view.cgi?id=535 + +6.5 NTLM does not support password with Unicode 'SECTION SIGN' character + + https://en.wikipedia.org/wiki/Section_sign + https://codepoints.net/U+00A7 SECTION SIGN + https://github.com/curl/curl/issues/2120 + +6.6 libcurl can fail to try alternatives with --proxy-any + + When connecting via a proxy using --proxy-any, a failure to establish an + authentication causes libcurl to abort trying other options if the failed + method has a higher preference than the alternatives. As an example, + --proxy-any against a proxy which advertise Negotiate and NTLM, but which + fails to set up Kerberos authentication does not proceed to try + authentication using NTLM. + + https://github.com/curl/curl/issues/876 + +6.7 Do not clear digest for single realm + + https://github.com/curl/curl/issues/3267 + +6.8 Heimdal memory leaks + + Running test 2077 and 2078 with curl built to do GSS with Heimdal causes + valgrind errors (memory leak). + + https://github.com/curl/curl/issues/14446 + +6.9 SHA-256 digest not supported in Windows SSPI builds + + Windows builds of curl that have SSPI enabled use the native Windows API calls + to create authentication strings. The call to InitializeSecurityContext fails + with SEC_E_QOP_NOT_SUPPORTED which causes curl to fail with CURLE_AUTH_ERROR. + + Microsoft does not document supported digest algorithms and that SEC_E error + code is not a documented error for InitializeSecurityContext (digest). + + https://github.com/curl/curl/issues/6302 + +6.10 curl never completes Negotiate over HTTP + + Apparently it is not working correctly...? + + See https://github.com/curl/curl/issues/5235 + +6.11 Negotiate on Windows fails + + When using --negotiate (or NTLM) with curl on Windows, SSL/TLS handshake + fails despite having a valid kerberos ticket cached. Works without any issue + in Unix/Linux. + + https://github.com/curl/curl/issues/5881 + +6.12 cannot use Secure Transport with Crypto Token Kit + + https://github.com/curl/curl/issues/7048 + +6.13 Negotiate authentication against Hadoop HDFS + + https://github.com/curl/curl/issues/8264 + +7. FTP + +7.4 FTP with ACCT + + When doing an operation over FTP that requires the ACCT command (but not when + logging in), the operation fails since libcurl does not detect this and thus + fails to issue the correct command: https://curl.se/bug/view.cgi?id=635 + +7.12 FTPS server compatibility on Windows with Schannel + + FTPS is not widely used with the Schannel TLS backend and so there may be + more bugs compared to other TLS backends such as OpenSSL. In the past users + have reported hanging and failed connections. It is likely some changes to + curl since then fixed the issues. None of the reported issues can be + reproduced any longer. + + If you encounter an issue connecting to your server via FTPS with the latest + curl and Schannel then please search for open issues or file a new issue. + +9. SFTP and SCP + +9.1 SFTP does not do CURLOPT_POSTQUOTE correct + + When libcurl sends CURLOPT_POSTQUOTE commands when connected to a SFTP server + using the multi interface, the commands are not being sent correctly and + instead the connection is "cancelled" (the operation is considered done) + prematurely. There is a half-baked (busy-looping) patch provided in the bug + report but it cannot be accepted as-is. See + https://curl.se/bug/view.cgi?id=748 + +9.2 wolfssh: publickey auth does not work + + When building curl to use the wolfSSH backend for SFTP, the publickey + authentication does not work. This is simply functionality not written for curl + yet, the necessary API for make this work is provided by wolfSSH. + + See https://github.com/curl/curl/issues/4820 + +9.3 Remote recursive folder creation with SFTP + + On this servers, the curl fails to create directories on the remote server + even when the CURLOPT_FTP_CREATE_MISSING_DIRS option is set. + + See https://github.com/curl/curl/issues/5204 + +9.4 libssh blocking and infinite loop problem + + In the SSH_SFTP_INIT state for libssh, the ssh session working mode is set to + blocking mode. If the network is suddenly disconnected during sftp + transmission, curl is stuck, even if curl is configured with a timeout. + + https://github.com/curl/curl/issues/8632 + +9.5 Cygwin: "WARNING: UNPROTECTED PRIVATE KEY FILE!" + + Running SCP and SFTP tests on Cygwin makes this warning message appear. + + https://github.com/curl/curl/issues/11244 + +9.6 wolfssh: all tests fail + + Something fundamental stops them all from working properly. + + https://github.com/curl/curl/issues/16794 + +10. Connection + +10.1 --interface with link-scoped IPv6 address + + When you give the `--interface` option telling curl to use a specific + interface for its outgoing traffic in combination with a IPv6 address in the + URL that uses a link-local scope, curl might pick the wrong address from the + named interface and the subsequent transfer fails. + + Example command line: + + curl --interface eth0 'http://[fe80:928d:xxff:fexx:xxxx]/' + + The fact that the given IP address is link-scoped should probably be used as + input to somehow make curl make a better choice for this. + + https://github.com/curl/curl/issues/14782 + +11. Internals + +11.1 gssapi library name + version is missing in curl_version_info() + + The struct needs to be expanded and code added to store this info. + + See https://github.com/curl/curl/issues/13492 + +11.2 error buffer not set if connection to multiple addresses fails + + If you ask libcurl to resolve a hostname like example.com to IPv6 addresses + when you only have IPv4 connectivity. libcurl fails with + CURLE_COULDNT_CONNECT, but the error buffer set by CURLOPT_ERRORBUFFER + remains empty. Issue: https://github.com/curl/curl/issues/544 + +11.3 TFTP tests fail on OpenBSD + + When adding an OpenBSD job with tests to GHA, some tests consistently fail + to run. + + See https://github.com/curl/curl/issues/13623 + +11.4 HTTP test server 'connection-monitor' problems + + The 'connection-monitor' feature of the sws HTTP test server does not work + properly if some tests are run in unexpected order. Like 1509 and then 1525. + + See https://github.com/curl/curl/issues/868 + +11.5 Connection information when using TCP Fast Open + + CURLINFO_LOCAL_PORT (and possibly a few other) fails when TCP Fast Open is + enabled. + + See https://github.com/curl/curl/issues/1332 and + https://github.com/curl/curl/issues/4296 + +11.6 test cases sometimes timeout + + Occasionally, one of the tests timeouts. Inexplicably. + + See https://github.com/curl/curl/issues/13350 + +11.7 CURLOPT_CONNECT_TO does not work for HTTPS proxy + + It is unclear if the same option should even cover the proxy connection or if + if requires a separate option. + + See https://github.com/curl/curl/issues/14481 + +11.8 WinIDN test failures + + Test 165 disabled when built with WinIDN. + +11.9 setting a disabled option should return CURLE_NOT_BUILT_IN + + When curl has been built with specific features or protocols disabled, + setting such options with curl_easy_setopt() should rather return + CURLE_NOT_BUILT_IN instead of CURLE_UNKNOWN_OPTION to signal the difference + to the application + + See https://github.com/curl/curl/issues/15472 + +12. LDAP + +12.1 OpenLDAP hangs after returning results + + By configuration defaults, OpenLDAP automatically chase referrals on + secondary socket descriptors. The OpenLDAP backend is asynchronous and thus + should monitor all socket descriptors involved. Currently, these secondary + descriptors are not monitored, causing OpenLDAP library to never receive + data from them. + + As a temporary workaround, disable referrals chasing by configuration. + + The fix is not easy: proper automatic referrals chasing requires a + synchronous bind callback and monitoring an arbitrary number of socket + descriptors for a single easy handle (currently limited to 5). + + Generic LDAP is synchronous: OK. + + See https://github.com/curl/curl/issues/622 and + https://curl.se/mail/lib-2016-01/0101.html + +12.2 LDAP on Windows does authentication wrong? + + https://github.com/curl/curl/issues/3116 + +12.3 LDAP on Windows does not work + + A simple curl command line getting "ldap://ldap.forumsys.com" returns an + error that says "no memory" ! + + https://github.com/curl/curl/issues/4261 + +12.4 LDAPS requests to ActiveDirectory server hang + + https://github.com/curl/curl/issues/9580 + +13. TCP/IP + +13.2 Trying local ports fails on Windows + + This makes '--local-port [range]' to not work since curl cannot properly + detect if a port is already in use, so it tries the first port, uses that and + then subsequently fails anyway if that was actually in use. + + https://github.com/curl/curl/issues/8112 + +15. CMake + +15.1 cmake outputs: no version information available + + Something in the SONAME generation seems to be wrong in the cmake build. + + https://github.com/curl/curl/issues/11158 + +15.6 uses -lpthread instead of Threads::Threads + + See https://github.com/curl/curl/issues/6166 + +15.7 generated .pc file contains strange entries + + The Libs.private field of the generated .pc file contains -lgcc -lgcc_s -lc + -lgcc -lgcc_s + + See https://github.com/curl/curl/issues/6167 + +15.13 CMake build with MIT Kerberos does not work + + Minimum CMake version was bumped in curl 7.71.0 (#5358) Since CMake 3.2 + try_compile started respecting the CMAKE_EXE_FLAGS. The code dealing with + MIT Kerberos detection sets few variables to potentially weird mix of space, + and ;-separated flags. It had to blow up at some point. All the CMake checks + that involve compilation are doomed from that point, the configured tree + cannot be built. + + https://github.com/curl/curl/issues/6904 + +16. aws-sigv4 + +16.2 aws-sigv4 does not handle multipart/form-data correctly + + https://github.com/curl/curl/issues/13351 + +17. HTTP/2 + +17.1 HTTP/2 prior knowledge over proxy + + https://github.com/curl/curl/issues/12641 + +17.2 HTTP/2 frames while in the connection pool kill reuse + + If the server sends HTTP/2 frames (like for example an HTTP/2 PING frame) to + curl while the connection is held in curl's connection pool, the socket is + found readable when considered for reuse and that makes curl think it is dead + and then it is closed and a new connection gets created instead. + + This is *best* fixed by adding monitoring to connections while they are kept + in the pool so that pings can be responded to appropriately. + +17.3 ENHANCE_YOUR_CALM causes infinite retries + + Infinite retries with 2 parallel requests on one connection receiving GOAWAY + with ENHANCE_YOUR_CALM error code. + + See https://github.com/curl/curl/issues/5119 + +17.4 HTTP/2 + TLS spends a lot of time in recv + + It has been observed that by making the speed limit less accurate we could + improve this performance. (by reverting + https://github.com/curl/curl/commit/db5c9f4f9e0779b49624752b135281a0717b277b) + Can we find a golden middle ground? + + See https://curl.se/mail/lib-2024-05/0026.html and + https://github.com/curl/curl/issues/13416 + +18. HTTP/3 + +18.1 connection migration does not work + + https://github.com/curl/curl/issues/7695 + +18.2 quiche: QUIC connection is draining + + The transfer ends with error "QUIC connection is draining". + + https://github.com/curl/curl/issues/12037 + +19. RTSP + +19.1 Some methods do not support response bodies + + The RTSP implementation is written to assume that a number of RTSP methods + always get responses without bodies, even though there seems to be no + indication in the RFC that this is always the case. + + https://github.com/curl/curl/issues/12414 diff --git a/curl/docs/MAIL-ETIQUETTE.md b/curl/docs/MAIL-ETIQUETTE.md new file mode 100644 index 0000000..3de77b1 --- /dev/null +++ b/curl/docs/MAIL-ETIQUETTE.md @@ -0,0 +1,258 @@ + + +# Mail etiquette + +## About the lists + +### Mailing Lists + +The mailing lists we have are all listed and described on the [curl +website](https://curl.se/mail/). + +Each mailing list is targeted to a specific set of users and subjects, please +use the one or the ones that suit you the most. + +Each mailing list has hundreds up to thousands of readers, meaning that each +mail sent is received and read by a large number of people. People from +various cultures, regions, religions and continents. + +### Netiquette + +Netiquette is a common term for how to behave on the Internet. Of course, in +each particular group and subculture there are differences in what is +acceptable and what is considered good manners. + +This document outlines what we in the curl project consider to be good +etiquette, and primarily this focus on how to behave on and how to use our +mailing lists. + +### Do Not Mail a Single Individual + +Many people send one question to one person. One person gets many mails, and +there is only one person who can give you a reply. The question may be +something that other people would also like to ask. These other people have no +way to read the reply, but to ask the one person the question. The one person +consequently gets overloaded with mail. + +If you really want to contact an individual and perhaps pay for his or her +services, by all means go ahead, but if it is just another curl question, take +it to a suitable list instead. + +### Subscription Required + +All curl mailing lists require that you are subscribed to allow a mail to go +through to all the subscribers. + +If you post without being subscribed (or from a different mail address than +the one you are subscribed with), your mail is simply silently discarded. You +have to subscribe first, then post. + +The reason for this unfortunate and strict subscription policy is of course to +stop spam from pestering the lists. + +### Moderation of new posters + +Several of the curl mailing lists automatically make all posts from new +subscribers be moderated. After you have subscribed and sent your first mail +to a list, that mail is not let through to the list until a mailing list +administrator has verified that it is OK and permits it to get posted. + +Once a first post has been made that proves the sender is actually talking +about curl-related subjects, the moderation "flag" is switched off and future +posts go through without being moderated. + +The reason for this moderation policy is that we do suffer from spammers who +actually subscribe and send spam to our lists. + +### Handling trolls and spam + +Despite our good intentions and hard work to keep spam off the lists and to +maintain a friendly and positive atmosphere, there are times when spam and or +trolls get through. + +Troll - "someone who posts inflammatory, extraneous, or off-topic messages in +an online community" + +Spam - "use of electronic messaging systems to send unsolicited bulk messages" + +No matter what, we NEVER EVER respond to trolls or spammers on the list. If +you believe the list admin should do something in particular, contact them +off-list. The subject is taken care of as much as possible to prevent repeated +offenses, but responding on the list to such messages never leads to anything +good and only puts the light even more on the offender: which was the entire +purpose of it getting sent to the list in the first place. + +Do not feed the trolls. + +### How to unsubscribe + +You can unsubscribe the same way you subscribed in the first place. You go to +the page for the particular mailing list you are subscribed to and you enter +your email address and password and press the unsubscribe button. + +Also, the instructions to unsubscribe are included in the headers of every +mail that is sent out to all curl related mailing lists and there is a footer +in each mail that links to the "admin" page on which you can unsubscribe and +change other options. + +You NEVER EVER email the mailing list requesting someone else to take you off +the list. + +### I posted, now what? + +If you are not subscribed with the same email address that you used to send +the email, your post is silently discarded. + +If you posted for the first time to the mailing list, you first need to wait +for an administrator to allow your email to go through (moderated). This +normally happens quickly but in case we are asleep, you may have to wait a few +hours. + +Once your email goes through it is sent out to several hundred or even +thousands of recipients. Your email may cover an area that not that many +people know about or are interested in. Or possibly the person who knows about +it is on vacation or under a heavy work load right now. You may have to wait +for a response and you should not expect to get a response at all. Ideally, +you get an answer within a couple of days. + +You do yourself and all of us a service when you include as many details as +possible already in your first email. Mention your operating system and +environment. Tell us which curl version you are using and tell us what you +did, what happened and what you expected would happen. Preferably, show us +what you did with details enough to allow others to help point out the problem +or repeat the steps in their locations. + +Failing to include details only delays responses and make people respond and +ask for more details and you have to send follow-up emails that include them. + +Expect the responses to primarily help YOU debug the issue, or ask YOU +questions that can lead you or others towards a solution or explanation to +whatever you experience. + +If you are a repeat offender to the guidelines outlined in this document, +chances are that people ignore you and your chances to get responses in the +future greatly diminish. + +### Your emails are public + +Your email, its contents and all its headers and the details in those headers +are received by every subscriber of the mailing list that you send your email +to. + +Your email as sent to a curl mailing list ends up in mail archives, on the +curl website and elsewhere, for others to see and read. Today and in the +future. In addition to the archives, the mail is sent out to thousands of +individuals. There is no way to undo a sent email. + +When sending emails to a curl mailing list, do not include sensitive +information such as usernames and passwords; use fake ones, temporary ones or +just remove them completely from the mail. Note that this includes base64 +encoded HTTP Basic auth headers. + +This public nature of the curl mailing lists makes automatically inserted mail +footers about mails being "private" or "only meant for the recipient" or +similar even more silly than usual. Because they are absolutely not private +when sent to a public mailing list. + +## Sending mail + +### Reply or New Mail + +Please do not reply to an existing message as a short-cut to post a message to +the lists. + +Many mail programs and web archivers use information within mails to keep them +together as "threads", as collections of posts that discuss a certain subject. +If you do not intend to reply on the same or similar subject, do not just hit +reply on an existing mail and change the subject, create a new mail. + +### Reply to the List + +When replying to a message from the list, make sure that you do "group reply" +or "reply to all", and not just reply to the author of the single mail you +reply to. + +We are actively discouraging replying to the single person by setting the +correct field in outgoing mails back asking for replies to get sent to the +mailing list address, making it harder for people to reply to the author only +by mistake. + +### Use a Sensible Subject + +Please use a subject of the mail that makes sense and that is related to the +contents of your mail. It makes it a lot easier to find your mail afterwards +and it makes it easier to track mail threads and topics. + +### Do Not Top-Post + +If you reply to a message, do not use top-posting. Top-posting is when you +write the new text at the top of a mail and you insert the previous quoted +mail conversation below. It forces users to read the mail in a backwards order +to properly understand it. + +This is why top posting is so bad (in top posting order): + + A: Because it messes up the order in which people normally read text. + Q: Why is top-posting such a bad thing? + A: Top-posting. + Q: What is the most annoying thing in email? + +Apart from the screwed up read order (especially when mixed together in a +thread when someone responds using the mandated bottom-posting style), it also +makes it impossible to quote only parts of the original mail. + +When you reply to a mail. You let the mail client insert the previous mail +quoted. Then you put the cursor on the first line of the mail and you move +down through the mail, deleting all parts of the quotes that do not add +context for your comments. When you want to add a comment you do so, inline, +right after the quotes that relate to your comment. Then you continue +downwards again. + +When most of the quotes have been removed and you have added your own words, +you are done. + +### HTML is not for mails + +Please switch off those HTML encoded messages. You can mail all those funny +mails to your friends. We speak plain text mails. + +### Quoting + +Quote as little as possible. Just enough to provide the context you cannot +eave out. A lengthy description can be found +[here](https://www.netmeister.org/news/learn2quote.html). + +### Digest + +We allow subscribers to subscribe to the "digest" version of the mailing +lists. A digest is a collection of mails lumped together in one single mail. + +Should you decide to reply to a mail sent out as a digest, there are two +things you MUST consider if you really, really cannot subscribe normally +instead: + +Cut off all mails and chatter that is not related to the mail you want to +reply to. + +Change the subject name to something sensible and related to the subject, +preferably even the actual subject of the single mail you wanted to reply to + +### Please Tell Us How You Solved The Problem + +Many people mail questions to the list, people spend some of their time and +make an effort in providing good answers to these questions. + +If you are the one who asks, please consider responding once more in case one +of the hints was what solved your problems. The guys who write answers feel +good to know that they provided a good answer and that you fixed the problem. +Far too often, the person who asked the question is never heard from again, +and we never get to know if they are gone because the problem was solved or +perhaps because the problem was unsolvable. + +Getting the solution posted also helps other users that experience the same +problem(s). They get to see (possibly in the web archives) that the suggested +fixes actually have helped at least one person. diff --git a/curl/docs/MANUAL.md b/curl/docs/MANUAL.md new file mode 100644 index 0000000..9ff5c09 --- /dev/null +++ b/curl/docs/MANUAL.md @@ -0,0 +1,1008 @@ + + +# curl tutorial + +## Simple Usage + +Get the main page from a web-server: + + curl https://www.example.com/ + +Get a README file from an FTP server: + + curl ftp://ftp.example.com/README + +Get a webpage from a server using port 8000: + + curl http://www.example.com:8000/ + +Get a directory listing of an FTP site: + + curl ftp://ftp.example.com/ + +Get the all terms matching curl from a dictionary: + + curl dict://dict.example.com/m:curl + +Get the definition of curl from a dictionary: + + curl dict://dict.example.com/d:curl + +Fetch two documents at once: + + curl ftp://ftp.example.com/ http://www.example.com:8000/ + +Get a file off an FTPS server: + + curl ftps://files.are.example.com/secrets.txt + +or use the more appropriate FTPS way to get the same file: + + curl --ssl-reqd ftp://files.are.example.com/secrets.txt + +Get a file from an SSH server using SFTP: + + curl -u username sftp://example.com/etc/issue + +Get a file from an SSH server using SCP using a private key (not +password-protected) to authenticate: + + curl -u username: --key ~/.ssh/id_rsa scp://example.com/~/file.txt + +Get a file from an SSH server using SCP using a private key +(password-protected) to authenticate: + + curl -u username: --key ~/.ssh/id_rsa --pass private_key_password + scp://example.com/~/file.txt + +Get the main page from an IPv6 web server: + + curl "http://[2001:1890:1112:1::20]/" + +Get a file from an SMB server: + + curl -u "domain\username:passwd" smb://server.example.com/share/file.txt + +## Download to a File + +Get a webpage and store in a local file with a specific name: + + curl -o thatpage.html http://www.example.com/ + +Get a webpage and store in a local file, make the local file get the name of +the remote document (if no filename part is specified in the URL, this fails): + + curl -O http://www.example.com/index.html + +Fetch two files and store them with their remote names: + + curl -O www.haxx.se/index.html -O curl.se/download.html + +## Using Passwords + +### FTP + +To ftp files using name and password, include them in the URL like: + + curl ftp://name:passwd@ftp.server.example:port/full/path/to/file + +or specify them with the `-u` flag like + + curl -u name:passwd ftp://ftp.server.example:port/full/path/to/file + +### FTPS + +It is just like for FTP, but you may also want to specify and use SSL-specific +options for certificates etc. + +Note that using `FTPS://` as prefix is the *implicit* way as described in the +standards while the recommended *explicit* way is done by using `FTP://` and +the `--ssl-reqd` option. + +### SFTP / SCP + +This is similar to FTP, but you can use the `--key` option to specify a +private key to use instead of a password. Note that the private key may itself +be protected by a password that is unrelated to the login password of the +remote system; this password is specified using the `--pass` option. +Typically, curl automatically extracts the public key from the private key +file, but in cases where curl does not have the proper library support, a +matching public key file must be specified using the `--pubkey` option. + +### HTTP + +curl also supports user and password in HTTP URLs, thus you can pick a file +like: + + curl http://name:passwd@http.server.example/full/path/to/file + +or specify user and password separately like in + + curl -u name:passwd http://http.server.example/full/path/to/file + +HTTP offers many different methods of authentication and curl supports +several: Basic, Digest, NTLM and Negotiate (SPNEGO). Without telling which +method to use, curl defaults to Basic. You can also ask curl to pick the most +secure ones out of the ones that the server accepts for the given URL, by +using `--anyauth`. + +**Note**! According to the URL specification, HTTP URLs can not contain a user +and password, so that style does not work when using curl via a proxy, even +though curl allows it at other times. When using a proxy, you _must_ use the +`-u` style for user and password. + +### HTTPS + +Probably most commonly used with private certificates, as explained below. + +## Proxy + +curl supports both HTTP and SOCKS proxy servers, with optional authentication. +It does not have special support for FTP proxy servers since there are no +standards for those, but it can still be made to work with many of them. You +can also use both HTTP and SOCKS proxies to transfer files to and from FTP +servers. + +Get an ftp file using an HTTP proxy named my-proxy that uses port 888: + + curl -x my-proxy:888 ftp://ftp.example.com/README + +Get a file from an HTTP server that requires user and password, using the +same proxy as above: + + curl -u user:passwd -x my-proxy:888 http://www.example.com/ + +Some proxies require special authentication. Specify by using -U as above: + + curl -U user:passwd -x my-proxy:888 http://www.example.com/ + +A comma-separated list of hosts and domains which do not use the proxy can be +specified as: + + curl --noproxy example.com -x my-proxy:888 http://www.example.com/ + +If the proxy is specified with `--proxy1.0` instead of `--proxy` or `-x`, then +curl uses HTTP/1.0 instead of HTTP/1.1 for any `CONNECT` attempts. + +curl also supports SOCKS4 and SOCKS5 proxies with `--socks4` and `--socks5`. + +See also the environment variables curl supports that offer further proxy +control. + +Most FTP proxy servers are set up to appear as a normal FTP server from the +client's perspective, with special commands to select the remote FTP server. +curl supports the `-u`, `-Q` and `--ftp-account` options that can be used to +set up transfers through many FTP proxies. For example, a file can be uploaded +to a remote FTP server using a Blue Coat FTP proxy with the options: + + curl -u "username@ftp.server.example Proxy-Username:Remote-Pass" + --ftp-account Proxy-Password --upload-file local-file + ftp://my-ftp.proxy.example:21/remote/upload/path/ + +See the manual for your FTP proxy to determine the form it expects to set up +transfers, and curl's `-v` option to see exactly what curl is sending. + +## Piping + +Get a key file and add it with `apt-key` (when on a system that uses `apt` for +package management): + + curl -L https://apt.example.org/llvm-snapshot.gpg.key | sudo apt-key add - + +The '|' pipes the output to STDIN. `-` tells `apt-key` that the key file +should be read from STDIN. + +## Ranges + +HTTP 1.1 introduced byte-ranges. Using this, a client can request to get only +one or more sub-parts of a specified document. curl supports this with the +`-r` flag. + +Get the first 100 bytes of a document: + + curl -r 0-99 http://www.example.com/ + +Get the last 500 bytes of a document: + + curl -r -500 http://www.example.com/ + +curl also supports simple ranges for FTP files as well. Then you can only +specify start and stop position. + +Get the first 100 bytes of a document using FTP: + + curl -r 0-99 ftp://www.example.com/README + +## Uploading + +### FTP / FTPS / SFTP / SCP + +Upload all data on stdin to a specified server: + + curl -T - ftp://ftp.example.com/myfile + +Upload data from a specified file, login with user and password: + + curl -T uploadfile -u user:passwd ftp://ftp.example.com/myfile + +Upload a local file to the remote site, and use the local filename at the +remote site too: + + curl -T uploadfile -u user:passwd ftp://ftp.example.com/ + +Upload a local file to get appended to the remote file: + + curl -T localfile -a ftp://ftp.example.com/remotefile + +curl also supports ftp upload through a proxy, but only if the proxy is +configured to allow that kind of tunneling. If it does, you can run curl in a +fashion similar to: + + curl --proxytunnel -x proxy:port -T localfile ftp.example.com + +### SMB / SMBS + + curl -T file.txt -u "domain\username:passwd" + smb://server.example.com/share/ + +### HTTP + +Upload all data on stdin to a specified HTTP site: + + curl -T - http://www.example.com/myfile + +Note that the HTTP server must have been configured to accept PUT before this +can be done successfully. + +For other ways to do HTTP data upload, see the POST section below. + +## Verbose / Debug + +If curl fails where it is not supposed to, if the servers do not let you in, +if you cannot understand the responses: use the `-v` flag to get verbose +fetching. curl outputs lots of info and what it sends and receives in order to +let the user see all client-server interaction (but it does not show you the +actual data). + + curl -v ftp://ftp.example.com/ + +To get even more details and information on what curl does, try using the +`--trace` or `--trace-ascii` options with a given filename to log to, like +this: + + curl --trace my-trace.txt www.haxx.se + + +## Detailed Information + +Different protocols provide different ways of getting detailed information +about specific files/documents. To get curl to show detailed information about +a single file, you should use `-I`/`--head` option. It displays all available +info on a single file for HTTP and FTP. The HTTP information is a lot more +extensive. + +For HTTP, you can get the header information (the same as `-I` would show) +shown before the data by using `-i`/`--include`. curl understands the +`-D`/`--dump-header` option when getting files from both FTP and HTTP, and it +then stores the headers in the specified file. + +Store the HTTP headers in a separate file (headers.txt in the example): + + curl --dump-header headers.txt curl.se + +Note that headers stored in a separate file can be useful at a later time if +you want curl to use cookies sent by the server. More about that in the +cookies section. + +## POST (HTTP) + +It is easy to post data using curl. This is done using the `-d ` option. +The post data must be urlencoded. + +Post a simple `name` and `phone` guestbook. + + curl -d "name=Rafael%20Sagula&phone=3320780" http://www.example.com/guest.cgi + +Or automatically [URL encode the data](https://everything.curl.dev/http/post/url-encode). + + curl --data-urlencode "name=Rafael Sagula&phone=3320780" + http://www.example.com/guest.cgi + +How to post a form with curl, lesson #1: + +Dig out all the `` tags in the form that you want to fill in. + +If there is a normal post, you use `-d` to post. `-d` takes a full post +string, which is in the format + + =&=&... + +The variable names are the names set with `"name="` in the `` tags, and +the data is the contents you want to fill in for the inputs. The data *must* +be properly URL encoded. That means you replace space with + and that you +replace weird letters with `%XX` where `XX` is the hexadecimal representation +of the letter's ASCII code. + +Example: + +(say if `http://example.com` had the following html) + +```html +
+ + + + +
+``` + +We want to enter user `foobar` with password `12345`. + +To post to this, you would enter a curl command line like: + + curl -d "user=foobar&pass=12345&id=blablabla&ding=submit" + http://example.com/post.cgi + +While `-d` uses the application/x-www-form-urlencoded mime-type, generally +understood by CGI's and similar, curl also supports the more capable +multipart/form-data type. This latter type supports things like file upload. + +`-F` accepts parameters like `-F "name=contents"`. If you want the contents to +be read from a file, use `@filename` as contents. When specifying a file, you +can also specify the file content type by appending `;type=` to the +filename. You can also post the contents of several files in one field. For +example, the field name `coolfiles` is used to send three files, with +different content types using the following syntax: + + curl -F "coolfiles=@fil1.gif;type=image/gif,fil2.txt,fil3.html" + http://www.example.com/postit.cgi + +If the content-type is not specified, curl tries to guess from the file +extension (it only knows a few), or use the previously specified type (from an +earlier file if several files are specified in a list) or else it uses the +default type `application/octet-stream`. + +Emulate a fill-in form with `-F`. Let's say you fill in three fields in a +form. One field is a filename which to post, one field is your name and one +field is a file description. We want to post the file we have written named +`cooltext.txt`. To let curl do the posting of this data instead of your +favorite browser, you have to read the HTML source of the form page and find +the names of the input fields. In our example, the input field names are +`file`, `yourname` and `filedescription`. + + curl -F "file=@cooltext.txt" -F "yourname=Daniel" + -F "filedescription=Cool text file with cool text inside" + http://www.example.com/postit.cgi + +To send two files in one post you can do it in two ways: + +Send multiple files in a single field with a single field name: + + curl -F "pictures=@dog.gif,cat.gif" $URL + +Send two fields with two field names + + curl -F "docpicture=@dog.gif" -F "catpicture=@cat.gif" $URL + +To send a field value literally without interpreting a leading `@` or `<`, or +an embedded `;type=`, use `--form-string` instead of `-F`. This is recommended +when the value is obtained from a user or some other unpredictable +source. Under these circumstances, using `-F` instead of `--form-string` could +allow a user to trick curl into uploading a file. + +## Referrer + +An HTTP request has the option to include information about which address +referred it to the actual page. curl allows you to specify the referrer to be +used on the command line. It is especially useful to fool or trick stupid +servers or CGI scripts that rely on that information being available or +contain certain data. + + curl -e www.example.org http://www.example.com/ + +## User Agent + +An HTTP request has the option to include information about the browser that +generated the request. curl allows it to be specified on the command line. It +is especially useful to fool or trick stupid servers or CGI scripts that only +accept certain browsers. + +Example: + + curl -A 'Mozilla/3.0 (Win95; I)' http://www.bank.example.com/ + +Other common strings: + +- `Mozilla/3.0 (Win95; I)` - Netscape Version 3 for Windows 95 +- `Mozilla/3.04 (Win95; U)` - Netscape Version 3 for Windows 95 +- `Mozilla/2.02 (OS/2; U)` - Netscape Version 2 for OS/2 +- `Mozilla/4.04 [en] (X11; U; AIX 4.2; Nav)` - Netscape for AIX +- `Mozilla/4.05 [en] (X11; U; Linux 2.0.32 i586)` - Netscape for Linux + +Note that Internet Explorer tries hard to be compatible in every way: + +- `Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)` - MSIE for W95 + +Mozilla is not the only possible User-Agent name: + +- `Konqueror/1.0` - KDE File Manager desktop client +- `Lynx/2.7.1 libwww-FM/2.14` - Lynx command line browser + +## Cookies + +Cookies are generally used by web servers to keep state information at the +client's side. The server sets cookies by sending a response line in the +headers that looks like `Set-Cookie: ` where the data part then +typically contains a set of `NAME=VALUE` pairs (separated by semicolons `;` +like `NAME1=VALUE1; NAME2=VALUE2;`). The server can also specify for what path +the cookie should be used for (by specifying `path=value`), when the cookie +should expire (`expire=DATE`), for what domain to use it (`domain=NAME`) and +if it should be used on secure connections only (`secure`). + +If you have received a page from a server that contains a header like: + +```http +Set-Cookie: sessionid=boo123; path="/foo"; +``` + +it means the server wants that first pair passed on when we get anything in a +path beginning with `/foo`. + +Example, get a page that wants my name passed in a cookie: + + curl -b "name=Daniel" www.example.com + +curl also has the ability to use previously received cookies in following +sessions. If you get cookies from a server and store them in a file in a +manner similar to: + + curl --dump-header headers www.example.com + +... you can then in a second connect to that (or another) site, use the +cookies from the `headers.txt` file like: + + curl -b headers.txt www.example.com + +While saving headers to a file is a working way to store cookies, it is +however error-prone and not the preferred way to do this. Instead, make curl +save the incoming cookies using the well-known Netscape cookie format like +this: + + curl -c cookies.txt www.example.com + +Note that by specifying `-b` you enable the cookie engine and with `-L` you +can make curl follow a `location:` (which often is used in combination with +cookies). If a site sends cookies and a location field, you can use a +non-existing file to trigger the cookie awareness like: + + curl -L -b empty.txt www.example.com + +The file to read cookies from must be formatted using plain HTTP headers OR as +Netscape's cookie file. curl determines what kind it is based on the file +contents. In the above command, curl parses the header and store the cookies +received from www.example.com. curl sends the stored cookies which match the +request to the server as it follows the location. The file `empty.txt` may be +a nonexistent file. + +To read and write cookies from a Netscape cookie file, you can set both `-b` +and `-c` to use the same file: + + curl -b cookies.txt -c cookies.txt www.example.com + +## Progress Meter + +The progress meter exists to show a user that something actually is +happening. The different fields in the output have the following meaning: + + % Total % Received % Xferd Average Speed Time Curr. + Dload Upload Total Current Left Speed + 0 151M 0 38608 0 0 9406 0 4:41:43 0:00:04 4:41:39 9287 + +From left-to-right: + + - `%` - percentage completed of the whole transfer + - `Total` - total size of the whole expected transfer + - `%` - percentage completed of the download + - `Received` - currently downloaded amount of bytes + - `%` - percentage completed of the upload + - `Xferd` - currently uploaded amount of bytes + - `Average Speed Dload` - the average transfer speed of the download + - `Average Speed Upload` - the average transfer speed of the upload + - `Time Total` - expected time to complete the operation + - `Time Current` - time passed since the invoke + - `Time Left` - expected time left to completion + - `Curr.Speed` - the average transfer speed the last 5 seconds (the first + 5 seconds of a transfer is based on less time of course.) + +The `-#` option displays a totally different progress bar that does not need +much explanation! + +## Speed Limit + +curl allows the user to set the transfer speed conditions that must be met to +let the transfer keep going. By using the switch `-y` and `-Y` you can make +curl abort transfers if the transfer speed is below the specified lowest limit +for a specified time. + +To have curl abort the download if the speed is slower than 3000 bytes per +second for 1 minute, run: + + curl -Y 3000 -y 60 www.far-away.example.com + +This can be used in combination with the overall time limit, so that the above +operation must be completed in whole within 30 minutes: + + curl -m 1800 -Y 3000 -y 60 www.far-away.example.com + +Forcing curl not to transfer data faster than a given rate is also possible, +which might be useful if you are using a limited bandwidth connection and you +do not want your transfer to use all of it (sometimes referred to as +*bandwidth throttle*). + +Make curl transfer data no faster than 10 kilobytes per second: + + curl --limit-rate 10K www.far-away.example.com + +or + + curl --limit-rate 10240 www.far-away.example.com + +Or prevent curl from uploading data faster than 1 megabyte per second: + + curl -T upload --limit-rate 1M ftp://uploads.example.com + +When using the `--limit-rate` option, the transfer rate is regulated on a +per-second basis, which causes the total transfer speed to become lower than +the given number. Sometimes of course substantially lower, if your transfer +stalls during periods. + +## Config File + +curl automatically tries to read the `.curlrc` file (or `_curlrc` file on +Microsoft Windows systems) from the user's home directory on startup. + +The config file could be made up with normal command line switches, but you +can also specify the long options without the dashes to make it more +readable. You can separate the options and the parameter with spaces, or with +`=` or `:`. Comments can be used within the file. If the first letter on a +line is a `#`-symbol the rest of the line is treated as a comment. + +If you want the parameter to contain spaces, you must enclose the entire +parameter within double quotes (`"`). Within those quotes, you specify a quote +as `\"`. + +NOTE: You must specify options and their arguments on the same line. + +Example, set default time out and proxy in a config file: + + # We want a 30 minute timeout: + -m 1800 + # ... and we use a proxy for all accesses: + proxy = proxy.our.domain.example.com:8080 + +Whitespaces ARE significant at the end of lines, but all whitespace leading +up to the first characters of each line are ignored. + +Prevent curl from reading the default file by using -q as the first command +line parameter, like: + + curl -q www.example.org + +Force curl to get and display a local help page in case it is invoked without +URL by making a config file similar to: + + # default url to get + url = "http://help.with.curl.example.com/curlhelp.html" + +You can specify another config file to be read by using the `-K`/`--config` +flag. If you set config filename to `-` it reads the config from stdin, which +can be handy if you want to hide options from being visible in process tables +etc: + + echo "user = user:passwd" | curl -K - http://that.secret.example.com + +## Extra Headers + +When using curl in your own programs, you may end up needing to pass on your +own custom headers when getting a webpage. You can do this by using the `-H` +flag. + +Example, send the header `X-you-and-me: yes` to the server when getting a +page: + + curl -H "X-you-and-me: yes" love.example.com + +This can also be useful in case you want curl to send a different text in a +header than it normally does. The `-H` header you specify then replaces the +header curl would normally send. If you replace an internal header with an +empty one, you prevent that header from being sent. To prevent the `Host:` +header from being used: + + curl -H "Host:" server.example.com + +## FTP and Path Names + +Do note that when getting files with a `ftp://` URL, the given path is +relative to the directory you enter. To get the file `README` from your home +directory at your ftp site, do: + + curl ftp://user:passwd@my.example.com/README + +If you want the README file from the root directory of that same site, you +need to specify the absolute filename: + + curl ftp://user:passwd@my.example.com//README + +(I.e with an extra slash in front of the filename.) + +## SFTP and SCP and Path Names + +With sftp: and scp: URLs, the path name given is the absolute name on the +server. To access a file relative to the remote user's home directory, prefix +the file with `/~/` , such as: + + curl -u $USER sftp://home.example.com/~/.bashrc + +## FTP and Firewalls + +The FTP protocol requires one of the involved parties to open a second +connection as soon as data is about to get transferred. There are two ways to +do this. + +The default way for curl is to issue the PASV command which causes the server +to open another port and await another connection performed by the +client. This is good if the client is behind a firewall that does not allow +incoming connections. + + curl ftp.example.com + +If the server, for example, is behind a firewall that does not allow +connections on ports other than 21 (or if it just does not support the `PASV` +command), the other way to do it is to use the `PORT` command and instruct the +server to connect to the client on the given IP number and port (as parameters +to the PORT command). + +The `-P` flag to curl supports a few different options. Your machine may have +several IP-addresses and/or network interfaces and curl allows you to select +which of them to use. Default address can also be used: + + curl -P - ftp.example.com + +Download with `PORT` but use the IP address of our `le0` interface (this does +not work on Windows): + + curl -P le0 ftp.example.com + +Download with `PORT` but use 192.168.0.10 as our IP address to use: + + curl -P 192.168.0.10 ftp.example.com + +## Network Interface + +Get a webpage from a server using a specified port for the interface: + + curl --interface eth0:1 http://www.example.com/ + +or + + curl --interface 192.168.1.10 http://www.example.com/ + +## HTTPS + +Secure HTTP requires a TLS library to be installed and used when curl is +built. If that is done, curl is capable of retrieving and posting documents +using the HTTPS protocol. + +Example: + + curl https://secure.example.com + +curl is also capable of using client certificates to get/post files from sites +that require valid certificates. The only drawback is that the certificate +needs to be in PEM-format. PEM is a standard and open format to store +certificates with, but it is not used by the most commonly used browsers. If +you want curl to use the certificates you use with your favorite browser, you +may need to download/compile a converter that can convert your browser's +formatted certificates to PEM formatted ones. + +Example on how to automatically retrieve a document using a certificate with a +personal password: + + curl -E /path/to/cert.pem:password https://secure.example.com/ + +If you neglect to specify the password on the command line, you are prompted +for the correct password before any data can be received. + +Many older HTTPS servers have problems with specific SSL or TLS versions, +which newer versions of OpenSSL etc use, therefore it is sometimes useful to +specify what TLS version curl should use.: + + curl --tlv1.0 https://secure.example.com/ + +Otherwise, curl attempts to use a sensible TLS default version. + +## Resuming File Transfers + +To continue a file transfer where it was previously aborted, curl supports +resume on HTTP(S) downloads as well as FTP uploads and downloads. + +Continue downloading a document: + + curl -C - -o file ftp://ftp.example.com/path/file + +Continue uploading a document: + + curl -C - -T file ftp://ftp.example.com/path/file + +Continue downloading a document from a web server + + curl -C - -o file http://www.example.com/ + +## Time Conditions + +HTTP allows a client to specify a time condition for the document it requests. +It is `If-Modified-Since` or `If-Unmodified-Since`. curl allows you to specify +them with the `-z`/`--time-cond` flag. + +For example, you can easily make a download that only gets performed if the +remote file is newer than a local copy. It would be made like: + + curl -z local.html http://remote.example.com/remote.html + +Or you can download a file only if the local file is newer than the remote +one. Do this by prepending the date string with a `-`, as in: + + curl -z -local.html http://remote.example.com/remote.html + +You can specify a plain text date as condition. Tell curl to only download the +file if it was updated since January 12, 2012: + + curl -z "Jan 12 2012" http://remote.example.com/remote.html + +curl accepts a wide range of date formats. You always make the date check the +other way around by prepending it with a dash (`-`). + +## DICT + +For fun try + + curl dict://dict.org/m:curl + curl dict://dict.org/d:heisenbug:jargon + curl dict://dict.org/d:daniel:gcide + +Aliases for `m` are `match` and `find`, and aliases for `d` are `define` and +`lookup`. For example, + + curl dict://dict.org/find:curl + +Commands that break the URL description of the RFC (but not the DICT +protocol) are + + curl dict://dict.org/show:db + curl dict://dict.org/show:strat + +Authentication support is still missing + +## LDAP + +If you have installed the OpenLDAP library, curl can take advantage of it and +offer `ldap://` support. On Windows, curl uses WinLDAP from Platform SDK by +default. + +Default protocol version used by curl is LDAP version 3. Version 2 is used as +a fallback mechanism in case version 3 fails to connect. + +LDAP is a complex thing and writing an LDAP query is not an easy +task. Familiarize yourself with the exact syntax description elsewhere. One +such place might be: [RFC 2255, The LDAP URL +Format](https://curl.se/rfc/rfc2255.txt) + +To show you an example, this is how to get all people from an LDAP server that +has a certain subdomain in their email address: + + curl -B "ldap://ldap.example.com/o=frontec??sub?mail=*sth.example.com" + +You also can use authentication when accessing LDAP catalog: + + curl -u user:passwd "ldap://ldap.example.com/o=frontec??sub?mail=*" + curl "ldap://user:passwd@ldap.example.com/o=frontec??sub?mail=*" + +By default, if user and password are provided, OpenLDAP/WinLDAP uses basic +authentication. On Windows you can control this behavior by providing one of +`--basic`, `--ntlm` or `--digest` option in curl command line + + curl --ntlm "ldap://user:passwd@ldap.example.com/o=frontec??sub?mail=*" + +On Windows, if no user/password specified, auto-negotiation mechanism is used +with current logon credentials (SSPI/SPNEGO). + +## Environment Variables + +curl reads and understands the following proxy related environment variables: + + http_proxy, HTTPS_PROXY, FTP_PROXY + +They should be set for protocol-specific proxies. General proxy should be set +with + + ALL_PROXY + +A comma-separated list of hostnames that should not go through any proxy is +set in (only an asterisk, `*` matches all hosts) + + NO_PROXY + +If the hostname matches one of these strings, or the host is within the domain +of one of these strings, transactions with that node is not done over the +proxy. When a domain is used, it needs to start with a period. A user can +specify that both www.example.com and foo.example.com should not use a proxy +by setting `NO_PROXY` to `.example.com`. By including the full name you can +exclude specific hostnames, so to make `www.example.com` not use a proxy but +still have `foo.example.com` do it, set `NO_PROXY` to `www.example.com`. + +The usage of the `-x`/`--proxy` flag overrides the environment variables. + +## Netrc + +Unix introduced the `.netrc` concept a long time ago. It is a way for a user +to specify name and password for commonly visited FTP sites in a file so that +you do not have to type them in each time you visit those sites. You realize +this is a big security risk if someone else gets hold of your passwords, +therefore most Unix programs do not read this file unless it is only readable +by yourself (curl does not care though). + +curl supports `.netrc` files if told to (using the `-n`/`--netrc` and +`--netrc-optional` options). This is not restricted to just FTP, so curl can +use it for all protocols where authentication is used. + +A simple `.netrc` file could look something like: + + machine curl.se login iamdaniel password mysecret + +## Custom Output + +To better allow script programmers to get to know about the progress of curl, +the `-w`/`--write-out` option was introduced. Using this, you can specify what +information from the previous transfer you want to extract. + +To display the amount of bytes downloaded together with some text and an +ending newline: + + curl -w 'We downloaded %{size_download} bytes\n' www.example.com + +## Kerberos FTP Transfer + +curl supports kerberos4 and kerberos5/GSSAPI for FTP transfers. You need the +kerberos package installed and used at curl build time for it to be available. + +First, get the krb-ticket the normal way, like with the `kinit`/`kauth` tool. +Then use curl in way similar to: + + curl --krb private ftp://krb4site.example.com -u username:fakepwd + +There is no use for a password on the `-u` switch, but a blank one makes curl +ask for one and you already entered the real password to `kinit`/`kauth`. + +## TELNET + +The curl telnet support is basic and easy to use. curl passes all data passed +to it on stdin to the remote server. Connect to a remote telnet server using a +command line similar to: + + curl telnet://remote.example.com + +Enter the data to pass to the server on stdin. The result is sent to stdout or +to the file you specify with `-o`. + +You might want the `-N`/`--no-buffer` option to switch off the buffered output +for slow connections or similar. + +Pass options to the telnet protocol negotiation, by using the `-t` option. To +tell the server we use a vt100 terminal, try something like: + + curl -tTTYPE=vt100 telnet://remote.example.com + +Other interesting options for it `-t` include: + + - `XDISPLOC=` Sets the X display location. + - `NEW_ENV=` Sets an environment variable. + +NOTE: The telnet protocol does not specify any way to login with a specified +user and password so curl cannot do that automatically. To do that, you need to +track when the login prompt is received and send the username and password +accordingly. + +## Persistent Connections + +Specifying multiple files on a single command line makes curl transfer all of +them, one after the other in the specified order. + +libcurl attempts to use persistent connections for the transfers so that the +second transfer to the same host can use the same connection that was already +initiated and was left open in the previous transfer. This greatly decreases +connection time for all but the first transfer and it makes a far better use +of the network. + +Note that curl cannot use persistent connections for transfers that are used +in subsequent curl invokes. Try to stuff as many URLs as possible on the same +command line if they are using the same host, as that makes the transfers +faster. If you use an HTTP proxy for file transfers, practically all transfers +are persistent. + +## Multiple Transfers With A Single Command Line + +As is mentioned above, you can download multiple files with one command line +by simply adding more URLs. If you want those to get saved to a local file +instead of just printed to stdout, you need to add one save option for each +URL you specify. Note that this also goes for the `-O` option (but not +`--remote-name-all`). + +For example: get two files and use `-O` for the first and a custom file +name for the second: + + curl -O http://example.com/file.txt ftp://example.com/moo.exe -o moo.jpg + +You can also upload multiple files in a similar fashion: + + curl -T local1 ftp://example.com/moo.exe -T local2 ftp://example.com/moo2.txt + +## IPv6 + +curl connects to a server with IPv6 when a host lookup returns an IPv6 address +and fall back to IPv4 if the connection fails. The `--ipv4` and `--ipv6` +options can specify which address to use when both are available. IPv6 +addresses can also be specified directly in URLs using the syntax: + + http://[2001:1890:1112:1::20]/overview.html + +When this style is used, the `-g` option must be given to stop curl from +interpreting the square brackets as special globbing characters. Link local +and site local addresses including a scope identifier, such as `fe80::1234%1`, +may also be used, but the scope portion must be numeric or match an existing +network interface on Linux and the percent character must be URL escaped. The +previous example in an SFTP URL might look like: + + sftp://[fe80::1234%251]/ + +IPv6 addresses provided other than in URLs (e.g. to the `--proxy`, +`--interface` or `--ftp-port` options) should not be URL encoded. + +## Mailing Lists + +For your convenience, we have several open mailing lists to discuss curl, its +development and things relevant to this. Get all info at +https://curl.se/mail/. + +Please direct curl questions, feature requests and trouble reports to one of +these mailing lists instead of mailing any individual. + +Available lists include: + +### `curl-users` + +Users of the command line tool. How to use it, what does not work, new +features, related tools, questions, news, installations, compilations, +running, porting etc. + +### `curl-library` + +Developers using or developing libcurl. Bugs, extensions, improvements. + +### `curl-announce` + +Low-traffic. Only receives announcements of new public versions. At worst, +that makes something like one or two mails per month, but usually only one +mail every second month. + +### `curl-and-php` + +Using the curl functions in PHP. Everything curl with a PHP angle. Or PHP with +a curl angle. + +### `curl-and-python` + +Python hackers using curl with or without the python binding pycurl. diff --git a/curl/docs/README.md b/curl/docs/README.md new file mode 100644 index 0000000..22d96ea --- /dev/null +++ b/curl/docs/README.md @@ -0,0 +1,18 @@ + + +![curl logo](https://curl.se/logo/curl-logo.svg) + +# Documentation + +You find a mix of various documentation in this directory and subdirectories, +using several different formats. Some of them are not ideal for reading +directly in your browser. + +If you would rather see the rendered version of the documentation, check out the +curl website's [documentation section](https://curl.se/docs/) for +general curl stuff or the [libcurl section](https://curl.se/libcurl/) for +libcurl related documentation. diff --git a/curl/docs/RELEASE-PROCEDURE.md b/curl/docs/RELEASE-PROCEDURE.md new file mode 100644 index 0000000..fe8c01d --- /dev/null +++ b/curl/docs/RELEASE-PROCEDURE.md @@ -0,0 +1,145 @@ + + +curl release procedure - how to do a release +============================================ + +in the source code repo +----------------------- + +- edit `RELEASE-NOTES` to be accurate + +- update `docs/THANKS` + +- make sure all relevant changes are committed on the master branch + +- tag the git repo in this style: `git tag -a curl-7_34_0`. -a annotates the + tag and we use underscores instead of dots in the version number. Make sure + the tag is GPG signed (using -s). + +- run `./scripts/dmaketgz 7.34.0` to build the release tarballs. + +- push the git commits and the new tag + +- GPG sign the 4 tarballs as `maketgz` suggests + +- upload the 8 resulting files to the primary download directory + +in the curl-www repo +-------------------- + +- edit `Makefile` (version number and date), + +- edit `_newslog.html` (announce the new release) and + +- edit `_changes.html` (insert changes+bugfixes from RELEASE-NOTES) + +- commit all local changes + +- tag the repo with the same name as used for the source repo. + +- make sure all relevant changes are committed and pushed on the master branch + + (the website then updates its contents automatically) + +on GitHub +--------- + +- edit the newly made release tag so that it is listed as the latest release + +inform +------ + +- send an email to curl-users, curl-announce and curl-library. Insert the + RELEASE-NOTES into the mail. + +- if there are any advisories associated with the release, send each markdown + file to the above lists as well as to `oss-security@lists.openwall.com` + (unless the problem is unique to the non-open operating systems) + +celebrate +--------- + +- suitable beverage intake is encouraged for the festivities + +curl release scheduling +======================= + +Release Cycle +------------- + +We normally do releases every 8 weeks on Wednesdays. If important problems +arise, we can insert releases outside the schedule or we can move the release +date. + +Each 8 week (56 days) release cycle is divided into three distinct periods: + +- During the first 10 calendar days after a release, we are in "cool down". We + do not merge features but only bug-fixes. If a regression is reported, we + might do a follow-up patch release. + +- During the following 3 weeks (21 days) there is a feature window: we allow + new features and changes to curl and libcurl. If we accept any such changes, + we bump the minor number used for the next release. + +- During the next 25 days we are in feature freeze. We do not merge any + features or changes, and we only focus on fixing bugs and polishing things + to make the pending release a solid one. + +If a future release date happens to end up on a "bad date", like in the middle +of common public holidays or when the lead release manager is unavailable, the +release date can be moved forwards or backwards a full week. This is then +advertised well in advance. + +Release Candidates +------------------ + +We ship release candidate tarballs on three occasions in preparation for the +pending release: + +- Release candidate one (**rc1**) ships the same Saturday the feature freeze + starts. Twenty-five days before the release. Tagged like `rc-7_34_0-1`. + +- Release candidate two (**rc2**) ships nine days later, sixteen days before + the release. On a Monday. Tagged like `rc-7_34_0-2`. + +- Release candidate tree (**rc3**) ships nine days later, seven days before + the release. On a Wednesday. Tagged like `rc-7_34_0-3`. + +Release candidate tarballs are ephemeral and each such tarball is only kept +around for a few weeks. They are provided on their dedicated webpage at: +https://curl.se/rc/ + +The git tags for release candidate are temporary and remain set only for a +limited period of time. + +**Do not use release candidates in production**. They are work in progress. +Use them for testing and verification only. Use actual releases in production. + +Critical problems +----------------- + +We can break the release cycle and do a patch release at any point if a +critical enough problem is reported. There is no exact definition of how to +assess such criticality, but if an issue is highly disturbing or has a +security impact on a large enough share of the user population it might +qualify. + +If you think an issue qualifies, bring it to the curl-library mailing list and +push for it. + +Coming dates +------------ + +Based on the description above, here are some planned future release dates: + +- May 28, 2025 +- July 16, 2025 +- September 10, 2025 +- November 5, 2025 +- January 7, 2026 +- March 4, 2026 +- April 29, 2026 diff --git a/curl/docs/RELEASE-TOOLS.md b/curl/docs/RELEASE-TOOLS.md new file mode 100644 index 0000000..f97fce8 --- /dev/null +++ b/curl/docs/RELEASE-TOOLS.md @@ -0,0 +1,28 @@ +# Release tools used for curl 8.14.0 + +The following tools and their Debian package version numbers were used to +produce this release tarball. + +- autoconf: 2.71-3 +- automake: 1:1.16.5-1.3 +- libtool: 2.4.7-7~deb12u1 +- make: 4.3-4.1 +- perl: 5.36.0-7+deb12u2 +- git: 1:2.39.5-0+deb12u2 + +# Reproduce the tarball + +- Clone the repo and checkout the tag/commit: curl-8_14_0 +- Install the same set of tools + versions as listed above + +## Do a standard build + +- autoreconf -fi +- ./configure [...] +- make + +## Generate the tarball with the same timestamp + +- export SOURCE_DATE_EPOCH=1748410910 +- ./scripts/maketgz [version] + diff --git a/curl/docs/ROADMAP.md b/curl/docs/ROADMAP.md new file mode 100644 index 0000000..abf306b --- /dev/null +++ b/curl/docs/ROADMAP.md @@ -0,0 +1,17 @@ + + +# curl the next few years - perhaps + +Roadmap of things Daniel Stenberg wants to work on next. It is intended to +serve as a guideline for others for information, feedback and possible +participation. + +## WebSocket + +Agree that it is a good enough API and remove the EXPERIMENTAL label. + +## diff --git a/curl/docs/RUSTLS.md b/curl/docs/RUSTLS.md new file mode 100644 index 0000000..e46e1d8 --- /dev/null +++ b/curl/docs/RUSTLS.md @@ -0,0 +1,85 @@ + + +# Rustls + +[Rustls is a TLS backend written in Rust](https://docs.rs/rustls/). curl can +be built to use it as an alternative to OpenSSL or other TLS backends. We use +the [rustls-ffi C bindings](https://github.com/rustls/rustls-ffi/). This +version of curl is compatible with `rustls-ffi` v0.15.x. + +## Getting rustls-ffi + +To build `curl` with `rustls` support you need to have `rustls-ffi` available first. +There are three options for this: + +1. Install it from your package manager, if available. +2. Download pre-built binaries. +3. Build it from source. + +### Installing rustls-ffi from a package manager + +See the [rustls-ffi README] for packaging status. Availability and details for installation +differ between distributions. + +Once installed, build `curl` using `--with-rustls`. + + % git clone https://github.com/curl/curl + % cd curl + % autoreconf -fi + % ./configure --with-rustls + % make + +[rustls-ffi README]: https://github.com/rustls/rustls-ffi?tab=readme-ov-file + +### Downloading pre-built rustls-ffi binaries + +Pre-built binaries are available on the [releases page] on GitHub for releases since 0.15.0. +Download the appropriate archive for your platform and extract it to a directory of your choice +(e.g. `${HOME}/rustls-ffi-built`). + +Once downloaded, build `curl` using `--with-rustls` and the path to the extracted binaries. + + % git clone https://github.com/curl/curl + % cd curl + % autoreconf -fi + % ./configure --with-rustls=${HOME}/rustls-ffi-built + % make + +[releases page]: https://github.com/rustls/rustls-ffi/releases + +### Building rustls-ffi from source + +Building `rustls-ffi` from source requires both a rust compiler, and the [cargo-c] cargo plugin. + +To install a Rust compiler, use [rustup] or your package manager to install +the **1.73+** or newer toolchain. + +To install `cargo-c`, use your [package manager][cargo-c pkg], download +[a pre-built archive][cargo-c prebuilt], or build it from source with `cargo install cargo-c`. + +Next, check out, build, and install the appropriate version of `rustls-ffi` using `cargo`: + + % git clone https://github.com/rustls/rustls-ffi -b v0.15.0 + % cd rustls-ffi + % cargo capi install --release --prefix=${HOME}/rustls-ffi-built + +Now configure and build `curl` using `--with-rustls`: + + % git clone https://github.com/curl/curl + % cd curl + % autoreconf -fi + % ./configure --with-rustls=${HOME}/rustls-ffi-built + % make + +See the [rustls-ffi README][cryptography provider] for more information on cryptography providers and +their build/platform requirements. + +[cargo-c]: https://github.com/lu-zero/cargo-c +[rustup]: https://rustup.rs/ +[cargo-c pkg]: https://github.com/lu-zero/cargo-c?tab=readme-ov-file#availability +[cargo-c prebuilt]: https://github.com/lu-zero/cargo-c/releases +[cryptography provider]: https://github.com/cpu/rustls-ffi?tab=readme-ov-file#cryptography-provider diff --git a/curl/docs/SECURITY-ADVISORY.md b/curl/docs/SECURITY-ADVISORY.md new file mode 100644 index 0000000..efb0e04 --- /dev/null +++ b/curl/docs/SECURITY-ADVISORY.md @@ -0,0 +1,135 @@ + + +# Anatomy of a curl security advisory + +As described in the [Security Process](https://curl.se/dev/secprocess.html) +document, when a security vulnerability has been reported to the project and +confirmed, we author an advisory document for the issue. It should ideally +be written in cooperation with the reporter to make sure all the angles and +details of the problem are gathered and described correctly and succinctly. + +## New document + +A security advisory for curl is created in the `docs/` folder in the +[curl-www](https://github.com/curl/curl-www) repository. It should be named +`$CVEID.md` where `$CVEID` is the full CVE Id that has been registered for the +flaw. Like `CVE-2016-0755`. The `.md` extension of course means that the +document is written using markdown. + +The standard way to go about this is to first write the `VULNERABILITY` +section for the document, so that there is description of the flaw available, +then paste this description into the CVE Id request. + +### `vuln.pm` + +The new issue should be entered at the top of the list in the file `vuln.pm` +in the same directory. It holds a large array with all published curl +vulnerabilities. All fields should be filled in accordingly, separated by a +pipe character (`|`). + +The eleven fields for each CVE in `vuln.pm` are, in order: + + HTML page name, first vulnerable version, last vulnerable version, name of + the issue, CVE Id, announce date (`YYYYMMDD`), report to the project date + (`YYYYMMDD`), CWE, awarded reward amount (USD), area (single word), C-issue + (`-` if not a C issue at all, `OVERFLOW` , `OVERREAD`, `DOUBLE_FREE`, + `USE_AFTER_FREE`, `NULL_MISTAKE`, `UNINIT`) + +### `Makefile` + +The new CVE webpage filename needs to be added in the `Makefile`'s `CVELIST` +macro. + +When the markdown is in place and the `Makefile` and `vuln.pm` are updated, +all other files and metadata for all curl advisories and versions get +generated automatically using those files. + +## Document format + +The easy way is to start with a recent previously published advisory and just +blank out old texts and save it using a new name. Save the subtitles and +general layout. + +Some details and metadata are extracted from this document so it is important +to stick to the existing format. + +The first list must be the title of the issue. + +### VULNERABILITY + +The first subtitle should be `VULNERABILITY`. That should then include a +through and detailed description of the flaw. Including how it can be +triggered and maybe something about what might happen if triggered or +exploited. + +### INFO + +The next section is `INFO` which adds meta data information about the flaw. It +specifically mentions the official CVE Id for the issue and it must list the +CWE Id, starting on its own line. We write CWE identifiers in advisories with +the full (official) explanation on the right side of a colon. Like this: + +`CWE-305: Authentication Bypass by Primary Weakness` + +### AFFECTED VERSIONS + +The third section first lists what versions that are affected, then adds +clarity by stressing what versions that are *not* affected. A third line adds +information about which specific git commit that introduced the vulnerability. + +The `Introduced-in` commit should be a full URL that displays the commit, but +should work as a stand-alone commit hash if everything up to the last slash is +cut out. + +An example using the correct syntax: + +~~~ +- Affected versions: curl 7.16.1 to and including 7.88.1 +- Not affected versions: curl < 7.16.1 and curl >= 8.0.0 +- Introduced-in: https://github.com/curl/curl/commit/2147284cad +~~~ + +### THE SOLUTION + +This section describes and discusses the fix. The only mandatory information +here is the link to the git commit that fixes the problem. + +The `Fixed-in` value should be a full URL that displays the commit, but should +work as a stand-alone commit hash if everything up to the last slash is cut +out. + +Example: + +`- Fixed-in: https://github.com/curl/curl/commit/af369db4d3833272b8ed` + +### RECOMMENDATIONS + +This section lists the recommended actions for the users in a top to bottom +priority order and should ideally contain three items but no less than two. + +The top two are almost always `upgrade curl to version XXX` and `apply the +patch to your local version`. + +### TIMELINE + +Detail when this report was received in the project. When package distributors +were notified (via the distros mailing list or similar) + +When the advisory and fixed version are released. + +### CREDITS + +Mention the reporter and patch author at least, then everyone else involved +you think deserves a mention. + +If you want to mention more than one name, separate the names with comma +(`,`). + +~~~ +- Reported-by: Full Name +- Patched-by: Full Name +~~~ diff --git a/curl/docs/SPONSORS.md b/curl/docs/SPONSORS.md new file mode 100644 index 0000000..e4f61db --- /dev/null +++ b/curl/docs/SPONSORS.md @@ -0,0 +1,55 @@ + + +# curl sponsors + +A sponsor is someone who donates money or resources to the curl project for no +specific service in return. + +curl accepts donations via [GitHub sponsors](https://github.com/sponsors/curl) +and [Open Collective](https://opencollective.com/curl). + +An even better way to contribute to the project might be to pay an engineer or +two to spend work hours on curl related tasks. + +We promise to use donated funds for things and activities that we believe are +beneficial for the project and its development. That includes but is not +limited to bug-bounties, developer conferences, infrastructure, development, +services and hardware. + +Recurring donations above a certain amount of money puts the sponsor at a +named sponsor level: **Silver**, **Gold**, **Platinum** or **Top**. + +Sponsors on a named level can provide their logo image and preferred URL and +get recognition on the curl website's [sponsor +page](https://curl.se/sponsors.html), assuming they meet the project's +standards and requirements. + +- **Silver Sponsor** at least 100 USD/month +- **Gold Sponsor** at least 500 USD/month +- **Platinum Sponsor** at least 1000 USD/month +- **Top Sponsor** outstanding extra valuable help + +## Sponsor requirements + +A named level sponsor is entitled a logo and link on the curl website assuming +the company, brand and link are not deemed unsuitable. The curl team reserves +the right to make that decision at its own discretion. + +Sponsors may be denied a website presence for example if involved with drugs, +gambling, pornography, social media manipulation etc. + +## Past Sponsors + +Sponsors that stop paying are considered *Past Sponsors* and are not displayed +on the sponsor page anymore. We thank you for your contributions. + +## Donations + +Please note that sponsorship and donations are exactly that: donations to the +curl project. They are used to help and further the project as the project +leadership deems best. No goods or services are expected or promised in +return. Requests for refunds for such purposes are rejected. diff --git a/curl/docs/SSL-PROBLEMS.md b/curl/docs/SSL-PROBLEMS.md new file mode 100644 index 0000000..620392c --- /dev/null +++ b/curl/docs/SSL-PROBLEMS.md @@ -0,0 +1,97 @@ + + +# SSL problems + + First, let's establish that we often refer to TLS and SSL interchangeably as + SSL here. The current protocol is called TLS, it was called SSL a long time + ago. + + There are several known reasons why a connection that involves SSL might + fail. This is a document that attempts to detail the most common ones and + how to mitigate them. + +## CA certs + + CA certs are used to digitally verify the server's certificate. You need a + "ca bundle" for this. See lots of more details on this in the `SSLCERTS` + document. + +## CA bundle missing intermediate certificates + + When using said CA bundle to verify a server cert, you may experience + problems if your CA store does not contain the certificates for the + intermediates if the server does not provide them. + + The TLS protocol mandates that the intermediate certificates are sent in the + handshake, but as browsers have ways to survive or work around such + omissions, missing intermediates in TLS handshakes still happen that browser + users do not notice. + + Browsers work around this problem in two ways: they cache intermediate + certificates from previous transfers and some implement the TLS "AIA" + extension that lets the client explicitly download such certificates on + demand. + +## Protocol version + + Some broken servers fail to support the protocol negotiation properly that + SSL servers are supposed to handle. This may cause the connection to fail + completely. Sometimes you may need to explicitly select a SSL version to use + when connecting to make the connection succeed. + + An additional complication can be that modern SSL libraries sometimes are + built with support for older SSL and TLS versions disabled. + + All versions of SSL and the TLS versions before 1.2 are considered insecure + and should be avoided. Use TLS 1.2 or later. + +## Ciphers + + Clients give servers a list of ciphers to select from. If the list does not + include any ciphers the server wants/can use, the connection handshake + fails. + + curl has recently disabled the user of a whole bunch of seriously insecure + ciphers from its default set (slightly depending on SSL backend in use). + + You may have to explicitly provide an alternative list of ciphers for curl + to use to allow the server to use a weak cipher for you. + + Note that these weak ciphers are identified as flawed. For example, this + includes symmetric ciphers with less than 128 bit keys and RC4. + + Schannel in Windows XP is not able to connect to servers that no longer + support the legacy handshakes and algorithms used by those versions, so we + advise against building curl to use Schannel on really old Windows versions. + + Reference: [Prohibiting RC4 Cipher + Suites](https://datatracker.ietf.org/doc/html/draft-popov-tls-prohibiting-rc4-01) + +## Allow BEAST + + BEAST is the name of a TLS 1.0 attack that surfaced 2011. When adding means + to mitigate this attack, it turned out that some broken servers out there in + the wild did not work properly with the BEAST mitigation in place. + + To make such broken servers work, the --ssl-allow-beast option was + introduced. Exactly as it sounds, it re-introduces the BEAST vulnerability + but on the other hand it allows curl to connect to that kind of strange + servers. + +## Disabling certificate revocation checks + + Some SSL backends may do certificate revocation checks (CRL, OCSP, etc) + depending on the OS or build configuration. The --ssl-no-revoke option was + introduced in 7.44.0 to disable revocation checking but currently is only + supported for Schannel (the native Windows SSL library), with an exception + in the case of Windows' Untrusted Publishers block list which it seems cannot + be bypassed. This option may have broader support to accommodate other SSL + backends in the future. + + References: + + https://curl.se/docs/ssl-compared.html diff --git a/curl/docs/SSLCERTS.md b/curl/docs/SSLCERTS.md new file mode 100644 index 0000000..b170845 --- /dev/null +++ b/curl/docs/SSLCERTS.md @@ -0,0 +1,124 @@ + + +# TLS Certificate Verification + +## Native vs file based + +If curl was built with Schannel or Secure Transport support, then curl uses +the system native CA store for verification. All other TLS libraries use a +file based CA store by default. + +## Verification + +Every trusted server certificate is digitally signed by a Certificate +Authority, a CA. + +In your local CA store you have a collection of certificates from *trusted* +certificate authorities that TLS clients like curl use to verify servers. + +curl does certificate verification by default. This is done by verifying the +signature and making sure the certificate was crafted for the server name +provided in the URL. + +If you communicate with HTTPS, FTPS or other TLS-using servers using +certificates signed by a CA whose certificate is present in the store, you can +be sure that the remote server really is the one it claims to be. + +If the remote server uses a self-signed certificate, if you do not install a +CA cert store, if the server uses a certificate signed by a CA that is not +included in the store you use or if the remote host is an impostor +impersonating your favorite site, the certificate check fails and reports an +error. + +If you think it wrongly failed the verification, consider one of the following +sections. + +### Skip verification + +Tell curl to *not* verify the peer with `-k`/`--insecure`. + +We **strongly** recommend this is avoided and that even if you end up doing +this for experimentation or development, **never** skip verification in +production. + +### Use a custom CA store + +Get a CA certificate that can verify the remote server and use the proper +option to point out this CA cert for verification when connecting - for this +specific transfer only. + +With the curl command line tool: `--cacert [file]` + +If you use the curl command line tool without a native CA store, then you can +specify your own CA cert file by setting the environment variable +`CURL_CA_BUNDLE` to the path of your choice. `SSL_CERT_FILE` and `SSL_CERT_DIR` +are also supported. + +If you are using the curl command line tool on Windows, curl searches for a CA +cert file named `curl-ca-bundle.crt` in these directories and in this order: + 1. application's directory + 2. current working directory + 3. Windows System directory (e.g. C:\Windows\System32) + 4. Windows Directory (e.g. C:\Windows) + 5. all directories along %PATH% + +curl 8.11.0 added a build-time option to disable this search behavior, and +another option to restrict search to the application's directory. + +### Use the native store + +In several environments, in particular on Windows, you can ask curl to use the +system's native CA store when verifying the certificate. + +With the curl command line tool: `--ca-native`. + +### Modify the CA store + +Add the CA cert for your server to the existing default CA certificate store. + +Usually you can figure out the path to the local CA store by looking at the +verbose output that `curl -v` shows when you connect to an HTTPS site. + +### Change curl's default CA store + +The default CA certificate store curl uses is set at build time. When you +build curl you can point out your preferred path. + +### Extract CA cert from a server + + curl -w %{certs} https://example.com > cacert.pem + +The certificate has `BEGIN CERTIFICATE` and `END CERTIFICATE` markers. + +### Get the Mozilla CA store + +Download a version of the Firefox CA store converted to PEM format on the [CA +Extract](https://curl.se/docs/caextract.html) page. It always features the +latest Firefox bundle. + +## Native CA store + +If curl was built with Schannel, Secure Transport or were instructed to use +the native CA Store, then curl uses the certificates that are built into the +OS. These are the same certificates that appear in the Internet Options +control panel (under Windows) or Keychain Access application (under macOS). +Any custom security rules for certificates are honored. + +Schannel runs CRL checks on certificates unless peer verification is disabled. +Secure Transport on iOS runs OCSP checks on certificates unless peer +verification is disabled. Secure Transport on macOS runs either OCSP or CRL +checks on certificates if those features are enabled, and this behavior can be +adjusted in the preferences of Keychain Access. + +## HTTPS proxy + +curl can do HTTPS to the proxy separately from the connection to the server. +This TLS connection is handled and verified separately from the server +connection so instead of `--insecure` and `--cacert` to control the +certificate verification, you use `--proxy-insecure` and `--proxy-cacert`. +With these options, you make sure that the TLS connection and the trust of the +proxy can be kept totally separate from the TLS connection to the server. diff --git a/curl/docs/THANKS.txt b/curl/docs/THANKS.txt new file mode 100644 index 0000000..dd3a25b --- /dev/null +++ b/curl/docs/THANKS.txt @@ -0,0 +1,3433 @@ + This project has been alive for many years. Countless people have provided + feedback that have improved curl. Here follows a list of people that have + contributed (a-z order). + + If you have contributed but are missing here, please let us know! + +0xee on github +0xflotus on github +12932 on github +1337vt on github +1ocalhost on github +3dyd on github +3eka on github +5533asdg on github +8U61ife on github +9cel +a1346054 on github +Aaro Koskinen +Aaron Oneal +Aaron Orenstein +Aaron Scarisbrick +aasivov on github +Abdullah Alyan +Abhinav Singh +Abhinav Singhal +Abram Pousada +accountantM on github +AceCrow on github +ad0p on github +Adam Averay +Adam Barclay +Adam Brown +Adam Coyne +Adam D. Moss +Adam Langley +Adam Light +Adam Marcionek +Adam Piggott +Adam Rosenfield +Adam Sampson +Adam Tkac +ad-chaos on github +Aditya Garg +Ádler Jonas Gross +Adnan Khan +adnn on github +Adrian Burcea +Adriano Meirelles +Adrian Peniak +Adrian Schuur +afrind on github +Aftab Alam +ahodesuka on github +ajak in #curl +Ajit Dhumale +Akhilesh Nema +Akhil Kedia +Aki Koskinen +Aki Sakurai +Akos Pasztory +Akshay Vernekar +Alain Danteny +Alain Miniussi +Alan Coopersmith +Alan Jenkins +Alan Pinstein +Albert Chin-A-Young +Albert Choy +Alberto Leiva Popper +Albin Vass +Alejandro Alvarez Ayllon +Alejandro Colomar +Alejandro R. Sedeño +Aleksandar Milivojevic +Aleksander Mazur +Aleksandr Krotov +Aleksey Tulinov +alervd on github +Ales Mlakar +Ales Novak +Alessandro Ghedini +Alessandro Vesely +Alex aka WindEagle +Alexander Bartel +Alexander Beedie +Alexander Chuykov +Alexander Dyagilev +Alexander Elgert +Alexander Jaeger +Alexander Kanavin +Alexander Klauer +Alexander Kourakos +Alexander Krasnostavsky +Alexander Lazic +Alexander Pepper +Alexander Peslyak +Alexander Shtuchkin +Alexander Sinditskiy +Alexander Traud +Alexander V. Tikhonov +Alexander Zhuravlev +Alexandre Bury +Alexandre Ferrieux +Alexandre Pion +Alex Baines +Alex Bligh +Alex Bozarth +Alex Chan +Alex Crichton +Alexey Borzov +Alexey Eremikhin +Alexey Larikov +Alexey Melnichuk +Alexey Pesternikov +Alexey Savchuk +Alexey Simak +Alexey Zakhlestin +Alex Fishman +Alex Gaynor +Alex Grebenschikov +Alex Gruz +Alexis Carvalho +Alexis La Goutte +Alexis Savin +Alexis Vachette +Alex Kiernan +Alex Klyubin +Alex Konev +Alex Malinovich +Alex Mayorga +Alex McLellan +Alex Neblett +Alex Nichols +Alex Potapenko +Alex Rousskov +Alex Samorukov +Alex Snast +Alex Suykov +Alex Vinnik +Alex Xu +Alfonso Martone +Alfred Gebert +Ali Khodkar +ALittleDruid on github +Ali Utku Selen +Allen Pulsifer +Alois Klink +Alona Rossen +Amaury Denoyelle +amishmm on github +Amit Katyal +Ammar Faizi +Amol Pattekar +Amr Shahin +Anatol Belski +Anatoli Tubman +Anders Bakken +Anders Berg +Anders Gustafsson +Anders Havn +Anderson Sasaki +Anderson Toshiyuki Sasaki +Anders Roxell +Andi Jahja +Andrea Pappacoda +Andreas Damm +Andreas Falkenhahn +Andreas Farber +Andreas Fischer +Andreas Huebner +Andreas Kiefer +Andreas Kostyrka +Andreas Malzahn +Andreas Ntaflos +Andreas Olsson +Andreas Rieke +Andreas Roth +Andreas Schneider +Andreas Schuldei +Andreas Sommer +Andreas Streichardt +Andreas Westin +Andreas Wurf +Andre Guibert de Bruet +Andre Heinecke +Andrei Benea +Andrei Bica +Andrei Cipu +Andrei Florea +Andrei Karas +Andrei Korshikov +Andrei Kurushin +Andrei Neculau +Andrei Rybak +Andrei Sedoi +Andrei Valeriu BICA +Andrei Virtosu +Andrej E Baranov +Andrés García +Andrew +Andrew Ayer +Andrew Barnert +Andrew Barnes +Andrew Benham +Andrew Biggs +Andrew Bushnell +Andrew de los Reyes +Andrew Francis +Andrew Fuller +Andrew Ishchuk +Andrew Kaster +Andrew Kirillov +Andrew Krieger +Andrew Kurushin +Andrew Lambert +Andrew Moise +Andrew Potter +Andrew Robbins +Andrew Wansink +Andrey Alifanov +Andrey Gursky +Andrey Labunets +Andrii Moiseiev +Andrius Merkys +Andy Alt +Andy Cedilnik +Andy Fiddaman +Andy Pan +Andy Reitz +Andy Serpa +Andy Stamp +Andy Tsouladze +Angus Mackay +anio on github +annalee +anon00000000 on github +anshnd on github +Anssi Kolehmainen +Antarpreet Singh +Anthon Pang +Anthony Avina +Anthony Bryan +Anthony G. Basile +Anthony Hu +Anthony Ramine +Anthony Shaw +Antoine Aubert +Antoine Bollengier +Antoine Calando +Antoine du Hamel +Antoine Pietri +Antoine Pitrou +Anton Bychkov +Anton Gerasimov +Antonio Larrosa +Antoni Villalonga +Anton Kalmykov +Anton Malov +Antony74 on github +Anton Yabchinskiy +Antti Hätälä +antypanty on hackerone +Anubhav Rai +apparentorder on github +April King +Aquila Macedo +arainchik on github +Archangel_SDY on github +Arian van Putten +Arjan van de Ven +Arkadiusz Miskiewicz +arlt on github +Armel Asselin +Arnaud Compan +Arnaud Ebalard +Arnaud Rebillout +Arne Soete +Aron Bergman +Aron Rotteveel +Artak Galoyan +Arthur Murray +Artur Sinila +Arve Knudsen +Arvid Norberg +arvids-kokins-bidstack on github +asavah on github +Asger Hautop Drewsen +Ashish Shukla +Ashwin Metpalli +Askar Safin +Ask Bjørn Hansen +AtariDreams on github +Ates Goral +atjg on github +Augustus Saunders +Aurélien Pierre +Austin Green +Austin Moore +av223119 on github +Avery Fay +awesomekosm on github +awesomenode on github +Axel Chong +Axel Morawietz +Axel Tillequin +Ayesh Karunaratne +Ayoub Boudhar +Ayushman Singh Chauhan +b9a1 on github +Bachue Zhou +Baitinq on github +Balaji Parasuram +Balaji Salunke +Balaji S Rao +Balakrishnan Balasubramanian +Balazs Kovacsics +balikalina on github +Balint Szilakszi +baranyaib90 on github +Barry Abrahamson +Barry Pollard +Bart Whiteley +Baruch Siach +Bas Mevissen +Bastian Krause +Bastien Bouclet +Basuke Suzuki +Bas van Schaik +baumanj on github +bdry on github +beckenc on github +Ben +Benau on github +Ben Bodenmiller +Ben Boeckel +Benbuck Nason +Ben Darnell +Ben Fritz +Ben Greear +Benjamin Gerard +Benjamin Gilbert +Benjamin Johnson +Benjamin Kircher +Benjamin Loison +Benjamin Riefenstahl +Benjamin Ritcey +Benjamin Sergeant +Ben Kohler +Ben Madsen +Ben Noordhuis +Benoit Neil +Benoit Pierre +Benoit Sigoure +Ben Van Hof +Ben Voris +Ben Winslow +Ben Zanin +Bernard Leak +Bernard Spil +Bernat Mut +Bernd Mueller +Bernhard Iselborn +Bernhard M. Wiedemann +Bernhard Reutner-Fischer +Bernhard Walle +Bert Huijben +Bertrand Demiddelaer +Bertrand Simonnet +beslick5 on github +Bevan Weiss +Bhanu Prakash +Bill Doyle +Bill Egert +Bill Hoffman +billionai on github +Bill Middlecamp +Bill Nagel +Bill Pyne +Billyzou0741326 on github +Bin Lan +Bin Meng +Biswapriyo Nath +Bjarni Ingi Gislason +Bjoern Franke +Bjoern Sikora +Bjorn Augustsson +Bjorn Reese +Björn Stenberg +black-desk on github +Blaise Potard +Blake Burkhart +blankie +bnfp on github +bo0tzz on github +Bo Anderson +bobmitchell1956 on github +Bob Relyea +Bob Richmond +Bob Schader +Bodo Bergmann +Bogdan Nicula +boilingoden +Boris Kuschel +Boris Okunskiy +Boris Rasin +Boris Verkhovskiy +Brad Burdick +Brad Fitzpatrick +Bradford Bruce +Brad Forschinger +Brad Harder +Brad Hards +Brad House +Brad King +Brad Spencer +bramus on github +Brandon Casey +Brandon Dong +Brandon Wang +BratSinot on github +Brendan Dolan-Gavitt +Brendan Jurd +Brendon Smith +Brennan Kinney +Brent Beardsley +Brett Buddin +Brian Akins +Brian Bergeron +Brian Carpenter +Brian Chaplin +Brian Childs +Brian Chrisman +Brian Chrzanowski +Brian Clemens +Brian Dessent +Brian E. Gallew +Brian Green +Brian Inglis +Brian J. Murrell +Brian Lund +brian m. carlson +Brian Nixon +Brian Prodoehl +Brian R Duffy +Brian Ulm +Brock Noland +Bruce Mitchener +Bruce Stephens +bruce.yoon +BrumBrum on hackerone +Bruno Baguette +Bruno de Carvalho +Bruno Grasselli +Bruno Henrique Batista Cruz da Silva +Bruno Thomsen +Bru Rom +Bryan Henderson +Bryan Kemp +bsammon on github +bsergean on github +bsr13 on hackerone +bubbleguuum on github +Bubu on github +buzo-ffm on github +bxac on github +Bylon2 on github +Byrial Jensen +Cajus Pollmeier +Caleb Raitto +calvin2021y on github +Calvin Buckley +Calvin Ruocco +Cameron Blomquist +Cameron Cawley +Cameron Kaiser +Cameron MacMinn +Cameron Will +Camille Moncelier +Caolan McNamara +Cao ZhenXiang +Captain Basil +Carie Pointer +Carlo Alberto +Carlo Cabrera +Carlo Cannas +Carlo Marcelo Arenas Belón +Carlos Henrique Lima Melara +Carlos ORyan +Carlo Teubner +Carlo Wood +Carl Zogheib +Carsten Lange +Casey Bodley +Casey O'Donnell +Catalin Patulea +Catena cyber +causal-agent on github +cbartl on github +cclauss on github +Cédric Connes +Cédric Deltheil +Cering on github +Cesar Eduardo Barros +Ch40zz on github +Chad Monroe +Chandrakant Bagul +Chara White +Charles Cazabon +Charles Kerr +Charles Romestant +Charlie C +chemodax +Chen Prog +chensong1211 on github +Cherish98 on github +Chester Liu +Chih-Chung Chang +Chih-Hsuan Yen +Chilledheart on github +Chloe Kudryavtsev +Chris Araman +Chris "Bob Bob" +Chris Carlmar +Chris Combes +Chris Conlon +Chris Deidun +Chris Faherty +Chris Flerackers +Chris Gaukroger +Chris Maltby +Chris Mumford +Chris Paulson-Ellis +Chris Roberts +Chris Sauer +Chris Smowton +Chris Stubbs +Chris Swan +Chris Talbot +Christian Fillion +Christian Grothoff +Christian Hägele +Christian Heimes +Christian Hesse +Christian Heusel +Christian Krause +Christian Kurz +Christian Robottom Reis +Christian Schmitz +Christian Stewart +Christian Vogt +Christian Weisgerber +Christophe Demory +Christophe Dervieux +Christophe Legry +Christopher Conroy +Christopher Dannemiller +Christopher Degawa +Christopher Head +Christopher Palow +Christopher Reid +Christopher R. Palmer +Christopher Sauer +Christopher Stone +Christoph Jabs +Christoph Krey +Christoph M. Becker +Christoph Reiter +Chris Webb +Chris Young +chrysos349 on github +Chungtsun Li +Ciprian Badescu +civodul on github +Claes Jakobsson +Clarence Gardner +Claudio Neves +claudiusaiz on github +clbr on github +Clemens Gruber +Clément Notin +Cliff Crosland +Clifford Wolf +Clint Clayton +Cloudogu Siebels +CMD +cmfrolick on github +codesniffer13 on github +Cody Jones +Cody Mack +COFFEETALES on github +coinhubs on github +Colby Ranger +Cole Helbling +Colin Blair +Colin Cross +Colin Hogben +Colin Leroy +Colin Leroy-Mira +Colin O'Dell +Colin Watson +Colman Mbuya +Colm Buckley +Colton Willey +Constantine Sapuntzakis +consulion on github +coralw on github +Corinna Brandt +correctmost on github +Cory Benfield +Cory Nelson +Costya Shulyupin +Craig Andrews +Craig A West +Craig Davison +Craig de Stigter +Craig Markwardt +crazydef on github +Cris Bailiff +Cristian Greco +Cristian Morales Vega +Cristian Rodríguez +CueXXIII on github +Curt Bogmine +Cynthia Coan +Cyril B +Cyrill Osterwalder +d4d on hackerone +d912e3 on github +daboul on github +Dag Ekengren +Dagfinn Ilmari Mannsåker +Dagobert Michelsen +Daiki Ueno +Dair Grant +Dambaev Alexander +Damian Dixon +Damien Adant +Damien Vielpeau +Damien Walsh +Dan Becker +Dan Cristian +Dan Donahue +Dan Fandrich +Daniel at touchtunes +Dániel Bakai +Daniel Bankhead +Daniel Black +Daniel Carpenter +Daniel Cater +Daniel Egger +Daniel Engberg +Daniel Faust +Daniel Fosco +Daniel Gustafsson +Daniel Hallberg +Daniel Hwang +Daniel Jeliński +Daniel J. H. +Daniel Johnson +Daniel Kahn Gillmor +Daniel Katz +Daniel Krügler +Daniel Kurečka +Daniel Lee Hwang +Daniel Lublin +Daniel Marjamäki +Daniel McCarney +Daniel Melani +Daniel Mentz +Daniel Pouzzner +Daniel Romero +Daniel Schauenberg +Daniel Seither +Daniel Shahaf +Daniel Silverstone +Daniel Steinberg +Daniel Stenberg +Daniel Szmulewicz +Daniel Theron +Daniel Valenzuela +Daniel Woelfel +Dan Johnson +Dan Kenigsberg +Dan Locks +Dan McDonald +Dan McNulty +Dan Nelson +Dan Petitt +Dan Rosser +Dan Torop +Dan Zitter +Daphne Luong +Darío Hereñú +Dario Nieuwenhuis +Dario Weißer +Darren Banfi +Darryl House +Darshan Mody +dasimx on github +DasKutti on github +Dave Cottlehuber +Dave Dribin +Dave Halbakken +Dave Hamilton +Dave May +Dave Nicolson +Dave Reisner +Dave Thompson +Dave Vasilevsky +Davey Shafik +David Bau +David Benjamin +David Binderman +David Blaikie +David Bohman +David Byron +David Carlier +David Cohen +David Cook +David Demelier +David Earl +Davide Cassioli +davidedec on github +Davide Masserut +David E. Narváez +David Eriksson +David Garske +David Goerger +David Houlder +David Hu +David Hull +David James +David J Meyer +David Kalnischkies +David Kierznowski +David Kimdon +David L. +David Lang +David LeBlanc +David Lopes +David Lord +David McCreedy +David McLaughlin +David Odin +David Phillips +David Rosenstrauch +David Ryskalczyk +David Sanderson +David Sardari +David Schweikert +David Shaw +David Strauss +David Suter +David Tarendash +David Thiel +David Walser +David Woodhouse +David Wright +David Yan +Da-Yoon Chung +dbrowndan on github +dEajL3kA on github +Deal(一线灵) +dekerser on github +deliciouslytyped on github +delogicsreal on github +Demi Marie Obenour +dengjfzh on github +Dengminwen +Denis Baručić +Denis Chaplygin +Denis Feklushkin +Denis Goleshchikhin +Denis Laxalde +Denis Ollier +Deniz Sökmen +Dennis Clarke +Dennis Felsing +dependabot[bot] +Derek Higgins +Derek Huang +Derzsi Dániel +Desmond O. Chang +destman on github +Detlef Schmier +Dexter Gerig +dfdity on github +D. Flinkmann +Dheeraj Sangamkar +Didier Brisebourg +Diego Bes +Diego Casorran +Dietmar Hauser +Dilyan Palauzov +Dima Barsky +Dima Pasechnik +Dima Tisnek +Dimitar Boevski +Dimitre Dimitrov +Dimitrios Apostolou +Dimitrios Siganos +Dimitris Sarris +Dinar +Diogo Teles Sant'Anna +Dion Williams +Dirk Eddelbuettel +Dirk Feytons +Dirk Hünniger +Dirkjan Bussink +Dirk Manske +Dirk Rosenkranz +Dirk Wetter +Diven Qi +divinity76 on github +Divy Le Ray +dkjjr89 on github +dkwolfe4 on github +Dmitri Shubin +Dmitri Tikhonov +Dmitriy Sergeyev +dmitrmax on github +Dmitry Atamanov +Dmitry Bartsevich +Dmitry Eremin-Solenikov +Dmitry Falko +Dmitry Karpov +Dmitry Kostjuchenko +Dmitry Kurochkin +Dmitry Mikhirev +Dmitry Popov +Dmitry Rechkin +Dmitry S. Baikov +Dmitry Tretyakov +Dmitry Wagin +dnivras on github +dogma +Dolbneff A.V +Domenico Andreoli +Domen Kožar +Dominick Meglio +Dominik Hölzl +Dominik Klemba +Dominik Piątkowski +Dominik Thalhammer +Dominique Leuenberger +Dongliang Mu +Donguk Kim +Don J Olmstead +Dorian Craps +Doron Behar +Doug Kaufman +Douglas Creager +Douglas E. Wegscheid +Douglas Kilpatrick +Douglas Mencken +Douglas R. Horner +Douglas R. Reno +Douglas Steinwand +Doug Porter +Dov Murik +dpull on github +Drake Arconis +dtmsecurity on github +Duane Cathey +Duncan Mac-Vicar Prett +Duncan Wilcox +Dustin Boswell +Dustin Howett +Dusty Mabe +Duy Phan Thanh +Dwarakanath Yadavalli +dwickr +Dylam De La Torre +Dylan Anthony +Dylan Ellicott +Dylan Salisbury +eaglegai on github +Early Ehlinger +Earnestly on github +Eason-Yu on github +Ebe Janchivdorj +ebejan on github +Ebenezer Ikonne +ed0d2b2ce19451f2 +Eddie Lumpkin +Edgaras Janušauskas +Edin Kadribasic +edmcln on github +Edmond Yu +Ed Morley +Edoardo Lolletti +Eduard Bloch +Eduard Strehlau +Edward Kimmel +Edward Rudd +Edward Sheldrake +Edward Thomson +Eelco Dolstra +Eetu Ojanen +eeverettrbx on github +Egon Eckert +Egor Pugin +Ehren Bendler +Eldar Zaitov +elelel on github +elephoenix on github +Elia Tufarolo +Eli Schwartz +Elliot Killick +Elliot Saba +Elliott Balsley +Ellis Pritchard +Elmira A Semenova +Elms +Eloy Degen +elsamuko on github +elvinasp on github +emanruse on github +Emanuele Bovisio +Emanuele Torre +Emanuel Komínek +Emil Engler +Emiliano Ida +Emilio Cobos Álvarez +Emilio López +Emil Lerner +Emil Österlund +Emil Romanus +Emmanuel Tychon +Enno Boland +Enrico Scholz +Enrik Berkhan +enWILLYado on github +epicmkirzinger on github +eppesuig +Eramoto Masaya +Eric Cooper +Eric Curtin +Eric Gallager +Eric Hu +Eric Knibbe +Erick Nuwendam +Eric Landes +Eric Lavigne +Eric Lubin +Eric Melville +Eric Mertens +Eric Murphy +Eric Musser +Eric Norris +Érico Nogueira +Érico Nogueira Rolim +Eric Rautman +Eric Rescorla +Eric Ridge +Eric Rosenquist +Eric Sauvageau +Eric S. Raymond +Eric Thelin +Eric Vergnaud +Eric Vigeant +Eric Wong +Eric Wu +Eric Young +Erik Jacobsen +Erik Janssen +Erik Johansson +Erik Minekus +Erik Olsson +Erik Schnetter +Erik Stenlund +Ernest Beinrohr +Ernst Sjöstrand +Erwan Legrand +Erwin Authried +Esdras de Morais da Silva +Estanislau Augé-Pujadas +Ethan Everett +Ethan Glasser Camp +Ethan Wilkes +Etienne Simard +Eugene Kotlyarov +Evangelos Foutras +Evan Jordan +Even Rouault +Evert Pot +Evgeny Grin (Karlson2k) +Evgeny Turnaev +eXeC64 on github +extrimexxx on github +Eygene Ryabinkin +Eylem Ugurel +Fabian Fischer +Fabian Frank +Fabian Hiernaux +Fabian Keil +Fabian Ruff +Fabian Vogt +Fabian Yamaguchi +Fabrice Fontaine +Fabrizio Ammollo +Fahim Chandurwala +Faizur Rahman +Faraz Fallahi +farazrbx on github +Farzin on github +Fata Nugraha +Fawad Mirza +Fay Stegerman +FC Stegerman +fds242 on github +Federico Bianchi +Federico Pellegrin +Fedor Karpelevitch +Fedor Korotkov +feelingseas on github +FeignClaims on github +Feist Josselin +Felipe Gasper +Felix Hädicke +Felix Kaiser +Felix von Leitner +Felix Yan +Feng Tu +Fernando Muñoz +Filip Lundgren +Filip Salomonsson +finkjsc on github +Firefox OS +Flameborn on github +Flavio Medeiros +Florian Eckert +Florian Kohnhäuser +Florian Pritz +Florian Schoppmann +Florian Van Heghe +Florian Weimer +Florin Petriuc +Forrest Cahoon +Francisco Moraes +Francisco Munoz +Francisco Olarte +Francisco Sedano +François Charlier +François Michel +Francois Petitjean +François Rigault +Francois Rivard +Frank Denis +Frank Gevaerts +Frank Hempel +Frank Keeney +Frank McGeough +Frank Meier +Frank Ticheler +Frank Van Uffelen +František Kučera +Frazer Smith +Frederic Lepied +Frederik B +Frederik Wedel-Heinen +Fred Machado +Fred New +Fred Noz +Fredrik Thulin +Fred Stluka +FuccDucc on github +Fujii Hironori +fullincome on github +fundawang on github +fuzzard +Gabe +Gabriel Corona +Gabriel Kuri +Gabriel Marin +Gabriel Simmer +Gabriel Sjoberg +Gaelan Steele +Gaël Portay +galen11 on github +Gambit Communications +Ganesh Kamath +Ganesh Viswanathan +gaoxingwang on github +Garrett Holmstrom +Garrett Squire +Gary Maxwell +Gaurav Malhotra +Gautam Kachroo +Gautam Mani +Gavin Wong +Gavrie Philipson +Gaz Iqbal +gclinch on github +Gealber Morales +Geeknik Labs +Geoff Beier +Georeth Zhou +George Liu +Georg Horn +Georg Huettenegger +Georg Lippitsch +Georg Wicherski +Gerd v. Egidy +Gergely Nagy +Gerhard Herre +Gerome Fournier +Gerrit Bruchhäuser +Gerrit Renker +Ghennadi Procopciuc +Giancarlo Formicuccia +Giaslas Georgios +Gilad +Gilbert Ramirez Jr. +Gilles Blanc +Gilles Vollant +Gil Weber +Giorgos Oikonomou +Gisle Vanem +git-bruh on github +GitYuanQu on github +Giuseppe Attardi +Giuseppe D'Ambrosio +Giuseppe Persico +gkarracer on github +Gleb Ivanovsky +Glen A Johnson Jr. +Glen Nakamura +Glenn de boer +Glenn Sheridan +Glenn Strauss +Glen Scott +godmar on github +Godwin Stewart +Gökhan Şengün +Gonçalo Carvalho +Google Inc. +Gordon Marler +Gordon Parke +Gorilla Maguila +Goro FUJI +Götz Babin-Ebell +Gou Lingfeng +Graham Campbell +Graham Christensen +Grant Erickson +Grant Pannell +graywolf on github +Greg Hewgill +Greg Morse +Greg Onufer +Gregor Jasny +Gregory Jefferis +Gregory Muchka +Gregory Nicholls +Gregory Panakkal +Gregory Szorc +Greg Pratt +Greg Rowe +Greg Zavertnik +Griffin Downs +Grigory Entin +Grisha Levit +Gruber Glass +Guenole Bescon +Guido Berhoerster +Guilherme Puida +Guillaume Algis +Guillaume Arluison +guitared on github +Gunamoi Software +Gunter Knauf +guoxinvmware on github +Gustaf Hui +Gustavo Grieco +Gusted +Guy Poizat +GwanYeong Kim +Gwenole Beauchesne +Gwen Shapira +h1zzz on github +H3RSKO on github +Hagai Auro +Haibo Huang +Hakan Sunay Halil +Hamish Mackenzie +hammlee96 on github +hamstergene on github +Hang Kin Lau +Hang Su +Han Han +Hannah Schierling +Hannes Magnusson +Hanno Böck +Hanno Kranzhoff +Han Qiao +Hans-Christian Egtvedt +Hans-Christian Noren Egtvedt +Hans-Jurgen May +Hans Steegers +Hao Wu +Hardeep Singh +Haris Okanovic +Harmen Stoppels +Harold Stuart +Harry Mallon +Harry Sarson +Harry Sintonen +Harshal Pradhan +Hauke Duden +Haydar Alaidrus +Hayden Roche +Heikki Korpela +Heinrich Ko +Heinrich Schaefer +Helge Klein +Helmut Grohne +Helmut K. C. Tessarek +Helwing Lutz +Hendrik Visage +Henning Schild +Henri Gomez +Henrik Gaßmann +Henrik Holst +henrikjehgmti on github +Henrik Storner +Henry Ludemann +Henry Roeland +He Qin +Hermes Zhang +Herve Amblard +HexTheDragon +hgdagon on github +Hide Ishikawa +Hidemoto Nakada +highmtworks on github +hiimmat on github +Himanshu Gupta +Hind Montassif +Hiroki Kurosawa +Hirotaka Tagawa +Ho-chi Chen +Hoi-Ho Chan +Hongfei Li +Hongli Lai +Hongyi Zhao +Howard Blaise +Howard Chu +hsiao yi +HsiehYuho on github +htasta on github +Hubert Kario +Hugh Macdonald +Hugo van Kemenade +humbleacolyte +Huzaifa Sidhpurwala +huzunhao on github +hydra3333 on github +Hzhijun +iammrtau on github +Ian Blanes +Ian D Allen +Ian Fette +Ian Ford +Ian Gulliver +Ian Lynagh +Ian Spence +Ian Turner +Ian Wilkes +iAroc on github +IcedCoffeee on github +iconoclasthero +icy17 on github +Ignacio Vazquez-Abrams +Igor Franchuk +Igor Khristophorov +Igor Makarov +Igor Novoseltsev +Igor Polyakov +Igor Todorovski +Ihor Karpenko +ihsinme on github +Iida Yosiaki +Ikko Ashimine +Ilguiz Latypov +Ilja van Sprundel +Illarion Taev +illusory-dream on github +Ilmari Lauhakangas +Ilya Kosarev +imilli on github +Immanuel Gregoire +ImpatientHippo on github +Inca R +infinnovation-dev on github +Ingmar Runge +Ingo Ralf Blum +Ingo Wilken +Inho Oh +Int64x86 on github +Ionuț-Francisc Oancea +Irfan Adilovic +Ironbars13 on github +Irving Wolfe +Isaac Boukris +Isaiah Norton +Ishan SinghLevett +İsmail Dönmez +Ithubg on github +Ivan +Ivan Avdeev +ivanfywang +Ivan Kuchin +IvanoG on github +Ivan Tsybulin +Ivo Bellin Salarin +iz8mbw on github +Jackarain on github +JackBoosY on github +Jack Boos Yu +Jacky Lam +Jack Zhang +Jacob Barthelmeh +Jacob Champion +Jacob Hoffman-Andrews +Jacob Mealey +Jacob Meuser +Jacob Moshenko +Jacob Tolar +Jactry Zeng +Jad Chamcham +Jaime Fullaondo +Jake Yuesong Li +jakirkham on github +Jakob Hirsch +Jakub Bochenski +Jakub Jelen +Jakub Wilk +Jakub Zakrzewski +James Abbatiello +James Atwill +James Brown +James Bursa +James Cheng +James Clancy +James Cone +James Dury +James Fuller +James Gallagher +James Griffiths +James Housley +James Keast +James Knight +James Le Cuirot +James Lucas +James MacMillan +James Slaughter +Jamie Lokier +Jamie Newton +Jamie Wilkinson +Jan Alexander Steffens +JanB on github +Jan Chren +janedenone on github +Jan Ehrhardt +Jan Engelhardt +Jan Koen Annot +janko-js on github +Jan Kunder +Jan Macku +Jan Mazur +Janne Blomqvist +Janne Johansson +János Fekete +Jan-Piet Mens +Jan Schaumann +Jan Schmidt +Jan Van Boghout +Jan Venekamp +Jan Verbeek +Jared Jennings +Jared Lundell +Jari Aalto +Jari Sundell +jasal82 on github +Jason Baietto +Jason Glasgow +Jason Hood +Jason Juang +Jason Lee +Jason Liu +Jason McDonald +Jason S. Priebe +Javier Barroso +Javier Blazquez +Javier G. Sogo +Javier Navarro +Javier Sixto +Jay Austin +Jay Dommaschk +Jayesh A Shah +Jay Guerette +Jay Wu +Jaz Fresh +JazJas on github +jbgoog on github +J. Bromley +Jean-Christophe Amiel +Jean-Claude Chauve +Jean Fabrice +Jean-Francois Bertrand +Jean-Francois Durand +Jean Gressmann +Jean Jacques Drouin +Jean-Louis Lemaire +Jean-Marc Ranger +Jean-Noël Rouvignac +Jean-Philippe Barrette-LaPierre +Jean-Philippe Menil +Jeff Connelly +Jeff Hodges +Jeff Johnson +Jeff King +Jeff Lawson +Jeff Luszcz +Jeff Mears +Jeff Phillips +Jeff Pohlmeyer +Jeffrey Tolar +Jeffrey Walton +jeffrson on github +Jeff Weber +Jelle van der Waa +Jenny Heino +Jens Finkhaeuser +Jens Rantil +Jens Schleusener +Jeremie Rapin +Jeremy Drake +Jeremy Falcon +Jeremy Friesner +Jeremy Huddleston +Jeremy Lainé +Jeremy Lin +Jeremy Maitin-Shepard +Jeremy Pearson +Jérémy Rabasco +Jérémy Rocher +Jeremy Tan +Jeremy Thibault +Jeroen Koekkoek +Jeroen Ooms +Jérôme Leclercq +Jerome Mao +Jerome Muffat-Meridol +Jerome Robert +Jerome St-Louis +Jerome Vouillon +Jerry Krinock +Jerry Wu +Jes Badwal +Jesper Jensen +Jesse Chisholm +Jesse Noller +Jesse Tan +Jess Lowe +Jesus Malo Poyatos +jethrogb on github +jhoyla on github +Jiacai Liu +Jiang Wenjian +Jiawen Geng +Jie He +Jiehong on github +Jilayne Lovejoy +Jim Beveridge +Jim Drash +Jim Freeman +Jim Fuller +Jim Hollinger +Jim King +Jim Meyering +Jimmy Gaussen +Jimmy Sjölund +Jiří Bok +Jiri Dvorak +Jiri Hruska +Jiri Jaburek +Jiří Malák +Jiri Stary +Jishan Shaikh +Jiwoo Park +Jixinqi +jkamp-aws on github +jmdavitt on github +jnbr on github +Jocelyn Jaubert +Jochem Broekhoff +Jochen Sprickerhof +Joe Birr-Pixton +Joe Cise +Joe Halpin +JoelAtWisetech on github +Joel Chen +Joel Depooter +Joel Jakobsson +Joel Teichroeb +Joe Malicki +Joe Mason +joey-l-us on github +Jofell Gallardo +Johan Anderson +Johan Eliasson +Johan Lantz +Johann150 on github +Johannes Bauer +Johannes Ernst +Johannes G. Kristinsson +Johannes Lesr +Johannes Schindelin +Johan Nilsson +Johann Sebastian Schicho +Johan van Selst +John A. Bristor +John Bampton +John Bradshaw +John Butterfield +John Coffey +John Crow +John David Anglin +John DeHelian +John Dennis +John Dunn +John E. Malmberg +John Gardiner Myers +John Hascall +John Haugabook +John Hawthorn +John H. Ayad +John Janssen +John Joseph Bachir +John Kelly +John Kohl +John Lask +John Levon +John Lightsey +John Marino +John-Mark Bell +John Marshall +John McGowan +Johnny Luong +John P. McCaskey +John Porter +John Schroeder +John Sherrill +John Simpson +John Starks +John Suprock +John V. Chow +John Walker +John Wanghui +John Weismiller +John Wilkinson +Jojojov on github +Jonas Bülow +Jonas Forsman +Jonas Haag +Jonas Minnberg +Jonas Schnelli +Jonas 'Sortie' Termansen +Jonas Vautherin +Jonatan Lander +Jonatan Vela +Jonathan Cardoso Machado +Jonathan Hseu +Jonathan Matthews +Jonathan Moerman +Jonathan Nieder +Jonathan Perkin +Jonathan Rosa +Jonathan Watt +Jonathan Wernberg +Jon DeVree +Jongki Suwandi +Jon Grubbs +Jon Johnson Jr +Jon Nelson +jonny112 on github +Jon Rumsey +Jon Sargeant +Jon Seymour +Jon Spencer +Jon Torrey +Jon Travis +Jon Turner +Jon Wilkes +Joombalaya on github +Joonas Kuorilehto +Jordan Brown +Jörg Mueller-Tolk +Jörn Hartroth +Jose Alf +Josef Wolf +José Joaquín Atria +Jose Kahan +Joseph Chen +Joseph Tharayil +Josh Bialkowski +Josh Brobst +joshhe on github +Joshix-1 on github +Josh Kapell +Josh McCullough +Josh Soref +Joshua Kwan +Joshua Root +Joshua Swink +Josie Huddleston +Josip Medved +Josue Andrade Gomes +Jozef Kralik +Juan Barreto +Juan Cruz Viotti +Juan F. Codagnone +Juan Ignacio Hervás +Juan RP +Judson Bishop +Juergen Hoetzel +Juergen Wilke +Jukka Pihl +Julian K. +Julian Montes +Julian Noble +Julian Ospald +Julian Romero Nieto +Julian Taylor +Julian Z +Julien Chaffraix +Julien Nabet +Julien Royer +Juliusz Sosinowicz +jungle-boogie on github +Junho Choi +Jun-ichiro itojun Hagino +junsik on github +Jun Tseng +Jun-ya Kato +Jürgen Gmach +Jurij Smakov +jurisuk on github +Juro Bystricky +JustAnotherArchivist on github +justchen1369 on github +Justin Clift +Justin Ehlert +Justin Fletcher +Justin Karneges +Justin Maggard +Justin Steventon +jveazey on github +jvreelanda on github +jvvprasad78 on github +jzinn on github +ka7 on github +Kael1117 on github +Kai Engert +Kailun Qin +Kai Noda +Kai Pastor +Kai Sommerfeld +Kai-Uwe Rommel +Kalle Vahlman +kalvdans on github +Kamil Dudka +Kane York +Kang-Jin Lee +Kang Lin +Kantanat Wannapaka +Kareem +Kari Pahula +Karl Chen +Karl Moerder +Karol Pietrzak +Kartatz on github +Karthikdasari0423 on github +Kartik Mahajan +Kaspar Brand +Katie Wang +Katsuhiko YOSHIDA +kayrus on github +Kazuho Oku +kchow-FTNT on github +Keerthi Timmaraju +Kees Cook +Kees Dekker +Keitagit-kun on github +Keith MacDonald +Keith McGuigan +Keith Mok +Kelly Kaoudis +Ken Brown +Ken Hirsch +Kenneth Davidson +Kenneth Myhra +Kenny To +Ken Rastatter +Kent Boortz +Kerem Kat +Keshav Krity +Kevin Adler +Kevin Baughman +Kevin Burke +Kevin Daudt +Kevin Fisk +Kevin Ji +Kevin Lussier +Kevin R. Bulgrien +Kevin Reed +Kevin Roth +Kevin Ryan +Kevin Smith +Kevin Sun +Kevin Ushey +Kev Jackson +Kim Minjoong +Kimmo Kinnunen +Kim Rinnewitz +Kim Vandry +kirbyn17 on hackerone +Kirill Efimov +Kirill Marchuk +kit-ty-kate on github +Kjell Ericson +Kjetil Jacobsen +kkalganov on github +Klaus Crusius +Klaus Stein +Klevtsov Vadim +Kobi Gurkan +Koen Dergent +Koichi Shiraishi +kokke on github +Konstantin Isakov +Konstantin Kushnir +Konstantin Kuzov +Konstantin Vlasov +KotlinIsland on github +kotoriのねこ +koujaz on github +kouzhudong on github +Kovalkov Dmitrii +kpcyrd on github +kreshano on github +Krishnendu Majumdar +Kris Kennaway +Krister Johansen +Kristian Gunstone +Kristian Köhntopp +Kristian Mide +Kristiyan Tsaklev +Kristoffer Gleditsch +kriztalz +K. R. Walker +Kuan-Wei Chiu +Kunal Chandarana +Kunal Ekawde +Kurt Fankhauser +Kushal Das +Kvarec Lezki +kwind on github +Kwon-Young Choi +Kyle Abramowitz +kyled-dell on github +Kyle Edwards +Kyle J. McKay +Kyle L. Huff +Kyle Sallee +Kyohei Kadota +Kyselgov E.N +l00p3r on Hackerone +Lachlan O'Dea +Ladar Levison +Lance Ware +Laramie Leavitt +Larry Campbell +Larry Fahnoe +Larry Lin +Larry Stefani +Larry Stone +Lars Buitinck +Lars Francke +Lars Gustafsson +Lars J. Aas +Lars Johannesen +Lars Karlitski +Lars Kellogg-Stedman +Lars Nilsson +Lars Torben Wilson +Lau +Laurent Bonnans +Laurent Dufresne +Laurențiu Nicola +Laurent Rabret +Laurie Clark-Michalek +Lauri Kasanen +Lawrence Gripper +Lawrence Matthews +Lawrence Wagerfield +Leah Neukirchen +Lealem Amedie +Leandro Coutinho +Lee Li +LeeRiva +Legoff Vincent +Lehel Bernadt +Leif W +Leigh Purdie +Leith Bade +Lenaic Lefever +Len Krause +Len Marinaccio +Lenny Rachitsky +Leonardo Rosati +Leonardo Taccari +Leon Breedt +Leo Neat +Leon Timmermans +Leon Winter +Leszek Kubik +lf- on github +Liam Healy +Liam Warfield +LigH-de on github +lijian996 on github +Lijo Antony +lilongyan-huawei on github +Linas Vepstas +Lindley French +Ling Thio +Linos Giannopoulos +Lin Sun +Linus Lewandowski +Linus Nielsen Feltzing +Linus Nordberg +Lior Kaplan +Lisa Xu +Litter White +Liviu Chircu +Li Xinwei +Liza Alenchery +lizhuang0630 on github +lkordos on github +lllaffer on github +Lloyd Fournier +Lluís Batlle i Rossell +locpyl-tidnyd on github +Loganaden Velvindron +Logan Buth +Loic Dachary +Loïc Yhuel +lolbinarycat on github +lomberd2 on github +LoRd_MuldeR +Loren Kirkby +Lorenzo Miniero +Louis Solofrizzo +lRoccoon on github +Luan Cestari +Luật Nguyễn +Luca Altea +Luca Boccassi +Luca Niccoli +Lucas Adamski +Lucas Clemente Vella +Lucas Holt +Lucas Nussbaum +Lucas Pardue +Lucas Servén Marín +Lucas Severo +Lucien Zürcher +Ludek Finstrle +Ludovico Cavedon +Ludwig Nussel +Lukas Ruzicka +Lukas Tribus +Lukáš Zaoral +Lukasz Czekierda +Łukasz Domeradzki +lukaszgn on github +Luke Amery +Luke Call +Luke Dashjr +Luke Granger-Brown +Luke Hamburg +luminixinc on github +Luo Jinghua +Luong Dinh Dung +Luz Paz +lwthiker on github +Lyman Epp +Lyndon Hill +Maarten Billemont +Maciej Domanski +Maciej Karpiuk +Maciej Puzio +Maciej W. Rozycki +MacKenzie +madblobfish on github +MaeIsBad on github +magisterquis on hackerone +Mahmoud Samir Fayed +Maksim Arhipov +Maksim Kuzevanov +Maksim Ściepanienka +Maksim Stsepanenka +Maks Naumov +Maksymilian Arciemowicz +Malik Idrees Hasan Khan +Mamoru Tasaka +Mamta Upadhyay +Mandy Wu +Manfred Schwarb +Manuel Einfalt +Manuel Massing +Manuel Strehl +Manuj Bhatia +Marc Aldorasi +Marc-Antoine Perennou +Marc Boucher +Marc Deslauriers +Marc Doughty +Marcel Hernandez +Marcelo Echeverria +Marcelo Juchem +Marcel Raad +Marcel Roelofs +marc-groundctl on github +Marc Hesse +Marc Hörsken +Marcin Adamski +Marcin Gryszkalis +Marcin Konicki +Marcin Rataj +Marc Kleine-Budde +Marco Deckel +Marco G. Salvagno +Marco Kamner +Marco Maggi +Marcos Diazr +marcos-ng on github +Marc Renault +Marc Schlatter +Marcus Hoffmann +Marcus Klein +Marcus Müller +Marcus Sundberg +Marcus T +Marcus Webster +Margu +Marian Klymov +Marin Hannache +Mario Schroeder +Marius Albrecht +Marius Kleidl +Mark Brand +Mark Butler +Mark Davies +Mark Dodgson +Mark Gaiser +Mark Hamilton +Mark Huang +Mark Incley +Mark Itzcovitz +Mark Karpeles +Mark Lentczner +Mark Nottingham +Mark Phillips +Mark Roszko +Mark Salisbury +Mark Seuffert +Mark Sinkovics +Mark Snelling +Mark Swaanenburg +Mark Tully +Markus Duft +Markus Elfring +Markus Koetter +Markus Moeller +Markus Oberhumer +Markus Olsson +Markus Sommer +Markus Westerlind +Mark W. Eichin +Mark Wotton +Maros Priputen +Marquis de Muesli +marski on github +Martijn Koster +Martin Ågren +Martin Ankerl +Martin Bašti +Martin C. Martin +Martin D'Aloia +Martin Dorey +Martin Drasar +Martin Dreher +martinevsky +Martin Frodl +Martin Galvan +Martin Gartner +Martin Hager +Martin Halle +Martin Harrigan +Martin Hedenfalk +Martin Howarth +Martin Jansen +Martin Kammerhofer +Martin Kepplinger +Martin Lemke +Martin Peck +Martin Schmatz +Martin Skinner +Martin Staael +Martin Storsjö +Martin Strunz +Martin V +Martin Vejnár +Martin Waleczek +Martxel +Marty Kuhrt +Maruko +Marwan Yassini +Masaya Suzuki +masbug on github +Massimiliano Fantuzzi +Massimiliano Ziccardi +Massimo Callegari +MasterInQuestion on github +Master Inspire +Mateusz Loskot +Mathew Benson +Mathias Axelsson +Mathias Fuchs +Mathias Gumz +Mathieu Carbonneaux +Mathieu Garaud +Mathieu Legare +Matias N. Goldberg +Mats Lidell +Mats Lindestam +Matt Arsenault +Matteo Baccan +Matteo Bignotti +Matteo Bignottignotti +Matteo Rocco +Matt Ford +Matthew Blain +Matthew Clarke +Matthew Hall +Matthew Kerwin +Matthew Thompson +Matthew Whitehead +Matthias Bolte +Matthias Gatto +Matthias Naegler +Matthieu Baerts +Matt Holt +Mattias Fornander +Matt Jolly +Matt Kraai +Matt McClure +Matt Veenstra +Matt Witherspoon +Matt Wixson +Matus Uzak +mauke +Maurice Barnum +Maurício Meneghini Fauth +Mauricio Scheffer +Mauro Iorio +Mauro Rappa +Max Dymond +Max Eliaser +Max Faxälv +Maxim Dzhura +Maxime Larocque +Maxime Legros +Maxim Ivanov +Maxim Perenesenko +Maxim Prohorov +Max Katsev +Max Kellermann +Max Khon +Max Mehl +Max Peal +Max Savenkov +Max Zettlmeißl +mbeifuss on github +mccormickt12 on github +Median Median Stride +mehatzri on github +Mehmet Bozkurt +Mekonikum +Melissa Mears +Melroy van den Berg +Mel Zuser +Mert Yazıcıoğlu +Mettgut Jamalla +Micah Snyder +Michael Afanasiev +Michael Anti +Michael Baentsch +Michael Benedict +Michael Brehm +Michael Brown +Michael Calmer +Michael Cronenworth +Michael Curtis +Michael Day +Michael Drake +Michael Felt +Michael Forney +Michael Gmelin +Michael Goffioul +Michael Heimpold +Michael Hordijk +Michael Jahn +Michael Jerris +Michael Kalinin +Michael Kaufmann +Michael Kilburn +Michael Kolechkin +Michael König +Michael Kujawa +Michael Lee +Michael Litwak +Michael Maltese +Michael Mealling +Michael Mueller +Michael Musset +Michael O'Farrell +Michael Olbrich +Michael Osipov +Michael Schmid +Michael Schuster +Michael Smith +Michael Stapelberg +Michael Steuer +Michael Stillwell +Michael Trebilcock +Michael Vittiglio +Michael Wallner +Michał Antoniak +Michal Bonino +Michal Čaplygin +Michał Fita +Michał Górny +Michał Janiszewski +Michał Kowalczyk +Michal Marek +Michał Petryka +Michał Piechowski +Michal Rus +Michal Trybus +Michele Bini +Michel Promonet +Miguel Angel +Miguel Diaz +migueljcrum on github +Mihai Ionescu +Mikael Johansson +Mikael Sennerholm +Mikalai Ananenka +Mike Bytnar +Mike Crowe +Mike Dobbs +Mike Dowell +Mike Duglas +Mike Frysinger +Mike Gelfand +Mike Giancola +Mike Hasselberg +Mike Henshaw +Mike Hommey +Mike Mio +Mike Norton +Mike Power +Mike Protts +Mike Revi +Mike Tzou +Mikhail Kuznetsov +Miklos Nemeth +Milon Renatus +Miloš Ljumović +Mingliang Zhu +Mingtao Yang +Miroslav Franc +Miroslav Spousta +Mischa Salle +Mitz Wark +mkzero on github +modbw on github +Mohamed Daahir +Mohamed Lrhazi +Mohamed Osama +Mohammad AlSaleh +Mohammad Hasbini +Mohammadreza Hendiani +Mohammed Naser +Mohammed Sadiq +Mohun Biswas +momala454 on github +Momoka Yamamoto +MonkeybreadSoftware on github +Montg0mery on github +moohoorama on github +Morgan Willcock +Moritz +Moritz Buhl +Moritz Knüsel +Morten Minde Neergaard +Mostyn Bramley-Moore +Moti Avrahami +MrdUkk on github +MrSorcus on github +M.R.T on github +mschroeder-fzj on github +Muhammad Herdiansyah +Muhammad Hussein Ammari +Muhammed Yavuz Nuzumlalı +Murugan Balraj +musvaage on github +Muz Dima +Myk Taylor +n0name321 on github +Nach M. S. +Nagai H +naost3rn on github +Nao Yonashiro +Natanael Copa +Nate Prewitt +Nathanael Nerode +Nathan Coulter +Nathaniel J. Smith +Nathaniel R. Lewis +Nathaniel Waisbrot +Nathan Moinvaziri +Nathan O'Sullivan +na-trium-144 on github +Naveen Chandran +Naveen Noel +Neal McBurnett +Neal Poole +nedres on github +neex on github +Nehal J Wani +neheb on github +Neil Bowers +Neil Dunbar +Neil Horman +Neil Johari +Neil Kolban +Neil Spring +NeimadTL +nekopsykose on github +Nemos2024 on github +neutric on github +nevv on HackerOne/curl +newfunction +newfunction on hackerone +Niall McGee +Niall O'Reilly +nian6324 on github +nianxuejie on github +Nicholas Maniscalco +Nicholas Nethercote +Nick Banks +Nick Coghlan +Nick Draffen +Nick Gimbrone +Nick Humfrey +Nicklas Avén +Nick Miyake +nick-telia on github +Nick Zitzmann +nico-abram on github +Nico Baggus +Nicolas Berloquin +Nicolas Croiset +Nicolas F. +Nicolas François +Nicolas George +Nicolas Grekas +Nicolas Guillier +Nicolas Morey-Chaisemartin +Nicolas Noben +Nicolás Ojeda Bär +Nicolás San Martín +Nicolas Sterchele +Nico Rieck +Nic Roets +Niels Martignène +Niels van Tongeren +Nigel Brittain +Nikita Schmidt +Nikita Taranov +Nikitinskit Dmitriy +Niklas Angebrand +Niklas Hambüchen +Nikolai Kondrashov +Nikos Mavrogiannopoulos +Nikos Tsipinakis +Nils Goroll +nimaje on github +niner on github +Ning Dong +Niracler Li +Niranjan Hasabnis +Nir Soffer +Nis Jorgensen +nk +Noam Moshe +nobedee on github +NobodyXu on github +Nobuhiro Ban +Nodak Sodak +nono303 on github +nopjmp on github +Norbert Frese +Norbert Kett +norbertmm on github +Norbert Novotny +nosajsnikta on github +NTMan on github +Nuru on github +Octavio Schroeder +odek86 on github +Ofer +ohyeaah on github +Okhin Vasilij +Olaf Flebbe +Olaf Hering +Olaf Stüben +Ola Mork +Oleg Jukovec +Oleg Pudeyev +Oleguer Llopart +Olen Andoni +olesteban on github +Oli Kingshott +Oliver Chang +Oliver Gondža +Oliver Graute +Oliver Kuckertz +oliverpool on github +Oliver Roberts +Oliver Schindler +Oliver Urbann +Olivier Berger +Olivier Bonaventure +Olivier Brunel +Omar Ramadan +omau on github +Ondřej Hlavatý +Ondřej Koláček +opensignature on github +opensslonzos-github on github +Ophir Lojkine +Orange Tsai +Oren Souroujon +Oren Tirosh +Orgad Shaneh +Ori Avtalion +orycho on github +osabc on github +Osaila on github +Osama Albahrani +Oscar Koeroo +Oscar Norlander +Oskar Liljeblad +Oskar Sigvardsson +Oumph on github +Outvi V +ovidiu-benea on github +Ozan Cansel +Pablo Busse +Palo Markovic +pandada8 on github +Paolo Mossino +Paolo Piacentini +Paras Sethia +parazyd on github +Pascal Gaudette +Pascal Terjan +Pasha Kuznetsov +Pasi Karkkainen +patelvivekv1993 on github +patnyb on github +Pat Ray +Patrice Guerin +Patricia Muscalu +Patrick Bihan-Faou +Patrick Dawson +Patrick McManus +Patrick Monnerat +Patrick Rapin +Patrick Schlangen +Patrick Scott +Patrick Smith +Patrick Steinhardt +Patrick Watson +Patrik Thunstrom +Pau Garcia i Quiles +Paul B. Omta +Paul Donohue +Paul Dreik +Paul Gilmartin +Paul Groke +Paul Harrington +Paul Harris +Paul Hoffman +Paul Howarth +Paul Johnson +Paul Joyce +Paul Marks +Paul Marquis +Paul Moore +Paul Nolan +Paul Oliver +Paulo Roberto Tomasi +Paul Querna +Paul Saab +Paul Seligman +Paul Vixie +Paul Wise +Pavel Cenek +Pavel Gushchin +Pavel Kalyugin +Pavel Kropachev +Pavel Löbl +Pavel Mayorov +Pavel Orehov +Pavel Pavlov +Pavel Raiskup +Pavel Rochnyak +Pavel Volgarev +Pavol Markovic +Pawel A. Gajda +Pawel Kierski +Paweł Kowalski +Paweł Wegner +Paweł Witas +PBudmark on github +Pedro Henrique +Pedro Larroy +Pedro Monreal +Pedro Neves +pendrek at hackerone +Peng Li +Peng-Yu Chen +Per Jensen +Per Lundberg +Per Malmberg +Per Nilsson +Pete Cordell +Pete Lomax +Peter Bray +Peter Forret +Peter Frühberger +Peter Gal +Peter Goodman +Peter Heuchert +Peter Hjalmarsson +Pēteris Caune +Peteris Krumins +Peter Kokot +Peter Körner +Peter Korsgaard +Peter Krefting +Peter Lamare +Peter Lamberg +Peter Laser +Peter Marko +Peter O'Gorman +Peter Pentchev +Peter Piekarski +Peter Silva +Peter Simonyi +Peter Su +Peter Sumatra +Peter Sylvester +Peter Todd +Peter Varga +Peter Verhas +Peter Wang +Peter Wu +Peter Wullinger +Petr Bahula +Petr Novak +Petr Pisar +Petr Štetiar +Petr Voytsik +Phil Blundell +Phil Crump +Phil E. Taylor +Philip Chan +Philip Craig +Philip Gladstone +Philip Heiduck +Philip Langdale +Philippe Antoine +Philippe Antoine on HackerOne +Philippe Hameau +Philippe Marguinaud +Philipp Engel +Philippe Raoult +Philippe Vaucher +Philipp Klaus Krause +Philip Prindeville +Philipp Waehnert +Philip Sanetra +Phil Karn +Phil Lisiecki +Phil Pellouchoud +Pierre +Pierre Brico +Pierre Chapuis +Pierre-Etienne Meunier +Pierre Joye +Pierre Yager +Pierre Ynard +Pierre-Yves Bigourdan +Pierrick Charron +Piotr Dobrogost +Piotr Komborski +PleaseJustDont +Po-Chuan Hsieh +Pontakorn Prasertsuk +Pontus Lundkvist +Pooyan McSporran +Poul T Lomholt +Pramod Sharma +Prash Dush +Praveen Pvs +Prithvi MK +privetryan on github +Priyanka Shah +ProceduralMan on github +promptfuzz_ on hackerone +Pronyushkin Petr +prpr19xx on github +P R Schaffner +Przemysław Tomaszewski +pszemus on github +pszlazak on github +puckipedia on github +Puneet Pawaia +qhill +qhill on github +qiandu2006 on github +Qriist on github +Quagmire +Quanah Gibson-Mount +Quentin Balland +Quinn Slack +Radek Brich +Radek Zajic +Radoslav Georgiev +Radu Hociung +Radu Simionescu +Rafael Antonio +Rafaël Carré +Rafael Sagula +Rafał Mikrut +Rafa Muyo +Rafayel Mkrtchyan +Rahul Krishna M +Rainer Canavan +Rainer Jung +Rainer Koenig +Rainer Müller +RainRat +Raito Bezarius +Rajesh Naganathan +Rajkumar Mandal +Ralf A. Timmermann +ralfjunker on github +Ralf S. Engelschall +Ralph Beckmann +Ralph Langendam +Ralph Mitchell +Ralph Sennhauser +Ramiro Garcia +Ram Krushna Mishra +rampageX on github +ramsay-jones on github +RanBarLavie on github +Randall S. Becker +Randolf J +Randy Armstrong +Randy McMurchy +Ran Mozes +Raphael Gozzo +r-a-sattarov on github +Rasmus Melchior Jacobsen +Rasmus Thomsen +Raul Onitza-Klugman +Ravi Pratap +Ray Dassen +Ray Pekowski +Ray Satiro +Razvan Cojocaru +Razvan Pricope +rcombs on github +R. Dennis Steed +Red Hat Product Security +Reed Loden +Reinhard Max +Reinout van Schouwen +RekGRpth on github +Remco van Hooff +Remi Gacogne +Remo E +Rémy Léone +Renato Botelho +Renaud Allard +Renaud Chaillat +Renaud Duhaut +Renaud Guillard +Renaud Lehoux +Rene Bernhardt +Rene Rebe +renovate[bot] +renovate[bot] +Reuven Wachtfogel +RevaliQaQ on github +Reza Arbab +Rianov Viacheslav +riastradh on github +Ricardo Cadime +Ricardo Gomes +Ricardo Martins +Ricardo M. Correia +Richard Adams +Richard Alcock +Richard Archer +Richard Atterer +Richard Bowker +Richard Bramante +Richard Clayton +Richard Cooper +Richard Gorton +Richard Gray +Richard Hosking +Richard Hsu +Richard Levitte +Richard Marion +Richard Michael +Richard Moore +Richard Prescott +Richard Silverman +Richard van den Berg +Richard Whitehouse +Richard W.M. Jones +Rich Burridge +Rich FitzJohn +Rich Gray +Rich Mirch +Rich Rauenzahn +Rich Salz +Rich Turner +Richy Kim +Rici Lake +Rickard Hallerbäck +Rick Deist +Ricki Hirner +Rick Jones +Rick Lane +Rick Richardson +Rick Welykochy +Ricky Leverence +Ricky-Tigg on github +RiderALT on github +Rider Linden +Rikard Falkeborn +rilysh +Rinku Das +rl1987 on github +rmg-x on github +Rob Boeckermann +RobBotic1 on github +Robby Simpson +Rob Cotrone +Rob Crittenden +Rob Davies +Rob de Wit +Robert A. Monat +Robert B. Harris +Robert Brose +Robert Charles Muir +Robert Dunaj +Robert D. Young +Robert Foreman +Robert Iakobashvili +Robert Kolcun +Robert Linden +Robert Maynard +Robert Moreton +Robert Olson +Robert Prag +Robert Ronto +Robert Schumann +Robert Simpson +Robert Southee +Robert Weaver +Robert Wruck +Robin A. Meade +Robin Cornelius +Robin Douine +Robin Johnson +Robin Kay +Robin Marx +Rob Jones +Rob Sanders +Robson Braga Araujo +Rob Stanzel +Rob Ward +Rodger Combs +Rodney Simmons +Rodric Glaser +Rodrigo Silva +Rod Widdowson +Roger Leigh +Roger Orr +Roger Young +Roland Blom +Roland Hieber +Roland Krikava +Roland Zimmermann +Rolf Eike Beer +Rolland Dudemaine +Romain Coltel +Romain Fliedel +Romain Geissler +romamik om github +Roman Koifman +Roman Mamedov +Roman Zharkov +Romulo A. Ceccon +Ronald Crane +Ronan Pigott +Ron Eldor +Ronnie Mose +Ron Parker +Ron Zapp +Rosen Penev +Rosimildo da Silva +Ross Burton +roughtex on github +Roy Bellingan +Roy Li +Roy Shan +RubisetCie on github +Rudi Heitbaum +Rui LIU +Rui Pinheiro +Rune Kleveland +Ruslan Baratov +Ruslan Gazizov +Rutger Broekhoff +Rutger Hofman +Ruurd Beerstra +rwmjones on github +Ryan Beck-Buysse +Ryan Braud +ryancaicse on github +Ryan Carsten Schmidt +Ryan Chan +Ryan Mast +Ryan Nelson +Ryan Schmidt +Ryan Scott +Ryan Sleevi +Ryan Winograd +Ryuichi KAWAMATA +rzrymiak on github +s0urc3_ on hackerone +saimen +Sai Ram Kunala +Salah-Eddin Shaban +Saleem Abdulrasool +SaltyMilk +Salvador Dávila +Salvatore Sorrentino +Samanta Navarro +Sam Deane +Sam Hurst +Sam James +Sam Jessup +Sampo Kellomaki +Sam Roth +Sam Schanken +Samuel Chiang +Samuel Díaz García +Samuel Dionne-Riel +Samuel Henrique +Samuel Listopad +Samuel Marks +Samuel Surtees +Samuel Thibault +Samuel Tranchet +SandakovMM on github +Sander Gates +Sandor Feldi +Sandro Jaeckel +Sanjay Pujare +Santhana Todatry +Santino Keupp +Saqib Ali +Sara Golemon +Sarah Gooding +Saran Neti +Sascha Swiercy +Sascha Zengler +Satadru Pramanik +Satana de Sant'Ana +Saul good +saurabhsingh-dev on github +Saurav Babu +sayrer on github +sbernatsky on github +SBKarr on github +Scarlett McAllister +Scott Bailey +Scott Barrett +Scott Cantor +Scott Davis +Scott McCreary +Scott Mutter +Scott Talbert +sd0 on hackerone +Sean Boudreau +Sean Burford +Sean MacLennan +Sean McArthur +Sean Miller +Sean Molenaar +Sebastiaan van Erk +Sebastian Andersson +Sebastian Haglund +Sebastian Mundry +Sebastian Neubauer +Sebastian Pohlschmidt +Sebastian Rasmussen +Sebastian Sterk +Sebastian Walz +Sébastien Helleu +Sébastien Willemijns +selmelc on hackerone +SendSonS on github +Senthil Raja Velu +Sergei Kuzmin +Sergei Nikulov +Sergey +Sergey Alirzaev +Sergey Bronnikov +Sergey Fionov +Sergey Markelov +Sergey Ogryzkov +Sergey Ryabinin +Sergey Tatarincev +Sergii Kavunenko +Sergii Pylypenko +Sergio Ballestrero +Sergio Barresi +Sergio Borghese +Sergio Durigan Junior +Sergio-IME on github +Sergio Mijatovic +sergio-nsk on github +Serj Kalichev +Sertonix +SerusDev on github +Seshubabu Pasam +Seth Mos +Sevan Janiyan +sfan5 on github +Sgharat on github +Shachaf Ben-Kiki +ShadowZzj on github +Shailesh Kapse +Shankar Jadhavar +Shao Shuchao +Sharad Gupta +Shard +Sharon Brizinov +Shaun Jackman +Shaun Mirani +Shawn Landden +Shawn Poulson +Sh Diao +Sheshadri.V +Shikha Sharma +Shine Fan +Shiraz Kanga +shithappens2016 on github +Shlomi Fish +Shmulik Regev +Shohei Maeda +Siddhartha Prakash Jain +siddharthchhabrap on github +Sidney San Martín +Siegfried Gyuricsko +silveja1 on github +Simon Berger +Simon Chalifoux +Simon Dick +Simon H. +Simon Josefsson +Simon K +Simon Legner +Simon Liu +Simon Warta +simplerobot on github +Sinkevich Artem +Siva Sivaraman +Slaven Rezić +SLDiggie on github +Smackd0wn on github +S. Moonesamy +smuellerDD on github +sn on hackerone +sofaboss on github +Sohom Datta +Somnath Kundu +Song Ma +Sonia Subramanian +Sören Tempel +southernedge on github +Spacen Jasset +Spezifant on github +Spiridonoff A.V +Spoon Man +Spork Schivago +ssdbest on github +sspiri on github +sstruchtrup on github +Stadler Stephan +Stan Hu +Stanislav Ivochkin +Stanislav Lange +Stanislav Zidek +Stanley Wucw +Stan van de Burgt +Stathis Kapnidis +Stav Nir +steelman on github +Stefan Agner +Stefan Bühler +Stefan Eissing +Stefan Esser +Stefan Grether +Stefan Huber +Stefan Kanthak +Stefan Karpinski +Stefan Krause +Štefan Kremeň +Stefan Neis +Stefano Simonelli +Stefan Strogin +Stefan Talpalaru +Stefan Teleman +Stefan Tomanek +Stefan Ulrich +Stefan Yohansson +Steffen Kieß +Steinar H. Gunderson +steini2000 on github +Stepan Broz +Stepan Efremov +Stephan Bergmann +Stephane Pellegrino +Stephan Guilloux +Stephan Lagerholm +Stephan Mühlstrasser +Stephan Szabo +Stephen Boost +Stephen Brokenshire +Stephen Collyer +Stephen Farrell +Stephen Kick +Stephen M. Coakley +Stephen More +Stephen Toub +Sterling Hughes +Steve Green +Steve Havelka +Steve Herrell +Steve Holme +Steve H Truong +Steve Lhomme +Steve Little +Steve Marx +Steven Allen +Steven Bazyl +Steven G. Johnson +Steven Gu +Steven M. Schweda +stevenpackardblp on github +Steven Parkes +Steven Penny +Steve Oliphant +Steve Roskowski +Steve Walch +Stewart Gebbie +Stian Soiland-Reyes +Stoned Elipot +stootill on github +Stuart Henderson +Sukanya Hanumanthu +SumatraPeter on github +Sune Ahlgren +Sunny Bean +Sunny Purushe +SuperIlu on github +SuperStormer on github +Sven Anders +Sven Blumenstein +Sven Neuhaus +Sven Wegener +Svyatoslav Mishyn +swalkaus at yahoo.com +sylgal on github +Sylvestre Ledru +Symeon Paraschoudis +T200proX7 on github +Tadej Vengust +Tae Hyoung Ahn +Taiyu Len +Tal Regev +Tamás Bálint Misius +Tamir Duberstein +Taneli Vähäkangas +Tanguy Fautre +Taras Kushnir +tarek112 on github +Tatsuhiko Miyagawa +Tatsuhiro Tsujikawa +tawmoto on github +T. Bharath +tbugfinder on github +Ted Lyngmo +Teemu Yli-Elsila +Teh Kok How +Temprimus +Terence Eden +Terri Oda +Terry Wu +thanhchungbtc on github +TheAssassin on github +The Infinnovation team +TheKnarf on github +Theo +Theodore Dubois +therealhirudo on github +Thiago Suchorski +thisisgk on github +tholin on github +Thomas +Thomas1664 on github +Thomas Bouzerar +Thomas Braun +Thomas Danielsson +Thomas Ferguson +Thomas Gamper +Thomas Glanzmann +Thomas Guillem +Thomas J. Moore +Thomas Klausner +Thomas Lopatic +Thomas L. Shinnick +Thomas M. DuBuisson +Thomas Petazzoni +Thomas Pyle +Thomas Ruecker +Thomas Schwinge +Thomas Taylor +Thomas Tonino +Thomas van Hesteren +Thomas Vegas +Thomas Weißschuh +Thorsten Klein +Thorsten Schöning +Tianyi Song +Tiit Pikma +Till Maas +Till Wegmüller +Tim Ansell +Tim Baker +Tim Bartley +Tim Chen +Tim Costello +Tim Harder +Tim Heckman +Tim Hill +Tim Mcdonough +Timmy Schierling +Tim Newsome +Timo Lange +Timo Sirainen +Timotej Lazar +Timothe Litt +Timothy Gu +Timothy Polich +Timo Tijhof +Tim Rühsen +Tim Sedlmeyer +Tim Sneddon +Tim Stack +Tim Starling +Tim Tassonis +Timur Artikov +Tim Verhoeven +Tim Yuer +Tinus van den Berg +tinyboxvk +tiymat +TJ Saunders +Tk Xiong +tkzv on github +tlahn on github +tmkk on github +Tobias Blomberg +Tobias Bora +Tobias Gabriel +Tobias Hieta +Tobias Hintze +Tobias Lindgren +Tobias Markus +Tobias Nießen +Tobias Nygren +Tobias Nyholm +Tobias Rundström +Tobias Schaefer +Tobias Stoeckmann +Tobias Wendorff +Toby Peterson +Todd A Ouska +Todd Kaufmann +Todd Kulesza +Todd Short +Todd Vierling +Tomas Berger +Tomas Hoger +Tomas Jakobsson +Tomas Mlcoch +Tomas Mraz +Tomas Pospisek +Tomas Szepe +Tomas Tomecek +Tomas Volf +Tomasz Kojm +Tomasz Lacki +Tom Benoist +Tom Donovan +Tom Eccles +Tom G. Christensen +Tom Grace +Tom Greenslade +Tom Lee +Tom Mattison +Tommie Gannert +tommink[at]post.pl +Tom Moers +Tom Mueller +Tommy Chiang +Tommy Odom +Tommy Petty +Tommy Tam +Tom Regner +Tom Seddon +Tom Sparrow +Tom van der Woerdt +Tom Wright +tomy2105 on github +Tom Zerucha +Toni Moreno +Ton Voon +Tony Kelman +tonystz on github +Toon Claes +Toon Verwaest +Tor Arntsen +Torben Dannhauer +Torben Dury +Török Edwin +Torsten Foertsch +Toshio Kuratomi +Toshiyuki Maezawa +tpaukrt on github +Traian Nicolescu +Trail of Bits +tranzystorekk on github +Travis Burtrum +Travis Lane +Travis Obenhaus +Trivikram Kamat +Troels Walsted Hansen +Troy Engel +trrui-huawei +Trumeet on github +Trzik on github +Tseng Jun +Tuomas Siipola +Tuomo Rinne +Tupone Alfredo +Turiiya +T. Yamada +Tyler Hall +u20221022 on github +Ulf Härnhammar +Ulf Samuelsson +Ulrich Doehner +Ulrich Telle +Ulrich Zadow +UnicornZhang on github +updatede on github +UrsusArctos on github +User Sg +ustcqidi on github +Vadim Grinshpun +Valentin David +Valentín Gutiérrez +Valentin Richter +Valentyn Korniienko +Valerii Zapodovnikov +vanillajonathan on github +Varnavas Papaioannou +Vasiliy Faronov +Vasiliy Ulyanov +Vasily Lobaskin +Vasy Okhin +Venkat Akella +Venkataramana Mokkapati +Venkat Krishna R +Vicente Garcia +Victor Kislov +Victor Magierski +Victor Snezhko +VictorVG on github +Victor Vieux +Vijay Panghal +Vikram Saxena +Viktor Petersson +Viktor Szakats +Vilhelm Prytz +Ville Skyttä +Vilmos Nebehaj +Vincas Razma +Vincent Bronner +Vincent Grande +Vincent Le Normand +Vincent Penquerc'h +Vincent Sanders +Vincent Torri +violetlige on github +vitaha85 on github +Vitaly Varyvdin +Vítor Galvão +vl409 on github +Vlad Grachov +Vladimir Grishchenko +Vladimir Kotal +Vladimir Lazarenko +Vladimir Panteleev +Vladimir Varlamov +Vladislavs Sokurenko +Vlad Ureche +Vlastimil Ovčáčík +vlkl-sap on github +vlubart on github +Vojtech Janota +Vojtěch Král +Vojtech Minarik +Volker Schmid +Vollstrecker on github +Vsevolod Novikov +vshmuk on hackerone +vulnerabilityspotter on hackerone +Vulpes Vulpes +vuonganh1993 on github +vvb2060 on github +Vyron Tsingaras +w0x42 on hackerone +Waldek Kozba +Walter J. Mack +wangzhikun +Ward Willats +Warren Menzer +Wayne Haigh +Wei Chong Tan +Wenchao Li +Weng Xuetian +Wenxiang Qian +Werner Koch +Werner Stolz +Wes Hinsley +wesinator on github +Wesley Laxton +Wesley Miaw +Wez Furlong +Wham Bang +Wilfredo Sanchez +Wilhelm von Thiele +Will Dietz +Willem Hoek +Willem Sparreboom +William Ahern +William A. Rowe Jr +William Desportes +William Tang +Will Roberts +Winni Neessen +W. Mark Kubacki +wmsch on github +wncboy on github +Wojciech Zwiefka +wolfsage on hackerone +Wolf Vollprecht +Wouter Van Rooy +Wu Yongzheng +Wu Zheng +wxiaoguang on github +Wyatt O'Day +Wyatt OʼDay +x1sc0 on github +x2018 on github +Xavier Bouchoux +XhmikosR on github +XhstormR on github +xiadnoring on github +Xiangbin Li +xianghongai on github +Xiang Xiao +xiaofeng +Xiaoke Wang +Xiaoyin Liu +Xì Gà +Xi Ruoyao +XmiliaH on github +xnynx on github +xtonik on github +xwxbug on github +XYenon +Yaakov Selkowitz +Yadhu Krishna M +Yair Lenga +Yang Tse +Yaobin Wen +Yarram Sunil +Yasuharu Yamada +Yasuhiro Matsumoto +Yechiel Kalmenson +Yedaya Katsman +Yehezkel Horowitz +Yehoshua Hershberg +ygthien on github +Yifei Kong +Yihang Zhou +Yi Huang +Yiming Jing +Yingwei Liu +yiyuaner on github +Ymir1711 on github +Yonggang Luo +Yongkang Huang +Yoshimasa Ohno +Younes El-karama +youngchopin on github +Yousuke Kimoto +Yukihiro Kawada +Yun SangHo +Yurii Rashkovskii +Yuri Slobodyanyuk +Yuriy Chernyshov +Yuriy Sosov +yushicheng7788 on github +Yusuke Nakamura +Yu Xin +Yves Arrouye +Yves Lejeune +YX Hao +z2_ +Zachary Seguin +Zdenek Pavlas +Zekun Ni +zelinchen on github +zengwei +zengwei2000 +Zenju on github +Zero King +Zespre Schmidt +zhanghu on xiaomi +Zhang Wen +Zhang Xiuhua +Zhaoming Luo +Zhaoyang Wu +Zhao Yisha +zhengqwe on github +Zhibiao Wu +zhihaoy on github +Zhouyihai Ding +ZimCodes on github +zjyhjqs +zloi-user on github +zmcx16 on github +Zmey Petroff +zopsicle on github +Zvi Har'El +zzq1015 on github +Борис Верховский +Коваленко Анатолий Викторович +наб +Никита Дорохин +ウさん +不确定 +加藤郁之 +南宫雪珊 +左潇峰 +李四 +梦终无痕 +積丹尼 Dan Jacobson +罗朝辉 diff --git a/curl/docs/TODO.txt b/curl/docs/TODO.txt new file mode 100644 index 0000000..9e398d8 --- /dev/null +++ b/curl/docs/TODO.txt @@ -0,0 +1,1375 @@ + _ _ ____ _ + ___| | | | _ \| | + / __| | | | |_) | | + | (__| |_| | _ <| |___ + \___|\___/|_| \_\_____| + + Things that could be nice to do in the future + + Things to do in project curl. Please tell us what you think, contribute and + send us patches that improve things. + + Be aware that these are things that we could do, or have once been considered + things we could do. If you want to work on any of these areas, please + consider bringing it up for discussions first on the mailing list so that we + all agree it is still a good idea for the project. + + All bugs documented in the KNOWN_BUGS document are subject for fixing. + + 1. libcurl + 1.1 TFO support on Windows + 1.2 Consult %APPDATA% also for .netrc + 1.3 struct lifreq + 1.4 alt-svc sharing + 1.5 get rid of PATH_MAX + 1.6 thread-safe sharing + 1.8 CURLOPT_RESOLVE for any port number + 1.9 Cache negative name resolves + 1.10 auto-detect proxy + 1.11 minimize dependencies with dynamically loaded modules + 1.12 updated DNS server while running + 1.13 c-ares and CURLOPT_OPENSOCKETFUNCTION + 1.14 connect to multiple IPs in parallel + 1.15 Monitor connections in the connection pool + 1.16 Try to URL encode given URL + 1.17 Add support for IRIs + 1.18 try next proxy if one does not work + 1.19 provide timing info for each redirect + 1.20 SRV and URI DNS records + 1.21 netrc caching and sharing + 1.22 CURLINFO_PAUSE_STATE + 1.23 Offer API to flush the connection pool + 1.25 Expose tried IP addresses that failed + 1.28 FD_CLOEXEC + 1.29 WebSocket read callback + 1.30 config file parsing + 1.31 erase secrets from heap/stack after use + 1.32 add asynch getaddrinfo support + 1.33 make DoH inherit more transfer properties + + 2. libcurl - multi interface + 2.1 More non-blocking + 2.2 Better support for same name resolves + 2.3 Non-blocking curl_multi_remove_handle() + 2.4 Split connect and authentication process + 2.5 Edge-triggered sockets should work + 2.6 multi upkeep + 2.7 Virtual external sockets + 2.8 dynamically decide to use socketpair + + 3. Documentation + 3.1 Improve documentation about fork safety + + 4. FTP + 4.1 HOST + 4.4 Support CURLOPT_PREQUOTE for directories listings + 4.6 GSSAPI via Windows SSPI + 4.7 STAT for LIST without data connection + 4.8 Passive transfer could try other IP addresses + + 5. HTTP + 5.1 Provide the error body from a CONNECT response + 5.2 Obey Retry-After in redirects + 5.3 Rearrange request header order + 5.4 Allow SAN names in HTTP/2 server push + 5.5 auth= in URLs + 5.6 alt-svc should fallback if alt-svc does not work + 5.7 Require HTTP version X or higher + + 6. TELNET + 6.1 ditch stdin + 6.2 ditch telnet-specific select + 6.3 feature negotiation debug data + 6.4 exit immediately upon connection if stdin is /dev/null + + 7. SMTP + 7.1 Passing NOTIFY option to CURLOPT_MAIL_RCPT + 7.2 Enhanced capability support + 7.3 Add CURLOPT_MAIL_CLIENT option + + 8. POP3 + 8.2 Enhanced capability support + + 9. IMAP + 9.1 Enhanced capability support + + 10. LDAP + 10.1 SASL based authentication mechanisms + 10.2 CURLOPT_SSL_CTX_FUNCTION for LDAPS + 10.3 Paged searches on LDAP server + 10.4 Certificate-Based Authentication + + 11. SMB + 11.1 File listing support + 11.2 Honor file timestamps + 11.3 Use NTLMv2 + 11.4 Create remote directories + + 12. FILE + 12.1 Directory listing on non-POSIX + + 13. TLS + 13.1 TLS-PSK with OpenSSL + 13.2 TLS channel binding + 13.3 Defeat TLS fingerprinting + 13.4 Consider OCSP stapling by default + 13.5 Export session ids + 13.6 Provide callback for cert verification + 13.7 Less memory massaging with Schannel + 13.8 Support DANE + 13.9 TLS record padding + 13.10 Support Authority Information Access certificate extension (AIA) + 13.11 Some TLS options are not offered for HTTPS proxies + 13.13 Make sure we forbid TLS 1.3 post-handshake authentication + 13.14 Support the clienthello extension + 13.16 Share the CA cache + 13.17 Add missing features to TLS backends + + 14. Proxy + 14.1 Retry SOCKS handshake on address type not supported + + 15. Schannel + 15.1 Extend support for client certificate authentication + 15.2 Extend support for the --ciphers option + 15.4 Add option to allow abrupt server closure + + 16. SASL + 16.1 Other authentication mechanisms + 16.2 Add QOP support to GSSAPI authentication + + 17. SSH protocols + 17.1 Multiplexing + 17.2 Handle growing SFTP files + 17.3 Read keys from ~/.ssh/id_ecdsa, id_ed25519 + 17.4 Support CURLOPT_PREQUOTE + 17.5 SSH over HTTPS proxy with more backends + 17.6 SFTP with SCP:// + + 18. Command line tool + 18.1 sync + 18.2 glob posts + 18.4 --proxycommand + 18.5 UTF-8 filenames in Content-Disposition + 18.6 Option to make -Z merge lined based outputs on stdout + 18.7 specify which response codes that make -f/--fail return error + 18.9 Choose the name of file in braces for complex URLs + 18.10 improve how curl works in a Windows console window + 18.11 Windows: set attribute 'archive' for completed downloads + 18.12 keep running, read instructions from pipe/socket + 18.13 Acknowledge Ratelimit headers + 18.14 --dry-run + 18.15 --retry should resume + 18.17 consider filename from the redirected URL with -O ? + 18.18 retry on network is unreachable + 18.19 expand ~/ in config files + 18.20 hostname sections in config files + 18.21 retry on the redirected-to URL + 18.23 Set the modification date on an uploaded file + 18.24 Use multiple parallel transfers for a single download + 18.25 Prevent terminal injection when writing to terminal + 18.26 Custom progress meter update interval + 18.27 -J and -O with %-encoded filenames + 18.28 -J with -C - + 18.29 --retry and transfer timeouts + + 19. Build + 19.2 Enable PIE and RELRO by default + 19.3 Do not use GNU libtool on OpenBSD + 19.4 Package curl for Windows in a signed installer + 19.5 make configure use --cache-file more and better + + 20. Test suite + 20.1 SSL tunnel + 20.2 more protocols supported + 20.3 more platforms supported + 20.4 write an SMB test server to replace impacket + 20.5 Use the RFC 6265 test suite + 20.6 Run web-platform-tests URL tests + + 21. MQTT + 21.1 Support rate-limiting + 21.2 Support MQTTS + 21.3 Handle network blocks + + 22. TFTP + 22.1 TFTP does not convert LF to CRLF for mode=netascii + + 23. Gopher + 23.1 Handle network blocks + +============================================================================== + +1. libcurl + +1.1 TFO support on Windows + + libcurl supports the CURLOPT_TCP_FASTOPEN option since 7.49.0 for Linux and + macOS. Windows supports TCP Fast Open starting with Windows 10, version 1607 + and we should add support for it. + + TCP Fast Open is supported on several platforms but not on Windows. Work on + this was once started but never finished. + + See https://github.com/curl/curl/pull/3378 + +1.2 Consult %APPDATA% also for .netrc + + %APPDATA%\.netrc is not considered when running on Windows. should not it? + + See https://github.com/curl/curl/issues/4016 + +1.3 struct lifreq + + Use 'struct lifreq' and SIOCGLIFADDR instead of 'struct ifreq' and + SIOCGIFADDR on newer Solaris versions as they claim the latter is obsolete. + To support IPv6 interface addresses for network interfaces properly. + +1.4 alt-svc sharing + + The share interface could benefit from allowing the alt-svc cache to be + possible to share between easy handles. + + See https://github.com/curl/curl/issues/4476 + + The share interface offers CURL_LOCK_DATA_CONNECT to have multiple easy + handle share a connection cache, but due to how connections are used they are + still not thread-safe when used shared. + + See https://github.com/curl/curl/issues/4915 and lib1541.c + + The share interface offers CURL_LOCK_DATA_HSTS to have multiple easy handle + share a HSTS cache, but this is not thread-safe. + +1.5 get rid of PATH_MAX + + Having code use and rely on PATH_MAX is not nice: + https://insanecoding.blogspot.com/2007/11/pathmax-simply-isnt.html + + Currently the libssh2 SSH based code uses it, but to remove PATH_MAX from + there we need libssh2 to properly tell us when we pass in a too small buffer + and its current API (as of libssh2 1.2.7) does not. + +1.6 thread-safe sharing + + Using the share interface users can share some data between easy handles but + several of the sharing options are documented as not safe and supported to + share between multiple concurrent threads. Fixing this would enable more + users to share data in more powerful ways. + +1.8 CURLOPT_RESOLVE for any port number + + This option allows applications to set a replacement IP address for a given + host + port pair. Consider making support for providing a replacement address + for the hostname on all port numbers. + + See https://github.com/curl/curl/issues/1264 + +1.9 Cache negative name resolves + + A name resolve that has failed is likely to fail when made again within a + short period of time. Currently we only cache positive responses. + +1.10 auto-detect proxy + + libcurl could be made to detect the system proxy setup automatically and use + that. On Windows, macOS and Linux desktops for example. + + The pull-request to use libproxy for this was deferred due to doubts on the + reliability of the dependency and how to use it: + https://github.com/curl/curl/pull/977 + + libdetectproxy is a (C++) library for detecting the proxy on Windows + https://github.com/paulharris/libdetectproxy + +1.11 minimize dependencies with dynamically loaded modules + + We can create a system with loadable modules/plug-ins, where these modules + would be the ones that link to 3rd party libs. That would allow us to avoid + having to load ALL dependencies since only the necessary ones for this + app/invoke/used protocols would be necessary to load. See + https://github.com/curl/curl/issues/349 + +1.12 updated DNS server while running + + If /etc/resolv.conf gets updated while a program using libcurl is running, it + is may cause name resolves to fail unless res_init() is called. We should + consider calling res_init() + retry once unconditionally on all name resolve + failures to mitigate against this. Firefox works like that. Note that Windows + does not have res_init() or an alternative. + + https://github.com/curl/curl/issues/2251 + +1.13 c-ares and CURLOPT_OPENSOCKETFUNCTION + + curl creates most sockets via the CURLOPT_OPENSOCKETFUNCTION callback and + close them with the CURLOPT_CLOSESOCKETFUNCTION callback. However, c-ares + does not use those functions and instead opens and closes the sockets itself. + This means that when curl passes the c-ares socket to the + CURLMOPT_SOCKETFUNCTION it is not owned by the application like other + sockets. + + See https://github.com/curl/curl/issues/2734 + +1.14 connect to multiple IPs in parallel + + curl currently implements the happy eyeball algorithm for connecting to the + IPv4 and IPv6 alternatives for a host in parallel, sticking with the + connection that "wins". We could implement a similar algorithm per individual + IP family as well when there are multiple available addresses: start with the + first address, then start a second attempt N milliseconds after and then a + third another N milliseconds later. That way there would be less waiting when + the first IP has problems. It also improves the connection timeout value + handling for multiple address situations. + +1.15 Monitor connections in the connection pool + + libcurl's connection cache or pool holds a number of open connections for the + purpose of possible subsequent connection reuse. It may contain a few up to a + significant amount of connections. Currently, libcurl leaves all connections + as they are and first when a connection is iterated over for matching or + reuse purpose it is verified that it is still alive. + + Those connections may get closed by the server side for idleness or they may + get an HTTP/2 ping from the peer to verify that they are still alive. By + adding monitoring of the connections while in the pool, libcurl can detect + dead connections (and close them) better and earlier, and it can handle + HTTP/2 pings to keep such ones alive even when not actively doing transfers + on them. + +1.16 Try to URL encode given URL + + Given a URL that for example contains spaces, libcurl could have an option + that would try somewhat harder than it does now and convert spaces to %20 and + perhaps URL encoded byte values over 128 etc (basically do what the redirect + following code already does). + + https://github.com/curl/curl/issues/514 + +1.17 Add support for IRIs + + IRIs (RFC 3987) allow localized, non-ASCII, names in the URL. To properly + support this, curl/libcurl would need to translate/encode the given input + from the input string encoding into percent encoded output "over the wire". + + To make that work smoothly for curl users even on Windows, curl would + probably need to be able to convert from several input encodings. + +1.18 try next proxy if one does not work + + Allow an application to specify a list of proxies to try, and failing to + connect to the first go on and try the next instead until the list is + exhausted. Browsers support this feature at least when they specify proxies + using PACs. + + https://github.com/curl/curl/issues/896 + +1.19 provide timing info for each redirect + + curl and libcurl provide timing information via a set of different + time-stamps (CURLINFO_*_TIME). When curl is following redirects, those + returned time value are the accumulated sums. An improvement could be to + offer separate timings for each redirect. + + https://github.com/curl/curl/issues/6743 + +1.20 SRV and URI DNS records + + Offer support for resolving SRV and URI DNS records for libcurl to know which + server to connect to for various protocols (including HTTP). + +1.21 netrc caching and sharing + + The netrc file is read and parsed each time a connection is setup, which + means that if a transfer needs multiple connections for authentication or + redirects, the file might be reread (and parsed) multiple times. This makes + it impossible to provide the file as a pipe. + +1.22 CURLINFO_PAUSE_STATE + + Return information about the transfer's current pause state, in both + directions. https://github.com/curl/curl/issues/2588 + +1.23 Offer API to flush the connection pool + + Sometimes applications want to flush all the existing connections kept alive. + An API could allow a forced flush or just a forced loop that would properly + close all connections that have been closed by the server already. + +1.25 Expose tried IP addresses that failed + + When libcurl fails to connect to a host, it could offer the application the + addresses that were used in the attempt. Source + dest IP, source + dest port + and protocol (UDP or TCP) for each failure. Possibly as a callback. Perhaps + also provide "reason". + + https://github.com/curl/curl/issues/2126 + +1.28 FD_CLOEXEC + + It sets the close-on-exec flag for the file descriptor, which causes the file + descriptor to be automatically (and atomically) closed when any of the + exec-family functions succeed. Should probably be set by default? + + https://github.com/curl/curl/issues/2252 + +1.29 WebSocket read callback + + Call the read callback once the connection is established to allow sending + the first message in the connection. + + https://github.com/curl/curl/issues/11402 + +1.30 config file parsing + + Consider providing an API, possibly in a separate companion library, for + parsing a config file like curl's -K/--config option to allow applications to + get the same ability to read curl options from files. + + See https://github.com/curl/curl/issues/3698 + +1.31 erase secrets from heap/stack after use + + Introducing a concept and system to erase secrets from memory after use, it + could help mitigate and lessen the impact of (future) security problems etc. + However: most secrets are passed to libcurl as clear text from the + application and then clearing them within the library adds nothing... + + https://github.com/curl/curl/issues/7268 + +1.32 add asynch getaddrinfo support + + Use getaddrinfo_a() to provide an asynch name resolver backend to libcurl + that does not use threads and does not depend on c-ares. The getaddrinfo_a + function is (probably?) glibc specific but that is a widely used libc among + our users. + + https://github.com/curl/curl/pull/6746 + +1.33 make DoH inherit more transfer properties + + Some options are not inherited because they are not relevant for the DoH SSL + connections, or inheriting the option may result in unexpected behavior. For + example the user's debug function callback is not inherited because it would + be unexpected for internal handles (ie DoH handles) to be passed to that + callback. + + If an option is not inherited then it is not possible to set it separately + for DoH without a DoH-specific option. For example: + CURLOPT_DOH_SSL_VERIFYHOST, CURLOPT_DOH_SSL_VERIFYPEER and + CURLOPT_DOH_SSL_VERIFYSTATUS. + + See https://github.com/curl/curl/issues/6605 + +2. libcurl - multi interface + +2.1 More non-blocking + + Make sure we do not ever loop because of non-blocking sockets returning + EWOULDBLOCK or similar. Blocking cases include: + + - Name resolves on non-Windows unless c-ares or the threaded resolver is used. + + - The threaded resolver may block on cleanup: + https://github.com/curl/curl/issues/4852 + + - file:// transfers + + - TELNET transfers + + - GSSAPI authentication for FTP transfers + + - The "DONE" operation (post transfer protocol-specific actions) for the + protocols SFTP, SMTP, FTP. Fixing multi_done() for this is a worthy task. + + - curl_multi_remove_handle for any of the above. See section 2.3. + + - Calling curl_ws_send() from a callback + +2.2 Better support for same name resolves + + If a name resolve has been initiated for name NN and a second easy handle + wants to resolve that name as well, make it wait for the first resolve to end + up in the cache instead of doing a second separate resolve. This is + especially needed when adding many simultaneous handles using the same host + name when the DNS resolver can get flooded. + +2.3 Non-blocking curl_multi_remove_handle() + + The multi interface has a few API calls that assume a blocking behavior, like + add_handle() and remove_handle() which limits what we can do internally. The + multi API need to be moved even more into a single function that "drives" + everything in a non-blocking manner and signals when something is done. A + remove or add would then only ask for the action to get started and then + multi_perform() etc still be called until the add/remove is completed. + +2.4 Split connect and authentication process + + The multi interface treats the authentication process as part of the connect + phase. As such any failures during authentication does not trigger the + relevant QUIT or LOGOFF for protocols such as IMAP, POP3 and SMTP. + +2.5 Edge-triggered sockets should work + + The multi_socket API should work with edge-triggered socket events. One of + the internal actions that need to be improved for this to work perfectly is + the 'maxloops' handling in transfer.c:readwrite_data(). + +2.6 multi upkeep + + In libcurl 7.62.0 we introduced curl_easy_upkeep. It unfortunately only works + on easy handles. We should introduces a version of that for the multi handle, + and also consider doing "upkeep" automatically on connections in the + connection pool when the multi handle is in used. + + See https://github.com/curl/curl/issues/3199 + +2.7 Virtual external sockets + + libcurl performs operations on the given file descriptor that presumes it is + a socket and an application cannot replace them at the moment. Allowing an + application to fully replace those would allow a larger degree of freedom and + flexibility. + + See https://github.com/curl/curl/issues/5835 + +2.8 dynamically decide to use socketpair + + For users who do not use curl_multi_wait() or do not care for + curl_multi_wakeup(), we could introduce a way to make libcurl NOT + create a socketpair in the multi handle. + + See https://github.com/curl/curl/issues/4829 + +3. Documentation + +3.1 Improve documentation about fork safety + + See https://github.com/curl/curl/issues/6968 + +4. FTP + +4.1 HOST + + HOST is a command for a client to tell which hostname to use, to offer FTP + servers named-based virtual hosting: + + https://datatracker.ietf.org/doc/html/rfc7151 + +4.4 Support CURLOPT_PREQUOTE for directions listings + + The lack of support is mostly an oversight and requires the FTP state machine + to get updated to get fixed. + + https://github.com/curl/curl/issues/8602 + +4.6 GSSAPI via Windows SSPI + + In addition to currently supporting the SASL GSSAPI mechanism (Kerberos V5) + via third-party GSS-API libraries, such as Heimdal or MIT Kerberos, also add + support for GSSAPI authentication via Windows SSPI. + +4.7 STAT for LIST without data connection + + Some FTP servers allow STAT for listing directories instead of using LIST, + and the response is then sent over the control connection instead of as the + otherwise usedw data connection: https://www.nsftools.com/tips/RawFTP.htm#STAT + + This is not detailed in any FTP specification. + +4.8 Passive transfer could try other IP addresses + + When doing FTP operations through a proxy at localhost, the reported spotted + that curl only tried to connect once to the proxy, while it had multiple + addresses and a failed connect on one address should make it try the next. + + After switching to passive mode (EPSV), curl could try all IP addresses for + "localhost". Currently it tries ::1, but it should also try 127.0.0.1. + + See https://github.com/curl/curl/issues/1508 + +5. HTTP + +5.1 Provide the error body from a CONNECT response + + When curl receives a body response from a CONNECT request to a proxy, it + always just reads and ignores it. It would make some users happy if curl + instead optionally would be able to make that responsible available. Via a + new callback? Through some other means? + + See https://github.com/curl/curl/issues/9513 + +5.2 Obey Retry-After in redirects + + The Retry-After is said to dicate "the minimum time that the user agent is + asked to wait before issuing the redirected request" and libcurl does not + obey this. + + See https://github.com/curl/curl/issues/11447 + +5.3 Rearrange request header order + + Server implementers often make an effort to detect browser and to reject + clients it can detect to not match. One of the last details we cannot yet + control in libcurl's HTTP requests, which also can be exploited to detect + that libcurl is in fact used even when it tries to impersonate a browser, is + the order of the request headers. I propose that we introduce a new option in + which you give headers a value, and then when the HTTP request is built it + sorts the headers based on that number. We could then have internally created + headers use a default value so only headers that need to be moved have to be + specified. + +5.4 Allow SAN names in HTTP/2 server push + + curl only allows HTTP/2 push promise if the provided :authority header value + exactly matches the hostname given in the URL. It could be extended to allow + any name that would match the Subject Alternative Names in the server's TLS + certificate. + + See https://github.com/curl/curl/pull/3581 + +5.5 auth= in URLs + + Add the ability to specify the preferred authentication mechanism to use by + using ;auth= in the login part of the URL. + + For example: + + http://test:pass;auth=NTLM@example.com would be equivalent to specifying + --user test:pass;auth=NTLM or --user test:pass --ntlm from the command line. + + Additionally this should be implemented for proxy base URLs as well. + +5.6 alt-svc should fallback if alt-svc does not work + + The alt-svc: header provides a set of alternative services for curl to use + instead of the original. If the first attempted one fails, it should try the + next etc and if all alternatives fail go back to the original. + + See https://github.com/curl/curl/issues/4908 + +5.7 Require HTTP version X or higher + + curl and libcurl provide options for trying higher HTTP versions (for example + HTTP/2) but then still allows the server to pick version 1.1. We could + consider adding a way to require a minimum version. + + See https://github.com/curl/curl/issues/7980 + +6. TELNET + +6.1 ditch stdin + + Reading input (to send to the remote server) on stdin is a crappy solution + for library purposes. We need to invent a good way for the application to be + able to provide the data to send. + +6.2 ditch telnet-specific select + + Move the telnet support's network select() loop go away and merge the code + into the main transfer loop. Until this is done, the multi interface does not + work for telnet. + +6.3 feature negotiation debug data + + Add telnet feature negotiation data to the debug callback as header data. + +6.4 exit immediately upon connection if stdin is /dev/null + + If it did, curl could be used to probe if there is an server there listening + on a specific port. That is, the following command would exit immediately + after the connection is established with exit code 0: + + curl -s --connect-timeout 2 telnet://example.com:80 NOTIFY=SUCCESS,FAILURE" ); + + https://github.com/curl/curl/issues/8232 + +7.2 Enhanced capability support + + Add the ability, for an application that uses libcurl, to obtain the list of + capabilities returned from the EHLO command. + +7.3 Add CURLOPT_MAIL_CLIENT option + + Rather than use the URL to specify the mail client string to present in the + HELO and EHLO commands, libcurl should support a new CURLOPT specifically for + specifying this data as the URL is non-standard and to be honest a bit of a + hack ;-) + + Please see the following thread for more information: + https://curl.se/mail/lib-2012-05/0178.html + + +8. POP3 + +8.2 Enhanced capability support + + Add the ability, for an application that uses libcurl, to obtain the list of + capabilities returned from the CAPA command. + +9. IMAP + +9.1 Enhanced capability support + + Add the ability, for an application that uses libcurl, to obtain the list of + capabilities returned from the CAPABILITY command. + +10. LDAP + +10.1 SASL based authentication mechanisms + + Currently the LDAP module only supports ldap_simple_bind_s() in order to bind + to an LDAP server. However, this function sends username and password details + using the simple authentication mechanism (as clear text). However, it should + be possible to use ldap_bind_s() instead specifying the security context + information ourselves. + +10.2 CURLOPT_SSL_CTX_FUNCTION for LDAPS + + CURLOPT_SSL_CTX_FUNCTION works perfectly for HTTPS and email protocols, but + it has no effect for LDAPS connections. + + https://github.com/curl/curl/issues/4108 + +10.3 Paged searches on LDAP server + + https://github.com/curl/curl/issues/4452 + +10.4 Certificate-Based Authentication + + LDAPS not possible with macOS and Windows with Certificate-Based Authentication + + https://github.com/curl/curl/issues/9641 + +11. SMB + +11.1 File listing support + + Add support for listing the contents of a SMB share. The output should + probably be the same as/similar to FTP. + +11.2 Honor file timestamps + + The timestamp of the transferred file should reflect that of the original + file. + +11.3 Use NTLMv2 + + Currently the SMB authentication uses NTLMv1. + +11.4 Create remote directories + + Support for creating remote directories when uploading a file to a directory + that does not exist on the server, just like --ftp-create-dirs. + + +12. FILE + +12.1 Directory listing on non-POSIX + + Listing the contents of a directory accessed with FILE only works on + platforms with opendir. Support could be added for more systems, like + Windows. + +13. TLS + +13.1 TLS-PSK with OpenSSL + + Transport Layer Security pre-shared key ciphersuites (TLS-PSK) is a set of + cryptographic protocols that provide secure communication based on pre-shared + keys (PSKs). These pre-shared keys are symmetric keys shared in advance among + the communicating parties. + + https://github.com/curl/curl/issues/5081 + +13.2 TLS channel binding + + TLS 1.2 and 1.3 provide the ability to extract some secret data from the TLS + connection and use it in the client request (usually in some sort of + authentication) to ensure that the data sent is bound to the specific TLS + connection and cannot be successfully intercepted by a proxy. This + functionality can be used in a standard authentication mechanism such as + GSS-API or SCRAM, or in custom approaches like custom HTTP Authentication + headers. + + For TLS 1.2, the binding type is usually tls-unique, and for TLS 1.3 it is + tls-exporter. + + https://datatracker.ietf.org/doc/html/rfc5929 + https://datatracker.ietf.org/doc/html/rfc9266 + https://github.com/curl/curl/issues/9226 + +13.3 Defeat TLS fingerprinting + + By changing the order of TLS extensions provided in the TLS handshake, it is + sometimes possible to circumvent TLS fingerprinting by servers. The TLS + extension order is of course not the only way to fingerprint a client. + +13.4 Consider OCSP stapling by default + + Treat a negative response a reason for aborting the connection. Since OCSP + stapling is presumed to get used much less in the future when Let's Encrypt + drops the OCSP support, the benefit of this might however be limited. + + https://github.com/curl/curl/issues/15483 + +13.5 Export session ids + + Add an interface to libcurl that enables "session IDs" to get + exported/imported. Cris Bailiff said: "OpenSSL has functions which can + serialise the current SSL state to a buffer of your choice, and recover/reset + the state from such a buffer at a later date - this is used by mod_ssl for + apache to implement and SSL session ID cache". + +13.6 Provide callback for cert verification + + OpenSSL supports a callback for customised verification of the peer + certificate, but this does not seem to be exposed in the libcurl APIs. Could + it be? There is so much that could be done if it were. + +13.7 Less memory massaging with Schannel + + The Schannel backend does a lot of custom memory management we would rather + avoid: the repeated alloc + free in sends and the custom memory + realloc + system for encrypted and decrypted data. That should be avoided and reduced + for 1) efficiency and 2) safety. + +13.8 Support DANE + + DNS-Based Authentication of Named Entities (DANE) is a way to provide SSL + keys and certs over DNS using DNSSEC as an alternative to the CA model. + https://www.rfc-editor.org/rfc/rfc6698.txt + + An initial patch was posted by Suresh Krishnaswamy on March 7th 2013 + (https://curl.se/mail/lib-2013-03/0075.html) but it was a too simple + approach. See Daniel's comments: + https://curl.se/mail/lib-2013-03/0103.html . libunbound may be the + correct library to base this development on. + + Björn Stenberg wrote a separate initial take on DANE that was never + completed. + +13.9 TLS record padding + + TLS (1.3) offers optional record padding and OpenSSL provides an API for it. + I could make sense for libcurl to offer this ability to applications to make + traffic patterns harder to figure out by network traffic observers. + + See https://github.com/curl/curl/issues/5398 + +13.10 Support Authority Information Access certificate extension (AIA) + + AIA can provide various things like CRLs but more importantly information + about intermediate CA certificates that can allow validation path to be + fulfilled when the HTTPS server does not itself provide them. + + Since AIA is about downloading certs on demand to complete a TLS handshake, + it is probably a bit tricky to get done right. + + See https://github.com/curl/curl/issues/2793 + +13.11 Some TLS options are not offered for HTTPS proxies + + Some TLS related options to the command line tool and libcurl are only + provided for the server and not for HTTPS proxies. --proxy-tls-max, + --proxy-tlsv1.3, --proxy-curves and a few more. + For more Documentation on this see: + https://curl.se/libcurl/c/tls-options.html + + https://github.com/curl/curl/issues/12286 + +13.13 Make sure we forbid TLS 1.3 post-handshake authentication + + RFC 8740 explains how using HTTP/2 must forbid the use of TLS 1.3 + post-handshake authentication. We should make sure to live up to that. + + See https://github.com/curl/curl/issues/5396 + +13.14 Support the clienthello extension + + Certain stupid networks and middle boxes have a problem with SSL handshake + packets that are within a certain size range because how that sets some bits + that previously (in older TLS version) were not set. The clienthello + extension adds padding to avoid that size range. + + https://datatracker.ietf.org/doc/html/rfc7685 + https://github.com/curl/curl/issues/2299 + +13.16 Share the CA cache + + For TLS backends that supports CA caching, it makes sense to allow the share + object to be used to store the CA cache as well via the share API. Would + allow multiple easy handles to reuse the CA cache and save themselves from a + lot of extra processing overhead. + +13.17 Add missing features to TLS backends + + The feature matrix at https://curl.se/libcurl/c/tls-options.html shows which + features are supported by which TLS backends, and thus also where there are + feature gaps. + +14. Proxy + +14.1 Retry SOCKS handshake on address type not supported + + When curl resolves a hostname, it might get a mix of IPv6 and IPv4 returned. + curl might then use an IPv6 address with a SOCKS5 proxy, which - if it does + not support IPv6 - returns "Address type not supported" and curl exits with + that error. + + Perhaps it is preferred if curl would in this situation instead first retry + the SOCKS handshake again for this case and then use one of the IPv4 + addresses for the target host. + + See https://github.com/curl/curl/issues/17222 + +15. Schannel + +15.1 Extend support for client certificate authentication + + The existing support for the -E/--cert and --key options could be + extended by supplying a custom certificate and key in PEM format, see: + - Getting a Certificate for Schannel + https://msdn.microsoft.com/en-us/library/windows/desktop/aa375447.aspx + +15.2 Extend support for the --ciphers option + + The existing support for the --ciphers option could be extended + by mapping the OpenSSL/GnuTLS cipher suites to the Schannel APIs, see + - Specifying Schannel Ciphers and Cipher Strengths + https://msdn.microsoft.com/en-us/library/windows/desktop/aa380161.aspx + +15.4 Add option to allow abrupt server closure + + libcurl with Schannel errors without a known termination point from the server + (such as length of transfer, or SSL "close notify" alert) to prevent against + a truncation attack. Really old servers may neglect to send any termination + point. An option could be added to ignore such abrupt closures. + + https://github.com/curl/curl/issues/4427 + +16. SASL + +16.1 Other authentication mechanisms + + Add support for other authentication mechanisms such as OLP, + GSS-SPNEGO and others. + +16.2 Add QOP support to GSSAPI authentication + + Currently the GSSAPI authentication only supports the default QOP of auth + (Authentication), whilst Kerberos V5 supports both auth-int (Authentication + with integrity protection) and auth-conf (Authentication with integrity and + privacy protection). + + +17. SSH protocols + +17.1 Multiplexing + + SSH is a perfectly fine multiplexed protocols which would allow libcurl to do + multiple parallel transfers from the same host using the same connection, + much in the same spirit as HTTP/2 does. libcurl however does not take + advantage of that ability but does instead always create a new connection for + new transfers even if an existing connection already exists to the host. + + To fix this, libcurl would have to detect an existing connection and "attach" + the new transfer to the existing one. + +17.2 Handle growing SFTP files + + The SFTP code in libcurl checks the file size *before* a transfer starts and + then proceeds to transfer exactly that amount of data. If the remote file + grows while the transfer is in progress libcurl does not notice and does not + adapt. The OpenSSH SFTP command line tool does and libcurl could also just + attempt to download more to see if there is more to get... + + https://github.com/curl/curl/issues/4344 + +17.3 Read keys from ~/.ssh/id_ecdsa, id_ed25519 + + The libssh2 backend in curl is limited to only reading keys from id_rsa and + id_dsa, which makes it fail connecting to servers that use more modern key + types. + + https://github.com/curl/curl/issues/8586 + +17.4 Support CURLOPT_PREQUOTE + + The two other QUOTE options are supported for SFTP, but this was left out for + unknown reasons. + +17.5 SSH over HTTPS proxy with more backends + + The SSH based protocols SFTP and SCP did not work over HTTPS proxy at + all until PR https://github.com/curl/curl/pull/6021 brought the + functionality with the libssh2 backend. Presumably, this support + can/could be added for the other backends as well. + +17.6 SFTP with SCP:// + + OpenSSH 9 switched their 'scp' tool to speak SFTP under the hood. Going + forward it might be worth having curl or libcurl attempt SFTP if SCP fails to + follow suite. + +18. Command line tool + +18.1 sync + + "curl --sync http://example.com/feed[1-100].rss" or + "curl --sync http://example.net/{index,calendar,history}.html" + + Downloads a range or set of URLs using the remote name, but only if the + remote file is newer than the local file. A Last-Modified HTTP date header + should also be used to set the mod date on the downloaded file. + +18.2 glob posts + + Globbing support for -d and -F, as in 'curl -d "name=foo[0-9]" URL'. + This is easily scripted though. + +18.4 --proxycommand + + Allow the user to make curl run a command and use its stdio to make requests + and not do any network connection by itself. Example: + + curl --proxycommand 'ssh pi@raspberrypi.local -W 10.1.1.75 80' \ + http://some/otherwise/unavailable/service.php + + See https://github.com/curl/curl/issues/4941 + +18.5 UTF-8 filenames in Content-Disposition + + RFC 6266 documents how UTF-8 names can be passed to a client in the + Content-Disposition header, and curl does not support this. + + https://github.com/curl/curl/issues/1888 + +18.6 Option to make -Z merge lined based outputs on stdout + + When a user requests multiple lined based files using -Z and sends them to + stdout, curl does not "merge" and send complete lines fine but may send + partial lines from several sources. + + https://github.com/curl/curl/issues/5175 + +18.7 specify which response codes that make -f/--fail return error + + Allows a user to better specify exactly which error code(s) that are fine + and which are errors for their specific uses cases + +18.9 Choose the name of file in braces for complex URLs + + When using braces to download a list of URLs and you use complicated names + in the list of alternatives, it could be handy to allow curl to use other + names when saving. + + Consider a way to offer that. Possibly like + {partURL1:name1,partURL2:name2,partURL3:name3} where the name following the + colon is the output name. + + See https://github.com/curl/curl/issues/221 + +18.10 improve how curl works in a Windows console window + + If you pull the scrollbar when transferring with curl in a Windows console + window, the transfer is interrupted and can get disconnected. This can + probably be improved. See https://github.com/curl/curl/issues/322 + +18.11 Windows: set attribute 'archive' for completed downloads + + The archive bit (FILE_ATTRIBUTE_ARCHIVE, 0x20) separates files that shall be + backed up from those that are either not ready or have not changed. + + Downloads in progress are neither ready to be backed up, nor should they be + opened by a different process. Only after a download has been completed it is + sensible to include it in any integer snapshot or backup of the system. + + See https://github.com/curl/curl/issues/3354 + +18.12 keep running, read instructions from pipe/socket + + Provide an option that makes curl not exit after the last URL (or even work + without a given URL), and then make it read instructions passed on a pipe or + over a socket to make further instructions so that a second subsequent curl + invoke can talk to the still running instance and ask for transfers to get + done, and thus maintain its connection pool, DNS cache and more. + +18.13 Acknowledge Ratelimit headers + + Consider a command line option that can make curl do multiple serial requests + while acknowledging server specified rate limits: + https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/ + + See https://github.com/curl/curl/issues/5406 + +18.14 --dry-run + + A command line option that makes curl show exactly what it would do and send + if it would run for real. + + See https://github.com/curl/curl/issues/5426 + +18.15 --retry should resume + + When --retry is used and curl actually retries transfer, it should use the + already transferred data and do a resumed transfer for the rest (when + possible) so that it does not have to transfer the same data again that was + already transferred before the retry. + + See https://github.com/curl/curl/issues/1084 + +18.17 consider filename from the redirected URL with -O ? + + When a user gives a URL and uses -O, and curl follows a redirect to a new + URL, the filename is not extracted and used from the newly redirected-to URL + even if the new URL may have a much more sensible filename. + + This is clearly documented and helps for security since there is no surprise + to users which filename that might get overwritten, but maybe a new option + could allow for this or maybe -J should imply such a treatment as well as -J + already allows for the server to decide what filename to use so it already + provides the "may overwrite any file" risk. + + This is extra tricky if the original URL has no filename part at all since + then the current code path does error out with an error message, and we + cannot *know* already at that point if curl is redirected to a URL that has a + filename... + + See https://github.com/curl/curl/issues/1241 + +18.18 retry on network is unreachable + + The --retry option retries transfers on "transient failures". We later added + --retry-connrefused to also retry for "connection refused" errors. + + Suggestions have been brought to also allow retry on "network is unreachable" + errors and while totally reasonable, maybe we should consider a way to make + this more configurable than to add a new option for every new error people + want to retry for? + + https://github.com/curl/curl/issues/1603 + +18.19 expand ~/ in config files + + For example .curlrc could benefit from being able to do this. + + See https://github.com/curl/curl/issues/2317 + +18.20 hostname sections in config files + + config files would be more powerful if they could set different + configurations depending on used URLs, hostname or possibly origin. Then a + default .curlrc could a specific user-agent only when doing requests against + a certain site. + +18.21 retry on the redirected-to URL + + When curl is told to --retry a failed transfer and follows redirects, it + might get an HTTP 429 response from the redirected-to URL and not the + original one, which then could make curl decide to rather retry the transfer + on that URL only instead of the original operation to the original URL. + + Perhaps extra emphasized if the original transfer is a large POST that + redirects to a separate GET, and that GET is what gets the 529 + + See https://github.com/curl/curl/issues/5462 + +18.23 Set the modification date on an uploaded file + + For SFTP and possibly FTP, curl could offer an option to set the + modification time for the uploaded file. + + See https://github.com/curl/curl/issues/5768 + +18.24 Use multiple parallel transfers for a single download + + To enhance transfer speed, downloading a single URL can be split up into + multiple separate range downloads that get combined into a single final + result. + + An ideal implementation would not use a specified number of parallel + transfers, but curl could: + - First start getting the full file as transfer A + - If after N seconds have passed and the transfer is expected to continue for + M seconds or more, add a new transfer (B) that asks for the second half of + A's content (and stop A at the middle). + - If splitting up the work improves the transfer rate, it could then be done + again. Then again, etc up to a limit. + + This way, if transfer B fails (because Range: is not supported) it lets + transfer A remain the single one. N and M could be set to some sensible + defaults. + + See https://github.com/curl/curl/issues/5774 + +18.25 Prevent terminal injection when writing to terminal + + curl could offer an option to make escape sequence either non-functional or + avoid cursor moves or similar to reduce the risk of a user getting tricked by + clever tricks. + + See https://github.com/curl/curl/issues/6150 + +18.26 Custom progress meter update interval + + Users who are for example doing large downloads in CI or remote setups might + want the occasional progress meter update to see that the transfer is + progressing and has not stuck, but they may not appreciate the + many-times-a-second frequency curl can end up doing it with now. + +18.27 -J and -O with %-encoded filenames + + -J/--remote-header-name does not decode %-encoded filenames. RFC 6266 details + how it should be done. The can of worm is basically that we have no charset + handling in curl and ASCII >=128 is a challenge for us. Not to mention that + decoding also means that we need to check for nastiness that is attempted, + like "../" sequences and the like. Probably everything to the left of any + embedded slashes should be cut off. + https://curl.se/bug/view.cgi?id=1294 + + -O also does not decode %-encoded names, and while it has even less + information about the charset involved the process is similar to the -J case. + + Note that we do not decode -O without the user asking for it with some other + means, since -O has always been documented to use the name exactly as + specified in the URL. + +18.28 -J with -C - + + When using -J (with -O), automatically resumed downloading together with "-C + -" fails. Without -J the same command line works. This happens because the + resume logic is worked out before the target filename (and thus its + pre-transfer size) has been figured out. This can be improved. + + https://curl.se/bug/view.cgi?id=1169 + +18.29 --retry and transfer timeouts + + If using --retry and the transfer timeouts (possibly due to using -m or + -y/-Y) the next attempt does not resume the transfer properly from what was + downloaded in the previous attempt but truncates and restarts at the original + position where it was at before the previous failed attempt. See + https://curl.se/mail/lib-2008-01/0080.html and Mandriva bug report + https://qa.mandriva.com/show_bug.cgi?id=22565 + + +19. Build + +19.2 Enable PIE and RELRO by default + + Especially when having programs that execute curl via the command line, PIE + renders the exploitation of memory corruption vulnerabilities a lot more + difficult. This can be attributed to the additional information leaks being + required to conduct a successful attack. RELRO, on the other hand, masks + different binary sections like the GOT as read-only and thus kills a handful + of techniques that come in handy when attackers are able to arbitrarily + overwrite memory. A few tests showed that enabling these features had close + to no impact, neither on the performance nor on the general functionality of + curl. + +19.3 Do not use GNU libtool on OpenBSD + + When compiling curl on OpenBSD with "--enable-debug" it gives linking errors + when you use GNU libtool. This can be fixed by using the libtool provided by + OpenBSD itself. However for this the user always needs to invoke make with + "LIBTOOL=/usr/bin/libtool". It would be nice if the script could have some + magic to detect if this system is an OpenBSD host and then use the OpenBSD + libtool instead. + + See https://github.com/curl/curl/issues/5862 + +19.4 Package curl for Windows in a signed installer + + See https://github.com/curl/curl/issues/5424 + +19.5 make configure use --cache-file more and better + + The configure script can be improved to cache more values so that repeated + invokes run much faster. + + See https://github.com/curl/curl/issues/7753 + +20. Test suite + +20.1 SSL tunnel + + Make our own version of stunnel for simple port forwarding to enable HTTPS + and FTP-SSL tests without the stunnel dependency, and it could allow us to + provide test tools built with either OpenSSL or GnuTLS + +20.2 more protocols supported + + Extend the test suite to include more protocols. The telnet could just do FTP + or http operations (for which we have test servers). + +20.3 more platforms supported + + Make the test suite work on more platforms. OpenBSD and macOS. Remove + fork()s and it should become even more portable. + +20.4 write an SMB test server to replace impacket + + This would allow us to run SMB tests on more platforms and do better and more + covering tests. + + See https://github.com/curl/curl/issues/15697 + +20.5 Use the RFC 6265 test suite + + A test suite made for HTTP cookies (RFC 6265) by Adam Barth is available at + https://github.com/abarth/http-state/tree/master/tests + + It would be good if someone would write a script/setup that would run curl + with that test suite and detect deviances. Ideally, that would even be + incorporated into our regular test suite. + +20.6 Run web-platform-tests URL tests + + Run web-platform-tests URL tests and compare results with browsers on wpt.fyi + + It would help us find issues to fix and help us document where our parser + differs from the WHATWG URL spec parsers. + + See https://github.com/curl/curl/issues/4477 + +21. MQTT + +21.1 Support rate-limiting + + The rate-limiting logic is done in the PERFORMING state in multi.c but MQTT + is not (yet) implemented to use that. + +21.2 Support MQTTS + +21.3 Handle network blocks + + Running test suite with + `CURL_DBG_SOCK_WBLOCK=90 ./runtests.pl -a mqtt` makes several + MQTT test cases fail where they should not. + +22. TFTP + +22.1 TFTP does not convert LF to CRLF for mode=netascii + + RFC 3617 defines that an TFTP transfer can be done using "netascii" + mode. curl does not support extracting that mode from the URL nor does it treat + such transfers specifically. It should probably do LF to CRLF translations + for them. + + See https://github.com/curl/curl/issues/12655 + +23. Gopher + +23.1 Handle network blocks + + Running test suite with + `CURL_DBG_SOCK_WBLOCK=90 ./runtests.pl -a 1200 to 1300` makes several + Gopher test cases fail where they should not. diff --git a/curl/docs/TheArtOfHttpScripting.md b/curl/docs/TheArtOfHttpScripting.md new file mode 100644 index 0000000..46369d6 --- /dev/null +++ b/curl/docs/TheArtOfHttpScripting.md @@ -0,0 +1,712 @@ + + +# The Art Of Scripting HTTP Requests Using curl + +## Background + + This document assumes that you are familiar with HTML and general networking. + + The increasing amount of applications moving to the web has made "HTTP + Scripting" more frequently requested and wanted. To be able to automatically + extract information from the web, to fake users, to post or upload data to + web servers are all important tasks today. + + curl is a command line tool for doing all sorts of URL manipulations and + transfers, but this particular document focuses on how to use it when doing + HTTP requests for fun and profit. This documents assumes that you know how to + invoke `curl --help` or `curl --manual` to get basic information about it. + + curl is not written to do everything for you. It makes the requests, it gets + the data, it sends data and it retrieves the information. You probably need + to glue everything together using some kind of script language or repeated + manual invokes. + +## The HTTP Protocol + + HTTP is the protocol used to fetch data from web servers. It is a simple + protocol that is built upon TCP/IP. The protocol also allows information to + get sent to the server from the client using a few different methods, as is + shown here. + + HTTP is plain ASCII text lines being sent by the client to a server to + request a particular action, and then the server replies a few text lines + before the actual requested content is sent to the client. + + The client, curl, sends an HTTP request. The request contains a method (like + GET, POST, HEAD etc), a number of request headers and sometimes a request + body. The HTTP server responds with a status line (indicating if things went + well), response headers and most often also a response body. The "body" part + is the plain data you requested, like the actual HTML or the image etc. + +## See the Protocol + + Using curl's option [`--verbose`](https://curl.se/docs/manpage.html#-v) (`-v` + as a short option) displays what kind of commands curl sends to the server, + as well as a few other informational texts. + + `--verbose` is the single most useful option when it comes to debug or even + understand the curl<->server interaction. + + Sometimes even `--verbose` is not enough. Then + [`--trace`](https://curl.se/docs/manpage.html#-trace) and + [`--trace-ascii`](https://curl.se/docs/manpage.html#--trace-ascii) + offer even more details as they show **everything** curl sends and + receives. Use it like this: + + curl --trace-ascii debugdump.txt http://www.example.com/ + +## See the Timing + + Many times you may wonder what exactly is taking all the time, or you just + want to know the amount of milliseconds between two points in a transfer. For + those, and other similar situations, the + [`--trace-time`](https://curl.se/docs/manpage.html#--trace-time) option is + what you need. It prepends the time to each trace output line: + + curl --trace-ascii d.txt --trace-time http://example.com/ + +## See which Transfer + + When doing parallel transfers, it is relevant to see which transfer is doing + what. When response headers are received (and logged) you need to know which + transfer these are for. + [`--trace-ids`](https://curl.se/docs/manpage.html#--trace-ids) option is what + you need. It prepends the transfer and connection identifier to each trace + output line: + + curl --trace-ascii d.txt --trace-ids http://example.com/ + +## See the Response + + By default curl sends the response to stdout. You need to redirect it + somewhere to avoid that, most often that is done with `-o` or `-O`. + +# URL + +## Spec + + The Uniform Resource Locator format is how you specify the address of a + particular resource on the Internet. You know these, you have seen URLs like + https://curl.se or https://example.com a million times. RFC 3986 is the + canonical spec. The formal name is not URL, it is **URI**. + +## Host + + The hostname is usually resolved using DNS or your /etc/hosts file to an IP + address and that is what curl communicates with. Alternatively you specify + the IP address directly in the URL instead of a name. + + For development and other trying out situations, you can point to a different + IP address for a hostname than what would otherwise be used, by using curl's + [`--resolve`](https://curl.se/docs/manpage.html#--resolve) option: + + curl --resolve www.example.org:80:127.0.0.1 http://www.example.org/ + +## Port number + + Each protocol curl supports operates on a default port number, be it over TCP + or in some cases UDP. Normally you do not have to take that into + consideration, but at times you run test servers on other ports or + similar. Then you can specify the port number in the URL with a colon and a + number immediately following the hostname. Like when doing HTTP to port + 1234: + + curl http://www.example.org:1234/ + + The port number you specify in the URL is the number that the server uses to + offer its services. Sometimes you may use a proxy, and then you may + need to specify that proxy's port number separately from what curl needs to + connect to the server. Like when using an HTTP proxy on port 4321: + + curl --proxy http://proxy.example.org:4321 http://remote.example.org/ + +## Username and password + + Some services are setup to require HTTP authentication and then you need to + provide name and password which is then transferred to the remote site in + various ways depending on the exact authentication protocol used. + + You can opt to either insert the user and password in the URL or you can + provide them separately: + + curl http://user:password@example.org/ + + or + + curl -u user:password http://example.org/ + + You need to pay attention that this kind of HTTP authentication is not what + is usually done and requested by user-oriented websites these days. They tend + to use forms and cookies instead. + +## Path part + + The path part is just sent off to the server to request that it sends back + the associated response. The path is what is to the right side of the slash + that follows the hostname and possibly port number. + +# Fetch a page + +## GET + + The simplest and most common request/operation made using HTTP is to GET a + URL. The URL could itself refer to a webpage, an image or a file. The client + issues a GET request to the server and receives the document it asked for. + If you issue the command line + + curl https://curl.se + + you get a webpage returned in your terminal window. The entire HTML document + this URL identifies. + + All HTTP replies contain a set of response headers that are normally hidden, + use curl's [`--include`](https://curl.se/docs/manpage.html#-i) (`-i`) + option to display them as well as the rest of the document. + +## HEAD + + You can ask the remote server for ONLY the headers by using the + [`--head`](https://curl.se/docs/manpage.html#-I) (`-I`) option which makes + curl issue a HEAD request. In some special cases servers deny the HEAD method + while others still work, which is a particular kind of annoyance. + + The HEAD method is defined and made so that the server returns the headers + exactly the way it would do for a GET, but without a body. It means that you + may see a `Content-Length:` in the response headers, but there must not be an + actual body in the HEAD response. + +## Multiple URLs in a single command line + + A single curl command line may involve one or many URLs. The most common case + is probably to just use one, but you can specify any amount of URLs. Yes any. + No limits. You then get requests repeated over and over for all the given + URLs. + + Example, send two GET requests: + + curl http://url1.example.com http://url2.example.com + + If you use [`--data`](https://curl.se/docs/manpage.html#-d) to POST to + the URL, using multiple URLs means that you send that same POST to all the + given URLs. + + Example, send two POSTs: + + curl --data name=curl http://url1.example.com http://url2.example.com + + +## Multiple HTTP methods in a single command line + + Sometimes you need to operate on several URLs in a single command line and do + different HTTP methods on each. For this, you might enjoy the + [`--next`](https://curl.se/docs/manpage.html#-:) option. It is basically a + separator that separates a bunch of options from the next. All the URLs + before `--next` get the same method and get all the POST data merged into + one. + + When curl reaches the `--next` on the command line, it resets the method and + the POST data and allow a new set. + + Perhaps this is best shown with a few examples. To send first a HEAD and then + a GET: + + curl -I http://example.com --next http://example.com + + To first send a POST and then a GET: + + curl -d score=10 http://example.com/post.cgi --next http://example.com/results.html + +# HTML forms + +## Forms explained + + Forms are the general way a website can present an HTML page with fields for + the user to enter data in, and then press some kind of 'OK' or 'Submit' + button to get that data sent to the server. The server then typically uses + the posted data to decide how to act. Like using the entered words to search + in a database, or to add the info in a bug tracking system, display the + entered address on a map or using the info as a login-prompt verifying that + the user is allowed to see what it is about to see. + + Of course there has to be some kind of program on the server end to receive + the data you send. You cannot just invent something out of the air. + +## GET + + A GET-form uses the method GET, as specified in HTML like: + +```html +
+ + +
+``` + + In your favorite browser, this form appears with a text box to fill in and a + press-button labeled "OK". If you fill in '1905' and press the OK button, + your browser then creates a new URL to get for you. The URL gets + `junk.cgi?birthyear=1905&press=OK` appended to the path part of the previous + URL. + + If the original form was seen on the page `www.example.com/when/birth.html`, + the second page you get becomes + `www.example.com/when/junk.cgi?birthyear=1905&press=OK`. + + Most search engines work this way. + + To make curl do the GET form post for you, just enter the expected created + URL: + + curl "http://www.example.com/when/junk.cgi?birthyear=1905&press=OK" + +## POST + + The GET method makes all input field names get displayed in the URL field of + your browser. That is generally a good thing when you want to be able to + bookmark that page with your given data, but it is an obvious disadvantage if + you entered secret information in one of the fields or if there are a large + amount of fields creating a long and unreadable URL. + + The HTTP protocol then offers the POST method. This way the client sends the + data separated from the URL and thus you do not see any of it in the URL + address field. + + The form would look similar to the previous one: + +```html +
+ + +
+``` + + And to use curl to post this form with the same data filled in as before, we + could do it like: + + curl --data "birthyear=1905&press=%20OK%20" http://www.example.com/when/junk.cgi + + This kind of POST uses the Content-Type `application/x-www-form-urlencoded` + and is the most widely used POST kind. + + The data you send to the server MUST already be properly encoded, curl does + not do that for you. For example, if you want the data to contain a space, + you need to replace that space with `%20`, etc. Failing to comply with this + most likely causes your data to be received wrongly and messed up. + + Recent curl versions can in fact url-encode POST data for you, like this: + + curl --data-urlencode "name=I am Daniel" http://www.example.com + + If you repeat `--data` several times on the command line, curl concatenates + all the given data pieces - and put a `&` symbol between each data segment. + +## File Upload POST + + Back in late 1995 they defined an additional way to post data over HTTP. It + is documented in the RFC 1867, why this method sometimes is referred to as + RFC 1867-posting. + + This method is mainly designed to better support file uploads. A form that + allows a user to upload a file could be written like this in HTML: + +
+ + +
+ + This clearly shows that the Content-Type about to be sent is + `multipart/form-data`. + + To post to a form like this with curl, you enter a command line like: + + curl --form upload=@localfilename --form press=OK [URL] + +## Hidden Fields + + A common way for HTML based applications to pass state information between + pages is to add hidden fields to the forms. Hidden fields are already filled + in, they are not displayed to the user and they get passed along just as all + the other fields. + + A similar example form with one visible field, one hidden field and one + submit button could look like: + +```html +
+ + + +
+``` + + To POST this with curl, you do not have to think about if the fields are + hidden or not. To curl they are all the same: + + curl --data "birthyear=1905&press=OK&person=daniel" [URL] + +## Figure Out What A POST Looks Like + + When you are about to fill in a form and send it to a server by using curl + instead of a browser, you are of course interested in sending a POST exactly + the way your browser does. + + An easy way to get to see this, is to save the HTML page with the form on + your local disk, modify the 'method' to a GET, and press the submit button + (you could also change the action URL if you want to). + + You then clearly see the data get appended to the URL, separated with a + `?`-letter as GET forms are supposed to. + +# HTTP upload + +## PUT + + Perhaps the best way to upload data to an HTTP server is to use PUT. Then + again, this of course requires that someone put a program or script on the + server end that knows how to receive an HTTP PUT stream. + + Put a file to an HTTP server with curl: + + curl --upload-file uploadfile http://www.example.com/receive.cgi + +# HTTP Authentication + +## Basic Authentication + + HTTP Authentication is the ability to tell the server your username and + password so that it can verify that you are allowed to do the request you are + doing. The Basic authentication used in HTTP (which is the type curl uses by + default) is **plain text** based, which means it sends username and password + only slightly obfuscated, but still fully readable by anyone that sniffs on + the network between you and the remote server. + + To tell curl to use a user and password for authentication: + + curl --user name:password http://www.example.com + +## Other Authentication + + The site might require a different authentication method (check the headers + returned by the server), and then + [`--ntlm`](https://curl.se/docs/manpage.html#--ntlm), + [`--digest`](https://curl.se/docs/manpage.html#--digest), + [`--negotiate`](https://curl.se/docs/manpage.html#--negotiate) or even + [`--anyauth`](https://curl.se/docs/manpage.html#--anyauth) might be + options that suit you. + +## Proxy Authentication + + Sometimes your HTTP access is only available through the use of an HTTP + proxy. This seems to be especially common at various companies. An HTTP proxy + may require its own user and password to allow the client to get through to + the Internet. To specify those with curl, run something like: + + curl --proxy-user proxyuser:proxypassword curl.se + + If your proxy requires the authentication to be done using the NTLM method, + use [`--proxy-ntlm`](https://curl.se/docs/manpage.html#--proxy-ntlm), if + it requires Digest use + [`--proxy-digest`](https://curl.se/docs/manpage.html#--proxy-digest). + + If you use any one of these user+password options but leave out the password + part, curl prompts for the password interactively. + +## Hiding credentials + + Do note that when a program is run, its parameters might be possible to see + when listing the running processes of the system. Thus, other users may be + able to watch your passwords if you pass them as plain command line + options. There are ways to circumvent this. + + It is worth noting that while this is how HTTP Authentication works, many + websites do not use this concept when they provide logins etc. See the Web + Login chapter further below for more details on that. + +# More HTTP Headers + +## Referer + + An HTTP request may include a 'referer' field (yes it is misspelled), which + can be used to tell from which URL the client got to this particular + resource. Some programs/scripts check the referer field of requests to verify + that this was not arriving from an external site or an unknown page. While + this is a stupid way to check something so easily forged, many scripts still + do it. Using curl, you can put anything you want in the referer-field and + thus more easily be able to fool the server into serving your request. + + Use curl to set the referer field with: + + curl --referer http://www.example.come http://www.example.com + +## User Agent + + Similar to the referer field, all HTTP requests may set the User-Agent + field. It names what user agent (client) that is being used. Many + applications use this information to decide how to display pages. Silly web + programmers try to make different pages for users of different browsers to + make them look the best possible for their particular browsers. They usually + also do different kinds of JavaScript etc. + + At times, you may learn that getting a page with curl does not return the + same page that you see when getting the page with your browser. Then you know + it is time to set the User Agent field to fool the server into thinking you + are one of those browsers. + + By default, curl uses curl/VERSION, such as User-Agent: curl/8.11.0. + + To make curl look like Internet Explorer 5 on a Windows 2000 box: + + curl --user-agent "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" [URL] + + Or why not look like you are using Netscape 4.73 on an old Linux box: + + curl --user-agent "Mozilla/4.73 [en] (X11; U; Linux 2.2.15 i686)" [URL] + +## Redirects + +## Location header + + When a resource is requested from a server, the reply from the server may + include a hint about where the browser should go next to find this page, or a + new page keeping newly generated output. The header that tells the browser to + redirect is `Location:`. + + curl does not follow `Location:` headers by default, but simply displays such + pages in the same manner it displays all HTTP replies. It does however + feature an option that makes it attempt to follow the `Location:` pointers. + + To tell curl to follow a Location: + + curl --location http://www.example.com + + If you use curl to POST to a site that immediately redirects you to another + page, you can safely use [`--location`](https://curl.se/docs/manpage.html#-L) + (`-L`) and `--data`/`--form` together. curl only uses POST in the first + request, and then revert to GET in the following operations. + +## Other redirects + + Browsers typically support at least two other ways of redirects that curl + does not: first the html may contain a meta refresh tag that asks the browser + to load a specific URL after a set number of seconds, or it may use + JavaScript to do it. + +# Cookies + +## Cookie Basics + + The way the web browsers do "client side state control" is by using + cookies. Cookies are just names with associated contents. The cookies are + sent to the client by the server. The server tells the client for what path + and hostname it wants the cookie sent back, and it also sends an expiration + date and a few more properties. + + When a client communicates with a server with a name and path as previously + specified in a received cookie, the client sends back the cookies and their + contents to the server, unless of course they are expired. + + Many applications and servers use this method to connect a series of requests + into a single logical session. To be able to use curl in such occasions, we + must be able to record and send back cookies the way the web application + expects them. The same way browsers deal with them. + +## Cookie options + + The simplest way to send a few cookies to the server when getting a page with + curl is to add them on the command line like: + + curl --cookie "name=Daniel" http://www.example.com + + Cookies are sent as common HTTP headers. This is practical as it allows curl + to record cookies simply by recording headers. Record cookies with curl by + using the [`--dump-header`](https://curl.se/docs/manpage.html#-D) (`-D`) + option like: + + curl --dump-header headers_and_cookies http://www.example.com + + (Take note that the + [`--cookie-jar`](https://curl.se/docs/manpage.html#-c) option described + below is a better way to store cookies.) + + curl has a full blown cookie parsing engine built-in that comes in use if you + want to reconnect to a server and use cookies that were stored from a + previous connection (or hand-crafted manually to fool the server into + believing you had a previous connection). To use previously stored cookies, + you run curl like: + + curl --cookie stored_cookies_in_file http://www.example.com + + curl's "cookie engine" gets enabled when you use the + [`--cookie`](https://curl.se/docs/manpage.html#-b) option. If you only + want curl to understand received cookies, use `--cookie` with a file that + does not exist. Example, if you want to let curl understand cookies from a + page and follow a location (and thus possibly send back cookies it received), + you can invoke it like: + + curl --cookie nada --location http://www.example.com + + curl has the ability to read and write cookie files that use the same file + format that Netscape and Mozilla once used. It is a convenient way to share + cookies between scripts or invokes. The `--cookie` (`-b`) switch + automatically detects if a given file is such a cookie file and parses it, + and by using the `--cookie-jar` (`-c`) option you make curl write a new + cookie file at the end of an operation: + + curl --cookie cookies.txt --cookie-jar newcookies.txt \ + http://www.example.com + +# HTTPS + +## HTTPS is HTTP secure + + There are a few ways to do secure HTTP transfers. By far the most common + protocol for doing this is what is generally known as HTTPS, HTTP over + SSL. SSL encrypts all the data that is sent and received over the network and + thus makes it harder for attackers to spy on sensitive information. + + SSL (or TLS as the current version of the standard is called) offers a set of + advanced features to do secure transfers over HTTP. + + curl supports encrypted fetches when built to use a TLS library and it can be + built to use one out of a fairly large set of libraries - `curl -V` shows + which one your curl was built to use (if any). To get a page from an HTTPS + server, simply run curl like: + + curl https://secure.example.com + +## Certificates + + In the HTTPS world, you use certificates to validate that you are the one you + claim to be, as an addition to normal passwords. curl supports client- side + certificates. All certificates are locked with a passphrase, which you need + to enter before the certificate can be used by curl. The passphrase can be + specified on the command line or if not, entered interactively when curl + queries for it. Use a certificate with curl on an HTTPS server like: + + curl --cert mycert.pem https://secure.example.com + + curl also tries to verify that the server is who it claims to be, by + verifying the server's certificate against a locally stored CA cert bundle. + Failing the verification causes curl to deny the connection. You must then + use [`--insecure`](https://curl.se/docs/manpage.html#-k) (`-k`) in case you + want to tell curl to ignore that the server cannot be verified. + + More about server certificate verification and ca cert bundles can be read in + the [`SSLCERTS` document](https://curl.se/docs/sslcerts.html). + + At times you may end up with your own CA cert store and then you can tell + curl to use that to verify the server's certificate: + + curl --cacert ca-bundle.pem https://example.com/ + +# Custom Request Elements + +## Modify method and headers + + Doing fancy stuff, you may need to add or change elements of a single curl + request. + + For example, you can change the POST method to `PROPFIND` and send the data + as `Content-Type: text/xml` (instead of the default `Content-Type`) like + this: + + curl --data "" --header "Content-Type: text/xml" \ + --request PROPFIND example.com + + You can delete a default header by providing one without content. Like you + can ruin the request by chopping off the `Host:` header: + + curl --header "Host:" http://www.example.com + + You can add headers the same way. Your server may want a `Destination:` + header, and you can add it: + + curl --header "Destination: http://nowhere" http://example.com + +## More on changed methods + + It should be noted that curl selects which methods to use on its own + depending on what action to ask for. `-d` makes a POST, `-I` makes a HEAD and + so on. If you use the [`--request`](https://curl.se/docs/manpage.html#-X) / + `-X` option you can change the method keyword curl selects, but you do not + modify curl's behavior. This means that if you for example use -d "data" to + do a POST, you can modify the method to a `PROPFIND` with `-X` and curl still + thinks it sends a POST. You can change the normal GET to a POST method by + simply adding `-X POST` in a command line like: + + curl -X POST http://example.org/ + + curl however still acts as if it sent a GET so it does not send any request + body etc. + +# Web Login + +## Some login tricks + + While not strictly just HTTP related, it still causes a lot of people + problems so here's the executive run-down of how the vast majority of all + login forms work and how to login to them using curl. + + It can also be noted that to do this properly in an automated fashion, you + most certainly need to script things and do multiple curl invokes etc. + + First, servers mostly use cookies to track the logged-in status of the + client, so you need to capture the cookies you receive in the responses. + Then, many sites also set a special cookie on the login page (to make sure + you got there through their login page) so you should make a habit of first + getting the login-form page to capture the cookies set there. + + Some web-based login systems feature various amounts of JavaScript, and + sometimes they use such code to set or modify cookie contents. Possibly they + do that to prevent programmed logins, like this manual describes how to... + Anyway, if reading the code is not enough to let you repeat the behavior + manually, capturing the HTTP requests done by your browsers and analyzing the + sent cookies is usually a working method to work out how to shortcut the + JavaScript need. + + In the actual `
` tag for the login, lots of sites fill-in + random/session or otherwise secretly generated hidden tags and you may need + to first capture the HTML code for the login form and extract all the hidden + fields to be able to do a proper login POST. Remember that the contents need + to be URL encoded when sent in a normal POST. + +# Debug + +## Some debug tricks + + Many times when you run curl on a site, you notice that the site does not + seem to respond the same way to your curl requests as it does to your + browser's. + + Then you need to start making your curl requests more similar to your + browser's requests: + + - Use the `--trace-ascii` option to store fully detailed logs of the requests + for easier analyzing and better understanding + + - Make sure you check for and use cookies when needed (both reading with + `--cookie` and writing with `--cookie-jar`) + + - Set user-agent (with [`-A`](https://curl.se/docs/manpage.html#-A)) to + one like a recent popular browser does + + - Set referer (with [`-E`](https://curl.se/docs/manpage.html#-E)) like + it is set by the browser + + - If you use POST, make sure you send all the fields and in the same order as + the browser does it. + +## Check what the browsers do + + A good helper to make sure you do this right, is the web browsers' developers + tools that let you view all headers you send and receive (even when using + HTTPS). + + A more raw approach is to capture the HTTP traffic on the network with tools + such as Wireshark or tcpdump and check what headers that were sent and + received by the browser. (HTTPS forces you to use `SSLKEYLOGFILE` to do + that.) diff --git a/curl/docs/URL-SYNTAX.md b/curl/docs/URL-SYNTAX.md new file mode 100644 index 0000000..81c6926 --- /dev/null +++ b/curl/docs/URL-SYNTAX.md @@ -0,0 +1,396 @@ + + +# URL syntax and their use in curl + +## Specifications + +The official "URL syntax" is primarily defined in these two different +specifications: + + - [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986) (although URL is called + "URI" in there) + - [The WHATWG URL Specification](https://url.spec.whatwg.org/) + +RFC 3986 is the earlier one, and curl has always tried to adhere to that one +(since it shipped in January 2005). + +The WHATWG URL spec was written later, is incompatible with the RFC 3986 and +changes over time. + +## Variations + +URL parsers as implemented in browsers, libraries and tools usually opt to +support one of the mentioned specifications. Bugs, differences in +interpretations and the moving nature of the WHATWG spec does however make it +unlikely that multiple parsers treat URLs the same way. + +## Security + +Due to the inherent differences between URL parser implementations, it is +considered a security risk to mix different implementations and assume the +same behavior. + +For example, if you use one parser to check if a URL uses a good hostname or +the correct auth field, and then pass on that same URL to a *second* parser, +there is always a risk it treats the same URL differently. There is no right +and wrong in URL land, only differences of opinions. + +libcurl offers a separate API to its URL parser for this reason, among others. + +Applications may at times find it convenient to allow users to specify URLs +for various purposes and that string would then end up fed to curl. Getting a +URL from an external untrusted party and using it with curl brings several +security concerns: + +1. If you have an application that runs as or in a server application, getting + an unfiltered URL can trick your application to access a local resource + instead of a remote resource. Protecting yourself against localhost accesses + is hard when accepting user provided URLs. + +2. Such custom URLs can access other ports than you planned as port numbers + are part of the regular URL format. The combination of a local host and a + custom port number can allow external users to play tricks with your local + services. + +3. Such a URL might use other schemes than you thought of or planned for. + +## "RFC 3986 plus" + +curl recognizes a URL syntax that we call "RFC 3986 plus". It is grounded on +the well established RFC 3986 to make sure previously written command lines +and curl using scripts remain working. + +curl's URL parser allows a few deviations from the spec in order to +inter-operate better with URLs that appear in the wild. + +### Spaces + +A URL provided to curl cannot contain spaces. They need to be provided URL +encoded to be accepted in a URL by curl. + +An exception to this rule: `Location:` response headers that indicate to a +client where a resource has been redirected to, sometimes contain spaces. This +is a violation of RFC 3986 but is fine in the WHATWG spec. curl handles these +by re-encoding them to `%20`. + +### Non-ASCII + +Byte values in a provided URL that are outside of the printable ASCII range +are percent-encoded by curl. + +### Multiple slashes + +An absolute URL always starts with a "scheme" followed by a colon. For all the +schemes curl supports, the colon must be followed by two slashes according to +RFC 3986 but not according to the WHATWG spec - which allows one to infinity +amount. + +curl allows one, two or three slashes after the colon to still be considered a +valid URL. + +### "scheme-less" + +curl supports "URLs" that do not start with a scheme. This is not supported by +any of the specifications. This is a shortcut to entering URLs that was +supported by browsers early on and has been mimicked by curl. + +Based on what the hostname starts with, curl "guesses" what protocol to use: + + - `ftp.` means FTP + - `dict.` means DICT + - `ldap.` means LDAP + - `imap.` means IMAP + - `smtp.` means SMTP + - `pop3.` means POP3 + - all other means HTTP + +### Globbing letters + +The curl command line tool supports "globbing" of URLs. It means that you can +create ranges and lists using `[N-M]` and `{one,two,three}` sequences. The +letters used for this (`[]{}`) are reserved in RFC 3986 and can therefore not +legitimately be part of such a URL. + +They are however not reserved or special in the WHATWG specification, so +globbing can mess up such URLs. Globbing can be turned off for such occasions +(using `--globoff`). + +# URL syntax details + +A URL may consist of the following components - many of them are optional: + + [scheme][divider][userinfo][hostname][port number][path][query][fragment] + +Each component is separated from the following component with a divider +character or string. + +For example, this could look like: + + http://user:password@www.example.com:80/index.html?foo=bar#top + +## Scheme + +The scheme specifies the protocol to use. A curl build can support a few or +many different schemes. You can limit what schemes curl should accept. + +curl supports the following schemes on URLs specified to transfer. They are +matched case insensitively: + +`dict`, `file`, `ftp`, `ftps`, `gopher`, `gophers`, `http`, `https`, `imap`, +`imaps`, `ldap`, `ldaps`, `mqtt`, `pop3`, `pop3s`, `rtmp`, `rtmpe`, `rtmps`, +`rtmpt`, `rtmpte`, `rtmpts`, `rtsp`, `smb`, `smbs`, `smtp`, `smtps`, `telnet`, +`tftp` + +When the URL is specified to identify a proxy, curl recognizes the following +schemes: + +`http`, `https`, `socks4`, `socks4a`, `socks5`, `socks5h`, `socks` + +## Userinfo + +The userinfo field can be used to set username and password for +authentication purposes in this transfer. The use of this field is discouraged +since it often means passing around the password in plain text and is thus a +security risk. + +URLs for IMAP, POP3 and SMTP also support *login options* as part of the +userinfo field. They are provided as a semicolon after the password and then +the options. + +## Hostname + +The hostname part of the URL contains the address of the server that you want +to connect to. This can be the fully qualified domain name of the server, the +local network name of the machine on your network or the IP address of the +server or machine represented by either an IPv4 or IPv6 address (within +brackets). For example: + + http://www.example.com/ + + http://hostname/ + + http://192.168.0.1/ + + http://[2001:1890:1112:1::20]/ + +### "localhost" + +Starting in curl 7.77.0, curl uses loopback IP addresses for the name +`localhost`: `127.0.0.1` and `::1`. It does not resolve the name using the +resolver functions. + +This is done to make sure the host accessed is truly the localhost - the local +machine. + +### IDNA + +If curl was built with International Domain Name (IDN) support, it can also +handle hostnames using non-ASCII characters. + +When built with libidn2, curl uses the IDNA 2008 standard. This is equivalent +to the WHATWG URL spec, but differs from certain browsers that use IDNA 2003 +Transitional Processing. The two standards have a huge overlap but differ +slightly, perhaps most famously in how they deal with the +[German "double s"](https://en.wikipedia.org/wiki/%c3%9f) +([LATIN SMALL LETTER SHARP S](https://codepoints.net/U+00DF)). + +When WinIDN is used, curl uses IDNA 2003 Transitional Processing, like the rest +of Windows. + +## Port number + +If there is a colon after the hostname, that should be followed by the port +number to use. 1 - 65535. curl also supports a blank port number field - but +only if the URL starts with a scheme. + +If the port number is not specified in the URL, curl uses a default port +number based on the provide scheme: + +DICT 2628, FTP 21, FTPS 990, GOPHER 70, GOPHERS 70, HTTP 80, HTTPS 443, +IMAP 132, IMAPS 993, LDAP 369, LDAPS 636, MQTT 1883, POP3 110, POP3S 995, +RTMP 1935, RTMPS 443, RTMPT 80, RTSP 554, SCP 22, SFTP 22, SMB 445, SMBS 445, +SMTP 25, SMTPS 465, TELNET 23, TFTP 69 + +# Scheme specific behaviors + +## FTP + +The path part of an FTP request specifies the file to retrieve and from which +directory. If the file part is omitted then libcurl downloads the directory +listing for the directory specified. If the directory is omitted then the +directory listing for the root / home directory is returned. + +FTP servers typically put the user in its "home directory" after login, which +then differs between users. To explicitly specify the root directory of an FTP +server, start the path with double slash `//` or `/%2f` (2F is the hexadecimal +value of the ASCII code for the slash). + +## FILE + +When a `FILE://` URL is accessed on Windows systems, it can be crafted in a +way so that Windows attempts to connect to a (remote) machine when curl wants +to read or write such a path. + +curl only allows the hostname part of a FILE URL to be one out of these three +alternatives: `localhost`, `127.0.0.1` or blank ("", zero characters). +Anything else makes curl fail to parse the URL. + +### Windows-specific FILE details + +curl accepts that the FILE URL's path starts with a "drive letter". That is a +single letter `a` to `z` followed by a colon or a pipe character (`|`). + +The Windows operating system itself converts some file accesses to perform +network accesses over SMB/CIFS, through several different file path patterns. +This way, a `file://` URL passed to curl *might* be converted into a network +access inadvertently and unknowingly to curl. This is a Windows feature curl +cannot control or disable. + +## IMAP + +The path part of an IMAP request not only specifies the mailbox to list or +select, but can also be used to check the `UIDVALIDITY` of the mailbox, to +specify the `UID`, `SECTION` and `PARTIAL` octets of the message to fetch and +to specify what messages to search for. + +A top level folder list: + + imap://user:password@mail.example.com + +A folder list on the user's inbox: + + imap://user:password@mail.example.com/INBOX + +Select the user's inbox and fetch message with `uid = 1`: + + imap://user:password@mail.example.com/INBOX/;UID=1 + +Select the user's inbox and fetch the first message in the mail box: + + imap://user:password@mail.example.com/INBOX/;MAILINDEX=1 + +Select the user's inbox, check the `UIDVALIDITY` of the mailbox is 50 and +fetch message 2 if it is: + + imap://user:password@mail.example.com/INBOX;UIDVALIDITY=50/;UID=2 + +Select the user's inbox and fetch the text portion of message 3: + + imap://user:password@mail.example.com/INBOX/;UID=3/;SECTION=TEXT + +Select the user's inbox and fetch the first 1024 octets of message 4: + + imap://user:password@mail.example.com/INBOX/;UID=4/;PARTIAL=0.1024 + +Select the user's inbox and check for NEW messages: + + imap://user:password@mail.example.com/INBOX?NEW + +Select the user's inbox and search for messages containing "shadows" in the +subject line: + + imap://user:password@mail.example.com/INBOX?SUBJECT%20shadows + +Searching via the query part of the URL `?` is a search request for the +results to be returned as message sequence numbers (`MAILINDEX`). It is +possible to make a search request for results to be returned as unique ID +numbers (`UID`) by using a custom curl request via `-X`. `UID` numbers are +unique per session (and multiple sessions when `UIDVALIDITY` is the same). For +example, if you are searching for `"foo bar"` in header+body (`TEXT`) and you +want the matching `MAILINDEX` numbers returned then you could search via URL: + + imap://user:password@mail.example.com/INBOX?TEXT%20%22foo%20bar%22 + +If you want matching `UID` numbers you have to use a custom request: + + imap://user:password@mail.example.com/INBOX -X "UID SEARCH TEXT \"foo bar\"" + +For more information about IMAP commands please see RFC 9051. For more +information about the individual components of an IMAP URL please see RFC 5092. + +* Note old curl versions would `FETCH` by message sequence number when `UID` +was specified in the URL. That was a bug fixed in 7.62.0, which added +`MAILINDEX` to `FETCH` by mail sequence number. + +## LDAP + +The path part of a LDAP request can be used to specify the: Distinguished +Name, Attributes, Scope, Filter and Extension for a LDAP search. Each field is +separated by a question mark and when that field is not required an empty +string with the question mark separator should be included. + +Search for the `DN` as `My Organization`: + + ldap://ldap.example.com/o=My%20Organization + +the same search but only return `postalAddress` attributes: + + ldap://ldap.example.com/o=My%20Organization?postalAddress + +Search for an empty `DN` and request information about the +`rootDomainNamingContext` attribute for an Active Directory server: + + ldap://ldap.example.com/?rootDomainNamingContext + +For more information about the individual components of a LDAP URL please +see [RFC 4516](https://datatracker.ietf.org/doc/html/rfc4516). + +## POP3 + +The path part of a POP3 request specifies the message ID to retrieve. If the +ID is not specified then a list of waiting messages is returned instead. + +## SCP + +The path part of an SCP URL specifies the path and file to retrieve or +upload. The file is taken as an absolute path from the root directory on the +server. + +To specify a path relative to the user's home directory on the server, prepend +`~/` to the path portion. + +## SFTP + +The path part of an SFTP URL specifies the file to retrieve or upload. If the +path ends with a slash (`/`) then a directory listing is returned instead of a +file. If the path is omitted entirely then the directory listing for the root +/ home directory is returned. + +## SMB +The path part of a SMB request specifies the file to retrieve and from what +share and directory or the share to upload to and as such, may not be omitted. +If the username is embedded in the URL then it must contain the domain name +and as such, the backslash must be URL encoded as %2f. + +When uploading to SMB, the size of the file needs to be known ahead of time, +meaning that you can upload a file passed to curl over a pipe like stdin. + +curl supports SMB version 1 (only) + +## SMTP + +The path part of a SMTP request specifies the hostname to present during +communication with the mail server. If the path is omitted, then libcurl +attempts to resolve the local computer's hostname. However, this may not +return the fully qualified domain name that is required by some mail servers +and specifying this path allows you to set an alternative name, such as your +machine's fully qualified domain name, which you might have obtained from an +external function such as gethostname or getaddrinfo. + +The default smtp port is 25. Some servers use port 587 as an alternative. + +## RTMP + +There is no official URL spec for RTMP so libcurl uses the URL syntax supported +by the underlying librtmp library. It has a syntax where it wants a +traditional URL, followed by a space and a series of space-separated +`name=value` pairs. + +While space is not typically a "legal" letter, libcurl accepts them. When a +user wants to pass in a `#` (hash) character it is treated as a fragment and +it gets cut off by libcurl if provided literally. You have to escape it by +providing it as backslash and its ASCII value in hexadecimal: `\23`. diff --git a/curl/docs/VERSIONS.md b/curl/docs/VERSIONS.md new file mode 100644 index 0000000..a6c34b4 --- /dev/null +++ b/curl/docs/VERSIONS.md @@ -0,0 +1,338 @@ + + +Version Numbers and Releases +============================ + + The command line tool curl and the library libcurl are individually + versioned, but they usually follow each other closely. + + The version numbering is always built up using the same system: + + X.Y.Z + + - X is main version number + - Y is release number + - Z is patch number + +## Bumping numbers + + One of these numbers get bumped in each new release. The numbers to the right + of a bumped number are reset to zero. + + The main version number is bumped when *really* big, world colliding changes + are made. The release number is bumped when changes are performed or + things/features are added. The patch number is bumped when the changes are + mere bugfixes. + + It means that after release 1.2.3, we can release 2.0.0 if something really + big has been made, 1.3.0 if not that big changes were made or 1.2.4 if only + bugs were fixed. + + Bumping, as in increasing the number with 1, is unconditionally only + affecting one of the numbers (except the ones to the right of it, that may be + set to zero). 1 becomes 2, 3 becomes 4, 9 becomes 10, 88 becomes 89 and 99 + becomes 100. So, after 1.2.9 comes 1.2.10. After 3.99.3, 3.100.0 might come. + + All original curl source release archives are named according to the libcurl + version (not according to the curl client version that, as said before, might + differ). + + As a service to any application that might want to support new libcurl + features while still being able to build with older versions, all releases + have the libcurl version stored in the `curl/curlver.h` file using a static + numbering scheme that can be used for comparison. The version number is + defined as: + +```c +#define LIBCURL_VERSION_NUM 0xXXYYZZ +``` + + Where `XX`, `YY` and `ZZ` are the main version, release and patch numbers in + hexadecimal. All three number fields are always represented using two digits + (eight bits each). 1.2 would appear as "0x010200" while version 9.11.7 + appears as `0x090b07`. + + This 6-digit hexadecimal number is always a greater number in a more recent + release. It makes comparisons with greater than and less than work. + + This number is also available as three separate defines: + `LIBCURL_VERSION_MAJOR`, `LIBCURL_VERSION_MINOR` and `LIBCURL_VERSION_PATCH`. + +## Past releases + +This is a list of all public releases with their version numbers and release +dates. The tool was called `httpget` before 2.0, `urlget` before 4.0 then +`curl` since 4.0. `libcurl` and `curl` are always released in sync, using the +same version numbers. + +- 8.14.0: pending +- 8.13.0: April 2 2025 +- 8.12.1: February 13 2025 +- 8.12.0: February 5 2025 +- 8.11.1: December 11 2024 +- 8.11.0: November 6 2024 +- 8.10.1: September 18 2024 +- 8.10.0: September 11 2024 +- 8.9.1: July 31 2024 +- 8.9.0: July 24 2024 +- 8.8.0: May 22 2024 +- 8.7.1: March 27 2024 +- 8.7.0: March 27 2024 +- 8.6.0: January 31 2024 +- 8.5.0: December 6 2023 +- 8.4.0: October 11 2023 +- 8.3.0: September 13 2023 +- 8.2.1: July 26 2023 +- 8.2.0: July 19 2023 +- 8.1.2: May 30 2023 +- 8.1.1: May 23 2023 +- 8.1.0: May 17 2023 +- 8.0.1: March 20 2023 +- 8.0.0: March 20 2023 +- 7.88.1: February 20 2023 +- 7.88.0: February 15 2023 +- 7.87.0: December 21 2022 +- 7.86.0: October 26 2022 +- 7.85.0: August 31 2022 +- 7.84.0: June 27 2022 +- 7.83.1: May 11 2022 +- 7.83.0: April 27 2022 +- 7.82.0: March 5 2022 +- 7.81.0: January 5 2022 +- 7.80.0: November 10 2021 +- 7.79.1: September 22 2021 +- 7.79.0: September 15 2021 +- 7.78.0: July 21 2021 +- 7.77.0: May 26 2021 +- 7.76.1: April 14 2021 +- 7.76.0: March 31 2021 +- 7.75.0: February 3 2021 +- 7.74.0: December 9 2020 +- 7.73.0: October 14 2020 +- 7.72.0: August 19 2020 +- 7.71.1: July 1 2020 +- 7.71.0: June 24 2020 +- 7.70.0: April 29 2020 +- 7.69.1: March 11 2020 +- 7.69.0: March 4 2020 +- 7.68.0: January 8 2020 +- 7.67.0: November 6 2019 +- 7.66.0: September 11 2019 +- 7.65.3: July 19 2019 +- 7.65.2: July 17 2019 +- 7.65.1: June 5 2019 +- 7.65.0: May 22 2019 +- 7.64.1: March 27 2019 +- 7.64.0: February 6 2019 +- 7.63.0: December 12 2018 +- 7.62.0: October 31 2018 +- 7.61.1: September 5 2018 +- 7.61.0: July 11 2018 +- 7.60.0: May 16 2018 +- 7.59.0: March 14 2018 +- 7.58.0: January 24 2018 +- 7.57.0: November 29 2017 +- 7.56.1: October 23 2017 +- 7.56.0: October 4 2017 +- 7.55.1: August 14 2017 +- 7.55.0: August 9 2017 +- 7.54.1: June 14 2017 +- 7.54.0: April 19 2017 +- 7.53.1: February 24 2017 +- 7.53.0: February 22 2017 +- 7.52.1: December 23 2016 +- 7.52.0: December 21 2016 +- 7.51.0: November 2 2016 +- 7.50.3: September 14 2016 +- 7.50.2: September 7 2016 +- 7.50.1: August 3 2016 +- 7.50.0: July 21 2016 +- 7.49.1: May 30 2016 +- 7.49.0: May 18 2016 +- 7.48.0: March 23 2016 +- 7.47.1: February 8 2016 +- 7.47.0: January 27 2016 +- 7.46.0: December 2 2015 +- 7.45.0: October 7 2015 +- 7.44.0: August 12 2015 +- 7.43.0: June 17 2015 +- 7.42.1: April 29 2015 +- 7.42.0: April 22 2015 +- 7.41.0: February 25 2015 +- 7.40.0: January 8 2015 +- 7.39.0: November 5 2014 +- 7.38.0: September 10 2014 +- 7.37.1: July 16 2014 +- 7.37.0: May 21 2014 +- 7.36.0: March 26 2014 +- 7.35.0: January 29 2014 +- 7.34.0: December 17 2013 +- 7.33.0: October 14 2013 +- 7.32.0: August 12 2013 +- 7.31.0: June 22 2013 +- 7.30.0: April 12 2013 +- 7.29.0: February 6 2013 +- 7.28.1: November 20 2012 +- 7.28.0: October 10 2012 +- 7.27.0: July 27 2012 +- 7.26.0: May 24 2012 +- 7.25.0: March 22 2012 +- 7.24.0: January 24 2012 +- 7.23.1: November 17 2011 +- 7.23.0: November 15 2011 +- 7.22.0: September 13 2011 +- 7.21.7: June 23 2011 +- 7.21.6: April 22 2011 +- 7.21.5: April 17 2011 +- 7.21.4: February 17 2011 +- 7.21.3: December 15 2010 +- 7.21.2: October 13 2010 +- 7.21.1: August 11 2010 +- 7.21.0: June 16 2010 +- 7.20.1: April 14 2010 +- 7.20.0: February 9 2010 +- 7.19.7: November 4 2009 +- 7.19.6: August 12 2009 +- 7.19.5: May 18 2009 +- 7.19.4: March 3 2009 +- 7.19.3: January 19 2009 +- 7.19.2: November 13 2008 +- 7.19.1: November 5 2008 +- 7.19.0: September 1 2008 +- 7.18.2: June 4 2008 +- 7.18.1: March 30 2008 +- 7.18.0: January 28 2008 +- 7.17.1: October 29 2007 +- 7.17.0: September 13 2007 +- 7.16.4: July 10 2007 +- 7.16.3: June 25 2007 +- 7.16.2: April 11 2007 +- 7.16.1: January 29 2007 +- 7.16.0: October 30 2006 +- 7.15.5: August 7 2006 +- 7.15.4: June 12 2006 +- 7.15.3: March 20 2006 +- 7.15.2: February 27 2006 +- 7.15.1: December 7 2005 +- 7.15.0: October 13 2005 +- 7.14.1: September 1 2005 +- 7.14.0: May 16 2005 +- 7.13.2: April 4 2005 +- 7.13.1: March 4 2005 +- 7.13.0: February 1 2005 +- 7.12.3: December 20 2004 +- 7.12.2: October 18 2004 +- 7.12.1: August 10 2004 +- 7.12.0: June 2 2004 +- 7.11.2: April 26 2004 +- 7.11.1: March 19 2004 +- 7.11.0: January 22 2004 +- 7.10.8: November 1 2003 +- 7.10.7: August 15 2003 +- 7.10.6: July 28 2003 +- 7.10.5: May 19 2003 +- 7.10.4: April 2 2003 +- 7.10.3: January 14 2003 +- 7.10.2: November 18 2002 +- 7.10.1: October 11 2002 +- 7.10: October 1 2002 +- 7.9.8: June 13 2002 +- 7.9.7: May 10 2002 +- 7.9.6: April 14 2002 +- 7.9.5: March 7 2002 +- 7.9.4: March 4 2002 +- 7.9.3: January 23 2002 +- 7.9.2: December 5 2001 +- 7.9.1: November 4 2001 +- 7.9: September 23 2001 +- 7.8.1: August 20 2001 +- 7.8: June 7 2001 +- 7.7.3: May 4 2001 +- 7.7.2: April 22 2001 +- 7.7.1: April 3 2001 +- 7.7: March 22 2001 +- 7.6.1: February 9 2001 +- 7.6: January 26 2001 +- 7.5.2: January 4 2001 +- 7.5.1: December 11 2000 +- 7.5: December 1 2000 +- 7.4.2: November 15 2000 +- 7.4.1: October 16 2000 +- 7.4: October 16 2000 +- 7.3: September 28 2000 +- 7.2.1: August 31 2000 +- 7.2: August 30 2000 +- 7.1.1: August 21 2000 +- 7.1: August 7 2000 +- 6.5.2: March 21 2000 +- 6.5.1: March 20 2000 +- 6.5: March 13 2000 +- 6.4: January 17 2000 +- 6.3.1: November 23 1999 +- 6.3: November 10 1999 +- 6.2: October 21 1999 +- 6.1: October 17 1999 +- 6.0: September 13 1999 +- 5.11: August 25 1999 +- 5.10: August 13 1999 +- 5.9.1: July 30 1999 +- 5.9: May 22 1999 +- 5.8: May 5 1999 +- 5.7.1: April 23 1999 +- 5.7: April 20 1999 +- 5.5.1: January 27 1999 +- 5.5: January 15 1999 +- 5.4: January 7 1999 +- 5.3: December 21 1998 +- 5.2.1: December 14 1998 +- 5.2: December 14 1998 +- 5.0: December 1 1998 +- 4.10: October 26 1998 +- 4.9: October 7 1998 +- 4.8.4: September 20 1998 +- 4.8.3: September 7 1998 +- 4.8.2: August 14 1998 +- 4.8.1: August 7 1998 +- 4.8: July 30 1998 +- 4.7: July 20 1998 +- 4.6: July 3 1998 +- 4.5.1: June 12 1998 +- 4.5: May 30 1998 +- 4.4: May 13 1998 +- 4.3: April 30 1998 +- 4.2: April 15 1998 +- 4.1: April 3 1998 +- 4.0: March 20 1998 +- 3.12: March 14 1998 +- 3.11: February 9 1998 +- 3.10: February 4 1998 +- 3.9: February 4 1998 +- 3.7: January 15 1998 +- 3.6: January 1 1998 +- 3.5: December 15 1997 +- 3.2: December 1 1997 +- 3.1: November 24 1997 +- 3.0: November 1 1997 +- 2.9: October 15 1997 +- 2.8: October 1 1997 +- 2.7: September 20 1997 +- 2.6: September 10 1997 +- 2.5: September 1 1997 +- 2.4: August 27 1997 +- 2.3: August 21 1997 +- 2.2: August 14 1997 +- 2.1: August 10 1997 +- 2.0: August 1 1997 +- 1.5: July 21 1997 +- 1.4: July 15 1997 +- 1.3: June 1 1997 +- 1.2: May 1 1997 +- 1.1: April 20 1997 +- 1.0: April 8 1997 +- 0.3: February 1 1997 +- 0.2: December 17 1996 +- 0.1: November 11 1996 diff --git a/curl/docs/VULN-DISCLOSURE-POLICY.md b/curl/docs/VULN-DISCLOSURE-POLICY.md new file mode 100644 index 0000000..23deb6b --- /dev/null +++ b/curl/docs/VULN-DISCLOSURE-POLICY.md @@ -0,0 +1,349 @@ + + +# curl vulnerability disclosure policy + +This document describes how security vulnerabilities are handled in the curl +project. + +## Publishing Information + +All known and public curl or libcurl related vulnerabilities are listed on +[the curl website security page](https://curl.se/docs/security.html). + +Security vulnerabilities **should not** be entered in the project's public bug +tracker. + +## Vulnerability Handling + +The typical process for handling a new security vulnerability is as follows. + +No information should be made public about a vulnerability until it is +formally announced at the end of this process. That means, for example, that a +bug tracker entry must NOT be created to track the issue since that makes the +issue public and it should not be discussed on any of the project's public +mailing lists. Messages associated with any commits should not make any +reference to the security nature of the commit if done prior to the public +announcement. + +- The person discovering the issue, the reporter, reports the vulnerability on + [HackerOne](https://hackerone.com/curl). Issues filed there reach a handful + of selected and trusted people. + +- Messages that do not relate to the reporting or managing of an undisclosed + security vulnerability in curl or libcurl are ignored and no further action + is required. + +- A person in the security team responds to the original report to acknowledge + that a human has seen the report. + +- The security team investigates the report and either rejects it or accepts + it. See below for examples of problems that are not considered + vulnerabilities. + +- If the report is rejected, the team writes to the reporter to explain why. + +- If the report is accepted, the team writes to the reporter to let them + know it is accepted and that they are working on a fix. + +- The security team discusses the problem, works out a fix, considers the + impact of the problem and suggests a release schedule. This discussion + should involve the reporter as much as possible. + +- The release of the information should be "as soon as possible" and is most + often synchronized with an upcoming release that contains the fix. If the + reporter, or anyone else involved, thinks the next planned release is too + far away, then a separate earlier release should be considered. + +- Write a security advisory draft about the problem that explains what the + problem is, its impact, which versions it affects, solutions or workarounds, + when the release is out and make sure to credit all contributors properly. + Figure out the CWE (Common Weakness Enumeration) number for the flaw. See + [SECURITY-ADVISORY](https://curl.se/dev/advisory.html) for help on creating + the advisory. + +- Request a CVE Id for the issue. curl is a CNA (CVE Numbering Authority) and + can request its own numbers. + +- Update the "security advisory" with the CVE number. + +- The security team commits the fix in a private branch. The commit message + should ideally contain the CVE number. If the severity level of the issue is + set to Low or Medium, the fix is allowed to get merged into the master + repository via a normal PR - but without mentioning it being a security + vulnerability. + +- The monetary reward part of the bug-bounty is managed by the Internet Bug + Bounty team and the reporter is asked to request the reward from them after + the issue has been completely handled and published by curl. + +- No more than 10 days before release, inform + [distros@openwall](https://oss-security.openwall.org/wiki/mailing-lists/distros) + to prepare them about the upcoming public security vulnerability + announcement - attach the advisory draft for information with CVE and + current patch. 'distros' does not accept an embargo longer than 14 days and + they do not care for Windows-specific flaws. + +- No more than 48 hours before the release, the private branch is merged into + the master branch and pushed. Once pushed, the information is accessible to + the public and the actual release should follow suit immediately afterwards. + The time between the push and the release is used for final tests and + reviews. + +- The project team creates a release that includes the fix. + +- The project team announces the release and the vulnerability to the world in + the same manner we always announce releases. It gets sent to the + curl-announce, curl-library and curl-users mailing lists. + +- The security webpage on the website should get the new vulnerability + mentioned. + +## security (at curl dot se) + +This is a private mailing list for discussions on and about curl security +issues. + +Who is on this list? There are a couple of criteria you must meet, and then we +might ask you to join the list or you can ask to join it. It really is not a +formal process. We basically only require that you have a long-term presence +in the curl project and you have shown an understanding for the project and +its way of working. You must have been around for a good while and you should +have no plans of vanishing in the near future. + +We do not make the list of participants public mostly because it tends to vary +somewhat over time and a list somewhere only risks getting outdated. + +## Publishing Security Advisories + +1. Write up the security advisory, using markdown syntax. Use the same + subtitles as last time to maintain consistency. + +2. Name the advisory file after the allocated CVE id. + +3. Add a line on the top of the array in `curl-www/docs/vuln.pm`. + +4. Put the new advisory markdown file in the `curl-www/docs/` directory. Add it + to the git repository. + +5. Run `make` in your local web checkout and verify that things look fine. + +6. On security advisory release day, push the changes on the curl-www + repository's remote master branch. + +## HackerOne + +Request the issue to be disclosed. If there are sensitive details present in +the report and discussion, those should be redacted from the disclosure. The +default policy is to disclose as much as possible as soon as the vulnerability +has been published. + +## Bug Bounty + +See [BUG-BOUNTY](https://curl.se/docs/bugbounty.html) for details on the +bug bounty program. + +# Severity levels + +The curl project's security team rates security problems using four severity +levels depending how serious we consider the problem to be. We use **Low**, +**Medium**, **High** and **Critical**. We refrain from using numerical scoring +of vulnerabilities. + +We do not support CVSS as a method to grade security vulnerabilities, so we do +not set them for CVE records published by the curl project. We believe CVSS is +a broken system that often does not properly evaluate to suitable severity +levels that reflect all dimensions and factors involved. Other organizations +however set and provide CVSS scores for curl vulnerabilities. You need to +decide for yourself if you believe they know enough about the subjects +involved to make reasonable assessments. Deciding between four different +severity levels is hard enough for us. + +When deciding severity level on a particular issue, we take all the factors +into account: attack vector, attack complexity, required privileges, necessary +build configuration, protocols involved, platform specifics and also what +effects a possible exploit or trigger of the issue can lead do, including +confidentiality, integrity or availability problems. + +## Low + +This is a security problem that is truly hard or unlikely to exploit or +trigger. Due to timing, platform requirements or the fact that options or +protocols involved are rare etc. [Past +example](https://curl.se/docs/CVE-2022-43552.html) + +## Medium + +This is a security problem that is less hard than **Low** to exploit or +trigger. Less strict timing, wider platforms availability or involving more +widely used options or protocols. A problem that usually needs something else +to also happen to become serious. [Past +example](https://curl.se/docs/CVE-2022-32206.html) + +## High + +This issue in itself a serious problem with real world impact. Flaws that can +easily compromise the confidentiality, integrity or availability of resources. +Exploiting or triggering this problem is not hard. [Past +example](https://curl.se/docs/CVE-2019-3822.html) + +## Critical + +Easily exploitable by a remote unauthenticated attacker and lead to system +compromise (arbitrary code execution) without requiring user interaction, with +a common configuration on a popular platform. This issue has few restrictions +and requirements and can be exploited easily using most curl configurations. +[Past example](https://curl.se/docs/CVE-2000-0973.html) + +# Not security issues + +This is an incomplete list of issues that are not considered vulnerabilities. + +## Small memory leaks + +We do not consider a small memory leak a security problem; even if the amount +of allocated memory grows by a small amount every now and then. Long-living +applications and services already need to have counter-measures and deal with +growing memory usage, be it leaks or just increased use. A small memory or +resource leak is then expected to *not* cause a security problem. + +Of course there can be a discussion if a leak is small or not. A large leak +can be considered a security problem due to the DOS risk. If leaked memory +contains sensitive data it might also qualify as a security problem. + +## Never-ending transfers + +We do not consider flaws that cause a transfer to never end to be a security +problem. There are already several benign and likely reasons for transfers to +stall and never end, so applications that cannot deal with never-ending +transfers already need to have counter-measures established. + +If the problem avoids the regular counter-measures when it causes a never- +ending transfer, it might be a security problem. + +## Not practically possible + +If the flaw or vulnerability cannot practically get executed on existing +hardware it is not a security problem. + +## API misuse + +If a reported issue only triggers by an application using the API in a way +that is not documented to work or even documented to not work, it is probably +not going to be considered a security problem. We only guarantee secure and +proper functionality when the APIs are used as expected and documented. + +There can be a discussion about what the documentation actually means and how +to interpret the text, which might end up with us still agreeing that it is a +security problem. + +## Local attackers already present + +When an issue can only be attacked or misused by an attacker present on the +local system or network, the bar is raised. If a local user wrongfully has +elevated rights on your system enough to attack curl, they can probably +already do much worse harm and the problem is not really in curl. + +## Debug & Experiments + +Vulnerabilities in features which are off by default (in the build) and +documented as experimental, or exist only in debug mode, are not eligible for a +reward and we do not consider them security problems. + +## URL inconsistencies + +URL parser inconsistencies between browsers and curl are expected and are not +considered security vulnerabilities. The WHATWG URL Specification and RFC +3986+ (the plus meaning that it is an extended version) [are not completely +interoperable](https://github.com/bagder/docs/blob/master/URL-interop.md). + +Obvious parser bugs can still be vulnerabilities of course. + +## Visible command line arguments + +The curl command blanks the contents of a number of command line arguments to +prevent them from appearing in process listings. It does not blank all +arguments even if some of them that are not blanked might contain sensitive +data. We consider this functionality a best-effort and omissions are not +security vulnerabilities. + + - not all systems allow the arguments to be blanked in the first place + - since curl blanks the argument itself they are readable for a short moment + no matter what + - virtually every argument can contain sensitive data, depending on use + - blanking all arguments would make it impractical for users to differentiate + curl command lines in process listings + +## Busy-loops + +Busy-loops that consume 100% CPU time but eventually end (perhaps due to a set +timeout value or otherwise) are not considered security problems. Applications +are supposed to already handle situations when the transfer loop legitimately +consumes 100% CPU time, so while a prolonged such busy-loop is a nasty bug, we +do not consider it a security problem. + +## Saving files + +curl cannot protect against attacks where an attacker has write access to the +same directory where curl is directed to save files. + +## Tricking a user to run a command line + +A creative, misleading or funny looking command line is not a security +problem. The curl command line tool takes options and URLs on the command line +and if an attacker can trick the user to run a specifically crafted curl +command line, all bets are off. Such an attacker can just as well have the +user run a much worse command that can do something fatal (like +`sudo rm -rf /`). + +## Terminal output and escape sequences + +Content that is transferred from a server and gets displayed in a terminal by +curl may contain escape sequences or use other tricks to fool the user. This +is curl working as designed and is not a curl security problem. Escape +sequences, moving cursor, changing color etc, is also frequently used for +good. To reduce the risk of getting fooled, save files and browse them after +download using a display method that minimizes risks. + +## NULL dereferences and crashes + +If a malicious server can trigger a NULL dereference in curl or otherwise +cause curl to crash (and nothing worse), chances are big that we do not +consider that a security problem. + +Malicious servers can already cause considerable harm and denial of service +like scenarios without having to trigger such code paths. For example by +stalling, being terribly slow or by delivering enormous amounts of data. +Additionally, applications are expected to handle "normal" crashes without +that being the end of the world. + +There need to be more and special circumstances to treat such problems as +security issues. + +## Legacy dependencies + +Problems that can be triggered only by the use of a *legacy dependency* are +not considered security problems. + +A *legacy dependency* is here defined as: + +- the legacy version was released over ten years ago AND + +- the legacy version is no longer in use by any existing still supported + operating system or distribution AND + +- there are modern versions of equivalent or better functionality offered and + in common use + +## weak algorithms required for functionality + +curl supports several algorithms that are considered weak, like DES and MD5. +These algorithms are still not curl security vulnerabilities or security +problems as they are only used when the users explicitly ask for their use by +using the protocols or options that require the use of those algorithms. + +When servers upgrade to use secure alternatives, curl users should use those +options/protocols. diff --git a/curl/docs/curl-config.md b/curl/docs/curl-config.md new file mode 100644 index 0000000..12ad245 --- /dev/null +++ b/curl/docs/curl-config.md @@ -0,0 +1,124 @@ +--- +c: Copyright (C) Daniel Stenberg, , et al. +SPDX-License-Identifier: curl +Title: curl-config +Section: 1 +Source: curl-config +See-also: + - curl (1) +Added-in: 7.7.2 +--- + +# NAME + +curl-config - Get information about a libcurl installation + +# SYNOPSIS + +**curl-config [options]** + +# DESCRIPTION + +**curl-config** +displays information about the curl and libcurl installation. + +# OPTIONS + +## `--ca` + +Displays the built-in path to the CA cert bundle this libcurl uses. + +## `--cc` + +Displays the compiler used to build libcurl. + +## `--cflags` + +Set of compiler options (CFLAGS) to use when compiling files that use +libcurl. Currently that is only the include path to the curl include files. + +## `--checkfor [version]` + +Specify the oldest possible libcurl version string you want, and this script +returns 0 if the current installation is new enough or it returns 1 and +outputs a text saying that the current version is not new enough. (Added in +7.15.4) + +## `--configure` + +Displays the arguments given to configure when building curl. + +## `--feature` + +Lists what particular main features the installed libcurl was built with. At +the time of writing, this list may include SSL, KRB4 or IPv6. Do not assume +any particular order. The keywords are separated by newlines. There may be +none, one, or several keywords in the list. + +## `--help` + +Displays the available options. + +## `--libs` + +Shows the complete set of libs and other linker options you need in order to +link your application with libcurl. + +## `--prefix` + +This is the prefix used when libcurl was installed. libcurl is then installed +in $prefix/lib and its header files are installed in $prefix/include and so +on. The prefix is set with `configure --prefix`. + +## `--protocols` + +Lists what particular protocols the installed libcurl was built to support. At +the time of writing, this list may include HTTP, HTTPS, FTP, FTPS, FILE, +TELNET, LDAP, DICT and many more. Do not assume any particular order. The +protocols are listed using uppercase and are separated by newlines. There may +be none, one, or several protocols in the list. (Added in 7.13.0) + +## `--ssl-backends` + +Lists the SSL backends that were enabled when libcurl was built. It might be +no, one or several names. If more than one name, they appear comma-separated. +(Added in 7.58.0) + +## `--static-libs` + +Shows the complete set of libs and other linker options you need in order to +link your application with libcurl statically. (Added in 7.17.1) + +## `--version` + +Outputs version information about the installed libcurl. + +## `--vernum` + +Outputs version information about the installed libcurl, in numerical mode. +This shows the version number, in hexadecimal, using 8 bits for each part: +major, minor, and patch numbers. This makes libcurl 7.7.4 appear as 070704 and +libcurl 12.13.14 appear as 0c0d0e... Note that the initial zero might be +omitted. (This option was broken in the 7.15.0 release.) + +# EXAMPLES + +What linker options do I need when I link with libcurl? + + $ curl-config --libs + +What compiler options do I need when I compile using libcurl functions? + + $ curl-config --cflags + +How do I know if libcurl was built with SSL support? + + $ curl-config --feature | grep SSL + +What's the installed libcurl version? + + $ curl-config --version + +How do I build a single file with a one-line command? + + $ `curl-config --cc --cflags` -o example source.c `curl-config --libs` diff --git a/curl/docs/examples/10-at-a-time.c b/curl/docs/examples/10-at-a-time.c new file mode 100644 index 0000000..38a0f24 --- /dev/null +++ b/curl/docs/examples/10-at-a-time.c @@ -0,0 +1,153 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Download many files in parallel, in the same thread. + * + */ + +#include +#include +#include + +static const char *urls[] = { + "https://www.microsoft.com", + "https://opensource.org", + "https://www.google.com", + "https://www.yahoo.com", + "https://www.ibm.com", + "https://www.mysql.com", + "https://www.oracle.com", + "https://www.ripe.net", + "https://www.iana.org", + "https://www.amazon.com", + "https://www.netcraft.com", + "https://www.heise.de", + "https://www.chip.de", + "https://www.ca.com", + "https://www.cnet.com", + "https://www.mozilla.org", + "https://www.cnn.com", + "https://www.wikipedia.org", + "https://www.dell.com", + "https://www.hp.com", + "https://www.cert.org", + "https://www.mit.edu", + "https://www.nist.gov", + "https://www.ebay.com", + "https://www.playstation.com", + "https://www.uefa.com", + "https://www.ieee.org", + "https://www.apple.com", + "https://www.symantec.com", + "https://www.zdnet.com", + "https://www.fujitsu.com/global/", + "https://www.supermicro.com", + "https://www.hotmail.com", + "https://www.ietf.org", + "https://www.bbc.co.uk", + "https://news.google.com", + "https://www.foxnews.com", + "https://www.msn.com", + "https://www.wired.com", + "https://www.sky.com", + "https://www.usatoday.com", + "https://www.cbs.com", + "https://www.nbc.com/", + "https://slashdot.org", + "https://www.informationweek.com", + "https://apache.org", + "https://www.un.org", +}; + +#define MAX_PARALLEL 10 /* number of simultaneous transfers */ +#define NUM_URLS sizeof(urls)/sizeof(char *) + +static size_t write_cb(char *data, size_t n, size_t l, void *userp) +{ + /* take care of the data here, ignored in this example */ + (void)data; + (void)userp; + return n*l; +} + +static void add_transfer(CURLM *cm, unsigned int i, int *left) +{ + CURL *eh = curl_easy_init(); + curl_easy_setopt(eh, CURLOPT_WRITEFUNCTION, write_cb); + curl_easy_setopt(eh, CURLOPT_URL, urls[i]); + curl_easy_setopt(eh, CURLOPT_PRIVATE, urls[i]); + curl_multi_add_handle(cm, eh); + (*left)++; +} + +int main(void) +{ + CURLM *cm; + CURLMsg *msg; + unsigned int transfers = 0; + int msgs_left = -1; + int left = 0; + + curl_global_init(CURL_GLOBAL_ALL); + cm = curl_multi_init(); + + /* Limit the amount of simultaneous connections curl should allow: */ + curl_multi_setopt(cm, CURLMOPT_MAXCONNECTS, (long)MAX_PARALLEL); + + for(transfers = 0; transfers < MAX_PARALLEL && transfers < NUM_URLS; + transfers++) + add_transfer(cm, transfers, &left); + + do { + int still_alive = 1; + curl_multi_perform(cm, &still_alive); + + /* !checksrc! disable EQUALSNULL 1 */ + while((msg = curl_multi_info_read(cm, &msgs_left)) != NULL) { + if(msg->msg == CURLMSG_DONE) { + char *url; + CURL *e = msg->easy_handle; + curl_easy_getinfo(msg->easy_handle, CURLINFO_PRIVATE, &url); + fprintf(stderr, "R: %d - %s <%s>\n", + msg->data.result, curl_easy_strerror(msg->data.result), url); + curl_multi_remove_handle(cm, e); + curl_easy_cleanup(e); + left--; + } + else { + fprintf(stderr, "E: CURLMsg (%d)\n", msg->msg); + } + if(transfers < NUM_URLS) + add_transfer(cm, transfers++, &left); + } + if(left) + curl_multi_wait(cm, NULL, 0, 1000, NULL); + + } while(left); + + curl_multi_cleanup(cm); + curl_global_cleanup(); + + return EXIT_SUCCESS; +} diff --git a/curl/docs/examples/address-scope.c b/curl/docs/examples/address-scope.c new file mode 100644 index 0000000..43e9cf8 --- /dev/null +++ b/curl/docs/examples/address-scope.c @@ -0,0 +1,62 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * HTTP GET to an IPv6 address with specific scope + * + */ +#include +#include + +#if !defined(_WIN32) && !defined(MSDOS) && !defined(__AMIGA__) +#include +#endif + +int main(void) +{ +#if !defined(_WIN32) && !defined(MSDOS) && !defined(__AMIGA__) + /* Windows/MS-DOS users need to find how to use if_nametoindex() */ + CURL *curl; + CURLcode res; + + curl = curl_easy_init(); + if(curl) { + long my_scope_id; + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com"); + + my_scope_id = (long)if_nametoindex("eth0"); + curl_easy_setopt(curl, CURLOPT_ADDRESS_SCOPE, my_scope_id); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } +#endif + return 0; +} diff --git a/curl/docs/examples/altsvc.c b/curl/docs/examples/altsvc.c new file mode 100644 index 0000000..2f70d05 --- /dev/null +++ b/curl/docs/examples/altsvc.c @@ -0,0 +1,58 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * HTTP with Alt-Svc support + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com"); + + /* cache the alternatives in this file */ + curl_easy_setopt(curl, CURLOPT_ALTSVC, "altsvc.txt"); + + /* restrict which HTTP versions to use alternatives */ + curl_easy_setopt(curl, CURLOPT_ALTSVC_CTRL, (long) + CURLALTSVC_H1|CURLALTSVC_H2|CURLALTSVC_H3); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/anyauthput.c b/curl/docs/examples/anyauthput.c new file mode 100644 index 0000000..550c827 --- /dev/null +++ b/curl/docs/examples/anyauthput.c @@ -0,0 +1,164 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * HTTP PUT upload with authentication using "any" method. libcurl picks the + * one the server supports/wants. + * + */ +#include +#include +#include +#include + +#include + +#ifdef _WIN32 +#undef stat +#define stat _stat +#undef fstat +#define fstat _fstat +#define fileno _fileno +#endif + +#if LIBCURL_VERSION_NUM < 0x070c03 +#error "upgrade your libcurl to no less than 7.12.3" +#endif + +/* + * This example shows an HTTP PUT operation with authentication using "any" + * type. It PUTs a file given as a command line argument to the URL also given + * on the command line. + * + * Since libcurl 7.12.3, using "any" auth and POST/PUT requires a set seek + * function. + * + * This example also uses its own read callback. + */ + +/* seek callback function */ +static int my_seek(void *userp, curl_off_t offset, int origin) +{ + FILE *fp = (FILE *) userp; + + if(-1 == fseek(fp, (long) offset, origin)) + /* could not seek */ + return CURL_SEEKFUNC_CANTSEEK; + + return CURL_SEEKFUNC_OK; /* success! */ +} + +/* read callback function, fread() look alike */ +static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *stream) +{ + size_t nread; + + nread = fread(ptr, size, nmemb, stream); + + if(nread > 0) { + fprintf(stderr, "*** We read %lu bytes from file\n", (unsigned long)nread); + } + + return nread; +} + +int main(int argc, char **argv) +{ + CURL *curl; + CURLcode res; + FILE *fp; + struct stat file_info; + + char *file; + char *url; + + if(argc < 3) + return 1; + + file = argv[1]; + url = argv[2]; + + /* get the file size of the local file */ + fp = fopen(file, "rb"); + if(!fp) + return 2; + +#ifdef UNDER_CE + stat(file, &file_info); +#else + fstat(fileno(fp), &file_info); +#endif + + /* In Windows, this inits the Winsock stuff */ + curl_global_init(CURL_GLOBAL_ALL); + + /* get a curl handle */ + curl = curl_easy_init(); + if(curl) { + /* we want to use our own read function */ + curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback); + + /* which file to upload */ + curl_easy_setopt(curl, CURLOPT_READDATA, (void *) fp); + + /* set the seek function */ + curl_easy_setopt(curl, CURLOPT_SEEKFUNCTION, my_seek); + + /* pass the file descriptor to the seek callback as well */ + curl_easy_setopt(curl, CURLOPT_SEEKDATA, (void *) fp); + + /* enable "uploading" (which means PUT when doing HTTP) */ + curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L); + + /* specify target URL, and note that this URL should also include a file + name, not only a directory (as you can do with GTP uploads) */ + curl_easy_setopt(curl, CURLOPT_URL, url); + + /* and give the size of the upload, this supports large file sizes + on systems that have general support for it */ + curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, + (curl_off_t)file_info.st_size); + + /* tell libcurl we can use "any" auth, which lets the lib pick one, but it + also costs one extra round-trip and possibly sending of all the PUT + data twice!!! */ + curl_easy_setopt(curl, CURLOPT_HTTPAUTH, (long)CURLAUTH_ANY); + + /* set user name and password for the authentication */ + curl_easy_setopt(curl, CURLOPT_USERPWD, "user:password"); + + /* Now run off and do what you have been told! */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + fclose(fp); /* close the local file */ + + curl_global_cleanup(); + return 0; +} diff --git a/curl/docs/examples/block_ip.c b/curl/docs/examples/block_ip.c new file mode 100644 index 0000000..bff7b63 --- /dev/null +++ b/curl/docs/examples/block_ip.c @@ -0,0 +1,356 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Show how CURLOPT_OPENSOCKETFUNCTION can be used to block IP addresses. + * + */ +/* This is an advanced example that defines a whitelist or a blacklist to + * filter IP addresses. + */ + +#if defined(__AMIGA__) || defined(UNDER_CE) +#include +int main(void) { printf("Platform not supported.\n"); return 1; } +#else + +#ifdef _WIN32 +#ifndef _CRT_SECURE_NO_WARNINGS +#define _CRT_SECURE_NO_WARNINGS +#endif +#ifndef _CRT_NONSTDC_NO_DEPRECATE +#define _CRT_NONSTDC_NO_DEPRECATE +#endif +#if !defined(_WIN32_WINNT) || _WIN32_WINNT < 0x0600 +#undef _WIN32_WINNT +#define _WIN32_WINNT 0x0600 /* Requires Windows Vista */ +#endif +#include +#include +#include +#else +#include +#include +#include +#include +#endif + +#include +#include +#include + +#include + +#ifndef TRUE +#define TRUE 1 +#endif + +#ifndef FALSE +#define FALSE 0 +#endif + +struct ip { + /* The user-provided IP address or network (use CIDR) to filter */ + char *str; + /* IP address family AF_INET (IPv4) or AF_INET6 (IPv6) */ + int family; + /* IP in network byte format */ + union netaddr { + struct in_addr ipv4; +#ifdef AF_INET6 + struct in6_addr ipv6; +#endif + } netaddr; + /* IP bits to match against. + * This is equal to the CIDR notation or max bits if no CIDR. + * For example if ip->str is 127.0.0.0/8 then ip->maskbits is 8. + */ + int maskbits; + struct ip *next; +}; + +enum connection_filter_t { + CONNECTION_FILTER_BLACKLIST, + CONNECTION_FILTER_WHITELIST +}; + +struct connection_filter { + struct ip *list; + enum connection_filter_t type; + int verbose; +#ifdef AF_INET6 + /* If the address being filtered is an IPv4-mapped IPv6 address then it is + * checked against IPv4 list entries as well, unless ipv6_v6only is set TRUE. + */ + int ipv6_v6only; +#endif +}; + +static struct ip *ip_list_append(struct ip *list, const char *data) +{ + struct ip *ip, *last; + char *cidr; + + ip = (struct ip *)calloc(1, sizeof(*ip)); + if(!ip) + return NULL; + + if(strchr(data, ':')) { +#ifdef AF_INET6 + ip->family = AF_INET6; +#else + free(ip); + return NULL; +#endif + } + else + ip->family = AF_INET; + + ip->str = strdup(data); + if(!ip->str) { + free(ip); + return NULL; + } + + /* determine the number of bits that this IP will match against */ + cidr = strchr(ip->str, '/'); + if(cidr) { + ip->maskbits = atoi(cidr + 1); + if(ip->maskbits <= 0 || +#ifdef AF_INET6 + (ip->family == AF_INET6 && ip->maskbits > 128) || +#endif + (ip->family == AF_INET && ip->maskbits > 32)) { + free(ip->str); + free(ip); + return NULL; + } + /* ignore the CIDR notation when converting ip->str to ip->netaddr */ + *cidr = '\0'; + } + else if(ip->family == AF_INET) + ip->maskbits = 32; +#ifdef AF_INET6 + else if(ip->family == AF_INET6) + ip->maskbits = 128; +#endif + + if(1 != inet_pton(ip->family, ip->str, &ip->netaddr)) { + free(ip->str); + free(ip); + return NULL; + } + + if(cidr) + *cidr = '/'; + + if(!list) + return ip; + for(last = list; last->next; last = last->next) + ; + last->next = ip; + return list; +} + +static void ip_list_free_all(struct ip *list) +{ + struct ip *next; + while(list) { + next = list->next; + free(list->str); + free(list); + list = next; + } +} + +static void free_connection_filter(struct connection_filter *filter) +{ + if(filter) { + ip_list_free_all(filter->list); + free(filter); + } +} + +static int ip_match(struct ip *ip, void *netaddr) +{ + int bytes, tailbits; + const unsigned char *x, *y; + + x = (unsigned char *)&ip->netaddr; + y = (unsigned char *)netaddr; + + for(bytes = ip->maskbits / 8; bytes; --bytes) { + if(*x++ != *y++) + return FALSE; + } + + tailbits = ip->maskbits % 8; + if(tailbits) { + unsigned char tailmask = (unsigned char)((0xFF << (8 - tailbits)) & 0xFF); + if((*x & tailmask) != (*y & tailmask)) + return FALSE; + } + + return TRUE; +} + +#ifdef AF_INET6 +static int is_ipv4_mapped_ipv6_address(int family, void *netaddr) +{ + if(family == AF_INET6) { + int i; + unsigned char *x = (unsigned char *)netaddr; + for(i = 0; i < 12; ++i) { + if(x[i]) + break; + } + /* support formats ::x.x.x.x (deprecated) and ::ffff:x.x.x.x */ + if((i == 12 && (x[i] || x[i + 1] || x[i + 2] || x[i + 3])) || + (i == 10 && (x[i] == 0xFF && x[i + 1] == 0xFF))) + return TRUE; + } + + return FALSE; +} +#endif /* AF_INET6 */ + +static curl_socket_t opensocket(void *clientp, + curlsocktype purpose, + struct curl_sockaddr *address) +{ + /* filter the address */ + if(purpose == CURLSOCKTYPE_IPCXN) { + void *cinaddr = NULL; + + if(address->family == AF_INET) + cinaddr = &((struct sockaddr_in *)(void *)&address->addr)->sin_addr; +#ifdef AF_INET6 + else if(address->family == AF_INET6) + cinaddr = &((struct sockaddr_in6 *)(void *)&address->addr)->sin6_addr; +#endif + + if(cinaddr) { + struct ip *ip; + struct connection_filter *filter = (struct connection_filter *)clientp; +#ifdef AF_INET6 + int mapped = !filter->ipv6_v6only && + is_ipv4_mapped_ipv6_address(address->family, cinaddr); +#endif + + for(ip = filter->list; ip; ip = ip->next) { + if(ip->family == address->family && ip_match(ip, cinaddr)) + break; +#ifdef AF_INET6 + if(mapped && ip->family == AF_INET && address->family == AF_INET6 && + ip_match(ip, (unsigned char *)cinaddr + 12)) + break; +#endif + } + + if(ip && filter->type == CONNECTION_FILTER_BLACKLIST) { + if(filter->verbose) { + char buf[128] = {0}; + inet_ntop(address->family, cinaddr, buf, sizeof(buf)); + fprintf(stderr, "* Rejecting IP %s due to blacklist entry %s.\n", + buf, ip->str); + } + return CURL_SOCKET_BAD; + } + else if(!ip && filter->type == CONNECTION_FILTER_WHITELIST) { + if(filter->verbose) { + char buf[128] = {0}; + inet_ntop(address->family, cinaddr, buf, sizeof(buf)); + fprintf(stderr, + "* Rejecting IP %s due to missing whitelist entry.\n", buf); + } + return CURL_SOCKET_BAD; + } + } + } + + return socket(address->family, address->socktype, address->protocol); +} + +int main(void) +{ + CURL *curl; + CURLcode res; + struct connection_filter *filter; + + filter = (struct connection_filter *)calloc(1, sizeof(*filter)); + if(!filter) + return 1; + + if(curl_global_init(CURL_GLOBAL_DEFAULT)) { + free(filter); + return 1; + } + + curl = curl_easy_init(); + if(!curl) { + curl_global_cleanup(); + free(filter); + return 1; + } + + /* Set the target URL */ + curl_easy_setopt(curl, CURLOPT_URL, "http://localhost"); + + /* Define an IP connection filter. + * If an address has CIDR notation then it matches the network. + * For example 74.6.143.25/24 matches 74.6.143.0 - 74.6.143.255. + */ + filter->type = CONNECTION_FILTER_BLACKLIST; + filter->list = ip_list_append(filter->list, "98.137.11.164"); + filter->list = ip_list_append(filter->list, "127.0.0.0/8"); +#ifdef AF_INET6 + filter->list = ip_list_append(filter->list, "::1"); +#endif + + /* Set the socket function which does the filtering */ + curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, opensocket); + curl_easy_setopt(curl, CURLOPT_OPENSOCKETDATA, filter); + + /* Verbose mode */ + filter->verbose = TRUE; + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + /* Perform the request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) { + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + } + + /* Clean up */ + curl_easy_cleanup(curl); + free_connection_filter(filter); + + /* Clean up libcurl */ + curl_global_cleanup(); + + return 0; +} +#endif diff --git a/curl/docs/examples/certinfo.c b/curl/docs/examples/certinfo.c new file mode 100644 index 0000000..795be6c --- /dev/null +++ b/curl/docs/examples/certinfo.c @@ -0,0 +1,87 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Extract lots of TLS certificate info. + * + */ +#include + +#include + +static size_t wrfu(void *ptr, size_t size, size_t nmemb, void *stream) +{ + (void)stream; + (void)ptr; + return size * nmemb; +} + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl_global_init(CURL_GLOBAL_DEFAULT); + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/"); + + curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, wrfu); + + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); + + curl_easy_setopt(curl, CURLOPT_VERBOSE, 0L); + curl_easy_setopt(curl, CURLOPT_CERTINFO, 1L); + + res = curl_easy_perform(curl); + + if(!res) { + struct curl_certinfo *certinfo; + + res = curl_easy_getinfo(curl, CURLINFO_CERTINFO, &certinfo); + + if(!res && certinfo) { + int i; + + printf("%d certs!\n", certinfo->num_of_certs); + + for(i = 0; i < certinfo->num_of_certs; i++) { + struct curl_slist *slist; + + for(slist = certinfo->certinfo[i]; slist; slist = slist->next) + printf("%s\n", slist->data); + + } + } + + } + + curl_easy_cleanup(curl); + } + + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/chkspeed.c b/curl/docs/examples/chkspeed.c new file mode 100644 index 0000000..fc40814 --- /dev/null +++ b/curl/docs/examples/chkspeed.c @@ -0,0 +1,224 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Show transfer timing info after download completes. + * + */ +/* Example source code to show how the callback function can be used to + * download data into a chunk of memory instead of storing it in a file. + * After successful download we use curl_easy_getinfo() calls to get the + * amount of downloaded bytes, the time used for the whole download, and + * the average download speed. + * On Linux you can create the download test files with: + * dd if=/dev/urandom of=file_1M.bin bs=1M count=1 + * + */ + +#include +#include +#include + +#include + +#define URL_BASE "http://speedtest.your.domain/" +#define URL_1M URL_BASE "file_1M.bin" +#define URL_2M URL_BASE "file_2M.bin" +#define URL_5M URL_BASE "file_5M.bin" +#define URL_10M URL_BASE "file_10M.bin" +#define URL_20M URL_BASE "file_20M.bin" +#define URL_50M URL_BASE "file_50M.bin" +#define URL_100M URL_BASE "file_100M.bin" + +#define CHKSPEED_VERSION "1.0" + +static size_t WriteCallback(void *ptr, size_t size, size_t nmemb, void *data) +{ + /* we are not interested in the downloaded bytes itself, + so we only return the size we would have saved ... */ + (void)ptr; /* unused */ + (void)data; /* unused */ + return (size_t)(size * nmemb); +} + +int main(int argc, char *argv[]) +{ + CURL *curl_handle; + CURLcode res; + int prtall = 0, prtsep = 0, prttime = 0; + const char *url = URL_1M; + char *appname = argv[0]; + + if(argc > 1) { + /* parse input parameters */ + for(argc--, argv++; *argv; argc--, argv++) { + if(argv[0][0] == '-') { + switch(argv[0][1]) { + case 'h': + case 'H': + fprintf(stderr, + "\rUsage: %s [-m=1|2|5|10|20|50|100] [-t] [-x] [url]\n", + appname); + return 1; + case 'v': + case 'V': + fprintf(stderr, "\r%s %s - %s\n", + appname, CHKSPEED_VERSION, curl_version()); + return 1; + case 'a': + case 'A': + prtall = 1; + break; + case 'x': + case 'X': + prtsep = 1; + break; + case 't': + case 'T': + prttime = 1; + break; + case 'm': + case 'M': + if(argv[0][2] == '=') { + long m = strtol((*argv) + 3, NULL, 10); + switch(m) { + case 1: + url = URL_1M; + break; + case 2: + url = URL_2M; + break; + case 5: + url = URL_5M; + break; + case 10: + url = URL_10M; + break; + case 20: + url = URL_20M; + break; + case 50: + url = URL_50M; + break; + case 100: + url = URL_100M; + break; + default: + fprintf(stderr, "\r%s: invalid parameter %s\n", + appname, *argv + 3); + return 1; + } + break; + } + fprintf(stderr, "\r%s: invalid or unknown option %s\n", + appname, *argv); + return 1; + default: + fprintf(stderr, "\r%s: invalid or unknown option %s\n", + appname, *argv); + return 1; + } + } + else { + url = *argv; + } + } + } + + /* print separator line */ + if(prtsep) { + printf("-------------------------------------------------\n"); + } + /* print localtime */ + if(prttime) { + time_t t = time(NULL); + printf("Localtime: %s", ctime(&t)); + } + + /* init libcurl */ + curl_global_init(CURL_GLOBAL_ALL); + + /* init the curl session */ + curl_handle = curl_easy_init(); + + /* specify URL to get */ + curl_easy_setopt(curl_handle, CURLOPT_URL, url); + + /* send all data to this function */ + curl_easy_setopt(curl_handle, CURLOPT_WRITEFUNCTION, WriteCallback); + + /* some servers do not like requests that are made without a user-agent + field, so we provide one */ + curl_easy_setopt(curl_handle, CURLOPT_USERAGENT, + "libcurl-speedchecker/" CHKSPEED_VERSION); + + /* get it! */ + res = curl_easy_perform(curl_handle); + + if(CURLE_OK == res) { + curl_off_t val; + + /* check for bytes downloaded */ + res = curl_easy_getinfo(curl_handle, CURLINFO_SIZE_DOWNLOAD_T, &val); + if((CURLE_OK == res) && (val > 0)) + printf("Data downloaded: %lu bytes.\n", (unsigned long)val); + + /* check for total download time */ + res = curl_easy_getinfo(curl_handle, CURLINFO_TOTAL_TIME_T, &val); + if((CURLE_OK == res) && (val > 0)) + printf("Total download time: %lu.%06lu sec.\n", + (unsigned long)(val / 1000000), (unsigned long)(val % 1000000)); + + /* check for average download speed */ + res = curl_easy_getinfo(curl_handle, CURLINFO_SPEED_DOWNLOAD_T, &val); + if((CURLE_OK == res) && (val > 0)) + printf("Average download speed: %lu kbyte/sec.\n", + (unsigned long)(val / 1024)); + + if(prtall) { + /* check for name resolution time */ + res = curl_easy_getinfo(curl_handle, CURLINFO_NAMELOOKUP_TIME_T, &val); + if((CURLE_OK == res) && (val > 0)) + printf("Name lookup time: %lu.%06lu sec.\n", + (unsigned long)(val / 1000000), (unsigned long)(val % 1000000)); + + /* check for connect time */ + res = curl_easy_getinfo(curl_handle, CURLINFO_CONNECT_TIME_T, &val); + if((CURLE_OK == res) && (val > 0)) + printf("Connect time: %lu.%06lu sec.\n", + (unsigned long)(val / 1000000), (unsigned long)(val % 1000000)); + } + } + else { + fprintf(stderr, "Error while fetching '%s' : %s\n", + url, curl_easy_strerror(res)); + } + + /* cleanup curl stuff */ + curl_easy_cleanup(curl_handle); + + /* we are done with libcurl, so clean it up */ + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/connect-to.c b/curl/docs/examples/connect-to.c new file mode 100644 index 0000000..ad1e304 --- /dev/null +++ b/curl/docs/examples/connect-to.c @@ -0,0 +1,70 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Use CURLOPT_CONNECT_TO to connect to "wrong" hostname + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + /* + Each single string should be written using the format + HOST:PORT:CONNECT-TO-HOST:CONNECT-TO-PORT where HOST is the host of the + request, PORT is the port of the request, CONNECT-TO-HOST is the host name + to connect to, and CONNECT-TO-PORT is the port to connect to. + */ + /* instead of curl.se:443, it resolves and uses example.com:443 but in other + aspects work as if it still is curl.se */ + struct curl_slist *host = curl_slist_append(NULL, + "curl.se:443:example.com:443"); + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_CONNECT_TO, host); + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/"); + + /* since this connects to the wrong host, checking the host name in the + server certificate fails, so unless we disable the check libcurl + returns CURLE_PEER_FAILED_VERIFICATION */ + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); + + /* Letting the wrong host name in the certificate be okay, the transfer + goes through but (most likely) causes a 404 or similar because it sends + an unknown name in the Host: header field */ + res = curl_easy_perform(curl); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + + curl_slist_free_all(host); + + return (int)res; +} diff --git a/curl/docs/examples/cookie_interface.c b/curl/docs/examples/cookie_interface.c new file mode 100644 index 0000000..da40953 --- /dev/null +++ b/curl/docs/examples/cookie_interface.c @@ -0,0 +1,139 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Import and export cookies with COOKIELIST. + * + */ + +#include +#include +#include +#include + +#include +#include + +static int print_cookies(CURL *curl) +{ + CURLcode res; + struct curl_slist *cookies; + struct curl_slist *nc; + int i; + + printf("Cookies, curl knows:\n"); + res = curl_easy_getinfo(curl, CURLINFO_COOKIELIST, &cookies); + if(res != CURLE_OK) { + fprintf(stderr, "Curl curl_easy_getinfo failed: %s\n", + curl_easy_strerror(res)); + return 1; + } + nc = cookies; + i = 1; + while(nc) { + printf("[%d]: %s\n", i, nc->data); + nc = nc->next; + i++; + } + if(i == 1) { + printf("(none)\n"); + } + curl_slist_free_all(cookies); + + return 0; +} + +int +main(void) +{ + CURL *curl; + CURLcode res; + + curl_global_init(CURL_GLOBAL_ALL); + curl = curl_easy_init(); + if(curl) { + char nline[512]; + + curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/"); + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + curl_easy_setopt(curl, CURLOPT_COOKIEFILE, ""); /* start cookie engine */ + res = curl_easy_perform(curl); + if(res != CURLE_OK) { + fprintf(stderr, "Curl perform failed: %s\n", curl_easy_strerror(res)); + return 1; + } + + print_cookies(curl); + + printf("Erasing curl's knowledge of cookies!\n"); + curl_easy_setopt(curl, CURLOPT_COOKIELIST, "ALL"); + + print_cookies(curl); + + printf("-----------------------------------------------\n" + "Setting a cookie \"PREF\" via cookie interface:\n"); + /* Netscape format cookie */ + curl_msnprintf(nline, sizeof(nline), "%s\t%s\t%s\t%s\t%.0f\t%s\t%s", + ".example.com", "TRUE", "/", "FALSE", + difftime(time(NULL) + 31337, (time_t)0), + "PREF", "hello example, i like you!"); + res = curl_easy_setopt(curl, CURLOPT_COOKIELIST, nline); + if(res != CURLE_OK) { + fprintf(stderr, "Curl curl_easy_setopt failed: %s\n", + curl_easy_strerror(res)); + return 1; + } + + /* HTTP-header style cookie. If you use the Set-Cookie format and do not + specify a domain then the cookie is sent for any domain and is not + modified, likely not what you intended. For more information refer to + the CURLOPT_COOKIELIST documentation. + */ + curl_msnprintf(nline, sizeof(nline), + "Set-Cookie: OLD_PREF=3d141414bf4209321; " + "expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.example.com"); + res = curl_easy_setopt(curl, CURLOPT_COOKIELIST, nline); + if(res != CURLE_OK) { + fprintf(stderr, "Curl curl_easy_setopt failed: %s\n", + curl_easy_strerror(res)); + return 1; + } + + print_cookies(curl); + + res = curl_easy_perform(curl); + if(res != CURLE_OK) { + fprintf(stderr, "Curl perform failed: %s\n", curl_easy_strerror(res)); + return 1; + } + + curl_easy_cleanup(curl); + } + else { + fprintf(stderr, "Curl init failed!\n"); + return 1; + } + + curl_global_cleanup(); + return 0; +} diff --git a/curl/docs/examples/debug.c b/curl/docs/examples/debug.c new file mode 100644 index 0000000..2bd8b97 --- /dev/null +++ b/curl/docs/examples/debug.c @@ -0,0 +1,155 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Show how CURLOPT_DEBUGFUNCTION can be used. + * + */ +#include +#include + +struct data { + char trace_ascii; /* 1 or 0 */ +}; + +static +void dump(const char *text, + FILE *stream, unsigned char *ptr, size_t size, + char nohex) +{ + size_t i; + size_t c; + + unsigned int width = 0x10; + + if(nohex) + /* without the hex output, we can fit more on screen */ + width = 0x40; + + fprintf(stream, "%s, %10.10lu bytes (0x%8.8lx)\n", + text, (unsigned long)size, (unsigned long)size); + + for(i = 0; i < size; i += width) { + + fprintf(stream, "%4.4lx: ", (unsigned long)i); + + if(!nohex) { + /* hex not disabled, show it */ + for(c = 0; c < width; c++) + if(i + c < size) + fprintf(stream, "%02x ", ptr[i + c]); + else + fputs(" ", stream); + } + + for(c = 0; (c < width) && (i + c < size); c++) { + /* check for 0D0A; if found, skip past and start a new line of output */ + if(nohex && (i + c + 1 < size) && ptr[i + c] == 0x0D && + ptr[i + c + 1] == 0x0A) { + i += (c + 2 - width); + break; + } + fprintf(stream, "%c", + (ptr[i + c] >= 0x20) && (ptr[i + c] < 0x80) ? ptr[i + c] : '.'); + /* check again for 0D0A, to avoid an extra \n if it's at width */ + if(nohex && (i + c + 2 < size) && ptr[i + c + 1] == 0x0D && + ptr[i + c + 2] == 0x0A) { + i += (c + 3 - width); + break; + } + } + fputc('\n', stream); /* newline */ + } + fflush(stream); +} + +static +int my_trace(CURL *handle, curl_infotype type, + char *data, size_t size, + void *userp) +{ + struct data *config = (struct data *)userp; + const char *text; + (void)handle; /* prevent compiler warning */ + + switch(type) { + case CURLINFO_TEXT: + fprintf(stderr, "== Info: %s", data); + return 0; + case CURLINFO_HEADER_OUT: + text = "=> Send header"; + break; + case CURLINFO_DATA_OUT: + text = "=> Send data"; + break; + case CURLINFO_SSL_DATA_OUT: + text = "=> Send SSL data"; + break; + case CURLINFO_HEADER_IN: + text = "<= Recv header"; + break; + case CURLINFO_DATA_IN: + text = "<= Recv data"; + break; + case CURLINFO_SSL_DATA_IN: + text = "<= Recv SSL data"; + break; + default: /* in case a new one is introduced to shock us */ + return 0; + } + + dump(text, stderr, (unsigned char *)data, size, config->trace_ascii); + return 0; +} + +int main(void) +{ + CURL *curl; + CURLcode res; + struct data config; + + config.trace_ascii = 1; /* enable ASCII tracing */ + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, my_trace); + curl_easy_setopt(curl, CURLOPT_DEBUGDATA, &config); + + /* the DEBUGFUNCTION has no effect until we enable VERBOSE */ + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + /* example.com is redirected, so we tell libcurl to follow redirection */ + curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); + + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/"); + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/default-scheme.c b/curl/docs/examples/default-scheme.c new file mode 100644 index 0000000..13e1e08 --- /dev/null +++ b/curl/docs/examples/default-scheme.c @@ -0,0 +1,57 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Change default scheme when none is provided in the URL + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "example.com"); + + /* Change the default protocol (scheme) for schemeless URLs from plain + "http" to use a secure one instead. */ + curl_easy_setopt(curl, CURLOPT_DEFAULT_PROTOCOL, "https"); + + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/externalsocket.c b/curl/docs/examples/externalsocket.c new file mode 100644 index 0000000..84c9ba4 --- /dev/null +++ b/curl/docs/examples/externalsocket.c @@ -0,0 +1,182 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Pass in a custom socket for libcurl to use. + * + */ +#ifdef _MSC_VER +#ifndef _WINSOCK_DEPRECATED_NO_WARNINGS +#define _WINSOCK_DEPRECATED_NO_WARNINGS /* for inet_addr() */ +#endif +#endif + +#include +#include +#include +#include + +#ifdef _WIN32 +#define close closesocket +#else +#include /* socket types */ +#include /* socket definitions */ +#include +#include /* inet (3) functions */ +#include /* misc. Unix functions */ +#endif + +#ifdef UNDER_CE +#define strerror(e) "?" +#else +#include +#endif + +/* The IP address and port number to connect to */ +#define IPADDR "127.0.0.1" +#define PORTNUM 80 + +#ifndef INADDR_NONE +#define INADDR_NONE 0xffffffff +#endif + +static size_t write_data(void *ptr, size_t size, size_t nmemb, void *stream) +{ + size_t written = fwrite(ptr, size, nmemb, (FILE *)stream); + return written; +} + +static int closecb(void *clientp, curl_socket_t item) +{ + (void)clientp; + printf("libcurl wants to close %d now\n", (int)item); + return 0; +} + +static curl_socket_t opensocket(void *clientp, + curlsocktype purpose, + struct curl_sockaddr *address) +{ + curl_socket_t sockfd; + (void)purpose; + (void)address; + sockfd = *(curl_socket_t *)clientp; + /* the actual externally set socket is passed in via the OPENSOCKETDATA + option */ + return sockfd; +} + +static int sockopt_callback(void *clientp, curl_socket_t curlfd, + curlsocktype purpose) +{ + (void)clientp; + (void)curlfd; + (void)purpose; + /* This return code was added in libcurl 7.21.5 */ + return CURL_SOCKOPT_ALREADY_CONNECTED; +} + +int main(void) +{ + CURL *curl; + CURLcode res; + struct sockaddr_in servaddr; /* socket address structure */ + curl_socket_t sockfd; + +#ifdef _WIN32 + WSADATA wsaData; + int initwsa = WSAStartup(MAKEWORD(2, 2), &wsaData); + if(initwsa) { + printf("WSAStartup failed: %d\n", initwsa); + return 1; + } +#endif + + curl = curl_easy_init(); + if(curl) { + /* + * Note that libcurl internally thinks that you connect to the host and + * port that you specify in the URL option. + */ + curl_easy_setopt(curl, CURLOPT_URL, "http://99.99.99.99:9999"); + + /* Create the socket "manually" */ + sockfd = socket(AF_INET, SOCK_STREAM, 0); + if(sockfd == CURL_SOCKET_BAD) { + printf("Error creating listening socket.\n"); + return 3; + } + + memset(&servaddr, 0, sizeof(servaddr)); + servaddr.sin_family = AF_INET; + servaddr.sin_port = htons(PORTNUM); + + servaddr.sin_addr.s_addr = inet_addr(IPADDR); + if(INADDR_NONE == servaddr.sin_addr.s_addr) { + close(sockfd); + return 2; + } + + if(connect(sockfd, (struct sockaddr *) &servaddr, sizeof(servaddr)) == + -1) { + close(sockfd); + printf("client error: connect: %s\n", strerror(errno)); + return 1; + } + + /* no progress meter please */ + curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L); + + /* send all data to this function */ + curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_data); + + /* call this function to get a socket */ + curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, opensocket); + curl_easy_setopt(curl, CURLOPT_OPENSOCKETDATA, &sockfd); + + /* call this function to close sockets */ + curl_easy_setopt(curl, CURLOPT_CLOSESOCKETFUNCTION, closecb); + curl_easy_setopt(curl, CURLOPT_CLOSESOCKETDATA, &sockfd); + + /* call this function to set options for the socket */ + curl_easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_callback); + + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + res = curl_easy_perform(curl); + + curl_easy_cleanup(curl); + + close(sockfd); + + if(res) { + printf("libcurl error: %d\n", res); + return 4; + } + } + +#ifdef _WIN32 + WSACleanup(); +#endif + return 0; +} diff --git a/curl/docs/examples/fileupload.c b/curl/docs/examples/fileupload.c new file mode 100644 index 0000000..0860c94 --- /dev/null +++ b/curl/docs/examples/fileupload.c @@ -0,0 +1,103 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Upload to a file:// URL + * + */ +#include +#include +#include +#include + +#ifdef _WIN32 +#undef stat +#define stat _stat +#undef fstat +#define fstat _fstat +#define fileno _fileno +#endif + +int main(void) +{ + CURL *curl; + CURLcode res; + struct stat file_info; + curl_off_t speed_upload, total_time; + FILE *fd; + + fd = fopen("debugit", "rb"); /* open file to upload */ + if(!fd) + return 1; /* cannot continue */ + + /* to get the file size */ +#ifdef UNDER_CE + if(stat("debugit", &file_info) != 0) { +#else + if(fstat(fileno(fd), &file_info) != 0) { +#endif + fclose(fd); + return 1; /* cannot continue */ + } + + curl = curl_easy_init(); + if(curl) { + /* upload to this place */ + curl_easy_setopt(curl, CURLOPT_URL, + "file:///home/dast/src/curl/debug/new"); + + /* tell it to "upload" to the URL */ + curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L); + + /* set where to read from (on Windows you need to use READFUNCTION too) */ + curl_easy_setopt(curl, CURLOPT_READDATA, fd); + + /* and give the size of the upload (optional) */ + curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, + (curl_off_t)file_info.st_size); + + /* enable verbose for easier tracing */ + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) { + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + } + else { + /* now extract transfer info */ + curl_easy_getinfo(curl, CURLINFO_SPEED_UPLOAD_T, &speed_upload); + curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME_T, &total_time); + + fprintf(stderr, "Speed: %lu bytes/sec during %lu.%06lu seconds\n", + (unsigned long)speed_upload, + (unsigned long)(total_time / 1000000), + (unsigned long)(total_time % 1000000)); + } + /* always cleanup */ + curl_easy_cleanup(curl); + } + fclose(fd); + return 0; +} diff --git a/curl/docs/examples/ftp-wildcard.c b/curl/docs/examples/ftp-wildcard.c new file mode 100644 index 0000000..ddc6e4a --- /dev/null +++ b/curl/docs/examples/ftp-wildcard.c @@ -0,0 +1,153 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * FTP wildcard pattern matching + * + */ +#include +#include + +struct callback_data { + FILE *output; +}; + +static long file_is_coming(struct curl_fileinfo *finfo, + void *data, + int remains); + +static long file_is_downloaded(void *data); + +static size_t write_it(char *buff, size_t size, size_t nmemb, + void *cb_data); + +int main(int argc, char **argv) +{ + /* curl easy handle */ + CURL *handle; + + /* help data */ + struct callback_data data = { 0 }; + + /* global initialization */ + CURLcode rc = curl_global_init(CURL_GLOBAL_ALL); + if(rc) + return (int)rc; + + /* initialization of easy handle */ + handle = curl_easy_init(); + if(!handle) { + curl_global_cleanup(); + return CURLE_OUT_OF_MEMORY; + } + + /* turn on wildcard matching */ + curl_easy_setopt(handle, CURLOPT_WILDCARDMATCH, 1L); + + /* callback is called before download of concrete file started */ + curl_easy_setopt(handle, CURLOPT_CHUNK_BGN_FUNCTION, file_is_coming); + + /* callback is called after data from the file have been transferred */ + curl_easy_setopt(handle, CURLOPT_CHUNK_END_FUNCTION, file_is_downloaded); + + /* this callback writes contents into files */ + curl_easy_setopt(handle, CURLOPT_WRITEFUNCTION, write_it); + + /* put transfer data into callbacks */ + curl_easy_setopt(handle, CURLOPT_CHUNK_DATA, &data); + curl_easy_setopt(handle, CURLOPT_WRITEDATA, &data); + + /* curl_easy_setopt(handle, CURLOPT_VERBOSE, 1L); */ + + /* set a URL containing wildcard pattern (only in the last part) */ + if(argc == 2) + curl_easy_setopt(handle, CURLOPT_URL, argv[1]); + else + curl_easy_setopt(handle, CURLOPT_URL, "ftp://example.com/test/*"); + + /* and start transfer! */ + rc = curl_easy_perform(handle); + + curl_easy_cleanup(handle); + curl_global_cleanup(); + return (int)rc; +} + +static long file_is_coming(struct curl_fileinfo *finfo, void *input, + int remains) +{ + struct callback_data *data = input; + printf("%3d %40s %10luB ", remains, finfo->filename, + (unsigned long)finfo->size); + + switch(finfo->filetype) { + case CURLFILETYPE_DIRECTORY: + printf(" DIR\n"); + break; + case CURLFILETYPE_FILE: + printf("FILE "); + break; + default: + printf("OTHER\n"); + break; + } + + if(finfo->filetype == CURLFILETYPE_FILE) { + /* do not transfer files >= 50B */ + if(finfo->size > 50) { + printf("SKIPPED\n"); + return CURL_CHUNK_BGN_FUNC_SKIP; + } + + data->output = fopen(finfo->filename, "wb"); + if(!data->output) { + return CURL_CHUNK_BGN_FUNC_FAIL; + } + } + + return CURL_CHUNK_BGN_FUNC_OK; +} + +static long file_is_downloaded(void *input) +{ + struct callback_data *data = input; + if(data->output) { + printf("DOWNLOADED\n"); + fclose(data->output); + data->output = 0x0; + } + return CURL_CHUNK_END_FUNC_OK; +} + +static size_t write_it(char *buff, size_t size, size_t nmemb, + void *cb_data) +{ + struct callback_data *data = cb_data; + size_t written = 0; + if(data->output) + written = fwrite(buff, size, nmemb, data->output); + else + /* listing output */ + written = fwrite(buff, size, nmemb, stdout); + return written; +} diff --git a/curl/docs/examples/ftpget.c b/curl/docs/examples/ftpget.c new file mode 100644 index 0000000..95369c1 --- /dev/null +++ b/curl/docs/examples/ftpget.c @@ -0,0 +1,94 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +#include + +#include + +/* + * Get a single file from an FTP server. + * + */ + +struct FtpFile { + const char *filename; + FILE *stream; +}; + +static size_t my_fwrite(void *buffer, size_t size, size_t nmemb, void *stream) +{ + struct FtpFile *out = (struct FtpFile *)stream; + if(!out->stream) { + /* open file for writing */ + out->stream = fopen(out->filename, "wb"); + if(!out->stream) + return 0; /* failure, cannot open file to write */ + } + return fwrite(buffer, size, nmemb, out->stream); +} + + +int main(void) +{ + CURL *curl; + CURLcode res; + struct FtpFile ftpfile = { + "curl.tar.gz", /* name to store the file as if successful */ + NULL + }; + + curl_global_init(CURL_GLOBAL_DEFAULT); + + curl = curl_easy_init(); + if(curl) { + /* + * You better replace the URL with one that works! + */ + curl_easy_setopt(curl, CURLOPT_URL, + "ftp://ftp.example.com/curl/curl-7.9.2.tar.gz"); + /* Define our callback to get called when there is data to be written */ + curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, my_fwrite); + /* Set a pointer to our struct to pass to the callback */ + curl_easy_setopt(curl, CURLOPT_WRITEDATA, &ftpfile); + + /* Switch on full protocol/debug output */ + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + res = curl_easy_perform(curl); + + /* always cleanup */ + curl_easy_cleanup(curl); + + if(CURLE_OK != res) { + /* we failed */ + fprintf(stderr, "curl told us %d\n", res); + } + } + + if(ftpfile.stream) + fclose(ftpfile.stream); /* close the local file */ + + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/ftpgetinfo.c b/curl/docs/examples/ftpgetinfo.c new file mode 100644 index 0000000..485b26b --- /dev/null +++ b/curl/docs/examples/ftpgetinfo.c @@ -0,0 +1,93 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +#include +#include + +#include + +/* + * Checks a single file's size and mtime from an FTP server. + * + */ + +static size_t throw_away(void *ptr, size_t size, size_t nmemb, void *data) +{ + (void)ptr; + (void)data; + /* we are not interested in the headers itself, + so we only return the size we would have saved ... */ + return (size_t)(size * nmemb); +} + +int main(void) +{ + char ftpurl[] = "ftp://ftp.example.com/gnu/binutils/binutils-2.19.1.tar.bz2"; + CURL *curl; + CURLcode res; + long filetime = -1; + curl_off_t filesize = 0; + const char *filename = strrchr(ftpurl, '/') + 1; + + curl_global_init(CURL_GLOBAL_DEFAULT); + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, ftpurl); + /* No download if the file */ + curl_easy_setopt(curl, CURLOPT_NOBODY, 1L); + /* Ask for filetime */ + curl_easy_setopt(curl, CURLOPT_FILETIME, 1L); + curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, throw_away); + curl_easy_setopt(curl, CURLOPT_HEADER, 0L); + /* Switch on full protocol/debug output */ + /* curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); */ + + res = curl_easy_perform(curl); + + if(CURLE_OK == res) { + /* https://curl.se/libcurl/c/curl_easy_getinfo.html */ + res = curl_easy_getinfo(curl, CURLINFO_FILETIME, &filetime); + if((CURLE_OK == res) && (filetime >= 0)) { + time_t file_time = (time_t)filetime; + printf("filetime %s: %s", filename, ctime(&file_time)); + } + res = curl_easy_getinfo(curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD_T, + &filesize); + if((CURLE_OK == res) && (filesize > 0)) + printf("filesize %s: %" CURL_FORMAT_CURL_OFF_T " bytes\n", + filename, filesize); + } + else { + /* we failed */ + fprintf(stderr, "curl told us %d\n", res); + } + + /* always cleanup */ + curl_easy_cleanup(curl); + } + + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/ftpgetresp.c b/curl/docs/examples/ftpgetresp.c new file mode 100644 index 0000000..7b40f77 --- /dev/null +++ b/curl/docs/examples/ftpgetresp.c @@ -0,0 +1,85 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +#include + +#include + +/* + * Similar to ftpget.c but also stores the received response-lines + * in a separate file using our own callback! + * + */ +static size_t +write_response(void *ptr, size_t size, size_t nmemb, void *data) +{ + FILE *writehere = (FILE *)data; + return fwrite(ptr, size, nmemb, writehere); +} + +#define FTPBODY "ftp-list" +#define FTPHEADERS "ftp-responses" + +int main(void) +{ + CURL *curl; + CURLcode res; + FILE *ftpfile; + FILE *respfile; + + /* local filename to store the file as */ + ftpfile = fopen(FTPBODY, "wb"); /* b is binary, needed on Windows */ + if(!ftpfile) + return 1; + + /* local filename to store the FTP server's response lines in */ + respfile = fopen(FTPHEADERS, "wb"); /* b is binary, needed on Windows */ + if(!respfile) { + fclose(ftpfile); + return 1; + } + + curl = curl_easy_init(); + if(curl) { + /* Get a file listing from sunet */ + curl_easy_setopt(curl, CURLOPT_URL, "ftp://ftp.example.com/"); + curl_easy_setopt(curl, CURLOPT_WRITEDATA, ftpfile); + /* If you intend to use this on Windows with a libcurl DLL, you must use + CURLOPT_WRITEFUNCTION as well */ + curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, write_response); + curl_easy_setopt(curl, CURLOPT_HEADERDATA, respfile); + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + + fclose(ftpfile); /* close the local file */ + fclose(respfile); /* close the response file */ + + return 0; +} diff --git a/curl/docs/examples/ftpsget.c b/curl/docs/examples/ftpsget.c new file mode 100644 index 0000000..dfe80b9 --- /dev/null +++ b/curl/docs/examples/ftpsget.c @@ -0,0 +1,101 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +#include + +#include + +/* + * Get a single file from an FTPS server. + * + */ + +struct FtpFile { + const char *filename; + FILE *stream; +}; + +static size_t my_fwrite(void *buffer, size_t size, size_t nmemb, + void *stream) +{ + struct FtpFile *out = (struct FtpFile *)stream; + if(!out->stream) { + /* open file for writing */ + out->stream = fopen(out->filename, "wb"); + if(!out->stream) + return 0; /* failure, cannot open file to write */ + } + return fwrite(buffer, size, nmemb, out->stream); +} + + +int main(void) +{ + CURL *curl; + CURLcode res; + struct FtpFile ftpfile = { + "yourfile.bin", /* name to store the file as if successful */ + NULL + }; + + curl_global_init(CURL_GLOBAL_DEFAULT); + + curl = curl_easy_init(); + if(curl) { + /* + * You better replace the URL with one that works! Note that we use an + * FTP:// URL with standard explicit FTPS. You can also do FTPS:// URLs if + * you want to do the rarer kind of transfers: implicit. + */ + curl_easy_setopt(curl, CURLOPT_URL, + "ftp://user@server/home/user/file.txt"); + /* Define our callback to get called when there is data to be written */ + curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, my_fwrite); + /* Set a pointer to our struct to pass to the callback */ + curl_easy_setopt(curl, CURLOPT_WRITEDATA, &ftpfile); + + /* We activate SSL and we require it for both control and data */ + curl_easy_setopt(curl, CURLOPT_USE_SSL, CURLUSESSL_ALL); + + /* Switch on full protocol/debug output */ + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + res = curl_easy_perform(curl); + + /* always cleanup */ + curl_easy_cleanup(curl); + + if(CURLE_OK != res) { + /* we failed */ + fprintf(stderr, "curl told us %d\n", res); + } + } + + if(ftpfile.stream) + fclose(ftpfile.stream); /* close the local file */ + + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/ftpupload.c b/curl/docs/examples/ftpupload.c new file mode 100644 index 0000000..6e7bece --- /dev/null +++ b/curl/docs/examples/ftpupload.c @@ -0,0 +1,150 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +#include +#include + +#include +#include +#include +#include +#ifdef UNDER_CE +#define strerror(e) "?" +#else +#include +#endif +#ifdef _WIN32 +#include +#undef stat +#define stat _stat +#else +#include +#endif + +/* + * Performs an FTP upload and renames the file just after a successful + * transfer. + * + */ + +#define LOCAL_FILE "/tmp/uploadthis.txt" +#define UPLOAD_FILE_AS "while-uploading.txt" +#define REMOTE_URL "ftp://example.com/" UPLOAD_FILE_AS +#define RENAME_FILE_TO "renamed-and-fine.txt" + +/* NOTE: if you want this example to work on Windows with libcurl as a DLL, + you MUST also provide a read callback with CURLOPT_READFUNCTION. Failing to + do so might give you a crash since a DLL may not use the variable's memory + when passed in to it from an app like this. */ +static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *stream) +{ + unsigned long nread; + /* in real-world cases, this would probably get this data differently + as this fread() stuff is exactly what the library already would do + by default internally */ + size_t retcode = fread(ptr, size, nmemb, stream); + + if(retcode > 0) { + nread = (unsigned long)retcode; + fprintf(stderr, "*** We read %lu bytes from file\n", nread); + } + + return retcode; +} + +int main(void) +{ + CURL *curl; + CURLcode res; + FILE *hd_src; + struct stat file_info; + unsigned long fsize; + + struct curl_slist *headerlist = NULL; + static const char buf_1 [] = "RNFR " UPLOAD_FILE_AS; + static const char buf_2 [] = "RNTO " RENAME_FILE_TO; + + /* get the file size of the local file */ + if(stat(LOCAL_FILE, &file_info)) { + printf("Couldn't open '%s': %s\n", LOCAL_FILE, strerror(errno)); + return 1; + } + fsize = (unsigned long)file_info.st_size; + + printf("Local file size: %lu bytes.\n", fsize); + + /* get a FILE * of the same file */ + hd_src = fopen(LOCAL_FILE, "rb"); + if(!hd_src) + return 2; + + /* In Windows, this inits the Winsock stuff */ + curl_global_init(CURL_GLOBAL_ALL); + + /* get a curl handle */ + curl = curl_easy_init(); + if(curl) { + /* build a list of commands to pass to libcurl */ + headerlist = curl_slist_append(headerlist, buf_1); + headerlist = curl_slist_append(headerlist, buf_2); + + /* we want to use our own read function */ + curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback); + + /* enable uploading */ + curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L); + + /* specify target */ + curl_easy_setopt(curl, CURLOPT_URL, REMOTE_URL); + + /* pass in that last of FTP commands to run after the transfer */ + curl_easy_setopt(curl, CURLOPT_POSTQUOTE, headerlist); + + /* now specify which file to upload */ + curl_easy_setopt(curl, CURLOPT_READDATA, hd_src); + + /* Set the size of the file to upload (optional). If you give a *_LARGE + option you MUST make sure that the type of the passed-in argument is a + curl_off_t. If you use CURLOPT_INFILESIZE (without _LARGE) you must + make sure that to pass in a type 'long' argument. */ + curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, + (curl_off_t)fsize); + + /* Now run off and do what you have been told! */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* clean up the FTP commands list */ + curl_slist_free_all(headerlist); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + fclose(hd_src); /* close the local file */ + + curl_global_cleanup(); + return 0; +} diff --git a/curl/docs/examples/ftpuploadfrommem.c b/curl/docs/examples/ftpuploadfrommem.c new file mode 100644 index 0000000..2537486 --- /dev/null +++ b/curl/docs/examples/ftpuploadfrommem.c @@ -0,0 +1,126 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * FTP upload a file from memory + * + */ +#include +#include +#include + +static const char data[]= + "Lorem ipsum dolor sit amet, consectetur adipiscing elit. " + "Nam rhoncus odio id venenatis volutpat. Vestibulum dapibus " + "bibendum ullamcorper. Maecenas finibus elit augue, vel " + "condimentum odio maximus nec. In hac habitasse platea dictumst. " + "Vestibulum vel dolor et turpis rutrum finibus ac at nulla. " + "Vivamus nec neque ac elit blandit pretium vitae maximus ipsum. " + "Quisque sodales magna vel erat auctor, sed pellentesque nisi " + "rhoncus. Donec vehicula maximus pretium. Aliquam eu tincidunt " + "lorem."; + +struct WriteThis { + const char *readptr; + size_t sizeleft; +}; + +static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp) +{ + struct WriteThis *upload = (struct WriteThis *)userp; + size_t max = size*nmemb; + + if(max < 1) + return 0; + + if(upload->sizeleft) { + size_t copylen = max; + if(copylen > upload->sizeleft) + copylen = upload->sizeleft; + memcpy(ptr, upload->readptr, copylen); + upload->readptr += copylen; + upload->sizeleft -= copylen; + return copylen; + } + + return 0; /* no more data left to deliver */ +} + +int main(void) +{ + CURL *curl; + CURLcode res; + + struct WriteThis upload; + + upload.readptr = data; + upload.sizeleft = strlen(data); + + /* In Windows, this inits the Winsock stuff */ + res = curl_global_init(CURL_GLOBAL_DEFAULT); + /* Check for errors */ + if(res != CURLE_OK) { + fprintf(stderr, "curl_global_init() failed: %s\n", + curl_easy_strerror(res)); + return 1; + } + + /* get a curl handle */ + curl = curl_easy_init(); + if(curl) { + /* First set the URL, the target file */ + curl_easy_setopt(curl, CURLOPT_URL, + "ftp://example.com/path/to/upload/file"); + + /* User and password for the FTP login */ + curl_easy_setopt(curl, CURLOPT_USERPWD, "login:secret"); + + /* Now specify we want to UPLOAD data */ + curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L); + + /* we want to use our own read function */ + curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback); + + /* pointer to pass to our read function */ + curl_easy_setopt(curl, CURLOPT_READDATA, &upload); + + /* get verbose debug output please */ + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + /* Set the expected upload size. */ + curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, + (curl_off_t)upload.sizeleft); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + curl_global_cleanup(); + return 0; +} diff --git a/curl/docs/examples/ftpuploadresume.c b/curl/docs/examples/ftpuploadresume.c new file mode 100644 index 0000000..b02ad92 --- /dev/null +++ b/curl/docs/examples/ftpuploadresume.c @@ -0,0 +1,167 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Upload to FTP, resuming failed transfers. Active mode. + * + */ + +#include +#include +#include + +/* parse headers for Content-Length */ +static size_t getcontentlengthfunc(void *ptr, size_t size, size_t nmemb, + void *stream) +{ + int r; + long len = 0; + + r = sscanf(ptr, "Content-Length: %ld\n", &len); + if(r) + *((long *) stream) = len; + + return size * nmemb; +} + +/* discard downloaded data */ +static size_t discardfunc(void *ptr, size_t size, size_t nmemb, void *stream) +{ + (void)ptr; + (void)stream; + return size * nmemb; +} + +/* read data to upload */ +static size_t readfunc(char *ptr, size_t size, size_t nmemb, void *stream) +{ + FILE *f = stream; + size_t n; + + if(ferror(f)) + return CURL_READFUNC_ABORT; + + n = fread(ptr, size, nmemb, f) * size; + + return n; +} + + +static int upload(CURL *curlhandle, const char *remotepath, + const char *localpath, long timeout, long tries) +{ + FILE *f; + long uploaded_len = 0; + CURLcode r = CURLE_GOT_NOTHING; + int c; + + f = fopen(localpath, "rb"); + if(!f) { +#ifndef UNDER_CE + perror(NULL); +#endif + return 0; + } + + curl_easy_setopt(curlhandle, CURLOPT_UPLOAD, 1L); + + curl_easy_setopt(curlhandle, CURLOPT_URL, remotepath); + + if(timeout) + curl_easy_setopt(curlhandle, CURLOPT_SERVER_RESPONSE_TIMEOUT, timeout); + + curl_easy_setopt(curlhandle, CURLOPT_HEADERFUNCTION, getcontentlengthfunc); + curl_easy_setopt(curlhandle, CURLOPT_HEADERDATA, &uploaded_len); + + curl_easy_setopt(curlhandle, CURLOPT_WRITEFUNCTION, discardfunc); + + curl_easy_setopt(curlhandle, CURLOPT_READFUNCTION, readfunc); + curl_easy_setopt(curlhandle, CURLOPT_READDATA, f); + + /* enable active mode */ + curl_easy_setopt(curlhandle, CURLOPT_FTPPORT, "-"); + + /* allow the server no more than 7 seconds to connect back */ + curl_easy_setopt(curlhandle, CURLOPT_ACCEPTTIMEOUT_MS, 7000L); + + curl_easy_setopt(curlhandle, CURLOPT_FTP_CREATE_MISSING_DIRS, 1L); + + curl_easy_setopt(curlhandle, CURLOPT_VERBOSE, 1L); + + for(c = 0; (r != CURLE_OK) && (c < tries); c++) { + /* are we resuming? */ + if(c) { /* yes */ + /* determine the length of the file already written */ + + /* + * With NOBODY and NOHEADER, libcurl issues a SIZE command, but the only + * way to retrieve the result is to parse the returned Content-Length + * header. Thus, getcontentlengthfunc(). We need discardfunc() above + * because HEADER dumps the headers to stdout without it. + */ + curl_easy_setopt(curlhandle, CURLOPT_NOBODY, 1L); + curl_easy_setopt(curlhandle, CURLOPT_HEADER, 1L); + + r = curl_easy_perform(curlhandle); + if(r != CURLE_OK) + continue; + + curl_easy_setopt(curlhandle, CURLOPT_NOBODY, 0L); + curl_easy_setopt(curlhandle, CURLOPT_HEADER, 0L); + + fseek(f, uploaded_len, SEEK_SET); + + curl_easy_setopt(curlhandle, CURLOPT_APPEND, 1L); + } + else { /* no */ + curl_easy_setopt(curlhandle, CURLOPT_APPEND, 0L); + } + + r = curl_easy_perform(curlhandle); + } + + fclose(f); + + if(r == CURLE_OK) + return 1; + else { + fprintf(stderr, "%s\n", curl_easy_strerror(r)); + return 0; + } +} + +int main(void) +{ + CURL *curlhandle = NULL; + + curl_global_init(CURL_GLOBAL_ALL); + curlhandle = curl_easy_init(); + + upload(curlhandle, "ftp://user:pass@example.com/path/file", "C:\\file", + 0, 3); + + curl_easy_cleanup(curlhandle); + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/getinfo.c b/curl/docs/examples/getinfo.c new file mode 100644 index 0000000..9c178c2 --- /dev/null +++ b/curl/docs/examples/getinfo.c @@ -0,0 +1,54 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Use getinfo to get content-type after completed transfer. + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/"); + res = curl_easy_perform(curl); + + if(CURLE_OK == res) { + char *ct; + /* ask for the content-type */ + res = curl_easy_getinfo(curl, CURLINFO_CONTENT_TYPE, &ct); + + if((CURLE_OK == res) && ct) + printf("We received Content-Type: %s\n", ct); + } + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/getinmemory.c b/curl/docs/examples/getinmemory.c new file mode 100644 index 0000000..173247d --- /dev/null +++ b/curl/docs/examples/getinmemory.c @@ -0,0 +1,118 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Shows how the write callback function can be used to download data into a + * chunk of memory instead of storing it in a file. + * + */ + +#include +#include +#include + +#include + +struct MemoryStruct { + char *memory; + size_t size; +}; + +static size_t +WriteMemoryCallback(void *contents, size_t size, size_t nmemb, void *userp) +{ + size_t realsize = size * nmemb; + struct MemoryStruct *mem = (struct MemoryStruct *)userp; + + char *ptr = realloc(mem->memory, mem->size + realsize + 1); + if(!ptr) { + /* out of memory! */ + printf("not enough memory (realloc returned NULL)\n"); + return 0; + } + + mem->memory = ptr; + memcpy(&(mem->memory[mem->size]), contents, realsize); + mem->size += realsize; + mem->memory[mem->size] = 0; + + return realsize; +} + +int main(void) +{ + CURL *curl_handle; + CURLcode res; + + struct MemoryStruct chunk; + + chunk.memory = malloc(1); /* grown as needed by the realloc above */ + chunk.size = 0; /* no data at this point */ + + curl_global_init(CURL_GLOBAL_ALL); + + /* init the curl session */ + curl_handle = curl_easy_init(); + + /* specify URL to get */ + curl_easy_setopt(curl_handle, CURLOPT_URL, "https://www.example.com/"); + + /* send all data to this function */ + curl_easy_setopt(curl_handle, CURLOPT_WRITEFUNCTION, WriteMemoryCallback); + + /* we pass our 'chunk' struct to the callback function */ + curl_easy_setopt(curl_handle, CURLOPT_WRITEDATA, (void *)&chunk); + + /* some servers do not like requests that are made without a user-agent + field, so we provide one */ + curl_easy_setopt(curl_handle, CURLOPT_USERAGENT, "libcurl-agent/1.0"); + + /* get it! */ + res = curl_easy_perform(curl_handle); + + /* check for errors */ + if(res != CURLE_OK) { + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + } + else { + /* + * Now, our chunk.memory points to a memory block that is chunk.size + * bytes big and contains the remote file. + * + * Do something nice with it! + */ + + printf("%lu bytes retrieved\n", (unsigned long)chunk.size); + } + + /* cleanup curl stuff */ + curl_easy_cleanup(curl_handle); + + free(chunk.memory); + + /* we are done with libcurl, so clean it up */ + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/getredirect.c b/curl/docs/examples/getredirect.c new file mode 100644 index 0000000..91c778d --- /dev/null +++ b/curl/docs/examples/getredirect.c @@ -0,0 +1,72 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Show how to extract Location: header and URL to redirect to. + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res; + char *location; + long response_code; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com"); + + /* example.com is redirected, figure out the redirection! */ + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + else { + res = curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response_code); + if((res == CURLE_OK) && + ((response_code / 100) != 3)) { + /* a redirect implies a 3xx response code */ + fprintf(stderr, "Not a redirect.\n"); + } + else { + res = curl_easy_getinfo(curl, CURLINFO_REDIRECT_URL, &location); + + if((res == CURLE_OK) && location) { + /* This is the new absolute URL that you could redirect to, even if + * the Location: response header may have been a relative URL. */ + printf("Redirected to: %s\n", location); + } + } + } + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/getreferrer.c b/curl/docs/examples/getreferrer.c new file mode 100644 index 0000000..c46f782 --- /dev/null +++ b/curl/docs/examples/getreferrer.c @@ -0,0 +1,59 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Show how to extract referrer header. + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + + curl = curl_easy_init(); + if(curl) { + CURLcode res; + + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com"); + curl_easy_setopt(curl, CURLOPT_REFERER, "https://example.org/referrer"); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + else { + char *hdr; + res = curl_easy_getinfo(curl, CURLINFO_REFERER, &hdr); + if((res == CURLE_OK) && hdr) + printf("Referrer header: %s\n", hdr); + } + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/headerapi.c b/curl/docs/examples/headerapi.c new file mode 100644 index 0000000..95c3668 --- /dev/null +++ b/curl/docs/examples/headerapi.c @@ -0,0 +1,81 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Extract headers post transfer with the header API + * + */ +#include +#include + +static size_t write_cb(char *data, size_t n, size_t l, void *userp) +{ + /* take care of the data here, ignored in this example */ + (void)data; + (void)userp; + return n*l; +} + +int main(void) +{ + CURL *curl; + + curl = curl_easy_init(); + if(curl) { + CURLcode res; + struct curl_header *header; + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com"); + /* example.com is redirected, so we tell libcurl to follow redirection */ + curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); + + /* this example just ignores the content */ + curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + if(CURLHE_OK == curl_easy_header(curl, "Content-Type", 0, CURLH_HEADER, + -1, &header)) + printf("Got content-type: %s\n", header->value); + + printf("All server headers:\n"); + { + struct curl_header *h; + struct curl_header *prev = NULL; + do { + h = curl_easy_nextheader(curl, CURLH_HEADER, -1, prev); + if(h) + printf(" %s: %s (%u)\n", h->name, h->value, (int)h->amount); + prev = h; + } while(h); + + } + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/hsts-preload.c b/curl/docs/examples/hsts-preload.c new file mode 100644 index 0000000..a25773f --- /dev/null +++ b/curl/docs/examples/hsts-preload.c @@ -0,0 +1,118 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Preload domains to HSTS + * + */ +#include +#include +#include + +struct entry { + const char *name; + const char *exp; +}; + +static const struct entry preload_hosts[] = { + { "example.com", "20370320 01:02:03" }, + { "curl.se", "20370320 03:02:01" }, + { NULL, NULL } /* end of list marker */ +}; + +struct state { + int index; +}; + +/* "read" is from the point of the library, it wants data from us. One domain + entry per invoke. */ +static CURLSTScode hstsread(CURL *easy, struct curl_hstsentry *e, + void *userp) +{ + const char *host; + const char *expire; + struct state *s = (struct state *)userp; + (void)easy; + host = preload_hosts[s->index].name; + expire = preload_hosts[s->index++].exp; + + if(host && (strlen(host) < e->namelen)) { + strcpy(e->name, host); + e->includeSubDomains = 0; + strcpy(e->expire, expire); + fprintf(stderr, "HSTS preload '%s' until '%s'\n", host, expire); + } + else + return CURLSTS_DONE; + return CURLSTS_OK; +} + +static CURLSTScode hstswrite(CURL *easy, struct curl_hstsentry *e, + struct curl_index *i, void *userp) +{ + (void)easy; + (void)userp; /* we have no custom input */ + printf("[%u/%u] %s %s\n", (unsigned int)i->index, (unsigned int)i->total, + e->name, e->expire); + return CURLSTS_OK; +} + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl = curl_easy_init(); + if(curl) { + struct state st = {0}; + + /* enable HSTS for this handle */ + curl_easy_setopt(curl, CURLOPT_HSTS_CTRL, (long)CURLHSTS_ENABLE); + + /* function to call at first to populate the cache before the transfer */ + curl_easy_setopt(curl, CURLOPT_HSTSREADFUNCTION, hstsread); + curl_easy_setopt(curl, CURLOPT_HSTSREADDATA, &st); + + /* function to call after transfer to store the new state of the HSTS + cache */ + curl_easy_setopt(curl, CURLOPT_HSTSWRITEFUNCTION, hstswrite); + curl_easy_setopt(curl, CURLOPT_HSTSWRITEDATA, NULL); + + /* use the domain with HTTP but due to the preload, it should do the + transfer using HTTPS */ + curl_easy_setopt(curl, CURLOPT_URL, "http://curl.se"); + + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/http-options.c b/curl/docs/examples/http-options.c new file mode 100644 index 0000000..586b55f --- /dev/null +++ b/curl/docs/examples/http-options.c @@ -0,0 +1,59 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Issue an HTTP 'OPTIONS *' request + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com"); + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "OPTIONS"); + + /* issue an OPTIONS * request (no leading slash) */ + curl_easy_setopt(curl, CURLOPT_REQUEST_TARGET, "*"); + + /* if this operation fails, allow risking a memory leak and do quick exit + from libcurl as this exits anyway */ + curl_easy_setopt(curl, CURLOPT_QUICK_EXIT, 1L); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/http-post.c b/curl/docs/examples/http-post.c new file mode 100644 index 0000000..901ee1e --- /dev/null +++ b/curl/docs/examples/http-post.c @@ -0,0 +1,61 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * simple HTTP POST using the easy interface + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res; + + /* In Windows, this inits the Winsock stuff */ + curl_global_init(CURL_GLOBAL_ALL); + + /* get a curl handle */ + curl = curl_easy_init(); + if(curl) { + /* First set the URL that is about to receive our POST. This URL can + just as well be an https:// URL if that is what should receive the + data. */ + curl_easy_setopt(curl, CURLOPT_URL, "http://postit.example.com/moo.cgi"); + /* Now specify the POST data */ + curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "name=daniel&project=curl"); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + curl_global_cleanup(); + return 0; +} diff --git a/curl/docs/examples/http2-download.c b/curl/docs/examples/http2-download.c new file mode 100644 index 0000000..4a249fa --- /dev/null +++ b/curl/docs/examples/http2-download.c @@ -0,0 +1,236 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Multiplexed HTTP/2 downloads over a single connection + * + */ +#include +#include +#include +#ifdef UNDER_CE +#define strerror(e) "?" +#else +#include +#endif + +/* curl stuff */ +#include +#include + +#ifndef CURLPIPE_MULTIPLEX +/* This little trick makes sure that we do not enable pipelining for libcurls + old enough to not have this symbol. It is _not_ defined to zero in a recent + libcurl header. */ +#define CURLPIPE_MULTIPLEX 0 +#endif + +struct transfer { + CURL *easy; + unsigned int num; + FILE *out; +}; + +#define NUM_HANDLES 1000 + +static +void dump(const char *text, unsigned int num, unsigned char *ptr, size_t size, + char nohex) +{ + size_t i; + size_t c; + + unsigned int width = 0x10; + + if(nohex) + /* without the hex output, we can fit more on screen */ + width = 0x40; + + fprintf(stderr, "%u %s, %lu bytes (0x%lx)\n", + num, text, (unsigned long)size, (unsigned long)size); + + for(i = 0; i < size; i += width) { + + fprintf(stderr, "%4.4lx: ", (unsigned long)i); + + if(!nohex) { + /* hex not disabled, show it */ + for(c = 0; c < width; c++) + if(i + c < size) + fprintf(stderr, "%02x ", ptr[i + c]); + else + fputs(" ", stderr); + } + + for(c = 0; (c < width) && (i + c < size); c++) { + /* check for 0D0A; if found, skip past and start a new line of output */ + if(nohex && (i + c + 1 < size) && ptr[i + c] == 0x0D && + ptr[i + c + 1] == 0x0A) { + i += (c + 2 - width); + break; + } + fprintf(stderr, "%c", + (ptr[i + c] >= 0x20) && (ptr[i + c] < 0x80) ? ptr[i + c] : '.'); + /* check again for 0D0A, to avoid an extra \n if it's at width */ + if(nohex && (i + c + 2 < size) && ptr[i + c + 1] == 0x0D && + ptr[i + c + 2] == 0x0A) { + i += (c + 3 - width); + break; + } + } + fputc('\n', stderr); /* newline */ + } +} + +static +int my_trace(CURL *handle, curl_infotype type, + char *data, size_t size, + void *userp) +{ + const char *text; + struct transfer *t = (struct transfer *)userp; + unsigned int num = t->num; + (void)handle; /* prevent compiler warning */ + + switch(type) { + case CURLINFO_TEXT: + fprintf(stderr, "== %u Info: %s", num, data); + return 0; + case CURLINFO_HEADER_OUT: + text = "=> Send header"; + break; + case CURLINFO_DATA_OUT: + text = "=> Send data"; + break; + case CURLINFO_SSL_DATA_OUT: + text = "=> Send SSL data"; + break; + case CURLINFO_HEADER_IN: + text = "<= Recv header"; + break; + case CURLINFO_DATA_IN: + text = "<= Recv data"; + break; + case CURLINFO_SSL_DATA_IN: + text = "<= Recv SSL data"; + break; + default: /* in case a new one is introduced to shock us */ + return 0; + } + + dump(text, num, (unsigned char *)data, size, 1); + return 0; +} + +static int setup(struct transfer *t, int num) +{ + char filename[128]; + CURL *hnd; + + hnd = t->easy = curl_easy_init(); + + curl_msnprintf(filename, 128, "dl-%d", num); + + t->out = fopen(filename, "wb"); + if(!t->out) { + fprintf(stderr, "error: could not open file %s for writing: %s\n", + filename, strerror(errno)); + return 1; + } + + /* write to this file */ + curl_easy_setopt(hnd, CURLOPT_WRITEDATA, t->out); + + /* set the same URL */ + curl_easy_setopt(hnd, CURLOPT_URL, "https://localhost:8443/index.html"); + + /* please be verbose */ + curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L); + curl_easy_setopt(hnd, CURLOPT_DEBUGFUNCTION, my_trace); + curl_easy_setopt(hnd, CURLOPT_DEBUGDATA, t); + + /* enlarge the receive buffer for potentially higher transfer speeds */ + curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 100000L); + + /* HTTP/2 please */ + curl_easy_setopt(hnd, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0); + +#if (CURLPIPE_MULTIPLEX > 0) + /* wait for pipe connection to confirm */ + curl_easy_setopt(hnd, CURLOPT_PIPEWAIT, 1L); +#endif + return 0; +} + +/* + * Download many transfers over HTTP/2, using the same connection! + */ +int main(int argc, char **argv) +{ + struct transfer trans[NUM_HANDLES]; + CURLM *multi_handle; + int i; + int still_running = 0; /* keep number of running handles */ + int num_transfers; + if(argc > 1) { + /* if given a number, do that many transfers */ + num_transfers = atoi(argv[1]); + if((num_transfers < 1) || (num_transfers > NUM_HANDLES)) + num_transfers = 3; /* a suitable low default */ + } + else + num_transfers = 3; /* suitable default */ + + /* init a multi stack */ + multi_handle = curl_multi_init(); + + for(i = 0; i < num_transfers; i++) { + if(setup(&trans[i], i)) + return 1; + + /* add the individual transfer */ + curl_multi_add_handle(multi_handle, trans[i].easy); + } + + curl_multi_setopt(multi_handle, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX); + + do { + CURLMcode mc = curl_multi_perform(multi_handle, &still_running); + + if(still_running) + /* wait for activity, timeout or "nothing" */ + mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL); + + if(mc) + break; + } while(still_running); + + for(i = 0; i < num_transfers; i++) { + curl_multi_remove_handle(multi_handle, trans[i].easy); + curl_easy_cleanup(trans[i].easy); + } + + curl_multi_cleanup(multi_handle); + + return 0; +} diff --git a/curl/docs/examples/http2-pushinmemory.c b/curl/docs/examples/http2-pushinmemory.c new file mode 100644 index 0000000..53c368e --- /dev/null +++ b/curl/docs/examples/http2-pushinmemory.c @@ -0,0 +1,186 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * HTTP/2 server push. Receive all data in memory. + * + */ +#include +#include +#include + +/* curl stuff */ +#include + +struct Memory { + char *memory; + size_t size; +}; + +static size_t +write_cb(void *contents, size_t size, size_t nmemb, void *userp) +{ + size_t realsize = size * nmemb; + struct Memory *mem = (struct Memory *)userp; + char *ptr = realloc(mem->memory, mem->size + realsize + 1); + if(!ptr) { + /* out of memory! */ + printf("not enough memory (realloc returned NULL)\n"); + return 0; + } + + mem->memory = ptr; + memcpy(&(mem->memory[mem->size]), contents, realsize); + mem->size += realsize; + mem->memory[mem->size] = 0; + + return realsize; +} + +#define MAX_FILES 10 +static struct Memory files[MAX_FILES]; +static int pushindex = 1; + +static void init_memory(struct Memory *chunk) +{ + chunk->memory = malloc(1); /* grown as needed with realloc */ + chunk->size = 0; /* no data at this point */ +} + +static void setup(CURL *hnd) +{ + /* set the same URL */ + curl_easy_setopt(hnd, CURLOPT_URL, "https://localhost:8443/index.html"); + + /* HTTP/2 please */ + curl_easy_setopt(hnd, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0); + + /* we use a self-signed test server, skip verification during debugging */ + curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYPEER, 0L); + curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYHOST, 0L); + + /* write data to a struct */ + curl_easy_setopt(hnd, CURLOPT_WRITEFUNCTION, write_cb); + init_memory(&files[0]); + curl_easy_setopt(hnd, CURLOPT_WRITEDATA, &files[0]); + + /* wait for pipe connection to confirm */ + curl_easy_setopt(hnd, CURLOPT_PIPEWAIT, 1L); +} + +/* called when there is an incoming push */ +static int server_push_callback(CURL *parent, + CURL *easy, + size_t num_headers, + struct curl_pushheaders *headers, + void *userp) +{ + char *headp; + int *transfers = (int *)userp; + (void)parent; /* we have no use for this */ + (void)num_headers; /* unused */ + + if(pushindex == MAX_FILES) + /* cannot fit anymore */ + return CURL_PUSH_DENY; + + /* write to this buffer */ + init_memory(&files[pushindex]); + curl_easy_setopt(easy, CURLOPT_WRITEDATA, &files[pushindex]); + pushindex++; + + headp = curl_pushheader_byname(headers, ":path"); + if(headp) + fprintf(stderr, "* Pushed :path '%s'\n", headp /* skip :path + colon */); + + (*transfers)++; /* one more */ + return CURL_PUSH_OK; +} + + +/* + * Download a file over HTTP/2, take care of server push. + */ +int main(void) +{ + CURL *easy; + CURLM *multi; + int still_running; /* keep number of running handles */ + int transfers = 1; /* we start with one */ + int i; + struct CURLMsg *m; + + /* init a multi stack */ + multi = curl_multi_init(); + + easy = curl_easy_init(); + + /* set options */ + setup(easy); + + /* add the easy transfer */ + curl_multi_add_handle(multi, easy); + + curl_multi_setopt(multi, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX); + curl_multi_setopt(multi, CURLMOPT_PUSHFUNCTION, server_push_callback); + curl_multi_setopt(multi, CURLMOPT_PUSHDATA, &transfers); + + while(transfers) { + int rc; + CURLMcode mcode = curl_multi_perform(multi, &still_running); + if(mcode) + break; + + mcode = curl_multi_wait(multi, NULL, 0, 1000, &rc); + if(mcode) + break; + + + /* + * When doing server push, libcurl itself created and added one or more + * easy handles but *we* need to clean them up when they are done. + */ + do { + int msgq = 0; + m = curl_multi_info_read(multi, &msgq); + if(m && (m->msg == CURLMSG_DONE)) { + CURL *e = m->easy_handle; + transfers--; + curl_multi_remove_handle(multi, e); + curl_easy_cleanup(e); + } + } while(m); + + } + + + curl_multi_cleanup(multi); + + /* 'pushindex' is now the number of received transfers */ + for(i = 0; i < pushindex; i++) { + /* do something fun with the data, and then free it when done */ + free(files[i].memory); + } + + return 0; +} diff --git a/curl/docs/examples/http2-serverpush.c b/curl/docs/examples/http2-serverpush.c new file mode 100644 index 0000000..e259e14 --- /dev/null +++ b/curl/docs/examples/http2-serverpush.c @@ -0,0 +1,273 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * HTTP/2 server push + * + */ +#include +#include +#include + +/* curl stuff */ +#include +#include + +#ifndef CURLPIPE_MULTIPLEX +#error "too old libcurl, cannot do HTTP/2 server push!" +#endif + +static +void dump(const char *text, unsigned char *ptr, size_t size, + char nohex) +{ + size_t i; + size_t c; + + unsigned int width = 0x10; + + if(nohex) + /* without the hex output, we can fit more on screen */ + width = 0x40; + + fprintf(stderr, "%s, %lu bytes (0x%lx)\n", + text, (unsigned long)size, (unsigned long)size); + + for(i = 0; i < size; i += width) { + + fprintf(stderr, "%4.4lx: ", (unsigned long)i); + + if(!nohex) { + /* hex not disabled, show it */ + for(c = 0; c < width; c++) + if(i + c < size) + fprintf(stderr, "%02x ", ptr[i + c]); + else + fputs(" ", stderr); + } + + for(c = 0; (c < width) && (i + c < size); c++) { + /* check for 0D0A; if found, skip past and start a new line of output */ + if(nohex && (i + c + 1 < size) && ptr[i + c] == 0x0D && + ptr[i + c + 1] == 0x0A) { + i += (c + 2 - width); + break; + } + fprintf(stderr, "%c", + (ptr[i + c] >= 0x20) && (ptr[i + c] < 0x80) ? ptr[i + c] : '.'); + /* check again for 0D0A, to avoid an extra \n if it's at width */ + if(nohex && (i + c + 2 < size) && ptr[i + c + 1] == 0x0D && + ptr[i + c + 2] == 0x0A) { + i += (c + 3 - width); + break; + } + } + fputc('\n', stderr); /* newline */ + } +} + +static +int my_trace(CURL *handle, curl_infotype type, + char *data, size_t size, + void *userp) +{ + const char *text; + (void)handle; /* prevent compiler warning */ + (void)userp; + switch(type) { + case CURLINFO_TEXT: + fprintf(stderr, "== Info: %s", data); + return 0; + case CURLINFO_HEADER_OUT: + text = "=> Send header"; + break; + case CURLINFO_DATA_OUT: + text = "=> Send data"; + break; + case CURLINFO_SSL_DATA_OUT: + text = "=> Send SSL data"; + break; + case CURLINFO_HEADER_IN: + text = "<= Recv header"; + break; + case CURLINFO_DATA_IN: + text = "<= Recv data"; + break; + case CURLINFO_SSL_DATA_IN: + text = "<= Recv SSL data"; + break; + default: /* in case a new one is introduced to shock us */ + return 0; + } + + dump(text, (unsigned char *)data, size, 1); + return 0; +} + +#define OUTPUTFILE "dl" + +static int setup(CURL *hnd, const char *url) +{ + FILE *out = fopen(OUTPUTFILE, "wb"); + if(!out) + /* failed */ + return 1; + + /* write to this file */ + curl_easy_setopt(hnd, CURLOPT_WRITEDATA, out); + + /* set the same URL */ + curl_easy_setopt(hnd, CURLOPT_URL, url); + + /* please be verbose */ + curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L); + curl_easy_setopt(hnd, CURLOPT_DEBUGFUNCTION, my_trace); + + /* HTTP/2 please */ + curl_easy_setopt(hnd, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0); + + /* we use a self-signed test server, skip verification during debugging */ + curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYPEER, 0L); + curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYHOST, 0L); + +#if (CURLPIPE_MULTIPLEX > 0) + /* wait for pipe connection to confirm */ + curl_easy_setopt(hnd, CURLOPT_PIPEWAIT, 1L); +#endif + return 0; /* all is good */ +} + +/* called when there is an incoming push */ +static int server_push_callback(CURL *parent, + CURL *easy, + size_t num_headers, + struct curl_pushheaders *headers, + void *userp) +{ + char *headp; + size_t i; + int *transfers = (int *)userp; + char filename[128]; + FILE *out; + static unsigned int count = 0; + + (void)parent; /* we have no use for this */ + + curl_msnprintf(filename, 128, "push%u", count++); + + /* here's a new stream, save it in a new file for each new push */ + out = fopen(filename, "wb"); + if(!out) { + /* if we cannot save it, deny it */ + fprintf(stderr, "Failed to create output file for push\n"); + return CURL_PUSH_DENY; + } + + /* write to this file */ + curl_easy_setopt(easy, CURLOPT_WRITEDATA, out); + + fprintf(stderr, "**** push callback approves stream %u, got %lu headers!\n", + count, (unsigned long)num_headers); + + for(i = 0; i < num_headers; i++) { + headp = curl_pushheader_bynum(headers, i); + fprintf(stderr, "**** header %lu: %s\n", (unsigned long)i, headp); + } + + headp = curl_pushheader_byname(headers, ":path"); + if(headp) { + fprintf(stderr, "**** The PATH is %s\n", headp /* skip :path + colon */); + } + + (*transfers)++; /* one more */ + return CURL_PUSH_OK; +} + + +/* + * Download a file over HTTP/2, take care of server push. + */ +int main(int argc, char *argv[]) +{ + CURL *easy; + CURLM *multi_handle; + int transfers = 1; /* we start with one */ + struct CURLMsg *m; + const char *url = "https://localhost:8443/index.html"; + + if(argc == 2) + url = argv[1]; + + /* init a multi stack */ + multi_handle = curl_multi_init(); + + easy = curl_easy_init(); + + /* set options */ + if(setup(easy, url)) { + fprintf(stderr, "failed\n"); + return 1; + } + + /* add the easy transfer */ + curl_multi_add_handle(multi_handle, easy); + + curl_multi_setopt(multi_handle, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX); + curl_multi_setopt(multi_handle, CURLMOPT_PUSHFUNCTION, server_push_callback); + curl_multi_setopt(multi_handle, CURLMOPT_PUSHDATA, &transfers); + + do { + int still_running; /* keep number of running handles */ + CURLMcode mc = curl_multi_perform(multi_handle, &still_running); + + if(still_running) + /* wait for activity, timeout or "nothing" */ + mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL); + + if(mc) + break; + + /* + * A little caution when doing server push is that libcurl itself has + * created and added one or more easy handles but we need to clean them up + * when we are done. + */ + + do { + int msgq = 0; + m = curl_multi_info_read(multi_handle, &msgq); + if(m && (m->msg == CURLMSG_DONE)) { + CURL *e = m->easy_handle; + transfers--; + curl_multi_remove_handle(multi_handle, e); + curl_easy_cleanup(e); + } + } while(m); + + } while(transfers); /* as long as we have transfers going */ + + curl_multi_cleanup(multi_handle); + + + return 0; +} diff --git a/curl/docs/examples/http2-upload.c b/curl/docs/examples/http2-upload.c new file mode 100644 index 0000000..580944f --- /dev/null +++ b/curl/docs/examples/http2-upload.c @@ -0,0 +1,342 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Multiplexed HTTP/2 uploads over a single connection + * + */ +#include +#include +#include +#include +#include +#ifdef UNDER_CE +#define strerror(e) "?" +#else +#include +#endif + +/* somewhat Unix-specific */ +#ifndef _MSC_VER +#include +#include +#endif + +#ifdef _WIN32 +#undef stat +#define stat _stat +#endif + +/* curl stuff */ +#include +#include + +#ifndef CURLPIPE_MULTIPLEX +/* This little trick makes sure that we do not enable pipelining for libcurls + old enough to not have this symbol. It is _not_ defined to zero in a recent + libcurl header. */ +#define CURLPIPE_MULTIPLEX 0 +#endif + +#define NUM_HANDLES 1000 + +#ifdef _MSC_VER +#define gettimeofday(a, b) my_gettimeofday((a), (b)) +static +int my_gettimeofday(struct timeval *tp, void *tzp) +{ + (void)tzp; + if(tp) { + /* Offset between 1601-01-01 and 1970-01-01 in 100 nanosec units */ + #define _WIN32_FT_OFFSET (116444736000000000) + union { + CURL_TYPEOF_CURL_OFF_T ns100; /* time since 1 Jan 1601 in 100ns units */ + FILETIME ft; + } _now; + GetSystemTimeAsFileTime(&_now.ft); + tp->tv_usec = (long)((_now.ns100 / 10) % 1000000); + tp->tv_sec = (long)((_now.ns100 - _WIN32_FT_OFFSET) / 10000000); + } + return 0; +} +#endif + +struct input { + FILE *in; + size_t bytes_read; /* count up */ + CURL *hnd; + int num; +}; + +static +void dump(const char *text, int num, unsigned char *ptr, size_t size, + char nohex) +{ + size_t i; + size_t c; + unsigned int width = 0x10; + + if(nohex) + /* without the hex output, we can fit more on screen */ + width = 0x40; + + fprintf(stderr, "%d %s, %lu bytes (0x%lx)\n", + num, text, (unsigned long)size, (unsigned long)size); + + for(i = 0; i < size; i += width) { + + fprintf(stderr, "%4.4lx: ", (unsigned long)i); + + if(!nohex) { + /* hex not disabled, show it */ + for(c = 0; c < width; c++) + if(i + c < size) + fprintf(stderr, "%02x ", ptr[i + c]); + else + fputs(" ", stderr); + } + + for(c = 0; (c < width) && (i + c < size); c++) { + /* check for 0D0A; if found, skip past and start a new line of output */ + if(nohex && (i + c + 1 < size) && ptr[i + c] == 0x0D && + ptr[i + c + 1] == 0x0A) { + i += (c + 2 - width); + break; + } + fprintf(stderr, "%c", + (ptr[i + c] >= 0x20) && (ptr[i + c] < 0x80) ? ptr[i + c] : '.'); + /* check again for 0D0A, to avoid an extra \n if it's at width */ + if(nohex && (i + c + 2 < size) && ptr[i + c + 1] == 0x0D && + ptr[i + c + 2] == 0x0A) { + i += (c + 3 - width); + break; + } + } + fputc('\n', stderr); /* newline */ + } +} + +static +int my_trace(CURL *handle, curl_infotype type, + char *data, size_t size, + void *userp) +{ + char timebuf[60]; + const char *text; + struct input *i = (struct input *)userp; + int num = i->num; + static time_t epoch_offset; + static int known_offset; + struct timeval tv; + time_t secs; + struct tm *now; + (void)handle; /* prevent compiler warning */ + + gettimeofday(&tv, NULL); + if(!known_offset) { + epoch_offset = time(NULL) - tv.tv_sec; + known_offset = 1; + } + secs = epoch_offset + tv.tv_sec; + now = localtime(&secs); /* not thread safe but we do not care */ + curl_msnprintf(timebuf, sizeof(timebuf), "%02d:%02d:%02d.%06ld", + now->tm_hour, now->tm_min, now->tm_sec, (long)tv.tv_usec); + + switch(type) { + case CURLINFO_TEXT: + fprintf(stderr, "%s [%d] Info: %s", timebuf, num, data); + return 0; + case CURLINFO_HEADER_OUT: + text = "=> Send header"; + break; + case CURLINFO_DATA_OUT: + text = "=> Send data"; + break; + case CURLINFO_SSL_DATA_OUT: + text = "=> Send SSL data"; + break; + case CURLINFO_HEADER_IN: + text = "<= Recv header"; + break; + case CURLINFO_DATA_IN: + text = "<= Recv data"; + break; + case CURLINFO_SSL_DATA_IN: + text = "<= Recv SSL data"; + break; + default: /* in case a new one is introduced to shock us */ + return 0; + } + + dump(text, num, (unsigned char *)data, size, 1); + return 0; +} + +static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *userp) +{ + struct input *i = userp; + size_t retcode = fread(ptr, size, nmemb, i->in); + i->bytes_read += retcode; + return retcode; +} + +static int setup(struct input *i, int num, const char *upload) +{ + FILE *out; + char url[256]; + char filename[128]; + struct stat file_info; + curl_off_t uploadsize; + CURL *hnd; + + hnd = i->hnd = NULL; + + i->num = num; + curl_msnprintf(filename, 128, "dl-%d", num); + out = fopen(filename, "wb"); + if(!out) { + fprintf(stderr, "error: could not open file %s for writing: %s\n", upload, + strerror(errno)); + return 1; + } + + curl_msnprintf(url, 256, "https://localhost:8443/upload-%d", num); + + /* get the file size of the local file */ + if(stat(upload, &file_info)) { + fprintf(stderr, "error: could not stat file %s: %s\n", upload, + strerror(errno)); + fclose(out); + return 1; + } + + uploadsize = file_info.st_size; + + i->in = fopen(upload, "rb"); + if(!i->in) { + fprintf(stderr, "error: could not open file %s for reading: %s\n", upload, + strerror(errno)); + fclose(out); + return 1; + } + + hnd = i->hnd = curl_easy_init(); + + /* write to this file */ + curl_easy_setopt(hnd, CURLOPT_WRITEDATA, out); + + /* we want to use our own read function */ + curl_easy_setopt(hnd, CURLOPT_READFUNCTION, read_callback); + /* read from this file */ + curl_easy_setopt(hnd, CURLOPT_READDATA, i); + /* provide the size of the upload */ + curl_easy_setopt(hnd, CURLOPT_INFILESIZE_LARGE, uploadsize); + + /* send in the URL to store the upload as */ + curl_easy_setopt(hnd, CURLOPT_URL, url); + + /* upload please */ + curl_easy_setopt(hnd, CURLOPT_UPLOAD, 1L); + + /* please be verbose */ + curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L); + curl_easy_setopt(hnd, CURLOPT_DEBUGFUNCTION, my_trace); + curl_easy_setopt(hnd, CURLOPT_DEBUGDATA, i); + + /* HTTP/2 please */ + curl_easy_setopt(hnd, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0); + + /* we use a self-signed test server, skip verification during debugging */ + curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYPEER, 0L); + curl_easy_setopt(hnd, CURLOPT_SSL_VERIFYHOST, 0L); + +#if (CURLPIPE_MULTIPLEX > 0) + /* wait for pipe connection to confirm */ + curl_easy_setopt(hnd, CURLOPT_PIPEWAIT, 1L); +#endif + return 0; +} + +/* + * Upload all files over HTTP/2, using the same physical connection! + */ +int main(int argc, char **argv) +{ + struct input trans[NUM_HANDLES]; + CURLM *multi_handle; + int i; + int still_running = 0; /* keep number of running handles */ + const char *filename = "index.html"; + int num_transfers; + + if(argc > 1) { + /* if given a number, do that many transfers */ + num_transfers = atoi(argv[1]); + + if(!num_transfers || (num_transfers > NUM_HANDLES)) + num_transfers = 3; /* a suitable low default */ + + if(argc > 2) + /* if given a file name, upload this! */ + filename = argv[2]; + } + else + num_transfers = 3; + + /* init a multi stack */ + multi_handle = curl_multi_init(); + + for(i = 0; i < num_transfers; i++) { + if(setup(&trans[i], i, filename)) + return 1; + + /* add the individual transfer */ + curl_multi_add_handle(multi_handle, trans[i].hnd); + } + + curl_multi_setopt(multi_handle, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX); + + /* We do HTTP/2 so let's stick to one connection per host */ + curl_multi_setopt(multi_handle, CURLMOPT_MAX_HOST_CONNECTIONS, 1L); + + do { + CURLMcode mc = curl_multi_perform(multi_handle, &still_running); + + if(still_running) + /* wait for activity, timeout or "nothing" */ + mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL); + + if(mc) + break; + + } while(still_running); + + curl_multi_cleanup(multi_handle); + + for(i = 0; i < num_transfers; i++) { + curl_multi_remove_handle(multi_handle, trans[i].hnd); + curl_easy_cleanup(trans[i].hnd); + } + + return 0; +} diff --git a/curl/docs/examples/http3-present.c b/curl/docs/examples/http3-present.c new file mode 100644 index 0000000..56ba0f5 --- /dev/null +++ b/curl/docs/examples/http3-present.c @@ -0,0 +1,49 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Checks if HTTP/3 support is present in libcurl. + * + */ +#include +#include + +int main(void) +{ + curl_version_info_data *ver; + + curl_global_init(CURL_GLOBAL_ALL); + + ver = curl_version_info(CURLVERSION_NOW); + if(ver->features & CURL_VERSION_HTTP2) + printf("HTTP/2 support is present\n"); + + if(ver->features & CURL_VERSION_HTTP3) + printf("HTTP/3 support is present\n"); + + if(ver->features & CURL_VERSION_ALTSVC) + printf("Alt-svc support is present\n"); + + curl_global_cleanup(); + return 0; +} diff --git a/curl/docs/examples/http3.c b/curl/docs/examples/http3.c new file mode 100644 index 0000000..e278f2e --- /dev/null +++ b/curl/docs/examples/http3.c @@ -0,0 +1,55 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Very simple HTTP/3 GET + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com"); + + /* Use HTTP/3 but fallback to earlier HTTP if necessary */ + curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, + (long)CURL_HTTP_VERSION_3); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/httpcustomheader.c b/curl/docs/examples/httpcustomheader.c new file mode 100644 index 0000000..a388167 --- /dev/null +++ b/curl/docs/examples/httpcustomheader.c @@ -0,0 +1,72 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * HTTP request with custom modified, removed and added headers + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl = curl_easy_init(); + if(curl) { + struct curl_slist *chunk = NULL; + + /* Remove a header curl would otherwise add by itself */ + chunk = curl_slist_append(chunk, "Accept:"); + + /* Add a custom header */ + chunk = curl_slist_append(chunk, "Another: yes"); + + /* Modify a header curl otherwise adds differently */ + chunk = curl_slist_append(chunk, "Host: example.com"); + + /* Add a header with "blank" contents to the right of the colon. Note that + we are then using a semicolon in the string we pass to curl! */ + chunk = curl_slist_append(chunk, "X-silly-header;"); + + /* set our custom set of headers */ + curl_easy_setopt(curl, CURLOPT_HTTPHEADER, chunk); + + curl_easy_setopt(curl, CURLOPT_URL, "localhost"); + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + + /* free the custom headers */ + curl_slist_free_all(chunk); + } + return 0; +} diff --git a/curl/docs/examples/httpput-postfields.c b/curl/docs/examples/httpput-postfields.c new file mode 100644 index 0000000..fdd6ffe --- /dev/null +++ b/curl/docs/examples/httpput-postfields.c @@ -0,0 +1,104 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * HTTP PUT using CURLOPT_POSTFIELDS + * + */ +#include +#include +#include + +static const char olivertwist[]= + "Among other public buildings in a certain town, which for many reasons " + "it will be prudent to refrain from mentioning, and to which I will assign " + "no fictitious name, there is one anciently common to most towns, great or " + "small: to wit, a workhouse; and in this workhouse was born; on a day and " + "date which I need not trouble myself to repeat, inasmuch as it can be of " + "no possible consequence to the reader, in this stage of the business at " + "all events; the item of mortality whose name is prefixed"; + +/* ... to the head of this chapter. String cut off to stick within the C90 + 509 byte limit. */ + +/* + * This example shows an HTTP PUT operation that sends a fixed buffer with + * CURLOPT_POSTFIELDS to the URL given as an argument. + */ + +int main(int argc, char **argv) +{ + CURL *curl; + CURLcode res; + char *url; + + if(argc < 2) + return 1; + + url = argv[1]; + + /* In Windows, this inits the Winsock stuff */ + curl_global_init(CURL_GLOBAL_ALL); + + /* get a curl handle */ + curl = curl_easy_init(); + if(curl) { + struct curl_slist *headers = NULL; + + /* default type with postfields is application/x-www-form-urlencoded, + change it if you want */ + headers = curl_slist_append(headers, "Content-Type: literature/classic"); + curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); + + /* pass on content in request body. When CURLOPT_POSTFIELDSIZE is not used, + curl does strlen to get the size. */ + curl_easy_setopt(curl, CURLOPT_POSTFIELDS, olivertwist); + + /* override the POST implied by CURLOPT_POSTFIELDS + * + * Warning: CURLOPT_CUSTOMREQUEST is problematic, especially if you want + * to follow redirects. Be aware. + */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "PUT"); + + /* specify target URL, and note that this URL should include a file + name, not only a directory */ + curl_easy_setopt(curl, CURLOPT_URL, url); + + /* Now run off and do what you have been told! */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + + /* free headers */ + curl_slist_free_all(headers); + } + + curl_global_cleanup(); + return 0; +} diff --git a/curl/docs/examples/httpput.c b/curl/docs/examples/httpput.c new file mode 100644 index 0000000..3743e1b --- /dev/null +++ b/curl/docs/examples/httpput.c @@ -0,0 +1,130 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * HTTP PUT with easy interface and read callback + * + */ +#include +#include +#include +#include + +#ifdef _WIN32 +#undef stat +#define stat _stat +#endif + +/* + * This example shows an HTTP PUT operation. PUTs a file given as a command + * line argument to the URL also given on the command line. + * + * This example also uses its own read callback. + * + * Here's an article on how to setup a PUT handler for Apache: + * http://www.apacheweek.com/features/put + */ + +static size_t read_callback(char *ptr, size_t size, size_t nmemb, void *stream) +{ + size_t retcode; + unsigned long nread; + + /* in real-world cases, this would probably get this data differently + as this fread() stuff is exactly what the library already would do + by default internally */ + retcode = fread(ptr, size, nmemb, stream); + + if(retcode > 0) { + nread = (unsigned long)retcode; + fprintf(stderr, "*** We read %lu bytes from file\n", nread); + } + + return retcode; +} + +int main(int argc, char **argv) +{ + CURL *curl; + CURLcode res; + FILE * hd_src; + struct stat file_info; + + char *file; + char *url; + + if(argc < 3) + return 1; + + file = argv[1]; + url = argv[2]; + + /* get the file size of the local file */ + stat(file, &file_info); + + /* get a FILE * of the same file, could also be made with + fdopen() from the previous descriptor, but hey this is just + an example! */ + hd_src = fopen(file, "rb"); + if(!hd_src) + return 2; + + /* In Windows, this inits the Winsock stuff */ + curl_global_init(CURL_GLOBAL_ALL); + + /* get a curl handle */ + curl = curl_easy_init(); + if(curl) { + /* we want to use our own read function */ + curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback); + + /* enable uploading (implies PUT over HTTP) */ + curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L); + + /* specify target URL, and note that this URL should include a file + name, not only a directory */ + curl_easy_setopt(curl, CURLOPT_URL, url); + + /* now specify which file to upload */ + curl_easy_setopt(curl, CURLOPT_READDATA, hd_src); + + /* provide the size of the upload, we typecast the value to curl_off_t + since we must be sure to use the correct data size */ + curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, + (curl_off_t)file_info.st_size); + + /* Now run off and do what you have been told! */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + fclose(hd_src); /* close the local file */ + + curl_global_cleanup(); + return 0; +} diff --git a/curl/docs/examples/https.c b/curl/docs/examples/https.c new file mode 100644 index 0000000..c1cba87 --- /dev/null +++ b/curl/docs/examples/https.c @@ -0,0 +1,83 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Simple HTTPS GET + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl_global_init(CURL_GLOBAL_DEFAULT); + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/"); + +#ifdef SKIP_PEER_VERIFICATION + /* + * If you want to connect to a site who is not using a certificate that is + * signed by one of the certs in the CA bundle you have, you can skip the + * verification of the server's certificate. This makes the connection + * A LOT LESS SECURE. + * + * If you have a CA cert for the server stored someplace else than in the + * default bundle, then the CURLOPT_CAPATH option might come handy for + * you. + */ + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); +#endif + +#ifdef SKIP_HOSTNAME_VERIFICATION + /* + * If the site you are connecting to uses a different host name that what + * they have mentioned in their server certificate's commonName (or + * subjectAltName) fields, libcurl refuses to connect. You can skip this + * check, but it makes the connection insecure. + */ + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); +#endif + + /* cache the CA cert bundle in memory for a week */ + curl_easy_setopt(curl, CURLOPT_CA_CACHE_TIMEOUT, 604800L); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/imap-append.c b/curl/docs/examples/imap-append.c new file mode 100644 index 0000000..1839dea --- /dev/null +++ b/curl/docs/examples/imap-append.c @@ -0,0 +1,130 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Send email with IMAP + * + */ + +#include +#include +#include + +/* This is a simple example showing how to send mail using libcurl's IMAP + * capabilities. + * + * Note that this example requires libcurl 7.30.0 or above. + */ + +#define FROM "" +#define TO "" +#define CC "" + +static const char *payload_text = + "Date: Mon, 29 Nov 2010 21:54:29 +1100\r\n" + "To: " TO "\r\n" + "From: " FROM "(Example User)\r\n" + "Cc: " CC "(Another example User)\r\n" + "Message-ID: " + "\r\n" + "Subject: IMAP example message\r\n" + "\r\n" /* empty line to divide headers from body, see RFC 5322 */ + "The body of the message starts here.\r\n" + "\r\n" + "It could be a lot of lines, could be MIME encoded, whatever.\r\n" + "Check RFC 5322.\r\n"; + +struct upload_status { + size_t bytes_read; +}; + +static size_t payload_source(char *ptr, size_t size, size_t nmemb, void *userp) +{ + struct upload_status *upload_ctx = (struct upload_status *)userp; + const char *data; + size_t room = size * nmemb; + + if((size == 0) || (nmemb == 0) || ((size*nmemb) < 1)) { + return 0; + } + + data = &payload_text[upload_ctx->bytes_read]; + + if(*data) { + size_t len = strlen(data); + if(room < len) + len = room; + memcpy(ptr, data, len); + upload_ctx->bytes_read += len; + + return len; + } + + return 0; +} + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + size_t filesize; + long infilesize = LONG_MAX; + struct upload_status upload_ctx = { 0 }; + + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This creates a new message in folder "Sent". */ + curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com/Sent"); + + /* In this case, we are using a callback function to specify the data. You + * could just use the CURLOPT_READDATA option to specify a FILE pointer to + * read from. */ + curl_easy_setopt(curl, CURLOPT_READFUNCTION, payload_source); + curl_easy_setopt(curl, CURLOPT_READDATA, &upload_ctx); + curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L); + + filesize = strlen(payload_text); + if(filesize <= LONG_MAX) + infilesize = (long)filesize; + curl_easy_setopt(curl, CURLOPT_INFILESIZE, infilesize); + + /* Perform the append */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/imap-authzid.c b/curl/docs/examples/imap-authzid.c new file mode 100644 index 0000000..eb615c6 --- /dev/null +++ b/curl/docs/examples/imap-authzid.c @@ -0,0 +1,73 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Retrieve emails from a shared IMAP mailbox + * + */ + +#include +#include + +/* This is a simple example showing how to fetch mail using libcurl's IMAP + * capabilities. + * + * Note that this example requires libcurl 7.66.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set the username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* Set the authorization identity (identity to act as) */ + curl_easy_setopt(curl, CURLOPT_SASL_AUTHZID, "shared-mailbox"); + + /* Force PLAIN authentication */ + curl_easy_setopt(curl, CURLOPT_LOGIN_OPTIONS, "AUTH=PLAIN"); + + /* This fetches message 1 from the user's inbox */ + curl_easy_setopt(curl, CURLOPT_URL, + "imap://imap.example.com/INBOX/;UID=1"); + + /* Perform the fetch */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/imap-copy.c b/curl/docs/examples/imap-copy.c new file mode 100644 index 0000000..a221be0 --- /dev/null +++ b/curl/docs/examples/imap-copy.c @@ -0,0 +1,73 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Copy an email from one IMAP folder to another + * + */ + +#include +#include + +/* This is a simple example showing how to copy a mail from one mailbox folder + * to another using libcurl's IMAP capabilities. + * + * Note that this example requires libcurl 7.30.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This is source mailbox folder to select */ + curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com/INBOX"); + + /* Set the COPY command specifying the message ID and destination folder */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "COPY 1 FOLDER"); + + /* Note that to perform a move operation you need to perform the copy, + * then mark the original mail as Deleted and EXPUNGE or CLOSE. Please see + * imap-store.c for more information on deleting messages. */ + + /* Perform the custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/imap-create.c b/curl/docs/examples/imap-create.c new file mode 100644 index 0000000..6a9b565 --- /dev/null +++ b/curl/docs/examples/imap-create.c @@ -0,0 +1,69 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Create a new IMAP folder + * + */ + +#include +#include + +/* This is a simple example showing how to create a new mailbox folder using + * libcurl's IMAP capabilities. + * + * Note that this example requires libcurl 7.30.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This is just the server URL */ + curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com"); + + /* Set the CREATE command specifying the new folder name */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "CREATE FOLDER"); + + /* Perform the custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/imap-delete.c b/curl/docs/examples/imap-delete.c new file mode 100644 index 0000000..e43ab2e --- /dev/null +++ b/curl/docs/examples/imap-delete.c @@ -0,0 +1,69 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Delete an IMAP folder + * + */ + +#include +#include + +/* This is a simple example showing how to delete an existing mailbox folder + * using libcurl's IMAP capabilities. + * + * Note that this example requires libcurl 7.30.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This is just the server URL */ + curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com"); + + /* Set the DELETE command specifying the existing folder */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "DELETE FOLDER"); + + /* Perform the custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/imap-examine.c b/curl/docs/examples/imap-examine.c new file mode 100644 index 0000000..34217bf --- /dev/null +++ b/curl/docs/examples/imap-examine.c @@ -0,0 +1,69 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Obtain information about an IMAP folder + * + */ + +#include +#include + +/* This is a simple example showing how to obtain information about a mailbox + * folder using libcurl's IMAP capabilities via the EXAMINE command. + * + * Note that this example requires libcurl 7.30.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This is just the server URL */ + curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com"); + + /* Set the EXAMINE command specifying the mailbox folder */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "EXAMINE OUTBOX"); + + /* Perform the custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/imap-fetch.c b/curl/docs/examples/imap-fetch.c new file mode 100644 index 0000000..416fe88 --- /dev/null +++ b/curl/docs/examples/imap-fetch.c @@ -0,0 +1,67 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Retrieve IMAP emails + * + */ + +#include +#include + +/* This is a simple example showing how to fetch mail using libcurl's IMAP + * capabilities. + * + * Note that this example requires libcurl 7.30.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This fetches message 1 from the user's inbox */ + curl_easy_setopt(curl, CURLOPT_URL, + "imap://imap.example.com/INBOX/;UID=1"); + + /* Perform the fetch */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/imap-list.c b/curl/docs/examples/imap-list.c new file mode 100644 index 0000000..0253b54 --- /dev/null +++ b/curl/docs/examples/imap-list.c @@ -0,0 +1,68 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * List the folders within an IMAP mailbox + * + */ + +#include +#include + +/* This is a simple example showing how to list the folders within an IMAP + * mailbox. + * + * Note that this example requires libcurl 7.30.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This lists the folders within the user's mailbox. If you want to list + * the folders within a specific folder, for example the inbox, then + * specify the folder as a path in the URL such as /INBOX */ + curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com"); + + /* Perform the list */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/imap-lsub.c b/curl/docs/examples/imap-lsub.c new file mode 100644 index 0000000..cf45a5f --- /dev/null +++ b/curl/docs/examples/imap-lsub.c @@ -0,0 +1,70 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * List the subscribed IMAP folders + * + */ + +#include +#include + +/* This is a simple example showing how to list the subscribed folders within + * an IMAP mailbox. + * + * Note that this example requires libcurl 7.30.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This is just the server URL */ + curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com"); + + /* Set the LSUB command. Note the syntax is similar to that of a LIST + command. */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "LSUB \"\" *"); + + /* Perform the custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/imap-multi.c b/curl/docs/examples/imap-multi.c new file mode 100644 index 0000000..42fa738 --- /dev/null +++ b/curl/docs/examples/imap-multi.c @@ -0,0 +1,83 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Get IMAP email with the multi interface + * + */ + +#include +#include +#include + +/* This is a simple example showing how to fetch mail using libcurl's IMAP + * capabilities. It builds on the imap-fetch.c example to demonstrate how to + * use libcurl's multi interface. + */ + +int main(void) +{ + CURL *curl; + CURLM *mcurl; + int still_running = 1; + + curl_global_init(CURL_GLOBAL_DEFAULT); + + curl = curl_easy_init(); + if(!curl) + return 1; + + mcurl = curl_multi_init(); + if(!mcurl) + return 2; + + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This fetches message 1 from the user's inbox */ + curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com/INBOX/;UID=1"); + + /* Tell the multi stack about our easy handle */ + curl_multi_add_handle(mcurl, curl); + + do { + CURLMcode mc = curl_multi_perform(mcurl, &still_running); + + if(still_running) + /* wait for activity, timeout or "nothing" */ + mc = curl_multi_poll(mcurl, NULL, 0, 1000, NULL); + + if(mc) + break; + } while(still_running); + + /* Always cleanup */ + curl_multi_remove_handle(mcurl, curl); + curl_multi_cleanup(mcurl); + curl_easy_cleanup(curl); + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/imap-noop.c b/curl/docs/examples/imap-noop.c new file mode 100644 index 0000000..9e5a3da --- /dev/null +++ b/curl/docs/examples/imap-noop.c @@ -0,0 +1,69 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Perform an IMAP noop + * + */ + +#include +#include + +/* This is a simple example showing how to perform a noop using libcurl's IMAP + * capabilities. + * + * Note that this example requires libcurl 7.30.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This is just the server URL */ + curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com"); + + /* Set the NOOP command */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "NOOP"); + + /* Perform the custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/imap-search.c b/curl/docs/examples/imap-search.c new file mode 100644 index 0000000..141b06f --- /dev/null +++ b/curl/docs/examples/imap-search.c @@ -0,0 +1,73 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Search for new IMAP emails + * + */ + +#include +#include + +/* This is a simple example showing how to search for new messages using + * libcurl's IMAP capabilities. + * + * Note that this example requires libcurl 7.30.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This is mailbox folder to select */ + curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com/INBOX"); + + /* Set the SEARCH command specifying what we want to search for. Note that + * this can contain a message sequence set and a number of search criteria + * keywords including flags such as ANSWERED, DELETED, DRAFT, FLAGGED, NEW, + * RECENT and SEEN. For more information about the search criteria please + * see RFC-3501 section 6.4.4. */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "SEARCH NEW"); + + /* Perform the custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/imap-ssl.c b/curl/docs/examples/imap-ssl.c new file mode 100644 index 0000000..a2774be --- /dev/null +++ b/curl/docs/examples/imap-ssl.c @@ -0,0 +1,94 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * IMAP with implicit SSL + * + */ + +#include +#include + +/* This is a simple example showing how to fetch mail using libcurl's IMAP + * capabilities. It builds on the imap-fetch.c example adding transport + * security to protect the authentication details from being snooped. + * + * Note that this example requires libcurl 7.30.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This fetches message 1 from the user's inbox. Note the use of + * imaps:// rather than imap:// to request a SSL based connection. */ + curl_easy_setopt(curl, CURLOPT_URL, + "imaps://imap.example.com/INBOX/;UID=1"); + + /* If you want to connect to a site who is not using a certificate that is + * signed by one of the certs in the CA bundle you have, you can skip the + * verification of the server's certificate. This makes the connection + * A LOT LESS SECURE. + * + * If you have a CA cert for the server stored someplace else than in the + * default bundle, then the CURLOPT_CAPATH option might come handy for + * you. */ +#ifdef SKIP_PEER_VERIFICATION + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); +#endif + + /* If the site you are connecting to uses a different host name that what + * they have mentioned in their server certificate's commonName (or + * subjectAltName) fields, libcurl refuses to connect. You can skip this + * check, but it makes the connection insecure. */ +#ifdef SKIP_HOSTNAME_VERIFICATION + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); +#endif + + /* Since the traffic is encrypted, it is useful to turn on debug + * information within libcurl to see what is happening during the + * transfer */ + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + /* Perform the fetch */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/imap-store.c b/curl/docs/examples/imap-store.c new file mode 100644 index 0000000..d04a607 --- /dev/null +++ b/curl/docs/examples/imap-store.c @@ -0,0 +1,84 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Modify the properties of an email over IMAP + * + */ + +#include +#include + +/* This is a simple example showing how to modify an existing mail using + * libcurl's IMAP capabilities with the STORE command. + * + * Note that this example requires libcurl 7.30.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This is the mailbox folder to select */ + curl_easy_setopt(curl, CURLOPT_URL, "imap://imap.example.com/INBOX"); + + /* Set the STORE command with the Deleted flag for message 1. Note that + * you can use the STORE command to set other flags such as Seen, Answered, + * Flagged, Draft and Recent. */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "STORE 1 +Flags \\Deleted"); + + /* Perform the custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + else { + /* Set the EXPUNGE command, although you can use the CLOSE command if you + * do not want to know the result of the STORE */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "EXPUNGE"); + + /* Perform the second custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + } + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/imap-tls.c b/curl/docs/examples/imap-tls.c new file mode 100644 index 0000000..838923b --- /dev/null +++ b/curl/docs/examples/imap-tls.c @@ -0,0 +1,94 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * IMAP using TLS + * + */ + +#include +#include + +/* This is a simple example showing how to fetch mail using libcurl's IMAP + * capabilities. It builds on the imap-fetch.c example adding transport + * security to protect the authentication details from being snooped. + * + * Note that this example requires libcurl 7.30.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This fetches message 1 from the user's inbox */ + curl_easy_setopt(curl, CURLOPT_URL, + "imap://imap.example.com/INBOX/;UID=1"); + + /* In this example, we start with a plain text connection, and upgrade to + * Transport Layer Security (TLS) using the STARTTLS command. Be careful + * of using CURLUSESSL_TRY here, because if TLS upgrade fails, the + * transfer continues anyway - see the security discussion in the libcurl + * tutorial for more details. */ + curl_easy_setopt(curl, CURLOPT_USE_SSL, (long)CURLUSESSL_ALL); + + /* If your server does not have a valid certificate, then you can disable + * part of the Transport Layer Security protection by setting the + * CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST options to 0 (false). + * curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); + * curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); + * + * That is, in general, a bad idea. It is still better than sending your + * authentication details in plain text though. Instead, you should get + * the issuer certificate (or the host certificate if the certificate is + * self-signed) and add it to the set of certificates that are known to + * libcurl using CURLOPT_CAINFO and/or CURLOPT_CAPATH. See docs/SSLCERTS + * for more information. */ + curl_easy_setopt(curl, CURLOPT_CAINFO, "/path/to/certificate.pem"); + + /* Since the traffic is encrypted, it is useful to turn on debug + * information within libcurl to see what is happening during the + * transfer */ + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + /* Perform the fetch */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/interface.c b/curl/docs/examples/interface.c new file mode 100644 index 0000000..f1a2016 --- /dev/null +++ b/curl/docs/examples/interface.c @@ -0,0 +1,52 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Use CURLOPT_INTERFACE to bind the outgoing socket to an interface + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* The interface needs to be a local existing interface over which you can + connect to the host in the URL. It can also specify an IP address, but + that address needs to be assigned one of the local network + interfaces. */ + curl_easy_setopt(curl, CURLOPT_INTERFACE, "enp3s0"); + curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/"); + + res = curl_easy_perform(curl); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/ipv6.c b/curl/docs/examples/ipv6.c new file mode 100644 index 0000000..371e0f5 --- /dev/null +++ b/curl/docs/examples/ipv6.c @@ -0,0 +1,48 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * HTTPS GET using IPv6 only + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_IPRESOLVE, (long)CURL_IPRESOLVE_V6); + + curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/"); + + res = curl_easy_perform(curl); + + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/keepalive.c b/curl/docs/examples/keepalive.c new file mode 100644 index 0000000..e06d7ff --- /dev/null +++ b/curl/docs/examples/keepalive.c @@ -0,0 +1,58 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Use the TCP keep-alive options + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* enable TCP keep-alive for this transfer */ + curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L); + + /* keep-alive idle time to 120 seconds */ + curl_easy_setopt(curl, CURLOPT_TCP_KEEPIDLE, 120L); + + /* interval time between keep-alive probes: 60 seconds */ + curl_easy_setopt(curl, CURLOPT_TCP_KEEPINTVL, 60L); + + /* maximum number of keep-alive probes: 3 */ + curl_easy_setopt(curl, CURLOPT_TCP_KEEPCNT, 3L); + + curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/"); + + res = curl_easy_perform(curl); + + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/localport.c b/curl/docs/examples/localport.c new file mode 100644 index 0000000..7e88ce4 --- /dev/null +++ b/curl/docs/examples/localport.c @@ -0,0 +1,53 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Use CURLOPT_LOCALPORT to control local port number + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Try to use a local port number between 20000-20009 */ + curl_easy_setopt(curl, CURLOPT_LOCALPORT, 20000L); + /* 10 means number of attempts, which starts with the number set in + CURLOPT_LOCALPORT. The lower value set, the smaller the chance it + works. */ + curl_easy_setopt(curl, CURLOPT_LOCALPORTRANGE, 10L); + curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/"); + + res = curl_easy_perform(curl); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/maxconnects.c b/curl/docs/examples/maxconnects.c new file mode 100644 index 0000000..2e8e5b5 --- /dev/null +++ b/curl/docs/examples/maxconnects.c @@ -0,0 +1,66 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) James Fuller, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Set maximum number of persistent connections to 1. + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl = curl_easy_init(); + if(curl) { + const char *urls[] = { "https://example.com", + "https://curl.se", + "https://www.example/", + NULL /* end of list */ + }; + int i = 0; + + /* Change the maximum number of persistent connection */ + curl_easy_setopt(curl, CURLOPT_MAXCONNECTS, 1L); + + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + /* loop over the URLs */ + while(urls[i]) { + curl_easy_setopt(curl, CURLOPT_URL, urls[i]); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + i++; + } + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/multi-app.c b/curl/docs/examples/multi-app.c new file mode 100644 index 0000000..5bbf580 --- /dev/null +++ b/curl/docs/examples/multi-app.c @@ -0,0 +1,115 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * A basic application source code using the multi interface doing two + * transfers in parallel. + * + */ + +#include +#include + +/* curl stuff */ +#include + +/* + * Download an HTTP file and upload an FTP file simultaneously. + */ + +#define HANDLECOUNT 2 /* Number of simultaneous transfers */ +#define HTTP_HANDLE 0 /* Index for the HTTP transfer */ +#define FTP_HANDLE 1 /* Index for the FTP transfer */ + +int main(void) +{ + CURL *handles[HANDLECOUNT]; + CURLM *multi_handle; + + int still_running = 1; /* keep number of running handles */ + int i; + + CURLMsg *msg; /* for picking up messages with the transfer status */ + int msgs_left; /* how many messages are left */ + + /* Allocate one curl handle per transfer */ + for(i = 0; i < HANDLECOUNT; i++) + handles[i] = curl_easy_init(); + + /* set the options (I left out a few, you get the point anyway) */ + curl_easy_setopt(handles[HTTP_HANDLE], CURLOPT_URL, "https://example.com"); + + curl_easy_setopt(handles[FTP_HANDLE], CURLOPT_URL, "ftp://example.com"); + curl_easy_setopt(handles[FTP_HANDLE], CURLOPT_UPLOAD, 1L); + + /* init a multi stack */ + multi_handle = curl_multi_init(); + + /* add the individual transfers */ + for(i = 0; i < HANDLECOUNT; i++) + curl_multi_add_handle(multi_handle, handles[i]); + + while(still_running) { + CURLMcode mc = curl_multi_perform(multi_handle, &still_running); + + if(still_running) + /* wait for activity, timeout or "nothing" */ + mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL); + + if(mc) + break; + } + /* See how the transfers went */ + /* !checksrc! disable EQUALSNULL 1 */ + while((msg = curl_multi_info_read(multi_handle, &msgs_left)) != NULL) { + if(msg->msg == CURLMSG_DONE) { + int idx; + + /* Find out which handle this message is about */ + for(idx = 0; idx < HANDLECOUNT; idx++) { + int found = (msg->easy_handle == handles[idx]); + if(found) + break; + } + + switch(idx) { + case HTTP_HANDLE: + printf("HTTP transfer completed with status %d\n", msg->data.result); + break; + case FTP_HANDLE: + printf("FTP transfer completed with status %d\n", msg->data.result); + break; + } + } + } + + /* remove the transfers and cleanup the handles */ + for(i = 0; i < HANDLECOUNT; i++) { + curl_multi_remove_handle(multi_handle, handles[i]); + curl_easy_cleanup(handles[i]); + } + + curl_multi_cleanup(multi_handle); + + return 0; +} diff --git a/curl/docs/examples/multi-debugcallback.c b/curl/docs/examples/multi-debugcallback.c new file mode 100644 index 0000000..79123ca --- /dev/null +++ b/curl/docs/examples/multi-debugcallback.c @@ -0,0 +1,161 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * multi interface and debug callback + * + */ + +#include +#include + +/* curl stuff */ +#include + +#define TRUE 1 + +static void dump(const char *text, FILE *stream, unsigned char *ptr, + size_t size, char nohex) +{ + size_t i; + size_t c; + + unsigned int width = 0x10; + + if(nohex) + /* without the hex output, we can fit more on screen */ + width = 0x40; + + fprintf(stream, "%s, %10.10lu bytes (0x%8.8lx)\n", + text, (unsigned long)size, (unsigned long)size); + + for(i = 0; i < size; i += width) { + + fprintf(stream, "%4.4lx: ", (unsigned long)i); + + if(!nohex) { + /* hex not disabled, show it */ + for(c = 0; c < width; c++) + if(i + c < size) + fprintf(stream, "%02x ", ptr[i + c]); + else + fputs(" ", stream); + } + + for(c = 0; (c < width) && (i + c < size); c++) { + /* check for 0D0A; if found, skip past and start a new line of output */ + if(nohex && (i + c + 1 < size) && ptr[i + c] == 0x0D && + ptr[i + c + 1] == 0x0A) { + i += (c + 2 - width); + break; + } + fprintf(stream, "%c", + (ptr[i + c] >= 0x20) && (ptr[i + c] < 0x80) ? ptr[i + c] : '.'); + /* check again for 0D0A, to avoid an extra \n if it's at width */ + if(nohex && (i + c + 2 < size) && ptr[i + c + 1] == 0x0D && + ptr[i + c + 2] == 0x0A) { + i += (c + 3 - width); + break; + } + } + fputc('\n', stream); /* newline */ + } + fflush(stream); +} + +static +int my_trace(CURL *handle, curl_infotype type, + unsigned char *data, size_t size, + void *userp) +{ + const char *text; + + (void)userp; + (void)handle; /* prevent compiler warning */ + + switch(type) { + case CURLINFO_TEXT: + fprintf(stderr, "== Info: %s", data); + return 0; + case CURLINFO_HEADER_OUT: + text = "=> Send header"; + break; + case CURLINFO_DATA_OUT: + text = "=> Send data"; + break; + case CURLINFO_HEADER_IN: + text = "<= Recv header"; + break; + case CURLINFO_DATA_IN: + text = "<= Recv data"; + break; + default: /* in case a new one is introduced to shock us */ + return 0; + } + + dump(text, stderr, data, size, TRUE); + return 0; +} + +/* + * Simply download an HTTP file. + */ +int main(void) +{ + CURL *http_handle; + CURLM *multi_handle; + + int still_running = 0; /* keep number of running handles */ + + http_handle = curl_easy_init(); + + /* set the options (I left out a few, you get the point anyway) */ + curl_easy_setopt(http_handle, CURLOPT_URL, "https://www.example.com/"); + + curl_easy_setopt(http_handle, CURLOPT_DEBUGFUNCTION, my_trace); + curl_easy_setopt(http_handle, CURLOPT_VERBOSE, 1L); + + /* init a multi stack */ + multi_handle = curl_multi_init(); + + /* add the individual transfers */ + curl_multi_add_handle(multi_handle, http_handle); + + do { + CURLMcode mc = curl_multi_perform(multi_handle, &still_running); + + if(still_running) + /* wait for activity, timeout or "nothing" */ + mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL); + + if(mc) + break; + + } while(still_running); + + curl_multi_cleanup(multi_handle); + + curl_easy_cleanup(http_handle); + + return 0; +} diff --git a/curl/docs/examples/multi-double.c b/curl/docs/examples/multi-double.c new file mode 100644 index 0000000..99bd736 --- /dev/null +++ b/curl/docs/examples/multi-double.c @@ -0,0 +1,93 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * multi interface code doing two parallel HTTP transfers + * + */ +#include +#include + +/* curl stuff */ +#include + +/* + * Simply download two HTTP files! + */ +int main(void) +{ + CURL *http_handle; + CURL *http_handle2; + CURLM *multi_handle; + + int still_running = 1; /* keep number of running handles */ + + http_handle = curl_easy_init(); + http_handle2 = curl_easy_init(); + + /* set options */ + curl_easy_setopt(http_handle, CURLOPT_URL, "https://www.example.com/"); + + /* set options */ + curl_easy_setopt(http_handle2, CURLOPT_URL, "http://localhost/"); + + /* init a multi stack */ + multi_handle = curl_multi_init(); + + /* add the individual transfers */ + curl_multi_add_handle(multi_handle, http_handle); + curl_multi_add_handle(multi_handle, http_handle2); + + while(still_running) { + CURLMsg *msg; + int queued; + CURLMcode mc = curl_multi_perform(multi_handle, &still_running); + + if(still_running) + /* wait for activity, timeout or "nothing" */ + mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL); + + if(mc) + break; + + do { + msg = curl_multi_info_read(multi_handle, &queued); + if(msg) { + if(msg->msg == CURLMSG_DONE) { + /* a transfer ended */ + fprintf(stderr, "Transfer completed\n"); + } + } + } while(msg); + } + + curl_multi_remove_handle(multi_handle, http_handle); + curl_multi_remove_handle(multi_handle, http_handle2); + + curl_multi_cleanup(multi_handle); + + curl_easy_cleanup(http_handle); + curl_easy_cleanup(http_handle2); + + return 0; +} diff --git a/curl/docs/examples/multi-formadd.c b/curl/docs/examples/multi-formadd.c new file mode 100644 index 0000000..58c7e64 --- /dev/null +++ b/curl/docs/examples/multi-formadd.c @@ -0,0 +1,120 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * using the multi interface to do a multipart formpost without blocking + * + */ + +/* + * Warning: this example uses the deprecated form api. See "multi-post.c" + * for a similar example using the mime api. + */ + +#include +#include + +#include + +int main(void) +{ + CURL *curl; + + CURLM *multi_handle; + int still_running = 0; + + struct curl_httppost *formpost = NULL; + struct curl_httppost *lastptr = NULL; + struct curl_slist *headerlist = NULL; + static const char buf[] = "Expect:"; + + CURL_IGNORE_DEPRECATION( + /* Fill in the file upload field. This makes libcurl load data from + the given file name when curl_easy_perform() is called. */ + curl_formadd(&formpost, + &lastptr, + CURLFORM_COPYNAME, "sendfile", + CURLFORM_FILE, "multi-formadd.c", + CURLFORM_END); + + /* Fill in the filename field */ + curl_formadd(&formpost, + &lastptr, + CURLFORM_COPYNAME, "filename", + CURLFORM_COPYCONTENTS, "multi-formadd.c", + CURLFORM_END); + + /* Fill in the submit field too, even if this is rarely needed */ + curl_formadd(&formpost, + &lastptr, + CURLFORM_COPYNAME, "submit", + CURLFORM_COPYCONTENTS, "send", + CURLFORM_END); + ) + + curl = curl_easy_init(); + multi_handle = curl_multi_init(); + + /* initialize custom header list (stating that Expect: 100-continue is not + wanted */ + headerlist = curl_slist_append(headerlist, buf); + if(curl && multi_handle) { + + /* what URL that receives this POST */ + curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/upload.cgi"); + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headerlist); + CURL_IGNORE_DEPRECATION( + curl_easy_setopt(curl, CURLOPT_HTTPPOST, formpost); + ) + + curl_multi_add_handle(multi_handle, curl); + + do { + CURLMcode mc = curl_multi_perform(multi_handle, &still_running); + + if(still_running) + /* wait for activity, timeout or "nothing" */ + mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL); + + if(mc) + break; + + } while(still_running); + + curl_multi_cleanup(multi_handle); + + /* always cleanup */ + curl_easy_cleanup(curl); + + CURL_IGNORE_DEPRECATION( + /* then cleanup the formpost chain */ + curl_formfree(formpost); + ) + + /* free slist */ + curl_slist_free_all(headerlist); + } + return 0; +} diff --git a/curl/docs/examples/multi-legacy.c b/curl/docs/examples/multi-legacy.c new file mode 100644 index 0000000..b0c37ea --- /dev/null +++ b/curl/docs/examples/multi-legacy.c @@ -0,0 +1,191 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * A basic application source code using the multi interface doing two + * transfers in parallel without curl_multi_wait/poll. + * + */ + +#include +#include + +/* somewhat Unix-specific */ +#ifndef _WIN32 +#include +#include +#endif + +/* curl stuff */ +#include + +/* + * Download an HTTP file and upload an FTP file simultaneously. + */ + +#define HANDLECOUNT 2 /* Number of simultaneous transfers */ +#define HTTP_HANDLE 0 /* Index for the HTTP transfer */ +#define FTP_HANDLE 1 /* Index for the FTP transfer */ + +int main(void) +{ + CURL *handles[HANDLECOUNT]; + CURLM *multi_handle; + + int still_running = 0; /* keep number of running handles */ + int i; + + CURLMsg *msg; /* for picking up messages with the transfer status */ + int msgs_left; /* how many messages are left */ + + /* Allocate one curl handle per transfer */ + for(i = 0; i < HANDLECOUNT; i++) + handles[i] = curl_easy_init(); + + /* set the options (I left out a few, you get the point anyway) */ + curl_easy_setopt(handles[HTTP_HANDLE], CURLOPT_URL, "https://example.com"); + + curl_easy_setopt(handles[FTP_HANDLE], CURLOPT_URL, "ftp://example.com"); + curl_easy_setopt(handles[FTP_HANDLE], CURLOPT_UPLOAD, 1L); + + /* init a multi stack */ + multi_handle = curl_multi_init(); + + /* add the individual transfers */ + for(i = 0; i < HANDLECOUNT; i++) + curl_multi_add_handle(multi_handle, handles[i]); + + /* we start some action by calling perform right away */ + curl_multi_perform(multi_handle, &still_running); + + while(still_running) { + struct timeval timeout; + int rc; /* select() return code */ + CURLMcode mc; /* curl_multi_fdset() return code */ + + fd_set fdread; + fd_set fdwrite; + fd_set fdexcep; + int maxfd = -1; + + long curl_timeo = -1; + + FD_ZERO(&fdread); + FD_ZERO(&fdwrite); + FD_ZERO(&fdexcep); + + /* set a suitable timeout to play around with */ + timeout.tv_sec = 1; + timeout.tv_usec = 0; + + curl_multi_timeout(multi_handle, &curl_timeo); + if(curl_timeo >= 0) { +#if defined(MSDOS) || defined(__AMIGA__) + timeout.tv_sec = (time_t)(curl_timeo / 1000); +#else + timeout.tv_sec = curl_timeo / 1000; +#endif + if(timeout.tv_sec > 1) + timeout.tv_sec = 1; + else +#if defined(MSDOS) || defined(__AMIGA__) + timeout.tv_usec = (time_t)(curl_timeo % 1000) * 1000; +#else + timeout.tv_usec = (int)(curl_timeo % 1000) * 1000; +#endif + } + + /* get file descriptors from the transfers */ + mc = curl_multi_fdset(multi_handle, &fdread, &fdwrite, &fdexcep, &maxfd); + + if(mc != CURLM_OK) { + fprintf(stderr, "curl_multi_fdset() failed, code %d.\n", mc); + break; + } + + /* On success the value of maxfd is guaranteed to be >= -1. We call + select(maxfd + 1, ...); specially in case of (maxfd == -1) there are + no fds ready yet so we call select(0, ...) --or Sleep() on Windows-- + to sleep 100ms, which is the minimum suggested value in the + curl_multi_fdset() doc. */ + + if(maxfd == -1) { +#ifdef _WIN32 + Sleep(100); + rc = 0; +#else + /* Portable sleep for platforms other than Windows. */ + struct timeval wait = {0}; + wait.tv_usec = 100 * 1000; /* 100ms */ + rc = select(0, NULL, NULL, NULL, &wait); +#endif + } + else { + /* Note that on some platforms 'timeout' may be modified by select(). + If you need access to the original value save a copy beforehand. */ + rc = select(maxfd + 1, &fdread, &fdwrite, &fdexcep, &timeout); + } + + switch(rc) { + case -1: + /* select error */ + break; + case 0: /* timeout */ + default: /* action */ + curl_multi_perform(multi_handle, &still_running); + break; + } + } + + /* See how the transfers went */ + /* !checksrc! disable EQUALSNULL 1 */ + while((msg = curl_multi_info_read(multi_handle, &msgs_left)) != NULL) { + if(msg->msg == CURLMSG_DONE) { + int idx; + + /* Find out which handle this message is about */ + for(idx = 0; idx < HANDLECOUNT; idx++) { + int found = (msg->easy_handle == handles[idx]); + if(found) + break; + } + + switch(idx) { + case HTTP_HANDLE: + printf("HTTP transfer completed with status %d\n", msg->data.result); + break; + case FTP_HANDLE: + printf("FTP transfer completed with status %d\n", msg->data.result); + break; + } + } + } + + curl_multi_cleanup(multi_handle); + + /* Free the curl handles */ + for(i = 0; i < HANDLECOUNT; i++) + curl_easy_cleanup(handles[i]); + + return 0; +} diff --git a/curl/docs/examples/multi-post.c b/curl/docs/examples/multi-post.c new file mode 100644 index 0000000..84af48f --- /dev/null +++ b/curl/docs/examples/multi-post.c @@ -0,0 +1,104 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * using the multi interface to do a multipart formpost without blocking + * + */ + +#include +#include + +#include + +int main(void) +{ + CURL *curl; + + CURLM *multi_handle; + int still_running = 0; + + curl_mime *form = NULL; + curl_mimepart *field = NULL; + struct curl_slist *headerlist = NULL; + static const char buf[] = "Expect:"; + + curl = curl_easy_init(); + multi_handle = curl_multi_init(); + + if(curl && multi_handle) { + /* Create the form */ + form = curl_mime_init(curl); + + /* Fill in the file upload field */ + field = curl_mime_addpart(form); + curl_mime_name(field, "sendfile"); + curl_mime_filedata(field, "multi-post.c"); + + /* Fill in the filename field */ + field = curl_mime_addpart(form); + curl_mime_name(field, "filename"); + curl_mime_data(field, "multi-post.c", CURL_ZERO_TERMINATED); + + /* Fill in the submit field too, even if this is rarely needed */ + field = curl_mime_addpart(form); + curl_mime_name(field, "submit"); + curl_mime_data(field, "send", CURL_ZERO_TERMINATED); + + /* initialize custom header list (stating that Expect: 100-continue is not + wanted */ + headerlist = curl_slist_append(headerlist, buf); + + /* what URL that receives this POST */ + curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/upload.cgi"); + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headerlist); + curl_easy_setopt(curl, CURLOPT_MIMEPOST, form); + + curl_multi_add_handle(multi_handle, curl); + + do { + CURLMcode mc = curl_multi_perform(multi_handle, &still_running); + + if(still_running) + /* wait for activity, timeout or "nothing" */ + mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL); + + if(mc) + break; + } while(still_running); + + curl_multi_cleanup(multi_handle); + + /* always cleanup */ + curl_easy_cleanup(curl); + + /* then cleanup the form */ + curl_mime_free(form); + + /* free slist */ + curl_slist_free_all(headerlist); + } + return 0; +} diff --git a/curl/docs/examples/multi-single.c b/curl/docs/examples/multi-single.c new file mode 100644 index 0000000..0ead96f --- /dev/null +++ b/curl/docs/examples/multi-single.c @@ -0,0 +1,80 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * using the multi interface to do a single download + * + */ + +#include +#include + +/* curl stuff */ +#include + +/* + * Simply download an HTTP file. + */ +int main(void) +{ + CURL *http_handle; + CURLM *multi_handle; + int still_running = 1; /* keep number of running handles */ + + curl_global_init(CURL_GLOBAL_DEFAULT); + + http_handle = curl_easy_init(); + + /* set the options (I left out a few, you get the point anyway) */ + curl_easy_setopt(http_handle, CURLOPT_URL, "https://www.example.com/"); + + /* init a multi stack */ + multi_handle = curl_multi_init(); + + /* add the individual transfers */ + curl_multi_add_handle(multi_handle, http_handle); + + do { + CURLMcode mc = curl_multi_perform(multi_handle, &still_running); + + if(!mc) + /* wait for activity, timeout or "nothing" */ + mc = curl_multi_poll(multi_handle, NULL, 0, 1000, NULL); + + if(mc) { + fprintf(stderr, "curl_multi_poll() failed, code %d.\n", (int)mc); + break; + } + + } while(still_running); + + curl_multi_remove_handle(multi_handle, http_handle); + + curl_easy_cleanup(http_handle); + + curl_multi_cleanup(multi_handle); + + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/netrc.c b/curl/docs/examples/netrc.c new file mode 100644 index 0000000..42e1b63 --- /dev/null +++ b/curl/docs/examples/netrc.c @@ -0,0 +1,49 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Use credentials from .netrc + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL); + curl_easy_setopt(curl, CURLOPT_NETRC_FILE, + "/home/daniel/s3cr3ts.txt"); + curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/"); + + res = curl_easy_perform(curl); + + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/parseurl.c b/curl/docs/examples/parseurl.c new file mode 100644 index 0000000..8675adc --- /dev/null +++ b/curl/docs/examples/parseurl.c @@ -0,0 +1,80 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Basic URL API use. + * + */ +#include +#include + +#if !CURL_AT_LEAST_VERSION(7, 62, 0) +#error "this example requires curl 7.62.0 or later" +#endif + +int main(void) +{ + CURLU *h; + CURLUcode uc; + char *host; + char *path; + + h = curl_url(); /* get a handle to work with */ + if(!h) + return 1; + + /* parse a full URL */ + uc = curl_url_set(h, CURLUPART_URL, "http://example.com/path/index.html", 0); + if(uc) + goto fail; + + /* extract hostname from the parsed URL */ + uc = curl_url_get(h, CURLUPART_HOST, &host, 0); + if(!uc) { + printf("Host name: %s\n", host); + curl_free(host); + } + + /* extract the path from the parsed URL */ + uc = curl_url_get(h, CURLUPART_PATH, &path, 0); + if(!uc) { + printf("Path: %s\n", path); + curl_free(path); + } + + /* redirect with a relative URL */ + uc = curl_url_set(h, CURLUPART_URL, "../another/second.html", 0); + if(uc) + goto fail; + + /* extract the new, updated path */ + uc = curl_url_get(h, CURLUPART_PATH, &path, 0); + if(!uc) { + printf("Path: %s\n", path); + curl_free(path); + } + +fail: + curl_url_cleanup(h); /* free URL handle */ + return 0; +} diff --git a/curl/docs/examples/persistent.c b/curl/docs/examples/persistent.c new file mode 100644 index 0000000..be5e8c3 --- /dev/null +++ b/curl/docs/examples/persistent.c @@ -0,0 +1,70 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * reusing handles to do HTTP persistent connections + * + */ +#include + +#include + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl_global_init(CURL_GLOBAL_ALL); + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + curl_easy_setopt(curl, CURLOPT_HEADER, 1L); + + /* get the first document */ + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/"); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* get another document from the same server using the same + connection */ + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/docs/"); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + + return 0; +} diff --git a/curl/docs/examples/pop3-authzid.c b/curl/docs/examples/pop3-authzid.c new file mode 100644 index 0000000..3281b32 --- /dev/null +++ b/curl/docs/examples/pop3-authzid.c @@ -0,0 +1,72 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Retrieve emails from a shared POP3 mailbox + * + */ + +#include +#include + +/* This is a simple example showing how to retrieve mail using libcurl's POP3 + * capabilities. + * + * Note that this example requires libcurl 7.66.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set the username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* Set the authorization identity (identity to act as) */ + curl_easy_setopt(curl, CURLOPT_SASL_AUTHZID, "shared-mailbox"); + + /* Force PLAIN authentication */ + curl_easy_setopt(curl, CURLOPT_LOGIN_OPTIONS, "AUTH=PLAIN"); + + /* This retrieves message 1 from the user's mailbox */ + curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com/1"); + + /* Perform the retr */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/pop3-dele.c b/curl/docs/examples/pop3-dele.c new file mode 100644 index 0000000..fe3795c --- /dev/null +++ b/curl/docs/examples/pop3-dele.c @@ -0,0 +1,72 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Delete POP3 emails + * + */ + +#include +#include + +/* This is a simple example showing how to delete an existing mail using + * libcurl's POP3 capabilities. + * + * Note that this example requires libcurl 7.26.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* You can specify the message either in the URL or DELE command */ + curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com/1"); + + /* Set the DELE command */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "DELE"); + + /* Do not perform a transfer as DELE returns no data */ + curl_easy_setopt(curl, CURLOPT_NOBODY, 1L); + + /* Perform the custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/pop3-list.c b/curl/docs/examples/pop3-list.c new file mode 100644 index 0000000..2cd44e4 --- /dev/null +++ b/curl/docs/examples/pop3-list.c @@ -0,0 +1,66 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * List the contents of a POP3 mailbox + * + */ + +#include +#include + +/* This is a simple example using libcurl's POP3 capabilities to list the + * contents of a mailbox. + * + * Note that this example requires libcurl 7.20.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This lists every message of the given mailbox */ + curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com"); + + /* Perform the list */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/pop3-multi.c b/curl/docs/examples/pop3-multi.c new file mode 100644 index 0000000..54eb7ec --- /dev/null +++ b/curl/docs/examples/pop3-multi.c @@ -0,0 +1,84 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Get POP3 email using the multi interface + * + */ + +#include +#include +#include + +/* This is a simple example showing how to retrieve mail using libcurl's POP3 + * capabilities. It builds on the pop3-retr.c example to demonstrate how to use + * libcurl's multi interface. + */ + +int main(void) +{ + CURL *curl; + CURLM *mcurl; + int still_running = 1; + + curl_global_init(CURL_GLOBAL_DEFAULT); + + curl = curl_easy_init(); + if(!curl) + return 1; + + mcurl = curl_multi_init(); + if(!mcurl) + return 2; + + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This retrieves message 1 from the user's mailbox */ + curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com/1"); + + /* Tell the multi stack about our easy handle */ + curl_multi_add_handle(mcurl, curl); + + do { + CURLMcode mc = curl_multi_perform(mcurl, &still_running); + + if(still_running) + /* wait for activity, timeout or "nothing" */ + mc = curl_multi_poll(mcurl, NULL, 0, 1000, NULL); + + if(mc) + break; + + } while(still_running); + + /* Always cleanup */ + curl_multi_remove_handle(mcurl, curl); + curl_multi_cleanup(mcurl); + curl_easy_cleanup(curl); + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/pop3-noop.c b/curl/docs/examples/pop3-noop.c new file mode 100644 index 0000000..16181d2 --- /dev/null +++ b/curl/docs/examples/pop3-noop.c @@ -0,0 +1,72 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Perform a POP3 noop + * + */ + +#include +#include + +/* This is a simple example showing how to perform a noop using libcurl's POP3 + * capabilities. + * + * Note that this example requires libcurl 7.26.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This is just the server URL */ + curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com"); + + /* Set the NOOP command */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "NOOP"); + + /* Do not perform a transfer as NOOP returns no data */ + curl_easy_setopt(curl, CURLOPT_NOBODY, 1L); + + /* Perform the custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/pop3-retr.c b/curl/docs/examples/pop3-retr.c new file mode 100644 index 0000000..8e690f9 --- /dev/null +++ b/curl/docs/examples/pop3-retr.c @@ -0,0 +1,66 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Retrieve POP3 email + * + */ + +#include +#include + +/* This is a simple example showing how to retrieve mail using libcurl's POP3 + * capabilities. + * + * Note that this example requires libcurl 7.20.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This retrieves message 1 from the user's mailbox */ + curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com/1"); + + /* Perform the retr */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/pop3-ssl.c b/curl/docs/examples/pop3-ssl.c new file mode 100644 index 0000000..dcc7992 --- /dev/null +++ b/curl/docs/examples/pop3-ssl.c @@ -0,0 +1,93 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Get POP3 email using implicit SSL + * + */ + +#include +#include + +/* This is a simple example showing how to retrieve mail using libcurl's POP3 + * capabilities. It builds on the pop3-retr.c example adding transport + * security to protect the authentication details from being snooped. + * + * Note that this example requires libcurl 7.20.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This retrieves message 1 from the user's mailbox. Note the use of + * pop3s:// rather than pop3:// to request a SSL based connection. */ + curl_easy_setopt(curl, CURLOPT_URL, "pop3s://pop.example.com/1"); + + /* If you want to connect to a site who is not using a certificate that is + * signed by one of the certs in the CA bundle you have, you can skip the + * verification of the server's certificate. This makes the connection + * A LOT LESS SECURE. + * + * If you have a CA cert for the server stored someplace else than in the + * default bundle, then the CURLOPT_CAPATH option might come handy for + * you. */ +#ifdef SKIP_PEER_VERIFICATION + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); +#endif + + /* If the site you are connecting to uses a different host name that what + * they have mentioned in their server certificate's commonName (or + * subjectAltName) fields, libcurl refuses to connect. You can skip this + * check, but it makes the connection insecure. */ +#ifdef SKIP_HOSTNAME_VERIFICATION + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); +#endif + + /* Since the traffic is encrypted, it is useful to turn on debug + * information within libcurl to see what is happening during the + * transfer */ + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + /* Perform the retr */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/pop3-stat.c b/curl/docs/examples/pop3-stat.c new file mode 100644 index 0000000..419859b --- /dev/null +++ b/curl/docs/examples/pop3-stat.c @@ -0,0 +1,72 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Obtain POP3 message statistics + * + */ + +#include +#include + +/* This is a simple example showing how to obtain message statistics using + * libcurl's POP3 capabilities. + * + * Note that this example requires libcurl 7.26.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This is just the server URL */ + curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com"); + + /* Set the STAT command */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "STAT"); + + /* Do not perform a transfer as the data is in the response */ + curl_easy_setopt(curl, CURLOPT_NOBODY, 1L); + + /* Perform the custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/pop3-tls.c b/curl/docs/examples/pop3-tls.c new file mode 100644 index 0000000..7c2d824 --- /dev/null +++ b/curl/docs/examples/pop3-tls.c @@ -0,0 +1,93 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * POP3 using TLS + * + */ + +#include +#include + +/* This is a simple example showing how to retrieve mail using libcurl's POP3 + * capabilities. It builds on the pop3-retr.c example adding transport + * security to protect the authentication details from being snooped. + * + * Note that this example requires libcurl 7.20.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This retrieves message 1 from the user's mailbox */ + curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com/1"); + + /* In this example, we start with a plain text connection, and upgrade to + * Transport Layer Security (TLS) using the STLS command. Be careful of + * using CURLUSESSL_TRY here, because if TLS upgrade fails, the transfer + * continues anyway - see the security discussion in the libcurl tutorial + * for more details. */ + curl_easy_setopt(curl, CURLOPT_USE_SSL, (long)CURLUSESSL_ALL); + + /* If your server does not have a valid certificate, then you can disable + * part of the Transport Layer Security protection by setting the + * CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST options to 0 (false). + * curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); + * curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); + * + * That is, in general, a bad idea. It is still better than sending your + * authentication details in plain text though. Instead, you should get + * the issuer certificate (or the host certificate if the certificate is + * self-signed) and add it to the set of certificates that are known to + * libcurl using CURLOPT_CAINFO and/or CURLOPT_CAPATH. See docs/SSLCERTS + * for more information. */ + curl_easy_setopt(curl, CURLOPT_CAINFO, "/path/to/certificate.pem"); + + /* Since the traffic is encrypted, it is useful to turn on debug + * information within libcurl to see what is happening during the + * transfer */ + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + /* Perform the retr */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/pop3-top.c b/curl/docs/examples/pop3-top.c new file mode 100644 index 0000000..7ceba88 --- /dev/null +++ b/curl/docs/examples/pop3-top.c @@ -0,0 +1,69 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * POP3 example showing how to retrieve only the headers of an email + * + */ + +#include +#include + +/* This is a simple example showing how to retrieve only the headers of a mail + * using libcurl's POP3 capabilities. + * + * Note that this example requires libcurl 7.26.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This is just the server URL */ + curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com"); + + /* Set the TOP command for message 1 to only include the headers */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "TOP 1 0"); + + /* Perform the custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/pop3-uidl.c b/curl/docs/examples/pop3-uidl.c new file mode 100644 index 0000000..496e5b0 --- /dev/null +++ b/curl/docs/examples/pop3-uidl.c @@ -0,0 +1,69 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * List the contents of a POP3 mailbox by unique ID + * + */ + +#include +#include + +/* This is a simple example using libcurl's POP3 capabilities to list the + * contents of a mailbox by unique ID. + * + * Note that this example requires libcurl 7.26.0 or above. + */ + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This is just the server URL */ + curl_easy_setopt(curl, CURLOPT_URL, "pop3://pop.example.com"); + + /* Set the UIDL command */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "UIDL"); + + /* Perform the custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/post-callback.c b/curl/docs/examples/post-callback.c new file mode 100644 index 0000000..1a213cb --- /dev/null +++ b/curl/docs/examples/post-callback.c @@ -0,0 +1,156 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Issue an HTTP POST and provide the data through the read callback. + * + */ +#include +#include +#include + +/* silly test data to POST */ +static const char data[]="Lorem ipsum dolor sit amet, consectetur adipiscing " + "elit. Sed vel urna neque. Ut quis leo metus. Quisque eleifend, ex at " + "laoreet rhoncus, odio ipsum semper metus, at tempus ante urna in mauris. " + "Suspendisse ornare tempor venenatis. Ut dui neque, pellentesque a varius " + "eget, mattis vitae ligula. Fusce ut pharetra est. Ut ullamcorper mi ac " + "sollicitudin semper. Praesent sit amet tellus varius, posuere nulla non, " + "rhoncus ipsum."; + +struct WriteThis { + const char *readptr; + size_t sizeleft; +}; + +static size_t read_callback(char *dest, size_t size, size_t nmemb, void *userp) +{ + struct WriteThis *wt = (struct WriteThis *)userp; + size_t buffer_size = size*nmemb; + + if(wt->sizeleft) { + /* copy as much as possible from the source to the destination */ + size_t copy_this_much = wt->sizeleft; + if(copy_this_much > buffer_size) + copy_this_much = buffer_size; + memcpy(dest, wt->readptr, copy_this_much); + + wt->readptr += copy_this_much; + wt->sizeleft -= copy_this_much; + return copy_this_much; /* we copied this many bytes */ + } + + return 0; /* no more data left to deliver */ +} + +int main(void) +{ + CURL *curl; + CURLcode res; + + struct WriteThis wt; + + wt.readptr = data; + wt.sizeleft = strlen(data); + + /* In Windows, this inits the Winsock stuff */ + res = curl_global_init(CURL_GLOBAL_DEFAULT); + /* Check for errors */ + if(res != CURLE_OK) { + fprintf(stderr, "curl_global_init() failed: %s\n", + curl_easy_strerror(res)); + return 1; + } + + /* get a curl handle */ + curl = curl_easy_init(); + if(curl) { + /* First set the URL that is about to receive our POST. */ + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/index.cgi"); + + /* Now specify we want to POST data */ + curl_easy_setopt(curl, CURLOPT_POST, 1L); + + /* we want to use our own read function */ + curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback); + + /* pointer to pass to our read function */ + curl_easy_setopt(curl, CURLOPT_READDATA, &wt); + + /* get verbose debug output please */ + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + /* + If you use POST to an HTTP 1.1 server, you can send data without knowing + the size before starting the POST if you use chunked encoding. You + enable this by adding a header like "Transfer-Encoding: chunked" with + CURLOPT_HTTPHEADER. With HTTP 1.0 or without chunked transfer, you must + specify the size in the request. + */ +#ifdef USE_CHUNKED + { + struct curl_slist *chunk = NULL; + + chunk = curl_slist_append(chunk, "Transfer-Encoding: chunked"); + res = curl_easy_setopt(curl, CURLOPT_HTTPHEADER, chunk); + /* use curl_slist_free_all() after the *perform() call to free this + list again */ + } +#else + /* Set the expected POST size. If you want to POST large amounts of data, + consider CURLOPT_POSTFIELDSIZE_LARGE */ + curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)wt.sizeleft); +#endif + +#ifdef DISABLE_EXPECT + /* + Using POST with HTTP 1.1 implies the use of a "Expect: 100-continue" + header. You can disable this header with CURLOPT_HTTPHEADER as usual. + NOTE: if you want chunked transfer too, you need to combine these two + since you can only set one list of headers with CURLOPT_HTTPHEADER. */ + + /* A less good option would be to enforce HTTP 1.0, but that might also + have other implications. */ + { + struct curl_slist *chunk = NULL; + + chunk = curl_slist_append(chunk, "Expect:"); + res = curl_easy_setopt(curl, CURLOPT_HTTPHEADER, chunk); + /* use curl_slist_free_all() after the *perform() call to free this + list again */ + } +#endif + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + curl_global_cleanup(); + return 0; +} diff --git a/curl/docs/examples/postinmemory.c b/curl/docs/examples/postinmemory.c new file mode 100644 index 0000000..cbdc77f --- /dev/null +++ b/curl/docs/examples/postinmemory.c @@ -0,0 +1,113 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Make an HTTP POST with data from memory and receive response in memory. + * + */ +#include +#include +#include +#include + +struct MemoryStruct { + char *memory; + size_t size; +}; + +static size_t +WriteMemoryCallback(void *contents, size_t size, size_t nmemb, void *userp) +{ + size_t realsize = size * nmemb; + struct MemoryStruct *mem = (struct MemoryStruct *)userp; + + char *ptr = realloc(mem->memory, mem->size + realsize + 1); + if(!ptr) { + /* out of memory! */ + printf("not enough memory (realloc returned NULL)\n"); + return 0; + } + + mem->memory = ptr; + memcpy(&(mem->memory[mem->size]), contents, realsize); + mem->size += realsize; + mem->memory[mem->size] = 0; + + return realsize; +} + +int main(void) +{ + CURL *curl; + CURLcode res; + struct MemoryStruct chunk; + static const char *postthis = "Field=1&Field=2&Field=3"; + + chunk.memory = malloc(1); /* grown as needed by realloc above */ + chunk.size = 0; /* no data at this point */ + + curl_global_init(CURL_GLOBAL_ALL); + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.org/"); + + /* send all data to this function */ + curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, WriteMemoryCallback); + + /* we pass our 'chunk' struct to the callback function */ + curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)&chunk); + + /* some servers do not like requests that are made without a user-agent + field, so we provide one */ + curl_easy_setopt(curl, CURLOPT_USERAGENT, "libcurl-agent/1.0"); + + curl_easy_setopt(curl, CURLOPT_POSTFIELDS, postthis); + + /* if we do not provide POSTFIELDSIZE, libcurl calls strlen() by itself */ + curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(postthis)); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) { + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + } + else { + /* + * Now, our chunk.memory points to a memory block that is chunk.size + * bytes big and contains the remote file. + * + * Do something nice with it! + */ + printf("%s\n",chunk.memory); + } + + /* always cleanup */ + curl_easy_cleanup(curl); + } + + free(chunk.memory); + curl_global_cleanup(); + return 0; +} diff --git a/curl/docs/examples/postit2-formadd.c b/curl/docs/examples/postit2-formadd.c new file mode 100644 index 0000000..0d90346 --- /dev/null +++ b/curl/docs/examples/postit2-formadd.c @@ -0,0 +1,119 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * HTTP Multipart formpost with file upload and two additional parts. + * + */ + +/* + * Example code that uploads a filename 'foo' to a remote script that accepts + * "HTML form based" (as described in RFC 1738) uploads using HTTP POST. + * + * Warning: this example uses the deprecated form api. See "postit2.c" + * for a similar example using the mime api. + * + * The imaginary form we fill in looks like: + * + * + * Enter file: + * Enter filename: + * + * + */ + +#include +#include + +#include + +int main(int argc, char *argv[]) +{ + CURL *curl; + CURLcode res; + + struct curl_httppost *formpost = NULL; + struct curl_httppost *lastptr = NULL; + struct curl_slist *headerlist = NULL; + static const char buf[] = "Expect:"; + + curl_global_init(CURL_GLOBAL_ALL); + + CURL_IGNORE_DEPRECATION( + /* Fill in the file upload field */ + curl_formadd(&formpost, + &lastptr, + CURLFORM_COPYNAME, "sendfile", + CURLFORM_FILE, "postit2-formadd.c", + CURLFORM_END); + + /* Fill in the filename field */ + curl_formadd(&formpost, + &lastptr, + CURLFORM_COPYNAME, "filename", + CURLFORM_COPYCONTENTS, "postit2-formadd.c", + CURLFORM_END); + + + /* Fill in the submit field too, even if this is rarely needed */ + curl_formadd(&formpost, + &lastptr, + CURLFORM_COPYNAME, "submit", + CURLFORM_COPYCONTENTS, "send", + CURLFORM_END); + ) + + curl = curl_easy_init(); + /* initialize custom header list (stating that Expect: 100-continue is not + wanted */ + headerlist = curl_slist_append(headerlist, buf); + if(curl) { + /* what URL that receives this POST */ + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/examplepost.cgi"); + if((argc == 2) && (!strcmp(argv[1], "noexpectheader"))) + /* only disable 100-continue header if explicitly requested */ + curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headerlist); + CURL_IGNORE_DEPRECATION( + curl_easy_setopt(curl, CURLOPT_HTTPPOST, formpost); + ) + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + + CURL_IGNORE_DEPRECATION( + /* then cleanup the formpost chain */ + curl_formfree(formpost); + ) + + /* free slist */ + curl_slist_free_all(headerlist); + } + return 0; +} diff --git a/curl/docs/examples/postit2.c b/curl/docs/examples/postit2.c new file mode 100644 index 0000000..0f12cd4 --- /dev/null +++ b/curl/docs/examples/postit2.c @@ -0,0 +1,104 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * HTTP Multipart formpost with file upload and two additional parts. + * + */ +/* Example code that uploads a filename 'foo' to a remote script that accepts + * "HTML form based" (as described in RFC 1738) uploads using HTTP POST. + * + * The imaginary form we fill in looks like: + * + *
+ * Enter file: + * Enter filename: + * + *
+ * + */ + +#include +#include + +#include + +int main(int argc, char *argv[]) +{ + CURL *curl; + CURLcode res; + + curl_mime *form = NULL; + curl_mimepart *field = NULL; + struct curl_slist *headerlist = NULL; + static const char buf[] = "Expect:"; + + curl_global_init(CURL_GLOBAL_ALL); + + curl = curl_easy_init(); + if(curl) { + /* Create the form */ + form = curl_mime_init(curl); + + /* Fill in the file upload field */ + field = curl_mime_addpart(form); + curl_mime_name(field, "sendfile"); + curl_mime_filedata(field, "postit2.c"); + + /* Fill in the filename field */ + field = curl_mime_addpart(form); + curl_mime_name(field, "filename"); + curl_mime_data(field, "postit2.c", CURL_ZERO_TERMINATED); + + /* Fill in the submit field too, even if this is rarely needed */ + field = curl_mime_addpart(form); + curl_mime_name(field, "submit"); + curl_mime_data(field, "send", CURL_ZERO_TERMINATED); + + /* initialize custom header list (stating that Expect: 100-continue is not + wanted */ + headerlist = curl_slist_append(headerlist, buf); + /* what URL that receives this POST */ + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/examplepost.cgi"); + if((argc == 2) && (!strcmp(argv[1], "noexpectheader"))) + /* only disable 100-continue header if explicitly requested */ + curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headerlist); + curl_easy_setopt(curl, CURLOPT_MIMEPOST, form); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + + /* then cleanup the form */ + curl_mime_free(form); + /* free slist */ + curl_slist_free_all(headerlist); + } + return 0; +} diff --git a/curl/docs/examples/progressfunc.c b/curl/docs/examples/progressfunc.c new file mode 100644 index 0000000..e164f03 --- /dev/null +++ b/curl/docs/examples/progressfunc.c @@ -0,0 +1,97 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Use the progress callbacks, old and/or new one depending on available + * libcurl version. + * + */ +#include +#include + +#define MINIMAL_PROGRESS_FUNCTIONALITY_INTERVAL 3000000 +#define STOP_DOWNLOAD_AFTER_THIS_MANY_BYTES 6000 + +struct myprogress { + curl_off_t lastruntime; /* type depends on version, see above */ + CURL *curl; +}; + +/* this is how the CURLOPT_XFERINFOFUNCTION callback works */ +static int xferinfo(void *p, + curl_off_t dltotal, curl_off_t dlnow, + curl_off_t ultotal, curl_off_t ulnow) +{ + struct myprogress *myp = (struct myprogress *)p; + CURL *curl = myp->curl; + curl_off_t curtime = 0; + + curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME_T, &curtime); + + /* under certain circumstances it may be desirable for certain functionality + to only run every N seconds, in order to do this the transaction time can + be used */ + if((curtime - myp->lastruntime) >= MINIMAL_PROGRESS_FUNCTIONALITY_INTERVAL) { + myp->lastruntime = curtime; + fprintf(stderr, "TOTAL TIME: %lu.%06lu\r\n", + (unsigned long)(curtime / 1000000), + (unsigned long)(curtime % 1000000)); + } + + fprintf(stderr, "UP: %lu of %lu DOWN: %lu of %lu\r\n", + (unsigned long)ulnow, (unsigned long)ultotal, + (unsigned long)dlnow, (unsigned long)dltotal); + + if(dlnow > STOP_DOWNLOAD_AFTER_THIS_MANY_BYTES) + return 1; + return 0; +} + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + struct myprogress prog; + + curl = curl_easy_init(); + if(curl) { + prog.lastruntime = 0; + prog.curl = curl; + + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/"); + + curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, xferinfo); + /* pass the struct pointer into the xferinfo function */ + curl_easy_setopt(curl, CURLOPT_XFERINFODATA, &prog); + + curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L); + res = curl_easy_perform(curl); + + if(res != CURLE_OK) + fprintf(stderr, "%s\n", curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return (int)res; +} diff --git a/curl/docs/examples/protofeats.c b/curl/docs/examples/protofeats.c new file mode 100644 index 0000000..3e76221 --- /dev/null +++ b/curl/docs/examples/protofeats.c @@ -0,0 +1,52 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Outputs all protocols and features supported + * + */ +#include +#include + +#if !CURL_AT_LEAST_VERSION(7,87,0) +#error "too old libcurl" +#endif + +int main(void) +{ + curl_version_info_data *ver; + const char *const *ptr; + + curl_global_init(CURL_GLOBAL_ALL); + + ver = curl_version_info(CURLVERSION_NOW); + printf("Protocols:\n"); + for(ptr = ver->protocols; *ptr; ++ptr) + printf(" %s\n", *ptr); + printf("Features:\n"); + for(ptr = ver->feature_names; *ptr; ++ptr) + printf(" %s\n", *ptr); + + curl_global_cleanup(); + return 0; +} diff --git a/curl/docs/examples/range.c b/curl/docs/examples/range.c new file mode 100644 index 0000000..c8229fc --- /dev/null +++ b/curl/docs/examples/range.c @@ -0,0 +1,45 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * GET a range only of an HTTP resource + * + */ +#include + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/"); + curl_easy_setopt(curl, CURLOPT_RANGE, "200-999"); + + res = curl_easy_perform(curl); + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/resolve.c b/curl/docs/examples/resolve.c new file mode 100644 index 0000000..6514e93 --- /dev/null +++ b/curl/docs/examples/resolve.c @@ -0,0 +1,58 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Use CURLOPT_RESOLVE to feed custom IP addresses for given hostname + port + * number combinations. + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + /* Each single name resolve string should be written using the format + HOST:PORT:ADDRESS where HOST is the name libcurl tries to resolve, PORT + is the port number of the service where libcurl wants to connect to the + HOST and ADDRESS is the numerical IP address + */ + struct curl_slist *host = curl_slist_append(NULL, + "example.com:443:127.0.0.1"); + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_RESOLVE, host); + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com"); + res = curl_easy_perform(curl); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + + curl_slist_free_all(host); + + return (int)res; +} diff --git a/curl/docs/examples/rtsp-options.c b/curl/docs/examples/rtsp-options.c new file mode 100644 index 0000000..d1ddbf0 --- /dev/null +++ b/curl/docs/examples/rtsp-options.c @@ -0,0 +1,55 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Very simple RTSP request sending OPTIONS. + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "rtsp://example.com/"); + + curl_easy_setopt(curl, CURLOPT_RTSP_SESSION_ID, "12345"); + + curl_easy_setopt(curl, CURLOPT_RTSP_REQUEST, CURL_RTSPREQ_OPTIONS); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/sendrecv.c b/curl/docs/examples/sendrecv.c new file mode 100644 index 0000000..8cbb5b0 --- /dev/null +++ b/curl/docs/examples/sendrecv.c @@ -0,0 +1,179 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Demonstrate curl_easy_send() and curl_easy_recv() usage. + * + */ + +#include +#include +#include + +/* Avoid warning in FD_SET() with pre-2020 Cygwin/MSYS releases: + * warning: conversion to 'long unsigned int' from 'curl_socket_t' {aka 'int'} + * may change the sign of the result [-Wsign-conversion] + */ +#ifdef __GNUC__ +#pragma GCC diagnostic ignored "-Wsign-conversion" +#ifdef __DJGPP__ +#pragma GCC diagnostic ignored "-Warith-conversion" +#endif +#elif defined(_MSC_VER) +#pragma warning(disable:4127) /* conditional expression is constant */ +#endif + +/* Auxiliary function that waits on the socket. */ +static int wait_on_socket(curl_socket_t sockfd, int for_recv, long timeout_ms) +{ + struct timeval tv; + fd_set infd, outfd, errfd; + int res; + +#if defined(MSDOS) || defined(__AMIGA__) + tv.tv_sec = (time_t)(timeout_ms / 1000); + tv.tv_usec = (time_t)(timeout_ms % 1000) * 1000; +#else + tv.tv_sec = timeout_ms / 1000; + tv.tv_usec = (int)(timeout_ms % 1000) * 1000; +#endif + + FD_ZERO(&infd); + FD_ZERO(&outfd); + FD_ZERO(&errfd); + + FD_SET(sockfd, &errfd); /* always check for error */ + + if(for_recv) { + FD_SET(sockfd, &infd); + } + else { + FD_SET(sockfd, &outfd); + } + + /* select() returns the number of signalled sockets or -1 */ + res = select((int)sockfd + 1, &infd, &outfd, &errfd, &tv); + return res; +} + +int main(void) +{ + CURL *curl; + /* Minimalistic http request */ + const char *request = "GET / HTTP/1.0\r\nHost: example.com\r\n\r\n"; + size_t request_len = strlen(request); + + /* A general note of caution here: if you are using curl_easy_recv() or + curl_easy_send() to implement HTTP or _any_ other protocol libcurl + supports "natively", you are doing it wrong and you should stop. + + This example uses HTTP only to show how to use this API, it does not + suggest that writing an application doing this is sensible. + */ + + curl = curl_easy_init(); + if(curl) { + CURLcode res; + curl_socket_t sockfd; + size_t nsent_total = 0; + + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com"); + /* Do not do the transfer - only connect to host */ + curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L); + res = curl_easy_perform(curl); + + if(res != CURLE_OK) { + printf("Error: %s\n", curl_easy_strerror(res)); + return 1; + } + + /* Extract the socket from the curl handle - we need it for waiting. */ + res = curl_easy_getinfo(curl, CURLINFO_ACTIVESOCKET, &sockfd); + + if(res != CURLE_OK) { + printf("Error: %s\n", curl_easy_strerror(res)); + return 1; + } + + printf("Sending request.\n"); + + do { + /* Warning: This example program may loop indefinitely. + * A production-quality program must define a timeout and exit this loop + * as soon as the timeout has expired. */ + size_t nsent; + do { + nsent = 0; + res = curl_easy_send(curl, request + nsent_total, + request_len - nsent_total, &nsent); + nsent_total += nsent; + + if(res == CURLE_AGAIN && !wait_on_socket(sockfd, 0, 60000L)) { + printf("Error: timeout.\n"); + return 1; + } + } while(res == CURLE_AGAIN); + + if(res != CURLE_OK) { + printf("Error: %s\n", curl_easy_strerror(res)); + return 1; + } + + printf("Sent %lu bytes.\n", (unsigned long)nsent); + + } while(nsent_total < request_len); + + printf("Reading response.\n"); + + for(;;) { + /* Warning: This example program may loop indefinitely (see above). */ + char buf[1024]; + size_t nread; + do { + nread = 0; + res = curl_easy_recv(curl, buf, sizeof(buf), &nread); + + if(res == CURLE_AGAIN && !wait_on_socket(sockfd, 1, 60000L)) { + printf("Error: timeout.\n"); + return 1; + } + } while(res == CURLE_AGAIN); + + if(res != CURLE_OK) { + printf("Error: %s\n", curl_easy_strerror(res)); + break; + } + + if(nread == 0) { + /* end of the response */ + break; + } + + printf("Received %lu bytes.\n", (unsigned long)nread); + } + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/sepheaders.c b/curl/docs/examples/sepheaders.c new file mode 100644 index 0000000..31a3201 --- /dev/null +++ b/curl/docs/examples/sepheaders.c @@ -0,0 +1,95 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Simple HTTP GET that stores the headers in a separate file + * + */ +#include +#include + +#include + +static size_t write_data(void *ptr, size_t size, size_t nmemb, void *stream) +{ + size_t written = fwrite(ptr, size, nmemb, (FILE *)stream); + return written; +} + +int main(void) +{ + CURL *curl_handle; + static const char *headerfilename = "head.out"; + FILE *headerfile; + static const char *bodyfilename = "body.out"; + FILE *bodyfile; + + curl_global_init(CURL_GLOBAL_ALL); + + /* init the curl session */ + curl_handle = curl_easy_init(); + + /* set URL to get */ + curl_easy_setopt(curl_handle, CURLOPT_URL, "https://example.com"); + + /* no progress meter please */ + curl_easy_setopt(curl_handle, CURLOPT_NOPROGRESS, 1L); + + /* send all data to this function */ + curl_easy_setopt(curl_handle, CURLOPT_WRITEFUNCTION, write_data); + + /* open the header file */ + headerfile = fopen(headerfilename, "wb"); + if(!headerfile) { + curl_easy_cleanup(curl_handle); + return -1; + } + + /* open the body file */ + bodyfile = fopen(bodyfilename, "wb"); + if(!bodyfile) { + curl_easy_cleanup(curl_handle); + fclose(headerfile); + return -1; + } + + /* we want the headers be written to this file handle */ + curl_easy_setopt(curl_handle, CURLOPT_HEADERDATA, headerfile); + + /* we want the body be written to this file handle instead of stdout */ + curl_easy_setopt(curl_handle, CURLOPT_WRITEDATA, bodyfile); + + /* get it! */ + curl_easy_perform(curl_handle); + + /* close the header file */ + fclose(headerfile); + + /* close the body file */ + fclose(bodyfile); + + /* cleanup curl stuff */ + curl_easy_cleanup(curl_handle); + + return 0; +} diff --git a/curl/docs/examples/sftpget.c b/curl/docs/examples/sftpget.c new file mode 100644 index 0000000..6b594a1 --- /dev/null +++ b/curl/docs/examples/sftpget.c @@ -0,0 +1,112 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Gets a file using an SFTP URL. + * + */ + +#include + +#include + +/* define this to switch off the use of ssh-agent in this program */ +#undef DISABLE_SSH_AGENT + +/* + * This is an example showing how to get a single file from an SFTP server. It + * delays the actual destination file creation until the first write callback + * so that it does not create an empty file in case the remote file does not + * exist or something else fails. + */ + +struct FtpFile { + const char *filename; + FILE *stream; +}; + +static size_t my_fwrite(void *buffer, size_t size, size_t nmemb, + void *stream) +{ + struct FtpFile *out = (struct FtpFile *)stream; + if(!out->stream) { + /* open file for writing */ + out->stream = fopen(out->filename, "wb"); + if(!out->stream) + return 0; /* failure, cannot open file to write */ + } + return fwrite(buffer, size, nmemb, out->stream); +} + + +int main(void) +{ + CURL *curl; + CURLcode res; + struct FtpFile ftpfile = { + "yourfile.bin", /* name to store the file as if successful */ + NULL + }; + + curl_global_init(CURL_GLOBAL_DEFAULT); + + curl = curl_easy_init(); + if(curl) { + /* + * You better replace the URL with one that works! + */ + curl_easy_setopt(curl, CURLOPT_URL, + "sftp://user@server/home/user/file.txt"); + /* Define our callback to get called when there is data to be written */ + curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, my_fwrite); + /* Set a pointer to our struct to pass to the callback */ + curl_easy_setopt(curl, CURLOPT_WRITEDATA, &ftpfile); + +#ifndef DISABLE_SSH_AGENT + /* We activate ssh agent. For this to work you need + to have ssh-agent running (type set | grep SSH_AGENT to check) or + pageant on Windows (there is an icon in systray if so) */ + curl_easy_setopt(curl, CURLOPT_SSH_AUTH_TYPES, (long)CURLSSH_AUTH_AGENT); +#endif + + /* Switch on full protocol/debug output */ + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + res = curl_easy_perform(curl); + + /* always cleanup */ + curl_easy_cleanup(curl); + + if(CURLE_OK != res) { + /* we failed */ + fprintf(stderr, "curl told us %d\n", res); + } + } + + if(ftpfile.stream) + fclose(ftpfile.stream); /* close the local file */ + + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/sftpuploadresume.c b/curl/docs/examples/sftpuploadresume.c new file mode 100644 index 0000000..2803da3 --- /dev/null +++ b/curl/docs/examples/sftpuploadresume.c @@ -0,0 +1,139 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Upload to SFTP, resuming a previously aborted transfer. + * + */ + +#include +#include +#include + +/* read data to upload */ +static size_t readfunc(char *ptr, size_t size, size_t nmemb, void *stream) +{ + FILE *f = (FILE *)stream; + size_t n; + + if(ferror(f)) + return CURL_READFUNC_ABORT; + + n = fread(ptr, size, nmemb, f) * size; + + return n; +} + +/* + * sftpGetRemoteFileSize returns the remote file size in byte; -1 on error + */ +static curl_off_t sftpGetRemoteFileSize(const char *i_remoteFile) +{ + CURLcode result = CURLE_GOT_NOTHING; + curl_off_t remoteFileSizeByte = -1; + CURL *curlHandlePtr = curl_easy_init(); + + curl_easy_setopt(curlHandlePtr, CURLOPT_VERBOSE, 1L); + + curl_easy_setopt(curlHandlePtr, CURLOPT_URL, i_remoteFile); + curl_easy_setopt(curlHandlePtr, CURLOPT_NOPROGRESS, 1L); + curl_easy_setopt(curlHandlePtr, CURLOPT_NOBODY, 1L); + curl_easy_setopt(curlHandlePtr, CURLOPT_HEADER, 1L); + curl_easy_setopt(curlHandlePtr, CURLOPT_FILETIME, 1L); + + result = curl_easy_perform(curlHandlePtr); + if(CURLE_OK == result) { + result = curl_easy_getinfo(curlHandlePtr, + CURLINFO_CONTENT_LENGTH_DOWNLOAD_T, + &remoteFileSizeByte); + if(result) + return -1; + printf("filesize: %lu\n", (unsigned long)remoteFileSizeByte); + } + curl_easy_cleanup(curlHandlePtr); + + return remoteFileSizeByte; +} + + +static int sftpResumeUpload(CURL *curlhandle, const char *remotepath, + const char *localpath) +{ + FILE *f = NULL; + CURLcode result = CURLE_GOT_NOTHING; + + curl_off_t remoteFileSizeByte = sftpGetRemoteFileSize(remotepath); + if(-1 == remoteFileSizeByte) { + printf("Error reading the remote file size: unable to resume upload\n"); + return -1; + } + + f = fopen(localpath, "rb"); + if(!f) { +#ifndef UNDER_CE + perror(NULL); +#endif + return 0; + } + + curl_easy_setopt(curlhandle, CURLOPT_UPLOAD, 1L); + curl_easy_setopt(curlhandle, CURLOPT_URL, remotepath); + curl_easy_setopt(curlhandle, CURLOPT_READFUNCTION, readfunc); + curl_easy_setopt(curlhandle, CURLOPT_READDATA, f); + +#if defined(_WIN32) && !defined(UNDER_CE) + _fseeki64(f, remoteFileSizeByte, SEEK_SET); +#else + fseek(f, (long)remoteFileSizeByte, SEEK_SET); +#endif + curl_easy_setopt(curlhandle, CURLOPT_APPEND, 1L); + result = curl_easy_perform(curlhandle); + + fclose(f); + + if(result == CURLE_OK) + return 1; + else { + fprintf(stderr, "%s\n", curl_easy_strerror(result)); + return 0; + } +} + +int main(void) +{ + const char *remote = "sftp://user:pass@example.com/path/filename"; + const char *filename = "filename"; + CURL *curlhandle = NULL; + + curl_global_init(CURL_GLOBAL_ALL); + curlhandle = curl_easy_init(); + + if(!sftpResumeUpload(curlhandle, remote, filename)) { + printf("resumed upload using curl %s failed\n", curl_version()); + } + + curl_easy_cleanup(curlhandle); + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/shared-connection-cache.c b/curl/docs/examples/shared-connection-cache.c new file mode 100644 index 0000000..dc6805a --- /dev/null +++ b/curl/docs/examples/shared-connection-cache.c @@ -0,0 +1,87 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Connection cache shared between easy handles with the share interface + * + */ +#include +#include + +static void my_lock(CURL *handle, curl_lock_data data, + curl_lock_access laccess, void *useptr) +{ + (void)handle; + (void)data; + (void)laccess; + (void)useptr; + fprintf(stderr, "-> Mutex lock\n"); +} + +static void my_unlock(CURL *handle, curl_lock_data data, void *useptr) +{ + (void)handle; + (void)data; + (void)useptr; + fprintf(stderr, "<- Mutex unlock\n"); +} + +int main(void) +{ + CURLSH *share; + int i; + + share = curl_share_init(); + curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT); + + curl_share_setopt(share, CURLSHOPT_LOCKFUNC, my_lock); + curl_share_setopt(share, CURLSHOPT_UNLOCKFUNC, my_unlock); + + /* Loop the transfer and cleanup the handle properly every lap. This still + reuses connections since the pool is in the shared object! */ + + for(i = 0; i < 3; i++) { + CURL *curl = curl_easy_init(); + if(curl) { + CURLcode res; + + curl_easy_setopt(curl, CURLOPT_URL, "https://curl.se/"); + + /* use the share object */ + curl_easy_setopt(curl, CURLOPT_SHARE, share); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + } + + curl_share_cleanup(share); + return 0; +} diff --git a/curl/docs/examples/simple.c b/curl/docs/examples/simple.c new file mode 100644 index 0000000..53c8e47 --- /dev/null +++ b/curl/docs/examples/simple.c @@ -0,0 +1,53 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Very simple HTTP GET + * + */ +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com"); + /* example.com is redirected, so we tell libcurl to follow redirection */ + curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/simplepost.c b/curl/docs/examples/simplepost.c new file mode 100644 index 0000000..7ced982 --- /dev/null +++ b/curl/docs/examples/simplepost.c @@ -0,0 +1,58 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Very simple HTTP POST + * + */ +#include +#include +#include + +int main(void) +{ + CURL *curl; + CURLcode res; + + static const char *postthis = "moo mooo moo moo"; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "https://example.com"); + curl_easy_setopt(curl, CURLOPT_POSTFIELDS, postthis); + + /* if we do not provide POSTFIELDSIZE, libcurl calls strlen() by itself */ + curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(postthis)); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/simplessl.c b/curl/docs/examples/simplessl.c new file mode 100644 index 0000000..f9c0a78 --- /dev/null +++ b/curl/docs/examples/simplessl.c @@ -0,0 +1,154 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Shows HTTPS usage with client certs and optional ssl engine use. + * + */ +#include + +#include + +/* some requirements for this to work: + 1. set pCertFile to the file with the client certificate + 2. if the key is passphrase protected, set pPassphrase to the + passphrase you use + 3. if you are using a crypto engine: + 3.1. set a #define USE_ENGINE + 3.2. set pEngine to the name of the crypto engine you use + 3.3. set pKeyName to the key identifier you want to use + 4. if you do not use a crypto engine: + 4.1. set pKeyName to the filename of your client key + 4.2. if the format of the key file is DER, set pKeyType to "DER" + + !! verify of the server certificate is not implemented here !! + + **** This example only works with libcurl 7.9.3 and later! **** + +*/ + +int main(void) +{ + CURL *curl; + CURLcode res; + FILE *headerfile; + const char *pPassphrase = NULL; + + static const char *pCertFile = "testcert.pem"; + static const char *pCACertFile = "cacert.pem"; + static const char *pHeaderFile = "dumpit"; + + const char *pKeyName; + const char *pKeyType; + + const char *pEngine; + +#ifdef USE_ENGINE + pKeyName = "rsa_test"; + pKeyType = "ENG"; + pEngine = "chil"; /* for nChiper HSM... */ +#else + pKeyName = "testkey.pem"; + pKeyType = "PEM"; + pEngine = NULL; +#endif + + headerfile = fopen(pHeaderFile, "wb"); + if(!headerfile) + return 1; + + curl_global_init(CURL_GLOBAL_DEFAULT); + + curl = curl_easy_init(); + if(curl) { + /* what call to write: */ + curl_easy_setopt(curl, CURLOPT_URL, "HTTPS://secure.site.example"); + curl_easy_setopt(curl, CURLOPT_HEADERDATA, headerfile); + +#ifdef _MSC_VER +#pragma warning(push) +#pragma warning(disable:4127) /* conditional expression is constant */ +#endif + do { /* dummy loop, just to break out from */ + if(pEngine) { + /* use crypto engine */ + if(curl_easy_setopt(curl, CURLOPT_SSLENGINE, pEngine) != CURLE_OK) { + /* load the crypto engine */ + fprintf(stderr, "cannot set crypto engine\n"); + break; + } + if(curl_easy_setopt(curl, CURLOPT_SSLENGINE_DEFAULT, 1L) != CURLE_OK) { + /* set the crypto engine as default */ + /* only needed for the first time you load + an engine in a curl object... */ + fprintf(stderr, "cannot set crypto engine as default\n"); + break; + } + } + /* cert is stored PEM coded in file... */ + /* since PEM is default, we needn't set it for PEM */ + curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM"); + + /* set the cert for client authentication */ + curl_easy_setopt(curl, CURLOPT_SSLCERT, pCertFile); + + /* sorry, for engine we must set the passphrase + (if the key has one...) */ + if(pPassphrase) + curl_easy_setopt(curl, CURLOPT_KEYPASSWD, pPassphrase); + + /* if we use a key stored in a crypto engine, + we must set the key type to "ENG" */ + curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, pKeyType); + + /* set the private key (file or ID in engine) */ + curl_easy_setopt(curl, CURLOPT_SSLKEY, pKeyName); + + /* set the file with the certs validating the server */ + curl_easy_setopt(curl, CURLOPT_CAINFO, pCACertFile); + + /* disconnect if we cannot validate server's cert */ + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* we are done... */ + } while(0); +#ifdef _MSC_VER +#pragma warning(pop) +#endif + /* always cleanup */ + curl_easy_cleanup(curl); + } + + curl_global_cleanup(); + + fclose(headerfile); + + return 0; +} diff --git a/curl/docs/examples/smtp-authzid.c b/curl/docs/examples/smtp-authzid.c new file mode 100644 index 0000000..daaeab1 --- /dev/null +++ b/curl/docs/examples/smtp-authzid.c @@ -0,0 +1,162 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Send email on behalf of another user with SMTP + * + */ + +#include +#include +#include + +/* + * This is a simple example show how to send an email using libcurl's SMTP + * capabilities. + * + * Note that this example requires libcurl 7.66.0 or above. + */ + +/* The libcurl options want plain addresses, the viewable headers in the mail + * can get a full name as well. + */ +#define FROM_ADDR "" +#define SENDER_ADDR "" +#define TO_ADDR "" + +#define FROM_MAIL "Ursel " FROM_ADDR +#define SENDER_MAIL "Kurt " SENDER_ADDR +#define TO_MAIL "A Receiver " TO_ADDR + +static const char *payload_text = + "Date: Mon, 29 Nov 2010 21:54:29 +1100\r\n" + "To: " TO_MAIL "\r\n" + "From: " FROM_MAIL "\r\n" + "Sender: " SENDER_MAIL "\r\n" + "Message-ID: \r\n" + "Subject: SMTP example message\r\n" + "\r\n" /* empty line to divide headers from body, see RFC 5322 */ + "The body of the message starts here.\r\n" + "\r\n" + "It could be a lot of lines, could be MIME encoded, whatever.\r\n" + "Check RFC 5322.\r\n"; + +struct upload_status { + size_t bytes_read; +}; + +static size_t payload_source(char *ptr, size_t size, size_t nmemb, void *userp) +{ + struct upload_status *upload_ctx = (struct upload_status *)userp; + const char *data; + size_t room = size * nmemb; + + if((size == 0) || (nmemb == 0) || ((size*nmemb) < 1)) { + return 0; + } + + data = &payload_text[upload_ctx->bytes_read]; + + if(data) { + size_t len = strlen(data); + if(room < len) + len = room; + memcpy(ptr, data, len); + upload_ctx->bytes_read += len; + + return len; + } + + return 0; +} + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + struct curl_slist *recipients = NULL; + struct upload_status upload_ctx = { 0 }; + + curl = curl_easy_init(); + if(curl) { + /* This is the URL for your mailserver. In this example we connect to the + smtp-submission port as we require an authenticated connection. */ + curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com:587"); + + /* Set the username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "kurt"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "xipj3plmq"); + + /* Set the authorization identity (identity to act as) */ + curl_easy_setopt(curl, CURLOPT_SASL_AUTHZID, "ursel"); + + /* Force PLAIN authentication */ + curl_easy_setopt(curl, CURLOPT_LOGIN_OPTIONS, "AUTH=PLAIN"); + + /* Note that this option is not strictly required, omitting it results in + * libcurl sending the MAIL FROM command with empty sender data. All + * autoresponses should have an empty reverse-path, and should be directed + * to the address in the reverse-path which triggered them. Otherwise, + * they could cause an endless loop. See RFC 5321 Section 4.5.5 for more + * details. + */ + curl_easy_setopt(curl, CURLOPT_MAIL_FROM, FROM_ADDR); + + /* Add a recipient, in this particular case it corresponds to the + * To: addressee in the header. */ + recipients = curl_slist_append(recipients, TO_ADDR); + curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients); + + /* We are using a callback function to specify the payload (the headers and + * body of the message). You could just use the CURLOPT_READDATA option to + * specify a FILE pointer to read from. */ + curl_easy_setopt(curl, CURLOPT_READFUNCTION, payload_source); + curl_easy_setopt(curl, CURLOPT_READDATA, &upload_ctx); + curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L); + + /* Send the message */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Free the list of recipients */ + curl_slist_free_all(recipients); + + /* curl does not send the QUIT command until you call cleanup, so you + * should be able to reuse this connection for additional messages + * (setting CURLOPT_MAIL_FROM and CURLOPT_MAIL_RCPT as required, and + * calling curl_easy_perform() again. It may not be a good idea to keep + * the connection open for a long time though (more than a few minutes may + * result in the server timing out the connection), and you do want to + * clean up in the end. + */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/smtp-expn.c b/curl/docs/examples/smtp-expn.c new file mode 100644 index 0000000..202d1d0 --- /dev/null +++ b/curl/docs/examples/smtp-expn.c @@ -0,0 +1,81 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Expand an SMTP email mailing list + * + */ + +#include +#include +#include + +/* This is a simple example showing how to expand an email mailing list. + * + * Notes: + * + * 1) This example requires libcurl 7.34.0 or above. + * 2) Not all email servers support this command. + */ + +int main(void) +{ + CURL *curl; + CURLcode res; + struct curl_slist *recipients = NULL; + + curl = curl_easy_init(); + if(curl) { + /* This is the URL for your mailserver */ + curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com"); + + /* Note that the CURLOPT_MAIL_RCPT takes a list, not a char array */ + recipients = curl_slist_append(recipients, "Friends"); + curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients); + + /* Set the EXPN command */ + curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "EXPN"); + + /* Perform the custom request */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Free the list of recipients */ + curl_slist_free_all(recipients); + + /* curl does not send the QUIT command until you call cleanup, so you + * should be able to reuse this connection for additional requests. It may + * not be a good idea to keep the connection open for a long time though + * (more than a few minutes may result in the server timing out the + * connection) and you do want to clean up in the end. + */ + curl_easy_cleanup(curl); + } + + return 0; +} diff --git a/curl/docs/examples/smtp-mail.c b/curl/docs/examples/smtp-mail.c new file mode 100644 index 0000000..29918de --- /dev/null +++ b/curl/docs/examples/smtp-mail.c @@ -0,0 +1,150 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Send email with SMTP + * + */ + +#include +#include +#include + +/* + * For an SMTP example using the multi interface please see smtp-multi.c. + */ + +/* The libcurl options want plain addresses, the viewable headers in the mail + * can get a full name as well. + */ +#define FROM_ADDR "" +#define TO_ADDR "" +#define CC_ADDR "" + +#define FROM_MAIL "Sender Person " FROM_ADDR +#define TO_MAIL "A Receiver " TO_ADDR +#define CC_MAIL "John CC Smith " CC_ADDR + +static const char *payload_text = + "Date: Mon, 29 Nov 2010 21:54:29 +1100\r\n" + "To: " TO_MAIL "\r\n" + "From: " FROM_MAIL "\r\n" + "Cc: " CC_MAIL "\r\n" + "Message-ID: \r\n" + "Subject: SMTP example message\r\n" + "\r\n" /* empty line to divide headers from body, see RFC 5322 */ + "The body of the message starts here.\r\n" + "\r\n" + "It could be a lot of lines, could be MIME encoded, whatever.\r\n" + "Check RFC 5322.\r\n"; + +struct upload_status { + size_t bytes_read; +}; + +static size_t payload_source(char *ptr, size_t size, size_t nmemb, void *userp) +{ + struct upload_status *upload_ctx = (struct upload_status *)userp; + const char *data; + size_t room = size * nmemb; + + if((size == 0) || (nmemb == 0) || ((size*nmemb) < 1)) { + return 0; + } + + data = &payload_text[upload_ctx->bytes_read]; + + if(data) { + size_t len = strlen(data); + if(room < len) + len = room; + memcpy(ptr, data, len); + upload_ctx->bytes_read += len; + + return len; + } + + return 0; +} + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + struct curl_slist *recipients = NULL; + struct upload_status upload_ctx = { 0 }; + + curl = curl_easy_init(); + if(curl) { + /* This is the URL for your mailserver */ + curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com"); + + /* Note that this option is not strictly required, omitting it results in + * libcurl sending the MAIL FROM command with empty sender data. All + * autoresponses should have an empty reverse-path, and should be directed + * to the address in the reverse-path which triggered them. Otherwise, + * they could cause an endless loop. See RFC 5321 Section 4.5.5 for more + * details. + */ + curl_easy_setopt(curl, CURLOPT_MAIL_FROM, FROM_ADDR); + + /* Add two recipients, in this particular case they correspond to the + * To: and Cc: addressees in the header, but they could be any kind of + * recipient. */ + recipients = curl_slist_append(recipients, TO_ADDR); + recipients = curl_slist_append(recipients, CC_ADDR); + curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients); + + /* We are using a callback function to specify the payload (the headers and + * body of the message). You could just use the CURLOPT_READDATA option to + * specify a FILE pointer to read from. */ + curl_easy_setopt(curl, CURLOPT_READFUNCTION, payload_source); + curl_easy_setopt(curl, CURLOPT_READDATA, &upload_ctx); + curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L); + + /* Send the message */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Free the list of recipients */ + curl_slist_free_all(recipients); + + /* curl does not send the QUIT command until you call cleanup, so you + * should be able to reuse this connection for additional messages + * (setting CURLOPT_MAIL_FROM and CURLOPT_MAIL_RCPT as required, and + * calling curl_easy_perform() again. It may not be a good idea to keep + * the connection open for a long time though (more than a few minutes may + * result in the server timing out the connection), and you do want to + * clean up in the end. + */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/smtp-mime.c b/curl/docs/examples/smtp-mime.c new file mode 100644 index 0000000..7a2a9c6 --- /dev/null +++ b/curl/docs/examples/smtp-mime.c @@ -0,0 +1,168 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Send SMTP mime emails + * + */ + +#include +#include +#include + +/* This is a simple example showing how to send mime mail using libcurl's SMTP + * capabilities. For an example of using the multi interface please see + * smtp-multi.c. + * + * Note that this example requires libcurl 7.56.0 or above. + */ + +#define FROM "" +#define TO "" +#define CC "" + +static const char *headers_text[] = { + "Date: Tue, 22 Aug 2017 14:08:43 +0100", + "To: " TO, + "From: " FROM " (Example User)", + "Cc: " CC " (Another example User)", + "Message-ID: ", + "Subject: example sending a MIME-formatted message", + NULL +}; + +static const char inline_text[] = + "This is the inline text message of the email.\r\n" + "\r\n" + " It could be a lot of lines that would be displayed in an email\r\n" + "viewer that is not able to handle HTML.\r\n"; + +static const char inline_html[] = + "\r\n" + "

This is the inline HTML message of the email.

" + "
\r\n" + "

It could be a lot of HTML data that would be displayed by " + "email viewers able to handle HTML.

" + "\r\n"; + + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + + curl = curl_easy_init(); + if(curl) { + struct curl_slist *headers = NULL; + struct curl_slist *recipients = NULL; + struct curl_slist *slist = NULL; + curl_mime *mime; + curl_mime *alt; + curl_mimepart *part; + const char **cpp; + + /* This is the URL for your mailserver */ + curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com"); + + /* Note that this option is not strictly required, omitting it results in + * libcurl sending the MAIL FROM command with empty sender data. All + * autoresponses should have an empty reverse-path, and should be directed + * to the address in the reverse-path which triggered them. Otherwise, + * they could cause an endless loop. See RFC 5321 Section 4.5.5 for more + * details. + */ + curl_easy_setopt(curl, CURLOPT_MAIL_FROM, FROM); + + /* Add two recipients, in this particular case they correspond to the + * To: and Cc: addressees in the header, but they could be any kind of + * recipient. */ + recipients = curl_slist_append(recipients, TO); + recipients = curl_slist_append(recipients, CC); + curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients); + + /* allow one of the recipients to fail and still consider it okay */ + curl_easy_setopt(curl, CURLOPT_MAIL_RCPT_ALLOWFAILS, 1L); + + /* Build and set the message header list. */ + for(cpp = headers_text; *cpp; cpp++) + headers = curl_slist_append(headers, *cpp); + curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); + + /* Build the mime message. */ + mime = curl_mime_init(curl); + + /* The inline part is an alternative proposing the html and the text + versions of the email. */ + alt = curl_mime_init(curl); + + /* HTML message. */ + part = curl_mime_addpart(alt); + curl_mime_data(part, inline_html, CURL_ZERO_TERMINATED); + curl_mime_type(part, "text/html"); + + /* Text message. */ + part = curl_mime_addpart(alt); + curl_mime_data(part, inline_text, CURL_ZERO_TERMINATED); + + /* Create the inline part. */ + part = curl_mime_addpart(mime); + curl_mime_subparts(part, alt); + curl_mime_type(part, "multipart/alternative"); + slist = curl_slist_append(NULL, "Content-Disposition: inline"); + curl_mime_headers(part, slist, 1); + + /* Add the current source program as an attachment. */ + part = curl_mime_addpart(mime); + curl_mime_filedata(part, "smtp-mime.c"); + curl_easy_setopt(curl, CURLOPT_MIMEPOST, mime); + + /* Send the message */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Free lists. */ + curl_slist_free_all(recipients); + curl_slist_free_all(headers); + + /* curl does not send the QUIT command until you call cleanup, so you + * should be able to reuse this connection for additional messages + * (setting CURLOPT_MAIL_FROM and CURLOPT_MAIL_RCPT as required, and + * calling curl_easy_perform() again. It may not be a good idea to keep + * the connection open for a long time though (more than a few minutes may + * result in the server timing out the connection), and you do want to + * clean up in the end. + */ + curl_easy_cleanup(curl); + + /* Free multipart message. */ + curl_mime_free(mime); + } + + return (int)res; +} diff --git a/curl/docs/examples/smtp-multi.c b/curl/docs/examples/smtp-multi.c new file mode 100644 index 0000000..8837c57 --- /dev/null +++ b/curl/docs/examples/smtp-multi.c @@ -0,0 +1,153 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Send SMTP email with the multi interface + * + */ + +#include +#include + +/* This is an example showing how to send mail using libcurl's SMTP + * capabilities. It builds on the smtp-mail.c example to demonstrate how to use + * libcurl's multi interface. + */ + +#define FROM_MAIL "" +#define TO_MAIL "" +#define CC_MAIL "" + +static const char *payload_text = + "Date: Mon, 29 Nov 2010 21:54:29 +1100\r\n" + "To: " TO_MAIL "\r\n" + "From: " FROM_MAIL "\r\n" + "Cc: " CC_MAIL "\r\n" + "Message-ID: \r\n" + "Subject: SMTP example message\r\n" + "\r\n" /* empty line to divide headers from body, see RFC 5322 */ + "The body of the message starts here.\r\n" + "\r\n" + "It could be a lot of lines, could be MIME encoded, whatever.\r\n" + "Check RFC 5322.\r\n"; + +struct upload_status { + size_t bytes_read; +}; + +static size_t payload_source(char *ptr, size_t size, size_t nmemb, void *userp) +{ + struct upload_status *upload_ctx = (struct upload_status *)userp; + const char *data; + size_t room = size * nmemb; + + if((size == 0) || (nmemb == 0) || ((size*nmemb) < 1)) { + return 0; + } + + data = &payload_text[upload_ctx->bytes_read]; + + if(data) { + size_t len = strlen(data); + if(room < len) + len = room; + memcpy(ptr, data, len); + upload_ctx->bytes_read += len; + + return len; + } + + return 0; +} + +int main(void) +{ + CURL *curl; + CURLM *mcurl; + int still_running = 1; + struct curl_slist *recipients = NULL; + struct upload_status upload_ctx = { 0 }; + + curl_global_init(CURL_GLOBAL_DEFAULT); + + curl = curl_easy_init(); + if(!curl) + return 1; + + mcurl = curl_multi_init(); + if(!mcurl) + return 2; + + /* This is the URL for your mailserver */ + curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com"); + + /* Note that this option is not strictly required, omitting it results in + * libcurl sending the MAIL FROM command with empty sender data. All + * autoresponses should have an empty reverse-path, and should be directed + * to the address in the reverse-path which triggered them. Otherwise, they + * could cause an endless loop. See RFC 5321 Section 4.5.5 for more details. + */ + curl_easy_setopt(curl, CURLOPT_MAIL_FROM, FROM_MAIL); + + /* Add two recipients, in this particular case they correspond to the + * To: and Cc: addressees in the header, but they could be any kind of + * recipient. */ + recipients = curl_slist_append(recipients, TO_MAIL); + recipients = curl_slist_append(recipients, CC_MAIL); + curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients); + + /* We are using a callback function to specify the payload (the headers and + * body of the message). You could just use the CURLOPT_READDATA option to + * specify a FILE pointer to read from. */ + curl_easy_setopt(curl, CURLOPT_READFUNCTION, payload_source); + curl_easy_setopt(curl, CURLOPT_READDATA, &upload_ctx); + curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L); + + /* Tell the multi stack about our easy handle */ + curl_multi_add_handle(mcurl, curl); + + do { + CURLMcode mc = curl_multi_perform(mcurl, &still_running); + + if(still_running) + /* wait for activity, timeout or "nothing" */ + mc = curl_multi_poll(mcurl, NULL, 0, 1000, NULL); + + if(mc) + break; + + } while(still_running); + + /* Free the list of recipients */ + curl_slist_free_all(recipients); + + /* Always cleanup */ + curl_multi_remove_handle(mcurl, curl); + curl_multi_cleanup(mcurl); + curl_easy_cleanup(curl); + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/smtp-ssl.c b/curl/docs/examples/smtp-ssl.c new file mode 100644 index 0000000..150de9c --- /dev/null +++ b/curl/docs/examples/smtp-ssl.c @@ -0,0 +1,170 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Send SMTP email using implicit SSL + * + */ + +#include +#include +#include + +/* This is a simple example showing how to send mail using libcurl's SMTP + * capabilities. It builds on the smtp-mail.c example to add authentication + * and, more importantly, transport security to protect the authentication + * details from being snooped. + * + * Note that this example requires libcurl 7.20.0 or above. + */ + +#define FROM_MAIL "" +#define TO_MAIL "" +#define CC_MAIL "" + +static const char *payload_text = + "Date: Mon, 29 Nov 2010 21:54:29 +1100\r\n" + "To: " TO_MAIL "\r\n" + "From: " FROM_MAIL "\r\n" + "Cc: " CC_MAIL "\r\n" + "Message-ID: \r\n" + "Subject: SMTP example message\r\n" + "\r\n" /* empty line to divide headers from body, see RFC 5322 */ + "The body of the message starts here.\r\n" + "\r\n" + "It could be a lot of lines, could be MIME encoded, whatever.\r\n" + "Check RFC 5322.\r\n"; + +struct upload_status { + size_t bytes_read; +}; + +static size_t payload_source(char *ptr, size_t size, size_t nmemb, void *userp) +{ + struct upload_status *upload_ctx = (struct upload_status *)userp; + const char *data; + size_t room = size * nmemb; + + if((size == 0) || (nmemb == 0) || ((size*nmemb) < 1)) { + return 0; + } + + data = &payload_text[upload_ctx->bytes_read]; + + if(data) { + size_t len = strlen(data); + if(room < len) + len = room; + memcpy(ptr, data, len); + upload_ctx->bytes_read += len; + + return len; + } + + return 0; +} + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + struct curl_slist *recipients = NULL; + struct upload_status upload_ctx = { 0 }; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This is the URL for your mailserver. Note the use of smtps:// rather + * than smtp:// to request a SSL based connection. */ + curl_easy_setopt(curl, CURLOPT_URL, "smtps://mainserver.example.net"); + + /* If you want to connect to a site who is not using a certificate that is + * signed by one of the certs in the CA bundle you have, you can skip the + * verification of the server's certificate. This makes the connection + * A LOT LESS SECURE. + * + * If you have a CA cert for the server stored someplace else than in the + * default bundle, then the CURLOPT_CAPATH option might come handy for + * you. */ +#ifdef SKIP_PEER_VERIFICATION + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); +#endif + + /* If the site you are connecting to uses a different host name that what + * they have mentioned in their server certificate's commonName (or + * subjectAltName) fields, libcurl refuses to connect. You can skip this + * check, but it makes the connection insecure. */ +#ifdef SKIP_HOSTNAME_VERIFICATION + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); +#endif + + /* Note that this option is not strictly required, omitting it results in + * libcurl sending the MAIL FROM command with empty sender data. All + * autoresponses should have an empty reverse-path, and should be directed + * to the address in the reverse-path which triggered them. Otherwise, + * they could cause an endless loop. See RFC 5321 Section 4.5.5 for more + * details. + */ + curl_easy_setopt(curl, CURLOPT_MAIL_FROM, FROM_MAIL); + + /* Add two recipients, in this particular case they correspond to the + * To: and Cc: addressees in the header, but they could be any kind of + * recipient. */ + recipients = curl_slist_append(recipients, TO_MAIL); + recipients = curl_slist_append(recipients, CC_MAIL); + curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients); + + /* We are using a callback function to specify the payload (the headers and + * body of the message). You could just use the CURLOPT_READDATA option to + * specify a FILE pointer to read from. */ + curl_easy_setopt(curl, CURLOPT_READFUNCTION, payload_source); + curl_easy_setopt(curl, CURLOPT_READDATA, &upload_ctx); + curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L); + + /* Since the traffic is encrypted, it is useful to turn on debug + * information within libcurl to see what is happening during the + * transfer */ + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + /* Send the message */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Free the list of recipients */ + curl_slist_free_all(recipients); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/smtp-tls.c b/curl/docs/examples/smtp-tls.c new file mode 100644 index 0000000..fd4e385 --- /dev/null +++ b/curl/docs/examples/smtp-tls.c @@ -0,0 +1,173 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Send SMTP email using implicit TLS + * + */ + +#include +#include +#include + +/* This is a simple example showing how to send mail using libcurl's SMTP + * capabilities. It builds on the smtp-mail.c example to add authentication + * and, more importantly, transport security to protect the authentication + * details from being snooped. + * + * Note that this example requires libcurl 7.20.0 or above. + */ + +#define FROM_MAIL "" +#define TO_MAIL "" +#define CC_MAIL "" + +static const char *payload_text = + "Date: Mon, 29 Nov 2010 21:54:29 +1100\r\n" + "To: " TO_MAIL "\r\n" + "From: " FROM_MAIL "\r\n" + "Cc: " CC_MAIL "\r\n" + "Message-ID: \r\n" + "Subject: SMTP example message\r\n" + "\r\n" /* empty line to divide headers from body, see RFC 5322 */ + "The body of the message starts here.\r\n" + "\r\n" + "It could be a lot of lines, could be MIME encoded, whatever.\r\n" + "Check RFC 5322.\r\n"; + +struct upload_status { + size_t bytes_read; +}; + +static size_t payload_source(char *ptr, size_t size, size_t nmemb, void *userp) +{ + struct upload_status *upload_ctx = (struct upload_status *)userp; + const char *data; + size_t room = size * nmemb; + + if((size == 0) || (nmemb == 0) || ((size*nmemb) < 1)) { + return 0; + } + + data = &payload_text[upload_ctx->bytes_read]; + + if(data) { + size_t len = strlen(data); + if(room < len) + len = room; + memcpy(ptr, data, len); + upload_ctx->bytes_read += len; + + return len; + } + + return 0; +} + +int main(void) +{ + CURL *curl; + CURLcode res = CURLE_OK; + struct curl_slist *recipients = NULL; + struct upload_status upload_ctx = { 0 }; + + curl = curl_easy_init(); + if(curl) { + /* Set username and password */ + curl_easy_setopt(curl, CURLOPT_USERNAME, "user"); + curl_easy_setopt(curl, CURLOPT_PASSWORD, "secret"); + + /* This is the URL for your mailserver. Note the use of port 587 here, + * instead of the normal SMTP port (25). Port 587 is commonly used for + * secure mail submission (see RFC 4403), but you should use whatever + * matches your server configuration. */ + curl_easy_setopt(curl, CURLOPT_URL, "smtp://mainserver.example.net:587"); + + /* In this example, we start with a plain text connection, and upgrade to + * Transport Layer Security (TLS) using the STARTTLS command. Be careful + * of using CURLUSESSL_TRY here, because if TLS upgrade fails, the + * transfer continues anyway - see the security discussion in the libcurl + * tutorial for more details. */ + curl_easy_setopt(curl, CURLOPT_USE_SSL, (long)CURLUSESSL_ALL); + + /* If your server does not have a valid certificate, then you can disable + * part of the Transport Layer Security protection by setting the + * CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST options to 0 (false). + * curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); + * curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); + * That is, in general, a bad idea. It is still better than sending your + * authentication details in plain text though. Instead, you should get + * the issuer certificate (or the host certificate if the certificate is + * self-signed) and add it to the set of certificates that are known to + * libcurl using CURLOPT_CAINFO and/or CURLOPT_CAPATH. See docs/SSLCERTS + * for more information. */ + curl_easy_setopt(curl, CURLOPT_CAINFO, "/path/to/certificate.pem"); + + /* Note that this option is not strictly required, omitting it results in + * libcurl sending the MAIL FROM command with empty sender data. All + * autoresponses should have an empty reverse-path, and should be directed + * to the address in the reverse-path which triggered them. Otherwise, + * they could cause an endless loop. See RFC 5321 Section 4.5.5 for more + * details. + */ + curl_easy_setopt(curl, CURLOPT_MAIL_FROM, FROM_MAIL); + + /* Add two recipients, in this particular case they correspond to the + * To: and Cc: addressees in the header, but they could be any kind of + * recipient. */ + recipients = curl_slist_append(recipients, TO_MAIL); + recipients = curl_slist_append(recipients, CC_MAIL); + curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients); + + /* We are using a callback function to specify the payload (the headers and + * body of the message). You could just use the CURLOPT_READDATA option to + * specify a FILE pointer to read from. */ + curl_easy_setopt(curl, CURLOPT_READFUNCTION, payload_source); + curl_easy_setopt(curl, CURLOPT_READDATA, &upload_ctx); + curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L); + + /* Since the traffic is encrypted, it is useful to turn on debug + * information within libcurl to see what is happening during the + * transfer. + */ + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + /* Send the message */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Free the list of recipients */ + curl_slist_free_all(recipients); + + /* Always cleanup */ + curl_easy_cleanup(curl); + } + + return (int)res; +} diff --git a/curl/docs/examples/smtp-vrfy.c b/curl/docs/examples/smtp-vrfy.c new file mode 100644 index 0000000..0135efe --- /dev/null +++ b/curl/docs/examples/smtp-vrfy.c @@ -0,0 +1,81 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Verify an SMTP email address + * + */ + +#include +#include +#include + +/* This is a simple example showing how to verify an email address from an + * SMTP server. + * + * Notes: + * + * 1) This example requires libcurl 7.34.0 or above. + * 2) Not all email servers support this command and even if your email server + * does support it, it may respond with a 252 response code even though the + * address does not exist. + */ + +int main(void) +{ + CURL *curl; + CURLcode res; + struct curl_slist *recipients = NULL; + + curl = curl_easy_init(); + if(curl) { + /* This is the URL for your mailserver */ + curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com"); + + /* Note that the CURLOPT_MAIL_RCPT takes a list, not a char array */ + recipients = curl_slist_append(recipients, ""); + curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients); + + /* Perform the VRFY */ + res = curl_easy_perform(curl); + + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* Free the list of recipients */ + curl_slist_free_all(recipients); + + /* curl does not send the QUIT command until you call cleanup, so you + * should be able to reuse this connection for additional requests. It may + * not be a good idea to keep the connection open for a long time though + * (more than a few minutes may result in the server timing out the + * connection) and you do want to clean up in the end. + */ + curl_easy_cleanup(curl); + } + + return 0; +} diff --git a/curl/docs/examples/sslbackend.c b/curl/docs/examples/sslbackend.c new file mode 100644 index 0000000..fd2b575 --- /dev/null +++ b/curl/docs/examples/sslbackend.c @@ -0,0 +1,79 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Shows HTTPS usage with client certs and optional ssl engine use. + * + */ +#include +#include +#include +#include +#include + +#include + +/* + * An SSL-enabled libcurl is required for this sample to work (at least one + * SSL backend has to be configured). + * + * **** This example only works with libcurl 7.56.0 and later! **** +*/ + +int main(int argc, char **argv) +{ + const char *name = argc > 1 ? argv[1] : "openssl"; + CURLsslset result; + + if(!strcmp("list", name)) { + const curl_ssl_backend **list; + int i; + + result = curl_global_sslset(CURLSSLBACKEND_NONE, NULL, &list); + assert(result == CURLSSLSET_UNKNOWN_BACKEND); + + for(i = 0; list[i]; i++) + printf("SSL backend #%d: '%s' (ID: %d)\n", + i, list[i]->name, list[i]->id); + + return 0; + } + else if(isdigit((int)(unsigned char)*name)) { + int id = atoi(name); + + result = curl_global_sslset((curl_sslbackend)id, NULL, NULL); + } + else + result = curl_global_sslset(CURLSSLBACKEND_NONE, name, NULL); + + if(result == CURLSSLSET_UNKNOWN_BACKEND) { + fprintf(stderr, "Unknown SSL backend id: %s\n", name); + return 1; + } + + assert(result == CURLSSLSET_OK); + + printf("Version with SSL backend '%s':\n\n\t%s\n", name, curl_version()); + + return 0; +} diff --git a/curl/docs/examples/unixsocket.c b/curl/docs/examples/unixsocket.c new file mode 100644 index 0000000..299a121 --- /dev/null +++ b/curl/docs/examples/unixsocket.c @@ -0,0 +1,67 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Access HTTP server over Unix domain socket + * + */ +#include +#include + +#ifdef USE_ABSTRACT +/* + * The abstract socket namespace is a nonportable Linux extension. The name + * has no connection with filesystem pathnames. + */ +#define ABSTRACT "http-unix-domain" +#else +#define PATH "/tmp/http-unix-domain" +#endif + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "http://example.com"); + +#ifdef USE_ABSTRACT + curl_easy_setopt(curl, CURLOPT_ABSTRACT_UNIX_SOCKET, ABSTRACT); +#else + curl_easy_setopt(curl, CURLOPT_UNIX_SOCKET_PATH, PATH); +#endif + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/url2file.c b/curl/docs/examples/url2file.c new file mode 100644 index 0000000..9ed7da5 --- /dev/null +++ b/curl/docs/examples/url2file.c @@ -0,0 +1,87 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Download a given URL into a local file named page.out. + * + */ +#include +#include + +#include + +static size_t write_data(void *ptr, size_t size, size_t nmemb, void *stream) +{ + size_t written = fwrite(ptr, size, nmemb, (FILE *)stream); + return written; +} + +int main(int argc, char *argv[]) +{ + CURL *curl_handle; + static const char *pagefilename = "page.out"; + FILE *pagefile; + + if(argc < 2) { + printf("Usage: %s \n", argv[0]); + return 1; + } + + curl_global_init(CURL_GLOBAL_ALL); + + /* init the curl session */ + curl_handle = curl_easy_init(); + + /* set URL to get here */ + curl_easy_setopt(curl_handle, CURLOPT_URL, argv[1]); + + /* Switch on full protocol/debug output while testing */ + curl_easy_setopt(curl_handle, CURLOPT_VERBOSE, 1L); + + /* disable progress meter, set to 0L to enable it */ + curl_easy_setopt(curl_handle, CURLOPT_NOPROGRESS, 1L); + + /* send all data to this function */ + curl_easy_setopt(curl_handle, CURLOPT_WRITEFUNCTION, write_data); + + /* open the file */ + pagefile = fopen(pagefilename, "wb"); + if(pagefile) { + + /* write the page body to this file handle */ + curl_easy_setopt(curl_handle, CURLOPT_WRITEDATA, pagefile); + + /* get it! */ + curl_easy_perform(curl_handle); + + /* close the header file */ + fclose(pagefile); + } + + /* cleanup curl stuff */ + curl_easy_cleanup(curl_handle); + + curl_global_cleanup(); + + return 0; +} diff --git a/curl/docs/examples/urlapi.c b/curl/docs/examples/urlapi.c new file mode 100644 index 0000000..2ed78eb --- /dev/null +++ b/curl/docs/examples/urlapi.c @@ -0,0 +1,77 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * Set working URL with CURLU *. + * + */ +#include +#include + +#if !CURL_AT_LEAST_VERSION(7, 80, 0) +#error "this example requires curl 7.80.0 or later" +#endif + +int main(void) +{ + CURL *curl; + CURLcode res; + + CURLU *urlp; + CURLUcode uc; + + /* get a curl handle */ + curl = curl_easy_init(); + + /* init Curl URL */ + urlp = curl_url(); + uc = curl_url_set(urlp, CURLUPART_URL, + "http://example.com/path/index.html", 0); + + if(uc) { + fprintf(stderr, "curl_url_set() failed: %s", curl_url_strerror(uc)); + goto cleanup; + } + + if(curl) { + /* set urlp to use as working URL */ + curl_easy_setopt(curl, CURLOPT_CURLU, urlp); + curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); + + /* only allow HTTP, TFTP and SFTP */ + curl_easy_setopt(curl, CURLOPT_PROTOCOLS_STR, "http,tftp,sftp"); + + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + goto cleanup; + } + +cleanup: + curl_url_cleanup(urlp); + curl_easy_cleanup(curl); + return 0; +} diff --git a/curl/docs/examples/websocket-cb.c b/curl/docs/examples/websocket-cb.c new file mode 100644 index 0000000..09d6c64 --- /dev/null +++ b/curl/docs/examples/websocket-cb.c @@ -0,0 +1,68 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * WebSocket download-only using write callback + * + */ +#include +#include + +static size_t writecb(char *b, size_t size, size_t nitems, void *p) +{ + CURL *easy = p; + size_t i; + const struct curl_ws_frame *frame = curl_ws_meta(easy); + fprintf(stderr, "Type: %s\n", frame->flags & CURLWS_BINARY ? + "binary" : "text"); + fprintf(stderr, "Bytes: %u", (unsigned int)(nitems * size)); + for(i = 0; i < nitems; i++) + fprintf(stderr, "%02x ", (unsigned char)b[i]); + return nitems; +} + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "wss://example.com"); + + curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writecb); + /* pass the easy handle to the callback */ + curl_easy_setopt(curl, CURLOPT_WRITEDATA, curl); + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/examples/websocket.c b/curl/docs/examples/websocket.c new file mode 100644 index 0000000..758ee48 --- /dev/null +++ b/curl/docs/examples/websocket.c @@ -0,0 +1,135 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + * WebSocket using CONNECT_ONLY + * + */ +#include +#include +#ifdef _WIN32 +#include +#include +#define sleep(s) Sleep((DWORD)(s)) +#else +#include +#endif + +#include + +static int ping(CURL *curl, const char *send_payload) +{ + size_t sent; + CURLcode result = + curl_ws_send(curl, send_payload, strlen(send_payload), &sent, 0, + CURLWS_PING); + return (int)result; +} + +static int recv_pong(CURL *curl, const char *expected_payload) +{ + size_t rlen; + const struct curl_ws_frame *meta; + char buffer[256]; + CURLcode result = curl_ws_recv(curl, buffer, sizeof(buffer), &rlen, &meta); + if(!result) { + if(meta->flags & CURLWS_PONG) { + int same = 0; + fprintf(stderr, "ws: got PONG back\n"); + if(rlen == strlen(expected_payload)) { + if(!memcmp(expected_payload, buffer, rlen)) { + fprintf(stderr, "ws: got the same payload back\n"); + same = 1; + } + } + if(!same) + fprintf(stderr, "ws: did NOT get the same payload back\n"); + } + else { + fprintf(stderr, "recv_pong: got %u bytes rflags %x\n", (int)rlen, + meta->flags); + } + } + fprintf(stderr, "ws: curl_ws_recv returned %u, received %u\n", + (unsigned int)result, (unsigned int)rlen); + return (int)result; +} + +static CURLcode recv_any(CURL *curl) +{ + size_t rlen; + const struct curl_ws_frame *meta; + char buffer[256]; + + return curl_ws_recv(curl, buffer, sizeof(buffer), &rlen, &meta); +} + +/* close the connection */ +static void websocket_close(CURL *curl) +{ + size_t sent; + (void)curl_ws_send(curl, "", 0, &sent, 0, CURLWS_CLOSE); +} + +static void websocket(CURL *curl) +{ + int i = 0; + do { + recv_any(curl); + if(ping(curl, "foobar")) + return; + if(recv_pong(curl, "foobar")) { + return; + } + sleep(2); + } while(i++ < 10); + websocket_close(curl); +} + +int main(void) +{ + CURL *curl; + CURLcode res; + + curl = curl_easy_init(); + if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "wss://example.com"); + + curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 2L); /* websocket style */ + + /* Perform the request, res gets the return code */ + res = curl_easy_perform(curl); + /* Check for errors */ + if(res != CURLE_OK) + fprintf(stderr, "curl_easy_perform() failed: %s\n", + curl_easy_strerror(res)); + else { + /* connected and ready */ + websocket(curl); + } + + /* always cleanup */ + curl_easy_cleanup(curl); + } + return 0; +} diff --git a/curl/docs/libcurl/symbols-in-versions.txt b/curl/docs/libcurl/symbols-in-versions.txt new file mode 100644 index 0000000..e757219 --- /dev/null +++ b/curl/docs/libcurl/symbols-in-versions.txt @@ -0,0 +1,1171 @@ + _ _ ____ _ + ___| | | | _ \| | + / __| | | | |_) | | + | (__| |_| | _ <| |___ + \___|\___/|_| \_\_____| + + This document lists defines and other symbols present in libcurl, together + with exact information about the first libcurl version that provides the + symbol, the first version in which the symbol was marked as deprecated and + for a few symbols the last version that featured it. The names appear in + alphabetical order. + + Name Introduced Deprecated Last + +CURL_AT_LEAST_VERSION 7.43.0 +CURL_BLOB_COPY 7.71.0 +CURL_BLOB_NOCOPY 7.71.0 +CURL_CHUNK_BGN_FUNC_FAIL 7.21.0 +CURL_CHUNK_BGN_FUNC_OK 7.21.0 +CURL_CHUNK_BGN_FUNC_SKIP 7.21.0 +CURL_CHUNK_END_FUNC_FAIL 7.21.0 +CURL_CHUNK_END_FUNC_OK 7.21.0 +CURL_CSELECT_ERR 7.16.3 +CURL_CSELECT_IN 7.16.3 +CURL_CSELECT_OUT 7.16.3 +CURL_DEPRECATED 7.87.0 +CURL_DID_MEMORY_FUNC_TYPEDEFS 7.49.0 +CURL_EASY_NONE 7.14.0 - 7.15.4 +CURL_EASY_TIMEOUT 7.14.0 - 7.15.4 +CURL_ERROR_SIZE 7.1 +CURL_FNMATCHFUNC_FAIL 7.21.0 +CURL_FNMATCHFUNC_MATCH 7.21.0 +CURL_FNMATCHFUNC_NOMATCH 7.21.0 +CURL_FORMADD_DISABLED 7.12.1 7.56.0 +CURL_FORMADD_ILLEGAL_ARRAY 7.9.8 7.56.0 +CURL_FORMADD_INCOMPLETE 7.9.8 7.56.0 +CURL_FORMADD_MEMORY 7.9.8 7.56.0 +CURL_FORMADD_NULL 7.9.8 7.56.0 +CURL_FORMADD_OK 7.9.8 7.56.0 +CURL_FORMADD_OPTION_TWICE 7.9.8 7.56.0 +CURL_FORMADD_UNKNOWN_OPTION 7.9.8 7.56.0 +CURL_GLOBAL_ACK_EINTR 7.30.0 +CURL_GLOBAL_ALL 7.8 +CURL_GLOBAL_DEFAULT 7.8 +CURL_GLOBAL_NOTHING 7.8 +CURL_GLOBAL_SSL 7.8 +CURL_GLOBAL_WIN32 7.8.1 +CURL_HAS_DECLSPEC_ATTRIBUTE 8.13.0 +CURL_HET_DEFAULT 7.59.0 +CURL_HTTP_VERSION_1_0 7.9.1 +CURL_HTTP_VERSION_1_1 7.9.1 +CURL_HTTP_VERSION_2 7.43.0 +CURL_HTTP_VERSION_2_0 7.33.0 +CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE 7.49.0 +CURL_HTTP_VERSION_2TLS 7.47.0 +CURL_HTTP_VERSION_3 7.66.0 +CURL_HTTP_VERSION_3ONLY 7.88.0 +CURL_HTTP_VERSION_NONE 7.9.1 +CURL_HTTPPOST_BUFFER 7.46.0 +CURL_HTTPPOST_CALLBACK 7.46.0 +CURL_HTTPPOST_FILENAME 7.46.0 +CURL_HTTPPOST_LARGE 7.46.0 +CURL_HTTPPOST_PTRBUFFER 7.46.0 +CURL_HTTPPOST_PTRCONTENTS 7.46.0 +CURL_HTTPPOST_PTRNAME 7.46.0 +CURL_HTTPPOST_READFILE 7.46.0 +CURL_IGNORE_DEPRECATION 7.87.0 +CURL_IPRESOLVE_V4 7.10.8 +CURL_IPRESOLVE_V6 7.10.8 +CURL_IPRESOLVE_WHATEVER 7.10.8 +CURL_ISOCPP 7.10.2 +CURL_LOCK_ACCESS_NONE 7.10.3 +CURL_LOCK_ACCESS_SHARED 7.10.3 +CURL_LOCK_ACCESS_SINGLE 7.10.3 +CURL_LOCK_DATA_CONNECT 7.10.3 +CURL_LOCK_DATA_COOKIE 7.10.3 +CURL_LOCK_DATA_DNS 7.10.3 +CURL_LOCK_DATA_HSTS 7.88.0 +CURL_LOCK_DATA_NONE 7.10.3 +CURL_LOCK_DATA_PSL 7.61.0 +CURL_LOCK_DATA_SHARE 7.10.4 +CURL_LOCK_DATA_SSL_SESSION 7.10.3 +CURL_LOCK_TYPE_CONNECT 7.10 - 7.10.2 +CURL_LOCK_TYPE_COOKIE 7.10 - 7.10.2 +CURL_LOCK_TYPE_DNS 7.10 - 7.10.2 +CURL_LOCK_TYPE_NONE 7.10 - 7.10.2 +CURL_LOCK_TYPE_SSL_SESSION 7.10 - 7.10.2 +CURL_MAX_HTTP_HEADER 7.19.7 +CURL_MAX_READ_SIZE 7.53.0 +CURL_MAX_WRITE_SIZE 7.9.7 +CURL_NETRC_IGNORED 7.9.8 +CURL_NETRC_OPTIONAL 7.9.8 +CURL_NETRC_REQUIRED 7.9.8 +CURL_POLL_IN 7.14.0 +CURL_POLL_INOUT 7.14.0 +CURL_POLL_NONE 7.14.0 +CURL_POLL_OUT 7.14.0 +CURL_POLL_REMOVE 7.14.0 +CURL_PREREQFUNC_ABORT 7.79.0 +CURL_PREREQFUNC_OK 7.79.0 +CURL_PROGRESS_BAR 7.1.1 - 7.4.1 +CURL_PROGRESS_STATS 7.1.1 - 7.4.1 +CURL_PROGRESSFUNC_CONTINUE 7.68.0 +CURL_PULL_SYS_POLL_H 7.56.0 +CURL_PUSH_DENY 7.44.0 +CURL_PUSH_ERROROUT 7.72.0 +CURL_PUSH_OK 7.44.0 +CURL_READFUNC_ABORT 7.12.1 +CURL_READFUNC_PAUSE 7.18.0 +CURL_REDIR_GET_ALL 7.19.1 +CURL_REDIR_POST_301 7.19.1 +CURL_REDIR_POST_302 7.19.1 +CURL_REDIR_POST_303 7.26.0 +CURL_REDIR_POST_ALL 7.19.1 +CURL_RTSPREQ_ANNOUNCE 7.20.0 +CURL_RTSPREQ_DESCRIBE 7.20.0 +CURL_RTSPREQ_GET_PARAMETER 7.20.0 +CURL_RTSPREQ_NONE 7.20.0 +CURL_RTSPREQ_OPTIONS 7.20.0 +CURL_RTSPREQ_PAUSE 7.20.0 +CURL_RTSPREQ_PLAY 7.20.0 +CURL_RTSPREQ_RECEIVE 7.20.0 +CURL_RTSPREQ_RECORD 7.20.0 +CURL_RTSPREQ_SET_PARAMETER 7.20.0 +CURL_RTSPREQ_SETUP 7.20.0 +CURL_RTSPREQ_TEARDOWN 7.20.0 +CURL_SEEKFUNC_CANTSEEK 7.19.5 +CURL_SEEKFUNC_FAIL 7.19.5 +CURL_SEEKFUNC_OK 7.19.5 +CURL_SOCKET_BAD 7.14.0 +CURL_SOCKET_TIMEOUT 7.14.0 +CURL_SOCKOPT_ALREADY_CONNECTED 7.21.5 +CURL_SOCKOPT_ERROR 7.21.5 +CURL_SOCKOPT_OK 7.21.5 +CURL_SSLVERSION_DEFAULT 7.9.2 +CURL_SSLVERSION_MAX_DEFAULT 7.54.0 +CURL_SSLVERSION_MAX_NONE 7.54.0 +CURL_SSLVERSION_MAX_TLSv1_0 7.54.0 +CURL_SSLVERSION_MAX_TLSv1_1 7.54.0 +CURL_SSLVERSION_MAX_TLSv1_2 7.54.0 +CURL_SSLVERSION_MAX_TLSv1_3 7.54.0 +CURL_SSLVERSION_SSLv2 7.9.2 +CURL_SSLVERSION_SSLv3 7.9.2 +CURL_SSLVERSION_TLSv1 7.9.2 +CURL_SSLVERSION_TLSv1_0 7.34.0 +CURL_SSLVERSION_TLSv1_1 7.34.0 +CURL_SSLVERSION_TLSv1_2 7.34.0 +CURL_SSLVERSION_TLSv1_3 7.52.0 +CURL_STRICTER 7.50.2 +CURL_TIMECOND_IFMODSINCE 7.9.7 +CURL_TIMECOND_IFUNMODSINCE 7.9.7 +CURL_TIMECOND_LASTMOD 7.9.7 +CURL_TIMECOND_NONE 7.9.7 +CURL_TLSAUTH_NONE 7.21.4 +CURL_TLSAUTH_SRP 7.21.4 +CURL_TRAILERFUNC_ABORT 7.64.0 +CURL_TRAILERFUNC_OK 7.64.0 +CURL_UPKEEP_INTERVAL_DEFAULT 7.62.0 +CURL_VERSION_ALTSVC 7.64.1 +CURL_VERSION_ASYNCHDNS 7.10.7 +CURL_VERSION_BITS 7.43.0 +CURL_VERSION_BROTLI 7.57.0 +CURL_VERSION_CONV 7.15.4 +CURL_VERSION_CURLDEBUG 7.19.6 +CURL_VERSION_DEBUG 7.10.6 +CURL_VERSION_GSASL 7.76.0 +CURL_VERSION_GSSAPI 7.38.0 +CURL_VERSION_GSSNEGOTIATE 7.10.6 7.38.0 +CURL_VERSION_HSTS 7.74.0 +CURL_VERSION_HTTP2 7.33.0 +CURL_VERSION_HTTP3 7.66.0 +CURL_VERSION_HTTPS_PROXY 7.52.0 +CURL_VERSION_IDN 7.12.0 +CURL_VERSION_IPV6 7.10 +CURL_VERSION_KERBEROS4 7.10 7.33.0 +CURL_VERSION_KERBEROS5 7.40.0 +CURL_VERSION_LARGEFILE 7.11.1 +CURL_VERSION_LIBZ 7.10 +CURL_VERSION_MULTI_SSL 7.56.0 +CURL_VERSION_NTLM 7.10.6 +CURL_VERSION_NTLM_WB 7.22.0 8.8.0 +CURL_VERSION_PSL 7.47.0 +CURL_VERSION_SPNEGO 7.10.8 +CURL_VERSION_SSL 7.10 +CURL_VERSION_SSPI 7.13.2 +CURL_VERSION_THREADSAFE 7.84.0 +CURL_VERSION_TLSAUTH_SRP 7.21.4 +CURL_VERSION_UNICODE 7.72.0 +CURL_VERSION_UNIX_SOCKETS 7.40.0 +CURL_VERSION_ZSTD 7.72.0 +CURL_WAIT_POLLIN 7.28.0 +CURL_WAIT_POLLOUT 7.28.0 +CURL_WAIT_POLLPRI 7.28.0 +CURL_WIN32 7.69.0 - 8.5.0 +CURL_WRITEFUNC_ERROR 7.87.0 +CURL_WRITEFUNC_PAUSE 7.18.0 +CURL_ZERO_TERMINATED 7.56.0 +CURLALTSVC_H1 7.64.1 +CURLALTSVC_H2 7.64.1 +CURLALTSVC_H3 7.64.1 +CURLALTSVC_READONLYFILE 7.64.1 +CURLAUTH_ANY 7.10.6 +CURLAUTH_ANYSAFE 7.10.6 +CURLAUTH_AWS_SIGV4 7.75.0 +CURLAUTH_BASIC 7.10.6 +CURLAUTH_BEARER 7.61.0 +CURLAUTH_DIGEST 7.10.6 +CURLAUTH_DIGEST_IE 7.19.3 +CURLAUTH_GSSAPI 7.55.0 +CURLAUTH_GSSNEGOTIATE 7.10.6 7.38.0 +CURLAUTH_NEGOTIATE 7.38.0 +CURLAUTH_NONE 7.10.6 +CURLAUTH_NTLM 7.10.6 +CURLAUTH_NTLM_WB 7.22.0 8.8.0 +CURLAUTH_ONLY 7.21.3 +CURLCLOSEPOLICY_CALLBACK 7.7 7.16.1 +CURLCLOSEPOLICY_LEAST_RECENTLY_USED 7.7 7.16.1 +CURLCLOSEPOLICY_LEAST_TRAFFIC 7.7 7.16.1 +CURLCLOSEPOLICY_NONE 7.7 7.16.1 +CURLCLOSEPOLICY_OLDEST 7.7 7.16.1 +CURLCLOSEPOLICY_SLOWEST 7.7 7.16.1 +CURLE_ABORTED_BY_CALLBACK 7.1 +CURLE_AGAIN 7.18.2 +CURLE_ALREADY_COMPLETE 7.7.2 7.8 +CURLE_AUTH_ERROR 7.66.0 +CURLE_BAD_CALLING_ORDER 7.1 7.17.0 +CURLE_BAD_CONTENT_ENCODING 7.10 +CURLE_BAD_DOWNLOAD_RESUME 7.10 +CURLE_BAD_FUNCTION_ARGUMENT 7.1 +CURLE_BAD_PASSWORD_ENTERED 7.4.2 7.17.0 +CURLE_CHUNK_FAILED 7.21.0 +CURLE_CONV_FAILED 7.15.4 7.82.0 +CURLE_CONV_REQD 7.15.4 7.82.0 +CURLE_COULDNT_CONNECT 7.1 +CURLE_COULDNT_RESOLVE_HOST 7.1 +CURLE_COULDNT_RESOLVE_PROXY 7.1 +CURLE_FAILED_INIT 7.1 +CURLE_FILE_COULDNT_READ_FILE 7.1 +CURLE_FILESIZE_EXCEEDED 7.10.8 +CURLE_FTP_ACCEPT_FAILED 7.24.0 +CURLE_FTP_ACCEPT_TIMEOUT 7.24.0 +CURLE_FTP_ACCESS_DENIED 7.1 7.17.0 +CURLE_FTP_BAD_DOWNLOAD_RESUME 7.1 7.1 +CURLE_FTP_BAD_FILE_LIST 7.21.0 +CURLE_FTP_CANT_GET_HOST 7.1 +CURLE_FTP_CANT_RECONNECT 7.1 7.17.0 +CURLE_FTP_COULDNT_GET_SIZE 7.1 7.17.0 +CURLE_FTP_COULDNT_RETR_FILE 7.1 +CURLE_FTP_COULDNT_SET_ASCII 7.1 7.17.0 +CURLE_FTP_COULDNT_SET_BINARY 7.1 7.17.0 +CURLE_FTP_COULDNT_SET_TYPE 7.17.0 +CURLE_FTP_COULDNT_STOR_FILE 7.1 7.16.3 +CURLE_FTP_COULDNT_USE_REST 7.1 +CURLE_FTP_PARTIAL_FILE 7.1 7.1 +CURLE_FTP_PORT_FAILED 7.1 +CURLE_FTP_PRET_FAILED 7.20.0 +CURLE_FTP_QUOTE_ERROR 7.1 7.17.0 +CURLE_FTP_SSL_FAILED 7.11.0 7.17.0 +CURLE_FTP_USER_PASSWORD_INCORRECT 7.1 7.17.0 +CURLE_FTP_WEIRD_227_FORMAT 7.1 +CURLE_FTP_WEIRD_PASS_REPLY 7.1 +CURLE_FTP_WEIRD_PASV_REPLY 7.1 +CURLE_FTP_WEIRD_SERVER_REPLY 7.1 7.51.0 +CURLE_FTP_WEIRD_USER_REPLY 7.1 7.17.0 +CURLE_FTP_WRITE_ERROR 7.1 7.17.0 +CURLE_FUNCTION_NOT_FOUND 7.1 +CURLE_GOT_NOTHING 7.9.1 +CURLE_HTTP2 7.38.0 +CURLE_HTTP2_STREAM 7.49.0 +CURLE_HTTP3 7.68.0 +CURLE_HTTP_NOT_FOUND 7.1 7.10.3 +CURLE_HTTP_PORT_FAILED 7.3 7.12.0 +CURLE_HTTP_POST_ERROR 7.1 +CURLE_HTTP_RANGE_ERROR 7.1 7.17.0 +CURLE_HTTP_RETURNED_ERROR 7.10.3 +CURLE_INTERFACE_FAILED 7.12.0 +CURLE_LDAP_CANNOT_BIND 7.1 +CURLE_LDAP_INVALID_URL 7.10.8 7.82.0 +CURLE_LDAP_SEARCH_FAILED 7.1 +CURLE_LIBRARY_NOT_FOUND 7.1 7.17.0 +CURLE_LOGIN_DENIED 7.13.1 +CURLE_MALFORMAT_USER 7.1 7.17.0 +CURLE_NO_CONNECTION_AVAILABLE 7.30.0 +CURLE_NOT_BUILT_IN 7.21.5 +CURLE_OK 7.1 +CURLE_OPERATION_TIMEDOUT 7.10.2 +CURLE_OPERATION_TIMEOUTED 7.1 7.17.0 +CURLE_OUT_OF_MEMORY 7.1 +CURLE_PARTIAL_FILE 7.1 +CURLE_PEER_FAILED_VERIFICATION 7.17.1 +CURLE_PROXY 7.73.0 +CURLE_QUIC_CONNECT_ERROR 7.69.0 +CURLE_QUOTE_ERROR 7.17.0 +CURLE_RANGE_ERROR 7.17.0 +CURLE_READ_ERROR 7.1 +CURLE_RECURSIVE_API_CALL 7.59.0 +CURLE_RECV_ERROR 7.10 +CURLE_REMOTE_ACCESS_DENIED 7.17.0 +CURLE_REMOTE_DISK_FULL 7.17.0 +CURLE_REMOTE_FILE_EXISTS 7.17.0 +CURLE_REMOTE_FILE_NOT_FOUND 7.16.1 +CURLE_RTSP_CSEQ_ERROR 7.20.0 +CURLE_RTSP_SESSION_ERROR 7.20.0 +CURLE_SEND_ERROR 7.10 +CURLE_SEND_FAIL_REWIND 7.12.3 +CURLE_SETOPT_OPTION_SYNTAX 7.78.0 +CURLE_SHARE_IN_USE 7.9.6 7.17.0 +CURLE_SSH 7.16.1 +CURLE_SSL_CACERT 7.10 7.62.0 +CURLE_SSL_CACERT_BADFILE 7.16.0 +CURLE_SSL_CERTPROBLEM 7.10 +CURLE_SSL_CIPHER 7.10 +CURLE_SSL_CLIENTCERT 7.77.0 +CURLE_SSL_CONNECT_ERROR 7.1 +CURLE_SSL_CRL_BADFILE 7.19.0 +CURLE_SSL_ENGINE_INITFAILED 7.12.3 +CURLE_SSL_ENGINE_NOTFOUND 7.9.3 +CURLE_SSL_ENGINE_SETFAILED 7.9.3 +CURLE_SSL_INVALIDCERTSTATUS 7.41.0 +CURLE_SSL_ISSUER_ERROR 7.19.0 +CURLE_SSL_PEER_CERTIFICATE 7.8 7.17.1 +CURLE_SSL_PINNEDPUBKEYNOTMATCH 7.39.0 +CURLE_SSL_SHUTDOWN_FAILED 7.16.1 +CURLE_TELNET_OPTION_SYNTAX 7.7 +CURLE_TFTP_DISKFULL 7.15.0 7.17.0 +CURLE_TFTP_EXISTS 7.15.0 7.17.0 +CURLE_TFTP_ILLEGAL 7.15.0 +CURLE_TFTP_NOSUCHUSER 7.15.0 +CURLE_TFTP_NOTFOUND 7.15.0 +CURLE_TFTP_PERM 7.15.0 +CURLE_TFTP_UNKNOWNID 7.15.0 +CURLE_TOO_LARGE 8.6.0 +CURLE_TOO_MANY_REDIRECTS 7.5 +CURLE_UNKNOWN_OPTION 7.21.5 +CURLE_UNKNOWN_TELNET_OPTION 7.7 7.21.5 +CURLE_UNRECOVERABLE_POLL 7.84.0 +CURLE_UNSUPPORTED_PROTOCOL 7.1 +CURLE_UPLOAD_FAILED 7.16.3 +CURLE_URL_MALFORMAT 7.1 +CURLE_ECH_REQUIRED 8.8.0 +CURLE_URL_MALFORMAT_USER 7.1 7.17.0 +CURLE_USE_SSL_FAILED 7.17.0 +CURLE_WEIRD_SERVER_REPLY 7.51.0 +CURLE_WRITE_ERROR 7.1 +CURLFILETYPE_DEVICE_BLOCK 7.21.0 +CURLFILETYPE_DEVICE_CHAR 7.21.0 +CURLFILETYPE_DIRECTORY 7.21.0 +CURLFILETYPE_DOOR 7.21.0 +CURLFILETYPE_FILE 7.21.0 +CURLFILETYPE_NAMEDPIPE 7.21.0 +CURLFILETYPE_SOCKET 7.21.0 +CURLFILETYPE_SYMLINK 7.21.0 +CURLFILETYPE_UNKNOWN 7.21.0 +CURLFINFOFLAG_KNOWN_FILENAME 7.21.0 +CURLFINFOFLAG_KNOWN_FILETYPE 7.21.0 +CURLFINFOFLAG_KNOWN_GID 7.21.0 +CURLFINFOFLAG_KNOWN_HLINKCOUNT 7.21.0 +CURLFINFOFLAG_KNOWN_PERM 7.21.0 +CURLFINFOFLAG_KNOWN_SIZE 7.21.0 +CURLFINFOFLAG_KNOWN_TIME 7.21.0 +CURLFINFOFLAG_KNOWN_UID 7.21.0 +CURLFOLLOW_ALL 8.13.0 +CURLFOLLOW_OBEYCODE 8.13.0 +CURLFOLLOW_FIRSTONLY 8.13.0 +CURLFORM_ARRAY 7.9.1 7.56.0 +CURLFORM_ARRAY_END 7.9.1 7.9.5 7.9.6 +CURLFORM_ARRAY_START 7.9.1 7.9.5 7.9.6 +CURLFORM_BUFFER 7.9.8 7.56.0 +CURLFORM_BUFFERLENGTH 7.9.8 7.56.0 +CURLFORM_BUFFERPTR 7.9.8 7.56.0 +CURLFORM_CONTENTHEADER 7.9.3 7.56.0 +CURLFORM_CONTENTLEN 7.46.0 7.56.0 +CURLFORM_CONTENTSLENGTH 7.9 7.56.0 +CURLFORM_CONTENTTYPE 7.9 7.56.0 +CURLFORM_COPYCONTENTS 7.9 7.56.0 +CURLFORM_COPYNAME 7.9 7.56.0 +CURLFORM_END 7.9 7.56.0 +CURLFORM_FILE 7.9 7.56.0 +CURLFORM_FILECONTENT 7.9.1 7.56.0 +CURLFORM_FILENAME 7.9.6 7.56.0 +CURLFORM_NAMELENGTH 7.9 7.56.0 +CURLFORM_NOTHING 7.9 7.56.0 +CURLFORM_PTRCONTENTS 7.9 7.56.0 +CURLFORM_PTRNAME 7.9 7.56.0 +CURLFORM_STREAM 7.18.2 7.56.0 +CURLFTP_CREATE_DIR 7.19.4 +CURLFTP_CREATE_DIR_NONE 7.19.4 +CURLFTP_CREATE_DIR_RETRY 7.19.4 +CURLFTPAUTH_DEFAULT 7.12.2 +CURLFTPAUTH_SSL 7.12.2 +CURLFTPAUTH_TLS 7.12.2 +CURLFTPMETHOD_DEFAULT 7.15.3 +CURLFTPMETHOD_MULTICWD 7.15.3 +CURLFTPMETHOD_NOCWD 7.15.3 +CURLFTPMETHOD_SINGLECWD 7.15.3 +CURLFTPSSL_ALL 7.11.0 7.17.0 +CURLFTPSSL_CCC_ACTIVE 7.16.2 +CURLFTPSSL_CCC_NONE 7.16.2 +CURLFTPSSL_CCC_PASSIVE 7.16.1 +CURLFTPSSL_CONTROL 7.11.0 7.17.0 +CURLFTPSSL_NONE 7.11.0 7.17.0 +CURLFTPSSL_TRY 7.11.0 7.17.0 +CURLGSSAPI_DELEGATION_FLAG 7.22.0 +CURLGSSAPI_DELEGATION_NONE 7.22.0 +CURLGSSAPI_DELEGATION_POLICY_FLAG 7.22.0 +CURLH_1XX 7.83.0 +CURLH_CONNECT 7.83.0 +CURLH_HEADER 7.83.0 +CURLH_PSEUDO 7.83.0 +CURLH_TRAILER 7.83.0 +CURLHE_BAD_ARGUMENT 7.83.0 +CURLHE_BADINDEX 7.83.0 +CURLHE_MISSING 7.83.0 +CURLHE_NOHEADERS 7.83.0 +CURLHE_NOREQUEST 7.83.0 +CURLHE_NOT_BUILT_IN 7.83.0 +CURLHE_OK 7.83.0 +CURLHE_OUT_OF_MEMORY 7.83.0 +CURLHEADER_SEPARATE 7.37.0 +CURLHEADER_UNIFIED 7.37.0 +CURLHSTS_ENABLE 7.74.0 +CURLHSTS_READONLYFILE 7.74.0 +CURLINFO_ACTIVESOCKET 7.45.0 +CURLINFO_APPCONNECT_TIME 7.19.0 +CURLINFO_APPCONNECT_TIME_T 7.61.0 +CURLINFO_CAINFO 7.84.0 +CURLINFO_CAPATH 7.84.0 +CURLINFO_CERTINFO 7.19.1 +CURLINFO_CONDITION_UNMET 7.19.4 +CURLINFO_CONN_ID 8.2.0 +CURLINFO_CONNECT_TIME 7.4.1 +CURLINFO_CONNECT_TIME_T 7.61.0 +CURLINFO_CONTENT_LENGTH_DOWNLOAD 7.6.1 7.55.0 +CURLINFO_CONTENT_LENGTH_DOWNLOAD_T 7.55.0 +CURLINFO_CONTENT_LENGTH_UPLOAD 7.6.1 7.55.0 +CURLINFO_CONTENT_LENGTH_UPLOAD_T 7.55.0 +CURLINFO_CONTENT_TYPE 7.9.4 +CURLINFO_COOKIELIST 7.14.1 +CURLINFO_DATA_IN 7.9.6 +CURLINFO_DATA_OUT 7.9.6 +CURLINFO_DOUBLE 7.4.1 +CURLINFO_EARLYDATA_SENT_T 8.11.0 +CURLINFO_EFFECTIVE_METHOD 7.72.0 +CURLINFO_EFFECTIVE_URL 7.4 +CURLINFO_END 7.9.6 +CURLINFO_FILETIME 7.5 +CURLINFO_FILETIME_T 7.59.0 +CURLINFO_FTP_ENTRY_PATH 7.15.4 +CURLINFO_HEADER_IN 7.9.6 +CURLINFO_HEADER_OUT 7.9.6 +CURLINFO_HEADER_SIZE 7.4.1 +CURLINFO_HTTP_CODE 7.4.1 7.10.8 +CURLINFO_HTTP_CONNECTCODE 7.10.7 +CURLINFO_HTTP_VERSION 7.50.0 +CURLINFO_HTTPAUTH_AVAIL 7.10.8 +CURLINFO_HTTPAUTH_USED 8.12.0 +CURLINFO_LASTONE 7.4.1 +CURLINFO_LASTSOCKET 7.15.2 7.45.0 +CURLINFO_LOCAL_IP 7.21.0 +CURLINFO_LOCAL_PORT 7.21.0 +CURLINFO_LONG 7.4.1 +CURLINFO_MASK 7.4.1 +CURLINFO_NAMELOOKUP_TIME 7.4.1 +CURLINFO_NAMELOOKUP_TIME_T 7.61.0 +CURLINFO_NONE 7.4.1 +CURLINFO_NUM_CONNECTS 7.12.3 +CURLINFO_OFF_T 7.55.0 +CURLINFO_OS_ERRNO 7.12.2 +CURLINFO_PRETRANSFER_TIME 7.4.1 +CURLINFO_PRETRANSFER_TIME_T 7.61.0 +CURLINFO_POSTTRANSFER_TIME_T 8.10.0 +CURLINFO_PRIMARY_IP 7.19.0 +CURLINFO_PRIMARY_PORT 7.21.0 +CURLINFO_PRIVATE 7.10.3 +CURLINFO_PROTOCOL 7.52.0 7.85.0 +CURLINFO_PROXY_ERROR 7.73.0 +CURLINFO_PROXY_SSL_VERIFYRESULT 7.52.0 +CURLINFO_PROXYAUTH_AVAIL 7.10.8 +CURLINFO_PROXYAUTH_USED 8.12.0 +CURLINFO_PTR 7.54.1 +CURLINFO_QUEUE_TIME_T 8.6.0 +CURLINFO_REDIRECT_COUNT 7.9.7 +CURLINFO_REDIRECT_TIME 7.9.7 +CURLINFO_REDIRECT_TIME_T 7.61.0 +CURLINFO_REDIRECT_URL 7.18.2 +CURLINFO_REFERER 7.76.0 +CURLINFO_REQUEST_SIZE 7.4.1 +CURLINFO_RESPONSE_CODE 7.10.8 +CURLINFO_RETRY_AFTER 7.66.0 +CURLINFO_RTSP_CLIENT_CSEQ 7.20.0 +CURLINFO_RTSP_CSEQ_RECV 7.20.0 +CURLINFO_RTSP_SERVER_CSEQ 7.20.0 +CURLINFO_RTSP_SESSION_ID 7.20.0 +CURLINFO_SCHEME 7.52.0 +CURLINFO_SIZE_DOWNLOAD 7.4.1 7.55.0 +CURLINFO_SIZE_DOWNLOAD_T 7.55.0 +CURLINFO_SIZE_UPLOAD 7.4.1 7.55.0 +CURLINFO_SIZE_UPLOAD_T 7.55.0 +CURLINFO_SLIST 7.12.3 +CURLINFO_SOCKET 7.45.0 +CURLINFO_SPEED_DOWNLOAD 7.4.1 7.55.0 +CURLINFO_SPEED_DOWNLOAD_T 7.55.0 +CURLINFO_SPEED_UPLOAD 7.4.1 7.55.0 +CURLINFO_SPEED_UPLOAD_T 7.55.0 +CURLINFO_SSL_DATA_IN 7.12.1 +CURLINFO_SSL_DATA_OUT 7.12.1 +CURLINFO_SSL_ENGINES 7.12.3 +CURLINFO_SSL_VERIFYRESULT 7.5 +CURLINFO_STARTTRANSFER_TIME 7.9.2 +CURLINFO_STARTTRANSFER_TIME_T 7.61.0 +CURLINFO_STRING 7.4.1 +CURLINFO_TEXT 7.9.6 +CURLINFO_TLS_SESSION 7.34.0 7.48.0 +CURLINFO_TLS_SSL_PTR 7.48.0 +CURLINFO_TOTAL_TIME 7.4.1 +CURLINFO_TOTAL_TIME_T 7.61.0 +CURLINFO_TYPEMASK 7.4.1 +CURLINFO_USED_PROXY 8.7.0 +CURLINFO_XFER_ID 8.2.0 +CURLIOCMD_NOP 7.12.3 +CURLIOCMD_RESTARTREAD 7.12.3 +CURLIOE_FAILRESTART 7.12.3 +CURLIOE_OK 7.12.3 +CURLIOE_UNKNOWNCMD 7.12.3 +CURLKHMATCH_MISMATCH 7.19.6 +CURLKHMATCH_MISSING 7.19.6 +CURLKHMATCH_OK 7.19.6 +CURLKHSTAT_DEFER 7.19.6 +CURLKHSTAT_FINE 7.19.6 +CURLKHSTAT_FINE_ADD_TO_FILE 7.19.6 +CURLKHSTAT_FINE_REPLACE 7.73.0 +CURLKHSTAT_REJECT 7.19.6 +CURLKHTYPE_DSS 7.19.6 +CURLKHTYPE_ECDSA 7.58.0 +CURLKHTYPE_ED25519 7.58.0 +CURLKHTYPE_RSA 7.19.6 +CURLKHTYPE_RSA1 7.19.6 +CURLKHTYPE_UNKNOWN 7.19.6 +CURLM_ABORTED_BY_CALLBACK 7.81.0 +CURLM_ADDED_ALREADY 7.33.0 +CURLM_BAD_EASY_HANDLE 7.9.6 +CURLM_BAD_FUNCTION_ARGUMENT 7.69.0 +CURLM_BAD_HANDLE 7.9.6 +CURLM_BAD_SOCKET 7.15.4 +CURLM_CALL_MULTI_PERFORM 7.9.6 +CURLM_CALL_MULTI_SOCKET 7.15.5 +CURLM_INTERNAL_ERROR 7.9.6 +CURLM_OK 7.9.6 +CURLM_OUT_OF_MEMORY 7.9.6 +CURLM_RECURSIVE_API_CALL 7.59.0 +CURLM_UNKNOWN_OPTION 7.15.4 +CURLM_UNRECOVERABLE_POLL 7.84.0 +CURLM_WAKEUP_FAILURE 7.68.0 +CURLMIMEOPT_FORMESCAPE 7.81.0 +CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE 7.30.0 +CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE 7.30.0 +CURLMOPT_MAX_CONCURRENT_STREAMS 7.67.0 +CURLMOPT_MAX_HOST_CONNECTIONS 7.30.0 +CURLMOPT_MAX_PIPELINE_LENGTH 7.30.0 +CURLMOPT_MAX_TOTAL_CONNECTIONS 7.30.0 +CURLMOPT_MAXCONNECTS 7.16.3 +CURLMOPT_PIPELINING 7.16.0 +CURLMOPT_PIPELINING_SERVER_BL 7.30.0 +CURLMOPT_PIPELINING_SITE_BL 7.30.0 +CURLMOPT_PUSHDATA 7.44.0 +CURLMOPT_PUSHFUNCTION 7.44.0 +CURLMOPT_SOCKETDATA 7.15.4 +CURLMOPT_SOCKETFUNCTION 7.15.4 +CURLMOPT_TIMERDATA 7.16.0 +CURLMOPT_TIMERFUNCTION 7.16.0 +CURLMSG_DONE 7.9.6 +CURLMSG_NONE 7.9.6 +CURLOPT 7.69.0 +CURLOPT_ABSTRACT_UNIX_SOCKET 7.53.0 +CURLOPT_ACCEPT_ENCODING 7.21.6 +CURLOPT_ACCEPTTIMEOUT_MS 7.24.0 +CURLOPT_ADDRESS_SCOPE 7.19.0 +CURLOPT_ALTSVC 7.64.1 +CURLOPT_ALTSVC_CTRL 7.64.1 +CURLOPT_APPEND 7.17.0 +CURLOPT_AUTOREFERER 7.1 +CURLOPT_AWS_SIGV4 7.75.0 +CURLOPT_BUFFERSIZE 7.10 +CURLOPT_CAINFO 7.4.2 +CURLOPT_CAINFO_BLOB 7.77.0 +CURLOPT_CAPATH 7.9.8 +CURLOPT_CA_CACHE_TIMEOUT 7.87.0 +CURLOPT_CERTINFO 7.19.1 +CURLOPT_CHUNK_BGN_FUNCTION 7.21.0 +CURLOPT_CHUNK_DATA 7.21.0 +CURLOPT_CHUNK_END_FUNCTION 7.21.0 +CURLOPT_CLOSEFUNCTION 7.7 7.11.1 7.15.5 +CURLOPT_CLOSEPOLICY 7.7 7.16.1 +CURLOPT_CLOSESOCKETDATA 7.21.7 +CURLOPT_CLOSESOCKETFUNCTION 7.21.7 +CURLOPT_CONNECT_ONLY 7.15.2 +CURLOPT_CONNECT_TO 7.49.0 +CURLOPT_CONNECTTIMEOUT 7.7 +CURLOPT_CONNECTTIMEOUT_MS 7.16.2 +CURLOPT_CONV_FROM_NETWORK_FUNCTION 7.15.4 7.82.0 +CURLOPT_CONV_FROM_UTF8_FUNCTION 7.15.4 7.82.0 +CURLOPT_CONV_TO_NETWORK_FUNCTION 7.15.4 7.82.0 +CURLOPT_COOKIE 7.1 +CURLOPT_COOKIEFILE 7.1 +CURLOPT_COOKIEJAR 7.9 +CURLOPT_COOKIELIST 7.14.1 +CURLOPT_COOKIESESSION 7.9.7 +CURLOPT_COPYPOSTFIELDS 7.17.1 +CURLOPT_CRLF 7.1 +CURLOPT_CRLFILE 7.19.0 +CURLOPT_CURLU 7.63.0 +CURLOPT_CUSTOMREQUEST 7.1 +CURLOPT_DEBUGDATA 7.9.6 +CURLOPT_DEBUGFUNCTION 7.9.6 +CURLOPT_DEFAULT_PROTOCOL 7.45.0 +CURLOPT_DIRLISTONLY 7.17.0 +CURLOPT_DISALLOW_USERNAME_IN_URL 7.61.0 +CURLOPT_DNS_CACHE_TIMEOUT 7.9.3 +CURLOPT_DNS_INTERFACE 7.33.0 +CURLOPT_DNS_LOCAL_IP4 7.33.0 +CURLOPT_DNS_LOCAL_IP6 7.33.0 +CURLOPT_DNS_SERVERS 7.24.0 +CURLOPT_DNS_SHUFFLE_ADDRESSES 7.60.0 +CURLOPT_DNS_USE_GLOBAL_CACHE 7.9.3 7.11.1 +CURLOPT_DOH_SSL_VERIFYHOST 7.76.0 +CURLOPT_DOH_SSL_VERIFYPEER 7.76.0 +CURLOPT_DOH_SSL_VERIFYSTATUS 7.76.0 +CURLOPT_DOH_URL 7.62.0 +CURLOPT_ECH 8.8.0 +CURLOPT_EGDSOCKET 7.7 7.84.0 +CURLOPT_ENCODING 7.10 7.21.6 +CURLOPT_ERRORBUFFER 7.1 +CURLOPT_EXPECT_100_TIMEOUT_MS 7.36.0 +CURLOPT_FAILONERROR 7.1 +CURLOPT_FILE 7.1 7.9.7 +CURLOPT_FILETIME 7.5 +CURLOPT_FNMATCH_DATA 7.21.0 +CURLOPT_FNMATCH_FUNCTION 7.21.0 +CURLOPT_FOLLOWLOCATION 7.1 +CURLOPT_FORBID_REUSE 7.7 +CURLOPT_FRESH_CONNECT 7.7 +CURLOPT_FTP_ACCOUNT 7.13.0 +CURLOPT_FTP_ALTERNATIVE_TO_USER 7.15.5 +CURLOPT_FTP_CREATE_MISSING_DIRS 7.10.7 +CURLOPT_FTP_FILEMETHOD 7.15.1 +CURLOPT_FTP_RESPONSE_TIMEOUT 7.10.8 7.85.0 +CURLOPT_FTP_SKIP_PASV_IP 7.15.0 +CURLOPT_FTP_SSL 7.11.0 7.16.4 +CURLOPT_FTP_SSL_CCC 7.16.1 +CURLOPT_FTP_USE_EPRT 7.10.5 +CURLOPT_FTP_USE_EPSV 7.9.2 +CURLOPT_FTP_USE_PRET 7.20.0 +CURLOPT_FTPAPPEND 7.1 7.16.4 +CURLOPT_FTPASCII 7.1 7.11.1 7.15.5 +CURLOPT_FTPLISTONLY 7.1 7.16.4 +CURLOPT_FTPPORT 7.1 +CURLOPT_FTPSSLAUTH 7.12.2 +CURLOPT_GSSAPI_DELEGATION 7.22.0 +CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS 7.59.0 +CURLOPT_HAPROXYPROTOCOL 7.60.0 +CURLOPT_HAPROXY_CLIENT_IP 8.2.0 +CURLOPT_HEADER 7.1 +CURLOPT_HEADERDATA 7.10 +CURLOPT_HEADERFUNCTION 7.7.2 +CURLOPT_HEADEROPT 7.37.0 +CURLOPT_HSTS 7.74.0 +CURLOPT_HSTS_CTRL 7.74.0 +CURLOPT_HSTSREADDATA 7.74.0 +CURLOPT_HSTSREADFUNCTION 7.74.0 +CURLOPT_HSTSWRITEDATA 7.74.0 +CURLOPT_HSTSWRITEFUNCTION 7.74.0 +CURLOPT_HTTP09_ALLOWED 7.64.0 +CURLOPT_HTTP200ALIASES 7.10.3 +CURLOPT_HTTP_CONTENT_DECODING 7.16.2 +CURLOPT_HTTP_TRANSFER_DECODING 7.16.2 +CURLOPT_HTTP_VERSION 7.9.1 +CURLOPT_HTTPAUTH 7.10.6 +CURLOPT_HTTPGET 7.8.1 +CURLOPT_HTTPHEADER 7.1 +CURLOPT_HTTPPOST 7.1 7.56.0 +CURLOPT_HTTPPROXYTUNNEL 7.3 +CURLOPT_HTTPREQUEST 7.1 - 7.15.5 +CURLOPT_IGNORE_CONTENT_LENGTH 7.14.1 +CURLOPT_INFILE 7.1 7.9.7 +CURLOPT_INFILESIZE 7.1 +CURLOPT_INFILESIZE_LARGE 7.11.0 +CURLOPT_INTERFACE 7.3 +CURLOPT_INTERLEAVEDATA 7.20.0 +CURLOPT_INTERLEAVEFUNCTION 7.20.0 +CURLOPT_IOCTLDATA 7.12.3 7.18.0 +CURLOPT_IOCTLFUNCTION 7.12.3 7.18.0 +CURLOPT_IPRESOLVE 7.10.8 +CURLOPT_ISSUERCERT 7.19.0 +CURLOPT_ISSUERCERT_BLOB 7.71.0 +CURLOPT_KEEP_SENDING_ON_ERROR 7.51.0 +CURLOPT_KEYPASSWD 7.17.0 +CURLOPT_KRB4LEVEL 7.3 7.17.0 +CURLOPT_KRBLEVEL 7.16.4 +CURLOPT_LOCALPORT 7.15.2 +CURLOPT_LOCALPORTRANGE 7.15.2 +CURLOPT_LOGIN_OPTIONS 7.34.0 +CURLOPT_LOW_SPEED_LIMIT 7.1 +CURLOPT_LOW_SPEED_TIME 7.1 +CURLOPT_MAIL_AUTH 7.25.0 +CURLOPT_MAIL_FROM 7.20.0 +CURLOPT_MAIL_RCPT 7.20.0 +CURLOPT_MAIL_RCPT_ALLLOWFAILS 7.69.0 8.2.0 +CURLOPT_MAIL_RCPT_ALLOWFAILS 8.2.0 +CURLOPT_QUICK_EXIT 7.87.0 +CURLOPT_MAX_RECV_SPEED_LARGE 7.15.5 +CURLOPT_MAX_SEND_SPEED_LARGE 7.15.5 +CURLOPT_MAXAGE_CONN 7.65.0 +CURLOPT_MAXCONNECTS 7.7 +CURLOPT_MAXFILESIZE 7.10.8 +CURLOPT_MAXFILESIZE_LARGE 7.11.0 +CURLOPT_MAXLIFETIME_CONN 7.80.0 +CURLOPT_MAXREDIRS 7.5 +CURLOPT_MIME_OPTIONS 7.81.0 +CURLOPT_MIMEPOST 7.56.0 +CURLOPT_MUTE 7.1 7.8 7.15.5 +CURLOPT_NETRC 7.1 +CURLOPT_NETRC_FILE 7.11.0 +CURLOPT_NEW_DIRECTORY_PERMS 7.16.4 +CURLOPT_NEW_FILE_PERMS 7.16.4 +CURLOPT_NOBODY 7.1 +CURLOPT_NOPROGRESS 7.1 +CURLOPT_NOPROXY 7.19.4 +CURLOPT_NOSIGNAL 7.10 +CURLOPT_NOTHING 7.1.1 7.11.1 7.11.0 +CURLOPT_OPENSOCKETDATA 7.17.1 +CURLOPT_OPENSOCKETFUNCTION 7.17.1 +CURLOPT_PASSWDDATA 7.4.2 7.11.1 7.15.5 +CURLOPT_PASSWDFUNCTION 7.4.2 7.11.1 7.15.5 +CURLOPT_PASSWORD 7.19.1 +CURLOPT_PASV_HOST 7.12.1 7.16.0 7.15.5 +CURLOPT_PATH_AS_IS 7.42.0 +CURLOPT_PINNEDPUBLICKEY 7.39.0 +CURLOPT_PIPEWAIT 7.43.0 +CURLOPT_PORT 7.1 +CURLOPT_POST 7.1 +CURLOPT_POST301 7.17.1 7.19.1 +CURLOPT_POSTFIELDS 7.1 +CURLOPT_POSTFIELDSIZE 7.2 +CURLOPT_POSTFIELDSIZE_LARGE 7.11.1 +CURLOPT_POSTQUOTE 7.1 +CURLOPT_POSTREDIR 7.19.1 +CURLOPT_PRE_PROXY 7.52.0 +CURLOPT_PREQUOTE 7.9.5 +CURLOPT_PREREQDATA 7.80.0 +CURLOPT_PREREQFUNCTION 7.80.0 +CURLOPT_PRIVATE 7.10.3 +CURLOPT_PROGRESSDATA 7.1 +CURLOPT_PROGRESSFUNCTION 7.1 7.32.0 +CURLOPT_PROTOCOLS 7.19.4 7.85.0 +CURLOPT_PROTOCOLS_STR 7.85.0 +CURLOPT_PROXY 7.1 +CURLOPT_PROXY_CAINFO 7.52.0 +CURLOPT_PROXY_CAINFO_BLOB 7.77.0 +CURLOPT_PROXY_CAPATH 7.52.0 +CURLOPT_PROXY_CRLFILE 7.52.0 +CURLOPT_PROXY_ISSUERCERT 7.71.0 +CURLOPT_PROXY_ISSUERCERT_BLOB 7.71.0 +CURLOPT_PROXY_KEYPASSWD 7.52.0 +CURLOPT_PROXY_PINNEDPUBLICKEY 7.52.0 +CURLOPT_PROXY_SERVICE_NAME 7.43.0 +CURLOPT_PROXY_SSL_CIPHER_LIST 7.52.0 +CURLOPT_PROXY_SSL_OPTIONS 7.52.0 +CURLOPT_PROXY_SSL_VERIFYHOST 7.52.0 +CURLOPT_PROXY_SSL_VERIFYPEER 7.52.0 +CURLOPT_PROXY_SSLCERT 7.52.0 +CURLOPT_PROXY_SSLCERT_BLOB 7.71.0 +CURLOPT_PROXY_SSLCERTTYPE 7.52.0 +CURLOPT_PROXY_SSLKEY 7.52.0 +CURLOPT_PROXY_SSLKEY_BLOB 7.71.0 +CURLOPT_PROXY_SSLKEYTYPE 7.52.0 +CURLOPT_PROXY_SSLVERSION 7.52.0 +CURLOPT_PROXY_TLS13_CIPHERS 7.61.0 +CURLOPT_PROXY_TLSAUTH_PASSWORD 7.52.0 +CURLOPT_PROXY_TLSAUTH_TYPE 7.52.0 +CURLOPT_PROXY_TLSAUTH_USERNAME 7.52.0 +CURLOPT_PROXY_TRANSFER_MODE 7.18.0 +CURLOPT_PROXYAUTH 7.10.7 +CURLOPT_PROXYHEADER 7.37.0 +CURLOPT_PROXYPASSWORD 7.19.1 +CURLOPT_PROXYPORT 7.1 +CURLOPT_PROXYTYPE 7.10 +CURLOPT_PROXYUSERNAME 7.19.1 +CURLOPT_PROXYUSERPWD 7.1 +CURLOPT_PUT 7.1 7.12.1 +CURLOPT_QUOTE 7.1 +CURLOPT_RANDOM_FILE 7.7 7.84.0 +CURLOPT_RANGE 7.1 +CURLOPT_READDATA 7.9.7 +CURLOPT_READFUNCTION 7.1 +CURLOPT_REDIR_PROTOCOLS 7.19.4 7.85.0 +CURLOPT_REDIR_PROTOCOLS_STR 7.85.0 +CURLOPT_REFERER 7.1 +CURLOPT_REQUEST_TARGET 7.55.0 +CURLOPT_RESOLVE 7.21.3 +CURLOPT_RESOLVER_START_DATA 7.59.0 +CURLOPT_RESOLVER_START_FUNCTION 7.59.0 +CURLOPT_RESUME_FROM 7.1 +CURLOPT_RESUME_FROM_LARGE 7.11.0 +CURLOPT_RTSP_CLIENT_CSEQ 7.20.0 +CURLOPT_RTSP_REQUEST 7.20.0 +CURLOPT_RTSP_SERVER_CSEQ 7.20.0 +CURLOPT_RTSP_SESSION_ID 7.20.0 +CURLOPT_RTSP_STREAM_URI 7.20.0 +CURLOPT_RTSP_TRANSPORT 7.20.0 +CURLOPT_RTSPHEADER 7.20.0 +CURLOPT_SASL_AUTHZID 7.66.0 +CURLOPT_SASL_IR 7.31.0 +CURLOPT_SEEKDATA 7.18.0 +CURLOPT_SEEKFUNCTION 7.18.0 +CURLOPT_SERVER_RESPONSE_TIMEOUT 7.20.0 +CURLOPT_SERVER_RESPONSE_TIMEOUT_MS 8.6.0 +CURLOPT_SERVICE_NAME 7.43.0 +CURLOPT_SHARE 7.10 +CURLOPT_SOCKOPTDATA 7.16.0 +CURLOPT_SOCKOPTFUNCTION 7.16.0 +CURLOPT_SOCKS5_AUTH 7.55.0 +CURLOPT_SOCKS5_GSSAPI_NEC 7.19.4 +CURLOPT_SOCKS5_GSSAPI_SERVICE 7.19.4 7.49.0 +CURLOPT_SOURCE_HOST 7.12.1 - 7.15.5 +CURLOPT_SOURCE_PATH 7.12.1 - 7.15.5 +CURLOPT_SOURCE_PORT 7.12.1 - 7.15.5 +CURLOPT_SOURCE_POSTQUOTE 7.12.1 - 7.15.5 +CURLOPT_SOURCE_PREQUOTE 7.12.1 - 7.15.5 +CURLOPT_SOURCE_QUOTE 7.13.0 - 7.15.5 +CURLOPT_SOURCE_URL 7.13.0 - 7.15.5 +CURLOPT_SOURCE_USERPWD 7.12.1 - 7.15.5 +CURLOPT_SSH_AUTH_TYPES 7.16.1 +CURLOPT_SSH_COMPRESSION 7.56.0 +CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 7.17.1 +CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 7.80.0 +CURLOPT_SSH_HOSTKEYDATA 7.84.0 +CURLOPT_SSH_HOSTKEYFUNCTION 7.84.0 +CURLOPT_SSH_KEYDATA 7.19.6 +CURLOPT_SSH_KEYFUNCTION 7.19.6 +CURLOPT_SSH_KNOWNHOSTS 7.19.6 +CURLOPT_SSH_PRIVATE_KEYFILE 7.16.1 +CURLOPT_SSH_PUBLIC_KEYFILE 7.16.1 +CURLOPT_SSL_CIPHER_LIST 7.9 +CURLOPT_SSL_CTX_DATA 7.10.6 +CURLOPT_SSL_CTX_FUNCTION 7.10.6 +CURLOPT_SSL_EC_CURVES 7.73.0 +CURLOPT_SSL_ENABLE_ALPN 7.36.0 +CURLOPT_SSL_ENABLE_NPN 7.36.0 7.86.0 +CURLOPT_SSL_FALSESTART 7.42.0 +CURLOPT_SSL_OPTIONS 7.25.0 +CURLOPT_SSL_SESSIONID_CACHE 7.16.0 +CURLOPT_SSL_SIGNATURE_ALGORITHMS 8.14.0 +CURLOPT_SSL_VERIFYHOST 7.8.1 +CURLOPT_SSL_VERIFYPEER 7.4.2 +CURLOPT_SSL_VERIFYSTATUS 7.41.0 +CURLOPT_SSLCERT 7.1 +CURLOPT_SSLCERT_BLOB 7.71.0 +CURLOPT_SSLCERTPASSWD 7.1.1 7.17.0 +CURLOPT_SSLCERTTYPE 7.9.3 +CURLOPT_SSLENGINE 7.9.3 +CURLOPT_SSLENGINE_DEFAULT 7.9.3 +CURLOPT_SSLKEY 7.9.3 +CURLOPT_SSLKEY_BLOB 7.71.0 +CURLOPT_SSLKEYPASSWD 7.9.3 7.17.0 +CURLOPT_SSLKEYTYPE 7.9.3 +CURLOPT_SSLVERSION 7.1 +CURLOPT_STDERR 7.1 +CURLOPT_STREAM_DEPENDS 7.46.0 +CURLOPT_STREAM_DEPENDS_E 7.46.0 +CURLOPT_STREAM_WEIGHT 7.46.0 +CURLOPT_SUPPRESS_CONNECT_HEADERS 7.54.0 +CURLOPT_TCP_FASTOPEN 7.49.0 +CURLOPT_TCP_KEEPALIVE 7.25.0 +CURLOPT_TCP_KEEPIDLE 7.25.0 +CURLOPT_TCP_KEEPINTVL 7.25.0 +CURLOPT_TCP_KEEPCNT 8.9.0 +CURLOPT_TCP_NODELAY 7.11.2 +CURLOPT_TELNETOPTIONS 7.7 +CURLOPT_TFTP_BLKSIZE 7.19.4 +CURLOPT_TFTP_NO_OPTIONS 7.48.0 +CURLOPT_TIMECONDITION 7.1 +CURLOPT_TIMEOUT 7.1 +CURLOPT_TIMEOUT_MS 7.16.2 +CURLOPT_TIMEVALUE 7.1 +CURLOPT_TIMEVALUE_LARGE 7.59.0 +CURLOPT_TLS13_CIPHERS 7.61.0 +CURLOPT_TLSAUTH_PASSWORD 7.21.4 +CURLOPT_TLSAUTH_TYPE 7.21.4 +CURLOPT_TLSAUTH_USERNAME 7.21.4 +CURLOPT_TRAILERDATA 7.64.0 +CURLOPT_TRAILERFUNCTION 7.64.0 +CURLOPT_TRANSFER_ENCODING 7.21.6 +CURLOPT_TRANSFERTEXT 7.1.1 +CURLOPT_UNIX_SOCKET_PATH 7.40.0 +CURLOPT_UNRESTRICTED_AUTH 7.10.4 +CURLOPT_UPKEEP_INTERVAL_MS 7.62.0 +CURLOPT_UPLOAD 7.1 +CURLOPT_UPLOAD_BUFFERSIZE 7.62.0 +CURLOPT_UPLOAD_FLAGS 8.13.0 +CURLOPT_URL 7.1 +CURLOPT_USE_SSL 7.17.0 +CURLOPT_USERAGENT 7.1 +CURLOPT_USERNAME 7.19.1 +CURLOPT_USERPWD 7.1 +CURLOPT_VERBOSE 7.1 +CURLOPT_WILDCARDMATCH 7.21.0 +CURLOPT_WRITEDATA 7.9.7 +CURLOPT_WRITEFUNCTION 7.1 +CURLOPT_WRITEHEADER 7.1 +CURLOPT_WRITEINFO 7.1 +CURLOPT_WS_OPTIONS 7.86.0 +CURLOPT_XFERINFODATA 7.32.0 +CURLOPT_XFERINFOFUNCTION 7.32.0 +CURLOPT_XOAUTH2_BEARER 7.33.0 +CURLOPTDEPRECATED 7.87.0 +CURLOPTTYPE_BLOB 7.71.0 +CURLOPTTYPE_CBPOINT 7.73.0 +CURLOPTTYPE_FUNCTIONPOINT 7.1 +CURLOPTTYPE_LONG 7.1 +CURLOPTTYPE_OBJECTPOINT 7.1 +CURLOPTTYPE_OFF_T 7.11.0 +CURLOPTTYPE_SLISTPOINT 7.65.2 +CURLOPTTYPE_STRINGPOINT 7.46.0 +CURLOPTTYPE_VALUES 7.73.0 +CURLOT_BLOB 7.73.0 +CURLOT_CBPTR 7.73.0 +CURLOT_FLAG_ALIAS 7.73.0 +CURLOT_FUNCTION 7.73.0 +CURLOT_LONG 7.73.0 +CURLOT_OBJECT 7.73.0 +CURLOT_OFF_T 7.73.0 +CURLOT_SLIST 7.73.0 +CURLOT_STRING 7.73.0 +CURLOT_VALUES 7.73.0 +CURLPAUSE_ALL 7.18.0 +CURLPAUSE_CONT 7.18.0 +CURLPAUSE_RECV 7.18.0 +CURLPAUSE_RECV_CONT 7.18.0 +CURLPAUSE_SEND 7.18.0 +CURLPAUSE_SEND_CONT 7.18.0 +CURLPIPE_HTTP1 7.43.0 +CURLPIPE_MULTIPLEX 7.43.0 +CURLPIPE_NOTHING 7.43.0 +CURLPROTO_ALL 7.19.4 +CURLPROTO_DICT 7.19.4 +CURLPROTO_FILE 7.19.4 +CURLPROTO_FTP 7.19.4 +CURLPROTO_FTPS 7.19.4 +CURLPROTO_GOPHER 7.21.2 +CURLPROTO_GOPHERS 7.75.0 +CURLPROTO_HTTP 7.19.4 +CURLPROTO_HTTPS 7.19.4 +CURLPROTO_IMAP 7.20.0 +CURLPROTO_IMAPS 7.20.0 +CURLPROTO_LDAP 7.19.4 +CURLPROTO_LDAPS 7.19.4 +CURLPROTO_MQTT 7.71.0 +CURLPROTO_POP3 7.20.0 +CURLPROTO_POP3S 7.20.0 +CURLPROTO_RTMP 7.21.0 +CURLPROTO_RTMPE 7.21.0 +CURLPROTO_RTMPS 7.21.0 +CURLPROTO_RTMPT 7.21.0 +CURLPROTO_RTMPTE 7.21.0 +CURLPROTO_RTMPTS 7.21.0 +CURLPROTO_RTSP 7.20.0 +CURLPROTO_SCP 7.19.4 +CURLPROTO_SFTP 7.19.4 +CURLPROTO_SMB 7.40.0 +CURLPROTO_SMBS 7.40.0 +CURLPROTO_SMTP 7.20.0 +CURLPROTO_SMTPS 7.20.0 +CURLPROTO_TELNET 7.19.4 +CURLPROTO_TFTP 7.19.4 +CURLPROXY_HTTP 7.10 +CURLPROXY_HTTP_1_0 7.19.4 +CURLPROXY_HTTPS 7.52.0 +CURLPROXY_HTTPS2 8.1.0 +CURLPROXY_SOCKS4 7.10 +CURLPROXY_SOCKS4A 7.18.0 +CURLPROXY_SOCKS5 7.10 +CURLPROXY_SOCKS5_HOSTNAME 7.18.0 +CURLPX_BAD_ADDRESS_TYPE 7.73.0 +CURLPX_BAD_VERSION 7.73.0 +CURLPX_CLOSED 7.73.0 +CURLPX_GSSAPI 7.73.0 +CURLPX_GSSAPI_PERMSG 7.73.0 +CURLPX_GSSAPI_PROTECTION 7.73.0 +CURLPX_IDENTD 7.73.0 +CURLPX_IDENTD_DIFFER 7.73.0 +CURLPX_LONG_HOSTNAME 7.73.0 +CURLPX_LONG_PASSWD 7.73.0 +CURLPX_LONG_USER 7.73.0 +CURLPX_NO_AUTH 7.73.0 +CURLPX_OK 7.73.0 +CURLPX_RECV_ADDRESS 7.73.0 +CURLPX_RECV_AUTH 7.73.0 +CURLPX_RECV_CONNECT 7.73.0 +CURLPX_RECV_REQACK 7.73.0 +CURLPX_REPLY_ADDRESS_TYPE_NOT_SUPPORTED 7.73.0 +CURLPX_REPLY_COMMAND_NOT_SUPPORTED 7.73.0 +CURLPX_REPLY_CONNECTION_REFUSED 7.73.0 +CURLPX_REPLY_GENERAL_SERVER_FAILURE 7.73.0 +CURLPX_REPLY_HOST_UNREACHABLE 7.73.0 +CURLPX_REPLY_NETWORK_UNREACHABLE 7.73.0 +CURLPX_REPLY_NOT_ALLOWED 7.73.0 +CURLPX_REPLY_TTL_EXPIRED 7.73.0 +CURLPX_REPLY_UNASSIGNED 7.73.0 +CURLPX_REQUEST_FAILED 7.73.0 +CURLPX_RESOLVE_HOST 7.73.0 +CURLPX_SEND_AUTH 7.73.0 +CURLPX_SEND_CONNECT 7.73.0 +CURLPX_SEND_REQUEST 7.73.0 +CURLPX_UNKNOWN_FAIL 7.73.0 +CURLPX_UNKNOWN_MODE 7.73.0 +CURLPX_USER_REJECTED 7.73.0 +CURLSHE_BAD_OPTION 7.10.3 +CURLSHE_IN_USE 7.10.3 +CURLSHE_INVALID 7.10.3 +CURLSHE_NOMEM 7.12.0 +CURLSHE_NOT_BUILT_IN 7.23.0 +CURLSHE_OK 7.10.3 +CURLSHOPT_LOCKFUNC 7.10.3 +CURLSHOPT_NONE 7.10.3 +CURLSHOPT_SHARE 7.10.3 +CURLSHOPT_UNLOCKFUNC 7.10.3 +CURLSHOPT_UNSHARE 7.10.3 +CURLSHOPT_USERDATA 7.10.3 +CURLSOCKTYPE_ACCEPT 7.28.0 +CURLSOCKTYPE_IPCXN 7.16.0 +CURLSSH_AUTH_AGENT 7.28.0 +CURLSSH_AUTH_ANY 7.16.1 +CURLSSH_AUTH_DEFAULT 7.16.1 +CURLSSH_AUTH_GSSAPI 7.58.0 +CURLSSH_AUTH_HOST 7.16.1 +CURLSSH_AUTH_KEYBOARD 7.16.1 +CURLSSH_AUTH_NONE 7.16.1 +CURLSSH_AUTH_PASSWORD 7.16.1 +CURLSSH_AUTH_PUBLICKEY 7.16.1 +CURLSSLBACKEND_AWSLC 8.1.0 +CURLSSLBACKEND_AXTLS 7.38.0 7.61.0 +CURLSSLBACKEND_BEARSSL 7.68.0 +CURLSSLBACKEND_BORINGSSL 7.49.0 +CURLSSLBACKEND_CYASSL 7.34.0 +CURLSSLBACKEND_DARWINSSL 7.34.0 7.64.1 +CURLSSLBACKEND_GNUTLS 7.34.0 +CURLSSLBACKEND_GSKIT 7.34.0 +CURLSSLBACKEND_LIBRESSL 7.49.0 +CURLSSLBACKEND_MBEDTLS 7.46.0 +CURLSSLBACKEND_MESALINK 7.62.0 +CURLSSLBACKEND_NONE 7.34.0 +CURLSSLBACKEND_NSS 7.34.0 +CURLSSLBACKEND_OPENSSL 7.34.0 +CURLSSLBACKEND_POLARSSL 7.34.0 7.69.0 +CURLSSLBACKEND_QSOSSL 7.34.0 - 7.38.0 +CURLSSLBACKEND_RUSTLS 7.76.0 +CURLSSLBACKEND_SCHANNEL 7.34.0 +CURLSSLBACKEND_SECURETRANSPORT 7.64.1 +CURLSSLBACKEND_WOLFSSL 7.49.0 +CURLSSLOPT_ALLOW_BEAST 7.25.0 +CURLSSLOPT_AUTO_CLIENT_CERT 7.77.0 +CURLSSLOPT_NATIVE_CA 7.71.0 +CURLSSLOPT_NO_PARTIALCHAIN 7.68.0 +CURLSSLOPT_NO_REVOKE 7.44.0 +CURLSSLOPT_REVOKE_BEST_EFFORT 7.70.0 +CURLSSLOPT_EARLYDATA 8.11.0 +CURLSSLSET_NO_BACKENDS 7.56.0 +CURLSSLSET_OK 7.56.0 +CURLSSLSET_TOO_LATE 7.56.0 +CURLSSLSET_UNKNOWN_BACKEND 7.56.0 +CURLSTS_DONE 7.74.0 +CURLSTS_FAIL 7.74.0 +CURLSTS_OK 7.74.0 +CURLU_ALLOW_SPACE 7.78.0 +CURLU_APPENDQUERY 7.62.0 +CURLU_DEFAULT_PORT 7.62.0 +CURLU_DEFAULT_SCHEME 7.62.0 +CURLU_DISALLOW_USER 7.62.0 +CURLU_GET_EMPTY 8.8.0 +CURLU_GUESS_SCHEME 7.62.0 +CURLU_NO_AUTHORITY 7.67.0 +CURLU_NO_DEFAULT_PORT 7.62.0 +CURLU_NO_GUESS_SCHEME 8.9.0 +CURLU_NON_SUPPORT_SCHEME 7.62.0 +CURLU_PATH_AS_IS 7.62.0 +CURLU_PUNY2IDN 8.3.0 +CURLU_PUNYCODE 7.88.0 +CURLU_URLDECODE 7.62.0 +CURLU_URLENCODE 7.62.0 +CURLUE_BAD_FILE_URL 7.81.0 +CURLUE_BAD_FRAGMENT 7.81.0 +CURLUE_BAD_HANDLE 7.62.0 +CURLUE_BAD_HOSTNAME 7.81.0 +CURLUE_BAD_IPV6 7.81.0 +CURLUE_BAD_LOGIN 7.81.0 +CURLUE_BAD_PARTPOINTER 7.62.0 +CURLUE_BAD_PASSWORD 7.81.0 +CURLUE_BAD_PATH 7.81.0 +CURLUE_BAD_PORT_NUMBER 7.62.0 +CURLUE_BAD_QUERY 7.81.0 +CURLUE_BAD_SCHEME 7.81.0 +CURLUE_BAD_SLASHES 7.81.0 +CURLUE_BAD_USER 7.81.0 +CURLUE_LACKS_IDN 7.88.0 +CURLUE_MALFORMED_INPUT 7.62.0 +CURLUE_NO_FRAGMENT 7.62.0 +CURLUE_NO_HOST 7.62.0 +CURLUE_NO_OPTIONS 7.62.0 +CURLUE_NO_PASSWORD 7.62.0 +CURLUE_NO_PORT 7.62.0 +CURLUE_NO_QUERY 7.62.0 +CURLUE_NO_SCHEME 7.62.0 +CURLUE_NO_USER 7.62.0 +CURLUE_NO_ZONEID 7.81.0 +CURLUE_OK 7.62.0 +CURLUE_OUT_OF_MEMORY 7.62.0 +CURLUE_TOO_LARGE 8.6.0 +CURLUE_UNKNOWN_PART 7.62.0 +CURLUE_UNSUPPORTED_SCHEME 7.62.0 +CURLUE_URLDECODE 7.62.0 +CURLUE_USER_NOT_ALLOWED 7.62.0 +CURLUPART_FRAGMENT 7.62.0 +CURLUPART_HOST 7.62.0 +CURLUPART_OPTIONS 7.62.0 +CURLUPART_PASSWORD 7.62.0 +CURLUPART_PATH 7.62.0 +CURLUPART_PORT 7.62.0 +CURLUPART_QUERY 7.62.0 +CURLUPART_SCHEME 7.62.0 +CURLUPART_URL 7.62.0 +CURLUPART_USER 7.62.0 +CURLUPART_ZONEID 7.65.0 +CURLULFLAG_ANSWERED 8.13.0 +CURLULFLAG_DELETED 8.13.0 +CURLULFLAG_DRAFT 8.13.0 +CURLULFLAG_FLAGGED 8.13.0 +CURLULFLAG_SEEN 8.13.0 +CURLUSESSL_ALL 7.17.0 +CURLUSESSL_CONTROL 7.17.0 +CURLUSESSL_NONE 7.17.0 +CURLUSESSL_TRY 7.17.0 +CURLVERSION_EIGHTH 7.72.0 +CURLVERSION_ELEVENTH 7.87.0 +CURLVERSION_FIFTH 7.57.0 +CURLVERSION_FIRST 7.10 +CURLVERSION_FOURTH 7.16.1 +CURLVERSION_NINTH 7.75.0 +CURLVERSION_NOW 7.10 +CURLVERSION_SECOND 7.11.1 +CURLVERSION_SEVENTH 7.70.0 +CURLVERSION_SIXTH 7.66.0 +CURLVERSION_TENTH 7.77.0 +CURLVERSION_THIRD 7.12.0 +CURLVERSION_TWELFTH 8.8.0 +CURLWARNING 7.66.0 +CURLWS_BINARY 7.86.0 +CURLWS_CLOSE 7.86.0 +CURLWS_CONT 7.86.0 +CURLWS_NOAUTOPONG 8.14.0 +CURLWS_OFFSET 7.86.0 +CURLWS_PING 7.86.0 +CURLWS_PONG 7.86.0 +CURLWS_RAW_MODE 7.86.0 +CURLWS_TEXT 7.86.0 +LIBCURL_COPYRIGHT 7.18.0 +LIBCURL_TIMESTAMP 7.16.2 +LIBCURL_VERSION 7.1.1 +LIBCURL_VERSION_MAJOR 7.11.0 +LIBCURL_VERSION_MINOR 7.11.0 +LIBCURL_VERSION_NUM 7.1.1 +LIBCURL_VERSION_PATCH 7.11.0 diff --git a/curl/docs/mk-ca-bundle.md b/curl/docs/mk-ca-bundle.md new file mode 100644 index 0000000..fe68635 --- /dev/null +++ b/curl/docs/mk-ca-bundle.md @@ -0,0 +1,127 @@ +--- +c: Copyright (C) Daniel Stenberg, , et al. +SPDX-License-Identifier: curl +Title: mk-ca-bundle +Section: 1 +Source: mk-ca-bundle +See-also: + - curl (1) +Added-in: n/a +--- + +# NAME + +mk-ca-bundle - convert Mozilla's certificate bundle to PEM format + +# SYNOPSIS + +mk-ca-bundle [options] [output] + +# DESCRIPTION + +This tool downloads the *certdata.txt* file from Mozilla's source tree over +HTTPS, then parses it and extracts the included certificates into PEM format. +By default, only CA root certificates trusted to issue SSL server +authentication certificates are extracted. These are then processed with the +OpenSSL command line tool to produce the final ca-bundle output file. + +The default *output* name is **ca-bundle.crt**. By setting it to '-' (a single +dash) you get the output sent to STDOUT instead of a file. + +The PEM format this scripts uses for output makes the result readily available +for use by just about all OpenSSL or GnuTLS powered applications, such as curl +and others. + +# OPTIONS + +The following options are supported: + +## -b + +backup an existing version of *output* + +## -d [name] + +specify which Mozilla tree to pull *certdata.txt* from (or a custom URL). +Valid names are: **aurora**, **beta**, **central**, **Mozilla**, **nss**, +**release** (default). They are shortcuts for which source tree to get the +certificate data from. + +## -f + +force rebuild even if *certdata.txt* is current (Added in version 1.17) + +## -i + +print version info about used modules + +## -k + +Allow insecure data transfer. By default (since 1.27) this command fails if +the HTTPS transfer fails. This overrides that decision (and opens for +man-in-the-middle attacks). + +## -l + +print license info about *certdata.txt* + +## -m + +(Added in 1.26) Include meta data comments in the output. The meta data is +specific information about each certificate that is stored in the original +file as comments and using this option makes those comments get passed on to +the output file. The meta data is not parsed in any way by mk-ca-bundle. + +## -n + +Do not download *certdata.txt* - use the existing. + +## -p [purposes]:[levels] + +list of Mozilla trust purposes and levels for certificates to include in +output. Takes the form of a comma separated list of purposes, a colon, and a +comma separated list of levels. The default is to include all certificates +trusted to issue SSL Server certificates (*SERVER_AUTH:TRUSTED_DELEGATOR*). + +Valid purposes are: **ALL**, **DIGITAL_SIGNATURE**, **NON_REPUDIATION**, +**KEY_ENCIPHERMENT**, **DATA_ENCIPHERMENT**, **KEY_AGREEMENT**, +**KEY_CERT_SIGN**, **CRL_SIGN**, **SERVER_AUTH** (default), **CLIENT_AUTH**, +**CODE_SIGNING**, **EMAIL_PROTECTION**, **IPSEC_END_SYSTEM**, +**IPSEC_TUNNEL**, **IPSEC_USER**, **TIME_STAMPING**, **STEP_UP_APPROVED** + +Valid trust levels are: **ALL**, **TRUSTED_DELEGATOR** (default), **NOT_TRUSTED**, +**MUST_VERIFY_TRUST**, **TRUSTED** + +## -q + +be really quiet (no progress output at all) + +## -t + +include plain text listing of certificates + +## -s [algorithms] + +A comma separated list of signature algorithms with which to hash/fingerprint +each certificate and output when run in plain text mode. + +Valid algorithms are: +ALL, NONE, MD5 (default), SHA1, SHA256, SHA384, SHA512 + +## -u + +unlink (remove) *certdata.txt* after processing + +## -v + +be verbose and print out processed certificate authorities + +# EXIT STATUS + +Returns 0 on success. Returns 1 if it fails to download data. + +# FILE FORMAT + +The file format used by Mozilla for this trust information is documented here: + +https://p11-glue.freedesktop.org/doc/storing-trust-policy/storing-trust-existing.html diff --git a/curl/docs/options-in-versions.txt b/curl/docs/options-in-versions.txt new file mode 100644 index 0000000..a9ef8db --- /dev/null +++ b/curl/docs/options-in-versions.txt @@ -0,0 +1,281 @@ + _ _ ____ _ + ___| | | | _ \| | + / __| | | | |_) | | + | (__| |_| | _ <| |___ + \___|\___/|_| \_\_____| + + This document lists all command line options present in curl, together with + exact information about the first curl version that supports it. The options + are sorted alphabetically on the long name. + + Long (short) Introduced + +--abstract-unix-socket 7.53.0 +--alt-svc 7.64.1 +--anyauth 7.10.6 +--append (-a) 4.8 +--aws-sigv4 7.75.0 +--basic 7.10.6 +--ca-native 8.2.0 +--cacert 7.5 +--capath 7.9.8 +--cert (-E) 5.0 +--cert-status 7.41.0 +--cert-type 7.9.3 +--ciphers 7.9 +--compressed 7.10 +--compressed-ssh 7.56.0 +--config (-K) 4.10 +--connect-timeout 7.7 +--connect-to 7.49.0 +--continue-at (-C) 4.8 +--cookie (-b) 4.9 +--cookie-jar (-c) 7.9 +--create-dirs 7.10.3 +--create-file-mode 7.75.0 +--crlf 5.7 +--crlfile 7.19.7 +--curves 7.73.0 +--data (-d) 4.0 +--data-ascii 7.2 +--data-binary 7.2 +--data-raw 7.43.0 +--data-urlencode 7.18.0 +--delegation 7.22.0 +--digest 7.10.6 +--disable (-q) 5.0 +--disable-eprt 7.10.5 +--disable-epsv 7.9.2 +--disallow-username-in-url 7.61.0 +--dns-interface 7.33.0 +--dns-ipv4-addr 7.33.0 +--dns-ipv6-addr 7.33.0 +--dns-servers 7.33.0 +--doh-cert-status 7.76.0 +--doh-insecure 7.76.0 +--doh-url 7.62.0 +--dump-ca-embed 8.10.0 +--dump-header (-D) 5.7 +--ech 8.8.0 +--egd-file 7.7 +--engine 7.9.3 +--etag-compare 7.68.0 +--etag-save 7.68.0 +--expect100-timeout 7.47.0 +--fail (-f) 4.0 +--fail-early 7.52.0 +--fail-with-body 7.76.0 +--false-start 7.42.0 +--form (-F) 5.0 +--form-escape 7.81.0 +--form-string 7.13.2 +--ftp-account 7.13.0 +--ftp-alternative-to-user 7.15.5 +--ftp-create-dirs 7.10.7 +--ftp-method 7.15.1 +--ftp-pasv 7.11.0 +--ftp-port (-P) 4.0 +--ftp-pret 7.20.0 +--ftp-skip-pasv-ip 7.15.0 +--ftp-ssl-ccc 7.16.1 +--ftp-ssl-ccc-mode 7.16.2 +--ftp-ssl-control 7.16.0 +--get (-G) 7.8.1 +--globoff (-g) 7.6 +--happy-eyeballs-timeout-ms 7.59.0 +--haproxy-protocol 7.60.0 +--haproxy-clientip 8.2.0 +--head (-I) 4.0 +--header (-H) 5.0 +--help (-h) 4.0 +--hostpubmd5 7.17.1 +--hostpubsha256 7.80.0 +--hsts 7.74.0 +--http0.9 7.64.0 +--http1.0 (-0) 7.9.1 +--http1.1 7.33.0 +--http2 7.33.0 +--http2-prior-knowledge 7.49.0 +--http3 7.66.0 +--http3-only 7.88.0 +--ignore-content-length 7.14.1 +--ip-tos 8.9.0 +--ipfs-gateway 8.4.0 +--insecure (-k) 7.10 +--interface 7.3 +--ipv4 (-4) 7.10.8 +--ipv6 (-6) 7.10.8 +--json 7.82.0 +--junk-session-cookies (-j) 7.9.7 +--keepalive-cnt 8.9.0 +--keepalive-time 7.18.0 +--key 7.9.3 +--key-type 7.9.3 +--krb 7.3 +--libcurl 7.16.1 +--limit-rate 7.10 +--list-only (-l) 4.0 +--local-port 7.15.2 +--location (-L) 4.9 +--location-trusted 7.10.4 +--login-options 7.34.0 +--mail-auth 7.25.0 +--mail-from 7.20.0 +--mail-rcpt 7.20.0 +--mail-rcpt-allowfails 7.69.0 +--manual (-M) 5.2 +--max-filesize 7.10.8 +--max-redirs 7.5 +--max-time (-m) 4.0 +--metalink 7.27.0 +--mptcp 8.9.0 +--negotiate 7.10.6 +--netrc (-n) 4.6 +--netrc-file 7.21.5 +--netrc-optional 7.9.8 +--next (-:) 7.36.0 +--no-alpn 7.36.0 +--no-buffer (-N) 6.5 +--no-clobber 7.83.0 +--no-keepalive 7.18.0 +--no-npn 7.36.0 +--no-progress-meter 7.67.0 +--no-sessionid 7.16.0 +--noproxy 7.19.4 +--ntlm 7.10.6 +--ntlm-wb 7.22.0 +--oauth2-bearer 7.33.0 +--output (-o) 4.0 +--output-dir 7.73.0 +--parallel (-Z) 7.66.0 +--parallel-immediate 7.68.0 +--parallel-max 7.66.0 +--pass 7.9.3 +--path-as-is 7.42.0 +--pinnedpubkey 7.39.0 +--post301 7.17.1 +--post302 7.19.1 +--post303 7.26.0 +--preproxy 7.52.0 +--progress-bar (-#) 5.10 +--proto 7.21.0 +--proto-default 7.45.0 +--proto-redir 7.21.0 +--proxy (-x) 4.0 +--proxy-anyauth 7.13.2 +--proxy-basic 7.12.0 +--proxy-ca-native 8.2.0 +--proxy-cacert 7.52.0 +--proxy-capath 7.52.0 +--proxy-cert 7.52.0 +--proxy-cert-type 7.52.0 +--proxy-ciphers 7.52.0 +--proxy-crlfile 7.52.0 +--proxy-digest 7.12.0 +--proxy-header 7.37.0 +--proxy-http2 8.1.0 +--proxy-insecure 7.52.0 +--proxy-key 7.52.0 +--proxy-key-type 7.52.0 +--proxy-negotiate 7.17.1 +--proxy-ntlm 7.10.7 +--proxy-pass 7.52.0 +--proxy-pinnedpubkey 7.59.0 +--proxy-service-name 7.43.0 +--proxy-ssl-allow-beast 7.52.0 +--proxy-ssl-auto-client-cert 7.77.0 +--proxy-tls13-ciphers 7.61.0 +--proxy-tlsauthtype 7.52.0 +--proxy-tlspassword 7.52.0 +--proxy-tlsuser 7.52.0 +--proxy-tlsv1 7.52.0 +--proxy-user (-U) 4.0 +--proxy1.0 7.19.4 +--proxytunnel (-p) 7.3 +--pubkey 7.16.2 +--quote (-Q) 5.3 +--random-file 7.7 +--range (-r) 4.0 +--rate 7.84.0 +--raw 7.16.2 +--referer (-e) 4.0 +--remote-header-name (-J) 7.20.0 +--remote-name (-O) 4.0 +--remote-name-all 7.19.0 +--remote-time (-R) 7.9 +--remove-on-error 7.83.0 +--request (-X) 6.0 +--request-target 7.55.0 +--resolve 7.21.3 +--retry 7.12.3 +--retry-all-errors 7.71.0 +--retry-connrefused 7.52.0 +--retry-delay 7.12.3 +--retry-max-time 7.12.3 +--sasl-authzid 7.66.0 +--sasl-ir 7.31.0 +--service-name 7.43.0 +--show-error (-S) 5.9 +--show-headers (-i) 4.8 +--silent (-s) 4.0 +--sigalgs 8.14.0 +--skip-existing 8.10.0 +--socks4 7.15.2 +--socks4a 7.18.0 +--socks5 7.18.0 +--socks5-basic 7.55.0 +--socks5-gssapi 7.55.0 +--socks5-gssapi-nec 7.19.4 +--socks5-gssapi-service 7.19.4 +--socks5-hostname 7.18.0 +--speed-limit (-Y) 4.7 +--speed-time (-y) 4.7 +--ssl 7.20.0 +--ssl-allow-beast 7.25.0 +--ssl-auto-client-cert 7.77.0 +--ssl-no-revoke 7.44.0 +--ssl-reqd 7.20.0 +--ssl-revoke-best-effort 7.70.0 +--ssl-sessions 8.12.0 +--sslv2 (-2) 5.9 +--sslv3 (-3) 5.9 +--stderr 6.2 +--styled-output 7.61.0 +--suppress-connect-headers 7.54.0 +--tcp-fastopen 7.49.0 +--tcp-nodelay 7.11.2 +--telnet-option (-t) 7.7 +--tftp-blksize 7.20.0 +--tftp-no-options 7.48.0 +--time-cond (-z) 5.8 +--tls-earlydata 8.11.0 +--tls-max 7.54.0 +--tls13-ciphers 7.61.0 +--tlsauthtype 7.21.4 +--tlspassword 7.21.4 +--tlsuser 7.21.4 +--tlsv1 (-1) 7.9.2 +--tlsv1.0 7.34.0 +--tlsv1.1 7.34.0 +--tlsv1.2 7.34.0 +--tlsv1.3 7.52.0 +--tr-encoding 7.21.6 +--trace 7.9.7 +--trace-ascii 7.9.7 +--trace-config 8.3.0 +--trace-ids 8.2.0 +--trace-time 7.14.0 +--unix-socket 7.40.0 +--upload-file (-T) 4.0 +--upload-flags 8.13.0 +--url 7.5 +--url-query 7.87.0 +--use-ascii (-B) 5.0 +--user (-u) 4.0 +--user-agent (-A) 4.5.1 +--variable 8.3.0 +--verbose (-v) 4.0 +--version (-V) 4.0 +--vlan-priority 8.9.0 +--write-out (-w) 6.5 +--xattr 7.21.3 diff --git a/curl/docs/wcurl.md b/curl/docs/wcurl.md new file mode 100644 index 0000000..4111af5 --- /dev/null +++ b/curl/docs/wcurl.md @@ -0,0 +1,145 @@ +--- +c: Copyright (C) Samuel Henrique , Sergio Durigan Junior and many contributors, see the AUTHORS file. +SPDX-License-Identifier: curl +Title: wcurl +Section: 1 +Source: wcurl +See-also: + - curl (1) + - trurl (1) +Added-in: n/a +--- + +# NAME + +**wcurl** - a simple wrapper around curl to easily download files. + +# SYNOPSIS + +**wcurl \...** + +**wcurl [--curl-options \]... [--dry-run] [--no-decode-filename] [-o|-O|--output \] [--] \...** + +**wcurl [--curl-options=\]... [--dry-run] [--no-decode-filename] [--output=\] [--] \...** + +**wcurl -V|--version** + +**wcurl -h|--help** + +# DESCRIPTION + +**wcurl** is a simple curl wrapper which lets you use curl to download files +without having to remember any parameters. + +Simply call **wcurl** with a list of URLs you want to download and **wcurl** +picks sane defaults. + +If you need anything more complex, you can provide any of curl's supported +parameters via the **--curl-options** option. Just beware that you likely +should be using curl directly if your use case is not covered. + +By default, **wcurl** does: + +## * Percent-encode whitespaces in URLs; + +## * Download multiple URLs in parallel + if the installed curl's version is \>= 7.66.0 (--parallel); + +## * Follow redirects; + +## * Automatically choose a filename as output; + +## * Avoid overwriting files + if the installed curl's version is \>= 7.83.0 (--no-clobber); + +## * Perform retries; + +## * Set the downloaded file timestamp + to the value provided by the server, if available; + +## * Default to https + if the URL does not contain any scheme; + +## * Disable curl's URL globbing parser + so {} and [] characters in URLs are not treated specially; + +## * Percent-decode the resulting filename; + +## * Use 'index.html' as the default filename + if there is none in the URL. + +# OPTIONS + +## --curl-options, --curl-options=\... + +Specify extra options to be passed when invoking curl. May be specified more +than once. + +## -o, -O, --output, --output=\ + +Use the provided output path instead of getting it from the URL. If multiple +URLs are provided, resulting files share the same name with a number appended to +the end (curl \>= 7.83.0). If this option is provided multiple times, only the +last value is considered. + +## --no-decode-filename + +Don't percent-decode the output filename, even if the percent-encoding in the +URL was done by **wcurl**, e.g.: The URL contained whitespaces. + +## --dry-run + +Do not actually execute curl, just print what would be invoked. + +## -V, \--version + +Print version information. + +## -h, \--help + +Print help message. + +# CURL_OPTIONS + +Any option supported by curl can be set here. This is not used by **wcurl**; it +is instead forwarded to the curl invocation. + +# URL + +URL to be downloaded. Anything that is not a parameter is considered +an URL. Whitespaces are percent-encoded and the URL is passed to curl, which +then performs the parsing. May be specified more than once. + +# EXAMPLES + +Download a single file: + +**wcurl example.com/filename.txt** + +Download two files in parallel: + +**wcurl example.com/filename1.txt example.com/filename2.txt** + +Download a file passing the **--progress-bar** and **--http2** flags to curl: + +**wcurl --curl-options="--progress-bar --http2" example.com/filename.txt** + +Resume from an interrupted download (if more options are used, this needs to +be the last one in the list): + +**wcurl --curl-options="--continue-at -" example.com/filename.txt** + +# AUTHORS + + Samuel Henrique \ + Sergio Durigan Junior \ + and many contributors, see the AUTHORS file. + +# REPORTING BUGS + +If you experience any problems with **wcurl** that you do not experience with +curl, submit an issue on Github: https://github.com/curl/wcurl + +# COPYRIGHT + +**wcurl** is licensed under the curl license diff --git a/curl/include/brotli/decode.h b/curl/include/brotli/decode.h new file mode 100644 index 0000000..af1aa23 --- /dev/null +++ b/curl/include/brotli/decode.h @@ -0,0 +1,409 @@ +/* Copyright 2013 Google Inc. All Rights Reserved. + + Distributed under MIT license. + See file LICENSE for detail or copy at https://opensource.org/licenses/MIT +*/ + +/** + * @file + * API for Brotli decompression. + */ + +#ifndef BROTLI_DEC_DECODE_H_ +#define BROTLI_DEC_DECODE_H_ + +#include +#include +#include + +#if defined(__cplusplus) || defined(c_plusplus) +extern "C" { +#endif + +/** + * Opaque structure that holds decoder state. + * + * Allocated and initialized with ::BrotliDecoderCreateInstance. + * Cleaned up and deallocated with ::BrotliDecoderDestroyInstance. + */ +typedef struct BrotliDecoderStateStruct BrotliDecoderState; + +/** + * Result type for ::BrotliDecoderDecompress and + * ::BrotliDecoderDecompressStream functions. + */ +typedef enum { + /** Decoding error, e.g. corrupted input or memory allocation problem. */ + BROTLI_DECODER_RESULT_ERROR = 0, + /** Decoding successfully completed. */ + BROTLI_DECODER_RESULT_SUCCESS = 1, + /** Partially done; should be called again with more input. */ + BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT = 2, + /** Partially done; should be called again with more output. */ + BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT = 3 +} BrotliDecoderResult; + +/** + * Template that evaluates items of ::BrotliDecoderErrorCode. + * + * Example: @code {.cpp} + * // Log Brotli error code. + * switch (brotliDecoderErrorCode) { + * #define CASE_(PREFIX, NAME, CODE) \ + * case BROTLI_DECODER ## PREFIX ## NAME: \ + * LOG(INFO) << "error code:" << #NAME; \ + * break; + * #define NEWLINE_ + * BROTLI_DECODER_ERROR_CODES_LIST(CASE_, NEWLINE_) + * #undef CASE_ + * #undef NEWLINE_ + * default: LOG(FATAL) << "unknown brotli error code"; + * } + * @endcode + */ +#define BROTLI_DECODER_ERROR_CODES_LIST(BROTLI_ERROR_CODE, SEPARATOR) \ + BROTLI_ERROR_CODE(_, NO_ERROR, 0) SEPARATOR \ + /* Same as BrotliDecoderResult values */ \ + BROTLI_ERROR_CODE(_, SUCCESS, 1) SEPARATOR \ + BROTLI_ERROR_CODE(_, NEEDS_MORE_INPUT, 2) SEPARATOR \ + BROTLI_ERROR_CODE(_, NEEDS_MORE_OUTPUT, 3) SEPARATOR \ + \ + /* Errors caused by invalid input */ \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, EXUBERANT_NIBBLE, -1) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, RESERVED, -2) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, EXUBERANT_META_NIBBLE, -3) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, SIMPLE_HUFFMAN_ALPHABET, -4) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, SIMPLE_HUFFMAN_SAME, -5) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, CL_SPACE, -6) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, HUFFMAN_SPACE, -7) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, CONTEXT_MAP_REPEAT, -8) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, BLOCK_LENGTH_1, -9) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, BLOCK_LENGTH_2, -10) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, TRANSFORM, -11) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, DICTIONARY, -12) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, WINDOW_BITS, -13) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, PADDING_1, -14) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, PADDING_2, -15) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, DISTANCE, -16) SEPARATOR \ + \ + /* -17 code is reserved */ \ + \ + BROTLI_ERROR_CODE(_ERROR_, COMPOUND_DICTIONARY, -18) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_, DICTIONARY_NOT_SET, -19) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_, INVALID_ARGUMENTS, -20) SEPARATOR \ + \ + /* Memory allocation problems */ \ + BROTLI_ERROR_CODE(_ERROR_ALLOC_, CONTEXT_MODES, -21) SEPARATOR \ + /* Literal, insert and distance trees together */ \ + BROTLI_ERROR_CODE(_ERROR_ALLOC_, TREE_GROUPS, -22) SEPARATOR \ + /* -23..-24 codes are reserved for distinct tree groups */ \ + BROTLI_ERROR_CODE(_ERROR_ALLOC_, CONTEXT_MAP, -25) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_ALLOC_, RING_BUFFER_1, -26) SEPARATOR \ + BROTLI_ERROR_CODE(_ERROR_ALLOC_, RING_BUFFER_2, -27) SEPARATOR \ + /* -28..-29 codes are reserved for dynamic ring-buffer allocation */ \ + BROTLI_ERROR_CODE(_ERROR_ALLOC_, BLOCK_TYPE_TREES, -30) SEPARATOR \ + \ + /* "Impossible" states */ \ + BROTLI_ERROR_CODE(_ERROR_, UNREACHABLE, -31) + +/** + * Error code for detailed logging / production debugging. + * + * See ::BrotliDecoderGetErrorCode and ::BROTLI_LAST_ERROR_CODE. + */ +typedef enum { +#define BROTLI_COMMA_ , +#define BROTLI_ERROR_CODE_ENUM_ITEM_(PREFIX, NAME, CODE) \ + BROTLI_DECODER ## PREFIX ## NAME = CODE + BROTLI_DECODER_ERROR_CODES_LIST(BROTLI_ERROR_CODE_ENUM_ITEM_, BROTLI_COMMA_) +} BrotliDecoderErrorCode; +#undef BROTLI_ERROR_CODE_ENUM_ITEM_ +#undef BROTLI_COMMA_ + +/** + * The value of the last error code, negative integer. + * + * All other error code values are in the range from ::BROTLI_LAST_ERROR_CODE + * to @c -1. There are also 4 other possible non-error codes @c 0 .. @c 3 in + * ::BrotliDecoderErrorCode enumeration. + */ +#define BROTLI_LAST_ERROR_CODE BROTLI_DECODER_ERROR_UNREACHABLE + +/** Options to be used with ::BrotliDecoderSetParameter. */ +typedef enum BrotliDecoderParameter { + /** + * Disable "canny" ring buffer allocation strategy. + * + * Ring buffer is allocated according to window size, despite the real size of + * the content. + */ + BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION = 0, + /** + * Flag that determines if "Large Window Brotli" is used. + */ + BROTLI_DECODER_PARAM_LARGE_WINDOW = 1 +} BrotliDecoderParameter; + +/** + * Sets the specified parameter to the given decoder instance. + * + * @param state decoder instance + * @param param parameter to set + * @param value new parameter value + * @returns ::BROTLI_FALSE if parameter is unrecognized, or value is invalid + * @returns ::BROTLI_TRUE if value is accepted + */ +BROTLI_DEC_API BROTLI_BOOL BrotliDecoderSetParameter( + BrotliDecoderState* state, BrotliDecoderParameter param, uint32_t value); + +/** + * Adds LZ77 prefix dictionary, adds or replaces built-in static dictionary and + * transforms. + * + * Attached dictionary ownership is not transferred. + * Data provided to this method should be kept accessible until + * decoding is finished and decoder instance is destroyed. + * + * @note Dictionaries can NOT be attached after actual decoding is started. + * + * @param state decoder instance + * @param type dictionary data format + * @param data_size length of memory region pointed by @p data + * @param data dictionary data in format corresponding to @p type + * @returns ::BROTLI_FALSE if dictionary is corrupted, + * or dictionary count limit is reached + * @returns ::BROTLI_TRUE if dictionary is accepted / attached + */ +BROTLI_DEC_API BROTLI_BOOL BrotliDecoderAttachDictionary( + BrotliDecoderState* state, BrotliSharedDictionaryType type, + size_t data_size, const uint8_t data[BROTLI_ARRAY_PARAM(data_size)]); + +/** + * Creates an instance of ::BrotliDecoderState and initializes it. + * + * The instance can be used once for decoding and should then be destroyed with + * ::BrotliDecoderDestroyInstance, it cannot be reused for a new decoding + * session. + * + * @p alloc_func and @p free_func @b MUST be both zero or both non-zero. In the + * case they are both zero, default memory allocators are used. @p opaque is + * passed to @p alloc_func and @p free_func when they are called. @p free_func + * has to return without doing anything when asked to free a NULL pointer. + * + * @param alloc_func custom memory allocation function + * @param free_func custom memory free function + * @param opaque custom memory manager handle + * @returns @c 0 if instance can not be allocated or initialized + * @returns pointer to initialized ::BrotliDecoderState otherwise + */ +BROTLI_DEC_API BrotliDecoderState* BrotliDecoderCreateInstance( + brotli_alloc_func alloc_func, brotli_free_func free_func, void* opaque); + +/** + * Deinitializes and frees ::BrotliDecoderState instance. + * + * @param state decoder instance to be cleaned up and deallocated + */ +BROTLI_DEC_API void BrotliDecoderDestroyInstance(BrotliDecoderState* state); + +/** + * Performs one-shot memory-to-memory decompression. + * + * Decompresses the data in @p encoded_buffer into @p decoded_buffer, and sets + * @p *decoded_size to the decompressed length. + * + * @param encoded_size size of @p encoded_buffer + * @param encoded_buffer compressed data buffer with at least @p encoded_size + * addressable bytes + * @param[in, out] decoded_size @b in: size of @p decoded_buffer; \n + * @b out: length of decompressed data written to + * @p decoded_buffer + * @param decoded_buffer decompressed data destination buffer + * @returns ::BROTLI_DECODER_RESULT_ERROR if input is corrupted, memory + * allocation failed, or @p decoded_buffer is not large enough; + * @returns ::BROTLI_DECODER_RESULT_SUCCESS otherwise + */ +BROTLI_DEC_API BrotliDecoderResult BrotliDecoderDecompress( + size_t encoded_size, + const uint8_t encoded_buffer[BROTLI_ARRAY_PARAM(encoded_size)], + size_t* decoded_size, + uint8_t decoded_buffer[BROTLI_ARRAY_PARAM(*decoded_size)]); + +/** + * Decompresses the input stream to the output stream. + * + * The values @p *available_in and @p *available_out must specify the number of + * bytes addressable at @p *next_in and @p *next_out respectively. + * When @p *available_out is @c 0, @p next_out is allowed to be @c NULL. + * + * After each call, @p *available_in will be decremented by the amount of input + * bytes consumed, and the @p *next_in pointer will be incremented by that + * amount. Similarly, @p *available_out will be decremented by the amount of + * output bytes written, and the @p *next_out pointer will be incremented by + * that amount. + * + * @p total_out, if it is not a null-pointer, will be set to the number + * of bytes decompressed since the last @p state initialization. + * + * @note Input is never overconsumed, so @p next_in and @p available_in could be + * passed to the next consumer after decoding is complete. + * + * @param state decoder instance + * @param[in, out] available_in @b in: amount of available input; \n + * @b out: amount of unused input + * @param[in, out] next_in pointer to the next compressed byte + * @param[in, out] available_out @b in: length of output buffer; \n + * @b out: remaining size of output buffer + * @param[in, out] next_out output buffer cursor; + * can be @c NULL if @p available_out is @c 0 + * @param[out] total_out number of bytes decompressed so far; can be @c NULL + * @returns ::BROTLI_DECODER_RESULT_ERROR if input is corrupted, memory + * allocation failed, arguments were invalid, etc.; + * use ::BrotliDecoderGetErrorCode to get detailed error code + * @returns ::BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT decoding is blocked until + * more input data is provided + * @returns ::BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT decoding is blocked until + * more output space is provided + * @returns ::BROTLI_DECODER_RESULT_SUCCESS decoding is finished, no more + * input might be consumed and no more output will be produced + */ +BROTLI_DEC_API BrotliDecoderResult BrotliDecoderDecompressStream( + BrotliDecoderState* state, size_t* available_in, const uint8_t** next_in, + size_t* available_out, uint8_t** next_out, size_t* total_out); + +/** + * Checks if decoder has more output. + * + * @param state decoder instance + * @returns ::BROTLI_TRUE, if decoder has some unconsumed output + * @returns ::BROTLI_FALSE otherwise + */ +BROTLI_DEC_API BROTLI_BOOL BrotliDecoderHasMoreOutput( + const BrotliDecoderState* state); + +/** + * Acquires pointer to internal output buffer. + * + * This method is used to make language bindings easier and more efficient: + * -# push data to ::BrotliDecoderDecompressStream, + * until ::BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT is reported + * -# use ::BrotliDecoderTakeOutput to peek bytes and copy to language-specific + * entity + * + * Also this could be useful if there is an output stream that is able to + * consume all the provided data (e.g. when data is saved to file system). + * + * @attention After every call to ::BrotliDecoderTakeOutput @p *size bytes of + * output are considered consumed for all consecutive calls to the + * instance methods; returned pointer becomes invalidated as well. + * + * @note Decoder output is not guaranteed to be contiguous. This means that + * after the size-unrestricted call to ::BrotliDecoderTakeOutput, + * immediate next call to ::BrotliDecoderTakeOutput may return more data. + * + * @param state decoder instance + * @param[in, out] size @b in: number of bytes caller is ready to take, @c 0 if + * any amount could be handled; \n + * @b out: amount of data pointed by returned pointer and + * considered consumed; \n + * out value is never greater than in value, unless it is @c 0 + * @returns pointer to output data + */ +BROTLI_DEC_API const uint8_t* BrotliDecoderTakeOutput( + BrotliDecoderState* state, size_t* size); + +/** + * Checks if instance has already consumed input. + * + * Instance that returns ::BROTLI_FALSE is considered "fresh" and could be + * reused. + * + * @param state decoder instance + * @returns ::BROTLI_TRUE if decoder has already used some input bytes + * @returns ::BROTLI_FALSE otherwise + */ +BROTLI_DEC_API BROTLI_BOOL BrotliDecoderIsUsed(const BrotliDecoderState* state); + +/** + * Checks if decoder instance reached the final state. + * + * @param state decoder instance + * @returns ::BROTLI_TRUE if decoder is in a state where it reached the end of + * the input and produced all of the output + * @returns ::BROTLI_FALSE otherwise + */ +BROTLI_DEC_API BROTLI_BOOL BrotliDecoderIsFinished( + const BrotliDecoderState* state); + +/** + * Acquires a detailed error code. + * + * Should be used only after ::BrotliDecoderDecompressStream returns + * ::BROTLI_DECODER_RESULT_ERROR. + * + * See also ::BrotliDecoderErrorString + * + * @param state decoder instance + * @returns last saved error code + */ +BROTLI_DEC_API BrotliDecoderErrorCode BrotliDecoderGetErrorCode( + const BrotliDecoderState* state); + +/** + * Converts error code to a c-string. + */ +BROTLI_DEC_API const char* BrotliDecoderErrorString(BrotliDecoderErrorCode c); + +/** + * Gets a decoder library version. + * + * Look at BROTLI_MAKE_HEX_VERSION for more information. + */ +BROTLI_DEC_API uint32_t BrotliDecoderVersion(void); + +/** + * Callback to fire on metadata block start. + * + * After this callback is fired, if @p size is not @c 0, it is followed by + * ::brotli_decoder_metadata_chunk_func as more metadata block contents become + * accessible. + * + * @param opaque callback handle + * @param size size of metadata block + */ +typedef void (*brotli_decoder_metadata_start_func)(void* opaque, size_t size); + +/** + * Callback to fire on metadata block chunk becomes available. + * + * This function can be invoked multiple times per metadata block; block should + * be considered finished when sum of @p size matches the announced metadata + * block size. Chunks contents pointed by @p data are transient and shouln not + * be accessed after leaving the callback. + * + * @param opaque callback handle + * @param data pointer to metadata contents + * @param size size of metadata block chunk, at least @c 1 + */ +typedef void (*brotli_decoder_metadata_chunk_func)(void* opaque, + const uint8_t* data, + size_t size); + +/** + * Sets callback for receiving metadata blocks. + * + * @param state decoder instance + * @param start_func callback on metadata block start + * @param chunk_func callback on metadata block chunk + * @param opaque callback handle + */ +BROTLI_DEC_API void BrotliDecoderSetMetadataCallbacks( + BrotliDecoderState* state, + brotli_decoder_metadata_start_func start_func, + brotli_decoder_metadata_chunk_func chunk_func, void* opaque); + +#if defined(__cplusplus) || defined(c_plusplus) +} /* extern "C" */ +#endif + +#endif /* BROTLI_DEC_DECODE_H_ */ diff --git a/curl/include/brotli/encode.h b/curl/include/brotli/encode.h new file mode 100644 index 0000000..dea9931 --- /dev/null +++ b/curl/include/brotli/encode.h @@ -0,0 +1,501 @@ +/* Copyright 2013 Google Inc. All Rights Reserved. + + Distributed under MIT license. + See file LICENSE for detail or copy at https://opensource.org/licenses/MIT +*/ + +/** + * @file + * API for Brotli compression. + */ + +#ifndef BROTLI_ENC_ENCODE_H_ +#define BROTLI_ENC_ENCODE_H_ + +#include +#include +#include + +#if defined(__cplusplus) || defined(c_plusplus) +extern "C" { +#endif + +/** Minimal value for ::BROTLI_PARAM_LGWIN parameter. */ +#define BROTLI_MIN_WINDOW_BITS 10 +/** + * Maximal value for ::BROTLI_PARAM_LGWIN parameter. + * + * @note equal to @c BROTLI_MAX_DISTANCE_BITS constant. + */ +#define BROTLI_MAX_WINDOW_BITS 24 +/** + * Maximal value for ::BROTLI_PARAM_LGWIN parameter + * in "Large Window Brotli" (32-bit). + */ +#define BROTLI_LARGE_MAX_WINDOW_BITS 30 +/** Minimal value for ::BROTLI_PARAM_LGBLOCK parameter. */ +#define BROTLI_MIN_INPUT_BLOCK_BITS 16 +/** Maximal value for ::BROTLI_PARAM_LGBLOCK parameter. */ +#define BROTLI_MAX_INPUT_BLOCK_BITS 24 +/** Minimal value for ::BROTLI_PARAM_QUALITY parameter. */ +#define BROTLI_MIN_QUALITY 0 +/** Maximal value for ::BROTLI_PARAM_QUALITY parameter. */ +#define BROTLI_MAX_QUALITY 11 + +/** Options for ::BROTLI_PARAM_MODE parameter. */ +typedef enum BrotliEncoderMode { + /** + * Default compression mode. + * + * In this mode compressor does not know anything in advance about the + * properties of the input. + */ + BROTLI_MODE_GENERIC = 0, + /** Compression mode for UTF-8 formatted text input. */ + BROTLI_MODE_TEXT = 1, + /** Compression mode used in WOFF 2.0. */ + BROTLI_MODE_FONT = 2 +} BrotliEncoderMode; + +/** Default value for ::BROTLI_PARAM_QUALITY parameter. */ +#define BROTLI_DEFAULT_QUALITY 11 +/** Default value for ::BROTLI_PARAM_LGWIN parameter. */ +#define BROTLI_DEFAULT_WINDOW 22 +/** Default value for ::BROTLI_PARAM_MODE parameter. */ +#define BROTLI_DEFAULT_MODE BROTLI_MODE_GENERIC + +/** Operations that can be performed by streaming encoder. */ +typedef enum BrotliEncoderOperation { + /** + * Process input. + * + * Encoder may postpone producing output, until it has processed enough input. + */ + BROTLI_OPERATION_PROCESS = 0, + /** + * Produce output for all processed input. + * + * Actual flush is performed when input stream is depleted and there is enough + * space in output stream. This means that client should repeat + * ::BROTLI_OPERATION_FLUSH operation until @p available_in becomes @c 0, and + * ::BrotliEncoderHasMoreOutput returns ::BROTLI_FALSE. If output is acquired + * via ::BrotliEncoderTakeOutput, then operation should be repeated after + * output buffer is drained. + * + * @warning Until flush is complete, client @b SHOULD @b NOT swap, + * reduce or extend input stream. + * + * When flush is complete, output data will be sufficient for decoder to + * reproduce all the given input. + */ + BROTLI_OPERATION_FLUSH = 1, + /** + * Finalize the stream. + * + * Actual finalization is performed when input stream is depleted and there is + * enough space in output stream. This means that client should repeat + * ::BROTLI_OPERATION_FINISH operation until @p available_in becomes @c 0, and + * ::BrotliEncoderHasMoreOutput returns ::BROTLI_FALSE. If output is acquired + * via ::BrotliEncoderTakeOutput, then operation should be repeated after + * output buffer is drained. + * + * @warning Until finalization is complete, client @b SHOULD @b NOT swap, + * reduce or extend input stream. + * + * Helper function ::BrotliEncoderIsFinished checks if stream is finalized and + * output fully dumped. + * + * Adding more input data to finalized stream is impossible. + */ + BROTLI_OPERATION_FINISH = 2, + /** + * Emit metadata block to stream. + * + * Metadata is opaque to Brotli: neither encoder, nor decoder processes this + * data or relies on it. It may be used to pass some extra information from + * encoder client to decoder client without interfering with main data stream. + * + * @note Encoder may emit empty metadata blocks internally, to pad encoded + * stream to byte boundary. + * + * @warning Until emitting metadata is complete client @b SHOULD @b NOT swap, + * reduce or extend input stream. + * + * @warning The whole content of input buffer is considered to be the content + * of metadata block. Do @b NOT @e append metadata to input stream, + * before it is depleted with other operations. + * + * Stream is soft-flushed before metadata block is emitted. Metadata block + * @b MUST be no longer than than 16MiB. + */ + BROTLI_OPERATION_EMIT_METADATA = 3 +} BrotliEncoderOperation; + +/** Options to be used with ::BrotliEncoderSetParameter. */ +typedef enum BrotliEncoderParameter { + /** + * Tune encoder for specific input. + * + * ::BrotliEncoderMode enumerates all available values. + */ + BROTLI_PARAM_MODE = 0, + /** + * The main compression speed-density lever. + * + * The higher the quality, the slower the compression. Range is + * from ::BROTLI_MIN_QUALITY to ::BROTLI_MAX_QUALITY. + */ + BROTLI_PARAM_QUALITY = 1, + /** + * Recommended sliding LZ77 window size. + * + * Encoder may reduce this value, e.g. if input is much smaller than + * window size. + * + * Window size is `(1 << value) - 16`. + * + * Range is from ::BROTLI_MIN_WINDOW_BITS to ::BROTLI_MAX_WINDOW_BITS. + */ + BROTLI_PARAM_LGWIN = 2, + /** + * Recommended input block size. + * + * Encoder may reduce this value, e.g. if input is much smaller than input + * block size. + * + * Range is from ::BROTLI_MIN_INPUT_BLOCK_BITS to + * ::BROTLI_MAX_INPUT_BLOCK_BITS. + * + * @note Bigger input block size allows better compression, but consumes more + * memory. \n The rough formula of memory used for temporary input + * storage is `3 << lgBlock`. + */ + BROTLI_PARAM_LGBLOCK = 3, + /** + * Flag that affects usage of "literal context modeling" format feature. + * + * This flag is a "decoding-speed vs compression ratio" trade-off. + */ + BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING = 4, + /** + * Estimated total input size for all ::BrotliEncoderCompressStream calls. + * + * The default value is 0, which means that the total input size is unknown. + */ + BROTLI_PARAM_SIZE_HINT = 5, + /** + * Flag that determines if "Large Window Brotli" is used. + */ + BROTLI_PARAM_LARGE_WINDOW = 6, + /** + * Recommended number of postfix bits (NPOSTFIX). + * + * Encoder may change this value. + * + * Range is from 0 to ::BROTLI_MAX_NPOSTFIX. + */ + BROTLI_PARAM_NPOSTFIX = 7, + /** + * Recommended number of direct distance codes (NDIRECT). + * + * Encoder may change this value. + * + * Range is from 0 to (15 << NPOSTFIX) in steps of (1 << NPOSTFIX). + */ + BROTLI_PARAM_NDIRECT = 8, + /** + * Number of bytes of input stream already processed by a different instance. + * + * @note It is important to configure all the encoder instances with same + * parameters (except this one) in order to allow all the encoded parts + * obey the same restrictions implied by header. + * + * If offset is not 0, then stream header is omitted. + * In any case output start is byte aligned, so for proper streams stitching + * "predecessor" stream must be flushed. + * + * Range is not artificially limited, but all the values greater or equal to + * maximal window size have the same effect. Values greater than 2**30 are not + * allowed. + */ + BROTLI_PARAM_STREAM_OFFSET = 9 +} BrotliEncoderParameter; + +/** + * Opaque structure that holds encoder state. + * + * Allocated and initialized with ::BrotliEncoderCreateInstance. + * Cleaned up and deallocated with ::BrotliEncoderDestroyInstance. + */ +typedef struct BrotliEncoderStateStruct BrotliEncoderState; + +/** + * Sets the specified parameter to the given encoder instance. + * + * @param state encoder instance + * @param param parameter to set + * @param value new parameter value + * @returns ::BROTLI_FALSE if parameter is unrecognized, or value is invalid + * @returns ::BROTLI_FALSE if value of parameter can not be changed at current + * encoder state (e.g. when encoding is started, window size might be + * already encoded and therefore it is impossible to change it) + * @returns ::BROTLI_TRUE if value is accepted + * @warning invalid values might be accepted in case they would not break + * encoding process. + */ +BROTLI_ENC_API BROTLI_BOOL BrotliEncoderSetParameter( + BrotliEncoderState* state, BrotliEncoderParameter param, uint32_t value); + +/** + * Creates an instance of ::BrotliEncoderState and initializes it. + * + * @p alloc_func and @p free_func @b MUST be both zero or both non-zero. In the + * case they are both zero, default memory allocators are used. @p opaque is + * passed to @p alloc_func and @p free_func when they are called. @p free_func + * has to return without doing anything when asked to free a NULL pointer. + * + * @param alloc_func custom memory allocation function + * @param free_func custom memory free function + * @param opaque custom memory manager handle + * @returns @c 0 if instance can not be allocated or initialized + * @returns pointer to initialized ::BrotliEncoderState otherwise + */ +BROTLI_ENC_API BrotliEncoderState* BrotliEncoderCreateInstance( + brotli_alloc_func alloc_func, brotli_free_func free_func, void* opaque); + +/** + * Deinitializes and frees ::BrotliEncoderState instance. + * + * @param state decoder instance to be cleaned up and deallocated + */ +BROTLI_ENC_API void BrotliEncoderDestroyInstance(BrotliEncoderState* state); + +/* Opaque type for pointer to different possible internal structures containing + dictionary prepared for the encoder */ +typedef struct BrotliEncoderPreparedDictionaryStruct + BrotliEncoderPreparedDictionary; + +/** + * Prepares a shared dictionary from the given file format for the encoder. + * + * @p alloc_func and @p free_func @b MUST be both zero or both non-zero. In the + * case they are both zero, default memory allocators are used. @p opaque is + * passed to @p alloc_func and @p free_func when they are called. @p free_func + * has to return without doing anything when asked to free a NULL pointer. + * + * @param type type of dictionary stored in data + * @param data_size size of @p data buffer + * @param data pointer to the dictionary data + * @param quality the maximum Brotli quality to prepare the dictionary for, + * use BROTLI_MAX_QUALITY by default + * @param alloc_func custom memory allocation function + * @param free_func custom memory free function + * @param opaque custom memory manager handle + */ +BROTLI_ENC_API BrotliEncoderPreparedDictionary* +BrotliEncoderPrepareDictionary(BrotliSharedDictionaryType type, + size_t data_size, const uint8_t data[BROTLI_ARRAY_PARAM(data_size)], + int quality, + brotli_alloc_func alloc_func, brotli_free_func free_func, void* opaque); + +BROTLI_ENC_API void BrotliEncoderDestroyPreparedDictionary( + BrotliEncoderPreparedDictionary* dictionary); + +/** + * Attaches a prepared dictionary of any type to the encoder. Can be used + * multiple times to attach multiple dictionaries. The dictionary type was + * determined by BrotliEncoderPrepareDictionary. Multiple raw prefix + * dictionaries and/or max 1 serialized dictionary with custom words can be + * attached. + * + * @returns ::BROTLI_FALSE in case of error + * @returns ::BROTLI_TRUE otherwise + */ +BROTLI_ENC_API BROTLI_BOOL BrotliEncoderAttachPreparedDictionary( + BrotliEncoderState* state, + const BrotliEncoderPreparedDictionary* dictionary); + +/** + * Calculates the output size bound for the given @p input_size. + * + * @warning Result is only valid if quality is at least @c 2 and, in + * case ::BrotliEncoderCompressStream was used, no flushes + * (::BROTLI_OPERATION_FLUSH) were performed. + * + * @param input_size size of projected input + * @returns @c 0 if result does not fit @c size_t + */ +BROTLI_ENC_API size_t BrotliEncoderMaxCompressedSize(size_t input_size); + +/** + * Performs one-shot memory-to-memory compression. + * + * Compresses the data in @p input_buffer into @p encoded_buffer, and sets + * @p *encoded_size to the compressed length. + * + * @note If ::BrotliEncoderMaxCompressedSize(@p input_size) returns non-zero + * value, then output is guaranteed to be no longer than that. + * + * @note If @p lgwin is greater than ::BROTLI_MAX_WINDOW_BITS then resulting + * stream might be incompatible with RFC 7932; to decode such streams, + * decoder should be configured with + * ::BROTLI_DECODER_PARAM_LARGE_WINDOW = @c 1 + * + * @param quality quality parameter value, e.g. ::BROTLI_DEFAULT_QUALITY + * @param lgwin lgwin parameter value, e.g. ::BROTLI_DEFAULT_WINDOW + * @param mode mode parameter value, e.g. ::BROTLI_DEFAULT_MODE + * @param input_size size of @p input_buffer + * @param input_buffer input data buffer with at least @p input_size + * addressable bytes + * @param[in, out] encoded_size @b in: size of @p encoded_buffer; \n + * @b out: length of compressed data written to + * @p encoded_buffer, or @c 0 if compression fails + * @param encoded_buffer compressed data destination buffer + * @returns ::BROTLI_FALSE in case of compression error + * @returns ::BROTLI_FALSE if output buffer is too small + * @returns ::BROTLI_TRUE otherwise + */ +BROTLI_ENC_API BROTLI_BOOL BrotliEncoderCompress( + int quality, int lgwin, BrotliEncoderMode mode, size_t input_size, + const uint8_t input_buffer[BROTLI_ARRAY_PARAM(input_size)], + size_t* encoded_size, + uint8_t encoded_buffer[BROTLI_ARRAY_PARAM(*encoded_size)]); + +/** + * Compresses input stream to output stream. + * + * The values @p *available_in and @p *available_out must specify the number of + * bytes addressable at @p *next_in and @p *next_out respectively. + * When @p *available_out is @c 0, @p next_out is allowed to be @c NULL. + * + * After each call, @p *available_in will be decremented by the amount of input + * bytes consumed, and the @p *next_in pointer will be incremented by that + * amount. Similarly, @p *available_out will be decremented by the amount of + * output bytes written, and the @p *next_out pointer will be incremented by + * that amount. + * + * @p total_out, if it is not a null-pointer, will be set to the number + * of bytes compressed since the last @p state initialization. + * + * + * + * Internally workflow consists of 3 tasks: + * -# (optionally) copy input data to internal buffer + * -# actually compress data and (optionally) store it to internal buffer + * -# (optionally) copy compressed bytes from internal buffer to output stream + * + * Whenever all 3 tasks can't move forward anymore, or error occurs, this + * method returns the control flow to caller. + * + * @p op is used to perform flush, finish the stream, or inject metadata block. + * See ::BrotliEncoderOperation for more information. + * + * Flushing the stream means forcing encoding of all input passed to encoder and + * completing the current output block, so it could be fully decoded by stream + * decoder. To perform flush set @p op to ::BROTLI_OPERATION_FLUSH. + * Under some circumstances (e.g. lack of output stream capacity) this operation + * would require several calls to ::BrotliEncoderCompressStream. The method must + * be called again until both input stream is depleted and encoder has no more + * output (see ::BrotliEncoderHasMoreOutput) after the method is called. + * + * Finishing the stream means encoding of all input passed to encoder and + * adding specific "final" marks, so stream decoder could determine that stream + * is complete. To perform finish set @p op to ::BROTLI_OPERATION_FINISH. + * Under some circumstances (e.g. lack of output stream capacity) this operation + * would require several calls to ::BrotliEncoderCompressStream. The method must + * be called again until both input stream is depleted and encoder has no more + * output (see ::BrotliEncoderHasMoreOutput) after the method is called. + * + * @warning When flushing and finishing, @p op should not change until operation + * is complete; input stream should not be swapped, reduced or + * extended as well. + * + * @param state encoder instance + * @param op requested operation + * @param[in, out] available_in @b in: amount of available input; \n + * @b out: amount of unused input + * @param[in, out] next_in pointer to the next input byte + * @param[in, out] available_out @b in: length of output buffer; \n + * @b out: remaining size of output buffer + * @param[in, out] next_out compressed output buffer cursor; + * can be @c NULL if @p available_out is @c 0 + * @param[out] total_out number of bytes produced so far; can be @c NULL + * @returns ::BROTLI_FALSE if there was an error + * @returns ::BROTLI_TRUE otherwise + */ +BROTLI_ENC_API BROTLI_BOOL BrotliEncoderCompressStream( + BrotliEncoderState* state, BrotliEncoderOperation op, size_t* available_in, + const uint8_t** next_in, size_t* available_out, uint8_t** next_out, + size_t* total_out); + +/** + * Checks if encoder instance reached the final state. + * + * @param state encoder instance + * @returns ::BROTLI_TRUE if encoder is in a state where it reached the end of + * the input and produced all of the output + * @returns ::BROTLI_FALSE otherwise + */ +BROTLI_ENC_API BROTLI_BOOL BrotliEncoderIsFinished(BrotliEncoderState* state); + +/** + * Checks if encoder has more output. + * + * @param state encoder instance + * @returns ::BROTLI_TRUE, if encoder has some unconsumed output + * @returns ::BROTLI_FALSE otherwise + */ +BROTLI_ENC_API BROTLI_BOOL BrotliEncoderHasMoreOutput( + BrotliEncoderState* state); + +/** + * Acquires pointer to internal output buffer. + * + * This method is used to make language bindings easier and more efficient: + * -# push data to ::BrotliEncoderCompressStream, + * until ::BrotliEncoderHasMoreOutput returns BROTLI_TRUE + * -# use ::BrotliEncoderTakeOutput to peek bytes and copy to language-specific + * entity + * + * Also this could be useful if there is an output stream that is able to + * consume all the provided data (e.g. when data is saved to file system). + * + * @attention After every call to ::BrotliEncoderTakeOutput @p *size bytes of + * output are considered consumed for all consecutive calls to the + * instance methods; returned pointer becomes invalidated as well. + * + * @note Encoder output is not guaranteed to be contiguous. This means that + * after the size-unrestricted call to ::BrotliEncoderTakeOutput, + * immediate next call to ::BrotliEncoderTakeOutput may return more data. + * + * @param state encoder instance + * @param[in, out] size @b in: number of bytes caller is ready to take, @c 0 if + * any amount could be handled; \n + * @b out: amount of data pointed by returned pointer and + * considered consumed; \n + * out value is never greater than in value, unless it is @c 0 + * @returns pointer to output data + */ +BROTLI_ENC_API const uint8_t* BrotliEncoderTakeOutput( + BrotliEncoderState* state, size_t* size); + +/* Returns the estimated peak memory usage (in bytes) of the BrotliCompress() + function, not counting the memory needed for the input and output. */ +BROTLI_ENC_EXTRA_API size_t BrotliEncoderEstimatePeakMemoryUsage( + int quality, int lgwin, size_t input_size); +/* Returns 0 if dictionary is not valid; otherwise returns allocation size. */ +BROTLI_ENC_EXTRA_API size_t BrotliEncoderGetPreparedDictionarySize( + const BrotliEncoderPreparedDictionary* dictionary); + +/** + * Gets an encoder library version. + * + * Look at BROTLI_MAKE_HEX_VERSION for more information. + */ +BROTLI_ENC_API uint32_t BrotliEncoderVersion(void); + +#if defined(__cplusplus) || defined(c_plusplus) +} /* extern "C" */ +#endif + +#endif /* BROTLI_ENC_ENCODE_H_ */ diff --git a/curl/include/brotli/port.h b/curl/include/brotli/port.h new file mode 100644 index 0000000..0d50019 --- /dev/null +++ b/curl/include/brotli/port.h @@ -0,0 +1,305 @@ +/* Copyright 2016 Google Inc. All Rights Reserved. + + Distributed under MIT license. + See file LICENSE for detail or copy at https://opensource.org/licenses/MIT +*/ + +/* Macros for compiler / platform specific API declarations. */ + +#ifndef BROTLI_COMMON_PORT_H_ +#define BROTLI_COMMON_PORT_H_ + +/* The following macros were borrowed from https://github.com/nemequ/hedley + * with permission of original author - Evan Nemerson */ + +/* >>> >>> >>> hedley macros */ + +#define BROTLI_MAKE_VERSION(major, minor, revision) \ + (((major) * 1000000) + ((minor) * 1000) + (revision)) + +#if defined(__GNUC__) && defined(__GNUC_PATCHLEVEL__) +#define BROTLI_GNUC_VERSION \ + BROTLI_MAKE_VERSION(__GNUC__, __GNUC_MINOR__, __GNUC_PATCHLEVEL__) +#elif defined(__GNUC__) +#define BROTLI_GNUC_VERSION BROTLI_MAKE_VERSION(__GNUC__, __GNUC_MINOR__, 0) +#endif + +#if defined(BROTLI_GNUC_VERSION) +#define BROTLI_GNUC_VERSION_CHECK(major, minor, patch) \ + (BROTLI_GNUC_VERSION >= BROTLI_MAKE_VERSION(major, minor, patch)) +#else +#define BROTLI_GNUC_VERSION_CHECK(major, minor, patch) (0) +#endif + +#if defined(_MSC_FULL_VER) && (_MSC_FULL_VER >= 140000000) +#define BROTLI_MSVC_VERSION \ + BROTLI_MAKE_VERSION((_MSC_FULL_VER / 10000000), \ + (_MSC_FULL_VER % 10000000) / 100000, \ + (_MSC_FULL_VER % 100000) / 100) +#elif defined(_MSC_FULL_VER) +#define BROTLI_MSVC_VERSION \ + BROTLI_MAKE_VERSION((_MSC_FULL_VER / 1000000), \ + (_MSC_FULL_VER % 1000000) / 10000, \ + (_MSC_FULL_VER % 10000) / 10) +#elif defined(_MSC_VER) +#define BROTLI_MSVC_VERSION \ + BROTLI_MAKE_VERSION(_MSC_VER / 100, _MSC_VER % 100, 0) +#endif + +#if !defined(_MSC_VER) +#define BROTLI_MSVC_VERSION_CHECK(major, minor, patch) (0) +#elif defined(_MSC_VER) && (_MSC_VER >= 1400) +#define BROTLI_MSVC_VERSION_CHECK(major, minor, patch) \ + (_MSC_FULL_VER >= ((major * 10000000) + (minor * 100000) + (patch))) +#elif defined(_MSC_VER) && (_MSC_VER >= 1200) +#define BROTLI_MSVC_VERSION_CHECK(major, minor, patch) \ + (_MSC_FULL_VER >= ((major * 1000000) + (minor * 10000) + (patch))) +#else +#define BROTLI_MSVC_VERSION_CHECK(major, minor, patch) \ + (_MSC_VER >= ((major * 100) + (minor))) +#endif + +#if defined(__INTEL_COMPILER) && defined(__INTEL_COMPILER_UPDATE) +#define BROTLI_INTEL_VERSION \ + BROTLI_MAKE_VERSION(__INTEL_COMPILER / 100, \ + __INTEL_COMPILER % 100, \ + __INTEL_COMPILER_UPDATE) +#elif defined(__INTEL_COMPILER) +#define BROTLI_INTEL_VERSION \ + BROTLI_MAKE_VERSION(__INTEL_COMPILER / 100, __INTEL_COMPILER % 100, 0) +#endif + +#if defined(BROTLI_INTEL_VERSION) +#define BROTLI_INTEL_VERSION_CHECK(major, minor, patch) \ + (BROTLI_INTEL_VERSION >= BROTLI_MAKE_VERSION(major, minor, patch)) +#else +#define BROTLI_INTEL_VERSION_CHECK(major, minor, patch) (0) +#endif + +#if defined(__PGI) && \ + defined(__PGIC__) && defined(__PGIC_MINOR__) && defined(__PGIC_PATCHLEVEL__) +#define BROTLI_PGI_VERSION \ + BROTLI_MAKE_VERSION(__PGIC__, __PGIC_MINOR__, __PGIC_PATCHLEVEL__) +#endif + +#if defined(BROTLI_PGI_VERSION) +#define BROTLI_PGI_VERSION_CHECK(major, minor, patch) \ + (BROTLI_PGI_VERSION >= BROTLI_MAKE_VERSION(major, minor, patch)) +#else +#define BROTLI_PGI_VERSION_CHECK(major, minor, patch) (0) +#endif + +#if defined(__SUNPRO_C) && (__SUNPRO_C > 0x1000) +#define BROTLI_SUNPRO_VERSION \ + BROTLI_MAKE_VERSION( \ + (((__SUNPRO_C >> 16) & 0xf) * 10) + ((__SUNPRO_C >> 12) & 0xf), \ + (((__SUNPRO_C >> 8) & 0xf) * 10) + ((__SUNPRO_C >> 4) & 0xf), \ + (__SUNPRO_C & 0xf) * 10) +#elif defined(__SUNPRO_C) +#define BROTLI_SUNPRO_VERSION \ + BROTLI_MAKE_VERSION((__SUNPRO_C >> 8) & 0xf, \ + (__SUNPRO_C >> 4) & 0xf, \ + (__SUNPRO_C) & 0xf) +#elif defined(__SUNPRO_CC) && (__SUNPRO_CC > 0x1000) +#define BROTLI_SUNPRO_VERSION \ + BROTLI_MAKE_VERSION( \ + (((__SUNPRO_CC >> 16) & 0xf) * 10) + ((__SUNPRO_CC >> 12) & 0xf), \ + (((__SUNPRO_CC >> 8) & 0xf) * 10) + ((__SUNPRO_CC >> 4) & 0xf), \ + (__SUNPRO_CC & 0xf) * 10) +#elif defined(__SUNPRO_CC) +#define BROTLI_SUNPRO_VERSION \ + BROTLI_MAKE_VERSION((__SUNPRO_CC >> 8) & 0xf, \ + (__SUNPRO_CC >> 4) & 0xf, \ + (__SUNPRO_CC) & 0xf) +#endif + +#if defined(BROTLI_SUNPRO_VERSION) +#define BROTLI_SUNPRO_VERSION_CHECK(major, minor, patch) \ + (BROTLI_SUNPRO_VERSION >= BROTLI_MAKE_VERSION(major, minor, patch)) +#else +#define BROTLI_SUNPRO_VERSION_CHECK(major, minor, patch) (0) +#endif + +#if defined(__CC_ARM) && defined(__ARMCOMPILER_VERSION) +#define BROTLI_ARM_VERSION \ + BROTLI_MAKE_VERSION((__ARMCOMPILER_VERSION / 1000000), \ + (__ARMCOMPILER_VERSION % 1000000) / 10000, \ + (__ARMCOMPILER_VERSION % 10000) / 100) +#elif defined(__CC_ARM) && defined(__ARMCC_VERSION) +#define BROTLI_ARM_VERSION \ + BROTLI_MAKE_VERSION((__ARMCC_VERSION / 1000000), \ + (__ARMCC_VERSION % 1000000) / 10000, \ + (__ARMCC_VERSION % 10000) / 100) +#endif + +#if defined(BROTLI_ARM_VERSION) +#define BROTLI_ARM_VERSION_CHECK(major, minor, patch) \ + (BROTLI_ARM_VERSION >= BROTLI_MAKE_VERSION(major, minor, patch)) +#else +#define BROTLI_ARM_VERSION_CHECK(major, minor, patch) (0) +#endif + +#if defined(__ibmxl__) +#define BROTLI_IBM_VERSION \ + BROTLI_MAKE_VERSION(__ibmxl_version__, \ + __ibmxl_release__, \ + __ibmxl_modification__) +#elif defined(__xlC__) && defined(__xlC_ver__) +#define BROTLI_IBM_VERSION \ + BROTLI_MAKE_VERSION(__xlC__ >> 8, __xlC__ & 0xff, (__xlC_ver__ >> 8) & 0xff) +#elif defined(__xlC__) +#define BROTLI_IBM_VERSION BROTLI_MAKE_VERSION(__xlC__ >> 8, __xlC__ & 0xff, 0) +#endif + +#if defined(BROTLI_IBM_VERSION) +#define BROTLI_IBM_VERSION_CHECK(major, minor, patch) \ + (BROTLI_IBM_VERSION >= BROTLI_MAKE_VERSION(major, minor, patch)) +#else +#define BROTLI_IBM_VERSION_CHECK(major, minor, patch) (0) +#endif + +#if defined(__TI_COMPILER_VERSION__) +#define BROTLI_TI_VERSION \ + BROTLI_MAKE_VERSION((__TI_COMPILER_VERSION__ / 1000000), \ + (__TI_COMPILER_VERSION__ % 1000000) / 1000, \ + (__TI_COMPILER_VERSION__ % 1000)) +#endif + +#if defined(BROTLI_TI_VERSION) +#define BROTLI_TI_VERSION_CHECK(major, minor, patch) \ + (BROTLI_TI_VERSION >= BROTLI_MAKE_VERSION(major, minor, patch)) +#else +#define BROTLI_TI_VERSION_CHECK(major, minor, patch) (0) +#endif + +#if defined(__IAR_SYSTEMS_ICC__) +#if __VER__ > 1000 +#define BROTLI_IAR_VERSION \ + BROTLI_MAKE_VERSION((__VER__ / 1000000), \ + (__VER__ / 1000) % 1000, \ + (__VER__ % 1000)) +#else +#define BROTLI_IAR_VERSION BROTLI_MAKE_VERSION(VER / 100, __VER__ % 100, 0) +#endif +#endif + +#if defined(BROTLI_IAR_VERSION) +#define BROTLI_IAR_VERSION_CHECK(major, minor, patch) \ + (BROTLI_IAR_VERSION >= BROTLI_MAKE_VERSION(major, minor, patch)) +#else +#define BROTLI_IAR_VERSION_CHECK(major, minor, patch) (0) +#endif + +#if defined(__TINYC__) +#define BROTLI_TINYC_VERSION \ + BROTLI_MAKE_VERSION(__TINYC__ / 1000, (__TINYC__ / 100) % 10, __TINYC__ % 100) +#endif + +#if defined(BROTLI_TINYC_VERSION) +#define BROTLI_TINYC_VERSION_CHECK(major, minor, patch) \ + (BROTLI_TINYC_VERSION >= BROTLI_MAKE_VERSION(major, minor, patch)) +#else +#define BROTLI_TINYC_VERSION_CHECK(major, minor, patch) (0) +#endif + +#if defined(__has_attribute) +#define BROTLI_GNUC_HAS_ATTRIBUTE(attribute, major, minor, patch) \ + __has_attribute(attribute) +#else +#define BROTLI_GNUC_HAS_ATTRIBUTE(attribute, major, minor, patch) \ + BROTLI_GNUC_VERSION_CHECK(major, minor, patch) +#endif + +#if defined(__has_builtin) +#define BROTLI_GNUC_HAS_BUILTIN(builtin, major, minor, patch) \ + __has_builtin(builtin) +#else +#define BROTLI_GNUC_HAS_BUILTIN(builtin, major, minor, patch) \ + BROTLI_GNUC_VERSION_CHECK(major, minor, patch) +#endif + +#if defined(__has_feature) +#define BROTLI_HAS_FEATURE(feature) __has_feature(feature) +#else +#define BROTLI_HAS_FEATURE(feature) (0) +#endif + +#if defined(_WIN32) || defined(__CYGWIN__) +#define BROTLI_PUBLIC +#elif BROTLI_GNUC_VERSION_CHECK(3, 3, 0) || \ + BROTLI_TI_VERSION_CHECK(8, 0, 0) || \ + BROTLI_INTEL_VERSION_CHECK(16, 0, 0) || \ + BROTLI_ARM_VERSION_CHECK(4, 1, 0) || \ + BROTLI_IBM_VERSION_CHECK(13, 1, 0) || \ + BROTLI_SUNPRO_VERSION_CHECK(5, 11, 0) || \ + (BROTLI_TI_VERSION_CHECK(7, 3, 0) && \ + defined(__TI_GNU_ATTRIBUTE_SUPPORT__) && defined(__TI_EABI__)) +#define BROTLI_PUBLIC __attribute__ ((visibility ("default"))) +#else +#define BROTLI_PUBLIC +#endif + +/* BROTLI_INTERNAL could be defined to override visibility, e.g. for tests. */ +#if !defined(BROTLI_INTERNAL) +#if defined(_WIN32) || defined(__CYGWIN__) +#define BROTLI_INTERNAL +#elif BROTLI_GNUC_VERSION_CHECK(3, 3, 0) || \ + BROTLI_TI_VERSION_CHECK(8, 0, 0) || \ + BROTLI_INTEL_VERSION_CHECK(16, 0, 0) || \ + BROTLI_ARM_VERSION_CHECK(4, 1, 0) || \ + BROTLI_IBM_VERSION_CHECK(13, 1, 0) || \ + BROTLI_SUNPRO_VERSION_CHECK(5, 11, 0) || \ + (BROTLI_TI_VERSION_CHECK(7, 3, 0) && \ + defined(__TI_GNU_ATTRIBUTE_SUPPORT__) && defined(__TI_EABI__)) +#define BROTLI_INTERNAL __attribute__ ((visibility ("hidden"))) +#else +#define BROTLI_INTERNAL +#endif +#endif + +#if defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) && \ + !defined(__STDC_NO_VLA__) && !defined(__cplusplus) && \ + !defined(__PGI) && !defined(__PGIC__) && !defined(__TINYC__) && \ + !defined(__clang__) +#define BROTLI_ARRAY_PARAM(name) (name) +#else +#define BROTLI_ARRAY_PARAM(name) +#endif + +/* <<< <<< <<< end of hedley macros. */ + +#if defined(BROTLI_SHARED_COMPILATION) +#if defined(_WIN32) +#if defined(BROTLICOMMON_SHARED_COMPILATION) +#define BROTLI_COMMON_API __declspec(dllexport) +#else +#define BROTLI_COMMON_API __declspec(dllimport) +#endif /* BROTLICOMMON_SHARED_COMPILATION */ +#if defined(BROTLIDEC_SHARED_COMPILATION) +#define BROTLI_DEC_API __declspec(dllexport) +#else +#define BROTLI_DEC_API __declspec(dllimport) +#endif /* BROTLIDEC_SHARED_COMPILATION */ +#if defined(BROTLIENC_SHARED_COMPILATION) +#define BROTLI_ENC_API __declspec(dllexport) +#else +#define BROTLI_ENC_API __declspec(dllimport) +#endif /* BROTLIENC_SHARED_COMPILATION */ +#else /* _WIN32 */ +#define BROTLI_COMMON_API BROTLI_PUBLIC +#define BROTLI_DEC_API BROTLI_PUBLIC +#define BROTLI_ENC_API BROTLI_PUBLIC +#endif /* _WIN32 */ +#else /* BROTLI_SHARED_COMPILATION */ +#define BROTLI_COMMON_API +#define BROTLI_DEC_API +#define BROTLI_ENC_API +#endif + +#if defined(BROTLI_BUILD_ENC_EXTRA_API) +#define BROTLI_ENC_EXTRA_API BROTLI_ENC_API +#else +#define BROTLI_ENC_EXTRA_API BROTLI_INTERNAL +#endif + +#endif /* BROTLI_COMMON_PORT_H_ */ diff --git a/curl/include/brotli/shared_dictionary.h b/curl/include/brotli/shared_dictionary.h new file mode 100644 index 0000000..2970c2d --- /dev/null +++ b/curl/include/brotli/shared_dictionary.h @@ -0,0 +1,100 @@ +/* Copyright 2017 Google Inc. All Rights Reserved. + + Distributed under MIT license. + See file LICENSE for detail or copy at https://opensource.org/licenses/MIT +*/ + +/* (Opaque) Shared Dictionary definition and utilities. */ + +#ifndef BROTLI_COMMON_SHARED_DICTIONARY_H_ +#define BROTLI_COMMON_SHARED_DICTIONARY_H_ + +#include +#include + +#if defined(__cplusplus) || defined(c_plusplus) +extern "C" { +#endif + +#define SHARED_BROTLI_MIN_DICTIONARY_WORD_LENGTH 4 +#define SHARED_BROTLI_MAX_DICTIONARY_WORD_LENGTH 31 +#define SHARED_BROTLI_NUM_DICTIONARY_CONTEXTS 64 +#define SHARED_BROTLI_MAX_COMPOUND_DICTS 15 + +/** + * Opaque structure that holds shared dictionary data. + * + * Allocated and initialized with ::BrotliSharedDictionaryCreateInstance. + * Cleaned up and deallocated with ::BrotliSharedDictionaryDestroyInstance. + */ +typedef struct BrotliSharedDictionaryStruct BrotliSharedDictionary; + +/** + * Input data type for ::BrotliSharedDictionaryAttach. + */ +typedef enum BrotliSharedDictionaryType { + /** Raw LZ77 prefix dictionary. */ + BROTLI_SHARED_DICTIONARY_RAW = 0, + /** Serialized shared dictionary. + * + * DO NOT USE: methods accepting this value will fail. + */ + BROTLI_SHARED_DICTIONARY_SERIALIZED = 1 +} BrotliSharedDictionaryType; + +/** + * Creates an instance of ::BrotliSharedDictionary. + * + * Fresh instance has default word dictionary and transforms + * and no LZ77 prefix dictionary. + * + * @p alloc_func and @p free_func @b MUST be both zero or both non-zero. In the + * case they are both zero, default memory allocators are used. @p opaque is + * passed to @p alloc_func and @p free_func when they are called. @p free_func + * has to return without doing anything when asked to free a NULL pointer. + * + * @param alloc_func custom memory allocation function + * @param free_func custom memory free function + * @param opaque custom memory manager handle + * @returns @c 0 if instance can not be allocated or initialized + * @returns pointer to initialized ::BrotliSharedDictionary otherwise + */ +BROTLI_COMMON_API BrotliSharedDictionary* BrotliSharedDictionaryCreateInstance( + brotli_alloc_func alloc_func, brotli_free_func free_func, void* opaque); + +/** + * Deinitializes and frees ::BrotliSharedDictionary instance. + * + * @param dict shared dictionary instance to be cleaned up and deallocated + */ +BROTLI_COMMON_API void BrotliSharedDictionaryDestroyInstance( + BrotliSharedDictionary* dict); + +/** + * Attaches dictionary to a given instance of ::BrotliSharedDictionary. + * + * Dictionary to be attached is represented in a serialized format as a region + * of memory. + * + * Provided data it partially referenced by a resulting (compound) dictionary, + * and should be kept untouched, while at least one compound dictionary uses it. + * This way memory overhead is kept minimal by the cost of additional resource + * management. + * + * @param dict dictionary to extend + * @param type type of dictionary to attach + * @param data_size size of @p data + * @param data serialized dictionary of type @p type, with at least @p data_size + * addressable bytes + * @returns ::BROTLI_TRUE if provided dictionary is successfully attached + * @returns ::BROTLI_FALSE otherwise + */ +BROTLI_COMMON_API BROTLI_BOOL BrotliSharedDictionaryAttach( + BrotliSharedDictionary* dict, BrotliSharedDictionaryType type, + size_t data_size, const uint8_t data[BROTLI_ARRAY_PARAM(data_size)]); + +#if defined(__cplusplus) || defined(c_plusplus) +} /* extern "C" */ +#endif + +#endif /* BROTLI_COMMON_SHARED_DICTIONARY_H_ */ diff --git a/curl/include/brotli/types.h b/curl/include/brotli/types.h new file mode 100644 index 0000000..eff1a3c --- /dev/null +++ b/curl/include/brotli/types.h @@ -0,0 +1,83 @@ +/* Copyright 2013 Google Inc. All Rights Reserved. + + Distributed under MIT license. + See file LICENSE for detail or copy at https://opensource.org/licenses/MIT +*/ + +/** + * @file + * Common types used in decoder and encoder API. + */ + +#ifndef BROTLI_COMMON_TYPES_H_ +#define BROTLI_COMMON_TYPES_H_ + +#include /* for size_t */ + +#if defined(_MSC_VER) && (_MSC_VER < 1600) +typedef __int8 int8_t; +typedef unsigned __int8 uint8_t; +typedef __int16 int16_t; +typedef unsigned __int16 uint16_t; +typedef __int32 int32_t; +typedef unsigned __int32 uint32_t; +typedef unsigned __int64 uint64_t; +typedef __int64 int64_t; +#else +#include +#endif /* defined(_MSC_VER) && (_MSC_VER < 1600) */ + +/** + * A portable @c bool replacement. + * + * ::BROTLI_BOOL is a "documentation" type: actually it is @c int, but in API it + * denotes a type, whose only values are ::BROTLI_TRUE and ::BROTLI_FALSE. + * + * ::BROTLI_BOOL values passed to Brotli should either be ::BROTLI_TRUE or + * ::BROTLI_FALSE, or be a result of ::TO_BROTLI_BOOL macros. + * + * ::BROTLI_BOOL values returned by Brotli should not be tested for equality + * with @c true, @c false, ::BROTLI_TRUE, ::BROTLI_FALSE, but rather should be + * evaluated, for example: @code{.cpp} + * if (SomeBrotliFunction(encoder, BROTLI_TRUE) && + * !OtherBrotliFunction(decoder, BROTLI_FALSE)) { + * bool x = !!YetAnotherBrotliFunction(encoder, TO_BROLTI_BOOL(2 * 2 == 4)); + * DoSomething(x); + * } + * @endcode + */ +#define BROTLI_BOOL int +/** Portable @c true replacement. */ +#define BROTLI_TRUE 1 +/** Portable @c false replacement. */ +#define BROTLI_FALSE 0 +/** @c bool to ::BROTLI_BOOL conversion macros. */ +#define TO_BROTLI_BOOL(X) (!!(X) ? BROTLI_TRUE : BROTLI_FALSE) + +#define BROTLI_MAKE_UINT64_T(high, low) ((((uint64_t)(high)) << 32) | low) + +#define BROTLI_UINT32_MAX (~((uint32_t)0)) +#define BROTLI_SIZE_MAX (~((size_t)0)) + +/** + * Allocating function pointer type. + * + * @param opaque custom memory manager handle provided by client + * @param size requested memory region size; can not be @c 0 + * @returns @c 0 in the case of failure + * @returns a valid pointer to a memory region of at least @p size bytes + * long otherwise + */ +typedef void* (*brotli_alloc_func)(void* opaque, size_t size); + +/** + * Deallocating function pointer type. + * + * This function @b SHOULD do nothing if @p address is @c 0. + * + * @param opaque custom memory manager handle provided by client + * @param address memory region pointer returned by ::brotli_alloc_func, or @c 0 + */ +typedef void (*brotli_free_func)(void* opaque, void* address); + +#endif /* BROTLI_COMMON_TYPES_H_ */ diff --git a/curl/include/curl/curl.h b/curl/include/curl/curl.h new file mode 100644 index 0000000..128d1d3 --- /dev/null +++ b/curl/include/curl/curl.h @@ -0,0 +1,3348 @@ +#ifndef CURLINC_CURL_H +#define CURLINC_CURL_H +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * If you have libcurl problems, all docs and details are found here: + * https://curl.se/libcurl/ + */ + +#ifdef CURL_NO_OLDIES +#define CURL_STRICTER /* not used since 8.11.0 */ +#endif + +/* Compile-time deprecation macros. */ +#if (defined(__GNUC__) && \ + ((__GNUC__ > 12) || ((__GNUC__ == 12) && (__GNUC_MINOR__ >= 1))) || \ + (defined(__clang__) && __clang_major__ >= 3) || \ + defined(__IAR_SYSTEMS_ICC__)) && \ + !defined(__INTEL_COMPILER) && \ + !defined(CURL_DISABLE_DEPRECATION) && !defined(BUILDING_LIBCURL) +#define CURL_DEPRECATED(version, message) \ + __attribute__((deprecated("since " # version ". " message))) +#ifdef __IAR_SYSTEMS_ICC__ +#define CURL_IGNORE_DEPRECATION(statements) \ + _Pragma("diag_suppress=Pe1444") \ + statements \ + _Pragma("diag_default=Pe1444") +#else +#define CURL_IGNORE_DEPRECATION(statements) \ + _Pragma("GCC diagnostic push") \ + _Pragma("GCC diagnostic ignored \"-Wdeprecated-declarations\"") \ + statements \ + _Pragma("GCC diagnostic pop") +#endif +#else +#define CURL_DEPRECATED(version, message) +#define CURL_IGNORE_DEPRECATION(statements) statements +#endif + +#include "curlver.h" /* libcurl version defines */ +#include "system.h" /* determine things runtime */ + +#include +#include + +#if defined(__FreeBSD__) || defined(__MidnightBSD__) +/* Needed for __FreeBSD_version or __MidnightBSD_version symbol definition */ +#include +#endif + +/* The include stuff here below is mainly for time_t! */ +#include +#include + +#if defined(_WIN32) && !defined(_WIN32_WCE) && !defined(__CYGWIN__) +#if !(defined(_WINSOCKAPI_) || defined(_WINSOCK_H) || \ + defined(__LWIP_OPT_H__) || defined(LWIP_HDR_OPT_H)) +/* The check above prevents the winsock2.h inclusion if winsock.h already was + included, since they cannot co-exist without problems */ +#include +#include +#endif +#endif + +/* HP-UX systems version 9, 10 and 11 lack sys/select.h and so does oldish + libc5-based Linux systems. Only include it on systems that are known to + require it! */ +#if defined(_AIX) || defined(__NOVELL_LIBC__) || defined(__NetBSD__) || \ + defined(__minix) || defined(__INTEGRITY) || \ + defined(ANDROID) || defined(__ANDROID__) || defined(__OpenBSD__) || \ + defined(__CYGWIN__) || defined(AMIGA) || defined(__NuttX__) || \ + (defined(__FreeBSD_version) && (__FreeBSD_version < 800000)) || \ + (defined(__MidnightBSD_version) && (__MidnightBSD_version < 100000)) || \ + defined(__sun__) || defined(__serenity__) || defined(__vxworks__) +#include +#endif + +#ifndef _WIN32 +#include +#include +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +typedef void CURL; +typedef void CURLSH; + +/* + * libcurl external API function linkage decorations. + */ + +#ifdef __has_declspec_attribute +#define CURL_HAS_DECLSPEC_ATTRIBUTE(x) __has_declspec_attribute(x) +#else +#define CURL_HAS_DECLSPEC_ATTRIBUTE(x) 0 +#endif + +#ifdef CURL_STATICLIB +# define CURL_EXTERN +#elif defined(_WIN32) || \ + (CURL_HAS_DECLSPEC_ATTRIBUTE(dllexport) && \ + CURL_HAS_DECLSPEC_ATTRIBUTE(dllimport)) +# if defined(BUILDING_LIBCURL) +# define CURL_EXTERN __declspec(dllexport) +# else +# define CURL_EXTERN __declspec(dllimport) +# endif +#elif defined(BUILDING_LIBCURL) && defined(CURL_HIDDEN_SYMBOLS) +# define CURL_EXTERN CURL_EXTERN_SYMBOL +#else +# define CURL_EXTERN +#endif + +#ifndef curl_socket_typedef +/* socket typedef */ +#if defined(_WIN32) && !defined(__LWIP_OPT_H__) && !defined(LWIP_HDR_OPT_H) +typedef SOCKET curl_socket_t; +#define CURL_SOCKET_BAD INVALID_SOCKET +#else +typedef int curl_socket_t; +#define CURL_SOCKET_BAD -1 +#endif +#define curl_socket_typedef +#endif /* curl_socket_typedef */ + +/* enum for the different supported SSL backends */ +typedef enum { + CURLSSLBACKEND_NONE = 0, + CURLSSLBACKEND_OPENSSL = 1, + CURLSSLBACKEND_GNUTLS = 2, + CURLSSLBACKEND_NSS CURL_DEPRECATED(8.3.0, "") = 3, + CURLSSLBACKEND_OBSOLETE4 = 4, /* Was QSOSSL. */ + CURLSSLBACKEND_GSKIT CURL_DEPRECATED(8.3.0, "") = 5, + CURLSSLBACKEND_POLARSSL CURL_DEPRECATED(7.69.0, "") = 6, + CURLSSLBACKEND_WOLFSSL = 7, + CURLSSLBACKEND_SCHANNEL = 8, + CURLSSLBACKEND_SECURETRANSPORT = 9, + CURLSSLBACKEND_AXTLS CURL_DEPRECATED(7.61.0, "") = 10, + CURLSSLBACKEND_MBEDTLS = 11, + CURLSSLBACKEND_MESALINK CURL_DEPRECATED(7.82.0, "") = 12, + CURLSSLBACKEND_BEARSSL = 13, + CURLSSLBACKEND_RUSTLS = 14 +} curl_sslbackend; + +/* aliases for library clones and renames */ +#define CURLSSLBACKEND_AWSLC CURLSSLBACKEND_OPENSSL +#define CURLSSLBACKEND_BORINGSSL CURLSSLBACKEND_OPENSSL +#define CURLSSLBACKEND_LIBRESSL CURLSSLBACKEND_OPENSSL + +/* deprecated names: */ +#define CURLSSLBACKEND_CYASSL CURLSSLBACKEND_WOLFSSL +#define CURLSSLBACKEND_DARWINSSL CURLSSLBACKEND_SECURETRANSPORT + +/* bits for the CURLOPT_FOLLOWLOCATION option */ +#define CURLFOLLOW_ALL 1L /* generic follow redirects */ + +/* Do not use the custom method in the follow-up request if the HTTP code + instructs so (301, 302, 303). */ +#define CURLFOLLOW_OBEYCODE 2L + +/* Only use the custom method in the first request, always reset in the next */ +#define CURLFOLLOW_FIRSTONLY 3L + +struct curl_httppost { + struct curl_httppost *next; /* next entry in the list */ + char *name; /* pointer to allocated name */ + long namelength; /* length of name length */ + char *contents; /* pointer to allocated data contents */ + long contentslength; /* length of contents field, see also + CURL_HTTPPOST_LARGE */ + char *buffer; /* pointer to allocated buffer contents */ + long bufferlength; /* length of buffer field */ + char *contenttype; /* Content-Type */ + struct curl_slist *contentheader; /* list of extra headers for this form */ + struct curl_httppost *more; /* if one field name has more than one + file, this link should link to following + files */ + long flags; /* as defined below */ + +/* specified content is a filename */ +#define CURL_HTTPPOST_FILENAME (1<<0) +/* specified content is a filename */ +#define CURL_HTTPPOST_READFILE (1<<1) +/* name is only stored pointer do not free in formfree */ +#define CURL_HTTPPOST_PTRNAME (1<<2) +/* contents is only stored pointer do not free in formfree */ +#define CURL_HTTPPOST_PTRCONTENTS (1<<3) +/* upload file from buffer */ +#define CURL_HTTPPOST_BUFFER (1<<4) +/* upload file from pointer contents */ +#define CURL_HTTPPOST_PTRBUFFER (1<<5) +/* upload file contents by using the regular read callback to get the data and + pass the given pointer as custom pointer */ +#define CURL_HTTPPOST_CALLBACK (1<<6) +/* use size in 'contentlen', added in 7.46.0 */ +#define CURL_HTTPPOST_LARGE (1<<7) + + char *showfilename; /* The filename to show. If not set, the + actual filename will be used (if this + is a file part) */ + void *userp; /* custom pointer used for + HTTPPOST_CALLBACK posts */ + curl_off_t contentlen; /* alternative length of contents + field. Used if CURL_HTTPPOST_LARGE is + set. Added in 7.46.0 */ +}; + + +/* This is a return code for the progress callback that, when returned, will + signal libcurl to continue executing the default progress function */ +#define CURL_PROGRESSFUNC_CONTINUE 0x10000001 + +/* This is the CURLOPT_PROGRESSFUNCTION callback prototype. It is now + considered deprecated but was the only choice up until 7.31.0 */ +typedef int (*curl_progress_callback)(void *clientp, + double dltotal, + double dlnow, + double ultotal, + double ulnow); + +/* This is the CURLOPT_XFERINFOFUNCTION callback prototype. It was introduced + in 7.32.0, avoids the use of floating point numbers and provides more + detailed information. */ +typedef int (*curl_xferinfo_callback)(void *clientp, + curl_off_t dltotal, + curl_off_t dlnow, + curl_off_t ultotal, + curl_off_t ulnow); + +#ifndef CURL_MAX_READ_SIZE + /* The maximum receive buffer size configurable via CURLOPT_BUFFERSIZE. */ +#define CURL_MAX_READ_SIZE (10*1024*1024) +#endif + +#ifndef CURL_MAX_WRITE_SIZE + /* Tests have proven that 20K is a bad buffer size for uploads on Windows, + while 16K for some odd reason performed a lot better. We do the ifndef + check to allow this value to easier be changed at build time for those + who feel adventurous. The practical minimum is about 400 bytes since + libcurl uses a buffer of this size as a scratch area (unrelated to + network send operations). */ +#define CURL_MAX_WRITE_SIZE 16384 +#endif + +#ifndef CURL_MAX_HTTP_HEADER +/* The only reason to have a max limit for this is to avoid the risk of a bad + server feeding libcurl with a never-ending header that will cause reallocs + infinitely */ +#define CURL_MAX_HTTP_HEADER (100*1024) +#endif + +/* This is a magic return code for the write callback that, when returned, + will signal libcurl to pause receiving on the current transfer. */ +#define CURL_WRITEFUNC_PAUSE 0x10000001 + +/* This is a magic return code for the write callback that, when returned, + will signal an error from the callback. */ +#define CURL_WRITEFUNC_ERROR 0xFFFFFFFF + +typedef size_t (*curl_write_callback)(char *buffer, + size_t size, + size_t nitems, + void *outstream); + +/* This callback will be called when a new resolver request is made */ +typedef int (*curl_resolver_start_callback)(void *resolver_state, + void *reserved, void *userdata); + +/* enumeration of file types */ +typedef enum { + CURLFILETYPE_FILE = 0, + CURLFILETYPE_DIRECTORY, + CURLFILETYPE_SYMLINK, + CURLFILETYPE_DEVICE_BLOCK, + CURLFILETYPE_DEVICE_CHAR, + CURLFILETYPE_NAMEDPIPE, + CURLFILETYPE_SOCKET, + CURLFILETYPE_DOOR, /* is possible only on Sun Solaris now */ + + CURLFILETYPE_UNKNOWN /* should never occur */ +} curlfiletype; + +#define CURLFINFOFLAG_KNOWN_FILENAME (1<<0) +#define CURLFINFOFLAG_KNOWN_FILETYPE (1<<1) +#define CURLFINFOFLAG_KNOWN_TIME (1<<2) +#define CURLFINFOFLAG_KNOWN_PERM (1<<3) +#define CURLFINFOFLAG_KNOWN_UID (1<<4) +#define CURLFINFOFLAG_KNOWN_GID (1<<5) +#define CURLFINFOFLAG_KNOWN_SIZE (1<<6) +#define CURLFINFOFLAG_KNOWN_HLINKCOUNT (1<<7) + +/* Information about a single file, used when doing FTP wildcard matching */ +struct curl_fileinfo { + char *filename; + curlfiletype filetype; + time_t time; /* always zero! */ + unsigned int perm; + int uid; + int gid; + curl_off_t size; + long int hardlinks; + + struct { + /* If some of these fields is not NULL, it is a pointer to b_data. */ + char *time; + char *perm; + char *user; + char *group; + char *target; /* pointer to the target filename of a symlink */ + } strings; + + unsigned int flags; + + /* These are libcurl private struct fields. Previously used by libcurl, so + they must never be interfered with. */ + char *b_data; + size_t b_size; + size_t b_used; +}; + +/* return codes for CURLOPT_CHUNK_BGN_FUNCTION */ +#define CURL_CHUNK_BGN_FUNC_OK 0 +#define CURL_CHUNK_BGN_FUNC_FAIL 1 /* tell the lib to end the task */ +#define CURL_CHUNK_BGN_FUNC_SKIP 2 /* skip this chunk over */ + +/* if splitting of data transfer is enabled, this callback is called before + download of an individual chunk started. Note that parameter "remains" works + only for FTP wildcard downloading (for now), otherwise is not used */ +typedef long (*curl_chunk_bgn_callback)(const void *transfer_info, + void *ptr, + int remains); + +/* return codes for CURLOPT_CHUNK_END_FUNCTION */ +#define CURL_CHUNK_END_FUNC_OK 0 +#define CURL_CHUNK_END_FUNC_FAIL 1 /* tell the lib to end the task */ + +/* If splitting of data transfer is enabled this callback is called after + download of an individual chunk finished. + Note! After this callback was set then it have to be called FOR ALL chunks. + Even if downloading of this chunk was skipped in CHUNK_BGN_FUNC. + This is the reason why we do not need "transfer_info" parameter in this + callback and we are not interested in "remains" parameter too. */ +typedef long (*curl_chunk_end_callback)(void *ptr); + +/* return codes for FNMATCHFUNCTION */ +#define CURL_FNMATCHFUNC_MATCH 0 /* string corresponds to the pattern */ +#define CURL_FNMATCHFUNC_NOMATCH 1 /* pattern does not match the string */ +#define CURL_FNMATCHFUNC_FAIL 2 /* an error occurred */ + +/* callback type for wildcard downloading pattern matching. If the + string matches the pattern, return CURL_FNMATCHFUNC_MATCH value, etc. */ +typedef int (*curl_fnmatch_callback)(void *ptr, + const char *pattern, + const char *string); + +/* These are the return codes for the seek callbacks */ +#define CURL_SEEKFUNC_OK 0 +#define CURL_SEEKFUNC_FAIL 1 /* fail the entire transfer */ +#define CURL_SEEKFUNC_CANTSEEK 2 /* tell libcurl seeking cannot be done, so + libcurl might try other means instead */ +typedef int (*curl_seek_callback)(void *instream, + curl_off_t offset, + int origin); /* 'whence' */ + +/* This is a return code for the read callback that, when returned, will + signal libcurl to immediately abort the current transfer. */ +#define CURL_READFUNC_ABORT 0x10000000 +/* This is a return code for the read callback that, when returned, will + signal libcurl to pause sending data on the current transfer. */ +#define CURL_READFUNC_PAUSE 0x10000001 + +/* Return code for when the trailing headers' callback has terminated + without any errors */ +#define CURL_TRAILERFUNC_OK 0 +/* Return code for when was an error in the trailing header's list and we + want to abort the request */ +#define CURL_TRAILERFUNC_ABORT 1 + +typedef size_t (*curl_read_callback)(char *buffer, + size_t size, + size_t nitems, + void *instream); + +typedef int (*curl_trailer_callback)(struct curl_slist **list, + void *userdata); + +typedef enum { + CURLSOCKTYPE_IPCXN, /* socket created for a specific IP connection */ + CURLSOCKTYPE_ACCEPT, /* socket created by accept() call */ + CURLSOCKTYPE_LAST /* never use */ +} curlsocktype; + +/* The return code from the sockopt_callback can signal information back + to libcurl: */ +#define CURL_SOCKOPT_OK 0 +#define CURL_SOCKOPT_ERROR 1 /* causes libcurl to abort and return + CURLE_ABORTED_BY_CALLBACK */ +#define CURL_SOCKOPT_ALREADY_CONNECTED 2 + +typedef int (*curl_sockopt_callback)(void *clientp, + curl_socket_t curlfd, + curlsocktype purpose); + +struct curl_sockaddr { + int family; + int socktype; + int protocol; + unsigned int addrlen; /* addrlen was a socklen_t type before 7.18.0 but it + turned really ugly and painful on the systems that + lack this type */ + struct sockaddr addr; +}; + +typedef curl_socket_t +(*curl_opensocket_callback)(void *clientp, + curlsocktype purpose, + struct curl_sockaddr *address); + +typedef int +(*curl_closesocket_callback)(void *clientp, curl_socket_t item); + +typedef enum { + CURLIOE_OK, /* I/O operation successful */ + CURLIOE_UNKNOWNCMD, /* command was unknown to callback */ + CURLIOE_FAILRESTART, /* failed to restart the read */ + CURLIOE_LAST /* never use */ +} curlioerr; + +typedef enum { + CURLIOCMD_NOP, /* no operation */ + CURLIOCMD_RESTARTREAD, /* restart the read stream from start */ + CURLIOCMD_LAST /* never use */ +} curliocmd; + +typedef curlioerr (*curl_ioctl_callback)(CURL *handle, + int cmd, + void *clientp); + +#ifndef CURL_DID_MEMORY_FUNC_TYPEDEFS +/* + * The following typedef's are signatures of malloc, free, realloc, strdup and + * calloc respectively. Function pointers of these types can be passed to the + * curl_global_init_mem() function to set user defined memory management + * callback routines. + */ +typedef void *(*curl_malloc_callback)(size_t size); +typedef void (*curl_free_callback)(void *ptr); +typedef void *(*curl_realloc_callback)(void *ptr, size_t size); +typedef char *(*curl_strdup_callback)(const char *str); +typedef void *(*curl_calloc_callback)(size_t nmemb, size_t size); + +#define CURL_DID_MEMORY_FUNC_TYPEDEFS +#endif + +/* the kind of data that is passed to information_callback */ +typedef enum { + CURLINFO_TEXT = 0, + CURLINFO_HEADER_IN, /* 1 */ + CURLINFO_HEADER_OUT, /* 2 */ + CURLINFO_DATA_IN, /* 3 */ + CURLINFO_DATA_OUT, /* 4 */ + CURLINFO_SSL_DATA_IN, /* 5 */ + CURLINFO_SSL_DATA_OUT, /* 6 */ + CURLINFO_END +} curl_infotype; + +typedef int (*curl_debug_callback) + (CURL *handle, /* the handle/transfer this concerns */ + curl_infotype type, /* what kind of data */ + char *data, /* points to the data */ + size_t size, /* size of the data pointed to */ + void *userptr); /* whatever the user please */ + +/* This is the CURLOPT_PREREQFUNCTION callback prototype. */ +typedef int (*curl_prereq_callback)(void *clientp, + char *conn_primary_ip, + char *conn_local_ip, + int conn_primary_port, + int conn_local_port); + +/* Return code for when the pre-request callback has terminated without + any errors */ +#define CURL_PREREQFUNC_OK 0 +/* Return code for when the pre-request callback wants to abort the + request */ +#define CURL_PREREQFUNC_ABORT 1 + +/* All possible error codes from all sorts of curl functions. Future versions + may return other values, stay prepared. + + Always add new return codes last. Never *EVER* remove any. The return + codes must remain the same! + */ + +typedef enum { + CURLE_OK = 0, + CURLE_UNSUPPORTED_PROTOCOL, /* 1 */ + CURLE_FAILED_INIT, /* 2 */ + CURLE_URL_MALFORMAT, /* 3 */ + CURLE_NOT_BUILT_IN, /* 4 - [was obsoleted in August 2007 for + 7.17.0, reused in April 2011 for 7.21.5] */ + CURLE_COULDNT_RESOLVE_PROXY, /* 5 */ + CURLE_COULDNT_RESOLVE_HOST, /* 6 */ + CURLE_COULDNT_CONNECT, /* 7 */ + CURLE_WEIRD_SERVER_REPLY, /* 8 */ + CURLE_REMOTE_ACCESS_DENIED, /* 9 a service was denied by the server + due to lack of access - when login fails + this is not returned. */ + CURLE_FTP_ACCEPT_FAILED, /* 10 - [was obsoleted in April 2006 for + 7.15.4, reused in Dec 2011 for 7.24.0]*/ + CURLE_FTP_WEIRD_PASS_REPLY, /* 11 */ + CURLE_FTP_ACCEPT_TIMEOUT, /* 12 - timeout occurred accepting server + [was obsoleted in August 2007 for 7.17.0, + reused in Dec 2011 for 7.24.0]*/ + CURLE_FTP_WEIRD_PASV_REPLY, /* 13 */ + CURLE_FTP_WEIRD_227_FORMAT, /* 14 */ + CURLE_FTP_CANT_GET_HOST, /* 15 */ + CURLE_HTTP2, /* 16 - A problem in the http2 framing layer. + [was obsoleted in August 2007 for 7.17.0, + reused in July 2014 for 7.38.0] */ + CURLE_FTP_COULDNT_SET_TYPE, /* 17 */ + CURLE_PARTIAL_FILE, /* 18 */ + CURLE_FTP_COULDNT_RETR_FILE, /* 19 */ + CURLE_OBSOLETE20, /* 20 - NOT USED */ + CURLE_QUOTE_ERROR, /* 21 - quote command failure */ + CURLE_HTTP_RETURNED_ERROR, /* 22 */ + CURLE_WRITE_ERROR, /* 23 */ + CURLE_OBSOLETE24, /* 24 - NOT USED */ + CURLE_UPLOAD_FAILED, /* 25 - failed upload "command" */ + CURLE_READ_ERROR, /* 26 - could not open/read from file */ + CURLE_OUT_OF_MEMORY, /* 27 */ + CURLE_OPERATION_TIMEDOUT, /* 28 - the timeout time was reached */ + CURLE_OBSOLETE29, /* 29 - NOT USED */ + CURLE_FTP_PORT_FAILED, /* 30 - FTP PORT operation failed */ + CURLE_FTP_COULDNT_USE_REST, /* 31 - the REST command failed */ + CURLE_OBSOLETE32, /* 32 - NOT USED */ + CURLE_RANGE_ERROR, /* 33 - RANGE "command" did not work */ + CURLE_OBSOLETE34, /* 34 */ + CURLE_SSL_CONNECT_ERROR, /* 35 - wrong when connecting with SSL */ + CURLE_BAD_DOWNLOAD_RESUME, /* 36 - could not resume download */ + CURLE_FILE_COULDNT_READ_FILE, /* 37 */ + CURLE_LDAP_CANNOT_BIND, /* 38 */ + CURLE_LDAP_SEARCH_FAILED, /* 39 */ + CURLE_OBSOLETE40, /* 40 - NOT USED */ + CURLE_OBSOLETE41, /* 41 - NOT USED starting with 7.53.0 */ + CURLE_ABORTED_BY_CALLBACK, /* 42 */ + CURLE_BAD_FUNCTION_ARGUMENT, /* 43 */ + CURLE_OBSOLETE44, /* 44 - NOT USED */ + CURLE_INTERFACE_FAILED, /* 45 - CURLOPT_INTERFACE failed */ + CURLE_OBSOLETE46, /* 46 - NOT USED */ + CURLE_TOO_MANY_REDIRECTS, /* 47 - catch endless re-direct loops */ + CURLE_UNKNOWN_OPTION, /* 48 - User specified an unknown option */ + CURLE_SETOPT_OPTION_SYNTAX, /* 49 - Malformed setopt option */ + CURLE_OBSOLETE50, /* 50 - NOT USED */ + CURLE_OBSOLETE51, /* 51 - NOT USED */ + CURLE_GOT_NOTHING, /* 52 - when this is a specific error */ + CURLE_SSL_ENGINE_NOTFOUND, /* 53 - SSL crypto engine not found */ + CURLE_SSL_ENGINE_SETFAILED, /* 54 - can not set SSL crypto engine as + default */ + CURLE_SEND_ERROR, /* 55 - failed sending network data */ + CURLE_RECV_ERROR, /* 56 - failure in receiving network data */ + CURLE_OBSOLETE57, /* 57 - NOT IN USE */ + CURLE_SSL_CERTPROBLEM, /* 58 - problem with the local certificate */ + CURLE_SSL_CIPHER, /* 59 - could not use specified cipher */ + CURLE_PEER_FAILED_VERIFICATION, /* 60 - peer's certificate or fingerprint + was not verified fine */ + CURLE_BAD_CONTENT_ENCODING, /* 61 - Unrecognized/bad encoding */ + CURLE_OBSOLETE62, /* 62 - NOT IN USE since 7.82.0 */ + CURLE_FILESIZE_EXCEEDED, /* 63 - Maximum file size exceeded */ + CURLE_USE_SSL_FAILED, /* 64 - Requested FTP SSL level failed */ + CURLE_SEND_FAIL_REWIND, /* 65 - Sending the data requires a rewind + that failed */ + CURLE_SSL_ENGINE_INITFAILED, /* 66 - failed to initialise ENGINE */ + CURLE_LOGIN_DENIED, /* 67 - user, password or similar was not + accepted and we failed to login */ + CURLE_TFTP_NOTFOUND, /* 68 - file not found on server */ + CURLE_TFTP_PERM, /* 69 - permission problem on server */ + CURLE_REMOTE_DISK_FULL, /* 70 - out of disk space on server */ + CURLE_TFTP_ILLEGAL, /* 71 - Illegal TFTP operation */ + CURLE_TFTP_UNKNOWNID, /* 72 - Unknown transfer ID */ + CURLE_REMOTE_FILE_EXISTS, /* 73 - File already exists */ + CURLE_TFTP_NOSUCHUSER, /* 74 - No such user */ + CURLE_OBSOLETE75, /* 75 - NOT IN USE since 7.82.0 */ + CURLE_OBSOLETE76, /* 76 - NOT IN USE since 7.82.0 */ + CURLE_SSL_CACERT_BADFILE, /* 77 - could not load CACERT file, missing + or wrong format */ + CURLE_REMOTE_FILE_NOT_FOUND, /* 78 - remote file not found */ + CURLE_SSH, /* 79 - error from the SSH layer, somewhat + generic so the error message will be of + interest when this has happened */ + + CURLE_SSL_SHUTDOWN_FAILED, /* 80 - Failed to shut down the SSL + connection */ + CURLE_AGAIN, /* 81 - socket is not ready for send/recv, + wait till it is ready and try again (Added + in 7.18.2) */ + CURLE_SSL_CRL_BADFILE, /* 82 - could not load CRL file, missing or + wrong format (Added in 7.19.0) */ + CURLE_SSL_ISSUER_ERROR, /* 83 - Issuer check failed. (Added in + 7.19.0) */ + CURLE_FTP_PRET_FAILED, /* 84 - a PRET command failed */ + CURLE_RTSP_CSEQ_ERROR, /* 85 - mismatch of RTSP CSeq numbers */ + CURLE_RTSP_SESSION_ERROR, /* 86 - mismatch of RTSP Session Ids */ + CURLE_FTP_BAD_FILE_LIST, /* 87 - unable to parse FTP file list */ + CURLE_CHUNK_FAILED, /* 88 - chunk callback reported error */ + CURLE_NO_CONNECTION_AVAILABLE, /* 89 - No connection available, the + session will be queued */ + CURLE_SSL_PINNEDPUBKEYNOTMATCH, /* 90 - specified pinned public key did not + match */ + CURLE_SSL_INVALIDCERTSTATUS, /* 91 - invalid certificate status */ + CURLE_HTTP2_STREAM, /* 92 - stream error in HTTP/2 framing layer + */ + CURLE_RECURSIVE_API_CALL, /* 93 - an api function was called from + inside a callback */ + CURLE_AUTH_ERROR, /* 94 - an authentication function returned an + error */ + CURLE_HTTP3, /* 95 - An HTTP/3 layer problem */ + CURLE_QUIC_CONNECT_ERROR, /* 96 - QUIC connection error */ + CURLE_PROXY, /* 97 - proxy handshake error */ + CURLE_SSL_CLIENTCERT, /* 98 - client-side certificate required */ + CURLE_UNRECOVERABLE_POLL, /* 99 - poll/select returned fatal error */ + CURLE_TOO_LARGE, /* 100 - a value/data met its maximum */ + CURLE_ECH_REQUIRED, /* 101 - ECH tried but failed */ + CURL_LAST, /* never use! */ + + CURLE_RESERVED115 = 115, /* 115-126 - used in tests */ + CURLE_RESERVED116 = 116, + CURLE_RESERVED117 = 117, + CURLE_RESERVED118 = 118, + CURLE_RESERVED119 = 119, + CURLE_RESERVED120 = 120, + CURLE_RESERVED121 = 121, + CURLE_RESERVED122 = 122, + CURLE_RESERVED123 = 123, + CURLE_RESERVED124 = 124, + CURLE_RESERVED125 = 125, + CURLE_RESERVED126 = 126 +} CURLcode; + +#ifndef CURL_NO_OLDIES /* define this to test if your app builds with all + the obsolete stuff removed! */ + +/* removed in 7.53.0 */ +#define CURLE_FUNCTION_NOT_FOUND CURLE_OBSOLETE41 + +/* removed in 7.56.0 */ +#define CURLE_HTTP_POST_ERROR CURLE_OBSOLETE34 + +/* Previously obsolete error code reused in 7.38.0 */ +#define CURLE_OBSOLETE16 CURLE_HTTP2 + +/* Previously obsolete error codes reused in 7.24.0 */ +#define CURLE_OBSOLETE10 CURLE_FTP_ACCEPT_FAILED +#define CURLE_OBSOLETE12 CURLE_FTP_ACCEPT_TIMEOUT + +/* compatibility with older names */ +#define CURLOPT_ENCODING CURLOPT_ACCEPT_ENCODING +#define CURLE_FTP_WEIRD_SERVER_REPLY CURLE_WEIRD_SERVER_REPLY + +/* The following were added in 7.62.0 */ +#define CURLE_SSL_CACERT CURLE_PEER_FAILED_VERIFICATION + +/* The following were added in 7.21.5, April 2011 */ +#define CURLE_UNKNOWN_TELNET_OPTION CURLE_UNKNOWN_OPTION + +/* Added for 7.78.0 */ +#define CURLE_TELNET_OPTION_SYNTAX CURLE_SETOPT_OPTION_SYNTAX + +/* The following were added in 7.17.1 */ +/* These are scheduled to disappear by 2009 */ +#define CURLE_SSL_PEER_CERTIFICATE CURLE_PEER_FAILED_VERIFICATION + +/* The following were added in 7.17.0 */ +/* These are scheduled to disappear by 2009 */ +#define CURLE_OBSOLETE CURLE_OBSOLETE50 /* no one should be using this! */ +#define CURLE_BAD_PASSWORD_ENTERED CURLE_OBSOLETE46 +#define CURLE_BAD_CALLING_ORDER CURLE_OBSOLETE44 +#define CURLE_FTP_USER_PASSWORD_INCORRECT CURLE_OBSOLETE10 +#define CURLE_FTP_CANT_RECONNECT CURLE_OBSOLETE16 +#define CURLE_FTP_COULDNT_GET_SIZE CURLE_OBSOLETE32 +#define CURLE_FTP_COULDNT_SET_ASCII CURLE_OBSOLETE29 +#define CURLE_FTP_WEIRD_USER_REPLY CURLE_OBSOLETE12 +#define CURLE_FTP_WRITE_ERROR CURLE_OBSOLETE20 +#define CURLE_LIBRARY_NOT_FOUND CURLE_OBSOLETE40 +#define CURLE_MALFORMAT_USER CURLE_OBSOLETE24 +#define CURLE_SHARE_IN_USE CURLE_OBSOLETE57 +#define CURLE_URL_MALFORMAT_USER CURLE_NOT_BUILT_IN + +#define CURLE_FTP_ACCESS_DENIED CURLE_REMOTE_ACCESS_DENIED +#define CURLE_FTP_COULDNT_SET_BINARY CURLE_FTP_COULDNT_SET_TYPE +#define CURLE_FTP_QUOTE_ERROR CURLE_QUOTE_ERROR +#define CURLE_TFTP_DISKFULL CURLE_REMOTE_DISK_FULL +#define CURLE_TFTP_EXISTS CURLE_REMOTE_FILE_EXISTS +#define CURLE_HTTP_RANGE_ERROR CURLE_RANGE_ERROR +#define CURLE_FTP_SSL_FAILED CURLE_USE_SSL_FAILED + +/* The following were added earlier */ + +#define CURLE_OPERATION_TIMEOUTED CURLE_OPERATION_TIMEDOUT +#define CURLE_HTTP_NOT_FOUND CURLE_HTTP_RETURNED_ERROR +#define CURLE_HTTP_PORT_FAILED CURLE_INTERFACE_FAILED +#define CURLE_FTP_COULDNT_STOR_FILE CURLE_UPLOAD_FAILED +#define CURLE_FTP_PARTIAL_FILE CURLE_PARTIAL_FILE +#define CURLE_FTP_BAD_DOWNLOAD_RESUME CURLE_BAD_DOWNLOAD_RESUME +#define CURLE_LDAP_INVALID_URL CURLE_OBSOLETE62 +#define CURLE_CONV_REQD CURLE_OBSOLETE76 +#define CURLE_CONV_FAILED CURLE_OBSOLETE75 + +/* This was the error code 50 in 7.7.3 and a few earlier versions, this + is no longer used by libcurl but is instead #defined here only to not + make programs break */ +#define CURLE_ALREADY_COMPLETE 99999 + +/* Provide defines for really old option names */ +#define CURLOPT_FILE CURLOPT_WRITEDATA /* name changed in 7.9.7 */ +#define CURLOPT_INFILE CURLOPT_READDATA /* name changed in 7.9.7 */ +#define CURLOPT_WRITEHEADER CURLOPT_HEADERDATA + +/* Since long deprecated options with no code in the lib that does anything + with them. */ +#define CURLOPT_WRITEINFO CURLOPT_OBSOLETE40 +#define CURLOPT_CLOSEPOLICY CURLOPT_OBSOLETE72 +#define CURLOPT_OBSOLETE72 9999 +#define CURLOPT_OBSOLETE40 9999 + +#endif /* !CURL_NO_OLDIES */ + +/* + * Proxy error codes. Returned in CURLINFO_PROXY_ERROR if CURLE_PROXY was + * return for the transfers. + */ +typedef enum { + CURLPX_OK, + CURLPX_BAD_ADDRESS_TYPE, + CURLPX_BAD_VERSION, + CURLPX_CLOSED, + CURLPX_GSSAPI, + CURLPX_GSSAPI_PERMSG, + CURLPX_GSSAPI_PROTECTION, + CURLPX_IDENTD, + CURLPX_IDENTD_DIFFER, + CURLPX_LONG_HOSTNAME, + CURLPX_LONG_PASSWD, + CURLPX_LONG_USER, + CURLPX_NO_AUTH, + CURLPX_RECV_ADDRESS, + CURLPX_RECV_AUTH, + CURLPX_RECV_CONNECT, + CURLPX_RECV_REQACK, + CURLPX_REPLY_ADDRESS_TYPE_NOT_SUPPORTED, + CURLPX_REPLY_COMMAND_NOT_SUPPORTED, + CURLPX_REPLY_CONNECTION_REFUSED, + CURLPX_REPLY_GENERAL_SERVER_FAILURE, + CURLPX_REPLY_HOST_UNREACHABLE, + CURLPX_REPLY_NETWORK_UNREACHABLE, + CURLPX_REPLY_NOT_ALLOWED, + CURLPX_REPLY_TTL_EXPIRED, + CURLPX_REPLY_UNASSIGNED, + CURLPX_REQUEST_FAILED, + CURLPX_RESOLVE_HOST, + CURLPX_SEND_AUTH, + CURLPX_SEND_CONNECT, + CURLPX_SEND_REQUEST, + CURLPX_UNKNOWN_FAIL, + CURLPX_UNKNOWN_MODE, + CURLPX_USER_REJECTED, + CURLPX_LAST /* never use */ +} CURLproxycode; + +/* This prototype applies to all conversion callbacks */ +typedef CURLcode (*curl_conv_callback)(char *buffer, size_t length); + +typedef CURLcode (*curl_ssl_ctx_callback)(CURL *curl, /* easy handle */ + void *ssl_ctx, /* actually an OpenSSL + or wolfSSL SSL_CTX, + or an mbedTLS + mbedtls_ssl_config */ + void *userptr); + +typedef enum { + CURLPROXY_HTTP = 0, /* added in 7.10, new in 7.19.4 default is to use + CONNECT HTTP/1.1 */ + CURLPROXY_HTTP_1_0 = 1, /* added in 7.19.4, force to use CONNECT + HTTP/1.0 */ + CURLPROXY_HTTPS = 2, /* HTTPS but stick to HTTP/1 added in 7.52.0 */ + CURLPROXY_HTTPS2 = 3, /* HTTPS and attempt HTTP/2 added in 8.2.0 */ + CURLPROXY_SOCKS4 = 4, /* support added in 7.15.2, enum existed already + in 7.10 */ + CURLPROXY_SOCKS5 = 5, /* added in 7.10 */ + CURLPROXY_SOCKS4A = 6, /* added in 7.18.0 */ + CURLPROXY_SOCKS5_HOSTNAME = 7 /* Use the SOCKS5 protocol but pass along the + hostname rather than the IP address. added + in 7.18.0 */ +} curl_proxytype; /* this enum was added in 7.10 */ + +/* + * Bitmasks for CURLOPT_HTTPAUTH and CURLOPT_PROXYAUTH options: + * + * CURLAUTH_NONE - No HTTP authentication + * CURLAUTH_BASIC - HTTP Basic authentication (default) + * CURLAUTH_DIGEST - HTTP Digest authentication + * CURLAUTH_NEGOTIATE - HTTP Negotiate (SPNEGO) authentication + * CURLAUTH_GSSNEGOTIATE - Alias for CURLAUTH_NEGOTIATE (deprecated) + * CURLAUTH_NTLM - HTTP NTLM authentication + * CURLAUTH_DIGEST_IE - HTTP Digest authentication with IE flavour + * CURLAUTH_NTLM_WB - HTTP NTLM authentication delegated to winbind helper + * CURLAUTH_BEARER - HTTP Bearer token authentication + * CURLAUTH_ONLY - Use together with a single other type to force no + * authentication or just that single type + * CURLAUTH_ANY - All fine types set + * CURLAUTH_ANYSAFE - All fine types except Basic + */ + +#define CURLAUTH_NONE ((unsigned long)0) +#define CURLAUTH_BASIC (((unsigned long)1)<<0) +#define CURLAUTH_DIGEST (((unsigned long)1)<<1) +#define CURLAUTH_NEGOTIATE (((unsigned long)1)<<2) +/* Deprecated since the advent of CURLAUTH_NEGOTIATE */ +#define CURLAUTH_GSSNEGOTIATE CURLAUTH_NEGOTIATE +/* Used for CURLOPT_SOCKS5_AUTH to stay terminologically correct */ +#define CURLAUTH_GSSAPI CURLAUTH_NEGOTIATE +#define CURLAUTH_NTLM (((unsigned long)1)<<3) +#define CURLAUTH_DIGEST_IE (((unsigned long)1)<<4) +#ifndef CURL_NO_OLDIES + /* functionality removed since 8.8.0 */ +#define CURLAUTH_NTLM_WB (((unsigned long)1)<<5) +#endif +#define CURLAUTH_BEARER (((unsigned long)1)<<6) +#define CURLAUTH_AWS_SIGV4 (((unsigned long)1)<<7) +#define CURLAUTH_ONLY (((unsigned long)1)<<31) +#define CURLAUTH_ANY (~CURLAUTH_DIGEST_IE) +#define CURLAUTH_ANYSAFE (~(CURLAUTH_BASIC|CURLAUTH_DIGEST_IE)) + +#define CURLSSH_AUTH_ANY ~0 /* all types supported by the server */ +#define CURLSSH_AUTH_NONE 0 /* none allowed, silly but complete */ +#define CURLSSH_AUTH_PUBLICKEY (1<<0) /* public/private key files */ +#define CURLSSH_AUTH_PASSWORD (1<<1) /* password */ +#define CURLSSH_AUTH_HOST (1<<2) /* host key files */ +#define CURLSSH_AUTH_KEYBOARD (1<<3) /* keyboard interactive */ +#define CURLSSH_AUTH_AGENT (1<<4) /* agent (ssh-agent, pageant...) */ +#define CURLSSH_AUTH_GSSAPI (1<<5) /* gssapi (kerberos, ...) */ +#define CURLSSH_AUTH_DEFAULT CURLSSH_AUTH_ANY + +#define CURLGSSAPI_DELEGATION_NONE 0 /* no delegation (default) */ +#define CURLGSSAPI_DELEGATION_POLICY_FLAG (1<<0) /* if permitted by policy */ +#define CURLGSSAPI_DELEGATION_FLAG (1<<1) /* delegate always */ + +#define CURL_ERROR_SIZE 256 + +enum curl_khtype { + CURLKHTYPE_UNKNOWN, + CURLKHTYPE_RSA1, + CURLKHTYPE_RSA, + CURLKHTYPE_DSS, + CURLKHTYPE_ECDSA, + CURLKHTYPE_ED25519 +}; + +struct curl_khkey { + const char *key; /* points to a null-terminated string encoded with base64 + if len is zero, otherwise to the "raw" data */ + size_t len; + enum curl_khtype keytype; +}; + +/* this is the set of return values expected from the curl_sshkeycallback + callback */ +enum curl_khstat { + CURLKHSTAT_FINE_ADD_TO_FILE, + CURLKHSTAT_FINE, + CURLKHSTAT_REJECT, /* reject the connection, return an error */ + CURLKHSTAT_DEFER, /* do not accept it, but we cannot answer right now. + Causes a CURLE_PEER_FAILED_VERIFICATION error but the + connection will be left intact etc */ + CURLKHSTAT_FINE_REPLACE, /* accept and replace the wrong key */ + CURLKHSTAT_LAST /* not for use, only a marker for last-in-list */ +}; + +/* this is the set of status codes pass in to the callback */ +enum curl_khmatch { + CURLKHMATCH_OK, /* match */ + CURLKHMATCH_MISMATCH, /* host found, key mismatch! */ + CURLKHMATCH_MISSING, /* no matching host/key found */ + CURLKHMATCH_LAST /* not for use, only a marker for last-in-list */ +}; + +typedef int + (*curl_sshkeycallback) (CURL *easy, /* easy handle */ + const struct curl_khkey *knownkey, /* known */ + const struct curl_khkey *foundkey, /* found */ + enum curl_khmatch, /* libcurl's view on the keys */ + void *clientp); /* custom pointer passed with */ + /* CURLOPT_SSH_KEYDATA */ + +typedef int + (*curl_sshhostkeycallback) (void *clientp,/* custom pointer passed */ + /* with CURLOPT_SSH_HOSTKEYDATA */ + int keytype, /* CURLKHTYPE */ + const char *key, /* hostkey to check */ + size_t keylen); /* length of the key */ + /* return CURLE_OK to accept */ + /* or something else to refuse */ + + +/* parameter for the CURLOPT_USE_SSL option */ +#define CURLUSESSL_NONE 0L /* do not attempt to use SSL */ +#define CURLUSESSL_TRY 1L /* try using SSL, proceed anyway otherwise */ +#define CURLUSESSL_CONTROL 2L /* SSL for the control connection or fail */ +#define CURLUSESSL_ALL 3L /* SSL for all communication or fail */ + +typedef enum { + CURLUSESSL_LAST = 4 /* not an option, never use */ +} curl_usessl; + +/* Definition of bits for the CURLOPT_SSL_OPTIONS argument: */ + +/* - ALLOW_BEAST tells libcurl to allow the BEAST SSL vulnerability in the + name of improving interoperability with older servers. Some SSL libraries + have introduced work-arounds for this flaw but those work-arounds sometimes + make the SSL communication fail. To regain functionality with those broken + servers, a user can this way allow the vulnerability back. */ +#define CURLSSLOPT_ALLOW_BEAST (1<<0) + +/* - NO_REVOKE tells libcurl to disable certificate revocation checks for those + SSL backends where such behavior is present. */ +#define CURLSSLOPT_NO_REVOKE (1<<1) + +/* - NO_PARTIALCHAIN tells libcurl to *NOT* accept a partial certificate chain + if possible. The OpenSSL backend has this ability. */ +#define CURLSSLOPT_NO_PARTIALCHAIN (1<<2) + +/* - REVOKE_BEST_EFFORT tells libcurl to ignore certificate revocation offline + checks and ignore missing revocation list for those SSL backends where such + behavior is present. */ +#define CURLSSLOPT_REVOKE_BEST_EFFORT (1<<3) + +/* - CURLSSLOPT_NATIVE_CA tells libcurl to use standard certificate store of + operating system. Currently implemented under MS-Windows. */ +#define CURLSSLOPT_NATIVE_CA (1<<4) + +/* - CURLSSLOPT_AUTO_CLIENT_CERT tells libcurl to automatically locate and use + a client certificate for authentication. (Schannel) */ +#define CURLSSLOPT_AUTO_CLIENT_CERT (1<<5) + +/* If possible, send data using TLS 1.3 early data */ +#define CURLSSLOPT_EARLYDATA (1<<6) + +/* The default connection attempt delay in milliseconds for happy eyeballs. + CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS.3 and happy-eyeballs-timeout-ms.d document + this value, keep them in sync. */ +#define CURL_HET_DEFAULT 200L + +/* The default connection upkeep interval in milliseconds. */ +#define CURL_UPKEEP_INTERVAL_DEFAULT 60000L + +#ifndef CURL_NO_OLDIES /* define this to test if your app builds with all + the obsolete stuff removed! */ + +/* Backwards compatibility with older names */ +/* These are scheduled to disappear by 2009 */ + +#define CURLFTPSSL_NONE CURLUSESSL_NONE +#define CURLFTPSSL_TRY CURLUSESSL_TRY +#define CURLFTPSSL_CONTROL CURLUSESSL_CONTROL +#define CURLFTPSSL_ALL CURLUSESSL_ALL +#define CURLFTPSSL_LAST CURLUSESSL_LAST +#define curl_ftpssl curl_usessl +#endif /* !CURL_NO_OLDIES */ + +/* parameter for the CURLOPT_FTP_SSL_CCC option */ +typedef enum { + CURLFTPSSL_CCC_NONE, /* do not send CCC */ + CURLFTPSSL_CCC_PASSIVE, /* Let the server initiate the shutdown */ + CURLFTPSSL_CCC_ACTIVE, /* Initiate the shutdown */ + CURLFTPSSL_CCC_LAST /* not an option, never use */ +} curl_ftpccc; + +/* parameter for the CURLOPT_FTPSSLAUTH option */ +typedef enum { + CURLFTPAUTH_DEFAULT, /* let libcurl decide */ + CURLFTPAUTH_SSL, /* use "AUTH SSL" */ + CURLFTPAUTH_TLS, /* use "AUTH TLS" */ + CURLFTPAUTH_LAST /* not an option, never use */ +} curl_ftpauth; + +/* parameter for the CURLOPT_FTP_CREATE_MISSING_DIRS option */ +typedef enum { + CURLFTP_CREATE_DIR_NONE, /* do NOT create missing dirs! */ + CURLFTP_CREATE_DIR, /* (FTP/SFTP) if CWD fails, try MKD and then CWD + again if MKD succeeded, for SFTP this does + similar magic */ + CURLFTP_CREATE_DIR_RETRY, /* (FTP only) if CWD fails, try MKD and then CWD + again even if MKD failed! */ + CURLFTP_CREATE_DIR_LAST /* not an option, never use */ +} curl_ftpcreatedir; + +/* parameter for the CURLOPT_FTP_FILEMETHOD option */ +typedef enum { + CURLFTPMETHOD_DEFAULT, /* let libcurl pick */ + CURLFTPMETHOD_MULTICWD, /* single CWD operation for each path part */ + CURLFTPMETHOD_NOCWD, /* no CWD at all */ + CURLFTPMETHOD_SINGLECWD, /* one CWD to full dir, then work on file */ + CURLFTPMETHOD_LAST /* not an option, never use */ +} curl_ftpmethod; + +/* bitmask defines for CURLOPT_HEADEROPT */ +#define CURLHEADER_UNIFIED 0 +#define CURLHEADER_SEPARATE (1<<0) + +/* CURLALTSVC_* are bits for the CURLOPT_ALTSVC_CTRL option */ +#define CURLALTSVC_READONLYFILE (1<<2) +#define CURLALTSVC_H1 (1<<3) +#define CURLALTSVC_H2 (1<<4) +#define CURLALTSVC_H3 (1<<5) + +/* bitmask values for CURLOPT_UPLOAD_FLAGS */ +#define CURLULFLAG_ANSWERED (1L<<0) +#define CURLULFLAG_DELETED (1L<<1) +#define CURLULFLAG_DRAFT (1L<<2) +#define CURLULFLAG_FLAGGED (1L<<3) +#define CURLULFLAG_SEEN (1L<<4) + +struct curl_hstsentry { + char *name; + size_t namelen; + unsigned int includeSubDomains:1; + char expire[18]; /* YYYYMMDD HH:MM:SS [null-terminated] */ +}; + +struct curl_index { + size_t index; /* the provided entry's "index" or count */ + size_t total; /* total number of entries to save */ +}; + +typedef enum { + CURLSTS_OK, + CURLSTS_DONE, + CURLSTS_FAIL +} CURLSTScode; + +typedef CURLSTScode (*curl_hstsread_callback)(CURL *easy, + struct curl_hstsentry *e, + void *userp); +typedef CURLSTScode (*curl_hstswrite_callback)(CURL *easy, + struct curl_hstsentry *e, + struct curl_index *i, + void *userp); + +/* CURLHSTS_* are bits for the CURLOPT_HSTS option */ +#define CURLHSTS_ENABLE (long)(1<<0) +#define CURLHSTS_READONLYFILE (long)(1<<1) + +/* The CURLPROTO_ defines below are for the **deprecated** CURLOPT_*PROTOCOLS + options. Do not use. */ +#define CURLPROTO_HTTP (1<<0) +#define CURLPROTO_HTTPS (1<<1) +#define CURLPROTO_FTP (1<<2) +#define CURLPROTO_FTPS (1<<3) +#define CURLPROTO_SCP (1<<4) +#define CURLPROTO_SFTP (1<<5) +#define CURLPROTO_TELNET (1<<6) +#define CURLPROTO_LDAP (1<<7) +#define CURLPROTO_LDAPS (1<<8) +#define CURLPROTO_DICT (1<<9) +#define CURLPROTO_FILE (1<<10) +#define CURLPROTO_TFTP (1<<11) +#define CURLPROTO_IMAP (1<<12) +#define CURLPROTO_IMAPS (1<<13) +#define CURLPROTO_POP3 (1<<14) +#define CURLPROTO_POP3S (1<<15) +#define CURLPROTO_SMTP (1<<16) +#define CURLPROTO_SMTPS (1<<17) +#define CURLPROTO_RTSP (1<<18) +#define CURLPROTO_RTMP (1<<19) +#define CURLPROTO_RTMPT (1<<20) +#define CURLPROTO_RTMPE (1<<21) +#define CURLPROTO_RTMPTE (1<<22) +#define CURLPROTO_RTMPS (1<<23) +#define CURLPROTO_RTMPTS (1<<24) +#define CURLPROTO_GOPHER (1<<25) +#define CURLPROTO_SMB (1<<26) +#define CURLPROTO_SMBS (1<<27) +#define CURLPROTO_MQTT (1<<28) +#define CURLPROTO_GOPHERS (1<<29) +#define CURLPROTO_ALL (~0) /* enable everything */ + +/* long may be 32 or 64 bits, but we should never depend on anything else + but 32 */ +#define CURLOPTTYPE_LONG 0 +#define CURLOPTTYPE_OBJECTPOINT 10000 +#define CURLOPTTYPE_FUNCTIONPOINT 20000 +#define CURLOPTTYPE_OFF_T 30000 +#define CURLOPTTYPE_BLOB 40000 + +/* *STRINGPOINT is an alias for OBJECTPOINT to allow tools to extract the + string options from the header file */ + + +#define CURLOPT(na,t,nu) na = t + nu +#define CURLOPTDEPRECATED(na,t,nu,v,m) na CURL_DEPRECATED(v,m) = t + nu + +/* CURLOPT aliases that make no runtime difference */ + +/* 'char *' argument to a string with a trailing zero */ +#define CURLOPTTYPE_STRINGPOINT CURLOPTTYPE_OBJECTPOINT + +/* 'struct curl_slist *' argument */ +#define CURLOPTTYPE_SLISTPOINT CURLOPTTYPE_OBJECTPOINT + +/* 'void *' argument passed untouched to callback */ +#define CURLOPTTYPE_CBPOINT CURLOPTTYPE_OBJECTPOINT + +/* 'long' argument with a set of values/bitmask */ +#define CURLOPTTYPE_VALUES CURLOPTTYPE_LONG + +/* + * All CURLOPT_* values. + */ + +typedef enum { + /* This is the FILE * or void * the regular output should be written to. */ + CURLOPT(CURLOPT_WRITEDATA, CURLOPTTYPE_CBPOINT, 1), + + /* The full URL to get/put */ + CURLOPT(CURLOPT_URL, CURLOPTTYPE_STRINGPOINT, 2), + + /* Port number to connect to, if other than default. */ + CURLOPT(CURLOPT_PORT, CURLOPTTYPE_LONG, 3), + + /* Name of proxy to use. */ + CURLOPT(CURLOPT_PROXY, CURLOPTTYPE_STRINGPOINT, 4), + + /* "user:password;options" to use when fetching. */ + CURLOPT(CURLOPT_USERPWD, CURLOPTTYPE_STRINGPOINT, 5), + + /* "user:password" to use with proxy. */ + CURLOPT(CURLOPT_PROXYUSERPWD, CURLOPTTYPE_STRINGPOINT, 6), + + /* Range to get, specified as an ASCII string. */ + CURLOPT(CURLOPT_RANGE, CURLOPTTYPE_STRINGPOINT, 7), + + /* not used */ + + /* Specified file stream to upload from (use as input): */ + CURLOPT(CURLOPT_READDATA, CURLOPTTYPE_CBPOINT, 9), + + /* Buffer to receive error messages in, must be at least CURL_ERROR_SIZE + * bytes big. */ + CURLOPT(CURLOPT_ERRORBUFFER, CURLOPTTYPE_OBJECTPOINT, 10), + + /* Function that will be called to store the output (instead of fwrite). The + * parameters will use fwrite() syntax, make sure to follow them. */ + CURLOPT(CURLOPT_WRITEFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 11), + + /* Function that will be called to read the input (instead of fread). The + * parameters will use fread() syntax, make sure to follow them. */ + CURLOPT(CURLOPT_READFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 12), + + /* Time-out the read operation after this amount of seconds */ + CURLOPT(CURLOPT_TIMEOUT, CURLOPTTYPE_LONG, 13), + + /* If CURLOPT_READDATA is used, this can be used to inform libcurl about + * how large the file being sent really is. That allows better error + * checking and better verifies that the upload was successful. -1 means + * unknown size. + * + * For large file support, there is also a _LARGE version of the key + * which takes an off_t type, allowing platforms with larger off_t + * sizes to handle larger files. See below for INFILESIZE_LARGE. + */ + CURLOPT(CURLOPT_INFILESIZE, CURLOPTTYPE_LONG, 14), + + /* POST static input fields. */ + CURLOPT(CURLOPT_POSTFIELDS, CURLOPTTYPE_OBJECTPOINT, 15), + + /* Set the referrer page (needed by some CGIs) */ + CURLOPT(CURLOPT_REFERER, CURLOPTTYPE_STRINGPOINT, 16), + + /* Set the FTP PORT string (interface name, named or numerical IP address) + Use i.e '-' to use default address. */ + CURLOPT(CURLOPT_FTPPORT, CURLOPTTYPE_STRINGPOINT, 17), + + /* Set the User-Agent string (examined by some CGIs) */ + CURLOPT(CURLOPT_USERAGENT, CURLOPTTYPE_STRINGPOINT, 18), + + /* If the download receives less than "low speed limit" bytes/second + * during "low speed time" seconds, the operations is aborted. + * You could i.e if you have a pretty high speed connection, abort if + * it is less than 2000 bytes/sec during 20 seconds. + */ + + /* Set the "low speed limit" */ + CURLOPT(CURLOPT_LOW_SPEED_LIMIT, CURLOPTTYPE_LONG, 19), + + /* Set the "low speed time" */ + CURLOPT(CURLOPT_LOW_SPEED_TIME, CURLOPTTYPE_LONG, 20), + + /* Set the continuation offset. + * + * Note there is also a _LARGE version of this key which uses + * off_t types, allowing for large file offsets on platforms which + * use larger-than-32-bit off_t's. Look below for RESUME_FROM_LARGE. + */ + CURLOPT(CURLOPT_RESUME_FROM, CURLOPTTYPE_LONG, 21), + + /* Set cookie in request: */ + CURLOPT(CURLOPT_COOKIE, CURLOPTTYPE_STRINGPOINT, 22), + + /* This points to a linked list of headers, struct curl_slist kind. This + list is also used for RTSP (in spite of its name) */ + CURLOPT(CURLOPT_HTTPHEADER, CURLOPTTYPE_SLISTPOINT, 23), + + /* This points to a linked list of post entries, struct curl_httppost */ + CURLOPTDEPRECATED(CURLOPT_HTTPPOST, CURLOPTTYPE_OBJECTPOINT, 24, + 7.56.0, "Use CURLOPT_MIMEPOST"), + + /* name of the file keeping your private SSL-certificate */ + CURLOPT(CURLOPT_SSLCERT, CURLOPTTYPE_STRINGPOINT, 25), + + /* password for the SSL or SSH private key */ + CURLOPT(CURLOPT_KEYPASSWD, CURLOPTTYPE_STRINGPOINT, 26), + + /* send TYPE parameter? */ + CURLOPT(CURLOPT_CRLF, CURLOPTTYPE_LONG, 27), + + /* send linked-list of QUOTE commands */ + CURLOPT(CURLOPT_QUOTE, CURLOPTTYPE_SLISTPOINT, 28), + + /* send FILE * or void * to store headers to, if you use a callback it + is simply passed to the callback unmodified */ + CURLOPT(CURLOPT_HEADERDATA, CURLOPTTYPE_CBPOINT, 29), + + /* point to a file to read the initial cookies from, also enables + "cookie awareness" */ + CURLOPT(CURLOPT_COOKIEFILE, CURLOPTTYPE_STRINGPOINT, 31), + + /* What version to specifically try to use. + See CURL_SSLVERSION defines below. */ + CURLOPT(CURLOPT_SSLVERSION, CURLOPTTYPE_VALUES, 32), + + /* What kind of HTTP time condition to use, see defines */ + CURLOPT(CURLOPT_TIMECONDITION, CURLOPTTYPE_VALUES, 33), + + /* Time to use with the above condition. Specified in number of seconds + since 1 Jan 1970 */ + CURLOPT(CURLOPT_TIMEVALUE, CURLOPTTYPE_LONG, 34), + + /* 35 = OBSOLETE */ + + /* Custom request, for customizing the get command like + HTTP: DELETE, TRACE and others + FTP: to use a different list command + */ + CURLOPT(CURLOPT_CUSTOMREQUEST, CURLOPTTYPE_STRINGPOINT, 36), + + /* FILE handle to use instead of stderr */ + CURLOPT(CURLOPT_STDERR, CURLOPTTYPE_OBJECTPOINT, 37), + + /* 38 is not used */ + + /* send linked-list of post-transfer QUOTE commands */ + CURLOPT(CURLOPT_POSTQUOTE, CURLOPTTYPE_SLISTPOINT, 39), + + /* 40 is not used */ + + /* talk a lot */ + CURLOPT(CURLOPT_VERBOSE, CURLOPTTYPE_LONG, 41), + + /* throw the header out too */ + CURLOPT(CURLOPT_HEADER, CURLOPTTYPE_LONG, 42), + + /* shut off the progress meter */ + CURLOPT(CURLOPT_NOPROGRESS, CURLOPTTYPE_LONG, 43), + + /* use HEAD to get http document */ + CURLOPT(CURLOPT_NOBODY, CURLOPTTYPE_LONG, 44), + + /* no output on http error codes >= 400 */ + CURLOPT(CURLOPT_FAILONERROR, CURLOPTTYPE_LONG, 45), + + /* this is an upload */ + CURLOPT(CURLOPT_UPLOAD, CURLOPTTYPE_LONG, 46), + + /* HTTP POST method */ + CURLOPT(CURLOPT_POST, CURLOPTTYPE_LONG, 47), + + /* bare names when listing directories */ + CURLOPT(CURLOPT_DIRLISTONLY, CURLOPTTYPE_LONG, 48), + + /* Append instead of overwrite on upload! */ + CURLOPT(CURLOPT_APPEND, CURLOPTTYPE_LONG, 50), + + /* Specify whether to read the user+password from the .netrc or the URL. + * This must be one of the CURL_NETRC_* enums below. */ + CURLOPT(CURLOPT_NETRC, CURLOPTTYPE_VALUES, 51), + + /* use Location: Luke! */ + CURLOPT(CURLOPT_FOLLOWLOCATION, CURLOPTTYPE_LONG, 52), + + /* transfer data in text/ASCII format */ + CURLOPT(CURLOPT_TRANSFERTEXT, CURLOPTTYPE_LONG, 53), + + /* HTTP PUT */ + CURLOPTDEPRECATED(CURLOPT_PUT, CURLOPTTYPE_LONG, 54, + 7.12.1, "Use CURLOPT_UPLOAD"), + + /* 55 = OBSOLETE */ + + /* DEPRECATED + * Function that will be called instead of the internal progress display + * function. This function should be defined as the curl_progress_callback + * prototype defines. */ + CURLOPTDEPRECATED(CURLOPT_PROGRESSFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 56, + 7.32.0, "Use CURLOPT_XFERINFOFUNCTION"), + + /* Data passed to the CURLOPT_PROGRESSFUNCTION and CURLOPT_XFERINFOFUNCTION + callbacks */ + CURLOPT(CURLOPT_XFERINFODATA, CURLOPTTYPE_CBPOINT, 57), +#define CURLOPT_PROGRESSDATA CURLOPT_XFERINFODATA + + /* We want the referrer field set automatically when following locations */ + CURLOPT(CURLOPT_AUTOREFERER, CURLOPTTYPE_LONG, 58), + + /* Port of the proxy, can be set in the proxy string as well with: + "[host]:[port]" */ + CURLOPT(CURLOPT_PROXYPORT, CURLOPTTYPE_LONG, 59), + + /* size of the POST input data, if strlen() is not good to use */ + CURLOPT(CURLOPT_POSTFIELDSIZE, CURLOPTTYPE_LONG, 60), + + /* tunnel non-http operations through an HTTP proxy */ + CURLOPT(CURLOPT_HTTPPROXYTUNNEL, CURLOPTTYPE_LONG, 61), + + /* Set the interface string to use as outgoing network interface */ + CURLOPT(CURLOPT_INTERFACE, CURLOPTTYPE_STRINGPOINT, 62), + + /* Set the krb4/5 security level, this also enables krb4/5 awareness. This + * is a string, 'clear', 'safe', 'confidential' or 'private'. If the string + * is set but does not match one of these, 'private' will be used. */ + CURLOPT(CURLOPT_KRBLEVEL, CURLOPTTYPE_STRINGPOINT, 63), + + /* Set if we should verify the peer in ssl handshake, set 1 to verify. */ + CURLOPT(CURLOPT_SSL_VERIFYPEER, CURLOPTTYPE_LONG, 64), + + /* The CApath or CAfile used to validate the peer certificate + this option is used only if SSL_VERIFYPEER is true */ + CURLOPT(CURLOPT_CAINFO, CURLOPTTYPE_STRINGPOINT, 65), + + /* 66 = OBSOLETE */ + /* 67 = OBSOLETE */ + + /* Maximum number of http redirects to follow */ + CURLOPT(CURLOPT_MAXREDIRS, CURLOPTTYPE_LONG, 68), + + /* Pass a long set to 1 to get the date of the requested document (if + possible)! Pass a zero to shut it off. */ + CURLOPT(CURLOPT_FILETIME, CURLOPTTYPE_LONG, 69), + + /* This points to a linked list of telnet options */ + CURLOPT(CURLOPT_TELNETOPTIONS, CURLOPTTYPE_SLISTPOINT, 70), + + /* Max amount of cached alive connections */ + CURLOPT(CURLOPT_MAXCONNECTS, CURLOPTTYPE_LONG, 71), + + /* 72 = OBSOLETE */ + /* 73 = OBSOLETE */ + + /* Set to explicitly use a new connection for the upcoming transfer. + Do not use this unless you are absolutely sure of this, as it makes the + operation slower and is less friendly for the network. */ + CURLOPT(CURLOPT_FRESH_CONNECT, CURLOPTTYPE_LONG, 74), + + /* Set to explicitly forbid the upcoming transfer's connection to be reused + when done. Do not use this unless you are absolutely sure of this, as it + makes the operation slower and is less friendly for the network. */ + CURLOPT(CURLOPT_FORBID_REUSE, CURLOPTTYPE_LONG, 75), + + /* Set to a filename that contains random data for libcurl to use to + seed the random engine when doing SSL connects. */ + CURLOPTDEPRECATED(CURLOPT_RANDOM_FILE, CURLOPTTYPE_STRINGPOINT, 76, + 7.84.0, "Serves no purpose anymore"), + + /* Set to the Entropy Gathering Daemon socket pathname */ + CURLOPTDEPRECATED(CURLOPT_EGDSOCKET, CURLOPTTYPE_STRINGPOINT, 77, + 7.84.0, "Serves no purpose anymore"), + + /* Time-out connect operations after this amount of seconds, if connects are + OK within this time, then fine... This only aborts the connect phase. */ + CURLOPT(CURLOPT_CONNECTTIMEOUT, CURLOPTTYPE_LONG, 78), + + /* Function that will be called to store headers (instead of fwrite). The + * parameters will use fwrite() syntax, make sure to follow them. */ + CURLOPT(CURLOPT_HEADERFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 79), + + /* Set this to force the HTTP request to get back to GET. Only really usable + if POST, PUT or a custom request have been used first. + */ + CURLOPT(CURLOPT_HTTPGET, CURLOPTTYPE_LONG, 80), + + /* Set if we should verify the Common name from the peer certificate in ssl + * handshake, set 1 to check existence, 2 to ensure that it matches the + * provided hostname. */ + CURLOPT(CURLOPT_SSL_VERIFYHOST, CURLOPTTYPE_LONG, 81), + + /* Specify which filename to write all known cookies in after completed + operation. Set filename to "-" (dash) to make it go to stdout. */ + CURLOPT(CURLOPT_COOKIEJAR, CURLOPTTYPE_STRINGPOINT, 82), + + /* Specify which TLS 1.2 (1.1, 1.0) ciphers to use */ + CURLOPT(CURLOPT_SSL_CIPHER_LIST, CURLOPTTYPE_STRINGPOINT, 83), + + /* Specify which HTTP version to use! This must be set to one of the + CURL_HTTP_VERSION* enums set below. */ + CURLOPT(CURLOPT_HTTP_VERSION, CURLOPTTYPE_VALUES, 84), + + /* Specifically switch on or off the FTP engine's use of the EPSV command. By + default, that one will always be attempted before the more traditional + PASV command. */ + CURLOPT(CURLOPT_FTP_USE_EPSV, CURLOPTTYPE_LONG, 85), + + /* type of the file keeping your SSL-certificate ("DER", "PEM", "ENG") */ + CURLOPT(CURLOPT_SSLCERTTYPE, CURLOPTTYPE_STRINGPOINT, 86), + + /* name of the file keeping your private SSL-key */ + CURLOPT(CURLOPT_SSLKEY, CURLOPTTYPE_STRINGPOINT, 87), + + /* type of the file keeping your private SSL-key ("DER", "PEM", "ENG") */ + CURLOPT(CURLOPT_SSLKEYTYPE, CURLOPTTYPE_STRINGPOINT, 88), + + /* crypto engine for the SSL-sub system */ + CURLOPT(CURLOPT_SSLENGINE, CURLOPTTYPE_STRINGPOINT, 89), + + /* set the crypto engine for the SSL-sub system as default + the param has no meaning... + */ + CURLOPT(CURLOPT_SSLENGINE_DEFAULT, CURLOPTTYPE_LONG, 90), + + /* Non-zero value means to use the global dns cache */ + /* DEPRECATED, do not use! */ + CURLOPTDEPRECATED(CURLOPT_DNS_USE_GLOBAL_CACHE, CURLOPTTYPE_LONG, 91, + 7.11.1, "Use CURLOPT_SHARE"), + + /* DNS cache timeout */ + CURLOPT(CURLOPT_DNS_CACHE_TIMEOUT, CURLOPTTYPE_LONG, 92), + + /* send linked-list of pre-transfer QUOTE commands */ + CURLOPT(CURLOPT_PREQUOTE, CURLOPTTYPE_SLISTPOINT, 93), + + /* set the debug function */ + CURLOPT(CURLOPT_DEBUGFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 94), + + /* set the data for the debug function */ + CURLOPT(CURLOPT_DEBUGDATA, CURLOPTTYPE_CBPOINT, 95), + + /* mark this as start of a cookie session */ + CURLOPT(CURLOPT_COOKIESESSION, CURLOPTTYPE_LONG, 96), + + /* The CApath directory used to validate the peer certificate + this option is used only if SSL_VERIFYPEER is true */ + CURLOPT(CURLOPT_CAPATH, CURLOPTTYPE_STRINGPOINT, 97), + + /* Instruct libcurl to use a smaller receive buffer */ + CURLOPT(CURLOPT_BUFFERSIZE, CURLOPTTYPE_LONG, 98), + + /* Instruct libcurl to not use any signal/alarm handlers, even when using + timeouts. This option is useful for multi-threaded applications. + See libcurl-the-guide for more background information. */ + CURLOPT(CURLOPT_NOSIGNAL, CURLOPTTYPE_LONG, 99), + + /* Provide a CURLShare for mutexing non-ts data */ + CURLOPT(CURLOPT_SHARE, CURLOPTTYPE_OBJECTPOINT, 100), + + /* indicates type of proxy. accepted values are CURLPROXY_HTTP (default), + CURLPROXY_HTTPS, CURLPROXY_SOCKS4, CURLPROXY_SOCKS4A and + CURLPROXY_SOCKS5. */ + CURLOPT(CURLOPT_PROXYTYPE, CURLOPTTYPE_VALUES, 101), + + /* Set the Accept-Encoding string. Use this to tell a server you would like + the response to be compressed. Before 7.21.6, this was known as + CURLOPT_ENCODING */ + CURLOPT(CURLOPT_ACCEPT_ENCODING, CURLOPTTYPE_STRINGPOINT, 102), + + /* Set pointer to private data */ + CURLOPT(CURLOPT_PRIVATE, CURLOPTTYPE_OBJECTPOINT, 103), + + /* Set aliases for HTTP 200 in the HTTP Response header */ + CURLOPT(CURLOPT_HTTP200ALIASES, CURLOPTTYPE_SLISTPOINT, 104), + + /* Continue to send authentication (user+password) when following locations, + even when hostname changed. This can potentially send off the name + and password to whatever host the server decides. */ + CURLOPT(CURLOPT_UNRESTRICTED_AUTH, CURLOPTTYPE_LONG, 105), + + /* Specifically switch on or off the FTP engine's use of the EPRT command ( + it also disables the LPRT attempt). By default, those ones will always be + attempted before the good old traditional PORT command. */ + CURLOPT(CURLOPT_FTP_USE_EPRT, CURLOPTTYPE_LONG, 106), + + /* Set this to a bitmask value to enable the particular authentications + methods you like. Use this in combination with CURLOPT_USERPWD. + Note that setting multiple bits may cause extra network round-trips. */ + CURLOPT(CURLOPT_HTTPAUTH, CURLOPTTYPE_VALUES, 107), + + /* Set the ssl context callback function, currently only for OpenSSL or + wolfSSL ssl_ctx, or mbedTLS mbedtls_ssl_config in the second argument. + The function must match the curl_ssl_ctx_callback prototype. */ + CURLOPT(CURLOPT_SSL_CTX_FUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 108), + + /* Set the userdata for the ssl context callback function's third + argument */ + CURLOPT(CURLOPT_SSL_CTX_DATA, CURLOPTTYPE_CBPOINT, 109), + + /* FTP Option that causes missing dirs to be created on the remote server. + In 7.19.4 we introduced the convenience enums for this option using the + CURLFTP_CREATE_DIR prefix. + */ + CURLOPT(CURLOPT_FTP_CREATE_MISSING_DIRS, CURLOPTTYPE_LONG, 110), + + /* Set this to a bitmask value to enable the particular authentications + methods you like. Use this in combination with CURLOPT_PROXYUSERPWD. + Note that setting multiple bits may cause extra network round-trips. */ + CURLOPT(CURLOPT_PROXYAUTH, CURLOPTTYPE_VALUES, 111), + + /* Option that changes the timeout, in seconds, associated with getting a + response. This is different from transfer timeout time and essentially + places a demand on the server to acknowledge commands in a timely + manner. For FTP, SMTP, IMAP and POP3. */ + CURLOPT(CURLOPT_SERVER_RESPONSE_TIMEOUT, CURLOPTTYPE_LONG, 112), + + /* Set this option to one of the CURL_IPRESOLVE_* defines (see below) to + tell libcurl to use those IP versions only. This only has effect on + systems with support for more than one, i.e IPv4 _and_ IPv6. */ + CURLOPT(CURLOPT_IPRESOLVE, CURLOPTTYPE_VALUES, 113), + + /* Set this option to limit the size of a file that will be downloaded from + an HTTP or FTP server. + + Note there is also _LARGE version which adds large file support for + platforms which have larger off_t sizes. See MAXFILESIZE_LARGE below. */ + CURLOPT(CURLOPT_MAXFILESIZE, CURLOPTTYPE_LONG, 114), + + /* See the comment for INFILESIZE above, but in short, specifies + * the size of the file being uploaded. -1 means unknown. + */ + CURLOPT(CURLOPT_INFILESIZE_LARGE, CURLOPTTYPE_OFF_T, 115), + + /* Sets the continuation offset. There is also a CURLOPTTYPE_LONG version + * of this; look above for RESUME_FROM. + */ + CURLOPT(CURLOPT_RESUME_FROM_LARGE, CURLOPTTYPE_OFF_T, 116), + + /* Sets the maximum size of data that will be downloaded from + * an HTTP or FTP server. See MAXFILESIZE above for the LONG version. + */ + CURLOPT(CURLOPT_MAXFILESIZE_LARGE, CURLOPTTYPE_OFF_T, 117), + + /* Set this option to the filename of your .netrc file you want libcurl + to parse (using the CURLOPT_NETRC option). If not set, libcurl will do + a poor attempt to find the user's home directory and check for a .netrc + file in there. */ + CURLOPT(CURLOPT_NETRC_FILE, CURLOPTTYPE_STRINGPOINT, 118), + + /* Enable SSL/TLS for FTP, pick one of: + CURLUSESSL_TRY - try using SSL, proceed anyway otherwise + CURLUSESSL_CONTROL - SSL for the control connection or fail + CURLUSESSL_ALL - SSL for all communication or fail + */ + CURLOPT(CURLOPT_USE_SSL, CURLOPTTYPE_VALUES, 119), + + /* The _LARGE version of the standard POSTFIELDSIZE option */ + CURLOPT(CURLOPT_POSTFIELDSIZE_LARGE, CURLOPTTYPE_OFF_T, 120), + + /* Enable/disable the TCP Nagle algorithm */ + CURLOPT(CURLOPT_TCP_NODELAY, CURLOPTTYPE_LONG, 121), + + /* 122 OBSOLETE, used in 7.12.3. Gone in 7.13.0 */ + /* 123 OBSOLETE. Gone in 7.16.0 */ + /* 124 OBSOLETE, used in 7.12.3. Gone in 7.13.0 */ + /* 125 OBSOLETE, used in 7.12.3. Gone in 7.13.0 */ + /* 126 OBSOLETE, used in 7.12.3. Gone in 7.13.0 */ + /* 127 OBSOLETE. Gone in 7.16.0 */ + /* 128 OBSOLETE. Gone in 7.16.0 */ + + /* When FTP over SSL/TLS is selected (with CURLOPT_USE_SSL), this option + can be used to change libcurl's default action which is to first try + "AUTH SSL" and then "AUTH TLS" in this order, and proceed when a OK + response has been received. + + Available parameters are: + CURLFTPAUTH_DEFAULT - let libcurl decide + CURLFTPAUTH_SSL - try "AUTH SSL" first, then TLS + CURLFTPAUTH_TLS - try "AUTH TLS" first, then SSL + */ + CURLOPT(CURLOPT_FTPSSLAUTH, CURLOPTTYPE_VALUES, 129), + + CURLOPTDEPRECATED(CURLOPT_IOCTLFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 130, + 7.18.0, "Use CURLOPT_SEEKFUNCTION"), + CURLOPTDEPRECATED(CURLOPT_IOCTLDATA, CURLOPTTYPE_CBPOINT, 131, + 7.18.0, "Use CURLOPT_SEEKDATA"), + + /* 132 OBSOLETE. Gone in 7.16.0 */ + /* 133 OBSOLETE. Gone in 7.16.0 */ + + /* null-terminated string for pass on to the FTP server when asked for + "account" info */ + CURLOPT(CURLOPT_FTP_ACCOUNT, CURLOPTTYPE_STRINGPOINT, 134), + + /* feed cookie into cookie engine */ + CURLOPT(CURLOPT_COOKIELIST, CURLOPTTYPE_STRINGPOINT, 135), + + /* ignore Content-Length */ + CURLOPT(CURLOPT_IGNORE_CONTENT_LENGTH, CURLOPTTYPE_LONG, 136), + + /* Set to non-zero to skip the IP address received in a 227 PASV FTP server + response. Typically used for FTP-SSL purposes but is not restricted to + that. libcurl will then instead use the same IP address it used for the + control connection. */ + CURLOPT(CURLOPT_FTP_SKIP_PASV_IP, CURLOPTTYPE_LONG, 137), + + /* Select "file method" to use when doing FTP, see the curl_ftpmethod + above. */ + CURLOPT(CURLOPT_FTP_FILEMETHOD, CURLOPTTYPE_VALUES, 138), + + /* Local port number to bind the socket to */ + CURLOPT(CURLOPT_LOCALPORT, CURLOPTTYPE_LONG, 139), + + /* Number of ports to try, including the first one set with LOCALPORT. + Thus, setting it to 1 will make no additional attempts but the first. + */ + CURLOPT(CURLOPT_LOCALPORTRANGE, CURLOPTTYPE_LONG, 140), + + /* no transfer, set up connection and let application use the socket by + extracting it with CURLINFO_LASTSOCKET */ + CURLOPT(CURLOPT_CONNECT_ONLY, CURLOPTTYPE_LONG, 141), + + /* Function that will be called to convert from the + network encoding (instead of using the iconv calls in libcurl) */ + CURLOPTDEPRECATED(CURLOPT_CONV_FROM_NETWORK_FUNCTION, + CURLOPTTYPE_FUNCTIONPOINT, 142, + 7.82.0, "Serves no purpose anymore"), + + /* Function that will be called to convert to the + network encoding (instead of using the iconv calls in libcurl) */ + CURLOPTDEPRECATED(CURLOPT_CONV_TO_NETWORK_FUNCTION, + CURLOPTTYPE_FUNCTIONPOINT, 143, + 7.82.0, "Serves no purpose anymore"), + + /* Function that will be called to convert from UTF8 + (instead of using the iconv calls in libcurl) + Note that this is used only for SSL certificate processing */ + CURLOPTDEPRECATED(CURLOPT_CONV_FROM_UTF8_FUNCTION, + CURLOPTTYPE_FUNCTIONPOINT, 144, + 7.82.0, "Serves no purpose anymore"), + + /* if the connection proceeds too quickly then need to slow it down */ + /* limit-rate: maximum number of bytes per second to send or receive */ + CURLOPT(CURLOPT_MAX_SEND_SPEED_LARGE, CURLOPTTYPE_OFF_T, 145), + CURLOPT(CURLOPT_MAX_RECV_SPEED_LARGE, CURLOPTTYPE_OFF_T, 146), + + /* Pointer to command string to send if USER/PASS fails. */ + CURLOPT(CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPTTYPE_STRINGPOINT, 147), + + /* callback function for setting socket options */ + CURLOPT(CURLOPT_SOCKOPTFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 148), + CURLOPT(CURLOPT_SOCKOPTDATA, CURLOPTTYPE_CBPOINT, 149), + + /* set to 0 to disable session ID reuse for this transfer, default is + enabled (== 1) */ + CURLOPT(CURLOPT_SSL_SESSIONID_CACHE, CURLOPTTYPE_LONG, 150), + + /* allowed SSH authentication methods */ + CURLOPT(CURLOPT_SSH_AUTH_TYPES, CURLOPTTYPE_VALUES, 151), + + /* Used by scp/sftp to do public/private key authentication */ + CURLOPT(CURLOPT_SSH_PUBLIC_KEYFILE, CURLOPTTYPE_STRINGPOINT, 152), + CURLOPT(CURLOPT_SSH_PRIVATE_KEYFILE, CURLOPTTYPE_STRINGPOINT, 153), + + /* Send CCC (Clear Command Channel) after authentication */ + CURLOPT(CURLOPT_FTP_SSL_CCC, CURLOPTTYPE_LONG, 154), + + /* Same as TIMEOUT and CONNECTTIMEOUT, but with ms resolution */ + CURLOPT(CURLOPT_TIMEOUT_MS, CURLOPTTYPE_LONG, 155), + CURLOPT(CURLOPT_CONNECTTIMEOUT_MS, CURLOPTTYPE_LONG, 156), + + /* set to zero to disable the libcurl's decoding and thus pass the raw body + data to the application even when it is encoded/compressed */ + CURLOPT(CURLOPT_HTTP_TRANSFER_DECODING, CURLOPTTYPE_LONG, 157), + CURLOPT(CURLOPT_HTTP_CONTENT_DECODING, CURLOPTTYPE_LONG, 158), + + /* Permission used when creating new files and directories on the remote + server for protocols that support it, SFTP/SCP/FILE */ + CURLOPT(CURLOPT_NEW_FILE_PERMS, CURLOPTTYPE_LONG, 159), + CURLOPT(CURLOPT_NEW_DIRECTORY_PERMS, CURLOPTTYPE_LONG, 160), + + /* Set the behavior of POST when redirecting. Values must be set to one + of CURL_REDIR* defines below. This used to be called CURLOPT_POST301 */ + CURLOPT(CURLOPT_POSTREDIR, CURLOPTTYPE_VALUES, 161), + + /* used by scp/sftp to verify the host's public key */ + CURLOPT(CURLOPT_SSH_HOST_PUBLIC_KEY_MD5, CURLOPTTYPE_STRINGPOINT, 162), + + /* Callback function for opening socket (instead of socket(2)). Optionally, + callback is able change the address or refuse to connect returning + CURL_SOCKET_BAD. The callback should have type + curl_opensocket_callback */ + CURLOPT(CURLOPT_OPENSOCKETFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 163), + CURLOPT(CURLOPT_OPENSOCKETDATA, CURLOPTTYPE_CBPOINT, 164), + + /* POST volatile input fields. */ + CURLOPT(CURLOPT_COPYPOSTFIELDS, CURLOPTTYPE_OBJECTPOINT, 165), + + /* set transfer mode (;type=) when doing FTP via an HTTP proxy */ + CURLOPT(CURLOPT_PROXY_TRANSFER_MODE, CURLOPTTYPE_LONG, 166), + + /* Callback function for seeking in the input stream */ + CURLOPT(CURLOPT_SEEKFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 167), + CURLOPT(CURLOPT_SEEKDATA, CURLOPTTYPE_CBPOINT, 168), + + /* CRL file */ + CURLOPT(CURLOPT_CRLFILE, CURLOPTTYPE_STRINGPOINT, 169), + + /* Issuer certificate */ + CURLOPT(CURLOPT_ISSUERCERT, CURLOPTTYPE_STRINGPOINT, 170), + + /* (IPv6) Address scope */ + CURLOPT(CURLOPT_ADDRESS_SCOPE, CURLOPTTYPE_LONG, 171), + + /* Collect certificate chain info and allow it to get retrievable with + CURLINFO_CERTINFO after the transfer is complete. */ + CURLOPT(CURLOPT_CERTINFO, CURLOPTTYPE_LONG, 172), + + /* "name" and "pwd" to use when fetching. */ + CURLOPT(CURLOPT_USERNAME, CURLOPTTYPE_STRINGPOINT, 173), + CURLOPT(CURLOPT_PASSWORD, CURLOPTTYPE_STRINGPOINT, 174), + + /* "name" and "pwd" to use with Proxy when fetching. */ + CURLOPT(CURLOPT_PROXYUSERNAME, CURLOPTTYPE_STRINGPOINT, 175), + CURLOPT(CURLOPT_PROXYPASSWORD, CURLOPTTYPE_STRINGPOINT, 176), + + /* Comma separated list of hostnames defining no-proxy zones. These should + match both hostnames directly, and hostnames within a domain. For + example, local.com will match local.com and www.local.com, but NOT + notlocal.com or www.notlocal.com. For compatibility with other + implementations of this, .local.com will be considered to be the same as + local.com. A single * is the only valid wildcard, and effectively + disables the use of proxy. */ + CURLOPT(CURLOPT_NOPROXY, CURLOPTTYPE_STRINGPOINT, 177), + + /* block size for TFTP transfers */ + CURLOPT(CURLOPT_TFTP_BLKSIZE, CURLOPTTYPE_LONG, 178), + + /* Socks Service */ + /* DEPRECATED, do not use! */ + CURLOPTDEPRECATED(CURLOPT_SOCKS5_GSSAPI_SERVICE, + CURLOPTTYPE_STRINGPOINT, 179, + 7.49.0, "Use CURLOPT_PROXY_SERVICE_NAME"), + + /* Socks Service */ + CURLOPT(CURLOPT_SOCKS5_GSSAPI_NEC, CURLOPTTYPE_LONG, 180), + + /* set the bitmask for the protocols that are allowed to be used for the + transfer, which thus helps the app which takes URLs from users or other + external inputs and want to restrict what protocol(s) to deal + with. Defaults to CURLPROTO_ALL. */ + CURLOPTDEPRECATED(CURLOPT_PROTOCOLS, CURLOPTTYPE_LONG, 181, + 7.85.0, "Use CURLOPT_PROTOCOLS_STR"), + + /* set the bitmask for the protocols that libcurl is allowed to follow to, + as a subset of the CURLOPT_PROTOCOLS ones. That means the protocol needs + to be set in both bitmasks to be allowed to get redirected to. */ + CURLOPTDEPRECATED(CURLOPT_REDIR_PROTOCOLS, CURLOPTTYPE_LONG, 182, + 7.85.0, "Use CURLOPT_REDIR_PROTOCOLS_STR"), + + /* set the SSH knownhost filename to use */ + CURLOPT(CURLOPT_SSH_KNOWNHOSTS, CURLOPTTYPE_STRINGPOINT, 183), + + /* set the SSH host key callback, must point to a curl_sshkeycallback + function */ + CURLOPT(CURLOPT_SSH_KEYFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 184), + + /* set the SSH host key callback custom pointer */ + CURLOPT(CURLOPT_SSH_KEYDATA, CURLOPTTYPE_CBPOINT, 185), + + /* set the SMTP mail originator */ + CURLOPT(CURLOPT_MAIL_FROM, CURLOPTTYPE_STRINGPOINT, 186), + + /* set the list of SMTP mail receiver(s) */ + CURLOPT(CURLOPT_MAIL_RCPT, CURLOPTTYPE_SLISTPOINT, 187), + + /* FTP: send PRET before PASV */ + CURLOPT(CURLOPT_FTP_USE_PRET, CURLOPTTYPE_LONG, 188), + + /* RTSP request method (OPTIONS, SETUP, PLAY, etc...) */ + CURLOPT(CURLOPT_RTSP_REQUEST, CURLOPTTYPE_VALUES, 189), + + /* The RTSP session identifier */ + CURLOPT(CURLOPT_RTSP_SESSION_ID, CURLOPTTYPE_STRINGPOINT, 190), + + /* The RTSP stream URI */ + CURLOPT(CURLOPT_RTSP_STREAM_URI, CURLOPTTYPE_STRINGPOINT, 191), + + /* The Transport: header to use in RTSP requests */ + CURLOPT(CURLOPT_RTSP_TRANSPORT, CURLOPTTYPE_STRINGPOINT, 192), + + /* Manually initialize the client RTSP CSeq for this handle */ + CURLOPT(CURLOPT_RTSP_CLIENT_CSEQ, CURLOPTTYPE_LONG, 193), + + /* Manually initialize the server RTSP CSeq for this handle */ + CURLOPT(CURLOPT_RTSP_SERVER_CSEQ, CURLOPTTYPE_LONG, 194), + + /* The stream to pass to INTERLEAVEFUNCTION. */ + CURLOPT(CURLOPT_INTERLEAVEDATA, CURLOPTTYPE_CBPOINT, 195), + + /* Let the application define a custom write method for RTP data */ + CURLOPT(CURLOPT_INTERLEAVEFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 196), + + /* Turn on wildcard matching */ + CURLOPT(CURLOPT_WILDCARDMATCH, CURLOPTTYPE_LONG, 197), + + /* Directory matching callback called before downloading of an + individual file (chunk) started */ + CURLOPT(CURLOPT_CHUNK_BGN_FUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 198), + + /* Directory matching callback called after the file (chunk) + was downloaded, or skipped */ + CURLOPT(CURLOPT_CHUNK_END_FUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 199), + + /* Change match (fnmatch-like) callback for wildcard matching */ + CURLOPT(CURLOPT_FNMATCH_FUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 200), + + /* Let the application define custom chunk data pointer */ + CURLOPT(CURLOPT_CHUNK_DATA, CURLOPTTYPE_CBPOINT, 201), + + /* FNMATCH_FUNCTION user pointer */ + CURLOPT(CURLOPT_FNMATCH_DATA, CURLOPTTYPE_CBPOINT, 202), + + /* send linked-list of name:port:address sets */ + CURLOPT(CURLOPT_RESOLVE, CURLOPTTYPE_SLISTPOINT, 203), + + /* Set a username for authenticated TLS */ + CURLOPT(CURLOPT_TLSAUTH_USERNAME, CURLOPTTYPE_STRINGPOINT, 204), + + /* Set a password for authenticated TLS */ + CURLOPT(CURLOPT_TLSAUTH_PASSWORD, CURLOPTTYPE_STRINGPOINT, 205), + + /* Set authentication type for authenticated TLS */ + CURLOPT(CURLOPT_TLSAUTH_TYPE, CURLOPTTYPE_STRINGPOINT, 206), + + /* Set to 1 to enable the "TE:" header in HTTP requests to ask for + compressed transfer-encoded responses. Set to 0 to disable the use of TE: + in outgoing requests. The current default is 0, but it might change in a + future libcurl release. + + libcurl will ask for the compressed methods it knows of, and if that + is not any, it will not ask for transfer-encoding at all even if this + option is set to 1. + + */ + CURLOPT(CURLOPT_TRANSFER_ENCODING, CURLOPTTYPE_LONG, 207), + + /* Callback function for closing socket (instead of close(2)). The callback + should have type curl_closesocket_callback */ + CURLOPT(CURLOPT_CLOSESOCKETFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 208), + CURLOPT(CURLOPT_CLOSESOCKETDATA, CURLOPTTYPE_CBPOINT, 209), + + /* allow GSSAPI credential delegation */ + CURLOPT(CURLOPT_GSSAPI_DELEGATION, CURLOPTTYPE_VALUES, 210), + + /* Set the name servers to use for DNS resolution. + * Only supported by the c-ares DNS backend */ + CURLOPT(CURLOPT_DNS_SERVERS, CURLOPTTYPE_STRINGPOINT, 211), + + /* Time-out accept operations (currently for FTP only) after this amount + of milliseconds. */ + CURLOPT(CURLOPT_ACCEPTTIMEOUT_MS, CURLOPTTYPE_LONG, 212), + + /* Set TCP keepalive */ + CURLOPT(CURLOPT_TCP_KEEPALIVE, CURLOPTTYPE_LONG, 213), + + /* non-universal keepalive knobs (Linux, AIX, HP-UX, more) */ + CURLOPT(CURLOPT_TCP_KEEPIDLE, CURLOPTTYPE_LONG, 214), + CURLOPT(CURLOPT_TCP_KEEPINTVL, CURLOPTTYPE_LONG, 215), + + /* Enable/disable specific SSL features with a bitmask, see CURLSSLOPT_* */ + CURLOPT(CURLOPT_SSL_OPTIONS, CURLOPTTYPE_VALUES, 216), + + /* Set the SMTP auth originator */ + CURLOPT(CURLOPT_MAIL_AUTH, CURLOPTTYPE_STRINGPOINT, 217), + + /* Enable/disable SASL initial response */ + CURLOPT(CURLOPT_SASL_IR, CURLOPTTYPE_LONG, 218), + + /* Function that will be called instead of the internal progress display + * function. This function should be defined as the curl_xferinfo_callback + * prototype defines. (Deprecates CURLOPT_PROGRESSFUNCTION) */ + CURLOPT(CURLOPT_XFERINFOFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 219), + + /* The XOAUTH2 bearer token */ + CURLOPT(CURLOPT_XOAUTH2_BEARER, CURLOPTTYPE_STRINGPOINT, 220), + + /* Set the interface string to use as outgoing network + * interface for DNS requests. + * Only supported by the c-ares DNS backend */ + CURLOPT(CURLOPT_DNS_INTERFACE, CURLOPTTYPE_STRINGPOINT, 221), + + /* Set the local IPv4 address to use for outgoing DNS requests. + * Only supported by the c-ares DNS backend */ + CURLOPT(CURLOPT_DNS_LOCAL_IP4, CURLOPTTYPE_STRINGPOINT, 222), + + /* Set the local IPv6 address to use for outgoing DNS requests. + * Only supported by the c-ares DNS backend */ + CURLOPT(CURLOPT_DNS_LOCAL_IP6, CURLOPTTYPE_STRINGPOINT, 223), + + /* Set authentication options directly */ + CURLOPT(CURLOPT_LOGIN_OPTIONS, CURLOPTTYPE_STRINGPOINT, 224), + + /* Enable/disable TLS NPN extension (http2 over ssl might fail without) */ + CURLOPTDEPRECATED(CURLOPT_SSL_ENABLE_NPN, CURLOPTTYPE_LONG, 225, + 7.86.0, "Has no function"), + + /* Enable/disable TLS ALPN extension (http2 over ssl might fail without) */ + CURLOPT(CURLOPT_SSL_ENABLE_ALPN, CURLOPTTYPE_LONG, 226), + + /* Time to wait for a response to an HTTP request containing an + * Expect: 100-continue header before sending the data anyway. */ + CURLOPT(CURLOPT_EXPECT_100_TIMEOUT_MS, CURLOPTTYPE_LONG, 227), + + /* This points to a linked list of headers used for proxy requests only, + struct curl_slist kind */ + CURLOPT(CURLOPT_PROXYHEADER, CURLOPTTYPE_SLISTPOINT, 228), + + /* Pass in a bitmask of "header options" */ + CURLOPT(CURLOPT_HEADEROPT, CURLOPTTYPE_VALUES, 229), + + /* The public key in DER form used to validate the peer public key + this option is used only if SSL_VERIFYPEER is true */ + CURLOPT(CURLOPT_PINNEDPUBLICKEY, CURLOPTTYPE_STRINGPOINT, 230), + + /* Path to Unix domain socket */ + CURLOPT(CURLOPT_UNIX_SOCKET_PATH, CURLOPTTYPE_STRINGPOINT, 231), + + /* Set if we should verify the certificate status. */ + CURLOPT(CURLOPT_SSL_VERIFYSTATUS, CURLOPTTYPE_LONG, 232), + + /* Set if we should enable TLS false start. */ + CURLOPT(CURLOPT_SSL_FALSESTART, CURLOPTTYPE_LONG, 233), + + /* Do not squash dot-dot sequences */ + CURLOPT(CURLOPT_PATH_AS_IS, CURLOPTTYPE_LONG, 234), + + /* Proxy Service Name */ + CURLOPT(CURLOPT_PROXY_SERVICE_NAME, CURLOPTTYPE_STRINGPOINT, 235), + + /* Service Name */ + CURLOPT(CURLOPT_SERVICE_NAME, CURLOPTTYPE_STRINGPOINT, 236), + + /* Wait/do not wait for pipe/mutex to clarify */ + CURLOPT(CURLOPT_PIPEWAIT, CURLOPTTYPE_LONG, 237), + + /* Set the protocol used when curl is given a URL without a protocol */ + CURLOPT(CURLOPT_DEFAULT_PROTOCOL, CURLOPTTYPE_STRINGPOINT, 238), + + /* Set stream weight, 1 - 256 (default is 16) */ + CURLOPT(CURLOPT_STREAM_WEIGHT, CURLOPTTYPE_LONG, 239), + + /* Set stream dependency on another curl handle */ + CURLOPT(CURLOPT_STREAM_DEPENDS, CURLOPTTYPE_OBJECTPOINT, 240), + + /* Set E-xclusive stream dependency on another curl handle */ + CURLOPT(CURLOPT_STREAM_DEPENDS_E, CURLOPTTYPE_OBJECTPOINT, 241), + + /* Do not send any tftp option requests to the server */ + CURLOPT(CURLOPT_TFTP_NO_OPTIONS, CURLOPTTYPE_LONG, 242), + + /* Linked-list of host:port:connect-to-host:connect-to-port, + overrides the URL's host:port (only for the network layer) */ + CURLOPT(CURLOPT_CONNECT_TO, CURLOPTTYPE_SLISTPOINT, 243), + + /* Set TCP Fast Open */ + CURLOPT(CURLOPT_TCP_FASTOPEN, CURLOPTTYPE_LONG, 244), + + /* Continue to send data if the server responds early with an + * HTTP status code >= 300 */ + CURLOPT(CURLOPT_KEEP_SENDING_ON_ERROR, CURLOPTTYPE_LONG, 245), + + /* The CApath or CAfile used to validate the proxy certificate + this option is used only if PROXY_SSL_VERIFYPEER is true */ + CURLOPT(CURLOPT_PROXY_CAINFO, CURLOPTTYPE_STRINGPOINT, 246), + + /* The CApath directory used to validate the proxy certificate + this option is used only if PROXY_SSL_VERIFYPEER is true */ + CURLOPT(CURLOPT_PROXY_CAPATH, CURLOPTTYPE_STRINGPOINT, 247), + + /* Set if we should verify the proxy in ssl handshake, + set 1 to verify. */ + CURLOPT(CURLOPT_PROXY_SSL_VERIFYPEER, CURLOPTTYPE_LONG, 248), + + /* Set if we should verify the Common name from the proxy certificate in ssl + * handshake, set 1 to check existence, 2 to ensure that it matches + * the provided hostname. */ + CURLOPT(CURLOPT_PROXY_SSL_VERIFYHOST, CURLOPTTYPE_LONG, 249), + + /* What version to specifically try to use for proxy. + See CURL_SSLVERSION defines below. */ + CURLOPT(CURLOPT_PROXY_SSLVERSION, CURLOPTTYPE_VALUES, 250), + + /* Set a username for authenticated TLS for proxy */ + CURLOPT(CURLOPT_PROXY_TLSAUTH_USERNAME, CURLOPTTYPE_STRINGPOINT, 251), + + /* Set a password for authenticated TLS for proxy */ + CURLOPT(CURLOPT_PROXY_TLSAUTH_PASSWORD, CURLOPTTYPE_STRINGPOINT, 252), + + /* Set authentication type for authenticated TLS for proxy */ + CURLOPT(CURLOPT_PROXY_TLSAUTH_TYPE, CURLOPTTYPE_STRINGPOINT, 253), + + /* name of the file keeping your private SSL-certificate for proxy */ + CURLOPT(CURLOPT_PROXY_SSLCERT, CURLOPTTYPE_STRINGPOINT, 254), + + /* type of the file keeping your SSL-certificate ("DER", "PEM", "ENG") for + proxy */ + CURLOPT(CURLOPT_PROXY_SSLCERTTYPE, CURLOPTTYPE_STRINGPOINT, 255), + + /* name of the file keeping your private SSL-key for proxy */ + CURLOPT(CURLOPT_PROXY_SSLKEY, CURLOPTTYPE_STRINGPOINT, 256), + + /* type of the file keeping your private SSL-key ("DER", "PEM", "ENG") for + proxy */ + CURLOPT(CURLOPT_PROXY_SSLKEYTYPE, CURLOPTTYPE_STRINGPOINT, 257), + + /* password for the SSL private key for proxy */ + CURLOPT(CURLOPT_PROXY_KEYPASSWD, CURLOPTTYPE_STRINGPOINT, 258), + + /* Specify which TLS 1.2 (1.1, 1.0) ciphers to use for proxy */ + CURLOPT(CURLOPT_PROXY_SSL_CIPHER_LIST, CURLOPTTYPE_STRINGPOINT, 259), + + /* CRL file for proxy */ + CURLOPT(CURLOPT_PROXY_CRLFILE, CURLOPTTYPE_STRINGPOINT, 260), + + /* Enable/disable specific SSL features with a bitmask for proxy, see + CURLSSLOPT_* */ + CURLOPT(CURLOPT_PROXY_SSL_OPTIONS, CURLOPTTYPE_LONG, 261), + + /* Name of pre proxy to use. */ + CURLOPT(CURLOPT_PRE_PROXY, CURLOPTTYPE_STRINGPOINT, 262), + + /* The public key in DER form used to validate the proxy public key + this option is used only if PROXY_SSL_VERIFYPEER is true */ + CURLOPT(CURLOPT_PROXY_PINNEDPUBLICKEY, CURLOPTTYPE_STRINGPOINT, 263), + + /* Path to an abstract Unix domain socket */ + CURLOPT(CURLOPT_ABSTRACT_UNIX_SOCKET, CURLOPTTYPE_STRINGPOINT, 264), + + /* Suppress proxy CONNECT response headers from user callbacks */ + CURLOPT(CURLOPT_SUPPRESS_CONNECT_HEADERS, CURLOPTTYPE_LONG, 265), + + /* The request target, instead of extracted from the URL */ + CURLOPT(CURLOPT_REQUEST_TARGET, CURLOPTTYPE_STRINGPOINT, 266), + + /* bitmask of allowed auth methods for connections to SOCKS5 proxies */ + CURLOPT(CURLOPT_SOCKS5_AUTH, CURLOPTTYPE_LONG, 267), + + /* Enable/disable SSH compression */ + CURLOPT(CURLOPT_SSH_COMPRESSION, CURLOPTTYPE_LONG, 268), + + /* Post MIME data. */ + CURLOPT(CURLOPT_MIMEPOST, CURLOPTTYPE_OBJECTPOINT, 269), + + /* Time to use with the CURLOPT_TIMECONDITION. Specified in number of + seconds since 1 Jan 1970. */ + CURLOPT(CURLOPT_TIMEVALUE_LARGE, CURLOPTTYPE_OFF_T, 270), + + /* Head start in milliseconds to give happy eyeballs. */ + CURLOPT(CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS, CURLOPTTYPE_LONG, 271), + + /* Function that will be called before a resolver request is made */ + CURLOPT(CURLOPT_RESOLVER_START_FUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 272), + + /* User data to pass to the resolver start callback. */ + CURLOPT(CURLOPT_RESOLVER_START_DATA, CURLOPTTYPE_CBPOINT, 273), + + /* send HAProxy PROXY protocol header? */ + CURLOPT(CURLOPT_HAPROXYPROTOCOL, CURLOPTTYPE_LONG, 274), + + /* shuffle addresses before use when DNS returns multiple */ + CURLOPT(CURLOPT_DNS_SHUFFLE_ADDRESSES, CURLOPTTYPE_LONG, 275), + + /* Specify which TLS 1.3 ciphers suites to use */ + CURLOPT(CURLOPT_TLS13_CIPHERS, CURLOPTTYPE_STRINGPOINT, 276), + CURLOPT(CURLOPT_PROXY_TLS13_CIPHERS, CURLOPTTYPE_STRINGPOINT, 277), + + /* Disallow specifying username/login in URL. */ + CURLOPT(CURLOPT_DISALLOW_USERNAME_IN_URL, CURLOPTTYPE_LONG, 278), + + /* DNS-over-HTTPS URL */ + CURLOPT(CURLOPT_DOH_URL, CURLOPTTYPE_STRINGPOINT, 279), + + /* Preferred buffer size to use for uploads */ + CURLOPT(CURLOPT_UPLOAD_BUFFERSIZE, CURLOPTTYPE_LONG, 280), + + /* Time in ms between connection upkeep calls for long-lived connections. */ + CURLOPT(CURLOPT_UPKEEP_INTERVAL_MS, CURLOPTTYPE_LONG, 281), + + /* Specify URL using CURL URL API. */ + CURLOPT(CURLOPT_CURLU, CURLOPTTYPE_OBJECTPOINT, 282), + + /* add trailing data just after no more data is available */ + CURLOPT(CURLOPT_TRAILERFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 283), + + /* pointer to be passed to HTTP_TRAILER_FUNCTION */ + CURLOPT(CURLOPT_TRAILERDATA, CURLOPTTYPE_CBPOINT, 284), + + /* set this to 1L to allow HTTP/0.9 responses or 0L to disallow */ + CURLOPT(CURLOPT_HTTP09_ALLOWED, CURLOPTTYPE_LONG, 285), + + /* alt-svc control bitmask */ + CURLOPT(CURLOPT_ALTSVC_CTRL, CURLOPTTYPE_LONG, 286), + + /* alt-svc cache filename to possibly read from/write to */ + CURLOPT(CURLOPT_ALTSVC, CURLOPTTYPE_STRINGPOINT, 287), + + /* maximum age (idle time) of a connection to consider it for reuse + * (in seconds) */ + CURLOPT(CURLOPT_MAXAGE_CONN, CURLOPTTYPE_LONG, 288), + + /* SASL authorization identity */ + CURLOPT(CURLOPT_SASL_AUTHZID, CURLOPTTYPE_STRINGPOINT, 289), + + /* allow RCPT TO command to fail for some recipients */ + CURLOPT(CURLOPT_MAIL_RCPT_ALLOWFAILS, CURLOPTTYPE_LONG, 290), + + /* the private SSL-certificate as a "blob" */ + CURLOPT(CURLOPT_SSLCERT_BLOB, CURLOPTTYPE_BLOB, 291), + CURLOPT(CURLOPT_SSLKEY_BLOB, CURLOPTTYPE_BLOB, 292), + CURLOPT(CURLOPT_PROXY_SSLCERT_BLOB, CURLOPTTYPE_BLOB, 293), + CURLOPT(CURLOPT_PROXY_SSLKEY_BLOB, CURLOPTTYPE_BLOB, 294), + CURLOPT(CURLOPT_ISSUERCERT_BLOB, CURLOPTTYPE_BLOB, 295), + + /* Issuer certificate for proxy */ + CURLOPT(CURLOPT_PROXY_ISSUERCERT, CURLOPTTYPE_STRINGPOINT, 296), + CURLOPT(CURLOPT_PROXY_ISSUERCERT_BLOB, CURLOPTTYPE_BLOB, 297), + + /* the EC curves requested by the TLS client (RFC 8422, 5.1); + * OpenSSL support via 'set_groups'/'set_curves': + * https://docs.openssl.org/master/man3/SSL_CTX_set1_curves/ + */ + CURLOPT(CURLOPT_SSL_EC_CURVES, CURLOPTTYPE_STRINGPOINT, 298), + + /* HSTS bitmask */ + CURLOPT(CURLOPT_HSTS_CTRL, CURLOPTTYPE_LONG, 299), + /* HSTS filename */ + CURLOPT(CURLOPT_HSTS, CURLOPTTYPE_STRINGPOINT, 300), + + /* HSTS read callback */ + CURLOPT(CURLOPT_HSTSREADFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 301), + CURLOPT(CURLOPT_HSTSREADDATA, CURLOPTTYPE_CBPOINT, 302), + + /* HSTS write callback */ + CURLOPT(CURLOPT_HSTSWRITEFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 303), + CURLOPT(CURLOPT_HSTSWRITEDATA, CURLOPTTYPE_CBPOINT, 304), + + /* Parameters for V4 signature */ + CURLOPT(CURLOPT_AWS_SIGV4, CURLOPTTYPE_STRINGPOINT, 305), + + /* Same as CURLOPT_SSL_VERIFYPEER but for DoH (DNS-over-HTTPS) servers. */ + CURLOPT(CURLOPT_DOH_SSL_VERIFYPEER, CURLOPTTYPE_LONG, 306), + + /* Same as CURLOPT_SSL_VERIFYHOST but for DoH (DNS-over-HTTPS) servers. */ + CURLOPT(CURLOPT_DOH_SSL_VERIFYHOST, CURLOPTTYPE_LONG, 307), + + /* Same as CURLOPT_SSL_VERIFYSTATUS but for DoH (DNS-over-HTTPS) servers. */ + CURLOPT(CURLOPT_DOH_SSL_VERIFYSTATUS, CURLOPTTYPE_LONG, 308), + + /* The CA certificates as "blob" used to validate the peer certificate + this option is used only if SSL_VERIFYPEER is true */ + CURLOPT(CURLOPT_CAINFO_BLOB, CURLOPTTYPE_BLOB, 309), + + /* The CA certificates as "blob" used to validate the proxy certificate + this option is used only if PROXY_SSL_VERIFYPEER is true */ + CURLOPT(CURLOPT_PROXY_CAINFO_BLOB, CURLOPTTYPE_BLOB, 310), + + /* used by scp/sftp to verify the host's public key */ + CURLOPT(CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256, CURLOPTTYPE_STRINGPOINT, 311), + + /* Function that will be called immediately before the initial request + is made on a connection (after any protocol negotiation step). */ + CURLOPT(CURLOPT_PREREQFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 312), + + /* Data passed to the CURLOPT_PREREQFUNCTION callback */ + CURLOPT(CURLOPT_PREREQDATA, CURLOPTTYPE_CBPOINT, 313), + + /* maximum age (since creation) of a connection to consider it for reuse + * (in seconds) */ + CURLOPT(CURLOPT_MAXLIFETIME_CONN, CURLOPTTYPE_LONG, 314), + + /* Set MIME option flags. */ + CURLOPT(CURLOPT_MIME_OPTIONS, CURLOPTTYPE_LONG, 315), + + /* set the SSH host key callback, must point to a curl_sshkeycallback + function */ + CURLOPT(CURLOPT_SSH_HOSTKEYFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 316), + + /* set the SSH host key callback custom pointer */ + CURLOPT(CURLOPT_SSH_HOSTKEYDATA, CURLOPTTYPE_CBPOINT, 317), + + /* specify which protocols that are allowed to be used for the transfer, + which thus helps the app which takes URLs from users or other external + inputs and want to restrict what protocol(s) to deal with. Defaults to + all built-in protocols. */ + CURLOPT(CURLOPT_PROTOCOLS_STR, CURLOPTTYPE_STRINGPOINT, 318), + + /* specify which protocols that libcurl is allowed to follow directs to */ + CURLOPT(CURLOPT_REDIR_PROTOCOLS_STR, CURLOPTTYPE_STRINGPOINT, 319), + + /* WebSockets options */ + CURLOPT(CURLOPT_WS_OPTIONS, CURLOPTTYPE_LONG, 320), + + /* CA cache timeout */ + CURLOPT(CURLOPT_CA_CACHE_TIMEOUT, CURLOPTTYPE_LONG, 321), + + /* Can leak things, gonna exit() soon */ + CURLOPT(CURLOPT_QUICK_EXIT, CURLOPTTYPE_LONG, 322), + + /* set a specific client IP for HAProxy PROXY protocol header? */ + CURLOPT(CURLOPT_HAPROXY_CLIENT_IP, CURLOPTTYPE_STRINGPOINT, 323), + + /* millisecond version */ + CURLOPT(CURLOPT_SERVER_RESPONSE_TIMEOUT_MS, CURLOPTTYPE_LONG, 324), + + /* set ECH configuration */ + CURLOPT(CURLOPT_ECH, CURLOPTTYPE_STRINGPOINT, 325), + + /* maximum number of keepalive probes (Linux, *BSD, macOS, etc.) */ + CURLOPT(CURLOPT_TCP_KEEPCNT, CURLOPTTYPE_LONG, 326), + + CURLOPT(CURLOPT_UPLOAD_FLAGS, CURLOPTTYPE_LONG, 327), + + /* set TLS supported signature algorithms */ + CURLOPT(CURLOPT_SSL_SIGNATURE_ALGORITHMS, CURLOPTTYPE_STRINGPOINT, 328), + + CURLOPT_LASTENTRY /* the last unused */ +} CURLoption; + +#ifndef CURL_NO_OLDIES /* define this to test if your app builds with all + the obsolete stuff removed! */ + +/* Backwards compatibility with older names */ +/* These are scheduled to disappear by 2011 */ + +/* This was added in version 7.19.1 */ +#define CURLOPT_POST301 CURLOPT_POSTREDIR + +/* These are scheduled to disappear by 2009 */ + +/* The following were added in 7.17.0 */ +#define CURLOPT_SSLKEYPASSWD CURLOPT_KEYPASSWD +#define CURLOPT_FTPAPPEND CURLOPT_APPEND +#define CURLOPT_FTPLISTONLY CURLOPT_DIRLISTONLY +#define CURLOPT_FTP_SSL CURLOPT_USE_SSL + +/* The following were added earlier */ + +#define CURLOPT_SSLCERTPASSWD CURLOPT_KEYPASSWD +#define CURLOPT_KRB4LEVEL CURLOPT_KRBLEVEL + +/* */ +#define CURLOPT_FTP_RESPONSE_TIMEOUT CURLOPT_SERVER_RESPONSE_TIMEOUT + +/* Added in 8.2.0 */ +#define CURLOPT_MAIL_RCPT_ALLLOWFAILS CURLOPT_MAIL_RCPT_ALLOWFAILS + +#else +/* This is set if CURL_NO_OLDIES is defined at compile-time */ +#undef CURLOPT_DNS_USE_GLOBAL_CACHE /* soon obsolete */ +#endif + + + /* Below here follows defines for the CURLOPT_IPRESOLVE option. If a host + name resolves addresses using more than one IP protocol version, this + option might be handy to force libcurl to use a specific IP version. */ +#define CURL_IPRESOLVE_WHATEVER 0 /* default, uses addresses to all IP + versions that your system allows */ +#define CURL_IPRESOLVE_V4 1 /* uses only IPv4 addresses/connections */ +#define CURL_IPRESOLVE_V6 2 /* uses only IPv6 addresses/connections */ + + /* Convenient "aliases" */ +#define CURLOPT_RTSPHEADER CURLOPT_HTTPHEADER + +/* These constants are for use with the CURLOPT_HTTP_VERSION option. */ +#define CURL_HTTP_VERSION_NONE 0L /* setting this means we do not care, and + that we would like the library to choose + the best possible for us! */ +#define CURL_HTTP_VERSION_1_0 1L /* please use HTTP 1.0 in the request */ +#define CURL_HTTP_VERSION_1_1 2L /* please use HTTP 1.1 in the request */ +#define CURL_HTTP_VERSION_2_0 3L /* please use HTTP 2 in the request */ +#define CURL_HTTP_VERSION_2TLS 4L /* use version 2 for HTTPS, version 1.1 for + HTTP */ +#define CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE 5L /* please use HTTP 2 without + HTTP/1.1 Upgrade */ +#define CURL_HTTP_VERSION_3 30L /* Use HTTP/3, fallback to HTTP/2 or + HTTP/1 if needed. For HTTPS only. For + HTTP, this option makes libcurl + return error. */ +#define CURL_HTTP_VERSION_3ONLY 31L /* Use HTTP/3 without fallback. For + HTTPS only. For HTTP, this makes + libcurl return error. */ +#define CURL_HTTP_VERSION_LAST 32L /* *ILLEGAL* http version */ + +/* Convenience definition simple because the name of the version is HTTP/2 and + not 2.0. The 2_0 version of the enum name was set while the version was + still planned to be 2.0 and we stick to it for compatibility. */ +#define CURL_HTTP_VERSION_2 CURL_HTTP_VERSION_2_0 + +/* + * Public API enums for RTSP requests + */ + +#define CURL_RTSPREQ_NONE 0L +#define CURL_RTSPREQ_OPTIONS 1L +#define CURL_RTSPREQ_DESCRIBE 2L +#define CURL_RTSPREQ_ANNOUNCE 3L +#define CURL_RTSPREQ_SETUP 4L +#define CURL_RTSPREQ_PLAY 5L +#define CURL_RTSPREQ_PAUSE 6L +#define CURL_RTSPREQ_TEARDOWN 7L +#define CURL_RTSPREQ_GET_PARAMETER 8L +#define CURL_RTSPREQ_SET_PARAMETER 9L +#define CURL_RTSPREQ_RECORD 10L +#define CURL_RTSPREQ_RECEIVE 11L +#define CURL_RTSPREQ_LAST 12L /* not used */ + + /* These enums are for use with the CURLOPT_NETRC option. */ +#define CURL_NETRC_IGNORED 0L /* The .netrc will never be read. + This is the default. */ +#define CURL_NETRC_OPTIONAL 1L /* A user:password in the URL will be preferred + to one in the .netrc. */ +#define CURL_NETRC_REQUIRED 2L /* A user:password in the URL will be ignored. + Unless one is set programmatically, the + .netrc will be queried. */ +enum CURL_NETRC_OPTION { + /* we set a single member here, just to make sure we still provide the enum, + but the values to use are defined above with L suffixes */ + CURL_NETRC_LAST = 3 +}; + +#define CURL_SSLVERSION_DEFAULT 0 +#define CURL_SSLVERSION_TLSv1 1 /* TLS 1.x */ +#define CURL_SSLVERSION_SSLv2 2 +#define CURL_SSLVERSION_SSLv3 3 +#define CURL_SSLVERSION_TLSv1_0 4 +#define CURL_SSLVERSION_TLSv1_1 5 +#define CURL_SSLVERSION_TLSv1_2 6 +#define CURL_SSLVERSION_TLSv1_3 7 + +#define CURL_SSLVERSION_LAST 8 /* never use, keep last */ + +#define CURL_SSLVERSION_MAX_NONE 0 +#define CURL_SSLVERSION_MAX_DEFAULT (CURL_SSLVERSION_TLSv1 << 16) +#define CURL_SSLVERSION_MAX_TLSv1_0 (CURL_SSLVERSION_TLSv1_0 << 16) +#define CURL_SSLVERSION_MAX_TLSv1_1 (CURL_SSLVERSION_TLSv1_1 << 16) +#define CURL_SSLVERSION_MAX_TLSv1_2 (CURL_SSLVERSION_TLSv1_2 << 16) +#define CURL_SSLVERSION_MAX_TLSv1_3 (CURL_SSLVERSION_TLSv1_3 << 16) + + /* never use, keep last */ +#define CURL_SSLVERSION_MAX_LAST (CURL_SSLVERSION_LAST << 16) + +#define CURL_TLSAUTH_NONE 0L +#define CURL_TLSAUTH_SRP 1L + +enum CURL_TLSAUTH { + /* we set a single member here, just to make sure we still provide the enum, + but the values to use are defined above with L suffixes */ + CURL_TLSAUTH_LAST = 2 +}; + +/* symbols to use with CURLOPT_POSTREDIR. + CURL_REDIR_POST_301, CURL_REDIR_POST_302 and CURL_REDIR_POST_303 + can be bitwise ORed so that CURL_REDIR_POST_301 | CURL_REDIR_POST_302 + | CURL_REDIR_POST_303 == CURL_REDIR_POST_ALL */ + +#define CURL_REDIR_GET_ALL 0 +#define CURL_REDIR_POST_301 1 +#define CURL_REDIR_POST_302 2 +#define CURL_REDIR_POST_303 4 +#define CURL_REDIR_POST_ALL \ + (CURL_REDIR_POST_301|CURL_REDIR_POST_302|CURL_REDIR_POST_303) + +#define CURL_TIMECOND_NONE 0L +#define CURL_TIMECOND_IFMODSINCE 1L +#define CURL_TIMECOND_IFUNMODSINCE 2L +#define CURL_TIMECOND_LASTMOD 3L + +typedef enum { + /* we set a single member here, just to make sure we still provide + the enum typedef, but the values to use are defined above with L + suffixes */ + CURL_TIMECOND_LAST = 4 +} curl_TimeCond; + +/* Special size_t value signaling a null-terminated string. */ +#define CURL_ZERO_TERMINATED ((size_t) -1) + +/* curl_strequal() and curl_strnequal() are subject for removal in a future + release */ +CURL_EXTERN int curl_strequal(const char *s1, const char *s2); +CURL_EXTERN int curl_strnequal(const char *s1, const char *s2, size_t n); + +/* Mime/form handling support. */ +typedef struct curl_mime curl_mime; /* Mime context. */ +typedef struct curl_mimepart curl_mimepart; /* Mime part context. */ + +/* CURLMIMEOPT_ defines are for the CURLOPT_MIME_OPTIONS option. */ +#define CURLMIMEOPT_FORMESCAPE (1<<0) /* Use backslash-escaping for forms. */ + +/* + * NAME curl_mime_init() + * + * DESCRIPTION + * + * Create a mime context and return its handle. The easy parameter is the + * target handle. + */ +CURL_EXTERN curl_mime *curl_mime_init(CURL *easy); + +/* + * NAME curl_mime_free() + * + * DESCRIPTION + * + * release a mime handle and its substructures. + */ +CURL_EXTERN void curl_mime_free(curl_mime *mime); + +/* + * NAME curl_mime_addpart() + * + * DESCRIPTION + * + * Append a new empty part to the given mime context and return a handle to + * the created part. + */ +CURL_EXTERN curl_mimepart *curl_mime_addpart(curl_mime *mime); + +/* + * NAME curl_mime_name() + * + * DESCRIPTION + * + * Set mime/form part name. + */ +CURL_EXTERN CURLcode curl_mime_name(curl_mimepart *part, const char *name); + +/* + * NAME curl_mime_filename() + * + * DESCRIPTION + * + * Set mime part remote filename. + */ +CURL_EXTERN CURLcode curl_mime_filename(curl_mimepart *part, + const char *filename); + +/* + * NAME curl_mime_type() + * + * DESCRIPTION + * + * Set mime part type. + */ +CURL_EXTERN CURLcode curl_mime_type(curl_mimepart *part, const char *mimetype); + +/* + * NAME curl_mime_encoder() + * + * DESCRIPTION + * + * Set mime data transfer encoder. + */ +CURL_EXTERN CURLcode curl_mime_encoder(curl_mimepart *part, + const char *encoding); + +/* + * NAME curl_mime_data() + * + * DESCRIPTION + * + * Set mime part data source from memory data, + */ +CURL_EXTERN CURLcode curl_mime_data(curl_mimepart *part, + const char *data, size_t datasize); + +/* + * NAME curl_mime_filedata() + * + * DESCRIPTION + * + * Set mime part data source from named file. + */ +CURL_EXTERN CURLcode curl_mime_filedata(curl_mimepart *part, + const char *filename); + +/* + * NAME curl_mime_data_cb() + * + * DESCRIPTION + * + * Set mime part data source from callback function. + */ +CURL_EXTERN CURLcode curl_mime_data_cb(curl_mimepart *part, + curl_off_t datasize, + curl_read_callback readfunc, + curl_seek_callback seekfunc, + curl_free_callback freefunc, + void *arg); + +/* + * NAME curl_mime_subparts() + * + * DESCRIPTION + * + * Set mime part data source from subparts. + */ +CURL_EXTERN CURLcode curl_mime_subparts(curl_mimepart *part, + curl_mime *subparts); +/* + * NAME curl_mime_headers() + * + * DESCRIPTION + * + * Set mime part headers. + */ +CURL_EXTERN CURLcode curl_mime_headers(curl_mimepart *part, + struct curl_slist *headers, + int take_ownership); + +typedef enum { + /********* the first one is unused ************/ + CURLFORM_NOTHING CURL_DEPRECATED(7.56.0, ""), + CURLFORM_COPYNAME CURL_DEPRECATED(7.56.0, "Use curl_mime_name()"), + CURLFORM_PTRNAME CURL_DEPRECATED(7.56.0, "Use curl_mime_name()"), + CURLFORM_NAMELENGTH CURL_DEPRECATED(7.56.0, ""), + CURLFORM_COPYCONTENTS CURL_DEPRECATED(7.56.0, "Use curl_mime_data()"), + CURLFORM_PTRCONTENTS CURL_DEPRECATED(7.56.0, "Use curl_mime_data()"), + CURLFORM_CONTENTSLENGTH CURL_DEPRECATED(7.56.0, "Use curl_mime_data()"), + CURLFORM_FILECONTENT CURL_DEPRECATED(7.56.0, "Use curl_mime_data_cb()"), + CURLFORM_ARRAY CURL_DEPRECATED(7.56.0, ""), + CURLFORM_OBSOLETE, + CURLFORM_FILE CURL_DEPRECATED(7.56.0, "Use curl_mime_filedata()"), + + CURLFORM_BUFFER CURL_DEPRECATED(7.56.0, "Use curl_mime_filename()"), + CURLFORM_BUFFERPTR CURL_DEPRECATED(7.56.0, "Use curl_mime_data()"), + CURLFORM_BUFFERLENGTH CURL_DEPRECATED(7.56.0, "Use curl_mime_data()"), + + CURLFORM_CONTENTTYPE CURL_DEPRECATED(7.56.0, "Use curl_mime_type()"), + CURLFORM_CONTENTHEADER CURL_DEPRECATED(7.56.0, "Use curl_mime_headers()"), + CURLFORM_FILENAME CURL_DEPRECATED(7.56.0, "Use curl_mime_filename()"), + CURLFORM_END, + CURLFORM_OBSOLETE2, + + CURLFORM_STREAM CURL_DEPRECATED(7.56.0, "Use curl_mime_data_cb()"), + CURLFORM_CONTENTLEN /* added in 7.46.0, provide a curl_off_t length */ + CURL_DEPRECATED(7.56.0, "Use curl_mime_data()"), + + CURLFORM_LASTENTRY /* the last unused */ +} CURLformoption; + +/* structure to be used as parameter for CURLFORM_ARRAY */ +struct curl_forms { + CURLformoption option; + const char *value; +}; + +/* use this for multipart formpost building */ +/* Returns code for curl_formadd() + * + * Returns: + * CURL_FORMADD_OK on success + * CURL_FORMADD_MEMORY if the FormInfo allocation fails + * CURL_FORMADD_OPTION_TWICE if one option is given twice for one Form + * CURL_FORMADD_NULL if a null pointer was given for a char + * CURL_FORMADD_MEMORY if the allocation of a FormInfo struct failed + * CURL_FORMADD_UNKNOWN_OPTION if an unknown option was used + * CURL_FORMADD_INCOMPLETE if the some FormInfo is not complete (or error) + * CURL_FORMADD_MEMORY if a curl_httppost struct cannot be allocated + * CURL_FORMADD_MEMORY if some allocation for string copying failed. + * CURL_FORMADD_ILLEGAL_ARRAY if an illegal option is used in an array + * + ***************************************************************************/ +typedef enum { + CURL_FORMADD_OK CURL_DEPRECATED(7.56.0, ""), /* 1st, no error */ + + CURL_FORMADD_MEMORY CURL_DEPRECATED(7.56.0, ""), + CURL_FORMADD_OPTION_TWICE CURL_DEPRECATED(7.56.0, ""), + CURL_FORMADD_NULL CURL_DEPRECATED(7.56.0, ""), + CURL_FORMADD_UNKNOWN_OPTION CURL_DEPRECATED(7.56.0, ""), + CURL_FORMADD_INCOMPLETE CURL_DEPRECATED(7.56.0, ""), + CURL_FORMADD_ILLEGAL_ARRAY CURL_DEPRECATED(7.56.0, ""), + /* libcurl was built with form api disabled */ + CURL_FORMADD_DISABLED CURL_DEPRECATED(7.56.0, ""), + + CURL_FORMADD_LAST /* last */ +} CURLFORMcode; + +/* + * NAME curl_formadd() + * + * DESCRIPTION + * + * Pretty advanced function for building multi-part formposts. Each invoke + * adds one part that together construct a full post. Then use + * CURLOPT_HTTPPOST to send it off to libcurl. + */ +CURL_EXTERN CURLFORMcode CURL_DEPRECATED(7.56.0, "Use curl_mime_init()") +curl_formadd(struct curl_httppost **httppost, + struct curl_httppost **last_post, + ...); + +/* + * callback function for curl_formget() + * The void *arg pointer will be the one passed as second argument to + * curl_formget(). + * The character buffer passed to it must not be freed. + * Should return the buffer length passed to it as the argument "len" on + * success. + */ +typedef size_t (*curl_formget_callback)(void *arg, const char *buf, + size_t len); + +/* + * NAME curl_formget() + * + * DESCRIPTION + * + * Serialize a curl_httppost struct built with curl_formadd(). + * Accepts a void pointer as second argument which will be passed to + * the curl_formget_callback function. + * Returns 0 on success. + */ +CURL_EXTERN int CURL_DEPRECATED(7.56.0, "") +curl_formget(struct curl_httppost *form, void *arg, + curl_formget_callback append); +/* + * NAME curl_formfree() + * + * DESCRIPTION + * + * Free a multipart formpost previously built with curl_formadd(). + */ +CURL_EXTERN void CURL_DEPRECATED(7.56.0, "Use curl_mime_free()") +curl_formfree(struct curl_httppost *form); + +/* + * NAME curl_getenv() + * + * DESCRIPTION + * + * Returns a malloc()'ed string that MUST be curl_free()ed after usage is + * complete. DEPRECATED - see lib/README.curlx + */ +CURL_EXTERN char *curl_getenv(const char *variable); + +/* + * NAME curl_version() + * + * DESCRIPTION + * + * Returns a static ASCII string of the libcurl version. + */ +CURL_EXTERN char *curl_version(void); + +/* + * NAME curl_easy_escape() + * + * DESCRIPTION + * + * Escapes URL strings (converts all letters consider illegal in URLs to their + * %XX versions). This function returns a new allocated string or NULL if an + * error occurred. + */ +CURL_EXTERN char *curl_easy_escape(CURL *handle, + const char *string, + int length); + +/* the previous version: */ +CURL_EXTERN char *curl_escape(const char *string, + int length); + + +/* + * NAME curl_easy_unescape() + * + * DESCRIPTION + * + * Unescapes URL encoding in strings (converts all %XX codes to their 8bit + * versions). This function returns a new allocated string or NULL if an error + * occurred. + * Conversion Note: On non-ASCII platforms the ASCII %XX codes are + * converted into the host encoding. + */ +CURL_EXTERN char *curl_easy_unescape(CURL *handle, + const char *string, + int length, + int *outlength); + +/* the previous version */ +CURL_EXTERN char *curl_unescape(const char *string, + int length); + +/* + * NAME curl_free() + * + * DESCRIPTION + * + * Provided for de-allocation in the same translation unit that did the + * allocation. Added in libcurl 7.10 + */ +CURL_EXTERN void curl_free(void *p); + +/* + * NAME curl_global_init() + * + * DESCRIPTION + * + * curl_global_init() should be invoked exactly once for each application that + * uses libcurl and before any call of other libcurl functions. + + * This function is thread-safe if CURL_VERSION_THREADSAFE is set in the + * curl_version_info_data.features flag (fetch by curl_version_info()). + + */ +CURL_EXTERN CURLcode curl_global_init(long flags); + +/* + * NAME curl_global_init_mem() + * + * DESCRIPTION + * + * curl_global_init() or curl_global_init_mem() should be invoked exactly once + * for each application that uses libcurl. This function can be used to + * initialize libcurl and set user defined memory management callback + * functions. Users can implement memory management routines to check for + * memory leaks, check for mis-use of the curl library etc. User registered + * callback routines will be invoked by this library instead of the system + * memory management routines like malloc, free etc. + */ +CURL_EXTERN CURLcode curl_global_init_mem(long flags, + curl_malloc_callback m, + curl_free_callback f, + curl_realloc_callback r, + curl_strdup_callback s, + curl_calloc_callback c); + +/* + * NAME curl_global_cleanup() + * + * DESCRIPTION + * + * curl_global_cleanup() should be invoked exactly once for each application + * that uses libcurl + */ +CURL_EXTERN void curl_global_cleanup(void); + +/* + * NAME curl_global_trace() + * + * DESCRIPTION + * + * curl_global_trace() can be invoked at application start to + * configure which components in curl should participate in tracing. + + * This function is thread-safe if CURL_VERSION_THREADSAFE is set in the + * curl_version_info_data.features flag (fetch by curl_version_info()). + + */ +CURL_EXTERN CURLcode curl_global_trace(const char *config); + +/* linked-list structure for the CURLOPT_QUOTE option (and other) */ +struct curl_slist { + char *data; + struct curl_slist *next; +}; + +/* + * NAME curl_global_sslset() + * + * DESCRIPTION + * + * When built with multiple SSL backends, curl_global_sslset() allows to + * choose one. This function can only be called once, and it must be called + * *before* curl_global_init(). + * + * The backend can be identified by the id (e.g. CURLSSLBACKEND_OPENSSL). The + * backend can also be specified via the name parameter (passing -1 as id). + * If both id and name are specified, the name will be ignored. If neither id + * nor name are specified, the function will fail with + * CURLSSLSET_UNKNOWN_BACKEND and set the "avail" pointer to the + * NULL-terminated list of available backends. + * + * Upon success, the function returns CURLSSLSET_OK. + * + * If the specified SSL backend is not available, the function returns + * CURLSSLSET_UNKNOWN_BACKEND and sets the "avail" pointer to a NULL-terminated + * list of available SSL backends. + * + * The SSL backend can be set only once. If it has already been set, a + * subsequent attempt to change it will result in a CURLSSLSET_TOO_LATE. + */ + +struct curl_ssl_backend { + curl_sslbackend id; + const char *name; +}; +typedef struct curl_ssl_backend curl_ssl_backend; + +typedef enum { + CURLSSLSET_OK = 0, + CURLSSLSET_UNKNOWN_BACKEND, + CURLSSLSET_TOO_LATE, + CURLSSLSET_NO_BACKENDS /* libcurl was built without any SSL support */ +} CURLsslset; + +CURL_EXTERN CURLsslset curl_global_sslset(curl_sslbackend id, const char *name, + const curl_ssl_backend ***avail); + +/* + * NAME curl_slist_append() + * + * DESCRIPTION + * + * Appends a string to a linked list. If no list exists, it will be created + * first. Returns the new list, after appending. + */ +CURL_EXTERN struct curl_slist *curl_slist_append(struct curl_slist *list, + const char *data); + +/* + * NAME curl_slist_free_all() + * + * DESCRIPTION + * + * free a previously built curl_slist. + */ +CURL_EXTERN void curl_slist_free_all(struct curl_slist *list); + +/* + * NAME curl_getdate() + * + * DESCRIPTION + * + * Returns the time, in seconds since 1 Jan 1970 of the time string given in + * the first argument. The time argument in the second parameter is unused + * and should be set to NULL. + */ +CURL_EXTERN time_t curl_getdate(const char *p, const time_t *unused); + +/* info about the certificate chain, for SSL backends that support it. Asked + for with CURLOPT_CERTINFO / CURLINFO_CERTINFO */ +struct curl_certinfo { + int num_of_certs; /* number of certificates with information */ + struct curl_slist **certinfo; /* for each index in this array, there is a + linked list with textual information for a + certificate in the format "name:content". + eg "Subject:foo", "Issuer:bar", etc. */ +}; + +/* Information about the SSL library used and the respective internal SSL + handle, which can be used to obtain further information regarding the + connection. Asked for with CURLINFO_TLS_SSL_PTR or CURLINFO_TLS_SESSION. */ +struct curl_tlssessioninfo { + curl_sslbackend backend; + void *internals; +}; + +#define CURLINFO_STRING 0x100000 +#define CURLINFO_LONG 0x200000 +#define CURLINFO_DOUBLE 0x300000 +#define CURLINFO_SLIST 0x400000 +#define CURLINFO_PTR 0x400000 /* same as SLIST */ +#define CURLINFO_SOCKET 0x500000 +#define CURLINFO_OFF_T 0x600000 +#define CURLINFO_MASK 0x0fffff +#define CURLINFO_TYPEMASK 0xf00000 + +typedef enum { + CURLINFO_NONE, /* first, never use this */ + CURLINFO_EFFECTIVE_URL = CURLINFO_STRING + 1, + CURLINFO_RESPONSE_CODE = CURLINFO_LONG + 2, + CURLINFO_TOTAL_TIME = CURLINFO_DOUBLE + 3, + CURLINFO_NAMELOOKUP_TIME = CURLINFO_DOUBLE + 4, + CURLINFO_CONNECT_TIME = CURLINFO_DOUBLE + 5, + CURLINFO_PRETRANSFER_TIME = CURLINFO_DOUBLE + 6, + CURLINFO_SIZE_UPLOAD CURL_DEPRECATED(7.55.0, "Use CURLINFO_SIZE_UPLOAD_T") + = CURLINFO_DOUBLE + 7, + CURLINFO_SIZE_UPLOAD_T = CURLINFO_OFF_T + 7, + CURLINFO_SIZE_DOWNLOAD + CURL_DEPRECATED(7.55.0, "Use CURLINFO_SIZE_DOWNLOAD_T") + = CURLINFO_DOUBLE + 8, + CURLINFO_SIZE_DOWNLOAD_T = CURLINFO_OFF_T + 8, + CURLINFO_SPEED_DOWNLOAD + CURL_DEPRECATED(7.55.0, "Use CURLINFO_SPEED_DOWNLOAD_T") + = CURLINFO_DOUBLE + 9, + CURLINFO_SPEED_DOWNLOAD_T = CURLINFO_OFF_T + 9, + CURLINFO_SPEED_UPLOAD + CURL_DEPRECATED(7.55.0, "Use CURLINFO_SPEED_UPLOAD_T") + = CURLINFO_DOUBLE + 10, + CURLINFO_SPEED_UPLOAD_T = CURLINFO_OFF_T + 10, + CURLINFO_HEADER_SIZE = CURLINFO_LONG + 11, + CURLINFO_REQUEST_SIZE = CURLINFO_LONG + 12, + CURLINFO_SSL_VERIFYRESULT = CURLINFO_LONG + 13, + CURLINFO_FILETIME = CURLINFO_LONG + 14, + CURLINFO_FILETIME_T = CURLINFO_OFF_T + 14, + CURLINFO_CONTENT_LENGTH_DOWNLOAD + CURL_DEPRECATED(7.55.0, + "Use CURLINFO_CONTENT_LENGTH_DOWNLOAD_T") + = CURLINFO_DOUBLE + 15, + CURLINFO_CONTENT_LENGTH_DOWNLOAD_T = CURLINFO_OFF_T + 15, + CURLINFO_CONTENT_LENGTH_UPLOAD + CURL_DEPRECATED(7.55.0, + "Use CURLINFO_CONTENT_LENGTH_UPLOAD_T") + = CURLINFO_DOUBLE + 16, + CURLINFO_CONTENT_LENGTH_UPLOAD_T = CURLINFO_OFF_T + 16, + CURLINFO_STARTTRANSFER_TIME = CURLINFO_DOUBLE + 17, + CURLINFO_CONTENT_TYPE = CURLINFO_STRING + 18, + CURLINFO_REDIRECT_TIME = CURLINFO_DOUBLE + 19, + CURLINFO_REDIRECT_COUNT = CURLINFO_LONG + 20, + CURLINFO_PRIVATE = CURLINFO_STRING + 21, + CURLINFO_HTTP_CONNECTCODE = CURLINFO_LONG + 22, + CURLINFO_HTTPAUTH_AVAIL = CURLINFO_LONG + 23, + CURLINFO_PROXYAUTH_AVAIL = CURLINFO_LONG + 24, + CURLINFO_OS_ERRNO = CURLINFO_LONG + 25, + CURLINFO_NUM_CONNECTS = CURLINFO_LONG + 26, + CURLINFO_SSL_ENGINES = CURLINFO_SLIST + 27, + CURLINFO_COOKIELIST = CURLINFO_SLIST + 28, + CURLINFO_LASTSOCKET CURL_DEPRECATED(7.45.0, "Use CURLINFO_ACTIVESOCKET") + = CURLINFO_LONG + 29, + CURLINFO_FTP_ENTRY_PATH = CURLINFO_STRING + 30, + CURLINFO_REDIRECT_URL = CURLINFO_STRING + 31, + CURLINFO_PRIMARY_IP = CURLINFO_STRING + 32, + CURLINFO_APPCONNECT_TIME = CURLINFO_DOUBLE + 33, + CURLINFO_CERTINFO = CURLINFO_PTR + 34, + CURLINFO_CONDITION_UNMET = CURLINFO_LONG + 35, + CURLINFO_RTSP_SESSION_ID = CURLINFO_STRING + 36, + CURLINFO_RTSP_CLIENT_CSEQ = CURLINFO_LONG + 37, + CURLINFO_RTSP_SERVER_CSEQ = CURLINFO_LONG + 38, + CURLINFO_RTSP_CSEQ_RECV = CURLINFO_LONG + 39, + CURLINFO_PRIMARY_PORT = CURLINFO_LONG + 40, + CURLINFO_LOCAL_IP = CURLINFO_STRING + 41, + CURLINFO_LOCAL_PORT = CURLINFO_LONG + 42, + CURLINFO_TLS_SESSION CURL_DEPRECATED(7.48.0, "Use CURLINFO_TLS_SSL_PTR") + = CURLINFO_PTR + 43, + CURLINFO_ACTIVESOCKET = CURLINFO_SOCKET + 44, + CURLINFO_TLS_SSL_PTR = CURLINFO_PTR + 45, + CURLINFO_HTTP_VERSION = CURLINFO_LONG + 46, + CURLINFO_PROXY_SSL_VERIFYRESULT = CURLINFO_LONG + 47, + CURLINFO_PROTOCOL CURL_DEPRECATED(7.85.0, "Use CURLINFO_SCHEME") + = CURLINFO_LONG + 48, + CURLINFO_SCHEME = CURLINFO_STRING + 49, + CURLINFO_TOTAL_TIME_T = CURLINFO_OFF_T + 50, + CURLINFO_NAMELOOKUP_TIME_T = CURLINFO_OFF_T + 51, + CURLINFO_CONNECT_TIME_T = CURLINFO_OFF_T + 52, + CURLINFO_PRETRANSFER_TIME_T = CURLINFO_OFF_T + 53, + CURLINFO_STARTTRANSFER_TIME_T = CURLINFO_OFF_T + 54, + CURLINFO_REDIRECT_TIME_T = CURLINFO_OFF_T + 55, + CURLINFO_APPCONNECT_TIME_T = CURLINFO_OFF_T + 56, + CURLINFO_RETRY_AFTER = CURLINFO_OFF_T + 57, + CURLINFO_EFFECTIVE_METHOD = CURLINFO_STRING + 58, + CURLINFO_PROXY_ERROR = CURLINFO_LONG + 59, + CURLINFO_REFERER = CURLINFO_STRING + 60, + CURLINFO_CAINFO = CURLINFO_STRING + 61, + CURLINFO_CAPATH = CURLINFO_STRING + 62, + CURLINFO_XFER_ID = CURLINFO_OFF_T + 63, + CURLINFO_CONN_ID = CURLINFO_OFF_T + 64, + CURLINFO_QUEUE_TIME_T = CURLINFO_OFF_T + 65, + CURLINFO_USED_PROXY = CURLINFO_LONG + 66, + CURLINFO_POSTTRANSFER_TIME_T = CURLINFO_OFF_T + 67, + CURLINFO_EARLYDATA_SENT_T = CURLINFO_OFF_T + 68, + CURLINFO_HTTPAUTH_USED = CURLINFO_LONG + 69, + CURLINFO_PROXYAUTH_USED = CURLINFO_LONG + 70, + CURLINFO_LASTONE = 70 +} CURLINFO; + +/* CURLINFO_RESPONSE_CODE is the new name for the option previously known as + CURLINFO_HTTP_CODE */ +#define CURLINFO_HTTP_CODE CURLINFO_RESPONSE_CODE + +typedef enum { + CURLCLOSEPOLICY_NONE, /* first, never use this */ + + CURLCLOSEPOLICY_OLDEST, + CURLCLOSEPOLICY_LEAST_RECENTLY_USED, + CURLCLOSEPOLICY_LEAST_TRAFFIC, + CURLCLOSEPOLICY_SLOWEST, + CURLCLOSEPOLICY_CALLBACK, + + CURLCLOSEPOLICY_LAST /* last, never use this */ +} curl_closepolicy; + +#define CURL_GLOBAL_SSL (1<<0) /* no purpose since 7.57.0 */ +#define CURL_GLOBAL_WIN32 (1<<1) +#define CURL_GLOBAL_ALL (CURL_GLOBAL_SSL|CURL_GLOBAL_WIN32) +#define CURL_GLOBAL_NOTHING 0 +#define CURL_GLOBAL_DEFAULT CURL_GLOBAL_ALL +#define CURL_GLOBAL_ACK_EINTR (1<<2) + + +/***************************************************************************** + * Setup defines, protos etc for the sharing stuff. + */ + +/* Different data locks for a single share */ +typedef enum { + CURL_LOCK_DATA_NONE = 0, + /* CURL_LOCK_DATA_SHARE is used internally to say that + * the locking is just made to change the internal state of the share + * itself. + */ + CURL_LOCK_DATA_SHARE, + CURL_LOCK_DATA_COOKIE, + CURL_LOCK_DATA_DNS, + CURL_LOCK_DATA_SSL_SESSION, + CURL_LOCK_DATA_CONNECT, + CURL_LOCK_DATA_PSL, + CURL_LOCK_DATA_HSTS, + CURL_LOCK_DATA_LAST +} curl_lock_data; + +/* Different lock access types */ +typedef enum { + CURL_LOCK_ACCESS_NONE = 0, /* unspecified action */ + CURL_LOCK_ACCESS_SHARED = 1, /* for read perhaps */ + CURL_LOCK_ACCESS_SINGLE = 2, /* for write perhaps */ + CURL_LOCK_ACCESS_LAST /* never use */ +} curl_lock_access; + +typedef void (*curl_lock_function)(CURL *handle, + curl_lock_data data, + curl_lock_access locktype, + void *userptr); +typedef void (*curl_unlock_function)(CURL *handle, + curl_lock_data data, + void *userptr); + + +typedef enum { + CURLSHE_OK, /* all is fine */ + CURLSHE_BAD_OPTION, /* 1 */ + CURLSHE_IN_USE, /* 2 */ + CURLSHE_INVALID, /* 3 */ + CURLSHE_NOMEM, /* 4 out of memory */ + CURLSHE_NOT_BUILT_IN, /* 5 feature not present in lib */ + CURLSHE_LAST /* never use */ +} CURLSHcode; + +typedef enum { + CURLSHOPT_NONE, /* do not use */ + CURLSHOPT_SHARE, /* specify a data type to share */ + CURLSHOPT_UNSHARE, /* specify which data type to stop sharing */ + CURLSHOPT_LOCKFUNC, /* pass in a 'curl_lock_function' pointer */ + CURLSHOPT_UNLOCKFUNC, /* pass in a 'curl_unlock_function' pointer */ + CURLSHOPT_USERDATA, /* pass in a user data pointer used in the lock/unlock + callback functions */ + CURLSHOPT_LAST /* never use */ +} CURLSHoption; + +CURL_EXTERN CURLSH *curl_share_init(void); +CURL_EXTERN CURLSHcode curl_share_setopt(CURLSH *share, CURLSHoption option, + ...); +CURL_EXTERN CURLSHcode curl_share_cleanup(CURLSH *share); + +/**************************************************************************** + * Structures for querying information about the curl library at runtime. + */ + +typedef enum { + CURLVERSION_FIRST, /* 7.10 */ + CURLVERSION_SECOND, /* 7.11.1 */ + CURLVERSION_THIRD, /* 7.12.0 */ + CURLVERSION_FOURTH, /* 7.16.1 */ + CURLVERSION_FIFTH, /* 7.57.0 */ + CURLVERSION_SIXTH, /* 7.66.0 */ + CURLVERSION_SEVENTH, /* 7.70.0 */ + CURLVERSION_EIGHTH, /* 7.72.0 */ + CURLVERSION_NINTH, /* 7.75.0 */ + CURLVERSION_TENTH, /* 7.77.0 */ + CURLVERSION_ELEVENTH, /* 7.87.0 */ + CURLVERSION_TWELFTH, /* 8.8.0 */ + CURLVERSION_LAST /* never actually use this */ +} CURLversion; + +/* The 'CURLVERSION_NOW' is the symbolic name meant to be used by + basically all programs ever that want to get version information. It is + meant to be a built-in version number for what kind of struct the caller + expects. If the struct ever changes, we redefine the NOW to another enum + from above. */ +#define CURLVERSION_NOW CURLVERSION_TWELFTH + +struct curl_version_info_data { + CURLversion age; /* age of the returned struct */ + const char *version; /* LIBCURL_VERSION */ + unsigned int version_num; /* LIBCURL_VERSION_NUM */ + const char *host; /* OS/host/cpu/machine when configured */ + int features; /* bitmask, see defines below */ + const char *ssl_version; /* human readable string */ + long ssl_version_num; /* not used anymore, always 0 */ + const char *libz_version; /* human readable string */ + /* protocols is terminated by an entry with a NULL protoname */ + const char * const *protocols; + + /* The fields below this were added in CURLVERSION_SECOND */ + const char *ares; + int ares_num; + + /* This field was added in CURLVERSION_THIRD */ + const char *libidn; + + /* These field were added in CURLVERSION_FOURTH */ + + /* Same as '_libiconv_version' if built with HAVE_ICONV */ + int iconv_ver_num; + + const char *libssh_version; /* human readable string */ + + /* These fields were added in CURLVERSION_FIFTH */ + unsigned int brotli_ver_num; /* Numeric Brotli version + (MAJOR << 24) | (MINOR << 12) | PATCH */ + const char *brotli_version; /* human readable string. */ + + /* These fields were added in CURLVERSION_SIXTH */ + unsigned int nghttp2_ver_num; /* Numeric nghttp2 version + (MAJOR << 16) | (MINOR << 8) | PATCH */ + const char *nghttp2_version; /* human readable string. */ + const char *quic_version; /* human readable quic (+ HTTP/3) library + + version or NULL */ + + /* These fields were added in CURLVERSION_SEVENTH */ + const char *cainfo; /* the built-in default CURLOPT_CAINFO, might + be NULL */ + const char *capath; /* the built-in default CURLOPT_CAPATH, might + be NULL */ + + /* These fields were added in CURLVERSION_EIGHTH */ + unsigned int zstd_ver_num; /* Numeric Zstd version + (MAJOR << 24) | (MINOR << 12) | PATCH */ + const char *zstd_version; /* human readable string. */ + + /* These fields were added in CURLVERSION_NINTH */ + const char *hyper_version; /* human readable string. */ + + /* These fields were added in CURLVERSION_TENTH */ + const char *gsasl_version; /* human readable string. */ + + /* These fields were added in CURLVERSION_ELEVENTH */ + /* feature_names is terminated by an entry with a NULL feature name */ + const char * const *feature_names; + + /* These fields were added in CURLVERSION_TWELFTH */ + const char *rtmp_version; /* human readable string. */ +}; +typedef struct curl_version_info_data curl_version_info_data; + +#define CURL_VERSION_IPV6 (1<<0) /* IPv6-enabled */ +#define CURL_VERSION_KERBEROS4 (1<<1) /* Kerberos V4 auth is supported + (deprecated) */ +#define CURL_VERSION_SSL (1<<2) /* SSL options are present */ +#define CURL_VERSION_LIBZ (1<<3) /* libz features are present */ +#define CURL_VERSION_NTLM (1<<4) /* NTLM auth is supported */ +#define CURL_VERSION_GSSNEGOTIATE (1<<5) /* Negotiate auth is supported + (deprecated) */ +#define CURL_VERSION_DEBUG (1<<6) /* Built with debug capabilities */ +#define CURL_VERSION_ASYNCHDNS (1<<7) /* Asynchronous DNS resolves */ +#define CURL_VERSION_SPNEGO (1<<8) /* SPNEGO auth is supported */ +#define CURL_VERSION_LARGEFILE (1<<9) /* Supports files larger than 2GB */ +#define CURL_VERSION_IDN (1<<10) /* Internationized Domain Names are + supported */ +#define CURL_VERSION_SSPI (1<<11) /* Built against Windows SSPI */ +#define CURL_VERSION_CONV (1<<12) /* Character conversions supported */ +#define CURL_VERSION_CURLDEBUG (1<<13) /* Debug memory tracking supported */ +#define CURL_VERSION_TLSAUTH_SRP (1<<14) /* TLS-SRP auth is supported */ +#define CURL_VERSION_NTLM_WB (1<<15) /* NTLM delegation to winbind helper + is supported */ +#define CURL_VERSION_HTTP2 (1<<16) /* HTTP2 support built-in */ +#define CURL_VERSION_GSSAPI (1<<17) /* Built against a GSS-API library */ +#define CURL_VERSION_KERBEROS5 (1<<18) /* Kerberos V5 auth is supported */ +#define CURL_VERSION_UNIX_SOCKETS (1<<19) /* Unix domain sockets support */ +#define CURL_VERSION_PSL (1<<20) /* Mozilla's Public Suffix List, used + for cookie domain verification */ +#define CURL_VERSION_HTTPS_PROXY (1<<21) /* HTTPS-proxy support built-in */ +#define CURL_VERSION_MULTI_SSL (1<<22) /* Multiple SSL backends available */ +#define CURL_VERSION_BROTLI (1<<23) /* Brotli features are present. */ +#define CURL_VERSION_ALTSVC (1<<24) /* Alt-Svc handling built-in */ +#define CURL_VERSION_HTTP3 (1<<25) /* HTTP3 support built-in */ +#define CURL_VERSION_ZSTD (1<<26) /* zstd features are present */ +#define CURL_VERSION_UNICODE (1<<27) /* Unicode support on Windows */ +#define CURL_VERSION_HSTS (1<<28) /* HSTS is supported */ +#define CURL_VERSION_GSASL (1<<29) /* libgsasl is supported */ +#define CURL_VERSION_THREADSAFE (1<<30) /* libcurl API is thread-safe */ + +/* + * NAME curl_version_info() + * + * DESCRIPTION + * + * This function returns a pointer to a static copy of the version info + * struct. See above. + */ +CURL_EXTERN curl_version_info_data *curl_version_info(CURLversion); + +/* + * NAME curl_easy_strerror() + * + * DESCRIPTION + * + * The curl_easy_strerror function may be used to turn a CURLcode value + * into the equivalent human readable error string. This is useful + * for printing meaningful error messages. + */ +CURL_EXTERN const char *curl_easy_strerror(CURLcode); + +/* + * NAME curl_share_strerror() + * + * DESCRIPTION + * + * The curl_share_strerror function may be used to turn a CURLSHcode value + * into the equivalent human readable error string. This is useful + * for printing meaningful error messages. + */ +CURL_EXTERN const char *curl_share_strerror(CURLSHcode); + +/* + * NAME curl_easy_pause() + * + * DESCRIPTION + * + * The curl_easy_pause function pauses or unpauses transfers. Select the new + * state by setting the bitmask, use the convenience defines below. + * + */ +CURL_EXTERN CURLcode curl_easy_pause(CURL *handle, int bitmask); + +#define CURLPAUSE_RECV (1<<0) +#define CURLPAUSE_RECV_CONT (0) + +#define CURLPAUSE_SEND (1<<2) +#define CURLPAUSE_SEND_CONT (0) + +#define CURLPAUSE_ALL (CURLPAUSE_RECV|CURLPAUSE_SEND) +#define CURLPAUSE_CONT (CURLPAUSE_RECV_CONT|CURLPAUSE_SEND_CONT) + +/* + * NAME curl_easy_ssls_import() + * + * DESCRIPTION + * + * The curl_easy_ssls_import function adds a previously exported SSL session + * to the SSL session cache of the easy handle (or the underlying share). + */ +CURL_EXTERN CURLcode curl_easy_ssls_import(CURL *handle, + const char *session_key, + const unsigned char *shmac, + size_t shmac_len, + const unsigned char *sdata, + size_t sdata_len); + +/* This is the curl_ssls_export_cb callback prototype. It + * is passed to curl_easy_ssls_export() to extract SSL sessions/tickets. */ +typedef CURLcode curl_ssls_export_cb(CURL *handle, + void *userptr, + const char *session_key, + const unsigned char *shmac, + size_t shmac_len, + const unsigned char *sdata, + size_t sdata_len, + curl_off_t valid_until, + int ietf_tls_id, + const char *alpn, + size_t earlydata_max); + +/* + * NAME curl_easy_ssls_export() + * + * DESCRIPTION + * + * The curl_easy_ssls_export function iterates over all SSL sessions stored + * in the easy handle (or underlying share) and invokes the passed + * callback. + * + */ +CURL_EXTERN CURLcode curl_easy_ssls_export(CURL *handle, + curl_ssls_export_cb *export_fn, + void *userptr); + + +#ifdef __cplusplus +} /* end of extern "C" */ +#endif + +/* unfortunately, the easy.h and multi.h include files need options and info + stuff before they can be included! */ +#include "easy.h" /* nothing in curl is fun without the easy stuff */ +#include "multi.h" +#include "urlapi.h" +#include "options.h" +#include "header.h" +#include "websockets.h" +#include "mprintf.h" + +/* the typechecker does not work in C++ (yet) */ +#if defined(__GNUC__) && defined(__GNUC_MINOR__) && \ + ((__GNUC__ > 4) || (__GNUC__ == 4 && __GNUC_MINOR__ >= 3)) && \ + !defined(__cplusplus) && !defined(CURL_DISABLE_TYPECHECK) +#include "typecheck-gcc.h" +#else +#if defined(__STDC__) && (__STDC__ >= 1) +/* This preprocessor magic that replaces a call with the exact same call is + only done to make sure application authors pass exactly three arguments + to these functions. */ +#define curl_easy_setopt(handle,opt,param) curl_easy_setopt(handle,opt,param) +#define curl_easy_getinfo(handle,info,arg) curl_easy_getinfo(handle,info,arg) +#define curl_share_setopt(share,opt,param) curl_share_setopt(share,opt,param) +#define curl_multi_setopt(handle,opt,param) curl_multi_setopt(handle,opt,param) +#endif /* __STDC__ >= 1 */ +#endif /* gcc >= 4.3 && !__cplusplus && !CURL_DISABLE_TYPECHECK */ + +#endif /* CURLINC_CURL_H */ diff --git a/curl/include/curl/curlver.h b/curl/include/curl/curlver.h new file mode 100644 index 0000000..11e35ed --- /dev/null +++ b/curl/include/curl/curlver.h @@ -0,0 +1,79 @@ +#ifndef CURLINC_CURLVER_H +#define CURLINC_CURLVER_H +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* This header file contains nothing but libcurl version info, generated by + a script at release-time. This was made its own header file in 7.11.2 */ + +/* This is the global package copyright */ +#define LIBCURL_COPYRIGHT "Daniel Stenberg, ." + +/* This is the version number of the libcurl package from which this header + file origins: */ +#define LIBCURL_VERSION "8.14.0" + +/* The numeric version number is also available "in parts" by using these + defines: */ +#define LIBCURL_VERSION_MAJOR 8 +#define LIBCURL_VERSION_MINOR 14 +#define LIBCURL_VERSION_PATCH 0 + +/* This is the numeric version of the libcurl version number, meant for easier + parsing and comparisons by programs. The LIBCURL_VERSION_NUM define will + always follow this syntax: + + 0xXXYYZZ + + Where XX, YY and ZZ are the main version, release and patch numbers in + hexadecimal (using 8 bits each). All three numbers are always represented + using two digits. 1.2 would appear as "0x010200" while version 9.11.7 + appears as "0x090b07". + + This 6-digit (24 bits) hexadecimal number does not show pre-release number, + and it is always a greater number in a more recent release. It makes + comparisons with greater than and less than work. + + Note: This define is the full hex number and _does not_ use the + CURL_VERSION_BITS() macro since curl's own configure script greps for it + and needs it to contain the full number. +*/ +#define LIBCURL_VERSION_NUM 0x080e00 + +/* + * This is the date and time when the full source package was created. The + * timestamp is not stored in git, as the timestamp is properly set in the + * tarballs by the maketgz script. + * + * The format of the date follows this template: + * + * "2007-11-23" + */ +#define LIBCURL_TIMESTAMP "2025-05-28" + +#define CURL_VERSION_BITS(x,y,z) ((x)<<16|(y)<<8|(z)) +#define CURL_AT_LEAST_VERSION(x,y,z) \ + (LIBCURL_VERSION_NUM >= CURL_VERSION_BITS(x, y, z)) + +#endif /* CURLINC_CURLVER_H */ diff --git a/curl/include/curl/easy.h b/curl/include/curl/easy.h new file mode 100644 index 0000000..56f8060 --- /dev/null +++ b/curl/include/curl/easy.h @@ -0,0 +1,125 @@ +#ifndef CURLINC_EASY_H +#define CURLINC_EASY_H +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +#ifdef __cplusplus +extern "C" { +#endif + +/* Flag bits in the curl_blob struct: */ +#define CURL_BLOB_COPY 1 /* tell libcurl to copy the data */ +#define CURL_BLOB_NOCOPY 0 /* tell libcurl to NOT copy the data */ + +struct curl_blob { + void *data; + size_t len; + unsigned int flags; /* bit 0 is defined, the rest are reserved and should be + left zeroes */ +}; + +CURL_EXTERN CURL *curl_easy_init(void); +CURL_EXTERN CURLcode curl_easy_setopt(CURL *curl, CURLoption option, ...); +CURL_EXTERN CURLcode curl_easy_perform(CURL *curl); +CURL_EXTERN void curl_easy_cleanup(CURL *curl); + +/* + * NAME curl_easy_getinfo() + * + * DESCRIPTION + * + * Request internal information from the curl session with this function. + * The third argument MUST be pointing to the specific type of the used option + * which is documented in each manpage of the option. The data pointed to + * will be filled in accordingly and can be relied upon only if the function + * returns CURLE_OK. This function is intended to get used *AFTER* a performed + * transfer, all results from this function are undefined until the transfer + * is completed. + */ +CURL_EXTERN CURLcode curl_easy_getinfo(CURL *curl, CURLINFO info, ...); + + +/* + * NAME curl_easy_duphandle() + * + * DESCRIPTION + * + * Creates a new curl session handle with the same options set for the handle + * passed in. Duplicating a handle could only be a matter of cloning data and + * options, internal state info and things like persistent connections cannot + * be transferred. It is useful in multithreaded applications when you can run + * curl_easy_duphandle() for each new thread to avoid a series of identical + * curl_easy_setopt() invokes in every thread. + */ +CURL_EXTERN CURL *curl_easy_duphandle(CURL *curl); + +/* + * NAME curl_easy_reset() + * + * DESCRIPTION + * + * Re-initializes a curl handle to the default values. This puts back the + * handle to the same state as it was in when it was just created. + * + * It does keep: live connections, the Session ID cache, the DNS cache and the + * cookies. + */ +CURL_EXTERN void curl_easy_reset(CURL *curl); + +/* + * NAME curl_easy_recv() + * + * DESCRIPTION + * + * Receives data from the connected socket. Use after successful + * curl_easy_perform() with CURLOPT_CONNECT_ONLY option. + */ +CURL_EXTERN CURLcode curl_easy_recv(CURL *curl, void *buffer, size_t buflen, + size_t *n); + +/* + * NAME curl_easy_send() + * + * DESCRIPTION + * + * Sends data over the connected socket. Use after successful + * curl_easy_perform() with CURLOPT_CONNECT_ONLY option. + */ +CURL_EXTERN CURLcode curl_easy_send(CURL *curl, const void *buffer, + size_t buflen, size_t *n); + + +/* + * NAME curl_easy_upkeep() + * + * DESCRIPTION + * + * Performs connection upkeep for the given session handle. + */ +CURL_EXTERN CURLcode curl_easy_upkeep(CURL *curl); + +#ifdef __cplusplus +} /* end of extern "C" */ +#endif + +#endif diff --git a/curl/include/curl/header.h b/curl/include/curl/header.h new file mode 100644 index 0000000..8df11e1 --- /dev/null +++ b/curl/include/curl/header.h @@ -0,0 +1,74 @@ +#ifndef CURLINC_HEADER_H +#define CURLINC_HEADER_H +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +#ifdef __cplusplus +extern "C" { +#endif + +struct curl_header { + char *name; /* this might not use the same case */ + char *value; + size_t amount; /* number of headers using this name */ + size_t index; /* ... of this instance, 0 or higher */ + unsigned int origin; /* see bits below */ + void *anchor; /* handle privately used by libcurl */ +}; + +/* 'origin' bits */ +#define CURLH_HEADER (1<<0) /* plain server header */ +#define CURLH_TRAILER (1<<1) /* trailers */ +#define CURLH_CONNECT (1<<2) /* CONNECT headers */ +#define CURLH_1XX (1<<3) /* 1xx headers */ +#define CURLH_PSEUDO (1<<4) /* pseudo headers */ + +typedef enum { + CURLHE_OK, + CURLHE_BADINDEX, /* header exists but not with this index */ + CURLHE_MISSING, /* no such header exists */ + CURLHE_NOHEADERS, /* no headers at all exist (yet) */ + CURLHE_NOREQUEST, /* no request with this number was used */ + CURLHE_OUT_OF_MEMORY, /* out of memory while processing */ + CURLHE_BAD_ARGUMENT, /* a function argument was not okay */ + CURLHE_NOT_BUILT_IN /* if API was disabled in the build */ +} CURLHcode; + +CURL_EXTERN CURLHcode curl_easy_header(CURL *easy, + const char *name, + size_t index, + unsigned int origin, + int request, + struct curl_header **hout); + +CURL_EXTERN struct curl_header *curl_easy_nextheader(CURL *easy, + unsigned int origin, + int request, + struct curl_header *prev); + +#ifdef __cplusplus +} /* end of extern "C" */ +#endif + +#endif /* CURLINC_HEADER_H */ diff --git a/curl/include/curl/mprintf.h b/curl/include/curl/mprintf.h new file mode 100644 index 0000000..88059c8 --- /dev/null +++ b/curl/include/curl/mprintf.h @@ -0,0 +1,85 @@ +#ifndef CURLINC_MPRINTF_H +#define CURLINC_MPRINTF_H +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +#include +#include /* needed for FILE */ +#include "curl.h" /* for CURL_EXTERN */ + +#ifdef __cplusplus +extern "C" { +#endif + +#ifndef CURL_TEMP_PRINTF +#if (defined(__GNUC__) || defined(__clang__) || \ + defined(__IAR_SYSTEMS_ICC__)) && \ + defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) && \ + !defined(CURL_NO_FMT_CHECKS) +#if defined(__MINGW32__) && !defined(__clang__) +#if defined(__MINGW_PRINTF_FORMAT) /* mingw-w64 3.0.0+. Needs stdio.h. */ +#define CURL_TEMP_PRINTF(fmt, arg) \ + __attribute__((format(__MINGW_PRINTF_FORMAT, fmt, arg))) +#else +#define CURL_TEMP_PRINTF(fmt, arg) +#endif +#else +#define CURL_TEMP_PRINTF(fmt, arg) \ + __attribute__((format(printf, fmt, arg))) +#endif +#else +#define CURL_TEMP_PRINTF(fmt, arg) +#endif +#endif + +CURL_EXTERN int curl_mprintf(const char *format, ...) + CURL_TEMP_PRINTF(1, 2); +CURL_EXTERN int curl_mfprintf(FILE *fd, const char *format, ...) + CURL_TEMP_PRINTF(2, 3); +CURL_EXTERN int curl_msprintf(char *buffer, const char *format, ...) + CURL_TEMP_PRINTF(2, 3); +CURL_EXTERN int curl_msnprintf(char *buffer, size_t maxlength, + const char *format, ...) + CURL_TEMP_PRINTF(3, 4); +CURL_EXTERN int curl_mvprintf(const char *format, va_list args) + CURL_TEMP_PRINTF(1, 0); +CURL_EXTERN int curl_mvfprintf(FILE *fd, const char *format, va_list args) + CURL_TEMP_PRINTF(2, 0); +CURL_EXTERN int curl_mvsprintf(char *buffer, const char *format, va_list args) + CURL_TEMP_PRINTF(2, 0); +CURL_EXTERN int curl_mvsnprintf(char *buffer, size_t maxlength, + const char *format, va_list args) + CURL_TEMP_PRINTF(3, 0); +CURL_EXTERN char *curl_maprintf(const char *format, ...) + CURL_TEMP_PRINTF(1, 2); +CURL_EXTERN char *curl_mvaprintf(const char *format, va_list args) + CURL_TEMP_PRINTF(1, 0); + +#undef CURL_TEMP_PRINTF + +#ifdef __cplusplus +} /* end of extern "C" */ +#endif + +#endif /* CURLINC_MPRINTF_H */ diff --git a/curl/include/curl/multi.h b/curl/include/curl/multi.h new file mode 100644 index 0000000..42469bb --- /dev/null +++ b/curl/include/curl/multi.h @@ -0,0 +1,481 @@ +#ifndef CURLINC_MULTI_H +#define CURLINC_MULTI_H +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +/* + This is an "external" header file. Do not give away any internals here! + + GOALS + + o Enable a "pull" interface. The application that uses libcurl decides where + and when to ask libcurl to get/send data. + + o Enable multiple simultaneous transfers in the same thread without making it + complicated for the application. + + o Enable the application to select() on its own file descriptors and curl's + file descriptors simultaneous easily. + +*/ + +/* + * This header file should not really need to include "curl.h" since curl.h + * itself includes this file and we expect user applications to do #include + * without the need for especially including multi.h. + * + * For some reason we added this include here at one point, and rather than to + * break existing (wrongly written) libcurl applications, we leave it as-is + * but with this warning attached. + */ +#include "curl.h" + +#ifdef __cplusplus +extern "C" { +#endif + +typedef void CURLM; + +typedef enum { + CURLM_CALL_MULTI_PERFORM = -1, /* please call curl_multi_perform() or + curl_multi_socket*() soon */ + CURLM_OK, + CURLM_BAD_HANDLE, /* the passed-in handle is not a valid CURLM handle */ + CURLM_BAD_EASY_HANDLE, /* an easy handle was not good/valid */ + CURLM_OUT_OF_MEMORY, /* if you ever get this, you are in deep sh*t */ + CURLM_INTERNAL_ERROR, /* this is a libcurl bug */ + CURLM_BAD_SOCKET, /* the passed in socket argument did not match */ + CURLM_UNKNOWN_OPTION, /* curl_multi_setopt() with unsupported option */ + CURLM_ADDED_ALREADY, /* an easy handle already added to a multi handle was + attempted to get added - again */ + CURLM_RECURSIVE_API_CALL, /* an api function was called from inside a + callback */ + CURLM_WAKEUP_FAILURE, /* wakeup is unavailable or failed */ + CURLM_BAD_FUNCTION_ARGUMENT, /* function called with a bad parameter */ + CURLM_ABORTED_BY_CALLBACK, + CURLM_UNRECOVERABLE_POLL, + CURLM_LAST +} CURLMcode; + +/* just to make code nicer when using curl_multi_socket() you can now check + for CURLM_CALL_MULTI_SOCKET too in the same style it works for + curl_multi_perform() and CURLM_CALL_MULTI_PERFORM */ +#define CURLM_CALL_MULTI_SOCKET CURLM_CALL_MULTI_PERFORM + +/* bitmask bits for CURLMOPT_PIPELINING */ +#define CURLPIPE_NOTHING 0L +#define CURLPIPE_HTTP1 1L +#define CURLPIPE_MULTIPLEX 2L + +typedef enum { + CURLMSG_NONE, /* first, not used */ + CURLMSG_DONE, /* This easy handle has completed. 'result' contains + the CURLcode of the transfer */ + CURLMSG_LAST /* last, not used */ +} CURLMSG; + +struct CURLMsg { + CURLMSG msg; /* what this message means */ + CURL *easy_handle; /* the handle it concerns */ + union { + void *whatever; /* message-specific data */ + CURLcode result; /* return code for transfer */ + } data; +}; +typedef struct CURLMsg CURLMsg; + +/* Based on poll(2) structure and values. + * We do not use pollfd and POLL* constants explicitly + * to cover platforms without poll(). */ +#define CURL_WAIT_POLLIN 0x0001 +#define CURL_WAIT_POLLPRI 0x0002 +#define CURL_WAIT_POLLOUT 0x0004 + +struct curl_waitfd { + curl_socket_t fd; + short events; + short revents; +}; + +/* + * Name: curl_multi_init() + * + * Desc: initialize multi-style curl usage + * + * Returns: a new CURLM handle to use in all 'curl_multi' functions. + */ +CURL_EXTERN CURLM *curl_multi_init(void); + +/* + * Name: curl_multi_add_handle() + * + * Desc: add a standard curl handle to the multi stack + * + * Returns: CURLMcode type, general multi error code. + */ +CURL_EXTERN CURLMcode curl_multi_add_handle(CURLM *multi_handle, + CURL *curl_handle); + + /* + * Name: curl_multi_remove_handle() + * + * Desc: removes a curl handle from the multi stack again + * + * Returns: CURLMcode type, general multi error code. + */ +CURL_EXTERN CURLMcode curl_multi_remove_handle(CURLM *multi_handle, + CURL *curl_handle); + + /* + * Name: curl_multi_fdset() + * + * Desc: Ask curl for its fd_set sets. The app can use these to select() or + * poll() on. We want curl_multi_perform() called as soon as one of + * them are ready. + * + * Returns: CURLMcode type, general multi error code. + */ +CURL_EXTERN CURLMcode curl_multi_fdset(CURLM *multi_handle, + fd_set *read_fd_set, + fd_set *write_fd_set, + fd_set *exc_fd_set, + int *max_fd); + +/* + * Name: curl_multi_wait() + * + * Desc: Poll on all fds within a CURLM set as well as any + * additional fds passed to the function. + * + * Returns: CURLMcode type, general multi error code. + */ +CURL_EXTERN CURLMcode curl_multi_wait(CURLM *multi_handle, + struct curl_waitfd extra_fds[], + unsigned int extra_nfds, + int timeout_ms, + int *ret); + +/* + * Name: curl_multi_poll() + * + * Desc: Poll on all fds within a CURLM set as well as any + * additional fds passed to the function. + * + * Returns: CURLMcode type, general multi error code. + */ +CURL_EXTERN CURLMcode curl_multi_poll(CURLM *multi_handle, + struct curl_waitfd extra_fds[], + unsigned int extra_nfds, + int timeout_ms, + int *ret); + +/* + * Name: curl_multi_wakeup() + * + * Desc: wakes up a sleeping curl_multi_poll call. + * + * Returns: CURLMcode type, general multi error code. + */ +CURL_EXTERN CURLMcode curl_multi_wakeup(CURLM *multi_handle); + + /* + * Name: curl_multi_perform() + * + * Desc: When the app thinks there is data available for curl it calls this + * function to read/write whatever there is right now. This returns + * as soon as the reads and writes are done. This function does not + * require that there actually is data available for reading or that + * data can be written, it can be called just in case. It returns + * the number of handles that still transfer data in the second + * argument's integer-pointer. + * + * Returns: CURLMcode type, general multi error code. *NOTE* that this only + * returns errors etc regarding the whole multi stack. There might + * still have occurred problems on individual transfers even when + * this returns OK. + */ +CURL_EXTERN CURLMcode curl_multi_perform(CURLM *multi_handle, + int *running_handles); + + /* + * Name: curl_multi_cleanup() + * + * Desc: Cleans up and removes a whole multi stack. It does not free or + * touch any individual easy handles in any way. We need to define + * in what state those handles will be if this function is called + * in the middle of a transfer. + * + * Returns: CURLMcode type, general multi error code. + */ +CURL_EXTERN CURLMcode curl_multi_cleanup(CURLM *multi_handle); + +/* + * Name: curl_multi_info_read() + * + * Desc: Ask the multi handle if there is any messages/informationals from + * the individual transfers. Messages include informationals such as + * error code from the transfer or just the fact that a transfer is + * completed. More details on these should be written down as well. + * + * Repeated calls to this function will return a new struct each + * time, until a special "end of msgs" struct is returned as a signal + * that there is no more to get at this point. + * + * The data the returned pointer points to will not survive calling + * curl_multi_cleanup(). + * + * The 'CURLMsg' struct is meant to be simple and only contain basic + * information. If more involved information is wanted, we will + * provide the particular "transfer handle" in that struct and that + * should/could/would be used in subsequent curl_easy_getinfo() calls + * (or similar). The point being that we must never expose complex + * structs to applications, as then we will undoubtably get backwards + * compatibility problems in the future. + * + * Returns: A pointer to a filled-in struct, or NULL if it failed or ran out + * of structs. It also writes the number of messages left in the + * queue (after this read) in the integer the second argument points + * to. + */ +CURL_EXTERN CURLMsg *curl_multi_info_read(CURLM *multi_handle, + int *msgs_in_queue); + +/* + * Name: curl_multi_strerror() + * + * Desc: The curl_multi_strerror function may be used to turn a CURLMcode + * value into the equivalent human readable error string. This is + * useful for printing meaningful error messages. + * + * Returns: A pointer to a null-terminated error message. + */ +CURL_EXTERN const char *curl_multi_strerror(CURLMcode); + +/* + * Name: curl_multi_socket() and + * curl_multi_socket_all() + * + * Desc: An alternative version of curl_multi_perform() that allows the + * application to pass in one of the file descriptors that have been + * detected to have "action" on them and let libcurl perform. + * See manpage for details. + */ +#define CURL_POLL_NONE 0 +#define CURL_POLL_IN 1 +#define CURL_POLL_OUT 2 +#define CURL_POLL_INOUT 3 +#define CURL_POLL_REMOVE 4 + +#define CURL_SOCKET_TIMEOUT CURL_SOCKET_BAD + +#define CURL_CSELECT_IN 0x01 +#define CURL_CSELECT_OUT 0x02 +#define CURL_CSELECT_ERR 0x04 + +typedef int (*curl_socket_callback)(CURL *easy, /* easy handle */ + curl_socket_t s, /* socket */ + int what, /* see above */ + void *userp, /* private callback + pointer */ + void *socketp); /* private socket + pointer */ +/* + * Name: curl_multi_timer_callback + * + * Desc: Called by libcurl whenever the library detects a change in the + * maximum number of milliseconds the app is allowed to wait before + * curl_multi_socket() or curl_multi_perform() must be called + * (to allow libcurl's timed events to take place). + * + * Returns: The callback should return zero. + */ +typedef int (*curl_multi_timer_callback)(CURLM *multi, /* multi handle */ + long timeout_ms, /* see above */ + void *userp); /* private callback + pointer */ + +CURL_EXTERN CURLMcode CURL_DEPRECATED(7.19.5, "Use curl_multi_socket_action()") +curl_multi_socket(CURLM *multi_handle, curl_socket_t s, int *running_handles); + +CURL_EXTERN CURLMcode curl_multi_socket_action(CURLM *multi_handle, + curl_socket_t s, + int ev_bitmask, + int *running_handles); + +CURL_EXTERN CURLMcode CURL_DEPRECATED(7.19.5, "Use curl_multi_socket_action()") +curl_multi_socket_all(CURLM *multi_handle, int *running_handles); + +#ifndef CURL_ALLOW_OLD_MULTI_SOCKET +/* This macro below was added in 7.16.3 to push users who recompile to use + the new curl_multi_socket_action() instead of the old curl_multi_socket() +*/ +#define curl_multi_socket(x,y,z) curl_multi_socket_action(x,y,0,z) +#endif + +/* + * Name: curl_multi_timeout() + * + * Desc: Returns the maximum number of milliseconds the app is allowed to + * wait before curl_multi_socket() or curl_multi_perform() must be + * called (to allow libcurl's timed events to take place). + * + * Returns: CURLM error code. + */ +CURL_EXTERN CURLMcode curl_multi_timeout(CURLM *multi_handle, + long *milliseconds); + +typedef enum { + /* This is the socket callback function pointer */ + CURLOPT(CURLMOPT_SOCKETFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 1), + + /* This is the argument passed to the socket callback */ + CURLOPT(CURLMOPT_SOCKETDATA, CURLOPTTYPE_OBJECTPOINT, 2), + + /* set to 1 to enable pipelining for this multi handle */ + CURLOPT(CURLMOPT_PIPELINING, CURLOPTTYPE_LONG, 3), + + /* This is the timer callback function pointer */ + CURLOPT(CURLMOPT_TIMERFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 4), + + /* This is the argument passed to the timer callback */ + CURLOPT(CURLMOPT_TIMERDATA, CURLOPTTYPE_OBJECTPOINT, 5), + + /* maximum number of entries in the connection cache */ + CURLOPT(CURLMOPT_MAXCONNECTS, CURLOPTTYPE_LONG, 6), + + /* maximum number of (pipelining) connections to one host */ + CURLOPT(CURLMOPT_MAX_HOST_CONNECTIONS, CURLOPTTYPE_LONG, 7), + + /* maximum number of requests in a pipeline */ + CURLOPT(CURLMOPT_MAX_PIPELINE_LENGTH, CURLOPTTYPE_LONG, 8), + + /* a connection with a content-length longer than this + will not be considered for pipelining */ + CURLOPT(CURLMOPT_CONTENT_LENGTH_PENALTY_SIZE, CURLOPTTYPE_OFF_T, 9), + + /* a connection with a chunk length longer than this + will not be considered for pipelining */ + CURLOPT(CURLMOPT_CHUNK_LENGTH_PENALTY_SIZE, CURLOPTTYPE_OFF_T, 10), + + /* a list of site names(+port) that are blocked from pipelining */ + CURLOPT(CURLMOPT_PIPELINING_SITE_BL, CURLOPTTYPE_OBJECTPOINT, 11), + + /* a list of server types that are blocked from pipelining */ + CURLOPT(CURLMOPT_PIPELINING_SERVER_BL, CURLOPTTYPE_OBJECTPOINT, 12), + + /* maximum number of open connections in total */ + CURLOPT(CURLMOPT_MAX_TOTAL_CONNECTIONS, CURLOPTTYPE_LONG, 13), + + /* This is the server push callback function pointer */ + CURLOPT(CURLMOPT_PUSHFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 14), + + /* This is the argument passed to the server push callback */ + CURLOPT(CURLMOPT_PUSHDATA, CURLOPTTYPE_OBJECTPOINT, 15), + + /* maximum number of concurrent streams to support on a connection */ + CURLOPT(CURLMOPT_MAX_CONCURRENT_STREAMS, CURLOPTTYPE_LONG, 16), + + CURLMOPT_LASTENTRY /* the last unused */ +} CURLMoption; + + +/* + * Name: curl_multi_setopt() + * + * Desc: Sets options for the multi handle. + * + * Returns: CURLM error code. + */ +CURL_EXTERN CURLMcode curl_multi_setopt(CURLM *multi_handle, + CURLMoption option, ...); + + +/* + * Name: curl_multi_assign() + * + * Desc: This function sets an association in the multi handle between the + * given socket and a private pointer of the application. This is + * (only) useful for curl_multi_socket uses. + * + * Returns: CURLM error code. + */ +CURL_EXTERN CURLMcode curl_multi_assign(CURLM *multi_handle, + curl_socket_t sockfd, void *sockp); + +/* + * Name: curl_multi_get_handles() + * + * Desc: Returns an allocated array holding all handles currently added to + * the multi handle. Marks the final entry with a NULL pointer. If + * there is no easy handle added to the multi handle, this function + * returns an array with the first entry as a NULL pointer. + * + * Returns: NULL on failure, otherwise a CURL **array pointer + */ +CURL_EXTERN CURL **curl_multi_get_handles(CURLM *multi_handle); + +/* + * Name: curl_push_callback + * + * Desc: This callback gets called when a new stream is being pushed by the + * server. It approves or denies the new stream. It can also decide + * to completely fail the connection. + * + * Returns: CURL_PUSH_OK, CURL_PUSH_DENY or CURL_PUSH_ERROROUT + */ +#define CURL_PUSH_OK 0 +#define CURL_PUSH_DENY 1 +#define CURL_PUSH_ERROROUT 2 /* added in 7.72.0 */ + +struct curl_pushheaders; /* forward declaration only */ + +CURL_EXTERN char *curl_pushheader_bynum(struct curl_pushheaders *h, + size_t num); +CURL_EXTERN char *curl_pushheader_byname(struct curl_pushheaders *h, + const char *name); + +typedef int (*curl_push_callback)(CURL *parent, + CURL *easy, + size_t num_headers, + struct curl_pushheaders *headers, + void *userp); + +/* + * Name: curl_multi_waitfds() + * + * Desc: Ask curl for fds for polling. The app can use these to poll on. + * We want curl_multi_perform() called as soon as one of them are + * ready. Passing zero size allows to get just a number of fds. + * + * Returns: CURLMcode type, general multi error code. + */ +CURL_EXTERN CURLMcode curl_multi_waitfds(CURLM *multi, + struct curl_waitfd *ufds, + unsigned int size, + unsigned int *fd_count); + +#ifdef __cplusplus +} /* end of extern "C" */ +#endif + +#endif diff --git a/curl/include/curl/options.h b/curl/include/curl/options.h new file mode 100644 index 0000000..1ed76a9 --- /dev/null +++ b/curl/include/curl/options.h @@ -0,0 +1,70 @@ +#ifndef CURLINC_OPTIONS_H +#define CURLINC_OPTIONS_H +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +#ifdef __cplusplus +extern "C" { +#endif + +typedef enum { + CURLOT_LONG, /* long (a range of values) */ + CURLOT_VALUES, /* (a defined set or bitmask) */ + CURLOT_OFF_T, /* curl_off_t (a range of values) */ + CURLOT_OBJECT, /* pointer (void *) */ + CURLOT_STRING, /* (char * to null-terminated buffer) */ + CURLOT_SLIST, /* (struct curl_slist *) */ + CURLOT_CBPTR, /* (void * passed as-is to a callback) */ + CURLOT_BLOB, /* blob (struct curl_blob *) */ + CURLOT_FUNCTION /* function pointer */ +} curl_easytype; + +/* Flag bits */ + +/* "alias" means it is provided for old programs to remain functional, + we prefer another name */ +#define CURLOT_FLAG_ALIAS (1<<0) + +/* The CURLOPTTYPE_* id ranges can still be used to figure out what type/size + to use for curl_easy_setopt() for the given id */ +struct curl_easyoption { + const char *name; + CURLoption id; + curl_easytype type; + unsigned int flags; +}; + +CURL_EXTERN const struct curl_easyoption * +curl_easy_option_by_name(const char *name); + +CURL_EXTERN const struct curl_easyoption * +curl_easy_option_by_id(CURLoption id); + +CURL_EXTERN const struct curl_easyoption * +curl_easy_option_next(const struct curl_easyoption *prev); + +#ifdef __cplusplus +} /* end of extern "C" */ +#endif +#endif /* CURLINC_OPTIONS_H */ diff --git a/curl/include/curl/stdcheaders.h b/curl/include/curl/stdcheaders.h new file mode 100644 index 0000000..7451aa3 --- /dev/null +++ b/curl/include/curl/stdcheaders.h @@ -0,0 +1,35 @@ +#ifndef CURLINC_STDCHEADERS_H +#define CURLINC_STDCHEADERS_H +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +#include + +size_t fread(void *, size_t, size_t, FILE *); +size_t fwrite(const void *, size_t, size_t, FILE *); + +int strcasecmp(const char *, const char *); +int strncasecmp(const char *, const char *, size_t); + +#endif /* CURLINC_STDCHEADERS_H */ diff --git a/curl/include/curl/system.h b/curl/include/curl/system.h new file mode 100644 index 0000000..f1c2719 --- /dev/null +++ b/curl/include/curl/system.h @@ -0,0 +1,450 @@ +#ifndef CURLINC_SYSTEM_H +#define CURLINC_SYSTEM_H +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* + * Try to keep one section per platform, compiler and architecture, otherwise, + * if an existing section is reused for a different one and later on the + * original is adjusted, probably the piggybacking one can be adversely + * changed. + * + * In order to differentiate between platforms/compilers/architectures use + * only compiler built-in predefined preprocessor symbols. + * + * curl_off_t + * ---------- + * + * For any given platform/compiler curl_off_t MUST be typedef'ed to a 64-bit + * wide signed integral data type. The width of this data type must remain + * constant and independent of any possible large file support settings. + * + * As a general rule, curl_off_t shall not be mapped to off_t. This rule shall + * only be violated if off_t is the only 64-bit data type available and the + * size of off_t is independent of large file support settings. Keep your + * build on the safe side avoiding an off_t gating. If you have a 64-bit + * off_t then take for sure that another 64-bit data type exists, dig deeper + * and you will find it. + * + */ + +#ifdef __DJGPP__ +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T "lld" +# define CURL_FORMAT_CURL_OFF_TU "llu" +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# define CURL_TYPEOF_CURL_SOCKLEN_T int + +#elif defined(__BORLANDC__) +# define CURL_TYPEOF_CURL_OFF_T __int64 +# define CURL_FORMAT_CURL_OFF_T "I64d" +# define CURL_FORMAT_CURL_OFF_TU "I64u" +# define CURL_SUFFIX_CURL_OFF_T i64 +# define CURL_SUFFIX_CURL_OFF_TU ui64 +# define CURL_TYPEOF_CURL_SOCKLEN_T int + +#elif defined(__POCC__) +# if defined(_MSC_VER) +# define CURL_TYPEOF_CURL_OFF_T __int64 +# define CURL_FORMAT_CURL_OFF_T "I64d" +# define CURL_FORMAT_CURL_OFF_TU "I64u" +# define CURL_SUFFIX_CURL_OFF_T i64 +# define CURL_SUFFIX_CURL_OFF_TU ui64 +# else +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T "lld" +# define CURL_FORMAT_CURL_OFF_TU "llu" +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# endif +# define CURL_TYPEOF_CURL_SOCKLEN_T int + +#elif defined(__LCC__) +# if defined(__MCST__) /* MCST eLbrus Compiler Collection */ +# define CURL_TYPEOF_CURL_OFF_T long +# define CURL_FORMAT_CURL_OFF_T "ld" +# define CURL_FORMAT_CURL_OFF_TU "lu" +# define CURL_SUFFIX_CURL_OFF_T L +# define CURL_SUFFIX_CURL_OFF_TU UL +# define CURL_TYPEOF_CURL_SOCKLEN_T socklen_t +# define CURL_PULL_SYS_TYPES_H 1 +# define CURL_PULL_SYS_SOCKET_H 1 +# else /* Local (or Little) C Compiler */ +# define CURL_TYPEOF_CURL_OFF_T long +# define CURL_FORMAT_CURL_OFF_T "ld" +# define CURL_FORMAT_CURL_OFF_TU "lu" +# define CURL_SUFFIX_CURL_OFF_T L +# define CURL_SUFFIX_CURL_OFF_TU UL +# define CURL_TYPEOF_CURL_SOCKLEN_T int +# endif + +#elif defined(macintosh) +# include +# if TYPE_LONGLONG +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T "lld" +# define CURL_FORMAT_CURL_OFF_TU "llu" +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# else +# define CURL_TYPEOF_CURL_OFF_T long +# define CURL_FORMAT_CURL_OFF_T "ld" +# define CURL_FORMAT_CURL_OFF_TU "lu" +# define CURL_SUFFIX_CURL_OFF_T L +# define CURL_SUFFIX_CURL_OFF_TU UL +# endif +# define CURL_TYPEOF_CURL_SOCKLEN_T unsigned int + +#elif defined(__TANDEM) +# if !defined(__LP64) +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T "lld" +# define CURL_FORMAT_CURL_OFF_TU "llu" +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# define CURL_TYPEOF_CURL_SOCKLEN_T int +# else +# define CURL_TYPEOF_CURL_OFF_T long +# define CURL_FORMAT_CURL_OFF_T "ld" +# define CURL_FORMAT_CURL_OFF_TU "lu" +# define CURL_SUFFIX_CURL_OFF_T L +# define CURL_SUFFIX_CURL_OFF_TU UL +# define CURL_TYPEOF_CURL_SOCKLEN_T unsigned int +# endif + +#elif defined(UNDER_CE) +# if defined(__MINGW32CE__) +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T "lld" +# define CURL_FORMAT_CURL_OFF_TU "llu" +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# define CURL_TYPEOF_CURL_SOCKLEN_T int +# else +# define CURL_TYPEOF_CURL_OFF_T __int64 +# define CURL_FORMAT_CURL_OFF_T "I64d" +# define CURL_FORMAT_CURL_OFF_TU "I64u" +# define CURL_SUFFIX_CURL_OFF_T i64 +# define CURL_SUFFIX_CURL_OFF_TU ui64 +# define CURL_TYPEOF_CURL_SOCKLEN_T int +# endif + +#elif defined(__MINGW32__) +# include +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T PRId64 +# define CURL_FORMAT_CURL_OFF_TU PRIu64 +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# define CURL_TYPEOF_CURL_SOCKLEN_T int +# define CURL_PULL_SYS_TYPES_H 1 + +#elif defined(__VMS) +# if defined(__VAX) +# define CURL_TYPEOF_CURL_OFF_T long +# define CURL_FORMAT_CURL_OFF_T "ld" +# define CURL_FORMAT_CURL_OFF_TU "lu" +# define CURL_SUFFIX_CURL_OFF_T L +# define CURL_SUFFIX_CURL_OFF_TU UL +# else +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T "lld" +# define CURL_FORMAT_CURL_OFF_TU "llu" +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# endif +# define CURL_TYPEOF_CURL_SOCKLEN_T unsigned int + +#elif defined(__OS400__) +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T "lld" +# define CURL_FORMAT_CURL_OFF_TU "llu" +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# define CURL_TYPEOF_CURL_SOCKLEN_T socklen_t +# define CURL_PULL_SYS_TYPES_H 1 +# define CURL_PULL_SYS_SOCKET_H 1 + +#elif defined(__MVS__) +# if defined(_LONG_LONG) +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T "lld" +# define CURL_FORMAT_CURL_OFF_TU "llu" +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# else /* _LP64 and default */ +# define CURL_TYPEOF_CURL_OFF_T long +# define CURL_FORMAT_CURL_OFF_T "ld" +# define CURL_FORMAT_CURL_OFF_TU "lu" +# define CURL_SUFFIX_CURL_OFF_T L +# define CURL_SUFFIX_CURL_OFF_TU UL +# endif +# define CURL_TYPEOF_CURL_SOCKLEN_T socklen_t +# define CURL_PULL_SYS_TYPES_H 1 +# define CURL_PULL_SYS_SOCKET_H 1 + +#elif defined(__370__) +# if defined(__IBMC__) || defined(__IBMCPP__) +# if defined(_LONG_LONG) +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T "lld" +# define CURL_FORMAT_CURL_OFF_TU "llu" +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# else /* _LP64 and default */ +# define CURL_TYPEOF_CURL_OFF_T long +# define CURL_FORMAT_CURL_OFF_T "ld" +# define CURL_FORMAT_CURL_OFF_TU "lu" +# define CURL_SUFFIX_CURL_OFF_T L +# define CURL_SUFFIX_CURL_OFF_TU UL +# endif +# define CURL_TYPEOF_CURL_SOCKLEN_T socklen_t +# define CURL_PULL_SYS_TYPES_H 1 +# define CURL_PULL_SYS_SOCKET_H 1 +# endif + +#elif defined(TPF) +# define CURL_TYPEOF_CURL_OFF_T long +# define CURL_FORMAT_CURL_OFF_T "ld" +# define CURL_FORMAT_CURL_OFF_TU "lu" +# define CURL_SUFFIX_CURL_OFF_T L +# define CURL_SUFFIX_CURL_OFF_TU UL +# define CURL_TYPEOF_CURL_SOCKLEN_T int + +#elif defined(__TINYC__) /* also known as tcc */ +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T "lld" +# define CURL_FORMAT_CURL_OFF_TU "llu" +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# define CURL_TYPEOF_CURL_SOCKLEN_T socklen_t +# define CURL_PULL_SYS_TYPES_H 1 +# define CURL_PULL_SYS_SOCKET_H 1 + +#elif defined(__SUNPRO_C) || defined(__SUNPRO_CC) /* Oracle Solaris Studio */ +# if !defined(__LP64) && (defined(__ILP32) || \ + defined(__i386) || \ + defined(__sparcv8) || \ + defined(__sparcv8plus)) +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T "lld" +# define CURL_FORMAT_CURL_OFF_TU "llu" +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# elif defined(__LP64) || \ + defined(__amd64) || defined(__sparcv9) +# define CURL_TYPEOF_CURL_OFF_T long +# define CURL_FORMAT_CURL_OFF_T "ld" +# define CURL_FORMAT_CURL_OFF_TU "lu" +# define CURL_SUFFIX_CURL_OFF_T L +# define CURL_SUFFIX_CURL_OFF_TU UL +# endif +# define CURL_TYPEOF_CURL_SOCKLEN_T socklen_t +# define CURL_PULL_SYS_TYPES_H 1 +# define CURL_PULL_SYS_SOCKET_H 1 + +#elif defined(__xlc__) /* IBM xlc compiler */ +# if !defined(_LP64) +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T "lld" +# define CURL_FORMAT_CURL_OFF_TU "llu" +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# else +# define CURL_TYPEOF_CURL_OFF_T long +# define CURL_FORMAT_CURL_OFF_T "ld" +# define CURL_FORMAT_CURL_OFF_TU "lu" +# define CURL_SUFFIX_CURL_OFF_T L +# define CURL_SUFFIX_CURL_OFF_TU UL +# endif +# define CURL_TYPEOF_CURL_SOCKLEN_T socklen_t +# define CURL_PULL_SYS_TYPES_H 1 +# define CURL_PULL_SYS_SOCKET_H 1 + +#elif defined(__hpux) /* HP aCC compiler */ +# if !defined(_LP64) +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T "lld" +# define CURL_FORMAT_CURL_OFF_TU "llu" +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# else +# define CURL_TYPEOF_CURL_OFF_T long +# define CURL_FORMAT_CURL_OFF_T "ld" +# define CURL_FORMAT_CURL_OFF_TU "lu" +# define CURL_SUFFIX_CURL_OFF_T L +# define CURL_SUFFIX_CURL_OFF_TU UL +# endif +# define CURL_TYPEOF_CURL_SOCKLEN_T socklen_t +# define CURL_PULL_SYS_TYPES_H 1 +# define CURL_PULL_SYS_SOCKET_H 1 + +/* ===================================== */ +/* KEEP MSVC THE PENULTIMATE ENTRY */ +/* ===================================== */ + +#elif defined(_MSC_VER) +# if (_MSC_VER >= 1800) +# include +# define CURL_FORMAT_CURL_OFF_T PRId64 +# define CURL_FORMAT_CURL_OFF_TU PRIu64 +# else +# define CURL_FORMAT_CURL_OFF_T "I64d" +# define CURL_FORMAT_CURL_OFF_TU "I64u" +# endif +# define CURL_TYPEOF_CURL_OFF_T __int64 +# define CURL_SUFFIX_CURL_OFF_T i64 +# define CURL_SUFFIX_CURL_OFF_TU ui64 +# define CURL_TYPEOF_CURL_SOCKLEN_T int + +/* ===================================== */ +/* KEEP GENERIC GCC THE LAST ENTRY */ +/* ===================================== */ + +#elif defined(__GNUC__) && !defined(_SCO_DS) +# if !defined(__LP64__) && \ + (defined(__ILP32__) || defined(__i386__) || defined(__hppa__) || \ + defined(__ppc__) || defined(__powerpc__) || defined(__arm__) || \ + defined(__sparc__) || defined(__mips__) || defined(__sh__) || \ + defined(__XTENSA__) || \ + (defined(__SIZEOF_LONG__) && __SIZEOF_LONG__ == 4) || \ + (defined(__LONG_MAX__) && __LONG_MAX__ == 2147483647L)) +# define CURL_TYPEOF_CURL_OFF_T long long +# define CURL_FORMAT_CURL_OFF_T "lld" +# define CURL_FORMAT_CURL_OFF_TU "llu" +# define CURL_SUFFIX_CURL_OFF_T LL +# define CURL_SUFFIX_CURL_OFF_TU ULL +# define CURL_POPCOUNT64(x) __builtin_popcountll(x) +# define CURL_CTZ64(x) __builtin_ctzll(x) +# elif defined(__LP64__) || \ + defined(__x86_64__) || defined(__ppc64__) || defined(__sparc64__) || \ + defined(__e2k__) || \ + (defined(__SIZEOF_LONG__) && __SIZEOF_LONG__ == 8) || \ + (defined(__LONG_MAX__) && __LONG_MAX__ == 9223372036854775807L) +# define CURL_TYPEOF_CURL_OFF_T long +# define CURL_FORMAT_CURL_OFF_T "ld" +# define CURL_FORMAT_CURL_OFF_TU "lu" +# define CURL_SUFFIX_CURL_OFF_T L +# define CURL_SUFFIX_CURL_OFF_TU UL +# define CURL_POPCOUNT64(x) __builtin_popcountl(x) +# define CURL_CTZ64(x) __builtin_ctzl(x) +# endif +# define CURL_TYPEOF_CURL_SOCKLEN_T socklen_t +# define CURL_PULL_SYS_TYPES_H 1 +# define CURL_PULL_SYS_SOCKET_H 1 + +#else +/* generic "safe guess" on old 32-bit style */ +# define CURL_TYPEOF_CURL_OFF_T long +# define CURL_FORMAT_CURL_OFF_T "ld" +# define CURL_FORMAT_CURL_OFF_TU "lu" +# define CURL_SUFFIX_CURL_OFF_T L +# define CURL_SUFFIX_CURL_OFF_TU UL +# define CURL_TYPEOF_CURL_SOCKLEN_T int +#endif + +#ifdef _AIX +/* AIX needs */ +#define CURL_PULL_SYS_POLL_H +#endif + +/* CURL_PULL_SYS_TYPES_H is defined above when inclusion of header file */ +/* sys/types.h is required here to properly make type definitions below. */ +#ifdef CURL_PULL_SYS_TYPES_H +# include +#endif + +/* CURL_PULL_SYS_SOCKET_H is defined above when inclusion of header file */ +/* sys/socket.h is required here to properly make type definitions below. */ +#ifdef CURL_PULL_SYS_SOCKET_H +# include +#endif + +/* CURL_PULL_SYS_POLL_H is defined above when inclusion of header file */ +/* sys/poll.h is required here to properly make type definitions below. */ +#ifdef CURL_PULL_SYS_POLL_H +# include +#endif + +/* Data type definition of curl_socklen_t. */ +#ifdef CURL_TYPEOF_CURL_SOCKLEN_T + typedef CURL_TYPEOF_CURL_SOCKLEN_T curl_socklen_t; +#endif + +/* Data type definition of curl_off_t. */ + +#ifdef CURL_TYPEOF_CURL_OFF_T + typedef CURL_TYPEOF_CURL_OFF_T curl_off_t; +#endif + +/* + * CURL_ISOCPP and CURL_OFF_T_C definitions are done here in order to allow + * these to be visible and exported by the external libcurl interface API, + * while also making them visible to the library internals, simply including + * curl_setup.h, without actually needing to include curl.h internally. + * If some day this section would grow big enough, all this should be moved + * to its own header file. + */ + +/* + * Figure out if we can use the ## preprocessor operator, which is supported + * by ISO/ANSI C and C++. Some compilers support it without setting __STDC__ + * or __cplusplus so we need to carefully check for them too. + */ + +#if defined(__STDC__) || defined(_MSC_VER) || defined(__cplusplus) || \ + defined(__HP_aCC) || defined(__BORLANDC__) || defined(__LCC__) || \ + defined(__POCC__) || defined(__HIGHC__) || \ + defined(__ILEC400__) + /* This compiler is believed to have an ISO compatible preprocessor */ +#define CURL_ISOCPP +#else + /* This compiler is believed NOT to have an ISO compatible preprocessor */ +#undef CURL_ISOCPP +#endif + +/* + * Macros for minimum-width signed and unsigned curl_off_t integer constants. + */ + +#if defined(__BORLANDC__) && (__BORLANDC__ == 0x0551) +# define CURLINC_OFF_T_C_HLPR2(x) x +# define CURLINC_OFF_T_C_HLPR1(x) CURLINC_OFF_T_C_HLPR2(x) +# define CURL_OFF_T_C(Val) CURLINC_OFF_T_C_HLPR1(Val) ## \ + CURLINC_OFF_T_C_HLPR1(CURL_SUFFIX_CURL_OFF_T) +# define CURL_OFF_TU_C(Val) CURLINC_OFF_T_C_HLPR1(Val) ## \ + CURLINC_OFF_T_C_HLPR1(CURL_SUFFIX_CURL_OFF_TU) +#else +# ifdef CURL_ISOCPP +# define CURLINC_OFF_T_C_HLPR2(Val,Suffix) Val ## Suffix +# else +# define CURLINC_OFF_T_C_HLPR2(Val,Suffix) Val/**/Suffix +# endif +# define CURLINC_OFF_T_C_HLPR1(Val,Suffix) CURLINC_OFF_T_C_HLPR2(Val,Suffix) +# define CURL_OFF_T_C(Val) CURLINC_OFF_T_C_HLPR1(Val,CURL_SUFFIX_CURL_OFF_T) +# define CURL_OFF_TU_C(Val) CURLINC_OFF_T_C_HLPR1(Val,CURL_SUFFIX_CURL_OFF_TU) +#endif + +#endif /* CURLINC_SYSTEM_H */ diff --git a/curl/include/curl/typecheck-gcc.h b/curl/include/curl/typecheck-gcc.h new file mode 100644 index 0000000..6415269 --- /dev/null +++ b/curl/include/curl/typecheck-gcc.h @@ -0,0 +1,867 @@ +#ifndef CURLINC_TYPECHECK_GCC_H +#define CURLINC_TYPECHECK_GCC_H +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +/* wraps curl_easy_setopt() with typechecking */ + +/* To add a new kind of warning, add an + * if(curlcheck_sometype_option(_curl_opt)) + * if(!curlcheck_sometype(value)) + * _curl_easy_setopt_err_sometype(); + * block and define curlcheck_sometype_option, curlcheck_sometype and + * _curl_easy_setopt_err_sometype below + * + * NOTE: We use two nested 'if' statements here instead of the && operator, in + * order to work around gcc bug #32061. It affects only gcc 4.3.x/4.4.x + * when compiling with -Wlogical-op. + * + * To add an option that uses the same type as an existing option, you will + * just need to extend the appropriate _curl_*_option macro + */ + +#define curl_easy_setopt(handle, option, value) \ + __extension__({ \ + if(__builtin_constant_p(option)) { \ + CURL_IGNORE_DEPRECATION( \ + if(curlcheck_long_option(option)) \ + if(!curlcheck_long(value)) \ + _curl_easy_setopt_err_long(); \ + if(curlcheck_off_t_option(option)) \ + if(!curlcheck_off_t(value)) \ + _curl_easy_setopt_err_curl_off_t(); \ + if(curlcheck_string_option(option)) \ + if(!curlcheck_string(value)) \ + _curl_easy_setopt_err_string(); \ + if((option) == CURLOPT_PRIVATE) { } \ + if(curlcheck_write_cb_option(option)) \ + if(!curlcheck_write_cb(value)) \ + _curl_easy_setopt_err_write_callback(); \ + if(curlcheck_curl_option(option)) \ + if(!curlcheck_curl(value)) \ + _curl_easy_setopt_err_curl(); \ + if((option) == CURLOPT_RESOLVER_START_FUNCTION) \ + if(!curlcheck_resolver_start_callback(value)) \ + _curl_easy_setopt_err_resolver_start_callback(); \ + if((option) == CURLOPT_READFUNCTION) \ + if(!curlcheck_read_cb(value)) \ + _curl_easy_setopt_err_read_cb(); \ + if((option) == CURLOPT_IOCTLFUNCTION) \ + if(!curlcheck_ioctl_cb(value)) \ + _curl_easy_setopt_err_ioctl_cb(); \ + if((option) == CURLOPT_SOCKOPTFUNCTION) \ + if(!curlcheck_sockopt_cb(value)) \ + _curl_easy_setopt_err_sockopt_cb(); \ + if((option) == CURLOPT_OPENSOCKETFUNCTION) \ + if(!curlcheck_opensocket_cb(value)) \ + _curl_easy_setopt_err_opensocket_cb(); \ + if((option) == CURLOPT_PROGRESSFUNCTION) \ + if(!curlcheck_progress_cb(value)) \ + _curl_easy_setopt_err_progress_cb(); \ + if((option) == CURLOPT_XFERINFOFUNCTION) \ + if(!curlcheck_xferinfo_cb(value)) \ + _curl_easy_setopt_err_xferinfo_cb(); \ + if((option) == CURLOPT_DEBUGFUNCTION) \ + if(!curlcheck_debug_cb(value)) \ + _curl_easy_setopt_err_debug_cb(); \ + if((option) == CURLOPT_SSL_CTX_FUNCTION) \ + if(!curlcheck_ssl_ctx_cb(value)) \ + _curl_easy_setopt_err_ssl_ctx_cb(); \ + if(curlcheck_conv_cb_option(option)) \ + if(!curlcheck_conv_cb(value)) \ + _curl_easy_setopt_err_conv_cb(); \ + if((option) == CURLOPT_SEEKFUNCTION) \ + if(!curlcheck_seek_cb(value)) \ + _curl_easy_setopt_err_seek_cb(); \ + if((option) == CURLOPT_CHUNK_BGN_FUNCTION) \ + if(!curlcheck_chunk_bgn_cb(value)) \ + _curl_easy_setopt_err_chunk_bgn_cb(); \ + if((option) == CURLOPT_CHUNK_END_FUNCTION) \ + if(!curlcheck_chunk_end_cb(value)) \ + _curl_easy_setopt_err_chunk_end_cb(); \ + if((option) == CURLOPT_CLOSESOCKETFUNCTION) \ + if(!curlcheck_close_socket_cb(value)) \ + _curl_easy_setopt_err_close_socket_cb(); \ + if((option) == CURLOPT_FNMATCH_FUNCTION) \ + if(!curlcheck_fnmatch_cb(value)) \ + _curl_easy_setopt_err_fnmatch_cb(); \ + if((option) == CURLOPT_HSTSREADFUNCTION) \ + if(!curlcheck_hstsread_cb(value)) \ + _curl_easy_setopt_err_hstsread_cb(); \ + if((option) == CURLOPT_HSTSWRITEFUNCTION) \ + if(!curlcheck_hstswrite_cb(value)) \ + _curl_easy_setopt_err_hstswrite_cb(); \ + if((option) == CURLOPT_SSH_HOSTKEYFUNCTION) \ + if(!curlcheck_ssh_hostkey_cb(value)) \ + _curl_easy_setopt_err_ssh_hostkey_cb(); \ + if((option) == CURLOPT_SSH_KEYFUNCTION) \ + if(!curlcheck_ssh_key_cb(value)) \ + _curl_easy_setopt_err_ssh_key_cb(); \ + if((option) == CURLOPT_INTERLEAVEFUNCTION) \ + if(!curlcheck_interleave_cb(value)) \ + _curl_easy_setopt_err_interleave_cb(); \ + if((option) == CURLOPT_PREREQFUNCTION) \ + if(!curlcheck_prereq_cb(value)) \ + _curl_easy_setopt_err_prereq_cb(); \ + if((option) == CURLOPT_TRAILERFUNCTION) \ + if(!curlcheck_trailer_cb(value)) \ + _curl_easy_setopt_err_trailer_cb(); \ + if(curlcheck_cb_data_option(option)) \ + if(!curlcheck_cb_data(value)) \ + _curl_easy_setopt_err_cb_data(); \ + if((option) == CURLOPT_ERRORBUFFER) \ + if(!curlcheck_error_buffer(value)) \ + _curl_easy_setopt_err_error_buffer(); \ + if((option) == CURLOPT_CURLU) \ + if(!curlcheck_ptr((value), CURLU)) \ + _curl_easy_setopt_err_curlu(); \ + if((option) == CURLOPT_STDERR) \ + if(!curlcheck_FILE(value)) \ + _curl_easy_setopt_err_FILE(); \ + if(curlcheck_postfields_option(option)) \ + if(!curlcheck_postfields(value)) \ + _curl_easy_setopt_err_postfields(); \ + if((option) == CURLOPT_HTTPPOST) \ + if(!curlcheck_arr((value), struct curl_httppost)) \ + _curl_easy_setopt_err_curl_httpost(); \ + if((option) == CURLOPT_MIMEPOST) \ + if(!curlcheck_ptr((value), curl_mime)) \ + _curl_easy_setopt_err_curl_mimepost(); \ + if(curlcheck_slist_option(option)) \ + if(!curlcheck_arr((value), struct curl_slist)) \ + _curl_easy_setopt_err_curl_slist(); \ + if((option) == CURLOPT_SHARE) \ + if(!curlcheck_ptr((value), CURLSH)) \ + _curl_easy_setopt_err_CURLSH(); \ + ) \ + } \ + curl_easy_setopt(handle, option, value); \ + }) + +/* wraps curl_easy_getinfo() with typechecking */ +#define curl_easy_getinfo(handle, info, arg) \ + __extension__({ \ + if(__builtin_constant_p(info)) { \ + CURL_IGNORE_DEPRECATION( \ + if(curlcheck_string_info(info)) \ + if(!curlcheck_arr((arg), char *)) \ + _curl_easy_getinfo_err_string(); \ + if(curlcheck_long_info(info)) \ + if(!curlcheck_arr((arg), long)) \ + _curl_easy_getinfo_err_long(); \ + if(curlcheck_double_info(info)) \ + if(!curlcheck_arr((arg), double)) \ + _curl_easy_getinfo_err_double(); \ + if(curlcheck_slist_info(info)) \ + if(!curlcheck_arr((arg), struct curl_slist *)) \ + _curl_easy_getinfo_err_curl_slist(); \ + if(curlcheck_tlssessioninfo_info(info)) \ + if(!curlcheck_arr((arg), struct curl_tlssessioninfo *)) \ + _curl_easy_getinfo_err_curl_tlssesssioninfo(); \ + if(curlcheck_certinfo_info(info)) \ + if(!curlcheck_arr((arg), struct curl_certinfo *)) \ + _curl_easy_getinfo_err_curl_certinfo(); \ + if(curlcheck_socket_info(info)) \ + if(!curlcheck_arr((arg), curl_socket_t)) \ + _curl_easy_getinfo_err_curl_socket(); \ + if(curlcheck_off_t_info(info)) \ + if(!curlcheck_arr((arg), curl_off_t)) \ + _curl_easy_getinfo_err_curl_off_t(); \ + ) \ + } \ + curl_easy_getinfo(handle, info, arg); \ + }) + +/* + * For now, just make sure that the functions are called with three arguments + */ +#define curl_share_setopt(share,opt,param) curl_share_setopt(share,opt,param) +#define curl_multi_setopt(handle,opt,param) curl_multi_setopt(handle,opt,param) + +/* the actual warnings, triggered by calling the _curl_easy_setopt_err* + * functions */ + +/* To define a new warning, use _CURL_WARNING(identifier, "message") */ +#define CURLWARNING(id, message) \ + static void __attribute__((__warning__(message))) \ + __attribute__((__unused__)) __attribute__((__noinline__)) \ + id(void) { __asm__(""); } + +CURLWARNING(_curl_easy_setopt_err_long, + "curl_easy_setopt expects a long argument") +CURLWARNING(_curl_easy_setopt_err_curl_off_t, + "curl_easy_setopt expects a curl_off_t argument") +CURLWARNING(_curl_easy_setopt_err_string, + "curl_easy_setopt expects a " + "string ('char *' or char[]) argument") +CURLWARNING(_curl_easy_setopt_err_write_callback, + "curl_easy_setopt expects a curl_write_callback argument") +CURLWARNING(_curl_easy_setopt_err_resolver_start_callback, + "curl_easy_setopt expects a " + "curl_resolver_start_callback argument") +CURLWARNING(_curl_easy_setopt_err_read_cb, + "curl_easy_setopt expects a curl_read_callback argument") +CURLWARNING(_curl_easy_setopt_err_ioctl_cb, + "curl_easy_setopt expects a curl_ioctl_callback argument") +CURLWARNING(_curl_easy_setopt_err_sockopt_cb, + "curl_easy_setopt expects a curl_sockopt_callback argument") +CURLWARNING(_curl_easy_setopt_err_opensocket_cb, + "curl_easy_setopt expects a " + "curl_opensocket_callback argument") +CURLWARNING(_curl_easy_setopt_err_progress_cb, + "curl_easy_setopt expects a curl_progress_callback argument") +CURLWARNING(_curl_easy_setopt_err_xferinfo_cb, + "curl_easy_setopt expects a curl_xferinfo_callback argument") +CURLWARNING(_curl_easy_setopt_err_debug_cb, + "curl_easy_setopt expects a curl_debug_callback argument") +CURLWARNING(_curl_easy_setopt_err_ssl_ctx_cb, + "curl_easy_setopt expects a curl_ssl_ctx_callback argument") +CURLWARNING(_curl_easy_setopt_err_conv_cb, + "curl_easy_setopt expects a curl_conv_callback argument") +CURLWARNING(_curl_easy_setopt_err_seek_cb, + "curl_easy_setopt expects a curl_seek_callback argument") +CURLWARNING(_curl_easy_setopt_err_cb_data, + "curl_easy_setopt expects a " + "private data pointer as argument") +CURLWARNING(_curl_easy_setopt_err_chunk_bgn_cb, + "curl_easy_setopt expects a curl_chunk_bgn_callback argument") +CURLWARNING(_curl_easy_setopt_err_chunk_end_cb, + "curl_easy_setopt expects a curl_chunk_end_callback argument") +CURLWARNING(_curl_easy_setopt_err_close_socket_cb, + "curl_easy_setopt expects a curl_closesocket_callback argument") +CURLWARNING(_curl_easy_setopt_err_fnmatch_cb, + "curl_easy_setopt expects a curl_fnmatch_callback argument") +CURLWARNING(_curl_easy_setopt_err_hstsread_cb, + "curl_easy_setopt expects a curl_hstsread_callback argument") +CURLWARNING(_curl_easy_setopt_err_hstswrite_cb, + "curl_easy_setopt expects a curl_hstswrite_callback argument") +CURLWARNING(_curl_easy_setopt_err_ssh_key_cb, + "curl_easy_setopt expects a curl_sshkeycallback argument") +CURLWARNING(_curl_easy_setopt_err_ssh_hostkey_cb, + "curl_easy_setopt expects a curl_sshhostkeycallback argument") +CURLWARNING(_curl_easy_setopt_err_interleave_cb, + "curl_easy_setopt expects a curl_interleave_callback argument") +CURLWARNING(_curl_easy_setopt_err_prereq_cb, + "curl_easy_setopt expects a curl_prereq_callback argument") +CURLWARNING(_curl_easy_setopt_err_trailer_cb, + "curl_easy_setopt expects a curl_trailerfunc_ok argument") +CURLWARNING(_curl_easy_setopt_err_error_buffer, + "curl_easy_setopt expects a " + "char buffer of CURL_ERROR_SIZE as argument") +CURLWARNING(_curl_easy_setopt_err_curlu, + "curl_easy_setopt expects a 'CURLU *' argument") +CURLWARNING(_curl_easy_setopt_err_curl, + "curl_easy_setopt expects a 'CURL *' argument") +CURLWARNING(_curl_easy_setopt_err_FILE, + "curl_easy_setopt expects a 'FILE *' argument") +CURLWARNING(_curl_easy_setopt_err_postfields, + "curl_easy_setopt expects a 'void *' or 'char *' argument") +CURLWARNING(_curl_easy_setopt_err_curl_httpost, + "curl_easy_setopt expects a 'struct curl_httppost *' " + "argument") +CURLWARNING(_curl_easy_setopt_err_curl_mimepost, + "curl_easy_setopt expects a 'curl_mime *' " + "argument") +CURLWARNING(_curl_easy_setopt_err_curl_slist, + "curl_easy_setopt expects a 'struct curl_slist *' argument") +CURLWARNING(_curl_easy_setopt_err_CURLSH, + "curl_easy_setopt expects a CURLSH* argument") +CURLWARNING(_curl_easy_getinfo_err_string, + "curl_easy_getinfo expects a pointer to 'char *'") +CURLWARNING(_curl_easy_getinfo_err_long, + "curl_easy_getinfo expects a pointer to long") +CURLWARNING(_curl_easy_getinfo_err_double, + "curl_easy_getinfo expects a pointer to double") +CURLWARNING(_curl_easy_getinfo_err_curl_slist, + "curl_easy_getinfo expects a pointer to 'struct curl_slist *'") +CURLWARNING(_curl_easy_getinfo_err_curl_tlssesssioninfo, + "curl_easy_getinfo expects a pointer to " + "'struct curl_tlssessioninfo *'") +CURLWARNING(_curl_easy_getinfo_err_curl_certinfo, + "curl_easy_getinfo expects a pointer to " + "'struct curl_certinfo *'") +CURLWARNING(_curl_easy_getinfo_err_curl_socket, + "curl_easy_getinfo expects a pointer to curl_socket_t") +CURLWARNING(_curl_easy_getinfo_err_curl_off_t, + "curl_easy_getinfo expects a pointer to curl_off_t") + +/* groups of curl_easy_setops options that take the same type of argument */ + +/* evaluates to true if option takes a long argument */ +#define curlcheck_long_option(option) \ + (0 < (option) && (option) < CURLOPTTYPE_OBJECTPOINT) + +#define curlcheck_off_t_option(option) \ + (((option) > CURLOPTTYPE_OFF_T) && ((option) < CURLOPTTYPE_BLOB)) + +/* option takes a CURL * argument */ +#define curlcheck_curl_option(option) \ + ((option) == CURLOPT_STREAM_DEPENDS || \ + (option) == CURLOPT_STREAM_DEPENDS_E || \ + 0) + +/* evaluates to true if option takes a char* argument */ +#define curlcheck_string_option(option) \ + ((option) == CURLOPT_ABSTRACT_UNIX_SOCKET || \ + (option) == CURLOPT_ACCEPT_ENCODING || \ + (option) == CURLOPT_ALTSVC || \ + (option) == CURLOPT_CAINFO || \ + (option) == CURLOPT_CAPATH || \ + (option) == CURLOPT_COOKIE || \ + (option) == CURLOPT_COOKIEFILE || \ + (option) == CURLOPT_COOKIEJAR || \ + (option) == CURLOPT_COOKIELIST || \ + (option) == CURLOPT_CRLFILE || \ + (option) == CURLOPT_CUSTOMREQUEST || \ + (option) == CURLOPT_DEFAULT_PROTOCOL || \ + (option) == CURLOPT_DNS_INTERFACE || \ + (option) == CURLOPT_DNS_LOCAL_IP4 || \ + (option) == CURLOPT_DNS_LOCAL_IP6 || \ + (option) == CURLOPT_DNS_SERVERS || \ + (option) == CURLOPT_DOH_URL || \ + (option) == CURLOPT_ECH || \ + (option) == CURLOPT_EGDSOCKET || \ + (option) == CURLOPT_FTP_ACCOUNT || \ + (option) == CURLOPT_FTP_ALTERNATIVE_TO_USER || \ + (option) == CURLOPT_FTPPORT || \ + (option) == CURLOPT_HAPROXY_CLIENT_IP || \ + (option) == CURLOPT_HSTS || \ + (option) == CURLOPT_INTERFACE || \ + (option) == CURLOPT_ISSUERCERT || \ + (option) == CURLOPT_KEYPASSWD || \ + (option) == CURLOPT_KRBLEVEL || \ + (option) == CURLOPT_LOGIN_OPTIONS || \ + (option) == CURLOPT_MAIL_AUTH || \ + (option) == CURLOPT_MAIL_FROM || \ + (option) == CURLOPT_NETRC_FILE || \ + (option) == CURLOPT_NOPROXY || \ + (option) == CURLOPT_PASSWORD || \ + (option) == CURLOPT_PINNEDPUBLICKEY || \ + (option) == CURLOPT_PRE_PROXY || \ + (option) == CURLOPT_PROTOCOLS_STR || \ + (option) == CURLOPT_PROXY || \ + (option) == CURLOPT_PROXY_CAINFO || \ + (option) == CURLOPT_PROXY_CAPATH || \ + (option) == CURLOPT_PROXY_CRLFILE || \ + (option) == CURLOPT_PROXY_ISSUERCERT || \ + (option) == CURLOPT_PROXY_KEYPASSWD || \ + (option) == CURLOPT_PROXY_PINNEDPUBLICKEY || \ + (option) == CURLOPT_PROXY_SERVICE_NAME || \ + (option) == CURLOPT_PROXY_SSL_CIPHER_LIST || \ + (option) == CURLOPT_PROXY_SSLCERT || \ + (option) == CURLOPT_PROXY_SSLCERTTYPE || \ + (option) == CURLOPT_PROXY_SSLKEY || \ + (option) == CURLOPT_PROXY_SSLKEYTYPE || \ + (option) == CURLOPT_PROXY_TLS13_CIPHERS || \ + (option) == CURLOPT_PROXY_TLSAUTH_PASSWORD || \ + (option) == CURLOPT_PROXY_TLSAUTH_TYPE || \ + (option) == CURLOPT_PROXY_TLSAUTH_USERNAME || \ + (option) == CURLOPT_PROXYPASSWORD || \ + (option) == CURLOPT_PROXYUSERNAME || \ + (option) == CURLOPT_PROXYUSERPWD || \ + (option) == CURLOPT_RANDOM_FILE || \ + (option) == CURLOPT_RANGE || \ + (option) == CURLOPT_REDIR_PROTOCOLS_STR || \ + (option) == CURLOPT_REFERER || \ + (option) == CURLOPT_REQUEST_TARGET || \ + (option) == CURLOPT_RTSP_SESSION_ID || \ + (option) == CURLOPT_RTSP_STREAM_URI || \ + (option) == CURLOPT_RTSP_TRANSPORT || \ + (option) == CURLOPT_SASL_AUTHZID || \ + (option) == CURLOPT_SERVICE_NAME || \ + (option) == CURLOPT_SOCKS5_GSSAPI_SERVICE || \ + (option) == CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 || \ + (option) == CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 || \ + (option) == CURLOPT_SSH_KNOWNHOSTS || \ + (option) == CURLOPT_SSH_PRIVATE_KEYFILE || \ + (option) == CURLOPT_SSH_PUBLIC_KEYFILE || \ + (option) == CURLOPT_SSLCERT || \ + (option) == CURLOPT_SSLCERTTYPE || \ + (option) == CURLOPT_SSLENGINE || \ + (option) == CURLOPT_SSLKEY || \ + (option) == CURLOPT_SSLKEYTYPE || \ + (option) == CURLOPT_SSL_CIPHER_LIST || \ + (option) == CURLOPT_SSL_EC_CURVES || \ + (option) == CURLOPT_SSL_SIGNATURE_ALGORITHMS || \ + (option) == CURLOPT_TLS13_CIPHERS || \ + (option) == CURLOPT_TLSAUTH_PASSWORD || \ + (option) == CURLOPT_TLSAUTH_TYPE || \ + (option) == CURLOPT_TLSAUTH_USERNAME || \ + (option) == CURLOPT_UNIX_SOCKET_PATH || \ + (option) == CURLOPT_URL || \ + (option) == CURLOPT_USERAGENT || \ + (option) == CURLOPT_USERNAME || \ + (option) == CURLOPT_AWS_SIGV4 || \ + (option) == CURLOPT_USERPWD || \ + (option) == CURLOPT_XOAUTH2_BEARER || \ + 0) + +/* evaluates to true if option takes a curl_write_callback argument */ +#define curlcheck_write_cb_option(option) \ + ((option) == CURLOPT_HEADERFUNCTION || \ + (option) == CURLOPT_WRITEFUNCTION) + +/* evaluates to true if option takes a curl_conv_callback argument */ +#define curlcheck_conv_cb_option(option) \ + ((option) == CURLOPT_CONV_TO_NETWORK_FUNCTION || \ + (option) == CURLOPT_CONV_FROM_NETWORK_FUNCTION || \ + (option) == CURLOPT_CONV_FROM_UTF8_FUNCTION) + +/* evaluates to true if option takes a data argument to pass to a callback */ +#define curlcheck_cb_data_option(option) \ + ((option) == CURLOPT_CHUNK_DATA || \ + (option) == CURLOPT_CLOSESOCKETDATA || \ + (option) == CURLOPT_DEBUGDATA || \ + (option) == CURLOPT_FNMATCH_DATA || \ + (option) == CURLOPT_HEADERDATA || \ + (option) == CURLOPT_HSTSREADDATA || \ + (option) == CURLOPT_HSTSWRITEDATA || \ + (option) == CURLOPT_INTERLEAVEDATA || \ + (option) == CURLOPT_IOCTLDATA || \ + (option) == CURLOPT_OPENSOCKETDATA || \ + (option) == CURLOPT_PREREQDATA || \ + (option) == CURLOPT_XFERINFODATA || \ + (option) == CURLOPT_READDATA || \ + (option) == CURLOPT_SEEKDATA || \ + (option) == CURLOPT_SOCKOPTDATA || \ + (option) == CURLOPT_SSH_KEYDATA || \ + (option) == CURLOPT_SSL_CTX_DATA || \ + (option) == CURLOPT_WRITEDATA || \ + (option) == CURLOPT_RESOLVER_START_DATA || \ + (option) == CURLOPT_TRAILERDATA || \ + (option) == CURLOPT_SSH_HOSTKEYDATA || \ + 0) + +/* evaluates to true if option takes a POST data argument (void* or char*) */ +#define curlcheck_postfields_option(option) \ + ((option) == CURLOPT_POSTFIELDS || \ + (option) == CURLOPT_COPYPOSTFIELDS || \ + 0) + +/* evaluates to true if option takes a struct curl_slist * argument */ +#define curlcheck_slist_option(option) \ + ((option) == CURLOPT_HTTP200ALIASES || \ + (option) == CURLOPT_HTTPHEADER || \ + (option) == CURLOPT_MAIL_RCPT || \ + (option) == CURLOPT_POSTQUOTE || \ + (option) == CURLOPT_PREQUOTE || \ + (option) == CURLOPT_PROXYHEADER || \ + (option) == CURLOPT_QUOTE || \ + (option) == CURLOPT_RESOLVE || \ + (option) == CURLOPT_TELNETOPTIONS || \ + (option) == CURLOPT_CONNECT_TO || \ + 0) + +/* groups of curl_easy_getinfo infos that take the same type of argument */ + +/* evaluates to true if info expects a pointer to char * argument */ +#define curlcheck_string_info(info) \ + (CURLINFO_STRING < (info) && (info) < CURLINFO_LONG && \ + (info) != CURLINFO_PRIVATE) + +/* evaluates to true if info expects a pointer to long argument */ +#define curlcheck_long_info(info) \ + (CURLINFO_LONG < (info) && (info) < CURLINFO_DOUBLE) + +/* evaluates to true if info expects a pointer to double argument */ +#define curlcheck_double_info(info) \ + (CURLINFO_DOUBLE < (info) && (info) < CURLINFO_SLIST) + +/* true if info expects a pointer to struct curl_slist * argument */ +#define curlcheck_slist_info(info) \ + (((info) == CURLINFO_SSL_ENGINES) || ((info) == CURLINFO_COOKIELIST)) + +/* true if info expects a pointer to struct curl_tlssessioninfo * argument */ +#define curlcheck_tlssessioninfo_info(info) \ + (((info) == CURLINFO_TLS_SSL_PTR) || ((info) == CURLINFO_TLS_SESSION)) + +/* true if info expects a pointer to struct curl_certinfo * argument */ +#define curlcheck_certinfo_info(info) ((info) == CURLINFO_CERTINFO) + +/* true if info expects a pointer to struct curl_socket_t argument */ +#define curlcheck_socket_info(info) \ + (CURLINFO_SOCKET < (info) && (info) < CURLINFO_OFF_T) + +/* true if info expects a pointer to curl_off_t argument */ +#define curlcheck_off_t_info(info) \ + (CURLINFO_OFF_T < (info)) + + +/* typecheck helpers -- check whether given expression has requested type */ + +/* For pointers, you can use the curlcheck_ptr/curlcheck_arr macros, + * otherwise define a new macro. Search for __builtin_types_compatible_p + * in the GCC manual. + * NOTE: these macros MUST NOT EVALUATE their arguments! The argument is + * the actual expression passed to the curl_easy_setopt macro. This + * means that you can only apply the sizeof and __typeof__ operators, no + * == or whatsoever. + */ + +/* XXX: should evaluate to true if expr is a pointer */ +#define curlcheck_any_ptr(expr) \ + (sizeof(expr) == sizeof(void *)) + +/* evaluates to true if expr is NULL */ +/* XXX: must not evaluate expr, so this check is not accurate */ +#define curlcheck_NULL(expr) \ + (__builtin_types_compatible_p(__typeof__(expr), __typeof__(NULL))) + +/* evaluates to true if expr is type*, const type* or NULL */ +#define curlcheck_ptr(expr, type) \ + (curlcheck_NULL(expr) || \ + __builtin_types_compatible_p(__typeof__(expr), type *) || \ + __builtin_types_compatible_p(__typeof__(expr), const type *)) + +/* evaluates to true if expr is one of type[], type*, NULL or const type* */ +#define curlcheck_arr(expr, type) \ + (curlcheck_ptr((expr), type) || \ + __builtin_types_compatible_p(__typeof__(expr), type [])) + +/* evaluates to true if expr is a string */ +#define curlcheck_string(expr) \ + (curlcheck_arr((expr), char) || \ + curlcheck_arr((expr), signed char) || \ + curlcheck_arr((expr), unsigned char)) + +/* evaluates to true if expr is a CURL * */ +#define curlcheck_curl(expr) \ + (curlcheck_NULL(expr) || \ + __builtin_types_compatible_p(__typeof__(expr), CURL *)) + + +/* evaluates to true if expr is a long (no matter the signedness) + * XXX: for now, int is also accepted (and therefore short and char, which + * are promoted to int when passed to a variadic function) */ +#define curlcheck_long(expr) \ + ( \ + ((sizeof(long) != sizeof(int)) && \ + (__builtin_types_compatible_p(__typeof__(expr), long) || \ + __builtin_types_compatible_p(__typeof__(expr), signed long) || \ + __builtin_types_compatible_p(__typeof__(expr), unsigned long))) \ + || \ + ((sizeof(long) == sizeof(int)) && \ + (__builtin_types_compatible_p(__typeof__(expr), long) || \ + __builtin_types_compatible_p(__typeof__(expr), signed long) || \ + __builtin_types_compatible_p(__typeof__(expr), unsigned long) || \ + __builtin_types_compatible_p(__typeof__(expr), int) || \ + __builtin_types_compatible_p(__typeof__(expr), signed int) || \ + __builtin_types_compatible_p(__typeof__(expr), unsigned int) || \ + __builtin_types_compatible_p(__typeof__(expr), short) || \ + __builtin_types_compatible_p(__typeof__(expr), signed short) || \ + __builtin_types_compatible_p(__typeof__(expr), unsigned short) || \ + __builtin_types_compatible_p(__typeof__(expr), char) || \ + __builtin_types_compatible_p(__typeof__(expr), signed char) || \ + __builtin_types_compatible_p(__typeof__(expr), unsigned char))) \ + ) + +/* evaluates to true if expr is of type curl_off_t */ +#define curlcheck_off_t(expr) \ + (__builtin_types_compatible_p(__typeof__(expr), curl_off_t)) + +/* evaluates to true if expr is abuffer suitable for CURLOPT_ERRORBUFFER */ +/* XXX: also check size of an char[] array? */ +#define curlcheck_error_buffer(expr) \ + (curlcheck_NULL(expr) || \ + __builtin_types_compatible_p(__typeof__(expr), char *) || \ + __builtin_types_compatible_p(__typeof__(expr), char[])) + +/* evaluates to true if expr is of type (const) void* or (const) FILE* */ +#if 0 +#define curlcheck_cb_data(expr) \ + (curlcheck_ptr((expr), void) || \ + curlcheck_ptr((expr), FILE)) +#else /* be less strict */ +#define curlcheck_cb_data(expr) \ + curlcheck_any_ptr(expr) +#endif + +/* evaluates to true if expr is of type FILE* */ +#define curlcheck_FILE(expr) \ + (curlcheck_NULL(expr) || \ + (__builtin_types_compatible_p(__typeof__(expr), FILE *))) + +/* evaluates to true if expr can be passed as POST data (void* or char*) */ +#define curlcheck_postfields(expr) \ + (curlcheck_ptr((expr), void) || \ + curlcheck_arr((expr), char) || \ + curlcheck_arr((expr), unsigned char)) + +/* helper: __builtin_types_compatible_p distinguishes between functions and + * function pointers, hide it */ +#define curlcheck_cb_compatible(func, type) \ + (__builtin_types_compatible_p(__typeof__(func), type) || \ + __builtin_types_compatible_p(__typeof__(func) *, type)) + +/* evaluates to true if expr is of type curl_resolver_start_callback */ +#define curlcheck_resolver_start_callback(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_resolver_start_callback)) + +/* evaluates to true if expr is of type curl_read_callback or "similar" */ +#define curlcheck_read_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), __typeof__(fread) *) || \ + curlcheck_cb_compatible((expr), curl_read_callback) || \ + curlcheck_cb_compatible((expr), _curl_read_callback1) || \ + curlcheck_cb_compatible((expr), _curl_read_callback2) || \ + curlcheck_cb_compatible((expr), _curl_read_callback3) || \ + curlcheck_cb_compatible((expr), _curl_read_callback4) || \ + curlcheck_cb_compatible((expr), _curl_read_callback5) || \ + curlcheck_cb_compatible((expr), _curl_read_callback6)) +typedef size_t (*_curl_read_callback1)(char *, size_t, size_t, void *); +typedef size_t (*_curl_read_callback2)(char *, size_t, size_t, const void *); +typedef size_t (*_curl_read_callback3)(char *, size_t, size_t, FILE *); +typedef size_t (*_curl_read_callback4)(void *, size_t, size_t, void *); +typedef size_t (*_curl_read_callback5)(void *, size_t, size_t, const void *); +typedef size_t (*_curl_read_callback6)(void *, size_t, size_t, FILE *); + +/* evaluates to true if expr is of type curl_write_callback or "similar" */ +#define curlcheck_write_cb(expr) \ + (curlcheck_read_cb(expr) || \ + curlcheck_cb_compatible((expr), __typeof__(fwrite) *) || \ + curlcheck_cb_compatible((expr), curl_write_callback) || \ + curlcheck_cb_compatible((expr), _curl_write_callback1) || \ + curlcheck_cb_compatible((expr), _curl_write_callback2) || \ + curlcheck_cb_compatible((expr), _curl_write_callback3) || \ + curlcheck_cb_compatible((expr), _curl_write_callback4) || \ + curlcheck_cb_compatible((expr), _curl_write_callback5) || \ + curlcheck_cb_compatible((expr), _curl_write_callback6)) +typedef size_t (*_curl_write_callback1)(const char *, size_t, size_t, void *); +typedef size_t (*_curl_write_callback2)(const char *, size_t, size_t, + const void *); +typedef size_t (*_curl_write_callback3)(const char *, size_t, size_t, FILE *); +typedef size_t (*_curl_write_callback4)(const void *, size_t, size_t, void *); +typedef size_t (*_curl_write_callback5)(const void *, size_t, size_t, + const void *); +typedef size_t (*_curl_write_callback6)(const void *, size_t, size_t, FILE *); + +/* evaluates to true if expr is of type curl_ioctl_callback or "similar" */ +#define curlcheck_ioctl_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_ioctl_callback) || \ + curlcheck_cb_compatible((expr), _curl_ioctl_callback1) || \ + curlcheck_cb_compatible((expr), _curl_ioctl_callback2) || \ + curlcheck_cb_compatible((expr), _curl_ioctl_callback3) || \ + curlcheck_cb_compatible((expr), _curl_ioctl_callback4)) +typedef curlioerr (*_curl_ioctl_callback1)(CURL *, int, void *); +typedef curlioerr (*_curl_ioctl_callback2)(CURL *, int, const void *); +typedef curlioerr (*_curl_ioctl_callback3)(CURL *, curliocmd, void *); +typedef curlioerr (*_curl_ioctl_callback4)(CURL *, curliocmd, const void *); + +/* evaluates to true if expr is of type curl_sockopt_callback or "similar" */ +#define curlcheck_sockopt_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_sockopt_callback) || \ + curlcheck_cb_compatible((expr), _curl_sockopt_callback1) || \ + curlcheck_cb_compatible((expr), _curl_sockopt_callback2)) +typedef int (*_curl_sockopt_callback1)(void *, curl_socket_t, curlsocktype); +typedef int (*_curl_sockopt_callback2)(const void *, curl_socket_t, + curlsocktype); + +/* evaluates to true if expr is of type curl_opensocket_callback or + "similar" */ +#define curlcheck_opensocket_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_opensocket_callback) || \ + curlcheck_cb_compatible((expr), _curl_opensocket_callback1) || \ + curlcheck_cb_compatible((expr), _curl_opensocket_callback2) || \ + curlcheck_cb_compatible((expr), _curl_opensocket_callback3) || \ + curlcheck_cb_compatible((expr), _curl_opensocket_callback4)) +typedef curl_socket_t (*_curl_opensocket_callback1) + (void *, curlsocktype, struct curl_sockaddr *); +typedef curl_socket_t (*_curl_opensocket_callback2) + (void *, curlsocktype, const struct curl_sockaddr *); +typedef curl_socket_t (*_curl_opensocket_callback3) + (const void *, curlsocktype, struct curl_sockaddr *); +typedef curl_socket_t (*_curl_opensocket_callback4) + (const void *, curlsocktype, const struct curl_sockaddr *); + +/* evaluates to true if expr is of type curl_progress_callback or "similar" */ +#define curlcheck_progress_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_progress_callback) || \ + curlcheck_cb_compatible((expr), _curl_progress_callback1) || \ + curlcheck_cb_compatible((expr), _curl_progress_callback2)) +typedef int (*_curl_progress_callback1)(void *, + double, double, double, double); +typedef int (*_curl_progress_callback2)(const void *, + double, double, double, double); + +/* evaluates to true if expr is of type curl_xferinfo_callback */ +#define curlcheck_xferinfo_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_xferinfo_callback)) + +/* evaluates to true if expr is of type curl_debug_callback or "similar" */ +#define curlcheck_debug_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_debug_callback) || \ + curlcheck_cb_compatible((expr), _curl_debug_callback1) || \ + curlcheck_cb_compatible((expr), _curl_debug_callback2) || \ + curlcheck_cb_compatible((expr), _curl_debug_callback3) || \ + curlcheck_cb_compatible((expr), _curl_debug_callback4) || \ + curlcheck_cb_compatible((expr), _curl_debug_callback5) || \ + curlcheck_cb_compatible((expr), _curl_debug_callback6) || \ + curlcheck_cb_compatible((expr), _curl_debug_callback7) || \ + curlcheck_cb_compatible((expr), _curl_debug_callback8)) +typedef int (*_curl_debug_callback1) (CURL *, + curl_infotype, char *, size_t, void *); +typedef int (*_curl_debug_callback2) (CURL *, + curl_infotype, char *, size_t, const void *); +typedef int (*_curl_debug_callback3) (CURL *, + curl_infotype, const char *, size_t, void *); +typedef int (*_curl_debug_callback4) (CURL *, + curl_infotype, const char *, size_t, const void *); +typedef int (*_curl_debug_callback5) (CURL *, + curl_infotype, unsigned char *, size_t, void *); +typedef int (*_curl_debug_callback6) (CURL *, + curl_infotype, unsigned char *, size_t, const void *); +typedef int (*_curl_debug_callback7) (CURL *, + curl_infotype, const unsigned char *, size_t, void *); +typedef int (*_curl_debug_callback8) (CURL *, + curl_infotype, const unsigned char *, size_t, const void *); + +/* evaluates to true if expr is of type curl_ssl_ctx_callback or "similar" */ +/* this is getting even messier... */ +#define curlcheck_ssl_ctx_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_ssl_ctx_callback) || \ + curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback1) || \ + curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback2) || \ + curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback3) || \ + curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback4) || \ + curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback5) || \ + curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback6) || \ + curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback7) || \ + curlcheck_cb_compatible((expr), _curl_ssl_ctx_callback8)) +typedef CURLcode (*_curl_ssl_ctx_callback1)(CURL *, void *, void *); +typedef CURLcode (*_curl_ssl_ctx_callback2)(CURL *, void *, const void *); +typedef CURLcode (*_curl_ssl_ctx_callback3)(CURL *, const void *, void *); +typedef CURLcode (*_curl_ssl_ctx_callback4)(CURL *, const void *, + const void *); +#ifdef HEADER_SSL_H +/* hack: if we included OpenSSL's ssl.h, we know about SSL_CTX + * this will of course break if we are included before OpenSSL headers... + */ +typedef CURLcode (*_curl_ssl_ctx_callback5)(CURL *, SSL_CTX *, void *); +typedef CURLcode (*_curl_ssl_ctx_callback6)(CURL *, SSL_CTX *, const void *); +typedef CURLcode (*_curl_ssl_ctx_callback7)(CURL *, const SSL_CTX *, void *); +typedef CURLcode (*_curl_ssl_ctx_callback8)(CURL *, const SSL_CTX *, + const void *); +#else +typedef _curl_ssl_ctx_callback1 _curl_ssl_ctx_callback5; +typedef _curl_ssl_ctx_callback1 _curl_ssl_ctx_callback6; +typedef _curl_ssl_ctx_callback1 _curl_ssl_ctx_callback7; +typedef _curl_ssl_ctx_callback1 _curl_ssl_ctx_callback8; +#endif + +/* evaluates to true if expr is of type curl_conv_callback or "similar" */ +#define curlcheck_conv_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_conv_callback) || \ + curlcheck_cb_compatible((expr), _curl_conv_callback1) || \ + curlcheck_cb_compatible((expr), _curl_conv_callback2) || \ + curlcheck_cb_compatible((expr), _curl_conv_callback3) || \ + curlcheck_cb_compatible((expr), _curl_conv_callback4)) +typedef CURLcode (*_curl_conv_callback1)(char *, size_t length); +typedef CURLcode (*_curl_conv_callback2)(const char *, size_t length); +typedef CURLcode (*_curl_conv_callback3)(void *, size_t length); +typedef CURLcode (*_curl_conv_callback4)(const void *, size_t length); + +/* evaluates to true if expr is of type curl_seek_callback or "similar" */ +#define curlcheck_seek_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_seek_callback) || \ + curlcheck_cb_compatible((expr), _curl_seek_callback1) || \ + curlcheck_cb_compatible((expr), _curl_seek_callback2)) +typedef CURLcode (*_curl_seek_callback1)(void *, curl_off_t, int); +typedef CURLcode (*_curl_seek_callback2)(const void *, curl_off_t, int); + +/* evaluates to true if expr is of type curl_chunk_bgn_callback */ +#define curlcheck_chunk_bgn_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_chunk_bgn_callback) || \ + curlcheck_cb_compatible((expr), _curl_chunk_bgn_callback1) || \ + curlcheck_cb_compatible((expr), _curl_chunk_bgn_callback2)) +typedef long (*_curl_chunk_bgn_callback1)(struct curl_fileinfo *, + void *, int); +typedef long (*_curl_chunk_bgn_callback2)(void *, void *, int); + +/* evaluates to true if expr is of type curl_chunk_end_callback */ +#define curlcheck_chunk_end_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_chunk_end_callback)) + +/* evaluates to true if expr is of type curl_closesocket_callback */ +#define curlcheck_close_socket_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_closesocket_callback)) + +/* evaluates to true if expr is of type curl_fnmatch_callback */ +#define curlcheck_fnmatch_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_fnmatch_callback)) + +/* evaluates to true if expr is of type curl_hstsread_callback */ +#define curlcheck_hstsread_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_hstsread_callback)) + +/* evaluates to true if expr is of type curl_hstswrite_callback */ +#define curlcheck_hstswrite_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_hstswrite_callback)) + +/* evaluates to true if expr is of type curl_sshhostkeycallback */ +#define curlcheck_ssh_hostkey_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_sshhostkeycallback)) + +/* evaluates to true if expr is of type curl_sshkeycallback */ +#define curlcheck_ssh_key_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_sshkeycallback)) + +/* evaluates to true if expr is of type curl_interleave_callback */ +#define curlcheck_interleave_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), _curl_interleave_callback1) || \ + curlcheck_cb_compatible((expr), _curl_interleave_callback2)) +typedef size_t (*_curl_interleave_callback1)(void *p, size_t s, + size_t n, void *u); +typedef size_t (*_curl_interleave_callback2)(char *p, size_t s, + size_t n, void *u); + +/* evaluates to true if expr is of type curl_prereq_callback */ +#define curlcheck_prereq_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_prereq_callback)) + +/* evaluates to true if expr is of type curl_trailer_callback */ +#define curlcheck_trailer_cb(expr) \ + (curlcheck_NULL(expr) || \ + curlcheck_cb_compatible((expr), curl_trailer_callback)) + +#endif /* CURLINC_TYPECHECK_GCC_H */ diff --git a/curl/include/curl/urlapi.h b/curl/include/curl/urlapi.h new file mode 100644 index 0000000..b4a6e5d --- /dev/null +++ b/curl/include/curl/urlapi.h @@ -0,0 +1,155 @@ +#ifndef CURLINC_URLAPI_H +#define CURLINC_URLAPI_H +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +#include "curl.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/* the error codes for the URL API */ +typedef enum { + CURLUE_OK, + CURLUE_BAD_HANDLE, /* 1 */ + CURLUE_BAD_PARTPOINTER, /* 2 */ + CURLUE_MALFORMED_INPUT, /* 3 */ + CURLUE_BAD_PORT_NUMBER, /* 4 */ + CURLUE_UNSUPPORTED_SCHEME, /* 5 */ + CURLUE_URLDECODE, /* 6 */ + CURLUE_OUT_OF_MEMORY, /* 7 */ + CURLUE_USER_NOT_ALLOWED, /* 8 */ + CURLUE_UNKNOWN_PART, /* 9 */ + CURLUE_NO_SCHEME, /* 10 */ + CURLUE_NO_USER, /* 11 */ + CURLUE_NO_PASSWORD, /* 12 */ + CURLUE_NO_OPTIONS, /* 13 */ + CURLUE_NO_HOST, /* 14 */ + CURLUE_NO_PORT, /* 15 */ + CURLUE_NO_QUERY, /* 16 */ + CURLUE_NO_FRAGMENT, /* 17 */ + CURLUE_NO_ZONEID, /* 18 */ + CURLUE_BAD_FILE_URL, /* 19 */ + CURLUE_BAD_FRAGMENT, /* 20 */ + CURLUE_BAD_HOSTNAME, /* 21 */ + CURLUE_BAD_IPV6, /* 22 */ + CURLUE_BAD_LOGIN, /* 23 */ + CURLUE_BAD_PASSWORD, /* 24 */ + CURLUE_BAD_PATH, /* 25 */ + CURLUE_BAD_QUERY, /* 26 */ + CURLUE_BAD_SCHEME, /* 27 */ + CURLUE_BAD_SLASHES, /* 28 */ + CURLUE_BAD_USER, /* 29 */ + CURLUE_LACKS_IDN, /* 30 */ + CURLUE_TOO_LARGE, /* 31 */ + CURLUE_LAST +} CURLUcode; + +typedef enum { + CURLUPART_URL, + CURLUPART_SCHEME, + CURLUPART_USER, + CURLUPART_PASSWORD, + CURLUPART_OPTIONS, + CURLUPART_HOST, + CURLUPART_PORT, + CURLUPART_PATH, + CURLUPART_QUERY, + CURLUPART_FRAGMENT, + CURLUPART_ZONEID /* added in 7.65.0 */ +} CURLUPart; + +#define CURLU_DEFAULT_PORT (1<<0) /* return default port number */ +#define CURLU_NO_DEFAULT_PORT (1<<1) /* act as if no port number was set, + if the port number matches the + default for the scheme */ +#define CURLU_DEFAULT_SCHEME (1<<2) /* return default scheme if + missing */ +#define CURLU_NON_SUPPORT_SCHEME (1<<3) /* allow non-supported scheme */ +#define CURLU_PATH_AS_IS (1<<4) /* leave dot sequences */ +#define CURLU_DISALLOW_USER (1<<5) /* no user+password allowed */ +#define CURLU_URLDECODE (1<<6) /* URL decode on get */ +#define CURLU_URLENCODE (1<<7) /* URL encode on set */ +#define CURLU_APPENDQUERY (1<<8) /* append a form style part */ +#define CURLU_GUESS_SCHEME (1<<9) /* legacy curl-style guessing */ +#define CURLU_NO_AUTHORITY (1<<10) /* Allow empty authority when the + scheme is unknown. */ +#define CURLU_ALLOW_SPACE (1<<11) /* Allow spaces in the URL */ +#define CURLU_PUNYCODE (1<<12) /* get the hostname in punycode */ +#define CURLU_PUNY2IDN (1<<13) /* punycode => IDN conversion */ +#define CURLU_GET_EMPTY (1<<14) /* allow empty queries and fragments + when extracting the URL or the + components */ +#define CURLU_NO_GUESS_SCHEME (1<<15) /* for get, do not accept a guess */ + +typedef struct Curl_URL CURLU; + +/* + * curl_url() creates a new CURLU handle and returns a pointer to it. + * Must be freed with curl_url_cleanup(). + */ +CURL_EXTERN CURLU *curl_url(void); + +/* + * curl_url_cleanup() frees the CURLU handle and related resources used for + * the URL parsing. It will not free strings previously returned with the URL + * API. + */ +CURL_EXTERN void curl_url_cleanup(CURLU *handle); + +/* + * curl_url_dup() duplicates a CURLU handle and returns a new copy. The new + * handle must also be freed with curl_url_cleanup(). + */ +CURL_EXTERN CURLU *curl_url_dup(const CURLU *in); + +/* + * curl_url_get() extracts a specific part of the URL from a CURLU + * handle. Returns error code. The returned pointer MUST be freed with + * curl_free() afterwards. + */ +CURL_EXTERN CURLUcode curl_url_get(const CURLU *handle, CURLUPart what, + char **part, unsigned int flags); + +/* + * curl_url_set() sets a specific part of the URL in a CURLU handle. Returns + * error code. The passed in string will be copied. Passing a NULL instead of + * a part string, clears that part. + */ +CURL_EXTERN CURLUcode curl_url_set(CURLU *handle, CURLUPart what, + const char *part, unsigned int flags); + +/* + * curl_url_strerror() turns a CURLUcode value into the equivalent human + * readable error string. This is useful for printing meaningful error + * messages. + */ +CURL_EXTERN const char *curl_url_strerror(CURLUcode); + +#ifdef __cplusplus +} /* end of extern "C" */ +#endif + +#endif /* CURLINC_URLAPI_H */ diff --git a/curl/include/curl/websockets.h b/curl/include/curl/websockets.h new file mode 100644 index 0000000..afb86b4 --- /dev/null +++ b/curl/include/curl/websockets.h @@ -0,0 +1,85 @@ +#ifndef CURLINC_WEBSOCKETS_H +#define CURLINC_WEBSOCKETS_H +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ + +#ifdef __cplusplus +extern "C" { +#endif + +struct curl_ws_frame { + int age; /* zero */ + int flags; /* See the CURLWS_* defines */ + curl_off_t offset; /* the offset of this data into the frame */ + curl_off_t bytesleft; /* number of pending bytes left of the payload */ + size_t len; /* size of the current data chunk */ +}; + +/* flag bits */ +#define CURLWS_TEXT (1<<0) +#define CURLWS_BINARY (1<<1) +#define CURLWS_CONT (1<<2) +#define CURLWS_CLOSE (1<<3) +#define CURLWS_PING (1<<4) +#define CURLWS_OFFSET (1<<5) + +/* + * NAME curl_ws_recv() + * + * DESCRIPTION + * + * Receives data from the websocket connection. Use after successful + * curl_easy_perform() with CURLOPT_CONNECT_ONLY option. + */ +CURL_EXTERN CURLcode curl_ws_recv(CURL *curl, void *buffer, size_t buflen, + size_t *recv, + const struct curl_ws_frame **metap); + +/* flags for curl_ws_send() */ +#define CURLWS_PONG (1<<6) + +/* + * NAME curl_ws_send() + * + * DESCRIPTION + * + * Sends data over the websocket connection. Use after successful + * curl_easy_perform() with CURLOPT_CONNECT_ONLY option. + */ +CURL_EXTERN CURLcode curl_ws_send(CURL *curl, const void *buffer, + size_t buflen, size_t *sent, + curl_off_t fragsize, + unsigned int flags); + +/* bits for the CURLOPT_WS_OPTIONS bitmask: */ +#define CURLWS_RAW_MODE (1<<0) +#define CURLWS_NOAUTOPONG (1<<1) + +CURL_EXTERN const struct curl_ws_frame *curl_ws_meta(CURL *curl); + +#ifdef __cplusplus +} +#endif + +#endif /* CURLINC_WEBSOCKETS_H */ diff --git a/curl/include/libpsl.h b/curl/include/libpsl.h new file mode 100644 index 0000000..d7946e5 --- /dev/null +++ b/curl/include/libpsl.h @@ -0,0 +1,210 @@ +/* + * Copyright(c) 2014-2024 Tim Ruehsen + * + * Permission is hereby granted, free of charge, to any person obtaining a + * copy of this software and associated documentation files (the "Software"), + * to deal in the Software without restriction, including without limitation + * the rights to use, copy, modify, merge, publish, distribute, sublicense, + * and/or sell copies of the Software, and to permit persons to whom the + * Software is furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in + * all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + * DEALINGS IN THE SOFTWARE. + * + * This file is part of libpsl. + * + * Header file for libpsl library routines + * + * Changelog + * 20.03.2014 Tim Ruehsen created + * + */ + +#ifndef LIBPSL_LIBPSL_H +#define LIBPSL_LIBPSL_H + +#include +#include + +#define PSL_VERSION "0.21.5" +#define PSL_VERSION_MAJOR 0 +#define PSL_VERSION_MINOR 21 +#define PSL_VERSION_PATCH 5 +#define PSL_VERSION_NUMBER 0x001505 + +/* support clang's __has_declspec_attribute attribute */ +#ifndef __has_declspec_attribute +# define __has_declspec_attribute(x) 0 +#endif + +#ifndef PSL_API +#if defined BUILDING_PSL && HAVE_VISIBILITY +# define PSL_API __attribute__ ((__visibility__("default"))) +#elif defined BUILDING_PSL && (defined _MSC_VER || __has_declspec_attribute(dllexport)) && !defined PSL_STATIC +# define PSL_API __declspec(dllexport) +#elif (defined _MSC_VER || __has_declspec_attribute(dllimport)) && !defined PSL_STATIC +# define PSL_API __declspec(dllimport) +#else +# define PSL_API +#endif +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/* types for psl_is_public_suffix2() */ +#define PSL_TYPE_ICANN (1<<0) +#define PSL_TYPE_PRIVATE (1<<1) +#define PSL_TYPE_NO_STAR_RULE (1<<2) +#define PSL_TYPE_ANY (PSL_TYPE_ICANN | PSL_TYPE_PRIVATE) + +/** + * psl_error_t: + * @PSL_SUCCESS: Successful return. + * @PSL_ERR_INVALID_ARG: Invalid argument. + * @PSL_ERR_CONVERTER: Failed to open libicu utf-16 converter. + * @PSL_ERR_TO_UTF16: Failed to convert to utf-16. + * @PSL_ERR_TO_LOWER: Failed to convert utf-16 to lowercase. + * @PSL_ERR_TO_UTF8: Failed to convert utf-16 to utf-8. + * @PSL_ERR_NO_MEM: Failed to allocate memory. + * + * Return codes for PSL functions. + * Negative return codes mean failure. + * Positive values are reserved for non-error return codes. + */ +typedef enum { + PSL_SUCCESS = 0, + PSL_ERR_INVALID_ARG = -1, + PSL_ERR_CONVERTER = -2, /* failed to open libicu utf-16 converter */ + PSL_ERR_TO_UTF16 = -3, /* failed to convert to utf-16 */ + PSL_ERR_TO_LOWER = -4, /* failed to convert utf-16 to lowercase */ + PSL_ERR_TO_UTF8 = -5, /* failed to convert utf-16 to utf-8 */ + PSL_ERR_NO_MEM = -6 /* failed to allocate memory */ +} psl_error_t; + +typedef struct psl_ctx_st psl_ctx_t; + +/* frees PSL context */ +PSL_API +void + psl_free(psl_ctx_t *psl); + +/* frees memory allocated by libpsl routines */ +PSL_API +void + psl_free_string(char *str); + +/* loads PSL data from file */ +PSL_API +psl_ctx_t * + psl_load_file(const char *fname); + +/* loads PSL data from FILE pointer */ +PSL_API +psl_ctx_t * + psl_load_fp(FILE *fp); + +/* retrieves builtin PSL data */ +PSL_API +const psl_ctx_t * + psl_builtin(void); + +/* retrieves most recent PSL data */ +PSL_API +psl_ctx_t * + psl_latest(const char *fname); + +/* checks whether domain is a public suffix or not */ +PSL_API +int + psl_is_public_suffix(const psl_ctx_t *psl, const char *domain); + +/* checks whether domain is a public suffix regarding the type or not */ +PSL_API +int + psl_is_public_suffix2(const psl_ctx_t *psl, const char *domain, int type); + +/* checks whether cookie_domain is acceptable for domain or not */ +PSL_API +int + psl_is_cookie_domain_acceptable(const psl_ctx_t *psl, const char *hostname, const char *cookie_domain); + +/* returns the longest not registrable domain within 'domain' or NULL if none found */ +PSL_API +const char * + psl_unregistrable_domain(const psl_ctx_t *psl, const char *domain); + +/* returns the shortest possible registrable domain part or NULL if domain is not registrable at all */ +PSL_API +const char * + psl_registrable_domain(const psl_ctx_t *psl, const char *domain); + +/* convert a string into lowercase UTF-8 */ +PSL_API +psl_error_t + psl_str_to_utf8lower(const char *str, const char *encoding, const char *locale, char **lower); + +/* does not include exceptions */ +PSL_API +int + psl_suffix_count(const psl_ctx_t *psl); + +/* just counts exceptions */ +PSL_API +int + psl_suffix_exception_count(const psl_ctx_t *psl); + +/* just counts wildcards */ +PSL_API +int + psl_suffix_wildcard_count(const psl_ctx_t *psl); + +/* returns mtime of PSL source file */ +PSL_API +time_t + psl_builtin_file_time(void); + +/* returns SHA1 checksum (hex-encoded, lowercase) of PSL source file */ +PSL_API +const char * + psl_builtin_sha1sum(void); + +/* returns file name of PSL source file */ +PSL_API +const char * + psl_builtin_filename(void); + +/* returns name of distribution PSL data file */ +PSL_API +const char * + psl_dist_filename(void); + +/* returns library version string */ +PSL_API +const char * + psl_get_version(void); + +/* checks library version number */ +PSL_API +int + psl_check_version_number(int version); + +/* returns whether the built-in data is outdated or not */ +PSL_API +int + psl_builtin_outdated(void); + +#ifdef __cplusplus +} +#endif + +#endif /* LIBPSL_LIBPSL_H */ diff --git a/curl/include/libssh2.h b/curl/include/libssh2.h new file mode 100644 index 0000000..f47858a --- /dev/null +++ b/curl/include/libssh2.h @@ -0,0 +1,1516 @@ +/* Copyright (C) Sara Golemon + * Copyright (C) Daniel Stenberg + * Copyright (C) Simon Josefsson + * All rights reserved. + * + * Redistribution and use in source and binary forms, + * with or without modification, are permitted provided + * that the following conditions are met: + * + * Redistributions of source code must retain the above + * copyright notice, this list of conditions and the + * following disclaimer. + * + * Redistributions in binary form must reproduce the above + * copyright notice, this list of conditions and the following + * disclaimer in the documentation and/or other materials + * provided with the distribution. + * + * Neither the name of the copyright holder nor the names + * of any other contributors may be used to endorse or + * promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND + * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY + * OF SUCH DAMAGE. + * + * SPDX-License-Identifier: BSD-3-Clause + */ + +#ifndef LIBSSH2_H +#define LIBSSH2_H 1 + +#define LIBSSH2_COPYRIGHT "The libssh2 project and its contributors." + +/* We use underscore instead of dash when appending DEV in dev versions just + to make the BANNER define (used by src/session.c) be a valid SSH + banner. Release versions have no appended strings and may of course not + have dashes either. */ +#define LIBSSH2_VERSION "1.11.1" + +/* The numeric version number is also available "in parts" by using these + defines: */ +#define LIBSSH2_VERSION_MAJOR 1 +#define LIBSSH2_VERSION_MINOR 11 +#define LIBSSH2_VERSION_PATCH 1 + +/* This is the numeric version of the libssh2 version number, meant for easier + parsing and comparisons by programs. The LIBSSH2_VERSION_NUM define will + always follow this syntax: + + 0xXXYYZZ + + Where XX, YY and ZZ are the main version, release and patch numbers in + hexadecimal (using 8 bits each). All three numbers are always represented + using two digits. 1.2 would appear as "0x010200" while version 9.11.7 + appears as "0x090b07". + + This 6-digit (24 bits) hexadecimal number does not show pre-release number, + and it is always a greater number in a more recent release. It makes + comparisons with greater than and less than work. +*/ +#define LIBSSH2_VERSION_NUM 0x010b01 + +/* + * This is the date and time when the full source package was created. The + * timestamp is not stored in the source code repo, as the timestamp is + * properly set in the tarballs by the maketgz script. + * + * The format of the date should follow this template: + * + * "Mon Feb 12 11:35:33 UTC 2007" + */ +#define LIBSSH2_TIMESTAMP "Wed Oct 16 08:03:21 UTC 2024" + +#ifndef RC_INVOKED + +#ifdef __cplusplus +extern "C" { +#endif + +#ifdef _WIN32 +# include +# include +#endif + +#include +#include +#include +#include + +/* Allow alternate API prefix from CFLAGS or calling app */ +#ifndef LIBSSH2_API +# ifdef _WIN32 +# if defined(LIBSSH2_EXPORTS) || defined(_WINDLL) +# ifdef LIBSSH2_LIBRARY +# define LIBSSH2_API __declspec(dllexport) +# else +# define LIBSSH2_API __declspec(dllimport) +# endif /* LIBSSH2_LIBRARY */ +# else +# define LIBSSH2_API +# endif +# else /* !_WIN32 */ +# define LIBSSH2_API +# endif /* _WIN32 */ +#endif /* LIBSSH2_API */ + +#ifdef HAVE_SYS_UIO_H +# include +#endif + +#ifdef _MSC_VER +typedef unsigned char uint8_t; +typedef unsigned short int uint16_t; +typedef unsigned int uint32_t; +typedef __int32 int32_t; +typedef __int64 int64_t; +typedef unsigned __int64 uint64_t; +typedef unsigned __int64 libssh2_uint64_t; +typedef __int64 libssh2_int64_t; +#if (!defined(HAVE_SSIZE_T) && !defined(ssize_t)) +typedef SSIZE_T ssize_t; +#define HAVE_SSIZE_T +#endif +#else +#include +typedef unsigned long long libssh2_uint64_t; +typedef long long libssh2_int64_t; +#endif + +#ifdef _WIN32 +typedef SOCKET libssh2_socket_t; +#define LIBSSH2_INVALID_SOCKET INVALID_SOCKET +#define LIBSSH2_SOCKET_CLOSE(s) closesocket(s) +#else /* !_WIN32 */ +typedef int libssh2_socket_t; +#define LIBSSH2_INVALID_SOCKET -1 +#define LIBSSH2_SOCKET_CLOSE(s) close(s) +#endif /* _WIN32 */ + +/* Compile-time deprecation macros */ +#if !defined(LIBSSH2_DISABLE_DEPRECATION) && !defined(LIBSSH2_LIBRARY) +# if defined(_MSC_VER) +# if _MSC_VER >= 1400 +# define LIBSSH2_DEPRECATED(version, message) \ + __declspec(deprecated("since libssh2 " # version ". " message)) +# elif _MSC_VER >= 1310 +# define LIBSSH2_DEPRECATED(version, message) \ + __declspec(deprecated) +# endif +# elif defined(__GNUC__) && !defined(__INTEL_COMPILER) +# if (defined(__clang__) && __clang_major__ >= 3) || \ + (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 5)) +# define LIBSSH2_DEPRECATED(version, message) \ + __attribute__((deprecated("since libssh2 " # version ". " message))) +# elif __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0) +# define LIBSSH2_DEPRECATED(version, message) \ + __attribute__((deprecated)) +# endif +# elif defined(__SUNPRO_C) && __SUNPRO_C >= 0x5130 +# define LIBSSH2_DEPRECATED(version, message) \ + __attribute__((deprecated)) +# endif +#endif + +#ifndef LIBSSH2_DEPRECATED +#define LIBSSH2_DEPRECATED(version, message) +#endif + +/* + * Determine whether there is small or large file support on windows. + */ + +#if defined(_MSC_VER) && !defined(_WIN32_WCE) +# if (_MSC_VER >= 900) && (_INTEGRAL_MAX_BITS >= 64) +# define LIBSSH2_USE_WIN32_LARGE_FILES +# else +# define LIBSSH2_USE_WIN32_SMALL_FILES +# endif +#endif + +#if defined(__MINGW32__) && !defined(LIBSSH2_USE_WIN32_LARGE_FILES) +# define LIBSSH2_USE_WIN32_LARGE_FILES +#endif + +#if defined(__WATCOMC__) && !defined(LIBSSH2_USE_WIN32_LARGE_FILES) +# define LIBSSH2_USE_WIN32_LARGE_FILES +#endif + +#if defined(__POCC__) +# undef LIBSSH2_USE_WIN32_LARGE_FILES +#endif + +#if defined(_WIN32) && !defined(LIBSSH2_USE_WIN32_LARGE_FILES) && \ + !defined(LIBSSH2_USE_WIN32_SMALL_FILES) +# define LIBSSH2_USE_WIN32_SMALL_FILES +#endif + +/* + * Large file (>2Gb) support using WIN32 functions. + */ + +#ifdef LIBSSH2_USE_WIN32_LARGE_FILES +# include +# define LIBSSH2_STRUCT_STAT_SIZE_FORMAT "%I64d" +typedef struct _stati64 libssh2_struct_stat; +typedef __int64 libssh2_struct_stat_size; +#endif + +/* + * Small file (<2Gb) support using WIN32 functions. + */ + +#ifdef LIBSSH2_USE_WIN32_SMALL_FILES +# ifndef _WIN32_WCE +# define LIBSSH2_STRUCT_STAT_SIZE_FORMAT "%d" +typedef struct _stat libssh2_struct_stat; +typedef off_t libssh2_struct_stat_size; +# endif +#endif + +#ifndef LIBSSH2_STRUCT_STAT_SIZE_FORMAT +# ifdef __VMS +/* We have to roll our own format here because %z is a C99-ism we don't + have. */ +# if __USE_OFF64_T || __USING_STD_STAT +# define LIBSSH2_STRUCT_STAT_SIZE_FORMAT "%Ld" +# else +# define LIBSSH2_STRUCT_STAT_SIZE_FORMAT "%d" +# endif +# else +# define LIBSSH2_STRUCT_STAT_SIZE_FORMAT "%zd" +# endif +typedef struct stat libssh2_struct_stat; +typedef off_t libssh2_struct_stat_size; +#endif + +/* Part of every banner, user specified or not */ +#define LIBSSH2_SSH_BANNER "SSH-2.0-libssh2_" LIBSSH2_VERSION + +#define LIBSSH2_SSH_DEFAULT_BANNER LIBSSH2_SSH_BANNER +#define LIBSSH2_SSH_DEFAULT_BANNER_WITH_CRLF LIBSSH2_SSH_DEFAULT_BANNER "\r\n" + +/* Defaults for pty requests */ +#define LIBSSH2_TERM_WIDTH 80 +#define LIBSSH2_TERM_HEIGHT 24 +#define LIBSSH2_TERM_WIDTH_PX 0 +#define LIBSSH2_TERM_HEIGHT_PX 0 + +/* 1/4 second */ +#define LIBSSH2_SOCKET_POLL_UDELAY 250000 +/* 0.25 * 120 == 30 seconds */ +#define LIBSSH2_SOCKET_POLL_MAXLOOPS 120 + +/* Maximum size to allow a payload to compress to, plays it safe by falling + short of spec limits */ +#define LIBSSH2_PACKET_MAXCOMP 32000 + +/* Maximum size to allow a payload to deccompress to, plays it safe by + allowing more than spec requires */ +#define LIBSSH2_PACKET_MAXDECOMP 40000 + +/* Maximum size for an inbound compressed payload, plays it safe by + overshooting spec limits */ +#define LIBSSH2_PACKET_MAXPAYLOAD 40000 + +/* Malloc callbacks */ +#define LIBSSH2_ALLOC_FUNC(name) void *name(size_t count, void **abstract) +#define LIBSSH2_REALLOC_FUNC(name) void *name(void *ptr, size_t count, \ + void **abstract) +#define LIBSSH2_FREE_FUNC(name) void name(void *ptr, void **abstract) + +typedef struct _LIBSSH2_USERAUTH_KBDINT_PROMPT +{ + unsigned char *text; + size_t length; + unsigned char echo; +} LIBSSH2_USERAUTH_KBDINT_PROMPT; + +typedef struct _LIBSSH2_USERAUTH_KBDINT_RESPONSE +{ + char *text; + unsigned int length; /* FIXME: change type to size_t */ +} LIBSSH2_USERAUTH_KBDINT_RESPONSE; + +typedef struct _LIBSSH2_SK_SIG_INFO { + uint8_t flags; + uint32_t counter; + unsigned char *sig_r; + size_t sig_r_len; + unsigned char *sig_s; + size_t sig_s_len; +} LIBSSH2_SK_SIG_INFO; + +/* 'publickey' authentication callback */ +#define LIBSSH2_USERAUTH_PUBLICKEY_SIGN_FUNC(name) \ + int name(LIBSSH2_SESSION *session, unsigned char **sig, size_t *sig_len, \ + const unsigned char *data, size_t data_len, void **abstract) + +/* 'keyboard-interactive' authentication callback */ +/* FIXME: name_len, instruction_len -> size_t, num_prompts -> unsigned int? */ +#define LIBSSH2_USERAUTH_KBDINT_RESPONSE_FUNC(name_) \ + void name_(const char *name, int name_len, const char *instruction, \ + int instruction_len, int num_prompts, \ + const LIBSSH2_USERAUTH_KBDINT_PROMPT *prompts, \ + LIBSSH2_USERAUTH_KBDINT_RESPONSE *responses, void **abstract) + +/* SK authentication callback */ +#define LIBSSH2_USERAUTH_SK_SIGN_FUNC(name) \ + int name(LIBSSH2_SESSION *session, LIBSSH2_SK_SIG_INFO *sig_info, \ + const unsigned char *data, size_t data_len, \ + int algorithm, uint8_t flags, \ + const char *application, const unsigned char *key_handle, \ + size_t handle_len, \ + void **abstract) + +/* Flags for SK authentication */ +#define LIBSSH2_SK_PRESENCE_REQUIRED 0x01 +#define LIBSSH2_SK_VERIFICATION_REQUIRED 0x04 + +/* FIXME: update lengths to size_t (or ssize_t): */ + +/* Callbacks for special SSH packets */ +#define LIBSSH2_IGNORE_FUNC(name) \ + void name(LIBSSH2_SESSION *session, const char *message, int message_len, \ + void **abstract) + +#define LIBSSH2_DEBUG_FUNC(name) \ + void name(LIBSSH2_SESSION *session, int always_display, \ + const char *message, int message_len, \ + const char *language, int language_len, \ + void **abstract) + +#define LIBSSH2_DISCONNECT_FUNC(name) \ + void name(LIBSSH2_SESSION *session, int reason, \ + const char *message, int message_len, \ + const char *language, int language_len, \ + void **abstract) + +#define LIBSSH2_PASSWD_CHANGEREQ_FUNC(name) \ + void name(LIBSSH2_SESSION *session, char **newpw, int *newpw_len, \ + void **abstract) + +#define LIBSSH2_MACERROR_FUNC(name) \ + int name(LIBSSH2_SESSION *session, const char *packet, int packet_len, \ + void **abstract) + +#define LIBSSH2_X11_OPEN_FUNC(name) \ + void name(LIBSSH2_SESSION *session, LIBSSH2_CHANNEL *channel, \ + const char *shost, int sport, void **abstract) + +#define LIBSSH2_AUTHAGENT_FUNC(name) \ + void name(LIBSSH2_SESSION *session, LIBSSH2_CHANNEL *channel, \ + void **abstract) + +#define LIBSSH2_ADD_IDENTITIES_FUNC(name) \ + void name(LIBSSH2_SESSION *session, void *buffer, \ + const char *agent_path, void **abstract) + +#define LIBSSH2_AUTHAGENT_SIGN_FUNC(name) \ + int name(LIBSSH2_SESSION* session, \ + unsigned char *blob, unsigned int blen, \ + const unsigned char *data, unsigned int dlen, \ + unsigned char **signature, unsigned int *sigLen, \ + const char *agentPath, \ + void **abstract) + +#define LIBSSH2_CHANNEL_CLOSE_FUNC(name) \ + void name(LIBSSH2_SESSION *session, void **session_abstract, \ + LIBSSH2_CHANNEL *channel, void **channel_abstract) + +/* I/O callbacks */ +#define LIBSSH2_RECV_FUNC(name) \ + ssize_t name(libssh2_socket_t socket, \ + void *buffer, size_t length, \ + int flags, void **abstract) +#define LIBSSH2_SEND_FUNC(name) \ + ssize_t name(libssh2_socket_t socket, \ + const void *buffer, size_t length, \ + int flags, void **abstract) + +/* libssh2_session_callback_set() constants */ +#define LIBSSH2_CALLBACK_IGNORE 0 +#define LIBSSH2_CALLBACK_DEBUG 1 +#define LIBSSH2_CALLBACK_DISCONNECT 2 +#define LIBSSH2_CALLBACK_MACERROR 3 +#define LIBSSH2_CALLBACK_X11 4 +#define LIBSSH2_CALLBACK_SEND 5 +#define LIBSSH2_CALLBACK_RECV 6 +#define LIBSSH2_CALLBACK_AUTHAGENT 7 +#define LIBSSH2_CALLBACK_AUTHAGENT_IDENTITIES 8 +#define LIBSSH2_CALLBACK_AUTHAGENT_SIGN 9 + +/* libssh2_session_method_pref() constants */ +#define LIBSSH2_METHOD_KEX 0 +#define LIBSSH2_METHOD_HOSTKEY 1 +#define LIBSSH2_METHOD_CRYPT_CS 2 +#define LIBSSH2_METHOD_CRYPT_SC 3 +#define LIBSSH2_METHOD_MAC_CS 4 +#define LIBSSH2_METHOD_MAC_SC 5 +#define LIBSSH2_METHOD_COMP_CS 6 +#define LIBSSH2_METHOD_COMP_SC 7 +#define LIBSSH2_METHOD_LANG_CS 8 +#define LIBSSH2_METHOD_LANG_SC 9 +#define LIBSSH2_METHOD_SIGN_ALGO 10 + +/* flags */ +#define LIBSSH2_FLAG_SIGPIPE 1 +#define LIBSSH2_FLAG_COMPRESS 2 +#define LIBSSH2_FLAG_QUOTE_PATHS 3 + +typedef struct _LIBSSH2_SESSION LIBSSH2_SESSION; +typedef struct _LIBSSH2_CHANNEL LIBSSH2_CHANNEL; +typedef struct _LIBSSH2_LISTENER LIBSSH2_LISTENER; +typedef struct _LIBSSH2_KNOWNHOSTS LIBSSH2_KNOWNHOSTS; +typedef struct _LIBSSH2_AGENT LIBSSH2_AGENT; + +/* SK signature callback */ +typedef struct _LIBSSH2_PRIVKEY_SK { + int algorithm; + uint8_t flags; + const char *application; + const unsigned char *key_handle; + size_t handle_len; + LIBSSH2_USERAUTH_SK_SIGN_FUNC((*sign_callback)); + void **orig_abstract; +} LIBSSH2_PRIVKEY_SK; + +int +libssh2_sign_sk(LIBSSH2_SESSION *session, + unsigned char **sig, + size_t *sig_len, + const unsigned char *data, + size_t data_len, + void **abstract); + +typedef struct _LIBSSH2_POLLFD { + unsigned char type; /* LIBSSH2_POLLFD_* below */ + + union { + libssh2_socket_t socket; /* File descriptors -- examined with + system select() call */ + LIBSSH2_CHANNEL *channel; /* Examined by checking internal state */ + LIBSSH2_LISTENER *listener; /* Read polls only -- are inbound + connections waiting to be accepted? */ + } fd; + + unsigned long events; /* Requested Events */ + unsigned long revents; /* Returned Events */ +} LIBSSH2_POLLFD; + +/* Poll FD Descriptor Types */ +#define LIBSSH2_POLLFD_SOCKET 1 +#define LIBSSH2_POLLFD_CHANNEL 2 +#define LIBSSH2_POLLFD_LISTENER 3 + +/* Note: Win32 Doesn't actually have a poll() implementation, so some of these + values are faked with select() data */ +/* Poll FD events/revents -- Match sys/poll.h where possible */ +#define LIBSSH2_POLLFD_POLLIN 0x0001 /* Data available to be read or + connection available -- + All */ +#define LIBSSH2_POLLFD_POLLPRI 0x0002 /* Priority data available to + be read -- Socket only */ +#define LIBSSH2_POLLFD_POLLEXT 0x0002 /* Extended data available to + be read -- Channel only */ +#define LIBSSH2_POLLFD_POLLOUT 0x0004 /* Can may be written -- + Socket/Channel */ +/* revents only */ +#define LIBSSH2_POLLFD_POLLERR 0x0008 /* Error Condition -- Socket */ +#define LIBSSH2_POLLFD_POLLHUP 0x0010 /* HangUp/EOF -- Socket */ +#define LIBSSH2_POLLFD_SESSION_CLOSED 0x0010 /* Session Disconnect */ +#define LIBSSH2_POLLFD_POLLNVAL 0x0020 /* Invalid request -- Socket + Only */ +#define LIBSSH2_POLLFD_POLLEX 0x0040 /* Exception Condition -- + Socket/Win32 */ +#define LIBSSH2_POLLFD_CHANNEL_CLOSED 0x0080 /* Channel Disconnect */ +#define LIBSSH2_POLLFD_LISTENER_CLOSED 0x0080 /* Listener Disconnect */ + +#define HAVE_LIBSSH2_SESSION_BLOCK_DIRECTION +/* Block Direction Types */ +#define LIBSSH2_SESSION_BLOCK_INBOUND 0x0001 +#define LIBSSH2_SESSION_BLOCK_OUTBOUND 0x0002 + +/* Hash Types */ +#define LIBSSH2_HOSTKEY_HASH_MD5 1 +#define LIBSSH2_HOSTKEY_HASH_SHA1 2 +#define LIBSSH2_HOSTKEY_HASH_SHA256 3 + +/* Hostkey Types */ +#define LIBSSH2_HOSTKEY_TYPE_UNKNOWN 0 +#define LIBSSH2_HOSTKEY_TYPE_RSA 1 +#define LIBSSH2_HOSTKEY_TYPE_DSS 2 /* deprecated */ +#define LIBSSH2_HOSTKEY_TYPE_ECDSA_256 3 +#define LIBSSH2_HOSTKEY_TYPE_ECDSA_384 4 +#define LIBSSH2_HOSTKEY_TYPE_ECDSA_521 5 +#define LIBSSH2_HOSTKEY_TYPE_ED25519 6 + +/* Disconnect Codes (defined by SSH protocol) */ +#define SSH_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT 1 +#define SSH_DISCONNECT_PROTOCOL_ERROR 2 +#define SSH_DISCONNECT_KEY_EXCHANGE_FAILED 3 +#define SSH_DISCONNECT_RESERVED 4 +#define SSH_DISCONNECT_MAC_ERROR 5 +#define SSH_DISCONNECT_COMPRESSION_ERROR 6 +#define SSH_DISCONNECT_SERVICE_NOT_AVAILABLE 7 +#define SSH_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED 8 +#define SSH_DISCONNECT_HOST_KEY_NOT_VERIFIABLE 9 +#define SSH_DISCONNECT_CONNECTION_LOST 10 +#define SSH_DISCONNECT_BY_APPLICATION 11 +#define SSH_DISCONNECT_TOO_MANY_CONNECTIONS 12 +#define SSH_DISCONNECT_AUTH_CANCELLED_BY_USER 13 +#define SSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE 14 +#define SSH_DISCONNECT_ILLEGAL_USER_NAME 15 + +/* Error Codes (defined by libssh2) */ +#define LIBSSH2_ERROR_NONE 0 + +/* The library once used -1 as a generic error return value on numerous places + through the code, which subsequently was converted to + LIBSSH2_ERROR_SOCKET_NONE uses over time. As this is a generic error code, + the goal is to never ever return this code but instead make sure that a + more accurate and descriptive error code is used. */ +#define LIBSSH2_ERROR_SOCKET_NONE -1 + +#define LIBSSH2_ERROR_BANNER_RECV -2 +#define LIBSSH2_ERROR_BANNER_SEND -3 +#define LIBSSH2_ERROR_INVALID_MAC -4 +#define LIBSSH2_ERROR_KEX_FAILURE -5 +#define LIBSSH2_ERROR_ALLOC -6 +#define LIBSSH2_ERROR_SOCKET_SEND -7 +#define LIBSSH2_ERROR_KEY_EXCHANGE_FAILURE -8 +#define LIBSSH2_ERROR_TIMEOUT -9 +#define LIBSSH2_ERROR_HOSTKEY_INIT -10 +#define LIBSSH2_ERROR_HOSTKEY_SIGN -11 +#define LIBSSH2_ERROR_DECRYPT -12 +#define LIBSSH2_ERROR_SOCKET_DISCONNECT -13 +#define LIBSSH2_ERROR_PROTO -14 +#define LIBSSH2_ERROR_PASSWORD_EXPIRED -15 +#define LIBSSH2_ERROR_FILE -16 +#define LIBSSH2_ERROR_METHOD_NONE -17 +#define LIBSSH2_ERROR_AUTHENTICATION_FAILED -18 +#define LIBSSH2_ERROR_PUBLICKEY_UNRECOGNIZED \ + LIBSSH2_ERROR_AUTHENTICATION_FAILED +#define LIBSSH2_ERROR_PUBLICKEY_UNVERIFIED -19 +#define LIBSSH2_ERROR_CHANNEL_OUTOFORDER -20 +#define LIBSSH2_ERROR_CHANNEL_FAILURE -21 +#define LIBSSH2_ERROR_CHANNEL_REQUEST_DENIED -22 +#define LIBSSH2_ERROR_CHANNEL_UNKNOWN -23 +#define LIBSSH2_ERROR_CHANNEL_WINDOW_EXCEEDED -24 +#define LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED -25 +#define LIBSSH2_ERROR_CHANNEL_CLOSED -26 +#define LIBSSH2_ERROR_CHANNEL_EOF_SENT -27 +#define LIBSSH2_ERROR_SCP_PROTOCOL -28 +#define LIBSSH2_ERROR_ZLIB -29 +#define LIBSSH2_ERROR_SOCKET_TIMEOUT -30 +#define LIBSSH2_ERROR_SFTP_PROTOCOL -31 +#define LIBSSH2_ERROR_REQUEST_DENIED -32 +#define LIBSSH2_ERROR_METHOD_NOT_SUPPORTED -33 +#define LIBSSH2_ERROR_INVAL -34 +#define LIBSSH2_ERROR_INVALID_POLL_TYPE -35 +#define LIBSSH2_ERROR_PUBLICKEY_PROTOCOL -36 +#define LIBSSH2_ERROR_EAGAIN -37 +#define LIBSSH2_ERROR_BUFFER_TOO_SMALL -38 +#define LIBSSH2_ERROR_BAD_USE -39 +#define LIBSSH2_ERROR_COMPRESS -40 +#define LIBSSH2_ERROR_OUT_OF_BOUNDARY -41 +#define LIBSSH2_ERROR_AGENT_PROTOCOL -42 +#define LIBSSH2_ERROR_SOCKET_RECV -43 +#define LIBSSH2_ERROR_ENCRYPT -44 +#define LIBSSH2_ERROR_BAD_SOCKET -45 +#define LIBSSH2_ERROR_KNOWN_HOSTS -46 +#define LIBSSH2_ERROR_CHANNEL_WINDOW_FULL -47 +#define LIBSSH2_ERROR_KEYFILE_AUTH_FAILED -48 +#define LIBSSH2_ERROR_RANDGEN -49 +#define LIBSSH2_ERROR_MISSING_USERAUTH_BANNER -50 +#define LIBSSH2_ERROR_ALGO_UNSUPPORTED -51 +#define LIBSSH2_ERROR_MAC_FAILURE -52 +#define LIBSSH2_ERROR_HASH_INIT -53 +#define LIBSSH2_ERROR_HASH_CALC -54 + +/* this is a define to provide the old (<= 1.2.7) name */ +#define LIBSSH2_ERROR_BANNER_NONE LIBSSH2_ERROR_BANNER_RECV + +/* Global API */ +#define LIBSSH2_INIT_NO_CRYPTO 0x0001 + +/* + * libssh2_init() + * + * Initialize the libssh2 functions. This typically initialize the + * crypto library. It uses a global state, and is not thread safe -- + * you must make sure this function is not called concurrently. + * + * Flags can be: + * 0: Normal initialize + * LIBSSH2_INIT_NO_CRYPTO: Do not initialize the crypto library (ie. + * OPENSSL_add_cipher_algoritms() for OpenSSL + * + * Returns 0 if succeeded, or a negative value for error. + */ +LIBSSH2_API int libssh2_init(int flags); + +/* + * libssh2_exit() + * + * Exit the libssh2 functions and free's all memory used internal. + */ +LIBSSH2_API void libssh2_exit(void); + +/* + * libssh2_free() + * + * Deallocate memory allocated by earlier call to libssh2 functions. + */ +LIBSSH2_API void libssh2_free(LIBSSH2_SESSION *session, void *ptr); + +/* + * libssh2_session_supported_algs() + * + * Fills algs with a list of supported acryptographic algorithms. Returns a + * non-negative number (number of supported algorithms) on success or a + * negative number (an error code) on failure. + * + * NOTE: on success, algs must be deallocated (by calling libssh2_free) when + * not needed anymore + */ +LIBSSH2_API int libssh2_session_supported_algs(LIBSSH2_SESSION* session, + int method_type, + const char ***algs); + +/* Session API */ +LIBSSH2_API LIBSSH2_SESSION * +libssh2_session_init_ex(LIBSSH2_ALLOC_FUNC((*my_alloc)), + LIBSSH2_FREE_FUNC((*my_free)), + LIBSSH2_REALLOC_FUNC((*my_realloc)), void *abstract); +#define libssh2_session_init() libssh2_session_init_ex(NULL, NULL, NULL, NULL) + +LIBSSH2_API void **libssh2_session_abstract(LIBSSH2_SESSION *session); + +typedef void (libssh2_cb_generic)(void); + +LIBSSH2_API libssh2_cb_generic * +libssh2_session_callback_set2(LIBSSH2_SESSION *session, int cbtype, + libssh2_cb_generic *callback); + +LIBSSH2_DEPRECATED(1.11.1, "Use libssh2_session_callback_set2()") +LIBSSH2_API void *libssh2_session_callback_set(LIBSSH2_SESSION *session, + int cbtype, void *callback); +LIBSSH2_API int libssh2_session_banner_set(LIBSSH2_SESSION *session, + const char *banner); +#ifndef LIBSSH2_NO_DEPRECATED +LIBSSH2_DEPRECATED(1.4.0, "Use libssh2_session_banner_set()") +LIBSSH2_API int libssh2_banner_set(LIBSSH2_SESSION *session, + const char *banner); + +LIBSSH2_DEPRECATED(1.2.8, "Use libssh2_session_handshake()") +LIBSSH2_API int libssh2_session_startup(LIBSSH2_SESSION *session, int sock); +#endif +LIBSSH2_API int libssh2_session_handshake(LIBSSH2_SESSION *session, + libssh2_socket_t sock); +LIBSSH2_API int libssh2_session_disconnect_ex(LIBSSH2_SESSION *session, + int reason, + const char *description, + const char *lang); +#define libssh2_session_disconnect(session, description) \ + libssh2_session_disconnect_ex((session), SSH_DISCONNECT_BY_APPLICATION, \ + (description), "") + +LIBSSH2_API int libssh2_session_free(LIBSSH2_SESSION *session); + +LIBSSH2_API const char *libssh2_hostkey_hash(LIBSSH2_SESSION *session, + int hash_type); + +LIBSSH2_API const char *libssh2_session_hostkey(LIBSSH2_SESSION *session, + size_t *len, int *type); + +LIBSSH2_API int libssh2_session_method_pref(LIBSSH2_SESSION *session, + int method_type, + const char *prefs); +LIBSSH2_API const char *libssh2_session_methods(LIBSSH2_SESSION *session, + int method_type); +LIBSSH2_API int libssh2_session_last_error(LIBSSH2_SESSION *session, + char **errmsg, + int *errmsg_len, int want_buf); +LIBSSH2_API int libssh2_session_last_errno(LIBSSH2_SESSION *session); +LIBSSH2_API int libssh2_session_set_last_error(LIBSSH2_SESSION* session, + int errcode, + const char *errmsg); +LIBSSH2_API int libssh2_session_block_directions(LIBSSH2_SESSION *session); + +LIBSSH2_API int libssh2_session_flag(LIBSSH2_SESSION *session, int flag, + int value); +LIBSSH2_API const char *libssh2_session_banner_get(LIBSSH2_SESSION *session); + +/* Userauth API */ +LIBSSH2_API char *libssh2_userauth_list(LIBSSH2_SESSION *session, + const char *username, + unsigned int username_len); +LIBSSH2_API int libssh2_userauth_banner(LIBSSH2_SESSION *session, + char **banner); +LIBSSH2_API int libssh2_userauth_authenticated(LIBSSH2_SESSION *session); + +LIBSSH2_API int +libssh2_userauth_password_ex(LIBSSH2_SESSION *session, + const char *username, + unsigned int username_len, + const char *password, + unsigned int password_len, + LIBSSH2_PASSWD_CHANGEREQ_FUNC + ((*passwd_change_cb))); + +#define libssh2_userauth_password(session, username, password) \ + libssh2_userauth_password_ex((session), (username), \ + (unsigned int)strlen(username), \ + (password), (unsigned int)strlen(password), \ + NULL) + +LIBSSH2_API int +libssh2_userauth_publickey_fromfile_ex(LIBSSH2_SESSION *session, + const char *username, + unsigned int username_len, + const char *publickey, + const char *privatekey, + const char *passphrase); + +#define libssh2_userauth_publickey_fromfile(session, username, publickey, \ + privatekey, passphrase) \ + libssh2_userauth_publickey_fromfile_ex((session), (username), \ + (unsigned int)strlen(username), \ + (publickey), \ + (privatekey), (passphrase)) + +LIBSSH2_API int +libssh2_userauth_publickey(LIBSSH2_SESSION *session, + const char *username, + const unsigned char *pubkeydata, + size_t pubkeydata_len, + LIBSSH2_USERAUTH_PUBLICKEY_SIGN_FUNC + ((*sign_callback)), + void **abstract); + +LIBSSH2_API int +libssh2_userauth_hostbased_fromfile_ex(LIBSSH2_SESSION *session, + const char *username, + unsigned int username_len, + const char *publickey, + const char *privatekey, + const char *passphrase, + const char *hostname, + unsigned int hostname_len, + const char *local_username, + unsigned int local_username_len); + +#define libssh2_userauth_hostbased_fromfile(session, username, publickey, \ + privatekey, passphrase, hostname) \ + libssh2_userauth_hostbased_fromfile_ex((session), (username), \ + (unsigned int)strlen(username), \ + (publickey), \ + (privatekey), (passphrase), \ + (hostname), \ + (unsigned int)strlen(hostname), \ + (username), \ + (unsigned int)strlen(username)) + +LIBSSH2_API int +libssh2_userauth_publickey_frommemory(LIBSSH2_SESSION *session, + const char *username, + size_t username_len, + const char *publickeyfiledata, + size_t publickeyfiledata_len, + const char *privatekeyfiledata, + size_t privatekeyfiledata_len, + const char *passphrase); + +/* + * response_callback is provided with filled by library prompts array, + * but client must allocate and fill individual responses. Responses + * array is already allocated. Responses data will be freed by libssh2 + * after callback return, but before subsequent callback invocation. + */ +LIBSSH2_API int +libssh2_userauth_keyboard_interactive_ex(LIBSSH2_SESSION* session, + const char *username, + unsigned int username_len, + LIBSSH2_USERAUTH_KBDINT_RESPONSE_FUNC + ((*response_callback))); + +#define libssh2_userauth_keyboard_interactive(session, username, \ + response_callback) \ + libssh2_userauth_keyboard_interactive_ex((session), (username), \ + (unsigned int)strlen(username), \ + (response_callback)) + +LIBSSH2_API int +libssh2_userauth_publickey_sk(LIBSSH2_SESSION *session, + const char *username, + size_t username_len, + const unsigned char *pubkeydata, + size_t pubkeydata_len, + const char *privatekeydata, + size_t privatekeydata_len, + const char *passphrase, + LIBSSH2_USERAUTH_SK_SIGN_FUNC + ((*sign_callback)), + void **abstract); + +LIBSSH2_API int libssh2_poll(LIBSSH2_POLLFD *fds, unsigned int nfds, + long timeout); + +/* Channel API */ +#define LIBSSH2_CHANNEL_WINDOW_DEFAULT (2*1024*1024) +#define LIBSSH2_CHANNEL_PACKET_DEFAULT 32768 +#define LIBSSH2_CHANNEL_MINADJUST 1024 + +/* Extended Data Handling */ +#define LIBSSH2_CHANNEL_EXTENDED_DATA_NORMAL 0 +#define LIBSSH2_CHANNEL_EXTENDED_DATA_IGNORE 1 +#define LIBSSH2_CHANNEL_EXTENDED_DATA_MERGE 2 + +#define SSH_EXTENDED_DATA_STDERR 1 + +/* Returned by any function that would block during a read/write operation */ +#define LIBSSH2CHANNEL_EAGAIN LIBSSH2_ERROR_EAGAIN + +LIBSSH2_API LIBSSH2_CHANNEL * +libssh2_channel_open_ex(LIBSSH2_SESSION *session, const char *channel_type, + unsigned int channel_type_len, + unsigned int window_size, unsigned int packet_size, + const char *message, unsigned int message_len); + +#define libssh2_channel_open_session(session) \ + libssh2_channel_open_ex((session), "session", sizeof("session") - 1, \ + LIBSSH2_CHANNEL_WINDOW_DEFAULT, \ + LIBSSH2_CHANNEL_PACKET_DEFAULT, NULL, 0) + +LIBSSH2_API LIBSSH2_CHANNEL * +libssh2_channel_direct_tcpip_ex(LIBSSH2_SESSION *session, const char *host, + int port, const char *shost, int sport); +#define libssh2_channel_direct_tcpip(session, host, port) \ + libssh2_channel_direct_tcpip_ex((session), (host), (port), "127.0.0.1", 22) + +LIBSSH2_API LIBSSH2_CHANNEL * +libssh2_channel_direct_streamlocal_ex(LIBSSH2_SESSION * session, + const char *socket_path, + const char *shost, int sport); + +LIBSSH2_API LIBSSH2_LISTENER * +libssh2_channel_forward_listen_ex(LIBSSH2_SESSION *session, const char *host, + int port, int *bound_port, + int queue_maxsize); +#define libssh2_channel_forward_listen(session, port) \ + libssh2_channel_forward_listen_ex((session), NULL, (port), NULL, 16) + +LIBSSH2_API int libssh2_channel_forward_cancel(LIBSSH2_LISTENER *listener); + +LIBSSH2_API LIBSSH2_CHANNEL * +libssh2_channel_forward_accept(LIBSSH2_LISTENER *listener); + +LIBSSH2_API int libssh2_channel_setenv_ex(LIBSSH2_CHANNEL *channel, + const char *varname, + unsigned int varname_len, + const char *value, + unsigned int value_len); + +#define libssh2_channel_setenv(channel, varname, value) \ + libssh2_channel_setenv_ex((channel), (varname), \ + (unsigned int)strlen(varname), (value), \ + (unsigned int)strlen(value)) + +LIBSSH2_API int libssh2_channel_request_auth_agent(LIBSSH2_CHANNEL *channel); + +LIBSSH2_API int libssh2_channel_request_pty_ex(LIBSSH2_CHANNEL *channel, + const char *term, + unsigned int term_len, + const char *modes, + unsigned int modes_len, + int width, int height, + int width_px, int height_px); +#define libssh2_channel_request_pty(channel, term) \ + libssh2_channel_request_pty_ex((channel), (term), \ + (unsigned int)strlen(term), \ + NULL, 0, \ + LIBSSH2_TERM_WIDTH, \ + LIBSSH2_TERM_HEIGHT, \ + LIBSSH2_TERM_WIDTH_PX, \ + LIBSSH2_TERM_HEIGHT_PX) + +LIBSSH2_API int libssh2_channel_request_pty_size_ex(LIBSSH2_CHANNEL *channel, + int width, int height, + int width_px, + int height_px); +#define libssh2_channel_request_pty_size(channel, width, height) \ + libssh2_channel_request_pty_size_ex((channel), (width), (height), 0, 0) + +LIBSSH2_API int libssh2_channel_x11_req_ex(LIBSSH2_CHANNEL *channel, + int single_connection, + const char *auth_proto, + const char *auth_cookie, + int screen_number); +#define libssh2_channel_x11_req(channel, screen_number) \ + libssh2_channel_x11_req_ex((channel), 0, NULL, NULL, (screen_number)) + +LIBSSH2_API int libssh2_channel_signal_ex(LIBSSH2_CHANNEL *channel, + const char *signame, + size_t signame_len); +#define libssh2_channel_signal(channel, signame) \ + libssh2_channel_signal_ex((channel), signame, strlen(signame)) + +LIBSSH2_API int libssh2_channel_process_startup(LIBSSH2_CHANNEL *channel, + const char *request, + unsigned int request_len, + const char *message, + unsigned int message_len); +#define libssh2_channel_shell(channel) \ + libssh2_channel_process_startup((channel), "shell", sizeof("shell") - 1, \ + NULL, 0) +#define libssh2_channel_exec(channel, command) \ + libssh2_channel_process_startup((channel), "exec", sizeof("exec") - 1, \ + (command), (unsigned int)strlen(command)) +#define libssh2_channel_subsystem(channel, subsystem) \ + libssh2_channel_process_startup((channel), "subsystem", \ + sizeof("subsystem") - 1, (subsystem), \ + (unsigned int)strlen(subsystem)) + +LIBSSH2_API ssize_t libssh2_channel_read_ex(LIBSSH2_CHANNEL *channel, + int stream_id, char *buf, + size_t buflen); +#define libssh2_channel_read(channel, buf, buflen) \ + libssh2_channel_read_ex((channel), 0, \ + (buf), (buflen)) +#define libssh2_channel_read_stderr(channel, buf, buflen) \ + libssh2_channel_read_ex((channel), SSH_EXTENDED_DATA_STDERR, \ + (buf), (buflen)) + +LIBSSH2_API int libssh2_poll_channel_read(LIBSSH2_CHANNEL *channel, + int extended); + +LIBSSH2_API unsigned long +libssh2_channel_window_read_ex(LIBSSH2_CHANNEL *channel, + unsigned long *read_avail, + unsigned long *window_size_initial); +#define libssh2_channel_window_read(channel) \ + libssh2_channel_window_read_ex((channel), NULL, NULL) + +#ifndef LIBSSH2_NO_DEPRECATED +LIBSSH2_DEPRECATED(1.1.0, "Use libssh2_channel_receive_window_adjust2()") +LIBSSH2_API unsigned long +libssh2_channel_receive_window_adjust(LIBSSH2_CHANNEL *channel, + unsigned long adjustment, + unsigned char force); +#endif +LIBSSH2_API int +libssh2_channel_receive_window_adjust2(LIBSSH2_CHANNEL *channel, + unsigned long adjustment, + unsigned char force, + unsigned int *storewindow); + +LIBSSH2_API ssize_t libssh2_channel_write_ex(LIBSSH2_CHANNEL *channel, + int stream_id, const char *buf, + size_t buflen); + +#define libssh2_channel_write(channel, buf, buflen) \ + libssh2_channel_write_ex((channel), 0, \ + (buf), (buflen)) +#define libssh2_channel_write_stderr(channel, buf, buflen) \ + libssh2_channel_write_ex((channel), SSH_EXTENDED_DATA_STDERR, \ + (buf), (buflen)) + +LIBSSH2_API unsigned long +libssh2_channel_window_write_ex(LIBSSH2_CHANNEL *channel, + unsigned long *window_size_initial); +#define libssh2_channel_window_write(channel) \ + libssh2_channel_window_write_ex((channel), NULL) + +LIBSSH2_API void libssh2_session_set_blocking(LIBSSH2_SESSION* session, + int blocking); +LIBSSH2_API int libssh2_session_get_blocking(LIBSSH2_SESSION* session); + +LIBSSH2_API void libssh2_channel_set_blocking(LIBSSH2_CHANNEL *channel, + int blocking); + +LIBSSH2_API void libssh2_session_set_timeout(LIBSSH2_SESSION* session, + long timeout); +LIBSSH2_API long libssh2_session_get_timeout(LIBSSH2_SESSION* session); + +LIBSSH2_API void libssh2_session_set_read_timeout(LIBSSH2_SESSION* session, + long timeout); +LIBSSH2_API long libssh2_session_get_read_timeout(LIBSSH2_SESSION* session); + +#ifndef LIBSSH2_NO_DEPRECATED +LIBSSH2_DEPRECATED(1.1.0, "libssh2_channel_handle_extended_data2()") +LIBSSH2_API void libssh2_channel_handle_extended_data(LIBSSH2_CHANNEL *channel, + int ignore_mode); +#endif +LIBSSH2_API int libssh2_channel_handle_extended_data2(LIBSSH2_CHANNEL *channel, + int ignore_mode); + +#ifndef LIBSSH2_NO_DEPRECATED +/* libssh2_channel_ignore_extended_data() is defined below for BC with version + * 0.1 + * + * Future uses should use libssh2_channel_handle_extended_data() directly if + * LIBSSH2_CHANNEL_EXTENDED_DATA_MERGE is passed, extended data will be read + * (FIFO) from the standard data channel + */ +/* DEPRECATED since 0.3.0. Use libssh2_channel_handle_extended_data2(). */ +#define libssh2_channel_ignore_extended_data(channel, ignore) \ + libssh2_channel_handle_extended_data((channel), (ignore) ? \ + LIBSSH2_CHANNEL_EXTENDED_DATA_IGNORE : \ + LIBSSH2_CHANNEL_EXTENDED_DATA_NORMAL) +#endif + +#define LIBSSH2_CHANNEL_FLUSH_EXTENDED_DATA -1 +#define LIBSSH2_CHANNEL_FLUSH_ALL -2 +LIBSSH2_API int libssh2_channel_flush_ex(LIBSSH2_CHANNEL *channel, + int streamid); +#define libssh2_channel_flush(channel) libssh2_channel_flush_ex((channel), 0) +#define libssh2_channel_flush_stderr(channel) \ + libssh2_channel_flush_ex((channel), SSH_EXTENDED_DATA_STDERR) + +LIBSSH2_API int libssh2_channel_get_exit_status(LIBSSH2_CHANNEL* channel); +LIBSSH2_API int libssh2_channel_get_exit_signal(LIBSSH2_CHANNEL* channel, + char **exitsignal, + size_t *exitsignal_len, + char **errmsg, + size_t *errmsg_len, + char **langtag, + size_t *langtag_len); +LIBSSH2_API int libssh2_channel_send_eof(LIBSSH2_CHANNEL *channel); +LIBSSH2_API int libssh2_channel_eof(LIBSSH2_CHANNEL *channel); +LIBSSH2_API int libssh2_channel_wait_eof(LIBSSH2_CHANNEL *channel); +LIBSSH2_API int libssh2_channel_close(LIBSSH2_CHANNEL *channel); +LIBSSH2_API int libssh2_channel_wait_closed(LIBSSH2_CHANNEL *channel); +LIBSSH2_API int libssh2_channel_free(LIBSSH2_CHANNEL *channel); + +#ifndef LIBSSH2_NO_DEPRECATED +LIBSSH2_DEPRECATED(1.7.0, "Use libssh2_scp_recv2()") +LIBSSH2_API LIBSSH2_CHANNEL *libssh2_scp_recv(LIBSSH2_SESSION *session, + const char *path, + struct stat *sb); +#endif +/* Use libssh2_scp_recv2() for large (> 2GB) file support on windows */ +LIBSSH2_API LIBSSH2_CHANNEL *libssh2_scp_recv2(LIBSSH2_SESSION *session, + const char *path, + libssh2_struct_stat *sb); +LIBSSH2_API LIBSSH2_CHANNEL *libssh2_scp_send_ex(LIBSSH2_SESSION *session, + const char *path, int mode, + size_t size, long mtime, + long atime); +LIBSSH2_API LIBSSH2_CHANNEL * +libssh2_scp_send64(LIBSSH2_SESSION *session, const char *path, int mode, + libssh2_int64_t size, time_t mtime, time_t atime); + +#define libssh2_scp_send(session, path, mode, size) \ + libssh2_scp_send_ex((session), (path), (mode), (size), 0, 0) + +/* DEPRECATED */ +LIBSSH2_API int libssh2_base64_decode(LIBSSH2_SESSION *session, char **dest, + unsigned int *dest_len, + const char *src, unsigned int src_len); + +LIBSSH2_API +const char *libssh2_version(int req_version_num); + +typedef enum { + libssh2_no_crypto = 0, + libssh2_openssl, + libssh2_gcrypt, + libssh2_mbedtls, + libssh2_wincng, + libssh2_os400qc3 +} libssh2_crypto_engine_t; + +LIBSSH2_API +libssh2_crypto_engine_t libssh2_crypto_engine(void); + +#define HAVE_LIBSSH2_KNOWNHOST_API 0x010101 /* since 1.1.1 */ +#define HAVE_LIBSSH2_VERSION_API 0x010100 /* libssh2_version since 1.1 */ +#define HAVE_LIBSSH2_CRYPTOENGINE_API 0x011100 /* libssh2_crypto_engine + since 1.11 */ + +struct libssh2_knownhost { + unsigned int magic; /* magic stored by the library */ + void *node; /* handle to the internal representation of this host */ + char *name; /* this is NULL if no plain text host name exists */ + char *key; /* key in base64/printable format */ + int typemask; +}; + +/* + * libssh2_knownhost_init() + * + * Init a collection of known hosts. Returns the pointer to a collection. + * + */ +LIBSSH2_API LIBSSH2_KNOWNHOSTS * +libssh2_knownhost_init(LIBSSH2_SESSION *session); + +/* + * libssh2_knownhost_add() + * + * Add a host and its associated key to the collection of known hosts. + * + * The 'type' argument specifies on what format the given host and keys are: + * + * plain - ascii "hostname.domain.tld" + * sha1 - SHA1( ) base64-encoded! + * custom - another hash + * + * If 'sha1' is selected as type, the salt must be provided to the salt + * argument. This too base64 encoded. + * + * The SHA-1 hash is what OpenSSH can be told to use in known_hosts files. If + * a custom type is used, salt is ignored and you must provide the host + * pre-hashed when checking for it in the libssh2_knownhost_check() function. + * + * The keylen parameter may be omitted (zero) if the key is provided as a + * NULL-terminated base64-encoded string. + */ + +/* host format (2 bits) */ +#define LIBSSH2_KNOWNHOST_TYPE_MASK 0xffff +#define LIBSSH2_KNOWNHOST_TYPE_PLAIN 1 +#define LIBSSH2_KNOWNHOST_TYPE_SHA1 2 /* always base64 encoded */ +#define LIBSSH2_KNOWNHOST_TYPE_CUSTOM 3 + +/* key format (2 bits) */ +#define LIBSSH2_KNOWNHOST_KEYENC_MASK (3<<16) +#define LIBSSH2_KNOWNHOST_KEYENC_RAW (1<<16) +#define LIBSSH2_KNOWNHOST_KEYENC_BASE64 (2<<16) + +/* type of key (4 bits) */ +#define LIBSSH2_KNOWNHOST_KEY_MASK (15<<18) +#define LIBSSH2_KNOWNHOST_KEY_SHIFT 18 +#define LIBSSH2_KNOWNHOST_KEY_RSA1 (1<<18) +#define LIBSSH2_KNOWNHOST_KEY_SSHRSA (2<<18) +#define LIBSSH2_KNOWNHOST_KEY_SSHDSS (3<<18) /* deprecated */ +#define LIBSSH2_KNOWNHOST_KEY_ECDSA_256 (4<<18) +#define LIBSSH2_KNOWNHOST_KEY_ECDSA_384 (5<<18) +#define LIBSSH2_KNOWNHOST_KEY_ECDSA_521 (6<<18) +#define LIBSSH2_KNOWNHOST_KEY_ED25519 (7<<18) +#define LIBSSH2_KNOWNHOST_KEY_UNKNOWN (15<<18) + +LIBSSH2_API int +libssh2_knownhost_add(LIBSSH2_KNOWNHOSTS *hosts, + const char *host, + const char *salt, + const char *key, size_t keylen, int typemask, + struct libssh2_knownhost **store); + +/* + * libssh2_knownhost_addc() + * + * Add a host and its associated key to the collection of known hosts. + * + * Takes a comment argument that may be NULL. A NULL comment indicates + * there is no comment and the entry will end directly after the key + * when written out to a file. An empty string "" comment will indicate an + * empty comment which will cause a single space to be written after the key. + * + * The 'type' argument specifies on what format the given host and keys are: + * + * plain - ascii "hostname.domain.tld" + * sha1 - SHA1( ) base64-encoded! + * custom - another hash + * + * If 'sha1' is selected as type, the salt must be provided to the salt + * argument. This too base64 encoded. + * + * The SHA-1 hash is what OpenSSH can be told to use in known_hosts files. + * If a custom type is used, salt is ignored and you must provide the host + * pre-hashed when checking for it in the libssh2_knownhost_check() function. + * + * The keylen parameter may be omitted (zero) if the key is provided as a + * NULL-terminated base64-encoded string. + */ + +LIBSSH2_API int +libssh2_knownhost_addc(LIBSSH2_KNOWNHOSTS *hosts, + const char *host, + const char *salt, + const char *key, size_t keylen, + const char *comment, size_t commentlen, int typemask, + struct libssh2_knownhost **store); + +/* + * libssh2_knownhost_check() + * + * Check a host and its associated key against the collection of known hosts. + * + * The type is the type/format of the given host name. + * + * plain - ascii "hostname.domain.tld" + * custom - prehashed base64 encoded. Note that this cannot use any salts. + * + * + * 'knownhost' may be set to NULL if you don't care about that info. + * + * Returns: + * + * LIBSSH2_KNOWNHOST_CHECK_* values, see below + * + */ + +#define LIBSSH2_KNOWNHOST_CHECK_MATCH 0 +#define LIBSSH2_KNOWNHOST_CHECK_MISMATCH 1 +#define LIBSSH2_KNOWNHOST_CHECK_NOTFOUND 2 +#define LIBSSH2_KNOWNHOST_CHECK_FAILURE 3 + +LIBSSH2_API int +libssh2_knownhost_check(LIBSSH2_KNOWNHOSTS *hosts, + const char *host, const char *key, size_t keylen, + int typemask, + struct libssh2_knownhost **knownhost); + +/* this function is identital to the above one, but also takes a port + argument that allows libssh2 to do a better check */ +LIBSSH2_API int +libssh2_knownhost_checkp(LIBSSH2_KNOWNHOSTS *hosts, + const char *host, int port, + const char *key, size_t keylen, + int typemask, + struct libssh2_knownhost **knownhost); + +/* + * libssh2_knownhost_del() + * + * Remove a host from the collection of known hosts. The 'entry' struct is + * retrieved by a call to libssh2_knownhost_check(). + * + */ +LIBSSH2_API int +libssh2_knownhost_del(LIBSSH2_KNOWNHOSTS *hosts, + struct libssh2_knownhost *entry); + +/* + * libssh2_knownhost_free() + * + * Free an entire collection of known hosts. + * + */ +LIBSSH2_API void +libssh2_knownhost_free(LIBSSH2_KNOWNHOSTS *hosts); + +/* + * libssh2_knownhost_readline() + * + * Pass in a line of a file of 'type'. It makes libssh2 read this line. + * + * LIBSSH2_KNOWNHOST_FILE_OPENSSH is the only supported type. + * + */ +LIBSSH2_API int +libssh2_knownhost_readline(LIBSSH2_KNOWNHOSTS *hosts, + const char *line, size_t len, int type); + +/* + * libssh2_knownhost_readfile() + * + * Add hosts+key pairs from a given file. + * + * Returns a negative value for error or number of successfully added hosts. + * + * This implementation currently only knows one 'type' (openssh), all others + * are reserved for future use. + */ + +#define LIBSSH2_KNOWNHOST_FILE_OPENSSH 1 + +LIBSSH2_API int +libssh2_knownhost_readfile(LIBSSH2_KNOWNHOSTS *hosts, + const char *filename, int type); + +/* + * libssh2_knownhost_writeline() + * + * Ask libssh2 to convert a known host to an output line for storage. + * + * Note that this function returns LIBSSH2_ERROR_BUFFER_TOO_SMALL if the given + * output buffer is too small to hold the desired output. + * + * This implementation currently only knows one 'type' (openssh), all others + * are reserved for future use. + * + */ +LIBSSH2_API int +libssh2_knownhost_writeline(LIBSSH2_KNOWNHOSTS *hosts, + struct libssh2_knownhost *known, + char *buffer, size_t buflen, + size_t *outlen, /* the amount of written data */ + int type); + +/* + * libssh2_knownhost_writefile() + * + * Write hosts+key pairs to a given file. + * + * This implementation currently only knows one 'type' (openssh), all others + * are reserved for future use. + */ + +LIBSSH2_API int +libssh2_knownhost_writefile(LIBSSH2_KNOWNHOSTS *hosts, + const char *filename, int type); + +/* + * libssh2_knownhost_get() + * + * Traverse the internal list of known hosts. Pass NULL to 'prev' to get + * the first one. Or pass a pointer to the previously returned one to get the + * next. + * + * Returns: + * 0 if a fine host was stored in 'store' + * 1 if end of hosts + * [negative] on errors + */ +LIBSSH2_API int +libssh2_knownhost_get(LIBSSH2_KNOWNHOSTS *hosts, + struct libssh2_knownhost **store, + struct libssh2_knownhost *prev); + +#define HAVE_LIBSSH2_AGENT_API 0x010202 /* since 1.2.2 */ + +struct libssh2_agent_publickey { + unsigned int magic; /* magic stored by the library */ + void *node; /* handle to the internal representation of key */ + unsigned char *blob; /* public key blob */ + size_t blob_len; /* length of the public key blob */ + char *comment; /* comment in printable format */ +}; + +/* + * libssh2_agent_init() + * + * Init an ssh-agent handle. Returns the pointer to the handle. + * + */ +LIBSSH2_API LIBSSH2_AGENT * +libssh2_agent_init(LIBSSH2_SESSION *session); + +/* + * libssh2_agent_connect() + * + * Connect to an ssh-agent. + * + * Returns 0 if succeeded, or a negative value for error. + */ +LIBSSH2_API int +libssh2_agent_connect(LIBSSH2_AGENT *agent); + +/* + * libssh2_agent_list_identities() + * + * Request an ssh-agent to list identities. + * + * Returns 0 if succeeded, or a negative value for error. + */ +LIBSSH2_API int +libssh2_agent_list_identities(LIBSSH2_AGENT *agent); + +/* + * libssh2_agent_get_identity() + * + * Traverse the internal list of public keys. Pass NULL to 'prev' to get + * the first one. Or pass a pointer to the previously returned one to get the + * next. + * + * Returns: + * 0 if a fine public key was stored in 'store' + * 1 if end of public keys + * [negative] on errors + */ +LIBSSH2_API int +libssh2_agent_get_identity(LIBSSH2_AGENT *agent, + struct libssh2_agent_publickey **store, + struct libssh2_agent_publickey *prev); + +/* + * libssh2_agent_userauth() + * + * Do publickey user authentication with the help of ssh-agent. + * + * Returns 0 if succeeded, or a negative value for error. + */ +LIBSSH2_API int +libssh2_agent_userauth(LIBSSH2_AGENT *agent, + const char *username, + struct libssh2_agent_publickey *identity); + +/* + * libssh2_agent_sign() + * + * Sign a payload using a system-installed ssh-agent. + * + * Returns 0 if succeeded, or a negative value for error. + */ +LIBSSH2_API int +libssh2_agent_sign(LIBSSH2_AGENT *agent, + struct libssh2_agent_publickey *identity, + unsigned char **sig, + size_t *s_len, + const unsigned char *data, + size_t d_len, + const char *method, + unsigned int method_len); + +/* + * libssh2_agent_disconnect() + * + * Close a connection to an ssh-agent. + * + * Returns 0 if succeeded, or a negative value for error. + */ +LIBSSH2_API int +libssh2_agent_disconnect(LIBSSH2_AGENT *agent); + +/* + * libssh2_agent_free() + * + * Free an ssh-agent handle. This function also frees the internal + * collection of public keys. + */ +LIBSSH2_API void +libssh2_agent_free(LIBSSH2_AGENT *agent); + +/* + * libssh2_agent_set_identity_path() + * + * Allows a custom agent identity socket path beyond SSH_AUTH_SOCK env + * + */ +LIBSSH2_API void +libssh2_agent_set_identity_path(LIBSSH2_AGENT *agent, + const char *path); + +/* + * libssh2_agent_get_identity_path() + * + * Returns the custom agent identity socket path if set + * + */ +LIBSSH2_API const char * +libssh2_agent_get_identity_path(LIBSSH2_AGENT *agent); + +/* + * libssh2_keepalive_config() + * + * Set how often keepalive messages should be sent. WANT_REPLY + * indicates whether the keepalive messages should request a response + * from the server. INTERVAL is number of seconds that can pass + * without any I/O, use 0 (the default) to disable keepalives. To + * avoid some busy-loop corner-cases, if you specify an interval of 1 + * it will be treated as 2. + * + * Note that non-blocking applications are responsible for sending the + * keepalive messages using libssh2_keepalive_send(). + */ +LIBSSH2_API void libssh2_keepalive_config(LIBSSH2_SESSION *session, + int want_reply, + unsigned int interval); + +/* + * libssh2_keepalive_send() + * + * Send a keepalive message if needed. SECONDS_TO_NEXT indicates how + * many seconds you can sleep after this call before you need to call + * it again. Returns 0 on success, or LIBSSH2_ERROR_SOCKET_SEND on + * I/O errors. + */ +LIBSSH2_API int libssh2_keepalive_send(LIBSSH2_SESSION *session, + int *seconds_to_next); + +/* NOTE NOTE NOTE + libssh2_trace() has no function in builds that aren't built with debug + enabled + */ +LIBSSH2_API int libssh2_trace(LIBSSH2_SESSION *session, int bitmask); +#define LIBSSH2_TRACE_TRANS (1<<1) +#define LIBSSH2_TRACE_KEX (1<<2) +#define LIBSSH2_TRACE_AUTH (1<<3) +#define LIBSSH2_TRACE_CONN (1<<4) +#define LIBSSH2_TRACE_SCP (1<<5) +#define LIBSSH2_TRACE_SFTP (1<<6) +#define LIBSSH2_TRACE_ERROR (1<<7) +#define LIBSSH2_TRACE_PUBLICKEY (1<<8) +#define LIBSSH2_TRACE_SOCKET (1<<9) + +typedef void (*libssh2_trace_handler_func)(LIBSSH2_SESSION*, + void *, + const char *, + size_t); +LIBSSH2_API int libssh2_trace_sethandler(LIBSSH2_SESSION *session, + void *context, + libssh2_trace_handler_func callback); + +#ifdef __cplusplus +} /* extern "C" */ +#endif + +#endif /* !RC_INVOKED */ + +#endif /* LIBSSH2_H */ diff --git a/curl/include/libssh2_publickey.h b/curl/include/libssh2_publickey.h new file mode 100644 index 0000000..566acd6 --- /dev/null +++ b/curl/include/libssh2_publickey.h @@ -0,0 +1,128 @@ +/* Copyright (C) Sara Golemon + * All rights reserved. + * + * Redistribution and use in source and binary forms, + * with or without modification, are permitted provided + * that the following conditions are met: + * + * Redistributions of source code must retain the above + * copyright notice, this list of conditions and the + * following disclaimer. + * + * Redistributions in binary form must reproduce the above + * copyright notice, this list of conditions and the following + * disclaimer in the documentation and/or other materials + * provided with the distribution. + * + * Neither the name of the copyright holder nor the names + * of any other contributors may be used to endorse or + * promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND + * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY + * OF SUCH DAMAGE. + */ + +/* Note: This include file is only needed for using the + * publickey SUBSYSTEM which is not the same as publickey + * authentication. For authentication you only need libssh2.h + * + * For more information on the publickey subsystem, + * refer to IETF draft: secsh-publickey + * + * SPDX-License-Identifier: BSD-3-Clause + */ + +#ifndef LIBSSH2_PUBLICKEY_H +#define LIBSSH2_PUBLICKEY_H 1 + +#include "libssh2.h" + +typedef struct _LIBSSH2_PUBLICKEY LIBSSH2_PUBLICKEY; + +typedef struct _libssh2_publickey_attribute { + const char *name; + unsigned long name_len; + const char *value; + unsigned long value_len; + char mandatory; +} libssh2_publickey_attribute; + +typedef struct _libssh2_publickey_list { + unsigned char *packet; /* For freeing */ + + const unsigned char *name; + unsigned long name_len; + const unsigned char *blob; + unsigned long blob_len; + unsigned long num_attrs; + libssh2_publickey_attribute *attrs; /* free me */ +} libssh2_publickey_list; + +/* Generally use the first macro here, but if both name and value are string + literals, you can use _fast() to take advantage of preprocessing */ +#define libssh2_publickey_attribute(name, value, mandatory) \ + { (name), strlen(name), (value), strlen(value), (mandatory) }, +#define libssh2_publickey_attribute_fast(name, value, mandatory) \ + { (name), sizeof(name) - 1, (value), sizeof(value) - 1, (mandatory) }, + +#ifdef __cplusplus +extern "C" { +#endif + +/* Publickey Subsystem */ +LIBSSH2_API LIBSSH2_PUBLICKEY * +libssh2_publickey_init(LIBSSH2_SESSION *session); + +LIBSSH2_API int +libssh2_publickey_add_ex(LIBSSH2_PUBLICKEY *pkey, + const unsigned char *name, + unsigned long name_len, + const unsigned char *blob, + unsigned long blob_len, char overwrite, + unsigned long num_attrs, + const libssh2_publickey_attribute attrs[]); +#define libssh2_publickey_add(pkey, name, blob, blob_len, overwrite, \ + num_attrs, attrs) \ + libssh2_publickey_add_ex((pkey), \ + (name), strlen(name), \ + (blob), (blob_len), \ + (overwrite), (num_attrs), (attrs)) + +LIBSSH2_API int libssh2_publickey_remove_ex(LIBSSH2_PUBLICKEY *pkey, + const unsigned char *name, + unsigned long name_len, + const unsigned char *blob, + unsigned long blob_len); +#define libssh2_publickey_remove(pkey, name, blob, blob_len) \ + libssh2_publickey_remove_ex((pkey), \ + (name), strlen(name), \ + (blob), (blob_len)) + +LIBSSH2_API int +libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY *pkey, + unsigned long *num_keys, + libssh2_publickey_list **pkey_list); +LIBSSH2_API void +libssh2_publickey_list_free(LIBSSH2_PUBLICKEY *pkey, + libssh2_publickey_list *pkey_list); + +LIBSSH2_API int libssh2_publickey_shutdown(LIBSSH2_PUBLICKEY *pkey); + +#ifdef __cplusplus +} /* extern "C" */ +#endif + +#endif /* LIBSSH2_PUBLICKEY_H */ diff --git a/curl/include/libssh2_sftp.h b/curl/include/libssh2_sftp.h new file mode 100644 index 0000000..ab7b0af --- /dev/null +++ b/curl/include/libssh2_sftp.h @@ -0,0 +1,382 @@ +/* Copyright (C) Sara Golemon + * All rights reserved. + * + * Redistribution and use in source and binary forms, + * with or without modification, are permitted provided + * that the following conditions are met: + * + * Redistributions of source code must retain the above + * copyright notice, this list of conditions and the + * following disclaimer. + * + * Redistributions in binary form must reproduce the above + * copyright notice, this list of conditions and the following + * disclaimer in the documentation and/or other materials + * provided with the distribution. + * + * Neither the name of the copyright holder nor the names + * of any other contributors may be used to endorse or + * promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND + * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY + * OF SUCH DAMAGE. + * + * SPDX-License-Identifier: BSD-3-Clause + */ + +#ifndef LIBSSH2_SFTP_H +#define LIBSSH2_SFTP_H 1 + +#include "libssh2.h" + +#ifndef _WIN32 +#include +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/* Note: Version 6 was documented at the time of writing + * However it was marked as "DO NOT IMPLEMENT" due to pending changes + * + * Let's start with Version 3 (The version found in OpenSSH) and go from there + */ +#define LIBSSH2_SFTP_VERSION 3 + +typedef struct _LIBSSH2_SFTP LIBSSH2_SFTP; +typedef struct _LIBSSH2_SFTP_HANDLE LIBSSH2_SFTP_HANDLE; +typedef struct _LIBSSH2_SFTP_ATTRIBUTES LIBSSH2_SFTP_ATTRIBUTES; +typedef struct _LIBSSH2_SFTP_STATVFS LIBSSH2_SFTP_STATVFS; + +/* Flags for open_ex() */ +#define LIBSSH2_SFTP_OPENFILE 0 +#define LIBSSH2_SFTP_OPENDIR 1 + +/* Flags for rename_ex() */ +#define LIBSSH2_SFTP_RENAME_OVERWRITE 0x00000001 +#define LIBSSH2_SFTP_RENAME_ATOMIC 0x00000002 +#define LIBSSH2_SFTP_RENAME_NATIVE 0x00000004 + +/* Flags for stat_ex() */ +#define LIBSSH2_SFTP_STAT 0 +#define LIBSSH2_SFTP_LSTAT 1 +#define LIBSSH2_SFTP_SETSTAT 2 + +/* Flags for symlink_ex() */ +#define LIBSSH2_SFTP_SYMLINK 0 +#define LIBSSH2_SFTP_READLINK 1 +#define LIBSSH2_SFTP_REALPATH 2 + +/* Flags for sftp_mkdir() */ +#define LIBSSH2_SFTP_DEFAULT_MODE -1 + +/* SFTP attribute flag bits */ +#define LIBSSH2_SFTP_ATTR_SIZE 0x00000001 +#define LIBSSH2_SFTP_ATTR_UIDGID 0x00000002 +#define LIBSSH2_SFTP_ATTR_PERMISSIONS 0x00000004 +#define LIBSSH2_SFTP_ATTR_ACMODTIME 0x00000008 +#define LIBSSH2_SFTP_ATTR_EXTENDED 0x80000000 + +/* SFTP statvfs flag bits */ +#define LIBSSH2_SFTP_ST_RDONLY 0x00000001 +#define LIBSSH2_SFTP_ST_NOSUID 0x00000002 + +struct _LIBSSH2_SFTP_ATTRIBUTES { + /* If flags & ATTR_* bit is set, then the value in this struct will be + * meaningful Otherwise it should be ignored + */ + unsigned long flags; + + libssh2_uint64_t filesize; + unsigned long uid, gid; + unsigned long permissions; + unsigned long atime, mtime; +}; + +struct _LIBSSH2_SFTP_STATVFS { + libssh2_uint64_t f_bsize; /* file system block size */ + libssh2_uint64_t f_frsize; /* fragment size */ + libssh2_uint64_t f_blocks; /* size of fs in f_frsize units */ + libssh2_uint64_t f_bfree; /* # free blocks */ + libssh2_uint64_t f_bavail; /* # free blocks for non-root */ + libssh2_uint64_t f_files; /* # inodes */ + libssh2_uint64_t f_ffree; /* # free inodes */ + libssh2_uint64_t f_favail; /* # free inodes for non-root */ + libssh2_uint64_t f_fsid; /* file system ID */ + libssh2_uint64_t f_flag; /* mount flags */ + libssh2_uint64_t f_namemax; /* maximum filename length */ +}; + +/* SFTP filetypes */ +#define LIBSSH2_SFTP_TYPE_REGULAR 1 +#define LIBSSH2_SFTP_TYPE_DIRECTORY 2 +#define LIBSSH2_SFTP_TYPE_SYMLINK 3 +#define LIBSSH2_SFTP_TYPE_SPECIAL 4 +#define LIBSSH2_SFTP_TYPE_UNKNOWN 5 +#define LIBSSH2_SFTP_TYPE_SOCKET 6 +#define LIBSSH2_SFTP_TYPE_CHAR_DEVICE 7 +#define LIBSSH2_SFTP_TYPE_BLOCK_DEVICE 8 +#define LIBSSH2_SFTP_TYPE_FIFO 9 + +/* + * Reproduce the POSIX file modes here for systems that are not POSIX + * compliant. + * + * These is used in "permissions" of "struct _LIBSSH2_SFTP_ATTRIBUTES" + */ +/* File type */ +#define LIBSSH2_SFTP_S_IFMT 0170000 /* type of file mask */ +#define LIBSSH2_SFTP_S_IFIFO 0010000 /* named pipe (fifo) */ +#define LIBSSH2_SFTP_S_IFCHR 0020000 /* character special */ +#define LIBSSH2_SFTP_S_IFDIR 0040000 /* directory */ +#define LIBSSH2_SFTP_S_IFBLK 0060000 /* block special */ +#define LIBSSH2_SFTP_S_IFREG 0100000 /* regular */ +#define LIBSSH2_SFTP_S_IFLNK 0120000 /* symbolic link */ +#define LIBSSH2_SFTP_S_IFSOCK 0140000 /* socket */ + +/* File mode */ +/* Read, write, execute/search by owner */ +#define LIBSSH2_SFTP_S_IRWXU 0000700 /* RWX mask for owner */ +#define LIBSSH2_SFTP_S_IRUSR 0000400 /* R for owner */ +#define LIBSSH2_SFTP_S_IWUSR 0000200 /* W for owner */ +#define LIBSSH2_SFTP_S_IXUSR 0000100 /* X for owner */ +/* Read, write, execute/search by group */ +#define LIBSSH2_SFTP_S_IRWXG 0000070 /* RWX mask for group */ +#define LIBSSH2_SFTP_S_IRGRP 0000040 /* R for group */ +#define LIBSSH2_SFTP_S_IWGRP 0000020 /* W for group */ +#define LIBSSH2_SFTP_S_IXGRP 0000010 /* X for group */ +/* Read, write, execute/search by others */ +#define LIBSSH2_SFTP_S_IRWXO 0000007 /* RWX mask for other */ +#define LIBSSH2_SFTP_S_IROTH 0000004 /* R for other */ +#define LIBSSH2_SFTP_S_IWOTH 0000002 /* W for other */ +#define LIBSSH2_SFTP_S_IXOTH 0000001 /* X for other */ + +/* macros to check for specific file types, added in 1.2.5 */ +#define LIBSSH2_SFTP_S_ISLNK(m) \ + (((m) & LIBSSH2_SFTP_S_IFMT) == LIBSSH2_SFTP_S_IFLNK) +#define LIBSSH2_SFTP_S_ISREG(m) \ + (((m) & LIBSSH2_SFTP_S_IFMT) == LIBSSH2_SFTP_S_IFREG) +#define LIBSSH2_SFTP_S_ISDIR(m) \ + (((m) & LIBSSH2_SFTP_S_IFMT) == LIBSSH2_SFTP_S_IFDIR) +#define LIBSSH2_SFTP_S_ISCHR(m) \ + (((m) & LIBSSH2_SFTP_S_IFMT) == LIBSSH2_SFTP_S_IFCHR) +#define LIBSSH2_SFTP_S_ISBLK(m) \ + (((m) & LIBSSH2_SFTP_S_IFMT) == LIBSSH2_SFTP_S_IFBLK) +#define LIBSSH2_SFTP_S_ISFIFO(m) \ + (((m) & LIBSSH2_SFTP_S_IFMT) == LIBSSH2_SFTP_S_IFIFO) +#define LIBSSH2_SFTP_S_ISSOCK(m) \ + (((m) & LIBSSH2_SFTP_S_IFMT) == LIBSSH2_SFTP_S_IFSOCK) + +/* SFTP File Transfer Flags -- (e.g. flags parameter to sftp_open()) + * Danger will robinson... APPEND doesn't have any effect on OpenSSH servers */ +#define LIBSSH2_FXF_READ 0x00000001 +#define LIBSSH2_FXF_WRITE 0x00000002 +#define LIBSSH2_FXF_APPEND 0x00000004 +#define LIBSSH2_FXF_CREAT 0x00000008 +#define LIBSSH2_FXF_TRUNC 0x00000010 +#define LIBSSH2_FXF_EXCL 0x00000020 + +/* SFTP Status Codes (returned by libssh2_sftp_last_error() ) */ +#define LIBSSH2_FX_OK 0UL +#define LIBSSH2_FX_EOF 1UL +#define LIBSSH2_FX_NO_SUCH_FILE 2UL +#define LIBSSH2_FX_PERMISSION_DENIED 3UL +#define LIBSSH2_FX_FAILURE 4UL +#define LIBSSH2_FX_BAD_MESSAGE 5UL +#define LIBSSH2_FX_NO_CONNECTION 6UL +#define LIBSSH2_FX_CONNECTION_LOST 7UL +#define LIBSSH2_FX_OP_UNSUPPORTED 8UL +#define LIBSSH2_FX_INVALID_HANDLE 9UL +#define LIBSSH2_FX_NO_SUCH_PATH 10UL +#define LIBSSH2_FX_FILE_ALREADY_EXISTS 11UL +#define LIBSSH2_FX_WRITE_PROTECT 12UL +#define LIBSSH2_FX_NO_MEDIA 13UL +#define LIBSSH2_FX_NO_SPACE_ON_FILESYSTEM 14UL +#define LIBSSH2_FX_QUOTA_EXCEEDED 15UL +#define LIBSSH2_FX_UNKNOWN_PRINCIPLE 16UL /* Initial mis-spelling */ +#define LIBSSH2_FX_UNKNOWN_PRINCIPAL 16UL +#define LIBSSH2_FX_LOCK_CONFlICT 17UL /* Initial mis-spelling */ +#define LIBSSH2_FX_LOCK_CONFLICT 17UL +#define LIBSSH2_FX_DIR_NOT_EMPTY 18UL +#define LIBSSH2_FX_NOT_A_DIRECTORY 19UL +#define LIBSSH2_FX_INVALID_FILENAME 20UL +#define LIBSSH2_FX_LINK_LOOP 21UL + +/* Returned by any function that would block during a read/write operation */ +#define LIBSSH2SFTP_EAGAIN LIBSSH2_ERROR_EAGAIN + +/* SFTP API */ +LIBSSH2_API LIBSSH2_SFTP *libssh2_sftp_init(LIBSSH2_SESSION *session); +LIBSSH2_API int libssh2_sftp_shutdown(LIBSSH2_SFTP *sftp); +LIBSSH2_API unsigned long libssh2_sftp_last_error(LIBSSH2_SFTP *sftp); +LIBSSH2_API LIBSSH2_CHANNEL *libssh2_sftp_get_channel(LIBSSH2_SFTP *sftp); + +/* File / Directory Ops */ +LIBSSH2_API LIBSSH2_SFTP_HANDLE * +libssh2_sftp_open_ex(LIBSSH2_SFTP *sftp, + const char *filename, + unsigned int filename_len, + unsigned long flags, + long mode, int open_type); +#define libssh2_sftp_open(sftp, filename, flags, mode) \ + libssh2_sftp_open_ex((sftp), \ + (filename), (unsigned int)strlen(filename), \ + (flags), (mode), LIBSSH2_SFTP_OPENFILE) +#define libssh2_sftp_opendir(sftp, path) \ + libssh2_sftp_open_ex((sftp), \ + (path), (unsigned int)strlen(path), \ + 0, 0, LIBSSH2_SFTP_OPENDIR) +LIBSSH2_API LIBSSH2_SFTP_HANDLE * +libssh2_sftp_open_ex_r(LIBSSH2_SFTP *sftp, + const char *filename, + size_t filename_len, + unsigned long flags, + long mode, int open_type, + LIBSSH2_SFTP_ATTRIBUTES *attrs); +#define libssh2_sftp_open_r(sftp, filename, flags, mode, attrs) \ + libssh2_sftp_open_ex_r((sftp), (filename), strlen(filename), \ + (flags), (mode), LIBSSH2_SFTP_OPENFILE, \ + (attrs)) + +LIBSSH2_API ssize_t libssh2_sftp_read(LIBSSH2_SFTP_HANDLE *handle, + char *buffer, size_t buffer_maxlen); + +LIBSSH2_API int libssh2_sftp_readdir_ex(LIBSSH2_SFTP_HANDLE *handle, \ + char *buffer, size_t buffer_maxlen, + char *longentry, + size_t longentry_maxlen, + LIBSSH2_SFTP_ATTRIBUTES *attrs); +#define libssh2_sftp_readdir(handle, buffer, buffer_maxlen, attrs) \ + libssh2_sftp_readdir_ex((handle), (buffer), (buffer_maxlen), NULL, 0, \ + (attrs)) + +LIBSSH2_API ssize_t libssh2_sftp_write(LIBSSH2_SFTP_HANDLE *handle, + const char *buffer, size_t count); +LIBSSH2_API int libssh2_sftp_fsync(LIBSSH2_SFTP_HANDLE *handle); + +LIBSSH2_API int libssh2_sftp_close_handle(LIBSSH2_SFTP_HANDLE *handle); +#define libssh2_sftp_close(handle) libssh2_sftp_close_handle(handle) +#define libssh2_sftp_closedir(handle) libssh2_sftp_close_handle(handle) + +LIBSSH2_API void libssh2_sftp_seek(LIBSSH2_SFTP_HANDLE *handle, size_t offset); +LIBSSH2_API void libssh2_sftp_seek64(LIBSSH2_SFTP_HANDLE *handle, + libssh2_uint64_t offset); +#define libssh2_sftp_rewind(handle) libssh2_sftp_seek64((handle), 0) + +LIBSSH2_API size_t libssh2_sftp_tell(LIBSSH2_SFTP_HANDLE *handle); +LIBSSH2_API libssh2_uint64_t libssh2_sftp_tell64(LIBSSH2_SFTP_HANDLE *handle); + +LIBSSH2_API int libssh2_sftp_fstat_ex(LIBSSH2_SFTP_HANDLE *handle, + LIBSSH2_SFTP_ATTRIBUTES *attrs, + int setstat); +#define libssh2_sftp_fstat(handle, attrs) \ + libssh2_sftp_fstat_ex((handle), (attrs), 0) +#define libssh2_sftp_fsetstat(handle, attrs) \ + libssh2_sftp_fstat_ex((handle), (attrs), 1) + +/* Miscellaneous Ops */ +LIBSSH2_API int libssh2_sftp_rename_ex(LIBSSH2_SFTP *sftp, + const char *source_filename, + unsigned int srouce_filename_len, + const char *dest_filename, + unsigned int dest_filename_len, + long flags); +#define libssh2_sftp_rename(sftp, sourcefile, destfile) \ + libssh2_sftp_rename_ex((sftp), \ + (sourcefile), (unsigned int)strlen(sourcefile), \ + (destfile), (unsigned int)strlen(destfile), \ + LIBSSH2_SFTP_RENAME_OVERWRITE | \ + LIBSSH2_SFTP_RENAME_ATOMIC | \ + LIBSSH2_SFTP_RENAME_NATIVE) + +LIBSSH2_API int libssh2_sftp_posix_rename_ex(LIBSSH2_SFTP *sftp, + const char *source_filename, + size_t srouce_filename_len, + const char *dest_filename, + size_t dest_filename_len); +#define libssh2_sftp_posix_rename(sftp, sourcefile, destfile) \ + libssh2_sftp_posix_rename_ex((sftp), (sourcefile), strlen(sourcefile), \ + (destfile), strlen(destfile)) + +LIBSSH2_API int libssh2_sftp_unlink_ex(LIBSSH2_SFTP *sftp, + const char *filename, + unsigned int filename_len); +#define libssh2_sftp_unlink(sftp, filename) \ + libssh2_sftp_unlink_ex((sftp), (filename), (unsigned int)strlen(filename)) + +LIBSSH2_API int libssh2_sftp_fstatvfs(LIBSSH2_SFTP_HANDLE *handle, + LIBSSH2_SFTP_STATVFS *st); + +LIBSSH2_API int libssh2_sftp_statvfs(LIBSSH2_SFTP *sftp, + const char *path, + size_t path_len, + LIBSSH2_SFTP_STATVFS *st); + +LIBSSH2_API int libssh2_sftp_mkdir_ex(LIBSSH2_SFTP *sftp, + const char *path, + unsigned int path_len, long mode); +#define libssh2_sftp_mkdir(sftp, path, mode) \ + libssh2_sftp_mkdir_ex((sftp), (path), (unsigned int)strlen(path), (mode)) + +LIBSSH2_API int libssh2_sftp_rmdir_ex(LIBSSH2_SFTP *sftp, + const char *path, + unsigned int path_len); +#define libssh2_sftp_rmdir(sftp, path) \ + libssh2_sftp_rmdir_ex((sftp), (path), (unsigned int)strlen(path)) + +LIBSSH2_API int libssh2_sftp_stat_ex(LIBSSH2_SFTP *sftp, + const char *path, + unsigned int path_len, + int stat_type, + LIBSSH2_SFTP_ATTRIBUTES *attrs); +#define libssh2_sftp_stat(sftp, path, attrs) \ + libssh2_sftp_stat_ex((sftp), (path), (unsigned int)strlen(path), \ + LIBSSH2_SFTP_STAT, (attrs)) +#define libssh2_sftp_lstat(sftp, path, attrs) \ + libssh2_sftp_stat_ex((sftp), (path), (unsigned int)strlen(path), \ + LIBSSH2_SFTP_LSTAT, (attrs)) +#define libssh2_sftp_setstat(sftp, path, attrs) \ + libssh2_sftp_stat_ex((sftp), (path), (unsigned int)strlen(path), \ + LIBSSH2_SFTP_SETSTAT, (attrs)) + +LIBSSH2_API int libssh2_sftp_symlink_ex(LIBSSH2_SFTP *sftp, + const char *path, + unsigned int path_len, + char *target, + unsigned int target_len, + int link_type); +#define libssh2_sftp_symlink(sftp, orig, linkpath) \ + libssh2_sftp_symlink_ex((sftp), \ + (orig), (unsigned int)strlen(orig), \ + (linkpath), (unsigned int)strlen(linkpath), \ + LIBSSH2_SFTP_SYMLINK) +#define libssh2_sftp_readlink(sftp, path, target, maxlen) \ + libssh2_sftp_symlink_ex((sftp), \ + (path), (unsigned int)strlen(path), \ + (target), (maxlen), \ + LIBSSH2_SFTP_READLINK) +#define libssh2_sftp_realpath(sftp, path, target, maxlen) \ + libssh2_sftp_symlink_ex((sftp), \ + (path), (unsigned int)strlen(path), \ + (target), (maxlen), \ + LIBSSH2_SFTP_REALPATH) + +#ifdef __cplusplus +} /* extern "C" */ +#endif + +#endif /* LIBSSH2_SFTP_H */ diff --git a/curl/include/nghttp2/nghttp2.h b/curl/include/nghttp2/nghttp2.h new file mode 100644 index 0000000..3d91af5 --- /dev/null +++ b/curl/include/nghttp2/nghttp2.h @@ -0,0 +1,6838 @@ +/* + * nghttp2 - HTTP/2 C Library + * + * Copyright (c) 2013, 2014 Tatsuhiro Tsujikawa + * + * Permission is hereby granted, free of charge, to any person obtaining + * a copy of this software and associated documentation files (the + * "Software"), to deal in the Software without restriction, including + * without limitation the rights to use, copy, modify, merge, publish, + * distribute, sublicense, and/or sell copies of the Software, and to + * permit persons to whom the Software is furnished to do so, subject to + * the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + */ +#ifndef NGHTTP2_H +#define NGHTTP2_H + +/* Define WIN32 when build target is Win32 API (borrowed from + libcurl) */ +#if (defined(_WIN32) || defined(__WIN32__)) && !defined(WIN32) +# define WIN32 +#endif + +/* Compatibility for non-Clang compilers */ +#ifndef __has_declspec_attribute +# define __has_declspec_attribute(x) 0 +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +#include +#if defined(_MSC_VER) && (_MSC_VER < 1800) +/* MSVC < 2013 does not have inttypes.h because it is not C99 + compliant. See compiler macros and version number in + https://sourceforge.net/p/predef/wiki/Compilers/ */ +# include +#else /* !defined(_MSC_VER) || (_MSC_VER >= 1800) */ +# include +#endif /* !defined(_MSC_VER) || (_MSC_VER >= 1800) */ +#include +#include +#include + +#include + +#ifdef NGHTTP2_STATICLIB +# define NGHTTP2_EXTERN +#elif defined(WIN32) || \ + (__has_declspec_attribute(dllexport) && __has_declspec_attribute(dllimport)) +# ifdef BUILDING_NGHTTP2 +# define NGHTTP2_EXTERN __declspec(dllexport) +# else /* !BUILDING_NGHTTP2 */ +# define NGHTTP2_EXTERN __declspec(dllimport) +# endif /* !BUILDING_NGHTTP2 */ +#else /* !defined(WIN32) */ +# ifdef BUILDING_NGHTTP2 +# define NGHTTP2_EXTERN __attribute__((visibility("default"))) +# else /* !BUILDING_NGHTTP2 */ +# define NGHTTP2_EXTERN +# endif /* !BUILDING_NGHTTP2 */ +#endif /* !defined(WIN32) */ + +#ifdef BUILDING_NGHTTP2 +# undef NGHTTP2_NO_SSIZE_T +#endif /* BUILDING_NGHTTP2 */ + +/** + * @typedef + * + * :type:`nghttp2_ssize` is a signed counterpart of size_t. + */ +typedef ptrdiff_t nghttp2_ssize; + +/** + * @macro + * + * The protocol version identification string of this library + * supports. This identifier is used if HTTP/2 is used over TLS. + */ +#define NGHTTP2_PROTO_VERSION_ID "h2" +/** + * @macro + * + * The length of :macro:`NGHTTP2_PROTO_VERSION_ID`. + */ +#define NGHTTP2_PROTO_VERSION_ID_LEN 2 + +/** + * @macro + * + * The serialized form of ALPN protocol identifier this library + * supports. Notice that first byte is the length of following + * protocol identifier. This is the same wire format of `TLS ALPN + * extension `_. This is useful + * to process incoming ALPN tokens in wire format. + */ +#define NGHTTP2_PROTO_ALPN "\x2h2" + +/** + * @macro + * + * The length of :macro:`NGHTTP2_PROTO_ALPN`. + */ +#define NGHTTP2_PROTO_ALPN_LEN (sizeof(NGHTTP2_PROTO_ALPN) - 1) + +/** + * @macro + * + * The protocol version identification string of this library + * supports. This identifier is used if HTTP/2 is used over cleartext + * TCP. + */ +#define NGHTTP2_CLEARTEXT_PROTO_VERSION_ID "h2c" + +/** + * @macro + * + * The length of :macro:`NGHTTP2_CLEARTEXT_PROTO_VERSION_ID`. + */ +#define NGHTTP2_CLEARTEXT_PROTO_VERSION_ID_LEN 3 + +struct nghttp2_session; +/** + * @struct + * + * The primary structure to hold the resources needed for a HTTP/2 + * session. The details of this structure are intentionally hidden + * from the public API. + */ +typedef struct nghttp2_session nghttp2_session; + +/** + * @macro + * + * The age of :type:`nghttp2_info` + */ +#define NGHTTP2_VERSION_AGE 1 + +/** + * @struct + * + * This struct is what `nghttp2_version()` returns. It holds + * information about the particular nghttp2 version. + */ +typedef struct { + /** + * Age of this struct. This instance of nghttp2 sets it to + * :macro:`NGHTTP2_VERSION_AGE` but a future version may bump it and + * add more struct fields at the bottom + */ + int age; + /** + * the :macro:`NGHTTP2_VERSION_NUM` number (since age ==1) + */ + int version_num; + /** + * points to the :macro:`NGHTTP2_VERSION` string (since age ==1) + */ + const char *version_str; + /** + * points to the :macro:`NGHTTP2_PROTO_VERSION_ID` string this + * instance implements (since age ==1) + */ + const char *proto_str; + /* -------- the above fields all exist when age == 1 */ +} nghttp2_info; + +/** + * @macro + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * The default weight of stream dependency. + */ +#define NGHTTP2_DEFAULT_WEIGHT 16 + +/** + * @macro + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * The maximum weight of stream dependency. + */ +#define NGHTTP2_MAX_WEIGHT 256 + +/** + * @macro + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * The minimum weight of stream dependency. + */ +#define NGHTTP2_MIN_WEIGHT 1 + +/** + * @macro + * + * The maximum window size + */ +#define NGHTTP2_MAX_WINDOW_SIZE ((int32_t)((1U << 31) - 1)) + +/** + * @macro + * + * The initial window size for stream level flow control. + */ +#define NGHTTP2_INITIAL_WINDOW_SIZE ((1 << 16) - 1) +/** + * @macro + * + * The initial window size for connection level flow control. + */ +#define NGHTTP2_INITIAL_CONNECTION_WINDOW_SIZE ((1 << 16) - 1) + +/** + * @macro + * + * The default header table size. + */ +#define NGHTTP2_DEFAULT_HEADER_TABLE_SIZE (1 << 12) + +/** + * @macro + * + * The client magic string, which is the first 24 bytes byte string of + * client connection preface. + */ +#define NGHTTP2_CLIENT_MAGIC "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n" + +/** + * @macro + * + * The length of :macro:`NGHTTP2_CLIENT_MAGIC`. + */ +#define NGHTTP2_CLIENT_MAGIC_LEN 24 + +/** + * @macro + * + * The default max number of settings per SETTINGS frame + */ +#define NGHTTP2_DEFAULT_MAX_SETTINGS 32 + +/** + * @enum + * + * Error codes used in this library. The code range is [-999, -500], + * inclusive. The following values are defined: + */ +typedef enum { + /** + * Invalid argument passed. + */ + NGHTTP2_ERR_INVALID_ARGUMENT = -501, + /** + * Out of buffer space. + */ + NGHTTP2_ERR_BUFFER_ERROR = -502, + /** + * The specified protocol version is not supported. + */ + NGHTTP2_ERR_UNSUPPORTED_VERSION = -503, + /** + * Used as a return value from :type:`nghttp2_send_callback2`, + * :type:`nghttp2_recv_callback` and + * :type:`nghttp2_send_data_callback` to indicate that the operation + * would block. + */ + NGHTTP2_ERR_WOULDBLOCK = -504, + /** + * General protocol error + */ + NGHTTP2_ERR_PROTO = -505, + /** + * The frame is invalid. + */ + NGHTTP2_ERR_INVALID_FRAME = -506, + /** + * The peer performed a shutdown on the connection. + */ + NGHTTP2_ERR_EOF = -507, + /** + * Used as a return value from + * :func:`nghttp2_data_source_read_callback2` to indicate that data + * transfer is postponed. See + * :func:`nghttp2_data_source_read_callback2` for details. + */ + NGHTTP2_ERR_DEFERRED = -508, + /** + * Stream ID has reached the maximum value. Therefore no stream ID + * is available. + */ + NGHTTP2_ERR_STREAM_ID_NOT_AVAILABLE = -509, + /** + * The stream is already closed; or the stream ID is invalid. + */ + NGHTTP2_ERR_STREAM_CLOSED = -510, + /** + * RST_STREAM has been added to the outbound queue. The stream is + * in closing state. + */ + NGHTTP2_ERR_STREAM_CLOSING = -511, + /** + * The transmission is not allowed for this stream (e.g., a frame + * with END_STREAM flag set has already sent). + */ + NGHTTP2_ERR_STREAM_SHUT_WR = -512, + /** + * The stream ID is invalid. + */ + NGHTTP2_ERR_INVALID_STREAM_ID = -513, + /** + * The state of the stream is not valid (e.g., DATA cannot be sent + * to the stream if response HEADERS has not been sent). + */ + NGHTTP2_ERR_INVALID_STREAM_STATE = -514, + /** + * Another DATA frame has already been deferred. + */ + NGHTTP2_ERR_DEFERRED_DATA_EXIST = -515, + /** + * Starting new stream is not allowed (e.g., GOAWAY has been sent + * and/or received). + */ + NGHTTP2_ERR_START_STREAM_NOT_ALLOWED = -516, + /** + * GOAWAY has already been sent. + */ + NGHTTP2_ERR_GOAWAY_ALREADY_SENT = -517, + /** + * The received frame contains the invalid header block (e.g., There + * are duplicate header names; or the header names are not encoded + * in US-ASCII character set and not lower cased; or the header name + * is zero-length string; or the header value contains multiple + * in-sequence NUL bytes). + */ + NGHTTP2_ERR_INVALID_HEADER_BLOCK = -518, + /** + * Indicates that the context is not suitable to perform the + * requested operation. + */ + NGHTTP2_ERR_INVALID_STATE = -519, + /** + * The user callback function failed due to the temporal error. + */ + NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE = -521, + /** + * The length of the frame is invalid, either too large or too small. + */ + NGHTTP2_ERR_FRAME_SIZE_ERROR = -522, + /** + * Header block inflate/deflate error. + */ + NGHTTP2_ERR_HEADER_COMP = -523, + /** + * Flow control error + */ + NGHTTP2_ERR_FLOW_CONTROL = -524, + /** + * Insufficient buffer size given to function. + */ + NGHTTP2_ERR_INSUFF_BUFSIZE = -525, + /** + * Callback was paused by the application + */ + NGHTTP2_ERR_PAUSE = -526, + /** + * There are too many in-flight SETTING frame and no more + * transmission of SETTINGS is allowed. + */ + NGHTTP2_ERR_TOO_MANY_INFLIGHT_SETTINGS = -527, + /** + * The server push is disabled. + */ + NGHTTP2_ERR_PUSH_DISABLED = -528, + /** + * DATA or HEADERS frame for a given stream has been already + * submitted and has not been fully processed yet. Application + * should wait for the transmission of the previously submitted + * frame before submitting another. + */ + NGHTTP2_ERR_DATA_EXIST = -529, + /** + * The current session is closing due to a connection error or + * `nghttp2_session_terminate_session()` is called. + */ + NGHTTP2_ERR_SESSION_CLOSING = -530, + /** + * Invalid HTTP header field was received and stream is going to be + * closed. + */ + NGHTTP2_ERR_HTTP_HEADER = -531, + /** + * Violation in HTTP messaging rule. + */ + NGHTTP2_ERR_HTTP_MESSAGING = -532, + /** + * Stream was refused. + */ + NGHTTP2_ERR_REFUSED_STREAM = -533, + /** + * Unexpected internal error, but recovered. + */ + NGHTTP2_ERR_INTERNAL = -534, + /** + * Indicates that a processing was canceled. + */ + NGHTTP2_ERR_CANCEL = -535, + /** + * When a local endpoint expects to receive SETTINGS frame, it + * receives an other type of frame. + */ + NGHTTP2_ERR_SETTINGS_EXPECTED = -536, + /** + * When a local endpoint receives too many settings entries + * in a single SETTINGS frame. + */ + NGHTTP2_ERR_TOO_MANY_SETTINGS = -537, + /** + * The errors < :enum:`nghttp2_error.NGHTTP2_ERR_FATAL` mean that + * the library is under unexpected condition and processing was + * terminated (e.g., out of memory). If application receives this + * error code, it must stop using that :type:`nghttp2_session` + * object and only allowed operation for that object is deallocate + * it using `nghttp2_session_del()`. + */ + NGHTTP2_ERR_FATAL = -900, + /** + * Out of memory. This is a fatal error. + */ + NGHTTP2_ERR_NOMEM = -901, + /** + * The user callback function failed. This is a fatal error. + */ + NGHTTP2_ERR_CALLBACK_FAILURE = -902, + /** + * Invalid client magic (see :macro:`NGHTTP2_CLIENT_MAGIC`) was + * received and further processing is not possible. + */ + NGHTTP2_ERR_BAD_CLIENT_MAGIC = -903, + /** + * Possible flooding by peer was detected in this HTTP/2 session. + * Flooding is measured by how many PING and SETTINGS frames with + * ACK flag set are queued for transmission. These frames are + * response for the peer initiated frames, and peer can cause memory + * exhaustion on server side to send these frames forever and does + * not read network. + */ + NGHTTP2_ERR_FLOODED = -904, + /** + * When a local endpoint receives too many CONTINUATION frames + * following a HEADER frame. + */ + NGHTTP2_ERR_TOO_MANY_CONTINUATIONS = -905, +} nghttp2_error; + +/** + * @struct + * + * The object representing single contiguous buffer. + */ +typedef struct { + /** + * The pointer to the buffer. + */ + uint8_t *base; + /** + * The length of the buffer. + */ + size_t len; +} nghttp2_vec; + +struct nghttp2_rcbuf; + +/** + * @struct + * + * The object representing reference counted buffer. The details of + * this structure are intentionally hidden from the public API. + */ +typedef struct nghttp2_rcbuf nghttp2_rcbuf; + +/** + * @function + * + * Increments the reference count of |rcbuf| by 1. + */ +NGHTTP2_EXTERN void nghttp2_rcbuf_incref(nghttp2_rcbuf *rcbuf); + +/** + * @function + * + * Decrements the reference count of |rcbuf| by 1. If the reference + * count becomes zero, the object pointed by |rcbuf| will be freed. + * In this case, application must not use |rcbuf| again. + */ +NGHTTP2_EXTERN void nghttp2_rcbuf_decref(nghttp2_rcbuf *rcbuf); + +/** + * @function + * + * Returns the underlying buffer managed by |rcbuf|. + */ +NGHTTP2_EXTERN nghttp2_vec nghttp2_rcbuf_get_buf(nghttp2_rcbuf *rcbuf); + +/** + * @function + * + * Returns nonzero if the underlying buffer is statically allocated, + * and 0 otherwise. This can be useful for language bindings that wish + * to avoid creating duplicate strings for these buffers. + */ +NGHTTP2_EXTERN int nghttp2_rcbuf_is_static(const nghttp2_rcbuf *rcbuf); + +/** + * @enum + * + * The flags for header field name/value pair. + */ +typedef enum { + /** + * No flag set. + */ + NGHTTP2_NV_FLAG_NONE = 0, + /** + * Indicates that this name/value pair must not be indexed ("Literal + * Header Field never Indexed" representation must be used in HPACK + * encoding). Other implementation calls this bit as "sensitive". + */ + NGHTTP2_NV_FLAG_NO_INDEX = 0x01, + /** + * This flag is set solely by application. If this flag is set, the + * library does not make a copy of header field name. This could + * improve performance. + */ + NGHTTP2_NV_FLAG_NO_COPY_NAME = 0x02, + /** + * This flag is set solely by application. If this flag is set, the + * library does not make a copy of header field value. This could + * improve performance. + */ + NGHTTP2_NV_FLAG_NO_COPY_VALUE = 0x04 +} nghttp2_nv_flag; + +/** + * @struct + * + * The name/value pair, which mainly used to represent header fields. + */ +typedef struct { + /** + * The |name| byte string. If this struct is presented from library + * (e.g., :type:`nghttp2_on_frame_recv_callback`), |name| is + * guaranteed to be NULL-terminated. For some callbacks + * (:type:`nghttp2_before_frame_send_callback`, + * :type:`nghttp2_on_frame_send_callback`, and + * :type:`nghttp2_on_frame_not_send_callback`), it may not be + * NULL-terminated if header field is passed from application with + * the flag :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME`). + * When application is constructing this struct, |name| is not + * required to be NULL-terminated. + */ + uint8_t *name; + /** + * The |value| byte string. If this struct is presented from + * library (e.g., :type:`nghttp2_on_frame_recv_callback`), |value| + * is guaranteed to be NULL-terminated. For some callbacks + * (:type:`nghttp2_before_frame_send_callback`, + * :type:`nghttp2_on_frame_send_callback`, and + * :type:`nghttp2_on_frame_not_send_callback`), it may not be + * NULL-terminated if header field is passed from application with + * the flag :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_VALUE`). + * When application is constructing this struct, |value| is not + * required to be NULL-terminated. + */ + uint8_t *value; + /** + * The length of the |name|, excluding terminating NULL. + */ + size_t namelen; + /** + * The length of the |value|, excluding terminating NULL. + */ + size_t valuelen; + /** + * Bitwise OR of one or more of :type:`nghttp2_nv_flag`. + */ + uint8_t flags; +} nghttp2_nv; + +/** + * @enum + * + * The frame types in HTTP/2 specification. + */ +typedef enum { + /** + * The DATA frame. + */ + NGHTTP2_DATA = 0, + /** + * The HEADERS frame. + */ + NGHTTP2_HEADERS = 0x01, + /** + * The PRIORITY frame. + */ + NGHTTP2_PRIORITY = 0x02, + /** + * The RST_STREAM frame. + */ + NGHTTP2_RST_STREAM = 0x03, + /** + * The SETTINGS frame. + */ + NGHTTP2_SETTINGS = 0x04, + /** + * The PUSH_PROMISE frame. + */ + NGHTTP2_PUSH_PROMISE = 0x05, + /** + * The PING frame. + */ + NGHTTP2_PING = 0x06, + /** + * The GOAWAY frame. + */ + NGHTTP2_GOAWAY = 0x07, + /** + * The WINDOW_UPDATE frame. + */ + NGHTTP2_WINDOW_UPDATE = 0x08, + /** + * The CONTINUATION frame. This frame type won't be passed to any + * callbacks because the library processes this frame type and its + * preceding HEADERS/PUSH_PROMISE as a single frame. + */ + NGHTTP2_CONTINUATION = 0x09, + /** + * The ALTSVC frame, which is defined in `RFC 7383 + * `_. + */ + NGHTTP2_ALTSVC = 0x0a, + /** + * The ORIGIN frame, which is defined by `RFC 8336 + * `_. + */ + NGHTTP2_ORIGIN = 0x0c, + /** + * The PRIORITY_UPDATE frame, which is defined by :rfc:`9218`. + */ + NGHTTP2_PRIORITY_UPDATE = 0x10 +} nghttp2_frame_type; + +/** + * @enum + * + * The flags for HTTP/2 frames. This enum defines all flags for all + * frames. + */ +typedef enum { + /** + * No flag set. + */ + NGHTTP2_FLAG_NONE = 0, + /** + * The END_STREAM flag. + */ + NGHTTP2_FLAG_END_STREAM = 0x01, + /** + * The END_HEADERS flag. + */ + NGHTTP2_FLAG_END_HEADERS = 0x04, + /** + * The ACK flag. + */ + NGHTTP2_FLAG_ACK = 0x01, + /** + * The PADDED flag. + */ + NGHTTP2_FLAG_PADDED = 0x08, + /** + * The PRIORITY flag. + */ + NGHTTP2_FLAG_PRIORITY = 0x20 +} nghttp2_flag; + +/** + * @enum + * The SETTINGS ID. + */ +typedef enum { + /** + * SETTINGS_HEADER_TABLE_SIZE + */ + NGHTTP2_SETTINGS_HEADER_TABLE_SIZE = 0x01, + /** + * SETTINGS_ENABLE_PUSH + */ + NGHTTP2_SETTINGS_ENABLE_PUSH = 0x02, + /** + * SETTINGS_MAX_CONCURRENT_STREAMS + */ + NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS = 0x03, + /** + * SETTINGS_INITIAL_WINDOW_SIZE + */ + NGHTTP2_SETTINGS_INITIAL_WINDOW_SIZE = 0x04, + /** + * SETTINGS_MAX_FRAME_SIZE + */ + NGHTTP2_SETTINGS_MAX_FRAME_SIZE = 0x05, + /** + * SETTINGS_MAX_HEADER_LIST_SIZE + */ + NGHTTP2_SETTINGS_MAX_HEADER_LIST_SIZE = 0x06, + /** + * SETTINGS_ENABLE_CONNECT_PROTOCOL + * (`RFC 8441 `_) + */ + NGHTTP2_SETTINGS_ENABLE_CONNECT_PROTOCOL = 0x08, + /** + * SETTINGS_NO_RFC7540_PRIORITIES (:rfc:`9218`) + */ + NGHTTP2_SETTINGS_NO_RFC7540_PRIORITIES = 0x09 +} nghttp2_settings_id; +/* Note: If we add SETTINGS, update the capacity of + NGHTTP2_INBOUND_NUM_IV as well */ + +/** + * @macro + * + * .. warning:: + * + * Deprecated. The initial max concurrent streams is 0xffffffffu. + * + * Default maximum number of incoming concurrent streams. Use + * `nghttp2_submit_settings()` with + * :enum:`nghttp2_settings_id.NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS` + * to change the maximum number of incoming concurrent streams. + * + * .. note:: + * + * The maximum number of outgoing concurrent streams is 100 by + * default. + */ +#define NGHTTP2_INITIAL_MAX_CONCURRENT_STREAMS ((1U << 31) - 1) + +/** + * @enum + * The status codes for the RST_STREAM and GOAWAY frames. + */ +typedef enum { + /** + * No errors. + */ + NGHTTP2_NO_ERROR = 0x00, + /** + * PROTOCOL_ERROR + */ + NGHTTP2_PROTOCOL_ERROR = 0x01, + /** + * INTERNAL_ERROR + */ + NGHTTP2_INTERNAL_ERROR = 0x02, + /** + * FLOW_CONTROL_ERROR + */ + NGHTTP2_FLOW_CONTROL_ERROR = 0x03, + /** + * SETTINGS_TIMEOUT + */ + NGHTTP2_SETTINGS_TIMEOUT = 0x04, + /** + * STREAM_CLOSED + */ + NGHTTP2_STREAM_CLOSED = 0x05, + /** + * FRAME_SIZE_ERROR + */ + NGHTTP2_FRAME_SIZE_ERROR = 0x06, + /** + * REFUSED_STREAM + */ + NGHTTP2_REFUSED_STREAM = 0x07, + /** + * CANCEL + */ + NGHTTP2_CANCEL = 0x08, + /** + * COMPRESSION_ERROR + */ + NGHTTP2_COMPRESSION_ERROR = 0x09, + /** + * CONNECT_ERROR + */ + NGHTTP2_CONNECT_ERROR = 0x0a, + /** + * ENHANCE_YOUR_CALM + */ + NGHTTP2_ENHANCE_YOUR_CALM = 0x0b, + /** + * INADEQUATE_SECURITY + */ + NGHTTP2_INADEQUATE_SECURITY = 0x0c, + /** + * HTTP_1_1_REQUIRED + */ + NGHTTP2_HTTP_1_1_REQUIRED = 0x0d +} nghttp2_error_code; + +/** + * @struct + * The frame header. + */ +typedef struct { + /** + * The length field of this frame, excluding frame header. + */ + size_t length; + /** + * The stream identifier (aka, stream ID) + */ + int32_t stream_id; + /** + * The type of this frame. See `nghttp2_frame_type`. + */ + uint8_t type; + /** + * The flags. + */ + uint8_t flags; + /** + * Reserved bit in frame header. Currently, this is always set to 0 + * and application should not expect something useful in here. + */ + uint8_t reserved; +} nghttp2_frame_hd; + +/** + * @union + * + * This union represents the some kind of data source passed to + * :type:`nghttp2_data_source_read_callback2`. + */ +typedef union { + /** + * The integer field, suitable for a file descriptor. + */ + int fd; + /** + * The pointer to an arbitrary object. + */ + void *ptr; +} nghttp2_data_source; + +/** + * @enum + * + * The flags used to set in |data_flags| output parameter in + * :type:`nghttp2_data_source_read_callback2`. + */ +typedef enum { + /** + * No flag set. + */ + NGHTTP2_DATA_FLAG_NONE = 0, + /** + * Indicates EOF was sensed. + */ + NGHTTP2_DATA_FLAG_EOF = 0x01, + /** + * Indicates that END_STREAM flag must not be set even if + * NGHTTP2_DATA_FLAG_EOF is set. Usually this flag is used to send + * trailer fields with `nghttp2_submit_request2()` or + * `nghttp2_submit_response2()`. + */ + NGHTTP2_DATA_FLAG_NO_END_STREAM = 0x02, + /** + * Indicates that application will send complete DATA frame in + * :type:`nghttp2_send_data_callback`. + */ + NGHTTP2_DATA_FLAG_NO_COPY = 0x04 +} nghttp2_data_flag; + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @functypedef + * + * .. warning:: + * + * Deprecated. Use :type:`nghttp2_data_source_read_callback2` + * instead. + * + * Callback function invoked when the library wants to read data from + * the |source|. The read data is sent in the stream |stream_id|. + * The implementation of this function must read at most |length| + * bytes of data from |source| (or possibly other places) and store + * them in |buf| and return number of data stored in |buf|. If EOF is + * reached, set :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_EOF` flag + * in |*data_flags|. + * + * Sometime it is desirable to avoid copying data into |buf| and let + * application to send data directly. To achieve this, set + * :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_NO_COPY` to + * |*data_flags| (and possibly other flags, just like when we do + * copy), and return the number of bytes to send without copying data + * into |buf|. The library, seeing + * :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_NO_COPY`, will invoke + * :type:`nghttp2_send_data_callback`. The application must send + * complete DATA frame in that callback. + * + * If this callback is set by `nghttp2_submit_request()`, + * `nghttp2_submit_response()` or `nghttp2_submit_headers()` and + * `nghttp2_submit_data()` with flag parameter + * :enum:`nghttp2_flag.NGHTTP2_FLAG_END_STREAM` set, and + * :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_EOF` flag is set to + * |*data_flags|, DATA frame will have END_STREAM flag set. Usually, + * this is expected behaviour and all are fine. One exception is send + * trailer fields. You cannot send trailer fields after sending frame + * with END_STREAM set. To avoid this problem, one can set + * :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_NO_END_STREAM` along + * with :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_EOF` to signal the + * library not to set END_STREAM in DATA frame. Then application can + * use `nghttp2_submit_trailer()` to send trailer fields. + * `nghttp2_submit_trailer()` can be called inside this callback. + * + * If the application wants to postpone DATA frames (e.g., + * asynchronous I/O, or reading data blocks for long time), it is + * achieved by returning :enum:`nghttp2_error.NGHTTP2_ERR_DEFERRED` + * without reading any data in this invocation. The library removes + * DATA frame from the outgoing queue temporarily. To move back + * deferred DATA frame to outgoing queue, call + * `nghttp2_session_resume_data()`. + * + * By default, |length| is limited to 16KiB at maximum. If peer + * allows larger frames, application can enlarge transmission buffer + * size. See :type:`nghttp2_data_source_read_length_callback` for + * more details. + * + * If the application just wants to return from + * `nghttp2_session_send()` or `nghttp2_session_mem_send()` without + * sending anything, return :enum:`nghttp2_error.NGHTTP2_ERR_PAUSE`. + * + * In case of error, there are 2 choices. Returning + * :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE` will + * close the stream by issuing RST_STREAM with + * :enum:`nghttp2_error_code.NGHTTP2_INTERNAL_ERROR`. If a different + * error code is desirable, use `nghttp2_submit_rst_stream()` with a + * desired error code and then return + * :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE`. + * Returning :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` will + * signal the entire session failure. + */ +typedef ssize_t (*nghttp2_data_source_read_callback)( + nghttp2_session *session, int32_t stream_id, uint8_t *buf, size_t length, + uint32_t *data_flags, nghttp2_data_source *source, void *user_data); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @functypedef + * + * Callback function invoked when the library wants to read data from + * the |source|. The read data is sent in the stream |stream_id|. + * The implementation of this function must read at most |length| + * bytes of data from |source| (or possibly other places) and store + * them in |buf| and return number of data stored in |buf|. If EOF is + * reached, set :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_EOF` flag + * in |*data_flags|. + * + * Sometime it is desirable to avoid copying data into |buf| and let + * application to send data directly. To achieve this, set + * :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_NO_COPY` to + * |*data_flags| (and possibly other flags, just like when we do + * copy), and return the number of bytes to send without copying data + * into |buf|. The library, seeing + * :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_NO_COPY`, will invoke + * :type:`nghttp2_send_data_callback`. The application must send + * complete DATA frame in that callback. + * + * If this callback is set by `nghttp2_submit_request2()`, + * `nghttp2_submit_response2()` or `nghttp2_submit_headers()` and + * `nghttp2_submit_data2()` with flag parameter + * :enum:`nghttp2_flag.NGHTTP2_FLAG_END_STREAM` set, and + * :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_EOF` flag is set to + * |*data_flags|, DATA frame will have END_STREAM flag set. Usually, + * this is expected behaviour and all are fine. One exception is send + * trailer fields. You cannot send trailer fields after sending frame + * with END_STREAM set. To avoid this problem, one can set + * :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_NO_END_STREAM` along + * with :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_EOF` to signal the + * library not to set END_STREAM in DATA frame. Then application can + * use `nghttp2_submit_trailer()` to send trailer fields. + * `nghttp2_submit_trailer()` can be called inside this callback. + * + * If the application wants to postpone DATA frames (e.g., + * asynchronous I/O, or reading data blocks for long time), it is + * achieved by returning :enum:`nghttp2_error.NGHTTP2_ERR_DEFERRED` + * without reading any data in this invocation. The library removes + * DATA frame from the outgoing queue temporarily. To move back + * deferred DATA frame to outgoing queue, call + * `nghttp2_session_resume_data()`. + * + * By default, |length| is limited to 16KiB at maximum. If peer + * allows larger frames, application can enlarge transmission buffer + * size. See :type:`nghttp2_data_source_read_length_callback` for + * more details. + * + * If the application just wants to return from + * `nghttp2_session_send()` or `nghttp2_session_mem_send2()` without + * sending anything, return :enum:`nghttp2_error.NGHTTP2_ERR_PAUSE`. + * + * In case of error, there are 2 choices. Returning + * :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE` will + * close the stream by issuing RST_STREAM with + * :enum:`nghttp2_error_code.NGHTTP2_INTERNAL_ERROR`. If a different + * error code is desirable, use `nghttp2_submit_rst_stream()` with a + * desired error code and then return + * :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE`. + * Returning :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` will + * signal the entire session failure. + */ +typedef nghttp2_ssize (*nghttp2_data_source_read_callback2)( + nghttp2_session *session, int32_t stream_id, uint8_t *buf, size_t length, + uint32_t *data_flags, nghttp2_data_source *source, void *user_data); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @struct + * + * .. warning:: + * + * Deprecated. Use :type:`nghttp2_data_provider2` instead. + * + * This struct represents the data source and the way to read a chunk + * of data from it. + */ +typedef struct { + /** + * The data source. + */ + nghttp2_data_source source; + /** + * The callback function to read a chunk of data from the |source|. + */ + nghttp2_data_source_read_callback read_callback; +} nghttp2_data_provider; + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @struct + * + * This struct represents the data source and the way to read a chunk + * of data from it. + */ +typedef struct { + /** + * The data source. + */ + nghttp2_data_source source; + /** + * The callback function to read a chunk of data from the |source|. + */ + nghttp2_data_source_read_callback2 read_callback; +} nghttp2_data_provider2; + +/** + * @struct + * + * The DATA frame. The received data is delivered via + * :type:`nghttp2_on_data_chunk_recv_callback`. + */ +typedef struct { + nghttp2_frame_hd hd; + /** + * The length of the padding in this frame. This includes PAD_HIGH + * and PAD_LOW. + */ + size_t padlen; +} nghttp2_data; + +/** + * @enum + * + * The category of HEADERS, which indicates the role of the frame. In + * HTTP/2 spec, request, response, push response and other arbitrary + * headers (e.g., trailer fields) are all called just HEADERS. To + * give the application the role of incoming HEADERS frame, we define + * several categories. + */ +typedef enum { + /** + * The HEADERS frame is opening new stream, which is analogous to + * SYN_STREAM in SPDY. + */ + NGHTTP2_HCAT_REQUEST = 0, + /** + * The HEADERS frame is the first response headers, which is + * analogous to SYN_REPLY in SPDY. + */ + NGHTTP2_HCAT_RESPONSE = 1, + /** + * The HEADERS frame is the first headers sent against reserved + * stream. + */ + NGHTTP2_HCAT_PUSH_RESPONSE = 2, + /** + * The HEADERS frame which does not apply for the above categories, + * which is analogous to HEADERS in SPDY. If non-final response + * (e.g., status 1xx) is used, final response HEADERS frame will be + * categorized here. + */ + NGHTTP2_HCAT_HEADERS = 3 +} nghttp2_headers_category; + +/** + * @struct + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * The structure to specify stream dependency. + */ +typedef struct { + /** + * The stream ID of the stream to depend on. Specifying 0 makes + * stream not depend any other stream. + */ + int32_t stream_id; + /** + * The weight of this dependency. + */ + int32_t weight; + /** + * nonzero means exclusive dependency + */ + uint8_t exclusive; +} nghttp2_priority_spec; + +/** + * @struct + * + * The HEADERS frame. It has the following members: + */ +typedef struct { + /** + * The frame header. + */ + nghttp2_frame_hd hd; + /** + * The length of the padding in this frame. This includes PAD_HIGH + * and PAD_LOW. + */ + size_t padlen; + /** + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * The priority specification + */ + nghttp2_priority_spec pri_spec; + /** + * The name/value pairs. + */ + nghttp2_nv *nva; + /** + * The number of name/value pairs in |nva|. + */ + size_t nvlen; + /** + * The category of this HEADERS frame. + */ + nghttp2_headers_category cat; +} nghttp2_headers; + +/** + * @struct + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * The PRIORITY frame. It has the following members: + */ +typedef struct { + /** + * The frame header. + */ + nghttp2_frame_hd hd; + /** + * The priority specification. + */ + nghttp2_priority_spec pri_spec; +} nghttp2_priority; + +/** + * @struct + * + * The RST_STREAM frame. It has the following members: + */ +typedef struct { + /** + * The frame header. + */ + nghttp2_frame_hd hd; + /** + * The error code. See :type:`nghttp2_error_code`. + */ + uint32_t error_code; +} nghttp2_rst_stream; + +/** + * @struct + * + * The SETTINGS ID/Value pair. It has the following members: + */ +typedef struct { + /** + * The SETTINGS ID. See :type:`nghttp2_settings_id`. + */ + int32_t settings_id; + /** + * The value of this entry. + */ + uint32_t value; +} nghttp2_settings_entry; + +/** + * @struct + * + * The SETTINGS frame. It has the following members: + */ +typedef struct { + /** + * The frame header. + */ + nghttp2_frame_hd hd; + /** + * The number of SETTINGS ID/Value pairs in |iv|. + */ + size_t niv; + /** + * The pointer to the array of SETTINGS ID/Value pair. + */ + nghttp2_settings_entry *iv; +} nghttp2_settings; + +/** + * @struct + * + * The PUSH_PROMISE frame. It has the following members: + */ +typedef struct { + /** + * The frame header. + */ + nghttp2_frame_hd hd; + /** + * The length of the padding in this frame. This includes PAD_HIGH + * and PAD_LOW. + */ + size_t padlen; + /** + * The name/value pairs. + */ + nghttp2_nv *nva; + /** + * The number of name/value pairs in |nva|. + */ + size_t nvlen; + /** + * The promised stream ID + */ + int32_t promised_stream_id; + /** + * Reserved bit. Currently this is always set to 0 and application + * should not expect something useful in here. + */ + uint8_t reserved; +} nghttp2_push_promise; + +/** + * @struct + * + * The PING frame. It has the following members: + */ +typedef struct { + /** + * The frame header. + */ + nghttp2_frame_hd hd; + /** + * The opaque data + */ + uint8_t opaque_data[8]; +} nghttp2_ping; + +/** + * @struct + * + * The GOAWAY frame. It has the following members: + */ +typedef struct { + /** + * The frame header. + */ + nghttp2_frame_hd hd; + /** + * The last stream stream ID. + */ + int32_t last_stream_id; + /** + * The error code. See :type:`nghttp2_error_code`. + */ + uint32_t error_code; + /** + * The additional debug data + */ + uint8_t *opaque_data; + /** + * The length of |opaque_data| member. + */ + size_t opaque_data_len; + /** + * Reserved bit. Currently this is always set to 0 and application + * should not expect something useful in here. + */ + uint8_t reserved; +} nghttp2_goaway; + +/** + * @struct + * + * The WINDOW_UPDATE frame. It has the following members: + */ +typedef struct { + /** + * The frame header. + */ + nghttp2_frame_hd hd; + /** + * The window size increment. + */ + int32_t window_size_increment; + /** + * Reserved bit. Currently this is always set to 0 and application + * should not expect something useful in here. + */ + uint8_t reserved; +} nghttp2_window_update; + +/** + * @struct + * + * The extension frame. It has following members: + */ +typedef struct { + /** + * The frame header. + */ + nghttp2_frame_hd hd; + /** + * The pointer to extension payload. The exact pointer type is + * determined by hd.type. + * + * Currently, no extension is supported. This is a place holder for + * the future extensions. + */ + void *payload; +} nghttp2_extension; + +/** + * @union + * + * This union includes all frames to pass them to various function + * calls as nghttp2_frame type. The CONTINUATION frame is omitted + * from here because the library deals with it internally. + */ +typedef union { + /** + * The frame header, which is convenient to inspect frame header. + */ + nghttp2_frame_hd hd; + /** + * The DATA frame. + */ + nghttp2_data data; + /** + * The HEADERS frame. + */ + nghttp2_headers headers; + /** + * The PRIORITY frame. + */ + nghttp2_priority priority; + /** + * The RST_STREAM frame. + */ + nghttp2_rst_stream rst_stream; + /** + * The SETTINGS frame. + */ + nghttp2_settings settings; + /** + * The PUSH_PROMISE frame. + */ + nghttp2_push_promise push_promise; + /** + * The PING frame. + */ + nghttp2_ping ping; + /** + * The GOAWAY frame. + */ + nghttp2_goaway goaway; + /** + * The WINDOW_UPDATE frame. + */ + nghttp2_window_update window_update; + /** + * The extension frame. + */ + nghttp2_extension ext; +} nghttp2_frame; + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @functypedef + * + * .. warning:: + * + * Deprecated. Use :type:`nghttp2_send_callback2` instead. + * + * Callback function invoked when |session| wants to send data to the + * remote peer. The implementation of this function must send at most + * |length| bytes of data stored in |data|. The |flags| is currently + * not used and always 0. It must return the number of bytes sent if + * it succeeds. If it cannot send any single byte without blocking, + * it must return :enum:`nghttp2_error.NGHTTP2_ERR_WOULDBLOCK`. For + * other errors, it must return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. The + * |user_data| pointer is the third argument passed in to the call to + * `nghttp2_session_client_new()` or `nghttp2_session_server_new()`. + * + * This callback is required if the application uses + * `nghttp2_session_send()` to send data to the remote endpoint. If + * the application uses solely `nghttp2_session_mem_send()` instead, + * this callback function is unnecessary. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_send_callback()`. + * + * .. note:: + * + * The |length| may be very small. If that is the case, and + * application disables Nagle algorithm (``TCP_NODELAY``), then just + * writing |data| to the network stack leads to very small packet, + * and it is very inefficient. An application should be responsible + * to buffer up small chunks of data as necessary to avoid this + * situation. + */ +typedef ssize_t (*nghttp2_send_callback)(nghttp2_session *session, + const uint8_t *data, size_t length, + int flags, void *user_data); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @functypedef + * + * Callback function invoked when |session| wants to send data to the + * remote peer. The implementation of this function must send at most + * |length| bytes of data stored in |data|. The |flags| is currently + * not used and always 0. It must return the number of bytes sent if + * it succeeds. If it cannot send any single byte without blocking, + * it must return :enum:`nghttp2_error.NGHTTP2_ERR_WOULDBLOCK`. For + * other errors, it must return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. The + * |user_data| pointer is the third argument passed in to the call to + * `nghttp2_session_client_new()` or `nghttp2_session_server_new()`. + * + * This callback is required if the application uses + * `nghttp2_session_send()` to send data to the remote endpoint. If + * the application uses solely `nghttp2_session_mem_send2()` instead, + * this callback function is unnecessary. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_send_callback2()`. + * + * .. note:: + * + * The |length| may be very small. If that is the case, and + * application disables Nagle algorithm (``TCP_NODELAY``), then just + * writing |data| to the network stack leads to very small packet, + * and it is very inefficient. An application should be responsible + * to buffer up small chunks of data as necessary to avoid this + * situation. + */ +typedef nghttp2_ssize (*nghttp2_send_callback2)(nghttp2_session *session, + const uint8_t *data, + size_t length, int flags, + void *user_data); + +/** + * @functypedef + * + * Callback function invoked when + * :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_NO_COPY` is used in + * :type:`nghttp2_data_source_read_callback` to send complete DATA + * frame. + * + * The |frame| is a DATA frame to send. The |framehd| is the + * serialized frame header (9 bytes). The |length| is the length of + * application data to send (this does not include padding). The + * |source| is the same pointer passed to + * :type:`nghttp2_data_source_read_callback`. + * + * The application first must send frame header |framehd| of length 9 + * bytes. If ``frame->data.padlen > 0``, send 1 byte of value + * ``frame->data.padlen - 1``. Then send exactly |length| bytes of + * application data. Finally, if ``frame->data.padlen > 1``, send + * ``frame->data.padlen - 1`` bytes of zero as padding. + * + * The application has to send complete DATA frame in this callback. + * If all data were written successfully, return 0. + * + * If it cannot send any data at all, just return + * :enum:`nghttp2_error.NGHTTP2_ERR_WOULDBLOCK`; the library will call + * this callback with the same parameters later (It is recommended to + * send complete DATA frame at once in this function to deal with + * error; if partial frame data has already sent, it is impossible to + * send another data in that state, and all we can do is tear down + * connection). When data is fully processed, but application wants + * to make `nghttp2_session_mem_send2()` or `nghttp2_session_send()` + * return immediately without processing next frames, return + * :enum:`nghttp2_error.NGHTTP2_ERR_PAUSE`. If application decided to + * reset this stream, return + * :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE`, then + * the library will send RST_STREAM with INTERNAL_ERROR as error code. + * The application can also return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`, which will + * result in connection closure. Returning any other value is treated + * as :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` is returned. + */ +typedef int (*nghttp2_send_data_callback)(nghttp2_session *session, + nghttp2_frame *frame, + const uint8_t *framehd, size_t length, + nghttp2_data_source *source, + void *user_data); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @functypedef + * + * .. warning:: + * + * Deprecated. Use :type:`nghttp2_recv_callback2` instead. + * + * Callback function invoked when |session| wants to receive data from + * the remote peer. The implementation of this function must read at + * most |length| bytes of data and store it in |buf|. The |flags| is + * currently not used and always 0. It must return the number of + * bytes written in |buf| if it succeeds. If it cannot read any + * single byte without blocking, it must return + * :enum:`nghttp2_error.NGHTTP2_ERR_WOULDBLOCK`. If it gets EOF + * before it reads any single byte, it must return + * :enum:`nghttp2_error.NGHTTP2_ERR_EOF`. For other errors, it must + * return :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * Returning 0 is treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_WOULDBLOCK`. The |user_data| + * pointer is the third argument passed in to the call to + * `nghttp2_session_client_new()` or `nghttp2_session_server_new()`. + * + * This callback is required if the application uses + * `nghttp2_session_recv()` to receive data from the remote endpoint. + * If the application uses solely `nghttp2_session_mem_recv()` + * instead, this callback function is unnecessary. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_recv_callback()`. + */ +typedef ssize_t (*nghttp2_recv_callback)(nghttp2_session *session, uint8_t *buf, + size_t length, int flags, + void *user_data); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @functypedef + * + * Callback function invoked when |session| wants to receive data from + * the remote peer. The implementation of this function must read at + * most |length| bytes of data and store it in |buf|. The |flags| is + * currently not used and always 0. It must return the number of + * bytes written in |buf| if it succeeds. If it cannot read any + * single byte without blocking, it must return + * :enum:`nghttp2_error.NGHTTP2_ERR_WOULDBLOCK`. If it gets EOF + * before it reads any single byte, it must return + * :enum:`nghttp2_error.NGHTTP2_ERR_EOF`. For other errors, it must + * return :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * Returning 0 is treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_WOULDBLOCK`. The |user_data| + * pointer is the third argument passed in to the call to + * `nghttp2_session_client_new()` or `nghttp2_session_server_new()`. + * + * This callback is required if the application uses + * `nghttp2_session_recv()` to receive data from the remote endpoint. + * If the application uses solely `nghttp2_session_mem_recv2()` + * instead, this callback function is unnecessary. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_recv_callback2()`. + */ +typedef nghttp2_ssize (*nghttp2_recv_callback2)(nghttp2_session *session, + uint8_t *buf, size_t length, + int flags, void *user_data); + +/** + * @functypedef + * + * Callback function invoked by `nghttp2_session_recv()` and + * `nghttp2_session_mem_recv2()` when a frame is received. The + * |user_data| pointer is the third argument passed in to the call to + * `nghttp2_session_client_new()` or `nghttp2_session_server_new()`. + * + * If frame is HEADERS or PUSH_PROMISE, the ``nva`` and ``nvlen`` + * member of their data structure are always ``NULL`` and 0 + * respectively. The header name/value pairs are emitted via + * :type:`nghttp2_on_header_callback`. + * + * Only HEADERS and DATA frame can signal the end of incoming data. + * If ``frame->hd.flags & NGHTTP2_FLAG_END_STREAM`` is nonzero, the + * |frame| is the last frame from the remote peer in this stream. + * + * This callback won't be called for CONTINUATION frames. + * HEADERS/PUSH_PROMISE + CONTINUATIONs are treated as single frame. + * + * The implementation of this function must return 0 if it succeeds. + * If nonzero value is returned, it is treated as fatal error and + * `nghttp2_session_recv()` and `nghttp2_session_mem_recv2()` + * functions immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_on_frame_recv_callback()`. + */ +typedef int (*nghttp2_on_frame_recv_callback)(nghttp2_session *session, + const nghttp2_frame *frame, + void *user_data); + +/** + * @functypedef + * + * Callback function invoked by `nghttp2_session_recv()` and + * `nghttp2_session_mem_recv2()` when an invalid non-DATA frame is + * received. The error is indicated by the |lib_error_code|, which is + * one of the values defined in :type:`nghttp2_error`. When this + * callback function is invoked, the library automatically submits + * either RST_STREAM or GOAWAY frame. The |user_data| pointer is the + * third argument passed in to the call to + * `nghttp2_session_client_new()` or `nghttp2_session_server_new()`. + * + * If frame is HEADERS or PUSH_PROMISE, the ``nva`` and ``nvlen`` + * member of their data structure are always ``NULL`` and 0 + * respectively. + * + * The implementation of this function must return 0 if it succeeds. + * If nonzero is returned, it is treated as fatal error and + * `nghttp2_session_recv()` and `nghttp2_session_mem_recv2()` + * functions immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_on_invalid_frame_recv_callback()`. + */ +typedef int (*nghttp2_on_invalid_frame_recv_callback)( + nghttp2_session *session, const nghttp2_frame *frame, int lib_error_code, + void *user_data); + +/** + * @functypedef + * + * Callback function invoked when a chunk of data in DATA frame is + * received. The |stream_id| is the stream ID this DATA frame belongs + * to. The |flags| is the flags of DATA frame which this data chunk + * is contained. ``(flags & NGHTTP2_FLAG_END_STREAM) != 0`` does not + * necessarily mean this chunk of data is the last one in the stream. + * You should use :type:`nghttp2_on_frame_recv_callback` to know all + * data frames are received. The |user_data| pointer is the third + * argument passed in to the call to `nghttp2_session_client_new()` or + * `nghttp2_session_server_new()`. + * + * If the application uses `nghttp2_session_mem_recv2()`, it can + * return :enum:`nghttp2_error.NGHTTP2_ERR_PAUSE` to make + * `nghttp2_session_mem_recv2()` return without processing further + * input bytes. The memory by pointed by the |data| is retained until + * `nghttp2_session_mem_recv2()` or `nghttp2_session_recv()` is + * called. The application must retain the input bytes which was used + * to produce the |data| parameter, because it may refer to the memory + * region included in the input bytes. + * + * The implementation of this function must return 0 if it succeeds. + * If nonzero is returned, it is treated as fatal error, and + * `nghttp2_session_recv()` and `nghttp2_session_mem_recv2()` + * functions immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_on_data_chunk_recv_callback()`. + */ +typedef int (*nghttp2_on_data_chunk_recv_callback)(nghttp2_session *session, + uint8_t flags, + int32_t stream_id, + const uint8_t *data, + size_t len, void *user_data); + +/** + * @functypedef + * + * Callback function invoked just before the non-DATA frame |frame| is + * sent. The |user_data| pointer is the third argument passed in to + * the call to `nghttp2_session_client_new()` or + * `nghttp2_session_server_new()`. + * + * The implementation of this function must return 0 if it succeeds. + * It can also return :enum:`nghttp2_error.NGHTTP2_ERR_CANCEL` to + * cancel the transmission of the given frame. + * + * If there is a fatal error while executing this callback, the + * implementation should return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`, which makes + * `nghttp2_session_send()` and `nghttp2_session_mem_send2()` + * functions immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * + * If the other value is returned, it is treated as if + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` is returned. + * But the implementation should not rely on this since the library + * may define new return value to extend its capability. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_before_frame_send_callback()`. + */ +typedef int (*nghttp2_before_frame_send_callback)(nghttp2_session *session, + const nghttp2_frame *frame, + void *user_data); + +/** + * @functypedef + * + * Callback function invoked after the frame |frame| is sent. The + * |user_data| pointer is the third argument passed in to the call to + * `nghttp2_session_client_new()` or `nghttp2_session_server_new()`. + * + * The implementation of this function must return 0 if it succeeds. + * If nonzero is returned, it is treated as fatal error and + * `nghttp2_session_send()` and `nghttp2_session_mem_send2()` + * functions immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_on_frame_send_callback()`. + */ +typedef int (*nghttp2_on_frame_send_callback)(nghttp2_session *session, + const nghttp2_frame *frame, + void *user_data); + +/** + * @functypedef + * + * Callback function invoked after the non-DATA frame |frame| is not + * sent because of the error. The error is indicated by the + * |lib_error_code|, which is one of the values defined in + * :type:`nghttp2_error`. The |user_data| pointer is the third + * argument passed in to the call to `nghttp2_session_client_new()` or + * `nghttp2_session_server_new()`. + * + * The implementation of this function must return 0 if it succeeds. + * If nonzero is returned, it is treated as fatal error and + * `nghttp2_session_send()` and `nghttp2_session_mem_send2()` + * functions immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * + * `nghttp2_session_get_stream_user_data()` can be used to get + * associated data. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_on_frame_not_send_callback()`. + */ +typedef int (*nghttp2_on_frame_not_send_callback)(nghttp2_session *session, + const nghttp2_frame *frame, + int lib_error_code, + void *user_data); + +/** + * @functypedef + * + * Callback function invoked when the stream |stream_id| is closed. + * The reason of closure is indicated by the |error_code|. The + * |error_code| is usually one of :enum:`nghttp2_error_code`, but that + * is not guaranteed. The stream_user_data, which was specified in + * `nghttp2_submit_request2()` or `nghttp2_submit_headers()`, is still + * available in this function. The |user_data| pointer is the third + * argument passed in to the call to `nghttp2_session_client_new()` or + * `nghttp2_session_server_new()`. + * + * This function is also called for a stream in reserved state. + * + * The implementation of this function must return 0 if it succeeds. + * If nonzero is returned, it is treated as fatal error and + * `nghttp2_session_recv()`, `nghttp2_session_mem_recv2()`, + * `nghttp2_session_send()`, and `nghttp2_session_mem_send2()` + * functions immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_on_stream_close_callback()`. + */ +typedef int (*nghttp2_on_stream_close_callback)(nghttp2_session *session, + int32_t stream_id, + uint32_t error_code, + void *user_data); + +/** + * @functypedef + * + * Callback function invoked when the reception of header block in + * HEADERS or PUSH_PROMISE is started. Each header name/value pair + * will be emitted by :type:`nghttp2_on_header_callback`. + * + * The ``frame->hd.flags`` may not have + * :enum:`nghttp2_flag.NGHTTP2_FLAG_END_HEADERS` flag set, which + * indicates that one or more CONTINUATION frames are involved. But + * the application does not need to care about that because the header + * name/value pairs are emitted transparently regardless of + * CONTINUATION frames. + * + * The server applications probably create an object to store + * information about new stream if ``frame->hd.type == + * NGHTTP2_HEADERS`` and ``frame->headers.cat == + * NGHTTP2_HCAT_REQUEST``. If |session| is configured as server side, + * ``frame->headers.cat`` is either ``NGHTTP2_HCAT_REQUEST`` + * containing request headers or ``NGHTTP2_HCAT_HEADERS`` containing + * trailer fields and never get PUSH_PROMISE in this callback. + * + * For the client applications, ``frame->hd.type`` is either + * ``NGHTTP2_HEADERS`` or ``NGHTTP2_PUSH_PROMISE``. In case of + * ``NGHTTP2_HEADERS``, ``frame->headers.cat == + * NGHTTP2_HCAT_RESPONSE`` means that it is the first response + * headers, but it may be non-final response which is indicated by 1xx + * status code. In this case, there may be zero or more HEADERS frame + * with ``frame->headers.cat == NGHTTP2_HCAT_HEADERS`` which has + * non-final response code and finally client gets exactly one HEADERS + * frame with ``frame->headers.cat == NGHTTP2_HCAT_HEADERS`` + * containing final response headers (non-1xx status code). The + * trailer fields also has ``frame->headers.cat == + * NGHTTP2_HCAT_HEADERS`` which does not contain any status code. + * + * Returning + * :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE` will + * close the stream (promised stream if frame is PUSH_PROMISE) by + * issuing RST_STREAM with + * :enum:`nghttp2_error_code.NGHTTP2_INTERNAL_ERROR`. In this case, + * :type:`nghttp2_on_header_callback` and + * :type:`nghttp2_on_frame_recv_callback` will not be invoked. If a + * different error code is desirable, use + * `nghttp2_submit_rst_stream()` with a desired error code and then + * return :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE`. + * Again, use ``frame->push_promise.promised_stream_id`` as stream_id + * parameter in `nghttp2_submit_rst_stream()` if frame is + * PUSH_PROMISE. + * + * The implementation of this function must return 0 if it succeeds. + * It can return + * :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE` to + * reset the stream (promised stream if frame is PUSH_PROMISE). For + * critical errors, it must return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. If the other + * value is returned, it is treated as if + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` is returned. If + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` is returned, + * `nghttp2_session_mem_recv2()` function will immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_on_begin_headers_callback()`. + */ +typedef int (*nghttp2_on_begin_headers_callback)(nghttp2_session *session, + const nghttp2_frame *frame, + void *user_data); + +/** + * @functypedef + * + * Callback function invoked when a header name/value pair is received + * for the |frame|. The |name| of length |namelen| is header name. + * The |value| of length |valuelen| is header value. The |flags| is + * bitwise OR of one or more of :type:`nghttp2_nv_flag`. + * + * If :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_INDEX` is set in + * |flags|, the receiver must not index this name/value pair when + * forwarding it to the next hop. More specifically, "Literal Header + * Field never Indexed" representation must be used in HPACK encoding. + * + * When this callback is invoked, ``frame->hd.type`` is either + * :enum:`nghttp2_frame_type.NGHTTP2_HEADERS` or + * :enum:`nghttp2_frame_type.NGHTTP2_PUSH_PROMISE`. After all header + * name/value pairs are processed with this callback, and no error has + * been detected, :type:`nghttp2_on_frame_recv_callback` will be + * invoked. If there is an error in decompression, + * :type:`nghttp2_on_frame_recv_callback` for the |frame| will not be + * invoked. + * + * Both |name| and |value| are guaranteed to be NULL-terminated. The + * |namelen| and |valuelen| do not include terminal NULL. If + * `nghttp2_option_set_no_http_messaging()` is used with nonzero + * value, NULL character may be included in |name| or |value| before + * terminating NULL. + * + * Please note that unless `nghttp2_option_set_no_http_messaging()` is + * used, nghttp2 library does perform validation against the |name| + * and the |value| using `nghttp2_check_header_name()` and + * `nghttp2_check_header_value()`. In addition to this, nghttp2 + * performs validation based on HTTP Messaging rule, which is briefly + * explained in :ref:`http-messaging` section. + * + * If the application uses `nghttp2_session_mem_recv2()`, it can + * return :enum:`nghttp2_error.NGHTTP2_ERR_PAUSE` to make + * `nghttp2_session_mem_recv2()` return without processing further + * input bytes. The memory pointed by |frame|, |name| and |value| + * parameters are retained until `nghttp2_session_mem_recv2()` or + * `nghttp2_session_recv()` is called. The application must retain + * the input bytes which was used to produce these parameters, because + * it may refer to the memory region included in the input bytes. + * + * Returning + * :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE` will + * close the stream (promised stream if frame is PUSH_PROMISE) by + * issuing RST_STREAM with + * :enum:`nghttp2_error_code.NGHTTP2_INTERNAL_ERROR`. In this case, + * :type:`nghttp2_on_header_callback` and + * :type:`nghttp2_on_frame_recv_callback` will not be invoked. If a + * different error code is desirable, use + * `nghttp2_submit_rst_stream()` with a desired error code and then + * return :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE`. + * Again, use ``frame->push_promise.promised_stream_id`` as stream_id + * parameter in `nghttp2_submit_rst_stream()` if frame is + * PUSH_PROMISE. + * + * The implementation of this function must return 0 if it succeeds. + * It may return :enum:`nghttp2_error.NGHTTP2_ERR_PAUSE` or + * :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE`. For + * other critical failures, it must return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. If the other + * nonzero value is returned, it is treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. If + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` is returned, + * `nghttp2_session_recv()` and `nghttp2_session_mem_recv2()` + * functions immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_on_header_callback()`. + * + * .. warning:: + * + * Application should properly limit the total buffer size to store + * incoming header fields. Without it, peer may send large number + * of header fields or large header fields to cause out of memory in + * local endpoint. Due to how HPACK works, peer can do this + * effectively without using much memory on their own. + */ +typedef int (*nghttp2_on_header_callback)(nghttp2_session *session, + const nghttp2_frame *frame, + const uint8_t *name, size_t namelen, + const uint8_t *value, size_t valuelen, + uint8_t flags, void *user_data); + +/** + * @functypedef + * + * Callback function invoked when a header name/value pair is received + * for the |frame|. The |name| is header name. The |value| is header + * value. The |flags| is bitwise OR of one or more of + * :type:`nghttp2_nv_flag`. + * + * This callback behaves like :type:`nghttp2_on_header_callback`, + * except that |name| and |value| are stored in reference counted + * buffer. If application wishes to keep these references without + * copying them, use `nghttp2_rcbuf_incref()` to increment their + * reference count. It is the application's responsibility to call + * `nghttp2_rcbuf_decref()` if they called `nghttp2_rcbuf_incref()` so + * as not to leak memory. If the |session| is created by + * `nghttp2_session_server_new3()` or `nghttp2_session_client_new3()`, + * the function to free memory is the one belongs to the mem + * parameter. As long as this free function alives, |name| and + * |value| can live after |session| was destroyed. + */ +typedef int (*nghttp2_on_header_callback2)(nghttp2_session *session, + const nghttp2_frame *frame, + nghttp2_rcbuf *name, + nghttp2_rcbuf *value, uint8_t flags, + void *user_data); + +/** + * @functypedef + * + * Callback function invoked when a invalid header name/value pair is + * received for the |frame|. + * + * The parameter and behaviour are similar to + * :type:`nghttp2_on_header_callback`. The difference is that this + * callback is only invoked when a invalid header name/value pair is + * received which is treated as stream error if this callback is not + * set. Only invalid regular header field are passed to this + * callback. In other words, invalid pseudo header field is not + * passed to this callback. Also header fields which includes upper + * cased latter are also treated as error without passing them to this + * callback. + * + * This callback is only considered if HTTP messaging validation is + * turned on (which is on by default, see + * `nghttp2_option_set_no_http_messaging()`). + * + * With this callback, application inspects the incoming invalid + * field, and it also can reset stream from this callback by returning + * :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE`. By + * default, the error code is + * :enum:`nghttp2_error_code.NGHTTP2_PROTOCOL_ERROR`. To change the + * error code, call `nghttp2_submit_rst_stream()` with the error code + * of choice in addition to returning + * :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE`. + * + * If 0 is returned, the header field is ignored, and the stream is + * not reset. + */ +typedef int (*nghttp2_on_invalid_header_callback)( + nghttp2_session *session, const nghttp2_frame *frame, const uint8_t *name, + size_t namelen, const uint8_t *value, size_t valuelen, uint8_t flags, + void *user_data); + +/** + * @functypedef + * + * Callback function invoked when a invalid header name/value pair is + * received for the |frame|. + * + * The parameter and behaviour are similar to + * :type:`nghttp2_on_header_callback2`. The difference is that this + * callback is only invoked when a invalid header name/value pair is + * received which is silently ignored if this callback is not set. + * Only invalid regular header field are passed to this callback. In + * other words, invalid pseudo header field is not passed to this + * callback. Also header fields which includes upper cased latter are + * also treated as error without passing them to this callback. + * + * This callback is only considered if HTTP messaging validation is + * turned on (which is on by default, see + * `nghttp2_option_set_no_http_messaging()`). + * + * With this callback, application inspects the incoming invalid + * field, and it also can reset stream from this callback by returning + * :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE`. By + * default, the error code is + * :enum:`nghttp2_error_code.NGHTTP2_INTERNAL_ERROR`. To change the + * error code, call `nghttp2_submit_rst_stream()` with the error code + * of choice in addition to returning + * :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE`. + */ +typedef int (*nghttp2_on_invalid_header_callback2)( + nghttp2_session *session, const nghttp2_frame *frame, nghttp2_rcbuf *name, + nghttp2_rcbuf *value, uint8_t flags, void *user_data); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @functypedef + * + * .. warning:: + * + * Deprecated. Use :type:`nghttp2_select_padding_callback2` + * instead. + * + * Callback function invoked when the library asks application how + * many padding bytes are required for the transmission of the + * |frame|. The application must choose the total length of payload + * including padded bytes in range [frame->hd.length, max_payloadlen], + * inclusive. Choosing number not in this range will be treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. Returning + * ``frame->hd.length`` means no padding is added. Returning + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` will make + * `nghttp2_session_send()` and `nghttp2_session_mem_send()` functions + * immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_select_padding_callback()`. + */ +typedef ssize_t (*nghttp2_select_padding_callback)(nghttp2_session *session, + const nghttp2_frame *frame, + size_t max_payloadlen, + void *user_data); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @functypedef + * + * Callback function invoked when the library asks application how + * many padding bytes are required for the transmission of the + * |frame|. The application must choose the total length of payload + * including padded bytes in range [frame->hd.length, max_payloadlen], + * inclusive. Choosing number not in this range will be treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. Returning + * ``frame->hd.length`` means no padding is added. Returning + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` will make + * `nghttp2_session_send()` and `nghttp2_session_mem_send2()` + * functions immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_select_padding_callback2()`. + */ +typedef nghttp2_ssize (*nghttp2_select_padding_callback2)( + nghttp2_session *session, const nghttp2_frame *frame, size_t max_payloadlen, + void *user_data); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @functypedef + * + * .. warning:: + * + * Deprecated. Use + * :type:`nghttp2_data_source_read_length_callback2` instead. + * + * Callback function invoked when library wants to get max length of + * data to send data to the remote peer. The implementation of this + * function should return a value in the following range. [1, + * min(|session_remote_window_size|, |stream_remote_window_size|, + * |remote_max_frame_size|)]. If a value greater than this range is + * returned than the max allow value will be used. Returning a value + * smaller than this range is treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. The + * |frame_type| is provided for future extensibility and identifies + * the type of frame (see :type:`nghttp2_frame_type`) for which to get + * the length for. Currently supported frame types are: + * :enum:`nghttp2_frame_type.NGHTTP2_DATA`. + * + * This callback can be used to control the length in bytes for which + * :type:`nghttp2_data_source_read_callback` is allowed to send to the + * remote endpoint. This callback is optional. Returning + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` will signal the + * entire session failure. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_data_source_read_length_callback()`. + */ +typedef ssize_t (*nghttp2_data_source_read_length_callback)( + nghttp2_session *session, uint8_t frame_type, int32_t stream_id, + int32_t session_remote_window_size, int32_t stream_remote_window_size, + uint32_t remote_max_frame_size, void *user_data); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @functypedef + * + * Callback function invoked when library wants to get max length of + * data to send data to the remote peer. The implementation of this + * function should return a value in the following range. [1, + * min(|session_remote_window_size|, |stream_remote_window_size|, + * |remote_max_frame_size|)]. If a value greater than this range is + * returned than the max allow value will be used. Returning a value + * smaller than this range is treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. The + * |frame_type| is provided for future extensibility and identifies + * the type of frame (see :type:`nghttp2_frame_type`) for which to get + * the length for. Currently supported frame types are: + * :enum:`nghttp2_frame_type.NGHTTP2_DATA`. + * + * This callback can be used to control the length in bytes for which + * :type:`nghttp2_data_source_read_callback` is allowed to send to the + * remote endpoint. This callback is optional. Returning + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` will signal the + * entire session failure. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_data_source_read_length_callback2()`. + */ +typedef nghttp2_ssize (*nghttp2_data_source_read_length_callback2)( + nghttp2_session *session, uint8_t frame_type, int32_t stream_id, + int32_t session_remote_window_size, int32_t stream_remote_window_size, + uint32_t remote_max_frame_size, void *user_data); + +/** + * @functypedef + * + * Callback function invoked when a frame header is received. The + * |hd| points to received frame header. + * + * Unlike :type:`nghttp2_on_frame_recv_callback`, this callback will + * also be called when frame header of CONTINUATION frame is received. + * + * If both :type:`nghttp2_on_begin_frame_callback` and + * :type:`nghttp2_on_begin_headers_callback` are set and HEADERS or + * PUSH_PROMISE is received, :type:`nghttp2_on_begin_frame_callback` + * will be called first. + * + * The implementation of this function must return 0 if it succeeds. + * If nonzero value is returned, it is treated as fatal error and + * `nghttp2_session_recv()` and `nghttp2_session_mem_recv2()` + * functions immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * + * To set this callback to :type:`nghttp2_session_callbacks`, use + * `nghttp2_session_callbacks_set_on_begin_frame_callback()`. + */ +typedef int (*nghttp2_on_begin_frame_callback)(nghttp2_session *session, + const nghttp2_frame_hd *hd, + void *user_data); + +/** + * @functypedef + * + * Callback function invoked when chunk of extension frame payload is + * received. The |hd| points to frame header. The received + * chunk is |data| of length |len|. + * + * The implementation of this function must return 0 if it succeeds. + * + * To abort processing this extension frame, return + * :enum:`nghttp2_error.NGHTTP2_ERR_CANCEL`. + * + * If fatal error occurred, application should return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. In this case, + * `nghttp2_session_recv()` and `nghttp2_session_mem_recv2()` + * functions immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. If the other + * values are returned, currently they are treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + */ +typedef int (*nghttp2_on_extension_chunk_recv_callback)( + nghttp2_session *session, const nghttp2_frame_hd *hd, const uint8_t *data, + size_t len, void *user_data); + +/** + * @functypedef + * + * Callback function invoked when library asks the application to + * unpack extension payload from its wire format. The extension + * payload has been passed to the application using + * :type:`nghttp2_on_extension_chunk_recv_callback`. The frame header + * is already unpacked by the library and provided as |hd|. + * + * To receive extension frames, the application must tell desired + * extension frame type to the library using + * `nghttp2_option_set_user_recv_extension_type()`. + * + * The implementation of this function may store the pointer to the + * created object as a result of unpacking in |*payload|, and returns + * 0. The pointer stored in |*payload| is opaque to the library, and + * the library does not own its pointer. |*payload| is initialized as + * ``NULL``. The |*payload| is available as ``frame->ext.payload`` in + * :type:`nghttp2_on_frame_recv_callback`. Therefore if application + * can free that memory inside :type:`nghttp2_on_frame_recv_callback` + * callback. Of course, application has a liberty not to use + * |*payload|, and do its own mechanism to process extension frames. + * + * To abort processing this extension frame, return + * :enum:`nghttp2_error.NGHTTP2_ERR_CANCEL`. + * + * If fatal error occurred, application should return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. In this case, + * `nghttp2_session_recv()` and `nghttp2_session_mem_recv2()` + * functions immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. If the other + * values are returned, currently they are treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + */ +typedef int (*nghttp2_unpack_extension_callback)(nghttp2_session *session, + void **payload, + const nghttp2_frame_hd *hd, + void *user_data); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @functypedef + * + * .. warning:: + * + * Deprecated. Use :type:`nghttp2_pack_extension_callback2` + * instead. + * + * Callback function invoked when library asks the application to pack + * extension payload in its wire format. The frame header will be + * packed by library. Application must pack payload only. + * ``frame->ext.payload`` is the object passed to + * `nghttp2_submit_extension()` as payload parameter. Application + * must pack extension payload to the |buf| of its capacity |len| + * bytes. The |len| is at least 16KiB. + * + * The implementation of this function should return the number of + * bytes written into |buf| when it succeeds. + * + * To abort processing this extension frame, return + * :enum:`nghttp2_error.NGHTTP2_ERR_CANCEL`, and + * :type:`nghttp2_on_frame_not_send_callback` will be invoked. + * + * If fatal error occurred, application should return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. In this case, + * `nghttp2_session_send()` and `nghttp2_session_mem_send()` functions + * immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. If the other + * values are returned, currently they are treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. If the return + * value is strictly larger than |len|, it is treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + */ +typedef ssize_t (*nghttp2_pack_extension_callback)(nghttp2_session *session, + uint8_t *buf, size_t len, + const nghttp2_frame *frame, + void *user_data); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @functypedef + * + * Callback function invoked when library asks the application to pack + * extension payload in its wire format. The frame header will be + * packed by library. Application must pack payload only. + * ``frame->ext.payload`` is the object passed to + * `nghttp2_submit_extension()` as payload parameter. Application + * must pack extension payload to the |buf| of its capacity |len| + * bytes. The |len| is at least 16KiB. + * + * The implementation of this function should return the number of + * bytes written into |buf| when it succeeds. + * + * To abort processing this extension frame, return + * :enum:`nghttp2_error.NGHTTP2_ERR_CANCEL`, and + * :type:`nghttp2_on_frame_not_send_callback` will be invoked. + * + * If fatal error occurred, application should return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. In this case, + * `nghttp2_session_send()` and `nghttp2_session_mem_send2()` + * functions immediately return + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. If the other + * values are returned, currently they are treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. If the return + * value is strictly larger than |len|, it is treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + */ +typedef nghttp2_ssize (*nghttp2_pack_extension_callback2)( + nghttp2_session *session, uint8_t *buf, size_t len, + const nghttp2_frame *frame, void *user_data); + +/** + * @functypedef + * + * .. warning:: + * + * Deprecated. Use :type:`nghttp2_error_callback2` instead. + * + * Callback function invoked when library provides the error message + * intended for human consumption. This callback is solely for + * debugging purpose. The |msg| is typically NULL-terminated string + * of length |len|. |len| does not include the sentinel NULL + * character. + * + * The format of error message may change between nghttp2 library + * versions. The application should not depend on the particular + * format. + * + * Normally, application should return 0 from this callback. If fatal + * error occurred while doing something in this callback, application + * should return :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * In this case, library will return immediately with return value + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. Currently, if + * nonzero value is returned from this callback, they are treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`, but application + * should not rely on this details. + */ +typedef int (*nghttp2_error_callback)(nghttp2_session *session, const char *msg, + size_t len, void *user_data); + +/** + * @functypedef + * + * Callback function invoked when library provides the error code, and + * message. This callback is solely for debugging purpose. + * |lib_error_code| is one of error code defined in + * :enum:`nghttp2_error`. The |msg| is typically NULL-terminated + * string of length |len|, and intended for human consumption. |len| + * does not include the sentinel NULL character. + * + * The format of error message may change between nghttp2 library + * versions. The application should not depend on the particular + * format. + * + * Normally, application should return 0 from this callback. If fatal + * error occurred while doing something in this callback, application + * should return :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. + * In this case, library will return immediately with return value + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`. Currently, if + * nonzero value is returned from this callback, they are treated as + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE`, but application + * should not rely on this details. + */ +typedef int (*nghttp2_error_callback2)(nghttp2_session *session, + int lib_error_code, const char *msg, + size_t len, void *user_data); + +struct nghttp2_session_callbacks; + +/** + * @struct + * + * Callback functions for :type:`nghttp2_session`. The details of + * this structure are intentionally hidden from the public API. + */ +typedef struct nghttp2_session_callbacks nghttp2_session_callbacks; + +/** + * @function + * + * Initializes |*callbacks_ptr| with NULL values. + * + * The initialized object can be used when initializing multiple + * :type:`nghttp2_session` objects. + * + * When the application finished using this object, it can use + * `nghttp2_session_callbacks_del()` to free its memory. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int +nghttp2_session_callbacks_new(nghttp2_session_callbacks **callbacks_ptr); + +/** + * @function + * + * Frees any resources allocated for |callbacks|. If |callbacks| is + * ``NULL``, this function does nothing. + */ +NGHTTP2_EXTERN void +nghttp2_session_callbacks_del(nghttp2_session_callbacks *callbacks); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use `nghttp2_session_callbacks_set_send_callback2()` + * with :type:`nghttp2_send_callback2` instead. + * + * Sets callback function invoked when a session wants to send data to + * the remote peer. This callback is not necessary if the application + * uses solely `nghttp2_session_mem_send()` to serialize data to + * transmit. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_send_callback( + nghttp2_session_callbacks *cbs, nghttp2_send_callback send_callback); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @function + * + * Sets callback function invoked when a session wants to send data to + * the remote peer. This callback is not necessary if the application + * uses solely `nghttp2_session_mem_send2()` to serialize data to + * transmit. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_send_callback2( + nghttp2_session_callbacks *cbs, nghttp2_send_callback2 send_callback); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use `nghttp2_session_callbacks_set_recv_callback2()` + * with :type:`nghttp2_recv_callback2` instead. + * + * Sets callback function invoked when the a session wants to receive + * data from the remote peer. This callback is not necessary if the + * application uses solely `nghttp2_session_mem_recv()` to process + * received data. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_recv_callback( + nghttp2_session_callbacks *cbs, nghttp2_recv_callback recv_callback); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @function + * + * Sets callback function invoked when the a session wants to receive + * data from the remote peer. This callback is not necessary if the + * application uses solely `nghttp2_session_mem_recv2()` to process + * received data. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_recv_callback2( + nghttp2_session_callbacks *cbs, nghttp2_recv_callback2 recv_callback); + +/** + * @function + * + * Sets callback function invoked by `nghttp2_session_recv()` and + * `nghttp2_session_mem_recv2()` when a frame is received. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_on_frame_recv_callback( + nghttp2_session_callbacks *cbs, + nghttp2_on_frame_recv_callback on_frame_recv_callback); + +/** + * @function + * + * Sets callback function invoked by `nghttp2_session_recv()` and + * `nghttp2_session_mem_recv2()` when an invalid non-DATA frame is + * received. + */ +NGHTTP2_EXTERN void +nghttp2_session_callbacks_set_on_invalid_frame_recv_callback( + nghttp2_session_callbacks *cbs, + nghttp2_on_invalid_frame_recv_callback on_invalid_frame_recv_callback); + +/** + * @function + * + * Sets callback function invoked when a chunk of data in DATA frame + * is received. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_on_data_chunk_recv_callback( + nghttp2_session_callbacks *cbs, + nghttp2_on_data_chunk_recv_callback on_data_chunk_recv_callback); + +/** + * @function + * + * Sets callback function invoked before a non-DATA frame is sent. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_before_frame_send_callback( + nghttp2_session_callbacks *cbs, + nghttp2_before_frame_send_callback before_frame_send_callback); + +/** + * @function + * + * Sets callback function invoked after a frame is sent. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_on_frame_send_callback( + nghttp2_session_callbacks *cbs, + nghttp2_on_frame_send_callback on_frame_send_callback); + +/** + * @function + * + * Sets callback function invoked when a non-DATA frame is not sent + * because of an error. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_on_frame_not_send_callback( + nghttp2_session_callbacks *cbs, + nghttp2_on_frame_not_send_callback on_frame_not_send_callback); + +/** + * @function + * + * Sets callback function invoked when the stream is closed. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_on_stream_close_callback( + nghttp2_session_callbacks *cbs, + nghttp2_on_stream_close_callback on_stream_close_callback); + +/** + * @function + * + * Sets callback function invoked when the reception of header block + * in HEADERS or PUSH_PROMISE is started. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_on_begin_headers_callback( + nghttp2_session_callbacks *cbs, + nghttp2_on_begin_headers_callback on_begin_headers_callback); + +/** + * @function + * + * Sets callback function invoked when a header name/value pair is + * received. If both + * `nghttp2_session_callbacks_set_on_header_callback()` and + * `nghttp2_session_callbacks_set_on_header_callback2()` are used to + * set callbacks, the latter has the precedence. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_on_header_callback( + nghttp2_session_callbacks *cbs, + nghttp2_on_header_callback on_header_callback); + +/** + * @function + * + * Sets callback function invoked when a header name/value pair is + * received. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_on_header_callback2( + nghttp2_session_callbacks *cbs, + nghttp2_on_header_callback2 on_header_callback2); + +/** + * @function + * + * Sets callback function invoked when a invalid header name/value + * pair is received. If both + * `nghttp2_session_callbacks_set_on_invalid_header_callback()` and + * `nghttp2_session_callbacks_set_on_invalid_header_callback2()` are + * used to set callbacks, the latter takes the precedence. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_on_invalid_header_callback( + nghttp2_session_callbacks *cbs, + nghttp2_on_invalid_header_callback on_invalid_header_callback); + +/** + * @function + * + * Sets callback function invoked when a invalid header name/value + * pair is received. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_on_invalid_header_callback2( + nghttp2_session_callbacks *cbs, + nghttp2_on_invalid_header_callback2 on_invalid_header_callback2); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use + * `nghttp2_session_callbacks_set_select_padding_callback2()` with + * :type:`nghttp2_select_padding_callback2` instead. + * + * Sets callback function invoked when the library asks application + * how many padding bytes are required for the transmission of the + * given frame. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_select_padding_callback( + nghttp2_session_callbacks *cbs, + nghttp2_select_padding_callback select_padding_callback); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @function + * + * Sets callback function invoked when the library asks application + * how many padding bytes are required for the transmission of the + * given frame. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_select_padding_callback2( + nghttp2_session_callbacks *cbs, + nghttp2_select_padding_callback2 select_padding_callback); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use + * `nghttp2_session_callbacks_set_data_source_read_length_callback2()` + * with :type:`nghttp2_data_source_read_length_callback2` instead. + * + * Sets callback function determine the length allowed in + * :type:`nghttp2_data_source_read_callback`. + */ +NGHTTP2_EXTERN void +nghttp2_session_callbacks_set_data_source_read_length_callback( + nghttp2_session_callbacks *cbs, + nghttp2_data_source_read_length_callback data_source_read_length_callback); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @function + * + * Sets callback function determine the length allowed in + * :type:`nghttp2_data_source_read_callback2`. + */ +NGHTTP2_EXTERN void +nghttp2_session_callbacks_set_data_source_read_length_callback2( + nghttp2_session_callbacks *cbs, + nghttp2_data_source_read_length_callback2 data_source_read_length_callback); + +/** + * @function + * + * Sets callback function invoked when a frame header is received. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_on_begin_frame_callback( + nghttp2_session_callbacks *cbs, + nghttp2_on_begin_frame_callback on_begin_frame_callback); + +/** + * @function + * + * Sets callback function invoked when + * :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_NO_COPY` is used in + * :type:`nghttp2_data_source_read_callback2` to avoid data copy. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_send_data_callback( + nghttp2_session_callbacks *cbs, + nghttp2_send_data_callback send_data_callback); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use + * `nghttp2_session_callbacks_set_pack_extension_callback2()` with + * :type:`nghttp2_pack_extension_callback2` instead. + * + * Sets callback function invoked when the library asks the + * application to pack extension frame payload in wire format. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_pack_extension_callback( + nghttp2_session_callbacks *cbs, + nghttp2_pack_extension_callback pack_extension_callback); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @function + * + * Sets callback function invoked when the library asks the + * application to pack extension frame payload in wire format. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_pack_extension_callback2( + nghttp2_session_callbacks *cbs, + nghttp2_pack_extension_callback2 pack_extension_callback); + +/** + * @function + * + * Sets callback function invoked when the library asks the + * application to unpack extension frame payload from wire format. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_unpack_extension_callback( + nghttp2_session_callbacks *cbs, + nghttp2_unpack_extension_callback unpack_extension_callback); + +/** + * @function + * + * Sets callback function invoked when chunk of extension frame + * payload is received. + */ +NGHTTP2_EXTERN void +nghttp2_session_callbacks_set_on_extension_chunk_recv_callback( + nghttp2_session_callbacks *cbs, + nghttp2_on_extension_chunk_recv_callback on_extension_chunk_recv_callback); + +/** + * @function + * + * .. warning:: + * + * Deprecated. Use + * `nghttp2_session_callbacks_set_error_callback2()` with + * :type:`nghttp2_error_callback2` instead. + * + * Sets callback function invoked when library tells error message to + * the application. + * + * If both :type:`nghttp2_error_callback` and + * :type:`nghttp2_error_callback2` are set, the latter takes + * precedence. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_error_callback( + nghttp2_session_callbacks *cbs, nghttp2_error_callback error_callback); + +/** + * @function + * + * Sets callback function invoked when library tells error code, and + * message to the application. + * + * If both :type:`nghttp2_error_callback` and + * :type:`nghttp2_error_callback2` are set, the latter takes + * precedence. + */ +NGHTTP2_EXTERN void nghttp2_session_callbacks_set_error_callback2( + nghttp2_session_callbacks *cbs, nghttp2_error_callback2 error_callback2); + +/** + * @functypedef + * + * Custom memory allocator to replace malloc(). The |mem_user_data| + * is the mem_user_data member of :type:`nghttp2_mem` structure. + */ +typedef void *(*nghttp2_malloc)(size_t size, void *mem_user_data); + +/** + * @functypedef + * + * Custom memory allocator to replace free(). The |mem_user_data| is + * the mem_user_data member of :type:`nghttp2_mem` structure. + */ +typedef void (*nghttp2_free)(void *ptr, void *mem_user_data); + +/** + * @functypedef + * + * Custom memory allocator to replace calloc(). The |mem_user_data| + * is the mem_user_data member of :type:`nghttp2_mem` structure. + */ +typedef void *(*nghttp2_calloc)(size_t nmemb, size_t size, void *mem_user_data); + +/** + * @functypedef + * + * Custom memory allocator to replace realloc(). The |mem_user_data| + * is the mem_user_data member of :type:`nghttp2_mem` structure. + */ +typedef void *(*nghttp2_realloc)(void *ptr, size_t size, void *mem_user_data); + +/** + * @struct + * + * Custom memory allocator functions and user defined pointer. The + * |mem_user_data| member is passed to each allocator function. This + * can be used, for example, to achieve per-session memory pool. + * + * In the following example code, ``my_malloc``, ``my_free``, + * ``my_calloc`` and ``my_realloc`` are the replacement of the + * standard allocators ``malloc``, ``free``, ``calloc`` and + * ``realloc`` respectively:: + * + * void *my_malloc_cb(size_t size, void *mem_user_data) { + * return my_malloc(size); + * } + * + * void my_free_cb(void *ptr, void *mem_user_data) { my_free(ptr); } + * + * void *my_calloc_cb(size_t nmemb, size_t size, void *mem_user_data) { + * return my_calloc(nmemb, size); + * } + * + * void *my_realloc_cb(void *ptr, size_t size, void *mem_user_data) { + * return my_realloc(ptr, size); + * } + * + * void session_new() { + * nghttp2_session *session; + * nghttp2_session_callbacks *callbacks; + * nghttp2_mem mem = {NULL, my_malloc_cb, my_free_cb, my_calloc_cb, + * my_realloc_cb}; + * + * ... + * + * nghttp2_session_client_new3(&session, callbacks, NULL, NULL, &mem); + * + * ... + * } + */ +typedef struct { + /** + * An arbitrary user supplied data. This is passed to each + * allocator function. + */ + void *mem_user_data; + /** + * Custom allocator function to replace malloc(). + */ + nghttp2_malloc malloc; + /** + * Custom allocator function to replace free(). + */ + nghttp2_free free; + /** + * Custom allocator function to replace calloc(). + */ + nghttp2_calloc calloc; + /** + * Custom allocator function to replace realloc(). + */ + nghttp2_realloc realloc; +} nghttp2_mem; + +struct nghttp2_option; + +/** + * @struct + * + * Configuration options for :type:`nghttp2_session`. The details of + * this structure are intentionally hidden from the public API. + */ +typedef struct nghttp2_option nghttp2_option; + +/** + * @function + * + * Initializes |*option_ptr| with default values. + * + * When the application finished using this object, it can use + * `nghttp2_option_del()` to free its memory. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int nghttp2_option_new(nghttp2_option **option_ptr); + +/** + * @function + * + * Frees any resources allocated for |option|. If |option| is + * ``NULL``, this function does nothing. + */ +NGHTTP2_EXTERN void nghttp2_option_del(nghttp2_option *option); + +/** + * @function + * + * This option prevents the library from sending WINDOW_UPDATE for a + * connection automatically. If this option is set to nonzero, the + * library won't send WINDOW_UPDATE for DATA until application calls + * `nghttp2_session_consume()` to indicate the consumed amount of + * data. Don't use `nghttp2_submit_window_update()` for this purpose. + * By default, this option is set to zero. + */ +NGHTTP2_EXTERN void +nghttp2_option_set_no_auto_window_update(nghttp2_option *option, int val); + +/** + * @function + * + * This option sets the SETTINGS_MAX_CONCURRENT_STREAMS value of + * remote endpoint as if it is received in SETTINGS frame. Without + * specifying this option, the maximum number of outgoing concurrent + * streams is initially limited to 100 to avoid issues when the local + * endpoint submits lots of requests before receiving initial SETTINGS + * frame from the remote endpoint, since sending them at once to the + * remote endpoint could lead to rejection of some of the requests. + * This value will be overwritten when the local endpoint receives + * initial SETTINGS frame from the remote endpoint, either to the + * value advertised in SETTINGS_MAX_CONCURRENT_STREAMS or to the + * default value (unlimited) if none was advertised. + */ +NGHTTP2_EXTERN void +nghttp2_option_set_peer_max_concurrent_streams(nghttp2_option *option, + uint32_t val); + +/** + * @function + * + * By default, nghttp2 library, if configured as server, requires + * first 24 bytes of client magic byte string (MAGIC). In most cases, + * this will simplify the implementation of server. But sometimes + * server may want to detect the application protocol based on first + * few bytes on clear text communication. + * + * If this option is used with nonzero |val|, nghttp2 library does not + * handle MAGIC. It still checks following SETTINGS frame. This + * means that applications should deal with MAGIC by themselves. + * + * If this option is not used or used with zero value, if MAGIC does + * not match :macro:`NGHTTP2_CLIENT_MAGIC`, `nghttp2_session_recv()` + * and `nghttp2_session_mem_recv2()` will return error + * :enum:`nghttp2_error.NGHTTP2_ERR_BAD_CLIENT_MAGIC`, which is fatal + * error. + */ +NGHTTP2_EXTERN void +nghttp2_option_set_no_recv_client_magic(nghttp2_option *option, int val); + +/** + * @function + * + * By default, nghttp2 library enforces subset of HTTP Messaging rules + * described in `HTTP/2 specification, section 8 + * `_. See + * :ref:`http-messaging` section for details. For those applications + * who use nghttp2 library as non-HTTP use, give nonzero to |val| to + * disable this enforcement. Please note that disabling this feature + * does not change the fundamental client and server model of HTTP. + * That is, even if the validation is disabled, only client can send + * requests. + */ +NGHTTP2_EXTERN void nghttp2_option_set_no_http_messaging(nghttp2_option *option, + int val); + +/** + * @function + * + * RFC 7540 does not enforce any limit on the number of incoming + * reserved streams (in RFC 7540 terms, streams in reserved (remote) + * state). This only affects client side, since only server can push + * streams. Malicious server can push arbitrary number of streams, + * and make client's memory exhausted. This option can set the + * maximum number of such incoming streams to avoid possible memory + * exhaustion. If this option is set, and pushed streams are + * automatically closed on reception, without calling user provided + * callback, if they exceed the given limit. The default value is + * 200. If session is configured as server side, this option has no + * effect. Server can control the number of streams to push. + */ +NGHTTP2_EXTERN void +nghttp2_option_set_max_reserved_remote_streams(nghttp2_option *option, + uint32_t val); + +/** + * @function + * + * Sets extension frame type the application is willing to handle with + * user defined callbacks (see + * :type:`nghttp2_on_extension_chunk_recv_callback` and + * :type:`nghttp2_unpack_extension_callback`). The |type| is + * extension frame type, and must be strictly greater than 0x9. + * Otherwise, this function does nothing. The application can call + * this function multiple times to set more than one frame type to + * receive. The application does not have to call this function if it + * just sends extension frames. + */ +NGHTTP2_EXTERN void +nghttp2_option_set_user_recv_extension_type(nghttp2_option *option, + uint8_t type); + +/** + * @function + * + * Sets extension frame type the application is willing to receive + * using builtin handler. The |type| is the extension frame type to + * receive, and must be strictly greater than 0x9. Otherwise, this + * function does nothing. The application can call this function + * multiple times to set more than one frame type to receive. The + * application does not have to call this function if it just sends + * extension frames. + * + * If same frame type is passed to both + * `nghttp2_option_set_builtin_recv_extension_type()` and + * `nghttp2_option_set_user_recv_extension_type()`, the latter takes + * precedence. + */ +NGHTTP2_EXTERN void +nghttp2_option_set_builtin_recv_extension_type(nghttp2_option *option, + uint8_t type); + +/** + * @function + * + * This option prevents the library from sending PING frame with ACK + * flag set automatically when PING frame without ACK flag set is + * received. If this option is set to nonzero, the library won't send + * PING frame with ACK flag set in the response for incoming PING + * frame. The application can send PING frame with ACK flag set using + * `nghttp2_submit_ping()` with :enum:`nghttp2_flag.NGHTTP2_FLAG_ACK` + * as flags parameter. + */ +NGHTTP2_EXTERN void nghttp2_option_set_no_auto_ping_ack(nghttp2_option *option, + int val); + +/** + * @function + * + * This option sets the maximum length of header block (a set of + * header fields per one HEADERS frame) to send. The length of a + * given set of header fields is calculated using + * `nghttp2_hd_deflate_bound()`. The default value is 64KiB. If + * application attempts to send header fields larger than this limit, + * the transmission of the frame fails with error code + * :enum:`nghttp2_error.NGHTTP2_ERR_FRAME_SIZE_ERROR`. + */ +NGHTTP2_EXTERN void +nghttp2_option_set_max_send_header_block_length(nghttp2_option *option, + size_t val); + +/** + * @function + * + * This option sets the maximum dynamic table size for deflating + * header fields. The default value is 4KiB. In HTTP/2, receiver of + * deflated header block can specify maximum dynamic table size. The + * actual maximum size is the minimum of the size receiver specified + * and this option value. + */ +NGHTTP2_EXTERN void +nghttp2_option_set_max_deflate_dynamic_table_size(nghttp2_option *option, + size_t val); + +/** + * @function + * + * .. warning:: + * + * Deprecated. Closed streams are not retained anymore. + * + * This function works as before, but it does not take any effect + * against :type:`nghttp2_session`. + */ +NGHTTP2_EXTERN void nghttp2_option_set_no_closed_streams(nghttp2_option *option, + int val); + +/** + * @function + * + * This function sets the maximum number of outgoing SETTINGS ACK and + * PING ACK frames retained in :type:`nghttp2_session` object. If + * more than those frames are retained, the peer is considered to be + * misbehaving and session will be closed. The default value is 1000. + */ +NGHTTP2_EXTERN void nghttp2_option_set_max_outbound_ack(nghttp2_option *option, + size_t val); + +/** + * @function + * + * This function sets the maximum number of SETTINGS entries per + * SETTINGS frame that will be accepted. If more than those entries + * are received, the peer is considered to be misbehaving and session + * will be closed. The default value is 32. + */ +NGHTTP2_EXTERN void nghttp2_option_set_max_settings(nghttp2_option *option, + size_t val); + +/** + * @function + * + * .. warning:: + * Deprecated. :rfc:`7540` priorities have been removed. + * + * This function works as before, but it does not take any effect + * against :type:`nghttp2_session`. + */ +NGHTTP2_EXTERN void +nghttp2_option_set_server_fallback_rfc7540_priorities(nghttp2_option *option, + int val); + +/** + * @function + * + * This option, if set to nonzero, turns off RFC 9113 leading and + * trailing white spaces validation against HTTP field value. Some + * important fields, such as HTTP/2 pseudo header fields, are + * validated more strictly and this option does not apply to them. + */ +NGHTTP2_EXTERN void +nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation( + nghttp2_option *option, int val); + +/** + * @function + * + * This function sets the rate limit for the incoming stream reset + * (RST_STREAM frame). It is server use only. It is a token-bucket + * based rate limiter. |burst| specifies the number of tokens that is + * initially available. The maximum number of tokens is capped to + * this value. |rate| specifies the number of tokens that are + * regenerated per second. An incoming RST_STREAM consumes one token. + * If there is no token available, GOAWAY is sent to tear down the + * connection. |burst| and |rate| default to 1000 and 33 + * respectively. + */ +NGHTTP2_EXTERN void +nghttp2_option_set_stream_reset_rate_limit(nghttp2_option *option, + uint64_t burst, uint64_t rate); + +/** + * @function + * + * This function sets the maximum number of CONTINUATION frames + * following an incoming HEADER frame. If more than those frames are + * received, the remote endpoint is considered to be misbehaving and + * session will be closed. The default value is 8. + */ +NGHTTP2_EXTERN void nghttp2_option_set_max_continuations(nghttp2_option *option, + size_t val); + +/** + * @function + * + * Initializes |*session_ptr| for client use. The all members of + * |callbacks| are copied to |*session_ptr|. Therefore |*session_ptr| + * does not store |callbacks|. The |user_data| is an arbitrary user + * supplied data, which will be passed to the callback functions. + * + * The :type:`nghttp2_send_callback2` must be specified. If the + * application code uses `nghttp2_session_recv()`, the + * :type:`nghttp2_recv_callback` must be specified. The other members + * of |callbacks| can be ``NULL``. + * + * If this function fails, |*session_ptr| is left untouched. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int +nghttp2_session_client_new(nghttp2_session **session_ptr, + const nghttp2_session_callbacks *callbacks, + void *user_data); + +/** + * @function + * + * Initializes |*session_ptr| for server use. The all members of + * |callbacks| are copied to |*session_ptr|. Therefore |*session_ptr| + * does not store |callbacks|. The |user_data| is an arbitrary user + * supplied data, which will be passed to the callback functions. + * + * The :type:`nghttp2_send_callback2` must be specified. If the + * application code uses `nghttp2_session_recv()`, the + * :type:`nghttp2_recv_callback` must be specified. The other members + * of |callbacks| can be ``NULL``. + * + * If this function fails, |*session_ptr| is left untouched. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int +nghttp2_session_server_new(nghttp2_session **session_ptr, + const nghttp2_session_callbacks *callbacks, + void *user_data); + +/** + * @function + * + * Like `nghttp2_session_client_new()`, but with additional options + * specified in the |option|. + * + * The |option| can be ``NULL`` and the call is equivalent to + * `nghttp2_session_client_new()`. + * + * This function does not take ownership |option|. The application is + * responsible for freeing |option| if it finishes using the object. + * + * The library code does not refer to |option| after this function + * returns. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int +nghttp2_session_client_new2(nghttp2_session **session_ptr, + const nghttp2_session_callbacks *callbacks, + void *user_data, const nghttp2_option *option); + +/** + * @function + * + * Like `nghttp2_session_server_new()`, but with additional options + * specified in the |option|. + * + * The |option| can be ``NULL`` and the call is equivalent to + * `nghttp2_session_server_new()`. + * + * This function does not take ownership |option|. The application is + * responsible for freeing |option| if it finishes using the object. + * + * The library code does not refer to |option| after this function + * returns. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int +nghttp2_session_server_new2(nghttp2_session **session_ptr, + const nghttp2_session_callbacks *callbacks, + void *user_data, const nghttp2_option *option); + +/** + * @function + * + * Like `nghttp2_session_client_new2()`, but with additional custom + * memory allocator specified in the |mem|. + * + * The |mem| can be ``NULL`` and the call is equivalent to + * `nghttp2_session_client_new2()`. + * + * This function does not take ownership |mem|. The application is + * responsible for freeing |mem|. + * + * The library code does not refer to |mem| pointer after this + * function returns, so the application can safely free it. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int nghttp2_session_client_new3( + nghttp2_session **session_ptr, const nghttp2_session_callbacks *callbacks, + void *user_data, const nghttp2_option *option, nghttp2_mem *mem); + +/** + * @function + * + * Like `nghttp2_session_server_new2()`, but with additional custom + * memory allocator specified in the |mem|. + * + * The |mem| can be ``NULL`` and the call is equivalent to + * `nghttp2_session_server_new2()`. + * + * This function does not take ownership |mem|. The application is + * responsible for freeing |mem|. + * + * The library code does not refer to |mem| pointer after this + * function returns, so the application can safely free it. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int nghttp2_session_server_new3( + nghttp2_session **session_ptr, const nghttp2_session_callbacks *callbacks, + void *user_data, const nghttp2_option *option, nghttp2_mem *mem); + +/** + * @function + * + * Frees any resources allocated for |session|. If |session| is + * ``NULL``, this function does nothing. + */ +NGHTTP2_EXTERN void nghttp2_session_del(nghttp2_session *session); + +/** + * @function + * + * Sends pending frames to the remote peer. + * + * This function retrieves the highest prioritized frame from the + * outbound queue and sends it to the remote peer. It does this as + * many times as possible until the user callback + * :type:`nghttp2_send_callback2` returns + * :enum:`nghttp2_error.NGHTTP2_ERR_WOULDBLOCK`, the outbound queue + * becomes empty or flow control is triggered (remote window size + * becomes depleted or maximum number of concurrent streams is + * reached). This function calls several callback functions which are + * passed when initializing the |session|. Here is the simple time + * chart which tells when each callback is invoked: + * + * 1. Get the next frame to send from outbound queue. + * + * 2. Prepare transmission of the frame. + * + * 3. If the control frame cannot be sent because some preconditions + * are not met (e.g., request HEADERS cannot be sent after GOAWAY), + * :type:`nghttp2_on_frame_not_send_callback` is invoked. Abort + * the following steps. + * + * 4. If the frame is HEADERS, PUSH_PROMISE or DATA, + * :type:`nghttp2_select_padding_callback` is invoked. + * + * 5. If the frame is request HEADERS, the stream is opened here. + * + * 6. :type:`nghttp2_before_frame_send_callback` is invoked. + * + * 7. If :enum:`nghttp2_error.NGHTTP2_ERR_CANCEL` is returned from + * :type:`nghttp2_before_frame_send_callback`, the current frame + * transmission is canceled, and + * :type:`nghttp2_on_frame_not_send_callback` is invoked. Abort + * the following steps. + * + * 8. :type:`nghttp2_send_callback2` is invoked one or more times to + * send the frame. + * + * 9. :type:`nghttp2_on_frame_send_callback` is invoked. + * + * 10. If the transmission of the frame triggers closure of the + * stream, the stream is closed and + * :type:`nghttp2_on_stream_close_callback` is invoked. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` + * The callback function failed. + */ +NGHTTP2_EXTERN int nghttp2_session_send(nghttp2_session *session); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use `nghttp2_session_mem_send2()` instead. + * + * Returns the serialized data to send. + * + * This function behaves like `nghttp2_session_send()` except that it + * does not use :type:`nghttp2_send_callback` to transmit data. + * Instead, it assigns the pointer to the serialized data to the + * |*data_ptr| and returns its length. The other callbacks are called + * in the same way as they are in `nghttp2_session_send()`. + * + * If no data is available to send, this function returns 0. + * + * This function may not return all serialized data in one invocation. + * To get all data, call this function repeatedly until it returns 0 + * or one of negative error codes. + * + * The assigned |*data_ptr| is valid until the next call of + * `nghttp2_session_mem_send()` or `nghttp2_session_send()`. + * + * The caller must send all data before sending the next chunk of + * data. + * + * This function returns the length of the data pointed by the + * |*data_ptr| if it succeeds, or one of the following negative error + * codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * + * .. note:: + * + * This function may produce very small byte string. If that is the + * case, and application disables Nagle algorithm (``TCP_NODELAY``), + * then writing this small chunk leads to very small packet, and it + * is very inefficient. An application should be responsible to + * buffer up small chunks of data as necessary to avoid this + * situation. + */ +NGHTTP2_EXTERN ssize_t nghttp2_session_mem_send(nghttp2_session *session, + const uint8_t **data_ptr); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @function + * + * Returns the serialized data to send. + * + * This function behaves like `nghttp2_session_send()` except that it + * does not use :type:`nghttp2_send_callback2` to transmit data. + * Instead, it assigns the pointer to the serialized data to the + * |*data_ptr| and returns its length. The other callbacks are called + * in the same way as they are in `nghttp2_session_send()`. + * + * If no data is available to send, this function returns 0. + * + * This function may not return all serialized data in one invocation. + * To get all data, call this function repeatedly until it returns 0 + * or one of negative error codes. + * + * The assigned |*data_ptr| is valid until the next call of + * `nghttp2_session_mem_send2()` or `nghttp2_session_send()`. + * + * The caller must send all data before sending the next chunk of + * data. + * + * This function returns the length of the data pointed by the + * |*data_ptr| if it succeeds, or one of the following negative error + * codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * + * .. note:: + * + * This function may produce very small byte string. If that is the + * case, and application disables Nagle algorithm (``TCP_NODELAY``), + * then writing this small chunk leads to very small packet, and it + * is very inefficient. An application should be responsible to + * buffer up small chunks of data as necessary to avoid this + * situation. + */ +NGHTTP2_EXTERN nghttp2_ssize +nghttp2_session_mem_send2(nghttp2_session *session, const uint8_t **data_ptr); + +/** + * @function + * + * Receives frames from the remote peer. + * + * This function receives as many frames as possible until the user + * callback :type:`nghttp2_recv_callback` returns + * :enum:`nghttp2_error.NGHTTP2_ERR_WOULDBLOCK`. This function calls + * several callback functions which are passed when initializing the + * |session|. Here is the simple time chart which tells when each + * callback is invoked: + * + * 1. :type:`nghttp2_recv_callback` is invoked one or more times to + * receive frame header. + * + * 2. When frame header is received, + * :type:`nghttp2_on_begin_frame_callback` is invoked. + * + * 3. If the frame is DATA frame: + * + * 1. :type:`nghttp2_recv_callback` is invoked to receive DATA + * payload. For each chunk of data, + * :type:`nghttp2_on_data_chunk_recv_callback` is invoked. + * + * 2. If one DATA frame is completely received, + * :type:`nghttp2_on_frame_recv_callback` is invoked. If the + * reception of the frame triggers the closure of the stream, + * :type:`nghttp2_on_stream_close_callback` is invoked. + * + * 4. If the frame is the control frame: + * + * 1. :type:`nghttp2_recv_callback` is invoked one or more times to + * receive whole frame. + * + * 2. If the received frame is valid, then following actions are + * taken. If the frame is either HEADERS or PUSH_PROMISE, + * :type:`nghttp2_on_begin_headers_callback` is invoked. Then + * :type:`nghttp2_on_header_callback` is invoked for each header + * name/value pair. For invalid header field, + * :type:`nghttp2_on_invalid_header_callback` is called. After + * all name/value pairs are emitted successfully, + * :type:`nghttp2_on_frame_recv_callback` is invoked. For other + * frames, :type:`nghttp2_on_frame_recv_callback` is invoked. + * If the reception of the frame triggers the closure of the + * stream, :type:`nghttp2_on_stream_close_callback` is invoked. + * + * 3. If the received frame is unpacked but is interpreted as + * invalid, :type:`nghttp2_on_invalid_frame_recv_callback` is + * invoked. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_EOF` + * The remote peer did shutdown on the connection. + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` + * The callback function failed. + * :enum:`nghttp2_error.NGHTTP2_ERR_BAD_CLIENT_MAGIC` + * Invalid client magic was detected. This error only returns + * when |session| was configured as server and + * `nghttp2_option_set_no_recv_client_magic()` is not used with + * nonzero value. + * :enum:`nghttp2_error.NGHTTP2_ERR_FLOODED` + * Flooding was detected in this HTTP/2 session, and it must be + * closed. This is most likely caused by misbehaviour of peer. + */ +NGHTTP2_EXTERN int nghttp2_session_recv(nghttp2_session *session); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use `nghttp2_session_mem_recv2()` instead. + * + * Processes data |in| as an input from the remote endpoint. The + * |inlen| indicates the number of bytes to receive in the |in|. + * + * This function behaves like `nghttp2_session_recv()` except that it + * does not use :type:`nghttp2_recv_callback` to receive data; the + * |in| is the only data for the invocation of this function. If all + * bytes are processed, this function returns. The other callbacks + * are called in the same way as they are in `nghttp2_session_recv()`. + * + * In the current implementation, this function always tries to + * processes |inlen| bytes of input data unless either an error occurs or + * :enum:`nghttp2_error.NGHTTP2_ERR_PAUSE` is returned from + * :type:`nghttp2_on_header_callback` or + * :type:`nghttp2_on_data_chunk_recv_callback`. If + * :enum:`nghttp2_error.NGHTTP2_ERR_PAUSE` is used, the return value + * includes the number of bytes which was used to produce the data or + * frame for the callback. + * + * This function returns the number of processed bytes, or one of the + * following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` + * The callback function failed. + * :enum:`nghttp2_error.NGHTTP2_ERR_BAD_CLIENT_MAGIC` + * Invalid client magic was detected. This error only returns + * when |session| was configured as server and + * `nghttp2_option_set_no_recv_client_magic()` is not used with + * nonzero value. + * :enum:`nghttp2_error.NGHTTP2_ERR_FLOODED` + * Flooding was detected in this HTTP/2 session, and it must be + * closed. This is most likely caused by misbehaviour of peer. + */ +NGHTTP2_EXTERN ssize_t nghttp2_session_mem_recv(nghttp2_session *session, + const uint8_t *in, + size_t inlen); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @function + * + * Processes data |in| as an input from the remote endpoint. The + * |inlen| indicates the number of bytes to receive in the |in|. + * + * This function behaves like `nghttp2_session_recv()` except that it + * does not use :type:`nghttp2_recv_callback` to receive data; the + * |in| is the only data for the invocation of this function. If all + * bytes are processed, this function returns. The other callbacks + * are called in the same way as they are in `nghttp2_session_recv()`. + * + * In the current implementation, this function always tries to + * processes |inlen| bytes of input data unless either an error occurs or + * :enum:`nghttp2_error.NGHTTP2_ERR_PAUSE` is returned from + * :type:`nghttp2_on_header_callback` or + * :type:`nghttp2_on_data_chunk_recv_callback`. If + * :enum:`nghttp2_error.NGHTTP2_ERR_PAUSE` is used, the return value + * includes the number of bytes which was used to produce the data or + * frame for the callback. + * + * This function returns the number of processed bytes, or one of the + * following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_CALLBACK_FAILURE` + * The callback function failed. + * :enum:`nghttp2_error.NGHTTP2_ERR_BAD_CLIENT_MAGIC` + * Invalid client magic was detected. This error only returns + * when |session| was configured as server and + * `nghttp2_option_set_no_recv_client_magic()` is not used with + * nonzero value. + * :enum:`nghttp2_error.NGHTTP2_ERR_FLOODED` + * Flooding was detected in this HTTP/2 session, and it must be + * closed. This is most likely caused by misbehaviour of peer. + */ +NGHTTP2_EXTERN nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, + const uint8_t *in, + size_t inlen); + +/** + * @function + * + * Puts back previously deferred DATA frame in the stream |stream_id| + * to the outbound queue. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The stream does not exist; or no deferred data exist. + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int nghttp2_session_resume_data(nghttp2_session *session, + int32_t stream_id); + +/** + * @function + * + * Returns nonzero value if |session| wants to receive data from the + * remote peer. + * + * If both `nghttp2_session_want_read()` and + * `nghttp2_session_want_write()` return 0, the application should + * drop the connection. + */ +NGHTTP2_EXTERN int nghttp2_session_want_read(nghttp2_session *session); + +/** + * @function + * + * Returns nonzero value if |session| wants to send data to the remote + * peer. + * + * If both `nghttp2_session_want_read()` and + * `nghttp2_session_want_write()` return 0, the application should + * drop the connection. + */ +NGHTTP2_EXTERN int nghttp2_session_want_write(nghttp2_session *session); + +/** + * @function + * + * Returns stream_user_data for the stream |stream_id|. The + * stream_user_data is provided by `nghttp2_submit_request2()`, + * `nghttp2_submit_headers()` or + * `nghttp2_session_set_stream_user_data()`. Unless it is set using + * `nghttp2_session_set_stream_user_data()`, if the stream is + * initiated by the remote endpoint, stream_user_data is always + * ``NULL``. If the stream does not exist, this function returns + * ``NULL``. + */ +NGHTTP2_EXTERN void * +nghttp2_session_get_stream_user_data(nghttp2_session *session, + int32_t stream_id); + +/** + * @function + * + * Sets the |stream_user_data| to the stream denoted by the + * |stream_id|. If a stream user data is already set to the stream, + * it is replaced with the |stream_user_data|. It is valid to specify + * ``NULL`` in the |stream_user_data|, which nullifies the associated + * data pointer. + * + * It is valid to set the |stream_user_data| to the stream reserved by + * PUSH_PROMISE frame. + * + * This function returns 0 if it succeeds, or one of following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The stream does not exist + */ +NGHTTP2_EXTERN int +nghttp2_session_set_stream_user_data(nghttp2_session *session, + int32_t stream_id, void *stream_user_data); + +/** + * @function + * + * Sets |user_data| to |session|, overwriting the existing user data + * specified in `nghttp2_session_client_new()`, or + * `nghttp2_session_server_new()`. + */ +NGHTTP2_EXTERN void nghttp2_session_set_user_data(nghttp2_session *session, + void *user_data); + +/** + * @function + * + * Returns the number of frames in the outbound queue. This does not + * include the deferred DATA frames. + */ +NGHTTP2_EXTERN size_t +nghttp2_session_get_outbound_queue_size(nghttp2_session *session); + +/** + * @function + * + * Returns the number of DATA payload in bytes received without + * WINDOW_UPDATE transmission for the stream |stream_id|. The local + * (receive) window size can be adjusted by + * `nghttp2_submit_window_update()`. This function takes into account + * that and returns effective data length. In particular, if the + * local window size is reduced by submitting negative + * window_size_increment with `nghttp2_submit_window_update()`, this + * function returns the number of bytes less than actually received. + * + * This function returns -1 if it fails. + */ +NGHTTP2_EXTERN int32_t nghttp2_session_get_stream_effective_recv_data_length( + nghttp2_session *session, int32_t stream_id); + +/** + * @function + * + * Returns the local (receive) window size for the stream |stream_id|. + * The local window size can be adjusted by + * `nghttp2_submit_window_update()`. This function takes into account + * that and returns effective window size. + * + * This function does not take into account the amount of received + * data from the remote endpoint. Use + * `nghttp2_session_get_stream_local_window_size()` to know the amount + * of data the remote endpoint can send without receiving stream level + * WINDOW_UPDATE frame. Note that each stream is still subject to the + * connection level flow control. + * + * This function returns -1 if it fails. + */ +NGHTTP2_EXTERN int32_t nghttp2_session_get_stream_effective_local_window_size( + nghttp2_session *session, int32_t stream_id); + +/** + * @function + * + * Returns the amount of flow-controlled payload (e.g., DATA) that the + * remote endpoint can send without receiving stream level + * WINDOW_UPDATE frame. It is also subject to the connection level + * flow control. So the actual amount of data to send is + * min(`nghttp2_session_get_stream_local_window_size()`, + * `nghttp2_session_get_local_window_size()`). + * + * This function returns -1 if it fails. + */ +NGHTTP2_EXTERN int32_t nghttp2_session_get_stream_local_window_size( + nghttp2_session *session, int32_t stream_id); + +/** + * @function + * + * Returns the number of DATA payload in bytes received without + * WINDOW_UPDATE transmission for a connection. The local (receive) + * window size can be adjusted by `nghttp2_submit_window_update()`. + * This function takes into account that and returns effective data + * length. In particular, if the local window size is reduced by + * submitting negative window_size_increment with + * `nghttp2_submit_window_update()`, this function returns the number + * of bytes less than actually received. + * + * This function returns -1 if it fails. + */ +NGHTTP2_EXTERN int32_t +nghttp2_session_get_effective_recv_data_length(nghttp2_session *session); + +/** + * @function + * + * Returns the local (receive) window size for a connection. The + * local window size can be adjusted by + * `nghttp2_submit_window_update()`. This function takes into account + * that and returns effective window size. + * + * This function does not take into account the amount of received + * data from the remote endpoint. Use + * `nghttp2_session_get_local_window_size()` to know the amount of + * data the remote endpoint can send without receiving + * connection-level WINDOW_UPDATE frame. Note that each stream is + * still subject to the stream level flow control. + * + * This function returns -1 if it fails. + */ +NGHTTP2_EXTERN int32_t +nghttp2_session_get_effective_local_window_size(nghttp2_session *session); + +/** + * @function + * + * Returns the amount of flow-controlled payload (e.g., DATA) that the + * remote endpoint can send without receiving connection level + * WINDOW_UPDATE frame. Note that each stream is still subject to the + * stream level flow control (see + * `nghttp2_session_get_stream_local_window_size()`). + * + * This function returns -1 if it fails. + */ +NGHTTP2_EXTERN int32_t +nghttp2_session_get_local_window_size(nghttp2_session *session); + +/** + * @function + * + * Returns the remote window size for a given stream |stream_id|. + * + * This is the amount of flow-controlled payload (e.g., DATA) that the + * local endpoint can send without stream level WINDOW_UPDATE. There + * is also connection level flow control, so the effective size of + * payload that the local endpoint can actually send is + * min(`nghttp2_session_get_stream_remote_window_size()`, + * `nghttp2_session_get_remote_window_size()`). + * + * This function returns -1 if it fails. + */ +NGHTTP2_EXTERN int32_t nghttp2_session_get_stream_remote_window_size( + nghttp2_session *session, int32_t stream_id); + +/** + * @function + * + * Returns the remote window size for a connection. + * + * This function always succeeds. + */ +NGHTTP2_EXTERN int32_t +nghttp2_session_get_remote_window_size(nghttp2_session *session); + +/** + * @function + * + * Returns 1 if local peer half closed the given stream |stream_id|. + * Returns 0 if it did not. Returns -1 if no such stream exists. + */ +NGHTTP2_EXTERN int +nghttp2_session_get_stream_local_close(nghttp2_session *session, + int32_t stream_id); + +/** + * @function + * + * Returns 1 if remote peer half closed the given stream |stream_id|. + * Returns 0 if it did not. Returns -1 if no such stream exists. + */ +NGHTTP2_EXTERN int +nghttp2_session_get_stream_remote_close(nghttp2_session *session, + int32_t stream_id); + +/** + * @function + * + * Returns the current dynamic table size of HPACK inflater, including + * the overhead 32 bytes per entry described in RFC 7541. + */ +NGHTTP2_EXTERN size_t +nghttp2_session_get_hd_inflate_dynamic_table_size(nghttp2_session *session); + +/** + * @function + * + * Returns the current dynamic table size of HPACK deflater including + * the overhead 32 bytes per entry described in RFC 7541. + */ +NGHTTP2_EXTERN size_t +nghttp2_session_get_hd_deflate_dynamic_table_size(nghttp2_session *session); + +/** + * @function + * + * Signals the session so that the connection should be terminated. + * + * The last stream ID is the minimum value between the stream ID of a + * stream for which :type:`nghttp2_on_frame_recv_callback` was called + * most recently and the last stream ID we have sent to the peer + * previously. + * + * The |error_code| is the error code of this GOAWAY frame. The + * pre-defined error code is one of :enum:`nghttp2_error_code`. + * + * After the transmission, both `nghttp2_session_want_read()` and + * `nghttp2_session_want_write()` return 0. + * + * This function should be called when the connection should be + * terminated after sending GOAWAY. If the remaining streams should + * be processed after GOAWAY, use `nghttp2_submit_goaway()` instead. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int nghttp2_session_terminate_session(nghttp2_session *session, + uint32_t error_code); + +/** + * @function + * + * Signals the session so that the connection should be terminated. + * + * This function behaves like `nghttp2_session_terminate_session()`, + * but the last stream ID can be specified by the application for fine + * grained control of stream. The HTTP/2 specification does not allow + * last_stream_id to be increased. So the actual value sent as + * last_stream_id is the minimum value between the given + * |last_stream_id| and the last_stream_id we have previously sent to + * the peer. + * + * The |last_stream_id| is peer's stream ID or 0. So if |session| is + * initialized as client, |last_stream_id| must be even or 0. If + * |session| is initialized as server, |last_stream_id| must be odd or + * 0. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |last_stream_id| is invalid. + */ +NGHTTP2_EXTERN int nghttp2_session_terminate_session2(nghttp2_session *session, + int32_t last_stream_id, + uint32_t error_code); + +/** + * @function + * + * Signals to the client that the server started graceful shutdown + * procedure. + * + * This function is only usable for server. If this function is + * called with client side session, this function returns + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE`. + * + * To gracefully shutdown HTTP/2 session, server should call this + * function to send GOAWAY with last_stream_id (1u << 31) - 1. And + * after some delay (e.g., 1 RTT), send another GOAWAY with the stream + * ID that the server has some processing using + * `nghttp2_submit_goaway()`. See also + * `nghttp2_session_get_last_proc_stream_id()`. + * + * Unlike `nghttp2_submit_goaway()`, this function just sends GOAWAY + * and does nothing more. This is a mere indication to the client + * that session shutdown is imminent. The application should call + * `nghttp2_submit_goaway()` with appropriate last_stream_id after + * this call. + * + * If one or more GOAWAY frame have been already sent by either + * `nghttp2_submit_goaway()` or `nghttp2_session_terminate_session()`, + * this function has no effect. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE` + * The |session| is initialized as client. + */ +NGHTTP2_EXTERN int nghttp2_submit_shutdown_notice(nghttp2_session *session); + +/** + * @function + * + * Returns the value of SETTINGS |id| notified by a remote endpoint. + * The |id| must be one of values defined in + * :enum:`nghttp2_settings_id`. + */ +NGHTTP2_EXTERN uint32_t nghttp2_session_get_remote_settings( + nghttp2_session *session, nghttp2_settings_id id); + +/** + * @function + * + * Returns the value of SETTINGS |id| of local endpoint acknowledged + * by the remote endpoint. The |id| must be one of the values defined + * in :enum:`nghttp2_settings_id`. + */ +NGHTTP2_EXTERN uint32_t nghttp2_session_get_local_settings( + nghttp2_session *session, nghttp2_settings_id id); + +/** + * @function + * + * Tells the |session| that next stream ID is |next_stream_id|. The + * |next_stream_id| must be equal or greater than the value returned + * by `nghttp2_session_get_next_stream_id()`. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |next_stream_id| is strictly less than the value + * `nghttp2_session_get_next_stream_id()` returns; or + * |next_stream_id| is invalid (e.g., even integer for client, or + * odd integer for server). + */ +NGHTTP2_EXTERN int nghttp2_session_set_next_stream_id(nghttp2_session *session, + int32_t next_stream_id); + +/** + * @function + * + * Returns the next outgoing stream ID. Notice that return type is + * uint32_t. If we run out of stream ID for this session, this + * function returns 1 << 31. + */ +NGHTTP2_EXTERN uint32_t +nghttp2_session_get_next_stream_id(nghttp2_session *session); + +/** + * @function + * + * Tells the |session| that |size| bytes for a stream denoted by + * |stream_id| were consumed by application and are ready to + * WINDOW_UPDATE. The consumed bytes are counted towards both + * connection and stream level WINDOW_UPDATE (see + * `nghttp2_session_consume_connection()` and + * `nghttp2_session_consume_stream()` to update consumption + * independently). This function is intended to be used without + * automatic window update (see + * `nghttp2_option_set_no_auto_window_update()`). + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |stream_id| is 0. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE` + * Automatic WINDOW_UPDATE is not disabled. + */ +NGHTTP2_EXTERN int nghttp2_session_consume(nghttp2_session *session, + int32_t stream_id, size_t size); + +/** + * @function + * + * Like `nghttp2_session_consume()`, but this only tells library that + * |size| bytes were consumed only for connection level. Note that + * HTTP/2 maintains connection and stream level flow control windows + * independently. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE` + * Automatic WINDOW_UPDATE is not disabled. + */ +NGHTTP2_EXTERN int nghttp2_session_consume_connection(nghttp2_session *session, + size_t size); + +/** + * @function + * + * Like `nghttp2_session_consume()`, but this only tells library that + * |size| bytes were consumed only for stream denoted by |stream_id|. + * Note that HTTP/2 maintains connection and stream level flow control + * windows independently. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |stream_id| is 0. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE` + * Automatic WINDOW_UPDATE is not disabled. + */ +NGHTTP2_EXTERN int nghttp2_session_consume_stream(nghttp2_session *session, + int32_t stream_id, + size_t size); + +/** + * @function + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * This function is noop. It always returns 0. + */ +NGHTTP2_EXTERN int +nghttp2_session_change_stream_priority(nghttp2_session *session, + int32_t stream_id, + const nghttp2_priority_spec *pri_spec); + +/** + * @function + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * This function is noop. It always returns 0. + */ +NGHTTP2_EXTERN int +nghttp2_session_create_idle_stream(nghttp2_session *session, int32_t stream_id, + const nghttp2_priority_spec *pri_spec); + +/** + * @function + * + * .. warning:: + * + * This function is deprecated in favor of + * `nghttp2_session_upgrade2()`, because this function lacks the + * parameter to tell the library the request method used in the + * original HTTP request. This information is required for client + * to validate actual response body length against content-length + * header field (see `nghttp2_option_set_no_http_messaging()`). If + * HEAD is used in request, the length of response body must be 0 + * regardless of value included in content-length header field. + * + * Performs post-process of HTTP Upgrade request. This function can + * be called from both client and server, but the behavior is very + * different in each other. + * + * If called from client side, the |settings_payload| must be the + * value sent in ``HTTP2-Settings`` header field and must be decoded + * by base64url decoder. The |settings_payloadlen| is the length of + * |settings_payload|. The |settings_payload| is unpacked and its + * setting values will be submitted using `nghttp2_submit_settings()`. + * This means that the client application code does not need to submit + * SETTINGS by itself. The stream with stream ID=1 is opened and the + * |stream_user_data| is used for its stream_user_data. The opened + * stream becomes half-closed (local) state. + * + * If called from server side, the |settings_payload| must be the + * value received in ``HTTP2-Settings`` header field and must be + * decoded by base64url decoder. The |settings_payloadlen| is the + * length of |settings_payload|. It is treated as if the SETTINGS + * frame with that payload is received. Thus, callback functions for + * the reception of SETTINGS frame will be invoked. The stream with + * stream ID=1 is opened. The |stream_user_data| is ignored. The + * opened stream becomes half-closed (remote). + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |settings_payload| is badly formed. + * :enum:`nghttp2_error.NGHTTP2_ERR_PROTO` + * The stream ID 1 is already used or closed; or is not available. + */ +NGHTTP2_EXTERN int nghttp2_session_upgrade(nghttp2_session *session, + const uint8_t *settings_payload, + size_t settings_payloadlen, + void *stream_user_data); + +/** + * @function + * + * Performs post-process of HTTP Upgrade request. This function can + * be called from both client and server, but the behavior is very + * different in each other. + * + * If called from client side, the |settings_payload| must be the + * value sent in ``HTTP2-Settings`` header field and must be decoded + * by base64url decoder. The |settings_payloadlen| is the length of + * |settings_payload|. The |settings_payload| is unpacked and its + * setting values will be submitted using `nghttp2_submit_settings()`. + * This means that the client application code does not need to submit + * SETTINGS by itself. The stream with stream ID=1 is opened and the + * |stream_user_data| is used for its stream_user_data. The opened + * stream becomes half-closed (local) state. + * + * If called from server side, the |settings_payload| must be the + * value received in ``HTTP2-Settings`` header field and must be + * decoded by base64url decoder. The |settings_payloadlen| is the + * length of |settings_payload|. It is treated as if the SETTINGS + * frame with that payload is received. Thus, callback functions for + * the reception of SETTINGS frame will be invoked. The stream with + * stream ID=1 is opened. The |stream_user_data| is ignored. The + * opened stream becomes half-closed (remote). + * + * If the request method is HEAD, pass nonzero value to + * |head_request|. Otherwise, pass 0. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |settings_payload| is badly formed. + * :enum:`nghttp2_error.NGHTTP2_ERR_PROTO` + * The stream ID 1 is already used or closed; or is not available. + */ +NGHTTP2_EXTERN int nghttp2_session_upgrade2(nghttp2_session *session, + const uint8_t *settings_payload, + size_t settings_payloadlen, + int head_request, + void *stream_user_data); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use `nghttp2_pack_settings_payload2()` instead. + * + * Serializes the SETTINGS values |iv| in the |buf|. The size of the + * |buf| is specified by |buflen|. The number of entries in the |iv| + * array is given by |niv|. The required space in |buf| for the |niv| + * entries is ``6*niv`` bytes and if the given buffer is too small, an + * error is returned. This function is used mainly for creating a + * SETTINGS payload to be sent with the ``HTTP2-Settings`` header + * field in an HTTP Upgrade request. The data written in |buf| is NOT + * base64url encoded and the application is responsible for encoding. + * + * This function returns the number of bytes written in |buf|, or one + * of the following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |iv| contains duplicate settings ID or invalid value. + * + * :enum:`nghttp2_error.NGHTTP2_ERR_INSUFF_BUFSIZE` + * The provided |buflen| size is too small to hold the output. + */ +NGHTTP2_EXTERN ssize_t nghttp2_pack_settings_payload( + uint8_t *buf, size_t buflen, const nghttp2_settings_entry *iv, size_t niv); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @function + * + * Serializes the SETTINGS values |iv| in the |buf|. The size of the + * |buf| is specified by |buflen|. The number of entries in the |iv| + * array is given by |niv|. The required space in |buf| for the |niv| + * entries is ``6*niv`` bytes and if the given buffer is too small, an + * error is returned. This function is used mainly for creating a + * SETTINGS payload to be sent with the ``HTTP2-Settings`` header + * field in an HTTP Upgrade request. The data written in |buf| is NOT + * base64url encoded and the application is responsible for encoding. + * + * This function returns the number of bytes written in |buf|, or one + * of the following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |iv| contains duplicate settings ID or invalid value. + * + * :enum:`nghttp2_error.NGHTTP2_ERR_INSUFF_BUFSIZE` + * The provided |buflen| size is too small to hold the output. + */ +NGHTTP2_EXTERN nghttp2_ssize nghttp2_pack_settings_payload2( + uint8_t *buf, size_t buflen, const nghttp2_settings_entry *iv, size_t niv); + +/** + * @function + * + * Returns string describing the |lib_error_code|. The + * |lib_error_code| must be one of the :enum:`nghttp2_error`. + */ +NGHTTP2_EXTERN const char *nghttp2_strerror(int lib_error_code); + +/** + * @function + * + * Returns string representation of HTTP/2 error code |error_code| + * (e.g., ``PROTOCOL_ERROR`` is returned if ``error_code == + * NGHTTP2_PROTOCOL_ERROR``). If string representation is unknown for + * given |error_code|, this function returns string ``unknown``. + */ +NGHTTP2_EXTERN const char *nghttp2_http2_strerror(uint32_t error_code); + +/** + * @function + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * Initializes |pri_spec| with the |stream_id| of the stream to depend + * on with |weight| and its exclusive flag. If |exclusive| is + * nonzero, exclusive flag is set. + * + * The |weight| must be in [:macro:`NGHTTP2_MIN_WEIGHT`, + * :macro:`NGHTTP2_MAX_WEIGHT`], inclusive. + */ +NGHTTP2_EXTERN void nghttp2_priority_spec_init(nghttp2_priority_spec *pri_spec, + int32_t stream_id, + int32_t weight, int exclusive); + +/** + * @function + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * Initializes |pri_spec| with the default values. The default values + * are: stream_id = 0, weight = :macro:`NGHTTP2_DEFAULT_WEIGHT` and + * exclusive = 0. + */ +NGHTTP2_EXTERN void +nghttp2_priority_spec_default_init(nghttp2_priority_spec *pri_spec); + +/** + * @function + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * Returns nonzero if the |pri_spec| is filled with default values. + */ +NGHTTP2_EXTERN int +nghttp2_priority_spec_check_default(const nghttp2_priority_spec *pri_spec); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use `nghttp2_submit_request2()` instead. + * + * Submits HEADERS frame and optionally one or more DATA frames. + * + * The |pri_spec| is ignored. + * + * The |nva| is an array of name/value pair :type:`nghttp2_nv` with + * |nvlen| elements. The application is responsible to include + * required pseudo-header fields (header field whose name starts with + * ":") in |nva| and must place pseudo-headers before regular header + * fields. + * + * This function creates copies of all name/value pairs in |nva|. It + * also lower-cases all names in |nva|. The order of elements in + * |nva| is preserved. For header fields with + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME` and + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_VALUE` are set, + * header field name and value are not copied respectively. With + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME`, application + * is responsible to pass header field name in lowercase. The + * application should maintain the references to them until + * :type:`nghttp2_on_frame_send_callback` or + * :type:`nghttp2_on_frame_not_send_callback` is called. + * + * HTTP/2 specification has requirement about header fields in the + * request HEADERS. See the specification for more details. + * + * If |data_prd| is not ``NULL``, it provides data which will be sent + * in subsequent DATA frames. In this case, a method that allows + * request message bodies + * (https://tools.ietf.org/html/rfc7231#section-4) must be specified + * with ``:method`` key in |nva| (e.g. ``POST``). This function does + * not take ownership of the |data_prd|. The function copies the + * members of the |data_prd|. If |data_prd| is ``NULL``, HEADERS have + * END_STREAM set. The |stream_user_data| is data associated to the + * stream opened by this request and can be an arbitrary pointer, + * which can be retrieved later by + * `nghttp2_session_get_stream_user_data()`. + * + * This function returns assigned stream ID if it succeeds, or one of + * the following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_STREAM_ID_NOT_AVAILABLE` + * No stream ID is available because maximum stream ID was + * reached. + * :enum:`nghttp2_error.NGHTTP2_ERR_PROTO` + * The |session| is server session. + * + * .. warning:: + * + * This function returns assigned stream ID if it succeeds. But + * that stream is not created yet. The application must not submit + * frame to that stream ID before + * :type:`nghttp2_before_frame_send_callback` is called for this + * frame. This means `nghttp2_session_get_stream_user_data()` does + * not work before the callback. But + * `nghttp2_session_set_stream_user_data()` handles this situation + * specially, and it can set data to a stream during this period. + * + */ +NGHTTP2_EXTERN int32_t nghttp2_submit_request( + nghttp2_session *session, const nghttp2_priority_spec *pri_spec, + const nghttp2_nv *nva, size_t nvlen, const nghttp2_data_provider *data_prd, + void *stream_user_data); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @function + * + * Submits HEADERS frame and optionally one or more DATA frames. + * + * The |pri_spec| is ignored. + * + * The |nva| is an array of name/value pair :type:`nghttp2_nv` with + * |nvlen| elements. The application is responsible to include + * required pseudo-header fields (header field whose name starts with + * ":") in |nva| and must place pseudo-headers before regular header + * fields. + * + * This function creates copies of all name/value pairs in |nva|. It + * also lower-cases all names in |nva|. The order of elements in + * |nva| is preserved. For header fields with + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME` and + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_VALUE` are set, + * header field name and value are not copied respectively. With + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME`, application + * is responsible to pass header field name in lowercase. The + * application should maintain the references to them until + * :type:`nghttp2_on_frame_send_callback` or + * :type:`nghttp2_on_frame_not_send_callback` is called. + * + * HTTP/2 specification has requirement about header fields in the + * request HEADERS. See the specification for more details. + * + * If |data_prd| is not ``NULL``, it provides data which will be sent + * in subsequent DATA frames. In this case, a method that allows + * request message bodies + * (https://tools.ietf.org/html/rfc7231#section-4) must be specified + * with ``:method`` key in |nva| (e.g. ``POST``). This function does + * not take ownership of the |data_prd|. The function copies the + * members of the |data_prd|. If |data_prd| is ``NULL``, HEADERS have + * END_STREAM set. The |stream_user_data| is data associated to the + * stream opened by this request and can be an arbitrary pointer, + * which can be retrieved later by + * `nghttp2_session_get_stream_user_data()`. + * + * This function returns assigned stream ID if it succeeds, or one of + * the following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_STREAM_ID_NOT_AVAILABLE` + * No stream ID is available because maximum stream ID was + * reached. + * :enum:`nghttp2_error.NGHTTP2_ERR_PROTO` + * The |session| is server session. + * + * .. warning:: + * + * This function returns assigned stream ID if it succeeds. But + * that stream is not created yet. The application must not submit + * frame to that stream ID before + * :type:`nghttp2_before_frame_send_callback` is called for this + * frame. This means `nghttp2_session_get_stream_user_data()` does + * not work before the callback. But + * `nghttp2_session_set_stream_user_data()` handles this situation + * specially, and it can set data to a stream during this period. + * + */ +NGHTTP2_EXTERN int32_t nghttp2_submit_request2( + nghttp2_session *session, const nghttp2_priority_spec *pri_spec, + const nghttp2_nv *nva, size_t nvlen, const nghttp2_data_provider2 *data_prd, + void *stream_user_data); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use `nghttp2_submit_response2()` instead. + * + * Submits response HEADERS frame and optionally one or more DATA + * frames against the stream |stream_id|. + * + * The |nva| is an array of name/value pair :type:`nghttp2_nv` with + * |nvlen| elements. The application is responsible to include + * required pseudo-header fields (header field whose name starts with + * ":") in |nva| and must place pseudo-headers before regular header + * fields. + * + * This function creates copies of all name/value pairs in |nva|. It + * also lower-cases all names in |nva|. The order of elements in + * |nva| is preserved. For header fields with + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME` and + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_VALUE` are set, + * header field name and value are not copied respectively. With + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME`, application + * is responsible to pass header field name in lowercase. The + * application should maintain the references to them until + * :type:`nghttp2_on_frame_send_callback` or + * :type:`nghttp2_on_frame_not_send_callback` is called. + * + * HTTP/2 specification has requirement about header fields in the + * response HEADERS. See the specification for more details. + * + * If |data_prd| is not ``NULL``, it provides data which will be sent + * in subsequent DATA frames. This function does not take ownership + * of the |data_prd|. The function copies the members of the + * |data_prd|. If |data_prd| is ``NULL``, HEADERS will have + * END_STREAM flag set. + * + * This method can be used as normal HTTP response and push response. + * When pushing a resource using this function, the |session| must be + * configured using `nghttp2_session_server_new()` or its variants and + * the target stream denoted by the |stream_id| must be reserved using + * `nghttp2_submit_push_promise()`. + * + * To send non-final response headers (e.g., HTTP status 101), don't + * use this function because this function half-closes the outbound + * stream. Instead, use `nghttp2_submit_headers()` for this purpose. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |stream_id| is 0. + * :enum:`nghttp2_error.NGHTTP2_ERR_DATA_EXIST` + * DATA or HEADERS has been already submitted and not fully + * processed yet. Normally, this does not happen, but when + * application wrongly calls `nghttp2_submit_response()` twice, + * this may happen. + * :enum:`nghttp2_error.NGHTTP2_ERR_PROTO` + * The |session| is client session. + * + * .. warning:: + * + * Calling this function twice for the same stream ID may lead to + * program crash. It is generally considered to a programming error + * to commit response twice. + */ +NGHTTP2_EXTERN int +nghttp2_submit_response(nghttp2_session *session, int32_t stream_id, + const nghttp2_nv *nva, size_t nvlen, + const nghttp2_data_provider *data_prd); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @function + * + * Submits response HEADERS frame and optionally one or more DATA + * frames against the stream |stream_id|. + * + * The |nva| is an array of name/value pair :type:`nghttp2_nv` with + * |nvlen| elements. The application is responsible to include + * required pseudo-header fields (header field whose name starts with + * ":") in |nva| and must place pseudo-headers before regular header + * fields. + * + * This function creates copies of all name/value pairs in |nva|. It + * also lower-cases all names in |nva|. The order of elements in + * |nva| is preserved. For header fields with + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME` and + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_VALUE` are set, + * header field name and value are not copied respectively. With + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME`, application + * is responsible to pass header field name in lowercase. The + * application should maintain the references to them until + * :type:`nghttp2_on_frame_send_callback` or + * :type:`nghttp2_on_frame_not_send_callback` is called. + * + * HTTP/2 specification has requirement about header fields in the + * response HEADERS. See the specification for more details. + * + * If |data_prd| is not ``NULL``, it provides data which will be sent + * in subsequent DATA frames. This function does not take ownership + * of the |data_prd|. The function copies the members of the + * |data_prd|. If |data_prd| is ``NULL``, HEADERS will have + * END_STREAM flag set. + * + * This method can be used as normal HTTP response and push response. + * When pushing a resource using this function, the |session| must be + * configured using `nghttp2_session_server_new()` or its variants and + * the target stream denoted by the |stream_id| must be reserved using + * `nghttp2_submit_push_promise()`. + * + * To send non-final response headers (e.g., HTTP status 101), don't + * use this function because this function half-closes the outbound + * stream. Instead, use `nghttp2_submit_headers()` for this purpose. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |stream_id| is 0. + * :enum:`nghttp2_error.NGHTTP2_ERR_DATA_EXIST` + * DATA or HEADERS has been already submitted and not fully + * processed yet. Normally, this does not happen, but when + * application wrongly calls `nghttp2_submit_response2()` twice, + * this may happen. + * :enum:`nghttp2_error.NGHTTP2_ERR_PROTO` + * The |session| is client session. + * + * .. warning:: + * + * Calling this function twice for the same stream ID may lead to + * program crash. It is generally considered to a programming error + * to commit response twice. + */ +NGHTTP2_EXTERN int +nghttp2_submit_response2(nghttp2_session *session, int32_t stream_id, + const nghttp2_nv *nva, size_t nvlen, + const nghttp2_data_provider2 *data_prd); + +/** + * @function + * + * Submits trailer fields HEADERS against the stream |stream_id|. + * + * The |nva| is an array of name/value pair :type:`nghttp2_nv` with + * |nvlen| elements. The application must not include pseudo-header + * fields (headers whose names starts with ":") in |nva|. + * + * This function creates copies of all name/value pairs in |nva|. It + * also lower-cases all names in |nva|. The order of elements in + * |nva| is preserved. For header fields with + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME` and + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_VALUE` are set, + * header field name and value are not copied respectively. With + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME`, application + * is responsible to pass header field name in lowercase. The + * application should maintain the references to them until + * :type:`nghttp2_on_frame_send_callback` or + * :type:`nghttp2_on_frame_not_send_callback` is called. + * + * For server, trailer fields must follow response HEADERS or response + * DATA without END_STREAM flat set. The library does not enforce + * this requirement, and applications should do this for themselves. + * If `nghttp2_submit_trailer()` is called before any response HEADERS + * submission (usually by `nghttp2_submit_response2()`), the content + * of |nva| will be sent as response headers, which will result in + * error. + * + * This function has the same effect with `nghttp2_submit_headers()`, + * with flags = :enum:`nghttp2_flag.NGHTTP2_FLAG_END_STREAM` and both + * pri_spec and stream_user_data to NULL. + * + * To submit trailer fields after `nghttp2_submit_response2()` is + * called, the application has to specify + * :type:`nghttp2_data_provider2` to `nghttp2_submit_response2()`. + * Inside of :type:`nghttp2_data_source_read_callback2`, when setting + * :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_EOF`, also set + * :enum:`nghttp2_data_flag.NGHTTP2_DATA_FLAG_NO_END_STREAM`. After + * that, the application can send trailer fields using + * `nghttp2_submit_trailer()`. `nghttp2_submit_trailer()` can be used + * inside :type:`nghttp2_data_source_read_callback2`. + * + * This function returns 0 if it succeeds and |stream_id| is -1. + * Otherwise, this function returns 0 if it succeeds, or one of the + * following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |stream_id| is 0. + */ +NGHTTP2_EXTERN int nghttp2_submit_trailer(nghttp2_session *session, + int32_t stream_id, + const nghttp2_nv *nva, size_t nvlen); + +/** + * @function + * + * Submits HEADERS frame. The |flags| is bitwise OR of the + * following values: + * + * * :enum:`nghttp2_flag.NGHTTP2_FLAG_END_STREAM` + * + * If |flags| includes :enum:`nghttp2_flag.NGHTTP2_FLAG_END_STREAM`, + * this frame has END_STREAM flag set. + * + * The library handles the CONTINUATION frame internally and it + * correctly sets END_HEADERS to the last sequence of the PUSH_PROMISE + * or CONTINUATION frame. + * + * If the |stream_id| is -1, this frame is assumed as request (i.e., + * request HEADERS frame which opens new stream). In this case, the + * assigned stream ID will be returned. Otherwise, specify stream ID + * in |stream_id|. + * + * The |pri_spec| is ignored. + * + * The |nva| is an array of name/value pair :type:`nghttp2_nv` with + * |nvlen| elements. The application is responsible to include + * required pseudo-header fields (header field whose name starts with + * ":") in |nva| and must place pseudo-headers before regular header + * fields. + * + * This function creates copies of all name/value pairs in |nva|. It + * also lower-cases all names in |nva|. The order of elements in + * |nva| is preserved. For header fields with + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME` and + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_VALUE` are set, + * header field name and value are not copied respectively. With + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME`, application + * is responsible to pass header field name in lowercase. The + * application should maintain the references to them until + * :type:`nghttp2_on_frame_send_callback` or + * :type:`nghttp2_on_frame_not_send_callback` is called. + * + * The |stream_user_data| is a pointer to an arbitrary data which is + * associated to the stream this frame will open. Therefore it is + * only used if this frame opens streams, in other words, it changes + * stream state from idle or reserved to open. + * + * This function is low-level in a sense that the application code can + * specify flags directly. For usual HTTP request, + * `nghttp2_submit_request2()` is useful. Likewise, for HTTP + * response, prefer `nghttp2_submit_response2()`. + * + * This function returns newly assigned stream ID if it succeeds and + * |stream_id| is -1. Otherwise, this function returns 0 if it + * succeeds, or one of the following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_STREAM_ID_NOT_AVAILABLE` + * No stream ID is available because maximum stream ID was + * reached. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |stream_id| is 0. + * :enum:`nghttp2_error.NGHTTP2_ERR_DATA_EXIST` + * DATA or HEADERS has been already submitted and not fully + * processed yet. This happens if stream denoted by |stream_id| + * is in reserved state. + * :enum:`nghttp2_error.NGHTTP2_ERR_PROTO` + * The |stream_id| is -1, and |session| is server session. + * + * .. warning:: + * + * This function returns assigned stream ID if it succeeds and + * |stream_id| is -1. But that stream is not opened yet. The + * application must not submit frame to that stream ID before + * :type:`nghttp2_before_frame_send_callback` is called for this + * frame. + * + */ +NGHTTP2_EXTERN int32_t nghttp2_submit_headers( + nghttp2_session *session, uint8_t flags, int32_t stream_id, + const nghttp2_priority_spec *pri_spec, const nghttp2_nv *nva, size_t nvlen, + void *stream_user_data); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use `nghttp2_submit_data2()` instead. + * + * Submits one or more DATA frames to the stream |stream_id|. The + * data to be sent are provided by |data_prd|. If |flags| contains + * :enum:`nghttp2_flag.NGHTTP2_FLAG_END_STREAM`, the last DATA frame + * has END_STREAM flag set. + * + * This function does not take ownership of the |data_prd|. The + * function copies the members of the |data_prd|. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_DATA_EXIST` + * DATA or HEADERS has been already submitted and not fully + * processed yet. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |stream_id| is 0. + * :enum:`nghttp2_error.NGHTTP2_ERR_STREAM_CLOSED` + * The stream was already closed; or the |stream_id| is invalid. + * + * .. note:: + * + * Currently, only one DATA or HEADERS is allowed for a stream at a + * time. Submitting these frames more than once before first DATA + * or HEADERS is finished results in + * :enum:`nghttp2_error.NGHTTP2_ERR_DATA_EXIST` error code. The + * earliest callback which tells that previous frame is done is + * :type:`nghttp2_on_frame_send_callback`. In side that callback, + * new data can be submitted using `nghttp2_submit_data()`. Of + * course, all data except for last one must not have + * :enum:`nghttp2_flag.NGHTTP2_FLAG_END_STREAM` flag set in |flags|. + * This sounds a bit complicated, and we recommend to use + * `nghttp2_submit_request()` and `nghttp2_submit_response()` to + * avoid this cascading issue. The experience shows that for HTTP + * use, these two functions are enough to implement both client and + * server. + */ +NGHTTP2_EXTERN int nghttp2_submit_data(nghttp2_session *session, uint8_t flags, + int32_t stream_id, + const nghttp2_data_provider *data_prd); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @function + * + * Submits one or more DATA frames to the stream |stream_id|. The + * data to be sent are provided by |data_prd|. If |flags| contains + * :enum:`nghttp2_flag.NGHTTP2_FLAG_END_STREAM`, the last DATA frame + * has END_STREAM flag set. + * + * This function does not take ownership of the |data_prd|. The + * function copies the members of the |data_prd|. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_DATA_EXIST` + * DATA or HEADERS has been already submitted and not fully + * processed yet. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |stream_id| is 0. + * :enum:`nghttp2_error.NGHTTP2_ERR_STREAM_CLOSED` + * The stream was already closed; or the |stream_id| is invalid. + * + * .. note:: + * + * Currently, only one DATA or HEADERS is allowed for a stream at a + * time. Submitting these frames more than once before first DATA + * or HEADERS is finished results in + * :enum:`nghttp2_error.NGHTTP2_ERR_DATA_EXIST` error code. The + * earliest callback which tells that previous frame is done is + * :type:`nghttp2_on_frame_send_callback`. In side that callback, + * new data can be submitted using `nghttp2_submit_data2()`. Of + * course, all data except for last one must not have + * :enum:`nghttp2_flag.NGHTTP2_FLAG_END_STREAM` flag set in |flags|. + * This sounds a bit complicated, and we recommend to use + * `nghttp2_submit_request2()` and `nghttp2_submit_response2()` to + * avoid this cascading issue. The experience shows that for HTTP + * use, these two functions are enough to implement both client and + * server. + */ +NGHTTP2_EXTERN int nghttp2_submit_data2(nghttp2_session *session, uint8_t flags, + int32_t stream_id, + const nghttp2_data_provider2 *data_prd); + +/** + * @function + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * This function is noop. It always returns 0. + */ +NGHTTP2_EXTERN int +nghttp2_submit_priority(nghttp2_session *session, uint8_t flags, + int32_t stream_id, + const nghttp2_priority_spec *pri_spec); + +/** + * @macro + * + * :macro:`NGHTTP2_EXTPRI_DEFAULT_URGENCY` is the default urgency + * level for :rfc:`9218` extensible priorities. + */ +#define NGHTTP2_EXTPRI_DEFAULT_URGENCY 3 + +/** + * @macro + * + * :macro:`NGHTTP2_EXTPRI_URGENCY_HIGH` is the highest urgency level + * for :rfc:`9218` extensible priorities. + */ +#define NGHTTP2_EXTPRI_URGENCY_HIGH 0 + +/** + * @macro + * + * :macro:`NGHTTP2_EXTPRI_URGENCY_LOW` is the lowest urgency level for + * :rfc:`9218` extensible priorities. + */ +#define NGHTTP2_EXTPRI_URGENCY_LOW 7 + +/** + * @macro + * + * :macro:`NGHTTP2_EXTPRI_URGENCY_LEVELS` is the number of urgency + * levels for :rfc:`9218` extensible priorities. + */ +#define NGHTTP2_EXTPRI_URGENCY_LEVELS (NGHTTP2_EXTPRI_URGENCY_LOW + 1) + +/** + * @struct + * + * :type:`nghttp2_extpri` is :rfc:`9218` extensible priorities + * specification for a stream. + */ +typedef struct nghttp2_extpri { + /** + * :member:`urgency` is the urgency of a stream, it must be in + * [:macro:`NGHTTP2_EXTPRI_URGENCY_HIGH`, + * :macro:`NGHTTP2_EXTPRI_URGENCY_LOW`], inclusive, and 0 is the + * highest urgency. + */ + uint32_t urgency; + /** + * :member:`inc` indicates that a content can be processed + * incrementally or not. If inc is 0, it cannot be processed + * incrementally. If inc is 1, it can be processed incrementally. + * Other value is not permitted. + */ + int inc; +} nghttp2_extpri; + +/** + * @function + * + * Submits RST_STREAM frame to cancel/reject the stream |stream_id| + * with the error code |error_code|. + * + * The pre-defined error code is one of :enum:`nghttp2_error_code`. + * + * The |flags| is currently ignored and should be + * :enum:`nghttp2_flag.NGHTTP2_FLAG_NONE`. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |stream_id| is 0. + */ +NGHTTP2_EXTERN int nghttp2_submit_rst_stream(nghttp2_session *session, + uint8_t flags, int32_t stream_id, + uint32_t error_code); + +/** + * @function + * + * Stores local settings and submits SETTINGS frame. The |iv| is the + * pointer to the array of :type:`nghttp2_settings_entry`. The |niv| + * indicates the number of :type:`nghttp2_settings_entry`. + * + * The |flags| is currently ignored and should be + * :enum:`nghttp2_flag.NGHTTP2_FLAG_NONE`. + * + * This function does not take ownership of the |iv|. This function + * copies all the elements in the |iv|. + * + * While updating individual stream's local window size, if the window + * size becomes strictly larger than NGHTTP2_MAX_WINDOW_SIZE, + * RST_STREAM is issued against such a stream. + * + * SETTINGS with :enum:`nghttp2_flag.NGHTTP2_FLAG_ACK` is + * automatically submitted by the library and application could not + * send it at its will. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |iv| contains invalid value (e.g., initial window size + * strictly greater than (1 << 31) - 1. + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int nghttp2_submit_settings(nghttp2_session *session, + uint8_t flags, + const nghttp2_settings_entry *iv, + size_t niv); + +/** + * @function + * + * Submits PUSH_PROMISE frame. + * + * The |flags| is currently ignored. The library handles the + * CONTINUATION frame internally and it correctly sets END_HEADERS to + * the last sequence of the PUSH_PROMISE or CONTINUATION frame. + * + * The |stream_id| must be client initiated stream ID. + * + * The |nva| is an array of name/value pair :type:`nghttp2_nv` with + * |nvlen| elements. The application is responsible to include + * required pseudo-header fields (header field whose name starts with + * ":") in |nva| and must place pseudo-headers before regular header + * fields. + * + * This function creates copies of all name/value pairs in |nva|. It + * also lower-cases all names in |nva|. The order of elements in + * |nva| is preserved. For header fields with + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME` and + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_VALUE` are set, + * header field name and value are not copied respectively. With + * :enum:`nghttp2_nv_flag.NGHTTP2_NV_FLAG_NO_COPY_NAME`, application + * is responsible to pass header field name in lowercase. The + * application should maintain the references to them until + * :type:`nghttp2_on_frame_send_callback` or + * :type:`nghttp2_on_frame_not_send_callback` is called. + * + * The |promised_stream_user_data| is a pointer to an arbitrary data + * which is associated to the promised stream this frame will open and + * make it in reserved state. It is available using + * `nghttp2_session_get_stream_user_data()`. The application can + * access it in :type:`nghttp2_before_frame_send_callback` and + * :type:`nghttp2_on_frame_send_callback` of this frame. + * + * The client side is not allowed to use this function. + * + * To submit response headers and data, use + * `nghttp2_submit_response2()`. + * + * This function returns assigned promised stream ID if it succeeds, + * or one of the following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_PROTO` + * This function was invoked when |session| is initialized as + * client. + * :enum:`nghttp2_error.NGHTTP2_ERR_STREAM_ID_NOT_AVAILABLE` + * No stream ID is available because maximum stream ID was + * reached. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |stream_id| is 0; The |stream_id| does not designate stream + * that peer initiated. + * :enum:`nghttp2_error.NGHTTP2_ERR_STREAM_CLOSED` + * The stream was already closed; or the |stream_id| is invalid. + * + * .. warning:: + * + * This function returns assigned promised stream ID if it succeeds. + * As of 1.16.0, stream object for pushed resource is created when + * this function succeeds. In that case, the application can submit + * push response for the promised frame. + * + * In 1.15.0 or prior versions, pushed stream is not opened yet when + * this function succeeds. The application must not submit frame to + * that stream ID before :type:`nghttp2_before_frame_send_callback` + * is called for this frame. + * + */ +NGHTTP2_EXTERN int32_t nghttp2_submit_push_promise( + nghttp2_session *session, uint8_t flags, int32_t stream_id, + const nghttp2_nv *nva, size_t nvlen, void *promised_stream_user_data); + +/** + * @function + * + * Submits PING frame. You don't have to send PING back when you + * received PING frame. The library automatically submits PING frame + * in this case. + * + * The |flags| is bitwise OR of 0 or more of the following value. + * + * * :enum:`nghttp2_flag.NGHTTP2_FLAG_ACK` + * + * Unless `nghttp2_option_set_no_auto_ping_ack()` is used, the |flags| + * should be :enum:`nghttp2_flag.NGHTTP2_FLAG_NONE`. + * + * If the |opaque_data| is non ``NULL``, then it should point to the 8 + * bytes array of memory to specify opaque data to send with PING + * frame. If the |opaque_data| is ``NULL``, zero-cleared 8 bytes will + * be sent as opaque data. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int nghttp2_submit_ping(nghttp2_session *session, uint8_t flags, + const uint8_t *opaque_data); + +/** + * @function + * + * Submits GOAWAY frame with the last stream ID |last_stream_id| and + * the error code |error_code|. + * + * The pre-defined error code is one of :enum:`nghttp2_error_code`. + * + * The |flags| is currently ignored and should be + * :enum:`nghttp2_flag.NGHTTP2_FLAG_NONE`. + * + * The |last_stream_id| is peer's stream ID or 0. So if |session| is + * initialized as client, |last_stream_id| must be even or 0. If + * |session| is initialized as server, |last_stream_id| must be odd or + * 0. + * + * The HTTP/2 specification says last_stream_id must not be increased + * from the value previously sent. So the actual value sent as + * last_stream_id is the minimum value between the given + * |last_stream_id| and the last_stream_id previously sent to the + * peer. + * + * If the |opaque_data| is not ``NULL`` and |opaque_data_len| is not + * zero, those data will be sent as additional debug data. The + * library makes a copy of the memory region pointed by |opaque_data| + * with the length |opaque_data_len|, so the caller does not need to + * keep this memory after the return of this function. If the + * |opaque_data_len| is 0, the |opaque_data| could be ``NULL``. + * + * After successful transmission of GOAWAY, following things happen. + * All incoming streams having strictly more than |last_stream_id| are + * closed. All incoming HEADERS which starts new stream are simply + * ignored. After all active streams are handled, both + * `nghttp2_session_want_read()` and `nghttp2_session_want_write()` + * return 0 and the application can close session. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |opaque_data_len| is too large; the |last_stream_id| is + * invalid. + */ +NGHTTP2_EXTERN int nghttp2_submit_goaway(nghttp2_session *session, + uint8_t flags, int32_t last_stream_id, + uint32_t error_code, + const uint8_t *opaque_data, + size_t opaque_data_len); + +/** + * @function + * + * Returns the last stream ID of a stream for which + * :type:`nghttp2_on_frame_recv_callback` was invoked most recently. + * The returned value can be used as last_stream_id parameter for + * `nghttp2_submit_goaway()` and + * `nghttp2_session_terminate_session2()`. + * + * This function always succeeds. + */ +NGHTTP2_EXTERN int32_t +nghttp2_session_get_last_proc_stream_id(nghttp2_session *session); + +/** + * @function + * + * Returns nonzero if new request can be sent from local endpoint. + * + * This function return 0 if request is not allowed for this session. + * There are several reasons why request is not allowed. Some of the + * reasons are: session is server; stream ID has been spent; GOAWAY + * has been sent or received. + * + * The application can call `nghttp2_submit_request2()` without + * consulting this function. In that case, + * `nghttp2_submit_request2()` may return error. Or, request is + * failed to sent, and :type:`nghttp2_on_stream_close_callback` is + * called. + */ +NGHTTP2_EXTERN int +nghttp2_session_check_request_allowed(nghttp2_session *session); + +/** + * @function + * + * Returns nonzero if |session| is initialized as server side session. + */ +NGHTTP2_EXTERN int +nghttp2_session_check_server_session(nghttp2_session *session); + +/** + * @function + * + * Submits WINDOW_UPDATE frame. + * + * The |flags| is currently ignored and should be + * :enum:`nghttp2_flag.NGHTTP2_FLAG_NONE`. + * + * The |stream_id| is the stream ID to send this WINDOW_UPDATE. To + * send connection level WINDOW_UPDATE, specify 0 to |stream_id|. + * + * If the |window_size_increment| is positive, the WINDOW_UPDATE with + * that value as window_size_increment is queued. If the + * |window_size_increment| is larger than the received bytes from the + * remote endpoint, the local window size is increased by that + * difference. If the sole purpose is to increase the local window + * size, consider to use `nghttp2_session_set_local_window_size()`. + * + * If the |window_size_increment| is negative, the local window size + * is decreased by -|window_size_increment|. If automatic + * WINDOW_UPDATE is enabled + * (`nghttp2_option_set_no_auto_window_update()`), and the library + * decided that the WINDOW_UPDATE should be submitted, then + * WINDOW_UPDATE is queued with the current received bytes count. If + * the sole purpose is to decrease the local window size, consider to + * use `nghttp2_session_set_local_window_size()`. + * + * If the |window_size_increment| is 0, the function does nothing and + * returns 0. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_FLOW_CONTROL` + * The local window size overflow or gets negative. + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int nghttp2_submit_window_update(nghttp2_session *session, + uint8_t flags, + int32_t stream_id, + int32_t window_size_increment); + +/** + * @function + * + * Set local window size (local endpoints's window size) to the given + * |window_size| for the given stream denoted by |stream_id|. To + * change connection level window size, specify 0 to |stream_id|. To + * increase window size, this function may submit WINDOW_UPDATE frame + * to transmission queue. + * + * The |flags| is currently ignored and should be + * :enum:`nghttp2_flag.NGHTTP2_FLAG_NONE`. + * + * This sounds similar to `nghttp2_submit_window_update()`, but there + * are 2 differences. The first difference is that this function + * takes the absolute value of window size to set, rather than the + * delta. To change the window size, this may be easier to use since + * the application just declares the intended window size, rather than + * calculating delta. The second difference is that + * `nghttp2_submit_window_update()` affects the received bytes count + * which has not acked yet. By the specification of + * `nghttp2_submit_window_update()`, to strictly increase the local + * window size, we have to submit delta including all received bytes + * count, which might not be desirable in some cases. On the other + * hand, this function does not affect the received bytes count. It + * just sets the local window size to the given value. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |stream_id| is negative. + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int +nghttp2_session_set_local_window_size(nghttp2_session *session, uint8_t flags, + int32_t stream_id, int32_t window_size); + +/** + * @function + * + * Submits extension frame. + * + * Application can pass arbitrary frame flags and stream ID in |flags| + * and |stream_id| respectively. The |payload| is opaque pointer, and + * it can be accessible though ``frame->ext.payload`` in + * :type:`nghttp2_pack_extension_callback2`. The library will not own + * passed |payload| pointer. + * + * The application must set :type:`nghttp2_pack_extension_callback2` + * using `nghttp2_session_callbacks_set_pack_extension_callback2()`. + * + * The application should retain the memory pointed by |payload| until + * the transmission of extension frame is done (which is indicated by + * :type:`nghttp2_on_frame_send_callback`), or transmission fails + * (which is indicated by :type:`nghttp2_on_frame_not_send_callback`). + * If application does not touch this memory region after packing it + * into a wire format, application can free it inside + * :type:`nghttp2_pack_extension_callback2`. + * + * The standard HTTP/2 frame cannot be sent with this function, so + * |type| must be strictly grater than 0x9. Otherwise, this function + * will fail with error code + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT`. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE` + * If :type:`nghttp2_pack_extension_callback2` is not set. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * If |type| specifies standard HTTP/2 frame type. The frame + * types in the rage [0x0, 0x9], both inclusive, are standard + * HTTP/2 frame type, and cannot be sent using this function. + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory + */ +NGHTTP2_EXTERN int nghttp2_submit_extension(nghttp2_session *session, + uint8_t type, uint8_t flags, + int32_t stream_id, void *payload); + +/** + * @struct + * + * The payload of ALTSVC frame. ALTSVC frame is a non-critical + * extension to HTTP/2. If this frame is received, and + * `nghttp2_option_set_user_recv_extension_type()` is not set, and + * `nghttp2_option_set_builtin_recv_extension_type()` is set for + * :enum:`nghttp2_frame_type.NGHTTP2_ALTSVC`, + * ``nghttp2_extension.payload`` will point to this struct. + * + * It has the following members: + */ +typedef struct { + /** + * The pointer to origin which this alternative service is + * associated with. This is not necessarily NULL-terminated. + */ + uint8_t *origin; + /** + * The length of the |origin|. + */ + size_t origin_len; + /** + * The pointer to Alt-Svc field value contained in ALTSVC frame. + * This is not necessarily NULL-terminated. + */ + uint8_t *field_value; + /** + * The length of the |field_value|. + */ + size_t field_value_len; +} nghttp2_ext_altsvc; + +/** + * @function + * + * Submits ALTSVC frame. + * + * ALTSVC frame is a non-critical extension to HTTP/2, and defined in + * `RFC 7383 `_. + * + * The |flags| is currently ignored and should be + * :enum:`nghttp2_flag.NGHTTP2_FLAG_NONE`. + * + * The |origin| points to the origin this alternative service is + * associated with. The |origin_len| is the length of the origin. If + * |stream_id| is 0, the origin must be specified. If |stream_id| is + * not zero, the origin must be empty (in other words, |origin_len| + * must be 0). + * + * The ALTSVC frame is only usable from server side. If this function + * is invoked with client side session, this function returns + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE`. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE` + * The function is called from client side session + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The sum of |origin_len| and |field_value_len| is larger than + * 16382; or |origin_len| is 0 while |stream_id| is 0; or + * |origin_len| is not 0 while |stream_id| is not 0. + */ +NGHTTP2_EXTERN int nghttp2_submit_altsvc(nghttp2_session *session, + uint8_t flags, int32_t stream_id, + const uint8_t *origin, + size_t origin_len, + const uint8_t *field_value, + size_t field_value_len); + +/** + * @struct + * + * The single entry of an origin. + */ +typedef struct { + /** + * The pointer to origin. No validation is made against this field + * by the library. This is not necessarily NULL-terminated. + */ + uint8_t *origin; + /** + * The length of the |origin|. + */ + size_t origin_len; +} nghttp2_origin_entry; + +/** + * @struct + * + * The payload of ORIGIN frame. ORIGIN frame is a non-critical + * extension to HTTP/2 and defined by `RFC 8336 + * `_. + * + * If this frame is received, and + * `nghttp2_option_set_user_recv_extension_type()` is not set, and + * `nghttp2_option_set_builtin_recv_extension_type()` is set for + * :enum:`nghttp2_frame_type.NGHTTP2_ORIGIN`, + * ``nghttp2_extension.payload`` will point to this struct. + * + * It has the following members: + */ +typedef struct { + /** + * The number of origins contained in |ov|. + */ + size_t nov; + /** + * The pointer to the array of origins contained in ORIGIN frame. + */ + nghttp2_origin_entry *ov; +} nghttp2_ext_origin; + +/** + * @function + * + * Submits ORIGIN frame. + * + * ORIGIN frame is a non-critical extension to HTTP/2 and defined by + * `RFC 8336 `_. + * + * The |flags| is currently ignored and should be + * :enum:`nghttp2_flag.NGHTTP2_FLAG_NONE`. + * + * The |ov| points to the array of origins. The |nov| specifies the + * number of origins included in |ov|. This function creates copies + * of all elements in |ov|. + * + * The ORIGIN frame is only usable by a server. If this function is + * invoked with client side session, this function returns + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE`. + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE` + * The function is called from client side session. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * There are too many origins, or an origin is too large to fit + * into a default frame payload. + */ +NGHTTP2_EXTERN int nghttp2_submit_origin(nghttp2_session *session, + uint8_t flags, + const nghttp2_origin_entry *ov, + size_t nov); + +/** + * @struct + * + * The payload of PRIORITY_UPDATE frame. PRIORITY_UPDATE frame is a + * non-critical extension to HTTP/2. If this frame is received, and + * `nghttp2_option_set_user_recv_extension_type()` is not set, and + * `nghttp2_option_set_builtin_recv_extension_type()` is set for + * :enum:`nghttp2_frame_type.NGHTTP2_PRIORITY_UPDATE`, + * ``nghttp2_extension.payload`` will point to this struct. + * + * It has the following members: + */ +typedef struct { + /** + * The stream ID of the stream whose priority is updated. + */ + int32_t stream_id; + /** + * The pointer to Priority field value. It is not necessarily + * NULL-terminated. + */ + uint8_t *field_value; + /** + * The length of the :member:`field_value`. + */ + size_t field_value_len; +} nghttp2_ext_priority_update; + +/** + * @function + * + * Submits PRIORITY_UPDATE frame. + * + * PRIORITY_UPDATE frame is a non-critical extension to HTTP/2, and + * defined in :rfc:`9218#section-7.1`. + * + * The |flags| is currently ignored and should be + * :enum:`nghttp2_flag.NGHTTP2_FLAG_NONE`. + * + * The |stream_id| is the ID of stream which is prioritized. The + * |field_value| points to the Priority field value. The + * |field_value_len| is the length of the Priority field value. + * + * If this function is called by server, + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE` is returned. + * + * If + * :enum:`nghttp2_settings_id.NGHTTP2_SETTINGS_NO_RFC7540_PRIORITIES` + * of value of 0 is received by a remote endpoint (or it is omitted), + * this function does nothing and returns 0. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE` + * The function is called from server side session + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * The |field_value_len| is larger than 16380; or |stream_id| is + * 0. + */ +NGHTTP2_EXTERN int nghttp2_submit_priority_update(nghttp2_session *session, + uint8_t flags, + int32_t stream_id, + const uint8_t *field_value, + size_t field_value_len); + +/** + * @function + * + * Changes the priority of the existing stream denoted by |stream_id|. + * The new priority is |extpri|. This function is meant to be used by + * server for :rfc:`9218` extensible prioritization scheme. + * + * If |session| is initialized as client, this function returns + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE`. For client, use + * `nghttp2_submit_priority_update()` instead. + * + * If :member:`extpri->urgency ` is out of + * bound, it is set to :macro:`NGHTTP2_EXTPRI_URGENCY_LOW`. + * + * If |ignore_client_signal| is nonzero, server starts to ignore + * client priority signals for this stream. + * + * If + * :enum:`nghttp2_settings_id.NGHTTP2_SETTINGS_NO_RFC7540_PRIORITIES` + * of value of 1 is not submitted via `nghttp2_submit_settings()`, + * this function does nothing and returns 0. + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE` + * The |session| is initialized as client. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * |stream_id| is zero; or a stream denoted by |stream_id| is not + * found. + */ +NGHTTP2_EXTERN int nghttp2_session_change_extpri_stream_priority( + nghttp2_session *session, int32_t stream_id, const nghttp2_extpri *extpri, + int ignore_client_signal); + +/** + * @function + * + * Stores the stream priority of the existing stream denoted by + * |stream_id| in the object pointed by |extpri|. This function is + * meant to be used by server for :rfc:`9218` extensible + * prioritization scheme. + * + * If |session| is initialized as client, this function returns + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE`. + * + * If + * :enum:`nghttp2_settings_id.NGHTTP2_SETTINGS_NO_RFC7540_PRIORITIES` + * of value of 1 is not submitted via `nghttp2_submit_settings()`, + * this function does nothing and returns 0. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE` + * The |session| is initialized as client. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * |stream_id| is zero; or a stream denoted by |stream_id| is not + * found. + */ +NGHTTP2_EXTERN int nghttp2_session_get_extpri_stream_priority( + nghttp2_session *session, nghttp2_extpri *extpri, int32_t stream_id); + +/** + * @function + * + * Parses Priority header field value pointed by |value| of length + * |len|, and stores the result in the object pointed by |extpri|. + * Priority header field is defined in :rfc:`9218`. + * + * This function does not initialize the object pointed by |extpri| + * before storing the result. It only assigns the values that the + * parser correctly extracted to fields. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_ARGUMENT` + * Failed to parse the header field value. + */ +NGHTTP2_EXTERN int nghttp2_extpri_parse_priority(nghttp2_extpri *extpri, + const uint8_t *value, + size_t len); + +/** + * @function + * + * Compares ``lhs->name`` of length ``lhs->namelen`` bytes and + * ``rhs->name`` of length ``rhs->namelen`` bytes. Returns negative + * integer if ``lhs->name`` is found to be less than ``rhs->name``; or + * returns positive integer if ``lhs->name`` is found to be greater + * than ``rhs->name``; or returns 0 otherwise. + */ +NGHTTP2_EXTERN int nghttp2_nv_compare_name(const nghttp2_nv *lhs, + const nghttp2_nv *rhs); + +/** + * @function + * + * .. warning:: + * + * Deprecated. Use `nghttp2_select_alpn` instead. + * + * A helper function for dealing with ALPN in server side. The |in| + * contains peer's protocol list in preferable order. The format of + * |in| is length-prefixed and not null-terminated. For example, + * ``h2`` and ``http/1.1`` stored in |in| like this:: + * + * in[0] = 2 + * in[1..2] = "h2" + * in[3] = 8 + * in[4..11] = "http/1.1" + * inlen = 12 + * + * The selection algorithm is as follows: + * + * 1. If peer's list contains HTTP/2 protocol the library supports, + * it is selected and returns 1. The following step is not taken. + * + * 2. If peer's list contains ``http/1.1``, this function selects + * ``http/1.1`` and returns 0. The following step is not taken. + * + * 3. This function selects nothing and returns -1 (So called + * non-overlap case). In this case, |out| and |outlen| are left + * untouched. + * + * Selecting ``h2`` means that ``h2`` is written into |*out| and its + * length (which is 2) is assigned to |*outlen|. + * + * For ALPN, refer to https://tools.ietf.org/html/rfc7301 + * + * To use this method you should do something like:: + * + * static int alpn_select_proto_cb(SSL* ssl, + * const unsigned char **out, + * unsigned char *outlen, + * const unsigned char *in, + * unsigned int inlen, + * void *arg) + * { + * int rv; + * rv = nghttp2_select_next_protocol((unsigned char**)out, outlen, + * in, inlen); + * if (rv == -1) { + * return SSL_TLSEXT_ERR_NOACK; + * } + * if (rv == 1) { + * ((MyType*)arg)->http2_selected = 1; + * } + * return SSL_TLSEXT_ERR_OK; + * } + * ... + * SSL_CTX_set_alpn_select_cb(ssl_ctx, alpn_select_proto_cb, my_obj); + * + */ +NGHTTP2_EXTERN int nghttp2_select_next_protocol(unsigned char **out, + unsigned char *outlen, + const unsigned char *in, + unsigned int inlen); + +/** + * @function + * + * A helper function for dealing with ALPN in server side. The |in| + * contains peer's protocol list in preferable order. The format of + * |in| is length-prefixed and not null-terminated. For example, + * ``h2`` and ``http/1.1`` stored in |in| like this:: + * + * in[0] = 2 + * in[1..2] = "h2" + * in[3] = 8 + * in[4..11] = "http/1.1" + * inlen = 12 + * + * The selection algorithm is as follows: + * + * 1. If peer's list contains HTTP/2 protocol the library supports, + * it is selected and returns 1. The following step is not taken. + * + * 2. If peer's list contains ``http/1.1``, this function selects + * ``http/1.1`` and returns 0. The following step is not taken. + * + * 3. This function selects nothing and returns -1 (So called + * non-overlap case). In this case, |out| and |outlen| are left + * untouched. + * + * Selecting ``h2`` means that ``h2`` is written into |*out| and its + * length (which is 2) is assigned to |*outlen|. + * + * For ALPN, refer to https://tools.ietf.org/html/rfc7301 + * + * To use this method you should do something like:: + * + * static int alpn_select_proto_cb(SSL* ssl, + * const unsigned char **out, + * unsigned char *outlen, + * const unsigned char *in, + * unsigned int inlen, + * void *arg) + * { + * int rv; + * rv = nghttp2_select_alpn(out, outlen, in, inlen); + * if (rv == -1) { + * return SSL_TLSEXT_ERR_NOACK; + * } + * if (rv == 1) { + * ((MyType*)arg)->http2_selected = 1; + * } + * return SSL_TLSEXT_ERR_OK; + * } + * ... + * SSL_CTX_set_alpn_select_cb(ssl_ctx, alpn_select_proto_cb, my_obj); + * + */ +NGHTTP2_EXTERN int nghttp2_select_alpn(const unsigned char **out, + unsigned char *outlen, + const unsigned char *in, + unsigned int inlen); + +/** + * @function + * + * Returns a pointer to a nghttp2_info struct with version information + * about the run-time library in use. The |least_version| argument + * can be set to a 24 bit numerical value for the least accepted + * version number and if the condition is not met, this function will + * return a ``NULL``. Pass in 0 to skip the version checking. + */ +NGHTTP2_EXTERN nghttp2_info *nghttp2_version(int least_version); + +/** + * @function + * + * Returns nonzero if the :type:`nghttp2_error` library error code + * |lib_error| is fatal. + */ +NGHTTP2_EXTERN int nghttp2_is_fatal(int lib_error_code); + +/** + * @function + * + * Returns nonzero if HTTP header field name |name| of length |len| is + * valid according to http://tools.ietf.org/html/rfc7230#section-3.2 + * + * Because this is a header field name in HTTP2, the upper cased alphabet + * is treated as error. + */ +NGHTTP2_EXTERN int nghttp2_check_header_name(const uint8_t *name, size_t len); + +/** + * @function + * + * Returns nonzero if HTTP header field value |value| of length |len| + * is valid according to + * http://tools.ietf.org/html/rfc7230#section-3.2 + * + * This function is considered obsolete, and application should + * consider to use `nghttp2_check_header_value_rfc9113()` instead. + */ +NGHTTP2_EXTERN int nghttp2_check_header_value(const uint8_t *value, size_t len); + +/** + * @function + * + * Returns nonzero if HTTP header field value |value| of length |len| + * is valid according to + * http://tools.ietf.org/html/rfc7230#section-3.2, plus + * https://datatracker.ietf.org/doc/html/rfc9113#section-8.2.1 + */ +NGHTTP2_EXTERN int nghttp2_check_header_value_rfc9113(const uint8_t *value, + size_t len); + +/** + * @function + * + * Returns nonzero if the |value| which is supposed to be the value of + * the :method header field is valid according to + * https://datatracker.ietf.org/doc/html/rfc7231#section-4 and + * https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.6 + */ +NGHTTP2_EXTERN int nghttp2_check_method(const uint8_t *value, size_t len); + +/** + * @function + * + * Returns nonzero if the |value| which is supposed to be the value of + * the :path header field is valid according to + * https://datatracker.ietf.org/doc/html/rfc7540#section-8.1.2.3 + * + * |value| is valid if it merely consists of the allowed characters. + * In particular, it does not check whether |value| follows the syntax + * of path. The allowed characters are all characters valid by + * `nghttp2_check_header_value` minus SPC and HT. + */ +NGHTTP2_EXTERN int nghttp2_check_path(const uint8_t *value, size_t len); + +/** + * @function + * + * Returns nonzero if the |value| which is supposed to be the value of the + * :authority or host header field is valid according to + * https://tools.ietf.org/html/rfc3986#section-3.2 + * + * Note that :authority and host field values are not authority. They + * do not include userinfo in RFC 3986, see + * https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2, that + * is, it does not include '@'. This function treats '@' as a valid + * character. + * + * |value| is valid if it merely consists of the allowed characters. + * In particular, it does not check whether |value| follows the syntax + * of authority. + */ +NGHTTP2_EXTERN int nghttp2_check_authority(const uint8_t *value, size_t len); + +/* HPACK API */ + +struct nghttp2_hd_deflater; + +/** + * @struct + * + * HPACK deflater object. + */ +typedef struct nghttp2_hd_deflater nghttp2_hd_deflater; + +/** + * @function + * + * Initializes |*deflater_ptr| for deflating name/values pairs. + * + * The |max_deflate_dynamic_table_size| is the upper bound of header + * table size the deflater will use. + * + * If this function fails, |*deflater_ptr| is left untouched. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int +nghttp2_hd_deflate_new(nghttp2_hd_deflater **deflater_ptr, + size_t max_deflate_dynamic_table_size); + +/** + * @function + * + * Like `nghttp2_hd_deflate_new()`, but with additional custom memory + * allocator specified in the |mem|. + * + * The |mem| can be ``NULL`` and the call is equivalent to + * `nghttp2_hd_deflate_new()`. + * + * This function does not take ownership |mem|. The application is + * responsible for freeing |mem|. + * + * The library code does not refer to |mem| pointer after this + * function returns, so the application can safely free it. + */ +NGHTTP2_EXTERN int +nghttp2_hd_deflate_new2(nghttp2_hd_deflater **deflater_ptr, + size_t max_deflate_dynamic_table_size, + nghttp2_mem *mem); + +/** + * @function + * + * Deallocates any resources allocated for |deflater|. + */ +NGHTTP2_EXTERN void nghttp2_hd_deflate_del(nghttp2_hd_deflater *deflater); + +/** + * @function + * + * Changes header table size of the |deflater| to + * |settings_max_dynamic_table_size| bytes. This may trigger eviction + * in the dynamic table. + * + * The |settings_max_dynamic_table_size| should be the value received + * in SETTINGS_HEADER_TABLE_SIZE. + * + * The deflater never uses more memory than + * ``max_deflate_dynamic_table_size`` bytes specified in + * `nghttp2_hd_deflate_new()`. Therefore, if + * |settings_max_dynamic_table_size| > + * ``max_deflate_dynamic_table_size``, resulting maximum table size + * becomes ``max_deflate_dynamic_table_size``. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int +nghttp2_hd_deflate_change_table_size(nghttp2_hd_deflater *deflater, + size_t settings_max_dynamic_table_size); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use `nghttp2_hd_deflate_hd2()` instead. + * + * Deflates the |nva|, which has the |nvlen| name/value pairs, into + * the |buf| of length |buflen|. + * + * If |buf| is not large enough to store the deflated header block, + * this function fails with + * :enum:`nghttp2_error.NGHTTP2_ERR_INSUFF_BUFSIZE`. The caller + * should use `nghttp2_hd_deflate_bound()` to know the upper bound of + * buffer size required to deflate given header name/value pairs. + * + * Once this function fails, subsequent call of this function always + * returns :enum:`nghttp2_error.NGHTTP2_ERR_HEADER_COMP`. + * + * After this function returns, it is safe to delete the |nva|. + * + * This function returns the number of bytes written to |buf| if it + * succeeds, or one of the following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_HEADER_COMP` + * Deflation process has failed. + * :enum:`nghttp2_error.NGHTTP2_ERR_INSUFF_BUFSIZE` + * The provided |buflen| size is too small to hold the output. + */ +NGHTTP2_EXTERN ssize_t nghttp2_hd_deflate_hd(nghttp2_hd_deflater *deflater, + uint8_t *buf, size_t buflen, + const nghttp2_nv *nva, + size_t nvlen); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @function + * + * Deflates the |nva|, which has the |nvlen| name/value pairs, into + * the |buf| of length |buflen|. + * + * If |buf| is not large enough to store the deflated header block, + * this function fails with + * :enum:`nghttp2_error.NGHTTP2_ERR_INSUFF_BUFSIZE`. The caller + * should use `nghttp2_hd_deflate_bound()` to know the upper bound of + * buffer size required to deflate given header name/value pairs. + * + * Once this function fails, subsequent call of this function always + * returns :enum:`nghttp2_error.NGHTTP2_ERR_HEADER_COMP`. + * + * After this function returns, it is safe to delete the |nva|. + * + * This function returns the number of bytes written to |buf| if it + * succeeds, or one of the following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_HEADER_COMP` + * Deflation process has failed. + * :enum:`nghttp2_error.NGHTTP2_ERR_INSUFF_BUFSIZE` + * The provided |buflen| size is too small to hold the output. + */ +NGHTTP2_EXTERN nghttp2_ssize +nghttp2_hd_deflate_hd2(nghttp2_hd_deflater *deflater, uint8_t *buf, + size_t buflen, const nghttp2_nv *nva, size_t nvlen); + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use `nghttp2_hd_deflate_hd_vec2()` instead. + * + * Deflates the |nva|, which has the |nvlen| name/value pairs, into + * the |veclen| size of buf vector |vec|. The each size of buffer + * must be set in len field of :type:`nghttp2_vec`. If and only if + * one chunk is filled up completely, next chunk will be used. If + * |vec| is not large enough to store the deflated header block, this + * function fails with + * :enum:`nghttp2_error.NGHTTP2_ERR_INSUFF_BUFSIZE`. The caller + * should use `nghttp2_hd_deflate_bound()` to know the upper bound of + * buffer size required to deflate given header name/value pairs. + * + * Once this function fails, subsequent call of this function always + * returns :enum:`nghttp2_error.NGHTTP2_ERR_HEADER_COMP`. + * + * After this function returns, it is safe to delete the |nva|. + * + * This function returns the number of bytes written to |vec| if it + * succeeds, or one of the following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_HEADER_COMP` + * Deflation process has failed. + * :enum:`nghttp2_error.NGHTTP2_ERR_INSUFF_BUFSIZE` + * The provided |buflen| size is too small to hold the output. + */ +NGHTTP2_EXTERN ssize_t nghttp2_hd_deflate_hd_vec(nghttp2_hd_deflater *deflater, + const nghttp2_vec *vec, + size_t veclen, + const nghttp2_nv *nva, + size_t nvlen); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @function + * + * Deflates the |nva|, which has the |nvlen| name/value pairs, into + * the |veclen| size of buf vector |vec|. The each size of buffer + * must be set in len field of :type:`nghttp2_vec`. If and only if + * one chunk is filled up completely, next chunk will be used. If + * |vec| is not large enough to store the deflated header block, this + * function fails with + * :enum:`nghttp2_error.NGHTTP2_ERR_INSUFF_BUFSIZE`. The caller + * should use `nghttp2_hd_deflate_bound()` to know the upper bound of + * buffer size required to deflate given header name/value pairs. + * + * Once this function fails, subsequent call of this function always + * returns :enum:`nghttp2_error.NGHTTP2_ERR_HEADER_COMP`. + * + * After this function returns, it is safe to delete the |nva|. + * + * This function returns the number of bytes written to |vec| if it + * succeeds, or one of the following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_HEADER_COMP` + * Deflation process has failed. + * :enum:`nghttp2_error.NGHTTP2_ERR_INSUFF_BUFSIZE` + * The provided |buflen| size is too small to hold the output. + */ +NGHTTP2_EXTERN nghttp2_ssize nghttp2_hd_deflate_hd_vec2( + nghttp2_hd_deflater *deflater, const nghttp2_vec *vec, size_t veclen, + const nghttp2_nv *nva, size_t nvlen); + +/** + * @function + * + * Returns an upper bound on the compressed size after deflation of + * |nva| of length |nvlen|. + */ +NGHTTP2_EXTERN size_t nghttp2_hd_deflate_bound(nghttp2_hd_deflater *deflater, + const nghttp2_nv *nva, + size_t nvlen); + +/** + * @function + * + * Returns the number of entries that header table of |deflater| + * contains. This is the sum of the number of static table and + * dynamic table, so the return value is at least 61. + */ +NGHTTP2_EXTERN +size_t nghttp2_hd_deflate_get_num_table_entries(nghttp2_hd_deflater *deflater); + +/** + * @function + * + * Returns the table entry denoted by |idx| from header table of + * |deflater|. The |idx| is 1-based, and idx=1 returns first entry of + * static table. idx=62 returns first entry of dynamic table if it + * exists. Specifying idx=0 is error, and this function returns NULL. + * If |idx| is strictly greater than the number of entries the tables + * contain, this function returns NULL. + */ +NGHTTP2_EXTERN +const nghttp2_nv * +nghttp2_hd_deflate_get_table_entry(nghttp2_hd_deflater *deflater, size_t idx); + +/** + * @function + * + * Returns the used dynamic table size, including the overhead 32 + * bytes per entry described in RFC 7541. + */ +NGHTTP2_EXTERN +size_t nghttp2_hd_deflate_get_dynamic_table_size(nghttp2_hd_deflater *deflater); + +/** + * @function + * + * Returns the maximum dynamic table size. + */ +NGHTTP2_EXTERN +size_t +nghttp2_hd_deflate_get_max_dynamic_table_size(nghttp2_hd_deflater *deflater); + +struct nghttp2_hd_inflater; + +/** + * @struct + * + * HPACK inflater object. + */ +typedef struct nghttp2_hd_inflater nghttp2_hd_inflater; + +/** + * @function + * + * Initializes |*inflater_ptr| for inflating name/values pairs. + * + * If this function fails, |*inflater_ptr| is left untouched. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + */ +NGHTTP2_EXTERN int nghttp2_hd_inflate_new(nghttp2_hd_inflater **inflater_ptr); + +/** + * @function + * + * Like `nghttp2_hd_inflate_new()`, but with additional custom memory + * allocator specified in the |mem|. + * + * The |mem| can be ``NULL`` and the call is equivalent to + * `nghttp2_hd_inflate_new()`. + * + * This function does not take ownership |mem|. The application is + * responsible for freeing |mem|. + * + * The library code does not refer to |mem| pointer after this + * function returns, so the application can safely free it. + */ +NGHTTP2_EXTERN int nghttp2_hd_inflate_new2(nghttp2_hd_inflater **inflater_ptr, + nghttp2_mem *mem); + +/** + * @function + * + * Deallocates any resources allocated for |inflater|. + */ +NGHTTP2_EXTERN void nghttp2_hd_inflate_del(nghttp2_hd_inflater *inflater); + +/** + * @function + * + * Changes header table size in the |inflater|. This may trigger + * eviction in the dynamic table. + * + * The |settings_max_dynamic_table_size| should be the value + * transmitted in SETTINGS_HEADER_TABLE_SIZE. + * + * This function must not be called while header block is being + * inflated. In other words, this function must be called after + * initialization of |inflater|, but before calling + * `nghttp2_hd_inflate_hd3()`, or after + * `nghttp2_hd_inflate_end_headers()`. Otherwise, + * `NGHTTP2_ERR_INVALID_STATE` was returned. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_INVALID_STATE` + * The function is called while header block is being inflated. + * Probably, application missed to call + * `nghttp2_hd_inflate_end_headers()`. + */ +NGHTTP2_EXTERN int +nghttp2_hd_inflate_change_table_size(nghttp2_hd_inflater *inflater, + size_t settings_max_dynamic_table_size); + +/** + * @enum + * + * The flags for header inflation. + */ +typedef enum { + /** + * No flag set. + */ + NGHTTP2_HD_INFLATE_NONE = 0, + /** + * Indicates all headers were inflated. + */ + NGHTTP2_HD_INFLATE_FINAL = 0x01, + /** + * Indicates a header was emitted. + */ + NGHTTP2_HD_INFLATE_EMIT = 0x02 +} nghttp2_hd_inflate_flag; + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use `nghttp2_hd_inflate_hd2()` instead. + * + * Inflates name/value block stored in |in| with length |inlen|. This + * function performs decompression. For each successful emission of + * header name/value pair, + * :enum:`nghttp2_hd_inflate_flag.NGHTTP2_HD_INFLATE_EMIT` is set in + * |*inflate_flags| and name/value pair is assigned to the |nv_out| + * and the function returns. The caller must not free the members of + * |nv_out|. + * + * The |nv_out| may include pointers to the memory region in the |in|. + * The caller must retain the |in| while the |nv_out| is used. + * + * The application should call this function repeatedly until the + * ``(*inflate_flags) & NGHTTP2_HD_INFLATE_FINAL`` is nonzero and + * return value is non-negative. This means the all input values are + * processed successfully. Then the application must call + * `nghttp2_hd_inflate_end_headers()` to prepare for the next header + * block input. + * + * The caller can feed complete compressed header block. It also can + * feed it in several chunks. The caller must set |in_final| to + * nonzero if the given input is the last block of the compressed + * header. + * + * This function returns the number of bytes processed if it succeeds, + * or one of the following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_HEADER_COMP` + * Inflation process has failed. + * :enum:`nghttp2_error.NGHTTP2_ERR_BUFFER_ERROR` + * The header field name or value is too large. + * + * Example follows:: + * + * int inflate_header_block(nghttp2_hd_inflater *hd_inflater, + * uint8_t *in, size_t inlen, int final) + * { + * ssize_t rv; + * + * for(;;) { + * nghttp2_nv nv; + * int inflate_flags = 0; + * + * rv = nghttp2_hd_inflate_hd(hd_inflater, &nv, &inflate_flags, + * in, inlen, final); + * + * if(rv < 0) { + * fprintf(stderr, "inflate failed with error code %zd", rv); + * return -1; + * } + * + * in += rv; + * inlen -= rv; + * + * if(inflate_flags & NGHTTP2_HD_INFLATE_EMIT) { + * fwrite(nv.name, nv.namelen, 1, stderr); + * fprintf(stderr, ": "); + * fwrite(nv.value, nv.valuelen, 1, stderr); + * fprintf(stderr, "\n"); + * } + * if(inflate_flags & NGHTTP2_HD_INFLATE_FINAL) { + * nghttp2_hd_inflate_end_headers(hd_inflater); + * break; + * } + * if((inflate_flags & NGHTTP2_HD_INFLATE_EMIT) == 0 && + * inlen == 0) { + * break; + * } + * } + * + * return 0; + * } + * + */ +NGHTTP2_EXTERN ssize_t nghttp2_hd_inflate_hd(nghttp2_hd_inflater *inflater, + nghttp2_nv *nv_out, + int *inflate_flags, uint8_t *in, + size_t inlen, int in_final); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +#ifndef NGHTTP2_NO_SSIZE_T +/** + * @function + * + * .. warning:: + * + * Deprecated. Use `nghttp2_hd_inflate_hd3()` instead. + * + * Inflates name/value block stored in |in| with length |inlen|. This + * function performs decompression. For each successful emission of + * header name/value pair, + * :enum:`nghttp2_hd_inflate_flag.NGHTTP2_HD_INFLATE_EMIT` is set in + * |*inflate_flags| and name/value pair is assigned to the |nv_out| + * and the function returns. The caller must not free the members of + * |nv_out|. + * + * The |nv_out| may include pointers to the memory region in the |in|. + * The caller must retain the |in| while the |nv_out| is used. + * + * The application should call this function repeatedly until the + * ``(*inflate_flags) & NGHTTP2_HD_INFLATE_FINAL`` is nonzero and + * return value is non-negative. If that happens, all given input + * data (|inlen| bytes) are processed successfully. Then the + * application must call `nghttp2_hd_inflate_end_headers()` to prepare + * for the next header block input. + * + * In other words, if |in_final| is nonzero, and this function returns + * |inlen|, you can assert that + * :enum:`nghttp2_hd_inflate_final.NGHTTP2_HD_INFLATE_FINAL` is set in + * |*inflate_flags|. + * + * The caller can feed complete compressed header block. It also can + * feed it in several chunks. The caller must set |in_final| to + * nonzero if the given input is the last block of the compressed + * header. + * + * This function returns the number of bytes processed if it succeeds, + * or one of the following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_HEADER_COMP` + * Inflation process has failed. + * :enum:`nghttp2_error.NGHTTP2_ERR_BUFFER_ERROR` + * The header field name or value is too large. + * + * Example follows:: + * + * int inflate_header_block(nghttp2_hd_inflater *hd_inflater, + * uint8_t *in, size_t inlen, int final) + * { + * ssize_t rv; + * + * for(;;) { + * nghttp2_nv nv; + * int inflate_flags = 0; + * + * rv = nghttp2_hd_inflate_hd2(hd_inflater, &nv, &inflate_flags, + * in, inlen, final); + * + * if(rv < 0) { + * fprintf(stderr, "inflate failed with error code %zd", rv); + * return -1; + * } + * + * in += rv; + * inlen -= rv; + * + * if(inflate_flags & NGHTTP2_HD_INFLATE_EMIT) { + * fwrite(nv.name, nv.namelen, 1, stderr); + * fprintf(stderr, ": "); + * fwrite(nv.value, nv.valuelen, 1, stderr); + * fprintf(stderr, "\n"); + * } + * if(inflate_flags & NGHTTP2_HD_INFLATE_FINAL) { + * nghttp2_hd_inflate_end_headers(hd_inflater); + * break; + * } + * if((inflate_flags & NGHTTP2_HD_INFLATE_EMIT) == 0 && + * inlen == 0) { + * break; + * } + * } + * + * return 0; + * } + * + */ +NGHTTP2_EXTERN ssize_t nghttp2_hd_inflate_hd2(nghttp2_hd_inflater *inflater, + nghttp2_nv *nv_out, + int *inflate_flags, + const uint8_t *in, size_t inlen, + int in_final); + +#endif /* NGHTTP2_NO_SSIZE_T */ + +/** + * @function + * + * Inflates name/value block stored in |in| with length |inlen|. This + * function performs decompression. For each successful emission of + * header name/value pair, + * :enum:`nghttp2_hd_inflate_flag.NGHTTP2_HD_INFLATE_EMIT` is set in + * |*inflate_flags| and name/value pair is assigned to the |nv_out| + * and the function returns. The caller must not free the members of + * |nv_out|. + * + * The |nv_out| may include pointers to the memory region in the |in|. + * The caller must retain the |in| while the |nv_out| is used. + * + * The application should call this function repeatedly until the + * ``(*inflate_flags) & NGHTTP2_HD_INFLATE_FINAL`` is nonzero and + * return value is non-negative. If that happens, all given input + * data (|inlen| bytes) are processed successfully. Then the + * application must call `nghttp2_hd_inflate_end_headers()` to prepare + * for the next header block input. + * + * In other words, if |in_final| is nonzero, and this function returns + * |inlen|, you can assert that + * :enum:`nghttp2_hd_inflate_final.NGHTTP2_HD_INFLATE_FINAL` is set in + * |*inflate_flags|. + * + * The caller can feed complete compressed header block. It also can + * feed it in several chunks. The caller must set |in_final| to + * nonzero if the given input is the last block of the compressed + * header. + * + * This function returns the number of bytes processed if it succeeds, + * or one of the following negative error codes: + * + * :enum:`nghttp2_error.NGHTTP2_ERR_NOMEM` + * Out of memory. + * :enum:`nghttp2_error.NGHTTP2_ERR_HEADER_COMP` + * Inflation process has failed. + * :enum:`nghttp2_error.NGHTTP2_ERR_BUFFER_ERROR` + * The header field name or value is too large. + * + * Example follows:: + * + * int inflate_header_block(nghttp2_hd_inflater *hd_inflater, + * uint8_t *in, size_t inlen, int final) + * { + * nghttp2_ssize rv; + * + * for(;;) { + * nghttp2_nv nv; + * int inflate_flags = 0; + * + * rv = nghttp2_hd_inflate_hd3(hd_inflater, &nv, &inflate_flags, + * in, inlen, final); + * + * if(rv < 0) { + * fprintf(stderr, "inflate failed with error code %td", rv); + * return -1; + * } + * + * in += rv; + * inlen -= rv; + * + * if(inflate_flags & NGHTTP2_HD_INFLATE_EMIT) { + * fwrite(nv.name, nv.namelen, 1, stderr); + * fprintf(stderr, ": "); + * fwrite(nv.value, nv.valuelen, 1, stderr); + * fprintf(stderr, "\n"); + * } + * if(inflate_flags & NGHTTP2_HD_INFLATE_FINAL) { + * nghttp2_hd_inflate_end_headers(hd_inflater); + * break; + * } + * if((inflate_flags & NGHTTP2_HD_INFLATE_EMIT) == 0 && + * inlen == 0) { + * break; + * } + * } + * + * return 0; + * } + * + */ +NGHTTP2_EXTERN nghttp2_ssize nghttp2_hd_inflate_hd3( + nghttp2_hd_inflater *inflater, nghttp2_nv *nv_out, int *inflate_flags, + const uint8_t *in, size_t inlen, int in_final); + +/** + * @function + * + * Signals the end of decompression for one header block. + * + * This function returns 0 if it succeeds. Currently this function + * always succeeds. + */ +NGHTTP2_EXTERN int +nghttp2_hd_inflate_end_headers(nghttp2_hd_inflater *inflater); + +/** + * @function + * + * Returns the number of entries that header table of |inflater| + * contains. This is the sum of the number of static table and + * dynamic table, so the return value is at least 61. + */ +NGHTTP2_EXTERN +size_t nghttp2_hd_inflate_get_num_table_entries(nghttp2_hd_inflater *inflater); + +/** + * @function + * + * Returns the table entry denoted by |idx| from header table of + * |inflater|. The |idx| is 1-based, and idx=1 returns first entry of + * static table. idx=62 returns first entry of dynamic table if it + * exists. Specifying idx=0 is error, and this function returns NULL. + * If |idx| is strictly greater than the number of entries the tables + * contain, this function returns NULL. + */ +NGHTTP2_EXTERN +const nghttp2_nv * +nghttp2_hd_inflate_get_table_entry(nghttp2_hd_inflater *inflater, size_t idx); + +/** + * @function + * + * Returns the used dynamic table size, including the overhead 32 + * bytes per entry described in RFC 7541. + */ +NGHTTP2_EXTERN +size_t nghttp2_hd_inflate_get_dynamic_table_size(nghttp2_hd_inflater *inflater); + +/** + * @function + * + * Returns the maximum dynamic table size. + */ +NGHTTP2_EXTERN +size_t +nghttp2_hd_inflate_get_max_dynamic_table_size(nghttp2_hd_inflater *inflater); + +struct nghttp2_stream; + +/** + * @struct + * + * The structure to represent HTTP/2 stream. The details of this + * structure are intentionally hidden from the public API. + */ +typedef struct nghttp2_stream nghttp2_stream; + +/** + * @function + * + * Returns pointer to :type:`nghttp2_stream` object denoted by + * |stream_id|. If stream was not found, returns NULL. + * + * Returns imaginary root stream (see + * `nghttp2_session_get_root_stream()`) if 0 is given in |stream_id|. + * + * Unless |stream_id| == 0, the returned pointer is valid until next + * call of `nghttp2_session_send()`, `nghttp2_session_mem_send2()`, + * `nghttp2_session_recv()`, and `nghttp2_session_mem_recv2()`. + */ +NGHTTP2_EXTERN nghttp2_stream * +nghttp2_session_find_stream(nghttp2_session *session, int32_t stream_id); + +/** + * @enum + * + * State of stream as described in RFC 7540. + */ +typedef enum { + /** + * idle state. + */ + NGHTTP2_STREAM_STATE_IDLE = 1, + /** + * open state. + */ + NGHTTP2_STREAM_STATE_OPEN, + /** + * reserved (local) state. + */ + NGHTTP2_STREAM_STATE_RESERVED_LOCAL, + /** + * reserved (remote) state. + */ + NGHTTP2_STREAM_STATE_RESERVED_REMOTE, + /** + * half closed (local) state. + */ + NGHTTP2_STREAM_STATE_HALF_CLOSED_LOCAL, + /** + * half closed (remote) state. + */ + NGHTTP2_STREAM_STATE_HALF_CLOSED_REMOTE, + /** + * closed state. + */ + NGHTTP2_STREAM_STATE_CLOSED +} nghttp2_stream_proto_state; + +/** + * @function + * + * Returns state of |stream|. The root stream retrieved by + * `nghttp2_session_get_root_stream()` will have stream state + * :enum:`nghttp2_stream_proto_state.NGHTTP2_STREAM_STATE_IDLE`. + */ +NGHTTP2_EXTERN nghttp2_stream_proto_state +nghttp2_stream_get_state(nghttp2_stream *stream); + +/** + * @function + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * Returns root of dependency tree, which is imaginary stream with + * stream ID 0. The returned pointer is valid until |session| is + * freed by `nghttp2_session_del()`. + */ +NGHTTP2_EXTERN nghttp2_stream * +nghttp2_session_get_root_stream(nghttp2_session *session); + +/** + * @function + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * This function always returns NULL. + */ +NGHTTP2_EXTERN nghttp2_stream * +nghttp2_stream_get_parent(nghttp2_stream *stream); + +NGHTTP2_EXTERN int32_t nghttp2_stream_get_stream_id(nghttp2_stream *stream); + +/** + * @function + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * This function always returns NULL. + */ +NGHTTP2_EXTERN nghttp2_stream * +nghttp2_stream_get_next_sibling(nghttp2_stream *stream); + +/** + * @function + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * This function always returns NULL. + */ +NGHTTP2_EXTERN nghttp2_stream * +nghttp2_stream_get_previous_sibling(nghttp2_stream *stream); + +/** + * @function + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * This function always returns NULL. + */ +NGHTTP2_EXTERN nghttp2_stream * +nghttp2_stream_get_first_child(nghttp2_stream *stream); + +/** + * @function + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * This function always returns :macro:`NGHTTP2_DEFAULT_WEIGHT`. + */ +NGHTTP2_EXTERN int32_t nghttp2_stream_get_weight(nghttp2_stream *stream); + +/** + * @function + * + * .. warning:: + * + * Deprecated. :rfc:`7540` priorities are deprecated by + * :rfc:`9113`. Consider migrating to :rfc:`9218` extensible + * prioritization scheme. + * + * This function always returns 0. + */ +NGHTTP2_EXTERN int32_t +nghttp2_stream_get_sum_dependency_weight(nghttp2_stream *stream); + +/** + * @functypedef + * + * Callback function invoked when the library outputs debug logging. + * The function is called with arguments suitable for ``vfprintf(3)`` + * + * The debug output is only enabled if the library is built with + * ``DEBUGBUILD`` macro defined. + */ +typedef void (*nghttp2_debug_vprintf_callback)(const char *format, + va_list args); + +/** + * @function + * + * Sets a debug output callback called by the library when built with + * ``DEBUGBUILD`` macro defined. If this option is not used, debug + * log is written into standard error output. + * + * For builds without ``DEBUGBUILD`` macro defined, this function is + * noop. + * + * Note that building with ``DEBUGBUILD`` may cause significant + * performance penalty to libnghttp2 because of extra processing. It + * should be used for debugging purpose only. + * + * .. Warning:: + * + * Building with ``DEBUGBUILD`` may cause significant performance + * penalty to libnghttp2 because of extra processing. It should be + * used for debugging purpose only. We write this two times because + * this is important. + */ +NGHTTP2_EXTERN void nghttp2_set_debug_vprintf_callback( + nghttp2_debug_vprintf_callback debug_vprintf_callback); + +#ifdef __cplusplus +} +#endif + +#endif /* NGHTTP2_H */ diff --git a/curl/include/nghttp2/nghttp2ver.h b/curl/include/nghttp2/nghttp2ver.h new file mode 100644 index 0000000..1302eb5 --- /dev/null +++ b/curl/include/nghttp2/nghttp2ver.h @@ -0,0 +1,42 @@ +/* + * nghttp2 - HTTP/2 C Library + * + * Copyright (c) 2012, 2013 Tatsuhiro Tsujikawa + * + * Permission is hereby granted, free of charge, to any person obtaining + * a copy of this software and associated documentation files (the + * "Software"), to deal in the Software without restriction, including + * without limitation the rights to use, copy, modify, merge, publish, + * distribute, sublicense, and/or sell copies of the Software, and to + * permit persons to whom the Software is furnished to do so, subject to + * the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + */ +#ifndef NGHTTP2VER_H +#define NGHTTP2VER_H + +/** + * @macro + * Version number of the nghttp2 library release + */ +#define NGHTTP2_VERSION "1.65.0" + +/** + * @macro + * Numerical representation of the version number of the nghttp2 library + * release. This is a 24 bit number with 8 bits for major number, 8 bits + * for minor and 8 bits for patch. Version 1.2.3 becomes 0x010203. + */ +#define NGHTTP2_VERSION_NUM 0x014100 + +#endif /* NGHTTP2VER_H */ diff --git a/curl/include/nghttp3/nghttp3.h b/curl/include/nghttp3/nghttp3.h new file mode 100644 index 0000000..bcf5ece --- /dev/null +++ b/curl/include/nghttp3/nghttp3.h @@ -0,0 +1,2939 @@ +/* + * nghttp3 + * + * Copyright (c) 2018 nghttp3 contributors + * Copyright (c) 2017 ngtcp2 contributors + * Copyright (c) 2017 nghttp2 contributors + * + * Permission is hereby granted, free of charge, to any person obtaining + * a copy of this software and associated documentation files (the + * "Software"), to deal in the Software without restriction, including + * without limitation the rights to use, copy, modify, merge, publish, + * distribute, sublicense, and/or sell copies of the Software, and to + * permit persons to whom the Software is furnished to do so, subject to + * the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + */ +#ifndef NGHTTP3_H +#define NGHTTP3_H + +/* Define WIN32 when build target is Win32 API (borrowed from + libcurl) */ +#if (defined(_WIN32) || defined(__WIN32__)) && !defined(WIN32) +# define WIN32 +#endif /* (defined(_WIN32) || defined(__WIN32__)) && !defined(WIN32) */ + +#ifdef __cplusplus +extern "C" { +#endif /* defined(__cplusplus) */ + +#include +#if defined(_MSC_VER) && (_MSC_VER < 1800) +/* MSVC < 2013 does not have inttypes.h because it is not C99 + compliant. See compiler macros and version number in + https://sourceforge.net/p/predef/wiki/Compilers/ */ +# include +#else /* !(defined(_MSC_VER) && (_MSC_VER < 1800)) */ +# include +#endif /* !(defined(_MSC_VER) && (_MSC_VER < 1800)) */ +#include +#include +#include + +#include + +#ifdef NGHTTP3_STATICLIB +# define NGHTTP3_EXTERN +#elif defined(WIN32) +# ifdef BUILDING_NGHTTP3 +# define NGHTTP3_EXTERN __declspec(dllexport) +# else /* !defined(BUILDING_NGHTTP3) */ +# define NGHTTP3_EXTERN __declspec(dllimport) +# endif /* !defined(BUILDING_NGHTTP3) */ +#else /* !(defined(NGHTTP3_STATICLIB) || defined(WIN32)) */ +# ifdef BUILDING_NGHTTP3 +# define NGHTTP3_EXTERN __attribute__((visibility("default"))) +# else /* !defined(BUILDING_NGHTTP3) */ +# define NGHTTP3_EXTERN +# endif /* !defined(BUILDING_NGHTTP3) */ +#endif /* !(defined(NGHTTP3_STATICLIB) || defined(WIN32)) */ + +#ifdef _MSC_VER +# define NGHTTP3_ALIGN(N) __declspec(align(N)) +#else /* !defined(_MSC_VER) */ +# define NGHTTP3_ALIGN(N) __attribute__((aligned(N))) +#endif /* !defined(_MSC_VER) */ + +/** + * @typedef + * + * :type:`nghttp3_ssize` is signed counterpart of size_t. + */ +typedef ptrdiff_t nghttp3_ssize; + +/** + * @macro + * + * :macro:`NGHTTP3_ALPN_H3` is a serialized form of HTTP/3 ALPN + * protocol identifier this library supports. Notice that the first + * byte is the length of the following protocol identifier. + */ +#define NGHTTP3_ALPN_H3 "\x2h3" + +/** + * @macrosection + * + * nghttp3 library error codes + */ + +/** + * @macro + * + * :macro:`NGHTTP3_ERR_INVALID_ARGUMENT` indicates that a passed + * argument is invalid. + */ +#define NGHTTP3_ERR_INVALID_ARGUMENT -101 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_INVALID_STATE` indicates that a requested + * operation is not allowed at the current connection state. + */ +#define NGHTTP3_ERR_INVALID_STATE -102 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_WOULDBLOCK` indicates that an operation might + * block. + */ +#define NGHTTP3_ERR_WOULDBLOCK -103 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_STREAM_IN_USE` indicates that a stream ID is + * already in use. + */ +#define NGHTTP3_ERR_STREAM_IN_USE -104 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_MALFORMED_HTTP_HEADER` indicates that an HTTP + * header field is malformed. + */ +#define NGHTTP3_ERR_MALFORMED_HTTP_HEADER -105 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_REMOVE_HTTP_HEADER` indicates that an HTTP + * header field is discarded. + */ +#define NGHTTP3_ERR_REMOVE_HTTP_HEADER -106 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_MALFORMED_HTTP_MESSAGING` indicates that HTTP + * messaging is malformed. + */ +#define NGHTTP3_ERR_MALFORMED_HTTP_MESSAGING -107 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_QPACK_FATAL` indicates that a fatal error is + * occurred during QPACK processing, and it cannot be recoverable. + */ +#define NGHTTP3_ERR_QPACK_FATAL -108 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_QPACK_HEADER_TOO_LARGE` indicates that a header + * field is too large to process. + */ +#define NGHTTP3_ERR_QPACK_HEADER_TOO_LARGE -109 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_STREAM_NOT_FOUND` indicates that a stream is + * not found. + */ +#define NGHTTP3_ERR_STREAM_NOT_FOUND -110 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_CONN_CLOSING` indicates that a connection is + * closing state. + */ +#define NGHTTP3_ERR_CONN_CLOSING -111 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_STREAM_DATA_OVERFLOW` indicates that the length + * of stream data is too long, and causes overflow. + */ +#define NGHTTP3_ERR_STREAM_DATA_OVERFLOW -112 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_QPACK_DECOMPRESSION_FAILED` indicates that a + * QPACK decompression failed. + */ +#define NGHTTP3_ERR_QPACK_DECOMPRESSION_FAILED -401 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_QPACK_ENCODER_STREAM_ERROR` indicates that an + * error occurred while reading QPACK encoder stream. + */ +#define NGHTTP3_ERR_QPACK_ENCODER_STREAM_ERROR -402 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_QPACK_DECODER_STREAM_ERROR` indicates that an + * error occurred while reading QPACK decoder stream. + */ +#define NGHTTP3_ERR_QPACK_DECODER_STREAM_ERROR -403 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_H3_FRAME_UNEXPECTED` indicates that an + * unexpected HTTP/3 frame is received. + */ +#define NGHTTP3_ERR_H3_FRAME_UNEXPECTED -601 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_H3_FRAME_ERROR` indicates that an HTTP/3 frame + * is malformed. + */ +#define NGHTTP3_ERR_H3_FRAME_ERROR -602 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_H3_MISSING_SETTINGS` indicates that an HTTP/3 + * SETTINGS frame is missing. + */ +#define NGHTTP3_ERR_H3_MISSING_SETTINGS -603 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_H3_INTERNAL_ERROR` indicates an internal error. + */ +#define NGHTTP3_ERR_H3_INTERNAL_ERROR -604 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_H3_CLOSED_CRITICAL_STREAM` indicates that a + * critical stream is closed. + */ +#define NGHTTP3_ERR_H3_CLOSED_CRITICAL_STREAM -605 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_H3_GENERAL_PROTOCOL_ERROR` indicates a general + * protocol error. This is typically a catch-all error. + */ +#define NGHTTP3_ERR_H3_GENERAL_PROTOCOL_ERROR -606 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_H3_ID_ERROR` indicates that an ID related error + * occurred. + */ +#define NGHTTP3_ERR_H3_ID_ERROR -607 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_H3_SETTINGS_ERROR` indicates that an HTTP/3 + * SETTINGS frame is malformed. + */ +#define NGHTTP3_ERR_H3_SETTINGS_ERROR -608 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_H3_STREAM_CREATION_ERROR` indicates that a + * remote endpoint attempts to create a new stream which is not + * allowed. + */ +#define NGHTTP3_ERR_H3_STREAM_CREATION_ERROR -609 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_FATAL` indicates that error codes less than + * this value is fatal error. When this error is returned, an + * endpoint should drop connection immediately. + */ +#define NGHTTP3_ERR_FATAL -900 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_NOMEM` indicates out of memory. + */ +#define NGHTTP3_ERR_NOMEM -901 +/** + * @macro + * + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` indicates that user defined + * callback function failed. + */ +#define NGHTTP3_ERR_CALLBACK_FAILURE -902 + +/** + * @macrosection + * + * HTTP/3 application error code + */ + +/** + * @macro + * + * :macro:`NGHTTP3_H3_NO_ERROR` is HTTP/3 application error code + * ``H3_NO_ERROR``. + */ +#define NGHTTP3_H3_NO_ERROR 0x0100 +/** + * @macro + * + * :macro:`NGHTTP3_H3_GENERAL_PROTOCOL_ERROR` is HTTP/3 application + * error code ``H3_GENERAL_PROTOCOL_ERROR``. + */ +#define NGHTTP3_H3_GENERAL_PROTOCOL_ERROR 0x0101 +/** + * @macro + * + * :macro:`NGHTTP3_H3_INTERNAL_ERROR` is HTTP/3 application error code + * ``H3_INTERNAL_ERROR``. + */ +#define NGHTTP3_H3_INTERNAL_ERROR 0x0102 +/** + * @macro + * + * :macro:`NGHTTP3_H3_STREAM_CREATION_ERROR` is HTTP/3 application + * error code ``H3_STREAM_CREATION_ERROR``. + */ +#define NGHTTP3_H3_STREAM_CREATION_ERROR 0x0103 +/** + * @macro + * + * :macro:`NGHTTP3_H3_CLOSED_CRITICAL_STREAM` is HTTP/3 application + * error code ``H3_CLOSED_CRITICAL_STREAM``. + */ +#define NGHTTP3_H3_CLOSED_CRITICAL_STREAM 0x0104 +/** + * @macro + * + * :macro:`NGHTTP3_H3_FRAME_UNEXPECTED` is HTTP/3 application error + * code ``H3_FRAME_UNEXPECTED``. + */ +#define NGHTTP3_H3_FRAME_UNEXPECTED 0x0105 +/** + * @macro + * + * :macro:`NGHTTP3_H3_FRAME_ERROR` is HTTP/3 application error code + * ``H3_FRAME_ERROR``. + */ +#define NGHTTP3_H3_FRAME_ERROR 0x0106 +/** + * @macro + * + * :macro:`NGHTTP3_H3_EXCESSIVE_LOAD` is HTTP/3 application error code + * ``H3_EXCESSIVE_LOAD``. + */ +#define NGHTTP3_H3_EXCESSIVE_LOAD 0x0107 +/** + * @macro + * + * :macro:`NGHTTP3_H3_ID_ERROR` is HTTP/3 application error code + * ``H3_ID_ERROR``. + */ +#define NGHTTP3_H3_ID_ERROR 0x0108 +/** + * @macro + * + * :macro:`NGHTTP3_H3_SETTINGS_ERROR` is HTTP/3 application error code + * ``H3_SETTINGS_ERROR``. + */ +#define NGHTTP3_H3_SETTINGS_ERROR 0x0109 +/** + * @macro + * + * :macro:`NGHTTP3_H3_MISSING_SETTINGS` is HTTP/3 application error + * code ``H3_MISSING_SETTINGS``. + */ +#define NGHTTP3_H3_MISSING_SETTINGS 0x010a +/** + * @macro + * + * :macro:`NGHTTP3_H3_REQUEST_REJECTED` is HTTP/3 application error + * code ``H3_REQUEST_REJECTED``. + */ +#define NGHTTP3_H3_REQUEST_REJECTED 0x010b +/** + * @macro + * + * :macro:`NGHTTP3_H3_REQUEST_CANCELLED` is HTTP/3 application error + * code ``H3_REQUEST_CANCELLED``. + */ +#define NGHTTP3_H3_REQUEST_CANCELLED 0x010c +/** + * @macro + * + * :macro:`NGHTTP3_H3_REQUEST_INCOMPLETE` is HTTP/3 application error + * code ``H3_REQUEST_INCOMPLETE``. + */ +#define NGHTTP3_H3_REQUEST_INCOMPLETE 0x010d +/** + * @macro + * + * :macro:`NGHTTP3_H3_MESSAGE_ERROR` is HTTP/3 application error code + * ``H3_MESSAGE_ERROR``. + */ +#define NGHTTP3_H3_MESSAGE_ERROR 0x010e +/** + * @macro + * + * :macro:`NGHTTP3_H3_CONNECT_ERROR` is HTTP/3 application error code + * ``H3_CONNECT_ERROR``. + */ +#define NGHTTP3_H3_CONNECT_ERROR 0x010f +/** + * @macro + * + * :macro:`NGHTTP3_H3_VERSION_FALLBACK` is HTTP/3 application error + * code ``H3_VERSION_FALLBACK``. + */ +#define NGHTTP3_H3_VERSION_FALLBACK 0x0110 +/** + * @macro + * + * :macro:`NGHTTP3_QPACK_DECOMPRESSION_FAILED` is HTTP/3 application + * error code ``QPACK_DECOMPRESSION_FAILED``. + */ +#define NGHTTP3_QPACK_DECOMPRESSION_FAILED 0x0200 +/** + * @macro + * + * :macro:`NGHTTP3_QPACK_ENCODER_STREAM_ERROR` is HTTP/3 application + * error code ``QPACK_ENCODER_STREAM_ERROR``. + */ +#define NGHTTP3_QPACK_ENCODER_STREAM_ERROR 0x0201 +/** + * @macro + * + * :macro:`NGHTTP3_QPACK_DECODER_STREAM_ERROR` is HTTP/3 application + * error code ``QPACK_DECODER_STREAM_ERROR``. + */ +#define NGHTTP3_QPACK_DECODER_STREAM_ERROR 0x0202 + +/** + * @functypedef + * + * :type:`nghttp3_malloc` is a custom memory allocator to replace + * :manpage:`malloc(3)`. The |user_data| is the + * :member:`nghttp3_mem.user_data`. + */ +typedef void *(*nghttp3_malloc)(size_t size, void *user_data); + +/** + * @functypedef + * + * :type:`nghttp3_free` is a custom memory allocator to replace + * :manpage:`free(3)`. The |user_data| is the + * :member:`nghttp3_mem.user_data`. + */ +typedef void (*nghttp3_free)(void *ptr, void *user_data); + +/** + * @functypedef + * + * :type:`nghttp3_calloc` is a custom memory allocator to replace + * :manpage:`calloc(3)`. The |user_data| is the + * :member:`nghttp3_mem.user_data`. + */ +typedef void *(*nghttp3_calloc)(size_t nmemb, size_t size, void *user_data); + +/** + * @functypedef + * + * :type:`nghttp3_realloc` is a custom memory allocator to replace + * :manpage:`realloc(3)`. The |user_data| is the + * :member:`nghttp3_mem.user_data`. + */ +typedef void *(*nghttp3_realloc)(void *ptr, size_t size, void *user_data); + +/** + * @struct + * + * :type:`nghttp3_mem` is a custom memory allocator functions and user + * defined pointer. The :member:`user_data` field is passed to each + * allocator function. This can be used, for example, to achieve + * per-session memory pool. + * + * In the following example code, ``my_malloc``, ``my_free``, + * ``my_calloc``, and ``my_realloc`` are the replacement of the + * standard allocators :manpage:`malloc(3)`, :manpage:`free(3)`, + * :manpage:`calloc(3)` and :manpage:`realloc(3)` respectively:: + * + * void *my_malloc_cb(size_t size, void *user_data) { + * (void)user_data; + * return my_malloc(size); + * } + * + * void my_free_cb(void *ptr, void *user_data) { + * (void)user_data; + * my_free(ptr); + * } + * + * void *my_calloc_cb(size_t nmemb, size_t size, void *user_data) { + * (void)user_data; + * return my_calloc(nmemb, size); + * } + * + * void *my_realloc_cb(void *ptr, size_t size, void *user_data) { + * (void)user_data; + * return my_realloc(ptr, size); + * } + * + * void conn_new() { + * nghttp3_mem mem = {NULL, my_malloc_cb, my_free_cb, my_calloc_cb, + * my_realloc_cb}; + * + * ... + * } + */ +typedef struct nghttp3_mem { + /** + * :member:`user_data` is an arbitrary user supplied data. This is + * passed to each allocator function. + */ + void *user_data; + /** + * :member:`malloc` is a custom allocator function to replace + * :manpage:`malloc(3)`. + */ + nghttp3_malloc malloc; + /** + * :member:`free` is a custom allocator function to replace + * :manpage:`free(3)`. + */ + nghttp3_free free; + /** + * :member:`calloc` is a custom allocator function to replace + * :manpage:`calloc(3)`. + */ + nghttp3_calloc calloc; + /** + * :member:`realloc` is a custom allocator function to replace + * :manpage:`realloc(3)`. + */ + nghttp3_realloc realloc; +} nghttp3_mem; + +/** + * @function + * + * `nghttp3_mem_default` returns the default memory allocator which + * uses malloc/calloc/realloc/free. + */ +NGHTTP3_EXTERN const nghttp3_mem *nghttp3_mem_default(void); + +/** + * @struct + * + * :type:`nghttp3_vec` is ``struct iovec`` compatible structure to + * reference arbitrary array of bytes. + */ +typedef struct nghttp3_vec { + /** + * :member:`base` points to the data. + */ + uint8_t *base; + /** + * :member:`len` is the number of bytes which the buffer pointed by + * :member:`base` contains. + */ + size_t len; +} nghttp3_vec; + +/** + * @struct + * + * :type:`nghttp3_rcbuf` is the object representing reference counted + * buffer. The details of this structure are intentionally hidden + * from the public API. + */ +typedef struct nghttp3_rcbuf nghttp3_rcbuf; + +/** + * @function + * + * `nghttp3_rcbuf_incref` increments the reference count of |rcbuf| by + * 1. + */ +NGHTTP3_EXTERN void nghttp3_rcbuf_incref(nghttp3_rcbuf *rcbuf); + +/** + * @function + * + * `nghttp3_rcbuf_decref` decrements the reference count of |rcbuf| by + * 1. If the reference count becomes zero, the object pointed by + * |rcbuf| will be freed. In this case, application must not use + * |rcbuf| again. + */ +NGHTTP3_EXTERN void nghttp3_rcbuf_decref(nghttp3_rcbuf *rcbuf); + +/** + * @function + * + * `nghttp3_rcbuf_get_buf` returns the underlying buffer managed by + * |rcbuf|. + */ +NGHTTP3_EXTERN nghttp3_vec nghttp3_rcbuf_get_buf(const nghttp3_rcbuf *rcbuf); + +/** + * @function + * + * `nghttp3_rcbuf_is_static` returns nonzero if the underlying buffer + * is statically allocated, and 0 otherwise. This can be useful for + * language bindings that wish to avoid creating duplicate strings for + * these buffers. + */ +NGHTTP3_EXTERN int nghttp3_rcbuf_is_static(const nghttp3_rcbuf *rcbuf); + +/** + * @struct + * + * :type:`nghttp3_buf` is the variable size buffer. + */ +typedef struct nghttp3_buf { + /** + * :member:`begin` points to the beginning of the buffer. + */ + uint8_t *begin; + /** + * :member:`end` points to the one beyond of the last byte of the + * buffer + */ + uint8_t *end; + /** + * :member:`pos` points to the start of data. Typically, this + * points to the address that next data should be read. Initially, + * it points to :member:`begin`. + */ + uint8_t *pos; + /** + * :member:`last` points to the one beyond of the last data of the + * buffer. Typically, new data is written at this point. + * Initially, it points to :member:`begin`. + */ + uint8_t *last; +} nghttp3_buf; + +/** + * @function + * + * `nghttp3_buf_init` initializes empty |buf|. + */ +NGHTTP3_EXTERN void nghttp3_buf_init(nghttp3_buf *buf); + +/** + * @function + * + * `nghttp3_buf_free` frees resources allocated for |buf| using |mem| + * as memory allocator. :member:`buf->begin ` must + * be a heap buffer allocated by |mem|. + */ +NGHTTP3_EXTERN void nghttp3_buf_free(nghttp3_buf *buf, const nghttp3_mem *mem); + +/** + * @function + * + * `nghttp3_buf_left` returns the number of additional bytes which can + * be written to the underlying buffer. In other words, it returns + * :member:`buf->end ` - :member:`buf->last + * `. + */ +NGHTTP3_EXTERN size_t nghttp3_buf_left(const nghttp3_buf *buf); + +/** + * @function + * + * `nghttp3_buf_len` returns the number of bytes left to read. In + * other words, it returns :member:`buf->last ` - + * :member:`buf->pos `. + */ +NGHTTP3_EXTERN size_t nghttp3_buf_len(const nghttp3_buf *buf); + +/** + * @function + * + * `nghttp3_buf_reset` sets :member:`buf->pos ` and + * :member:`buf->last ` to :member:`buf->begin + * `. + */ +NGHTTP3_EXTERN void nghttp3_buf_reset(nghttp3_buf *buf); + +/** + * @macrosection + * + * Flags for HTTP field name/value pair + */ + +/** + * @macro + * + * :macro:`NGHTTP3_NV_FLAG_NONE` indicates no flag set. + */ +#define NGHTTP3_NV_FLAG_NONE 0x00u + +/** + * @macro + * + * :macro:`NGHTTP3_NV_FLAG_NEVER_INDEX` indicates that this name/value + * pair must not be indexed. Other implementation calls this bit as + * "sensitive". + */ +#define NGHTTP3_NV_FLAG_NEVER_INDEX 0x01u + +/** + * @macro + * + * :macro:`NGHTTP3_NV_FLAG_NO_COPY_NAME` is set solely by application. + * If this flag is set, the library does not make a copy of field + * name. This could improve performance. + */ +#define NGHTTP3_NV_FLAG_NO_COPY_NAME 0x02u + +/** + * @macro + * + * :macro:`NGHTTP3_NV_FLAG_NO_COPY_VALUE` is set solely by + * application. If this flag is set, the library does not make a copy + * of field value. This could improve performance. + */ +#define NGHTTP3_NV_FLAG_NO_COPY_VALUE 0x04u + +/** + * @macro + * + * :macro:`NGHTTP3_NV_FLAG_TRY_INDEX` gives a hint to QPACK encoder to + * index an HTTP field which is not indexed by default. This is just + * a hint, and QPACK encoder might not encode the field in various + * reasons. + */ +#define NGHTTP3_NV_FLAG_TRY_INDEX 0x08u + +/** + * @struct + * + * :type:`nghttp3_nv` is the name/value pair, which mainly used to + * represent HTTP fields. + */ +typedef struct nghttp3_nv { + /** + * :member:`name` is the HTTP field name. + */ + const uint8_t *name; + /** + * :member:`value` is the HTTP field value. + */ + const uint8_t *value; + /** + * :member:`namelen` is the length of the |name|, excluding + * terminating NULL. + */ + size_t namelen; + /** + * :member:`valuelen` is the length of the |value|, excluding + * terminating NULL. + */ + size_t valuelen; + /** + * :member:`flags` is bitwise OR of one or more of + * :macro:`NGHTTP3_NV_FLAG_* `. + */ + uint8_t flags; +} nghttp3_nv; + +/* Generated by mkstatichdtbl.py */ +/** + * @enum + * + * :type:`nghttp3_qpack_token` defines HTTP field name tokens to + * identify field name quickly. It appears in + * :member:`nghttp3_qpack_nv.token`. + */ +typedef enum nghttp3_qpack_token { + /** + * :enum:`NGHTTP3_QPACK_TOKEN__AUTHORITY` is a token for + * ``:authority``. + */ + NGHTTP3_QPACK_TOKEN__AUTHORITY = 0, + /** + * :enum:`NGHTTP3_QPACK_TOKEN__PATH` is a token for ``:path``. + */ + NGHTTP3_QPACK_TOKEN__PATH = 8, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_AGE` is a token for ``age``. + */ + NGHTTP3_QPACK_TOKEN_AGE = 43, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_CONTENT_DISPOSITION` is a token for + * ``content-disposition``. + */ + NGHTTP3_QPACK_TOKEN_CONTENT_DISPOSITION = 52, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_CONTENT_LENGTH` is a token for + * ``content-length``. + */ + NGHTTP3_QPACK_TOKEN_CONTENT_LENGTH = 55, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_COOKIE` is a token for ``cookie``. + */ + NGHTTP3_QPACK_TOKEN_COOKIE = 68, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_DATE` is a token for ``date``. + */ + NGHTTP3_QPACK_TOKEN_DATE = 69, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_ETAG` is a token for ``etag``. + */ + NGHTTP3_QPACK_TOKEN_ETAG = 71, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_IF_MODIFIED_SINCE` is a token for + * ``if-modified-since``. + */ + NGHTTP3_QPACK_TOKEN_IF_MODIFIED_SINCE = 74, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_IF_NONE_MATCH` is a token for + * ``if-none-match``. + */ + NGHTTP3_QPACK_TOKEN_IF_NONE_MATCH = 75, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_LAST_MODIFIED` is a token for + * ``last-modified``. + */ + NGHTTP3_QPACK_TOKEN_LAST_MODIFIED = 77, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_LINK` is a token for ``link``. + */ + NGHTTP3_QPACK_TOKEN_LINK = 78, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_LOCATION` is a token for ``location``. + */ + NGHTTP3_QPACK_TOKEN_LOCATION = 79, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_REFERER` is a token for ``referer``. + */ + NGHTTP3_QPACK_TOKEN_REFERER = 83, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_SET_COOKIE` is a token for + * ``set-cookie``. + */ + NGHTTP3_QPACK_TOKEN_SET_COOKIE = 85, + /** + * :enum:`NGHTTP3_QPACK_TOKEN__METHOD` is a token for ``:method``. + */ + NGHTTP3_QPACK_TOKEN__METHOD = 1, + /** + * :enum:`NGHTTP3_QPACK_TOKEN__SCHEME` is a token for ``:scheme``. + */ + NGHTTP3_QPACK_TOKEN__SCHEME = 9, + /** + * :enum:`NGHTTP3_QPACK_TOKEN__STATUS` is a token for ``:status``. + */ + NGHTTP3_QPACK_TOKEN__STATUS = 11, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_ACCEPT` is a token for ``accept``. + */ + NGHTTP3_QPACK_TOKEN_ACCEPT = 25, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_ACCEPT_ENCODING` is a token for + * ``accept-encoding``. + */ + NGHTTP3_QPACK_TOKEN_ACCEPT_ENCODING = 27, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_ACCEPT_RANGES` is a token for + * ``accept-ranges``. + */ + NGHTTP3_QPACK_TOKEN_ACCEPT_RANGES = 29, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_ACCESS_CONTROL_ALLOW_HEADERS` is a + * token for ``access-control-allow-headers``. + */ + NGHTTP3_QPACK_TOKEN_ACCESS_CONTROL_ALLOW_HEADERS = 32, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_ACCESS_CONTROL_ALLOW_ORIGIN` is a + * token for ``access-control-allow-origin``. + */ + NGHTTP3_QPACK_TOKEN_ACCESS_CONTROL_ALLOW_ORIGIN = 38, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_CACHE_CONTROL` is a token for + * ``cache-control``. + */ + NGHTTP3_QPACK_TOKEN_CACHE_CONTROL = 46, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_CONTENT_ENCODING` is a token for + * ``content-encoding``. + */ + NGHTTP3_QPACK_TOKEN_CONTENT_ENCODING = 53, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_CONTENT_TYPE` is a token for + * ``content-type``. + */ + NGHTTP3_QPACK_TOKEN_CONTENT_TYPE = 57, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_RANGE` is a token for ``range``. + */ + NGHTTP3_QPACK_TOKEN_RANGE = 82, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_STRICT_TRANSPORT_SECURITY` is a token + * for ``strict-transport-security``. + */ + NGHTTP3_QPACK_TOKEN_STRICT_TRANSPORT_SECURITY = 86, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_VARY` is a token for ``vary``. + */ + NGHTTP3_QPACK_TOKEN_VARY = 92, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_X_CONTENT_TYPE_OPTIONS` is a token for + * ``x-content-type-options``. + */ + NGHTTP3_QPACK_TOKEN_X_CONTENT_TYPE_OPTIONS = 94, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_X_XSS_PROTECTION` is a token for + * ``x-xss-protection``. + */ + NGHTTP3_QPACK_TOKEN_X_XSS_PROTECTION = 98, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_ACCEPT_LANGUAGE` is a token for + * ``accept-language``. + */ + NGHTTP3_QPACK_TOKEN_ACCEPT_LANGUAGE = 28, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_ACCESS_CONTROL_ALLOW_CREDENTIALS` is a + * token for ``access-control-allow-credentials``. + */ + NGHTTP3_QPACK_TOKEN_ACCESS_CONTROL_ALLOW_CREDENTIALS = 30, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_ACCESS_CONTROL_ALLOW_METHODS` is a + * token for ``access-control-allow-methods``. + */ + NGHTTP3_QPACK_TOKEN_ACCESS_CONTROL_ALLOW_METHODS = 35, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_ACCESS_CONTROL_EXPOSE_HEADERS` is a + * token for ``access-control-expose-headers``. + */ + NGHTTP3_QPACK_TOKEN_ACCESS_CONTROL_EXPOSE_HEADERS = 39, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_ACCESS_CONTROL_REQUEST_HEADERS` is a + * token for ``access-control-request-headers``. + */ + NGHTTP3_QPACK_TOKEN_ACCESS_CONTROL_REQUEST_HEADERS = 40, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_ACCESS_CONTROL_REQUEST_METHOD` is a + * token for ``access-control-request-method``. + */ + NGHTTP3_QPACK_TOKEN_ACCESS_CONTROL_REQUEST_METHOD = 41, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_ALT_SVC` is a token for ``alt-svc``. + */ + NGHTTP3_QPACK_TOKEN_ALT_SVC = 44, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_AUTHORIZATION` is a token for + * ``authorization``. + */ + NGHTTP3_QPACK_TOKEN_AUTHORIZATION = 45, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_CONTENT_SECURITY_POLICY` is a token + * for ``content-security-policy``. + */ + NGHTTP3_QPACK_TOKEN_CONTENT_SECURITY_POLICY = 56, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_EARLY_DATA` is a token for + * ``early-data``. + */ + NGHTTP3_QPACK_TOKEN_EARLY_DATA = 70, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_EXPECT_CT` is a token for + * ``expect-ct``. + */ + NGHTTP3_QPACK_TOKEN_EXPECT_CT = 72, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_FORWARDED` is a token for + * ``forwarded``. + */ + NGHTTP3_QPACK_TOKEN_FORWARDED = 73, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_IF_RANGE` is a token for ``if-range``. + */ + NGHTTP3_QPACK_TOKEN_IF_RANGE = 76, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_ORIGIN` is a token for ``origin``. + */ + NGHTTP3_QPACK_TOKEN_ORIGIN = 80, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_PURPOSE` is a token for ``purpose``. + */ + NGHTTP3_QPACK_TOKEN_PURPOSE = 81, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_SERVER` is a token for ``server``. + */ + NGHTTP3_QPACK_TOKEN_SERVER = 84, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_TIMING_ALLOW_ORIGIN` is a token for + * ``timing-allow-origin``. + */ + NGHTTP3_QPACK_TOKEN_TIMING_ALLOW_ORIGIN = 89, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_UPGRADE_INSECURE_REQUESTS` is a token + * for ``upgrade-insecure-requests``. + */ + NGHTTP3_QPACK_TOKEN_UPGRADE_INSECURE_REQUESTS = 90, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_USER_AGENT` is a token for + * ``user-agent``. + */ + NGHTTP3_QPACK_TOKEN_USER_AGENT = 91, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_X_FORWARDED_FOR` is a token for + * ``x-forwarded-for``. + */ + NGHTTP3_QPACK_TOKEN_X_FORWARDED_FOR = 95, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_X_FRAME_OPTIONS` is a token for + * ``x-frame-options``. + */ + NGHTTP3_QPACK_TOKEN_X_FRAME_OPTIONS = 96, + + /* Additional HTTP fields for HTTP messaging validation */ + + /** + * :enum:`NGHTTP3_QPACK_TOKEN_HOST` is a token for ``host``. + */ + NGHTTP3_QPACK_TOKEN_HOST = 1000, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_CONNECTION` is a token for + * ``connection``. + */ + NGHTTP3_QPACK_TOKEN_CONNECTION, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_KEEP_ALIVE` is a token for + * ``keep-alive``. + */ + NGHTTP3_QPACK_TOKEN_KEEP_ALIVE, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_PROXY_CONNECTION` is a token for + * ``proxy-connection``. + */ + NGHTTP3_QPACK_TOKEN_PROXY_CONNECTION, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_TRANSFER_ENCODING` is a token for + * ``transfer-encoding``. + */ + NGHTTP3_QPACK_TOKEN_TRANSFER_ENCODING, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_UPGRADE` is a token for ``upgrade``. + */ + NGHTTP3_QPACK_TOKEN_UPGRADE, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_TE` is a token for ``te``. + */ + NGHTTP3_QPACK_TOKEN_TE, + /** + * :enum:`NGHTTP3_QPACK_TOKEN__PROTOCOL` is a token for + * ``:protocol``. + */ + NGHTTP3_QPACK_TOKEN__PROTOCOL, + /** + * :enum:`NGHTTP3_QPACK_TOKEN_PRIORITY` is a token for ``priority``. + */ + NGHTTP3_QPACK_TOKEN_PRIORITY +} nghttp3_qpack_token; + +/** + * @struct + * + * :type:`nghttp3_qpack_nv` represents HTTP field name/value pair just + * like :type:`nghttp3_nv`. It is an extended version of + * :type:`nghttp3_nv`, and has reference counted buffers and tokens. + */ +typedef struct nghttp3_qpack_nv { + /** + * :member:`name` is the buffer containing HTTP field name. + * NULL-termination is guaranteed. + */ + nghttp3_rcbuf *name; + /** + * :member:`value` is the buffer containing HTTP field value. + * NULL-termination is guaranteed. + */ + nghttp3_rcbuf *value; + /** + * :member:`token` is :type:`nghttp3_qpack_token` value of + * :member:`name`. It could be -1 if we have no token for that HTTP + * field name. + */ + int32_t token; + /** + * :member:`flags` is a bitwise OR of one or more of + * :macro:`NGHTTP3_NV_FLAG_* `. + */ + uint8_t flags; +} nghttp3_qpack_nv; + +/** + * @struct + * + * :type:`nghttp3_qpack_encoder` is QPACK encoder. The details of + * this structure are intentionally hidden from the public API. + */ +typedef struct nghttp3_qpack_encoder nghttp3_qpack_encoder; + +/** + * @function + * + * `nghttp3_qpack_encoder_new` initializes QPACK encoder. |pencoder| + * must be non-NULL pointer. |hard_max_dtable_capacity| is the upper + * bound of the dynamic table capacity. |mem| is a memory allocator. + * This function allocates memory for :type:`nghttp3_qpack_encoder` + * itself, and assigns its pointer to |*pencoder| if it succeeds. + * + * The maximum dynamic table capacity is still 0. In order to change + * the maximum dynamic table capacity, call + * `nghttp3_qpack_encoder_set_max_dtable_capacity`. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_qpack_encoder_new(nghttp3_qpack_encoder **pencoder, + size_t hard_max_dtable_capacity, + const nghttp3_mem *mem); + +/** + * @function + * + * `nghttp3_qpack_encoder_del` frees memory allocated for |encoder|. + * This function also frees memory pointed by |encoder| itself. This + * function does nothing if |encoder| is NULL. + */ +NGHTTP3_EXTERN void nghttp3_qpack_encoder_del(nghttp3_qpack_encoder *encoder); + +/** + * @function + * + * `nghttp3_qpack_encoder_encode` encodes the list of HTTP fields + * |nva|. |nvlen| is the length of |nva|. |stream_id| is the + * identifier of the stream which these HTTP fields belong to. This + * function writes field section prefix, encoded HTTP field section, + * and encoder stream to |pbuf|, |rbuf|, and |ebuf| respectively. + * Each :member:`nghttp3_buf.last` will be adjusted when data is + * written. An application should write |pbuf| and |rbuf| to the + * request stream in this order. + * + * The buffer pointed by |pbuf|, |rbuf|, and |ebuf| can be empty + * buffer. It is fine to pass a buffer initialized by + * `nghttp3_buf_init(buf) `. This function + * allocates memory for these buffers as necessary. In particular, it + * frees and expands buffer if the current capacity of buffer is not + * enough. If :member:`nghttp3_buf.begin` of any buffer is not NULL, + * it must be allocated by the same memory allocator passed to + * `nghttp3_qpack_encoder_new`. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory + * :macro:`NGHTTP3_ERR_QPACK_FATAL` + * |encoder| is in unrecoverable error state, and cannot be used + * anymore. + */ +NGHTTP3_EXTERN int nghttp3_qpack_encoder_encode( + nghttp3_qpack_encoder *encoder, nghttp3_buf *pbuf, nghttp3_buf *rbuf, + nghttp3_buf *ebuf, int64_t stream_id, const nghttp3_nv *nva, size_t nvlen); + +/** + * @function + * + * `nghttp3_qpack_encoder_read_decoder` reads decoder stream. The + * buffer pointed by |src| of length |srclen| contains decoder stream. + * + * This function returns the number of bytes read, or one of the + * following negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory + * :macro:`NGHTTP3_ERR_QPACK_FATAL` + * |encoder| is in unrecoverable error state, and cannot be used + * anymore. + * :macro:`NGHTTP3_ERR_QPACK_DECODER_STREAM` + * |encoder| is unable to process input because it is malformed. + */ +NGHTTP3_EXTERN nghttp3_ssize nghttp3_qpack_encoder_read_decoder( + nghttp3_qpack_encoder *encoder, const uint8_t *src, size_t srclen); + +/** + * @function + * + * `nghttp3_qpack_encoder_set_max_dtable_capacity` sets max dynamic + * table capacity to |max_dtable_capacity|. If |max_dtable_capacity| + * is larger than ``hard_max_dtable_capacity`` parameter of + * `nghttp3_qpack_encoder_new`, it is truncated to the latter. + */ +NGHTTP3_EXTERN void +nghttp3_qpack_encoder_set_max_dtable_capacity(nghttp3_qpack_encoder *encoder, + size_t max_dtable_capacity); + +/** + * @function + * + * `nghttp3_qpack_encoder_set_max_blocked_streams` sets the number of + * streams which can be blocked to |max_blocked_streams|. + */ +NGHTTP3_EXTERN void +nghttp3_qpack_encoder_set_max_blocked_streams(nghttp3_qpack_encoder *encoder, + size_t max_blocked_streams); + +/** + * @function + * + * `nghttp3_qpack_encoder_ack_everything` tells |encoder| that all + * encoded HTTP field sections are acknowledged. This function is + * provided for debugging purpose only. In HTTP/3, |encoder| knows + * this by reading decoder stream with + * `nghttp3_qpack_encoder_read_decoder`. + */ +NGHTTP3_EXTERN void +nghttp3_qpack_encoder_ack_everything(nghttp3_qpack_encoder *encoder); + +/** + * @function + * + * `nghttp3_qpack_encoder_get_num_blocked_streams` returns the number + * of streams which are potentially blocked at decoder side. + */ +NGHTTP3_EXTERN size_t +nghttp3_qpack_encoder_get_num_blocked_streams(nghttp3_qpack_encoder *encoder); + +/** + * @struct + * + * :type:`nghttp3_qpack_stream_context` is a decoder context for an + * individual stream. Its state is per HTTP field section. In order + * to reuse this object for another HTTP field section, call + * `nghttp3_qpack_stream_context_reset`. The details of this + * structure are intentionally hidden from the public API. + */ +typedef struct nghttp3_qpack_stream_context nghttp3_qpack_stream_context; + +/** + * @function + * + * `nghttp3_qpack_stream_context_new` initializes stream context. + * |psctx| must be non-NULL pointer. |stream_id| is stream ID. |mem| + * is a memory allocator. This function allocates memory for + * :type:`nghttp3_qpack_stream_context` itself, and assigns its + * pointer to |*psctx| if it succeeds. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int +nghttp3_qpack_stream_context_new(nghttp3_qpack_stream_context **psctx, + int64_t stream_id, const nghttp3_mem *mem); + +/** + * @function + * + * `nghttp3_qpack_stream_context_del` frees memory allocated for + * |sctx|. This function frees memory pointed by |sctx| itself. This + * function does nothing if |sctx| is NULL. + */ +NGHTTP3_EXTERN void +nghttp3_qpack_stream_context_del(nghttp3_qpack_stream_context *sctx); + +/** + * @function + * + * `nghttp3_qpack_stream_context_get_ricnt` returns required insert + * count. + */ +NGHTTP3_EXTERN uint64_t +nghttp3_qpack_stream_context_get_ricnt(nghttp3_qpack_stream_context *sctx); + +/** + * @function + * + * `nghttp3_qpack_stream_context_reset` resets the state of |sctx|. + * Then it can be reused for decoding an another HTTP field section in + * the same stream. + */ +NGHTTP3_EXTERN +void nghttp3_qpack_stream_context_reset(nghttp3_qpack_stream_context *sctx); + +/** + * @struct + * + * :type:`nghttp3_qpack_decoder` is QPACK decoder. The details of + * this structure are intentionally hidden from the public API. + */ +typedef struct nghttp3_qpack_decoder nghttp3_qpack_decoder; + +/** + * @function + * + * `nghttp3_qpack_decoder_new` initializes QPACK decoder. |pdecoder| + * must be non-NULL pointer. |hard_max_dtable_capacity| is the upper + * bound of the dynamic table capacity. |max_blocked_streams| is the + * maximum number of streams which can be blocked. |mem| is a memory + * allocator. This function allocates memory for + * :type:`nghttp3_qpack_decoder` itself, and assigns its pointer to + * |*pdecoder| if it succeeds. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_qpack_decoder_new(nghttp3_qpack_decoder **pdecoder, + size_t hard_max_dtable_capacity, + size_t max_blocked_streams, + const nghttp3_mem *mem); + +/** + * @function + * + * `nghttp3_qpack_decoder_del` frees memory allocated for |decoder|. + * This function frees memory pointed by |decoder| itself. This + * function does nothing if |decoder| is NULL. + */ +NGHTTP3_EXTERN void nghttp3_qpack_decoder_del(nghttp3_qpack_decoder *decoder); + +/** + * @function + * + * `nghttp3_qpack_decoder_read_encoder` reads encoder stream. The + * buffer pointed by |src| of length |srclen| contains encoder stream. + * + * This function returns the number of bytes read, or one of the + * following negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + * :macro:`NGHTTP3_ERR_QPACK_FATAL` + * |decoder| is in unrecoverable error state, and cannot be used + * anymore. + * :macro:`NGHTTP3_ERR_QPACK_ENCODER_STREAM` + * Could not interpret encoder stream instruction. + */ +NGHTTP3_EXTERN nghttp3_ssize nghttp3_qpack_decoder_read_encoder( + nghttp3_qpack_decoder *decoder, const uint8_t *src, size_t srclen); + +/** + * @function + * + * `nghttp3_qpack_decoder_get_icnt` returns insert count. + */ +NGHTTP3_EXTERN uint64_t +nghttp3_qpack_decoder_get_icnt(const nghttp3_qpack_decoder *decoder); + +/** + * @macrosection + * + * Flags for QPACK decoder + */ + +/** + * @macro + * + * :macro:`NGHTTP3_QPACK_DECODE_FLAG_NONE` indicates that no flag set. + */ +#define NGHTTP3_QPACK_DECODE_FLAG_NONE 0x00u + +/** + * @macro + * + * :macro:`NGHTTP3_QPACK_DECODE_FLAG_EMIT` indicates that an HTTP + * field is successfully decoded. + */ +#define NGHTTP3_QPACK_DECODE_FLAG_EMIT 0x01u + +/** + * @macro + * + * :macro:`NGHTTP3_QPACK_DECODE_FLAG_FINAL` indicates that an entire + * HTTP field section has been decoded. + */ +#define NGHTTP3_QPACK_DECODE_FLAG_FINAL 0x02u + +/** + * @macro + * + * :macro:`NGHTTP3_QPACK_DECODE_FLAG_BLOCKED` indicates that decoding + * has been blocked. + */ +#define NGHTTP3_QPACK_DECODE_FLAG_BLOCKED 0x04u + +/** + * @function + * + * `nghttp3_qpack_decoder_read_request` reads request stream. The + * request stream is given as the buffer pointed by |src| of length + * |srclen|. |sctx| is the stream context, and it must be created by + * `nghttp3_qpack_stream_context_new`. |*pflags| must be non-NULL + * pointer. |nv| must be non-NULL pointer. + * + * If this function succeeds, it assigns flags to |*pflags|. If + * |*pflags| has :macro:`NGHTTP3_QPACK_DECODE_FLAG_EMIT` set, a + * decoded HTTP field is assigned to |nv|. If |*pflags| has + * :macro:`NGHTTP3_QPACK_DECODE_FLAG_FINAL` set, an entire HTTP field + * section has been successfully decoded. If |*pflags| has + * :macro:`NGHTTP3_QPACK_DECODE_FLAG_BLOCKED` set, decoding is blocked + * due to required insert count. + * + * When an HTTP field is decoded, an application receives it in |nv|. + * :member:`nv->name ` and :member:`nv->value + * ` are reference counted buffer, and their + * reference counts are already incremented for application use. + * Therefore, when application finishes processing |nv|, it must call + * `nghttp3_rcbuf_decref(nv->name) ` and + * `nghttp3_rcbuf_decref(nv->value) `, or memory + * leak might occur. These :type:`nghttp3_rcbuf` objects hold the + * pointer to :type:`nghttp3_mem` that is passed to + * `nghttp3_qpack_decoder_new` (or either `nghttp3_conn_client_new` or + * `nghttp3_conn_server_new` if it is used indirectly). As long as + * these objects are alive, the pointed :type:`nghttp3_mem` object + * must be available. Otherwise, `nghttp3_rcbuf_decref` will cause + * undefined behavior. + * + * This function returns the number of bytes read, or one of the + * following negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + * :macro:`NGHTTP3_ERR_QPACK_FATAL` + * |decoder| is in unrecoverable error state, and cannot be used + * anymore. + * :macro:`NGHTTP3_ERR_QPACK_DECOMPRESSION_FAILED` + * Could not interpret field line representations. + * :macro:`NGHTTP3_ERR_QPACK_HEADER_TOO_LARGE` + * HTTP field is too large. + */ +NGHTTP3_EXTERN nghttp3_ssize nghttp3_qpack_decoder_read_request( + nghttp3_qpack_decoder *decoder, nghttp3_qpack_stream_context *sctx, + nghttp3_qpack_nv *nv, uint8_t *pflags, const uint8_t *src, size_t srclen, + int fin); + +/** + * @function + * + * `nghttp3_qpack_decoder_write_decoder` writes decoder stream into + * |dbuf|. + * + * The caller must ensure that `nghttp3_buf_left(dbuf) + * ` >= + * `nghttp3_qpack_decoder_get_decoder_streamlen(decoder) + * `. + */ +NGHTTP3_EXTERN void +nghttp3_qpack_decoder_write_decoder(nghttp3_qpack_decoder *decoder, + nghttp3_buf *dbuf); + +/** + * @function + * + * `nghttp3_qpack_decoder_get_decoder_streamlen` returns the length of + * decoder stream that is currently pending. + */ +NGHTTP3_EXTERN size_t +nghttp3_qpack_decoder_get_decoder_streamlen(nghttp3_qpack_decoder *decoder); + +/** + * @function + * + * `nghttp3_qpack_decoder_cancel_stream` cancels HTTP field section + * decoding for stream denoted by |stream_id|. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + * :macro:`NGHTTP3_ERR_QPACK_FATAL` + * Decoder stream overflow. + */ +NGHTTP3_EXTERN int +nghttp3_qpack_decoder_cancel_stream(nghttp3_qpack_decoder *decoder, + int64_t stream_id); + +/** + * @function + * + * `nghttp3_qpack_decoder_set_max_dtable_capacity` sets + * |max_dtable_capacity| as maximum dynamic table size. + * |max_dtable_capacity| must be equal to, or smaller than + * ``hard_max_dtable_capacity`` parameter of + * `nghttp3_qpack_decoder_new`. Normally, the maximum capacity is + * communicated in encoder stream. This function is provided for + * debugging and testing purpose. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_INVALID_ARGUMENT` + * |max_dtable_capacity| exceeds the upper bound of the dynamic + * table capacity. + */ +NGHTTP3_EXTERN int +nghttp3_qpack_decoder_set_max_dtable_capacity(nghttp3_qpack_decoder *decoder, + size_t max_dtable_capacity); + +/** + * @function + * + * `nghttp3_qpack_decoder_set_max_concurrent_streams` tells |decoder| + * the maximum number of concurrent streams that a remote endpoint can + * open, including both bidirectional and unidirectional streams which + * potentially receive QPACK encoded HEADERS frame. This value is + * used as a hint to limit the length of decoder stream. + */ +NGHTTP3_EXTERN void +nghttp3_qpack_decoder_set_max_concurrent_streams(nghttp3_qpack_decoder *decoder, + size_t max_concurrent_streams); + +/** + * @function + * + * `nghttp3_strerror` returns textual representation of |liberr|. + */ +NGHTTP3_EXTERN const char *nghttp3_strerror(int liberr); + +/** + * @function + * + * `nghttp3_err_infer_quic_app_error_code` returns a QUIC application + * error code which corresponds to |liberr|. + */ +NGHTTP3_EXTERN uint64_t nghttp3_err_infer_quic_app_error_code(int liberr); + +/** + * @functypedef + * + * :type:`nghttp3_debug_vprintf_callback` is a callback function + * invoked when the library outputs debug logging. The function is + * called with arguments suitable for :manpage:`vfprintf(3)`. + * + * The debug output is only enabled if the library is built with + * :macro:`DEBUGBUILD` macro defined. + */ +typedef void (*nghttp3_debug_vprintf_callback)(const char *format, + va_list args); + +/** + * @function + * + * `nghttp3_set_debug_vprintf_callback` sets a debug output callback + * called by the library when built with :macro:`DEBUGBUILD` macro + * defined. If a callback function is not set by this function, debug + * log is written into standard error output. + * + * For builds without :macro:`DEBUGBUILD` macro defined, this function + * is noop. + * + * Note that building with :macro:`DEBUGBUILD` may cause significant + * performance penalty to libnghttp3 because of extra processing. It + * should be used for debugging purpose only. + * + * .. Warning:: + * + * Building with :macro:`DEBUGBUILD` may cause significant + * performance penalty to libnghttp3 because of extra processing. + * It should be used for debugging purpose only. We write this two + * times because this is important. + */ +NGHTTP3_EXTERN void nghttp3_set_debug_vprintf_callback( + nghttp3_debug_vprintf_callback debug_vprintf_callback); + +/** + * @macrosection + * + * Shutdown related constants + */ + +/** + * @macro + * + * :macro:`NGHTTP3_SHUTDOWN_NOTICE_STREAM_ID` specifies stream ID sent + * by a server when it initiates graceful shutdown of the connection + * via `nghttp3_conn_submit_shutdown_notice`. + */ +#define NGHTTP3_SHUTDOWN_NOTICE_STREAM_ID ((1ull << 62) - 4) + +/** + * @macro + * + * :macro:`NGHTTP3_SHUTDOWN_NOTICE_PUSH_ID` specifies push ID sent by + * a client when it initiates graceful shutdown of the connection via + * `nghttp3_conn_submit_shutdown_notice`. Note that libnghttp3 does + * not implement HTTP/3 Server Push. + */ +#define NGHTTP3_SHUTDOWN_NOTICE_PUSH_ID ((1ull << 62) - 1) + +/** + * @struct + * + * :type:`nghttp3_conn` represents a single HTTP/3 connection. The + * details of this structure are intentionally hidden from the public + * API. + */ +typedef struct nghttp3_conn nghttp3_conn; + +#define NGHTTP3_SETTINGS_V1 1 +#define NGHTTP3_SETTINGS_VERSION NGHTTP3_SETTINGS_V1 + +/** + * @struct + * + * :type:`nghttp3_settings` defines HTTP/3 settings. + */ +typedef struct nghttp3_settings { + /** + * :member:`max_field_section_size` specifies the maximum header + * section (block) size. + */ + uint64_t max_field_section_size; + /** + * :member:`qpack_max_dtable_capacity` is the maximum size of QPACK + * dynamic table. + */ + size_t qpack_max_dtable_capacity; + /** + * :member:`qpack_encoder_max_dtable_capacity` is the upper bound of + * QPACK dynamic table capacity that the QPACK encoder is willing to + * use. The effective maximum dynamic table capacity is the minimum + * of this field and the value of the received + * SETTINGS_QPACK_MAX_TABLE_CAPACITY. If this field is set to 0, + * the encoder does not use the dynamic table. + * + * When :type:`nghttp3_settings` is passed to + * :member:`nghttp3_callbacks.recv_settings` callback, this field + * should be ignored. + */ + size_t qpack_encoder_max_dtable_capacity; + /** + * :member:`qpack_blocked_streams` is the maximum number of streams + * which can be blocked while they are being decoded. + */ + size_t qpack_blocked_streams; + /** + * :member:`enable_connect_protocol`, if set to nonzero, enables + * Extended CONNECT Method (see :rfc:`9220`). Client ignores this + * field. + */ + uint8_t enable_connect_protocol; + /** + * :member:`h3_datagram`, if set to nonzero, enables HTTP/3 + * Datagrams (see :rfc:`9297`). + */ + uint8_t h3_datagram; +} nghttp3_settings; + +/** + * @functypedef + * + * :type:`nghttp3_acked_stream_data` is a callback function which is + * invoked when data sent on stream denoted by |stream_id| supplied + * from application is acknowledged by remote endpoint. The number of + * bytes acknowledged is given in |datalen|. + * + * The implementation of this callback must return 0 if it succeeds. + * Returning :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` will return to the + * caller immediately. Any values other than 0 is treated as + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE`. + */ +typedef int (*nghttp3_acked_stream_data)(nghttp3_conn *conn, int64_t stream_id, + uint64_t datalen, void *conn_user_data, + void *stream_user_data); + +/** + * @functypedef + * + * :type:`nghttp3_conn_stream_close` is a callback function which is + * invoked when a stream identified by |stream_id| is closed. QUIC + * application error code |app_error_code| indicates the reason of + * this closure. + * + * The implementation of this callback must return 0 if it succeeds. + * Returning :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` will return to the + * caller immediately. Any values other than 0 is treated as + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE`. + */ +typedef int (*nghttp3_stream_close)(nghttp3_conn *conn, int64_t stream_id, + uint64_t app_error_code, + void *conn_user_data, + void *stream_user_data); + +/** + * @functypedef + * + * :type:`nghttp3_recv_data` is a callback function which is invoked + * when a part of request or response body on stream identified by + * |stream_id| is received. |data| points to the received data, and + * its length is |datalen|. + * + * The application is responsible for increasing flow control credit + * (say, increasing by |datalen| bytes). + * + * The implementation of this callback must return 0 if it succeeds. + * Returning :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` will return to the + * caller immediately. Any values other than 0 is treated as + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE`. + */ +typedef int (*nghttp3_recv_data)(nghttp3_conn *conn, int64_t stream_id, + const uint8_t *data, size_t datalen, + void *conn_user_data, void *stream_user_data); + +/** + * @functypedef + * + * :type:`nghttp3_deferred_consume` is a callback function which is + * invoked when the library consumed |consumed| bytes for a stream + * identified by |stream_id|. This callback is used to notify the + * consumed bytes for stream blocked due to synchronization between + * streams. The application is responsible for increasing flow + * control credit by |consumed| bytes. + * + * The implementation of this callback must return 0 if it succeeds. + * Returning :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` will return to the + * caller immediately. Any values other than 0 is treated as + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE`. + */ +typedef int (*nghttp3_deferred_consume)(nghttp3_conn *conn, int64_t stream_id, + size_t consumed, void *conn_user_data, + void *stream_user_data); + +/** + * @functypedef + * + * :type:`nghttp3_begin_headers` is a callback function which is + * invoked when an incoming HTTP field section is started on a stream + * denoted by |stream_id|. Each HTTP field is passed to application + * by :type:`nghttp3_recv_header` callback. And then + * :type:`nghttp3_end_headers` is called when a whole HTTP field + * section is processed. + * + * The implementation of this callback must return 0 if it succeeds. + * Returning :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` will return to the + * caller immediately. Any values other than 0 is treated as + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE`. + */ +typedef int (*nghttp3_begin_headers)(nghttp3_conn *conn, int64_t stream_id, + void *conn_user_data, + void *stream_user_data); + +/** + * @functypedef + * + * :type:`nghttp3_recv_header` is a callback function which is invoked + * when an HTTP field is received on a stream denoted by |stream_id|. + * |name| contains a field name, and |value| contains a field value. + * |token| is one of token defined in :type:`nghttp3_qpack_token` or + * -1 if no token is defined for |name|. |flags| is bitwise OR of + * zero or more of :macro:`NGHTTP3_NV_FLAG_* `. + * + * The buffers for |name| and |value| are reference counted. If + * application needs to keep them, increment the reference count with + * `nghttp3_rcbuf_incref`. When they are no longer used, call + * `nghttp3_rcbuf_decref`. + * + * The implementation of this callback must return 0 if it succeeds. + * Returning :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` will return to the + * caller immediately. Any values other than 0 is treated as + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE`. + */ +typedef int (*nghttp3_recv_header)(nghttp3_conn *conn, int64_t stream_id, + int32_t token, nghttp3_rcbuf *name, + nghttp3_rcbuf *value, uint8_t flags, + void *conn_user_data, + void *stream_user_data); + +/** + * @functypedef + * + * :type:`nghttp3_end_headers` is a callback function which is invoked + * when an incoming HTTP field section has ended. + * + * If the stream ends with this HTTP field section, |fin| is set to + * nonzero. + * + * The implementation of this callback must return 0 if it succeeds. + * Returning :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` will return to the + * caller immediately. Any values other than 0 is treated as + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE`. + */ +typedef int (*nghttp3_end_headers)(nghttp3_conn *conn, int64_t stream_id, + int fin, void *conn_user_data, + void *stream_user_data); + +/** + * @functypedef + * + * :type:`nghttp3_end_stream` is a callback function which is invoked + * when the receiving side of stream is closed. For server, this + * callback function is invoked when HTTP request is received + * completely. For client, this callback function is invoked when + * HTTP response is received completely. + * + * The implementation of this callback must return 0 if it succeeds. + * Returning :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` will return to the + * caller immediately. Any values other than 0 is treated as + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE`. + */ +typedef int (*nghttp3_end_stream)(nghttp3_conn *conn, int64_t stream_id, + void *conn_user_data, void *stream_user_data); + +/** + * @functypedef + * + * :type:`nghttp3_stop_sending` is a callback function which is + * invoked when the library asks application to send STOP_SENDING to + * the stream identified by |stream_id|. QUIC application error code + * |app_error_code| indicates the reason for this action. + * + * The implementation of this callback must return 0 if it succeeds. + * Returning :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` will return to the + * caller immediately. Any values other than 0 is treated as + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE`. + */ +typedef int (*nghttp3_stop_sending)(nghttp3_conn *conn, int64_t stream_id, + uint64_t app_error_code, + void *conn_user_data, + void *stream_user_data); + +/** + * @functypedef + * + * :type:`nghttp3_reset_stream` is a callback function which is + * invoked when the library asks application to reset stream + * identified by |stream_id|. QUIC application error code + * |app_error_code| indicates the reason for this action. + * + * The implementation of this callback must return 0 if it succeeds. + * Returning :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` will return to the + * caller immediately. Any values other than 0 is treated as + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE`. + */ +typedef int (*nghttp3_reset_stream)(nghttp3_conn *conn, int64_t stream_id, + uint64_t app_error_code, + void *conn_user_data, + void *stream_user_data); + +/** + * @functypedef + * + * :type:`nghttp3_shutdown` is a callback function which is invoked + * when a shutdown is initiated by the remote endpoint. For client, + * |id| contains a stream ID of a client initiated stream, for server, + * it contains a push ID. All client streams with stream ID, or pushes + * with push ID equal to, or larger than |ID| are guaranteed to not be + * processed by the remote endpoint. Note that libnghttp3 does not + * implement Server Push. + * + * Parameter |id| for client can contain a special value + * :macro:`NGHTTP3_SHUTDOWN_NOTICE_STREAM_ID`, and for server it can + * contain special value + * :macro:`NGHTTP3_SHUTDOWN_NOTICE_PUSH_ID`. These values signal + * request for graceful shutdown of the connection, triggered by + * remote endpoint's invocation of + * `nghttp3_conn_submit_shutdown_notice`. + * + * It is possible that this callback is invoked multiple times on a + * single connection, however the |id| can only stay the same or + * decrease, never increase. + * + * The implementation of this callback must return 0 if it succeeds. + * Returning :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` will return to the + * caller immediately. Any values other than 0 is treated as + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE`. + */ +typedef int (*nghttp3_shutdown)(nghttp3_conn *conn, int64_t id, + void *conn_user_data); + +/** + * @functypedef + * + * :type:`nghttp3_recv_settings` is a callback function which is + * invoked when SETTINGS frame is received. |settings| is a received + * remote HTTP/3 settings. + * + * The implementation of this callback must return 0 if it succeeds. + * Returning :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` will return to the + * caller immediately. Any values other than 0 is treated as + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE`. + */ +typedef int (*nghttp3_recv_settings)(nghttp3_conn *conn, + const nghttp3_settings *settings, + void *conn_user_data); + +#define NGHTTP3_CALLBACKS_V1 1 +#define NGHTTP3_CALLBACKS_VERSION NGHTTP3_CALLBACKS_V1 + +/** + * @struct + * + * :type:`nghttp3_callbacks` holds a set of callback functions. + */ +typedef struct nghttp3_callbacks { + /** + * :member:`acked_stream_data` is a callback function which is + * invoked when data sent on a particular stream have been + * acknowledged by a remote endpoint. + */ + nghttp3_acked_stream_data acked_stream_data; + /** + * :member:`stream_close` is a callback function which is invoked + * when a particular stream has closed. + */ + nghttp3_stream_close stream_close; + /** + * :member:`recv_data` is a callback function which is invoked when + * stream data is received. + */ + nghttp3_recv_data recv_data; + /** + * :member:`deferred_consume` is a callback function which is + * invoked when the library consumed data for a particular stream + * which had been blocked for synchronization between streams. + */ + nghttp3_deferred_consume deferred_consume; + /** + * :member:`begin_headers` is a callback function which is invoked + * when an HTTP header field section has started on a particular + * stream. + */ + nghttp3_begin_headers begin_headers; + /** + * :member:`recv_header` is a callback function which is invoked + * when a single HTTP header field is received on a particular + * stream. + */ + nghttp3_recv_header recv_header; + /** + * :member:`end_headers` is a callback function which is invoked + * when an HTTP header field section has ended on a particular + * stream. + */ + nghttp3_end_headers end_headers; + /** + * :member:`begin_trailers` is a callback function which is invoked + * when an HTTP trailer field section has started on a particular + * stream. + */ + nghttp3_begin_headers begin_trailers; + /** + * :member:`recv_trailer` is a callback function which is invoked + * when a single HTTP trailer field is received on a particular + * stream. + */ + nghttp3_recv_header recv_trailer; + /** + * :member:`end_trailers` is a callback function which is invoked + * when an HTTP trailer field section has ended on a particular + * stream. + */ + nghttp3_end_headers end_trailers; + /** + * :member:`stop_sending` is a callback function which is invoked + * when the library asks application to send STOP_SENDING to a + * particular stream. + */ + nghttp3_stop_sending stop_sending; + /** + * :member:`end_stream` is a callback function which is invoked when + * a receiving side of stream has been closed. + */ + nghttp3_end_stream end_stream; + /** + * :member:`reset_stream` is a callback function which is invoked + * when the library asks application to reset stream (by sending + * RESET_STREAM). + */ + nghttp3_reset_stream reset_stream; + /** + * :member:`shutdown` is a callback function which is invoked when + * the remote endpoint has signalled initiation of connection + * shutdown. + */ + nghttp3_shutdown shutdown; + /** + * :member:`recv_settings` is a callback function which is invoked + * when SETTINGS frame is received. + */ + nghttp3_recv_settings recv_settings; +} nghttp3_callbacks; + +/** + * @function + * + * `nghttp3_settings_default` fills |settings| with the default + * values. + * + * - :member:`max_field_section_size + * ` = :expr:`((1ull << 62) - 1)` + * - :member:`qpack_max_dtable_capacity + * ` = 0 + * - :member:`qpack_encoder_max_dtable_capacity + * ` = 4096 + * - :member:`qpack_blocked_streams + * ` = 0 + * - :member:`enable_connect_protocol + * ` = 0 + */ +NGHTTP3_EXTERN void +nghttp3_settings_default_versioned(int settings_version, + nghttp3_settings *settings); + +/** + * @function + * + * `nghttp3_conn_client_new` creates :type:`nghttp3_conn`, and + * initializes it for client use. The pointer to the object is stored + * in |*pconn|. If |mem| is ``NULL``, the memory allocator returned + * by `nghttp3_mem_default` is used. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int +nghttp3_conn_client_new_versioned(nghttp3_conn **pconn, int callbacks_version, + const nghttp3_callbacks *callbacks, + int settings_version, + const nghttp3_settings *settings, + const nghttp3_mem *mem, void *conn_user_data); + +/** + * @function + * + * `nghttp3_conn_server_new` creates :type:`nghttp3_conn`, and + * initializes it for server use. The pointer to the object is stored + * in |*pconn|. If |mem| is ``NULL``, the memory allocator returned + * by `nghttp3_mem_default` is used. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int +nghttp3_conn_server_new_versioned(nghttp3_conn **pconn, int callbacks_version, + const nghttp3_callbacks *callbacks, + int settings_version, + const nghttp3_settings *settings, + const nghttp3_mem *mem, void *conn_user_data); + +/** + * @function + * + * `nghttp3_conn_del` frees resources allocated for |conn|. This + * function also frees memory pointed by |conn| itself. This function + * does nothing if |conn| is NULL. + */ +NGHTTP3_EXTERN void nghttp3_conn_del(nghttp3_conn *conn); + +/** + * @function + * + * `nghttp3_conn_bind_control_stream` binds stream denoted by + * |stream_id| to outgoing unidirectional control stream. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_INVALID_STATE` + * Control stream has already corresponding stream ID. + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_conn_bind_control_stream(nghttp3_conn *conn, + int64_t stream_id); + +/** + * @function + * + * `nghttp3_conn_bind_qpack_streams` binds stream denoted by + * |qenc_stream_id| to outgoing QPACK encoder stream, and stream + * denoted by |qdec_stream_id| to outgoing QPACK encoder stream. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_INVALID_STATE` + * QPACK encoder/decoder stream have already corresponding stream + * IDs. + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_conn_bind_qpack_streams(nghttp3_conn *conn, + int64_t qenc_stream_id, + int64_t qdec_stream_id); + +/** + * @function + * + * `nghttp3_conn_read_stream` reads data |src| of length |srclen| on + * stream identified by |stream_id|. It returns the number of bytes + * consumed. The "consumed" means that application can increase flow + * control credit (both stream and connection) of underlying QUIC + * connection by that amount. It does not include the amount of data + * carried by DATA frame which contains application data (excluding + * any control or QPACK unidirectional streams). See + * :type:`nghttp3_recv_data` to handle those bytes. If |fin| is + * nonzero, this is the last data from remote endpoint in this stream. + * + * This function returns the number of bytes consumed, or one of the + * following negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` + * User callback failed. + * + * It may return the other error codes. The negative error code means + * that |conn| encountered a connection error, and the connection must + * be closed. Calling nghttp3 API other than `nghttp3_conn_del` + * causes undefined behavior. + */ +NGHTTP3_EXTERN nghttp3_ssize nghttp3_conn_read_stream(nghttp3_conn *conn, + int64_t stream_id, + const uint8_t *src, + size_t srclen, int fin); + +/** + * @function + * + * `nghttp3_conn_writev_stream` stores stream data to send to |vec| of + * length |veccnt|, and returns the number of nghttp3_vec object in + * which it stored data. It stores stream ID to |*pstream_id|. An + * application has to call `nghttp3_conn_add_write_offset` to inform + * |conn| of the actual number of bytes that underlying QUIC stack + * accepted. |*pfin| will be nonzero if this is the last data to + * send. If there is no stream to write data or send fin, this + * function returns 0, and -1 is assigned to |*pstream_id|. This + * function may return 0, and |*pstream_id| is not -1, and |*pfin| is + * nonzero. It means 0 length data to |*pstream_id|, and it is the + * last data to the stream. They must be passed to QUIC stack, and + * they are accepted, the application has to call + * `nghttp3_conn_add_write_offset` with 0 byte. + * + * This function returns the number of bytes consumed, or one of the + * following negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` + * User callback failed. + * + * It may return the other error codes. The negative error code means + * that |conn| encountered a connection error, and the connection must + * be closed. Calling nghttp3 API other than `nghttp3_conn_del` + * causes undefined behavior. + */ +NGHTTP3_EXTERN nghttp3_ssize nghttp3_conn_writev_stream(nghttp3_conn *conn, + int64_t *pstream_id, + int *pfin, + nghttp3_vec *vec, + size_t veccnt); + +/** + * @function + * + * `nghttp3_conn_add_write_offset` tells |conn| the number of bytes + * |n| for stream denoted by |stream_id| QUIC stack accepted. + * + * If stream has no data to send but just sends fin (closing the write + * side of a stream), the number of bytes sent is 0. It is important + * to call this function even if |n| is 0 in this case. It is safe to + * call this function if |n| is 0. + * + * `nghttp3_conn_writev_stream` must be called before calling this + * function to get data to send, and those data must be fed into QUIC + * stack. + * + * If a stream denoted by |stream_id| is not found, this function + * returns 0. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_conn_add_write_offset(nghttp3_conn *conn, + int64_t stream_id, size_t n); + +/** + * @function + * + * `nghttp3_conn_add_ack_offset` tells |conn| the number of bytes |n| + * for stream denoted by |stream_id| QUIC stack has acknowledged. + * + * If a stream denoted by |stream_id| is not found, this function + * returns 0. + * + * Alternatively, `nghttp3_conn_update_ack_offset` can be used to + * accomplish the same thing. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` + * User callback failed. + */ +NGHTTP3_EXTERN int nghttp3_conn_add_ack_offset(nghttp3_conn *conn, + int64_t stream_id, uint64_t n); + +/** + * @function + * + * `nghttp3_conn_update_ack_offset` tells |conn| that QUIC stack has + * acknowledged the stream data up to |offset| for a stream denoted by + * |stream_id|. + * + * If a stream denoted by |stream_id| is not found, this function + * returns 0. + * + * Alternatively, `nghttp3_conn_add_ack_offset` can be used to + * accomplish the same thing. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_INVALID_ARGUMENT` + * |offset| is less than the number of bytes acknowledged so far. + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` + * User callback failed. + */ +NGHTTP3_EXTERN int nghttp3_conn_update_ack_offset(nghttp3_conn *conn, + int64_t stream_id, + uint64_t offset); + +/** + * @function + * + * `nghttp3_conn_block_stream` tells the library that stream + * identified by |stream_id| is blocked due to QUIC flow control. + */ +NGHTTP3_EXTERN void nghttp3_conn_block_stream(nghttp3_conn *conn, + int64_t stream_id); + +/** + * @function + * + * `nghttp3_conn_unblock_stream` tells the library that stream + * identified by |stream_id| which was blocked by QUIC flow control + * (see `nghttp3_conn_block_stream`) is unblocked. + * + * If a stream denoted by |stream_id| is not found, this function + * returns 0. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_conn_unblock_stream(nghttp3_conn *conn, + int64_t stream_id); + +/** + * @function + * + * `nghttp3_conn_is_stream_writable` returns nonzero if a stream + * identified by |stream_id| is writable. It is not writable if: + * + * - the stream does not exist; or, + * - the stream is closed (e.g., `nghttp3_conn_close_stream` is + * called); or, + * - the stream is QUIC flow control blocked (e.g., + * `nghttp3_conn_block_stream` is called); or, + * - the stream is input data blocked (e.g., + * :macro:`NGHTTP3_ERR_WOULDBLOCK` is returned from + * :type:`nghttp3_read_data_callback`); or, + * - the stream is half-closed local (e.g., + * `nghttp3_conn_shutdown_stream_write` is called). + */ +NGHTTP3_EXTERN int nghttp3_conn_is_stream_writable(nghttp3_conn *conn, + int64_t stream_id); + +/** + * @function + * + * `nghttp3_conn_shutdown_stream_write` tells the library that any + * further write operation to stream identified by |stream_id| is + * prohibited. This works like `nghttp3_conn_block_stream`, but it + * cannot be unblocked by `nghttp3_conn_unblock_stream`. + */ +NGHTTP3_EXTERN void nghttp3_conn_shutdown_stream_write(nghttp3_conn *conn, + int64_t stream_id); + +/** + * @function + * + * `nghttp3_conn_shutdown_stream_read` tells the library that + * read-side of stream denoted by |stream_id| is abruptly closed, and + * any further incoming data and pending stream data should be + * discarded. + * + * If a stream denoted by |stream_id| is not client bidirectional + * stream, this function returns 0. If the stream has already + * shutdown read-side stream, this function returns 0. + * + * This function does not fail if a stream denoted by |stream_id| is + * not found, although it may fail with the other reasons. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + * :macro:`NGHTTP3_ERR_QPACK_FATAL` + * QPACK decoder stream overflow. + */ +NGHTTP3_EXTERN int nghttp3_conn_shutdown_stream_read(nghttp3_conn *conn, + int64_t stream_id); + +/** + * @function + * + * `nghttp3_conn_resume_stream` resumes stream identified by + * |stream_id| which was previously unable to provide data. See + * :type:`nghttp3_read_data_callback`. + * + * If a stream denoted by |stream_id| is not found, this function + * returns 0. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_conn_resume_stream(nghttp3_conn *conn, + int64_t stream_id); + +/** + * @function + * + * `nghttp3_conn_close_stream` tells the library that a stream + * identified by |stream_id| has been closed. QUIC application error + * code |app_error_code| is the reason of the closure. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_STREAM_NOT_FOUND` + * Stream not found. + * :macro:`NGHTTP3_ERR_H3_CLOSED_CRITICAL_STREAM` + * A critical stream is closed. + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE` + * User callback failed + */ +NGHTTP3_EXTERN int nghttp3_conn_close_stream(nghttp3_conn *conn, + int64_t stream_id, + uint64_t app_error_code); + +/** + * @macrosection + * + * Data flags + */ + +/** + * @macro + * + * :macro:`NGHTTP3_DATA_FLAG_NONE` indicates no flag set. + */ +#define NGHTTP3_DATA_FLAG_NONE 0x00u + +/** + * @macro + * + * :macro:`NGHTTP3_DATA_FLAG_EOF` indicates that all request or + * response body has been provided to the library. It also indicates + * that sending side of stream is closed unless + * :macro:`NGHTTP3_DATA_FLAG_NO_END_STREAM` is given at the same time. + */ +#define NGHTTP3_DATA_FLAG_EOF 0x01u + +/** + * @macro + * + * :macro:`NGHTTP3_DATA_FLAG_NO_END_STREAM` indicates that sending + * side of stream is not closed even if :macro:`NGHTTP3_DATA_FLAG_EOF` + * is set. Usually this flag is used to send trailer fields with + * `nghttp3_conn_submit_trailers`. If `nghttp3_conn_submit_trailers` + * has been called, regardless of this flag, the submitted trailer + * fields are sent. + */ +#define NGHTTP3_DATA_FLAG_NO_END_STREAM 0x02u + +/** + * @function + * + * `nghttp3_conn_set_max_client_streams_bidi` tells |conn| the + * cumulative number of bidirectional streams that client can open. + */ +NGHTTP3_EXTERN void +nghttp3_conn_set_max_client_streams_bidi(nghttp3_conn *conn, + uint64_t max_streams); + +/** + * @function + * + * `nghttp3_conn_set_max_concurrent_streams` tells |conn| the maximum + * number of concurrent streams that a remote endpoint can open, + * including both bidirectional and unidirectional streams which + * potentially receive QPACK encoded HEADERS frame. This value is + * used as a hint to limit the internal resource consumption. + */ +NGHTTP3_EXTERN void +nghttp3_conn_set_max_concurrent_streams(nghttp3_conn *conn, + size_t max_concurrent_streams); + +/** + * @functypedef + * + * :type:`nghttp3_read_data_callback` is a callback function invoked + * when the library asks an application to provide stream data for a + * stream denoted by |stream_id|. + * + * The library provides |vec| of length |veccnt| to the application. + * The application should fill data and its length to |vec|. It has + * to return the number of the filled objects. The application must + * retain data until they are safe to free. It is notified by + * :type:`nghttp3_acked_stream_data` callback. + * + * If this is the last data to send (or there is no data to send + * because all data have been sent already), set + * :macro:`NGHTTP3_DATA_FLAG_EOF` to |*pflags|. + * + * If the application is unable to provide data temporarily, return + * :macro:`NGHTTP3_ERR_WOULDBLOCK`. When it is ready to provide data, + * call `nghttp3_conn_resume_stream`. + * + * The callback should return the number of objects in |vec| that the + * application filled if it succeeds, or + * :macro:`NGHTTP3_ERR_CALLBACK_FAILURE`. + * + * TODO Add NGHTTP3_ERR_TEMPORAL_CALLBACK_FAILURE to reset just this + * stream. + */ +typedef nghttp3_ssize (*nghttp3_read_data_callback)( + nghttp3_conn *conn, int64_t stream_id, nghttp3_vec *vec, size_t veccnt, + uint32_t *pflags, void *conn_user_data, void *stream_user_data); + +/** + * @struct + * + * :type:`nghttp3_data_reader` specifies the way how to generate + * request or response body. + */ +typedef struct nghttp3_data_reader { + /** + * :member:`read_data` is a callback function to generate body. + */ + nghttp3_read_data_callback read_data; +} nghttp3_data_reader; + +/** + * @function + * + * `nghttp3_conn_submit_request` submits HTTP request header fields + * and body on the stream identified by |stream_id|. |stream_id| must + * be a client initiated bidirectional stream. Only client can submit + * HTTP request. |nva| of length |nvlen| specifies HTTP request + * header fields. |dr| specifies a request body. If there is no + * request body, specify NULL. If |dr| is NULL, it implies the end of + * stream. |stream_user_data| is an opaque pointer attached to the + * stream. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_CONN_CLOSING` + * Connection is shutting down, and no new stream is allowed. + * :macro:`NGHTTP3_ERR_STREAM_IN_USE` + * Stream has already been opened. + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_conn_submit_request( + nghttp3_conn *conn, int64_t stream_id, const nghttp3_nv *nva, size_t nvlen, + const nghttp3_data_reader *dr, void *stream_user_data); + +/** + * @function + * + * `nghttp3_conn_submit_info` submits HTTP non-final response header + * fields on the stream identified by |stream_id|. |nva| of length + * |nvlen| specifies HTTP response header fields. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_STREAM_NOT_FOUND` + * Stream not found + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_conn_submit_info(nghttp3_conn *conn, + int64_t stream_id, + const nghttp3_nv *nva, + size_t nvlen); + +/** + * @function + * + * `nghttp3_conn_submit_response` submits HTTP response header fields + * and body on the stream identified by |stream_id|. |nva| of length + * |nvlen| specifies HTTP response header fields. |dr| specifies a + * response body. If there is no response body, specify NULL. If + * |dr| is NULL, it implies the end of stream. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_STREAM_NOT_FOUND` + * Stream not found + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_conn_submit_response(nghttp3_conn *conn, + int64_t stream_id, + const nghttp3_nv *nva, + size_t nvlen, + const nghttp3_data_reader *dr); + +/** + * @function + * + * `nghttp3_conn_submit_trailers` submits HTTP trailer fields on the + * stream identified by |stream_id|. |nva| of length |nvlen| + * specifies HTTP trailer fields. Calling this function implies the + * end of stream. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_STREAM_NOT_FOUND` + * Stream not found + * :macro:`NGHTTP3_ERR_INVALID_STATE` + * Application has already submitted fin to stream. + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_conn_submit_trailers(nghttp3_conn *conn, + int64_t stream_id, + const nghttp3_nv *nva, + size_t nvlen); + +/** + * @function + * + * `nghttp3_conn_submit_shutdown_notice` notifies the other endpoint + * to stop creating new stream. After a couple of RTTs later, call + * `nghttp3_conn_shutdown` to start graceful shutdown. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_conn_submit_shutdown_notice(nghttp3_conn *conn); + +/** + * @function + * + * `nghttp3_conn_shutdown` starts graceful shutdown. It should be + * called after `nghttp3_conn_submit_shutdown_notice` and a couple of + * RTTs. After calling this function, the local endpoint starts + * rejecting new incoming streams. The existing streams are processed + * normally. See also `nghttp3_conn_is_drained`. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_conn_shutdown(nghttp3_conn *conn); + +/** + * @function + * + * `nghttp3_conn_set_stream_user_data` sets |stream_user_data| to the + * stream identified by |stream_id|. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_STREAM_NOT_FOUND` + * Stream not found. + */ +NGHTTP3_EXTERN int nghttp3_conn_set_stream_user_data(nghttp3_conn *conn, + int64_t stream_id, + void *stream_user_data); + +/** + * @function + * + * `nghttp3_conn_get_frame_payload_left` returns the number of bytes + * left to read current frame payload for a stream denoted by + * |stream_id|. If no such stream is found, or |stream_id| identifies + * neither client bidirectional stream nor remote control stream, it + * returns 0. + */ +NGHTTP3_EXTERN uint64_t nghttp3_conn_get_frame_payload_left(nghttp3_conn *conn, + int64_t stream_id); + +/** + * @macrosection + * + * HTTP stream priority flags + */ + +/** + * @macro + * + * :macro:`NGHTTP3_DEFAULT_URGENCY` is the default urgency level. + */ +#define NGHTTP3_DEFAULT_URGENCY 3 + +/** + * @macro + * + * :macro:`NGHTTP3_URGENCY_HIGH` is the highest urgency level. + */ +#define NGHTTP3_URGENCY_HIGH 0 + +/** + * @macro + * + * :macro:`NGHTTP3_URGENCY_LOW` is the lowest urgency level. + */ +#define NGHTTP3_URGENCY_LOW 7 + +/** + * @macro + * + * :macro:`NGHTTP3_URGENCY_LEVELS` is the number of urgency levels. + */ +#define NGHTTP3_URGENCY_LEVELS (NGHTTP3_URGENCY_LOW + 1) + +#define NGHTTP3_PRI_V1 1 +#define NGHTTP3_PRI_VERSION NGHTTP3_PRI_V1 + +/** + * @struct + * + * :type:`nghttp3_pri` represents HTTP priority. + */ +typedef struct NGHTTP3_ALIGN(8) nghttp3_pri { + /** + * :member:`urgency` is the urgency of a stream, it must be in + * [:macro:`NGHTTP3_URGENCY_HIGH`, :macro:`NGHTTP3_URGENCY_LOW`], + * inclusive, and 0 is the highest urgency. + */ + uint32_t urgency; + /** + * :member:`inc` indicates that a content can be processed + * incrementally or not. If it is 0, it cannot be processed + * incrementally. If it is 1, it can be processed incrementally. + * Other value is not permitted. + */ + uint8_t inc; +} nghttp3_pri; + +/** + * @function + * + * `nghttp3_conn_get_stream_priority` stores stream priority of a + * stream denoted by |stream_id| into |*dest|. |stream_id| must + * identify client initiated bidirectional stream. Only server can + * use this function. + * + * This function must not be called if |conn| is initialized as + * client. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_INVALID_ARGUMENT` + * |stream_id| is not a client initiated bidirectional stream ID. + * :macro:`NGHTTP3_ERR_STREAM_NOT_FOUND` + * Stream not found. + */ +NGHTTP3_EXTERN int nghttp3_conn_get_stream_priority_versioned( + nghttp3_conn *conn, int pri_version, nghttp3_pri *dest, int64_t stream_id); + +/** + * @function + * + * `nghttp3_conn_set_client_stream_priority` updates priority of a + * stream denoted by |stream_id| with the value pointed by |data| of + * length |datalen|, which should be a serialized :rfc:`9218` priority + * field value. |stream_id| must identify client initiated + * bidirectional stream. + * + * This function must not be called if |conn| is initialized as + * server. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_INVALID_ARGUMENT` + * |stream_id| is not a client initiated bidirectional stream ID. + * :macro:`NGHTTP3_ERR_STREAM_NOT_FOUND` + * Stream not found. + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_conn_set_client_stream_priority(nghttp3_conn *conn, + int64_t stream_id, + const uint8_t *data, + size_t datalen); + +/** + * @function + * + * `nghttp3_conn_set_server_stream_priority` updates priority of a + * stream denoted by |stream_id| with the value pointed by |pri|. + * |stream_id| must identify client initiated bidirectional stream. + * + * This function must not be called if |conn| is initialized as + * client. + * + * This function completely overrides stream priority set by client, + * and any attempts to update priority by client are ignored. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_INVALID_ARGUMENT` + * |stream_id| is not a client initiated bidirectional stream ID. + * :macro:`NGHTTP3_ERR_STREAM_NOT_FOUND` + * Stream not found. + * :macro:`NGHTTP3_ERR_NOMEM` + * Out of memory. + */ +NGHTTP3_EXTERN int nghttp3_conn_set_server_stream_priority_versioned( + nghttp3_conn *conn, int64_t stream_id, int pri_version, + const nghttp3_pri *pri); + +/** + * @function + * + * `nghttp3_vec_len` returns the sum of length in |vec| of |cnt| + * elements. + */ +NGHTTP3_EXTERN uint64_t nghttp3_vec_len(const nghttp3_vec *vec, size_t cnt); + +/** + * @function + * + * `nghttp3_check_header_name` returns nonzero if HTTP field name + * |name| of length |len| is valid according to + * :rfc:`7230#section-3.2`. + * + * Because this is an HTTP field name in HTTP/3, the upper cased + * alphabet is treated as error. + */ +NGHTTP3_EXTERN int nghttp3_check_header_name(const uint8_t *name, size_t len); + +/** + * @function + * + * `nghttp3_check_header_value` returns nonzero if HTTP field value + * |value| of length |len| is valid according to + * :rfc:`7230#section-3.2`. + */ +NGHTTP3_EXTERN int nghttp3_check_header_value(const uint8_t *value, size_t len); + +/** + * @function + * + * `nghttp3_conn_is_drained` returns nonzero if + * `nghttp3_conn_shutdown` has been called, and there is no active + * remote streams. This function is for server use only. + */ +NGHTTP3_EXTERN int nghttp3_conn_is_drained(nghttp3_conn *conn); + +/** + * @function + * + * `nghttp3_pri_parse_priority` parses Priority header field value + * pointed by |value| of length |len|, and stores the result in the + * object pointed by |dest|. Priority header field is defined in + * :rfc:`9218`. + * + * This function does not initialize the object pointed by |dest| + * before storing the result. It only assigns the values that the + * parser correctly extracted to fields. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGHTTP3_ERR_INVALID_ARGUMENT` + * Failed to parse the header field value. + */ +NGHTTP3_EXTERN int nghttp3_pri_parse_priority_versioned(int pri_version, + nghttp3_pri *dest, + const uint8_t *value, + size_t len); + +/** + * @macrosection + * + * nghttp3_info flags + */ + +/** + * @macro + * + * :macro:`NGHTTP3_VERSION_AGE` is the age of :type:`nghttp3_info`. + */ +#define NGHTTP3_VERSION_AGE 1 + +/** + * @struct + * + * :type:`nghttp3_info` is what `nghttp3_version` returns. It holds + * information about the particular nghttp3 version. + */ +typedef struct nghttp3_info { + /** + * :member:`age` is the age of this struct. This instance of + * nghttp3 sets it to :macro:`NGHTTP3_VERSION_AGE` but a future + * version may bump it and add more struct fields at the bottom + */ + int age; + /** + * :member:`version_num` is the :macro:`NGHTTP3_VERSION_NUM` number + * (since age == 1) + */ + int version_num; + /** + * :member:`version_str` points to the :macro:`NGHTTP3_VERSION` + * string (since age ==1) + */ + const char *version_str; + /* -------- the above fields all exist when age == 1 */ +} nghttp3_info; + +/** + * @function + * + * `nghttp3_version` returns a pointer to a :type:`nghttp3_info` + * struct with version information about the run-time library in use. + * The |least_version| argument can be set to a 24 bit numerical value + * for the least accepted version number, and if the condition is not + * met, this function will return a ``NULL``. Pass in 0 to skip the + * version checking. + */ +NGHTTP3_EXTERN const nghttp3_info *nghttp3_version(int least_version); + +/** + * @function + * + * `nghttp3_err_is_fatal` returns nonzero if |liberr| is a fatal + * error. |liberr| must be one of nghttp3 library error codes (which + * is defined as NGHTTP3_ERR_* macro, such as + * :macro:`NGHTTP3_ERR_NOMEM`). + */ +NGHTTP3_EXTERN int nghttp3_err_is_fatal(int liberr); + +/* + * Versioned function wrappers + */ + +/* + * `nghttp3_settings_default` is a wrapper around + * `nghttp3_settings_default_versioned` to set the correct struct + * version. + */ +#define nghttp3_settings_default(SETTINGS) \ + nghttp3_settings_default_versioned(NGHTTP3_SETTINGS_VERSION, (SETTINGS)) + +/* + * `nghttp3_conn_client_new` is a wrapper around + * `nghttp3_conn_client_new_versioned` to set the correct struct + * version. + */ +#define nghttp3_conn_client_new(PCONN, CALLBACKS, SETTINGS, MEM, USER_DATA) \ + nghttp3_conn_client_new_versioned((PCONN), NGHTTP3_CALLBACKS_VERSION, \ + (CALLBACKS), NGHTTP3_SETTINGS_VERSION, \ + (SETTINGS), (MEM), (USER_DATA)) + +/* + * `nghttp3_conn_server_new` is a wrapper around + * `nghttp3_conn_server_new_versioned` to set the correct struct + * version. + */ +#define nghttp3_conn_server_new(PCONN, CALLBACKS, SETTINGS, MEM, USER_DATA) \ + nghttp3_conn_server_new_versioned((PCONN), NGHTTP3_CALLBACKS_VERSION, \ + (CALLBACKS), NGHTTP3_SETTINGS_VERSION, \ + (SETTINGS), (MEM), (USER_DATA)) + +/* + * `nghttp3_conn_set_server_stream_priority` is a wrapper around + * `nghttp3_conn_set_server_stream_priority_versioned` to set the + * correct struct version. + */ +#define nghttp3_conn_set_server_stream_priority(CONN, STREAM_ID, PRI) \ + nghttp3_conn_set_server_stream_priority_versioned( \ + (CONN), (STREAM_ID), NGHTTP3_PRI_VERSION, (PRI)) + +/* + * `nghttp3_conn_get_stream_priority` is a wrapper around + * `nghttp3_conn_get_stream_priority_versioned` to set the correct + * struct version. + */ +#define nghttp3_conn_get_stream_priority(CONN, DEST, STREAM_ID) \ + nghttp3_conn_get_stream_priority_versioned((CONN), NGHTTP3_PRI_VERSION, \ + (DEST), (STREAM_ID)) + +/* + * `nghttp3_pri_parse_priority` is a wrapper around + * `nghttp3_pri_parse_priority_versioned` to set the correct struct + * version. + */ +#define nghttp3_pri_parse_priority(DEST, VALUE, LEN) \ + nghttp3_pri_parse_priority_versioned(NGHTTP3_PRI_VERSION, (DEST), (VALUE), \ + (LEN)) + +#ifdef __cplusplus +} +#endif /* defined(__cplusplus) */ + +#endif /* !defined(NGHTTP3_H) */ diff --git a/curl/include/nghttp3/version.h b/curl/include/nghttp3/version.h new file mode 100644 index 0000000..4061c15 --- /dev/null +++ b/curl/include/nghttp3/version.h @@ -0,0 +1,46 @@ +/* + * nghttp3 + * + * Copyright (c) 2019 nghttp3 contributors + * Copyright (c) 2016 ngtcp2 contributors + * + * Permission is hereby granted, free of charge, to any person obtaining + * a copy of this software and associated documentation files (the + * "Software"), to deal in the Software without restriction, including + * without limitation the rights to use, copy, modify, merge, publish, + * distribute, sublicense, and/or sell copies of the Software, and to + * permit persons to whom the Software is furnished to do so, subject to + * the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + */ +#ifndef NGHTTP3_VERSION_H +#define NGHTTP3_VERSION_H + +/** + * @macro + * + * Version number of the nghttp3 library release. + */ +#define NGHTTP3_VERSION "1.10.1" + +/** + * @macro + * + * Numerical representation of the version number of the nghttp3 + * library release. This is a 24 bit number with 8 bits for major + * number, 8 bits for minor and 8 bits for patch. Version 1.2.3 + * becomes 0x010203. + */ +#define NGHTTP3_VERSION_NUM 0x010a01 + +#endif /* !defined(NGHTTP3_VERSION_H) */ diff --git a/curl/include/ngtcp2/ngtcp2.h b/curl/include/ngtcp2/ngtcp2.h new file mode 100644 index 0000000..d7a27b9 --- /dev/null +++ b/curl/include/ngtcp2/ngtcp2.h @@ -0,0 +1,5969 @@ +/* + * ngtcp2 + * + * Copyright (c) 2017 ngtcp2 contributors + * Copyright (c) 2017 nghttp2 contributors + * + * Permission is hereby granted, free of charge, to any person obtaining + * a copy of this software and associated documentation files (the + * "Software"), to deal in the Software without restriction, including + * without limitation the rights to use, copy, modify, merge, publish, + * distribute, sublicense, and/or sell copies of the Software, and to + * permit persons to whom the Software is furnished to do so, subject to + * the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + */ +#ifndef NGTCP2_H +#define NGTCP2_H + +/* Define WIN32 when build target is Win32 API (borrowed from + libcurl) */ +#if (defined(_WIN32) || defined(__WIN32__)) && !defined(WIN32) +# define WIN32 +#endif /* (defined(_WIN32) || defined(__WIN32__)) && !defined(WIN32) */ + +#ifdef _MSC_VER +# pragma warning(push) +# pragma warning(disable : 4324) +#endif /* defined(_MSC_VER) */ + +#include +#if defined(_MSC_VER) && (_MSC_VER < 1800) +/* MSVC < 2013 does not have inttypes.h because it is not C99 + compliant. See compiler macros and version number in + https://sourceforge.net/p/predef/wiki/Compilers/ */ +# include +#else /* !(defined(_MSC_VER) && (_MSC_VER < 1800)) */ +# include +#endif /* !(defined(_MSC_VER) && (_MSC_VER < 1800)) */ +#include +#include +#include + +#ifndef NGTCP2_USE_GENERIC_SOCKADDR +# ifdef WIN32 +# ifndef WIN32_LEAN_AND_MEAN +# define WIN32_LEAN_AND_MEAN +# endif /* !defined(WIN32_LEAN_AND_MEAN) */ +# include +# else /* !defined(WIN32) */ +# include +# include +# endif /* !defined(WIN32) */ +#endif /* !defined(NGTCP2_USE_GENERIC_SOCKADDR) */ + +#include + +#ifdef NGTCP2_STATICLIB +# define NGTCP2_EXTERN +#elif defined(WIN32) +# ifdef BUILDING_NGTCP2 +# define NGTCP2_EXTERN __declspec(dllexport) +# else /* !defined(BUILDING_NGTCP2) */ +# define NGTCP2_EXTERN __declspec(dllimport) +# endif /* !defined(BUILDING_NGTCP2) */ +#else /* !(defined(NGTCP2_STATICLIB) || defined(WIN32)) */ +# ifdef BUILDING_NGTCP2 +# define NGTCP2_EXTERN __attribute__((visibility("default"))) +# else /* !defined(BUILDING_NGTCP2) */ +# define NGTCP2_EXTERN +# endif /* !defined(BUILDING_NGTCP2) */ +#endif /* !(defined(NGTCP2_STATICLIB) || defined(WIN32)) */ + +#ifdef _MSC_VER +# define NGTCP2_ALIGN(N) __declspec(align(N)) +#else /* !defined(_MSC_VER) */ +# define NGTCP2_ALIGN(N) __attribute__((aligned(N))) +#endif /* !defined(_MSC_VER) */ + +#ifdef __cplusplus +extern "C" { +#endif /* defined(__cplusplus) */ + +/** + * @typedef + * + * :type:`ngtcp2_ssize` is signed counterpart of size_t. + */ +typedef ptrdiff_t ngtcp2_ssize; + +/** + * @functypedef + * + * :type:`ngtcp2_malloc` is a custom memory allocator to replace + * :manpage:`malloc(3)`. The |user_data| is + * :member:`ngtcp2_mem.user_data`. + */ +typedef void *(*ngtcp2_malloc)(size_t size, void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_free` is a custom memory allocator to replace + * :manpage:`free(3)`. The |user_data| is + * :member:`ngtcp2_mem.user_data`. + */ +typedef void (*ngtcp2_free)(void *ptr, void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_calloc` is a custom memory allocator to replace + * :manpage:`calloc(3)`. The |user_data| is the + * :member:`ngtcp2_mem.user_data`. + */ +typedef void *(*ngtcp2_calloc)(size_t nmemb, size_t size, void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_realloc` is a custom memory allocator to replace + * :manpage:`realloc(3)`. The |user_data| is the + * :member:`ngtcp2_mem.user_data`. + */ +typedef void *(*ngtcp2_realloc)(void *ptr, size_t size, void *user_data); + +/** + * @struct + * + * :type:`ngtcp2_mem` is a custom memory allocator. The + * :member:`user_data` field is passed to each allocator function. + * This can be used, for example, to achieve per-connection memory + * pool. + * + * In the following example code, ``my_malloc``, ``my_free``, + * ``my_calloc`` and ``my_realloc`` are the replacement of the + * standard allocators :manpage:`malloc(3)`, :manpage:`free(3)`, + * :manpage:`calloc(3)` and :manpage:`realloc(3)` respectively:: + * + * void *my_malloc_cb(size_t size, void *user_data) { + * (void)user_data; + * return my_malloc(size); + * } + * + * void my_free_cb(void *ptr, void *user_data) { + * (void)user_data; + * my_free(ptr); + * } + * + * void *my_calloc_cb(size_t nmemb, size_t size, void *user_data) { + * (void)user_data; + * return my_calloc(nmemb, size); + * } + * + * void *my_realloc_cb(void *ptr, size_t size, void *user_data) { + * (void)user_data; + * return my_realloc(ptr, size); + * } + * + * void conn_new() { + * ngtcp2_mem mem = { + * .malloc = my_malloc_cb, + * .free = my_free_cb, + * .calloc = my_calloc_cb, + * .realloc = my_realloc_cb, + * }; + * + * ... + * } + */ +typedef struct ngtcp2_mem { + /** + * :member:`user_data` is an arbitrary user supplied data. This + * is passed to each allocator function. + */ + void *user_data; + /** + * :member:`malloc` is a custom allocator function to replace + * :manpage:`malloc(3)`. + */ + ngtcp2_malloc malloc; + /** + * :member:`free` is a custom allocator function to replace + * :manpage:`free(3)`. + */ + ngtcp2_free free; + /** + * :member:`calloc` is a custom allocator function to replace + * :manpage:`calloc(3)`. + */ + ngtcp2_calloc calloc; + /** + * :member:`realloc` is a custom allocator function to replace + * :manpage:`realloc(3)`. + */ + ngtcp2_realloc realloc; +} ngtcp2_mem; + +/** + * @macrosection + * + * Time related macros + */ + +/** + * @macro + * + * :macro:`NGTCP2_NANOSECONDS` is a count of tick which corresponds to + * 1 nanosecond. + */ +#define NGTCP2_NANOSECONDS ((ngtcp2_duration)1ULL) + +/** + * @macro + * + * :macro:`NGTCP2_MICROSECONDS` is a count of tick which corresponds + * to 1 microsecond. + */ +#define NGTCP2_MICROSECONDS ((ngtcp2_duration)(1000ULL * NGTCP2_NANOSECONDS)) + +/** + * @macro + * + * :macro:`NGTCP2_MILLISECONDS` is a count of tick which corresponds + * to 1 millisecond. + */ +#define NGTCP2_MILLISECONDS ((ngtcp2_duration)(1000ULL * NGTCP2_MICROSECONDS)) + +/** + * @macro + * + * :macro:`NGTCP2_SECONDS` is a count of tick which corresponds to 1 + * second. + */ +#define NGTCP2_SECONDS ((ngtcp2_duration)(1000ULL * NGTCP2_MILLISECONDS)) + +/** + * @macro + * + * :macro:`NGTCP2_MINUTES` is a count of tick which corresponds to 1 + * minute. + */ +#define NGTCP2_MINUTES ((ngtcp2_duration)(60ULL * NGTCP2_SECONDS)) + +/** + * @macrosection + * + * QUIC protocol version macros + */ + +/** + * @macro + * + * :macro:`NGTCP2_PROTO_VER_V1` is the QUIC version 1. + */ +#define NGTCP2_PROTO_VER_V1 ((uint32_t)0x00000001u) + +/** + * @macro + * + * :macro:`NGTCP2_PROTO_VER_V2` is the QUIC version 2. See + * :rfc:`9369`. + */ +#define NGTCP2_PROTO_VER_V2 ((uint32_t)0x6b3343cfu) + +/** + * @macro + * + * :macro:`NGTCP2_PROTO_VER_MAX` is the highest QUIC version that this + * library supports. Deprecated since v1.1.0. + */ +#define NGTCP2_PROTO_VER_MAX NGTCP2_PROTO_VER_V1 + +/** + * @macro + * + * :macro:`NGTCP2_PROTO_VER_MIN` is the lowest QUIC version that this + * library supports. Deprecated since v1.1.0. + */ +#define NGTCP2_PROTO_VER_MIN NGTCP2_PROTO_VER_V1 + +/** + * @macro + * + * :macro:`NGTCP2_RESERVED_VERSION_MASK` is the bit mask of reserved + * version. + */ +#define NGTCP2_RESERVED_VERSION_MASK 0x0a0a0a0au + +/** + * @macrosection + * + * UDP datagram related macros + */ + +/** + * @macro + * + * :macro:`NGTCP2_MAX_UDP_PAYLOAD_SIZE` is the default maximum UDP + * datagram payload size that the local endpoint transmits. + */ +#define NGTCP2_MAX_UDP_PAYLOAD_SIZE 1200 + +/** + * @macro + * + * :macro:`NGTCP2_MAX_PMTUD_UDP_PAYLOAD_SIZE` is the maximum UDP + * datagram payload size that Path MTU Discovery can discover. + */ +#define NGTCP2_MAX_PMTUD_UDP_PAYLOAD_SIZE 1452 + +/** + * @macrosection + * + * QUIC specific macros + */ + +/** + * @macro + * + * :macro:`NGTCP2_MAX_VARINT` is the maximum value which can be + * encoded in variable-length integer encoding. + */ +#define NGTCP2_MAX_VARINT ((1ULL << 62) - 1) + +/** + * @macro + * + * :macro:`NGTCP2_STATELESS_RESET_TOKENLEN` is the length of Stateless + * Reset Token. + */ +#define NGTCP2_STATELESS_RESET_TOKENLEN 16 + +/** + * @macro + * + * :macro:`NGTCP2_MIN_STATELESS_RESET_RANDLEN` is the minimum length + * of random bytes (Unpredictable Bits) in Stateless Reset packet. + */ +#define NGTCP2_MIN_STATELESS_RESET_RANDLEN 5 + +/** + * @macro + * + * :macro:`NGTCP2_PATH_CHALLENGE_DATALEN` is the length of + * PATH_CHALLENGE data. + */ +#define NGTCP2_PATH_CHALLENGE_DATALEN 8 + +/** + * @macro + * + * :macro:`NGTCP2_RETRY_KEY_V1` is an encryption key to create + * integrity tag of Retry packet. It is used for QUIC v1. + */ +#define NGTCP2_RETRY_KEY_V1 \ + "\xbe\x0c\x69\x0b\x9f\x66\x57\x5a\x1d\x76\x6b\x54\xe3\x68\xc8\x4e" + +/** + * @macro + * + * :macro:`NGTCP2_RETRY_NONCE_V1` is nonce used when generating + * integrity tag of Retry packet. It is used for QUIC v1. + */ +#define NGTCP2_RETRY_NONCE_V1 "\x46\x15\x99\xd3\x5d\x63\x2b\xf2\x23\x98\x25\xbb" + +/** + * @macro + * + * :macro:`NGTCP2_RETRY_KEY_V2` is an encryption key to create + * integrity tag of Retry packet. It is used for QUIC v2. See + * :rfc:`9369`. + */ +#define NGTCP2_RETRY_KEY_V2 \ + "\x8f\xb4\xb0\x1b\x56\xac\x48\xe2\x60\xfb\xcb\xce\xad\x7c\xcc\x92" + +/** + * @macro + * + * :macro:`NGTCP2_RETRY_NONCE_V2` is nonce used when generating + * integrity tag of Retry packet. It is used for QUIC v2. See + * :rfc:`9369`. + */ +#define NGTCP2_RETRY_NONCE_V2 "\xd8\x69\x69\xbc\x2d\x7c\x6d\x99\x90\xef\xb0\x4a" + +/** + * @macro + * + * :macro:`NGTCP2_HP_MASKLEN` is the length of header protection mask. + */ +#define NGTCP2_HP_MASKLEN 5 + +/** + * @macro + * + * :macro:`NGTCP2_HP_SAMPLELEN` is the number bytes sampled when + * encrypting a packet header. + */ +#define NGTCP2_HP_SAMPLELEN 16 + +/** + * @macro + * + * :macro:`NGTCP2_DEFAULT_INITIAL_RTT` is a default initial RTT. + */ +#define NGTCP2_DEFAULT_INITIAL_RTT (333 * NGTCP2_MILLISECONDS) + +/** + * @macro + * + * :macro:`NGTCP2_MAX_CIDLEN` is the maximum length of Connection ID. + */ +#define NGTCP2_MAX_CIDLEN 20 + +/** + * @macro + * + * :macro:`NGTCP2_MIN_CIDLEN` is the minimum length of Connection ID. + */ +#define NGTCP2_MIN_CIDLEN 1 + +/** + * @macro + * + * :macro:`NGTCP2_MIN_INITIAL_DCIDLEN` is the minimum length of + * Destination Connection ID in Client Initial packet if it does not + * bear token from Retry packet. + */ +#define NGTCP2_MIN_INITIAL_DCIDLEN 8 + +/** + * @macrosection + * + * ECN related macros + */ + +/** + * @macro + * + * :macro:`NGTCP2_ECN_NOT_ECT` indicates no ECN marking. + */ +#define NGTCP2_ECN_NOT_ECT 0x0 + +/** + * @macro + * + * :macro:`NGTCP2_ECN_ECT_1` is ECT(1) codepoint. + */ +#define NGTCP2_ECN_ECT_1 0x1 + +/** + * @macro + * + * :macro:`NGTCP2_ECN_ECT_0` is ECT(0) codepoint. + */ +#define NGTCP2_ECN_ECT_0 0x2 + +/** + * @macro + * + * :macro:`NGTCP2_ECN_CE` is CE codepoint. + */ +#define NGTCP2_ECN_CE 0x3 + +/** + * @macro + * + * :macro:`NGTCP2_ECN_MASK` is a bit mask to get ECN marking. + */ +#define NGTCP2_ECN_MASK 0x3 + +#define NGTCP2_PKT_INFO_V1 1 +#define NGTCP2_PKT_INFO_VERSION NGTCP2_PKT_INFO_V1 + +/** + * @struct + * + * :type:`ngtcp2_pkt_info` is a packet metadata. + */ +typedef struct NGTCP2_ALIGN(8) ngtcp2_pkt_info { + /** + * :member:`ecn` is ECN marking, and when it is passed to + * `ngtcp2_conn_read_pkt()`, it should be either + * :macro:`NGTCP2_ECN_NOT_ECT`, :macro:`NGTCP2_ECN_ECT_1`, + * :macro:`NGTCP2_ECN_ECT_0`, or :macro:`NGTCP2_ECN_CE`. + */ + uint8_t ecn; +} ngtcp2_pkt_info; + +/** + * @macrosection + * + * ngtcp2 library error codes + */ + +/** + * @macro + * + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` indicates that a passed + * argument is invalid. + */ +#define NGTCP2_ERR_INVALID_ARGUMENT -201 +/** + * @macro + * + * :macro:`NGTCP2_ERR_NOBUF` indicates that a provided buffer does not + * have enough space to store data. + */ +#define NGTCP2_ERR_NOBUF -202 +/** + * @macro + * + * :macro:`NGTCP2_ERR_PROTO` indicates a general protocol error. + */ +#define NGTCP2_ERR_PROTO -203 +/** + * @macro + * + * :macro:`NGTCP2_ERR_INVALID_STATE` indicates that a requested + * operation is not allowed at the current connection state. + */ +#define NGTCP2_ERR_INVALID_STATE -204 +/** + * @macro + * + * :macro:`NGTCP2_ERR_ACK_FRAME` indicates that an invalid ACK frame + * is received. + */ +#define NGTCP2_ERR_ACK_FRAME -205 +/** + * @macro + * + * :macro:`NGTCP2_ERR_STREAM_ID_BLOCKED` indicates that there is no + * spare stream ID available. + */ +#define NGTCP2_ERR_STREAM_ID_BLOCKED -206 +/** + * @macro + * + * :macro:`NGTCP2_ERR_STREAM_IN_USE` indicates that a stream ID is + * already in use. + */ +#define NGTCP2_ERR_STREAM_IN_USE -207 +/** + * @macro + * + * :macro:`NGTCP2_ERR_STREAM_DATA_BLOCKED` indicates that stream data + * cannot be sent because of flow control. + */ +#define NGTCP2_ERR_STREAM_DATA_BLOCKED -208 +/** + * @macro + * + * :macro:`NGTCP2_ERR_FLOW_CONTROL` indicates flow control error. + */ +#define NGTCP2_ERR_FLOW_CONTROL -209 +/** + * @macro + * + * :macro:`NGTCP2_ERR_CONNECTION_ID_LIMIT` indicates that the number + * of received Connection ID exceeds acceptable limit. + */ +#define NGTCP2_ERR_CONNECTION_ID_LIMIT -210 +/** + * @macro + * + * :macro:`NGTCP2_ERR_STREAM_LIMIT` indicates that a remote endpoint + * opens more streams that is permitted. + */ +#define NGTCP2_ERR_STREAM_LIMIT -211 +/** + * @macro + * + * :macro:`NGTCP2_ERR_FINAL_SIZE` indicates that inconsistent final + * size of a stream. + */ +#define NGTCP2_ERR_FINAL_SIZE -212 +/** + * @macro + * + * :macro:`NGTCP2_ERR_CRYPTO` indicates crypto (TLS) related error. + */ +#define NGTCP2_ERR_CRYPTO -213 +/** + * @macro + * + * :macro:`NGTCP2_ERR_PKT_NUM_EXHAUSTED` indicates that packet number + * is exhausted. + */ +#define NGTCP2_ERR_PKT_NUM_EXHAUSTED -214 +/** + * @macro + * + * :macro:`NGTCP2_ERR_REQUIRED_TRANSPORT_PARAM` indicates that a + * required transport parameter is missing. + */ +#define NGTCP2_ERR_REQUIRED_TRANSPORT_PARAM -215 +/** + * @macro + * + * :macro:`NGTCP2_ERR_MALFORMED_TRANSPORT_PARAM` indicates that a + * transport parameter is malformed. + */ +#define NGTCP2_ERR_MALFORMED_TRANSPORT_PARAM -216 +/** + * @macro + * + * :macro:`NGTCP2_ERR_FRAME_ENCODING` indicates there is an error in + * frame encoding. + */ +#define NGTCP2_ERR_FRAME_ENCODING -217 +/** + * @macro + * + * :macro:`NGTCP2_ERR_DECRYPT` indicates a decryption failure. + */ +#define NGTCP2_ERR_DECRYPT -218 +/** + * @macro + * + * :macro:`NGTCP2_ERR_STREAM_SHUT_WR` indicates no more data can be + * sent to a stream. + */ +#define NGTCP2_ERR_STREAM_SHUT_WR -219 +/** + * @macro + * + * :macro:`NGTCP2_ERR_STREAM_NOT_FOUND` indicates that a stream was + * not found. + */ +#define NGTCP2_ERR_STREAM_NOT_FOUND -220 +/** + * @macro + * + * :macro:`NGTCP2_ERR_STREAM_STATE` indicates that a requested + * operation is not allowed at the current stream state. + */ +#define NGTCP2_ERR_STREAM_STATE -221 +/** + * @macro + * + * :macro:`NGTCP2_ERR_RECV_VERSION_NEGOTIATION` indicates that Version + * Negotiation packet was received. + */ +#define NGTCP2_ERR_RECV_VERSION_NEGOTIATION -222 +/** + * @macro + * + * :macro:`NGTCP2_ERR_CLOSING` indicates that connection is in closing + * state. + */ +#define NGTCP2_ERR_CLOSING -223 +/** + * @macro + * + * :macro:`NGTCP2_ERR_DRAINING` indicates that connection is in + * draining state. + */ +#define NGTCP2_ERR_DRAINING -224 +/** + * @macro + * + * :macro:`NGTCP2_ERR_TRANSPORT_PARAM` indicates a general transport + * parameter error. + */ +#define NGTCP2_ERR_TRANSPORT_PARAM -225 +/** + * @macro + * + * :macro:`NGTCP2_ERR_DISCARD_PKT` indicates a packet was discarded. + */ +#define NGTCP2_ERR_DISCARD_PKT -226 +/** + * @macro + * + * :macro:`NGTCP2_ERR_CONN_ID_BLOCKED` indicates that there is no + * spare Connection ID available. + */ +#define NGTCP2_ERR_CONN_ID_BLOCKED -227 +/** + * @macro + * + * :macro:`NGTCP2_ERR_INTERNAL` indicates an internal error. + */ +#define NGTCP2_ERR_INTERNAL -228 +/** + * @macro + * + * :macro:`NGTCP2_ERR_CRYPTO_BUFFER_EXCEEDED` indicates that a crypto + * buffer exceeded. + */ +#define NGTCP2_ERR_CRYPTO_BUFFER_EXCEEDED -229 +/** + * @macro + * + * :macro:`NGTCP2_ERR_WRITE_MORE` indicates + * :macro:`NGTCP2_WRITE_STREAM_FLAG_MORE` is used and a function call + * succeeded. + */ +#define NGTCP2_ERR_WRITE_MORE -230 +/** + * @macro + * + * :macro:`NGTCP2_ERR_RETRY` indicates that server should send Retry + * packet. + */ +#define NGTCP2_ERR_RETRY -231 +/** + * @macro + * + * :macro:`NGTCP2_ERR_DROP_CONN` indicates that an endpoint should + * drop connection immediately. + */ +#define NGTCP2_ERR_DROP_CONN -232 +/** + * @macro + * + * :macro:`NGTCP2_ERR_AEAD_LIMIT_REACHED` indicates AEAD encryption + * limit is reached and key update is not available. An endpoint + * should drop connection immediately. + */ +#define NGTCP2_ERR_AEAD_LIMIT_REACHED -233 +/** + * @macro + * + * :macro:`NGTCP2_ERR_NO_VIABLE_PATH` indicates that path validation + * could not probe that a path is capable of sending UDP datagram + * payload of size at least 1200 bytes. + */ +#define NGTCP2_ERR_NO_VIABLE_PATH -234 +/** + * @macro + * + * :macro:`NGTCP2_ERR_VERSION_NEGOTIATION` indicates that server + * should send Version Negotiation packet. + */ +#define NGTCP2_ERR_VERSION_NEGOTIATION -235 +/** + * @macro + * + * :macro:`NGTCP2_ERR_HANDSHAKE_TIMEOUT` indicates that QUIC + * connection is not established before the specified deadline. + */ +#define NGTCP2_ERR_HANDSHAKE_TIMEOUT -236 +/** + * @macro + * + * :macro:`NGTCP2_ERR_VERSION_NEGOTIATION_FAILURE` indicates the + * version negotiation failed. + */ +#define NGTCP2_ERR_VERSION_NEGOTIATION_FAILURE -237 +/** + * @macro + * + * :macro:`NGTCP2_ERR_IDLE_CLOSE` indicates the connection should be + * closed silently because of idle timeout. + */ +#define NGTCP2_ERR_IDLE_CLOSE -238 +/** + * @macro + * + * :macro:`NGTCP2_ERR_FATAL` indicates that error codes less than this + * value is fatal error. When this error is returned, an endpoint + * should close connection immediately. + */ +#define NGTCP2_ERR_FATAL -500 +/** + * @macro + * + * :macro:`NGTCP2_ERR_NOMEM` indicates out of memory. + */ +#define NGTCP2_ERR_NOMEM -501 +/** + * @macro + * + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` indicates that user defined + * callback function failed. + */ +#define NGTCP2_ERR_CALLBACK_FAILURE -502 + +/** + * @macrosection + * + * QUIC packet header flags + */ + +/** + * @macro + * + * :macro:`NGTCP2_PKT_FLAG_NONE` indicates no flag set. + */ +#define NGTCP2_PKT_FLAG_NONE 0x00u + +/** + * @macro + * + * :macro:`NGTCP2_PKT_FLAG_LONG_FORM` indicates the Long header packet + * header. + */ +#define NGTCP2_PKT_FLAG_LONG_FORM 0x01u + +/** + * @macro + * + * :macro:`NGTCP2_PKT_FLAG_FIXED_BIT_CLEAR` indicates that Fixed Bit + * (aka QUIC bit) is not set. + */ +#define NGTCP2_PKT_FLAG_FIXED_BIT_CLEAR 0x02u + +/** + * @macro + * + * :macro:`NGTCP2_PKT_FLAG_KEY_PHASE` indicates Key Phase bit set. + */ +#define NGTCP2_PKT_FLAG_KEY_PHASE 0x04u + +/** + * @enum + * + * :type:`ngtcp2_pkt_type` defines QUIC version-independent QUIC + * packet types. + */ +typedef enum ngtcp2_pkt_type { + /** + * :enum:`NGTCP2_PKT_VERSION_NEGOTIATION` is defined by libngtcp2 + * for convenience. + */ + NGTCP2_PKT_VERSION_NEGOTIATION = 0x80, + /** + * :enum:`NGTCP2_PKT_STATELESS_RESET` is defined by libngtcp2 for + * convenience. + */ + NGTCP2_PKT_STATELESS_RESET = 0x81, + /** + * :enum:`NGTCP2_PKT_INITIAL` indicates Initial packet. + */ + NGTCP2_PKT_INITIAL = 0x10, + /** + * :enum:`NGTCP2_PKT_0RTT` indicates 0-RTT packet. + */ + NGTCP2_PKT_0RTT = 0x11, + /** + * :enum:`NGTCP2_PKT_HANDSHAKE` indicates Handshake packet. + */ + NGTCP2_PKT_HANDSHAKE = 0x12, + /** + * :enum:`NGTCP2_PKT_RETRY` indicates Retry packet. + */ + NGTCP2_PKT_RETRY = 0x13, + /** + * :enum:`NGTCP2_PKT_1RTT` is defined by libngtcp2 for convenience. + */ + NGTCP2_PKT_1RTT = 0x40 +} ngtcp2_pkt_type; + +/** + * @macrosection + * + * QUIC transport error code + */ + +/** + * @macro + * + * :macro:`NGTCP2_NO_ERROR` is QUIC transport error code ``NO_ERROR``. + */ +#define NGTCP2_NO_ERROR 0x0u + +/** + * @macro + * + * :macro:`NGTCP2_INTERNAL_ERROR` is QUIC transport error code + * ``INTERNAL_ERROR``. + */ +#define NGTCP2_INTERNAL_ERROR 0x1u + +/** + * @macro + * + * :macro:`NGTCP2_CONNECTION_REFUSED` is QUIC transport error code + * ``CONNECTION_REFUSED``. + */ +#define NGTCP2_CONNECTION_REFUSED 0x2u + +/** + * @macro + * + * :macro:`NGTCP2_FLOW_CONTROL_ERROR` is QUIC transport error code + * ``FLOW_CONTROL_ERROR``. + */ +#define NGTCP2_FLOW_CONTROL_ERROR 0x3u + +/** + * @macro + * + * :macro:`NGTCP2_STREAM_LIMIT_ERROR` is QUIC transport error code + * ``STREAM_LIMIT_ERROR``. + */ +#define NGTCP2_STREAM_LIMIT_ERROR 0x4u + +/** + * @macro + * + * :macro:`NGTCP2_STREAM_STATE_ERROR` is QUIC transport error code + * ``STREAM_STATE_ERROR``. + */ +#define NGTCP2_STREAM_STATE_ERROR 0x5u + +/** + * @macro + * + * :macro:`NGTCP2_FINAL_SIZE_ERROR` is QUIC transport error code + * ``FINAL_SIZE_ERROR``. + */ +#define NGTCP2_FINAL_SIZE_ERROR 0x6u + +/** + * @macro + * + * :macro:`NGTCP2_FRAME_ENCODING_ERROR` is QUIC transport error code + * ``FRAME_ENCODING_ERROR``. + */ +#define NGTCP2_FRAME_ENCODING_ERROR 0x7u + +/** + * @macro + * + * :macro:`NGTCP2_TRANSPORT_PARAMETER_ERROR` is QUIC transport error + * code ``TRANSPORT_PARAMETER_ERROR``. + */ +#define NGTCP2_TRANSPORT_PARAMETER_ERROR 0x8u + +/** + * @macro + * + * :macro:`NGTCP2_CONNECTION_ID_LIMIT_ERROR` is QUIC transport error + * code ``CONNECTION_ID_LIMIT_ERROR``. + */ +#define NGTCP2_CONNECTION_ID_LIMIT_ERROR 0x9u + +/** + * @macro + * + * :macro:`NGTCP2_PROTOCOL_VIOLATION` is QUIC transport error code + * ``PROTOCOL_VIOLATION``. + */ +#define NGTCP2_PROTOCOL_VIOLATION 0xau + +/** + * @macro + * + * :macro:`NGTCP2_INVALID_TOKEN` is QUIC transport error code + * ``INVALID_TOKEN``. + */ +#define NGTCP2_INVALID_TOKEN 0xbu + +/** + * @macro + * + * :macro:`NGTCP2_APPLICATION_ERROR` is QUIC transport error code + * ``APPLICATION_ERROR``. + */ +#define NGTCP2_APPLICATION_ERROR 0xcu + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_BUFFER_EXCEEDED` is QUIC transport error code + * ``CRYPTO_BUFFER_EXCEEDED``. + */ +#define NGTCP2_CRYPTO_BUFFER_EXCEEDED 0xdu + +/** + * @macro + * + * :macro:`NGTCP2_KEY_UPDATE_ERROR` is QUIC transport error code + * ``KEY_UPDATE_ERROR``. + */ +#define NGTCP2_KEY_UPDATE_ERROR 0xeu + +/** + * @macro + * + * :macro:`NGTCP2_AEAD_LIMIT_REACHED` is QUIC transport error code + * ``AEAD_LIMIT_REACHED``. + */ +#define NGTCP2_AEAD_LIMIT_REACHED 0xfu + +/** + * @macro + * + * :macro:`NGTCP2_NO_VIABLE_PATH` is QUIC transport error code + * ``NO_VIABLE_PATH``. + */ +#define NGTCP2_NO_VIABLE_PATH 0x10u + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_ERROR` is QUIC transport error code + * ``CRYPTO_ERROR``. + */ +#define NGTCP2_CRYPTO_ERROR 0x100u + +/** + * @macro + * + * :macro:`NGTCP2_VERSION_NEGOTIATION_ERROR` is QUIC transport error + * code ``VERSION_NEGOTIATION_ERROR``. See :rfc:`9368`. + */ +#define NGTCP2_VERSION_NEGOTIATION_ERROR 0x11 + +/** + * @enum + * + * :type:`ngtcp2_path_validation_result` defines path validation + * result code. + */ +typedef enum ngtcp2_path_validation_result { + /** + * :enum:`NGTCP2_PATH_VALIDATION_RESULT_SUCCESS` indicates + * successful validation. + */ + NGTCP2_PATH_VALIDATION_RESULT_SUCCESS, + /** + * :enum:`NGTCP2_PATH_VALIDATION_RESULT_FAILURE` indicates + * validation failure. + */ + NGTCP2_PATH_VALIDATION_RESULT_FAILURE, + /** + * :enum:`NGTCP2_PATH_VALIDATION_RESULT_ABORTED` indicates that path + * validation was aborted. + */ + NGTCP2_PATH_VALIDATION_RESULT_ABORTED +} ngtcp2_path_validation_result; + +/** + * @typedef + * + * :type:`ngtcp2_tstamp` is a timestamp with nanosecond resolution. + * ``UINT64_MAX`` is an invalid value, and it is often used to + * indicate that no value is set. + */ +typedef uint64_t ngtcp2_tstamp; + +/** + * @typedef + * + * :type:`ngtcp2_duration` is a period of time in nanosecond + * resolution. ``UINT64_MAX`` is an invalid value, and it is often + * used to indicate that no value is set. + */ +typedef uint64_t ngtcp2_duration; + +/** + * @struct + * + * :type:`ngtcp2_cid` holds a Connection ID. + */ +typedef struct ngtcp2_cid { + /** + * :member:`datalen` is the length of Connection ID. + */ + size_t datalen; + /** + * :member:`data` is the buffer to store Connection ID. + */ + uint8_t data[NGTCP2_MAX_CIDLEN]; +} ngtcp2_cid; + +/** + * @struct + * + * :type:`ngtcp2_vec` is struct iovec compatible structure to + * reference arbitrary array of bytes. + */ +typedef struct ngtcp2_vec { + /** + * :member:`base` points to the data. + */ + uint8_t *base; + /** + * :member:`len` is the number of bytes which the buffer pointed by + * base contains. + */ + size_t len; +} ngtcp2_vec; + +/** + * @function + * + * `ngtcp2_cid_init` initializes Connection ID |cid| with the byte + * string pointed by |data| and its length is |datalen|. |datalen| + * must be at most :macro:`NGTCP2_MAX_CIDLEN`. + */ +NGTCP2_EXTERN void ngtcp2_cid_init(ngtcp2_cid *cid, const uint8_t *data, + size_t datalen); + +/** + * @function + * + * `ngtcp2_cid_eq` returns nonzero if |a| and |b| share the same + * Connection ID. + */ +NGTCP2_EXTERN int ngtcp2_cid_eq(const ngtcp2_cid *a, const ngtcp2_cid *b); + +/** + * @struct + * + * :type:`ngtcp2_pkt_hd` represents QUIC packet header. + */ +typedef struct ngtcp2_pkt_hd { + /** + * :member:`dcid` is Destination Connection ID. + */ + ngtcp2_cid dcid; + /** + * :member:`scid` is Source Connection ID. + */ + ngtcp2_cid scid; + /** + * :member:`pkt_num` is a packet number. + */ + int64_t pkt_num; + /** + * :member:`token` contains token. Only Initial packet may contain + * token. NULL if no token is present. + */ + const uint8_t *token; + /** + * :member:`tokenlen` is the length of :member:`token`. 0 if no + * token is present. + */ + size_t tokenlen; + /** + * :member:`pkt_numlen` is the number of bytes spent to encode + * :member:`pkt_num`. + */ + size_t pkt_numlen; + /** + * :member:`len` is the sum of :member:`pkt_numlen` and the length + * of QUIC packet payload. + */ + size_t len; + /** + * :member:`version` is QUIC version. + */ + uint32_t version; + /** + * :member:`type` is a type of QUIC packet. This field does not + * have a QUIC packet type defined for a specific QUIC version. + * Instead, it contains version independent packet type defined by + * this library. See :type:`ngtcp2_pkt_type`. + */ + uint8_t type; + /** + * :member:`flags` is zero or more of :macro:`NGTCP2_PKT_FLAG_* + * `. + */ + uint8_t flags; +} ngtcp2_pkt_hd; + +/** + * @struct + * + * :type:`ngtcp2_pkt_stateless_reset` represents Stateless Reset. + */ +typedef struct ngtcp2_pkt_stateless_reset { + /** + * :member:`stateless_reset_token` contains stateless reset token. + */ + uint8_t stateless_reset_token[NGTCP2_STATELESS_RESET_TOKENLEN]; + /** + * :member:`rand` points a buffer which contains random bytes + * section. + */ + const uint8_t *rand; + /** + * :member:`randlen` is the number of random bytes. + */ + size_t randlen; +} ngtcp2_pkt_stateless_reset; + +/** + * @macrosection + * + * QUIC transport parameters related macros + */ + +/** + * @macro + * + * :macro:`NGTCP2_DEFAULT_MAX_RECV_UDP_PAYLOAD_SIZE` is the default + * value of max_udp_payload_size transport parameter. + */ +#define NGTCP2_DEFAULT_MAX_RECV_UDP_PAYLOAD_SIZE 65527 + +/** + * @macro + * + * :macro:`NGTCP2_DEFAULT_ACK_DELAY_EXPONENT` is a default value of + * scaling factor of ACK Delay field in ACK frame. + */ +#define NGTCP2_DEFAULT_ACK_DELAY_EXPONENT 3 + +/** + * @macro + * + * :macro:`NGTCP2_DEFAULT_MAX_ACK_DELAY` is a default value of the + * maximum amount of time in nanoseconds by which endpoint delays + * sending acknowledgement. + */ +#define NGTCP2_DEFAULT_MAX_ACK_DELAY (25 * NGTCP2_MILLISECONDS) + +/** + * @macro + * + * :macro:`NGTCP2_DEFAULT_ACTIVE_CONNECTION_ID_LIMIT` is the default + * value of active_connection_id_limit transport parameter value if + * omitted. + */ +#define NGTCP2_DEFAULT_ACTIVE_CONNECTION_ID_LIMIT 2 + +/** + * @macro + * + * :macro:`NGTCP2_TLSEXT_QUIC_TRANSPORT_PARAMETERS_V1` is TLS + * extension type of quic_transport_parameters. + */ +#define NGTCP2_TLSEXT_QUIC_TRANSPORT_PARAMETERS_V1 0x39u + +#ifdef NGTCP2_USE_GENERIC_SOCKADDR +# ifndef NGTCP2_AF_INET +# error NGTCP2_AF_INET must be defined +# endif /* !defined(NGTCP2_AF_INET) */ + +# ifndef NGTCP2_AF_INET6 +# error NGTCP2_AF_INET6 must be defined +# endif /* !defined(NGTCP2_AF_INET6) */ + +typedef unsigned short int ngtcp2_sa_family; +typedef uint16_t ngtcp2_in_port; + +typedef struct ngtcp2_sockaddr { + ngtcp2_sa_family sa_family; + uint8_t sa_data[14]; +} ngtcp2_sockaddr; + +typedef struct ngtcp2_in_addr { + uint32_t s_addr; +} ngtcp2_in_addr; + +typedef struct ngtcp2_sockaddr_in { + ngtcp2_sa_family sin_family; + ngtcp2_in_port sin_port; + ngtcp2_in_addr sin_addr; + uint8_t sin_zero[8]; +} ngtcp2_sockaddr_in; + +typedef struct ngtcp2_in6_addr { + uint8_t in6_addr[16]; +} ngtcp2_in6_addr; + +typedef struct ngtcp2_sockaddr_in6 { + ngtcp2_sa_family sin6_family; + ngtcp2_in_port sin6_port; + uint32_t sin6_flowinfo; + ngtcp2_in6_addr sin6_addr; + uint32_t sin6_scope_id; +} ngtcp2_sockaddr_in6; + +typedef uint32_t ngtcp2_socklen; +#else /* !defined(NGTCP2_USE_GENERIC_SOCKADDR) */ +# define NGTCP2_AF_INET AF_INET +# define NGTCP2_AF_INET6 AF_INET6 + +/** + * @typedef + * + * :type:`ngtcp2_sockaddr` is typedefed to struct sockaddr. If + * :macro:`NGTCP2_USE_GENERIC_SOCKADDR` is defined, it is typedefed to + * the generic struct sockaddr defined in ngtcp2.h. + */ +typedef struct sockaddr ngtcp2_sockaddr; +/** + * @typedef + * + * :type:`ngtcp2_sockaddr_in` is typedefed to struct sockaddr_in. If + * :macro:`NGTCP2_USE_GENERIC_SOCKADDR` is defined, it is typedefed to + * the generic struct sockaddr_in defined in ngtcp2.h. + */ +typedef struct sockaddr_in ngtcp2_sockaddr_in; +/** + * @typedef + * + * :type:`ngtcp2_sockaddr_in6` is typedefed to struct sockaddr_in6. + * If :macro:`NGTCP2_USE_GENERIC_SOCKADDR` is defined, it is typedefed + * to the generic struct sockaddr_in6 defined in ngtcp2.h. + */ +typedef struct sockaddr_in6 ngtcp2_sockaddr_in6; +/** + * @typedef + * + * :type:`ngtcp2_socklen` is typedefed to socklen_t. If + * :macro:`NGTCP2_USE_GENERIC_SOCKADDR` is defined, it is typedefed to + * uint32_t. + */ +typedef socklen_t ngtcp2_socklen; +#endif /* !defined(NGTCP2_USE_GENERIC_SOCKADDR) */ + +/** + * @struct + * + * :type:`ngtcp2_sockaddr_union` conveniently includes all supported + * address types. + */ +typedef union ngtcp2_sockaddr_union { + ngtcp2_sockaddr sa; + ngtcp2_sockaddr_in in; + ngtcp2_sockaddr_in6 in6; +} ngtcp2_sockaddr_union; + +/** + * @struct + * + * :type:`ngtcp2_preferred_addr` represents preferred address + * structure. + */ +typedef struct ngtcp2_preferred_addr { + /** + * :member:`cid` is a Connection ID. + */ + ngtcp2_cid cid; + /** + * :member:`ipv4` contains IPv4 address and port. + */ + ngtcp2_sockaddr_in ipv4; + /** + * :member:`ipv6` contains IPv6 address and port. + */ + ngtcp2_sockaddr_in6 ipv6; + /** + * :member:`ipv4_present` indicates that :member:`ipv4` contains + * IPv4 address and port. + */ + uint8_t ipv4_present; + /** + * :member:`ipv6_present` indicates that :member:`ipv6` contains + * IPv6 address and port. + */ + uint8_t ipv6_present; + /** + * :member:`stateless_reset_token` contains stateless reset token. + */ + uint8_t stateless_reset_token[NGTCP2_STATELESS_RESET_TOKENLEN]; +} ngtcp2_preferred_addr; + +/** + * @struct + * + * :type:`ngtcp2_version_info` represents version_information + * structure. See :rfc:`9368`. + */ +typedef struct ngtcp2_version_info { + /** + * :member:`chosen_version` is the version chosen by the sender. + */ + uint32_t chosen_version; + /** + * :member:`available_versions` points the wire image of + * available_versions field. The each version is therefore in + * network byte order. + */ + const uint8_t *available_versions; + /** + * :member:`available_versionslen` is the number of bytes pointed by + * :member:`available_versions`, not the number of versions + * included. + */ + size_t available_versionslen; +} ngtcp2_version_info; + +#define NGTCP2_TRANSPORT_PARAMS_V1 1 +#define NGTCP2_TRANSPORT_PARAMS_VERSION NGTCP2_TRANSPORT_PARAMS_V1 + +/** + * @struct + * + * :type:`ngtcp2_transport_params` represents QUIC transport + * parameters. + */ +typedef struct ngtcp2_transport_params { + /** + * :member:`preferred_addr` contains preferred address if + * :member:`preferred_addr_present` is nonzero. + */ + ngtcp2_preferred_addr preferred_addr; + /** + * :member:`original_dcid` is the Destination Connection ID field + * from the first Initial packet from client. Server must specify + * this field and set :member:`original_dcid_present` to nonzero. + * It is expected that application knows the original Destination + * Connection ID even if it sends Retry packet, for example, by + * including it in retry token. Otherwise, application should not + * specify this field. + */ + ngtcp2_cid original_dcid; + /** + * :member:`initial_scid` is the Source Connection ID field from the + * first Initial packet the local endpoint sends. Application + * should not specify this field. If :member:`initial_scid_present` + * is set to nonzero, it indicates this field is set. + */ + ngtcp2_cid initial_scid; + /** + * :member:`retry_scid` is the Source Connection ID field from Retry + * packet. Only server uses this field. If server application + * received Initial packet with retry token from client, and server + * successfully verified its token, server application must set + * Destination Connection ID field from the Initial packet to this + * field, and set :member:`retry_scid_present` to nonzero. Server + * application must verify that the Destination Connection ID from + * Initial packet was sent in Retry packet by, for example, + * including the Connection ID in a token, or including it in AAD + * when encrypting a token. + */ + ngtcp2_cid retry_scid; + /** + * :member:`initial_max_stream_data_bidi_local` is the size of flow + * control window of locally initiated stream. This is the number + * of bytes that the remote endpoint can send, and the local + * endpoint must ensure that it has enough buffer to receive them. + */ + uint64_t initial_max_stream_data_bidi_local; + /** + * :member:`initial_max_stream_data_bidi_remote` is the size of flow + * control window of remotely initiated stream. This is the number + * of bytes that the remote endpoint can send, and the local + * endpoint must ensure that it has enough buffer to receive them. + */ + uint64_t initial_max_stream_data_bidi_remote; + /** + * :member:`initial_max_stream_data_uni` is the size of flow control + * window of remotely initiated unidirectional stream. This is the + * number of bytes that the remote endpoint can send, and the local + * endpoint must ensure that it has enough buffer to receive them. + */ + uint64_t initial_max_stream_data_uni; + /** + * :member:`initial_max_data` is the connection level flow control + * window. + */ + uint64_t initial_max_data; + /** + * :member:`initial_max_streams_bidi` is the number of concurrent + * streams that the remote endpoint can create. + */ + uint64_t initial_max_streams_bidi; + /** + * :member:`initial_max_streams_uni` is the number of concurrent + * unidirectional streams that the remote endpoint can create. + */ + uint64_t initial_max_streams_uni; + /** + * :member:`max_idle_timeout` is a duration during which sender + * allows quiescent. 0 means no idle timeout. It must not be + * UINT64_MAX. + */ + ngtcp2_duration max_idle_timeout; + /** + * :member:`max_udp_payload_size` is the maximum UDP payload size + * that the local endpoint can receive. + */ + uint64_t max_udp_payload_size; + /** + * :member:`active_connection_id_limit` is the maximum number of + * Connection ID that sender can store. If specified, it must be in + * the range of [:macro:`NGTCP2_DEFAULT_ACTIVE_CONNECTION_ID_LIMIT`, + * 8], inclusive. + */ + uint64_t active_connection_id_limit; + /** + * :member:`ack_delay_exponent` is the exponent used in ACK Delay + * field in ACK frame. + */ + uint64_t ack_delay_exponent; + /** + * :member:`max_ack_delay` is the maximum acknowledgement delay by + * which the local endpoint will delay sending acknowledgements. It + * must be strictly less than (1 << 14) milliseconds. + * Sub-millisecond part is dropped when sending it in a QUIC + * transport parameter. + */ + ngtcp2_duration max_ack_delay; + /** + * :member:`max_datagram_frame_size` is the maximum size of DATAGRAM + * frame that the local endpoint willingly receives. Specifying 0 + * disables DATAGRAM support. See :rfc:`9221`. + */ + uint64_t max_datagram_frame_size; + /** + * :member:`stateless_reset_token_present` is nonzero if + * :member:`stateless_reset_token` field is set. + */ + uint8_t stateless_reset_token_present; + /** + * :member:`disable_active_migration` is nonzero if the local + * endpoint does not support active connection migration. + */ + uint8_t disable_active_migration; + /** + * :member:`original_dcid_present` is nonzero if + * :member:`original_dcid` field is set. + */ + uint8_t original_dcid_present; + /** + * :member:`initial_scid_present` is nonzero if + * :member:`initial_scid` field is set. + */ + uint8_t initial_scid_present; + /** + * :member:`retry_scid_present` is nonzero if :member:`retry_scid` + * field is set. + */ + uint8_t retry_scid_present; + /** + * :member:`preferred_addr_present` is nonzero if + * :member:`preferred_address` is set. + */ + uint8_t preferred_addr_present; + /** + * :member:`stateless_reset_token` contains stateless reset token. + */ + uint8_t stateless_reset_token[NGTCP2_STATELESS_RESET_TOKENLEN]; + /** + * :member:`grease_quic_bit` is nonzero if sender supports "Greasing + * the QUIC Bit" extension. See :rfc:`9287`. + */ + uint8_t grease_quic_bit; + /** + * :member:`version_info` contains version_information field if + * :member:`version_info_present` is nonzero. Application should + * not specify this field. + */ + ngtcp2_version_info version_info; + /** + * :member:`version_info_present` is nonzero if + * :member:`version_info` is set. Application should not specify + * this field. + */ + uint8_t version_info_present; +} ngtcp2_transport_params; + +#define NGTCP2_CONN_INFO_V1 1 +#define NGTCP2_CONN_INFO_VERSION NGTCP2_CONN_INFO_V1 + +/** + * @struct + * + * :type:`ngtcp2_conn_info` holds various connection statistics. + */ +typedef struct ngtcp2_conn_info { + /** + * :member:`latest_rtt` is the latest RTT sample which is not + * adjusted by acknowledgement delay. + */ + ngtcp2_duration latest_rtt; + /** + * :member:`min_rtt` is the minimum RTT seen so far. It is not + * adjusted by acknowledgement delay. + */ + ngtcp2_duration min_rtt; + /** + * :member:`smoothed_rtt` is the smoothed RTT. + */ + ngtcp2_duration smoothed_rtt; + /** + * :member:`rttvar` is a mean deviation of observed RTT. + */ + ngtcp2_duration rttvar; + /** + * :member:`cwnd` is the size of congestion window. + */ + uint64_t cwnd; + /** + * :member:`ssthresh` is slow start threshold. + */ + uint64_t ssthresh; + /** + * :member:`bytes_in_flight` is the number in bytes of all sent + * packets which have not been acknowledged. + */ + uint64_t bytes_in_flight; +} ngtcp2_conn_info; + +/** + * @enum + * + * :type:`ngtcp2_cc_algo` defines congestion control algorithms. + */ +typedef enum ngtcp2_cc_algo { + /** + * :enum:`NGTCP2_CC_ALGO_RENO` represents Reno. + */ + NGTCP2_CC_ALGO_RENO = 0x00, + /** + * :enum:`NGTCP2_CC_ALGO_CUBIC` represents Cubic. + */ + NGTCP2_CC_ALGO_CUBIC = 0x01, + /** + * :enum:`NGTCP2_CC_ALGO_BBR` represents BBR v2. + */ + NGTCP2_CC_ALGO_BBR = 0x02 +} ngtcp2_cc_algo; + +/** + * @functypedef + * + * :type:`ngtcp2_printf` is a callback function for logging. + * |user_data| is the same object passed to `ngtcp2_conn_client_new` + * or `ngtcp2_conn_server_new`. + */ +typedef void (*ngtcp2_printf)(void *user_data, const char *format, ...); + +/** + * @macrosection + * + * QLog related macros + */ + +/** + * @macro + * + * :macro:`NGTCP2_QLOG_WRITE_FLAG_NONE` indicates no flag set. + */ +#define NGTCP2_QLOG_WRITE_FLAG_NONE 0x00u +/** + * @macro + * + * :macro:`NGTCP2_QLOG_WRITE_FLAG_FIN` indicates that this is the + * final call to :type:`ngtcp2_qlog_write` in the current connection. + */ +#define NGTCP2_QLOG_WRITE_FLAG_FIN 0x01u + +/** + * @struct + * + * :type:`ngtcp2_rand_ctx` is a wrapper around native random number + * generator. It is opaque to the ngtcp2 library. This might be + * useful if application needs to specify random number generator per + * thread or per connection. + */ +typedef struct ngtcp2_rand_ctx { + /** + * :member:`native_handle` is a pointer to an underlying random + * number generator. + */ + void *native_handle; +} ngtcp2_rand_ctx; + +/** + * @functypedef + * + * :type:`ngtcp2_qlog_write` is a callback function which is called to + * write qlog |data| of length |datalen| bytes. |flags| is bitwise OR + * of zero or more of :macro:`NGTCP2_QLOG_WRITE_FLAG_* + * `. If + * :macro:`NGTCP2_QLOG_WRITE_FLAG_FIN` is set, |datalen| may be 0. + */ +typedef void (*ngtcp2_qlog_write)(void *user_data, uint32_t flags, + const void *data, size_t datalen); + +/** + * @enum + * + * :type:`ngtcp2_token_type` defines the type of token. + */ +typedef enum ngtcp2_token_type { + /** + * :enum:`NGTCP2_TOKEN_TYPE_UNKNOWN` indicates that the type of + * token is unknown. + */ + NGTCP2_TOKEN_TYPE_UNKNOWN, + /** + * :enum:`NGTCP2_TOKEN_TYPE_RETRY` indicates that a token comes from + * Retry packet. + */ + NGTCP2_TOKEN_TYPE_RETRY, + /** + * :enum:`NGTCP2_TOKEN_TYPE_NEW_TOKEN` indicates that a token comes + * from NEW_TOKEN frame. + */ + NGTCP2_TOKEN_TYPE_NEW_TOKEN +} ngtcp2_token_type; + +#define NGTCP2_SETTINGS_V1 1 +#define NGTCP2_SETTINGS_V2 2 +#define NGTCP2_SETTINGS_VERSION NGTCP2_SETTINGS_V2 + +/** + * @struct + * + * :type:`ngtcp2_settings` defines QUIC connection settings. + */ +typedef struct ngtcp2_settings { + /** + * :member:`qlog_write` is a callback function to write qlog. + * Setting ``NULL`` disables qlog. + */ + ngtcp2_qlog_write qlog_write; + /** + * :member:`cc_algo` specifies congestion control algorithm. + */ + ngtcp2_cc_algo cc_algo; + /** + * :member:`initial_ts` is an initial timestamp given to the + * library. + */ + ngtcp2_tstamp initial_ts; + /** + * :member:`initial_rtt` is an initial RTT. + */ + ngtcp2_duration initial_rtt; + /** + * :member:`log_printf` is a function that the library uses to write + * logs. ``NULL`` means no logging output. It is nothing to do + * with qlog. + */ + ngtcp2_printf log_printf; + /** + * :member:`max_tx_udp_payload_size` is the maximum size of UDP + * datagram payload that the local endpoint transmits. + */ + size_t max_tx_udp_payload_size; + /** + * :member:`token` is a token from Retry packet or NEW_TOKEN frame. + * + * Server sets this field if it received the token in Client Initial + * packet and successfully validated. It should also set + * :member:`token_type` field. + * + * Client sets this field if it intends to send token in its Initial + * packet. + * + * `ngtcp2_conn_server_new` and `ngtcp2_conn_client_new` make a copy + * of token. + * + * Set NULL if there is no token. + */ + const uint8_t *token; + /** + * :member:`tokenlen` is the length of :member:`token`. Set 0 if + * there is no token. + */ + size_t tokenlen; + /** + * :member:`token_type` is the type of token. Server application + * should set this field. + */ + ngtcp2_token_type token_type; + /** + * :member:`rand_ctx` is an optional random number generator to be + * passed to :type:`ngtcp2_rand` callback. + */ + ngtcp2_rand_ctx rand_ctx; + /** + * :member:`max_window` is the maximum connection-level flow control + * window if connection-level window auto-tuning is enabled. The + * connection-level window auto tuning is enabled if nonzero value + * is specified in this field. The initial value of window size is + * :member:`ngtcp2_transport_params.initial_max_data`. The window + * size is scaled up to the value specified in this field. + */ + uint64_t max_window; + /** + * :member:`max_stream_window` is the maximum stream-level flow + * control window if stream-level window auto-tuning is enabled. + * The stream-level window auto-tuning is enabled if nonzero value + * is specified in this field. The initial value of window size is + * :member:`ngtcp2_transport_params.initial_max_stream_data_bidi_remote`, + * :member:`ngtcp2_transport_params.initial_max_stream_data_bidi_local`, + * or :member:`ngtcp2_transport_params.initial_max_stream_data_uni`, + * depending on the type of stream. The window size is scaled up to + * the value specified in this field. + * + * Please note that the auto-tuning is done per stream. Even if the + * previous stream gets larger window as a result of auto-tuning, + * the new stream still starts with the initial value set in + * transport parameters. This might become a bottleneck if + * congestion window of a remote server is wide open. If this + * causes an issue, do not enable auto-tuning. + */ + uint64_t max_stream_window; + /** + * :member:`ack_thresh` is the minimum number of the received ACK + * eliciting packets that trigger the immediate acknowledgement from + * the local endpoint. + */ + size_t ack_thresh; + /** + * :member:`no_tx_udp_payload_size_shaping`, if set to nonzero, + * instructs the library not to limit the UDP payload size to + * :macro:`NGTCP2_MAX_UDP_PAYLOAD_SIZE` (which can be extended by + * Path MTU Discovery), and instead use the minimum size among the + * given buffer size, :member:`max_tx_udp_payload_size`, and the + * received max_udp_payload_size QUIC transport parameter. + */ + uint8_t no_tx_udp_payload_size_shaping; + /** + * :member:`handshake_timeout` is the period of time before giving + * up QUIC connection establishment. If QUIC handshake is not + * complete within this period, `ngtcp2_conn_handle_expiry` returns + * :macro:`NGTCP2_ERR_HANDSHAKE_TIMEOUT` error. The deadline is + * :member:`initial_ts` + :member:`handshake_timeout`. If this + * field is set to ``UINT64_MAX``, no handshake timeout is set. + */ + ngtcp2_duration handshake_timeout; + /** + * :member:`preferred_versions` is the array of versions that are + * preferred by the local endpoint. All versions set in this array + * must be supported by the library, and compatible to QUIC v1. The + * reserved versions are not allowed. They are sorted in the order + * of preference. + * + * On compatible version negotiation, server will negotiate one of + * those versions contained in this array if there is some overlap + * between these versions and the versions offered by the client. + * If there is no overlap, but the client chosen version is + * supported by the library, the server chooses the client chosen + * version as the negotiated version. This version set corresponds + * to Offered Versions described in :rfc:`9368`, and it should be + * included in Version Negotiation packet. + * + * Client uses this field and :member:`original_version` to prevent + * version downgrade attack if it reacted upon Version Negotiation + * packet. If this field is specified, client must include + * |client_chosen_version| passed to `ngtcp2_conn_client_new` unless + * |client_chosen_version| is a reserved version. + */ + const uint32_t *preferred_versions; + /** + * :member:`preferred_versionslen` is the number of versions that + * are contained in the array pointed by + * :member:`preferred_versions`. + */ + size_t preferred_versionslen; + /** + * :member:`available_versions` is the array of versions that are + * going to be set in :member:`available_versions + * ` field of outgoing + * version_information QUIC transport parameter. + * + * For server, this corresponds to Fully-Deployed Versions described + * in :rfc:`9368`. If this field is not set, it is set to + * :member:`preferred_versions` internally if + * :member:`preferred_versionslen` is not zero. If this field is + * not set, and :member:`preferred_versionslen` is zero, this field + * is set to :macro:`NGTCP2_PROTO_VER_V1` internally. + * + * Client must include |client_chosen_version| passed to + * `ngtcp2_conn_client_new` in this array if this field is set and + * |client_chosen_version| is not a reserved version. If this field + * is not set, |client_chosen_version| passed to + * `ngtcp2_conn_client_new` will be set in this field internally + * unless |client_chosen_version| is a reserved version. + */ + const uint32_t *available_versions; + /** + * :member:`available_versionslen` is the number of versions that + * are contained in the array pointed by + * :member:`available_versions`. + */ + size_t available_versionslen; + /** + * :member:`original_version` is the original version that client + * initially used to make a connection attempt. If it is set, and + * it differs from |client_chosen_version| passed to + * `ngtcp2_conn_client_new`, the library assumes that client reacted + * upon Version Negotiation packet. Server does not use this field. + */ + uint32_t original_version; + /** + * :member:`no_pmtud`, if set to nonzero, disables Path MTU + * Discovery. + */ + uint8_t no_pmtud; + /** + * :member:`initial_pkt_num` is the initial packet number for each + * packet number space. It must be in range [0, INT32_MAX], + * inclusive. + */ + uint32_t initial_pkt_num; + /* The following fields have been added since NGTCP2_SETTINGS_V2. */ + /** + * :member:`pmtud_probes` is the array of UDP datagram payload size + * to probe during Path MTU Discovery. The discovery is done in the + * order appeared in this array. The size must be strictly larger + * than 1200, otherwise the behavior is undefined. The maximum + * value in this array should be set to + * :member:`max_tx_udp_payload_size`. If this field is not set, the + * predefined PMTUD probes are made. This field has been available + * since v1.4.0. + */ + const uint16_t *pmtud_probes; + /** + * :member:`pmtud_probeslen` is the number of elements that are + * contained in the array pointed by :member:`pmtud_probes`. This + * field has been available since v1.4.0. + */ + size_t pmtud_probeslen; +} ngtcp2_settings; + +/** + * @struct + * + * :type:`ngtcp2_addr` is the endpoint address. + */ +typedef struct ngtcp2_addr { + /** + * :member:`addr` points to the buffer which contains endpoint + * address. It must not be ``NULL``. + */ + ngtcp2_sockaddr *addr; + /** + * :member:`addrlen` is the length of :member:`addr`. It must not + * be longer than sizeof(:type:`ngtcp2_sockaddr_union`). + */ + ngtcp2_socklen addrlen; +} ngtcp2_addr; + +/** + * @struct + * + * :type:`ngtcp2_path` is the network endpoints where a packet is sent + * and received. + */ +typedef struct ngtcp2_path { + /** + * :member:`local` is the address of local endpoint. + */ + ngtcp2_addr local; + /** + * :member:`remote` is the address of remote endpoint. + */ + ngtcp2_addr remote; + /** + * :member:`user_data` is an arbitrary data and opaque to the + * library. + * + * Note that :type:`ngtcp2_path` is generally passed to + * :type:`ngtcp2_conn` by an application, and :type:`ngtcp2_conn` + * stores their copies. Unfortunately, there is no way for the + * application to know when :type:`ngtcp2_conn` finished using a + * specific :type:`ngtcp2_path` object in mid connection, which + * means that the application cannot free the data pointed by this + * field. Therefore, it is advised to use this field only when the + * data pointed by this field persists in an entire lifetime of the + * connection. + */ + void *user_data; +} ngtcp2_path; + +/** + * @struct + * + * :type:`ngtcp2_path_storage` is a convenient struct to have buffers + * to store the longest addresses. + */ +typedef struct ngtcp2_path_storage { + /** + * :member:`path` stores network path. + */ + ngtcp2_path path; + /** + * :member:`local_addrbuf` is a buffer to store local address. + */ + ngtcp2_sockaddr_union local_addrbuf; + /** + * :member:`remote_addrbuf` is a buffer to store remote address. + */ + ngtcp2_sockaddr_union remote_addrbuf; +} ngtcp2_path_storage; + +/** + * @struct + * + * :type:`ngtcp2_crypto_md` is a wrapper around native message digest + * object. + */ +typedef struct ngtcp2_crypto_md { + /** + * :member:`native_handle` is a pointer to an underlying message + * digest object. + */ + void *native_handle; +} ngtcp2_crypto_md; + +/** + * @struct + * + * :type:`ngtcp2_crypto_aead` is a wrapper around native AEAD object. + */ +typedef struct ngtcp2_crypto_aead { + /** + * :member:`native_handle` is a pointer to an underlying AEAD + * object. + */ + void *native_handle; + /** + * :member:`max_overhead` is the number of additional bytes which + * AEAD encryption needs on encryption. + */ + size_t max_overhead; +} ngtcp2_crypto_aead; + +/** + * @struct + * + * :type:`ngtcp2_crypto_cipher` is a wrapper around native cipher + * object. + */ +typedef struct ngtcp2_crypto_cipher { + /** + * :member:`native_handle` is a pointer to an underlying cipher + * object. + */ + void *native_handle; +} ngtcp2_crypto_cipher; + +/** + * @struct + * + * :type:`ngtcp2_crypto_aead_ctx` is a wrapper around native AEAD + * cipher context object. It should be initialized with a specific + * key. ngtcp2 library reuses this context object to encrypt or + * decrypt multiple packets. + */ +typedef struct ngtcp2_crypto_aead_ctx { + /** + * :member:`native_handle` is a pointer to an underlying AEAD + * context object. + */ + void *native_handle; +} ngtcp2_crypto_aead_ctx; + +/** + * @struct + * + * :type:`ngtcp2_crypto_cipher_ctx` is a wrapper around native cipher + * context object. It should be initialized with a specific key. + * ngtcp2 library reuses this context object to encrypt or decrypt + * multiple packet headers. + */ +typedef struct ngtcp2_crypto_cipher_ctx { + /** + * :member:`native_handle` is a pointer to an underlying cipher + * context object. + */ + void *native_handle; +} ngtcp2_crypto_cipher_ctx; + +/** + * @struct + * + * :type:`ngtcp2_crypto_ctx` is a convenient structure to bind all + * crypto related objects in one place. Use + * `ngtcp2_crypto_ctx_initial` to initialize this struct for Initial + * packet encryption. For Handshake and 1-RTT packets, use + * `ngtcp2_crypto_ctx_tls`. For 0-RTT packets, use + * `ngtcp2_crypto_ctx_tls_early`. + */ +typedef struct ngtcp2_crypto_ctx { + /** + * :member:`aead` is AEAD object. + */ + ngtcp2_crypto_aead aead; + /** + * :member:`md` is message digest object. + */ + ngtcp2_crypto_md md; + /** + * :member:`hp` is header protection cipher. + */ + ngtcp2_crypto_cipher hp; + /** + * :member:`max_encryption` is the number of encryption which this + * key can be used with. + */ + uint64_t max_encryption; + /** + * :member:`max_decryption_failure` is the number of decryption + * failure with this key. + */ + uint64_t max_decryption_failure; +} ngtcp2_crypto_ctx; + +/** + * @function + * + * `ngtcp2_transport_params_encode` encodes |params| in |dest| of + * length |destlen|. + * + * If |dest| is NULL, and |destlen| is zero, this function just + * returns the number of bytes required to store the encoded transport + * parameters. + * + * This function returns the number of bytes written, or one of the + * following negative error codes: + * + * :macro:`NGTCP2_ERR_NOBUF` + * Buffer is too small. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_transport_params_encode_versioned( + uint8_t *dest, size_t destlen, int transport_params_version, + const ngtcp2_transport_params *params); + +/** + * @function + * + * `ngtcp2_transport_params_decode` decodes transport parameters in + * |data| of length |datalen|, and stores the result in the object + * pointed by |params|. + * + * If an optional parameter is missing, the default value is assigned. + * + * The following fields may point to somewhere inside the buffer + * pointed by |data| of length |datalen|: + * + * - :member:`ngtcp2_transport_params.version_info.available_versions + * ` + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_MALFORMED_TRANSPORT_PARAM` + * The input is malformed. + */ +NGTCP2_EXTERN int +ngtcp2_transport_params_decode_versioned(int transport_params_version, + ngtcp2_transport_params *params, + const uint8_t *data, size_t datalen); + +/** + * @function + * + * `ngtcp2_transport_params_decode_new` decodes transport parameters + * in |data| of length |datalen|, and stores the result in the object + * allocated dynamically. The pointer to the allocated object is + * assigned to |*pparams|. Unlike `ngtcp2_transport_params_decode`, + * all direct and indirect fields are also allocated dynamically if + * needed. + * + * |mem| is a memory allocator to allocate memory. If |mem| is + * ``NULL``, the memory allocator returned by `ngtcp2_mem_default()` + * is used. + * + * If the optional parameters are missing, the default value is + * assigned. + * + * `ngtcp2_transport_params_del` frees the memory allocated by this + * function. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_MALFORMED_TRANSPORT_PARAM` + * The input is malformed. + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory. + */ +NGTCP2_EXTERN int +ngtcp2_transport_params_decode_new(ngtcp2_transport_params **pparams, + const uint8_t *data, size_t datalen, + const ngtcp2_mem *mem); + +/** + * @function + * + * `ngtcp2_transport_params_del` frees the |params| which must be + * dynamically allocated by `ngtcp2_transport_params_decode_new`. + * + * |mem| is a memory allocator that allocated |params|. If |mem| is + * ``NULL``, the memory allocator returned by `ngtcp2_mem_default()` + * is used. + * + * If |params| is ``NULL``, this function does nothing. + */ +NGTCP2_EXTERN void ngtcp2_transport_params_del(ngtcp2_transport_params *params, + const ngtcp2_mem *mem); + +/** + * @struct + * + * :type:`ngtcp2_version_cid` is a convenient struct to store the + * result of `ngtcp2_pkt_decode_version_cid`. + */ +typedef struct ngtcp2_version_cid { + /** + * :member:`version` stores QUIC version. + */ + uint32_t version; + /** + * :member:`dcid` points to the Destination Connection ID. + */ + const uint8_t *dcid; + /** + * :member:`dcidlen` is the length of the Destination Connection ID + * pointed by :member:`dcid`. + */ + size_t dcidlen; + /** + * :member:`scid` points to the Source Connection ID. + */ + const uint8_t *scid; + /** + * :member:`scidlen` is the length of the Source Connection ID + * pointed by :member:`scid`. + */ + size_t scidlen; +} ngtcp2_version_cid; + +/** + * @function + * + * `ngtcp2_pkt_decode_version_cid` extracts QUIC version, Destination + * Connection ID and Source Connection ID from the packet pointed by + * |data| of length |datalen|. This function can handle Connection ID + * up to 255 bytes unlike `ngtcp2_pkt_decode_hd_long` or + * `ngtcp2_pkt_decode_hd_short` which are only capable of handling + * Connection ID less than or equal to :macro:`NGTCP2_MAX_CIDLEN`. + * Longer Connection ID is only valid if the version is unsupported + * QUIC version. + * + * If the given packet is Long header packet, this function extracts + * the version from the packet, and assigns it to + * :member:`dest->version `. It also + * extracts the pointer to the Destination Connection ID and its + * length, and assigns them to :member:`dest->dcid + * ` and :member:`dest->dcidlen + * ` respectively. Similarly, it extracts + * the pointer to the Source Connection ID and its length, and assigns + * them to :member:`dest->scid ` and + * :member:`dest->scidlen ` respectively. + * |short_dcidlen| is ignored. + * + * If the given packet is Short header packet, :member:`dest->version + * ` will be 0, :member:`dest->scid + * ` will be ``NULL``, and + * :member:`dest->scidlen ` will be 0. + * Because the Short header packet does not have the length of + * Destination Connection ID, the caller has to pass the length in + * |short_dcidlen|. This function extracts the pointer to the + * Destination Connection ID, and assigns it to :member:`dest->dcid + * `. |short_dcidlen| is assigned to + * :member:`dest->dcidlen `. + * + * If Version Negotiation is required, this function returns + * :macro:`NGTCP2_ERR_VERSION_NEGOTIATION`. Unlike the other error + * cases, all fields of |dest| are assigned as described above. + * + * This function returns 0 if it succeeds. Otherwise, one of the + * following negative error code: + * + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` + * The function could not decode the packet header. + * :macro:`NGTCP2_ERR_VERSION_NEGOTIATION` + * Version Negotiation packet should be sent. + */ +NGTCP2_EXTERN int ngtcp2_pkt_decode_version_cid(ngtcp2_version_cid *dest, + const uint8_t *data, + size_t datalen, + size_t short_dcidlen); + +/** + * @function + * + * `ngtcp2_pkt_decode_hd_long` decodes QUIC long packet header in + * |pkt| of length |pktlen|. This function only parses the input just + * before packet number field. + * + * This function does not verify that length field is correct. In + * other words, this function succeeds even if length > |pktlen|. + * + * This function can handle Connection ID up to + * :macro:`NGTCP2_MAX_CIDLEN`. Consider to use + * `ngtcp2_pkt_decode_version_cid` to get longer Connection ID. + * + * This function handles Version Negotiation specially. If version + * field is 0, |pkt| must contain Version Negotiation packet. Version + * Negotiation packet has random type in wire format. For + * convenience, this function sets + * :enum:`ngtcp2_pkt_type.NGTCP2_PKT_VERSION_NEGOTIATION` to + * :member:`dest->type `, clears + * :macro:`NGTCP2_PKT_FLAG_LONG_FORM` flag from :member:`dest->flags + * `, and sets 0 to :member:`dest->len + * `. Version Negotiation packet occupies a single + * packet. + * + * It stores the result in the object pointed by |dest|, and returns + * the number of bytes decoded to read the packet header if it + * succeeds, or one of the following error codes: + * + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` + * Packet is too short; or it is not a long header + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_pkt_decode_hd_long(ngtcp2_pkt_hd *dest, + const uint8_t *pkt, + size_t pktlen); + +/** + * @function + * + * `ngtcp2_pkt_decode_hd_short` decodes QUIC short header in |pkt| of + * length |pktlen|. Short header packet does not encode the length of + * Connection ID, thus we need the input from the outside. |dcidlen| + * is the length of Destination Connection ID in packet header. This + * function only parses the input just before packet number field. + * This function can handle Connection ID up to + * :macro:`NGTCP2_MAX_CIDLEN`. Consider to use + * `ngtcp2_pkt_decode_version_cid` to get longer Connection ID. It + * stores the result in the object pointed by |dest|, and returns the + * number of bytes decoded to read the packet header if it succeeds, + * or one of the following error codes: + * + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` + * Packet is too short; or it is not a short header + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_pkt_decode_hd_short(ngtcp2_pkt_hd *dest, + const uint8_t *pkt, + size_t pktlen, + size_t dcidlen); + +/** + * @function + * + * `ngtcp2_pkt_write_stateless_reset` writes Stateless Reset packet in + * the buffer pointed by |dest| whose length is |destlen|. + * |stateless_reset_token| is a pointer to the Stateless Reset Token, + * and its length must be :macro:`NGTCP2_STATELESS_RESET_TOKENLEN` + * bytes long. |rand| specifies the random octets preceding Stateless + * Reset Token. The length of |rand| is specified by |randlen| which + * must be at least :macro:`NGTCP2_MIN_STATELESS_RESET_RANDLEN` bytes + * long. + * + * If |randlen| is too long to write them all in the buffer, |rand| is + * written to the buffer as much as possible, and is truncated. + * + * This function returns the number of bytes written to the buffer, or + * one of the following negative error codes: + * + * :macro:`NGTCP2_ERR_NOBUF` + * Buffer is too small. + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` + * |randlen| is strictly less than + * :macro:`NGTCP2_MIN_STATELESS_RESET_RANDLEN`. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_pkt_write_stateless_reset( + uint8_t *dest, size_t destlen, const uint8_t *stateless_reset_token, + const uint8_t *rand, size_t randlen); + +/** + * @function + * + * `ngtcp2_pkt_write_version_negotiation` writes Version Negotiation + * packet in the buffer pointed by |dest| whose length is |destlen|. + * |unused_random| should be generated randomly. |dcid| is a + * Connection ID which appeared in a packet as a Source Connection ID + * sent by client which caused version negotiation. Similarly, |scid| + * is a Connection ID which appeared in a packet as a Destination + * Connection ID sent by client. |sv| is a list of supported + * versions, and |nsv| specifies the number of supported versions + * included in |sv|. + * + * This function returns the number of bytes written to the buffer, or + * one of the following negative error codes: + * + * :macro:`NGTCP2_ERR_NOBUF` + * Buffer is too small. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_pkt_write_version_negotiation( + uint8_t *dest, size_t destlen, uint8_t unused_random, const uint8_t *dcid, + size_t dcidlen, const uint8_t *scid, size_t scidlen, const uint32_t *sv, + size_t nsv); + +/** + * @struct + * + * :type:`ngtcp2_conn` represents a single QUIC connection. + */ +typedef struct ngtcp2_conn ngtcp2_conn; + +/** + * @functypedef + * + * :type:`ngtcp2_client_initial` is invoked when client application + * asks TLS stack to produce first TLS cryptographic handshake data. + * + * This implementation of this callback must get the first handshake + * data from TLS stack, and pass it to ngtcp2 library using + * `ngtcp2_conn_submit_crypto_data` function. Make sure that before + * calling `ngtcp2_conn_submit_crypto_data` function, client + * application must create initial packet protection keys and IVs, and + * provide them to ngtcp2 library using + * `ngtcp2_conn_install_initial_key`. + * + * This callback function must return 0 if it succeeds, or + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` which makes the library call + * return immediately. + */ +typedef int (*ngtcp2_client_initial)(ngtcp2_conn *conn, void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_recv_client_initial` is invoked when server receives + * Initial packet from client. An server application must implement + * this callback, and generate initial keys and IVs for both + * transmission and reception. Install them using + * `ngtcp2_conn_install_initial_key`. |dcid| is the Destination + * Connection ID in Initial packet received from client. It is used + * to derive initial packet protection keys. + * + * The callback function must return 0 if it succeeds. If an error + * occurs, return :macro:`NGTCP2_ERR_CALLBACK_FAILURE` which makes the + * library call return immediately. + */ +typedef int (*ngtcp2_recv_client_initial)(ngtcp2_conn *conn, + const ngtcp2_cid *dcid, + void *user_data); + +/** + * @enum + * + * :type:`ngtcp2_encryption_level` is QUIC encryption level. + */ +typedef enum ngtcp2_encryption_level { + /** + * :enum:`NGTCP2_ENCRYPTION_LEVEL_INITIAL` is Initial encryption + * level. + */ + NGTCP2_ENCRYPTION_LEVEL_INITIAL, + /** + * :enum:`NGTCP2_ENCRYPTION_LEVEL_HANDSHAKE` is Handshake encryption + * level. + */ + NGTCP2_ENCRYPTION_LEVEL_HANDSHAKE, + /** + * :enum:`NGTCP2_ENCRYPTION_LEVEL_1RTT` is 1-RTT encryption level. + */ + NGTCP2_ENCRYPTION_LEVEL_1RTT, + /** + * :enum:`NGTCP2_ENCRYPTION_LEVEL_0RTT` is 0-RTT encryption level. + */ + NGTCP2_ENCRYPTION_LEVEL_0RTT +} ngtcp2_encryption_level; + +/** + * @functypedef + * + * :type`ngtcp2_recv_crypto_data` is invoked when crypto data is + * received. The received data is pointed by |data|, and its length + * is |datalen|. The |offset| specifies the offset where |data| is + * positioned. |user_data| is the arbitrary pointer passed to + * `ngtcp2_conn_client_new` or `ngtcp2_conn_server_new`. The ngtcp2 + * library ensures that the crypto data is passed to the application + * in the increasing order of |offset|. |datalen| is always strictly + * greater than 0. |encryption_level| indicates the encryption level + * where this data is received. Crypto data can never be received in + * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`. + * + * The application should provide the given data to TLS stack. + * + * The callback function must return 0 if it succeeds, or one of the + * following negative error codes: + * + * - :macro:`NGTCP2_ERR_CRYPTO` + * - :macro:`NGTCP2_ERR_REQUIRED_TRANSPORT_PARAM` + * - :macro:`NGTCP2_ERR_MALFORMED_TRANSPORT_PARAM` + * - :macro:`NGTCP2_ERR_TRANSPORT_PARAM` + * - :macro:`NGTCP2_ERR_PROTO` + * - :macro:`NGTCP2_ERR_VERSION_NEGOTIATION_FAILURE` + * - :macro:`NGTCP2_ERR_NOMEM` + * - :macro:`NGTCP2_ERR_CALLBACK_FAILURE` + * + * If the other value is returned, it is treated as + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE`. + * + * If application encounters fatal error, return + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` which makes the library call + * return immediately. + */ +typedef int (*ngtcp2_recv_crypto_data)(ngtcp2_conn *conn, + ngtcp2_encryption_level encryption_level, + uint64_t offset, const uint8_t *data, + size_t datalen, void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_handshake_completed` is invoked when QUIC + * cryptographic handshake has completed. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_handshake_completed)(ngtcp2_conn *conn, void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_handshake_confirmed` is invoked when QUIC + * cryptographic handshake is confirmed. The handshake confirmation + * means that both endpoints agree that handshake has finished. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_handshake_confirmed)(ngtcp2_conn *conn, void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_recv_version_negotiation` is invoked when Version + * Negotiation packet is received. |hd| is the pointer to the QUIC + * packet header object. The vector |sv| of |nsv| elements contains + * the QUIC version the server supports. Since Version Negotiation is + * only sent by server, this callback function is used by client only. + * + * The callback function must return 0 if it succeeds, or + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` which makes the library call + * return immediately. + */ +typedef int (*ngtcp2_recv_version_negotiation)(ngtcp2_conn *conn, + const ngtcp2_pkt_hd *hd, + const uint32_t *sv, size_t nsv, + void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_recv_retry` is invoked when Retry packet is received. + * This callback is client use only. + * + * Application must regenerate packet protection key, IV, and header + * protection key for Initial packets using the Destination Connection + * ID obtained by :member:`hd->scid `, and install + * them by calling `ngtcp2_conn_install_initial_key`. + * + * 0-RTT data accepted by the ngtcp2 library will be automatically + * retransmitted as 0-RTT data by the library. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_recv_retry)(ngtcp2_conn *conn, const ngtcp2_pkt_hd *hd, + void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_encrypt` is invoked when the ngtcp2 library asks the + * application to encrypt packet payload. The packet payload to + * encrypt is passed as |plaintext| of length |plaintextlen|. The + * AEAD cipher is |aead|. |aead_ctx| is the AEAD cipher context + * object which is initialized with the specific encryption key. The + * nonce is passed as |nonce| of length |noncelen|. The Additional + * Authenticated Data is passed as |aad| of length |aadlen|. + * + * The implementation of this callback must encrypt |plaintext| using + * the negotiated cipher suite, and write the ciphertext into the + * buffer pointed by |dest|. |dest| has enough capacity to store the + * ciphertext and any additional AEAD tag data. + * + * |dest| and |plaintext| may point to the same buffer. + * + * The callback function must return 0 if it succeeds, or + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` which makes the library call + * return immediately. + */ +typedef int (*ngtcp2_encrypt)(uint8_t *dest, const ngtcp2_crypto_aead *aead, + const ngtcp2_crypto_aead_ctx *aead_ctx, + const uint8_t *plaintext, size_t plaintextlen, + const uint8_t *nonce, size_t noncelen, + const uint8_t *aad, size_t aadlen); + +/** + * @functypedef + * + * :type:`ngtcp2_decrypt` is invoked when the ngtcp2 library asks the + * application to decrypt packet payload. The packet payload to + * decrypt is passed as |ciphertext| of length |ciphertextlen|. The + * AEAD cipher is |aead|. |aead_ctx| is the AEAD cipher context + * object which is initialized with the specific decryption key. The + * nonce is passed as |nonce| of length |noncelen|. The Additional + * Authenticated Data is passed as |aad| of length |aadlen|. + * + * The implementation of this callback must decrypt |ciphertext| using + * the negotiated cipher suite, and write the ciphertext into the + * buffer pointed by |dest|. |dest| has enough capacity to store the + * cleartext. + * + * |dest| and |ciphertext| may point to the same buffer. + * + * The callback function must return 0 if it succeeds. If TLS stack + * fails to decrypt data, return :macro:`NGTCP2_ERR_DECRYPT`. For any + * other errors, return :macro:`NGTCP2_ERR_CALLBACK_FAILURE` which + * makes the library call return immediately. + */ +typedef int (*ngtcp2_decrypt)(uint8_t *dest, const ngtcp2_crypto_aead *aead, + const ngtcp2_crypto_aead_ctx *aead_ctx, + const uint8_t *ciphertext, size_t ciphertextlen, + const uint8_t *nonce, size_t noncelen, + const uint8_t *aad, size_t aadlen); + +/** + * @functypedef + * + * :type:`ngtcp2_hp_mask` is invoked when the ngtcp2 library asks the + * application to produce a mask to encrypt or decrypt packet header. + * The encryption cipher is |hp|. |hp_ctx| is the cipher context + * object which is initialized with the specific header protection + * key. The sample is passed as |sample| which is + * :macro:`NGTCP2_HP_SAMPLELEN` bytes long. + * + * The implementation of this callback must produce a mask using the + * header protection cipher suite specified by QUIC specification, and + * write the result into the buffer pointed by |dest|. The length of + * the mask must be at least :macro:`NGTCP2_HP_MASKLEN`. The library + * only uses the first :macro:`NGTCP2_HP_MASKLEN` bytes of the + * produced mask. The buffer pointed by |dest| is guaranteed to have + * at least :macro:`NGTCP2_HP_SAMPLELEN` bytes available for + * convenience. + * + * The callback function must return 0 if it succeeds, or + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` which makes the library call + * return immediately. + */ +typedef int (*ngtcp2_hp_mask)(uint8_t *dest, const ngtcp2_crypto_cipher *hp, + const ngtcp2_crypto_cipher_ctx *hp_ctx, + const uint8_t *sample); + +/** + * @macrosection + * + * STREAM frame data flags + */ + +/** + * @macro + * + * :macro:`NGTCP2_STREAM_DATA_FLAG_NONE` indicates no flag set. + */ +#define NGTCP2_STREAM_DATA_FLAG_NONE 0x00u + +/** + * @macro + * + * :macro:`NGTCP2_STREAM_DATA_FLAG_FIN` indicates that this chunk of + * data is final piece of an incoming stream. + */ +#define NGTCP2_STREAM_DATA_FLAG_FIN 0x01u + +/** + * @macro + * + * :macro:`NGTCP2_STREAM_DATA_FLAG_0RTT` indicates that this chunk of + * data contains data received in 0-RTT packet, and the handshake has + * not completed yet, which means that the data might be replayed. + */ +#define NGTCP2_STREAM_DATA_FLAG_0RTT 0x02u + +/** + * @functypedef + * + * :type:`ngtcp2_recv_stream_data` is invoked when stream data is + * received. The stream is specified by |stream_id|. |flags| is the + * bitwise-OR of zero or more of :macro:`NGTCP2_STREAM_DATA_FLAG_* + * `. If |flags| & + * :macro:`NGTCP2_STREAM_DATA_FLAG_FIN` is nonzero, this portion of + * the data is the last data in this stream. |offset| is the offset + * where this data begins. The library ensures that data is passed to + * the application in the non-decreasing order of |offset| without any + * overlap. The data is passed as |data| of length |datalen|. + * |datalen| may be 0 if and only if |fin| is nonzero. + * + * If :macro:`NGTCP2_STREAM_DATA_FLAG_0RTT` is set in |flags|, it + * indicates that a part of or whole data was received in 0-RTT + * packet, and a handshake has not completed yet. + * + * The callback function must return 0 if it succeeds, or + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` which makes the library return + * immediately. + */ +typedef int (*ngtcp2_recv_stream_data)(ngtcp2_conn *conn, uint32_t flags, + int64_t stream_id, uint64_t offset, + const uint8_t *data, size_t datalen, + void *user_data, void *stream_user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_stream_open` is a callback function which is called + * when remote stream is opened by a remote endpoint. This function + * is not called if stream is opened by implicitly (we might + * reconsider this behaviour later). + * + * The implementation of this callback should return 0 if it succeeds. + * Returning :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library + * call return immediately. + */ +typedef int (*ngtcp2_stream_open)(ngtcp2_conn *conn, int64_t stream_id, + void *user_data); + +/** + * @macrosection + * + * Stream close flags + */ + +/** + * @macro + * + * :macro:`NGTCP2_STREAM_CLOSE_FLAG_NONE` indicates no flag set. + */ +#define NGTCP2_STREAM_CLOSE_FLAG_NONE 0x00u + +/** + * @macro + * + * :macro:`NGTCP2_STREAM_CLOSE_FLAG_APP_ERROR_CODE_SET` indicates that + * app_error_code parameter is set. + */ +#define NGTCP2_STREAM_CLOSE_FLAG_APP_ERROR_CODE_SET 0x01u + +/** + * @functypedef + * + * :type:`ngtcp2_stream_close` is invoked when a stream is closed. + * This callback is not called when QUIC connection is closed before + * existing streams are closed. |flags| is the bitwise-OR of zero or + * more of :macro:`NGTCP2_STREAM_CLOSE_FLAG_* + * `. |app_error_code| indicates the + * error code of this closure if + * :macro:`NGTCP2_STREAM_CLOSE_FLAG_APP_ERROR_CODE_SET` is set in + * |flags|. If it is not set, the stream was closed without any error + * code, which generally means success. + * + * |app_error_code| is the first application error code sent by a + * local endpoint, or received from a remote endpoint. If a stream is + * closed cleanly, no application error code is exchanged. Since QUIC + * stack does not know the application error code which indicates "no + * errors", |app_error_code| is set to 0 and + * :macro:`NGTCP2_STREAM_CLOSE_FLAG_APP_ERROR_CODE_SET` is not set in + * |flags| in this case. + * + * The implementation of this callback should return 0 if it succeeds. + * Returning :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library + * call return immediately. + */ +typedef int (*ngtcp2_stream_close)(ngtcp2_conn *conn, uint32_t flags, + int64_t stream_id, uint64_t app_error_code, + void *user_data, void *stream_user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_stream_reset` is invoked when a stream identified by + * |stream_id| is reset by a remote endpoint. + * + * The implementation of this callback should return 0 if it succeeds. + * Returning :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library + * call return immediately. + */ +typedef int (*ngtcp2_stream_reset)(ngtcp2_conn *conn, int64_t stream_id, + uint64_t final_size, uint64_t app_error_code, + void *user_data, void *stream_user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_acked_stream_data_offset` is a callback function + * which is called when stream data in range [|offset|, |offset| + + * |datalen|) is acknowledged, and application can free the portion of + * data. For a given |stream_id|, this callback is called + * sequentially in increasing order of |offset| without any overlap. + * |datalen| is normally strictly greater than 0. One exception is + * that when a STREAM frame has fin flag set and 0 length data, this + * callback is invoked with |datalen| == 0. + * + * If a stream is closed prematurely, and stream data is still + * in-flight, this callback function is not called for those data. + * After :member:`ngtcp2_callbacks.stream_close` is called for a + * particular stream, |conn| does not touch data for the closed stream + * again, and application can free all unacknowledged stream data. + * + * The implementation of this callback should return 0 if it succeeds. + * Returning :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library + * call return immediately. + */ +typedef int (*ngtcp2_acked_stream_data_offset)( + ngtcp2_conn *conn, int64_t stream_id, uint64_t offset, uint64_t datalen, + void *user_data, void *stream_user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_recv_stateless_reset` is a callback function which is + * called when Stateless Reset packet is received. The stateless + * reset details are given in |sr|. + * + * The implementation of this callback should return 0 if it succeeds. + * Returning :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library + * call return immediately. + */ +typedef int (*ngtcp2_recv_stateless_reset)(ngtcp2_conn *conn, + const ngtcp2_pkt_stateless_reset *sr, + void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_extend_max_streams` is a callback function which is + * called every time max stream ID is strictly extended. + * |max_streams| is the cumulative number of streams which an endpoint + * can open. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_extend_max_streams)(ngtcp2_conn *conn, + uint64_t max_streams, void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_extend_max_stream_data` is a callback function which + * is invoked when max stream data is extended. |stream_id| + * identifies the stream. |max_data| is a cumulative number of bytes + * an endpoint can send on this stream. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_extend_max_stream_data)(ngtcp2_conn *conn, + int64_t stream_id, + uint64_t max_data, void *user_data, + void *stream_user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_rand` is a callback function to get random data of + * length |destlen|. Application must fill random |destlen| bytes to + * the buffer pointed by |dest|. The generated data is used only in + * non-cryptographic context. But it is strongly recommended to use a + * secure random number generator. + */ +typedef void (*ngtcp2_rand)(uint8_t *dest, size_t destlen, + const ngtcp2_rand_ctx *rand_ctx); + +/** + * @functypedef + * + * :type:`ngtcp2_get_new_connection_id` is a callback function to ask + * an application for new connection ID. Application must generate + * new unused connection ID with the exact |cidlen| bytes, and store + * it in |cid|. It also has to generate a stateless reset token, and + * store it in |token|. The length of stateless reset token is + * :macro:`NGTCP2_STATELESS_RESET_TOKENLEN` and it is guaranteed that + * the buffer pointed by |token| has the sufficient space to store the + * token. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_get_new_connection_id)(ngtcp2_conn *conn, ngtcp2_cid *cid, + uint8_t *token, size_t cidlen, + void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_remove_connection_id` is a callback function which + * notifies the application that connection ID |cid| is no longer used + * by a remote endpoint. This Connection ID was previously offered by + * a local endpoint, and a remote endpoint could use it as Destination + * Connection ID when sending QUIC packet. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_remove_connection_id)(ngtcp2_conn *conn, + const ngtcp2_cid *cid, + void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_update_key` is a callback function which tells the + * application that it must generate new packet protection keying + * materials and AEAD cipher context objects with new keys. The + * current set of secrets are given as |current_rx_secret| and + * |current_tx_secret| of length |secretlen|. They are decryption and + * encryption secrets respectively. + * + * The application must generate new secrets and keys for both + * encryption and decryption. It must write decryption secret and IV + * to the buffer pointed by |rx_secret| and |rx_iv| respectively. It + * also must create new AEAD cipher context object with new decryption + * key and initialize |rx_aead_ctx| with it. Similarly, write + * encryption secret and IV to the buffer pointed by |tx_secret| and + * |tx_iv|. Create new AEAD cipher context object with new encryption + * key and initialize |tx_aead_ctx| with it. All given buffers have + * the enough capacity to store secret, key and IV. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_update_key)( + ngtcp2_conn *conn, uint8_t *rx_secret, uint8_t *tx_secret, + ngtcp2_crypto_aead_ctx *rx_aead_ctx, uint8_t *rx_iv, + ngtcp2_crypto_aead_ctx *tx_aead_ctx, uint8_t *tx_iv, + const uint8_t *current_rx_secret, const uint8_t *current_tx_secret, + size_t secretlen, void *user_data); + +/** + * @macrosection + * + * Path validation related macros + */ + +/** + * @macro + * + * :macro:`NGTCP2_PATH_VALIDATION_FLAG_NONE` indicates no flag set. + */ +#define NGTCP2_PATH_VALIDATION_FLAG_NONE 0x00u + +/** + * @macro + * + * :macro:`NGTCP2_PATH_VALIDATION_FLAG_PREFERRED_ADDR` indicates the + * validation involving server preferred address. This flag is only + * set for client. + */ +#define NGTCP2_PATH_VALIDATION_FLAG_PREFERRED_ADDR 0x01u + +/** + * @macro + * + * :macro:`NGTCP2_PATH_VALIDATION_FLAG_NEW_TOKEN` indicates that + * server should send NEW_TOKEN frame for the new remote address. + * This flag is only set for server. + */ +#define NGTCP2_PATH_VALIDATION_FLAG_NEW_TOKEN 0x02u + +/** + * @functypedef + * + * :type:`ngtcp2_path_validation` is a callback function which tells + * an application the outcome of path validation. |flags| is zero or + * more of :macro:`NGTCP2_PATH_VALIDATION_FLAG_* + * `. |path| is the path that was + * validated. |old_path| is the path that is previously used before a + * local endpoint has migrated to |path| if |old_path| is not NULL. + * If |res| is + * :enum:`ngtcp2_path_validation_result.NGTCP2_PATH_VALIDATION_RESULT_SUCCESS`, + * the path validation succeeded. If |res| is + * :enum:`ngtcp2_path_validation_result.NGTCP2_PATH_VALIDATION_RESULT_FAILURE`, + * the path validation failed. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_path_validation)(ngtcp2_conn *conn, uint32_t flags, + const ngtcp2_path *path, + const ngtcp2_path *old_path, + ngtcp2_path_validation_result res, + void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_select_preferred_addr` is a callback function which + * asks a client application to choose server address from preferred + * addresses |paddr| received from server. An application should + * write a network path for a selected preferred address in |dest|. + * More specifically, the selected preferred address must be set to + * :member:`dest->remote `, a client source + * address must be set to :member:`dest->local `. + * If a client source address does not change for the new server + * address, leave :member:`dest->local ` + * unmodified, or copy the value of :member:`local + * ` field of the current network path obtained + * from `ngtcp2_conn_get_path()`. Both :member:`dest->local.addr + * ` and :member:`dest->remote.addr + * ` point to buffers which are at least + * sizeof(:type:`ngtcp2_sockaddr_union`) bytes long, respectively. If + * an application denies the preferred addresses, just leave |dest| + * unmodified (or set :member:`dest->remote.addrlen + * ` to 0), and return 0. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_select_preferred_addr)(ngtcp2_conn *conn, + ngtcp2_path *dest, + const ngtcp2_preferred_addr *paddr, + void *user_data); + +/** + * @enum + * + * :type:`ngtcp2_connection_id_status_type` defines a set of status + * for Destination Connection ID. + */ +typedef enum ngtcp2_connection_id_status_type { + /** + * :enum:`NGTCP2_CONNECTION_ID_STATUS_TYPE_ACTIVATE` indicates that + * a local endpoint starts using new Destination Connection ID. + */ + NGTCP2_CONNECTION_ID_STATUS_TYPE_ACTIVATE, + /** + * :enum:`NGTCP2_CONNECTION_ID_STATUS_TYPE_DEACTIVATE` indicates + * that a local endpoint stops using a given Destination Connection + * ID. + */ + NGTCP2_CONNECTION_ID_STATUS_TYPE_DEACTIVATE +} ngtcp2_connection_id_status_type; + +/** + * @functypedef + * + * :type:`ngtcp2_connection_id_status` is a callback function which is + * called when the status of Destination Connection ID changes. + * + * |token| is the associated stateless reset token, and it is ``NULL`` + * if no token is present. + * + * |type| is the one of the value defined in + * :type:`ngtcp2_connection_id_status_type`. The new value might be + * added in the future release. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_connection_id_status)( + ngtcp2_conn *conn, ngtcp2_connection_id_status_type type, uint64_t seq, + const ngtcp2_cid *cid, const uint8_t *token, void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_recv_new_token` is a callback function which is + * called when new token is received from server. This callback is + * client use only. + * + * |token| is the received token of length |tokenlen| bytes long. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_recv_new_token)(ngtcp2_conn *conn, const uint8_t *token, + size_t tokenlen, void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_delete_crypto_aead_ctx` is a callback function which + * must delete the native object pointed by + * :member:`aead_ctx->native_handle + * `. + */ +typedef void (*ngtcp2_delete_crypto_aead_ctx)(ngtcp2_conn *conn, + ngtcp2_crypto_aead_ctx *aead_ctx, + void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_delete_crypto_cipher_ctx` is a callback function + * which must delete the native object pointed by + * :member:`cipher_ctx->native_handle + * `. + */ +typedef void (*ngtcp2_delete_crypto_cipher_ctx)( + ngtcp2_conn *conn, ngtcp2_crypto_cipher_ctx *cipher_ctx, void *user_data); + +/** + * @macrosection + * + * DATAGRAM frame flags + */ + +/** + * @macro + * + * :macro:`NGTCP2_DATAGRAM_FLAG_NONE` indicates no flag set. + */ +#define NGTCP2_DATAGRAM_FLAG_NONE 0x00u + +/** + * @macro + * + * :macro:`NGTCP2_DATAGRAM_FLAG_0RTT` indicates that DATAGRAM frame is + * received in 0-RTT packet, and the handshake has not completed yet, + * which means that the data might be replayed. + */ +#define NGTCP2_DATAGRAM_FLAG_0RTT 0x01u + +/** + * @functypedef + * + * :type:`ngtcp2_recv_datagram` is invoked when DATAGRAM frame is + * received. |flags| is bitwise-OR of zero or more of + * :macro:`NGTCP2_DATAGRAM_FLAG_* `. + * + * If :macro:`NGTCP2_DATAGRAM_FLAG_0RTT` is set in |flags|, it + * indicates that DATAGRAM frame was received in 0-RTT packet, and a + * handshake has not completed yet. + * + * The callback function must return 0 if it succeeds, or + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` which makes the library return + * immediately. + */ +typedef int (*ngtcp2_recv_datagram)(ngtcp2_conn *conn, uint32_t flags, + const uint8_t *data, size_t datalen, + void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_ack_datagram` is invoked when a packet which contains + * DATAGRAM frame which is identified by |dgram_id| is acknowledged. + * |dgram_id| is the valued passed to `ngtcp2_conn_writev_datagram`. + * + * The callback function must return 0 if it succeeds, or + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` which makes the library return + * immediately. + */ +typedef int (*ngtcp2_ack_datagram)(ngtcp2_conn *conn, uint64_t dgram_id, + void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_lost_datagram` is invoked when a packet which + * contains DATAGRAM frame which is identified by |dgram_id| is + * declared lost. |dgram_id| is the valued passed to + * `ngtcp2_conn_writev_datagram`. Note that the loss might be + * spurious, and DATAGRAM frame might be acknowledged later. + * + * The callback function must return 0 if it succeeds, or + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` which makes the library return + * immediately. + */ +typedef int (*ngtcp2_lost_datagram)(ngtcp2_conn *conn, uint64_t dgram_id, + void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_get_path_challenge_data` is a callback function to + * ask an application for new data that is sent in PATH_CHALLENGE + * frame. Application must generate new unpredictable, exactly + * :macro:`NGTCP2_PATH_CHALLENGE_DATALEN` bytes of random data, and + * store them into the buffer pointed by |data|. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_get_path_challenge_data)(ngtcp2_conn *conn, uint8_t *data, + void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_stream_stop_sending` is invoked when a stream is no + * longer read by a local endpoint before it receives all stream data. + * This function is called at most once per stream. |app_error_code| + * is the error code passed to `ngtcp2_conn_shutdown_stream_read` or + * `ngtcp2_conn_shutdown_stream`. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_stream_stop_sending)(ngtcp2_conn *conn, int64_t stream_id, + uint64_t app_error_code, + void *user_data, + void *stream_user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_version_negotiation` is invoked when the compatible + * version negotiation takes place. For client, it is called when it + * sees a change in version field of a long header packet. This + * callback function might be called multiple times for client. For + * server, it is called once when the version is negotiated. + * + * The implementation of this callback must install new Initial keys + * for |version| and Destination Connection ID |client_dcid| from + * client. Use `ngtcp2_conn_install_vneg_initial_key` to install + * keys. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_version_negotiation)(ngtcp2_conn *conn, uint32_t version, + const ngtcp2_cid *client_dcid, + void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_recv_key` is invoked when new key is installed to + * |conn| during QUIC cryptographic handshake. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_recv_key)(ngtcp2_conn *conn, ngtcp2_encryption_level level, + void *user_data); + +/** + * @functypedef + * + * :type:`ngtcp2_tls_early_data_rejected` is invoked when early data + * was rejected by server during TLS handshake, or client decided not + * to attempt early data. + * + * The callback function must return 0 if it succeeds. Returning + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` makes the library call return + * immediately. + */ +typedef int (*ngtcp2_tls_early_data_rejected)(ngtcp2_conn *conn, + void *user_data); + +#define NGTCP2_CALLBACKS_V1 1 +#define NGTCP2_CALLBACKS_VERSION NGTCP2_CALLBACKS_V1 + +/** + * @struct + * + * :type:`ngtcp2_callbacks` holds a set of callback functions. + */ +typedef struct ngtcp2_callbacks { + /** + * :member:`client_initial` is a callback function which is invoked + * when client asks TLS stack to produce first TLS cryptographic + * handshake message. This callback function must be specified for + * a client application. + */ + ngtcp2_client_initial client_initial; + /** + * :member:`recv_client_initial` is a callback function which is + * invoked when a server receives the first Initial packet from + * client. This callback function must be specified for a server + * application. + */ + ngtcp2_recv_client_initial recv_client_initial; + /** + * :member:`recv_crypto_data` is a callback function which is + * invoked when cryptographic data (CRYPTO frame, in other words, + * TLS message) is received. This callback function must be + * specified. + */ + ngtcp2_recv_crypto_data recv_crypto_data; + /** + * :member:`handshake_completed` is a callback function which is + * invoked when QUIC cryptographic handshake has completed. This + * callback function is optional. + */ + ngtcp2_handshake_completed handshake_completed; + /** + * :member:`recv_version_negotiation` is a callback function which + * is invoked when Version Negotiation packet is received by a + * client. This callback function is optional. + */ + ngtcp2_recv_version_negotiation recv_version_negotiation; + /** + * :member:`encrypt` is a callback function which is invoked to + * encrypt a QUIC packet. This callback function must be specified. + */ + ngtcp2_encrypt encrypt; + /** + * :member:`decrypt` is a callback function which is invoked to + * decrypt a QUIC packet. This callback function must be specified. + */ + ngtcp2_decrypt decrypt; + /** + * :member:`hp_mask` is a callback function which is invoked to get + * a mask to encrypt or decrypt QUIC packet header. This callback + * function must be specified. + */ + ngtcp2_hp_mask hp_mask; + /** + * :member:`recv_stream_data` is a callback function which is + * invoked when stream data, which includes application data, is + * received. This callback function is optional. + */ + ngtcp2_recv_stream_data recv_stream_data; + /** + * :member:`acked_stream_data_offset` is a callback function which + * is invoked when stream data, which includes application data, is + * acknowledged by a remote endpoint. It tells an application the + * largest offset of acknowledged stream data without a gap so that + * application can free memory for the data up to that offset. This + * callback function is optional. + */ + ngtcp2_acked_stream_data_offset acked_stream_data_offset; + /** + * :member:`stream_open` is a callback function which is invoked + * when new remote stream is opened by a remote endpoint. This + * callback function is optional. + */ + ngtcp2_stream_open stream_open; + /** + * :member:`stream_close` is a callback function which is invoked + * when a stream is closed. This callback function is optional. + */ + ngtcp2_stream_close stream_close; + /** + * :member:`recv_stateless_reset` is a callback function which is + * invoked when Stateless Reset packet is received. This callback + * function is optional. + */ + ngtcp2_recv_stateless_reset recv_stateless_reset; + /** + * :member:`recv_retry` is a callback function which is invoked when + * a client receives Retry packet. For client, this callback + * function must be specified. Server never receive Retry packet. + */ + ngtcp2_recv_retry recv_retry; + /** + * :member:`extend_max_local_streams_bidi` is a callback function + * which is invoked when the number of bidirectional stream which a + * local endpoint can open is increased. This callback function is + * optional. + */ + ngtcp2_extend_max_streams extend_max_local_streams_bidi; + /** + * :member:`extend_max_local_streams_uni` is a callback function + * which is invoked when the number of unidirectional stream which a + * local endpoint can open is increased. This callback function is + * optional. + */ + ngtcp2_extend_max_streams extend_max_local_streams_uni; + /** + * :member:`rand` is a callback function which is invoked when the + * library needs random data. This callback function must be + * specified. + */ + ngtcp2_rand rand; + /** + * :member:`get_new_connection_id` is a callback function which is + * invoked when the library needs new connection ID. This callback + * function must be specified. + */ + ngtcp2_get_new_connection_id get_new_connection_id; + /** + * :member:`remove_connection_id` is a callback function which + * notifies an application that connection ID is no longer used by a + * remote endpoint. This callback function is optional. + */ + ngtcp2_remove_connection_id remove_connection_id; + /** + * :member:`update_key` is a callback function which is invoked when + * the library tells an application that it must update keying + * materials, and install new keys. This callback function must be + * specified. + */ + ngtcp2_update_key update_key; + /** + * :member:`path_validation` is a callback function which is invoked + * when path validation completed. This callback function is + * optional. + */ + ngtcp2_path_validation path_validation; + /** + * :member:`select_preferred_addr` is a callback function which is + * invoked when the library asks a client to select preferred + * address presented by a server. If not set, client ignores + * preferred addresses. This callback function is optional. + */ + ngtcp2_select_preferred_addr select_preferred_addr; + /** + * :member:`stream_reset` is a callback function which is invoked + * when a stream is reset by a remote endpoint. This callback + * function is optional. + */ + ngtcp2_stream_reset stream_reset; + /** + * :member:`extend_max_remote_streams_bidi` is a callback function + * which is invoked when the number of bidirectional streams which a + * remote endpoint can open is increased. This callback function is + * optional. + */ + ngtcp2_extend_max_streams extend_max_remote_streams_bidi; + /** + * :member:`extend_max_remote_streams_uni` is a callback function + * which is invoked when the number of unidirectional streams which + * a remote endpoint can open is increased. This callback function + * is optional. + */ + ngtcp2_extend_max_streams extend_max_remote_streams_uni; + /** + * :member:`extend_max_stream_data` is callback function which is + * invoked when the maximum offset of stream data that a local + * endpoint can send is increased. This callback function is + * optional. + */ + ngtcp2_extend_max_stream_data extend_max_stream_data; + /** + * :member:`dcid_status` is a callback function which is invoked + * when the new Destination Connection ID is activated, or the + * activated Destination Connection ID is now deactivated. This + * callback function is optional. + */ + ngtcp2_connection_id_status dcid_status; + /** + * :member:`handshake_confirmed` is a callback function which is + * invoked when both endpoints agree that handshake has finished. + * This field is ignored by server because + * :member:`handshake_completed` also indicates the handshake + * confirmation for server. This callback function is optional. + */ + ngtcp2_handshake_confirmed handshake_confirmed; + /** + * :member:`recv_new_token` is a callback function which is invoked + * when new token is received from server. This field is ignored by + * server. This callback function is optional. + */ + ngtcp2_recv_new_token recv_new_token; + /** + * :member:`delete_crypto_aead_ctx` is a callback function which + * deletes a given AEAD cipher context object. This callback + * function must be specified. + */ + ngtcp2_delete_crypto_aead_ctx delete_crypto_aead_ctx; + /** + * :member:`delete_crypto_cipher_ctx` is a callback function which + * deletes a given cipher context object. This callback function + * must be specified. + */ + ngtcp2_delete_crypto_cipher_ctx delete_crypto_cipher_ctx; + /** + * :member:`recv_datagram` is a callback function which is invoked + * when DATAGRAM frame is received. This callback function is + * optional. + */ + ngtcp2_recv_datagram recv_datagram; + /** + * :member:`ack_datagram` is a callback function which is invoked + * when a QUIC packet containing DATAGRAM frame is acknowledged by a + * remote endpoint. This callback function is optional. + */ + ngtcp2_ack_datagram ack_datagram; + /** + * :member:`lost_datagram` is a callback function which is invoked + * when a QUIC packet containing DATAGRAM frame is declared lost. + * This callback function is optional. + */ + ngtcp2_lost_datagram lost_datagram; + /** + * :member:`get_path_challenge_data` is a callback function which is + * invoked when the library needs new data sent along with + * PATH_CHALLENGE frame. This callback must be specified. + */ + ngtcp2_get_path_challenge_data get_path_challenge_data; + /** + * :member:`stream_stop_sending` is a callback function which is + * invoked when a local endpoint no longer reads from a stream + * before it receives all stream data. This callback function is + * optional. + */ + ngtcp2_stream_stop_sending stream_stop_sending; + /** + * :member:`version_negotiation` is a callback function which is + * invoked when the compatible version negotiation takes place. + * This callback function must be specified. + */ + ngtcp2_version_negotiation version_negotiation; + /** + * :member:`recv_rx_key` is a callback function which is invoked + * when a new key for decrypting packets is installed during QUIC + * cryptographic handshake. It is not called for + * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_INITIAL`. + */ + ngtcp2_recv_key recv_rx_key; + /** + * :member:`recv_tx_key` is a callback function which is invoked + * when a new key for encrypting packets is installed during QUIC + * cryptographic handshake. It is not called for + * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_INITIAL`. + */ + ngtcp2_recv_key recv_tx_key; + /** + * :member:`tls_early_data_rejected` is a callback function which is + * invoked when server rejected early data during TLS handshake, or + * client decided not to attempt early data. This callback function + * is only used by client. + */ + ngtcp2_tls_early_data_rejected tls_early_data_rejected; +} ngtcp2_callbacks; + +/** + * @function + * + * `ngtcp2_pkt_write_connection_close` writes Initial packet + * containing CONNECTION_CLOSE frame with the given |error_code| and + * the optional |reason| of length |reasonlen| to the buffer pointed + * by |dest| of length |destlen|. All encryption parameters are for + * Initial packet encryption. The packet number is always 0. + * + * The primary use case of this function is for server to send + * CONNECTION_CLOSE frame in Initial packet to close connection + * without committing any state when validating Retry token fails. + * + * This function returns the number of bytes written if it succeeds, + * or one of the following negative error codes: + * + * :macro:`NGTCP2_ERR_NOBUF` + * Buffer is too small. + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` + * Callback function failed. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_pkt_write_connection_close( + uint8_t *dest, size_t destlen, uint32_t version, const ngtcp2_cid *dcid, + const ngtcp2_cid *scid, uint64_t error_code, const uint8_t *reason, + size_t reasonlen, ngtcp2_encrypt encrypt, const ngtcp2_crypto_aead *aead, + const ngtcp2_crypto_aead_ctx *aead_ctx, const uint8_t *iv, + ngtcp2_hp_mask hp_mask, const ngtcp2_crypto_cipher *hp, + const ngtcp2_crypto_cipher_ctx *hp_ctx); + +/** + * @function + * + * `ngtcp2_pkt_write_retry` writes Retry packet in the buffer pointed + * by |dest| whose length is |destlen|. |dcid| is the Connection ID + * which appeared in a packet as a Source Connection ID sent by + * client. |scid| is a server chosen Source Connection ID. |odcid| + * specifies Original Destination Connection ID which appeared in a + * packet as a Destination Connection ID sent by client. |token| + * specifies Retry Token, and |tokenlen| specifies its length. |aead| + * must be AEAD_AES_128_GCM. |aead_ctx| must be initialized with + * :macro:`NGTCP2_RETRY_KEY` as an encryption key. + * + * This function returns the number of bytes written to the buffer, or + * one of the following negative error codes: + * + * :macro:`NGTCP2_ERR_NOBUF` + * Buffer is too small. + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` + * Callback function failed. + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` + * :member:`odcid->datalen ` is less than + * :macro:`NGTCP2_MIN_INITIAL_DCIDLEN`. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_pkt_write_retry( + uint8_t *dest, size_t destlen, uint32_t version, const ngtcp2_cid *dcid, + const ngtcp2_cid *scid, const ngtcp2_cid *odcid, const uint8_t *token, + size_t tokenlen, ngtcp2_encrypt encrypt, const ngtcp2_crypto_aead *aead, + const ngtcp2_crypto_aead_ctx *aead_ctx); + +/** + * @function + * + * `ngtcp2_accept` is used by server implementation, and decides + * whether packet |pkt| of length |pktlen| from client is acceptable + * for the very first packet to a connection. + * + * If |dest| is not ``NULL`` and the function returns 0, the decoded + * packet header is stored in the object pointed by |dest|. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` + * The packet is not acceptable for the very first packet to a new + * connection; or the function failed to parse the packet header. + */ +NGTCP2_EXTERN int ngtcp2_accept(ngtcp2_pkt_hd *dest, const uint8_t *pkt, + size_t pktlen); + +/** + * @function + * + * `ngtcp2_conn_client_new` creates new :type:`ngtcp2_conn`, and + * initializes it as client. On success, it stores the pointer to the + * newly allocated object in |*pconn|. |dcid| is a randomized + * Destination Connection ID which must be longer than or equal to + * :macro:`NGTCP2_MIN_INITIAL_DCIDLEN`. |scid| is a Source Connection + * ID chosen by client. |client_chosen_version| is a QUIC version + * that a client chooses. |path| is the network path where this QUIC + * connection is being established, and must not be ``NULL``. + * |callbacks|, |settings|, and |params| must not be ``NULL``, and the + * function makes a copy of each of them. |params| is a local QUIC + * transport parameters, and sent to a remote endpoint during + * handshake. |user_data| is the arbitrary pointer which is passed to + * the user-defined callback functions. If |mem| is ``NULL``, the + * memory allocator returned by `ngtcp2_mem_default()` is used. + * + * Call `ngtcp2_conn_del` to free memory allocated for |*pconn|. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory. + */ +NGTCP2_EXTERN int ngtcp2_conn_client_new_versioned( + ngtcp2_conn **pconn, const ngtcp2_cid *dcid, const ngtcp2_cid *scid, + const ngtcp2_path *path, uint32_t client_chosen_version, + int callbacks_version, const ngtcp2_callbacks *callbacks, + int settings_version, const ngtcp2_settings *settings, + int transport_params_version, const ngtcp2_transport_params *params, + const ngtcp2_mem *mem, void *user_data); + +/** + * @function + * + * `ngtcp2_conn_server_new` creates new :type:`ngtcp2_conn`, and + * initializes it as server. On success, it stores the pointer to the + * newly allocated object in |*pconn|. |dcid| is a Destination + * Connection ID, and is usually the Connection ID that appears in + * client Initial packet as Source Connection ID. |scid| is a Source + * Connection ID chosen by server. |path| is the network path where + * this QUIC connection is being established, and must not be + * ``NULL``. |client_chosen_version| is a QUIC version that a client + * chooses. |callbacks|, |settings|, and |params| must not be + * ``NULL``, and the function makes a copy of each of them. |params| + * is a local QUIC transport parameters, and sent to a remote endpoint + * during handshake. |user_data| is the arbitrary pointer which is + * passed to the user-defined callback functions. If |mem| is + * ``NULL``, the memory allocator returned by `ngtcp2_mem_default()` + * is used. + * + * Call `ngtcp2_conn_del` to free memory allocated for |*pconn|. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory. + */ +NGTCP2_EXTERN int ngtcp2_conn_server_new_versioned( + ngtcp2_conn **pconn, const ngtcp2_cid *dcid, const ngtcp2_cid *scid, + const ngtcp2_path *path, uint32_t client_chosen_version, + int callbacks_version, const ngtcp2_callbacks *callbacks, + int settings_version, const ngtcp2_settings *settings, + int transport_params_version, const ngtcp2_transport_params *params, + const ngtcp2_mem *mem, void *user_data); + +/** + * @function + * + * `ngtcp2_conn_del` frees resources allocated for |conn|. It also + * frees memory pointed by |conn|. + */ +NGTCP2_EXTERN void ngtcp2_conn_del(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_read_pkt` decrypts QUIC packet given in |pkt| of + * length |pktlen| and processes it. |path| is the network path the + * packet is delivered and must not be ``NULL``. |pi| is packet + * metadata and may be ``NULL``. This function performs QUIC handshake + * as well. + * + * This function must not be called from inside the callback + * functions. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_RETRY` + * Server must perform address validation by sending Retry packet + * (see `ngtcp2_crypto_write_retry` and `ngtcp2_pkt_write_retry`), + * and discard the connection state. Client application does not + * get this error code. + * :macro:`NGTCP2_ERR_DROP_CONN` + * Server application must drop the connection silently (without + * sending any CONNECTION_CLOSE frame), and discard connection + * state. Client application does not get this error code. + * :macro:`NGTCP2_ERR_DRAINING` + * A connection has entered the draining state, and no further + * packet transmission is allowed. + * :macro:`NGTCP2_ERR_CLOSING` + * A connection has entered the closing state, and no further + * packet transmission is allowed. Calling + * `ngtcp2_conn_write_connection_close` makes a connection enter + * this state. + * :macro:`NGTCP2_ERR_CRYPTO` + * An error happened in TLS stack. `ngtcp2_conn_get_tls_alert` + * returns TLS alert if set. + * + * If any other negative error is returned, call + * `ngtcp2_conn_write_connection_close` to get terminal packet, and + * sending it makes QUIC connection enter the closing state. + */ +NGTCP2_EXTERN int +ngtcp2_conn_read_pkt_versioned(ngtcp2_conn *conn, const ngtcp2_path *path, + int pkt_info_version, const ngtcp2_pkt_info *pi, + const uint8_t *pkt, size_t pktlen, + ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_conn_write_pkt` is equivalent to calling + * `ngtcp2_conn_writev_stream` with -1 as |stream_id|, no stream data, + * and :macro:`NGTCP2_WRITE_STREAM_FLAG_NONE` as flags. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_conn_write_pkt_versioned( + ngtcp2_conn *conn, ngtcp2_path *path, int pkt_info_version, + ngtcp2_pkt_info *pi, uint8_t *dest, size_t destlen, ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_conn_tls_handshake_completed` tells |conn| that the TLS + * stack declares TLS handshake completion. This does not mean QUIC + * handshake has completed. The library needs extra conditions to be + * met. + */ +NGTCP2_EXTERN void ngtcp2_conn_tls_handshake_completed(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_get_handshake_completed` returns nonzero if QUIC + * handshake has completed. + */ +NGTCP2_EXTERN int ngtcp2_conn_get_handshake_completed(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_install_initial_key` installs packet protection keying + * materials for Initial packets. |rx_aead_ctx| is AEAD cipher + * context object, and must be initialized with a decryption key. + * |rx_iv| is IV of length |rx_ivlen| for decryption. |rx_hp_ctx| is + * a packet header protection cipher context object for decryption. + * Similarly, |tx_aead_ctx|, |tx_iv| and |tx_hp_ctx| are for + * encrypting outgoing packets, and are the same length with the + * decryption counterpart . If they have already been set, they are + * overwritten. + * + * |ivlen| must be the minimum length of AEAD nonce, or 8 bytes if + * that is larger. + * + * If this function succeeds, |conn| takes ownership of |rx_aead_ctx|, + * |rx_hp_ctx|, |tx_aead_ctx|, and |tx_hp_ctx|. + * :member:`ngtcp2_callbacks.delete_crypto_aead_ctx` and + * :member:`ngtcp2_callbacks.delete_crypto_cipher_ctx` will be called + * to delete these objects when they are no longer used. If this + * function fails, the caller is responsible to delete them. + * + * After receiving Retry packet, a Destination Connection ID that + * client sends in Initial packet most likely changes. In that case, + * client application must generate these keying materials again based + * on new Destination Connection ID, and install them again with this + * function. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory. + */ +NGTCP2_EXTERN int ngtcp2_conn_install_initial_key( + ngtcp2_conn *conn, const ngtcp2_crypto_aead_ctx *rx_aead_ctx, + const uint8_t *rx_iv, const ngtcp2_crypto_cipher_ctx *rx_hp_ctx, + const ngtcp2_crypto_aead_ctx *tx_aead_ctx, const uint8_t *tx_iv, + const ngtcp2_crypto_cipher_ctx *tx_hp_ctx, size_t ivlen); + +/** + * @function + * + * `ngtcp2_conn_install_vneg_initial_key` installs packet protection + * keying materials for Initial packets on compatible version + * negotiation for |version|. |rx_aead_ctx| is AEAD cipher context + * object, and must be initialized with a decryption key. |rx_iv| is + * IV of length |rx_ivlen| for decryption. |rx_hp_ctx| is a packet + * header protection cipher context object for decryption. Similarly, + * |tx_aead_ctx|, |tx_iv| and |tx_hp_ctx| are for encrypting outgoing + * packets, and are the same length with the decryption counterpart. + * If they have already been set, they are overwritten. + * + * |ivlen| must be the minimum length of AEAD nonce, or 8 bytes if + * that is larger. + * + * If this function succeeds, |conn| takes ownership of |rx_aead_ctx|, + * |rx_hp_ctx|, |tx_aead_ctx|, and |tx_hp_ctx|. + * :member:`ngtcp2_callbacks.delete_crypto_aead_ctx` and + * :member:`ngtcp2_callbacks.delete_crypto_cipher_ctx` will be called + * to delete these objects when they are no longer used. If this + * function fails, the caller is responsible to delete them. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory. + */ +NGTCP2_EXTERN int ngtcp2_conn_install_vneg_initial_key( + ngtcp2_conn *conn, uint32_t version, + const ngtcp2_crypto_aead_ctx *rx_aead_ctx, const uint8_t *rx_iv, + const ngtcp2_crypto_cipher_ctx *rx_hp_ctx, + const ngtcp2_crypto_aead_ctx *tx_aead_ctx, const uint8_t *tx_iv, + const ngtcp2_crypto_cipher_ctx *tx_hp_ctx, size_t ivlen); + +/** + * @function + * + * `ngtcp2_conn_install_rx_handshake_key` installs packet protection + * keying materials for decrypting incoming Handshake packets. + * |aead_ctx| is AEAD cipher context object which must be initialized + * with a decryption key. |iv| is IV of length |ivlen|. |hp_ctx| is + * a packet header protection cipher context object. + * + * |ivlen| must be the minimum length of AEAD nonce, or 8 bytes if + * that is larger. + * + * If this function succeeds, |conn| takes ownership of |aead_ctx|, + * and |hp_ctx|. :member:`ngtcp2_callbacks.delete_crypto_aead_ctx` + * and :member:`ngtcp2_callbacks.delete_crypto_cipher_ctx` will be + * called to delete these objects when they are no longer used. If + * this function fails, the caller is responsible to delete them. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory. + */ +NGTCP2_EXTERN int ngtcp2_conn_install_rx_handshake_key( + ngtcp2_conn *conn, const ngtcp2_crypto_aead_ctx *aead_ctx, const uint8_t *iv, + size_t ivlen, const ngtcp2_crypto_cipher_ctx *hp_ctx); + +/** + * @function + * + * `ngtcp2_conn_install_tx_handshake_key` installs packet protection + * keying materials for encrypting outgoing Handshake packets. + * |aead_ctx| is AEAD cipher context object which must be initialized + * with an encryption key. |iv| is IV of length |ivlen|. |hp_ctx| is + * a packet header protection cipher context object. + * + * |ivlen| must be the minimum length of AEAD nonce, or 8 bytes if + * that is larger. + * + * If this function succeeds, |conn| takes ownership of |aead_ctx| and + * |hp_ctx|. :member:`ngtcp2_callbacks.delete_crypto_aead_ctx` and + * :member:`ngtcp2_callbacks.delete_crypto_cipher_ctx` will be called + * to delete these objects when they are no longer used. If this + * function fails, the caller is responsible to delete them. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory. + */ +NGTCP2_EXTERN int ngtcp2_conn_install_tx_handshake_key( + ngtcp2_conn *conn, const ngtcp2_crypto_aead_ctx *aead_ctx, const uint8_t *iv, + size_t ivlen, const ngtcp2_crypto_cipher_ctx *hp_ctx); + +/** + * @function + * + * `ngtcp2_conn_install_0rtt_key` installs packet protection AEAD + * cipher context object |aead_ctx|, IV |iv| of length |ivlen|, and + * packet header protection cipher context object |hp_ctx| to encrypt + * (for client) or decrypt (for server) 0-RTT packets. + * + * |ivlen| must be the minimum length of AEAD nonce, or 8 bytes if + * that is larger. + * + * If this function succeeds, |conn| takes ownership of |aead_ctx| and + * |hp_ctx|. :member:`ngtcp2_callbacks.delete_crypto_aead_ctx` and + * :member:`ngtcp2_callbacks.delete_crypto_cipher_ctx` will be called + * to delete these objects when they are no longer used. If this + * function fails, the caller is responsible to delete them. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory. + */ +NGTCP2_EXTERN int ngtcp2_conn_install_0rtt_key( + ngtcp2_conn *conn, const ngtcp2_crypto_aead_ctx *aead_ctx, const uint8_t *iv, + size_t ivlen, const ngtcp2_crypto_cipher_ctx *hp_ctx); + +/** + * @function + * + * `ngtcp2_conn_install_rx_key` installs packet protection keying + * materials for decrypting 1-RTT packets. |secret| of length + * |secretlen| is the decryption secret which is used to derive keying + * materials passed to this function. |aead_ctx| is AEAD cipher + * context object which must be initialized with a decryption key. + * |iv| is IV of length |ivlen|. |hp_ctx| is a packet header + * protection cipher context object. + * + * |ivlen| must be the minimum length of AEAD nonce, or 8 bytes if + * that is larger. + * + * If this function succeeds, |conn| takes ownership of |aead_ctx| and + * |hp_ctx|. :member:`ngtcp2_callbacks.delete_crypto_aead_ctx` and + * :member:`ngtcp2_callbacks.delete_crypto_cipher_ctx` will be called + * to delete these objects when they are no longer used. If this + * function fails, the caller is responsible to delete them. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory. + */ +NGTCP2_EXTERN int ngtcp2_conn_install_rx_key( + ngtcp2_conn *conn, const uint8_t *secret, size_t secretlen, + const ngtcp2_crypto_aead_ctx *aead_ctx, const uint8_t *iv, size_t ivlen, + const ngtcp2_crypto_cipher_ctx *hp_ctx); + +/** + * @function + * + * `ngtcp2_conn_install_tx_key` installs packet protection keying + * materials for encrypting 1-RTT packets. |secret| of length + * |secretlen| is the encryption secret which is used to derive keying + * materials passed to this function. |aead_ctx| is AEAD cipher + * context object which must be initialized with an encryption key. + * |iv| is IV of length |ivlen|. |hp_ctx| is a packet header + * protection cipher context object. + * + * |ivlen| must be the minimum length of AEAD nonce, or 8 bytes if + * that is larger. + * + * If this function succeeds, |conn| takes ownership of |aead_ctx| and + * |hp_ctx|. :member:`ngtcp2_callbacks.delete_crypto_aead_ctx` and + * :member:`ngtcp2_callbacks.delete_crypto_cipher_ctx` will be called + * to delete these objects when they are no longer used. If this + * function fails, the caller is responsible to delete them. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory. + */ +NGTCP2_EXTERN int ngtcp2_conn_install_tx_key( + ngtcp2_conn *conn, const uint8_t *secret, size_t secretlen, + const ngtcp2_crypto_aead_ctx *aead_ctx, const uint8_t *iv, size_t ivlen, + const ngtcp2_crypto_cipher_ctx *hp_ctx); + +/** + * @function + * + * `ngtcp2_conn_initiate_key_update` initiates the key update. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_INVALID_STATE` + * The previous key update has not been confirmed yet; or key + * update is too frequent; or new keys are not available yet. + */ +NGTCP2_EXTERN int ngtcp2_conn_initiate_key_update(ngtcp2_conn *conn, + ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_conn_set_tls_error` sets the TLS related error |liberr| in + * |conn|. |liberr| must be one of ngtcp2 library error codes (which + * is defined as NGTCP2_ERR_* macro, such as + * :macro:`NGTCP2_ERR_DECRYPT`). In general, error code should be + * propagated via return value, but sometimes ngtcp2 API is called + * inside callback function of TLS stack, and it does not allow to + * return ngtcp2 error code directly. In this case, implementation + * can set the error code (e.g., + * :macro:`NGTCP2_ERR_MALFORMED_TRANSPORT_PARAM`) using this function. + * + * See also `ngtcp2_conn_get_tls_error`. + */ +NGTCP2_EXTERN void ngtcp2_conn_set_tls_error(ngtcp2_conn *conn, int liberr); + +/** + * @function + * + * `ngtcp2_conn_get_tls_error` returns the value set by + * `ngtcp2_conn_set_tls_error`. If no value is set, this function + * returns 0. + */ +NGTCP2_EXTERN int ngtcp2_conn_get_tls_error(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_set_tls_alert` sets a TLS alert |alert| generated by a + * TLS stack of a local endpoint to |conn|. + * + * See also `ngtcp2_conn_get_tls_alert`. + */ +NGTCP2_EXTERN void ngtcp2_conn_set_tls_alert(ngtcp2_conn *conn, uint8_t alert); + +/** + * @function + * + * `ngtcp2_conn_get_tls_alert` returns the value set by + * `ngtcp2_conn_set_tls_alert`. If no value is set, this function + * returns 0. + */ +NGTCP2_EXTERN uint8_t ngtcp2_conn_get_tls_alert(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_set_keep_alive_timeout` sets keep-alive timeout. If + * nonzero value is given, after a connection is idle at least in a + * given amount of time, a keep-alive packet is sent. If UINT64_MAX + * is set, keep-alive functionality is disabled, and this is the + * default. Specifying 0 in |timeout| is reserved for a future + * extension, and for now it is treated as if UINT64_MAX is given. + */ +NGTCP2_EXTERN void ngtcp2_conn_set_keep_alive_timeout(ngtcp2_conn *conn, + ngtcp2_duration timeout); + +/** + * @function + * + * `ngtcp2_conn_get_expiry` returns the next expiry time. It returns + * ``UINT64_MAX`` if there is no next expiry. + * + * Call `ngtcp2_conn_handle_expiry` and then + * `ngtcp2_conn_writev_stream` (or `ngtcp2_conn_writev_datagram`) when + * the expiry time has passed. + */ +NGTCP2_EXTERN ngtcp2_tstamp ngtcp2_conn_get_expiry(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_handle_expiry` handles expired timer. + */ +NGTCP2_EXTERN int ngtcp2_conn_handle_expiry(ngtcp2_conn *conn, + ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_conn_get_pto` returns Probe Timeout (PTO). + */ +NGTCP2_EXTERN ngtcp2_duration ngtcp2_conn_get_pto(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_decode_and_set_remote_transport_params` decodes QUIC + * transport parameters from the buffer pointed by |data| of length + * |datalen|, and sets the result to |conn|. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_REQUIRED_TRANSPORT_PARAM` + * The required parameter is missing. + * :macro:`NGTCP2_ERR_MALFORMED_TRANSPORT_PARAM` + * The input is malformed. + * :macro:`NGTCP2_ERR_TRANSPORT_PARAM` + * Failed to validate the remote QUIC transport parameters. + * :macro:`NGTCP2_ERR_VERSION_NEGOTIATION_FAILURE` + * Version negotiation failure. + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` + * User callback failed + */ +NGTCP2_EXTERN int ngtcp2_conn_decode_and_set_remote_transport_params( + ngtcp2_conn *conn, const uint8_t *data, size_t datalen); + +/** + * @function + * + * `ngtcp2_conn_get_remote_transport_params` returns a pointer to the + * remote QUIC transport parameters. If no remote transport + * parameters are set, it returns NULL. + */ +NGTCP2_EXTERN const ngtcp2_transport_params * +ngtcp2_conn_get_remote_transport_params(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_encode_0rtt_transport_params` encodes the QUIC + * transport parameters that are used for 0-RTT data in the buffer + * pointed by |dest| of length |destlen|. It includes at least the + * following fields: + * + * - :member:`ngtcp2_transport_params.initial_max_streams_bidi` + * - :member:`ngtcp2_transport_params.initial_max_streams_uni` + * - :member:`ngtcp2_transport_params.initial_max_stream_data_bidi_local` + * - :member:`ngtcp2_transport_params.initial_max_stream_data_bidi_remote` + * - :member:`ngtcp2_transport_params.initial_max_stream_data_uni` + * - :member:`ngtcp2_transport_params.initial_max_data` + * - :member:`ngtcp2_transport_params.active_connection_id_limit` + * - :member:`ngtcp2_transport_params.max_datagram_frame_size` + * + * If |conn| is initialized as server, the following additional fields + * are also included: + * + * - :member:`ngtcp2_transport_params.max_idle_timeout` + * - :member:`ngtcp2_transport_params.max_udp_payload_size` + * - :member:`ngtcp2_transport_params.disable_active_migration` + * + * If |conn| is initialized as client, these parameters are + * synthesized from the remote transport parameters received from + * server. Otherwise, it is the local transport parameters that are + * set by the local endpoint. + * + * This function returns the number of bytes written, or one of the + * following negative error codes: + * + * :macro:`NGTCP2_ERR_NOBUF` + * Buffer is too small. + */ +NGTCP2_EXTERN +ngtcp2_ssize ngtcp2_conn_encode_0rtt_transport_params(ngtcp2_conn *conn, + uint8_t *dest, + size_t destlen); + +/** + * @function + * + * `ngtcp2_conn_decode_and_set_0rtt_transport_params` decodes QUIC + * transport parameters from |data| of length |datalen|, which is + * assumed to be the parameters received from the server in the + * previous connection, and sets it to |conn|. These parameters are + * used to send 0-RTT data. QUIC requires that client application + * should remember transport parameters along with a session ticket. + * + * At least following fields should be included: + * + * - :member:`ngtcp2_transport_params.initial_max_streams_bidi` + * - :member:`ngtcp2_transport_params.initial_max_streams_uni` + * - :member:`ngtcp2_transport_params.initial_max_stream_data_bidi_local` + * - :member:`ngtcp2_transport_params.initial_max_stream_data_bidi_remote` + * - :member:`ngtcp2_transport_params.initial_max_stream_data_uni` + * - :member:`ngtcp2_transport_params.initial_max_data` + * - :member:`ngtcp2_transport_params.active_connection_id_limit` + * - :member:`ngtcp2_transport_params.max_datagram_frame_size` (if + * DATAGRAM extension was negotiated) + * + * This function must only be used by client. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory. + * :macro:`NGTCP2_ERR_MALFORMED_TRANSPORT_PARAM` + * The input is malformed. + */ +NGTCP2_EXTERN int ngtcp2_conn_decode_and_set_0rtt_transport_params( + ngtcp2_conn *conn, const uint8_t *data, size_t datalen); + +/** + * @function + * + * `ngtcp2_conn_set_local_transport_params` sets the local transport + * parameters |params|. This function can only be called by server. + * Although the local transport parameters are passed to + * `ngtcp2_conn_server_new`, server might want to update them after + * ALPN is chosen. In that case, server can update the transport + * parameters with this function. Server must call this function + * before calling `ngtcp2_conn_install_tx_handshake_key`. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_INVALID_STATE` + * `ngtcp2_conn_install_tx_handshake_key` has been called. + */ +NGTCP2_EXTERN int ngtcp2_conn_set_local_transport_params_versioned( + ngtcp2_conn *conn, int transport_params_version, + const ngtcp2_transport_params *params); + +/** + * @function + * + * `ngtcp2_conn_get_local_transport_params` returns a pointer to the + * local QUIC transport parameters. + */ +NGTCP2_EXTERN const ngtcp2_transport_params * +ngtcp2_conn_get_local_transport_params(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_encode_local_transport_params` encodes the local QUIC + * transport parameters in |dest| of length |destlen|. + * + * This function returns the number of bytes written, or one of the + * following negative error codes: + * + * :macro:`NGTCP2_ERR_NOBUF` + * Buffer is too small. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_conn_encode_local_transport_params( + ngtcp2_conn *conn, uint8_t *dest, size_t destlen); + +/** + * @function + * + * `ngtcp2_conn_open_bidi_stream` opens new bidirectional stream. The + * |stream_user_data| is the user data specific to the stream. The + * stream ID of the opened stream is stored in |*pstream_id|. + * + * Application can call this function before handshake completes. For + * 0-RTT packet, application can call this function after calling + * `ngtcp2_conn_decode_and_set_0rtt_transport_params`. For 1-RTT + * packet, application can call this function after calling + * `ngtcp2_conn_decode_and_set_remote_transport_params` and + * `ngtcp2_conn_install_tx_key`. If ngtcp2 crypto support library is + * used, application can call this function after calling + * `ngtcp2_crypto_derive_and_install_tx_key` for 1-RTT packet. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory + * :macro:`NGTCP2_ERR_STREAM_ID_BLOCKED` + * The remote endpoint does not allow |stream_id| yet. + */ +NGTCP2_EXTERN int ngtcp2_conn_open_bidi_stream(ngtcp2_conn *conn, + int64_t *pstream_id, + void *stream_user_data); + +/** + * @function + * + * `ngtcp2_conn_open_uni_stream` opens new unidirectional stream. The + * |stream_user_data| is the user data specific to the stream. The + * stream ID of the opened stream is stored in |*pstream_id|. + * + * Application can call this function before handshake completes. For + * 0-RTT packet, application can call this function after calling + * `ngtcp2_conn_decode_and_set_0rtt_transport_params`. For 1-RTT + * packet, application can call this function after calling + * `ngtcp2_conn_decode_and_set_remote_transport_params` and + * `ngtcp2_conn_install_tx_key`. If ngtcp2 crypto support library is + * used, application can call this function after calling + * `ngtcp2_crypto_derive_and_install_tx_key` for 1-RTT packet. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory + * :macro:`NGTCP2_ERR_STREAM_ID_BLOCKED` + * The remote endpoint does not allow |stream_id| yet. + */ +NGTCP2_EXTERN int ngtcp2_conn_open_uni_stream(ngtcp2_conn *conn, + int64_t *pstream_id, + void *stream_user_data); + +/** + * @function + * + * `ngtcp2_conn_shutdown_stream` closes a stream denoted by + * |stream_id| abruptly. |app_error_code| is one of application error + * codes, and indicates the reason of shutdown. Successful call of + * this function does not immediately erase the state of the stream. + * The actual deletion is done when the remote endpoint sends + * acknowledgement. Calling this function is equivalent to call + * `ngtcp2_conn_shutdown_stream_read`, and + * `ngtcp2_conn_shutdown_stream_write` sequentially with the following + * differences. If |stream_id| refers to a local unidirectional + * stream, this function only shutdowns write side of the stream. If + * |stream_id| refers to a remote unidirectional stream, this function + * only shutdowns read side of the stream. + * + * |flags| is currently unused, and should be set to 0. + * + * This function returns 0 if a stream denoted by |stream_id| is not + * found. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory + */ +NGTCP2_EXTERN int ngtcp2_conn_shutdown_stream(ngtcp2_conn *conn, uint32_t flags, + int64_t stream_id, + uint64_t app_error_code); + +/** + * @function + * + * `ngtcp2_conn_shutdown_stream_write` closes write-side of a stream + * denoted by |stream_id| abruptly. |app_error_code| is one of + * application error codes, and indicates the reason of shutdown. If + * this function succeeds, no further application data is sent to the + * remote endpoint. It discards all data which has not been + * acknowledged yet. + * + * |flags| is currently unused, and should be set to 0. + * + * This function returns 0 if a stream denoted by |stream_id| is not + * found. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` + * |stream_id| refers to a remote unidirectional stream. + */ +NGTCP2_EXTERN int ngtcp2_conn_shutdown_stream_write(ngtcp2_conn *conn, + uint32_t flags, + int64_t stream_id, + uint64_t app_error_code); + +/** + * @function + * + * `ngtcp2_conn_shutdown_stream_read` closes read-side of a stream + * denoted by |stream_id| abruptly. |app_error_code| is one of + * application error codes, and indicates the reason of shutdown. If + * this function succeeds, no further application data is forwarded to + * an application layer. + * + * |flags| is currently unused, and should be set to 0. + * + * This function returns 0 if a stream denoted by |stream_id| is not + * found. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` + * |stream_id| refers to a local unidirectional stream. + */ +NGTCP2_EXTERN int ngtcp2_conn_shutdown_stream_read(ngtcp2_conn *conn, + uint32_t flags, + int64_t stream_id, + uint64_t app_error_code); + +/** + * @macrosection + * + * Write stream data flags + */ + +/** + * @macro + * + * :macro:`NGTCP2_WRITE_STREAM_FLAG_NONE` indicates no flag set. + */ +#define NGTCP2_WRITE_STREAM_FLAG_NONE 0x00u + +/** + * @macro + * + * :macro:`NGTCP2_WRITE_STREAM_FLAG_MORE` indicates that more data may + * come, and should be coalesced into the same packet if possible. + */ +#define NGTCP2_WRITE_STREAM_FLAG_MORE 0x01u + +/** + * @macro + * + * :macro:`NGTCP2_WRITE_STREAM_FLAG_FIN` indicates that a passed data + * is the final part of a stream. + */ +#define NGTCP2_WRITE_STREAM_FLAG_FIN 0x02u + +/** + * @macro + * + * :macro:`NGTCP2_WRITE_STREAM_FLAG_PADDING` indicates that a + * non-empty 0 RTT or 1 RTT ack-eliciting packet is padded to the + * minimum length of a sending path MTU or a given packet buffer when + * finalizing it. PATH_CHALLENGE, PATH_RESPONSE, CONNECTION_CLOSE + * only packets and PMTUD packets are excluded. + */ +#define NGTCP2_WRITE_STREAM_FLAG_PADDING 0x04u + +/** + * @function + * + * `ngtcp2_conn_write_stream` is just like + * `ngtcp2_conn_writev_stream`. The only difference is that it + * conveniently accepts a single buffer. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_conn_write_stream_versioned( + ngtcp2_conn *conn, ngtcp2_path *path, int pkt_info_version, + ngtcp2_pkt_info *pi, uint8_t *dest, size_t destlen, ngtcp2_ssize *pdatalen, + uint32_t flags, int64_t stream_id, const uint8_t *data, size_t datalen, + ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_conn_writev_stream` writes a packet containing stream data + * of a stream denoted by |stream_id|. The buffer of the packet is + * pointed by |dest| of length |destlen|. This function performs QUIC + * handshake as well. + * + * |destlen| should be at least + * :member:`ngtcp2_settings.max_tx_udp_payload_size`. It must be at + * least :macro:`NGTCP2_MAX_UDP_PAYLOAD_SIZE`. + * + * Specifying -1 to |stream_id| means no new stream data to send. + * + * If |path| is not ``NULL``, this function stores the network path + * with which the packet should be sent. Each addr field + * (:member:`ngtcp2_path.local` and :member:`ngtcp2_path.remote`) must + * point to the buffer which should be at least + * sizeof(:type:`sockaddr_union`) bytes long. The assignment might + * not be done if nothing is written to |dest|. + * + * If |pi| is not ``NULL``, this function stores packet metadata in it + * if it succeeds. The metadata includes ECN markings. When calling + * this function again after it returns + * :macro:`NGTCP2_ERR_WRITE_MORE`, caller must pass the same |pi| to + * this function. + * + * Stream data is specified as vector of data |datav|. |datavcnt| + * specifies the number of :type:`ngtcp2_vec` that |datav| includes. + * + * If all given data is encoded as STREAM frame in |dest|, and if + * |flags| & :macro:`NGTCP2_WRITE_STREAM_FLAG_FIN` is nonzero, fin + * flag is set to outgoing STREAM frame. Otherwise, fin flag in + * STREAM frame is not set. + * + * This packet may contain frames other than STREAM frame. The packet + * might not contain STREAM frame if other frames occupy the packet. + * In that case, |*pdatalen| would be -1 if |pdatalen| is not + * ``NULL``. + * + * Empty data is treated specially, and it is only accepted if no + * data, including the empty data, is submitted to a stream or + * :macro:`NGTCP2_WRITE_STREAM_FLAG_FIN` is set in |flags|. If 0 + * length STREAM frame is successfully serialized, |*pdatalen| would + * be 0. + * + * The number of data encoded in STREAM frame is stored in |*pdatalen| + * if it is not ``NULL``. The caller must keep the portion of data + * covered by |*pdatalen| bytes in tact until + * :member:`ngtcp2_callbacks.acked_stream_data_offset` indicates that + * they are acknowledged by a remote endpoint or the stream is closed. + * + * If the given stream data is small (e.g., few bytes), the packet + * might be severely under filled. Too many small packet might + * increase overall packet processing costs. Unless there are + * retransmissions, by default, application can only send 1 STREAM + * frame in one QUIC packet. In order to include more than 1 STREAM + * frame in one QUIC packet, specify + * :macro:`NGTCP2_WRITE_STREAM_FLAG_MORE` in |flags|. This is + * analogous to ``MSG_MORE`` flag in :manpage:`send(2)`. If the + * :macro:`NGTCP2_WRITE_STREAM_FLAG_MORE` is used, there are 4 + * outcomes: + * + * - The function returns the written length of packet just like + * without :macro:`NGTCP2_WRITE_STREAM_FLAG_MORE`. This is because + * packet is nearly full, and the library decided to make a complete + * packet. |*pdatalen| might be -1 or >= 0. It may return 0 which + * indicates that no packet transmission is possible at the moment + * for some reason. + * + * - The function returns :macro:`NGTCP2_ERR_WRITE_MORE`. In this + * case, |*pdatalen| >= 0 is asserted. It indicates that + * application can still call this function with different stream + * data (or `ngtcp2_conn_writev_datagram` if it has data to send in + * unreliable datagram) to pack them into the same packet. + * Application has to specify the same |conn|, |path|, |pi|, |dest|, + * |destlen|, and |ts| parameters, otherwise the behaviour is + * undefined. The application can change |flags|. + * + * - The function returns one of the following negative error codes: + * :macro:`NGTCP2_ERR_STREAM_DATA_BLOCKED`, + * :macro:`NGTCP2_ERR_STREAM_NOT_FOUND`, or + * :macro:`NGTCP2_ERR_STREAM_SHUT_WR`. In this case, |*pdatalen| == + * -1 is asserted. Application can still write the stream data of + * the other streams by calling this function (or + * `ngtcp2_conn_writev_datagram` if it has data to send in + * unreliable datagram) to pack them into the same packet. + * Application has to specify the same |conn|, |path|, |pi|, |dest|, + * |destlen|, and |ts| parameters, otherwise the behaviour is + * undefined. The application can change |flags|. + * + * - The other negative error codes might be returned just like + * without :macro:`NGTCP2_WRITE_STREAM_FLAG_MORE`. These errors + * should be treated as a connection error. + * + * When application uses :macro:`NGTCP2_WRITE_STREAM_FLAG_MORE` at + * least once, it must not call other ngtcp2 API functions + * (application can still call `ngtcp2_conn_write_connection_close` to + * handle error from this function. It can also call + * `ngtcp2_conn_shutdown_stream_read`, + * `ngtcp2_conn_shutdown_stream_write`, and + * `ngtcp2_conn_shutdown_stream`), just keep calling this function (or + * `ngtcp2_conn_writev_datagram`) until it returns 0, a positive + * number (which indicates a complete packet is ready), or the error + * codes other than :macro:`NGTCP2_ERR_WRITE_MORE`, + * :macro:`NGTCP2_ERR_STREAM_DATA_BLOCKED`, + * :macro:`NGTCP2_ERR_STREAM_NOT_FOUND`, and + * :macro:`NGTCP2_ERR_STREAM_SHUT_WR`. If there is no stream data to + * include, call this function with |stream_id| as -1 to stop + * coalescing and write a packet. + * + * If :macro:`NGTCP2_WRITE_STREAM_FLAG_PADDING` is set in |flags| when + * finalizing a non-empty 0 RTT or 1 RTT ack-eliciting packet, the + * packet is padded to the minimum length of a sending path MTU or a + * given packet buffer. + * + * This function returns 0 if it cannot write any frame because buffer + * is too small, or packet is congestion limited. Application should + * keep reading and wait for congestion window to grow. + * + * This function must not be called from inside the callback + * functions. + * + * `ngtcp2_conn_update_pkt_tx_time` must be called after this + * function. Application may call this function multiple times before + * calling `ngtcp2_conn_update_pkt_tx_time`. + * + * This function returns the number of bytes written in |dest| if it + * succeeds, or one of the following negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory + * :macro:`NGTCP2_ERR_STREAM_NOT_FOUND` + * Stream does not exist + * :macro:`NGTCP2_ERR_STREAM_SHUT_WR` + * Stream is half closed (local); or stream is being reset. + * :macro:`NGTCP2_ERR_PKT_NUM_EXHAUSTED` + * Packet number is exhausted, and cannot send any more packet. + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` + * User callback failed + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` + * The total length of stream data is too large. + * :macro:`NGTCP2_ERR_STREAM_DATA_BLOCKED` + * Stream is blocked because of flow control. + * :macro:`NGTCP2_ERR_WRITE_MORE` + * (Only when :macro:`NGTCP2_WRITE_STREAM_FLAG_MORE` is specified) + * Application can call this function to pack more stream data + * into the same packet. See above to know how it works. + * + * If any other negative error is returned, call + * `ngtcp2_conn_write_connection_close` to get terminal packet, and + * sending it makes QUIC connection enter the closing state. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_conn_writev_stream_versioned( + ngtcp2_conn *conn, ngtcp2_path *path, int pkt_info_version, + ngtcp2_pkt_info *pi, uint8_t *dest, size_t destlen, ngtcp2_ssize *pdatalen, + uint32_t flags, int64_t stream_id, const ngtcp2_vec *datav, size_t datavcnt, + ngtcp2_tstamp ts); + +/** + * @macrosection + * + * Write datagram flags + */ + +/** + * @macro + * + * :macro:`NGTCP2_WRITE_DATAGRAM_FLAG_NONE` indicates no flag set. + */ +#define NGTCP2_WRITE_DATAGRAM_FLAG_NONE 0x00u + +/** + * @macro + * + * :macro:`NGTCP2_WRITE_DATAGRAM_FLAG_MORE` indicates that more data + * may come, and should be coalesced into the same packet if possible. + */ +#define NGTCP2_WRITE_DATAGRAM_FLAG_MORE 0x01u + +/** + * @macro + * + * :macro:`NGTCP2_WRITE_DATAGRAM_FLAG_PADDING` indicates that a + * non-empty 0 RTT or 1 RTT ack-eliciting packet is padded to the + * minimum length of a sending path MTU or a given packet buffer when + * finalizing it. PATH_CHALLENGE, PATH_RESPONSE, CONNECTION_CLOSE + * only packets and PMTUD packets are excluded. + */ +#define NGTCP2_WRITE_DATAGRAM_FLAG_PADDING 0x02u + +/** + * @function + * + * `ngtcp2_conn_write_datagram` is just like + * `ngtcp2_conn_writev_datagram`. The only difference is that it + * conveniently accepts a single buffer. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_conn_write_datagram_versioned( + ngtcp2_conn *conn, ngtcp2_path *path, int pkt_info_version, + ngtcp2_pkt_info *pi, uint8_t *dest, size_t destlen, int *paccepted, + uint32_t flags, uint64_t dgram_id, const uint8_t *data, size_t datalen, + ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_conn_writev_datagram` writes a packet containing unreliable + * data in DATAGRAM frame. The buffer of the packet is pointed by + * |dest| of length |destlen|. This function performs QUIC handshake + * as well. + * + * |destlen| should be at least + * :member:`ngtcp2_settings.max_tx_udp_payload_size`. It must be at + * least :macro:`NGTCP2_MAX_UDP_PAYLOAD_SIZE`. + * + * For |path| and |pi| parameters, refer to + * `ngtcp2_conn_writev_stream`. + * + * Stream data is specified as vector of data |datav|. |datavcnt| + * specifies the number of :type:`ngtcp2_vec` that |datav| includes. + * + * If the given data is written to the buffer, nonzero value is + * assigned to |*paccepted| if it is not NULL. The data in DATAGRAM + * frame cannot be fragmented; writing partial data is not possible. + * + * |dgram_id| is an opaque identifier which should uniquely identify + * the given DATAGRAM data. It is passed to + * :member:`ngtcp2_callbacks.ack_datagram` callback when a packet that + * contains DATAGRAM frame is acknowledged. It is also passed to + * :member:`ngtcp2_callbacks.lost_datagram` callback when a packet + * that contains DATAGRAM frame is declared lost. If an application + * uses neither of those callbacks, it can sets 0 to this parameter. + * + * This function might write other frames other than DATAGRAM frame, + * just like `ngtcp2_conn_writev_stream`. + * + * If the function returns 0, it means that no more data cannot be + * sent because of congestion control limit; or, data does not fit + * into the provided buffer; or, a local endpoint, as a server, is + * unable to send data because of its amplification limit. In this + * case, |*paccepted| is assigned zero if it is not NULL. + * + * If :macro:`NGTCP2_WRITE_DATAGRAM_FLAG_MORE` is set in |flags|, + * there are 3 outcomes: + * + * - The function returns the written length of packet just like + * without :macro:`NGTCP2_WRITE_DATAGRAM_FLAG_MORE`. This is + * because packet is nearly full and the library decided to make a + * complete packet. |*paccepted| might be zero or nonzero. + * + * - The function returns :macro:`NGTCP2_ERR_WRITE_MORE`. In this + * case, |*paccepted| != 0 is asserted. This indicates that + * application can call this function with another unreliable data + * (or `ngtcp2_conn_writev_stream` if it has stream data to send) to + * pack them into the same packet. Application has to specify the + * same |conn|, |path|, |pi|, |dest|, |destlen|, and |ts| + * parameters, otherwise the behaviour is undefined. The + * application can change |flags|. + * + * - The other error might be returned just like without + * :macro:`NGTCP2_WRITE_DATAGRAM_FLAG_MORE`. + * + * When application sees :macro:`NGTCP2_ERR_WRITE_MORE`, it must not + * call other ngtcp2 API functions (application can still call + * `ngtcp2_conn_write_connection_close` to handle error from this + * function. It can also call `ngtcp2_conn_shutdown_stream_read`, + * `ngtcp2_conn_shutdown_stream_write`, and + * `ngtcp2_conn_shutdown_stream`). Just keep calling this function + * (or `ngtcp2_conn_writev_stream`) until it returns a positive number + * (which indicates a complete packet is ready). + * + * If :macro:`NGTCP2_WRITE_DATAGRAM_FLAG_PADDING` is set in |flags| + * when finalizing a non-empty 0 RTT or 1 RTT ack-eliciting packet, + * the packet is padded to the minimum length of a sending path MTU or + * a given packet buffer. + * + * This function returns the number of bytes written in |dest| if it + * succeeds, or one of the following negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory + * :macro:`NGTCP2_ERR_PKT_NUM_EXHAUSTED` + * Packet number is exhausted, and cannot send any more packet. + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` + * User callback failed + * :macro:`NGTCP2_ERR_WRITE_MORE` + * (Only when :macro:`NGTCP2_WRITE_DATAGRAM_FLAG_MORE` is + * specified) Application can call this function to pack more data + * into the same packet. See above to know how it works. + * :macro:`NGTCP2_ERR_INVALID_STATE` + * A remote endpoint did not express the DATAGRAM frame support. + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` + * The provisional DATAGRAM frame size exceeds the maximum + * DATAGRAM frame size that a remote endpoint can receive. + * + * If any other negative error is returned, call + * `ngtcp2_conn_write_connection_close` to get terminal packet, and + * sending it makes QUIC connection enter the closing state. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_conn_writev_datagram_versioned( + ngtcp2_conn *conn, ngtcp2_path *path, int pkt_info_version, + ngtcp2_pkt_info *pi, uint8_t *dest, size_t destlen, int *paccepted, + uint32_t flags, uint64_t dgram_id, const ngtcp2_vec *datav, size_t datavcnt, + ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_conn_in_closing_period` returns nonzero if |conn| is in the + * closing period. + */ +NGTCP2_EXTERN int ngtcp2_conn_in_closing_period(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_in_draining_period` returns nonzero if |conn| is in + * the draining period. + */ +NGTCP2_EXTERN int ngtcp2_conn_in_draining_period(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_extend_max_stream_offset` extends the maximum stream + * data that a remote endpoint can send by |datalen|. |stream_id| + * specifies the stream ID. This function only extends stream-level + * flow control window. + * + * This function returns 0 if a stream denoted by |stream_id| is not + * found. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory. + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` + * |stream_id| refers to a local unidirectional stream. + */ +NGTCP2_EXTERN int ngtcp2_conn_extend_max_stream_offset(ngtcp2_conn *conn, + int64_t stream_id, + uint64_t datalen); + +/** + * @function + * + * `ngtcp2_conn_extend_max_offset` extends max data offset by + * |datalen|. This function only extends connection-level flow + * control window. + */ +NGTCP2_EXTERN void ngtcp2_conn_extend_max_offset(ngtcp2_conn *conn, + uint64_t datalen); + +/** + * @function + * + * `ngtcp2_conn_extend_max_streams_bidi` extends the number of maximum + * remote bidirectional streams that a remote endpoint can open by + * |n|. + * + * The library does not increase maximum stream limit automatically. + * The exception is when a stream is closed without + * :member:`ngtcp2_callbacks.stream_open` callback being called. In + * this case, stream limit is increased automatically. + */ +NGTCP2_EXTERN void ngtcp2_conn_extend_max_streams_bidi(ngtcp2_conn *conn, + size_t n); + +/** + * @function + * + * `ngtcp2_conn_extend_max_streams_uni` extends the number of maximum + * remote unidirectional streams that a remote endpoint can open by + * |n|. + * + * The library does not increase maximum stream limit automatically. + * The exception is when a stream is closed without + * :member:`ngtcp2_callbacks.stream_open` callback being called. In + * this case, stream limit is increased automatically. + */ +NGTCP2_EXTERN void ngtcp2_conn_extend_max_streams_uni(ngtcp2_conn *conn, + size_t n); + +/** + * @function + * + * `ngtcp2_conn_get_dcid` returns the non-NULL pointer to the current + * Destination Connection ID. If no Destination Connection ID is + * present, the return value is not ``NULL``, and its :member:`datalen + * ` field is 0. + */ +NGTCP2_EXTERN const ngtcp2_cid *ngtcp2_conn_get_dcid(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_get_client_initial_dcid` returns the non-NULL pointer + * to the Destination Connection ID that client sent in its Initial + * packet. If the Destination Connection ID is not present, the + * return value is not ``NULL``, and its :member:`datalen + * ` field is 0. + */ +NGTCP2_EXTERN const ngtcp2_cid * +ngtcp2_conn_get_client_initial_dcid(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_get_scid` writes the all Source Connection IDs which a + * local endpoint has provided to a remote endpoint, and are not + * retired in |dest|. If |dest| is NULL, this function does not write + * anything, and returns the number of Source Connection IDs that + * would otherwise be written to the provided buffer. The buffer + * pointed by |dest| must have sizeof(:type:`ngtcp2_cid`) * n bytes + * available, where n is the return value of `ngtcp2_conn_get_scid` + * with |dest| == NULL. + */ +NGTCP2_EXTERN size_t ngtcp2_conn_get_scid(ngtcp2_conn *conn, ngtcp2_cid *dest); + +/** + * @struct + * + * :type:`ngtcp2_cid_token` is the convenient struct to store + * Connection ID, its associated path, and stateless reset token. + */ +typedef struct ngtcp2_cid_token { + /** + * :member:`seq` is the sequence number of this Connection ID. + */ + uint64_t seq; + /** + * :member:`cid` is Connection ID. + */ + ngtcp2_cid cid; + /** + * :member:`ps` is the path which this Connection ID is associated + * with. + */ + ngtcp2_path_storage ps; + /** + * :member:`token` is the stateless reset token for this Connection + * ID. + */ + uint8_t token[NGTCP2_STATELESS_RESET_TOKENLEN]; + /** + * :member:`token_present` is nonzero if token contains stateless + * reset token. + */ + uint8_t token_present; +} ngtcp2_cid_token; + +/** + * @function + * + * `ngtcp2_conn_get_active_dcid` writes the all active Destination + * Connection IDs and their tokens to |dest|. Before handshake + * completes, this function returns 0. If |dest| is NULL, this + * function does not write anything, and returns the number of + * Destination Connection IDs that would otherwise be written to the + * provided buffer. The buffer pointed by |dest| must have + * sizeof(:type:`ngtcp2_cid_token`) * n bytes available, where n is + * the return value of `ngtcp2_conn_get_active_dcid` with |dest| == + * NULL. + */ +NGTCP2_EXTERN size_t ngtcp2_conn_get_active_dcid(ngtcp2_conn *conn, + ngtcp2_cid_token *dest); + +/** + * @function + * + * `ngtcp2_conn_get_client_chosen_version` returns the client chosen + * version. + */ +NGTCP2_EXTERN uint32_t ngtcp2_conn_get_client_chosen_version(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_get_negotiated_version` returns the negotiated + * version. + * + * Until the version is negotiated, this function returns 0. + */ +NGTCP2_EXTERN uint32_t ngtcp2_conn_get_negotiated_version(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_tls_early_data_rejected` tells |conn| that early data + * was rejected by a server during TLS handshake, or client decided + * not to attempt early data for some reason. |conn| discards the + * following connection states: + * + * - Any opened streams. + * - Stream identifier allocations. + * - Max data extended by `ngtcp2_conn_extend_max_offset`. + * - Max bidi streams extended by `ngtcp2_conn_extend_max_streams_bidi`. + * - Max uni streams extended by `ngtcp2_conn_extend_max_streams_uni`. + * + * Application which wishes to retransmit early data, it has to open + * streams, and send stream data again. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` + * User callback failed + */ +NGTCP2_EXTERN int ngtcp2_conn_tls_early_data_rejected(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_get_tls_early_data_rejected` returns nonzero if + * `ngtcp2_conn_tls_early_data_rejected` has been called. + */ +NGTCP2_EXTERN int ngtcp2_conn_get_tls_early_data_rejected(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_get_conn_info` assigns connection statistics data to + * |*cinfo|. + */ +NGTCP2_EXTERN void ngtcp2_conn_get_conn_info_versioned(ngtcp2_conn *conn, + int conn_info_version, + ngtcp2_conn_info *cinfo); + +/** + * @function + * + * `ngtcp2_conn_submit_crypto_data` submits crypto data |data| of + * length |datalen| to the library for transmission. + * |encryption_level| specifies the encryption level of data. + * + * The library makes a copy of the buffer pointed by |data| of length + * |datalen|. Application can discard |data|. + */ +NGTCP2_EXTERN int +ngtcp2_conn_submit_crypto_data(ngtcp2_conn *conn, + ngtcp2_encryption_level encryption_level, + const uint8_t *data, const size_t datalen); + +/** + * @function + * + * `ngtcp2_conn_submit_new_token` submits address validation token. + * It is sent in NEW_TOKEN frame. Only server can call this function. + * |tokenlen| must not be 0. + * + * This function makes a copy of the buffer pointed by |token| of + * length |tokenlen|. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory. + */ +NGTCP2_EXTERN int ngtcp2_conn_submit_new_token(ngtcp2_conn *conn, + const uint8_t *token, + size_t tokenlen); + +/** + * @function + * + * `ngtcp2_conn_set_local_addr` sets local endpoint address |addr| to + * the current path of |conn|. This function is provided for testing + * purpose only. + */ +NGTCP2_EXTERN void ngtcp2_conn_set_local_addr(ngtcp2_conn *conn, + const ngtcp2_addr *addr); + +/** + * @function + * + * `ngtcp2_conn_set_path_user_data` sets the |path_user_data| to the + * current path (see :member:`ngtcp2_path.user_data`). + */ +NGTCP2_EXTERN void ngtcp2_conn_set_path_user_data(ngtcp2_conn *conn, + void *path_user_data); + +/** + * @function + * + * `ngtcp2_conn_get_path` returns the current path. + */ +NGTCP2_EXTERN const ngtcp2_path *ngtcp2_conn_get_path(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_get_max_tx_udp_payload_size` returns the maximum UDP + * payload size that this local endpoint would send. This is the + * value of :member:`ngtcp2_settings.max_tx_udp_payload_size` that is + * passed to `ngtcp2_conn_client_new` or `ngtcp2_conn_server_new`. + */ +NGTCP2_EXTERN size_t ngtcp2_conn_get_max_tx_udp_payload_size(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_get_path_max_tx_udp_payload_size` returns the maximum + * UDP payload size for the current path. If + * :member:`ngtcp2_settings.no_tx_udp_payload_size_shaping` is set to + * nonzero, this function is equivalent to + * `ngtcp2_conn_get_max_tx_udp_payload_size`. Otherwise, it returns + * the maximum UDP payload size that is probed for the current path. + */ +NGTCP2_EXTERN size_t +ngtcp2_conn_get_path_max_tx_udp_payload_size(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_initiate_immediate_migration` starts connection + * migration to the given |path|. Only client can initiate migration. + * This function does immediate migration; while the path validation + * is nonetheless performed, this function does not wait for it to + * succeed. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_INVALID_STATE` + * Migration is disabled; or handshake is not yet confirmed; or + * client is migrating to server's preferred address. + * :macro:`NGTCP2_ERR_CONN_ID_BLOCKED` + * No unused connection ID is available. + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` + * :member:`local ` field of |path| equals the + * current local address. + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory + */ +NGTCP2_EXTERN int ngtcp2_conn_initiate_immediate_migration( + ngtcp2_conn *conn, const ngtcp2_path *path, ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_conn_initiate_migration` starts connection migration to the + * given |path|. Only client can initiate migration. Unlike + * `ngtcp2_conn_initiate_immediate_migration`, this function starts a + * path validation with a new path, and migrate to the new path after + * successful path validation. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_INVALID_STATE` + * Migration is disabled; or handshake is not yet confirmed; or + * client is migrating to server's preferred address. + * :macro:`NGTCP2_ERR_CONN_ID_BLOCKED` + * No unused connection ID is available. + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` + * :member:`local ` field of |path| equals the + * current local address. + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory + */ +NGTCP2_EXTERN int ngtcp2_conn_initiate_migration(ngtcp2_conn *conn, + const ngtcp2_path *path, + ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_conn_get_max_data_left` returns the number of bytes that + * this local endpoint can send in this connection without violating + * connection-level flow control. + */ +NGTCP2_EXTERN uint64_t ngtcp2_conn_get_max_data_left(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_get_max_stream_data_left` returns the number of bytes + * that this local endpoint can send to a stream identified by + * |stream_id| without violating stream-level flow control. If no + * such stream is found, this function returns 0. + */ +NGTCP2_EXTERN uint64_t ngtcp2_conn_get_max_stream_data_left(ngtcp2_conn *conn, + int64_t stream_id); + +/** + * @function + * + * `ngtcp2_conn_get_streams_bidi_left` returns the number of + * bidirectional streams which the local endpoint can open without + * violating stream concurrency limit. + */ +NGTCP2_EXTERN uint64_t ngtcp2_conn_get_streams_bidi_left(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_get_streams_uni_left` returns the number of + * unidirectional streams which the local endpoint can open without + * violating stream concurrency limit. + */ +NGTCP2_EXTERN uint64_t ngtcp2_conn_get_streams_uni_left(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_get_cwnd_left` returns the cwnd minus the number of + * bytes in flight on the current path. If the former is smaller than + * the latter, this function returns 0. + */ +NGTCP2_EXTERN uint64_t ngtcp2_conn_get_cwnd_left(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_set_initial_crypto_ctx` sets |ctx| for Initial packet + * encryption. The passed data will be passed to + * :type:`ngtcp2_encrypt`, :type:`ngtcp2_decrypt` and + * :type:`ngtcp2_hp_mask` callbacks. + */ +NGTCP2_EXTERN void +ngtcp2_conn_set_initial_crypto_ctx(ngtcp2_conn *conn, + const ngtcp2_crypto_ctx *ctx); + +/** + * @function + * + * `ngtcp2_conn_get_initial_crypto_ctx` returns + * :type:`ngtcp2_crypto_ctx` object for Initial packet encryption. + */ +NGTCP2_EXTERN const ngtcp2_crypto_ctx * +ngtcp2_conn_get_initial_crypto_ctx(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_set_crypto_ctx` sets |ctx| for Handshake/1-RTT packet + * encryption. The passed data will be passed to + * :type:`ngtcp2_encrypt`, :type:`ngtcp2_decrypt` and + * :type:`ngtcp2_hp_mask` callbacks. + */ +NGTCP2_EXTERN void ngtcp2_conn_set_crypto_ctx(ngtcp2_conn *conn, + const ngtcp2_crypto_ctx *ctx); + +/** + * @function + * + * `ngtcp2_conn_get_crypto_ctx` returns :type:`ngtcp2_crypto_ctx` + * object for Handshake/1-RTT packet encryption. + */ +NGTCP2_EXTERN const ngtcp2_crypto_ctx * +ngtcp2_conn_get_crypto_ctx(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_set_0rtt_crypto_ctx` sets |ctx| for 0-RTT packet + * encryption. The passed data will be passed to + * :type:`ngtcp2_encrypt`, :type:`ngtcp2_decrypt` and + * :type:`ngtcp2_hp_mask` callbacks. + */ +NGTCP2_EXTERN void +ngtcp2_conn_set_0rtt_crypto_ctx(ngtcp2_conn *conn, + const ngtcp2_crypto_ctx *ctx); + +/** + * @function + * + * `ngtcp2_conn_get_0rtt_crypto_ctx` returns :type:`ngtcp2_crypto_ctx` + * object for 0-RTT packet encryption. + */ +NGTCP2_EXTERN const ngtcp2_crypto_ctx * +ngtcp2_conn_get_0rtt_crypto_ctx(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_get_tls_native_handle` returns TLS native handle set + * by `ngtcp2_conn_set_tls_native_handle`. + */ +NGTCP2_EXTERN void *ngtcp2_conn_get_tls_native_handle(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_set_tls_native_handle` sets TLS native handle + * |tls_native_handle| to |conn|. Internally, it is used as an opaque + * pointer. + */ +NGTCP2_EXTERN void ngtcp2_conn_set_tls_native_handle(ngtcp2_conn *conn, + void *tls_native_handle); + +/** + * @function + * + * `ngtcp2_conn_set_retry_aead` sets |aead| and |aead_ctx| for Retry + * integrity tag verification. |aead| must be AEAD_AES_128_GCM. + * |aead_ctx| must be initialized with :macro:`NGTCP2_RETRY_KEY` as + * encryption key. This function must be called if |conn| is + * initialized as client. Server does not verify the tag, and has no + * need to call this function. + * + * |conn| takes ownership of |aead_ctx|. + * :member:`ngtcp2_callbacks.delete_crypto_aead_ctx` will be called to + * delete this object when it is no longer used. + */ +NGTCP2_EXTERN void +ngtcp2_conn_set_retry_aead(ngtcp2_conn *conn, const ngtcp2_crypto_aead *aead, + const ngtcp2_crypto_aead_ctx *aead_ctx); + +/** + * @enum + * + * :type:`ngtcp2_ccerr_type` defines connection error type. + */ +typedef enum ngtcp2_ccerr_type { + /** + * :enum:`NGTCP2_CCERR_TYPE_TRANSPORT` indicates the QUIC transport + * error, and the error code is QUIC transport error code. + */ + NGTCP2_CCERR_TYPE_TRANSPORT, + /** + * :enum:`NGTCP2_CCERR_TYPE_APPLICATION` indicates an application + * error, and the error code is application error code. + */ + NGTCP2_CCERR_TYPE_APPLICATION, + /** + * :enum:`NGTCP2_CCERR_TYPE_VERSION_NEGOTIATION` is a special case + * of QUIC transport error, and it indicates that client receives + * Version Negotiation packet. + */ + NGTCP2_CCERR_TYPE_VERSION_NEGOTIATION, + /** + * :enum:`NGTCP2_CCERR_TYPE_IDLE_CLOSE` is a special case of QUIC + * transport error, and it indicates that connection is closed + * because of idle timeout. + */ + NGTCP2_CCERR_TYPE_IDLE_CLOSE, + /** + * :enum:`NGTCP2_CCERR_TYPE_DROP_CONN` is a special case of QUIC + * transport error, and it indicates that connection should be + * dropped without sending a CONNECTION_CLOSE frame. + */ + NGTCP2_CCERR_TYPE_DROP_CONN, + /** + * :enum:`NGTCP2_CCERR_TYPE_RETRY` is a special case of QUIC + * transport error, and it indicates that RETRY packet should be + * sent to a client. + */ + NGTCP2_CCERR_TYPE_RETRY +} ngtcp2_ccerr_type; + +/** + * @struct + * + * :type:`ngtcp2_ccerr` contains connection error code, its type, a + * frame type that caused this error, and the optional reason phrase. + */ +typedef struct ngtcp2_ccerr { + /** + * :member:`type` is the type of this error. + */ + ngtcp2_ccerr_type type; + /** + * :member:`error_code` is the error code for connection closure. + * Its interpretation depends on :member:`type`. + */ + uint64_t error_code; + /** + * :member:`frame_type` is the type of QUIC frame which triggers + * this connection error. This field is set to 0 if the frame type + * is unknown. + */ + uint64_t frame_type; + /** + * :member:`reason` points to the buffer which contains a reason + * phrase. It may be NULL if there is no reason phrase. If it is + * received from a remote endpoint, it is truncated to at most 1024 + * bytes. + */ + const uint8_t *reason; + /** + * :member:`reasonlen` is the length of data pointed by + * :member:`reason`. + */ + size_t reasonlen; +} ngtcp2_ccerr; + +/** + * @function + * + * `ngtcp2_ccerr_default` initializes |ccerr| with the default values. + * It sets the following fields: + * + * - :member:`type ` = + * :enum:`ngtcp2_ccerr_type.NGTCP2_CCERR_TYPE_TRANSPORT` + * - :member:`error_code ` = + * :macro:`NGTCP2_NO_ERROR`. + * - :member:`frame_type ` = 0 + * - :member:`reason ` = NULL + * - :member:`reasonlen ` = 0 + */ +NGTCP2_EXTERN void ngtcp2_ccerr_default(ngtcp2_ccerr *ccerr); + +/** + * @function + * + * `ngtcp2_ccerr_set_transport_error` sets :member:`ccerr->type + * ` to + * :enum:`ngtcp2_ccerr_type.NGTCP2_CCERR_TYPE_TRANSPORT`, and + * :member:`ccerr->error_code ` to + * |error_code|. |reason| is the reason phrase of length |reasonlen|. + * This function does not make a copy of the reason phrase. + */ +NGTCP2_EXTERN void ngtcp2_ccerr_set_transport_error(ngtcp2_ccerr *ccerr, + uint64_t error_code, + const uint8_t *reason, + size_t reasonlen); + +/** + * @function + * + * `ngtcp2_ccerr_set_liberr` sets type and error_code based on + * |liberr|. + * + * |reason| is the reason phrase of length |reasonlen|. This function + * does not make a copy of the reason phrase. + * + * If |liberr| is :macro:`NGTCP2_ERR_RECV_VERSION_NEGOTIATION`, + * :member:`ccerr->type ` is set to + * :enum:`ngtcp2_ccerr_type.NGTCP2_CCERR_TYPE_VERSION_NEGOTIATION`, + * and :member:`ccerr->error_code ` to + * :macro:`NGTCP2_NO_ERROR`. + * + * If |liberr| is :macro:`NGTCP2_ERR_IDLE_CLOSE`, :member:`ccerr->type + * ` is set to + * :enum:`ngtcp2_ccerr_type.NGTCP2_CCERR_TYPE_IDLE_CLOSE`, and + * :member:`ccerr->error_code ` to + * :macro:`NGTCP2_NO_ERROR`. + * + * If |liberr| is :macro:`NGTCP2_ERR_DROP_CONN`, :member:`ccerr->type + * ` is set to + * :enum:`ngtcp2_ccerr_type.NGTCP2_CCERR_TYPE_DROP_CONN`, and + * :member:`ccerr->error_code ` to + * :macro:`NGTCP2_NO_ERROR`. + * + * If |liberr| is :macro:`NGTCP2_ERR_RETRY`, :member:`ccerr->type + * ` is set to + * :enum:`ngtcp2_ccerr_type.NGTCP2_CCERR_TYPE_RETRY`, and + * :member:`ccerr->error_type ` to + * :macro:`NGTCP2_NO_ERROR`. + * + * Otherwise, :member:`ccerr->type ` is set to + * :enum:`ngtcp2_ccerr_type.NGTCP2_CCERR_TYPE_TRANSPORT`, and + * :member:`ccerr->error_code ` is set to an + * error code inferred by |liberr| (see + * `ngtcp2_err_infer_quic_transport_error_code`). + */ +NGTCP2_EXTERN void ngtcp2_ccerr_set_liberr(ngtcp2_ccerr *ccerr, int liberr, + const uint8_t *reason, + size_t reasonlen); + +/** + * @function + * + * `ngtcp2_ccerr_set_tls_alert` sets :member:`ccerr->type + * ` to + * :enum:`ngtcp2_ccerr_type.NGTCP2_CCERR_TYPE_TRANSPORT`, and + * :member:`ccerr->error_code ` to bitwise-OR + * of :macro:`NGTCP2_CRYPTO_ERROR` and |tls_alert|. |reason| is the + * reason phrase of length |reasonlen|. This function does not make a + * copy of the reason phrase. + */ +NGTCP2_EXTERN void ngtcp2_ccerr_set_tls_alert(ngtcp2_ccerr *ccerr, + uint8_t tls_alert, + const uint8_t *reason, + size_t reasonlen); + +/** + * @function + * + * `ngtcp2_ccerr_set_application_error` sets :member:`ccerr->type + * ` to + * :enum:`ngtcp2_ccerr_type.NGTCP2_CCERR_TYPE_APPLICATION`, and + * :member:`ccerr->error_code ` to + * |error_code|. |reason| is the reason phrase of length |reasonlen|. + * This function does not make a copy of the reason phrase. + */ +NGTCP2_EXTERN void ngtcp2_ccerr_set_application_error(ngtcp2_ccerr *ccerr, + uint64_t error_code, + const uint8_t *reason, + size_t reasonlen); + +/** + * @function + * + * `ngtcp2_conn_write_connection_close` writes a packet which contains + * CONNECTION_CLOSE frame(s) (type 0x1c or 0x1d) in the buffer pointed + * by |dest| whose capacity is |destlen|. + * + * For client, |destlen| should be at least + * :macro:`NGTCP2_MAX_UDP_PAYLOAD_SIZE`. + * + * If |path| is not ``NULL``, this function stores the network path + * with which the packet should be sent. Each addr field must point + * to the buffer which should be at least + * sizeof(:type:`ngtcp2_sockaddr_union`) bytes long. The assignment + * might not be done if nothing is written to |dest|. + * + * If |pi| is not ``NULL``, this function stores packet metadata in it + * if it succeeds. The metadata includes ECN markings. + * + * If :member:`ccerr->type ` == + * :enum:`ngtcp2_ccerr_type.NGTCP2_CCERR_TYPE_TRANSPORT`, this + * function sends CONNECTION_CLOSE (type 0x1c) frame. If + * :member:`ccerr->type ` == + * :enum:`ngtcp2_ccerr_type.NGTCP2_CCERR_TYPE_APPLICATION`, it sends + * CONNECTION_CLOSE (type 0x1d) frame. Otherwise, it does not produce + * any data, and returns 0. + * + * |destlen| could be shorten by some factors (e.g., server side + * amplification limit). This function returns + * :macro:`NGTCP2_ERR_NOBUF` if the resulting buffer is too small even + * if the given buffer has enough space. + * + * This function must not be called from inside the callback + * functions. + * + * At the moment, successful call to this function makes connection + * close. We may change this behaviour in the future to allow + * graceful shutdown. + * + * This function returns the number of bytes written in |dest| if it + * succeeds, or one of the following negative error codes: + * + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory + * :macro:`NGTCP2_ERR_NOBUF` + * Buffer is too small + * :macro:`NGTCP2_ERR_INVALID_STATE` + * The current state does not allow sending CONNECTION_CLOSE + * frame. + * :macro:`NGTCP2_ERR_PKT_NUM_EXHAUSTED` + * Packet number is exhausted, and cannot send any more packet. + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE` + * User callback failed + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_conn_write_connection_close_versioned( + ngtcp2_conn *conn, ngtcp2_path *path, int pkt_info_version, + ngtcp2_pkt_info *pi, uint8_t *dest, size_t destlen, const ngtcp2_ccerr *ccerr, + ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_conn_get_ccerr` returns the received connection close + * error. If no connection error is received, it returns + * :type:`ngtcp2_ccerr` that is initialized by `ngtcp2_ccerr_default`. + */ +NGTCP2_EXTERN const ngtcp2_ccerr *ngtcp2_conn_get_ccerr(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_is_local_stream` returns nonzero if |stream_id| + * denotes a locally initiated stream. + */ +NGTCP2_EXTERN int ngtcp2_conn_is_local_stream(ngtcp2_conn *conn, + int64_t stream_id); + +/** + * @function + * + * `ngtcp2_conn_is_server` returns nonzero if |conn| is initialized as + * server. + */ +NGTCP2_EXTERN int ngtcp2_conn_is_server(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_after_retry` returns nonzero if |conn| as a client has + * received Retry packet from server, and successfully validated it. + */ +NGTCP2_EXTERN int ngtcp2_conn_after_retry(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_set_stream_user_data` sets |stream_user_data| to the + * stream identified by |stream_id|. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_STREAM_NOT_FOUND` + * Stream does not exist + */ +NGTCP2_EXTERN int ngtcp2_conn_set_stream_user_data(ngtcp2_conn *conn, + int64_t stream_id, + void *stream_user_data); + +/** + * @function + * + * `ngtcp2_conn_update_pkt_tx_time` sets the time instant of the next + * packet transmission to pace packets. This function must be called + * after (multiple invocation of) `ngtcp2_conn_writev_stream`. If + * packet aggregation (e.g., packet batching, GSO) is used, call this + * function after all aggregated datagrams are sent, which indicates + * multiple invocation of `ngtcp2_conn_writev_stream`. + */ +NGTCP2_EXTERN void ngtcp2_conn_update_pkt_tx_time(ngtcp2_conn *conn, + ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_conn_get_send_quantum` returns the maximum number of bytes + * that can be sent in one go without packet spacing. + */ +NGTCP2_EXTERN size_t ngtcp2_conn_get_send_quantum(ngtcp2_conn *conn); + +/** + * @function + * + * `ngtcp2_conn_get_stream_loss_count` returns the number of packets + * that contain STREAM frame for a stream identified by |stream_id| + * and are declared to be lost. The number may include the spurious + * losses. If no stream identified by |stream_id| is found, this + * function returns 0. + */ +NGTCP2_EXTERN size_t ngtcp2_conn_get_stream_loss_count(ngtcp2_conn *conn, + int64_t stream_id); + +/** + * @function + * + * `ngtcp2_strerror` returns the text representation of |liberr|. + * |liberr| must be one of ngtcp2 library error codes (which is + * defined as :macro:`NGTCP2_ERR_* ` + * macros). + */ +NGTCP2_EXTERN const char *ngtcp2_strerror(int liberr); + +/** + * @function + * + * `ngtcp2_err_is_fatal` returns nonzero if |liberr| is a fatal error. + * |liberr| must be one of ngtcp2 library error codes (which is + * defined as :macro:`NGTCP2_ERR_* ` + * macros). + */ +NGTCP2_EXTERN int ngtcp2_err_is_fatal(int liberr); + +/** + * @function + * + * `ngtcp2_err_infer_quic_transport_error_code` returns a QUIC + * transport error code which corresponds to |liberr|. |liberr| must + * be one of ngtcp2 library error codes (which is defined as + * :macro:`NGTCP2_ERR_* ` macros). + */ +NGTCP2_EXTERN uint64_t ngtcp2_err_infer_quic_transport_error_code(int liberr); + +/** + * @function + * + * `ngtcp2_addr_init` initializes |dest| with the given arguments and + * returns |dest|. + */ +NGTCP2_EXTERN ngtcp2_addr *ngtcp2_addr_init(ngtcp2_addr *dest, + const ngtcp2_sockaddr *addr, + ngtcp2_socklen addrlen); + +/** + * @function + * + * `ngtcp2_addr_copy_byte` copies |addr| of length |addrlen| into the + * buffer pointed by :member:`dest->addr `. + * :member:`dest->addrlen ` is updated to have + * |addrlen|. This function assumes that :member:`dest->addr + * ` points to a buffer which has a sufficient + * capacity to store the copy. + */ +NGTCP2_EXTERN void ngtcp2_addr_copy_byte(ngtcp2_addr *dest, + const ngtcp2_sockaddr *addr, + ngtcp2_socklen addrlen); + +/** + * @function + * + * `ngtcp2_path_storage_init` initializes |ps| with the given + * arguments. This function copies |local_addr| and |remote_addr|. + */ +NGTCP2_EXTERN void ngtcp2_path_storage_init(ngtcp2_path_storage *ps, + const ngtcp2_sockaddr *local_addr, + ngtcp2_socklen local_addrlen, + const ngtcp2_sockaddr *remote_addr, + ngtcp2_socklen remote_addrlen, + void *user_data); + +/** + * @function + * + * `ngtcp2_path_storage_zero` initializes |ps| with the zero length + * addresses. + */ +NGTCP2_EXTERN void ngtcp2_path_storage_zero(ngtcp2_path_storage *ps); + +/** + * @function + * + * `ngtcp2_settings_default` initializes |settings| with the default + * values. First this function fills |settings| with 0, and set the + * default value to the following fields: + * + * * :type:`cc_algo ` = + * :enum:`ngtcp2_cc_algo.NGTCP2_CC_ALGO_CUBIC` + * * :type:`initial_rtt ` = + * :macro:`NGTCP2_DEFAULT_INITIAL_RTT` + * * :type:`ack_thresh ` = 2 + * * :type:`max_tx_udp_payload_size + * ` = 1452 + * * :type:`handshake_timeout ` = + * ``UINT64_MAX`` + */ +NGTCP2_EXTERN void ngtcp2_settings_default_versioned(int settings_version, + ngtcp2_settings *settings); + +/** + * @function + * + * `ngtcp2_transport_params_default` initializes |params| with the + * default values. First this function fills |params| with 0, and set + * the default value to the following fields: + * + * * :type:`max_udp_payload_size + * ` = + * :macro:`NGTCP2_DEFAULT_MAX_RECV_UDP_PAYLOAD_SIZE` + * * :type:`ack_delay_exponent + * ` = + * :macro:`NGTCP2_DEFAULT_ACK_DELAY_EXPONENT` + * * :type:`max_ack_delay ` = + * :macro:`NGTCP2_DEFAULT_MAX_ACK_DELAY` + * * :type:`active_connection_id_limit + * ` = + * :macro:`NGTCP2_DEFAULT_ACTIVE_CONNECTION_ID_LIMIT` + */ +NGTCP2_EXTERN void +ngtcp2_transport_params_default_versioned(int transport_params_version, + ngtcp2_transport_params *params); + +/** + * @function + * + * `ngtcp2_mem_default` returns the default, system standard memory + * allocator. + */ +NGTCP2_EXTERN const ngtcp2_mem *ngtcp2_mem_default(void); + +/** + * @macrosection + * + * ngtcp2_info macros + */ + +/** + * @macro + * + * :macro:`NGTCP2_VERSION_AGE` is the age of :type:`ngtcp2_info` + */ +#define NGTCP2_VERSION_AGE 1 + +/** + * @struct + * + * :type:`ngtcp2_info` is what `ngtcp2_version` returns. It holds + * information about the particular ngtcp2 version. + */ +typedef struct ngtcp2_info { + /** + * :member:`age` is the age of this struct. This instance of ngtcp2 + * sets it to :macro:`NGTCP2_VERSION_AGE` but a future version may + * bump it and add more struct fields at the bottom + */ + int age; + /** + * :member:`version_num` is the :macro:`NGTCP2_VERSION_NUM` number + * (since :member:`age` ==1) + */ + int version_num; + /** + * :member:`version_str` points to the :macro:`NGTCP2_VERSION` + * string (since :member:`age` ==1) + */ + const char *version_str; + /* -------- the above fields all exist when age == 1 */ +} ngtcp2_info; + +/** + * @function + * + * `ngtcp2_version` returns a pointer to a :type:`ngtcp2_info` struct + * with version information about the run-time library in use. The + * |least_version| argument can be set to a 24 bit numerical value for + * the least accepted version number, and if the condition is not met, + * this function will return a ``NULL``. Pass in 0 to skip the + * version checking. + */ +NGTCP2_EXTERN const ngtcp2_info *ngtcp2_version(int least_version); + +/** + * @function + * + * `ngtcp2_is_bidi_stream` returns nonzero if |stream_id| denotes + * bidirectional stream. + */ +NGTCP2_EXTERN int ngtcp2_is_bidi_stream(int64_t stream_id); + +/** + * @function + * + * `ngtcp2_path_copy` copies |src| into |dest|. This function assumes + * that |dest| has enough buffer to store the deep copy of + * :member:`src->local ` and :member:`src->remote + * `. + */ +NGTCP2_EXTERN void ngtcp2_path_copy(ngtcp2_path *dest, const ngtcp2_path *src); + +/** + * @function + * + * `ngtcp2_path_eq` returns nonzero if |a| and |b| shares the same + * local and remote addresses. + */ +NGTCP2_EXTERN int ngtcp2_path_eq(const ngtcp2_path *a, const ngtcp2_path *b); + +/** + * @function + * + * `ngtcp2_is_supported_version` returns nonzero if the library + * supports QUIC version |version|. + */ +NGTCP2_EXTERN int ngtcp2_is_supported_version(uint32_t version); + +/** + * @function + * + * `ngtcp2_is_reserved_version` returns nonzero if |version| is a + * reserved version. + */ +NGTCP2_EXTERN int ngtcp2_is_reserved_version(uint32_t version); + +/** + * @function + * + * `ngtcp2_select_version` selects and returns a version from the + * version set |offered_versions| of |offered_versionslen| elements. + * |preferred_versions| of |preferred_versionslen| elements specifies + * the preference of versions, which is sorted in the order of + * preference. All versions included in |preferred_versions| must be + * supported by the library, that is, passing any version in the array + * to `ngtcp2_is_supported_version` must return nonzero. This + * function is intended to be used by client when it receives Version + * Negotiation packet. If no version is selected, this function + * returns 0. + */ +NGTCP2_EXTERN uint32_t ngtcp2_select_version(const uint32_t *preferred_versions, + size_t preferred_versionslen, + const uint32_t *offered_versions, + size_t offered_versionslen); + +/* + * Versioned function wrappers + */ + +/* + * `ngtcp2_conn_read_pkt` is a wrapper around + * `ngtcp2_conn_read_pkt_versioned` to set the correct struct version. + */ +#define ngtcp2_conn_read_pkt(CONN, PATH, PI, PKT, PKTLEN, TS) \ + ngtcp2_conn_read_pkt_versioned((CONN), (PATH), NGTCP2_PKT_INFO_VERSION, \ + (PI), (PKT), (PKTLEN), (TS)) + +/* + * `ngtcp2_conn_write_pkt` is a wrapper around + * `ngtcp2_conn_write_pkt_versioned` to set the correct struct + * version. + */ +#define ngtcp2_conn_write_pkt(CONN, PATH, PI, DEST, DESTLEN, TS) \ + ngtcp2_conn_write_pkt_versioned((CONN), (PATH), NGTCP2_PKT_INFO_VERSION, \ + (PI), (DEST), (DESTLEN), (TS)) + +/* + * `ngtcp2_conn_write_stream` is a wrapper around + * `ngtcp2_conn_write_stream_versioned` to set the correct struct + * version. + */ +#define ngtcp2_conn_write_stream(CONN, PATH, PI, DEST, DESTLEN, PDATALEN, \ + FLAGS, STREAM_ID, DATA, DATALEN, TS) \ + ngtcp2_conn_write_stream_versioned( \ + (CONN), (PATH), NGTCP2_PKT_INFO_VERSION, (PI), (DEST), (DESTLEN), \ + (PDATALEN), (FLAGS), (STREAM_ID), (DATA), (DATALEN), (TS)) + +/* + * `ngtcp2_conn_writev_stream` is a wrapper around + * `ngtcp2_conn_writev_stream_versioned` to set the correct struct + * version. + */ +#define ngtcp2_conn_writev_stream(CONN, PATH, PI, DEST, DESTLEN, PDATALEN, \ + FLAGS, STREAM_ID, DATAV, DATAVCNT, TS) \ + ngtcp2_conn_writev_stream_versioned( \ + (CONN), (PATH), NGTCP2_PKT_INFO_VERSION, (PI), (DEST), (DESTLEN), \ + (PDATALEN), (FLAGS), (STREAM_ID), (DATAV), (DATAVCNT), (TS)) + +/* + * `ngtcp2_conn_write_datagram` is a wrapper around + * `ngtcp2_conn_write_datagram_versioned` to set the correct struct + * version. + */ +#define ngtcp2_conn_write_datagram(CONN, PATH, PI, DEST, DESTLEN, PACCEPTED, \ + FLAGS, DGRAM_ID, DATA, DATALEN, TS) \ + ngtcp2_conn_write_datagram_versioned( \ + (CONN), (PATH), NGTCP2_PKT_INFO_VERSION, (PI), (DEST), (DESTLEN), \ + (PACCEPTED), (FLAGS), (DGRAM_ID), (DATA), (DATALEN), (TS)) + +/* + * `ngtcp2_conn_writev_datagram` is a wrapper around + * `ngtcp2_conn_writev_datagram_versioned` to set the correct struct + * version. + */ +#define ngtcp2_conn_writev_datagram(CONN, PATH, PI, DEST, DESTLEN, PACCEPTED, \ + FLAGS, DGRAM_ID, DATAV, DATAVCNT, TS) \ + ngtcp2_conn_writev_datagram_versioned( \ + (CONN), (PATH), NGTCP2_PKT_INFO_VERSION, (PI), (DEST), (DESTLEN), \ + (PACCEPTED), (FLAGS), (DGRAM_ID), (DATAV), (DATAVCNT), (TS)) + +/* + * `ngtcp2_conn_write_connection_close` is a wrapper around + * `ngtcp2_conn_write_connection_close_versioned` to set the correct + * struct version. + */ +#define ngtcp2_conn_write_connection_close(CONN, PATH, PI, DEST, DESTLEN, \ + CCERR, TS) \ + ngtcp2_conn_write_connection_close_versioned( \ + (CONN), (PATH), NGTCP2_PKT_INFO_VERSION, (PI), (DEST), (DESTLEN), (CCERR), \ + (TS)) + +/* + * `ngtcp2_transport_params_encode` is a wrapper around + * `ngtcp2_transport_params_encode_versioned` to set the correct + * struct version. + */ +#define ngtcp2_transport_params_encode(DEST, DESTLEN, PARAMS) \ + ngtcp2_transport_params_encode_versioned( \ + (DEST), (DESTLEN), NGTCP2_TRANSPORT_PARAMS_VERSION, (PARAMS)) + +/* + * `ngtcp2_transport_params_decode` is a wrapper around + * `ngtcp2_transport_params_decode_versioned` to set the correct + * struct version. + */ +#define ngtcp2_transport_params_decode(PARAMS, DATA, DATALEN) \ + ngtcp2_transport_params_decode_versioned(NGTCP2_TRANSPORT_PARAMS_VERSION, \ + (PARAMS), (DATA), (DATALEN)) + +/* + * `ngtcp2_conn_client_new` is a wrapper around + * `ngtcp2_conn_client_new_versioned` to set the correct struct + * version. + */ +#define ngtcp2_conn_client_new(PCONN, DCID, SCID, PATH, VERSION, CALLBACKS, \ + SETTINGS, PARAMS, MEM, USER_DATA) \ + ngtcp2_conn_client_new_versioned( \ + (PCONN), (DCID), (SCID), (PATH), (VERSION), NGTCP2_CALLBACKS_VERSION, \ + (CALLBACKS), NGTCP2_SETTINGS_VERSION, (SETTINGS), \ + NGTCP2_TRANSPORT_PARAMS_VERSION, (PARAMS), (MEM), (USER_DATA)) + +/* + * `ngtcp2_conn_server_new` is a wrapper around + * `ngtcp2_conn_server_new_versioned` to set the correct struct + * version. + */ +#define ngtcp2_conn_server_new(PCONN, DCID, SCID, PATH, VERSION, CALLBACKS, \ + SETTINGS, PARAMS, MEM, USER_DATA) \ + ngtcp2_conn_server_new_versioned( \ + (PCONN), (DCID), (SCID), (PATH), (VERSION), NGTCP2_CALLBACKS_VERSION, \ + (CALLBACKS), NGTCP2_SETTINGS_VERSION, (SETTINGS), \ + NGTCP2_TRANSPORT_PARAMS_VERSION, (PARAMS), (MEM), (USER_DATA)) + +/* + * `ngtcp2_conn_set_local_transport_params` is a wrapper around + * `ngtcp2_conn_set_local_transport_params_versioned` to set the + * correct struct version. + */ +#define ngtcp2_conn_set_local_transport_params(CONN, PARAMS) \ + ngtcp2_conn_set_local_transport_params_versioned( \ + (CONN), NGTCP2_TRANSPORT_PARAMS_VERSION, (PARAMS)) + +/* + * `ngtcp2_transport_params_default` is a wrapper around + * `ngtcp2_transport_params_default_versioned` to set the correct + * struct version. + */ +#define ngtcp2_transport_params_default(PARAMS) \ + ngtcp2_transport_params_default_versioned(NGTCP2_TRANSPORT_PARAMS_VERSION, \ + (PARAMS)) + +/* + * `ngtcp2_conn_get_conn_info` is a wrapper around + * `ngtcp2_conn_get_conn_info_versioned` to set the correct struct + * version. + */ +#define ngtcp2_conn_get_conn_info(CONN, CINFO) \ + ngtcp2_conn_get_conn_info_versioned((CONN), NGTCP2_CONN_INFO_VERSION, (CINFO)) + +/* + * `ngtcp2_settings_default` is a wrapper around + * `ngtcp2_settings_default_versioned` to set the correct struct + * version. + */ +#define ngtcp2_settings_default(SETTINGS) \ + ngtcp2_settings_default_versioned(NGTCP2_SETTINGS_VERSION, (SETTINGS)) + +#ifdef _MSC_VER +# pragma warning(pop) +#endif /* defined(_MSC_VER) */ + +#ifdef __cplusplus +} +#endif /* defined(__cplusplus) */ + +#endif /* !defined(NGTCP2_H) */ diff --git a/curl/include/ngtcp2/ngtcp2_crypto.h b/curl/include/ngtcp2/ngtcp2_crypto.h new file mode 100644 index 0000000..003ec6b --- /dev/null +++ b/curl/include/ngtcp2/ngtcp2_crypto.h @@ -0,0 +1,963 @@ +/* + * ngtcp2 + * + * Copyright (c) 2019 ngtcp2 contributors + * + * Permission is hereby granted, free of charge, to any person obtaining + * a copy of this software and associated documentation files (the + * "Software"), to deal in the Software without restriction, including + * without limitation the rights to use, copy, modify, merge, publish, + * distribute, sublicense, and/or sell copies of the Software, and to + * permit persons to whom the Software is furnished to do so, subject to + * the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + */ +#ifndef NGTCP2_CRYPTO_H +#define NGTCP2_CRYPTO_H + +#include + +#ifdef __cplusplus +extern "C" { +#endif /* defined(__cplusplus) */ + +#ifdef WIN32 +# ifndef WIN32_LEAN_AND_MEAN +# define WIN32_LEAN_AND_MEAN +# endif /* !defined(WIN32_LEAN_AND_MEAN) */ +# include +#endif /* defined(WIN32) */ + +/** + * @macrosection + * + * ngtcp2 crypto library error codes + */ + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_ERR_INTERNAL` indicates an internal error. + */ +#define NGTCP2_CRYPTO_ERR_INTERNAL -201 + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN` indicates that a token + * is unreadable because it is not correctly formatted; or verifying + * the integrity protection failed. + */ +#define NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN -202 + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_ERR_VERIFY_TOKEN` indicates that a token does + * not probe the client address; or the token validity has expired; or + * it contains invalid Connection ID. + */ +#define NGTCP2_CRYPTO_ERR_VERIFY_TOKEN -203 + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_ERR_NOMEM` indicates out of memory. + */ +#define NGTCP2_CRYPTO_ERR_NOMEM -501 + +/** + * @function + * + * `ngtcp2_crypto_ctx_tls` initializes |ctx| by extracting negotiated + * ciphers and message digests from native TLS session + * |tls_native_handle|. This is used for encrypting/decrypting + * Handshake and 1-RTT packets. If it is unable to obtain necessary + * data from |tls_native_handle|, this function returns NULL. + * + * If libngtcp2_crypto_quictls is linked, |tls_native_handle| must be + * a pointer to SSL object. + */ +NGTCP2_EXTERN ngtcp2_crypto_ctx *ngtcp2_crypto_ctx_tls(ngtcp2_crypto_ctx *ctx, + void *tls_native_handle); + +/** + * @function + * + * `ngtcp2_crypto_ctx_tls_early` initializes |ctx| by extracting early + * ciphers and message digests from native TLS session + * |tls_native_handle|. This is used for encrypting/decrypting 0-RTT + * packets. If it is unable to obtain necessary data from + * |tls_native_handle|, this function returns NULL. + * + * If libngtcp2_crypto_quictls is linked, |tls_native_handle| must be + * a pointer to SSL object. + */ +NGTCP2_EXTERN ngtcp2_crypto_ctx * +ngtcp2_crypto_ctx_tls_early(ngtcp2_crypto_ctx *ctx, void *tls_native_handle); + +/** + * @function + * + * `ngtcp2_crypto_md_init` initializes |md| with the provided + * |md_native_handle| which is an underlying message digest object. + * + * If libngtcp2_crypto_quictls is linked, |md_native_handle| must be a + * pointer to EVP_MD. + * + * If libngtcp2_crypto_gnutls is linked, |md_native_handle| must be + * gnutls_mac_algorithm_t casted to ``void *``. + * + * If libngtcp2_crypto_boringssl is linked, |md_native_handle| must be + * a pointer to EVP_MD. + */ +NGTCP2_EXTERN ngtcp2_crypto_md *ngtcp2_crypto_md_init(ngtcp2_crypto_md *md, + void *md_native_handle); + +/** + * @function + * + * `ngtcp2_crypto_md_hashlen` returns the length of |md| output. + */ +NGTCP2_EXTERN size_t ngtcp2_crypto_md_hashlen(const ngtcp2_crypto_md *md); + +/** + * @function + * + * `ngtcp2_crypto_aead_keylen` returns the length of key for |aead|. + */ +NGTCP2_EXTERN size_t ngtcp2_crypto_aead_keylen(const ngtcp2_crypto_aead *aead); + +/** + * @function + * + * `ngtcp2_crypto_aead_noncelen` returns the length of nonce for + * |aead|. + */ +NGTCP2_EXTERN size_t +ngtcp2_crypto_aead_noncelen(const ngtcp2_crypto_aead *aead); + +/** + * @function + * + * `ngtcp2_crypto_hkdf_extract` performs HKDF extract operation. + * + * The length of output is `ngtcp2_crypto_md_hashlen(md) + * `. The output is stored in the buffer + * pointed by |dest|. The caller is responsible to specify the buffer + * that has enough capacity to store the output. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int +ngtcp2_crypto_hkdf_extract(uint8_t *dest, const ngtcp2_crypto_md *md, + const uint8_t *secret, size_t secretlen, + const uint8_t *salt, size_t saltlen); + +/** + * @function + * + * `ngtcp2_crypto_hkdf_expand` performs HKDF expand operation. The + * result is |destlen| bytes long, and is stored in the buffer pointed + * by |dest|. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int ngtcp2_crypto_hkdf_expand( + uint8_t *dest, size_t destlen, const ngtcp2_crypto_md *md, + const uint8_t *secret, size_t secretlen, const uint8_t *info, size_t infolen); + +/** + * @function + * + * `ngtcp2_crypto_hkdf` performs HKDF operation. The result is + * |destlen| bytes long, and is stored in the buffer pointed by + * |dest|. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int ngtcp2_crypto_hkdf(uint8_t *dest, size_t destlen, + const ngtcp2_crypto_md *md, + const uint8_t *secret, size_t secretlen, + const uint8_t *salt, size_t saltlen, + const uint8_t *info, size_t infolen); + +/** + * @function + * + * `ngtcp2_crypto_packet_protection_ivlen` returns the length of IV + * used to encrypt QUIC packet. + */ +NGTCP2_EXTERN size_t +ngtcp2_crypto_packet_protection_ivlen(const ngtcp2_crypto_aead *aead); + +/** + * @function + * + * `ngtcp2_crypto_encrypt` encrypts |plaintext| of length + * |plaintextlen| and writes the ciphertext into the buffer pointed by + * |dest|. The length of ciphertext is |plaintextlen| + + * :member:`aead->max_overhead ` + * bytes long. |dest| must have enough capacity to store the + * ciphertext. |dest| and |plaintext| may point to the same buffer. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int ngtcp2_crypto_encrypt(uint8_t *dest, + const ngtcp2_crypto_aead *aead, + const ngtcp2_crypto_aead_ctx *aead_ctx, + const uint8_t *plaintext, + size_t plaintextlen, + const uint8_t *nonce, size_t noncelen, + const uint8_t *aad, size_t aadlen); + +/** + * @function + * + * `ngtcp2_crypto_encrypt_cb` is a wrapper function around + * `ngtcp2_crypto_encrypt`. It can be directly passed to + * :member:`ngtcp2_callbacks.encrypt` field. + * + * This function returns 0 if it succeeds, or + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE`. + */ +NGTCP2_EXTERN int +ngtcp2_crypto_encrypt_cb(uint8_t *dest, const ngtcp2_crypto_aead *aead, + const ngtcp2_crypto_aead_ctx *aead_ctx, + const uint8_t *plaintext, size_t plaintextlen, + const uint8_t *nonce, size_t noncelen, + const uint8_t *aad, size_t aadlen); + +/** + * @function + * + * `ngtcp2_crypto_decrypt` decrypts |ciphertext| of length + * |ciphertextlen| and writes the plaintext into the buffer pointed by + * |dest|. The length of plaintext is |ciphertextlen| - + * :member:`aead->max_overhead ` + * bytes long. |dest| must have enough capacity to store the + * plaintext. |dest| and |ciphertext| may point to the same buffer. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int ngtcp2_crypto_decrypt(uint8_t *dest, + const ngtcp2_crypto_aead *aead, + const ngtcp2_crypto_aead_ctx *aead_ctx, + const uint8_t *ciphertext, + size_t ciphertextlen, + const uint8_t *nonce, size_t noncelen, + const uint8_t *aad, size_t aadlen); + +/** + * @function + * + * `ngtcp2_crypto_decrypt_cb` is a wrapper function around + * `ngtcp2_crypto_decrypt`. It can be directly passed to + * :member:`ngtcp2_callbacks.decrypt` field. + * + * This function returns 0 if it succeeds, or + * :macro:`NGTCP2_ERR_TLS_DECRYPT`. + */ +NGTCP2_EXTERN int +ngtcp2_crypto_decrypt_cb(uint8_t *dest, const ngtcp2_crypto_aead *aead, + const ngtcp2_crypto_aead_ctx *aead_ctx, + const uint8_t *ciphertext, size_t ciphertextlen, + const uint8_t *nonce, size_t noncelen, + const uint8_t *aad, size_t aadlen); + +/** + * @function + * + * `ngtcp2_crypto_hp_mask` generates a mask which is used in packet + * header encryption. The mask is written to the buffer pointed by + * |dest|. The sample is passed as |sample| which is + * :macro:`NGTCP2_HP_SAMPLELEN` bytes long. The length of mask must + * be at least :macro:`NGTCP2_HP_MASKLEN`. The library only uses the + * first :macro:`NGTCP2_HP_MASKLEN` bytes of the produced mask. The + * buffer pointed by |dest| must have at least + * :macro:`NGTCP2_HP_SAMPLELEN` bytes available. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int ngtcp2_crypto_hp_mask(uint8_t *dest, + const ngtcp2_crypto_cipher *hp, + const ngtcp2_crypto_cipher_ctx *hp_ctx, + const uint8_t *sample); + +/** + * @function + * + * `ngtcp2_crypto_hp_mask_cb` is a wrapper function around + * `ngtcp2_crypto_hp_mask`. It can be directly passed to + * :member:`ngtcp2_callbacks.hp_mask` field. + * + * This function returns 0 if it succeeds, or + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE`. + */ +NGTCP2_EXTERN int +ngtcp2_crypto_hp_mask_cb(uint8_t *dest, const ngtcp2_crypto_cipher *hp, + const ngtcp2_crypto_cipher_ctx *hp_ctx, + const uint8_t *sample); + +/** + * @function + * + * `ngtcp2_crypto_derive_and_install_rx_key` derives the decryption + * keying materials from |secret|, and installs them to |conn|. + * + * If |key| is not NULL, the derived packet protection key is written + * to the buffer pointed by |key|. If |iv| is not NULL, the derived + * packet protection IV is written to the buffer pointed by |iv|. If + * |hp| is not NULL, the derived header protection key is written to + * the buffer pointed by |hp|. + * + * |secretlen| specifies the length of |secret|. + * + * The length of packet protection key and header protection key is + * `ngtcp2_crypto_aead_keylen(ctx->aead) `, + * and the length of packet protection IV is + * `ngtcp2_crypto_packet_protection_ivlen(ctx->aead) + * ` where ctx is obtained by + * `ngtcp2_crypto_ctx_tls` (or `ngtcp2_crypto_ctx_tls_early` if + * |level| == + * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`). + * + * In the first call of this function, it calls + * `ngtcp2_conn_set_crypto_ctx` (or `ngtcp2_conn_set_early_crypto_ctx` + * if |level| == + * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to + * set negotiated AEAD and message digest algorithm. After the + * successful call of this function, application can use + * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx` + * if |level| == + * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to + * get :type:`ngtcp2_crypto_ctx`. + * + * If |conn| is initialized as client, and |level| is + * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this + * function retrieves a remote QUIC transport parameters extension + * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and + * sets it to |conn| by calling + * `ngtcp2_conn_decode_and_set_remote_transport_params`. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int ngtcp2_crypto_derive_and_install_rx_key( + ngtcp2_conn *conn, uint8_t *key, uint8_t *iv, uint8_t *hp, + ngtcp2_encryption_level level, const uint8_t *secret, size_t secretlen); + +/** + * @function + * + * `ngtcp2_crypto_derive_and_install_tx_key` derives the encryption + * keying materials from |secret|, and installs new keys to |conn|. + * + * If |key| is not NULL, the derived packet protection key is written + * to the buffer pointed by |key|. If |iv| is not NULL, the derived + * packet protection IV is written to the buffer pointed by |iv|. If + * |hp| is not NULL, the derived header protection key is written to + * the buffer pointed by |hp|. + * + * |secretlen| specifies the length of |secret|. + * + * The length of packet protection key and header protection key is + * `ngtcp2_crypto_aead_keylen(ctx->aead) `, + * and the length of packet protection IV is + * `ngtcp2_crypto_packet_protection_ivlen(ctx->aead) + * ` where ctx is obtained by + * `ngtcp2_crypto_ctx_tls` (or `ngtcp2_crypto_ctx_tls_early` if + * |level| == + * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`). + * + * In the first call of this function, it calls + * `ngtcp2_conn_set_crypto_ctx` (or `ngtcp2_conn_set_early_crypto_ctx` + * if |level| == + * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to + * set negotiated AEAD and message digest algorithm. After the + * successful call of this function, application can use + * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx` + * if |level| == + * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to + * get :type:`ngtcp2_crypto_ctx`. + * + * If |conn| is initialized as server, and |level| is + * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this + * function retrieves a remote QUIC transport parameters extension + * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and + * sets it to |conn| by calling + * `ngtcp2_conn_decode_and_set_remote_transport_params`. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int ngtcp2_crypto_derive_and_install_tx_key( + ngtcp2_conn *conn, uint8_t *key, uint8_t *iv, uint8_t *hp, + ngtcp2_encryption_level level, const uint8_t *secret, size_t secretlen); + +/** + * @function + * + * `ngtcp2_crypto_update_key` updates traffic keying materials. + * + * The new decryption traffic secret is written to the buffer pointed + * by |rx_secret|. The length of secret is |secretlen| bytes, and + * |rx_secret| must point to the buffer which has enough capacity. + * + * The new encryption traffic secret is written to the buffer pointed + * by |tx_secret|. The length of secret is |secretlen| bytes, and + * |tx_secret| must point to the buffer which has enough capacity. + * + * The derived decryption packet protection key is written to the + * buffer pointed by |rx_key|. The derived decryption packet + * protection IV is written to the buffer pointed by |rx_iv|. + * |rx_aead_ctx| is initialized with the derived key and IV. + * + * The derived encryption packet protection key is written to the + * buffer pointed by |tx_key|. The derived encryption packet + * protection IV is written to the buffer pointed by |tx_iv|. + * |tx_aead_ctx| is initialized with the derived key and IV. + * + * |current_rx_secret| and |current_tx_secret| are the current + * decryption and encryption traffic secrets respectively. They share + * the same length with |rx_secret| and |tx_secret|. + * + * The length of packet protection key and header protection key is + * `ngtcp2_crypto_aead_keylen(ctx->aead) `, + * and the length of packet protection IV is + * `ngtcp2_crypto_packet_protection_ivlen(ctx->aead) + * ` where ctx is obtained by + * `ngtcp2_crypto_ctx_tls`. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int ngtcp2_crypto_update_key( + ngtcp2_conn *conn, uint8_t *rx_secret, uint8_t *tx_secret, + ngtcp2_crypto_aead_ctx *rx_aead_ctx, uint8_t *rx_key, uint8_t *rx_iv, + ngtcp2_crypto_aead_ctx *tx_aead_ctx, uint8_t *tx_key, uint8_t *tx_iv, + const uint8_t *current_rx_secret, const uint8_t *current_tx_secret, + size_t secretlen); + +/** + * @function + * + * `ngtcp2_crypto_update_key_cb` is a wrapper function around + * `ngtcp2_crypto_update_key`. It can be directly passed to + * :member:`ngtcp2_callbacks.update_key` field. + * + * This function returns 0 if it succeeds, or + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE`. + */ +NGTCP2_EXTERN int ngtcp2_crypto_update_key_cb( + ngtcp2_conn *conn, uint8_t *rx_secret, uint8_t *tx_secret, + ngtcp2_crypto_aead_ctx *rx_aead_ctx, uint8_t *rx_iv, + ngtcp2_crypto_aead_ctx *tx_aead_ctx, uint8_t *tx_iv, + const uint8_t *current_rx_secret, const uint8_t *current_tx_secret, + size_t secretlen, void *user_data); + +/** + * @function + * + * `ngtcp2_crypto_client_initial_cb` installs initial secrets and + * encryption keys, and sets QUIC transport parameters. + * + * This function can be directly passed to + * :member:`ngtcp2_callbacks.client_initial` field. It is only used + * by client. + * + * This function returns 0 if it succeeds, or + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE`. + */ +NGTCP2_EXTERN int ngtcp2_crypto_client_initial_cb(ngtcp2_conn *conn, + void *user_data); + +/** + * @function + * + * `ngtcp2_crypto_recv_retry_cb` re-installs initial secrets in + * response to incoming Retry packet. + * + * This function can be directly passed to + * :member:`ngtcp2_callbacks.recv_retry` field. It is only used by + * client. + * + * This function returns 0 if it succeeds, or + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE`. + */ +NGTCP2_EXTERN int ngtcp2_crypto_recv_retry_cb(ngtcp2_conn *conn, + const ngtcp2_pkt_hd *hd, + void *user_data); + +/** + * @function + * + * `ngtcp2_crypto_recv_client_initial_cb` installs initial secrets in + * response to an incoming Initial packet from client, and sets QUIC + * transport parameters. + * + * This function can be directly passed to + * :member:`ngtcp2_callbacks.recv_client_initial` field. It is only + * used by server. + * + * This function returns 0 if it succeeds, or + * :macro:`NGTCP2_ERR_CALLBACK_FAILURE`. + */ +NGTCP2_EXTERN int ngtcp2_crypto_recv_client_initial_cb(ngtcp2_conn *conn, + const ngtcp2_cid *dcid, + void *user_data); + +/** + * @function + * + * `ngtcp2_crypto_read_write_crypto_data` reads CRYPTO data |data| of + * length |datalen| in an encryption level |encryption_level|, and may + * feed outgoing CRYPTO data to |conn|. This function can drive + * handshake. This function can be also used after handshake + * completes. It is allowed to call this function with |datalen| == + * 0. In this case, no additional read operation is done. + * + * This function returns 0 if it succeeds, or a negative error code. + * The generic error code is -1 if a specific error code is not + * suitable. The error codes less than -10000 are specific to + * underlying TLS implementation. For quictls, the error codes are + * defined in *ngtcp2_crypto_quictls.h*. + */ +NGTCP2_EXTERN int +ngtcp2_crypto_read_write_crypto_data(ngtcp2_conn *conn, + ngtcp2_encryption_level encryption_level, + const uint8_t *data, size_t datalen); + +/** + * @function + * + * `ngtcp2_crypto_recv_crypto_data_cb` is a wrapper function around + * `ngtcp2_crypto_read_write_crypto_data`. It can be directly passed + * to :member:`ngtcp2_callbacks.recv_crypto_data` field. + * + * If this function is used, the TLS implementation specific error + * codes described in `ngtcp2_crypto_read_write_crypto_data` are + * treated as if it returns -1. Do not use this function if an + * application wishes to use the TLS implementation specific error + * codes. + */ +NGTCP2_EXTERN int ngtcp2_crypto_recv_crypto_data_cb( + ngtcp2_conn *conn, ngtcp2_encryption_level encryption_level, uint64_t offset, + const uint8_t *data, size_t datalen, void *user_data); + +/** + * @function + * + * `ngtcp2_crypto_generate_stateless_reset_token` generates a + * stateless reset token using HKDF extraction using the given |cid| + * and |secret| as input. The token will be written to the buffer + * pointed by |token|, and it must have a capacity of at least + * :macro:`NGTCP2_STATELESS_RESET_TOKENLEN` bytes. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int ngtcp2_crypto_generate_stateless_reset_token( + uint8_t *token, const uint8_t *secret, size_t secretlen, + const ngtcp2_cid *cid); + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_TOKEN_RAND_DATALEN` is the length of random + * data added to a token generated by + * `ngtcp2_crypto_generate_retry_token` or + * `ngtcp2_crypto_generate_regular_token`. + */ +#define NGTCP2_CRYPTO_TOKEN_RAND_DATALEN 16 + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_RETRY` is the magic byte for + * Retry token generated by `ngtcp2_crypto_generate_retry_token`. + */ +#define NGTCP2_CRYPTO_TOKEN_MAGIC_RETRY 0xb6 + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_RETRY2` is the magic byte for + * Retry token generated by `ngtcp2_crypto_generate_retry_token2`. + */ +#define NGTCP2_CRYPTO_TOKEN_MAGIC_RETRY2 0xb7 + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_REGULAR` is the magic byte for a + * token generated by `ngtcp2_crypto_generate_regular_token`. + */ +#define NGTCP2_CRYPTO_TOKEN_MAGIC_REGULAR 0x36 + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_MAX_RETRY_TOKENLEN` is the maximum length of + * a token generated by `ngtcp2_crypto_generate_retry_token`. + */ +#define NGTCP2_CRYPTO_MAX_RETRY_TOKENLEN \ + (/* magic = */ 1 + /* cid len = */ 1 + NGTCP2_MAX_CIDLEN + \ + sizeof(ngtcp2_tstamp) + /* aead tag = */ 16 + \ + NGTCP2_CRYPTO_TOKEN_RAND_DATALEN) + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_MAX_RETRY_TOKENLEN2` is the maximum length of + * a token generated by `ngtcp2_crypto_generate_retry_token2`. + */ +#define NGTCP2_CRYPTO_MAX_RETRY_TOKENLEN2 \ + (/* magic = */ 1 + sizeof(ngtcp2_sockaddr_union) + /* cid len = */ 1 + \ + NGTCP2_MAX_CIDLEN + sizeof(ngtcp2_tstamp) + /* aead tag = */ 16 + \ + NGTCP2_CRYPTO_TOKEN_RAND_DATALEN) + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` is the maximum length + * of a token generated by `ngtcp2_crypto_generate_regular_token`. + */ +#define NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN \ + (/* magic = */ 1 + sizeof(ngtcp2_tstamp) + /* aead tag = */ 16 + \ + NGTCP2_CRYPTO_TOKEN_RAND_DATALEN) + +/** + * @function + * + * `ngtcp2_crypto_generate_retry_token` generates a token in the + * buffer pointed by |token| that is sent with Retry packet. The + * buffer pointed by |token| must have at least + * :macro:`NGTCP2_CRYPTO_MAX_RETRY_TOKENLEN` bytes long. The + * successfully generated token starts with + * :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_RETRY`. |secret| of length + * |secretlen| is a keying material to generate keys to encrypt the + * token. |version| is QUIC version. |remote_addr| of length + * |remote_addrlen| is an address of client. |retry_scid| is a Source + * Connection ID chosen by server, and set in Retry packet. |odcid| + * is a Destination Connection ID in Initial packet sent by client. + * |ts| is the timestamp when the token is generated. + * + * See also `ngtcp2_crypto_generate_retry_token2`. + * + * This function returns the length of generated token if it succeeds, + * or -1. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_crypto_generate_retry_token( + uint8_t *token, const uint8_t *secret, size_t secretlen, uint32_t version, + const ngtcp2_sockaddr *remote_addr, ngtcp2_socklen remote_addrlen, + const ngtcp2_cid *retry_scid, const ngtcp2_cid *odcid, ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_crypto_verify_retry_token` verifies Retry token stored in + * the buffer pointed by |token| of length |tokenlen|. |secret| of + * length |secretlen| is a keying material to generate keys to decrypt + * the token. |version| is QUIC version of the Initial packet that + * contains this token. |remote_addr| of length |remote_addrlen| is + * an address of client. |dcid| is a Destination Connection ID in + * Initial packet sent by client. |timeout| is the period during + * which the token is valid. |ts| is the current timestamp. When + * validation succeeds, the extracted Destination Connection ID (which + * is the Destination Connection ID in Initial packet sent by client + * that triggered Retry packet) is stored in the buffer pointed by + * |odcid|. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int ngtcp2_crypto_verify_retry_token( + ngtcp2_cid *odcid, const uint8_t *token, size_t tokenlen, + const uint8_t *secret, size_t secretlen, uint32_t version, + const ngtcp2_sockaddr *remote_addr, ngtcp2_socklen remote_addrlen, + const ngtcp2_cid *dcid, ngtcp2_duration timeout, ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_crypto_generate_retry_token2` generates a token in the + * buffer pointed by |token| that is sent with Retry packet. The + * buffer pointed by |token| must have at least + * :macro:`NGTCP2_CRYPTO_MAX_RETRY_TOKENLEN2` bytes long. The + * successfully generated token starts with + * :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_RETRY2`. |secret| of length + * |secretlen| is a keying material to generate keys to encrypt the + * token. |version| is QUIC version. |remote_addr| of length + * |remote_addrlen| is an address of client. |retry_scid| is a Source + * Connection ID chosen by server, and set in Retry packet. |odcid| + * is a Destination Connection ID in Initial packet sent by client. + * |ts| is the timestamp when the token is generated. + * + * Use this function instead of `ngtcp2_crypto_generate_retry_token` + * if more detailed error handling is required when verifying the + * token. `ngtcp2_crypto_verify_retry_token2` must be used to verify + * the token. + * + * This function returns the length of generated token if it succeeds, + * or -1. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_crypto_generate_retry_token2( + uint8_t *token, const uint8_t *secret, size_t secretlen, uint32_t version, + const ngtcp2_sockaddr *remote_addr, ngtcp2_socklen remote_addrlen, + const ngtcp2_cid *retry_scid, const ngtcp2_cid *odcid, ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_crypto_verify_retry_token2` verifies Retry token stored in + * the buffer pointed by |token| of length |tokenlen|. |secret| of + * length |secretlen| is a keying material to generate keys to decrypt + * the token. |version| is QUIC version of the Initial packet that + * contains this token. |remote_addr| of length |remote_addrlen| is + * an address of client. |dcid| is a Destination Connection ID in + * Initial packet sent by client. |timeout| is the period during + * which the token is valid. |ts| is the current timestamp. When + * validation succeeds, the extracted Destination Connection ID (which + * is the Destination Connection ID in Initial packet sent by client + * that triggered Retry packet) is stored in the buffer pointed by + * |odcid|. + * + * The token must be generated by + * `ngtcp2_crypto_generate_retry_token2`. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_CRYPTO_ERR_UNREADABLE_TOKEN` + * A token is badly formatted; or verifying the integrity + * protection failed. + * :macro:`NGTCP2_CRYPTO_ERR_VERIFY_TOKEN` + * A token does not probe the client address; or the token + * validity has expired; or it contains invalid Connection ID. + * :macro:`NGTCP2_CRYPTO_ERR_INTERNAL` + * Internal error occurred. + */ +NGTCP2_EXTERN int ngtcp2_crypto_verify_retry_token2( + ngtcp2_cid *odcid, const uint8_t *token, size_t tokenlen, + const uint8_t *secret, size_t secretlen, uint32_t version, + const ngtcp2_sockaddr *remote_addr, ngtcp2_socklen remote_addrlen, + const ngtcp2_cid *dcid, ngtcp2_duration timeout, ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_crypto_generate_regular_token` generates a token in the + * buffer pointed by |token| that is sent with NEW_TOKEN frame. The + * buffer pointed by |token| must have at least + * :macro:`NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN` bytes long. The + * successfully generated token starts with + * :macro:`NGTCP2_CRYPTO_TOKEN_MAGIC_REGULAR`. |secret| of length + * |secretlen| is a keying material to generate keys to encrypt the + * token. |remote_addr| of length |remote_addrlen| is an address of + * client. |ts| is the timestamp when the token is generated. + * + * This function returns the length of generated token if it succeeds, + * or -1. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_crypto_generate_regular_token( + uint8_t *token, const uint8_t *secret, size_t secretlen, + const ngtcp2_sockaddr *remote_addr, ngtcp2_socklen remote_addrlen, + ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_crypto_verify_regular_token` verifies a regular token + * stored in the buffer pointed by |token| of length |tokenlen|. + * |secret| of length |secretlen| is a keying material to generate + * keys to decrypt the token. |remote_addr| of length + * |remote_addrlen| is an address of client. |timeout| is the period + * during which the token is valid. |ts| is the current timestamp. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int ngtcp2_crypto_verify_regular_token( + const uint8_t *token, size_t tokenlen, const uint8_t *secret, + size_t secretlen, const ngtcp2_sockaddr *remote_addr, + ngtcp2_socklen remote_addrlen, ngtcp2_duration timeout, ngtcp2_tstamp ts); + +/** + * @function + * + * `ngtcp2_crypto_write_connection_close` writes Initial packet + * containing CONNECTION_CLOSE with the given |error_code| and the + * optional |reason| of length |reasonlen| to the buffer pointed by + * |dest| of length |destlen|. This function is designed for server + * to close connection without committing the state when validating + * Retry token fails. This function must not be used by client. The + * |dcid| must be the Source Connection ID in Initial packet from + * client. The |scid| must be the Destination Connection ID in + * Initial packet from client. |scid| is used to derive initial + * keying materials. + * + * This function wraps around `ngtcp2_pkt_write_connection_close` for + * easier use. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_crypto_write_connection_close( + uint8_t *dest, size_t destlen, uint32_t version, const ngtcp2_cid *dcid, + const ngtcp2_cid *scid, uint64_t error_code, const uint8_t *reason, + size_t reasonlen); + +/** + * @function + * + * `ngtcp2_crypto_write_retry` writes Retry packet to the buffer + * pointed by |dest| of length |destlen|. |dcid| is the Connection ID + * which appeared in a packet as a Source Connection ID sent by + * client. |scid| is a server chosen Source Connection ID. |odcid| + * specifies Original Destination Connection ID which appeared in a + * packet as a Destination Connection ID sent by client. |token| + * specifies Retry Token, and |tokenlen| specifies its length. + * + * This function wraps around `ngtcp2_pkt_write_retry` for easier use. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN ngtcp2_ssize ngtcp2_crypto_write_retry( + uint8_t *dest, size_t destlen, uint32_t version, const ngtcp2_cid *dcid, + const ngtcp2_cid *scid, const ngtcp2_cid *odcid, const uint8_t *token, + size_t tokenlen); + +/** + * @function + * + * `ngtcp2_crypto_aead_ctx_encrypt_init` initializes |aead_ctx| with + * new AEAD cipher context object for encryption which is constructed + * to use |key| as encryption key. |aead| specifies AEAD cipher to + * use. |noncelen| is the length of nonce. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int +ngtcp2_crypto_aead_ctx_encrypt_init(ngtcp2_crypto_aead_ctx *aead_ctx, + const ngtcp2_crypto_aead *aead, + const uint8_t *key, size_t noncelen); + +/** + * @function + * + * `ngtcp2_crypto_aead_ctx_decrypt_init` initializes |aead_ctx| with + * new AEAD cipher context object for decryption which is constructed + * to use |key| as decryption key. |aead| specifies AEAD cipher to + * use. |noncelen| is the length of nonce. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int +ngtcp2_crypto_aead_ctx_decrypt_init(ngtcp2_crypto_aead_ctx *aead_ctx, + const ngtcp2_crypto_aead *aead, + const uint8_t *key, size_t noncelen); + +/** + * @function + * + * `ngtcp2_crypto_aead_ctx_free` frees up resources used by + * |aead_ctx|. This function does not free the memory pointed by + * |aead_ctx| itself. + */ +NGTCP2_EXTERN void +ngtcp2_crypto_aead_ctx_free(ngtcp2_crypto_aead_ctx *aead_ctx); + +/** + * @function + * + * `ngtcp2_crypto_delete_crypto_aead_ctx_cb` deletes the given + * |aead_ctx|. + * + * This function can be directly passed to + * :member:`ngtcp2_callbacks.delete_crypto_aead_ctx` field. + */ +NGTCP2_EXTERN void ngtcp2_crypto_delete_crypto_aead_ctx_cb( + ngtcp2_conn *conn, ngtcp2_crypto_aead_ctx *aead_ctx, void *user_data); + +/** + * @function + * + * `ngtcp2_crypto_delete_crypto_cipher_ctx_cb` deletes the given + * |cipher_ctx|. + * + * This function can be directly passed to + * :member:`ngtcp2_callbacks.delete_crypto_cipher_ctx` field. + */ +NGTCP2_EXTERN void ngtcp2_crypto_delete_crypto_cipher_ctx_cb( + ngtcp2_conn *conn, ngtcp2_crypto_cipher_ctx *cipher_ctx, void *user_data); + +/** + * @function + * + * `ngtcp2_crypto_get_path_challenge_data_cb` writes unpredictable + * sequence of :macro:`NGTCP2_PATH_CHALLENGE_DATALEN` bytes to |data| + * which is sent with PATH_CHALLENGE frame. + * + * This function can be directly passed to + * :member:`ngtcp2_callbacks.get_path_challenge_data` field. + */ +NGTCP2_EXTERN int ngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn *conn, + uint8_t *data, + void *user_data); + +/** + * @function + * + * `ngtcp2_crypto_version_negotiation_cb` installs Initial keys for + * |version| which is negotiated or being negotiated. |client_dcid| + * is the destination connection ID in first Initial packet from + * client. + * + * This function can be directly passed to + * :member:`ngtcp2_callbacks.version_negotiation` field. + */ +NGTCP2_EXTERN int +ngtcp2_crypto_version_negotiation_cb(ngtcp2_conn *conn, uint32_t version, + const ngtcp2_cid *client_dcid, + void *user_data); + +typedef struct ngtcp2_crypto_conn_ref ngtcp2_crypto_conn_ref; + +/** + * @functypedef + * + * :type:`ngtcp2_crypto_get_conn` is a callback function to get a + * pointer to :type:`ngtcp2_conn` from |conn_ref|. The implementation + * must return non-NULL :type:`ngtcp2_conn` object. + */ +typedef ngtcp2_conn *(*ngtcp2_crypto_get_conn)( + ngtcp2_crypto_conn_ref *conn_ref); + +/** + * @struct + * + * :type:`ngtcp2_crypto_conn_ref` is a structure to get a pointer to + * :type:`ngtcp2_conn`. It is meant to be set to TLS native handle as + * an application specific data (e.g. SSL_set_app_data in quictls). + */ +typedef struct ngtcp2_crypto_conn_ref { + /** + * :member:`get_conn` is a callback function to get a pointer to + * :type:`ngtcp2_conn` object. + */ + ngtcp2_crypto_get_conn get_conn; + /** + * :member:`user_data` is a pointer to arbitrary user data. + */ + void *user_data; +} ngtcp2_crypto_conn_ref; + +#ifdef __cplusplus +} +#endif /* defined(__cplusplus) */ + +#endif /* !defined(NGTCP2_CRYPTO_H) */ diff --git a/curl/include/ngtcp2/ngtcp2_crypto_quictls.h b/curl/include/ngtcp2/ngtcp2_crypto_quictls.h new file mode 100644 index 0000000..22e3eda --- /dev/null +++ b/curl/include/ngtcp2/ngtcp2_crypto_quictls.h @@ -0,0 +1,147 @@ +/* + * ngtcp2 + * + * Copyright (c) 2019 ngtcp2 contributors + * + * Permission is hereby granted, free of charge, to any person obtaining + * a copy of this software and associated documentation files (the + * "Software"), to deal in the Software without restriction, including + * without limitation the rights to use, copy, modify, merge, publish, + * distribute, sublicense, and/or sell copies of the Software, and to + * permit persons to whom the Software is furnished to do so, subject to + * the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + */ +#ifndef NGTCP2_CRYPTO_QUICTLS_H +#define NGTCP2_CRYPTO_QUICTLS_H + +#include + +#include + +#ifdef __cplusplus +extern "C" { +#endif /* defined(__cplusplus) */ + +/** + * @macrosection + * + * quictls specific error codes + */ + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_QUICTLS_ERR_TLS_WANT_X509_LOOKUP` is the + * error code which indicates that TLS handshake routine is + * interrupted by X509 certificate lookup. See + * :macro:`SSL_ERROR_WANT_X509_LOOKUP` error description from + * `SSL_do_handshake`. + */ +#define NGTCP2_CRYPTO_QUICTLS_ERR_TLS_WANT_X509_LOOKUP -10001 + +/** + * @macro + * + * :macro:`NGTCP2_CRYPTO_QUICTLS_ERR_TLS_WANT_CLIENT_HELLO_CB` is the + * error code which indicates that TLS handshake routine is + * interrupted by client hello callback. See + * :macro:`SSL_ERROR_WANT_CLIENT_HELLO_CB` error description from + * `SSL_do_handshake`. + */ +#define NGTCP2_CRYPTO_QUICTLS_ERR_TLS_WANT_CLIENT_HELLO_CB -10002 + +/** + * @function + * + * `ngtcp2_crypto_quictls_from_ossl_encryption_level` translates + * |ossl_level| to :type:`ngtcp2_encryption_level`. This function is + * only available for quictls backend. + */ +NGTCP2_EXTERN ngtcp2_encryption_level +ngtcp2_crypto_quictls_from_ossl_encryption_level( + OSSL_ENCRYPTION_LEVEL ossl_level); + +/** + * @function + * + * `ngtcp2_crypto_quictls_from_ngtcp2_encryption_level` translates + * |encryption_level| to OSSL_ENCRYPTION_LEVEL. This function is only + * available for quictls backend. + */ +NGTCP2_EXTERN OSSL_ENCRYPTION_LEVEL +ngtcp2_crypto_quictls_from_ngtcp2_encryption_level( + ngtcp2_encryption_level encryption_level); + +/** + * @function + * + * `ngtcp2_crypto_quictls_configure_server_context` configures + * |ssl_ctx| for server side QUIC connection. It performs the + * following modifications: + * + * - Set minimum and maximum TLS version to TLSv1.3. + * - Set SSL_QUIC_METHOD by calling SSL_CTX_set_quic_method. + * + * Application must set a pointer to :type:`ngtcp2_crypto_conn_ref` to + * SSL object by calling SSL_set_app_data, and + * :type:`ngtcp2_crypto_conn_ref` object must have + * :member:`ngtcp2_crypto_conn_ref.get_conn` field assigned to get + * :type:`ngtcp2_conn`. + * + * It returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int +ngtcp2_crypto_quictls_configure_server_context(SSL_CTX *ssl_ctx); + +/** + * @function + * + * `ngtcp2_crypto_quictls_configure_client_context` configures + * |ssl_ctx| for client side QUIC connection. It performs the + * following modifications: + * + * - Set minimum and maximum TLS version to TLSv1.3. + * - Set SSL_QUIC_METHOD by calling SSL_CTX_set_quic_method. + * + * Application must set a pointer to :type:`ngtcp2_crypto_conn_ref` to + * SSL object by calling SSL_set_app_data, and + * :type:`ngtcp2_crypto_conn_ref` object must have + * :member:`ngtcp2_crypto_conn_ref.get_conn` field assigned to get + * :type:`ngtcp2_conn`. + * + * It returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int +ngtcp2_crypto_quictls_configure_client_context(SSL_CTX *ssl_ctx); + +/** + * @function + * + * `ngtcp2_crypto_quictls_init` initializes libngtcp2_crypto_quictls + * library. This initialization is optional. For quictls >= 3.0, it + * is highly recommended to call this function before any use of + * libngtcp2_crypto library API to workaround the performance + * regression. Note that calling this function does not solve all + * performance issues introduced in 3.x. For quictls 1.1.1, this + * function does nothing, and always succeeds. + * + * This function returns 0 if it succeeds, or -1. + */ +NGTCP2_EXTERN int ngtcp2_crypto_quictls_init(void); + +#ifdef __cplusplus +} +#endif /* defined(__cplusplus) */ + +#endif /* !defined(NGTCP2_CRYPTO_QUICTLS_H) */ diff --git a/curl/include/ngtcp2/version.h b/curl/include/ngtcp2/version.h new file mode 100644 index 0000000..5a261a2 --- /dev/null +++ b/curl/include/ngtcp2/version.h @@ -0,0 +1,51 @@ +/* + * ngtcp2 + * + * Copyright (c) 2016 ngtcp2 contributors + * + * Permission is hereby granted, free of charge, to any person obtaining + * a copy of this software and associated documentation files (the + * "Software"), to deal in the Software without restriction, including + * without limitation the rights to use, copy, modify, merge, publish, + * distribute, sublicense, and/or sell copies of the Software, and to + * permit persons to whom the Software is furnished to do so, subject to + * the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + */ +#ifndef NGTCP2_VERSION_H +#define NGTCP2_VERSION_H + +/** + * @macrosection + * + * Library version macros + */ + +/** + * @macro + * + * Version number of the ngtcp2 library release. + */ +#define NGTCP2_VERSION "1.13.0" + +/** + * @macro + * + * Numerical representation of the version number of the ngtcp2 + * library release. This is a 24 bit number with 8 bits for major + * number, 8 bits for minor and 8 bits for patch. Version 1.2.3 + * becomes 0x010203. + */ +#define NGTCP2_VERSION_NUM 0x010d00 + +#endif /* !defined(NGTCP2_VERSION_H) */ diff --git a/curl/include/openssl/aes.h b/curl/include/openssl/aes.h new file mode 100644 index 0000000..8903a8e --- /dev/null +++ b/curl/include/openssl/aes.h @@ -0,0 +1,120 @@ +/* $OpenBSD: aes.h,v 1.16 2025/01/25 17:59:44 tb Exp $ */ +/* ==================================================================== + * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + */ + +#ifndef HEADER_AES_H +#define HEADER_AES_H + +#include + +#include + +#define AES_ENCRYPT 1 +#define AES_DECRYPT 0 + +/* Because array size can't be a const in C, the following two are macros. + Both sizes are in bytes. */ +#define AES_MAXNR 14 +#define AES_BLOCK_SIZE 16 + +#ifdef __cplusplus +extern "C" { +#endif + +/* This should be a hidden type, but EVP requires that the size be known */ +struct aes_key_st { + unsigned int rd_key[4 *(AES_MAXNR + 1)]; + int rounds; +}; +typedef struct aes_key_st AES_KEY; + +int AES_set_encrypt_key(const unsigned char *userKey, const int bits, + AES_KEY *key); +int AES_set_decrypt_key(const unsigned char *userKey, const int bits, + AES_KEY *key); + +void AES_encrypt(const unsigned char *in, unsigned char *out, + const AES_KEY *key); +void AES_decrypt(const unsigned char *in, unsigned char *out, + const AES_KEY *key); + +void AES_ecb_encrypt(const unsigned char *in, unsigned char *out, + const AES_KEY *key, const int enc); +void AES_cbc_encrypt(const unsigned char *in, unsigned char *out, + size_t length, const AES_KEY *key, unsigned char *ivec, const int enc); +void AES_cfb128_encrypt(const unsigned char *in, unsigned char *out, + size_t length, const AES_KEY *key, unsigned char *ivec, int *num, + const int enc); +void AES_cfb1_encrypt(const unsigned char *in, unsigned char *out, + size_t length, const AES_KEY *key, unsigned char *ivec, int *num, + const int enc); +void AES_cfb8_encrypt(const unsigned char *in, unsigned char *out, + size_t length, const AES_KEY *key, unsigned char *ivec, int *num, + const int enc); +void AES_ofb128_encrypt(const unsigned char *in, unsigned char *out, + size_t length, const AES_KEY *key, unsigned char *ivec, int *num); +void AES_ctr128_encrypt(const unsigned char *in, unsigned char *out, + size_t length, const AES_KEY *key, unsigned char ivec[AES_BLOCK_SIZE], + unsigned char ecount_buf[AES_BLOCK_SIZE], unsigned int *num); +/* NB: the IV is _two_ blocks long */ +void AES_ige_encrypt(const unsigned char *in, unsigned char *out, + size_t length, const AES_KEY *key, unsigned char *ivec, const int enc); + +int AES_wrap_key(AES_KEY *key, const unsigned char *iv, unsigned char *out, + const unsigned char *in, unsigned int inlen); +int AES_unwrap_key(AES_KEY *key, const unsigned char *iv, unsigned char *out, + const unsigned char *in, unsigned int inlen); + + +#ifdef __cplusplus +} +#endif + +#endif /* !HEADER_AES_H */ diff --git a/curl/include/openssl/asn1.h b/curl/include/openssl/asn1.h new file mode 100644 index 0000000..aeabbc0 --- /dev/null +++ b/curl/include/openssl/asn1.h @@ -0,0 +1,1124 @@ +/* $OpenBSD: asn1.h,v 1.92 2024/04/10 14:55:12 beck Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_ASN1_H +#define HEADER_ASN1_H + +#include + +#include + +#ifndef OPENSSL_NO_BIO +#include +#endif +#include +#include +#include + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define V_ASN1_UNIVERSAL 0x00 +#define V_ASN1_APPLICATION 0x40 +#define V_ASN1_CONTEXT_SPECIFIC 0x80 +#define V_ASN1_PRIVATE 0xc0 + +#define V_ASN1_CONSTRUCTED 0x20 +#define V_ASN1_PRIMITIVE_TAG 0x1f +#define V_ASN1_PRIMATIVE_TAG 0x1f + +#define V_ASN1_APP_CHOOSE -2 /* let the recipient choose */ +#define V_ASN1_OTHER -3 /* used in ASN1_TYPE */ +#define V_ASN1_ANY -4 /* used in ASN1 template code */ + +#define V_ASN1_NEG 0x100 /* negative flag */ + +#define V_ASN1_UNDEF -1 +#define V_ASN1_EOC 0 +#define V_ASN1_BOOLEAN 1 /**/ +#define V_ASN1_INTEGER 2 +#define V_ASN1_NEG_INTEGER (2 | V_ASN1_NEG) +#define V_ASN1_BIT_STRING 3 +#define V_ASN1_OCTET_STRING 4 +#define V_ASN1_NULL 5 +#define V_ASN1_OBJECT 6 +#define V_ASN1_OBJECT_DESCRIPTOR 7 +#define V_ASN1_EXTERNAL 8 +#define V_ASN1_REAL 9 +#define V_ASN1_ENUMERATED 10 +#define V_ASN1_NEG_ENUMERATED (10 | V_ASN1_NEG) +#define V_ASN1_UTF8STRING 12 +#define V_ASN1_SEQUENCE 16 +#define V_ASN1_SET 17 +#define V_ASN1_NUMERICSTRING 18 /**/ +#define V_ASN1_PRINTABLESTRING 19 +#define V_ASN1_T61STRING 20 +#define V_ASN1_TELETEXSTRING 20 /* alias */ +#define V_ASN1_VIDEOTEXSTRING 21 /**/ +#define V_ASN1_IA5STRING 22 +#define V_ASN1_UTCTIME 23 +#define V_ASN1_GENERALIZEDTIME 24 /**/ +#define V_ASN1_GRAPHICSTRING 25 /**/ +#define V_ASN1_ISO64STRING 26 /**/ +#define V_ASN1_VISIBLESTRING 26 /* alias */ +#define V_ASN1_GENERALSTRING 27 /**/ +#define V_ASN1_UNIVERSALSTRING 28 /**/ +#define V_ASN1_BMPSTRING 30 + +#define B_ASN1_NUMERICSTRING 0x0001 +#define B_ASN1_PRINTABLESTRING 0x0002 +#define B_ASN1_T61STRING 0x0004 +#define B_ASN1_TELETEXSTRING 0x0004 +#define B_ASN1_VIDEOTEXSTRING 0x0008 +#define B_ASN1_IA5STRING 0x0010 +#define B_ASN1_GRAPHICSTRING 0x0020 +#define B_ASN1_ISO64STRING 0x0040 +#define B_ASN1_VISIBLESTRING 0x0040 +#define B_ASN1_GENERALSTRING 0x0080 +#define B_ASN1_UNIVERSALSTRING 0x0100 +#define B_ASN1_OCTET_STRING 0x0200 +#define B_ASN1_BIT_STRING 0x0400 +#define B_ASN1_BMPSTRING 0x0800 +#define B_ASN1_UNKNOWN 0x1000 +#define B_ASN1_UTF8STRING 0x2000 +#define B_ASN1_UTCTIME 0x4000 +#define B_ASN1_GENERALIZEDTIME 0x8000 +#define B_ASN1_SEQUENCE 0x10000 + +/* For use with ASN1_mbstring_copy() */ +#define MBSTRING_FLAG 0x1000 +#define MBSTRING_UTF8 (MBSTRING_FLAG) +#define MBSTRING_ASC (MBSTRING_FLAG|1) +#define MBSTRING_BMP (MBSTRING_FLAG|2) +#define MBSTRING_UNIV (MBSTRING_FLAG|4) + +#define SMIME_OLDMIME 0x400 +#define SMIME_CRLFEOL 0x800 +#define SMIME_STREAM 0x1000 + +struct X509_algor_st; +DECLARE_STACK_OF(X509_ALGOR) + +#define DECLARE_ASN1_SET_OF(type) /* filled in by mkstack.pl */ +#define IMPLEMENT_ASN1_SET_OF(type) /* nothing, no longer needed */ + +#define ASN1_STRING_FLAG_BITS_LEFT 0x08 /* Set if 0x07 has bits left value */ +/* This indicates that the ASN1_STRING is not a real value but just a place + * holder for the location where indefinite length constructed data should + * be inserted in the memory buffer + */ +#define ASN1_STRING_FLAG_NDEF 0x010 + +/* This flag is used by the CMS code to indicate that a string is not + * complete and is a place holder for content when it had all been + * accessed. The flag will be reset when content has been written to it. + */ + +#define ASN1_STRING_FLAG_CONT 0x020 +/* This flag is used by ASN1 code to indicate an ASN1_STRING is an MSTRING + * type. + */ +#define ASN1_STRING_FLAG_MSTRING 0x040 +/* This is the base type that holds just about everything :-) */ +struct asn1_string_st { + int length; + int type; + unsigned char *data; + /* The value of the following field depends on the type being + * held. It is mostly being used for BIT_STRING so if the + * input data has a non-zero 'unused bits' value, it will be + * handled correctly */ + long flags; +}; + +/* ASN1_ENCODING structure: this is used to save the received + * encoding of an ASN1 type. This is useful to get round + * problems with invalid encodings which can break signatures. + */ + +typedef struct ASN1_ENCODING_st { + unsigned char *enc; /* DER encoding */ + long len; /* Length of encoding */ + int modified; /* set to 1 if 'enc' is invalid */ +} ASN1_ENCODING; + +/* Used with ASN1 LONG type: if a long is set to this it is omitted */ +#define ASN1_LONG_UNDEF 0x7fffffffL + +#define STABLE_FLAGS_MALLOC 0x01 +#define STABLE_NO_MASK 0x02 +#define DIRSTRING_TYPE \ + (B_ASN1_PRINTABLESTRING|B_ASN1_T61STRING|B_ASN1_BMPSTRING|B_ASN1_UTF8STRING) +#define PKCS9STRING_TYPE (DIRSTRING_TYPE|B_ASN1_IA5STRING) + +typedef struct asn1_string_table_st { + int nid; + long minsize; + long maxsize; + unsigned long mask; + unsigned long flags; +} ASN1_STRING_TABLE; + +/* Declarations for template structures: for full definitions + * see asn1t.h + */ +typedef struct ASN1_TEMPLATE_st ASN1_TEMPLATE; +typedef struct ASN1_TLC_st ASN1_TLC; +/* This is just an opaque pointer */ +typedef struct ASN1_VALUE_st ASN1_VALUE; + +#ifndef LIBRESSL_INTERNAL + +/* Declare ASN1 functions: the implement macro in in asn1t.h */ + +#define DECLARE_ASN1_FUNCTIONS(type) DECLARE_ASN1_FUNCTIONS_name(type, type) + +#define DECLARE_ASN1_ALLOC_FUNCTIONS(type) \ + DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, type) + +#define DECLARE_ASN1_FUNCTIONS_name(type, name) \ + DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \ + DECLARE_ASN1_ENCODE_FUNCTIONS(type, name, name) + +#define DECLARE_ASN1_FUNCTIONS_fname(type, itname, name) \ + DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \ + DECLARE_ASN1_ENCODE_FUNCTIONS(type, itname, name) + +#define DECLARE_ASN1_ENCODE_FUNCTIONS(type, itname, name) \ + type *d2i_##name(type **a, const unsigned char **in, long len); \ + int i2d_##name(type *a, unsigned char **out); \ + DECLARE_ASN1_ITEM(itname) + +#define DECLARE_ASN1_ENCODE_FUNCTIONS_const(type, name) \ + type *d2i_##name(type **a, const unsigned char **in, long len); \ + int i2d_##name(const type *a, unsigned char **out); \ + DECLARE_ASN1_ITEM(name) + +#define DECLARE_ASN1_NDEF_FUNCTION(name) \ + int i2d_##name##_NDEF(name *a, unsigned char **out); + +#define DECLARE_ASN1_FUNCTIONS_const(name) \ + DECLARE_ASN1_ALLOC_FUNCTIONS(name) \ + DECLARE_ASN1_ENCODE_FUNCTIONS_const(name, name) + +#define DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \ + type *name##_new(void); \ + void name##_free(type *a); + +#define DECLARE_ASN1_PRINT_FUNCTION(stname) \ + DECLARE_ASN1_PRINT_FUNCTION_fname(stname, stname) + +#define DECLARE_ASN1_PRINT_FUNCTION_fname(stname, fname) \ + int fname##_print_ctx(BIO *out, stname *x, int indent, \ + const ASN1_PCTX *pctx); + +#endif /* !LIBRESSL_INTERNAL */ + +#define D2I_OF(type) type *(*)(type **,const unsigned char **,long) +#define I2D_OF(type) int (*)(type *,unsigned char **) +#define I2D_OF_const(type) int (*)(const type *,unsigned char **) + +#define CHECKED_D2I_OF(type, d2i) \ + ((d2i_of_void*) (1 ? d2i : ((D2I_OF(type))0))) +#define CHECKED_I2D_OF(type, i2d) \ + ((i2d_of_void*) (1 ? i2d : ((I2D_OF(type))0))) +#define CHECKED_NEW_OF(type, xnew) \ + ((void *(*)(void)) (1 ? xnew : ((type *(*)(void))0))) +#define CHECKED_PTR_OF(type, p) \ + ((void*) (1 ? p : (type*)0)) +#define CHECKED_PPTR_OF(type, p) \ + ((void**) (1 ? p : (type**)0)) + +#define TYPEDEF_D2I_OF(type) typedef type *d2i_of_##type(type **,const unsigned char **,long) +#define TYPEDEF_I2D_OF(type) typedef int i2d_of_##type(type *,unsigned char **) +#define TYPEDEF_D2I2D_OF(type) TYPEDEF_D2I_OF(type); TYPEDEF_I2D_OF(type) + +TYPEDEF_D2I2D_OF(void); + +/* The following macros and typedefs allow an ASN1_ITEM + * to be embedded in a structure and referenced. Since + * the ASN1_ITEM pointers need to be globally accessible + * (possibly from shared libraries) they may exist in + * different forms. On platforms that support it the + * ASN1_ITEM structure itself will be globally exported. + * Other platforms will export a function that returns + * an ASN1_ITEM pointer. + * + * To handle both cases transparently the macros below + * should be used instead of hard coding an ASN1_ITEM + * pointer in a structure. + * + * The structure will look like this: + * + * typedef struct SOMETHING_st { + * ... + * ASN1_ITEM_EXP *iptr; + * ... + * } SOMETHING; + * + * It would be initialised as e.g.: + * + * SOMETHING somevar = {...,ASN1_ITEM_ref(X509),...}; + * + * and the actual pointer extracted with: + * + * const ASN1_ITEM *it = ASN1_ITEM_ptr(somevar.iptr); + * + * Finally an ASN1_ITEM pointer can be extracted from an + * appropriate reference with: ASN1_ITEM_rptr(X509). This + * would be used when a function takes an ASN1_ITEM * argument. + * + */ + +/* ASN1_ITEM pointer exported type */ +typedef const ASN1_ITEM ASN1_ITEM_EXP; + +#ifndef LIBRESSL_INTERNAL + +/* Macro to obtain ASN1_ITEM pointer from exported type */ +#define ASN1_ITEM_ptr(iptr) (iptr) + +/* Macro to include ASN1_ITEM pointer from base type */ +#define ASN1_ITEM_ref(iptr) (&(iptr##_it)) + +#define ASN1_ITEM_rptr(ref) (&(ref##_it)) + +#define DECLARE_ASN1_ITEM(name) \ + extern const ASN1_ITEM name##_it; + +#endif /* !LIBRESSL_INTERNAL */ + +/* Parameters used by ASN1_STRING_print_ex() */ + +/* These determine which characters to escape: + * RFC2253 special characters, control characters and + * MSB set characters + */ + +#define ASN1_STRFLGS_ESC_2253 1 +#define ASN1_STRFLGS_ESC_CTRL 2 +#define ASN1_STRFLGS_ESC_MSB 4 + + +/* This flag determines how we do escaping: normally + * RC2253 backslash only, set this to use backslash and + * quote. + */ + +#define ASN1_STRFLGS_ESC_QUOTE 8 + + +/* These three flags are internal use only. */ + +/* Character is a valid PrintableString character */ +#define CHARTYPE_PRINTABLESTRING 0x10 +/* Character needs escaping if it is the first character */ +#define CHARTYPE_FIRST_ESC_2253 0x20 +/* Character needs escaping if it is the last character */ +#define CHARTYPE_LAST_ESC_2253 0x40 + +/* NB the internal flags are safely reused below by flags + * handled at the top level. + */ + +/* If this is set we convert all character strings + * to UTF8 first + */ + +#define ASN1_STRFLGS_UTF8_CONVERT 0x10 + +/* If this is set we don't attempt to interpret content: + * just assume all strings are 1 byte per character. This + * will produce some pretty odd looking output! + */ + +#define ASN1_STRFLGS_IGNORE_TYPE 0x20 + +/* If this is set we include the string type in the output */ +#define ASN1_STRFLGS_SHOW_TYPE 0x40 + +/* This determines which strings to display and which to + * 'dump' (hex dump of content octets or DER encoding). We can + * only dump non character strings or everything. If we + * don't dump 'unknown' they are interpreted as character + * strings with 1 octet per character and are subject to + * the usual escaping options. + */ + +#define ASN1_STRFLGS_DUMP_ALL 0x80 +#define ASN1_STRFLGS_DUMP_UNKNOWN 0x100 + +/* These determine what 'dumping' does, we can dump the + * content octets or the DER encoding: both use the + * RFC2253 #NNNNN notation. + */ + +#define ASN1_STRFLGS_DUMP_DER 0x200 + +/* All the string flags consistent with RFC2253, + * escaping control characters isn't essential in + * RFC2253 but it is advisable anyway. + */ + +#define ASN1_STRFLGS_RFC2253 (ASN1_STRFLGS_ESC_2253 | \ + ASN1_STRFLGS_ESC_CTRL | \ + ASN1_STRFLGS_ESC_MSB | \ + ASN1_STRFLGS_UTF8_CONVERT | \ + ASN1_STRFLGS_DUMP_UNKNOWN | \ + ASN1_STRFLGS_DUMP_DER) + +DECLARE_STACK_OF(ASN1_INTEGER) + +DECLARE_STACK_OF(ASN1_GENERALSTRING) + +typedef struct asn1_type_st { + int type; + union { + char *ptr; + ASN1_BOOLEAN boolean; + ASN1_STRING * asn1_string; + ASN1_OBJECT * object; + ASN1_INTEGER * integer; + ASN1_ENUMERATED * enumerated; + ASN1_BIT_STRING * bit_string; + ASN1_OCTET_STRING * octet_string; + ASN1_PRINTABLESTRING * printablestring; + ASN1_T61STRING * t61string; + ASN1_IA5STRING * ia5string; + ASN1_GENERALSTRING * generalstring; + ASN1_BMPSTRING * bmpstring; + ASN1_UNIVERSALSTRING * universalstring; + ASN1_UTCTIME * utctime; + ASN1_GENERALIZEDTIME * generalizedtime; + ASN1_VISIBLESTRING * visiblestring; + ASN1_UTF8STRING * utf8string; + /* set and sequence are left complete and still + * contain the set or sequence bytes */ + ASN1_STRING * set; + ASN1_STRING * sequence; + ASN1_VALUE * asn1_value; + } value; +} ASN1_TYPE; + +DECLARE_STACK_OF(ASN1_TYPE) + +typedef STACK_OF(ASN1_TYPE) ASN1_SEQUENCE_ANY; + +ASN1_SEQUENCE_ANY *d2i_ASN1_SEQUENCE_ANY(ASN1_SEQUENCE_ANY **a, const unsigned char **in, long len); +int i2d_ASN1_SEQUENCE_ANY(const ASN1_SEQUENCE_ANY *a, unsigned char **out); +extern const ASN1_ITEM ASN1_SEQUENCE_ANY_it; +ASN1_SEQUENCE_ANY *d2i_ASN1_SET_ANY(ASN1_SEQUENCE_ANY **a, const unsigned char **in, long len); +int i2d_ASN1_SET_ANY(const ASN1_SEQUENCE_ANY *a, unsigned char **out); +extern const ASN1_ITEM ASN1_SET_ANY_it; + +/* This is used to contain a list of bit names */ +typedef struct BIT_STRING_BITNAME_st { + int bitnum; + const char *lname; + const char *sname; +} BIT_STRING_BITNAME; + +#define B_ASN1_TIME \ + B_ASN1_UTCTIME | \ + B_ASN1_GENERALIZEDTIME + +#define B_ASN1_PRINTABLE \ + B_ASN1_NUMERICSTRING| \ + B_ASN1_PRINTABLESTRING| \ + B_ASN1_T61STRING| \ + B_ASN1_IA5STRING| \ + B_ASN1_BIT_STRING| \ + B_ASN1_UNIVERSALSTRING|\ + B_ASN1_BMPSTRING|\ + B_ASN1_UTF8STRING|\ + B_ASN1_SEQUENCE|\ + B_ASN1_UNKNOWN + +#define B_ASN1_DIRECTORYSTRING \ + B_ASN1_PRINTABLESTRING| \ + B_ASN1_TELETEXSTRING|\ + B_ASN1_BMPSTRING|\ + B_ASN1_UNIVERSALSTRING|\ + B_ASN1_UTF8STRING + +#define B_ASN1_DISPLAYTEXT \ + B_ASN1_IA5STRING| \ + B_ASN1_VISIBLESTRING| \ + B_ASN1_BMPSTRING|\ + B_ASN1_UTF8STRING + +ASN1_TYPE *ASN1_TYPE_new(void); +void ASN1_TYPE_free(ASN1_TYPE *a); +ASN1_TYPE *d2i_ASN1_TYPE(ASN1_TYPE **a, const unsigned char **in, long len); +int i2d_ASN1_TYPE(ASN1_TYPE *a, unsigned char **out); +extern const ASN1_ITEM ASN1_ANY_it; + +int ASN1_TYPE_get(const ASN1_TYPE *a); +void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value); +int ASN1_TYPE_set1(ASN1_TYPE *a, int type, const void *value); +int ASN1_TYPE_cmp(const ASN1_TYPE *a, const ASN1_TYPE *b); + +ASN1_OBJECT *ASN1_OBJECT_new(void); +void ASN1_OBJECT_free(ASN1_OBJECT *a); +int i2d_ASN1_OBJECT(const ASN1_OBJECT *a, unsigned char **pp); +ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp, + long length); + +extern const ASN1_ITEM ASN1_OBJECT_it; + +DECLARE_STACK_OF(ASN1_OBJECT) + +ASN1_STRING *ASN1_STRING_new(void); +void ASN1_STRING_free(ASN1_STRING *a); +int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str); +ASN1_STRING *ASN1_STRING_dup(const ASN1_STRING *a); +ASN1_STRING *ASN1_STRING_type_new(int type); +int ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING *b); + /* Since this is used to store all sorts of things, via macros, for now, make + its data void * */ +int ASN1_STRING_set(ASN1_STRING *str, const void *data, int len); +void ASN1_STRING_set0(ASN1_STRING *str, void *data, int len); +int ASN1_STRING_length(const ASN1_STRING *x); +void ASN1_STRING_length_set(ASN1_STRING *x, int n); +int ASN1_STRING_type(const ASN1_STRING *x); +unsigned char *ASN1_STRING_data(ASN1_STRING *x); +const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *x); + +ASN1_BIT_STRING *ASN1_BIT_STRING_new(void); +void ASN1_BIT_STRING_free(ASN1_BIT_STRING *a); +ASN1_BIT_STRING *d2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, const unsigned char **in, long len); +int i2d_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **out); +extern const ASN1_ITEM ASN1_BIT_STRING_it; +int ASN1_BIT_STRING_set(ASN1_BIT_STRING *a, unsigned char *d, int length); +int ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value); +int ASN1_BIT_STRING_get_bit(const ASN1_BIT_STRING *a, int n); + +ASN1_INTEGER *ASN1_INTEGER_new(void); +void ASN1_INTEGER_free(ASN1_INTEGER *a); +ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, const unsigned char **in, long len); +int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **out); +extern const ASN1_ITEM ASN1_INTEGER_it; +ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, const unsigned char **pp, + long length); +ASN1_INTEGER * ASN1_INTEGER_dup(const ASN1_INTEGER *x); +int ASN1_INTEGER_cmp(const ASN1_INTEGER *x, const ASN1_INTEGER *y); + +ASN1_ENUMERATED *ASN1_ENUMERATED_new(void); +void ASN1_ENUMERATED_free(ASN1_ENUMERATED *a); +ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, const unsigned char **in, long len); +int i2d_ASN1_ENUMERATED(ASN1_ENUMERATED *a, unsigned char **out); +extern const ASN1_ITEM ASN1_ENUMERATED_it; + +int ASN1_UTCTIME_check(const ASN1_UTCTIME *a); +ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t); +ASN1_UTCTIME *ASN1_UTCTIME_adj(ASN1_UTCTIME *s, time_t t, + int offset_day, long offset_sec); +int ASN1_UTCTIME_set_string(ASN1_UTCTIME *s, const char *str); + +int ASN1_UTCTIME_cmp_time_t(const ASN1_UTCTIME *s, time_t t); + +int ASN1_GENERALIZEDTIME_check(const ASN1_GENERALIZEDTIME *a); +ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s, + time_t t); +ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_adj(ASN1_GENERALIZEDTIME *s, + time_t t, int offset_day, long offset_sec); +int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, const char *str); + +ASN1_OCTET_STRING *ASN1_OCTET_STRING_new(void); +void ASN1_OCTET_STRING_free(ASN1_OCTET_STRING *a); +ASN1_OCTET_STRING *d2i_ASN1_OCTET_STRING(ASN1_OCTET_STRING **a, const unsigned char **in, long len); +int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **out); +extern const ASN1_ITEM ASN1_OCTET_STRING_it; +ASN1_OCTET_STRING *ASN1_OCTET_STRING_dup(const ASN1_OCTET_STRING *a); +int ASN1_OCTET_STRING_cmp(const ASN1_OCTET_STRING *a, + const ASN1_OCTET_STRING *b); +int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *str, const unsigned char *data, + int len); + +ASN1_VISIBLESTRING *ASN1_VISIBLESTRING_new(void); +void ASN1_VISIBLESTRING_free(ASN1_VISIBLESTRING *a); +ASN1_VISIBLESTRING *d2i_ASN1_VISIBLESTRING(ASN1_VISIBLESTRING **a, const unsigned char **in, long len); +int i2d_ASN1_VISIBLESTRING(ASN1_VISIBLESTRING *a, unsigned char **out); +extern const ASN1_ITEM ASN1_VISIBLESTRING_it; +ASN1_UNIVERSALSTRING *ASN1_UNIVERSALSTRING_new(void); +void ASN1_UNIVERSALSTRING_free(ASN1_UNIVERSALSTRING *a); +ASN1_UNIVERSALSTRING *d2i_ASN1_UNIVERSALSTRING(ASN1_UNIVERSALSTRING **a, const unsigned char **in, long len); +int i2d_ASN1_UNIVERSALSTRING(ASN1_UNIVERSALSTRING *a, unsigned char **out); +extern const ASN1_ITEM ASN1_UNIVERSALSTRING_it; +ASN1_UTF8STRING *ASN1_UTF8STRING_new(void); +void ASN1_UTF8STRING_free(ASN1_UTF8STRING *a); +ASN1_UTF8STRING *d2i_ASN1_UTF8STRING(ASN1_UTF8STRING **a, const unsigned char **in, long len); +int i2d_ASN1_UTF8STRING(ASN1_UTF8STRING *a, unsigned char **out); +extern const ASN1_ITEM ASN1_UTF8STRING_it; +ASN1_NULL *ASN1_NULL_new(void); +void ASN1_NULL_free(ASN1_NULL *a); +ASN1_NULL *d2i_ASN1_NULL(ASN1_NULL **a, const unsigned char **in, long len); +int i2d_ASN1_NULL(ASN1_NULL *a, unsigned char **out); +extern const ASN1_ITEM ASN1_NULL_it; +ASN1_BMPSTRING *ASN1_BMPSTRING_new(void); +void ASN1_BMPSTRING_free(ASN1_BMPSTRING *a); +ASN1_BMPSTRING *d2i_ASN1_BMPSTRING(ASN1_BMPSTRING **a, const unsigned char **in, long len); +int i2d_ASN1_BMPSTRING(ASN1_BMPSTRING *a, unsigned char **out); +extern const ASN1_ITEM ASN1_BMPSTRING_it; + +ASN1_STRING *ASN1_PRINTABLE_new(void); +void ASN1_PRINTABLE_free(ASN1_STRING *a); +ASN1_STRING *d2i_ASN1_PRINTABLE(ASN1_STRING **a, const unsigned char **in, long len); +int i2d_ASN1_PRINTABLE(ASN1_STRING *a, unsigned char **out); +extern const ASN1_ITEM ASN1_PRINTABLE_it; + +ASN1_STRING *DIRECTORYSTRING_new(void); +void DIRECTORYSTRING_free(ASN1_STRING *a); +ASN1_STRING *d2i_DIRECTORYSTRING(ASN1_STRING **a, const unsigned char **in, long len); +int i2d_DIRECTORYSTRING(ASN1_STRING *a, unsigned char **out); +extern const ASN1_ITEM DIRECTORYSTRING_it; +ASN1_STRING *DISPLAYTEXT_new(void); +void DISPLAYTEXT_free(ASN1_STRING *a); +ASN1_STRING *d2i_DISPLAYTEXT(ASN1_STRING **a, const unsigned char **in, long len); +int i2d_DISPLAYTEXT(ASN1_STRING *a, unsigned char **out); +extern const ASN1_ITEM DISPLAYTEXT_it; +ASN1_PRINTABLESTRING *ASN1_PRINTABLESTRING_new(void); +void ASN1_PRINTABLESTRING_free(ASN1_PRINTABLESTRING *a); +ASN1_PRINTABLESTRING *d2i_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING **a, const unsigned char **in, long len); +int i2d_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING *a, unsigned char **out); +extern const ASN1_ITEM ASN1_PRINTABLESTRING_it; +ASN1_T61STRING *ASN1_T61STRING_new(void); +void ASN1_T61STRING_free(ASN1_T61STRING *a); +ASN1_T61STRING *d2i_ASN1_T61STRING(ASN1_T61STRING **a, const unsigned char **in, long len); +int i2d_ASN1_T61STRING(ASN1_T61STRING *a, unsigned char **out); +extern const ASN1_ITEM ASN1_T61STRING_it; +ASN1_IA5STRING *ASN1_IA5STRING_new(void); +void ASN1_IA5STRING_free(ASN1_IA5STRING *a); +ASN1_IA5STRING *d2i_ASN1_IA5STRING(ASN1_IA5STRING **a, const unsigned char **in, long len); +int i2d_ASN1_IA5STRING(ASN1_IA5STRING *a, unsigned char **out); +extern const ASN1_ITEM ASN1_IA5STRING_it; +ASN1_GENERALSTRING *ASN1_GENERALSTRING_new(void); +void ASN1_GENERALSTRING_free(ASN1_GENERALSTRING *a); +ASN1_GENERALSTRING *d2i_ASN1_GENERALSTRING(ASN1_GENERALSTRING **a, const unsigned char **in, long len); +int i2d_ASN1_GENERALSTRING(ASN1_GENERALSTRING *a, unsigned char **out); +extern const ASN1_ITEM ASN1_GENERALSTRING_it; +ASN1_UTCTIME *ASN1_UTCTIME_new(void); +void ASN1_UTCTIME_free(ASN1_UTCTIME *a); +ASN1_UTCTIME *d2i_ASN1_UTCTIME(ASN1_UTCTIME **a, const unsigned char **in, long len); +int i2d_ASN1_UTCTIME(ASN1_UTCTIME *a, unsigned char **out); +extern const ASN1_ITEM ASN1_UTCTIME_it; +ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_new(void); +void ASN1_GENERALIZEDTIME_free(ASN1_GENERALIZEDTIME *a); +ASN1_GENERALIZEDTIME *d2i_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME **a, const unsigned char **in, long len); +int i2d_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME *a, unsigned char **out); +extern const ASN1_ITEM ASN1_GENERALIZEDTIME_it; +ASN1_TIME *ASN1_TIME_new(void); +void ASN1_TIME_free(ASN1_TIME *a); +ASN1_TIME *d2i_ASN1_TIME(ASN1_TIME **a, const unsigned char **in, long len); +int i2d_ASN1_TIME(ASN1_TIME *a, unsigned char **out); +extern const ASN1_ITEM ASN1_TIME_it; + +int ASN1_TIME_to_tm(const ASN1_TIME *s, struct tm *tm); +int ASN1_TIME_compare(const ASN1_TIME *t1, const ASN1_TIME *t2); +int ASN1_TIME_cmp_time_t(const ASN1_TIME *s, time_t t2); +int ASN1_TIME_normalize(ASN1_TIME *t); +int ASN1_TIME_set_string_X509(ASN1_TIME *time, const char *str); +int ASN1_TIME_diff(int *pday, int *psec, const ASN1_TIME *from, + const ASN1_TIME *to); + +extern const ASN1_ITEM ASN1_OCTET_STRING_NDEF_it; + +ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s, time_t t); +ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s, time_t t, int offset_day, + long offset_sec); +int ASN1_TIME_check(const ASN1_TIME *t); +ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t, + ASN1_GENERALIZEDTIME **out); +int ASN1_TIME_set_string(ASN1_TIME *s, const char *str); + +#ifndef OPENSSL_NO_BIO +int i2a_ASN1_INTEGER(BIO *bp, const ASN1_INTEGER *a); +int a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size); +int i2a_ASN1_ENUMERATED(BIO *bp, const ASN1_ENUMERATED *a); +int a2i_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *bs, char *buf, int size); +int i2a_ASN1_OBJECT(BIO *bp, const ASN1_OBJECT *a); +int a2i_ASN1_STRING(BIO *bp, ASN1_STRING *bs, char *buf, int size); +int i2a_ASN1_STRING(BIO *bp, const ASN1_STRING *a, int type); +#endif +int i2t_ASN1_OBJECT(char *buf, int buf_len, const ASN1_OBJECT *a); + +int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num); +ASN1_OBJECT *ASN1_OBJECT_create(int nid, unsigned char *data, int len, + const char *sn, const char *ln); + +int ASN1_INTEGER_get_uint64(uint64_t *out_val, const ASN1_INTEGER *aint); +int ASN1_INTEGER_set_uint64(ASN1_INTEGER *aint, uint64_t val); +int ASN1_INTEGER_get_int64(int64_t *out_val, const ASN1_INTEGER *aint); +int ASN1_INTEGER_set_int64(ASN1_INTEGER *aint, int64_t val); +int ASN1_INTEGER_set(ASN1_INTEGER *a, long v); +long ASN1_INTEGER_get(const ASN1_INTEGER *a); +ASN1_INTEGER *BN_to_ASN1_INTEGER(const BIGNUM *bn, ASN1_INTEGER *ai); +BIGNUM *ASN1_INTEGER_to_BN(const ASN1_INTEGER *ai, BIGNUM *bn); + +int ASN1_ENUMERATED_get_int64(int64_t *out_val, const ASN1_ENUMERATED *aenum); +int ASN1_ENUMERATED_set_int64(ASN1_ENUMERATED *aenum, int64_t val); +int ASN1_ENUMERATED_set(ASN1_ENUMERATED *a, long v); +long ASN1_ENUMERATED_get(const ASN1_ENUMERATED *a); +ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(const BIGNUM *bn, ASN1_ENUMERATED *ai); +BIGNUM *ASN1_ENUMERATED_to_BN(const ASN1_ENUMERATED *ai, BIGNUM *bn); + +/* General */ +/* given a string, return the correct type, max is the maximum length */ +int ASN1_PRINTABLE_type(const unsigned char *s, int max); + +/* SPECIALS */ +int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag, + int *pclass, long omax); +void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag, + int xclass); +int ASN1_put_eoc(unsigned char **pp); +int ASN1_object_size(int constructed, int length, int tag); + +void *ASN1_item_dup(const ASN1_ITEM *it, void *x); + +void *ASN1_dup(i2d_of_void *i2d, d2i_of_void *d2i, void *x); + +void *ASN1_d2i_fp(void *(*xnew)(void), d2i_of_void *d2i, FILE *in, void **x); + +#define ASN1_d2i_fp_of(type,xnew,d2i,in,x) \ + ((type*)ASN1_d2i_fp(CHECKED_NEW_OF(type, xnew), \ + CHECKED_D2I_OF(type, d2i), \ + in, \ + CHECKED_PPTR_OF(type, x))) + +void *ASN1_item_d2i_fp(const ASN1_ITEM *it, FILE *in, void *x); +int ASN1_i2d_fp(i2d_of_void *i2d, FILE *out, void *x); + +#define ASN1_i2d_fp_of(type,i2d,out,x) \ + (ASN1_i2d_fp(CHECKED_I2D_OF(type, i2d), \ + out, \ + CHECKED_PTR_OF(type, x))) + +#define ASN1_i2d_fp_of_const(type,i2d,out,x) \ + (ASN1_i2d_fp(CHECKED_I2D_OF(const type, i2d), \ + out, \ + CHECKED_PTR_OF(const type, x))) + +int ASN1_item_i2d_fp(const ASN1_ITEM *it, FILE *out, void *x); +int ASN1_STRING_print_ex_fp(FILE *fp, const ASN1_STRING *str, + unsigned long flags); + +int ASN1_STRING_to_UTF8(unsigned char **out, const ASN1_STRING *in); + +#ifndef OPENSSL_NO_BIO +void *ASN1_d2i_bio(void *(*xnew)(void), d2i_of_void *d2i, BIO *in, void **x); + +#define ASN1_d2i_bio_of(type,xnew,d2i,in,x) \ + ((type*)ASN1_d2i_bio( CHECKED_NEW_OF(type, xnew), \ + CHECKED_D2I_OF(type, d2i), \ + in, \ + CHECKED_PPTR_OF(type, x))) + +void *ASN1_item_d2i_bio(const ASN1_ITEM *it, BIO *in, void *x); +int ASN1_i2d_bio(i2d_of_void *i2d, BIO *out, unsigned char *x); + +#define ASN1_i2d_bio_of(type,i2d,out,x) \ + (ASN1_i2d_bio(CHECKED_I2D_OF(type, i2d), \ + out, \ + CHECKED_PTR_OF(type, x))) + +#define ASN1_i2d_bio_of_const(type,i2d,out,x) \ + (ASN1_i2d_bio(CHECKED_I2D_OF(const type, i2d), \ + out, \ + CHECKED_PTR_OF(const type, x))) + +int ASN1_item_i2d_bio(const ASN1_ITEM *it, BIO *out, void *x); +int ASN1_UTCTIME_print(BIO *fp, const ASN1_UTCTIME *a); +int ASN1_GENERALIZEDTIME_print(BIO *fp, const ASN1_GENERALIZEDTIME *a); +int ASN1_TIME_print(BIO *fp, const ASN1_TIME *a); +int ASN1_STRING_print(BIO *bp, const ASN1_STRING *v); +int ASN1_STRING_print_ex(BIO *out, const ASN1_STRING *str, unsigned long flags); +int ASN1_parse(BIO *bp, const unsigned char *pp, long len, int indent); +int ASN1_parse_dump(BIO *bp, const unsigned char *pp, long len, int indent, int dump); +#endif + +unsigned long ASN1_tag2bit(int tag); +const char *ASN1_tag2str(int tag); + +int ASN1_UNIVERSALSTRING_to_string(ASN1_UNIVERSALSTRING *s); + +int ASN1_TYPE_set_octetstring(ASN1_TYPE *a, const unsigned char *data, int len); +int ASN1_TYPE_get_octetstring(const ASN1_TYPE *a, unsigned char *data, + int max_len); +int ASN1_TYPE_set_int_octetstring(ASN1_TYPE *a, long num, const unsigned char *data, + int len); +int ASN1_TYPE_get_int_octetstring(const ASN1_TYPE *a, long *num, + unsigned char *data, int max_len); + +ASN1_STRING *ASN1_item_pack(void *obj, const ASN1_ITEM *it, + ASN1_OCTET_STRING **oct); +void *ASN1_item_unpack(const ASN1_STRING *oct, const ASN1_ITEM *it); + +void ASN1_STRING_set_default_mask(unsigned long mask); +int ASN1_STRING_set_default_mask_asc(const char *p); +unsigned long ASN1_STRING_get_default_mask(void); +int ASN1_mbstring_copy(ASN1_STRING **out, const unsigned char *in, int len, + int inform, unsigned long mask); +int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len, + int inform, unsigned long mask, long minsize, long maxsize); + +ASN1_STRING *ASN1_STRING_set_by_NID(ASN1_STRING **out, + const unsigned char *in, int inlen, int inform, int nid); +const ASN1_STRING_TABLE *ASN1_STRING_TABLE_get(int nid); + +/* ASN1 template functions */ + +/* Old API compatible functions */ +ASN1_VALUE *ASN1_item_new(const ASN1_ITEM *it); +void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it); +ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **val, const unsigned char **in, + long len, const ASN1_ITEM *it); +int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it); + +ASN1_TYPE *ASN1_generate_nconf(const char *str, CONF *nconf); +ASN1_TYPE *ASN1_generate_v3(const char *str, X509V3_CTX *cnf); + +/* ASN1 Print flags */ + +/* Indicate missing OPTIONAL fields */ +#define ASN1_PCTX_FLAGS_SHOW_ABSENT 0x001 +/* Mark start and end of SEQUENCE */ +#define ASN1_PCTX_FLAGS_SHOW_SEQUENCE 0x002 +/* Mark start and end of SEQUENCE/SET OF */ +#define ASN1_PCTX_FLAGS_SHOW_SSOF 0x004 +/* Show the ASN1 type of primitives */ +#define ASN1_PCTX_FLAGS_SHOW_TYPE 0x008 +/* Don't show ASN1 type of ANY */ +#define ASN1_PCTX_FLAGS_NO_ANY_TYPE 0x010 +/* Don't show ASN1 type of MSTRINGs */ +#define ASN1_PCTX_FLAGS_NO_MSTRING_TYPE 0x020 +/* Don't show field names in SEQUENCE */ +#define ASN1_PCTX_FLAGS_NO_FIELD_NAME 0x040 +/* Show structure names of each SEQUENCE field */ +#define ASN1_PCTX_FLAGS_SHOW_FIELD_STRUCT_NAME 0x080 +/* Don't show structure name even at top level */ +#define ASN1_PCTX_FLAGS_NO_STRUCT_NAME 0x100 + +int ASN1_item_print(BIO *out, ASN1_VALUE *ifld, int indent, + const ASN1_ITEM *it, const ASN1_PCTX *pctx); + +int SMIME_crlf_copy(BIO *in, BIO *out, int flags); +int SMIME_text(BIO *in, BIO *out); + +void ERR_load_ASN1_strings(void); + +/* Error codes for the ASN1 functions. */ + +/* Function codes. */ +#define ASN1_F_A2D_ASN1_OBJECT 100 +#define ASN1_F_A2I_ASN1_ENUMERATED 101 +#define ASN1_F_A2I_ASN1_INTEGER 102 +#define ASN1_F_A2I_ASN1_STRING 103 +#define ASN1_F_APPEND_EXP 176 +#define ASN1_F_ASN1_BIT_STRING_SET_BIT 183 +#define ASN1_F_ASN1_CB 177 +#define ASN1_F_ASN1_CHECK_TLEN 104 +#define ASN1_F_ASN1_COLLATE_PRIMITIVE 105 +#define ASN1_F_ASN1_COLLECT 106 +#define ASN1_F_ASN1_D2I_EX_PRIMITIVE 108 +#define ASN1_F_ASN1_D2I_FP 109 +#define ASN1_F_ASN1_D2I_READ_BIO 107 +#define ASN1_F_ASN1_DIGEST 184 +#define ASN1_F_ASN1_DO_ADB 110 +#define ASN1_F_ASN1_DUP 111 +#define ASN1_F_ASN1_ENUMERATED_SET 112 +#define ASN1_F_ASN1_ENUMERATED_TO_BN 113 +#define ASN1_F_ASN1_EX_C2I 204 +#define ASN1_F_ASN1_FIND_END 190 +#define ASN1_F_ASN1_GENERALIZEDTIME_ADJ 216 +#define ASN1_F_ASN1_GENERALIZEDTIME_SET 185 +#define ASN1_F_ASN1_GENERATE_V3 178 +#define ASN1_F_ASN1_GET_OBJECT 114 +#define ASN1_F_ASN1_HEADER_NEW 115 +#define ASN1_F_ASN1_I2D_BIO 116 +#define ASN1_F_ASN1_I2D_FP 117 +#define ASN1_F_ASN1_INTEGER_SET 118 +#define ASN1_F_ASN1_INTEGER_TO_BN 119 +#define ASN1_F_ASN1_ITEM_D2I_FP 206 +#define ASN1_F_ASN1_ITEM_DUP 191 +#define ASN1_F_ASN1_ITEM_EX_COMBINE_NEW 121 +#define ASN1_F_ASN1_ITEM_EX_D2I 120 +#define ASN1_F_ASN1_ITEM_I2D_BIO 192 +#define ASN1_F_ASN1_ITEM_I2D_FP 193 +#define ASN1_F_ASN1_ITEM_PACK 198 +#define ASN1_F_ASN1_ITEM_SIGN 195 +#define ASN1_F_ASN1_ITEM_SIGN_CTX 220 +#define ASN1_F_ASN1_ITEM_UNPACK 199 +#define ASN1_F_ASN1_ITEM_VERIFY 197 +#define ASN1_F_ASN1_MBSTRING_NCOPY 122 +#define ASN1_F_ASN1_OBJECT_NEW 123 +#define ASN1_F_ASN1_OUTPUT_DATA 214 +#define ASN1_F_ASN1_PACK_STRING 124 +#define ASN1_F_ASN1_PCTX_NEW 205 +#define ASN1_F_ASN1_PKCS5_PBE_SET 125 +#define ASN1_F_ASN1_SEQ_PACK 126 +#define ASN1_F_ASN1_SEQ_UNPACK 127 +#define ASN1_F_ASN1_SIGN 128 +#define ASN1_F_ASN1_STR2TYPE 179 +#define ASN1_F_ASN1_STRING_SET 186 +#define ASN1_F_ASN1_STRING_TABLE_ADD 129 +#define ASN1_F_ASN1_STRING_TYPE_NEW 130 +#define ASN1_F_ASN1_TEMPLATE_EX_D2I 132 +#define ASN1_F_ASN1_TEMPLATE_NEW 133 +#define ASN1_F_ASN1_TEMPLATE_NOEXP_D2I 131 +#define ASN1_F_ASN1_TIME_ADJ 217 +#define ASN1_F_ASN1_TIME_SET 175 +#define ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING 134 +#define ASN1_F_ASN1_TYPE_GET_OCTETSTRING 135 +#define ASN1_F_ASN1_UNPACK_STRING 136 +#define ASN1_F_ASN1_UTCTIME_ADJ 218 +#define ASN1_F_ASN1_UTCTIME_SET 187 +#define ASN1_F_ASN1_VERIFY 137 +#define ASN1_F_B64_READ_ASN1 209 +#define ASN1_F_B64_WRITE_ASN1 210 +#define ASN1_F_BIO_NEW_NDEF 208 +#define ASN1_F_BITSTR_CB 180 +#define ASN1_F_BN_TO_ASN1_ENUMERATED 138 +#define ASN1_F_BN_TO_ASN1_INTEGER 139 +#define ASN1_F_C2I_ASN1_BIT_STRING 189 +#define ASN1_F_C2I_ASN1_INTEGER 194 +#define ASN1_F_C2I_ASN1_OBJECT 196 +#define ASN1_F_COLLECT_DATA 140 +#define ASN1_F_D2I_ASN1_BIT_STRING 141 +#define ASN1_F_D2I_ASN1_BOOLEAN 142 +#define ASN1_F_D2I_ASN1_BYTES 143 +#define ASN1_F_D2I_ASN1_GENERALIZEDTIME 144 +#define ASN1_F_D2I_ASN1_HEADER 145 +#define ASN1_F_D2I_ASN1_INTEGER 146 +#define ASN1_F_D2I_ASN1_OBJECT 147 +#define ASN1_F_D2I_ASN1_SET 148 +#define ASN1_F_D2I_ASN1_TYPE_BYTES 149 +#define ASN1_F_D2I_ASN1_UINTEGER 150 +#define ASN1_F_D2I_ASN1_UTCTIME 151 +#define ASN1_F_D2I_AUTOPRIVATEKEY 207 +#define ASN1_F_D2I_NETSCAPE_RSA 152 +#define ASN1_F_D2I_NETSCAPE_RSA_2 153 +#define ASN1_F_D2I_PRIVATEKEY 154 +#define ASN1_F_D2I_PUBLICKEY 155 +#define ASN1_F_D2I_RSA_NET 200 +#define ASN1_F_D2I_RSA_NET_2 201 +#define ASN1_F_D2I_X509 156 +#define ASN1_F_D2I_X509_CINF 157 +#define ASN1_F_D2I_X509_PKEY 159 +#define ASN1_F_I2D_ASN1_BIO_STREAM 211 +#define ASN1_F_I2D_ASN1_SET 188 +#define ASN1_F_I2D_ASN1_TIME 160 +#define ASN1_F_I2D_DSA_PUBKEY 161 +#define ASN1_F_I2D_EC_PUBKEY 181 +#define ASN1_F_I2D_PRIVATEKEY 163 +#define ASN1_F_I2D_PUBLICKEY 164 +#define ASN1_F_I2D_RSA_NET 162 +#define ASN1_F_I2D_RSA_PUBKEY 165 +#define ASN1_F_LONG_C2I 166 +#define ASN1_F_OID_MODULE_INIT 174 +#define ASN1_F_PARSE_TAGGING 182 +#define ASN1_F_PKCS5_PBE2_SET_IV 167 +#define ASN1_F_PKCS5_PBE_SET 202 +#define ASN1_F_PKCS5_PBE_SET0_ALGOR 215 +#define ASN1_F_PKCS5_PBKDF2_SET 219 +#define ASN1_F_SMIME_READ_ASN1 212 +#define ASN1_F_SMIME_TEXT 213 +#define ASN1_F_X509_CINF_NEW 168 +#define ASN1_F_X509_CRL_ADD0_REVOKED 169 +#define ASN1_F_X509_INFO_NEW 170 +#define ASN1_F_X509_NAME_ENCODE 203 +#define ASN1_F_X509_NAME_EX_D2I 158 +#define ASN1_F_X509_NAME_EX_NEW 171 +#define ASN1_F_X509_NEW 172 +#define ASN1_F_X509_PKEY_NEW 173 + +/* Reason codes. */ +#define ASN1_R_ADDING_OBJECT 171 +#define ASN1_R_ASN1_PARSE_ERROR 203 +#define ASN1_R_ASN1_SIG_PARSE_ERROR 204 +#define ASN1_R_AUX_ERROR 100 +#define ASN1_R_BAD_CLASS 101 +#define ASN1_R_BAD_OBJECT_HEADER 102 +#define ASN1_R_BAD_PASSWORD_READ 103 +#define ASN1_R_BAD_TAG 104 +#define ASN1_R_BAD_TEMPLATE 230 +#define ASN1_R_BMPSTRING_IS_WRONG_LENGTH 214 +#define ASN1_R_BN_LIB 105 +#define ASN1_R_BOOLEAN_IS_WRONG_LENGTH 106 +#define ASN1_R_BUFFER_TOO_SMALL 107 +#define ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER 108 +#define ASN1_R_CONTEXT_NOT_INITIALISED 217 +#define ASN1_R_DATA_IS_WRONG 109 +#define ASN1_R_DECODE_ERROR 110 +#define ASN1_R_DECODING_ERROR 111 +#define ASN1_R_DEPTH_EXCEEDED 174 +#define ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED 198 +#define ASN1_R_ENCODE_ERROR 112 +#define ASN1_R_ERROR_GETTING_TIME 173 +#define ASN1_R_ERROR_LOADING_SECTION 172 +#define ASN1_R_ERROR_PARSING_SET_ELEMENT 113 +#define ASN1_R_ERROR_SETTING_CIPHER_PARAMS 114 +#define ASN1_R_EXPECTING_AN_INTEGER 115 +#define ASN1_R_EXPECTING_AN_OBJECT 116 +#define ASN1_R_EXPECTING_A_BOOLEAN 117 +#define ASN1_R_EXPECTING_A_TIME 118 +#define ASN1_R_EXPLICIT_LENGTH_MISMATCH 119 +#define ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED 120 +#define ASN1_R_FIELD_MISSING 121 +#define ASN1_R_FIRST_NUM_TOO_LARGE 122 +#define ASN1_R_HEADER_TOO_LONG 123 +#define ASN1_R_ILLEGAL_BITSTRING_FORMAT 175 +#define ASN1_R_ILLEGAL_BOOLEAN 176 +#define ASN1_R_ILLEGAL_CHARACTERS 124 +#define ASN1_R_ILLEGAL_FORMAT 177 +#define ASN1_R_ILLEGAL_HEX 178 +#define ASN1_R_ILLEGAL_IMPLICIT_TAG 179 +#define ASN1_R_ILLEGAL_INTEGER 180 +#define ASN1_R_ILLEGAL_NEGATIVE_VALUE 226 +#define ASN1_R_ILLEGAL_NESTED_TAGGING 181 +#define ASN1_R_ILLEGAL_NULL 125 +#define ASN1_R_ILLEGAL_NULL_VALUE 182 +#define ASN1_R_ILLEGAL_OBJECT 183 +#define ASN1_R_ILLEGAL_OPTIONAL_ANY 126 +#define ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE 170 +#define ASN1_R_ILLEGAL_TAGGED_ANY 127 +#define ASN1_R_ILLEGAL_TIME_VALUE 184 +#define ASN1_R_INTEGER_NOT_ASCII_FORMAT 185 +#define ASN1_R_INTEGER_TOO_LARGE_FOR_LONG 128 +#define ASN1_R_INVALID_BIT_STRING_BITS_LEFT 220 +#define ASN1_R_INVALID_BMPSTRING_LENGTH 129 +#define ASN1_R_INVALID_DIGIT 130 +#define ASN1_R_INVALID_MIME_TYPE 205 +#define ASN1_R_INVALID_MODIFIER 186 +#define ASN1_R_INVALID_NUMBER 187 +#define ASN1_R_INVALID_OBJECT_ENCODING 216 +#define ASN1_R_INVALID_SEPARATOR 131 +#define ASN1_R_INVALID_TIME_FORMAT 132 +#define ASN1_R_INVALID_UNIVERSALSTRING_LENGTH 133 +#define ASN1_R_INVALID_UTF8STRING 134 +#define ASN1_R_IV_TOO_LARGE 135 +#define ASN1_R_LENGTH_ERROR 136 +#define ASN1_R_LIST_ERROR 188 +#define ASN1_R_MIME_NO_CONTENT_TYPE 206 +#define ASN1_R_MIME_PARSE_ERROR 207 +#define ASN1_R_MIME_SIG_PARSE_ERROR 208 +#define ASN1_R_MISSING_EOC 137 +#define ASN1_R_MISSING_SECOND_NUMBER 138 +#define ASN1_R_MISSING_VALUE 189 +#define ASN1_R_MSTRING_NOT_UNIVERSAL 139 +#define ASN1_R_MSTRING_WRONG_TAG 140 +#define ASN1_R_NESTED_ASN1_STRING 197 +#define ASN1_R_NESTED_TOO_DEEP 219 +#define ASN1_R_NON_HEX_CHARACTERS 141 +#define ASN1_R_NOT_ASCII_FORMAT 190 +#define ASN1_R_NOT_ENOUGH_DATA 142 +#define ASN1_R_NO_CONTENT_TYPE 209 +#define ASN1_R_NO_DEFAULT_DIGEST 201 +#define ASN1_R_NO_MATCHING_CHOICE_TYPE 143 +#define ASN1_R_NO_MULTIPART_BODY_FAILURE 210 +#define ASN1_R_NO_MULTIPART_BOUNDARY 211 +#define ASN1_R_NO_SIG_CONTENT_TYPE 212 +#define ASN1_R_NULL_IS_WRONG_LENGTH 144 +#define ASN1_R_OBJECT_NOT_ASCII_FORMAT 191 +#define ASN1_R_ODD_NUMBER_OF_CHARS 145 +#define ASN1_R_PRIVATE_KEY_HEADER_MISSING 146 +#define ASN1_R_SECOND_NUMBER_TOO_LARGE 147 +#define ASN1_R_SEQUENCE_LENGTH_MISMATCH 148 +#define ASN1_R_SEQUENCE_NOT_CONSTRUCTED 149 +#define ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG 192 +#define ASN1_R_SHORT_LINE 150 +#define ASN1_R_SIG_INVALID_MIME_TYPE 213 +#define ASN1_R_STREAMING_NOT_SUPPORTED 202 +#define ASN1_R_STRING_TOO_LONG 151 +#define ASN1_R_STRING_TOO_SHORT 152 +#define ASN1_R_TAG_VALUE_TOO_HIGH 153 +#define ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 154 +#define ASN1_R_TIME_NOT_ASCII_FORMAT 193 +#define ASN1_R_TOO_LARGE 223 +#define ASN1_R_TOO_LONG 155 +#define ASN1_R_TOO_SMALL 224 +#define ASN1_R_TYPE_NOT_CONSTRUCTED 156 +#define ASN1_R_TYPE_NOT_PRIMITIVE 231 +#define ASN1_R_UNABLE_TO_DECODE_RSA_KEY 157 +#define ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY 158 +#define ASN1_R_UNEXPECTED_EOC 159 +#define ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH 215 +#define ASN1_R_UNKNOWN_FORMAT 160 +#define ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM 161 +#define ASN1_R_UNKNOWN_OBJECT_TYPE 162 +#define ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE 163 +#define ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM 199 +#define ASN1_R_UNKNOWN_TAG 194 +#define ASN1_R_UNKOWN_FORMAT 195 +#define ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE 164 +#define ASN1_R_UNSUPPORTED_CIPHER 165 +#define ASN1_R_UNSUPPORTED_ENCRYPTION_ALGORITHM 166 +#define ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE 167 +#define ASN1_R_UNSUPPORTED_TYPE 196 +#define ASN1_R_WRONG_INTEGER_TYPE 225 +#define ASN1_R_WRONG_PUBLIC_KEY_TYPE 200 +#define ASN1_R_WRONG_TAG 168 +#define ASN1_R_WRONG_TYPE 169 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/asn1t.h b/curl/include/openssl/asn1t.h new file mode 100644 index 0000000..22cde48 --- /dev/null +++ b/curl/include/openssl/asn1t.h @@ -0,0 +1,904 @@ +/* $OpenBSD: asn1t.h,v 1.24 2024/07/08 16:24:22 beck Exp $ */ +/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL + * project 2000. + */ +/* ==================================================================== + * Copyright (c) 2000-2005 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ +#ifndef HEADER_ASN1T_H +#define HEADER_ASN1T_H + +#include + +#include + +#include + +/* ASN1 template defines, structures and functions */ + +#ifdef __cplusplus +extern "C" { +#endif + +#ifndef LIBRESSL_INTERNAL + +/* Macro to obtain ASN1_ADB pointer from a type (only used internally) */ +#define ASN1_ADB_ptr(iptr) ((const ASN1_ADB *)(iptr)) + + +/* Macros for start and end of ASN1_ITEM definition */ + +#define ASN1_ITEM_start(itname) \ + const ASN1_ITEM itname##_it = { + +#define static_ASN1_ITEM_start(itname) \ + static const ASN1_ITEM itname##_it = { + +#define ASN1_ITEM_end(itname) \ + }; + + + +/* Macros to aid ASN1 template writing */ + +#define ASN1_ITEM_TEMPLATE(tname) \ + static const ASN1_TEMPLATE tname##_item_tt + +#define ASN1_ITEM_TEMPLATE_END(tname) \ + ;\ + ASN1_ITEM_start(tname) \ + ASN1_ITYPE_PRIMITIVE,\ + -1,\ + &tname##_item_tt,\ + 0,\ + NULL,\ + 0,\ + #tname \ + ASN1_ITEM_end(tname) + +#define static_ASN1_ITEM_TEMPLATE_END(tname) \ + ;\ + static_ASN1_ITEM_start(tname) \ + ASN1_ITYPE_PRIMITIVE,\ + -1,\ + &tname##_item_tt,\ + 0,\ + NULL,\ + 0,\ + #tname \ + ASN1_ITEM_end(tname) + + +/* This is a ASN1 type which just embeds a template */ + +/* + * This pair helps declare a SEQUENCE. We can do: + * + * ASN1_SEQUENCE(stname) = { + * ... SEQUENCE components ... + * } ASN1_SEQUENCE_END(stname) + * + * This will produce an ASN1_ITEM called stname_it + * for a structure called stname. + * + * If you want the same structure but a different + * name then use: + * + * ASN1_SEQUENCE(itname) = { + * ... SEQUENCE components ... + * } ASN1_SEQUENCE_END_name(stname, itname) + * + * This will create an item called itname_it using + * a structure called stname. + */ + +#define ASN1_SEQUENCE(tname) \ + static const ASN1_TEMPLATE tname##_seq_tt[] + +#define ASN1_SEQUENCE_END(stname) ASN1_SEQUENCE_END_name(stname, stname) + +#define static_ASN1_SEQUENCE_END(stname) static_ASN1_SEQUENCE_END_name(stname, stname) + +#define ASN1_SEQUENCE_END_name(stname, tname) \ + ;\ + ASN1_ITEM_start(tname) \ + ASN1_ITYPE_SEQUENCE,\ + V_ASN1_SEQUENCE,\ + tname##_seq_tt,\ + sizeof(tname##_seq_tt) / sizeof(ASN1_TEMPLATE),\ + NULL,\ + sizeof(stname),\ + #stname \ + ASN1_ITEM_end(tname) + +#define static_ASN1_SEQUENCE_END_name(stname, tname) \ + ;\ + static_ASN1_ITEM_start(tname) \ + ASN1_ITYPE_SEQUENCE,\ + V_ASN1_SEQUENCE,\ + tname##_seq_tt,\ + sizeof(tname##_seq_tt) / sizeof(ASN1_TEMPLATE),\ + NULL,\ + sizeof(stname),\ + #stname \ + ASN1_ITEM_end(tname) + +#define ASN1_NDEF_SEQUENCE(tname) \ + ASN1_SEQUENCE(tname) + +#define ASN1_NDEF_SEQUENCE_cb(tname, cb) \ + ASN1_SEQUENCE_cb(tname, cb) + +#define ASN1_SEQUENCE_cb(tname, cb) \ + static const ASN1_AUX tname##_aux = {NULL, 0, 0, 0, cb, 0}; \ + ASN1_SEQUENCE(tname) + +#define ASN1_SEQUENCE_ref(tname, cb, lck) \ + static const ASN1_AUX tname##_aux = {NULL, ASN1_AFLG_REFCOUNT, offsetof(tname, references), lck, cb, 0}; \ + ASN1_SEQUENCE(tname) + +#define ASN1_SEQUENCE_enc(tname, enc, cb) \ + static const ASN1_AUX tname##_aux = {NULL, ASN1_AFLG_ENCODING, 0, 0, cb, offsetof(tname, enc)}; \ + ASN1_SEQUENCE(tname) + +#define ASN1_NDEF_SEQUENCE_END(tname) \ + ;\ + ASN1_ITEM_start(tname) \ + ASN1_ITYPE_NDEF_SEQUENCE,\ + V_ASN1_SEQUENCE,\ + tname##_seq_tt,\ + sizeof(tname##_seq_tt) / sizeof(ASN1_TEMPLATE),\ + NULL,\ + sizeof(tname),\ + #tname \ + ASN1_ITEM_end(tname) + +#define static_ASN1_NDEF_SEQUENCE_END(tname) \ + ;\ + static_ASN1_ITEM_start(tname) \ + ASN1_ITYPE_NDEF_SEQUENCE,\ + V_ASN1_SEQUENCE,\ + tname##_seq_tt,\ + sizeof(tname##_seq_tt) / sizeof(ASN1_TEMPLATE),\ + NULL,\ + sizeof(tname),\ + #tname \ + ASN1_ITEM_end(tname) + +#define ASN1_SEQUENCE_END_enc(stname, tname) ASN1_SEQUENCE_END_ref(stname, tname) + +#define ASN1_SEQUENCE_END_cb(stname, tname) ASN1_SEQUENCE_END_ref(stname, tname) + +#define static_ASN1_SEQUENCE_END_cb(stname, tname) static_ASN1_SEQUENCE_END_ref(stname, tname) + +#define ASN1_SEQUENCE_END_ref(stname, tname) \ + ;\ + ASN1_ITEM_start(tname) \ + ASN1_ITYPE_SEQUENCE,\ + V_ASN1_SEQUENCE,\ + tname##_seq_tt,\ + sizeof(tname##_seq_tt) / sizeof(ASN1_TEMPLATE),\ + &tname##_aux,\ + sizeof(stname),\ + #stname \ + ASN1_ITEM_end(tname) + +#define static_ASN1_SEQUENCE_END_ref(stname, tname) \ + ;\ + static_ASN1_ITEM_start(tname) \ + ASN1_ITYPE_SEQUENCE,\ + V_ASN1_SEQUENCE,\ + tname##_seq_tt,\ + sizeof(tname##_seq_tt) / sizeof(ASN1_TEMPLATE),\ + &tname##_aux,\ + sizeof(stname),\ + #stname \ + ASN1_ITEM_end(tname) + +#define ASN1_NDEF_SEQUENCE_END_cb(stname, tname) \ + ;\ + ASN1_ITEM_start(tname) \ + ASN1_ITYPE_NDEF_SEQUENCE,\ + V_ASN1_SEQUENCE,\ + tname##_seq_tt,\ + sizeof(tname##_seq_tt) / sizeof(ASN1_TEMPLATE),\ + &tname##_aux,\ + sizeof(stname),\ + #stname \ + ASN1_ITEM_end(tname) + + +/* + * This pair helps declare a CHOICE type. We can do: + * + * ASN1_CHOICE(chname) = { + * ... CHOICE options ... + * ASN1_CHOICE_END(chname) + * + * This will produce an ASN1_ITEM called chname_it + * for a structure called chname. The structure + * definition must look like this: + * typedef struct { + * int type; + * union { + * ASN1_SOMETHING *opt1; + * ASN1_SOMEOTHER *opt2; + * } value; + * } chname; + * + * the name of the selector must be 'type'. + * to use an alternative selector name use the + * ASN1_CHOICE_END_selector() version. + */ + +#define ASN1_CHOICE(tname) \ + static const ASN1_TEMPLATE tname##_ch_tt[] + +#define ASN1_CHOICE_cb(tname, cb) \ + static const ASN1_AUX tname##_aux = {NULL, 0, 0, 0, cb, 0}; \ + ASN1_CHOICE(tname) + +#define ASN1_CHOICE_END(stname) ASN1_CHOICE_END_name(stname, stname) + +#define static_ASN1_CHOICE_END(stname) static_ASN1_CHOICE_END_name(stname, stname) + +#define ASN1_CHOICE_END_name(stname, tname) ASN1_CHOICE_END_selector(stname, tname, type) + +#define static_ASN1_CHOICE_END_name(stname, tname) static_ASN1_CHOICE_END_selector(stname, tname, type) + +#define ASN1_CHOICE_END_selector(stname, tname, selname) \ + ;\ + ASN1_ITEM_start(tname) \ + ASN1_ITYPE_CHOICE,\ + offsetof(stname,selname) ,\ + tname##_ch_tt,\ + sizeof(tname##_ch_tt) / sizeof(ASN1_TEMPLATE),\ + NULL,\ + sizeof(stname),\ + #stname \ + ASN1_ITEM_end(tname) + +#define static_ASN1_CHOICE_END_selector(stname, tname, selname) \ + ;\ + static_ASN1_ITEM_start(tname) \ + ASN1_ITYPE_CHOICE,\ + offsetof(stname,selname) ,\ + tname##_ch_tt,\ + sizeof(tname##_ch_tt) / sizeof(ASN1_TEMPLATE),\ + NULL,\ + sizeof(stname),\ + #stname \ + ASN1_ITEM_end(tname) + +#define ASN1_CHOICE_END_cb(stname, tname, selname) \ + ;\ + ASN1_ITEM_start(tname) \ + ASN1_ITYPE_CHOICE,\ + offsetof(stname,selname) ,\ + tname##_ch_tt,\ + sizeof(tname##_ch_tt) / sizeof(ASN1_TEMPLATE),\ + &tname##_aux,\ + sizeof(stname),\ + #stname \ + ASN1_ITEM_end(tname) + +/* This helps with the template wrapper form of ASN1_ITEM */ + +#define ASN1_EX_TEMPLATE_TYPE(flags, tag, name, type) { \ + (flags), (tag), 0,\ + #name, ASN1_ITEM_ref(type) } + +/* These help with SEQUENCE or CHOICE components */ + +/* used to declare other types */ + +#define ASN1_EX_TYPE(flags, tag, stname, field, type) { \ + (flags), (tag), offsetof(stname, field),\ + #field, ASN1_ITEM_ref(type) } + +/* implicit and explicit helper macros */ + +#define ASN1_IMP_EX(stname, field, type, tag, ex) \ + ASN1_EX_TYPE(ASN1_TFLG_IMPLICIT | ex, tag, stname, field, type) + +#define ASN1_EXP_EX(stname, field, type, tag, ex) \ + ASN1_EX_TYPE(ASN1_TFLG_EXPLICIT | ex, tag, stname, field, type) + +/* Any defined by macros: the field used is in the table itself */ + +#define ASN1_ADB_OBJECT(tblname) { ASN1_TFLG_ADB_OID, -1, 0, #tblname, (const ASN1_ITEM *)&(tblname##_adb) } +#define ASN1_ADB_INTEGER(tblname) { ASN1_TFLG_ADB_INT, -1, 0, #tblname, (const ASN1_ITEM *)&(tblname##_adb) } +/* Plain simple type */ +#define ASN1_SIMPLE(stname, field, type) ASN1_EX_TYPE(0,0, stname, field, type) + +/* OPTIONAL simple type */ +#define ASN1_OPT(stname, field, type) ASN1_EX_TYPE(ASN1_TFLG_OPTIONAL, 0, stname, field, type) + +/* IMPLICIT tagged simple type */ +#define ASN1_IMP(stname, field, type, tag) ASN1_IMP_EX(stname, field, type, tag, 0) + +/* IMPLICIT tagged OPTIONAL simple type */ +#define ASN1_IMP_OPT(stname, field, type, tag) ASN1_IMP_EX(stname, field, type, tag, ASN1_TFLG_OPTIONAL) + +/* Same as above but EXPLICIT */ + +#define ASN1_EXP(stname, field, type, tag) ASN1_EXP_EX(stname, field, type, tag, 0) +#define ASN1_EXP_OPT(stname, field, type, tag) ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_OPTIONAL) + +/* SEQUENCE OF type */ +#define ASN1_SEQUENCE_OF(stname, field, type) \ + ASN1_EX_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, stname, field, type) + +/* OPTIONAL SEQUENCE OF */ +#define ASN1_SEQUENCE_OF_OPT(stname, field, type) \ + ASN1_EX_TYPE(ASN1_TFLG_SEQUENCE_OF|ASN1_TFLG_OPTIONAL, 0, stname, field, type) + +/* Same as above but for SET OF */ + +#define ASN1_SET_OF(stname, field, type) \ + ASN1_EX_TYPE(ASN1_TFLG_SET_OF, 0, stname, field, type) + +#define ASN1_SET_OF_OPT(stname, field, type) \ + ASN1_EX_TYPE(ASN1_TFLG_SET_OF|ASN1_TFLG_OPTIONAL, 0, stname, field, type) + +/* Finally compound types of SEQUENCE, SET, IMPLICIT, EXPLICIT and OPTIONAL */ + +#define ASN1_IMP_SET_OF(stname, field, type, tag) \ + ASN1_IMP_EX(stname, field, type, tag, ASN1_TFLG_SET_OF) + +#define ASN1_EXP_SET_OF(stname, field, type, tag) \ + ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_SET_OF) + +#define ASN1_IMP_SET_OF_OPT(stname, field, type, tag) \ + ASN1_IMP_EX(stname, field, type, tag, ASN1_TFLG_SET_OF|ASN1_TFLG_OPTIONAL) + +#define ASN1_EXP_SET_OF_OPT(stname, field, type, tag) \ + ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_SET_OF|ASN1_TFLG_OPTIONAL) + +#define ASN1_IMP_SEQUENCE_OF(stname, field, type, tag) \ + ASN1_IMP_EX(stname, field, type, tag, ASN1_TFLG_SEQUENCE_OF) + +#define ASN1_IMP_SEQUENCE_OF_OPT(stname, field, type, tag) \ + ASN1_IMP_EX(stname, field, type, tag, ASN1_TFLG_SEQUENCE_OF|ASN1_TFLG_OPTIONAL) + +#define ASN1_EXP_SEQUENCE_OF(stname, field, type, tag) \ + ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_SEQUENCE_OF) + +#define ASN1_EXP_SEQUENCE_OF_OPT(stname, field, type, tag) \ + ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_SEQUENCE_OF|ASN1_TFLG_OPTIONAL) + +/* EXPLICIT using indefinite length constructed form */ +#define ASN1_NDEF_EXP(stname, field, type, tag) \ + ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_NDEF) + +/* EXPLICIT OPTIONAL using indefinite length constructed form */ +#define ASN1_NDEF_EXP_OPT(stname, field, type, tag) \ + ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_OPTIONAL|ASN1_TFLG_NDEF) + +/* Macros for the ASN1_ADB structure */ + +#define ASN1_ADB(name) \ + static const ASN1_ADB_TABLE name##_adbtbl[] + + +#define ASN1_ADB_END(name, flags, field, app_table, def, none) \ + ;\ + static const ASN1_ADB name##_adb = {\ + flags,\ + offsetof(name, field),\ + app_table,\ + name##_adbtbl,\ + sizeof(name##_adbtbl) / sizeof(ASN1_ADB_TABLE),\ + def,\ + none\ + } + + +#define ADB_ENTRY(val, template) {val, template} + +#define ASN1_ADB_TEMPLATE(name) \ + static const ASN1_TEMPLATE name##_tt + +#endif /* !LIBRESSL_INTERNAL */ + +/* This is the ASN1 template structure that defines + * a wrapper round the actual type. It determines the + * actual position of the field in the value structure, + * various flags such as OPTIONAL and the field name. + */ + +struct ASN1_TEMPLATE_st { + unsigned long flags; /* Various flags */ + long tag; /* tag, not used if no tagging */ + unsigned long offset; /* Offset of this field in structure */ + const char *field_name; /* Field name */ + ASN1_ITEM_EXP *item; /* Relevant ASN1_ITEM or ASN1_ADB */ +}; + +/* Macro to extract ASN1_ITEM and ASN1_ADB pointer from ASN1_TEMPLATE */ + +#define ASN1_TEMPLATE_item(t) (t->item_ptr) +#define ASN1_TEMPLATE_adb(t) (t->item_ptr) + +typedef struct ASN1_ADB_TABLE_st ASN1_ADB_TABLE; +typedef struct ASN1_ADB_st ASN1_ADB; + +struct ASN1_ADB_st { + unsigned long flags; /* Various flags */ + unsigned long offset; /* Offset of selector field */ + const ASN1_ADB_TABLE *tbl; /* Table of possible types */ + long tblcount; /* Number of entries in tbl */ + const ASN1_TEMPLATE *default_tt; /* Type to use if no match */ + const ASN1_TEMPLATE *null_tt; /* Type to use if selector is NULL */ +}; + +struct ASN1_ADB_TABLE_st { + long value; /* NID for an object or value for an int */ + const ASN1_TEMPLATE tt; /* item for this value */ +}; + +/* template flags */ + +/* Field is optional */ +#define ASN1_TFLG_OPTIONAL (0x1) + +/* Field is a SET OF */ +#define ASN1_TFLG_SET_OF (0x1 << 1) + +/* Field is a SEQUENCE OF */ +#define ASN1_TFLG_SEQUENCE_OF (0x2 << 1) + +/* Special case: this refers to a SET OF that + * will be sorted into DER order when encoded *and* + * the corresponding STACK will be modified to match + * the new order. + */ +#define ASN1_TFLG_SET_ORDER (0x3 << 1) + +/* Mask for SET OF or SEQUENCE OF */ +#define ASN1_TFLG_SK_MASK (0x3 << 1) + +/* These flags mean the tag should be taken from the + * tag field. If EXPLICIT then the underlying type + * is used for the inner tag. + */ + +/* IMPLICIT tagging */ +#define ASN1_TFLG_IMPTAG (0x1 << 3) + + +/* EXPLICIT tagging, inner tag from underlying type */ +#define ASN1_TFLG_EXPTAG (0x2 << 3) + +#define ASN1_TFLG_TAG_MASK (0x3 << 3) + +/* context specific IMPLICIT */ +#define ASN1_TFLG_IMPLICIT ASN1_TFLG_IMPTAG|ASN1_TFLG_CONTEXT + +/* context specific EXPLICIT */ +#define ASN1_TFLG_EXPLICIT ASN1_TFLG_EXPTAG|ASN1_TFLG_CONTEXT + +/* + * If tagging is in force these determine the type of tag to use. Otherwiser + * the tag is determined by the underlying type. These values reflect the + * actual octet format. + */ + +/* Universal tag */ +#define ASN1_TFLG_UNIVERSAL (0x0<<6) +/* Application tag */ +#define ASN1_TFLG_APPLICATION (0x1<<6) +/* Context specific tag */ +#define ASN1_TFLG_CONTEXT (0x2<<6) +/* Private tag */ +#define ASN1_TFLG_PRIVATE (0x3<<6) + +#define ASN1_TFLG_TAG_CLASS (0x3<<6) + +/* + * These are for ANY DEFINED BY type. In this case + * the 'item' field points to an ASN1_ADB structure + * which contains a table of values to decode the + * relevant type + */ + +#define ASN1_TFLG_ADB_MASK (0x3<<8) + +#define ASN1_TFLG_ADB_OID (0x1<<8) + +#define ASN1_TFLG_ADB_INT (0x1<<9) + +/* + * This flag when present in a SEQUENCE OF, SET OF + * or EXPLICIT causes indefinite length constructed + * encoding to be used if required. + */ + +#define ASN1_TFLG_NDEF (0x1<<11) + +/* This is the actual ASN1 item itself */ + +struct ASN1_ITEM_st { + char itype; /* The item type, primitive, SEQUENCE, CHOICE or extern */ + long utype; /* underlying type */ + const ASN1_TEMPLATE *templates; /* If SEQUENCE or CHOICE this contains the contents */ + long tcount; /* Number of templates if SEQUENCE or CHOICE */ + const void *funcs; /* functions that handle this type */ + long size; /* Structure size (usually)*/ + const char *sname; /* Structure name */ +}; + +/* These are values for the itype field and + * determine how the type is interpreted. + * + * For PRIMITIVE types the underlying type + * determines the behaviour if items is NULL. + * + * Otherwise templates must contain a single + * template and the type is treated in the + * same way as the type specified in the template. + * + * For SEQUENCE types the templates field points + * to the members, the size field is the + * structure size. + * + * For CHOICE types the templates field points + * to each possible member (typically a union) + * and the 'size' field is the offset of the + * selector. + * + * The 'funcs' field is used for application + * specific functions. + * + * The EXTERN type uses a new style d2i/i2d. + * The new style should be used where possible + * because it avoids things like the d2i IMPLICIT + * hack. + * + * MSTRING is a multiple string type, it is used + * for a CHOICE of character strings where the + * actual strings all occupy an ASN1_STRING + * structure. In this case the 'utype' field + * has a special meaning, it is used as a mask + * of acceptable types using the B_ASN1 constants. + * + * NDEF_SEQUENCE is the same as SEQUENCE except + * that it will use indefinite length constructed + * encoding if requested. + * + */ + +#define ASN1_ITYPE_PRIMITIVE 0x0 + +#define ASN1_ITYPE_SEQUENCE 0x1 + +#define ASN1_ITYPE_CHOICE 0x2 + +#define ASN1_ITYPE_EXTERN 0x4 + +#define ASN1_ITYPE_MSTRING 0x5 + +#define ASN1_ITYPE_NDEF_SEQUENCE 0x6 + +/* Cache for ASN1 tag and length, so we + * don't keep re-reading it for things + * like CHOICE + */ + +struct ASN1_TLC_st { + char valid; /* Values below are valid */ + int ret; /* return value */ + long plen; /* length */ + int ptag; /* class value */ + int pclass; /* class value */ + int hdrlen; /* header length */ +}; + +/* Typedefs for ASN1 function pointers */ + +typedef ASN1_VALUE * ASN1_new_func(void); +typedef void ASN1_free_func(ASN1_VALUE *a); +typedef ASN1_VALUE * ASN1_d2i_func(ASN1_VALUE **a, const unsigned char ** in, long length); +typedef int ASN1_i2d_func(ASN1_VALUE * a, unsigned char **in); + +typedef int ASN1_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len, const ASN1_ITEM *it, + int tag, int aclass, char opt, ASN1_TLC *ctx); + +typedef int ASN1_ex_i2d(ASN1_VALUE **pval, unsigned char **out, const ASN1_ITEM *it, int tag, int aclass); +typedef int ASN1_ex_new_func(ASN1_VALUE **pval, const ASN1_ITEM *it); +typedef void ASN1_ex_free_func(ASN1_VALUE **pval, const ASN1_ITEM *it); + +typedef int ASN1_ex_print_func(BIO *out, ASN1_VALUE **pval, + int indent, const char *fname, + const ASN1_PCTX *pctx); + +typedef int ASN1_primitive_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype, const ASN1_ITEM *it); +typedef int ASN1_primitive_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it); +typedef int ASN1_primitive_print(BIO *out, ASN1_VALUE **pval, const ASN1_ITEM *it, int indent, const ASN1_PCTX *pctx); + +typedef struct ASN1_EXTERN_FUNCS_st { + void *app_data; + ASN1_ex_new_func *asn1_ex_new; + ASN1_ex_free_func *asn1_ex_free; + ASN1_ex_free_func *asn1_ex_clear; + ASN1_ex_d2i *asn1_ex_d2i; + ASN1_ex_i2d *asn1_ex_i2d; + ASN1_ex_print_func *asn1_ex_print; +} ASN1_EXTERN_FUNCS; + +typedef struct ASN1_PRIMITIVE_FUNCS_st { + void *app_data; + unsigned long flags; + ASN1_ex_new_func *prim_new; + ASN1_ex_free_func *prim_free; + ASN1_ex_free_func *prim_clear; + ASN1_primitive_c2i *prim_c2i; + ASN1_primitive_i2c *prim_i2c; + ASN1_primitive_print *prim_print; +} ASN1_PRIMITIVE_FUNCS; + +/* This is the ASN1_AUX structure: it handles various + * miscellaneous requirements. For example the use of + * reference counts and an informational callback. + * + * The "informational callback" is called at various + * points during the ASN1 encoding and decoding. It can + * be used to provide minor customisation of the structures + * used. This is most useful where the supplied routines + * *almost* do the right thing but need some extra help + * at a few points. If the callback returns zero then + * it is assumed a fatal error has occurred and the + * main operation should be abandoned. + * + * If major changes in the default behaviour are required + * then an external type is more appropriate. + */ + +typedef int ASN1_aux_cb(int operation, ASN1_VALUE **in, const ASN1_ITEM *it, + void *exarg); + +typedef struct ASN1_AUX_st { + void *app_data; + int flags; + int ref_offset; /* Offset of reference value */ + int ref_lock; /* Lock type to use */ + ASN1_aux_cb *asn1_cb; + int enc_offset; /* Offset of ASN1_ENCODING structure */ +} ASN1_AUX; + +/* For print related callbacks exarg points to this structure */ +typedef struct ASN1_PRINT_ARG_st { + BIO *out; + int indent; + const ASN1_PCTX *pctx; +} ASN1_PRINT_ARG; + +/* For streaming related callbacks exarg points to this structure */ +typedef struct ASN1_STREAM_ARG_st { + /* BIO to stream through */ + BIO *out; + /* BIO with filters appended */ + BIO *ndef_bio; + /* Streaming I/O boundary */ + unsigned char **boundary; +} ASN1_STREAM_ARG; + +/* Flags in ASN1_AUX */ + +/* Use a reference count */ +#define ASN1_AFLG_REFCOUNT 1 +/* Save the encoding of structure (useful for signatures) */ +#define ASN1_AFLG_ENCODING 2 + +/* operation values for asn1_cb */ + +#define ASN1_OP_NEW_PRE 0 +#define ASN1_OP_NEW_POST 1 +#define ASN1_OP_FREE_PRE 2 +#define ASN1_OP_FREE_POST 3 +#define ASN1_OP_D2I_PRE 4 +#define ASN1_OP_D2I_POST 5 +#define ASN1_OP_I2D_PRE 6 +#define ASN1_OP_I2D_POST 7 +#define ASN1_OP_PRINT_PRE 8 +#define ASN1_OP_PRINT_POST 9 +#define ASN1_OP_STREAM_PRE 10 +#define ASN1_OP_STREAM_POST 11 +#define ASN1_OP_DETACHED_PRE 12 +#define ASN1_OP_DETACHED_POST 13 + +#ifndef LIBRESSL_INTERNAL + +/* Macro to implement a primitive type */ +#define IMPLEMENT_ASN1_TYPE(stname) IMPLEMENT_ASN1_TYPE_ex(stname, stname, 0) +#define IMPLEMENT_ASN1_TYPE_ex(itname, vname, ex) \ + ASN1_ITEM_start(itname) \ + ASN1_ITYPE_PRIMITIVE, V_##vname, NULL, 0, NULL, ex, #itname \ + ASN1_ITEM_end(itname) + +/* Macro to implement a multi string type */ +#define IMPLEMENT_ASN1_MSTRING(itname, mask) \ + ASN1_ITEM_start(itname) \ + ASN1_ITYPE_MSTRING, mask, NULL, 0, NULL, sizeof(ASN1_STRING), #itname \ + ASN1_ITEM_end(itname) +#define IMPLEMENT_EXTERN_ASN1(sname, tag, fptrs) \ + ASN1_ITEM_start(sname) \ + ASN1_ITYPE_EXTERN, \ + tag, \ + NULL, \ + 0, \ + &fptrs, \ + 0, \ + #sname \ + ASN1_ITEM_end(sname) + +/* Macro to implement standard functions in terms of ASN1_ITEM structures */ + +#define IMPLEMENT_ASN1_FUNCTIONS(stname) IMPLEMENT_ASN1_FUNCTIONS_fname(stname, stname, stname) + +#define IMPLEMENT_ASN1_FUNCTIONS_name(stname, itname) IMPLEMENT_ASN1_FUNCTIONS_fname(stname, itname, itname) + +#define IMPLEMENT_ASN1_FUNCTIONS_ENCODE_name(stname, itname) \ + IMPLEMENT_ASN1_FUNCTIONS_ENCODE_fname(stname, itname, itname) + +#define IMPLEMENT_STATIC_ASN1_ALLOC_FUNCTIONS(stname) \ + IMPLEMENT_ASN1_ALLOC_FUNCTIONS_pfname(static, stname, stname, stname) + +#define IMPLEMENT_ASN1_ALLOC_FUNCTIONS(stname) \ + IMPLEMENT_ASN1_ALLOC_FUNCTIONS_fname(stname, stname, stname) + +#define IMPLEMENT_ASN1_ALLOC_FUNCTIONS_pfname(pre, stname, itname, fname) \ + pre stname *fname##_new(void) \ + { \ + return (stname *)ASN1_item_new(ASN1_ITEM_rptr(itname)); \ + } \ + pre void fname##_free(stname *a) \ + { \ + ASN1_item_free((ASN1_VALUE *)a, ASN1_ITEM_rptr(itname)); \ + } + +#define IMPLEMENT_ASN1_ALLOC_FUNCTIONS_fname(stname, itname, fname) \ + stname *fname##_new(void) \ + { \ + return (stname *)ASN1_item_new(ASN1_ITEM_rptr(itname)); \ + } \ + void fname##_free(stname *a) \ + { \ + ASN1_item_free((ASN1_VALUE *)a, ASN1_ITEM_rptr(itname)); \ + } + +#define IMPLEMENT_ASN1_FUNCTIONS_fname(stname, itname, fname) \ + IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(stname, itname, fname) \ + IMPLEMENT_ASN1_ALLOC_FUNCTIONS_fname(stname, itname, fname) + +#define IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(stname, itname, fname) \ + stname *d2i_##fname(stname **a, const unsigned char **in, long len) \ + { \ + return (stname *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, ASN1_ITEM_rptr(itname));\ + } \ + int i2d_##fname(stname *a, unsigned char **out) \ + { \ + return ASN1_item_i2d((ASN1_VALUE *)a, out, ASN1_ITEM_rptr(itname));\ + } + +#define IMPLEMENT_ASN1_NDEF_FUNCTION(stname) \ + int i2d_##stname##_NDEF(stname *a, unsigned char **out) \ + { \ + return ASN1_item_ndef_i2d((ASN1_VALUE *)a, out, ASN1_ITEM_rptr(stname));\ + } + +/* This includes evil casts to remove const: they will go away when full + * ASN1 constification is done. + */ +#define IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(stname, itname, fname) \ + stname *d2i_##fname(stname **a, const unsigned char **in, long len) \ + { \ + return (stname *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, ASN1_ITEM_rptr(itname));\ + } \ + int i2d_##fname(const stname *a, unsigned char **out) \ + { \ + return ASN1_item_i2d((ASN1_VALUE *)a, out, ASN1_ITEM_rptr(itname));\ + } + +#define IMPLEMENT_ASN1_DUP_FUNCTION(stname) \ + stname * stname##_dup(stname *x) \ + { \ + return ASN1_item_dup(ASN1_ITEM_rptr(stname), x); \ + } + +#define IMPLEMENT_ASN1_PRINT_FUNCTION(stname) \ + IMPLEMENT_ASN1_PRINT_FUNCTION_fname(stname, stname, stname) + +#define IMPLEMENT_ASN1_PRINT_FUNCTION_fname(stname, itname, fname) \ + int fname##_print_ctx(BIO *out, stname *x, int indent, \ + const ASN1_PCTX *pctx) \ + { \ + return ASN1_item_print(out, (ASN1_VALUE *)x, indent, \ + ASN1_ITEM_rptr(itname), pctx); \ + } + +#define IMPLEMENT_ASN1_FUNCTIONS_const(name) \ + IMPLEMENT_ASN1_FUNCTIONS_const_fname(name, name, name) + +#define IMPLEMENT_ASN1_FUNCTIONS_const_fname(stname, itname, fname) \ + IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(stname, itname, fname) \ + IMPLEMENT_ASN1_ALLOC_FUNCTIONS_fname(stname, itname, fname) + +#endif /* !LIBRESSL_INTERNAL */ + +/* external definitions for primitive types */ + +extern const ASN1_ITEM ASN1_BOOLEAN_it; +extern const ASN1_ITEM ASN1_TBOOLEAN_it; +extern const ASN1_ITEM ASN1_FBOOLEAN_it; +extern const ASN1_ITEM ASN1_SEQUENCE_it; +extern const ASN1_ITEM BIGNUM_it; +extern const ASN1_ITEM LONG_it; +extern const ASN1_ITEM ZLONG_it; +extern const ASN1_ITEM CBIGNUM_it; + +DECLARE_STACK_OF(ASN1_VALUE) + +/* Functions used internally by the ASN1 code */ + +int ASN1_item_ex_new(ASN1_VALUE **pval, const ASN1_ITEM *it); +void ASN1_item_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it); +int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len, const ASN1_ITEM *it, + int tag, int aclass, char opt, ASN1_TLC *ctx); + +int ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out, const ASN1_ITEM *it, int tag, int aclass); + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/bio.h b/curl/include/openssl/bio.h new file mode 100644 index 0000000..8327ffc --- /dev/null +++ b/curl/include/openssl/bio.h @@ -0,0 +1,717 @@ +/* $OpenBSD: bio.h,v 1.64 2024/05/19 07:12:50 jsg Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_BIO_H +#define HEADER_BIO_H +#if !defined(HAVE_ATTRIBUTE__BOUNDED__) && !defined(__OpenBSD__) +#define __bounded__(x, y, z) +#endif +#include + +# include +#include + +#include + + +#ifdef __cplusplus +extern "C" { +#endif + +/* These are the 'types' of BIOs */ +#define BIO_TYPE_NONE 0 +#define BIO_TYPE_MEM (1|0x0400) +#define BIO_TYPE_FILE (2|0x0400) + +#define BIO_TYPE_FD (4|0x0400|0x0100) +#define BIO_TYPE_SOCKET (5|0x0400|0x0100) +#define BIO_TYPE_NULL (6|0x0400) +#define BIO_TYPE_SSL (7|0x0200) +#define BIO_TYPE_MD (8|0x0200) /* passive filter */ +#define BIO_TYPE_BUFFER (9|0x0200) /* filter */ +#define BIO_TYPE_CIPHER (10|0x0200) /* filter */ +#define BIO_TYPE_BASE64 (11|0x0200) /* filter */ +#define BIO_TYPE_CONNECT (12|0x0400|0x0100) /* socket - connect */ +#define BIO_TYPE_ACCEPT (13|0x0400|0x0100) /* socket for accept */ +#define BIO_TYPE_PROXY_CLIENT (14|0x0200) /* client proxy BIO */ +#define BIO_TYPE_PROXY_SERVER (15|0x0200) /* server proxy BIO */ +#define BIO_TYPE_NBIO_TEST (16|0x0200) /* server proxy BIO */ +#define BIO_TYPE_NULL_FILTER (17|0x0200) +#define BIO_TYPE_BER (18|0x0200) /* BER -> bin filter */ +#define BIO_TYPE_BIO (19|0x0400) /* (half a) BIO pair */ +#define BIO_TYPE_LINEBUFFER (20|0x0200) /* filter */ +#define BIO_TYPE_DGRAM (21|0x0400|0x0100) +#define BIO_TYPE_ASN1 (22|0x0200) /* filter */ +#define BIO_TYPE_COMP (23|0x0200) /* filter */ + +#define BIO_TYPE_DESCRIPTOR 0x0100 /* socket, fd, connect or accept */ +#define BIO_TYPE_FILTER 0x0200 +#define BIO_TYPE_SOURCE_SINK 0x0400 + +/* + * BIO_TYPE_START is the first user-allocated BIO type. No pre-defined type, + * flag bits aside, may exceed this value. + */ +#define BIO_TYPE_START 128 + +/* BIO_FILENAME_READ|BIO_CLOSE to open or close on free. + * BIO_set_fp(in,stdin,BIO_NOCLOSE); */ +#define BIO_NOCLOSE 0x00 +#define BIO_CLOSE 0x01 + +/* These are used in the following macros and are passed to + * BIO_ctrl() */ +#define BIO_CTRL_RESET 1 /* opt - rewind/zero etc */ +#define BIO_CTRL_EOF 2 /* opt - are we at the eof */ +#define BIO_CTRL_INFO 3 /* opt - extra tit-bits */ +#define BIO_CTRL_SET 4 /* man - set the 'IO' type */ +#define BIO_CTRL_GET 5 /* man - get the 'IO' type */ +#define BIO_CTRL_PUSH 6 /* opt - internal, used to signify change */ +#define BIO_CTRL_POP 7 /* opt - internal, used to signify change */ +#define BIO_CTRL_GET_CLOSE 8 /* man - set the 'close' on free */ +#define BIO_CTRL_SET_CLOSE 9 /* man - set the 'close' on free */ +#define BIO_CTRL_PENDING 10 /* opt - is their more data buffered */ +#define BIO_CTRL_FLUSH 11 /* opt - 'flush' buffered output */ +#define BIO_CTRL_DUP 12 /* man - extra stuff for 'duped' BIO */ +#define BIO_CTRL_WPENDING 13 /* opt - number of bytes still to write */ +/* callback is int cb(BIO *bio,state,ret); */ +#define BIO_CTRL_SET_CALLBACK 14 /* opt - set callback function */ +#define BIO_CTRL_GET_CALLBACK 15 /* opt - set callback function */ + +#define BIO_CTRL_SET_FILENAME 30 /* BIO_s_file special */ + +/* dgram BIO stuff */ +#define BIO_CTRL_DGRAM_CONNECT 31 /* BIO dgram special */ +#define BIO_CTRL_DGRAM_SET_CONNECTED 32 /* allow for an externally + * connected socket to be + * passed in */ +#define BIO_CTRL_DGRAM_SET_RECV_TIMEOUT 33 /* setsockopt, essentially */ +#define BIO_CTRL_DGRAM_GET_RECV_TIMEOUT 34 /* getsockopt, essentially */ +#define BIO_CTRL_DGRAM_SET_SEND_TIMEOUT 35 /* setsockopt, essentially */ +#define BIO_CTRL_DGRAM_GET_SEND_TIMEOUT 36 /* getsockopt, essentially */ + +#define BIO_CTRL_DGRAM_GET_RECV_TIMER_EXP 37 /* flag whether the last */ +#define BIO_CTRL_DGRAM_GET_SEND_TIMER_EXP 38 /* I/O operation tiemd out */ + +/* #ifdef IP_MTU_DISCOVER */ +#define BIO_CTRL_DGRAM_MTU_DISCOVER 39 /* set DF bit on egress packets */ +/* #endif */ + +#define BIO_CTRL_DGRAM_QUERY_MTU 40 /* as kernel for current MTU */ +#define BIO_CTRL_DGRAM_GET_FALLBACK_MTU 47 +#define BIO_CTRL_DGRAM_GET_MTU 41 /* get cached value for MTU */ +#define BIO_CTRL_DGRAM_SET_MTU 42 /* set cached value for + * MTU. want to use this + * if asking the kernel + * fails */ + +#define BIO_CTRL_DGRAM_MTU_EXCEEDED 43 /* check whether the MTU + * was exceed in the + * previous write + * operation */ + +#define BIO_CTRL_DGRAM_GET_PEER 46 +#define BIO_CTRL_DGRAM_SET_PEER 44 /* Destination for the data */ + +#define BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT 45 /* Next DTLS handshake timeout to + * adjust socket timeouts */ + + +/* modifiers */ +#define BIO_FP_READ 0x02 +#define BIO_FP_WRITE 0x04 +#define BIO_FP_APPEND 0x08 +#define BIO_FP_TEXT 0x10 + +#define BIO_FLAGS_READ 0x01 +#define BIO_FLAGS_WRITE 0x02 +#define BIO_FLAGS_IO_SPECIAL 0x04 +#define BIO_FLAGS_RWS (BIO_FLAGS_READ|BIO_FLAGS_WRITE|BIO_FLAGS_IO_SPECIAL) +#define BIO_FLAGS_SHOULD_RETRY 0x08 + +/* Used in BIO_gethostbyname() */ +#define BIO_GHBN_CTRL_HITS 1 +#define BIO_GHBN_CTRL_MISSES 2 +#define BIO_GHBN_CTRL_CACHE_SIZE 3 +#define BIO_GHBN_CTRL_GET_ENTRY 4 +#define BIO_GHBN_CTRL_FLUSH 5 + +/* Mostly used in the SSL BIO */ +/* Not used anymore + * #define BIO_FLAGS_PROTOCOL_DELAYED_READ 0x10 + * #define BIO_FLAGS_PROTOCOL_DELAYED_WRITE 0x20 + * #define BIO_FLAGS_PROTOCOL_STARTUP 0x40 + */ + +#define BIO_FLAGS_BASE64_NO_NL 0x100 + +/* This is used with memory BIOs: it means we shouldn't free up or change the + * data in any way. + */ +#define BIO_FLAGS_MEM_RDONLY 0x200 + +void BIO_set_flags(BIO *b, int flags); +int BIO_test_flags(const BIO *b, int flags); +void BIO_clear_flags(BIO *b, int flags); + +#define BIO_get_flags(b) BIO_test_flags(b, ~(0x0)) +#define BIO_set_retry_special(b) \ + BIO_set_flags(b, (BIO_FLAGS_IO_SPECIAL|BIO_FLAGS_SHOULD_RETRY)) +#define BIO_set_retry_read(b) \ + BIO_set_flags(b, (BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY)) +#define BIO_set_retry_write(b) \ + BIO_set_flags(b, (BIO_FLAGS_WRITE|BIO_FLAGS_SHOULD_RETRY)) + +/* These are normally used internally in BIOs */ +#define BIO_clear_retry_flags(b) \ + BIO_clear_flags(b, (BIO_FLAGS_RWS|BIO_FLAGS_SHOULD_RETRY)) +#define BIO_get_retry_flags(b) \ + BIO_test_flags(b, (BIO_FLAGS_RWS|BIO_FLAGS_SHOULD_RETRY)) + +/* These should be used by the application to tell why we should retry */ +#define BIO_should_read(a) BIO_test_flags(a, BIO_FLAGS_READ) +#define BIO_should_write(a) BIO_test_flags(a, BIO_FLAGS_WRITE) +#define BIO_should_io_special(a) BIO_test_flags(a, BIO_FLAGS_IO_SPECIAL) +#define BIO_retry_type(a) BIO_test_flags(a, BIO_FLAGS_RWS) +#define BIO_should_retry(a) BIO_test_flags(a, BIO_FLAGS_SHOULD_RETRY) + +/* The next three are used in conjunction with the + * BIO_should_io_special() condition. After this returns true, + * BIO *BIO_get_retry_BIO(BIO *bio, int *reason); will walk the BIO + * stack and return the 'reason' for the special and the offending BIO. + * Given a BIO, BIO_get_retry_reason(bio) will return the code. */ +/* Returned from the SSL bio when the certificate retrieval code had an error */ +#define BIO_RR_SSL_X509_LOOKUP 0x01 +/* Returned from the connect BIO when a connect would have blocked */ +#define BIO_RR_CONNECT 0x02 +/* Returned from the accept BIO when an accept would have blocked */ +#define BIO_RR_ACCEPT 0x03 + +/* These are passed by the BIO callback */ +#define BIO_CB_FREE 0x01 +#define BIO_CB_READ 0x02 +#define BIO_CB_WRITE 0x03 +#define BIO_CB_PUTS 0x04 +#define BIO_CB_GETS 0x05 +#define BIO_CB_CTRL 0x06 + +/* + * The callback is called before and after the underling operation, + * the BIO_CB_RETURN flag indicates if it is after the call. + */ +#define BIO_CB_RETURN 0x80 +#define BIO_CB_return(a) ((a)|BIO_CB_RETURN)) +#define BIO_cb_pre(a) (!((a)&BIO_CB_RETURN)) +#define BIO_cb_post(a) ((a)&BIO_CB_RETURN) + +typedef long (*BIO_callback_fn)(BIO *b, int oper, const char *argp, int argi, + long argl, long ret); +typedef long (*BIO_callback_fn_ex)(BIO *b, int oper, const char *argp, + size_t len, int argi, long argl, int ret, size_t *processed); + +BIO_callback_fn BIO_get_callback(const BIO *b); +void BIO_set_callback(BIO *b, BIO_callback_fn callback); + +BIO_callback_fn_ex BIO_get_callback_ex(const BIO *b); +void BIO_set_callback_ex(BIO *b, BIO_callback_fn_ex callback); + +char *BIO_get_callback_arg(const BIO *b); +void BIO_set_callback_arg(BIO *b, char *arg); + +const char *BIO_method_name(const BIO *b); +int BIO_method_type(const BIO *b); + +typedef int BIO_info_cb(BIO *, int, int); +/* Compatibility with OpenSSL's backward compatibility. */ +typedef BIO_info_cb bio_info_cb; + +typedef struct bio_method_st BIO_METHOD; + +DECLARE_STACK_OF(BIO) + +/* Prefix and suffix callback in ASN1 BIO */ +typedef int asn1_ps_func(BIO *b, unsigned char **pbuf, int *plen, void *parg); + +/* BIO_METHOD accessors */ +BIO_METHOD *BIO_meth_new(int type, const char *name); +void BIO_meth_free(BIO_METHOD *biom); +int (*BIO_meth_get_write(const BIO_METHOD *biom))(BIO *, const char *, int); +int BIO_meth_set_write(BIO_METHOD *biom, + int (*write)(BIO *, const char *, int)); +int (*BIO_meth_get_read(const BIO_METHOD *biom))(BIO *, char *, int); +int BIO_meth_set_read(BIO_METHOD *biom, int (*read)(BIO *, char *, int)); +int (*BIO_meth_get_puts(const BIO_METHOD *biom))(BIO *, const char *); +int BIO_meth_set_puts(BIO_METHOD *biom, int (*puts)(BIO *, const char *)); +int (*BIO_meth_get_gets(const BIO_METHOD *biom))(BIO *, char *, int); +int BIO_meth_set_gets(BIO_METHOD *biom, int (*gets)(BIO *, char *, int)); +long (*BIO_meth_get_ctrl(const BIO_METHOD *biom))(BIO *, int, long, void *); +int BIO_meth_set_ctrl(BIO_METHOD *biom, long (*ctrl)(BIO *, int, long, void *)); +int (*BIO_meth_get_create(const BIO_METHOD *biom))(BIO *); +int BIO_meth_set_create(BIO_METHOD *biom, int (*create)(BIO *)); +int (*BIO_meth_get_destroy(const BIO_METHOD *biom))(BIO *); +int BIO_meth_set_destroy(BIO_METHOD *biom, int (*destroy)(BIO *)); +long (*BIO_meth_get_callback_ctrl(const BIO_METHOD *biom))(BIO *, int, BIO_info_cb *); +int BIO_meth_set_callback_ctrl(BIO_METHOD *biom, + long (*callback_ctrl)(BIO *, int, BIO_info_cb *)); + +/* connect BIO stuff */ +#define BIO_CONN_S_BEFORE 1 +#define BIO_CONN_S_GET_IP 2 +#define BIO_CONN_S_GET_PORT 3 +#define BIO_CONN_S_CREATE_SOCKET 4 +#define BIO_CONN_S_CONNECT 5 +#define BIO_CONN_S_OK 6 +#define BIO_CONN_S_BLOCKED_CONNECT 7 +#define BIO_CONN_S_NBIO 8 +/*#define BIO_CONN_get_param_hostname BIO_ctrl */ + +#define BIO_C_SET_CONNECT 100 +#define BIO_C_DO_STATE_MACHINE 101 +#define BIO_C_SET_NBIO 102 +#define BIO_C_SET_PROXY_PARAM 103 +#define BIO_C_SET_FD 104 +#define BIO_C_GET_FD 105 +#define BIO_C_SET_FILE_PTR 106 +#define BIO_C_GET_FILE_PTR 107 +#define BIO_C_SET_FILENAME 108 +#define BIO_C_SET_SSL 109 +#define BIO_C_GET_SSL 110 +#define BIO_C_SET_MD 111 +#define BIO_C_GET_MD 112 +#define BIO_C_GET_CIPHER_STATUS 113 +#define BIO_C_SET_BUF_MEM 114 +#define BIO_C_GET_BUF_MEM_PTR 115 +#define BIO_C_GET_BUFF_NUM_LINES 116 +#define BIO_C_SET_BUFF_SIZE 117 +#define BIO_C_SET_ACCEPT 118 +#define BIO_C_SSL_MODE 119 +#define BIO_C_GET_MD_CTX 120 +#define BIO_C_GET_PROXY_PARAM 121 +#define BIO_C_SET_BUFF_READ_DATA 122 /* data to read first */ +#define BIO_C_GET_CONNECT 123 +#define BIO_C_GET_ACCEPT 124 +#define BIO_C_SET_SSL_RENEGOTIATE_BYTES 125 +#define BIO_C_GET_SSL_NUM_RENEGOTIATES 126 +#define BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT 127 +#define BIO_C_FILE_SEEK 128 +#define BIO_C_GET_CIPHER_CTX 129 +#define BIO_C_SET_BUF_MEM_EOF_RETURN 130/*return end of input value*/ +#define BIO_C_SET_BIND_MODE 131 +#define BIO_C_GET_BIND_MODE 132 +#define BIO_C_FILE_TELL 133 +#define BIO_C_GET_SOCKS 134 +#define BIO_C_SET_SOCKS 135 + +#define BIO_C_SET_WRITE_BUF_SIZE 136/* for BIO_s_bio */ +#define BIO_C_GET_WRITE_BUF_SIZE 137 +#define BIO_C_MAKE_BIO_PAIR 138 +#define BIO_C_DESTROY_BIO_PAIR 139 +#define BIO_C_GET_WRITE_GUARANTEE 140 +#define BIO_C_GET_READ_REQUEST 141 +#define BIO_C_SHUTDOWN_WR 142 +#define BIO_C_RESET_READ_REQUEST 147 +#define BIO_C_SET_MD_CTX 148 + +#define BIO_C_SET_EX_ARG 153 +#define BIO_C_GET_EX_ARG 154 + +#define BIO_set_app_data(s,arg) BIO_set_ex_data(s,0,arg) +#define BIO_get_app_data(s) BIO_get_ex_data(s,0) + +/* BIO_s_connect() and BIO_s_socks4a_connect() */ +#define BIO_set_conn_hostname(b,name) BIO_ctrl(b,BIO_C_SET_CONNECT,0,(char *)name) +#define BIO_set_conn_port(b,port) BIO_ctrl(b,BIO_C_SET_CONNECT,1,(char *)port) +#define BIO_set_conn_ip(b,ip) BIO_ctrl(b,BIO_C_SET_CONNECT,2,(char *)ip) +#define BIO_set_conn_int_port(b,port) BIO_ctrl(b,BIO_C_SET_CONNECT,3,(char *)port) +#define BIO_get_conn_hostname(b) BIO_ptr_ctrl(b,BIO_C_GET_CONNECT,0) +#define BIO_get_conn_port(b) BIO_ptr_ctrl(b,BIO_C_GET_CONNECT,1) +#define BIO_get_conn_ip(b) BIO_ptr_ctrl(b,BIO_C_GET_CONNECT,2) +#define BIO_get_conn_int_port(b) BIO_int_ctrl(b,BIO_C_GET_CONNECT,3,0) + + +#define BIO_set_nbio(b,n) BIO_ctrl(b,BIO_C_SET_NBIO,(n),NULL) + +/* BIO_s_accept_socket() */ +#define BIO_set_accept_port(b,name) BIO_ctrl(b,BIO_C_SET_ACCEPT,0,(char *)name) +#define BIO_get_accept_port(b) BIO_ptr_ctrl(b,BIO_C_GET_ACCEPT,0) +/* #define BIO_set_nbio(b,n) BIO_ctrl(b,BIO_C_SET_NBIO,(n),NULL) */ +#define BIO_set_nbio_accept(b,n) BIO_ctrl(b,BIO_C_SET_ACCEPT,1,(n)?(void *)"a":NULL) +#define BIO_set_accept_bios(b,bio) BIO_ctrl(b,BIO_C_SET_ACCEPT,2,(char *)bio) + +#define BIO_BIND_NORMAL 0 +#define BIO_BIND_REUSEADDR_IF_UNUSED 1 +#define BIO_BIND_REUSEADDR 2 +#define BIO_set_bind_mode(b,mode) BIO_ctrl(b,BIO_C_SET_BIND_MODE,mode,NULL) +#define BIO_get_bind_mode(b,mode) BIO_ctrl(b,BIO_C_GET_BIND_MODE,0,NULL) + +#define BIO_do_connect(b) BIO_do_handshake(b) +#define BIO_do_accept(b) BIO_do_handshake(b) +#define BIO_do_handshake(b) BIO_ctrl(b,BIO_C_DO_STATE_MACHINE,0,NULL) + +/* BIO_s_proxy_client() */ +#define BIO_set_url(b,url) BIO_ctrl(b,BIO_C_SET_PROXY_PARAM,0,(char *)(url)) +#define BIO_set_proxies(b,p) BIO_ctrl(b,BIO_C_SET_PROXY_PARAM,1,(char *)(p)) +/* BIO_set_nbio(b,n) */ +#define BIO_set_filter_bio(b,s) BIO_ctrl(b,BIO_C_SET_PROXY_PARAM,2,(char *)(s)) +/* BIO *BIO_get_filter_bio(BIO *bio); */ +#define BIO_set_proxy_cb(b,cb) BIO_callback_ctrl(b,BIO_C_SET_PROXY_PARAM,3,(void *(*cb)())) +#define BIO_set_proxy_header(b,sk) BIO_ctrl(b,BIO_C_SET_PROXY_PARAM,4,(char *)sk) +#define BIO_set_no_connect_return(b,bool) BIO_int_ctrl(b,BIO_C_SET_PROXY_PARAM,5,bool) + +#define BIO_get_proxy_header(b,skp) BIO_ctrl(b,BIO_C_GET_PROXY_PARAM,0,(char *)skp) +#define BIO_get_proxies(b,pxy_p) BIO_ctrl(b,BIO_C_GET_PROXY_PARAM,1,(char *)(pxy_p)) +#define BIO_get_url(b,url) BIO_ctrl(b,BIO_C_GET_PROXY_PARAM,2,(char *)(url)) +#define BIO_get_no_connect_return(b) BIO_ctrl(b,BIO_C_GET_PROXY_PARAM,5,NULL) + +#define BIO_set_fd(b,fd,c) BIO_int_ctrl(b,BIO_C_SET_FD,c,fd) +#define BIO_get_fd(b,c) BIO_ctrl(b,BIO_C_GET_FD,0,(char *)c) + +#define BIO_set_fp(b,fp,c) BIO_ctrl(b,BIO_C_SET_FILE_PTR,c,(char *)fp) +#define BIO_get_fp(b,fpp) BIO_ctrl(b,BIO_C_GET_FILE_PTR,0,(char *)fpp) + +#define BIO_seek(b,ofs) (int)BIO_ctrl(b,BIO_C_FILE_SEEK,ofs,NULL) +#define BIO_tell(b) (int)BIO_ctrl(b,BIO_C_FILE_TELL,0,NULL) + +/* name is cast to lose const, but might be better to route through a function + so we can do it safely */ +#define BIO_read_filename(b,name) BIO_ctrl(b,BIO_C_SET_FILENAME, \ + BIO_CLOSE|BIO_FP_READ,(char *)name) +#define BIO_write_filename(b,name) BIO_ctrl(b,BIO_C_SET_FILENAME, \ + BIO_CLOSE|BIO_FP_WRITE,name) +#define BIO_append_filename(b,name) BIO_ctrl(b,BIO_C_SET_FILENAME, \ + BIO_CLOSE|BIO_FP_APPEND,name) +#define BIO_rw_filename(b,name) BIO_ctrl(b,BIO_C_SET_FILENAME, \ + BIO_CLOSE|BIO_FP_READ|BIO_FP_WRITE,name) + +/* WARNING WARNING, this ups the reference count on the read bio of the + * SSL structure. This is because the ssl read BIO is now pointed to by + * the next_bio field in the bio. So when you free the BIO, make sure + * you are doing a BIO_free_all() to catch the underlying BIO. */ +#define BIO_set_ssl(b,ssl,c) BIO_ctrl(b,BIO_C_SET_SSL,c,(char *)ssl) +#define BIO_get_ssl(b,sslp) BIO_ctrl(b,BIO_C_GET_SSL,0,(char *)sslp) +#define BIO_set_ssl_mode(b,client) BIO_ctrl(b,BIO_C_SSL_MODE,client,NULL) +#define BIO_set_ssl_renegotiate_bytes(b,num) \ + BIO_ctrl(b,BIO_C_SET_SSL_RENEGOTIATE_BYTES,num,NULL) +#define BIO_get_num_renegotiates(b) \ + BIO_ctrl(b,BIO_C_GET_SSL_NUM_RENEGOTIATES,0,NULL) +#define BIO_set_ssl_renegotiate_timeout(b,seconds) \ + BIO_ctrl(b,BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT,seconds,NULL) + +/* defined in evp.h */ +/* #define BIO_set_md(b,md) BIO_ctrl(b,BIO_C_SET_MD,1,(char *)md) */ + +#define BIO_get_mem_data(b,pp) BIO_ctrl(b,BIO_CTRL_INFO,0,(char *)pp) +#define BIO_set_mem_buf(b,bm,c) BIO_ctrl(b,BIO_C_SET_BUF_MEM,c,(char *)bm) +#define BIO_get_mem_ptr(b,pp) BIO_ctrl(b,BIO_C_GET_BUF_MEM_PTR,0,(char *)pp) +#define BIO_set_mem_eof_return(b,v) \ + BIO_ctrl(b,BIO_C_SET_BUF_MEM_EOF_RETURN,v,NULL) + +/* For the BIO_f_buffer() type */ +#define BIO_get_buffer_num_lines(b) BIO_ctrl(b,BIO_C_GET_BUFF_NUM_LINES,0,NULL) +#define BIO_set_buffer_size(b,size) BIO_ctrl(b,BIO_C_SET_BUFF_SIZE,size,NULL) +#define BIO_set_read_buffer_size(b,size) BIO_int_ctrl(b,BIO_C_SET_BUFF_SIZE,size,0) +#define BIO_set_write_buffer_size(b,size) BIO_int_ctrl(b,BIO_C_SET_BUFF_SIZE,size,1) +#define BIO_set_buffer_read_data(b,buf,num) BIO_ctrl(b,BIO_C_SET_BUFF_READ_DATA,num,buf) + +/* Don't use the next one unless you know what you are doing :-) */ +#define BIO_dup_state(b,ret) BIO_ctrl(b,BIO_CTRL_DUP,0,(char *)(ret)) + +#define BIO_reset(b) (int)BIO_ctrl(b,BIO_CTRL_RESET,0,NULL) +#define BIO_eof(b) (int)BIO_ctrl(b,BIO_CTRL_EOF,0,NULL) +#define BIO_set_close(b,c) (int)BIO_ctrl(b,BIO_CTRL_SET_CLOSE,(c),NULL) +#define BIO_get_close(b) (int)BIO_ctrl(b,BIO_CTRL_GET_CLOSE,0,NULL) +#define BIO_pending(b) (int)BIO_ctrl(b,BIO_CTRL_PENDING,0,NULL) +#define BIO_wpending(b) (int)BIO_ctrl(b,BIO_CTRL_WPENDING,0,NULL) +/* ...pending macros have inappropriate return type */ +size_t BIO_ctrl_pending(BIO *b); +size_t BIO_ctrl_wpending(BIO *b); +#define BIO_flush(b) (int)BIO_ctrl(b,BIO_CTRL_FLUSH,0,NULL) +#define BIO_get_info_callback(b,cbp) (int)BIO_ctrl(b,BIO_CTRL_GET_CALLBACK,0, \ + cbp) +#define BIO_set_info_callback(b,cb) (int)BIO_callback_ctrl(b,BIO_CTRL_SET_CALLBACK,cb) + +/* For the BIO_f_buffer() type */ +#define BIO_buffer_get_num_lines(b) BIO_ctrl(b,BIO_CTRL_GET,0,NULL) + +/* For BIO_s_bio() */ +#define BIO_set_write_buf_size(b,size) (int)BIO_ctrl(b,BIO_C_SET_WRITE_BUF_SIZE,size,NULL) +#define BIO_get_write_buf_size(b,size) (size_t)BIO_ctrl(b,BIO_C_GET_WRITE_BUF_SIZE,size,NULL) +#define BIO_make_bio_pair(b1,b2) (int)BIO_ctrl(b1,BIO_C_MAKE_BIO_PAIR,0,b2) +#define BIO_destroy_bio_pair(b) (int)BIO_ctrl(b,BIO_C_DESTROY_BIO_PAIR,0,NULL) +#define BIO_shutdown_wr(b) (int)BIO_ctrl(b, BIO_C_SHUTDOWN_WR, 0, NULL) +/* macros with inappropriate type -- but ...pending macros use int too: */ +#define BIO_get_write_guarantee(b) (int)BIO_ctrl(b,BIO_C_GET_WRITE_GUARANTEE,0,NULL) +#define BIO_get_read_request(b) (int)BIO_ctrl(b,BIO_C_GET_READ_REQUEST,0,NULL) +size_t BIO_ctrl_get_write_guarantee(BIO *b); +size_t BIO_ctrl_get_read_request(BIO *b); +int BIO_ctrl_reset_read_request(BIO *b); + +/* ctrl macros for dgram */ +#define BIO_ctrl_dgram_connect(b,peer) \ + (int)BIO_ctrl(b,BIO_CTRL_DGRAM_CONNECT,0, (char *)peer) +#define BIO_ctrl_set_connected(b, state, peer) \ + (int)BIO_ctrl(b, BIO_CTRL_DGRAM_SET_CONNECTED, state, (char *)peer) +#define BIO_dgram_recv_timedout(b) \ + (int)BIO_ctrl(b, BIO_CTRL_DGRAM_GET_RECV_TIMER_EXP, 0, NULL) +#define BIO_dgram_send_timedout(b) \ + (int)BIO_ctrl(b, BIO_CTRL_DGRAM_GET_SEND_TIMER_EXP, 0, NULL) +#define BIO_dgram_get_peer(b,peer) \ + (int)BIO_ctrl(b, BIO_CTRL_DGRAM_GET_PEER, 0, (char *)peer) +#define BIO_dgram_set_peer(b,peer) \ + (int)BIO_ctrl(b, BIO_CTRL_DGRAM_SET_PEER, 0, (char *)peer) + +/* These two aren't currently implemented */ +/* int BIO_get_ex_num(BIO *bio); */ +/* void BIO_set_ex_free_func(BIO *bio,int idx,void (*cb)()); */ +int BIO_set_ex_data(BIO *bio, int idx, void *data); +void *BIO_get_ex_data(BIO *bio, int idx); +int BIO_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, + CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); +unsigned long BIO_number_read(BIO *bio); +unsigned long BIO_number_written(BIO *bio); + +int BIO_get_new_index(void); +const BIO_METHOD *BIO_s_file(void); +BIO *BIO_new_file(const char *filename, const char *mode); +BIO *BIO_new_fp(FILE *stream, int close_flag); +BIO *BIO_new(const BIO_METHOD *type); +int BIO_free(BIO *a); +int BIO_up_ref(BIO *bio); +void *BIO_get_data(BIO *a); +void BIO_set_data(BIO *a, void *ptr); +int BIO_get_init(BIO *a); +void BIO_set_init(BIO *a, int init); +int BIO_get_shutdown(BIO *a); +void BIO_set_shutdown(BIO *a, int shut); +void BIO_vfree(BIO *a); +int BIO_read(BIO *b, void *data, int len) + __attribute__((__bounded__(__buffer__,2,3))); +int BIO_gets(BIO *bp, char *buf, int size) + __attribute__((__bounded__ (__string__,2,3))); +int BIO_write(BIO *b, const void *data, int len) + __attribute__((__bounded__(__buffer__,2,3))); +int BIO_puts(BIO *bp, const char *buf); +int BIO_indent(BIO *b, int indent, int max); +long BIO_ctrl(BIO *bp, int cmd, long larg, void *parg); +long BIO_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp); +char * BIO_ptr_ctrl(BIO *bp, int cmd, long larg); +long BIO_int_ctrl(BIO *bp, int cmd, long larg, int iarg); +BIO * BIO_push(BIO *b, BIO *append); +BIO * BIO_pop(BIO *b); +void BIO_free_all(BIO *a); +BIO * BIO_find_type(BIO *b, int bio_type); +BIO * BIO_next(BIO *b); +void BIO_set_next(BIO *b, BIO *next); +BIO * BIO_get_retry_BIO(BIO *bio, int *reason); +int BIO_get_retry_reason(BIO *bio); +void BIO_set_retry_reason(BIO *bio, int reason); +BIO * BIO_dup_chain(BIO *in); + +long BIO_debug_callback(BIO *bio, int cmd, const char *argp, int argi, + long argl, long ret); + +const BIO_METHOD *BIO_s_mem(void); +BIO *BIO_new_mem_buf(const void *buf, int len); +const BIO_METHOD *BIO_s_socket(void); +const BIO_METHOD *BIO_s_connect(void); +const BIO_METHOD *BIO_s_accept(void); +const BIO_METHOD *BIO_s_fd(void); +const BIO_METHOD *BIO_s_log(void); +const BIO_METHOD *BIO_s_bio(void); +const BIO_METHOD *BIO_s_null(void); +const BIO_METHOD *BIO_f_null(void); +const BIO_METHOD *BIO_f_buffer(void); +const BIO_METHOD *BIO_f_nbio_test(void); +#ifndef OPENSSL_NO_DGRAM +const BIO_METHOD *BIO_s_datagram(void); +#endif + +/* BIO_METHOD *BIO_f_ber(void); */ + +int BIO_sock_should_retry(int i); +int BIO_sock_non_fatal_error(int _error); +int BIO_dgram_non_fatal_error(int _error); + +int BIO_fd_should_retry(int i); +int BIO_fd_non_fatal_error(int _error); + +int BIO_dump(BIO *b, const char *bytes, int len); +int BIO_dump_indent(BIO *b, const char *bytes, int len, int indent); + +struct hostent *BIO_gethostbyname(const char *name); +/* We might want a thread-safe interface too: + * struct hostent *BIO_gethostbyname_r(const char *name, + * struct hostent *result, void *buffer, size_t buflen); + * or something similar (caller allocates a struct hostent, + * pointed to by "result", and additional buffer space for the various + * substructures; if the buffer does not suffice, NULL is returned + * and an appropriate error code is set). + */ +int BIO_sock_error(int sock); +int BIO_socket_ioctl(int fd, long type, void *arg); +int BIO_socket_nbio(int fd, int mode); +int BIO_get_port(const char *str, unsigned short *port_ptr); +int BIO_get_host_ip(const char *str, unsigned char *ip); +int BIO_get_accept_socket(char *host_port, int mode); +int BIO_accept(int sock, char **ip_port); +int BIO_sock_init(void ); +void BIO_sock_cleanup(void); +int BIO_set_tcp_ndelay(int sock, int turn_on); + +BIO *BIO_new_socket(int sock, int close_flag); +BIO *BIO_new_dgram(int fd, int close_flag); +BIO *BIO_new_fd(int fd, int close_flag); +BIO *BIO_new_connect(const char *host_port); +BIO *BIO_new_accept(const char *host_port); + +int BIO_new_bio_pair(BIO **bio1, size_t writebuf1, + BIO **bio2, size_t writebuf2); +/* If successful, returns 1 and in *bio1, *bio2 two BIO pair endpoints. + * Otherwise returns 0 and sets *bio1 and *bio2 to NULL. + * Size 0 uses default value. + */ + +void BIO_copy_next_retry(BIO *b); + +/*long BIO_ghbn_ctrl(int cmd,int iarg,char *parg);*/ + +/* Needed for libressl-portable. */ +#ifndef __MINGW_PRINTF_FORMAT +int BIO_printf(BIO *bio, const char *format, ...) + __attribute__((__format__(__printf__, 2, 3), __nonnull__(2))); +#else +int BIO_printf(BIO *bio, const char *format, ...) + __attribute__((__format__(__MINGW_PRINTF_FORMAT, 2, 3), __nonnull__(2))); +#endif + +void ERR_load_BIO_strings(void); + +/* Error codes for the BIO functions. */ + +/* Function codes. */ +#define BIO_F_ACPT_STATE 100 +#define BIO_F_BIO_ACCEPT 101 +#define BIO_F_BIO_BER_GET_HEADER 102 +#define BIO_F_BIO_CALLBACK_CTRL 131 +#define BIO_F_BIO_CTRL 103 +#define BIO_F_BIO_GETHOSTBYNAME 120 +#define BIO_F_BIO_GETS 104 +#define BIO_F_BIO_GET_ACCEPT_SOCKET 105 +#define BIO_F_BIO_GET_HOST_IP 106 +#define BIO_F_BIO_GET_PORT 107 +#define BIO_F_BIO_MAKE_PAIR 121 +#define BIO_F_BIO_NEW 108 +#define BIO_F_BIO_NEW_FILE 109 +#define BIO_F_BIO_NEW_MEM_BUF 126 +#define BIO_F_BIO_NREAD 123 +#define BIO_F_BIO_NREAD0 124 +#define BIO_F_BIO_NWRITE 125 +#define BIO_F_BIO_NWRITE0 122 +#define BIO_F_BIO_PUTS 110 +#define BIO_F_BIO_READ 111 +#define BIO_F_BIO_SOCK_INIT 112 +#define BIO_F_BIO_WRITE 113 +#define BIO_F_BUFFER_CTRL 114 +#define BIO_F_CONN_CTRL 127 +#define BIO_F_CONN_STATE 115 +#define BIO_F_DGRAM_SCTP_READ 132 +#define BIO_F_FILE_CTRL 116 +#define BIO_F_FILE_READ 130 +#define BIO_F_LINEBUFFER_CTRL 129 +#define BIO_F_MEM_READ 128 +#define BIO_F_MEM_WRITE 117 +#define BIO_F_SSL_NEW 118 +#define BIO_F_WSASTARTUP 119 + +/* Reason codes. */ +#define BIO_R_ACCEPT_ERROR 100 +#define BIO_R_BAD_FOPEN_MODE 101 +#define BIO_R_BAD_HOSTNAME_LOOKUP 102 +#define BIO_R_BROKEN_PIPE 124 +#define BIO_R_CONNECT_ERROR 103 +#define BIO_R_EOF_ON_MEMORY_BIO 127 +#define BIO_R_ERROR_SETTING_NBIO 104 +#define BIO_R_ERROR_SETTING_NBIO_ON_ACCEPTED_SOCKET 105 +#define BIO_R_ERROR_SETTING_NBIO_ON_ACCEPT_SOCKET 106 +#define BIO_R_GETHOSTBYNAME_ADDR_IS_NOT_AF_INET 107 +#define BIO_R_INVALID_ARGUMENT 125 +#define BIO_R_INVALID_IP_ADDRESS 108 +#define BIO_R_INVALID_PORT_NUMBER 129 +#define BIO_R_IN_USE 123 +#define BIO_R_KEEPALIVE 109 +#define BIO_R_LENGTH_TOO_LONG 130 +#define BIO_R_NBIO_CONNECT_ERROR 110 +#define BIO_R_NO_ACCEPT_PORT_SPECIFIED 111 +#define BIO_R_NO_HOSTNAME_SPECIFIED 112 +#define BIO_R_NO_PORT_DEFINED 113 +#define BIO_R_NO_PORT_SPECIFIED 114 +#define BIO_R_NO_SUCH_FILE 128 +#define BIO_R_NULL_PARAMETER 115 +#define BIO_R_TAG_MISMATCH 116 +#define BIO_R_UNABLE_TO_BIND_SOCKET 117 +#define BIO_R_UNABLE_TO_CREATE_SOCKET 118 +#define BIO_R_UNABLE_TO_LISTEN_SOCKET 119 +#define BIO_R_UNINITIALIZED 120 +#define BIO_R_UNSUPPORTED_METHOD 121 +#define BIO_R_WRITE_TO_READ_ONLY_BIO 126 +#define BIO_R_WSASTARTUP 122 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/blowfish.h b/curl/include/openssl/blowfish.h new file mode 100644 index 0000000..5ea99af --- /dev/null +++ b/curl/include/openssl/blowfish.h @@ -0,0 +1,106 @@ +/* $OpenBSD: blowfish.h,v 1.18 2025/01/25 17:59:44 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_BLOWFISH_H +#define HEADER_BLOWFISH_H + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define BF_ENCRYPT 1 +#define BF_DECRYPT 0 + +/* + * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + * ! BF_LONG has to be at least 32 bits wide. If it's wider, then ! + * ! BF_LONG_LOG2 has to be defined along. ! + * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + */ + +#define BF_LONG unsigned int + +#define BF_ROUNDS 16 +#define BF_BLOCK 8 + +typedef struct bf_key_st { + BF_LONG P[BF_ROUNDS + 2]; + BF_LONG S[4*256]; +} BF_KEY; + +void BF_set_key(BF_KEY *key, int len, const unsigned char *data); + +void BF_encrypt(BF_LONG *data, const BF_KEY *key); +void BF_decrypt(BF_LONG *data, const BF_KEY *key); + +void BF_ecb_encrypt(const unsigned char *in, unsigned char *out, + const BF_KEY *key, int enc); +void BF_cbc_encrypt(const unsigned char *in, unsigned char *out, long length, + const BF_KEY *schedule, unsigned char *ivec, int enc); +void BF_cfb64_encrypt(const unsigned char *in, unsigned char *out, long length, + const BF_KEY *schedule, unsigned char *ivec, int *num, int enc); +void BF_ofb64_encrypt(const unsigned char *in, unsigned char *out, long length, + const BF_KEY *schedule, unsigned char *ivec, int *num); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/bn.h b/curl/include/openssl/bn.h new file mode 100644 index 0000000..7c3c0b1 --- /dev/null +++ b/curl/include/openssl/bn.h @@ -0,0 +1,520 @@ +/* $OpenBSD: bn.h,v 1.80 2025/03/09 15:22:40 tb Exp $ */ +/* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ +/* ==================================================================== + * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ +/* ==================================================================== + * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. + * + * Portions of the attached software ("Contribution") are developed by + * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project. + * + * The Contribution is licensed pursuant to the Eric Young open source + * license provided above. + * + * The binary polynomial arithmetic software is originally written by + * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories. + * + */ + +#ifndef HEADER_BN_H +#define HEADER_BN_H + +#include +#include + +#include + +#include +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* This next option uses the C libraries (2 word)/(1 word) function. + * If it is not defined, I use my C version (which is slower). + * The reason for this flag is that when the particular C compiler + * library routine is used, and the library is linked with a different + * compiler, the library is missing. This mostly happens when the + * library is built with gcc and then linked using normal cc. This would + * be a common occurrence because gcc normally produces code that is + * 2 times faster than system compilers for the big number stuff. + * For machines with only one compiler (or shared libraries), this should + * be on. Again this in only really a problem on machines + * using "long long's", are 32bit, and are not using my assembler code. */ +/* #define BN_DIV2W */ + +#ifdef _LP64 +#undef BN_LLONG +#define BN_ULONG unsigned long +#define BN_LONG long +#define BN_BITS 128 +#define BN_BYTES 8 +#define BN_BITS2 64 +#define BN_BITS4 32 +#define BN_MASK2 (0xffffffffffffffffL) +#define BN_MASK2l (0xffffffffL) +#define BN_MASK2h (0xffffffff00000000L) +#define BN_MASK2h1 (0xffffffff80000000L) +#define BN_TBIT (0x8000000000000000L) +#define BN_DEC_CONV (10000000000000000000UL) +#define BN_DEC_FMT1 "%lu" +#define BN_DEC_FMT2 "%019lu" +#define BN_DEC_NUM 19 +#define BN_HEX_FMT1 "%lX" +#define BN_HEX_FMT2 "%016lX" +#else +#define BN_ULLONG unsigned long long +#define BN_LLONG +#define BN_ULONG unsigned int +#define BN_LONG int +#define BN_BITS 64 +#define BN_BYTES 4 +#define BN_BITS2 32 +#define BN_BITS4 16 +#define BN_MASK (0xffffffffffffffffLL) +#define BN_MASK2 (0xffffffffL) +#define BN_MASK2l (0xffff) +#define BN_MASK2h1 (0xffff8000L) +#define BN_MASK2h (0xffff0000L) +#define BN_TBIT (0x80000000L) +#define BN_DEC_CONV (1000000000L) +#define BN_DEC_FMT1 "%u" +#define BN_DEC_FMT2 "%09u" +#define BN_DEC_NUM 9 +#define BN_HEX_FMT1 "%X" +#define BN_HEX_FMT2 "%08X" +#endif + +#define BN_FLG_MALLOCED 0x01 +#define BN_FLG_STATIC_DATA 0x02 +#define BN_FLG_CONSTTIME 0x04 /* avoid leaking exponent information through timing, + * BN_mod_exp_mont() will call BN_mod_exp_mont_consttime, + * BN_div() will call BN_div_no_branch, + * BN_mod_inverse() will call BN_mod_inverse_no_branch. + */ + +void BN_set_flags(BIGNUM *b, int n); +int BN_get_flags(const BIGNUM *b, int n); +void BN_with_flags(BIGNUM *dest, const BIGNUM *src, int flags); + +/* Values for |top| in BN_rand() */ +#define BN_RAND_TOP_ANY -1 +#define BN_RAND_TOP_ONE 0 +#define BN_RAND_TOP_TWO 1 + +/* Values for |bottom| in BN_rand() */ +#define BN_RAND_BOTTOM_ANY 0 +#define BN_RAND_BOTTOM_ODD 1 + +BN_GENCB *BN_GENCB_new(void); +void BN_GENCB_free(BN_GENCB *cb); + +/* Wrapper function to make using BN_GENCB easier, */ +int BN_GENCB_call(BN_GENCB *cb, int a, int b); + +/* Populate a BN_GENCB structure with an "old"-style callback */ +void BN_GENCB_set_old(BN_GENCB *gencb, void (*callback)(int, int, void *), + void *cb_arg); + +/* Populate a BN_GENCB structure with a "new"-style callback */ +void BN_GENCB_set(BN_GENCB *gencb, int (*callback)(int, int, BN_GENCB *), + void *cb_arg); + +void *BN_GENCB_get_arg(BN_GENCB *cb); + +#define BN_prime_checks 0 /* default: select number of iterations + based on the size of the number */ + +/* + * BN_prime_checks_for_size() returns the number of Miller-Rabin + * iterations that will be done for checking that a random number + * is probably prime. The error rate for accepting a composite + * number as prime depends on the size of the prime |b|. The error + * rates used are for calculating an RSA key with 2 primes, and so + * the level is what you would expect for a key of double the size + * of the prime. + * + * This table is generated using the algorithm of FIPS PUB 186-4 + * Digital Signature Standard (DSS), section F.1, page 117. + * (https://dx.doi.org/10.6028/NIST.FIPS.186-4) + * + * The following magma script was used to generate the output: + * securitybits:=125; + * k:=1024; + * for t:=1 to 65 do + * for M:=3 to Floor(2*Sqrt(k-1)-1) do + * S:=0; + * // Sum over m + * for m:=3 to M do + * s:=0; + * // Sum over j + * for j:=2 to m do + * s+:=(RealField(32)!2)^-(j+(k-1)/j); + * end for; + * S+:=2^(m-(m-1)*t)*s; + * end for; + * A:=2^(k-2-M*t); + * B:=8*(Pi(RealField(32))^2-6)/3*2^(k-2)*S; + * pkt:=2.00743*Log(2)*k*2^-k*(A+B); + * seclevel:=Floor(-Log(2,pkt)); + * if seclevel ge securitybits then + * printf "k: %5o, security: %o bits (t: %o, M: %o)\n",k,seclevel,t,M; + * break; + * end if; + * end for; + * if seclevel ge securitybits then break; end if; + * end for; + * + * It can be run online at: + * http://magma.maths.usyd.edu.au/calc + * + * And will output: + * k: 1024, security: 129 bits (t: 6, M: 23) + * + * k is the number of bits of the prime, securitybits is the level + * we want to reach. + * + * prime length | RSA key size | # MR tests | security level + * -------------+--------------|------------+--------------- + * (b) >= 6394 | >= 12788 | 3 | 256 bit + * (b) >= 3747 | >= 7494 | 3 | 192 bit + * (b) >= 1345 | >= 2690 | 4 | 128 bit + * (b) >= 1080 | >= 2160 | 5 | 128 bit + * (b) >= 852 | >= 1704 | 5 | 112 bit + * (b) >= 476 | >= 952 | 5 | 80 bit + * (b) >= 400 | >= 800 | 6 | 80 bit + * (b) >= 347 | >= 694 | 7 | 80 bit + * (b) >= 308 | >= 616 | 8 | 80 bit + * (b) >= 55 | >= 110 | 27 | 64 bit + * (b) >= 6 | >= 12 | 34 | 64 bit + */ + +#define BN_prime_checks_for_size(b) ((b) >= 3747 ? 3 : \ + (b) >= 1345 ? 4 : \ + (b) >= 476 ? 5 : \ + (b) >= 400 ? 6 : \ + (b) >= 347 ? 7 : \ + (b) >= 308 ? 8 : \ + (b) >= 55 ? 27 : \ + /* b >= 6 */ 34) + +#define BN_num_bytes(a) ((BN_num_bits(a)+7)/8) + +int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w); +int BN_is_zero(const BIGNUM *a); +int BN_is_one(const BIGNUM *a); +int BN_is_word(const BIGNUM *a, const BN_ULONG w); +int BN_is_odd(const BIGNUM *a); + +void BN_zero(BIGNUM *a); +int BN_one(BIGNUM *a); + +const BIGNUM *BN_value_one(void); +BN_CTX *BN_CTX_new(void); +void BN_CTX_free(BN_CTX *c); +void BN_CTX_start(BN_CTX *ctx); +BIGNUM *BN_CTX_get(BN_CTX *ctx); +void BN_CTX_end(BN_CTX *ctx); +int BN_rand(BIGNUM *rnd, int bits, int top, int bottom); +int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom); +int BN_rand_range(BIGNUM *rnd, const BIGNUM *range); +int BN_pseudo_rand_range(BIGNUM *rnd, const BIGNUM *range); +int BN_num_bits(const BIGNUM *a); +int BN_num_bits_word(BN_ULONG); +BIGNUM *BN_new(void); +void BN_clear_free(BIGNUM *a); +BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b); +void BN_swap(BIGNUM *a, BIGNUM *b); +BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret); +int BN_bn2bin(const BIGNUM *a, unsigned char *to); +int BN_bn2binpad(const BIGNUM *a, unsigned char *to, int tolen); +BIGNUM *BN_lebin2bn(const unsigned char *s, int len, BIGNUM *ret); +int BN_bn2lebinpad(const BIGNUM *a, unsigned char *to, int tolen); +BIGNUM *BN_mpi2bn(const unsigned char *s, int len, BIGNUM *ret); +int BN_bn2mpi(const BIGNUM *a, unsigned char *to); +int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b); +int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b); +int BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b); +int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b); +int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx); +int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx); +void BN_set_negative(BIGNUM *b, int n); + +int BN_is_negative(const BIGNUM *b); + +int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d, + BN_CTX *ctx); +#define BN_mod(rem,m,d,ctx) BN_div(NULL,(rem),(m),(d),(ctx)) + +int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx); +int BN_mod_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m, BN_CTX *ctx); +int BN_mod_add_quick(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m); +int BN_mod_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m, BN_CTX *ctx); +int BN_mod_sub_quick(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m); +int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, + const BIGNUM *m, BN_CTX *ctx); +int BN_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx); +int BN_mod_lshift1(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx); +int BN_mod_lshift1_quick(BIGNUM *r, const BIGNUM *a, const BIGNUM *m); +int BN_mod_lshift(BIGNUM *r, const BIGNUM *a, int n, const BIGNUM *m, BN_CTX *ctx); +int BN_mod_lshift_quick(BIGNUM *r, const BIGNUM *a, int n, const BIGNUM *m); + +BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w); +BN_ULONG BN_div_word(BIGNUM *a, BN_ULONG w); +int BN_mul_word(BIGNUM *a, BN_ULONG w); +int BN_add_word(BIGNUM *a, BN_ULONG w); +int BN_sub_word(BIGNUM *a, BN_ULONG w); +int BN_set_word(BIGNUM *a, BN_ULONG w); +BN_ULONG BN_get_word(const BIGNUM *a); + +int BN_cmp(const BIGNUM *a, const BIGNUM *b); +void BN_free(BIGNUM *a); +int BN_is_bit_set(const BIGNUM *a, int n); +int BN_lshift(BIGNUM *r, const BIGNUM *a, int n); +int BN_lshift1(BIGNUM *r, const BIGNUM *a); +int BN_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx); + +int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, + const BIGNUM *m, BN_CTX *ctx); +int BN_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, + const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx); +int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, + const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont); + +int BN_mask_bits(BIGNUM *a, int n); +int BN_print_fp(FILE *fp, const BIGNUM *a); +int BN_print(BIO *fp, const BIGNUM *a); +int BN_rshift(BIGNUM *r, const BIGNUM *a, int n); +int BN_rshift1(BIGNUM *r, const BIGNUM *a); +void BN_clear(BIGNUM *a); +BIGNUM *BN_dup(const BIGNUM *a); +int BN_ucmp(const BIGNUM *a, const BIGNUM *b); +int BN_set_bit(BIGNUM *a, int n); +int BN_clear_bit(BIGNUM *a, int n); +char * BN_bn2hex(const BIGNUM *a); +char * BN_bn2dec(const BIGNUM *a); +int BN_hex2bn(BIGNUM **a, const char *str); +int BN_dec2bn(BIGNUM **a, const char *str); +int BN_asc2bn(BIGNUM **a, const char *str); +int BN_gcd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx); +int BN_kronecker(const BIGNUM *a,const BIGNUM *b,BN_CTX *ctx); /* returns -2 for error */ +BIGNUM *BN_mod_inverse(BIGNUM *ret, + const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx); +BIGNUM *BN_mod_sqrt(BIGNUM *ret, + const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx); + +void BN_consttime_swap(BN_ULONG swap, BIGNUM *a, BIGNUM *b, int nwords); + +int BN_security_bits(int L, int N); + +int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe, const BIGNUM *add, + const BIGNUM *rem, BN_GENCB *cb); +int BN_is_prime_ex(const BIGNUM *p, int nchecks, BN_CTX *ctx, BN_GENCB *cb); +int BN_is_prime_fasttest_ex(const BIGNUM *p, int nchecks, BN_CTX *ctx, + int do_trial_division, BN_GENCB *cb); + +BN_MONT_CTX *BN_MONT_CTX_new(void); +int BN_mod_mul_montgomery(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, + BN_MONT_CTX *mont, BN_CTX *ctx); +int BN_to_montgomery(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont, + BN_CTX *ctx); +int BN_from_montgomery(BIGNUM *r, const BIGNUM *a, + BN_MONT_CTX *mont, BN_CTX *ctx); +void BN_MONT_CTX_free(BN_MONT_CTX *mont); +int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx); +BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, const BN_MONT_CTX *from); +BN_MONT_CTX *BN_MONT_CTX_set_locked(BN_MONT_CTX **pmont, int lock, + const BIGNUM *mod, BN_CTX *ctx); + +/* Primes from RFC 2409 */ +BIGNUM *BN_get_rfc2409_prime_768(BIGNUM *bn); +BIGNUM *BN_get_rfc2409_prime_1024(BIGNUM *bn); + +/* Primes from RFC 3526 */ +BIGNUM *BN_get_rfc3526_prime_1536(BIGNUM *bn); +BIGNUM *BN_get_rfc3526_prime_2048(BIGNUM *bn); +BIGNUM *BN_get_rfc3526_prime_3072(BIGNUM *bn); +BIGNUM *BN_get_rfc3526_prime_4096(BIGNUM *bn); +BIGNUM *BN_get_rfc3526_prime_6144(BIGNUM *bn); +BIGNUM *BN_get_rfc3526_prime_8192(BIGNUM *bn); + +void ERR_load_BN_strings(void); + +/* Error codes for the BN functions. */ + +/* Function codes. */ +#define BN_F_BNRAND 127 +#define BN_F_BN_BLINDING_CONVERT_EX 100 +#define BN_F_BN_BLINDING_CREATE_PARAM 128 +#define BN_F_BN_BLINDING_INVERT_EX 101 +#define BN_F_BN_BLINDING_NEW 102 +#define BN_F_BN_BLINDING_UPDATE 103 +#define BN_F_BN_BN2DEC 104 +#define BN_F_BN_BN2HEX 105 +#define BN_F_BN_CTX_GET 116 +#define BN_F_BN_CTX_NEW 106 +#define BN_F_BN_CTX_START 129 +#define BN_F_BN_DIV 107 +#define BN_F_BN_DIV_NO_BRANCH 138 +#define BN_F_BN_DIV_RECP 130 +#define BN_F_BN_EXP 123 +#define BN_F_BN_EXPAND2 108 +#define BN_F_BN_GENERATE_PRIME_EX 140 +#define BN_F_BN_EXPAND_INTERNAL 120 +#define BN_F_BN_GF2M_MOD 131 +#define BN_F_BN_GF2M_MOD_EXP 132 +#define BN_F_BN_GF2M_MOD_MUL 133 +#define BN_F_BN_GF2M_MOD_SOLVE_QUAD 134 +#define BN_F_BN_GF2M_MOD_SOLVE_QUAD_ARR 135 +#define BN_F_BN_GF2M_MOD_SQR 136 +#define BN_F_BN_GF2M_MOD_SQRT 137 +#define BN_F_BN_MOD_EXP2_MONT 118 +#define BN_F_BN_MOD_EXP_MONT 109 +#define BN_F_BN_MOD_EXP_MONT_CONSTTIME 124 +#define BN_F_BN_MOD_EXP_MONT_WORD 117 +#define BN_F_BN_MOD_EXP_RECP 125 +#define BN_F_BN_MOD_EXP_SIMPLE 126 +#define BN_F_BN_MOD_INVERSE 110 +#define BN_F_BN_MOD_INVERSE_NO_BRANCH 139 +#define BN_F_BN_MOD_LSHIFT_QUICK 119 +#define BN_F_BN_MOD_MUL_RECIPROCAL 111 +#define BN_F_BN_MOD_SQRT 121 +#define BN_F_BN_MPI2BN 112 +#define BN_F_BN_NEW 113 +#define BN_F_BN_RAND 114 +#define BN_F_BN_RAND_RANGE 122 +#define BN_F_BN_USUB 115 + +/* Reason codes. */ +#define BN_R_ARG2_LT_ARG3 100 +#define BN_R_BAD_RECIPROCAL 101 +#define BN_R_BIGNUM_TOO_LONG 114 +#define BN_R_BITS_TOO_SMALL 117 +#define BN_R_CALLED_WITH_EVEN_MODULUS 102 +#define BN_R_DIV_BY_ZERO 103 +#define BN_R_ENCODING_ERROR 104 +#define BN_R_EXPAND_ON_STATIC_BIGNUM_DATA 105 +#define BN_R_INPUT_NOT_REDUCED 110 +#define BN_R_INVALID_ARGUMENT 118 +#define BN_R_INVALID_LENGTH 106 +#define BN_R_INVALID_RANGE 115 +#define BN_R_NOT_A_SQUARE 111 +#define BN_R_NOT_INITIALIZED 107 +#define BN_R_NO_INVERSE 108 +#define BN_R_NO_SOLUTION 116 +#define BN_R_P_IS_NOT_PRIME 112 +#define BN_R_TOO_MANY_ITERATIONS 113 +#define BN_R_TOO_MANY_TEMPORARY_VARIABLES 109 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/buffer.h b/curl/include/openssl/buffer.h new file mode 100644 index 0000000..d461d64 --- /dev/null +++ b/curl/include/openssl/buffer.h @@ -0,0 +1,102 @@ +/* $OpenBSD: buffer.h,v 1.17 2023/07/28 10:17:21 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_BUFFER_H +#define HEADER_BUFFER_H + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#include +#include + +/* Already declared in ossl_typ.h */ +/* typedef struct buf_mem_st BUF_MEM; */ + +struct buf_mem_st { + size_t length; /* current number of bytes */ + char *data; + size_t max; /* size of buffer */ +}; + +BUF_MEM *BUF_MEM_new(void); +void BUF_MEM_free(BUF_MEM *a); +int BUF_MEM_grow(BUF_MEM *str, size_t len); +int BUF_MEM_grow_clean(BUF_MEM *str, size_t len); + +void ERR_load_BUF_strings(void); + +/* Error codes for the BUF functions. */ + +/* Function codes. */ +#define BUF_F_BUF_MEMDUP 103 +#define BUF_F_BUF_MEM_GROW 100 +#define BUF_F_BUF_MEM_GROW_CLEAN 105 +#define BUF_F_BUF_MEM_NEW 101 +#define BUF_F_BUF_STRDUP 102 +#define BUF_F_BUF_STRNDUP 104 + +/* Reason codes. */ + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/camellia.h b/curl/include/openssl/camellia.h new file mode 100644 index 0000000..c1f1a17 --- /dev/null +++ b/curl/include/openssl/camellia.h @@ -0,0 +1,121 @@ +/* $OpenBSD: camellia.h,v 1.6 2025/01/25 17:59:44 tb Exp $ */ +/* ==================================================================== + * Copyright (c) 2006 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + */ + +#ifndef HEADER_CAMELLIA_H +#define HEADER_CAMELLIA_H + +#include + +#include + +#define CAMELLIA_ENCRYPT 1 +#define CAMELLIA_DECRYPT 0 + +/* Because array size can't be a const in C, the following two are macros. + Both sizes are in bytes. */ + +#ifdef __cplusplus +extern "C" { +#endif + +/* This should be a hidden type, but EVP requires that the size be known */ + +#define CAMELLIA_BLOCK_SIZE 16 +#define CAMELLIA_TABLE_BYTE_LEN 272 +#define CAMELLIA_TABLE_WORD_LEN (CAMELLIA_TABLE_BYTE_LEN / 4) + +typedef unsigned int KEY_TABLE_TYPE[CAMELLIA_TABLE_WORD_LEN]; /* to match with WORD */ + +struct camellia_key_st { + union { + double d; /* ensures 64-bit align */ + KEY_TABLE_TYPE rd_key; + } u; + int grand_rounds; +}; +typedef struct camellia_key_st CAMELLIA_KEY; + +int Camellia_set_key(const unsigned char *userKey, const int bits, + CAMELLIA_KEY *key); + +void Camellia_encrypt(const unsigned char *in, unsigned char *out, + const CAMELLIA_KEY *key); +void Camellia_decrypt(const unsigned char *in, unsigned char *out, + const CAMELLIA_KEY *key); + +void Camellia_ecb_encrypt(const unsigned char *in, unsigned char *out, + const CAMELLIA_KEY *key, const int enc); +void Camellia_cbc_encrypt(const unsigned char *in, unsigned char *out, + size_t length, const CAMELLIA_KEY *key, + unsigned char *ivec, const int enc); +void Camellia_cfb128_encrypt(const unsigned char *in, unsigned char *out, + size_t length, const CAMELLIA_KEY *key, + unsigned char *ivec, int *num, const int enc); +void Camellia_cfb1_encrypt(const unsigned char *in, unsigned char *out, + size_t length, const CAMELLIA_KEY *key, + unsigned char *ivec, int *num, const int enc); +void Camellia_cfb8_encrypt(const unsigned char *in, unsigned char *out, + size_t length, const CAMELLIA_KEY *key, + unsigned char *ivec, int *num, const int enc); +void Camellia_ofb128_encrypt(const unsigned char *in, unsigned char *out, + size_t length, const CAMELLIA_KEY *key, + unsigned char *ivec, int *num); +void Camellia_ctr128_encrypt(const unsigned char *in, unsigned char *out, + size_t length, const CAMELLIA_KEY *key, + unsigned char ivec[CAMELLIA_BLOCK_SIZE], + unsigned char ecount_buf[CAMELLIA_BLOCK_SIZE], + unsigned int *num); + +#ifdef __cplusplus +} +#endif + +#endif /* !HEADER_Camellia_H */ diff --git a/curl/include/openssl/cast.h b/curl/include/openssl/cast.h new file mode 100644 index 0000000..5c12d91 --- /dev/null +++ b/curl/include/openssl/cast.h @@ -0,0 +1,99 @@ +/* $OpenBSD: cast.h,v 1.14 2025/01/25 17:59:44 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_CAST_H +#define HEADER_CAST_H + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define CAST_ENCRYPT 1 +#define CAST_DECRYPT 0 + +#define CAST_LONG unsigned int + +#define CAST_BLOCK 8 +#define CAST_KEY_LENGTH 16 + +typedef struct cast_key_st { + CAST_LONG data[32]; + int short_key; /* Use reduced rounds for short key */ +} CAST_KEY; + +void CAST_set_key(CAST_KEY *key, int len, const unsigned char *data); +void CAST_ecb_encrypt(const unsigned char *in, unsigned char *out, const CAST_KEY *key, + int enc); +void CAST_encrypt(CAST_LONG *data, const CAST_KEY *key); +void CAST_decrypt(CAST_LONG *data, const CAST_KEY *key); +void CAST_cbc_encrypt(const unsigned char *in, unsigned char *out, long length, + const CAST_KEY *ks, unsigned char *iv, int enc); +void CAST_cfb64_encrypt(const unsigned char *in, unsigned char *out, + long length, const CAST_KEY *schedule, unsigned char *ivec, + int *num, int enc); +void CAST_ofb64_encrypt(const unsigned char *in, unsigned char *out, + long length, const CAST_KEY *schedule, unsigned char *ivec, + int *num); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/chacha.h b/curl/include/openssl/chacha.h new file mode 100644 index 0000000..7d30c51 --- /dev/null +++ b/curl/include/openssl/chacha.h @@ -0,0 +1,54 @@ +/* $OpenBSD: chacha.h,v 1.9 2025/01/25 17:59:44 tb Exp $ */ +/* + * Copyright (c) 2014 Joel Sing + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef HEADER_CHACHA_H +#define HEADER_CHACHA_H + +#include + +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct { + unsigned int input[16]; + unsigned char ks[64]; + unsigned char unused; +} ChaCha_ctx; + +void ChaCha_set_key(ChaCha_ctx *ctx, const unsigned char *key, + unsigned int keybits); +void ChaCha_set_iv(ChaCha_ctx *ctx, const unsigned char *iv, + const unsigned char *counter); +void ChaCha(ChaCha_ctx *ctx, unsigned char *out, const unsigned char *in, + size_t len); + +void CRYPTO_chacha_20(unsigned char *out, const unsigned char *in, size_t len, + const unsigned char key[32], const unsigned char iv[8], uint64_t counter); +void CRYPTO_xchacha_20(unsigned char *out, const unsigned char *in, size_t len, + const unsigned char key[32], const unsigned char iv[24]); +void CRYPTO_hchacha_20(unsigned char out[32], + const unsigned char key[32], const unsigned char iv[16]); + +#ifdef __cplusplus +} +#endif + +#endif /* HEADER_CHACHA_H */ diff --git a/curl/include/openssl/cmac.h b/curl/include/openssl/cmac.h new file mode 100644 index 0000000..f77dae1 --- /dev/null +++ b/curl/include/openssl/cmac.h @@ -0,0 +1,81 @@ +/* $OpenBSD: cmac.h,v 1.4 2024/03/02 09:30:21 tb Exp $ */ +/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL + * project. + */ +/* ==================================================================== + * Copyright (c) 2010 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + */ + + +#ifndef HEADER_CMAC_H +#define HEADER_CMAC_H + +#ifdef __cplusplus +extern "C" { +#endif + +#include + +/* Opaque */ +typedef struct CMAC_CTX_st CMAC_CTX; + +CMAC_CTX *CMAC_CTX_new(void); +void CMAC_CTX_cleanup(CMAC_CTX *ctx); +void CMAC_CTX_free(CMAC_CTX *ctx); +EVP_CIPHER_CTX *CMAC_CTX_get0_cipher_ctx(CMAC_CTX *ctx); +int CMAC_CTX_copy(CMAC_CTX *out, const CMAC_CTX *in); + +int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen, + const EVP_CIPHER *cipher, ENGINE *impl); +int CMAC_Update(CMAC_CTX *ctx, const void *data, size_t dlen); +int CMAC_Final(CMAC_CTX *ctx, unsigned char *out, size_t *poutlen); + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/cms.h b/curl/include/openssl/cms.h new file mode 100644 index 0000000..90030bd --- /dev/null +++ b/curl/include/openssl/cms.h @@ -0,0 +1,534 @@ +/* $OpenBSD: cms.h,v 1.18 2024/03/30 00:35:15 joshua Exp $ */ +/* + * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL + * project. + */ +/* ==================================================================== + * Copyright (c) 2008 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + */ + +#ifndef HEADER_CMS_H +#define HEADER_CMS_H + +#include + +#ifndef OPENSSL_NO_CMS + +#include +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct CMS_ContentInfo_st CMS_ContentInfo; +typedef struct CMS_SignerInfo_st CMS_SignerInfo; +typedef struct CMS_CertificateChoices CMS_CertificateChoices; +typedef struct CMS_RevocationInfoChoice_st CMS_RevocationInfoChoice; +typedef struct CMS_RecipientInfo_st CMS_RecipientInfo; +typedef struct CMS_ReceiptRequest_st CMS_ReceiptRequest; +typedef struct CMS_Receipt_st CMS_Receipt; +typedef struct CMS_RecipientEncryptedKey_st CMS_RecipientEncryptedKey; +typedef struct CMS_OtherKeyAttribute_st CMS_OtherKeyAttribute; + +DECLARE_STACK_OF(CMS_SignerInfo) +DECLARE_STACK_OF(CMS_RecipientEncryptedKey) +DECLARE_STACK_OF(CMS_RecipientInfo) +DECLARE_STACK_OF(CMS_RevocationInfoChoice) +CMS_ContentInfo *CMS_ContentInfo_new(void); +void CMS_ContentInfo_free(CMS_ContentInfo *a); +CMS_ContentInfo *d2i_CMS_ContentInfo(CMS_ContentInfo **a, const unsigned char **in, long len); +int i2d_CMS_ContentInfo(CMS_ContentInfo *a, unsigned char **out); +extern const ASN1_ITEM CMS_ContentInfo_it; +CMS_ReceiptRequest *CMS_ReceiptRequest_new(void); +void CMS_ReceiptRequest_free(CMS_ReceiptRequest *a); +CMS_ReceiptRequest *d2i_CMS_ReceiptRequest(CMS_ReceiptRequest **a, const unsigned char **in, long len); +int i2d_CMS_ReceiptRequest(CMS_ReceiptRequest *a, unsigned char **out); +extern const ASN1_ITEM CMS_ReceiptRequest_it; +int CMS_ContentInfo_print_ctx(BIO *out, CMS_ContentInfo *x, int indent, const ASN1_PCTX *pctx); + +#define CMS_SIGNERINFO_ISSUER_SERIAL 0 +#define CMS_SIGNERINFO_KEYIDENTIFIER 1 + +#define CMS_RECIPINFO_NONE -1 +#define CMS_RECIPINFO_TRANS 0 +#define CMS_RECIPINFO_AGREE 1 +#define CMS_RECIPINFO_KEK 2 +#define CMS_RECIPINFO_PASS 3 +#define CMS_RECIPINFO_OTHER 4 + +/* S/MIME related flags */ + +#define CMS_TEXT 0x1 +#define CMS_NOCERTS 0x2 +#define CMS_NO_CONTENT_VERIFY 0x4 +#define CMS_NO_ATTR_VERIFY 0x8 +#define CMS_NOSIGS \ + (CMS_NO_CONTENT_VERIFY|CMS_NO_ATTR_VERIFY) +#define CMS_NOINTERN 0x10 +#define CMS_NO_SIGNER_CERT_VERIFY 0x20 +#define CMS_NOVERIFY 0x20 +#define CMS_DETACHED 0x40 +#define CMS_BINARY 0x80 +#define CMS_NOATTR 0x100 +#define CMS_NOSMIMECAP 0x200 +#define CMS_NOOLDMIMETYPE 0x400 +#define CMS_CRLFEOL 0x800 +#define CMS_STREAM 0x1000 +#define CMS_NOCRL 0x2000 +#define CMS_PARTIAL 0x4000 +#define CMS_REUSE_DIGEST 0x8000 +#define CMS_USE_KEYID 0x10000 +#define CMS_DEBUG_DECRYPT 0x20000 +#define CMS_KEY_PARAM 0x40000 +#define CMS_ASCIICRLF 0x80000 + +const ASN1_OBJECT *CMS_get0_type(const CMS_ContentInfo *cms); + +int CMS_get_version(const CMS_ContentInfo *cms, long *version); +int CMS_SignerInfo_get_version(const CMS_SignerInfo *si, long *version); + +BIO *CMS_dataInit(CMS_ContentInfo *cms, BIO *icont); +int CMS_dataFinal(CMS_ContentInfo *cms, BIO *bio); + +ASN1_OCTET_STRING **CMS_get0_content(CMS_ContentInfo *cms); +int CMS_is_detached(CMS_ContentInfo *cms); +int CMS_set_detached(CMS_ContentInfo *cms, int detached); + +CMS_ContentInfo *PEM_read_bio_CMS(BIO *bp, CMS_ContentInfo **x, + pem_password_cb *cb, void *u); +CMS_ContentInfo *PEM_read_CMS(FILE *fp, CMS_ContentInfo **x, + pem_password_cb *cb, void *u); +int PEM_write_bio_CMS(BIO *bp, const CMS_ContentInfo *x); +int PEM_write_CMS(FILE *fp, const CMS_ContentInfo *x); +int CMS_stream(unsigned char ***boundary, CMS_ContentInfo *cms); +CMS_ContentInfo *d2i_CMS_bio(BIO *bp, CMS_ContentInfo **cms); +int i2d_CMS_bio(BIO *bp, CMS_ContentInfo *cms); + +BIO *BIO_new_CMS(BIO *out, CMS_ContentInfo *cms); +int i2d_CMS_bio_stream(BIO *out, CMS_ContentInfo *cms, BIO *in, int flags); +int PEM_write_bio_CMS_stream(BIO *out, CMS_ContentInfo *cms, BIO *in, + int flags); +CMS_ContentInfo *SMIME_read_CMS(BIO *bio, BIO **bcont); +int SMIME_write_CMS(BIO *bio, CMS_ContentInfo *cms, BIO *data, int flags); + +int CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont, unsigned int flags); + +CMS_ContentInfo *CMS_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs, + BIO *data, unsigned int flags); + +CMS_ContentInfo *CMS_sign_receipt(CMS_SignerInfo *si, X509 *signcert, + EVP_PKEY *pkey, STACK_OF(X509) *certs, unsigned int flags); + +int CMS_data(CMS_ContentInfo *cms, BIO *out, unsigned int flags); +CMS_ContentInfo *CMS_data_create(BIO *in, unsigned int flags); + +int CMS_digest_verify(CMS_ContentInfo *cms, BIO *dcont, BIO *out, + unsigned int flags); +CMS_ContentInfo *CMS_digest_create(BIO *in, const EVP_MD *md, + unsigned int flags); + +int CMS_EncryptedData_decrypt(CMS_ContentInfo *cms, const unsigned char *key, + size_t keylen, BIO *dcont, BIO *out, unsigned int flags); + +CMS_ContentInfo *CMS_EncryptedData_encrypt(BIO *in, const EVP_CIPHER *cipher, + const unsigned char *key, size_t keylen, unsigned int flags); + +int CMS_EncryptedData_set1_key(CMS_ContentInfo *cms, const EVP_CIPHER *ciph, + const unsigned char *key, size_t keylen); + +int CMS_verify(CMS_ContentInfo *cms, STACK_OF(X509) *certs, + X509_STORE *store, BIO *dcont, BIO *out, unsigned int flags); + +int CMS_verify_receipt(CMS_ContentInfo *rcms, CMS_ContentInfo *ocms, + STACK_OF(X509) *certs, X509_STORE *store, unsigned int flags); + +STACK_OF(X509) *CMS_get0_signers(CMS_ContentInfo *cms); + +CMS_ContentInfo *CMS_encrypt(STACK_OF(X509) *certs, BIO *in, + const EVP_CIPHER *cipher, unsigned int flags); + +int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pkey, X509 *cert, + BIO *dcont, BIO *out, unsigned int flags); + +int CMS_decrypt_set1_pkey(CMS_ContentInfo *cms, EVP_PKEY *pk, X509 *cert); +int CMS_decrypt_set1_key(CMS_ContentInfo *cms, unsigned char *key, + size_t keylen, const unsigned char *id, size_t idlen); +int CMS_decrypt_set1_password(CMS_ContentInfo *cms, unsigned char *pass, + ssize_t passlen); + +STACK_OF(CMS_RecipientInfo) *CMS_get0_RecipientInfos(CMS_ContentInfo *cms); +int CMS_RecipientInfo_type(CMS_RecipientInfo *ri); +EVP_PKEY_CTX *CMS_RecipientInfo_get0_pkey_ctx(CMS_RecipientInfo *ri); +CMS_ContentInfo *CMS_EnvelopedData_create(const EVP_CIPHER *cipher); +CMS_RecipientInfo *CMS_add1_recipient_cert(CMS_ContentInfo *cms, X509 *recip, + unsigned int flags); +int CMS_RecipientInfo_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pkey); +int CMS_RecipientInfo_ktri_cert_cmp(CMS_RecipientInfo *ri, X509 *cert); +int CMS_RecipientInfo_ktri_get0_algs(CMS_RecipientInfo *ri, EVP_PKEY **pk, + X509 **recip, X509_ALGOR **palg); +int CMS_RecipientInfo_ktri_get0_signer_id(CMS_RecipientInfo *ri, + ASN1_OCTET_STRING **keyid, X509_NAME **issuer, ASN1_INTEGER **sno); + +CMS_RecipientInfo *CMS_add0_recipient_key(CMS_ContentInfo *cms, int nid, + unsigned char *key, size_t keylen, unsigned char *id, size_t idlen, + ASN1_GENERALIZEDTIME *date, ASN1_OBJECT *otherTypeId, ASN1_TYPE *otherType); + +int CMS_RecipientInfo_kekri_get0_id(CMS_RecipientInfo *ri, X509_ALGOR **palg, + ASN1_OCTET_STRING **pid, ASN1_GENERALIZEDTIME **pdate, + ASN1_OBJECT **potherid, ASN1_TYPE **pothertype); + +int CMS_RecipientInfo_set0_key(CMS_RecipientInfo *ri, unsigned char *key, + size_t keylen); + +int CMS_RecipientInfo_kekri_id_cmp(CMS_RecipientInfo *ri, + const unsigned char *id, size_t idlen); + +int CMS_RecipientInfo_set0_password(CMS_RecipientInfo *ri, unsigned char *pass, + ssize_t passlen); + +CMS_RecipientInfo *CMS_add0_recipient_password(CMS_ContentInfo *cms, int iter, + int wrap_nid, int pbe_nid, unsigned char *pass, ssize_t passlen, + const EVP_CIPHER *kekciph); + +int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri); +int CMS_RecipientInfo_encrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri); + +int CMS_uncompress(CMS_ContentInfo *cms, BIO *dcont, BIO *out, + unsigned int flags); +CMS_ContentInfo *CMS_compress(BIO *in, int comp_nid, unsigned int flags); + +int CMS_set1_eContentType(CMS_ContentInfo *cms, const ASN1_OBJECT *oid); +const ASN1_OBJECT *CMS_get0_eContentType(CMS_ContentInfo *cms); + +CMS_CertificateChoices *CMS_add0_CertificateChoices(CMS_ContentInfo *cms); +int CMS_add0_cert(CMS_ContentInfo *cms, X509 *cert); +int CMS_add1_cert(CMS_ContentInfo *cms, X509 *cert); +STACK_OF(X509) *CMS_get1_certs(CMS_ContentInfo *cms); + +CMS_RevocationInfoChoice *CMS_add0_RevocationInfoChoice(CMS_ContentInfo *cms); +int CMS_add0_crl(CMS_ContentInfo *cms, X509_CRL *crl); +int CMS_add1_crl(CMS_ContentInfo *cms, X509_CRL *crl); +STACK_OF(X509_CRL) *CMS_get1_crls(CMS_ContentInfo *cms); + +int CMS_SignedData_init(CMS_ContentInfo *cms); +CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, X509 *signer, + EVP_PKEY *pk, const EVP_MD *md, unsigned int flags); +EVP_PKEY_CTX *CMS_SignerInfo_get0_pkey_ctx(CMS_SignerInfo *si); +EVP_MD_CTX *CMS_SignerInfo_get0_md_ctx(CMS_SignerInfo *si); +STACK_OF(CMS_SignerInfo) *CMS_get0_SignerInfos(CMS_ContentInfo *cms); + +void CMS_SignerInfo_set1_signer_cert(CMS_SignerInfo *si, X509 *signer); +int CMS_SignerInfo_get0_signer_id(CMS_SignerInfo *si, ASN1_OCTET_STRING **keyid, + X509_NAME **issuer, ASN1_INTEGER **sno); +int CMS_SignerInfo_cert_cmp(CMS_SignerInfo *si, X509 *cert); +int CMS_set1_signers_certs(CMS_ContentInfo *cms, STACK_OF(X509) *certs, + unsigned int flags); +void CMS_SignerInfo_get0_algs(CMS_SignerInfo *si, EVP_PKEY **pk, X509 **signer, + X509_ALGOR **pdig, X509_ALGOR **psig); +ASN1_OCTET_STRING *CMS_SignerInfo_get0_signature(CMS_SignerInfo *si); +int CMS_SignerInfo_sign(CMS_SignerInfo *si); +int CMS_SignerInfo_verify(CMS_SignerInfo *si); +int CMS_SignerInfo_verify_content(CMS_SignerInfo *si, BIO *chain); + +int CMS_add_smimecap(CMS_SignerInfo *si, STACK_OF(X509_ALGOR) *algs); +int CMS_add_simple_smimecap(STACK_OF(X509_ALGOR) **algs, int algnid, + int keysize); +int CMS_add_standard_smimecap(STACK_OF(X509_ALGOR) **smcap); + +int CMS_signed_get_attr_count(const CMS_SignerInfo *si); +int CMS_signed_get_attr_by_NID(const CMS_SignerInfo *si, int nid, int lastpos); +int CMS_signed_get_attr_by_OBJ(const CMS_SignerInfo *si, const ASN1_OBJECT *obj, + int lastpos); +X509_ATTRIBUTE *CMS_signed_get_attr(const CMS_SignerInfo *si, int loc); +X509_ATTRIBUTE *CMS_signed_delete_attr(CMS_SignerInfo *si, int loc); +int CMS_signed_add1_attr(CMS_SignerInfo *si, X509_ATTRIBUTE *attr); +int CMS_signed_add1_attr_by_OBJ(CMS_SignerInfo *si, const ASN1_OBJECT *obj, + int type, const void *bytes, int len); +int CMS_signed_add1_attr_by_NID(CMS_SignerInfo *si, int nid, int type, + const void *bytes, int len); +int CMS_signed_add1_attr_by_txt(CMS_SignerInfo *si, + const char *attrname, int type, const void *bytes, int len); +void *CMS_signed_get0_data_by_OBJ(CMS_SignerInfo *si, const ASN1_OBJECT *oid, + int lastpos, int type); + +int CMS_unsigned_get_attr_count(const CMS_SignerInfo *si); +int CMS_unsigned_get_attr_by_NID(const CMS_SignerInfo *si, int nid, + int lastpos); +int CMS_unsigned_get_attr_by_OBJ(const CMS_SignerInfo *si, + const ASN1_OBJECT *obj, int lastpos); +X509_ATTRIBUTE *CMS_unsigned_get_attr(const CMS_SignerInfo *si, int loc); +X509_ATTRIBUTE *CMS_unsigned_delete_attr(CMS_SignerInfo *si, int loc); +int CMS_unsigned_add1_attr(CMS_SignerInfo *si, X509_ATTRIBUTE *attr); +int CMS_unsigned_add1_attr_by_OBJ(CMS_SignerInfo *si, + const ASN1_OBJECT *obj, int type, const void *bytes, int len); +int CMS_unsigned_add1_attr_by_NID(CMS_SignerInfo *si, int nid, int type, + const void *bytes, int len); +int CMS_unsigned_add1_attr_by_txt(CMS_SignerInfo *si, const char *attrname, + int type, const void *bytes, int len); +void *CMS_unsigned_get0_data_by_OBJ(CMS_SignerInfo *si, ASN1_OBJECT *oid, + int lastpos, int type); + +int CMS_get1_ReceiptRequest(CMS_SignerInfo *si, CMS_ReceiptRequest **prr); +CMS_ReceiptRequest *CMS_ReceiptRequest_create0(unsigned char *id, int idlen, + int allorfirst, STACK_OF(GENERAL_NAMES) *receiptList, + STACK_OF(GENERAL_NAMES) *receiptsTo); +int CMS_add1_ReceiptRequest(CMS_SignerInfo *si, CMS_ReceiptRequest *rr); +void CMS_ReceiptRequest_get0_values(CMS_ReceiptRequest *rr, ASN1_STRING **pcid, + int *pallorfirst, STACK_OF(GENERAL_NAMES) **plist, + STACK_OF(GENERAL_NAMES) **prto); + +int CMS_RecipientInfo_kari_get0_alg(CMS_RecipientInfo *ri, X509_ALGOR **palg, + ASN1_OCTET_STRING **pukm); +STACK_OF(CMS_RecipientEncryptedKey) * + CMS_RecipientInfo_kari_get0_reks(CMS_RecipientInfo *ri); + +int CMS_RecipientInfo_kari_get0_orig_id(CMS_RecipientInfo *ri, + X509_ALGOR **pubalg, ASN1_BIT_STRING **pubkey, ASN1_OCTET_STRING **keyid, + X509_NAME **issuer, ASN1_INTEGER **sno); + +int CMS_RecipientInfo_kari_orig_id_cmp(CMS_RecipientInfo *ri, X509 *cert); + +int CMS_RecipientEncryptedKey_get0_id(CMS_RecipientEncryptedKey *rek, + ASN1_OCTET_STRING **keyid, ASN1_GENERALIZEDTIME **tm, + CMS_OtherKeyAttribute **other, X509_NAME **issuer, ASN1_INTEGER **sno); +int CMS_RecipientEncryptedKey_cert_cmp(CMS_RecipientEncryptedKey *rek, + X509 *cert); +int CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk); +EVP_CIPHER_CTX *CMS_RecipientInfo_kari_get0_ctx(CMS_RecipientInfo *ri); +int CMS_RecipientInfo_kari_decrypt(CMS_ContentInfo *cms, + CMS_RecipientInfo *ri, CMS_RecipientEncryptedKey *rek); + +int CMS_SharedInfo_encode(unsigned char **pder, X509_ALGOR *kekalg, + ASN1_OCTET_STRING *ukm, int keylen); + +/* Backward compatibility for spelling errors. */ +#define CMS_R_UNKNOWN_DIGEST_ALGORITM CMS_R_UNKNOWN_DIGEST_ALGORITHM +#define CMS_R_UNSUPPORTED_RECPIENTINFO_TYPE \ + CMS_R_UNSUPPORTED_RECIPIENTINFO_TYPE + +int ERR_load_CMS_strings(void); + +/* + * CMS function codes. + */ +#define CMS_F_CHECK_CONTENT 99 +#define CMS_F_CMS_ADD0_CERT 164 +#define CMS_F_CMS_ADD0_RECIPIENT_KEY 100 +#define CMS_F_CMS_ADD0_RECIPIENT_PASSWORD 165 +#define CMS_F_CMS_ADD1_RECEIPTREQUEST 158 +#define CMS_F_CMS_ADD1_RECIPIENT_CERT 101 +#define CMS_F_CMS_ADD1_SIGNER 102 +#define CMS_F_CMS_ADD1_SIGNINGTIME 103 +#define CMS_F_CMS_COMPRESS 104 +#define CMS_F_CMS_COMPRESSEDDATA_CREATE 105 +#define CMS_F_CMS_COMPRESSEDDATA_INIT_BIO 106 +#define CMS_F_CMS_COPY_CONTENT 107 +#define CMS_F_CMS_COPY_MESSAGEDIGEST 108 +#define CMS_F_CMS_DATA 109 +#define CMS_F_CMS_DATAFINAL 110 +#define CMS_F_CMS_DATAINIT 111 +#define CMS_F_CMS_DECRYPT 112 +#define CMS_F_CMS_DECRYPT_SET1_KEY 113 +#define CMS_F_CMS_DECRYPT_SET1_PASSWORD 166 +#define CMS_F_CMS_DECRYPT_SET1_PKEY 114 +#define CMS_F_CMS_DIGESTALGORITHM_FIND_CTX 115 +#define CMS_F_CMS_DIGESTALGORITHM_INIT_BIO 116 +#define CMS_F_CMS_DIGESTEDDATA_DO_FINAL 117 +#define CMS_F_CMS_DIGEST_VERIFY 118 +#define CMS_F_CMS_ENCODE_RECEIPT 161 +#define CMS_F_CMS_ENCRYPT 119 +#define CMS_F_CMS_ENCRYPTEDCONTENT_INIT 179 +#define CMS_F_CMS_ENCRYPTEDCONTENT_INIT_BIO 120 +#define CMS_F_CMS_ENCRYPTEDDATA_DECRYPT 121 +#define CMS_F_CMS_ENCRYPTEDDATA_ENCRYPT 122 +#define CMS_F_CMS_ENCRYPTEDDATA_SET1_KEY 123 +#define CMS_F_CMS_ENVELOPEDDATA_CREATE 124 +#define CMS_F_CMS_ENVELOPEDDATA_INIT_BIO 125 +#define CMS_F_CMS_ENVELOPED_DATA_INIT 126 +#define CMS_F_CMS_ENV_ASN1_CTRL 171 +#define CMS_F_CMS_FINAL 127 +#define CMS_F_CMS_GET0_CERTIFICATE_CHOICES 128 +#define CMS_F_CMS_GET0_CONTENT 129 +#define CMS_F_CMS_GET0_ECONTENT_TYPE 130 +#define CMS_F_CMS_GET0_ENVELOPED 131 +#define CMS_F_CMS_GET0_REVOCATION_CHOICES 132 +#define CMS_F_CMS_GET0_SIGNED 133 +#define CMS_F_CMS_MSGSIGDIGEST_ADD1 162 +#define CMS_F_CMS_RECEIPTREQUEST_CREATE0 159 +#define CMS_F_CMS_RECEIPT_VERIFY 160 +#define CMS_F_CMS_RECIPIENTINFO_DECRYPT 134 +#define CMS_F_CMS_RECIPIENTINFO_ENCRYPT 169 +#define CMS_F_CMS_RECIPIENTINFO_KARI_ENCRYPT 178 +#define CMS_F_CMS_RECIPIENTINFO_KARI_GET0_ALG 175 +#define CMS_F_CMS_RECIPIENTINFO_KARI_GET0_ORIG_ID 173 +#define CMS_F_CMS_RECIPIENTINFO_KARI_GET0_REKS 172 +#define CMS_F_CMS_RECIPIENTINFO_KARI_ORIG_ID_CMP 174 +#define CMS_F_CMS_RECIPIENTINFO_KEKRI_DECRYPT 135 +#define CMS_F_CMS_RECIPIENTINFO_KEKRI_ENCRYPT 136 +#define CMS_F_CMS_RECIPIENTINFO_KEKRI_GET0_ID 137 +#define CMS_F_CMS_RECIPIENTINFO_KEKRI_ID_CMP 138 +#define CMS_F_CMS_RECIPIENTINFO_KTRI_CERT_CMP 139 +#define CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT 140 +#define CMS_F_CMS_RECIPIENTINFO_KTRI_ENCRYPT 141 +#define CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_ALGS 142 +#define CMS_F_CMS_RECIPIENTINFO_KTRI_GET0_SIGNER_ID 143 +#define CMS_F_CMS_RECIPIENTINFO_PWRI_CRYPT 167 +#define CMS_F_CMS_RECIPIENTINFO_SET0_KEY 144 +#define CMS_F_CMS_RECIPIENTINFO_SET0_PASSWORD 168 +#define CMS_F_CMS_RECIPIENTINFO_SET0_PKEY 145 +#define CMS_F_CMS_SD_ASN1_CTRL 170 +#define CMS_F_CMS_SET1_IAS 176 +#define CMS_F_CMS_SET1_KEYID 177 +#define CMS_F_CMS_SET1_SIGNERIDENTIFIER 146 +#define CMS_F_CMS_SET_DETACHED 147 +#define CMS_F_CMS_SIGN 148 +#define CMS_F_CMS_SIGNED_DATA_INIT 149 +#define CMS_F_CMS_SIGNERINFO_CONTENT_SIGN 150 +#define CMS_F_CMS_SIGNERINFO_SIGN 151 +#define CMS_F_CMS_SIGNERINFO_VERIFY 152 +#define CMS_F_CMS_SIGNERINFO_VERIFY_CERT 153 +#define CMS_F_CMS_SIGNERINFO_VERIFY_CONTENT 154 +#define CMS_F_CMS_SIGN_RECEIPT 163 +#define CMS_F_CMS_STREAM 155 +#define CMS_F_CMS_UNCOMPRESS 156 +#define CMS_F_CMS_VERIFY 157 +#define CMS_F_KEK_UNWRAP_KEY 180 + +/* + * CMS reason codes. + */ +#define CMS_R_ADD_SIGNER_ERROR 99 +#define CMS_R_CERTIFICATE_ALREADY_PRESENT 175 +#define CMS_R_CERTIFICATE_HAS_NO_KEYID 160 +#define CMS_R_CERTIFICATE_VERIFY_ERROR 100 +#define CMS_R_CIPHER_INITIALISATION_ERROR 101 +#define CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR 102 +#define CMS_R_CMS_DATAFINAL_ERROR 103 +#define CMS_R_CMS_LIB 104 +#define CMS_R_CONTENTIDENTIFIER_MISMATCH 170 +#define CMS_R_CONTENT_NOT_FOUND 105 +#define CMS_R_CONTENT_TYPE_MISMATCH 171 +#define CMS_R_CONTENT_TYPE_NOT_COMPRESSED_DATA 106 +#define CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA 107 +#define CMS_R_CONTENT_TYPE_NOT_SIGNED_DATA 108 +#define CMS_R_CONTENT_VERIFY_ERROR 109 +#define CMS_R_CTRL_ERROR 110 +#define CMS_R_CTRL_FAILURE 111 +#define CMS_R_DECRYPT_ERROR 112 +#define CMS_R_ERROR_GETTING_PUBLIC_KEY 113 +#define CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE 114 +#define CMS_R_ERROR_SETTING_KEY 115 +#define CMS_R_ERROR_SETTING_RECIPIENTINFO 116 +#define CMS_R_INVALID_ENCRYPTED_KEY_LENGTH 117 +#define CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER 176 +#define CMS_R_INVALID_KEY_LENGTH 118 +#define CMS_R_MD_BIO_INIT_ERROR 119 +#define CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH 120 +#define CMS_R_MESSAGEDIGEST_WRONG_LENGTH 121 +#define CMS_R_MSGSIGDIGEST_ERROR 172 +#define CMS_R_MSGSIGDIGEST_VERIFICATION_FAILURE 162 +#define CMS_R_MSGSIGDIGEST_WRONG_LENGTH 163 +#define CMS_R_NEED_ONE_SIGNER 164 +#define CMS_R_NOT_A_SIGNED_RECEIPT 165 +#define CMS_R_NOT_ENCRYPTED_DATA 122 +#define CMS_R_NOT_KEK 123 +#define CMS_R_NOT_KEY_AGREEMENT 181 +#define CMS_R_NOT_KEY_TRANSPORT 124 +#define CMS_R_NOT_PWRI 177 +#define CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE 125 +#define CMS_R_NO_CIPHER 126 +#define CMS_R_NO_CONTENT 127 +#define CMS_R_NO_CONTENT_TYPE 173 +#define CMS_R_NO_DEFAULT_DIGEST 128 +#define CMS_R_NO_DIGEST_SET 129 +#define CMS_R_NO_KEY 130 +#define CMS_R_NO_KEY_OR_CERT 174 +#define CMS_R_NO_MATCHING_DIGEST 131 +#define CMS_R_NO_MATCHING_RECIPIENT 132 +#define CMS_R_NO_MATCHING_SIGNATURE 166 +#define CMS_R_NO_MSGSIGDIGEST 167 +#define CMS_R_NO_PASSWORD 178 +#define CMS_R_NO_PRIVATE_KEY 133 +#define CMS_R_NO_PUBLIC_KEY 134 +#define CMS_R_NO_RECEIPT_REQUEST 168 +#define CMS_R_NO_SIGNERS 135 +#define CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 136 +#define CMS_R_RECEIPT_DECODE_ERROR 169 +#define CMS_R_RECIPIENT_ERROR 137 +#define CMS_R_SIGNER_CERTIFICATE_NOT_FOUND 138 +#define CMS_R_SIGNFINAL_ERROR 139 +#define CMS_R_SMIME_TEXT_ERROR 140 +#define CMS_R_STORE_INIT_ERROR 141 +#define CMS_R_TYPE_NOT_COMPRESSED_DATA 142 +#define CMS_R_TYPE_NOT_DATA 143 +#define CMS_R_TYPE_NOT_DIGESTED_DATA 144 +#define CMS_R_TYPE_NOT_ENCRYPTED_DATA 145 +#define CMS_R_TYPE_NOT_ENVELOPED_DATA 146 +#define CMS_R_UNABLE_TO_FINALIZE_CONTEXT 147 +#define CMS_R_UNKNOWN_CIPHER 148 +#define CMS_R_UNKNOWN_DIGEST_ALGORITHM 149 +#define CMS_R_UNKNOWN_ID 150 +#define CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM 151 +#define CMS_R_UNSUPPORTED_CONTENT_TYPE 152 +#define CMS_R_UNSUPPORTED_KEK_ALGORITHM 153 +#define CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM 179 +#define CMS_R_UNSUPPORTED_RECIPIENTINFO_TYPE 155 +#define CMS_R_UNSUPPORTED_RECIPIENT_TYPE 154 +#define CMS_R_UNSUPPORTED_TYPE 156 +#define CMS_R_UNWRAP_ERROR 157 +#define CMS_R_UNWRAP_FAILURE 180 +#define CMS_R_VERIFICATION_FAILURE 158 +#define CMS_R_WRAP_ERROR 159 + +#ifdef __cplusplus +} +#endif +#endif +#endif diff --git a/curl/include/openssl/comp.h b/curl/include/openssl/comp.h new file mode 100644 index 0000000..f033027 --- /dev/null +++ b/curl/include/openssl/comp.h @@ -0,0 +1,7 @@ +/* $OpenBSD: comp.h,v 1.13 2023/07/28 09:42:44 tb Exp $ */ + +/* + * Public domain. + * + * This header is intentionally left empty. Some software uses it unnecessarily. + */ diff --git a/curl/include/openssl/conf.h b/curl/include/openssl/conf.h new file mode 100644 index 0000000..58a9035 --- /dev/null +++ b/curl/include/openssl/conf.h @@ -0,0 +1,189 @@ +/* $OpenBSD: conf.h,v 1.28 2025/03/01 10:11:19 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_CONF_H +#define HEADER_CONF_H + +#include + +#include +#include +#include +#include + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct { + char *section; + char *name; + char *value; +} CONF_VALUE; + +DECLARE_STACK_OF(CONF_VALUE) +DECLARE_LHASH_OF(CONF_VALUE); + +struct conf_st; +struct conf_method_st; +typedef struct conf_method_st CONF_METHOD; + +/* Module definitions */ + +typedef struct conf_imodule_st CONF_IMODULE; +typedef struct conf_module_st CONF_MODULE; + +DECLARE_STACK_OF(CONF_MODULE) +DECLARE_STACK_OF(CONF_IMODULE) + +/* DSO module function typedefs */ +typedef int conf_init_func(CONF_IMODULE *md, const CONF *cnf); +typedef void conf_finish_func(CONF_IMODULE *md); + +#define CONF_MFLAGS_IGNORE_ERRORS 0x1 +#define CONF_MFLAGS_IGNORE_RETURN_CODES 0x2 +#define CONF_MFLAGS_SILENT 0x4 +#define CONF_MFLAGS_NO_DSO 0x8 +#define CONF_MFLAGS_IGNORE_MISSING_FILE 0x10 +#define CONF_MFLAGS_DEFAULT_SECTION 0x20 + +void OPENSSL_config(const char *config_name); +void OPENSSL_no_config(void); + +struct conf_st { + const CONF_METHOD *meth; + LHASH_OF(CONF_VALUE) *data; +}; + +CONF *NCONF_new(const CONF_METHOD *meth); +void NCONF_free(CONF *conf); + +int NCONF_load(CONF *conf, const char *file, long *eline); +int NCONF_load_bio(CONF *conf, BIO *bp, long *eline); +STACK_OF(CONF_VALUE) *NCONF_get_section(const CONF *conf, const char *section); +char *NCONF_get_string(const CONF *conf, const char *group, const char *name); +int NCONF_get_number_e(const CONF *conf, const char *group, const char *name, + long *result); + +#define NCONF_get_number(c,g,n,r) NCONF_get_number_e(c,g,n,r) + +/* Module functions */ + +int CONF_modules_load(const CONF *cnf, const char *appname, + unsigned long flags); +int CONF_modules_load_file(const char *filename, const char *appname, + unsigned long flags); +void CONF_modules_unload(int all); +void CONF_modules_finish(void); +void CONF_modules_free(void); + +char *CONF_get1_default_config_file(void); + +void ERR_load_CONF_strings(void); + +/* Error codes for the CONF functions. */ + +/* Function codes. */ +#define CONF_F_CONF_DUMP_FP 104 +#define CONF_F_CONF_LOAD 100 +#define CONF_F_CONF_LOAD_BIO 102 +#define CONF_F_CONF_LOAD_FP 103 +#define CONF_F_CONF_MODULES_LOAD 116 +#define CONF_F_CONF_PARSE_LIST 119 +#define CONF_F_DEF_LOAD 120 +#define CONF_F_DEF_LOAD_BIO 121 +#define CONF_F_MODULE_INIT 115 +#define CONF_F_MODULE_LOAD_DSO 117 +#define CONF_F_MODULE_RUN 118 +#define CONF_F_NCONF_DUMP_BIO 105 +#define CONF_F_NCONF_DUMP_FP 106 +#define CONF_F_NCONF_GET_NUMBER 107 +#define CONF_F_NCONF_GET_NUMBER_E 112 +#define CONF_F_NCONF_GET_SECTION 108 +#define CONF_F_NCONF_GET_STRING 109 +#define CONF_F_NCONF_LOAD 113 +#define CONF_F_NCONF_LOAD_BIO 110 +#define CONF_F_NCONF_LOAD_FP 114 +#define CONF_F_NCONF_NEW 111 +#define CONF_F_STR_COPY 101 + +/* Reason codes. */ +#define CONF_R_ERROR_LOADING_DSO 110 +#define CONF_R_LIST_CANNOT_BE_NULL 115 +#define CONF_R_MISSING_CLOSE_SQUARE_BRACKET 100 +#define CONF_R_MISSING_EQUAL_SIGN 101 +#define CONF_R_MISSING_FINISH_FUNCTION 111 +#define CONF_R_MISSING_INIT_FUNCTION 112 +#define CONF_R_MODULE_INITIALIZATION_ERROR 109 +#define CONF_R_NO_CLOSE_BRACE 102 +#define CONF_R_NO_CONF 105 +#define CONF_R_NO_CONF_OR_ENVIRONMENT_VARIABLE 106 +#define CONF_R_NO_SECTION 107 +#define CONF_R_NO_SUCH_FILE 114 +#define CONF_R_NO_VALUE 108 +#define CONF_R_UNABLE_TO_CREATE_NEW_SECTION 103 +#define CONF_R_UNKNOWN_MODULE_NAME 113 +#define CONF_R_VARIABLE_EXPANSION_TOO_LONG 116 +#define CONF_R_VARIABLE_HAS_NO_VALUE 104 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/crypto.h b/curl/include/openssl/crypto.h new file mode 100644 index 0000000..b4230f1 --- /dev/null +++ b/curl/include/openssl/crypto.h @@ -0,0 +1,458 @@ +/* $OpenBSD: crypto.h,v 1.79 2025/03/09 15:29:56 tb Exp $ */ +/* ==================================================================== + * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ +/* ==================================================================== + * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. + * ECDH support in OpenSSL originally developed by + * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. + */ + +#include +#include +#include +#include + +#ifndef HEADER_CRYPTO_H +#define HEADER_CRYPTO_H + +#include + +#include +#include +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* Backward compatibility to SSLeay */ +/* This is more to be used to check the correct DLL is being used + * in the MS world. */ +#define SSLEAY_VERSION_NUMBER OPENSSL_VERSION_NUMBER +#define SSLEAY_VERSION 0 +/* #define SSLEAY_OPTIONS 1 no longer supported */ +#define SSLEAY_CFLAGS 2 +#define SSLEAY_BUILT_ON 3 +#define SSLEAY_PLATFORM 4 +#define SSLEAY_DIR 5 + +/* When changing the CRYPTO_LOCK_* list, be sure to maintain the text lock + * names in cryptlib.c + */ + +#define CRYPTO_LOCK_ERR 1 +#define CRYPTO_LOCK_EX_DATA 2 +#define CRYPTO_LOCK_X509 3 +#define CRYPTO_LOCK_X509_INFO 4 +#define CRYPTO_LOCK_X509_PKEY 5 +#define CRYPTO_LOCK_X509_CRL 6 +#define CRYPTO_LOCK_X509_REQ 7 +#define CRYPTO_LOCK_DSA 8 +#define CRYPTO_LOCK_RSA 9 +#define CRYPTO_LOCK_EVP_PKEY 10 +#define CRYPTO_LOCK_X509_STORE 11 +#define CRYPTO_LOCK_SSL_CTX 12 +#define CRYPTO_LOCK_SSL_CERT 13 +#define CRYPTO_LOCK_SSL_SESSION 14 +#define CRYPTO_LOCK_SSL_SESS_CERT 15 +#define CRYPTO_LOCK_SSL 16 +#define CRYPTO_LOCK_SSL_METHOD 17 +#define CRYPTO_LOCK_RAND 18 +#define CRYPTO_LOCK_RAND2 19 +#define CRYPTO_LOCK_MALLOC 20 +#define CRYPTO_LOCK_BIO 21 +#define CRYPTO_LOCK_GETHOSTBYNAME 22 +#define CRYPTO_LOCK_GETSERVBYNAME 23 +#define CRYPTO_LOCK_READDIR 24 +#define CRYPTO_LOCK_RSA_BLINDING 25 +#define CRYPTO_LOCK_DH 26 +#define CRYPTO_LOCK_MALLOC2 27 +#define CRYPTO_LOCK_DSO 28 +#define CRYPTO_LOCK_DYNLOCK 29 +#define CRYPTO_LOCK_ENGINE 30 +#define CRYPTO_LOCK_UI 31 +#define CRYPTO_LOCK_ECDSA 32 +#define CRYPTO_LOCK_EC 33 +#define CRYPTO_LOCK_ECDH 34 +#define CRYPTO_LOCK_BN 35 +#define CRYPTO_LOCK_EC_PRE_COMP 36 +#define CRYPTO_LOCK_STORE 37 +#define CRYPTO_LOCK_COMP 38 +#define CRYPTO_LOCK_FIPS 39 +#define CRYPTO_LOCK_FIPS2 40 +#define CRYPTO_NUM_LOCKS 41 + +#define CRYPTO_LOCK 1 +#define CRYPTO_UNLOCK 2 +#define CRYPTO_READ 4 +#define CRYPTO_WRITE 8 + +#ifndef CRYPTO_w_lock +#define CRYPTO_w_lock(type) \ + CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,OPENSSL_FILE,OPENSSL_LINE) +#define CRYPTO_w_unlock(type) \ + CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,OPENSSL_FILE,OPENSSL_LINE) +#define CRYPTO_r_lock(type) \ + CRYPTO_lock(CRYPTO_LOCK|CRYPTO_READ,type,OPENSSL_FILE,OPENSSL_LINE) +#define CRYPTO_r_unlock(type) \ + CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_READ,type,OPENSSL_FILE,OPENSSL_LINE) +#define CRYPTO_add(addr,amount,type) \ + CRYPTO_add_lock(addr,amount,type,OPENSSL_FILE,OPENSSL_LINE) +#endif + +/* Some applications as well as some parts of OpenSSL need to allocate + and deallocate locks in a dynamic fashion. The following typedef + makes this possible in a type-safe manner. */ +/* struct CRYPTO_dynlock_value has to be defined by the application. */ +typedef struct { + int references; + struct CRYPTO_dynlock_value *data; +} CRYPTO_dynlock; + + +/* The following can be used to detect memory leaks in the SSLeay library. + * It used, it turns on malloc checking */ + +#define CRYPTO_MEM_CHECK_OFF 0x0 /* an enume */ +#define CRYPTO_MEM_CHECK_ON 0x1 /* a bit */ +#define CRYPTO_MEM_CHECK_ENABLE 0x2 /* a bit */ +#define CRYPTO_MEM_CHECK_DISABLE 0x3 /* an enume */ + +/* The following are bit values to turn on or off options connected to the + * malloc checking functionality */ + +/* Adds time to the memory checking information */ +#define V_CRYPTO_MDEBUG_TIME 0x1 /* a bit */ +/* Adds thread number to the memory checking information */ +#define V_CRYPTO_MDEBUG_THREAD 0x2 /* a bit */ + +#define V_CRYPTO_MDEBUG_ALL (V_CRYPTO_MDEBUG_TIME | V_CRYPTO_MDEBUG_THREAD) + + +/* predec of the BIO type */ +typedef struct bio_st BIO_dummy; + +struct crypto_ex_data_st { + void *sk; +}; +DECLARE_STACK_OF(void) + +#define CRYPTO_EX_INDEX_SSL 0 +#define CRYPTO_EX_INDEX_SSL_CTX 1 +#define CRYPTO_EX_INDEX_SSL_SESSION 2 +#define CRYPTO_EX_INDEX_APP 3 +#define CRYPTO_EX_INDEX_BIO 4 +#define CRYPTO_EX_INDEX_DH 5 +#define CRYPTO_EX_INDEX_DSA 6 +#define CRYPTO_EX_INDEX_EC_KEY 7 +#define CRYPTO_EX_INDEX_ENGINE 8 +#define CRYPTO_EX_INDEX_RSA 9 +#define CRYPTO_EX_INDEX_UI 10 +#define CRYPTO_EX_INDEX_UI_METHOD 11 +#define CRYPTO_EX_INDEX_X509 12 +#define CRYPTO_EX_INDEX_X509_STORE 13 +#define CRYPTO_EX_INDEX_X509_STORE_CTX 14 +#define CRYPTO_EX_INDEX__COUNT 15 + +#ifndef LIBRESSL_INTERNAL +#define CRYPTO_malloc_init() (0) +#define CRYPTO_malloc_debug_init() (0) +#endif /* LIBRESSL_INTERNAL */ + +#if defined CRYPTO_MDEBUG_ALL || defined CRYPTO_MDEBUG_TIME || defined CRYPTO_MDEBUG_THREAD +# ifndef CRYPTO_MDEBUG /* avoid duplicate #define */ +# define CRYPTO_MDEBUG +# endif +#endif + +int CRYPTO_mem_ctrl(int mode); + +#define OPENSSL_malloc(num) CRYPTO_malloc((num),OPENSSL_FILE,OPENSSL_LINE) +#define OPENSSL_strdup(str) CRYPTO_strdup((str),OPENSSL_FILE,OPENSSL_LINE) +#define OPENSSL_free(addr) CRYPTO_free((addr),OPENSSL_FILE,OPENSSL_LINE) + +const char *OpenSSL_version(int type); +#define OPENSSL_VERSION 0 +#define OPENSSL_CFLAGS 1 +#define OPENSSL_BUILT_ON 2 +#define OPENSSL_PLATFORM 3 +#define OPENSSL_DIR 4 +#define OPENSSL_ENGINES_DIR 5 +unsigned long OpenSSL_version_num(void); + +const char *SSLeay_version(int type); +unsigned long SSLeay(void); + +/* Within a given class, get/register a new index */ +int CRYPTO_get_ex_new_index(int class_index, long argl, void *argp, + CRYPTO_EX_new *new_func, CRYPTO_EX_dup *dup_func, + CRYPTO_EX_free *free_func); +/* Initialise/duplicate/free CRYPTO_EX_DATA variables corresponding to a given + * class (invokes whatever per-class callbacks are applicable) */ +int CRYPTO_new_ex_data(int class_index, void *obj, CRYPTO_EX_DATA *ad); +int CRYPTO_dup_ex_data(int class_index, CRYPTO_EX_DATA *to, + CRYPTO_EX_DATA *from); +void CRYPTO_free_ex_data(int class_index, void *obj, CRYPTO_EX_DATA *ad); +/* Get/set data in a CRYPTO_EX_DATA variable corresponding to a particular index + * (relative to the class type involved) */ +int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int idx, void *val); +void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx); +/* This function cleans up all "ex_data" state. It mustn't be called under + * potential race-conditions. */ +void CRYPTO_cleanup_all_ex_data(void); + +void CRYPTO_lock(int mode, int type, const char *file, int line); +int CRYPTO_add_lock(int *pointer, int amount, int type, const char *file, + int line); + +/* Don't use this structure directly. */ +typedef struct crypto_threadid_st CRYPTO_THREADID; + +/* These functions are deprecated no-op stubs */ +void CRYPTO_set_id_callback(unsigned long (*func)(void)); +unsigned long (*CRYPTO_get_id_callback(void))(void); +unsigned long CRYPTO_thread_id(void); + +int CRYPTO_get_new_lockid(char *name); +const char *CRYPTO_get_lock_name(int type); + +int CRYPTO_num_locks(void); +void CRYPTO_set_locking_callback(void (*func)(int mode, int type, + const char *file, int line)); +void (*CRYPTO_get_locking_callback(void))(int mode, int type, + const char *file, int line); +void CRYPTO_set_add_lock_callback(int (*func)(int *num, int mount, int type, + const char *file, int line)); +int (*CRYPTO_get_add_lock_callback(void))(int *num, int mount, int type, + const char *file, int line); + +void CRYPTO_THREADID_set_numeric(CRYPTO_THREADID *id, unsigned long val); +void CRYPTO_THREADID_set_pointer(CRYPTO_THREADID *id, void *ptr); +int CRYPTO_THREADID_set_callback(void (*threadid_func)(CRYPTO_THREADID *)); +void (*CRYPTO_THREADID_get_callback(void))(CRYPTO_THREADID *); + +int CRYPTO_get_new_dynlockid(void); +void CRYPTO_destroy_dynlockid(int i); +struct CRYPTO_dynlock_value *CRYPTO_get_dynlock_value(int i); +void CRYPTO_set_dynlock_create_callback(struct CRYPTO_dynlock_value *(*dyn_create_function)(const char *file, int line)); +void CRYPTO_set_dynlock_lock_callback(void (*dyn_lock_function)(int mode, struct CRYPTO_dynlock_value *l, const char *file, int line)); +void CRYPTO_set_dynlock_destroy_callback(void (*dyn_destroy_function)(struct CRYPTO_dynlock_value *l, const char *file, int line)); +struct CRYPTO_dynlock_value *(*CRYPTO_get_dynlock_create_callback(void))(const char *file, int line); +void (*CRYPTO_get_dynlock_lock_callback(void))(int mode, struct CRYPTO_dynlock_value *l, const char *file, int line); +void (*CRYPTO_get_dynlock_destroy_callback(void))(struct CRYPTO_dynlock_value *l, const char *file, int line); + +int CRYPTO_set_mem_functions(void *(*m)(size_t, const char *, int), + void *(*r)(void *, size_t, const char *, int), + void (*f)(void *, const char *, int)); + +void *CRYPTO_malloc(size_t num, const char *file, int line); +char *CRYPTO_strdup(const char *str, const char *file, int line); +void CRYPTO_free(void *ptr, const char *file, int line); + +void OPENSSL_cleanse(void *ptr, size_t len); + +/* + * Because this is a public header, use a portable method of indicating the + * function does not return, rather than __dead. + */ +#ifdef _MSC_VER +__declspec(noreturn) +#else +__attribute__((__noreturn__)) +#endif +void OpenSSLDie(const char *file, int line, const char *assertion); +#define OPENSSL_assert(e) (void)((e) ? 0 : (OpenSSLDie(OPENSSL_FILE, OPENSSL_LINE, #e),1)) + +int FIPS_mode(void); +int FIPS_mode_set(int r); + +void OPENSSL_init(void); + +/* CRYPTO_memcmp returns zero iff the |len| bytes at |a| and |b| are equal. It + * takes an amount of time dependent on |len|, but independent of the contents + * of |a| and |b|. Unlike memcmp, it cannot be used to put elements into a + * defined order as the return value when a != b is undefined, other than to be + * non-zero. */ +int CRYPTO_memcmp(const void *a, const void *b, size_t len); + +/* + * OpenSSL compatible OPENSSL_INIT options. + */ + +#define OPENSSL_INIT_NO_LOAD_CONFIG 0x00000001L +#define OPENSSL_INIT_LOAD_CONFIG 0x00000002L + +/* LibreSSL specific */ +#define _OPENSSL_INIT_FLAG_NOOP 0x80000000L + +/* + * These are provided for compatibility, but have no effect + * on how LibreSSL is initialized. + */ +#define OPENSSL_INIT_NO_LOAD_CRYPTO_STRINGS _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_LOAD_CRYPTO_STRINGS _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_ADD_ALL_CIPHERS _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_ADD_ALL_DIGESTS _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_NO_ADD_ALL_CIPHERS _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_NO_ADD_ALL_DIGESTS _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_ASYNC _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_ENGINE_RDRAND _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_ENGINE_DYNAMIC _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_ENGINE_OPENSSL _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_ENGINE_CRYPTODEV _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_ENGINE_CAPI _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_ENGINE_PADLOCK _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_ENGINE_AFALG _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_reserved_internal _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_ATFORK _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_ENGINE_ALL_BUILTIN _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_NO_ATEXIT _OPENSSL_INIT_FLAG_NOOP + +int OPENSSL_init_crypto(uint64_t opts, const void *settings); +void OPENSSL_cleanup(void); + +/* + * CPU capabilities. + */ +#define CRYPTO_CPU_CAPS_ACCELERATED_AES 0x00000001ULL + +uint64_t OPENSSL_cpu_caps(void); + +/* + * OpenSSL helpfully put OPENSSL_gmtime() here because all other time related + * functions are in asn1.h. + */ +struct tm *OPENSSL_gmtime(const time_t *time, struct tm *out_tm); + +void ERR_load_CRYPTO_strings(void); + +/* Error codes for the CRYPTO functions. */ + +/* Function codes. */ +#define CRYPTO_F_CRYPTO_GET_EX_NEW_INDEX 100 +#define CRYPTO_F_CRYPTO_GET_NEW_DYNLOCKID 103 +#define CRYPTO_F_CRYPTO_GET_NEW_LOCKID 101 +#define CRYPTO_F_CRYPTO_SET_EX_DATA 102 +#define CRYPTO_F_DEF_ADD_INDEX 104 +#define CRYPTO_F_DEF_GET_CLASS 105 +#define CRYPTO_F_FIPS_MODE_SET 109 +#define CRYPTO_F_INT_DUP_EX_DATA 106 +#define CRYPTO_F_INT_FREE_EX_DATA 107 +#define CRYPTO_F_INT_NEW_EX_DATA 108 + +/* Reason codes. */ +#define CRYPTO_R_FIPS_MODE_NOT_SUPPORTED 101 +#define CRYPTO_R_NO_DYNLOCK_CREATE_CALLBACK 100 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/ct.h b/curl/include/openssl/ct.h new file mode 100644 index 0000000..db5cf28 --- /dev/null +++ b/curl/include/openssl/ct.h @@ -0,0 +1,567 @@ +/* $OpenBSD: ct.h,v 1.8 2024/08/08 23:50:29 tb Exp $ */ +/* + * Public API for Certificate Transparency (CT). + * Written by Rob Percival (robpercival@google.com) for the OpenSSL project. + */ +/* ==================================================================== + * Copyright (c) 2016 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + */ + +#ifndef HEADER_CT_H +#define HEADER_CT_H + +#include + +#ifndef OPENSSL_NO_CT +#include +#include +#include +#ifdef __cplusplus +extern "C" { +#endif + +/* Minimum RSA key size, from RFC6962 */ +#define SCT_MIN_RSA_BITS 2048 + +/* All hashes are SHA256 in v1 of Certificate Transparency */ +#define CT_V1_HASHLEN SHA256_DIGEST_LENGTH + +typedef enum { + CT_LOG_ENTRY_TYPE_NOT_SET = -1, + CT_LOG_ENTRY_TYPE_X509 = 0, + CT_LOG_ENTRY_TYPE_PRECERT = 1 +} ct_log_entry_type_t; + +typedef enum { + SCT_VERSION_NOT_SET = -1, + SCT_VERSION_V1 = 0 +} sct_version_t; + +typedef enum { + SCT_SOURCE_UNKNOWN, + SCT_SOURCE_TLS_EXTENSION, + SCT_SOURCE_X509V3_EXTENSION, + SCT_SOURCE_OCSP_STAPLED_RESPONSE +} sct_source_t; + +typedef enum { + SCT_VALIDATION_STATUS_NOT_SET, + SCT_VALIDATION_STATUS_UNKNOWN_LOG, + SCT_VALIDATION_STATUS_VALID, + SCT_VALIDATION_STATUS_INVALID, + SCT_VALIDATION_STATUS_UNVERIFIED, + SCT_VALIDATION_STATUS_UNKNOWN_VERSION +} sct_validation_status_t; + +DECLARE_STACK_OF(SCT) +DECLARE_STACK_OF(CTLOG) + +/****************************************** + * CT policy evaluation context functions * + ******************************************/ + +/* + * Creates a new, empty policy evaluation context. + * The caller is responsible for calling CT_POLICY_EVAL_CTX_free when finished + * with the CT_POLICY_EVAL_CTX. + */ +CT_POLICY_EVAL_CTX *CT_POLICY_EVAL_CTX_new(void); + +/* Deletes a policy evaluation context and anything it owns. */ +void CT_POLICY_EVAL_CTX_free(CT_POLICY_EVAL_CTX *ctx); + +/* Gets the peer certificate that the SCTs are for */ +X509 *CT_POLICY_EVAL_CTX_get0_cert(const CT_POLICY_EVAL_CTX *ctx); + +/* + * Sets the certificate associated with the received SCTs. + * Increments the reference count of cert. + * Returns 1 on success, 0 otherwise. + */ +int CT_POLICY_EVAL_CTX_set1_cert(CT_POLICY_EVAL_CTX *ctx, X509 *cert); + +/* Gets the issuer of the aforementioned certificate */ +X509 *CT_POLICY_EVAL_CTX_get0_issuer(const CT_POLICY_EVAL_CTX *ctx); + +/* + * Sets the issuer of the certificate associated with the received SCTs. + * Increments the reference count of issuer. + * Returns 1 on success, 0 otherwise. + */ +int CT_POLICY_EVAL_CTX_set1_issuer(CT_POLICY_EVAL_CTX *ctx, X509 *issuer); + +/* Gets the CT logs that are trusted sources of SCTs */ +const CTLOG_STORE *CT_POLICY_EVAL_CTX_get0_log_store(const CT_POLICY_EVAL_CTX *ctx); + +/* Sets the log store that is in use. It must outlive the CT_POLICY_EVAL_CTX. */ +void CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(CT_POLICY_EVAL_CTX *ctx, + CTLOG_STORE *log_store); + +/* + * Gets the time, in milliseconds since the Unix epoch, that will be used as the + * current time when checking whether an SCT was issued in the future. + * Such SCTs will fail validation, as required by RFC6962. + */ +uint64_t CT_POLICY_EVAL_CTX_get_time(const CT_POLICY_EVAL_CTX *ctx); + +/* + * Sets the time to evaluate SCTs against, in milliseconds since the Unix epoch. + * If an SCT's timestamp is after this time, it will be interpreted as having + * been issued in the future. RFC6962 states that "TLS clients MUST reject SCTs + * whose timestamp is in the future", so an SCT will not validate in this case. + */ +void CT_POLICY_EVAL_CTX_set_time(CT_POLICY_EVAL_CTX *ctx, uint64_t time_in_ms); + +/***************** + * SCT functions * + *****************/ + +/* + * Creates a new, blank SCT. + * The caller is responsible for calling SCT_free when finished with the SCT. + */ +SCT *SCT_new(void); + +/* + * Creates a new SCT from some base64-encoded strings. + * The caller is responsible for calling SCT_free when finished with the SCT. + */ +SCT *SCT_new_from_base64(unsigned char version, const char *logid_base64, + ct_log_entry_type_t entry_type, uint64_t timestamp, + const char *extensions_base64, const char *signature_base64); + +/* + * Frees the SCT and the underlying data structures. + */ +void SCT_free(SCT *sct); + +/* + * Free a stack of SCTs, and the underlying SCTs themselves. + * Intended to be compatible with X509V3_EXT_FREE. + */ +void SCT_LIST_free(STACK_OF(SCT) *a); + +/* + * Returns the version of the SCT. + */ +sct_version_t SCT_get_version(const SCT *sct); + +/* + * Set the version of an SCT. + * Returns 1 on success, 0 if the version is unrecognized. + */ +int SCT_set_version(SCT *sct, sct_version_t version); + +/* + * Returns the log entry type of the SCT. + */ +ct_log_entry_type_t SCT_get_log_entry_type(const SCT *sct); + +/* + * Set the log entry type of an SCT. + * Returns 1 on success, 0 otherwise. + */ +int SCT_set_log_entry_type(SCT *sct, ct_log_entry_type_t entry_type); + +/* + * Gets the ID of the log that an SCT came from. + * Ownership of the log ID remains with the SCT. + * Returns the length of the log ID. + */ +size_t SCT_get0_log_id(const SCT *sct, unsigned char **log_id); + +/* + * Set the log ID of an SCT to point directly to the *log_id specified. + * The SCT takes ownership of the specified pointer. + * Returns 1 on success, 0 otherwise. + */ +int SCT_set0_log_id(SCT *sct, unsigned char *log_id, size_t log_id_len); + +/* + * Set the log ID of an SCT. + * This makes a copy of the log_id. + * Returns 1 on success, 0 otherwise. + */ +int SCT_set1_log_id(SCT *sct, const unsigned char *log_id, + size_t log_id_len); + +/* + * Returns the timestamp for the SCT (epoch time in milliseconds). + */ +uint64_t SCT_get_timestamp(const SCT *sct); + +/* + * Set the timestamp of an SCT (epoch time in milliseconds). + */ +void SCT_set_timestamp(SCT *sct, uint64_t timestamp); + +/* + * Return the NID for the signature used by the SCT. + * For CT v1, this will be either NID_sha256WithRSAEncryption or + * NID_ecdsa_with_SHA256 (or NID_undef if incorrect/unset). + */ +int SCT_get_signature_nid(const SCT *sct); + +/* + * Set the signature type of an SCT + * For CT v1, this should be either NID_sha256WithRSAEncryption or + * NID_ecdsa_with_SHA256. + * Returns 1 on success, 0 otherwise. + */ +int SCT_set_signature_nid(SCT *sct, int nid); + +/* + * Set *ext to point to the extension data for the SCT. ext must not be NULL. + * The SCT retains ownership of this pointer. + * Returns length of the data pointed to. + */ +size_t SCT_get0_extensions(const SCT *sct, unsigned char **ext); + +/* + * Set the extensions of an SCT to point directly to the *ext specified. + * The SCT takes ownership of the specified pointer. + */ +void SCT_set0_extensions(SCT *sct, unsigned char *ext, size_t ext_len); + +/* + * Set the extensions of an SCT. + * This takes a copy of the ext. + * Returns 1 on success, 0 otherwise. + */ +int SCT_set1_extensions(SCT *sct, const unsigned char *ext, + size_t ext_len); + +/* + * Set *sig to point to the signature for the SCT. sig must not be NULL. + * The SCT retains ownership of this pointer. + * Returns length of the data pointed to. + */ +size_t SCT_get0_signature(const SCT *sct, unsigned char **sig); + +/* + * Set the signature of an SCT to point directly to the *sig specified. + * The SCT takes ownership of the specified pointer. + */ +void SCT_set0_signature(SCT *sct, unsigned char *sig, size_t sig_len); + +/* + * Set the signature of an SCT to be a copy of the *sig specified. + * Returns 1 on success, 0 otherwise. + */ +int SCT_set1_signature(SCT *sct, const unsigned char *sig, + size_t sig_len); + +/* + * The origin of this SCT, e.g. TLS extension, OCSP response, etc. + */ +sct_source_t SCT_get_source(const SCT *sct); + +/* + * Set the origin of this SCT, e.g. TLS extension, OCSP response, etc. + * Returns 1 on success, 0 otherwise. + */ +int SCT_set_source(SCT *sct, sct_source_t source); + +/* + * Returns a text string describing the validation status of |sct|. + */ +const char *SCT_validation_status_string(const SCT *sct); + +/* + * Pretty-prints an |sct| to |out|. + * It will be indented by the number of spaces specified by |indent|. + * If |logs| is not NULL, it will be used to lookup the CT log that the SCT came + * from, so that the log name can be printed. + */ +void SCT_print(const SCT *sct, BIO *out, int indent, const CTLOG_STORE *logs); + +/* + * Pretty-prints an |sct_list| to |out|. + * It will be indented by the number of spaces specified by |indent|. + * SCTs will be delimited by |separator|. + * If |logs| is not NULL, it will be used to lookup the CT log that each SCT + * came from, so that the log names can be printed. + */ +void SCT_LIST_print(const STACK_OF(SCT) *sct_list, BIO *out, int indent, + const char *separator, const CTLOG_STORE *logs); + +/* + * Gets the last result of validating this SCT. + * If it has not been validated yet, returns SCT_VALIDATION_STATUS_NOT_SET. + */ +sct_validation_status_t SCT_get_validation_status(const SCT *sct); + +/* + * Validates the given SCT with the provided context. + * Sets the "validation_status" field of the SCT. + * Returns 1 if the SCT is valid and the signature verifies. + * Returns 0 if the SCT is invalid or could not be verified. + * Returns -1 if an error occurs. + */ +int SCT_validate(SCT *sct, const CT_POLICY_EVAL_CTX *ctx); + +/* + * Validates the given list of SCTs with the provided context. + * Sets the "validation_status" field of each SCT. + * Returns 1 if there are no invalid SCTs and all signatures verify. + * Returns 0 if at least one SCT is invalid or could not be verified. + * Returns a negative integer if an error occurs. + */ +int SCT_LIST_validate(const STACK_OF(SCT) *scts, + CT_POLICY_EVAL_CTX *ctx); + + +/********************************* + * SCT parsing and serialisation * + *********************************/ + +/* + * Serialize (to TLS format) a stack of SCTs and return the length. + * "a" must not be NULL. + * If "pp" is NULL, just return the length of what would have been serialized. + * If "pp" is not NULL and "*pp" is null, function will allocate a new pointer + * for data that caller is responsible for freeing (only if function returns + * successfully). + * If "pp" is NULL and "*pp" is not NULL, caller is responsible for ensuring + * that "*pp" is large enough to accept all of the serialized data. + * Returns < 0 on error, >= 0 indicating bytes written (or would have been) + * on success. + */ +int i2o_SCT_LIST(const STACK_OF(SCT) *a, unsigned char **pp); + +/* + * Convert TLS format SCT list to a stack of SCTs. + * If "a" or "*a" is NULL, a new stack will be created that the caller is + * responsible for freeing (by calling SCT_LIST_free). + * "**pp" and "*pp" must not be NULL. + * Upon success, "*pp" will point to after the last bytes read, and a stack + * will be returned. + * Upon failure, a NULL pointer will be returned, and the position of "*pp" is + * not defined. + */ +STACK_OF(SCT) *o2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp, + size_t len); + +/* + * Serialize (to DER format) a stack of SCTs and return the length. + * "a" must not be NULL. + * If "pp" is NULL, just returns the length of what would have been serialized. + * If "pp" is not NULL and "*pp" is null, function will allocate a new pointer + * for data that caller is responsible for freeing (only if function returns + * successfully). + * If "pp" is NULL and "*pp" is not NULL, caller is responsible for ensuring + * that "*pp" is large enough to accept all of the serialized data. + * Returns < 0 on error, >= 0 indicating bytes written (or would have been) + * on success. + */ +int i2d_SCT_LIST(const STACK_OF(SCT) *a, unsigned char **pp); + +/* + * Parses an SCT list in DER format and returns it. + * If "a" or "*a" is NULL, a new stack will be created that the caller is + * responsible for freeing (by calling SCT_LIST_free). + * "**pp" and "*pp" must not be NULL. + * Upon success, "*pp" will point to after the last bytes read, and a stack + * will be returned. + * Upon failure, a NULL pointer will be returned, and the position of "*pp" is + * not defined. + */ +STACK_OF(SCT) *d2i_SCT_LIST(STACK_OF(SCT) **a, const unsigned char **pp, + long len); + +/* + * Serialize (to TLS format) an |sct| and write it to |out|. + * If |out| is null, no SCT will be output but the length will still be returned. + * If |out| points to a null pointer, a string will be allocated to hold the + * TLS-format SCT. It is the responsibility of the caller to free it. + * If |out| points to an allocated string, the TLS-format SCT will be written + * to it. + * The length of the SCT in TLS format will be returned. + */ +int i2o_SCT(const SCT *sct, unsigned char **out); + +/* + * Parses an SCT in TLS format and returns it. + * If |psct| is not null, it will end up pointing to the parsed SCT. If it + * already points to a non-null pointer, the pointer will be free'd. + * |in| should be a pointer to a string containing the TLS-format SCT. + * |in| will be advanced to the end of the SCT if parsing succeeds. + * |len| should be the length of the SCT in |in|. + * Returns NULL if an error occurs. + * If the SCT is an unsupported version, only the SCT's 'sct' and 'sct_len' + * fields will be populated (with |in| and |len| respectively). + */ +SCT *o2i_SCT(SCT **psct, const unsigned char **in, size_t len); + +/******************** + * CT log functions * + ********************/ + +/* + * Creates a new CT log instance with the given |public_key| and |name|. + * Takes ownership of |public_key| but copies |name|. + * Returns NULL if malloc fails or if |public_key| cannot be converted to DER. + * Should be deleted by the caller using CTLOG_free when no longer needed. + */ +CTLOG *CTLOG_new(EVP_PKEY *public_key, const char *name); + +/* + * Creates a new CTLOG instance with the base64-encoded SubjectPublicKeyInfo DER + * in |pkey_base64|. The |name| is a string to help users identify this log. + * Returns 1 on success, 0 on failure. + * Should be deleted by the caller using CTLOG_free when no longer needed. + */ +int CTLOG_new_from_base64(CTLOG **ct_log, const char *pkey_base64, + const char *name); + +/* + * Deletes a CT log instance and its fields. + */ +void CTLOG_free(CTLOG *log); + +/* Gets the name of the CT log */ +const char *CTLOG_get0_name(const CTLOG *log); +/* Gets the ID of the CT log */ +void CTLOG_get0_log_id(const CTLOG *log, const uint8_t **log_id, + size_t *log_id_len); +/* Gets the public key of the CT log */ +EVP_PKEY *CTLOG_get0_public_key(const CTLOG *log); + +/************************** + * CT log store functions * + **************************/ + +/* + * Creates a new CT log store. + * Should be deleted by the caller using CTLOG_STORE_free when no longer needed. + */ +CTLOG_STORE *CTLOG_STORE_new(void); + +/* + * Deletes a CT log store and all of the CT log instances held within. + */ +void CTLOG_STORE_free(CTLOG_STORE *store); + +/* + * Finds a CT log in the store based on its log ID. + * Returns the CT log, or NULL if no match is found. + */ +const CTLOG *CTLOG_STORE_get0_log_by_id(const CTLOG_STORE *store, + const uint8_t *log_id, size_t log_id_len); + +/* + * Loads a CT log list into a |store| from a |file|. + * Returns 1 if loading is successful, or 0 otherwise. + */ +int CTLOG_STORE_load_file(CTLOG_STORE *store, const char *file); + +/* + * Loads the default CT log list into a |store|. + * Returns 1 if loading is successful, or 0 otherwise. + */ +int CTLOG_STORE_load_default_file(CTLOG_STORE *store); + +int ERR_load_CT_strings(void); + +/* + * CT function codes. + */ +# define CT_F_CTLOG_NEW 117 +# define CT_F_CTLOG_NEW_FROM_BASE64 118 +# define CT_F_CTLOG_NEW_FROM_CONF 119 +# define CT_F_CTLOG_STORE_LOAD_CTX_NEW 122 +# define CT_F_CTLOG_STORE_LOAD_FILE 123 +# define CT_F_CTLOG_STORE_LOAD_LOG 130 +# define CT_F_CTLOG_STORE_NEW 131 +# define CT_F_CT_BASE64_DECODE 124 +# define CT_F_CT_POLICY_EVAL_CTX_NEW 133 +# define CT_F_CT_V1_LOG_ID_FROM_PKEY 125 +# define CT_F_I2O_SCT 107 +# define CT_F_I2O_SCT_LIST 108 +# define CT_F_I2O_SCT_SIGNATURE 109 +# define CT_F_O2I_SCT 110 +# define CT_F_O2I_SCT_LIST 111 +# define CT_F_O2I_SCT_SIGNATURE 112 +# define CT_F_SCT_CTX_NEW 126 +# define CT_F_SCT_CTX_VERIFY 128 +# define CT_F_SCT_NEW 100 +# define CT_F_SCT_NEW_FROM_BASE64 127 +# define CT_F_SCT_SET0_LOG_ID 101 +# define CT_F_SCT_SET1_EXTENSIONS 114 +# define CT_F_SCT_SET1_LOG_ID 115 +# define CT_F_SCT_SET1_SIGNATURE 116 +# define CT_F_SCT_SET_LOG_ENTRY_TYPE 102 +# define CT_F_SCT_SET_SIGNATURE_NID 103 +# define CT_F_SCT_SET_VERSION 104 + +/* + * CT reason codes. + */ +# define CT_R_BASE64_DECODE_ERROR 108 +# define CT_R_INVALID_LOG_ID_LENGTH 100 +# define CT_R_LOG_CONF_INVALID 109 +# define CT_R_LOG_CONF_INVALID_KEY 110 +# define CT_R_LOG_CONF_MISSING_DESCRIPTION 111 +# define CT_R_LOG_CONF_MISSING_KEY 112 +# define CT_R_LOG_KEY_INVALID 113 +# define CT_R_SCT_FUTURE_TIMESTAMP 116 +# define CT_R_SCT_INVALID 104 +# define CT_R_SCT_INVALID_SIGNATURE 107 +# define CT_R_SCT_LIST_INVALID 105 +# define CT_R_SCT_LOG_ID_MISMATCH 114 +# define CT_R_SCT_NOT_SET 106 +# define CT_R_SCT_UNSUPPORTED_VERSION 115 +# define CT_R_UNRECOGNIZED_SIGNATURE_NID 101 +# define CT_R_UNSUPPORTED_ENTRY_TYPE 102 +# define CT_R_UNSUPPORTED_VERSION 103 + +#ifdef __cplusplus +} +#endif +#endif +#endif diff --git a/curl/include/openssl/curve25519.h b/curl/include/openssl/curve25519.h new file mode 100644 index 0000000..e42bc22 --- /dev/null +++ b/curl/include/openssl/curve25519.h @@ -0,0 +1,104 @@ +/* $OpenBSD: curve25519.h,v 1.7 2022/11/13 14:05:04 tb Exp $ */ +/* + * Copyright (c) 2015, Google Inc. + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY + * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION + * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN + * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef HEADER_CURVE25519_H +#define HEADER_CURVE25519_H + +#include + +#include + +#if defined(__cplusplus) +extern "C" { +#endif + +/* + * Curve25519. + * + * Curve25519 is an elliptic curve. See https://tools.ietf.org/html/rfc7748. + */ + +/* + * X25519. + * + * X25519 is the Diffie-Hellman primitive built from curve25519. It is + * sometimes referred to as curve25519, but X25519 is a more precise name. + * See http://cr.yp.to/ecdh.html and https://tools.ietf.org/html/rfc7748. + */ + +#define X25519_KEY_LENGTH 32 + +/* + * X25519_keypair sets |out_public_value| and |out_private_key| to a freshly + * generated, public/private key pair. + */ +void X25519_keypair(uint8_t out_public_value[X25519_KEY_LENGTH], + uint8_t out_private_key[X25519_KEY_LENGTH]); + +/* + * X25519 writes a shared key to |out_shared_key| that is calculated from the + * given private key and the peer's public value. It returns one on success and + * zero on error. + * + * Don't use the shared key directly, rather use a KDF and also include the two + * public values as inputs. + */ +int X25519(uint8_t out_shared_key[X25519_KEY_LENGTH], + const uint8_t private_key[X25519_KEY_LENGTH], + const uint8_t peers_public_value[X25519_KEY_LENGTH]); + +/* + * ED25519 + * + * Ed25519 is a signature scheme using a twisted Edwards curve that is + * birationally equivalent to curve25519. + */ + +#define ED25519_PRIVATE_KEY_LENGTH 32 +#define ED25519_PUBLIC_KEY_LENGTH 32 +#define ED25519_SIGNATURE_LENGTH 64 + +/* + * ED25519_keypair sets |out_public_key| and |out_private_key| to a freshly + * generated, public/private key pair. + */ +void ED25519_keypair(uint8_t out_public_key[ED25519_PUBLIC_KEY_LENGTH], + uint8_t out_private_key[ED25519_PRIVATE_KEY_LENGTH]); + +/* + * ED25519_sign sets |out_sig| to be a signature of |message_len| bytes from + * |message| using |public_key| and |private_key|. It returns one on success + * or zero on allocation failure. + */ +int ED25519_sign(uint8_t *out_sig, const uint8_t *message, size_t message_len, + const uint8_t public_key[ED25519_PUBLIC_KEY_LENGTH], + const uint8_t private_key_seed[ED25519_PRIVATE_KEY_LENGTH]); + +/* + * ED25519_verify returns one iff |signature| is a valid signature by + * |public_key| of |message_len| bytes from |message|. It returns zero + * otherwise. + */ +int ED25519_verify(const uint8_t *message, size_t message_len, + const uint8_t signature[ED25519_SIGNATURE_LENGTH], + const uint8_t public_key[ED25519_PUBLIC_KEY_LENGTH]); + +#if defined(__cplusplus) +} /* extern C */ +#endif + +#endif /* HEADER_CURVE25519_H */ diff --git a/curl/include/openssl/des.h b/curl/include/openssl/des.h new file mode 100644 index 0000000..2d957a1 --- /dev/null +++ b/curl/include/openssl/des.h @@ -0,0 +1,206 @@ +/* $OpenBSD: des.h,v 1.23 2025/01/25 17:59:44 tb Exp $ */ +/* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_NEW_DES_H +#define HEADER_NEW_DES_H + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +typedef unsigned char DES_cblock[8]; +typedef /* const */ unsigned char const_DES_cblock[8]; +/* With "const", gcc 2.8.1 on Solaris thinks that DES_cblock * + * and const_DES_cblock * are incompatible pointer types. */ + +typedef struct DES_ks { + union { + DES_cblock cblock; + /* make sure things are correct size on machines with + * 8 byte longs */ + DES_LONG deslong[2]; + } ks[16]; +} DES_key_schedule; + +#define DES_KEY_SZ (sizeof(DES_cblock)) +#define DES_SCHEDULE_SZ (sizeof(DES_key_schedule)) + +#define DES_ENCRYPT 1 +#define DES_DECRYPT 0 + +#define DES_CBC_MODE 0 +#define DES_PCBC_MODE 1 + +#define DES_ecb2_encrypt(i,o,k1,k2,e) \ + DES_ecb3_encrypt((i),(o),(k1),(k2),(k1),(e)) + +#define DES_ede2_cbc_encrypt(i,o,l,k1,k2,iv,e) \ + DES_ede3_cbc_encrypt((i),(o),(l),(k1),(k2),(k1),(iv),(e)) + +#define DES_ede2_cfb64_encrypt(i,o,l,k1,k2,iv,n,e) \ + DES_ede3_cfb64_encrypt((i),(o),(l),(k1),(k2),(k1),(iv),(n),(e)) + +#define DES_ede2_ofb64_encrypt(i,o,l,k1,k2,iv,n) \ + DES_ede3_ofb64_encrypt((i),(o),(l),(k1),(k2),(k1),(iv),(n)) + +extern int DES_check_key; /* defaults to false */ + +void DES_ecb3_encrypt(const_DES_cblock *input, DES_cblock *output, + DES_key_schedule *ks1, DES_key_schedule *ks2, + DES_key_schedule *ks3, int enc); +DES_LONG DES_cbc_cksum(const unsigned char *input, DES_cblock *output, + long length, DES_key_schedule *schedule, + const_DES_cblock *ivec); +/* DES_cbc_encrypt does not update the IV! Use DES_ncbc_encrypt instead. */ +void DES_cbc_encrypt(const unsigned char *input, unsigned char *output, + long length, DES_key_schedule *schedule, DES_cblock *ivec, + int enc); +void DES_ncbc_encrypt(const unsigned char *input, unsigned char *output, + long length, DES_key_schedule *schedule, DES_cblock *ivec, + int enc); +void DES_xcbc_encrypt(const unsigned char *input, unsigned char *output, + long length, DES_key_schedule *schedule, DES_cblock *ivec, + const_DES_cblock *inw, const_DES_cblock *outw, int enc); +void DES_cfb_encrypt(const unsigned char *in, unsigned char *out, int numbits, + long length, DES_key_schedule *schedule, DES_cblock *ivec, + int enc); +void DES_ecb_encrypt(const_DES_cblock *input, DES_cblock *output, + DES_key_schedule *ks, int enc); + +/* This is the DES encryption function that gets called by just about + every other DES routine in the library. You should not use this + function except to implement 'modes' of DES. I say this because the + functions that call this routine do the conversion from 'char *' to + long, and this needs to be done to make sure 'non-aligned' memory + access do not occur. The characters are loaded 'little endian'. + Data is a pointer to 2 unsigned long's and ks is the + DES_key_schedule to use. enc, is non zero specifies encryption, + zero if decryption. */ +void DES_encrypt1(DES_LONG *data, DES_key_schedule *ks, int enc); + +/* This functions is the same as DES_encrypt1() except that the DES + initial permutation (IP) and final permutation (FP) have been left + out. As for DES_encrypt1(), you should not use this function. + It is used by the routines in the library that implement triple DES. + IP() DES_encrypt2() DES_encrypt2() DES_encrypt2() FP() is the same + as DES_encrypt1() DES_encrypt1() DES_encrypt1() except faster :-). */ +void DES_encrypt2(DES_LONG *data, DES_key_schedule *ks, int enc); + +void DES_encrypt3(DES_LONG *data, DES_key_schedule *ks1, + DES_key_schedule *ks2, DES_key_schedule *ks3); +void DES_decrypt3(DES_LONG *data, DES_key_schedule *ks1, + DES_key_schedule *ks2, DES_key_schedule *ks3); +void DES_ede3_cbc_encrypt(const unsigned char *input, unsigned char *output, + long length, + DES_key_schedule *ks1, DES_key_schedule *ks2, + DES_key_schedule *ks3, DES_cblock *ivec, int enc); +void DES_ede3_cbcm_encrypt(const unsigned char *in, unsigned char *out, + long length, + DES_key_schedule *ks1, DES_key_schedule *ks2, + DES_key_schedule *ks3, + DES_cblock *ivec1, DES_cblock *ivec2, + int enc); +void DES_ede3_cfb64_encrypt(const unsigned char *in, unsigned char *out, + long length, DES_key_schedule *ks1, + DES_key_schedule *ks2, DES_key_schedule *ks3, + DES_cblock *ivec, int *num, int enc); +void DES_ede3_cfb_encrypt(const unsigned char *in, unsigned char *out, + int numbits, long length, DES_key_schedule *ks1, + DES_key_schedule *ks2, DES_key_schedule *ks3, + DES_cblock *ivec, int enc); +void DES_ede3_ofb64_encrypt(const unsigned char *in, unsigned char *out, + long length, DES_key_schedule *ks1, + DES_key_schedule *ks2, DES_key_schedule *ks3, + DES_cblock *ivec, int *num); +char *DES_fcrypt(const char *buf, const char *salt, char *ret); +char *DES_crypt(const char *buf, const char *salt); +void DES_ofb_encrypt(const unsigned char *in, unsigned char *out, int numbits, + long length, DES_key_schedule *schedule, DES_cblock *ivec); +void DES_pcbc_encrypt(const unsigned char *input, unsigned char *output, + long length, DES_key_schedule *schedule, DES_cblock *ivec, + int enc); +DES_LONG DES_quad_cksum(const unsigned char *input, DES_cblock output[], + long length, int out_count, DES_cblock *seed); +int DES_random_key(DES_cblock *ret); +void DES_set_odd_parity(DES_cblock *key); +int DES_check_key_parity(const_DES_cblock *key); +int DES_is_weak_key(const_DES_cblock *key); +/* DES_set_key (= set_key = DES_key_sched = key_sched) calls + * DES_set_key_checked if global variable DES_check_key is set, + * DES_set_key_unchecked otherwise. */ +int DES_set_key(const_DES_cblock *key, DES_key_schedule *schedule); +int DES_key_sched(const_DES_cblock *key, DES_key_schedule *schedule); +int DES_set_key_checked(const_DES_cblock *key, DES_key_schedule *schedule); +void DES_set_key_unchecked(const_DES_cblock *key, DES_key_schedule *schedule); +void DES_string_to_key(const char *str, DES_cblock *key); +void DES_string_to_2keys(const char *str, DES_cblock *key1, DES_cblock *key2); +void DES_cfb64_encrypt(const unsigned char *in, unsigned char *out, long length, + DES_key_schedule *schedule, DES_cblock *ivec, int *num, + int enc); +void DES_ofb64_encrypt(const unsigned char *in, unsigned char *out, long length, + DES_key_schedule *schedule, DES_cblock *ivec, int *num); + +#define DES_fixup_key_parity DES_set_odd_parity + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/dh.h b/curl/include/openssl/dh.h new file mode 100644 index 0000000..04bda3f --- /dev/null +++ b/curl/include/openssl/dh.h @@ -0,0 +1,245 @@ +/* $OpenBSD: dh.h,v 1.38 2025/01/25 17:59:44 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_DH_H +#define HEADER_DH_H + +#include + +#ifndef OPENSSL_NO_BIO +#include +#endif +#include +#include + +#ifndef OPENSSL_DH_MAX_MODULUS_BITS +# define OPENSSL_DH_MAX_MODULUS_BITS 10000 +#endif + +#define DH_FLAG_CACHE_MONT_P 0x01 + +/* If this flag is set the DH method is FIPS compliant and can be used + * in FIPS mode. This is set in the validated module method. If an + * application sets this flag in its own methods it is its reposibility + * to ensure the result is compliant. + */ + +#define DH_FLAG_FIPS_METHOD 0x0400 + +/* If this flag is set the operations normally disabled in FIPS mode are + * permitted it is then the applications responsibility to ensure that the + * usage is compliant. + */ + +#define DH_FLAG_NON_FIPS_ALLOW 0x0400 + +#ifdef __cplusplus +extern "C" { +#endif + +#define DH_GENERATOR_2 2 +/* #define DH_GENERATOR_3 3 */ +#define DH_GENERATOR_5 5 + +/* DH_check error codes */ +#define DH_CHECK_P_NOT_PRIME 0x01 +#define DH_CHECK_P_NOT_SAFE_PRIME 0x02 +#define DH_UNABLE_TO_CHECK_GENERATOR 0x04 +#define DH_NOT_SUITABLE_GENERATOR 0x08 +#define DH_CHECK_Q_NOT_PRIME 0x10 +#define DH_CHECK_INVALID_Q_VALUE 0x20 +#define DH_CHECK_INVALID_J_VALUE 0x40 + +/* DH_check_pub_key error codes */ +#define DH_CHECK_PUBKEY_TOO_SMALL 0x01 +#define DH_CHECK_PUBKEY_TOO_LARGE 0x02 +#define DH_CHECK_PUBKEY_INVALID 0x04 + +/* primes p where (p-1)/2 is prime too are called "safe"; we define + this for backward compatibility: */ +#define DH_CHECK_P_NOT_STRONG_PRIME DH_CHECK_P_NOT_SAFE_PRIME + +DH *d2i_DHparams_bio(BIO *bp, DH **a); +int i2d_DHparams_bio(BIO *bp, DH *a); +DH *d2i_DHparams_fp(FILE *fp, DH **a); +int i2d_DHparams_fp(FILE *fp, DH *a); + +DH *DHparams_dup(DH *); + +const DH_METHOD *DH_OpenSSL(void); + +void DH_set_default_method(const DH_METHOD *meth); +const DH_METHOD *DH_get_default_method(void); +int DH_set_method(DH *dh, const DH_METHOD *meth); +DH *DH_new_method(ENGINE *engine); + +DH * DH_new(void); +void DH_free(DH *dh); +int DH_up_ref(DH *dh); +int DH_size(const DH *dh); +int DH_bits(const DH *dh); +int DH_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, + CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); +int DH_set_ex_data(DH *d, int idx, void *arg); +void *DH_get_ex_data(DH *d, int idx); +int DH_security_bits(const DH *dh); + +ENGINE *DH_get0_engine(DH *d); +void DH_get0_pqg(const DH *dh, const BIGNUM **p, const BIGNUM **q, + const BIGNUM **g); +int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g); +void DH_get0_key(const DH *dh, const BIGNUM **pub_key, const BIGNUM **priv_key); +int DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key); +const BIGNUM *DH_get0_p(const DH *dh); +const BIGNUM *DH_get0_q(const DH *dh); +const BIGNUM *DH_get0_g(const DH *dh); +const BIGNUM *DH_get0_priv_key(const DH *dh); +const BIGNUM *DH_get0_pub_key(const DH *dh); +void DH_clear_flags(DH *dh, int flags); +int DH_test_flags(const DH *dh, int flags); +void DH_set_flags(DH *dh, int flags); +long DH_get_length(const DH *dh); +int DH_set_length(DH *dh, long length); + +/* + * Wrapped in OPENSSL_NO_DEPRECATED in 0.9.8, added to rust-openssl in 2020, + * for "advanced DH support". + */ +DH * DH_generate_parameters(int prime_len,int generator, + void (*callback)(int,int,void *),void *cb_arg); + +/* New version */ +int DH_generate_parameters_ex(DH *dh, int prime_len,int generator, BN_GENCB *cb); + +int DH_check(const DH *dh,int *codes); +int DH_check_pub_key(const DH *dh,const BIGNUM *pub_key, int *codes); +int DH_generate_key(DH *dh); +int DH_compute_key(unsigned char *key,const BIGNUM *pub_key,DH *dh); +DH * d2i_DHparams(DH **a,const unsigned char **pp, long length); +int i2d_DHparams(const DH *a,unsigned char **pp); +int DHparams_print_fp(FILE *fp, const DH *x); +#ifndef OPENSSL_NO_BIO +int DHparams_print(BIO *bp, const DH *x); +#else +int DHparams_print(char *bp, const DH *x); +#endif + +#define EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx, len) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DH, EVP_PKEY_OP_PARAMGEN, \ + EVP_PKEY_CTRL_DH_PARAMGEN_PRIME_LEN, len, NULL) + +#define EVP_PKEY_CTX_set_dh_paramgen_generator(ctx, gen) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DH, EVP_PKEY_OP_PARAMGEN, \ + EVP_PKEY_CTRL_DH_PARAMGEN_GENERATOR, gen, NULL) + +#define EVP_PKEY_CTRL_DH_PARAMGEN_PRIME_LEN (EVP_PKEY_ALG_CTRL + 1) +#define EVP_PKEY_CTRL_DH_PARAMGEN_GENERATOR (EVP_PKEY_ALG_CTRL + 2) + + +void ERR_load_DH_strings(void); + +/* Error codes for the DH functions. */ + +/* Function codes. */ +#define DH_F_COMPUTE_KEY 102 +#define DH_F_DHPARAMS_PRINT_FP 101 +#define DH_F_DH_BUILTIN_GENPARAMS 106 +#define DH_F_DH_COMPUTE_KEY 114 +#define DH_F_DH_GENERATE_KEY 115 +#define DH_F_DH_GENERATE_PARAMETERS_EX 116 +#define DH_F_DH_NEW_METHOD 105 +#define DH_F_DH_PARAM_DECODE 107 +#define DH_F_DH_PRIV_DECODE 110 +#define DH_F_DH_PRIV_ENCODE 111 +#define DH_F_DH_PUB_DECODE 108 +#define DH_F_DH_PUB_ENCODE 109 +#define DH_F_DO_DH_PRINT 100 +#define DH_F_GENERATE_KEY 103 +#define DH_F_GENERATE_PARAMETERS 104 +#define DH_F_PKEY_DH_DERIVE 112 +#define DH_F_PKEY_DH_KEYGEN 113 + +/* Reason codes. */ +#define DH_R_BAD_GENERATOR 101 +#define DH_R_BN_DECODE_ERROR 109 +#define DH_R_BN_ERROR 106 +#define DH_R_DECODE_ERROR 104 +#define DH_R_INVALID_PUBKEY 102 +#define DH_R_KEYS_NOT_SET 108 +#define DH_R_KEY_SIZE_TOO_SMALL 110 +#define DH_R_MODULUS_TOO_LARGE 103 +#define DH_R_NON_FIPS_METHOD 111 +#define DH_R_NO_PARAMETERS_SET 107 +#define DH_R_NO_PRIVATE_VALUE 100 +#define DH_R_PARAMETER_ENCODING_ERROR 105 +#define DH_R_CHECK_INVALID_J_VALUE 115 +#define DH_R_CHECK_INVALID_Q_VALUE 116 +#define DH_R_CHECK_PUBKEY_INVALID 122 +#define DH_R_CHECK_PUBKEY_TOO_LARGE 123 +#define DH_R_CHECK_PUBKEY_TOO_SMALL 124 +#define DH_R_CHECK_P_NOT_PRIME 117 +#define DH_R_CHECK_P_NOT_SAFE_PRIME 118 +#define DH_R_CHECK_Q_NOT_PRIME 119 +#define DH_R_MISSING_PUBKEY 125 +#define DH_R_NOT_SUITABLE_GENERATOR 120 +#define DH_R_UNABLE_TO_CHECK_GENERATOR 121 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/dsa.h b/curl/include/openssl/dsa.h new file mode 100644 index 0000000..7a8e7fc --- /dev/null +++ b/curl/include/openssl/dsa.h @@ -0,0 +1,263 @@ +/* $OpenBSD: dsa.h,v 1.48 2025/03/01 11:33:07 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +/* + * The DSS routines are based on patches supplied by + * Steven Schoch . He basically did the + * work and I have just tweaked them a little to fit into my + * stylistic vision for SSLeay :-) */ + +#ifndef HEADER_DSA_H +#define HEADER_DSA_H + +#include + +#ifndef OPENSSL_NO_BIO +#include +#endif +#include +#include +#ifndef OPENSSL_NO_DH +# include +#endif + +#include + +#ifndef OPENSSL_DSA_MAX_MODULUS_BITS +# define OPENSSL_DSA_MAX_MODULUS_BITS 10000 +#endif + +#define DSA_FLAG_CACHE_MONT_P 0x01 + +/* If this flag is set the DSA method is FIPS compliant and can be used + * in FIPS mode. This is set in the validated module method. If an + * application sets this flag in its own methods it is its reposibility + * to ensure the result is compliant. + */ + +#define DSA_FLAG_FIPS_METHOD 0x0400 + +/* If this flag is set the operations normally disabled in FIPS mode are + * permitted it is then the applications responsibility to ensure that the + * usage is compliant. + */ + +#define DSA_FLAG_NON_FIPS_ALLOW 0x0400 + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct DSA_SIG_st DSA_SIG; + +DSA *d2i_DSAparams_bio(BIO *bp, DSA **a); +int i2d_DSAparams_bio(BIO *bp, DSA *a); +DSA *d2i_DSAparams_fp(FILE *fp, DSA **a); +int i2d_DSAparams_fp(FILE *fp, DSA *a); + +DSA *DSAparams_dup(DSA *x); +DSA_SIG * DSA_SIG_new(void); +void DSA_SIG_free(DSA_SIG *a); +int i2d_DSA_SIG(const DSA_SIG *a, unsigned char **pp); +DSA_SIG * d2i_DSA_SIG(DSA_SIG **v, const unsigned char **pp, long length); +void DSA_SIG_get0(const DSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps); +int DSA_SIG_set0(DSA_SIG *sig, BIGNUM *r, BIGNUM *s); + +DSA_SIG * DSA_do_sign(const unsigned char *dgst,int dlen,DSA *dsa); +int DSA_do_verify(const unsigned char *dgst,int dgst_len, + DSA_SIG *sig,DSA *dsa); + +const DSA_METHOD *DSA_OpenSSL(void); + +void DSA_set_default_method(const DSA_METHOD *); +const DSA_METHOD *DSA_get_default_method(void); +int DSA_set_method(DSA *dsa, const DSA_METHOD *); + +DSA * DSA_new(void); +DSA * DSA_new_method(ENGINE *engine); +void DSA_free(DSA *r); +/* "up" the DSA object's reference count */ +int DSA_up_ref(DSA *r); +int DSA_size(const DSA *); +int DSA_bits(const DSA *d); + /* next 4 return -1 on error */ +int DSA_sign_setup( DSA *dsa,BN_CTX *ctx_in,BIGNUM **kinvp,BIGNUM **rp); +int DSA_sign(int type,const unsigned char *dgst,int dlen, + unsigned char *sig, unsigned int *siglen, DSA *dsa); +int DSA_verify(int type,const unsigned char *dgst,int dgst_len, + const unsigned char *sigbuf, int siglen, DSA *dsa); +int DSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, + CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); +int DSA_set_ex_data(DSA *d, int idx, void *arg); +void *DSA_get_ex_data(DSA *d, int idx); +int DSA_security_bits(const DSA *d); + +DSA *d2i_DSAPublicKey(DSA **a, const unsigned char **pp, long length); +int i2d_DSAPublicKey(const DSA *a, unsigned char **pp); +extern const ASN1_ITEM DSAPublicKey_it; + +DSA *d2i_DSAPrivateKey(DSA **a, const unsigned char **pp, long length); +int i2d_DSAPrivateKey(const DSA *a, unsigned char **pp); +extern const ASN1_ITEM DSAPrivateKey_it; + +DSA *d2i_DSAparams(DSA **a, const unsigned char **pp, long length); +int i2d_DSAparams(const DSA *a,unsigned char **pp); +extern const ASN1_ITEM DSAparams_it; + +/* New version */ +int DSA_generate_parameters_ex(DSA *dsa, int bits, + const unsigned char *seed,int seed_len, + int *counter_ret, unsigned long *h_ret, BN_GENCB *cb); + +int DSA_generate_key(DSA *a); + +#ifndef OPENSSL_NO_BIO +int DSAparams_print(BIO *bp, const DSA *x); +int DSA_print(BIO *bp, const DSA *x, int off); +#endif +int DSAparams_print_fp(FILE *fp, const DSA *x); +int DSA_print_fp(FILE *bp, const DSA *x, int off); + +#ifndef OPENSSL_NO_DH +/* Convert DSA structure (key or just parameters) into DH structure + * (be careful to avoid small subgroup attacks when using this!) */ +DH *DSA_dup_DH(const DSA *r); +#endif + +void DSA_get0_pqg(const DSA *d, const BIGNUM **p, const BIGNUM **q, + const BIGNUM **g); +int DSA_set0_pqg(DSA *d, BIGNUM *p, BIGNUM *q, BIGNUM *g); +void DSA_get0_key(const DSA *d, const BIGNUM **pub_key, const BIGNUM **priv_key); +int DSA_set0_key(DSA *d, BIGNUM *pub_key, BIGNUM *priv_key); +const BIGNUM *DSA_get0_p(const DSA *d); +const BIGNUM *DSA_get0_q(const DSA *d); +const BIGNUM *DSA_get0_g(const DSA *d); +const BIGNUM *DSA_get0_pub_key(const DSA *d); +const BIGNUM *DSA_get0_priv_key(const DSA *d); +void DSA_clear_flags(DSA *d, int flags); +int DSA_test_flags(const DSA *d, int flags); +void DSA_set_flags(DSA *d, int flags); +ENGINE *DSA_get0_engine(DSA *d); + +DSA_METHOD *DSA_meth_new(const char *name, int flags); +void DSA_meth_free(DSA_METHOD *meth); +DSA_METHOD *DSA_meth_dup(const DSA_METHOD *meth); +const char *DSA_meth_get0_name(const DSA_METHOD *meth); +int DSA_meth_set1_name(DSA_METHOD *meth, const char *name); +int DSA_meth_set_sign(DSA_METHOD *meth, + DSA_SIG *(*sign)(const unsigned char *, int, DSA *)); +int DSA_meth_set_finish(DSA_METHOD *meth, int (*finish)(DSA *)); + +#define EVP_PKEY_CTX_set_dsa_paramgen_bits(ctx, nbits) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DSA, EVP_PKEY_OP_PARAMGEN, \ + EVP_PKEY_CTRL_DSA_PARAMGEN_BITS, nbits, NULL) + +#define EVP_PKEY_CTRL_DSA_PARAMGEN_BITS (EVP_PKEY_ALG_CTRL + 1) +#define EVP_PKEY_CTRL_DSA_PARAMGEN_Q_BITS (EVP_PKEY_ALG_CTRL + 2) +#define EVP_PKEY_CTRL_DSA_PARAMGEN_MD (EVP_PKEY_ALG_CTRL + 3) + +void ERR_load_DSA_strings(void); + +/* Error codes for the DSA functions. */ + +/* Function codes. */ +#define DSA_F_D2I_DSA_SIG 110 +#define DSA_F_DO_DSA_PRINT 104 +#define DSA_F_DSAPARAMS_PRINT 100 +#define DSA_F_DSAPARAMS_PRINT_FP 101 +#define DSA_F_DSA_DO_SIGN 112 +#define DSA_F_DSA_DO_VERIFY 113 +#define DSA_F_DSA_GENERATE_KEY 124 +#define DSA_F_DSA_GENERATE_PARAMETERS_EX 123 +#define DSA_F_DSA_NEW_METHOD 103 +#define DSA_F_DSA_PARAM_DECODE 119 +#define DSA_F_DSA_PRINT_FP 105 +#define DSA_F_DSA_PRIV_DECODE 115 +#define DSA_F_DSA_PRIV_ENCODE 116 +#define DSA_F_DSA_PUB_DECODE 117 +#define DSA_F_DSA_PUB_ENCODE 118 +#define DSA_F_DSA_SIGN 106 +#define DSA_F_DSA_SIGN_SETUP 107 +#define DSA_F_DSA_SIG_NEW 109 +#define DSA_F_DSA_SIG_PRINT 125 +#define DSA_F_DSA_VERIFY 108 +#define DSA_F_I2D_DSA_SIG 111 +#define DSA_F_OLD_DSA_PRIV_DECODE 122 +#define DSA_F_PKEY_DSA_CTRL 120 +#define DSA_F_PKEY_DSA_KEYGEN 121 +#define DSA_F_SIG_CB 114 + +/* Reason codes. */ +#define DSA_R_BAD_Q_VALUE 102 +#define DSA_R_BN_DECODE_ERROR 108 +#define DSA_R_BN_ERROR 109 +#define DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE 100 +#define DSA_R_DECODE_ERROR 104 +#define DSA_R_INVALID_DIGEST_TYPE 106 +#define DSA_R_INVALID_PARAMETERS 112 +#define DSA_R_MISSING_PARAMETERS 101 +#define DSA_R_MODULUS_TOO_LARGE 103 +#define DSA_R_NEED_NEW_SETUP_VALUES 110 +#define DSA_R_NON_FIPS_DSA_METHOD 111 +#define DSA_R_NO_PARAMETERS_SET 107 +#define DSA_R_PARAMETER_ENCODING_ERROR 105 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/dtls1.h b/curl/include/openssl/dtls1.h new file mode 100644 index 0000000..79542c8 --- /dev/null +++ b/curl/include/openssl/dtls1.h @@ -0,0 +1,107 @@ +/* $OpenBSD: dtls1.h,v 1.27 2021/05/16 13:56:30 jsing Exp $ */ +/* + * DTLS implementation written by Nagendra Modadugu + * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. + */ +/* ==================================================================== + * Copyright (c) 1999-2005 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#ifndef HEADER_DTLS1_H +#define HEADER_DTLS1_H + +#if defined(_WIN32) +#include +#else +#include +#endif + +#include +#include +#include + +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define DTLS1_VERSION 0xFEFF +#define DTLS1_2_VERSION 0xFEFD +#define DTLS1_VERSION_MAJOR 0xFE + +/* lengths of messages */ +#define DTLS1_COOKIE_LENGTH 256 + +#define DTLS1_RT_HEADER_LENGTH 13 + +#define DTLS1_HM_HEADER_LENGTH 12 + +#define DTLS1_HM_BAD_FRAGMENT -2 +#define DTLS1_HM_FRAGMENT_RETRY -3 + +#define DTLS1_CCS_HEADER_LENGTH 1 + +#define DTLS1_AL_HEADER_LENGTH 2 + +/* Timeout multipliers (timeout slice is defined in apps/timeouts.h */ +#define DTLS1_TMO_READ_COUNT 2 +#define DTLS1_TMO_WRITE_COUNT 2 + +#define DTLS1_TMO_ALERT_COUNT 12 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/ec.h b/curl/include/openssl/ec.h new file mode 100644 index 0000000..5438dd8 --- /dev/null +++ b/curl/include/openssl/ec.h @@ -0,0 +1,675 @@ +/* $OpenBSD: ec.h,v 1.55 2025/03/10 08:38:11 tb Exp $ */ +/* + * Originally written by Bodo Moeller for the OpenSSL project. + */ +/* ==================================================================== + * Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ +/* ==================================================================== + * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. + * + * Portions of the attached software ("Contribution") are developed by + * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project. + * + * The Contribution is licensed pursuant to the OpenSSL open source + * license provided above. + * + * The elliptic curve binary polynomial software is originally written by + * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories. + */ + +#ifndef HEADER_EC_H +#define HEADER_EC_H + +#include + +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#ifndef OPENSSL_ECC_MAX_FIELD_BITS +#define OPENSSL_ECC_MAX_FIELD_BITS 661 +#endif + +/* Elliptic point conversion form as per X9.62, page 4 and section 4.4.2. */ +typedef enum { + POINT_CONVERSION_COMPRESSED = 2, + POINT_CONVERSION_UNCOMPRESSED = 4, + POINT_CONVERSION_HYBRID = 6 +} point_conversion_form_t; + +typedef struct ec_group_st EC_GROUP; +typedef struct ec_point_st EC_POINT; + +void EC_GROUP_free(EC_GROUP *group); +void EC_GROUP_clear_free(EC_GROUP *group); + +EC_GROUP *EC_GROUP_dup(const EC_GROUP *src); + +int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator, + const BIGNUM *order, const BIGNUM *cofactor); +const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group); + +int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx); +int EC_GROUP_order_bits(const EC_GROUP *group); +int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor, BN_CTX *ctx); + +void EC_GROUP_set_curve_name(EC_GROUP *group, int nid); +int EC_GROUP_get_curve_name(const EC_GROUP *group); + +void EC_GROUP_set_asn1_flag(EC_GROUP *group, int flag); +int EC_GROUP_get_asn1_flag(const EC_GROUP *group); + +void EC_GROUP_set_point_conversion_form(EC_GROUP *group, + point_conversion_form_t form); +point_conversion_form_t EC_GROUP_get_point_conversion_form(const EC_GROUP *); + +unsigned char *EC_GROUP_get0_seed(const EC_GROUP *x); +size_t EC_GROUP_get_seed_len(const EC_GROUP *); +size_t EC_GROUP_set_seed(EC_GROUP *, const unsigned char *, size_t len); + +int EC_GROUP_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, + const BIGNUM *b, BN_CTX *ctx); +int EC_GROUP_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b, + BN_CTX *ctx); + +int EC_GROUP_set_curve_GFp(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, + const BIGNUM *b, BN_CTX *ctx); +int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, + BIGNUM *b, BN_CTX *ctx); + +int EC_GROUP_get_degree(const EC_GROUP *group); + +int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx); +int EC_GROUP_check_discriminant(const EC_GROUP *group, BN_CTX *ctx); + +/* Compare two EC_GROUPs. Returns 0 if both groups are equal, 1 otherwise. */ +int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx); + +EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a, + const BIGNUM *b, BN_CTX *ctx); +EC_GROUP *EC_GROUP_new_by_curve_name(int nid); + +typedef struct { + int nid; + const char *comment; +} EC_builtin_curve; + +size_t EC_get_builtin_curves(EC_builtin_curve *r, size_t nitems); + +const char *EC_curve_nid2nist(int nid); +int EC_curve_nist2nid(const char *name); + +EC_POINT *EC_POINT_new(const EC_GROUP *group); +void EC_POINT_free(EC_POINT *point); +void EC_POINT_clear_free(EC_POINT *point); +int EC_POINT_copy(EC_POINT *dst, const EC_POINT *src); +EC_POINT *EC_POINT_dup(const EC_POINT *src, const EC_GROUP *group); + +int EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point); + +int EC_POINT_set_affine_coordinates(const EC_GROUP *group, EC_POINT *p, + const BIGNUM *x, const BIGNUM *y, BN_CTX *ctx); +int EC_POINT_get_affine_coordinates(const EC_GROUP *group, const EC_POINT *p, + BIGNUM *x, BIGNUM *y, BN_CTX *ctx); +int EC_POINT_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *p, + const BIGNUM *x, int y_bit, BN_CTX *ctx); + +int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group, EC_POINT *p, + const BIGNUM *x, const BIGNUM *y, BN_CTX *ctx); +int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group, + const EC_POINT *p, BIGNUM *x, BIGNUM *y, BN_CTX *ctx); +int EC_POINT_set_compressed_coordinates_GFp(const EC_GROUP *group, EC_POINT *p, + const BIGNUM *x, int y_bit, BN_CTX *ctx); +size_t EC_POINT_point2oct(const EC_GROUP *group, const EC_POINT *p, + point_conversion_form_t form, unsigned char *buf, size_t len, BN_CTX *ctx); +int EC_POINT_oct2point(const EC_GROUP *group, EC_POINT *p, + const unsigned char *buf, size_t len, BN_CTX *ctx); + +BIGNUM *EC_POINT_point2bn(const EC_GROUP *, const EC_POINT *, + point_conversion_form_t form, BIGNUM *, BN_CTX *); +EC_POINT *EC_POINT_bn2point(const EC_GROUP *, const BIGNUM *, EC_POINT *, + BN_CTX *); +char *EC_POINT_point2hex(const EC_GROUP *, const EC_POINT *, + point_conversion_form_t form, BN_CTX *); +EC_POINT *EC_POINT_hex2point(const EC_GROUP *, const char *, EC_POINT *, + BN_CTX *); + +int EC_POINT_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, + const EC_POINT *b, BN_CTX *ctx); +int EC_POINT_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, + BN_CTX *ctx); +int EC_POINT_invert(const EC_GROUP *group, EC_POINT *a, BN_CTX *ctx); +int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *p); +int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point, + BN_CTX *ctx); +int EC_POINT_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b, + BN_CTX *ctx); + +int EC_POINT_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx); +int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, + const EC_POINT *q, const BIGNUM *m, BN_CTX *ctx); + +int EC_GROUP_get_basis_type(const EC_GROUP *); + +#define OPENSSL_EC_EXPLICIT_CURVE 0x000 +#define OPENSSL_EC_NAMED_CURVE 0x001 + +EC_GROUP *d2i_ECPKParameters(EC_GROUP **, const unsigned char **in, long len); +int i2d_ECPKParameters(const EC_GROUP *, unsigned char **out); + +#define d2i_ECPKParameters_bio(bp,x) ASN1_d2i_bio_of(EC_GROUP,NULL,d2i_ECPKParameters,bp,x) +#define i2d_ECPKParameters_bio(bp,x) ASN1_i2d_bio_of_const(EC_GROUP,i2d_ECPKParameters,bp,x) +#define d2i_ECPKParameters_fp(fp,x) (EC_GROUP *)ASN1_d2i_fp(NULL, \ + (char *(*)())d2i_ECPKParameters,(fp),(unsigned char **)(x)) +#define i2d_ECPKParameters_fp(fp,x) ASN1_i2d_fp(i2d_ECPKParameters,(fp), \ + (unsigned char *)(x)) + +#ifndef OPENSSL_NO_BIO +int ECPKParameters_print(BIO *bp, const EC_GROUP *x, int off); +#endif +int ECPKParameters_print_fp(FILE *fp, const EC_GROUP *x, int off); + +#define EC_PKEY_NO_PARAMETERS 0x001 +#define EC_PKEY_NO_PUBKEY 0x002 + +#define EC_FLAG_NON_FIPS_ALLOW 0x1 +#define EC_FLAG_FIPS_CHECKED 0x2 +#define EC_FLAG_COFACTOR_ECDH 0x1000 + +EC_KEY *EC_KEY_new(void); +int EC_KEY_get_flags(const EC_KEY *key); +void EC_KEY_set_flags(EC_KEY *key, int flags); +void EC_KEY_clear_flags(EC_KEY *key, int flags); +EC_KEY *EC_KEY_new_by_curve_name(int nid); +void EC_KEY_free(EC_KEY *key); +EC_KEY *EC_KEY_copy(EC_KEY *dst, const EC_KEY *src); +EC_KEY *EC_KEY_dup(const EC_KEY *src); +int EC_KEY_up_ref(EC_KEY *key); + +const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key); +int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group); +const BIGNUM *EC_KEY_get0_private_key(const EC_KEY *key); +int EC_KEY_set_private_key(EC_KEY *key, const BIGNUM *prv); +const EC_POINT *EC_KEY_get0_public_key(const EC_KEY *key); +int EC_KEY_set_public_key(EC_KEY *key, const EC_POINT *pub); + +unsigned EC_KEY_get_enc_flags(const EC_KEY *key); +void EC_KEY_set_enc_flags(EC_KEY *eckey, unsigned int flags); +point_conversion_form_t EC_KEY_get_conv_form(const EC_KEY *key); +void EC_KEY_set_conv_form(EC_KEY *eckey, point_conversion_form_t cform); + +void EC_KEY_set_asn1_flag(EC_KEY *eckey, int asn1_flag); +int EC_KEY_precompute_mult(EC_KEY *key, BN_CTX *ctx); +int EC_KEY_generate_key(EC_KEY *key); +int EC_KEY_check_key(const EC_KEY *key); +int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, BIGNUM *x, BIGNUM *y); + +EC_KEY *d2i_ECPrivateKey(EC_KEY **key, const unsigned char **in, long len); +int i2d_ECPrivateKey(EC_KEY *key, unsigned char **out); +EC_KEY *d2i_ECParameters(EC_KEY **key, const unsigned char **in, long len); +int i2d_ECParameters(EC_KEY *key, unsigned char **out); + +EC_KEY *o2i_ECPublicKey(EC_KEY **key, const unsigned char **in, long len); +int i2o_ECPublicKey(const EC_KEY *key, unsigned char **out); + +#ifndef OPENSSL_NO_BIO +int ECParameters_print(BIO *bp, const EC_KEY *key); +int EC_KEY_print(BIO *bp, const EC_KEY *key, int off); +#endif +int ECParameters_print_fp(FILE *fp, const EC_KEY *key); +int EC_KEY_print_fp(FILE *fp, const EC_KEY *key, int off); + +#define EC_KEY_get_ex_new_index(l, p, newf, dupf, freef) \ + CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_EC_KEY, l, p, newf, dupf, freef) +int EC_KEY_set_ex_data(EC_KEY *key, int idx, void *arg); +void *EC_KEY_get_ex_data(const EC_KEY *key, int idx); + +const EC_KEY_METHOD *EC_KEY_OpenSSL(void); +const EC_KEY_METHOD *EC_KEY_get_default_method(void); +void EC_KEY_set_default_method(const EC_KEY_METHOD *meth); +const EC_KEY_METHOD *EC_KEY_get_method(const EC_KEY *key); +int EC_KEY_set_method(EC_KEY *key, const EC_KEY_METHOD *meth); +EC_KEY *EC_KEY_new_method(ENGINE *engine); + +int ECDH_size(const EC_KEY *ecdh); +int ECDH_compute_key(void *out, size_t outlen, const EC_POINT *pub_key, + EC_KEY *ecdh, + void *(*KDF)(const void *in, size_t inlen, void *out, size_t *outlen)); + +typedef struct ECDSA_SIG_st ECDSA_SIG; + +ECDSA_SIG *ECDSA_SIG_new(void); +void ECDSA_SIG_free(ECDSA_SIG *sig); +int i2d_ECDSA_SIG(const ECDSA_SIG *sig, unsigned char **pp); +ECDSA_SIG *d2i_ECDSA_SIG(ECDSA_SIG **sig, const unsigned char **pp, long len); + +const BIGNUM *ECDSA_SIG_get0_r(const ECDSA_SIG *sig); +const BIGNUM *ECDSA_SIG_get0_s(const ECDSA_SIG *sig); +void ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps); +int ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s); + +int ECDSA_size(const EC_KEY *eckey); + +ECDSA_SIG *ECDSA_do_sign(const unsigned char *digest, int digest_len, + EC_KEY *eckey); +int ECDSA_do_verify(const unsigned char *digest, int digest_len, + const ECDSA_SIG *sig, EC_KEY *eckey); + +int ECDSA_sign(int type, const unsigned char *digest, int digest_len, + unsigned char *signature, unsigned int *signature_len, EC_KEY *eckey); +int ECDSA_verify(int type, const unsigned char *digest, int digest_len, + const unsigned char *signature, int signature_len, EC_KEY *eckey); + +EC_KEY_METHOD *EC_KEY_METHOD_new(const EC_KEY_METHOD *meth); +void EC_KEY_METHOD_free(EC_KEY_METHOD *meth); +void EC_KEY_METHOD_set_init(EC_KEY_METHOD *meth, + int (*init)(EC_KEY *key), + void (*finish)(EC_KEY *key), + int (*copy)(EC_KEY *dest, const EC_KEY *src), + int (*set_group)(EC_KEY *key, const EC_GROUP *grp), + int (*set_private)(EC_KEY *key, const BIGNUM *priv_key), + int (*set_public)(EC_KEY *key, const EC_POINT *pub_key)); +void EC_KEY_METHOD_set_keygen(EC_KEY_METHOD *meth, + int (*keygen)(EC_KEY *key)); +void EC_KEY_METHOD_set_compute_key(EC_KEY_METHOD *meth, + int (*ckey)(unsigned char **out, size_t *out_len, const EC_POINT *pub_key, + const EC_KEY *ecdh)); +void EC_KEY_METHOD_set_sign(EC_KEY_METHOD *meth, + int (*sign)(int type, const unsigned char *digest, int digest_len, + unsigned char *signature, unsigned int *signature_len, + const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey), + int (*sign_setup)(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp), + ECDSA_SIG *(*sign_sig)(const unsigned char *digest, int digest_len, + const BIGNUM *in_kinv, const BIGNUM *in_r, EC_KEY *eckey)); +void EC_KEY_METHOD_set_verify(EC_KEY_METHOD *meth, + int (*verify)(int type, const unsigned char *digest, int digest_len, + const unsigned char *signature, int signature_len, EC_KEY *eckey), + int (*verify_sig)(const unsigned char *digest, int digest_len, + const ECDSA_SIG *sig, EC_KEY *eckey)); +void EC_KEY_METHOD_get_init(const EC_KEY_METHOD *meth, + int (**pinit)(EC_KEY *key), + void (**pfinish)(EC_KEY *key), + int (**pcopy)(EC_KEY *dest, const EC_KEY *src), + int (**pset_group)(EC_KEY *key, const EC_GROUP *grp), + int (**pset_private)(EC_KEY *key, const BIGNUM *priv_key), + int (**pset_public)(EC_KEY *key, const EC_POINT *pub_key)); +void EC_KEY_METHOD_get_keygen(const EC_KEY_METHOD *meth, + int (**pkeygen)(EC_KEY *key)); +void EC_KEY_METHOD_get_compute_key(const EC_KEY_METHOD *meth, + int (**pck)(unsigned char **out, size_t *out_len, const EC_POINT *pub_key, + const EC_KEY *ecdh)); +void EC_KEY_METHOD_get_sign(const EC_KEY_METHOD *meth, + int (**psign)(int type, const unsigned char *digest, int digest_len, + unsigned char *signature, unsigned int *signature_len, + const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey), + int (**psign_setup)(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp), + ECDSA_SIG *(**psign_sig)(const unsigned char *digest, int digest_len, + const BIGNUM *in_kinv, const BIGNUM *in_r, EC_KEY *eckey)); +void EC_KEY_METHOD_get_verify(const EC_KEY_METHOD *meth, + int (**pverify)(int type, const unsigned char *digest, int digest_len, + const unsigned char *signature, int signature_len, EC_KEY *eckey), + int (**pverify_sig)(const unsigned char *digest, int digest_len, + const ECDSA_SIG *sig, EC_KEY *eckey)); + +EC_KEY *ECParameters_dup(EC_KEY *key); + +#define EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, nid) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_EC, \ + EVP_PKEY_OP_PARAMGEN|EVP_PKEY_OP_KEYGEN, \ + EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID, nid, NULL) + +#define EVP_PKEY_CTX_set_ec_param_enc(ctx, flag) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_EC, \ + EVP_PKEY_OP_PARAMGEN|EVP_PKEY_OP_KEYGEN, \ + EVP_PKEY_CTRL_EC_PARAM_ENC, flag, NULL) + +#define EVP_PKEY_CTX_set_ecdh_cofactor_mode(ctx, flag) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_EC, \ + EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_EC_ECDH_COFACTOR, flag, NULL) + +#define EVP_PKEY_CTX_get_ecdh_cofactor_mode(ctx) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_EC, \ + EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_EC_ECDH_COFACTOR, -2, NULL) + +#define EVP_PKEY_CTX_set_ecdh_kdf_type(ctx, kdf) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_EC, \ + EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_EC_KDF_TYPE, kdf, NULL) + +#define EVP_PKEY_CTX_get_ecdh_kdf_type(ctx) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_EC, \ + EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_EC_KDF_TYPE, -2, NULL) + +#define EVP_PKEY_CTX_set_ecdh_kdf_md(ctx, md) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_EC, \ + EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_EC_KDF_MD, 0, (void *)(md)) + +#define EVP_PKEY_CTX_get_ecdh_kdf_md(ctx, pmd) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_EC, \ + EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_GET_EC_KDF_MD, 0, (void *)(pmd)) + +#define EVP_PKEY_CTX_set_ecdh_kdf_outlen(ctx, len) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_EC, \ + EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_EC_KDF_OUTLEN, len, NULL) + +#define EVP_PKEY_CTX_get_ecdh_kdf_outlen(ctx, plen) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_EC, \ + EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_GET_EC_KDF_OUTLEN, 0, \ + (void *)(plen)) + +#define EVP_PKEY_CTX_set0_ecdh_kdf_ukm(ctx, p, plen) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_EC, \ + EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_EC_KDF_UKM, plen, (void *)(p)) + +#define EVP_PKEY_CTX_get0_ecdh_kdf_ukm(ctx, p) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_EC, \ + EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_GET_EC_KDF_UKM, 0, (void *)(p)) + +/* SM2 will skip the operation check so no need to pass operation here */ +#define EVP_PKEY_CTX_set1_id(ctx, id, id_len) \ + EVP_PKEY_CTX_ctrl(ctx, -1, -1, \ + EVP_PKEY_CTRL_SET1_ID, (int)id_len, (void*)(id)) + +#define EVP_PKEY_CTX_get1_id(ctx, id) \ + EVP_PKEY_CTX_ctrl(ctx, -1, -1, \ + EVP_PKEY_CTRL_GET1_ID, 0, (void*)(id)) + +#define EVP_PKEY_CTX_get1_id_len(ctx, id_len) \ + EVP_PKEY_CTX_ctrl(ctx, -1, -1, \ + EVP_PKEY_CTRL_GET1_ID_LEN, 0, (void*)(id_len)) + +#define EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID (EVP_PKEY_ALG_CTRL + 1) +#define EVP_PKEY_CTRL_EC_PARAM_ENC (EVP_PKEY_ALG_CTRL + 2) +#define EVP_PKEY_CTRL_EC_ECDH_COFACTOR (EVP_PKEY_ALG_CTRL + 3) +#define EVP_PKEY_CTRL_EC_KDF_TYPE (EVP_PKEY_ALG_CTRL + 4) +#define EVP_PKEY_CTRL_EC_KDF_MD (EVP_PKEY_ALG_CTRL + 5) +#define EVP_PKEY_CTRL_GET_EC_KDF_MD (EVP_PKEY_ALG_CTRL + 6) +#define EVP_PKEY_CTRL_EC_KDF_OUTLEN (EVP_PKEY_ALG_CTRL + 7) +#define EVP_PKEY_CTRL_GET_EC_KDF_OUTLEN (EVP_PKEY_ALG_CTRL + 8) +#define EVP_PKEY_CTRL_EC_KDF_UKM (EVP_PKEY_ALG_CTRL + 9) +#define EVP_PKEY_CTRL_GET_EC_KDF_UKM (EVP_PKEY_ALG_CTRL + 10) +#define EVP_PKEY_CTRL_SET1_ID (EVP_PKEY_ALG_CTRL + 11) +#define EVP_PKEY_CTRL_GET1_ID (EVP_PKEY_ALG_CTRL + 12) +#define EVP_PKEY_CTRL_GET1_ID_LEN (EVP_PKEY_ALG_CTRL + 13) + +/* KDF types */ +#define EVP_PKEY_ECDH_KDF_NONE 1 +#define EVP_PKEY_ECDH_KDF_X9_63 2 + +void ERR_load_EC_strings(void); + +/* Error codes for the EC functions. */ + +/* Function codes. */ +#define EC_F_BN_TO_FELEM 224 +#define EC_F_COMPUTE_WNAF 143 +#define EC_F_D2I_ECPARAMETERS 144 +#define EC_F_D2I_ECPKPARAMETERS 145 +#define EC_F_D2I_ECPRIVATEKEY 146 +#define EC_F_DO_EC_KEY_PRINT 221 +#define EC_F_ECKEY_PARAM2TYPE 223 +#define EC_F_ECKEY_PARAM_DECODE 212 +#define EC_F_ECKEY_PRIV_DECODE 213 +#define EC_F_ECKEY_PRIV_ENCODE 214 +#define EC_F_ECKEY_PUB_DECODE 215 +#define EC_F_ECKEY_PUB_ENCODE 216 +#define EC_F_ECKEY_TYPE2PARAM 220 +#define EC_F_ECPARAMETERS_PRINT 147 +#define EC_F_ECPARAMETERS_PRINT_FP 148 +#define EC_F_ECPKPARAMETERS_PRINT 149 +#define EC_F_ECPKPARAMETERS_PRINT_FP 150 +#define EC_F_ECP_NIST_MOD_192 203 +#define EC_F_ECP_NIST_MOD_224 204 +#define EC_F_ECP_NIST_MOD_256 205 +#define EC_F_ECP_NIST_MOD_521 206 +#define EC_F_ECP_NISTZ256_GET_AFFINE 240 +#define EC_F_ECP_NISTZ256_MULT_PRECOMPUTE 243 +#define EC_F_ECP_NISTZ256_POINTS_MUL 241 +#define EC_F_ECP_NISTZ256_PRE_COMP_NEW 244 +#define EC_F_ECP_NISTZ256_SET_WORDS 245 +#define EC_F_ECP_NISTZ256_WINDOWED_MUL 242 +#define EC_F_EC_ASN1_GROUP2CURVE 153 +#define EC_F_EC_ASN1_GROUP2FIELDID 154 +#define EC_F_EC_ASN1_GROUP2PARAMETERS 155 +#define EC_F_EC_ASN1_GROUP2PKPARAMETERS 156 +#define EC_F_EC_ASN1_PARAMETERS2GROUP 157 +#define EC_F_EC_ASN1_PKPARAMETERS2GROUP 158 +#define EC_F_EC_EX_DATA_SET_DATA 211 +#define EC_F_EC_GF2M_MONTGOMERY_POINT_MULTIPLY 208 +#define EC_F_EC_GF2M_SIMPLE_GROUP_CHECK_DISCRIMINANT 159 +#define EC_F_EC_GF2M_SIMPLE_GROUP_SET_CURVE 195 +#define EC_F_EC_GF2M_SIMPLE_OCT2POINT 160 +#define EC_F_EC_GF2M_SIMPLE_POINT2OCT 161 +#define EC_F_EC_GF2M_SIMPLE_POINT_GET_AFFINE_COORDINATES 162 +#define EC_F_EC_GF2M_SIMPLE_POINT_SET_AFFINE_COORDINATES 163 +#define EC_F_EC_GF2M_SIMPLE_SET_COMPRESSED_COORDINATES 164 +#define EC_F_EC_GFP_MONT_FIELD_DECODE 133 +#define EC_F_EC_GFP_MONT_FIELD_ENCODE 134 +#define EC_F_EC_GFP_MONT_FIELD_MUL 131 +#define EC_F_EC_GFP_MONT_FIELD_SET_TO_ONE 209 +#define EC_F_EC_GFP_MONT_FIELD_SQR 132 +#define EC_F_EC_GFP_MONT_GROUP_SET_CURVE 189 +#define EC_F_EC_GFP_MONT_GROUP_SET_CURVE_GFP 135 +#define EC_F_EC_GFP_NISTP224_GROUP_SET_CURVE 225 +#define EC_F_EC_GFP_NISTP224_POINTS_MUL 228 +#define EC_F_EC_GFP_NISTP224_POINT_GET_AFFINE_COORDINATES 226 +#define EC_F_EC_GFP_NISTP256_GROUP_SET_CURVE 230 +#define EC_F_EC_GFP_NISTP256_POINTS_MUL 231 +#define EC_F_EC_GFP_NISTP256_POINT_GET_AFFINE_COORDINATES 232 +#define EC_F_EC_GFP_NISTP521_GROUP_SET_CURVE 233 +#define EC_F_EC_GFP_NISTP521_POINTS_MUL 234 +#define EC_F_EC_GFP_NISTP521_POINT_GET_AFFINE_COORDINATES 235 +#define EC_F_EC_GFP_NIST_FIELD_MUL 200 +#define EC_F_EC_GFP_NIST_FIELD_SQR 201 +#define EC_F_EC_GFP_NIST_GROUP_SET_CURVE 202 +#define EC_F_EC_GFP_SIMPLE_GROUP_CHECK_DISCRIMINANT 165 +#define EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE 166 +#define EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE_GFP 100 +#define EC_F_EC_GFP_SIMPLE_GROUP_SET_GENERATOR 101 +#define EC_F_EC_GFP_SIMPLE_MAKE_AFFINE 102 +#define EC_F_EC_GFP_SIMPLE_OCT2POINT 103 +#define EC_F_EC_GFP_SIMPLE_POINT2OCT 104 +#define EC_F_EC_GFP_SIMPLE_POINTS_MAKE_AFFINE 137 +#define EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES 167 +#define EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES_GFP 105 +#define EC_F_EC_GFP_SIMPLE_POINT_SET_AFFINE_COORDINATES 168 +#define EC_F_EC_GFP_SIMPLE_POINT_SET_AFFINE_COORDINATES_GFP 128 +#define EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES 169 +#define EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES_GFP 129 +#define EC_F_EC_GROUP_CHECK 170 +#define EC_F_EC_GROUP_CHECK_DISCRIMINANT 171 +#define EC_F_EC_GROUP_COPY 106 +#define EC_F_EC_GROUP_GET0_GENERATOR 139 +#define EC_F_EC_GROUP_GET_COFACTOR 140 +#define EC_F_EC_GROUP_GET_CURVE_GF2M 172 +#define EC_F_EC_GROUP_GET_CURVE_GFP 130 +#define EC_F_EC_GROUP_GET_DEGREE 173 +#define EC_F_EC_GROUP_GET_ORDER 141 +#define EC_F_EC_GROUP_GET_PENTANOMIAL_BASIS 193 +#define EC_F_EC_GROUP_GET_TRINOMIAL_BASIS 194 +#define EC_F_EC_GROUP_NEW 108 +#define EC_F_EC_GROUP_NEW_BY_CURVE_NAME 174 +#define EC_F_EC_GROUP_NEW_FROM_DATA 175 +#define EC_F_EC_GROUP_PRECOMPUTE_MULT 142 +#define EC_F_EC_GROUP_SET_CURVE_GF2M 176 +#define EC_F_EC_GROUP_SET_CURVE_GFP 109 +#define EC_F_EC_GROUP_SET_EXTRA_DATA 110 +#define EC_F_EC_GROUP_SET_GENERATOR 111 +#define EC_F_EC_KEY_CHECK_KEY 177 +#define EC_F_EC_KEY_COPY 178 +#define EC_F_EC_KEY_GENERATE_KEY 179 +#define EC_F_EC_KEY_NEW 182 +#define EC_F_EC_KEY_PRINT 180 +#define EC_F_EC_KEY_PRINT_FP 181 +#define EC_F_EC_KEY_SET_PUBLIC_KEY_AFFINE_COORDINATES 229 +#define EC_F_EC_POINTS_MAKE_AFFINE 136 +#define EC_F_EC_POINT_ADD 112 +#define EC_F_EC_POINT_CMP 113 +#define EC_F_EC_POINT_COPY 114 +#define EC_F_EC_POINT_DBL 115 +#define EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M 183 +#define EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP 116 +#define EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP 117 +#define EC_F_EC_POINT_INVERT 210 +#define EC_F_EC_POINT_IS_AT_INFINITY 118 +#define EC_F_EC_POINT_IS_ON_CURVE 119 +#define EC_F_EC_POINT_MAKE_AFFINE 120 +#define EC_F_EC_POINT_MUL 184 +#define EC_F_EC_POINT_NEW 121 +#define EC_F_EC_POINT_OCT2POINT 122 +#define EC_F_EC_POINT_POINT2OCT 123 +#define EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M 185 +#define EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP 124 +#define EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GF2M 186 +#define EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GFP 125 +#define EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP 126 +#define EC_F_EC_POINT_SET_TO_INFINITY 127 +#define EC_F_EC_PRE_COMP_DUP 207 +#define EC_F_EC_PRE_COMP_NEW 196 +#define EC_F_EC_WNAF_MUL 187 +#define EC_F_EC_WNAF_PRECOMPUTE_MULT 188 +#define EC_F_I2D_ECPARAMETERS 190 +#define EC_F_I2D_ECPKPARAMETERS 191 +#define EC_F_I2D_ECPRIVATEKEY 192 +#define EC_F_I2O_ECPUBLICKEY 151 +#define EC_F_NISTP224_PRE_COMP_NEW 227 +#define EC_F_NISTP256_PRE_COMP_NEW 236 +#define EC_F_NISTP521_PRE_COMP_NEW 237 +#define EC_F_O2I_ECPUBLICKEY 152 +#define EC_F_OLD_EC_PRIV_DECODE 222 +#define EC_F_PKEY_EC_CTRL 197 +#define EC_F_PKEY_EC_CTRL_STR 198 +#define EC_F_PKEY_EC_DERIVE 217 +#define EC_F_PKEY_EC_KEYGEN 199 +#define EC_F_PKEY_EC_PARAMGEN 219 +#define EC_F_PKEY_EC_SIGN 218 + +/* Reason codes. */ +#define EC_R_ASN1_ERROR 115 +#define EC_R_ASN1_UNKNOWN_FIELD 116 +#define EC_R_BAD_SIGNATURE 166 +#define EC_R_BIGNUM_OUT_OF_RANGE 144 +#define EC_R_BUFFER_TOO_SMALL 100 +#define EC_R_COORDINATES_OUT_OF_RANGE 146 +#define EC_R_D2I_ECPKPARAMETERS_FAILURE 117 +#define EC_R_DECODE_ERROR 142 +#define EC_R_DISCRIMINANT_IS_ZERO 118 +#define EC_R_EC_GROUP_NEW_BY_NAME_FAILURE 119 +#define EC_R_FIELD_TOO_LARGE 143 +#define EC_R_GF2M_NOT_SUPPORTED 147 +#define EC_R_GROUP2PKPARAMETERS_FAILURE 120 +#define EC_R_I2D_ECPKPARAMETERS_FAILURE 121 +#define EC_R_INCOMPATIBLE_OBJECTS 101 +#define EC_R_INVALID_ARGUMENT 112 +#define EC_R_INVALID_COMPRESSED_POINT 110 +#define EC_R_INVALID_COMPRESSION_BIT 109 +#define EC_R_INVALID_CURVE 141 +#define EC_R_INVALID_DIGEST 151 +#define EC_R_INVALID_DIGEST_TYPE 138 +#define EC_R_INVALID_ENCODING 102 +#define EC_R_INVALID_FIELD 103 +#define EC_R_INVALID_FORM 104 +#define EC_R_INVALID_GROUP_ORDER 122 +#define EC_R_INVALID_KEY 165 +#define EC_R_INVALID_OUTPUT_LENGTH 171 +#define EC_R_INVALID_PEER_KEY 152 +#define EC_R_INVALID_PENTANOMIAL_BASIS 132 +#define EC_R_INVALID_PRIVATE_KEY 123 +#define EC_R_INVALID_TRINOMIAL_BASIS 137 +#define EC_R_KDF_FAILED 167 +#define EC_R_KDF_PARAMETER_ERROR 148 +#define EC_R_KEY_TRUNCATION 168 +#define EC_R_KEYS_NOT_SET 140 +#define EC_R_MISSING_PARAMETERS 124 +#define EC_R_MISSING_PRIVATE_KEY 125 +#define EC_R_NEED_NEW_SETUP_VALUES 170 +#define EC_R_NOT_A_NIST_PRIME 135 +#define EC_R_NOT_A_SUPPORTED_NIST_PRIME 136 +#define EC_R_NOT_IMPLEMENTED 126 +#define EC_R_NOT_INITIALIZED 111 +#define EC_R_NO_FIELD_MOD 133 +#define EC_R_NO_PARAMETERS_SET 139 +#define EC_R_PASSED_NULL_PARAMETER 134 +#define EC_R_PEER_KEY_ERROR 149 +#define EC_R_PKPARAMETERS2GROUP_FAILURE 127 +#define EC_R_POINT_AT_INFINITY 106 +#define EC_R_POINT_ARITHMETIC_FAILURE 169 +#define EC_R_POINT_IS_NOT_ON_CURVE 107 +#define EC_R_SHARED_INFO_ERROR 150 +#define EC_R_SLOT_FULL 108 +#define EC_R_UNDEFINED_GENERATOR 113 +#define EC_R_UNDEFINED_ORDER 128 +#define EC_R_UNKNOWN_COFACTOR 164 +#define EC_R_UNKNOWN_GROUP 129 +#define EC_R_UNKNOWN_ORDER 114 +#define EC_R_UNSUPPORTED_FIELD 131 +#define EC_R_WRONG_CURVE_PARAMETERS 145 +#define EC_R_WRONG_ORDER 130 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/ecdh.h b/curl/include/openssl/ecdh.h new file mode 100644 index 0000000..0149d5c --- /dev/null +++ b/curl/include/openssl/ecdh.h @@ -0,0 +1,6 @@ +/* $OpenBSD: ecdh.h,v 1.10 2023/07/28 09:25:12 tb Exp $ */ +/* + * Public domain. + */ + +#include diff --git a/curl/include/openssl/ecdsa.h b/curl/include/openssl/ecdsa.h new file mode 100644 index 0000000..9f498eb --- /dev/null +++ b/curl/include/openssl/ecdsa.h @@ -0,0 +1,6 @@ +/* $OpenBSD: ecdsa.h,v 1.20 2023/07/28 09:16:17 tb Exp $ */ +/* + * Public domain. + */ + +#include diff --git a/curl/include/openssl/engine.h b/curl/include/openssl/engine.h new file mode 100644 index 0000000..20398f8 --- /dev/null +++ b/curl/include/openssl/engine.h @@ -0,0 +1,215 @@ +/* $OpenBSD: engine.h,v 1.44 2024/03/02 10:22:07 tb Exp $ */ +/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL + * project 2000. + */ +/* ==================================================================== + * Copyright (c) 1999-2004 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ +/* ==================================================================== + * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. + * ECDH support in OpenSSL originally developed by + * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. + */ + +#ifndef HEADER_ENGINE_H +#define HEADER_ENGINE_H + +#include + +#include +#include + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define ENGINE_METHOD_RSA (unsigned int)0x0001 +#define ENGINE_METHOD_DSA (unsigned int)0x0002 +#define ENGINE_METHOD_DH (unsigned int)0x0004 +#define ENGINE_METHOD_RAND (unsigned int)0x0008 +#define ENGINE_METHOD_CIPHERS (unsigned int)0x0040 +#define ENGINE_METHOD_DIGESTS (unsigned int)0x0080 +#define ENGINE_METHOD_STORE (unsigned int)0x0100 +#define ENGINE_METHOD_PKEY_METHS (unsigned int)0x0200 +#define ENGINE_METHOD_PKEY_ASN1_METHS (unsigned int)0x0400 +#define ENGINE_METHOD_EC (unsigned int)0x0800 +#define ENGINE_METHOD_ALL (unsigned int)0xFFFF +#define ENGINE_METHOD_NONE (unsigned int)0x0000 + +/* + * Prototypes for the stub functions in engine_stubs.c. They are provided to + * build M2Crypto, Dovecot, apr-utils without patching. + */ +void ENGINE_load_builtin_engines(void); +void ENGINE_load_dynamic(void); +void ENGINE_load_openssl(void); +int ENGINE_register_all_complete(void); + +void ENGINE_cleanup(void); + +ENGINE *ENGINE_new(void); +int ENGINE_free(ENGINE *engine); +int ENGINE_init(ENGINE *engine); +int ENGINE_finish(ENGINE *engine); + +ENGINE *ENGINE_by_id(const char *id); +const char *ENGINE_get_id(const ENGINE *engine); +const char *ENGINE_get_name(const ENGINE *engine); + +int ENGINE_set_default(ENGINE *engine, unsigned int flags); + +ENGINE *ENGINE_get_default_RSA(void); +int ENGINE_set_default_RSA(ENGINE *engine); + +int ENGINE_ctrl_cmd(ENGINE *engine, const char *cmd_name, long i, void *p, + void (*f)(void), int cmd_optional); +int ENGINE_ctrl_cmd_string(ENGINE *engine, const char *cmd, const char *arg, + int cmd_optional); + +EVP_PKEY *ENGINE_load_private_key(ENGINE *engine, const char *key_id, + UI_METHOD *ui_method, void *callback_data); +EVP_PKEY *ENGINE_load_public_key(ENGINE *engine, const char *key_id, + UI_METHOD *ui_method, void *callback_data); + +/* Error codes for the ENGINE functions. */ + +/* Function codes. */ +#define ENGINE_F_DYNAMIC_CTRL 180 +#define ENGINE_F_DYNAMIC_GET_DATA_CTX 181 +#define ENGINE_F_DYNAMIC_LOAD 182 +#define ENGINE_F_DYNAMIC_SET_DATA_CTX 183 +#define ENGINE_F_ENGINE_ADD 105 +#define ENGINE_F_ENGINE_BY_ID 106 +#define ENGINE_F_ENGINE_CMD_IS_EXECUTABLE 170 +#define ENGINE_F_ENGINE_CTRL 142 +#define ENGINE_F_ENGINE_CTRL_CMD 178 +#define ENGINE_F_ENGINE_CTRL_CMD_STRING 171 +#define ENGINE_F_ENGINE_FINISH 107 +#define ENGINE_F_ENGINE_FREE_UTIL 108 +#define ENGINE_F_ENGINE_GET_CIPHER 185 +#define ENGINE_F_ENGINE_GET_DEFAULT_TYPE 177 +#define ENGINE_F_ENGINE_GET_DIGEST 186 +#define ENGINE_F_ENGINE_GET_NEXT 115 +#define ENGINE_F_ENGINE_GET_PKEY_ASN1_METH 193 +#define ENGINE_F_ENGINE_GET_PKEY_METH 192 +#define ENGINE_F_ENGINE_GET_PREV 116 +#define ENGINE_F_ENGINE_INIT 119 +#define ENGINE_F_ENGINE_LIST_ADD 120 +#define ENGINE_F_ENGINE_LIST_REMOVE 121 +#define ENGINE_F_ENGINE_LOAD_PRIVATE_KEY 150 +#define ENGINE_F_ENGINE_LOAD_PUBLIC_KEY 151 +#define ENGINE_F_ENGINE_LOAD_SSL_CLIENT_CERT 194 +#define ENGINE_F_ENGINE_NEW 122 +#define ENGINE_F_ENGINE_REMOVE 123 +#define ENGINE_F_ENGINE_SET_DEFAULT_STRING 189 +#define ENGINE_F_ENGINE_SET_DEFAULT_TYPE 126 +#define ENGINE_F_ENGINE_SET_ID 129 +#define ENGINE_F_ENGINE_SET_NAME 130 +#define ENGINE_F_ENGINE_TABLE_REGISTER 184 +#define ENGINE_F_ENGINE_UNLOAD_KEY 152 +#define ENGINE_F_ENGINE_UNLOCKED_FINISH 191 +#define ENGINE_F_ENGINE_UP_REF 190 +#define ENGINE_F_INT_CTRL_HELPER 172 +#define ENGINE_F_INT_ENGINE_CONFIGURE 188 +#define ENGINE_F_INT_ENGINE_MODULE_INIT 187 +#define ENGINE_F_LOG_MESSAGE 141 + +/* Reason codes. */ +#define ENGINE_R_ALREADY_LOADED 100 +#define ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER 133 +#define ENGINE_R_CMD_NOT_EXECUTABLE 134 +#define ENGINE_R_COMMAND_TAKES_INPUT 135 +#define ENGINE_R_COMMAND_TAKES_NO_INPUT 136 +#define ENGINE_R_CONFLICTING_ENGINE_ID 103 +#define ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED 119 +#define ENGINE_R_DH_NOT_IMPLEMENTED 139 +#define ENGINE_R_DSA_NOT_IMPLEMENTED 140 +#define ENGINE_R_DSO_FAILURE 104 +#define ENGINE_R_DSO_NOT_FOUND 132 +#define ENGINE_R_ENGINES_SECTION_ERROR 148 +#define ENGINE_R_ENGINE_CONFIGURATION_ERROR 102 +#define ENGINE_R_ENGINE_IS_NOT_IN_LIST 105 +#define ENGINE_R_ENGINE_SECTION_ERROR 149 +#define ENGINE_R_FAILED_LOADING_PRIVATE_KEY 128 +#define ENGINE_R_FAILED_LOADING_PUBLIC_KEY 129 +#define ENGINE_R_FINISH_FAILED 106 +#define ENGINE_R_GET_HANDLE_FAILED 107 +#define ENGINE_R_ID_OR_NAME_MISSING 108 +#define ENGINE_R_INIT_FAILED 109 +#define ENGINE_R_INTERNAL_LIST_ERROR 110 +#define ENGINE_R_INVALID_ARGUMENT 143 +#define ENGINE_R_INVALID_CMD_NAME 137 +#define ENGINE_R_INVALID_CMD_NUMBER 138 +#define ENGINE_R_INVALID_INIT_VALUE 151 +#define ENGINE_R_INVALID_STRING 150 +#define ENGINE_R_NOT_INITIALISED 117 +#define ENGINE_R_NOT_LOADED 112 +#define ENGINE_R_NO_CONTROL_FUNCTION 120 +#define ENGINE_R_NO_INDEX 144 +#define ENGINE_R_NO_LOAD_FUNCTION 125 +#define ENGINE_R_NO_REFERENCE 130 +#define ENGINE_R_NO_SUCH_ENGINE 116 +#define ENGINE_R_NO_UNLOAD_FUNCTION 126 +#define ENGINE_R_PROVIDE_PARAMETERS 113 +#define ENGINE_R_RSA_NOT_IMPLEMENTED 141 +#define ENGINE_R_UNIMPLEMENTED_CIPHER 146 +#define ENGINE_R_UNIMPLEMENTED_DIGEST 147 +#define ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD 101 +#define ENGINE_R_VERSION_INCOMPATIBILITY 145 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/err.h b/curl/include/openssl/err.h new file mode 100644 index 0000000..fe6c34d --- /dev/null +++ b/curl/include/openssl/err.h @@ -0,0 +1,396 @@ +/* $OpenBSD: err.h,v 1.36 2025/03/09 15:12:18 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ +/* ==================================================================== + * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#ifndef HEADER_ERR_H +#define HEADER_ERR_H + +#include + +#include +#include + +#include +#ifndef OPENSSL_NO_BIO +#include +#endif +#ifndef OPENSSL_NO_LHASH +#include +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +#ifndef OPENSSL_NO_FILENAMES +#define ERR_PUT_error(a,b,c,d,e) ERR_put_error(a,b,c,d,e) +#else +#define ERR_PUT_error(a,b,c,d,e) ERR_put_error(a,b,c,NULL,0) +#endif + +#include + +#define ERR_TXT_MALLOCED 0x01 +#define ERR_TXT_STRING 0x02 + +#define ERR_FLAG_MARK 0x01 + +#define ERR_NUM_ERRORS 16 + +/* library */ +#define ERR_LIB_NONE 1 +#define ERR_LIB_SYS 2 +#define ERR_LIB_BN 3 +#define ERR_LIB_RSA 4 +#define ERR_LIB_DH 5 +#define ERR_LIB_EVP 6 +#define ERR_LIB_BUF 7 +#define ERR_LIB_OBJ 8 +#define ERR_LIB_PEM 9 +#define ERR_LIB_DSA 10 +#define ERR_LIB_X509 11 +/* #define ERR_LIB_METH 12 */ +#define ERR_LIB_ASN1 13 +#define ERR_LIB_CONF 14 +#define ERR_LIB_CRYPTO 15 +#define ERR_LIB_EC 16 +#define ERR_LIB_SSL 20 +/* #define ERR_LIB_SSL23 21 */ +/* #define ERR_LIB_SSL2 22 */ +/* #define ERR_LIB_SSL3 23 */ +/* #define ERR_LIB_RSAREF 30 */ +/* #define ERR_LIB_PROXY 31 */ +#define ERR_LIB_BIO 32 +#define ERR_LIB_PKCS7 33 +#define ERR_LIB_X509V3 34 +#define ERR_LIB_PKCS12 35 +#define ERR_LIB_RAND 36 +#define ERR_LIB_DSO 37 +#define ERR_LIB_ENGINE 38 +#define ERR_LIB_OCSP 39 +#define ERR_LIB_UI 40 +#define ERR_LIB_COMP 41 +#define ERR_LIB_ECDSA 42 +#define ERR_LIB_ECDH 43 +#define ERR_LIB_STORE 44 +#define ERR_LIB_FIPS 45 +#define ERR_LIB_CMS 46 +#define ERR_LIB_TS 47 +#define ERR_LIB_HMAC 48 +#define ERR_LIB_JPAKE 49 +#define ERR_LIB_GOST 50 +#define ERR_LIB_CT 51 +#define ERR_LIB_KDF 52 + +#define ERR_LIB_USER 128 + +#ifndef LIBRESSL_INTERNAL +#define SYSerr(f,r) ERR_PUT_error(ERR_LIB_SYS,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define BNerr(f,r) ERR_PUT_error(ERR_LIB_BN,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define RSAerr(f,r) ERR_PUT_error(ERR_LIB_RSA,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define DHerr(f,r) ERR_PUT_error(ERR_LIB_DH,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define EVPerr(f,r) ERR_PUT_error(ERR_LIB_EVP,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define BUFerr(f,r) ERR_PUT_error(ERR_LIB_BUF,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define OBJerr(f,r) ERR_PUT_error(ERR_LIB_OBJ,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define PEMerr(f,r) ERR_PUT_error(ERR_LIB_PEM,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define DSAerr(f,r) ERR_PUT_error(ERR_LIB_DSA,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define X509err(f,r) ERR_PUT_error(ERR_LIB_X509,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define ASN1err(f,r) ERR_PUT_error(ERR_LIB_ASN1,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define CONFerr(f,r) ERR_PUT_error(ERR_LIB_CONF,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define CRYPTOerr(f,r) ERR_PUT_error(ERR_LIB_CRYPTO,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define ECerr(f,r) ERR_PUT_error(ERR_LIB_EC,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define BIOerr(f,r) ERR_PUT_error(ERR_LIB_BIO,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define PKCS7err(f,r) ERR_PUT_error(ERR_LIB_PKCS7,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define X509V3err(f,r) ERR_PUT_error(ERR_LIB_X509V3,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define PKCS12err(f,r) ERR_PUT_error(ERR_LIB_PKCS12,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define RANDerr(f,r) ERR_PUT_error(ERR_LIB_RAND,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define DSOerr(f,r) ERR_PUT_error(ERR_LIB_DSO,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define ENGINEerr(f,r) ERR_PUT_error(ERR_LIB_ENGINE,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define OCSPerr(f,r) ERR_PUT_error(ERR_LIB_OCSP,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define UIerr(f,r) ERR_PUT_error(ERR_LIB_UI,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define COMPerr(f,r) ERR_PUT_error(ERR_LIB_COMP,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define ECDSAerr(f,r) ERR_PUT_error(ERR_LIB_ECDSA,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define ECDHerr(f,r) ERR_PUT_error(ERR_LIB_ECDH,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define STOREerr(f,r) ERR_PUT_error(ERR_LIB_STORE,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define FIPSerr(f,r) ERR_PUT_error(ERR_LIB_FIPS,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define CMSerr(f,r) ERR_PUT_error(ERR_LIB_CMS,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define TSerr(f,r) ERR_PUT_error(ERR_LIB_TS,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define HMACerr(f,r) ERR_PUT_error(ERR_LIB_HMAC,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define JPAKEerr(f,r) ERR_PUT_error(ERR_LIB_JPAKE,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define GOSTerr(f,r) ERR_PUT_error(ERR_LIB_GOST,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define SSLerr(f,r) ERR_PUT_error(ERR_LIB_SSL,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define CTerr(f, r) ERR_PUT_error(ERR_LIB_CT,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#define KDFerr(f, r) ERR_PUT_error(ERR_LIB_KDF,(f),(r),OPENSSL_FILE,OPENSSL_LINE) +#endif + +#ifdef LIBRESSL_INTERNAL +#define SYSerror(r) ERR_PUT_error(ERR_LIB_SYS,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define BNerror(r) ERR_PUT_error(ERR_LIB_BN,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define RSAerror(r) ERR_PUT_error(ERR_LIB_RSA,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define DHerror(r) ERR_PUT_error(ERR_LIB_DH,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define EVPerror(r) ERR_PUT_error(ERR_LIB_EVP,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define BUFerror(r) ERR_PUT_error(ERR_LIB_BUF,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define OBJerror(r) ERR_PUT_error(ERR_LIB_OBJ,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define PEMerror(r) ERR_PUT_error(ERR_LIB_PEM,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define DSAerror(r) ERR_PUT_error(ERR_LIB_DSA,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define X509error(r) ERR_PUT_error(ERR_LIB_X509,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define ASN1error(r) ERR_PUT_error(ERR_LIB_ASN1,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define CONFerror(r) ERR_PUT_error(ERR_LIB_CONF,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define CRYPTOerror(r) ERR_PUT_error(ERR_LIB_CRYPTO,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define ECerror(r) ERR_PUT_error(ERR_LIB_EC,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define BIOerror(r) ERR_PUT_error(ERR_LIB_BIO,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define PKCS7error(r) ERR_PUT_error(ERR_LIB_PKCS7,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define X509V3error(r) ERR_PUT_error(ERR_LIB_X509V3,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define PKCS12error(r) ERR_PUT_error(ERR_LIB_PKCS12,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define RANDerror(r) ERR_PUT_error(ERR_LIB_RAND,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define DSOerror(r) ERR_PUT_error(ERR_LIB_DSO,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define ENGINEerror(r) ERR_PUT_error(ERR_LIB_ENGINE,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define OCSPerror(r) ERR_PUT_error(ERR_LIB_OCSP,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define UIerror(r) ERR_PUT_error(ERR_LIB_UI,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define COMPerror(r) ERR_PUT_error(ERR_LIB_COMP,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define ECDSAerror(r) ERR_PUT_error(ERR_LIB_ECDSA,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define ECDHerror(r) ERR_PUT_error(ERR_LIB_ECDH,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define STOREerror(r) ERR_PUT_error(ERR_LIB_STORE,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define FIPSerror(r) ERR_PUT_error(ERR_LIB_FIPS,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define CMSerror(r) ERR_PUT_error(ERR_LIB_CMS,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define TSerror(r) ERR_PUT_error(ERR_LIB_TS,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define HMACerror(r) ERR_PUT_error(ERR_LIB_HMAC,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define JPAKEerror(r) ERR_PUT_error(ERR_LIB_JPAKE,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define GOSTerror(r) ERR_PUT_error(ERR_LIB_GOST,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define CTerror(r) ERR_PUT_error(ERR_LIB_CT,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#define KDFerror(r) ERR_PUT_error(ERR_LIB_KDF,(0xfff),(r),OPENSSL_FILE,OPENSSL_LINE) +#endif + +#define ERR_PACK(l,f,r) (((((unsigned long)l)&0xffL)<<24L)| \ + ((((unsigned long)f)&0xfffL)<<12L)| \ + ((((unsigned long)r)&0xfffL))) +#define ERR_GET_LIB(l) (int)((((unsigned long)l)>>24L)&0xffL) +#define ERR_GET_FUNC(l) (int)((((unsigned long)l)>>12L)&0xfffL) +#define ERR_GET_REASON(l) (int)((l)&0xfffL) +#define ERR_FATAL_ERROR(l) (int)((l)&ERR_R_FATAL) + + +/* OS functions */ +#define SYS_F_FOPEN 1 +#define SYS_F_CONNECT 2 +#define SYS_F_GETSERVBYNAME 3 +#define SYS_F_SOCKET 4 +#define SYS_F_IOCTLSOCKET 5 +#define SYS_F_BIND 6 +#define SYS_F_LISTEN 7 +#define SYS_F_ACCEPT 8 +#define SYS_F_WSASTARTUP 9 /* Winsock stuff */ +#define SYS_F_OPENDIR 10 +#define SYS_F_FREAD 11 + + +/* reasons */ +#define ERR_R_SYS_LIB ERR_LIB_SYS /* 2 */ +#define ERR_R_BN_LIB ERR_LIB_BN /* 3 */ +#define ERR_R_RSA_LIB ERR_LIB_RSA /* 4 */ +#define ERR_R_DH_LIB ERR_LIB_DH /* 5 */ +#define ERR_R_EVP_LIB ERR_LIB_EVP /* 6 */ +#define ERR_R_BUF_LIB ERR_LIB_BUF /* 7 */ +#define ERR_R_OBJ_LIB ERR_LIB_OBJ /* 8 */ +#define ERR_R_PEM_LIB ERR_LIB_PEM /* 9 */ +#define ERR_R_DSA_LIB ERR_LIB_DSA /* 10 */ +#define ERR_R_X509_LIB ERR_LIB_X509 /* 11 */ +#define ERR_R_ASN1_LIB ERR_LIB_ASN1 /* 13 */ +#define ERR_R_CONF_LIB ERR_LIB_CONF /* 14 */ +#define ERR_R_CRYPTO_LIB ERR_LIB_CRYPTO /* 15 */ +#define ERR_R_EC_LIB ERR_LIB_EC /* 16 */ +#define ERR_R_SSL_LIB ERR_LIB_SSL /* 20 */ +#define ERR_R_BIO_LIB ERR_LIB_BIO /* 32 */ +#define ERR_R_PKCS7_LIB ERR_LIB_PKCS7 /* 33 */ +#define ERR_R_X509V3_LIB ERR_LIB_X509V3 /* 34 */ +#define ERR_R_PKCS12_LIB ERR_LIB_PKCS12 /* 35 */ +#define ERR_R_RAND_LIB ERR_LIB_RAND /* 36 */ +#define ERR_R_DSO_LIB ERR_LIB_DSO /* 37 */ +#define ERR_R_ENGINE_LIB ERR_LIB_ENGINE /* 38 */ +#define ERR_R_OCSP_LIB ERR_LIB_OCSP /* 39 */ +#define ERR_R_UI_LIB ERR_LIB_UI /* 40 */ +#define ERR_R_COMP_LIB ERR_LIB_COMP /* 41 */ +#define ERR_R_ECDSA_LIB ERR_LIB_ECDSA /* 42 */ +#define ERR_R_ECDH_LIB ERR_LIB_ECDH /* 43 */ +#define ERR_R_STORE_LIB ERR_LIB_STORE /* 44 */ +#define ERR_R_TS_LIB ERR_LIB_TS /* 45 */ + +#define ERR_R_NESTED_ASN1_ERROR 58 +#define ERR_R_BAD_ASN1_OBJECT_HEADER 59 +#define ERR_R_BAD_GET_ASN1_OBJECT_CALL 60 +#define ERR_R_EXPECTING_AN_ASN1_SEQUENCE 61 +#define ERR_R_ASN1_LENGTH_MISMATCH 62 +#define ERR_R_MISSING_ASN1_EOS 63 + +/* fatal error */ +#define ERR_R_FATAL 64 +#define ERR_R_MALLOC_FAILURE (1|ERR_R_FATAL) +#define ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED (2|ERR_R_FATAL) +#define ERR_R_PASSED_NULL_PARAMETER (3|ERR_R_FATAL) +#define ERR_R_INTERNAL_ERROR (4|ERR_R_FATAL) +#define ERR_R_DISABLED (5|ERR_R_FATAL) +#define ERR_R_INIT_FAIL (6|ERR_R_FATAL) + +/* 99 is the maximum possible ERR_R_... code, higher values + * are reserved for the individual libraries */ + +typedef struct ERR_string_data_st { + unsigned long error; + const char *string; +} ERR_STRING_DATA; + +void ERR_put_error(int lib, int func, int reason, const char *file, int line); +void ERR_set_error_data(char *data, int flags); + +unsigned long ERR_get_error(void); +unsigned long ERR_get_error_line(const char **file, int *line); +unsigned long ERR_get_error_line_data(const char **file, int *line, + const char **data, int *flags); +unsigned long ERR_peek_error(void); +unsigned long ERR_peek_error_line(const char **file, int *line); +unsigned long ERR_peek_error_line_data(const char **file, int *line, + const char **data, int *flags); +unsigned long ERR_peek_last_error(void); +unsigned long ERR_peek_last_error_line(const char **file, int *line); +unsigned long ERR_peek_last_error_line_data(const char **file, int *line, + const char **data, int *flags); +void ERR_clear_error(void ); +char *ERR_error_string(unsigned long e, char *buf); +void ERR_error_string_n(unsigned long e, char *buf, size_t len); +const char *ERR_lib_error_string(unsigned long e); +const char *ERR_func_error_string(unsigned long e); +const char *ERR_reason_error_string(unsigned long e); +void ERR_print_errors_cb(int (*cb)(const char *str, size_t len, void *u), + void *u); +void ERR_print_errors_fp(FILE *fp); +#ifndef OPENSSL_NO_BIO +void ERR_print_errors(BIO *bp); +#endif +void ERR_asprintf_error_data(char * format, ...); +void ERR_load_strings(int lib, ERR_STRING_DATA *str); +void ERR_unload_strings(int lib, ERR_STRING_DATA *str); +void ERR_load_ERR_strings(void); +void ERR_load_crypto_strings(void); +void ERR_free_strings(void); + +void ERR_remove_thread_state(const CRYPTO_THREADID *tid); +/* Wrapped in OPENSSL_NO_DEPRECATED in 0.9.8. Still used in 2023. */ +void ERR_remove_state(unsigned long pid); + +int ERR_get_next_error_library(void); + +int ERR_set_mark(void); +int ERR_pop_to_mark(void); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/evp.h b/curl/include/openssl/evp.h new file mode 100644 index 0000000..c2b81d0 --- /dev/null +++ b/curl/include/openssl/evp.h @@ -0,0 +1,1292 @@ +/* $OpenBSD: evp.h,v 1.137 2024/08/31 10:38:49 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_ENVELOPE_H +#define HEADER_ENVELOPE_H + +#include + +#include + +#ifndef OPENSSL_NO_BIO +#include +#endif + +/* +#define EVP_RC2_KEY_SIZE 16 +#define EVP_RC4_KEY_SIZE 16 +#define EVP_BLOWFISH_KEY_SIZE 16 +#define EVP_CAST5_KEY_SIZE 16 +#define EVP_RC5_32_12_16_KEY_SIZE 16 +*/ +#define EVP_MAX_MD_SIZE 64 /* longest known is SHA512 */ +#define EVP_MAX_KEY_LENGTH 64 +#define EVP_MAX_IV_LENGTH 16 +#define EVP_MAX_BLOCK_LENGTH 32 + +#define PKCS5_SALT_LEN 8 +/* Default PKCS#5 iteration count */ +#define PKCS5_DEFAULT_ITER 2048 + +#include + +#define EVP_PK_RSA 0x0001 +#define EVP_PK_DSA 0x0002 +#define EVP_PK_DH 0x0004 +#define EVP_PK_EC 0x0008 +#define EVP_PKT_SIGN 0x0010 +#define EVP_PKT_ENC 0x0020 +#define EVP_PKT_EXCH 0x0040 +#define EVP_PKS_RSA 0x0100 +#define EVP_PKS_DSA 0x0200 +#define EVP_PKS_EC 0x0400 +#define EVP_PKT_EXP 0x1000 /* <= 512 bit key */ + +#define EVP_PKEY_NONE NID_undef +#define EVP_PKEY_RSA NID_rsaEncryption +#define EVP_PKEY_RSA_PSS NID_rsassaPss +#define EVP_PKEY_RSA2 NID_rsa +#define EVP_PKEY_DSA NID_dsa +#define EVP_PKEY_DSA1 NID_dsa_2 +#define EVP_PKEY_DSA2 NID_dsaWithSHA +#define EVP_PKEY_DSA3 NID_dsaWithSHA1 +#define EVP_PKEY_DSA4 NID_dsaWithSHA1_2 +#define EVP_PKEY_DH NID_dhKeyAgreement +#define EVP_PKEY_EC NID_X9_62_id_ecPublicKey +#define EVP_PKEY_GOSTR01 NID_id_GostR3410_2001 +#define EVP_PKEY_GOSTIMIT NID_id_Gost28147_89_MAC +#define EVP_PKEY_HMAC NID_hmac +#define EVP_PKEY_CMAC NID_cmac +#define EVP_PKEY_HKDF NID_hkdf +#define EVP_PKEY_TLS1_PRF NID_tls1_prf +#define EVP_PKEY_GOSTR12_256 NID_id_tc26_gost3410_2012_256 +#define EVP_PKEY_GOSTR12_512 NID_id_tc26_gost3410_2012_512 +#define EVP_PKEY_ED25519 NID_ED25519 +#define EVP_PKEY_X25519 NID_X25519 + +#ifdef __cplusplus +extern "C" { +#endif + +#define EVP_PKEY_MO_SIGN 0x0001 +#define EVP_PKEY_MO_VERIFY 0x0002 +#define EVP_PKEY_MO_ENCRYPT 0x0004 +#define EVP_PKEY_MO_DECRYPT 0x0008 + +#ifndef EVP_MD +#define EVP_MD_FLAG_ONESHOT 0x0001 /* digest can only handle a single + * block */ + +/* DigestAlgorithmIdentifier flags... */ + +#define EVP_MD_FLAG_DIGALGID_MASK 0x0018 + +/* NULL or absent parameter accepted. Use NULL */ + +#define EVP_MD_FLAG_DIGALGID_NULL 0x0000 + +/* NULL or absent parameter accepted. Use NULL for PKCS#1 otherwise absent */ + +#define EVP_MD_FLAG_DIGALGID_ABSENT 0x0008 + +/* Custom handling via ctrl */ + +#define EVP_MD_FLAG_DIGALGID_CUSTOM 0x0018 + +#define EVP_MD_FLAG_FIPS 0x0400 /* Note if suitable for use in FIPS mode */ + +/* Digest ctrls */ + +#define EVP_MD_CTRL_DIGALGID 0x1 +#define EVP_MD_CTRL_MICALG 0x2 +#define EVP_MD_CTRL_SET_KEY 0x3 +#define EVP_MD_CTRL_GOST_SET_SBOX 0x4 + +/* Minimum Algorithm specific ctrl value */ + +#define EVP_MD_CTRL_ALG_CTRL 0x1000 + +#endif /* !EVP_MD */ + +/* values for EVP_MD_CTX flags */ + +#define EVP_MD_CTX_FLAG_ONESHOT 0x0001 /* digest update will be called + * once only */ +#define EVP_MD_CTX_FLAG_CLEANED 0x0002 /* context has already been + * cleaned */ +#define EVP_MD_CTX_FLAG_REUSE 0x0004 /* Don't free up ctx->md_data + * in EVP_MD_CTX_cleanup */ +/* FIPS and pad options are ignored in 1.0.0, definitions are here + * so we don't accidentally reuse the values for other purposes. + */ + +#define EVP_MD_CTX_FLAG_NON_FIPS_ALLOW 0x0008 /* Allow use of non FIPS digest + * in FIPS mode */ + +/* The following PAD options are also currently ignored in 1.0.0, digest + * parameters are handled through EVP_DigestSign*() and EVP_DigestVerify*() + * instead. + */ +#define EVP_MD_CTX_FLAG_PAD_MASK 0xF0 /* RSA mode to use */ +#define EVP_MD_CTX_FLAG_PAD_PKCS1 0x00 /* PKCS#1 v1.5 mode */ +#define EVP_MD_CTX_FLAG_PAD_PSS 0x20 /* PSS mode */ + +#define EVP_MD_CTX_FLAG_NO_INIT 0x0100 /* Don't initialize md_data */ + +/* Values for cipher flags */ + +/* Modes for ciphers */ + +#define EVP_CIPH_STREAM_CIPHER 0x0 +#define EVP_CIPH_ECB_MODE 0x1 +#define EVP_CIPH_CBC_MODE 0x2 +#define EVP_CIPH_CFB_MODE 0x3 +#define EVP_CIPH_OFB_MODE 0x4 +#define EVP_CIPH_CTR_MODE 0x5 +#define EVP_CIPH_GCM_MODE 0x6 +#define EVP_CIPH_CCM_MODE 0x7 +#define EVP_CIPH_XTS_MODE 0x10001 +#define EVP_CIPH_WRAP_MODE 0x10002 +#define EVP_CIPH_MODE 0xF0007 +/* Set if variable length cipher */ +#define EVP_CIPH_VARIABLE_LENGTH 0x8 +/* Set if the iv handling should be done by the cipher itself */ +#define EVP_CIPH_CUSTOM_IV 0x10 +/* Set if the cipher's init() function should be called if key is NULL */ +#define EVP_CIPH_ALWAYS_CALL_INIT 0x20 +/* Call ctrl() to init cipher parameters */ +#define EVP_CIPH_CTRL_INIT 0x40 +/* Don't use standard block padding */ +#define EVP_CIPH_NO_PADDING 0x100 +/* cipher handles random key generation */ +#define EVP_CIPH_RAND_KEY 0x200 +/* cipher has its own additional copying logic */ +#define EVP_CIPH_CUSTOM_COPY 0x400 +/* Allow use default ASN1 get/set iv */ +#define EVP_CIPH_FLAG_DEFAULT_ASN1 0x1000 +/* Buffer length in bits not bytes: CFB1 mode only */ +#define EVP_CIPH_FLAG_LENGTH_BITS 0x2000 +/* Note if suitable for use in FIPS mode */ +#define EVP_CIPH_FLAG_FIPS 0x4000 +/* Allow non FIPS cipher in FIPS mode */ +#define EVP_CIPH_FLAG_NON_FIPS_ALLOW 0x8000 +/* Cipher handles any and all padding logic as well + * as finalisation. + */ +#define EVP_CIPH_FLAG_CUSTOM_CIPHER 0x100000 +#define EVP_CIPH_FLAG_AEAD_CIPHER 0x200000 + +/* + * Cipher context flag to indicate that we can handle wrap mode: if allowed in + * older applications, it could overflow buffers. + */ +#define EVP_CIPHER_CTX_FLAG_WRAP_ALLOW 0x1 + +/* ctrl() values */ + +#define EVP_CTRL_INIT 0x0 +#define EVP_CTRL_GET_RC2_KEY_BITS 0x2 +#define EVP_CTRL_SET_RC2_KEY_BITS 0x3 +#define EVP_CTRL_GET_RC5_ROUNDS 0x4 +#define EVP_CTRL_SET_RC5_ROUNDS 0x5 +#define EVP_CTRL_RAND_KEY 0x6 +#define EVP_CTRL_PBE_PRF_NID 0x7 +#define EVP_CTRL_COPY 0x8 +#define EVP_CTRL_AEAD_SET_IVLEN 0x9 +#define EVP_CTRL_AEAD_GET_TAG 0x10 +#define EVP_CTRL_AEAD_SET_TAG 0x11 +#define EVP_CTRL_AEAD_SET_IV_FIXED 0x12 +#define EVP_CTRL_GCM_SET_IVLEN EVP_CTRL_AEAD_SET_IVLEN +#define EVP_CTRL_GCM_GET_TAG EVP_CTRL_AEAD_GET_TAG +#define EVP_CTRL_GCM_SET_TAG EVP_CTRL_AEAD_SET_TAG +#define EVP_CTRL_GCM_SET_IV_FIXED EVP_CTRL_AEAD_SET_IV_FIXED +#define EVP_CTRL_GCM_IV_GEN 0x13 +#define EVP_CTRL_CCM_SET_IVLEN EVP_CTRL_AEAD_SET_IVLEN +#define EVP_CTRL_CCM_GET_TAG EVP_CTRL_AEAD_GET_TAG +#define EVP_CTRL_CCM_SET_TAG EVP_CTRL_AEAD_SET_TAG +#define EVP_CTRL_CCM_SET_L 0x14 +#define EVP_CTRL_CCM_SET_MSGLEN 0x15 +/* AEAD cipher deduces payload length and returns number of bytes + * required to store MAC and eventual padding. Subsequent call to + * EVP_Cipher even appends/verifies MAC. + */ +#define EVP_CTRL_AEAD_TLS1_AAD 0x16 +/* Used by composite AEAD ciphers, no-op in GCM, CCM... */ +#define EVP_CTRL_AEAD_SET_MAC_KEY 0x17 +/* Set the GCM invocation field, decrypt only */ +#define EVP_CTRL_GCM_SET_IV_INV 0x18 +/* Set the S-BOX NID for GOST ciphers */ +#define EVP_CTRL_GOST_SET_SBOX 0x19 + +/* GCM TLS constants */ +/* Length of fixed part of IV derived from PRF */ +#define EVP_GCM_TLS_FIXED_IV_LEN 4 +/* Length of explicit part of IV part of TLS records */ +#define EVP_GCM_TLS_EXPLICIT_IV_LEN 8 +/* Length of tag for TLS */ +#define EVP_GCM_TLS_TAG_LEN 16 + +/* CCM TLS constants */ +/* Length of fixed part of IV derived from PRF */ +#define EVP_CCM_TLS_FIXED_IV_LEN 4 +/* Length of explicit part of IV part of TLS records */ +#define EVP_CCM_TLS_EXPLICIT_IV_LEN 8 +/* Total length of CCM IV length for TLS */ +#define EVP_CCM_TLS_IV_LEN 12 +/* Length of tag for TLS */ +#define EVP_CCM_TLS_TAG_LEN 16 +/* Length of CCM8 tag for TLS */ +#define EVP_CCM8_TLS_TAG_LEN 8 + +/* Length of tag for TLS */ +#define EVP_CHACHAPOLY_TLS_TAG_LEN 16 + +/* XXX - do we want to expose these? */ +#if defined(LIBRESSL_INTERNAL) +#define ED25519_KEYLEN 32 +#define X25519_KEYLEN 32 +#endif + +typedef struct evp_cipher_info_st { + const EVP_CIPHER *cipher; + unsigned char iv[EVP_MAX_IV_LENGTH]; +} EVP_CIPHER_INFO; + +/* Password based encryption function */ +typedef int EVP_PBE_KEYGEN(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, + ASN1_TYPE *param, const EVP_CIPHER *cipher, const EVP_MD *md, int en_de); + +#ifndef OPENSSL_NO_RSA +#define EVP_PKEY_assign_RSA(pkey,rsa) EVP_PKEY_assign((pkey),EVP_PKEY_RSA,\ + (char *)(rsa)) +#endif + +#ifndef OPENSSL_NO_DSA +#define EVP_PKEY_assign_DSA(pkey,dsa) EVP_PKEY_assign((pkey),EVP_PKEY_DSA,\ + (char *)(dsa)) +#endif + +#ifndef OPENSSL_NO_DH +#define EVP_PKEY_assign_DH(pkey,dh) EVP_PKEY_assign((pkey),EVP_PKEY_DH,\ + (char *)(dh)) +#endif + +#ifndef OPENSSL_NO_EC +#define EVP_PKEY_assign_EC_KEY(pkey,eckey) EVP_PKEY_assign((pkey),EVP_PKEY_EC,\ + (char *)(eckey)) +#endif + +/* Add some extra combinations */ +#define EVP_get_digestbynid(a) EVP_get_digestbyname(OBJ_nid2sn(a)) +#define EVP_get_digestbyobj(a) EVP_get_digestbynid(OBJ_obj2nid(a)) +#define EVP_get_cipherbynid(a) EVP_get_cipherbyname(OBJ_nid2sn(a)) +#define EVP_get_cipherbyobj(a) EVP_get_cipherbynid(OBJ_obj2nid(a)) + +int EVP_MD_type(const EVP_MD *md); +#define EVP_MD_nid(e) EVP_MD_type(e) +#define EVP_MD_name(e) OBJ_nid2sn(EVP_MD_nid(e)) +int EVP_MD_pkey_type(const EVP_MD *md); +int EVP_MD_size(const EVP_MD *md); +int EVP_MD_block_size(const EVP_MD *md); +unsigned long EVP_MD_flags(const EVP_MD *md); + +const EVP_MD *EVP_MD_CTX_md(const EVP_MD_CTX *ctx); +void *EVP_MD_CTX_md_data(const EVP_MD_CTX *ctx); +EVP_PKEY_CTX *EVP_MD_CTX_pkey_ctx(const EVP_MD_CTX *ctx); +void EVP_MD_CTX_set_pkey_ctx(EVP_MD_CTX *ctx, EVP_PKEY_CTX *pctx); +#define EVP_MD_CTX_size(e) EVP_MD_size(EVP_MD_CTX_md(e)) +#define EVP_MD_CTX_block_size(e) EVP_MD_block_size(EVP_MD_CTX_md(e)) +#define EVP_MD_CTX_type(e) EVP_MD_type(EVP_MD_CTX_md(e)) + +int EVP_CIPHER_nid(const EVP_CIPHER *cipher); +#define EVP_CIPHER_name(e) OBJ_nid2sn(EVP_CIPHER_nid(e)) +int EVP_CIPHER_block_size(const EVP_CIPHER *cipher); +int EVP_CIPHER_key_length(const EVP_CIPHER *cipher); +int EVP_CIPHER_iv_length(const EVP_CIPHER *cipher); +unsigned long EVP_CIPHER_flags(const EVP_CIPHER *cipher); +#define EVP_CIPHER_mode(e) (EVP_CIPHER_flags(e) & EVP_CIPH_MODE) + +const EVP_CIPHER * EVP_CIPHER_CTX_cipher(const EVP_CIPHER_CTX *ctx); +int EVP_CIPHER_CTX_encrypting(const EVP_CIPHER_CTX *ctx); +int EVP_CIPHER_CTX_nid(const EVP_CIPHER_CTX *ctx); +int EVP_CIPHER_CTX_block_size(const EVP_CIPHER_CTX *ctx); +int EVP_CIPHER_CTX_key_length(const EVP_CIPHER_CTX *ctx); +int EVP_CIPHER_CTX_iv_length(const EVP_CIPHER_CTX *ctx); +int EVP_CIPHER_CTX_get_iv(const EVP_CIPHER_CTX *ctx, + unsigned char *iv, size_t len); +int EVP_CIPHER_CTX_set_iv(EVP_CIPHER_CTX *ctx, + const unsigned char *iv, size_t len); +int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in); +void *EVP_CIPHER_CTX_get_app_data(const EVP_CIPHER_CTX *ctx); +void EVP_CIPHER_CTX_set_app_data(EVP_CIPHER_CTX *ctx, void *data); +void *EVP_CIPHER_CTX_get_cipher_data(const EVP_CIPHER_CTX *ctx); +void *EVP_CIPHER_CTX_set_cipher_data(EVP_CIPHER_CTX *ctx, void *cipher_data); +unsigned char *EVP_CIPHER_CTX_buf_noconst(EVP_CIPHER_CTX *ctx); +#define EVP_CIPHER_CTX_type(c) EVP_CIPHER_type(EVP_CIPHER_CTX_cipher(c)) +unsigned long EVP_CIPHER_CTX_flags(const EVP_CIPHER_CTX *ctx); +#define EVP_CIPHER_CTX_mode(e) (EVP_CIPHER_CTX_flags(e) & EVP_CIPH_MODE) + +EVP_CIPHER *EVP_CIPHER_meth_new(int cipher_type, int block_size, int key_len); +EVP_CIPHER *EVP_CIPHER_meth_dup(const EVP_CIPHER *cipher); +void EVP_CIPHER_meth_free(EVP_CIPHER *cipher); + +int EVP_CIPHER_meth_set_iv_length(EVP_CIPHER *cipher, int iv_len); +int EVP_CIPHER_meth_set_flags(EVP_CIPHER *cipher, unsigned long flags); +int EVP_CIPHER_meth_set_impl_ctx_size(EVP_CIPHER *cipher, int ctx_size); +int EVP_CIPHER_meth_set_init(EVP_CIPHER *cipher, + int (*init)(EVP_CIPHER_CTX *ctx, const unsigned char *key, + const unsigned char *iv, int enc)); +int EVP_CIPHER_meth_set_do_cipher(EVP_CIPHER *cipher, + int (*do_cipher)(EVP_CIPHER_CTX *ctx, unsigned char *out, + const unsigned char *in, size_t inl)); +int EVP_CIPHER_meth_set_cleanup(EVP_CIPHER *cipher, + int (*cleanup)(EVP_CIPHER_CTX *)); +int EVP_CIPHER_meth_set_set_asn1_params(EVP_CIPHER *cipher, + int (*set_asn1_parameters)(EVP_CIPHER_CTX *, ASN1_TYPE *)); +int EVP_CIPHER_meth_set_get_asn1_params(EVP_CIPHER *cipher, + int (*get_asn1_parameters)(EVP_CIPHER_CTX *, ASN1_TYPE *)); +int EVP_CIPHER_meth_set_ctrl(EVP_CIPHER *cipher, + int (*ctrl)(EVP_CIPHER_CTX *, int type, int arg, void *ptr)); + +EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *engine, + const unsigned char *private_key, size_t len); +EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *engine, + const unsigned char *public_key, size_t len); +int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, + unsigned char *out_private_key, size_t *out_len); +int EVP_PKEY_get_raw_public_key(const EVP_PKEY *pkey, + unsigned char *out_public_key, size_t *out_len); + +#define EVP_ENCODE_LENGTH(l) (((l+2)/3*4)+(l/48+1)*2+80) +#define EVP_DECODE_LENGTH(l) ((l+3)/4*3+80) + +#define EVP_SignInit_ex(a,b,c) EVP_DigestInit_ex(a,b,c) +#define EVP_SignInit(a,b) EVP_DigestInit(a,b) +#define EVP_SignUpdate(a,b,c) EVP_DigestUpdate(a,b,c) +#define EVP_VerifyInit_ex(a,b,c) EVP_DigestInit_ex(a,b,c) +#define EVP_VerifyInit(a,b) EVP_DigestInit(a,b) +#define EVP_VerifyUpdate(a,b,c) EVP_DigestUpdate(a,b,c) +#define EVP_OpenUpdate(a,b,c,d,e) EVP_DecryptUpdate(a,b,c,d,e) +#define EVP_SealUpdate(a,b,c,d,e) EVP_EncryptUpdate(a,b,c,d,e) +#define EVP_DigestSignUpdate(a,b,c) EVP_DigestUpdate(a,b,c) +#define EVP_DigestVerifyUpdate(a,b,c) EVP_DigestUpdate(a,b,c) + +#define BIO_set_md(b,md) BIO_ctrl(b,BIO_C_SET_MD,0,(char *)md) +#define BIO_get_md(b,mdp) BIO_ctrl(b,BIO_C_GET_MD,0,(char *)mdp) +#define BIO_get_md_ctx(b,mdcp) BIO_ctrl(b,BIO_C_GET_MD_CTX,0,(char *)mdcp) +#define BIO_set_md_ctx(b,mdcp) BIO_ctrl(b,BIO_C_SET_MD_CTX,0,(char *)mdcp) +#define BIO_get_cipher_status(b) BIO_ctrl(b,BIO_C_GET_CIPHER_STATUS,0,NULL) +#define BIO_get_cipher_ctx(b,c_pp) BIO_ctrl(b,BIO_C_GET_CIPHER_CTX,0,(char *)c_pp) + +int EVP_Cipher(EVP_CIPHER_CTX *c, unsigned char *out, const unsigned char *in, + unsigned int inl); + +EVP_MD_CTX *EVP_MD_CTX_new(void); +void EVP_MD_CTX_free(EVP_MD_CTX *ctx); +int EVP_MD_CTX_init(EVP_MD_CTX *ctx); +int EVP_MD_CTX_reset(EVP_MD_CTX *ctx); +EVP_MD_CTX *EVP_MD_CTX_create(void); +void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx); +int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx); +int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in); +void EVP_MD_CTX_set_flags(EVP_MD_CTX *ctx, int flags); +void EVP_MD_CTX_clear_flags(EVP_MD_CTX *ctx, int flags); +int EVP_MD_CTX_ctrl(EVP_MD_CTX *ctx, int type, int arg, void *ptr); +int EVP_MD_CTX_test_flags(const EVP_MD_CTX *ctx, int flags); + +int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl); +int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *d, size_t cnt); +int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *s); +int EVP_Digest(const void *data, size_t count, unsigned char *md, + unsigned int *size, const EVP_MD *type, ENGINE *impl); + +int EVP_MD_CTX_copy(EVP_MD_CTX *out, const EVP_MD_CTX *in); +int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type); +int EVP_DigestFinal(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *s); + +int EVP_read_pw_string(char *buf, int length, const char *prompt, int verify); +int EVP_read_pw_string_min(char *buf, int minlen, int maxlen, + const char *prompt, int verify); +void EVP_set_pw_prompt(const char *prompt); +char *EVP_get_pw_prompt(void); + +int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md, + const unsigned char *salt, const unsigned char *data, int datal, int count, + unsigned char *key, unsigned char *iv); + +void EVP_CIPHER_CTX_set_flags(EVP_CIPHER_CTX *ctx, int flags); +void EVP_CIPHER_CTX_clear_flags(EVP_CIPHER_CTX *ctx, int flags); +int EVP_CIPHER_CTX_test_flags(const EVP_CIPHER_CTX *ctx, int flags); + +int EVP_EncryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, + const unsigned char *key, const unsigned char *iv); +int EVP_EncryptInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, + ENGINE *impl, const unsigned char *key, const unsigned char *iv); +int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, + const unsigned char *in, int inl); +int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl); +int EVP_EncryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl); + +int EVP_DecryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, + const unsigned char *key, const unsigned char *iv); +int EVP_DecryptInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, + ENGINE *impl, const unsigned char *key, const unsigned char *iv); +int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, + const unsigned char *in, int inl); +int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl); +int EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl); + +int EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, + const unsigned char *key, const unsigned char *iv, int enc); +int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, + ENGINE *impl, const unsigned char *key, const unsigned char *iv, int enc); +int EVP_CipherUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl, + const unsigned char *in, int inl); +int EVP_CipherFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl); +int EVP_CipherFinal(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl); + +int EVP_SignFinal(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *s, + EVP_PKEY *pkey); + +int EVP_VerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sigbuf, + unsigned int siglen, EVP_PKEY *pkey); + +int EVP_DigestSignInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, + const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey); +int EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, size_t *siglen); + +int EVP_DigestSign(EVP_MD_CTX *ctx, unsigned char *sigret, size_t *siglen, + const unsigned char *tbs, size_t tbslen); + +int EVP_DigestVerifyInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, + const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey); +int EVP_DigestVerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sig, + size_t siglen); + +int EVP_DigestVerify(EVP_MD_CTX *ctx, const unsigned char *sigret, + size_t siglen, const unsigned char *tbs, size_t tbslen); + +int EVP_OpenInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, + const unsigned char *ek, int ekl, const unsigned char *iv, EVP_PKEY *priv); +int EVP_OpenFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl); + +int EVP_SealInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, + unsigned char **ek, int *ekl, unsigned char *iv, EVP_PKEY **pubk, + int npubk); +int EVP_SealFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl); + +EVP_ENCODE_CTX *EVP_ENCODE_CTX_new(void); +void EVP_ENCODE_CTX_free(EVP_ENCODE_CTX *ctx); +void EVP_EncodeInit(EVP_ENCODE_CTX *ctx); +int EVP_EncodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl, + const unsigned char *in, int inl); +void EVP_EncodeFinal(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl); +int EVP_EncodeBlock(unsigned char *t, const unsigned char *f, int n); + +void EVP_DecodeInit(EVP_ENCODE_CTX *ctx); +int EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl, + const unsigned char *in, int inl); +int EVP_DecodeFinal(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl); +int EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n); + +int EVP_CIPHER_CTX_init(EVP_CIPHER_CTX *a); +int EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *a); +EVP_CIPHER_CTX *EVP_CIPHER_CTX_new(void); +void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *a); +int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *a); +int EVP_CIPHER_CTX_set_key_length(EVP_CIPHER_CTX *x, int keylen); +int EVP_CIPHER_CTX_set_padding(EVP_CIPHER_CTX *c, int pad); +int EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr); +int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key); + +#ifndef OPENSSL_NO_BIO +const BIO_METHOD *BIO_f_md(void); +const BIO_METHOD *BIO_f_base64(void); +const BIO_METHOD *BIO_f_cipher(void); +int BIO_set_cipher(BIO *b, const EVP_CIPHER *c, const unsigned char *k, + const unsigned char *i, int enc); +#endif + +const EVP_MD *EVP_md_null(void); +#ifndef OPENSSL_NO_MD4 +const EVP_MD *EVP_md4(void); +#endif +#ifndef OPENSSL_NO_MD5 +const EVP_MD *EVP_md5(void); +const EVP_MD *EVP_md5_sha1(void); +#endif +#ifndef OPENSSL_NO_SHA +const EVP_MD *EVP_sha1(void); +#endif +#ifndef OPENSSL_NO_SHA256 +const EVP_MD *EVP_sha224(void); +const EVP_MD *EVP_sha256(void); +#endif +#ifndef OPENSSL_NO_SHA512 +const EVP_MD *EVP_sha384(void); +const EVP_MD *EVP_sha512(void); +const EVP_MD *EVP_sha512_224(void); +const EVP_MD *EVP_sha512_256(void); +#endif +#ifndef OPENSSL_NO_SHA3 +const EVP_MD *EVP_sha3_224(void); +const EVP_MD *EVP_sha3_256(void); +const EVP_MD *EVP_sha3_384(void); +const EVP_MD *EVP_sha3_512(void); +#endif +#ifndef OPENSSL_NO_SM3 +const EVP_MD *EVP_sm3(void); +#endif +#ifndef OPENSSL_NO_RIPEMD +const EVP_MD *EVP_ripemd160(void); +#endif +const EVP_CIPHER *EVP_enc_null(void); /* does nothing :-) */ +#ifndef OPENSSL_NO_DES +const EVP_CIPHER *EVP_des_ecb(void); +const EVP_CIPHER *EVP_des_ede(void); +const EVP_CIPHER *EVP_des_ede3(void); +const EVP_CIPHER *EVP_des_ede_ecb(void); +const EVP_CIPHER *EVP_des_ede3_ecb(void); +const EVP_CIPHER *EVP_des_cfb64(void); +# define EVP_des_cfb EVP_des_cfb64 +const EVP_CIPHER *EVP_des_cfb1(void); +const EVP_CIPHER *EVP_des_cfb8(void); +const EVP_CIPHER *EVP_des_ede_cfb64(void); +# define EVP_des_ede_cfb EVP_des_ede_cfb64 +const EVP_CIPHER *EVP_des_ede3_cfb64(void); +# define EVP_des_ede3_cfb EVP_des_ede3_cfb64 +const EVP_CIPHER *EVP_des_ede3_cfb1(void); +const EVP_CIPHER *EVP_des_ede3_cfb8(void); +const EVP_CIPHER *EVP_des_ofb(void); +const EVP_CIPHER *EVP_des_ede_ofb(void); +const EVP_CIPHER *EVP_des_ede3_ofb(void); +const EVP_CIPHER *EVP_des_cbc(void); +const EVP_CIPHER *EVP_des_ede_cbc(void); +const EVP_CIPHER *EVP_des_ede3_cbc(void); +const EVP_CIPHER *EVP_desx_cbc(void); +#endif +#ifndef OPENSSL_NO_RC4 +const EVP_CIPHER *EVP_rc4(void); +const EVP_CIPHER *EVP_rc4_40(void); +#endif +#ifndef OPENSSL_NO_IDEA +const EVP_CIPHER *EVP_idea_ecb(void); +const EVP_CIPHER *EVP_idea_cfb64(void); +# define EVP_idea_cfb EVP_idea_cfb64 +const EVP_CIPHER *EVP_idea_ofb(void); +const EVP_CIPHER *EVP_idea_cbc(void); +#endif +#ifndef OPENSSL_NO_RC2 +const EVP_CIPHER *EVP_rc2_ecb(void); +const EVP_CIPHER *EVP_rc2_cbc(void); +const EVP_CIPHER *EVP_rc2_40_cbc(void); +const EVP_CIPHER *EVP_rc2_64_cbc(void); +const EVP_CIPHER *EVP_rc2_cfb64(void); +# define EVP_rc2_cfb EVP_rc2_cfb64 +const EVP_CIPHER *EVP_rc2_ofb(void); +#endif +#ifndef OPENSSL_NO_BF +const EVP_CIPHER *EVP_bf_ecb(void); +const EVP_CIPHER *EVP_bf_cbc(void); +const EVP_CIPHER *EVP_bf_cfb64(void); +# define EVP_bf_cfb EVP_bf_cfb64 +const EVP_CIPHER *EVP_bf_ofb(void); +#endif +#ifndef OPENSSL_NO_CAST +const EVP_CIPHER *EVP_cast5_ecb(void); +const EVP_CIPHER *EVP_cast5_cbc(void); +const EVP_CIPHER *EVP_cast5_cfb64(void); +# define EVP_cast5_cfb EVP_cast5_cfb64 +const EVP_CIPHER *EVP_cast5_ofb(void); +#endif +#ifndef OPENSSL_NO_AES +const EVP_CIPHER *EVP_aes_128_ecb(void); +const EVP_CIPHER *EVP_aes_128_cbc(void); +const EVP_CIPHER *EVP_aes_128_cfb1(void); +const EVP_CIPHER *EVP_aes_128_cfb8(void); +const EVP_CIPHER *EVP_aes_128_cfb128(void); +# define EVP_aes_128_cfb EVP_aes_128_cfb128 +const EVP_CIPHER *EVP_aes_128_ofb(void); +const EVP_CIPHER *EVP_aes_128_ctr(void); +const EVP_CIPHER *EVP_aes_128_ccm(void); +const EVP_CIPHER *EVP_aes_128_gcm(void); +const EVP_CIPHER *EVP_aes_128_wrap(void); +const EVP_CIPHER *EVP_aes_128_xts(void); +const EVP_CIPHER *EVP_aes_192_ecb(void); +const EVP_CIPHER *EVP_aes_192_cbc(void); +const EVP_CIPHER *EVP_aes_192_cfb1(void); +const EVP_CIPHER *EVP_aes_192_cfb8(void); +const EVP_CIPHER *EVP_aes_192_cfb128(void); +# define EVP_aes_192_cfb EVP_aes_192_cfb128 +const EVP_CIPHER *EVP_aes_192_ofb(void); +const EVP_CIPHER *EVP_aes_192_ctr(void); +const EVP_CIPHER *EVP_aes_192_ccm(void); +const EVP_CIPHER *EVP_aes_192_gcm(void); +const EVP_CIPHER *EVP_aes_192_wrap(void); +const EVP_CIPHER *EVP_aes_256_ecb(void); +const EVP_CIPHER *EVP_aes_256_cbc(void); +const EVP_CIPHER *EVP_aes_256_cfb1(void); +const EVP_CIPHER *EVP_aes_256_cfb8(void); +const EVP_CIPHER *EVP_aes_256_cfb128(void); +# define EVP_aes_256_cfb EVP_aes_256_cfb128 +const EVP_CIPHER *EVP_aes_256_ofb(void); +const EVP_CIPHER *EVP_aes_256_ctr(void); +const EVP_CIPHER *EVP_aes_256_ccm(void); +const EVP_CIPHER *EVP_aes_256_gcm(void); +const EVP_CIPHER *EVP_aes_256_wrap(void); +const EVP_CIPHER *EVP_aes_256_xts(void); +#if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) +const EVP_CIPHER *EVP_chacha20_poly1305(void); +#endif +#endif +#ifndef OPENSSL_NO_CAMELLIA +const EVP_CIPHER *EVP_camellia_128_ecb(void); +const EVP_CIPHER *EVP_camellia_128_cbc(void); +const EVP_CIPHER *EVP_camellia_128_cfb1(void); +const EVP_CIPHER *EVP_camellia_128_cfb8(void); +const EVP_CIPHER *EVP_camellia_128_cfb128(void); +# define EVP_camellia_128_cfb EVP_camellia_128_cfb128 +const EVP_CIPHER *EVP_camellia_128_ofb(void); +const EVP_CIPHER *EVP_camellia_192_ecb(void); +const EVP_CIPHER *EVP_camellia_192_cbc(void); +const EVP_CIPHER *EVP_camellia_192_cfb1(void); +const EVP_CIPHER *EVP_camellia_192_cfb8(void); +const EVP_CIPHER *EVP_camellia_192_cfb128(void); +# define EVP_camellia_192_cfb EVP_camellia_192_cfb128 +const EVP_CIPHER *EVP_camellia_192_ofb(void); +const EVP_CIPHER *EVP_camellia_256_ecb(void); +const EVP_CIPHER *EVP_camellia_256_cbc(void); +const EVP_CIPHER *EVP_camellia_256_cfb1(void); +const EVP_CIPHER *EVP_camellia_256_cfb8(void); +const EVP_CIPHER *EVP_camellia_256_cfb128(void); +# define EVP_camellia_256_cfb EVP_camellia_256_cfb128 +const EVP_CIPHER *EVP_camellia_256_ofb(void); +#endif + +#ifndef OPENSSL_NO_CHACHA +const EVP_CIPHER *EVP_chacha20(void); +#endif + +#ifndef OPENSSL_NO_SM4 +const EVP_CIPHER *EVP_sm4_ecb(void); +const EVP_CIPHER *EVP_sm4_cbc(void); +const EVP_CIPHER *EVP_sm4_cfb128(void); +#define EVP_sm4_cfb EVP_sm4_cfb128 +const EVP_CIPHER *EVP_sm4_ofb(void); +const EVP_CIPHER *EVP_sm4_ctr(void); +#endif + +void OPENSSL_add_all_algorithms_noconf(void); +void OPENSSL_add_all_algorithms_conf(void); + +#ifdef OPENSSL_LOAD_CONF +#define OpenSSL_add_all_algorithms() OPENSSL_add_all_algorithms_conf() +#else +#define OpenSSL_add_all_algorithms() OPENSSL_add_all_algorithms_noconf() +#endif + +void OpenSSL_add_all_ciphers(void); +void OpenSSL_add_all_digests(void); + +#define SSLeay_add_all_algorithms() OpenSSL_add_all_algorithms() +#define SSLeay_add_all_ciphers() OpenSSL_add_all_ciphers() +#define SSLeay_add_all_digests() OpenSSL_add_all_digests() + +const EVP_CIPHER *EVP_get_cipherbyname(const char *name); +const EVP_MD *EVP_get_digestbyname(const char *name); +void EVP_cleanup(void); + +void EVP_CIPHER_do_all(void (*fn)(const EVP_CIPHER *ciph, const char *from, + const char *to, void *x), void *arg); +void EVP_CIPHER_do_all_sorted(void (*fn)(const EVP_CIPHER *ciph, + const char *from, const char *to, void *x), void *arg); + +void EVP_MD_do_all(void (*fn)(const EVP_MD *ciph, const char *from, + const char *to, void *x), void *arg); +void EVP_MD_do_all_sorted(void (*fn)(const EVP_MD *ciph, const char *from, + const char *to, void *x), void *arg); + +int EVP_PKEY_decrypt_old(unsigned char *dec_key, const unsigned char *enc_key, + int enc_key_len, EVP_PKEY *private_key); +int EVP_PKEY_encrypt_old(unsigned char *enc_key, const unsigned char *key, + int key_len, EVP_PKEY *pub_key); +int EVP_PKEY_type(int type); +int EVP_PKEY_id(const EVP_PKEY *pkey); +int EVP_PKEY_base_id(const EVP_PKEY *pkey); +int EVP_PKEY_bits(const EVP_PKEY *pkey); +int EVP_PKEY_security_bits(const EVP_PKEY *pkey); +int EVP_PKEY_size(const EVP_PKEY *pkey); +int EVP_PKEY_set_type(EVP_PKEY *pkey, int type); +int EVP_PKEY_set_type_str(EVP_PKEY *pkey, const char *str, int len); +int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key); +void *EVP_PKEY_get0(const EVP_PKEY *pkey); +const unsigned char *EVP_PKEY_get0_hmac(const EVP_PKEY *pkey, size_t *len); + +#ifndef OPENSSL_NO_RSA +struct rsa_st; +struct rsa_st *EVP_PKEY_get0_RSA(EVP_PKEY *pkey); +struct rsa_st *EVP_PKEY_get1_RSA(EVP_PKEY *pkey); +int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, struct rsa_st *key); +#endif +#ifndef OPENSSL_NO_DSA +struct dsa_st; +struct dsa_st *EVP_PKEY_get0_DSA(EVP_PKEY *pkey); +struct dsa_st *EVP_PKEY_get1_DSA(EVP_PKEY *pkey); +int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, struct dsa_st *key); +#endif +#ifndef OPENSSL_NO_DH +struct dh_st; +struct dh_st *EVP_PKEY_get0_DH(EVP_PKEY *pkey); +struct dh_st *EVP_PKEY_get1_DH(EVP_PKEY *pkey); +int EVP_PKEY_set1_DH(EVP_PKEY *pkey, struct dh_st *key); +#endif +#ifndef OPENSSL_NO_EC +struct ec_key_st; +struct ec_key_st *EVP_PKEY_get0_EC_KEY(EVP_PKEY *pkey); +struct ec_key_st *EVP_PKEY_get1_EC_KEY(EVP_PKEY *pkey); +int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, struct ec_key_st *key); +#endif + +EVP_PKEY *EVP_PKEY_new(void); +void EVP_PKEY_free(EVP_PKEY *pkey); +int EVP_PKEY_up_ref(EVP_PKEY *pkey); + +EVP_PKEY *d2i_PublicKey(int type, EVP_PKEY **a, const unsigned char **pp, + long length); +int i2d_PublicKey(EVP_PKEY *a, unsigned char **pp); + +EVP_PKEY *d2i_PrivateKey(int type, EVP_PKEY **a, const unsigned char **pp, + long length); +EVP_PKEY *d2i_AutoPrivateKey(EVP_PKEY **a, const unsigned char **pp, + long length); +int i2d_PrivateKey(EVP_PKEY *a, unsigned char **pp); + +int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from); +int EVP_PKEY_missing_parameters(const EVP_PKEY *pkey); +int EVP_PKEY_save_parameters(EVP_PKEY *pkey, int mode); +int EVP_PKEY_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b); + +int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b); + +int EVP_PKEY_print_public(BIO *out, const EVP_PKEY *pkey, int indent, + ASN1_PCTX *pctx); +int EVP_PKEY_print_private(BIO *out, const EVP_PKEY *pkey, int indent, + ASN1_PCTX *pctx); +int EVP_PKEY_print_params(BIO *out, const EVP_PKEY *pkey, int indent, + ASN1_PCTX *pctx); + +int EVP_PKEY_get_default_digest_nid(EVP_PKEY *pkey, int *pnid); + +int EVP_CIPHER_type(const EVP_CIPHER *ctx); + +/* PKCS5 password based encryption */ +int PKCS5_PBKDF2_HMAC_SHA1(const char *pass, int passlen, + const unsigned char *salt, int saltlen, int iter, int keylen, + unsigned char *out); +int PKCS5_PBKDF2_HMAC(const char *pass, int passlen, const unsigned char *salt, + int saltlen, int iter, const EVP_MD *digest, int keylen, + unsigned char *out); + +#define ASN1_PKEY_ALIAS 0x1 +#define ASN1_PKEY_DYNAMIC 0x2 +#define ASN1_PKEY_SIGPARAM_NULL 0x4 + +#define ASN1_PKEY_CTRL_PKCS7_SIGN 0x1 +#define ASN1_PKEY_CTRL_PKCS7_ENCRYPT 0x2 +#define ASN1_PKEY_CTRL_DEFAULT_MD_NID 0x3 +#define ASN1_PKEY_CTRL_CMS_SIGN 0x5 +#define ASN1_PKEY_CTRL_CMS_ENVELOPE 0x7 +#define ASN1_PKEY_CTRL_CMS_RI_TYPE 0x8 + +int EVP_PKEY_asn1_get_count(void); +const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_get0(int idx); +const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find(ENGINE **pe, int type); +const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find_str(ENGINE **pe, + const char *str, int len); +int EVP_PKEY_asn1_get0_info(int *ppkey_id, int *pkey_base_id, int *ppkey_flags, + const char **pinfo, const char **ppem_str, + const EVP_PKEY_ASN1_METHOD *ameth); + +const EVP_PKEY_ASN1_METHOD *EVP_PKEY_get0_asn1(const EVP_PKEY *pkey); + +#define EVP_PKEY_OP_UNDEFINED 0 +#define EVP_PKEY_OP_PARAMGEN (1<<1) +#define EVP_PKEY_OP_KEYGEN (1<<2) +#define EVP_PKEY_OP_SIGN (1<<3) +#define EVP_PKEY_OP_VERIFY (1<<4) +#define EVP_PKEY_OP_VERIFYRECOVER (1<<5) +#define EVP_PKEY_OP_SIGNCTX (1<<6) +#define EVP_PKEY_OP_VERIFYCTX (1<<7) +#define EVP_PKEY_OP_ENCRYPT (1<<8) +#define EVP_PKEY_OP_DECRYPT (1<<9) +#define EVP_PKEY_OP_DERIVE (1<<10) + +#define EVP_PKEY_OP_TYPE_SIG \ + (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY | EVP_PKEY_OP_VERIFYRECOVER \ + | EVP_PKEY_OP_SIGNCTX | EVP_PKEY_OP_VERIFYCTX) + +#define EVP_PKEY_OP_TYPE_CRYPT \ + (EVP_PKEY_OP_ENCRYPT | EVP_PKEY_OP_DECRYPT) + +#define EVP_PKEY_OP_TYPE_NOGEN \ + (EVP_PKEY_OP_SIG | EVP_PKEY_OP_CRYPT | EVP_PKEY_OP_DERIVE) + +#define EVP_PKEY_OP_TYPE_GEN \ + (EVP_PKEY_OP_PARAMGEN | EVP_PKEY_OP_KEYGEN) + +#define EVP_PKEY_CTX_set_signature_md(ctx, md) \ + EVP_PKEY_CTX_ctrl(ctx, -1, EVP_PKEY_OP_TYPE_SIG, \ + EVP_PKEY_CTRL_MD, 0, (void *)md) + +#define EVP_PKEY_CTX_get_signature_md(ctx, pmd) \ + EVP_PKEY_CTX_ctrl(ctx, -1, EVP_PKEY_OP_TYPE_SIG, \ + EVP_PKEY_CTRL_GET_MD, 0, (void *)(pmd)) + +#define EVP_PKEY_CTRL_MD 1 +#define EVP_PKEY_CTRL_PEER_KEY 2 + +#define EVP_PKEY_CTRL_PKCS7_ENCRYPT 3 +#define EVP_PKEY_CTRL_PKCS7_DECRYPT 4 + +#define EVP_PKEY_CTRL_PKCS7_SIGN 5 + +#define EVP_PKEY_CTRL_SET_MAC_KEY 6 + +#define EVP_PKEY_CTRL_DIGESTINIT 7 + +/* Used by GOST key encryption in TLS */ +#define EVP_PKEY_CTRL_SET_IV 8 + +#define EVP_PKEY_CTRL_CMS_ENCRYPT 9 +#define EVP_PKEY_CTRL_CMS_DECRYPT 10 +#define EVP_PKEY_CTRL_CMS_SIGN 11 + +#define EVP_PKEY_CTRL_CIPHER 12 + +#define EVP_PKEY_CTRL_GET_MD 13 + +#define EVP_PKEY_ALG_CTRL 0x1000 + + +#define EVP_PKEY_FLAG_AUTOARGLEN 2 +/* Method handles all operations: don't assume any digest related + * defaults. + */ +#define EVP_PKEY_FLAG_SIGCTX_CUSTOM 4 + +EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e); +EVP_PKEY_CTX *EVP_PKEY_CTX_new_id(int id, ENGINE *e); +EVP_PKEY_CTX *EVP_PKEY_CTX_dup(EVP_PKEY_CTX *ctx); +void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx); + +int EVP_PKEY_CTX_ctrl(EVP_PKEY_CTX *ctx, int keytype, int optype, int cmd, + int p1, void *p2); +int EVP_PKEY_CTX_ctrl_str(EVP_PKEY_CTX *ctx, const char *type, + const char *value); + +int EVP_PKEY_CTX_get_operation(EVP_PKEY_CTX *ctx); +void EVP_PKEY_CTX_set0_keygen_info(EVP_PKEY_CTX *ctx, int *dat, int datlen); + +EVP_PKEY *EVP_PKEY_new_mac_key(int type, ENGINE *e, const unsigned char *key, + int keylen); +EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv, + size_t len, const EVP_CIPHER *cipher); + +void EVP_PKEY_CTX_set_data(EVP_PKEY_CTX *ctx, void *data); +void *EVP_PKEY_CTX_get_data(EVP_PKEY_CTX *ctx); +EVP_PKEY *EVP_PKEY_CTX_get0_pkey(EVP_PKEY_CTX *ctx); + +EVP_PKEY *EVP_PKEY_CTX_get0_peerkey(EVP_PKEY_CTX *ctx); + +void EVP_PKEY_CTX_set_app_data(EVP_PKEY_CTX *ctx, void *data); +void *EVP_PKEY_CTX_get_app_data(EVP_PKEY_CTX *ctx); + +int EVP_PKEY_sign_init(EVP_PKEY_CTX *ctx); +int EVP_PKEY_sign(EVP_PKEY_CTX *ctx, unsigned char *sig, size_t *siglen, + const unsigned char *tbs, size_t tbslen); +int EVP_PKEY_verify_init(EVP_PKEY_CTX *ctx); +int EVP_PKEY_verify(EVP_PKEY_CTX *ctx, const unsigned char *sig, size_t siglen, + const unsigned char *tbs, size_t tbslen); +int EVP_PKEY_verify_recover_init(EVP_PKEY_CTX *ctx); +int EVP_PKEY_verify_recover(EVP_PKEY_CTX *ctx, unsigned char *rout, + size_t *routlen, const unsigned char *sig, size_t siglen); +int EVP_PKEY_encrypt_init(EVP_PKEY_CTX *ctx); +int EVP_PKEY_encrypt(EVP_PKEY_CTX *ctx, unsigned char *out, size_t *outlen, + const unsigned char *in, size_t inlen); +int EVP_PKEY_decrypt_init(EVP_PKEY_CTX *ctx); +int EVP_PKEY_decrypt(EVP_PKEY_CTX *ctx, unsigned char *out, size_t *outlen, + const unsigned char *in, size_t inlen); + +int EVP_PKEY_derive_init(EVP_PKEY_CTX *ctx); +int EVP_PKEY_derive_set_peer(EVP_PKEY_CTX *ctx, EVP_PKEY *peer); +int EVP_PKEY_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen); + +typedef int EVP_PKEY_gen_cb(EVP_PKEY_CTX *ctx); + +int EVP_PKEY_paramgen_init(EVP_PKEY_CTX *ctx); +int EVP_PKEY_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey); +int EVP_PKEY_keygen_init(EVP_PKEY_CTX *ctx); +int EVP_PKEY_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey); + +void EVP_PKEY_CTX_set_cb(EVP_PKEY_CTX *ctx, EVP_PKEY_gen_cb *cb); +EVP_PKEY_gen_cb *EVP_PKEY_CTX_get_cb(EVP_PKEY_CTX *ctx); + +int EVP_PKEY_CTX_get_keygen_info(EVP_PKEY_CTX *ctx, int idx); + +/* Authenticated Encryption with Additional Data. + * + * AEAD couples confidentiality and integrity in a single primtive. AEAD + * algorithms take a key and then can seal and open individual messages. Each + * message has a unique, per-message nonce and, optionally, additional data + * which is authenticated but not included in the output. */ + +typedef struct evp_aead_st EVP_AEAD; + +#ifndef OPENSSL_NO_AES +/* EVP_aes_128_gcm is AES-128 in Galois Counter Mode. */ +const EVP_AEAD *EVP_aead_aes_128_gcm(void); +/* EVP_aes_256_gcm is AES-256 in Galois Counter Mode. */ +const EVP_AEAD *EVP_aead_aes_256_gcm(void); +#endif + +#if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) +/* EVP_aead_chacha20_poly1305 is ChaCha20 with a Poly1305 authenticator. */ +const EVP_AEAD *EVP_aead_chacha20_poly1305(void); +/* EVP_aead_xchacha20_poly1305 is XChaCha20 with a Poly1305 authenticator. */ +const EVP_AEAD *EVP_aead_xchacha20_poly1305(void); +#endif + +/* EVP_AEAD_key_length returns the length of the keys used. */ +size_t EVP_AEAD_key_length(const EVP_AEAD *aead); + +/* EVP_AEAD_nonce_length returns the length of the per-message nonce. */ +size_t EVP_AEAD_nonce_length(const EVP_AEAD *aead); + +/* EVP_AEAD_max_overhead returns the maximum number of additional bytes added + * by the act of sealing data with the AEAD. */ +size_t EVP_AEAD_max_overhead(const EVP_AEAD *aead); + +/* EVP_AEAD_max_tag_len returns the maximum tag length when using this AEAD. + * This * is the largest value that can be passed as a tag length to + * EVP_AEAD_CTX_init. */ +size_t EVP_AEAD_max_tag_len(const EVP_AEAD *aead); + +/* An EVP_AEAD_CTX represents an AEAD algorithm configured with a specific key + * and message-independent IV. */ +typedef struct evp_aead_ctx_st EVP_AEAD_CTX; + +/* EVP_AEAD_MAX_TAG_LENGTH is the maximum tag length used by any AEAD + * defined in this header. */ +#define EVP_AEAD_MAX_TAG_LENGTH 16 + +/* EVP_AEAD_DEFAULT_TAG_LENGTH is a magic value that can be passed to + * EVP_AEAD_CTX_init to indicate that the default tag length for an AEAD + * should be used. */ +#define EVP_AEAD_DEFAULT_TAG_LENGTH 0 + +/* EVP_AEAD_CTX_new allocates a new context for use with EVP_AEAD_CTX_init. + * It can be cleaned up for reuse with EVP_AEAD_CTX_cleanup and must be freed + * with EVP_AEAD_CTX_free. */ +EVP_AEAD_CTX *EVP_AEAD_CTX_new(void); + +/* EVP_AEAD_CTX_free releases all memory owned by the context. */ +void EVP_AEAD_CTX_free(EVP_AEAD_CTX *ctx); + +/* EVP_AEAD_CTX_init initializes the context for the given AEAD algorithm. + * The implementation argument may be NULL to choose the default implementation. + * Authentication tags may be truncated by passing a tag length. A tag length + * of zero indicates the default tag length should be used. */ +int EVP_AEAD_CTX_init(EVP_AEAD_CTX *ctx, const EVP_AEAD *aead, + const unsigned char *key, size_t key_len, size_t tag_len, ENGINE *impl); + +/* EVP_AEAD_CTX_cleanup frees any data allocated for this context. */ +void EVP_AEAD_CTX_cleanup(EVP_AEAD_CTX *ctx); + +/* EVP_AEAD_CTX_seal encrypts and authenticates the input and authenticates + * any additional data (AD), the result being written as output. One is + * returned on success, otherwise zero. + * + * This function may be called (with the same EVP_AEAD_CTX) concurrently with + * itself or EVP_AEAD_CTX_open. + * + * At most max_out_len bytes are written as output and, in order to ensure + * success, this value should be the length of the input plus the result of + * EVP_AEAD_overhead. On successful return, out_len is set to the actual + * number of bytes written. + * + * The length of the nonce is must be equal to the result of + * EVP_AEAD_nonce_length for this AEAD. + * + * EVP_AEAD_CTX_seal never results in a partial output. If max_out_len is + * insufficient, zero will be returned and out_len will be set to zero. + * + * If the input and output are aliased then out must be <= in. */ +int EVP_AEAD_CTX_seal(const EVP_AEAD_CTX *ctx, unsigned char *out, + size_t *out_len, size_t max_out_len, const unsigned char *nonce, + size_t nonce_len, const unsigned char *in, size_t in_len, + const unsigned char *ad, size_t ad_len); + +/* EVP_AEAD_CTX_open authenticates the input and additional data, decrypting + * the input and writing it as output. One is returned on success, otherwise + * zero. + * + * This function may be called (with the same EVP_AEAD_CTX) concurrently with + * itself or EVP_AEAD_CTX_seal. + * + * At most the number of input bytes are written as output. In order to ensure + * success, max_out_len should be at least the same as the input length. On + * successful return out_len is set to the actual number of bytes written. + * + * The length of nonce must be equal to the result of EVP_AEAD_nonce_length + * for this AEAD. + * + * EVP_AEAD_CTX_open never results in a partial output. If max_out_len is + * insufficient, zero will be returned and out_len will be set to zero. + * + * If the input and output are aliased then out must be <= in. */ +int EVP_AEAD_CTX_open(const EVP_AEAD_CTX *ctx, unsigned char *out, + size_t *out_len, size_t max_out_len, const unsigned char *nonce, + size_t nonce_len, const unsigned char *in, size_t in_len, + const unsigned char *ad, size_t ad_len); + +void ERR_load_EVP_strings(void); + +/* Error codes for the EVP functions. */ + +/* Function codes. */ +#define EVP_F_AEAD_AES_GCM_INIT 187 +#define EVP_F_AEAD_AES_GCM_OPEN 188 +#define EVP_F_AEAD_AES_GCM_SEAL 189 +#define EVP_F_AEAD_CHACHA20_POLY1305_INIT 192 +#define EVP_F_AEAD_CHACHA20_POLY1305_OPEN 193 +#define EVP_F_AEAD_CHACHA20_POLY1305_SEAL 194 +#define EVP_F_AEAD_CTX_OPEN 185 +#define EVP_F_AEAD_CTX_SEAL 186 +#define EVP_F_AESNI_INIT_KEY 165 +#define EVP_F_AESNI_XTS_CIPHER 176 +#define EVP_F_AES_INIT_KEY 133 +#define EVP_F_AES_XTS 172 +#define EVP_F_AES_XTS_CIPHER 175 +#define EVP_F_ALG_MODULE_INIT 177 +#define EVP_F_CAMELLIA_INIT_KEY 159 +#define EVP_F_CMAC_INIT 173 +#define EVP_F_D2I_PKEY 100 +#define EVP_F_DO_SIGVER_INIT 161 +#define EVP_F_DSAPKEY2PKCS8 134 +#define EVP_F_DSA_PKEY2PKCS8 135 +#define EVP_F_ECDSA_PKEY2PKCS8 129 +#define EVP_F_ECKEY_PKEY2PKCS8 132 +#define EVP_F_EVP_AEAD_CTX_INIT 180 +#define EVP_F_EVP_AEAD_CTX_OPEN 190 +#define EVP_F_EVP_AEAD_CTX_SEAL 191 +#define EVP_F_EVP_BYTESTOKEY 200 +#define EVP_F_EVP_CIPHERINIT_EX 123 +#define EVP_F_EVP_CIPHER_CTX_COPY 163 +#define EVP_F_EVP_CIPHER_CTX_CTRL 124 +#define EVP_F_EVP_CIPHER_CTX_SET_KEY_LENGTH 122 +#define EVP_F_EVP_CIPHER_GET_ASN1_IV 201 +#define EVP_F_EVP_CIPHER_SET_ASN1_IV 202 +#define EVP_F_EVP_DECRYPTFINAL_EX 101 +#define EVP_F_EVP_DECRYPTUPDATE 199 +#define EVP_F_EVP_DIGESTFINAL_EX 196 +#define EVP_F_EVP_DIGESTINIT_EX 128 +#define EVP_F_EVP_ENCRYPTFINAL_EX 127 +#define EVP_F_EVP_ENCRYPTUPDATE 198 +#define EVP_F_EVP_MD_CTX_COPY_EX 110 +#define EVP_F_EVP_MD_CTX_CTRL 195 +#define EVP_F_EVP_MD_SIZE 162 +#define EVP_F_EVP_OPENINIT 102 +#define EVP_F_EVP_PBE_ALG_ADD 115 +#define EVP_F_EVP_PBE_ALG_ADD_TYPE 160 +#define EVP_F_EVP_PBE_CIPHERINIT 116 +#define EVP_F_EVP_PKCS82PKEY 111 +#define EVP_F_EVP_PKCS82PKEY_BROKEN 136 +#define EVP_F_EVP_PKEY2PKCS8_BROKEN 113 +#define EVP_F_EVP_PKEY_COPY_PARAMETERS 103 +#define EVP_F_EVP_PKEY_CTX_CTRL 137 +#define EVP_F_EVP_PKEY_CTX_CTRL_STR 150 +#define EVP_F_EVP_PKEY_CTX_DUP 156 +#define EVP_F_EVP_PKEY_DECRYPT 104 +#define EVP_F_EVP_PKEY_DECRYPT_INIT 138 +#define EVP_F_EVP_PKEY_DECRYPT_OLD 151 +#define EVP_F_EVP_PKEY_DERIVE 153 +#define EVP_F_EVP_PKEY_DERIVE_INIT 154 +#define EVP_F_EVP_PKEY_DERIVE_SET_PEER 155 +#define EVP_F_EVP_PKEY_ENCRYPT 105 +#define EVP_F_EVP_PKEY_ENCRYPT_INIT 139 +#define EVP_F_EVP_PKEY_ENCRYPT_OLD 152 +#define EVP_F_EVP_PKEY_GET1_DH 119 +#define EVP_F_EVP_PKEY_GET1_DSA 120 +#define EVP_F_EVP_PKEY_GET1_ECDSA 130 +#define EVP_F_EVP_PKEY_GET1_EC_KEY 131 +#define EVP_F_EVP_PKEY_GET1_RSA 121 +#define EVP_F_EVP_PKEY_KEYGEN 146 +#define EVP_F_EVP_PKEY_KEYGEN_INIT 147 +#define EVP_F_EVP_PKEY_NEW 106 +#define EVP_F_EVP_PKEY_PARAMGEN 148 +#define EVP_F_EVP_PKEY_PARAMGEN_INIT 149 +#define EVP_F_EVP_PKEY_SIGN 140 +#define EVP_F_EVP_PKEY_SIGN_INIT 141 +#define EVP_F_EVP_PKEY_VERIFY 142 +#define EVP_F_EVP_PKEY_VERIFY_INIT 143 +#define EVP_F_EVP_PKEY_VERIFY_RECOVER 144 +#define EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT 145 +#define EVP_F_EVP_RIJNDAEL 126 +#define EVP_F_EVP_SIGNFINAL 107 +#define EVP_F_EVP_VERIFYFINAL 108 +#define EVP_F_FIPS_CIPHERINIT 166 +#define EVP_F_FIPS_CIPHER_CTX_COPY 170 +#define EVP_F_FIPS_CIPHER_CTX_CTRL 167 +#define EVP_F_FIPS_CIPHER_CTX_SET_KEY_LENGTH 171 +#define EVP_F_FIPS_DIGESTINIT 168 +#define EVP_F_FIPS_MD_CTX_COPY 169 +#define EVP_F_HMAC_INIT_EX 174 +#define EVP_F_INT_CTX_NEW 157 +#define EVP_F_PKCS5_PBE_KEYIVGEN 117 +#define EVP_F_PKCS5_V2_PBE_KEYIVGEN 118 +#define EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN 164 +#define EVP_F_PKCS8_SET_BROKEN 112 +#define EVP_F_PKEY_SET_TYPE 158 +#define EVP_F_RC2_GET_ASN1_TYPE_AND_IV 197 +#define EVP_F_RC2_MAGIC_TO_METH 109 +#define EVP_F_RC5_CTRL 125 + +/* Reason codes. */ +#define EVP_R_AES_IV_SETUP_FAILED 162 +#define EVP_R_AES_KEY_SETUP_FAILED 143 +#define EVP_R_ASN1_LIB 140 +#define EVP_R_BAD_BLOCK_LENGTH 136 +#define EVP_R_BAD_DECRYPT 100 +#define EVP_R_BAD_KEY_LENGTH 137 +#define EVP_R_BN_DECODE_ERROR 112 +#define EVP_R_BN_PUBKEY_ERROR 113 +#define EVP_R_BUFFER_TOO_SMALL 155 +#define EVP_R_CAMELLIA_KEY_SETUP_FAILED 157 +#define EVP_R_CIPHER_PARAMETER_ERROR 122 +#define EVP_R_COMMAND_NOT_SUPPORTED 147 +#define EVP_R_CTRL_NOT_IMPLEMENTED 132 +#define EVP_R_CTRL_OPERATION_NOT_IMPLEMENTED 133 +#define EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH 138 +#define EVP_R_DECODE_ERROR 114 +#define EVP_R_DIFFERENT_KEY_TYPES 101 +#define EVP_R_DIFFERENT_PARAMETERS 153 +#define EVP_R_DISABLED_FOR_FIPS 163 +#define EVP_R_ENCODE_ERROR 115 +#define EVP_R_ERROR_LOADING_SECTION 165 +#define EVP_R_ERROR_SETTING_FIPS_MODE 166 +#define EVP_R_EVP_PBE_CIPHERINIT_ERROR 119 +#define EVP_R_EXPECTING_AN_HMAC_KEY 174 +#define EVP_R_EXPECTING_AN_RSA_KEY 127 +#define EVP_R_EXPECTING_A_DH_KEY 128 +#define EVP_R_EXPECTING_A_DSA_KEY 129 +#define EVP_R_EXPECTING_A_ECDSA_KEY 141 +#define EVP_R_EXPECTING_A_EC_KEY 142 +#define EVP_R_FIPS_MODE_NOT_SUPPORTED 167 +#define EVP_R_GET_RAW_KEY_FAILED 182 +#define EVP_R_INITIALIZATION_ERROR 134 +#define EVP_R_INPUT_NOT_INITIALIZED 111 +#define EVP_R_INVALID_DIGEST 152 +#define EVP_R_INVALID_FIPS_MODE 168 +#define EVP_R_INVALID_IV_LENGTH 194 +#define EVP_R_INVALID_KEY_LENGTH 130 +#define EVP_R_INVALID_OPERATION 148 +#define EVP_R_IV_TOO_LARGE 102 +#define EVP_R_KEYGEN_FAILURE 120 +#define EVP_R_KEY_SETUP_FAILED 180 +#define EVP_R_MESSAGE_DIGEST_IS_NULL 159 +#define EVP_R_METHOD_NOT_SUPPORTED 144 +#define EVP_R_MISSING_PARAMETERS 103 +#define EVP_R_NO_CIPHER_SET 131 +#define EVP_R_NO_DEFAULT_DIGEST 158 +#define EVP_R_NO_DIGEST_SET 139 +#define EVP_R_NO_DSA_PARAMETERS 116 +#define EVP_R_NO_KEY_SET 154 +#define EVP_R_NO_OPERATION_SET 149 +#define EVP_R_NO_SIGN_FUNCTION_CONFIGURED 104 +#define EVP_R_NO_VERIFY_FUNCTION_CONFIGURED 105 +#define EVP_R_ONLY_ONESHOT_SUPPORTED 177 +#define EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE 150 +#define EVP_R_OPERATON_NOT_INITIALIZED 151 +#define EVP_R_OUTPUT_ALIASES_INPUT 172 +#define EVP_R_PKCS8_UNKNOWN_BROKEN_TYPE 117 +#define EVP_R_PRIVATE_KEY_DECODE_ERROR 145 +#define EVP_R_PRIVATE_KEY_ENCODE_ERROR 146 +#define EVP_R_PUBLIC_KEY_NOT_RSA 106 +#define EVP_R_TAG_TOO_LARGE 171 +#define EVP_R_TOO_LARGE 164 +#define EVP_R_UNKNOWN_CIPHER 160 +#define EVP_R_UNKNOWN_DIGEST 161 +#define EVP_R_UNKNOWN_OPTION 169 +#define EVP_R_UNKNOWN_PBE_ALGORITHM 121 +#define EVP_R_UNSUPORTED_NUMBER_OF_ROUNDS 135 +#define EVP_R_UNSUPPORTED_ALGORITHM 156 +#define EVP_R_UNSUPPORTED_CIPHER 107 +#define EVP_R_UNSUPPORTED_KEYLENGTH 123 +#define EVP_R_UNSUPPORTED_KEY_DERIVATION_FUNCTION 124 +#define EVP_R_UNSUPPORTED_KEY_SIZE 108 +#define EVP_R_UNSUPPORTED_PRF 125 +#define EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM 118 +#define EVP_R_WRAP_MODE_NOT_ALLOWED 170 +#define EVP_R_UNSUPPORTED_SALT_TYPE 126 +#define EVP_R_WRONG_FINAL_BLOCK_LENGTH 109 +#define EVP_R_WRONG_PUBLIC_KEY_TYPE 110 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/hkdf.h b/curl/include/openssl/hkdf.h new file mode 100644 index 0000000..6cec526 --- /dev/null +++ b/curl/include/openssl/hkdf.h @@ -0,0 +1,65 @@ +/* $OpenBSD: hkdf.h,v 1.3 2023/08/11 04:52:08 tb Exp $ */ +/* Copyright (c) 2014, Google Inc. + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY + * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION + * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN + * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ + +#ifndef OPENSSL_HEADER_HKDF_H +#define OPENSSL_HEADER_HKDF_H + +#include + +#if defined(__cplusplus) +extern "C" { +#endif + +/* + * HKDF computes HKDF (as specified by RFC 5869) of initial keying + * material |secret| with |salt| and |info| using |digest|, and + * outputs |out_len| bytes to |out_key|. It returns one on success and + * zero on error. + * + * HKDF is an Extract-and-Expand algorithm. It does not do any key + * stretching, and as such, is not suited to be used alone to generate + * a key from a password. + */ + +int HKDF(uint8_t *out_key, size_t out_len, const EVP_MD *digest, + const uint8_t *secret, size_t secret_len, const uint8_t *salt, + size_t salt_len, const uint8_t *info, size_t info_len); + +/* + * HKDF_extract computes a HKDF PRK (as specified by RFC 5869) from + * initial keying material |secret| and salt |salt| using |digest|, + * and outputs |out_len| bytes to |out_key|. The maximum output size + * is |EVP_MAX_MD_SIZE|. It returns one on success and zero on error. + */ +int HKDF_extract(uint8_t *out_key, size_t *out_len, const EVP_MD *digest, + const uint8_t *secret, size_t secret_len, + const uint8_t *salt, size_t salt_len); + +/* + * HKDF_expand computes a HKDF OKM (as specified by RFC 5869) of + * length |out_len| from the PRK |prk| and info |info| using |digest|, + * and outputs the result to |out_key|. It returns one on success and + * zero on error. + */ +int HKDF_expand(uint8_t *out_key, size_t out_len, + const EVP_MD *digest, const uint8_t *prk, size_t prk_len, + const uint8_t *info, size_t info_len); + + +#if defined(__cplusplus) +} /* extern C */ +#endif + +#endif /* OPENSSL_HEADER_HKDF_H */ diff --git a/curl/include/openssl/hmac.h b/curl/include/openssl/hmac.h new file mode 100644 index 0000000..2216fd9 --- /dev/null +++ b/curl/include/openssl/hmac.h @@ -0,0 +1,101 @@ +/* $OpenBSD: hmac.h,v 1.21 2025/01/25 17:59:44 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ +#ifndef HEADER_HMAC_H +#define HEADER_HMAC_H + +#include + +#if !defined(HAVE_ATTRIBUTE__BOUNDED__) && !defined(__OpenBSD__) +#define __bounded__(x, y, z) +#endif + +#include + +#define HMAC_MAX_MD_CBLOCK 144 /* largest known is SHA3-224 */ + +#ifdef __cplusplus +extern "C" { +#endif + +#define HMAC_size(e) (EVP_MD_size(HMAC_CTX_get_md((e)))) + +HMAC_CTX *HMAC_CTX_new(void); +void HMAC_CTX_free(HMAC_CTX *ctx); +int HMAC_CTX_reset(HMAC_CTX *ctx); + +int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len, const EVP_MD *md, + ENGINE *impl) + __attribute__ ((__bounded__(__buffer__, 2, 3))); +int HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, size_t len) + __attribute__ ((__bounded__(__buffer__, 2, 3))); +int HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len); +unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len, + const unsigned char *d, size_t n, unsigned char *md, unsigned int *md_len) + __attribute__ ((__bounded__(__buffer__, 2, 3))) + __attribute__ ((__bounded__(__buffer__, 4, 5))) + __attribute__((__nonnull__ (6))); +int HMAC_CTX_copy(HMAC_CTX *dctx, HMAC_CTX *sctx); + +void HMAC_CTX_set_flags(HMAC_CTX *ctx, unsigned long flags); +const EVP_MD *HMAC_CTX_get_md(const HMAC_CTX *ctx); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/idea.h b/curl/include/openssl/idea.h new file mode 100644 index 0000000..2bdd364 --- /dev/null +++ b/curl/include/openssl/idea.h @@ -0,0 +1,94 @@ +/* $OpenBSD: idea.h,v 1.13 2025/01/25 17:59:44 tb Exp $ */ +/* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_IDEA_H +#define HEADER_IDEA_H + +#include /* IDEA_INT, OPENSSL_NO_IDEA */ + +#define IDEA_ENCRYPT 1 +#define IDEA_DECRYPT 0 + +#define IDEA_BLOCK 8 +#define IDEA_KEY_LENGTH 16 + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct idea_key_st { + IDEA_INT data[9][6]; +} IDEA_KEY_SCHEDULE; + +void idea_ecb_encrypt(const unsigned char *in, unsigned char *out, + IDEA_KEY_SCHEDULE *ks); +void idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks); +void idea_set_decrypt_key(IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk); +void idea_cbc_encrypt(const unsigned char *in, unsigned char *out, + long length, IDEA_KEY_SCHEDULE *ks, unsigned char *iv, int enc); +void idea_cfb64_encrypt(const unsigned char *in, unsigned char *out, + long length, IDEA_KEY_SCHEDULE *ks, unsigned char *iv, + int *num, int enc); +void idea_ofb64_encrypt(const unsigned char *in, unsigned char *out, + long length, IDEA_KEY_SCHEDULE *ks, unsigned char *iv, int *num); +void idea_encrypt(unsigned long *in, IDEA_KEY_SCHEDULE *ks); +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/kdf.h b/curl/include/openssl/kdf.h new file mode 100644 index 0000000..578949c --- /dev/null +++ b/curl/include/openssl/kdf.h @@ -0,0 +1,137 @@ +/* $OpenBSD: kdf.h,v 1.9 2024/07/09 16:20:17 tb Exp $ */ +/* + * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL + * project. + */ +/* ==================================================================== + * Copyright (c) 2016-2018 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + */ + +#ifndef HEADER_KDF_H +# define HEADER_KDF_H + +#ifdef __cplusplus +extern "C" { +#endif + +# define EVP_PKEY_CTRL_TLS_MD (EVP_PKEY_ALG_CTRL + 0) +# define EVP_PKEY_CTRL_TLS_SECRET (EVP_PKEY_ALG_CTRL + 1) +# define EVP_PKEY_CTRL_TLS_SEED (EVP_PKEY_ALG_CTRL + 2) + +# define EVP_PKEY_CTRL_HKDF_MD (EVP_PKEY_ALG_CTRL + 3) +# define EVP_PKEY_CTRL_HKDF_SALT (EVP_PKEY_ALG_CTRL + 4) +# define EVP_PKEY_CTRL_HKDF_KEY (EVP_PKEY_ALG_CTRL + 5) +# define EVP_PKEY_CTRL_HKDF_INFO (EVP_PKEY_ALG_CTRL + 6) +# define EVP_PKEY_CTRL_HKDF_MODE (EVP_PKEY_ALG_CTRL + 7) + +# define EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND 0 +# define EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY 1 +# define EVP_PKEY_HKDEF_MODE_EXPAND_ONLY 2 + + +# define EVP_PKEY_CTX_set_tls1_prf_md(pctx, md) \ + EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_TLS_MD, 0, (void *)(md)) + +# define EVP_PKEY_CTX_set1_tls1_prf_secret(pctx, sec, seclen) \ + EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_TLS_SECRET, seclen, (void *)(sec)) + +# define EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed, seedlen) \ + EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_TLS_SEED, seedlen, (void *)(seed)) + + +# define EVP_PKEY_CTX_set_hkdf_md(pctx, md) \ + EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_HKDF_MD, 0, (void *)(md)) + +# define EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, saltlen) \ + EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_HKDF_SALT, saltlen, (void *)(salt)) + +# define EVP_PKEY_CTX_set1_hkdf_key(pctx, key, keylen) \ + EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_HKDF_KEY, keylen, (void *)(key)) + +# define EVP_PKEY_CTX_add1_hkdf_info(pctx, info, infolen) \ + EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_HKDF_INFO, infolen, (void *)(info)) + +# define EVP_PKEY_CTX_hkdf_mode(pctx, mode) \ + EVP_PKEY_CTX_ctrl(pctx, -1, EVP_PKEY_OP_DERIVE, \ + EVP_PKEY_CTRL_HKDF_MODE, mode, NULL) + +int ERR_load_KDF_strings(void); + +/* + * KDF function codes. + */ +# define KDF_F_PKEY_HKDF_CTRL_STR 103 +# define KDF_F_PKEY_HKDF_DERIVE 102 +# define KDF_F_PKEY_HKDF_INIT 108 +# define KDF_F_PKEY_TLS1_PRF_CTRL_STR 100 +# define KDF_F_PKEY_TLS1_PRF_DERIVE 101 +# define KDF_F_PKEY_TLS1_PRF_INIT 110 +# define KDF_F_TLS1_PRF_ALG 111 + +/* + * KDF reason codes. + */ +# define KDF_R_INVALID_DIGEST 100 +# define KDF_R_MISSING_KEY 104 +# define KDF_R_MISSING_MESSAGE_DIGEST 105 +# define KDF_R_MISSING_SECRET 107 +# define KDF_R_MISSING_SEED 106 +# define KDF_R_UNKNOWN_PARAMETER_TYPE 103 +# define KDF_R_VALUE_MISSING 102 + +# ifdef __cplusplus +} +# endif +#endif diff --git a/curl/include/openssl/lhash.h b/curl/include/openssl/lhash.h new file mode 100644 index 0000000..86d0554 --- /dev/null +++ b/curl/include/openssl/lhash.h @@ -0,0 +1,179 @@ +/* $OpenBSD: lhash.h,v 1.14 2024/03/02 11:11:11 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +/* Header for dynamic hash table routines + * Author - Eric Young + */ + +#ifndef HEADER_LHASH_H +#define HEADER_LHASH_H + +#include + +#include + +#ifndef OPENSSL_NO_BIO +#include +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +typedef int (*LHASH_COMP_FN_TYPE)(const void *, const void *); +typedef unsigned long (*LHASH_HASH_FN_TYPE)(const void *); +typedef void (*LHASH_DOALL_FN_TYPE)(void *); +typedef void (*LHASH_DOALL_ARG_FN_TYPE)(void *, void *); + +/* Macros for declaring and implementing type-safe wrappers for LHASH callbacks. + * This way, callbacks can be provided to LHASH structures without function + * pointer casting and the macro-defined callbacks provide per-variable casting + * before deferring to the underlying type-specific callbacks. NB: It is + * possible to place a "static" in front of both the DECLARE and IMPLEMENT + * macros if the functions are strictly internal. */ + +/* First: "hash" functions */ +#define DECLARE_LHASH_HASH_FN(name, o_type) \ + unsigned long name##_LHASH_HASH(const void *); +#define IMPLEMENT_LHASH_HASH_FN(name, o_type) \ + unsigned long name##_LHASH_HASH(const void *arg) { \ + const o_type *a = arg; \ + return name##_hash(a); } +#define LHASH_HASH_FN(name) name##_LHASH_HASH + +/* Second: "compare" functions */ +#define DECLARE_LHASH_COMP_FN(name, o_type) \ + int name##_LHASH_COMP(const void *, const void *); +#define IMPLEMENT_LHASH_COMP_FN(name, o_type) \ + int name##_LHASH_COMP(const void *arg1, const void *arg2) { \ + const o_type *a = arg1; \ + const o_type *b = arg2; \ + return name##_cmp(a,b); } +#define LHASH_COMP_FN(name) name##_LHASH_COMP + +/* Third: "doall" functions */ +#define DECLARE_LHASH_DOALL_FN(name, o_type) \ + void name##_LHASH_DOALL(void *); +#define IMPLEMENT_LHASH_DOALL_FN(name, o_type) \ + void name##_LHASH_DOALL(void *arg) { \ + o_type *a = arg; \ + name##_doall(a); } +#define LHASH_DOALL_FN(name) name##_LHASH_DOALL + +/* Fourth: "doall_arg" functions */ +#define DECLARE_LHASH_DOALL_ARG_FN(name, o_type, a_type) \ + void name##_LHASH_DOALL_ARG(void *, void *); +#define IMPLEMENT_LHASH_DOALL_ARG_FN(name, o_type, a_type) \ + void name##_LHASH_DOALL_ARG(void *arg1, void *arg2) { \ + o_type *a = arg1; \ + a_type *b = arg2; \ + name##_doall_arg(a, b); } +#define LHASH_DOALL_ARG_FN(name) name##_LHASH_DOALL_ARG + +typedef struct lhash_st _LHASH; + +#define LH_LOAD_MULT 256 + +_LHASH *lh_new(LHASH_HASH_FN_TYPE h, LHASH_COMP_FN_TYPE c); +void lh_free(_LHASH *lh); +int lh_error(_LHASH *lh); +void *lh_insert(_LHASH *lh, void *data); +void *lh_delete(_LHASH *lh, const void *data); +void *lh_retrieve(_LHASH *lh, const void *data); +void lh_doall(_LHASH *lh, LHASH_DOALL_FN_TYPE func); +void lh_doall_arg(_LHASH *lh, LHASH_DOALL_ARG_FN_TYPE func, void *arg); +unsigned long lh_strhash(const char *c); +unsigned long lh_num_items(const _LHASH *lh); + +/* Type checking... */ + +#define LHASH_OF(type) struct lhash_st_##type + +#define DECLARE_LHASH_OF(type) LHASH_OF(type) + +#define CHECKED_LHASH_OF(type,lh) \ + ((_LHASH *)CHECKED_PTR_OF(LHASH_OF(type),lh)) + +/* Define wrapper functions. */ +#define LHM_lh_new(type, name) \ + ((LHASH_OF(type) *)lh_new(LHASH_HASH_FN(name), LHASH_COMP_FN(name))) +#define LHM_lh_error(type, lh) \ + lh_error(CHECKED_LHASH_OF(type,lh)) +#define LHM_lh_insert(type, lh, inst) \ + ((type *)lh_insert(CHECKED_LHASH_OF(type, lh), \ + CHECKED_PTR_OF(type, inst))) +#define LHM_lh_retrieve(type, lh, inst) \ + ((type *)lh_retrieve(CHECKED_LHASH_OF(type, lh), \ + CHECKED_PTR_OF(type, inst))) +#define LHM_lh_delete(type, lh, inst) \ + ((type *)lh_delete(CHECKED_LHASH_OF(type, lh), \ + CHECKED_PTR_OF(type, inst))) +#define LHM_lh_doall(type, lh,fn) lh_doall(CHECKED_LHASH_OF(type, lh), fn) +#define LHM_lh_doall_arg(type, lh, fn, arg_type, arg) \ + lh_doall_arg(CHECKED_LHASH_OF(type, lh), fn, CHECKED_PTR_OF(arg_type, arg)) +#define LHM_lh_num_items(type, lh) lh_num_items(CHECKED_LHASH_OF(type, lh)) +#define LHM_lh_free(type, lh) lh_free(CHECKED_LHASH_OF(type, lh)) + +DECLARE_LHASH_OF(OPENSSL_STRING); +DECLARE_LHASH_OF(OPENSSL_CSTRING); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/md4.h b/curl/include/openssl/md4.h new file mode 100644 index 0000000..d2a107a --- /dev/null +++ b/curl/include/openssl/md4.h @@ -0,0 +1,105 @@ +/* $OpenBSD: md4.h,v 1.22 2025/01/25 17:59:44 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#include + +#ifndef HEADER_MD4_H +#define HEADER_MD4_H + +#if !defined(HAVE_ATTRIBUTE__BOUNDED__) && !defined(__OpenBSD__) +#define __bounded__(x, y, z) +#endif + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + * ! MD4_LONG has to be at least 32 bits wide. ! + * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + */ + +#define MD4_LONG unsigned int + +#define MD4_CBLOCK 64 +#define MD4_LBLOCK (MD4_CBLOCK/4) +#define MD4_DIGEST_LENGTH 16 + +typedef struct MD4state_st { + MD4_LONG A, B,C, D; + MD4_LONG Nl, Nh; + MD4_LONG data[MD4_LBLOCK]; + unsigned int num; +} MD4_CTX; + +int MD4_Init(MD4_CTX *c); +int MD4_Update(MD4_CTX *c, const void *data, size_t len) + __attribute__ ((__bounded__(__buffer__, 2, 3))); +int MD4_Final(unsigned char *md, MD4_CTX *c); +unsigned char *MD4(const unsigned char *d, size_t n, unsigned char *md) + __attribute__ ((__bounded__(__buffer__, 1, 2))) + __attribute__ ((__nonnull__(3))); +void MD4_Transform(MD4_CTX *c, const unsigned char *b); +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/md5.h b/curl/include/openssl/md5.h new file mode 100644 index 0000000..4d94c84 --- /dev/null +++ b/curl/include/openssl/md5.h @@ -0,0 +1,99 @@ +/* $OpenBSD: md5.h,v 1.25 2025/01/25 17:59:44 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#include + +#ifndef HEADER_MD5_H +#define HEADER_MD5_H + +#include + +#if !defined(HAVE_ATTRIBUTE__BOUNDED__) && !defined(__OpenBSD__) +#define __bounded__(x, y, z) +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +#define MD5_LONG unsigned int + +#define MD5_CBLOCK 64 +#define MD5_LBLOCK (MD5_CBLOCK/4) +#define MD5_DIGEST_LENGTH 16 + +typedef struct MD5state_st { + MD5_LONG A, B,C, D; + MD5_LONG Nl, Nh; + MD5_LONG data[MD5_LBLOCK]; + unsigned int num; +} MD5_CTX; + +int MD5_Init(MD5_CTX *c); +int MD5_Update(MD5_CTX *c, const void *data, size_t len) + __attribute__ ((__bounded__(__buffer__, 2, 3))); +int MD5_Final(unsigned char *md, MD5_CTX *c); +unsigned char *MD5(const unsigned char *d, size_t n, unsigned char *md) + __attribute__ ((__bounded__(__buffer__, 1, 2))) + __attribute__ ((__nonnull__(3))); +void MD5_Transform(MD5_CTX *c, const unsigned char *b); +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/modes.h b/curl/include/openssl/modes.h new file mode 100644 index 0000000..53fa9af --- /dev/null +++ b/curl/include/openssl/modes.h @@ -0,0 +1,118 @@ +/* $OpenBSD: modes.h,v 1.6 2023/07/08 14:55:36 beck Exp $ */ +/* ==================================================================== + * Copyright (c) 2008 The OpenSSL Project. All rights reserved. + * + * Rights for redistribution and usage in source and binary + * forms are granted according to the OpenSSL license. + */ + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +typedef void (*block128_f)(const unsigned char in[16], + unsigned char out[16], + const void *key); + +typedef void (*cbc128_f)(const unsigned char *in, unsigned char *out, + size_t len, const void *key, + unsigned char ivec[16], int enc); + +typedef void (*ctr128_f)(const unsigned char *in, unsigned char *out, + size_t blocks, const void *key, + const unsigned char ivec[16]); + +typedef void (*ccm128_f)(const unsigned char *in, unsigned char *out, + size_t blocks, const void *key, + const unsigned char ivec[16], unsigned char cmac[16]); + +void CRYPTO_cbc128_encrypt(const unsigned char *in, unsigned char *out, + size_t len, const void *key, + unsigned char ivec[16], block128_f block); +void CRYPTO_cbc128_decrypt(const unsigned char *in, unsigned char *out, + size_t len, const void *key, + unsigned char ivec[16], block128_f block); + +void CRYPTO_ctr128_encrypt(const unsigned char *in, unsigned char *out, + size_t len, const void *key, + unsigned char ivec[16], unsigned char ecount_buf[16], + unsigned int *num, block128_f block); + +void CRYPTO_ctr128_encrypt_ctr32(const unsigned char *in, unsigned char *out, + size_t len, const void *key, + unsigned char ivec[16], unsigned char ecount_buf[16], + unsigned int *num, ctr128_f ctr); + +void CRYPTO_ofb128_encrypt(const unsigned char *in, unsigned char *out, + size_t len, const void *key, + unsigned char ivec[16], int *num, + block128_f block); + +void CRYPTO_cfb128_encrypt(const unsigned char *in, unsigned char *out, + size_t len, const void *key, + unsigned char ivec[16], int *num, + int enc, block128_f block); +void CRYPTO_cfb128_8_encrypt(const unsigned char *in, unsigned char *out, + size_t length, const void *key, + unsigned char ivec[16], int *num, + int enc, block128_f block); +void CRYPTO_cfb128_1_encrypt(const unsigned char *in, unsigned char *out, + size_t bits, const void *key, + unsigned char ivec[16], int *num, + int enc, block128_f block); + +typedef struct gcm128_context GCM128_CONTEXT; + +GCM128_CONTEXT *CRYPTO_gcm128_new(void *key, block128_f block); +void CRYPTO_gcm128_init(GCM128_CONTEXT *ctx, void *key, block128_f block); +void CRYPTO_gcm128_setiv(GCM128_CONTEXT *ctx, const unsigned char *iv, + size_t len); +int CRYPTO_gcm128_aad(GCM128_CONTEXT *ctx, const unsigned char *aad, + size_t len); +int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx, + const unsigned char *in, unsigned char *out, + size_t len); +int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx, + const unsigned char *in, unsigned char *out, + size_t len); +int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx, + const unsigned char *in, unsigned char *out, + size_t len, ctr128_f stream); +int CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx, + const unsigned char *in, unsigned char *out, + size_t len, ctr128_f stream); +int CRYPTO_gcm128_finish(GCM128_CONTEXT *ctx, const unsigned char *tag, + size_t len); +void CRYPTO_gcm128_tag(GCM128_CONTEXT *ctx, unsigned char *tag, size_t len); +void CRYPTO_gcm128_release(GCM128_CONTEXT *ctx); + +typedef struct ccm128_context CCM128_CONTEXT; + +void CRYPTO_ccm128_init(CCM128_CONTEXT *ctx, + unsigned int M, unsigned int L, void *key, block128_f block); +int CRYPTO_ccm128_setiv(CCM128_CONTEXT *ctx, + const unsigned char *nonce, size_t nlen, size_t mlen); +void CRYPTO_ccm128_aad(CCM128_CONTEXT *ctx, + const unsigned char *aad, size_t alen); +int CRYPTO_ccm128_encrypt(CCM128_CONTEXT *ctx, + const unsigned char *inp, unsigned char *out, size_t len); +int CRYPTO_ccm128_decrypt(CCM128_CONTEXT *ctx, + const unsigned char *inp, unsigned char *out, size_t len); +int CRYPTO_ccm128_encrypt_ccm64(CCM128_CONTEXT *ctx, + const unsigned char *inp, unsigned char *out, size_t len, + ccm128_f stream); +int CRYPTO_ccm128_decrypt_ccm64(CCM128_CONTEXT *ctx, + const unsigned char *inp, unsigned char *out, size_t len, + ccm128_f stream); +size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx, unsigned char *tag, size_t len); + +typedef struct xts128_context XTS128_CONTEXT; + +int CRYPTO_xts128_encrypt(const XTS128_CONTEXT *ctx, const unsigned char iv[16], + const unsigned char *inp, unsigned char *out, size_t len, int enc); + +#ifdef __cplusplus +} +#endif diff --git a/curl/include/openssl/obj_mac.h b/curl/include/openssl/obj_mac.h new file mode 100644 index 0000000..ace77cc --- /dev/null +++ b/curl/include/openssl/obj_mac.h @@ -0,0 +1,4643 @@ +/* crypto/objects/obj_mac.h */ + +/* THIS FILE IS GENERATED FROM objects.txt by objects.pl via the + * following command: + * perl objects.pl objects.txt obj_mac.num obj_mac.h + */ + +/* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#define SN_undef "UNDEF" +#define LN_undef "undefined" +#define NID_undef 0 +#define OBJ_undef 0L + +#define SN_itu_t "ITU-T" +#define LN_itu_t "itu-t" +#define NID_itu_t 645 +#define OBJ_itu_t 0L + +#define NID_ccitt 404 +#define OBJ_ccitt OBJ_itu_t + +#define SN_iso "ISO" +#define LN_iso "iso" +#define NID_iso 181 +#define OBJ_iso 1L + +#define SN_joint_iso_itu_t "JOINT-ISO-ITU-T" +#define LN_joint_iso_itu_t "joint-iso-itu-t" +#define NID_joint_iso_itu_t 646 +#define OBJ_joint_iso_itu_t 2L + +#define NID_joint_iso_ccitt 393 +#define OBJ_joint_iso_ccitt OBJ_joint_iso_itu_t + +#define SN_member_body "member-body" +#define LN_member_body "ISO Member Body" +#define NID_member_body 182 +#define OBJ_member_body OBJ_iso,2L + +#define SN_identified_organization "identified-organization" +#define NID_identified_organization 676 +#define OBJ_identified_organization OBJ_iso,3L + +#define SN_hmac_md5 "HMAC-MD5" +#define LN_hmac_md5 "hmac-md5" +#define NID_hmac_md5 780 +#define OBJ_hmac_md5 OBJ_identified_organization,6L,1L,5L,5L,8L,1L,1L + +#define SN_hmac_sha1 "HMAC-SHA1" +#define LN_hmac_sha1 "hmac-sha1" +#define NID_hmac_sha1 781 +#define OBJ_hmac_sha1 OBJ_identified_organization,6L,1L,5L,5L,8L,1L,2L + +#define SN_certicom_arc "certicom-arc" +#define NID_certicom_arc 677 +#define OBJ_certicom_arc OBJ_identified_organization,132L + +#define SN_international_organizations "international-organizations" +#define LN_international_organizations "International Organizations" +#define NID_international_organizations 647 +#define OBJ_international_organizations OBJ_joint_iso_itu_t,23L + +#define SN_wap "wap" +#define NID_wap 678 +#define OBJ_wap OBJ_international_organizations,43L + +#define SN_wap_wsg "wap-wsg" +#define NID_wap_wsg 679 +#define OBJ_wap_wsg OBJ_wap,1L + +#define SN_selected_attribute_types "selected-attribute-types" +#define LN_selected_attribute_types "Selected Attribute Types" +#define NID_selected_attribute_types 394 +#define OBJ_selected_attribute_types OBJ_joint_iso_itu_t,5L,1L,5L + +#define SN_clearance "clearance" +#define NID_clearance 395 +#define OBJ_clearance OBJ_selected_attribute_types,55L + +#define SN_ISO_US "ISO-US" +#define LN_ISO_US "ISO US Member Body" +#define NID_ISO_US 183 +#define OBJ_ISO_US OBJ_member_body,840L + +#define SN_X9_57 "X9-57" +#define LN_X9_57 "X9.57" +#define NID_X9_57 184 +#define OBJ_X9_57 OBJ_ISO_US,10040L + +#define SN_X9cm "X9cm" +#define LN_X9cm "X9.57 CM ?" +#define NID_X9cm 185 +#define OBJ_X9cm OBJ_X9_57,4L + +#define SN_dsa "DSA" +#define LN_dsa "dsaEncryption" +#define NID_dsa 116 +#define OBJ_dsa OBJ_X9cm,1L + +#define SN_dsaWithSHA1 "DSA-SHA1" +#define LN_dsaWithSHA1 "dsaWithSHA1" +#define NID_dsaWithSHA1 113 +#define OBJ_dsaWithSHA1 OBJ_X9cm,3L + +#define SN_ansi_X9_62 "ansi-X9-62" +#define LN_ansi_X9_62 "ANSI X9.62" +#define NID_ansi_X9_62 405 +#define OBJ_ansi_X9_62 OBJ_ISO_US,10045L + +#define OBJ_X9_62_id_fieldType OBJ_ansi_X9_62,1L + +#define SN_X9_62_prime_field "prime-field" +#define NID_X9_62_prime_field 406 +#define OBJ_X9_62_prime_field OBJ_X9_62_id_fieldType,1L + +#define SN_X9_62_characteristic_two_field "characteristic-two-field" +#define NID_X9_62_characteristic_two_field 407 +#define OBJ_X9_62_characteristic_two_field OBJ_X9_62_id_fieldType,2L + +#define SN_X9_62_id_characteristic_two_basis "id-characteristic-two-basis" +#define NID_X9_62_id_characteristic_two_basis 680 +#define OBJ_X9_62_id_characteristic_two_basis OBJ_X9_62_characteristic_two_field,3L + +#define SN_X9_62_onBasis "onBasis" +#define NID_X9_62_onBasis 681 +#define OBJ_X9_62_onBasis OBJ_X9_62_id_characteristic_two_basis,1L + +#define SN_X9_62_tpBasis "tpBasis" +#define NID_X9_62_tpBasis 682 +#define OBJ_X9_62_tpBasis OBJ_X9_62_id_characteristic_two_basis,2L + +#define SN_X9_62_ppBasis "ppBasis" +#define NID_X9_62_ppBasis 683 +#define OBJ_X9_62_ppBasis OBJ_X9_62_id_characteristic_two_basis,3L + +#define OBJ_X9_62_id_publicKeyType OBJ_ansi_X9_62,2L + +#define SN_X9_62_id_ecPublicKey "id-ecPublicKey" +#define NID_X9_62_id_ecPublicKey 408 +#define OBJ_X9_62_id_ecPublicKey OBJ_X9_62_id_publicKeyType,1L + +#define OBJ_X9_62_ellipticCurve OBJ_ansi_X9_62,3L + +#define OBJ_X9_62_c_TwoCurve OBJ_X9_62_ellipticCurve,0L + +#define SN_X9_62_c2pnb163v1 "c2pnb163v1" +#define NID_X9_62_c2pnb163v1 684 +#define OBJ_X9_62_c2pnb163v1 OBJ_X9_62_c_TwoCurve,1L + +#define SN_X9_62_c2pnb163v2 "c2pnb163v2" +#define NID_X9_62_c2pnb163v2 685 +#define OBJ_X9_62_c2pnb163v2 OBJ_X9_62_c_TwoCurve,2L + +#define SN_X9_62_c2pnb163v3 "c2pnb163v3" +#define NID_X9_62_c2pnb163v3 686 +#define OBJ_X9_62_c2pnb163v3 OBJ_X9_62_c_TwoCurve,3L + +#define SN_X9_62_c2pnb176v1 "c2pnb176v1" +#define NID_X9_62_c2pnb176v1 687 +#define OBJ_X9_62_c2pnb176v1 OBJ_X9_62_c_TwoCurve,4L + +#define SN_X9_62_c2tnb191v1 "c2tnb191v1" +#define NID_X9_62_c2tnb191v1 688 +#define OBJ_X9_62_c2tnb191v1 OBJ_X9_62_c_TwoCurve,5L + +#define SN_X9_62_c2tnb191v2 "c2tnb191v2" +#define NID_X9_62_c2tnb191v2 689 +#define OBJ_X9_62_c2tnb191v2 OBJ_X9_62_c_TwoCurve,6L + +#define SN_X9_62_c2tnb191v3 "c2tnb191v3" +#define NID_X9_62_c2tnb191v3 690 +#define OBJ_X9_62_c2tnb191v3 OBJ_X9_62_c_TwoCurve,7L + +#define SN_X9_62_c2onb191v4 "c2onb191v4" +#define NID_X9_62_c2onb191v4 691 +#define OBJ_X9_62_c2onb191v4 OBJ_X9_62_c_TwoCurve,8L + +#define SN_X9_62_c2onb191v5 "c2onb191v5" +#define NID_X9_62_c2onb191v5 692 +#define OBJ_X9_62_c2onb191v5 OBJ_X9_62_c_TwoCurve,9L + +#define SN_X9_62_c2pnb208w1 "c2pnb208w1" +#define NID_X9_62_c2pnb208w1 693 +#define OBJ_X9_62_c2pnb208w1 OBJ_X9_62_c_TwoCurve,10L + +#define SN_X9_62_c2tnb239v1 "c2tnb239v1" +#define NID_X9_62_c2tnb239v1 694 +#define OBJ_X9_62_c2tnb239v1 OBJ_X9_62_c_TwoCurve,11L + +#define SN_X9_62_c2tnb239v2 "c2tnb239v2" +#define NID_X9_62_c2tnb239v2 695 +#define OBJ_X9_62_c2tnb239v2 OBJ_X9_62_c_TwoCurve,12L + +#define SN_X9_62_c2tnb239v3 "c2tnb239v3" +#define NID_X9_62_c2tnb239v3 696 +#define OBJ_X9_62_c2tnb239v3 OBJ_X9_62_c_TwoCurve,13L + +#define SN_X9_62_c2onb239v4 "c2onb239v4" +#define NID_X9_62_c2onb239v4 697 +#define OBJ_X9_62_c2onb239v4 OBJ_X9_62_c_TwoCurve,14L + +#define SN_X9_62_c2onb239v5 "c2onb239v5" +#define NID_X9_62_c2onb239v5 698 +#define OBJ_X9_62_c2onb239v5 OBJ_X9_62_c_TwoCurve,15L + +#define SN_X9_62_c2pnb272w1 "c2pnb272w1" +#define NID_X9_62_c2pnb272w1 699 +#define OBJ_X9_62_c2pnb272w1 OBJ_X9_62_c_TwoCurve,16L + +#define SN_X9_62_c2pnb304w1 "c2pnb304w1" +#define NID_X9_62_c2pnb304w1 700 +#define OBJ_X9_62_c2pnb304w1 OBJ_X9_62_c_TwoCurve,17L + +#define SN_X9_62_c2tnb359v1 "c2tnb359v1" +#define NID_X9_62_c2tnb359v1 701 +#define OBJ_X9_62_c2tnb359v1 OBJ_X9_62_c_TwoCurve,18L + +#define SN_X9_62_c2pnb368w1 "c2pnb368w1" +#define NID_X9_62_c2pnb368w1 702 +#define OBJ_X9_62_c2pnb368w1 OBJ_X9_62_c_TwoCurve,19L + +#define SN_X9_62_c2tnb431r1 "c2tnb431r1" +#define NID_X9_62_c2tnb431r1 703 +#define OBJ_X9_62_c2tnb431r1 OBJ_X9_62_c_TwoCurve,20L + +#define OBJ_X9_62_primeCurve OBJ_X9_62_ellipticCurve,1L + +#define SN_X9_62_prime192v1 "prime192v1" +#define NID_X9_62_prime192v1 409 +#define OBJ_X9_62_prime192v1 OBJ_X9_62_primeCurve,1L + +#define SN_X9_62_prime192v2 "prime192v2" +#define NID_X9_62_prime192v2 410 +#define OBJ_X9_62_prime192v2 OBJ_X9_62_primeCurve,2L + +#define SN_X9_62_prime192v3 "prime192v3" +#define NID_X9_62_prime192v3 411 +#define OBJ_X9_62_prime192v3 OBJ_X9_62_primeCurve,3L + +#define SN_X9_62_prime239v1 "prime239v1" +#define NID_X9_62_prime239v1 412 +#define OBJ_X9_62_prime239v1 OBJ_X9_62_primeCurve,4L + +#define SN_X9_62_prime239v2 "prime239v2" +#define NID_X9_62_prime239v2 413 +#define OBJ_X9_62_prime239v2 OBJ_X9_62_primeCurve,5L + +#define SN_X9_62_prime239v3 "prime239v3" +#define NID_X9_62_prime239v3 414 +#define OBJ_X9_62_prime239v3 OBJ_X9_62_primeCurve,6L + +#define SN_X9_62_prime256v1 "prime256v1" +#define NID_X9_62_prime256v1 415 +#define OBJ_X9_62_prime256v1 OBJ_X9_62_primeCurve,7L + +#define OBJ_X9_62_id_ecSigType OBJ_ansi_X9_62,4L + +#define SN_ecdsa_with_SHA1 "ecdsa-with-SHA1" +#define NID_ecdsa_with_SHA1 416 +#define OBJ_ecdsa_with_SHA1 OBJ_X9_62_id_ecSigType,1L + +#define SN_ecdsa_with_Recommended "ecdsa-with-Recommended" +#define NID_ecdsa_with_Recommended 791 +#define OBJ_ecdsa_with_Recommended OBJ_X9_62_id_ecSigType,2L + +#define SN_ecdsa_with_Specified "ecdsa-with-Specified" +#define NID_ecdsa_with_Specified 792 +#define OBJ_ecdsa_with_Specified OBJ_X9_62_id_ecSigType,3L + +#define SN_ecdsa_with_SHA224 "ecdsa-with-SHA224" +#define NID_ecdsa_with_SHA224 793 +#define OBJ_ecdsa_with_SHA224 OBJ_ecdsa_with_Specified,1L + +#define SN_ecdsa_with_SHA256 "ecdsa-with-SHA256" +#define NID_ecdsa_with_SHA256 794 +#define OBJ_ecdsa_with_SHA256 OBJ_ecdsa_with_Specified,2L + +#define SN_ecdsa_with_SHA384 "ecdsa-with-SHA384" +#define NID_ecdsa_with_SHA384 795 +#define OBJ_ecdsa_with_SHA384 OBJ_ecdsa_with_Specified,3L + +#define SN_ecdsa_with_SHA512 "ecdsa-with-SHA512" +#define NID_ecdsa_with_SHA512 796 +#define OBJ_ecdsa_with_SHA512 OBJ_ecdsa_with_Specified,4L + +#define OBJ_secg_ellipticCurve OBJ_certicom_arc,0L + +#define SN_secp112r1 "secp112r1" +#define NID_secp112r1 704 +#define OBJ_secp112r1 OBJ_secg_ellipticCurve,6L + +#define SN_secp112r2 "secp112r2" +#define NID_secp112r2 705 +#define OBJ_secp112r2 OBJ_secg_ellipticCurve,7L + +#define SN_secp128r1 "secp128r1" +#define NID_secp128r1 706 +#define OBJ_secp128r1 OBJ_secg_ellipticCurve,28L + +#define SN_secp128r2 "secp128r2" +#define NID_secp128r2 707 +#define OBJ_secp128r2 OBJ_secg_ellipticCurve,29L + +#define SN_secp160k1 "secp160k1" +#define NID_secp160k1 708 +#define OBJ_secp160k1 OBJ_secg_ellipticCurve,9L + +#define SN_secp160r1 "secp160r1" +#define NID_secp160r1 709 +#define OBJ_secp160r1 OBJ_secg_ellipticCurve,8L + +#define SN_secp160r2 "secp160r2" +#define NID_secp160r2 710 +#define OBJ_secp160r2 OBJ_secg_ellipticCurve,30L + +#define SN_secp192k1 "secp192k1" +#define NID_secp192k1 711 +#define OBJ_secp192k1 OBJ_secg_ellipticCurve,31L + +#define SN_secp224k1 "secp224k1" +#define NID_secp224k1 712 +#define OBJ_secp224k1 OBJ_secg_ellipticCurve,32L + +#define SN_secp224r1 "secp224r1" +#define NID_secp224r1 713 +#define OBJ_secp224r1 OBJ_secg_ellipticCurve,33L + +#define SN_secp256k1 "secp256k1" +#define NID_secp256k1 714 +#define OBJ_secp256k1 OBJ_secg_ellipticCurve,10L + +#define SN_secp384r1 "secp384r1" +#define NID_secp384r1 715 +#define OBJ_secp384r1 OBJ_secg_ellipticCurve,34L + +#define SN_secp521r1 "secp521r1" +#define NID_secp521r1 716 +#define OBJ_secp521r1 OBJ_secg_ellipticCurve,35L + +#define SN_sect113r1 "sect113r1" +#define NID_sect113r1 717 +#define OBJ_sect113r1 OBJ_secg_ellipticCurve,4L + +#define SN_sect113r2 "sect113r2" +#define NID_sect113r2 718 +#define OBJ_sect113r2 OBJ_secg_ellipticCurve,5L + +#define SN_sect131r1 "sect131r1" +#define NID_sect131r1 719 +#define OBJ_sect131r1 OBJ_secg_ellipticCurve,22L + +#define SN_sect131r2 "sect131r2" +#define NID_sect131r2 720 +#define OBJ_sect131r2 OBJ_secg_ellipticCurve,23L + +#define SN_sect163k1 "sect163k1" +#define NID_sect163k1 721 +#define OBJ_sect163k1 OBJ_secg_ellipticCurve,1L + +#define SN_sect163r1 "sect163r1" +#define NID_sect163r1 722 +#define OBJ_sect163r1 OBJ_secg_ellipticCurve,2L + +#define SN_sect163r2 "sect163r2" +#define NID_sect163r2 723 +#define OBJ_sect163r2 OBJ_secg_ellipticCurve,15L + +#define SN_sect193r1 "sect193r1" +#define NID_sect193r1 724 +#define OBJ_sect193r1 OBJ_secg_ellipticCurve,24L + +#define SN_sect193r2 "sect193r2" +#define NID_sect193r2 725 +#define OBJ_sect193r2 OBJ_secg_ellipticCurve,25L + +#define SN_sect233k1 "sect233k1" +#define NID_sect233k1 726 +#define OBJ_sect233k1 OBJ_secg_ellipticCurve,26L + +#define SN_sect233r1 "sect233r1" +#define NID_sect233r1 727 +#define OBJ_sect233r1 OBJ_secg_ellipticCurve,27L + +#define SN_sect239k1 "sect239k1" +#define NID_sect239k1 728 +#define OBJ_sect239k1 OBJ_secg_ellipticCurve,3L + +#define SN_sect283k1 "sect283k1" +#define NID_sect283k1 729 +#define OBJ_sect283k1 OBJ_secg_ellipticCurve,16L + +#define SN_sect283r1 "sect283r1" +#define NID_sect283r1 730 +#define OBJ_sect283r1 OBJ_secg_ellipticCurve,17L + +#define SN_sect409k1 "sect409k1" +#define NID_sect409k1 731 +#define OBJ_sect409k1 OBJ_secg_ellipticCurve,36L + +#define SN_sect409r1 "sect409r1" +#define NID_sect409r1 732 +#define OBJ_sect409r1 OBJ_secg_ellipticCurve,37L + +#define SN_sect571k1 "sect571k1" +#define NID_sect571k1 733 +#define OBJ_sect571k1 OBJ_secg_ellipticCurve,38L + +#define SN_sect571r1 "sect571r1" +#define NID_sect571r1 734 +#define OBJ_sect571r1 OBJ_secg_ellipticCurve,39L + +#define OBJ_wap_wsg_idm_ecid OBJ_wap_wsg,4L + +#define SN_wap_wsg_idm_ecid_wtls1 "wap-wsg-idm-ecid-wtls1" +#define NID_wap_wsg_idm_ecid_wtls1 735 +#define OBJ_wap_wsg_idm_ecid_wtls1 OBJ_wap_wsg_idm_ecid,1L + +#define SN_wap_wsg_idm_ecid_wtls3 "wap-wsg-idm-ecid-wtls3" +#define NID_wap_wsg_idm_ecid_wtls3 736 +#define OBJ_wap_wsg_idm_ecid_wtls3 OBJ_wap_wsg_idm_ecid,3L + +#define SN_wap_wsg_idm_ecid_wtls4 "wap-wsg-idm-ecid-wtls4" +#define NID_wap_wsg_idm_ecid_wtls4 737 +#define OBJ_wap_wsg_idm_ecid_wtls4 OBJ_wap_wsg_idm_ecid,4L + +#define SN_wap_wsg_idm_ecid_wtls5 "wap-wsg-idm-ecid-wtls5" +#define NID_wap_wsg_idm_ecid_wtls5 738 +#define OBJ_wap_wsg_idm_ecid_wtls5 OBJ_wap_wsg_idm_ecid,5L + +#define SN_wap_wsg_idm_ecid_wtls6 "wap-wsg-idm-ecid-wtls6" +#define NID_wap_wsg_idm_ecid_wtls6 739 +#define OBJ_wap_wsg_idm_ecid_wtls6 OBJ_wap_wsg_idm_ecid,6L + +#define SN_wap_wsg_idm_ecid_wtls7 "wap-wsg-idm-ecid-wtls7" +#define NID_wap_wsg_idm_ecid_wtls7 740 +#define OBJ_wap_wsg_idm_ecid_wtls7 OBJ_wap_wsg_idm_ecid,7L + +#define SN_wap_wsg_idm_ecid_wtls8 "wap-wsg-idm-ecid-wtls8" +#define NID_wap_wsg_idm_ecid_wtls8 741 +#define OBJ_wap_wsg_idm_ecid_wtls8 OBJ_wap_wsg_idm_ecid,8L + +#define SN_wap_wsg_idm_ecid_wtls9 "wap-wsg-idm-ecid-wtls9" +#define NID_wap_wsg_idm_ecid_wtls9 742 +#define OBJ_wap_wsg_idm_ecid_wtls9 OBJ_wap_wsg_idm_ecid,9L + +#define SN_wap_wsg_idm_ecid_wtls10 "wap-wsg-idm-ecid-wtls10" +#define NID_wap_wsg_idm_ecid_wtls10 743 +#define OBJ_wap_wsg_idm_ecid_wtls10 OBJ_wap_wsg_idm_ecid,10L + +#define SN_wap_wsg_idm_ecid_wtls11 "wap-wsg-idm-ecid-wtls11" +#define NID_wap_wsg_idm_ecid_wtls11 744 +#define OBJ_wap_wsg_idm_ecid_wtls11 OBJ_wap_wsg_idm_ecid,11L + +#define SN_wap_wsg_idm_ecid_wtls12 "wap-wsg-idm-ecid-wtls12" +#define NID_wap_wsg_idm_ecid_wtls12 745 +#define OBJ_wap_wsg_idm_ecid_wtls12 OBJ_wap_wsg_idm_ecid,12L + +#define SN_cast5_cbc "CAST5-CBC" +#define LN_cast5_cbc "cast5-cbc" +#define NID_cast5_cbc 108 +#define OBJ_cast5_cbc OBJ_ISO_US,113533L,7L,66L,10L + +#define SN_cast5_ecb "CAST5-ECB" +#define LN_cast5_ecb "cast5-ecb" +#define NID_cast5_ecb 109 + +#define SN_cast5_cfb64 "CAST5-CFB" +#define LN_cast5_cfb64 "cast5-cfb" +#define NID_cast5_cfb64 110 + +#define SN_cast5_ofb64 "CAST5-OFB" +#define LN_cast5_ofb64 "cast5-ofb" +#define NID_cast5_ofb64 111 + +#define LN_pbeWithMD5AndCast5_CBC "pbeWithMD5AndCast5CBC" +#define NID_pbeWithMD5AndCast5_CBC 112 +#define OBJ_pbeWithMD5AndCast5_CBC OBJ_ISO_US,113533L,7L,66L,12L + +#define SN_id_PasswordBasedMAC "id-PasswordBasedMAC" +#define LN_id_PasswordBasedMAC "password based MAC" +#define NID_id_PasswordBasedMAC 782 +#define OBJ_id_PasswordBasedMAC OBJ_ISO_US,113533L,7L,66L,13L + +#define SN_id_DHBasedMac "id-DHBasedMac" +#define LN_id_DHBasedMac "Diffie-Hellman based MAC" +#define NID_id_DHBasedMac 783 +#define OBJ_id_DHBasedMac OBJ_ISO_US,113533L,7L,66L,30L + +#define SN_rsadsi "rsadsi" +#define LN_rsadsi "RSA Data Security, Inc." +#define NID_rsadsi 1 +#define OBJ_rsadsi OBJ_ISO_US,113549L + +#define SN_pkcs "pkcs" +#define LN_pkcs "RSA Data Security, Inc. PKCS" +#define NID_pkcs 2 +#define OBJ_pkcs OBJ_rsadsi,1L + +#define SN_pkcs1 "pkcs1" +#define NID_pkcs1 186 +#define OBJ_pkcs1 OBJ_pkcs,1L + +#define LN_rsaEncryption "rsaEncryption" +#define NID_rsaEncryption 6 +#define OBJ_rsaEncryption OBJ_pkcs1,1L + +#define SN_md2WithRSAEncryption "RSA-MD2" +#define LN_md2WithRSAEncryption "md2WithRSAEncryption" +#define NID_md2WithRSAEncryption 7 +#define OBJ_md2WithRSAEncryption OBJ_pkcs1,2L + +#define SN_md4WithRSAEncryption "RSA-MD4" +#define LN_md4WithRSAEncryption "md4WithRSAEncryption" +#define NID_md4WithRSAEncryption 396 +#define OBJ_md4WithRSAEncryption OBJ_pkcs1,3L + +#define SN_md5WithRSAEncryption "RSA-MD5" +#define LN_md5WithRSAEncryption "md5WithRSAEncryption" +#define NID_md5WithRSAEncryption 8 +#define OBJ_md5WithRSAEncryption OBJ_pkcs1,4L + +#define SN_sha1WithRSAEncryption "RSA-SHA1" +#define LN_sha1WithRSAEncryption "sha1WithRSAEncryption" +#define NID_sha1WithRSAEncryption 65 +#define OBJ_sha1WithRSAEncryption OBJ_pkcs1,5L + +#define SN_rsaesOaep "RSAES-OAEP" +#define LN_rsaesOaep "rsaesOaep" +#define NID_rsaesOaep 919 +#define OBJ_rsaesOaep OBJ_pkcs1,7L + +#define SN_mgf1 "MGF1" +#define LN_mgf1 "mgf1" +#define NID_mgf1 911 +#define OBJ_mgf1 OBJ_pkcs1,8L + +#define SN_pSpecified "PSPECIFIED" +#define LN_pSpecified "pSpecified" +#define NID_pSpecified 992 +#define OBJ_pSpecified OBJ_pkcs1,9L + +#define SN_rsassaPss "RSASSA-PSS" +#define LN_rsassaPss "rsassaPss" +#define NID_rsassaPss 912 +#define OBJ_rsassaPss OBJ_pkcs1,10L + +#define SN_sha256WithRSAEncryption "RSA-SHA256" +#define LN_sha256WithRSAEncryption "sha256WithRSAEncryption" +#define NID_sha256WithRSAEncryption 668 +#define OBJ_sha256WithRSAEncryption OBJ_pkcs1,11L + +#define SN_sha384WithRSAEncryption "RSA-SHA384" +#define LN_sha384WithRSAEncryption "sha384WithRSAEncryption" +#define NID_sha384WithRSAEncryption 669 +#define OBJ_sha384WithRSAEncryption OBJ_pkcs1,12L + +#define SN_sha512WithRSAEncryption "RSA-SHA512" +#define LN_sha512WithRSAEncryption "sha512WithRSAEncryption" +#define NID_sha512WithRSAEncryption 670 +#define OBJ_sha512WithRSAEncryption OBJ_pkcs1,13L + +#define SN_sha224WithRSAEncryption "RSA-SHA224" +#define LN_sha224WithRSAEncryption "sha224WithRSAEncryption" +#define NID_sha224WithRSAEncryption 671 +#define OBJ_sha224WithRSAEncryption OBJ_pkcs1,14L + +#define SN_sha512_224WithRSAEncryption "RSA-SHA512/224" +#define LN_sha512_224WithRSAEncryption "sha512-224WithRSAEncryption" +#define NID_sha512_224WithRSAEncryption 1025 +#define OBJ_sha512_224WithRSAEncryption OBJ_pkcs1,15L + +#define SN_sha512_256WithRSAEncryption "RSA-SHA512/256" +#define LN_sha512_256WithRSAEncryption "sha512-256WithRSAEncryption" +#define NID_sha512_256WithRSAEncryption 1026 +#define OBJ_sha512_256WithRSAEncryption OBJ_pkcs1,16L + +#define SN_pkcs3 "pkcs3" +#define NID_pkcs3 27 +#define OBJ_pkcs3 OBJ_pkcs,3L + +#define LN_dhKeyAgreement "dhKeyAgreement" +#define NID_dhKeyAgreement 28 +#define OBJ_dhKeyAgreement OBJ_pkcs3,1L + +#define SN_pkcs5 "pkcs5" +#define NID_pkcs5 187 +#define OBJ_pkcs5 OBJ_pkcs,5L + +#define SN_pbeWithMD2AndDES_CBC "PBE-MD2-DES" +#define LN_pbeWithMD2AndDES_CBC "pbeWithMD2AndDES-CBC" +#define NID_pbeWithMD2AndDES_CBC 9 +#define OBJ_pbeWithMD2AndDES_CBC OBJ_pkcs5,1L + +#define SN_pbeWithMD5AndDES_CBC "PBE-MD5-DES" +#define LN_pbeWithMD5AndDES_CBC "pbeWithMD5AndDES-CBC" +#define NID_pbeWithMD5AndDES_CBC 10 +#define OBJ_pbeWithMD5AndDES_CBC OBJ_pkcs5,3L + +#define SN_pbeWithMD2AndRC2_CBC "PBE-MD2-RC2-64" +#define LN_pbeWithMD2AndRC2_CBC "pbeWithMD2AndRC2-CBC" +#define NID_pbeWithMD2AndRC2_CBC 168 +#define OBJ_pbeWithMD2AndRC2_CBC OBJ_pkcs5,4L + +#define SN_pbeWithMD5AndRC2_CBC "PBE-MD5-RC2-64" +#define LN_pbeWithMD5AndRC2_CBC "pbeWithMD5AndRC2-CBC" +#define NID_pbeWithMD5AndRC2_CBC 169 +#define OBJ_pbeWithMD5AndRC2_CBC OBJ_pkcs5,6L + +#define SN_pbeWithSHA1AndDES_CBC "PBE-SHA1-DES" +#define LN_pbeWithSHA1AndDES_CBC "pbeWithSHA1AndDES-CBC" +#define NID_pbeWithSHA1AndDES_CBC 170 +#define OBJ_pbeWithSHA1AndDES_CBC OBJ_pkcs5,10L + +#define SN_pbeWithSHA1AndRC2_CBC "PBE-SHA1-RC2-64" +#define LN_pbeWithSHA1AndRC2_CBC "pbeWithSHA1AndRC2-CBC" +#define NID_pbeWithSHA1AndRC2_CBC 68 +#define OBJ_pbeWithSHA1AndRC2_CBC OBJ_pkcs5,11L + +#define LN_id_pbkdf2 "PBKDF2" +#define NID_id_pbkdf2 69 +#define OBJ_id_pbkdf2 OBJ_pkcs5,12L + +#define LN_pbes2 "PBES2" +#define NID_pbes2 161 +#define OBJ_pbes2 OBJ_pkcs5,13L + +#define LN_pbmac1 "PBMAC1" +#define NID_pbmac1 162 +#define OBJ_pbmac1 OBJ_pkcs5,14L + +#define SN_pkcs7 "pkcs7" +#define NID_pkcs7 20 +#define OBJ_pkcs7 OBJ_pkcs,7L + +#define LN_pkcs7_data "pkcs7-data" +#define NID_pkcs7_data 21 +#define OBJ_pkcs7_data OBJ_pkcs7,1L + +#define LN_pkcs7_signed "pkcs7-signedData" +#define NID_pkcs7_signed 22 +#define OBJ_pkcs7_signed OBJ_pkcs7,2L + +#define LN_pkcs7_enveloped "pkcs7-envelopedData" +#define NID_pkcs7_enveloped 23 +#define OBJ_pkcs7_enveloped OBJ_pkcs7,3L + +#define LN_pkcs7_signedAndEnveloped "pkcs7-signedAndEnvelopedData" +#define NID_pkcs7_signedAndEnveloped 24 +#define OBJ_pkcs7_signedAndEnveloped OBJ_pkcs7,4L + +#define LN_pkcs7_digest "pkcs7-digestData" +#define NID_pkcs7_digest 25 +#define OBJ_pkcs7_digest OBJ_pkcs7,5L + +#define LN_pkcs7_encrypted "pkcs7-encryptedData" +#define NID_pkcs7_encrypted 26 +#define OBJ_pkcs7_encrypted OBJ_pkcs7,6L + +#define SN_pkcs9 "pkcs9" +#define NID_pkcs9 47 +#define OBJ_pkcs9 OBJ_pkcs,9L + +#define LN_pkcs9_emailAddress "emailAddress" +#define NID_pkcs9_emailAddress 48 +#define OBJ_pkcs9_emailAddress OBJ_pkcs9,1L + +#define LN_pkcs9_unstructuredName "unstructuredName" +#define NID_pkcs9_unstructuredName 49 +#define OBJ_pkcs9_unstructuredName OBJ_pkcs9,2L + +#define LN_pkcs9_contentType "contentType" +#define NID_pkcs9_contentType 50 +#define OBJ_pkcs9_contentType OBJ_pkcs9,3L + +#define LN_pkcs9_messageDigest "messageDigest" +#define NID_pkcs9_messageDigest 51 +#define OBJ_pkcs9_messageDigest OBJ_pkcs9,4L + +#define LN_pkcs9_signingTime "signingTime" +#define NID_pkcs9_signingTime 52 +#define OBJ_pkcs9_signingTime OBJ_pkcs9,5L + +#define LN_pkcs9_countersignature "countersignature" +#define NID_pkcs9_countersignature 53 +#define OBJ_pkcs9_countersignature OBJ_pkcs9,6L + +#define LN_pkcs9_challengePassword "challengePassword" +#define NID_pkcs9_challengePassword 54 +#define OBJ_pkcs9_challengePassword OBJ_pkcs9,7L + +#define LN_pkcs9_unstructuredAddress "unstructuredAddress" +#define NID_pkcs9_unstructuredAddress 55 +#define OBJ_pkcs9_unstructuredAddress OBJ_pkcs9,8L + +#define LN_pkcs9_extCertAttributes "extendedCertificateAttributes" +#define NID_pkcs9_extCertAttributes 56 +#define OBJ_pkcs9_extCertAttributes OBJ_pkcs9,9L + +#define SN_ext_req "extReq" +#define LN_ext_req "Extension Request" +#define NID_ext_req 172 +#define OBJ_ext_req OBJ_pkcs9,14L + +#define SN_SMIMECapabilities "SMIME-CAPS" +#define LN_SMIMECapabilities "S/MIME Capabilities" +#define NID_SMIMECapabilities 167 +#define OBJ_SMIMECapabilities OBJ_pkcs9,15L + +#define SN_SMIME "SMIME" +#define LN_SMIME "S/MIME" +#define NID_SMIME 188 +#define OBJ_SMIME OBJ_pkcs9,16L + +#define SN_id_smime_mod "id-smime-mod" +#define NID_id_smime_mod 189 +#define OBJ_id_smime_mod OBJ_SMIME,0L + +#define SN_id_smime_ct "id-smime-ct" +#define NID_id_smime_ct 190 +#define OBJ_id_smime_ct OBJ_SMIME,1L + +#define SN_id_smime_aa "id-smime-aa" +#define NID_id_smime_aa 191 +#define OBJ_id_smime_aa OBJ_SMIME,2L + +#define SN_id_smime_alg "id-smime-alg" +#define NID_id_smime_alg 192 +#define OBJ_id_smime_alg OBJ_SMIME,3L + +#define SN_id_smime_cd "id-smime-cd" +#define NID_id_smime_cd 193 +#define OBJ_id_smime_cd OBJ_SMIME,4L + +#define SN_id_smime_spq "id-smime-spq" +#define NID_id_smime_spq 194 +#define OBJ_id_smime_spq OBJ_SMIME,5L + +#define SN_id_smime_cti "id-smime-cti" +#define NID_id_smime_cti 195 +#define OBJ_id_smime_cti OBJ_SMIME,6L + +#define SN_id_smime_mod_cms "id-smime-mod-cms" +#define NID_id_smime_mod_cms 196 +#define OBJ_id_smime_mod_cms OBJ_id_smime_mod,1L + +#define SN_id_smime_mod_ess "id-smime-mod-ess" +#define NID_id_smime_mod_ess 197 +#define OBJ_id_smime_mod_ess OBJ_id_smime_mod,2L + +#define SN_id_smime_mod_oid "id-smime-mod-oid" +#define NID_id_smime_mod_oid 198 +#define OBJ_id_smime_mod_oid OBJ_id_smime_mod,3L + +#define SN_id_smime_mod_msg_v3 "id-smime-mod-msg-v3" +#define NID_id_smime_mod_msg_v3 199 +#define OBJ_id_smime_mod_msg_v3 OBJ_id_smime_mod,4L + +#define SN_id_smime_mod_ets_eSignature_88 "id-smime-mod-ets-eSignature-88" +#define NID_id_smime_mod_ets_eSignature_88 200 +#define OBJ_id_smime_mod_ets_eSignature_88 OBJ_id_smime_mod,5L + +#define SN_id_smime_mod_ets_eSignature_97 "id-smime-mod-ets-eSignature-97" +#define NID_id_smime_mod_ets_eSignature_97 201 +#define OBJ_id_smime_mod_ets_eSignature_97 OBJ_id_smime_mod,6L + +#define SN_id_smime_mod_ets_eSigPolicy_88 "id-smime-mod-ets-eSigPolicy-88" +#define NID_id_smime_mod_ets_eSigPolicy_88 202 +#define OBJ_id_smime_mod_ets_eSigPolicy_88 OBJ_id_smime_mod,7L + +#define SN_id_smime_mod_ets_eSigPolicy_97 "id-smime-mod-ets-eSigPolicy-97" +#define NID_id_smime_mod_ets_eSigPolicy_97 203 +#define OBJ_id_smime_mod_ets_eSigPolicy_97 OBJ_id_smime_mod,8L + +#define SN_id_smime_ct_receipt "id-smime-ct-receipt" +#define NID_id_smime_ct_receipt 204 +#define OBJ_id_smime_ct_receipt OBJ_id_smime_ct,1L + +#define SN_id_smime_ct_authData "id-smime-ct-authData" +#define NID_id_smime_ct_authData 205 +#define OBJ_id_smime_ct_authData OBJ_id_smime_ct,2L + +#define SN_id_smime_ct_publishCert "id-smime-ct-publishCert" +#define NID_id_smime_ct_publishCert 206 +#define OBJ_id_smime_ct_publishCert OBJ_id_smime_ct,3L + +#define SN_id_smime_ct_TSTInfo "id-smime-ct-TSTInfo" +#define NID_id_smime_ct_TSTInfo 207 +#define OBJ_id_smime_ct_TSTInfo OBJ_id_smime_ct,4L + +#define SN_id_smime_ct_TDTInfo "id-smime-ct-TDTInfo" +#define NID_id_smime_ct_TDTInfo 208 +#define OBJ_id_smime_ct_TDTInfo OBJ_id_smime_ct,5L + +#define SN_id_smime_ct_contentInfo "id-smime-ct-contentInfo" +#define NID_id_smime_ct_contentInfo 209 +#define OBJ_id_smime_ct_contentInfo OBJ_id_smime_ct,6L + +#define SN_id_smime_ct_DVCSRequestData "id-smime-ct-DVCSRequestData" +#define NID_id_smime_ct_DVCSRequestData 210 +#define OBJ_id_smime_ct_DVCSRequestData OBJ_id_smime_ct,7L + +#define SN_id_smime_ct_DVCSResponseData "id-smime-ct-DVCSResponseData" +#define NID_id_smime_ct_DVCSResponseData 211 +#define OBJ_id_smime_ct_DVCSResponseData OBJ_id_smime_ct,8L + +#define SN_id_smime_ct_compressedData "id-smime-ct-compressedData" +#define NID_id_smime_ct_compressedData 786 +#define OBJ_id_smime_ct_compressedData OBJ_id_smime_ct,9L + +#define SN_id_ct_routeOriginAuthz "id-ct-routeOriginAuthz" +#define NID_id_ct_routeOriginAuthz 1001 +#define OBJ_id_ct_routeOriginAuthz OBJ_id_smime_ct,24L + +#define SN_id_ct_rpkiManifest "id-ct-rpkiManifest" +#define NID_id_ct_rpkiManifest 1002 +#define OBJ_id_ct_rpkiManifest OBJ_id_smime_ct,26L + +#define SN_id_ct_asciiTextWithCRLF "id-ct-asciiTextWithCRLF" +#define NID_id_ct_asciiTextWithCRLF 787 +#define OBJ_id_ct_asciiTextWithCRLF OBJ_id_smime_ct,27L + +#define SN_id_ct_rpkiGhostbusters "id-ct-rpkiGhostbusters" +#define NID_id_ct_rpkiGhostbusters 1003 +#define OBJ_id_ct_rpkiGhostbusters OBJ_id_smime_ct,35L + +#define SN_id_ct_resourceTaggedAttest "id-ct-resourceTaggedAttest" +#define NID_id_ct_resourceTaggedAttest 1004 +#define OBJ_id_ct_resourceTaggedAttest OBJ_id_smime_ct,36L + +#define SN_id_ct_geofeedCSVwithCRLF "id-ct-geofeedCSVwithCRLF" +#define NID_id_ct_geofeedCSVwithCRLF 1013 +#define OBJ_id_ct_geofeedCSVwithCRLF OBJ_id_smime_ct,47L + +#define SN_id_ct_signedChecklist "id-ct-signedChecklist" +#define NID_id_ct_signedChecklist 1014 +#define OBJ_id_ct_signedChecklist OBJ_id_smime_ct,48L + +#define SN_id_ct_ASPA "id-ct-ASPA" +#define NID_id_ct_ASPA 1017 +#define OBJ_id_ct_ASPA OBJ_id_smime_ct,49L + +#define SN_id_ct_signedTAL "id-ct-signedTAL" +#define NID_id_ct_signedTAL 1024 +#define OBJ_id_ct_signedTAL OBJ_id_smime_ct,50L + +#define SN_id_ct_rpkiSignedPrefixList "id-ct-rpkiSignedPrefixList" +#define NID_id_ct_rpkiSignedPrefixList 1054 +#define OBJ_id_ct_rpkiSignedPrefixList OBJ_id_smime_ct,51L + +#define SN_id_smime_aa_receiptRequest "id-smime-aa-receiptRequest" +#define NID_id_smime_aa_receiptRequest 212 +#define OBJ_id_smime_aa_receiptRequest OBJ_id_smime_aa,1L + +#define SN_id_smime_aa_securityLabel "id-smime-aa-securityLabel" +#define NID_id_smime_aa_securityLabel 213 +#define OBJ_id_smime_aa_securityLabel OBJ_id_smime_aa,2L + +#define SN_id_smime_aa_mlExpandHistory "id-smime-aa-mlExpandHistory" +#define NID_id_smime_aa_mlExpandHistory 214 +#define OBJ_id_smime_aa_mlExpandHistory OBJ_id_smime_aa,3L + +#define SN_id_smime_aa_contentHint "id-smime-aa-contentHint" +#define NID_id_smime_aa_contentHint 215 +#define OBJ_id_smime_aa_contentHint OBJ_id_smime_aa,4L + +#define SN_id_smime_aa_msgSigDigest "id-smime-aa-msgSigDigest" +#define NID_id_smime_aa_msgSigDigest 216 +#define OBJ_id_smime_aa_msgSigDigest OBJ_id_smime_aa,5L + +#define SN_id_smime_aa_encapContentType "id-smime-aa-encapContentType" +#define NID_id_smime_aa_encapContentType 217 +#define OBJ_id_smime_aa_encapContentType OBJ_id_smime_aa,6L + +#define SN_id_smime_aa_contentIdentifier "id-smime-aa-contentIdentifier" +#define NID_id_smime_aa_contentIdentifier 218 +#define OBJ_id_smime_aa_contentIdentifier OBJ_id_smime_aa,7L + +#define SN_id_smime_aa_macValue "id-smime-aa-macValue" +#define NID_id_smime_aa_macValue 219 +#define OBJ_id_smime_aa_macValue OBJ_id_smime_aa,8L + +#define SN_id_smime_aa_equivalentLabels "id-smime-aa-equivalentLabels" +#define NID_id_smime_aa_equivalentLabels 220 +#define OBJ_id_smime_aa_equivalentLabels OBJ_id_smime_aa,9L + +#define SN_id_smime_aa_contentReference "id-smime-aa-contentReference" +#define NID_id_smime_aa_contentReference 221 +#define OBJ_id_smime_aa_contentReference OBJ_id_smime_aa,10L + +#define SN_id_smime_aa_encrypKeyPref "id-smime-aa-encrypKeyPref" +#define NID_id_smime_aa_encrypKeyPref 222 +#define OBJ_id_smime_aa_encrypKeyPref OBJ_id_smime_aa,11L + +#define SN_id_smime_aa_signingCertificate "id-smime-aa-signingCertificate" +#define NID_id_smime_aa_signingCertificate 223 +#define OBJ_id_smime_aa_signingCertificate OBJ_id_smime_aa,12L + +#define SN_id_smime_aa_smimeEncryptCerts "id-smime-aa-smimeEncryptCerts" +#define NID_id_smime_aa_smimeEncryptCerts 224 +#define OBJ_id_smime_aa_smimeEncryptCerts OBJ_id_smime_aa,13L + +#define SN_id_smime_aa_timeStampToken "id-smime-aa-timeStampToken" +#define NID_id_smime_aa_timeStampToken 225 +#define OBJ_id_smime_aa_timeStampToken OBJ_id_smime_aa,14L + +#define SN_id_smime_aa_ets_sigPolicyId "id-smime-aa-ets-sigPolicyId" +#define NID_id_smime_aa_ets_sigPolicyId 226 +#define OBJ_id_smime_aa_ets_sigPolicyId OBJ_id_smime_aa,15L + +#define SN_id_smime_aa_ets_commitmentType "id-smime-aa-ets-commitmentType" +#define NID_id_smime_aa_ets_commitmentType 227 +#define OBJ_id_smime_aa_ets_commitmentType OBJ_id_smime_aa,16L + +#define SN_id_smime_aa_ets_signerLocation "id-smime-aa-ets-signerLocation" +#define NID_id_smime_aa_ets_signerLocation 228 +#define OBJ_id_smime_aa_ets_signerLocation OBJ_id_smime_aa,17L + +#define SN_id_smime_aa_ets_signerAttr "id-smime-aa-ets-signerAttr" +#define NID_id_smime_aa_ets_signerAttr 229 +#define OBJ_id_smime_aa_ets_signerAttr OBJ_id_smime_aa,18L + +#define SN_id_smime_aa_ets_otherSigCert "id-smime-aa-ets-otherSigCert" +#define NID_id_smime_aa_ets_otherSigCert 230 +#define OBJ_id_smime_aa_ets_otherSigCert OBJ_id_smime_aa,19L + +#define SN_id_smime_aa_ets_contentTimestamp "id-smime-aa-ets-contentTimestamp" +#define NID_id_smime_aa_ets_contentTimestamp 231 +#define OBJ_id_smime_aa_ets_contentTimestamp OBJ_id_smime_aa,20L + +#define SN_id_smime_aa_ets_CertificateRefs "id-smime-aa-ets-CertificateRefs" +#define NID_id_smime_aa_ets_CertificateRefs 232 +#define OBJ_id_smime_aa_ets_CertificateRefs OBJ_id_smime_aa,21L + +#define SN_id_smime_aa_ets_RevocationRefs "id-smime-aa-ets-RevocationRefs" +#define NID_id_smime_aa_ets_RevocationRefs 233 +#define OBJ_id_smime_aa_ets_RevocationRefs OBJ_id_smime_aa,22L + +#define SN_id_smime_aa_ets_certValues "id-smime-aa-ets-certValues" +#define NID_id_smime_aa_ets_certValues 234 +#define OBJ_id_smime_aa_ets_certValues OBJ_id_smime_aa,23L + +#define SN_id_smime_aa_ets_revocationValues "id-smime-aa-ets-revocationValues" +#define NID_id_smime_aa_ets_revocationValues 235 +#define OBJ_id_smime_aa_ets_revocationValues OBJ_id_smime_aa,24L + +#define SN_id_smime_aa_ets_escTimeStamp "id-smime-aa-ets-escTimeStamp" +#define NID_id_smime_aa_ets_escTimeStamp 236 +#define OBJ_id_smime_aa_ets_escTimeStamp OBJ_id_smime_aa,25L + +#define SN_id_smime_aa_ets_certCRLTimestamp "id-smime-aa-ets-certCRLTimestamp" +#define NID_id_smime_aa_ets_certCRLTimestamp 237 +#define OBJ_id_smime_aa_ets_certCRLTimestamp OBJ_id_smime_aa,26L + +#define SN_id_smime_aa_ets_archiveTimeStamp "id-smime-aa-ets-archiveTimeStamp" +#define NID_id_smime_aa_ets_archiveTimeStamp 238 +#define OBJ_id_smime_aa_ets_archiveTimeStamp OBJ_id_smime_aa,27L + +#define SN_id_smime_aa_signatureType "id-smime-aa-signatureType" +#define NID_id_smime_aa_signatureType 239 +#define OBJ_id_smime_aa_signatureType OBJ_id_smime_aa,28L + +#define SN_id_smime_aa_dvcs_dvc "id-smime-aa-dvcs-dvc" +#define NID_id_smime_aa_dvcs_dvc 240 +#define OBJ_id_smime_aa_dvcs_dvc OBJ_id_smime_aa,29L + +#define SN_id_smime_aa_signingCertificateV2 "id-smime-aa-signingCertificateV2" +#define NID_id_smime_aa_signingCertificateV2 1023 +#define OBJ_id_smime_aa_signingCertificateV2 OBJ_id_smime_aa,47L + +#define SN_id_smime_alg_ESDHwith3DES "id-smime-alg-ESDHwith3DES" +#define NID_id_smime_alg_ESDHwith3DES 241 +#define OBJ_id_smime_alg_ESDHwith3DES OBJ_id_smime_alg,1L + +#define SN_id_smime_alg_ESDHwithRC2 "id-smime-alg-ESDHwithRC2" +#define NID_id_smime_alg_ESDHwithRC2 242 +#define OBJ_id_smime_alg_ESDHwithRC2 OBJ_id_smime_alg,2L + +#define SN_id_smime_alg_3DESwrap "id-smime-alg-3DESwrap" +#define NID_id_smime_alg_3DESwrap 243 +#define OBJ_id_smime_alg_3DESwrap OBJ_id_smime_alg,3L + +#define SN_id_smime_alg_RC2wrap "id-smime-alg-RC2wrap" +#define NID_id_smime_alg_RC2wrap 244 +#define OBJ_id_smime_alg_RC2wrap OBJ_id_smime_alg,4L + +#define SN_id_smime_alg_ESDH "id-smime-alg-ESDH" +#define NID_id_smime_alg_ESDH 245 +#define OBJ_id_smime_alg_ESDH OBJ_id_smime_alg,5L + +#define SN_id_smime_alg_CMS3DESwrap "id-smime-alg-CMS3DESwrap" +#define NID_id_smime_alg_CMS3DESwrap 246 +#define OBJ_id_smime_alg_CMS3DESwrap OBJ_id_smime_alg,6L + +#define SN_id_smime_alg_CMSRC2wrap "id-smime-alg-CMSRC2wrap" +#define NID_id_smime_alg_CMSRC2wrap 247 +#define OBJ_id_smime_alg_CMSRC2wrap OBJ_id_smime_alg,7L + +#define SN_id_alg_PWRI_KEK "id-alg-PWRI-KEK" +#define NID_id_alg_PWRI_KEK 893 +#define OBJ_id_alg_PWRI_KEK OBJ_id_smime_alg,9L + +#define SN_id_smime_cd_ldap "id-smime-cd-ldap" +#define NID_id_smime_cd_ldap 248 +#define OBJ_id_smime_cd_ldap OBJ_id_smime_cd,1L + +#define SN_id_smime_spq_ets_sqt_uri "id-smime-spq-ets-sqt-uri" +#define NID_id_smime_spq_ets_sqt_uri 249 +#define OBJ_id_smime_spq_ets_sqt_uri OBJ_id_smime_spq,1L + +#define SN_id_smime_spq_ets_sqt_unotice "id-smime-spq-ets-sqt-unotice" +#define NID_id_smime_spq_ets_sqt_unotice 250 +#define OBJ_id_smime_spq_ets_sqt_unotice OBJ_id_smime_spq,2L + +#define SN_id_smime_cti_ets_proofOfOrigin "id-smime-cti-ets-proofOfOrigin" +#define NID_id_smime_cti_ets_proofOfOrigin 251 +#define OBJ_id_smime_cti_ets_proofOfOrigin OBJ_id_smime_cti,1L + +#define SN_id_smime_cti_ets_proofOfReceipt "id-smime-cti-ets-proofOfReceipt" +#define NID_id_smime_cti_ets_proofOfReceipt 252 +#define OBJ_id_smime_cti_ets_proofOfReceipt OBJ_id_smime_cti,2L + +#define SN_id_smime_cti_ets_proofOfDelivery "id-smime-cti-ets-proofOfDelivery" +#define NID_id_smime_cti_ets_proofOfDelivery 253 +#define OBJ_id_smime_cti_ets_proofOfDelivery OBJ_id_smime_cti,3L + +#define SN_id_smime_cti_ets_proofOfSender "id-smime-cti-ets-proofOfSender" +#define NID_id_smime_cti_ets_proofOfSender 254 +#define OBJ_id_smime_cti_ets_proofOfSender OBJ_id_smime_cti,4L + +#define SN_id_smime_cti_ets_proofOfApproval "id-smime-cti-ets-proofOfApproval" +#define NID_id_smime_cti_ets_proofOfApproval 255 +#define OBJ_id_smime_cti_ets_proofOfApproval OBJ_id_smime_cti,5L + +#define SN_id_smime_cti_ets_proofOfCreation "id-smime-cti-ets-proofOfCreation" +#define NID_id_smime_cti_ets_proofOfCreation 256 +#define OBJ_id_smime_cti_ets_proofOfCreation OBJ_id_smime_cti,6L + +#define LN_friendlyName "friendlyName" +#define NID_friendlyName 156 +#define OBJ_friendlyName OBJ_pkcs9,20L + +#define LN_localKeyID "localKeyID" +#define NID_localKeyID 157 +#define OBJ_localKeyID OBJ_pkcs9,21L + +#define SN_ms_csp_name "CSPName" +#define LN_ms_csp_name "Microsoft CSP Name" +#define NID_ms_csp_name 417 +#define OBJ_ms_csp_name 1L,3L,6L,1L,4L,1L,311L,17L,1L + +#define SN_LocalKeySet "LocalKeySet" +#define LN_LocalKeySet "Microsoft Local Key set" +#define NID_LocalKeySet 856 +#define OBJ_LocalKeySet 1L,3L,6L,1L,4L,1L,311L,17L,2L + +#define OBJ_certTypes OBJ_pkcs9,22L + +#define LN_x509Certificate "x509Certificate" +#define NID_x509Certificate 158 +#define OBJ_x509Certificate OBJ_certTypes,1L + +#define LN_sdsiCertificate "sdsiCertificate" +#define NID_sdsiCertificate 159 +#define OBJ_sdsiCertificate OBJ_certTypes,2L + +#define OBJ_crlTypes OBJ_pkcs9,23L + +#define LN_x509Crl "x509Crl" +#define NID_x509Crl 160 +#define OBJ_x509Crl OBJ_crlTypes,1L + +#define OBJ_pkcs12 OBJ_pkcs,12L + +#define OBJ_pkcs12_pbeids OBJ_pkcs12,1L + +#define SN_pbe_WithSHA1And128BitRC4 "PBE-SHA1-RC4-128" +#define LN_pbe_WithSHA1And128BitRC4 "pbeWithSHA1And128BitRC4" +#define NID_pbe_WithSHA1And128BitRC4 144 +#define OBJ_pbe_WithSHA1And128BitRC4 OBJ_pkcs12_pbeids,1L + +#define SN_pbe_WithSHA1And40BitRC4 "PBE-SHA1-RC4-40" +#define LN_pbe_WithSHA1And40BitRC4 "pbeWithSHA1And40BitRC4" +#define NID_pbe_WithSHA1And40BitRC4 145 +#define OBJ_pbe_WithSHA1And40BitRC4 OBJ_pkcs12_pbeids,2L + +#define SN_pbe_WithSHA1And3_Key_TripleDES_CBC "PBE-SHA1-3DES" +#define LN_pbe_WithSHA1And3_Key_TripleDES_CBC "pbeWithSHA1And3-KeyTripleDES-CBC" +#define NID_pbe_WithSHA1And3_Key_TripleDES_CBC 146 +#define OBJ_pbe_WithSHA1And3_Key_TripleDES_CBC OBJ_pkcs12_pbeids,3L + +#define SN_pbe_WithSHA1And2_Key_TripleDES_CBC "PBE-SHA1-2DES" +#define LN_pbe_WithSHA1And2_Key_TripleDES_CBC "pbeWithSHA1And2-KeyTripleDES-CBC" +#define NID_pbe_WithSHA1And2_Key_TripleDES_CBC 147 +#define OBJ_pbe_WithSHA1And2_Key_TripleDES_CBC OBJ_pkcs12_pbeids,4L + +#define SN_pbe_WithSHA1And128BitRC2_CBC "PBE-SHA1-RC2-128" +#define LN_pbe_WithSHA1And128BitRC2_CBC "pbeWithSHA1And128BitRC2-CBC" +#define NID_pbe_WithSHA1And128BitRC2_CBC 148 +#define OBJ_pbe_WithSHA1And128BitRC2_CBC OBJ_pkcs12_pbeids,5L + +#define SN_pbe_WithSHA1And40BitRC2_CBC "PBE-SHA1-RC2-40" +#define LN_pbe_WithSHA1And40BitRC2_CBC "pbeWithSHA1And40BitRC2-CBC" +#define NID_pbe_WithSHA1And40BitRC2_CBC 149 +#define OBJ_pbe_WithSHA1And40BitRC2_CBC OBJ_pkcs12_pbeids,6L + +#define OBJ_pkcs12_Version1 OBJ_pkcs12,10L + +#define OBJ_pkcs12_BagIds OBJ_pkcs12_Version1,1L + +#define LN_keyBag "keyBag" +#define NID_keyBag 150 +#define OBJ_keyBag OBJ_pkcs12_BagIds,1L + +#define LN_pkcs8ShroudedKeyBag "pkcs8ShroudedKeyBag" +#define NID_pkcs8ShroudedKeyBag 151 +#define OBJ_pkcs8ShroudedKeyBag OBJ_pkcs12_BagIds,2L + +#define LN_certBag "certBag" +#define NID_certBag 152 +#define OBJ_certBag OBJ_pkcs12_BagIds,3L + +#define LN_crlBag "crlBag" +#define NID_crlBag 153 +#define OBJ_crlBag OBJ_pkcs12_BagIds,4L + +#define LN_secretBag "secretBag" +#define NID_secretBag 154 +#define OBJ_secretBag OBJ_pkcs12_BagIds,5L + +#define LN_safeContentsBag "safeContentsBag" +#define NID_safeContentsBag 155 +#define OBJ_safeContentsBag OBJ_pkcs12_BagIds,6L + +#define SN_md2 "MD2" +#define LN_md2 "md2" +#define NID_md2 3 +#define OBJ_md2 OBJ_rsadsi,2L,2L + +#define SN_md4 "MD4" +#define LN_md4 "md4" +#define NID_md4 257 +#define OBJ_md4 OBJ_rsadsi,2L,4L + +#define SN_md5 "MD5" +#define LN_md5 "md5" +#define NID_md5 4 +#define OBJ_md5 OBJ_rsadsi,2L,5L + +#define SN_md5_sha1 "MD5-SHA1" +#define LN_md5_sha1 "md5-sha1" +#define NID_md5_sha1 114 + +#define LN_hmacWithMD5 "hmacWithMD5" +#define NID_hmacWithMD5 797 +#define OBJ_hmacWithMD5 OBJ_rsadsi,2L,6L + +#define LN_hmacWithSHA1 "hmacWithSHA1" +#define NID_hmacWithSHA1 163 +#define OBJ_hmacWithSHA1 OBJ_rsadsi,2L,7L + +#define LN_hmacWithSHA224 "hmacWithSHA224" +#define NID_hmacWithSHA224 798 +#define OBJ_hmacWithSHA224 OBJ_rsadsi,2L,8L + +#define LN_hmacWithSHA256 "hmacWithSHA256" +#define NID_hmacWithSHA256 799 +#define OBJ_hmacWithSHA256 OBJ_rsadsi,2L,9L + +#define LN_hmacWithSHA384 "hmacWithSHA384" +#define NID_hmacWithSHA384 800 +#define OBJ_hmacWithSHA384 OBJ_rsadsi,2L,10L + +#define LN_hmacWithSHA512 "hmacWithSHA512" +#define NID_hmacWithSHA512 801 +#define OBJ_hmacWithSHA512 OBJ_rsadsi,2L,11L + +#define LN_hmacWithSHA512_224 "hmacWithSHA512-224" +#define NID_hmacWithSHA512_224 1027 +#define OBJ_hmacWithSHA512_224 OBJ_rsadsi,2L,12L + +#define LN_hmacWithSHA512_256 "hmacWithSHA512-256" +#define NID_hmacWithSHA512_256 1028 +#define OBJ_hmacWithSHA512_256 OBJ_rsadsi,2L,13L + +#define SN_rc2_cbc "RC2-CBC" +#define LN_rc2_cbc "rc2-cbc" +#define NID_rc2_cbc 37 +#define OBJ_rc2_cbc OBJ_rsadsi,3L,2L + +#define SN_rc2_ecb "RC2-ECB" +#define LN_rc2_ecb "rc2-ecb" +#define NID_rc2_ecb 38 + +#define SN_rc2_cfb64 "RC2-CFB" +#define LN_rc2_cfb64 "rc2-cfb" +#define NID_rc2_cfb64 39 + +#define SN_rc2_ofb64 "RC2-OFB" +#define LN_rc2_ofb64 "rc2-ofb" +#define NID_rc2_ofb64 40 + +#define SN_rc2_40_cbc "RC2-40-CBC" +#define LN_rc2_40_cbc "rc2-40-cbc" +#define NID_rc2_40_cbc 98 + +#define SN_rc2_64_cbc "RC2-64-CBC" +#define LN_rc2_64_cbc "rc2-64-cbc" +#define NID_rc2_64_cbc 166 + +#define SN_rc4 "RC4" +#define LN_rc4 "rc4" +#define NID_rc4 5 +#define OBJ_rc4 OBJ_rsadsi,3L,4L + +#define SN_rc4_40 "RC4-40" +#define LN_rc4_40 "rc4-40" +#define NID_rc4_40 97 + +#define SN_des_ede3_cbc "DES-EDE3-CBC" +#define LN_des_ede3_cbc "des-ede3-cbc" +#define NID_des_ede3_cbc 44 +#define OBJ_des_ede3_cbc OBJ_rsadsi,3L,7L + +#define SN_rc5_cbc "RC5-CBC" +#define LN_rc5_cbc "rc5-cbc" +#define NID_rc5_cbc 120 +#define OBJ_rc5_cbc OBJ_rsadsi,3L,8L + +#define SN_rc5_ecb "RC5-ECB" +#define LN_rc5_ecb "rc5-ecb" +#define NID_rc5_ecb 121 + +#define SN_rc5_cfb64 "RC5-CFB" +#define LN_rc5_cfb64 "rc5-cfb" +#define NID_rc5_cfb64 122 + +#define SN_rc5_ofb64 "RC5-OFB" +#define LN_rc5_ofb64 "rc5-ofb" +#define NID_rc5_ofb64 123 + +#define SN_ms_ext_req "msExtReq" +#define LN_ms_ext_req "Microsoft Extension Request" +#define NID_ms_ext_req 171 +#define OBJ_ms_ext_req 1L,3L,6L,1L,4L,1L,311L,2L,1L,14L + +#define SN_ms_code_ind "msCodeInd" +#define LN_ms_code_ind "Microsoft Individual Code Signing" +#define NID_ms_code_ind 134 +#define OBJ_ms_code_ind 1L,3L,6L,1L,4L,1L,311L,2L,1L,21L + +#define SN_ms_code_com "msCodeCom" +#define LN_ms_code_com "Microsoft Commercial Code Signing" +#define NID_ms_code_com 135 +#define OBJ_ms_code_com 1L,3L,6L,1L,4L,1L,311L,2L,1L,22L + +#define SN_ms_ctl_sign "msCTLSign" +#define LN_ms_ctl_sign "Microsoft Trust List Signing" +#define NID_ms_ctl_sign 136 +#define OBJ_ms_ctl_sign 1L,3L,6L,1L,4L,1L,311L,10L,3L,1L + +#define SN_ms_sgc "msSGC" +#define LN_ms_sgc "Microsoft Server Gated Crypto" +#define NID_ms_sgc 137 +#define OBJ_ms_sgc 1L,3L,6L,1L,4L,1L,311L,10L,3L,3L + +#define SN_ms_efs "msEFS" +#define LN_ms_efs "Microsoft Encrypted File System" +#define NID_ms_efs 138 +#define OBJ_ms_efs 1L,3L,6L,1L,4L,1L,311L,10L,3L,4L + +#define SN_ms_smartcard_login "msSmartcardLogin" +#define LN_ms_smartcard_login "Microsoft Smartcardlogin" +#define NID_ms_smartcard_login 648 +#define OBJ_ms_smartcard_login 1L,3L,6L,1L,4L,1L,311L,20L,2L,2L + +#define SN_ms_upn "msUPN" +#define LN_ms_upn "Microsoft Universal Principal Name" +#define NID_ms_upn 649 +#define OBJ_ms_upn 1L,3L,6L,1L,4L,1L,311L,20L,2L,3L + +#define SN_idea_cbc "IDEA-CBC" +#define LN_idea_cbc "idea-cbc" +#define NID_idea_cbc 34 +#define OBJ_idea_cbc 1L,3L,6L,1L,4L,1L,188L,7L,1L,1L,2L + +#define SN_idea_ecb "IDEA-ECB" +#define LN_idea_ecb "idea-ecb" +#define NID_idea_ecb 36 + +#define SN_idea_cfb64 "IDEA-CFB" +#define LN_idea_cfb64 "idea-cfb" +#define NID_idea_cfb64 35 + +#define SN_idea_ofb64 "IDEA-OFB" +#define LN_idea_ofb64 "idea-ofb" +#define NID_idea_ofb64 46 + +#define SN_bf_cbc "BF-CBC" +#define LN_bf_cbc "bf-cbc" +#define NID_bf_cbc 91 +#define OBJ_bf_cbc 1L,3L,6L,1L,4L,1L,3029L,1L,2L + +#define SN_bf_ecb "BF-ECB" +#define LN_bf_ecb "bf-ecb" +#define NID_bf_ecb 92 + +#define SN_bf_cfb64 "BF-CFB" +#define LN_bf_cfb64 "bf-cfb" +#define NID_bf_cfb64 93 + +#define SN_bf_ofb64 "BF-OFB" +#define LN_bf_ofb64 "bf-ofb" +#define NID_bf_ofb64 94 + +#define SN_id_pkix "PKIX" +#define NID_id_pkix 127 +#define OBJ_id_pkix 1L,3L,6L,1L,5L,5L,7L + +#define SN_id_pkix_mod "id-pkix-mod" +#define NID_id_pkix_mod 258 +#define OBJ_id_pkix_mod OBJ_id_pkix,0L + +#define SN_id_pe "id-pe" +#define NID_id_pe 175 +#define OBJ_id_pe OBJ_id_pkix,1L + +#define SN_id_qt "id-qt" +#define NID_id_qt 259 +#define OBJ_id_qt OBJ_id_pkix,2L + +#define SN_id_kp "id-kp" +#define NID_id_kp 128 +#define OBJ_id_kp OBJ_id_pkix,3L + +#define SN_id_it "id-it" +#define NID_id_it 260 +#define OBJ_id_it OBJ_id_pkix,4L + +#define SN_id_pkip "id-pkip" +#define NID_id_pkip 261 +#define OBJ_id_pkip OBJ_id_pkix,5L + +#define SN_id_alg "id-alg" +#define NID_id_alg 262 +#define OBJ_id_alg OBJ_id_pkix,6L + +#define SN_id_cmc "id-cmc" +#define NID_id_cmc 263 +#define OBJ_id_cmc OBJ_id_pkix,7L + +#define SN_id_on "id-on" +#define NID_id_on 264 +#define OBJ_id_on OBJ_id_pkix,8L + +#define SN_id_pda "id-pda" +#define NID_id_pda 265 +#define OBJ_id_pda OBJ_id_pkix,9L + +#define SN_id_aca "id-aca" +#define NID_id_aca 266 +#define OBJ_id_aca OBJ_id_pkix,10L + +#define SN_id_qcs "id-qcs" +#define NID_id_qcs 267 +#define OBJ_id_qcs OBJ_id_pkix,11L + +#define SN_id_cct "id-cct" +#define NID_id_cct 268 +#define OBJ_id_cct OBJ_id_pkix,12L + +#define SN_id_cp "id-cp" +#define NID_id_cp 1005 +#define OBJ_id_cp OBJ_id_pkix,14L + +#define SN_id_ppl "id-ppl" +#define NID_id_ppl 662 +#define OBJ_id_ppl OBJ_id_pkix,21L + +#define SN_id_ad "id-ad" +#define NID_id_ad 176 +#define OBJ_id_ad OBJ_id_pkix,48L + +#define SN_id_pkix1_explicit_88 "id-pkix1-explicit-88" +#define NID_id_pkix1_explicit_88 269 +#define OBJ_id_pkix1_explicit_88 OBJ_id_pkix_mod,1L + +#define SN_id_pkix1_implicit_88 "id-pkix1-implicit-88" +#define NID_id_pkix1_implicit_88 270 +#define OBJ_id_pkix1_implicit_88 OBJ_id_pkix_mod,2L + +#define SN_id_pkix1_explicit_93 "id-pkix1-explicit-93" +#define NID_id_pkix1_explicit_93 271 +#define OBJ_id_pkix1_explicit_93 OBJ_id_pkix_mod,3L + +#define SN_id_pkix1_implicit_93 "id-pkix1-implicit-93" +#define NID_id_pkix1_implicit_93 272 +#define OBJ_id_pkix1_implicit_93 OBJ_id_pkix_mod,4L + +#define SN_id_mod_crmf "id-mod-crmf" +#define NID_id_mod_crmf 273 +#define OBJ_id_mod_crmf OBJ_id_pkix_mod,5L + +#define SN_id_mod_cmc "id-mod-cmc" +#define NID_id_mod_cmc 274 +#define OBJ_id_mod_cmc OBJ_id_pkix_mod,6L + +#define SN_id_mod_kea_profile_88 "id-mod-kea-profile-88" +#define NID_id_mod_kea_profile_88 275 +#define OBJ_id_mod_kea_profile_88 OBJ_id_pkix_mod,7L + +#define SN_id_mod_kea_profile_93 "id-mod-kea-profile-93" +#define NID_id_mod_kea_profile_93 276 +#define OBJ_id_mod_kea_profile_93 OBJ_id_pkix_mod,8L + +#define SN_id_mod_cmp "id-mod-cmp" +#define NID_id_mod_cmp 277 +#define OBJ_id_mod_cmp OBJ_id_pkix_mod,9L + +#define SN_id_mod_qualified_cert_88 "id-mod-qualified-cert-88" +#define NID_id_mod_qualified_cert_88 278 +#define OBJ_id_mod_qualified_cert_88 OBJ_id_pkix_mod,10L + +#define SN_id_mod_qualified_cert_93 "id-mod-qualified-cert-93" +#define NID_id_mod_qualified_cert_93 279 +#define OBJ_id_mod_qualified_cert_93 OBJ_id_pkix_mod,11L + +#define SN_id_mod_attribute_cert "id-mod-attribute-cert" +#define NID_id_mod_attribute_cert 280 +#define OBJ_id_mod_attribute_cert OBJ_id_pkix_mod,12L + +#define SN_id_mod_timestamp_protocol "id-mod-timestamp-protocol" +#define NID_id_mod_timestamp_protocol 281 +#define OBJ_id_mod_timestamp_protocol OBJ_id_pkix_mod,13L + +#define SN_id_mod_ocsp "id-mod-ocsp" +#define NID_id_mod_ocsp 282 +#define OBJ_id_mod_ocsp OBJ_id_pkix_mod,14L + +#define SN_id_mod_dvcs "id-mod-dvcs" +#define NID_id_mod_dvcs 283 +#define OBJ_id_mod_dvcs OBJ_id_pkix_mod,15L + +#define SN_id_mod_cmp2000 "id-mod-cmp2000" +#define NID_id_mod_cmp2000 284 +#define OBJ_id_mod_cmp2000 OBJ_id_pkix_mod,16L + +#define SN_info_access "authorityInfoAccess" +#define LN_info_access "Authority Information Access" +#define NID_info_access 177 +#define OBJ_info_access OBJ_id_pe,1L + +#define SN_biometricInfo "biometricInfo" +#define LN_biometricInfo "Biometric Info" +#define NID_biometricInfo 285 +#define OBJ_biometricInfo OBJ_id_pe,2L + +#define SN_qcStatements "qcStatements" +#define NID_qcStatements 286 +#define OBJ_qcStatements OBJ_id_pe,3L + +#define SN_ac_auditEntity "ac-auditEntity" +#define NID_ac_auditEntity 287 +#define OBJ_ac_auditEntity OBJ_id_pe,4L + +#define SN_ac_targeting "ac-targeting" +#define NID_ac_targeting 288 +#define OBJ_ac_targeting OBJ_id_pe,5L + +#define SN_aaControls "aaControls" +#define NID_aaControls 289 +#define OBJ_aaControls OBJ_id_pe,6L + +#define SN_sbgp_ipAddrBlock "sbgp-ipAddrBlock" +#define NID_sbgp_ipAddrBlock 290 +#define OBJ_sbgp_ipAddrBlock OBJ_id_pe,7L + +#define SN_sbgp_autonomousSysNum "sbgp-autonomousSysNum" +#define NID_sbgp_autonomousSysNum 291 +#define OBJ_sbgp_autonomousSysNum OBJ_id_pe,8L + +#define SN_sbgp_routerIdentifier "sbgp-routerIdentifier" +#define NID_sbgp_routerIdentifier 292 +#define OBJ_sbgp_routerIdentifier OBJ_id_pe,9L + +#define SN_ac_proxying "ac-proxying" +#define NID_ac_proxying 397 +#define OBJ_ac_proxying OBJ_id_pe,10L + +#define SN_sinfo_access "subjectInfoAccess" +#define LN_sinfo_access "Subject Information Access" +#define NID_sinfo_access 398 +#define OBJ_sinfo_access OBJ_id_pe,11L + +#define SN_proxyCertInfo "proxyCertInfo" +#define LN_proxyCertInfo "Proxy Certificate Information" +#define NID_proxyCertInfo 663 +#define OBJ_proxyCertInfo OBJ_id_pe,14L + +#define SN_tlsfeature "tlsfeature" +#define LN_tlsfeature "TLS Feature" +#define NID_tlsfeature 1016 +#define OBJ_tlsfeature OBJ_id_pe,24L + +#define SN_sbgp_ipAddrBlockv2 "sbgp-ipAddrBlockv2" +#define NID_sbgp_ipAddrBlockv2 1006 +#define OBJ_sbgp_ipAddrBlockv2 OBJ_id_pe,28L + +#define SN_sbgp_autonomousSysNumv2 "sbgp-autonomousSysNumv2" +#define NID_sbgp_autonomousSysNumv2 1007 +#define OBJ_sbgp_autonomousSysNumv2 OBJ_id_pe,29L + +#define SN_acmeIdentifier "acmeIdentifier" +#define LN_acmeIdentifier "ACME Identifier" +#define NID_acmeIdentifier 1053 +#define OBJ_acmeIdentifier OBJ_id_pe,31L + +#define SN_id_qt_cps "id-qt-cps" +#define LN_id_qt_cps "Policy Qualifier CPS" +#define NID_id_qt_cps 164 +#define OBJ_id_qt_cps OBJ_id_qt,1L + +#define SN_id_qt_unotice "id-qt-unotice" +#define LN_id_qt_unotice "Policy Qualifier User Notice" +#define NID_id_qt_unotice 165 +#define OBJ_id_qt_unotice OBJ_id_qt,2L + +#define SN_textNotice "textNotice" +#define NID_textNotice 293 +#define OBJ_textNotice OBJ_id_qt,3L + +#define SN_server_auth "serverAuth" +#define LN_server_auth "TLS Web Server Authentication" +#define NID_server_auth 129 +#define OBJ_server_auth OBJ_id_kp,1L + +#define SN_client_auth "clientAuth" +#define LN_client_auth "TLS Web Client Authentication" +#define NID_client_auth 130 +#define OBJ_client_auth OBJ_id_kp,2L + +#define SN_code_sign "codeSigning" +#define LN_code_sign "Code Signing" +#define NID_code_sign 131 +#define OBJ_code_sign OBJ_id_kp,3L + +#define SN_email_protect "emailProtection" +#define LN_email_protect "E-mail Protection" +#define NID_email_protect 132 +#define OBJ_email_protect OBJ_id_kp,4L + +#define SN_ipsecEndSystem "ipsecEndSystem" +#define LN_ipsecEndSystem "IPSec End System" +#define NID_ipsecEndSystem 294 +#define OBJ_ipsecEndSystem OBJ_id_kp,5L + +#define SN_ipsecTunnel "ipsecTunnel" +#define LN_ipsecTunnel "IPSec Tunnel" +#define NID_ipsecTunnel 295 +#define OBJ_ipsecTunnel OBJ_id_kp,6L + +#define SN_ipsecUser "ipsecUser" +#define LN_ipsecUser "IPSec User" +#define NID_ipsecUser 296 +#define OBJ_ipsecUser OBJ_id_kp,7L + +#define SN_time_stamp "timeStamping" +#define LN_time_stamp "Time Stamping" +#define NID_time_stamp 133 +#define OBJ_time_stamp OBJ_id_kp,8L + +#define SN_OCSP_sign "OCSPSigning" +#define LN_OCSP_sign "OCSP Signing" +#define NID_OCSP_sign 180 +#define OBJ_OCSP_sign OBJ_id_kp,9L + +#define SN_dvcs "DVCS" +#define LN_dvcs "dvcs" +#define NID_dvcs 297 +#define OBJ_dvcs OBJ_id_kp,10L + +#define SN_id_kp_bgpsec_router "id-kp-bgpsec-router" +#define LN_id_kp_bgpsec_router "BGPsec Router" +#define NID_id_kp_bgpsec_router 1015 +#define OBJ_id_kp_bgpsec_router OBJ_id_kp,30L + +#define SN_id_it_caProtEncCert "id-it-caProtEncCert" +#define NID_id_it_caProtEncCert 298 +#define OBJ_id_it_caProtEncCert OBJ_id_it,1L + +#define SN_id_it_signKeyPairTypes "id-it-signKeyPairTypes" +#define NID_id_it_signKeyPairTypes 299 +#define OBJ_id_it_signKeyPairTypes OBJ_id_it,2L + +#define SN_id_it_encKeyPairTypes "id-it-encKeyPairTypes" +#define NID_id_it_encKeyPairTypes 300 +#define OBJ_id_it_encKeyPairTypes OBJ_id_it,3L + +#define SN_id_it_preferredSymmAlg "id-it-preferredSymmAlg" +#define NID_id_it_preferredSymmAlg 301 +#define OBJ_id_it_preferredSymmAlg OBJ_id_it,4L + +#define SN_id_it_caKeyUpdateInfo "id-it-caKeyUpdateInfo" +#define NID_id_it_caKeyUpdateInfo 302 +#define OBJ_id_it_caKeyUpdateInfo OBJ_id_it,5L + +#define SN_id_it_currentCRL "id-it-currentCRL" +#define NID_id_it_currentCRL 303 +#define OBJ_id_it_currentCRL OBJ_id_it,6L + +#define SN_id_it_unsupportedOIDs "id-it-unsupportedOIDs" +#define NID_id_it_unsupportedOIDs 304 +#define OBJ_id_it_unsupportedOIDs OBJ_id_it,7L + +#define SN_id_it_subscriptionRequest "id-it-subscriptionRequest" +#define NID_id_it_subscriptionRequest 305 +#define OBJ_id_it_subscriptionRequest OBJ_id_it,8L + +#define SN_id_it_subscriptionResponse "id-it-subscriptionResponse" +#define NID_id_it_subscriptionResponse 306 +#define OBJ_id_it_subscriptionResponse OBJ_id_it,9L + +#define SN_id_it_keyPairParamReq "id-it-keyPairParamReq" +#define NID_id_it_keyPairParamReq 307 +#define OBJ_id_it_keyPairParamReq OBJ_id_it,10L + +#define SN_id_it_keyPairParamRep "id-it-keyPairParamRep" +#define NID_id_it_keyPairParamRep 308 +#define OBJ_id_it_keyPairParamRep OBJ_id_it,11L + +#define SN_id_it_revPassphrase "id-it-revPassphrase" +#define NID_id_it_revPassphrase 309 +#define OBJ_id_it_revPassphrase OBJ_id_it,12L + +#define SN_id_it_implicitConfirm "id-it-implicitConfirm" +#define NID_id_it_implicitConfirm 310 +#define OBJ_id_it_implicitConfirm OBJ_id_it,13L + +#define SN_id_it_confirmWaitTime "id-it-confirmWaitTime" +#define NID_id_it_confirmWaitTime 311 +#define OBJ_id_it_confirmWaitTime OBJ_id_it,14L + +#define SN_id_it_origPKIMessage "id-it-origPKIMessage" +#define NID_id_it_origPKIMessage 312 +#define OBJ_id_it_origPKIMessage OBJ_id_it,15L + +#define SN_id_it_suppLangTags "id-it-suppLangTags" +#define NID_id_it_suppLangTags 784 +#define OBJ_id_it_suppLangTags OBJ_id_it,16L + +#define SN_id_regCtrl "id-regCtrl" +#define NID_id_regCtrl 313 +#define OBJ_id_regCtrl OBJ_id_pkip,1L + +#define SN_id_regInfo "id-regInfo" +#define NID_id_regInfo 314 +#define OBJ_id_regInfo OBJ_id_pkip,2L + +#define SN_id_regCtrl_regToken "id-regCtrl-regToken" +#define NID_id_regCtrl_regToken 315 +#define OBJ_id_regCtrl_regToken OBJ_id_regCtrl,1L + +#define SN_id_regCtrl_authenticator "id-regCtrl-authenticator" +#define NID_id_regCtrl_authenticator 316 +#define OBJ_id_regCtrl_authenticator OBJ_id_regCtrl,2L + +#define SN_id_regCtrl_pkiPublicationInfo "id-regCtrl-pkiPublicationInfo" +#define NID_id_regCtrl_pkiPublicationInfo 317 +#define OBJ_id_regCtrl_pkiPublicationInfo OBJ_id_regCtrl,3L + +#define SN_id_regCtrl_pkiArchiveOptions "id-regCtrl-pkiArchiveOptions" +#define NID_id_regCtrl_pkiArchiveOptions 318 +#define OBJ_id_regCtrl_pkiArchiveOptions OBJ_id_regCtrl,4L + +#define SN_id_regCtrl_oldCertID "id-regCtrl-oldCertID" +#define NID_id_regCtrl_oldCertID 319 +#define OBJ_id_regCtrl_oldCertID OBJ_id_regCtrl,5L + +#define SN_id_regCtrl_protocolEncrKey "id-regCtrl-protocolEncrKey" +#define NID_id_regCtrl_protocolEncrKey 320 +#define OBJ_id_regCtrl_protocolEncrKey OBJ_id_regCtrl,6L + +#define SN_id_regInfo_utf8Pairs "id-regInfo-utf8Pairs" +#define NID_id_regInfo_utf8Pairs 321 +#define OBJ_id_regInfo_utf8Pairs OBJ_id_regInfo,1L + +#define SN_id_regInfo_certReq "id-regInfo-certReq" +#define NID_id_regInfo_certReq 322 +#define OBJ_id_regInfo_certReq OBJ_id_regInfo,2L + +#define SN_id_alg_des40 "id-alg-des40" +#define NID_id_alg_des40 323 +#define OBJ_id_alg_des40 OBJ_id_alg,1L + +#define SN_id_alg_noSignature "id-alg-noSignature" +#define NID_id_alg_noSignature 324 +#define OBJ_id_alg_noSignature OBJ_id_alg,2L + +#define SN_id_alg_dh_sig_hmac_sha1 "id-alg-dh-sig-hmac-sha1" +#define NID_id_alg_dh_sig_hmac_sha1 325 +#define OBJ_id_alg_dh_sig_hmac_sha1 OBJ_id_alg,3L + +#define SN_id_alg_dh_pop "id-alg-dh-pop" +#define NID_id_alg_dh_pop 326 +#define OBJ_id_alg_dh_pop OBJ_id_alg,4L + +#define SN_id_cmc_statusInfo "id-cmc-statusInfo" +#define NID_id_cmc_statusInfo 327 +#define OBJ_id_cmc_statusInfo OBJ_id_cmc,1L + +#define SN_id_cmc_identification "id-cmc-identification" +#define NID_id_cmc_identification 328 +#define OBJ_id_cmc_identification OBJ_id_cmc,2L + +#define SN_id_cmc_identityProof "id-cmc-identityProof" +#define NID_id_cmc_identityProof 329 +#define OBJ_id_cmc_identityProof OBJ_id_cmc,3L + +#define SN_id_cmc_dataReturn "id-cmc-dataReturn" +#define NID_id_cmc_dataReturn 330 +#define OBJ_id_cmc_dataReturn OBJ_id_cmc,4L + +#define SN_id_cmc_transactionId "id-cmc-transactionId" +#define NID_id_cmc_transactionId 331 +#define OBJ_id_cmc_transactionId OBJ_id_cmc,5L + +#define SN_id_cmc_senderNonce "id-cmc-senderNonce" +#define NID_id_cmc_senderNonce 332 +#define OBJ_id_cmc_senderNonce OBJ_id_cmc,6L + +#define SN_id_cmc_recipientNonce "id-cmc-recipientNonce" +#define NID_id_cmc_recipientNonce 333 +#define OBJ_id_cmc_recipientNonce OBJ_id_cmc,7L + +#define SN_id_cmc_addExtensions "id-cmc-addExtensions" +#define NID_id_cmc_addExtensions 334 +#define OBJ_id_cmc_addExtensions OBJ_id_cmc,8L + +#define SN_id_cmc_encryptedPOP "id-cmc-encryptedPOP" +#define NID_id_cmc_encryptedPOP 335 +#define OBJ_id_cmc_encryptedPOP OBJ_id_cmc,9L + +#define SN_id_cmc_decryptedPOP "id-cmc-decryptedPOP" +#define NID_id_cmc_decryptedPOP 336 +#define OBJ_id_cmc_decryptedPOP OBJ_id_cmc,10L + +#define SN_id_cmc_lraPOPWitness "id-cmc-lraPOPWitness" +#define NID_id_cmc_lraPOPWitness 337 +#define OBJ_id_cmc_lraPOPWitness OBJ_id_cmc,11L + +#define SN_id_cmc_getCert "id-cmc-getCert" +#define NID_id_cmc_getCert 338 +#define OBJ_id_cmc_getCert OBJ_id_cmc,15L + +#define SN_id_cmc_getCRL "id-cmc-getCRL" +#define NID_id_cmc_getCRL 339 +#define OBJ_id_cmc_getCRL OBJ_id_cmc,16L + +#define SN_id_cmc_revokeRequest "id-cmc-revokeRequest" +#define NID_id_cmc_revokeRequest 340 +#define OBJ_id_cmc_revokeRequest OBJ_id_cmc,17L + +#define SN_id_cmc_regInfo "id-cmc-regInfo" +#define NID_id_cmc_regInfo 341 +#define OBJ_id_cmc_regInfo OBJ_id_cmc,18L + +#define SN_id_cmc_responseInfo "id-cmc-responseInfo" +#define NID_id_cmc_responseInfo 342 +#define OBJ_id_cmc_responseInfo OBJ_id_cmc,19L + +#define SN_id_cmc_queryPending "id-cmc-queryPending" +#define NID_id_cmc_queryPending 343 +#define OBJ_id_cmc_queryPending OBJ_id_cmc,21L + +#define SN_id_cmc_popLinkRandom "id-cmc-popLinkRandom" +#define NID_id_cmc_popLinkRandom 344 +#define OBJ_id_cmc_popLinkRandom OBJ_id_cmc,22L + +#define SN_id_cmc_popLinkWitness "id-cmc-popLinkWitness" +#define NID_id_cmc_popLinkWitness 345 +#define OBJ_id_cmc_popLinkWitness OBJ_id_cmc,23L + +#define SN_id_cmc_confirmCertAcceptance "id-cmc-confirmCertAcceptance" +#define NID_id_cmc_confirmCertAcceptance 346 +#define OBJ_id_cmc_confirmCertAcceptance OBJ_id_cmc,24L + +#define SN_id_on_personalData "id-on-personalData" +#define NID_id_on_personalData 347 +#define OBJ_id_on_personalData OBJ_id_on,1L + +#define SN_id_on_permanentIdentifier "id-on-permanentIdentifier" +#define LN_id_on_permanentIdentifier "Permanent Identifier" +#define NID_id_on_permanentIdentifier 858 +#define OBJ_id_on_permanentIdentifier OBJ_id_on,3L + +#define SN_id_pda_dateOfBirth "id-pda-dateOfBirth" +#define NID_id_pda_dateOfBirth 348 +#define OBJ_id_pda_dateOfBirth OBJ_id_pda,1L + +#define SN_id_pda_placeOfBirth "id-pda-placeOfBirth" +#define NID_id_pda_placeOfBirth 349 +#define OBJ_id_pda_placeOfBirth OBJ_id_pda,2L + +#define SN_id_pda_gender "id-pda-gender" +#define NID_id_pda_gender 351 +#define OBJ_id_pda_gender OBJ_id_pda,3L + +#define SN_id_pda_countryOfCitizenship "id-pda-countryOfCitizenship" +#define NID_id_pda_countryOfCitizenship 352 +#define OBJ_id_pda_countryOfCitizenship OBJ_id_pda,4L + +#define SN_id_pda_countryOfResidence "id-pda-countryOfResidence" +#define NID_id_pda_countryOfResidence 353 +#define OBJ_id_pda_countryOfResidence OBJ_id_pda,5L + +#define SN_id_aca_authenticationInfo "id-aca-authenticationInfo" +#define NID_id_aca_authenticationInfo 354 +#define OBJ_id_aca_authenticationInfo OBJ_id_aca,1L + +#define SN_id_aca_accessIdentity "id-aca-accessIdentity" +#define NID_id_aca_accessIdentity 355 +#define OBJ_id_aca_accessIdentity OBJ_id_aca,2L + +#define SN_id_aca_chargingIdentity "id-aca-chargingIdentity" +#define NID_id_aca_chargingIdentity 356 +#define OBJ_id_aca_chargingIdentity OBJ_id_aca,3L + +#define SN_id_aca_group "id-aca-group" +#define NID_id_aca_group 357 +#define OBJ_id_aca_group OBJ_id_aca,4L + +#define SN_id_aca_role "id-aca-role" +#define NID_id_aca_role 358 +#define OBJ_id_aca_role OBJ_id_aca,5L + +#define SN_id_aca_encAttrs "id-aca-encAttrs" +#define NID_id_aca_encAttrs 399 +#define OBJ_id_aca_encAttrs OBJ_id_aca,6L + +#define SN_id_qcs_pkixQCSyntax_v1 "id-qcs-pkixQCSyntax-v1" +#define NID_id_qcs_pkixQCSyntax_v1 359 +#define OBJ_id_qcs_pkixQCSyntax_v1 OBJ_id_qcs,1L + +#define SN_id_cct_crs "id-cct-crs" +#define NID_id_cct_crs 360 +#define OBJ_id_cct_crs OBJ_id_cct,1L + +#define SN_id_cct_PKIData "id-cct-PKIData" +#define NID_id_cct_PKIData 361 +#define OBJ_id_cct_PKIData OBJ_id_cct,2L + +#define SN_id_cct_PKIResponse "id-cct-PKIResponse" +#define NID_id_cct_PKIResponse 362 +#define OBJ_id_cct_PKIResponse OBJ_id_cct,3L + +#define SN_ipAddr_asNumber "ipAddr-asNumber" +#define NID_ipAddr_asNumber 1008 +#define OBJ_ipAddr_asNumber OBJ_id_cp,2L + +#define SN_ipAddr_asNumberv2 "ipAddr-asNumberv2" +#define NID_ipAddr_asNumberv2 1009 +#define OBJ_ipAddr_asNumberv2 OBJ_id_cp,3L + +#define SN_id_ppl_anyLanguage "id-ppl-anyLanguage" +#define LN_id_ppl_anyLanguage "Any language" +#define NID_id_ppl_anyLanguage 664 +#define OBJ_id_ppl_anyLanguage OBJ_id_ppl,0L + +#define SN_id_ppl_inheritAll "id-ppl-inheritAll" +#define LN_id_ppl_inheritAll "Inherit all" +#define NID_id_ppl_inheritAll 665 +#define OBJ_id_ppl_inheritAll OBJ_id_ppl,1L + +#define SN_Independent "id-ppl-independent" +#define LN_Independent "Independent" +#define NID_Independent 667 +#define OBJ_Independent OBJ_id_ppl,2L + +#define SN_ad_OCSP "OCSP" +#define LN_ad_OCSP "OCSP" +#define NID_ad_OCSP 178 +#define OBJ_ad_OCSP OBJ_id_ad,1L + +#define SN_ad_ca_issuers "caIssuers" +#define LN_ad_ca_issuers "CA Issuers" +#define NID_ad_ca_issuers 179 +#define OBJ_ad_ca_issuers OBJ_id_ad,2L + +#define SN_ad_timeStamping "ad_timestamping" +#define LN_ad_timeStamping "AD Time Stamping" +#define NID_ad_timeStamping 363 +#define OBJ_ad_timeStamping OBJ_id_ad,3L + +#define SN_ad_dvcs "AD_DVCS" +#define LN_ad_dvcs "ad dvcs" +#define NID_ad_dvcs 364 +#define OBJ_ad_dvcs OBJ_id_ad,4L + +#define SN_caRepository "caRepository" +#define LN_caRepository "CA Repository" +#define NID_caRepository 785 +#define OBJ_caRepository OBJ_id_ad,5L + +#define SN_rpkiManifest "rpkiManifest" +#define LN_rpkiManifest "RPKI Manifest" +#define NID_rpkiManifest 1010 +#define OBJ_rpkiManifest OBJ_id_ad,10L + +#define SN_signedObject "signedObject" +#define LN_signedObject "Signed Object" +#define NID_signedObject 1011 +#define OBJ_signedObject OBJ_id_ad,11L + +#define SN_rpkiNotify "rpkiNotify" +#define LN_rpkiNotify "RPKI Notify" +#define NID_rpkiNotify 1012 +#define OBJ_rpkiNotify OBJ_id_ad,13L + +#define OBJ_id_pkix_OCSP OBJ_ad_OCSP + +#define SN_id_pkix_OCSP_basic "basicOCSPResponse" +#define LN_id_pkix_OCSP_basic "Basic OCSP Response" +#define NID_id_pkix_OCSP_basic 365 +#define OBJ_id_pkix_OCSP_basic OBJ_id_pkix_OCSP,1L + +#define SN_id_pkix_OCSP_Nonce "Nonce" +#define LN_id_pkix_OCSP_Nonce "OCSP Nonce" +#define NID_id_pkix_OCSP_Nonce 366 +#define OBJ_id_pkix_OCSP_Nonce OBJ_id_pkix_OCSP,2L + +#define SN_id_pkix_OCSP_CrlID "CrlID" +#define LN_id_pkix_OCSP_CrlID "OCSP CRL ID" +#define NID_id_pkix_OCSP_CrlID 367 +#define OBJ_id_pkix_OCSP_CrlID OBJ_id_pkix_OCSP,3L + +#define SN_id_pkix_OCSP_acceptableResponses "acceptableResponses" +#define LN_id_pkix_OCSP_acceptableResponses "Acceptable OCSP Responses" +#define NID_id_pkix_OCSP_acceptableResponses 368 +#define OBJ_id_pkix_OCSP_acceptableResponses OBJ_id_pkix_OCSP,4L + +#define SN_id_pkix_OCSP_noCheck "noCheck" +#define LN_id_pkix_OCSP_noCheck "OCSP No Check" +#define NID_id_pkix_OCSP_noCheck 369 +#define OBJ_id_pkix_OCSP_noCheck OBJ_id_pkix_OCSP,5L + +#define SN_id_pkix_OCSP_archiveCutoff "archiveCutoff" +#define LN_id_pkix_OCSP_archiveCutoff "OCSP Archive Cutoff" +#define NID_id_pkix_OCSP_archiveCutoff 370 +#define OBJ_id_pkix_OCSP_archiveCutoff OBJ_id_pkix_OCSP,6L + +#define SN_id_pkix_OCSP_serviceLocator "serviceLocator" +#define LN_id_pkix_OCSP_serviceLocator "OCSP Service Locator" +#define NID_id_pkix_OCSP_serviceLocator 371 +#define OBJ_id_pkix_OCSP_serviceLocator OBJ_id_pkix_OCSP,7L + +#define SN_id_pkix_OCSP_extendedStatus "extendedStatus" +#define LN_id_pkix_OCSP_extendedStatus "Extended OCSP Status" +#define NID_id_pkix_OCSP_extendedStatus 372 +#define OBJ_id_pkix_OCSP_extendedStatus OBJ_id_pkix_OCSP,8L + +#define SN_id_pkix_OCSP_valid "valid" +#define NID_id_pkix_OCSP_valid 373 +#define OBJ_id_pkix_OCSP_valid OBJ_id_pkix_OCSP,9L + +#define SN_id_pkix_OCSP_path "path" +#define NID_id_pkix_OCSP_path 374 +#define OBJ_id_pkix_OCSP_path OBJ_id_pkix_OCSP,10L + +#define SN_id_pkix_OCSP_trustRoot "trustRoot" +#define LN_id_pkix_OCSP_trustRoot "Trust Root" +#define NID_id_pkix_OCSP_trustRoot 375 +#define OBJ_id_pkix_OCSP_trustRoot OBJ_id_pkix_OCSP,11L + +#define SN_algorithm "algorithm" +#define LN_algorithm "algorithm" +#define NID_algorithm 376 +#define OBJ_algorithm 1L,3L,14L,3L,2L + +#define SN_md5WithRSA "RSA-NP-MD5" +#define LN_md5WithRSA "md5WithRSA" +#define NID_md5WithRSA 104 +#define OBJ_md5WithRSA OBJ_algorithm,3L + +#define SN_des_ecb "DES-ECB" +#define LN_des_ecb "des-ecb" +#define NID_des_ecb 29 +#define OBJ_des_ecb OBJ_algorithm,6L + +#define SN_des_cbc "DES-CBC" +#define LN_des_cbc "des-cbc" +#define NID_des_cbc 31 +#define OBJ_des_cbc OBJ_algorithm,7L + +#define SN_des_ofb64 "DES-OFB" +#define LN_des_ofb64 "des-ofb" +#define NID_des_ofb64 45 +#define OBJ_des_ofb64 OBJ_algorithm,8L + +#define SN_des_cfb64 "DES-CFB" +#define LN_des_cfb64 "des-cfb" +#define NID_des_cfb64 30 +#define OBJ_des_cfb64 OBJ_algorithm,9L + +#define SN_rsaSignature "rsaSignature" +#define NID_rsaSignature 377 +#define OBJ_rsaSignature OBJ_algorithm,11L + +#define SN_dsa_2 "DSA-old" +#define LN_dsa_2 "dsaEncryption-old" +#define NID_dsa_2 67 +#define OBJ_dsa_2 OBJ_algorithm,12L + +#define SN_dsaWithSHA "DSA-SHA" +#define LN_dsaWithSHA "dsaWithSHA" +#define NID_dsaWithSHA 66 +#define OBJ_dsaWithSHA OBJ_algorithm,13L + +#define SN_shaWithRSAEncryption "RSA-SHA" +#define LN_shaWithRSAEncryption "shaWithRSAEncryption" +#define NID_shaWithRSAEncryption 42 +#define OBJ_shaWithRSAEncryption OBJ_algorithm,15L + +#define SN_des_ede_ecb "DES-EDE" +#define LN_des_ede_ecb "des-ede" +#define NID_des_ede_ecb 32 +#define OBJ_des_ede_ecb OBJ_algorithm,17L + +#define SN_des_ede3_ecb "DES-EDE3" +#define LN_des_ede3_ecb "des-ede3" +#define NID_des_ede3_ecb 33 + +#define SN_des_ede_cbc "DES-EDE-CBC" +#define LN_des_ede_cbc "des-ede-cbc" +#define NID_des_ede_cbc 43 + +#define SN_des_ede_cfb64 "DES-EDE-CFB" +#define LN_des_ede_cfb64 "des-ede-cfb" +#define NID_des_ede_cfb64 60 + +#define SN_des_ede3_cfb64 "DES-EDE3-CFB" +#define LN_des_ede3_cfb64 "des-ede3-cfb" +#define NID_des_ede3_cfb64 61 + +#define SN_des_ede_ofb64 "DES-EDE-OFB" +#define LN_des_ede_ofb64 "des-ede-ofb" +#define NID_des_ede_ofb64 62 + +#define SN_des_ede3_ofb64 "DES-EDE3-OFB" +#define LN_des_ede3_ofb64 "des-ede3-ofb" +#define NID_des_ede3_ofb64 63 + +#define SN_desx_cbc "DESX-CBC" +#define LN_desx_cbc "desx-cbc" +#define NID_desx_cbc 80 + +#define SN_sha "SHA" +#define LN_sha "sha" +#define NID_sha 41 +#define OBJ_sha OBJ_algorithm,18L + +#define SN_sha1 "SHA1" +#define LN_sha1 "sha1" +#define NID_sha1 64 +#define OBJ_sha1 OBJ_algorithm,26L + +#define SN_dsaWithSHA1_2 "DSA-SHA1-old" +#define LN_dsaWithSHA1_2 "dsaWithSHA1-old" +#define NID_dsaWithSHA1_2 70 +#define OBJ_dsaWithSHA1_2 OBJ_algorithm,27L + +#define SN_sha1WithRSA "RSA-SHA1-2" +#define LN_sha1WithRSA "sha1WithRSA" +#define NID_sha1WithRSA 115 +#define OBJ_sha1WithRSA OBJ_algorithm,29L + +#define SN_ripemd160 "RIPEMD160" +#define LN_ripemd160 "ripemd160" +#define NID_ripemd160 117 +#define OBJ_ripemd160 1L,3L,36L,3L,2L,1L + +#define SN_ripemd160WithRSA "RSA-RIPEMD160" +#define LN_ripemd160WithRSA "ripemd160WithRSA" +#define NID_ripemd160WithRSA 119 +#define OBJ_ripemd160WithRSA 1L,3L,36L,3L,3L,1L,2L + +#define SN_sxnet "SXNetID" +#define LN_sxnet "Strong Extranet ID" +#define NID_sxnet 143 +#define OBJ_sxnet 1L,3L,101L,1L,4L,1L + +#define SN_X500 "X500" +#define LN_X500 "directory services (X.500)" +#define NID_X500 11 +#define OBJ_X500 2L,5L + +#define SN_X509 "X509" +#define NID_X509 12 +#define OBJ_X509 OBJ_X500,4L + +#define SN_commonName "CN" +#define LN_commonName "commonName" +#define NID_commonName 13 +#define OBJ_commonName OBJ_X509,3L + +#define SN_surname "SN" +#define LN_surname "surname" +#define NID_surname 100 +#define OBJ_surname OBJ_X509,4L + +#define LN_serialNumber "serialNumber" +#define NID_serialNumber 105 +#define OBJ_serialNumber OBJ_X509,5L + +#define SN_countryName "C" +#define LN_countryName "countryName" +#define NID_countryName 14 +#define OBJ_countryName OBJ_X509,6L + +#define SN_localityName "L" +#define LN_localityName "localityName" +#define NID_localityName 15 +#define OBJ_localityName OBJ_X509,7L + +#define SN_stateOrProvinceName "ST" +#define LN_stateOrProvinceName "stateOrProvinceName" +#define NID_stateOrProvinceName 16 +#define OBJ_stateOrProvinceName OBJ_X509,8L + +#define SN_streetAddress "street" +#define LN_streetAddress "streetAddress" +#define NID_streetAddress 660 +#define OBJ_streetAddress OBJ_X509,9L + +#define SN_organizationName "O" +#define LN_organizationName "organizationName" +#define NID_organizationName 17 +#define OBJ_organizationName OBJ_X509,10L + +#define SN_organizationalUnitName "OU" +#define LN_organizationalUnitName "organizationalUnitName" +#define NID_organizationalUnitName 18 +#define OBJ_organizationalUnitName OBJ_X509,11L + +#define SN_title "title" +#define LN_title "title" +#define NID_title 106 +#define OBJ_title OBJ_X509,12L + +#define LN_description "description" +#define NID_description 107 +#define OBJ_description OBJ_X509,13L + +#define LN_searchGuide "searchGuide" +#define NID_searchGuide 859 +#define OBJ_searchGuide OBJ_X509,14L + +#define LN_businessCategory "businessCategory" +#define NID_businessCategory 860 +#define OBJ_businessCategory OBJ_X509,15L + +#define LN_postalAddress "postalAddress" +#define NID_postalAddress 861 +#define OBJ_postalAddress OBJ_X509,16L + +#define LN_postalCode "postalCode" +#define NID_postalCode 661 +#define OBJ_postalCode OBJ_X509,17L + +#define LN_postOfficeBox "postOfficeBox" +#define NID_postOfficeBox 862 +#define OBJ_postOfficeBox OBJ_X509,18L + +#define LN_physicalDeliveryOfficeName "physicalDeliveryOfficeName" +#define NID_physicalDeliveryOfficeName 863 +#define OBJ_physicalDeliveryOfficeName OBJ_X509,19L + +#define LN_telephoneNumber "telephoneNumber" +#define NID_telephoneNumber 864 +#define OBJ_telephoneNumber OBJ_X509,20L + +#define LN_telexNumber "telexNumber" +#define NID_telexNumber 865 +#define OBJ_telexNumber OBJ_X509,21L + +#define LN_teletexTerminalIdentifier "teletexTerminalIdentifier" +#define NID_teletexTerminalIdentifier 866 +#define OBJ_teletexTerminalIdentifier OBJ_X509,22L + +#define LN_facsimileTelephoneNumber "facsimileTelephoneNumber" +#define NID_facsimileTelephoneNumber 867 +#define OBJ_facsimileTelephoneNumber OBJ_X509,23L + +#define LN_x121Address "x121Address" +#define NID_x121Address 868 +#define OBJ_x121Address OBJ_X509,24L + +#define LN_internationaliSDNNumber "internationaliSDNNumber" +#define NID_internationaliSDNNumber 869 +#define OBJ_internationaliSDNNumber OBJ_X509,25L + +#define LN_registeredAddress "registeredAddress" +#define NID_registeredAddress 870 +#define OBJ_registeredAddress OBJ_X509,26L + +#define LN_destinationIndicator "destinationIndicator" +#define NID_destinationIndicator 871 +#define OBJ_destinationIndicator OBJ_X509,27L + +#define LN_preferredDeliveryMethod "preferredDeliveryMethod" +#define NID_preferredDeliveryMethod 872 +#define OBJ_preferredDeliveryMethod OBJ_X509,28L + +#define LN_presentationAddress "presentationAddress" +#define NID_presentationAddress 873 +#define OBJ_presentationAddress OBJ_X509,29L + +#define LN_supportedApplicationContext "supportedApplicationContext" +#define NID_supportedApplicationContext 874 +#define OBJ_supportedApplicationContext OBJ_X509,30L + +#define SN_member "member" +#define NID_member 875 +#define OBJ_member OBJ_X509,31L + +#define SN_owner "owner" +#define NID_owner 876 +#define OBJ_owner OBJ_X509,32L + +#define LN_roleOccupant "roleOccupant" +#define NID_roleOccupant 877 +#define OBJ_roleOccupant OBJ_X509,33L + +#define SN_seeAlso "seeAlso" +#define NID_seeAlso 878 +#define OBJ_seeAlso OBJ_X509,34L + +#define LN_userPassword "userPassword" +#define NID_userPassword 879 +#define OBJ_userPassword OBJ_X509,35L + +#define LN_userCertificate "userCertificate" +#define NID_userCertificate 880 +#define OBJ_userCertificate OBJ_X509,36L + +#define LN_cACertificate "cACertificate" +#define NID_cACertificate 881 +#define OBJ_cACertificate OBJ_X509,37L + +#define LN_authorityRevocationList "authorityRevocationList" +#define NID_authorityRevocationList 882 +#define OBJ_authorityRevocationList OBJ_X509,38L + +#define LN_certificateRevocationList "certificateRevocationList" +#define NID_certificateRevocationList 883 +#define OBJ_certificateRevocationList OBJ_X509,39L + +#define LN_crossCertificatePair "crossCertificatePair" +#define NID_crossCertificatePair 884 +#define OBJ_crossCertificatePair OBJ_X509,40L + +#define SN_name "name" +#define LN_name "name" +#define NID_name 173 +#define OBJ_name OBJ_X509,41L + +#define SN_givenName "GN" +#define LN_givenName "givenName" +#define NID_givenName 99 +#define OBJ_givenName OBJ_X509,42L + +#define SN_initials "initials" +#define LN_initials "initials" +#define NID_initials 101 +#define OBJ_initials OBJ_X509,43L + +#define LN_generationQualifier "generationQualifier" +#define NID_generationQualifier 509 +#define OBJ_generationQualifier OBJ_X509,44L + +#define LN_x500UniqueIdentifier "x500UniqueIdentifier" +#define NID_x500UniqueIdentifier 503 +#define OBJ_x500UniqueIdentifier OBJ_X509,45L + +#define SN_dnQualifier "dnQualifier" +#define LN_dnQualifier "dnQualifier" +#define NID_dnQualifier 174 +#define OBJ_dnQualifier OBJ_X509,46L + +#define LN_enhancedSearchGuide "enhancedSearchGuide" +#define NID_enhancedSearchGuide 885 +#define OBJ_enhancedSearchGuide OBJ_X509,47L + +#define LN_protocolInformation "protocolInformation" +#define NID_protocolInformation 886 +#define OBJ_protocolInformation OBJ_X509,48L + +#define LN_distinguishedName "distinguishedName" +#define NID_distinguishedName 887 +#define OBJ_distinguishedName OBJ_X509,49L + +#define LN_uniqueMember "uniqueMember" +#define NID_uniqueMember 888 +#define OBJ_uniqueMember OBJ_X509,50L + +#define LN_houseIdentifier "houseIdentifier" +#define NID_houseIdentifier 889 +#define OBJ_houseIdentifier OBJ_X509,51L + +#define LN_supportedAlgorithms "supportedAlgorithms" +#define NID_supportedAlgorithms 890 +#define OBJ_supportedAlgorithms OBJ_X509,52L + +#define LN_deltaRevocationList "deltaRevocationList" +#define NID_deltaRevocationList 891 +#define OBJ_deltaRevocationList OBJ_X509,53L + +#define SN_dmdName "dmdName" +#define NID_dmdName 892 +#define OBJ_dmdName OBJ_X509,54L + +#define LN_pseudonym "pseudonym" +#define NID_pseudonym 510 +#define OBJ_pseudonym OBJ_X509,65L + +#define SN_role "role" +#define LN_role "role" +#define NID_role 400 +#define OBJ_role OBJ_X509,72L + +#define SN_X500algorithms "X500algorithms" +#define LN_X500algorithms "directory services - algorithms" +#define NID_X500algorithms 378 +#define OBJ_X500algorithms OBJ_X500,8L + +#define SN_rsa "RSA" +#define LN_rsa "rsa" +#define NID_rsa 19 +#define OBJ_rsa OBJ_X500algorithms,1L,1L + +#define SN_mdc2WithRSA "RSA-MDC2" +#define LN_mdc2WithRSA "mdc2WithRSA" +#define NID_mdc2WithRSA 96 +#define OBJ_mdc2WithRSA OBJ_X500algorithms,3L,100L + +#define SN_mdc2 "MDC2" +#define LN_mdc2 "mdc2" +#define NID_mdc2 95 +#define OBJ_mdc2 OBJ_X500algorithms,3L,101L + +#define SN_id_ce "id-ce" +#define NID_id_ce 81 +#define OBJ_id_ce OBJ_X500,29L + +#define SN_subject_directory_attributes "subjectDirectoryAttributes" +#define LN_subject_directory_attributes "X509v3 Subject Directory Attributes" +#define NID_subject_directory_attributes 769 +#define OBJ_subject_directory_attributes OBJ_id_ce,9L + +#define SN_subject_key_identifier "subjectKeyIdentifier" +#define LN_subject_key_identifier "X509v3 Subject Key Identifier" +#define NID_subject_key_identifier 82 +#define OBJ_subject_key_identifier OBJ_id_ce,14L + +#define SN_key_usage "keyUsage" +#define LN_key_usage "X509v3 Key Usage" +#define NID_key_usage 83 +#define OBJ_key_usage OBJ_id_ce,15L + +#define SN_private_key_usage_period "privateKeyUsagePeriod" +#define LN_private_key_usage_period "X509v3 Private Key Usage Period" +#define NID_private_key_usage_period 84 +#define OBJ_private_key_usage_period OBJ_id_ce,16L + +#define SN_subject_alt_name "subjectAltName" +#define LN_subject_alt_name "X509v3 Subject Alternative Name" +#define NID_subject_alt_name 85 +#define OBJ_subject_alt_name OBJ_id_ce,17L + +#define SN_issuer_alt_name "issuerAltName" +#define LN_issuer_alt_name "X509v3 Issuer Alternative Name" +#define NID_issuer_alt_name 86 +#define OBJ_issuer_alt_name OBJ_id_ce,18L + +#define SN_basic_constraints "basicConstraints" +#define LN_basic_constraints "X509v3 Basic Constraints" +#define NID_basic_constraints 87 +#define OBJ_basic_constraints OBJ_id_ce,19L + +#define SN_crl_number "crlNumber" +#define LN_crl_number "X509v3 CRL Number" +#define NID_crl_number 88 +#define OBJ_crl_number OBJ_id_ce,20L + +#define SN_crl_reason "CRLReason" +#define LN_crl_reason "X509v3 CRL Reason Code" +#define NID_crl_reason 141 +#define OBJ_crl_reason OBJ_id_ce,21L + +#define SN_invalidity_date "invalidityDate" +#define LN_invalidity_date "Invalidity Date" +#define NID_invalidity_date 142 +#define OBJ_invalidity_date OBJ_id_ce,24L + +#define SN_delta_crl "deltaCRL" +#define LN_delta_crl "X509v3 Delta CRL Indicator" +#define NID_delta_crl 140 +#define OBJ_delta_crl OBJ_id_ce,27L + +#define SN_issuing_distribution_point "issuingDistributionPoint" +#define LN_issuing_distribution_point "X509v3 Issuing Distribution Point" +#define NID_issuing_distribution_point 770 +#define OBJ_issuing_distribution_point OBJ_id_ce,28L + +#define SN_certificate_issuer "certificateIssuer" +#define LN_certificate_issuer "X509v3 Certificate Issuer" +#define NID_certificate_issuer 771 +#define OBJ_certificate_issuer OBJ_id_ce,29L + +#define SN_name_constraints "nameConstraints" +#define LN_name_constraints "X509v3 Name Constraints" +#define NID_name_constraints 666 +#define OBJ_name_constraints OBJ_id_ce,30L + +#define SN_crl_distribution_points "crlDistributionPoints" +#define LN_crl_distribution_points "X509v3 CRL Distribution Points" +#define NID_crl_distribution_points 103 +#define OBJ_crl_distribution_points OBJ_id_ce,31L + +#define SN_certificate_policies "certificatePolicies" +#define LN_certificate_policies "X509v3 Certificate Policies" +#define NID_certificate_policies 89 +#define OBJ_certificate_policies OBJ_id_ce,32L + +#define SN_any_policy "anyPolicy" +#define LN_any_policy "X509v3 Any Policy" +#define NID_any_policy 746 +#define OBJ_any_policy OBJ_certificate_policies,0L + +#define SN_policy_mappings "policyMappings" +#define LN_policy_mappings "X509v3 Policy Mappings" +#define NID_policy_mappings 747 +#define OBJ_policy_mappings OBJ_id_ce,33L + +#define SN_authority_key_identifier "authorityKeyIdentifier" +#define LN_authority_key_identifier "X509v3 Authority Key Identifier" +#define NID_authority_key_identifier 90 +#define OBJ_authority_key_identifier OBJ_id_ce,35L + +#define SN_policy_constraints "policyConstraints" +#define LN_policy_constraints "X509v3 Policy Constraints" +#define NID_policy_constraints 401 +#define OBJ_policy_constraints OBJ_id_ce,36L + +#define SN_ext_key_usage "extendedKeyUsage" +#define LN_ext_key_usage "X509v3 Extended Key Usage" +#define NID_ext_key_usage 126 +#define OBJ_ext_key_usage OBJ_id_ce,37L + +#define SN_freshest_crl "freshestCRL" +#define LN_freshest_crl "X509v3 Freshest CRL" +#define NID_freshest_crl 857 +#define OBJ_freshest_crl OBJ_id_ce,46L + +#define SN_inhibit_any_policy "inhibitAnyPolicy" +#define LN_inhibit_any_policy "X509v3 Inhibit Any Policy" +#define NID_inhibit_any_policy 748 +#define OBJ_inhibit_any_policy OBJ_id_ce,54L + +#define SN_target_information "targetInformation" +#define LN_target_information "X509v3 AC Targeting" +#define NID_target_information 402 +#define OBJ_target_information OBJ_id_ce,55L + +#define SN_no_rev_avail "noRevAvail" +#define LN_no_rev_avail "X509v3 No Revocation Available" +#define NID_no_rev_avail 403 +#define OBJ_no_rev_avail OBJ_id_ce,56L + +#define SN_anyExtendedKeyUsage "anyExtendedKeyUsage" +#define LN_anyExtendedKeyUsage "Any Extended Key Usage" +#define NID_anyExtendedKeyUsage 910 +#define OBJ_anyExtendedKeyUsage OBJ_ext_key_usage,0L + +#define SN_netscape "Netscape" +#define LN_netscape "Netscape Communications Corp." +#define NID_netscape 57 +#define OBJ_netscape 2L,16L,840L,1L,113730L + +#define SN_netscape_cert_extension "nsCertExt" +#define LN_netscape_cert_extension "Netscape Certificate Extension" +#define NID_netscape_cert_extension 58 +#define OBJ_netscape_cert_extension OBJ_netscape,1L + +#define SN_netscape_data_type "nsDataType" +#define LN_netscape_data_type "Netscape Data Type" +#define NID_netscape_data_type 59 +#define OBJ_netscape_data_type OBJ_netscape,2L + +#define SN_netscape_cert_type "nsCertType" +#define LN_netscape_cert_type "Netscape Cert Type" +#define NID_netscape_cert_type 71 +#define OBJ_netscape_cert_type OBJ_netscape_cert_extension,1L + +#define SN_netscape_base_url "nsBaseUrl" +#define LN_netscape_base_url "Netscape Base Url" +#define NID_netscape_base_url 72 +#define OBJ_netscape_base_url OBJ_netscape_cert_extension,2L + +#define SN_netscape_revocation_url "nsRevocationUrl" +#define LN_netscape_revocation_url "Netscape Revocation Url" +#define NID_netscape_revocation_url 73 +#define OBJ_netscape_revocation_url OBJ_netscape_cert_extension,3L + +#define SN_netscape_ca_revocation_url "nsCaRevocationUrl" +#define LN_netscape_ca_revocation_url "Netscape CA Revocation Url" +#define NID_netscape_ca_revocation_url 74 +#define OBJ_netscape_ca_revocation_url OBJ_netscape_cert_extension,4L + +#define SN_netscape_renewal_url "nsRenewalUrl" +#define LN_netscape_renewal_url "Netscape Renewal Url" +#define NID_netscape_renewal_url 75 +#define OBJ_netscape_renewal_url OBJ_netscape_cert_extension,7L + +#define SN_netscape_ca_policy_url "nsCaPolicyUrl" +#define LN_netscape_ca_policy_url "Netscape CA Policy Url" +#define NID_netscape_ca_policy_url 76 +#define OBJ_netscape_ca_policy_url OBJ_netscape_cert_extension,8L + +#define SN_netscape_ssl_server_name "nsSslServerName" +#define LN_netscape_ssl_server_name "Netscape SSL Server Name" +#define NID_netscape_ssl_server_name 77 +#define OBJ_netscape_ssl_server_name OBJ_netscape_cert_extension,12L + +#define SN_netscape_comment "nsComment" +#define LN_netscape_comment "Netscape Comment" +#define NID_netscape_comment 78 +#define OBJ_netscape_comment OBJ_netscape_cert_extension,13L + +#define SN_netscape_cert_sequence "nsCertSequence" +#define LN_netscape_cert_sequence "Netscape Certificate Sequence" +#define NID_netscape_cert_sequence 79 +#define OBJ_netscape_cert_sequence OBJ_netscape_data_type,5L + +#define SN_ns_sgc "nsSGC" +#define LN_ns_sgc "Netscape Server Gated Crypto" +#define NID_ns_sgc 139 +#define OBJ_ns_sgc OBJ_netscape,4L,1L + +#define SN_org "ORG" +#define LN_org "org" +#define NID_org 379 +#define OBJ_org OBJ_iso,3L + +#define SN_dod "DOD" +#define LN_dod "dod" +#define NID_dod 380 +#define OBJ_dod OBJ_org,6L + +#define SN_iana "IANA" +#define LN_iana "iana" +#define NID_iana 381 +#define OBJ_iana OBJ_dod,1L + +#define OBJ_internet OBJ_iana + +#define SN_Directory "directory" +#define LN_Directory "Directory" +#define NID_Directory 382 +#define OBJ_Directory OBJ_internet,1L + +#define SN_Management "mgmt" +#define LN_Management "Management" +#define NID_Management 383 +#define OBJ_Management OBJ_internet,2L + +#define SN_Experimental "experimental" +#define LN_Experimental "Experimental" +#define NID_Experimental 384 +#define OBJ_Experimental OBJ_internet,3L + +#define SN_Private "private" +#define LN_Private "Private" +#define NID_Private 385 +#define OBJ_Private OBJ_internet,4L + +#define SN_Security "security" +#define LN_Security "Security" +#define NID_Security 386 +#define OBJ_Security OBJ_internet,5L + +#define SN_SNMPv2 "snmpv2" +#define LN_SNMPv2 "SNMPv2" +#define NID_SNMPv2 387 +#define OBJ_SNMPv2 OBJ_internet,6L + +#define LN_Mail "Mail" +#define NID_Mail 388 +#define OBJ_Mail OBJ_internet,7L + +#define SN_Enterprises "enterprises" +#define LN_Enterprises "Enterprises" +#define NID_Enterprises 389 +#define OBJ_Enterprises OBJ_Private,1L + +#define SN_dcObject "dcobject" +#define LN_dcObject "dcObject" +#define NID_dcObject 390 +#define OBJ_dcObject OBJ_Enterprises,1466L,344L + +#define OBJ_extendedValidation OBJ_Enterprises,311L,60L + +#define LN_jurisdictionLocalityName "jurisdictionLocalityName" +#define NID_jurisdictionLocalityName 956 +#define OBJ_jurisdictionLocalityName OBJ_extendedValidation,2L,1L,1L + +#define LN_jurisdictionStateOrProvinceName "jurisdictionStateOrProvinceName" +#define NID_jurisdictionStateOrProvinceName 957 +#define OBJ_jurisdictionStateOrProvinceName OBJ_extendedValidation,2L,1L,2L + +#define LN_jurisdictionCountryName "jurisdictionCountryName" +#define NID_jurisdictionCountryName 958 +#define OBJ_jurisdictionCountryName OBJ_extendedValidation,2L,1L,3L + +#define SN_mime_mhs "mime-mhs" +#define LN_mime_mhs "MIME MHS" +#define NID_mime_mhs 504 +#define OBJ_mime_mhs OBJ_Mail,1L + +#define SN_mime_mhs_headings "mime-mhs-headings" +#define LN_mime_mhs_headings "mime-mhs-headings" +#define NID_mime_mhs_headings 505 +#define OBJ_mime_mhs_headings OBJ_mime_mhs,1L + +#define SN_mime_mhs_bodies "mime-mhs-bodies" +#define LN_mime_mhs_bodies "mime-mhs-bodies" +#define NID_mime_mhs_bodies 506 +#define OBJ_mime_mhs_bodies OBJ_mime_mhs,2L + +#define SN_id_hex_partial_message "id-hex-partial-message" +#define LN_id_hex_partial_message "id-hex-partial-message" +#define NID_id_hex_partial_message 507 +#define OBJ_id_hex_partial_message OBJ_mime_mhs_headings,1L + +#define SN_id_hex_multipart_message "id-hex-multipart-message" +#define LN_id_hex_multipart_message "id-hex-multipart-message" +#define NID_id_hex_multipart_message 508 +#define OBJ_id_hex_multipart_message OBJ_mime_mhs_headings,2L + +#define SN_rle_compression "RLE" +#define LN_rle_compression "run length compression" +#define NID_rle_compression 124 +#define OBJ_rle_compression 1L,1L,1L,1L,666L,1L + +#define SN_zlib_compression "ZLIB" +#define LN_zlib_compression "zlib compression" +#define NID_zlib_compression 125 +#define OBJ_zlib_compression OBJ_id_smime_alg,8L + +#define OBJ_csor 2L,16L,840L,1L,101L,3L + +#define OBJ_nistAlgorithms OBJ_csor,4L + +#define OBJ_aes OBJ_nistAlgorithms,1L + +#define SN_aes_128_ecb "AES-128-ECB" +#define LN_aes_128_ecb "aes-128-ecb" +#define NID_aes_128_ecb 418 +#define OBJ_aes_128_ecb OBJ_aes,1L + +#define SN_aes_128_cbc "AES-128-CBC" +#define LN_aes_128_cbc "aes-128-cbc" +#define NID_aes_128_cbc 419 +#define OBJ_aes_128_cbc OBJ_aes,2L + +#define SN_aes_128_ofb128 "AES-128-OFB" +#define LN_aes_128_ofb128 "aes-128-ofb" +#define NID_aes_128_ofb128 420 +#define OBJ_aes_128_ofb128 OBJ_aes,3L + +#define SN_aes_128_cfb128 "AES-128-CFB" +#define LN_aes_128_cfb128 "aes-128-cfb" +#define NID_aes_128_cfb128 421 +#define OBJ_aes_128_cfb128 OBJ_aes,4L + +#define SN_id_aes128_wrap "id-aes128-wrap" +#define NID_id_aes128_wrap 788 +#define OBJ_id_aes128_wrap OBJ_aes,5L + +#define SN_aes_128_gcm "id-aes128-GCM" +#define LN_aes_128_gcm "aes-128-gcm" +#define NID_aes_128_gcm 895 +#define OBJ_aes_128_gcm OBJ_aes,6L + +#define SN_aes_128_ccm "id-aes128-CCM" +#define LN_aes_128_ccm "aes-128-ccm" +#define NID_aes_128_ccm 896 +#define OBJ_aes_128_ccm OBJ_aes,7L + +#define SN_id_aes128_wrap_pad "id-aes128-wrap-pad" +#define NID_id_aes128_wrap_pad 897 +#define OBJ_id_aes128_wrap_pad OBJ_aes,8L + +#define SN_aes_192_ecb "AES-192-ECB" +#define LN_aes_192_ecb "aes-192-ecb" +#define NID_aes_192_ecb 422 +#define OBJ_aes_192_ecb OBJ_aes,21L + +#define SN_aes_192_cbc "AES-192-CBC" +#define LN_aes_192_cbc "aes-192-cbc" +#define NID_aes_192_cbc 423 +#define OBJ_aes_192_cbc OBJ_aes,22L + +#define SN_aes_192_ofb128 "AES-192-OFB" +#define LN_aes_192_ofb128 "aes-192-ofb" +#define NID_aes_192_ofb128 424 +#define OBJ_aes_192_ofb128 OBJ_aes,23L + +#define SN_aes_192_cfb128 "AES-192-CFB" +#define LN_aes_192_cfb128 "aes-192-cfb" +#define NID_aes_192_cfb128 425 +#define OBJ_aes_192_cfb128 OBJ_aes,24L + +#define SN_id_aes192_wrap "id-aes192-wrap" +#define NID_id_aes192_wrap 789 +#define OBJ_id_aes192_wrap OBJ_aes,25L + +#define SN_aes_192_gcm "id-aes192-GCM" +#define LN_aes_192_gcm "aes-192-gcm" +#define NID_aes_192_gcm 898 +#define OBJ_aes_192_gcm OBJ_aes,26L + +#define SN_aes_192_ccm "id-aes192-CCM" +#define LN_aes_192_ccm "aes-192-ccm" +#define NID_aes_192_ccm 899 +#define OBJ_aes_192_ccm OBJ_aes,27L + +#define SN_id_aes192_wrap_pad "id-aes192-wrap-pad" +#define NID_id_aes192_wrap_pad 900 +#define OBJ_id_aes192_wrap_pad OBJ_aes,28L + +#define SN_aes_256_ecb "AES-256-ECB" +#define LN_aes_256_ecb "aes-256-ecb" +#define NID_aes_256_ecb 426 +#define OBJ_aes_256_ecb OBJ_aes,41L + +#define SN_aes_256_cbc "AES-256-CBC" +#define LN_aes_256_cbc "aes-256-cbc" +#define NID_aes_256_cbc 427 +#define OBJ_aes_256_cbc OBJ_aes,42L + +#define SN_aes_256_ofb128 "AES-256-OFB" +#define LN_aes_256_ofb128 "aes-256-ofb" +#define NID_aes_256_ofb128 428 +#define OBJ_aes_256_ofb128 OBJ_aes,43L + +#define SN_aes_256_cfb128 "AES-256-CFB" +#define LN_aes_256_cfb128 "aes-256-cfb" +#define NID_aes_256_cfb128 429 +#define OBJ_aes_256_cfb128 OBJ_aes,44L + +#define SN_id_aes256_wrap "id-aes256-wrap" +#define NID_id_aes256_wrap 790 +#define OBJ_id_aes256_wrap OBJ_aes,45L + +#define SN_aes_256_gcm "id-aes256-GCM" +#define LN_aes_256_gcm "aes-256-gcm" +#define NID_aes_256_gcm 901 +#define OBJ_aes_256_gcm OBJ_aes,46L + +#define SN_aes_256_ccm "id-aes256-CCM" +#define LN_aes_256_ccm "aes-256-ccm" +#define NID_aes_256_ccm 902 +#define OBJ_aes_256_ccm OBJ_aes,47L + +#define SN_id_aes256_wrap_pad "id-aes256-wrap-pad" +#define NID_id_aes256_wrap_pad 903 +#define OBJ_id_aes256_wrap_pad OBJ_aes,48L + +#define SN_aes_128_cfb1 "AES-128-CFB1" +#define LN_aes_128_cfb1 "aes-128-cfb1" +#define NID_aes_128_cfb1 650 + +#define SN_aes_192_cfb1 "AES-192-CFB1" +#define LN_aes_192_cfb1 "aes-192-cfb1" +#define NID_aes_192_cfb1 651 + +#define SN_aes_256_cfb1 "AES-256-CFB1" +#define LN_aes_256_cfb1 "aes-256-cfb1" +#define NID_aes_256_cfb1 652 + +#define SN_aes_128_cfb8 "AES-128-CFB8" +#define LN_aes_128_cfb8 "aes-128-cfb8" +#define NID_aes_128_cfb8 653 + +#define SN_aes_192_cfb8 "AES-192-CFB8" +#define LN_aes_192_cfb8 "aes-192-cfb8" +#define NID_aes_192_cfb8 654 + +#define SN_aes_256_cfb8 "AES-256-CFB8" +#define LN_aes_256_cfb8 "aes-256-cfb8" +#define NID_aes_256_cfb8 655 + +#define SN_aes_128_ctr "AES-128-CTR" +#define LN_aes_128_ctr "aes-128-ctr" +#define NID_aes_128_ctr 904 + +#define SN_aes_192_ctr "AES-192-CTR" +#define LN_aes_192_ctr "aes-192-ctr" +#define NID_aes_192_ctr 905 + +#define SN_aes_256_ctr "AES-256-CTR" +#define LN_aes_256_ctr "aes-256-ctr" +#define NID_aes_256_ctr 906 + +#define SN_aes_128_xts "AES-128-XTS" +#define LN_aes_128_xts "aes-128-xts" +#define NID_aes_128_xts 913 + +#define SN_aes_256_xts "AES-256-XTS" +#define LN_aes_256_xts "aes-256-xts" +#define NID_aes_256_xts 914 + +#define SN_des_cfb1 "DES-CFB1" +#define LN_des_cfb1 "des-cfb1" +#define NID_des_cfb1 656 + +#define SN_des_cfb8 "DES-CFB8" +#define LN_des_cfb8 "des-cfb8" +#define NID_des_cfb8 657 + +#define SN_des_ede3_cfb1 "DES-EDE3-CFB1" +#define LN_des_ede3_cfb1 "des-ede3-cfb1" +#define NID_des_ede3_cfb1 658 + +#define SN_des_ede3_cfb8 "DES-EDE3-CFB8" +#define LN_des_ede3_cfb8 "des-ede3-cfb8" +#define NID_des_ede3_cfb8 659 + +#define OBJ_nist_hashalgs OBJ_nistAlgorithms,2L + +#define SN_sha256 "SHA256" +#define LN_sha256 "sha256" +#define NID_sha256 672 +#define OBJ_sha256 OBJ_nist_hashalgs,1L + +#define SN_sha384 "SHA384" +#define LN_sha384 "sha384" +#define NID_sha384 673 +#define OBJ_sha384 OBJ_nist_hashalgs,2L + +#define SN_sha512 "SHA512" +#define LN_sha512 "sha512" +#define NID_sha512 674 +#define OBJ_sha512 OBJ_nist_hashalgs,3L + +#define SN_sha224 "SHA224" +#define LN_sha224 "sha224" +#define NID_sha224 675 +#define OBJ_sha224 OBJ_nist_hashalgs,4L + +#define SN_sha512_224 "SHA512-224" +#define LN_sha512_224 "sha512-224" +#define NID_sha512_224 1029 +#define OBJ_sha512_224 OBJ_nist_hashalgs,5L + +#define SN_sha512_256 "SHA512-256" +#define LN_sha512_256 "sha512-256" +#define NID_sha512_256 1030 +#define OBJ_sha512_256 OBJ_nist_hashalgs,6L + +#define SN_sha3_224 "SHA3-224" +#define LN_sha3_224 "sha3-224" +#define NID_sha3_224 1031 +#define OBJ_sha3_224 OBJ_nist_hashalgs,7L + +#define SN_sha3_256 "SHA3-256" +#define LN_sha3_256 "sha3-256" +#define NID_sha3_256 1032 +#define OBJ_sha3_256 OBJ_nist_hashalgs,8L + +#define SN_sha3_384 "SHA3-384" +#define LN_sha3_384 "sha3-384" +#define NID_sha3_384 1033 +#define OBJ_sha3_384 OBJ_nist_hashalgs,9L + +#define SN_sha3_512 "SHA3-512" +#define LN_sha3_512 "sha3-512" +#define NID_sha3_512 1034 +#define OBJ_sha3_512 OBJ_nist_hashalgs,10L + +#define SN_hmac_sha3_224 "id-hmacWithSHA3-224" +#define LN_hmac_sha3_224 "hmac-sha3-224" +#define NID_hmac_sha3_224 1035 +#define OBJ_hmac_sha3_224 OBJ_nist_hashalgs,13L + +#define SN_hmac_sha3_256 "id-hmacWithSHA3-256" +#define LN_hmac_sha3_256 "hmac-sha3-256" +#define NID_hmac_sha3_256 1036 +#define OBJ_hmac_sha3_256 OBJ_nist_hashalgs,14L + +#define SN_hmac_sha3_384 "id-hmacWithSHA3-384" +#define LN_hmac_sha3_384 "hmac-sha3-384" +#define NID_hmac_sha3_384 1037 +#define OBJ_hmac_sha3_384 OBJ_nist_hashalgs,15L + +#define SN_hmac_sha3_512 "id-hmacWithSHA3-512" +#define LN_hmac_sha3_512 "hmac-sha3-512" +#define NID_hmac_sha3_512 1038 +#define OBJ_hmac_sha3_512 OBJ_nist_hashalgs,16L + +#define OBJ_nist_sigalgs OBJ_nistAlgorithms,3L + +#define SN_dsa_with_SHA224 "id-dsa-with-sha224" +#define LN_dsa_with_SHA224 "dsa_with_SHA224" +#define NID_dsa_with_SHA224 802 +#define OBJ_dsa_with_SHA224 OBJ_nist_sigalgs,1L + +#define SN_dsa_with_SHA256 "id-dsa-with-sha256" +#define LN_dsa_with_SHA256 "dsa_with_SHA256" +#define NID_dsa_with_SHA256 803 +#define OBJ_dsa_with_SHA256 OBJ_nist_sigalgs,2L + +#define SN_dsa_with_SHA384 "id-dsa-with-sha384" +#define LN_dsa_with_SHA384 "dsa_with_SHA384" +#define NID_dsa_with_SHA384 1039 +#define OBJ_dsa_with_SHA384 OBJ_nist_sigalgs,3L + +#define SN_dsa_with_SHA512 "id-dsa-with-sha512" +#define LN_dsa_with_SHA512 "dsa_with_SHA512" +#define NID_dsa_with_SHA512 1040 +#define OBJ_dsa_with_SHA512 OBJ_nist_sigalgs,4L + +#define SN_dsa_with_SHA3_224 "id-dsa-with-sha3-224" +#define LN_dsa_with_SHA3_224 "dsa_with_SHA3-224" +#define NID_dsa_with_SHA3_224 1041 +#define OBJ_dsa_with_SHA3_224 OBJ_nist_sigalgs,5L + +#define SN_dsa_with_SHA3_256 "id-dsa-with-sha3-256" +#define LN_dsa_with_SHA3_256 "dsa_with_SHA3-256" +#define NID_dsa_with_SHA3_256 1042 +#define OBJ_dsa_with_SHA3_256 OBJ_nist_sigalgs,6L + +#define SN_dsa_with_SHA3_384 "id-dsa-with-sha3-384" +#define LN_dsa_with_SHA3_384 "dsa_with_SHA3-384" +#define NID_dsa_with_SHA3_384 1043 +#define OBJ_dsa_with_SHA3_384 OBJ_nist_sigalgs,7L + +#define SN_dsa_with_SHA3_512 "id-dsa-with-sha3-512" +#define LN_dsa_with_SHA3_512 "dsa_with_SHA3-512" +#define NID_dsa_with_SHA3_512 1044 +#define OBJ_dsa_with_SHA3_512 OBJ_nist_sigalgs,8L + +#define SN_ecdsa_with_SHA3_224 "id-ecdsa-with-sha3-224" +#define LN_ecdsa_with_SHA3_224 "ecdsa_with_SHA3-224" +#define NID_ecdsa_with_SHA3_224 1045 +#define OBJ_ecdsa_with_SHA3_224 OBJ_nist_sigalgs,9L + +#define SN_ecdsa_with_SHA3_256 "id-ecdsa-with-sha3-256" +#define LN_ecdsa_with_SHA3_256 "ecdsa_with_SHA3-256" +#define NID_ecdsa_with_SHA3_256 1046 +#define OBJ_ecdsa_with_SHA3_256 OBJ_nist_sigalgs,10L + +#define SN_ecdsa_with_SHA3_384 "id-ecdsa-with-sha3-384" +#define LN_ecdsa_with_SHA3_384 "ecdsa_with_SHA3-384" +#define NID_ecdsa_with_SHA3_384 1047 +#define OBJ_ecdsa_with_SHA3_384 OBJ_nist_sigalgs,11L + +#define SN_ecdsa_with_SHA3_512 "id-ecdsa-with-sha3-512" +#define LN_ecdsa_with_SHA3_512 "ecdsa_with_SHA3-512" +#define NID_ecdsa_with_SHA3_512 1048 +#define OBJ_ecdsa_with_SHA3_512 OBJ_nist_sigalgs,12L + +#define SN_RSA_SHA3_224 "id-rsassa-pkcs1-v1_5-with-sha3-224" +#define LN_RSA_SHA3_224 "RSA-SHA3-224" +#define NID_RSA_SHA3_224 1049 +#define OBJ_RSA_SHA3_224 OBJ_nist_sigalgs,13L + +#define SN_RSA_SHA3_256 "id-rsassa-pkcs1-v1_5-with-sha3-256" +#define LN_RSA_SHA3_256 "RSA-SHA3-256" +#define NID_RSA_SHA3_256 1050 +#define OBJ_RSA_SHA3_256 OBJ_nist_sigalgs,14L + +#define SN_RSA_SHA3_384 "id-rsassa-pkcs1-v1_5-with-sha3-384" +#define LN_RSA_SHA3_384 "RSA-SHA3-384" +#define NID_RSA_SHA3_384 1051 +#define OBJ_RSA_SHA3_384 OBJ_nist_sigalgs,15L + +#define SN_RSA_SHA3_512 "id-rsassa-pkcs1-v1_5-with-sha3-512" +#define LN_RSA_SHA3_512 "RSA-SHA3-512" +#define NID_RSA_SHA3_512 1052 +#define OBJ_RSA_SHA3_512 OBJ_nist_sigalgs,16L + +#define SN_hold_instruction_code "holdInstructionCode" +#define LN_hold_instruction_code "Hold Instruction Code" +#define NID_hold_instruction_code 430 +#define OBJ_hold_instruction_code OBJ_id_ce,23L + +#define OBJ_holdInstruction OBJ_X9_57,2L + +#define SN_hold_instruction_none "holdInstructionNone" +#define LN_hold_instruction_none "Hold Instruction None" +#define NID_hold_instruction_none 431 +#define OBJ_hold_instruction_none OBJ_holdInstruction,1L + +#define SN_hold_instruction_call_issuer "holdInstructionCallIssuer" +#define LN_hold_instruction_call_issuer "Hold Instruction Call Issuer" +#define NID_hold_instruction_call_issuer 432 +#define OBJ_hold_instruction_call_issuer OBJ_holdInstruction,2L + +#define SN_hold_instruction_reject "holdInstructionReject" +#define LN_hold_instruction_reject "Hold Instruction Reject" +#define NID_hold_instruction_reject 433 +#define OBJ_hold_instruction_reject OBJ_holdInstruction,3L + +#define SN_data "data" +#define NID_data 434 +#define OBJ_data OBJ_itu_t,9L + +#define SN_pss "pss" +#define NID_pss 435 +#define OBJ_pss OBJ_data,2342L + +#define SN_ucl "ucl" +#define NID_ucl 436 +#define OBJ_ucl OBJ_pss,19200300L + +#define SN_pilot "pilot" +#define NID_pilot 437 +#define OBJ_pilot OBJ_ucl,100L + +#define LN_pilotAttributeType "pilotAttributeType" +#define NID_pilotAttributeType 438 +#define OBJ_pilotAttributeType OBJ_pilot,1L + +#define LN_pilotAttributeSyntax "pilotAttributeSyntax" +#define NID_pilotAttributeSyntax 439 +#define OBJ_pilotAttributeSyntax OBJ_pilot,3L + +#define LN_pilotObjectClass "pilotObjectClass" +#define NID_pilotObjectClass 440 +#define OBJ_pilotObjectClass OBJ_pilot,4L + +#define LN_pilotGroups "pilotGroups" +#define NID_pilotGroups 441 +#define OBJ_pilotGroups OBJ_pilot,10L + +#define LN_iA5StringSyntax "iA5StringSyntax" +#define NID_iA5StringSyntax 442 +#define OBJ_iA5StringSyntax OBJ_pilotAttributeSyntax,4L + +#define LN_caseIgnoreIA5StringSyntax "caseIgnoreIA5StringSyntax" +#define NID_caseIgnoreIA5StringSyntax 443 +#define OBJ_caseIgnoreIA5StringSyntax OBJ_pilotAttributeSyntax,5L + +#define LN_pilotObject "pilotObject" +#define NID_pilotObject 444 +#define OBJ_pilotObject OBJ_pilotObjectClass,3L + +#define LN_pilotPerson "pilotPerson" +#define NID_pilotPerson 445 +#define OBJ_pilotPerson OBJ_pilotObjectClass,4L + +#define SN_account "account" +#define NID_account 446 +#define OBJ_account OBJ_pilotObjectClass,5L + +#define SN_document "document" +#define NID_document 447 +#define OBJ_document OBJ_pilotObjectClass,6L + +#define SN_room "room" +#define NID_room 448 +#define OBJ_room OBJ_pilotObjectClass,7L + +#define LN_documentSeries "documentSeries" +#define NID_documentSeries 449 +#define OBJ_documentSeries OBJ_pilotObjectClass,9L + +#define SN_Domain "domain" +#define LN_Domain "Domain" +#define NID_Domain 392 +#define OBJ_Domain OBJ_pilotObjectClass,13L + +#define LN_rFC822localPart "rFC822localPart" +#define NID_rFC822localPart 450 +#define OBJ_rFC822localPart OBJ_pilotObjectClass,14L + +#define LN_dNSDomain "dNSDomain" +#define NID_dNSDomain 451 +#define OBJ_dNSDomain OBJ_pilotObjectClass,15L + +#define LN_domainRelatedObject "domainRelatedObject" +#define NID_domainRelatedObject 452 +#define OBJ_domainRelatedObject OBJ_pilotObjectClass,17L + +#define LN_friendlyCountry "friendlyCountry" +#define NID_friendlyCountry 453 +#define OBJ_friendlyCountry OBJ_pilotObjectClass,18L + +#define LN_simpleSecurityObject "simpleSecurityObject" +#define NID_simpleSecurityObject 454 +#define OBJ_simpleSecurityObject OBJ_pilotObjectClass,19L + +#define LN_pilotOrganization "pilotOrganization" +#define NID_pilotOrganization 455 +#define OBJ_pilotOrganization OBJ_pilotObjectClass,20L + +#define LN_pilotDSA "pilotDSA" +#define NID_pilotDSA 456 +#define OBJ_pilotDSA OBJ_pilotObjectClass,21L + +#define LN_qualityLabelledData "qualityLabelledData" +#define NID_qualityLabelledData 457 +#define OBJ_qualityLabelledData OBJ_pilotObjectClass,22L + +#define SN_userId "UID" +#define LN_userId "userId" +#define NID_userId 458 +#define OBJ_userId OBJ_pilotAttributeType,1L + +#define LN_textEncodedORAddress "textEncodedORAddress" +#define NID_textEncodedORAddress 459 +#define OBJ_textEncodedORAddress OBJ_pilotAttributeType,2L + +#define SN_rfc822Mailbox "mail" +#define LN_rfc822Mailbox "rfc822Mailbox" +#define NID_rfc822Mailbox 460 +#define OBJ_rfc822Mailbox OBJ_pilotAttributeType,3L + +#define SN_info "info" +#define NID_info 461 +#define OBJ_info OBJ_pilotAttributeType,4L + +#define LN_favouriteDrink "favouriteDrink" +#define NID_favouriteDrink 462 +#define OBJ_favouriteDrink OBJ_pilotAttributeType,5L + +#define LN_roomNumber "roomNumber" +#define NID_roomNumber 463 +#define OBJ_roomNumber OBJ_pilotAttributeType,6L + +#define SN_photo "photo" +#define NID_photo 464 +#define OBJ_photo OBJ_pilotAttributeType,7L + +#define LN_userClass "userClass" +#define NID_userClass 465 +#define OBJ_userClass OBJ_pilotAttributeType,8L + +#define SN_host "host" +#define NID_host 466 +#define OBJ_host OBJ_pilotAttributeType,9L + +#define SN_manager "manager" +#define NID_manager 467 +#define OBJ_manager OBJ_pilotAttributeType,10L + +#define LN_documentIdentifier "documentIdentifier" +#define NID_documentIdentifier 468 +#define OBJ_documentIdentifier OBJ_pilotAttributeType,11L + +#define LN_documentTitle "documentTitle" +#define NID_documentTitle 469 +#define OBJ_documentTitle OBJ_pilotAttributeType,12L + +#define LN_documentVersion "documentVersion" +#define NID_documentVersion 470 +#define OBJ_documentVersion OBJ_pilotAttributeType,13L + +#define LN_documentAuthor "documentAuthor" +#define NID_documentAuthor 471 +#define OBJ_documentAuthor OBJ_pilotAttributeType,14L + +#define LN_documentLocation "documentLocation" +#define NID_documentLocation 472 +#define OBJ_documentLocation OBJ_pilotAttributeType,15L + +#define LN_homeTelephoneNumber "homeTelephoneNumber" +#define NID_homeTelephoneNumber 473 +#define OBJ_homeTelephoneNumber OBJ_pilotAttributeType,20L + +#define SN_secretary "secretary" +#define NID_secretary 474 +#define OBJ_secretary OBJ_pilotAttributeType,21L + +#define LN_otherMailbox "otherMailbox" +#define NID_otherMailbox 475 +#define OBJ_otherMailbox OBJ_pilotAttributeType,22L + +#define LN_lastModifiedTime "lastModifiedTime" +#define NID_lastModifiedTime 476 +#define OBJ_lastModifiedTime OBJ_pilotAttributeType,23L + +#define LN_lastModifiedBy "lastModifiedBy" +#define NID_lastModifiedBy 477 +#define OBJ_lastModifiedBy OBJ_pilotAttributeType,24L + +#define SN_domainComponent "DC" +#define LN_domainComponent "domainComponent" +#define NID_domainComponent 391 +#define OBJ_domainComponent OBJ_pilotAttributeType,25L + +#define LN_aRecord "aRecord" +#define NID_aRecord 478 +#define OBJ_aRecord OBJ_pilotAttributeType,26L + +#define LN_pilotAttributeType27 "pilotAttributeType27" +#define NID_pilotAttributeType27 479 +#define OBJ_pilotAttributeType27 OBJ_pilotAttributeType,27L + +#define LN_mXRecord "mXRecord" +#define NID_mXRecord 480 +#define OBJ_mXRecord OBJ_pilotAttributeType,28L + +#define LN_nSRecord "nSRecord" +#define NID_nSRecord 481 +#define OBJ_nSRecord OBJ_pilotAttributeType,29L + +#define LN_sOARecord "sOARecord" +#define NID_sOARecord 482 +#define OBJ_sOARecord OBJ_pilotAttributeType,30L + +#define LN_cNAMERecord "cNAMERecord" +#define NID_cNAMERecord 483 +#define OBJ_cNAMERecord OBJ_pilotAttributeType,31L + +#define LN_associatedDomain "associatedDomain" +#define NID_associatedDomain 484 +#define OBJ_associatedDomain OBJ_pilotAttributeType,37L + +#define LN_associatedName "associatedName" +#define NID_associatedName 485 +#define OBJ_associatedName OBJ_pilotAttributeType,38L + +#define LN_homePostalAddress "homePostalAddress" +#define NID_homePostalAddress 486 +#define OBJ_homePostalAddress OBJ_pilotAttributeType,39L + +#define LN_personalTitle "personalTitle" +#define NID_personalTitle 487 +#define OBJ_personalTitle OBJ_pilotAttributeType,40L + +#define LN_mobileTelephoneNumber "mobileTelephoneNumber" +#define NID_mobileTelephoneNumber 488 +#define OBJ_mobileTelephoneNumber OBJ_pilotAttributeType,41L + +#define LN_pagerTelephoneNumber "pagerTelephoneNumber" +#define NID_pagerTelephoneNumber 489 +#define OBJ_pagerTelephoneNumber OBJ_pilotAttributeType,42L + +#define LN_friendlyCountryName "friendlyCountryName" +#define NID_friendlyCountryName 490 +#define OBJ_friendlyCountryName OBJ_pilotAttributeType,43L + +#define LN_organizationalStatus "organizationalStatus" +#define NID_organizationalStatus 491 +#define OBJ_organizationalStatus OBJ_pilotAttributeType,45L + +#define LN_janetMailbox "janetMailbox" +#define NID_janetMailbox 492 +#define OBJ_janetMailbox OBJ_pilotAttributeType,46L + +#define LN_mailPreferenceOption "mailPreferenceOption" +#define NID_mailPreferenceOption 493 +#define OBJ_mailPreferenceOption OBJ_pilotAttributeType,47L + +#define LN_buildingName "buildingName" +#define NID_buildingName 494 +#define OBJ_buildingName OBJ_pilotAttributeType,48L + +#define LN_dSAQuality "dSAQuality" +#define NID_dSAQuality 495 +#define OBJ_dSAQuality OBJ_pilotAttributeType,49L + +#define LN_singleLevelQuality "singleLevelQuality" +#define NID_singleLevelQuality 496 +#define OBJ_singleLevelQuality OBJ_pilotAttributeType,50L + +#define LN_subtreeMinimumQuality "subtreeMinimumQuality" +#define NID_subtreeMinimumQuality 497 +#define OBJ_subtreeMinimumQuality OBJ_pilotAttributeType,51L + +#define LN_subtreeMaximumQuality "subtreeMaximumQuality" +#define NID_subtreeMaximumQuality 498 +#define OBJ_subtreeMaximumQuality OBJ_pilotAttributeType,52L + +#define LN_personalSignature "personalSignature" +#define NID_personalSignature 499 +#define OBJ_personalSignature OBJ_pilotAttributeType,53L + +#define LN_dITRedirect "dITRedirect" +#define NID_dITRedirect 500 +#define OBJ_dITRedirect OBJ_pilotAttributeType,54L + +#define SN_audio "audio" +#define NID_audio 501 +#define OBJ_audio OBJ_pilotAttributeType,55L + +#define LN_documentPublisher "documentPublisher" +#define NID_documentPublisher 502 +#define OBJ_documentPublisher OBJ_pilotAttributeType,56L + +#define SN_id_set "id-set" +#define LN_id_set "Secure Electronic Transactions" +#define NID_id_set 512 +#define OBJ_id_set OBJ_international_organizations,42L + +#define SN_set_ctype "set-ctype" +#define LN_set_ctype "content types" +#define NID_set_ctype 513 +#define OBJ_set_ctype OBJ_id_set,0L + +#define SN_set_msgExt "set-msgExt" +#define LN_set_msgExt "message extensions" +#define NID_set_msgExt 514 +#define OBJ_set_msgExt OBJ_id_set,1L + +#define SN_set_attr "set-attr" +#define NID_set_attr 515 +#define OBJ_set_attr OBJ_id_set,3L + +#define SN_set_policy "set-policy" +#define NID_set_policy 516 +#define OBJ_set_policy OBJ_id_set,5L + +#define SN_set_certExt "set-certExt" +#define LN_set_certExt "certificate extensions" +#define NID_set_certExt 517 +#define OBJ_set_certExt OBJ_id_set,7L + +#define SN_set_brand "set-brand" +#define NID_set_brand 518 +#define OBJ_set_brand OBJ_id_set,8L + +#define SN_setct_PANData "setct-PANData" +#define NID_setct_PANData 519 +#define OBJ_setct_PANData OBJ_set_ctype,0L + +#define SN_setct_PANToken "setct-PANToken" +#define NID_setct_PANToken 520 +#define OBJ_setct_PANToken OBJ_set_ctype,1L + +#define SN_setct_PANOnly "setct-PANOnly" +#define NID_setct_PANOnly 521 +#define OBJ_setct_PANOnly OBJ_set_ctype,2L + +#define SN_setct_OIData "setct-OIData" +#define NID_setct_OIData 522 +#define OBJ_setct_OIData OBJ_set_ctype,3L + +#define SN_setct_PI "setct-PI" +#define NID_setct_PI 523 +#define OBJ_setct_PI OBJ_set_ctype,4L + +#define SN_setct_PIData "setct-PIData" +#define NID_setct_PIData 524 +#define OBJ_setct_PIData OBJ_set_ctype,5L + +#define SN_setct_PIDataUnsigned "setct-PIDataUnsigned" +#define NID_setct_PIDataUnsigned 525 +#define OBJ_setct_PIDataUnsigned OBJ_set_ctype,6L + +#define SN_setct_HODInput "setct-HODInput" +#define NID_setct_HODInput 526 +#define OBJ_setct_HODInput OBJ_set_ctype,7L + +#define SN_setct_AuthResBaggage "setct-AuthResBaggage" +#define NID_setct_AuthResBaggage 527 +#define OBJ_setct_AuthResBaggage OBJ_set_ctype,8L + +#define SN_setct_AuthRevReqBaggage "setct-AuthRevReqBaggage" +#define NID_setct_AuthRevReqBaggage 528 +#define OBJ_setct_AuthRevReqBaggage OBJ_set_ctype,9L + +#define SN_setct_AuthRevResBaggage "setct-AuthRevResBaggage" +#define NID_setct_AuthRevResBaggage 529 +#define OBJ_setct_AuthRevResBaggage OBJ_set_ctype,10L + +#define SN_setct_CapTokenSeq "setct-CapTokenSeq" +#define NID_setct_CapTokenSeq 530 +#define OBJ_setct_CapTokenSeq OBJ_set_ctype,11L + +#define SN_setct_PInitResData "setct-PInitResData" +#define NID_setct_PInitResData 531 +#define OBJ_setct_PInitResData OBJ_set_ctype,12L + +#define SN_setct_PI_TBS "setct-PI-TBS" +#define NID_setct_PI_TBS 532 +#define OBJ_setct_PI_TBS OBJ_set_ctype,13L + +#define SN_setct_PResData "setct-PResData" +#define NID_setct_PResData 533 +#define OBJ_setct_PResData OBJ_set_ctype,14L + +#define SN_setct_AuthReqTBS "setct-AuthReqTBS" +#define NID_setct_AuthReqTBS 534 +#define OBJ_setct_AuthReqTBS OBJ_set_ctype,16L + +#define SN_setct_AuthResTBS "setct-AuthResTBS" +#define NID_setct_AuthResTBS 535 +#define OBJ_setct_AuthResTBS OBJ_set_ctype,17L + +#define SN_setct_AuthResTBSX "setct-AuthResTBSX" +#define NID_setct_AuthResTBSX 536 +#define OBJ_setct_AuthResTBSX OBJ_set_ctype,18L + +#define SN_setct_AuthTokenTBS "setct-AuthTokenTBS" +#define NID_setct_AuthTokenTBS 537 +#define OBJ_setct_AuthTokenTBS OBJ_set_ctype,19L + +#define SN_setct_CapTokenData "setct-CapTokenData" +#define NID_setct_CapTokenData 538 +#define OBJ_setct_CapTokenData OBJ_set_ctype,20L + +#define SN_setct_CapTokenTBS "setct-CapTokenTBS" +#define NID_setct_CapTokenTBS 539 +#define OBJ_setct_CapTokenTBS OBJ_set_ctype,21L + +#define SN_setct_AcqCardCodeMsg "setct-AcqCardCodeMsg" +#define NID_setct_AcqCardCodeMsg 540 +#define OBJ_setct_AcqCardCodeMsg OBJ_set_ctype,22L + +#define SN_setct_AuthRevReqTBS "setct-AuthRevReqTBS" +#define NID_setct_AuthRevReqTBS 541 +#define OBJ_setct_AuthRevReqTBS OBJ_set_ctype,23L + +#define SN_setct_AuthRevResData "setct-AuthRevResData" +#define NID_setct_AuthRevResData 542 +#define OBJ_setct_AuthRevResData OBJ_set_ctype,24L + +#define SN_setct_AuthRevResTBS "setct-AuthRevResTBS" +#define NID_setct_AuthRevResTBS 543 +#define OBJ_setct_AuthRevResTBS OBJ_set_ctype,25L + +#define SN_setct_CapReqTBS "setct-CapReqTBS" +#define NID_setct_CapReqTBS 544 +#define OBJ_setct_CapReqTBS OBJ_set_ctype,26L + +#define SN_setct_CapReqTBSX "setct-CapReqTBSX" +#define NID_setct_CapReqTBSX 545 +#define OBJ_setct_CapReqTBSX OBJ_set_ctype,27L + +#define SN_setct_CapResData "setct-CapResData" +#define NID_setct_CapResData 546 +#define OBJ_setct_CapResData OBJ_set_ctype,28L + +#define SN_setct_CapRevReqTBS "setct-CapRevReqTBS" +#define NID_setct_CapRevReqTBS 547 +#define OBJ_setct_CapRevReqTBS OBJ_set_ctype,29L + +#define SN_setct_CapRevReqTBSX "setct-CapRevReqTBSX" +#define NID_setct_CapRevReqTBSX 548 +#define OBJ_setct_CapRevReqTBSX OBJ_set_ctype,30L + +#define SN_setct_CapRevResData "setct-CapRevResData" +#define NID_setct_CapRevResData 549 +#define OBJ_setct_CapRevResData OBJ_set_ctype,31L + +#define SN_setct_CredReqTBS "setct-CredReqTBS" +#define NID_setct_CredReqTBS 550 +#define OBJ_setct_CredReqTBS OBJ_set_ctype,32L + +#define SN_setct_CredReqTBSX "setct-CredReqTBSX" +#define NID_setct_CredReqTBSX 551 +#define OBJ_setct_CredReqTBSX OBJ_set_ctype,33L + +#define SN_setct_CredResData "setct-CredResData" +#define NID_setct_CredResData 552 +#define OBJ_setct_CredResData OBJ_set_ctype,34L + +#define SN_setct_CredRevReqTBS "setct-CredRevReqTBS" +#define NID_setct_CredRevReqTBS 553 +#define OBJ_setct_CredRevReqTBS OBJ_set_ctype,35L + +#define SN_setct_CredRevReqTBSX "setct-CredRevReqTBSX" +#define NID_setct_CredRevReqTBSX 554 +#define OBJ_setct_CredRevReqTBSX OBJ_set_ctype,36L + +#define SN_setct_CredRevResData "setct-CredRevResData" +#define NID_setct_CredRevResData 555 +#define OBJ_setct_CredRevResData OBJ_set_ctype,37L + +#define SN_setct_PCertReqData "setct-PCertReqData" +#define NID_setct_PCertReqData 556 +#define OBJ_setct_PCertReqData OBJ_set_ctype,38L + +#define SN_setct_PCertResTBS "setct-PCertResTBS" +#define NID_setct_PCertResTBS 557 +#define OBJ_setct_PCertResTBS OBJ_set_ctype,39L + +#define SN_setct_BatchAdminReqData "setct-BatchAdminReqData" +#define NID_setct_BatchAdminReqData 558 +#define OBJ_setct_BatchAdminReqData OBJ_set_ctype,40L + +#define SN_setct_BatchAdminResData "setct-BatchAdminResData" +#define NID_setct_BatchAdminResData 559 +#define OBJ_setct_BatchAdminResData OBJ_set_ctype,41L + +#define SN_setct_CardCInitResTBS "setct-CardCInitResTBS" +#define NID_setct_CardCInitResTBS 560 +#define OBJ_setct_CardCInitResTBS OBJ_set_ctype,42L + +#define SN_setct_MeAqCInitResTBS "setct-MeAqCInitResTBS" +#define NID_setct_MeAqCInitResTBS 561 +#define OBJ_setct_MeAqCInitResTBS OBJ_set_ctype,43L + +#define SN_setct_RegFormResTBS "setct-RegFormResTBS" +#define NID_setct_RegFormResTBS 562 +#define OBJ_setct_RegFormResTBS OBJ_set_ctype,44L + +#define SN_setct_CertReqData "setct-CertReqData" +#define NID_setct_CertReqData 563 +#define OBJ_setct_CertReqData OBJ_set_ctype,45L + +#define SN_setct_CertReqTBS "setct-CertReqTBS" +#define NID_setct_CertReqTBS 564 +#define OBJ_setct_CertReqTBS OBJ_set_ctype,46L + +#define SN_setct_CertResData "setct-CertResData" +#define NID_setct_CertResData 565 +#define OBJ_setct_CertResData OBJ_set_ctype,47L + +#define SN_setct_CertInqReqTBS "setct-CertInqReqTBS" +#define NID_setct_CertInqReqTBS 566 +#define OBJ_setct_CertInqReqTBS OBJ_set_ctype,48L + +#define SN_setct_ErrorTBS "setct-ErrorTBS" +#define NID_setct_ErrorTBS 567 +#define OBJ_setct_ErrorTBS OBJ_set_ctype,49L + +#define SN_setct_PIDualSignedTBE "setct-PIDualSignedTBE" +#define NID_setct_PIDualSignedTBE 568 +#define OBJ_setct_PIDualSignedTBE OBJ_set_ctype,50L + +#define SN_setct_PIUnsignedTBE "setct-PIUnsignedTBE" +#define NID_setct_PIUnsignedTBE 569 +#define OBJ_setct_PIUnsignedTBE OBJ_set_ctype,51L + +#define SN_setct_AuthReqTBE "setct-AuthReqTBE" +#define NID_setct_AuthReqTBE 570 +#define OBJ_setct_AuthReqTBE OBJ_set_ctype,52L + +#define SN_setct_AuthResTBE "setct-AuthResTBE" +#define NID_setct_AuthResTBE 571 +#define OBJ_setct_AuthResTBE OBJ_set_ctype,53L + +#define SN_setct_AuthResTBEX "setct-AuthResTBEX" +#define NID_setct_AuthResTBEX 572 +#define OBJ_setct_AuthResTBEX OBJ_set_ctype,54L + +#define SN_setct_AuthTokenTBE "setct-AuthTokenTBE" +#define NID_setct_AuthTokenTBE 573 +#define OBJ_setct_AuthTokenTBE OBJ_set_ctype,55L + +#define SN_setct_CapTokenTBE "setct-CapTokenTBE" +#define NID_setct_CapTokenTBE 574 +#define OBJ_setct_CapTokenTBE OBJ_set_ctype,56L + +#define SN_setct_CapTokenTBEX "setct-CapTokenTBEX" +#define NID_setct_CapTokenTBEX 575 +#define OBJ_setct_CapTokenTBEX OBJ_set_ctype,57L + +#define SN_setct_AcqCardCodeMsgTBE "setct-AcqCardCodeMsgTBE" +#define NID_setct_AcqCardCodeMsgTBE 576 +#define OBJ_setct_AcqCardCodeMsgTBE OBJ_set_ctype,58L + +#define SN_setct_AuthRevReqTBE "setct-AuthRevReqTBE" +#define NID_setct_AuthRevReqTBE 577 +#define OBJ_setct_AuthRevReqTBE OBJ_set_ctype,59L + +#define SN_setct_AuthRevResTBE "setct-AuthRevResTBE" +#define NID_setct_AuthRevResTBE 578 +#define OBJ_setct_AuthRevResTBE OBJ_set_ctype,60L + +#define SN_setct_AuthRevResTBEB "setct-AuthRevResTBEB" +#define NID_setct_AuthRevResTBEB 579 +#define OBJ_setct_AuthRevResTBEB OBJ_set_ctype,61L + +#define SN_setct_CapReqTBE "setct-CapReqTBE" +#define NID_setct_CapReqTBE 580 +#define OBJ_setct_CapReqTBE OBJ_set_ctype,62L + +#define SN_setct_CapReqTBEX "setct-CapReqTBEX" +#define NID_setct_CapReqTBEX 581 +#define OBJ_setct_CapReqTBEX OBJ_set_ctype,63L + +#define SN_setct_CapResTBE "setct-CapResTBE" +#define NID_setct_CapResTBE 582 +#define OBJ_setct_CapResTBE OBJ_set_ctype,64L + +#define SN_setct_CapRevReqTBE "setct-CapRevReqTBE" +#define NID_setct_CapRevReqTBE 583 +#define OBJ_setct_CapRevReqTBE OBJ_set_ctype,65L + +#define SN_setct_CapRevReqTBEX "setct-CapRevReqTBEX" +#define NID_setct_CapRevReqTBEX 584 +#define OBJ_setct_CapRevReqTBEX OBJ_set_ctype,66L + +#define SN_setct_CapRevResTBE "setct-CapRevResTBE" +#define NID_setct_CapRevResTBE 585 +#define OBJ_setct_CapRevResTBE OBJ_set_ctype,67L + +#define SN_setct_CredReqTBE "setct-CredReqTBE" +#define NID_setct_CredReqTBE 586 +#define OBJ_setct_CredReqTBE OBJ_set_ctype,68L + +#define SN_setct_CredReqTBEX "setct-CredReqTBEX" +#define NID_setct_CredReqTBEX 587 +#define OBJ_setct_CredReqTBEX OBJ_set_ctype,69L + +#define SN_setct_CredResTBE "setct-CredResTBE" +#define NID_setct_CredResTBE 588 +#define OBJ_setct_CredResTBE OBJ_set_ctype,70L + +#define SN_setct_CredRevReqTBE "setct-CredRevReqTBE" +#define NID_setct_CredRevReqTBE 589 +#define OBJ_setct_CredRevReqTBE OBJ_set_ctype,71L + +#define SN_setct_CredRevReqTBEX "setct-CredRevReqTBEX" +#define NID_setct_CredRevReqTBEX 590 +#define OBJ_setct_CredRevReqTBEX OBJ_set_ctype,72L + +#define SN_setct_CredRevResTBE "setct-CredRevResTBE" +#define NID_setct_CredRevResTBE 591 +#define OBJ_setct_CredRevResTBE OBJ_set_ctype,73L + +#define SN_setct_BatchAdminReqTBE "setct-BatchAdminReqTBE" +#define NID_setct_BatchAdminReqTBE 592 +#define OBJ_setct_BatchAdminReqTBE OBJ_set_ctype,74L + +#define SN_setct_BatchAdminResTBE "setct-BatchAdminResTBE" +#define NID_setct_BatchAdminResTBE 593 +#define OBJ_setct_BatchAdminResTBE OBJ_set_ctype,75L + +#define SN_setct_RegFormReqTBE "setct-RegFormReqTBE" +#define NID_setct_RegFormReqTBE 594 +#define OBJ_setct_RegFormReqTBE OBJ_set_ctype,76L + +#define SN_setct_CertReqTBE "setct-CertReqTBE" +#define NID_setct_CertReqTBE 595 +#define OBJ_setct_CertReqTBE OBJ_set_ctype,77L + +#define SN_setct_CertReqTBEX "setct-CertReqTBEX" +#define NID_setct_CertReqTBEX 596 +#define OBJ_setct_CertReqTBEX OBJ_set_ctype,78L + +#define SN_setct_CertResTBE "setct-CertResTBE" +#define NID_setct_CertResTBE 597 +#define OBJ_setct_CertResTBE OBJ_set_ctype,79L + +#define SN_setct_CRLNotificationTBS "setct-CRLNotificationTBS" +#define NID_setct_CRLNotificationTBS 598 +#define OBJ_setct_CRLNotificationTBS OBJ_set_ctype,80L + +#define SN_setct_CRLNotificationResTBS "setct-CRLNotificationResTBS" +#define NID_setct_CRLNotificationResTBS 599 +#define OBJ_setct_CRLNotificationResTBS OBJ_set_ctype,81L + +#define SN_setct_BCIDistributionTBS "setct-BCIDistributionTBS" +#define NID_setct_BCIDistributionTBS 600 +#define OBJ_setct_BCIDistributionTBS OBJ_set_ctype,82L + +#define SN_setext_genCrypt "setext-genCrypt" +#define LN_setext_genCrypt "generic cryptogram" +#define NID_setext_genCrypt 601 +#define OBJ_setext_genCrypt OBJ_set_msgExt,1L + +#define SN_setext_miAuth "setext-miAuth" +#define LN_setext_miAuth "merchant initiated auth" +#define NID_setext_miAuth 602 +#define OBJ_setext_miAuth OBJ_set_msgExt,3L + +#define SN_setext_pinSecure "setext-pinSecure" +#define NID_setext_pinSecure 603 +#define OBJ_setext_pinSecure OBJ_set_msgExt,4L + +#define SN_setext_pinAny "setext-pinAny" +#define NID_setext_pinAny 604 +#define OBJ_setext_pinAny OBJ_set_msgExt,5L + +#define SN_setext_track2 "setext-track2" +#define NID_setext_track2 605 +#define OBJ_setext_track2 OBJ_set_msgExt,7L + +#define SN_setext_cv "setext-cv" +#define LN_setext_cv "additional verification" +#define NID_setext_cv 606 +#define OBJ_setext_cv OBJ_set_msgExt,8L + +#define SN_set_policy_root "set-policy-root" +#define NID_set_policy_root 607 +#define OBJ_set_policy_root OBJ_set_policy,0L + +#define SN_setCext_hashedRoot "setCext-hashedRoot" +#define NID_setCext_hashedRoot 608 +#define OBJ_setCext_hashedRoot OBJ_set_certExt,0L + +#define SN_setCext_certType "setCext-certType" +#define NID_setCext_certType 609 +#define OBJ_setCext_certType OBJ_set_certExt,1L + +#define SN_setCext_merchData "setCext-merchData" +#define NID_setCext_merchData 610 +#define OBJ_setCext_merchData OBJ_set_certExt,2L + +#define SN_setCext_cCertRequired "setCext-cCertRequired" +#define NID_setCext_cCertRequired 611 +#define OBJ_setCext_cCertRequired OBJ_set_certExt,3L + +#define SN_setCext_tunneling "setCext-tunneling" +#define NID_setCext_tunneling 612 +#define OBJ_setCext_tunneling OBJ_set_certExt,4L + +#define SN_setCext_setExt "setCext-setExt" +#define NID_setCext_setExt 613 +#define OBJ_setCext_setExt OBJ_set_certExt,5L + +#define SN_setCext_setQualf "setCext-setQualf" +#define NID_setCext_setQualf 614 +#define OBJ_setCext_setQualf OBJ_set_certExt,6L + +#define SN_setCext_PGWYcapabilities "setCext-PGWYcapabilities" +#define NID_setCext_PGWYcapabilities 615 +#define OBJ_setCext_PGWYcapabilities OBJ_set_certExt,7L + +#define SN_setCext_TokenIdentifier "setCext-TokenIdentifier" +#define NID_setCext_TokenIdentifier 616 +#define OBJ_setCext_TokenIdentifier OBJ_set_certExt,8L + +#define SN_setCext_Track2Data "setCext-Track2Data" +#define NID_setCext_Track2Data 617 +#define OBJ_setCext_Track2Data OBJ_set_certExt,9L + +#define SN_setCext_TokenType "setCext-TokenType" +#define NID_setCext_TokenType 618 +#define OBJ_setCext_TokenType OBJ_set_certExt,10L + +#define SN_setCext_IssuerCapabilities "setCext-IssuerCapabilities" +#define NID_setCext_IssuerCapabilities 619 +#define OBJ_setCext_IssuerCapabilities OBJ_set_certExt,11L + +#define SN_setAttr_Cert "setAttr-Cert" +#define NID_setAttr_Cert 620 +#define OBJ_setAttr_Cert OBJ_set_attr,0L + +#define SN_setAttr_PGWYcap "setAttr-PGWYcap" +#define LN_setAttr_PGWYcap "payment gateway capabilities" +#define NID_setAttr_PGWYcap 621 +#define OBJ_setAttr_PGWYcap OBJ_set_attr,1L + +#define SN_setAttr_TokenType "setAttr-TokenType" +#define NID_setAttr_TokenType 622 +#define OBJ_setAttr_TokenType OBJ_set_attr,2L + +#define SN_setAttr_IssCap "setAttr-IssCap" +#define LN_setAttr_IssCap "issuer capabilities" +#define NID_setAttr_IssCap 623 +#define OBJ_setAttr_IssCap OBJ_set_attr,3L + +#define SN_set_rootKeyThumb "set-rootKeyThumb" +#define NID_set_rootKeyThumb 624 +#define OBJ_set_rootKeyThumb OBJ_setAttr_Cert,0L + +#define SN_set_addPolicy "set-addPolicy" +#define NID_set_addPolicy 625 +#define OBJ_set_addPolicy OBJ_setAttr_Cert,1L + +#define SN_setAttr_Token_EMV "setAttr-Token-EMV" +#define NID_setAttr_Token_EMV 626 +#define OBJ_setAttr_Token_EMV OBJ_setAttr_TokenType,1L + +#define SN_setAttr_Token_B0Prime "setAttr-Token-B0Prime" +#define NID_setAttr_Token_B0Prime 627 +#define OBJ_setAttr_Token_B0Prime OBJ_setAttr_TokenType,2L + +#define SN_setAttr_IssCap_CVM "setAttr-IssCap-CVM" +#define NID_setAttr_IssCap_CVM 628 +#define OBJ_setAttr_IssCap_CVM OBJ_setAttr_IssCap,3L + +#define SN_setAttr_IssCap_T2 "setAttr-IssCap-T2" +#define NID_setAttr_IssCap_T2 629 +#define OBJ_setAttr_IssCap_T2 OBJ_setAttr_IssCap,4L + +#define SN_setAttr_IssCap_Sig "setAttr-IssCap-Sig" +#define NID_setAttr_IssCap_Sig 630 +#define OBJ_setAttr_IssCap_Sig OBJ_setAttr_IssCap,5L + +#define SN_setAttr_GenCryptgrm "setAttr-GenCryptgrm" +#define LN_setAttr_GenCryptgrm "generate cryptogram" +#define NID_setAttr_GenCryptgrm 631 +#define OBJ_setAttr_GenCryptgrm OBJ_setAttr_IssCap_CVM,1L + +#define SN_setAttr_T2Enc "setAttr-T2Enc" +#define LN_setAttr_T2Enc "encrypted track 2" +#define NID_setAttr_T2Enc 632 +#define OBJ_setAttr_T2Enc OBJ_setAttr_IssCap_T2,1L + +#define SN_setAttr_T2cleartxt "setAttr-T2cleartxt" +#define LN_setAttr_T2cleartxt "cleartext track 2" +#define NID_setAttr_T2cleartxt 633 +#define OBJ_setAttr_T2cleartxt OBJ_setAttr_IssCap_T2,2L + +#define SN_setAttr_TokICCsig "setAttr-TokICCsig" +#define LN_setAttr_TokICCsig "ICC or token signature" +#define NID_setAttr_TokICCsig 634 +#define OBJ_setAttr_TokICCsig OBJ_setAttr_IssCap_Sig,1L + +#define SN_setAttr_SecDevSig "setAttr-SecDevSig" +#define LN_setAttr_SecDevSig "secure device signature" +#define NID_setAttr_SecDevSig 635 +#define OBJ_setAttr_SecDevSig OBJ_setAttr_IssCap_Sig,2L + +#define SN_set_brand_IATA_ATA "set-brand-IATA-ATA" +#define NID_set_brand_IATA_ATA 636 +#define OBJ_set_brand_IATA_ATA OBJ_set_brand,1L + +#define SN_set_brand_Diners "set-brand-Diners" +#define NID_set_brand_Diners 637 +#define OBJ_set_brand_Diners OBJ_set_brand,30L + +#define SN_set_brand_AmericanExpress "set-brand-AmericanExpress" +#define NID_set_brand_AmericanExpress 638 +#define OBJ_set_brand_AmericanExpress OBJ_set_brand,34L + +#define SN_set_brand_JCB "set-brand-JCB" +#define NID_set_brand_JCB 639 +#define OBJ_set_brand_JCB OBJ_set_brand,35L + +#define SN_set_brand_Visa "set-brand-Visa" +#define NID_set_brand_Visa 640 +#define OBJ_set_brand_Visa OBJ_set_brand,4L + +#define SN_set_brand_MasterCard "set-brand-MasterCard" +#define NID_set_brand_MasterCard 641 +#define OBJ_set_brand_MasterCard OBJ_set_brand,5L + +#define SN_set_brand_Novus "set-brand-Novus" +#define NID_set_brand_Novus 642 +#define OBJ_set_brand_Novus OBJ_set_brand,6011L + +#define SN_des_cdmf "DES-CDMF" +#define LN_des_cdmf "des-cdmf" +#define NID_des_cdmf 643 +#define OBJ_des_cdmf OBJ_rsadsi,3L,10L + +#define SN_rsaOAEPEncryptionSET "rsaOAEPEncryptionSET" +#define NID_rsaOAEPEncryptionSET 644 +#define OBJ_rsaOAEPEncryptionSET OBJ_rsadsi,1L,1L,6L + +#define SN_ipsec3 "Oakley-EC2N-3" +#define LN_ipsec3 "ipsec3" +#define NID_ipsec3 749 + +#define SN_ipsec4 "Oakley-EC2N-4" +#define LN_ipsec4 "ipsec4" +#define NID_ipsec4 750 + +#define SN_whirlpool "whirlpool" +#define NID_whirlpool 804 +#define OBJ_whirlpool OBJ_iso,0L,10118L,3L,0L,55L + +#define SN_cryptopro "cryptopro" +#define NID_cryptopro 805 +#define OBJ_cryptopro OBJ_member_body,643L,2L,2L + +#define SN_cryptocom "cryptocom" +#define NID_cryptocom 806 +#define OBJ_cryptocom OBJ_member_body,643L,2L,9L + +#define SN_id_GostR3411_94_with_GostR3410_2001 "id-GostR3411-94-with-GostR3410-2001" +#define LN_id_GostR3411_94_with_GostR3410_2001 "GOST R 34.11-94 with GOST R 34.10-2001" +#define NID_id_GostR3411_94_with_GostR3410_2001 807 +#define OBJ_id_GostR3411_94_with_GostR3410_2001 OBJ_cryptopro,3L + +#define SN_id_GostR3411_94_with_GostR3410_94 "id-GostR3411-94-with-GostR3410-94" +#define LN_id_GostR3411_94_with_GostR3410_94 "GOST R 34.11-94 with GOST R 34.10-94" +#define NID_id_GostR3411_94_with_GostR3410_94 808 +#define OBJ_id_GostR3411_94_with_GostR3410_94 OBJ_cryptopro,4L + +#define SN_id_GostR3411_94 "md_gost94" +#define LN_id_GostR3411_94 "GOST R 34.11-94" +#define NID_id_GostR3411_94 809 +#define OBJ_id_GostR3411_94 OBJ_cryptopro,9L + +#define SN_id_HMACGostR3411_94 "id-HMACGostR3411-94" +#define LN_id_HMACGostR3411_94 "HMAC GOST 34.11-94" +#define NID_id_HMACGostR3411_94 810 +#define OBJ_id_HMACGostR3411_94 OBJ_cryptopro,10L + +#define SN_id_GostR3410_2001 "gost2001" +#define LN_id_GostR3410_2001 "GOST R 34.10-2001" +#define NID_id_GostR3410_2001 811 +#define OBJ_id_GostR3410_2001 OBJ_cryptopro,19L + +#define SN_id_GostR3410_94 "gost94" +#define LN_id_GostR3410_94 "GOST R 34.10-94" +#define NID_id_GostR3410_94 812 +#define OBJ_id_GostR3410_94 OBJ_cryptopro,20L + +#define SN_id_Gost28147_89 "gost89" +#define LN_id_Gost28147_89 "GOST 28147-89" +#define NID_id_Gost28147_89 813 +#define OBJ_id_Gost28147_89 OBJ_cryptopro,21L + +#define SN_gost89_cnt "gost89-cnt" +#define NID_gost89_cnt 814 + +#define SN_id_Gost28147_89_MAC "gost-mac" +#define LN_id_Gost28147_89_MAC "GOST 28147-89 MAC" +#define NID_id_Gost28147_89_MAC 815 +#define OBJ_id_Gost28147_89_MAC OBJ_cryptopro,22L + +#define SN_id_GostR3411_94_prf "prf-gostr3411-94" +#define LN_id_GostR3411_94_prf "GOST R 34.11-94 PRF" +#define NID_id_GostR3411_94_prf 816 +#define OBJ_id_GostR3411_94_prf OBJ_cryptopro,23L + +#define SN_id_GostR3410_2001DH "id-GostR3410-2001DH" +#define LN_id_GostR3410_2001DH "GOST R 34.10-2001 DH" +#define NID_id_GostR3410_2001DH 817 +#define OBJ_id_GostR3410_2001DH OBJ_cryptopro,98L + +#define SN_id_GostR3410_94DH "id-GostR3410-94DH" +#define LN_id_GostR3410_94DH "GOST R 34.10-94 DH" +#define NID_id_GostR3410_94DH 818 +#define OBJ_id_GostR3410_94DH OBJ_cryptopro,99L + +#define SN_id_Gost28147_89_CryptoPro_KeyMeshing "id-Gost28147-89-CryptoPro-KeyMeshing" +#define NID_id_Gost28147_89_CryptoPro_KeyMeshing 819 +#define OBJ_id_Gost28147_89_CryptoPro_KeyMeshing OBJ_cryptopro,14L,1L + +#define SN_id_Gost28147_89_None_KeyMeshing "id-Gost28147-89-None-KeyMeshing" +#define NID_id_Gost28147_89_None_KeyMeshing 820 +#define OBJ_id_Gost28147_89_None_KeyMeshing OBJ_cryptopro,14L,0L + +#define SN_id_GostR3411_94_TestParamSet "id-GostR3411-94-TestParamSet" +#define NID_id_GostR3411_94_TestParamSet 821 +#define OBJ_id_GostR3411_94_TestParamSet OBJ_cryptopro,30L,0L + +#define SN_id_GostR3411_94_CryptoProParamSet "id-GostR3411-94-CryptoProParamSet" +#define NID_id_GostR3411_94_CryptoProParamSet 822 +#define OBJ_id_GostR3411_94_CryptoProParamSet OBJ_cryptopro,30L,1L + +#define SN_id_Gost28147_89_TestParamSet "id-Gost28147-89-TestParamSet" +#define NID_id_Gost28147_89_TestParamSet 823 +#define OBJ_id_Gost28147_89_TestParamSet OBJ_cryptopro,31L,0L + +#define SN_id_Gost28147_89_CryptoPro_A_ParamSet "id-Gost28147-89-CryptoPro-A-ParamSet" +#define NID_id_Gost28147_89_CryptoPro_A_ParamSet 824 +#define OBJ_id_Gost28147_89_CryptoPro_A_ParamSet OBJ_cryptopro,31L,1L + +#define SN_id_Gost28147_89_CryptoPro_B_ParamSet "id-Gost28147-89-CryptoPro-B-ParamSet" +#define NID_id_Gost28147_89_CryptoPro_B_ParamSet 825 +#define OBJ_id_Gost28147_89_CryptoPro_B_ParamSet OBJ_cryptopro,31L,2L + +#define SN_id_Gost28147_89_CryptoPro_C_ParamSet "id-Gost28147-89-CryptoPro-C-ParamSet" +#define NID_id_Gost28147_89_CryptoPro_C_ParamSet 826 +#define OBJ_id_Gost28147_89_CryptoPro_C_ParamSet OBJ_cryptopro,31L,3L + +#define SN_id_Gost28147_89_CryptoPro_D_ParamSet "id-Gost28147-89-CryptoPro-D-ParamSet" +#define NID_id_Gost28147_89_CryptoPro_D_ParamSet 827 +#define OBJ_id_Gost28147_89_CryptoPro_D_ParamSet OBJ_cryptopro,31L,4L + +#define SN_id_Gost28147_89_CryptoPro_Oscar_1_1_ParamSet "id-Gost28147-89-CryptoPro-Oscar-1-1-ParamSet" +#define NID_id_Gost28147_89_CryptoPro_Oscar_1_1_ParamSet 828 +#define OBJ_id_Gost28147_89_CryptoPro_Oscar_1_1_ParamSet OBJ_cryptopro,31L,5L + +#define SN_id_Gost28147_89_CryptoPro_Oscar_1_0_ParamSet "id-Gost28147-89-CryptoPro-Oscar-1-0-ParamSet" +#define NID_id_Gost28147_89_CryptoPro_Oscar_1_0_ParamSet 829 +#define OBJ_id_Gost28147_89_CryptoPro_Oscar_1_0_ParamSet OBJ_cryptopro,31L,6L + +#define SN_id_Gost28147_89_CryptoPro_RIC_1_ParamSet "id-Gost28147-89-CryptoPro-RIC-1-ParamSet" +#define NID_id_Gost28147_89_CryptoPro_RIC_1_ParamSet 830 +#define OBJ_id_Gost28147_89_CryptoPro_RIC_1_ParamSet OBJ_cryptopro,31L,7L + +#define SN_id_GostR3410_94_TestParamSet "id-GostR3410-94-TestParamSet" +#define NID_id_GostR3410_94_TestParamSet 831 +#define OBJ_id_GostR3410_94_TestParamSet OBJ_cryptopro,32L,0L + +#define SN_id_GostR3410_94_CryptoPro_A_ParamSet "id-GostR3410-94-CryptoPro-A-ParamSet" +#define NID_id_GostR3410_94_CryptoPro_A_ParamSet 832 +#define OBJ_id_GostR3410_94_CryptoPro_A_ParamSet OBJ_cryptopro,32L,2L + +#define SN_id_GostR3410_94_CryptoPro_B_ParamSet "id-GostR3410-94-CryptoPro-B-ParamSet" +#define NID_id_GostR3410_94_CryptoPro_B_ParamSet 833 +#define OBJ_id_GostR3410_94_CryptoPro_B_ParamSet OBJ_cryptopro,32L,3L + +#define SN_id_GostR3410_94_CryptoPro_C_ParamSet "id-GostR3410-94-CryptoPro-C-ParamSet" +#define NID_id_GostR3410_94_CryptoPro_C_ParamSet 834 +#define OBJ_id_GostR3410_94_CryptoPro_C_ParamSet OBJ_cryptopro,32L,4L + +#define SN_id_GostR3410_94_CryptoPro_D_ParamSet "id-GostR3410-94-CryptoPro-D-ParamSet" +#define NID_id_GostR3410_94_CryptoPro_D_ParamSet 835 +#define OBJ_id_GostR3410_94_CryptoPro_D_ParamSet OBJ_cryptopro,32L,5L + +#define SN_id_GostR3410_94_CryptoPro_XchA_ParamSet "id-GostR3410-94-CryptoPro-XchA-ParamSet" +#define NID_id_GostR3410_94_CryptoPro_XchA_ParamSet 836 +#define OBJ_id_GostR3410_94_CryptoPro_XchA_ParamSet OBJ_cryptopro,33L,1L + +#define SN_id_GostR3410_94_CryptoPro_XchB_ParamSet "id-GostR3410-94-CryptoPro-XchB-ParamSet" +#define NID_id_GostR3410_94_CryptoPro_XchB_ParamSet 837 +#define OBJ_id_GostR3410_94_CryptoPro_XchB_ParamSet OBJ_cryptopro,33L,2L + +#define SN_id_GostR3410_94_CryptoPro_XchC_ParamSet "id-GostR3410-94-CryptoPro-XchC-ParamSet" +#define NID_id_GostR3410_94_CryptoPro_XchC_ParamSet 838 +#define OBJ_id_GostR3410_94_CryptoPro_XchC_ParamSet OBJ_cryptopro,33L,3L + +#define SN_id_GostR3410_2001_TestParamSet "id-GostR3410-2001-TestParamSet" +#define NID_id_GostR3410_2001_TestParamSet 839 +#define OBJ_id_GostR3410_2001_TestParamSet OBJ_cryptopro,35L,0L + +#define SN_id_GostR3410_2001_CryptoPro_A_ParamSet "id-GostR3410-2001-CryptoPro-A-ParamSet" +#define NID_id_GostR3410_2001_CryptoPro_A_ParamSet 840 +#define OBJ_id_GostR3410_2001_CryptoPro_A_ParamSet OBJ_cryptopro,35L,1L + +#define SN_id_GostR3410_2001_CryptoPro_B_ParamSet "id-GostR3410-2001-CryptoPro-B-ParamSet" +#define NID_id_GostR3410_2001_CryptoPro_B_ParamSet 841 +#define OBJ_id_GostR3410_2001_CryptoPro_B_ParamSet OBJ_cryptopro,35L,2L + +#define SN_id_GostR3410_2001_CryptoPro_C_ParamSet "id-GostR3410-2001-CryptoPro-C-ParamSet" +#define NID_id_GostR3410_2001_CryptoPro_C_ParamSet 842 +#define OBJ_id_GostR3410_2001_CryptoPro_C_ParamSet OBJ_cryptopro,35L,3L + +#define SN_id_GostR3410_2001_CryptoPro_XchA_ParamSet "id-GostR3410-2001-CryptoPro-XchA-ParamSet" +#define NID_id_GostR3410_2001_CryptoPro_XchA_ParamSet 843 +#define OBJ_id_GostR3410_2001_CryptoPro_XchA_ParamSet OBJ_cryptopro,36L,0L + +#define SN_id_GostR3410_2001_CryptoPro_XchB_ParamSet "id-GostR3410-2001-CryptoPro-XchB-ParamSet" +#define NID_id_GostR3410_2001_CryptoPro_XchB_ParamSet 844 +#define OBJ_id_GostR3410_2001_CryptoPro_XchB_ParamSet OBJ_cryptopro,36L,1L + +#define SN_id_GostR3410_94_a "id-GostR3410-94-a" +#define NID_id_GostR3410_94_a 845 +#define OBJ_id_GostR3410_94_a OBJ_id_GostR3410_94,1L + +#define SN_id_GostR3410_94_aBis "id-GostR3410-94-aBis" +#define NID_id_GostR3410_94_aBis 846 +#define OBJ_id_GostR3410_94_aBis OBJ_id_GostR3410_94,2L + +#define SN_id_GostR3410_94_b "id-GostR3410-94-b" +#define NID_id_GostR3410_94_b 847 +#define OBJ_id_GostR3410_94_b OBJ_id_GostR3410_94,3L + +#define SN_id_GostR3410_94_bBis "id-GostR3410-94-bBis" +#define NID_id_GostR3410_94_bBis 848 +#define OBJ_id_GostR3410_94_bBis OBJ_id_GostR3410_94,4L + +#define SN_id_Gost28147_89_cc "id-Gost28147-89-cc" +#define LN_id_Gost28147_89_cc "GOST 28147-89 Cryptocom ParamSet" +#define NID_id_Gost28147_89_cc 849 +#define OBJ_id_Gost28147_89_cc OBJ_cryptocom,1L,6L,1L + +#define SN_id_GostR3410_94_cc "gost94cc" +#define LN_id_GostR3410_94_cc "GOST 34.10-94 Cryptocom" +#define NID_id_GostR3410_94_cc 850 +#define OBJ_id_GostR3410_94_cc OBJ_cryptocom,1L,5L,3L + +#define SN_id_GostR3410_2001_cc "gost2001cc" +#define LN_id_GostR3410_2001_cc "GOST 34.10-2001 Cryptocom" +#define NID_id_GostR3410_2001_cc 851 +#define OBJ_id_GostR3410_2001_cc OBJ_cryptocom,1L,5L,4L + +#define SN_id_GostR3411_94_with_GostR3410_94_cc "id-GostR3411-94-with-GostR3410-94-cc" +#define LN_id_GostR3411_94_with_GostR3410_94_cc "GOST R 34.11-94 with GOST R 34.10-94 Cryptocom" +#define NID_id_GostR3411_94_with_GostR3410_94_cc 852 +#define OBJ_id_GostR3411_94_with_GostR3410_94_cc OBJ_cryptocom,1L,3L,3L + +#define SN_id_GostR3411_94_with_GostR3410_2001_cc "id-GostR3411-94-with-GostR3410-2001-cc" +#define LN_id_GostR3411_94_with_GostR3410_2001_cc "GOST R 34.11-94 with GOST R 34.10-2001 Cryptocom" +#define NID_id_GostR3411_94_with_GostR3410_2001_cc 853 +#define OBJ_id_GostR3411_94_with_GostR3410_2001_cc OBJ_cryptocom,1L,3L,4L + +#define SN_id_GostR3410_2001_ParamSet_cc "id-GostR3410-2001-ParamSet-cc" +#define LN_id_GostR3410_2001_ParamSet_cc "GOST R 3410-2001 Parameter Set Cryptocom" +#define NID_id_GostR3410_2001_ParamSet_cc 854 +#define OBJ_id_GostR3410_2001_ParamSet_cc OBJ_cryptocom,1L,8L,1L + +#define SN_sm3 "SM3" +#define LN_sm3 "sm3" +#define NID_sm3 968 +#define OBJ_sm3 1L,2L,156L,10197L,1L,401L + +#define SN_sm3WithRSAEncryption "RSA-SM3" +#define LN_sm3WithRSAEncryption "sm3WithRSAEncryption" +#define NID_sm3WithRSAEncryption 969 +#define OBJ_sm3WithRSAEncryption 1L,2L,156L,10197L,1L,504L + +#define SN_camellia_128_cbc "CAMELLIA-128-CBC" +#define LN_camellia_128_cbc "camellia-128-cbc" +#define NID_camellia_128_cbc 751 +#define OBJ_camellia_128_cbc 1L,2L,392L,200011L,61L,1L,1L,1L,2L + +#define SN_camellia_192_cbc "CAMELLIA-192-CBC" +#define LN_camellia_192_cbc "camellia-192-cbc" +#define NID_camellia_192_cbc 752 +#define OBJ_camellia_192_cbc 1L,2L,392L,200011L,61L,1L,1L,1L,3L + +#define SN_camellia_256_cbc "CAMELLIA-256-CBC" +#define LN_camellia_256_cbc "camellia-256-cbc" +#define NID_camellia_256_cbc 753 +#define OBJ_camellia_256_cbc 1L,2L,392L,200011L,61L,1L,1L,1L,4L + +#define SN_id_camellia128_wrap "id-camellia128-wrap" +#define NID_id_camellia128_wrap 907 +#define OBJ_id_camellia128_wrap 1L,2L,392L,200011L,61L,1L,1L,3L,2L + +#define SN_id_camellia192_wrap "id-camellia192-wrap" +#define NID_id_camellia192_wrap 908 +#define OBJ_id_camellia192_wrap 1L,2L,392L,200011L,61L,1L,1L,3L,3L + +#define SN_id_camellia256_wrap "id-camellia256-wrap" +#define NID_id_camellia256_wrap 909 +#define OBJ_id_camellia256_wrap 1L,2L,392L,200011L,61L,1L,1L,3L,4L + +#define OBJ_ntt_ds 0L,3L,4401L,5L + +#define OBJ_camellia OBJ_ntt_ds,3L,1L,9L + +#define SN_camellia_128_ecb "CAMELLIA-128-ECB" +#define LN_camellia_128_ecb "camellia-128-ecb" +#define NID_camellia_128_ecb 754 +#define OBJ_camellia_128_ecb OBJ_camellia,1L + +#define SN_camellia_128_ofb128 "CAMELLIA-128-OFB" +#define LN_camellia_128_ofb128 "camellia-128-ofb" +#define NID_camellia_128_ofb128 766 +#define OBJ_camellia_128_ofb128 OBJ_camellia,3L + +#define SN_camellia_128_cfb128 "CAMELLIA-128-CFB" +#define LN_camellia_128_cfb128 "camellia-128-cfb" +#define NID_camellia_128_cfb128 757 +#define OBJ_camellia_128_cfb128 OBJ_camellia,4L + +#define SN_camellia_192_ecb "CAMELLIA-192-ECB" +#define LN_camellia_192_ecb "camellia-192-ecb" +#define NID_camellia_192_ecb 755 +#define OBJ_camellia_192_ecb OBJ_camellia,21L + +#define SN_camellia_192_ofb128 "CAMELLIA-192-OFB" +#define LN_camellia_192_ofb128 "camellia-192-ofb" +#define NID_camellia_192_ofb128 767 +#define OBJ_camellia_192_ofb128 OBJ_camellia,23L + +#define SN_camellia_192_cfb128 "CAMELLIA-192-CFB" +#define LN_camellia_192_cfb128 "camellia-192-cfb" +#define NID_camellia_192_cfb128 758 +#define OBJ_camellia_192_cfb128 OBJ_camellia,24L + +#define SN_camellia_256_ecb "CAMELLIA-256-ECB" +#define LN_camellia_256_ecb "camellia-256-ecb" +#define NID_camellia_256_ecb 756 +#define OBJ_camellia_256_ecb OBJ_camellia,41L + +#define SN_camellia_256_ofb128 "CAMELLIA-256-OFB" +#define LN_camellia_256_ofb128 "camellia-256-ofb" +#define NID_camellia_256_ofb128 768 +#define OBJ_camellia_256_ofb128 OBJ_camellia,43L + +#define SN_camellia_256_cfb128 "CAMELLIA-256-CFB" +#define LN_camellia_256_cfb128 "camellia-256-cfb" +#define NID_camellia_256_cfb128 759 +#define OBJ_camellia_256_cfb128 OBJ_camellia,44L + +#define SN_camellia_128_cfb1 "CAMELLIA-128-CFB1" +#define LN_camellia_128_cfb1 "camellia-128-cfb1" +#define NID_camellia_128_cfb1 760 + +#define SN_camellia_192_cfb1 "CAMELLIA-192-CFB1" +#define LN_camellia_192_cfb1 "camellia-192-cfb1" +#define NID_camellia_192_cfb1 761 + +#define SN_camellia_256_cfb1 "CAMELLIA-256-CFB1" +#define LN_camellia_256_cfb1 "camellia-256-cfb1" +#define NID_camellia_256_cfb1 762 + +#define SN_camellia_128_cfb8 "CAMELLIA-128-CFB8" +#define LN_camellia_128_cfb8 "camellia-128-cfb8" +#define NID_camellia_128_cfb8 763 + +#define SN_camellia_192_cfb8 "CAMELLIA-192-CFB8" +#define LN_camellia_192_cfb8 "camellia-192-cfb8" +#define NID_camellia_192_cfb8 764 + +#define SN_camellia_256_cfb8 "CAMELLIA-256-CFB8" +#define LN_camellia_256_cfb8 "camellia-256-cfb8" +#define NID_camellia_256_cfb8 765 + +#define SN_kisa "KISA" +#define LN_kisa "kisa" +#define NID_kisa 773 +#define OBJ_kisa OBJ_member_body,410L,200004L + +#define SN_seed_ecb "SEED-ECB" +#define LN_seed_ecb "seed-ecb" +#define NID_seed_ecb 776 +#define OBJ_seed_ecb OBJ_kisa,1L,3L + +#define SN_seed_cbc "SEED-CBC" +#define LN_seed_cbc "seed-cbc" +#define NID_seed_cbc 777 +#define OBJ_seed_cbc OBJ_kisa,1L,4L + +#define SN_seed_cfb128 "SEED-CFB" +#define LN_seed_cfb128 "seed-cfb" +#define NID_seed_cfb128 779 +#define OBJ_seed_cfb128 OBJ_kisa,1L,5L + +#define SN_seed_ofb128 "SEED-OFB" +#define LN_seed_ofb128 "seed-ofb" +#define NID_seed_ofb128 778 +#define OBJ_seed_ofb128 OBJ_kisa,1L,6L + +#define SN_ISO_CN "ISO-CN" +#define LN_ISO_CN "ISO CN Member Body" +#define NID_ISO_CN 970 +#define OBJ_ISO_CN OBJ_member_body,156L + +#define SN_oscca "oscca" +#define NID_oscca 971 +#define OBJ_oscca OBJ_ISO_CN,10197L + +#define SN_sm_scheme "sm-scheme" +#define NID_sm_scheme 972 +#define OBJ_sm_scheme OBJ_oscca,1L + +#define SN_sm4_ecb "SM4-ECB" +#define LN_sm4_ecb "sm4-ecb" +#define NID_sm4_ecb 973 +#define OBJ_sm4_ecb OBJ_sm_scheme,104L,1L + +#define SN_sm4_cbc "SM4-CBC" +#define LN_sm4_cbc "sm4-cbc" +#define NID_sm4_cbc 974 +#define OBJ_sm4_cbc OBJ_sm_scheme,104L,2L + +#define SN_sm4_ofb128 "SM4-OFB" +#define LN_sm4_ofb128 "sm4-ofb" +#define NID_sm4_ofb128 975 +#define OBJ_sm4_ofb128 OBJ_sm_scheme,104L,3L + +#define SN_sm4_cfb128 "SM4-CFB" +#define LN_sm4_cfb128 "sm4-cfb" +#define NID_sm4_cfb128 976 +#define OBJ_sm4_cfb128 OBJ_sm_scheme,104L,4L + +#define SN_sm4_cfb1 "SM4-CFB1" +#define LN_sm4_cfb1 "sm4-cfb1" +#define NID_sm4_cfb1 977 +#define OBJ_sm4_cfb1 OBJ_sm_scheme,104L,5L + +#define SN_sm4_cfb8 "SM4-CFB8" +#define LN_sm4_cfb8 "sm4-cfb8" +#define NID_sm4_cfb8 978 +#define OBJ_sm4_cfb8 OBJ_sm_scheme,104L,6L + +#define SN_sm4_ctr "SM4-CTR" +#define LN_sm4_ctr "sm4-ctr" +#define NID_sm4_ctr 979 +#define OBJ_sm4_ctr OBJ_sm_scheme,104L,7L + +#define SN_hmac "HMAC" +#define LN_hmac "hmac" +#define NID_hmac 855 + +#define SN_cmac "CMAC" +#define LN_cmac "cmac" +#define NID_cmac 894 + +#define SN_rc4_hmac_md5 "RC4-HMAC-MD5" +#define LN_rc4_hmac_md5 "rc4-hmac-md5" +#define NID_rc4_hmac_md5 915 + +#define SN_aes_128_cbc_hmac_sha1 "AES-128-CBC-HMAC-SHA1" +#define LN_aes_128_cbc_hmac_sha1 "aes-128-cbc-hmac-sha1" +#define NID_aes_128_cbc_hmac_sha1 916 + +#define SN_aes_192_cbc_hmac_sha1 "AES-192-CBC-HMAC-SHA1" +#define LN_aes_192_cbc_hmac_sha1 "aes-192-cbc-hmac-sha1" +#define NID_aes_192_cbc_hmac_sha1 917 + +#define SN_aes_256_cbc_hmac_sha1 "AES-256-CBC-HMAC-SHA1" +#define LN_aes_256_cbc_hmac_sha1 "aes-256-cbc-hmac-sha1" +#define NID_aes_256_cbc_hmac_sha1 918 + +#define OBJ_x9_63_scheme 1L,3L,133L,16L,840L,63L,0L + +#define OBJ_secg_scheme OBJ_certicom_arc,1L + +#define SN_dhSinglePass_stdDH_sha1kdf_scheme "dhSinglePass-stdDH-sha1kdf-scheme" +#define NID_dhSinglePass_stdDH_sha1kdf_scheme 980 +#define OBJ_dhSinglePass_stdDH_sha1kdf_scheme OBJ_x9_63_scheme,2L + +#define SN_dhSinglePass_stdDH_sha224kdf_scheme "dhSinglePass-stdDH-sha224kdf-scheme" +#define NID_dhSinglePass_stdDH_sha224kdf_scheme 981 +#define OBJ_dhSinglePass_stdDH_sha224kdf_scheme OBJ_secg_scheme,11L,0L + +#define SN_dhSinglePass_stdDH_sha256kdf_scheme "dhSinglePass-stdDH-sha256kdf-scheme" +#define NID_dhSinglePass_stdDH_sha256kdf_scheme 982 +#define OBJ_dhSinglePass_stdDH_sha256kdf_scheme OBJ_secg_scheme,11L,1L + +#define SN_dhSinglePass_stdDH_sha384kdf_scheme "dhSinglePass-stdDH-sha384kdf-scheme" +#define NID_dhSinglePass_stdDH_sha384kdf_scheme 983 +#define OBJ_dhSinglePass_stdDH_sha384kdf_scheme OBJ_secg_scheme,11L,2L + +#define SN_dhSinglePass_stdDH_sha512kdf_scheme "dhSinglePass-stdDH-sha512kdf-scheme" +#define NID_dhSinglePass_stdDH_sha512kdf_scheme 984 +#define OBJ_dhSinglePass_stdDH_sha512kdf_scheme OBJ_secg_scheme,11L,3L + +#define SN_dhSinglePass_cofactorDH_sha1kdf_scheme "dhSinglePass-cofactorDH-sha1kdf-scheme" +#define NID_dhSinglePass_cofactorDH_sha1kdf_scheme 985 +#define OBJ_dhSinglePass_cofactorDH_sha1kdf_scheme OBJ_x9_63_scheme,3L + +#define SN_dhSinglePass_cofactorDH_sha224kdf_scheme "dhSinglePass-cofactorDH-sha224kdf-scheme" +#define NID_dhSinglePass_cofactorDH_sha224kdf_scheme 986 +#define OBJ_dhSinglePass_cofactorDH_sha224kdf_scheme OBJ_secg_scheme,14L,0L + +#define SN_dhSinglePass_cofactorDH_sha256kdf_scheme "dhSinglePass-cofactorDH-sha256kdf-scheme" +#define NID_dhSinglePass_cofactorDH_sha256kdf_scheme 987 +#define OBJ_dhSinglePass_cofactorDH_sha256kdf_scheme OBJ_secg_scheme,14L,1L + +#define SN_dhSinglePass_cofactorDH_sha384kdf_scheme "dhSinglePass-cofactorDH-sha384kdf-scheme" +#define NID_dhSinglePass_cofactorDH_sha384kdf_scheme 988 +#define OBJ_dhSinglePass_cofactorDH_sha384kdf_scheme OBJ_secg_scheme,14L,2L + +#define SN_dhSinglePass_cofactorDH_sha512kdf_scheme "dhSinglePass-cofactorDH-sha512kdf-scheme" +#define NID_dhSinglePass_cofactorDH_sha512kdf_scheme 989 +#define OBJ_dhSinglePass_cofactorDH_sha512kdf_scheme OBJ_secg_scheme,14L,3L + +#define SN_dh_std_kdf "dh-std-kdf" +#define NID_dh_std_kdf 990 + +#define SN_dh_cofactor_kdf "dh-cofactor-kdf" +#define NID_dh_cofactor_kdf 991 + +#define SN_ct_precert_scts "ct_precert_scts" +#define LN_ct_precert_scts "CT Precertificate SCTs" +#define NID_ct_precert_scts 1018 +#define OBJ_ct_precert_scts 1L,3L,6L,1L,4L,1L,11129L,2L,4L,2L + +#define SN_ct_precert_poison "ct_precert_poison" +#define LN_ct_precert_poison "CT Precertificate Poison" +#define NID_ct_precert_poison 1019 +#define OBJ_ct_precert_poison 1L,3L,6L,1L,4L,1L,11129L,2L,4L,3L + +#define SN_ct_precert_signer "ct_precert_signer" +#define LN_ct_precert_signer "CT Precertificate Signer" +#define NID_ct_precert_signer 1020 +#define OBJ_ct_precert_signer 1L,3L,6L,1L,4L,1L,11129L,2L,4L,4L + +#define SN_ct_cert_scts "ct_cert_scts" +#define LN_ct_cert_scts "CT Certificate SCTs" +#define NID_ct_cert_scts 1021 +#define OBJ_ct_cert_scts 1L,3L,6L,1L,4L,1L,11129L,2L,4L,5L + +#define SN_tls1_prf "TLS1-PRF" +#define LN_tls1_prf "tls1-prf" +#define NID_tls1_prf 1055 + +#define SN_hkdf "HKDF" +#define LN_hkdf "hkdf" +#define NID_hkdf 1022 + +#define SN_teletrust "teletrust" +#define NID_teletrust 920 +#define OBJ_teletrust OBJ_identified_organization,36L + +#define SN_brainpool "brainpool" +#define NID_brainpool 921 +#define OBJ_brainpool OBJ_teletrust,3L,3L,2L,8L,1L + +#define SN_brainpoolP160r1 "brainpoolP160r1" +#define NID_brainpoolP160r1 922 +#define OBJ_brainpoolP160r1 OBJ_brainpool,1L,1L + +#define SN_brainpoolP160t1 "brainpoolP160t1" +#define NID_brainpoolP160t1 923 +#define OBJ_brainpoolP160t1 OBJ_brainpool,1L,2L + +#define SN_brainpoolP192r1 "brainpoolP192r1" +#define NID_brainpoolP192r1 924 +#define OBJ_brainpoolP192r1 OBJ_brainpool,1L,3L + +#define SN_brainpoolP192t1 "brainpoolP192t1" +#define NID_brainpoolP192t1 925 +#define OBJ_brainpoolP192t1 OBJ_brainpool,1L,4L + +#define SN_brainpoolP224r1 "brainpoolP224r1" +#define NID_brainpoolP224r1 926 +#define OBJ_brainpoolP224r1 OBJ_brainpool,1L,5L + +#define SN_brainpoolP224t1 "brainpoolP224t1" +#define NID_brainpoolP224t1 927 +#define OBJ_brainpoolP224t1 OBJ_brainpool,1L,6L + +#define SN_brainpoolP256r1 "brainpoolP256r1" +#define NID_brainpoolP256r1 928 +#define OBJ_brainpoolP256r1 OBJ_brainpool,1L,7L + +#define SN_brainpoolP256t1 "brainpoolP256t1" +#define NID_brainpoolP256t1 929 +#define OBJ_brainpoolP256t1 OBJ_brainpool,1L,8L + +#define SN_brainpoolP320r1 "brainpoolP320r1" +#define NID_brainpoolP320r1 930 +#define OBJ_brainpoolP320r1 OBJ_brainpool,1L,9L + +#define SN_brainpoolP320t1 "brainpoolP320t1" +#define NID_brainpoolP320t1 931 +#define OBJ_brainpoolP320t1 OBJ_brainpool,1L,10L + +#define SN_brainpoolP384r1 "brainpoolP384r1" +#define NID_brainpoolP384r1 932 +#define OBJ_brainpoolP384r1 OBJ_brainpool,1L,11L + +#define SN_brainpoolP384t1 "brainpoolP384t1" +#define NID_brainpoolP384t1 933 +#define OBJ_brainpoolP384t1 OBJ_brainpool,1L,12L + +#define SN_brainpoolP512r1 "brainpoolP512r1" +#define NID_brainpoolP512r1 934 +#define OBJ_brainpoolP512r1 OBJ_brainpool,1L,13L + +#define SN_brainpoolP512t1 "brainpoolP512t1" +#define NID_brainpoolP512t1 935 +#define OBJ_brainpoolP512t1 OBJ_brainpool,1L,14L + +#define SN_FRP256v1 "FRP256v1" +#define NID_FRP256v1 936 +#define OBJ_FRP256v1 1L,2L,250L,1L,223L,101L,256L,1L + +#define SN_chacha20 "ChaCha" +#define LN_chacha20 "chacha" +#define NID_chacha20 937 + +#define SN_chacha20_poly1305 "ChaCha20-Poly1305" +#define LN_chacha20_poly1305 "chacha20-poly1305" +#define NID_chacha20_poly1305 967 + +#define SN_gost89_ecb "gost89-ecb" +#define NID_gost89_ecb 938 + +#define SN_gost89_cbc "gost89-cbc" +#define NID_gost89_cbc 939 + +#define SN_tc26 "tc26" +#define NID_tc26 940 +#define OBJ_tc26 OBJ_member_body,643L,7L,1L + +#define SN_id_tc26_gost3411_2012_256 "streebog256" +#define LN_id_tc26_gost3411_2012_256 "GOST R 34.11-2012 (256 bit)" +#define NID_id_tc26_gost3411_2012_256 941 +#define OBJ_id_tc26_gost3411_2012_256 OBJ_tc26,1L,2L,2L + +#define SN_id_tc26_gost3411_2012_512 "streebog512" +#define LN_id_tc26_gost3411_2012_512 "GOST R 34-11-2012 (512 bit)" +#define NID_id_tc26_gost3411_2012_512 942 +#define OBJ_id_tc26_gost3411_2012_512 OBJ_tc26,1L,2L,3L + +#define SN_id_tc26_hmac_gost_3411_12_256 "id-tc26-hmac-gost-3411-12-256" +#define LN_id_tc26_hmac_gost_3411_12_256 "HMAC STREEBOG 256" +#define NID_id_tc26_hmac_gost_3411_12_256 999 +#define OBJ_id_tc26_hmac_gost_3411_12_256 OBJ_tc26,1L,4L,1L + +#define SN_id_tc26_hmac_gost_3411_12_512 "id-tc26-hmac-gost-3411-12-512" +#define LN_id_tc26_hmac_gost_3411_12_512 "HMAC STREEBOG 512" +#define NID_id_tc26_hmac_gost_3411_12_512 1000 +#define OBJ_id_tc26_hmac_gost_3411_12_512 OBJ_tc26,1L,4L,2L + +#define SN_id_tc26_gost_3410_12_256_paramSetA "id-tc26-gost-3410-12-256-paramSetA" +#define LN_id_tc26_gost_3410_12_256_paramSetA "GOST R 34.10-2012 (256 bit) ParamSet A" +#define NID_id_tc26_gost_3410_12_256_paramSetA 993 +#define OBJ_id_tc26_gost_3410_12_256_paramSetA OBJ_tc26,2L,1L,1L,1L + +#define SN_id_tc26_gost_3410_12_256_paramSetB "id-tc26-gost-3410-12-256-paramSetB" +#define LN_id_tc26_gost_3410_12_256_paramSetB "GOST R 34.10-2012 (256 bit) ParamSet B" +#define NID_id_tc26_gost_3410_12_256_paramSetB 994 +#define OBJ_id_tc26_gost_3410_12_256_paramSetB OBJ_tc26,2L,1L,1L,2L + +#define SN_id_tc26_gost_3410_12_256_paramSetC "id-tc26-gost-3410-12-256-paramSetC" +#define LN_id_tc26_gost_3410_12_256_paramSetC "GOST R 34.10-2012 (256 bit) ParamSet C" +#define NID_id_tc26_gost_3410_12_256_paramSetC 995 +#define OBJ_id_tc26_gost_3410_12_256_paramSetC OBJ_tc26,2L,1L,1L,3L + +#define SN_id_tc26_gost_3410_12_256_paramSetD "id-tc26-gost-3410-12-256-paramSetD" +#define LN_id_tc26_gost_3410_12_256_paramSetD "GOST R 34.10-2012 (256 bit) ParamSet D" +#define NID_id_tc26_gost_3410_12_256_paramSetD 996 +#define OBJ_id_tc26_gost_3410_12_256_paramSetD OBJ_tc26,2L,1L,1L,4L + +#define SN_id_tc26_gost_3410_12_512_paramSetTest "id-tc26-gost-3410-12-512-paramSetTest" +#define LN_id_tc26_gost_3410_12_512_paramSetTest "GOST R 34.10-2012 (512 bit) testing parameter set" +#define NID_id_tc26_gost_3410_12_512_paramSetTest 997 +#define OBJ_id_tc26_gost_3410_12_512_paramSetTest OBJ_tc26,2L,1L,2L,0L + +#define SN_id_tc26_gost_3410_12_512_paramSetA "id-tc26-gost-3410-12-512-paramSetA" +#define LN_id_tc26_gost_3410_12_512_paramSetA "GOST R 34.10-2012 (512 bit) ParamSet A" +#define NID_id_tc26_gost_3410_12_512_paramSetA 943 +#define OBJ_id_tc26_gost_3410_12_512_paramSetA OBJ_tc26,2L,1L,2L,1L + +#define SN_id_tc26_gost_3410_12_512_paramSetB "id-tc26-gost-3410-12-512-paramSetB" +#define LN_id_tc26_gost_3410_12_512_paramSetB "GOST R 34.10-2012 (512 bit) ParamSet B" +#define NID_id_tc26_gost_3410_12_512_paramSetB 944 +#define OBJ_id_tc26_gost_3410_12_512_paramSetB OBJ_tc26,2L,1L,2L,2L + +#define SN_id_tc26_gost_3410_12_512_paramSetC "id-tc26-gost-3410-12-512-paramSetC" +#define LN_id_tc26_gost_3410_12_512_paramSetC "GOST R 34.10-2012 (512 bit) ParamSet C" +#define NID_id_tc26_gost_3410_12_512_paramSetC 998 +#define OBJ_id_tc26_gost_3410_12_512_paramSetC OBJ_tc26,2L,1L,2L,3L + +#define SN_id_tc26_gost_28147_param_Z "id-tc26-gost-28147-param-Z" +#define NID_id_tc26_gost_28147_param_Z 945 +#define OBJ_id_tc26_gost_28147_param_Z OBJ_tc26,2L,5L,1L,1L + +#define SN_id_tc26_gost3410_2012_256 "id-tc26-gost3410-2012-256" +#define LN_id_tc26_gost3410_2012_256 "GOST R 34.10-2012 (256 bit)" +#define NID_id_tc26_gost3410_2012_256 946 +#define OBJ_id_tc26_gost3410_2012_256 OBJ_tc26,1L,1L,1L + +#define SN_id_tc26_gost3410_2012_512 "id-tc26-gost3410-2012-512" +#define LN_id_tc26_gost3410_2012_512 "GOST R 34.10-2012 (512 bit)" +#define NID_id_tc26_gost3410_2012_512 947 +#define OBJ_id_tc26_gost3410_2012_512 OBJ_tc26,1L,1L,2L + +#define SN_id_tc26_signwithdigest_gost3410_2012_256 "id-tc26-signwithdigest-gost3410-2012-256" +#define LN_id_tc26_signwithdigest_gost3410_2012_256 "GOST R 34.11-2012 with GOST R 34.10-2012 (256 bit)" +#define NID_id_tc26_signwithdigest_gost3410_2012_256 948 +#define OBJ_id_tc26_signwithdigest_gost3410_2012_256 OBJ_tc26,1L,3L,2L + +#define SN_id_tc26_signwithdigest_gost3410_2012_512 "id-tc26-signwithdigest-gost3410-2012-512" +#define LN_id_tc26_signwithdigest_gost3410_2012_512 "GOST R 34.11-2012 with GOST R 34.10-2012 (512 bit)" +#define NID_id_tc26_signwithdigest_gost3410_2012_512 949 +#define OBJ_id_tc26_signwithdigest_gost3410_2012_512 OBJ_tc26,1L,3L,3L + +#define SN_X25519 "X25519" +#define NID_X25519 950 +#define OBJ_X25519 1L,3L,101L,110L + +#define SN_X448 "X448" +#define NID_X448 951 +#define OBJ_X448 1L,3L,101L,111L + +#define SN_Ed25519 "Ed25519" +#define NID_Ed25519 952 +#define OBJ_Ed25519 1L,3L,101L,112L + +#define SN_Ed448 "Ed448" +#define NID_Ed448 953 +#define OBJ_Ed448 1L,3L,101L,113L + +#define SN_Ed25519ph "Ed25519ph" +#define NID_Ed25519ph 954 +#define OBJ_Ed25519ph 1L,3L,101L,114L + +#define SN_Ed448ph "Ed448ph" +#define NID_Ed448ph 955 +#define OBJ_Ed448ph 1L,3L,101L,115L + +#define SN_kx_rsa "KxRSA" +#define LN_kx_rsa "kx-rsa" +#define NID_kx_rsa 959 + +#define SN_kx_ecdhe "KxECDHE" +#define LN_kx_ecdhe "kx-ecdhe" +#define NID_kx_ecdhe 960 + +#define SN_kx_dhe "KxDHE" +#define LN_kx_dhe "kx-dhe" +#define NID_kx_dhe 961 + +#define SN_kx_gost "KxGOST" +#define LN_kx_gost "kx-gost" +#define NID_kx_gost 962 + +#define SN_auth_rsa "AuthRSA" +#define LN_auth_rsa "auth-rsa" +#define NID_auth_rsa 963 + +#define SN_auth_ecdsa "AuthECDSA" +#define LN_auth_ecdsa "auth-ecdsa" +#define NID_auth_ecdsa 964 + +#define SN_auth_gost01 "AuthGOST01" +#define LN_auth_gost01 "auth-gost01" +#define NID_auth_gost01 965 + +#define SN_auth_null "AuthNULL" +#define LN_auth_null "auth-null" +#define NID_auth_null 966 + diff --git a/curl/include/openssl/objects.h b/curl/include/openssl/objects.h new file mode 100644 index 0000000..1a8490b --- /dev/null +++ b/curl/include/openssl/objects.h @@ -0,0 +1,137 @@ +/* $OpenBSD: objects.h,v 1.29 2024/03/02 09:51:36 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_OBJECTS_H +#define HEADER_OBJECTS_H + +#include + +#define SN_ED25519 SN_Ed25519 +#define NID_ED25519 NID_Ed25519 +#define OBJ_ED25519 OBJ_Ed25519 + +#include +#include + +#define OBJ_NAME_TYPE_UNDEF 0x00 +#define OBJ_NAME_TYPE_MD_METH 0x01 +#define OBJ_NAME_TYPE_CIPHER_METH 0x02 +#define OBJ_NAME_TYPE_NUM 0x03 + +#define OBJ_NAME_ALIAS 0x8000 + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct obj_name_st { + int type; + int alias; + const char *name; + const void *data; +} OBJ_NAME; + +void OBJ_NAME_do_all(int type, void (*fn)(const OBJ_NAME *, void *arg), + void *arg); +void OBJ_NAME_do_all_sorted(int type, void (*fn)(const OBJ_NAME *, void *arg), + void *arg); + +ASN1_OBJECT * OBJ_dup(const ASN1_OBJECT *o); +ASN1_OBJECT * OBJ_nid2obj(int n); +const char * OBJ_nid2ln(int n); +const char * OBJ_nid2sn(int n); +int OBJ_obj2nid(const ASN1_OBJECT *o); +ASN1_OBJECT * OBJ_txt2obj(const char *s, int no_name); +int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name); +int OBJ_txt2nid(const char *s); +int OBJ_ln2nid(const char *s); +int OBJ_sn2nid(const char *s); +int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b); + +int OBJ_new_nid(int num); +int OBJ_create(const char *oid, const char *sn, const char *ln); +void OBJ_cleanup(void); +int OBJ_create_objects(BIO *in); + +size_t OBJ_length(const ASN1_OBJECT *obj); +const unsigned char *OBJ_get0_data(const ASN1_OBJECT *obj); + +int OBJ_find_sigid_algs(int signid, int *pdig_nid, int *ppkey_nid); +int OBJ_find_sigid_by_algs(int *psignid, int dig_nid, int pkey_nid); + +void ERR_load_OBJ_strings(void); + +/* Error codes for the OBJ functions. */ + +/* Function codes. */ +#define OBJ_F_OBJ_ADD_OBJECT 105 +#define OBJ_F_OBJ_CREATE 100 +#define OBJ_F_OBJ_DUP 101 +#define OBJ_F_OBJ_NAME_NEW_INDEX 106 +#define OBJ_F_OBJ_NID2LN 102 +#define OBJ_F_OBJ_NID2OBJ 103 +#define OBJ_F_OBJ_NID2SN 104 + +/* Reason codes. */ +#define OBJ_R_MALLOC_FAILURE 100 +#define OBJ_R_UNKNOWN_NID 101 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/ocsp.h b/curl/include/openssl/ocsp.h new file mode 100644 index 0000000..691ee4a --- /dev/null +++ b/curl/include/openssl/ocsp.h @@ -0,0 +1,484 @@ +/* $OpenBSD: ocsp.h,v 1.20 2022/07/12 14:42:49 kn Exp $ */ +/* Written by Tom Titchener for the OpenSSL + * project. */ + +/* History: + This file was transfered to Richard Levitte from CertCo by Kathy + Weinhold in mid-spring 2000 to be included in OpenSSL or released + as a patch kit. */ + +/* ==================================================================== + * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#ifndef HEADER_OCSP_H +#define HEADER_OCSP_H + +#include +#include +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * CRLReason ::= ENUMERATED { + * unspecified (0), + * keyCompromise (1), + * cACompromise (2), + * affiliationChanged (3), + * superseded (4), + * cessationOfOperation (5), + * certificateHold (6), + * removeFromCRL (8) } + */ +#define OCSP_REVOKED_STATUS_NOSTATUS -1 +#define OCSP_REVOKED_STATUS_UNSPECIFIED 0 +#define OCSP_REVOKED_STATUS_KEYCOMPROMISE 1 +#define OCSP_REVOKED_STATUS_CACOMPROMISE 2 +#define OCSP_REVOKED_STATUS_AFFILIATIONCHANGED 3 +#define OCSP_REVOKED_STATUS_SUPERSEDED 4 +#define OCSP_REVOKED_STATUS_CESSATIONOFOPERATION 5 +#define OCSP_REVOKED_STATUS_CERTIFICATEHOLD 6 +#define OCSP_REVOKED_STATUS_REMOVEFROMCRL 8 + + +/* Various flags and values */ + +#define OCSP_DEFAULT_NONCE_LENGTH 16 + +#define OCSP_NOCERTS 0x1 +#define OCSP_NOINTERN 0x2 +#define OCSP_NOSIGS 0x4 +#define OCSP_NOCHAIN 0x8 +#define OCSP_NOVERIFY 0x10 +#define OCSP_NOEXPLICIT 0x20 +#define OCSP_NOCASIGN 0x40 +#define OCSP_NODELEGATED 0x80 +#define OCSP_NOCHECKS 0x100 +#define OCSP_TRUSTOTHER 0x200 +#define OCSP_RESPID_KEY 0x400 +#define OCSP_NOTIME 0x800 + +typedef struct ocsp_cert_id_st OCSP_CERTID; + +DECLARE_STACK_OF(OCSP_CERTID) + +typedef struct ocsp_one_request_st OCSP_ONEREQ; + +DECLARE_STACK_OF(OCSP_ONEREQ) + +typedef struct ocsp_req_info_st OCSP_REQINFO; +typedef struct ocsp_signature_st OCSP_SIGNATURE; +typedef struct ocsp_request_st OCSP_REQUEST; + +#define OCSP_RESPONSE_STATUS_SUCCESSFUL 0 +#define OCSP_RESPONSE_STATUS_MALFORMEDREQUEST 1 +#define OCSP_RESPONSE_STATUS_INTERNALERROR 2 +#define OCSP_RESPONSE_STATUS_TRYLATER 3 +#define OCSP_RESPONSE_STATUS_SIGREQUIRED 5 +#define OCSP_RESPONSE_STATUS_UNAUTHORIZED 6 + +typedef struct ocsp_resp_bytes_st OCSP_RESPBYTES; + +#define V_OCSP_RESPID_NAME 0 +#define V_OCSP_RESPID_KEY 1 + +DECLARE_STACK_OF(OCSP_RESPID) + +OCSP_RESPID *OCSP_RESPID_new(void); +void OCSP_RESPID_free(OCSP_RESPID *a); +OCSP_RESPID *d2i_OCSP_RESPID(OCSP_RESPID **a, const unsigned char **in, long len); +int i2d_OCSP_RESPID(OCSP_RESPID *a, unsigned char **out); +extern const ASN1_ITEM OCSP_RESPID_it; + +typedef struct ocsp_revoked_info_st OCSP_REVOKEDINFO; + +#define V_OCSP_CERTSTATUS_GOOD 0 +#define V_OCSP_CERTSTATUS_REVOKED 1 +#define V_OCSP_CERTSTATUS_UNKNOWN 2 + +typedef struct ocsp_cert_status_st OCSP_CERTSTATUS; +typedef struct ocsp_single_response_st OCSP_SINGLERESP; + +DECLARE_STACK_OF(OCSP_SINGLERESP) + +typedef struct ocsp_response_data_st OCSP_RESPDATA; + +typedef struct ocsp_basic_response_st OCSP_BASICRESP; + +typedef struct ocsp_crl_id_st OCSP_CRLID; +typedef struct ocsp_service_locator_st OCSP_SERVICELOC; + +#define PEM_STRING_OCSP_REQUEST "OCSP REQUEST" +#define PEM_STRING_OCSP_RESPONSE "OCSP RESPONSE" + +#define PEM_read_bio_OCSP_REQUEST(bp,x,cb) \ + (OCSP_REQUEST *)PEM_ASN1_read_bio((char *(*)())d2i_OCSP_REQUEST, \ + PEM_STRING_OCSP_REQUEST,bp,(char **)x,cb,NULL) + +#define PEM_read_bio_OCSP_RESPONSE(bp,x,cb) \ + (OCSP_RESPONSE *)PEM_ASN1_read_bio((char *(*)())d2i_OCSP_RESPONSE, \ + PEM_STRING_OCSP_RESPONSE,bp,(char **)x,cb,NULL) + +#define PEM_write_bio_OCSP_REQUEST(bp,o) \ + PEM_ASN1_write_bio((int (*)())i2d_OCSP_REQUEST,PEM_STRING_OCSP_REQUEST,\ + bp,(char *)o, NULL,NULL,0,NULL,NULL) + +#define PEM_write_bio_OCSP_RESPONSE(bp,o) \ + PEM_ASN1_write_bio((int (*)())i2d_OCSP_RESPONSE,PEM_STRING_OCSP_RESPONSE,\ + bp,(char *)o, NULL,NULL,0,NULL,NULL) + +#define ASN1_BIT_STRING_digest(data,type,md,len) \ + ASN1_item_digest(&ASN1_BIT_STRING_it,type,data,md,len) + +#define OCSP_CERTSTATUS_dup(cs) \ + ASN1_item_dup(&OCSP_CERTSTATUS_it, cs) + +OCSP_CERTID *OCSP_CERTID_dup(OCSP_CERTID *id); + +OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, const char *path, OCSP_REQUEST *req); +OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, const char *path, OCSP_REQUEST *req, + int maxline); +int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx); +void OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx); +int OCSP_REQ_CTX_set1_req(OCSP_REQ_CTX *rctx, OCSP_REQUEST *req); +int OCSP_REQ_CTX_add1_header(OCSP_REQ_CTX *rctx, const char *name, + const char *value); + +OCSP_CERTID *OCSP_cert_to_id(const EVP_MD *dgst, const X509 *subject, + const X509 *issuer); + +OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst, const X509_NAME *issuerName, + const ASN1_BIT_STRING *issuerKey, const ASN1_INTEGER *serialNumber); + +OCSP_ONEREQ *OCSP_request_add0_id(OCSP_REQUEST *req, OCSP_CERTID *cid); + +int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len); +int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len); +int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs); +int OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req); + +int OCSP_request_set1_name(OCSP_REQUEST *req, X509_NAME *nm); +int OCSP_request_add1_cert(OCSP_REQUEST *req, X509 *cert); + +int OCSP_request_sign(OCSP_REQUEST *req, X509 *signer, EVP_PKEY *key, + const EVP_MD *dgst, STACK_OF(X509) *certs, unsigned long flags); + +int OCSP_response_status(OCSP_RESPONSE *resp); +OCSP_BASICRESP *OCSP_response_get1_basic(OCSP_RESPONSE *resp); + +const ASN1_OCTET_STRING *OCSP_resp_get0_signature(const OCSP_BASICRESP *bs); +const X509_ALGOR *OCSP_resp_get0_tbs_sigalg(const OCSP_BASICRESP *bs); +const OCSP_RESPDATA *OCSP_resp_get0_respdata(const OCSP_BASICRESP *bs); +int OCSP_resp_get0_signer(OCSP_BASICRESP *bs, X509 **signer, + STACK_OF(X509) *extra_certs); + +int OCSP_resp_count(OCSP_BASICRESP *bs); +OCSP_SINGLERESP *OCSP_resp_get0(OCSP_BASICRESP *bs, int idx); +const ASN1_GENERALIZEDTIME *OCSP_resp_get0_produced_at(const OCSP_BASICRESP *bs); +const STACK_OF(X509) *OCSP_resp_get0_certs(const OCSP_BASICRESP *bs); +int OCSP_resp_get0_id(const OCSP_BASICRESP *bs, + const ASN1_OCTET_STRING **pid, const X509_NAME **pname); + +int OCSP_resp_find(OCSP_BASICRESP *bs, OCSP_CERTID *id, int last); +int OCSP_single_get0_status(OCSP_SINGLERESP *single, int *reason, + ASN1_GENERALIZEDTIME **revtime, ASN1_GENERALIZEDTIME **thisupd, + ASN1_GENERALIZEDTIME **nextupd); +int OCSP_resp_find_status(OCSP_BASICRESP *bs, OCSP_CERTID *id, int *status, + int *reason, ASN1_GENERALIZEDTIME **revtime, + ASN1_GENERALIZEDTIME **thisupd, ASN1_GENERALIZEDTIME **nextupd); +int OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd, + ASN1_GENERALIZEDTIME *nextupd, long sec, long maxsec); + +int OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs, + X509_STORE *store, unsigned long flags); + +int OCSP_parse_url(const char *url, char **phost, char **pport, + char **ppath, int *pssl); + +int OCSP_id_issuer_cmp(OCSP_CERTID *a, OCSP_CERTID *b); +int OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b); + +int OCSP_request_onereq_count(OCSP_REQUEST *req); +OCSP_ONEREQ *OCSP_request_onereq_get0(OCSP_REQUEST *req, int i); +OCSP_CERTID *OCSP_onereq_get0_id(OCSP_ONEREQ *one); +int OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd, + ASN1_OCTET_STRING **pikeyHash, ASN1_INTEGER **pserial, + OCSP_CERTID *cid); +int OCSP_request_is_signed(OCSP_REQUEST *req); +OCSP_RESPONSE *OCSP_response_create(int status, OCSP_BASICRESP *bs); +OCSP_SINGLERESP *OCSP_basic_add1_status(OCSP_BASICRESP *rsp, OCSP_CERTID *cid, + int status, int reason, ASN1_TIME *revtime, ASN1_TIME *thisupd, + ASN1_TIME *nextupd); +int OCSP_basic_add1_cert(OCSP_BASICRESP *resp, X509 *cert); +int OCSP_basic_sign(OCSP_BASICRESP *brsp, X509 *signer, EVP_PKEY *key, + const EVP_MD *dgst, STACK_OF(X509) *certs, unsigned long flags); + +X509_EXTENSION *OCSP_crlID_new(const char *url, long *n, char *tim); + +X509_EXTENSION *OCSP_accept_responses_new(char **oids); + +X509_EXTENSION *OCSP_archive_cutoff_new(char* tim); + +X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME* issuer, const char **urls); + +int OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x); +int OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos); +int OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, const ASN1_OBJECT *obj, + int lastpos); +int OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit, + int lastpos); +X509_EXTENSION *OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc); +X509_EXTENSION *OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc); +void *OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx); +int OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value, + int crit, unsigned long flags); +int OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc); + +int OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x); +int OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos); +int OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, const ASN1_OBJECT *obj, + int lastpos); +int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos); +X509_EXTENSION *OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc); +X509_EXTENSION *OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc); +void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx); +int OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit, + unsigned long flags); +int OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc); + +int OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x); +int OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos); +int OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, const ASN1_OBJECT *obj, + int lastpos); +int OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit, + int lastpos); +X509_EXTENSION *OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc); +X509_EXTENSION *OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc); +void *OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit, + int *idx); +int OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value, + int crit, unsigned long flags); +int OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc); + +int OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x); +int OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid, + int lastpos); +int OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, + const ASN1_OBJECT *obj, int lastpos); +int OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit, + int lastpos); +X509_EXTENSION *OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc); +X509_EXTENSION *OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc); +void *OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit, + int *idx); +int OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value, + int crit, unsigned long flags); +int OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex, + int loc); +const OCSP_CERTID *OCSP_SINGLERESP_get0_id(const OCSP_SINGLERESP *x); + +OCSP_SINGLERESP *OCSP_SINGLERESP_new(void); +void OCSP_SINGLERESP_free(OCSP_SINGLERESP *a); +OCSP_SINGLERESP *d2i_OCSP_SINGLERESP(OCSP_SINGLERESP **a, const unsigned char **in, long len); +int i2d_OCSP_SINGLERESP(OCSP_SINGLERESP *a, unsigned char **out); +extern const ASN1_ITEM OCSP_SINGLERESP_it; +OCSP_CERTSTATUS *OCSP_CERTSTATUS_new(void); +void OCSP_CERTSTATUS_free(OCSP_CERTSTATUS *a); +OCSP_CERTSTATUS *d2i_OCSP_CERTSTATUS(OCSP_CERTSTATUS **a, const unsigned char **in, long len); +int i2d_OCSP_CERTSTATUS(OCSP_CERTSTATUS *a, unsigned char **out); +extern const ASN1_ITEM OCSP_CERTSTATUS_it; +OCSP_REVOKEDINFO *OCSP_REVOKEDINFO_new(void); +void OCSP_REVOKEDINFO_free(OCSP_REVOKEDINFO *a); +OCSP_REVOKEDINFO *d2i_OCSP_REVOKEDINFO(OCSP_REVOKEDINFO **a, const unsigned char **in, long len); +int i2d_OCSP_REVOKEDINFO(OCSP_REVOKEDINFO *a, unsigned char **out); +extern const ASN1_ITEM OCSP_REVOKEDINFO_it; +OCSP_BASICRESP *OCSP_BASICRESP_new(void); +void OCSP_BASICRESP_free(OCSP_BASICRESP *a); +OCSP_BASICRESP *d2i_OCSP_BASICRESP(OCSP_BASICRESP **a, const unsigned char **in, long len); +int i2d_OCSP_BASICRESP(OCSP_BASICRESP *a, unsigned char **out); +extern const ASN1_ITEM OCSP_BASICRESP_it; +OCSP_RESPDATA *OCSP_RESPDATA_new(void); +void OCSP_RESPDATA_free(OCSP_RESPDATA *a); +OCSP_RESPDATA *d2i_OCSP_RESPDATA(OCSP_RESPDATA **a, const unsigned char **in, long len); +int i2d_OCSP_RESPDATA(OCSP_RESPDATA *a, unsigned char **out); +extern const ASN1_ITEM OCSP_RESPDATA_it; +OCSP_RESPID *OCSP_RESPID_new(void); +void OCSP_RESPID_free(OCSP_RESPID *a); +OCSP_RESPID *d2i_OCSP_RESPID(OCSP_RESPID **a, const unsigned char **in, long len); +int i2d_OCSP_RESPID(OCSP_RESPID *a, unsigned char **out); +extern const ASN1_ITEM OCSP_RESPID_it; +OCSP_RESPONSE *OCSP_RESPONSE_new(void); +void OCSP_RESPONSE_free(OCSP_RESPONSE *a); +OCSP_RESPONSE *d2i_OCSP_RESPONSE(OCSP_RESPONSE **a, const unsigned char **in, long len); +int i2d_OCSP_RESPONSE(OCSP_RESPONSE *a, unsigned char **out); +OCSP_RESPONSE *d2i_OCSP_RESPONSE_bio(BIO *bp, OCSP_RESPONSE **a); +int i2d_OCSP_RESPONSE_bio(BIO *bp, OCSP_RESPONSE *a); +extern const ASN1_ITEM OCSP_RESPONSE_it; +OCSP_RESPBYTES *OCSP_RESPBYTES_new(void); +void OCSP_RESPBYTES_free(OCSP_RESPBYTES *a); +OCSP_RESPBYTES *d2i_OCSP_RESPBYTES(OCSP_RESPBYTES **a, const unsigned char **in, long len); +int i2d_OCSP_RESPBYTES(OCSP_RESPBYTES *a, unsigned char **out); +extern const ASN1_ITEM OCSP_RESPBYTES_it; +OCSP_ONEREQ *OCSP_ONEREQ_new(void); +void OCSP_ONEREQ_free(OCSP_ONEREQ *a); +OCSP_ONEREQ *d2i_OCSP_ONEREQ(OCSP_ONEREQ **a, const unsigned char **in, long len); +int i2d_OCSP_ONEREQ(OCSP_ONEREQ *a, unsigned char **out); +extern const ASN1_ITEM OCSP_ONEREQ_it; +OCSP_CERTID *OCSP_CERTID_new(void); +void OCSP_CERTID_free(OCSP_CERTID *a); +OCSP_CERTID *d2i_OCSP_CERTID(OCSP_CERTID **a, const unsigned char **in, long len); +int i2d_OCSP_CERTID(OCSP_CERTID *a, unsigned char **out); +extern const ASN1_ITEM OCSP_CERTID_it; +OCSP_REQUEST *OCSP_REQUEST_new(void); +void OCSP_REQUEST_free(OCSP_REQUEST *a); +OCSP_REQUEST *d2i_OCSP_REQUEST(OCSP_REQUEST **a, const unsigned char **in, long len); +int i2d_OCSP_REQUEST(OCSP_REQUEST *a, unsigned char **out); +OCSP_REQUEST *d2i_OCSP_REQUEST_bio(BIO *bp, OCSP_REQUEST **a); +int i2d_OCSP_REQUEST_bio(BIO *bp, OCSP_REQUEST *a); +extern const ASN1_ITEM OCSP_REQUEST_it; +OCSP_SIGNATURE *OCSP_SIGNATURE_new(void); +void OCSP_SIGNATURE_free(OCSP_SIGNATURE *a); +OCSP_SIGNATURE *d2i_OCSP_SIGNATURE(OCSP_SIGNATURE **a, const unsigned char **in, long len); +int i2d_OCSP_SIGNATURE(OCSP_SIGNATURE *a, unsigned char **out); +extern const ASN1_ITEM OCSP_SIGNATURE_it; +OCSP_REQINFO *OCSP_REQINFO_new(void); +void OCSP_REQINFO_free(OCSP_REQINFO *a); +OCSP_REQINFO *d2i_OCSP_REQINFO(OCSP_REQINFO **a, const unsigned char **in, long len); +int i2d_OCSP_REQINFO(OCSP_REQINFO *a, unsigned char **out); +extern const ASN1_ITEM OCSP_REQINFO_it; +OCSP_CRLID *OCSP_CRLID_new(void); +void OCSP_CRLID_free(OCSP_CRLID *a); +OCSP_CRLID *d2i_OCSP_CRLID(OCSP_CRLID **a, const unsigned char **in, long len); +int i2d_OCSP_CRLID(OCSP_CRLID *a, unsigned char **out); +extern const ASN1_ITEM OCSP_CRLID_it; +OCSP_SERVICELOC *OCSP_SERVICELOC_new(void); +void OCSP_SERVICELOC_free(OCSP_SERVICELOC *a); +OCSP_SERVICELOC *d2i_OCSP_SERVICELOC(OCSP_SERVICELOC **a, const unsigned char **in, long len); +int i2d_OCSP_SERVICELOC(OCSP_SERVICELOC *a, unsigned char **out); +extern const ASN1_ITEM OCSP_SERVICELOC_it; + +const char *OCSP_response_status_str(long s); +const char *OCSP_cert_status_str(long s); +const char *OCSP_crl_reason_str(long s); + +int OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST* a, unsigned long flags); +int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags); + +int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs, + X509_STORE *st, unsigned long flags); + +void ERR_load_OCSP_strings(void); + +/* Error codes for the OCSP functions. */ + +/* Function codes. */ +#define OCSP_F_ASN1_STRING_ENCODE 100 +#define OCSP_F_D2I_OCSP_NONCE 102 +#define OCSP_F_OCSP_BASIC_ADD1_STATUS 103 +#define OCSP_F_OCSP_BASIC_SIGN 104 +#define OCSP_F_OCSP_BASIC_VERIFY 105 +#define OCSP_F_OCSP_CERT_ID_NEW 101 +#define OCSP_F_OCSP_CHECK_DELEGATED 106 +#define OCSP_F_OCSP_CHECK_IDS 107 +#define OCSP_F_OCSP_CHECK_ISSUER 108 +#define OCSP_F_OCSP_CHECK_VALIDITY 115 +#define OCSP_F_OCSP_MATCH_ISSUERID 109 +#define OCSP_F_OCSP_PARSE_URL 114 +#define OCSP_F_OCSP_REQUEST_SIGN 110 +#define OCSP_F_OCSP_REQUEST_VERIFY 116 +#define OCSP_F_OCSP_RESPONSE_GET1_BASIC 111 +#define OCSP_F_OCSP_SENDREQ_BIO 112 +#define OCSP_F_OCSP_SENDREQ_NBIO 117 +#define OCSP_F_PARSE_HTTP_LINE1 118 +#define OCSP_F_REQUEST_VERIFY 113 + +/* Reason codes. */ +#define OCSP_R_BAD_DATA 100 +#define OCSP_R_CERTIFICATE_VERIFY_ERROR 101 +#define OCSP_R_DIGEST_ERR 102 +#define OCSP_R_ERROR_IN_NEXTUPDATE_FIELD 122 +#define OCSP_R_ERROR_IN_THISUPDATE_FIELD 123 +#define OCSP_R_ERROR_PARSING_URL 121 +#define OCSP_R_MISSING_OCSPSIGNING_USAGE 103 +#define OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE 124 +#define OCSP_R_NOT_BASIC_RESPONSE 104 +#define OCSP_R_NO_CERTIFICATES_IN_CHAIN 105 +#define OCSP_R_NO_CONTENT 106 +#define OCSP_R_NO_PUBLIC_KEY 107 +#define OCSP_R_NO_RESPONSE_DATA 108 +#define OCSP_R_NO_REVOKED_TIME 109 +#define OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 110 +#define OCSP_R_REQUEST_NOT_SIGNED 128 +#define OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA 111 +#define OCSP_R_ROOT_CA_NOT_TRUSTED 112 +#define OCSP_R_SERVER_READ_ERROR 113 +#define OCSP_R_SERVER_RESPONSE_ERROR 114 +#define OCSP_R_SERVER_RESPONSE_PARSE_ERROR 115 +#define OCSP_R_SERVER_WRITE_ERROR 116 +#define OCSP_R_SIGNATURE_FAILURE 117 +#define OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND 118 +#define OCSP_R_STATUS_EXPIRED 125 +#define OCSP_R_STATUS_NOT_YET_VALID 126 +#define OCSP_R_STATUS_TOO_OLD 127 +#define OCSP_R_UNKNOWN_MESSAGE_DIGEST 119 +#define OCSP_R_UNKNOWN_NID 120 +#define OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE 129 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/opensslconf.h b/curl/include/openssl/opensslconf.h new file mode 100644 index 0000000..cc19376 --- /dev/null +++ b/curl/include/openssl/opensslconf.h @@ -0,0 +1,149 @@ +#include +/* crypto/opensslconf.h.in */ + +#if defined(HEADER_CRYPTO_LOCAL_H) && !defined(OPENSSLDIR) +#define OPENSSLDIR "/etc/ssl" +#endif + +#undef OPENSSL_EXPORT_VAR_AS_FUNCTION + +#ifndef OPENSSL_FILE +#ifdef OPENSSL_NO_FILENAMES +#define OPENSSL_FILE "" +#define OPENSSL_LINE 0 +#else +#define OPENSSL_FILE __FILE__ +#define OPENSSL_LINE __LINE__ +#endif +#endif + +#if defined(HEADER_IDEA_H) && !defined(IDEA_INT) +#define IDEA_INT unsigned int +#endif + +#if defined(HEADER_MD2_H) && !defined(MD2_INT) +#define MD2_INT unsigned int +#endif + +#if defined(HEADER_RC2_H) && !defined(RC2_INT) +/* I need to put in a mod for the alpha - eay */ +#define RC2_INT unsigned int +#endif + +#if defined(HEADER_RC4_H) +#if !defined(RC4_INT) +/* using int types make the structure larger but make the code faster + * on most boxes I have tested - up to %20 faster. */ +/* + * I don't know what does "most" mean, but declaring "int" is a must on: + * - Intel P6 because partial register stalls are very expensive; + * - elder Alpha because it lacks byte load/store instructions; + */ +#define RC4_INT unsigned int +#endif +#if !defined(RC4_CHUNK) +/* + * This enables code handling data aligned at natural CPU word + * boundary. See crypto/rc4/rc4_enc.c for further details. + */ +#define RC4_CHUNK unsigned long +#endif +#endif + +#if (defined(HEADER_NEW_DES_H) || defined(HEADER_DES_H)) && !defined(DES_LONG) +/* If this is set to 'unsigned int' on a DEC Alpha, this gives about a + * %20 speed up (longs are 8 bytes, int's are 4). */ +#ifndef DES_LONG +#define DES_LONG unsigned int +#endif +#endif + +#if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H) +#define CONFIG_HEADER_BN_H +#undef BN_LLONG + +/* Should we define BN_DIV2W here? */ + +/* Only one for the following should be defined */ +#define SIXTY_FOUR_BIT_LONG +#undef SIXTY_FOUR_BIT +#undef THIRTY_TWO_BIT +#endif + +#if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H) +#define CONFIG_HEADER_BF_LOCL_H +#undef BF_PTR +#endif /* HEADER_BF_LOCL_H */ + +#if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H) +#define CONFIG_HEADER_DES_LOCL_H +#ifndef DES_DEFAULT_OPTIONS +/* the following is tweaked from a config script, that is why it is a + * protected undef/define */ +#ifndef DES_PTR +#undef DES_PTR +#endif + +/* This helps C compiler generate the correct code for multiple functional + * units. It reduces register dependencies at the expense of 2 more + * registers */ +#ifndef DES_RISC1 +#undef DES_RISC1 +#endif + +#ifndef DES_RISC2 +#undef DES_RISC2 +#endif + +#if defined(DES_RISC1) && defined(DES_RISC2) +YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!! +#endif + +/* Unroll the inner loop, this sometimes helps, sometimes hinders. + * Very much CPU dependent */ +#ifndef DES_UNROLL +#define DES_UNROLL +#endif + +/* These default values were supplied by + * Peter Gutman + * They are only used if nothing else has been defined */ +#if !defined(DES_PTR) && !defined(DES_RISC1) && !defined(DES_RISC2) && !defined(DES_UNROLL) +/* Special defines which change the way the code is built depending on the + CPU and OS. For SGI machines you can use _MIPS_SZLONG (32 or 64) to find + even newer MIPS CPU's, but at the moment one size fits all for + optimization options. Older Sparc's work better with only UNROLL, but + there's no way to tell at compile time what it is you're running on */ + +#if defined( sun ) /* Newer Sparc's */ +# define DES_PTR +# define DES_RISC1 +# define DES_UNROLL +#elif defined( __ultrix ) /* Older MIPS */ +# define DES_PTR +# define DES_RISC2 +# define DES_UNROLL +#elif defined( __osf1__ ) /* Alpha */ +# define DES_PTR +# define DES_RISC2 +#elif defined ( _AIX ) /* RS6000 */ + /* Unknown */ +#elif defined( __hpux ) /* HP-PA */ + /* Unknown */ +#elif defined( __aux ) /* 68K */ + /* Unknown */ +#elif defined( __dgux ) /* 88K (but P6 in latest boxes) */ +# define DES_UNROLL +#elif defined( __sgi ) /* Newer MIPS */ +# define DES_PTR +# define DES_RISC2 +# define DES_UNROLL +#elif defined(i386) || defined(__i386__) /* x86 boxes, should be gcc */ +# define DES_PTR +# define DES_RISC1 +# define DES_UNROLL +#endif /* Systems-specific speed defines */ +#endif + +#endif /* DES_DEFAULT_OPTIONS */ +#endif /* HEADER_DES_LOCL_H */ diff --git a/curl/include/openssl/opensslfeatures.h b/curl/include/openssl/opensslfeatures.h new file mode 100644 index 0000000..41df8b8 --- /dev/null +++ b/curl/include/openssl/opensslfeatures.h @@ -0,0 +1,153 @@ +/* $OpenBSD: opensslfeatures.h,v 1.44 2024/08/31 10:38:49 tb Exp $ */ +/* + * Feature flags for LibreSSL... so you can actually tell when things + * are enabled, rather than not being able to tell when things are + * enabled (or possibly not yet not implemented, or removed!). + */ +#define LIBRESSL_HAS_QUIC +#define LIBRESSL_HAS_TLS1_3 +#define LIBRESSL_HAS_DTLS1_2 + +/* + * Used for compatibility with compilers lacking __attribute__ + */ +#if defined(_MSC_VER) && !defined(__clang__) && !defined(__attribute__) +#define __attribute__(a) +#endif + +#define OPENSSL_THREADS + +#define OPENSSL_NO_BUF_FREELISTS +#define OPENSSL_NO_DEPRECATED +#define OPENSSL_NO_EC2M +#define OPENSSL_NO_GMP +#define OPENSSL_NO_JPAKE +#define OPENSSL_NO_KRB5 +#define OPENSSL_NO_RSAX +#define OPENSSL_NO_SHA0 +#define OPENSSL_NO_SSL2 +#define OPENSSL_NO_STORE + +/* + * OPENSSL_NO_* flags that currently appear in OpenSSL. + */ + +/* #define OPENSSL_NO_AFALGENG */ +/* #define OPENSSL_NO_ALGORITHMS */ +/* #define OPENSSL_NO_ARIA */ +/* #define OPENSSL_NO_ASM */ +#define OPENSSL_NO_ASYNC +/* #define OPENSSL_NO_AUTOALGINIT */ +/* #define OPENSSL_NO_AUTOERRINIT */ +/* #define OPENSSL_NO_AUTOLOAD_CONFIG */ +/* #define OPENSSL_NO_BF */ +#define OPENSSL_NO_BLAKE2 +#define OPENSSL_NO_BROTLI +/* #define OPENSSL_NO_BUILTIN_OVERFLOW_CHECKING */ +/* #define OPENSSL_NO_CAMELLIA */ +#define OPENSSL_NO_CAPIENG +/* #define OPENSSL_NO_CAST */ +/* #define OPENSSL_NO_CHACHA */ +/* #define OPENSSL_NO_CMAC */ +/* #define OPENSSL_NO_CMP */ +/* #define OPENSSL_NO_CMS */ +#define OPENSSL_NO_COMP +/* #define OPENSSL_NO_COMP_ALG */ +/* #define OPENSSL_NO_CRMF */ +/* #define OPENSSL_NO_CRYPTO_MDEBUG */ +/* #define OPENSSL_NO_CRYPTO_MDEBUG_BACKTRACE */ +/* #define OPENSSL_NO_CT */ +/* #define OPENSSL_NO_DECC_INIT */ +/* #define OPENSSL_NO_DES */ +/* #define OPENSSL_NO_DEVCRYPTOENG */ +/* #define OPENSSL_NO_DGRAM */ +/* #define OPENSSL_NO_DH */ +/* #define OPENSSL_NO_DSA */ +#define OPENSSL_NO_DSO +/* #define OPENSSL_NO_DTLS */ +#define OPENSSL_NO_DTLS1 +#ifndef LIBRESSL_HAS_DTLS1_2 +#define OPENSSL_NO_DTLS1_2 +#endif +/* #define OPENSSL_NO_DTLS1_2_METHOD */ +/* #define OPENSSL_NO_DTLS1_METHOD */ +#define OPENSSL_NO_DYNAMIC_ENGINE +/* #define OPENSSL_NO_EC */ +#define OPENSSL_NO_EC_NISTP_64_GCC_128 +#define OPENSSL_NO_EGD +#define OPENSSL_NO_ENGINE +/* #define OPENSSL_NO_ERR */ +/* #define OPENSSL_NO_FILENAMES */ +/* #define OPENSSL_NO_FUZZ_AFL */ +/* #define OPENSSL_NO_FUZZ_LIBFUZZER */ +#define OPENSSL_NO_GOST +#define OPENSSL_NO_HEARTBEATS +/* #define OPENSSL_NO_HW */ +/* #define OPENSSL_NO_HW_PADLOCK */ +/* #define OPENSSL_NO_IDEA */ +/* #define OPENSSL_NO_INLINE_ASM */ +/* #define OPENSSL_NO_KEYPARAMS */ +#define OPENSSL_NO_KTLS +/* #define OPENSSL_NO_KTLS_RX */ +/* #define OPENSSL_NO_KTLS_ZC_TX */ +/* #define OPENSSL_NO_LOCALE */ +#define OPENSSL_NO_MD2 +/* #define OPENSSL_NO_MD4 */ +/* #define OPENSSL_NO_MD5 */ +#define OPENSSL_NO_MDC2 +/* #define OPENSSL_NO_MULTIBLOCK */ +/* #define OPENSSL_NO_NEXTPROTONEG */ +/* #define OPENSSL_NO_OCB */ +/* #define OPENSSL_NO_OCSP */ +/* #define OPENSSL_NO_PADLOCKENG */ +/* #define OPENSSL_NO_PINSHARED */ +/* #define OPENSSL_NO_POLY1305 */ +/* #define OPENSSL_NO_POSIX_IO */ +#define OPENSSL_NO_PSK +#define OPENSSL_NO_QUIC +/* #define OPENSSL_NO_RC2 */ +/* #define OPENSSL_NO_RC4 */ +#define OPENSSL_NO_RC5 +/* #define OPENSSL_NO_RDRAND */ +/* #define OPENSSL_NO_RFC3779 */ +/* #define OPENSSL_NO_RMD160 */ +/* #define OPENSSL_NO_RSA */ +#define OPENSSL_NO_SCRYPT +#define OPENSSL_NO_SCTP +/* #define OPENSSL_NO_SECURE_MEMORY */ +#define OPENSSL_NO_SEED +/* #define OPENSSL_NO_SIPHASH */ +/* #define OPENSSL_NO_SIV */ +/* #define OPENSSL_NO_SM2 */ +/* #define OPENSSL_NO_SM3 */ +/* #define OPENSSL_NO_SM4 */ +/* #define OPENSSL_NO_SOCK */ +#define OPENSSL_NO_SRP +/* #define OPENSSL_NO_SRTP */ +#define OPENSSL_NO_SSL3 +#define OPENSSL_NO_SSL3_METHOD +#define OPENSSL_NO_SSL_TRACE +/* #define OPENSSL_NO_STATIC_ENGINE */ +/* #define OPENSSL_NO_STDIO */ +/* #define OPENSSL_NO_THREAD_POOL */ +/* #define OPENSSL_NO_TLS */ +#define OPENSSL_NO_TLS1 +#define OPENSSL_NO_TLS1_1 +#define OPENSSL_NO_TLS1_METHOD +#define OPENSSL_NO_TLS1_1_METHOD +/* #define OPENSSL_NO_TLS1_2 */ +/* #define OPENSSL_NO_TLS1_2_METHOD */ +#ifndef LIBRESSL_HAS_TLS1_3 +#define OPENSSL_NO_TLS1_3 +#endif +/* #define OPENSSL_NO_TLS1_METHOD */ +/* #define OPENSSL_NO_TRACE */ +/* #define OPENSSL_NO_TS */ +/* #define OPENSSL_NO_UI_CONSOLE */ +/* #define OPENSSL_NO_UNIT_TEST */ +/* #define OPENSSL_NO_UNIX_SOCK */ +/* #define OPENSSL_NO_WEAK_SSL_CIPHERS */ +#define OPENSSL_NO_WHIRLPOOL +/* #define OPENSSL_NO_WINSTORE */ +#define OPENSSL_NO_ZLIB +/* #define OPENSSL_NO_ZSTD */ diff --git a/curl/include/openssl/opensslv.h b/curl/include/openssl/opensslv.h new file mode 100644 index 0000000..bf06db8 --- /dev/null +++ b/curl/include/openssl/opensslv.h @@ -0,0 +1,18 @@ +/* $OpenBSD: opensslv.h,v 1.80 2025/03/09 15:49:18 tb Exp $ */ +#ifndef HEADER_OPENSSLV_H +#define HEADER_OPENSSLV_H + +/* These will change with each release of LibreSSL-portable */ +#define LIBRESSL_VERSION_NUMBER 0x4010000fL +/* ^ Patch starts here */ +#define LIBRESSL_VERSION_TEXT "LibreSSL 4.1.0" + +/* These will never change */ +#define OPENSSL_VERSION_NUMBER 0x20000000L +#define OPENSSL_VERSION_TEXT LIBRESSL_VERSION_TEXT +#define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT + +#define SHLIB_VERSION_HISTORY "" +#define SHLIB_VERSION_NUMBER "1.0.0" + +#endif /* HEADER_OPENSSLV_H */ diff --git a/curl/include/openssl/ossl_typ.h b/curl/include/openssl/ossl_typ.h new file mode 100644 index 0000000..e82ad2f --- /dev/null +++ b/curl/include/openssl/ossl_typ.h @@ -0,0 +1,196 @@ +/* $OpenBSD: ossl_typ.h,v 1.31 2024/05/27 09:12:32 jsg Exp $ */ +/* ==================================================================== + * Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#ifndef HEADER_OPENSSL_TYPES_H +#define HEADER_OPENSSL_TYPES_H + +#include + +typedef struct asn1_string_st ASN1_INTEGER; +typedef struct asn1_string_st ASN1_ENUMERATED; +typedef struct asn1_string_st ASN1_BIT_STRING; +typedef struct asn1_string_st ASN1_OCTET_STRING; +typedef struct asn1_string_st ASN1_PRINTABLESTRING; +typedef struct asn1_string_st ASN1_T61STRING; +typedef struct asn1_string_st ASN1_IA5STRING; +typedef struct asn1_string_st ASN1_GENERALSTRING; +typedef struct asn1_string_st ASN1_UNIVERSALSTRING; +typedef struct asn1_string_st ASN1_BMPSTRING; +typedef struct asn1_string_st ASN1_UTCTIME; +typedef struct asn1_string_st ASN1_TIME; +typedef struct asn1_string_st ASN1_GENERALIZEDTIME; +typedef struct asn1_string_st ASN1_VISIBLESTRING; +typedef struct asn1_string_st ASN1_UTF8STRING; +typedef struct asn1_string_st ASN1_STRING; +typedef int ASN1_BOOLEAN; +typedef int ASN1_NULL; + +typedef struct asn1_object_st ASN1_OBJECT; + +typedef struct ASN1_ITEM_st ASN1_ITEM; +typedef struct asn1_pctx_st ASN1_PCTX; + +#if defined(_WIN32) && defined(__WINCRYPT_H__) +#if !defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_DISABLE_OVERRIDE_WINCRYPT_DEFINES_WARNING) +#ifdef _MSC_VER +#pragma message("Warning, overriding WinCrypt defines") +#else +#warning overriding WinCrypt defines +#endif +#endif +#undef X509_NAME +#undef X509_EXTENSIONS +#undef OCSP_REQUEST +#undef OCSP_RESPONSE +#undef PKCS7_ISSUER_AND_SERIAL +#endif + +#ifdef BIGNUM +#undef BIGNUM +#endif +typedef struct bignum_st BIGNUM; +typedef struct bignum_ctx BN_CTX; +typedef struct bn_blinding_st BN_BLINDING; +typedef struct bn_mont_ctx_st BN_MONT_CTX; +typedef struct bn_gencb_st BN_GENCB; + +typedef struct bio_st BIO; +typedef struct buf_mem_st BUF_MEM; + +typedef struct evp_cipher_st EVP_CIPHER; +typedef struct evp_cipher_ctx_st EVP_CIPHER_CTX; +typedef struct evp_md_st EVP_MD; +typedef struct evp_md_ctx_st EVP_MD_CTX; +typedef struct evp_pkey_st EVP_PKEY; + +typedef struct evp_pkey_asn1_method_st EVP_PKEY_ASN1_METHOD; + +typedef struct evp_pkey_method_st EVP_PKEY_METHOD; +typedef struct evp_pkey_ctx_st EVP_PKEY_CTX; + +typedef struct evp_Encode_Ctx_st EVP_ENCODE_CTX; + +typedef struct hmac_ctx_st HMAC_CTX; + +typedef struct dh_st DH; +typedef struct dh_method DH_METHOD; + +typedef struct dsa_st DSA; +typedef struct dsa_method DSA_METHOD; + +typedef struct ec_key_st EC_KEY; +typedef struct ec_key_method_st EC_KEY_METHOD; + +typedef struct rsa_st RSA; +typedef struct rsa_meth_st RSA_METHOD; +typedef struct rsa_pss_params_st RSA_PSS_PARAMS; + +typedef struct rand_meth_st RAND_METHOD; + +typedef struct x509_st X509; +typedef struct X509_algor_st X509_ALGOR; +typedef struct X509_crl_st X509_CRL; +typedef struct x509_revoked_st X509_REVOKED; +typedef struct X509_name_st X509_NAME; +typedef struct X509_pubkey_st X509_PUBKEY; +typedef struct x509_store_st X509_STORE; +typedef struct x509_store_ctx_st X509_STORE_CTX; + +typedef struct x509_object_st X509_OBJECT; +typedef struct x509_lookup_st X509_LOOKUP; +typedef struct x509_lookup_method_st X509_LOOKUP_METHOD; +typedef struct X509_VERIFY_PARAM_st X509_VERIFY_PARAM; + +typedef struct pkcs8_priv_key_info_st PKCS8_PRIV_KEY_INFO; + +typedef struct v3_ext_ctx X509V3_CTX; +typedef struct conf_st CONF; + +typedef struct ui_st UI; +typedef struct ui_method_st UI_METHOD; + +typedef struct engine_st ENGINE; +typedef struct ssl_st SSL; +typedef struct ssl_ctx_st SSL_CTX; + +typedef struct AUTHORITY_KEYID_st AUTHORITY_KEYID; +typedef struct DIST_POINT_st DIST_POINT; +typedef struct ISSUING_DIST_POINT_st ISSUING_DIST_POINT; +typedef struct NAME_CONSTRAINTS_st NAME_CONSTRAINTS; + +/* If placed in pkcs12.h, we end up with a circular dependency with pkcs7.h */ +#define DECLARE_PKCS12_STACK_OF(type) /* Nothing */ +#define IMPLEMENT_PKCS12_STACK_OF(type) /* Nothing */ + +typedef struct crypto_ex_data_st CRYPTO_EX_DATA; +/* Callback types for crypto.h */ +typedef int CRYPTO_EX_new(void *parent, void *ptr, CRYPTO_EX_DATA *ad, + int idx, long argl, void *argp); +typedef void CRYPTO_EX_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad, + int idx, long argl, void *argp); +typedef int CRYPTO_EX_dup(CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from, + void *from_d, int idx, long argl, void *argp); + +typedef struct ocsp_req_ctx_st OCSP_REQ_CTX; +typedef struct ocsp_response_st OCSP_RESPONSE; +typedef struct ocsp_responder_id_st OCSP_RESPID; + +typedef struct sct_st SCT; +typedef struct sct_ctx_st SCT_CTX; +typedef struct ctlog_st CTLOG; +typedef struct ctlog_store_st CTLOG_STORE; +typedef struct ct_policy_eval_ctx_st CT_POLICY_EVAL_CTX; + +#endif /* def HEADER_OPENSSL_TYPES_H */ diff --git a/curl/include/openssl/pem.h b/curl/include/openssl/pem.h new file mode 100644 index 0000000..4fdab48 --- /dev/null +++ b/curl/include/openssl/pem.h @@ -0,0 +1,546 @@ +/* $OpenBSD: pem.h,v 1.28 2024/05/11 05:41:28 tb Exp $ */ +/* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_PEM_H +#define HEADER_PEM_H + +#include + +#ifndef OPENSSL_NO_BIO +#include +#endif +#ifndef OPENSSL_NO_STACK +#include +#endif +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define PEM_BUFSIZE 1024 + +#define PEM_OBJ_UNDEF 0 +#define PEM_OBJ_X509 1 +#define PEM_OBJ_X509_REQ 2 +#define PEM_OBJ_CRL 3 +#define PEM_OBJ_SSL_SESSION 4 +#define PEM_OBJ_PRIV_KEY 10 +#define PEM_OBJ_PRIV_RSA 11 +#define PEM_OBJ_PRIV_DSA 12 +#define PEM_OBJ_PRIV_DH 13 +#define PEM_OBJ_PUB_RSA 14 +#define PEM_OBJ_PUB_DSA 15 +#define PEM_OBJ_PUB_DH 16 +#define PEM_OBJ_DHPARAMS 17 +#define PEM_OBJ_DSAPARAMS 18 +#define PEM_OBJ_PRIV_RSA_PUBLIC 19 +#define PEM_OBJ_PRIV_ECDSA 20 +#define PEM_OBJ_PUB_ECDSA 21 +#define PEM_OBJ_ECPARAMETERS 22 + +#define PEM_ERROR 30 +#define PEM_DEK_DES_CBC 40 +#define PEM_DEK_IDEA_CBC 45 +#define PEM_DEK_DES_EDE 50 +#define PEM_DEK_DES_ECB 60 +#define PEM_DEK_RSA 70 +#define PEM_DEK_RSA_MD2 80 +#define PEM_DEK_RSA_MD5 90 + +#define PEM_MD_MD2 NID_md2 +#define PEM_MD_MD5 NID_md5 +#define PEM_MD_SHA NID_sha +#define PEM_MD_MD2_RSA NID_md2WithRSAEncryption +#define PEM_MD_MD5_RSA NID_md5WithRSAEncryption +#define PEM_MD_SHA_RSA NID_sha1WithRSAEncryption + +#define PEM_STRING_X509_OLD "X509 CERTIFICATE" +#define PEM_STRING_X509 "CERTIFICATE" +#define PEM_STRING_X509_TRUSTED "TRUSTED CERTIFICATE" +#define PEM_STRING_X509_REQ_OLD "NEW CERTIFICATE REQUEST" +#define PEM_STRING_X509_REQ "CERTIFICATE REQUEST" +#define PEM_STRING_X509_CRL "X509 CRL" +#define PEM_STRING_EVP_PKEY "ANY PRIVATE KEY" +#define PEM_STRING_PUBLIC "PUBLIC KEY" +#define PEM_STRING_RSA "RSA PRIVATE KEY" +#define PEM_STRING_RSA_PUBLIC "RSA PUBLIC KEY" +#define PEM_STRING_DSA "DSA PRIVATE KEY" +#define PEM_STRING_DSA_PUBLIC "DSA PUBLIC KEY" +#define PEM_STRING_PKCS7 "PKCS7" +#define PEM_STRING_PKCS7_SIGNED "PKCS #7 SIGNED DATA" +#define PEM_STRING_PKCS8 "ENCRYPTED PRIVATE KEY" +#define PEM_STRING_PKCS8INF "PRIVATE KEY" +#define PEM_STRING_DHPARAMS "DH PARAMETERS" +#define PEM_STRING_SSL_SESSION "SSL SESSION PARAMETERS" +#define PEM_STRING_DSAPARAMS "DSA PARAMETERS" +#define PEM_STRING_ECDSA_PUBLIC "ECDSA PUBLIC KEY" +#define PEM_STRING_ECPARAMETERS "EC PARAMETERS" +#define PEM_STRING_ECPRIVATEKEY "EC PRIVATE KEY" +#define PEM_STRING_PARAMETERS "PARAMETERS" +#define PEM_STRING_CMS "CMS" + +/* enc_type is one off */ +#define PEM_TYPE_ENCRYPTED 10 +#define PEM_TYPE_MIC_ONLY 20 +#define PEM_TYPE_MIC_CLEAR 30 +#define PEM_TYPE_CLEAR 40 + +#ifndef LIBRESSL_INTERNAL +/* These macros make the PEM_read/PEM_write functions easier to maintain and + * write. Now they are all implemented with either: + * IMPLEMENT_PEM_rw(...) or IMPLEMENT_PEM_rw_cb(...) + */ + +#define IMPLEMENT_PEM_read_fp(name, type, str, asn1) \ +type *PEM_read_##name(FILE *fp, type **x, pem_password_cb *cb, void *u)\ +{ \ +return PEM_ASN1_read((d2i_of_void *)d2i_##asn1, str,fp,(void **)x,cb,u); \ +} + +#define IMPLEMENT_PEM_write_fp(name, type, str, asn1) \ +int PEM_write_##name(FILE *fp, type *x) \ +{ \ +return PEM_ASN1_write((i2d_of_void *)i2d_##asn1,str,fp,x,NULL,NULL,0,NULL,NULL); \ +} + +#define IMPLEMENT_PEM_write_fp_const(name, type, str, asn1) \ +int PEM_write_##name(FILE *fp, const type *x) \ +{ \ +return PEM_ASN1_write((i2d_of_void *)i2d_##asn1,str,fp,(void *)x,NULL,NULL,0,NULL,NULL); \ +} + +#define IMPLEMENT_PEM_write_cb_fp(name, type, str, asn1) \ +int PEM_write_##name(FILE *fp, type *x, const EVP_CIPHER *enc, \ + unsigned char *kstr, int klen, pem_password_cb *cb, \ + void *u) \ + { \ + return PEM_ASN1_write((i2d_of_void *)i2d_##asn1,str,fp,x,enc,kstr,klen,cb,u); \ + } + +#define IMPLEMENT_PEM_write_cb_fp_const(name, type, str, asn1) \ +int PEM_write_##name(FILE *fp, type *x, const EVP_CIPHER *enc, \ + unsigned char *kstr, int klen, pem_password_cb *cb, \ + void *u) \ + { \ + return PEM_ASN1_write((i2d_of_void *)i2d_##asn1,str,fp,x,enc,kstr,klen,cb,u); \ + } + + +#define IMPLEMENT_PEM_read_bio(name, type, str, asn1) \ +type *PEM_read_bio_##name(BIO *bp, type **x, pem_password_cb *cb, void *u)\ +{ \ +return PEM_ASN1_read_bio((d2i_of_void *)d2i_##asn1, str,bp,(void **)x,cb,u); \ +} + +#define IMPLEMENT_PEM_write_bio(name, type, str, asn1) \ +int PEM_write_bio_##name(BIO *bp, type *x) \ +{ \ +return PEM_ASN1_write_bio((i2d_of_void *)i2d_##asn1,str,bp,x,NULL,NULL,0,NULL,NULL); \ +} + +#define IMPLEMENT_PEM_write_bio_const(name, type, str, asn1) \ +int PEM_write_bio_##name(BIO *bp, const type *x) \ +{ \ +return PEM_ASN1_write_bio((i2d_of_void *)i2d_##asn1,str,bp,(void *)x,NULL,NULL,0,NULL,NULL); \ +} + +#define IMPLEMENT_PEM_write_cb_bio(name, type, str, asn1) \ +int PEM_write_bio_##name(BIO *bp, type *x, const EVP_CIPHER *enc, \ + unsigned char *kstr, int klen, pem_password_cb *cb, void *u) \ + { \ + return PEM_ASN1_write_bio((i2d_of_void *)i2d_##asn1,str,bp,x,enc,kstr,klen,cb,u); \ + } + +#define IMPLEMENT_PEM_write_cb_bio_const(name, type, str, asn1) \ +int PEM_write_bio_##name(BIO *bp, type *x, const EVP_CIPHER *enc, \ + unsigned char *kstr, int klen, pem_password_cb *cb, void *u) \ + { \ + return PEM_ASN1_write_bio((i2d_of_void *)i2d_##asn1,str,bp,(void *)x,enc,kstr,klen,cb,u); \ + } + +#define IMPLEMENT_PEM_write(name, type, str, asn1) \ + IMPLEMENT_PEM_write_bio(name, type, str, asn1) \ + IMPLEMENT_PEM_write_fp(name, type, str, asn1) + +#define IMPLEMENT_PEM_write_const(name, type, str, asn1) \ + IMPLEMENT_PEM_write_bio_const(name, type, str, asn1) \ + IMPLEMENT_PEM_write_fp_const(name, type, str, asn1) + +#define IMPLEMENT_PEM_write_cb(name, type, str, asn1) \ + IMPLEMENT_PEM_write_cb_bio(name, type, str, asn1) \ + IMPLEMENT_PEM_write_cb_fp(name, type, str, asn1) + +#define IMPLEMENT_PEM_write_cb_const(name, type, str, asn1) \ + IMPLEMENT_PEM_write_cb_bio_const(name, type, str, asn1) \ + IMPLEMENT_PEM_write_cb_fp_const(name, type, str, asn1) + +#define IMPLEMENT_PEM_read(name, type, str, asn1) \ + IMPLEMENT_PEM_read_bio(name, type, str, asn1) \ + IMPLEMENT_PEM_read_fp(name, type, str, asn1) + +#define IMPLEMENT_PEM_rw(name, type, str, asn1) \ + IMPLEMENT_PEM_read(name, type, str, asn1) \ + IMPLEMENT_PEM_write(name, type, str, asn1) + +#define IMPLEMENT_PEM_rw_const(name, type, str, asn1) \ + IMPLEMENT_PEM_read(name, type, str, asn1) \ + IMPLEMENT_PEM_write_const(name, type, str, asn1) + +#define IMPLEMENT_PEM_rw_cb(name, type, str, asn1) \ + IMPLEMENT_PEM_read(name, type, str, asn1) \ + IMPLEMENT_PEM_write_cb(name, type, str, asn1) + +#endif + +/* These are the same except they are for the declarations */ + + +#define DECLARE_PEM_read_fp(name, type) \ + type *PEM_read_##name(FILE *fp, type **x, pem_password_cb *cb, void *u); + +#define DECLARE_PEM_write_fp(name, type) \ + int PEM_write_##name(FILE *fp, type *x); + +#define DECLARE_PEM_write_fp_const(name, type) \ + int PEM_write_##name(FILE *fp, const type *x); + +#define DECLARE_PEM_write_cb_fp(name, type) \ + int PEM_write_##name(FILE *fp, type *x, const EVP_CIPHER *enc, \ + unsigned char *kstr, int klen, pem_password_cb *cb, void *u); + + +#ifndef OPENSSL_NO_BIO +#define DECLARE_PEM_read_bio(name, type) \ + type *PEM_read_bio_##name(BIO *bp, type **x, pem_password_cb *cb, void *u); + +#define DECLARE_PEM_write_bio(name, type) \ + int PEM_write_bio_##name(BIO *bp, type *x); + +#define DECLARE_PEM_write_bio_const(name, type) \ + int PEM_write_bio_##name(BIO *bp, const type *x); + +#define DECLARE_PEM_write_cb_bio(name, type) \ + int PEM_write_bio_##name(BIO *bp, type *x, const EVP_CIPHER *enc, \ + unsigned char *kstr, int klen, pem_password_cb *cb, void *u); + +#else + +#define DECLARE_PEM_read_bio(name, type) /**/ +#define DECLARE_PEM_write_bio(name, type) /**/ +#define DECLARE_PEM_write_bio_const(name, type) /**/ +#define DECLARE_PEM_write_cb_bio(name, type) /**/ + +#endif + +#define DECLARE_PEM_write(name, type) \ + DECLARE_PEM_write_bio(name, type) \ + DECLARE_PEM_write_fp(name, type) + +#define DECLARE_PEM_write_const(name, type) \ + DECLARE_PEM_write_bio_const(name, type) \ + DECLARE_PEM_write_fp_const(name, type) + +#define DECLARE_PEM_write_cb(name, type) \ + DECLARE_PEM_write_cb_bio(name, type) \ + DECLARE_PEM_write_cb_fp(name, type) + +#define DECLARE_PEM_read(name, type) \ + DECLARE_PEM_read_bio(name, type) \ + DECLARE_PEM_read_fp(name, type) + +#define DECLARE_PEM_rw(name, type) \ + DECLARE_PEM_read(name, type) \ + DECLARE_PEM_write(name, type) + +#define DECLARE_PEM_rw_const(name, type) \ + DECLARE_PEM_read(name, type) \ + DECLARE_PEM_write_const(name, type) + +#define DECLARE_PEM_rw_cb(name, type) \ + DECLARE_PEM_read(name, type) \ + DECLARE_PEM_write_cb(name, type) + +typedef int pem_password_cb(char *buf, int size, int rwflag, void *userdata); + +int PEM_get_EVP_CIPHER_INFO(char *header, EVP_CIPHER_INFO *cipher); +int PEM_do_header (EVP_CIPHER_INFO *cipher, unsigned char *data, long *len, + pem_password_cb *callback, void *u); + +#ifndef OPENSSL_NO_BIO +int PEM_read_bio(BIO *bp, char **name, char **header, + unsigned char **data, long *len); +int PEM_write_bio(BIO *bp, const char *name, const char *hdr, + const unsigned char *data, long len); +int PEM_bytes_read_bio(unsigned char **pdata, long *plen, char **pnm, + const char *name, BIO *bp, pem_password_cb *cb, void *u); +void * PEM_ASN1_read_bio(d2i_of_void *d2i, const char *name, BIO *bp, + void **x, pem_password_cb *cb, void *u); +int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x, + const EVP_CIPHER *enc, unsigned char *kstr, int klen, + pem_password_cb *cb, void *u); + +STACK_OF(X509_INFO) * PEM_X509_INFO_read_bio(BIO *bp, + STACK_OF(X509_INFO) *sk, pem_password_cb *cb, void *u); +int PEM_X509_INFO_write_bio(BIO *bp, X509_INFO *xi, EVP_CIPHER *enc, + unsigned char *kstr, int klen, pem_password_cb *cd, void *u); +#endif + +int PEM_read(FILE *fp, char **name, char **header, + unsigned char **data, long *len); +int PEM_write(FILE *fp, const char *name, const char *hdr, + const unsigned char *data, long len); +void * PEM_ASN1_read(d2i_of_void *d2i, const char *name, FILE *fp, void **x, + pem_password_cb *cb, void *u); +int PEM_ASN1_write(i2d_of_void *i2d, const char *name, FILE *fp, + void *x, const EVP_CIPHER *enc, unsigned char *kstr, + int klen, pem_password_cb *callback, void *u); +STACK_OF(X509_INFO) * PEM_X509_INFO_read(FILE *fp, STACK_OF(X509_INFO) *sk, + pem_password_cb *cb, void *u); + +int PEM_SignInit(EVP_MD_CTX *ctx, EVP_MD *type); +int PEM_SignUpdate(EVP_MD_CTX *ctx, unsigned char *d, unsigned int cnt); +int PEM_SignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, + unsigned int *siglen, EVP_PKEY *pkey); + +int PEM_def_callback(char *buf, int num, int w, void *key); +void PEM_proc_type(char *buf, int type); +void PEM_dek_info(char *buf, const char *type, int len, char *str); + + +DECLARE_PEM_rw(X509, X509) + +DECLARE_PEM_rw(X509_AUX, X509) + +DECLARE_PEM_rw(X509_REQ, X509_REQ) +DECLARE_PEM_write(X509_REQ_NEW, X509_REQ) + +DECLARE_PEM_rw(X509_CRL, X509_CRL) + +DECLARE_PEM_rw(PKCS7, PKCS7) + +DECLARE_PEM_rw(PKCS8, X509_SIG) + +DECLARE_PEM_rw(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO) + +#ifndef OPENSSL_NO_RSA + +DECLARE_PEM_rw_cb(RSAPrivateKey, RSA) + +DECLARE_PEM_rw_const(RSAPublicKey, RSA) +DECLARE_PEM_rw(RSA_PUBKEY, RSA) + +#endif + +#ifndef OPENSSL_NO_DSA + +DECLARE_PEM_rw_cb(DSAPrivateKey, DSA) + +DECLARE_PEM_rw(DSA_PUBKEY, DSA) + +DECLARE_PEM_rw_const(DSAparams, DSA) + +#endif + +#ifndef OPENSSL_NO_EC +DECLARE_PEM_rw_const(ECPKParameters, EC_GROUP) +DECLARE_PEM_rw_cb(ECPrivateKey, EC_KEY) +DECLARE_PEM_rw(EC_PUBKEY, EC_KEY) +#endif + +#ifndef OPENSSL_NO_DH + +DECLARE_PEM_rw_const(DHparams, DH) + +#endif + +DECLARE_PEM_rw_cb(PrivateKey, EVP_PKEY) + +DECLARE_PEM_rw(PUBKEY, EVP_PKEY) + +int PEM_write_bio_PrivateKey_traditional(BIO *bp, EVP_PKEY *x, + const EVP_CIPHER *enc, unsigned char *kstr, int klen, pem_password_cb *cb, + void *u); +int PEM_write_bio_PKCS8PrivateKey_nid(BIO *bp, EVP_PKEY *x, int nid, + char *kstr, int klen, + pem_password_cb *cb, void *u); +int PEM_write_bio_PKCS8PrivateKey(BIO *, EVP_PKEY *, const EVP_CIPHER *, + char *, int, pem_password_cb *, void *); +int i2d_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc, + char *kstr, int klen, + pem_password_cb *cb, void *u); +int i2d_PKCS8PrivateKey_nid_bio(BIO *bp, EVP_PKEY *x, int nid, + char *kstr, int klen, + pem_password_cb *cb, void *u); +EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, + void *u); + +int i2d_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc, + char *kstr, int klen, + pem_password_cb *cb, void *u); +int i2d_PKCS8PrivateKey_nid_fp(FILE *fp, EVP_PKEY *x, int nid, + char *kstr, int klen, + pem_password_cb *cb, void *u); +int PEM_write_PKCS8PrivateKey_nid(FILE *fp, EVP_PKEY *x, int nid, + char *kstr, int klen, + pem_password_cb *cb, void *u); + +EVP_PKEY *d2i_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY **x, pem_password_cb *cb, + void *u); + +int PEM_write_PKCS8PrivateKey(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc, + char *kstr, int klen, pem_password_cb *cd, void *u); + +EVP_PKEY *PEM_read_bio_Parameters(BIO *bp, EVP_PKEY **x); +int PEM_write_bio_Parameters(BIO *bp, EVP_PKEY *x); + + +EVP_PKEY *b2i_PrivateKey(const unsigned char **in, long length); +EVP_PKEY *b2i_PublicKey(const unsigned char **in, long length); +EVP_PKEY *b2i_PrivateKey_bio(BIO *in); +EVP_PKEY *b2i_PublicKey_bio(BIO *in); +int i2b_PrivateKey_bio(BIO *out, EVP_PKEY *pk); +int i2b_PublicKey_bio(BIO *out, EVP_PKEY *pk); +#ifndef OPENSSL_NO_RC4 +EVP_PKEY *b2i_PVK_bio(BIO *in, pem_password_cb *cb, void *u); +int i2b_PVK_bio(BIO *out, EVP_PKEY *pk, int enclevel, pem_password_cb *cb, + void *u); +#endif + + +void ERR_load_PEM_strings(void); + +/* Error codes for the PEM functions. */ + +/* Function codes. */ +#define PEM_F_B2I_DSS 127 +#define PEM_F_B2I_PVK_BIO 128 +#define PEM_F_B2I_RSA 129 +#define PEM_F_CHECK_BITLEN_DSA 130 +#define PEM_F_CHECK_BITLEN_RSA 131 +#define PEM_F_D2I_PKCS8PRIVATEKEY_BIO 120 +#define PEM_F_D2I_PKCS8PRIVATEKEY_FP 121 +#define PEM_F_DO_B2I 132 +#define PEM_F_DO_B2I_BIO 133 +#define PEM_F_DO_BLOB_HEADER 134 +#define PEM_F_DO_PK8PKEY 126 +#define PEM_F_DO_PK8PKEY_FP 125 +#define PEM_F_DO_PVK_BODY 135 +#define PEM_F_DO_PVK_HEADER 136 +#define PEM_F_I2B_PVK 137 +#define PEM_F_I2B_PVK_BIO 138 +#define PEM_F_LOAD_IV 101 +#define PEM_F_PEM_ASN1_READ 102 +#define PEM_F_PEM_ASN1_READ_BIO 103 +#define PEM_F_PEM_ASN1_WRITE 104 +#define PEM_F_PEM_ASN1_WRITE_BIO 105 +#define PEM_F_PEM_DEF_CALLBACK 100 +#define PEM_F_PEM_DO_HEADER 106 +#define PEM_F_PEM_F_PEM_WRITE_PKCS8PRIVATEKEY 118 +#define PEM_F_PEM_GET_EVP_CIPHER_INFO 107 +#define PEM_F_PEM_PK8PKEY 119 +#define PEM_F_PEM_READ 108 +#define PEM_F_PEM_READ_BIO 109 +#define PEM_F_PEM_READ_BIO_PARAMETERS 140 +#define PEM_F_PEM_READ_BIO_PRIVATEKEY 123 +#define PEM_F_PEM_READ_PRIVATEKEY 124 +#define PEM_F_PEM_SEALFINAL 110 +#define PEM_F_PEM_SEALINIT 111 +#define PEM_F_PEM_SIGNFINAL 112 +#define PEM_F_PEM_WRITE 113 +#define PEM_F_PEM_WRITE_BIO 114 +#define PEM_F_PEM_WRITE_PRIVATEKEY 139 +#define PEM_F_PEM_X509_INFO_READ 115 +#define PEM_F_PEM_X509_INFO_READ_BIO 116 +#define PEM_F_PEM_X509_INFO_WRITE_BIO 117 + +/* Reason codes. */ +#define PEM_R_BAD_BASE64_DECODE 100 +#define PEM_R_BAD_DECRYPT 101 +#define PEM_R_BAD_END_LINE 102 +#define PEM_R_BAD_IV_CHARS 103 +#define PEM_R_BAD_MAGIC_NUMBER 116 +#define PEM_R_BAD_PASSWORD_READ 104 +#define PEM_R_BAD_VERSION_NUMBER 117 +#define PEM_R_BIO_WRITE_FAILURE 118 +#define PEM_R_CIPHER_IS_NULL 127 +#define PEM_R_ERROR_CONVERTING_PRIVATE_KEY 115 +#define PEM_R_EXPECTING_PRIVATE_KEY_BLOB 119 +#define PEM_R_EXPECTING_PUBLIC_KEY_BLOB 120 +#define PEM_R_INCONSISTENT_HEADER 121 +#define PEM_R_KEYBLOB_HEADER_PARSE_ERROR 122 +#define PEM_R_KEYBLOB_TOO_SHORT 123 +#define PEM_R_NOT_DEK_INFO 105 +#define PEM_R_NOT_ENCRYPTED 106 +#define PEM_R_NOT_PROC_TYPE 107 +#define PEM_R_NO_START_LINE 108 +#define PEM_R_PROBLEMS_GETTING_PASSWORD 109 +#define PEM_R_PUBLIC_KEY_NO_RSA 110 +#define PEM_R_PVK_DATA_TOO_SHORT 124 +#define PEM_R_PVK_TOO_SHORT 125 +#define PEM_R_READ_KEY 111 +#define PEM_R_SHORT_HEADER 112 +#define PEM_R_UNSUPPORTED_CIPHER 113 +#define PEM_R_UNSUPPORTED_ENCRYPTION 114 +#define PEM_R_UNSUPPORTED_KEY_COMPONENTS 126 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/pkcs12.h b/curl/include/openssl/pkcs12.h new file mode 100644 index 0000000..2007120 --- /dev/null +++ b/curl/include/openssl/pkcs12.h @@ -0,0 +1,284 @@ +/* $OpenBSD: pkcs12.h,v 1.29 2025/03/09 15:45:52 tb Exp $ */ +/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#ifndef HEADER_PKCS12_H +#define HEADER_PKCS12_H + +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define PKCS12_KEY_ID 1 +#define PKCS12_IV_ID 2 +#define PKCS12_MAC_ID 3 + +/* Default iteration count */ +#ifndef PKCS12_DEFAULT_ITER +#define PKCS12_DEFAULT_ITER PKCS5_DEFAULT_ITER +#endif + +#define PKCS12_MAC_KEY_LENGTH 20 + +#define PKCS12_SALT_LEN 8 + +/* Uncomment out next line for unicode password and names, otherwise ASCII */ + +/*#define PBE_UNICODE*/ + +#ifdef PBE_UNICODE +#define PKCS12_key_gen PKCS12_key_gen_uni +#define PKCS12_add_friendlyname PKCS12_add_friendlyname_uni +#else +#define PKCS12_key_gen PKCS12_key_gen_asc +#define PKCS12_add_friendlyname PKCS12_add_friendlyname_asc +#endif + +/* MS key usage constants */ + +#define KEY_EX 0x10 +#define KEY_SIG 0x80 + +typedef struct PKCS12_MAC_DATA_st PKCS12_MAC_DATA; + +typedef struct PKCS12_st PKCS12; + +typedef struct PKCS12_SAFEBAG_st PKCS12_SAFEBAG; + +DECLARE_STACK_OF(PKCS12_SAFEBAG) +DECLARE_PKCS12_STACK_OF(PKCS12_SAFEBAG) + +typedef struct pkcs12_bag_st PKCS12_BAGS; + +#define PKCS12_ERROR 0 +#define PKCS12_OK 1 + +#ifndef LIBRESSL_INTERNAL + +/* Compatibility macros */ + +#define M_PKCS12_x5092certbag PKCS12_x5092certbag +#define M_PKCS12_x509crl2certbag PKCS12_x509crl2certbag + +#define M_PKCS12_certbag2x509 PKCS12_certbag2x509 +#define M_PKCS12_certbag2x509crl PKCS12_certbag2x509crl + +#define M_PKCS12_unpack_p7data PKCS12_unpack_p7data +#define M_PKCS12_pack_authsafes PKCS12_pack_authsafes +#define M_PKCS12_unpack_authsafes PKCS12_unpack_authsafes +#define M_PKCS12_unpack_p7encdata PKCS12_unpack_p7encdata + +#define M_PKCS12_decrypt_skey PKCS12_decrypt_skey +#define M_PKCS8_decrypt PKCS8_decrypt + +#endif /* !LIBRESSL_INTERNAL */ + +#define M_PKCS12_bag_type PKCS12_bag_type +#define M_PKCS12_cert_bag_type PKCS12_cert_bag_type +#define M_PKCS12_crl_bag_type PKCS12_cert_bag_type + +#define PKCS12_bag_type PKCS12_SAFEBAG_get_nid +#define PKCS12_cert_bag_type PKCS12_SAFEBAG_get_bag_nid + +#define PKCS12_certbag2x509 PKCS12_SAFEBAG_get1_cert +#define PKCS12_certbag2x509crl PKCS12_SAFEBAG_get1_crl + +#define PKCS12_x5092certbag PKCS12_SAFEBAG_create_cert +#define PKCS12_x509crl2certbag PKCS12_SAFEBAG_create_crl +#define PKCS12_MAKE_KEYBAG PKCS12_SAFEBAG_create0_p8inf +#define PKCS12_MAKE_SHKEYBAG PKCS12_SAFEBAG_create_pkcs8_encrypt + +const ASN1_TYPE *PKCS12_SAFEBAG_get0_attr(const PKCS12_SAFEBAG *bag, + int attr_nid); +const STACK_OF(X509_ATTRIBUTE) * + PKCS12_SAFEBAG_get0_attrs(const PKCS12_SAFEBAG *bag); +int PKCS12_SAFEBAG_get_nid(const PKCS12_SAFEBAG *bag); +int PKCS12_SAFEBAG_get_bag_nid(const PKCS12_SAFEBAG *bag); + +X509 *PKCS12_SAFEBAG_get1_cert(const PKCS12_SAFEBAG *bag); +X509_CRL *PKCS12_SAFEBAG_get1_crl(const PKCS12_SAFEBAG *bag); + +ASN1_TYPE *PKCS8_get_attr(PKCS8_PRIV_KEY_INFO *p8, int attr_nid); +int PKCS12_mac_present(const PKCS12 *p12); +void PKCS12_get0_mac(const ASN1_OCTET_STRING **pmac, const X509_ALGOR **pmacalg, + const ASN1_OCTET_STRING **psalt, const ASN1_INTEGER **piter, + const PKCS12 *p12); + +const PKCS8_PRIV_KEY_INFO *PKCS12_SAFEBAG_get0_p8inf(const PKCS12_SAFEBAG *bag); +const X509_SIG *PKCS12_SAFEBAG_get0_pkcs8(const PKCS12_SAFEBAG *bag); +const STACK_OF(PKCS12_SAFEBAG) * + PKCS12_SAFEBAG_get0_safes(const PKCS12_SAFEBAG *bag); +const ASN1_OBJECT *PKCS12_SAFEBAG_get0_type(const PKCS12_SAFEBAG *bag); + +PKCS8_PRIV_KEY_INFO *PKCS8_decrypt(const X509_SIG *p8, const char *pass, + int passlen); +PKCS8_PRIV_KEY_INFO *PKCS12_decrypt_skey(const PKCS12_SAFEBAG *bag, + const char *pass, int passlen); +X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher, + const char *pass, int passlen, unsigned char *salt, int saltlen, int iter, + PKCS8_PRIV_KEY_INFO *p8); + +STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7data(PKCS7 *p7); +STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7encdata(PKCS7 *p7, const char *pass, + int passlen); +STACK_OF(PKCS7) *PKCS12_unpack_authsafes(const PKCS12 *p12); + +int PKCS8_add_keyusage(PKCS8_PRIV_KEY_INFO *p8, int usage); +char *PKCS12_get_friendlyname(PKCS12_SAFEBAG *bag); +int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, + int saltlen, int id, int iter, int n, unsigned char *out, + const EVP_MD *md_type); +int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen); +int PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen, + unsigned char *salt, int saltlen, int iter, + const EVP_MD *md_type); + +unsigned char *OPENSSL_asc2uni(const char *asc, int asclen, + unsigned char **uni, int *unilen); +char *OPENSSL_uni2asc(const unsigned char *uni, int unilen); + +PKCS12 *PKCS12_new(void); +void PKCS12_free(PKCS12 *a); +PKCS12 *d2i_PKCS12(PKCS12 **a, const unsigned char **in, long len); +int i2d_PKCS12(PKCS12 *a, unsigned char **out); +extern const ASN1_ITEM PKCS12_it; + +PKCS12_SAFEBAG *PKCS12_SAFEBAG_new(void); +void PKCS12_SAFEBAG_free(PKCS12_SAFEBAG *a); +PKCS12_SAFEBAG *d2i_PKCS12_SAFEBAG(PKCS12_SAFEBAG **a, const unsigned char **in, long len); +int i2d_PKCS12_SAFEBAG(PKCS12_SAFEBAG *a, unsigned char **out); +extern const ASN1_ITEM PKCS12_SAFEBAG_it; + +void PKCS12_PBE_add(void); +int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert, + STACK_OF(X509) **ca); +PKCS12 *PKCS12_create(const char *pass, const char *name, EVP_PKEY *pkey, + X509 *cert, STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter, + int mac_iter, int keytype); + +int i2d_PKCS12_bio(BIO *bp, PKCS12 *p12); +int i2d_PKCS12_fp(FILE *fp, PKCS12 *p12); +PKCS12 *d2i_PKCS12_bio(BIO *bp, PKCS12 **p12); +PKCS12 *d2i_PKCS12_fp(FILE *fp, PKCS12 **p12); +int PKCS12_newpass(PKCS12 *p12, const char *oldpass, const char *newpass); + +void ERR_load_PKCS12_strings(void); + +/* Error codes for the PKCS12 functions. */ + +/* Function codes. */ +#define PKCS12_F_PARSE_BAG 129 +#define PKCS12_F_PARSE_BAGS 103 +#define PKCS12_F_PKCS12_ADD_FRIENDLYNAME 100 +#define PKCS12_F_PKCS12_ADD_FRIENDLYNAME_ASC 127 +#define PKCS12_F_PKCS12_ADD_FRIENDLYNAME_UNI 102 +#define PKCS12_F_PKCS12_ADD_LOCALKEYID 104 +#define PKCS12_F_PKCS12_CREATE 105 +#define PKCS12_F_PKCS12_GEN_MAC 107 +#define PKCS12_F_PKCS12_INIT 109 +#define PKCS12_F_PKCS12_ITEM_DECRYPT_D2I 106 +#define PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT 108 +#define PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG 117 +#define PKCS12_F_PKCS12_KEY_GEN_ASC 110 +#define PKCS12_F_PKCS12_KEY_GEN_UNI 111 +#define PKCS12_F_PKCS12_MAKE_KEYBAG 112 +#define PKCS12_F_PKCS12_MAKE_SHKEYBAG 113 +#define PKCS12_F_PKCS12_NEWPASS 128 +#define PKCS12_F_PKCS12_PACK_P7DATA 114 +#define PKCS12_F_PKCS12_PACK_P7ENCDATA 115 +#define PKCS12_F_PKCS12_PARSE 118 +#define PKCS12_F_PKCS12_PBE_CRYPT 119 +#define PKCS12_F_PKCS12_PBE_KEYIVGEN 120 +#define PKCS12_F_PKCS12_SETUP_MAC 122 +#define PKCS12_F_PKCS12_SET_MAC 123 +#define PKCS12_F_PKCS12_UNPACK_AUTHSAFES 130 +#define PKCS12_F_PKCS12_UNPACK_P7DATA 131 +#define PKCS12_F_PKCS12_VERIFY_MAC 126 +#define PKCS12_F_PKCS8_ADD_KEYUSAGE 124 +#define PKCS12_F_PKCS8_ENCRYPT 125 + +/* Reason codes. */ +#define PKCS12_R_CANT_PACK_STRUCTURE 100 +#define PKCS12_R_CONTENT_TYPE_NOT_DATA 121 +#define PKCS12_R_DECODE_ERROR 101 +#define PKCS12_R_ENCODE_ERROR 102 +#define PKCS12_R_ENCRYPT_ERROR 103 +#define PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE 120 +#define PKCS12_R_INVALID_NULL_ARGUMENT 104 +#define PKCS12_R_INVALID_NULL_PKCS12_POINTER 105 +#define PKCS12_R_IV_GEN_ERROR 106 +#define PKCS12_R_KEY_GEN_ERROR 107 +#define PKCS12_R_MAC_ABSENT 108 +#define PKCS12_R_MAC_GENERATION_ERROR 109 +#define PKCS12_R_MAC_SETUP_ERROR 110 +#define PKCS12_R_MAC_STRING_SET_ERROR 111 +#define PKCS12_R_MAC_VERIFY_ERROR 112 +#define PKCS12_R_MAC_VERIFY_FAILURE 113 +#define PKCS12_R_PARSE_ERROR 114 +#define PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR 115 +#define PKCS12_R_PKCS12_CIPHERFINAL_ERROR 116 +#define PKCS12_R_PKCS12_PBE_CRYPT_ERROR 117 +#define PKCS12_R_UNKNOWN_DIGEST_ALGORITHM 118 +#define PKCS12_R_UNSUPPORTED_PKCS12_MODE 119 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/pkcs7.h b/curl/include/openssl/pkcs7.h new file mode 100644 index 0000000..b286205 --- /dev/null +++ b/curl/include/openssl/pkcs7.h @@ -0,0 +1,522 @@ +/* $OpenBSD: pkcs7.h,v 1.22 2024/10/23 01:57:19 jsg Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_PKCS7_H +#define HEADER_PKCS7_H + +#include + +#include +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(_WIN32) && defined(__WINCRYPT_H__) +#if !defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_DISABLE_OVERRIDE_WINCRYPT_DEFINES_WARNING) +#ifdef _MSC_VER +#pragma message("Warning, overriding WinCrypt defines") +#else +#warning overriding WinCrypt defines +#endif +#endif +#undef PKCS7_ISSUER_AND_SERIAL +#undef PKCS7_SIGNER_INFO +#endif + +/* +Encryption_ID DES-CBC +Digest_ID MD5 +Digest_Encryption_ID rsaEncryption +Key_Encryption_ID rsaEncryption +*/ + +typedef struct pkcs7_issuer_and_serial_st { + X509_NAME *issuer; + ASN1_INTEGER *serial; +} PKCS7_ISSUER_AND_SERIAL; + +typedef struct pkcs7_signer_info_st { + ASN1_INTEGER *version; /* version 1 */ + PKCS7_ISSUER_AND_SERIAL *issuer_and_serial; + X509_ALGOR *digest_alg; + STACK_OF(X509_ATTRIBUTE) *auth_attr; /* [ 0 ] */ + X509_ALGOR *digest_enc_alg; + ASN1_OCTET_STRING *enc_digest; + STACK_OF(X509_ATTRIBUTE) *unauth_attr; /* [ 1 ] */ + + /* The private key to sign with */ + EVP_PKEY *pkey; +} PKCS7_SIGNER_INFO; + +DECLARE_STACK_OF(PKCS7_SIGNER_INFO) + +typedef struct pkcs7_recip_info_st { + ASN1_INTEGER *version; /* version 0 */ + PKCS7_ISSUER_AND_SERIAL *issuer_and_serial; + X509_ALGOR *key_enc_algor; + ASN1_OCTET_STRING *enc_key; + X509 *cert; /* get the pub-key from this */ +} PKCS7_RECIP_INFO; + +DECLARE_STACK_OF(PKCS7_RECIP_INFO) + +typedef struct pkcs7_signed_st { + ASN1_INTEGER *version; /* version 1 */ + STACK_OF(X509_ALGOR) *md_algs; /* md used */ + STACK_OF(X509) *cert; /* [ 0 ] */ + STACK_OF(X509_CRL) *crl; /* [ 1 ] */ + STACK_OF(PKCS7_SIGNER_INFO) *signer_info; + + struct pkcs7_st *contents; +} PKCS7_SIGNED; +/* The above structure is very very similar to PKCS7_SIGN_ENVELOPE. + * How about merging the two */ + +typedef struct pkcs7_enc_content_st { + ASN1_OBJECT *content_type; + X509_ALGOR *algorithm; + ASN1_OCTET_STRING *enc_data; /* [ 0 ] */ + const EVP_CIPHER *cipher; +} PKCS7_ENC_CONTENT; + +typedef struct pkcs7_enveloped_st { + ASN1_INTEGER *version; /* version 0 */ + STACK_OF(PKCS7_RECIP_INFO) *recipientinfo; + PKCS7_ENC_CONTENT *enc_data; +} PKCS7_ENVELOPE; + +typedef struct pkcs7_signedandenveloped_st { + ASN1_INTEGER *version; /* version 1 */ + STACK_OF(X509_ALGOR) *md_algs; /* md used */ + STACK_OF(X509) *cert; /* [ 0 ] */ + STACK_OF(X509_CRL) *crl; /* [ 1 ] */ + STACK_OF(PKCS7_SIGNER_INFO) *signer_info; + + PKCS7_ENC_CONTENT *enc_data; + STACK_OF(PKCS7_RECIP_INFO) *recipientinfo; +} PKCS7_SIGN_ENVELOPE; + +typedef struct pkcs7_digest_st { + ASN1_INTEGER *version; /* version 0 */ + X509_ALGOR *md; /* md used */ + struct pkcs7_st *contents; + ASN1_OCTET_STRING *digest; +} PKCS7_DIGEST; + +typedef struct pkcs7_encrypted_st { + ASN1_INTEGER *version; /* version 0 */ + PKCS7_ENC_CONTENT *enc_data; +} PKCS7_ENCRYPT; + +typedef struct pkcs7_st { + /* The following is non NULL if it contains ASN1 encoding of + * this structure */ + unsigned char *asn1; + long length; + +#define PKCS7_S_HEADER 0 +#define PKCS7_S_BODY 1 +#define PKCS7_S_TAIL 2 + int state; /* used during processing */ + + int detached; + + ASN1_OBJECT *type; + /* content as defined by the type */ + /* all encryption/message digests are applied to the 'contents', + * leaving out the 'type' field. */ + union { + char *ptr; + + /* NID_pkcs7_data */ + ASN1_OCTET_STRING *data; + + /* NID_pkcs7_signed */ + PKCS7_SIGNED *sign; + + /* NID_pkcs7_enveloped */ + PKCS7_ENVELOPE *enveloped; + + /* NID_pkcs7_signedAndEnveloped */ + PKCS7_SIGN_ENVELOPE *signed_and_enveloped; + + /* NID_pkcs7_digest */ + PKCS7_DIGEST *digest; + + /* NID_pkcs7_encrypted */ + PKCS7_ENCRYPT *encrypted; + + /* Anything else */ + ASN1_TYPE *other; + } d; +} PKCS7; + +DECLARE_STACK_OF(PKCS7) +DECLARE_PKCS12_STACK_OF(PKCS7) + +#define PKCS7_OP_SET_DETACHED_SIGNATURE 1 +#define PKCS7_OP_GET_DETACHED_SIGNATURE 2 + +#define PKCS7_get_signed_attributes(si) ((si)->auth_attr) +#define PKCS7_get_attributes(si) ((si)->unauth_attr) + +#define PKCS7_type_is_signed(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_signed) +#define PKCS7_type_is_encrypted(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_encrypted) +#define PKCS7_type_is_enveloped(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_enveloped) +#define PKCS7_type_is_signedAndEnveloped(a) \ + (OBJ_obj2nid((a)->type) == NID_pkcs7_signedAndEnveloped) +#define PKCS7_type_is_data(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_data) +#define PKCS7_type_is_digest(a) (OBJ_obj2nid((a)->type) == NID_pkcs7_digest) +#define PKCS7_type_is_encrypted(a) \ + (OBJ_obj2nid((a)->type) == NID_pkcs7_encrypted) + +#define PKCS7_set_detached(p,v) \ + PKCS7_ctrl(p,PKCS7_OP_SET_DETACHED_SIGNATURE,v,NULL) +#define PKCS7_get_detached(p) \ + PKCS7_ctrl(p,PKCS7_OP_GET_DETACHED_SIGNATURE,0,NULL) + +#define PKCS7_is_detached(p7) (PKCS7_type_is_signed(p7) && PKCS7_get_detached(p7)) + +/* S/MIME related flags */ + +#define PKCS7_TEXT 0x1 +#define PKCS7_NOCERTS 0x2 +#define PKCS7_NOSIGS 0x4 +#define PKCS7_NOCHAIN 0x8 +#define PKCS7_NOINTERN 0x10 +#define PKCS7_NOVERIFY 0x20 +#define PKCS7_DETACHED 0x40 +#define PKCS7_BINARY 0x80 +#define PKCS7_NOATTR 0x100 +#define PKCS7_NOSMIMECAP 0x200 +#define PKCS7_NOOLDMIMETYPE 0x400 +#define PKCS7_CRLFEOL 0x800 +#define PKCS7_STREAM 0x1000 +#define PKCS7_NOCRL 0x2000 +#define PKCS7_PARTIAL 0x4000 +#define PKCS7_REUSE_DIGEST 0x8000 + +/* Flags: for compatibility with older code */ + +#define SMIME_TEXT PKCS7_TEXT +#define SMIME_NOCERTS PKCS7_NOCERTS +#define SMIME_NOSIGS PKCS7_NOSIGS +#define SMIME_NOCHAIN PKCS7_NOCHAIN +#define SMIME_NOINTERN PKCS7_NOINTERN +#define SMIME_NOVERIFY PKCS7_NOVERIFY +#define SMIME_DETACHED PKCS7_DETACHED +#define SMIME_BINARY PKCS7_BINARY +#define SMIME_NOATTR PKCS7_NOATTR + +PKCS7_ISSUER_AND_SERIAL *PKCS7_ISSUER_AND_SERIAL_new(void); +void PKCS7_ISSUER_AND_SERIAL_free(PKCS7_ISSUER_AND_SERIAL *a); +PKCS7_ISSUER_AND_SERIAL *d2i_PKCS7_ISSUER_AND_SERIAL(PKCS7_ISSUER_AND_SERIAL **a, const unsigned char **in, long len); +int i2d_PKCS7_ISSUER_AND_SERIAL(PKCS7_ISSUER_AND_SERIAL *a, unsigned char **out); +extern const ASN1_ITEM PKCS7_ISSUER_AND_SERIAL_it; + +int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data, + const EVP_MD *type, unsigned char *md, unsigned int *len); +PKCS7 *d2i_PKCS7_fp(FILE *fp, PKCS7 **p7); +int i2d_PKCS7_fp(FILE *fp, PKCS7 *p7); +PKCS7 *PKCS7_dup(PKCS7 *p7); +PKCS7 *d2i_PKCS7_bio(BIO *bp, PKCS7 **p7); +int i2d_PKCS7_bio(BIO *bp, PKCS7 *p7); +int i2d_PKCS7_bio_stream(BIO *out, PKCS7 *p7, BIO *in, int flags); +int PEM_write_bio_PKCS7_stream(BIO *out, PKCS7 *p7, BIO *in, int flags); + +PKCS7_SIGNER_INFO *PKCS7_SIGNER_INFO_new(void); +void PKCS7_SIGNER_INFO_free(PKCS7_SIGNER_INFO *a); +PKCS7_SIGNER_INFO *d2i_PKCS7_SIGNER_INFO(PKCS7_SIGNER_INFO **a, const unsigned char **in, long len); +int i2d_PKCS7_SIGNER_INFO(PKCS7_SIGNER_INFO *a, unsigned char **out); +extern const ASN1_ITEM PKCS7_SIGNER_INFO_it; +PKCS7_RECIP_INFO *PKCS7_RECIP_INFO_new(void); +void PKCS7_RECIP_INFO_free(PKCS7_RECIP_INFO *a); +PKCS7_RECIP_INFO *d2i_PKCS7_RECIP_INFO(PKCS7_RECIP_INFO **a, const unsigned char **in, long len); +int i2d_PKCS7_RECIP_INFO(PKCS7_RECIP_INFO *a, unsigned char **out); +extern const ASN1_ITEM PKCS7_RECIP_INFO_it; +PKCS7_SIGNED *PKCS7_SIGNED_new(void); +void PKCS7_SIGNED_free(PKCS7_SIGNED *a); +PKCS7_SIGNED *d2i_PKCS7_SIGNED(PKCS7_SIGNED **a, const unsigned char **in, long len); +int i2d_PKCS7_SIGNED(PKCS7_SIGNED *a, unsigned char **out); +extern const ASN1_ITEM PKCS7_SIGNED_it; +PKCS7_ENC_CONTENT *PKCS7_ENC_CONTENT_new(void); +void PKCS7_ENC_CONTENT_free(PKCS7_ENC_CONTENT *a); +PKCS7_ENC_CONTENT *d2i_PKCS7_ENC_CONTENT(PKCS7_ENC_CONTENT **a, const unsigned char **in, long len); +int i2d_PKCS7_ENC_CONTENT(PKCS7_ENC_CONTENT *a, unsigned char **out); +extern const ASN1_ITEM PKCS7_ENC_CONTENT_it; +PKCS7_ENVELOPE *PKCS7_ENVELOPE_new(void); +void PKCS7_ENVELOPE_free(PKCS7_ENVELOPE *a); +PKCS7_ENVELOPE *d2i_PKCS7_ENVELOPE(PKCS7_ENVELOPE **a, const unsigned char **in, long len); +int i2d_PKCS7_ENVELOPE(PKCS7_ENVELOPE *a, unsigned char **out); +extern const ASN1_ITEM PKCS7_ENVELOPE_it; +PKCS7_SIGN_ENVELOPE *PKCS7_SIGN_ENVELOPE_new(void); +void PKCS7_SIGN_ENVELOPE_free(PKCS7_SIGN_ENVELOPE *a); +PKCS7_SIGN_ENVELOPE *d2i_PKCS7_SIGN_ENVELOPE(PKCS7_SIGN_ENVELOPE **a, const unsigned char **in, long len); +int i2d_PKCS7_SIGN_ENVELOPE(PKCS7_SIGN_ENVELOPE *a, unsigned char **out); +extern const ASN1_ITEM PKCS7_SIGN_ENVELOPE_it; +PKCS7_DIGEST *PKCS7_DIGEST_new(void); +void PKCS7_DIGEST_free(PKCS7_DIGEST *a); +PKCS7_DIGEST *d2i_PKCS7_DIGEST(PKCS7_DIGEST **a, const unsigned char **in, long len); +int i2d_PKCS7_DIGEST(PKCS7_DIGEST *a, unsigned char **out); +extern const ASN1_ITEM PKCS7_DIGEST_it; +PKCS7_ENCRYPT *PKCS7_ENCRYPT_new(void); +void PKCS7_ENCRYPT_free(PKCS7_ENCRYPT *a); +PKCS7_ENCRYPT *d2i_PKCS7_ENCRYPT(PKCS7_ENCRYPT **a, const unsigned char **in, long len); +int i2d_PKCS7_ENCRYPT(PKCS7_ENCRYPT *a, unsigned char **out); +extern const ASN1_ITEM PKCS7_ENCRYPT_it; +PKCS7 *PKCS7_new(void); +void PKCS7_free(PKCS7 *a); +PKCS7 *d2i_PKCS7(PKCS7 **a, const unsigned char **in, long len); +int i2d_PKCS7(PKCS7 *a, unsigned char **out); +extern const ASN1_ITEM PKCS7_it; + +extern const ASN1_ITEM PKCS7_ATTR_SIGN_it; +extern const ASN1_ITEM PKCS7_ATTR_VERIFY_it; + +int PKCS7_print_ctx(BIO *out, PKCS7 *x, int indent, const ASN1_PCTX *pctx); + +long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg); + +int PKCS7_set_type(PKCS7 *p7, int type); +int PKCS7_set0_type_other(PKCS7 *p7, int type, ASN1_TYPE *other); +int PKCS7_set_content(PKCS7 *p7, PKCS7 *p7_data); +int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey, + const EVP_MD *dgst); +int PKCS7_SIGNER_INFO_sign(PKCS7_SIGNER_INFO *si); +int PKCS7_add_signer(PKCS7 *p7, PKCS7_SIGNER_INFO *p7i); +int PKCS7_add_certificate(PKCS7 *p7, X509 *x509); +int PKCS7_add_crl(PKCS7 *p7, X509_CRL *x509); +int PKCS7_content_new(PKCS7 *p7, int nid); +int PKCS7_dataVerify(X509_STORE *cert_store, X509_STORE_CTX *ctx, + BIO *bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si); +int PKCS7_signatureVerify(BIO *bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si, + X509 *x509); + +BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio); +int PKCS7_dataFinal(PKCS7 *p7, BIO *bio); +BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert); + + +PKCS7_SIGNER_INFO *PKCS7_add_signature(PKCS7 *p7, X509 *x509, + EVP_PKEY *pkey, const EVP_MD *dgst); +X509 *PKCS7_cert_from_signer_info(PKCS7 *p7, PKCS7_SIGNER_INFO *si); +int PKCS7_set_digest(PKCS7 *p7, const EVP_MD *md); +STACK_OF(PKCS7_SIGNER_INFO) *PKCS7_get_signer_info(PKCS7 *p7); + +PKCS7_RECIP_INFO *PKCS7_add_recipient(PKCS7 *p7, X509 *x509); +void PKCS7_SIGNER_INFO_get0_algs(PKCS7_SIGNER_INFO *si, EVP_PKEY **pk, + X509_ALGOR **pdig, X509_ALGOR **psig); +void PKCS7_RECIP_INFO_get0_alg(PKCS7_RECIP_INFO *ri, X509_ALGOR **penc); +int PKCS7_add_recipient_info(PKCS7 *p7, PKCS7_RECIP_INFO *ri); +int PKCS7_RECIP_INFO_set(PKCS7_RECIP_INFO *p7i, X509 *x509); +int PKCS7_set_cipher(PKCS7 *p7, const EVP_CIPHER *cipher); +int PKCS7_stream(unsigned char ***boundary, PKCS7 *p7); + +PKCS7_ISSUER_AND_SERIAL *PKCS7_get_issuer_and_serial(PKCS7 *p7, int idx); +ASN1_OCTET_STRING *PKCS7_digest_from_attributes(STACK_OF(X509_ATTRIBUTE) *sk); +int PKCS7_add_signed_attribute(PKCS7_SIGNER_INFO *p7si, int nid, int type, + void *data); +int PKCS7_add_attribute (PKCS7_SIGNER_INFO *p7si, int nid, int atrtype, + void *value); +ASN1_TYPE *PKCS7_get_attribute(PKCS7_SIGNER_INFO *si, int nid); +ASN1_TYPE *PKCS7_get_signed_attribute(PKCS7_SIGNER_INFO *si, int nid); +int PKCS7_set_signed_attributes(PKCS7_SIGNER_INFO *p7si, + STACK_OF(X509_ATTRIBUTE) *sk); +int PKCS7_set_attributes(PKCS7_SIGNER_INFO *p7si, STACK_OF(X509_ATTRIBUTE) *sk); + + +PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs, + BIO *data, int flags); + +PKCS7_SIGNER_INFO *PKCS7_sign_add_signer(PKCS7 *p7, + X509 *signcert, EVP_PKEY *pkey, const EVP_MD *md, + int flags); + +int PKCS7_final(PKCS7 *p7, BIO *data, int flags); +int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store, + BIO *indata, BIO *out, int flags); +STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags); +PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, const EVP_CIPHER *cipher, + int flags); +int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags); + +int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si, + STACK_OF(X509_ALGOR) *cap); +STACK_OF(X509_ALGOR) *PKCS7_get_smimecap(PKCS7_SIGNER_INFO *si); +int PKCS7_simple_smimecap(STACK_OF(X509_ALGOR) *sk, int nid, int arg); + +int PKCS7_add_attrib_content_type(PKCS7_SIGNER_INFO *si, ASN1_OBJECT *coid); +int PKCS7_add0_attrib_signing_time(PKCS7_SIGNER_INFO *si, ASN1_TIME *t); +int PKCS7_add1_attrib_digest(PKCS7_SIGNER_INFO *si, + const unsigned char *md, int mdlen); + +int SMIME_write_PKCS7(BIO *bio, PKCS7 *p7, BIO *data, int flags); +PKCS7 *SMIME_read_PKCS7(BIO *bio, BIO **bcont); + +BIO *BIO_new_PKCS7(BIO *out, PKCS7 *p7); + + +void ERR_load_PKCS7_strings(void); + +/* Error codes for the PKCS7 functions. */ + +/* Function codes. */ +#define PKCS7_F_B64_READ_PKCS7 120 +#define PKCS7_F_B64_WRITE_PKCS7 121 +#define PKCS7_F_DO_PKCS7_SIGNED_ATTRIB 136 +#define PKCS7_F_I2D_PKCS7_BIO_STREAM 140 +#define PKCS7_F_PKCS7_ADD0_ATTRIB_SIGNING_TIME 135 +#define PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP 118 +#define PKCS7_F_PKCS7_ADD_CERTIFICATE 100 +#define PKCS7_F_PKCS7_ADD_CRL 101 +#define PKCS7_F_PKCS7_ADD_RECIPIENT_INFO 102 +#define PKCS7_F_PKCS7_ADD_SIGNATURE 131 +#define PKCS7_F_PKCS7_ADD_SIGNER 103 +#define PKCS7_F_PKCS7_BIO_ADD_DIGEST 125 +#define PKCS7_F_PKCS7_COPY_EXISTING_DIGEST 138 +#define PKCS7_F_PKCS7_CTRL 104 +#define PKCS7_F_PKCS7_DATADECODE 112 +#define PKCS7_F_PKCS7_DATAFINAL 128 +#define PKCS7_F_PKCS7_DATAINIT 105 +#define PKCS7_F_PKCS7_DATASIGN 106 +#define PKCS7_F_PKCS7_DATAVERIFY 107 +#define PKCS7_F_PKCS7_DECRYPT 114 +#define PKCS7_F_PKCS7_DECRYPT_RINFO 133 +#define PKCS7_F_PKCS7_ENCODE_RINFO 132 +#define PKCS7_F_PKCS7_ENCRYPT 115 +#define PKCS7_F_PKCS7_FINAL 134 +#define PKCS7_F_PKCS7_FIND_DIGEST 127 +#define PKCS7_F_PKCS7_GET0_SIGNERS 124 +#define PKCS7_F_PKCS7_RECIP_INFO_SET 130 +#define PKCS7_F_PKCS7_SET_CIPHER 108 +#define PKCS7_F_PKCS7_SET_CONTENT 109 +#define PKCS7_F_PKCS7_SET_DIGEST 126 +#define PKCS7_F_PKCS7_SET_TYPE 110 +#define PKCS7_F_PKCS7_SIGN 116 +#define PKCS7_F_PKCS7_SIGNATUREVERIFY 113 +#define PKCS7_F_PKCS7_SIGNER_INFO_SET 129 +#define PKCS7_F_PKCS7_SIGNER_INFO_SIGN 139 +#define PKCS7_F_PKCS7_SIGN_ADD_SIGNER 137 +#define PKCS7_F_PKCS7_SIMPLE_SMIMECAP 119 +#define PKCS7_F_PKCS7_VERIFY 117 +#define PKCS7_F_SMIME_READ_PKCS7 122 +#define PKCS7_F_SMIME_TEXT 123 + +/* Reason codes. */ +#define PKCS7_R_CERTIFICATE_VERIFY_ERROR 117 +#define PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER 144 +#define PKCS7_R_CIPHER_NOT_INITIALIZED 116 +#define PKCS7_R_CONTENT_AND_DATA_PRESENT 118 +#define PKCS7_R_CTRL_ERROR 152 +#define PKCS7_R_DECODE_ERROR 130 +#define PKCS7_R_DECRYPTED_KEY_IS_WRONG_LENGTH 100 +#define PKCS7_R_DECRYPT_ERROR 119 +#define PKCS7_R_DIGEST_FAILURE 101 +#define PKCS7_R_ENCRYPTION_CTRL_FAILURE 149 +#define PKCS7_R_ENCRYPTION_NOT_SUPPORTED_FOR_THIS_KEY_TYPE 150 +#define PKCS7_R_ERROR_ADDING_RECIPIENT 120 +#define PKCS7_R_ERROR_SETTING_CIPHER 121 +#define PKCS7_R_INVALID_MIME_TYPE 131 +#define PKCS7_R_INVALID_NULL_POINTER 143 +#define PKCS7_R_MIME_NO_CONTENT_TYPE 132 +#define PKCS7_R_MIME_PARSE_ERROR 133 +#define PKCS7_R_MIME_SIG_PARSE_ERROR 134 +#define PKCS7_R_MISSING_CERIPEND_INFO 103 +#define PKCS7_R_NO_CONTENT 122 +#define PKCS7_R_NO_CONTENT_TYPE 135 +#define PKCS7_R_NO_DEFAULT_DIGEST 151 +#define PKCS7_R_NO_MATCHING_DIGEST_TYPE_FOUND 154 +#define PKCS7_R_NO_MULTIPART_BODY_FAILURE 136 +#define PKCS7_R_NO_MULTIPART_BOUNDARY 137 +#define PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE 115 +#define PKCS7_R_NO_RECIPIENT_MATCHES_KEY 146 +#define PKCS7_R_NO_SIGNATURES_ON_DATA 123 +#define PKCS7_R_NO_SIGNERS 142 +#define PKCS7_R_NO_SIG_CONTENT_TYPE 138 +#define PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE 104 +#define PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR 124 +#define PKCS7_R_PKCS7_ADD_SIGNER_ERROR 153 +#define PKCS7_R_PKCS7_DATAFINAL 126 +#define PKCS7_R_PKCS7_DATAFINAL_ERROR 125 +#define PKCS7_R_PKCS7_DATASIGN 145 +#define PKCS7_R_PKCS7_PARSE_ERROR 139 +#define PKCS7_R_PKCS7_SIG_PARSE_ERROR 140 +#define PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 127 +#define PKCS7_R_SIGNATURE_FAILURE 105 +#define PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND 128 +#define PKCS7_R_SIGNING_CTRL_FAILURE 147 +#define PKCS7_R_SIGNING_NOT_SUPPORTED_FOR_THIS_KEY_TYPE 148 +#define PKCS7_R_SIG_INVALID_MIME_TYPE 141 +#define PKCS7_R_SMIME_TEXT_ERROR 129 +#define PKCS7_R_UNABLE_TO_FIND_CERTIFICATE 106 +#define PKCS7_R_UNABLE_TO_FIND_MEM_BIO 107 +#define PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST 108 +#define PKCS7_R_UNKNOWN_DIGEST_TYPE 109 +#define PKCS7_R_UNKNOWN_OPERATION 110 +#define PKCS7_R_UNSUPPORTED_CIPHER_TYPE 111 +#define PKCS7_R_UNSUPPORTED_CONTENT_TYPE 112 +#define PKCS7_R_WRONG_CONTENT_TYPE 113 +#define PKCS7_R_WRONG_PKCS7_TYPE 114 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/poly1305.h b/curl/include/openssl/poly1305.h new file mode 100644 index 0000000..f538335 --- /dev/null +++ b/curl/include/openssl/poly1305.h @@ -0,0 +1,45 @@ +/* $OpenBSD: poly1305.h,v 1.4 2025/01/25 17:59:44 tb Exp $ */ +/* + * Copyright (c) 2014 Joel Sing + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef HEADER_POLY1305_H +#define HEADER_POLY1305_H + +#include + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct poly1305_context { + size_t aligner; + unsigned char opaque[136]; +} poly1305_context; + +typedef struct poly1305_context poly1305_state; + +void CRYPTO_poly1305_init(poly1305_context *ctx, const unsigned char key[32]); +void CRYPTO_poly1305_update(poly1305_context *ctx, const unsigned char *in, + size_t len); +void CRYPTO_poly1305_finish(poly1305_context *ctx, unsigned char mac[16]); + +#ifdef __cplusplus +} +#endif + +#endif /* HEADER_POLY1305_H */ diff --git a/curl/include/openssl/posix_time.h b/curl/include/openssl/posix_time.h new file mode 100644 index 0000000..82b3f30 --- /dev/null +++ b/curl/include/openssl/posix_time.h @@ -0,0 +1,54 @@ +/* $OpenBSD: posix_time.h,v 1.1 2024/02/18 16:28:38 tb Exp $ */ +/* + * Copyright (c) 2022, Google Inc. + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY + * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION + * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN + * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef OPENSSL_HEADER_POSIX_TIME_H +#define OPENSSL_HEADER_POSIX_TIME_H + +#include +#include + +#if defined(__cplusplus) +extern "C" { +#endif + +/* + * OPENSSL_posix_to_tm converts a int64_t POSIX time value in |time|, which must + * be in the range of year 0000 to 9999, to a broken out time value in |tm|. It + * returns one on success and zero on error. + */ +int OPENSSL_posix_to_tm(int64_t time, struct tm *out_tm); + +/* + * OPENSSL_tm_to_posix converts a time value between the years 0 and 9999 in + * |tm| to a POSIX time value in |out|. One is returned on success, zero is + * returned on failure. It is a failure if |tm| contains out of range values. + */ +int OPENSSL_tm_to_posix(const struct tm *tm, int64_t *out); + +/* + * OPENSSL_timegm converts a time value between the years 0 and 9999 in |tm| to + * a time_t value in |out|. One is returned on success, zero is returned on + * failure. It is a failure if the converted time can not be represented in a + * time_t, or if the tm contains out of range values. + */ +int OPENSSL_timegm(const struct tm *tm, time_t *out); + +#if defined(__cplusplus) +} /* extern C */ +#endif + +#endif /* OPENSSL_HEADER_POSIX_TIME_H */ diff --git a/curl/include/openssl/rand.h b/curl/include/openssl/rand.h new file mode 100644 index 0000000..1a2c8f7 --- /dev/null +++ b/curl/include/openssl/rand.h @@ -0,0 +1,118 @@ +/* $OpenBSD: rand.h,v 1.25 2024/04/10 14:53:01 beck Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#include + +#ifndef HEADER_RAND_H +#define HEADER_RAND_H + +#include + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* Already defined in ossl_typ.h */ +/* typedef struct rand_meth_st RAND_METHOD; */ + +struct rand_meth_st { + void (*seed)(const void *buf, int num); + int (*bytes)(unsigned char *buf, int num); + void (*cleanup)(void); + void (*add)(const void *buf, int num, double entropy); + int (*pseudorand)(unsigned char *buf, int num); + int (*status)(void); +}; + +int RAND_set_rand_method(const RAND_METHOD *meth); +const RAND_METHOD *RAND_get_rand_method(void); +RAND_METHOD *RAND_SSLeay(void); + +void RAND_cleanup(void ); +int RAND_bytes(unsigned char *buf, int num); +int RAND_pseudo_bytes(unsigned char *buf, int num); +void RAND_seed(const void *buf, int num); +void RAND_add(const void *buf, int num, double entropy); +int RAND_load_file(const char *file, long max_bytes); +int RAND_write_file(const char *file); +const char *RAND_file_name(char *file, size_t num); +int RAND_status(void); +int RAND_poll(void); + +void ERR_load_RAND_strings(void); + +/* Error codes for the RAND functions. (no longer used) */ + +/* Function codes. */ +#define RAND_F_RAND_GET_RAND_METHOD 101 +#define RAND_F_RAND_INIT_FIPS 102 +#define RAND_F_SSLEAY_RAND_BYTES 100 + +/* Reason codes. */ +#define RAND_R_DUAL_EC_DRBG_DISABLED 104 +#define RAND_R_ERROR_INITIALISING_DRBG 102 +#define RAND_R_ERROR_INSTANTIATING_DRBG 103 +#define RAND_R_NO_FIPS_RANDOM_METHOD_SET 101 +#define RAND_R_PRNG_NOT_SEEDED 100 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/rc2.h b/curl/include/openssl/rc2.h new file mode 100644 index 0000000..96e395f --- /dev/null +++ b/curl/include/openssl/rc2.h @@ -0,0 +1,96 @@ +/* $OpenBSD: rc2.h,v 1.13 2025/01/25 17:59:44 tb Exp $ */ +/* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_RC2_H +#define HEADER_RC2_H + +#include /* OPENSSL_NO_RC2, RC2_INT */ + +#define RC2_ENCRYPT 1 +#define RC2_DECRYPT 0 + +#define RC2_BLOCK 8 +#define RC2_KEY_LENGTH 16 + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct rc2_key_st { + RC2_INT data[64]; +} RC2_KEY; + +void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data, int bits); +void RC2_ecb_encrypt(const unsigned char *in, unsigned char *out, RC2_KEY *key, + int enc); +void RC2_encrypt(unsigned long *data, RC2_KEY *key); +void RC2_decrypt(unsigned long *data, RC2_KEY *key); +void RC2_cbc_encrypt(const unsigned char *in, unsigned char *out, long length, + RC2_KEY *ks, unsigned char *iv, int enc); +void RC2_cfb64_encrypt(const unsigned char *in, unsigned char *out, + long length, RC2_KEY *schedule, unsigned char *ivec, + int *num, int enc); +void RC2_ofb64_encrypt(const unsigned char *in, unsigned char *out, + long length, RC2_KEY *schedule, unsigned char *ivec, + int *num); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/rc4.h b/curl/include/openssl/rc4.h new file mode 100644 index 0000000..a204723 --- /dev/null +++ b/curl/include/openssl/rc4.h @@ -0,0 +1,83 @@ +/* $OpenBSD: rc4.h,v 1.16 2025/01/25 17:59:44 tb Exp $ */ +/* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_RC4_H +#define HEADER_RC4_H + +#include /* OPENSSL_NO_RC4, RC4_INT */ + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct rc4_key_st { + RC4_INT x, y; + RC4_INT data[256]; +} RC4_KEY; + +void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data); +void RC4(RC4_KEY *key, size_t len, const unsigned char *indata, + unsigned char *outdata); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/ripemd.h b/curl/include/openssl/ripemd.h new file mode 100644 index 0000000..c7b1bd7 --- /dev/null +++ b/curl/include/openssl/ripemd.h @@ -0,0 +1,107 @@ +/* $OpenBSD: ripemd.h,v 1.20 2025/01/25 17:59:44 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#include + +#ifndef HEADER_RIPEMD_H +#define HEADER_RIPEMD_H + +#if !defined(HAVE_ATTRIBUTE__BOUNDED__) && !defined(__OpenBSD__) +#define __bounded__(x, y, z) +#endif + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(__LP32__) +#define RIPEMD160_LONG unsigned long +#elif defined(__ILP64__) +#define RIPEMD160_LONG unsigned long +#define RIPEMD160_LONG_LOG2 3 +#else +#define RIPEMD160_LONG unsigned int +#endif + +#define RIPEMD160_CBLOCK 64 +#define RIPEMD160_LBLOCK (RIPEMD160_CBLOCK/4) +#define RIPEMD160_DIGEST_LENGTH 20 + +typedef struct RIPEMD160state_st { + RIPEMD160_LONG A, B,C, D, E; + RIPEMD160_LONG Nl, Nh; + RIPEMD160_LONG data[RIPEMD160_LBLOCK]; + unsigned int num; +} RIPEMD160_CTX; + +int RIPEMD160_Init(RIPEMD160_CTX *c); +int RIPEMD160_Update(RIPEMD160_CTX *c, const void *data, size_t len) + __attribute__ ((__bounded__(__buffer__, 2, 3))); +int RIPEMD160_Final(unsigned char *md, RIPEMD160_CTX *c); +unsigned char *RIPEMD160(const unsigned char *d, size_t n, + unsigned char *md) + __attribute__ ((__bounded__(__buffer__, 1, 2))) + __attribute__ ((__nonnull__(3))); +void RIPEMD160_Transform(RIPEMD160_CTX *c, const unsigned char *b); +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/rsa.h b/curl/include/openssl/rsa.h new file mode 100644 index 0000000..5620128 --- /dev/null +++ b/curl/include/openssl/rsa.h @@ -0,0 +1,603 @@ +/* $OpenBSD: rsa.h,v 1.67 2025/01/25 17:59:44 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_RSA_H +#define HEADER_RSA_H + +#include + +#include + +#ifndef OPENSSL_NO_BIO +#include +#endif +#include +#include + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +struct rsa_pss_params_st { + X509_ALGOR *hashAlgorithm; + X509_ALGOR *maskGenAlgorithm; + ASN1_INTEGER *saltLength; + ASN1_INTEGER *trailerField; + + /* Hash algorithm decoded from maskGenAlgorithm. */ + X509_ALGOR *maskHash; +} /* RSA_PSS_PARAMS */; + +typedef struct rsa_oaep_params_st { + X509_ALGOR *hashFunc; + X509_ALGOR *maskGenFunc; + X509_ALGOR *pSourceFunc; + + /* Hash algorithm decoded from maskGenFunc. */ + X509_ALGOR *maskHash; +} RSA_OAEP_PARAMS; + +#ifndef OPENSSL_RSA_MAX_MODULUS_BITS +# define OPENSSL_RSA_MAX_MODULUS_BITS 16384 +#endif + +#ifndef OPENSSL_RSA_SMALL_MODULUS_BITS +# define OPENSSL_RSA_SMALL_MODULUS_BITS 3072 +#endif +#ifndef OPENSSL_RSA_MAX_PUBEXP_BITS +# define OPENSSL_RSA_MAX_PUBEXP_BITS 64 /* exponent limit enforced for "large" modulus only */ +#endif + +#define RSA_3 0x3L +#define RSA_F4 0x10001L + +/* Don't check pub/private match. */ +#define RSA_METHOD_FLAG_NO_CHECK 0x0001 + +#define RSA_FLAG_CACHE_PUBLIC 0x0002 +#define RSA_FLAG_CACHE_PRIVATE 0x0004 +#define RSA_FLAG_BLINDING 0x0008 +#define RSA_FLAG_THREAD_SAFE 0x0010 + +/* + * This flag means the private key operations will be handled by rsa_mod_exp + * and that they do not depend on the private key components being present: + * for example a key stored in external hardware. Without this flag bn_mod_exp + * gets called when private key components are absent. + */ +#define RSA_FLAG_EXT_PKEY 0x0020 + +/* + * This flag in the RSA_METHOD enables the new rsa_sign, rsa_verify functions. + */ +#define RSA_FLAG_SIGN_VER 0x0040 + +/* + * The built-in RSA implementation uses blinding by default, but other engines + * might not need it. + */ +#define RSA_FLAG_NO_BLINDING 0x0080 + +/* Salt length matches digest */ +#define RSA_PSS_SALTLEN_DIGEST -1 +/* Verify only: auto detect salt length */ +#define RSA_PSS_SALTLEN_AUTO -2 +/* Set salt length to maximum possible */ +#define RSA_PSS_SALTLEN_MAX -3 + +#define EVP_PKEY_CTX_set_rsa_padding(ctx, pad) \ + RSA_pkey_ctx_ctrl(ctx, -1, EVP_PKEY_CTRL_RSA_PADDING, pad, NULL) + +#define EVP_PKEY_CTX_get_rsa_padding(ctx, ppad) \ + RSA_pkey_ctx_ctrl(ctx, -1, EVP_PKEY_CTRL_GET_RSA_PADDING, 0, ppad) + +#define EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, len) \ + RSA_pkey_ctx_ctrl(ctx, (EVP_PKEY_OP_SIGN|EVP_PKEY_OP_VERIFY), \ + EVP_PKEY_CTRL_RSA_PSS_SALTLEN, len, NULL) + +#define EVP_PKEY_CTX_set_rsa_pss_keygen_saltlen(ctx, len) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA_PSS, EVP_PKEY_OP_KEYGEN, \ + EVP_PKEY_CTRL_RSA_PSS_SALTLEN, len, NULL) + +#define EVP_PKEY_CTX_get_rsa_pss_saltlen(ctx, plen) \ + RSA_pkey_ctx_ctrl(ctx, (EVP_PKEY_OP_SIGN|EVP_PKEY_OP_VERIFY), \ + EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN, 0, plen) + +#define EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, bits) \ + RSA_pkey_ctx_ctrl(ctx, EVP_PKEY_OP_KEYGEN, \ + EVP_PKEY_CTRL_RSA_KEYGEN_BITS, bits, NULL) + +#define EVP_PKEY_CTX_set_rsa_keygen_pubexp(ctx, pubexp) \ + RSA_pkey_ctx_ctrl(ctx, EVP_PKEY_OP_KEYGEN, \ + EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP, 0, pubexp) + +#define EVP_PKEY_CTX_set_rsa_mgf1_md(ctx, md) \ + RSA_pkey_ctx_ctrl(ctx, EVP_PKEY_OP_TYPE_SIG | EVP_PKEY_OP_TYPE_CRYPT, \ + EVP_PKEY_CTRL_RSA_MGF1_MD, 0, (void *)(md)) + +#define EVP_PKEY_CTX_set_rsa_pss_keygen_mgf1_md(ctx, md) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA_PSS, EVP_PKEY_OP_KEYGEN, \ + EVP_PKEY_CTRL_RSA_MGF1_MD, 0, (void *)(md)) + +#define EVP_PKEY_CTX_set_rsa_oaep_md(ctx, md) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_CRYPT, \ + EVP_PKEY_CTRL_RSA_OAEP_MD, 0, (void *)(md)) + +#define EVP_PKEY_CTX_get_rsa_mgf1_md(ctx, pmd) \ + RSA_pkey_ctx_ctrl(ctx, EVP_PKEY_OP_TYPE_SIG | EVP_PKEY_OP_TYPE_CRYPT, \ + EVP_PKEY_CTRL_GET_RSA_MGF1_MD, 0, (void *)(pmd)) + +#define EVP_PKEY_CTX_get_rsa_oaep_md(ctx, pmd) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_CRYPT, \ + EVP_PKEY_CTRL_GET_RSA_OAEP_MD, 0, (void *)(pmd)) + +#define EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, l, llen) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_CRYPT, \ + EVP_PKEY_CTRL_RSA_OAEP_LABEL, llen, (void *)(l)) + +#define EVP_PKEY_CTX_get0_rsa_oaep_label(ctx, l) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, EVP_PKEY_OP_TYPE_CRYPT, \ + EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL, 0, (void *)(l)) + +#define EVP_PKEY_CTX_set_rsa_pss_keygen_md(ctx, md) \ + EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA_PSS, \ + EVP_PKEY_OP_KEYGEN, EVP_PKEY_CTRL_MD, 0, (void *)(md)) + +#define EVP_PKEY_CTRL_RSA_PADDING (EVP_PKEY_ALG_CTRL + 1) +#define EVP_PKEY_CTRL_RSA_PSS_SALTLEN (EVP_PKEY_ALG_CTRL + 2) + +#define EVP_PKEY_CTRL_RSA_KEYGEN_BITS (EVP_PKEY_ALG_CTRL + 3) +#define EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP (EVP_PKEY_ALG_CTRL + 4) +#define EVP_PKEY_CTRL_RSA_MGF1_MD (EVP_PKEY_ALG_CTRL + 5) + +#define EVP_PKEY_CTRL_GET_RSA_PADDING (EVP_PKEY_ALG_CTRL + 6) +#define EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN (EVP_PKEY_ALG_CTRL + 7) +#define EVP_PKEY_CTRL_GET_RSA_MGF1_MD (EVP_PKEY_ALG_CTRL + 8) + +#define EVP_PKEY_CTRL_RSA_OAEP_MD (EVP_PKEY_ALG_CTRL + 9) +#define EVP_PKEY_CTRL_RSA_OAEP_LABEL (EVP_PKEY_ALG_CTRL + 10) + +#define EVP_PKEY_CTRL_GET_RSA_OAEP_MD (EVP_PKEY_ALG_CTRL + 11) +#define EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL (EVP_PKEY_ALG_CTRL + 12) + +#define RSA_PKCS1_PADDING 1 +#define RSA_SSLV23_PADDING 2 +#define RSA_NO_PADDING 3 +#define RSA_PKCS1_OAEP_PADDING 4 +/* rust-openssl and erlang expose this and salt even uses it. */ +#define RSA_X931_PADDING 5 +/* EVP_PKEY_ only */ +#define RSA_PKCS1_PSS_PADDING 6 + +#define RSA_PKCS1_PADDING_SIZE 11 + +#define RSA_set_app_data(s,arg) RSA_set_ex_data(s,0,arg) +#define RSA_get_app_data(s) RSA_get_ex_data(s,0) + +RSA *RSA_new(void); +RSA *RSA_new_method(ENGINE *engine); +int RSA_bits(const RSA *rsa); +int RSA_size(const RSA *rsa); + +/* + * Wrapped in OPENSSL_NO_DEPRECATED in 0.9.8. Still used for libressl bindings + * in rust-openssl. + */ +RSA *RSA_generate_key(int bits, unsigned long e, + void (*callback)(int, int, void *), void *cb_arg); + +/* New version */ +int RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e, BN_GENCB *cb); + +int RSA_check_key(const RSA *); +/* next 4 return -1 on error */ +int RSA_public_encrypt(int flen, const unsigned char *from, + unsigned char *to, RSA *rsa, int padding); +int RSA_private_encrypt(int flen, const unsigned char *from, + unsigned char *to, RSA *rsa, int padding); +int RSA_public_decrypt(int flen, const unsigned char *from, + unsigned char *to, RSA *rsa, int padding); +int RSA_private_decrypt(int flen, const unsigned char *from, + unsigned char *to, RSA *rsa, int padding); +void RSA_free(RSA *r); +/* "up" the RSA object's reference count */ +int RSA_up_ref(RSA *r); + +int RSA_flags(const RSA *r); + +void RSA_set_default_method(const RSA_METHOD *meth); +const RSA_METHOD *RSA_get_default_method(void); +const RSA_METHOD *RSA_get_method(const RSA *rsa); +int RSA_set_method(RSA *rsa, const RSA_METHOD *meth); + +const RSA_METHOD *RSA_PKCS1_OpenSSL(void); +const RSA_METHOD *RSA_PKCS1_SSLeay(void); + +int RSA_pkey_ctx_ctrl(EVP_PKEY_CTX *ctx, int optype, int cmd, int p1, void *p2); + +RSA *d2i_RSAPublicKey(RSA **a, const unsigned char **in, long len); +int i2d_RSAPublicKey(const RSA *a, unsigned char **out); +extern const ASN1_ITEM RSAPublicKey_it; +RSA *d2i_RSAPrivateKey(RSA **a, const unsigned char **in, long len); +int i2d_RSAPrivateKey(const RSA *a, unsigned char **out); +extern const ASN1_ITEM RSAPrivateKey_it; + +RSA_PSS_PARAMS *RSA_PSS_PARAMS_new(void); +void RSA_PSS_PARAMS_free(RSA_PSS_PARAMS *a); +RSA_PSS_PARAMS *d2i_RSA_PSS_PARAMS(RSA_PSS_PARAMS **a, const unsigned char **in, long len); +int i2d_RSA_PSS_PARAMS(RSA_PSS_PARAMS *a, unsigned char **out); +extern const ASN1_ITEM RSA_PSS_PARAMS_it; + +RSA_OAEP_PARAMS *RSA_OAEP_PARAMS_new(void); +void RSA_OAEP_PARAMS_free(RSA_OAEP_PARAMS *a); +RSA_OAEP_PARAMS *d2i_RSA_OAEP_PARAMS(RSA_OAEP_PARAMS **a, const unsigned char **in, long len); +int i2d_RSA_OAEP_PARAMS(RSA_OAEP_PARAMS *a, unsigned char **out); +extern const ASN1_ITEM RSA_OAEP_PARAMS_it; + +int RSA_print_fp(FILE *fp, const RSA *r, int offset); + +#ifndef OPENSSL_NO_BIO +int RSA_print(BIO *bp, const RSA *r, int offset); +#endif + +/* The following 2 functions sign and verify a X509_SIG ASN1 object + * inside PKCS#1 padded RSA encryption */ +int RSA_sign(int type, const unsigned char *m, unsigned int m_length, + unsigned char *sigret, unsigned int *siglen, RSA *rsa); +int RSA_verify(int type, const unsigned char *m, unsigned int m_length, + const unsigned char *sigbuf, unsigned int siglen, RSA *rsa); + +/* The following 2 function sign and verify a ASN1_OCTET_STRING + * object inside PKCS#1 padded RSA encryption */ +int RSA_sign_ASN1_OCTET_STRING(int type, const unsigned char *m, + unsigned int m_length, unsigned char *sigret, unsigned int *siglen, + RSA *rsa); +int RSA_verify_ASN1_OCTET_STRING(int type, const unsigned char *m, + unsigned int m_length, unsigned char *sigbuf, unsigned int siglen, + RSA *rsa); + +int RSA_blinding_on(RSA *rsa, BN_CTX *ctx); +void RSA_blinding_off(RSA *rsa); + +int RSA_padding_add_PKCS1_type_1(unsigned char *to, int tlen, + const unsigned char *f, int fl); +int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen, + const unsigned char *f, int fl, int rsa_len); +int RSA_padding_add_PKCS1_type_2(unsigned char *to, int tlen, + const unsigned char *f, int fl); +int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen, + const unsigned char *f, int fl, int rsa_len); +int PKCS1_MGF1(unsigned char *mask, long len, + const unsigned char *seed, long seedlen, const EVP_MD *dgst); +int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen, + const unsigned char *f, int fl, + const unsigned char *p, int pl); +int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen, + const unsigned char *f, int fl, int rsa_len, + const unsigned char *p, int pl); +int RSA_padding_add_PKCS1_OAEP_mgf1(unsigned char *to, int tlen, + const unsigned char *from, int flen, const unsigned char *param, int plen, + const EVP_MD *md, const EVP_MD *mgf1md); +int RSA_padding_check_PKCS1_OAEP_mgf1(unsigned char *to, int tlen, + const unsigned char *from, int flen, int num, const unsigned char *param, + int plen, const EVP_MD *md, const EVP_MD *mgf1md); +int RSA_padding_add_none(unsigned char *to, int tlen, + const unsigned char *f, int fl); +int RSA_padding_check_none(unsigned char *to, int tlen, + const unsigned char *f, int fl, int rsa_len); + +int RSA_verify_PKCS1_PSS(RSA *rsa, const unsigned char *mHash, + const EVP_MD *Hash, const unsigned char *EM, int sLen); +int RSA_padding_add_PKCS1_PSS(RSA *rsa, unsigned char *EM, + const unsigned char *mHash, const EVP_MD *Hash, int sLen); + +int RSA_verify_PKCS1_PSS_mgf1(RSA *rsa, const unsigned char *mHash, + const EVP_MD *Hash, const EVP_MD *mgf1Hash, const unsigned char *EM, + int sLen); + +int RSA_padding_add_PKCS1_PSS_mgf1(RSA *rsa, unsigned char *EM, + const unsigned char *mHash, const EVP_MD *Hash, const EVP_MD *mgf1Hash, + int sLen); + +int RSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, + CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); +int RSA_set_ex_data(RSA *r, int idx, void *arg); +void *RSA_get_ex_data(const RSA *r, int idx); + +int RSA_security_bits(const RSA *rsa); + +void RSA_get0_key(const RSA *r, const BIGNUM **n, const BIGNUM **e, + const BIGNUM **d); +int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d); +void RSA_get0_crt_params(const RSA *r, const BIGNUM **dmp1, const BIGNUM **dmq1, + const BIGNUM **iqmp); +int RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp); +void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q); +int RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q); +const BIGNUM *RSA_get0_n(const RSA *r); +const BIGNUM *RSA_get0_e(const RSA *r); +const BIGNUM *RSA_get0_d(const RSA *r); +const BIGNUM *RSA_get0_p(const RSA *r); +const BIGNUM *RSA_get0_q(const RSA *r); +const BIGNUM *RSA_get0_dmp1(const RSA *r); +const BIGNUM *RSA_get0_dmq1(const RSA *r); +const BIGNUM *RSA_get0_iqmp(const RSA *r); +const RSA_PSS_PARAMS *RSA_get0_pss_params(const RSA *r); +void RSA_clear_flags(RSA *r, int flags); +int RSA_test_flags(const RSA *r, int flags); +void RSA_set_flags(RSA *r, int flags); + +RSA *RSAPublicKey_dup(RSA *rsa); +RSA *RSAPrivateKey_dup(RSA *rsa); + +/* If this flag is set the RSA method is FIPS compliant and can be used + * in FIPS mode. This is set in the validated module method. If an + * application sets this flag in its own methods it is its responsibility + * to ensure the result is compliant. + */ + +#define RSA_FLAG_FIPS_METHOD 0x0400 + +/* If this flag is set the operations normally disabled in FIPS mode are + * permitted it is then the applications responsibility to ensure that the + * usage is compliant. + */ + +#define RSA_FLAG_NON_FIPS_ALLOW 0x0400 +/* Application has decided PRNG is good enough to generate a key: don't + * check. + */ +#define RSA_FLAG_CHECKED 0x0800 + +RSA_METHOD *RSA_meth_new(const char *name, int flags); +void RSA_meth_free(RSA_METHOD *meth); +RSA_METHOD *RSA_meth_dup(const RSA_METHOD *meth); +int RSA_meth_set1_name(RSA_METHOD *meth, const char *name); +int RSA_meth_set_priv_enc(RSA_METHOD *meth, int (*priv_enc)(int flen, + const unsigned char *from, unsigned char *to, RSA *rsa, int padding)); +int RSA_meth_set_priv_dec(RSA_METHOD *meth, int (*priv_dec)(int flen, + const unsigned char *from, unsigned char *to, RSA *rsa, int padding)); +int (*RSA_meth_get_finish(const RSA_METHOD *meth))(RSA *rsa); +int RSA_meth_set_finish(RSA_METHOD *meth, int (*finish)(RSA *rsa)); +int RSA_meth_set_pub_enc(RSA_METHOD *meth, int (*pub_enc)(int flen, + const unsigned char *from, unsigned char *to, RSA *rsa, int padding)); +int RSA_meth_set_pub_dec(RSA_METHOD *meth, int (*pub_dec)(int flen, + const unsigned char *from, unsigned char *to, RSA *rsa, int padding)); +int RSA_meth_set_mod_exp(RSA_METHOD *meth, int (*mod_exp)(BIGNUM *r0, + const BIGNUM *i, RSA *rsa, BN_CTX *ctx)); +int RSA_meth_set_bn_mod_exp(RSA_METHOD *meth, int (*bn_mod_exp)(BIGNUM *r, + const BIGNUM *a, const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, + BN_MONT_CTX *m_ctx)); +int RSA_meth_set_init(RSA_METHOD *meth, int (*init)(RSA *rsa)); +int RSA_meth_set_keygen(RSA_METHOD *meth, int (*keygen)(RSA *rsa, int bits, + BIGNUM *e, BN_GENCB *cb)); +int RSA_meth_set_flags(RSA_METHOD *meth, int flags); +int RSA_meth_set0_app_data(RSA_METHOD *meth, void *app_data); +const char *RSA_meth_get0_name(const RSA_METHOD *); +int (*RSA_meth_get_pub_enc(const RSA_METHOD *meth))(int flen, + const unsigned char *from, unsigned char *to, RSA *rsa, int padding); +int (*RSA_meth_get_pub_dec(const RSA_METHOD *meth))(int flen, + const unsigned char *from, unsigned char *to, RSA *rsa, int padding); +int (*RSA_meth_get_priv_enc(const RSA_METHOD *meth))(int flen, + const unsigned char *from, unsigned char *to, RSA *rsa, int padding); +int (*RSA_meth_get_priv_dec(const RSA_METHOD *meth))(int flen, + const unsigned char *from, unsigned char *to, RSA *rsa, int padding); +int (*RSA_meth_get_mod_exp(const RSA_METHOD *meth))(BIGNUM *r0, const BIGNUM *i, + RSA *rsa, BN_CTX *ctx); +int (*RSA_meth_get_bn_mod_exp(const RSA_METHOD *meth))(BIGNUM *r, + const BIGNUM *a, const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, + BN_MONT_CTX *m_ctx); +int (*RSA_meth_get_init(const RSA_METHOD *meth))(RSA *rsa); +int (*RSA_meth_get_keygen(const RSA_METHOD *meth))(RSA *rsa, int bits, BIGNUM *e, + BN_GENCB *cb); +int RSA_meth_get_flags(const RSA_METHOD *meth); +void *RSA_meth_get0_app_data(const RSA_METHOD *meth); +int (*RSA_meth_get_sign(const RSA_METHOD *meth))(int type, + const unsigned char *m, unsigned int m_length, + unsigned char *sigret, unsigned int *siglen, + const RSA *rsa); +int RSA_meth_set_sign(RSA_METHOD *rsa, int (*sign)(int type, + const unsigned char *m, unsigned int m_length, unsigned char *sigret, + unsigned int *siglen, const RSA *rsa)); +int (*RSA_meth_get_verify(const RSA_METHOD *meth))(int dtype, + const unsigned char *m, unsigned int m_length, const unsigned char *sigbuf, + unsigned int siglen, const RSA *rsa); +int RSA_meth_set_verify(RSA_METHOD *rsa, int (*verify)(int dtype, + const unsigned char *m, unsigned int m_length, const unsigned char *sigbuf, + unsigned int siglen, const RSA *rsa)); + + +void ERR_load_RSA_strings(void); + +/* Error codes for the RSA functions. */ + +/* Function codes. */ +#define RSA_F_CHECK_PADDING_MD 140 +#define RSA_F_DO_RSA_PRINT 146 +#define RSA_F_INT_RSA_VERIFY 145 +#define RSA_F_MEMORY_LOCK 100 +#define RSA_F_OLD_RSA_PRIV_DECODE 147 +#define RSA_F_PKEY_RSA_CTRL 143 +#define RSA_F_PKEY_RSA_CTRL_STR 144 +#define RSA_F_PKEY_RSA_SIGN 142 +#define RSA_F_PKEY_RSA_VERIFY 154 +#define RSA_F_PKEY_RSA_VERIFYRECOVER 141 +#define RSA_F_RSA_BUILTIN_KEYGEN 129 +#define RSA_F_RSA_CHECK_KEY 123 +#define RSA_F_RSA_EAY_MOD_EXP 157 +#define RSA_F_RSA_EAY_PRIVATE_DECRYPT 101 +#define RSA_F_RSA_EAY_PRIVATE_ENCRYPT 102 +#define RSA_F_RSA_EAY_PUBLIC_DECRYPT 103 +#define RSA_F_RSA_EAY_PUBLIC_ENCRYPT 104 +#define RSA_F_RSA_GENERATE_KEY 105 +#define RSA_F_RSA_GENERATE_KEY_EX 155 +#define RSA_F_RSA_ITEM_VERIFY 156 +#define RSA_F_RSA_MEMORY_LOCK 130 +#define RSA_F_RSA_NEW_METHOD 106 +#define RSA_F_RSA_NULL 124 +#define RSA_F_RSA_NULL_MOD_EXP 131 +#define RSA_F_RSA_NULL_PRIVATE_DECRYPT 132 +#define RSA_F_RSA_NULL_PRIVATE_ENCRYPT 133 +#define RSA_F_RSA_NULL_PUBLIC_DECRYPT 134 +#define RSA_F_RSA_NULL_PUBLIC_ENCRYPT 135 +#define RSA_F_RSA_PADDING_ADD_NONE 107 +#define RSA_F_RSA_PADDING_ADD_PKCS1_OAEP 121 +#define RSA_F_RSA_PADDING_ADD_PKCS1_PSS 125 +#define RSA_F_RSA_PADDING_ADD_PKCS1_PSS_MGF1 148 +#define RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1 108 +#define RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_2 109 +#define RSA_F_RSA_PADDING_ADD_X931 127 +#define RSA_F_RSA_PADDING_CHECK_NONE 111 +#define RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP 122 +#define RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1 112 +#define RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2 113 +#define RSA_F_RSA_PADDING_CHECK_X931 128 +#define RSA_F_RSA_PRINT 115 +#define RSA_F_RSA_PRINT_FP 116 +#define RSA_F_RSA_PRIVATE_DECRYPT 150 +#define RSA_F_RSA_PRIVATE_ENCRYPT 151 +#define RSA_F_RSA_PRIV_DECODE 137 +#define RSA_F_RSA_PRIV_ENCODE 138 +#define RSA_F_RSA_PUBLIC_DECRYPT 152 +#define RSA_F_RSA_PUBLIC_ENCRYPT 153 +#define RSA_F_RSA_PUB_DECODE 139 +#define RSA_F_RSA_SETUP_BLINDING 136 +#define RSA_F_RSA_SIGN 117 +#define RSA_F_RSA_SIGN_ASN1_OCTET_STRING 118 +#define RSA_F_RSA_VERIFY 119 +#define RSA_F_RSA_VERIFY_ASN1_OCTET_STRING 120 +#define RSA_F_RSA_VERIFY_PKCS1_PSS 126 +#define RSA_F_RSA_VERIFY_PKCS1_PSS_MGF1 149 + +/* Reason codes. */ +#define RSA_R_ALGORITHM_MISMATCH 100 +#define RSA_R_BAD_E_VALUE 101 +#define RSA_R_BAD_FIXED_HEADER_DECRYPT 102 +#define RSA_R_BAD_PAD_BYTE_COUNT 103 +#define RSA_R_BAD_SIGNATURE 104 +#define RSA_R_BLOCK_TYPE_IS_NOT_01 106 +#define RSA_R_BLOCK_TYPE_IS_NOT_02 107 +#define RSA_R_DATA_GREATER_THAN_MOD_LEN 108 +#define RSA_R_DATA_TOO_LARGE 109 +#define RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE 110 +#define RSA_R_DATA_TOO_LARGE_FOR_MODULUS 132 +#define RSA_R_DATA_TOO_SMALL 111 +#define RSA_R_DATA_TOO_SMALL_FOR_KEY_SIZE 122 +#define RSA_R_DIGEST_DOES_NOT_MATCH 158 +#define RSA_R_DIGEST_NOT_ALLOWED 145 +#define RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY 112 +#define RSA_R_DMP1_NOT_CONGRUENT_TO_D 124 +#define RSA_R_DMQ1_NOT_CONGRUENT_TO_D 125 +#define RSA_R_D_E_NOT_CONGRUENT_TO_1 123 +#define RSA_R_FIRST_OCTET_INVALID 133 +#define RSA_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE 144 +#define RSA_R_INVALID_DIGEST 157 +#define RSA_R_INVALID_DIGEST_LENGTH 143 +#define RSA_R_INVALID_HEADER 137 +#define RSA_R_INVALID_KEYBITS 145 +#define RSA_R_INVALID_LABEL 160 +#define RSA_R_INVALID_MESSAGE_LENGTH 131 +#define RSA_R_INVALID_MGF1_MD 156 +#define RSA_R_INVALID_OAEP_PARAMETERS 161 +#define RSA_R_INVALID_PADDING 138 +#define RSA_R_INVALID_PADDING_MODE 141 +#define RSA_R_INVALID_PSS_PARAMETERS 149 +#define RSA_R_INVALID_PSS_SALTLEN 146 +#define RSA_R_INVALID_SALT_LENGTH 150 +#define RSA_R_INVALID_TRAILER 139 +#define RSA_R_INVALID_X931_DIGEST 142 +#define RSA_R_IQMP_NOT_INVERSE_OF_Q 126 +#define RSA_R_KEY_SIZE_TOO_SMALL 120 +#define RSA_R_LAST_OCTET_INVALID 134 +#define RSA_R_MODULUS_TOO_LARGE 105 +#define RSA_R_MGF1_DIGEST_NOT_ALLOWED 152 +#define RSA_R_NON_FIPS_RSA_METHOD 157 +#define RSA_R_NO_PUBLIC_EXPONENT 140 +#define RSA_R_NULL_BEFORE_BLOCK_MISSING 113 +#define RSA_R_N_DOES_NOT_EQUAL_P_Q 127 +#define RSA_R_OAEP_DECODING_ERROR 121 +#define RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE 158 +#define RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE 148 +#define RSA_R_PADDING_CHECK_FAILED 114 +#define RSA_R_PSS_SALTLEN_TOO_SMALL 164 +#define RSA_R_P_NOT_PRIME 128 +#define RSA_R_Q_NOT_PRIME 129 +#define RSA_R_RSA_OPERATIONS_NOT_SUPPORTED 130 +#define RSA_R_SLEN_CHECK_FAILED 136 +#define RSA_R_SLEN_RECOVERY_FAILED 135 +#define RSA_R_SSLV3_ROLLBACK_ATTACK 115 +#define RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 116 +#define RSA_R_UNKNOWN_ALGORITHM_TYPE 117 +#define RSA_R_UNKNOWN_DIGEST 166 +#define RSA_R_UNKNOWN_MASK_DIGEST 151 +#define RSA_R_UNKNOWN_PADDING_TYPE 118 +#define RSA_R_UNKNOWN_PSS_DIGEST 152 +#define RSA_R_UNSUPPORTED_ENCRYPTION_TYPE 162 +#define RSA_R_UNSUPPORTED_LABEL_SOURCE 163 +#define RSA_R_UNSUPPORTED_MASK_ALGORITHM 153 +#define RSA_R_UNSUPPORTED_MASK_PARAMETER 154 +#define RSA_R_UNSUPPORTED_SIGNATURE_TYPE 155 +#define RSA_R_VALUE_MISSING 147 +#define RSA_R_WRONG_SIGNATURE_LENGTH 119 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/safestack.h b/curl/include/openssl/safestack.h new file mode 100644 index 0000000..8425a45 --- /dev/null +++ b/curl/include/openssl/safestack.h @@ -0,0 +1,1739 @@ +/* $OpenBSD: safestack.h,v 1.33 2024/03/02 11:22:48 tb Exp $ */ +/* ==================================================================== + * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#ifndef HEADER_SAFESTACK_H +#define HEADER_SAFESTACK_H + +#include + +#ifndef CHECKED_PTR_OF +#define CHECKED_PTR_OF(type, p) \ + ((void*) (1 ? p : (type*)0)) +#endif + +/* In C++ we get problems because an explicit cast is needed from (void *) + * we use CHECKED_STACK_OF to ensure the correct type is passed in the macros + * below. + */ + +#define CHECKED_STACK_OF(type, p) \ + ((_STACK*) (1 ? p : (STACK_OF(type)*)0)) + +#define CHECKED_SK_FREE_FUNC(type, p) \ + ((void (*)(void *)) ((1 ? p : (void (*)(type *))0))) + +#define CHECKED_SK_FREE_FUNC2(type, p) \ + ((void (*)(void *)) ((1 ? p : (void (*)(type))0))) + +#define CHECKED_SK_CMP_FUNC(type, p) \ + ((int (*)(const void *, const void *)) \ + ((1 ? p : (int (*)(const type * const *, const type * const *))0))) + +#define STACK_OF(type) struct stack_st_##type +#define PREDECLARE_STACK_OF(type) STACK_OF(type); + +#define DECLARE_STACK_OF(type) STACK_OF(type); +#define DECLARE_SPECIAL_STACK_OF(type, type2) STACK_OF(type); + +#define IMPLEMENT_STACK_OF(type) /* nada (obsolete in new safestack approach)*/ + + +/* Strings are special: normally an lhash entry will point to a single + * (somewhat) mutable object. In the case of strings: + * + * a) Instead of a single char, there is an array of chars, NUL-terminated. + * b) The string may have be immutable. + * + * So, they need their own declarations. Especially important for + * type-checking tools, such as Deputy. + * +o * In practice, however, it appears to be hard to have a const + * string. For now, I'm settling for dealing with the fact it is a + * string at all. + */ +typedef char *OPENSSL_STRING; + +typedef const char *OPENSSL_CSTRING; + +/* Confusingly, LHASH_OF(STRING) deals with char ** throughout, but + * STACK_OF(STRING) is really more like STACK_OF(char), only, as + * mentioned above, instead of a single char each entry is a + * NUL-terminated array of chars. So, we have to implement STRING + * specially for STACK_OF. This is dealt with in the autogenerated + * macros below. + */ + +DECLARE_SPECIAL_STACK_OF(OPENSSL_STRING, char) + +/* SKM_sk_... stack macros are internal to safestack.h: + * never use them directly, use sk__... instead */ +#define SKM_sk_new(type, cmp) \ + ((STACK_OF(type) *)sk_new(CHECKED_SK_CMP_FUNC(type, cmp))) +#define SKM_sk_new_null(type) \ + ((STACK_OF(type) *)sk_new_null()) +#define SKM_sk_free(type, st) \ + sk_free(CHECKED_STACK_OF(type, st)) +#define SKM_sk_num(type, st) \ + sk_num(CHECKED_STACK_OF(type, st)) +#define SKM_sk_value(type, st,i) \ + ((type *)sk_value(CHECKED_STACK_OF(type, st), i)) +#define SKM_sk_set(type, st,i,val) \ + sk_set(CHECKED_STACK_OF(type, st), i, CHECKED_PTR_OF(type, val)) +#define SKM_sk_zero(type, st) \ + sk_zero(CHECKED_STACK_OF(type, st)) +#define SKM_sk_push(type, st, val) \ + sk_push(CHECKED_STACK_OF(type, st), CHECKED_PTR_OF(type, val)) +#define SKM_sk_unshift(type, st, val) \ + sk_unshift(CHECKED_STACK_OF(type, st), CHECKED_PTR_OF(type, val)) +#define SKM_sk_find(type, st, val) \ + sk_find(CHECKED_STACK_OF(type, st), CHECKED_PTR_OF(type, val)) +#define SKM_sk_delete(type, st, i) \ + (type *)sk_delete(CHECKED_STACK_OF(type, st), i) +#define SKM_sk_delete_ptr(type, st, ptr) \ + (type *)sk_delete_ptr(CHECKED_STACK_OF(type, st), CHECKED_PTR_OF(type, ptr)) +#define SKM_sk_insert(type, st,val, i) \ + sk_insert(CHECKED_STACK_OF(type, st), CHECKED_PTR_OF(type, val), i) +#define SKM_sk_set_cmp_func(type, st, cmp) \ + ((int (*)(const type * const *,const type * const *)) \ + sk_set_cmp_func(CHECKED_STACK_OF(type, st), CHECKED_SK_CMP_FUNC(type, cmp))) +#define SKM_sk_dup(type, st) \ + (STACK_OF(type) *)sk_dup(CHECKED_STACK_OF(type, st)) +#define SKM_sk_pop_free(type, st, free_func) \ + sk_pop_free(CHECKED_STACK_OF(type, st), CHECKED_SK_FREE_FUNC(type, free_func)) +#define SKM_sk_shift(type, st) \ + (type *)sk_shift(CHECKED_STACK_OF(type, st)) +#define SKM_sk_pop(type, st) \ + (type *)sk_pop(CHECKED_STACK_OF(type, st)) +#define SKM_sk_sort(type, st) \ + sk_sort(CHECKED_STACK_OF(type, st)) +#define SKM_sk_is_sorted(type, st) \ + sk_is_sorted(CHECKED_STACK_OF(type, st)) + +#define sk_ACCESS_DESCRIPTION_new(cmp) SKM_sk_new(ACCESS_DESCRIPTION, (cmp)) +#define sk_ACCESS_DESCRIPTION_new_null() SKM_sk_new_null(ACCESS_DESCRIPTION) +#define sk_ACCESS_DESCRIPTION_free(st) SKM_sk_free(ACCESS_DESCRIPTION, (st)) +#define sk_ACCESS_DESCRIPTION_num(st) SKM_sk_num(ACCESS_DESCRIPTION, (st)) +#define sk_ACCESS_DESCRIPTION_value(st, i) SKM_sk_value(ACCESS_DESCRIPTION, (st), (i)) +#define sk_ACCESS_DESCRIPTION_set(st, i, val) SKM_sk_set(ACCESS_DESCRIPTION, (st), (i), (val)) +#define sk_ACCESS_DESCRIPTION_zero(st) SKM_sk_zero(ACCESS_DESCRIPTION, (st)) +#define sk_ACCESS_DESCRIPTION_push(st, val) SKM_sk_push(ACCESS_DESCRIPTION, (st), (val)) +#define sk_ACCESS_DESCRIPTION_unshift(st, val) SKM_sk_unshift(ACCESS_DESCRIPTION, (st), (val)) +#define sk_ACCESS_DESCRIPTION_find(st, val) SKM_sk_find(ACCESS_DESCRIPTION, (st), (val)) +#define sk_ACCESS_DESCRIPTION_delete(st, i) SKM_sk_delete(ACCESS_DESCRIPTION, (st), (i)) +#define sk_ACCESS_DESCRIPTION_delete_ptr(st, ptr) SKM_sk_delete_ptr(ACCESS_DESCRIPTION, (st), (ptr)) +#define sk_ACCESS_DESCRIPTION_insert(st, val, i) SKM_sk_insert(ACCESS_DESCRIPTION, (st), (val), (i)) +#define sk_ACCESS_DESCRIPTION_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(ACCESS_DESCRIPTION, (st), (cmp)) +#define sk_ACCESS_DESCRIPTION_dup(st) SKM_sk_dup(ACCESS_DESCRIPTION, st) +#define sk_ACCESS_DESCRIPTION_pop_free(st, free_func) SKM_sk_pop_free(ACCESS_DESCRIPTION, (st), (free_func)) +#define sk_ACCESS_DESCRIPTION_shift(st) SKM_sk_shift(ACCESS_DESCRIPTION, (st)) +#define sk_ACCESS_DESCRIPTION_pop(st) SKM_sk_pop(ACCESS_DESCRIPTION, (st)) +#define sk_ACCESS_DESCRIPTION_sort(st) SKM_sk_sort(ACCESS_DESCRIPTION, (st)) +#define sk_ACCESS_DESCRIPTION_is_sorted(st) SKM_sk_is_sorted(ACCESS_DESCRIPTION, (st)) + +#define sk_ASIdOrRange_new(cmp) SKM_sk_new(ASIdOrRange, (cmp)) +#define sk_ASIdOrRange_new_null() SKM_sk_new_null(ASIdOrRange) +#define sk_ASIdOrRange_free(st) SKM_sk_free(ASIdOrRange, (st)) +#define sk_ASIdOrRange_num(st) SKM_sk_num(ASIdOrRange, (st)) +#define sk_ASIdOrRange_value(st, i) SKM_sk_value(ASIdOrRange, (st), (i)) +#define sk_ASIdOrRange_set(st, i, val) SKM_sk_set(ASIdOrRange, (st), (i), (val)) +#define sk_ASIdOrRange_zero(st) SKM_sk_zero(ASIdOrRange, (st)) +#define sk_ASIdOrRange_push(st, val) SKM_sk_push(ASIdOrRange, (st), (val)) +#define sk_ASIdOrRange_unshift(st, val) SKM_sk_unshift(ASIdOrRange, (st), (val)) +#define sk_ASIdOrRange_find(st, val) SKM_sk_find(ASIdOrRange, (st), (val)) +#define sk_ASIdOrRange_delete(st, i) SKM_sk_delete(ASIdOrRange, (st), (i)) +#define sk_ASIdOrRange_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASIdOrRange, (st), (ptr)) +#define sk_ASIdOrRange_insert(st, val, i) SKM_sk_insert(ASIdOrRange, (st), (val), (i)) +#define sk_ASIdOrRange_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(ASIdOrRange, (st), (cmp)) +#define sk_ASIdOrRange_dup(st) SKM_sk_dup(ASIdOrRange, st) +#define sk_ASIdOrRange_pop_free(st, free_func) SKM_sk_pop_free(ASIdOrRange, (st), (free_func)) +#define sk_ASIdOrRange_shift(st) SKM_sk_shift(ASIdOrRange, (st)) +#define sk_ASIdOrRange_pop(st) SKM_sk_pop(ASIdOrRange, (st)) +#define sk_ASIdOrRange_sort(st) SKM_sk_sort(ASIdOrRange, (st)) +#define sk_ASIdOrRange_is_sorted(st) SKM_sk_is_sorted(ASIdOrRange, (st)) + +#define sk_ASN1_GENERALSTRING_new(cmp) SKM_sk_new(ASN1_GENERALSTRING, (cmp)) +#define sk_ASN1_GENERALSTRING_new_null() SKM_sk_new_null(ASN1_GENERALSTRING) +#define sk_ASN1_GENERALSTRING_free(st) SKM_sk_free(ASN1_GENERALSTRING, (st)) +#define sk_ASN1_GENERALSTRING_num(st) SKM_sk_num(ASN1_GENERALSTRING, (st)) +#define sk_ASN1_GENERALSTRING_value(st, i) SKM_sk_value(ASN1_GENERALSTRING, (st), (i)) +#define sk_ASN1_GENERALSTRING_set(st, i, val) SKM_sk_set(ASN1_GENERALSTRING, (st), (i), (val)) +#define sk_ASN1_GENERALSTRING_zero(st) SKM_sk_zero(ASN1_GENERALSTRING, (st)) +#define sk_ASN1_GENERALSTRING_push(st, val) SKM_sk_push(ASN1_GENERALSTRING, (st), (val)) +#define sk_ASN1_GENERALSTRING_unshift(st, val) SKM_sk_unshift(ASN1_GENERALSTRING, (st), (val)) +#define sk_ASN1_GENERALSTRING_find(st, val) SKM_sk_find(ASN1_GENERALSTRING, (st), (val)) +#define sk_ASN1_GENERALSTRING_delete(st, i) SKM_sk_delete(ASN1_GENERALSTRING, (st), (i)) +#define sk_ASN1_GENERALSTRING_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASN1_GENERALSTRING, (st), (ptr)) +#define sk_ASN1_GENERALSTRING_insert(st, val, i) SKM_sk_insert(ASN1_GENERALSTRING, (st), (val), (i)) +#define sk_ASN1_GENERALSTRING_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(ASN1_GENERALSTRING, (st), (cmp)) +#define sk_ASN1_GENERALSTRING_dup(st) SKM_sk_dup(ASN1_GENERALSTRING, st) +#define sk_ASN1_GENERALSTRING_pop_free(st, free_func) SKM_sk_pop_free(ASN1_GENERALSTRING, (st), (free_func)) +#define sk_ASN1_GENERALSTRING_shift(st) SKM_sk_shift(ASN1_GENERALSTRING, (st)) +#define sk_ASN1_GENERALSTRING_pop(st) SKM_sk_pop(ASN1_GENERALSTRING, (st)) +#define sk_ASN1_GENERALSTRING_sort(st) SKM_sk_sort(ASN1_GENERALSTRING, (st)) +#define sk_ASN1_GENERALSTRING_is_sorted(st) SKM_sk_is_sorted(ASN1_GENERALSTRING, (st)) + +#define sk_ASN1_INTEGER_new(cmp) SKM_sk_new(ASN1_INTEGER, (cmp)) +#define sk_ASN1_INTEGER_new_null() SKM_sk_new_null(ASN1_INTEGER) +#define sk_ASN1_INTEGER_free(st) SKM_sk_free(ASN1_INTEGER, (st)) +#define sk_ASN1_INTEGER_num(st) SKM_sk_num(ASN1_INTEGER, (st)) +#define sk_ASN1_INTEGER_value(st, i) SKM_sk_value(ASN1_INTEGER, (st), (i)) +#define sk_ASN1_INTEGER_set(st, i, val) SKM_sk_set(ASN1_INTEGER, (st), (i), (val)) +#define sk_ASN1_INTEGER_zero(st) SKM_sk_zero(ASN1_INTEGER, (st)) +#define sk_ASN1_INTEGER_push(st, val) SKM_sk_push(ASN1_INTEGER, (st), (val)) +#define sk_ASN1_INTEGER_unshift(st, val) SKM_sk_unshift(ASN1_INTEGER, (st), (val)) +#define sk_ASN1_INTEGER_find(st, val) SKM_sk_find(ASN1_INTEGER, (st), (val)) +#define sk_ASN1_INTEGER_delete(st, i) SKM_sk_delete(ASN1_INTEGER, (st), (i)) +#define sk_ASN1_INTEGER_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASN1_INTEGER, (st), (ptr)) +#define sk_ASN1_INTEGER_insert(st, val, i) SKM_sk_insert(ASN1_INTEGER, (st), (val), (i)) +#define sk_ASN1_INTEGER_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(ASN1_INTEGER, (st), (cmp)) +#define sk_ASN1_INTEGER_dup(st) SKM_sk_dup(ASN1_INTEGER, st) +#define sk_ASN1_INTEGER_pop_free(st, free_func) SKM_sk_pop_free(ASN1_INTEGER, (st), (free_func)) +#define sk_ASN1_INTEGER_shift(st) SKM_sk_shift(ASN1_INTEGER, (st)) +#define sk_ASN1_INTEGER_pop(st) SKM_sk_pop(ASN1_INTEGER, (st)) +#define sk_ASN1_INTEGER_sort(st) SKM_sk_sort(ASN1_INTEGER, (st)) +#define sk_ASN1_INTEGER_is_sorted(st) SKM_sk_is_sorted(ASN1_INTEGER, (st)) + +#define sk_ASN1_OBJECT_new(cmp) SKM_sk_new(ASN1_OBJECT, (cmp)) +#define sk_ASN1_OBJECT_new_null() SKM_sk_new_null(ASN1_OBJECT) +#define sk_ASN1_OBJECT_free(st) SKM_sk_free(ASN1_OBJECT, (st)) +#define sk_ASN1_OBJECT_num(st) SKM_sk_num(ASN1_OBJECT, (st)) +#define sk_ASN1_OBJECT_value(st, i) SKM_sk_value(ASN1_OBJECT, (st), (i)) +#define sk_ASN1_OBJECT_set(st, i, val) SKM_sk_set(ASN1_OBJECT, (st), (i), (val)) +#define sk_ASN1_OBJECT_zero(st) SKM_sk_zero(ASN1_OBJECT, (st)) +#define sk_ASN1_OBJECT_push(st, val) SKM_sk_push(ASN1_OBJECT, (st), (val)) +#define sk_ASN1_OBJECT_unshift(st, val) SKM_sk_unshift(ASN1_OBJECT, (st), (val)) +#define sk_ASN1_OBJECT_find(st, val) SKM_sk_find(ASN1_OBJECT, (st), (val)) +#define sk_ASN1_OBJECT_delete(st, i) SKM_sk_delete(ASN1_OBJECT, (st), (i)) +#define sk_ASN1_OBJECT_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASN1_OBJECT, (st), (ptr)) +#define sk_ASN1_OBJECT_insert(st, val, i) SKM_sk_insert(ASN1_OBJECT, (st), (val), (i)) +#define sk_ASN1_OBJECT_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(ASN1_OBJECT, (st), (cmp)) +#define sk_ASN1_OBJECT_dup(st) SKM_sk_dup(ASN1_OBJECT, st) +#define sk_ASN1_OBJECT_pop_free(st, free_func) SKM_sk_pop_free(ASN1_OBJECT, (st), (free_func)) +#define sk_ASN1_OBJECT_shift(st) SKM_sk_shift(ASN1_OBJECT, (st)) +#define sk_ASN1_OBJECT_pop(st) SKM_sk_pop(ASN1_OBJECT, (st)) +#define sk_ASN1_OBJECT_sort(st) SKM_sk_sort(ASN1_OBJECT, (st)) +#define sk_ASN1_OBJECT_is_sorted(st) SKM_sk_is_sorted(ASN1_OBJECT, (st)) + +#define sk_ASN1_TYPE_new(cmp) SKM_sk_new(ASN1_TYPE, (cmp)) +#define sk_ASN1_TYPE_new_null() SKM_sk_new_null(ASN1_TYPE) +#define sk_ASN1_TYPE_free(st) SKM_sk_free(ASN1_TYPE, (st)) +#define sk_ASN1_TYPE_num(st) SKM_sk_num(ASN1_TYPE, (st)) +#define sk_ASN1_TYPE_value(st, i) SKM_sk_value(ASN1_TYPE, (st), (i)) +#define sk_ASN1_TYPE_set(st, i, val) SKM_sk_set(ASN1_TYPE, (st), (i), (val)) +#define sk_ASN1_TYPE_zero(st) SKM_sk_zero(ASN1_TYPE, (st)) +#define sk_ASN1_TYPE_push(st, val) SKM_sk_push(ASN1_TYPE, (st), (val)) +#define sk_ASN1_TYPE_unshift(st, val) SKM_sk_unshift(ASN1_TYPE, (st), (val)) +#define sk_ASN1_TYPE_find(st, val) SKM_sk_find(ASN1_TYPE, (st), (val)) +#define sk_ASN1_TYPE_delete(st, i) SKM_sk_delete(ASN1_TYPE, (st), (i)) +#define sk_ASN1_TYPE_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASN1_TYPE, (st), (ptr)) +#define sk_ASN1_TYPE_insert(st, val, i) SKM_sk_insert(ASN1_TYPE, (st), (val), (i)) +#define sk_ASN1_TYPE_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(ASN1_TYPE, (st), (cmp)) +#define sk_ASN1_TYPE_dup(st) SKM_sk_dup(ASN1_TYPE, st) +#define sk_ASN1_TYPE_pop_free(st, free_func) SKM_sk_pop_free(ASN1_TYPE, (st), (free_func)) +#define sk_ASN1_TYPE_shift(st) SKM_sk_shift(ASN1_TYPE, (st)) +#define sk_ASN1_TYPE_pop(st) SKM_sk_pop(ASN1_TYPE, (st)) +#define sk_ASN1_TYPE_sort(st) SKM_sk_sort(ASN1_TYPE, (st)) +#define sk_ASN1_TYPE_is_sorted(st) SKM_sk_is_sorted(ASN1_TYPE, (st)) + +#define sk_ASN1_UTF8STRING_new(cmp) SKM_sk_new(ASN1_UTF8STRING, (cmp)) +#define sk_ASN1_UTF8STRING_new_null() SKM_sk_new_null(ASN1_UTF8STRING) +#define sk_ASN1_UTF8STRING_free(st) SKM_sk_free(ASN1_UTF8STRING, (st)) +#define sk_ASN1_UTF8STRING_num(st) SKM_sk_num(ASN1_UTF8STRING, (st)) +#define sk_ASN1_UTF8STRING_value(st, i) SKM_sk_value(ASN1_UTF8STRING, (st), (i)) +#define sk_ASN1_UTF8STRING_set(st, i, val) SKM_sk_set(ASN1_UTF8STRING, (st), (i), (val)) +#define sk_ASN1_UTF8STRING_zero(st) SKM_sk_zero(ASN1_UTF8STRING, (st)) +#define sk_ASN1_UTF8STRING_push(st, val) SKM_sk_push(ASN1_UTF8STRING, (st), (val)) +#define sk_ASN1_UTF8STRING_unshift(st, val) SKM_sk_unshift(ASN1_UTF8STRING, (st), (val)) +#define sk_ASN1_UTF8STRING_find(st, val) SKM_sk_find(ASN1_UTF8STRING, (st), (val)) +#define sk_ASN1_UTF8STRING_delete(st, i) SKM_sk_delete(ASN1_UTF8STRING, (st), (i)) +#define sk_ASN1_UTF8STRING_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASN1_UTF8STRING, (st), (ptr)) +#define sk_ASN1_UTF8STRING_insert(st, val, i) SKM_sk_insert(ASN1_UTF8STRING, (st), (val), (i)) +#define sk_ASN1_UTF8STRING_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(ASN1_UTF8STRING, (st), (cmp)) +#define sk_ASN1_UTF8STRING_dup(st) SKM_sk_dup(ASN1_UTF8STRING, st) +#define sk_ASN1_UTF8STRING_pop_free(st, free_func) SKM_sk_pop_free(ASN1_UTF8STRING, (st), (free_func)) +#define sk_ASN1_UTF8STRING_shift(st) SKM_sk_shift(ASN1_UTF8STRING, (st)) +#define sk_ASN1_UTF8STRING_pop(st) SKM_sk_pop(ASN1_UTF8STRING, (st)) +#define sk_ASN1_UTF8STRING_sort(st) SKM_sk_sort(ASN1_UTF8STRING, (st)) +#define sk_ASN1_UTF8STRING_is_sorted(st) SKM_sk_is_sorted(ASN1_UTF8STRING, (st)) + +#define sk_ASN1_VALUE_new(cmp) SKM_sk_new(ASN1_VALUE, (cmp)) +#define sk_ASN1_VALUE_new_null() SKM_sk_new_null(ASN1_VALUE) +#define sk_ASN1_VALUE_free(st) SKM_sk_free(ASN1_VALUE, (st)) +#define sk_ASN1_VALUE_num(st) SKM_sk_num(ASN1_VALUE, (st)) +#define sk_ASN1_VALUE_value(st, i) SKM_sk_value(ASN1_VALUE, (st), (i)) +#define sk_ASN1_VALUE_set(st, i, val) SKM_sk_set(ASN1_VALUE, (st), (i), (val)) +#define sk_ASN1_VALUE_zero(st) SKM_sk_zero(ASN1_VALUE, (st)) +#define sk_ASN1_VALUE_push(st, val) SKM_sk_push(ASN1_VALUE, (st), (val)) +#define sk_ASN1_VALUE_unshift(st, val) SKM_sk_unshift(ASN1_VALUE, (st), (val)) +#define sk_ASN1_VALUE_find(st, val) SKM_sk_find(ASN1_VALUE, (st), (val)) +#define sk_ASN1_VALUE_delete(st, i) SKM_sk_delete(ASN1_VALUE, (st), (i)) +#define sk_ASN1_VALUE_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASN1_VALUE, (st), (ptr)) +#define sk_ASN1_VALUE_insert(st, val, i) SKM_sk_insert(ASN1_VALUE, (st), (val), (i)) +#define sk_ASN1_VALUE_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(ASN1_VALUE, (st), (cmp)) +#define sk_ASN1_VALUE_dup(st) SKM_sk_dup(ASN1_VALUE, st) +#define sk_ASN1_VALUE_pop_free(st, free_func) SKM_sk_pop_free(ASN1_VALUE, (st), (free_func)) +#define sk_ASN1_VALUE_shift(st) SKM_sk_shift(ASN1_VALUE, (st)) +#define sk_ASN1_VALUE_pop(st) SKM_sk_pop(ASN1_VALUE, (st)) +#define sk_ASN1_VALUE_sort(st) SKM_sk_sort(ASN1_VALUE, (st)) +#define sk_ASN1_VALUE_is_sorted(st) SKM_sk_is_sorted(ASN1_VALUE, (st)) + +#define sk_BIO_new(cmp) SKM_sk_new(BIO, (cmp)) +#define sk_BIO_new_null() SKM_sk_new_null(BIO) +#define sk_BIO_free(st) SKM_sk_free(BIO, (st)) +#define sk_BIO_num(st) SKM_sk_num(BIO, (st)) +#define sk_BIO_value(st, i) SKM_sk_value(BIO, (st), (i)) +#define sk_BIO_set(st, i, val) SKM_sk_set(BIO, (st), (i), (val)) +#define sk_BIO_zero(st) SKM_sk_zero(BIO, (st)) +#define sk_BIO_push(st, val) SKM_sk_push(BIO, (st), (val)) +#define sk_BIO_unshift(st, val) SKM_sk_unshift(BIO, (st), (val)) +#define sk_BIO_find(st, val) SKM_sk_find(BIO, (st), (val)) +#define sk_BIO_delete(st, i) SKM_sk_delete(BIO, (st), (i)) +#define sk_BIO_delete_ptr(st, ptr) SKM_sk_delete_ptr(BIO, (st), (ptr)) +#define sk_BIO_insert(st, val, i) SKM_sk_insert(BIO, (st), (val), (i)) +#define sk_BIO_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(BIO, (st), (cmp)) +#define sk_BIO_dup(st) SKM_sk_dup(BIO, st) +#define sk_BIO_pop_free(st, free_func) SKM_sk_pop_free(BIO, (st), (free_func)) +#define sk_BIO_shift(st) SKM_sk_shift(BIO, (st)) +#define sk_BIO_pop(st) SKM_sk_pop(BIO, (st)) +#define sk_BIO_sort(st) SKM_sk_sort(BIO, (st)) +#define sk_BIO_is_sorted(st) SKM_sk_is_sorted(BIO, (st)) + +#define sk_BY_DIR_ENTRY_new(cmp) SKM_sk_new(BY_DIR_ENTRY, (cmp)) +#define sk_BY_DIR_ENTRY_new_null() SKM_sk_new_null(BY_DIR_ENTRY) +#define sk_BY_DIR_ENTRY_free(st) SKM_sk_free(BY_DIR_ENTRY, (st)) +#define sk_BY_DIR_ENTRY_num(st) SKM_sk_num(BY_DIR_ENTRY, (st)) +#define sk_BY_DIR_ENTRY_value(st, i) SKM_sk_value(BY_DIR_ENTRY, (st), (i)) +#define sk_BY_DIR_ENTRY_set(st, i, val) SKM_sk_set(BY_DIR_ENTRY, (st), (i), (val)) +#define sk_BY_DIR_ENTRY_zero(st) SKM_sk_zero(BY_DIR_ENTRY, (st)) +#define sk_BY_DIR_ENTRY_push(st, val) SKM_sk_push(BY_DIR_ENTRY, (st), (val)) +#define sk_BY_DIR_ENTRY_unshift(st, val) SKM_sk_unshift(BY_DIR_ENTRY, (st), (val)) +#define sk_BY_DIR_ENTRY_find(st, val) SKM_sk_find(BY_DIR_ENTRY, (st), (val)) +#define sk_BY_DIR_ENTRY_delete(st, i) SKM_sk_delete(BY_DIR_ENTRY, (st), (i)) +#define sk_BY_DIR_ENTRY_delete_ptr(st, ptr) SKM_sk_delete_ptr(BY_DIR_ENTRY, (st), (ptr)) +#define sk_BY_DIR_ENTRY_insert(st, val, i) SKM_sk_insert(BY_DIR_ENTRY, (st), (val), (i)) +#define sk_BY_DIR_ENTRY_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(BY_DIR_ENTRY, (st), (cmp)) +#define sk_BY_DIR_ENTRY_dup(st) SKM_sk_dup(BY_DIR_ENTRY, st) +#define sk_BY_DIR_ENTRY_pop_free(st, free_func) SKM_sk_pop_free(BY_DIR_ENTRY, (st), (free_func)) +#define sk_BY_DIR_ENTRY_shift(st) SKM_sk_shift(BY_DIR_ENTRY, (st)) +#define sk_BY_DIR_ENTRY_pop(st) SKM_sk_pop(BY_DIR_ENTRY, (st)) +#define sk_BY_DIR_ENTRY_sort(st) SKM_sk_sort(BY_DIR_ENTRY, (st)) +#define sk_BY_DIR_ENTRY_is_sorted(st) SKM_sk_is_sorted(BY_DIR_ENTRY, (st)) + +#define sk_BY_DIR_HASH_new(cmp) SKM_sk_new(BY_DIR_HASH, (cmp)) +#define sk_BY_DIR_HASH_new_null() SKM_sk_new_null(BY_DIR_HASH) +#define sk_BY_DIR_HASH_free(st) SKM_sk_free(BY_DIR_HASH, (st)) +#define sk_BY_DIR_HASH_num(st) SKM_sk_num(BY_DIR_HASH, (st)) +#define sk_BY_DIR_HASH_value(st, i) SKM_sk_value(BY_DIR_HASH, (st), (i)) +#define sk_BY_DIR_HASH_set(st, i, val) SKM_sk_set(BY_DIR_HASH, (st), (i), (val)) +#define sk_BY_DIR_HASH_zero(st) SKM_sk_zero(BY_DIR_HASH, (st)) +#define sk_BY_DIR_HASH_push(st, val) SKM_sk_push(BY_DIR_HASH, (st), (val)) +#define sk_BY_DIR_HASH_unshift(st, val) SKM_sk_unshift(BY_DIR_HASH, (st), (val)) +#define sk_BY_DIR_HASH_find(st, val) SKM_sk_find(BY_DIR_HASH, (st), (val)) +#define sk_BY_DIR_HASH_delete(st, i) SKM_sk_delete(BY_DIR_HASH, (st), (i)) +#define sk_BY_DIR_HASH_delete_ptr(st, ptr) SKM_sk_delete_ptr(BY_DIR_HASH, (st), (ptr)) +#define sk_BY_DIR_HASH_insert(st, val, i) SKM_sk_insert(BY_DIR_HASH, (st), (val), (i)) +#define sk_BY_DIR_HASH_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(BY_DIR_HASH, (st), (cmp)) +#define sk_BY_DIR_HASH_dup(st) SKM_sk_dup(BY_DIR_HASH, st) +#define sk_BY_DIR_HASH_pop_free(st, free_func) SKM_sk_pop_free(BY_DIR_HASH, (st), (free_func)) +#define sk_BY_DIR_HASH_shift(st) SKM_sk_shift(BY_DIR_HASH, (st)) +#define sk_BY_DIR_HASH_pop(st) SKM_sk_pop(BY_DIR_HASH, (st)) +#define sk_BY_DIR_HASH_sort(st) SKM_sk_sort(BY_DIR_HASH, (st)) +#define sk_BY_DIR_HASH_is_sorted(st) SKM_sk_is_sorted(BY_DIR_HASH, (st)) + +#define sk_CMS_CertificateChoices_new(cmp) SKM_sk_new(CMS_CertificateChoices, (cmp)) +#define sk_CMS_CertificateChoices_new_null() SKM_sk_new_null(CMS_CertificateChoices) +#define sk_CMS_CertificateChoices_free(st) SKM_sk_free(CMS_CertificateChoices, (st)) +#define sk_CMS_CertificateChoices_num(st) SKM_sk_num(CMS_CertificateChoices, (st)) +#define sk_CMS_CertificateChoices_value(st, i) SKM_sk_value(CMS_CertificateChoices, (st), (i)) +#define sk_CMS_CertificateChoices_set(st, i, val) SKM_sk_set(CMS_CertificateChoices, (st), (i), (val)) +#define sk_CMS_CertificateChoices_zero(st) SKM_sk_zero(CMS_CertificateChoices, (st)) +#define sk_CMS_CertificateChoices_push(st, val) SKM_sk_push(CMS_CertificateChoices, (st), (val)) +#define sk_CMS_CertificateChoices_unshift(st, val) SKM_sk_unshift(CMS_CertificateChoices, (st), (val)) +#define sk_CMS_CertificateChoices_find(st, val) SKM_sk_find(CMS_CertificateChoices, (st), (val)) +#define sk_CMS_CertificateChoices_delete(st, i) SKM_sk_delete(CMS_CertificateChoices, (st), (i)) +#define sk_CMS_CertificateChoices_delete_ptr(st, ptr) SKM_sk_delete_ptr(CMS_CertificateChoices, (st), (ptr)) +#define sk_CMS_CertificateChoices_insert(st, val, i) SKM_sk_insert(CMS_CertificateChoices, (st), (val), (i)) +#define sk_CMS_CertificateChoices_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(CMS_CertificateChoices, (st), (cmp)) +#define sk_CMS_CertificateChoices_dup(st) SKM_sk_dup(CMS_CertificateChoices, st) +#define sk_CMS_CertificateChoices_pop_free(st, free_func) SKM_sk_pop_free(CMS_CertificateChoices, (st), (free_func)) +#define sk_CMS_CertificateChoices_shift(st) SKM_sk_shift(CMS_CertificateChoices, (st)) +#define sk_CMS_CertificateChoices_pop(st) SKM_sk_pop(CMS_CertificateChoices, (st)) +#define sk_CMS_CertificateChoices_sort(st) SKM_sk_sort(CMS_CertificateChoices, (st)) +#define sk_CMS_CertificateChoices_is_sorted(st) SKM_sk_is_sorted(CMS_CertificateChoices, (st)) + +#define sk_CMS_RecipientEncryptedKey_new(cmp) SKM_sk_new(CMS_RecipientEncryptedKey, (cmp)) +#define sk_CMS_RecipientEncryptedKey_new_null() SKM_sk_new_null(CMS_RecipientEncryptedKey) +#define sk_CMS_RecipientEncryptedKey_free(st) SKM_sk_free(CMS_RecipientEncryptedKey, (st)) +#define sk_CMS_RecipientEncryptedKey_num(st) SKM_sk_num(CMS_RecipientEncryptedKey, (st)) +#define sk_CMS_RecipientEncryptedKey_value(st, i) SKM_sk_value(CMS_RecipientEncryptedKey, (st), (i)) +#define sk_CMS_RecipientEncryptedKey_set(st, i, val) SKM_sk_set(CMS_RecipientEncryptedKey, (st), (i), (val)) +#define sk_CMS_RecipientEncryptedKey_zero(st) SKM_sk_zero(CMS_RecipientEncryptedKey, (st)) +#define sk_CMS_RecipientEncryptedKey_push(st, val) SKM_sk_push(CMS_RecipientEncryptedKey, (st), (val)) +#define sk_CMS_RecipientEncryptedKey_unshift(st, val) SKM_sk_unshift(CMS_RecipientEncryptedKey, (st), (val)) +#define sk_CMS_RecipientEncryptedKey_find(st, val) SKM_sk_find(CMS_RecipientEncryptedKey, (st), (val)) +#define sk_CMS_RecipientEncryptedKey_delete(st, i) SKM_sk_delete(CMS_RecipientEncryptedKey, (st), (i)) +#define sk_CMS_RecipientEncryptedKey_delete_ptr(st, ptr) SKM_sk_delete_ptr(CMS_RecipientEncryptedKey, (st), (ptr)) +#define sk_CMS_RecipientEncryptedKey_insert(st, val, i) SKM_sk_insert(CMS_RecipientEncryptedKey, (st), (val), (i)) +#define sk_CMS_RecipientEncryptedKey_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(CMS_RecipientEncryptedKey, (st), (cmp)) +#define sk_CMS_RecipientEncryptedKey_dup(st) SKM_sk_dup(CMS_RecipientEncryptedKey, st) +#define sk_CMS_RecipientEncryptedKey_pop_free(st, free_func) SKM_sk_pop_free(CMS_RecipientEncryptedKey, (st), (free_func)) +#define sk_CMS_RecipientEncryptedKey_shift(st) SKM_sk_shift(CMS_RecipientEncryptedKey, (st)) +#define sk_CMS_RecipientEncryptedKey_pop(st) SKM_sk_pop(CMS_RecipientEncryptedKey, (st)) +#define sk_CMS_RecipientEncryptedKey_sort(st) SKM_sk_sort(CMS_RecipientEncryptedKey, (st)) +#define sk_CMS_RecipientEncryptedKey_is_sorted(st) SKM_sk_is_sorted(CMS_RecipientEncryptedKey, (st)) + +#define sk_CMS_RecipientInfo_new(cmp) SKM_sk_new(CMS_RecipientInfo, (cmp)) +#define sk_CMS_RecipientInfo_new_null() SKM_sk_new_null(CMS_RecipientInfo) +#define sk_CMS_RecipientInfo_free(st) SKM_sk_free(CMS_RecipientInfo, (st)) +#define sk_CMS_RecipientInfo_num(st) SKM_sk_num(CMS_RecipientInfo, (st)) +#define sk_CMS_RecipientInfo_value(st, i) SKM_sk_value(CMS_RecipientInfo, (st), (i)) +#define sk_CMS_RecipientInfo_set(st, i, val) SKM_sk_set(CMS_RecipientInfo, (st), (i), (val)) +#define sk_CMS_RecipientInfo_zero(st) SKM_sk_zero(CMS_RecipientInfo, (st)) +#define sk_CMS_RecipientInfo_push(st, val) SKM_sk_push(CMS_RecipientInfo, (st), (val)) +#define sk_CMS_RecipientInfo_unshift(st, val) SKM_sk_unshift(CMS_RecipientInfo, (st), (val)) +#define sk_CMS_RecipientInfo_find(st, val) SKM_sk_find(CMS_RecipientInfo, (st), (val)) +#define sk_CMS_RecipientInfo_delete(st, i) SKM_sk_delete(CMS_RecipientInfo, (st), (i)) +#define sk_CMS_RecipientInfo_delete_ptr(st, ptr) SKM_sk_delete_ptr(CMS_RecipientInfo, (st), (ptr)) +#define sk_CMS_RecipientInfo_insert(st, val, i) SKM_sk_insert(CMS_RecipientInfo, (st), (val), (i)) +#define sk_CMS_RecipientInfo_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(CMS_RecipientInfo, (st), (cmp)) +#define sk_CMS_RecipientInfo_dup(st) SKM_sk_dup(CMS_RecipientInfo, st) +#define sk_CMS_RecipientInfo_pop_free(st, free_func) SKM_sk_pop_free(CMS_RecipientInfo, (st), (free_func)) +#define sk_CMS_RecipientInfo_shift(st) SKM_sk_shift(CMS_RecipientInfo, (st)) +#define sk_CMS_RecipientInfo_pop(st) SKM_sk_pop(CMS_RecipientInfo, (st)) +#define sk_CMS_RecipientInfo_sort(st) SKM_sk_sort(CMS_RecipientInfo, (st)) +#define sk_CMS_RecipientInfo_is_sorted(st) SKM_sk_is_sorted(CMS_RecipientInfo, (st)) + +#define sk_CMS_RevocationInfoChoice_new(cmp) SKM_sk_new(CMS_RevocationInfoChoice, (cmp)) +#define sk_CMS_RevocationInfoChoice_new_null() SKM_sk_new_null(CMS_RevocationInfoChoice) +#define sk_CMS_RevocationInfoChoice_free(st) SKM_sk_free(CMS_RevocationInfoChoice, (st)) +#define sk_CMS_RevocationInfoChoice_num(st) SKM_sk_num(CMS_RevocationInfoChoice, (st)) +#define sk_CMS_RevocationInfoChoice_value(st, i) SKM_sk_value(CMS_RevocationInfoChoice, (st), (i)) +#define sk_CMS_RevocationInfoChoice_set(st, i, val) SKM_sk_set(CMS_RevocationInfoChoice, (st), (i), (val)) +#define sk_CMS_RevocationInfoChoice_zero(st) SKM_sk_zero(CMS_RevocationInfoChoice, (st)) +#define sk_CMS_RevocationInfoChoice_push(st, val) SKM_sk_push(CMS_RevocationInfoChoice, (st), (val)) +#define sk_CMS_RevocationInfoChoice_unshift(st, val) SKM_sk_unshift(CMS_RevocationInfoChoice, (st), (val)) +#define sk_CMS_RevocationInfoChoice_find(st, val) SKM_sk_find(CMS_RevocationInfoChoice, (st), (val)) +#define sk_CMS_RevocationInfoChoice_delete(st, i) SKM_sk_delete(CMS_RevocationInfoChoice, (st), (i)) +#define sk_CMS_RevocationInfoChoice_delete_ptr(st, ptr) SKM_sk_delete_ptr(CMS_RevocationInfoChoice, (st), (ptr)) +#define sk_CMS_RevocationInfoChoice_insert(st, val, i) SKM_sk_insert(CMS_RevocationInfoChoice, (st), (val), (i)) +#define sk_CMS_RevocationInfoChoice_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(CMS_RevocationInfoChoice, (st), (cmp)) +#define sk_CMS_RevocationInfoChoice_dup(st) SKM_sk_dup(CMS_RevocationInfoChoice, st) +#define sk_CMS_RevocationInfoChoice_pop_free(st, free_func) SKM_sk_pop_free(CMS_RevocationInfoChoice, (st), (free_func)) +#define sk_CMS_RevocationInfoChoice_shift(st) SKM_sk_shift(CMS_RevocationInfoChoice, (st)) +#define sk_CMS_RevocationInfoChoice_pop(st) SKM_sk_pop(CMS_RevocationInfoChoice, (st)) +#define sk_CMS_RevocationInfoChoice_sort(st) SKM_sk_sort(CMS_RevocationInfoChoice, (st)) +#define sk_CMS_RevocationInfoChoice_is_sorted(st) SKM_sk_is_sorted(CMS_RevocationInfoChoice, (st)) + +#define sk_CMS_SignerInfo_new(cmp) SKM_sk_new(CMS_SignerInfo, (cmp)) +#define sk_CMS_SignerInfo_new_null() SKM_sk_new_null(CMS_SignerInfo) +#define sk_CMS_SignerInfo_free(st) SKM_sk_free(CMS_SignerInfo, (st)) +#define sk_CMS_SignerInfo_num(st) SKM_sk_num(CMS_SignerInfo, (st)) +#define sk_CMS_SignerInfo_value(st, i) SKM_sk_value(CMS_SignerInfo, (st), (i)) +#define sk_CMS_SignerInfo_set(st, i, val) SKM_sk_set(CMS_SignerInfo, (st), (i), (val)) +#define sk_CMS_SignerInfo_zero(st) SKM_sk_zero(CMS_SignerInfo, (st)) +#define sk_CMS_SignerInfo_push(st, val) SKM_sk_push(CMS_SignerInfo, (st), (val)) +#define sk_CMS_SignerInfo_unshift(st, val) SKM_sk_unshift(CMS_SignerInfo, (st), (val)) +#define sk_CMS_SignerInfo_find(st, val) SKM_sk_find(CMS_SignerInfo, (st), (val)) +#define sk_CMS_SignerInfo_delete(st, i) SKM_sk_delete(CMS_SignerInfo, (st), (i)) +#define sk_CMS_SignerInfo_delete_ptr(st, ptr) SKM_sk_delete_ptr(CMS_SignerInfo, (st), (ptr)) +#define sk_CMS_SignerInfo_insert(st, val, i) SKM_sk_insert(CMS_SignerInfo, (st), (val), (i)) +#define sk_CMS_SignerInfo_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(CMS_SignerInfo, (st), (cmp)) +#define sk_CMS_SignerInfo_dup(st) SKM_sk_dup(CMS_SignerInfo, st) +#define sk_CMS_SignerInfo_pop_free(st, free_func) SKM_sk_pop_free(CMS_SignerInfo, (st), (free_func)) +#define sk_CMS_SignerInfo_shift(st) SKM_sk_shift(CMS_SignerInfo, (st)) +#define sk_CMS_SignerInfo_pop(st) SKM_sk_pop(CMS_SignerInfo, (st)) +#define sk_CMS_SignerInfo_sort(st) SKM_sk_sort(CMS_SignerInfo, (st)) +#define sk_CMS_SignerInfo_is_sorted(st) SKM_sk_is_sorted(CMS_SignerInfo, (st)) + +#define sk_CONF_IMODULE_new(cmp) SKM_sk_new(CONF_IMODULE, (cmp)) +#define sk_CONF_IMODULE_new_null() SKM_sk_new_null(CONF_IMODULE) +#define sk_CONF_IMODULE_free(st) SKM_sk_free(CONF_IMODULE, (st)) +#define sk_CONF_IMODULE_num(st) SKM_sk_num(CONF_IMODULE, (st)) +#define sk_CONF_IMODULE_value(st, i) SKM_sk_value(CONF_IMODULE, (st), (i)) +#define sk_CONF_IMODULE_set(st, i, val) SKM_sk_set(CONF_IMODULE, (st), (i), (val)) +#define sk_CONF_IMODULE_zero(st) SKM_sk_zero(CONF_IMODULE, (st)) +#define sk_CONF_IMODULE_push(st, val) SKM_sk_push(CONF_IMODULE, (st), (val)) +#define sk_CONF_IMODULE_unshift(st, val) SKM_sk_unshift(CONF_IMODULE, (st), (val)) +#define sk_CONF_IMODULE_find(st, val) SKM_sk_find(CONF_IMODULE, (st), (val)) +#define sk_CONF_IMODULE_delete(st, i) SKM_sk_delete(CONF_IMODULE, (st), (i)) +#define sk_CONF_IMODULE_delete_ptr(st, ptr) SKM_sk_delete_ptr(CONF_IMODULE, (st), (ptr)) +#define sk_CONF_IMODULE_insert(st, val, i) SKM_sk_insert(CONF_IMODULE, (st), (val), (i)) +#define sk_CONF_IMODULE_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(CONF_IMODULE, (st), (cmp)) +#define sk_CONF_IMODULE_dup(st) SKM_sk_dup(CONF_IMODULE, st) +#define sk_CONF_IMODULE_pop_free(st, free_func) SKM_sk_pop_free(CONF_IMODULE, (st), (free_func)) +#define sk_CONF_IMODULE_shift(st) SKM_sk_shift(CONF_IMODULE, (st)) +#define sk_CONF_IMODULE_pop(st) SKM_sk_pop(CONF_IMODULE, (st)) +#define sk_CONF_IMODULE_sort(st) SKM_sk_sort(CONF_IMODULE, (st)) +#define sk_CONF_IMODULE_is_sorted(st) SKM_sk_is_sorted(CONF_IMODULE, (st)) + +#define sk_CONF_MODULE_new(cmp) SKM_sk_new(CONF_MODULE, (cmp)) +#define sk_CONF_MODULE_new_null() SKM_sk_new_null(CONF_MODULE) +#define sk_CONF_MODULE_free(st) SKM_sk_free(CONF_MODULE, (st)) +#define sk_CONF_MODULE_num(st) SKM_sk_num(CONF_MODULE, (st)) +#define sk_CONF_MODULE_value(st, i) SKM_sk_value(CONF_MODULE, (st), (i)) +#define sk_CONF_MODULE_set(st, i, val) SKM_sk_set(CONF_MODULE, (st), (i), (val)) +#define sk_CONF_MODULE_zero(st) SKM_sk_zero(CONF_MODULE, (st)) +#define sk_CONF_MODULE_push(st, val) SKM_sk_push(CONF_MODULE, (st), (val)) +#define sk_CONF_MODULE_unshift(st, val) SKM_sk_unshift(CONF_MODULE, (st), (val)) +#define sk_CONF_MODULE_find(st, val) SKM_sk_find(CONF_MODULE, (st), (val)) +#define sk_CONF_MODULE_delete(st, i) SKM_sk_delete(CONF_MODULE, (st), (i)) +#define sk_CONF_MODULE_delete_ptr(st, ptr) SKM_sk_delete_ptr(CONF_MODULE, (st), (ptr)) +#define sk_CONF_MODULE_insert(st, val, i) SKM_sk_insert(CONF_MODULE, (st), (val), (i)) +#define sk_CONF_MODULE_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(CONF_MODULE, (st), (cmp)) +#define sk_CONF_MODULE_dup(st) SKM_sk_dup(CONF_MODULE, st) +#define sk_CONF_MODULE_pop_free(st, free_func) SKM_sk_pop_free(CONF_MODULE, (st), (free_func)) +#define sk_CONF_MODULE_shift(st) SKM_sk_shift(CONF_MODULE, (st)) +#define sk_CONF_MODULE_pop(st) SKM_sk_pop(CONF_MODULE, (st)) +#define sk_CONF_MODULE_sort(st) SKM_sk_sort(CONF_MODULE, (st)) +#define sk_CONF_MODULE_is_sorted(st) SKM_sk_is_sorted(CONF_MODULE, (st)) + +#define sk_CONF_VALUE_new(cmp) SKM_sk_new(CONF_VALUE, (cmp)) +#define sk_CONF_VALUE_new_null() SKM_sk_new_null(CONF_VALUE) +#define sk_CONF_VALUE_free(st) SKM_sk_free(CONF_VALUE, (st)) +#define sk_CONF_VALUE_num(st) SKM_sk_num(CONF_VALUE, (st)) +#define sk_CONF_VALUE_value(st, i) SKM_sk_value(CONF_VALUE, (st), (i)) +#define sk_CONF_VALUE_set(st, i, val) SKM_sk_set(CONF_VALUE, (st), (i), (val)) +#define sk_CONF_VALUE_zero(st) SKM_sk_zero(CONF_VALUE, (st)) +#define sk_CONF_VALUE_push(st, val) SKM_sk_push(CONF_VALUE, (st), (val)) +#define sk_CONF_VALUE_unshift(st, val) SKM_sk_unshift(CONF_VALUE, (st), (val)) +#define sk_CONF_VALUE_find(st, val) SKM_sk_find(CONF_VALUE, (st), (val)) +#define sk_CONF_VALUE_delete(st, i) SKM_sk_delete(CONF_VALUE, (st), (i)) +#define sk_CONF_VALUE_delete_ptr(st, ptr) SKM_sk_delete_ptr(CONF_VALUE, (st), (ptr)) +#define sk_CONF_VALUE_insert(st, val, i) SKM_sk_insert(CONF_VALUE, (st), (val), (i)) +#define sk_CONF_VALUE_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(CONF_VALUE, (st), (cmp)) +#define sk_CONF_VALUE_dup(st) SKM_sk_dup(CONF_VALUE, st) +#define sk_CONF_VALUE_pop_free(st, free_func) SKM_sk_pop_free(CONF_VALUE, (st), (free_func)) +#define sk_CONF_VALUE_shift(st) SKM_sk_shift(CONF_VALUE, (st)) +#define sk_CONF_VALUE_pop(st) SKM_sk_pop(CONF_VALUE, (st)) +#define sk_CONF_VALUE_sort(st) SKM_sk_sort(CONF_VALUE, (st)) +#define sk_CONF_VALUE_is_sorted(st) SKM_sk_is_sorted(CONF_VALUE, (st)) + +#define sk_CRYPTO_dynlock_new(cmp) SKM_sk_new(CRYPTO_dynlock, (cmp)) +#define sk_CRYPTO_dynlock_new_null() SKM_sk_new_null(CRYPTO_dynlock) +#define sk_CRYPTO_dynlock_free(st) SKM_sk_free(CRYPTO_dynlock, (st)) +#define sk_CRYPTO_dynlock_num(st) SKM_sk_num(CRYPTO_dynlock, (st)) +#define sk_CRYPTO_dynlock_value(st, i) SKM_sk_value(CRYPTO_dynlock, (st), (i)) +#define sk_CRYPTO_dynlock_set(st, i, val) SKM_sk_set(CRYPTO_dynlock, (st), (i), (val)) +#define sk_CRYPTO_dynlock_zero(st) SKM_sk_zero(CRYPTO_dynlock, (st)) +#define sk_CRYPTO_dynlock_push(st, val) SKM_sk_push(CRYPTO_dynlock, (st), (val)) +#define sk_CRYPTO_dynlock_unshift(st, val) SKM_sk_unshift(CRYPTO_dynlock, (st), (val)) +#define sk_CRYPTO_dynlock_find(st, val) SKM_sk_find(CRYPTO_dynlock, (st), (val)) +#define sk_CRYPTO_dynlock_delete(st, i) SKM_sk_delete(CRYPTO_dynlock, (st), (i)) +#define sk_CRYPTO_dynlock_delete_ptr(st, ptr) SKM_sk_delete_ptr(CRYPTO_dynlock, (st), (ptr)) +#define sk_CRYPTO_dynlock_insert(st, val, i) SKM_sk_insert(CRYPTO_dynlock, (st), (val), (i)) +#define sk_CRYPTO_dynlock_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(CRYPTO_dynlock, (st), (cmp)) +#define sk_CRYPTO_dynlock_dup(st) SKM_sk_dup(CRYPTO_dynlock, st) +#define sk_CRYPTO_dynlock_pop_free(st, free_func) SKM_sk_pop_free(CRYPTO_dynlock, (st), (free_func)) +#define sk_CRYPTO_dynlock_shift(st) SKM_sk_shift(CRYPTO_dynlock, (st)) +#define sk_CRYPTO_dynlock_pop(st) SKM_sk_pop(CRYPTO_dynlock, (st)) +#define sk_CRYPTO_dynlock_sort(st) SKM_sk_sort(CRYPTO_dynlock, (st)) +#define sk_CRYPTO_dynlock_is_sorted(st) SKM_sk_is_sorted(CRYPTO_dynlock, (st)) + +#define sk_CTLOG_new(cmp) SKM_sk_new(CTLOG, (cmp)) +#define sk_CTLOG_new_null() SKM_sk_new_null(CTLOG) +#define sk_CTLOG_free(st) SKM_sk_free(CTLOG, (st)) +#define sk_CTLOG_num(st) SKM_sk_num(CTLOG, (st)) +#define sk_CTLOG_value(st, i) SKM_sk_value(CTLOG, (st), (i)) +#define sk_CTLOG_set(st, i, val) SKM_sk_set(CTLOG, (st), (i), (val)) +#define sk_CTLOG_zero(st) SKM_sk_zero(CTLOG, (st)) +#define sk_CTLOG_push(st, val) SKM_sk_push(CTLOG, (st), (val)) +#define sk_CTLOG_unshift(st, val) SKM_sk_unshift(CTLOG, (st), (val)) +#define sk_CTLOG_find(st, val) SKM_sk_find(CTLOG, (st), (val)) +#define sk_CTLOG_delete(st, i) SKM_sk_delete(CTLOG, (st), (i)) +#define sk_CTLOG_delete_ptr(st, ptr) SKM_sk_delete_ptr(CTLOG, (st), (ptr)) +#define sk_CTLOG_insert(st, val, i) SKM_sk_insert(CTLOG, (st), (val), (i)) +#define sk_CTLOG_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(CTLOG, (st), (cmp)) +#define sk_CTLOG_dup(st) SKM_sk_dup(CTLOG, st) +#define sk_CTLOG_pop_free(st, free_func) SKM_sk_pop_free(CTLOG, (st), (free_func)) +#define sk_CTLOG_shift(st) SKM_sk_shift(CTLOG, (st)) +#define sk_CTLOG_pop(st) SKM_sk_pop(CTLOG, (st)) +#define sk_CTLOG_sort(st) SKM_sk_sort(CTLOG, (st)) +#define sk_CTLOG_is_sorted(st) SKM_sk_is_sorted(CTLOG, (st)) + +#define sk_DIST_POINT_new(cmp) SKM_sk_new(DIST_POINT, (cmp)) +#define sk_DIST_POINT_new_null() SKM_sk_new_null(DIST_POINT) +#define sk_DIST_POINT_free(st) SKM_sk_free(DIST_POINT, (st)) +#define sk_DIST_POINT_num(st) SKM_sk_num(DIST_POINT, (st)) +#define sk_DIST_POINT_value(st, i) SKM_sk_value(DIST_POINT, (st), (i)) +#define sk_DIST_POINT_set(st, i, val) SKM_sk_set(DIST_POINT, (st), (i), (val)) +#define sk_DIST_POINT_zero(st) SKM_sk_zero(DIST_POINT, (st)) +#define sk_DIST_POINT_push(st, val) SKM_sk_push(DIST_POINT, (st), (val)) +#define sk_DIST_POINT_unshift(st, val) SKM_sk_unshift(DIST_POINT, (st), (val)) +#define sk_DIST_POINT_find(st, val) SKM_sk_find(DIST_POINT, (st), (val)) +#define sk_DIST_POINT_delete(st, i) SKM_sk_delete(DIST_POINT, (st), (i)) +#define sk_DIST_POINT_delete_ptr(st, ptr) SKM_sk_delete_ptr(DIST_POINT, (st), (ptr)) +#define sk_DIST_POINT_insert(st, val, i) SKM_sk_insert(DIST_POINT, (st), (val), (i)) +#define sk_DIST_POINT_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(DIST_POINT, (st), (cmp)) +#define sk_DIST_POINT_dup(st) SKM_sk_dup(DIST_POINT, st) +#define sk_DIST_POINT_pop_free(st, free_func) SKM_sk_pop_free(DIST_POINT, (st), (free_func)) +#define sk_DIST_POINT_shift(st) SKM_sk_shift(DIST_POINT, (st)) +#define sk_DIST_POINT_pop(st) SKM_sk_pop(DIST_POINT, (st)) +#define sk_DIST_POINT_sort(st) SKM_sk_sort(DIST_POINT, (st)) +#define sk_DIST_POINT_is_sorted(st) SKM_sk_is_sorted(DIST_POINT, (st)) + +#define sk_ESS_CERT_ID_new(cmp) SKM_sk_new(ESS_CERT_ID, (cmp)) +#define sk_ESS_CERT_ID_new_null() SKM_sk_new_null(ESS_CERT_ID) +#define sk_ESS_CERT_ID_free(st) SKM_sk_free(ESS_CERT_ID, (st)) +#define sk_ESS_CERT_ID_num(st) SKM_sk_num(ESS_CERT_ID, (st)) +#define sk_ESS_CERT_ID_value(st, i) SKM_sk_value(ESS_CERT_ID, (st), (i)) +#define sk_ESS_CERT_ID_set(st, i, val) SKM_sk_set(ESS_CERT_ID, (st), (i), (val)) +#define sk_ESS_CERT_ID_zero(st) SKM_sk_zero(ESS_CERT_ID, (st)) +#define sk_ESS_CERT_ID_push(st, val) SKM_sk_push(ESS_CERT_ID, (st), (val)) +#define sk_ESS_CERT_ID_unshift(st, val) SKM_sk_unshift(ESS_CERT_ID, (st), (val)) +#define sk_ESS_CERT_ID_find(st, val) SKM_sk_find(ESS_CERT_ID, (st), (val)) +#define sk_ESS_CERT_ID_delete(st, i) SKM_sk_delete(ESS_CERT_ID, (st), (i)) +#define sk_ESS_CERT_ID_delete_ptr(st, ptr) SKM_sk_delete_ptr(ESS_CERT_ID, (st), (ptr)) +#define sk_ESS_CERT_ID_insert(st, val, i) SKM_sk_insert(ESS_CERT_ID, (st), (val), (i)) +#define sk_ESS_CERT_ID_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(ESS_CERT_ID, (st), (cmp)) +#define sk_ESS_CERT_ID_dup(st) SKM_sk_dup(ESS_CERT_ID, st) +#define sk_ESS_CERT_ID_pop_free(st, free_func) SKM_sk_pop_free(ESS_CERT_ID, (st), (free_func)) +#define sk_ESS_CERT_ID_shift(st) SKM_sk_shift(ESS_CERT_ID, (st)) +#define sk_ESS_CERT_ID_pop(st) SKM_sk_pop(ESS_CERT_ID, (st)) +#define sk_ESS_CERT_ID_sort(st) SKM_sk_sort(ESS_CERT_ID, (st)) +#define sk_ESS_CERT_ID_is_sorted(st) SKM_sk_is_sorted(ESS_CERT_ID, (st)) + +#ifdef LIBRESSL_INTERNAL +#define sk_ESS_CERT_ID_V2_new(cmp) SKM_sk_new(ESS_CERT_ID_V2, (cmp)) +#define sk_ESS_CERT_ID_V2_new_null() SKM_sk_new_null(ESS_CERT_ID_V2) +#define sk_ESS_CERT_ID_V2_free(st) SKM_sk_free(ESS_CERT_ID_V2, (st)) +#define sk_ESS_CERT_ID_V2_num(st) SKM_sk_num(ESS_CERT_ID_V2, (st)) +#define sk_ESS_CERT_ID_V2_value(st, i) SKM_sk_value(ESS_CERT_ID_V2, (st), (i)) +#define sk_ESS_CERT_ID_V2_set(st, i, val) SKM_sk_set(ESS_CERT_ID_V2, (st), (i), (val)) +#define sk_ESS_CERT_ID_V2_zero(st) SKM_sk_zero(ESS_CERT_ID_V2, (st)) +#define sk_ESS_CERT_ID_V2_push(st, val) SKM_sk_push(ESS_CERT_ID_V2, (st), (val)) +#define sk_ESS_CERT_ID_V2_unshift(st, val) SKM_sk_unshift(ESS_CERT_ID_V2, (st), (val)) +#define sk_ESS_CERT_ID_V2_find(st, val) SKM_sk_find(ESS_CERT_ID_V2, (st), (val)) +#define sk_ESS_CERT_ID_V2_delete(st, i) SKM_sk_delete(ESS_CERT_ID_V2, (st), (i)) +#define sk_ESS_CERT_ID_V2_delete_ptr(st, ptr) SKM_sk_delete_ptr(ESS_CERT_ID_V2, (st), (ptr)) +#define sk_ESS_CERT_ID_V2_insert(st, val, i) SKM_sk_insert(ESS_CERT_ID_V2, (st), (val), (i)) +#define sk_ESS_CERT_ID_V2_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(ESS_CERT_ID_V2, (st), (cmp)) +#define sk_ESS_CERT_ID_V2_dup(st) SKM_sk_dup(ESS_CERT_ID_V2, st) +#define sk_ESS_CERT_ID_V2_pop_free(st, free_func) SKM_sk_pop_free(ESS_CERT_ID_V2, (st), (free_func)) +#define sk_ESS_CERT_ID_V2_shift(st) SKM_sk_shift(ESS_CERT_ID_V2, (st)) +#define sk_ESS_CERT_ID_V2_pop(st) SKM_sk_pop(ESS_CERT_ID_V2, (st)) +#define sk_ESS_CERT_ID_V2_sort(st) SKM_sk_sort(ESS_CERT_ID_V2, (st)) +#define sk_ESS_CERT_ID_V2_is_sorted(st) SKM_sk_is_sorted(ESS_CERT_ID_V2, (st)) +#endif /* LIBRESSL_INTERNAL */ + +#define sk_EVP_MD_new(cmp) SKM_sk_new(EVP_MD, (cmp)) +#define sk_EVP_MD_new_null() SKM_sk_new_null(EVP_MD) +#define sk_EVP_MD_free(st) SKM_sk_free(EVP_MD, (st)) +#define sk_EVP_MD_num(st) SKM_sk_num(EVP_MD, (st)) +#define sk_EVP_MD_value(st, i) SKM_sk_value(EVP_MD, (st), (i)) +#define sk_EVP_MD_set(st, i, val) SKM_sk_set(EVP_MD, (st), (i), (val)) +#define sk_EVP_MD_zero(st) SKM_sk_zero(EVP_MD, (st)) +#define sk_EVP_MD_push(st, val) SKM_sk_push(EVP_MD, (st), (val)) +#define sk_EVP_MD_unshift(st, val) SKM_sk_unshift(EVP_MD, (st), (val)) +#define sk_EVP_MD_find(st, val) SKM_sk_find(EVP_MD, (st), (val)) +#define sk_EVP_MD_delete(st, i) SKM_sk_delete(EVP_MD, (st), (i)) +#define sk_EVP_MD_delete_ptr(st, ptr) SKM_sk_delete_ptr(EVP_MD, (st), (ptr)) +#define sk_EVP_MD_insert(st, val, i) SKM_sk_insert(EVP_MD, (st), (val), (i)) +#define sk_EVP_MD_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(EVP_MD, (st), (cmp)) +#define sk_EVP_MD_dup(st) SKM_sk_dup(EVP_MD, st) +#define sk_EVP_MD_pop_free(st, free_func) SKM_sk_pop_free(EVP_MD, (st), (free_func)) +#define sk_EVP_MD_shift(st) SKM_sk_shift(EVP_MD, (st)) +#define sk_EVP_MD_pop(st) SKM_sk_pop(EVP_MD, (st)) +#define sk_EVP_MD_sort(st) SKM_sk_sort(EVP_MD, (st)) +#define sk_EVP_MD_is_sorted(st) SKM_sk_is_sorted(EVP_MD, (st)) + +#define sk_EVP_PKEY_ASN1_METHOD_new(cmp) SKM_sk_new(EVP_PKEY_ASN1_METHOD, (cmp)) +#define sk_EVP_PKEY_ASN1_METHOD_new_null() SKM_sk_new_null(EVP_PKEY_ASN1_METHOD) +#define sk_EVP_PKEY_ASN1_METHOD_free(st) SKM_sk_free(EVP_PKEY_ASN1_METHOD, (st)) +#define sk_EVP_PKEY_ASN1_METHOD_num(st) SKM_sk_num(EVP_PKEY_ASN1_METHOD, (st)) +#define sk_EVP_PKEY_ASN1_METHOD_value(st, i) SKM_sk_value(EVP_PKEY_ASN1_METHOD, (st), (i)) +#define sk_EVP_PKEY_ASN1_METHOD_set(st, i, val) SKM_sk_set(EVP_PKEY_ASN1_METHOD, (st), (i), (val)) +#define sk_EVP_PKEY_ASN1_METHOD_zero(st) SKM_sk_zero(EVP_PKEY_ASN1_METHOD, (st)) +#define sk_EVP_PKEY_ASN1_METHOD_push(st, val) SKM_sk_push(EVP_PKEY_ASN1_METHOD, (st), (val)) +#define sk_EVP_PKEY_ASN1_METHOD_unshift(st, val) SKM_sk_unshift(EVP_PKEY_ASN1_METHOD, (st), (val)) +#define sk_EVP_PKEY_ASN1_METHOD_find(st, val) SKM_sk_find(EVP_PKEY_ASN1_METHOD, (st), (val)) +#define sk_EVP_PKEY_ASN1_METHOD_delete(st, i) SKM_sk_delete(EVP_PKEY_ASN1_METHOD, (st), (i)) +#define sk_EVP_PKEY_ASN1_METHOD_delete_ptr(st, ptr) SKM_sk_delete_ptr(EVP_PKEY_ASN1_METHOD, (st), (ptr)) +#define sk_EVP_PKEY_ASN1_METHOD_insert(st, val, i) SKM_sk_insert(EVP_PKEY_ASN1_METHOD, (st), (val), (i)) +#define sk_EVP_PKEY_ASN1_METHOD_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(EVP_PKEY_ASN1_METHOD, (st), (cmp)) +#define sk_EVP_PKEY_ASN1_METHOD_dup(st) SKM_sk_dup(EVP_PKEY_ASN1_METHOD, st) +#define sk_EVP_PKEY_ASN1_METHOD_pop_free(st, free_func) SKM_sk_pop_free(EVP_PKEY_ASN1_METHOD, (st), (free_func)) +#define sk_EVP_PKEY_ASN1_METHOD_shift(st) SKM_sk_shift(EVP_PKEY_ASN1_METHOD, (st)) +#define sk_EVP_PKEY_ASN1_METHOD_pop(st) SKM_sk_pop(EVP_PKEY_ASN1_METHOD, (st)) +#define sk_EVP_PKEY_ASN1_METHOD_sort(st) SKM_sk_sort(EVP_PKEY_ASN1_METHOD, (st)) +#define sk_EVP_PKEY_ASN1_METHOD_is_sorted(st) SKM_sk_is_sorted(EVP_PKEY_ASN1_METHOD, (st)) + +#define sk_EVP_PKEY_METHOD_new(cmp) SKM_sk_new(EVP_PKEY_METHOD, (cmp)) +#define sk_EVP_PKEY_METHOD_new_null() SKM_sk_new_null(EVP_PKEY_METHOD) +#define sk_EVP_PKEY_METHOD_free(st) SKM_sk_free(EVP_PKEY_METHOD, (st)) +#define sk_EVP_PKEY_METHOD_num(st) SKM_sk_num(EVP_PKEY_METHOD, (st)) +#define sk_EVP_PKEY_METHOD_value(st, i) SKM_sk_value(EVP_PKEY_METHOD, (st), (i)) +#define sk_EVP_PKEY_METHOD_set(st, i, val) SKM_sk_set(EVP_PKEY_METHOD, (st), (i), (val)) +#define sk_EVP_PKEY_METHOD_zero(st) SKM_sk_zero(EVP_PKEY_METHOD, (st)) +#define sk_EVP_PKEY_METHOD_push(st, val) SKM_sk_push(EVP_PKEY_METHOD, (st), (val)) +#define sk_EVP_PKEY_METHOD_unshift(st, val) SKM_sk_unshift(EVP_PKEY_METHOD, (st), (val)) +#define sk_EVP_PKEY_METHOD_find(st, val) SKM_sk_find(EVP_PKEY_METHOD, (st), (val)) +#define sk_EVP_PKEY_METHOD_delete(st, i) SKM_sk_delete(EVP_PKEY_METHOD, (st), (i)) +#define sk_EVP_PKEY_METHOD_delete_ptr(st, ptr) SKM_sk_delete_ptr(EVP_PKEY_METHOD, (st), (ptr)) +#define sk_EVP_PKEY_METHOD_insert(st, val, i) SKM_sk_insert(EVP_PKEY_METHOD, (st), (val), (i)) +#define sk_EVP_PKEY_METHOD_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(EVP_PKEY_METHOD, (st), (cmp)) +#define sk_EVP_PKEY_METHOD_dup(st) SKM_sk_dup(EVP_PKEY_METHOD, st) +#define sk_EVP_PKEY_METHOD_pop_free(st, free_func) SKM_sk_pop_free(EVP_PKEY_METHOD, (st), (free_func)) +#define sk_EVP_PKEY_METHOD_shift(st) SKM_sk_shift(EVP_PKEY_METHOD, (st)) +#define sk_EVP_PKEY_METHOD_pop(st) SKM_sk_pop(EVP_PKEY_METHOD, (st)) +#define sk_EVP_PKEY_METHOD_sort(st) SKM_sk_sort(EVP_PKEY_METHOD, (st)) +#define sk_EVP_PKEY_METHOD_is_sorted(st) SKM_sk_is_sorted(EVP_PKEY_METHOD, (st)) + +#define sk_GENERAL_NAME_new(cmp) SKM_sk_new(GENERAL_NAME, (cmp)) +#define sk_GENERAL_NAME_new_null() SKM_sk_new_null(GENERAL_NAME) +#define sk_GENERAL_NAME_free(st) SKM_sk_free(GENERAL_NAME, (st)) +#define sk_GENERAL_NAME_num(st) SKM_sk_num(GENERAL_NAME, (st)) +#define sk_GENERAL_NAME_value(st, i) SKM_sk_value(GENERAL_NAME, (st), (i)) +#define sk_GENERAL_NAME_set(st, i, val) SKM_sk_set(GENERAL_NAME, (st), (i), (val)) +#define sk_GENERAL_NAME_zero(st) SKM_sk_zero(GENERAL_NAME, (st)) +#define sk_GENERAL_NAME_push(st, val) SKM_sk_push(GENERAL_NAME, (st), (val)) +#define sk_GENERAL_NAME_unshift(st, val) SKM_sk_unshift(GENERAL_NAME, (st), (val)) +#define sk_GENERAL_NAME_find(st, val) SKM_sk_find(GENERAL_NAME, (st), (val)) +#define sk_GENERAL_NAME_delete(st, i) SKM_sk_delete(GENERAL_NAME, (st), (i)) +#define sk_GENERAL_NAME_delete_ptr(st, ptr) SKM_sk_delete_ptr(GENERAL_NAME, (st), (ptr)) +#define sk_GENERAL_NAME_insert(st, val, i) SKM_sk_insert(GENERAL_NAME, (st), (val), (i)) +#define sk_GENERAL_NAME_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(GENERAL_NAME, (st), (cmp)) +#define sk_GENERAL_NAME_dup(st) SKM_sk_dup(GENERAL_NAME, st) +#define sk_GENERAL_NAME_pop_free(st, free_func) SKM_sk_pop_free(GENERAL_NAME, (st), (free_func)) +#define sk_GENERAL_NAME_shift(st) SKM_sk_shift(GENERAL_NAME, (st)) +#define sk_GENERAL_NAME_pop(st) SKM_sk_pop(GENERAL_NAME, (st)) +#define sk_GENERAL_NAME_sort(st) SKM_sk_sort(GENERAL_NAME, (st)) +#define sk_GENERAL_NAME_is_sorted(st) SKM_sk_is_sorted(GENERAL_NAME, (st)) + +#define sk_GENERAL_NAMES_new(cmp) SKM_sk_new(GENERAL_NAMES, (cmp)) +#define sk_GENERAL_NAMES_new_null() SKM_sk_new_null(GENERAL_NAMES) +#define sk_GENERAL_NAMES_free(st) SKM_sk_free(GENERAL_NAMES, (st)) +#define sk_GENERAL_NAMES_num(st) SKM_sk_num(GENERAL_NAMES, (st)) +#define sk_GENERAL_NAMES_value(st, i) SKM_sk_value(GENERAL_NAMES, (st), (i)) +#define sk_GENERAL_NAMES_set(st, i, val) SKM_sk_set(GENERAL_NAMES, (st), (i), (val)) +#define sk_GENERAL_NAMES_zero(st) SKM_sk_zero(GENERAL_NAMES, (st)) +#define sk_GENERAL_NAMES_push(st, val) SKM_sk_push(GENERAL_NAMES, (st), (val)) +#define sk_GENERAL_NAMES_unshift(st, val) SKM_sk_unshift(GENERAL_NAMES, (st), (val)) +#define sk_GENERAL_NAMES_find(st, val) SKM_sk_find(GENERAL_NAMES, (st), (val)) +#define sk_GENERAL_NAMES_delete(st, i) SKM_sk_delete(GENERAL_NAMES, (st), (i)) +#define sk_GENERAL_NAMES_delete_ptr(st, ptr) SKM_sk_delete_ptr(GENERAL_NAMES, (st), (ptr)) +#define sk_GENERAL_NAMES_insert(st, val, i) SKM_sk_insert(GENERAL_NAMES, (st), (val), (i)) +#define sk_GENERAL_NAMES_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(GENERAL_NAMES, (st), (cmp)) +#define sk_GENERAL_NAMES_dup(st) SKM_sk_dup(GENERAL_NAMES, st) +#define sk_GENERAL_NAMES_pop_free(st, free_func) SKM_sk_pop_free(GENERAL_NAMES, (st), (free_func)) +#define sk_GENERAL_NAMES_shift(st) SKM_sk_shift(GENERAL_NAMES, (st)) +#define sk_GENERAL_NAMES_pop(st) SKM_sk_pop(GENERAL_NAMES, (st)) +#define sk_GENERAL_NAMES_sort(st) SKM_sk_sort(GENERAL_NAMES, (st)) +#define sk_GENERAL_NAMES_is_sorted(st) SKM_sk_is_sorted(GENERAL_NAMES, (st)) + +#define sk_GENERAL_SUBTREE_new(cmp) SKM_sk_new(GENERAL_SUBTREE, (cmp)) +#define sk_GENERAL_SUBTREE_new_null() SKM_sk_new_null(GENERAL_SUBTREE) +#define sk_GENERAL_SUBTREE_free(st) SKM_sk_free(GENERAL_SUBTREE, (st)) +#define sk_GENERAL_SUBTREE_num(st) SKM_sk_num(GENERAL_SUBTREE, (st)) +#define sk_GENERAL_SUBTREE_value(st, i) SKM_sk_value(GENERAL_SUBTREE, (st), (i)) +#define sk_GENERAL_SUBTREE_set(st, i, val) SKM_sk_set(GENERAL_SUBTREE, (st), (i), (val)) +#define sk_GENERAL_SUBTREE_zero(st) SKM_sk_zero(GENERAL_SUBTREE, (st)) +#define sk_GENERAL_SUBTREE_push(st, val) SKM_sk_push(GENERAL_SUBTREE, (st), (val)) +#define sk_GENERAL_SUBTREE_unshift(st, val) SKM_sk_unshift(GENERAL_SUBTREE, (st), (val)) +#define sk_GENERAL_SUBTREE_find(st, val) SKM_sk_find(GENERAL_SUBTREE, (st), (val)) +#define sk_GENERAL_SUBTREE_delete(st, i) SKM_sk_delete(GENERAL_SUBTREE, (st), (i)) +#define sk_GENERAL_SUBTREE_delete_ptr(st, ptr) SKM_sk_delete_ptr(GENERAL_SUBTREE, (st), (ptr)) +#define sk_GENERAL_SUBTREE_insert(st, val, i) SKM_sk_insert(GENERAL_SUBTREE, (st), (val), (i)) +#define sk_GENERAL_SUBTREE_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(GENERAL_SUBTREE, (st), (cmp)) +#define sk_GENERAL_SUBTREE_dup(st) SKM_sk_dup(GENERAL_SUBTREE, st) +#define sk_GENERAL_SUBTREE_pop_free(st, free_func) SKM_sk_pop_free(GENERAL_SUBTREE, (st), (free_func)) +#define sk_GENERAL_SUBTREE_shift(st) SKM_sk_shift(GENERAL_SUBTREE, (st)) +#define sk_GENERAL_SUBTREE_pop(st) SKM_sk_pop(GENERAL_SUBTREE, (st)) +#define sk_GENERAL_SUBTREE_sort(st) SKM_sk_sort(GENERAL_SUBTREE, (st)) +#define sk_GENERAL_SUBTREE_is_sorted(st) SKM_sk_is_sorted(GENERAL_SUBTREE, (st)) + +#define sk_IPAddressFamily_new(cmp) SKM_sk_new(IPAddressFamily, (cmp)) +#define sk_IPAddressFamily_new_null() SKM_sk_new_null(IPAddressFamily) +#define sk_IPAddressFamily_free(st) SKM_sk_free(IPAddressFamily, (st)) +#define sk_IPAddressFamily_num(st) SKM_sk_num(IPAddressFamily, (st)) +#define sk_IPAddressFamily_value(st, i) SKM_sk_value(IPAddressFamily, (st), (i)) +#define sk_IPAddressFamily_set(st, i, val) SKM_sk_set(IPAddressFamily, (st), (i), (val)) +#define sk_IPAddressFamily_zero(st) SKM_sk_zero(IPAddressFamily, (st)) +#define sk_IPAddressFamily_push(st, val) SKM_sk_push(IPAddressFamily, (st), (val)) +#define sk_IPAddressFamily_unshift(st, val) SKM_sk_unshift(IPAddressFamily, (st), (val)) +#define sk_IPAddressFamily_find(st, val) SKM_sk_find(IPAddressFamily, (st), (val)) +#define sk_IPAddressFamily_delete(st, i) SKM_sk_delete(IPAddressFamily, (st), (i)) +#define sk_IPAddressFamily_delete_ptr(st, ptr) SKM_sk_delete_ptr(IPAddressFamily, (st), (ptr)) +#define sk_IPAddressFamily_insert(st, val, i) SKM_sk_insert(IPAddressFamily, (st), (val), (i)) +#define sk_IPAddressFamily_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(IPAddressFamily, (st), (cmp)) +#define sk_IPAddressFamily_dup(st) SKM_sk_dup(IPAddressFamily, st) +#define sk_IPAddressFamily_pop_free(st, free_func) SKM_sk_pop_free(IPAddressFamily, (st), (free_func)) +#define sk_IPAddressFamily_shift(st) SKM_sk_shift(IPAddressFamily, (st)) +#define sk_IPAddressFamily_pop(st) SKM_sk_pop(IPAddressFamily, (st)) +#define sk_IPAddressFamily_sort(st) SKM_sk_sort(IPAddressFamily, (st)) +#define sk_IPAddressFamily_is_sorted(st) SKM_sk_is_sorted(IPAddressFamily, (st)) + +#define sk_IPAddressOrRange_new(cmp) SKM_sk_new(IPAddressOrRange, (cmp)) +#define sk_IPAddressOrRange_new_null() SKM_sk_new_null(IPAddressOrRange) +#define sk_IPAddressOrRange_free(st) SKM_sk_free(IPAddressOrRange, (st)) +#define sk_IPAddressOrRange_num(st) SKM_sk_num(IPAddressOrRange, (st)) +#define sk_IPAddressOrRange_value(st, i) SKM_sk_value(IPAddressOrRange, (st), (i)) +#define sk_IPAddressOrRange_set(st, i, val) SKM_sk_set(IPAddressOrRange, (st), (i), (val)) +#define sk_IPAddressOrRange_zero(st) SKM_sk_zero(IPAddressOrRange, (st)) +#define sk_IPAddressOrRange_push(st, val) SKM_sk_push(IPAddressOrRange, (st), (val)) +#define sk_IPAddressOrRange_unshift(st, val) SKM_sk_unshift(IPAddressOrRange, (st), (val)) +#define sk_IPAddressOrRange_find(st, val) SKM_sk_find(IPAddressOrRange, (st), (val)) +#define sk_IPAddressOrRange_delete(st, i) SKM_sk_delete(IPAddressOrRange, (st), (i)) +#define sk_IPAddressOrRange_delete_ptr(st, ptr) SKM_sk_delete_ptr(IPAddressOrRange, (st), (ptr)) +#define sk_IPAddressOrRange_insert(st, val, i) SKM_sk_insert(IPAddressOrRange, (st), (val), (i)) +#define sk_IPAddressOrRange_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(IPAddressOrRange, (st), (cmp)) +#define sk_IPAddressOrRange_dup(st) SKM_sk_dup(IPAddressOrRange, st) +#define sk_IPAddressOrRange_pop_free(st, free_func) SKM_sk_pop_free(IPAddressOrRange, (st), (free_func)) +#define sk_IPAddressOrRange_shift(st) SKM_sk_shift(IPAddressOrRange, (st)) +#define sk_IPAddressOrRange_pop(st) SKM_sk_pop(IPAddressOrRange, (st)) +#define sk_IPAddressOrRange_sort(st) SKM_sk_sort(IPAddressOrRange, (st)) +#define sk_IPAddressOrRange_is_sorted(st) SKM_sk_is_sorted(IPAddressOrRange, (st)) + +#define sk_MIME_HEADER_new(cmp) SKM_sk_new(MIME_HEADER, (cmp)) +#define sk_MIME_HEADER_new_null() SKM_sk_new_null(MIME_HEADER) +#define sk_MIME_HEADER_free(st) SKM_sk_free(MIME_HEADER, (st)) +#define sk_MIME_HEADER_num(st) SKM_sk_num(MIME_HEADER, (st)) +#define sk_MIME_HEADER_value(st, i) SKM_sk_value(MIME_HEADER, (st), (i)) +#define sk_MIME_HEADER_set(st, i, val) SKM_sk_set(MIME_HEADER, (st), (i), (val)) +#define sk_MIME_HEADER_zero(st) SKM_sk_zero(MIME_HEADER, (st)) +#define sk_MIME_HEADER_push(st, val) SKM_sk_push(MIME_HEADER, (st), (val)) +#define sk_MIME_HEADER_unshift(st, val) SKM_sk_unshift(MIME_HEADER, (st), (val)) +#define sk_MIME_HEADER_find(st, val) SKM_sk_find(MIME_HEADER, (st), (val)) +#define sk_MIME_HEADER_delete(st, i) SKM_sk_delete(MIME_HEADER, (st), (i)) +#define sk_MIME_HEADER_delete_ptr(st, ptr) SKM_sk_delete_ptr(MIME_HEADER, (st), (ptr)) +#define sk_MIME_HEADER_insert(st, val, i) SKM_sk_insert(MIME_HEADER, (st), (val), (i)) +#define sk_MIME_HEADER_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(MIME_HEADER, (st), (cmp)) +#define sk_MIME_HEADER_dup(st) SKM_sk_dup(MIME_HEADER, st) +#define sk_MIME_HEADER_pop_free(st, free_func) SKM_sk_pop_free(MIME_HEADER, (st), (free_func)) +#define sk_MIME_HEADER_shift(st) SKM_sk_shift(MIME_HEADER, (st)) +#define sk_MIME_HEADER_pop(st) SKM_sk_pop(MIME_HEADER, (st)) +#define sk_MIME_HEADER_sort(st) SKM_sk_sort(MIME_HEADER, (st)) +#define sk_MIME_HEADER_is_sorted(st) SKM_sk_is_sorted(MIME_HEADER, (st)) + +#define sk_MIME_PARAM_new(cmp) SKM_sk_new(MIME_PARAM, (cmp)) +#define sk_MIME_PARAM_new_null() SKM_sk_new_null(MIME_PARAM) +#define sk_MIME_PARAM_free(st) SKM_sk_free(MIME_PARAM, (st)) +#define sk_MIME_PARAM_num(st) SKM_sk_num(MIME_PARAM, (st)) +#define sk_MIME_PARAM_value(st, i) SKM_sk_value(MIME_PARAM, (st), (i)) +#define sk_MIME_PARAM_set(st, i, val) SKM_sk_set(MIME_PARAM, (st), (i), (val)) +#define sk_MIME_PARAM_zero(st) SKM_sk_zero(MIME_PARAM, (st)) +#define sk_MIME_PARAM_push(st, val) SKM_sk_push(MIME_PARAM, (st), (val)) +#define sk_MIME_PARAM_unshift(st, val) SKM_sk_unshift(MIME_PARAM, (st), (val)) +#define sk_MIME_PARAM_find(st, val) SKM_sk_find(MIME_PARAM, (st), (val)) +#define sk_MIME_PARAM_delete(st, i) SKM_sk_delete(MIME_PARAM, (st), (i)) +#define sk_MIME_PARAM_delete_ptr(st, ptr) SKM_sk_delete_ptr(MIME_PARAM, (st), (ptr)) +#define sk_MIME_PARAM_insert(st, val, i) SKM_sk_insert(MIME_PARAM, (st), (val), (i)) +#define sk_MIME_PARAM_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(MIME_PARAM, (st), (cmp)) +#define sk_MIME_PARAM_dup(st) SKM_sk_dup(MIME_PARAM, st) +#define sk_MIME_PARAM_pop_free(st, free_func) SKM_sk_pop_free(MIME_PARAM, (st), (free_func)) +#define sk_MIME_PARAM_shift(st) SKM_sk_shift(MIME_PARAM, (st)) +#define sk_MIME_PARAM_pop(st) SKM_sk_pop(MIME_PARAM, (st)) +#define sk_MIME_PARAM_sort(st) SKM_sk_sort(MIME_PARAM, (st)) +#define sk_MIME_PARAM_is_sorted(st) SKM_sk_is_sorted(MIME_PARAM, (st)) + +#define sk_NAME_FUNCS_new(cmp) SKM_sk_new(NAME_FUNCS, (cmp)) +#define sk_NAME_FUNCS_new_null() SKM_sk_new_null(NAME_FUNCS) +#define sk_NAME_FUNCS_free(st) SKM_sk_free(NAME_FUNCS, (st)) +#define sk_NAME_FUNCS_num(st) SKM_sk_num(NAME_FUNCS, (st)) +#define sk_NAME_FUNCS_value(st, i) SKM_sk_value(NAME_FUNCS, (st), (i)) +#define sk_NAME_FUNCS_set(st, i, val) SKM_sk_set(NAME_FUNCS, (st), (i), (val)) +#define sk_NAME_FUNCS_zero(st) SKM_sk_zero(NAME_FUNCS, (st)) +#define sk_NAME_FUNCS_push(st, val) SKM_sk_push(NAME_FUNCS, (st), (val)) +#define sk_NAME_FUNCS_unshift(st, val) SKM_sk_unshift(NAME_FUNCS, (st), (val)) +#define sk_NAME_FUNCS_find(st, val) SKM_sk_find(NAME_FUNCS, (st), (val)) +#define sk_NAME_FUNCS_delete(st, i) SKM_sk_delete(NAME_FUNCS, (st), (i)) +#define sk_NAME_FUNCS_delete_ptr(st, ptr) SKM_sk_delete_ptr(NAME_FUNCS, (st), (ptr)) +#define sk_NAME_FUNCS_insert(st, val, i) SKM_sk_insert(NAME_FUNCS, (st), (val), (i)) +#define sk_NAME_FUNCS_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(NAME_FUNCS, (st), (cmp)) +#define sk_NAME_FUNCS_dup(st) SKM_sk_dup(NAME_FUNCS, st) +#define sk_NAME_FUNCS_pop_free(st, free_func) SKM_sk_pop_free(NAME_FUNCS, (st), (free_func)) +#define sk_NAME_FUNCS_shift(st) SKM_sk_shift(NAME_FUNCS, (st)) +#define sk_NAME_FUNCS_pop(st) SKM_sk_pop(NAME_FUNCS, (st)) +#define sk_NAME_FUNCS_sort(st) SKM_sk_sort(NAME_FUNCS, (st)) +#define sk_NAME_FUNCS_is_sorted(st) SKM_sk_is_sorted(NAME_FUNCS, (st)) + +#define sk_OCSP_CERTID_new(cmp) SKM_sk_new(OCSP_CERTID, (cmp)) +#define sk_OCSP_CERTID_new_null() SKM_sk_new_null(OCSP_CERTID) +#define sk_OCSP_CERTID_free(st) SKM_sk_free(OCSP_CERTID, (st)) +#define sk_OCSP_CERTID_num(st) SKM_sk_num(OCSP_CERTID, (st)) +#define sk_OCSP_CERTID_value(st, i) SKM_sk_value(OCSP_CERTID, (st), (i)) +#define sk_OCSP_CERTID_set(st, i, val) SKM_sk_set(OCSP_CERTID, (st), (i), (val)) +#define sk_OCSP_CERTID_zero(st) SKM_sk_zero(OCSP_CERTID, (st)) +#define sk_OCSP_CERTID_push(st, val) SKM_sk_push(OCSP_CERTID, (st), (val)) +#define sk_OCSP_CERTID_unshift(st, val) SKM_sk_unshift(OCSP_CERTID, (st), (val)) +#define sk_OCSP_CERTID_find(st, val) SKM_sk_find(OCSP_CERTID, (st), (val)) +#define sk_OCSP_CERTID_delete(st, i) SKM_sk_delete(OCSP_CERTID, (st), (i)) +#define sk_OCSP_CERTID_delete_ptr(st, ptr) SKM_sk_delete_ptr(OCSP_CERTID, (st), (ptr)) +#define sk_OCSP_CERTID_insert(st, val, i) SKM_sk_insert(OCSP_CERTID, (st), (val), (i)) +#define sk_OCSP_CERTID_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(OCSP_CERTID, (st), (cmp)) +#define sk_OCSP_CERTID_dup(st) SKM_sk_dup(OCSP_CERTID, st) +#define sk_OCSP_CERTID_pop_free(st, free_func) SKM_sk_pop_free(OCSP_CERTID, (st), (free_func)) +#define sk_OCSP_CERTID_shift(st) SKM_sk_shift(OCSP_CERTID, (st)) +#define sk_OCSP_CERTID_pop(st) SKM_sk_pop(OCSP_CERTID, (st)) +#define sk_OCSP_CERTID_sort(st) SKM_sk_sort(OCSP_CERTID, (st)) +#define sk_OCSP_CERTID_is_sorted(st) SKM_sk_is_sorted(OCSP_CERTID, (st)) + +#define sk_OCSP_ONEREQ_new(cmp) SKM_sk_new(OCSP_ONEREQ, (cmp)) +#define sk_OCSP_ONEREQ_new_null() SKM_sk_new_null(OCSP_ONEREQ) +#define sk_OCSP_ONEREQ_free(st) SKM_sk_free(OCSP_ONEREQ, (st)) +#define sk_OCSP_ONEREQ_num(st) SKM_sk_num(OCSP_ONEREQ, (st)) +#define sk_OCSP_ONEREQ_value(st, i) SKM_sk_value(OCSP_ONEREQ, (st), (i)) +#define sk_OCSP_ONEREQ_set(st, i, val) SKM_sk_set(OCSP_ONEREQ, (st), (i), (val)) +#define sk_OCSP_ONEREQ_zero(st) SKM_sk_zero(OCSP_ONEREQ, (st)) +#define sk_OCSP_ONEREQ_push(st, val) SKM_sk_push(OCSP_ONEREQ, (st), (val)) +#define sk_OCSP_ONEREQ_unshift(st, val) SKM_sk_unshift(OCSP_ONEREQ, (st), (val)) +#define sk_OCSP_ONEREQ_find(st, val) SKM_sk_find(OCSP_ONEREQ, (st), (val)) +#define sk_OCSP_ONEREQ_delete(st, i) SKM_sk_delete(OCSP_ONEREQ, (st), (i)) +#define sk_OCSP_ONEREQ_delete_ptr(st, ptr) SKM_sk_delete_ptr(OCSP_ONEREQ, (st), (ptr)) +#define sk_OCSP_ONEREQ_insert(st, val, i) SKM_sk_insert(OCSP_ONEREQ, (st), (val), (i)) +#define sk_OCSP_ONEREQ_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(OCSP_ONEREQ, (st), (cmp)) +#define sk_OCSP_ONEREQ_dup(st) SKM_sk_dup(OCSP_ONEREQ, st) +#define sk_OCSP_ONEREQ_pop_free(st, free_func) SKM_sk_pop_free(OCSP_ONEREQ, (st), (free_func)) +#define sk_OCSP_ONEREQ_shift(st) SKM_sk_shift(OCSP_ONEREQ, (st)) +#define sk_OCSP_ONEREQ_pop(st) SKM_sk_pop(OCSP_ONEREQ, (st)) +#define sk_OCSP_ONEREQ_sort(st) SKM_sk_sort(OCSP_ONEREQ, (st)) +#define sk_OCSP_ONEREQ_is_sorted(st) SKM_sk_is_sorted(OCSP_ONEREQ, (st)) + +#define sk_OCSP_RESPID_new(cmp) SKM_sk_new(OCSP_RESPID, (cmp)) +#define sk_OCSP_RESPID_new_null() SKM_sk_new_null(OCSP_RESPID) +#define sk_OCSP_RESPID_free(st) SKM_sk_free(OCSP_RESPID, (st)) +#define sk_OCSP_RESPID_num(st) SKM_sk_num(OCSP_RESPID, (st)) +#define sk_OCSP_RESPID_value(st, i) SKM_sk_value(OCSP_RESPID, (st), (i)) +#define sk_OCSP_RESPID_set(st, i, val) SKM_sk_set(OCSP_RESPID, (st), (i), (val)) +#define sk_OCSP_RESPID_zero(st) SKM_sk_zero(OCSP_RESPID, (st)) +#define sk_OCSP_RESPID_push(st, val) SKM_sk_push(OCSP_RESPID, (st), (val)) +#define sk_OCSP_RESPID_unshift(st, val) SKM_sk_unshift(OCSP_RESPID, (st), (val)) +#define sk_OCSP_RESPID_find(st, val) SKM_sk_find(OCSP_RESPID, (st), (val)) +#define sk_OCSP_RESPID_delete(st, i) SKM_sk_delete(OCSP_RESPID, (st), (i)) +#define sk_OCSP_RESPID_delete_ptr(st, ptr) SKM_sk_delete_ptr(OCSP_RESPID, (st), (ptr)) +#define sk_OCSP_RESPID_insert(st, val, i) SKM_sk_insert(OCSP_RESPID, (st), (val), (i)) +#define sk_OCSP_RESPID_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(OCSP_RESPID, (st), (cmp)) +#define sk_OCSP_RESPID_dup(st) SKM_sk_dup(OCSP_RESPID, st) +#define sk_OCSP_RESPID_pop_free(st, free_func) SKM_sk_pop_free(OCSP_RESPID, (st), (free_func)) +#define sk_OCSP_RESPID_shift(st) SKM_sk_shift(OCSP_RESPID, (st)) +#define sk_OCSP_RESPID_pop(st) SKM_sk_pop(OCSP_RESPID, (st)) +#define sk_OCSP_RESPID_sort(st) SKM_sk_sort(OCSP_RESPID, (st)) +#define sk_OCSP_RESPID_is_sorted(st) SKM_sk_is_sorted(OCSP_RESPID, (st)) + +#define sk_OCSP_SINGLERESP_new(cmp) SKM_sk_new(OCSP_SINGLERESP, (cmp)) +#define sk_OCSP_SINGLERESP_new_null() SKM_sk_new_null(OCSP_SINGLERESP) +#define sk_OCSP_SINGLERESP_free(st) SKM_sk_free(OCSP_SINGLERESP, (st)) +#define sk_OCSP_SINGLERESP_num(st) SKM_sk_num(OCSP_SINGLERESP, (st)) +#define sk_OCSP_SINGLERESP_value(st, i) SKM_sk_value(OCSP_SINGLERESP, (st), (i)) +#define sk_OCSP_SINGLERESP_set(st, i, val) SKM_sk_set(OCSP_SINGLERESP, (st), (i), (val)) +#define sk_OCSP_SINGLERESP_zero(st) SKM_sk_zero(OCSP_SINGLERESP, (st)) +#define sk_OCSP_SINGLERESP_push(st, val) SKM_sk_push(OCSP_SINGLERESP, (st), (val)) +#define sk_OCSP_SINGLERESP_unshift(st, val) SKM_sk_unshift(OCSP_SINGLERESP, (st), (val)) +#define sk_OCSP_SINGLERESP_find(st, val) SKM_sk_find(OCSP_SINGLERESP, (st), (val)) +#define sk_OCSP_SINGLERESP_delete(st, i) SKM_sk_delete(OCSP_SINGLERESP, (st), (i)) +#define sk_OCSP_SINGLERESP_delete_ptr(st, ptr) SKM_sk_delete_ptr(OCSP_SINGLERESP, (st), (ptr)) +#define sk_OCSP_SINGLERESP_insert(st, val, i) SKM_sk_insert(OCSP_SINGLERESP, (st), (val), (i)) +#define sk_OCSP_SINGLERESP_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(OCSP_SINGLERESP, (st), (cmp)) +#define sk_OCSP_SINGLERESP_dup(st) SKM_sk_dup(OCSP_SINGLERESP, st) +#define sk_OCSP_SINGLERESP_pop_free(st, free_func) SKM_sk_pop_free(OCSP_SINGLERESP, (st), (free_func)) +#define sk_OCSP_SINGLERESP_shift(st) SKM_sk_shift(OCSP_SINGLERESP, (st)) +#define sk_OCSP_SINGLERESP_pop(st) SKM_sk_pop(OCSP_SINGLERESP, (st)) +#define sk_OCSP_SINGLERESP_sort(st) SKM_sk_sort(OCSP_SINGLERESP, (st)) +#define sk_OCSP_SINGLERESP_is_sorted(st) SKM_sk_is_sorted(OCSP_SINGLERESP, (st)) + +#define sk_PKCS12_SAFEBAG_new(cmp) SKM_sk_new(PKCS12_SAFEBAG, (cmp)) +#define sk_PKCS12_SAFEBAG_new_null() SKM_sk_new_null(PKCS12_SAFEBAG) +#define sk_PKCS12_SAFEBAG_free(st) SKM_sk_free(PKCS12_SAFEBAG, (st)) +#define sk_PKCS12_SAFEBAG_num(st) SKM_sk_num(PKCS12_SAFEBAG, (st)) +#define sk_PKCS12_SAFEBAG_value(st, i) SKM_sk_value(PKCS12_SAFEBAG, (st), (i)) +#define sk_PKCS12_SAFEBAG_set(st, i, val) SKM_sk_set(PKCS12_SAFEBAG, (st), (i), (val)) +#define sk_PKCS12_SAFEBAG_zero(st) SKM_sk_zero(PKCS12_SAFEBAG, (st)) +#define sk_PKCS12_SAFEBAG_push(st, val) SKM_sk_push(PKCS12_SAFEBAG, (st), (val)) +#define sk_PKCS12_SAFEBAG_unshift(st, val) SKM_sk_unshift(PKCS12_SAFEBAG, (st), (val)) +#define sk_PKCS12_SAFEBAG_find(st, val) SKM_sk_find(PKCS12_SAFEBAG, (st), (val)) +#define sk_PKCS12_SAFEBAG_delete(st, i) SKM_sk_delete(PKCS12_SAFEBAG, (st), (i)) +#define sk_PKCS12_SAFEBAG_delete_ptr(st, ptr) SKM_sk_delete_ptr(PKCS12_SAFEBAG, (st), (ptr)) +#define sk_PKCS12_SAFEBAG_insert(st, val, i) SKM_sk_insert(PKCS12_SAFEBAG, (st), (val), (i)) +#define sk_PKCS12_SAFEBAG_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(PKCS12_SAFEBAG, (st), (cmp)) +#define sk_PKCS12_SAFEBAG_dup(st) SKM_sk_dup(PKCS12_SAFEBAG, st) +#define sk_PKCS12_SAFEBAG_pop_free(st, free_func) SKM_sk_pop_free(PKCS12_SAFEBAG, (st), (free_func)) +#define sk_PKCS12_SAFEBAG_shift(st) SKM_sk_shift(PKCS12_SAFEBAG, (st)) +#define sk_PKCS12_SAFEBAG_pop(st) SKM_sk_pop(PKCS12_SAFEBAG, (st)) +#define sk_PKCS12_SAFEBAG_sort(st) SKM_sk_sort(PKCS12_SAFEBAG, (st)) +#define sk_PKCS12_SAFEBAG_is_sorted(st) SKM_sk_is_sorted(PKCS12_SAFEBAG, (st)) + +#define sk_PKCS7_new(cmp) SKM_sk_new(PKCS7, (cmp)) +#define sk_PKCS7_new_null() SKM_sk_new_null(PKCS7) +#define sk_PKCS7_free(st) SKM_sk_free(PKCS7, (st)) +#define sk_PKCS7_num(st) SKM_sk_num(PKCS7, (st)) +#define sk_PKCS7_value(st, i) SKM_sk_value(PKCS7, (st), (i)) +#define sk_PKCS7_set(st, i, val) SKM_sk_set(PKCS7, (st), (i), (val)) +#define sk_PKCS7_zero(st) SKM_sk_zero(PKCS7, (st)) +#define sk_PKCS7_push(st, val) SKM_sk_push(PKCS7, (st), (val)) +#define sk_PKCS7_unshift(st, val) SKM_sk_unshift(PKCS7, (st), (val)) +#define sk_PKCS7_find(st, val) SKM_sk_find(PKCS7, (st), (val)) +#define sk_PKCS7_delete(st, i) SKM_sk_delete(PKCS7, (st), (i)) +#define sk_PKCS7_delete_ptr(st, ptr) SKM_sk_delete_ptr(PKCS7, (st), (ptr)) +#define sk_PKCS7_insert(st, val, i) SKM_sk_insert(PKCS7, (st), (val), (i)) +#define sk_PKCS7_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(PKCS7, (st), (cmp)) +#define sk_PKCS7_dup(st) SKM_sk_dup(PKCS7, st) +#define sk_PKCS7_pop_free(st, free_func) SKM_sk_pop_free(PKCS7, (st), (free_func)) +#define sk_PKCS7_shift(st) SKM_sk_shift(PKCS7, (st)) +#define sk_PKCS7_pop(st) SKM_sk_pop(PKCS7, (st)) +#define sk_PKCS7_sort(st) SKM_sk_sort(PKCS7, (st)) +#define sk_PKCS7_is_sorted(st) SKM_sk_is_sorted(PKCS7, (st)) + +#define sk_PKCS7_RECIP_INFO_new(cmp) SKM_sk_new(PKCS7_RECIP_INFO, (cmp)) +#define sk_PKCS7_RECIP_INFO_new_null() SKM_sk_new_null(PKCS7_RECIP_INFO) +#define sk_PKCS7_RECIP_INFO_free(st) SKM_sk_free(PKCS7_RECIP_INFO, (st)) +#define sk_PKCS7_RECIP_INFO_num(st) SKM_sk_num(PKCS7_RECIP_INFO, (st)) +#define sk_PKCS7_RECIP_INFO_value(st, i) SKM_sk_value(PKCS7_RECIP_INFO, (st), (i)) +#define sk_PKCS7_RECIP_INFO_set(st, i, val) SKM_sk_set(PKCS7_RECIP_INFO, (st), (i), (val)) +#define sk_PKCS7_RECIP_INFO_zero(st) SKM_sk_zero(PKCS7_RECIP_INFO, (st)) +#define sk_PKCS7_RECIP_INFO_push(st, val) SKM_sk_push(PKCS7_RECIP_INFO, (st), (val)) +#define sk_PKCS7_RECIP_INFO_unshift(st, val) SKM_sk_unshift(PKCS7_RECIP_INFO, (st), (val)) +#define sk_PKCS7_RECIP_INFO_find(st, val) SKM_sk_find(PKCS7_RECIP_INFO, (st), (val)) +#define sk_PKCS7_RECIP_INFO_delete(st, i) SKM_sk_delete(PKCS7_RECIP_INFO, (st), (i)) +#define sk_PKCS7_RECIP_INFO_delete_ptr(st, ptr) SKM_sk_delete_ptr(PKCS7_RECIP_INFO, (st), (ptr)) +#define sk_PKCS7_RECIP_INFO_insert(st, val, i) SKM_sk_insert(PKCS7_RECIP_INFO, (st), (val), (i)) +#define sk_PKCS7_RECIP_INFO_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(PKCS7_RECIP_INFO, (st), (cmp)) +#define sk_PKCS7_RECIP_INFO_dup(st) SKM_sk_dup(PKCS7_RECIP_INFO, st) +#define sk_PKCS7_RECIP_INFO_pop_free(st, free_func) SKM_sk_pop_free(PKCS7_RECIP_INFO, (st), (free_func)) +#define sk_PKCS7_RECIP_INFO_shift(st) SKM_sk_shift(PKCS7_RECIP_INFO, (st)) +#define sk_PKCS7_RECIP_INFO_pop(st) SKM_sk_pop(PKCS7_RECIP_INFO, (st)) +#define sk_PKCS7_RECIP_INFO_sort(st) SKM_sk_sort(PKCS7_RECIP_INFO, (st)) +#define sk_PKCS7_RECIP_INFO_is_sorted(st) SKM_sk_is_sorted(PKCS7_RECIP_INFO, (st)) + +#define sk_PKCS7_SIGNER_INFO_new(cmp) SKM_sk_new(PKCS7_SIGNER_INFO, (cmp)) +#define sk_PKCS7_SIGNER_INFO_new_null() SKM_sk_new_null(PKCS7_SIGNER_INFO) +#define sk_PKCS7_SIGNER_INFO_free(st) SKM_sk_free(PKCS7_SIGNER_INFO, (st)) +#define sk_PKCS7_SIGNER_INFO_num(st) SKM_sk_num(PKCS7_SIGNER_INFO, (st)) +#define sk_PKCS7_SIGNER_INFO_value(st, i) SKM_sk_value(PKCS7_SIGNER_INFO, (st), (i)) +#define sk_PKCS7_SIGNER_INFO_set(st, i, val) SKM_sk_set(PKCS7_SIGNER_INFO, (st), (i), (val)) +#define sk_PKCS7_SIGNER_INFO_zero(st) SKM_sk_zero(PKCS7_SIGNER_INFO, (st)) +#define sk_PKCS7_SIGNER_INFO_push(st, val) SKM_sk_push(PKCS7_SIGNER_INFO, (st), (val)) +#define sk_PKCS7_SIGNER_INFO_unshift(st, val) SKM_sk_unshift(PKCS7_SIGNER_INFO, (st), (val)) +#define sk_PKCS7_SIGNER_INFO_find(st, val) SKM_sk_find(PKCS7_SIGNER_INFO, (st), (val)) +#define sk_PKCS7_SIGNER_INFO_delete(st, i) SKM_sk_delete(PKCS7_SIGNER_INFO, (st), (i)) +#define sk_PKCS7_SIGNER_INFO_delete_ptr(st, ptr) SKM_sk_delete_ptr(PKCS7_SIGNER_INFO, (st), (ptr)) +#define sk_PKCS7_SIGNER_INFO_insert(st, val, i) SKM_sk_insert(PKCS7_SIGNER_INFO, (st), (val), (i)) +#define sk_PKCS7_SIGNER_INFO_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(PKCS7_SIGNER_INFO, (st), (cmp)) +#define sk_PKCS7_SIGNER_INFO_dup(st) SKM_sk_dup(PKCS7_SIGNER_INFO, st) +#define sk_PKCS7_SIGNER_INFO_pop_free(st, free_func) SKM_sk_pop_free(PKCS7_SIGNER_INFO, (st), (free_func)) +#define sk_PKCS7_SIGNER_INFO_shift(st) SKM_sk_shift(PKCS7_SIGNER_INFO, (st)) +#define sk_PKCS7_SIGNER_INFO_pop(st) SKM_sk_pop(PKCS7_SIGNER_INFO, (st)) +#define sk_PKCS7_SIGNER_INFO_sort(st) SKM_sk_sort(PKCS7_SIGNER_INFO, (st)) +#define sk_PKCS7_SIGNER_INFO_is_sorted(st) SKM_sk_is_sorted(PKCS7_SIGNER_INFO, (st)) + +#define sk_POLICYINFO_new(cmp) SKM_sk_new(POLICYINFO, (cmp)) +#define sk_POLICYINFO_new_null() SKM_sk_new_null(POLICYINFO) +#define sk_POLICYINFO_free(st) SKM_sk_free(POLICYINFO, (st)) +#define sk_POLICYINFO_num(st) SKM_sk_num(POLICYINFO, (st)) +#define sk_POLICYINFO_value(st, i) SKM_sk_value(POLICYINFO, (st), (i)) +#define sk_POLICYINFO_set(st, i, val) SKM_sk_set(POLICYINFO, (st), (i), (val)) +#define sk_POLICYINFO_zero(st) SKM_sk_zero(POLICYINFO, (st)) +#define sk_POLICYINFO_push(st, val) SKM_sk_push(POLICYINFO, (st), (val)) +#define sk_POLICYINFO_unshift(st, val) SKM_sk_unshift(POLICYINFO, (st), (val)) +#define sk_POLICYINFO_find(st, val) SKM_sk_find(POLICYINFO, (st), (val)) +#define sk_POLICYINFO_delete(st, i) SKM_sk_delete(POLICYINFO, (st), (i)) +#define sk_POLICYINFO_delete_ptr(st, ptr) SKM_sk_delete_ptr(POLICYINFO, (st), (ptr)) +#define sk_POLICYINFO_insert(st, val, i) SKM_sk_insert(POLICYINFO, (st), (val), (i)) +#define sk_POLICYINFO_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(POLICYINFO, (st), (cmp)) +#define sk_POLICYINFO_dup(st) SKM_sk_dup(POLICYINFO, st) +#define sk_POLICYINFO_pop_free(st, free_func) SKM_sk_pop_free(POLICYINFO, (st), (free_func)) +#define sk_POLICYINFO_shift(st) SKM_sk_shift(POLICYINFO, (st)) +#define sk_POLICYINFO_pop(st) SKM_sk_pop(POLICYINFO, (st)) +#define sk_POLICYINFO_sort(st) SKM_sk_sort(POLICYINFO, (st)) +#define sk_POLICYINFO_is_sorted(st) SKM_sk_is_sorted(POLICYINFO, (st)) + +#define sk_POLICYQUALINFO_new(cmp) SKM_sk_new(POLICYQUALINFO, (cmp)) +#define sk_POLICYQUALINFO_new_null() SKM_sk_new_null(POLICYQUALINFO) +#define sk_POLICYQUALINFO_free(st) SKM_sk_free(POLICYQUALINFO, (st)) +#define sk_POLICYQUALINFO_num(st) SKM_sk_num(POLICYQUALINFO, (st)) +#define sk_POLICYQUALINFO_value(st, i) SKM_sk_value(POLICYQUALINFO, (st), (i)) +#define sk_POLICYQUALINFO_set(st, i, val) SKM_sk_set(POLICYQUALINFO, (st), (i), (val)) +#define sk_POLICYQUALINFO_zero(st) SKM_sk_zero(POLICYQUALINFO, (st)) +#define sk_POLICYQUALINFO_push(st, val) SKM_sk_push(POLICYQUALINFO, (st), (val)) +#define sk_POLICYQUALINFO_unshift(st, val) SKM_sk_unshift(POLICYQUALINFO, (st), (val)) +#define sk_POLICYQUALINFO_find(st, val) SKM_sk_find(POLICYQUALINFO, (st), (val)) +#define sk_POLICYQUALINFO_delete(st, i) SKM_sk_delete(POLICYQUALINFO, (st), (i)) +#define sk_POLICYQUALINFO_delete_ptr(st, ptr) SKM_sk_delete_ptr(POLICYQUALINFO, (st), (ptr)) +#define sk_POLICYQUALINFO_insert(st, val, i) SKM_sk_insert(POLICYQUALINFO, (st), (val), (i)) +#define sk_POLICYQUALINFO_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(POLICYQUALINFO, (st), (cmp)) +#define sk_POLICYQUALINFO_dup(st) SKM_sk_dup(POLICYQUALINFO, st) +#define sk_POLICYQUALINFO_pop_free(st, free_func) SKM_sk_pop_free(POLICYQUALINFO, (st), (free_func)) +#define sk_POLICYQUALINFO_shift(st) SKM_sk_shift(POLICYQUALINFO, (st)) +#define sk_POLICYQUALINFO_pop(st) SKM_sk_pop(POLICYQUALINFO, (st)) +#define sk_POLICYQUALINFO_sort(st) SKM_sk_sort(POLICYQUALINFO, (st)) +#define sk_POLICYQUALINFO_is_sorted(st) SKM_sk_is_sorted(POLICYQUALINFO, (st)) + +#define sk_POLICY_MAPPING_new(cmp) SKM_sk_new(POLICY_MAPPING, (cmp)) +#define sk_POLICY_MAPPING_new_null() SKM_sk_new_null(POLICY_MAPPING) +#define sk_POLICY_MAPPING_free(st) SKM_sk_free(POLICY_MAPPING, (st)) +#define sk_POLICY_MAPPING_num(st) SKM_sk_num(POLICY_MAPPING, (st)) +#define sk_POLICY_MAPPING_value(st, i) SKM_sk_value(POLICY_MAPPING, (st), (i)) +#define sk_POLICY_MAPPING_set(st, i, val) SKM_sk_set(POLICY_MAPPING, (st), (i), (val)) +#define sk_POLICY_MAPPING_zero(st) SKM_sk_zero(POLICY_MAPPING, (st)) +#define sk_POLICY_MAPPING_push(st, val) SKM_sk_push(POLICY_MAPPING, (st), (val)) +#define sk_POLICY_MAPPING_unshift(st, val) SKM_sk_unshift(POLICY_MAPPING, (st), (val)) +#define sk_POLICY_MAPPING_find(st, val) SKM_sk_find(POLICY_MAPPING, (st), (val)) +#define sk_POLICY_MAPPING_delete(st, i) SKM_sk_delete(POLICY_MAPPING, (st), (i)) +#define sk_POLICY_MAPPING_delete_ptr(st, ptr) SKM_sk_delete_ptr(POLICY_MAPPING, (st), (ptr)) +#define sk_POLICY_MAPPING_insert(st, val, i) SKM_sk_insert(POLICY_MAPPING, (st), (val), (i)) +#define sk_POLICY_MAPPING_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(POLICY_MAPPING, (st), (cmp)) +#define sk_POLICY_MAPPING_dup(st) SKM_sk_dup(POLICY_MAPPING, st) +#define sk_POLICY_MAPPING_pop_free(st, free_func) SKM_sk_pop_free(POLICY_MAPPING, (st), (free_func)) +#define sk_POLICY_MAPPING_shift(st) SKM_sk_shift(POLICY_MAPPING, (st)) +#define sk_POLICY_MAPPING_pop(st) SKM_sk_pop(POLICY_MAPPING, (st)) +#define sk_POLICY_MAPPING_sort(st) SKM_sk_sort(POLICY_MAPPING, (st)) +#define sk_POLICY_MAPPING_is_sorted(st) SKM_sk_is_sorted(POLICY_MAPPING, (st)) + +#define sk_SCT_new(cmp) SKM_sk_new(SCT, (cmp)) +#define sk_SCT_new_null() SKM_sk_new_null(SCT) +#define sk_SCT_free(st) SKM_sk_free(SCT, (st)) +#define sk_SCT_num(st) SKM_sk_num(SCT, (st)) +#define sk_SCT_value(st, i) SKM_sk_value(SCT, (st), (i)) +#define sk_SCT_set(st, i, val) SKM_sk_set(SCT, (st), (i), (val)) +#define sk_SCT_zero(st) SKM_sk_zero(SCT, (st)) +#define sk_SCT_push(st, val) SKM_sk_push(SCT, (st), (val)) +#define sk_SCT_unshift(st, val) SKM_sk_unshift(SCT, (st), (val)) +#define sk_SCT_find(st, val) SKM_sk_find(SCT, (st), (val)) +#define sk_SCT_delete(st, i) SKM_sk_delete(SCT, (st), (i)) +#define sk_SCT_delete_ptr(st, ptr) SKM_sk_delete_ptr(SCT, (st), (ptr)) +#define sk_SCT_insert(st, val, i) SKM_sk_insert(SCT, (st), (val), (i)) +#define sk_SCT_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(SCT, (st), (cmp)) +#define sk_SCT_dup(st) SKM_sk_dup(SCT, st) +#define sk_SCT_pop_free(st, free_func) SKM_sk_pop_free(SCT, (st), (free_func)) +#define sk_SCT_shift(st) SKM_sk_shift(SCT, (st)) +#define sk_SCT_pop(st) SKM_sk_pop(SCT, (st)) +#define sk_SCT_sort(st) SKM_sk_sort(SCT, (st)) +#define sk_SCT_is_sorted(st) SKM_sk_is_sorted(SCT, (st)) + +#define sk_SRTP_PROTECTION_PROFILE_new(cmp) SKM_sk_new(SRTP_PROTECTION_PROFILE, (cmp)) +#define sk_SRTP_PROTECTION_PROFILE_new_null() SKM_sk_new_null(SRTP_PROTECTION_PROFILE) +#define sk_SRTP_PROTECTION_PROFILE_free(st) SKM_sk_free(SRTP_PROTECTION_PROFILE, (st)) +#define sk_SRTP_PROTECTION_PROFILE_num(st) SKM_sk_num(SRTP_PROTECTION_PROFILE, (st)) +#define sk_SRTP_PROTECTION_PROFILE_value(st, i) SKM_sk_value(SRTP_PROTECTION_PROFILE, (st), (i)) +#define sk_SRTP_PROTECTION_PROFILE_set(st, i, val) SKM_sk_set(SRTP_PROTECTION_PROFILE, (st), (i), (val)) +#define sk_SRTP_PROTECTION_PROFILE_zero(st) SKM_sk_zero(SRTP_PROTECTION_PROFILE, (st)) +#define sk_SRTP_PROTECTION_PROFILE_push(st, val) SKM_sk_push(SRTP_PROTECTION_PROFILE, (st), (val)) +#define sk_SRTP_PROTECTION_PROFILE_unshift(st, val) SKM_sk_unshift(SRTP_PROTECTION_PROFILE, (st), (val)) +#define sk_SRTP_PROTECTION_PROFILE_find(st, val) SKM_sk_find(SRTP_PROTECTION_PROFILE, (st), (val)) +#define sk_SRTP_PROTECTION_PROFILE_delete(st, i) SKM_sk_delete(SRTP_PROTECTION_PROFILE, (st), (i)) +#define sk_SRTP_PROTECTION_PROFILE_delete_ptr(st, ptr) SKM_sk_delete_ptr(SRTP_PROTECTION_PROFILE, (st), (ptr)) +#define sk_SRTP_PROTECTION_PROFILE_insert(st, val, i) SKM_sk_insert(SRTP_PROTECTION_PROFILE, (st), (val), (i)) +#define sk_SRTP_PROTECTION_PROFILE_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(SRTP_PROTECTION_PROFILE, (st), (cmp)) +#define sk_SRTP_PROTECTION_PROFILE_dup(st) SKM_sk_dup(SRTP_PROTECTION_PROFILE, st) +#define sk_SRTP_PROTECTION_PROFILE_pop_free(st, free_func) SKM_sk_pop_free(SRTP_PROTECTION_PROFILE, (st), (free_func)) +#define sk_SRTP_PROTECTION_PROFILE_shift(st) SKM_sk_shift(SRTP_PROTECTION_PROFILE, (st)) +#define sk_SRTP_PROTECTION_PROFILE_pop(st) SKM_sk_pop(SRTP_PROTECTION_PROFILE, (st)) +#define sk_SRTP_PROTECTION_PROFILE_sort(st) SKM_sk_sort(SRTP_PROTECTION_PROFILE, (st)) +#define sk_SRTP_PROTECTION_PROFILE_is_sorted(st) SKM_sk_is_sorted(SRTP_PROTECTION_PROFILE, (st)) + +#define sk_SSL_CIPHER_new(cmp) SKM_sk_new(SSL_CIPHER, (cmp)) +#define sk_SSL_CIPHER_new_null() SKM_sk_new_null(SSL_CIPHER) +#define sk_SSL_CIPHER_free(st) SKM_sk_free(SSL_CIPHER, (st)) +#define sk_SSL_CIPHER_num(st) SKM_sk_num(SSL_CIPHER, (st)) +#define sk_SSL_CIPHER_value(st, i) SKM_sk_value(SSL_CIPHER, (st), (i)) +#define sk_SSL_CIPHER_set(st, i, val) SKM_sk_set(SSL_CIPHER, (st), (i), (val)) +#define sk_SSL_CIPHER_zero(st) SKM_sk_zero(SSL_CIPHER, (st)) +#define sk_SSL_CIPHER_push(st, val) SKM_sk_push(SSL_CIPHER, (st), (val)) +#define sk_SSL_CIPHER_unshift(st, val) SKM_sk_unshift(SSL_CIPHER, (st), (val)) +#define sk_SSL_CIPHER_find(st, val) SKM_sk_find(SSL_CIPHER, (st), (val)) +#define sk_SSL_CIPHER_delete(st, i) SKM_sk_delete(SSL_CIPHER, (st), (i)) +#define sk_SSL_CIPHER_delete_ptr(st, ptr) SKM_sk_delete_ptr(SSL_CIPHER, (st), (ptr)) +#define sk_SSL_CIPHER_insert(st, val, i) SKM_sk_insert(SSL_CIPHER, (st), (val), (i)) +#define sk_SSL_CIPHER_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(SSL_CIPHER, (st), (cmp)) +#define sk_SSL_CIPHER_dup(st) SKM_sk_dup(SSL_CIPHER, st) +#define sk_SSL_CIPHER_pop_free(st, free_func) SKM_sk_pop_free(SSL_CIPHER, (st), (free_func)) +#define sk_SSL_CIPHER_shift(st) SKM_sk_shift(SSL_CIPHER, (st)) +#define sk_SSL_CIPHER_pop(st) SKM_sk_pop(SSL_CIPHER, (st)) +#define sk_SSL_CIPHER_sort(st) SKM_sk_sort(SSL_CIPHER, (st)) +#define sk_SSL_CIPHER_is_sorted(st) SKM_sk_is_sorted(SSL_CIPHER, (st)) + +#define sk_SSL_COMP_new(cmp) SKM_sk_new(SSL_COMP, (cmp)) +#define sk_SSL_COMP_new_null() SKM_sk_new_null(SSL_COMP) +#define sk_SSL_COMP_free(st) SKM_sk_free(SSL_COMP, (st)) +#define sk_SSL_COMP_num(st) SKM_sk_num(SSL_COMP, (st)) +#define sk_SSL_COMP_value(st, i) SKM_sk_value(SSL_COMP, (st), (i)) +#define sk_SSL_COMP_set(st, i, val) SKM_sk_set(SSL_COMP, (st), (i), (val)) +#define sk_SSL_COMP_zero(st) SKM_sk_zero(SSL_COMP, (st)) +#define sk_SSL_COMP_push(st, val) SKM_sk_push(SSL_COMP, (st), (val)) +#define sk_SSL_COMP_unshift(st, val) SKM_sk_unshift(SSL_COMP, (st), (val)) +#define sk_SSL_COMP_find(st, val) SKM_sk_find(SSL_COMP, (st), (val)) +#define sk_SSL_COMP_delete(st, i) SKM_sk_delete(SSL_COMP, (st), (i)) +#define sk_SSL_COMP_delete_ptr(st, ptr) SKM_sk_delete_ptr(SSL_COMP, (st), (ptr)) +#define sk_SSL_COMP_insert(st, val, i) SKM_sk_insert(SSL_COMP, (st), (val), (i)) +#define sk_SSL_COMP_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(SSL_COMP, (st), (cmp)) +#define sk_SSL_COMP_dup(st) SKM_sk_dup(SSL_COMP, st) +#define sk_SSL_COMP_pop_free(st, free_func) SKM_sk_pop_free(SSL_COMP, (st), (free_func)) +#define sk_SSL_COMP_shift(st) SKM_sk_shift(SSL_COMP, (st)) +#define sk_SSL_COMP_pop(st) SKM_sk_pop(SSL_COMP, (st)) +#define sk_SSL_COMP_sort(st) SKM_sk_sort(SSL_COMP, (st)) +#define sk_SSL_COMP_is_sorted(st) SKM_sk_is_sorted(SSL_COMP, (st)) + +#define sk_STACK_OF_X509_NAME_ENTRY_new(cmp) SKM_sk_new(STACK_OF_X509_NAME_ENTRY, (cmp)) +#define sk_STACK_OF_X509_NAME_ENTRY_new_null() SKM_sk_new_null(STACK_OF_X509_NAME_ENTRY) +#define sk_STACK_OF_X509_NAME_ENTRY_free(st) SKM_sk_free(STACK_OF_X509_NAME_ENTRY, (st)) +#define sk_STACK_OF_X509_NAME_ENTRY_num(st) SKM_sk_num(STACK_OF_X509_NAME_ENTRY, (st)) +#define sk_STACK_OF_X509_NAME_ENTRY_value(st, i) SKM_sk_value(STACK_OF_X509_NAME_ENTRY, (st), (i)) +#define sk_STACK_OF_X509_NAME_ENTRY_set(st, i, val) SKM_sk_set(STACK_OF_X509_NAME_ENTRY, (st), (i), (val)) +#define sk_STACK_OF_X509_NAME_ENTRY_zero(st) SKM_sk_zero(STACK_OF_X509_NAME_ENTRY, (st)) +#define sk_STACK_OF_X509_NAME_ENTRY_push(st, val) SKM_sk_push(STACK_OF_X509_NAME_ENTRY, (st), (val)) +#define sk_STACK_OF_X509_NAME_ENTRY_unshift(st, val) SKM_sk_unshift(STACK_OF_X509_NAME_ENTRY, (st), (val)) +#define sk_STACK_OF_X509_NAME_ENTRY_find(st, val) SKM_sk_find(STACK_OF_X509_NAME_ENTRY, (st), (val)) +#define sk_STACK_OF_X509_NAME_ENTRY_delete(st, i) SKM_sk_delete(STACK_OF_X509_NAME_ENTRY, (st), (i)) +#define sk_STACK_OF_X509_NAME_ENTRY_delete_ptr(st, ptr) SKM_sk_delete_ptr(STACK_OF_X509_NAME_ENTRY, (st), (ptr)) +#define sk_STACK_OF_X509_NAME_ENTRY_insert(st, val, i) SKM_sk_insert(STACK_OF_X509_NAME_ENTRY, (st), (val), (i)) +#define sk_STACK_OF_X509_NAME_ENTRY_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(STACK_OF_X509_NAME_ENTRY, (st), (cmp)) +#define sk_STACK_OF_X509_NAME_ENTRY_dup(st) SKM_sk_dup(STACK_OF_X509_NAME_ENTRY, st) +#define sk_STACK_OF_X509_NAME_ENTRY_pop_free(st, free_func) SKM_sk_pop_free(STACK_OF_X509_NAME_ENTRY, (st), (free_func)) +#define sk_STACK_OF_X509_NAME_ENTRY_shift(st) SKM_sk_shift(STACK_OF_X509_NAME_ENTRY, (st)) +#define sk_STACK_OF_X509_NAME_ENTRY_pop(st) SKM_sk_pop(STACK_OF_X509_NAME_ENTRY, (st)) +#define sk_STACK_OF_X509_NAME_ENTRY_sort(st) SKM_sk_sort(STACK_OF_X509_NAME_ENTRY, (st)) +#define sk_STACK_OF_X509_NAME_ENTRY_is_sorted(st) SKM_sk_is_sorted(STACK_OF_X509_NAME_ENTRY, (st)) + +#define sk_STORE_ATTR_INFO_new(cmp) SKM_sk_new(STORE_ATTR_INFO, (cmp)) +#define sk_STORE_ATTR_INFO_new_null() SKM_sk_new_null(STORE_ATTR_INFO) +#define sk_STORE_ATTR_INFO_free(st) SKM_sk_free(STORE_ATTR_INFO, (st)) +#define sk_STORE_ATTR_INFO_num(st) SKM_sk_num(STORE_ATTR_INFO, (st)) +#define sk_STORE_ATTR_INFO_value(st, i) SKM_sk_value(STORE_ATTR_INFO, (st), (i)) +#define sk_STORE_ATTR_INFO_set(st, i, val) SKM_sk_set(STORE_ATTR_INFO, (st), (i), (val)) +#define sk_STORE_ATTR_INFO_zero(st) SKM_sk_zero(STORE_ATTR_INFO, (st)) +#define sk_STORE_ATTR_INFO_push(st, val) SKM_sk_push(STORE_ATTR_INFO, (st), (val)) +#define sk_STORE_ATTR_INFO_unshift(st, val) SKM_sk_unshift(STORE_ATTR_INFO, (st), (val)) +#define sk_STORE_ATTR_INFO_find(st, val) SKM_sk_find(STORE_ATTR_INFO, (st), (val)) +#define sk_STORE_ATTR_INFO_delete(st, i) SKM_sk_delete(STORE_ATTR_INFO, (st), (i)) +#define sk_STORE_ATTR_INFO_delete_ptr(st, ptr) SKM_sk_delete_ptr(STORE_ATTR_INFO, (st), (ptr)) +#define sk_STORE_ATTR_INFO_insert(st, val, i) SKM_sk_insert(STORE_ATTR_INFO, (st), (val), (i)) +#define sk_STORE_ATTR_INFO_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(STORE_ATTR_INFO, (st), (cmp)) +#define sk_STORE_ATTR_INFO_dup(st) SKM_sk_dup(STORE_ATTR_INFO, st) +#define sk_STORE_ATTR_INFO_pop_free(st, free_func) SKM_sk_pop_free(STORE_ATTR_INFO, (st), (free_func)) +#define sk_STORE_ATTR_INFO_shift(st) SKM_sk_shift(STORE_ATTR_INFO, (st)) +#define sk_STORE_ATTR_INFO_pop(st) SKM_sk_pop(STORE_ATTR_INFO, (st)) +#define sk_STORE_ATTR_INFO_sort(st) SKM_sk_sort(STORE_ATTR_INFO, (st)) +#define sk_STORE_ATTR_INFO_is_sorted(st) SKM_sk_is_sorted(STORE_ATTR_INFO, (st)) + +#define sk_STORE_OBJECT_new(cmp) SKM_sk_new(STORE_OBJECT, (cmp)) +#define sk_STORE_OBJECT_new_null() SKM_sk_new_null(STORE_OBJECT) +#define sk_STORE_OBJECT_free(st) SKM_sk_free(STORE_OBJECT, (st)) +#define sk_STORE_OBJECT_num(st) SKM_sk_num(STORE_OBJECT, (st)) +#define sk_STORE_OBJECT_value(st, i) SKM_sk_value(STORE_OBJECT, (st), (i)) +#define sk_STORE_OBJECT_set(st, i, val) SKM_sk_set(STORE_OBJECT, (st), (i), (val)) +#define sk_STORE_OBJECT_zero(st) SKM_sk_zero(STORE_OBJECT, (st)) +#define sk_STORE_OBJECT_push(st, val) SKM_sk_push(STORE_OBJECT, (st), (val)) +#define sk_STORE_OBJECT_unshift(st, val) SKM_sk_unshift(STORE_OBJECT, (st), (val)) +#define sk_STORE_OBJECT_find(st, val) SKM_sk_find(STORE_OBJECT, (st), (val)) +#define sk_STORE_OBJECT_delete(st, i) SKM_sk_delete(STORE_OBJECT, (st), (i)) +#define sk_STORE_OBJECT_delete_ptr(st, ptr) SKM_sk_delete_ptr(STORE_OBJECT, (st), (ptr)) +#define sk_STORE_OBJECT_insert(st, val, i) SKM_sk_insert(STORE_OBJECT, (st), (val), (i)) +#define sk_STORE_OBJECT_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(STORE_OBJECT, (st), (cmp)) +#define sk_STORE_OBJECT_dup(st) SKM_sk_dup(STORE_OBJECT, st) +#define sk_STORE_OBJECT_pop_free(st, free_func) SKM_sk_pop_free(STORE_OBJECT, (st), (free_func)) +#define sk_STORE_OBJECT_shift(st) SKM_sk_shift(STORE_OBJECT, (st)) +#define sk_STORE_OBJECT_pop(st) SKM_sk_pop(STORE_OBJECT, (st)) +#define sk_STORE_OBJECT_sort(st) SKM_sk_sort(STORE_OBJECT, (st)) +#define sk_STORE_OBJECT_is_sorted(st) SKM_sk_is_sorted(STORE_OBJECT, (st)) + +#define sk_UI_STRING_new(cmp) SKM_sk_new(UI_STRING, (cmp)) +#define sk_UI_STRING_new_null() SKM_sk_new_null(UI_STRING) +#define sk_UI_STRING_free(st) SKM_sk_free(UI_STRING, (st)) +#define sk_UI_STRING_num(st) SKM_sk_num(UI_STRING, (st)) +#define sk_UI_STRING_value(st, i) SKM_sk_value(UI_STRING, (st), (i)) +#define sk_UI_STRING_set(st, i, val) SKM_sk_set(UI_STRING, (st), (i), (val)) +#define sk_UI_STRING_zero(st) SKM_sk_zero(UI_STRING, (st)) +#define sk_UI_STRING_push(st, val) SKM_sk_push(UI_STRING, (st), (val)) +#define sk_UI_STRING_unshift(st, val) SKM_sk_unshift(UI_STRING, (st), (val)) +#define sk_UI_STRING_find(st, val) SKM_sk_find(UI_STRING, (st), (val)) +#define sk_UI_STRING_delete(st, i) SKM_sk_delete(UI_STRING, (st), (i)) +#define sk_UI_STRING_delete_ptr(st, ptr) SKM_sk_delete_ptr(UI_STRING, (st), (ptr)) +#define sk_UI_STRING_insert(st, val, i) SKM_sk_insert(UI_STRING, (st), (val), (i)) +#define sk_UI_STRING_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(UI_STRING, (st), (cmp)) +#define sk_UI_STRING_dup(st) SKM_sk_dup(UI_STRING, st) +#define sk_UI_STRING_pop_free(st, free_func) SKM_sk_pop_free(UI_STRING, (st), (free_func)) +#define sk_UI_STRING_shift(st) SKM_sk_shift(UI_STRING, (st)) +#define sk_UI_STRING_pop(st) SKM_sk_pop(UI_STRING, (st)) +#define sk_UI_STRING_sort(st) SKM_sk_sort(UI_STRING, (st)) +#define sk_UI_STRING_is_sorted(st) SKM_sk_is_sorted(UI_STRING, (st)) + +#define sk_X509_new(cmp) SKM_sk_new(X509, (cmp)) +#define sk_X509_new_null() SKM_sk_new_null(X509) +#define sk_X509_free(st) SKM_sk_free(X509, (st)) +#define sk_X509_num(st) SKM_sk_num(X509, (st)) +#define sk_X509_value(st, i) SKM_sk_value(X509, (st), (i)) +#define sk_X509_set(st, i, val) SKM_sk_set(X509, (st), (i), (val)) +#define sk_X509_zero(st) SKM_sk_zero(X509, (st)) +#define sk_X509_push(st, val) SKM_sk_push(X509, (st), (val)) +#define sk_X509_unshift(st, val) SKM_sk_unshift(X509, (st), (val)) +#define sk_X509_find(st, val) SKM_sk_find(X509, (st), (val)) +#define sk_X509_delete(st, i) SKM_sk_delete(X509, (st), (i)) +#define sk_X509_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509, (st), (ptr)) +#define sk_X509_insert(st, val, i) SKM_sk_insert(X509, (st), (val), (i)) +#define sk_X509_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509, (st), (cmp)) +#define sk_X509_dup(st) SKM_sk_dup(X509, st) +#define sk_X509_pop_free(st, free_func) SKM_sk_pop_free(X509, (st), (free_func)) +#define sk_X509_shift(st) SKM_sk_shift(X509, (st)) +#define sk_X509_pop(st) SKM_sk_pop(X509, (st)) +#define sk_X509_sort(st) SKM_sk_sort(X509, (st)) +#define sk_X509_is_sorted(st) SKM_sk_is_sorted(X509, (st)) + +#define sk_X509V3_EXT_METHOD_new(cmp) SKM_sk_new(X509V3_EXT_METHOD, (cmp)) +#define sk_X509V3_EXT_METHOD_new_null() SKM_sk_new_null(X509V3_EXT_METHOD) +#define sk_X509V3_EXT_METHOD_free(st) SKM_sk_free(X509V3_EXT_METHOD, (st)) +#define sk_X509V3_EXT_METHOD_num(st) SKM_sk_num(X509V3_EXT_METHOD, (st)) +#define sk_X509V3_EXT_METHOD_value(st, i) SKM_sk_value(X509V3_EXT_METHOD, (st), (i)) +#define sk_X509V3_EXT_METHOD_set(st, i, val) SKM_sk_set(X509V3_EXT_METHOD, (st), (i), (val)) +#define sk_X509V3_EXT_METHOD_zero(st) SKM_sk_zero(X509V3_EXT_METHOD, (st)) +#define sk_X509V3_EXT_METHOD_push(st, val) SKM_sk_push(X509V3_EXT_METHOD, (st), (val)) +#define sk_X509V3_EXT_METHOD_unshift(st, val) SKM_sk_unshift(X509V3_EXT_METHOD, (st), (val)) +#define sk_X509V3_EXT_METHOD_find(st, val) SKM_sk_find(X509V3_EXT_METHOD, (st), (val)) +#define sk_X509V3_EXT_METHOD_delete(st, i) SKM_sk_delete(X509V3_EXT_METHOD, (st), (i)) +#define sk_X509V3_EXT_METHOD_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509V3_EXT_METHOD, (st), (ptr)) +#define sk_X509V3_EXT_METHOD_insert(st, val, i) SKM_sk_insert(X509V3_EXT_METHOD, (st), (val), (i)) +#define sk_X509V3_EXT_METHOD_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509V3_EXT_METHOD, (st), (cmp)) +#define sk_X509V3_EXT_METHOD_dup(st) SKM_sk_dup(X509V3_EXT_METHOD, st) +#define sk_X509V3_EXT_METHOD_pop_free(st, free_func) SKM_sk_pop_free(X509V3_EXT_METHOD, (st), (free_func)) +#define sk_X509V3_EXT_METHOD_shift(st) SKM_sk_shift(X509V3_EXT_METHOD, (st)) +#define sk_X509V3_EXT_METHOD_pop(st) SKM_sk_pop(X509V3_EXT_METHOD, (st)) +#define sk_X509V3_EXT_METHOD_sort(st) SKM_sk_sort(X509V3_EXT_METHOD, (st)) +#define sk_X509V3_EXT_METHOD_is_sorted(st) SKM_sk_is_sorted(X509V3_EXT_METHOD, (st)) + +#define sk_X509_ALGOR_new(cmp) SKM_sk_new(X509_ALGOR, (cmp)) +#define sk_X509_ALGOR_new_null() SKM_sk_new_null(X509_ALGOR) +#define sk_X509_ALGOR_free(st) SKM_sk_free(X509_ALGOR, (st)) +#define sk_X509_ALGOR_num(st) SKM_sk_num(X509_ALGOR, (st)) +#define sk_X509_ALGOR_value(st, i) SKM_sk_value(X509_ALGOR, (st), (i)) +#define sk_X509_ALGOR_set(st, i, val) SKM_sk_set(X509_ALGOR, (st), (i), (val)) +#define sk_X509_ALGOR_zero(st) SKM_sk_zero(X509_ALGOR, (st)) +#define sk_X509_ALGOR_push(st, val) SKM_sk_push(X509_ALGOR, (st), (val)) +#define sk_X509_ALGOR_unshift(st, val) SKM_sk_unshift(X509_ALGOR, (st), (val)) +#define sk_X509_ALGOR_find(st, val) SKM_sk_find(X509_ALGOR, (st), (val)) +#define sk_X509_ALGOR_delete(st, i) SKM_sk_delete(X509_ALGOR, (st), (i)) +#define sk_X509_ALGOR_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_ALGOR, (st), (ptr)) +#define sk_X509_ALGOR_insert(st, val, i) SKM_sk_insert(X509_ALGOR, (st), (val), (i)) +#define sk_X509_ALGOR_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_ALGOR, (st), (cmp)) +#define sk_X509_ALGOR_dup(st) SKM_sk_dup(X509_ALGOR, st) +#define sk_X509_ALGOR_pop_free(st, free_func) SKM_sk_pop_free(X509_ALGOR, (st), (free_func)) +#define sk_X509_ALGOR_shift(st) SKM_sk_shift(X509_ALGOR, (st)) +#define sk_X509_ALGOR_pop(st) SKM_sk_pop(X509_ALGOR, (st)) +#define sk_X509_ALGOR_sort(st) SKM_sk_sort(X509_ALGOR, (st)) +#define sk_X509_ALGOR_is_sorted(st) SKM_sk_is_sorted(X509_ALGOR, (st)) + +#define sk_X509_ATTRIBUTE_new(cmp) SKM_sk_new(X509_ATTRIBUTE, (cmp)) +#define sk_X509_ATTRIBUTE_new_null() SKM_sk_new_null(X509_ATTRIBUTE) +#define sk_X509_ATTRIBUTE_free(st) SKM_sk_free(X509_ATTRIBUTE, (st)) +#define sk_X509_ATTRIBUTE_num(st) SKM_sk_num(X509_ATTRIBUTE, (st)) +#define sk_X509_ATTRIBUTE_value(st, i) SKM_sk_value(X509_ATTRIBUTE, (st), (i)) +#define sk_X509_ATTRIBUTE_set(st, i, val) SKM_sk_set(X509_ATTRIBUTE, (st), (i), (val)) +#define sk_X509_ATTRIBUTE_zero(st) SKM_sk_zero(X509_ATTRIBUTE, (st)) +#define sk_X509_ATTRIBUTE_push(st, val) SKM_sk_push(X509_ATTRIBUTE, (st), (val)) +#define sk_X509_ATTRIBUTE_unshift(st, val) SKM_sk_unshift(X509_ATTRIBUTE, (st), (val)) +#define sk_X509_ATTRIBUTE_find(st, val) SKM_sk_find(X509_ATTRIBUTE, (st), (val)) +#define sk_X509_ATTRIBUTE_delete(st, i) SKM_sk_delete(X509_ATTRIBUTE, (st), (i)) +#define sk_X509_ATTRIBUTE_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_ATTRIBUTE, (st), (ptr)) +#define sk_X509_ATTRIBUTE_insert(st, val, i) SKM_sk_insert(X509_ATTRIBUTE, (st), (val), (i)) +#define sk_X509_ATTRIBUTE_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_ATTRIBUTE, (st), (cmp)) +#define sk_X509_ATTRIBUTE_dup(st) SKM_sk_dup(X509_ATTRIBUTE, st) +#define sk_X509_ATTRIBUTE_pop_free(st, free_func) SKM_sk_pop_free(X509_ATTRIBUTE, (st), (free_func)) +#define sk_X509_ATTRIBUTE_shift(st) SKM_sk_shift(X509_ATTRIBUTE, (st)) +#define sk_X509_ATTRIBUTE_pop(st) SKM_sk_pop(X509_ATTRIBUTE, (st)) +#define sk_X509_ATTRIBUTE_sort(st) SKM_sk_sort(X509_ATTRIBUTE, (st)) +#define sk_X509_ATTRIBUTE_is_sorted(st) SKM_sk_is_sorted(X509_ATTRIBUTE, (st)) + +#define sk_X509_CRL_new(cmp) SKM_sk_new(X509_CRL, (cmp)) +#define sk_X509_CRL_new_null() SKM_sk_new_null(X509_CRL) +#define sk_X509_CRL_free(st) SKM_sk_free(X509_CRL, (st)) +#define sk_X509_CRL_num(st) SKM_sk_num(X509_CRL, (st)) +#define sk_X509_CRL_value(st, i) SKM_sk_value(X509_CRL, (st), (i)) +#define sk_X509_CRL_set(st, i, val) SKM_sk_set(X509_CRL, (st), (i), (val)) +#define sk_X509_CRL_zero(st) SKM_sk_zero(X509_CRL, (st)) +#define sk_X509_CRL_push(st, val) SKM_sk_push(X509_CRL, (st), (val)) +#define sk_X509_CRL_unshift(st, val) SKM_sk_unshift(X509_CRL, (st), (val)) +#define sk_X509_CRL_find(st, val) SKM_sk_find(X509_CRL, (st), (val)) +#define sk_X509_CRL_delete(st, i) SKM_sk_delete(X509_CRL, (st), (i)) +#define sk_X509_CRL_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_CRL, (st), (ptr)) +#define sk_X509_CRL_insert(st, val, i) SKM_sk_insert(X509_CRL, (st), (val), (i)) +#define sk_X509_CRL_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_CRL, (st), (cmp)) +#define sk_X509_CRL_dup(st) SKM_sk_dup(X509_CRL, st) +#define sk_X509_CRL_pop_free(st, free_func) SKM_sk_pop_free(X509_CRL, (st), (free_func)) +#define sk_X509_CRL_shift(st) SKM_sk_shift(X509_CRL, (st)) +#define sk_X509_CRL_pop(st) SKM_sk_pop(X509_CRL, (st)) +#define sk_X509_CRL_sort(st) SKM_sk_sort(X509_CRL, (st)) +#define sk_X509_CRL_is_sorted(st) SKM_sk_is_sorted(X509_CRL, (st)) + +#define sk_X509_EXTENSION_new(cmp) SKM_sk_new(X509_EXTENSION, (cmp)) +#define sk_X509_EXTENSION_new_null() SKM_sk_new_null(X509_EXTENSION) +#define sk_X509_EXTENSION_free(st) SKM_sk_free(X509_EXTENSION, (st)) +#define sk_X509_EXTENSION_num(st) SKM_sk_num(X509_EXTENSION, (st)) +#define sk_X509_EXTENSION_value(st, i) SKM_sk_value(X509_EXTENSION, (st), (i)) +#define sk_X509_EXTENSION_set(st, i, val) SKM_sk_set(X509_EXTENSION, (st), (i), (val)) +#define sk_X509_EXTENSION_zero(st) SKM_sk_zero(X509_EXTENSION, (st)) +#define sk_X509_EXTENSION_push(st, val) SKM_sk_push(X509_EXTENSION, (st), (val)) +#define sk_X509_EXTENSION_unshift(st, val) SKM_sk_unshift(X509_EXTENSION, (st), (val)) +#define sk_X509_EXTENSION_find(st, val) SKM_sk_find(X509_EXTENSION, (st), (val)) +#define sk_X509_EXTENSION_delete(st, i) SKM_sk_delete(X509_EXTENSION, (st), (i)) +#define sk_X509_EXTENSION_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_EXTENSION, (st), (ptr)) +#define sk_X509_EXTENSION_insert(st, val, i) SKM_sk_insert(X509_EXTENSION, (st), (val), (i)) +#define sk_X509_EXTENSION_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_EXTENSION, (st), (cmp)) +#define sk_X509_EXTENSION_dup(st) SKM_sk_dup(X509_EXTENSION, st) +#define sk_X509_EXTENSION_pop_free(st, free_func) SKM_sk_pop_free(X509_EXTENSION, (st), (free_func)) +#define sk_X509_EXTENSION_shift(st) SKM_sk_shift(X509_EXTENSION, (st)) +#define sk_X509_EXTENSION_pop(st) SKM_sk_pop(X509_EXTENSION, (st)) +#define sk_X509_EXTENSION_sort(st) SKM_sk_sort(X509_EXTENSION, (st)) +#define sk_X509_EXTENSION_is_sorted(st) SKM_sk_is_sorted(X509_EXTENSION, (st)) + +#define sk_X509_INFO_new(cmp) SKM_sk_new(X509_INFO, (cmp)) +#define sk_X509_INFO_new_null() SKM_sk_new_null(X509_INFO) +#define sk_X509_INFO_free(st) SKM_sk_free(X509_INFO, (st)) +#define sk_X509_INFO_num(st) SKM_sk_num(X509_INFO, (st)) +#define sk_X509_INFO_value(st, i) SKM_sk_value(X509_INFO, (st), (i)) +#define sk_X509_INFO_set(st, i, val) SKM_sk_set(X509_INFO, (st), (i), (val)) +#define sk_X509_INFO_zero(st) SKM_sk_zero(X509_INFO, (st)) +#define sk_X509_INFO_push(st, val) SKM_sk_push(X509_INFO, (st), (val)) +#define sk_X509_INFO_unshift(st, val) SKM_sk_unshift(X509_INFO, (st), (val)) +#define sk_X509_INFO_find(st, val) SKM_sk_find(X509_INFO, (st), (val)) +#define sk_X509_INFO_delete(st, i) SKM_sk_delete(X509_INFO, (st), (i)) +#define sk_X509_INFO_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_INFO, (st), (ptr)) +#define sk_X509_INFO_insert(st, val, i) SKM_sk_insert(X509_INFO, (st), (val), (i)) +#define sk_X509_INFO_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_INFO, (st), (cmp)) +#define sk_X509_INFO_dup(st) SKM_sk_dup(X509_INFO, st) +#define sk_X509_INFO_pop_free(st, free_func) SKM_sk_pop_free(X509_INFO, (st), (free_func)) +#define sk_X509_INFO_shift(st) SKM_sk_shift(X509_INFO, (st)) +#define sk_X509_INFO_pop(st) SKM_sk_pop(X509_INFO, (st)) +#define sk_X509_INFO_sort(st) SKM_sk_sort(X509_INFO, (st)) +#define sk_X509_INFO_is_sorted(st) SKM_sk_is_sorted(X509_INFO, (st)) + +#define sk_X509_LOOKUP_new(cmp) SKM_sk_new(X509_LOOKUP, (cmp)) +#define sk_X509_LOOKUP_new_null() SKM_sk_new_null(X509_LOOKUP) +#define sk_X509_LOOKUP_free(st) SKM_sk_free(X509_LOOKUP, (st)) +#define sk_X509_LOOKUP_num(st) SKM_sk_num(X509_LOOKUP, (st)) +#define sk_X509_LOOKUP_value(st, i) SKM_sk_value(X509_LOOKUP, (st), (i)) +#define sk_X509_LOOKUP_set(st, i, val) SKM_sk_set(X509_LOOKUP, (st), (i), (val)) +#define sk_X509_LOOKUP_zero(st) SKM_sk_zero(X509_LOOKUP, (st)) +#define sk_X509_LOOKUP_push(st, val) SKM_sk_push(X509_LOOKUP, (st), (val)) +#define sk_X509_LOOKUP_unshift(st, val) SKM_sk_unshift(X509_LOOKUP, (st), (val)) +#define sk_X509_LOOKUP_find(st, val) SKM_sk_find(X509_LOOKUP, (st), (val)) +#define sk_X509_LOOKUP_delete(st, i) SKM_sk_delete(X509_LOOKUP, (st), (i)) +#define sk_X509_LOOKUP_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_LOOKUP, (st), (ptr)) +#define sk_X509_LOOKUP_insert(st, val, i) SKM_sk_insert(X509_LOOKUP, (st), (val), (i)) +#define sk_X509_LOOKUP_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_LOOKUP, (st), (cmp)) +#define sk_X509_LOOKUP_dup(st) SKM_sk_dup(X509_LOOKUP, st) +#define sk_X509_LOOKUP_pop_free(st, free_func) SKM_sk_pop_free(X509_LOOKUP, (st), (free_func)) +#define sk_X509_LOOKUP_shift(st) SKM_sk_shift(X509_LOOKUP, (st)) +#define sk_X509_LOOKUP_pop(st) SKM_sk_pop(X509_LOOKUP, (st)) +#define sk_X509_LOOKUP_sort(st) SKM_sk_sort(X509_LOOKUP, (st)) +#define sk_X509_LOOKUP_is_sorted(st) SKM_sk_is_sorted(X509_LOOKUP, (st)) + +#define sk_X509_NAME_new(cmp) SKM_sk_new(X509_NAME, (cmp)) +#define sk_X509_NAME_new_null() SKM_sk_new_null(X509_NAME) +#define sk_X509_NAME_free(st) SKM_sk_free(X509_NAME, (st)) +#define sk_X509_NAME_num(st) SKM_sk_num(X509_NAME, (st)) +#define sk_X509_NAME_value(st, i) SKM_sk_value(X509_NAME, (st), (i)) +#define sk_X509_NAME_set(st, i, val) SKM_sk_set(X509_NAME, (st), (i), (val)) +#define sk_X509_NAME_zero(st) SKM_sk_zero(X509_NAME, (st)) +#define sk_X509_NAME_push(st, val) SKM_sk_push(X509_NAME, (st), (val)) +#define sk_X509_NAME_unshift(st, val) SKM_sk_unshift(X509_NAME, (st), (val)) +#define sk_X509_NAME_find(st, val) SKM_sk_find(X509_NAME, (st), (val)) +#define sk_X509_NAME_delete(st, i) SKM_sk_delete(X509_NAME, (st), (i)) +#define sk_X509_NAME_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_NAME, (st), (ptr)) +#define sk_X509_NAME_insert(st, val, i) SKM_sk_insert(X509_NAME, (st), (val), (i)) +#define sk_X509_NAME_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_NAME, (st), (cmp)) +#define sk_X509_NAME_dup(st) SKM_sk_dup(X509_NAME, st) +#define sk_X509_NAME_pop_free(st, free_func) SKM_sk_pop_free(X509_NAME, (st), (free_func)) +#define sk_X509_NAME_shift(st) SKM_sk_shift(X509_NAME, (st)) +#define sk_X509_NAME_pop(st) SKM_sk_pop(X509_NAME, (st)) +#define sk_X509_NAME_sort(st) SKM_sk_sort(X509_NAME, (st)) +#define sk_X509_NAME_is_sorted(st) SKM_sk_is_sorted(X509_NAME, (st)) + +#define sk_X509_NAME_ENTRY_new(cmp) SKM_sk_new(X509_NAME_ENTRY, (cmp)) +#define sk_X509_NAME_ENTRY_new_null() SKM_sk_new_null(X509_NAME_ENTRY) +#define sk_X509_NAME_ENTRY_free(st) SKM_sk_free(X509_NAME_ENTRY, (st)) +#define sk_X509_NAME_ENTRY_num(st) SKM_sk_num(X509_NAME_ENTRY, (st)) +#define sk_X509_NAME_ENTRY_value(st, i) SKM_sk_value(X509_NAME_ENTRY, (st), (i)) +#define sk_X509_NAME_ENTRY_set(st, i, val) SKM_sk_set(X509_NAME_ENTRY, (st), (i), (val)) +#define sk_X509_NAME_ENTRY_zero(st) SKM_sk_zero(X509_NAME_ENTRY, (st)) +#define sk_X509_NAME_ENTRY_push(st, val) SKM_sk_push(X509_NAME_ENTRY, (st), (val)) +#define sk_X509_NAME_ENTRY_unshift(st, val) SKM_sk_unshift(X509_NAME_ENTRY, (st), (val)) +#define sk_X509_NAME_ENTRY_find(st, val) SKM_sk_find(X509_NAME_ENTRY, (st), (val)) +#define sk_X509_NAME_ENTRY_delete(st, i) SKM_sk_delete(X509_NAME_ENTRY, (st), (i)) +#define sk_X509_NAME_ENTRY_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_NAME_ENTRY, (st), (ptr)) +#define sk_X509_NAME_ENTRY_insert(st, val, i) SKM_sk_insert(X509_NAME_ENTRY, (st), (val), (i)) +#define sk_X509_NAME_ENTRY_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_NAME_ENTRY, (st), (cmp)) +#define sk_X509_NAME_ENTRY_dup(st) SKM_sk_dup(X509_NAME_ENTRY, st) +#define sk_X509_NAME_ENTRY_pop_free(st, free_func) SKM_sk_pop_free(X509_NAME_ENTRY, (st), (free_func)) +#define sk_X509_NAME_ENTRY_shift(st) SKM_sk_shift(X509_NAME_ENTRY, (st)) +#define sk_X509_NAME_ENTRY_pop(st) SKM_sk_pop(X509_NAME_ENTRY, (st)) +#define sk_X509_NAME_ENTRY_sort(st) SKM_sk_sort(X509_NAME_ENTRY, (st)) +#define sk_X509_NAME_ENTRY_is_sorted(st) SKM_sk_is_sorted(X509_NAME_ENTRY, (st)) + +#define sk_X509_OBJECT_new(cmp) SKM_sk_new(X509_OBJECT, (cmp)) +#define sk_X509_OBJECT_new_null() SKM_sk_new_null(X509_OBJECT) +#define sk_X509_OBJECT_free(st) SKM_sk_free(X509_OBJECT, (st)) +#define sk_X509_OBJECT_num(st) SKM_sk_num(X509_OBJECT, (st)) +#define sk_X509_OBJECT_value(st, i) SKM_sk_value(X509_OBJECT, (st), (i)) +#define sk_X509_OBJECT_set(st, i, val) SKM_sk_set(X509_OBJECT, (st), (i), (val)) +#define sk_X509_OBJECT_zero(st) SKM_sk_zero(X509_OBJECT, (st)) +#define sk_X509_OBJECT_push(st, val) SKM_sk_push(X509_OBJECT, (st), (val)) +#define sk_X509_OBJECT_unshift(st, val) SKM_sk_unshift(X509_OBJECT, (st), (val)) +#define sk_X509_OBJECT_find(st, val) SKM_sk_find(X509_OBJECT, (st), (val)) +#define sk_X509_OBJECT_delete(st, i) SKM_sk_delete(X509_OBJECT, (st), (i)) +#define sk_X509_OBJECT_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_OBJECT, (st), (ptr)) +#define sk_X509_OBJECT_insert(st, val, i) SKM_sk_insert(X509_OBJECT, (st), (val), (i)) +#define sk_X509_OBJECT_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_OBJECT, (st), (cmp)) +#define sk_X509_OBJECT_dup(st) SKM_sk_dup(X509_OBJECT, st) +#define sk_X509_OBJECT_pop_free(st, free_func) SKM_sk_pop_free(X509_OBJECT, (st), (free_func)) +#define sk_X509_OBJECT_shift(st) SKM_sk_shift(X509_OBJECT, (st)) +#define sk_X509_OBJECT_pop(st) SKM_sk_pop(X509_OBJECT, (st)) +#define sk_X509_OBJECT_sort(st) SKM_sk_sort(X509_OBJECT, (st)) +#define sk_X509_OBJECT_is_sorted(st) SKM_sk_is_sorted(X509_OBJECT, (st)) + +#define sk_X509_REVOKED_new(cmp) SKM_sk_new(X509_REVOKED, (cmp)) +#define sk_X509_REVOKED_new_null() SKM_sk_new_null(X509_REVOKED) +#define sk_X509_REVOKED_free(st) SKM_sk_free(X509_REVOKED, (st)) +#define sk_X509_REVOKED_num(st) SKM_sk_num(X509_REVOKED, (st)) +#define sk_X509_REVOKED_value(st, i) SKM_sk_value(X509_REVOKED, (st), (i)) +#define sk_X509_REVOKED_set(st, i, val) SKM_sk_set(X509_REVOKED, (st), (i), (val)) +#define sk_X509_REVOKED_zero(st) SKM_sk_zero(X509_REVOKED, (st)) +#define sk_X509_REVOKED_push(st, val) SKM_sk_push(X509_REVOKED, (st), (val)) +#define sk_X509_REVOKED_unshift(st, val) SKM_sk_unshift(X509_REVOKED, (st), (val)) +#define sk_X509_REVOKED_find(st, val) SKM_sk_find(X509_REVOKED, (st), (val)) +#define sk_X509_REVOKED_delete(st, i) SKM_sk_delete(X509_REVOKED, (st), (i)) +#define sk_X509_REVOKED_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_REVOKED, (st), (ptr)) +#define sk_X509_REVOKED_insert(st, val, i) SKM_sk_insert(X509_REVOKED, (st), (val), (i)) +#define sk_X509_REVOKED_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_REVOKED, (st), (cmp)) +#define sk_X509_REVOKED_dup(st) SKM_sk_dup(X509_REVOKED, st) +#define sk_X509_REVOKED_pop_free(st, free_func) SKM_sk_pop_free(X509_REVOKED, (st), (free_func)) +#define sk_X509_REVOKED_shift(st) SKM_sk_shift(X509_REVOKED, (st)) +#define sk_X509_REVOKED_pop(st) SKM_sk_pop(X509_REVOKED, (st)) +#define sk_X509_REVOKED_sort(st) SKM_sk_sort(X509_REVOKED, (st)) +#define sk_X509_REVOKED_is_sorted(st) SKM_sk_is_sorted(X509_REVOKED, (st)) + +#define sk_X509_VERIFY_PARAM_new(cmp) SKM_sk_new(X509_VERIFY_PARAM, (cmp)) +#define sk_X509_VERIFY_PARAM_new_null() SKM_sk_new_null(X509_VERIFY_PARAM) +#define sk_X509_VERIFY_PARAM_free(st) SKM_sk_free(X509_VERIFY_PARAM, (st)) +#define sk_X509_VERIFY_PARAM_num(st) SKM_sk_num(X509_VERIFY_PARAM, (st)) +#define sk_X509_VERIFY_PARAM_value(st, i) SKM_sk_value(X509_VERIFY_PARAM, (st), (i)) +#define sk_X509_VERIFY_PARAM_set(st, i, val) SKM_sk_set(X509_VERIFY_PARAM, (st), (i), (val)) +#define sk_X509_VERIFY_PARAM_zero(st) SKM_sk_zero(X509_VERIFY_PARAM, (st)) +#define sk_X509_VERIFY_PARAM_push(st, val) SKM_sk_push(X509_VERIFY_PARAM, (st), (val)) +#define sk_X509_VERIFY_PARAM_unshift(st, val) SKM_sk_unshift(X509_VERIFY_PARAM, (st), (val)) +#define sk_X509_VERIFY_PARAM_find(st, val) SKM_sk_find(X509_VERIFY_PARAM, (st), (val)) +#define sk_X509_VERIFY_PARAM_delete(st, i) SKM_sk_delete(X509_VERIFY_PARAM, (st), (i)) +#define sk_X509_VERIFY_PARAM_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_VERIFY_PARAM, (st), (ptr)) +#define sk_X509_VERIFY_PARAM_insert(st, val, i) SKM_sk_insert(X509_VERIFY_PARAM, (st), (val), (i)) +#define sk_X509_VERIFY_PARAM_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_VERIFY_PARAM, (st), (cmp)) +#define sk_X509_VERIFY_PARAM_dup(st) SKM_sk_dup(X509_VERIFY_PARAM, st) +#define sk_X509_VERIFY_PARAM_pop_free(st, free_func) SKM_sk_pop_free(X509_VERIFY_PARAM, (st), (free_func)) +#define sk_X509_VERIFY_PARAM_shift(st) SKM_sk_shift(X509_VERIFY_PARAM, (st)) +#define sk_X509_VERIFY_PARAM_pop(st) SKM_sk_pop(X509_VERIFY_PARAM, (st)) +#define sk_X509_VERIFY_PARAM_sort(st) SKM_sk_sort(X509_VERIFY_PARAM, (st)) +#define sk_X509_VERIFY_PARAM_is_sorted(st) SKM_sk_is_sorted(X509_VERIFY_PARAM, (st)) + +#define sk_void_new(cmp) SKM_sk_new(void, (cmp)) +#define sk_void_new_null() SKM_sk_new_null(void) +#define sk_void_free(st) SKM_sk_free(void, (st)) +#define sk_void_num(st) SKM_sk_num(void, (st)) +#define sk_void_value(st, i) SKM_sk_value(void, (st), (i)) +#define sk_void_set(st, i, val) SKM_sk_set(void, (st), (i), (val)) +#define sk_void_zero(st) SKM_sk_zero(void, (st)) +#define sk_void_push(st, val) SKM_sk_push(void, (st), (val)) +#define sk_void_unshift(st, val) SKM_sk_unshift(void, (st), (val)) +#define sk_void_find(st, val) SKM_sk_find(void, (st), (val)) +#define sk_void_delete(st, i) SKM_sk_delete(void, (st), (i)) +#define sk_void_delete_ptr(st, ptr) SKM_sk_delete_ptr(void, (st), (ptr)) +#define sk_void_insert(st, val, i) SKM_sk_insert(void, (st), (val), (i)) +#define sk_void_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(void, (st), (cmp)) +#define sk_void_dup(st) SKM_sk_dup(void, st) +#define sk_void_pop_free(st, free_func) SKM_sk_pop_free(void, (st), (free_func)) +#define sk_void_shift(st) SKM_sk_shift(void, (st)) +#define sk_void_pop(st) SKM_sk_pop(void, (st)) +#define sk_void_sort(st) SKM_sk_sort(void, (st)) +#define sk_void_is_sorted(st) SKM_sk_is_sorted(void, (st)) + +#define sk_OPENSSL_STRING_new(cmp) ((STACK_OF(OPENSSL_STRING) *)sk_new(CHECKED_SK_CMP_FUNC(char, cmp))) +#define sk_OPENSSL_STRING_new_null() ((STACK_OF(OPENSSL_STRING) *)sk_new_null()) +#define sk_OPENSSL_STRING_push(st, val) sk_push(CHECKED_STACK_OF(OPENSSL_STRING, st), CHECKED_PTR_OF(char, val)) +#define sk_OPENSSL_STRING_find(st, val) sk_find(CHECKED_STACK_OF(OPENSSL_STRING, st), CHECKED_PTR_OF(char, val)) +#define sk_OPENSSL_STRING_value(st, i) ((OPENSSL_STRING)sk_value(CHECKED_STACK_OF(OPENSSL_STRING, st), i)) +#define sk_OPENSSL_STRING_num(st) SKM_sk_num(OPENSSL_STRING, st) +#define sk_OPENSSL_STRING_pop_free(st, free_func) sk_pop_free(CHECKED_STACK_OF(OPENSSL_STRING, st), CHECKED_SK_FREE_FUNC2(OPENSSL_STRING, free_func)) +#define sk_OPENSSL_STRING_insert(st, val, i) sk_insert(CHECKED_STACK_OF(OPENSSL_STRING, st), CHECKED_PTR_OF(char, val), i) +#define sk_OPENSSL_STRING_free(st) SKM_sk_free(OPENSSL_STRING, st) +#define sk_OPENSSL_STRING_set(st, i, val) sk_set(CHECKED_STACK_OF(OPENSSL_STRING, st), i, CHECKED_PTR_OF(char, val)) +#define sk_OPENSSL_STRING_zero(st) SKM_sk_zero(OPENSSL_STRING, (st)) +#define sk_OPENSSL_STRING_unshift(st, val) sk_unshift(CHECKED_STACK_OF(OPENSSL_STRING, st), CHECKED_PTR_OF(char, val)) +#define sk_OPENSSL_STRING_delete(st, i) SKM_sk_delete(OPENSSL_STRING, (st), (i)) +#define sk_OPENSSL_STRING_delete_ptr(st, ptr) (OPENSSL_STRING *)sk_delete_ptr(CHECKED_STACK_OF(OPENSSL_STRING, st), CHECKED_PTR_OF(char, ptr)) +#define sk_OPENSSL_STRING_set_cmp_func(st, cmp) \ + ((int (*)(const char * const *,const char * const *)) \ + sk_set_cmp_func(CHECKED_STACK_OF(OPENSSL_STRING, st), CHECKED_SK_CMP_FUNC(char, cmp))) +#define sk_OPENSSL_STRING_dup(st) SKM_sk_dup(OPENSSL_STRING, st) +#define sk_OPENSSL_STRING_shift(st) SKM_sk_shift(OPENSSL_STRING, (st)) +#define sk_OPENSSL_STRING_pop(st) (char *)sk_pop(CHECKED_STACK_OF(OPENSSL_STRING, st)) +#define sk_OPENSSL_STRING_sort(st) SKM_sk_sort(OPENSSL_STRING, (st)) +#define sk_OPENSSL_STRING_is_sorted(st) SKM_sk_is_sorted(OPENSSL_STRING, (st)) + +#define sk_OPENSSL_PSTRING_new(cmp) ((STACK_OF(OPENSSL_PSTRING) *)sk_new(CHECKED_SK_CMP_FUNC(OPENSSL_STRING, cmp))) +#define sk_OPENSSL_PSTRING_new_null() ((STACK_OF(OPENSSL_PSTRING) *)sk_new_null()) +#define sk_OPENSSL_PSTRING_push(st, val) sk_push(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val)) +#define sk_OPENSSL_PSTRING_find(st, val) sk_find(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val)) +#define sk_OPENSSL_PSTRING_value(st, i) ((OPENSSL_PSTRING)sk_value(CHECKED_STACK_OF(OPENSSL_PSTRING, st), i)) +#define sk_OPENSSL_PSTRING_num(st) SKM_sk_num(OPENSSL_PSTRING, st) +#define sk_OPENSSL_PSTRING_pop_free(st, free_func) sk_pop_free(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_SK_FREE_FUNC2(OPENSSL_PSTRING, free_func)) +#define sk_OPENSSL_PSTRING_insert(st, val, i) sk_insert(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val), i) +#define sk_OPENSSL_PSTRING_free(st) SKM_sk_free(OPENSSL_PSTRING, st) +#define sk_OPENSSL_PSTRING_set(st, i, val) sk_set(CHECKED_STACK_OF(OPENSSL_PSTRING, st), i, CHECKED_PTR_OF(OPENSSL_STRING, val)) +#define sk_OPENSSL_PSTRING_zero(st) SKM_sk_zero(OPENSSL_PSTRING, (st)) +#define sk_OPENSSL_PSTRING_unshift(st, val) sk_unshift(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, val)) +#define sk_OPENSSL_PSTRING_delete(st, i) SKM_sk_delete(OPENSSL_PSTRING, (st), (i)) +#define sk_OPENSSL_PSTRING_delete_ptr(st, ptr) (OPENSSL_PSTRING *)sk_delete_ptr(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_PTR_OF(OPENSSL_STRING, ptr)) +#define sk_OPENSSL_PSTRING_set_cmp_func(st, cmp) \ + ((int (*)(const OPENSSL_STRING * const *,const OPENSSL_STRING * const *)) \ + sk_set_cmp_func(CHECKED_STACK_OF(OPENSSL_PSTRING, st), CHECKED_SK_CMP_FUNC(OPENSSL_STRING, cmp))) +#define sk_OPENSSL_PSTRING_dup(st) SKM_sk_dup(OPENSSL_PSTRING, st) +#define sk_OPENSSL_PSTRING_shift(st) SKM_sk_shift(OPENSSL_PSTRING, (st)) +#define sk_OPENSSL_PSTRING_pop(st) (OPENSSL_STRING *)sk_pop(CHECKED_STACK_OF(OPENSSL_PSTRING, st)) +#define sk_OPENSSL_PSTRING_sort(st) SKM_sk_sort(OPENSSL_PSTRING, (st)) +#define sk_OPENSSL_PSTRING_is_sorted(st) SKM_sk_is_sorted(OPENSSL_PSTRING, (st)) + +#define lh_ADDED_OBJ_new() LHM_lh_new(ADDED_OBJ,added_obj) +#define lh_ADDED_OBJ_insert(lh,inst) LHM_lh_insert(ADDED_OBJ,lh,inst) +#define lh_ADDED_OBJ_retrieve(lh,inst) LHM_lh_retrieve(ADDED_OBJ,lh,inst) +#define lh_ADDED_OBJ_delete(lh,inst) LHM_lh_delete(ADDED_OBJ,lh,inst) +#define lh_ADDED_OBJ_doall(lh,fn) LHM_lh_doall(ADDED_OBJ,lh,fn) +#define lh_ADDED_OBJ_doall_arg(lh,fn,arg_type,arg) \ + LHM_lh_doall_arg(ADDED_OBJ,lh,fn,arg_type,arg) +#define lh_ADDED_OBJ_error(lh) LHM_lh_error(ADDED_OBJ,lh) +#define lh_ADDED_OBJ_num_items(lh) LHM_lh_num_items(ADDED_OBJ,lh) +#define lh_ADDED_OBJ_free(lh) LHM_lh_free(ADDED_OBJ,lh) + +#define lh_CONF_VALUE_new() LHM_lh_new(CONF_VALUE,conf_value) +#define lh_CONF_VALUE_insert(lh,inst) LHM_lh_insert(CONF_VALUE,lh,inst) +#define lh_CONF_VALUE_retrieve(lh,inst) LHM_lh_retrieve(CONF_VALUE,lh,inst) +#define lh_CONF_VALUE_delete(lh,inst) LHM_lh_delete(CONF_VALUE,lh,inst) +#define lh_CONF_VALUE_doall(lh,fn) LHM_lh_doall(CONF_VALUE,lh,fn) +#define lh_CONF_VALUE_doall_arg(lh,fn,arg_type,arg) \ + LHM_lh_doall_arg(CONF_VALUE,lh,fn,arg_type,arg) +#define lh_CONF_VALUE_error(lh) LHM_lh_error(CONF_VALUE,lh) +#define lh_CONF_VALUE_num_items(lh) LHM_lh_num_items(CONF_VALUE,lh) +#define lh_CONF_VALUE_free(lh) LHM_lh_free(CONF_VALUE,lh) + +#define lh_ERR_STATE_new() LHM_lh_new(ERR_STATE,err_state) +#define lh_ERR_STATE_insert(lh,inst) LHM_lh_insert(ERR_STATE,lh,inst) +#define lh_ERR_STATE_retrieve(lh,inst) LHM_lh_retrieve(ERR_STATE,lh,inst) +#define lh_ERR_STATE_delete(lh,inst) LHM_lh_delete(ERR_STATE,lh,inst) +#define lh_ERR_STATE_doall(lh,fn) LHM_lh_doall(ERR_STATE,lh,fn) +#define lh_ERR_STATE_doall_arg(lh,fn,arg_type,arg) \ + LHM_lh_doall_arg(ERR_STATE,lh,fn,arg_type,arg) +#define lh_ERR_STATE_error(lh) LHM_lh_error(ERR_STATE,lh) +#define lh_ERR_STATE_num_items(lh) LHM_lh_num_items(ERR_STATE,lh) +#define lh_ERR_STATE_free(lh) LHM_lh_free(ERR_STATE,lh) + +#define lh_ERR_STRING_DATA_new() LHM_lh_new(ERR_STRING_DATA,err_string_data) +#define lh_ERR_STRING_DATA_insert(lh,inst) LHM_lh_insert(ERR_STRING_DATA,lh,inst) +#define lh_ERR_STRING_DATA_retrieve(lh,inst) LHM_lh_retrieve(ERR_STRING_DATA,lh,inst) +#define lh_ERR_STRING_DATA_delete(lh,inst) LHM_lh_delete(ERR_STRING_DATA,lh,inst) +#define lh_ERR_STRING_DATA_doall(lh,fn) LHM_lh_doall(ERR_STRING_DATA,lh,fn) +#define lh_ERR_STRING_DATA_doall_arg(lh,fn,arg_type,arg) \ + LHM_lh_doall_arg(ERR_STRING_DATA,lh,fn,arg_type,arg) +#define lh_ERR_STRING_DATA_error(lh) LHM_lh_error(ERR_STRING_DATA,lh) +#define lh_ERR_STRING_DATA_num_items(lh) LHM_lh_num_items(ERR_STRING_DATA,lh) +#define lh_ERR_STRING_DATA_free(lh) LHM_lh_free(ERR_STRING_DATA,lh) + +#define lh_EX_CLASS_ITEM_new() LHM_lh_new(EX_CLASS_ITEM,ex_class_item) +#define lh_EX_CLASS_ITEM_insert(lh,inst) LHM_lh_insert(EX_CLASS_ITEM,lh,inst) +#define lh_EX_CLASS_ITEM_retrieve(lh,inst) LHM_lh_retrieve(EX_CLASS_ITEM,lh,inst) +#define lh_EX_CLASS_ITEM_delete(lh,inst) LHM_lh_delete(EX_CLASS_ITEM,lh,inst) +#define lh_EX_CLASS_ITEM_doall(lh,fn) LHM_lh_doall(EX_CLASS_ITEM,lh,fn) +#define lh_EX_CLASS_ITEM_doall_arg(lh,fn,arg_type,arg) \ + LHM_lh_doall_arg(EX_CLASS_ITEM,lh,fn,arg_type,arg) +#define lh_EX_CLASS_ITEM_error(lh) LHM_lh_error(EX_CLASS_ITEM,lh) +#define lh_EX_CLASS_ITEM_num_items(lh) LHM_lh_num_items(EX_CLASS_ITEM,lh) +#define lh_EX_CLASS_ITEM_free(lh) LHM_lh_free(EX_CLASS_ITEM,lh) + +#define lh_FUNCTION_new() LHM_lh_new(FUNCTION,function) +#define lh_FUNCTION_insert(lh,inst) LHM_lh_insert(FUNCTION,lh,inst) +#define lh_FUNCTION_retrieve(lh,inst) LHM_lh_retrieve(FUNCTION,lh,inst) +#define lh_FUNCTION_delete(lh,inst) LHM_lh_delete(FUNCTION,lh,inst) +#define lh_FUNCTION_doall(lh,fn) LHM_lh_doall(FUNCTION,lh,fn) +#define lh_FUNCTION_doall_arg(lh,fn,arg_type,arg) \ + LHM_lh_doall_arg(FUNCTION,lh,fn,arg_type,arg) +#define lh_FUNCTION_error(lh) LHM_lh_error(FUNCTION,lh) +#define lh_FUNCTION_num_items(lh) LHM_lh_num_items(FUNCTION,lh) +#define lh_FUNCTION_free(lh) LHM_lh_free(FUNCTION,lh) + +#define lh_OBJ_NAME_new() LHM_lh_new(OBJ_NAME,obj_name) +#define lh_OBJ_NAME_insert(lh,inst) LHM_lh_insert(OBJ_NAME,lh,inst) +#define lh_OBJ_NAME_retrieve(lh,inst) LHM_lh_retrieve(OBJ_NAME,lh,inst) +#define lh_OBJ_NAME_delete(lh,inst) LHM_lh_delete(OBJ_NAME,lh,inst) +#define lh_OBJ_NAME_doall(lh,fn) LHM_lh_doall(OBJ_NAME,lh,fn) +#define lh_OBJ_NAME_doall_arg(lh,fn,arg_type,arg) \ + LHM_lh_doall_arg(OBJ_NAME,lh,fn,arg_type,arg) +#define lh_OBJ_NAME_error(lh) LHM_lh_error(OBJ_NAME,lh) +#define lh_OBJ_NAME_num_items(lh) LHM_lh_num_items(OBJ_NAME,lh) +#define lh_OBJ_NAME_free(lh) LHM_lh_free(OBJ_NAME,lh) + +#define lh_OPENSSL_STRING_new() LHM_lh_new(OPENSSL_STRING,openssl_string) +#define lh_OPENSSL_STRING_insert(lh,inst) LHM_lh_insert(OPENSSL_STRING,lh,inst) +#define lh_OPENSSL_STRING_retrieve(lh,inst) LHM_lh_retrieve(OPENSSL_STRING,lh,inst) +#define lh_OPENSSL_STRING_delete(lh,inst) LHM_lh_delete(OPENSSL_STRING,lh,inst) +#define lh_OPENSSL_STRING_doall(lh,fn) LHM_lh_doall(OPENSSL_STRING,lh,fn) +#define lh_OPENSSL_STRING_doall_arg(lh,fn,arg_type,arg) \ + LHM_lh_doall_arg(OPENSSL_STRING,lh,fn,arg_type,arg) +#define lh_OPENSSL_STRING_error(lh) LHM_lh_error(OPENSSL_STRING,lh) +#define lh_OPENSSL_STRING_num_items(lh) LHM_lh_num_items(OPENSSL_STRING,lh) +#define lh_OPENSSL_STRING_free(lh) LHM_lh_free(OPENSSL_STRING,lh) + +#define lh_SSL_SESSION_new() LHM_lh_new(SSL_SESSION,ssl_session) +#define lh_SSL_SESSION_insert(lh,inst) LHM_lh_insert(SSL_SESSION,lh,inst) +#define lh_SSL_SESSION_retrieve(lh,inst) LHM_lh_retrieve(SSL_SESSION,lh,inst) +#define lh_SSL_SESSION_delete(lh,inst) LHM_lh_delete(SSL_SESSION,lh,inst) +#define lh_SSL_SESSION_doall(lh,fn) LHM_lh_doall(SSL_SESSION,lh,fn) +#define lh_SSL_SESSION_doall_arg(lh,fn,arg_type,arg) \ + LHM_lh_doall_arg(SSL_SESSION,lh,fn,arg_type,arg) +#define lh_SSL_SESSION_error(lh) LHM_lh_error(SSL_SESSION,lh) +#define lh_SSL_SESSION_num_items(lh) LHM_lh_num_items(SSL_SESSION,lh) +#define lh_SSL_SESSION_free(lh) LHM_lh_free(SSL_SESSION,lh) + +#endif /* !defined HEADER_SAFESTACK_H */ diff --git a/curl/include/openssl/sha.h b/curl/include/openssl/sha.h new file mode 100644 index 0000000..ec97f48 --- /dev/null +++ b/curl/include/openssl/sha.h @@ -0,0 +1,190 @@ +/* $OpenBSD: sha.h,v 1.26 2025/01/25 17:59:44 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#include + +#ifndef HEADER_SHA_H +#define HEADER_SHA_H +#if !defined(HAVE_ATTRIBUTE__BOUNDED__) && !defined(__OpenBSD__) +#define __bounded__(x, y, z) +#endif + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + * ! SHA_LONG has to be at least 32 bits wide. ! + * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + */ + +#define SHA_LONG unsigned int + +#define SHA_LBLOCK 16 +#define SHA_CBLOCK (SHA_LBLOCK*4) /* SHA treats input data as a + * contiguous array of 32 bit + * wide big-endian values. */ +#define SHA_LAST_BLOCK (SHA_CBLOCK-8) +#define SHA_DIGEST_LENGTH 20 + +typedef struct SHAstate_st { + SHA_LONG h0, h1, h2, h3, h4; + SHA_LONG Nl, Nh; + SHA_LONG data[SHA_LBLOCK]; + unsigned int num; +} SHA_CTX; + +#ifndef OPENSSL_NO_SHA1 +int SHA1_Init(SHA_CTX *c); +int SHA1_Update(SHA_CTX *c, const void *data, size_t len) + __attribute__ ((__bounded__(__buffer__, 2, 3))); +int SHA1_Final(unsigned char *md, SHA_CTX *c); +unsigned char *SHA1(const unsigned char *d, size_t n, unsigned char *md) + __attribute__ ((__bounded__(__buffer__, 1, 2))) + __attribute__ ((__nonnull__(3))); +void SHA1_Transform(SHA_CTX *c, const unsigned char *data); +#endif + +#define SHA256_CBLOCK (SHA_LBLOCK*4) /* SHA-256 treats input data as a + * contiguous array of 32 bit + * wide big-endian values. */ +#define SHA224_DIGEST_LENGTH 28 +#define SHA256_DIGEST_LENGTH 32 + +typedef struct SHA256state_st { + SHA_LONG h[8]; + SHA_LONG Nl, Nh; + SHA_LONG data[SHA_LBLOCK]; + unsigned int num, md_len; +} SHA256_CTX; + +#ifndef OPENSSL_NO_SHA256 +int SHA224_Init(SHA256_CTX *c); +int SHA224_Update(SHA256_CTX *c, const void *data, size_t len) + __attribute__ ((__bounded__(__buffer__, 2, 3))); +int SHA224_Final(unsigned char *md, SHA256_CTX *c); +unsigned char *SHA224(const unsigned char *d, size_t n, unsigned char *md) + __attribute__ ((__bounded__(__buffer__, 1, 2))) + __attribute__ ((__nonnull__(3))); +int SHA256_Init(SHA256_CTX *c); +int SHA256_Update(SHA256_CTX *c, const void *data, size_t len) + __attribute__ ((__bounded__(__buffer__, 2, 3))); +int SHA256_Final(unsigned char *md, SHA256_CTX *c); +unsigned char *SHA256(const unsigned char *d, size_t n, unsigned char *md) + __attribute__ ((__bounded__(__buffer__, 1, 2))) + __attribute__ ((__nonnull__(3))); +void SHA256_Transform(SHA256_CTX *c, const unsigned char *data); +#endif + +#define SHA384_DIGEST_LENGTH 48 +#define SHA512_DIGEST_LENGTH 64 + +#ifndef OPENSSL_NO_SHA512 +/* + * Unlike 32-bit digest algorithms, SHA-512 *relies* on SHA_LONG64 + * being exactly 64-bit wide. See Implementation Notes in sha512.c + * for further details. + */ +#define SHA512_CBLOCK (SHA_LBLOCK*8) /* SHA-512 treats input data as a + * contiguous array of 64 bit + * wide big-endian values. */ +#if defined(_LP64) +#define SHA_LONG64 unsigned long +#define U64(C) C##UL +#else +#define SHA_LONG64 unsigned long long +#define U64(C) C##ULL +#endif + +typedef struct SHA512state_st { + SHA_LONG64 h[8]; + SHA_LONG64 Nl, Nh; + union { + SHA_LONG64 d[SHA_LBLOCK]; + unsigned char p[SHA512_CBLOCK]; + } u; + unsigned int num, md_len; +} SHA512_CTX; +#endif + +#ifndef OPENSSL_NO_SHA512 +int SHA384_Init(SHA512_CTX *c); +int SHA384_Update(SHA512_CTX *c, const void *data, size_t len) + __attribute__ ((__bounded__(__buffer__, 2, 3))); +int SHA384_Final(unsigned char *md, SHA512_CTX *c); +unsigned char *SHA384(const unsigned char *d, size_t n, unsigned char *md) + __attribute__ ((__bounded__(__buffer__, 1, 2))) + __attribute__ ((__nonnull__(3))); +int SHA512_Init(SHA512_CTX *c); +int SHA512_Update(SHA512_CTX *c, const void *data, size_t len) + __attribute__ ((__bounded__(__buffer__, 2, 3))); +int SHA512_Final(unsigned char *md, SHA512_CTX *c); +unsigned char *SHA512(const unsigned char *d, size_t n, unsigned char *md) + __attribute__ ((__bounded__(__buffer__, 1, 2))) + __attribute__ ((__nonnull__(3))); +void SHA512_Transform(SHA512_CTX *c, const unsigned char *data); +#endif + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/sm3.h b/curl/include/openssl/sm3.h new file mode 100644 index 0000000..fa435d3 --- /dev/null +++ b/curl/include/openssl/sm3.h @@ -0,0 +1,49 @@ +/* $OpenBSD: sm3.h,v 1.2 2025/01/25 17:59:44 tb Exp $ */ +/* + * Copyright (c) 2018, Ribose Inc + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef HEADER_SM3_H +#define HEADER_SM3_H + +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define SM3_DIGEST_LENGTH 32 +#define SM3_WORD unsigned int + +#define SM3_CBLOCK 64 +#define SM3_LBLOCK (SM3_CBLOCK / 4) + +typedef struct SM3state_st { + SM3_WORD A, B, C, D, E, F, G, H; + SM3_WORD Nl, Nh; + SM3_WORD data[SM3_LBLOCK]; + unsigned int num; +} SM3_CTX; + +int SM3_Init(SM3_CTX *c); +int SM3_Update(SM3_CTX *c, const void *data, size_t len); +int SM3_Final(unsigned char *md, SM3_CTX *c); + +#ifdef __cplusplus +} +#endif + +#endif /* HEADER_SM3_H */ diff --git a/curl/include/openssl/sm4.h b/curl/include/openssl/sm4.h new file mode 100644 index 0000000..0c7fc22 --- /dev/null +++ b/curl/include/openssl/sm4.h @@ -0,0 +1,47 @@ +/* $OpenBSD: sm4.h,v 1.2 2025/01/25 17:59:44 tb Exp $ */ +/* + * Copyright (c) 2017, 2019 Ribose Inc + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef HEADER_SM4_H +#define HEADER_SM4_H + +#include + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define SM4_DECRYPT 0 +#define SM4_ENCRYPT 1 + +#define SM4_BLOCK_SIZE 16 +#define SM4_KEY_SCHEDULE 32 + +typedef struct sm4_key_st { + unsigned char opaque[128]; +} SM4_KEY; + +int SM4_set_key(const uint8_t *key, SM4_KEY *ks); +void SM4_decrypt(const uint8_t *in, uint8_t *out, const SM4_KEY *ks); +void SM4_encrypt(const uint8_t *in, uint8_t *out, const SM4_KEY *ks); + +#ifdef __cplusplus +} +#endif + +#endif /* HEADER_SM4_H */ diff --git a/curl/include/openssl/srtp.h b/curl/include/openssl/srtp.h new file mode 100644 index 0000000..686e9d9 --- /dev/null +++ b/curl/include/openssl/srtp.h @@ -0,0 +1,148 @@ +/* $OpenBSD: srtp.h,v 1.8 2025/03/13 10:26:41 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ +/* ==================================================================== + * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ +/* + * DTLS code by Eric Rescorla + * + * Copyright (C) 2006, Network Resonance, Inc. + * Copyright (C) 2011, RTFM, Inc. + */ + +#ifndef HEADER_D1_SRTP_H +#define HEADER_D1_SRTP_H + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define SRTP_AES128_CM_SHA1_80 0x0001 +#define SRTP_AES128_CM_SHA1_32 0x0002 +#define SRTP_AES128_F8_SHA1_80 0x0003 +#define SRTP_AES128_F8_SHA1_32 0x0004 +#define SRTP_NULL_SHA1_80 0x0005 +#define SRTP_NULL_SHA1_32 0x0006 + +/* AEAD SRTP protection profiles from RFC 7714 */ +#define SRTP_AEAD_AES_128_GCM 0x0007 +#define SRTP_AEAD_AES_256_GCM 0x0008 + +int SSL_CTX_set_tlsext_use_srtp(SSL_CTX *ctx, const char *profiles); +int SSL_set_tlsext_use_srtp(SSL *ctx, const char *profiles); + +STACK_OF(SRTP_PROTECTION_PROFILE) *SSL_get_srtp_profiles(SSL *ssl); +SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_profile(SSL *s); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/ssl.h b/curl/include/openssl/ssl.h new file mode 100644 index 0000000..a1ed22b --- /dev/null +++ b/curl/include/openssl/ssl.h @@ -0,0 +1,2343 @@ +/* $OpenBSD: ssl.h,v 1.247 2025/03/12 14:03:55 jsing Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ +/* ==================================================================== + * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ +/* ==================================================================== + * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. + * ECC cipher suite support in OpenSSL originally developed by + * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. + */ +/* ==================================================================== + * Copyright 2005 Nokia. All rights reserved. + * + * The portions of the attached software ("Contribution") is developed by + * Nokia Corporation and is licensed pursuant to the OpenSSL open source + * license. + * + * The Contribution, originally written by Mika Kousa and Pasi Eronen of + * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites + * support (see RFC 4279) to OpenSSL. + * + * No patent licenses or other rights except those expressly stated in + * the OpenSSL open source license shall be deemed granted or received + * expressly, by implication, estoppel, or otherwise. + * + * No assurances are provided by Nokia that the Contribution does not + * infringe the patent or other intellectual property rights of any third + * party or that the license provides you with all the necessary rights + * to make use of the Contribution. + * + * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN + * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA + * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY + * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR + * OTHERWISE. + */ + +#ifndef HEADER_SSL_H +#define HEADER_SSL_H + +#include + +#include + +#include +#include +#include + +#include + +#ifndef OPENSSL_NO_DEPRECATED +#include +#include +#include + +#ifndef OPENSSL_NO_X509 +#include +#endif +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/* SSLeay version number for ASN.1 encoding of the session information */ +/* Version 0 - initial version + * Version 1 - added the optional peer certificate + */ +#define SSL_SESSION_ASN1_VERSION 0x0001 + +/* text strings for the ciphers */ +#define SSL_TXT_NULL_WITH_MD5 SSL2_TXT_NULL_WITH_MD5 +#define SSL_TXT_RC4_128_WITH_MD5 SSL2_TXT_RC4_128_WITH_MD5 +#define SSL_TXT_RC4_128_EXPORT40_WITH_MD5 SSL2_TXT_RC4_128_EXPORT40_WITH_MD5 +#define SSL_TXT_RC2_128_CBC_WITH_MD5 SSL2_TXT_RC2_128_CBC_WITH_MD5 +#define SSL_TXT_RC2_128_CBC_EXPORT40_WITH_MD5 SSL2_TXT_RC2_128_CBC_EXPORT40_WITH_MD5 +#define SSL_TXT_IDEA_128_CBC_WITH_MD5 SSL2_TXT_IDEA_128_CBC_WITH_MD5 +#define SSL_TXT_DES_64_CBC_WITH_MD5 SSL2_TXT_DES_64_CBC_WITH_MD5 +#define SSL_TXT_DES_64_CBC_WITH_SHA SSL2_TXT_DES_64_CBC_WITH_SHA +#define SSL_TXT_DES_192_EDE3_CBC_WITH_MD5 SSL2_TXT_DES_192_EDE3_CBC_WITH_MD5 +#define SSL_TXT_DES_192_EDE3_CBC_WITH_SHA SSL2_TXT_DES_192_EDE3_CBC_WITH_SHA + +/* VRS Additional Kerberos5 entries + */ +#define SSL_TXT_KRB5_RC4_128_SHA SSL3_TXT_KRB5_RC4_128_SHA +#define SSL_TXT_KRB5_IDEA_128_CBC_SHA SSL3_TXT_KRB5_IDEA_128_CBC_SHA +#define SSL_TXT_KRB5_RC4_128_MD5 SSL3_TXT_KRB5_RC4_128_MD5 +#define SSL_TXT_KRB5_IDEA_128_CBC_MD5 SSL3_TXT_KRB5_IDEA_128_CBC_MD5 + +#define SSL_TXT_KRB5_RC2_40_CBC_SHA SSL3_TXT_KRB5_RC2_40_CBC_SHA +#define SSL_TXT_KRB5_RC4_40_SHA SSL3_TXT_KRB5_RC4_40_SHA +#define SSL_TXT_KRB5_RC2_40_CBC_MD5 SSL3_TXT_KRB5_RC2_40_CBC_MD5 +#define SSL_TXT_KRB5_RC4_40_MD5 SSL3_TXT_KRB5_RC4_40_MD5 + +#define SSL_TXT_KRB5_DES_40_CBC_SHA SSL3_TXT_KRB5_DES_40_CBC_SHA +#define SSL_TXT_KRB5_DES_40_CBC_MD5 SSL3_TXT_KRB5_DES_40_CBC_MD5 +#define SSL_TXT_KRB5_DES_64_CBC_SHA SSL3_TXT_KRB5_DES_64_CBC_SHA +#define SSL_TXT_KRB5_DES_64_CBC_MD5 SSL3_TXT_KRB5_DES_64_CBC_MD5 +#define SSL_TXT_KRB5_DES_192_CBC3_SHA SSL3_TXT_KRB5_DES_192_CBC3_SHA +#define SSL_TXT_KRB5_DES_192_CBC3_MD5 SSL3_TXT_KRB5_DES_192_CBC3_MD5 +#define SSL_MAX_KRB5_PRINCIPAL_LENGTH 256 + +#define SSL_MAX_SSL_SESSION_ID_LENGTH 32 +#define SSL_MAX_SID_CTX_LENGTH 32 + +#define SSL_MIN_RSA_MODULUS_LENGTH_IN_BYTES (512/8) +#define SSL_MAX_KEY_ARG_LENGTH 8 +#define SSL_MAX_MASTER_KEY_LENGTH 48 + + +/* These are used to specify which ciphers to use and not to use */ + +#define SSL_TXT_LOW "LOW" +#define SSL_TXT_MEDIUM "MEDIUM" +#define SSL_TXT_HIGH "HIGH" + +#define SSL_TXT_kFZA "kFZA" /* unused! */ +#define SSL_TXT_aFZA "aFZA" /* unused! */ +#define SSL_TXT_eFZA "eFZA" /* unused! */ +#define SSL_TXT_FZA "FZA" /* unused! */ + +#define SSL_TXT_aNULL "aNULL" +#define SSL_TXT_eNULL "eNULL" +#define SSL_TXT_NULL "NULL" + +#define SSL_TXT_kRSA "kRSA" +#define SSL_TXT_kDHr "kDHr" /* no such ciphersuites supported! */ +#define SSL_TXT_kDHd "kDHd" /* no such ciphersuites supported! */ +#define SSL_TXT_kDH "kDH" /* no such ciphersuites supported! */ +#define SSL_TXT_kEDH "kEDH" +#define SSL_TXT_kKRB5 "kKRB5" +#define SSL_TXT_kECDHr "kECDHr" +#define SSL_TXT_kECDHe "kECDHe" +#define SSL_TXT_kECDH "kECDH" +#define SSL_TXT_kEECDH "kEECDH" +#define SSL_TXT_kPSK "kPSK" +#define SSL_TXT_kSRP "kSRP" + +#define SSL_TXT_aRSA "aRSA" +#define SSL_TXT_aDSS "aDSS" +#define SSL_TXT_aDH "aDH" /* no such ciphersuites supported! */ +#define SSL_TXT_aECDH "aECDH" +#define SSL_TXT_aKRB5 "aKRB5" +#define SSL_TXT_aECDSA "aECDSA" +#define SSL_TXT_aPSK "aPSK" + +#define SSL_TXT_DSS "DSS" +#define SSL_TXT_DH "DH" +#define SSL_TXT_DHE "DHE" /* same as "kDHE:-ADH" */ +#define SSL_TXT_EDH "EDH" /* previous name for DHE */ +#define SSL_TXT_ADH "ADH" +#define SSL_TXT_RSA "RSA" +#define SSL_TXT_ECDH "ECDH" +#define SSL_TXT_ECDHE "ECDHE" /* same as "kECDHE:-AECDH" */ +#define SSL_TXT_EECDH "EECDH" /* previous name for ECDHE */ +#define SSL_TXT_AECDH "AECDH" +#define SSL_TXT_ECDSA "ECDSA" +#define SSL_TXT_KRB5 "KRB5" +#define SSL_TXT_PSK "PSK" +#define SSL_TXT_SRP "SRP" + +#define SSL_TXT_DES "DES" +#define SSL_TXT_3DES "3DES" +#define SSL_TXT_RC4 "RC4" +#define SSL_TXT_RC2 "RC2" +#define SSL_TXT_IDEA "IDEA" +#define SSL_TXT_SEED "SEED" +#define SSL_TXT_AES128 "AES128" +#define SSL_TXT_AES256 "AES256" +#define SSL_TXT_AES "AES" +#define SSL_TXT_AES_GCM "AESGCM" +#define SSL_TXT_CAMELLIA128 "CAMELLIA128" +#define SSL_TXT_CAMELLIA256 "CAMELLIA256" +#define SSL_TXT_CAMELLIA "CAMELLIA" +#define SSL_TXT_CHACHA20 "CHACHA20" + +#define SSL_TXT_AEAD "AEAD" +#define SSL_TXT_MD5 "MD5" +#define SSL_TXT_SHA1 "SHA1" +#define SSL_TXT_SHA "SHA" /* same as "SHA1" */ +#define SSL_TXT_SHA256 "SHA256" +#define SSL_TXT_SHA384 "SHA384" + +#define SSL_TXT_DTLS1 "DTLSv1" +#define SSL_TXT_DTLS1_2 "DTLSv1.2" +#define SSL_TXT_SSLV2 "SSLv2" +#define SSL_TXT_SSLV3 "SSLv3" +#define SSL_TXT_TLSV1 "TLSv1" +#define SSL_TXT_TLSV1_1 "TLSv1.1" +#define SSL_TXT_TLSV1_2 "TLSv1.2" +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +#define SSL_TXT_TLSV1_3 "TLSv1.3" +#endif + +#define SSL_TXT_EXP "EXP" +#define SSL_TXT_EXPORT "EXPORT" + +#define SSL_TXT_ALL "ALL" + +/* + * COMPLEMENTOF* definitions. These identifiers are used to (de-select) + * ciphers normally not being used. + * Example: "RC4" will activate all ciphers using RC4 including ciphers + * without authentication, which would normally disabled by DEFAULT (due + * the "!ADH" being part of default). Therefore "RC4:!COMPLEMENTOFDEFAULT" + * will make sure that it is also disabled in the specific selection. + * COMPLEMENTOF* identifiers are portable between version, as adjustments + * to the default cipher setup will also be included here. + * + * COMPLEMENTOFDEFAULT does not experience the same special treatment that + * DEFAULT gets, as only selection is being done and no sorting as needed + * for DEFAULT. + */ +#define SSL_TXT_CMPALL "COMPLEMENTOFALL" +#define SSL_TXT_CMPDEF "COMPLEMENTOFDEFAULT" + +/* The following cipher list is used by default. + * It also is substituted when an application-defined cipher list string + * starts with 'DEFAULT'. */ +#define SSL_DEFAULT_CIPHER_LIST "ALL:!aNULL:!eNULL:!SSLv2" +/* As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always + * starts with a reasonable order, and all we have to do for DEFAULT is + * throwing out anonymous and unencrypted ciphersuites! + * (The latter are not actually enabled by ALL, but "ALL:RSA" would enable + * some of them.) + */ + +/* Used in SSL_set_shutdown()/SSL_get_shutdown(); */ +#define SSL_SENT_SHUTDOWN 1 +#define SSL_RECEIVED_SHUTDOWN 2 + + +#define SSL_FILETYPE_ASN1 X509_FILETYPE_ASN1 +#define SSL_FILETYPE_PEM X509_FILETYPE_PEM + +/* This is needed to stop compilers complaining about the + * 'struct ssl_st *' function parameters used to prototype callbacks + * in SSL_CTX. */ +typedef struct ssl_st *ssl_crock_st; + +typedef struct ssl_method_st SSL_METHOD; +typedef struct ssl_cipher_st SSL_CIPHER; +typedef struct ssl_session_st SSL_SESSION; + +#if defined(LIBRESSL_HAS_QUIC) || defined(LIBRESSL_INTERNAL) +typedef struct ssl_quic_method_st SSL_QUIC_METHOD; +#endif + +DECLARE_STACK_OF(SSL_CIPHER) + +/* SRTP protection profiles for use with the use_srtp extension (RFC 5764)*/ +typedef struct srtp_protection_profile_st { + const char *name; + unsigned long id; +} SRTP_PROTECTION_PROFILE; + +DECLARE_STACK_OF(SRTP_PROTECTION_PROFILE) + +typedef int (*tls_session_ticket_ext_cb_fn)(SSL *s, const unsigned char *data, + int len, void *arg); +typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len, + STACK_OF(SSL_CIPHER) *peer_ciphers, const SSL_CIPHER **cipher, void *arg); + +/* Allow initial connection to servers that don't support RI */ +#define SSL_OP_LEGACY_SERVER_CONNECT 0x00000004L + +/* Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added + * in OpenSSL 0.9.6d. Usually (depending on the application protocol) + * the workaround is not needed. + * Unfortunately some broken SSL/TLS implementations cannot handle it + * at all, which is why it was previously included in SSL_OP_ALL. + * Now it's not. + */ +#define SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS 0x00000800L + +/* DTLS options */ +#define SSL_OP_NO_QUERY_MTU 0x00001000L +/* Turn on Cookie Exchange (on relevant for servers) */ +#define SSL_OP_COOKIE_EXCHANGE 0x00002000L +/* Don't use RFC4507 ticket extension */ +#define SSL_OP_NO_TICKET 0x00004000L + +/* As server, disallow session resumption on renegotiation */ +#define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION 0x00010000L +/* Disallow client initiated renegotiation. */ +#define SSL_OP_NO_CLIENT_RENEGOTIATION 0x00020000L +/* Disallow client and server initiated renegotiation. */ +#define SSL_OP_NO_RENEGOTIATION 0x00040000L +/* Allow client initiated renegotiation. */ +#define SSL_OP_ALLOW_CLIENT_RENEGOTIATION 0x00080000L +/* If set, always create a new key when using tmp_dh parameters */ +#define SSL_OP_SINGLE_DH_USE 0x00100000L +/* Set on servers to choose the cipher according to the server's + * preferences */ +#define SSL_OP_CIPHER_SERVER_PREFERENCE 0x00400000L + +#define SSL_OP_NO_TLSv1 0x04000000L +#define SSL_OP_NO_TLSv1_2 0x08000000L +#define SSL_OP_NO_TLSv1_1 0x10000000L + +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +#define SSL_OP_NO_TLSv1_3 0x20000000L +#endif + +#define SSL_OP_NO_DTLSv1 0x40000000L +#define SSL_OP_NO_DTLSv1_2 0x80000000L + +/* SSL_OP_ALL: various bug workarounds that should be rather harmless. */ +#define SSL_OP_ALL \ + (SSL_OP_LEGACY_SERVER_CONNECT) + +/* Obsolete flags kept for compatibility. No sane code should use them. */ +#define SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION 0x0 +#define SSL_OP_CISCO_ANYCONNECT 0x0 +#define SSL_OP_CRYPTOPRO_TLSEXT_BUG 0x0 +#define SSL_OP_EPHEMERAL_RSA 0x0 +#define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER 0x0 +#define SSL_OP_MICROSOFT_SESS_ID_BUG 0x0 +#define SSL_OP_MSIE_SSLV2_RSA_PADDING 0x0 +#define SSL_OP_NETSCAPE_CA_DN_BUG 0x0 +#define SSL_OP_NETSCAPE_CHALLENGE_BUG 0x0 +#define SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG 0x0 +#define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG 0x0 +#define SSL_OP_NO_COMPRESSION 0x0 +#define SSL_OP_NO_SSLv2 0x0 +#define SSL_OP_NO_SSLv3 0x0 +#define SSL_OP_PKCS1_CHECK_1 0x0 +#define SSL_OP_PKCS1_CHECK_2 0x0 +#define SSL_OP_SAFARI_ECDHE_ECDSA_BUG 0x0 +#define SSL_OP_SINGLE_ECDH_USE 0x0 +#define SSL_OP_SSLEAY_080_CLIENT_DH_BUG 0x0 +#define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG 0x0 +#define SSL_OP_TLSEXT_PADDING 0x0 +#define SSL_OP_TLS_BLOCK_PADDING_BUG 0x0 +#define SSL_OP_TLS_D5_BUG 0x0 +#define SSL_OP_TLS_ROLLBACK_BUG 0x0 + +/* Allow SSL_write(..., n) to return r with 0 < r < n (i.e. report success + * when just a single record has been written): */ +#define SSL_MODE_ENABLE_PARTIAL_WRITE 0x00000001L +/* Make it possible to retry SSL_write() with changed buffer location + * (buffer contents must stay the same!); this is not the default to avoid + * the misconception that non-blocking SSL_write() behaves like + * non-blocking write(): */ +#define SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER 0x00000002L +/* Never bother the application with retries if the transport + * is blocking: */ +#define SSL_MODE_AUTO_RETRY 0x00000004L +/* Don't attempt to automatically build certificate chain */ +#define SSL_MODE_NO_AUTO_CHAIN 0x00000008L +/* Save RAM by releasing read and write buffers when they're empty. (SSL3 and + * TLS only.) "Released" buffers are put onto a free-list in the context + * or just freed (depending on the context's setting for freelist_max_len). */ +#define SSL_MODE_RELEASE_BUFFERS 0x00000010L + +/* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value, + * they cannot be used to clear bits. */ + +#define SSL_CTX_set_options(ctx,op) \ + SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,(op),NULL) +#define SSL_CTX_clear_options(ctx,op) \ + SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_OPTIONS,(op),NULL) +#define SSL_CTX_get_options(ctx) \ + SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,0,NULL) +#define SSL_set_options(ssl,op) \ + SSL_ctrl((ssl),SSL_CTRL_OPTIONS,(op),NULL) +#define SSL_clear_options(ssl,op) \ + SSL_ctrl((ssl),SSL_CTRL_CLEAR_OPTIONS,(op),NULL) +#define SSL_get_options(ssl) \ + SSL_ctrl((ssl),SSL_CTRL_OPTIONS,0,NULL) + +#define SSL_CTX_set_mode(ctx,op) \ + SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,(op),NULL) +#define SSL_CTX_clear_mode(ctx,op) \ + SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_MODE,(op),NULL) +#define SSL_CTX_get_mode(ctx) \ + SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,0,NULL) +#define SSL_clear_mode(ssl,op) \ + SSL_ctrl((ssl),SSL_CTRL_CLEAR_MODE,(op),NULL) +#define SSL_set_mode(ssl,op) \ + SSL_ctrl((ssl),SSL_CTRL_MODE,(op),NULL) +#define SSL_get_mode(ssl) \ + SSL_ctrl((ssl),SSL_CTRL_MODE,0,NULL) +#define SSL_set_mtu(ssl, mtu) \ + SSL_ctrl((ssl),SSL_CTRL_SET_MTU,(mtu),NULL) + +#define SSL_get_secure_renegotiation_support(ssl) \ + SSL_ctrl((ssl), SSL_CTRL_GET_RI_SUPPORT, 0, NULL) + +void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, + int version, int content_type, const void *buf, size_t len, SSL *ssl, + void *arg)); +void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, + int content_type, const void *buf, size_t len, SSL *ssl, void *arg)); +#define SSL_CTX_set_msg_callback_arg(ctx, arg) SSL_CTX_ctrl((ctx), SSL_CTRL_SET_MSG_CALLBACK_ARG, 0, (arg)) +#define SSL_set_msg_callback_arg(ssl, arg) SSL_ctrl((ssl), SSL_CTRL_SET_MSG_CALLBACK_ARG, 0, (arg)) +typedef void (*SSL_CTX_keylog_cb_func)(const SSL *ssl, const char *line); +void SSL_CTX_set_keylog_callback(SSL_CTX *ctx, SSL_CTX_keylog_cb_func cb); +SSL_CTX_keylog_cb_func SSL_CTX_get_keylog_callback(const SSL_CTX *ctx); +int SSL_set_num_tickets(SSL *s, size_t num_tickets); +size_t SSL_get_num_tickets(const SSL *s); +int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets); +size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx); +STACK_OF(X509) *SSL_get0_verified_chain(const SSL *s); + +#define SSL_MAX_CERT_LIST_DEFAULT 1024*100 /* 100k max cert list :-) */ + +#define SSL_SESSION_CACHE_MAX_SIZE_DEFAULT (1024*20) + +/* This callback type is used inside SSL_CTX, SSL, and in the functions that set + * them. It is used to override the generation of SSL/TLS session IDs in a + * server. Return value should be zero on an error, non-zero to proceed. Also, + * callbacks should themselves check if the id they generate is unique otherwise + * the SSL handshake will fail with an error - callbacks can do this using the + * 'ssl' value they're passed by; + * SSL_has_matching_session_id(ssl, id, *id_len) + * The length value passed in is set at the maximum size the session ID can be. + * In SSLv2 this is 16 bytes, whereas SSLv3/TLSv1 it is 32 bytes. The callback + * can alter this length to be less if desired, but under SSLv2 session IDs are + * supposed to be fixed at 16 bytes so the id will be padded after the callback + * returns in this case. It is also an error for the callback to set the size to + * zero. */ +typedef int (*GEN_SESSION_CB)(const SSL *ssl, unsigned char *id, + unsigned int *id_len); + +typedef struct ssl_comp_st SSL_COMP; + +#ifdef LIBRESSL_INTERNAL +DECLARE_STACK_OF(SSL_COMP) +struct lhash_st_SSL_SESSION { + int dummy; +}; +#endif + +#define SSL_SESS_CACHE_OFF 0x0000 +#define SSL_SESS_CACHE_CLIENT 0x0001 +#define SSL_SESS_CACHE_SERVER 0x0002 +#define SSL_SESS_CACHE_BOTH (SSL_SESS_CACHE_CLIENT|SSL_SESS_CACHE_SERVER) +#define SSL_SESS_CACHE_NO_AUTO_CLEAR 0x0080 +/* enough comments already ... see SSL_CTX_set_session_cache_mode(3) */ +#define SSL_SESS_CACHE_NO_INTERNAL_LOOKUP 0x0100 +#define SSL_SESS_CACHE_NO_INTERNAL_STORE 0x0200 +#define SSL_SESS_CACHE_NO_INTERNAL \ + (SSL_SESS_CACHE_NO_INTERNAL_LOOKUP|SSL_SESS_CACHE_NO_INTERNAL_STORE) + +struct lhash_st_SSL_SESSION *SSL_CTX_sessions(SSL_CTX *ctx); +#define SSL_CTX_sess_number(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_NUMBER,0,NULL) +#define SSL_CTX_sess_connect(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT,0,NULL) +#define SSL_CTX_sess_connect_good(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_GOOD,0,NULL) +#define SSL_CTX_sess_connect_renegotiate(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CONNECT_RENEGOTIATE,0,NULL) +#define SSL_CTX_sess_accept(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT,0,NULL) +#define SSL_CTX_sess_accept_renegotiate(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_RENEGOTIATE,0,NULL) +#define SSL_CTX_sess_accept_good(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_ACCEPT_GOOD,0,NULL) +#define SSL_CTX_sess_hits(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_HIT,0,NULL) +#define SSL_CTX_sess_cb_hits(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CB_HIT,0,NULL) +#define SSL_CTX_sess_misses(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_MISSES,0,NULL) +#define SSL_CTX_sess_timeouts(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_TIMEOUTS,0,NULL) +#define SSL_CTX_sess_cache_full(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CACHE_FULL,0,NULL) + +void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx, + int (*new_session_cb)(struct ssl_st *ssl, SSL_SESSION *sess)); +int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx))(struct ssl_st *ssl, + SSL_SESSION *sess); +void SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx, + void (*remove_session_cb)(struct ssl_ctx_st *ctx, SSL_SESSION *sess)); +void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx))(struct ssl_ctx_st *ctx, + SSL_SESSION *sess); +void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx, + SSL_SESSION *(*get_session_cb)(struct ssl_st *ssl, + const unsigned char *data, int len, int *copy)); +SSL_SESSION *(*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx))(struct ssl_st *ssl, + const unsigned char *data, int len, int *copy); +void SSL_CTX_set_info_callback(SSL_CTX *ctx, void (*cb)(const SSL *ssl, + int type, int val)); +void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl, int type, + int val); +void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, + int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey)); +int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL *ssl, X509 **x509, + EVP_PKEY **pkey); +void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx, + int (*app_gen_cookie_cb)(SSL *ssl, unsigned char *cookie, + unsigned int *cookie_len)); +void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, + int (*app_verify_cookie_cb)(SSL *ssl, const unsigned char *cookie, + unsigned int cookie_len)); +void SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *s, int (*cb)(SSL *ssl, + const unsigned char **out, unsigned int *outlen, void *arg), void *arg); +void SSL_CTX_set_next_proto_select_cb(SSL_CTX *s, int (*cb)(SSL *ssl, + unsigned char **out, unsigned char *outlen, const unsigned char *in, + unsigned int inlen, void *arg), void *arg); + +int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, + const unsigned char *in, unsigned int inlen, const unsigned char *client, + unsigned int client_len); +void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, + unsigned int *len); + +#define OPENSSL_NPN_UNSUPPORTED 0 +#define OPENSSL_NPN_NEGOTIATED 1 +#define OPENSSL_NPN_NO_OVERLAP 2 + +int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos, + unsigned int protos_len); +int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos, + unsigned int protos_len); +void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx, + int (*cb)(SSL *ssl, const unsigned char **out, unsigned char *outlen, + const unsigned char *in, unsigned int inlen, void *arg), void *arg); +void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data, + unsigned int *len); + +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +typedef int (*SSL_psk_use_session_cb_func)(SSL *ssl, const EVP_MD *md, + const unsigned char **id, size_t *idlen, SSL_SESSION **sess); +void SSL_set_psk_use_session_callback(SSL *s, SSL_psk_use_session_cb_func cb); +#endif + +#define SSL_NOTHING 1 +#define SSL_WRITING 2 +#define SSL_READING 3 +#define SSL_X509_LOOKUP 4 + +/* These will only be used when doing non-blocking IO */ +#define SSL_want_nothing(s) (SSL_want(s) == SSL_NOTHING) +#define SSL_want_read(s) (SSL_want(s) == SSL_READING) +#define SSL_want_write(s) (SSL_want(s) == SSL_WRITING) +#define SSL_want_x509_lookup(s) (SSL_want(s) == SSL_X509_LOOKUP) + +#define SSL_MAC_FLAG_READ_MAC_STREAM 1 +#define SSL_MAC_FLAG_WRITE_MAC_STREAM 2 + +#ifdef __cplusplus +} +#endif + +#include +#include /* This is mostly sslv3 with a few tweaks */ +#include /* Datagram TLS */ +#include /* Support for the use_srtp extension */ + +#ifdef __cplusplus +extern "C" { +#endif + +/* compatibility */ +#define SSL_set_app_data(s,arg) (SSL_set_ex_data(s,0,(char *)arg)) +#define SSL_get_app_data(s) (SSL_get_ex_data(s,0)) +#define SSL_SESSION_set_app_data(s,a) (SSL_SESSION_set_ex_data(s,0,(char *)a)) +#define SSL_SESSION_get_app_data(s) (SSL_SESSION_get_ex_data(s,0)) +#define SSL_CTX_get_app_data(ctx) (SSL_CTX_get_ex_data(ctx,0)) +#define SSL_CTX_set_app_data(ctx,arg) (SSL_CTX_set_ex_data(ctx,0,(char *)arg)) + +/* The following are the possible values for ssl->state are are + * used to indicate where we are up to in the SSL connection establishment. + * The macros that follow are about the only things you should need to use + * and even then, only when using non-blocking IO. + * It can also be useful to work out where you were when the connection + * failed */ + +#define SSL_ST_CONNECT 0x1000 +#define SSL_ST_ACCEPT 0x2000 +#define SSL_ST_MASK 0x0FFF +#define SSL_ST_INIT (SSL_ST_CONNECT|SSL_ST_ACCEPT) +#define SSL_ST_BEFORE 0x4000 +#define SSL_ST_OK 0x03 +#define SSL_ST_RENEGOTIATE (0x04|SSL_ST_INIT) + +#define SSL_CB_LOOP 0x01 +#define SSL_CB_EXIT 0x02 +#define SSL_CB_READ 0x04 +#define SSL_CB_WRITE 0x08 +#define SSL_CB_ALERT 0x4000 /* used in callback */ +#define SSL_CB_READ_ALERT (SSL_CB_ALERT|SSL_CB_READ) +#define SSL_CB_WRITE_ALERT (SSL_CB_ALERT|SSL_CB_WRITE) +#define SSL_CB_ACCEPT_LOOP (SSL_ST_ACCEPT|SSL_CB_LOOP) +#define SSL_CB_ACCEPT_EXIT (SSL_ST_ACCEPT|SSL_CB_EXIT) +#define SSL_CB_CONNECT_LOOP (SSL_ST_CONNECT|SSL_CB_LOOP) +#define SSL_CB_CONNECT_EXIT (SSL_ST_CONNECT|SSL_CB_EXIT) +#define SSL_CB_HANDSHAKE_START 0x10 +#define SSL_CB_HANDSHAKE_DONE 0x20 + +/* Is the SSL_connection established? */ +#define SSL_get_state(a) (SSL_state((a))) +#define SSL_is_init_finished(a) (SSL_state((a)) == SSL_ST_OK) +#define SSL_in_init(a) (SSL_state((a))&SSL_ST_INIT) +#define SSL_in_before(a) (SSL_state((a))&SSL_ST_BEFORE) +#define SSL_in_connect_init(a) (SSL_state((a))&SSL_ST_CONNECT) +#define SSL_in_accept_init(a) (SSL_state((a))&SSL_ST_ACCEPT) + +/* The following 2 states are kept in ssl->rstate when reads fail, + * you should not need these */ +#define SSL_ST_READ_HEADER 0xF0 +#define SSL_ST_READ_BODY 0xF1 +#define SSL_ST_READ_DONE 0xF2 + +/* Obtain latest Finished message + * -- that we sent (SSL_get_finished) + * -- that we expected from peer (SSL_get_peer_finished). + * Returns length (0 == no Finished so far), copies up to 'count' bytes. */ +size_t SSL_get_finished(const SSL *s, void *buf, size_t count); +size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count); + +/* use either SSL_VERIFY_NONE or SSL_VERIFY_PEER, the last 2 options + * are 'ored' with SSL_VERIFY_PEER if they are desired */ +#define SSL_VERIFY_NONE 0x00 +#define SSL_VERIFY_PEER 0x01 +#define SSL_VERIFY_FAIL_IF_NO_PEER_CERT 0x02 +#define SSL_VERIFY_CLIENT_ONCE 0x04 +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +#define SSL_VERIFY_POST_HANDSHAKE 0x08 + +int SSL_verify_client_post_handshake(SSL *s); +void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val); +void SSL_set_post_handshake_auth(SSL *s, int val); +#endif + +#define OpenSSL_add_ssl_algorithms() SSL_library_init() +#define SSLeay_add_ssl_algorithms() SSL_library_init() + +/* More backward compatibility */ +#define SSL_get_cipher(s) \ + SSL_CIPHER_get_name(SSL_get_current_cipher(s)) +#define SSL_get_cipher_bits(s,np) \ + SSL_CIPHER_get_bits(SSL_get_current_cipher(s),np) +#define SSL_get_cipher_version(s) \ + SSL_CIPHER_get_version(SSL_get_current_cipher(s)) +#define SSL_get_cipher_name(s) \ + SSL_CIPHER_get_name(SSL_get_current_cipher(s)) +#define SSL_get_time(a) SSL_SESSION_get_time(a) +#define SSL_set_time(a,b) SSL_SESSION_set_time((a),(b)) +#define SSL_get_timeout(a) SSL_SESSION_get_timeout(a) +#define SSL_set_timeout(a,b) SSL_SESSION_set_timeout((a),(b)) + +#define d2i_SSL_SESSION_bio(bp,s_id) ASN1_d2i_bio_of(SSL_SESSION,SSL_SESSION_new,d2i_SSL_SESSION,bp,s_id) +#define i2d_SSL_SESSION_bio(bp,s_id) ASN1_i2d_bio_of(SSL_SESSION,i2d_SSL_SESSION,bp,s_id) + +SSL_SESSION *PEM_read_bio_SSL_SESSION(BIO *bp, SSL_SESSION **x, + pem_password_cb *cb, void *u); +SSL_SESSION *PEM_read_SSL_SESSION(FILE *fp, SSL_SESSION **x, + pem_password_cb *cb, void *u); +int PEM_write_bio_SSL_SESSION(BIO *bp, SSL_SESSION *x); +int PEM_write_SSL_SESSION(FILE *fp, SSL_SESSION *x); + +/* + * TLS Alerts. + * + * https://www.iana.org/assignments/tls-parameters/#tls-parameters-6 + */ + +/* Obsolete alerts. */ +#ifndef LIBRESSL_INTERNAL +#define SSL_AD_DECRYPTION_FAILED 21 /* Removed in TLSv1.1 */ +#define SSL_AD_NO_CERTIFICATE 41 /* Removed in TLSv1.0 */ +#define SSL_AD_EXPORT_RESTRICTION 60 /* Removed in TLSv1.1 */ +#endif + +#define SSL_AD_CLOSE_NOTIFY 0 +#define SSL_AD_UNEXPECTED_MESSAGE 10 +#define SSL_AD_BAD_RECORD_MAC 20 +#define SSL_AD_RECORD_OVERFLOW 22 +#define SSL_AD_DECOMPRESSION_FAILURE 30 /* Removed in TLSv1.3 */ +#define SSL_AD_HANDSHAKE_FAILURE 40 +#define SSL_AD_BAD_CERTIFICATE 42 +#define SSL_AD_UNSUPPORTED_CERTIFICATE 43 +#define SSL_AD_CERTIFICATE_REVOKED 44 +#define SSL_AD_CERTIFICATE_EXPIRED 45 +#define SSL_AD_CERTIFICATE_UNKNOWN 46 +#define SSL_AD_ILLEGAL_PARAMETER 47 +#define SSL_AD_UNKNOWN_CA 48 +#define SSL_AD_ACCESS_DENIED 49 +#define SSL_AD_DECODE_ERROR 50 +#define SSL_AD_DECRYPT_ERROR 51 +#define SSL_AD_PROTOCOL_VERSION 70 +#define SSL_AD_INSUFFICIENT_SECURITY 71 +#define SSL_AD_INTERNAL_ERROR 80 +#define SSL_AD_INAPPROPRIATE_FALLBACK 86 +#define SSL_AD_USER_CANCELLED 90 +#define SSL_AD_NO_RENEGOTIATION 100 /* Removed in TLSv1.3 */ +#define SSL_AD_MISSING_EXTENSION 109 /* Added in TLSv1.3. */ +#define SSL_AD_UNSUPPORTED_EXTENSION 110 +#define SSL_AD_CERTIFICATE_UNOBTAINABLE 111 /* Removed in TLSv1.3 */ +#define SSL_AD_UNRECOGNIZED_NAME 112 +#define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE 113 +#define SSL_AD_BAD_CERTIFICATE_HASH_VALUE 114 /* Removed in TLSv1.3 */ +#define SSL_AD_UNKNOWN_PSK_IDENTITY 115 +#define SSL_AD_CERTIFICATE_REQUIRED 116 +#define SSL_AD_NO_APPLICATION_PROTOCOL 120 + +/* Offset to get an SSL_R_... value from an SSL_AD_... value. */ +#define SSL_AD_REASON_OFFSET 1000 + +#define SSL_ERROR_NONE 0 +#define SSL_ERROR_SSL 1 +#define SSL_ERROR_WANT_READ 2 +#define SSL_ERROR_WANT_WRITE 3 +#define SSL_ERROR_WANT_X509_LOOKUP 4 +#define SSL_ERROR_SYSCALL 5 +#define SSL_ERROR_ZERO_RETURN 6 +#define SSL_ERROR_WANT_CONNECT 7 +#define SSL_ERROR_WANT_ACCEPT 8 +#define SSL_ERROR_WANT_ASYNC 9 +#define SSL_ERROR_WANT_ASYNC_JOB 10 +#define SSL_ERROR_WANT_CLIENT_HELLO_CB 11 + +#define SSL_CTRL_NEED_TMP_RSA 1 +#define SSL_CTRL_SET_TMP_RSA 2 +#define SSL_CTRL_SET_TMP_DH 3 +#define SSL_CTRL_SET_TMP_ECDH 4 +#define SSL_CTRL_SET_TMP_RSA_CB 5 +#define SSL_CTRL_SET_TMP_DH_CB 6 +#define SSL_CTRL_SET_TMP_ECDH_CB 7 + +#define SSL_CTRL_GET_SESSION_REUSED 8 +#define SSL_CTRL_GET_CLIENT_CERT_REQUEST 9 +#define SSL_CTRL_GET_NUM_RENEGOTIATIONS 10 +#define SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS 11 +#define SSL_CTRL_GET_TOTAL_RENEGOTIATIONS 12 +#define SSL_CTRL_GET_FLAGS 13 +#define SSL_CTRL_EXTRA_CHAIN_CERT 14 + +#define SSL_CTRL_SET_MSG_CALLBACK 15 +#define SSL_CTRL_SET_MSG_CALLBACK_ARG 16 + +/* only applies to datagram connections */ +#define SSL_CTRL_SET_MTU 17 +/* Stats */ +#define SSL_CTRL_SESS_NUMBER 20 +#define SSL_CTRL_SESS_CONNECT 21 +#define SSL_CTRL_SESS_CONNECT_GOOD 22 +#define SSL_CTRL_SESS_CONNECT_RENEGOTIATE 23 +#define SSL_CTRL_SESS_ACCEPT 24 +#define SSL_CTRL_SESS_ACCEPT_GOOD 25 +#define SSL_CTRL_SESS_ACCEPT_RENEGOTIATE 26 +#define SSL_CTRL_SESS_HIT 27 +#define SSL_CTRL_SESS_CB_HIT 28 +#define SSL_CTRL_SESS_MISSES 29 +#define SSL_CTRL_SESS_TIMEOUTS 30 +#define SSL_CTRL_SESS_CACHE_FULL 31 +#define SSL_CTRL_OPTIONS 32 +#define SSL_CTRL_MODE 33 + +#define SSL_CTRL_GET_READ_AHEAD 40 +#define SSL_CTRL_SET_READ_AHEAD 41 +#define SSL_CTRL_SET_SESS_CACHE_SIZE 42 +#define SSL_CTRL_GET_SESS_CACHE_SIZE 43 +#define SSL_CTRL_SET_SESS_CACHE_MODE 44 +#define SSL_CTRL_GET_SESS_CACHE_MODE 45 + +#define SSL_CTRL_GET_MAX_CERT_LIST 50 +#define SSL_CTRL_SET_MAX_CERT_LIST 51 + +#define SSL_CTRL_SET_MAX_SEND_FRAGMENT 52 + +/* see tls1.h for macros based on these */ +#define SSL_CTRL_SET_TLSEXT_SERVERNAME_CB 53 +#define SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG 54 +#define SSL_CTRL_SET_TLSEXT_HOSTNAME 55 +#define SSL_CTRL_SET_TLSEXT_DEBUG_CB 56 +#define SSL_CTRL_SET_TLSEXT_DEBUG_ARG 57 +#define SSL_CTRL_GET_TLSEXT_TICKET_KEYS 58 +#define SSL_CTRL_SET_TLSEXT_TICKET_KEYS 59 +#define SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB 128 +#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB 63 +#define SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB_ARG 129 +#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG 64 +#define SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE 127 +#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE 65 +#define SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS 66 +#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS 67 +#define SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS 68 +#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS 69 +#define SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP 70 +#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP 71 + +#define SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB 72 + +#define SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB 75 +#define SSL_CTRL_SET_SRP_VERIFY_PARAM_CB 76 +#define SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB 77 + +#define SSL_CTRL_SET_SRP_ARG 78 +#define SSL_CTRL_SET_TLS_EXT_SRP_USERNAME 79 +#define SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH 80 +#define SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD 81 + +#define DTLS_CTRL_GET_TIMEOUT 73 +#define DTLS_CTRL_HANDLE_TIMEOUT 74 +#define DTLS_CTRL_LISTEN 75 + +#define SSL_CTRL_GET_RI_SUPPORT 76 +#define SSL_CTRL_CLEAR_OPTIONS 77 +#define SSL_CTRL_CLEAR_MODE 78 + +#define SSL_CTRL_GET_EXTRA_CHAIN_CERTS 82 +#define SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS 83 + +#define SSL_CTRL_CHAIN 88 +#define SSL_CTRL_CHAIN_CERT 89 + +#define SSL_CTRL_SET_GROUPS 91 +#define SSL_CTRL_SET_GROUPS_LIST 92 +#define SSL_CTRL_GET_SHARED_GROUP 93 +#define SSL_CTRL_SET_ECDH_AUTO 94 + +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +#define SSL_CTRL_GET_PEER_SIGNATURE_NID 108 +#define SSL_CTRL_GET_PEER_TMP_KEY 109 +#define SSL_CTRL_GET_SERVER_TMP_KEY SSL_CTRL_GET_PEER_TMP_KEY +#else +#define SSL_CTRL_GET_SERVER_TMP_KEY 109 +#endif + +#define SSL_CTRL_GET_CHAIN_CERTS 115 + +#define SSL_CTRL_SET_DH_AUTO 118 + +#define SSL_CTRL_SET_MIN_PROTO_VERSION 123 +#define SSL_CTRL_SET_MAX_PROTO_VERSION 124 +#define SSL_CTRL_GET_MIN_PROTO_VERSION 130 +#define SSL_CTRL_GET_MAX_PROTO_VERSION 131 + +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +#define SSL_CTRL_GET_SIGNATURE_NID 132 +#endif + +#define DTLSv1_get_timeout(ssl, arg) \ + SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)arg) +#define DTLSv1_handle_timeout(ssl) \ + SSL_ctrl(ssl,DTLS_CTRL_HANDLE_TIMEOUT,0, NULL) +#define DTLSv1_listen(ssl, peer) \ + SSL_ctrl(ssl,DTLS_CTRL_LISTEN,0, (void *)peer) + +#define SSL_session_reused(ssl) \ + SSL_ctrl((ssl),SSL_CTRL_GET_SESSION_REUSED,0,NULL) +#define SSL_num_renegotiations(ssl) \ + SSL_ctrl((ssl),SSL_CTRL_GET_NUM_RENEGOTIATIONS,0,NULL) +#define SSL_clear_num_renegotiations(ssl) \ + SSL_ctrl((ssl),SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS,0,NULL) +#define SSL_total_renegotiations(ssl) \ + SSL_ctrl((ssl),SSL_CTRL_GET_TOTAL_RENEGOTIATIONS,0,NULL) + +#define SSL_CTX_need_tmp_RSA(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_NEED_TMP_RSA,0,NULL) +#define SSL_CTX_set_tmp_rsa(ctx,rsa) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_RSA,0,(char *)rsa) +#define SSL_CTX_set_tmp_dh(ctx,dh) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH,0,(char *)dh) +#define SSL_CTX_set_tmp_ecdh(ctx,ecdh) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH,0,(char *)ecdh) +#define SSL_CTX_set_dh_auto(ctx, onoff) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SET_DH_AUTO,onoff,NULL) +#define SSL_CTX_set_ecdh_auto(ctx, onoff) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SET_ECDH_AUTO,onoff,NULL) + +#define SSL_need_tmp_RSA(ssl) \ + SSL_ctrl(ssl,SSL_CTRL_NEED_TMP_RSA,0,NULL) +#define SSL_set_tmp_rsa(ssl,rsa) \ + SSL_ctrl(ssl,SSL_CTRL_SET_TMP_RSA,0,(char *)rsa) +#define SSL_set_tmp_dh(ssl,dh) \ + SSL_ctrl(ssl,SSL_CTRL_SET_TMP_DH,0,(char *)dh) +#define SSL_set_tmp_ecdh(ssl,ecdh) \ + SSL_ctrl(ssl,SSL_CTRL_SET_TMP_ECDH,0,(char *)ecdh) +#define SSL_set_dh_auto(s, onoff) \ + SSL_ctrl(s,SSL_CTRL_SET_DH_AUTO,onoff,NULL) +#define SSL_set_ecdh_auto(s, onoff) \ + SSL_ctrl(s,SSL_CTRL_SET_ECDH_AUTO,onoff,NULL) + +int SSL_CTX_set0_chain(SSL_CTX *ctx, STACK_OF(X509) *chain); +int SSL_CTX_set1_chain(SSL_CTX *ctx, STACK_OF(X509) *chain); +int SSL_CTX_add0_chain_cert(SSL_CTX *ctx, X509 *x509); +int SSL_CTX_add1_chain_cert(SSL_CTX *ctx, X509 *x509); +int SSL_CTX_get0_chain_certs(const SSL_CTX *ctx, STACK_OF(X509) **out_chain); +int SSL_CTX_clear_chain_certs(SSL_CTX *ctx); + +int SSL_set0_chain(SSL *ssl, STACK_OF(X509) *chain); +int SSL_set1_chain(SSL *ssl, STACK_OF(X509) *chain); +int SSL_add0_chain_cert(SSL *ssl, X509 *x509); +int SSL_add1_chain_cert(SSL *ssl, X509 *x509); +int SSL_get0_chain_certs(const SSL *ssl, STACK_OF(X509) **out_chain); +int SSL_clear_chain_certs(SSL *ssl); + +int SSL_CTX_set1_groups(SSL_CTX *ctx, const int *groups, size_t groups_len); +int SSL_CTX_set1_groups_list(SSL_CTX *ctx, const char *groups); + +int SSL_set1_groups(SSL *ssl, const int *groups, size_t groups_len); +int SSL_set1_groups_list(SSL *ssl, const char *groups); + +int SSL_CTX_get_min_proto_version(SSL_CTX *ctx); +int SSL_CTX_get_max_proto_version(SSL_CTX *ctx); +int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, uint16_t version); +int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, uint16_t version); + +int SSL_get_min_proto_version(SSL *ssl); +int SSL_get_max_proto_version(SSL *ssl); +int SSL_set_min_proto_version(SSL *ssl, uint16_t version); +int SSL_set_max_proto_version(SSL *ssl, uint16_t version); + +const SSL_METHOD *SSL_CTX_get_ssl_method(const SSL_CTX *ctx); + +#ifndef LIBRESSL_INTERNAL +#define SSL_CTRL_SET_CURVES SSL_CTRL_SET_GROUPS +#define SSL_CTRL_SET_CURVES_LIST SSL_CTRL_SET_GROUPS_LIST + +#define SSL_CTX_set1_curves SSL_CTX_set1_groups +#define SSL_CTX_set1_curves_list SSL_CTX_set1_groups_list +#define SSL_set1_curves SSL_set1_groups +#define SSL_set1_curves_list SSL_set1_groups_list +#endif + +#define SSL_CTX_add_extra_chain_cert(ctx, x509) \ + SSL_CTX_ctrl(ctx, SSL_CTRL_EXTRA_CHAIN_CERT, 0, (char *)x509) +#define SSL_CTX_get_extra_chain_certs(ctx, px509) \ + SSL_CTX_ctrl(ctx, SSL_CTRL_GET_EXTRA_CHAIN_CERTS, 0, px509) +#define SSL_CTX_get_extra_chain_certs_only(ctx, px509) \ + SSL_CTX_ctrl(ctx, SSL_CTRL_GET_EXTRA_CHAIN_CERTS, 1, px509) +#define SSL_CTX_clear_extra_chain_certs(ctx) \ + SSL_CTX_ctrl(ctx, SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS, 0, NULL) + +#define SSL_get_shared_group(s, n) \ + SSL_ctrl((s), SSL_CTRL_GET_SHARED_GROUP, (n), NULL) +#define SSL_get_shared_curve SSL_get_shared_group + +#define SSL_get_server_tmp_key(s, pk) \ + SSL_ctrl(s,SSL_CTRL_GET_SERVER_TMP_KEY,0,pk) + +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +#define SSL_get_signature_nid(s, pn) \ + SSL_ctrl(s, SSL_CTRL_GET_SIGNATURE_NID, 0, pn) + +#define SSL_get_peer_signature_nid(s, pn) \ + SSL_ctrl(s, SSL_CTRL_GET_PEER_SIGNATURE_NID, 0, pn) +#define SSL_get_peer_tmp_key(s, pk) \ + SSL_ctrl(s, SSL_CTRL_GET_PEER_TMP_KEY, 0, pk) +#endif /* LIBRESSL_HAS_TLS1_3 || LIBRESSL_INTERNAL */ + +#ifndef LIBRESSL_INTERNAL +/* + * Also provide those functions as macros for compatibility with + * existing users. + */ +#define SSL_CTX_set0_chain SSL_CTX_set0_chain +#define SSL_CTX_set1_chain SSL_CTX_set1_chain +#define SSL_CTX_add0_chain_cert SSL_CTX_add0_chain_cert +#define SSL_CTX_add1_chain_cert SSL_CTX_add1_chain_cert +#define SSL_CTX_get0_chain_certs SSL_CTX_get0_chain_certs +#define SSL_CTX_clear_chain_certs SSL_CTX_clear_chain_certs + +#define SSL_add0_chain_cert SSL_add0_chain_cert +#define SSL_add1_chain_cert SSL_add1_chain_cert +#define SSL_set0_chain SSL_set0_chain +#define SSL_set1_chain SSL_set1_chain +#define SSL_get0_chain_certs SSL_get0_chain_certs +#define SSL_clear_chain_certs SSL_clear_chain_certs + +#define SSL_CTX_set1_groups SSL_CTX_set1_groups +#define SSL_CTX_set1_groups_list SSL_CTX_set1_groups_list +#define SSL_set1_groups SSL_set1_groups +#define SSL_set1_groups_list SSL_set1_groups_list + +#define SSL_CTX_get_min_proto_version SSL_CTX_get_min_proto_version +#define SSL_CTX_get_max_proto_version SSL_CTX_get_max_proto_version +#define SSL_CTX_set_min_proto_version SSL_CTX_set_min_proto_version +#define SSL_CTX_set_max_proto_version SSL_CTX_set_max_proto_version + +#define SSL_get_min_proto_version SSL_get_min_proto_version +#define SSL_get_max_proto_version SSL_get_max_proto_version +#define SSL_set_min_proto_version SSL_set_min_proto_version +#define SSL_set_max_proto_version SSL_set_max_proto_version +#endif + +const BIO_METHOD *BIO_f_ssl(void); +BIO *BIO_new_ssl(SSL_CTX *ctx, int client); +BIO *BIO_new_ssl_connect(SSL_CTX *ctx); +BIO *BIO_new_buffer_ssl_connect(SSL_CTX *ctx); +int BIO_ssl_copy_session_id(BIO *to, BIO *from); +void BIO_ssl_shutdown(BIO *ssl_bio); + +STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx); +int SSL_CTX_set_cipher_list(SSL_CTX *, const char *str); +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +int SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str); +#endif +SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth); +void SSL_CTX_free(SSL_CTX *); +int SSL_CTX_up_ref(SSL_CTX *ctx); +long SSL_CTX_set_timeout(SSL_CTX *ctx, long t); +long SSL_CTX_get_timeout(const SSL_CTX *ctx); +X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *); +void SSL_CTX_set_cert_store(SSL_CTX *, X509_STORE *); +void SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store); +X509 *SSL_CTX_get0_certificate(const SSL_CTX *ctx); +EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx); +int SSL_want(const SSL *s); +int SSL_clear(SSL *s); + +void SSL_CTX_flush_sessions(SSL_CTX *ctx, long tm); + +const SSL_CIPHER *SSL_get_current_cipher(const SSL *s); +int SSL_CIPHER_get_bits(const SSL_CIPHER *c, int *alg_bits); +const char * SSL_CIPHER_get_version(const SSL_CIPHER *c); +const char * SSL_CIPHER_get_name(const SSL_CIPHER *c); +unsigned long SSL_CIPHER_get_id(const SSL_CIPHER *c); +uint16_t SSL_CIPHER_get_value(const SSL_CIPHER *c); +const SSL_CIPHER *SSL_CIPHER_find(SSL *ssl, const unsigned char *ptr); +int SSL_CIPHER_get_cipher_nid(const SSL_CIPHER *c); +int SSL_CIPHER_get_digest_nid(const SSL_CIPHER *c); +int SSL_CIPHER_get_kx_nid(const SSL_CIPHER *c); +int SSL_CIPHER_get_auth_nid(const SSL_CIPHER *c); +const EVP_MD *SSL_CIPHER_get_handshake_digest(const SSL_CIPHER *c); +int SSL_CIPHER_is_aead(const SSL_CIPHER *c); + +int SSL_get_fd(const SSL *s); +int SSL_get_rfd(const SSL *s); +int SSL_get_wfd(const SSL *s); +const char * SSL_get_cipher_list(const SSL *s, int n); +char * SSL_get_shared_ciphers(const SSL *s, char *buf, int len); +int SSL_get_read_ahead(const SSL * s); +int SSL_pending(const SSL *s); +int SSL_set_fd(SSL *s, int fd); +int SSL_set_rfd(SSL *s, int fd); +int SSL_set_wfd(SSL *s, int fd); +void SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio); +BIO * SSL_get_rbio(const SSL *s); +void SSL_set0_rbio(SSL *s, BIO *rbio); +BIO * SSL_get_wbio(const SSL *s); +int SSL_set_cipher_list(SSL *s, const char *str); +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +int SSL_set_ciphersuites(SSL *s, const char *str); +#endif +void SSL_set_read_ahead(SSL *s, int yes); +int SSL_get_verify_mode(const SSL *s); +int SSL_get_verify_depth(const SSL *s); +int (*SSL_get_verify_callback(const SSL *s))(int, X509_STORE_CTX *); +void SSL_set_verify(SSL *s, int mode, + int (*callback)(int ok, X509_STORE_CTX *ctx)); +void SSL_set_verify_depth(SSL *s, int depth); +int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa); +int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, const unsigned char *d, long len); +int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey); +int SSL_use_PrivateKey_ASN1(int pk, SSL *ssl, const unsigned char *d, long len); +int SSL_use_certificate(SSL *ssl, X509 *x); +int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len); + +int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type); +int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type); +int SSL_use_certificate_file(SSL *ssl, const char *file, int type); +int SSL_use_certificate_chain_file(SSL *ssl, const char *file); +int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type); +int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type); +int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type); +int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file); /* PEM type */ +int SSL_CTX_use_certificate_chain_mem(SSL_CTX *ctx, void *buf, int len); +STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file); +int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stackCAs, + const char *file); +int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stackCAs, + const char *dir); + +void SSL_load_error_strings(void ); +const char *SSL_state_string(const SSL *s); +const char *SSL_rstate_string(const SSL *s); +const char *SSL_state_string_long(const SSL *s); +const char *SSL_rstate_string_long(const SSL *s); +const SSL_CIPHER *SSL_SESSION_get0_cipher(const SSL_SESSION *ss); +size_t SSL_SESSION_get_master_key(const SSL_SESSION *ss, + unsigned char *out, size_t max_out); +int SSL_SESSION_get_protocol_version(const SSL_SESSION *s); +long SSL_SESSION_get_time(const SSL_SESSION *s); +long SSL_SESSION_set_time(SSL_SESSION *s, long t); +long SSL_SESSION_get_timeout(const SSL_SESSION *s); +long SSL_SESSION_set_timeout(SSL_SESSION *s, long t); +int SSL_copy_session_id(SSL *to, const SSL *from); +X509 *SSL_SESSION_get0_peer(SSL_SESSION *s); +int SSL_SESSION_set1_id(SSL_SESSION *s, const unsigned char *sid, + unsigned int sid_len); +int SSL_SESSION_set1_id_context(SSL_SESSION *s, + const unsigned char *sid_ctx, unsigned int sid_ctx_len); +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +int SSL_SESSION_is_resumable(const SSL_SESSION *s); +#endif + +SSL_SESSION *SSL_SESSION_new(void); +void SSL_SESSION_free(SSL_SESSION *ses); +int SSL_SESSION_up_ref(SSL_SESSION *ss); +const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *ss, + unsigned int *len); +const unsigned char *SSL_SESSION_get0_id_context(const SSL_SESSION *ss, + unsigned int *len); +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +uint32_t SSL_SESSION_get_max_early_data(const SSL_SESSION *sess); +int SSL_SESSION_set_max_early_data(SSL_SESSION *sess, uint32_t max_early_data); +#endif +unsigned long SSL_SESSION_get_ticket_lifetime_hint(const SSL_SESSION *s); +int SSL_SESSION_has_ticket(const SSL_SESSION *s); +unsigned int SSL_SESSION_get_compress_id(const SSL_SESSION *ss); +int SSL_SESSION_print_fp(FILE *fp, const SSL_SESSION *ses); +int SSL_SESSION_print(BIO *fp, const SSL_SESSION *ses); +int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp); +int SSL_set_session(SSL *to, SSL_SESSION *session); +int SSL_CTX_add_session(SSL_CTX *s, SSL_SESSION *c); +int SSL_CTX_remove_session(SSL_CTX *, SSL_SESSION *c); +int SSL_CTX_set_generate_session_id(SSL_CTX *, GEN_SESSION_CB); +int SSL_set_generate_session_id(SSL *, GEN_SESSION_CB); +int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id, + unsigned int id_len); +SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, + long length); + +#ifdef HEADER_X509_H +X509 * SSL_get_peer_certificate(const SSL *s); +#endif + +STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s); + +int SSL_CTX_get_verify_mode(const SSL_CTX *ctx); +int SSL_CTX_get_verify_depth(const SSL_CTX *ctx); +int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx))(int, X509_STORE_CTX *); +void SSL_CTX_set_verify(SSL_CTX *ctx, int mode, + int (*callback)(int, X509_STORE_CTX *)); +void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth); +void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, int (*cb)(X509_STORE_CTX *, void *), void *arg); +int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa); +int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len); +int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey); +int SSL_CTX_use_PrivateKey_ASN1(int pk, SSL_CTX *ctx, const unsigned char *d, long len); +int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x); +int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d); + +pem_password_cb *SSL_CTX_get_default_passwd_cb(SSL_CTX *ctx); +void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb); +void *SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX *ctx); +void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u); + +int SSL_CTX_check_private_key(const SSL_CTX *ctx); +int SSL_check_private_key(const SSL *ctx); + +int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx, unsigned int sid_ctx_len); + +int SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx, unsigned int sid_ctx_len); + +int SSL_CTX_set_purpose(SSL_CTX *s, int purpose); +int SSL_set_purpose(SSL *s, int purpose); +int SSL_CTX_set_trust(SSL_CTX *s, int trust); +int SSL_set_trust(SSL *s, int trust); +int SSL_set1_host(SSL *s, const char *hostname); +void SSL_set_hostflags(SSL *s, unsigned int flags); +const char *SSL_get0_peername(SSL *s); + +X509_VERIFY_PARAM *SSL_CTX_get0_param(SSL_CTX *ctx); +int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm); +X509_VERIFY_PARAM *SSL_get0_param(SSL *ssl); +int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm); + +SSL *SSL_new(SSL_CTX *ctx); +void SSL_free(SSL *ssl); +int SSL_up_ref(SSL *ssl); +int SSL_accept(SSL *ssl); +int SSL_connect(SSL *ssl); +int SSL_is_dtls(const SSL *s); +int SSL_is_server(const SSL *s); +int SSL_read(SSL *ssl, void *buf, int num); +int SSL_peek(SSL *ssl, void *buf, int num); +int SSL_write(SSL *ssl, const void *buf, int num); +int SSL_read_ex(SSL *ssl, void *buf, size_t num, size_t *bytes_read); +int SSL_peek_ex(SSL *ssl, void *buf, size_t num, size_t *bytes_peeked); +int SSL_write_ex(SSL *ssl, const void *buf, size_t num, size_t *bytes_written); + +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +uint32_t SSL_CTX_get_max_early_data(const SSL_CTX *ctx); +int SSL_CTX_set_max_early_data(SSL_CTX *ctx, uint32_t max_early_data); + +uint32_t SSL_get_max_early_data(const SSL *s); +int SSL_set_max_early_data(SSL *s, uint32_t max_early_data); + +#define SSL_EARLY_DATA_NOT_SENT 0 +#define SSL_EARLY_DATA_REJECTED 1 +#define SSL_EARLY_DATA_ACCEPTED 2 +int SSL_get_early_data_status(const SSL *s); + +#define SSL_READ_EARLY_DATA_ERROR 0 +#define SSL_READ_EARLY_DATA_SUCCESS 1 +#define SSL_READ_EARLY_DATA_FINISH 2 +int SSL_read_early_data(SSL *s, void *buf, size_t num, size_t *readbytes); +int SSL_write_early_data(SSL *s, const void *buf, size_t num, size_t *written); +#endif + +long SSL_ctrl(SSL *ssl, int cmd, long larg, void *parg); +long SSL_callback_ctrl(SSL *, int, void (*)(void)); +long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg); +long SSL_CTX_callback_ctrl(SSL_CTX *, int, void (*)(void)); + +int SSL_get_error(const SSL *s, int ret_code); +const char *SSL_get_version(const SSL *s); + +/* This sets the 'default' SSL version that SSL_new() will create */ +int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth); + +const SSL_METHOD *SSLv23_method(void); /* SSLv3 or TLSv1.* */ +const SSL_METHOD *SSLv23_server_method(void); /* SSLv3 or TLSv1.* */ +const SSL_METHOD *SSLv23_client_method(void); /* SSLv3 or TLSv1.* */ + +const SSL_METHOD *TLSv1_method(void); /* TLSv1.0 */ +const SSL_METHOD *TLSv1_server_method(void); /* TLSv1.0 */ +const SSL_METHOD *TLSv1_client_method(void); /* TLSv1.0 */ + +const SSL_METHOD *TLSv1_1_method(void); /* TLSv1.1 */ +const SSL_METHOD *TLSv1_1_server_method(void); /* TLSv1.1 */ +const SSL_METHOD *TLSv1_1_client_method(void); /* TLSv1.1 */ + +const SSL_METHOD *TLSv1_2_method(void); /* TLSv1.2 */ +const SSL_METHOD *TLSv1_2_server_method(void); /* TLSv1.2 */ +const SSL_METHOD *TLSv1_2_client_method(void); /* TLSv1.2 */ + +const SSL_METHOD *TLS_method(void); /* TLS v1.0 or later */ +const SSL_METHOD *TLS_server_method(void); /* TLS v1.0 or later */ +const SSL_METHOD *TLS_client_method(void); /* TLS v1.0 or later */ + +const SSL_METHOD *DTLSv1_method(void); /* DTLSv1.0 */ +const SSL_METHOD *DTLSv1_server_method(void); /* DTLSv1.0 */ +const SSL_METHOD *DTLSv1_client_method(void); /* DTLSv1.0 */ + +const SSL_METHOD *DTLSv1_2_method(void); /* DTLSv1.2 */ +const SSL_METHOD *DTLSv1_2_server_method(void); /* DTLSv1.2 */ +const SSL_METHOD *DTLSv1_2_client_method(void); /* DTLSv1.2 */ + +const SSL_METHOD *DTLS_method(void); /* DTLS v1.0 or later */ +const SSL_METHOD *DTLS_server_method(void); /* DTLS v1.0 or later */ +const SSL_METHOD *DTLS_client_method(void); /* DTLS v1.0 or later */ + +STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s); +STACK_OF(SSL_CIPHER) *SSL_get_client_ciphers(const SSL *s); +STACK_OF(SSL_CIPHER) *SSL_get1_supported_ciphers(SSL *s); + +int SSL_do_handshake(SSL *s); +int SSL_renegotiate(SSL *s); +int SSL_renegotiate_abbreviated(SSL *s); +int SSL_renegotiate_pending(SSL *s); +int SSL_shutdown(SSL *s); + +const SSL_METHOD *SSL_get_ssl_method(SSL *s); +int SSL_set_ssl_method(SSL *s, const SSL_METHOD *method); +const char *SSL_alert_type_string_long(int value); +const char *SSL_alert_type_string(int value); +const char *SSL_alert_desc_string_long(int value); +const char *SSL_alert_desc_string(int value); + +void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list); +void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list); +STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s); +STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *s); +int SSL_add_client_CA(SSL *ssl, X509 *x); +int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x); + +void SSL_set_connect_state(SSL *s); +void SSL_set_accept_state(SSL *s); + +long SSL_get_default_timeout(const SSL *s); + +char *SSL_CIPHER_description(const SSL_CIPHER *, char *buf, int size); +STACK_OF(X509_NAME) *SSL_dup_CA_list(const STACK_OF(X509_NAME) *sk); + +SSL *SSL_dup(SSL *ssl); + +X509 *SSL_get_certificate(const SSL *ssl); +/* EVP_PKEY */ struct evp_pkey_st *SSL_get_privatekey(const SSL *ssl); + +void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx,int mode); +int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx); +void SSL_set_quiet_shutdown(SSL *ssl,int mode); +int SSL_get_quiet_shutdown(const SSL *ssl); +void SSL_set_shutdown(SSL *ssl,int mode); +int SSL_get_shutdown(const SSL *ssl); +int SSL_version(const SSL *ssl); +int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx); +int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, + const char *CApath); +int SSL_CTX_load_verify_mem(SSL_CTX *ctx, void *buf, int len); +#define SSL_get0_session SSL_get_session /* just peek at pointer */ +SSL_SESSION *SSL_get_session(const SSL *ssl); +SSL_SESSION *SSL_get1_session(SSL *ssl); /* obtain a reference count */ +SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl); +SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx); +void SSL_set_info_callback(SSL *ssl, + void (*cb)(const SSL *ssl, int type, int val)); +void (*SSL_get_info_callback(const SSL *ssl))(const SSL *ssl, int type, int val); +int SSL_state(const SSL *ssl); +void SSL_set_state(SSL *ssl, int state); + +void SSL_set_verify_result(SSL *ssl, long v); +long SSL_get_verify_result(const SSL *ssl); + +int SSL_set_ex_data(SSL *ssl, int idx, void *data); +void *SSL_get_ex_data(const SSL *ssl, int idx); +int SSL_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, + CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); + +int SSL_SESSION_set_ex_data(SSL_SESSION *ss, int idx, void *data); +void *SSL_SESSION_get_ex_data(const SSL_SESSION *ss, int idx); +int SSL_SESSION_get_ex_new_index(long argl, void *argp, + CRYPTO_EX_new *new_func, CRYPTO_EX_dup *dup_func, + CRYPTO_EX_free *free_func); + +int SSL_CTX_set_ex_data(SSL_CTX *ssl, int idx, void *data); +void *SSL_CTX_get_ex_data(const SSL_CTX *ssl, int idx); +int SSL_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, + CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); + +int SSL_get_ex_data_X509_STORE_CTX_idx(void ); + +#define SSL_CTX_sess_set_cache_size(ctx,t) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_SIZE,t,NULL) +#define SSL_CTX_sess_get_cache_size(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_GET_SESS_CACHE_SIZE,0,NULL) +#define SSL_CTX_set_session_cache_mode(ctx,m) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_MODE,m,NULL) +#define SSL_CTX_get_session_cache_mode(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_GET_SESS_CACHE_MODE,0,NULL) + +#define SSL_CTX_get_default_read_ahead(ctx) SSL_CTX_get_read_ahead(ctx) +#define SSL_CTX_set_default_read_ahead(ctx,m) SSL_CTX_set_read_ahead(ctx,m) +#define SSL_CTX_get_read_ahead(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_GET_READ_AHEAD,0,NULL) +#define SSL_CTX_set_read_ahead(ctx,m) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SET_READ_AHEAD,m,NULL) +#define SSL_CTX_get_max_cert_list(ctx) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_GET_MAX_CERT_LIST,0,NULL) +#define SSL_CTX_set_max_cert_list(ctx,m) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SET_MAX_CERT_LIST,m,NULL) +#define SSL_get_max_cert_list(ssl) \ + SSL_ctrl(ssl,SSL_CTRL_GET_MAX_CERT_LIST,0,NULL) +#define SSL_set_max_cert_list(ssl,m) \ + SSL_ctrl(ssl,SSL_CTRL_SET_MAX_CERT_LIST,m,NULL) + +#define SSL_CTX_set_max_send_fragment(ctx,m) \ + SSL_CTX_ctrl(ctx,SSL_CTRL_SET_MAX_SEND_FRAGMENT,m,NULL) +#define SSL_set_max_send_fragment(ssl,m) \ + SSL_ctrl(ssl,SSL_CTRL_SET_MAX_SEND_FRAGMENT,m,NULL) + +/* NB: the keylength is only applicable when is_export is true */ +void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx, + RSA *(*cb)(SSL *ssl, int is_export, int keylength)); + +void SSL_set_tmp_rsa_callback(SSL *ssl, + RSA *(*cb)(SSL *ssl, int is_export, int keylength)); +void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx, + DH *(*dh)(SSL *ssl, int is_export, int keylength)); +void SSL_set_tmp_dh_callback(SSL *ssl, + DH *(*dh)(SSL *ssl, int is_export, int keylength)); +void SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx, + EC_KEY *(*ecdh)(SSL *ssl, int is_export, int keylength)); +void SSL_set_tmp_ecdh_callback(SSL *ssl, + EC_KEY *(*ecdh)(SSL *ssl, int is_export, int keylength)); + +size_t SSL_get_client_random(const SSL *s, unsigned char *out, size_t max_out); +size_t SSL_get_server_random(const SSL *s, unsigned char *out, size_t max_out); + +const void *SSL_get_current_compression(SSL *s); +const void *SSL_get_current_expansion(SSL *s); + +const char *SSL_COMP_get_name(const void *comp); +void *SSL_COMP_get_compression_methods(void); + +/* TLS extensions functions */ +int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len); + +int SSL_set_session_ticket_ext_cb(SSL *s, + tls_session_ticket_ext_cb_fn cb, void *arg); + +/* Pre-shared secret session resumption functions */ +int SSL_set_session_secret_cb(SSL *s, + tls_session_secret_cb_fn tls_session_secret_cb, void *arg); + +int SSL_cache_hit(SSL *s); + +/* What the "other" parameter contains in security callback */ +/* Mask for type */ +#define SSL_SECOP_OTHER_TYPE 0xffff0000 +#define SSL_SECOP_OTHER_NONE 0 +#define SSL_SECOP_OTHER_CIPHER (1 << 16) +#define SSL_SECOP_OTHER_CURVE (2 << 16) +#define SSL_SECOP_OTHER_DH (3 << 16) +#define SSL_SECOP_OTHER_PKEY (4 << 16) +#define SSL_SECOP_OTHER_SIGALG (5 << 16) +#define SSL_SECOP_OTHER_CERT (6 << 16) + +/* Indicated operation refers to peer key or certificate */ +#define SSL_SECOP_PEER 0x1000 + +/* Values for "op" parameter in security callback */ + +/* Called to filter ciphers */ +/* Ciphers client supports */ +#define SSL_SECOP_CIPHER_SUPPORTED (1 | SSL_SECOP_OTHER_CIPHER) +/* Cipher shared by client/server */ +#define SSL_SECOP_CIPHER_SHARED (2 | SSL_SECOP_OTHER_CIPHER) +/* Sanity check of cipher server selects */ +#define SSL_SECOP_CIPHER_CHECK (3 | SSL_SECOP_OTHER_CIPHER) +/* Curves supported by client */ +#define SSL_SECOP_CURVE_SUPPORTED (4 | SSL_SECOP_OTHER_CURVE) +/* Curves shared by client/server */ +#define SSL_SECOP_CURVE_SHARED (5 | SSL_SECOP_OTHER_CURVE) +/* Sanity check of curve server selects */ +#define SSL_SECOP_CURVE_CHECK (6 | SSL_SECOP_OTHER_CURVE) +/* Temporary DH key */ +/* + * XXX: changed in OpenSSL e2b420fdd70 to (7 | SSL_SECOP_OTHER_PKEY) + * Needs switching internal use of DH to EVP_PKEY. The code is not reachable + * from outside the library as long as we do not expose the callback in the API. + */ +#define SSL_SECOP_TMP_DH (7 | SSL_SECOP_OTHER_DH) +/* SSL/TLS version */ +#define SSL_SECOP_VERSION (9 | SSL_SECOP_OTHER_NONE) +/* Session tickets */ +#define SSL_SECOP_TICKET (10 | SSL_SECOP_OTHER_NONE) +/* Supported signature algorithms sent to peer */ +#define SSL_SECOP_SIGALG_SUPPORTED (11 | SSL_SECOP_OTHER_SIGALG) +/* Shared signature algorithm */ +#define SSL_SECOP_SIGALG_SHARED (12 | SSL_SECOP_OTHER_SIGALG) +/* Sanity check signature algorithm allowed */ +#define SSL_SECOP_SIGALG_CHECK (13 | SSL_SECOP_OTHER_SIGALG) +/* Used to get mask of supported public key signature algorithms */ +#define SSL_SECOP_SIGALG_MASK (14 | SSL_SECOP_OTHER_SIGALG) +/* Use to see if compression is allowed */ +#define SSL_SECOP_COMPRESSION (15 | SSL_SECOP_OTHER_NONE) +/* EE key in certificate */ +#define SSL_SECOP_EE_KEY (16 | SSL_SECOP_OTHER_CERT) +/* CA key in certificate */ +#define SSL_SECOP_CA_KEY (17 | SSL_SECOP_OTHER_CERT) +/* CA digest algorithm in certificate */ +#define SSL_SECOP_CA_MD (18 | SSL_SECOP_OTHER_CERT) +/* Peer EE key in certificate */ +#define SSL_SECOP_PEER_EE_KEY (SSL_SECOP_EE_KEY | SSL_SECOP_PEER) +/* Peer CA key in certificate */ +#define SSL_SECOP_PEER_CA_KEY (SSL_SECOP_CA_KEY | SSL_SECOP_PEER) +/* Peer CA digest algorithm in certificate */ +#define SSL_SECOP_PEER_CA_MD (SSL_SECOP_CA_MD | SSL_SECOP_PEER) + +void SSL_set_security_level(SSL *ssl, int level); +int SSL_get_security_level(const SSL *ssl); + +void SSL_CTX_set_security_level(SSL_CTX *ctx, int level); +int SSL_CTX_get_security_level(const SSL_CTX *ctx); + +#if defined(LIBRESSL_HAS_QUIC) || defined(LIBRESSL_INTERNAL) +/* + * QUIC integration. + * + * QUIC acts as an underlying transport for the TLS 1.3 handshake. The following + * functions allow a QUIC implementation to serve as the underlying transport as + * described in RFC 9001. + * + * When configured for QUIC, |SSL_do_handshake| will drive the handshake as + * before, but it will not use the configured |BIO|. It will call functions on + * |SSL_QUIC_METHOD| to configure secrets and send data. If data is needed from + * the peer, it will return |SSL_ERROR_WANT_READ|. As the caller receives data + * it can decrypt, it calls |SSL_provide_quic_data|. Subsequent + * |SSL_do_handshake| calls will then consume that data and progress the + * handshake. After the handshake is complete, the caller should continue to + * call |SSL_provide_quic_data| for any post-handshake data, followed by + * |SSL_process_quic_post_handshake| to process it. It is an error to call + * |SSL_peek|, |SSL_read| and |SSL_write| in QUIC. + * + * To avoid DoS attacks, the QUIC implementation must limit the amount of data + * being queued up. The implementation can call + * |SSL_quic_max_handshake_flight_len| to get the maximum buffer length at each + * encryption level. + * + * QUIC implementations must additionally configure transport parameters with + * |SSL_set_quic_transport_params|. |SSL_get_peer_quic_transport_params| may be + * used to query the value received from the peer. This extension is handled + * as an opaque byte string, which the caller is responsible for serializing + * and parsing. See RFC 9000 section 7.4 for further details. + */ + +/* + * ssl_encryption_level_t specifies the QUIC encryption level used to transmit + * handshake messages. + */ +typedef enum ssl_encryption_level_t { + ssl_encryption_initial = 0, + ssl_encryption_early_data, + ssl_encryption_handshake, + ssl_encryption_application, +} OSSL_ENCRYPTION_LEVEL; + +/* + * ssl_quic_method_st (aka |SSL_QUIC_METHOD|) describes custom QUIC hooks. + * + * Note that we provide both the new (BoringSSL) secrets interface + * (set_read_secret/set_write_secret) along with the old interface + * (set_encryption_secrets), which quictls is still using. + * + * Since some consumers fail to use named initialisers, the order of these + * functions is important. Hopefully all of these consumers use the old version. + */ +struct ssl_quic_method_st { + /* + * set_encryption_secrets configures the read and write secrets for the + * given encryption level. This function will always be called before an + * encryption level other than |ssl_encryption_initial| is used. + * + * When reading packets at a given level, the QUIC implementation must + * send ACKs at the same level, so this function provides read and write + * secrets together. The exception is |ssl_encryption_early_data|, where + * secrets are only available in the client to server direction. The + * other secret will be NULL. The server acknowledges such data at + * |ssl_encryption_application|, which will be configured in the same + * |SSL_do_handshake| call. + * + * This function should use |SSL_get_current_cipher| to determine the TLS + * cipher suite. + */ + int (*set_encryption_secrets)(SSL *ssl, enum ssl_encryption_level_t level, + const uint8_t *read_secret, const uint8_t *write_secret, + size_t secret_len); + + /* + * add_handshake_data adds handshake data to the current flight at the + * given encryption level. It returns one on success and zero on error. + * Callers should defer writing data to the network until |flush_flight| + * to better pack QUIC packets into transport datagrams. + * + * If |level| is not |ssl_encryption_initial|, this function will not be + * called before |level| is initialized with |set_write_secret|. + */ + int (*add_handshake_data)(SSL *ssl, enum ssl_encryption_level_t level, + const uint8_t *data, size_t len); + + /* + * flush_flight is called when the current flight is complete and should + * be written to the transport. Note a flight may contain data at + * several encryption levels. It returns one on success and zero on + * error. + */ + int (*flush_flight)(SSL *ssl); + + /* + * send_alert sends a fatal alert at the specified encryption level. It + * returns one on success and zero on error. + * + * If |level| is not |ssl_encryption_initial|, this function will not be + * called before |level| is initialized with |set_write_secret|. + */ + int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, + uint8_t alert); + + /* + * set_read_secret configures the read secret and cipher suite for the + * given encryption level. It returns one on success and zero to + * terminate the handshake with an error. It will be called at most once + * per encryption level. + * + * Read keys will not be released before QUIC may use them. Once a level + * has been initialized, QUIC may begin processing data from it. + * Handshake data should be passed to |SSL_provide_quic_data| and + * application data (if |level| is |ssl_encryption_early_data| or + * |ssl_encryption_application|) may be processed according to the rules + * of the QUIC protocol. + */ + int (*set_read_secret)(SSL *ssl, enum ssl_encryption_level_t level, + const SSL_CIPHER *cipher, const uint8_t *secret, size_t secret_len); + + /* + * set_write_secret behaves like |set_read_secret| but configures the + * write secret and cipher suite for the given encryption level. It will + * be called at most once per encryption level. + * + * Write keys will not be released before QUIC may use them. If |level| + * is |ssl_encryption_early_data| or |ssl_encryption_application|, QUIC + * may begin sending application data at |level|. + */ + int (*set_write_secret)(SSL *ssl, enum ssl_encryption_level_t level, + const SSL_CIPHER *cipher, const uint8_t *secret, size_t secret_len); +}; + +/* + * SSL_CTX_set_quic_method configures the QUIC hooks. This should only be + * configured with a minimum version of TLS 1.3. |quic_method| must remain valid + * for the lifetime of |ctx|. It returns one on success and zero on error. + */ +int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method); + +/* + * SSL_set_quic_method configures the QUIC hooks. This should only be + * configured with a minimum version of TLS 1.3. |quic_method| must remain valid + * for the lifetime of |ssl|. It returns one on success and zero on error. + */ +int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method); + +/* SSL_is_quic returns true if an SSL has been configured for use with QUIC. */ +int SSL_is_quic(const SSL *ssl); + +/* + * SSL_quic_max_handshake_flight_len returns returns the maximum number of bytes + * that may be received at the given encryption level. This function should be + * used to limit buffering in the QUIC implementation. See RFC 9000 section 7.5. + */ +size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, + enum ssl_encryption_level_t level); + +/* + * SSL_quic_read_level returns the current read encryption level. + */ +enum ssl_encryption_level_t SSL_quic_read_level(const SSL *ssl); + +/* + * SSL_quic_write_level returns the current write encryption level. + */ +enum ssl_encryption_level_t SSL_quic_write_level(const SSL *ssl); + +/* + * SSL_provide_quic_data provides data from QUIC at a particular encryption + * level |level|. It returns one on success and zero on error. Note this + * function will return zero if the handshake is not expecting data from |level| + * at this time. The QUIC implementation should then close the connection with + * an error. + */ +int SSL_provide_quic_data(SSL *ssl, enum ssl_encryption_level_t level, + const uint8_t *data, size_t len); + +/* + * SSL_process_quic_post_handshake processes any data that QUIC has provided + * after the handshake has completed. This includes NewSessionTicket messages + * sent by the server. It returns one on success and zero on error. + */ +int SSL_process_quic_post_handshake(SSL *ssl); + +/* + * SSL_set_quic_transport_params configures |ssl| to send |params| (of length + * |params_len|) in the quic_transport_parameters extension in either the + * ClientHello or EncryptedExtensions handshake message. It is an error to set + * transport parameters if |ssl| is not configured for QUIC. The buffer pointed + * to by |params| only need be valid for the duration of the call to this + * function. This function returns 1 on success and 0 on failure. + */ +int SSL_set_quic_transport_params(SSL *ssl, const uint8_t *params, + size_t params_len); + +/* + * SSL_get_peer_quic_transport_params provides the caller with the value of the + * quic_transport_parameters extension sent by the peer. A pointer to the buffer + * containing the TransportParameters will be put in |*out_params|, and its + * length in |*params_len|. This buffer will be valid for the lifetime of the + * |SSL|. If no params were received from the peer, |*out_params_len| will be 0. + */ +void SSL_get_peer_quic_transport_params(const SSL *ssl, + const uint8_t **out_params, size_t *out_params_len); + +/* + * SSL_set_quic_use_legacy_codepoint configures whether to use the legacy QUIC + * extension codepoint 0xffa5 as opposed to the official value 57. This is + * unsupported in LibreSSL. + */ +void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy); + +#endif + +void ERR_load_SSL_strings(void); + +/* Error codes for the SSL functions. */ + +/* Function codes. */ +#define SSL_F_CLIENT_CERTIFICATE 100 +#define SSL_F_CLIENT_FINISHED 167 +#define SSL_F_CLIENT_HELLO 101 +#define SSL_F_CLIENT_MASTER_KEY 102 +#define SSL_F_D2I_SSL_SESSION 103 +#define SSL_F_DO_DTLS1_WRITE 245 +#define SSL_F_DO_SSL3_WRITE 104 +#define SSL_F_DTLS1_ACCEPT 246 +#define SSL_F_DTLS1_ADD_CERT_TO_BUF 295 +#define SSL_F_DTLS1_BUFFER_RECORD 247 +#define SSL_F_DTLS1_CHECK_TIMEOUT_NUM 316 +#define SSL_F_DTLS1_CLIENT_HELLO 248 +#define SSL_F_DTLS1_CONNECT 249 +#define SSL_F_DTLS1_ENC 250 +#define SSL_F_DTLS1_GET_HELLO_VERIFY 251 +#define SSL_F_DTLS1_GET_MESSAGE 252 +#define SSL_F_DTLS1_GET_MESSAGE_FRAGMENT 253 +#define SSL_F_DTLS1_GET_RECORD 254 +#define SSL_F_DTLS1_HANDLE_TIMEOUT 297 +#define SSL_F_DTLS1_HEARTBEAT 305 +#define SSL_F_DTLS1_OUTPUT_CERT_CHAIN 255 +#define SSL_F_DTLS1_PREPROCESS_FRAGMENT 288 +#define SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE 256 +#define SSL_F_DTLS1_PROCESS_RECORD 257 +#define SSL_F_DTLS1_READ_BYTES 258 +#define SSL_F_DTLS1_READ_FAILED 259 +#define SSL_F_DTLS1_SEND_CERTIFICATE_REQUEST 260 +#define SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE 261 +#define SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE 262 +#define SSL_F_DTLS1_SEND_CLIENT_VERIFY 263 +#define SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST 264 +#define SSL_F_DTLS1_SEND_SERVER_CERTIFICATE 265 +#define SSL_F_DTLS1_SEND_SERVER_HELLO 266 +#define SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE 267 +#define SSL_F_DTLS1_WRITE_APP_DATA_BYTES 268 +#define SSL_F_GET_CLIENT_FINISHED 105 +#define SSL_F_GET_CLIENT_HELLO 106 +#define SSL_F_GET_CLIENT_MASTER_KEY 107 +#define SSL_F_GET_SERVER_FINISHED 108 +#define SSL_F_GET_SERVER_HELLO 109 +#define SSL_F_GET_SERVER_VERIFY 110 +#define SSL_F_I2D_SSL_SESSION 111 +#define SSL_F_READ_N 112 +#define SSL_F_REQUEST_CERTIFICATE 113 +#define SSL_F_SERVER_FINISH 239 +#define SSL_F_SERVER_HELLO 114 +#define SSL_F_SERVER_VERIFY 240 +#define SSL_F_SSL23_ACCEPT 115 +#define SSL_F_SSL23_CLIENT_HELLO 116 +#define SSL_F_SSL23_CONNECT 117 +#define SSL_F_SSL23_GET_CLIENT_HELLO 118 +#define SSL_F_SSL23_GET_SERVER_HELLO 119 +#define SSL_F_SSL23_PEEK 237 +#define SSL_F_SSL23_READ 120 +#define SSL_F_SSL23_WRITE 121 +#define SSL_F_SSL2_ACCEPT 122 +#define SSL_F_SSL2_CONNECT 123 +#define SSL_F_SSL2_ENC_INIT 124 +#define SSL_F_SSL2_GENERATE_KEY_MATERIAL 241 +#define SSL_F_SSL2_PEEK 234 +#define SSL_F_SSL2_READ 125 +#define SSL_F_SSL2_READ_INTERNAL 236 +#define SSL_F_SSL2_SET_CERTIFICATE 126 +#define SSL_F_SSL2_WRITE 127 +#define SSL_F_SSL3_ACCEPT 128 +#define SSL_F_SSL3_ADD_CERT_TO_BUF 296 +#define SSL_F_SSL3_CALLBACK_CTRL 233 +#define SSL_F_SSL3_CHANGE_CIPHER_STATE 129 +#define SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM 130 +#define SSL_F_SSL3_CHECK_CLIENT_HELLO 304 +#define SSL_F_SSL3_CLIENT_HELLO 131 +#define SSL_F_SSL3_CONNECT 132 +#define SSL_F_SSL3_CTRL 213 +#define SSL_F_SSL3_CTX_CTRL 133 +#define SSL_F_SSL3_DIGEST_CACHED_RECORDS 293 +#define SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC 292 +#define SSL_F_SSL3_ENC 134 +#define SSL_F_SSL3_GENERATE_KEY_BLOCK 238 +#define SSL_F_SSL3_GET_CERTIFICATE_REQUEST 135 +#define SSL_F_SSL3_GET_CERT_STATUS 289 +#define SSL_F_SSL3_GET_CERT_VERIFY 136 +#define SSL_F_SSL3_GET_CLIENT_CERTIFICATE 137 +#define SSL_F_SSL3_GET_CLIENT_HELLO 138 +#define SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE 139 +#define SSL_F_SSL3_GET_FINISHED 140 +#define SSL_F_SSL3_GET_KEY_EXCHANGE 141 +#define SSL_F_SSL3_GET_MESSAGE 142 +#define SSL_F_SSL3_GET_NEW_SESSION_TICKET 283 +#define SSL_F_SSL3_GET_NEXT_PROTO 306 +#define SSL_F_SSL3_GET_RECORD 143 +#define SSL_F_SSL3_GET_SERVER_CERTIFICATE 144 +#define SSL_F_SSL3_GET_SERVER_DONE 145 +#define SSL_F_SSL3_GET_SERVER_HELLO 146 +#define SSL_F_SSL3_HANDSHAKE_MAC 285 +#define SSL_F_SSL3_NEW_SESSION_TICKET 287 +#define SSL_F_SSL3_OUTPUT_CERT_CHAIN 147 +#define SSL_F_SSL3_PEEK 235 +#define SSL_F_SSL3_READ_BYTES 148 +#define SSL_F_SSL3_READ_N 149 +#define SSL_F_SSL3_SEND_CERTIFICATE_REQUEST 150 +#define SSL_F_SSL3_SEND_CLIENT_CERTIFICATE 151 +#define SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE 152 +#define SSL_F_SSL3_SEND_CLIENT_VERIFY 153 +#define SSL_F_SSL3_SEND_SERVER_CERTIFICATE 154 +#define SSL_F_SSL3_SEND_SERVER_HELLO 242 +#define SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE 155 +#define SSL_F_SSL3_SETUP_KEY_BLOCK 157 +#define SSL_F_SSL3_SETUP_READ_BUFFER 156 +#define SSL_F_SSL3_SETUP_WRITE_BUFFER 291 +#define SSL_F_SSL3_WRITE_BYTES 158 +#define SSL_F_SSL3_WRITE_PENDING 159 +#define SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT 298 +#define SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT 277 +#define SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT 307 +#define SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK 215 +#define SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK 216 +#define SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT 299 +#define SSL_F_SSL_ADD_SERVERHELLO_TLSEXT 278 +#define SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT 308 +#define SSL_F_SSL_BAD_METHOD 160 +#define SSL_F_SSL_BYTES_TO_CIPHER_LIST 161 +#define SSL_F_SSL_CERT_DUP 221 +#define SSL_F_SSL_CERT_INST 222 +#define SSL_F_SSL_CERT_INSTANTIATE 214 +#define SSL_F_SSL_CERT_NEW 162 +#define SSL_F_SSL_CHECK_PRIVATE_KEY 163 +#define SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT 280 +#define SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG 279 +#define SSL_F_SSL_CIPHER_PROCESS_RULESTR 230 +#define SSL_F_SSL_CIPHER_STRENGTH_SORT 231 +#define SSL_F_SSL_CLEAR 164 +#define SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD 165 +#define SSL_F_SSL_CREATE_CIPHER_LIST 166 +#define SSL_F_SSL_CTRL 232 +#define SSL_F_SSL_CTX_CHECK_PRIVATE_KEY 168 +#define SSL_F_SSL_CTX_MAKE_PROFILES 309 +#define SSL_F_SSL_CTX_NEW 169 +#define SSL_F_SSL_CTX_SET_CIPHER_LIST 269 +#define SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE 290 +#define SSL_F_SSL_CTX_SET_PURPOSE 226 +#define SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT 219 +#define SSL_F_SSL_CTX_SET_SSL_VERSION 170 +#define SSL_F_SSL_CTX_SET_TRUST 229 +#define SSL_F_SSL_CTX_USE_CERTIFICATE 171 +#define SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1 172 +#define SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE 220 +#define SSL_F_SSL_CTX_USE_CERTIFICATE_FILE 173 +#define SSL_F_SSL_CTX_USE_PRIVATEKEY 174 +#define SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1 175 +#define SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE 176 +#define SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT 272 +#define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY 177 +#define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1 178 +#define SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE 179 +#define SSL_F_SSL_DO_HANDSHAKE 180 +#define SSL_F_SSL_GET_NEW_SESSION 181 +#define SSL_F_SSL_GET_PREV_SESSION 217 +#define SSL_F_SSL_GET_SERVER_SEND_CERT 182 +#define SSL_F_SSL_GET_SERVER_SEND_PKEY 317 +#define SSL_F_SSL_GET_SIGN_PKEY 183 +#define SSL_F_SSL_INIT_WBIO_BUFFER 184 +#define SSL_F_SSL_LOAD_CLIENT_CA_FILE 185 +#define SSL_F_SSL_NEW 186 +#define SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT 300 +#define SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT 302 +#define SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT 310 +#define SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT 301 +#define SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT 303 +#define SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT 311 +#define SSL_F_SSL_PEEK 270 +#define SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT 281 +#define SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT 282 +#define SSL_F_SSL_READ 223 +#define SSL_F_SSL_RSA_PRIVATE_DECRYPT 187 +#define SSL_F_SSL_RSA_PUBLIC_ENCRYPT 188 +#define SSL_F_SSL_SESSION_NEW 189 +#define SSL_F_SSL_SESSION_PRINT_FP 190 +#define SSL_F_SSL_SESSION_SET1_ID_CONTEXT 312 +#define SSL_F_SSL_SESS_CERT_NEW 225 +#define SSL_F_SSL_SET_CERT 191 +#define SSL_F_SSL_SET_CIPHER_LIST 271 +#define SSL_F_SSL_SET_FD 192 +#define SSL_F_SSL_SET_PKEY 193 +#define SSL_F_SSL_SET_PURPOSE 227 +#define SSL_F_SSL_SET_RFD 194 +#define SSL_F_SSL_SET_SESSION 195 +#define SSL_F_SSL_SET_SESSION_ID_CONTEXT 218 +#define SSL_F_SSL_SET_SESSION_TICKET_EXT 294 +#define SSL_F_SSL_SET_TRUST 228 +#define SSL_F_SSL_SET_WFD 196 +#define SSL_F_SSL_SHUTDOWN 224 +#define SSL_F_SSL_SRP_CTX_INIT 313 +#define SSL_F_SSL_UNDEFINED_CONST_FUNCTION 243 +#define SSL_F_SSL_UNDEFINED_FUNCTION 197 +#define SSL_F_SSL_UNDEFINED_VOID_FUNCTION 244 +#define SSL_F_SSL_USE_CERTIFICATE 198 +#define SSL_F_SSL_USE_CERTIFICATE_ASN1 199 +#define SSL_F_SSL_USE_CERTIFICATE_FILE 200 +#define SSL_F_SSL_USE_PRIVATEKEY 201 +#define SSL_F_SSL_USE_PRIVATEKEY_ASN1 202 +#define SSL_F_SSL_USE_PRIVATEKEY_FILE 203 +#define SSL_F_SSL_USE_PSK_IDENTITY_HINT 273 +#define SSL_F_SSL_USE_RSAPRIVATEKEY 204 +#define SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1 205 +#define SSL_F_SSL_USE_RSAPRIVATEKEY_FILE 206 +#define SSL_F_SSL_VERIFY_CERT_CHAIN 207 +#define SSL_F_SSL_WRITE 208 +#define SSL_F_TLS1_AEAD_CTX_INIT 339 +#define SSL_F_TLS1_CERT_VERIFY_MAC 286 +#define SSL_F_TLS1_CHANGE_CIPHER_STATE 209 +#define SSL_F_TLS1_CHANGE_CIPHER_STATE_AEAD 340 +#define SSL_F_TLS1_CHANGE_CIPHER_STATE_CIPHER 338 +#define SSL_F_TLS1_CHECK_SERVERHELLO_TLSEXT 274 +#define SSL_F_TLS1_ENC 210 +#define SSL_F_TLS1_EXPORT_KEYING_MATERIAL 314 +#define SSL_F_TLS1_HEARTBEAT 315 +#define SSL_F_TLS1_PREPARE_CLIENTHELLO_TLSEXT 275 +#define SSL_F_TLS1_PREPARE_SERVERHELLO_TLSEXT 276 +#define SSL_F_TLS1_PRF 284 +#define SSL_F_TLS1_SETUP_KEY_BLOCK 211 +#define SSL_F_WRITE_PENDING 212 + +/* Reason codes. */ +#define SSL_R_APP_DATA_IN_HANDSHAKE 100 +#define SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT 272 +#define SSL_R_BAD_ALERT_RECORD 101 +#define SSL_R_BAD_AUTHENTICATION_TYPE 102 +#define SSL_R_BAD_CHANGE_CIPHER_SPEC 103 +#define SSL_R_BAD_CHECKSUM 104 +#define SSL_R_BAD_DATA_RETURNED_BY_CALLBACK 106 +#define SSL_R_BAD_DECOMPRESSION 107 +#define SSL_R_BAD_DH_G_LENGTH 108 +#define SSL_R_BAD_DH_PUB_KEY_LENGTH 109 +#define SSL_R_BAD_DH_P_LENGTH 110 +#define SSL_R_BAD_DIGEST_LENGTH 111 +#define SSL_R_BAD_DSA_SIGNATURE 112 +#define SSL_R_BAD_ECC_CERT 304 +#define SSL_R_BAD_ECDSA_SIGNATURE 305 +#define SSL_R_BAD_ECPOINT 306 +#define SSL_R_BAD_HANDSHAKE_LENGTH 332 +#define SSL_R_BAD_HELLO_REQUEST 105 +#define SSL_R_BAD_LENGTH 271 +#define SSL_R_BAD_MAC_DECODE 113 +#define SSL_R_BAD_MAC_LENGTH 333 +#define SSL_R_BAD_MESSAGE_TYPE 114 +#define SSL_R_BAD_PACKET_LENGTH 115 +#define SSL_R_BAD_PROTOCOL_VERSION_NUMBER 116 +#define SSL_R_BAD_PSK_IDENTITY_HINT_LENGTH 316 +#define SSL_R_BAD_RESPONSE_ARGUMENT 117 +#define SSL_R_BAD_RSA_DECRYPT 118 +#define SSL_R_BAD_RSA_ENCRYPT 119 +#define SSL_R_BAD_RSA_E_LENGTH 120 +#define SSL_R_BAD_RSA_MODULUS_LENGTH 121 +#define SSL_R_BAD_RSA_SIGNATURE 122 +#define SSL_R_BAD_SIGNATURE 123 +#define SSL_R_BAD_SRP_A_LENGTH 347 +#define SSL_R_BAD_SRP_B_LENGTH 348 +#define SSL_R_BAD_SRP_G_LENGTH 349 +#define SSL_R_BAD_SRP_N_LENGTH 350 +#define SSL_R_BAD_SRP_S_LENGTH 351 +#define SSL_R_BAD_SRTP_MKI_VALUE 352 +#define SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST 353 +#define SSL_R_BAD_SSL_FILETYPE 124 +#define SSL_R_BAD_SSL_SESSION_ID_LENGTH 125 +#define SSL_R_BAD_STATE 126 +#define SSL_R_BAD_WRITE_RETRY 127 +#define SSL_R_BIO_NOT_SET 128 +#define SSL_R_BLOCK_CIPHER_PAD_IS_WRONG 129 +#define SSL_R_BN_LIB 130 +#define SSL_R_CA_DN_LENGTH_MISMATCH 131 +#define SSL_R_CA_DN_TOO_LONG 132 +#define SSL_R_CA_KEY_TOO_SMALL 397 +#define SSL_R_CA_MD_TOO_WEAK 398 +#define SSL_R_CCS_RECEIVED_EARLY 133 +#define SSL_R_CERTIFICATE_VERIFY_FAILED 134 +#define SSL_R_CERT_LENGTH_MISMATCH 135 +#define SSL_R_CHALLENGE_IS_DIFFERENT 136 +#define SSL_R_CIPHER_CODE_WRONG_LENGTH 137 +#define SSL_R_CIPHER_COMPRESSION_UNAVAILABLE 371 +#define SSL_R_CIPHER_OR_HASH_UNAVAILABLE 138 +#define SSL_R_CIPHER_TABLE_SRC_ERROR 139 +#define SSL_R_CLIENTHELLO_TLSEXT 226 +#define SSL_R_COMPRESSED_LENGTH_TOO_LONG 140 +#define SSL_R_COMPRESSION_DISABLED 343 +#define SSL_R_COMPRESSION_FAILURE 141 +#define SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE 307 +#define SSL_R_COMPRESSION_LIBRARY_ERROR 142 +#define SSL_R_CONNECTION_ID_IS_DIFFERENT 143 +#define SSL_R_CONNECTION_TYPE_NOT_SET 144 +#define SSL_R_COOKIE_MISMATCH 308 +#define SSL_R_DATA_BETWEEN_CCS_AND_FINISHED 145 +#define SSL_R_DATA_LENGTH_TOO_LONG 146 +#define SSL_R_DECRYPTION_FAILED 147 +#define SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC 281 +#define SSL_R_DH_KEY_TOO_SMALL 394 +#define SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG 148 +#define SSL_R_DIGEST_CHECK_FAILED 149 +#define SSL_R_DTLS_MESSAGE_TOO_BIG 334 +#define SSL_R_DUPLICATE_COMPRESSION_ID 309 +#define SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT 317 +#define SSL_R_ECC_CERT_NOT_FOR_SIGNING 318 +#define SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE 322 +#define SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE 323 +#define SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER 310 +#define SSL_R_EE_KEY_TOO_SMALL 399 +#define SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST 354 +#define SSL_R_ENCRYPTED_LENGTH_TOO_LONG 150 +#define SSL_R_ERROR_GENERATING_TMP_RSA_KEY 282 +#define SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST 151 +#define SSL_R_EXCESSIVE_MESSAGE_SIZE 152 +#define SSL_R_EXTRA_DATA_IN_MESSAGE 153 +#define SSL_R_GOT_A_FIN_BEFORE_A_CCS 154 +#define SSL_R_GOT_NEXT_PROTO_BEFORE_A_CCS 355 +#define SSL_R_GOT_NEXT_PROTO_WITHOUT_EXTENSION 356 +#define SSL_R_HTTPS_PROXY_REQUEST 155 +#define SSL_R_HTTP_REQUEST 156 +#define SSL_R_ILLEGAL_PADDING 283 +#define SSL_R_INAPPROPRIATE_FALLBACK 373 +#define SSL_R_INCONSISTENT_COMPRESSION 340 +#define SSL_R_INVALID_CHALLENGE_LENGTH 158 +#define SSL_R_INVALID_COMMAND 280 +#define SSL_R_INVALID_COMPRESSION_ALGORITHM 341 +#define SSL_R_INVALID_PURPOSE 278 +#define SSL_R_INVALID_SRP_USERNAME 357 +#define SSL_R_INVALID_STATUS_RESPONSE 328 +#define SSL_R_INVALID_TICKET_KEYS_LENGTH 325 +#define SSL_R_INVALID_TRUST 279 +#define SSL_R_KEY_ARG_TOO_LONG 284 +#define SSL_R_KRB5 285 +#define SSL_R_KRB5_C_CC_PRINC 286 +#define SSL_R_KRB5_C_GET_CRED 287 +#define SSL_R_KRB5_C_INIT 288 +#define SSL_R_KRB5_C_MK_REQ 289 +#define SSL_R_KRB5_S_BAD_TICKET 290 +#define SSL_R_KRB5_S_INIT 291 +#define SSL_R_KRB5_S_RD_REQ 292 +#define SSL_R_KRB5_S_TKT_EXPIRED 293 +#define SSL_R_KRB5_S_TKT_NYV 294 +#define SSL_R_KRB5_S_TKT_SKEW 295 +#define SSL_R_LENGTH_MISMATCH 159 +#define SSL_R_LENGTH_TOO_SHORT 160 +#define SSL_R_LIBRARY_BUG 274 +#define SSL_R_LIBRARY_HAS_NO_CIPHERS 161 +#define SSL_R_MESSAGE_TOO_LONG 296 +#define SSL_R_MISSING_DH_DSA_CERT 162 +#define SSL_R_MISSING_DH_KEY 163 +#define SSL_R_MISSING_DH_RSA_CERT 164 +#define SSL_R_MISSING_DSA_SIGNING_CERT 165 +#define SSL_R_MISSING_EXPORT_TMP_DH_KEY 166 +#define SSL_R_MISSING_EXPORT_TMP_RSA_KEY 167 +#define SSL_R_MISSING_RSA_CERTIFICATE 168 +#define SSL_R_MISSING_RSA_ENCRYPTING_CERT 169 +#define SSL_R_MISSING_RSA_SIGNING_CERT 170 +#define SSL_R_MISSING_SRP_PARAM 358 +#define SSL_R_MISSING_TMP_DH_KEY 171 +#define SSL_R_MISSING_TMP_ECDH_KEY 311 +#define SSL_R_MISSING_TMP_RSA_KEY 172 +#define SSL_R_MISSING_TMP_RSA_PKEY 173 +#define SSL_R_MISSING_VERIFY_MESSAGE 174 +#define SSL_R_MULTIPLE_SGC_RESTARTS 346 +#define SSL_R_NON_SSLV2_INITIAL_PACKET 175 +#define SSL_R_NO_APPLICATION_PROTOCOL 235 +#define SSL_R_NO_CERTIFICATES_RETURNED 176 +#define SSL_R_NO_CERTIFICATE_ASSIGNED 177 +#define SSL_R_NO_CERTIFICATE_RETURNED 178 +#define SSL_R_NO_CERTIFICATE_SET 179 +#define SSL_R_NO_CERTIFICATE_SPECIFIED 180 +#define SSL_R_NO_CIPHERS_AVAILABLE 181 +#define SSL_R_NO_CIPHERS_PASSED 182 +#define SSL_R_NO_CIPHERS_SPECIFIED 183 +#define SSL_R_NO_CIPHER_LIST 184 +#define SSL_R_NO_CIPHER_MATCH 185 +#define SSL_R_NO_CLIENT_CERT_METHOD 331 +#define SSL_R_NO_CLIENT_CERT_RECEIVED 186 +#define SSL_R_NO_COMPRESSION_SPECIFIED 187 +#define SSL_R_NO_METHOD_SPECIFIED 188 +#define SSL_R_NO_PRIVATEKEY 189 +#define SSL_R_NO_PRIVATE_KEY_ASSIGNED 190 +#define SSL_R_NO_PROTOCOLS_AVAILABLE 191 +#define SSL_R_NO_PUBLICKEY 192 +#define SSL_R_NO_RENEGOTIATION 339 +#define SSL_R_NO_REQUIRED_DIGEST 324 +#define SSL_R_NO_SHARED_CIPHER 193 +#define SSL_R_NO_SRTP_PROFILES 359 +#define SSL_R_NO_VERIFY_CALLBACK 194 +#define SSL_R_NULL_SSL_CTX 195 +#define SSL_R_NULL_SSL_METHOD_PASSED 196 +#define SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED 197 +#define SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED 344 +#define SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE 297 +#define SSL_R_PACKET_LENGTH_TOO_LONG 198 +#define SSL_R_PARSE_TLSEXT 227 +#define SSL_R_PATH_TOO_LONG 270 +#define SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE 199 +#define SSL_R_PEER_ERROR 200 +#define SSL_R_PEER_ERROR_CERTIFICATE 201 +#define SSL_R_PEER_ERROR_NO_CERTIFICATE 202 +#define SSL_R_PEER_ERROR_NO_CIPHER 203 +#define SSL_R_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE 204 +#define SSL_R_PRE_MAC_LENGTH_TOO_LONG 205 +#define SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS 206 +#define SSL_R_PROTOCOL_IS_SHUTDOWN 207 +#define SSL_R_PSK_IDENTITY_NOT_FOUND 223 +#define SSL_R_PSK_NO_CLIENT_CB 224 +#define SSL_R_PSK_NO_SERVER_CB 225 +#define SSL_R_PUBLIC_KEY_ENCRYPT_ERROR 208 +#define SSL_R_PUBLIC_KEY_IS_NOT_RSA 209 +#define SSL_R_PUBLIC_KEY_NOT_RSA 210 +#define SSL_R_READ_BIO_NOT_SET 211 +#define SSL_R_READ_TIMEOUT_EXPIRED 312 +#define SSL_R_READ_WRONG_PACKET_TYPE 212 +#define SSL_R_RECORD_LENGTH_MISMATCH 213 +#define SSL_R_RECORD_TOO_LARGE 214 +#define SSL_R_RECORD_TOO_SMALL 298 +#define SSL_R_RENEGOTIATE_EXT_TOO_LONG 335 +#define SSL_R_RENEGOTIATION_ENCODING_ERR 336 +#define SSL_R_RENEGOTIATION_MISMATCH 337 +#define SSL_R_REQUIRED_CIPHER_MISSING 215 +#define SSL_R_REQUIRED_COMPRESSSION_ALGORITHM_MISSING 342 +#define SSL_R_REUSE_CERT_LENGTH_NOT_ZERO 216 +#define SSL_R_REUSE_CERT_TYPE_NOT_ZERO 217 +#define SSL_R_REUSE_CIPHER_LIST_NOT_ZERO 218 +#define SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING 345 +#define SSL_R_SERVERHELLO_TLSEXT 275 +#define SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED 277 +#define SSL_R_SHORT_READ 219 +#define SSL_R_SIGNATURE_ALGORITHMS_ERROR 360 +#define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE 220 +#define SSL_R_SRP_A_CALC 361 +#define SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES 362 +#define SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG 363 +#define SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE 364 +#define SSL_R_SSL23_DOING_SESSION_ID_REUSE 221 +#define SSL_R_SSL2_CONNECTION_ID_TOO_LONG 299 +#define SSL_R_SSL3_EXT_INVALID_ECPOINTFORMAT 321 +#define SSL_R_SSL3_EXT_INVALID_SERVERNAME 319 +#define SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE 320 +#define SSL_R_SSL3_SESSION_ID_TOO_LONG 300 +#define SSL_R_SSL3_SESSION_ID_TOO_SHORT 222 +#define SSL_R_SSLV3_ALERT_BAD_CERTIFICATE 1042 +#define SSL_R_SSLV3_ALERT_BAD_RECORD_MAC 1020 +#define SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED 1045 +#define SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED 1044 +#define SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN 1046 +#define SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE 1030 +#define SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE 1040 +#define SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER 1047 +#define SSL_R_SSLV3_ALERT_NO_CERTIFICATE 1041 +#define SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE 1010 +#define SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE 1043 +#define SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION 228 +#define SSL_R_SSL_HANDSHAKE_FAILURE 229 +#define SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS 230 +#define SSL_R_SSL_SESSION_ID_CALLBACK_FAILED 301 +#define SSL_R_SSL_SESSION_ID_CONFLICT 302 +#define SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG 273 +#define SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH 303 +#define SSL_R_SSL_SESSION_ID_IS_DIFFERENT 231 +#define SSL_R_SSL_SESSION_ID_TOO_LONG 408 +#define SSL_R_TLSV13_ALERT_MISSING_EXTENSION 1109 +#define SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED 1116 +#define SSL_R_TLSV1_ALERT_ACCESS_DENIED 1049 +#define SSL_R_TLSV1_ALERT_NO_APPLICATION_PROTOCOL 1120 +#define SSL_R_TLSV1_ALERT_DECODE_ERROR 1050 +#define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED 1021 +#define SSL_R_TLSV1_ALERT_DECRYPT_ERROR 1051 +#define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION 1060 +#define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK 1086 +#define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY 1071 +#define SSL_R_TLSV1_ALERT_INTERNAL_ERROR 1080 +#define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION 1100 +#define SSL_R_TLSV1_ALERT_PROTOCOL_VERSION 1070 +#define SSL_R_TLSV1_ALERT_RECORD_OVERFLOW 1022 +#define SSL_R_TLSV1_ALERT_UNKNOWN_CA 1048 +#define SSL_R_TLSV1_ALERT_UNKNOWN_PSK_IDENTITY 1115 +#define SSL_R_TLSV1_ALERT_USER_CANCELLED 1090 +#define SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE 1114 +#define SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE 1113 +#define SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE 1111 +#define SSL_R_TLSV1_UNRECOGNIZED_NAME 1112 +#define SSL_R_TLSV1_UNSUPPORTED_EXTENSION 1110 +#define SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER 232 +#define SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT 365 +#define SSL_R_TLS_HEARTBEAT_PENDING 366 +#define SSL_R_TLS_ILLEGAL_EXPORTER_LABEL 367 +#define SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST 157 +#define SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 233 +#define SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG 234 +#define SSL_R_UNABLE_TO_DECODE_DH_CERTS 236 +#define SSL_R_UNABLE_TO_DECODE_ECDH_CERTS 313 +#define SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY 237 +#define SSL_R_UNABLE_TO_FIND_DH_PARAMETERS 238 +#define SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS 314 +#define SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS 239 +#define SSL_R_UNABLE_TO_FIND_SSL_METHOD 240 +#define SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES 241 +#define SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES 242 +#define SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES 243 +#define SSL_R_UNEXPECTED_MESSAGE 244 +#define SSL_R_UNEXPECTED_RECORD 245 +#define SSL_R_UNINITIALIZED 276 +#define SSL_R_UNKNOWN_ALERT_TYPE 246 +#define SSL_R_UNKNOWN_CERTIFICATE_TYPE 247 +#define SSL_R_UNKNOWN_CIPHER_RETURNED 248 +#define SSL_R_UNKNOWN_CIPHER_TYPE 249 +#define SSL_R_UNKNOWN_DIGEST 368 +#define SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE 250 +#define SSL_R_UNKNOWN_PKEY_TYPE 251 +#define SSL_R_UNKNOWN_PROTOCOL 252 +#define SSL_R_UNKNOWN_REMOTE_ERROR_TYPE 253 +#define SSL_R_UNKNOWN_SSL_VERSION 254 +#define SSL_R_UNKNOWN_STATE 255 +#define SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED 338 +#define SSL_R_UNSUPPORTED_CIPHER 256 +#define SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM 257 +#define SSL_R_UNSUPPORTED_DIGEST_TYPE 326 +#define SSL_R_UNSUPPORTED_ELLIPTIC_CURVE 315 +#define SSL_R_UNSUPPORTED_PROTOCOL 258 +#define SSL_R_UNSUPPORTED_SSL_VERSION 259 +#define SSL_R_UNSUPPORTED_STATUS_TYPE 329 +#define SSL_R_USE_SRTP_NOT_NEGOTIATED 369 +#define SSL_R_VERSION_TOO_LOW 396 +#define SSL_R_WRITE_BIO_NOT_SET 260 +#define SSL_R_WRONG_CIPHER_RETURNED 261 +#define SSL_R_WRONG_CURVE 378 +#define SSL_R_WRONG_MESSAGE_TYPE 262 +#define SSL_R_WRONG_NUMBER_OF_KEY_BITS 263 +#define SSL_R_WRONG_SIGNATURE_LENGTH 264 +#define SSL_R_WRONG_SIGNATURE_SIZE 265 +#define SSL_R_WRONG_SIGNATURE_TYPE 370 +#define SSL_R_WRONG_SSL_VERSION 266 +#define SSL_R_WRONG_VERSION_NUMBER 267 +#define SSL_R_X509_LIB 268 +#define SSL_R_X509_VERIFICATION_SETUP_PROBLEMS 269 +#define SSL_R_PEER_BEHAVING_BADLY 666 +#define SSL_R_QUIC_INTERNAL_ERROR 667 +#define SSL_R_WRONG_ENCRYPTION_LEVEL_RECEIVED 668 +#define SSL_R_UNKNOWN 999 + +/* + * OpenSSL compatible OPENSSL_INIT options + */ + +/* + * These are provided for compatibility, but have no effect + * on how LibreSSL is initialized. + */ +#define OPENSSL_INIT_LOAD_SSL_STRINGS _OPENSSL_INIT_FLAG_NOOP +#define OPENSSL_INIT_SSL_DEFAULT _OPENSSL_INIT_FLAG_NOOP + +int OPENSSL_init_ssl(uint64_t opts, const void *settings); +int SSL_library_init(void); + +/* + * A few things still use this without #ifdef guard. + */ + +#define SSL2_VERSION 0x0002 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/ssl3.h b/curl/include/openssl/ssl3.h new file mode 100644 index 0000000..1b1110b --- /dev/null +++ b/curl/include/openssl/ssl3.h @@ -0,0 +1,441 @@ +/* $OpenBSD: ssl3.h,v 1.60 2024/03/02 11:47:41 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ +/* ==================================================================== + * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ +/* ==================================================================== + * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. + * ECC cipher suite support in OpenSSL originally developed by + * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. + */ + +#ifndef HEADER_SSL3_H +#define HEADER_SSL3_H + +#include +#include +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* TLS_EMPTY_RENEGOTIATION_INFO_SCSV from RFC 5746. */ +#define SSL3_CK_SCSV 0x030000FF + +/* TLS_FALLBACK_SCSV from draft-ietf-tls-downgrade-scsv-03. */ +#define SSL3_CK_FALLBACK_SCSV 0x03005600 + +#define SSL3_CK_RSA_NULL_MD5 0x03000001 +#define SSL3_CK_RSA_NULL_SHA 0x03000002 +#define SSL3_CK_RSA_RC4_40_MD5 0x03000003 +#define SSL3_CK_RSA_RC4_128_MD5 0x03000004 +#define SSL3_CK_RSA_RC4_128_SHA 0x03000005 +#define SSL3_CK_RSA_RC2_40_MD5 0x03000006 +#define SSL3_CK_RSA_IDEA_128_SHA 0x03000007 +#define SSL3_CK_RSA_DES_40_CBC_SHA 0x03000008 +#define SSL3_CK_RSA_DES_64_CBC_SHA 0x03000009 +#define SSL3_CK_RSA_DES_192_CBC3_SHA 0x0300000A + +#define SSL3_CK_DH_DSS_DES_40_CBC_SHA 0x0300000B +#define SSL3_CK_DH_DSS_DES_64_CBC_SHA 0x0300000C +#define SSL3_CK_DH_DSS_DES_192_CBC3_SHA 0x0300000D +#define SSL3_CK_DH_RSA_DES_40_CBC_SHA 0x0300000E +#define SSL3_CK_DH_RSA_DES_64_CBC_SHA 0x0300000F +#define SSL3_CK_DH_RSA_DES_192_CBC3_SHA 0x03000010 + +#define SSL3_CK_EDH_DSS_DES_40_CBC_SHA 0x03000011 +#define SSL3_CK_EDH_DSS_DES_64_CBC_SHA 0x03000012 +#define SSL3_CK_EDH_DSS_DES_192_CBC3_SHA 0x03000013 +#define SSL3_CK_EDH_RSA_DES_40_CBC_SHA 0x03000014 +#define SSL3_CK_EDH_RSA_DES_64_CBC_SHA 0x03000015 +#define SSL3_CK_EDH_RSA_DES_192_CBC3_SHA 0x03000016 + +#define SSL3_CK_ADH_RC4_40_MD5 0x03000017 +#define SSL3_CK_ADH_RC4_128_MD5 0x03000018 +#define SSL3_CK_ADH_DES_40_CBC_SHA 0x03000019 +#define SSL3_CK_ADH_DES_64_CBC_SHA 0x0300001A +#define SSL3_CK_ADH_DES_192_CBC_SHA 0x0300001B + +/* VRS Additional Kerberos5 entries + */ +#define SSL3_CK_KRB5_DES_64_CBC_SHA 0x0300001E +#define SSL3_CK_KRB5_DES_192_CBC3_SHA 0x0300001F +#define SSL3_CK_KRB5_RC4_128_SHA 0x03000020 +#define SSL3_CK_KRB5_IDEA_128_CBC_SHA 0x03000021 +#define SSL3_CK_KRB5_DES_64_CBC_MD5 0x03000022 +#define SSL3_CK_KRB5_DES_192_CBC3_MD5 0x03000023 +#define SSL3_CK_KRB5_RC4_128_MD5 0x03000024 +#define SSL3_CK_KRB5_IDEA_128_CBC_MD5 0x03000025 + +#define SSL3_CK_KRB5_DES_40_CBC_SHA 0x03000026 +#define SSL3_CK_KRB5_RC2_40_CBC_SHA 0x03000027 +#define SSL3_CK_KRB5_RC4_40_SHA 0x03000028 +#define SSL3_CK_KRB5_DES_40_CBC_MD5 0x03000029 +#define SSL3_CK_KRB5_RC2_40_CBC_MD5 0x0300002A +#define SSL3_CK_KRB5_RC4_40_MD5 0x0300002B + +#define SSL3_TXT_RSA_NULL_MD5 "NULL-MD5" +#define SSL3_TXT_RSA_NULL_SHA "NULL-SHA" +#define SSL3_TXT_RSA_RC4_40_MD5 "EXP-RC4-MD5" +#define SSL3_TXT_RSA_RC4_128_MD5 "RC4-MD5" +#define SSL3_TXT_RSA_RC4_128_SHA "RC4-SHA" +#define SSL3_TXT_RSA_RC2_40_MD5 "EXP-RC2-CBC-MD5" +#define SSL3_TXT_RSA_IDEA_128_SHA "IDEA-CBC-SHA" +#define SSL3_TXT_RSA_DES_40_CBC_SHA "EXP-DES-CBC-SHA" +#define SSL3_TXT_RSA_DES_64_CBC_SHA "DES-CBC-SHA" +#define SSL3_TXT_RSA_DES_192_CBC3_SHA "DES-CBC3-SHA" + +#define SSL3_TXT_DH_DSS_DES_40_CBC_SHA "EXP-DH-DSS-DES-CBC-SHA" +#define SSL3_TXT_DH_DSS_DES_64_CBC_SHA "DH-DSS-DES-CBC-SHA" +#define SSL3_TXT_DH_DSS_DES_192_CBC3_SHA "DH-DSS-DES-CBC3-SHA" +#define SSL3_TXT_DH_RSA_DES_40_CBC_SHA "EXP-DH-RSA-DES-CBC-SHA" +#define SSL3_TXT_DH_RSA_DES_64_CBC_SHA "DH-RSA-DES-CBC-SHA" +#define SSL3_TXT_DH_RSA_DES_192_CBC3_SHA "DH-RSA-DES-CBC3-SHA" + +#define SSL3_TXT_EDH_DSS_DES_40_CBC_SHA "EXP-EDH-DSS-DES-CBC-SHA" +#define SSL3_TXT_EDH_DSS_DES_64_CBC_SHA "EDH-DSS-DES-CBC-SHA" +#define SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA "EDH-DSS-DES-CBC3-SHA" +#define SSL3_TXT_EDH_RSA_DES_40_CBC_SHA "EXP-EDH-RSA-DES-CBC-SHA" +#define SSL3_TXT_EDH_RSA_DES_64_CBC_SHA "EDH-RSA-DES-CBC-SHA" +#define SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA "EDH-RSA-DES-CBC3-SHA" + +#define SSL3_TXT_ADH_RC4_40_MD5 "EXP-ADH-RC4-MD5" +#define SSL3_TXT_ADH_RC4_128_MD5 "ADH-RC4-MD5" +#define SSL3_TXT_ADH_DES_40_CBC_SHA "EXP-ADH-DES-CBC-SHA" +#define SSL3_TXT_ADH_DES_64_CBC_SHA "ADH-DES-CBC-SHA" +#define SSL3_TXT_ADH_DES_192_CBC_SHA "ADH-DES-CBC3-SHA" + +#define SSL3_TXT_KRB5_DES_64_CBC_SHA "KRB5-DES-CBC-SHA" +#define SSL3_TXT_KRB5_DES_192_CBC3_SHA "KRB5-DES-CBC3-SHA" +#define SSL3_TXT_KRB5_RC4_128_SHA "KRB5-RC4-SHA" +#define SSL3_TXT_KRB5_IDEA_128_CBC_SHA "KRB5-IDEA-CBC-SHA" +#define SSL3_TXT_KRB5_DES_64_CBC_MD5 "KRB5-DES-CBC-MD5" +#define SSL3_TXT_KRB5_DES_192_CBC3_MD5 "KRB5-DES-CBC3-MD5" +#define SSL3_TXT_KRB5_RC4_128_MD5 "KRB5-RC4-MD5" +#define SSL3_TXT_KRB5_IDEA_128_CBC_MD5 "KRB5-IDEA-CBC-MD5" + +#define SSL3_TXT_KRB5_DES_40_CBC_SHA "EXP-KRB5-DES-CBC-SHA" +#define SSL3_TXT_KRB5_RC2_40_CBC_SHA "EXP-KRB5-RC2-CBC-SHA" +#define SSL3_TXT_KRB5_RC4_40_SHA "EXP-KRB5-RC4-SHA" +#define SSL3_TXT_KRB5_DES_40_CBC_MD5 "EXP-KRB5-DES-CBC-MD5" +#define SSL3_TXT_KRB5_RC2_40_CBC_MD5 "EXP-KRB5-RC2-CBC-MD5" +#define SSL3_TXT_KRB5_RC4_40_MD5 "EXP-KRB5-RC4-MD5" + +#define SSL3_SSL_SESSION_ID_LENGTH 32 +#define SSL3_MAX_SSL_SESSION_ID_LENGTH 32 + +#define SSL3_MASTER_SECRET_SIZE 48 +#define SSL3_RANDOM_SIZE 32 +#define SSL3_SEQUENCE_SIZE 8 +#define SSL3_SESSION_ID_SIZE 32 +#define SSL3_CIPHER_VALUE_SIZE 2 + +#define SSL3_RT_HEADER_LENGTH 5 +#define SSL3_HM_HEADER_LENGTH 4 + +#define SSL3_ALIGN_PAYLOAD 8 + +/* This is the maximum MAC (digest) size used by the SSL library. + * Currently maximum of 20 is used by SHA1, but we reserve for + * future extension for 512-bit hashes. + */ + +#define SSL3_RT_MAX_MD_SIZE 64 + +/* Maximum block size used in all ciphersuites. Currently 16 for AES. + */ + +#define SSL_RT_MAX_CIPHER_BLOCK_SIZE 16 + +#define SSL3_RT_MAX_EXTRA (16384) + +/* Maximum plaintext length: defined by SSL/TLS standards */ +#define SSL3_RT_MAX_PLAIN_LENGTH 16384 +/* Maximum compression overhead: defined by SSL/TLS standards */ +#define SSL3_RT_MAX_COMPRESSED_OVERHEAD 1024 + +/* The standards give a maximum encryption overhead of 1024 bytes. + * In practice the value is lower than this. The overhead is the maximum + * number of padding bytes (256) plus the mac size. + */ +#define SSL3_RT_MAX_ENCRYPTED_OVERHEAD (256 + SSL3_RT_MAX_MD_SIZE) + +/* OpenSSL currently only uses a padding length of at most one block so + * the send overhead is smaller. + */ + +#define SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD \ + (SSL_RT_MAX_CIPHER_BLOCK_SIZE + SSL3_RT_MAX_MD_SIZE) + +/* If compression isn't used don't include the compression overhead */ +#define SSL3_RT_MAX_COMPRESSED_LENGTH SSL3_RT_MAX_PLAIN_LENGTH +#define SSL3_RT_MAX_ENCRYPTED_LENGTH \ + (SSL3_RT_MAX_ENCRYPTED_OVERHEAD+SSL3_RT_MAX_COMPRESSED_LENGTH) +#define SSL3_RT_MAX_PACKET_SIZE \ + (SSL3_RT_MAX_ENCRYPTED_LENGTH+SSL3_RT_HEADER_LENGTH) + +#define SSL3_MD_CLIENT_FINISHED_CONST "\x43\x4C\x4E\x54" +#define SSL3_MD_SERVER_FINISHED_CONST "\x53\x52\x56\x52" + +#define SSL3_VERSION 0x0300 +#define SSL3_VERSION_MAJOR 0x03 +#define SSL3_VERSION_MINOR 0x00 + +#define SSL3_RT_CHANGE_CIPHER_SPEC 20 +#define SSL3_RT_ALERT 21 +#define SSL3_RT_HANDSHAKE 22 +#define SSL3_RT_APPLICATION_DATA 23 + +#define SSL3_AL_WARNING 1 +#define SSL3_AL_FATAL 2 + +#ifndef LIBRESSL_INTERNAL +#define SSL3_AD_CLOSE_NOTIFY 0 +#define SSL3_AD_UNEXPECTED_MESSAGE 10 /* fatal */ +#define SSL3_AD_BAD_RECORD_MAC 20 /* fatal */ +#define SSL3_AD_DECOMPRESSION_FAILURE 30 /* fatal */ +#define SSL3_AD_HANDSHAKE_FAILURE 40 /* fatal */ +#define SSL3_AD_NO_CERTIFICATE 41 +#define SSL3_AD_BAD_CERTIFICATE 42 +#define SSL3_AD_UNSUPPORTED_CERTIFICATE 43 +#define SSL3_AD_CERTIFICATE_REVOKED 44 +#define SSL3_AD_CERTIFICATE_EXPIRED 45 +#define SSL3_AD_CERTIFICATE_UNKNOWN 46 +#define SSL3_AD_ILLEGAL_PARAMETER 47 /* fatal */ +#endif + +#define TLS1_HB_REQUEST 1 +#define TLS1_HB_RESPONSE 2 + +#define SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS 0x0001 +#define TLS1_FLAGS_FREEZE_TRANSCRIPT 0x0020 +#define SSL3_FLAGS_CCS_OK 0x0080 + +/* SSLv3 */ +/*client */ +/* extra state */ +#define SSL3_ST_CW_FLUSH (0x100|SSL_ST_CONNECT) +/* write to server */ +#define SSL3_ST_CW_CLNT_HELLO_A (0x110|SSL_ST_CONNECT) +#define SSL3_ST_CW_CLNT_HELLO_B (0x111|SSL_ST_CONNECT) +/* read from server */ +#define SSL3_ST_CR_SRVR_HELLO_A (0x120|SSL_ST_CONNECT) +#define SSL3_ST_CR_SRVR_HELLO_B (0x121|SSL_ST_CONNECT) +#define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A (0x126|SSL_ST_CONNECT) +#define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B (0x127|SSL_ST_CONNECT) +#define SSL3_ST_CR_CERT_A (0x130|SSL_ST_CONNECT) +#define SSL3_ST_CR_CERT_B (0x131|SSL_ST_CONNECT) +#define SSL3_ST_CR_KEY_EXCH_A (0x140|SSL_ST_CONNECT) +#define SSL3_ST_CR_KEY_EXCH_B (0x141|SSL_ST_CONNECT) +#define SSL3_ST_CR_CERT_REQ_A (0x150|SSL_ST_CONNECT) +#define SSL3_ST_CR_CERT_REQ_B (0x151|SSL_ST_CONNECT) +#define SSL3_ST_CR_SRVR_DONE_A (0x160|SSL_ST_CONNECT) +#define SSL3_ST_CR_SRVR_DONE_B (0x161|SSL_ST_CONNECT) +/* write to server */ +#define SSL3_ST_CW_CERT_A (0x170|SSL_ST_CONNECT) +#define SSL3_ST_CW_CERT_B (0x171|SSL_ST_CONNECT) +#define SSL3_ST_CW_CERT_C (0x172|SSL_ST_CONNECT) +#define SSL3_ST_CW_CERT_D (0x173|SSL_ST_CONNECT) +#define SSL3_ST_CW_KEY_EXCH_A (0x180|SSL_ST_CONNECT) +#define SSL3_ST_CW_KEY_EXCH_B (0x181|SSL_ST_CONNECT) +#define SSL3_ST_CW_CERT_VRFY_A (0x190|SSL_ST_CONNECT) +#define SSL3_ST_CW_CERT_VRFY_B (0x191|SSL_ST_CONNECT) +#define SSL3_ST_CW_CHANGE_A (0x1A0|SSL_ST_CONNECT) +#define SSL3_ST_CW_CHANGE_B (0x1A1|SSL_ST_CONNECT) +#define SSL3_ST_CW_FINISHED_A (0x1B0|SSL_ST_CONNECT) +#define SSL3_ST_CW_FINISHED_B (0x1B1|SSL_ST_CONNECT) +/* read from server */ +#define SSL3_ST_CR_CHANGE_A (0x1C0|SSL_ST_CONNECT) +#define SSL3_ST_CR_CHANGE_B (0x1C1|SSL_ST_CONNECT) +#define SSL3_ST_CR_FINISHED_A (0x1D0|SSL_ST_CONNECT) +#define SSL3_ST_CR_FINISHED_B (0x1D1|SSL_ST_CONNECT) +#define SSL3_ST_CR_SESSION_TICKET_A (0x1E0|SSL_ST_CONNECT) +#define SSL3_ST_CR_SESSION_TICKET_B (0x1E1|SSL_ST_CONNECT) +#define SSL3_ST_CR_CERT_STATUS_A (0x1F0|SSL_ST_CONNECT) +#define SSL3_ST_CR_CERT_STATUS_B (0x1F1|SSL_ST_CONNECT) + +/* server */ +/* extra state */ +#define SSL3_ST_SW_FLUSH (0x100|SSL_ST_ACCEPT) +/* read from client */ +/* Do not change the number values, they do matter */ +#define SSL3_ST_SR_CLNT_HELLO_A (0x110|SSL_ST_ACCEPT) +#define SSL3_ST_SR_CLNT_HELLO_B (0x111|SSL_ST_ACCEPT) +#define SSL3_ST_SR_CLNT_HELLO_C (0x112|SSL_ST_ACCEPT) +/* write to client */ +#define DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A (0x113|SSL_ST_ACCEPT) +#define DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B (0x114|SSL_ST_ACCEPT) +#define SSL3_ST_SW_HELLO_REQ_A (0x120|SSL_ST_ACCEPT) +#define SSL3_ST_SW_HELLO_REQ_B (0x121|SSL_ST_ACCEPT) +#define SSL3_ST_SW_HELLO_REQ_C (0x122|SSL_ST_ACCEPT) +#define SSL3_ST_SW_SRVR_HELLO_A (0x130|SSL_ST_ACCEPT) +#define SSL3_ST_SW_SRVR_HELLO_B (0x131|SSL_ST_ACCEPT) +#define SSL3_ST_SW_CERT_A (0x140|SSL_ST_ACCEPT) +#define SSL3_ST_SW_CERT_B (0x141|SSL_ST_ACCEPT) +#define SSL3_ST_SW_KEY_EXCH_A (0x150|SSL_ST_ACCEPT) +#define SSL3_ST_SW_KEY_EXCH_B (0x151|SSL_ST_ACCEPT) +#define SSL3_ST_SW_CERT_REQ_A (0x160|SSL_ST_ACCEPT) +#define SSL3_ST_SW_CERT_REQ_B (0x161|SSL_ST_ACCEPT) +#define SSL3_ST_SW_SRVR_DONE_A (0x170|SSL_ST_ACCEPT) +#define SSL3_ST_SW_SRVR_DONE_B (0x171|SSL_ST_ACCEPT) +/* read from client */ +#define SSL3_ST_SR_CERT_A (0x180|SSL_ST_ACCEPT) +#define SSL3_ST_SR_CERT_B (0x181|SSL_ST_ACCEPT) +#define SSL3_ST_SR_KEY_EXCH_A (0x190|SSL_ST_ACCEPT) +#define SSL3_ST_SR_KEY_EXCH_B (0x191|SSL_ST_ACCEPT) +#define SSL3_ST_SR_CERT_VRFY_A (0x1A0|SSL_ST_ACCEPT) +#define SSL3_ST_SR_CERT_VRFY_B (0x1A1|SSL_ST_ACCEPT) +#define SSL3_ST_SR_CHANGE_A (0x1B0|SSL_ST_ACCEPT) +#define SSL3_ST_SR_CHANGE_B (0x1B1|SSL_ST_ACCEPT) +#define SSL3_ST_SR_FINISHED_A (0x1C0|SSL_ST_ACCEPT) +#define SSL3_ST_SR_FINISHED_B (0x1C1|SSL_ST_ACCEPT) +/* write to client */ +#define SSL3_ST_SW_CHANGE_A (0x1D0|SSL_ST_ACCEPT) +#define SSL3_ST_SW_CHANGE_B (0x1D1|SSL_ST_ACCEPT) +#define SSL3_ST_SW_FINISHED_A (0x1E0|SSL_ST_ACCEPT) +#define SSL3_ST_SW_FINISHED_B (0x1E1|SSL_ST_ACCEPT) +#define SSL3_ST_SW_SESSION_TICKET_A (0x1F0|SSL_ST_ACCEPT) +#define SSL3_ST_SW_SESSION_TICKET_B (0x1F1|SSL_ST_ACCEPT) +#define SSL3_ST_SW_CERT_STATUS_A (0x200|SSL_ST_ACCEPT) +#define SSL3_ST_SW_CERT_STATUS_B (0x201|SSL_ST_ACCEPT) + +#define SSL3_MT_HELLO_REQUEST 0 +#define SSL3_MT_CLIENT_HELLO 1 +#define SSL3_MT_SERVER_HELLO 2 +#define SSL3_MT_NEWSESSION_TICKET 4 +#define SSL3_MT_CERTIFICATE 11 +#define SSL3_MT_SERVER_KEY_EXCHANGE 12 +#define SSL3_MT_CERTIFICATE_REQUEST 13 +#define SSL3_MT_SERVER_DONE 14 +#define SSL3_MT_CERTIFICATE_VERIFY 15 +#define SSL3_MT_CLIENT_KEY_EXCHANGE 16 +#define SSL3_MT_FINISHED 20 +#define SSL3_MT_CERTIFICATE_STATUS 22 + +#define DTLS1_MT_HELLO_VERIFY_REQUEST 3 + +#define SSL3_MT_CCS 1 + +#ifndef LIBRESSL_INTERNAL +/* These are used when changing over to a new cipher */ +#define SSL3_CC_READ 0x01 +#define SSL3_CC_WRITE 0x02 +#define SSL3_CC_CLIENT 0x10 +#define SSL3_CC_SERVER 0x20 +#define SSL3_CHANGE_CIPHER_CLIENT_WRITE (SSL3_CC_CLIENT|SSL3_CC_WRITE) +#define SSL3_CHANGE_CIPHER_SERVER_READ (SSL3_CC_SERVER|SSL3_CC_READ) +#define SSL3_CHANGE_CIPHER_CLIENT_READ (SSL3_CC_CLIENT|SSL3_CC_READ) +#define SSL3_CHANGE_CIPHER_SERVER_WRITE (SSL3_CC_SERVER|SSL3_CC_WRITE) +#endif + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/stack.h b/curl/include/openssl/stack.h new file mode 100644 index 0000000..783ccb4 --- /dev/null +++ b/curl/include/openssl/stack.h @@ -0,0 +1,99 @@ +/* $OpenBSD: stack.h,v 1.11 2024/03/02 11:20:36 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_STACK_H +#define HEADER_STACK_H + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct stack_st _STACK; + +#define M_sk_num(sk) ((sk) ? (sk)->num:-1) +#define M_sk_value(sk,n) ((sk) ? (sk)->data[n] : NULL) + +int sk_num(const _STACK *); +void *sk_value(const _STACK *, int); + +void *sk_set(_STACK *, int, void *); + +_STACK *sk_new(int (*cmp)(const void *, const void *)); +_STACK *sk_new_null(void); +void sk_free(_STACK *); +void sk_pop_free(_STACK *st, void (*func)(void *)); +int sk_insert(_STACK *sk, void *data, int where); +void *sk_delete(_STACK *st, int loc); +void *sk_delete_ptr(_STACK *st, void *p); +int sk_find(_STACK *st, void *data); +int sk_push(_STACK *st, void *data); +int sk_unshift(_STACK *st, void *data); +void *sk_shift(_STACK *st); +void *sk_pop(_STACK *st); +void sk_zero(_STACK *st); +int (*sk_set_cmp_func(_STACK *sk, int (*c)(const void *, const void *)))( + const void *, const void *); +_STACK *sk_dup(_STACK *st); +void sk_sort(_STACK *st); +int sk_is_sorted(const _STACK *st); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/tls1.h b/curl/include/openssl/tls1.h new file mode 100644 index 0000000..d018fce --- /dev/null +++ b/curl/include/openssl/tls1.h @@ -0,0 +1,764 @@ +/* $OpenBSD: tls1.h,v 1.60 2024/10/23 01:57:19 jsg Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ +/* ==================================================================== + * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ +/* ==================================================================== + * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. + * + * Portions of the attached software ("Contribution") are developed by + * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project. + * + * The Contribution is licensed pursuant to the OpenSSL open source + * license provided above. + * + * ECC cipher suite support in OpenSSL originally written by + * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories. + * + */ +/* ==================================================================== + * Copyright 2005 Nokia. All rights reserved. + * + * The portions of the attached software ("Contribution") is developed by + * Nokia Corporation and is licensed pursuant to the OpenSSL open source + * license. + * + * The Contribution, originally written by Mika Kousa and Pasi Eronen of + * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites + * support (see RFC 4279) to OpenSSL. + * + * No patent licenses or other rights except those expressly stated in + * the OpenSSL open source license shall be deemed granted or received + * expressly, by implication, estoppel, or otherwise. + * + * No assurances are provided by Nokia that the Contribution does not + * infringe the patent or other intellectual property rights of any third + * party or that the license provides you with all the necessary rights + * to make use of the Contribution. + * + * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN + * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA + * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY + * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR + * OTHERWISE. + */ + +#ifndef HEADER_TLS1_H +#define HEADER_TLS1_H + +#include + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define OPENSSL_TLS_SECURITY_LEVEL 1 + +#define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES 0 + +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +#define TLS1_3_VERSION 0x0304 +#endif + +#define TLS1_2_VERSION 0x0303 +#define TLS1_2_VERSION_MAJOR 0x03 +#define TLS1_2_VERSION_MINOR 0x03 + +#define TLS1_1_VERSION 0x0302 +#define TLS1_1_VERSION_MAJOR 0x03 +#define TLS1_1_VERSION_MINOR 0x02 + +#define TLS1_VERSION 0x0301 +#define TLS1_VERSION_MAJOR 0x03 +#define TLS1_VERSION_MINOR 0x01 + +#ifndef LIBRESSL_INTERNAL +#define TLS1_AD_DECRYPTION_FAILED 21 +#define TLS1_AD_RECORD_OVERFLOW 22 +#define TLS1_AD_UNKNOWN_CA 48 /* fatal */ +#define TLS1_AD_ACCESS_DENIED 49 /* fatal */ +#define TLS1_AD_DECODE_ERROR 50 /* fatal */ +#define TLS1_AD_DECRYPT_ERROR 51 +#define TLS1_AD_EXPORT_RESTRICTION 60 /* fatal */ +#define TLS1_AD_PROTOCOL_VERSION 70 /* fatal */ +#define TLS1_AD_INSUFFICIENT_SECURITY 71 /* fatal */ +#define TLS1_AD_INTERNAL_ERROR 80 /* fatal */ +/* Code 86 from RFC 7507. */ +#define TLS1_AD_INAPPROPRIATE_FALLBACK 86 /* fatal */ +#define TLS1_AD_USER_CANCELLED 90 +#define TLS1_AD_NO_RENEGOTIATION 100 +/* Codes 110-114 from RFC 3546. */ +#define TLS1_AD_UNSUPPORTED_EXTENSION 110 +#define TLS1_AD_CERTIFICATE_UNOBTAINABLE 111 +#define TLS1_AD_UNRECOGNIZED_NAME 112 +#define TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE 113 +#define TLS1_AD_BAD_CERTIFICATE_HASH_VALUE 114 +/* Code 115 from RFC 4279. */ +#define TLS1_AD_UNKNOWN_PSK_IDENTITY 115 /* fatal */ +#endif + +/* + * TLS ExtensionType values. + * + * https://www.iana.org/assignments/tls-extensiontype-values/ + */ + +/* ExtensionType values from RFC 3546, RFC 4366 and RFC 6066. */ +#define TLSEXT_TYPE_server_name 0 +#define TLSEXT_TYPE_max_fragment_length 1 +#define TLSEXT_TYPE_client_certificate_url 2 +#define TLSEXT_TYPE_trusted_ca_keys 3 +#define TLSEXT_TYPE_truncated_hmac 4 +#define TLSEXT_TYPE_status_request 5 + +/* ExtensionType values from RFC 4681. */ +#define TLSEXT_TYPE_user_mapping 6 + +/* ExtensionType values from RFC 5878. */ +#define TLSEXT_TYPE_client_authz 7 +#define TLSEXT_TYPE_server_authz 8 + +/* ExtensionType values from RFC 6091. */ +#define TLSEXT_TYPE_cert_type 9 + +/* ExtensionType values from RFC 7919. */ +#define TLSEXT_TYPE_supported_groups 10 + +/* ExtensionType values from RFC 4492. */ +#ifndef LIBRESSL_INTERNAL +#define TLSEXT_TYPE_elliptic_curves TLSEXT_TYPE_supported_groups +#endif +#define TLSEXT_TYPE_ec_point_formats 11 + +/* ExtensionType value from RFC 5054. */ +#define TLSEXT_TYPE_srp 12 + +/* ExtensionType value from RFC 5246/RFC 8446. */ +#define TLSEXT_TYPE_signature_algorithms 13 + +/* ExtensionType value from RFC 5764. */ +#define TLSEXT_TYPE_use_srtp 14 + +/* ExtensionType value from RFC 5620. */ +#define TLSEXT_TYPE_heartbeat 15 + +/* ExtensionType value from RFC 7301. */ +#define TLSEXT_TYPE_application_layer_protocol_negotiation 16 + +/* ExtensionType value from RFC 7685. */ +#define TLSEXT_TYPE_padding 21 + +/* ExtensionType value from RFC 4507. */ +#define TLSEXT_TYPE_session_ticket 35 + +/* ExtensionType values from RFC 8446 section 4.2 */ +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +#define TLSEXT_TYPE_pre_shared_key 41 +#define TLSEXT_TYPE_early_data 42 +#define TLSEXT_TYPE_supported_versions 43 +#define TLSEXT_TYPE_cookie 44 +#define TLSEXT_TYPE_psk_key_exchange_modes 45 +#define TLSEXT_TYPE_certificate_authorities 47 +#define TLSEXT_TYPE_oid_filters 48 +#define TLSEXT_TYPE_post_handshake_auth 49 +#define TLSEXT_TYPE_signature_algorithms_cert 50 +#define TLSEXT_TYPE_key_share 51 +#endif + +/* ExtensionType value from RFC 9001 section 8.2 */ +#if defined(LIBRESSL_HAS_QUIC) || defined(LIBRESSL_INTERNAL) +#define TLSEXT_TYPE_quic_transport_parameters 57 +#endif + +/* + * TLS 1.3 extension names from OpenSSL, where they decided to use a different + * name from that given in RFC 8446. + */ +#if defined(LIBRESSL_HAS_TLS1_3) +#define TLSEXT_TYPE_psk TLSEXT_TYPE_pre_shared_key +#define TLSEXT_TYPE_psk_kex_modes TLSEXT_TYPE_psk_key_exchange_modes +#endif + +/* Temporary extension type */ +#define TLSEXT_TYPE_renegotiate 0xff01 + +/* NameType value from RFC 3546. */ +#define TLSEXT_NAMETYPE_host_name 0 +/* status request value from RFC 3546 */ +#define TLSEXT_STATUSTYPE_ocsp 1 + +/* ECPointFormat values from RFC 4492. */ +#define TLSEXT_ECPOINTFORMAT_first 0 +#define TLSEXT_ECPOINTFORMAT_uncompressed 0 +#define TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime 1 +#define TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2 2 +#define TLSEXT_ECPOINTFORMAT_last 2 + +#define TLSEXT_MAXLEN_host_name 255 + +const char *SSL_get_servername(const SSL *s, const int type); +int SSL_get_servername_type(const SSL *s); +/* SSL_export_keying_material exports a value derived from the master secret, + * as specified in RFC 5705. It writes |olen| bytes to |out| given a label and + * optional context. (Since a zero length context is allowed, the |use_context| + * flag controls whether a context is included.) + * + * It returns 1 on success and zero otherwise. + */ +int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen, + const char *label, size_t llen, const unsigned char *p, size_t plen, + int use_context); + +int SSL_get_signature_type_nid(const SSL *ssl, int *nid); +int SSL_get_peer_signature_type_nid(const SSL *ssl, int *nid); + +#define SSL_set_tlsext_host_name(s,name) \ +SSL_ctrl(s,SSL_CTRL_SET_TLSEXT_HOSTNAME,TLSEXT_NAMETYPE_host_name,(char *)name) + +#define SSL_set_tlsext_debug_callback(ssl, cb) \ +SSL_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_DEBUG_CB,(void (*)(void))cb) + +#define SSL_set_tlsext_debug_arg(ssl, arg) \ +SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_DEBUG_ARG,0, (void *)arg) + +#define SSL_get_tlsext_status_type(ssl) \ +SSL_ctrl(ssl, SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE, 0, NULL) + +#define SSL_set_tlsext_status_type(ssl, type) \ +SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE,type, NULL) + +#define SSL_get_tlsext_status_exts(ssl, arg) \ +SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS,0, (void *)arg) + +#define SSL_set_tlsext_status_exts(ssl, arg) \ +SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS,0, (void *)arg) + +#define SSL_get_tlsext_status_ids(ssl, arg) \ +SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS,0, (void *)arg) + +#define SSL_set_tlsext_status_ids(ssl, arg) \ +SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS,0, (void *)arg) + +#define SSL_get_tlsext_status_ocsp_resp(ssl, arg) \ +SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP,0, (void *)arg) + +#define SSL_set_tlsext_status_ocsp_resp(ssl, arg, arglen) \ +SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP,arglen, (void *)arg) + +#define SSL_CTX_set_tlsext_servername_callback(ctx, cb) \ +SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TLSEXT_SERVERNAME_CB,(void (*)(void))cb) + +#define SSL_TLSEXT_ERR_OK 0 +#define SSL_TLSEXT_ERR_ALERT_WARNING 1 +#define SSL_TLSEXT_ERR_ALERT_FATAL 2 +#define SSL_TLSEXT_ERR_NOACK 3 + +#define SSL_CTX_set_tlsext_servername_arg(ctx, arg) \ +SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG,0, (void *)arg) + +#define SSL_CTX_get_tlsext_ticket_keys(ctx, keys, keylen) \ + SSL_CTX_ctrl((ctx),SSL_CTRL_GET_TLSEXT_TICKET_KEYS,(keylen),(keys)) +#define SSL_CTX_set_tlsext_ticket_keys(ctx, keys, keylen) \ + SSL_CTX_ctrl((ctx),SSL_CTRL_SET_TLSEXT_TICKET_KEYS,(keylen),(keys)) + +#define SSL_CTX_get_tlsext_status_cb(ssl, cb) \ +SSL_CTX_callback_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB,(void (*)(void))cb) +#define SSL_CTX_set_tlsext_status_cb(ssl, cb) \ +SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB,(void (*)(void))cb) + +#define SSL_CTX_get_tlsext_status_arg(ssl, arg) \ +SSL_CTX_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB_ARG,0,(void *)arg) +#define SSL_CTX_set_tlsext_status_arg(ssl, arg) \ +SSL_CTX_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG,0,(void *)arg) + +#define SSL_CTX_set_tlsext_ticket_key_cb(ssl, cb) \ +SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb) + +/* PSK ciphersuites from RFC 4279. */ +#define TLS1_CK_PSK_WITH_RC4_128_SHA 0x0300008A +#define TLS1_CK_PSK_WITH_3DES_EDE_CBC_SHA 0x0300008B +#define TLS1_CK_PSK_WITH_AES_128_CBC_SHA 0x0300008C +#define TLS1_CK_PSK_WITH_AES_256_CBC_SHA 0x0300008D + +/* Additional TLS ciphersuites from expired Internet Draft + * draft-ietf-tls-56-bit-ciphersuites-01.txt + * (available if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES is defined, see + * s3_lib.c). We actually treat them like SSL 3.0 ciphers, which we probably + * shouldn't. Note that the first two are actually not in the IDs. */ +#define TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5 0x03000060 /* not in ID */ +#define TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 0x03000061 /* not in ID */ +#define TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA 0x03000062 +#define TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA 0x03000063 +#define TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA 0x03000064 +#define TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA 0x03000065 +#define TLS1_CK_DHE_DSS_WITH_RC4_128_SHA 0x03000066 + +/* AES ciphersuites from RFC 3268. */ + +#define TLS1_CK_RSA_WITH_AES_128_SHA 0x0300002F +#define TLS1_CK_DH_DSS_WITH_AES_128_SHA 0x03000030 +#define TLS1_CK_DH_RSA_WITH_AES_128_SHA 0x03000031 +#define TLS1_CK_DHE_DSS_WITH_AES_128_SHA 0x03000032 +#define TLS1_CK_DHE_RSA_WITH_AES_128_SHA 0x03000033 +#define TLS1_CK_ADH_WITH_AES_128_SHA 0x03000034 + +#define TLS1_CK_RSA_WITH_AES_256_SHA 0x03000035 +#define TLS1_CK_DH_DSS_WITH_AES_256_SHA 0x03000036 +#define TLS1_CK_DH_RSA_WITH_AES_256_SHA 0x03000037 +#define TLS1_CK_DHE_DSS_WITH_AES_256_SHA 0x03000038 +#define TLS1_CK_DHE_RSA_WITH_AES_256_SHA 0x03000039 +#define TLS1_CK_ADH_WITH_AES_256_SHA 0x0300003A + +/* TLS v1.2 ciphersuites */ +#define TLS1_CK_RSA_WITH_NULL_SHA256 0x0300003B +#define TLS1_CK_RSA_WITH_AES_128_SHA256 0x0300003C +#define TLS1_CK_RSA_WITH_AES_256_SHA256 0x0300003D +#define TLS1_CK_DH_DSS_WITH_AES_128_SHA256 0x0300003E +#define TLS1_CK_DH_RSA_WITH_AES_128_SHA256 0x0300003F +#define TLS1_CK_DHE_DSS_WITH_AES_128_SHA256 0x03000040 + +/* Camellia ciphersuites from RFC 4132. */ +#define TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000041 +#define TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA 0x03000042 +#define TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000043 +#define TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA 0x03000044 +#define TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000045 +#define TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA 0x03000046 + +/* TLS v1.2 ciphersuites */ +#define TLS1_CK_DHE_RSA_WITH_AES_128_SHA256 0x03000067 +#define TLS1_CK_DH_DSS_WITH_AES_256_SHA256 0x03000068 +#define TLS1_CK_DH_RSA_WITH_AES_256_SHA256 0x03000069 +#define TLS1_CK_DHE_DSS_WITH_AES_256_SHA256 0x0300006A +#define TLS1_CK_DHE_RSA_WITH_AES_256_SHA256 0x0300006B +#define TLS1_CK_ADH_WITH_AES_128_SHA256 0x0300006C +#define TLS1_CK_ADH_WITH_AES_256_SHA256 0x0300006D + +/* Camellia ciphersuites from RFC 4132. */ +#define TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000084 +#define TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA 0x03000085 +#define TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000086 +#define TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA 0x03000087 +#define TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000088 +#define TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA 0x03000089 + +/* SEED ciphersuites from RFC 4162. */ +#define TLS1_CK_RSA_WITH_SEED_SHA 0x03000096 +#define TLS1_CK_DH_DSS_WITH_SEED_SHA 0x03000097 +#define TLS1_CK_DH_RSA_WITH_SEED_SHA 0x03000098 +#define TLS1_CK_DHE_DSS_WITH_SEED_SHA 0x03000099 +#define TLS1_CK_DHE_RSA_WITH_SEED_SHA 0x0300009A +#define TLS1_CK_ADH_WITH_SEED_SHA 0x0300009B + +/* TLS v1.2 GCM ciphersuites from RFC 5288. */ +#define TLS1_CK_RSA_WITH_AES_128_GCM_SHA256 0x0300009C +#define TLS1_CK_RSA_WITH_AES_256_GCM_SHA384 0x0300009D +#define TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256 0x0300009E +#define TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384 0x0300009F +#define TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256 0x030000A0 +#define TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384 0x030000A1 +#define TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256 0x030000A2 +#define TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384 0x030000A3 +#define TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256 0x030000A4 +#define TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384 0x030000A5 +#define TLS1_CK_ADH_WITH_AES_128_GCM_SHA256 0x030000A6 +#define TLS1_CK_ADH_WITH_AES_256_GCM_SHA384 0x030000A7 + +/* TLS 1.2 Camellia SHA-256 ciphersuites from RFC5932 */ +#define TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA256 0x030000BA +#define TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 0x030000BB +#define TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 0x030000BC +#define TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 0x030000BD +#define TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0x030000BE +#define TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA256 0x030000BF + +#define TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA256 0x030000C0 +#define TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 0x030000C1 +#define TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 0x030000C2 +#define TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 0x030000C3 +#define TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 0x030000C4 +#define TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA256 0x030000C5 + +/* TLS 1.3 cipher suites from RFC 8446 appendix B.4. */ +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +#define TLS1_3_CK_AES_128_GCM_SHA256 0x03001301 +#define TLS1_3_CK_AES_256_GCM_SHA384 0x03001302 +#define TLS1_3_CK_CHACHA20_POLY1305_SHA256 0x03001303 +#define TLS1_3_CK_AES_128_CCM_SHA256 0x03001304 +#define TLS1_3_CK_AES_128_CCM_8_SHA256 0x03001305 +#endif + +/* ECC ciphersuites from RFC 4492. */ +#define TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA 0x0300C001 +#define TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA 0x0300C002 +#define TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA 0x0300C003 +#define TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0x0300C004 +#define TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0x0300C005 + +#define TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA 0x0300C006 +#define TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA 0x0300C007 +#define TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA 0x0300C008 +#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0x0300C009 +#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0x0300C00A + +#define TLS1_CK_ECDH_RSA_WITH_NULL_SHA 0x0300C00B +#define TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA 0x0300C00C +#define TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA 0x0300C00D +#define TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA 0x0300C00E +#define TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA 0x0300C00F + +#define TLS1_CK_ECDHE_RSA_WITH_NULL_SHA 0x0300C010 +#define TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA 0x0300C011 +#define TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA 0x0300C012 +#define TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA 0x0300C013 +#define TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA 0x0300C014 + +#define TLS1_CK_ECDH_anon_WITH_NULL_SHA 0x0300C015 +#define TLS1_CK_ECDH_anon_WITH_RC4_128_SHA 0x0300C016 +#define TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA 0x0300C017 +#define TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA 0x0300C018 +#define TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA 0x0300C019 + +/* SRP ciphersuites from RFC 5054. */ +#define TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA 0x0300C01A +#define TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA 0x0300C01B +#define TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA 0x0300C01C +#define TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA 0x0300C01D +#define TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA 0x0300C01E +#define TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA 0x0300C01F +#define TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA 0x0300C020 +#define TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA 0x0300C021 +#define TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA 0x0300C022 + +/* ECDH HMAC based ciphersuites from RFC 5289. */ +#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256 0x0300C023 +#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384 0x0300C024 +#define TLS1_CK_ECDH_ECDSA_WITH_AES_128_SHA256 0x0300C025 +#define TLS1_CK_ECDH_ECDSA_WITH_AES_256_SHA384 0x0300C026 +#define TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256 0x0300C027 +#define TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384 0x0300C028 +#define TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256 0x0300C029 +#define TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384 0x0300C02A + +/* ECDH GCM based ciphersuites from RFC 5289. */ +#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0x0300C02B +#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0x0300C02C +#define TLS1_CK_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0x0300C02D +#define TLS1_CK_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 0x0300C02E +#define TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0x0300C02F +#define TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0x0300C030 +#define TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256 0x0300C031 +#define TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384 0x0300C032 + +/* ChaCha20-Poly1305 based ciphersuites. */ +#define TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305 0x0300CCA8 +#define TLS1_CK_ECDHE_ECDSA_CHACHA20_POLY1305 0x0300CCA9 +#define TLS1_CK_DHE_RSA_CHACHA20_POLY1305 0x0300CCAA + +#define TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5 "EXP1024-RC4-MD5" +#define TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 "EXP1024-RC2-CBC-MD5" +#define TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA "EXP1024-DES-CBC-SHA" +#define TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA "EXP1024-DHE-DSS-DES-CBC-SHA" +#define TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA "EXP1024-RC4-SHA" +#define TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA "EXP1024-DHE-DSS-RC4-SHA" +#define TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA "DHE-DSS-RC4-SHA" + +/* AES ciphersuites from RFC 3268. */ +#define TLS1_TXT_RSA_WITH_AES_128_SHA "AES128-SHA" +#define TLS1_TXT_DH_DSS_WITH_AES_128_SHA "DH-DSS-AES128-SHA" +#define TLS1_TXT_DH_RSA_WITH_AES_128_SHA "DH-RSA-AES128-SHA" +#define TLS1_TXT_DHE_DSS_WITH_AES_128_SHA "DHE-DSS-AES128-SHA" +#define TLS1_TXT_DHE_RSA_WITH_AES_128_SHA "DHE-RSA-AES128-SHA" +#define TLS1_TXT_ADH_WITH_AES_128_SHA "ADH-AES128-SHA" + +#define TLS1_TXT_RSA_WITH_AES_256_SHA "AES256-SHA" +#define TLS1_TXT_DH_DSS_WITH_AES_256_SHA "DH-DSS-AES256-SHA" +#define TLS1_TXT_DH_RSA_WITH_AES_256_SHA "DH-RSA-AES256-SHA" +#define TLS1_TXT_DHE_DSS_WITH_AES_256_SHA "DHE-DSS-AES256-SHA" +#define TLS1_TXT_DHE_RSA_WITH_AES_256_SHA "DHE-RSA-AES256-SHA" +#define TLS1_TXT_ADH_WITH_AES_256_SHA "ADH-AES256-SHA" + +/* ECC ciphersuites from draft-ietf-tls-ecc-01.txt (Mar 15, 2001) */ +#define TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA "ECDH-ECDSA-NULL-SHA" +#define TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA "ECDH-ECDSA-RC4-SHA" +#define TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA "ECDH-ECDSA-DES-CBC3-SHA" +#define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA "ECDH-ECDSA-AES128-SHA" +#define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA "ECDH-ECDSA-AES256-SHA" + +#define TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA "ECDHE-ECDSA-NULL-SHA" +#define TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA "ECDHE-ECDSA-RC4-SHA" +#define TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA "ECDHE-ECDSA-DES-CBC3-SHA" +#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA "ECDHE-ECDSA-AES128-SHA" +#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA "ECDHE-ECDSA-AES256-SHA" + +#define TLS1_TXT_ECDH_RSA_WITH_NULL_SHA "ECDH-RSA-NULL-SHA" +#define TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA "ECDH-RSA-RC4-SHA" +#define TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA "ECDH-RSA-DES-CBC3-SHA" +#define TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA "ECDH-RSA-AES128-SHA" +#define TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA "ECDH-RSA-AES256-SHA" + +#define TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA "ECDHE-RSA-NULL-SHA" +#define TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA "ECDHE-RSA-RC4-SHA" +#define TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA "ECDHE-RSA-DES-CBC3-SHA" +#define TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA "ECDHE-RSA-AES128-SHA" +#define TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA "ECDHE-RSA-AES256-SHA" + +#define TLS1_TXT_ECDH_anon_WITH_NULL_SHA "AECDH-NULL-SHA" +#define TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA "AECDH-RC4-SHA" +#define TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA "AECDH-DES-CBC3-SHA" +#define TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA "AECDH-AES128-SHA" +#define TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA "AECDH-AES256-SHA" + +/* PSK ciphersuites from RFC 4279. */ +#define TLS1_TXT_PSK_WITH_RC4_128_SHA "PSK-RC4-SHA" +#define TLS1_TXT_PSK_WITH_3DES_EDE_CBC_SHA "PSK-3DES-EDE-CBC-SHA" +#define TLS1_TXT_PSK_WITH_AES_128_CBC_SHA "PSK-AES128-CBC-SHA" +#define TLS1_TXT_PSK_WITH_AES_256_CBC_SHA "PSK-AES256-CBC-SHA" + +/* SRP ciphersuite from RFC 5054. */ +#define TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA "SRP-3DES-EDE-CBC-SHA" +#define TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA "SRP-RSA-3DES-EDE-CBC-SHA" +#define TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA "SRP-DSS-3DES-EDE-CBC-SHA" +#define TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA "SRP-AES-128-CBC-SHA" +#define TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA "SRP-RSA-AES-128-CBC-SHA" +#define TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA "SRP-DSS-AES-128-CBC-SHA" +#define TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA "SRP-AES-256-CBC-SHA" +#define TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA "SRP-RSA-AES-256-CBC-SHA" +#define TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA "SRP-DSS-AES-256-CBC-SHA" + +/* Camellia ciphersuites from RFC 4132. */ +#define TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA "CAMELLIA128-SHA" +#define TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA "DH-DSS-CAMELLIA128-SHA" +#define TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA "DH-RSA-CAMELLIA128-SHA" +#define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA "DHE-DSS-CAMELLIA128-SHA" +#define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA "DHE-RSA-CAMELLIA128-SHA" +#define TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA "ADH-CAMELLIA128-SHA" + +#define TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA "CAMELLIA256-SHA" +#define TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA "DH-DSS-CAMELLIA256-SHA" +#define TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA "DH-RSA-CAMELLIA256-SHA" +#define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA "DHE-DSS-CAMELLIA256-SHA" +#define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA "DHE-RSA-CAMELLIA256-SHA" +#define TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA "ADH-CAMELLIA256-SHA" + +/* TLS 1.2 Camellia SHA-256 ciphersuites from RFC5932 */ +#define TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA256 "CAMELLIA128-SHA256" +#define TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 "DH-DSS-CAMELLIA128-SHA256" +#define TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 "DH-RSA-CAMELLIA128-SHA256" +#define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 "DHE-DSS-CAMELLIA128-SHA256" +#define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 "DHE-RSA-CAMELLIA128-SHA256" +#define TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA256 "ADH-CAMELLIA128-SHA256" + +#define TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA256 "CAMELLIA256-SHA256" +#define TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 "DH-DSS-CAMELLIA256-SHA256" +#define TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 "DH-RSA-CAMELLIA256-SHA256" +#define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 "DHE-DSS-CAMELLIA256-SHA256" +#define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 "DHE-RSA-CAMELLIA256-SHA256" +#define TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA256 "ADH-CAMELLIA256-SHA256" + +/* SEED ciphersuites from RFC 4162. */ +#define TLS1_TXT_RSA_WITH_SEED_SHA "SEED-SHA" +#define TLS1_TXT_DH_DSS_WITH_SEED_SHA "DH-DSS-SEED-SHA" +#define TLS1_TXT_DH_RSA_WITH_SEED_SHA "DH-RSA-SEED-SHA" +#define TLS1_TXT_DHE_DSS_WITH_SEED_SHA "DHE-DSS-SEED-SHA" +#define TLS1_TXT_DHE_RSA_WITH_SEED_SHA "DHE-RSA-SEED-SHA" +#define TLS1_TXT_ADH_WITH_SEED_SHA "ADH-SEED-SHA" + +/* TLS v1.2 ciphersuites. */ +#define TLS1_TXT_RSA_WITH_NULL_SHA256 "NULL-SHA256" +#define TLS1_TXT_RSA_WITH_AES_128_SHA256 "AES128-SHA256" +#define TLS1_TXT_RSA_WITH_AES_256_SHA256 "AES256-SHA256" +#define TLS1_TXT_DH_DSS_WITH_AES_128_SHA256 "DH-DSS-AES128-SHA256" +#define TLS1_TXT_DH_RSA_WITH_AES_128_SHA256 "DH-RSA-AES128-SHA256" +#define TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256 "DHE-DSS-AES128-SHA256" +#define TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256 "DHE-RSA-AES128-SHA256" +#define TLS1_TXT_DH_DSS_WITH_AES_256_SHA256 "DH-DSS-AES256-SHA256" +#define TLS1_TXT_DH_RSA_WITH_AES_256_SHA256 "DH-RSA-AES256-SHA256" +#define TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256 "DHE-DSS-AES256-SHA256" +#define TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256 "DHE-RSA-AES256-SHA256" +#define TLS1_TXT_ADH_WITH_AES_128_SHA256 "ADH-AES128-SHA256" +#define TLS1_TXT_ADH_WITH_AES_256_SHA256 "ADH-AES256-SHA256" + +/* TLS v1.2 GCM ciphersuites from RFC 5288. */ +#define TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256 "AES128-GCM-SHA256" +#define TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384 "AES256-GCM-SHA384" +#define TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256 "DHE-RSA-AES128-GCM-SHA256" +#define TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384 "DHE-RSA-AES256-GCM-SHA384" +#define TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256 "DH-RSA-AES128-GCM-SHA256" +#define TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384 "DH-RSA-AES256-GCM-SHA384" +#define TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256 "DHE-DSS-AES128-GCM-SHA256" +#define TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384 "DHE-DSS-AES256-GCM-SHA384" +#define TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256 "DH-DSS-AES128-GCM-SHA256" +#define TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384 "DH-DSS-AES256-GCM-SHA384" +#define TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256 "ADH-AES128-GCM-SHA256" +#define TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384 "ADH-AES256-GCM-SHA384" + +/* ECDH HMAC based ciphersuites from RFC 5289. */ +#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256 "ECDHE-ECDSA-AES128-SHA256" +#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384 "ECDHE-ECDSA-AES256-SHA384" +#define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_SHA256 "ECDH-ECDSA-AES128-SHA256" +#define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_SHA384 "ECDH-ECDSA-AES256-SHA384" +#define TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256 "ECDHE-RSA-AES128-SHA256" +#define TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384 "ECDHE-RSA-AES256-SHA384" +#define TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256 "ECDH-RSA-AES128-SHA256" +#define TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384 "ECDH-RSA-AES256-SHA384" + +/* ECDH GCM based ciphersuites from RFC 5289. */ +#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 "ECDHE-ECDSA-AES128-GCM-SHA256" +#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 "ECDHE-ECDSA-AES256-GCM-SHA384" +#define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 "ECDH-ECDSA-AES128-GCM-SHA256" +#define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 "ECDH-ECDSA-AES256-GCM-SHA384" +#define TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256 "ECDHE-RSA-AES128-GCM-SHA256" +#define TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384 "ECDHE-RSA-AES256-GCM-SHA384" +#define TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256 "ECDH-RSA-AES128-GCM-SHA256" +#define TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384 "ECDH-RSA-AES256-GCM-SHA384" + +/* ChaCha20-Poly1305 based ciphersuites. */ +#define TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305 "ECDHE-RSA-CHACHA20-POLY1305" +#define TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 "ECDHE-ECDSA-CHACHA20-POLY1305" +#define TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305 "DHE-RSA-CHACHA20-POLY1305" + +/* TLS 1.3 cipher suites from RFC 8446 appendix B.4. */ +#if defined(LIBRESSL_HAS_TLS1_3) || defined(LIBRESSL_INTERNAL) +#define TLS1_3_TXT_AES_128_GCM_SHA256 "AEAD-AES128-GCM-SHA256" +#define TLS1_3_TXT_AES_256_GCM_SHA384 "AEAD-AES256-GCM-SHA384" +#define TLS1_3_TXT_CHACHA20_POLY1305_SHA256 "AEAD-CHACHA20-POLY1305-SHA256" +#define TLS1_3_TXT_AES_128_CCM_SHA256 "AEAD-AES128-CCM-SHA256" +#define TLS1_3_TXT_AES_128_CCM_8_SHA256 "AEAD-AES128-CCM-8-SHA256" + +#define TLS1_3_RFC_AES_128_GCM_SHA256 "TLS_AES_128_GCM_SHA256" +#define TLS1_3_RFC_AES_256_GCM_SHA384 "TLS_AES_256_GCM_SHA384" +#define TLS1_3_RFC_CHACHA20_POLY1305_SHA256 "TLS_CHACHA20_POLY1305_SHA256" +#define TLS1_3_RFC_AES_128_CCM_SHA256 "TLS_AES_128_CCM_SHA256" +#define TLS1_3_RFC_AES_128_CCM_8_SHA256 "TLS_AES_128_CCM_8_SHA256" +#endif + +#define TLS1_FINISH_MAC_LENGTH 12 + +#define TLS_MD_MAX_CONST_SIZE 20 +#define TLS_MD_CLIENT_FINISH_CONST "client finished" +#define TLS_MD_CLIENT_FINISH_CONST_SIZE 15 +#define TLS_MD_SERVER_FINISH_CONST "server finished" +#define TLS_MD_SERVER_FINISH_CONST_SIZE 15 +#define TLS_MD_KEY_EXPANSION_CONST "key expansion" +#define TLS_MD_KEY_EXPANSION_CONST_SIZE 13 +#define TLS_MD_CLIENT_WRITE_KEY_CONST "client write key" +#define TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE 16 +#define TLS_MD_SERVER_WRITE_KEY_CONST "server write key" +#define TLS_MD_SERVER_WRITE_KEY_CONST_SIZE 16 +#define TLS_MD_IV_BLOCK_CONST "IV block" +#define TLS_MD_IV_BLOCK_CONST_SIZE 8 +#define TLS_MD_MASTER_SECRET_CONST "master secret" +#define TLS_MD_MASTER_SECRET_CONST_SIZE 13 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/ts.h b/curl/include/openssl/ts.h new file mode 100644 index 0000000..c2b2a9e --- /dev/null +++ b/curl/include/openssl/ts.h @@ -0,0 +1,660 @@ +/* $OpenBSD: ts.h,v 1.24 2024/03/26 00:39:22 beck Exp $ */ +/* Written by Zoltan Glozik (zglozik@opentsa.org) for the OpenSSL + * project 2002, 2003, 2004. + */ +/* ==================================================================== + * Copyright (c) 2006 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#ifndef HEADER_TS_H +#define HEADER_TS_H + +#include + +#ifndef OPENSSL_NO_BUFFER +#include +#endif +#ifndef OPENSSL_NO_EVP +#include +#endif +#ifndef OPENSSL_NO_BIO +#include +#endif +#include +#include +#include + +#ifndef OPENSSL_NO_RSA +#include +#endif + +#ifndef OPENSSL_NO_DSA +#include +#endif + +#ifndef OPENSSL_NO_DH +#include +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +#include +#include + +typedef struct TS_msg_imprint_st TS_MSG_IMPRINT; +typedef struct TS_req_st TS_REQ; +typedef struct TS_accuracy_st TS_ACCURACY; +typedef struct TS_tst_info_st TS_TST_INFO; + +/* Possible values for status. */ +#define TS_STATUS_GRANTED 0 +#define TS_STATUS_GRANTED_WITH_MODS 1 +#define TS_STATUS_REJECTION 2 +#define TS_STATUS_WAITING 3 +#define TS_STATUS_REVOCATION_WARNING 4 +#define TS_STATUS_REVOCATION_NOTIFICATION 5 + +/* Possible values for failure_info. */ +#define TS_INFO_BAD_ALG 0 +#define TS_INFO_BAD_REQUEST 2 +#define TS_INFO_BAD_DATA_FORMAT 5 +#define TS_INFO_TIME_NOT_AVAILABLE 14 +#define TS_INFO_UNACCEPTED_POLICY 15 +#define TS_INFO_UNACCEPTED_EXTENSION 16 +#define TS_INFO_ADD_INFO_NOT_AVAILABLE 17 +#define TS_INFO_SYSTEM_FAILURE 25 + +typedef struct TS_status_info_st TS_STATUS_INFO; + +DECLARE_STACK_OF(ASN1_UTF8STRING) + +typedef struct ESS_issuer_serial ESS_ISSUER_SERIAL; +typedef struct ESS_cert_id ESS_CERT_ID; +DECLARE_STACK_OF(ESS_CERT_ID) +typedef struct ESS_signing_cert ESS_SIGNING_CERT; + +typedef struct ESS_cert_id_v2 ESS_CERT_ID_V2; +DECLARE_STACK_OF(ESS_CERT_ID_V2) + +typedef struct ESS_signing_cert_v2 ESS_SIGNING_CERT_V2; + +typedef struct TS_resp_st TS_RESP; + +TS_REQ *TS_REQ_new(void); +void TS_REQ_free(TS_REQ *a); +int i2d_TS_REQ(const TS_REQ *a, unsigned char **pp); +TS_REQ *d2i_TS_REQ(TS_REQ **a, const unsigned char **pp, long length); + +TS_REQ *TS_REQ_dup(TS_REQ *a); + +TS_REQ *d2i_TS_REQ_fp(FILE *fp, TS_REQ **a); +int i2d_TS_REQ_fp(FILE *fp, TS_REQ *a); +TS_REQ *d2i_TS_REQ_bio(BIO *fp, TS_REQ **a); +int i2d_TS_REQ_bio(BIO *fp, TS_REQ *a); + +TS_MSG_IMPRINT *TS_MSG_IMPRINT_new(void); +void TS_MSG_IMPRINT_free(TS_MSG_IMPRINT *a); +int i2d_TS_MSG_IMPRINT(const TS_MSG_IMPRINT *a, unsigned char **pp); +TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT(TS_MSG_IMPRINT **a, + const unsigned char **pp, long length); + +TS_MSG_IMPRINT *TS_MSG_IMPRINT_dup(TS_MSG_IMPRINT *a); + +TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT **a); +int i2d_TS_MSG_IMPRINT_fp(FILE *fp, TS_MSG_IMPRINT *a); +TS_MSG_IMPRINT *d2i_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT **a); +int i2d_TS_MSG_IMPRINT_bio(BIO *fp, TS_MSG_IMPRINT *a); + +TS_RESP *TS_RESP_new(void); +void TS_RESP_free(TS_RESP *a); +int i2d_TS_RESP(const TS_RESP *a, unsigned char **pp); +TS_RESP *d2i_TS_RESP(TS_RESP **a, const unsigned char **pp, long length); +TS_TST_INFO *PKCS7_to_TS_TST_INFO(PKCS7 *token); +TS_RESP *TS_RESP_dup(TS_RESP *a); + +TS_RESP *d2i_TS_RESP_fp(FILE *fp, TS_RESP **a); +int i2d_TS_RESP_fp(FILE *fp, TS_RESP *a); +TS_RESP *d2i_TS_RESP_bio(BIO *fp, TS_RESP **a); +int i2d_TS_RESP_bio(BIO *fp, TS_RESP *a); + +TS_STATUS_INFO *TS_STATUS_INFO_new(void); +void TS_STATUS_INFO_free(TS_STATUS_INFO *a); +int i2d_TS_STATUS_INFO(const TS_STATUS_INFO *a, unsigned char **pp); +TS_STATUS_INFO *d2i_TS_STATUS_INFO(TS_STATUS_INFO **a, + const unsigned char **pp, long length); +TS_STATUS_INFO *TS_STATUS_INFO_dup(TS_STATUS_INFO *a); + +TS_TST_INFO *TS_TST_INFO_new(void); +void TS_TST_INFO_free(TS_TST_INFO *a); +int i2d_TS_TST_INFO(const TS_TST_INFO *a, unsigned char **pp); +TS_TST_INFO *d2i_TS_TST_INFO(TS_TST_INFO **a, const unsigned char **pp, + long length); +TS_TST_INFO *TS_TST_INFO_dup(TS_TST_INFO *a); + +TS_TST_INFO *d2i_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO **a); +int i2d_TS_TST_INFO_fp(FILE *fp, TS_TST_INFO *a); +TS_TST_INFO *d2i_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO **a); +int i2d_TS_TST_INFO_bio(BIO *fp, TS_TST_INFO *a); + +TS_ACCURACY *TS_ACCURACY_new(void); +void TS_ACCURACY_free(TS_ACCURACY *a); +int i2d_TS_ACCURACY(const TS_ACCURACY *a, unsigned char **pp); +TS_ACCURACY *d2i_TS_ACCURACY(TS_ACCURACY **a, const unsigned char **pp, + long length); +TS_ACCURACY *TS_ACCURACY_dup(TS_ACCURACY *a); + +ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_new(void); +void ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *a); +int i2d_ESS_ISSUER_SERIAL(const ESS_ISSUER_SERIAL *a, + unsigned char **pp); +ESS_ISSUER_SERIAL *d2i_ESS_ISSUER_SERIAL(ESS_ISSUER_SERIAL **a, + const unsigned char **pp, long length); +ESS_ISSUER_SERIAL *ESS_ISSUER_SERIAL_dup(ESS_ISSUER_SERIAL *a); + +ESS_CERT_ID *ESS_CERT_ID_new(void); +void ESS_CERT_ID_free(ESS_CERT_ID *a); +int i2d_ESS_CERT_ID(const ESS_CERT_ID *a, unsigned char **pp); +ESS_CERT_ID *d2i_ESS_CERT_ID(ESS_CERT_ID **a, const unsigned char **pp, + long length); +ESS_CERT_ID *ESS_CERT_ID_dup(ESS_CERT_ID *a); + +ESS_SIGNING_CERT *ESS_SIGNING_CERT_new(void); +void ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *a); +int i2d_ESS_SIGNING_CERT(const ESS_SIGNING_CERT *a, + unsigned char **pp); +ESS_SIGNING_CERT *d2i_ESS_SIGNING_CERT(ESS_SIGNING_CERT **a, + const unsigned char **pp, long length); +ESS_SIGNING_CERT *ESS_SIGNING_CERT_dup(ESS_SIGNING_CERT *a); + +int TS_REQ_set_version(TS_REQ *a, long version); +long TS_REQ_get_version(const TS_REQ *a); + +int TS_REQ_set_msg_imprint(TS_REQ *a, TS_MSG_IMPRINT *msg_imprint); +TS_MSG_IMPRINT *TS_REQ_get_msg_imprint(TS_REQ *a); + +int TS_MSG_IMPRINT_set_algo(TS_MSG_IMPRINT *a, X509_ALGOR *alg); +X509_ALGOR *TS_MSG_IMPRINT_get_algo(TS_MSG_IMPRINT *a); + +int TS_MSG_IMPRINT_set_msg(TS_MSG_IMPRINT *a, unsigned char *d, int len); +ASN1_OCTET_STRING *TS_MSG_IMPRINT_get_msg(TS_MSG_IMPRINT *a); + +int TS_REQ_set_policy_id(TS_REQ *a, const ASN1_OBJECT *policy); +ASN1_OBJECT *TS_REQ_get_policy_id(TS_REQ *a); + +int TS_REQ_set_nonce(TS_REQ *a, const ASN1_INTEGER *nonce); +const ASN1_INTEGER *TS_REQ_get_nonce(const TS_REQ *a); + +int TS_REQ_set_cert_req(TS_REQ *a, int cert_req); +int TS_REQ_get_cert_req(const TS_REQ *a); + +STACK_OF(X509_EXTENSION) *TS_REQ_get_exts(TS_REQ *a); +void TS_REQ_ext_free(TS_REQ *a); +int TS_REQ_get_ext_count(TS_REQ *a); +int TS_REQ_get_ext_by_NID(TS_REQ *a, int nid, int lastpos); +int TS_REQ_get_ext_by_OBJ(TS_REQ *a, const ASN1_OBJECT *obj, int lastpos); +int TS_REQ_get_ext_by_critical(TS_REQ *a, int crit, int lastpos); +X509_EXTENSION *TS_REQ_get_ext(TS_REQ *a, int loc); +X509_EXTENSION *TS_REQ_delete_ext(TS_REQ *a, int loc); +int TS_REQ_add_ext(TS_REQ *a, X509_EXTENSION *ex, int loc); +void *TS_REQ_get_ext_d2i(TS_REQ *a, int nid, int *crit, int *idx); + +/* Function declarations for TS_REQ defined in ts/ts_req_print.c */ + +int TS_REQ_print_bio(BIO *bio, TS_REQ *a); + +/* Function declarations for TS_RESP defined in ts/ts_rsp_utils.c */ + +int TS_RESP_set_status_info(TS_RESP *a, TS_STATUS_INFO *info); +TS_STATUS_INFO *TS_RESP_get_status_info(TS_RESP *a); + +const ASN1_UTF8STRING *TS_STATUS_INFO_get0_failure_info(const TS_STATUS_INFO *si); +const STACK_OF(ASN1_UTF8STRING) * + TS_STATUS_INFO_get0_text(const TS_STATUS_INFO *si); +const ASN1_INTEGER *TS_STATUS_INFO_get0_status(const TS_STATUS_INFO *si); +int TS_STATUS_INFO_set_status(TS_STATUS_INFO *si, int i); + +/* Caller loses ownership of PKCS7 and TS_TST_INFO objects. */ +void TS_RESP_set_tst_info(TS_RESP *a, PKCS7 *p7, TS_TST_INFO *tst_info); +PKCS7 *TS_RESP_get_token(TS_RESP *a); +TS_TST_INFO *TS_RESP_get_tst_info(TS_RESP *a); + +int TS_TST_INFO_set_version(TS_TST_INFO *a, long version); +long TS_TST_INFO_get_version(const TS_TST_INFO *a); + +int TS_TST_INFO_set_policy_id(TS_TST_INFO *a, ASN1_OBJECT *policy_id); +ASN1_OBJECT *TS_TST_INFO_get_policy_id(TS_TST_INFO *a); + +int TS_TST_INFO_set_msg_imprint(TS_TST_INFO *a, TS_MSG_IMPRINT *msg_imprint); +TS_MSG_IMPRINT *TS_TST_INFO_get_msg_imprint(TS_TST_INFO *a); + +int TS_TST_INFO_set_serial(TS_TST_INFO *a, const ASN1_INTEGER *serial); +const ASN1_INTEGER *TS_TST_INFO_get_serial(const TS_TST_INFO *a); + +int TS_TST_INFO_set_time(TS_TST_INFO *a, const ASN1_GENERALIZEDTIME *gtime); +const ASN1_GENERALIZEDTIME *TS_TST_INFO_get_time(const TS_TST_INFO *a); + +int TS_TST_INFO_set_accuracy(TS_TST_INFO *a, TS_ACCURACY *accuracy); +TS_ACCURACY *TS_TST_INFO_get_accuracy(TS_TST_INFO *a); + +int TS_ACCURACY_set_seconds(TS_ACCURACY *a, const ASN1_INTEGER *seconds); +const ASN1_INTEGER *TS_ACCURACY_get_seconds(const TS_ACCURACY *a); + +int TS_ACCURACY_set_millis(TS_ACCURACY *a, const ASN1_INTEGER *millis); +const ASN1_INTEGER *TS_ACCURACY_get_millis(const TS_ACCURACY *a); + +int TS_ACCURACY_set_micros(TS_ACCURACY *a, const ASN1_INTEGER *micros); +const ASN1_INTEGER *TS_ACCURACY_get_micros(const TS_ACCURACY *a); + +int TS_TST_INFO_set_ordering(TS_TST_INFO *a, int ordering); +int TS_TST_INFO_get_ordering(const TS_TST_INFO *a); + +int TS_TST_INFO_set_nonce(TS_TST_INFO *a, const ASN1_INTEGER *nonce); +const ASN1_INTEGER *TS_TST_INFO_get_nonce(const TS_TST_INFO *a); + +int TS_TST_INFO_set_tsa(TS_TST_INFO *a, GENERAL_NAME *tsa); +GENERAL_NAME *TS_TST_INFO_get_tsa(TS_TST_INFO *a); + +STACK_OF(X509_EXTENSION) *TS_TST_INFO_get_exts(TS_TST_INFO *a); +void TS_TST_INFO_ext_free(TS_TST_INFO *a); +int TS_TST_INFO_get_ext_count(TS_TST_INFO *a); +int TS_TST_INFO_get_ext_by_NID(TS_TST_INFO *a, int nid, int lastpos); +int TS_TST_INFO_get_ext_by_OBJ(TS_TST_INFO *a, const ASN1_OBJECT *obj, + int lastpos); +int TS_TST_INFO_get_ext_by_critical(TS_TST_INFO *a, int crit, int lastpos); +X509_EXTENSION *TS_TST_INFO_get_ext(TS_TST_INFO *a, int loc); +X509_EXTENSION *TS_TST_INFO_delete_ext(TS_TST_INFO *a, int loc); +int TS_TST_INFO_add_ext(TS_TST_INFO *a, X509_EXTENSION *ex, int loc); +void *TS_TST_INFO_get_ext_d2i(TS_TST_INFO *a, int nid, int *crit, int *idx); + +/* Declarations related to response generation, defined in ts/ts_rsp_sign.c. */ + +/* Optional flags for response generation. */ + +/* Don't include the TSA name in response. */ +#define TS_TSA_NAME 0x01 + +/* Set ordering to true in response. */ +#define TS_ORDERING 0x02 + +/* + * Include the signer certificate and the other specified certificates in + * the ESS signing certificate attribute beside the PKCS7 signed data. + * Only the signer certificates is included by default. + */ +#define TS_ESS_CERT_ID_CHAIN 0x04 + +/* Forward declaration. */ +struct TS_resp_ctx; + +/* This must return a unique number less than 160 bits long. */ +typedef ASN1_INTEGER *(*TS_serial_cb)(struct TS_resp_ctx *, void *); + +/* This must return the seconds and microseconds since Jan 1, 1970 in + the sec and usec variables allocated by the caller. + Return non-zero for success and zero for failure. */ +typedef int (*TS_time_cb)(struct TS_resp_ctx *, void *, time_t *sec, long *usec); + +/* This must process the given extension. + * It can modify the TS_TST_INFO object of the context. + * Return values: !0 (processed), 0 (error, it must set the + * status info/failure info of the response). + */ +typedef int (*TS_extension_cb)(struct TS_resp_ctx *, X509_EXTENSION *, void *); + +typedef struct TS_resp_ctx TS_RESP_CTX; + +DECLARE_STACK_OF(EVP_MD) + +/* Creates a response context that can be used for generating responses. */ +TS_RESP_CTX *TS_RESP_CTX_new(void); +void TS_RESP_CTX_free(TS_RESP_CTX *ctx); + +/* This parameter must be set. */ +int TS_RESP_CTX_set_signer_cert(TS_RESP_CTX *ctx, X509 *signer); + +/* This parameter must be set. */ +int TS_RESP_CTX_set_signer_key(TS_RESP_CTX *ctx, EVP_PKEY *key); + +/* This parameter must be set. */ +int TS_RESP_CTX_set_def_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *def_policy); + +/* No additional certs are included in the response by default. */ +int TS_RESP_CTX_set_certs(TS_RESP_CTX *ctx, STACK_OF(X509) *certs); + +/* Adds a new acceptable policy, only the default policy + is accepted by default. */ +int TS_RESP_CTX_add_policy(TS_RESP_CTX *ctx, const ASN1_OBJECT *policy); + +/* Adds a new acceptable message digest. Note that no message digests + are accepted by default. The md argument is shared with the caller. */ +int TS_RESP_CTX_add_md(TS_RESP_CTX *ctx, const EVP_MD *md); + +/* Accuracy is not included by default. */ +int TS_RESP_CTX_set_accuracy(TS_RESP_CTX *ctx, + int secs, int millis, int micros); + +/* Clock precision digits, i.e. the number of decimal digits: + '0' means sec, '3' msec, '6' usec, and so on. Default is 0. */ +int TS_RESP_CTX_set_clock_precision_digits(TS_RESP_CTX *ctx, + unsigned clock_precision_digits); +/* At most we accept sec precision. */ +#define TS_MAX_CLOCK_PRECISION_DIGITS 0 + +/* No flags are set by default. */ +void TS_RESP_CTX_add_flags(TS_RESP_CTX *ctx, int flags); + +/* Default callback always returns a constant. */ +void TS_RESP_CTX_set_serial_cb(TS_RESP_CTX *ctx, TS_serial_cb cb, void *data); + +/* Default callback uses gettimeofday() and gmtime(). */ +void TS_RESP_CTX_set_time_cb(TS_RESP_CTX *ctx, TS_time_cb cb, void *data); + +/* Default callback rejects all extensions. The extension callback is called + * when the TS_TST_INFO object is already set up and not signed yet. */ +/* FIXME: extension handling is not tested yet. */ +void TS_RESP_CTX_set_extension_cb(TS_RESP_CTX *ctx, + TS_extension_cb cb, void *data); + +/* The following methods can be used in the callbacks. */ +int TS_RESP_CTX_set_status_info(TS_RESP_CTX *ctx, + int status, const char *text); + +/* Sets the status info only if it is still TS_STATUS_GRANTED. */ +int TS_RESP_CTX_set_status_info_cond(TS_RESP_CTX *ctx, + int status, const char *text); + +int TS_RESP_CTX_add_failure_info(TS_RESP_CTX *ctx, int failure); + +/* The get methods below can be used in the extension callback. */ +TS_REQ *TS_RESP_CTX_get_request(TS_RESP_CTX *ctx); + +TS_TST_INFO *TS_RESP_CTX_get_tst_info(TS_RESP_CTX *ctx); + +/* + * Creates the signed TS_TST_INFO and puts it in TS_RESP. + * In case of errors it sets the status info properly. + * Returns NULL only in case of memory allocation/fatal error. + */ +TS_RESP *TS_RESP_create_response(TS_RESP_CTX *ctx, BIO *req_bio); + +/* + * Declarations related to response verification, + * they are defined in ts/ts_rsp_verify.c. + */ + +int TS_RESP_verify_signature(PKCS7 *token, STACK_OF(X509) *certs, + X509_STORE *store, X509 **signer_out); + +/* Context structure for the generic verify method. */ + +/* Verify the signer's certificate and the signature of the response. */ +#define TS_VFY_SIGNATURE (1u << 0) +/* Verify the version number of the response. */ +#define TS_VFY_VERSION (1u << 1) +/* Verify if the policy supplied by the user matches the policy of the TSA. */ +#define TS_VFY_POLICY (1u << 2) +/* Verify the message imprint provided by the user. This flag should not be + specified with TS_VFY_DATA. */ +#define TS_VFY_IMPRINT (1u << 3) +/* Verify the message imprint computed by the verify method from the user + provided data and the MD algorithm of the response. This flag should not be + specified with TS_VFY_IMPRINT. */ +#define TS_VFY_DATA (1u << 4) +/* Verify the nonce value. */ +#define TS_VFY_NONCE (1u << 5) +/* Verify if the TSA name field matches the signer certificate. */ +#define TS_VFY_SIGNER (1u << 6) +/* Verify if the TSA name field equals to the user provided name. */ +#define TS_VFY_TSA_NAME (1u << 7) + +/* You can use the following convenience constants. */ +#define TS_VFY_ALL_IMPRINT (TS_VFY_SIGNATURE \ + | TS_VFY_VERSION \ + | TS_VFY_POLICY \ + | TS_VFY_IMPRINT \ + | TS_VFY_NONCE \ + | TS_VFY_SIGNER \ + | TS_VFY_TSA_NAME) +#define TS_VFY_ALL_DATA (TS_VFY_SIGNATURE \ + | TS_VFY_VERSION \ + | TS_VFY_POLICY \ + | TS_VFY_DATA \ + | TS_VFY_NONCE \ + | TS_VFY_SIGNER \ + | TS_VFY_TSA_NAME) + +typedef struct TS_verify_ctx TS_VERIFY_CTX; + +int TS_RESP_verify_response(TS_VERIFY_CTX *ctx, TS_RESP *response); +int TS_RESP_verify_token(TS_VERIFY_CTX *ctx, PKCS7 *token); + +/* + * Declarations related to response verification context, + * they are defined in ts/ts_verify_ctx.c. + */ + +/* Set all fields to zero. */ +TS_VERIFY_CTX *TS_VERIFY_CTX_new(void); +void TS_VERIFY_CTX_free(TS_VERIFY_CTX *ctx); +void TS_VERIFY_CTX_cleanup(TS_VERIFY_CTX *ctx); + +int TS_VERIFY_CTX_add_flags(TS_VERIFY_CTX *ctx, int flags); +int TS_VERIFY_CTX_set_flags(TS_VERIFY_CTX *ctx, int flags); +BIO *TS_VERIFY_CTX_set_data(TS_VERIFY_CTX *ctx, BIO *bio); +X509_STORE *TS_VERIFY_CTX_set_store(TS_VERIFY_CTX *ctx, X509_STORE *store); +/* R$ special */ +#define TS_VERIFY_CTS_set_certs TS_VERIFY_CTX_set_certs +STACK_OF(X509) *TS_VERIFY_CTX_set_certs(TS_VERIFY_CTX *ctx, + STACK_OF(X509) *certs); +unsigned char *TS_VERIFY_CTX_set_imprint(TS_VERIFY_CTX *ctx, + unsigned char *imprint, long imprint_len); + +/* + * If ctx is NULL, it allocates and returns a new object, otherwise + * it returns ctx. It initialises all the members as follows: + * flags = TS_VFY_ALL_IMPRINT & ~(TS_VFY_TSA_NAME | TS_VFY_SIGNATURE) + * certs = NULL + * store = NULL + * policy = policy from the request or NULL if absent (in this case + * TS_VFY_POLICY is cleared from flags as well) + * md_alg = MD algorithm from request + * imprint, imprint_len = imprint from request + * data = NULL + * nonce, nonce_len = nonce from the request or NULL if absent (in this case + * TS_VFY_NONCE is cleared from flags as well) + * tsa_name = NULL + * Important: after calling this method TS_VFY_SIGNATURE should be added! + */ +TS_VERIFY_CTX *TS_REQ_to_TS_VERIFY_CTX(TS_REQ *req, TS_VERIFY_CTX *ctx); + +/* Function declarations for TS_RESP defined in ts/ts_rsp_print.c */ + +int TS_RESP_print_bio(BIO *bio, TS_RESP *a); +int TS_STATUS_INFO_print_bio(BIO *bio, TS_STATUS_INFO *a); +int TS_TST_INFO_print_bio(BIO *bio, TS_TST_INFO *a); + +/* Common utility functions defined in ts/ts_lib.c */ + +int TS_ASN1_INTEGER_print_bio(BIO *bio, const ASN1_INTEGER *num); +int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj); +int TS_ext_print_bio(BIO *bio, const STACK_OF(X509_EXTENSION) *extensions); +int TS_X509_ALGOR_print_bio(BIO *bio, const X509_ALGOR *alg); +int TS_MSG_IMPRINT_print_bio(BIO *bio, TS_MSG_IMPRINT *msg); + +/* Function declarations for handling configuration options, + defined in ts/ts_conf.c */ + +X509 *TS_CONF_load_cert(const char *file); +STACK_OF(X509) *TS_CONF_load_certs(const char *file); +EVP_PKEY *TS_CONF_load_key(const char *file, const char *pass); +const char *TS_CONF_get_tsa_section(CONF *conf, const char *section); +int TS_CONF_set_serial(CONF *conf, const char *section, TS_serial_cb cb, + TS_RESP_CTX *ctx); +int TS_CONF_set_signer_cert(CONF *conf, const char *section, + const char *cert, TS_RESP_CTX *ctx); +int TS_CONF_set_certs(CONF *conf, const char *section, const char *certs, + TS_RESP_CTX *ctx); +int TS_CONF_set_signer_key(CONF *conf, const char *section, + const char *key, const char *pass, TS_RESP_CTX *ctx); +int TS_CONF_set_def_policy(CONF *conf, const char *section, + const char *policy, TS_RESP_CTX *ctx); +int TS_CONF_set_policies(CONF *conf, const char *section, TS_RESP_CTX *ctx); +int TS_CONF_set_digests(CONF *conf, const char *section, TS_RESP_CTX *ctx); +int TS_CONF_set_accuracy(CONF *conf, const char *section, TS_RESP_CTX *ctx); +int TS_CONF_set_clock_precision_digits(CONF *conf, const char *section, + TS_RESP_CTX *ctx); +int TS_CONF_set_ordering(CONF *conf, const char *section, TS_RESP_CTX *ctx); +int TS_CONF_set_tsa_name(CONF *conf, const char *section, TS_RESP_CTX *ctx); +int TS_CONF_set_ess_cert_id_chain(CONF *conf, const char *section, + TS_RESP_CTX *ctx); + +void ERR_load_TS_strings(void); + +/* Error codes for the TS functions. */ + +/* Function codes. */ +#define TS_F_D2I_TS_RESP 147 +#define TS_F_DEF_SERIAL_CB 110 +#define TS_F_DEF_TIME_CB 111 +#define TS_F_ESS_ADD_SIGNING_CERT 112 +#define TS_F_ESS_CERT_ID_NEW_INIT 113 +#define TS_F_ESS_SIGNING_CERT_NEW_INIT 114 +#define TS_F_INT_TS_RESP_VERIFY_TOKEN 149 +#define TS_F_PKCS7_TO_TS_TST_INFO 148 +#define TS_F_TS_ACCURACY_SET_MICROS 115 +#define TS_F_TS_ACCURACY_SET_MILLIS 116 +#define TS_F_TS_ACCURACY_SET_SECONDS 117 +#define TS_F_TS_CHECK_IMPRINTS 100 +#define TS_F_TS_CHECK_NONCES 101 +#define TS_F_TS_CHECK_POLICY 102 +#define TS_F_TS_CHECK_SIGNING_CERTS 103 +#define TS_F_TS_CHECK_STATUS_INFO 104 +#define TS_F_TS_COMPUTE_IMPRINT 145 +#define TS_F_TS_CONF_SET_DEFAULT_ENGINE 146 +#define TS_F_TS_GET_STATUS_TEXT 105 +#define TS_F_TS_MSG_IMPRINT_SET_ALGO 118 +#define TS_F_TS_REQ_SET_MSG_IMPRINT 119 +#define TS_F_TS_REQ_SET_NONCE 120 +#define TS_F_TS_REQ_SET_POLICY_ID 121 +#define TS_F_TS_RESP_CREATE_RESPONSE 122 +#define TS_F_TS_RESP_CREATE_TST_INFO 123 +#define TS_F_TS_RESP_CTX_ADD_FAILURE_INFO 124 +#define TS_F_TS_RESP_CTX_ADD_MD 125 +#define TS_F_TS_RESP_CTX_ADD_POLICY 126 +#define TS_F_TS_RESP_CTX_NEW 127 +#define TS_F_TS_RESP_CTX_SET_ACCURACY 128 +#define TS_F_TS_RESP_CTX_SET_CERTS 129 +#define TS_F_TS_RESP_CTX_SET_DEF_POLICY 130 +#define TS_F_TS_RESP_CTX_SET_SIGNER_CERT 131 +#define TS_F_TS_RESP_CTX_SET_STATUS_INFO 132 +#define TS_F_TS_RESP_GET_POLICY 133 +#define TS_F_TS_RESP_SET_GENTIME_WITH_PRECISION 134 +#define TS_F_TS_RESP_SET_STATUS_INFO 135 +#define TS_F_TS_RESP_SET_TST_INFO 150 +#define TS_F_TS_RESP_SIGN 136 +#define TS_F_TS_RESP_VERIFY_SIGNATURE 106 +#define TS_F_TS_RESP_VERIFY_TOKEN 107 +#define TS_F_TS_TST_INFO_SET_ACCURACY 137 +#define TS_F_TS_TST_INFO_SET_MSG_IMPRINT 138 +#define TS_F_TS_TST_INFO_SET_NONCE 139 +#define TS_F_TS_TST_INFO_SET_POLICY_ID 140 +#define TS_F_TS_TST_INFO_SET_SERIAL 141 +#define TS_F_TS_TST_INFO_SET_TIME 142 +#define TS_F_TS_TST_INFO_SET_TSA 143 +#define TS_F_TS_VERIFY 108 +#define TS_F_TS_VERIFY_CERT 109 +#define TS_F_TS_VERIFY_CTX_NEW 144 + +/* Reason codes. */ +#define TS_R_BAD_PKCS7_TYPE 132 +#define TS_R_BAD_TYPE 133 +#define TS_R_CERTIFICATE_VERIFY_ERROR 100 +#define TS_R_COULD_NOT_SET_ENGINE 127 +#define TS_R_COULD_NOT_SET_TIME 115 +#define TS_R_D2I_TS_RESP_INT_FAILED 128 +#define TS_R_DETACHED_CONTENT 134 +#define TS_R_ESS_ADD_SIGNING_CERT_ERROR 116 +#define TS_R_ESS_SIGNING_CERTIFICATE_ERROR 101 +#define TS_R_INVALID_NULL_POINTER 102 +#define TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE 117 +#define TS_R_MESSAGE_IMPRINT_MISMATCH 103 +#define TS_R_NONCE_MISMATCH 104 +#define TS_R_NONCE_NOT_RETURNED 105 +#define TS_R_NO_CONTENT 106 +#define TS_R_NO_TIME_STAMP_TOKEN 107 +#define TS_R_PKCS7_ADD_SIGNATURE_ERROR 118 +#define TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR 119 +#define TS_R_PKCS7_TO_TS_TST_INFO_FAILED 129 +#define TS_R_POLICY_MISMATCH 108 +#define TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 120 +#define TS_R_RESPONSE_SETUP_ERROR 121 +#define TS_R_SIGNATURE_FAILURE 109 +#define TS_R_THERE_MUST_BE_ONE_SIGNER 110 +#define TS_R_TIME_SYSCALL_ERROR 122 +#define TS_R_TOKEN_NOT_PRESENT 130 +#define TS_R_TOKEN_PRESENT 131 +#define TS_R_TSA_NAME_MISMATCH 111 +#define TS_R_TSA_UNTRUSTED 112 +#define TS_R_TST_INFO_SETUP_ERROR 123 +#define TS_R_TS_DATASIGN 124 +#define TS_R_UNACCEPTABLE_POLICY 125 +#define TS_R_UNSUPPORTED_MD_ALGORITHM 126 +#define TS_R_UNSUPPORTED_VERSION 113 +#define TS_R_WRONG_CONTENT_TYPE 114 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/txt_db.h b/curl/include/openssl/txt_db.h new file mode 100644 index 0000000..56b6b42 --- /dev/null +++ b/curl/include/openssl/txt_db.h @@ -0,0 +1,112 @@ +/* $OpenBSD: txt_db.h,v 1.9 2014/07/10 22:45:58 jsing Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_TXT_DB_H +#define HEADER_TXT_DB_H + +#include + +#ifndef OPENSSL_NO_BIO +#include +#endif +#include +#include + +#define DB_ERROR_OK 0 +#define DB_ERROR_MALLOC 1 +#define DB_ERROR_INDEX_CLASH 2 +#define DB_ERROR_INDEX_OUT_OF_RANGE 3 +#define DB_ERROR_NO_INDEX 4 +#define DB_ERROR_INSERT_INDEX_CLASH 5 + +#ifdef __cplusplus +extern "C" { +#endif + +typedef OPENSSL_STRING *OPENSSL_PSTRING; +DECLARE_SPECIAL_STACK_OF(OPENSSL_PSTRING, OPENSSL_STRING) + +typedef struct txt_db_st { + int num_fields; + STACK_OF(OPENSSL_PSTRING) *data; + LHASH_OF(OPENSSL_STRING) **index; + int (**qual)(OPENSSL_STRING *); + long error; + long arg1; + long arg2; + OPENSSL_STRING *arg_row; +} TXT_DB; + +#ifndef OPENSSL_NO_BIO +TXT_DB *TXT_DB_read(BIO *in, int num); +long TXT_DB_write(BIO *out, TXT_DB *db); +#else +TXT_DB *TXT_DB_read(char *in, int num); +long TXT_DB_write(char *out, TXT_DB *db); +#endif +int TXT_DB_create_index(TXT_DB *db, int field, int (*qual)(OPENSSL_STRING *), + LHASH_HASH_FN_TYPE hash, LHASH_COMP_FN_TYPE cmp); +void TXT_DB_free(TXT_DB *db); +OPENSSL_STRING *TXT_DB_get_by_index(TXT_DB *db, int idx, OPENSSL_STRING *value); +int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *value); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/curl/include/openssl/ui.h b/curl/include/openssl/ui.h new file mode 100644 index 0000000..cc400c2 --- /dev/null +++ b/curl/include/openssl/ui.h @@ -0,0 +1,397 @@ +/* $OpenBSD: ui.h,v 1.20 2025/03/09 15:25:53 tb Exp $ */ +/* Written by Richard Levitte (richard@levitte.org) for the OpenSSL + * project 2001. + */ +/* ==================================================================== + * Copyright (c) 2001 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + +#ifndef HEADER_UI_H +#define HEADER_UI_H + +#include + +#include +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* Declared already in ossl_typ.h */ +/* typedef struct ui_st UI; */ +/* typedef struct ui_method_st UI_METHOD; */ + + +/* + * All the following functions return -1 or NULL on error and in some cases + * (UI_process()) -2 if interrupted or in some other way cancelled. + * When everything is fine, they return 0, a positive value or a non-NULL + * pointer, all depending on their purpose. + */ + +/* Creators and destructor. */ +UI *UI_new(void); +UI *UI_new_method(const UI_METHOD *method); +void UI_free(UI *ui); + +/* + * The following functions are used to add strings to be printed and prompt + * strings to prompt for data. The names are UI_{add,dup}__string + * and UI_{add,dup}_input_boolean. + * + * UI_{add,dup}__string have the following meanings: + * add add a text or prompt string. The pointers given to these + * functions are used verbatim, no copying is done. + * dup make a copy of the text or prompt string, then add the copy + * to the collection of strings in the user interface. + * + * The function is a name for the functionality that the given + * string shall be used for. It can be one of: + * input use the string as data prompt. + * verify use the string as verification prompt. This + * is used to verify a previous input. + * info use the string for informational output. + * error use the string for error output. + * Honestly, there's currently no difference between info and error for the + * moment. + * + * UI_{add,dup}_input_boolean have the same semantics for "add" and "dup", + * and are typically used when one wants to prompt for a yes/no response. + * + * All of the functions in this group take a UI and a prompt string. + * The string input and verify addition functions also take a flag argument, + * a buffer for the result to end up in, a minimum input size and a maximum + * input size (the result buffer MUST be large enough to be able to contain + * the maximum number of characters). Additionally, the verify addition + * functions takes another buffer to compare the result against. + * The boolean input functions take an action description string (which should + * be safe to ignore if the expected user action is obvious, for example with + * a dialog box with an OK button and a Cancel button), a string of acceptable + * characters to mean OK and to mean Cancel. The two last strings are checked + * to make sure they don't have common characters. Additionally, the same + * flag argument as for the string input is taken, as well as a result buffer. + * The result buffer is required to be at least one byte long. Depending on + * the answer, the first character from the OK or the Cancel character strings + * will be stored in the first byte of the result buffer. No NUL will be + * added, so the result is *not* a string. + * + * On success, the functions all return an index of the added information. + * That index is useful when retrieving results with UI_get0_result(). + */ +int UI_add_input_string(UI *ui, const char *prompt, int flags, + char *result_buf, int minsize, int maxsize); +int UI_dup_input_string(UI *ui, const char *prompt, int flags, + char *result_buf, int minsize, int maxsize); +int UI_add_verify_string(UI *ui, const char *prompt, int flags, + char *result_buf, int minsize, int maxsize, const char *test_buf); +int UI_dup_verify_string(UI *ui, const char *prompt, int flags, + char *result_buf, int minsize, int maxsize, const char *test_buf); +int UI_add_input_boolean(UI *ui, const char *prompt, const char *action_desc, + const char *ok_chars, const char *cancel_chars, + int flags, char *result_buf); +int UI_dup_input_boolean(UI *ui, const char *prompt, const char *action_desc, + const char *ok_chars, const char *cancel_chars, + int flags, char *result_buf); +int UI_add_info_string(UI *ui, const char *text); +int UI_dup_info_string(UI *ui, const char *text); +int UI_add_error_string(UI *ui, const char *text); +int UI_dup_error_string(UI *ui, const char *text); + +/* These are the possible flags. They can be or'ed together. */ +/* Use to have echoing of input */ +#define UI_INPUT_FLAG_ECHO 0x01 +/* + * Use a default password. Where that password is found is completely + * up to the application, it might for example be in the user data set + * with UI_add_user_data(). It is not recommended to have more than + * one input in each UI being marked with this flag, or the application + * might get confused. + */ +#define UI_INPUT_FLAG_DEFAULT_PWD 0x02 + +/* + * Users of these routines may want to define flags of their own. The core + * UI won't look at those, but will pass them on to the method routines. They + * must use higher bits so they don't get confused with the UI bits above. + * UI_INPUT_FLAG_USER_BASE tells which is the lowest bit to use. A good + * example of use is this: + * + * #define MY_UI_FLAG1 (0x01 << UI_INPUT_FLAG_USER_BASE) + */ +#define UI_INPUT_FLAG_USER_BASE 16 + + +/* + * The following function helps construct a prompt. object_desc is a + * textual short description of the object, for example "pass phrase", + * and object_name is the name of the object (might be a card name or + * a file name. + * The returned string shall always be allocated on the heap with + * malloc(), and need to be free'd with free(). + * + * If the ui_method doesn't contain a pointer to a user-defined prompt + * constructor, a default string is built, looking like this: + * + * "Enter {object_desc} for {object_name}:" + * + * So, if object_desc has the value "pass phrase" and object_name has + * the value "foo.key", the resulting string is: + * + * "Enter pass phrase for foo.key:" + */ +char *UI_construct_prompt(UI *ui_method, const char *object_desc, + const char *object_name); + + +/* + * The following function is used to store a pointer to user-specific data. + * Any previous such pointer will be returned and replaced. + * + * For callback purposes, this function makes a lot more sense than using + * ex_data, since the latter requires that different parts of OpenSSL or + * applications share the same ex_data index. + * + * Note that the UI_OpenSSL() method completely ignores the user data. + * Other methods may not, however. + */ +void *UI_add_user_data(UI *ui, void *user_data); +/* We need a user data retrieving function as well. */ +void *UI_get0_user_data(UI *ui); + +/* Return the result associated with a prompt given with the index i. */ +const char *UI_get0_result(UI *ui, int i); + +/* When all strings have been added, process the whole thing. */ +int UI_process(UI *ui); + +/* + * Give a user interface parametrised control commands. This can be used to + * send down an integer, a data pointer or a function pointer, as well as + * be used to get information from a UI. + */ +int UI_ctrl(UI *ui, int cmd, long i, void *p, void (*f)(void)); + +/* The commands */ +/* + * Use UI_CONTROL_PRINT_ERRORS with the value 1 to have UI_process print the + * OpenSSL error stack before printing any info or added error messages and + * before any prompting. + */ +#define UI_CTRL_PRINT_ERRORS 1 +/* + * Check if a UI_process() is possible to do again with the same instance of + * a user interface. This makes UI_ctrl() return 1 if it is redoable, and 0 + * if not. + */ +#define UI_CTRL_IS_REDOABLE 2 + + +/* Some methods may use extra data */ +#define UI_set_app_data(s,arg) UI_set_ex_data(s,0,arg) +#define UI_get_app_data(s) UI_get_ex_data(s,0) +int UI_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, + CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); +int UI_set_ex_data(UI *r, int idx, void *arg); +void *UI_get_ex_data(UI *r, int idx); + +/* Use specific methods instead of the built-in one */ +void UI_set_default_method(const UI_METHOD *meth); +const UI_METHOD *UI_get_default_method(void); +const UI_METHOD *UI_get_method(UI *ui); +const UI_METHOD *UI_set_method(UI *ui, const UI_METHOD *meth); + +/* The method with all the built-in thingies */ +const UI_METHOD *UI_OpenSSL(void); + +const UI_METHOD *UI_null(void); + +/* + * ---------- For method writers ---------- + * A method contains a number of functions that implement the low level + * of the User Interface. The functions are: + * + * an opener This function starts a session, maybe by opening + * a channel to a tty, or by opening a window. + * a writer This function is called to write a given string, + * maybe to the tty, maybe as a field label in a + * window. + * a flusher This function is called to flush everything that + * has been output so far. It can be used to actually + * display a dialog box after it has been built. + * a reader This function is called to read a given prompt, + * maybe from the tty, maybe from a field in a + * window. Note that it's called with all string + * structures, not only the prompt ones, so it must + * check such things itself. + * a closer This function closes the session, maybe by closing + * the channel to the tty, or closing the window. + * + * All these functions are expected to return: + * + * 0 on error. + * 1 on success. + * -1 on out-of-band events, for example if some prompting has + * been canceled (by pressing Ctrl-C, for example). This is + * only checked when returned by the flusher or the reader. + * + * The way this is used, the opener is first called, then the writer for all + * strings, then the flusher, then the reader for all strings and finally the + * closer. Note that if you want to prompt from a terminal or other command + * line interface, the best is to have the reader also write the prompts + * instead of having the writer do it. If you want to prompt from a dialog + * box, the writer can be used to build up the contents of the box, and the + * flusher to actually display the box and run the event loop until all data + * has been given, after which the reader only grabs the given data and puts + * them back into the UI strings. + * + * All method functions take a UI as argument. Additionally, the writer and + * the reader take a UI_STRING. + */ + +/* + * The UI_STRING type is the data structure that contains all the needed info + * about a string or a prompt, including test data for a verification prompt. + */ +typedef struct ui_string_st UI_STRING; +DECLARE_STACK_OF(UI_STRING) + +/* + * The different types of strings that are currently supported. + * This is only needed by method authors. + */ +enum UI_string_types { + UIT_NONE = 0, + UIT_PROMPT, /* Prompt for a string */ + UIT_VERIFY, /* Prompt for a string and verify */ + UIT_BOOLEAN, /* Prompt for a yes/no response */ + UIT_INFO, /* Send info to the user */ + UIT_ERROR /* Send an error message to the user */ +}; + +/* Create and manipulate methods */ +UI_METHOD *UI_create_method(const char *name); +void UI_destroy_method(UI_METHOD *ui_method); +int UI_method_set_opener(UI_METHOD *method, int (*opener)(UI *ui)); +int UI_method_set_writer(UI_METHOD *method, + int (*writer)(UI *ui, UI_STRING *uis)); +int UI_method_set_flusher(UI_METHOD *method, int (*flusher)(UI *ui)); +int UI_method_set_reader(UI_METHOD *method, + int (*reader)(UI *ui, UI_STRING *uis)); +int UI_method_set_closer(UI_METHOD *method, int (*closer)(UI *ui)); +int UI_method_set_prompt_constructor(UI_METHOD *method, + char *(*prompt_constructor)(UI *ui, const char *object_desc, + const char *object_name)); +int (*UI_method_get_opener(const UI_METHOD *method))(UI *); +int (*UI_method_get_writer(const UI_METHOD *method))(UI *, UI_STRING *); +int (*UI_method_get_flusher(const UI_METHOD *method))(UI *); +int (*UI_method_get_reader(const UI_METHOD *method))(UI *, UI_STRING *); +int (*UI_method_get_closer(const UI_METHOD *method))(UI *); +char *(*UI_method_get_prompt_constructor(const UI_METHOD *method))(UI *, + const char *, const char *); + +/* + * The following functions are helpers for method writers to access relevant + * data from a UI_STRING. + */ +/* Return type of the UI_STRING */ +enum UI_string_types UI_get_string_type(UI_STRING *uis); +/* Return input flags of the UI_STRING */ +int UI_get_input_flags(UI_STRING *uis); +/* Return the actual string to output (the prompt, info or error) */ +const char *UI_get0_output_string(UI_STRING *uis); +/* Return the optional action string to output (boolean prompt instruction) */ +const char *UI_get0_action_string(UI_STRING *uis); +/* Return the result of a prompt */ +const char *UI_get0_result_string(UI_STRING *uis); +/* Return the string to test the result against. Only useful with verifies. */ +const char *UI_get0_test_string(UI_STRING *uis); +/* Return the required minimum size of the result */ +int UI_get_result_minsize(UI_STRING *uis); +/* Return the required maximum size of the result */ +int UI_get_result_maxsize(UI_STRING *uis); +/* Set the result of a UI_STRING. */ +int UI_set_result(UI *ui, UI_STRING *uis, const char *result); + +void ERR_load_UI_strings(void); + +/* Error codes for the UI functions. */ + +/* Function codes. */ +#define UI_F_GENERAL_ALLOCATE_BOOLEAN 108 +#define UI_F_GENERAL_ALLOCATE_PROMPT 109 +#define UI_F_GENERAL_ALLOCATE_STRING 100 +#define UI_F_UI_CTRL 111 +#define UI_F_UI_DUP_ERROR_STRING 101 +#define UI_F_UI_DUP_INFO_STRING 102 +#define UI_F_UI_DUP_INPUT_BOOLEAN 110 +#define UI_F_UI_DUP_INPUT_STRING 103 +#define UI_F_UI_DUP_VERIFY_STRING 106 +#define UI_F_UI_GET0_RESULT 107 +#define UI_F_UI_NEW_METHOD 104 +#define UI_F_UI_SET_RESULT 105 + +/* Reason codes. */ +#define UI_R_COMMON_OK_AND_CANCEL_CHARACTERS 104 +#define UI_R_INDEX_TOO_LARGE 102 +#define UI_R_INDEX_TOO_SMALL 103 +#define UI_R_NO_RESULT_BUFFER 105 +#define UI_R_RESULT_TOO_LARGE 100 +#define UI_R_RESULT_TOO_SMALL 101 +#define UI_R_UNKNOWN_CONTROL_COMMAND 106 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/x509.h b/curl/include/openssl/x509.h new file mode 100644 index 0000000..68a68e7 --- /dev/null +++ b/curl/include/openssl/x509.h @@ -0,0 +1,1053 @@ +/* $OpenBSD: x509.h,v 1.121 2025/03/09 15:17:22 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ +/* ==================================================================== + * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. + * ECDH support in OpenSSL originally developed by + * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. + */ + +#ifndef HEADER_X509_H +#define HEADER_X509_H + +#include + +#include +#ifndef OPENSSL_NO_BIO +#include +#endif +#ifndef OPENSSL_NO_BUFFER +#include +#endif +#ifndef OPENSSL_NO_DH +#include +#endif +#ifndef OPENSSL_NO_DSA +#include +#endif +#ifndef OPENSSL_NO_EC +#include +#endif +#ifndef OPENSSL_NO_EVP +#include +#endif +#ifndef OPENSSL_NO_RSA +#include +#endif +#ifndef OPENSSL_NO_SHA +#include +#endif +#include +#include + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(_WIN32) && defined(__WINCRYPT_H__) +#if !defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_DISABLE_OVERRIDE_WINCRYPT_DEFINES_WARNING) +#ifdef _MSC_VER +#pragma message("Warning, overriding WinCrypt defines") +#else +#warning overriding WinCrypt defines +#endif +#endif +#undef X509_NAME +#undef X509_EXTENSIONS +#endif + +#define X509_FILETYPE_PEM 1 +#define X509_FILETYPE_ASN1 2 +#define X509_FILETYPE_DEFAULT 3 + +#define X509v3_KU_DIGITAL_SIGNATURE 0x0080 +#define X509v3_KU_NON_REPUDIATION 0x0040 +#define X509v3_KU_KEY_ENCIPHERMENT 0x0020 +#define X509v3_KU_DATA_ENCIPHERMENT 0x0010 +#define X509v3_KU_KEY_AGREEMENT 0x0008 +#define X509v3_KU_KEY_CERT_SIGN 0x0004 +#define X509v3_KU_CRL_SIGN 0x0002 +#define X509v3_KU_ENCIPHER_ONLY 0x0001 +#define X509v3_KU_DECIPHER_ONLY 0x8000 +#define X509v3_KU_UNDEF 0xffff + +struct X509_algor_st { + ASN1_OBJECT *algorithm; + ASN1_TYPE *parameter; +} /* X509_ALGOR */; + +typedef STACK_OF(X509_ALGOR) X509_ALGORS; + +typedef struct X509_val_st X509_VAL; + +typedef struct X509_sig_st X509_SIG; + +typedef struct X509_name_entry_st X509_NAME_ENTRY; + +DECLARE_STACK_OF(X509_NAME_ENTRY) + +DECLARE_STACK_OF(X509_NAME) + +typedef struct X509_extension_st X509_EXTENSION; + +typedef STACK_OF(X509_EXTENSION) X509_EXTENSIONS; + +DECLARE_STACK_OF(X509_EXTENSION) + +typedef struct x509_attributes_st X509_ATTRIBUTE; + +DECLARE_STACK_OF(X509_ATTRIBUTE) + +typedef struct X509_req_info_st X509_REQ_INFO; + +typedef struct X509_req_st X509_REQ; + +typedef struct x509_cinf_st X509_CINF; + +DECLARE_STACK_OF(X509) + +#define X509_TRUST_COMPAT 1 +#define X509_TRUST_SSL_CLIENT 2 +#define X509_TRUST_SSL_SERVER 3 +#define X509_TRUST_EMAIL 4 +#define X509_TRUST_OBJECT_SIGN 5 +#define X509_TRUST_OCSP_SIGN 6 +#define X509_TRUST_OCSP_REQUEST 7 +#define X509_TRUST_TSA 8 + +/* Keep these up to date! */ +#define X509_TRUST_MIN 1 +#define X509_TRUST_MAX 8 + +/* Flags for X509_print_ex() */ + +#define X509_FLAG_COMPAT 0 +#define X509_FLAG_NO_HEADER 1L +#define X509_FLAG_NO_VERSION (1L << 1) +#define X509_FLAG_NO_SERIAL (1L << 2) +#define X509_FLAG_NO_SIGNAME (1L << 3) +#define X509_FLAG_NO_ISSUER (1L << 4) +#define X509_FLAG_NO_VALIDITY (1L << 5) +#define X509_FLAG_NO_SUBJECT (1L << 6) +#define X509_FLAG_NO_PUBKEY (1L << 7) +#define X509_FLAG_NO_EXTENSIONS (1L << 8) +#define X509_FLAG_NO_SIGDUMP (1L << 9) +#define X509_FLAG_NO_AUX (1L << 10) +#define X509_FLAG_NO_ATTRIBUTES (1L << 11) + +/* Flags specific to X509_NAME_print_ex() */ + +/* The field separator information */ + +#define XN_FLAG_SEP_MASK (0xf << 16) + +#define XN_FLAG_COMPAT 0 /* Traditional SSLeay: use old X509_NAME_print */ +#define XN_FLAG_SEP_COMMA_PLUS (1 << 16) /* RFC2253 ,+ */ +#define XN_FLAG_SEP_CPLUS_SPC (2 << 16) /* ,+ spaced: more readable */ +#define XN_FLAG_SEP_SPLUS_SPC (3 << 16) /* ;+ spaced */ +#define XN_FLAG_SEP_MULTILINE (4 << 16) /* One line per field */ + +#define XN_FLAG_DN_REV (1 << 20) /* Reverse DN order */ + +/* How the field name is shown */ + +#define XN_FLAG_FN_MASK (0x3 << 21) + +#define XN_FLAG_FN_SN 0 /* Object short name */ +#define XN_FLAG_FN_LN (1 << 21) /* Object long name */ +#define XN_FLAG_FN_OID (2 << 21) /* Always use OIDs */ +#define XN_FLAG_FN_NONE (3 << 21) /* No field names */ + +#define XN_FLAG_SPC_EQ (1 << 23) /* Put spaces round '=' */ + +/* This determines if we dump fields we don't recognise: + * RFC2253 requires this. + */ + +#define XN_FLAG_DUMP_UNKNOWN_FIELDS (1 << 24) + +#define XN_FLAG_FN_ALIGN (1 << 25) /* Align field names to 20 characters */ + +/* Complete set of RFC2253 flags */ + +#define XN_FLAG_RFC2253 (ASN1_STRFLGS_RFC2253 | \ + XN_FLAG_SEP_COMMA_PLUS | \ + XN_FLAG_DN_REV | \ + XN_FLAG_FN_SN | \ + XN_FLAG_DUMP_UNKNOWN_FIELDS) + +/* readable oneline form */ + +#define XN_FLAG_ONELINE (ASN1_STRFLGS_RFC2253 | \ + ASN1_STRFLGS_ESC_QUOTE | \ + XN_FLAG_SEP_CPLUS_SPC | \ + XN_FLAG_SPC_EQ | \ + XN_FLAG_FN_SN) + +/* readable multiline form */ + +#define XN_FLAG_MULTILINE (ASN1_STRFLGS_ESC_CTRL | \ + ASN1_STRFLGS_ESC_MSB | \ + XN_FLAG_SEP_MULTILINE | \ + XN_FLAG_SPC_EQ | \ + XN_FLAG_FN_LN | \ + XN_FLAG_FN_ALIGN) + +DECLARE_STACK_OF(X509_REVOKED) + +typedef struct X509_crl_info_st X509_CRL_INFO; + +DECLARE_STACK_OF(X509_CRL) + +typedef struct private_key_st { + int version; + /* The PKCS#8 data types */ + X509_ALGOR *enc_algor; + ASN1_OCTET_STRING *enc_pkey; /* encrypted pub key */ + + /* When decrypted, the following will not be NULL */ + EVP_PKEY *dec_pkey; + + /* used to encrypt and decrypt */ + int key_length; + char *key_data; + int key_free; /* true if we should auto free key_data */ + + /* expanded version of 'enc_algor' */ + EVP_CIPHER_INFO cipher; + + int references; +} X509_PKEY; + +#ifndef OPENSSL_NO_EVP +typedef struct X509_info_st { + X509 *x509; + X509_CRL *crl; + X509_PKEY *x_pkey; + + EVP_CIPHER_INFO enc_cipher; + int enc_len; + char *enc_data; + + int references; +} X509_INFO; + +DECLARE_STACK_OF(X509_INFO) +#endif + +/* The next 2 structures and their 8 routines were sent to me by + * Pat Richard and are used to manipulate + * Netscapes spki structures - useful if you are writing a CA web page + */ +typedef struct Netscape_spkac_st { + X509_PUBKEY *pubkey; + ASN1_IA5STRING *challenge; /* challenge sent in atlas >= PR2 */ +} NETSCAPE_SPKAC; + +typedef struct Netscape_spki_st { + NETSCAPE_SPKAC *spkac; /* signed public key and challenge */ + X509_ALGOR *sig_algor; + ASN1_BIT_STRING *signature; +} NETSCAPE_SPKI; + +typedef struct PBEPARAM_st { + ASN1_OCTET_STRING *salt; + ASN1_INTEGER *iter; +} PBEPARAM; + +#ifdef __cplusplus +} +#endif + +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define X509_extract_key(x) X509_get_pubkey(x) /*****/ +#define X509_REQ_extract_key(a) X509_REQ_get_pubkey(a) +#define X509_name_cmp(a,b) X509_NAME_cmp((a),(b)) + +int X509_CRL_up_ref(X509_CRL *x); +int X509_CRL_get_signature_nid(const X509_CRL *crl); + +int i2d_re_X509_CRL_tbs(X509_CRL *req, unsigned char **pp); + +const STACK_OF(X509_EXTENSION) *X509_CRL_get0_extensions(const X509_CRL *crl); +long X509_CRL_get_version(const X509_CRL *crl); +const ASN1_TIME *X509_CRL_get0_lastUpdate(const X509_CRL *crl); +const ASN1_TIME *X509_CRL_get0_nextUpdate(const X509_CRL *crl); +ASN1_TIME *X509_CRL_get_lastUpdate(X509_CRL *crl); +ASN1_TIME *X509_CRL_get_nextUpdate(X509_CRL *crl); +X509_NAME *X509_CRL_get_issuer(const X509_CRL *crl); +STACK_OF(X509_REVOKED) *X509_CRL_get_REVOKED(X509_CRL *crl); +void X509_CRL_get0_signature(const X509_CRL *crl, const ASN1_BIT_STRING **psig, + const X509_ALGOR **palg); + +const X509_ALGOR *X509_CRL_get0_tbs_sigalg(const X509_CRL *crl); + +int X509_REQ_get_signature_nid(const X509_REQ *req); + +void X509_REQ_get0_signature(const X509_REQ *req, const ASN1_BIT_STRING **psig, + const X509_ALGOR **palg); + +X509_PUBKEY *X509_get_X509_PUBKEY(const X509 *x); + +const char *X509_verify_cert_error_string(long n); + +#ifndef OPENSSL_NO_EVP +int X509_verify(X509 *a, EVP_PKEY *r); + +int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r); +int X509_CRL_verify(X509_CRL *a, EVP_PKEY *r); +int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r); + +NETSCAPE_SPKI * NETSCAPE_SPKI_b64_decode(const char *str, int len); +char * NETSCAPE_SPKI_b64_encode(NETSCAPE_SPKI *x); +EVP_PKEY *NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *x); +int NETSCAPE_SPKI_set_pubkey(NETSCAPE_SPKI *x, EVP_PKEY *pkey); + +int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki); + +int X509_signature_dump(BIO *bp, const ASN1_STRING *sig, int indent); +int X509_signature_print(BIO *bp, const X509_ALGOR *alg, + const ASN1_STRING *sig); + +int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md); +int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx); +int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md); +int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx); +int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md); +int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx); +int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md); + +int X509_pubkey_digest(const X509 *data,const EVP_MD *type, + unsigned char *md, unsigned int *len); +int X509_digest(const X509 *data,const EVP_MD *type, + unsigned char *md, unsigned int *len); +int X509_CRL_digest(const X509_CRL *data,const EVP_MD *type, + unsigned char *md, unsigned int *len); +int X509_REQ_digest(const X509_REQ *data,const EVP_MD *type, + unsigned char *md, unsigned int *len); +int X509_NAME_digest(const X509_NAME *data,const EVP_MD *type, + unsigned char *md, unsigned int *len); +#endif + +X509 *d2i_X509_fp(FILE *fp, X509 **x509); +int i2d_X509_fp(FILE *fp,X509 *x509); +X509_CRL *d2i_X509_CRL_fp(FILE *fp,X509_CRL **crl); +int i2d_X509_CRL_fp(FILE *fp,X509_CRL *crl); +X509_REQ *d2i_X509_REQ_fp(FILE *fp,X509_REQ **req); +int i2d_X509_REQ_fp(FILE *fp,X509_REQ *req); +#ifndef OPENSSL_NO_RSA +RSA *d2i_RSAPrivateKey_fp(FILE *fp,RSA **rsa); +int i2d_RSAPrivateKey_fp(FILE *fp,RSA *rsa); +RSA *d2i_RSAPublicKey_fp(FILE *fp,RSA **rsa); +int i2d_RSAPublicKey_fp(FILE *fp,RSA *rsa); +RSA *d2i_RSA_PUBKEY_fp(FILE *fp,RSA **rsa); +int i2d_RSA_PUBKEY_fp(FILE *fp,RSA *rsa); +#endif +#ifndef OPENSSL_NO_DSA +DSA *d2i_DSA_PUBKEY_fp(FILE *fp, DSA **dsa); +int i2d_DSA_PUBKEY_fp(FILE *fp, DSA *dsa); +DSA *d2i_DSAPrivateKey_fp(FILE *fp, DSA **dsa); +int i2d_DSAPrivateKey_fp(FILE *fp, DSA *dsa); +#endif +#ifndef OPENSSL_NO_EC +EC_KEY *d2i_EC_PUBKEY_fp(FILE *fp, EC_KEY **eckey); +int i2d_EC_PUBKEY_fp(FILE *fp, EC_KEY *eckey); +EC_KEY *d2i_ECPrivateKey_fp(FILE *fp, EC_KEY **eckey); +int i2d_ECPrivateKey_fp(FILE *fp, EC_KEY *eckey); +#endif +X509_SIG *d2i_PKCS8_fp(FILE *fp,X509_SIG **p8); +int i2d_PKCS8_fp(FILE *fp,X509_SIG *p8); +PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_fp(FILE *fp, + PKCS8_PRIV_KEY_INFO **p8inf); +int i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp,PKCS8_PRIV_KEY_INFO *p8inf); +int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key); +int i2d_PrivateKey_fp(FILE *fp, EVP_PKEY *pkey); +EVP_PKEY *d2i_PrivateKey_fp(FILE *fp, EVP_PKEY **a); +int i2d_PUBKEY_fp(FILE *fp, EVP_PKEY *pkey); +EVP_PKEY *d2i_PUBKEY_fp(FILE *fp, EVP_PKEY **a); + +#ifndef OPENSSL_NO_BIO +X509 *d2i_X509_bio(BIO *bp,X509 **x509); +int i2d_X509_bio(BIO *bp,X509 *x509); +X509_CRL *d2i_X509_CRL_bio(BIO *bp,X509_CRL **crl); +int i2d_X509_CRL_bio(BIO *bp,X509_CRL *crl); +X509_REQ *d2i_X509_REQ_bio(BIO *bp,X509_REQ **req); +int i2d_X509_REQ_bio(BIO *bp,X509_REQ *req); +#ifndef OPENSSL_NO_RSA +RSA *d2i_RSAPrivateKey_bio(BIO *bp,RSA **rsa); +int i2d_RSAPrivateKey_bio(BIO *bp,RSA *rsa); +RSA *d2i_RSAPublicKey_bio(BIO *bp,RSA **rsa); +int i2d_RSAPublicKey_bio(BIO *bp,RSA *rsa); +RSA *d2i_RSA_PUBKEY_bio(BIO *bp,RSA **rsa); +int i2d_RSA_PUBKEY_bio(BIO *bp,RSA *rsa); +#endif +#ifndef OPENSSL_NO_DSA +DSA *d2i_DSA_PUBKEY_bio(BIO *bp, DSA **dsa); +int i2d_DSA_PUBKEY_bio(BIO *bp, DSA *dsa); +DSA *d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa); +int i2d_DSAPrivateKey_bio(BIO *bp, DSA *dsa); +#endif +#ifndef OPENSSL_NO_EC +EC_KEY *d2i_EC_PUBKEY_bio(BIO *bp, EC_KEY **eckey); +int i2d_EC_PUBKEY_bio(BIO *bp, EC_KEY *eckey); +EC_KEY *d2i_ECPrivateKey_bio(BIO *bp, EC_KEY **eckey); +int i2d_ECPrivateKey_bio(BIO *bp, EC_KEY *eckey); +#endif +X509_SIG *d2i_PKCS8_bio(BIO *bp,X509_SIG **p8); +int i2d_PKCS8_bio(BIO *bp,X509_SIG *p8); +PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_bio(BIO *bp, + PKCS8_PRIV_KEY_INFO **p8inf); +int i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,PKCS8_PRIV_KEY_INFO *p8inf); +int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key); +int i2d_PrivateKey_bio(BIO *bp, EVP_PKEY *pkey); +EVP_PKEY *d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a); +int i2d_PUBKEY_bio(BIO *bp, EVP_PKEY *pkey); +EVP_PKEY *d2i_PUBKEY_bio(BIO *bp, EVP_PKEY **a); +#endif + +X509 *X509_dup(X509 *x509); +X509_ATTRIBUTE *X509_ATTRIBUTE_dup(X509_ATTRIBUTE *xa); +X509_EXTENSION *X509_EXTENSION_dup(X509_EXTENSION *ex); +X509_CRL *X509_CRL_dup(X509_CRL *crl); +X509_REQ *X509_REQ_dup(X509_REQ *req); +X509_ALGOR *X509_ALGOR_dup(X509_ALGOR *xn); +int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval); +void X509_ALGOR_get0(const ASN1_OBJECT **paobj, int *pptype, const void **ppval, + const X509_ALGOR *algor); +int X509_ALGOR_cmp(const X509_ALGOR *a, const X509_ALGOR *b); + +X509_NAME *X509_NAME_dup(X509_NAME *xn); +int X509_NAME_get0_der(X509_NAME *nm, const unsigned char **pder, size_t *pderlen); +X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne); + +int X509_cmp_time(const ASN1_TIME *s, time_t *t); +int X509_cmp_current_time(const ASN1_TIME *s); +ASN1_TIME * X509_time_adj(ASN1_TIME *s, long adj, time_t *t); +ASN1_TIME * X509_time_adj_ex(ASN1_TIME *s, + int offset_day, long offset_sec, time_t *t); +ASN1_TIME * X509_gmtime_adj(ASN1_TIME *s, long adj); + +const char * X509_get_default_cert_area(void ); +const char * X509_get_default_cert_dir(void ); +const char * X509_get_default_cert_file(void ); +const char * X509_get_default_cert_dir_env(void ); +const char * X509_get_default_cert_file_env(void ); +const char * X509_get_default_private_dir(void ); + +X509_REQ * X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md); +X509 * X509_REQ_to_X509(X509_REQ *r, int days,EVP_PKEY *pkey); + +X509_ALGOR *X509_ALGOR_new(void); +void X509_ALGOR_free(X509_ALGOR *a); +X509_ALGOR *d2i_X509_ALGOR(X509_ALGOR **a, const unsigned char **in, long len); +int i2d_X509_ALGOR(X509_ALGOR *a, unsigned char **out); +extern const ASN1_ITEM X509_ALGOR_it; +X509_ALGORS *d2i_X509_ALGORS(X509_ALGORS **a, const unsigned char **in, long len); +int i2d_X509_ALGORS(X509_ALGORS *a, unsigned char **out); +extern const ASN1_ITEM X509_ALGORS_it; +X509_VAL *X509_VAL_new(void); +void X509_VAL_free(X509_VAL *a); +X509_VAL *d2i_X509_VAL(X509_VAL **a, const unsigned char **in, long len); +int i2d_X509_VAL(X509_VAL *a, unsigned char **out); +extern const ASN1_ITEM X509_VAL_it; + +X509_PUBKEY *X509_PUBKEY_new(void); +void X509_PUBKEY_free(X509_PUBKEY *a); +X509_PUBKEY *d2i_X509_PUBKEY(X509_PUBKEY **a, const unsigned char **in, long len); +int i2d_X509_PUBKEY(X509_PUBKEY *a, unsigned char **out); +extern const ASN1_ITEM X509_PUBKEY_it; + +int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey); +EVP_PKEY * X509_PUBKEY_get(X509_PUBKEY *key); +EVP_PKEY * X509_PUBKEY_get0(X509_PUBKEY *key); +int X509_get_pubkey_parameters(EVP_PKEY *pkey, + STACK_OF(X509) *chain); +int i2d_PUBKEY(EVP_PKEY *a,unsigned char **pp); +EVP_PKEY * d2i_PUBKEY(EVP_PKEY **a,const unsigned char **pp, + long length); +#ifndef OPENSSL_NO_RSA +int i2d_RSA_PUBKEY(RSA *a,unsigned char **pp); +RSA * d2i_RSA_PUBKEY(RSA **a,const unsigned char **pp, + long length); +#endif +#ifndef OPENSSL_NO_DSA +int i2d_DSA_PUBKEY(DSA *a,unsigned char **pp); +DSA * d2i_DSA_PUBKEY(DSA **a,const unsigned char **pp, + long length); +#endif +#ifndef OPENSSL_NO_EC +int i2d_EC_PUBKEY(EC_KEY *a, unsigned char **pp); +EC_KEY *d2i_EC_PUBKEY(EC_KEY **a, const unsigned char **pp, + long length); +#endif + +X509_SIG *X509_SIG_new(void); +void X509_SIG_free(X509_SIG *a); +X509_SIG *d2i_X509_SIG(X509_SIG **a, const unsigned char **in, long len); +int i2d_X509_SIG(X509_SIG *a, unsigned char **out); +extern const ASN1_ITEM X509_SIG_it; +void X509_SIG_get0(const X509_SIG *sig, const X509_ALGOR **palg, + const ASN1_OCTET_STRING **pdigest); +void X509_SIG_getm(X509_SIG *sig, X509_ALGOR **palg, + ASN1_OCTET_STRING **pdigest); + +X509_REQ_INFO *X509_REQ_INFO_new(void); +void X509_REQ_INFO_free(X509_REQ_INFO *a); +X509_REQ_INFO *d2i_X509_REQ_INFO(X509_REQ_INFO **a, const unsigned char **in, long len); +int i2d_X509_REQ_INFO(X509_REQ_INFO *a, unsigned char **out); +extern const ASN1_ITEM X509_REQ_INFO_it; +X509_REQ *X509_REQ_new(void); +void X509_REQ_free(X509_REQ *a); +X509_REQ *d2i_X509_REQ(X509_REQ **a, const unsigned char **in, long len); +int i2d_X509_REQ(X509_REQ *a, unsigned char **out); +extern const ASN1_ITEM X509_REQ_it; + +X509_ATTRIBUTE *X509_ATTRIBUTE_new(void); +void X509_ATTRIBUTE_free(X509_ATTRIBUTE *a); +X509_ATTRIBUTE *d2i_X509_ATTRIBUTE(X509_ATTRIBUTE **a, const unsigned char **in, long len); +int i2d_X509_ATTRIBUTE(X509_ATTRIBUTE *a, unsigned char **out); +extern const ASN1_ITEM X509_ATTRIBUTE_it; +X509_ATTRIBUTE *X509_ATTRIBUTE_create(int nid, int atrtype, void *value); + +X509_EXTENSION *X509_EXTENSION_new(void); +void X509_EXTENSION_free(X509_EXTENSION *a); +X509_EXTENSION *d2i_X509_EXTENSION(X509_EXTENSION **a, const unsigned char **in, long len); +int i2d_X509_EXTENSION(X509_EXTENSION *a, unsigned char **out); +extern const ASN1_ITEM X509_EXTENSION_it; +X509_EXTENSIONS *d2i_X509_EXTENSIONS(X509_EXTENSIONS **a, const unsigned char **in, long len); +int i2d_X509_EXTENSIONS(X509_EXTENSIONS *a, unsigned char **out); +extern const ASN1_ITEM X509_EXTENSIONS_it; + +X509_NAME_ENTRY *X509_NAME_ENTRY_new(void); +void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a); +X509_NAME_ENTRY *d2i_X509_NAME_ENTRY(X509_NAME_ENTRY **a, const unsigned char **in, long len); +int i2d_X509_NAME_ENTRY(X509_NAME_ENTRY *a, unsigned char **out); +extern const ASN1_ITEM X509_NAME_ENTRY_it; + +X509_NAME *X509_NAME_new(void); +void X509_NAME_free(X509_NAME *a); +X509_NAME *d2i_X509_NAME(X509_NAME **a, const unsigned char **in, long len); +int i2d_X509_NAME(X509_NAME *a, unsigned char **out); +extern const ASN1_ITEM X509_NAME_it; + +int X509_NAME_set(X509_NAME **xn, X509_NAME *name); + +X509_CINF *X509_CINF_new(void); +void X509_CINF_free(X509_CINF *a); +X509_CINF *d2i_X509_CINF(X509_CINF **a, const unsigned char **in, long len); +int i2d_X509_CINF(X509_CINF *a, unsigned char **out); +extern const ASN1_ITEM X509_CINF_it; + +X509 *X509_new(void); +void X509_free(X509 *a); +X509 *d2i_X509(X509 **a, const unsigned char **in, long len); +int i2d_X509(X509 *a, unsigned char **out); +extern const ASN1_ITEM X509_it; + +int X509_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, + CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); +int X509_set_ex_data(X509 *r, int idx, void *arg); +void *X509_get_ex_data(X509 *r, int idx); +int i2d_X509_AUX(X509 *a,unsigned char **pp); +X509 * d2i_X509_AUX(X509 **a,const unsigned char **pp,long length); + +int i2d_re_X509_tbs(X509 *x, unsigned char **pp); + +/* Flags returned by X509_get_signature_info(): valid and suitable for TLS. */ +#define X509_SIG_INFO_VALID 1 +#define X509_SIG_INFO_TLS 2 +int X509_get_signature_info(X509 *x, int *mdnid, int *pknid, int *secbits, + uint32_t *flags); + +void X509_get0_signature(const ASN1_BIT_STRING **psig, + const X509_ALGOR **palg, const X509 *x); +int X509_get_signature_nid(const X509 *x); + +int X509_alias_set1(X509 *x, const unsigned char *name, int len); +int X509_keyid_set1(X509 *x, const unsigned char *id, int len); +unsigned char *X509_alias_get0(X509 *x, int *len); +unsigned char *X509_keyid_get0(X509 *x, int *len); +int X509_add1_trust_object(X509 *x, const ASN1_OBJECT *obj); +int X509_add1_reject_object(X509 *x, const ASN1_OBJECT *obj); +void X509_trust_clear(X509 *x); +void X509_reject_clear(X509 *x); + +X509_REVOKED *X509_REVOKED_new(void); +void X509_REVOKED_free(X509_REVOKED *a); +X509_REVOKED *X509_REVOKED_dup(X509_REVOKED *a); +X509_REVOKED *d2i_X509_REVOKED(X509_REVOKED **a, const unsigned char **in, long len); +int i2d_X509_REVOKED(X509_REVOKED *a, unsigned char **out); +extern const ASN1_ITEM X509_REVOKED_it; + +X509_CRL_INFO *X509_CRL_INFO_new(void); +void X509_CRL_INFO_free(X509_CRL_INFO *a); +X509_CRL_INFO *d2i_X509_CRL_INFO(X509_CRL_INFO **a, const unsigned char **in, long len); +int i2d_X509_CRL_INFO(X509_CRL_INFO *a, unsigned char **out); +extern const ASN1_ITEM X509_CRL_INFO_it; + +X509_CRL *X509_CRL_new(void); +void X509_CRL_free(X509_CRL *a); +X509_CRL *d2i_X509_CRL(X509_CRL **a, const unsigned char **in, long len); +int i2d_X509_CRL(X509_CRL *a, unsigned char **out); +extern const ASN1_ITEM X509_CRL_it; + +int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev); +int X509_CRL_get0_by_serial(X509_CRL *crl, + X509_REVOKED **ret, ASN1_INTEGER *serial); +int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x); + +X509_PKEY * X509_PKEY_new(void ); +void X509_PKEY_free(X509_PKEY *a); + +NETSCAPE_SPKI *NETSCAPE_SPKI_new(void); +void NETSCAPE_SPKI_free(NETSCAPE_SPKI *a); +NETSCAPE_SPKI *d2i_NETSCAPE_SPKI(NETSCAPE_SPKI **a, const unsigned char **in, long len); +int i2d_NETSCAPE_SPKI(NETSCAPE_SPKI *a, unsigned char **out); +extern const ASN1_ITEM NETSCAPE_SPKI_it; +NETSCAPE_SPKAC *NETSCAPE_SPKAC_new(void); +void NETSCAPE_SPKAC_free(NETSCAPE_SPKAC *a); +NETSCAPE_SPKAC *d2i_NETSCAPE_SPKAC(NETSCAPE_SPKAC **a, const unsigned char **in, long len); +int i2d_NETSCAPE_SPKAC(NETSCAPE_SPKAC *a, unsigned char **out); +extern const ASN1_ITEM NETSCAPE_SPKAC_it; + +#ifndef OPENSSL_NO_EVP +X509_INFO * X509_INFO_new(void); +void X509_INFO_free(X509_INFO *a); +char * X509_NAME_oneline(const X509_NAME *a, char *buf, int size); + +int ASN1_item_digest(const ASN1_ITEM *it,const EVP_MD *type,void *data, + unsigned char *md,unsigned int *len); + +int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *algor1, + ASN1_BIT_STRING *signature,void *data,EVP_PKEY *pkey); + +int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2, + ASN1_BIT_STRING *signature, + void *data, EVP_PKEY *pkey, const EVP_MD *type); +int ASN1_item_sign_ctx(const ASN1_ITEM *it, + X509_ALGOR *algor1, X509_ALGOR *algor2, + ASN1_BIT_STRING *signature, void *asn, EVP_MD_CTX *ctx); +#endif + +const STACK_OF(X509_EXTENSION) *X509_get0_extensions(const X509 *x); +void X509_get0_uids(const X509 *x, const ASN1_BIT_STRING **issuerUID, + const ASN1_BIT_STRING **subjectUID); +const X509_ALGOR *X509_get0_tbs_sigalg(const X509 *x); +int X509_set_version(X509 *x, long version); +long X509_get_version(const X509 *x); +int X509_set_serialNumber(X509 *x, ASN1_INTEGER *serial); +ASN1_INTEGER * X509_get_serialNumber(X509 *x); +const ASN1_INTEGER *X509_get0_serialNumber(const X509 *x); +int X509_set_issuer_name(X509 *x, X509_NAME *name); +X509_NAME * X509_get_issuer_name(const X509 *a); +int X509_set_subject_name(X509 *x, X509_NAME *name); +X509_NAME * X509_get_subject_name(const X509 *a); +int X509_set_notBefore(X509 *x, const ASN1_TIME *tm); +int X509_set1_notBefore(X509 *x, const ASN1_TIME *tm); +int X509_set_notAfter(X509 *x, const ASN1_TIME *tm); +int X509_set1_notAfter(X509 *x, const ASN1_TIME *tm); +const ASN1_TIME *X509_get0_notBefore(const X509 *x); +ASN1_TIME *X509_getm_notBefore(const X509 *x); +const ASN1_TIME *X509_get0_notAfter(const X509 *x); +ASN1_TIME *X509_getm_notAfter(const X509 *x); +int X509_set_pubkey(X509 *x, EVP_PKEY *pkey); +EVP_PKEY * X509_get_pubkey(X509 *x); +EVP_PKEY * X509_get0_pubkey(const X509 *x); +ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x); +int X509_certificate_type(const X509 *x, const EVP_PKEY *pubkey); +int X509_get_signature_type(const X509 *x); + +#define X509_get_notBefore X509_getm_notBefore +#define X509_get_notAfter X509_getm_notAfter + +int X509_REQ_set_version(X509_REQ *x,long version); +long X509_REQ_get_version(const X509_REQ *x); +int X509_REQ_set_subject_name(X509_REQ *req, X509_NAME *name); +X509_NAME *X509_REQ_get_subject_name(const X509_REQ *x); +int X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey); +EVP_PKEY * X509_REQ_get_pubkey(X509_REQ *req); +int i2d_re_X509_REQ_tbs(X509_REQ *req, unsigned char **pp); +EVP_PKEY * X509_REQ_get0_pubkey(X509_REQ *req); +int X509_REQ_extension_nid(int nid); +STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req); +int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts, + int nid); +int X509_REQ_add_extensions(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts); +int X509_REQ_get_attr_count(const X509_REQ *req); +int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, + int lastpos); +int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, const ASN1_OBJECT *obj, + int lastpos); +X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc); +X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc); +int X509_REQ_add1_attr(X509_REQ *req, X509_ATTRIBUTE *attr); +int X509_REQ_add1_attr_by_OBJ(X509_REQ *req, + const ASN1_OBJECT *obj, int type, + const unsigned char *bytes, int len); +int X509_REQ_add1_attr_by_NID(X509_REQ *req, + int nid, int type, + const unsigned char *bytes, int len); +int X509_REQ_add1_attr_by_txt(X509_REQ *req, + const char *attrname, int type, + const unsigned char *bytes, int len); + +int X509_CRL_set_version(X509_CRL *x, long version); +int X509_CRL_set_issuer_name(X509_CRL *x, X509_NAME *name); +int X509_CRL_set_lastUpdate(X509_CRL *x, const ASN1_TIME *tm); +int X509_CRL_set1_lastUpdate(X509_CRL *x, const ASN1_TIME *tm); +int X509_CRL_set_nextUpdate(X509_CRL *x, const ASN1_TIME *tm); +int X509_CRL_set1_nextUpdate(X509_CRL *x, const ASN1_TIME *tm); +int X509_CRL_sort(X509_CRL *crl); + +const STACK_OF(X509_EXTENSION) *X509_REVOKED_get0_extensions(const X509_REVOKED *x); +const ASN1_TIME *X509_REVOKED_get0_revocationDate(const X509_REVOKED *x); +const ASN1_INTEGER *X509_REVOKED_get0_serialNumber(const X509_REVOKED *x); +int X509_REVOKED_set_revocationDate(X509_REVOKED *r, ASN1_TIME *tm); +int X509_REVOKED_set_serialNumber(X509_REVOKED *x, ASN1_INTEGER *serial); + +int X509_REQ_check_private_key(X509_REQ *x509,EVP_PKEY *pkey); + +int X509_check_private_key(const X509 *x509, const EVP_PKEY *pkey); + +int X509_issuer_and_serial_cmp(const X509 *a, const X509 *b); +unsigned long X509_issuer_and_serial_hash(X509 *a); + +int X509_issuer_name_cmp(const X509 *a, const X509 *b); +unsigned long X509_issuer_name_hash(X509 *a); + +int X509_subject_name_cmp(const X509 *a, const X509 *b); +unsigned long X509_subject_name_hash(X509 *x); + +#ifndef OPENSSL_NO_MD5 +unsigned long X509_issuer_name_hash_old(X509 *a); +unsigned long X509_subject_name_hash_old(X509 *x); +#endif + +int X509_cmp(const X509 *a, const X509 *b); +int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b); +unsigned long X509_NAME_hash(X509_NAME *x); +unsigned long X509_NAME_hash_old(X509_NAME *x); + +int X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b); +int X509_CRL_match(const X509_CRL *a, const X509_CRL *b); +int X509_print_ex_fp(FILE *bp,X509 *x, unsigned long nmflag, unsigned long cflag); +int X509_print_fp(FILE *bp,X509 *x); +int X509_CRL_print_fp(FILE *bp,X509_CRL *x); +int X509_REQ_print_fp(FILE *bp,X509_REQ *req); +int X509_NAME_print_ex_fp(FILE *fp, const X509_NAME *nm, int indent, + unsigned long flags); + +#ifndef OPENSSL_NO_BIO +int X509_NAME_print_ex(BIO *out, const X509_NAME *nm, int indent, + unsigned long flags); +int X509_print_ex(BIO *bp,X509 *x, unsigned long nmflag, unsigned long cflag); +int X509_print(BIO *bp,X509 *x); +int X509_ocspid_print(BIO *bp,X509 *x); +int X509_CRL_print(BIO *bp,X509_CRL *x); +int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflag, unsigned long cflag); +int X509_REQ_print(BIO *bp,X509_REQ *req); +#endif + +int X509_NAME_entry_count(const X509_NAME *name); +int X509_NAME_get_text_by_NID(X509_NAME *name, int nid, + char *buf,int len); +int X509_NAME_get_text_by_OBJ(X509_NAME *name, + const ASN1_OBJECT *obj, char *buf,int len); + +/* NOTE: you should be passing -1, not 0 as lastpos. The functions that use + * lastpos, search after that position on. */ +int X509_NAME_get_index_by_NID(const X509_NAME *name, int nid, + int lastpos); +int X509_NAME_get_index_by_OBJ(const X509_NAME *name, + const ASN1_OBJECT *obj, int lastpos); +X509_NAME_ENTRY *X509_NAME_get_entry(const X509_NAME *name, int loc); +X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc); +int X509_NAME_add_entry(X509_NAME *name, const X509_NAME_ENTRY *ne, + int loc, int set); +int X509_NAME_add_entry_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj, + int type, const unsigned char *bytes, int len, int loc, int set); +int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type, + const unsigned char *bytes, int len, int loc, int set); +X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne, + const char *field, int type, const unsigned char *bytes, int len); +X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid, + int type, const unsigned char *bytes, int len); +int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type, + const unsigned char *bytes, int len, int loc, int set); +X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne, + const ASN1_OBJECT *obj, int type, + const unsigned char *bytes, int len); +int X509_NAME_ENTRY_set_object(X509_NAME_ENTRY *ne, + const ASN1_OBJECT *obj); +int X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type, + const unsigned char *bytes, int len); +ASN1_OBJECT * X509_NAME_ENTRY_get_object(const X509_NAME_ENTRY *ne); +ASN1_STRING * X509_NAME_ENTRY_get_data(const X509_NAME_ENTRY *ne); +int X509_NAME_ENTRY_set(const X509_NAME_ENTRY *ne); + +int X509v3_get_ext_count(const STACK_OF(X509_EXTENSION) *x); +int X509v3_get_ext_by_NID(const STACK_OF(X509_EXTENSION) *x, + int nid, int lastpos); +int X509v3_get_ext_by_OBJ(const STACK_OF(X509_EXTENSION) *x, + const ASN1_OBJECT *obj, int lastpos); +int X509v3_get_ext_by_critical(const STACK_OF(X509_EXTENSION) *x, + int crit, int lastpos); +X509_EXTENSION *X509v3_get_ext(const STACK_OF(X509_EXTENSION) *x, int loc); +X509_EXTENSION *X509v3_delete_ext(STACK_OF(X509_EXTENSION) *x, int loc); +STACK_OF(X509_EXTENSION) *X509v3_add_ext(STACK_OF(X509_EXTENSION) **x, + X509_EXTENSION *ex, int loc); + +int X509_get_ext_count(const X509 *x); +int X509_get_ext_by_NID(const X509 *x, int nid, int lastpos); +int X509_get_ext_by_OBJ(const X509 *x, const ASN1_OBJECT *obj, + int lastpos); +int X509_get_ext_by_critical(const X509 *x, int crit, int lastpos); +X509_EXTENSION *X509_get_ext(const X509 *x, int loc); +X509_EXTENSION *X509_delete_ext(X509 *x, int loc); +int X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc); +void * X509_get_ext_d2i(const X509 *x, int nid, int *crit, int *idx); +int X509_add1_ext_i2d(X509 *x, int nid, void *value, int crit, + unsigned long flags); + +int X509_CRL_get_ext_count(const X509_CRL *x); +int X509_CRL_get_ext_by_NID(const X509_CRL *x, int nid, + int lastpos); +int X509_CRL_get_ext_by_OBJ(const X509_CRL *x, + const ASN1_OBJECT *obj, int lastpos); +int X509_CRL_get_ext_by_critical(const X509_CRL *x, int crit, + int lastpos); +X509_EXTENSION *X509_CRL_get_ext(const X509_CRL *x, int loc); +X509_EXTENSION *X509_CRL_delete_ext(X509_CRL *x, int loc); +int X509_CRL_add_ext(X509_CRL *x, X509_EXTENSION *ex, int loc); +void * X509_CRL_get_ext_d2i(const X509_CRL *x, int nid, int *crit, + int *idx); +int X509_CRL_add1_ext_i2d(X509_CRL *x, int nid, void *value, + int crit, unsigned long flags); + +int X509_REVOKED_get_ext_count(const X509_REVOKED *x); +int X509_REVOKED_get_ext_by_NID(const X509_REVOKED *x, int nid, + int lastpos); +int X509_REVOKED_get_ext_by_OBJ(const X509_REVOKED *x, + const ASN1_OBJECT *obj, int lastpos); +int X509_REVOKED_get_ext_by_critical(const X509_REVOKED *x, + int crit, int lastpos); +X509_EXTENSION *X509_REVOKED_get_ext(const X509_REVOKED *x, int loc); +X509_EXTENSION *X509_REVOKED_delete_ext(X509_REVOKED *x, int loc); +int X509_REVOKED_add_ext(X509_REVOKED *x, X509_EXTENSION *ex, + int loc); +void * X509_REVOKED_get_ext_d2i(const X509_REVOKED *x, int nid, + int *crit, int *idx); +int X509_REVOKED_add1_ext_i2d(X509_REVOKED *x, int nid, void *value, + int crit, unsigned long flags); + +X509_EXTENSION *X509_EXTENSION_create_by_NID(X509_EXTENSION **ex, + int nid, int crit, ASN1_OCTET_STRING *data); +X509_EXTENSION *X509_EXTENSION_create_by_OBJ(X509_EXTENSION **ex, + const ASN1_OBJECT *obj, int crit, ASN1_OCTET_STRING *data); +int X509_EXTENSION_set_object(X509_EXTENSION *ex, + const ASN1_OBJECT *obj); +int X509_EXTENSION_set_critical(X509_EXTENSION *ex, int crit); +int X509_EXTENSION_set_data(X509_EXTENSION *ex, + ASN1_OCTET_STRING *data); +ASN1_OBJECT * X509_EXTENSION_get_object(X509_EXTENSION *ex); +ASN1_OCTET_STRING *X509_EXTENSION_get_data(X509_EXTENSION *ne); +int X509_EXTENSION_get_critical(const X509_EXTENSION *ex); + +X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_NID(X509_ATTRIBUTE **attr, int nid, + int atrtype, const void *data, int len); +X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_OBJ(X509_ATTRIBUTE **attr, + const ASN1_OBJECT *obj, int atrtype, const void *data, int len); +X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_txt(X509_ATTRIBUTE **attr, + const char *atrname, int type, const unsigned char *bytes, int len); +int X509_ATTRIBUTE_set1_object(X509_ATTRIBUTE *attr, const ASN1_OBJECT *obj); +int X509_ATTRIBUTE_set1_data(X509_ATTRIBUTE *attr, int attrtype, const void *data, int len); +void *X509_ATTRIBUTE_get0_data(X509_ATTRIBUTE *attr, int idx, + int atrtype, void *data); +int X509_ATTRIBUTE_count(const X509_ATTRIBUTE *attr); +ASN1_OBJECT *X509_ATTRIBUTE_get0_object(X509_ATTRIBUTE *attr); +ASN1_TYPE *X509_ATTRIBUTE_get0_type(X509_ATTRIBUTE *attr, int idx); + +int X509_verify_cert(X509_STORE_CTX *ctx); + +/* lookup a cert from a X509 STACK */ +X509 *X509_find_by_issuer_and_serial(STACK_OF(X509) *sk,X509_NAME *name, + ASN1_INTEGER *serial); +X509 *X509_find_by_subject(STACK_OF(X509) *sk,X509_NAME *name); + +extern const ASN1_ITEM PBEPARAM_it; + +/* PKCS#8 utilities */ + +PKCS8_PRIV_KEY_INFO *PKCS8_PRIV_KEY_INFO_new(void); +void PKCS8_PRIV_KEY_INFO_free(PKCS8_PRIV_KEY_INFO *a); +PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO(PKCS8_PRIV_KEY_INFO **a, const unsigned char **in, long len); +int i2d_PKCS8_PRIV_KEY_INFO(PKCS8_PRIV_KEY_INFO *a, unsigned char **out); +extern const ASN1_ITEM PKCS8_PRIV_KEY_INFO_it; + +EVP_PKEY *EVP_PKCS82PKEY(const PKCS8_PRIV_KEY_INFO *p8); +PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey); + +int PKCS8_pkey_set0(PKCS8_PRIV_KEY_INFO *priv, ASN1_OBJECT *aobj, int version, + int ptype, void *pval, unsigned char *penc, int penclen); +int PKCS8_pkey_get0(const ASN1_OBJECT **ppkalg, const unsigned char **pk, + int *ppklen, const X509_ALGOR **pa, const PKCS8_PRIV_KEY_INFO *p8); + +const STACK_OF(X509_ATTRIBUTE) *PKCS8_pkey_get0_attrs(const PKCS8_PRIV_KEY_INFO *p8); +int PKCS8_pkey_add1_attr_by_NID(PKCS8_PRIV_KEY_INFO *p8, int nid, int type, + const unsigned char *bytes, int len); + +int X509_PUBKEY_set0_param(X509_PUBKEY *pub, ASN1_OBJECT *aobj, int ptype, + void *pval, unsigned char *penc, int penclen); +int X509_PUBKEY_get0_param(ASN1_OBJECT **ppkalg, const unsigned char **pk, + int *ppklen, X509_ALGOR **pa, X509_PUBKEY *pub); + +int X509_up_ref(X509 *x); +STACK_OF(X509) *X509_chain_up_ref(STACK_OF(X509) *chain); + +void ERR_load_X509_strings(void); + +/* Error codes for the X509 functions. */ + +/* Function codes. */ +#define X509_F_ADD_CERT_DIR 100 +#define X509_F_BY_FILE_CTRL 101 +#define X509_F_CHECK_POLICY 145 +#define X509_F_DIR_CTRL 102 +#define X509_F_GET_CERT_BY_SUBJECT 103 +#define X509_F_NETSCAPE_SPKI_B64_DECODE 129 +#define X509_F_NETSCAPE_SPKI_B64_ENCODE 130 +#define X509_F_X509AT_ADD1_ATTR 135 +#define X509_F_X509V3_ADD_EXT 104 +#define X509_F_X509_ATTRIBUTE_CREATE_BY_NID 136 +#define X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ 137 +#define X509_F_X509_ATTRIBUTE_CREATE_BY_TXT 140 +#define X509_F_X509_ATTRIBUTE_GET0_DATA 139 +#define X509_F_X509_ATTRIBUTE_SET1_DATA 138 +#define X509_F_X509_CHECK_PRIVATE_KEY 128 +#define X509_F_X509_CRL_PRINT_FP 147 +#define X509_F_X509_EXTENSION_CREATE_BY_NID 108 +#define X509_F_X509_EXTENSION_CREATE_BY_OBJ 109 +#define X509_F_X509_GET_PUBKEY_PARAMETERS 110 +#define X509_F_X509_LOAD_CERT_CRL_FILE 132 +#define X509_F_X509_LOAD_CERT_FILE 111 +#define X509_F_X509_LOAD_CRL_FILE 112 +#define X509_F_X509_NAME_ADD_ENTRY 113 +#define X509_F_X509_NAME_ENTRY_CREATE_BY_NID 114 +#define X509_F_X509_NAME_ENTRY_CREATE_BY_TXT 131 +#define X509_F_X509_NAME_ENTRY_SET_OBJECT 115 +#define X509_F_X509_NAME_ONELINE 116 +#define X509_F_X509_NAME_PRINT 117 +#define X509_F_X509_PRINT_EX_FP 118 +#define X509_F_X509_PUBKEY_GET 119 +#define X509_F_X509_PUBKEY_SET 120 +#define X509_F_X509_REQ_CHECK_PRIVATE_KEY 144 +#define X509_F_X509_REQ_PRINT_EX 121 +#define X509_F_X509_REQ_PRINT_FP 122 +#define X509_F_X509_REQ_TO_X509 123 +#define X509_F_X509_STORE_ADD_CERT 124 +#define X509_F_X509_STORE_ADD_CRL 125 +#define X509_F_X509_STORE_CTX_GET1_ISSUER 146 +#define X509_F_X509_STORE_CTX_INIT 143 +#define X509_F_X509_STORE_CTX_NEW 142 +#define X509_F_X509_STORE_CTX_PURPOSE_INHERIT 134 +#define X509_F_X509_TO_X509_REQ 126 +#define X509_F_X509_TRUST_ADD 133 +#define X509_F_X509_TRUST_SET 141 +#define X509_F_X509_VERIFY_CERT 127 + +/* Reason codes. */ +#define X509_R_BAD_X509_FILETYPE 100 +#define X509_R_BASE64_DECODE_ERROR 118 +#define X509_R_CANT_CHECK_DH_KEY 114 +#define X509_R_CERT_ALREADY_IN_HASH_TABLE 101 +#define X509_R_ERR_ASN1_LIB 102 +#define X509_R_INVALID_DIRECTORY 113 +#define X509_R_INVALID_FIELD_NAME 119 +#define X509_R_INVALID_TRUST 123 +#define X509_R_INVALID_VERSION 137 +#define X509_R_KEY_TYPE_MISMATCH 115 +#define X509_R_KEY_VALUES_MISMATCH 116 +#define X509_R_LOADING_CERT_DIR 103 +#define X509_R_LOADING_DEFAULTS 104 +#define X509_R_METHOD_NOT_SUPPORTED 124 +#define X509_R_NO_CERTIFICATE_OR_CRL_FOUND 136 +#define X509_R_NO_CERT_SET_FOR_US_TO_VERIFY 105 +#define X509_R_PUBLIC_KEY_DECODE_ERROR 125 +#define X509_R_PUBLIC_KEY_ENCODE_ERROR 126 +#define X509_R_SHOULD_RETRY 106 +#define X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN 107 +#define X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY 108 +#define X509_R_UNKNOWN_KEY_TYPE 117 +#define X509_R_UNKNOWN_NID 109 +#define X509_R_UNKNOWN_PURPOSE_ID 121 +#define X509_R_UNKNOWN_TRUST_ID 120 +#define X509_R_UNSUPPORTED_ALGORITHM 111 +#define X509_R_WRONG_LOOKUP_TYPE 112 +#define X509_R_WRONG_TYPE 122 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/x509_vfy.h b/curl/include/openssl/x509_vfy.h new file mode 100644 index 0000000..7058bbc --- /dev/null +++ b/curl/include/openssl/x509_vfy.h @@ -0,0 +1,463 @@ +/* $OpenBSD: x509_vfy.h,v 1.70 2025/03/09 15:20:20 tb Exp $ */ +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + +#ifndef HEADER_X509_H +#include +/* openssl/x509.h ends up #include-ing this file at about the only + * appropriate moment. */ +#endif + +#ifndef HEADER_X509_VFY_H +#define HEADER_X509_VFY_H + +#include + +#ifndef OPENSSL_NO_LHASH +#include +#endif +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * SSL_CTX -> X509_STORE + * -> X509_LOOKUP + * ->X509_LOOKUP_METHOD + * -> X509_LOOKUP + * ->X509_LOOKUP_METHOD + * + * SSL -> X509_STORE_CTX + * ->X509_STORE + * + * The X509_STORE holds the tables etc for verification stuff. + * A X509_STORE_CTX is used while validating a single certificate. + * The X509_STORE has X509_LOOKUPs for looking up certs. + * The X509_STORE then calls a function to actually verify the + * certificate chain. + */ + +typedef enum { + X509_LU_NONE, + X509_LU_X509, + X509_LU_CRL, +} X509_LOOKUP_TYPE; + + +DECLARE_STACK_OF(X509_LOOKUP) +DECLARE_STACK_OF(X509_OBJECT) +DECLARE_STACK_OF(X509_VERIFY_PARAM) + +/* XXX - unused in OpenSSL. Can we remove this? */ +typedef struct X509_VERIFY_PARAM_ID_st X509_VERIFY_PARAM_ID; + + +int X509_STORE_set_depth(X509_STORE *store, int depth); + +void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth); + +#define X509_STORE_CTX_set_app_data(ctx,data) \ + X509_STORE_CTX_set_ex_data(ctx,0,data) +#define X509_STORE_CTX_get_app_data(ctx) \ + X509_STORE_CTX_get_ex_data(ctx,0) + +#define X509_L_FILE_LOAD 1 +#define X509_L_ADD_DIR 2 +#define X509_L_MEM 3 + +#define X509_LOOKUP_load_file(x,name,type) \ + X509_LOOKUP_ctrl((x),X509_L_FILE_LOAD,(name),(long)(type),NULL) + +#define X509_LOOKUP_add_dir(x,name,type) \ + X509_LOOKUP_ctrl((x),X509_L_ADD_DIR,(name),(long)(type),NULL) + +#define X509_LOOKUP_add_mem(x,iov,type) \ + X509_LOOKUP_ctrl((x),X509_L_MEM,(const char *)(iov),\ + (long)(type),NULL) + +#define X509_V_OK 0 +#define X509_V_ERR_UNSPECIFIED 1 +#define X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT 2 +#define X509_V_ERR_UNABLE_TO_GET_CRL 3 +#define X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE 4 +#define X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE 5 +#define X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY 6 +#define X509_V_ERR_CERT_SIGNATURE_FAILURE 7 +#define X509_V_ERR_CRL_SIGNATURE_FAILURE 8 +#define X509_V_ERR_CERT_NOT_YET_VALID 9 +#define X509_V_ERR_CERT_HAS_EXPIRED 10 +#define X509_V_ERR_CRL_NOT_YET_VALID 11 +#define X509_V_ERR_CRL_HAS_EXPIRED 12 +#define X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD 13 +#define X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD 14 +#define X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD 15 +#define X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD 16 +#define X509_V_ERR_OUT_OF_MEM 17 +#define X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT 18 +#define X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN 19 +#define X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY 20 +#define X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE 21 +#define X509_V_ERR_CERT_CHAIN_TOO_LONG 22 +#define X509_V_ERR_CERT_REVOKED 23 +#define X509_V_ERR_INVALID_CA 24 +#define X509_V_ERR_PATH_LENGTH_EXCEEDED 25 +#define X509_V_ERR_INVALID_PURPOSE 26 +#define X509_V_ERR_CERT_UNTRUSTED 27 +#define X509_V_ERR_CERT_REJECTED 28 +/* These are 'informational' when looking for issuer cert */ +#define X509_V_ERR_SUBJECT_ISSUER_MISMATCH 29 +#define X509_V_ERR_AKID_SKID_MISMATCH 30 +#define X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH 31 +#define X509_V_ERR_KEYUSAGE_NO_CERTSIGN 32 + +#define X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER 33 +#define X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION 34 +#define X509_V_ERR_KEYUSAGE_NO_CRL_SIGN 35 +#define X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION 36 +#define X509_V_ERR_INVALID_NON_CA 37 +#define X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED 38 +#define X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE 39 +#define X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED 40 + +#define X509_V_ERR_INVALID_EXTENSION 41 +#define X509_V_ERR_INVALID_POLICY_EXTENSION 42 +#define X509_V_ERR_NO_EXPLICIT_POLICY 43 +#define X509_V_ERR_DIFFERENT_CRL_SCOPE 44 +#define X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE 45 + +#define X509_V_ERR_UNNESTED_RESOURCE 46 + +#define X509_V_ERR_PERMITTED_VIOLATION 47 +#define X509_V_ERR_EXCLUDED_VIOLATION 48 +#define X509_V_ERR_SUBTREE_MINMAX 49 +#define X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE 51 +#define X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX 52 +#define X509_V_ERR_UNSUPPORTED_NAME_SYNTAX 53 +#define X509_V_ERR_CRL_PATH_VALIDATION_ERROR 54 + +/* The application is not happy */ +#define X509_V_ERR_APPLICATION_VERIFICATION 50 + +/* Host, email and IP check errors */ +#define X509_V_ERR_HOSTNAME_MISMATCH 62 +#define X509_V_ERR_EMAIL_MISMATCH 63 +#define X509_V_ERR_IP_ADDRESS_MISMATCH 64 + +/* Caller error */ +#define X509_V_ERR_INVALID_CALL 65 +/* Issuer lookup error */ +#define X509_V_ERR_STORE_LOOKUP 66 + +/* Security level errors */ +#define X509_V_ERR_EE_KEY_TOO_SMALL 67 +#define X509_V_ERR_CA_KEY_TOO_SMALL 68 +#define X509_V_ERR_CA_MD_TOO_WEAK 69 + +/* Certificate verify flags */ + +/* Deprecated in 1.1.0, has no effect. Various FFI bindings still expose it. */ +#define X509_V_FLAG_CB_ISSUER_CHECK 0x0 +/* Use check time instead of current time */ +#define X509_V_FLAG_USE_CHECK_TIME 0x2 +/* Lookup CRLs */ +#define X509_V_FLAG_CRL_CHECK 0x4 +/* Lookup CRLs for whole chain */ +#define X509_V_FLAG_CRL_CHECK_ALL 0x8 +/* Ignore unhandled critical extensions */ +#define X509_V_FLAG_IGNORE_CRITICAL 0x10 +/* Disable workarounds for broken certificates */ +#define X509_V_FLAG_X509_STRICT 0x20 +/* Enable proxy certificate validation */ +#define X509_V_FLAG_ALLOW_PROXY_CERTS 0x40 +/* Does nothing as its functionality has been enabled by default */ +#define X509_V_FLAG_POLICY_CHECK 0x80 +/* Policy variable require-explicit-policy */ +#define X509_V_FLAG_EXPLICIT_POLICY 0x100 +/* Policy variable inhibit-any-policy */ +#define X509_V_FLAG_INHIBIT_ANY 0x200 +/* Policy variable inhibit-policy-mapping */ +#define X509_V_FLAG_INHIBIT_MAP 0x400 +/* Notify callback that policy is OK */ +#define X509_V_FLAG_NOTIFY_POLICY 0x800 +/* Extended CRL features such as indirect CRLs, alternate CRL signing keys */ +#define X509_V_FLAG_EXTENDED_CRL_SUPPORT 0x1000 +/* Delta CRL support */ +#define X509_V_FLAG_USE_DELTAS 0x2000 +/* Check selfsigned CA signature */ +#define X509_V_FLAG_CHECK_SS_SIGNATURE 0x4000 +/* Use trusted store first */ +#define X509_V_FLAG_TRUSTED_FIRST 0x8000 +/* Allow partial chains if at least one certificate is in trusted store */ +#define X509_V_FLAG_PARTIAL_CHAIN 0x80000 + +/* If the initial chain is not trusted, do not attempt to build an alternative + * chain. Alternate chain checking was introduced in 1.0.2b. Setting this flag + * will force the behaviour to match that of previous versions. */ +#define X509_V_FLAG_NO_ALT_CHAINS 0x100000 + +/* Do not check certificate or CRL validity against current time. */ +#define X509_V_FLAG_NO_CHECK_TIME 0x200000 + +/* Force the use of the legacy certificate verification */ +#define X509_V_FLAG_LEGACY_VERIFY 0x400000 + +#define X509_VP_FLAG_DEFAULT 0x1 +#define X509_VP_FLAG_OVERWRITE 0x2 +#define X509_VP_FLAG_RESET_FLAGS 0x4 +#define X509_VP_FLAG_LOCKED 0x8 +#define X509_VP_FLAG_ONCE 0x10 + +/* + * Obsolete internal use: mask of policy related options. + * This should really go away. + */ +#define X509_V_FLAG_POLICY_MASK (X509_V_FLAG_POLICY_CHECK \ + | X509_V_FLAG_EXPLICIT_POLICY \ + | X509_V_FLAG_INHIBIT_ANY \ + | X509_V_FLAG_INHIBIT_MAP) + +X509_OBJECT *X509_OBJECT_new(void); +void X509_OBJECT_free(X509_OBJECT *a); +int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, X509_LOOKUP_TYPE type, + X509_NAME *name); +X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, + X509_LOOKUP_TYPE type, X509_NAME *name); +X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x); +X509_LOOKUP_TYPE X509_OBJECT_get_type(const X509_OBJECT *a); +X509 *X509_OBJECT_get0_X509(const X509_OBJECT *xo); +X509_CRL *X509_OBJECT_get0_X509_CRL(X509_OBJECT *xo); + +X509_STORE *X509_STORE_new(void); +void X509_STORE_free(X509_STORE *v); +int X509_STORE_up_ref(X509_STORE *x); +#define X509_STORE_get1_certs X509_STORE_CTX_get1_certs +#define X509_STORE_get1_crls X509_STORE_CTX_get1_crls +STACK_OF(X509) *X509_STORE_CTX_get1_certs(X509_STORE_CTX *st, X509_NAME *nm); +STACK_OF(X509_CRL) *X509_STORE_CTX_get1_crls(X509_STORE_CTX *st, X509_NAME *nm); +STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(X509_STORE *xs); +STACK_OF(X509_OBJECT) *X509_STORE_get1_objects(X509_STORE *xs); +void *X509_STORE_get_ex_data(X509_STORE *xs, int idx); +int X509_STORE_set_ex_data(X509_STORE *xs, int idx, void *data); + +#define X509_STORE_get_ex_new_index(l, p, newf, dupf, freef) \ + CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_X509_STORE, (l), (p), \ + (newf), (dupf), (freef)) + +int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags); +int X509_STORE_set_purpose(X509_STORE *ctx, int purpose); +int X509_STORE_set_trust(X509_STORE *ctx, int trust); +int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *pm); +X509_VERIFY_PARAM *X509_STORE_get0_param(X509_STORE *ctx); + +typedef int (*X509_STORE_CTX_verify_cb)(int, X509_STORE_CTX *); + +X509_STORE_CTX_verify_cb X509_STORE_get_verify_cb(X509_STORE *); + +void X509_STORE_set_verify_cb(X509_STORE *ctx, + int (*verify_cb)(int, X509_STORE_CTX *)); +#define X509_STORE_set_verify_cb_func(ctx, func) \ + X509_STORE_set_verify_cb((ctx), (func)) + +typedef int (*X509_STORE_CTX_check_issued_fn)(X509_STORE_CTX *ctx, + X509 *subject, X509 *issuer); + +X509_STORE_CTX_check_issued_fn X509_STORE_get_check_issued(X509_STORE *store); +void X509_STORE_set_check_issued(X509_STORE *store, + X509_STORE_CTX_check_issued_fn check_issued); +X509_STORE_CTX_check_issued_fn + X509_STORE_CTX_get_check_issued(X509_STORE_CTX *ctx); + +X509_STORE_CTX *X509_STORE_CTX_new(void); + +int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x); + +void X509_STORE_CTX_free(X509_STORE_CTX *ctx); +int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, + X509 *x509, STACK_OF(X509) *chain); +X509 *X509_STORE_CTX_get0_cert(X509_STORE_CTX *ctx); +STACK_OF(X509) *X509_STORE_CTX_get0_chain(X509_STORE_CTX *xs); +X509_STORE *X509_STORE_CTX_get0_store(X509_STORE_CTX *xs); +STACK_OF(X509) *X509_STORE_CTX_get0_untrusted(X509_STORE_CTX *ctx); +void X509_STORE_CTX_set0_untrusted(X509_STORE_CTX *ctx, STACK_OF(X509) *sk); +void X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk); +void X509_STORE_CTX_set0_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk); +void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx); + +X509_LOOKUP *X509_STORE_add_lookup(X509_STORE *v, const X509_LOOKUP_METHOD *m); + +const X509_LOOKUP_METHOD *X509_LOOKUP_hash_dir(void); +const X509_LOOKUP_METHOD *X509_LOOKUP_file(void); +const X509_LOOKUP_METHOD *X509_LOOKUP_mem(void); + +int X509_STORE_add_cert(X509_STORE *ctx, X509 *x); +int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x); + +int X509_STORE_CTX_get_by_subject(X509_STORE_CTX *vs, X509_LOOKUP_TYPE type, + X509_NAME *name, X509_OBJECT *ret); +#define X509_STORE_get_by_subject X509_STORE_CTX_get_by_subject +X509_OBJECT *X509_STORE_CTX_get_obj_by_subject(X509_STORE_CTX *vs, + X509_LOOKUP_TYPE type, X509_NAME *name); + +int X509_LOOKUP_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc, + long argl, char **ret); + +int X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type); +int X509_load_crl_file(X509_LOOKUP *ctx, const char *file, int type); +int X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type); + +void X509_LOOKUP_free(X509_LOOKUP *ctx); + +int X509_STORE_load_locations(X509_STORE *ctx, + const char *file, const char *dir); +int X509_STORE_load_mem(X509_STORE *ctx, void *buf, int len); +int X509_STORE_set_default_paths(X509_STORE *ctx); + +int X509_STORE_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, + CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func); +int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx,int idx,void *data); +void * X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx,int idx); +int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx); +void X509_STORE_CTX_set_error(X509_STORE_CTX *ctx,int s); +int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx); +void X509_STORE_CTX_set_error_depth(X509_STORE_CTX *ctx, int depth); +X509 * X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx); +void X509_STORE_CTX_set_current_cert(X509_STORE_CTX *ctx, X509 *x); +X509 *X509_STORE_CTX_get0_current_issuer(X509_STORE_CTX *ctx); +X509_CRL *X509_STORE_CTX_get0_current_crl(X509_STORE_CTX *ctx); +X509_STORE_CTX *X509_STORE_CTX_get0_parent_ctx(X509_STORE_CTX *ctx); +STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx); +STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx); +void X509_STORE_CTX_set_cert(X509_STORE_CTX *c,X509 *x); +void X509_STORE_CTX_set_chain(X509_STORE_CTX *c,STACK_OF(X509) *sk); +void X509_STORE_CTX_set0_crls(X509_STORE_CTX *c,STACK_OF(X509_CRL) *sk); +int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose); +int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust); +void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags); +void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags, + time_t t); +void X509_STORE_CTX_set0_verified_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *sk); +int (*X509_STORE_CTX_get_verify(X509_STORE_CTX *ctx))(X509_STORE_CTX *); +void X509_STORE_CTX_set_verify(X509_STORE_CTX *ctx, + int (*verify)(X509_STORE_CTX *)); +int (*X509_STORE_CTX_get_verify_cb(X509_STORE_CTX *ctx))(int, X509_STORE_CTX *); +void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx, + int (*verify_cb)(int, X509_STORE_CTX *)); + +typedef int (*X509_STORE_CTX_verify_fn)(X509_STORE_CTX *); + +void X509_STORE_set_verify(X509_STORE *ctx, X509_STORE_CTX_verify_fn verify); +X509_STORE_CTX_verify_fn X509_STORE_get_verify(X509_STORE *ctx); +#define X509_STORE_set_verify_func(ctx, func) \ + X509_STORE_set_verify((ctx), (func)) + +int X509_STORE_CTX_get_num_untrusted(X509_STORE_CTX *ctx); + +X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx); +void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param); +int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name); + +/* X509_VERIFY_PARAM functions */ + +X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void); +void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param); +int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *to, + const X509_VERIFY_PARAM *from); +int X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to, + const X509_VERIFY_PARAM *from); +int X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name); +int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags); +int X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param, + unsigned long flags); +unsigned long X509_VERIFY_PARAM_get_flags(X509_VERIFY_PARAM *param); +int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose); +int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust); +void X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth); +void X509_VERIFY_PARAM_set_auth_level(X509_VERIFY_PARAM *param, int auth_level); +time_t X509_VERIFY_PARAM_get_time(const X509_VERIFY_PARAM *param); +void X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t); +int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param, + ASN1_OBJECT *policy); +int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param, + STACK_OF(ASN1_OBJECT) *policies); +int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param); +int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param, const char *name, + size_t namelen); +int X509_VERIFY_PARAM_add1_host(X509_VERIFY_PARAM *param, const char *name, + size_t namelen); +void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param, + unsigned int flags); +char *X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *param); +int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param, const char *email, + size_t emaillen); +int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *param, const unsigned char *ip, + size_t iplen); +int X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM *param, const char *ipasc); +const char *X509_VERIFY_PARAM_get0_name(const X509_VERIFY_PARAM *param); +const X509_VERIFY_PARAM *X509_VERIFY_PARAM_get0(int id); +int X509_VERIFY_PARAM_get_count(void); + +int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param); +const X509_VERIFY_PARAM *X509_VERIFY_PARAM_lookup(const char *name); +void X509_VERIFY_PARAM_table_cleanup(void); + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/openssl/x509v3.h b/curl/include/openssl/x509v3.h new file mode 100644 index 0000000..fa31279 --- /dev/null +++ b/curl/include/openssl/x509v3.h @@ -0,0 +1,1041 @@ +/* $OpenBSD: x509v3.h,v 1.40 2024/12/23 09:57:23 tb Exp $ */ +/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL + * project 1999. + */ +/* ==================================================================== + * Copyright (c) 1999-2004 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * licensing@OpenSSL.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ +#ifndef HEADER_X509V3_H +#define HEADER_X509V3_H + +#include + +#include +#include +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* Forward reference */ +struct v3_ext_method; +struct v3_ext_ctx; + +/* Useful typedefs */ + +typedef void * (*X509V3_EXT_NEW)(void); +typedef void (*X509V3_EXT_FREE)(void *); +typedef void * (*X509V3_EXT_D2I)(void *, const unsigned char ** , long); +typedef int (*X509V3_EXT_I2D)(void *, unsigned char **); +typedef STACK_OF(CONF_VALUE) * + (*X509V3_EXT_I2V)(const struct v3_ext_method *method, void *ext, + STACK_OF(CONF_VALUE) *extlist); +typedef void * (*X509V3_EXT_V2I)(const struct v3_ext_method *method, + struct v3_ext_ctx *ctx, + STACK_OF(CONF_VALUE) *values); +typedef char * (*X509V3_EXT_I2S)(const struct v3_ext_method *method, void *ext); +typedef void * (*X509V3_EXT_S2I)(const struct v3_ext_method *method, + struct v3_ext_ctx *ctx, const char *str); +typedef int (*X509V3_EXT_I2R)(const struct v3_ext_method *method, void *ext, + BIO *out, int indent); +typedef void * (*X509V3_EXT_R2I)(const struct v3_ext_method *method, + struct v3_ext_ctx *ctx, const char *str); + +/* V3 extension structure */ + +struct v3_ext_method { + int ext_nid; + int ext_flags; + /* If this is set the following four fields are ignored */ + ASN1_ITEM_EXP *it; + /* Old style ASN1 calls */ + X509V3_EXT_NEW ext_new; + X509V3_EXT_FREE ext_free; + X509V3_EXT_D2I d2i; + X509V3_EXT_I2D i2d; + + /* The following pair is used for string extensions */ + X509V3_EXT_I2S i2s; + X509V3_EXT_S2I s2i; + + /* The following pair is used for multi-valued extensions */ + X509V3_EXT_I2V i2v; + X509V3_EXT_V2I v2i; + + /* The following are used for raw extensions */ + X509V3_EXT_I2R i2r; + X509V3_EXT_R2I r2i; + + const void *usr_data; /* Any extension specific data */ +}; + +struct v3_ext_ctx { + #define CTX_TEST 0x1 + int flags; + X509 *issuer_cert; + X509 *subject_cert; + X509_REQ *subject_req; + X509_CRL *crl; + void *db; +}; + +typedef struct v3_ext_method X509V3_EXT_METHOD; + +DECLARE_STACK_OF(X509V3_EXT_METHOD) + +/* XXX - can this be made internal? */ +#define X509V3_EXT_MULTILINE 0x4 + +/* XXX - remove it anyway? */ +/* Guess who uses this... Yes, of course, it's xca. */ +typedef BIT_STRING_BITNAME ENUMERATED_NAMES; + +typedef struct BASIC_CONSTRAINTS_st { + int ca; + ASN1_INTEGER *pathlen; +} BASIC_CONSTRAINTS; + + +typedef struct PKEY_USAGE_PERIOD_st { + ASN1_GENERALIZEDTIME *notBefore; + ASN1_GENERALIZEDTIME *notAfter; +} PKEY_USAGE_PERIOD; + +typedef struct otherName_st { + ASN1_OBJECT *type_id; + ASN1_TYPE *value; +} OTHERNAME; + +typedef struct EDIPartyName_st { + ASN1_STRING *nameAssigner; + ASN1_STRING *partyName; +} EDIPARTYNAME; + +typedef struct GENERAL_NAME_st { + + #define GEN_OTHERNAME 0 + #define GEN_EMAIL 1 + #define GEN_DNS 2 + #define GEN_X400 3 + #define GEN_DIRNAME 4 + #define GEN_EDIPARTY 5 + #define GEN_URI 6 + #define GEN_IPADD 7 + #define GEN_RID 8 + + int type; + union { + char *ptr; + OTHERNAME *otherName; /* otherName */ + ASN1_IA5STRING *rfc822Name; + ASN1_IA5STRING *dNSName; + ASN1_STRING *x400Address; + X509_NAME *directoryName; + EDIPARTYNAME *ediPartyName; + ASN1_IA5STRING *uniformResourceIdentifier; + ASN1_OCTET_STRING *iPAddress; + ASN1_OBJECT *registeredID; + + /* Old names */ + ASN1_OCTET_STRING *ip; /* iPAddress */ + X509_NAME *dirn; /* dirn */ + ASN1_IA5STRING *ia5; /* rfc822Name, dNSName, uniformResourceIdentifier */ + ASN1_OBJECT *rid; /* registeredID */ + } d; +} GENERAL_NAME; + +typedef struct ACCESS_DESCRIPTION_st { + ASN1_OBJECT *method; + GENERAL_NAME *location; +} ACCESS_DESCRIPTION; + +typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS; + +typedef STACK_OF(ASN1_OBJECT) EXTENDED_KEY_USAGE; + +DECLARE_STACK_OF(GENERAL_NAME) + +typedef STACK_OF(GENERAL_NAME) GENERAL_NAMES; +DECLARE_STACK_OF(GENERAL_NAMES) + +DECLARE_STACK_OF(ACCESS_DESCRIPTION) + +typedef struct DIST_POINT_NAME_st { + int type; + union { + GENERAL_NAMES *fullname; + STACK_OF(X509_NAME_ENTRY) *relativename; + } name; + /* If relativename then this contains the full distribution point name */ + X509_NAME *dpname; +} DIST_POINT_NAME; +/* All existing reasons */ +#define CRLDP_ALL_REASONS 0x807f + +#define CRL_REASON_NONE -1 +#define CRL_REASON_UNSPECIFIED 0 +#define CRL_REASON_KEY_COMPROMISE 1 +#define CRL_REASON_CA_COMPROMISE 2 +#define CRL_REASON_AFFILIATION_CHANGED 3 +#define CRL_REASON_SUPERSEDED 4 +#define CRL_REASON_CESSATION_OF_OPERATION 5 +#define CRL_REASON_CERTIFICATE_HOLD 6 +#define CRL_REASON_REMOVE_FROM_CRL 8 +#define CRL_REASON_PRIVILEGE_WITHDRAWN 9 +#define CRL_REASON_AA_COMPROMISE 10 + +struct DIST_POINT_st { + DIST_POINT_NAME *distpoint; + ASN1_BIT_STRING *reasons; + GENERAL_NAMES *CRLissuer; + int dp_reasons; +}; + +typedef STACK_OF(DIST_POINT) CRL_DIST_POINTS; + +DECLARE_STACK_OF(DIST_POINT) + +struct AUTHORITY_KEYID_st { + ASN1_OCTET_STRING *keyid; + GENERAL_NAMES *issuer; + ASN1_INTEGER *serial; +}; + +typedef struct NOTICEREF_st { + ASN1_STRING *organization; + STACK_OF(ASN1_INTEGER) *noticenos; +} NOTICEREF; + +typedef struct USERNOTICE_st { + NOTICEREF *noticeref; + ASN1_STRING *exptext; +} USERNOTICE; + +typedef struct POLICYQUALINFO_st { + ASN1_OBJECT *pqualid; + union { + ASN1_IA5STRING *cpsuri; + USERNOTICE *usernotice; + ASN1_TYPE *other; + } d; +} POLICYQUALINFO; + +DECLARE_STACK_OF(POLICYQUALINFO) + +typedef struct POLICYINFO_st { + ASN1_OBJECT *policyid; + STACK_OF(POLICYQUALINFO) *qualifiers; +} POLICYINFO; + +typedef STACK_OF(POLICYINFO) CERTIFICATEPOLICIES; + +DECLARE_STACK_OF(POLICYINFO) + +typedef struct POLICY_MAPPING_st { + ASN1_OBJECT *issuerDomainPolicy; + ASN1_OBJECT *subjectDomainPolicy; +} POLICY_MAPPING; + +DECLARE_STACK_OF(POLICY_MAPPING) + +typedef STACK_OF(POLICY_MAPPING) POLICY_MAPPINGS; + +typedef struct GENERAL_SUBTREE_st { + GENERAL_NAME *base; + ASN1_INTEGER *minimum; + ASN1_INTEGER *maximum; +} GENERAL_SUBTREE; + +DECLARE_STACK_OF(GENERAL_SUBTREE) + +struct NAME_CONSTRAINTS_st { + STACK_OF(GENERAL_SUBTREE) *permittedSubtrees; + STACK_OF(GENERAL_SUBTREE) *excludedSubtrees; +}; + +typedef struct POLICY_CONSTRAINTS_st { + ASN1_INTEGER *requireExplicitPolicy; + ASN1_INTEGER *inhibitPolicyMapping; +} POLICY_CONSTRAINTS; + +struct ISSUING_DIST_POINT_st { + DIST_POINT_NAME *distpoint; + int onlyuser; + int onlyCA; + ASN1_BIT_STRING *onlysomereasons; + int indirectCRL; + int onlyattr; +}; + +/* Values in idp_flags field */ +/* IDP present */ +#define IDP_PRESENT 0x1 +/* IDP values inconsistent */ +#define IDP_INVALID 0x2 +/* onlyuser true */ +#define IDP_ONLYUSER 0x4 +/* onlyCA true */ +#define IDP_ONLYCA 0x8 +/* onlyattr true */ +#define IDP_ONLYATTR 0x10 +/* indirectCRL true */ +#define IDP_INDIRECT 0x20 +/* onlysomereasons present */ +#define IDP_REASONS 0x40 + +#define X509V3_conf_err(val) ERR_asprintf_error_data( \ + "section:%s,name:%s,value:%s", val->section, \ + val->name, val->value); + +#define X509V3_set_ctx_test(ctx) \ + X509V3_set_ctx(ctx, NULL, NULL, NULL, NULL, CTX_TEST) +#define X509V3_set_ctx_nodb(ctx) (ctx)->db = NULL; + +/* X509_PURPOSE stuff */ + +#define EXFLAG_BCONS 0x0001 +#define EXFLAG_KUSAGE 0x0002 +#define EXFLAG_XKUSAGE 0x0004 +#define EXFLAG_NSCERT 0x0008 + +#define EXFLAG_CA 0x0010 +#define EXFLAG_SI 0x0020 /* Self issued. */ +#define EXFLAG_V1 0x0040 +#define EXFLAG_INVALID 0x0080 +#define EXFLAG_SET 0x0100 +#define EXFLAG_CRITICAL 0x0200 +#if !defined(LIBRESSL_INTERNAL) +#define EXFLAG_PROXY 0x0400 +#endif +#define EXFLAG_INVALID_POLICY 0x0800 +#define EXFLAG_FRESHEST 0x1000 +#define EXFLAG_SS 0x2000 /* Self signed. */ + +#define KU_DIGITAL_SIGNATURE 0x0080 +#define KU_NON_REPUDIATION 0x0040 +#define KU_KEY_ENCIPHERMENT 0x0020 +#define KU_DATA_ENCIPHERMENT 0x0010 +#define KU_KEY_AGREEMENT 0x0008 +#define KU_KEY_CERT_SIGN 0x0004 +#define KU_CRL_SIGN 0x0002 +#define KU_ENCIPHER_ONLY 0x0001 +#define KU_DECIPHER_ONLY 0x8000 + +#define NS_SSL_CLIENT 0x80 +#define NS_SSL_SERVER 0x40 +#define NS_SMIME 0x20 +#define NS_OBJSIGN 0x10 +#define NS_SSL_CA 0x04 +#define NS_SMIME_CA 0x02 +#define NS_OBJSIGN_CA 0x01 +#define NS_ANY_CA (NS_SSL_CA|NS_SMIME_CA|NS_OBJSIGN_CA) + +#define XKU_SSL_SERVER 0x1 +#define XKU_SSL_CLIENT 0x2 +#define XKU_SMIME 0x4 +#define XKU_CODE_SIGN 0x8 +#define XKU_SGC 0x10 +#define XKU_OCSP_SIGN 0x20 +#define XKU_TIMESTAMP 0x40 +#define XKU_DVCS 0x80 +#define XKU_ANYEKU 0x100 + +#define X509_PURPOSE_DYNAMIC 0x1 +#define X509_PURPOSE_DYNAMIC_NAME 0x2 + +typedef struct x509_purpose_st X509_PURPOSE; + +#define X509_PURPOSE_SSL_CLIENT 1 +#define X509_PURPOSE_SSL_SERVER 2 +#define X509_PURPOSE_NS_SSL_SERVER 3 +#define X509_PURPOSE_SMIME_SIGN 4 +#define X509_PURPOSE_SMIME_ENCRYPT 5 +#define X509_PURPOSE_CRL_SIGN 6 +#define X509_PURPOSE_ANY 7 +#define X509_PURPOSE_OCSP_HELPER 8 +#define X509_PURPOSE_TIMESTAMP_SIGN 9 + +#define X509_PURPOSE_MIN 1 +#define X509_PURPOSE_MAX 9 + +/* Flags for X509V3_EXT_print() */ + +#define X509V3_EXT_UNKNOWN_MASK (0xfL << 16) +/* Return error for unknown extensions */ +#define X509V3_EXT_DEFAULT 0 +/* Print error for unknown extensions */ +#define X509V3_EXT_ERROR_UNKNOWN (1L << 16) +/* ASN1 parse unknown extensions */ +#define X509V3_EXT_PARSE_UNKNOWN (2L << 16) +/* BIO_dump unknown extensions */ +#define X509V3_EXT_DUMP_UNKNOWN (3L << 16) + +/* Flags for X509V3_add1_i2d */ + +#define X509V3_ADD_OP_MASK 0xfL +#define X509V3_ADD_DEFAULT 0L +#define X509V3_ADD_APPEND 1L +#define X509V3_ADD_REPLACE 2L +#define X509V3_ADD_REPLACE_EXISTING 3L +#define X509V3_ADD_KEEP_EXISTING 4L +#define X509V3_ADD_DELETE 5L +#define X509V3_ADD_SILENT 0x10 + +DECLARE_STACK_OF(X509_PURPOSE) + +BASIC_CONSTRAINTS *BASIC_CONSTRAINTS_new(void); +void BASIC_CONSTRAINTS_free(BASIC_CONSTRAINTS *a); +BASIC_CONSTRAINTS *d2i_BASIC_CONSTRAINTS(BASIC_CONSTRAINTS **a, const unsigned char **in, long len); +int i2d_BASIC_CONSTRAINTS(BASIC_CONSTRAINTS *a, unsigned char **out); +extern const ASN1_ITEM BASIC_CONSTRAINTS_it; + +AUTHORITY_KEYID *AUTHORITY_KEYID_new(void); +void AUTHORITY_KEYID_free(AUTHORITY_KEYID *a); +AUTHORITY_KEYID *d2i_AUTHORITY_KEYID(AUTHORITY_KEYID **a, const unsigned char **in, long len); +int i2d_AUTHORITY_KEYID(AUTHORITY_KEYID *a, unsigned char **out); +extern const ASN1_ITEM AUTHORITY_KEYID_it; + +PKEY_USAGE_PERIOD *PKEY_USAGE_PERIOD_new(void); +void PKEY_USAGE_PERIOD_free(PKEY_USAGE_PERIOD *a); +PKEY_USAGE_PERIOD *d2i_PKEY_USAGE_PERIOD(PKEY_USAGE_PERIOD **a, const unsigned char **in, long len); +int i2d_PKEY_USAGE_PERIOD(PKEY_USAGE_PERIOD *a, unsigned char **out); +extern const ASN1_ITEM PKEY_USAGE_PERIOD_it; + +GENERAL_NAME *GENERAL_NAME_new(void); +void GENERAL_NAME_free(GENERAL_NAME *a); +GENERAL_NAME *d2i_GENERAL_NAME(GENERAL_NAME **a, const unsigned char **in, long len); +int i2d_GENERAL_NAME(GENERAL_NAME *a, unsigned char **out); +extern const ASN1_ITEM GENERAL_NAME_it; +GENERAL_NAME *GENERAL_NAME_dup(GENERAL_NAME *a); +int GENERAL_NAME_cmp(GENERAL_NAME *a, GENERAL_NAME *b); + + + +ASN1_BIT_STRING *v2i_ASN1_BIT_STRING(X509V3_EXT_METHOD *method, + X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval); +STACK_OF(CONF_VALUE) *i2v_ASN1_BIT_STRING(X509V3_EXT_METHOD *method, + ASN1_BIT_STRING *bits, + STACK_OF(CONF_VALUE) *extlist); + +STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method, GENERAL_NAME *gen, STACK_OF(CONF_VALUE) *ret); +int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen); + +GENERAL_NAMES *GENERAL_NAMES_new(void); +void GENERAL_NAMES_free(GENERAL_NAMES *a); +GENERAL_NAMES *d2i_GENERAL_NAMES(GENERAL_NAMES **a, const unsigned char **in, long len); +int i2d_GENERAL_NAMES(GENERAL_NAMES *a, unsigned char **out); +extern const ASN1_ITEM GENERAL_NAMES_it; + +STACK_OF(CONF_VALUE) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method, + GENERAL_NAMES *gen, STACK_OF(CONF_VALUE) *extlist); +GENERAL_NAMES *v2i_GENERAL_NAMES(const X509V3_EXT_METHOD *method, + X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval); + +OTHERNAME *OTHERNAME_new(void); +void OTHERNAME_free(OTHERNAME *a); +OTHERNAME *d2i_OTHERNAME(OTHERNAME **a, const unsigned char **in, long len); +int i2d_OTHERNAME(OTHERNAME *a, unsigned char **out); +extern const ASN1_ITEM OTHERNAME_it; +EDIPARTYNAME *EDIPARTYNAME_new(void); +void EDIPARTYNAME_free(EDIPARTYNAME *a); +EDIPARTYNAME *d2i_EDIPARTYNAME(EDIPARTYNAME **a, const unsigned char **in, long len); +int i2d_EDIPARTYNAME(EDIPARTYNAME *a, unsigned char **out); +extern const ASN1_ITEM EDIPARTYNAME_it; +int OTHERNAME_cmp(OTHERNAME *a, OTHERNAME *b); +void GENERAL_NAME_set0_value(GENERAL_NAME *a, int type, void *value); +void *GENERAL_NAME_get0_value(GENERAL_NAME *a, int *ptype); +int GENERAL_NAME_set0_othername(GENERAL_NAME *gen, + ASN1_OBJECT *oid, ASN1_TYPE *value); +int GENERAL_NAME_get0_otherName(GENERAL_NAME *gen, + ASN1_OBJECT **poid, ASN1_TYPE **pvalue); + +char *i2s_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, + const ASN1_OCTET_STRING *ia5); +ASN1_OCTET_STRING *s2i_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, + X509V3_CTX *ctx, const char *str); + +EXTENDED_KEY_USAGE *EXTENDED_KEY_USAGE_new(void); +void EXTENDED_KEY_USAGE_free(EXTENDED_KEY_USAGE *a); +EXTENDED_KEY_USAGE *d2i_EXTENDED_KEY_USAGE(EXTENDED_KEY_USAGE **a, const unsigned char **in, long len); +int i2d_EXTENDED_KEY_USAGE(EXTENDED_KEY_USAGE *a, unsigned char **out); +extern const ASN1_ITEM EXTENDED_KEY_USAGE_it; +int i2a_ACCESS_DESCRIPTION(BIO *bp, const ACCESS_DESCRIPTION* a); + +CERTIFICATEPOLICIES *CERTIFICATEPOLICIES_new(void); +void CERTIFICATEPOLICIES_free(CERTIFICATEPOLICIES *a); +CERTIFICATEPOLICIES *d2i_CERTIFICATEPOLICIES(CERTIFICATEPOLICIES **a, const unsigned char **in, long len); +int i2d_CERTIFICATEPOLICIES(CERTIFICATEPOLICIES *a, unsigned char **out); +extern const ASN1_ITEM CERTIFICATEPOLICIES_it; +POLICYINFO *POLICYINFO_new(void); +void POLICYINFO_free(POLICYINFO *a); +POLICYINFO *d2i_POLICYINFO(POLICYINFO **a, const unsigned char **in, long len); +int i2d_POLICYINFO(POLICYINFO *a, unsigned char **out); +extern const ASN1_ITEM POLICYINFO_it; +POLICYQUALINFO *POLICYQUALINFO_new(void); +void POLICYQUALINFO_free(POLICYQUALINFO *a); +POLICYQUALINFO *d2i_POLICYQUALINFO(POLICYQUALINFO **a, const unsigned char **in, long len); +int i2d_POLICYQUALINFO(POLICYQUALINFO *a, unsigned char **out); +extern const ASN1_ITEM POLICYQUALINFO_it; +USERNOTICE *USERNOTICE_new(void); +void USERNOTICE_free(USERNOTICE *a); +USERNOTICE *d2i_USERNOTICE(USERNOTICE **a, const unsigned char **in, long len); +int i2d_USERNOTICE(USERNOTICE *a, unsigned char **out); +extern const ASN1_ITEM USERNOTICE_it; +NOTICEREF *NOTICEREF_new(void); +void NOTICEREF_free(NOTICEREF *a); +NOTICEREF *d2i_NOTICEREF(NOTICEREF **a, const unsigned char **in, long len); +int i2d_NOTICEREF(NOTICEREF *a, unsigned char **out); +extern const ASN1_ITEM NOTICEREF_it; + +CRL_DIST_POINTS *CRL_DIST_POINTS_new(void); +void CRL_DIST_POINTS_free(CRL_DIST_POINTS *a); +CRL_DIST_POINTS *d2i_CRL_DIST_POINTS(CRL_DIST_POINTS **a, const unsigned char **in, long len); +int i2d_CRL_DIST_POINTS(CRL_DIST_POINTS *a, unsigned char **out); +extern const ASN1_ITEM CRL_DIST_POINTS_it; +DIST_POINT *DIST_POINT_new(void); +void DIST_POINT_free(DIST_POINT *a); +DIST_POINT *d2i_DIST_POINT(DIST_POINT **a, const unsigned char **in, long len); +int i2d_DIST_POINT(DIST_POINT *a, unsigned char **out); +extern const ASN1_ITEM DIST_POINT_it; +DIST_POINT_NAME *DIST_POINT_NAME_new(void); +void DIST_POINT_NAME_free(DIST_POINT_NAME *a); +DIST_POINT_NAME *d2i_DIST_POINT_NAME(DIST_POINT_NAME **a, const unsigned char **in, long len); +int i2d_DIST_POINT_NAME(DIST_POINT_NAME *a, unsigned char **out); +extern const ASN1_ITEM DIST_POINT_NAME_it; +ISSUING_DIST_POINT *ISSUING_DIST_POINT_new(void); +void ISSUING_DIST_POINT_free(ISSUING_DIST_POINT *a); +ISSUING_DIST_POINT *d2i_ISSUING_DIST_POINT(ISSUING_DIST_POINT **a, const unsigned char **in, long len); +int i2d_ISSUING_DIST_POINT(ISSUING_DIST_POINT *a, unsigned char **out); +extern const ASN1_ITEM ISSUING_DIST_POINT_it; + +int DIST_POINT_set_dpname(DIST_POINT_NAME *dpn, X509_NAME *iname); + +int NAME_CONSTRAINTS_check(X509 *x, NAME_CONSTRAINTS *nc); + +ACCESS_DESCRIPTION *ACCESS_DESCRIPTION_new(void); +void ACCESS_DESCRIPTION_free(ACCESS_DESCRIPTION *a); +ACCESS_DESCRIPTION *d2i_ACCESS_DESCRIPTION(ACCESS_DESCRIPTION **a, const unsigned char **in, long len); +int i2d_ACCESS_DESCRIPTION(ACCESS_DESCRIPTION *a, unsigned char **out); +extern const ASN1_ITEM ACCESS_DESCRIPTION_it; +AUTHORITY_INFO_ACCESS *AUTHORITY_INFO_ACCESS_new(void); +void AUTHORITY_INFO_ACCESS_free(AUTHORITY_INFO_ACCESS *a); +AUTHORITY_INFO_ACCESS *d2i_AUTHORITY_INFO_ACCESS(AUTHORITY_INFO_ACCESS **a, const unsigned char **in, long len); +int i2d_AUTHORITY_INFO_ACCESS(AUTHORITY_INFO_ACCESS *a, unsigned char **out); +extern const ASN1_ITEM AUTHORITY_INFO_ACCESS_it; + +extern const ASN1_ITEM POLICY_MAPPING_it; +POLICY_MAPPING *POLICY_MAPPING_new(void); +void POLICY_MAPPING_free(POLICY_MAPPING *a); +extern const ASN1_ITEM POLICY_MAPPINGS_it; + +extern const ASN1_ITEM GENERAL_SUBTREE_it; +GENERAL_SUBTREE *GENERAL_SUBTREE_new(void); +void GENERAL_SUBTREE_free(GENERAL_SUBTREE *a); + +extern const ASN1_ITEM NAME_CONSTRAINTS_it; +NAME_CONSTRAINTS *NAME_CONSTRAINTS_new(void); +void NAME_CONSTRAINTS_free(NAME_CONSTRAINTS *a); + +POLICY_CONSTRAINTS *POLICY_CONSTRAINTS_new(void); +void POLICY_CONSTRAINTS_free(POLICY_CONSTRAINTS *a); +extern const ASN1_ITEM POLICY_CONSTRAINTS_it; + +GENERAL_NAME *a2i_GENERAL_NAME(GENERAL_NAME *out, + const X509V3_EXT_METHOD *method, X509V3_CTX *ctx, + int gen_type, const char *value, int is_nc); + +#ifdef HEADER_CONF_H +GENERAL_NAME *v2i_GENERAL_NAME(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx, + CONF_VALUE *cnf); +GENERAL_NAME *v2i_GENERAL_NAME_ex(GENERAL_NAME *out, + const X509V3_EXT_METHOD *method, + X509V3_CTX *ctx, CONF_VALUE *cnf, int is_nc); +void X509V3_conf_free(CONF_VALUE *val); + +X509_EXTENSION *X509V3_EXT_nconf_nid(CONF *conf, X509V3_CTX *ctx, int ext_nid, + const char *value); +X509_EXTENSION *X509V3_EXT_nconf(CONF *conf, X509V3_CTX *ctx, const char *name, + const char *value); +int X509V3_EXT_add_nconf_sk(CONF *conf, X509V3_CTX *ctx, const char *section, + STACK_OF(X509_EXTENSION) **sk); +int X509V3_EXT_add_nconf(CONF *conf, X509V3_CTX *ctx, const char *section, + X509 *cert); +int X509V3_EXT_REQ_add_nconf(CONF *conf, X509V3_CTX *ctx, const char *section, + X509_REQ *req); +int X509V3_EXT_CRL_add_nconf(CONF *conf, X509V3_CTX *ctx, const char *section, + X509_CRL *crl); + +X509_EXTENSION *X509V3_EXT_conf_nid(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx, + int ext_nid, const char *value); +X509_EXTENSION *X509V3_EXT_conf(LHASH_OF(CONF_VALUE) *conf, X509V3_CTX *ctx, + const char *name, const char *value); + +void X509V3_set_nconf(X509V3_CTX *ctx, CONF *conf); +#endif + +void X509V3_set_ctx(X509V3_CTX *ctx, X509 *issuer, X509 *subject, + X509_REQ *req, X509_CRL *crl, int flags); + +char *i2s_ASN1_INTEGER(X509V3_EXT_METHOD *meth, const ASN1_INTEGER *aint); +ASN1_INTEGER *s2i_ASN1_INTEGER(X509V3_EXT_METHOD *meth, const char *value); +char *i2s_ASN1_ENUMERATED(X509V3_EXT_METHOD *meth, const ASN1_ENUMERATED *aint); +char *i2s_ASN1_ENUMERATED_TABLE(X509V3_EXT_METHOD *meth, + const ASN1_ENUMERATED *aint); + +const X509V3_EXT_METHOD *X509V3_EXT_get(X509_EXTENSION *ext); +const X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid); +int X509V3_add_standard_extensions(void); +STACK_OF(CONF_VALUE) *X509V3_parse_list(const char *line); +void *X509V3_EXT_d2i(X509_EXTENSION *ext); +void *X509V3_get_d2i(const STACK_OF(X509_EXTENSION) *x, int nid, int *crit, + int *idx); + +X509_EXTENSION *X509V3_EXT_i2d(int ext_nid, int crit, void *ext_struc); +int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value, int crit, unsigned long flags); + +char *hex_to_string(const unsigned char *buffer, long len); +unsigned char *string_to_hex(const char *str, long *len); + +void X509V3_EXT_val_prn(BIO *out, STACK_OF(CONF_VALUE) *val, int indent, + int ml); +int X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, unsigned long flag, int indent); +int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent); + +int X509V3_extensions_print(BIO *out, const char *title, + const STACK_OF(X509_EXTENSION) *exts, unsigned long flag, int indent); + +int X509_check_ca(X509 *x); +int X509_check_purpose(X509 *x, int id, int ca); +int X509_supported_extension(X509_EXTENSION *ex); +int X509_check_issued(X509 *issuer, X509 *subject); +int X509_check_akid(X509 *issuer, AUTHORITY_KEYID *akid); + +int X509_PURPOSE_get_count(void); +const X509_PURPOSE *X509_PURPOSE_get0(int idx); +int X509_PURPOSE_get_by_sname(const char *sname); +const char *X509_PURPOSE_get0_name(const X509_PURPOSE *xp); +const char *X509_PURPOSE_get0_sname(const X509_PURPOSE *xp); +int X509_PURPOSE_get_id(const X509_PURPOSE *); +uint32_t X509_get_extension_flags(X509 *x); +uint32_t X509_get_key_usage(X509 *x); +uint32_t X509_get_extended_key_usage(X509 *x); + +STACK_OF(OPENSSL_STRING) *X509_get1_email(X509 *x); +STACK_OF(OPENSSL_STRING) *X509_REQ_get1_email(X509_REQ *x); +void X509_email_free(STACK_OF(OPENSSL_STRING) *sk); +STACK_OF(OPENSSL_STRING) *X509_get1_ocsp(X509 *x); + +/* Flags for X509_check_* functions */ +/* Always check subject name for host match even if subject alt names present */ +#define X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT 0x1 +/* Disable wildcard matching for dnsName fields and common name. */ +#define X509_CHECK_FLAG_NO_WILDCARDS 0x2 +/* Wildcards must not match a partial label. */ +#define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0x4 +/* Allow (non-partial) wildcards to match multiple labels. */ +#define X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS 0x8 +/* Constraint verifier subdomain patterns to match a single labels. */ +#define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0x10 +/* Disable checking the CN for a hostname, to support modern validation */ +#define X509_CHECK_FLAG_NEVER_CHECK_SUBJECT 0x20 + +int X509_check_host(X509 *x, const char *chk, size_t chklen, + unsigned int flags, char **peername); +int X509_check_email(X509 *x, const char *chk, size_t chklen, + unsigned int flags); +int X509_check_ip(X509 *x, const unsigned char *chk, size_t chklen, + unsigned int flags); +int X509_check_ip_asc(X509 *x, const char *ipasc, unsigned int flags); + +ASN1_OCTET_STRING *a2i_IPADDRESS(const char *ipasc); +ASN1_OCTET_STRING *a2i_IPADDRESS_NC(const char *ipasc); +int a2i_ipadd(unsigned char *ipout, const char *ipasc); +int X509V3_NAME_from_section(X509_NAME *nm, STACK_OF(CONF_VALUE)*dn_sk, + unsigned long chtype); + +#ifndef OPENSSL_NO_RFC3779 +typedef struct ASRange_st { + ASN1_INTEGER *min; + ASN1_INTEGER *max; +} ASRange; + +#define ASIdOrRange_id 0 +#define ASIdOrRange_range 1 + +typedef struct ASIdOrRange_st { + int type; + union { + ASN1_INTEGER *id; + ASRange *range; + } u; +} ASIdOrRange; + +typedef STACK_OF(ASIdOrRange) ASIdOrRanges; +DECLARE_STACK_OF(ASIdOrRange) + +#define ASIdentifierChoice_inherit 0 +#define ASIdentifierChoice_asIdsOrRanges 1 + +typedef struct ASIdentifierChoice_st { + int type; + union { + ASN1_NULL *inherit; + ASIdOrRanges *asIdsOrRanges; + } u; +} ASIdentifierChoice; + +typedef struct ASIdentifiers_st { + ASIdentifierChoice *asnum; + ASIdentifierChoice *rdi; +} ASIdentifiers; + +ASRange *ASRange_new(void); +void ASRange_free(ASRange *a); +ASRange *d2i_ASRange(ASRange **a, const unsigned char **in, long len); +int i2d_ASRange(ASRange *a, unsigned char **out); +extern const ASN1_ITEM ASRange_it; + +ASIdOrRange *ASIdOrRange_new(void); +void ASIdOrRange_free(ASIdOrRange *a); +ASIdOrRange *d2i_ASIdOrRange(ASIdOrRange **a, const unsigned char **in, + long len); +int i2d_ASIdOrRange(ASIdOrRange *a, unsigned char **out); +extern const ASN1_ITEM ASIdOrRange_it; + +ASIdentifierChoice *ASIdentifierChoice_new(void); +void ASIdentifierChoice_free(ASIdentifierChoice *a); +ASIdentifierChoice *d2i_ASIdentifierChoice(ASIdentifierChoice **a, + const unsigned char **in, long len); +int i2d_ASIdentifierChoice(ASIdentifierChoice *a, unsigned char **out); +extern const ASN1_ITEM ASIdentifierChoice_it; + +ASIdentifiers *ASIdentifiers_new(void); +void ASIdentifiers_free(ASIdentifiers *a); +ASIdentifiers *d2i_ASIdentifiers(ASIdentifiers **a, const unsigned char **in, + long len); +int i2d_ASIdentifiers(ASIdentifiers *a, unsigned char **out); +extern const ASN1_ITEM ASIdentifiers_it; + +typedef struct IPAddressRange_st { + ASN1_BIT_STRING *min; + ASN1_BIT_STRING *max; +} IPAddressRange; + +#define IPAddressOrRange_addressPrefix 0 +#define IPAddressOrRange_addressRange 1 + +typedef struct IPAddressOrRange_st { + int type; + union { + ASN1_BIT_STRING *addressPrefix; + IPAddressRange *addressRange; + } u; +} IPAddressOrRange; + +typedef STACK_OF(IPAddressOrRange) IPAddressOrRanges; +DECLARE_STACK_OF(IPAddressOrRange) + +#define IPAddressChoice_inherit 0 +#define IPAddressChoice_addressesOrRanges 1 + +typedef struct IPAddressChoice_st { + int type; + union { + ASN1_NULL *inherit; + IPAddressOrRanges *addressesOrRanges; + } u; +} IPAddressChoice; + +typedef struct IPAddressFamily_st { + ASN1_OCTET_STRING *addressFamily; + IPAddressChoice *ipAddressChoice; +} IPAddressFamily; + +typedef STACK_OF(IPAddressFamily) IPAddrBlocks; +DECLARE_STACK_OF(IPAddressFamily) + +IPAddressRange *IPAddressRange_new(void); +void IPAddressRange_free(IPAddressRange *a); +IPAddressRange *d2i_IPAddressRange(IPAddressRange **a, + const unsigned char **in, long len); +int i2d_IPAddressRange(IPAddressRange *a, unsigned char **out); +extern const ASN1_ITEM IPAddressRange_it; + +IPAddressOrRange *IPAddressOrRange_new(void); +void IPAddressOrRange_free(IPAddressOrRange *a); +IPAddressOrRange *d2i_IPAddressOrRange(IPAddressOrRange **a, + const unsigned char **in, long len); +int i2d_IPAddressOrRange(IPAddressOrRange *a, unsigned char **out); +extern const ASN1_ITEM IPAddressOrRange_it; + +IPAddressChoice *IPAddressChoice_new(void); +void IPAddressChoice_free(IPAddressChoice *a); +IPAddressChoice *d2i_IPAddressChoice(IPAddressChoice **a, + const unsigned char **in, long len); +int i2d_IPAddressChoice(IPAddressChoice *a, unsigned char **out); +extern const ASN1_ITEM IPAddressChoice_it; + +IPAddressFamily *IPAddressFamily_new(void); +void IPAddressFamily_free(IPAddressFamily *a); +IPAddressFamily *d2i_IPAddressFamily(IPAddressFamily **a, + const unsigned char **in, long len); +int i2d_IPAddressFamily(IPAddressFamily *a, unsigned char **out); +extern const ASN1_ITEM IPAddressFamily_it; + +/* + * API tag for elements of the ASIdentifer SEQUENCE. + */ +#define V3_ASID_ASNUM 0 +#define V3_ASID_RDI 1 + +/* + * AFI values, assigned by IANA. It'd be nice to make the AFI + * handling code totally generic, but there are too many little things + * that would need to be defined for other address families for it to + * be worth the trouble. + */ +#define IANA_AFI_IPV4 1 +#define IANA_AFI_IPV6 2 + +/* + * Utilities to construct and extract values from RFC3779 extensions, + * since some of the encodings (particularly for IP address prefixes + * and ranges) are a bit tedious to work with directly. + */ +int X509v3_asid_add_inherit(ASIdentifiers *asid, int which); +int X509v3_asid_add_id_or_range(ASIdentifiers *asid, int which, + ASN1_INTEGER *min, ASN1_INTEGER *max); +int X509v3_addr_add_inherit(IPAddrBlocks *addr, const unsigned afi, + const unsigned *safi); +int X509v3_addr_add_prefix(IPAddrBlocks *addr, const unsigned afi, + const unsigned *safi, unsigned char *a, const int prefixlen); +int X509v3_addr_add_range(IPAddrBlocks *addr, const unsigned afi, + const unsigned *safi, unsigned char *min, unsigned char *max); +unsigned X509v3_addr_get_afi(const IPAddressFamily *f); +int X509v3_addr_get_range(IPAddressOrRange *aor, const unsigned afi, + unsigned char *min, unsigned char *max, const int length); + +/* + * Canonical forms. + */ +int X509v3_asid_is_canonical(ASIdentifiers *asid); +int X509v3_addr_is_canonical(IPAddrBlocks *addr); +int X509v3_asid_canonize(ASIdentifiers *asid); +int X509v3_addr_canonize(IPAddrBlocks *addr); + +/* + * Tests for inheritance and containment. + */ +int X509v3_asid_inherits(ASIdentifiers *asid); +int X509v3_addr_inherits(IPAddrBlocks *addr); +int X509v3_asid_subset(ASIdentifiers *a, ASIdentifiers *b); +int X509v3_addr_subset(IPAddrBlocks *a, IPAddrBlocks *b); + +/* + * Check whether RFC 3779 extensions nest properly in chains. + */ +int X509v3_asid_validate_path(X509_STORE_CTX *); +int X509v3_addr_validate_path(X509_STORE_CTX *); +int X509v3_asid_validate_resource_set(STACK_OF(X509) *chain, ASIdentifiers *ext, + int allow_inheritance); +int X509v3_addr_validate_resource_set(STACK_OF(X509) *chain, IPAddrBlocks *ext, + int allow_inheritance); + +#endif /* !OPENSSL_NO_RFC3779 */ + +void ERR_load_X509V3_strings(void); + +/* Error codes for the X509V3 functions. */ + +/* Function codes. */ +#define X509V3_F_A2I_GENERAL_NAME 164 +#define X509V3_F_ASIDENTIFIERCHOICE_CANONIZE 161 +#define X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL 162 +#define X509V3_F_COPY_EMAIL 122 +#define X509V3_F_COPY_ISSUER 123 +#define X509V3_F_DO_DIRNAME 144 +#define X509V3_F_DO_EXT_CONF 124 +#define X509V3_F_DO_EXT_I2D 135 +#define X509V3_F_DO_EXT_NCONF 151 +#define X509V3_F_DO_I2V_NAME_CONSTRAINTS 148 +#define X509V3_F_GNAMES_FROM_SECTNAME 156 +#define X509V3_F_HEX_TO_STRING 111 +#define X509V3_F_I2S_ASN1_ENUMERATED 121 +#define X509V3_F_I2S_ASN1_IA5STRING 149 +#define X509V3_F_I2S_ASN1_INTEGER 120 +#define X509V3_F_I2V_AUTHORITY_INFO_ACCESS 138 +#define X509V3_F_NOTICE_SECTION 132 +#define X509V3_F_NREF_NOS 133 +#define X509V3_F_POLICY_SECTION 131 +#define X509V3_F_PROCESS_PCI_VALUE 150 +#define X509V3_F_R2I_CERTPOL 130 +#define X509V3_F_R2I_PCI 155 +#define X509V3_F_S2I_ASN1_IA5STRING 100 +#define X509V3_F_S2I_ASN1_INTEGER 108 +#define X509V3_F_S2I_ASN1_OCTET_STRING 112 +#define X509V3_F_S2I_ASN1_SKEY_ID 114 +#define X509V3_F_S2I_SKEY_ID 115 +#define X509V3_F_SET_DIST_POINT_NAME 158 +#define X509V3_F_STRING_TO_HEX 113 +#define X509V3_F_SXNET_ADD_ID_ASC 125 +#define X509V3_F_SXNET_ADD_ID_INTEGER 126 +#define X509V3_F_SXNET_ADD_ID_ULONG 127 +#define X509V3_F_SXNET_GET_ID_ASC 128 +#define X509V3_F_SXNET_GET_ID_ULONG 129 +#define X509V3_F_V2I_ASIDENTIFIERS 163 +#define X509V3_F_V2I_ASN1_BIT_STRING 101 +#define X509V3_F_V2I_AUTHORITY_INFO_ACCESS 139 +#define X509V3_F_V2I_AUTHORITY_KEYID 119 +#define X509V3_F_V2I_BASIC_CONSTRAINTS 102 +#define X509V3_F_V2I_CRLD 134 +#define X509V3_F_V2I_EXTENDED_KEY_USAGE 103 +#define X509V3_F_V2I_GENERAL_NAMES 118 +#define X509V3_F_V2I_GENERAL_NAME_EX 117 +#define X509V3_F_V2I_IDP 157 +#define X509V3_F_V2I_IPADDRBLOCKS 159 +#define X509V3_F_V2I_ISSUER_ALT 153 +#define X509V3_F_V2I_NAME_CONSTRAINTS 147 +#define X509V3_F_V2I_POLICY_CONSTRAINTS 146 +#define X509V3_F_V2I_POLICY_MAPPINGS 145 +#define X509V3_F_V2I_SUBJECT_ALT 154 +#define X509V3_F_V3_ADDR_VALIDATE_PATH_INTERNAL 160 +#define X509V3_F_V3_GENERIC_EXTENSION 116 +#define X509V3_F_X509V3_ADD1_I2D 140 +#define X509V3_F_X509V3_ADD_VALUE 105 +#define X509V3_F_X509V3_EXT_ADD 104 +#define X509V3_F_X509V3_EXT_ADD_ALIAS 106 +#define X509V3_F_X509V3_EXT_CONF 107 +#define X509V3_F_X509V3_EXT_I2D 136 +#define X509V3_F_X509V3_EXT_NCONF 152 +#define X509V3_F_X509V3_GET_SECTION 142 +#define X509V3_F_X509V3_GET_STRING 143 +#define X509V3_F_X509V3_GET_VALUE_BOOL 110 +#define X509V3_F_X509V3_PARSE_LIST 109 +#define X509V3_F_X509_PURPOSE_ADD 137 +#define X509V3_F_X509_PURPOSE_SET 141 + +/* Reason codes. */ +#define X509V3_R_BAD_IP_ADDRESS 118 +#define X509V3_R_BAD_OBJECT 119 +#define X509V3_R_BN_DEC2BN_ERROR 100 +#define X509V3_R_BN_TO_ASN1_INTEGER_ERROR 101 +#define X509V3_R_DIRNAME_ERROR 149 +#define X509V3_R_DISTPOINT_ALREADY_SET 160 +#define X509V3_R_DUPLICATE_ZONE_ID 133 +#define X509V3_R_ERROR_CONVERTING_ZONE 131 +#define X509V3_R_ERROR_CREATING_EXTENSION 144 +#define X509V3_R_ERROR_IN_EXTENSION 128 +#define X509V3_R_EXPECTED_A_SECTION_NAME 137 +#define X509V3_R_EXTENSION_EXISTS 145 +#define X509V3_R_EXTENSION_NAME_ERROR 115 +#define X509V3_R_EXTENSION_NOT_FOUND 102 +#define X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED 103 +#define X509V3_R_EXTENSION_VALUE_ERROR 116 +#define X509V3_R_ILLEGAL_EMPTY_EXTENSION 151 +#define X509V3_R_ILLEGAL_HEX_DIGIT 113 +#define X509V3_R_INCORRECT_POLICY_SYNTAX_TAG 152 +#define X509V3_R_INVALID_MULTIPLE_RDNS 161 +#define X509V3_R_INVALID_ASNUMBER 162 +#define X509V3_R_INVALID_ASRANGE 163 +#define X509V3_R_INVALID_BOOLEAN_STRING 104 +#define X509V3_R_INVALID_EXTENSION_STRING 105 +#define X509V3_R_INVALID_INHERITANCE 165 +#define X509V3_R_INVALID_IPADDRESS 166 +#define X509V3_R_INVALID_NAME 106 +#define X509V3_R_INVALID_NULL_ARGUMENT 107 +#define X509V3_R_INVALID_NULL_NAME 108 +#define X509V3_R_INVALID_NULL_VALUE 109 +#define X509V3_R_INVALID_NUMBER 140 +#define X509V3_R_INVALID_NUMBERS 141 +#define X509V3_R_INVALID_OBJECT_IDENTIFIER 110 +#define X509V3_R_INVALID_OPTION 138 +#define X509V3_R_INVALID_POLICY_IDENTIFIER 134 +#define X509V3_R_INVALID_PROXY_POLICY_SETTING 153 +#define X509V3_R_INVALID_PURPOSE 146 +#define X509V3_R_INVALID_SAFI 164 +#define X509V3_R_INVALID_SECTION 135 +#define X509V3_R_INVALID_SYNTAX 143 +#define X509V3_R_ISSUER_DECODE_ERROR 126 +#define X509V3_R_MISSING_VALUE 124 +#define X509V3_R_NEED_ORGANIZATION_AND_NUMBERS 142 +#define X509V3_R_NO_CONFIG_DATABASE 136 +#define X509V3_R_NO_ISSUER_CERTIFICATE 121 +#define X509V3_R_NO_ISSUER_DETAILS 127 +#define X509V3_R_NO_POLICY_IDENTIFIER 139 +#define X509V3_R_NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED 154 +#define X509V3_R_NO_PUBLIC_KEY 114 +#define X509V3_R_NO_SUBJECT_DETAILS 125 +#define X509V3_R_ODD_NUMBER_OF_DIGITS 112 +#define X509V3_R_OPERATION_NOT_DEFINED 148 +#define X509V3_R_OTHERNAME_ERROR 147 +#define X509V3_R_POLICY_LANGUAGE_ALREADY_DEFINED 155 +#define X509V3_R_POLICY_PATH_LENGTH 156 +#define X509V3_R_POLICY_PATH_LENGTH_ALREADY_DEFINED 157 +#define X509V3_R_POLICY_SYNTAX_NOT_CURRENTLY_SUPPORTED 158 +#define X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY 159 +#define X509V3_R_SECTION_NOT_FOUND 150 +#define X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS 122 +#define X509V3_R_UNABLE_TO_GET_ISSUER_KEYID 123 +#define X509V3_R_UNKNOWN_BIT_STRING_ARGUMENT 111 +#define X509V3_R_UNKNOWN_EXTENSION 129 +#define X509V3_R_UNKNOWN_EXTENSION_NAME 130 +#define X509V3_R_UNKNOWN_OPTION 120 +#define X509V3_R_UNSUPPORTED_OPTION 117 +#define X509V3_R_UNSUPPORTED_TYPE 167 +#define X509V3_R_USER_TOO_LONG 132 + +#ifdef __cplusplus +} +#endif +#endif diff --git a/curl/include/zconf.h b/curl/include/zconf.h new file mode 100644 index 0000000..de90f8e --- /dev/null +++ b/curl/include/zconf.h @@ -0,0 +1,206 @@ +/* zconf.h -- configuration of the zlib compression library + * Copyright (C) 1995-2024 Jean-loup Gailly, Mark Adler + * For conditions of distribution and use, see copyright notice in zlib.h + */ + +#ifndef ZCONF_H +#define ZCONF_H + +#include "zlib_name_mangling.h" + +#if !defined(_WIN32) && defined(__WIN32__) +# define _WIN32 +#endif + +/* Clang macro for detecting declspec support + * https://clang.llvm.org/docs/LanguageExtensions.html#has-declspec-attribute + */ +#ifndef __has_declspec_attribute +# define __has_declspec_attribute(x) 0 +#endif + +#if defined(ZLIB_CONST) && !defined(z_const) +# define z_const const +#else +# define z_const +#endif + +/* Maximum value for memLevel in deflateInit2 */ +#ifndef MAX_MEM_LEVEL +# define MAX_MEM_LEVEL 9 +#endif + +/* Maximum value for windowBits in deflateInit2 and inflateInit2. + * WARNING: reducing MAX_WBITS makes minigzip unable to extract .gz files + * created by gzip. (Files created by minigzip can still be extracted by + * gzip.) + */ +#ifndef MIN_WBITS +# define MIN_WBITS 8 /* 256 LZ77 window */ +#endif +#ifndef MAX_WBITS +# define MAX_WBITS 15 /* 32K LZ77 window */ +#endif + +/* The memory requirements for deflate are (in bytes): + (1 << (windowBits+2)) + (1 << (memLevel+9)) + that is: 128K for windowBits=15 + 128K for memLevel = 8 (default values) + plus a few kilobytes for small objects. For example, if you want to reduce + the default memory requirements from 256K to 128K, compile with + make CFLAGS="-O -DMAX_WBITS=14 -DMAX_MEM_LEVEL=7" + Of course this will generally degrade compression (there's no free lunch). + + The memory requirements for inflate are (in bytes) 1 << windowBits + that is, 32K for windowBits=15 (default value) plus about 7 kilobytes + for small objects. +*/ + +/* Type declarations */ + + +#ifndef OF /* function prototypes */ +# define OF(args) args +#endif + +#ifdef ZLIB_INTERNAL +# define Z_INTERNAL ZLIB_INTERNAL +#endif + +/* If building or using zlib as a DLL, define ZLIB_DLL. + * This is not mandatory, but it offers a little performance increase. + */ +#if defined(ZLIB_DLL) && (defined(_WIN32) || (__has_declspec_attribute(dllexport) && __has_declspec_attribute(dllimport))) +# ifdef Z_INTERNAL +# define Z_EXTERN extern __declspec(dllexport) +# else +# define Z_EXTERN extern __declspec(dllimport) +# endif +#endif + +/* If building or using zlib with the WINAPI/WINAPIV calling convention, + * define ZLIB_WINAPI. + * Caution: the standard ZLIB1.DLL is NOT compiled using ZLIB_WINAPI. + */ +#if defined(ZLIB_WINAPI) && defined(_WIN32) +# ifndef WIN32_LEAN_AND_MEAN +# define WIN32_LEAN_AND_MEAN +# endif +# include + /* No need for _export, use ZLIB.DEF instead. */ + /* For complete Windows compatibility, use WINAPI, not __stdcall. */ +# define Z_EXPORT WINAPI +# define Z_EXPORTVA WINAPIV +#endif + +#ifndef Z_EXTERN +# define Z_EXTERN extern +#endif +#ifndef Z_EXPORT +# define Z_EXPORT +#endif +#ifndef Z_EXPORTVA +# define Z_EXPORTVA +#endif + +/* Conditional exports */ +#define ZNG_CONDEXPORT Z_INTERNAL + +/* For backwards compatibility */ + +#ifndef ZEXTERN +# define ZEXTERN Z_EXTERN +#endif +#ifndef ZEXPORT +# define ZEXPORT Z_EXPORT +#endif +#ifndef ZEXPORTVA +# define ZEXPORTVA Z_EXPORTVA +#endif +#ifndef FAR +# define FAR +#endif + +/* Legacy zlib typedefs for backwards compatibility. Don't assume stdint.h is defined. */ +typedef unsigned char Byte; +typedef Byte Bytef; + +typedef unsigned int uInt; /* 16 bits or more */ +typedef unsigned long uLong; /* 32 bits or more */ + +typedef char charf; +typedef int intf; +typedef uInt uIntf; +typedef uLong uLongf; + +typedef void const *voidpc; +typedef void *voidpf; +typedef void *voidp; + +typedef unsigned int z_crc_t; + +#if 1 /* was set to #if 1 by configure/cmake/etc */ +# define Z_HAVE_UNISTD_H +#endif + +#ifdef NEED_PTRDIFF_T /* may be set to #if 1 by configure/cmake/etc */ +typedef PTRDIFF_TYPE ptrdiff_t; +#endif + +#include /* for off_t */ + +#include /* for wchar_t and NULL */ + +/* a little trick to accommodate both "#define _LARGEFILE64_SOURCE" and + * "#define _LARGEFILE64_SOURCE 1" as requesting 64-bit operations, (even + * though the former does not conform to the LFS document), but considering + * both "#undef _LARGEFILE64_SOURCE" and "#define _LARGEFILE64_SOURCE 0" as + * equivalently requesting no 64-bit operations + */ +#if defined(_LARGEFILE64_SOURCE) && -_LARGEFILE64_SOURCE - -1 == 1 +# undef _LARGEFILE64_SOURCE +#endif + +#if defined(Z_HAVE_UNISTD_H) || defined(_LARGEFILE64_SOURCE) +# include /* for SEEK_*, off_t, and _LFS64_LARGEFILE */ +# ifndef z_off_t +# define z_off_t off_t +# endif +#endif + +#if defined(_LFS64_LARGEFILE) && _LFS64_LARGEFILE-0 +# define Z_LFS64 +#endif + +#if defined(_LARGEFILE64_SOURCE) && defined(Z_LFS64) +# define Z_LARGE64 +#endif + +#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS-0 == 64 && defined(Z_LFS64) +# define Z_WANT64 +#endif + +#if !defined(SEEK_SET) +# define SEEK_SET 0 /* Seek from beginning of file. */ +# define SEEK_CUR 1 /* Seek from current position. */ +# define SEEK_END 2 /* Set file pointer to EOF plus "offset" */ +#endif + +#ifndef z_off_t +# define z_off_t long +#endif + +#if !defined(_WIN32) && defined(Z_LARGE64) +# define z_off64_t off64_t +#else +# if defined(__MSYS__) +# define z_off64_t _off64_t +# elif defined(_WIN32) && !defined(__GNUC__) +# define z_off64_t __int64 +# else +# define z_off64_t z_off_t +# endif +#endif + +typedef size_t z_size_t; + +#endif /* ZCONF_H */ diff --git a/curl/include/zdict.h b/curl/include/zdict.h new file mode 100644 index 0000000..599b793 --- /dev/null +++ b/curl/include/zdict.h @@ -0,0 +1,481 @@ +/* + * Copyright (c) Meta Platforms, Inc. and affiliates. + * All rights reserved. + * + * This source code is licensed under both the BSD-style license (found in the + * LICENSE file in the root directory of this source tree) and the GPLv2 (found + * in the COPYING file in the root directory of this source tree). + * You may select, at your option, one of the above-listed licenses. + */ + +#ifndef ZSTD_ZDICT_H +#define ZSTD_ZDICT_H + + +/*====== Dependencies ======*/ +#include /* size_t */ + +#if defined (__cplusplus) +extern "C" { +#endif + +/* ===== ZDICTLIB_API : control library symbols visibility ===== */ +#ifndef ZDICTLIB_VISIBLE + /* Backwards compatibility with old macro name */ +# ifdef ZDICTLIB_VISIBILITY +# define ZDICTLIB_VISIBLE ZDICTLIB_VISIBILITY +# elif defined(__GNUC__) && (__GNUC__ >= 4) && !defined(__MINGW32__) +# define ZDICTLIB_VISIBLE __attribute__ ((visibility ("default"))) +# else +# define ZDICTLIB_VISIBLE +# endif +#endif + +#ifndef ZDICTLIB_HIDDEN +# if defined(__GNUC__) && (__GNUC__ >= 4) && !defined(__MINGW32__) +# define ZDICTLIB_HIDDEN __attribute__ ((visibility ("hidden"))) +# else +# define ZDICTLIB_HIDDEN +# endif +#endif + +#if defined(ZSTD_DLL_EXPORT) && (ZSTD_DLL_EXPORT==1) +# define ZDICTLIB_API __declspec(dllexport) ZDICTLIB_VISIBLE +#elif defined(ZSTD_DLL_IMPORT) && (ZSTD_DLL_IMPORT==1) +# define ZDICTLIB_API __declspec(dllimport) ZDICTLIB_VISIBLE /* It isn't required but allows to generate better code, saving a function pointer load from the IAT and an indirect jump.*/ +#else +# define ZDICTLIB_API ZDICTLIB_VISIBLE +#endif + +/******************************************************************************* + * Zstd dictionary builder + * + * FAQ + * === + * Why should I use a dictionary? + * ------------------------------ + * + * Zstd can use dictionaries to improve compression ratio of small data. + * Traditionally small files don't compress well because there is very little + * repetition in a single sample, since it is small. But, if you are compressing + * many similar files, like a bunch of JSON records that share the same + * structure, you can train a dictionary on ahead of time on some samples of + * these files. Then, zstd can use the dictionary to find repetitions that are + * present across samples. This can vastly improve compression ratio. + * + * When is a dictionary useful? + * ---------------------------- + * + * Dictionaries are useful when compressing many small files that are similar. + * The larger a file is, the less benefit a dictionary will have. Generally, + * we don't expect dictionary compression to be effective past 100KB. And the + * smaller a file is, the more we would expect the dictionary to help. + * + * How do I use a dictionary? + * -------------------------- + * + * Simply pass the dictionary to the zstd compressor with + * `ZSTD_CCtx_loadDictionary()`. The same dictionary must then be passed to + * the decompressor, using `ZSTD_DCtx_loadDictionary()`. There are other + * more advanced functions that allow selecting some options, see zstd.h for + * complete documentation. + * + * What is a zstd dictionary? + * -------------------------- + * + * A zstd dictionary has two pieces: Its header, and its content. The header + * contains a magic number, the dictionary ID, and entropy tables. These + * entropy tables allow zstd to save on header costs in the compressed file, + * which really matters for small data. The content is just bytes, which are + * repeated content that is common across many samples. + * + * What is a raw content dictionary? + * --------------------------------- + * + * A raw content dictionary is just bytes. It doesn't have a zstd dictionary + * header, a dictionary ID, or entropy tables. Any buffer is a valid raw + * content dictionary. + * + * How do I train a dictionary? + * ---------------------------- + * + * Gather samples from your use case. These samples should be similar to each + * other. If you have several use cases, you could try to train one dictionary + * per use case. + * + * Pass those samples to `ZDICT_trainFromBuffer()` and that will train your + * dictionary. There are a few advanced versions of this function, but this + * is a great starting point. If you want to further tune your dictionary + * you could try `ZDICT_optimizeTrainFromBuffer_cover()`. If that is too slow + * you can try `ZDICT_optimizeTrainFromBuffer_fastCover()`. + * + * If the dictionary training function fails, that is likely because you + * either passed too few samples, or a dictionary would not be effective + * for your data. Look at the messages that the dictionary trainer printed, + * if it doesn't say too few samples, then a dictionary would not be effective. + * + * How large should my dictionary be? + * ---------------------------------- + * + * A reasonable dictionary size, the `dictBufferCapacity`, is about 100KB. + * The zstd CLI defaults to a 110KB dictionary. You likely don't need a + * dictionary larger than that. But, most use cases can get away with a + * smaller dictionary. The advanced dictionary builders can automatically + * shrink the dictionary for you, and select the smallest size that doesn't + * hurt compression ratio too much. See the `shrinkDict` parameter. + * A smaller dictionary can save memory, and potentially speed up + * compression. + * + * How many samples should I provide to the dictionary builder? + * ------------------------------------------------------------ + * + * We generally recommend passing ~100x the size of the dictionary + * in samples. A few thousand should suffice. Having too few samples + * can hurt the dictionaries effectiveness. Having more samples will + * only improve the dictionaries effectiveness. But having too many + * samples can slow down the dictionary builder. + * + * How do I determine if a dictionary will be effective? + * ----------------------------------------------------- + * + * Simply train a dictionary and try it out. You can use zstd's built in + * benchmarking tool to test the dictionary effectiveness. + * + * # Benchmark levels 1-3 without a dictionary + * zstd -b1e3 -r /path/to/my/files + * # Benchmark levels 1-3 with a dictionary + * zstd -b1e3 -r /path/to/my/files -D /path/to/my/dictionary + * + * When should I retrain a dictionary? + * ----------------------------------- + * + * You should retrain a dictionary when its effectiveness drops. Dictionary + * effectiveness drops as the data you are compressing changes. Generally, we do + * expect dictionaries to "decay" over time, as your data changes, but the rate + * at which they decay depends on your use case. Internally, we regularly + * retrain dictionaries, and if the new dictionary performs significantly + * better than the old dictionary, we will ship the new dictionary. + * + * I have a raw content dictionary, how do I turn it into a zstd dictionary? + * ------------------------------------------------------------------------- + * + * If you have a raw content dictionary, e.g. by manually constructing it, or + * using a third-party dictionary builder, you can turn it into a zstd + * dictionary by using `ZDICT_finalizeDictionary()`. You'll also have to + * provide some samples of the data. It will add the zstd header to the + * raw content, which contains a dictionary ID and entropy tables, which + * will improve compression ratio, and allow zstd to write the dictionary ID + * into the frame, if you so choose. + * + * Do I have to use zstd's dictionary builder? + * ------------------------------------------- + * + * No! You can construct dictionary content however you please, it is just + * bytes. It will always be valid as a raw content dictionary. If you want + * a zstd dictionary, which can improve compression ratio, use + * `ZDICT_finalizeDictionary()`. + * + * What is the attack surface of a zstd dictionary? + * ------------------------------------------------ + * + * Zstd is heavily fuzz tested, including loading fuzzed dictionaries, so + * zstd should never crash, or access out-of-bounds memory no matter what + * the dictionary is. However, if an attacker can control the dictionary + * during decompression, they can cause zstd to generate arbitrary bytes, + * just like if they controlled the compressed data. + * + ******************************************************************************/ + + +/*! ZDICT_trainFromBuffer(): + * Train a dictionary from an array of samples. + * Redirect towards ZDICT_optimizeTrainFromBuffer_fastCover() single-threaded, with d=8, steps=4, + * f=20, and accel=1. + * Samples must be stored concatenated in a single flat buffer `samplesBuffer`, + * supplied with an array of sizes `samplesSizes`, providing the size of each sample, in order. + * The resulting dictionary will be saved into `dictBuffer`. + * @return: size of dictionary stored into `dictBuffer` (<= `dictBufferCapacity`) + * or an error code, which can be tested with ZDICT_isError(). + * Note: Dictionary training will fail if there are not enough samples to construct a + * dictionary, or if most of the samples are too small (< 8 bytes being the lower limit). + * If dictionary training fails, you should use zstd without a dictionary, as the dictionary + * would've been ineffective anyways. If you believe your samples would benefit from a dictionary + * please open an issue with details, and we can look into it. + * Note: ZDICT_trainFromBuffer()'s memory usage is about 6 MB. + * Tips: In general, a reasonable dictionary has a size of ~ 100 KB. + * It's possible to select smaller or larger size, just by specifying `dictBufferCapacity`. + * In general, it's recommended to provide a few thousands samples, though this can vary a lot. + * It's recommended that total size of all samples be about ~x100 times the target size of dictionary. + */ +ZDICTLIB_API size_t ZDICT_trainFromBuffer(void* dictBuffer, size_t dictBufferCapacity, + const void* samplesBuffer, + const size_t* samplesSizes, unsigned nbSamples); + +typedef struct { + int compressionLevel; /**< optimize for a specific zstd compression level; 0 means default */ + unsigned notificationLevel; /**< Write log to stderr; 0 = none (default); 1 = errors; 2 = progression; 3 = details; 4 = debug; */ + unsigned dictID; /**< force dictID value; 0 means auto mode (32-bits random value) + * NOTE: The zstd format reserves some dictionary IDs for future use. + * You may use them in private settings, but be warned that they + * may be used by zstd in a public dictionary registry in the future. + * These dictionary IDs are: + * - low range : <= 32767 + * - high range : >= (2^31) + */ +} ZDICT_params_t; + +/*! ZDICT_finalizeDictionary(): + * Given a custom content as a basis for dictionary, and a set of samples, + * finalize dictionary by adding headers and statistics according to the zstd + * dictionary format. + * + * Samples must be stored concatenated in a flat buffer `samplesBuffer`, + * supplied with an array of sizes `samplesSizes`, providing the size of each + * sample in order. The samples are used to construct the statistics, so they + * should be representative of what you will compress with this dictionary. + * + * The compression level can be set in `parameters`. You should pass the + * compression level you expect to use in production. The statistics for each + * compression level differ, so tuning the dictionary for the compression level + * can help quite a bit. + * + * You can set an explicit dictionary ID in `parameters`, or allow us to pick + * a random dictionary ID for you, but we can't guarantee no collisions. + * + * The dstDictBuffer and the dictContent may overlap, and the content will be + * appended to the end of the header. If the header + the content doesn't fit in + * maxDictSize the beginning of the content is truncated to make room, since it + * is presumed that the most profitable content is at the end of the dictionary, + * since that is the cheapest to reference. + * + * `maxDictSize` must be >= max(dictContentSize, ZDICT_DICTSIZE_MIN). + * + * @return: size of dictionary stored into `dstDictBuffer` (<= `maxDictSize`), + * or an error code, which can be tested by ZDICT_isError(). + * Note: ZDICT_finalizeDictionary() will push notifications into stderr if + * instructed to, using notificationLevel>0. + * NOTE: This function currently may fail in several edge cases including: + * * Not enough samples + * * Samples are uncompressible + * * Samples are all exactly the same + */ +ZDICTLIB_API size_t ZDICT_finalizeDictionary(void* dstDictBuffer, size_t maxDictSize, + const void* dictContent, size_t dictContentSize, + const void* samplesBuffer, const size_t* samplesSizes, unsigned nbSamples, + ZDICT_params_t parameters); + + +/*====== Helper functions ======*/ +ZDICTLIB_API unsigned ZDICT_getDictID(const void* dictBuffer, size_t dictSize); /**< extracts dictID; @return zero if error (not a valid dictionary) */ +ZDICTLIB_API size_t ZDICT_getDictHeaderSize(const void* dictBuffer, size_t dictSize); /* returns dict header size; returns a ZSTD error code on failure */ +ZDICTLIB_API unsigned ZDICT_isError(size_t errorCode); +ZDICTLIB_API const char* ZDICT_getErrorName(size_t errorCode); + +#if defined (__cplusplus) +} +#endif + +#endif /* ZSTD_ZDICT_H */ + +#if defined(ZDICT_STATIC_LINKING_ONLY) && !defined(ZSTD_ZDICT_H_STATIC) +#define ZSTD_ZDICT_H_STATIC + +#if defined (__cplusplus) +extern "C" { +#endif + +/* This can be overridden externally to hide static symbols. */ +#ifndef ZDICTLIB_STATIC_API +# if defined(ZSTD_DLL_EXPORT) && (ZSTD_DLL_EXPORT==1) +# define ZDICTLIB_STATIC_API __declspec(dllexport) ZDICTLIB_VISIBLE +# elif defined(ZSTD_DLL_IMPORT) && (ZSTD_DLL_IMPORT==1) +# define ZDICTLIB_STATIC_API __declspec(dllimport) ZDICTLIB_VISIBLE +# else +# define ZDICTLIB_STATIC_API ZDICTLIB_VISIBLE +# endif +#endif + +/* ==================================================================================== + * The definitions in this section are considered experimental. + * They should never be used with a dynamic library, as they may change in the future. + * They are provided for advanced usages. + * Use them only in association with static linking. + * ==================================================================================== */ + +#define ZDICT_DICTSIZE_MIN 256 +/* Deprecated: Remove in v1.6.0 */ +#define ZDICT_CONTENTSIZE_MIN 128 + +/*! ZDICT_cover_params_t: + * k and d are the only required parameters. + * For others, value 0 means default. + */ +typedef struct { + unsigned k; /* Segment size : constraint: 0 < k : Reasonable range [16, 2048+] */ + unsigned d; /* dmer size : constraint: 0 < d <= k : Reasonable range [6, 16] */ + unsigned steps; /* Number of steps : Only used for optimization : 0 means default (40) : Higher means more parameters checked */ + unsigned nbThreads; /* Number of threads : constraint: 0 < nbThreads : 1 means single-threaded : Only used for optimization : Ignored if ZSTD_MULTITHREAD is not defined */ + double splitPoint; /* Percentage of samples used for training: Only used for optimization : the first nbSamples * splitPoint samples will be used to training, the last nbSamples * (1 - splitPoint) samples will be used for testing, 0 means default (1.0), 1.0 when all samples are used for both training and testing */ + unsigned shrinkDict; /* Train dictionaries to shrink in size starting from the minimum size and selects the smallest dictionary that is shrinkDictMaxRegression% worse than the largest dictionary. 0 means no shrinking and 1 means shrinking */ + unsigned shrinkDictMaxRegression; /* Sets shrinkDictMaxRegression so that a smaller dictionary can be at worse shrinkDictMaxRegression% worse than the max dict size dictionary. */ + ZDICT_params_t zParams; +} ZDICT_cover_params_t; + +typedef struct { + unsigned k; /* Segment size : constraint: 0 < k : Reasonable range [16, 2048+] */ + unsigned d; /* dmer size : constraint: 0 < d <= k : Reasonable range [6, 16] */ + unsigned f; /* log of size of frequency array : constraint: 0 < f <= 31 : 1 means default(20)*/ + unsigned steps; /* Number of steps : Only used for optimization : 0 means default (40) : Higher means more parameters checked */ + unsigned nbThreads; /* Number of threads : constraint: 0 < nbThreads : 1 means single-threaded : Only used for optimization : Ignored if ZSTD_MULTITHREAD is not defined */ + double splitPoint; /* Percentage of samples used for training: Only used for optimization : the first nbSamples * splitPoint samples will be used to training, the last nbSamples * (1 - splitPoint) samples will be used for testing, 0 means default (0.75), 1.0 when all samples are used for both training and testing */ + unsigned accel; /* Acceleration level: constraint: 0 < accel <= 10, higher means faster and less accurate, 0 means default(1) */ + unsigned shrinkDict; /* Train dictionaries to shrink in size starting from the minimum size and selects the smallest dictionary that is shrinkDictMaxRegression% worse than the largest dictionary. 0 means no shrinking and 1 means shrinking */ + unsigned shrinkDictMaxRegression; /* Sets shrinkDictMaxRegression so that a smaller dictionary can be at worse shrinkDictMaxRegression% worse than the max dict size dictionary. */ + + ZDICT_params_t zParams; +} ZDICT_fastCover_params_t; + +/*! ZDICT_trainFromBuffer_cover(): + * Train a dictionary from an array of samples using the COVER algorithm. + * Samples must be stored concatenated in a single flat buffer `samplesBuffer`, + * supplied with an array of sizes `samplesSizes`, providing the size of each sample, in order. + * The resulting dictionary will be saved into `dictBuffer`. + * @return: size of dictionary stored into `dictBuffer` (<= `dictBufferCapacity`) + * or an error code, which can be tested with ZDICT_isError(). + * See ZDICT_trainFromBuffer() for details on failure modes. + * Note: ZDICT_trainFromBuffer_cover() requires about 9 bytes of memory for each input byte. + * Tips: In general, a reasonable dictionary has a size of ~ 100 KB. + * It's possible to select smaller or larger size, just by specifying `dictBufferCapacity`. + * In general, it's recommended to provide a few thousands samples, though this can vary a lot. + * It's recommended that total size of all samples be about ~x100 times the target size of dictionary. + */ +ZDICTLIB_STATIC_API size_t ZDICT_trainFromBuffer_cover( + void *dictBuffer, size_t dictBufferCapacity, + const void *samplesBuffer, const size_t *samplesSizes, unsigned nbSamples, + ZDICT_cover_params_t parameters); + +/*! ZDICT_optimizeTrainFromBuffer_cover(): + * The same requirements as above hold for all the parameters except `parameters`. + * This function tries many parameter combinations and picks the best parameters. + * `*parameters` is filled with the best parameters found, + * dictionary constructed with those parameters is stored in `dictBuffer`. + * + * All of the parameters d, k, steps are optional. + * If d is non-zero then we don't check multiple values of d, otherwise we check d = {6, 8}. + * if steps is zero it defaults to its default value. + * If k is non-zero then we don't check multiple values of k, otherwise we check steps values in [50, 2000]. + * + * @return: size of dictionary stored into `dictBuffer` (<= `dictBufferCapacity`) + * or an error code, which can be tested with ZDICT_isError(). + * On success `*parameters` contains the parameters selected. + * See ZDICT_trainFromBuffer() for details on failure modes. + * Note: ZDICT_optimizeTrainFromBuffer_cover() requires about 8 bytes of memory for each input byte and additionally another 5 bytes of memory for each byte of memory for each thread. + */ +ZDICTLIB_STATIC_API size_t ZDICT_optimizeTrainFromBuffer_cover( + void* dictBuffer, size_t dictBufferCapacity, + const void* samplesBuffer, const size_t* samplesSizes, unsigned nbSamples, + ZDICT_cover_params_t* parameters); + +/*! ZDICT_trainFromBuffer_fastCover(): + * Train a dictionary from an array of samples using a modified version of COVER algorithm. + * Samples must be stored concatenated in a single flat buffer `samplesBuffer`, + * supplied with an array of sizes `samplesSizes`, providing the size of each sample, in order. + * d and k are required. + * All other parameters are optional, will use default values if not provided + * The resulting dictionary will be saved into `dictBuffer`. + * @return: size of dictionary stored into `dictBuffer` (<= `dictBufferCapacity`) + * or an error code, which can be tested with ZDICT_isError(). + * See ZDICT_trainFromBuffer() for details on failure modes. + * Note: ZDICT_trainFromBuffer_fastCover() requires 6 * 2^f bytes of memory. + * Tips: In general, a reasonable dictionary has a size of ~ 100 KB. + * It's possible to select smaller or larger size, just by specifying `dictBufferCapacity`. + * In general, it's recommended to provide a few thousands samples, though this can vary a lot. + * It's recommended that total size of all samples be about ~x100 times the target size of dictionary. + */ +ZDICTLIB_STATIC_API size_t ZDICT_trainFromBuffer_fastCover(void *dictBuffer, + size_t dictBufferCapacity, const void *samplesBuffer, + const size_t *samplesSizes, unsigned nbSamples, + ZDICT_fastCover_params_t parameters); + +/*! ZDICT_optimizeTrainFromBuffer_fastCover(): + * The same requirements as above hold for all the parameters except `parameters`. + * This function tries many parameter combinations (specifically, k and d combinations) + * and picks the best parameters. `*parameters` is filled with the best parameters found, + * dictionary constructed with those parameters is stored in `dictBuffer`. + * All of the parameters d, k, steps, f, and accel are optional. + * If d is non-zero then we don't check multiple values of d, otherwise we check d = {6, 8}. + * if steps is zero it defaults to its default value. + * If k is non-zero then we don't check multiple values of k, otherwise we check steps values in [50, 2000]. + * If f is zero, default value of 20 is used. + * If accel is zero, default value of 1 is used. + * + * @return: size of dictionary stored into `dictBuffer` (<= `dictBufferCapacity`) + * or an error code, which can be tested with ZDICT_isError(). + * On success `*parameters` contains the parameters selected. + * See ZDICT_trainFromBuffer() for details on failure modes. + * Note: ZDICT_optimizeTrainFromBuffer_fastCover() requires about 6 * 2^f bytes of memory for each thread. + */ +ZDICTLIB_STATIC_API size_t ZDICT_optimizeTrainFromBuffer_fastCover(void* dictBuffer, + size_t dictBufferCapacity, const void* samplesBuffer, + const size_t* samplesSizes, unsigned nbSamples, + ZDICT_fastCover_params_t* parameters); + +typedef struct { + unsigned selectivityLevel; /* 0 means default; larger => select more => larger dictionary */ + ZDICT_params_t zParams; +} ZDICT_legacy_params_t; + +/*! ZDICT_trainFromBuffer_legacy(): + * Train a dictionary from an array of samples. + * Samples must be stored concatenated in a single flat buffer `samplesBuffer`, + * supplied with an array of sizes `samplesSizes`, providing the size of each sample, in order. + * The resulting dictionary will be saved into `dictBuffer`. + * `parameters` is optional and can be provided with values set to 0 to mean "default". + * @return: size of dictionary stored into `dictBuffer` (<= `dictBufferCapacity`) + * or an error code, which can be tested with ZDICT_isError(). + * See ZDICT_trainFromBuffer() for details on failure modes. + * Tips: In general, a reasonable dictionary has a size of ~ 100 KB. + * It's possible to select smaller or larger size, just by specifying `dictBufferCapacity`. + * In general, it's recommended to provide a few thousands samples, though this can vary a lot. + * It's recommended that total size of all samples be about ~x100 times the target size of dictionary. + * Note: ZDICT_trainFromBuffer_legacy() will send notifications into stderr if instructed to, using notificationLevel>0. + */ +ZDICTLIB_STATIC_API size_t ZDICT_trainFromBuffer_legacy( + void* dictBuffer, size_t dictBufferCapacity, + const void* samplesBuffer, const size_t* samplesSizes, unsigned nbSamples, + ZDICT_legacy_params_t parameters); + + +/* Deprecation warnings */ +/* It is generally possible to disable deprecation warnings from compiler, + for example with -Wno-deprecated-declarations for gcc + or _CRT_SECURE_NO_WARNINGS in Visual. + Otherwise, it's also possible to manually define ZDICT_DISABLE_DEPRECATE_WARNINGS */ +#ifdef ZDICT_DISABLE_DEPRECATE_WARNINGS +# define ZDICT_DEPRECATED(message) /* disable deprecation warnings */ +#else +# define ZDICT_GCC_VERSION (__GNUC__ * 100 + __GNUC_MINOR__) +# if defined (__cplusplus) && (__cplusplus >= 201402) /* C++14 or greater */ +# define ZDICT_DEPRECATED(message) [[deprecated(message)]] +# elif defined(__clang__) || (ZDICT_GCC_VERSION >= 405) +# define ZDICT_DEPRECATED(message) __attribute__((deprecated(message))) +# elif (ZDICT_GCC_VERSION >= 301) +# define ZDICT_DEPRECATED(message) __attribute__((deprecated)) +# elif defined(_MSC_VER) +# define ZDICT_DEPRECATED(message) __declspec(deprecated(message)) +# else +# pragma message("WARNING: You need to implement ZDICT_DEPRECATED for this compiler") +# define ZDICT_DEPRECATED(message) +# endif +#endif /* ZDICT_DISABLE_DEPRECATE_WARNINGS */ + +ZDICT_DEPRECATED("use ZDICT_finalizeDictionary() instead") +ZDICTLIB_STATIC_API +size_t ZDICT_addEntropyTablesFromBuffer(void* dictBuffer, size_t dictContentSize, size_t dictBufferCapacity, + const void* samplesBuffer, const size_t* samplesSizes, unsigned nbSamples); + +#if defined (__cplusplus) +} +#endif + +#endif /* ZSTD_ZDICT_H_STATIC */ diff --git a/curl/include/zlib.h b/curl/include/zlib.h new file mode 100644 index 0000000..d784951 --- /dev/null +++ b/curl/include/zlib.h @@ -0,0 +1,1859 @@ +#ifndef ZLIB_H_ +#define ZLIB_H_ +/* zlib.h -- interface of the 'zlib-ng' compression library + Forked from and compatible with zlib 1.3.1 + + Copyright (C) 1995-2024 Jean-loup Gailly and Mark Adler + + This software is provided 'as-is', without any express or implied + warranty. In no event will the authors be held liable for any damages + arising from the use of this software. + + Permission is granted to anyone to use this software for any purpose, + including commercial applications, and to alter it and redistribute it + freely, subject to the following restrictions: + + 1. The origin of this software must not be misrepresented; you must not + claim that you wrote the original software. If you use this software + in a product, an acknowledgment in the product documentation would be + appreciated but is not required. + 2. Altered source versions must be plainly marked as such, and must not be + misrepresented as being the original software. + 3. This notice may not be removed or altered from any source distribution. + + Jean-loup Gailly Mark Adler + jloup@gzip.org madler@alumni.caltech.edu + + + The data format used by the zlib library is described by RFCs (Request for + Comments) 1950 to 1952 in the files https://tools.ietf.org/html/rfc1950 + (zlib format), rfc1951 (deflate format) and rfc1952 (gzip format). +*/ + +#ifdef ZNGLIB_H_ +# error Include zlib-ng.h for zlib-ng API or zlib.h for zlib-compat API but not both +#endif + +#ifndef RC_INVOKED +#include +#include + +#include "zconf.h" + +#ifndef ZCONF_H +# error Missing zconf.h add binary output directory to include directories +#endif +#endif /* RC_INVOKED */ + +#ifdef __cplusplus +extern "C" { +#endif + +#define ZLIBNG_VERSION "2.2.4" +#define ZLIBNG_VERNUM 0x020204F0L /* MMNNRRSM: major minor revision status modified */ +#define ZLIBNG_VER_MAJOR 2 +#define ZLIBNG_VER_MINOR 2 +#define ZLIBNG_VER_REVISION 4 +#define ZLIBNG_VER_STATUS F /* 0=devel, 1-E=beta, F=Release (DEPRECATED) */ +#define ZLIBNG_VER_STATUSH 0xF /* Hex values: 0=devel, 1-E=beta, F=Release */ +#define ZLIBNG_VER_MODIFIED 0 /* non-zero if modified externally from zlib-ng */ + +#define ZLIB_VERSION "1.3.1.zlib-ng" +#define ZLIB_VERNUM 0x131f +#define ZLIB_VER_MAJOR 1 +#define ZLIB_VER_MINOR 3 +#define ZLIB_VER_REVISION 1 +#define ZLIB_VER_SUBREVISION 15 /* 15=fork (0xf) */ + +/* + The 'zlib' compression library provides in-memory compression and + decompression functions, including integrity checks of the uncompressed data. + This version of the library supports only one compression method (deflation) + but other algorithms will be added later and will have the same stream + interface. + + Compression can be done in a single step if the buffers are large enough, + or can be done by repeated calls of the compression function. In the latter + case, the application must provide more input and/or consume the output + (providing more output space) before each call. + + The compressed data format used by default by the in-memory functions is + the zlib format, which is a zlib wrapper documented in RFC 1950, wrapped + around a deflate stream, which is itself documented in RFC 1951. + + The library also supports reading and writing files in gzip (.gz) format + with an interface similar to that of stdio using the functions that start + with "gz". The gzip format is different from the zlib format. gzip is a + gzip wrapper, documented in RFC 1952, wrapped around a deflate stream. + + This library can optionally read and write gzip and raw deflate streams in + memory as well. + + The zlib format was designed to be compact and fast for use in memory + and on communications channels. The gzip format was designed for single- + file compression on file systems, has a larger header than zlib to maintain + directory information, and uses a different, slower check method than zlib. + + The library does not install any signal handler. The decoder checks + the consistency of the compressed data, so the library should never crash + even in the case of corrupted input. +*/ + +typedef void *(*alloc_func) (void *opaque, unsigned int items, unsigned int size); +typedef void (*free_func) (void *opaque, void *address); + +struct internal_state; + +typedef struct z_stream_s { + z_const unsigned char *next_in; /* next input byte */ + uint32_t avail_in; /* number of bytes available at next_in */ + unsigned long total_in; /* total number of input bytes read so far */ + + unsigned char *next_out; /* next output byte will go here */ + uint32_t avail_out; /* remaining free space at next_out */ + unsigned long total_out; /* total number of bytes output so far */ + + z_const char *msg; /* last error message, NULL if no error */ + struct internal_state *state; /* not visible by applications */ + + alloc_func zalloc; /* used to allocate the internal state */ + free_func zfree; /* used to free the internal state */ + void *opaque; /* private data object passed to zalloc and zfree */ + + int data_type; /* best guess about the data type: binary or text + for deflate, or the decoding state for inflate */ + unsigned long adler; /* Adler-32 or CRC-32 value of the uncompressed data */ + unsigned long reserved; /* reserved for future use */ +} z_stream; + +typedef z_stream *z_streamp; /* Obsolete type, retained for compatibility only */ + +/* + gzip header information passed to and from zlib routines. See RFC 1952 + for more details on the meanings of these fields. +*/ +typedef struct gz_header_s { + int text; /* true if compressed data believed to be text */ + unsigned long time; /* modification time */ + int xflags; /* extra flags (not used when writing a gzip file) */ + int os; /* operating system */ + unsigned char *extra; /* pointer to extra field or NULL if none */ + unsigned int extra_len; /* extra field length (valid if extra != NULL) */ + unsigned int extra_max; /* space at extra (only when reading header) */ + unsigned char *name; /* pointer to zero-terminated file name or NULL */ + unsigned int name_max; /* space at name (only when reading header) */ + unsigned char *comment; /* pointer to zero-terminated comment or NULL */ + unsigned int comm_max; /* space at comment (only when reading header) */ + int hcrc; /* true if there was or will be a header crc */ + int done; /* true when done reading gzip header (not used when writing a gzip file) */ +} gz_header; + +typedef gz_header *gz_headerp; + +/* + The application must update next_in and avail_in when avail_in has dropped + to zero. It must update next_out and avail_out when avail_out has dropped + to zero. The application must initialize zalloc, zfree and opaque before + calling the init function. All other fields are set by the compression + library and must not be updated by the application. + + The opaque value provided by the application will be passed as the first + parameter for calls of zalloc and zfree. This can be useful for custom + memory management. The compression library attaches no meaning to the + opaque value. + + zalloc must return NULL if there is not enough memory for the object. + If zlib is used in a multi-threaded application, zalloc and zfree must be + thread safe. In that case, zlib is thread-safe. When zalloc and zfree are + Z_NULL on entry to the initialization function, they are set to internal + routines that use the standard library functions malloc() and free(). + + The fields total_in and total_out can be used for statistics or progress + reports. After compression, total_in holds the total size of the + uncompressed data and may be saved for use by the decompressor (particularly + if the decompressor wants to decompress everything in a single step). +*/ + + /* constants */ + +#define Z_NO_FLUSH 0 +#define Z_PARTIAL_FLUSH 1 +#define Z_SYNC_FLUSH 2 +#define Z_FULL_FLUSH 3 +#define Z_FINISH 4 +#define Z_BLOCK 5 +#define Z_TREES 6 +/* Allowed flush values; see deflate() and inflate() below for details */ + +#define Z_OK 0 +#define Z_STREAM_END 1 +#define Z_NEED_DICT 2 +#define Z_ERRNO (-1) +#define Z_STREAM_ERROR (-2) +#define Z_DATA_ERROR (-3) +#define Z_MEM_ERROR (-4) +#define Z_BUF_ERROR (-5) +#define Z_VERSION_ERROR (-6) +/* Return codes for the compression/decompression functions. Negative values + * are errors, positive values are used for special but normal events. + */ + +#define Z_NO_COMPRESSION 0 +#define Z_BEST_SPEED 1 +#define Z_BEST_COMPRESSION 9 +#define Z_DEFAULT_COMPRESSION (-1) +/* compression levels */ + +#define Z_FILTERED 1 +#define Z_HUFFMAN_ONLY 2 +#define Z_RLE 3 +#define Z_FIXED 4 +#define Z_DEFAULT_STRATEGY 0 +/* compression strategy; see deflateInit2() below for details */ + +#define Z_BINARY 0 +#define Z_TEXT 1 +#define Z_ASCII Z_TEXT /* for compatibility with 1.2.2 and earlier */ +#define Z_UNKNOWN 2 +/* Possible values of the data_type field for deflate() */ + +#define Z_DEFLATED 8 +/* The deflate compression method (the only one supported in this version) */ + +#define Z_NULL 0 /* for compatibility with zlib, was for initializing zalloc, zfree, opaque */ + +#define zlib_version zlibVersion() +/* for compatibility with versions < 1.0.2 */ + + + /* basic functions */ + +Z_EXTERN const char * Z_EXPORT zlibVersion(void); +/* The application can compare zlibVersion and ZLIB_VERSION for consistency. + If the first character differs, the library code actually used is not + compatible with the zlib.h header file used by the application. This check + is automatically made by deflateInit and inflateInit. + */ + +/* +Z_EXTERN int Z_EXPORT deflateInit (z_stream *strm, int level); + + Initializes the internal stream state for compression. The fields + zalloc, zfree and opaque must be initialized before by the caller. If + zalloc and zfree are set to Z_NULL, deflateInit updates them to use default + allocation functions. total_in, total_out, adler, and msg are initialized. + + The compression level must be Z_DEFAULT_COMPRESSION, or between 0 and 9: + 1 gives best speed, 9 gives best compression, 0 gives no compression at all + (the input data is simply copied a block at a time). Z_DEFAULT_COMPRESSION + requests a default compromise between speed and compression (currently + equivalent to level 6). + + deflateInit returns Z_OK if success, Z_MEM_ERROR if there was not enough + memory, Z_STREAM_ERROR if level is not a valid compression level, or + Z_VERSION_ERROR if the zlib library version (zlib_version) is incompatible + with the version assumed by the caller (ZLIB_VERSION). msg is set to null + if there is no error message. deflateInit does not perform any compression: + this will be done by deflate(). +*/ + + +Z_EXTERN int Z_EXPORT deflate(z_stream *strm, int flush); +/* + deflate compresses as much data as possible, and stops when the input + buffer becomes empty or the output buffer becomes full. It may introduce + some output latency (reading input without producing any output) except when + forced to flush. + + The detailed semantics are as follows. deflate performs one or both of the + following actions: + + - Compress more input starting at next_in and update next_in and avail_in + accordingly. If not all input can be processed (because there is not + enough room in the output buffer), next_in and avail_in are updated and + processing will resume at this point for the next call of deflate(). + + - Generate more output starting at next_out and update next_out and avail_out + accordingly. This action is forced if the parameter flush is non zero. + Forcing flush frequently degrades the compression ratio, so this parameter + should be set only when necessary. Some output may be provided even if + flush is zero. + + Before the call of deflate(), the application should ensure that at least + one of the actions is possible, by providing more input and/or consuming more + output, and updating avail_in or avail_out accordingly; avail_out should + never be zero before the call. The application can consume the compressed + output when it wants, for example when the output buffer is full (avail_out + == 0), or after each call of deflate(). If deflate returns Z_OK and with + zero avail_out, it must be called again after making room in the output + buffer because there might be more output pending. See deflatePending(), + which can be used if desired to determine whether or not there is more output + in that case. + + Normally the parameter flush is set to Z_NO_FLUSH, which allows deflate to + decide how much data to accumulate before producing output, in order to + maximize compression. + + If the parameter flush is set to Z_SYNC_FLUSH, all pending output is + flushed to the output buffer and the output is aligned on a byte boundary, so + that the decompressor can get all input data available so far. (In + particular avail_in is zero after the call if enough output space has been + provided before the call.) Flushing may degrade compression for some + compression algorithms and so it should be used only when necessary. This + completes the current deflate block and follows it with an empty stored block + that is three bits plus filler bits to the next byte, followed by four bytes + (00 00 ff ff). + + If flush is set to Z_PARTIAL_FLUSH, all pending output is flushed to the + output buffer, but the output is not aligned to a byte boundary. All of the + input data so far will be available to the decompressor, as for Z_SYNC_FLUSH. + This completes the current deflate block and follows it with an empty fixed + codes block that is 10 bits long. This assures that enough bytes are output + in order for the decompressor to finish the block before the empty fixed + codes block. + + If flush is set to Z_BLOCK, a deflate block is completed and emitted, as + for Z_SYNC_FLUSH, but the output is not aligned on a byte boundary, and up to + seven bits of the current block are held to be written as the next byte after + the next deflate block is completed. In this case, the decompressor may not + be provided enough bits at this point in order to complete decompression of + the data provided so far to the compressor. It may need to wait for the next + block to be emitted. This is for advanced applications that need to control + the emission of deflate blocks. + + If flush is set to Z_FULL_FLUSH, all output is flushed as with + Z_SYNC_FLUSH, and the compression state is reset so that decompression can + restart from this point if previous compressed data has been damaged or if + random access is desired. Using Z_FULL_FLUSH too often can seriously degrade + compression. + + If deflate returns with avail_out == 0, this function must be called again + with the same value of the flush parameter and more output space (updated + avail_out), until the flush is complete (deflate returns with non-zero + avail_out). In the case of a Z_FULL_FLUSH or Z_SYNC_FLUSH, make sure that + avail_out is greater than six when the flush marker begins, in order to avoid + repeated flush markers upon calling deflate() again when avail_out == 0. + + If the parameter flush is set to Z_FINISH, pending input is processed, + pending output is flushed and deflate returns with Z_STREAM_END if there was + enough output space. If deflate returns with Z_OK or Z_BUF_ERROR, this + function must be called again with Z_FINISH and more output space (updated + avail_out) but no more input data, until it returns with Z_STREAM_END or an + error. After deflate has returned Z_STREAM_END, the only possible operations + on the stream are deflateReset or deflateEnd. + + Z_FINISH can be used in the first deflate call after deflateInit if all the + compression is to be done in a single step. In order to complete in one + call, avail_out must be at least the value returned by deflateBound (see + below). Then deflate is guaranteed to return Z_STREAM_END. If not enough + output space is provided, deflate will not return Z_STREAM_END, and it must + be called again as described above. + + deflate() sets strm->adler to the Adler-32 checksum of all input read + so far (that is, total_in bytes). If a gzip stream is being generated, then + strm->adler will be the CRC-32 checksum of the input read so far. (See + deflateInit2 below.) + + deflate() may update strm->data_type if it can make a good guess about + the input data type (Z_BINARY or Z_TEXT). If in doubt, the data is + considered binary. This field is only for information purposes and does not + affect the compression algorithm in any manner. + + deflate() returns Z_OK if some progress has been made (more input + processed or more output produced), Z_STREAM_END if all input has been + consumed and all output has been produced (only when flush is set to + Z_FINISH), Z_STREAM_ERROR if the stream state was inconsistent (for example + if next_in or next_out was NULL) or the state was inadvertently written over + by the application), or Z_BUF_ERROR if no progress is possible (for example + avail_in or avail_out was zero). Note that Z_BUF_ERROR is not fatal, and + deflate() can be called again with more input and more output space to + continue compressing. +*/ + + +Z_EXTERN int Z_EXPORT deflateEnd(z_stream *strm); +/* + All dynamically allocated data structures for this stream are freed. + This function discards any unprocessed input and does not flush any pending + output. + + deflateEnd returns Z_OK if success, Z_STREAM_ERROR if the + stream state was inconsistent, Z_DATA_ERROR if the stream was freed + prematurely (some input or output was discarded). In the error case, msg + may be set but then points to a static string (which must not be + deallocated). +*/ + + +/* +Z_EXTERN int Z_EXPORT inflateInit (z_stream *strm); + + Initializes the internal stream state for decompression. The fields + next_in, avail_in, zalloc, zfree and opaque must be initialized before by + the caller. In the current version of inflate, the provided input is not + read or consumed. The allocation of a sliding window will be deferred to + the first call of inflate (if the decompression does not complete on the + first call). If zalloc and zfree are set to Z_NULL, inflateInit updates + them to use default allocation functions. total_in, total_out, adler, and + msg are initialized. + + inflateInit returns Z_OK if success, Z_MEM_ERROR if there was not enough + memory, Z_VERSION_ERROR if the zlib library version is incompatible with the + version assumed by the caller, or Z_STREAM_ERROR if the parameters are + invalid, such as a null pointer to the structure. msg is set to null if + there is no error message. inflateInit does not perform any decompression. + Actual decompression will be done by inflate(). So next_in, and avail_in, + next_out, and avail_out are unused and unchanged. The current + implementation of inflateInit() does not process any header information -- + that is deferred until inflate() is called. +*/ + + +Z_EXTERN int Z_EXPORT inflate(z_stream *strm, int flush); +/* + inflate decompresses as much data as possible, and stops when the input + buffer becomes empty or the output buffer becomes full. It may introduce + some output latency (reading input without producing any output) except when + forced to flush. + + The detailed semantics are as follows. inflate performs one or both of the + following actions: + + - Decompress more input starting at next_in and update next_in and avail_in + accordingly. If not all input can be processed (because there is not + enough room in the output buffer), then next_in and avail_in are updated + accordingly, and processing will resume at this point for the next call of + inflate(). + + - Generate more output starting at next_out and update next_out and avail_out + accordingly. inflate() provides as much output as possible, until there is + no more input data or no more space in the output buffer (see below about + the flush parameter). + + Before the call of inflate(), the application should ensure that at least + one of the actions is possible, by providing more input and/or consuming more + output, and updating the next_* and avail_* values accordingly. If the + caller of inflate() does not provide both available input and available + output space, it is possible that there will be no progress made. The + application can consume the uncompressed output when it wants, for example + when the output buffer is full (avail_out == 0), or after each call of + inflate(). If inflate returns Z_OK and with zero avail_out, it must be + called again after making room in the output buffer because there might be + more output pending. + + The flush parameter of inflate() can be Z_NO_FLUSH, Z_SYNC_FLUSH, Z_FINISH, + Z_BLOCK, or Z_TREES. Z_SYNC_FLUSH requests that inflate() flush as much + output as possible to the output buffer. Z_BLOCK requests that inflate() + stop if and when it gets to the next deflate block boundary. When decoding + the zlib or gzip format, this will cause inflate() to return immediately + after the header and before the first block. When doing a raw inflate, + inflate() will go ahead and process the first block, and will return when it + gets to the end of that block, or when it runs out of data. + + The Z_BLOCK option assists in appending to or combining deflate streams. + To assist in this, on return inflate() always sets strm->data_type to the + number of unused bits in the last byte taken from strm->next_in, plus 64 if + inflate() is currently decoding the last block in the deflate stream, plus + 128 if inflate() returned immediately after decoding an end-of-block code or + decoding the complete header up to just before the first byte of the deflate + stream. The end-of-block will not be indicated until all of the uncompressed + data from that block has been written to strm->next_out. The number of + unused bits may in general be greater than seven, except when bit 7 of + data_type is set, in which case the number of unused bits will be less than + eight. data_type is set as noted here every time inflate() returns for all + flush options, and so can be used to determine the amount of currently + consumed input in bits. + + The Z_TREES option behaves as Z_BLOCK does, but it also returns when the + end of each deflate block header is reached, before any actual data in that + block is decoded. This allows the caller to determine the length of the + deflate block header for later use in random access within a deflate block. + 256 is added to the value of strm->data_type when inflate() returns + immediately after reaching the end of the deflate block header. + + inflate() should normally be called until it returns Z_STREAM_END or an + error. However if all decompression is to be performed in a single step (a + single call of inflate), the parameter flush should be set to Z_FINISH. In + this case all pending input is processed and all pending output is flushed; + avail_out must be large enough to hold all of the uncompressed data for the + operation to complete. (The size of the uncompressed data may have been + saved by the compressor for this purpose.) The use of Z_FINISH is not + required to perform an inflation in one step. However it may be used to + inform inflate that a faster approach can be used for the single inflate() + call. Z_FINISH also informs inflate to not maintain a sliding window if the + stream completes, which reduces inflate's memory footprint. If the stream + does not complete, either because not all of the stream is provided or not + enough output space is provided, then a sliding window will be allocated and + inflate() can be called again to continue the operation as if Z_NO_FLUSH had + been used. + + In this implementation, inflate() always flushes as much output as + possible to the output buffer, and always uses the faster approach on the + first call. So the effects of the flush parameter in this implementation are + on the return value of inflate() as noted below, when inflate() returns early + when Z_BLOCK or Z_TREES is used, and when inflate() avoids the allocation of + memory for a sliding window when Z_FINISH is used. + + If a preset dictionary is needed after this call (see inflateSetDictionary + below), inflate sets strm->adler to the Adler-32 checksum of the dictionary + chosen by the compressor and returns Z_NEED_DICT; otherwise it sets + strm->adler to the Adler-32 checksum of all output produced so far (that is, + total_out bytes) and returns Z_OK, Z_STREAM_END or an error code as described + below. At the end of the stream, inflate() checks that its computed Adler-32 + checksum is equal to that saved by the compressor and returns Z_STREAM_END + only if the checksum is correct. + + inflate() can decompress and check either zlib-wrapped or gzip-wrapped + deflate data. The header type is detected automatically, if requested when + initializing with inflateInit2(). Any information contained in the gzip + header is not retained unless inflateGetHeader() is used. When processing + gzip-wrapped deflate data, strm->adler32 is set to the CRC-32 of the output + produced so far. The CRC-32 is checked against the gzip trailer, as is the + uncompressed length, modulo 2^32. + + inflate() returns Z_OK if some progress has been made (more input processed + or more output produced), Z_STREAM_END if the end of the compressed data has + been reached and all uncompressed output has been produced, Z_NEED_DICT if a + preset dictionary is needed at this point, Z_DATA_ERROR if the input data was + corrupted (input stream not conforming to the zlib format or incorrect check + value, in which case strm->msg points to a string with a more specific + error), Z_STREAM_ERROR if the stream structure was inconsistent (for example + next_in or next_out was NULL, or the state was inadvertently written over + by the application), Z_MEM_ERROR if there was not enough memory, Z_BUF_ERROR + if no progress is possible or if there was not enough room in the output + buffer when Z_FINISH is used. Note that Z_BUF_ERROR is not fatal, and + inflate() can be called again with more input and more output space to + continue decompressing. If Z_DATA_ERROR is returned, the application may + then call inflateSync() to look for a good compression block if a partial + recovery of the data is to be attempted. +*/ + + +Z_EXTERN int Z_EXPORT inflateEnd(z_stream *strm); +/* + All dynamically allocated data structures for this stream are freed. + This function discards any unprocessed input and does not flush any pending + output. + + inflateEnd returns Z_OK if success, or Z_STREAM_ERROR if the stream state + was inconsistent. +*/ + + + /* Advanced functions */ + +/* + The following functions are needed only in some special applications. +*/ + +/* +Z_EXTERN int Z_EXPORT deflateInit2 (z_stream *strm, + int level, + int method, + int windowBits, + int memLevel, + int strategy); + + This is another version of deflateInit with more compression options. The + fields zalloc, zfree and opaque must be initialized before by the caller. + + The method parameter is the compression method. It must be Z_DEFLATED in + this version of the library. + + The windowBits parameter is the base two logarithm of the window size + (the size of the history buffer). It should be in the range 8..15 for this + version of the library. Larger values of this parameter result in better + compression at the expense of memory usage. The default value is 15 if + deflateInit is used instead. + + For the current implementation of deflate(), a windowBits value of 8 (a + window size of 256 bytes) is not supported. As a result, a request for 8 + will result in 9 (a 512-byte window). In that case, providing 8 to + inflateInit2() will result in an error when the zlib header with 9 is + checked against the initialization of inflate(). The remedy is to not use 8 + with deflateInit2() with this initialization, or at least in that case use 9 + with inflateInit2(). + + windowBits can also be -8..-15 for raw deflate. In this case, -windowBits + determines the window size. deflate() will then generate raw deflate data + with no zlib header or trailer, and will not compute a check value. + + windowBits can also be greater than 15 for optional gzip encoding. Add + 16 to windowBits to write a simple gzip header and trailer around the + compressed data instead of a zlib wrapper. The gzip header will have no + file name, no extra data, no comment, no modification time (set to zero), no + header crc, and the operating system will be set to the appropriate value, + if the operating system was determined at compile time. If a gzip stream is + being written, strm->adler is a CRC-32 instead of an Adler-32. + + For raw deflate or gzip encoding, a request for a 256-byte window is + rejected as invalid, since only the zlib header provides a means of + transmitting the window size to the decompressor. + + The memLevel parameter specifies how much memory should be allocated + for the internal compression state. memLevel=1 uses minimum memory but is + slow and reduces compression ratio; memLevel=9 uses maximum memory for + optimal speed. The default value is 8. See zconf.h for total memory usage + as a function of windowBits and memLevel. + + The strategy parameter is used to tune the compression algorithm. Use the + value Z_DEFAULT_STRATEGY for normal data, Z_FILTERED for data produced by a + filter (or predictor), Z_HUFFMAN_ONLY to force Huffman encoding only (no + string match), or Z_RLE to limit match distances to one (run-length + encoding). Filtered data consists mostly of small values with a somewhat + random distribution. In this case, the compression algorithm is tuned to + compress them better. The effect of Z_FILTERED is to force more Huffman + coding and less string matching; it is somewhat intermediate between + Z_DEFAULT_STRATEGY and Z_HUFFMAN_ONLY. Z_RLE is designed to be almost as + fast as Z_HUFFMAN_ONLY, but give better compression for PNG image data. The + strategy parameter only affects the compression ratio but not the + correctness of the compressed output even if it is not set appropriately. + Z_FIXED prevents the use of dynamic Huffman codes, allowing for a simpler + decoder for special applications. + + deflateInit2 returns Z_OK if success, Z_MEM_ERROR if there was not enough + memory, Z_STREAM_ERROR if any parameter is invalid (such as an invalid + method), or Z_VERSION_ERROR if the zlib library version (zlib_version) is + incompatible with the version assumed by the caller (ZLIB_VERSION). msg is + set to null if there is no error message. deflateInit2 does not perform any + compression: this will be done by deflate(). +*/ + +Z_EXTERN int Z_EXPORT deflateSetDictionary(z_stream *strm, + const unsigned char *dictionary, + unsigned int dictLength); +/* + Initializes the compression dictionary from the given byte sequence + without producing any compressed output. When using the zlib format, this + function must be called immediately after deflateInit, deflateInit2 or + deflateReset, and before any call of deflate. When doing raw deflate, this + function must be called either before any call of deflate, or immediately + after the completion of a deflate block, i.e. after all input has been + consumed and all output has been delivered when using any of the flush + options Z_BLOCK, Z_PARTIAL_FLUSH, Z_SYNC_FLUSH, or Z_FULL_FLUSH. The + compressor and decompressor must use exactly the same dictionary (see + inflateSetDictionary). + + The dictionary should consist of strings (byte sequences) that are likely + to be encountered later in the data to be compressed, with the most commonly + used strings preferably put towards the end of the dictionary. Using a + dictionary is most useful when the data to be compressed is short and can be + predicted with good accuracy; the data can then be compressed better than + with the default empty dictionary. + + Depending on the size of the compression data structures selected by + deflateInit or deflateInit2, a part of the dictionary may in effect be + discarded, for example if the dictionary is larger than the window size + provided in deflateInit or deflateInit2. Thus the strings most likely to be + useful should be put at the end of the dictionary, not at the front. In + addition, the current implementation of deflate will use at most the window + size minus 262 bytes of the provided dictionary. + + Upon return of this function, strm->adler is set to the Adler-32 value + of the dictionary; the decompressor may later use this value to determine + which dictionary has been used by the compressor. (The Adler-32 value + applies to the whole dictionary even if only a subset of the dictionary is + actually used by the compressor.) If a raw deflate was requested, then the + Adler-32 value is not computed and strm->adler is not set. + + deflateSetDictionary returns Z_OK if success, or Z_STREAM_ERROR if a + parameter is invalid (e.g. dictionary being NULL) or the stream state is + inconsistent (for example if deflate has already been called for this stream + or if not at a block boundary for raw deflate). deflateSetDictionary does + not perform any compression: this will be done by deflate(). +*/ + +Z_EXTERN int Z_EXPORT deflateGetDictionary (z_stream *strm, unsigned char *dictionary, unsigned int *dictLength); +/* + Returns the sliding dictionary being maintained by deflate. dictLength is + set to the number of bytes in the dictionary, and that many bytes are copied + to dictionary. dictionary must have enough space, where 32768 bytes is + always enough. If deflateGetDictionary() is called with dictionary equal to + Z_NULL, then only the dictionary length is returned, and nothing is copied. + Similarly, if dictLength is Z_NULL, then it is not set. + + deflateGetDictionary() may return a length less than the window size, even + when more than the window size in input has been provided. It may return up + to 258 bytes less in that case, due to how zlib's implementation of deflate + manages the sliding window and lookahead for matches, where matches can be + up to 258 bytes long. If the application needs the last window-size bytes of + input, then that would need to be saved by the application outside of zlib. + + deflateGetDictionary returns Z_OK on success, or Z_STREAM_ERROR if the + stream state is inconsistent. +*/ + +Z_EXTERN int Z_EXPORT deflateCopy(z_stream *dest, z_stream *source); +/* + Sets the destination stream as a complete copy of the source stream. + + This function can be useful when several compression strategies will be + tried, for example when there are several ways of pre-processing the input + data with a filter. The streams that will be discarded should then be freed + by calling deflateEnd. Note that deflateCopy duplicates the internal + compression state which can be quite large, so this strategy is slow and can + consume lots of memory. + + deflateCopy returns Z_OK if success, Z_MEM_ERROR if there was not + enough memory, Z_STREAM_ERROR if the source stream state was inconsistent + (such as zalloc being NULL). msg is left unchanged in both source and + destination. +*/ + +Z_EXTERN int Z_EXPORT deflateReset(z_stream *strm); +/* + This function is equivalent to deflateEnd followed by deflateInit, but + does not free and reallocate the internal compression state. The stream + will leave the compression level and any other attributes that may have been + set unchanged. total_in, total_out, adler, and msg are initialized. + + deflateReset returns Z_OK if success, or Z_STREAM_ERROR if the source + stream state was inconsistent (such as zalloc or state being NULL). +*/ + +Z_EXTERN int Z_EXPORT deflateParams(z_stream *strm, int level, int strategy); +/* + Dynamically update the compression level and compression strategy. The + interpretation of level and strategy is as in deflateInit2(). This can be + used to switch between compression and straight copy of the input data, or + to switch to a different kind of input data requiring a different strategy. + If the compression approach (which is a function of the level) or the + strategy is changed, and if there have been any deflate() calls since the + state was initialized or reset, then the input available so far is + compressed with the old level and strategy using deflate(strm, Z_BLOCK). + There are three approaches for the compression levels 0, 1..3, and 4..9 + respectively. The new level and strategy will take effect at the next call + of deflate(). + + If a deflate(strm, Z_BLOCK) is performed by deflateParams(), and it does + not have enough output space to complete, then the parameter change will not + take effect. In this case, deflateParams() can be called again with the + same parameters and more output space to try again. + + In order to assure a change in the parameters on the first try, the + deflate stream should be flushed using deflate() with Z_BLOCK or other flush + request until strm.avail_out is not zero, before calling deflateParams(). + Then no more input data should be provided before the deflateParams() call. + If this is done, the old level and strategy will be applied to the data + compressed before deflateParams(), and the new level and strategy will be + applied to the data compressed after deflateParams(). + + deflateParams returns Z_OK on success, Z_STREAM_ERROR if the source stream + state was inconsistent or if a parameter was invalid, or Z_BUF_ERROR if + there was not enough output space to complete the compression of the + available input data before a change in the strategy or approach. Note that + in the case of a Z_BUF_ERROR, the parameters are not changed. A return + value of Z_BUF_ERROR is not fatal, in which case deflateParams() can be + retried with more output space. +*/ + +Z_EXTERN int Z_EXPORT deflateTune(z_stream *strm, int good_length, int max_lazy, int nice_length, int max_chain); +/* + Fine tune deflate's internal compression parameters. This should only be + used by someone who understands the algorithm used by zlib's deflate for + searching for the best matching string, and even then only by the most + fanatic optimizer trying to squeeze out the last compressed bit for their + specific input data. Read the deflate.c source code for the meaning of the + max_lazy, good_length, nice_length, and max_chain parameters. + + deflateTune() can be called after deflateInit() or deflateInit2(), and + returns Z_OK on success, or Z_STREAM_ERROR for an invalid deflate stream. + */ + +Z_EXTERN unsigned long Z_EXPORT deflateBound(z_stream *strm, unsigned long sourceLen); +/* + deflateBound() returns an upper bound on the compressed size after + deflation of sourceLen bytes. It must be called after deflateInit() or + deflateInit2(), and after deflateSetHeader(), if used. This would be used + to allocate an output buffer for deflation in a single pass, and so would be + called before deflate(). If that first deflate() call is provided the + sourceLen input bytes, an output buffer allocated to the size returned by + deflateBound(), and the flush value Z_FINISH, then deflate() is guaranteed + to return Z_STREAM_END. Note that it is possible for the compressed size to + be larger than the value returned by deflateBound() if flush options other + than Z_FINISH or Z_NO_FLUSH are used. +*/ + +Z_EXTERN int Z_EXPORT deflatePending(z_stream *strm, uint32_t *pending, int *bits); +/* + deflatePending() returns the number of bytes and bits of output that have + been generated, but not yet provided in the available output. The bytes not + provided would be due to the available output space having being consumed. + The number of bits of output not provided are between 0 and 7, where they + await more bits to join them in order to fill out a full byte. If pending + or bits are NULL, then those values are not set. + + deflatePending returns Z_OK if success, or Z_STREAM_ERROR if the source + stream state was inconsistent. + */ + +Z_EXTERN int Z_EXPORT deflatePrime(z_stream *strm, int bits, int value); +/* + deflatePrime() inserts bits in the deflate output stream. The intent + is that this function is used to start off the deflate output with the bits + leftover from a previous deflate stream when appending to it. As such, this + function can only be used for raw deflate, and must be used before the first + deflate() call after a deflateInit2() or deflateReset(). bits must be less + than or equal to 16, and that many of the least significant bits of value + will be inserted in the output. + + deflatePrime returns Z_OK if success, Z_BUF_ERROR if there was not enough + room in the internal buffer to insert the bits, or Z_STREAM_ERROR if the + source stream state was inconsistent. +*/ + +Z_EXTERN int Z_EXPORT deflateSetHeader(z_stream *strm, gz_headerp head); +/* + deflateSetHeader() provides gzip header information for when a gzip + stream is requested by deflateInit2(). deflateSetHeader() may be called + after deflateInit2() or deflateReset() and before the first call of + deflate(). The text, time, os, extra field, name, and comment information + in the provided gz_header structure are written to the gzip header (xflag is + ignored -- the extra flags are set according to the compression level). The + caller must assure that, if not NULL, name and comment are terminated with + a zero byte, and that if extra is not NULL, that extra_len bytes are + available there. If hcrc is true, a gzip header crc is included. Note that + the current versions of the command-line version of gzip (up through version + 1.3.x) do not support header crc's, and will report that it is a "multi-part + gzip file" and give up. + + If deflateSetHeader is not used, the default gzip header has text false, + the time set to zero, and os set to the current operating system, with no + extra, name, or comment fields. The gzip header is returned to the default + state by deflateReset(). + + deflateSetHeader returns Z_OK if success, or Z_STREAM_ERROR if the source + stream state was inconsistent. +*/ + +/* +Z_EXTERN int Z_EXPORT inflateInit2(z_stream *strm, int windowBits); + + This is another version of inflateInit with an extra parameter. The + fields next_in, avail_in, zalloc, zfree and opaque must be initialized + before by the caller. + + The windowBits parameter is the base two logarithm of the maximum window + size (the size of the history buffer). It should be in the range 8..15 for + this version of the library. The default value is 15 if inflateInit is used + instead. windowBits must be greater than or equal to the windowBits value + provided to deflateInit2() while compressing, or it must be equal to 15 if + deflateInit2() was not used. If a compressed stream with a larger window + size is given as input, inflate() will return with the error code + Z_DATA_ERROR instead of trying to allocate a larger window. + + windowBits can also be zero to request that inflate use the window size in + the zlib header of the compressed stream. + + windowBits can also be -8..-15 for raw inflate. In this case, -windowBits + determines the window size. inflate() will then process raw deflate data, + not looking for a zlib or gzip header, not generating a check value, and not + looking for any check values for comparison at the end of the stream. This + is for use with other formats that use the deflate compressed data format + such as zip. Those formats provide their own check values. If a custom + format is developed using the raw deflate format for compressed data, it is + recommended that a check value such as an Adler-32 or a CRC-32 be applied to + the uncompressed data as is done in the zlib, gzip, and zip formats. For + most applications, the zlib format should be used as is. Note that comments + above on the use in deflateInit2() applies to the magnitude of windowBits. + + windowBits can also be greater than 15 for optional gzip decoding. Add + 32 to windowBits to enable zlib and gzip decoding with automatic header + detection, or add 16 to decode only the gzip format (the zlib format will + return a Z_DATA_ERROR). If a gzip stream is being decoded, strm->adler is a + CRC-32 instead of an Adler-32. Unlike the gunzip utility and gzread() (see + below), inflate() will *not* automatically decode concatenated gzip members. + inflate() will return Z_STREAM_END at the end of the gzip member. The state + would need to be reset to continue decoding a subsequent gzip member. This + *must* be done if there is more data after a gzip member, in order for the + decompression to be compliant with the gzip standard (RFC 1952). + + inflateInit2 returns Z_OK if success, Z_MEM_ERROR if there was not enough + memory, Z_VERSION_ERROR if the zlib library version is incompatible with the + version assumed by the caller, or Z_STREAM_ERROR if the parameters are + invalid, such as a null pointer to the structure. msg is set to null if + there is no error message. inflateInit2 does not perform any decompression + apart from possibly reading the zlib header if present: actual decompression + will be done by inflate(). (So next_in and avail_in may be modified, but + next_out and avail_out are unused and unchanged.) The current implementation + of inflateInit2() does not process any header information -- that is + deferred until inflate() is called. +*/ + +Z_EXTERN int Z_EXPORT inflateSetDictionary(z_stream *strm, const unsigned char *dictionary, unsigned int dictLength); +/* + Initializes the decompression dictionary from the given uncompressed byte + sequence. This function must be called immediately after a call of inflate, + if that call returned Z_NEED_DICT. The dictionary chosen by the compressor + can be determined from the Adler-32 value returned by that call of inflate. + The compressor and decompressor must use exactly the same dictionary (see + deflateSetDictionary). For raw inflate, this function can be called at any + time to set the dictionary. If the provided dictionary is smaller than the + window and there is already data in the window, then the provided dictionary + will amend what's there. The application must ensure that the dictionary + that was used for compression is provided. + + inflateSetDictionary returns Z_OK if success, Z_STREAM_ERROR if a + parameter is invalid (e.g. dictionary being NULL) or the stream state is + inconsistent, Z_DATA_ERROR if the given dictionary doesn't match the + expected one (incorrect Adler-32 value). inflateSetDictionary does not + perform any decompression: this will be done by subsequent calls of + inflate(). +*/ + +Z_EXTERN int Z_EXPORT inflateGetDictionary(z_stream *strm, unsigned char *dictionary, unsigned int *dictLength); +/* + Returns the sliding dictionary being maintained by inflate. dictLength is + set to the number of bytes in the dictionary, and that many bytes are copied + to dictionary. dictionary must have enough space, where 32768 bytes is + always enough. If inflateGetDictionary() is called with dictionary equal to + NULL, then only the dictionary length is returned, and nothing is copied. + Similarly, if dictLength is NULL, then it is not set. + + inflateGetDictionary returns Z_OK on success, or Z_STREAM_ERROR if the + stream state is inconsistent. +*/ + +Z_EXTERN int Z_EXPORT inflateSync(z_stream *strm); +/* + Skips invalid compressed data until a possible full flush point (see above + for the description of deflate with Z_FULL_FLUSH) can be found, or until all + available input is skipped. No output is provided. + + inflateSync searches for a 00 00 FF FF pattern in the compressed data. + All full flush points have this pattern, but not all occurrences of this + pattern are full flush points. + + inflateSync returns Z_OK if a possible full flush point has been found, + Z_BUF_ERROR if no more input was provided, Z_DATA_ERROR if no flush point + has been found, or Z_STREAM_ERROR if the stream structure was inconsistent. + In the success case, the application may save the current value of + total_in which indicates where valid compressed data was found. In the + error case, the application may repeatedly call inflateSync, providing more + input each time, until success or end of the input data. +*/ + +Z_EXTERN int Z_EXPORT inflateCopy(z_stream *dest, z_stream *source); +/* + Sets the destination stream as a complete copy of the source stream. + + This function can be useful when randomly accessing a large stream. The + first pass through the stream can periodically record the inflate state, + allowing restarting inflate at those points when randomly accessing the + stream. + + inflateCopy returns Z_OK if success, Z_MEM_ERROR if there was not + enough memory, Z_STREAM_ERROR if the source stream state was inconsistent + (such as zalloc being NULL). msg is left unchanged in both source and + destination. +*/ + +Z_EXTERN int Z_EXPORT inflateReset(z_stream *strm); +/* + This function is equivalent to inflateEnd followed by inflateInit, + but does not free and reallocate the internal decompression state. The + stream will keep attributes that may have been set by inflateInit2. + total_in, total_out, adler, and msg are initialized. + + inflateReset returns Z_OK if success, or Z_STREAM_ERROR if the source + stream state was inconsistent (such as zalloc or state being NULL). +*/ + +Z_EXTERN int Z_EXPORT inflateReset2(z_stream *strm, int windowBits); +/* + This function is the same as inflateReset, but it also permits changing + the wrap and window size requests. The windowBits parameter is interpreted + the same as it is for inflateInit2. If the window size is changed, then the + memory allocated for the window is freed, and the window will be reallocated + by inflate() if needed. + + inflateReset2 returns Z_OK if success, or Z_STREAM_ERROR if the source + stream state was inconsistent (such as zalloc or state being NULL), or if + the windowBits parameter is invalid. +*/ + +Z_EXTERN int Z_EXPORT inflatePrime(z_stream *strm, int bits, int value); +/* + This function inserts bits in the inflate input stream. The intent is + that this function is used to start inflating at a bit position in the + middle of a byte. The provided bits will be used before any bytes are used + from next_in. This function should only be used with raw inflate, and + should be used before the first inflate() call after inflateInit2() or + inflateReset(). bits must be less than or equal to 16, and that many of the + least significant bits of value will be inserted in the input. + + If bits is negative, then the input stream bit buffer is emptied. Then + inflatePrime() can be called again to put bits in the buffer. This is used + to clear out bits leftover after feeding inflate a block description prior + to feeding inflate codes. + + inflatePrime returns Z_OK if success, or Z_STREAM_ERROR if the source + stream state was inconsistent. +*/ + +Z_EXTERN long Z_EXPORT inflateMark(z_stream *strm); +/* + This function returns two values, one in the lower 16 bits of the return + value, and the other in the remaining upper bits, obtained by shifting the + return value down 16 bits. If the upper value is -1 and the lower value is + zero, then inflate() is currently decoding information outside of a block. + If the upper value is -1 and the lower value is non-zero, then inflate is in + the middle of a stored block, with the lower value equaling the number of + bytes from the input remaining to copy. If the upper value is not -1, then + it is the number of bits back from the current bit position in the input of + the code (literal or length/distance pair) currently being processed. In + that case the lower value is the number of bytes already emitted for that + code. + + A code is being processed if inflate is waiting for more input to complete + decoding of the code, or if it has completed decoding but is waiting for + more output space to write the literal or match data. + + inflateMark() is used to mark locations in the input data for random + access, which may be at bit positions, and to note those cases where the + output of a code may span boundaries of random access blocks. The current + location in the input stream can be determined from avail_in and data_type + as noted in the description for the Z_BLOCK flush parameter for inflate. + + inflateMark returns the value noted above, or -65536 if the provided + source stream state was inconsistent. +*/ + +Z_EXTERN int Z_EXPORT inflateGetHeader(z_stream *strm, gz_headerp head); +/* + inflateGetHeader() requests that gzip header information be stored in the + provided gz_header structure. inflateGetHeader() may be called after + inflateInit2() or inflateReset(), and before the first call of inflate(). + As inflate() processes the gzip stream, head->done is zero until the header + is completed, at which time head->done is set to one. If a zlib stream is + being decoded, then head->done is set to -1 to indicate that there will be + no gzip header information forthcoming. Note that Z_BLOCK or Z_TREES can be + used to force inflate() to return immediately after header processing is + complete and before any actual data is decompressed. + + The text, time, xflags, and os fields are filled in with the gzip header + contents. hcrc is set to true if there is a header CRC. (The header CRC + was valid if done is set to one.) If extra is not NULL, then extra_max + contains the maximum number of bytes to write to extra. Once done is true, + extra_len contains the actual extra field length, and extra contains the + extra field, or that field truncated if extra_max is less than extra_len. + If name is not NULL, then up to name_max characters are written there, + terminated with a zero unless the length is greater than name_max. If + comment is not NULL, then up to comm_max characters are written there, + terminated with a zero unless the length is greater than comm_max. When any + of extra, name, or comment are not NULL and the respective field is not + present in the header, then that field is set to NULL to signal its + absence. This allows the use of deflateSetHeader() with the returned + structure to duplicate the header. However if those fields are set to + allocated memory, then the application will need to save those pointers + elsewhere so that they can be eventually freed. + + If inflateGetHeader is not used, then the header information is simply + discarded. The header is always checked for validity, including the header + CRC if present. inflateReset() will reset the process to discard the header + information. The application would need to call inflateGetHeader() again to + retrieve the header from the next gzip stream. + + inflateGetHeader returns Z_OK if success, or Z_STREAM_ERROR if the source + stream state was inconsistent. +*/ + +/* +Z_EXTERN int Z_EXPORT inflateBackInit (z_stream *strm, int windowBits, unsigned char *window); + + Initialize the internal stream state for decompression using inflateBack() + calls. The fields zalloc, zfree and opaque in strm must be initialized + before the call. If zalloc and zfree are NULL, then the default library- + derived memory allocation routines are used. windowBits is the base two + logarithm of the window size, in the range 8..15. window is a caller + supplied buffer of that size. Except for special applications where it is + assured that deflate was used with small window sizes, windowBits must be 15 + and a 32K byte window must be supplied to be able to decompress general + deflate streams. + + See inflateBack() for the usage of these routines. + + inflateBackInit will return Z_OK on success, Z_STREAM_ERROR if any of + the parameters are invalid, Z_MEM_ERROR if the internal state could not be + allocated, or Z_VERSION_ERROR if the version of the library does not match + the version of the header file. +*/ + +typedef uint32_t (*in_func) (void *, z_const unsigned char * *); +typedef int (*out_func) (void *, unsigned char *, uint32_t); + +Z_EXTERN int Z_EXPORT inflateBack(z_stream *strm, in_func in, void *in_desc, out_func out, void *out_desc); +/* + inflateBack() does a raw inflate with a single call using a call-back + interface for input and output. This is potentially more efficient than + inflate() for file i/o applications, in that it avoids copying between the + output and the sliding window by simply making the window itself the output + buffer. inflate() can be faster on modern CPUs when used with large + buffers. inflateBack() trusts the application to not change the output + buffer passed by the output function, at least until inflateBack() returns. + + inflateBackInit() must be called first to allocate the internal state + and to initialize the state with the user-provided window buffer. + inflateBack() may then be used multiple times to inflate a complete, raw + deflate stream with each call. inflateBackEnd() is then called to free the + allocated state. + + A raw deflate stream is one with no zlib or gzip header or trailer. + This routine would normally be used in a utility that reads zip or gzip + files and writes out uncompressed files. The utility would decode the + header and process the trailer on its own, hence this routine expects only + the raw deflate stream to decompress. This is different from the default + behavior of inflate(), which expects a zlib header and trailer around the + deflate stream. + + inflateBack() uses two subroutines supplied by the caller that are then + called by inflateBack() for input and output. inflateBack() calls those + routines until it reads a complete deflate stream and writes out all of the + uncompressed data, or until it encounters an error. The function's + parameters and return types are defined above in the in_func and out_func + typedefs. inflateBack() will call in(in_desc, &buf) which should return the + number of bytes of provided input, and a pointer to that input in buf. If + there is no input available, in() must return zero -- buf is ignored in that + case -- and inflateBack() will return a buffer error. inflateBack() will + call out(out_desc, buf, len) to write the uncompressed data buf[0..len-1]. + out() should return zero on success, or non-zero on failure. If out() + returns non-zero, inflateBack() will return with an error. Neither in() nor + out() are permitted to change the contents of the window provided to + inflateBackInit(), which is also the buffer that out() uses to write from. + The length written by out() will be at most the window size. Any non-zero + amount of input may be provided by in(). + + For convenience, inflateBack() can be provided input on the first call by + setting strm->next_in and strm->avail_in. If that input is exhausted, then + in() will be called. Therefore strm->next_in must be initialized before + calling inflateBack(). If strm->next_in is NULL, then in() will be called + immediately for input. If strm->next_in is not NULL, then strm->avail_in + must also be initialized, and then if strm->avail_in is not zero, input will + initially be taken from strm->next_in[0 .. strm->avail_in - 1]. + + The in_desc and out_desc parameters of inflateBack() is passed as the + first parameter of in() and out() respectively when they are called. These + descriptors can be optionally used to pass any information that the caller- + supplied in() and out() functions need to do their job. + + On return, inflateBack() will set strm->next_in and strm->avail_in to + pass back any unused input that was provided by the last in() call. The + return values of inflateBack() can be Z_STREAM_END on success, Z_BUF_ERROR + if in() or out() returned an error, Z_DATA_ERROR if there was a format error + in the deflate stream (in which case strm->msg is set to indicate the nature + of the error), or Z_STREAM_ERROR if the stream was not properly initialized. + In the case of Z_BUF_ERROR, an input or output error can be distinguished + using strm->next_in which will be NULL only if in() returned an error. If + strm->next_in is not NULL, then the Z_BUF_ERROR was due to out() returning + non-zero. (in() will always be called before out(), so strm->next_in is + assured to be defined if out() returns non-zero.) Note that inflateBack() + cannot return Z_OK. +*/ + +Z_EXTERN int Z_EXPORT inflateBackEnd(z_stream *strm); +/* + All memory allocated by inflateBackInit() is freed. + + inflateBackEnd() returns Z_OK on success, or Z_STREAM_ERROR if the stream + state was inconsistent. +*/ + +Z_EXTERN unsigned long Z_EXPORT zlibCompileFlags(void); +/* Return flags indicating compile-time options. + + Type sizes, two bits each, 00 = 16 bits, 01 = 32, 10 = 64, 11 = other: + 1.0: size of unsigned int + 3.2: size of unsigned long + 5.4: size of void * (pointer) + 7.6: size of z_off_t + + Compiler, assembler, and debug options: + 8: ZLIB_DEBUG + 9: ASMV or ASMINF -- use ASM code + 10: ZLIB_WINAPI -- exported functions use the WINAPI calling convention + 11: 0 (reserved) + + One-time table building (smaller code, but not thread-safe if true): + 12: BUILDFIXED -- build static block decoding tables when needed (not supported by zlib-ng) + 13: DYNAMIC_CRC_TABLE -- build CRC calculation tables when needed + 14,15: 0 (reserved) + + Library content (indicates missing functionality): + 16: NO_GZCOMPRESS -- gz* functions cannot compress (to avoid linking + deflate code when not needed) + 17: NO_GZIP -- deflate can't write gzip streams, and inflate can't detect + and decode gzip streams (to avoid linking crc code) + 18-19: 0 (reserved) + + Operation variations (changes in library functionality): + 20: PKZIP_BUG_WORKAROUND -- slightly more permissive inflate + 21: FASTEST -- deflate algorithm with only one, lowest compression level + 22,23: 0 (reserved) + + The sprintf variant used by gzprintf (zero is best): + 24: 0 = vs*, 1 = s* -- 1 means limited to 20 arguments after the format + 25: 0 = *nprintf, 1 = *printf -- 1 means gzprintf() not secure! + 26: 0 = returns value, 1 = void -- 1 means inferred string length returned + + Remainder: + 27-31: 0 (reserved) + */ + + +#ifndef Z_SOLO + + /* utility functions */ + +/* + The following utility functions are implemented on top of the basic + stream-oriented functions. To simplify the interface, some default options + are assumed (compression level and memory usage, standard memory allocation + functions). The source code of these utility functions can be modified if + you need special options. +*/ + +Z_EXTERN int Z_EXPORT compress(unsigned char *dest, unsigned long *destLen, const unsigned char *source, unsigned long sourceLen); +/* + Compresses the source buffer into the destination buffer. sourceLen is + the byte length of the source buffer. Upon entry, destLen is the total size + of the destination buffer, which must be at least the value returned by + compressBound(sourceLen). Upon exit, destLen is the actual size of the + compressed data. compress() is equivalent to compress2() with a level + parameter of Z_DEFAULT_COMPRESSION. + + compress returns Z_OK if success, Z_MEM_ERROR if there was not + enough memory, Z_BUF_ERROR if there was not enough room in the output + buffer. +*/ + +Z_EXTERN int Z_EXPORT compress2(unsigned char *dest, unsigned long *destLen, const unsigned char *source, + unsigned long sourceLen, int level); +/* + Compresses the source buffer into the destination buffer. The level + parameter has the same meaning as in deflateInit. sourceLen is the byte + length of the source buffer. Upon entry, destLen is the total size of the + destination buffer, which must be at least the value returned by + compressBound(sourceLen). Upon exit, destLen is the actual size of the + compressed data. + + compress2 returns Z_OK if success, Z_MEM_ERROR if there was not enough + memory, Z_BUF_ERROR if there was not enough room in the output buffer, + Z_STREAM_ERROR if the level parameter is invalid. +*/ + +Z_EXTERN unsigned long Z_EXPORT compressBound(unsigned long sourceLen); +/* + compressBound() returns an upper bound on the compressed size after + compress() or compress2() on sourceLen bytes. It would be used before a + compress() or compress2() call to allocate the destination buffer. +*/ + +Z_EXTERN int Z_EXPORT uncompress(unsigned char *dest, unsigned long *destLen, const unsigned char *source, unsigned long sourceLen); +/* + Decompresses the source buffer into the destination buffer. sourceLen is + the byte length of the source buffer. Upon entry, destLen is the total size + of the destination buffer, which must be large enough to hold the entire + uncompressed data. (The size of the uncompressed data must have been saved + previously by the compressor and transmitted to the decompressor by some + mechanism outside the scope of this compression library.) Upon exit, destLen + is the actual size of the uncompressed data. + + uncompress returns Z_OK if success, Z_MEM_ERROR if there was not + enough memory, Z_BUF_ERROR if there was not enough room in the output + buffer, or Z_DATA_ERROR if the input data was corrupted or incomplete. In + the case where there is not enough room, uncompress() will fill the output + buffer with the uncompressed data up to that point. +*/ + + +Z_EXTERN int Z_EXPORT uncompress2 (unsigned char *dest, unsigned long *destLen, + const unsigned char *source, unsigned long *sourceLen); +/* + Same as uncompress, except that sourceLen is a pointer, where the + length of the source is *sourceLen. On return, *sourceLen is the number of + source bytes consumed. +*/ + + + /* gzip file access functions */ + +/* + This library supports reading and writing files in gzip (.gz) format with + an interface similar to that of stdio, using the functions that start with + "gz". The gzip format is different from the zlib format. gzip is a gzip + wrapper, documented in RFC 1952, wrapped around a deflate stream. +*/ + +typedef struct gzFile_s *gzFile; /* semi-opaque gzip file descriptor */ + +/* +Z_EXTERN gzFile Z_EXPORT gzopen(const char *path, const char *mode); + + Open the gzip (.gz) file at path for reading and decompressing, or + compressing and writing. The mode parameter is as in fopen ("rb" or "wb") + but can also include a compression level ("wb9") or a strategy: 'f' for + filtered data as in "wb6f", 'h' for Huffman-only compression as in "wb1h", + 'R' for run-length encoding as in "wb1R", or 'F' for fixed code compression + as in "wb9F". (See the description of deflateInit2 for more information + about the strategy parameter.) 'T' will request transparent writing or + appending with no compression and not using the gzip format. + + "a" can be used instead of "w" to request that the gzip stream that will + be written be appended to the file. "+" will result in an error, since + reading and writing to the same gzip file is not supported. The addition of + "x" when writing will create the file exclusively, which fails if the file + already exists. On systems that support it, the addition of "e" when + reading or writing will set the flag to close the file on an execve() call. + + These functions, as well as gzip, will read and decode a sequence of gzip + streams in a file. The append function of gzopen() can be used to create + such a file. (Also see gzflush() for another way to do this.) When + appending, gzopen does not test whether the file begins with a gzip stream, + nor does it look for the end of the gzip streams to begin appending. gzopen + will simply append a gzip stream to the existing file. + + gzopen can be used to read a file which is not in gzip format; in this + case gzread will directly read from the file without decompression. When + reading, this will be detected automatically by looking for the magic two- + byte gzip header. + + gzopen returns NULL if the file could not be opened, if there was + insufficient memory to allocate the gzFile state, or if an invalid mode was + specified (an 'r', 'w', or 'a' was not provided, or '+' was provided). + errno can be checked to determine if the reason gzopen failed was that the + file could not be opened. +*/ + +Z_EXTERN gzFile Z_EXPORT gzdopen(int fd, const char *mode); +/* + Associate a gzFile with the file descriptor fd. File descriptors are + obtained from calls like open, dup, creat, pipe or fileno (if the file has + been previously opened with fopen). The mode parameter is as in gzopen. + + The next call of gzclose on the returned gzFile will also close the file + descriptor fd, just like fclose(fdopen(fd, mode)) closes the file descriptor + fd. If you want to keep fd open, use fd = dup(fd_keep); gz = gzdopen(fd, + mode);. The duplicated descriptor should be saved to avoid a leak, since + gzdopen does not close fd if it fails. If you are using fileno() to get the + file descriptor from a FILE *, then you will have to use dup() to avoid + double-close()ing the file descriptor. Both gzclose() and fclose() will + close the associated file descriptor, so they need to have different file + descriptors. + + gzdopen returns NULL if there was insufficient memory to allocate the + gzFile state, if an invalid mode was specified (an 'r', 'w', or 'a' was not + provided, or '+' was provided), or if fd is -1. The file descriptor is not + used until the next gz* read, write, seek, or close operation, so gzdopen + will not detect if fd is invalid (unless fd is -1). +*/ + +Z_EXTERN int Z_EXPORT gzbuffer(gzFile file, unsigned size); +/* + Set the internal buffer size used by this library's functions for file to + size. The default buffer size is 8192 bytes. This function must be called + after gzopen() or gzdopen(), and before any other calls that read or write + the file. The buffer memory allocation is always deferred to the first read + or write. Three times that size in buffer space is allocated. A larger + buffer size of, for example, 64K or 128K bytes will noticeably increase the + speed of decompression (reading). + + The new buffer size also affects the maximum length for gzprintf(). + + gzbuffer() returns 0 on success, or -1 on failure, such as being called + too late. +*/ + +Z_EXTERN int Z_EXPORT gzsetparams(gzFile file, int level, int strategy); +/* + Dynamically update the compression level and strategy for file. See the + description of deflateInit2 for the meaning of these parameters. Previously + provided data is flushed before applying the parameter changes. + + gzsetparams returns Z_OK if success, Z_STREAM_ERROR if the file was not + opened for writing, Z_ERRNO if there is an error writing the flushed data, + or Z_MEM_ERROR if there is a memory allocation error. +*/ + +Z_EXTERN int Z_EXPORT gzread(gzFile file, void *buf, unsigned len); +/* + Read and decompress up to len uncompressed bytes from file into buf. If + the input file is not in gzip format, gzread copies the given number of + bytes into the buffer directly from the file. + + After reaching the end of a gzip stream in the input, gzread will continue + to read, looking for another gzip stream. Any number of gzip streams may be + concatenated in the input file, and will all be decompressed by gzread(). + If something other than a gzip stream is encountered after a gzip stream, + that remaining trailing garbage is ignored (and no error is returned). + + gzread can be used to read a gzip file that is being concurrently written. + Upon reaching the end of the input, gzread will return with the available + data. If the error code returned by gzerror is Z_OK or Z_BUF_ERROR, then + gzclearerr can be used to clear the end of file indicator in order to permit + gzread to be tried again. Z_OK indicates that a gzip stream was completed + on the last gzread. Z_BUF_ERROR indicates that the input file ended in the + middle of a gzip stream. Note that gzread does not return -1 in the event + of an incomplete gzip stream. This error is deferred until gzclose(), which + will return Z_BUF_ERROR if the last gzread ended in the middle of a gzip + stream. Alternatively, gzerror can be used before gzclose to detect this + case. + + gzread returns the number of uncompressed bytes actually read, less than + len for end of file, or -1 for error. If len is too large to fit in an int, + then nothing is read, -1 is returned, and the error state is set to + Z_STREAM_ERROR. +*/ + +Z_EXTERN size_t Z_EXPORT gzfread (void *buf, size_t size, size_t nitems, gzFile file); +/* + Read and decompress up to nitems items of size size from file into buf, + otherwise operating as gzread() does. This duplicates the interface of + stdio's fread(), with size_t request and return types. If the library + defines size_t, then z_size_t is identical to size_t. If not, then z_size_t + is an unsigned integer type that can contain a pointer. + + gzfread() returns the number of full items read of size size, or zero if + the end of the file was reached and a full item could not be read, or if + there was an error. gzerror() must be consulted if zero is returned in + order to determine if there was an error. If the multiplication of size and + nitems overflows, i.e. the product does not fit in a size_t, then nothing + is read, zero is returned, and the error state is set to Z_STREAM_ERROR. + + In the event that the end of file is reached and only a partial item is + available at the end, i.e. the remaining uncompressed data length is not a + multiple of size, then the final partial item is nevertheless read into buf + and the end-of-file flag is set. The length of the partial item read is not + provided, but could be inferred from the result of gztell(). This behavior + is the same as the behavior of fread() implementations in common libraries, + but it prevents the direct use of gzfread() to read a concurrently written + file, resetting and retrying on end-of-file, when size is not 1. +*/ + +Z_EXTERN int Z_EXPORT gzwrite(gzFile file, void const *buf, unsigned len); +/* + Compress and write the len uncompressed bytes at buf to file. gzwrite + returns the number of uncompressed bytes written or 0 in case of error. +*/ + +Z_EXTERN size_t Z_EXPORT gzfwrite(void const *buf, size_t size, size_t nitems, gzFile file); +/* + Compress and write nitems items of size size from buf to file, duplicating + the interface of stdio's fwrite(), with size_t request and return types. + + gzfwrite() returns the number of full items written of size size, or zero + if there was an error. If the multiplication of size and nitems overflows, + i.e. the product does not fit in a size_t, then nothing is written, zero + is returned, and the error state is set to Z_STREAM_ERROR. +*/ + +Z_EXTERN int Z_EXPORTVA gzprintf(gzFile file, const char *format, ...); +/* + Convert, format, compress, and write the arguments (...) to file under + control of the string format, as in fprintf. gzprintf returns the number of + uncompressed bytes actually written, or a negative zlib error code in case + of error. The number of uncompressed bytes written is limited to 8191, or + one less than the buffer size given to gzbuffer(). The caller should assure + that this limit is not exceeded. If it is exceeded, then gzprintf() will + return an error (0) with nothing written. In this case, there may also be a + buffer overflow with unpredictable consequences, which is possible only if + zlib was compiled with the insecure functions sprintf() or vsprintf(), + because the secure snprintf() or vsnprintf() functions were not available. + This can be determined using zlibCompileFlags(). +*/ + +Z_EXTERN int Z_EXPORT gzputs(gzFile file, const char *s); +/* + Compress and write the given null-terminated string s to file, excluding + the terminating null character. + + gzputs returns the number of characters written, or -1 in case of error. +*/ + +Z_EXTERN char * Z_EXPORT gzgets(gzFile file, char *buf, int len); +/* + Read and decompress bytes from file into buf, until len-1 characters are + read, or until a newline character is read and transferred to buf, or an + end-of-file condition is encountered. If any characters are read or if len + is one, the string is terminated with a null character. If no characters + are read due to an end-of-file or len is less than one, then the buffer is + left untouched. + + gzgets returns buf which is a null-terminated string, or it returns NULL + for end-of-file or in case of error. If there was an error, the contents at + buf are indeterminate. +*/ + +Z_EXTERN int Z_EXPORT gzputc(gzFile file, int c); +/* + Compress and write c, converted to an unsigned char, into file. gzputc + returns the value that was written, or -1 in case of error. +*/ + +Z_EXTERN int Z_EXPORT gzgetc(gzFile file); +/* + Read and decompress one byte from file. gzgetc returns this byte or -1 + in case of end of file or error. This is implemented as a macro for speed. + As such, it does not do all of the checking the other functions do. I.e. + it does not check to see if file is NULL, nor whether the structure file + points to has been clobbered or not. +*/ + +Z_EXTERN int Z_EXPORT gzungetc(int c, gzFile file); +/* + Push c back onto the stream for file to be read as the first character on + the next read. At least one character of push-back is always allowed. + gzungetc() returns the character pushed, or -1 on failure. gzungetc() will + fail if c is -1, and may fail if a character has been pushed but not read + yet. If gzungetc is used immediately after gzopen or gzdopen, at least the + output buffer size of pushed characters is allowed. (See gzbuffer above.) + The pushed character will be discarded if the stream is repositioned with + gzseek() or gzrewind(). +*/ + +Z_EXTERN int Z_EXPORT gzflush(gzFile file, int flush); +/* + Flush all pending output to file. The parameter flush is as in the + deflate() function. The return value is the zlib error number (see function + gzerror below). gzflush is only permitted when writing. + + If the flush parameter is Z_FINISH, the remaining data is written and the + gzip stream is completed in the output. If gzwrite() is called again, a new + gzip stream will be started in the output. gzread() is able to read such + concatenated gzip streams. + + gzflush should be called only when strictly necessary because it will + degrade compression if called too often. +*/ + +/* +Z_EXTERN z_off_t Z_EXPORT gzseek (gzFile file, z_off_t offset, int whence); + + Set the starting position to offset relative to whence for the next gzread + or gzwrite on file. The offset represents a number of bytes in the + uncompressed data stream. The whence parameter is defined as in lseek(2); + the value SEEK_END is not supported. + + If the file is opened for reading, this function is emulated but can be + extremely slow. If the file is opened for writing, only forward seeks are + supported; gzseek then compresses a sequence of zeroes up to the new + starting position. + + gzseek returns the resulting offset location as measured in bytes from + the beginning of the uncompressed stream, or -1 in case of error, in + particular if the file is opened for writing and the new starting position + would be before the current position. +*/ + +Z_EXTERN int Z_EXPORT gzrewind(gzFile file); +/* + Rewind file. This function is supported only for reading. + + gzrewind(file) is equivalent to (int)gzseek(file, 0L, SEEK_SET). +*/ + +/* +Z_EXTERN z_off_t Z_EXPORT gztell(gzFile file); + + Return the starting position for the next gzread or gzwrite on file. + This position represents a number of bytes in the uncompressed data stream, + and is zero when starting, even if appending or reading a gzip stream from + the middle of a file using gzdopen(). + + gztell(file) is equivalent to gzseek(file, 0L, SEEK_CUR) +*/ + +/* +Z_EXTERN z_off_t Z_EXPORT gzoffset(gzFile file); + + Return the current compressed (actual) read or write offset of file. This + offset includes the count of bytes that precede the gzip stream, for example + when appending or when using gzdopen() for reading. When reading, the + offset does not include as yet unused buffered input. This information can + be used for a progress indicator. On error, gzoffset() returns -1. +*/ + +Z_EXTERN int Z_EXPORT gzeof(gzFile file); +/* + Return true (1) if the end-of-file indicator for file has been set while + reading, false (0) otherwise. Note that the end-of-file indicator is set + only if the read tried to go past the end of the input, but came up short. + Therefore, just like feof(), gzeof() may return false even if there is no + more data to read, in the event that the last read request was for the exact + number of bytes remaining in the input file. This will happen if the input + file size is an exact multiple of the buffer size. + + If gzeof() returns true, then the read functions will return no more data, + unless the end-of-file indicator is reset by gzclearerr() and the input file + has grown since the previous end of file was detected. +*/ + +Z_EXTERN int Z_EXPORT gzdirect(gzFile file); +/* + Return true (1) if file is being copied directly while reading, or false + (0) if file is a gzip stream being decompressed. + + If the input file is empty, gzdirect() will return true, since the input + does not contain a gzip stream. + + If gzdirect() is used immediately after gzopen() or gzdopen() it will + cause buffers to be allocated to allow reading the file to determine if it + is a gzip file. Therefore if gzbuffer() is used, it should be called before + gzdirect(). + + When writing, gzdirect() returns true (1) if transparent writing was + requested ("wT" for the gzopen() mode), or false (0) otherwise. (Note: + gzdirect() is not needed when writing. Transparent writing must be + explicitly requested, so the application already knows the answer. When + linking statically, using gzdirect() will include all of the zlib code for + gzip file reading and decompression, which may not be desired.) +*/ + +Z_EXTERN int Z_EXPORT gzclose(gzFile file); +/* + Flush all pending output for file, if necessary, close file and + deallocate the (de)compression state. Note that once file is closed, you + cannot call gzerror with file, since its structures have been deallocated. + gzclose must not be called more than once on the same file, just as free + must not be called more than once on the same allocation. + + gzclose will return Z_STREAM_ERROR if file is not valid, Z_ERRNO on a + file operation error, Z_MEM_ERROR if out of memory, Z_BUF_ERROR if the + last read ended in the middle of a gzip stream, or Z_OK on success. +*/ + +Z_EXTERN int Z_EXPORT gzclose_r(gzFile file); +Z_EXTERN int Z_EXPORT gzclose_w(gzFile file); +/* + Same as gzclose(), but gzclose_r() is only for use when reading, and + gzclose_w() is only for use when writing or appending. The advantage to + using these instead of gzclose() is that they avoid linking in zlib + compression or decompression code that is not used when only reading or only + writing respectively. If gzclose() is used, then both compression and + decompression code will be included the application when linking to a static + zlib library. +*/ + +Z_EXTERN const char * Z_EXPORT gzerror(gzFile file, int *errnum); +/* + Return the error message for the last error which occurred on file. + errnum is set to zlib error number. If an error occurred in the file system + and not in the compression library, errnum is set to Z_ERRNO and the + application may consult errno to get the exact error code. + + The application must not modify the returned string. Future calls to + this function may invalidate the previously returned string. If file is + closed, then the string previously returned by gzerror will no longer be + available. + + gzerror() should be used to distinguish errors from end-of-file for those + functions above that do not distinguish those cases in their return values. +*/ + +Z_EXTERN void Z_EXPORT gzclearerr(gzFile file); +/* + Clear the error and end-of-file flags for file. This is analogous to the + clearerr() function in stdio. This is useful for continuing to read a gzip + file that is being written concurrently. +*/ + +#endif + + /* checksum functions */ + +/* + These functions are not related to compression but are exported + anyway because they might be useful in applications using the compression + library. +*/ + +Z_EXTERN unsigned long Z_EXPORT adler32(unsigned long adler, const unsigned char *buf, unsigned int len); +/* + Update a running Adler-32 checksum with the bytes buf[0..len-1] and + return the updated checksum. An Adler-32 value is in the range of a 32-bit + unsigned integer. If buf is Z_NULL, this function returns the required + initial value for the checksum. + + An Adler-32 checksum is almost as reliable as a CRC-32 but can be computed + much faster. + + Usage example: + + uint32_t adler = adler32(0L, NULL, 0); + + while (read_buffer(buffer, length) != EOF) { + adler = adler32(adler, buffer, length); + } + if (adler != original_adler) error(); +*/ + +Z_EXTERN unsigned long Z_EXPORT adler32_z(unsigned long adler, const unsigned char *buf, size_t len); +/* + Same as adler32(), but with a size_t length. +*/ + +/* +Z_EXTERN unsigned long Z_EXPORT adler32_combine(unsigned long adler1, unsigned long adler2, z_off_t len2); + + Combine two Adler-32 checksums into one. For two sequences of bytes, seq1 + and seq2 with lengths len1 and len2, Adler-32 checksums were calculated for + each, adler1 and adler2. adler32_combine() returns the Adler-32 checksum of + seq1 and seq2 concatenated, requiring only adler1, adler2, and len2. Note + that the z_off_t type (like off_t) is a signed integer. If len2 is + negative, the result has no meaning or utility. +*/ + +Z_EXTERN unsigned long Z_EXPORT crc32(unsigned long crc, const unsigned char *buf, unsigned int len); +/* + Update a running CRC-32 with the bytes buf[0..len-1] and return the + updated CRC-32. A CRC-32 value is in the range of a 32-bit unsigned integer. + If buf is Z_NULL, this function returns the required initial value for the + crc. Pre- and post-conditioning (one's complement) is performed within this + function so it shouldn't be done by the application. + + Usage example: + + uint32_t crc = crc32(0L, NULL, 0); + + while (read_buffer(buffer, length) != EOF) { + crc = crc32(crc, buffer, length); + } + if (crc != original_crc) error(); +*/ + +Z_EXTERN unsigned long Z_EXPORT crc32_z(unsigned long crc, const unsigned char *buf, size_t len); +/* + Same as crc32(), but with a size_t length. +*/ + +/* +Z_EXTERN unsigned long Z_EXPORT crc32_combine(unsigned long crc1, unsigned long crc2, z_off64_t len2); + + Combine two CRC-32 check values into one. For two sequences of bytes, + seq1 and seq2 with lengths len1 and len2, CRC-32 check values were + calculated for each, crc1 and crc2. crc32_combine() returns the CRC-32 + check value of seq1 and seq2 concatenated, requiring only crc1, crc2, and + len2. len2 must be non-negative. +*/ + +/* +Z_EXTERN unsigned long Z_EXPORT crc32_combine_gen(z_off_t len2); + + Return the operator corresponding to length len2, to be used with + crc32_combine_op(). len2 must be non-negative. +*/ + +Z_EXTERN unsigned long Z_EXPORT crc32_combine_op(unsigned long crc1, unsigned long crc2, + const unsigned long op); +/* + Give the same result as crc32_combine(), using op in place of len2. op is + is generated from len2 by crc32_combine_gen(). This will be faster than + crc32_combine() if the generated op is used more than once. +*/ + + + /* various hacks, don't look :) */ + +/* deflateInit and inflateInit are macros to allow checking the zlib version + * and the compiler's view of z_stream: + */ +Z_EXTERN int Z_EXPORT deflateInit_(z_stream *strm, int level, const char *version, int stream_size); +Z_EXTERN int Z_EXPORT inflateInit_(z_stream *strm, const char *version, int stream_size); +Z_EXTERN int Z_EXPORT deflateInit2_(z_stream *strm, int level, int method, int windowBits, int memLevel, + int strategy, const char *version, int stream_size); +Z_EXTERN int Z_EXPORT inflateInit2_(z_stream *strm, int windowBits, const char *version, int stream_size); +Z_EXTERN int Z_EXPORT inflateBackInit_(z_stream *strm, int windowBits, unsigned char *window, + const char *version, int stream_size); +#define deflateInit(strm, level) deflateInit_((strm), (level), ZLIB_VERSION, (int)sizeof(z_stream)) +#define inflateInit(strm) inflateInit_((strm), ZLIB_VERSION, (int)sizeof(z_stream)) +#define deflateInit2(strm, level, method, windowBits, memLevel, strategy) \ + deflateInit2_((strm), (level), (method), (windowBits), (memLevel), \ + (strategy), ZLIB_VERSION, (int)sizeof(z_stream)) +#define inflateInit2(strm, windowBits) inflateInit2_((strm), (windowBits), ZLIB_VERSION, (int)sizeof(z_stream)) +#define inflateBackInit(strm, windowBits, window) \ + inflateBackInit_((strm), (windowBits), (window), ZLIB_VERSION, (int)sizeof(z_stream)) + + +#ifndef Z_SOLO +/* gzgetc() macro and its supporting function and exposed data structure. Note + * that the real internal state is much larger than the exposed structure. + * This abbreviated structure exposes just enough for the gzgetc() macro. The + * user should not mess with these exposed elements, since their names or + * behavior could change in the future, perhaps even capriciously. They can + * only be used by the gzgetc() macro. You have been warned. + */ +struct gzFile_s { + unsigned have; + unsigned char *next; + z_off64_t pos; +}; +Z_EXTERN int Z_EXPORT gzgetc_(gzFile file); /* backward compatibility */ +# define gzgetc(g) ((g)->have ? ((g)->have--, (g)->pos++, *((g)->next)++) : (gzgetc)(g)) + +/* provide 64-bit offset functions if _LARGEFILE64_SOURCE defined, and/or + * change the regular functions to 64 bits if _FILE_OFFSET_BITS is 64 (if + * both are true, the application gets the *64 functions, and the regular + * functions are changed to 64 bits) -- in case these are set on systems + * without large file support, _LFS64_LARGEFILE must also be true + */ +#ifdef Z_LARGE64 + Z_EXTERN gzFile Z_EXPORT gzopen64(const char *, const char *); + Z_EXTERN z_off64_t Z_EXPORT gzseek64(gzFile, z_off64_t, int); + Z_EXTERN z_off64_t Z_EXPORT gztell64(gzFile); + Z_EXTERN z_off64_t Z_EXPORT gzoffset64(gzFile); + Z_EXTERN unsigned long Z_EXPORT adler32_combine64(unsigned long, unsigned long, z_off64_t); + Z_EXTERN unsigned long Z_EXPORT crc32_combine64(unsigned long, unsigned long, z_off64_t); + Z_EXTERN unsigned long Z_EXPORT crc32_combine_gen64(z_off64_t); +#endif +#endif + +#if !defined(Z_SOLO) && !defined(Z_INTERNAL) && defined(Z_WANT64) +# define gzopen gzopen64 +# define gzseek gzseek64 +# define gztell gztell64 +# define gzoffset gzoffset64 +# define adler32_combine adler32_combine64 +# define crc32_combine crc32_combine64 +# define crc32_combine_gen crc32_combine_gen64 +# ifndef Z_LARGE64 + Z_EXTERN gzFile Z_EXPORT gzopen64(const char *, const char *); + Z_EXTERN z_off_t Z_EXPORT gzseek64(gzFile, z_off_t, int); + Z_EXTERN z_off_t Z_EXPORT gztell64(gzFile); + Z_EXTERN z_off_t Z_EXPORT gzoffset64(gzFile); + Z_EXTERN unsigned long Z_EXPORT adler32_combine64(unsigned long, unsigned long, z_off_t); + Z_EXTERN unsigned long Z_EXPORT crc32_combine64(unsigned long, unsigned long, z_off_t); + Z_EXTERN unsigned long Z_EXPORT crc32_combine_gen64(z_off64_t); +# endif +#else +# ifndef Z_SOLO + Z_EXTERN gzFile Z_EXPORT gzopen(const char *, const char *); + Z_EXTERN z_off_t Z_EXPORT gzseek(gzFile, z_off_t, int); + Z_EXTERN z_off_t Z_EXPORT gztell(gzFile); + Z_EXTERN z_off_t Z_EXPORT gzoffset(gzFile); +# endif + Z_EXTERN unsigned long Z_EXPORT adler32_combine(unsigned long, unsigned long, z_off_t); + Z_EXTERN unsigned long Z_EXPORT crc32_combine(unsigned long, unsigned long, z_off_t); + Z_EXTERN unsigned long Z_EXPORT crc32_combine_gen(z_off_t); +#endif + +/* undocumented functions */ +Z_EXTERN const char * Z_EXPORT zError (int); +Z_EXTERN int Z_EXPORT inflateSyncPoint (z_stream *); +Z_EXTERN const uint32_t * Z_EXPORT get_crc_table (void); +Z_EXTERN int Z_EXPORT inflateUndermine (z_stream *, int); +Z_EXTERN int Z_EXPORT inflateValidate (z_stream *, int); +Z_EXTERN unsigned long Z_EXPORT inflateCodesUsed (z_stream *); +Z_EXTERN int Z_EXPORT inflateResetKeep (z_stream *); +Z_EXTERN int Z_EXPORT deflateResetKeep (z_stream *); + +#ifndef Z_SOLO +#if defined(_WIN32) + Z_EXTERN gzFile Z_EXPORT gzopen_w(const wchar_t *path, const char *mode); +#endif +Z_EXTERN int Z_EXPORTVA gzvprintf(gzFile file, const char *format, va_list va); +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* ZLIB_H_ */ diff --git a/curl/include/zlib_name_mangling.h b/curl/include/zlib_name_mangling.h new file mode 100644 index 0000000..b24cb83 --- /dev/null +++ b/curl/include/zlib_name_mangling.h @@ -0,0 +1,8 @@ +/* zlib_name_mangling.h has been automatically generated from + * zlib_name_mangling.h.empty because ZLIB_SYMBOL_PREFIX was NOT set. + */ + +#ifndef ZLIB_NAME_MANGLING_H +#define ZLIB_NAME_MANGLING_H + +#endif /* ZLIB_NAME_MANGLING_H */ diff --git a/curl/include/zstd.h b/curl/include/zstd.h new file mode 100644 index 0000000..b8c0644 --- /dev/null +++ b/curl/include/zstd.h @@ -0,0 +1,3198 @@ +/* + * Copyright (c) Meta Platforms, Inc. and affiliates. + * All rights reserved. + * + * This source code is licensed under both the BSD-style license (found in the + * LICENSE file in the root directory of this source tree) and the GPLv2 (found + * in the COPYING file in the root directory of this source tree). + * You may select, at your option, one of the above-listed licenses. + */ + +#ifndef ZSTD_H_235446 +#define ZSTD_H_235446 + + +/* ====== Dependencies ======*/ +#include /* size_t */ + +#include "zstd_errors.h" /* list of errors */ +#if defined(ZSTD_STATIC_LINKING_ONLY) && !defined(ZSTD_H_ZSTD_STATIC_LINKING_ONLY) +#include /* INT_MAX */ +#endif /* ZSTD_STATIC_LINKING_ONLY */ + +#if defined (__cplusplus) +extern "C" { +#endif + +/* ===== ZSTDLIB_API : control library symbols visibility ===== */ +#ifndef ZSTDLIB_VISIBLE + /* Backwards compatibility with old macro name */ +# ifdef ZSTDLIB_VISIBILITY +# define ZSTDLIB_VISIBLE ZSTDLIB_VISIBILITY +# elif defined(__GNUC__) && (__GNUC__ >= 4) && !defined(__MINGW32__) +# define ZSTDLIB_VISIBLE __attribute__ ((visibility ("default"))) +# else +# define ZSTDLIB_VISIBLE +# endif +#endif + +#ifndef ZSTDLIB_HIDDEN +# if defined(__GNUC__) && (__GNUC__ >= 4) && !defined(__MINGW32__) +# define ZSTDLIB_HIDDEN __attribute__ ((visibility ("hidden"))) +# else +# define ZSTDLIB_HIDDEN +# endif +#endif + +#if defined(ZSTD_DLL_EXPORT) && (ZSTD_DLL_EXPORT==1) +# define ZSTDLIB_API __declspec(dllexport) ZSTDLIB_VISIBLE +#elif defined(ZSTD_DLL_IMPORT) && (ZSTD_DLL_IMPORT==1) +# define ZSTDLIB_API __declspec(dllimport) ZSTDLIB_VISIBLE /* It isn't required but allows to generate better code, saving a function pointer load from the IAT and an indirect jump.*/ +#else +# define ZSTDLIB_API ZSTDLIB_VISIBLE +#endif + +/* Deprecation warnings : + * Should these warnings be a problem, it is generally possible to disable them, + * typically with -Wno-deprecated-declarations for gcc or _CRT_SECURE_NO_WARNINGS in Visual. + * Otherwise, it's also possible to define ZSTD_DISABLE_DEPRECATE_WARNINGS. + */ +#ifdef ZSTD_DISABLE_DEPRECATE_WARNINGS +# define ZSTD_DEPRECATED(message) /* disable deprecation warnings */ +#else +# if defined (__cplusplus) && (__cplusplus >= 201402) /* C++14 or greater */ +# define ZSTD_DEPRECATED(message) [[deprecated(message)]] +# elif (defined(GNUC) && (GNUC > 4 || (GNUC == 4 && GNUC_MINOR >= 5))) || defined(__clang__) || defined(__IAR_SYSTEMS_ICC__) +# define ZSTD_DEPRECATED(message) __attribute__((deprecated(message))) +# elif defined(__GNUC__) && (__GNUC__ >= 3) +# define ZSTD_DEPRECATED(message) __attribute__((deprecated)) +# elif defined(_MSC_VER) +# define ZSTD_DEPRECATED(message) __declspec(deprecated(message)) +# else +# pragma message("WARNING: You need to implement ZSTD_DEPRECATED for this compiler") +# define ZSTD_DEPRECATED(message) +# endif +#endif /* ZSTD_DISABLE_DEPRECATE_WARNINGS */ + + +/******************************************************************************* + Introduction + + zstd, short for Zstandard, is a fast lossless compression algorithm, targeting + real-time compression scenarios at zlib-level and better compression ratios. + The zstd compression library provides in-memory compression and decompression + functions. + + The library supports regular compression levels from 1 up to ZSTD_maxCLevel(), + which is currently 22. Levels >= 20, labeled `--ultra`, should be used with + caution, as they require more memory. The library also offers negative + compression levels, which extend the range of speed vs. ratio preferences. + The lower the level, the faster the speed (at the cost of compression). + + Compression can be done in: + - a single step (described as Simple API) + - a single step, reusing a context (described as Explicit context) + - unbounded multiple steps (described as Streaming compression) + + The compression ratio achievable on small data can be highly improved using + a dictionary. Dictionary compression can be performed in: + - a single step (described as Simple dictionary API) + - a single step, reusing a dictionary (described as Bulk-processing + dictionary API) + + Advanced experimental functions can be accessed using + `#define ZSTD_STATIC_LINKING_ONLY` before including zstd.h. + + Advanced experimental APIs should never be used with a dynamically-linked + library. They are not "stable"; their definitions or signatures may change in + the future. Only static linking is allowed. +*******************************************************************************/ + +/*------ Version ------*/ +#define ZSTD_VERSION_MAJOR 1 +#define ZSTD_VERSION_MINOR 5 +#define ZSTD_VERSION_RELEASE 7 +#define ZSTD_VERSION_NUMBER (ZSTD_VERSION_MAJOR *100*100 + ZSTD_VERSION_MINOR *100 + ZSTD_VERSION_RELEASE) + +/*! ZSTD_versionNumber() : + * Return runtime library version, the value is (MAJOR*100*100 + MINOR*100 + RELEASE). */ +ZSTDLIB_API unsigned ZSTD_versionNumber(void); + +#define ZSTD_LIB_VERSION ZSTD_VERSION_MAJOR.ZSTD_VERSION_MINOR.ZSTD_VERSION_RELEASE +#define ZSTD_QUOTE(str) #str +#define ZSTD_EXPAND_AND_QUOTE(str) ZSTD_QUOTE(str) +#define ZSTD_VERSION_STRING ZSTD_EXPAND_AND_QUOTE(ZSTD_LIB_VERSION) + +/*! ZSTD_versionString() : + * Return runtime library version, like "1.4.5". Requires v1.3.0+. */ +ZSTDLIB_API const char* ZSTD_versionString(void); + +/* ************************************* + * Default constant + ***************************************/ +#ifndef ZSTD_CLEVEL_DEFAULT +# define ZSTD_CLEVEL_DEFAULT 3 +#endif + +/* ************************************* + * Constants + ***************************************/ + +/* All magic numbers are supposed read/written to/from files/memory using little-endian convention */ +#define ZSTD_MAGICNUMBER 0xFD2FB528 /* valid since v0.8.0 */ +#define ZSTD_MAGIC_DICTIONARY 0xEC30A437 /* valid since v0.7.0 */ +#define ZSTD_MAGIC_SKIPPABLE_START 0x184D2A50 /* all 16 values, from 0x184D2A50 to 0x184D2A5F, signal the beginning of a skippable frame */ +#define ZSTD_MAGIC_SKIPPABLE_MASK 0xFFFFFFF0 + +#define ZSTD_BLOCKSIZELOG_MAX 17 +#define ZSTD_BLOCKSIZE_MAX (1<= ZSTD_compressBound(srcSize)` guarantees that zstd will have + * enough space to successfully compress the data. + * @return : compressed size written into `dst` (<= `dstCapacity), + * or an error code if it fails (which can be tested using ZSTD_isError()). */ +ZSTDLIB_API size_t ZSTD_compress( void* dst, size_t dstCapacity, + const void* src, size_t srcSize, + int compressionLevel); + +/*! ZSTD_decompress() : + * `compressedSize` : must be the _exact_ size of some number of compressed and/or skippable frames. + * Multiple compressed frames can be decompressed at once with this method. + * The result will be the concatenation of all decompressed frames, back to back. + * `dstCapacity` is an upper bound of originalSize to regenerate. + * First frame's decompressed size can be extracted using ZSTD_getFrameContentSize(). + * If maximum upper bound isn't known, prefer using streaming mode to decompress data. + * @return : the number of bytes decompressed into `dst` (<= `dstCapacity`), + * or an errorCode if it fails (which can be tested using ZSTD_isError()). */ +ZSTDLIB_API size_t ZSTD_decompress( void* dst, size_t dstCapacity, + const void* src, size_t compressedSize); + + +/*====== Decompression helper functions ======*/ + +/*! ZSTD_getFrameContentSize() : requires v1.3.0+ + * `src` should point to the start of a ZSTD encoded frame. + * `srcSize` must be at least as large as the frame header. + * hint : any size >= `ZSTD_frameHeaderSize_max` is large enough. + * @return : - decompressed size of `src` frame content, if known + * - ZSTD_CONTENTSIZE_UNKNOWN if the size cannot be determined + * - ZSTD_CONTENTSIZE_ERROR if an error occurred (e.g. invalid magic number, srcSize too small) + * note 1 : a 0 return value means the frame is valid but "empty". + * When invoking this method on a skippable frame, it will return 0. + * note 2 : decompressed size is an optional field, it may not be present (typically in streaming mode). + * When `return==ZSTD_CONTENTSIZE_UNKNOWN`, data to decompress could be any size. + * In which case, it's necessary to use streaming mode to decompress data. + * Optionally, application can rely on some implicit limit, + * as ZSTD_decompress() only needs an upper bound of decompressed size. + * (For example, data could be necessarily cut into blocks <= 16 KB). + * note 3 : decompressed size is always present when compression is completed using single-pass functions, + * such as ZSTD_compress(), ZSTD_compressCCtx() ZSTD_compress_usingDict() or ZSTD_compress_usingCDict(). + * note 4 : decompressed size can be very large (64-bits value), + * potentially larger than what local system can handle as a single memory segment. + * In which case, it's necessary to use streaming mode to decompress data. + * note 5 : If source is untrusted, decompressed size could be wrong or intentionally modified. + * Always ensure return value fits within application's authorized limits. + * Each application can set its own limits. + * note 6 : This function replaces ZSTD_getDecompressedSize() */ +#define ZSTD_CONTENTSIZE_UNKNOWN (0ULL - 1) +#define ZSTD_CONTENTSIZE_ERROR (0ULL - 2) +ZSTDLIB_API unsigned long long ZSTD_getFrameContentSize(const void *src, size_t srcSize); + +/*! ZSTD_getDecompressedSize() (obsolete): + * This function is now obsolete, in favor of ZSTD_getFrameContentSize(). + * Both functions work the same way, but ZSTD_getDecompressedSize() blends + * "empty", "unknown" and "error" results to the same return value (0), + * while ZSTD_getFrameContentSize() gives them separate return values. + * @return : decompressed size of `src` frame content _if known and not empty_, 0 otherwise. */ +ZSTD_DEPRECATED("Replaced by ZSTD_getFrameContentSize") +ZSTDLIB_API unsigned long long ZSTD_getDecompressedSize(const void* src, size_t srcSize); + +/*! ZSTD_findFrameCompressedSize() : Requires v1.4.0+ + * `src` should point to the start of a ZSTD frame or skippable frame. + * `srcSize` must be >= first frame size + * @return : the compressed size of the first frame starting at `src`, + * suitable to pass as `srcSize` to `ZSTD_decompress` or similar, + * or an error code if input is invalid + * Note 1: this method is called _find*() because it's not enough to read the header, + * it may have to scan through the frame's content, to reach its end. + * Note 2: this method also works with Skippable Frames. In which case, + * it returns the size of the complete skippable frame, + * which is always equal to its content size + 8 bytes for headers. */ +ZSTDLIB_API size_t ZSTD_findFrameCompressedSize(const void* src, size_t srcSize); + + +/*====== Compression helper functions ======*/ + +/*! ZSTD_compressBound() : + * maximum compressed size in worst case single-pass scenario. + * When invoking `ZSTD_compress()`, or any other one-pass compression function, + * it's recommended to provide @dstCapacity >= ZSTD_compressBound(srcSize) + * as it eliminates one potential failure scenario, + * aka not enough room in dst buffer to write the compressed frame. + * Note : ZSTD_compressBound() itself can fail, if @srcSize >= ZSTD_MAX_INPUT_SIZE . + * In which case, ZSTD_compressBound() will return an error code + * which can be tested using ZSTD_isError(). + * + * ZSTD_COMPRESSBOUND() : + * same as ZSTD_compressBound(), but as a macro. + * It can be used to produce constants, which can be useful for static allocation, + * for example to size a static array on stack. + * Will produce constant value 0 if srcSize is too large. + */ +#define ZSTD_MAX_INPUT_SIZE ((sizeof(size_t)==8) ? 0xFF00FF00FF00FF00ULL : 0xFF00FF00U) +#define ZSTD_COMPRESSBOUND(srcSize) (((size_t)(srcSize) >= ZSTD_MAX_INPUT_SIZE) ? 0 : (srcSize) + ((srcSize)>>8) + (((srcSize) < (128<<10)) ? (((128<<10) - (srcSize)) >> 11) /* margin, from 64 to 0 */ : 0)) /* this formula ensures that bound(A) + bound(B) <= bound(A+B) as long as A and B >= 128 KB */ +ZSTDLIB_API size_t ZSTD_compressBound(size_t srcSize); /*!< maximum compressed size in worst case single-pass scenario */ + + +/*====== Error helper functions ======*/ +/* ZSTD_isError() : + * Most ZSTD_* functions returning a size_t value can be tested for error, + * using ZSTD_isError(). + * @return 1 if error, 0 otherwise + */ +ZSTDLIB_API unsigned ZSTD_isError(size_t result); /*!< tells if a `size_t` function result is an error code */ +ZSTDLIB_API ZSTD_ErrorCode ZSTD_getErrorCode(size_t functionResult); /* convert a result into an error code, which can be compared to error enum list */ +ZSTDLIB_API const char* ZSTD_getErrorName(size_t result); /*!< provides readable string from a function result */ +ZSTDLIB_API int ZSTD_minCLevel(void); /*!< minimum negative compression level allowed, requires v1.4.0+ */ +ZSTDLIB_API int ZSTD_maxCLevel(void); /*!< maximum compression level available */ +ZSTDLIB_API int ZSTD_defaultCLevel(void); /*!< default compression level, specified by ZSTD_CLEVEL_DEFAULT, requires v1.5.0+ */ + + +/*************************************** +* Explicit context +***************************************/ +/*= Compression context + * When compressing many times, + * it is recommended to allocate a compression context just once, + * and reuse it for each successive compression operation. + * This will make the workload easier for system's memory. + * Note : re-using context is just a speed / resource optimization. + * It doesn't change the compression ratio, which remains identical. + * Note 2: For parallel execution in multi-threaded environments, + * use one different context per thread . + */ +typedef struct ZSTD_CCtx_s ZSTD_CCtx; +ZSTDLIB_API ZSTD_CCtx* ZSTD_createCCtx(void); +ZSTDLIB_API size_t ZSTD_freeCCtx(ZSTD_CCtx* cctx); /* compatible with NULL pointer */ + +/*! ZSTD_compressCCtx() : + * Same as ZSTD_compress(), using an explicit ZSTD_CCtx. + * Important : in order to mirror `ZSTD_compress()` behavior, + * this function compresses at the requested compression level, + * __ignoring any other advanced parameter__ . + * If any advanced parameter was set using the advanced API, + * they will all be reset. Only @compressionLevel remains. + */ +ZSTDLIB_API size_t ZSTD_compressCCtx(ZSTD_CCtx* cctx, + void* dst, size_t dstCapacity, + const void* src, size_t srcSize, + int compressionLevel); + +/*= Decompression context + * When decompressing many times, + * it is recommended to allocate a context only once, + * and reuse it for each successive compression operation. + * This will make workload friendlier for system's memory. + * Use one context per thread for parallel execution. */ +typedef struct ZSTD_DCtx_s ZSTD_DCtx; +ZSTDLIB_API ZSTD_DCtx* ZSTD_createDCtx(void); +ZSTDLIB_API size_t ZSTD_freeDCtx(ZSTD_DCtx* dctx); /* accept NULL pointer */ + +/*! ZSTD_decompressDCtx() : + * Same as ZSTD_decompress(), + * requires an allocated ZSTD_DCtx. + * Compatible with sticky parameters (see below). + */ +ZSTDLIB_API size_t ZSTD_decompressDCtx(ZSTD_DCtx* dctx, + void* dst, size_t dstCapacity, + const void* src, size_t srcSize); + + +/********************************************* +* Advanced compression API (Requires v1.4.0+) +**********************************************/ + +/* API design : + * Parameters are pushed one by one into an existing context, + * using ZSTD_CCtx_set*() functions. + * Pushed parameters are sticky : they are valid for next compressed frame, and any subsequent frame. + * "sticky" parameters are applicable to `ZSTD_compress2()` and `ZSTD_compressStream*()` ! + * __They do not apply to one-shot variants such as ZSTD_compressCCtx()__ . + * + * It's possible to reset all parameters to "default" using ZSTD_CCtx_reset(). + * + * This API supersedes all other "advanced" API entry points in the experimental section. + * In the future, we expect to remove API entry points from experimental which are redundant with this API. + */ + + +/* Compression strategies, listed from fastest to strongest */ +typedef enum { ZSTD_fast=1, + ZSTD_dfast=2, + ZSTD_greedy=3, + ZSTD_lazy=4, + ZSTD_lazy2=5, + ZSTD_btlazy2=6, + ZSTD_btopt=7, + ZSTD_btultra=8, + ZSTD_btultra2=9 + /* note : new strategies _might_ be added in the future. + Only the order (from fast to strong) is guaranteed */ +} ZSTD_strategy; + +typedef enum { + + /* compression parameters + * Note: When compressing with a ZSTD_CDict these parameters are superseded + * by the parameters used to construct the ZSTD_CDict. + * See ZSTD_CCtx_refCDict() for more info (superseded-by-cdict). */ + ZSTD_c_compressionLevel=100, /* Set compression parameters according to pre-defined cLevel table. + * Note that exact compression parameters are dynamically determined, + * depending on both compression level and srcSize (when known). + * Default level is ZSTD_CLEVEL_DEFAULT==3. + * Special: value 0 means default, which is controlled by ZSTD_CLEVEL_DEFAULT. + * Note 1 : it's possible to pass a negative compression level. + * Note 2 : setting a level does not automatically set all other compression parameters + * to default. Setting this will however eventually dynamically impact the compression + * parameters which have not been manually set. The manually set + * ones will 'stick'. */ + /* Advanced compression parameters : + * It's possible to pin down compression parameters to some specific values. + * In which case, these values are no longer dynamically selected by the compressor */ + ZSTD_c_windowLog=101, /* Maximum allowed back-reference distance, expressed as power of 2. + * This will set a memory budget for streaming decompression, + * with larger values requiring more memory + * and typically compressing more. + * Must be clamped between ZSTD_WINDOWLOG_MIN and ZSTD_WINDOWLOG_MAX. + * Special: value 0 means "use default windowLog". + * Note: Using a windowLog greater than ZSTD_WINDOWLOG_LIMIT_DEFAULT + * requires explicitly allowing such size at streaming decompression stage. */ + ZSTD_c_hashLog=102, /* Size of the initial probe table, as a power of 2. + * Resulting memory usage is (1 << (hashLog+2)). + * Must be clamped between ZSTD_HASHLOG_MIN and ZSTD_HASHLOG_MAX. + * Larger tables improve compression ratio of strategies <= dFast, + * and improve speed of strategies > dFast. + * Special: value 0 means "use default hashLog". */ + ZSTD_c_chainLog=103, /* Size of the multi-probe search table, as a power of 2. + * Resulting memory usage is (1 << (chainLog+2)). + * Must be clamped between ZSTD_CHAINLOG_MIN and ZSTD_CHAINLOG_MAX. + * Larger tables result in better and slower compression. + * This parameter is useless for "fast" strategy. + * It's still useful when using "dfast" strategy, + * in which case it defines a secondary probe table. + * Special: value 0 means "use default chainLog". */ + ZSTD_c_searchLog=104, /* Number of search attempts, as a power of 2. + * More attempts result in better and slower compression. + * This parameter is useless for "fast" and "dFast" strategies. + * Special: value 0 means "use default searchLog". */ + ZSTD_c_minMatch=105, /* Minimum size of searched matches. + * Note that Zstandard can still find matches of smaller size, + * it just tweaks its search algorithm to look for this size and larger. + * Larger values increase compression and decompression speed, but decrease ratio. + * Must be clamped between ZSTD_MINMATCH_MIN and ZSTD_MINMATCH_MAX. + * Note that currently, for all strategies < btopt, effective minimum is 4. + * , for all strategies > fast, effective maximum is 6. + * Special: value 0 means "use default minMatchLength". */ + ZSTD_c_targetLength=106, /* Impact of this field depends on strategy. + * For strategies btopt, btultra & btultra2: + * Length of Match considered "good enough" to stop search. + * Larger values make compression stronger, and slower. + * For strategy fast: + * Distance between match sampling. + * Larger values make compression faster, and weaker. + * Special: value 0 means "use default targetLength". */ + ZSTD_c_strategy=107, /* See ZSTD_strategy enum definition. + * The higher the value of selected strategy, the more complex it is, + * resulting in stronger and slower compression. + * Special: value 0 means "use default strategy". */ + + ZSTD_c_targetCBlockSize=130, /* v1.5.6+ + * Attempts to fit compressed block size into approximately targetCBlockSize. + * Bound by ZSTD_TARGETCBLOCKSIZE_MIN and ZSTD_TARGETCBLOCKSIZE_MAX. + * Note that it's not a guarantee, just a convergence target (default:0). + * No target when targetCBlockSize == 0. + * This is helpful in low bandwidth streaming environments to improve end-to-end latency, + * when a client can make use of partial documents (a prominent example being Chrome). + * Note: this parameter is stable since v1.5.6. + * It was present as an experimental parameter in earlier versions, + * but it's not recommended using it with earlier library versions + * due to massive performance regressions. + */ + /* LDM mode parameters */ + ZSTD_c_enableLongDistanceMatching=160, /* Enable long distance matching. + * This parameter is designed to improve compression ratio + * for large inputs, by finding large matches at long distance. + * It increases memory usage and window size. + * Note: enabling this parameter increases default ZSTD_c_windowLog to 128 MB + * except when expressly set to a different value. + * Note: will be enabled by default if ZSTD_c_windowLog >= 128 MB and + * compression strategy >= ZSTD_btopt (== compression level 16+) */ + ZSTD_c_ldmHashLog=161, /* Size of the table for long distance matching, as a power of 2. + * Larger values increase memory usage and compression ratio, + * but decrease compression speed. + * Must be clamped between ZSTD_HASHLOG_MIN and ZSTD_HASHLOG_MAX + * default: windowlog - 7. + * Special: value 0 means "automatically determine hashlog". */ + ZSTD_c_ldmMinMatch=162, /* Minimum match size for long distance matcher. + * Larger/too small values usually decrease compression ratio. + * Must be clamped between ZSTD_LDM_MINMATCH_MIN and ZSTD_LDM_MINMATCH_MAX. + * Special: value 0 means "use default value" (default: 64). */ + ZSTD_c_ldmBucketSizeLog=163, /* Log size of each bucket in the LDM hash table for collision resolution. + * Larger values improve collision resolution but decrease compression speed. + * The maximum value is ZSTD_LDM_BUCKETSIZELOG_MAX. + * Special: value 0 means "use default value" (default: 3). */ + ZSTD_c_ldmHashRateLog=164, /* Frequency of inserting/looking up entries into the LDM hash table. + * Must be clamped between 0 and (ZSTD_WINDOWLOG_MAX - ZSTD_HASHLOG_MIN). + * Default is MAX(0, (windowLog - ldmHashLog)), optimizing hash table usage. + * Larger values improve compression speed. + * Deviating far from default value will likely result in a compression ratio decrease. + * Special: value 0 means "automatically determine hashRateLog". */ + + /* frame parameters */ + ZSTD_c_contentSizeFlag=200, /* Content size will be written into frame header _whenever known_ (default:1) + * Content size must be known at the beginning of compression. + * This is automatically the case when using ZSTD_compress2(), + * For streaming scenarios, content size must be provided with ZSTD_CCtx_setPledgedSrcSize() */ + ZSTD_c_checksumFlag=201, /* A 32-bits checksum of content is written at end of frame (default:0) */ + ZSTD_c_dictIDFlag=202, /* When applicable, dictionary's ID is written into frame header (default:1) */ + + /* multi-threading parameters */ + /* These parameters are only active if multi-threading is enabled (compiled with build macro ZSTD_MULTITHREAD). + * Otherwise, trying to set any other value than default (0) will be a no-op and return an error. + * In a situation where it's unknown if the linked library supports multi-threading or not, + * setting ZSTD_c_nbWorkers to any value >= 1 and consulting the return value provides a quick way to check this property. + */ + ZSTD_c_nbWorkers=400, /* Select how many threads will be spawned to compress in parallel. + * When nbWorkers >= 1, triggers asynchronous mode when invoking ZSTD_compressStream*() : + * ZSTD_compressStream*() consumes input and flush output if possible, but immediately gives back control to caller, + * while compression is performed in parallel, within worker thread(s). + * (note : a strong exception to this rule is when first invocation of ZSTD_compressStream2() sets ZSTD_e_end : + * in which case, ZSTD_compressStream2() delegates to ZSTD_compress2(), which is always a blocking call). + * More workers improve speed, but also increase memory usage. + * Default value is `0`, aka "single-threaded mode" : no worker is spawned, + * compression is performed inside Caller's thread, and all invocations are blocking */ + ZSTD_c_jobSize=401, /* Size of a compression job. This value is enforced only when nbWorkers >= 1. + * Each compression job is completed in parallel, so this value can indirectly impact the nb of active threads. + * 0 means default, which is dynamically determined based on compression parameters. + * Job size must be a minimum of overlap size, or ZSTDMT_JOBSIZE_MIN (= 512 KB), whichever is largest. + * The minimum size is automatically and transparently enforced. */ + ZSTD_c_overlapLog=402, /* Control the overlap size, as a fraction of window size. + * The overlap size is an amount of data reloaded from previous job at the beginning of a new job. + * It helps preserve compression ratio, while each job is compressed in parallel. + * This value is enforced only when nbWorkers >= 1. + * Larger values increase compression ratio, but decrease speed. + * Possible values range from 0 to 9 : + * - 0 means "default" : value will be determined by the library, depending on strategy + * - 1 means "no overlap" + * - 9 means "full overlap", using a full window size. + * Each intermediate rank increases/decreases load size by a factor 2 : + * 9: full window; 8: w/2; 7: w/4; 6: w/8; 5:w/16; 4: w/32; 3:w/64; 2:w/128; 1:no overlap; 0:default + * default value varies between 6 and 9, depending on strategy */ + + /* note : additional experimental parameters are also available + * within the experimental section of the API. + * At the time of this writing, they include : + * ZSTD_c_rsyncable + * ZSTD_c_format + * ZSTD_c_forceMaxWindow + * ZSTD_c_forceAttachDict + * ZSTD_c_literalCompressionMode + * ZSTD_c_srcSizeHint + * ZSTD_c_enableDedicatedDictSearch + * ZSTD_c_stableInBuffer + * ZSTD_c_stableOutBuffer + * ZSTD_c_blockDelimiters + * ZSTD_c_validateSequences + * ZSTD_c_blockSplitterLevel + * ZSTD_c_splitAfterSequences + * ZSTD_c_useRowMatchFinder + * ZSTD_c_prefetchCDictTables + * ZSTD_c_enableSeqProducerFallback + * ZSTD_c_maxBlockSize + * Because they are not stable, it's necessary to define ZSTD_STATIC_LINKING_ONLY to access them. + * note : never ever use experimentalParam? names directly; + * also, the enums values themselves are unstable and can still change. + */ + ZSTD_c_experimentalParam1=500, + ZSTD_c_experimentalParam2=10, + ZSTD_c_experimentalParam3=1000, + ZSTD_c_experimentalParam4=1001, + ZSTD_c_experimentalParam5=1002, + /* was ZSTD_c_experimentalParam6=1003; is now ZSTD_c_targetCBlockSize */ + ZSTD_c_experimentalParam7=1004, + ZSTD_c_experimentalParam8=1005, + ZSTD_c_experimentalParam9=1006, + ZSTD_c_experimentalParam10=1007, + ZSTD_c_experimentalParam11=1008, + ZSTD_c_experimentalParam12=1009, + ZSTD_c_experimentalParam13=1010, + ZSTD_c_experimentalParam14=1011, + ZSTD_c_experimentalParam15=1012, + ZSTD_c_experimentalParam16=1013, + ZSTD_c_experimentalParam17=1014, + ZSTD_c_experimentalParam18=1015, + ZSTD_c_experimentalParam19=1016, + ZSTD_c_experimentalParam20=1017 +} ZSTD_cParameter; + +typedef struct { + size_t error; + int lowerBound; + int upperBound; +} ZSTD_bounds; + +/*! ZSTD_cParam_getBounds() : + * All parameters must belong to an interval with lower and upper bounds, + * otherwise they will either trigger an error or be automatically clamped. + * @return : a structure, ZSTD_bounds, which contains + * - an error status field, which must be tested using ZSTD_isError() + * - lower and upper bounds, both inclusive + */ +ZSTDLIB_API ZSTD_bounds ZSTD_cParam_getBounds(ZSTD_cParameter cParam); + +/*! ZSTD_CCtx_setParameter() : + * Set one compression parameter, selected by enum ZSTD_cParameter. + * All parameters have valid bounds. Bounds can be queried using ZSTD_cParam_getBounds(). + * Providing a value beyond bound will either clamp it, or trigger an error (depending on parameter). + * Setting a parameter is generally only possible during frame initialization (before starting compression). + * Exception : when using multi-threading mode (nbWorkers >= 1), + * the following parameters can be updated _during_ compression (within same frame): + * => compressionLevel, hashLog, chainLog, searchLog, minMatch, targetLength and strategy. + * new parameters will be active for next job only (after a flush()). + * @return : an error code (which can be tested using ZSTD_isError()). + */ +ZSTDLIB_API size_t ZSTD_CCtx_setParameter(ZSTD_CCtx* cctx, ZSTD_cParameter param, int value); + +/*! ZSTD_CCtx_setPledgedSrcSize() : + * Total input data size to be compressed as a single frame. + * Value will be written in frame header, unless if explicitly forbidden using ZSTD_c_contentSizeFlag. + * This value will also be controlled at end of frame, and trigger an error if not respected. + * @result : 0, or an error code (which can be tested with ZSTD_isError()). + * Note 1 : pledgedSrcSize==0 actually means zero, aka an empty frame. + * In order to mean "unknown content size", pass constant ZSTD_CONTENTSIZE_UNKNOWN. + * ZSTD_CONTENTSIZE_UNKNOWN is default value for any new frame. + * Note 2 : pledgedSrcSize is only valid once, for the next frame. + * It's discarded at the end of the frame, and replaced by ZSTD_CONTENTSIZE_UNKNOWN. + * Note 3 : Whenever all input data is provided and consumed in a single round, + * for example with ZSTD_compress2(), + * or invoking immediately ZSTD_compressStream2(,,,ZSTD_e_end), + * this value is automatically overridden by srcSize instead. + */ +ZSTDLIB_API size_t ZSTD_CCtx_setPledgedSrcSize(ZSTD_CCtx* cctx, unsigned long long pledgedSrcSize); + +typedef enum { + ZSTD_reset_session_only = 1, + ZSTD_reset_parameters = 2, + ZSTD_reset_session_and_parameters = 3 +} ZSTD_ResetDirective; + +/*! ZSTD_CCtx_reset() : + * There are 2 different things that can be reset, independently or jointly : + * - The session : will stop compressing current frame, and make CCtx ready to start a new one. + * Useful after an error, or to interrupt any ongoing compression. + * Any internal data not yet flushed is cancelled. + * Compression parameters and dictionary remain unchanged. + * They will be used to compress next frame. + * Resetting session never fails. + * - The parameters : changes all parameters back to "default". + * This also removes any reference to any dictionary or external sequence producer. + * Parameters can only be changed between 2 sessions (i.e. no compression is currently ongoing) + * otherwise the reset fails, and function returns an error value (which can be tested using ZSTD_isError()) + * - Both : similar to resetting the session, followed by resetting parameters. + */ +ZSTDLIB_API size_t ZSTD_CCtx_reset(ZSTD_CCtx* cctx, ZSTD_ResetDirective reset); + +/*! ZSTD_compress2() : + * Behave the same as ZSTD_compressCCtx(), but compression parameters are set using the advanced API. + * (note that this entry point doesn't even expose a compression level parameter). + * ZSTD_compress2() always starts a new frame. + * Should cctx hold data from a previously unfinished frame, everything about it is forgotten. + * - Compression parameters are pushed into CCtx before starting compression, using ZSTD_CCtx_set*() + * - The function is always blocking, returns when compression is completed. + * NOTE: Providing `dstCapacity >= ZSTD_compressBound(srcSize)` guarantees that zstd will have + * enough space to successfully compress the data, though it is possible it fails for other reasons. + * @return : compressed size written into `dst` (<= `dstCapacity), + * or an error code if it fails (which can be tested using ZSTD_isError()). + */ +ZSTDLIB_API size_t ZSTD_compress2( ZSTD_CCtx* cctx, + void* dst, size_t dstCapacity, + const void* src, size_t srcSize); + + +/*********************************************** +* Advanced decompression API (Requires v1.4.0+) +************************************************/ + +/* The advanced API pushes parameters one by one into an existing DCtx context. + * Parameters are sticky, and remain valid for all following frames + * using the same DCtx context. + * It's possible to reset parameters to default values using ZSTD_DCtx_reset(). + * Note : This API is compatible with existing ZSTD_decompressDCtx() and ZSTD_decompressStream(). + * Therefore, no new decompression function is necessary. + */ + +typedef enum { + + ZSTD_d_windowLogMax=100, /* Select a size limit (in power of 2) beyond which + * the streaming API will refuse to allocate memory buffer + * in order to protect the host from unreasonable memory requirements. + * This parameter is only useful in streaming mode, since no internal buffer is allocated in single-pass mode. + * By default, a decompression context accepts window sizes <= (1 << ZSTD_WINDOWLOG_LIMIT_DEFAULT). + * Special: value 0 means "use default maximum windowLog". */ + + /* note : additional experimental parameters are also available + * within the experimental section of the API. + * At the time of this writing, they include : + * ZSTD_d_format + * ZSTD_d_stableOutBuffer + * ZSTD_d_forceIgnoreChecksum + * ZSTD_d_refMultipleDDicts + * ZSTD_d_disableHuffmanAssembly + * ZSTD_d_maxBlockSize + * Because they are not stable, it's necessary to define ZSTD_STATIC_LINKING_ONLY to access them. + * note : never ever use experimentalParam? names directly + */ + ZSTD_d_experimentalParam1=1000, + ZSTD_d_experimentalParam2=1001, + ZSTD_d_experimentalParam3=1002, + ZSTD_d_experimentalParam4=1003, + ZSTD_d_experimentalParam5=1004, + ZSTD_d_experimentalParam6=1005 + +} ZSTD_dParameter; + +/*! ZSTD_dParam_getBounds() : + * All parameters must belong to an interval with lower and upper bounds, + * otherwise they will either trigger an error or be automatically clamped. + * @return : a structure, ZSTD_bounds, which contains + * - an error status field, which must be tested using ZSTD_isError() + * - both lower and upper bounds, inclusive + */ +ZSTDLIB_API ZSTD_bounds ZSTD_dParam_getBounds(ZSTD_dParameter dParam); + +/*! ZSTD_DCtx_setParameter() : + * Set one compression parameter, selected by enum ZSTD_dParameter. + * All parameters have valid bounds. Bounds can be queried using ZSTD_dParam_getBounds(). + * Providing a value beyond bound will either clamp it, or trigger an error (depending on parameter). + * Setting a parameter is only possible during frame initialization (before starting decompression). + * @return : 0, or an error code (which can be tested using ZSTD_isError()). + */ +ZSTDLIB_API size_t ZSTD_DCtx_setParameter(ZSTD_DCtx* dctx, ZSTD_dParameter param, int value); + +/*! ZSTD_DCtx_reset() : + * Return a DCtx to clean state. + * Session and parameters can be reset jointly or separately. + * Parameters can only be reset when no active frame is being decompressed. + * @return : 0, or an error code, which can be tested with ZSTD_isError() + */ +ZSTDLIB_API size_t ZSTD_DCtx_reset(ZSTD_DCtx* dctx, ZSTD_ResetDirective reset); + + +/**************************** +* Streaming +****************************/ + +typedef struct ZSTD_inBuffer_s { + const void* src; /**< start of input buffer */ + size_t size; /**< size of input buffer */ + size_t pos; /**< position where reading stopped. Will be updated. Necessarily 0 <= pos <= size */ +} ZSTD_inBuffer; + +typedef struct ZSTD_outBuffer_s { + void* dst; /**< start of output buffer */ + size_t size; /**< size of output buffer */ + size_t pos; /**< position where writing stopped. Will be updated. Necessarily 0 <= pos <= size */ +} ZSTD_outBuffer; + + + +/*-*********************************************************************** +* Streaming compression - HowTo +* +* A ZSTD_CStream object is required to track streaming operation. +* Use ZSTD_createCStream() and ZSTD_freeCStream() to create/release resources. +* ZSTD_CStream objects can be reused multiple times on consecutive compression operations. +* It is recommended to reuse ZSTD_CStream since it will play nicer with system's memory, by re-using already allocated memory. +* +* For parallel execution, use one separate ZSTD_CStream per thread. +* +* note : since v1.3.0, ZSTD_CStream and ZSTD_CCtx are the same thing. +* +* Parameters are sticky : when starting a new compression on the same context, +* it will reuse the same sticky parameters as previous compression session. +* When in doubt, it's recommended to fully initialize the context before usage. +* Use ZSTD_CCtx_reset() to reset the context and ZSTD_CCtx_setParameter(), +* ZSTD_CCtx_setPledgedSrcSize(), or ZSTD_CCtx_loadDictionary() and friends to +* set more specific parameters, the pledged source size, or load a dictionary. +* +* Use ZSTD_compressStream2() with ZSTD_e_continue as many times as necessary to +* consume input stream. The function will automatically update both `pos` +* fields within `input` and `output`. +* Note that the function may not consume the entire input, for example, because +* the output buffer is already full, in which case `input.pos < input.size`. +* The caller must check if input has been entirely consumed. +* If not, the caller must make some room to receive more compressed data, +* and then present again remaining input data. +* note: ZSTD_e_continue is guaranteed to make some forward progress when called, +* but doesn't guarantee maximal forward progress. This is especially relevant +* when compressing with multiple threads. The call won't block if it can +* consume some input, but if it can't it will wait for some, but not all, +* output to be flushed. +* @return : provides a minimum amount of data remaining to be flushed from internal buffers +* or an error code, which can be tested using ZSTD_isError(). +* +* At any moment, it's possible to flush whatever data might remain stuck within internal buffer, +* using ZSTD_compressStream2() with ZSTD_e_flush. `output->pos` will be updated. +* Note that, if `output->size` is too small, a single invocation with ZSTD_e_flush might not be enough (return code > 0). +* In which case, make some room to receive more compressed data, and call again ZSTD_compressStream2() with ZSTD_e_flush. +* You must continue calling ZSTD_compressStream2() with ZSTD_e_flush until it returns 0, at which point you can change the +* operation. +* note: ZSTD_e_flush will flush as much output as possible, meaning when compressing with multiple threads, it will +* block until the flush is complete or the output buffer is full. +* @return : 0 if internal buffers are entirely flushed, +* >0 if some data still present within internal buffer (the value is minimal estimation of remaining size), +* or an error code, which can be tested using ZSTD_isError(). +* +* Calling ZSTD_compressStream2() with ZSTD_e_end instructs to finish a frame. +* It will perform a flush and write frame epilogue. +* The epilogue is required for decoders to consider a frame completed. +* flush operation is the same, and follows same rules as calling ZSTD_compressStream2() with ZSTD_e_flush. +* You must continue calling ZSTD_compressStream2() with ZSTD_e_end until it returns 0, at which point you are free to +* start a new frame. +* note: ZSTD_e_end will flush as much output as possible, meaning when compressing with multiple threads, it will +* block until the flush is complete or the output buffer is full. +* @return : 0 if frame fully completed and fully flushed, +* >0 if some data still present within internal buffer (the value is minimal estimation of remaining size), +* or an error code, which can be tested using ZSTD_isError(). +* +* *******************************************************************/ + +typedef ZSTD_CCtx ZSTD_CStream; /**< CCtx and CStream are now effectively same object (>= v1.3.0) */ + /* Continue to distinguish them for compatibility with older versions <= v1.2.0 */ +/*===== ZSTD_CStream management functions =====*/ +ZSTDLIB_API ZSTD_CStream* ZSTD_createCStream(void); +ZSTDLIB_API size_t ZSTD_freeCStream(ZSTD_CStream* zcs); /* accept NULL pointer */ + +/*===== Streaming compression functions =====*/ +typedef enum { + ZSTD_e_continue=0, /* collect more data, encoder decides when to output compressed result, for optimal compression ratio */ + ZSTD_e_flush=1, /* flush any data provided so far, + * it creates (at least) one new block, that can be decoded immediately on reception; + * frame will continue: any future data can still reference previously compressed data, improving compression. + * note : multithreaded compression will block to flush as much output as possible. */ + ZSTD_e_end=2 /* flush any remaining data _and_ close current frame. + * note that frame is only closed after compressed data is fully flushed (return value == 0). + * After that point, any additional data starts a new frame. + * note : each frame is independent (does not reference any content from previous frame). + : note : multithreaded compression will block to flush as much output as possible. */ +} ZSTD_EndDirective; + +/*! ZSTD_compressStream2() : Requires v1.4.0+ + * Behaves about the same as ZSTD_compressStream, with additional control on end directive. + * - Compression parameters are pushed into CCtx before starting compression, using ZSTD_CCtx_set*() + * - Compression parameters cannot be changed once compression is started (save a list of exceptions in multi-threading mode) + * - output->pos must be <= dstCapacity, input->pos must be <= srcSize + * - output->pos and input->pos will be updated. They are guaranteed to remain below their respective limit. + * - endOp must be a valid directive + * - When nbWorkers==0 (default), function is blocking : it completes its job before returning to caller. + * - When nbWorkers>=1, function is non-blocking : it copies a portion of input, distributes jobs to internal worker threads, flush to output whatever is available, + * and then immediately returns, just indicating that there is some data remaining to be flushed. + * The function nonetheless guarantees forward progress : it will return only after it reads or write at least 1+ byte. + * - Exception : if the first call requests a ZSTD_e_end directive and provides enough dstCapacity, the function delegates to ZSTD_compress2() which is always blocking. + * - @return provides a minimum amount of data remaining to be flushed from internal buffers + * or an error code, which can be tested using ZSTD_isError(). + * if @return != 0, flush is not fully completed, there is still some data left within internal buffers. + * This is useful for ZSTD_e_flush, since in this case more flushes are necessary to empty all buffers. + * For ZSTD_e_end, @return == 0 when internal buffers are fully flushed and frame is completed. + * - after a ZSTD_e_end directive, if internal buffer is not fully flushed (@return != 0), + * only ZSTD_e_end or ZSTD_e_flush operations are allowed. + * Before starting a new compression job, or changing compression parameters, + * it is required to fully flush internal buffers. + * - note: if an operation ends with an error, it may leave @cctx in an undefined state. + * Therefore, it's UB to invoke ZSTD_compressStream2() of ZSTD_compressStream() on such a state. + * In order to be re-employed after an error, a state must be reset, + * which can be done explicitly (ZSTD_CCtx_reset()), + * or is sometimes implied by methods starting a new compression job (ZSTD_initCStream(), ZSTD_compressCCtx()) + */ +ZSTDLIB_API size_t ZSTD_compressStream2( ZSTD_CCtx* cctx, + ZSTD_outBuffer* output, + ZSTD_inBuffer* input, + ZSTD_EndDirective endOp); + + +/* These buffer sizes are softly recommended. + * They are not required : ZSTD_compressStream*() happily accepts any buffer size, for both input and output. + * Respecting the recommended size just makes it a bit easier for ZSTD_compressStream*(), + * reducing the amount of memory shuffling and buffering, resulting in minor performance savings. + * + * However, note that these recommendations are from the perspective of a C caller program. + * If the streaming interface is invoked from some other language, + * especially managed ones such as Java or Go, through a foreign function interface such as jni or cgo, + * a major performance rule is to reduce crossing such interface to an absolute minimum. + * It's not rare that performance ends being spent more into the interface, rather than compression itself. + * In which cases, prefer using large buffers, as large as practical, + * for both input and output, to reduce the nb of roundtrips. + */ +ZSTDLIB_API size_t ZSTD_CStreamInSize(void); /**< recommended size for input buffer */ +ZSTDLIB_API size_t ZSTD_CStreamOutSize(void); /**< recommended size for output buffer. Guarantee to successfully flush at least one complete compressed block. */ + + +/* ***************************************************************************** + * This following is a legacy streaming API, available since v1.0+ . + * It can be replaced by ZSTD_CCtx_reset() and ZSTD_compressStream2(). + * It is redundant, but remains fully supported. + ******************************************************************************/ + +/*! + * Equivalent to: + * + * ZSTD_CCtx_reset(zcs, ZSTD_reset_session_only); + * ZSTD_CCtx_refCDict(zcs, NULL); // clear the dictionary (if any) + * ZSTD_CCtx_setParameter(zcs, ZSTD_c_compressionLevel, compressionLevel); + * + * Note that ZSTD_initCStream() clears any previously set dictionary. Use the new API + * to compress with a dictionary. + */ +ZSTDLIB_API size_t ZSTD_initCStream(ZSTD_CStream* zcs, int compressionLevel); +/*! + * Alternative for ZSTD_compressStream2(zcs, output, input, ZSTD_e_continue). + * NOTE: The return value is different. ZSTD_compressStream() returns a hint for + * the next read size (if non-zero and not an error). ZSTD_compressStream2() + * returns the minimum nb of bytes left to flush (if non-zero and not an error). + */ +ZSTDLIB_API size_t ZSTD_compressStream(ZSTD_CStream* zcs, ZSTD_outBuffer* output, ZSTD_inBuffer* input); +/*! Equivalent to ZSTD_compressStream2(zcs, output, &emptyInput, ZSTD_e_flush). */ +ZSTDLIB_API size_t ZSTD_flushStream(ZSTD_CStream* zcs, ZSTD_outBuffer* output); +/*! Equivalent to ZSTD_compressStream2(zcs, output, &emptyInput, ZSTD_e_end). */ +ZSTDLIB_API size_t ZSTD_endStream(ZSTD_CStream* zcs, ZSTD_outBuffer* output); + + +/*-*************************************************************************** +* Streaming decompression - HowTo +* +* A ZSTD_DStream object is required to track streaming operations. +* Use ZSTD_createDStream() and ZSTD_freeDStream() to create/release resources. +* ZSTD_DStream objects can be re-employed multiple times. +* +* Use ZSTD_initDStream() to start a new decompression operation. +* @return : recommended first input size +* Alternatively, use advanced API to set specific properties. +* +* Use ZSTD_decompressStream() repetitively to consume your input. +* The function will update both `pos` fields. +* If `input.pos < input.size`, some input has not been consumed. +* It's up to the caller to present again remaining data. +* +* The function tries to flush all data decoded immediately, respecting output buffer size. +* If `output.pos < output.size`, decoder has flushed everything it could. +* +* However, when `output.pos == output.size`, it's more difficult to know. +* If @return > 0, the frame is not complete, meaning +* either there is still some data left to flush within internal buffers, +* or there is more input to read to complete the frame (or both). +* In which case, call ZSTD_decompressStream() again to flush whatever remains in the buffer. +* Note : with no additional input provided, amount of data flushed is necessarily <= ZSTD_BLOCKSIZE_MAX. +* @return : 0 when a frame is completely decoded and fully flushed, +* or an error code, which can be tested using ZSTD_isError(), +* or any other value > 0, which means there is still some decoding or flushing to do to complete current frame : +* the return value is a suggested next input size (just a hint for better latency) +* that will never request more than the remaining content of the compressed frame. +* *******************************************************************************/ + +typedef ZSTD_DCtx ZSTD_DStream; /**< DCtx and DStream are now effectively same object (>= v1.3.0) */ + /* For compatibility with versions <= v1.2.0, prefer differentiating them. */ +/*===== ZSTD_DStream management functions =====*/ +ZSTDLIB_API ZSTD_DStream* ZSTD_createDStream(void); +ZSTDLIB_API size_t ZSTD_freeDStream(ZSTD_DStream* zds); /* accept NULL pointer */ + +/*===== Streaming decompression functions =====*/ + +/*! ZSTD_initDStream() : + * Initialize/reset DStream state for new decompression operation. + * Call before new decompression operation using same DStream. + * + * Note : This function is redundant with the advanced API and equivalent to: + * ZSTD_DCtx_reset(zds, ZSTD_reset_session_only); + * ZSTD_DCtx_refDDict(zds, NULL); + */ +ZSTDLIB_API size_t ZSTD_initDStream(ZSTD_DStream* zds); + +/*! ZSTD_decompressStream() : + * Streaming decompression function. + * Call repetitively to consume full input updating it as necessary. + * Function will update both input and output `pos` fields exposing current state via these fields: + * - `input.pos < input.size`, some input remaining and caller should provide remaining input + * on the next call. + * - `output.pos < output.size`, decoder flushed internal output buffer. + * - `output.pos == output.size`, unflushed data potentially present in the internal buffers, + * check ZSTD_decompressStream() @return value, + * if > 0, invoke it again to flush remaining data to output. + * Note : with no additional input, amount of data flushed <= ZSTD_BLOCKSIZE_MAX. + * + * @return : 0 when a frame is completely decoded and fully flushed, + * or an error code, which can be tested using ZSTD_isError(), + * or any other value > 0, which means there is some decoding or flushing to do to complete current frame. + * + * Note: when an operation returns with an error code, the @zds state may be left in undefined state. + * It's UB to invoke `ZSTD_decompressStream()` on such a state. + * In order to re-use such a state, it must be first reset, + * which can be done explicitly (`ZSTD_DCtx_reset()`), + * or is implied for operations starting some new decompression job (`ZSTD_initDStream`, `ZSTD_decompressDCtx()`, `ZSTD_decompress_usingDict()`) + */ +ZSTDLIB_API size_t ZSTD_decompressStream(ZSTD_DStream* zds, ZSTD_outBuffer* output, ZSTD_inBuffer* input); + +ZSTDLIB_API size_t ZSTD_DStreamInSize(void); /*!< recommended size for input buffer */ +ZSTDLIB_API size_t ZSTD_DStreamOutSize(void); /*!< recommended size for output buffer. Guarantee to successfully flush at least one complete block in all circumstances. */ + + +/************************** +* Simple dictionary API +***************************/ +/*! ZSTD_compress_usingDict() : + * Compression at an explicit compression level using a Dictionary. + * A dictionary can be any arbitrary data segment (also called a prefix), + * or a buffer with specified information (see zdict.h). + * Note : This function loads the dictionary, resulting in significant startup delay. + * It's intended for a dictionary used only once. + * Note 2 : When `dict == NULL || dictSize < 8` no dictionary is used. */ +ZSTDLIB_API size_t ZSTD_compress_usingDict(ZSTD_CCtx* ctx, + void* dst, size_t dstCapacity, + const void* src, size_t srcSize, + const void* dict,size_t dictSize, + int compressionLevel); + +/*! ZSTD_decompress_usingDict() : + * Decompression using a known Dictionary. + * Dictionary must be identical to the one used during compression. + * Note : This function loads the dictionary, resulting in significant startup delay. + * It's intended for a dictionary used only once. + * Note : When `dict == NULL || dictSize < 8` no dictionary is used. */ +ZSTDLIB_API size_t ZSTD_decompress_usingDict(ZSTD_DCtx* dctx, + void* dst, size_t dstCapacity, + const void* src, size_t srcSize, + const void* dict,size_t dictSize); + + +/*********************************** + * Bulk processing dictionary API + **********************************/ +typedef struct ZSTD_CDict_s ZSTD_CDict; + +/*! ZSTD_createCDict() : + * When compressing multiple messages or blocks using the same dictionary, + * it's recommended to digest the dictionary only once, since it's a costly operation. + * ZSTD_createCDict() will create a state from digesting a dictionary. + * The resulting state can be used for future compression operations with very limited startup cost. + * ZSTD_CDict can be created once and shared by multiple threads concurrently, since its usage is read-only. + * @dictBuffer can be released after ZSTD_CDict creation, because its content is copied within CDict. + * Note 1 : Consider experimental function `ZSTD_createCDict_byReference()` if you prefer to not duplicate @dictBuffer content. + * Note 2 : A ZSTD_CDict can be created from an empty @dictBuffer, + * in which case the only thing that it transports is the @compressionLevel. + * This can be useful in a pipeline featuring ZSTD_compress_usingCDict() exclusively, + * expecting a ZSTD_CDict parameter with any data, including those without a known dictionary. */ +ZSTDLIB_API ZSTD_CDict* ZSTD_createCDict(const void* dictBuffer, size_t dictSize, + int compressionLevel); + +/*! ZSTD_freeCDict() : + * Function frees memory allocated by ZSTD_createCDict(). + * If a NULL pointer is passed, no operation is performed. */ +ZSTDLIB_API size_t ZSTD_freeCDict(ZSTD_CDict* CDict); + +/*! ZSTD_compress_usingCDict() : + * Compression using a digested Dictionary. + * Recommended when same dictionary is used multiple times. + * Note : compression level is _decided at dictionary creation time_, + * and frame parameters are hardcoded (dictID=yes, contentSize=yes, checksum=no) */ +ZSTDLIB_API size_t ZSTD_compress_usingCDict(ZSTD_CCtx* cctx, + void* dst, size_t dstCapacity, + const void* src, size_t srcSize, + const ZSTD_CDict* cdict); + + +typedef struct ZSTD_DDict_s ZSTD_DDict; + +/*! ZSTD_createDDict() : + * Create a digested dictionary, ready to start decompression operation without startup delay. + * dictBuffer can be released after DDict creation, as its content is copied inside DDict. */ +ZSTDLIB_API ZSTD_DDict* ZSTD_createDDict(const void* dictBuffer, size_t dictSize); + +/*! ZSTD_freeDDict() : + * Function frees memory allocated with ZSTD_createDDict() + * If a NULL pointer is passed, no operation is performed. */ +ZSTDLIB_API size_t ZSTD_freeDDict(ZSTD_DDict* ddict); + +/*! ZSTD_decompress_usingDDict() : + * Decompression using a digested Dictionary. + * Recommended when same dictionary is used multiple times. */ +ZSTDLIB_API size_t ZSTD_decompress_usingDDict(ZSTD_DCtx* dctx, + void* dst, size_t dstCapacity, + const void* src, size_t srcSize, + const ZSTD_DDict* ddict); + + +/******************************** + * Dictionary helper functions + *******************************/ + +/*! ZSTD_getDictID_fromDict() : Requires v1.4.0+ + * Provides the dictID stored within dictionary. + * if @return == 0, the dictionary is not conformant with Zstandard specification. + * It can still be loaded, but as a content-only dictionary. */ +ZSTDLIB_API unsigned ZSTD_getDictID_fromDict(const void* dict, size_t dictSize); + +/*! ZSTD_getDictID_fromCDict() : Requires v1.5.0+ + * Provides the dictID of the dictionary loaded into `cdict`. + * If @return == 0, the dictionary is not conformant to Zstandard specification, or empty. + * Non-conformant dictionaries can still be loaded, but as content-only dictionaries. */ +ZSTDLIB_API unsigned ZSTD_getDictID_fromCDict(const ZSTD_CDict* cdict); + +/*! ZSTD_getDictID_fromDDict() : Requires v1.4.0+ + * Provides the dictID of the dictionary loaded into `ddict`. + * If @return == 0, the dictionary is not conformant to Zstandard specification, or empty. + * Non-conformant dictionaries can still be loaded, but as content-only dictionaries. */ +ZSTDLIB_API unsigned ZSTD_getDictID_fromDDict(const ZSTD_DDict* ddict); + +/*! ZSTD_getDictID_fromFrame() : Requires v1.4.0+ + * Provides the dictID required to decompressed the frame stored within `src`. + * If @return == 0, the dictID could not be decoded. + * This could for one of the following reasons : + * - The frame does not require a dictionary to be decoded (most common case). + * - The frame was built with dictID intentionally removed. Whatever dictionary is necessary is a hidden piece of information. + * Note : this use case also happens when using a non-conformant dictionary. + * - `srcSize` is too small, and as a result, the frame header could not be decoded (only possible if `srcSize < ZSTD_FRAMEHEADERSIZE_MAX`). + * - This is not a Zstandard frame. + * When identifying the exact failure cause, it's possible to use ZSTD_getFrameHeader(), which will provide a more precise error code. */ +ZSTDLIB_API unsigned ZSTD_getDictID_fromFrame(const void* src, size_t srcSize); + + +/******************************************************************************* + * Advanced dictionary and prefix API (Requires v1.4.0+) + * + * This API allows dictionaries to be used with ZSTD_compress2(), + * ZSTD_compressStream2(), and ZSTD_decompressDCtx(). + * Dictionaries are sticky, they remain valid when same context is reused, + * they only reset when the context is reset + * with ZSTD_reset_parameters or ZSTD_reset_session_and_parameters. + * In contrast, Prefixes are single-use. + ******************************************************************************/ + + +/*! ZSTD_CCtx_loadDictionary() : Requires v1.4.0+ + * Create an internal CDict from `dict` buffer. + * Decompression will have to use same dictionary. + * @result : 0, or an error code (which can be tested with ZSTD_isError()). + * Special: Loading a NULL (or 0-size) dictionary invalidates previous dictionary, + * meaning "return to no-dictionary mode". + * Note 1 : Dictionary is sticky, it will be used for all future compressed frames, + * until parameters are reset, a new dictionary is loaded, or the dictionary + * is explicitly invalidated by loading a NULL dictionary. + * Note 2 : Loading a dictionary involves building tables. + * It's also a CPU consuming operation, with non-negligible impact on latency. + * Tables are dependent on compression parameters, and for this reason, + * compression parameters can no longer be changed after loading a dictionary. + * Note 3 :`dict` content will be copied internally. + * Use experimental ZSTD_CCtx_loadDictionary_byReference() to reference content instead. + * In such a case, dictionary buffer must outlive its users. + * Note 4 : Use ZSTD_CCtx_loadDictionary_advanced() + * to precisely select how dictionary content must be interpreted. + * Note 5 : This method does not benefit from LDM (long distance mode). + * If you want to employ LDM on some large dictionary content, + * prefer employing ZSTD_CCtx_refPrefix() described below. + */ +ZSTDLIB_API size_t ZSTD_CCtx_loadDictionary(ZSTD_CCtx* cctx, const void* dict, size_t dictSize); + +/*! ZSTD_CCtx_refCDict() : Requires v1.4.0+ + * Reference a prepared dictionary, to be used for all future compressed frames. + * Note that compression parameters are enforced from within CDict, + * and supersede any compression parameter previously set within CCtx. + * The parameters ignored are labelled as "superseded-by-cdict" in the ZSTD_cParameter enum docs. + * The ignored parameters will be used again if the CCtx is returned to no-dictionary mode. + * The dictionary will remain valid for future compressed frames using same CCtx. + * @result : 0, or an error code (which can be tested with ZSTD_isError()). + * Special : Referencing a NULL CDict means "return to no-dictionary mode". + * Note 1 : Currently, only one dictionary can be managed. + * Referencing a new dictionary effectively "discards" any previous one. + * Note 2 : CDict is just referenced, its lifetime must outlive its usage within CCtx. */ +ZSTDLIB_API size_t ZSTD_CCtx_refCDict(ZSTD_CCtx* cctx, const ZSTD_CDict* cdict); + +/*! ZSTD_CCtx_refPrefix() : Requires v1.4.0+ + * Reference a prefix (single-usage dictionary) for next compressed frame. + * A prefix is **only used once**. Tables are discarded at end of frame (ZSTD_e_end). + * Decompression will need same prefix to properly regenerate data. + * Compressing with a prefix is similar in outcome as performing a diff and compressing it, + * but performs much faster, especially during decompression (compression speed is tunable with compression level). + * This method is compatible with LDM (long distance mode). + * @result : 0, or an error code (which can be tested with ZSTD_isError()). + * Special: Adding any prefix (including NULL) invalidates any previous prefix or dictionary + * Note 1 : Prefix buffer is referenced. It **must** outlive compression. + * Its content must remain unmodified during compression. + * Note 2 : If the intention is to diff some large src data blob with some prior version of itself, + * ensure that the window size is large enough to contain the entire source. + * See ZSTD_c_windowLog. + * Note 3 : Referencing a prefix involves building tables, which are dependent on compression parameters. + * It's a CPU consuming operation, with non-negligible impact on latency. + * If there is a need to use the same prefix multiple times, consider loadDictionary instead. + * Note 4 : By default, the prefix is interpreted as raw content (ZSTD_dct_rawContent). + * Use experimental ZSTD_CCtx_refPrefix_advanced() to alter dictionary interpretation. */ +ZSTDLIB_API size_t ZSTD_CCtx_refPrefix(ZSTD_CCtx* cctx, + const void* prefix, size_t prefixSize); + +/*! ZSTD_DCtx_loadDictionary() : Requires v1.4.0+ + * Create an internal DDict from dict buffer, to be used to decompress all future frames. + * The dictionary remains valid for all future frames, until explicitly invalidated, or + * a new dictionary is loaded. + * @result : 0, or an error code (which can be tested with ZSTD_isError()). + * Special : Adding a NULL (or 0-size) dictionary invalidates any previous dictionary, + * meaning "return to no-dictionary mode". + * Note 1 : Loading a dictionary involves building tables, + * which has a non-negligible impact on CPU usage and latency. + * It's recommended to "load once, use many times", to amortize the cost + * Note 2 :`dict` content will be copied internally, so `dict` can be released after loading. + * Use ZSTD_DCtx_loadDictionary_byReference() to reference dictionary content instead. + * Note 3 : Use ZSTD_DCtx_loadDictionary_advanced() to take control of + * how dictionary content is loaded and interpreted. + */ +ZSTDLIB_API size_t ZSTD_DCtx_loadDictionary(ZSTD_DCtx* dctx, const void* dict, size_t dictSize); + +/*! ZSTD_DCtx_refDDict() : Requires v1.4.0+ + * Reference a prepared dictionary, to be used to decompress next frames. + * The dictionary remains active for decompression of future frames using same DCtx. + * + * If called with ZSTD_d_refMultipleDDicts enabled, repeated calls of this function + * will store the DDict references in a table, and the DDict used for decompression + * will be determined at decompression time, as per the dict ID in the frame. + * The memory for the table is allocated on the first call to refDDict, and can be + * freed with ZSTD_freeDCtx(). + * + * If called with ZSTD_d_refMultipleDDicts disabled (the default), only one dictionary + * will be managed, and referencing a dictionary effectively "discards" any previous one. + * + * @result : 0, or an error code (which can be tested with ZSTD_isError()). + * Special: referencing a NULL DDict means "return to no-dictionary mode". + * Note 2 : DDict is just referenced, its lifetime must outlive its usage from DCtx. + */ +ZSTDLIB_API size_t ZSTD_DCtx_refDDict(ZSTD_DCtx* dctx, const ZSTD_DDict* ddict); + +/*! ZSTD_DCtx_refPrefix() : Requires v1.4.0+ + * Reference a prefix (single-usage dictionary) to decompress next frame. + * This is the reverse operation of ZSTD_CCtx_refPrefix(), + * and must use the same prefix as the one used during compression. + * Prefix is **only used once**. Reference is discarded at end of frame. + * End of frame is reached when ZSTD_decompressStream() returns 0. + * @result : 0, or an error code (which can be tested with ZSTD_isError()). + * Note 1 : Adding any prefix (including NULL) invalidates any previously set prefix or dictionary + * Note 2 : Prefix buffer is referenced. It **must** outlive decompression. + * Prefix buffer must remain unmodified up to the end of frame, + * reached when ZSTD_decompressStream() returns 0. + * Note 3 : By default, the prefix is treated as raw content (ZSTD_dct_rawContent). + * Use ZSTD_CCtx_refPrefix_advanced() to alter dictMode (Experimental section) + * Note 4 : Referencing a raw content prefix has almost no cpu nor memory cost. + * A full dictionary is more costly, as it requires building tables. + */ +ZSTDLIB_API size_t ZSTD_DCtx_refPrefix(ZSTD_DCtx* dctx, + const void* prefix, size_t prefixSize); + +/* === Memory management === */ + +/*! ZSTD_sizeof_*() : Requires v1.4.0+ + * These functions give the _current_ memory usage of selected object. + * Note that object memory usage can evolve (increase or decrease) over time. */ +ZSTDLIB_API size_t ZSTD_sizeof_CCtx(const ZSTD_CCtx* cctx); +ZSTDLIB_API size_t ZSTD_sizeof_DCtx(const ZSTD_DCtx* dctx); +ZSTDLIB_API size_t ZSTD_sizeof_CStream(const ZSTD_CStream* zcs); +ZSTDLIB_API size_t ZSTD_sizeof_DStream(const ZSTD_DStream* zds); +ZSTDLIB_API size_t ZSTD_sizeof_CDict(const ZSTD_CDict* cdict); +ZSTDLIB_API size_t ZSTD_sizeof_DDict(const ZSTD_DDict* ddict); + +#if defined (__cplusplus) +} +#endif + +#endif /* ZSTD_H_235446 */ + + +/* ************************************************************************************** + * ADVANCED AND EXPERIMENTAL FUNCTIONS + **************************************************************************************** + * The definitions in the following section are considered experimental. + * They are provided for advanced scenarios. + * They should never be used with a dynamic library, as prototypes may change in the future. + * Use them only in association with static linking. + * ***************************************************************************************/ + +#if defined(ZSTD_STATIC_LINKING_ONLY) && !defined(ZSTD_H_ZSTD_STATIC_LINKING_ONLY) +#define ZSTD_H_ZSTD_STATIC_LINKING_ONLY + +#if defined (__cplusplus) +extern "C" { +#endif + +/* This can be overridden externally to hide static symbols. */ +#ifndef ZSTDLIB_STATIC_API +# if defined(ZSTD_DLL_EXPORT) && (ZSTD_DLL_EXPORT==1) +# define ZSTDLIB_STATIC_API __declspec(dllexport) ZSTDLIB_VISIBLE +# elif defined(ZSTD_DLL_IMPORT) && (ZSTD_DLL_IMPORT==1) +# define ZSTDLIB_STATIC_API __declspec(dllimport) ZSTDLIB_VISIBLE +# else +# define ZSTDLIB_STATIC_API ZSTDLIB_VISIBLE +# endif +#endif + +/**************************************************************************************** + * experimental API (static linking only) + **************************************************************************************** + * The following symbols and constants + * are not planned to join "stable API" status in the near future. + * They can still change in future versions. + * Some of them are planned to remain in the static_only section indefinitely. + * Some of them might be removed in the future (especially when redundant with existing stable functions) + * ***************************************************************************************/ + +#define ZSTD_FRAMEHEADERSIZE_PREFIX(format) ((format) == ZSTD_f_zstd1 ? 5 : 1) /* minimum input size required to query frame header size */ +#define ZSTD_FRAMEHEADERSIZE_MIN(format) ((format) == ZSTD_f_zstd1 ? 6 : 2) +#define ZSTD_FRAMEHEADERSIZE_MAX 18 /* can be useful for static allocation */ +#define ZSTD_SKIPPABLEHEADERSIZE 8 + +/* compression parameter bounds */ +#define ZSTD_WINDOWLOG_MAX_32 30 +#define ZSTD_WINDOWLOG_MAX_64 31 +#define ZSTD_WINDOWLOG_MAX ((int)(sizeof(size_t) == 4 ? ZSTD_WINDOWLOG_MAX_32 : ZSTD_WINDOWLOG_MAX_64)) +#define ZSTD_WINDOWLOG_MIN 10 +#define ZSTD_HASHLOG_MAX ((ZSTD_WINDOWLOG_MAX < 30) ? ZSTD_WINDOWLOG_MAX : 30) +#define ZSTD_HASHLOG_MIN 6 +#define ZSTD_CHAINLOG_MAX_32 29 +#define ZSTD_CHAINLOG_MAX_64 30 +#define ZSTD_CHAINLOG_MAX ((int)(sizeof(size_t) == 4 ? ZSTD_CHAINLOG_MAX_32 : ZSTD_CHAINLOG_MAX_64)) +#define ZSTD_CHAINLOG_MIN ZSTD_HASHLOG_MIN +#define ZSTD_SEARCHLOG_MAX (ZSTD_WINDOWLOG_MAX-1) +#define ZSTD_SEARCHLOG_MIN 1 +#define ZSTD_MINMATCH_MAX 7 /* only for ZSTD_fast, other strategies are limited to 6 */ +#define ZSTD_MINMATCH_MIN 3 /* only for ZSTD_btopt+, faster strategies are limited to 4 */ +#define ZSTD_TARGETLENGTH_MAX ZSTD_BLOCKSIZE_MAX +#define ZSTD_TARGETLENGTH_MIN 0 /* note : comparing this constant to an unsigned results in a tautological test */ +#define ZSTD_STRATEGY_MIN ZSTD_fast +#define ZSTD_STRATEGY_MAX ZSTD_btultra2 +#define ZSTD_BLOCKSIZE_MAX_MIN (1 << 10) /* The minimum valid max blocksize. Maximum blocksizes smaller than this make compressBound() inaccurate. */ + + +#define ZSTD_OVERLAPLOG_MIN 0 +#define ZSTD_OVERLAPLOG_MAX 9 + +#define ZSTD_WINDOWLOG_LIMIT_DEFAULT 27 /* by default, the streaming decoder will refuse any frame + * requiring larger than (1< 0: + * If litLength != 0: + * rep == 1 --> offset == repeat_offset_1 + * rep == 2 --> offset == repeat_offset_2 + * rep == 3 --> offset == repeat_offset_3 + * If litLength == 0: + * rep == 1 --> offset == repeat_offset_2 + * rep == 2 --> offset == repeat_offset_3 + * rep == 3 --> offset == repeat_offset_1 - 1 + * + * Note: This field is optional. ZSTD_generateSequences() will calculate the value of + * 'rep', but repeat offsets do not necessarily need to be calculated from an external + * sequence provider perspective. For example, ZSTD_compressSequences() does not + * use this 'rep' field at all (as of now). + */ +} ZSTD_Sequence; + +typedef struct { + unsigned windowLog; /**< largest match distance : larger == more compression, more memory needed during decompression */ + unsigned chainLog; /**< fully searched segment : larger == more compression, slower, more memory (useless for fast) */ + unsigned hashLog; /**< dispatch table : larger == faster, more memory */ + unsigned searchLog; /**< nb of searches : larger == more compression, slower */ + unsigned minMatch; /**< match length searched : larger == faster decompression, sometimes less compression */ + unsigned targetLength; /**< acceptable match size for optimal parser (only) : larger == more compression, slower */ + ZSTD_strategy strategy; /**< see ZSTD_strategy definition above */ +} ZSTD_compressionParameters; + +typedef struct { + int contentSizeFlag; /**< 1: content size will be in frame header (when known) */ + int checksumFlag; /**< 1: generate a 32-bits checksum using XXH64 algorithm at end of frame, for error detection */ + int noDictIDFlag; /**< 1: no dictID will be saved into frame header (dictID is only useful for dictionary compression) */ +} ZSTD_frameParameters; + +typedef struct { + ZSTD_compressionParameters cParams; + ZSTD_frameParameters fParams; +} ZSTD_parameters; + +typedef enum { + ZSTD_dct_auto = 0, /* dictionary is "full" when starting with ZSTD_MAGIC_DICTIONARY, otherwise it is "rawContent" */ + ZSTD_dct_rawContent = 1, /* ensures dictionary is always loaded as rawContent, even if it starts with ZSTD_MAGIC_DICTIONARY */ + ZSTD_dct_fullDict = 2 /* refuses to load a dictionary if it does not respect Zstandard's specification, starting with ZSTD_MAGIC_DICTIONARY */ +} ZSTD_dictContentType_e; + +typedef enum { + ZSTD_dlm_byCopy = 0, /**< Copy dictionary content internally */ + ZSTD_dlm_byRef = 1 /**< Reference dictionary content -- the dictionary buffer must outlive its users. */ +} ZSTD_dictLoadMethod_e; + +typedef enum { + ZSTD_f_zstd1 = 0, /* zstd frame format, specified in zstd_compression_format.md (default) */ + ZSTD_f_zstd1_magicless = 1 /* Variant of zstd frame format, without initial 4-bytes magic number. + * Useful to save 4 bytes per generated frame. + * Decoder cannot recognise automatically this format, requiring this instruction. */ +} ZSTD_format_e; + +typedef enum { + /* Note: this enum controls ZSTD_d_forceIgnoreChecksum */ + ZSTD_d_validateChecksum = 0, + ZSTD_d_ignoreChecksum = 1 +} ZSTD_forceIgnoreChecksum_e; + +typedef enum { + /* Note: this enum controls ZSTD_d_refMultipleDDicts */ + ZSTD_rmd_refSingleDDict = 0, + ZSTD_rmd_refMultipleDDicts = 1 +} ZSTD_refMultipleDDicts_e; + +typedef enum { + /* Note: this enum and the behavior it controls are effectively internal + * implementation details of the compressor. They are expected to continue + * to evolve and should be considered only in the context of extremely + * advanced performance tuning. + * + * Zstd currently supports the use of a CDict in three ways: + * + * - The contents of the CDict can be copied into the working context. This + * means that the compression can search both the dictionary and input + * while operating on a single set of internal tables. This makes + * the compression faster per-byte of input. However, the initial copy of + * the CDict's tables incurs a fixed cost at the beginning of the + * compression. For small compressions (< 8 KB), that copy can dominate + * the cost of the compression. + * + * - The CDict's tables can be used in-place. In this model, compression is + * slower per input byte, because the compressor has to search two sets of + * tables. However, this model incurs no start-up cost (as long as the + * working context's tables can be reused). For small inputs, this can be + * faster than copying the CDict's tables. + * + * - The CDict's tables are not used at all, and instead we use the working + * context alone to reload the dictionary and use params based on the source + * size. See ZSTD_compress_insertDictionary() and ZSTD_compress_usingDict(). + * This method is effective when the dictionary sizes are very small relative + * to the input size, and the input size is fairly large to begin with. + * + * Zstd has a simple internal heuristic that selects which strategy to use + * at the beginning of a compression. However, if experimentation shows that + * Zstd is making poor choices, it is possible to override that choice with + * this enum. + */ + ZSTD_dictDefaultAttach = 0, /* Use the default heuristic. */ + ZSTD_dictForceAttach = 1, /* Never copy the dictionary. */ + ZSTD_dictForceCopy = 2, /* Always copy the dictionary. */ + ZSTD_dictForceLoad = 3 /* Always reload the dictionary */ +} ZSTD_dictAttachPref_e; + +typedef enum { + ZSTD_lcm_auto = 0, /**< Automatically determine the compression mode based on the compression level. + * Negative compression levels will be uncompressed, and positive compression + * levels will be compressed. */ + ZSTD_lcm_huffman = 1, /**< Always attempt Huffman compression. Uncompressed literals will still be + * emitted if Huffman compression is not profitable. */ + ZSTD_lcm_uncompressed = 2 /**< Always emit uncompressed literals. */ +} ZSTD_literalCompressionMode_e; + +typedef enum { + /* Note: This enum controls features which are conditionally beneficial. + * Zstd can take a decision on whether or not to enable the feature (ZSTD_ps_auto), + * but setting the switch to ZSTD_ps_enable or ZSTD_ps_disable force enable/disable the feature. + */ + ZSTD_ps_auto = 0, /* Let the library automatically determine whether the feature shall be enabled */ + ZSTD_ps_enable = 1, /* Force-enable the feature */ + ZSTD_ps_disable = 2 /* Do not use the feature */ +} ZSTD_ParamSwitch_e; +#define ZSTD_paramSwitch_e ZSTD_ParamSwitch_e /* old name */ + +/*************************************** +* Frame header and size functions +***************************************/ + +/*! ZSTD_findDecompressedSize() : + * `src` should point to the start of a series of ZSTD encoded and/or skippable frames + * `srcSize` must be the _exact_ size of this series + * (i.e. there should be a frame boundary at `src + srcSize`) + * @return : - decompressed size of all data in all successive frames + * - if the decompressed size cannot be determined: ZSTD_CONTENTSIZE_UNKNOWN + * - if an error occurred: ZSTD_CONTENTSIZE_ERROR + * + * note 1 : decompressed size is an optional field, that may not be present, especially in streaming mode. + * When `return==ZSTD_CONTENTSIZE_UNKNOWN`, data to decompress could be any size. + * In which case, it's necessary to use streaming mode to decompress data. + * note 2 : decompressed size is always present when compression is done with ZSTD_compress() + * note 3 : decompressed size can be very large (64-bits value), + * potentially larger than what local system can handle as a single memory segment. + * In which case, it's necessary to use streaming mode to decompress data. + * note 4 : If source is untrusted, decompressed size could be wrong or intentionally modified. + * Always ensure result fits within application's authorized limits. + * Each application can set its own limits. + * note 5 : ZSTD_findDecompressedSize handles multiple frames, and so it must traverse the input to + * read each contained frame header. This is fast as most of the data is skipped, + * however it does mean that all frame data must be present and valid. */ +ZSTDLIB_STATIC_API unsigned long long ZSTD_findDecompressedSize(const void* src, size_t srcSize); + +/*! ZSTD_decompressBound() : + * `src` should point to the start of a series of ZSTD encoded and/or skippable frames + * `srcSize` must be the _exact_ size of this series + * (i.e. there should be a frame boundary at `src + srcSize`) + * @return : - upper-bound for the decompressed size of all data in all successive frames + * - if an error occurred: ZSTD_CONTENTSIZE_ERROR + * + * note 1 : an error can occur if `src` contains an invalid or incorrectly formatted frame. + * note 2 : the upper-bound is exact when the decompressed size field is available in every ZSTD encoded frame of `src`. + * in this case, `ZSTD_findDecompressedSize` and `ZSTD_decompressBound` return the same value. + * note 3 : when the decompressed size field isn't available, the upper-bound for that frame is calculated by: + * upper-bound = # blocks * min(128 KB, Window_Size) + */ +ZSTDLIB_STATIC_API unsigned long long ZSTD_decompressBound(const void* src, size_t srcSize); + +/*! ZSTD_frameHeaderSize() : + * srcSize must be large enough, aka >= ZSTD_FRAMEHEADERSIZE_PREFIX. + * @return : size of the Frame Header, + * or an error code (if srcSize is too small) */ +ZSTDLIB_STATIC_API size_t ZSTD_frameHeaderSize(const void* src, size_t srcSize); + +typedef enum { ZSTD_frame, ZSTD_skippableFrame } ZSTD_FrameType_e; +#define ZSTD_frameType_e ZSTD_FrameType_e /* old name */ +typedef struct { + unsigned long long frameContentSize; /* if == ZSTD_CONTENTSIZE_UNKNOWN, it means this field is not available. 0 means "empty" */ + unsigned long long windowSize; /* can be very large, up to <= frameContentSize */ + unsigned blockSizeMax; + ZSTD_FrameType_e frameType; /* if == ZSTD_skippableFrame, frameContentSize is the size of skippable content */ + unsigned headerSize; + unsigned dictID; /* for ZSTD_skippableFrame, contains the skippable magic variant [0-15] */ + unsigned checksumFlag; + unsigned _reserved1; + unsigned _reserved2; +} ZSTD_FrameHeader; +#define ZSTD_frameHeader ZSTD_FrameHeader /* old name */ + +/*! ZSTD_getFrameHeader() : + * decode Frame Header into `zfhPtr`, or requires larger `srcSize`. + * @return : 0 => header is complete, `zfhPtr` is correctly filled, + * >0 => `srcSize` is too small, @return value is the wanted `srcSize` amount, `zfhPtr` is not filled, + * or an error code, which can be tested using ZSTD_isError() */ +ZSTDLIB_STATIC_API size_t ZSTD_getFrameHeader(ZSTD_FrameHeader* zfhPtr, const void* src, size_t srcSize); +/*! ZSTD_getFrameHeader_advanced() : + * same as ZSTD_getFrameHeader(), + * with added capability to select a format (like ZSTD_f_zstd1_magicless) */ +ZSTDLIB_STATIC_API size_t ZSTD_getFrameHeader_advanced(ZSTD_FrameHeader* zfhPtr, const void* src, size_t srcSize, ZSTD_format_e format); + +/*! ZSTD_decompressionMargin() : + * Zstd supports in-place decompression, where the input and output buffers overlap. + * In this case, the output buffer must be at least (Margin + Output_Size) bytes large, + * and the input buffer must be at the end of the output buffer. + * + * _______________________ Output Buffer ________________________ + * | | + * | ____ Input Buffer ____| + * | | | + * v v v + * |---------------------------------------|-----------|----------| + * ^ ^ ^ + * |___________________ Output_Size ___________________|_ Margin _| + * + * NOTE: See also ZSTD_DECOMPRESSION_MARGIN(). + * NOTE: This applies only to single-pass decompression through ZSTD_decompress() or + * ZSTD_decompressDCtx(). + * NOTE: This function supports multi-frame input. + * + * @param src The compressed frame(s) + * @param srcSize The size of the compressed frame(s) + * @returns The decompression margin or an error that can be checked with ZSTD_isError(). + */ +ZSTDLIB_STATIC_API size_t ZSTD_decompressionMargin(const void* src, size_t srcSize); + +/*! ZSTD_DECOMPRESS_MARGIN() : + * Similar to ZSTD_decompressionMargin(), but instead of computing the margin from + * the compressed frame, compute it from the original size and the blockSizeLog. + * See ZSTD_decompressionMargin() for details. + * + * WARNING: This macro does not support multi-frame input, the input must be a single + * zstd frame. If you need that support use the function, or implement it yourself. + * + * @param originalSize The original uncompressed size of the data. + * @param blockSize The block size == MIN(windowSize, ZSTD_BLOCKSIZE_MAX). + * Unless you explicitly set the windowLog smaller than + * ZSTD_BLOCKSIZELOG_MAX you can just use ZSTD_BLOCKSIZE_MAX. + */ +#define ZSTD_DECOMPRESSION_MARGIN(originalSize, blockSize) ((size_t)( \ + ZSTD_FRAMEHEADERSIZE_MAX /* Frame header */ + \ + 4 /* checksum */ + \ + ((originalSize) == 0 ? 0 : 3 * (((originalSize) + (blockSize) - 1) / blockSize)) /* 3 bytes per block */ + \ + (blockSize) /* One block of margin */ \ + )) + +typedef enum { + ZSTD_sf_noBlockDelimiters = 0, /* ZSTD_Sequence[] has no block delimiters, just sequences */ + ZSTD_sf_explicitBlockDelimiters = 1 /* ZSTD_Sequence[] contains explicit block delimiters */ +} ZSTD_SequenceFormat_e; +#define ZSTD_sequenceFormat_e ZSTD_SequenceFormat_e /* old name */ + +/*! ZSTD_sequenceBound() : + * `srcSize` : size of the input buffer + * @return : upper-bound for the number of sequences that can be generated + * from a buffer of srcSize bytes + * + * note : returns number of sequences - to get bytes, multiply by sizeof(ZSTD_Sequence). + */ +ZSTDLIB_STATIC_API size_t ZSTD_sequenceBound(size_t srcSize); + +/*! ZSTD_generateSequences() : + * WARNING: This function is meant for debugging and informational purposes ONLY! + * Its implementation is flawed, and it will be deleted in a future version. + * It is not guaranteed to succeed, as there are several cases where it will give + * up and fail. You should NOT use this function in production code. + * + * This function is deprecated, and will be removed in a future version. + * + * Generate sequences using ZSTD_compress2(), given a source buffer. + * + * @param zc The compression context to be used for ZSTD_compress2(). Set any + * compression parameters you need on this context. + * @param outSeqs The output sequences buffer of size @p outSeqsSize + * @param outSeqsCapacity The size of the output sequences buffer. + * ZSTD_sequenceBound(srcSize) is an upper bound on the number + * of sequences that can be generated. + * @param src The source buffer to generate sequences from of size @p srcSize. + * @param srcSize The size of the source buffer. + * + * Each block will end with a dummy sequence + * with offset == 0, matchLength == 0, and litLength == length of last literals. + * litLength may be == 0, and if so, then the sequence of (of: 0 ml: 0 ll: 0) + * simply acts as a block delimiter. + * + * @returns The number of sequences generated, necessarily less than + * ZSTD_sequenceBound(srcSize), or an error code that can be checked + * with ZSTD_isError(). + */ +ZSTD_DEPRECATED("For debugging only, will be replaced by ZSTD_extractSequences()") +ZSTDLIB_STATIC_API size_t +ZSTD_generateSequences(ZSTD_CCtx* zc, + ZSTD_Sequence* outSeqs, size_t outSeqsCapacity, + const void* src, size_t srcSize); + +/*! ZSTD_mergeBlockDelimiters() : + * Given an array of ZSTD_Sequence, remove all sequences that represent block delimiters/last literals + * by merging them into the literals of the next sequence. + * + * As such, the final generated result has no explicit representation of block boundaries, + * and the final last literals segment is not represented in the sequences. + * + * The output of this function can be fed into ZSTD_compressSequences() with CCtx + * setting of ZSTD_c_blockDelimiters as ZSTD_sf_noBlockDelimiters + * @return : number of sequences left after merging + */ +ZSTDLIB_STATIC_API size_t ZSTD_mergeBlockDelimiters(ZSTD_Sequence* sequences, size_t seqsSize); + +/*! ZSTD_compressSequences() : + * Compress an array of ZSTD_Sequence, associated with @src buffer, into dst. + * @src contains the entire input (not just the literals). + * If @srcSize > sum(sequence.length), the remaining bytes are considered all literals + * If a dictionary is included, then the cctx should reference the dict (see: ZSTD_CCtx_refCDict(), ZSTD_CCtx_loadDictionary(), etc.). + * The entire source is compressed into a single frame. + * + * The compression behavior changes based on cctx params. In particular: + * If ZSTD_c_blockDelimiters == ZSTD_sf_noBlockDelimiters, the array of ZSTD_Sequence is expected to contain + * no block delimiters (defined in ZSTD_Sequence). Block boundaries are roughly determined based on + * the block size derived from the cctx, and sequences may be split. This is the default setting. + * + * If ZSTD_c_blockDelimiters == ZSTD_sf_explicitBlockDelimiters, the array of ZSTD_Sequence is expected to contain + * valid block delimiters (defined in ZSTD_Sequence). Behavior is undefined if no block delimiters are provided. + * + * When ZSTD_c_blockDelimiters == ZSTD_sf_explicitBlockDelimiters, it's possible to decide generating repcodes + * using the advanced parameter ZSTD_c_repcodeResolution. Repcodes will improve compression ratio, though the benefit + * can vary greatly depending on Sequences. On the other hand, repcode resolution is an expensive operation. + * By default, it's disabled at low (<10) compression levels, and enabled above the threshold (>=10). + * ZSTD_c_repcodeResolution makes it possible to directly manage this processing in either direction. + * + * If ZSTD_c_validateSequences == 0, this function blindly accepts the Sequences provided. Invalid Sequences cause undefined + * behavior. If ZSTD_c_validateSequences == 1, then the function will detect invalid Sequences (see doc/zstd_compression_format.md for + * specifics regarding offset/matchlength requirements) and then bail out and return an error. + * + * In addition to the two adjustable experimental params, there are other important cctx params. + * - ZSTD_c_minMatch MUST be set as less than or equal to the smallest match generated by the match finder. It has a minimum value of ZSTD_MINMATCH_MIN. + * - ZSTD_c_compressionLevel accordingly adjusts the strength of the entropy coder, as it would in typical compression. + * - ZSTD_c_windowLog affects offset validation: this function will return an error at higher debug levels if a provided offset + * is larger than what the spec allows for a given window log and dictionary (if present). See: doc/zstd_compression_format.md + * + * Note: Repcodes are, as of now, always re-calculated within this function, ZSTD_Sequence.rep is effectively unused. + * Dev Note: Once ability to ingest repcodes become available, the explicit block delims mode must respect those repcodes exactly, + * and cannot emit an RLE block that disagrees with the repcode history. + * @return : final compressed size, or a ZSTD error code. + */ +ZSTDLIB_STATIC_API size_t +ZSTD_compressSequences(ZSTD_CCtx* cctx, + void* dst, size_t dstCapacity, + const ZSTD_Sequence* inSeqs, size_t inSeqsSize, + const void* src, size_t srcSize); + + +/*! ZSTD_compressSequencesAndLiterals() : + * This is a variant of ZSTD_compressSequences() which, + * instead of receiving (src,srcSize) as input parameter, receives (literals,litSize), + * aka all the literals, already extracted and laid out into a single continuous buffer. + * This can be useful if the process generating the sequences also happens to generate the buffer of literals, + * thus skipping an extraction + caching stage. + * It's a speed optimization, useful when the right conditions are met, + * but it also features the following limitations: + * - Only supports explicit delimiter mode + * - Currently does not support Sequences validation (so input Sequences are trusted) + * - Not compatible with frame checksum, which must be disabled + * - If any block is incompressible, will fail and return an error + * - @litSize must be == sum of all @.litLength fields in @inSeqs. Any discrepancy will generate an error. + * - @litBufCapacity is the size of the underlying buffer into which literals are written, starting at address @literals. + * @litBufCapacity must be at least 8 bytes larger than @litSize. + * - @decompressedSize must be correct, and correspond to the sum of all Sequences. Any discrepancy will generate an error. + * @return : final compressed size, or a ZSTD error code. + */ +ZSTDLIB_STATIC_API size_t +ZSTD_compressSequencesAndLiterals(ZSTD_CCtx* cctx, + void* dst, size_t dstCapacity, + const ZSTD_Sequence* inSeqs, size_t nbSequences, + const void* literals, size_t litSize, size_t litBufCapacity, + size_t decompressedSize); + + +/*! ZSTD_writeSkippableFrame() : + * Generates a zstd skippable frame containing data given by src, and writes it to dst buffer. + * + * Skippable frames begin with a 4-byte magic number. There are 16 possible choices of magic number, + * ranging from ZSTD_MAGIC_SKIPPABLE_START to ZSTD_MAGIC_SKIPPABLE_START+15. + * As such, the parameter magicVariant controls the exact skippable frame magic number variant used, + * so the magic number used will be ZSTD_MAGIC_SKIPPABLE_START + magicVariant. + * + * Returns an error if destination buffer is not large enough, if the source size is not representable + * with a 4-byte unsigned int, or if the parameter magicVariant is greater than 15 (and therefore invalid). + * + * @return : number of bytes written or a ZSTD error. + */ +ZSTDLIB_STATIC_API size_t ZSTD_writeSkippableFrame(void* dst, size_t dstCapacity, + const void* src, size_t srcSize, + unsigned magicVariant); + +/*! ZSTD_readSkippableFrame() : + * Retrieves the content of a zstd skippable frame starting at @src, and writes it to @dst buffer. + * + * The parameter @magicVariant will receive the magicVariant that was supplied when the frame was written, + * i.e. magicNumber - ZSTD_MAGIC_SKIPPABLE_START. + * This can be NULL if the caller is not interested in the magicVariant. + * + * Returns an error if destination buffer is not large enough, or if the frame is not skippable. + * + * @return : number of bytes written or a ZSTD error. + */ +ZSTDLIB_STATIC_API size_t ZSTD_readSkippableFrame(void* dst, size_t dstCapacity, + unsigned* magicVariant, + const void* src, size_t srcSize); + +/*! ZSTD_isSkippableFrame() : + * Tells if the content of `buffer` starts with a valid Frame Identifier for a skippable frame. + */ +ZSTDLIB_STATIC_API unsigned ZSTD_isSkippableFrame(const void* buffer, size_t size); + + + +/*************************************** +* Memory management +***************************************/ + +/*! ZSTD_estimate*() : + * These functions make it possible to estimate memory usage + * of a future {D,C}Ctx, before its creation. + * This is useful in combination with ZSTD_initStatic(), + * which makes it possible to employ a static buffer for ZSTD_CCtx* state. + * + * ZSTD_estimateCCtxSize() will provide a memory budget large enough + * to compress data of any size using one-shot compression ZSTD_compressCCtx() or ZSTD_compress2() + * associated with any compression level up to max specified one. + * The estimate will assume the input may be arbitrarily large, + * which is the worst case. + * + * Note that the size estimation is specific for one-shot compression, + * it is not valid for streaming (see ZSTD_estimateCStreamSize*()) + * nor other potential ways of using a ZSTD_CCtx* state. + * + * When srcSize can be bound by a known and rather "small" value, + * this knowledge can be used to provide a tighter budget estimation + * because the ZSTD_CCtx* state will need less memory for small inputs. + * This tighter estimation can be provided by employing more advanced functions + * ZSTD_estimateCCtxSize_usingCParams(), which can be used in tandem with ZSTD_getCParams(), + * and ZSTD_estimateCCtxSize_usingCCtxParams(), which can be used in tandem with ZSTD_CCtxParams_setParameter(). + * Both can be used to estimate memory using custom compression parameters and arbitrary srcSize limits. + * + * Note : only single-threaded compression is supported. + * ZSTD_estimateCCtxSize_usingCCtxParams() will return an error code if ZSTD_c_nbWorkers is >= 1. + */ +ZSTDLIB_STATIC_API size_t ZSTD_estimateCCtxSize(int maxCompressionLevel); +ZSTDLIB_STATIC_API size_t ZSTD_estimateCCtxSize_usingCParams(ZSTD_compressionParameters cParams); +ZSTDLIB_STATIC_API size_t ZSTD_estimateCCtxSize_usingCCtxParams(const ZSTD_CCtx_params* params); +ZSTDLIB_STATIC_API size_t ZSTD_estimateDCtxSize(void); + +/*! ZSTD_estimateCStreamSize() : + * ZSTD_estimateCStreamSize() will provide a memory budget large enough for streaming compression + * using any compression level up to the max specified one. + * It will also consider src size to be arbitrarily "large", which is a worst case scenario. + * If srcSize is known to always be small, ZSTD_estimateCStreamSize_usingCParams() can provide a tighter estimation. + * ZSTD_estimateCStreamSize_usingCParams() can be used in tandem with ZSTD_getCParams() to create cParams from compressionLevel. + * ZSTD_estimateCStreamSize_usingCCtxParams() can be used in tandem with ZSTD_CCtxParams_setParameter(). Only single-threaded compression is supported. This function will return an error code if ZSTD_c_nbWorkers is >= 1. + * Note : CStream size estimation is only correct for single-threaded compression. + * ZSTD_estimateCStreamSize_usingCCtxParams() will return an error code if ZSTD_c_nbWorkers is >= 1. + * Note 2 : ZSTD_estimateCStreamSize* functions are not compatible with the Block-Level Sequence Producer API at this time. + * Size estimates assume that no external sequence producer is registered. + * + * ZSTD_DStream memory budget depends on frame's window Size. + * This information can be passed manually, using ZSTD_estimateDStreamSize, + * or deducted from a valid frame Header, using ZSTD_estimateDStreamSize_fromFrame(); + * Any frame requesting a window size larger than max specified one will be rejected. + * Note : if streaming is init with function ZSTD_init?Stream_usingDict(), + * an internal ?Dict will be created, which additional size is not estimated here. + * In this case, get total size by adding ZSTD_estimate?DictSize + */ +ZSTDLIB_STATIC_API size_t ZSTD_estimateCStreamSize(int maxCompressionLevel); +ZSTDLIB_STATIC_API size_t ZSTD_estimateCStreamSize_usingCParams(ZSTD_compressionParameters cParams); +ZSTDLIB_STATIC_API size_t ZSTD_estimateCStreamSize_usingCCtxParams(const ZSTD_CCtx_params* params); +ZSTDLIB_STATIC_API size_t ZSTD_estimateDStreamSize(size_t maxWindowSize); +ZSTDLIB_STATIC_API size_t ZSTD_estimateDStreamSize_fromFrame(const void* src, size_t srcSize); + +/*! ZSTD_estimate?DictSize() : + * ZSTD_estimateCDictSize() will bet that src size is relatively "small", and content is copied, like ZSTD_createCDict(). + * ZSTD_estimateCDictSize_advanced() makes it possible to control compression parameters precisely, like ZSTD_createCDict_advanced(). + * Note : dictionaries created by reference (`ZSTD_dlm_byRef`) are logically smaller. + */ +ZSTDLIB_STATIC_API size_t ZSTD_estimateCDictSize(size_t dictSize, int compressionLevel); +ZSTDLIB_STATIC_API size_t ZSTD_estimateCDictSize_advanced(size_t dictSize, ZSTD_compressionParameters cParams, ZSTD_dictLoadMethod_e dictLoadMethod); +ZSTDLIB_STATIC_API size_t ZSTD_estimateDDictSize(size_t dictSize, ZSTD_dictLoadMethod_e dictLoadMethod); + +/*! ZSTD_initStatic*() : + * Initialize an object using a pre-allocated fixed-size buffer. + * workspace: The memory area to emplace the object into. + * Provided pointer *must be 8-bytes aligned*. + * Buffer must outlive object. + * workspaceSize: Use ZSTD_estimate*Size() to determine + * how large workspace must be to support target scenario. + * @return : pointer to object (same address as workspace, just different type), + * or NULL if error (size too small, incorrect alignment, etc.) + * Note : zstd will never resize nor malloc() when using a static buffer. + * If the object requires more memory than available, + * zstd will just error out (typically ZSTD_error_memory_allocation). + * Note 2 : there is no corresponding "free" function. + * Since workspace is allocated externally, it must be freed externally too. + * Note 3 : cParams : use ZSTD_getCParams() to convert a compression level + * into its associated cParams. + * Limitation 1 : currently not compatible with internal dictionary creation, triggered by + * ZSTD_CCtx_loadDictionary(), ZSTD_initCStream_usingDict() or ZSTD_initDStream_usingDict(). + * Limitation 2 : static cctx currently not compatible with multi-threading. + * Limitation 3 : static dctx is incompatible with legacy support. + */ +ZSTDLIB_STATIC_API ZSTD_CCtx* ZSTD_initStaticCCtx(void* workspace, size_t workspaceSize); +ZSTDLIB_STATIC_API ZSTD_CStream* ZSTD_initStaticCStream(void* workspace, size_t workspaceSize); /**< same as ZSTD_initStaticCCtx() */ + +ZSTDLIB_STATIC_API ZSTD_DCtx* ZSTD_initStaticDCtx(void* workspace, size_t workspaceSize); +ZSTDLIB_STATIC_API ZSTD_DStream* ZSTD_initStaticDStream(void* workspace, size_t workspaceSize); /**< same as ZSTD_initStaticDCtx() */ + +ZSTDLIB_STATIC_API const ZSTD_CDict* ZSTD_initStaticCDict( + void* workspace, size_t workspaceSize, + const void* dict, size_t dictSize, + ZSTD_dictLoadMethod_e dictLoadMethod, + ZSTD_dictContentType_e dictContentType, + ZSTD_compressionParameters cParams); + +ZSTDLIB_STATIC_API const ZSTD_DDict* ZSTD_initStaticDDict( + void* workspace, size_t workspaceSize, + const void* dict, size_t dictSize, + ZSTD_dictLoadMethod_e dictLoadMethod, + ZSTD_dictContentType_e dictContentType); + + +/*! Custom memory allocation : + * These prototypes make it possible to pass your own allocation/free functions. + * ZSTD_customMem is provided at creation time, using ZSTD_create*_advanced() variants listed below. + * All allocation/free operations will be completed using these custom variants instead of regular ones. + */ +typedef void* (*ZSTD_allocFunction) (void* opaque, size_t size); +typedef void (*ZSTD_freeFunction) (void* opaque, void* address); +typedef struct { ZSTD_allocFunction customAlloc; ZSTD_freeFunction customFree; void* opaque; } ZSTD_customMem; +static +#ifdef __GNUC__ +__attribute__((__unused__)) +#endif + +#if defined(__clang__) && __clang_major__ >= 5 +#pragma clang diagnostic push +#pragma clang diagnostic ignored "-Wzero-as-null-pointer-constant" +#endif +ZSTD_customMem const ZSTD_defaultCMem = { NULL, NULL, NULL }; /**< this constant defers to stdlib's functions */ +#if defined(__clang__) && __clang_major__ >= 5 +#pragma clang diagnostic pop +#endif + +ZSTDLIB_STATIC_API ZSTD_CCtx* ZSTD_createCCtx_advanced(ZSTD_customMem customMem); +ZSTDLIB_STATIC_API ZSTD_CStream* ZSTD_createCStream_advanced(ZSTD_customMem customMem); +ZSTDLIB_STATIC_API ZSTD_DCtx* ZSTD_createDCtx_advanced(ZSTD_customMem customMem); +ZSTDLIB_STATIC_API ZSTD_DStream* ZSTD_createDStream_advanced(ZSTD_customMem customMem); + +ZSTDLIB_STATIC_API ZSTD_CDict* ZSTD_createCDict_advanced(const void* dict, size_t dictSize, + ZSTD_dictLoadMethod_e dictLoadMethod, + ZSTD_dictContentType_e dictContentType, + ZSTD_compressionParameters cParams, + ZSTD_customMem customMem); + +/*! Thread pool : + * These prototypes make it possible to share a thread pool among multiple compression contexts. + * This can limit resources for applications with multiple threads where each one uses + * a threaded compression mode (via ZSTD_c_nbWorkers parameter). + * ZSTD_createThreadPool creates a new thread pool with a given number of threads. + * Note that the lifetime of such pool must exist while being used. + * ZSTD_CCtx_refThreadPool assigns a thread pool to a context (use NULL argument value + * to use an internal thread pool). + * ZSTD_freeThreadPool frees a thread pool, accepts NULL pointer. + */ +typedef struct POOL_ctx_s ZSTD_threadPool; +ZSTDLIB_STATIC_API ZSTD_threadPool* ZSTD_createThreadPool(size_t numThreads); +ZSTDLIB_STATIC_API void ZSTD_freeThreadPool (ZSTD_threadPool* pool); /* accept NULL pointer */ +ZSTDLIB_STATIC_API size_t ZSTD_CCtx_refThreadPool(ZSTD_CCtx* cctx, ZSTD_threadPool* pool); + + +/* + * This API is temporary and is expected to change or disappear in the future! + */ +ZSTDLIB_STATIC_API ZSTD_CDict* ZSTD_createCDict_advanced2( + const void* dict, size_t dictSize, + ZSTD_dictLoadMethod_e dictLoadMethod, + ZSTD_dictContentType_e dictContentType, + const ZSTD_CCtx_params* cctxParams, + ZSTD_customMem customMem); + +ZSTDLIB_STATIC_API ZSTD_DDict* ZSTD_createDDict_advanced( + const void* dict, size_t dictSize, + ZSTD_dictLoadMethod_e dictLoadMethod, + ZSTD_dictContentType_e dictContentType, + ZSTD_customMem customMem); + + +/*************************************** +* Advanced compression functions +***************************************/ + +/*! ZSTD_createCDict_byReference() : + * Create a digested dictionary for compression + * Dictionary content is just referenced, not duplicated. + * As a consequence, `dictBuffer` **must** outlive CDict, + * and its content must remain unmodified throughout the lifetime of CDict. + * note: equivalent to ZSTD_createCDict_advanced(), with dictLoadMethod==ZSTD_dlm_byRef */ +ZSTDLIB_STATIC_API ZSTD_CDict* ZSTD_createCDict_byReference(const void* dictBuffer, size_t dictSize, int compressionLevel); + +/*! ZSTD_getCParams() : + * @return ZSTD_compressionParameters structure for a selected compression level and estimated srcSize. + * `estimatedSrcSize` value is optional, select 0 if not known */ +ZSTDLIB_STATIC_API ZSTD_compressionParameters ZSTD_getCParams(int compressionLevel, unsigned long long estimatedSrcSize, size_t dictSize); + +/*! ZSTD_getParams() : + * same as ZSTD_getCParams(), but @return a full `ZSTD_parameters` object instead of sub-component `ZSTD_compressionParameters`. + * All fields of `ZSTD_frameParameters` are set to default : contentSize=1, checksum=0, noDictID=0 */ +ZSTDLIB_STATIC_API ZSTD_parameters ZSTD_getParams(int compressionLevel, unsigned long long estimatedSrcSize, size_t dictSize); + +/*! ZSTD_checkCParams() : + * Ensure param values remain within authorized range. + * @return 0 on success, or an error code (can be checked with ZSTD_isError()) */ +ZSTDLIB_STATIC_API size_t ZSTD_checkCParams(ZSTD_compressionParameters params); + +/*! ZSTD_adjustCParams() : + * optimize params for a given `srcSize` and `dictSize`. + * `srcSize` can be unknown, in which case use ZSTD_CONTENTSIZE_UNKNOWN. + * `dictSize` must be `0` when there is no dictionary. + * cPar can be invalid : all parameters will be clamped within valid range in the @return struct. + * This function never fails (wide contract) */ +ZSTDLIB_STATIC_API ZSTD_compressionParameters ZSTD_adjustCParams(ZSTD_compressionParameters cPar, unsigned long long srcSize, size_t dictSize); + +/*! ZSTD_CCtx_setCParams() : + * Set all parameters provided within @p cparams into the working @p cctx. + * Note : if modifying parameters during compression (MT mode only), + * note that changes to the .windowLog parameter will be ignored. + * @return 0 on success, or an error code (can be checked with ZSTD_isError()). + * On failure, no parameters are updated. + */ +ZSTDLIB_STATIC_API size_t ZSTD_CCtx_setCParams(ZSTD_CCtx* cctx, ZSTD_compressionParameters cparams); + +/*! ZSTD_CCtx_setFParams() : + * Set all parameters provided within @p fparams into the working @p cctx. + * @return 0 on success, or an error code (can be checked with ZSTD_isError()). + */ +ZSTDLIB_STATIC_API size_t ZSTD_CCtx_setFParams(ZSTD_CCtx* cctx, ZSTD_frameParameters fparams); + +/*! ZSTD_CCtx_setParams() : + * Set all parameters provided within @p params into the working @p cctx. + * @return 0 on success, or an error code (can be checked with ZSTD_isError()). + */ +ZSTDLIB_STATIC_API size_t ZSTD_CCtx_setParams(ZSTD_CCtx* cctx, ZSTD_parameters params); + +/*! ZSTD_compress_advanced() : + * Note : this function is now DEPRECATED. + * It can be replaced by ZSTD_compress2(), in combination with ZSTD_CCtx_setParameter() and other parameter setters. + * This prototype will generate compilation warnings. */ +ZSTD_DEPRECATED("use ZSTD_compress2") +ZSTDLIB_STATIC_API +size_t ZSTD_compress_advanced(ZSTD_CCtx* cctx, + void* dst, size_t dstCapacity, + const void* src, size_t srcSize, + const void* dict,size_t dictSize, + ZSTD_parameters params); + +/*! ZSTD_compress_usingCDict_advanced() : + * Note : this function is now DEPRECATED. + * It can be replaced by ZSTD_compress2(), in combination with ZSTD_CCtx_loadDictionary() and other parameter setters. + * This prototype will generate compilation warnings. */ +ZSTD_DEPRECATED("use ZSTD_compress2 with ZSTD_CCtx_loadDictionary") +ZSTDLIB_STATIC_API +size_t ZSTD_compress_usingCDict_advanced(ZSTD_CCtx* cctx, + void* dst, size_t dstCapacity, + const void* src, size_t srcSize, + const ZSTD_CDict* cdict, + ZSTD_frameParameters fParams); + + +/*! ZSTD_CCtx_loadDictionary_byReference() : + * Same as ZSTD_CCtx_loadDictionary(), but dictionary content is referenced, instead of being copied into CCtx. + * It saves some memory, but also requires that `dict` outlives its usage within `cctx` */ +ZSTDLIB_STATIC_API size_t ZSTD_CCtx_loadDictionary_byReference(ZSTD_CCtx* cctx, const void* dict, size_t dictSize); + +/*! ZSTD_CCtx_loadDictionary_advanced() : + * Same as ZSTD_CCtx_loadDictionary(), but gives finer control over + * how to load the dictionary (by copy ? by reference ?) + * and how to interpret it (automatic ? force raw mode ? full mode only ?) */ +ZSTDLIB_STATIC_API size_t ZSTD_CCtx_loadDictionary_advanced(ZSTD_CCtx* cctx, const void* dict, size_t dictSize, ZSTD_dictLoadMethod_e dictLoadMethod, ZSTD_dictContentType_e dictContentType); + +/*! ZSTD_CCtx_refPrefix_advanced() : + * Same as ZSTD_CCtx_refPrefix(), but gives finer control over + * how to interpret prefix content (automatic ? force raw mode (default) ? full mode only ?) */ +ZSTDLIB_STATIC_API size_t ZSTD_CCtx_refPrefix_advanced(ZSTD_CCtx* cctx, const void* prefix, size_t prefixSize, ZSTD_dictContentType_e dictContentType); + +/* === experimental parameters === */ +/* these parameters can be used with ZSTD_setParameter() + * they are not guaranteed to remain supported in the future */ + + /* Enables rsyncable mode, + * which makes compressed files more rsync friendly + * by adding periodic synchronization points to the compressed data. + * The target average block size is ZSTD_c_jobSize / 2. + * It's possible to modify the job size to increase or decrease + * the granularity of the synchronization point. + * Once the jobSize is smaller than the window size, + * it will result in compression ratio degradation. + * NOTE 1: rsyncable mode only works when multithreading is enabled. + * NOTE 2: rsyncable performs poorly in combination with long range mode, + * since it will decrease the effectiveness of synchronization points, + * though mileage may vary. + * NOTE 3: Rsyncable mode limits maximum compression speed to ~400 MB/s. + * If the selected compression level is already running significantly slower, + * the overall speed won't be significantly impacted. + */ + #define ZSTD_c_rsyncable ZSTD_c_experimentalParam1 + +/* Select a compression format. + * The value must be of type ZSTD_format_e. + * See ZSTD_format_e enum definition for details */ +#define ZSTD_c_format ZSTD_c_experimentalParam2 + +/* Force back-reference distances to remain < windowSize, + * even when referencing into Dictionary content (default:0) */ +#define ZSTD_c_forceMaxWindow ZSTD_c_experimentalParam3 + +/* Controls whether the contents of a CDict + * are used in place, or copied into the working context. + * Accepts values from the ZSTD_dictAttachPref_e enum. + * See the comments on that enum for an explanation of the feature. */ +#define ZSTD_c_forceAttachDict ZSTD_c_experimentalParam4 + +/* Controlled with ZSTD_ParamSwitch_e enum. + * Default is ZSTD_ps_auto. + * Set to ZSTD_ps_disable to never compress literals. + * Set to ZSTD_ps_enable to always compress literals. (Note: uncompressed literals + * may still be emitted if huffman is not beneficial to use.) + * + * By default, in ZSTD_ps_auto, the library will decide at runtime whether to use + * literals compression based on the compression parameters - specifically, + * negative compression levels do not use literal compression. + */ +#define ZSTD_c_literalCompressionMode ZSTD_c_experimentalParam5 + +/* User's best guess of source size. + * Hint is not valid when srcSizeHint == 0. + * There is no guarantee that hint is close to actual source size, + * but compression ratio may regress significantly if guess considerably underestimates */ +#define ZSTD_c_srcSizeHint ZSTD_c_experimentalParam7 + +/* Controls whether the new and experimental "dedicated dictionary search + * structure" can be used. This feature is still rough around the edges, be + * prepared for surprising behavior! + * + * How to use it: + * + * When using a CDict, whether to use this feature or not is controlled at + * CDict creation, and it must be set in a CCtxParams set passed into that + * construction (via ZSTD_createCDict_advanced2()). A compression will then + * use the feature or not based on how the CDict was constructed; the value of + * this param, set in the CCtx, will have no effect. + * + * However, when a dictionary buffer is passed into a CCtx, such as via + * ZSTD_CCtx_loadDictionary(), this param can be set on the CCtx to control + * whether the CDict that is created internally can use the feature or not. + * + * What it does: + * + * Normally, the internal data structures of the CDict are analogous to what + * would be stored in a CCtx after compressing the contents of a dictionary. + * To an approximation, a compression using a dictionary can then use those + * data structures to simply continue what is effectively a streaming + * compression where the simulated compression of the dictionary left off. + * Which is to say, the search structures in the CDict are normally the same + * format as in the CCtx. + * + * It is possible to do better, since the CDict is not like a CCtx: the search + * structures are written once during CDict creation, and then are only read + * after that, while the search structures in the CCtx are both read and + * written as the compression goes along. This means we can choose a search + * structure for the dictionary that is read-optimized. + * + * This feature enables the use of that different structure. + * + * Note that some of the members of the ZSTD_compressionParameters struct have + * different semantics and constraints in the dedicated search structure. It is + * highly recommended that you simply set a compression level in the CCtxParams + * you pass into the CDict creation call, and avoid messing with the cParams + * directly. + * + * Effects: + * + * This will only have any effect when the selected ZSTD_strategy + * implementation supports this feature. Currently, that's limited to + * ZSTD_greedy, ZSTD_lazy, and ZSTD_lazy2. + * + * Note that this means that the CDict tables can no longer be copied into the + * CCtx, so the dict attachment mode ZSTD_dictForceCopy will no longer be + * usable. The dictionary can only be attached or reloaded. + * + * In general, you should expect compression to be faster--sometimes very much + * so--and CDict creation to be slightly slower. Eventually, we will probably + * make this mode the default. + */ +#define ZSTD_c_enableDedicatedDictSearch ZSTD_c_experimentalParam8 + +/* ZSTD_c_stableInBuffer + * Experimental parameter. + * Default is 0 == disabled. Set to 1 to enable. + * + * Tells the compressor that input data presented with ZSTD_inBuffer + * will ALWAYS be the same between calls. + * Technically, the @src pointer must never be changed, + * and the @pos field can only be updated by zstd. + * However, it's possible to increase the @size field, + * allowing scenarios where more data can be appended after compressions starts. + * These conditions are checked by the compressor, + * and compression will fail if they are not respected. + * Also, data in the ZSTD_inBuffer within the range [src, src + pos) + * MUST not be modified during compression or it will result in data corruption. + * + * When this flag is enabled zstd won't allocate an input window buffer, + * because the user guarantees it can reference the ZSTD_inBuffer until + * the frame is complete. But, it will still allocate an output buffer + * large enough to fit a block (see ZSTD_c_stableOutBuffer). This will also + * avoid the memcpy() from the input buffer to the input window buffer. + * + * NOTE: So long as the ZSTD_inBuffer always points to valid memory, using + * this flag is ALWAYS memory safe, and will never access out-of-bounds + * memory. However, compression WILL fail if conditions are not respected. + * + * WARNING: The data in the ZSTD_inBuffer in the range [src, src + pos) MUST + * not be modified during compression or it will result in data corruption. + * This is because zstd needs to reference data in the ZSTD_inBuffer to find + * matches. Normally zstd maintains its own window buffer for this purpose, + * but passing this flag tells zstd to rely on user provided buffer instead. + */ +#define ZSTD_c_stableInBuffer ZSTD_c_experimentalParam9 + +/* ZSTD_c_stableOutBuffer + * Experimental parameter. + * Default is 0 == disabled. Set to 1 to enable. + * + * Tells he compressor that the ZSTD_outBuffer will not be resized between + * calls. Specifically: (out.size - out.pos) will never grow. This gives the + * compressor the freedom to say: If the compressed data doesn't fit in the + * output buffer then return ZSTD_error_dstSizeTooSmall. This allows us to + * always decompress directly into the output buffer, instead of decompressing + * into an internal buffer and copying to the output buffer. + * + * When this flag is enabled zstd won't allocate an output buffer, because + * it can write directly to the ZSTD_outBuffer. It will still allocate the + * input window buffer (see ZSTD_c_stableInBuffer). + * + * Zstd will check that (out.size - out.pos) never grows and return an error + * if it does. While not strictly necessary, this should prevent surprises. + */ +#define ZSTD_c_stableOutBuffer ZSTD_c_experimentalParam10 + +/* ZSTD_c_blockDelimiters + * Default is 0 == ZSTD_sf_noBlockDelimiters. + * + * For use with sequence compression API: ZSTD_compressSequences(). + * + * Designates whether or not the given array of ZSTD_Sequence contains block delimiters + * and last literals, which are defined as sequences with offset == 0 and matchLength == 0. + * See the definition of ZSTD_Sequence for more specifics. + */ +#define ZSTD_c_blockDelimiters ZSTD_c_experimentalParam11 + +/* ZSTD_c_validateSequences + * Default is 0 == disabled. Set to 1 to enable sequence validation. + * + * For use with sequence compression API: ZSTD_compressSequences*(). + * Designates whether or not provided sequences are validated within ZSTD_compressSequences*() + * during function execution. + * + * When Sequence validation is disabled (default), Sequences are compressed as-is, + * so they must correct, otherwise it would result in a corruption error. + * + * Sequence validation adds some protection, by ensuring that all values respect boundary conditions. + * If a Sequence is detected invalid (see doc/zstd_compression_format.md for + * specifics regarding offset/matchlength requirements) then the function will bail out and + * return an error. + */ +#define ZSTD_c_validateSequences ZSTD_c_experimentalParam12 + +/* ZSTD_c_blockSplitterLevel + * note: this parameter only influences the first splitter stage, + * which is active before producing the sequences. + * ZSTD_c_splitAfterSequences controls the next splitter stage, + * which is active after sequence production. + * Note that both can be combined. + * Allowed values are between 0 and ZSTD_BLOCKSPLITTER_LEVEL_MAX included. + * 0 means "auto", which will select a value depending on current ZSTD_c_strategy. + * 1 means no splitting. + * Then, values from 2 to 6 are sorted in increasing cpu load order. + * + * Note that currently the first block is never split, + * to ensure expansion guarantees in presence of incompressible data. + */ +#define ZSTD_BLOCKSPLITTER_LEVEL_MAX 6 +#define ZSTD_c_blockSplitterLevel ZSTD_c_experimentalParam20 + +/* ZSTD_c_splitAfterSequences + * This is a stronger splitter algorithm, + * based on actual sequences previously produced by the selected parser. + * It's also slower, and as a consequence, mostly used for high compression levels. + * While the post-splitter does overlap with the pre-splitter, + * both can nonetheless be combined, + * notably with ZSTD_c_blockSplitterLevel at ZSTD_BLOCKSPLITTER_LEVEL_MAX, + * resulting in higher compression ratio than just one of them. + * + * Default is ZSTD_ps_auto. + * Set to ZSTD_ps_disable to never use block splitter. + * Set to ZSTD_ps_enable to always use block splitter. + * + * By default, in ZSTD_ps_auto, the library will decide at runtime whether to use + * block splitting based on the compression parameters. + */ +#define ZSTD_c_splitAfterSequences ZSTD_c_experimentalParam13 + +/* ZSTD_c_useRowMatchFinder + * Controlled with ZSTD_ParamSwitch_e enum. + * Default is ZSTD_ps_auto. + * Set to ZSTD_ps_disable to never use row-based matchfinder. + * Set to ZSTD_ps_enable to force usage of row-based matchfinder. + * + * By default, in ZSTD_ps_auto, the library will decide at runtime whether to use + * the row-based matchfinder based on support for SIMD instructions and the window log. + * Note that this only pertains to compression strategies: greedy, lazy, and lazy2 + */ +#define ZSTD_c_useRowMatchFinder ZSTD_c_experimentalParam14 + +/* ZSTD_c_deterministicRefPrefix + * Default is 0 == disabled. Set to 1 to enable. + * + * Zstd produces different results for prefix compression when the prefix is + * directly adjacent to the data about to be compressed vs. when it isn't. + * This is because zstd detects that the two buffers are contiguous and it can + * use a more efficient match finding algorithm. However, this produces different + * results than when the two buffers are non-contiguous. This flag forces zstd + * to always load the prefix in non-contiguous mode, even if it happens to be + * adjacent to the data, to guarantee determinism. + * + * If you really care about determinism when using a dictionary or prefix, + * like when doing delta compression, you should select this option. It comes + * at a speed penalty of about ~2.5% if the dictionary and data happened to be + * contiguous, and is free if they weren't contiguous. We don't expect that + * intentionally making the dictionary and data contiguous will be worth the + * cost to memcpy() the data. + */ +#define ZSTD_c_deterministicRefPrefix ZSTD_c_experimentalParam15 + +/* ZSTD_c_prefetchCDictTables + * Controlled with ZSTD_ParamSwitch_e enum. Default is ZSTD_ps_auto. + * + * In some situations, zstd uses CDict tables in-place rather than copying them + * into the working context. (See docs on ZSTD_dictAttachPref_e above for details). + * In such situations, compression speed is seriously impacted when CDict tables are + * "cold" (outside CPU cache). This parameter instructs zstd to prefetch CDict tables + * when they are used in-place. + * + * For sufficiently small inputs, the cost of the prefetch will outweigh the benefit. + * For sufficiently large inputs, zstd will by default memcpy() CDict tables + * into the working context, so there is no need to prefetch. This parameter is + * targeted at a middle range of input sizes, where a prefetch is cheap enough to be + * useful but memcpy() is too expensive. The exact range of input sizes where this + * makes sense is best determined by careful experimentation. + * + * Note: for this parameter, ZSTD_ps_auto is currently equivalent to ZSTD_ps_disable, + * but in the future zstd may conditionally enable this feature via an auto-detection + * heuristic for cold CDicts. + * Use ZSTD_ps_disable to opt out of prefetching under any circumstances. + */ +#define ZSTD_c_prefetchCDictTables ZSTD_c_experimentalParam16 + +/* ZSTD_c_enableSeqProducerFallback + * Allowed values are 0 (disable) and 1 (enable). The default setting is 0. + * + * Controls whether zstd will fall back to an internal sequence producer if an + * external sequence producer is registered and returns an error code. This fallback + * is block-by-block: the internal sequence producer will only be called for blocks + * where the external sequence producer returns an error code. Fallback parsing will + * follow any other cParam settings, such as compression level, the same as in a + * normal (fully-internal) compression operation. + * + * The user is strongly encouraged to read the full Block-Level Sequence Producer API + * documentation (below) before setting this parameter. */ +#define ZSTD_c_enableSeqProducerFallback ZSTD_c_experimentalParam17 + +/* ZSTD_c_maxBlockSize + * Allowed values are between 1KB and ZSTD_BLOCKSIZE_MAX (128KB). + * The default is ZSTD_BLOCKSIZE_MAX, and setting to 0 will set to the default. + * + * This parameter can be used to set an upper bound on the blocksize + * that overrides the default ZSTD_BLOCKSIZE_MAX. It cannot be used to set upper + * bounds greater than ZSTD_BLOCKSIZE_MAX or bounds lower than 1KB (will make + * compressBound() inaccurate). Only currently meant to be used for testing. + */ +#define ZSTD_c_maxBlockSize ZSTD_c_experimentalParam18 + +/* ZSTD_c_repcodeResolution + * This parameter only has an effect if ZSTD_c_blockDelimiters is + * set to ZSTD_sf_explicitBlockDelimiters (may change in the future). + * + * This parameter affects how zstd parses external sequences, + * provided via the ZSTD_compressSequences*() API + * or from an external block-level sequence producer. + * + * If set to ZSTD_ps_enable, the library will check for repeated offsets within + * external sequences, even if those repcodes are not explicitly indicated in + * the "rep" field. Note that this is the only way to exploit repcode matches + * while using compressSequences*() or an external sequence producer, since zstd + * currently ignores the "rep" field of external sequences. + * + * If set to ZSTD_ps_disable, the library will not exploit repeated offsets in + * external sequences, regardless of whether the "rep" field has been set. This + * reduces sequence compression overhead by about 25% while sacrificing some + * compression ratio. + * + * The default value is ZSTD_ps_auto, for which the library will enable/disable + * based on compression level (currently: level<10 disables, level>=10 enables). + */ +#define ZSTD_c_repcodeResolution ZSTD_c_experimentalParam19 +#define ZSTD_c_searchForExternalRepcodes ZSTD_c_experimentalParam19 /* older name */ + + +/*! ZSTD_CCtx_getParameter() : + * Get the requested compression parameter value, selected by enum ZSTD_cParameter, + * and store it into int* value. + * @return : 0, or an error code (which can be tested with ZSTD_isError()). + */ +ZSTDLIB_STATIC_API size_t ZSTD_CCtx_getParameter(const ZSTD_CCtx* cctx, ZSTD_cParameter param, int* value); + + +/*! ZSTD_CCtx_params : + * Quick howto : + * - ZSTD_createCCtxParams() : Create a ZSTD_CCtx_params structure + * - ZSTD_CCtxParams_setParameter() : Push parameters one by one into + * an existing ZSTD_CCtx_params structure. + * This is similar to + * ZSTD_CCtx_setParameter(). + * - ZSTD_CCtx_setParametersUsingCCtxParams() : Apply parameters to + * an existing CCtx. + * These parameters will be applied to + * all subsequent frames. + * - ZSTD_compressStream2() : Do compression using the CCtx. + * - ZSTD_freeCCtxParams() : Free the memory, accept NULL pointer. + * + * This can be used with ZSTD_estimateCCtxSize_advanced_usingCCtxParams() + * for static allocation of CCtx for single-threaded compression. + */ +ZSTDLIB_STATIC_API ZSTD_CCtx_params* ZSTD_createCCtxParams(void); +ZSTDLIB_STATIC_API size_t ZSTD_freeCCtxParams(ZSTD_CCtx_params* params); /* accept NULL pointer */ + +/*! ZSTD_CCtxParams_reset() : + * Reset params to default values. + */ +ZSTDLIB_STATIC_API size_t ZSTD_CCtxParams_reset(ZSTD_CCtx_params* params); + +/*! ZSTD_CCtxParams_init() : + * Initializes the compression parameters of cctxParams according to + * compression level. All other parameters are reset to their default values. + */ +ZSTDLIB_STATIC_API size_t ZSTD_CCtxParams_init(ZSTD_CCtx_params* cctxParams, int compressionLevel); + +/*! ZSTD_CCtxParams_init_advanced() : + * Initializes the compression and frame parameters of cctxParams according to + * params. All other parameters are reset to their default values. + */ +ZSTDLIB_STATIC_API size_t ZSTD_CCtxParams_init_advanced(ZSTD_CCtx_params* cctxParams, ZSTD_parameters params); + +/*! ZSTD_CCtxParams_setParameter() : Requires v1.4.0+ + * Similar to ZSTD_CCtx_setParameter. + * Set one compression parameter, selected by enum ZSTD_cParameter. + * Parameters must be applied to a ZSTD_CCtx using + * ZSTD_CCtx_setParametersUsingCCtxParams(). + * @result : a code representing success or failure (which can be tested with + * ZSTD_isError()). + */ +ZSTDLIB_STATIC_API size_t ZSTD_CCtxParams_setParameter(ZSTD_CCtx_params* params, ZSTD_cParameter param, int value); + +/*! ZSTD_CCtxParams_getParameter() : + * Similar to ZSTD_CCtx_getParameter. + * Get the requested value of one compression parameter, selected by enum ZSTD_cParameter. + * @result : 0, or an error code (which can be tested with ZSTD_isError()). + */ +ZSTDLIB_STATIC_API size_t ZSTD_CCtxParams_getParameter(const ZSTD_CCtx_params* params, ZSTD_cParameter param, int* value); + +/*! ZSTD_CCtx_setParametersUsingCCtxParams() : + * Apply a set of ZSTD_CCtx_params to the compression context. + * This can be done even after compression is started, + * if nbWorkers==0, this will have no impact until a new compression is started. + * if nbWorkers>=1, new parameters will be picked up at next job, + * with a few restrictions (windowLog, pledgedSrcSize, nbWorkers, jobSize, and overlapLog are not updated). + */ +ZSTDLIB_STATIC_API size_t ZSTD_CCtx_setParametersUsingCCtxParams( + ZSTD_CCtx* cctx, const ZSTD_CCtx_params* params); + +/*! ZSTD_compressStream2_simpleArgs() : + * Same as ZSTD_compressStream2(), + * but using only integral types as arguments. + * This variant might be helpful for binders from dynamic languages + * which have troubles handling structures containing memory pointers. + */ +ZSTDLIB_STATIC_API size_t ZSTD_compressStream2_simpleArgs ( + ZSTD_CCtx* cctx, + void* dst, size_t dstCapacity, size_t* dstPos, + const void* src, size_t srcSize, size_t* srcPos, + ZSTD_EndDirective endOp); + + +/*************************************** +* Advanced decompression functions +***************************************/ + +/*! ZSTD_isFrame() : + * Tells if the content of `buffer` starts with a valid Frame Identifier. + * Note : Frame Identifier is 4 bytes. If `size < 4`, @return will always be 0. + * Note 2 : Legacy Frame Identifiers are considered valid only if Legacy Support is enabled. + * Note 3 : Skippable Frame Identifiers are considered valid. */ +ZSTDLIB_STATIC_API unsigned ZSTD_isFrame(const void* buffer, size_t size); + +/*! ZSTD_createDDict_byReference() : + * Create a digested dictionary, ready to start decompression operation without startup delay. + * Dictionary content is referenced, and therefore stays in dictBuffer. + * It is important that dictBuffer outlives DDict, + * it must remain read accessible throughout the lifetime of DDict */ +ZSTDLIB_STATIC_API ZSTD_DDict* ZSTD_createDDict_byReference(const void* dictBuffer, size_t dictSize); + +/*! ZSTD_DCtx_loadDictionary_byReference() : + * Same as ZSTD_DCtx_loadDictionary(), + * but references `dict` content instead of copying it into `dctx`. + * This saves memory if `dict` remains around., + * However, it's imperative that `dict` remains accessible (and unmodified) while being used, so it must outlive decompression. */ +ZSTDLIB_STATIC_API size_t ZSTD_DCtx_loadDictionary_byReference(ZSTD_DCtx* dctx, const void* dict, size_t dictSize); + +/*! ZSTD_DCtx_loadDictionary_advanced() : + * Same as ZSTD_DCtx_loadDictionary(), + * but gives direct control over + * how to load the dictionary (by copy ? by reference ?) + * and how to interpret it (automatic ? force raw mode ? full mode only ?). */ +ZSTDLIB_STATIC_API size_t ZSTD_DCtx_loadDictionary_advanced(ZSTD_DCtx* dctx, const void* dict, size_t dictSize, ZSTD_dictLoadMethod_e dictLoadMethod, ZSTD_dictContentType_e dictContentType); + +/*! ZSTD_DCtx_refPrefix_advanced() : + * Same as ZSTD_DCtx_refPrefix(), but gives finer control over + * how to interpret prefix content (automatic ? force raw mode (default) ? full mode only ?) */ +ZSTDLIB_STATIC_API size_t ZSTD_DCtx_refPrefix_advanced(ZSTD_DCtx* dctx, const void* prefix, size_t prefixSize, ZSTD_dictContentType_e dictContentType); + +/*! ZSTD_DCtx_setMaxWindowSize() : + * Refuses allocating internal buffers for frames requiring a window size larger than provided limit. + * This protects a decoder context from reserving too much memory for itself (potential attack scenario). + * This parameter is only useful in streaming mode, since no internal buffer is allocated in single-pass mode. + * By default, a decompression context accepts all window sizes <= (1 << ZSTD_WINDOWLOG_LIMIT_DEFAULT) + * @return : 0, or an error code (which can be tested using ZSTD_isError()). + */ +ZSTDLIB_STATIC_API size_t ZSTD_DCtx_setMaxWindowSize(ZSTD_DCtx* dctx, size_t maxWindowSize); + +/*! ZSTD_DCtx_getParameter() : + * Get the requested decompression parameter value, selected by enum ZSTD_dParameter, + * and store it into int* value. + * @return : 0, or an error code (which can be tested with ZSTD_isError()). + */ +ZSTDLIB_STATIC_API size_t ZSTD_DCtx_getParameter(ZSTD_DCtx* dctx, ZSTD_dParameter param, int* value); + +/* ZSTD_d_format + * experimental parameter, + * allowing selection between ZSTD_format_e input compression formats + */ +#define ZSTD_d_format ZSTD_d_experimentalParam1 +/* ZSTD_d_stableOutBuffer + * Experimental parameter. + * Default is 0 == disabled. Set to 1 to enable. + * + * Tells the decompressor that the ZSTD_outBuffer will ALWAYS be the same + * between calls, except for the modifications that zstd makes to pos (the + * caller must not modify pos). This is checked by the decompressor, and + * decompression will fail if it ever changes. Therefore the ZSTD_outBuffer + * MUST be large enough to fit the entire decompressed frame. This will be + * checked when the frame content size is known. The data in the ZSTD_outBuffer + * in the range [dst, dst + pos) MUST not be modified during decompression + * or you will get data corruption. + * + * When this flag is enabled zstd won't allocate an output buffer, because + * it can write directly to the ZSTD_outBuffer, but it will still allocate + * an input buffer large enough to fit any compressed block. This will also + * avoid the memcpy() from the internal output buffer to the ZSTD_outBuffer. + * If you need to avoid the input buffer allocation use the buffer-less + * streaming API. + * + * NOTE: So long as the ZSTD_outBuffer always points to valid memory, using + * this flag is ALWAYS memory safe, and will never access out-of-bounds + * memory. However, decompression WILL fail if you violate the preconditions. + * + * WARNING: The data in the ZSTD_outBuffer in the range [dst, dst + pos) MUST + * not be modified during decompression or you will get data corruption. This + * is because zstd needs to reference data in the ZSTD_outBuffer to regenerate + * matches. Normally zstd maintains its own buffer for this purpose, but passing + * this flag tells zstd to use the user provided buffer. + */ +#define ZSTD_d_stableOutBuffer ZSTD_d_experimentalParam2 + +/* ZSTD_d_forceIgnoreChecksum + * Experimental parameter. + * Default is 0 == disabled. Set to 1 to enable + * + * Tells the decompressor to skip checksum validation during decompression, regardless + * of whether checksumming was specified during compression. This offers some + * slight performance benefits, and may be useful for debugging. + * Param has values of type ZSTD_forceIgnoreChecksum_e + */ +#define ZSTD_d_forceIgnoreChecksum ZSTD_d_experimentalParam3 + +/* ZSTD_d_refMultipleDDicts + * Experimental parameter. + * Default is 0 == disabled. Set to 1 to enable + * + * If enabled and dctx is allocated on the heap, then additional memory will be allocated + * to store references to multiple ZSTD_DDict. That is, multiple calls of ZSTD_refDDict() + * using a given ZSTD_DCtx, rather than overwriting the previous DDict reference, will instead + * store all references. At decompression time, the appropriate dictID is selected + * from the set of DDicts based on the dictID in the frame. + * + * Usage is simply calling ZSTD_refDDict() on multiple dict buffers. + * + * Param has values of byte ZSTD_refMultipleDDicts_e + * + * WARNING: Enabling this parameter and calling ZSTD_DCtx_refDDict(), will trigger memory + * allocation for the hash table. ZSTD_freeDCtx() also frees this memory. + * Memory is allocated as per ZSTD_DCtx::customMem. + * + * Although this function allocates memory for the table, the user is still responsible for + * memory management of the underlying ZSTD_DDict* themselves. + */ +#define ZSTD_d_refMultipleDDicts ZSTD_d_experimentalParam4 + +/* ZSTD_d_disableHuffmanAssembly + * Set to 1 to disable the Huffman assembly implementation. + * The default value is 0, which allows zstd to use the Huffman assembly + * implementation if available. + * + * This parameter can be used to disable Huffman assembly at runtime. + * If you want to disable it at compile time you can define the macro + * ZSTD_DISABLE_ASM. + */ +#define ZSTD_d_disableHuffmanAssembly ZSTD_d_experimentalParam5 + +/* ZSTD_d_maxBlockSize + * Allowed values are between 1KB and ZSTD_BLOCKSIZE_MAX (128KB). + * The default is ZSTD_BLOCKSIZE_MAX, and setting to 0 will set to the default. + * + * Forces the decompressor to reject blocks whose content size is + * larger than the configured maxBlockSize. When maxBlockSize is + * larger than the windowSize, the windowSize is used instead. + * This saves memory on the decoder when you know all blocks are small. + * + * This option is typically used in conjunction with ZSTD_c_maxBlockSize. + * + * WARNING: This causes the decoder to reject otherwise valid frames + * that have block sizes larger than the configured maxBlockSize. + */ +#define ZSTD_d_maxBlockSize ZSTD_d_experimentalParam6 + + +/*! ZSTD_DCtx_setFormat() : + * This function is REDUNDANT. Prefer ZSTD_DCtx_setParameter(). + * Instruct the decoder context about what kind of data to decode next. + * This instruction is mandatory to decode data without a fully-formed header, + * such ZSTD_f_zstd1_magicless for example. + * @return : 0, or an error code (which can be tested using ZSTD_isError()). */ +ZSTD_DEPRECATED("use ZSTD_DCtx_setParameter() instead") +ZSTDLIB_STATIC_API +size_t ZSTD_DCtx_setFormat(ZSTD_DCtx* dctx, ZSTD_format_e format); + +/*! ZSTD_decompressStream_simpleArgs() : + * Same as ZSTD_decompressStream(), + * but using only integral types as arguments. + * This can be helpful for binders from dynamic languages + * which have troubles handling structures containing memory pointers. + */ +ZSTDLIB_STATIC_API size_t ZSTD_decompressStream_simpleArgs ( + ZSTD_DCtx* dctx, + void* dst, size_t dstCapacity, size_t* dstPos, + const void* src, size_t srcSize, size_t* srcPos); + + +/******************************************************************** +* Advanced streaming functions +* Warning : most of these functions are now redundant with the Advanced API. +* Once Advanced API reaches "stable" status, +* redundant functions will be deprecated, and then at some point removed. +********************************************************************/ + +/*===== Advanced Streaming compression functions =====*/ + +/*! ZSTD_initCStream_srcSize() : + * This function is DEPRECATED, and equivalent to: + * ZSTD_CCtx_reset(zcs, ZSTD_reset_session_only); + * ZSTD_CCtx_refCDict(zcs, NULL); // clear the dictionary (if any) + * ZSTD_CCtx_setParameter(zcs, ZSTD_c_compressionLevel, compressionLevel); + * ZSTD_CCtx_setPledgedSrcSize(zcs, pledgedSrcSize); + * + * pledgedSrcSize must be correct. If it is not known at init time, use + * ZSTD_CONTENTSIZE_UNKNOWN. Note that, for compatibility with older programs, + * "0" also disables frame content size field. It may be enabled in the future. + * This prototype will generate compilation warnings. + */ +ZSTD_DEPRECATED("use ZSTD_CCtx_reset, see zstd.h for detailed instructions") +ZSTDLIB_STATIC_API +size_t ZSTD_initCStream_srcSize(ZSTD_CStream* zcs, + int compressionLevel, + unsigned long long pledgedSrcSize); + +/*! ZSTD_initCStream_usingDict() : + * This function is DEPRECATED, and is equivalent to: + * ZSTD_CCtx_reset(zcs, ZSTD_reset_session_only); + * ZSTD_CCtx_setParameter(zcs, ZSTD_c_compressionLevel, compressionLevel); + * ZSTD_CCtx_loadDictionary(zcs, dict, dictSize); + * + * Creates of an internal CDict (incompatible with static CCtx), except if + * dict == NULL or dictSize < 8, in which case no dict is used. + * Note: dict is loaded with ZSTD_dct_auto (treated as a full zstd dictionary if + * it begins with ZSTD_MAGIC_DICTIONARY, else as raw content) and ZSTD_dlm_byCopy. + * This prototype will generate compilation warnings. + */ +ZSTD_DEPRECATED("use ZSTD_CCtx_reset, see zstd.h for detailed instructions") +ZSTDLIB_STATIC_API +size_t ZSTD_initCStream_usingDict(ZSTD_CStream* zcs, + const void* dict, size_t dictSize, + int compressionLevel); + +/*! ZSTD_initCStream_advanced() : + * This function is DEPRECATED, and is equivalent to: + * ZSTD_CCtx_reset(zcs, ZSTD_reset_session_only); + * ZSTD_CCtx_setParams(zcs, params); + * ZSTD_CCtx_setPledgedSrcSize(zcs, pledgedSrcSize); + * ZSTD_CCtx_loadDictionary(zcs, dict, dictSize); + * + * dict is loaded with ZSTD_dct_auto and ZSTD_dlm_byCopy. + * pledgedSrcSize must be correct. + * If srcSize is not known at init time, use value ZSTD_CONTENTSIZE_UNKNOWN. + * This prototype will generate compilation warnings. + */ +ZSTD_DEPRECATED("use ZSTD_CCtx_reset, see zstd.h for detailed instructions") +ZSTDLIB_STATIC_API +size_t ZSTD_initCStream_advanced(ZSTD_CStream* zcs, + const void* dict, size_t dictSize, + ZSTD_parameters params, + unsigned long long pledgedSrcSize); + +/*! ZSTD_initCStream_usingCDict() : + * This function is DEPRECATED, and equivalent to: + * ZSTD_CCtx_reset(zcs, ZSTD_reset_session_only); + * ZSTD_CCtx_refCDict(zcs, cdict); + * + * note : cdict will just be referenced, and must outlive compression session + * This prototype will generate compilation warnings. + */ +ZSTD_DEPRECATED("use ZSTD_CCtx_reset and ZSTD_CCtx_refCDict, see zstd.h for detailed instructions") +ZSTDLIB_STATIC_API +size_t ZSTD_initCStream_usingCDict(ZSTD_CStream* zcs, const ZSTD_CDict* cdict); + +/*! ZSTD_initCStream_usingCDict_advanced() : + * This function is DEPRECATED, and is equivalent to: + * ZSTD_CCtx_reset(zcs, ZSTD_reset_session_only); + * ZSTD_CCtx_setFParams(zcs, fParams); + * ZSTD_CCtx_setPledgedSrcSize(zcs, pledgedSrcSize); + * ZSTD_CCtx_refCDict(zcs, cdict); + * + * same as ZSTD_initCStream_usingCDict(), with control over frame parameters. + * pledgedSrcSize must be correct. If srcSize is not known at init time, use + * value ZSTD_CONTENTSIZE_UNKNOWN. + * This prototype will generate compilation warnings. + */ +ZSTD_DEPRECATED("use ZSTD_CCtx_reset and ZSTD_CCtx_refCDict, see zstd.h for detailed instructions") +ZSTDLIB_STATIC_API +size_t ZSTD_initCStream_usingCDict_advanced(ZSTD_CStream* zcs, + const ZSTD_CDict* cdict, + ZSTD_frameParameters fParams, + unsigned long long pledgedSrcSize); + +/*! ZSTD_resetCStream() : + * This function is DEPRECATED, and is equivalent to: + * ZSTD_CCtx_reset(zcs, ZSTD_reset_session_only); + * ZSTD_CCtx_setPledgedSrcSize(zcs, pledgedSrcSize); + * Note: ZSTD_resetCStream() interprets pledgedSrcSize == 0 as ZSTD_CONTENTSIZE_UNKNOWN, but + * ZSTD_CCtx_setPledgedSrcSize() does not do the same, so ZSTD_CONTENTSIZE_UNKNOWN must be + * explicitly specified. + * + * start a new frame, using same parameters from previous frame. + * This is typically useful to skip dictionary loading stage, since it will reuse it in-place. + * Note that zcs must be init at least once before using ZSTD_resetCStream(). + * If pledgedSrcSize is not known at reset time, use macro ZSTD_CONTENTSIZE_UNKNOWN. + * If pledgedSrcSize > 0, its value must be correct, as it will be written in header, and controlled at the end. + * For the time being, pledgedSrcSize==0 is interpreted as "srcSize unknown" for compatibility with older programs, + * but it will change to mean "empty" in future version, so use macro ZSTD_CONTENTSIZE_UNKNOWN instead. + * @return : 0, or an error code (which can be tested using ZSTD_isError()) + * This prototype will generate compilation warnings. + */ +ZSTD_DEPRECATED("use ZSTD_CCtx_reset, see zstd.h for detailed instructions") +ZSTDLIB_STATIC_API +size_t ZSTD_resetCStream(ZSTD_CStream* zcs, unsigned long long pledgedSrcSize); + + +typedef struct { + unsigned long long ingested; /* nb input bytes read and buffered */ + unsigned long long consumed; /* nb input bytes actually compressed */ + unsigned long long produced; /* nb of compressed bytes generated and buffered */ + unsigned long long flushed; /* nb of compressed bytes flushed : not provided; can be tracked from caller side */ + unsigned currentJobID; /* MT only : latest started job nb */ + unsigned nbActiveWorkers; /* MT only : nb of workers actively compressing at probe time */ +} ZSTD_frameProgression; + +/* ZSTD_getFrameProgression() : + * tells how much data has been ingested (read from input) + * consumed (input actually compressed) and produced (output) for current frame. + * Note : (ingested - consumed) is amount of input data buffered internally, not yet compressed. + * Aggregates progression inside active worker threads. + */ +ZSTDLIB_STATIC_API ZSTD_frameProgression ZSTD_getFrameProgression(const ZSTD_CCtx* cctx); + +/*! ZSTD_toFlushNow() : + * Tell how many bytes are ready to be flushed immediately. + * Useful for multithreading scenarios (nbWorkers >= 1). + * Probe the oldest active job, defined as oldest job not yet entirely flushed, + * and check its output buffer. + * @return : amount of data stored in oldest job and ready to be flushed immediately. + * if @return == 0, it means either : + * + there is no active job (could be checked with ZSTD_frameProgression()), or + * + oldest job is still actively compressing data, + * but everything it has produced has also been flushed so far, + * therefore flush speed is limited by production speed of oldest job + * irrespective of the speed of concurrent (and newer) jobs. + */ +ZSTDLIB_STATIC_API size_t ZSTD_toFlushNow(ZSTD_CCtx* cctx); + + +/*===== Advanced Streaming decompression functions =====*/ + +/*! + * This function is deprecated, and is equivalent to: + * + * ZSTD_DCtx_reset(zds, ZSTD_reset_session_only); + * ZSTD_DCtx_loadDictionary(zds, dict, dictSize); + * + * note: no dictionary will be used if dict == NULL or dictSize < 8 + */ +ZSTD_DEPRECATED("use ZSTD_DCtx_reset + ZSTD_DCtx_loadDictionary, see zstd.h for detailed instructions") +ZSTDLIB_STATIC_API size_t ZSTD_initDStream_usingDict(ZSTD_DStream* zds, const void* dict, size_t dictSize); + +/*! + * This function is deprecated, and is equivalent to: + * + * ZSTD_DCtx_reset(zds, ZSTD_reset_session_only); + * ZSTD_DCtx_refDDict(zds, ddict); + * + * note : ddict is referenced, it must outlive decompression session + */ +ZSTD_DEPRECATED("use ZSTD_DCtx_reset + ZSTD_DCtx_refDDict, see zstd.h for detailed instructions") +ZSTDLIB_STATIC_API size_t ZSTD_initDStream_usingDDict(ZSTD_DStream* zds, const ZSTD_DDict* ddict); + +/*! + * This function is deprecated, and is equivalent to: + * + * ZSTD_DCtx_reset(zds, ZSTD_reset_session_only); + * + * reuse decompression parameters from previous init; saves dictionary loading + */ +ZSTD_DEPRECATED("use ZSTD_DCtx_reset, see zstd.h for detailed instructions") +ZSTDLIB_STATIC_API size_t ZSTD_resetDStream(ZSTD_DStream* zds); + + +/* ********************* BLOCK-LEVEL SEQUENCE PRODUCER API ********************* + * + * *** OVERVIEW *** + * The Block-Level Sequence Producer API allows users to provide their own custom + * sequence producer which libzstd invokes to process each block. The produced list + * of sequences (literals and matches) is then post-processed by libzstd to produce + * valid compressed blocks. + * + * This block-level offload API is a more granular complement of the existing + * frame-level offload API compressSequences() (introduced in v1.5.1). It offers + * an easier migration story for applications already integrated with libzstd: the + * user application continues to invoke the same compression functions + * ZSTD_compress2() or ZSTD_compressStream2() as usual, and transparently benefits + * from the specific advantages of the external sequence producer. For example, + * the sequence producer could be tuned to take advantage of known characteristics + * of the input, to offer better speed / ratio, or could leverage hardware + * acceleration not available within libzstd itself. + * + * See contrib/externalSequenceProducer for an example program employing the + * Block-Level Sequence Producer API. + * + * *** USAGE *** + * The user is responsible for implementing a function of type + * ZSTD_sequenceProducer_F. For each block, zstd will pass the following + * arguments to the user-provided function: + * + * - sequenceProducerState: a pointer to a user-managed state for the sequence + * producer. + * + * - outSeqs, outSeqsCapacity: an output buffer for the sequence producer. + * outSeqsCapacity is guaranteed >= ZSTD_sequenceBound(srcSize). The memory + * backing outSeqs is managed by the CCtx. + * + * - src, srcSize: an input buffer for the sequence producer to parse. + * srcSize is guaranteed to be <= ZSTD_BLOCKSIZE_MAX. + * + * - dict, dictSize: a history buffer, which may be empty, which the sequence + * producer may reference as it parses the src buffer. Currently, zstd will + * always pass dictSize == 0 into external sequence producers, but this will + * change in the future. + * + * - compressionLevel: a signed integer representing the zstd compression level + * set by the user for the current operation. The sequence producer may choose + * to use this information to change its compression strategy and speed/ratio + * tradeoff. Note: the compression level does not reflect zstd parameters set + * through the advanced API. + * + * - windowSize: a size_t representing the maximum allowed offset for external + * sequences. Note that sequence offsets are sometimes allowed to exceed the + * windowSize if a dictionary is present, see doc/zstd_compression_format.md + * for details. + * + * The user-provided function shall return a size_t representing the number of + * sequences written to outSeqs. This return value will be treated as an error + * code if it is greater than outSeqsCapacity. The return value must be non-zero + * if srcSize is non-zero. The ZSTD_SEQUENCE_PRODUCER_ERROR macro is provided + * for convenience, but any value greater than outSeqsCapacity will be treated as + * an error code. + * + * If the user-provided function does not return an error code, the sequences + * written to outSeqs must be a valid parse of the src buffer. Data corruption may + * occur if the parse is not valid. A parse is defined to be valid if the + * following conditions hold: + * - The sum of matchLengths and literalLengths must equal srcSize. + * - All sequences in the parse, except for the final sequence, must have + * matchLength >= ZSTD_MINMATCH_MIN. The final sequence must have + * matchLength >= ZSTD_MINMATCH_MIN or matchLength == 0. + * - All offsets must respect the windowSize parameter as specified in + * doc/zstd_compression_format.md. + * - If the final sequence has matchLength == 0, it must also have offset == 0. + * + * zstd will only validate these conditions (and fail compression if they do not + * hold) if the ZSTD_c_validateSequences cParam is enabled. Note that sequence + * validation has a performance cost. + * + * If the user-provided function returns an error, zstd will either fall back + * to an internal sequence producer or fail the compression operation. The user can + * choose between the two behaviors by setting the ZSTD_c_enableSeqProducerFallback + * cParam. Fallback compression will follow any other cParam settings, such as + * compression level, the same as in a normal compression operation. + * + * The user shall instruct zstd to use a particular ZSTD_sequenceProducer_F + * function by calling + * ZSTD_registerSequenceProducer(cctx, + * sequenceProducerState, + * sequenceProducer) + * This setting will persist until the next parameter reset of the CCtx. + * + * The sequenceProducerState must be initialized by the user before calling + * ZSTD_registerSequenceProducer(). The user is responsible for destroying the + * sequenceProducerState. + * + * *** LIMITATIONS *** + * This API is compatible with all zstd compression APIs which respect advanced parameters. + * However, there are three limitations: + * + * First, the ZSTD_c_enableLongDistanceMatching cParam is not currently supported. + * COMPRESSION WILL FAIL if it is enabled and the user tries to compress with a block-level + * external sequence producer. + * - Note that ZSTD_c_enableLongDistanceMatching is auto-enabled by default in some + * cases (see its documentation for details). Users must explicitly set + * ZSTD_c_enableLongDistanceMatching to ZSTD_ps_disable in such cases if an external + * sequence producer is registered. + * - As of this writing, ZSTD_c_enableLongDistanceMatching is disabled by default + * whenever ZSTD_c_windowLog < 128MB, but that's subject to change. Users should + * check the docs on ZSTD_c_enableLongDistanceMatching whenever the Block-Level Sequence + * Producer API is used in conjunction with advanced settings (like ZSTD_c_windowLog). + * + * Second, history buffers are not currently supported. Concretely, zstd will always pass + * dictSize == 0 to the external sequence producer (for now). This has two implications: + * - Dictionaries are not currently supported. Compression will *not* fail if the user + * references a dictionary, but the dictionary won't have any effect. + * - Stream history is not currently supported. All advanced compression APIs, including + * streaming APIs, work with external sequence producers, but each block is treated as + * an independent chunk without history from previous blocks. + * + * Third, multi-threading within a single compression is not currently supported. In other words, + * COMPRESSION WILL FAIL if ZSTD_c_nbWorkers > 0 and an external sequence producer is registered. + * Multi-threading across compressions is fine: simply create one CCtx per thread. + * + * Long-term, we plan to overcome all three limitations. There is no technical blocker to + * overcoming them. It is purely a question of engineering effort. + */ + +#define ZSTD_SEQUENCE_PRODUCER_ERROR ((size_t)(-1)) + +typedef size_t (*ZSTD_sequenceProducer_F) ( + void* sequenceProducerState, + ZSTD_Sequence* outSeqs, size_t outSeqsCapacity, + const void* src, size_t srcSize, + const void* dict, size_t dictSize, + int compressionLevel, + size_t windowSize +); + +/*! ZSTD_registerSequenceProducer() : + * Instruct zstd to use a block-level external sequence producer function. + * + * The sequenceProducerState must be initialized by the caller, and the caller is + * responsible for managing its lifetime. This parameter is sticky across + * compressions. It will remain set until the user explicitly resets compression + * parameters. + * + * Sequence producer registration is considered to be an "advanced parameter", + * part of the "advanced API". This means it will only have an effect on compression + * APIs which respect advanced parameters, such as compress2() and compressStream2(). + * Older compression APIs such as compressCCtx(), which predate the introduction of + * "advanced parameters", will ignore any external sequence producer setting. + * + * The sequence producer can be "cleared" by registering a NULL function pointer. This + * removes all limitations described above in the "LIMITATIONS" section of the API docs. + * + * The user is strongly encouraged to read the full API documentation (above) before + * calling this function. */ +ZSTDLIB_STATIC_API void +ZSTD_registerSequenceProducer( + ZSTD_CCtx* cctx, + void* sequenceProducerState, + ZSTD_sequenceProducer_F sequenceProducer +); + +/*! ZSTD_CCtxParams_registerSequenceProducer() : + * Same as ZSTD_registerSequenceProducer(), but operates on ZSTD_CCtx_params. + * This is used for accurate size estimation with ZSTD_estimateCCtxSize_usingCCtxParams(), + * which is needed when creating a ZSTD_CCtx with ZSTD_initStaticCCtx(). + * + * If you are using the external sequence producer API in a scenario where ZSTD_initStaticCCtx() + * is required, then this function is for you. Otherwise, you probably don't need it. + * + * See tests/zstreamtest.c for example usage. */ +ZSTDLIB_STATIC_API void +ZSTD_CCtxParams_registerSequenceProducer( + ZSTD_CCtx_params* params, + void* sequenceProducerState, + ZSTD_sequenceProducer_F sequenceProducer +); + + +/********************************************************************* +* Buffer-less and synchronous inner streaming functions (DEPRECATED) +* +* This API is deprecated, and will be removed in a future version. +* It allows streaming (de)compression with user allocated buffers. +* However, it is hard to use, and not as well tested as the rest of +* our API. +* +* Please use the normal streaming API instead: ZSTD_compressStream2, +* and ZSTD_decompressStream. +* If there is functionality that you need, but it doesn't provide, +* please open an issue on our GitHub. +********************************************************************* */ + +/** + Buffer-less streaming compression (synchronous mode) + + A ZSTD_CCtx object is required to track streaming operations. + Use ZSTD_createCCtx() / ZSTD_freeCCtx() to manage resource. + ZSTD_CCtx object can be reused multiple times within successive compression operations. + + Start by initializing a context. + Use ZSTD_compressBegin(), or ZSTD_compressBegin_usingDict() for dictionary compression. + + Then, consume your input using ZSTD_compressContinue(). + There are some important considerations to keep in mind when using this advanced function : + - ZSTD_compressContinue() has no internal buffer. It uses externally provided buffers only. + - Interface is synchronous : input is consumed entirely and produces 1+ compressed blocks. + - Caller must ensure there is enough space in `dst` to store compressed data under worst case scenario. + Worst case evaluation is provided by ZSTD_compressBound(). + ZSTD_compressContinue() doesn't guarantee recover after a failed compression. + - ZSTD_compressContinue() presumes prior input ***is still accessible and unmodified*** (up to maximum distance size, see WindowLog). + It remembers all previous contiguous blocks, plus one separated memory segment (which can itself consists of multiple contiguous blocks) + - ZSTD_compressContinue() detects that prior input has been overwritten when `src` buffer overlaps. + In which case, it will "discard" the relevant memory section from its history. + + Finish a frame with ZSTD_compressEnd(), which will write the last block(s) and optional checksum. + It's possible to use srcSize==0, in which case, it will write a final empty block to end the frame. + Without last block mark, frames are considered unfinished (hence corrupted) by compliant decoders. + + `ZSTD_CCtx` object can be reused (ZSTD_compressBegin()) to compress again. +*/ + +/*===== Buffer-less streaming compression functions =====*/ +ZSTD_DEPRECATED("The buffer-less API is deprecated in favor of the normal streaming API. See docs.") +ZSTDLIB_STATIC_API size_t ZSTD_compressBegin(ZSTD_CCtx* cctx, int compressionLevel); +ZSTD_DEPRECATED("The buffer-less API is deprecated in favor of the normal streaming API. See docs.") +ZSTDLIB_STATIC_API size_t ZSTD_compressBegin_usingDict(ZSTD_CCtx* cctx, const void* dict, size_t dictSize, int compressionLevel); +ZSTD_DEPRECATED("The buffer-less API is deprecated in favor of the normal streaming API. See docs.") +ZSTDLIB_STATIC_API size_t ZSTD_compressBegin_usingCDict(ZSTD_CCtx* cctx, const ZSTD_CDict* cdict); /**< note: fails if cdict==NULL */ + +ZSTD_DEPRECATED("This function will likely be removed in a future release. It is misleading and has very limited utility.") +ZSTDLIB_STATIC_API +size_t ZSTD_copyCCtx(ZSTD_CCtx* cctx, const ZSTD_CCtx* preparedCCtx, unsigned long long pledgedSrcSize); /**< note: if pledgedSrcSize is not known, use ZSTD_CONTENTSIZE_UNKNOWN */ + +ZSTD_DEPRECATED("The buffer-less API is deprecated in favor of the normal streaming API. See docs.") +ZSTDLIB_STATIC_API size_t ZSTD_compressContinue(ZSTD_CCtx* cctx, void* dst, size_t dstCapacity, const void* src, size_t srcSize); +ZSTD_DEPRECATED("The buffer-less API is deprecated in favor of the normal streaming API. See docs.") +ZSTDLIB_STATIC_API size_t ZSTD_compressEnd(ZSTD_CCtx* cctx, void* dst, size_t dstCapacity, const void* src, size_t srcSize); + +/* The ZSTD_compressBegin_advanced() and ZSTD_compressBegin_usingCDict_advanced() are now DEPRECATED and will generate a compiler warning */ +ZSTD_DEPRECATED("use advanced API to access custom parameters") +ZSTDLIB_STATIC_API +size_t ZSTD_compressBegin_advanced(ZSTD_CCtx* cctx, const void* dict, size_t dictSize, ZSTD_parameters params, unsigned long long pledgedSrcSize); /**< pledgedSrcSize : If srcSize is not known at init time, use ZSTD_CONTENTSIZE_UNKNOWN */ +ZSTD_DEPRECATED("use advanced API to access custom parameters") +ZSTDLIB_STATIC_API +size_t ZSTD_compressBegin_usingCDict_advanced(ZSTD_CCtx* const cctx, const ZSTD_CDict* const cdict, ZSTD_frameParameters const fParams, unsigned long long const pledgedSrcSize); /* compression parameters are already set within cdict. pledgedSrcSize must be correct. If srcSize is not known, use macro ZSTD_CONTENTSIZE_UNKNOWN */ +/** + Buffer-less streaming decompression (synchronous mode) + + A ZSTD_DCtx object is required to track streaming operations. + Use ZSTD_createDCtx() / ZSTD_freeDCtx() to manage it. + A ZSTD_DCtx object can be reused multiple times. + + First typical operation is to retrieve frame parameters, using ZSTD_getFrameHeader(). + Frame header is extracted from the beginning of compressed frame, so providing only the frame's beginning is enough. + Data fragment must be large enough to ensure successful decoding. + `ZSTD_frameHeaderSize_max` bytes is guaranteed to always be large enough. + result : 0 : successful decoding, the `ZSTD_frameHeader` structure is correctly filled. + >0 : `srcSize` is too small, please provide at least result bytes on next attempt. + errorCode, which can be tested using ZSTD_isError(). + + It fills a ZSTD_FrameHeader structure with important information to correctly decode the frame, + such as the dictionary ID, content size, or maximum back-reference distance (`windowSize`). + Note that these values could be wrong, either because of data corruption, or because a 3rd party deliberately spoofs false information. + As a consequence, check that values remain within valid application range. + For example, do not allocate memory blindly, check that `windowSize` is within expectation. + Each application can set its own limits, depending on local restrictions. + For extended interoperability, it is recommended to support `windowSize` of at least 8 MB. + + ZSTD_decompressContinue() needs previous data blocks during decompression, up to `windowSize` bytes. + ZSTD_decompressContinue() is very sensitive to contiguity, + if 2 blocks don't follow each other, make sure that either the compressor breaks contiguity at the same place, + or that previous contiguous segment is large enough to properly handle maximum back-reference distance. + There are multiple ways to guarantee this condition. + + The most memory efficient way is to use a round buffer of sufficient size. + Sufficient size is determined by invoking ZSTD_decodingBufferSize_min(), + which can return an error code if required value is too large for current system (in 32-bits mode). + In a round buffer methodology, ZSTD_decompressContinue() decompresses each block next to previous one, + up to the moment there is not enough room left in the buffer to guarantee decoding another full block, + which maximum size is provided in `ZSTD_frameHeader` structure, field `blockSizeMax`. + At which point, decoding can resume from the beginning of the buffer. + Note that already decoded data stored in the buffer should be flushed before being overwritten. + + There are alternatives possible, for example using two or more buffers of size `windowSize` each, though they consume more memory. + + Finally, if you control the compression process, you can also ignore all buffer size rules, + as long as the encoder and decoder progress in "lock-step", + aka use exactly the same buffer sizes, break contiguity at the same place, etc. + + Once buffers are setup, start decompression, with ZSTD_decompressBegin(). + If decompression requires a dictionary, use ZSTD_decompressBegin_usingDict() or ZSTD_decompressBegin_usingDDict(). + + Then use ZSTD_nextSrcSizeToDecompress() and ZSTD_decompressContinue() alternatively. + ZSTD_nextSrcSizeToDecompress() tells how many bytes to provide as 'srcSize' to ZSTD_decompressContinue(). + ZSTD_decompressContinue() requires this _exact_ amount of bytes, or it will fail. + + result of ZSTD_decompressContinue() is the number of bytes regenerated within 'dst' (necessarily <= dstCapacity). + It can be zero : it just means ZSTD_decompressContinue() has decoded some metadata item. + It can also be an error code, which can be tested with ZSTD_isError(). + + A frame is fully decoded when ZSTD_nextSrcSizeToDecompress() returns zero. + Context can then be reset to start a new decompression. + + Note : it's possible to know if next input to present is a header or a block, using ZSTD_nextInputType(). + This information is not required to properly decode a frame. + + == Special case : skippable frames == + + Skippable frames allow integration of user-defined data into a flow of concatenated frames. + Skippable frames will be ignored (skipped) by decompressor. + The format of skippable frames is as follows : + a) Skippable frame ID - 4 Bytes, Little endian format, any value from 0x184D2A50 to 0x184D2A5F + b) Frame Size - 4 Bytes, Little endian format, unsigned 32-bits + c) Frame Content - any content (User Data) of length equal to Frame Size + For skippable frames ZSTD_getFrameHeader() returns zfhPtr->frameType==ZSTD_skippableFrame. + For skippable frames ZSTD_decompressContinue() always returns 0 : it only skips the content. +*/ + +/*===== Buffer-less streaming decompression functions =====*/ + +ZSTDLIB_STATIC_API size_t ZSTD_decodingBufferSize_min(unsigned long long windowSize, unsigned long long frameContentSize); /**< when frame content size is not known, pass in frameContentSize == ZSTD_CONTENTSIZE_UNKNOWN */ + +ZSTDLIB_STATIC_API size_t ZSTD_decompressBegin(ZSTD_DCtx* dctx); +ZSTDLIB_STATIC_API size_t ZSTD_decompressBegin_usingDict(ZSTD_DCtx* dctx, const void* dict, size_t dictSize); +ZSTDLIB_STATIC_API size_t ZSTD_decompressBegin_usingDDict(ZSTD_DCtx* dctx, const ZSTD_DDict* ddict); + +ZSTDLIB_STATIC_API size_t ZSTD_nextSrcSizeToDecompress(ZSTD_DCtx* dctx); +ZSTDLIB_STATIC_API size_t ZSTD_decompressContinue(ZSTD_DCtx* dctx, void* dst, size_t dstCapacity, const void* src, size_t srcSize); + +/* misc */ +ZSTD_DEPRECATED("This function will likely be removed in the next minor release. It is misleading and has very limited utility.") +ZSTDLIB_STATIC_API void ZSTD_copyDCtx(ZSTD_DCtx* dctx, const ZSTD_DCtx* preparedDCtx); +typedef enum { ZSTDnit_frameHeader, ZSTDnit_blockHeader, ZSTDnit_block, ZSTDnit_lastBlock, ZSTDnit_checksum, ZSTDnit_skippableFrame } ZSTD_nextInputType_e; +ZSTDLIB_STATIC_API ZSTD_nextInputType_e ZSTD_nextInputType(ZSTD_DCtx* dctx); + + + + +/* ========================================= */ +/** Block level API (DEPRECATED) */ +/* ========================================= */ + +/*! + + This API is deprecated in favor of the regular compression API. + You can get the frame header down to 2 bytes by setting: + - ZSTD_c_format = ZSTD_f_zstd1_magicless + - ZSTD_c_contentSizeFlag = 0 + - ZSTD_c_checksumFlag = 0 + - ZSTD_c_dictIDFlag = 0 + + This API is not as well tested as our normal API, so we recommend not using it. + We will be removing it in a future version. If the normal API doesn't provide + the functionality you need, please open a GitHub issue. + + Block functions produce and decode raw zstd blocks, without frame metadata. + Frame metadata cost is typically ~12 bytes, which can be non-negligible for very small blocks (< 100 bytes). + But users will have to take in charge needed metadata to regenerate data, such as compressed and content sizes. + + A few rules to respect : + - Compressing and decompressing require a context structure + + Use ZSTD_createCCtx() and ZSTD_createDCtx() + - It is necessary to init context before starting + + compression : any ZSTD_compressBegin*() variant, including with dictionary + + decompression : any ZSTD_decompressBegin*() variant, including with dictionary + - Block size is limited, it must be <= ZSTD_getBlockSize() <= ZSTD_BLOCKSIZE_MAX == 128 KB + + If input is larger than a block size, it's necessary to split input data into multiple blocks + + For inputs larger than a single block, consider using regular ZSTD_compress() instead. + Frame metadata is not that costly, and quickly becomes negligible as source size grows larger than a block. + - When a block is considered not compressible enough, ZSTD_compressBlock() result will be 0 (zero) ! + ===> In which case, nothing is produced into `dst` ! + + User __must__ test for such outcome and deal directly with uncompressed data + + A block cannot be declared incompressible if ZSTD_compressBlock() return value was != 0. + Doing so would mess up with statistics history, leading to potential data corruption. + + ZSTD_decompressBlock() _doesn't accept uncompressed data as input_ !! + + In case of multiple successive blocks, should some of them be uncompressed, + decoder must be informed of their existence in order to follow proper history. + Use ZSTD_insertBlock() for such a case. +*/ + +/*===== Raw zstd block functions =====*/ +ZSTD_DEPRECATED("The block API is deprecated in favor of the normal compression API. See docs.") +ZSTDLIB_STATIC_API size_t ZSTD_getBlockSize (const ZSTD_CCtx* cctx); +ZSTD_DEPRECATED("The block API is deprecated in favor of the normal compression API. See docs.") +ZSTDLIB_STATIC_API size_t ZSTD_compressBlock (ZSTD_CCtx* cctx, void* dst, size_t dstCapacity, const void* src, size_t srcSize); +ZSTD_DEPRECATED("The block API is deprecated in favor of the normal compression API. See docs.") +ZSTDLIB_STATIC_API size_t ZSTD_decompressBlock(ZSTD_DCtx* dctx, void* dst, size_t dstCapacity, const void* src, size_t srcSize); +ZSTD_DEPRECATED("The block API is deprecated in favor of the normal compression API. See docs.") +ZSTDLIB_STATIC_API size_t ZSTD_insertBlock (ZSTD_DCtx* dctx, const void* blockStart, size_t blockSize); /**< insert uncompressed block into `dctx` history. Useful for multi-blocks decompression. */ + +#if defined (__cplusplus) +} +#endif + +#endif /* ZSTD_H_ZSTD_STATIC_LINKING_ONLY */ diff --git a/curl/include/zstd_errors.h b/curl/include/zstd_errors.h new file mode 100644 index 0000000..8ebc95c --- /dev/null +++ b/curl/include/zstd_errors.h @@ -0,0 +1,107 @@ +/* + * Copyright (c) Meta Platforms, Inc. and affiliates. + * All rights reserved. + * + * This source code is licensed under both the BSD-style license (found in the + * LICENSE file in the root directory of this source tree) and the GPLv2 (found + * in the COPYING file in the root directory of this source tree). + * You may select, at your option, one of the above-listed licenses. + */ + +#ifndef ZSTD_ERRORS_H_398273423 +#define ZSTD_ERRORS_H_398273423 + +#if defined (__cplusplus) +extern "C" { +#endif + +/* ===== ZSTDERRORLIB_API : control library symbols visibility ===== */ +#ifndef ZSTDERRORLIB_VISIBLE + /* Backwards compatibility with old macro name */ +# ifdef ZSTDERRORLIB_VISIBILITY +# define ZSTDERRORLIB_VISIBLE ZSTDERRORLIB_VISIBILITY +# elif defined(__GNUC__) && (__GNUC__ >= 4) && !defined(__MINGW32__) +# define ZSTDERRORLIB_VISIBLE __attribute__ ((visibility ("default"))) +# else +# define ZSTDERRORLIB_VISIBLE +# endif +#endif + +#ifndef ZSTDERRORLIB_HIDDEN +# if defined(__GNUC__) && (__GNUC__ >= 4) && !defined(__MINGW32__) +# define ZSTDERRORLIB_HIDDEN __attribute__ ((visibility ("hidden"))) +# else +# define ZSTDERRORLIB_HIDDEN +# endif +#endif + +#if defined(ZSTD_DLL_EXPORT) && (ZSTD_DLL_EXPORT==1) +# define ZSTDERRORLIB_API __declspec(dllexport) ZSTDERRORLIB_VISIBLE +#elif defined(ZSTD_DLL_IMPORT) && (ZSTD_DLL_IMPORT==1) +# define ZSTDERRORLIB_API __declspec(dllimport) ZSTDERRORLIB_VISIBLE /* It isn't required but allows to generate better code, saving a function pointer load from the IAT and an indirect jump.*/ +#else +# define ZSTDERRORLIB_API ZSTDERRORLIB_VISIBLE +#endif + +/*-********************************************* + * Error codes list + *-********************************************* + * Error codes _values_ are pinned down since v1.3.1 only. + * Therefore, don't rely on values if you may link to any version < v1.3.1. + * + * Only values < 100 are considered stable. + * + * note 1 : this API shall be used with static linking only. + * dynamic linking is not yet officially supported. + * note 2 : Prefer relying on the enum than on its value whenever possible + * This is the only supported way to use the error list < v1.3.1 + * note 3 : ZSTD_isError() is always correct, whatever the library version. + **********************************************/ +typedef enum { + ZSTD_error_no_error = 0, + ZSTD_error_GENERIC = 1, + ZSTD_error_prefix_unknown = 10, + ZSTD_error_version_unsupported = 12, + ZSTD_error_frameParameter_unsupported = 14, + ZSTD_error_frameParameter_windowTooLarge = 16, + ZSTD_error_corruption_detected = 20, + ZSTD_error_checksum_wrong = 22, + ZSTD_error_literals_headerWrong = 24, + ZSTD_error_dictionary_corrupted = 30, + ZSTD_error_dictionary_wrong = 32, + ZSTD_error_dictionaryCreation_failed = 34, + ZSTD_error_parameter_unsupported = 40, + ZSTD_error_parameter_combination_unsupported = 41, + ZSTD_error_parameter_outOfBound = 42, + ZSTD_error_tableLog_tooLarge = 44, + ZSTD_error_maxSymbolValue_tooLarge = 46, + ZSTD_error_maxSymbolValue_tooSmall = 48, + ZSTD_error_cannotProduce_uncompressedBlock = 49, + ZSTD_error_stabilityCondition_notRespected = 50, + ZSTD_error_stage_wrong = 60, + ZSTD_error_init_missing = 62, + ZSTD_error_memory_allocation = 64, + ZSTD_error_workSpace_tooSmall= 66, + ZSTD_error_dstSize_tooSmall = 70, + ZSTD_error_srcSize_wrong = 72, + ZSTD_error_dstBuffer_null = 74, + ZSTD_error_noForwardProgress_destFull = 80, + ZSTD_error_noForwardProgress_inputEmpty = 82, + /* following error codes are __NOT STABLE__, they can be removed or changed in future versions */ + ZSTD_error_frameIndex_tooLarge = 100, + ZSTD_error_seekableIO = 102, + ZSTD_error_dstBuffer_wrong = 104, + ZSTD_error_srcBuffer_wrong = 105, + ZSTD_error_sequenceProducer_failed = 106, + ZSTD_error_externalSequences_invalid = 107, + ZSTD_error_maxCode = 120 /* never EVER use this value directly, it can change in future versions! Use ZSTD_isError() instead */ +} ZSTD_ErrorCode; + +ZSTDERRORLIB_API const char* ZSTD_getErrorString(ZSTD_ErrorCode code); /**< Same as ZSTD_getErrorName, but using a `ZSTD_ErrorCode` enum argument */ + + +#if defined (__cplusplus) +} +#endif + +#endif /* ZSTD_ERRORS_H_398273423 */ diff --git a/curl/lib/libbrotlicommon.a b/curl/lib/libbrotlicommon.a new file mode 100644 index 0000000000000000000000000000000000000000..1ec09eb1fef66a6803a72e1309a21e2bbe6e7dd7 GIT binary patch literal 134894 zcmd?Sd2k$OdgclCEm*W=k7wMT@pw|z-6GLV93;g<00=ctiLwq_pt{H1)4@(uWgS3O zW_4y2!O{@{9ykadAjMk%Z&D;B0wj2X0FMbX_V1-)y%E%eBUU?$tSUt8KOH*}v$3(> z+28Xe*p_73Gv1!q*o`Tv2%svD?|6^reZKd5^VwG0kEh#e8?7(Cnm+eu^!w-kwXDU@ zKRDEMA!y&Dv4 zH~!@IUp{JOpaZ*Tuo&rj6U{G;b& z$&*?8W$m|^l##F3)V#tk?>|#h^Oyf&PR+mjk8^7N>Tl*~vTDA;e_yZp7VmGG|Gri8 zwVF9!9HRfSk^8DC`Kn(2ebe;YkLj1M@YQqo_l@#DAahT?`a5!3)A;47`JA?V)vwPl zdh+QnYZJc_;D&gE*U?!M7{S@}cRsI;dq(^UL3Ci_liAg^KCg{SXLWJuqNTI9;VymO zWR`1c*37A?`Cao{O-+N8YWDZP?}t^>^vi~XwCEpx{kW#--!^mv!9RRdO-&ESH9r5v zqtg8O*I)do=Eu)$_;KUnrC<8=EB^e>Gsx-JklC-*JjHu1@83s?|Csl)yz6)`M7CG* z{&U_o?_Y8Be%|A}KjHmrA#+t9|pWnQqKR!QJU*o$k9-~hf_s@+JD*2^j^hxyk#^-*1eU3&+ zuhwgGy1zl6qnC77FC80Q{rl$c8v6C+D@PLW<0N*dp{YrS{ipxLF*Oaz3>Gzd{a<{N zn)5kHoBezdKO1}r!uS7PHE76YH|I9liG&|yQZ-yd@--`~Pb4%F$gh&tMN5{=YQ^75 z>tBE8{{zyxaQW;Q%>JNFUn#9$lIky>^yFMj@0_oF{Ttu>*0;a&RPFCPJ@pQ%j;#JG*cX&O`Yc8+f<@I~K zp5gWTy#9dKKjHOy#58RKjHN+dHpG`f5l50_$;p&ukZ2t zKCd6}dXCpTUh{d?@%kaJAMskitDaW_uSQ-?ycY6W#A`9H=XovRwUpN~UdwsCz^j>8 z3$IpQD|of>dXd+ETQmI+^!6Lr>?bDvbBBHB>1UpP`VXIe=DUCL^wZYU-+x-;AH6K= zyYu<5i2;A|j(&Uc?{}Z(>!+79;7{JsZ%_W!_t>A`?!T{n{kQw?b6x%FU!@$Mdr42C z*X)N+{`|W?qXVQ=U;WbeUwzO2il6@7W_|IK8Y%eaUef1(%uD+H+q@zV{Qvx4*@u73 zOZMV(ujMtf)A;1a7f0tm|JPSf?SJ{FvbVp@OSbwS^O9Zv-0Rz)N8OUfFCxVM`Y7@b zW@THZhI@ft^m?xT|2+P;DDsb^4?l+@pBSd!5=BM`aQ5moHG)WAM2TO*lwT3)e<934 zZ2xmn4{&Mu3kxOR!jVyT|HuD%PR$?9w&L^S|C@$=>6iaEqMqO9o*S8NXVxU?hxN>c zUp6j%;R~%1o#M?N^W+P2++qXapL|qvmETGnR~Ll=CPMh}Ge7=u;|pKB-l_j-PR-)k zW1gIBqOB!Mp8RQk>X83|ar?rHXzPFby+8dw-gah3g|?UvzS|-z7$@nD^XtCY7e0PS$o4uG1Yjn;qAs zJ#jm5I=n(U?*)Zo;3RT(!bx*X+Tp%wyWrY6=hckc)sgj5LFR3zgX3u*$8~Z2jLSLx zygKVgX)l{_+(giwDWqTL`ZOca%{2)3+ycj@?afY#YXy$u#_eo2Zx_=v$_6wa}#x0~XK{gWaN$$$fLSTk^elSB7}igWAh7Pif{Pk#Q0)Ge3SY>!cYsyVKs1ag$y=TkOc%-9gp~ zAZoJ7Ky%2o-u7H)VN=r&_z}dJppD3pZ^xaEY?1jd`rVGxmE`Xgm_+8Awx=DJ zG3n}Z@`bz|aM4WO_q^Q88((`Bd2u(E^2j3><(w|Z$tSaR3i;_`bP`GWQ=q**b6!AZ zJBzt|fze8EJ=(zcNHDTU>q}jX72{AyGB0+q;2|4+LmU~hvt7t_eluf|;QBdaof$0@ zioV<7@kUP2gskrcPSMZK4;Xmg%Q~EjC>8>So4IwE$84gZGoL~=a+_geIj4Xuy8!}| z@V)#`km7`v{q$}_F^ergNduwHV0=aB$>}bn-p5LKB?Xe3PAzE z@iTNk)tE&GyB)i$z+9}u=AieCi5oD7T}*e$FSBxh&@c>x$#y-fIace;pDnI<9ZZUoq z^6&djw$yeE_ryJQw6|>2WixxMhku~JLkiw>5{PBH7AA40=NdM=} zt81xiiM8bdj8+Ey$@qx?`_kc{IoR=y3zs)D^(+ZF>VI}AgP24f{(aA}pu;N#*pLP; z5!>)a`^FC1)5YA?wY>Kp&a1?@CFZ~NXLY|S+6m^ST#v&Qy@JutbIx3FM`7c_7n(O` z;#j{#DdBV!+UOXzEbBUIr`Nr4;nL;=w$0gWXE!cf)|_Shkz2&k&gRh{*V}BP4?)Ut z9qZrs91Of9wkhWn&^X4TgLZXa84qDZgn$HftShVi-n-EGiU@Glr}C})V#iZ)$1DpI`bjWWdR|@$_GSxezb4d3s)59dhk6Cn*P?ifFmu9yigv zc-hZ3dC5)leo@zgY%So}3hQ`XCE*6IJKKRSG%s2DvsdiR_G0c=`|f+SKUlr^2hEG0 z|5>M#Os@Uc8`fh>)0;E6J48DGUvQ0?Ulrv;(Ff!QUsYi28aj}}1oD~&i(oInNN%Bd z@zS5Yym8}(`bA9(lOCR$Ypi{JjkN`X)4b&QpRIah&0nzG)74V@Uahkw!|_XghJOo? zox;5L>RP}e1ysGo2F<kdruaUz@<^#@lI3bgF z-mR~Fwy9}RoeR+a`NChc{QMU!wXb?93%^pBOSpo+OyN^=9oVP3cjneMNhX+wF0c82 z#jY{dZF7TW7X3I8t0;V%nqT)$Er(k8&3SY$pD5b+KUP{^+3->w6Z@;8SKwzYI*x^W zZ!V(nJntpEm-1f5dpYkH7B!jw7V_^R-ivv2+#-%!#Bqx_ZV|^V;<&{extQY?bKGK% zTg-8bIc_n>E!Oq;43-wMmN&;XaZVHGHt}5($24(l6X$RN27@=p@ehK=dpYlAyqEG` z!uxsNi+L~Ny^uG@5oN!yoa2^r+;Wav&T-2*ZaK#-=eXq@x18gaaojSFTgGwAIBpro zE#tUl9Jh?)mT}xNj$6ucOF3>S$1UZ!r5v}E6#y=LKf;ppZ}0>1(J!FpnsJVhk@ZpWG1M5fatcJsigF1}b11=bXe&8ECx6(3&W z`eY>#jRB_f9-4y>>aaU?KZ&zvr;2vI2*h+fR1)ls4a*h*DZulbUGj)0Y>cCy&v5?^ z?wQpASuc_C&L)#)Z2x4N`RwMS2Yh;;za}{99>3o( zf8Bp{>(NdAy7y?}lio+iIrb+1jeoL>E9`po{wKRW*~+)q`289`kMq9&X#CMh{+;4V zob~9`qjP+I^U(;$ZsWKU=F_`e|LUV7ybtm|{>gSeALs5jA06fXHy_=3bdS&O^4}TG z+y3a*r&~WAe0=uPzE67}U*LV`)9s(`;O~LQ};S`Dy>B1E22rw3qjGKGE;} zk1syH&hI-OpXc0ubB)1Iw{cECpMA`gF6uXP>>$7I;8^|K{`iKuYA^Tb{j~4#M|?KO zaea?R`K_PNdO2d?@eQzhP+;O6FH1CCAS@>iW_CbziuwgPi2vgF9KH?Y{T0~*e~=+! zi%dM3A#xU|^z#aHanYbWqAd^^VLB$kPk{dd2T)tgi!lg97X*l-f;htcZhle72H2MY z1{f-GC(ed1aKS#@*YSM=5Wq_9! zbwM1#Me)vf`vj~>CQfJ*muX?d!RToi3~&`w7<6N503`$lVpD>IE{%!soesKBG+!*F z36nUN+XW0Z%!%k3bvl9Q(Ix~!!&%G~h$m!Jd8De-c_SJ zL=(h4@d?bfuMU!5h7iU}2z@}H;fP>iz!<-7O*427GA8511?w}}Bpt;JNRuHSum?Fp zR_HglKY~EP9u7y8McHw4nhlW=Pot3v^Gl$jpbKJ4D2Dz?EKo2@BLP@1q|J;9U6s6K z5|Mx%aWt5OSg1JYK{Fk(a+n2Qd&5L zUOY~y360qdZV%E(aY181NGZh;?*_*K+)3(|5@04;V+BFf!t4~B2E|`FDG9-zo&5_* z4!m80u7YkE;%+|Wz6yI?tRN(a7|J(wJyDTZNb(5nog{);NE5vf76Z9jkc7=lD7q`QGFUCWY?tK{@Gf=A4)H5yt{cT^QUu;Evk7Yg zvjpz~$dyGV*k@`bf%RYB2e%UTJmxZqe^(H+*& zEf^}7@FLbGB?j?BXEDS?!tlF63gA(oxzD%xo`_+-#grDE1;%#>(j?;GUqkE$Fsa0R zN_%8L0;f%kjN@*4tNpp}Eqp1@Xi|r_H>Iy(H|;AaiJnZ_DM-k40@Z zF&x+nWkid7J67M=_)}4!46e?AI1V;QiRon_EuZI#oOls7k@+R8M+5<1vT!&XLL+7d zO5f{_wK4uEwom9FYB>0b{P{Xrh6acsO-U``bIE$AR*a+=b2>zG5fw%|feaw5(5d3} zaA=+{;vd^Vb1}B!MKI9JK*nFRgps6WoQ$UkR!gzbZY-QEy4DF03)FyaFxKL{b5a+1 zHQCb)G!ehSkztyhEq0Lf(RR@z3*LR#1SP;b+eeTEocdDky!=A!00fh;+ieUhg<+ua}6~dSo4uok?4s{!Vsc9Wdz-VL z`7_EWJx?rF-!R;PXoSF-50_)D5L< zR`g!$E?b;nqg*9U!bRzvTpQdCUfk7!IlN}i@DrP?r{nylmrrE@? zb8E%wgK3IQL+SH^~gBTKw zsK|8`Yz8cs!ITNTWl^x!Mv=?(2(MnR$&*Mm(2v@ukUFvH0GpN;^?Dv{5X%^xHw~VNCYs6*X zps1Vwmu*1?scsc>54V$Lc>*qi`vZR&Fjx}&%qrQ=I_udL7E&AtTjWKxWqFkq-u?2C(D;$^e|CTQ)ktc3nbXKKBAaEn$Yzz6_qc}fdUV7p>n-mw#2hci!; z38%WSNe-b!%XL=6qJ~^Xi)b;?-arkeXSFa_2jZnZtMLbil&t(OAZpW z-ep3Ce6Yfb#aeI%_#=(lLaj(({%uz@Ix+s+&I)hE4;HPnWQ_>TJDgVdYKwQQZGn~S zL@H7-E2i;#ZKIc8r4_pvs~6eQ8s?-c{x*(R=07W}EG1demb8BrYkNCgA9oi*uh!Nt zjMcRWg|E%kErL>Uh(2OOgaD8W*2MUXFKin0 za5PX`U|X`q1a0wf>I4!XU&j?*ByIxGD{|lu|KVw1k$N0wrN;{lZDRvES%mL*X>XcM@J9?ZuIba&QmA7PW=h4c{rKYAsT}c@Sk;=Vka0G zG~~0E#4vFqFGYM{XP}p|Sbh&L9(Vvg248c@@Ujvk*}`Ar=|ow%u7?2wK*eb@+9L`U zE?HodxD!w22P}IFKr*U8=ZDu_EZ5sC2l-%noP5CL3bvj1O0<+-GJyr%f_MjY_RaDU zF%oT&5di_v85+Qn3W6h{aUY)MK+(nYlGq6`V!ejug85h_mTb^>;sBb#Xn?M13*Mhq zDG(n>h+)LIDAvHNfo_>H$xsR(roIVeF-w?aE};05rnwoU8W*U0u(FFsjC*O3dYdzL zC&m{9{qPb)M0n3lh>4M#P8;z?o(aEfR#|*J8PE_ejsV-tAz;-DvMd<}nq)3TJCLRX z-QphN2_?4hFtk()otwEitwKl=tl2O^qWxI5>hQE^%MuE>&K9;cx?l%IqILjsC!>q) zR}e?{GI5*1csSaL%K}@YR?-DT7!gMeAhckh)B=yyQ86}R7&YCdgBnL7ckxl0Rhx(m z))CG}vRjaE$U3BIK+!-gL18j#2qEAL<+LAeHS@*{c1lBuH4p|}Q4Kn+ndSmomlE|! zs~%pGbV}K!C-g*4iM1*|ORC}Wh$uXlVzg+fR&+5Qhydu)6M!^is=^8o3QU{nKDGiD zM<0d_*)Ay01+^toQajOIFI&tJ$Pg!$KZwh*2rSbfaI$_pNrF282BU^F zPy`|_w%CDqz!*>_ZiI%OBEgLO8y%fa z9An1t;8DdPAlBHHcv@?zczs%kz>Bj3@fdcCR?$xSh`C49)K~Nkib6zQK{iJO8`CVX zFXj*qmHV01YuZm(sVE!E3sZuBb%{-g%h>oxzvvETUHJ+K6)R>!@D8>aQ^oMYETmG5 zwrFVNTC2yB+f1B1H8O0t8ZlK#o(x)+U5Z`$#3>{V$xXf!7F5|yu{P`kY!32H(wWg@ zG7I?2FeaLJWC7V?B{w1KWbz!K@|-QSTV`J)z`W8P@gQ6UHxF!s5*NimSD7!`hI7C_ zp&WR^&5}&#O*3Lra|BFEDR3b_9H%FM39{^f&zg)FP(NElkzshGQyf*qaf8kn zA^2%bD1@&J4PwWfajx{jHTiZ7f#a{15rY5FEE_%-tCD~zS*sODnZs@om?=9B?*=NK4+QrR3kqn6C$Dt z%1%HSkqolkkaI|FB!@Xeme5#!MH!*{b4ZO}${1$S=o){6c!SrCZAlbmA0jr=> zFnhRDxG;=|fRi;WcAm(wP#-k{_8!_wDL)7XdO|FZImXu0JqPf^wcDYa@&(!; za$Z8Js0Ndlz*aC8m@tXG>}S1U5g13t0V%{FfC#{tT1j!xagvJ?tIZgqpqvL*gsdQ6 z3g!-Sz>8VLH`oo039i~EuEc45>l~sME$IOR)p^@AG?EtPZ5TwpALvI>O z2scfSkYwZv-V+;y-RF~4M$?Ht$X24Am=U?tfHt&Q7l&DO@WW5LKVIA&ccShe=0^{-p6p%U`T_+e4ySPM8Rj3CP?v~az- ziwsX8Ses+AopxhO(RZ{V!Qb&hv@C$`py};KFIfJ6!!@K1BsU>LtZf50Jd-zM7DiN= z3CtQ-c*9r;e3>Xb32}fIV4U0aCH76Ejp*BK$(rvpq#8QNH^U-%k`p?D;NVS=d1V3e z)~b`CcHvVIJ<}`xH69kShXDUwK{{4|f%I`GUQL_wNHQ(~{oBgYleIVU)7C-mnVYCb zXAxkm6Nw7qsgZEz4(5jtK#&(BVF;1hO)}Xrjs+md>IOl~Y9xkJwqwjfc9?6u9si9j z9Eye-jDa=FY&M$fCTU65SrgH*ibrE``|@TePpr)>Exdcbz3urORDF2)vbgD}uq zXC+P@l&E172xdMv7!L~pNLxs1=I(GaavJb5P6AQ{T1fqmwZU6TyU{V$Cei#D;j7|s zu0s5YU1OO*%#G(7nm<@5X7F9(el&&*hXyhm6LZ7eB}6Uq5hTwFCuA3zH3ofxkTZlV zOfnpWWKF zUjZXI)M#d`O=Ow8gR(^lhR|=bgar2pf!1QYp1eS;t(8c@Xty|p`g&!yVxh<*r!%yH zOhIghVZ&hS#L;-Hl7ODHu!{hS>RMo}cjFDR2npyXG|0-5RT&2eF*yyg=*)`_ENzmo zHmoyAr*da5xkw ziyX>81u<%kiEK&9sK*Y3pZ9%p3idRsFOfZG9fUzMT8wfj7X+gk3%1eTw;kK zqeKeD+K76Y3BqhfFIg#G0Io(34f-;<=!$@8=6s_ae!Ibe zl3iUnQG)&cp^V)|%v>ss=b@)W&w*1?E_-VuZZVTAfn&J@Ii*FvWR`GOtTtBE5OJ1m zR#-L}7^h`eJ0ZKY8SDbTTQKV_we2Q4u+{)lVY?A$-~n)tOjJ>dD@9*hoSB8=`OW$= zxrU6t+9`u)R@1RBIlPd`M-WK~g|BGBZeWR?kpUk--Ix|O3+7VtVi_tZRT>@Mx=}NQ{6PD+<{6t#;#mYHNRrRVHPexXok-G;<K5WtlXI4aBKk znR+vb+ygtf%6R;C$&b0F!0SX+~!T;DKOuHKj@q9Ei5Si@43@)<3121S{g zE#;g5vAGrn@;VwM#J3FgZ6M)~nyYq#W^&62A2Ok`XI?I1=aav*VHM$OW< zRr{25uuaKfPw{zzg&KVePY>A!RisHG9|0B!%uU)N*pEI2ex83##>~L<#Ax|&e`Ty^ z`rd)covkw;ADn)0y1exYpNGTu$^-kSr!G%V^h{5D6!u;YhbAgxrz`vVs$-Mk@!@dj z%JkIv^2nZW@O1get(hY?IBa@ya(ePYcwlR_|D*8s`1IYa(-R+*PoA%g>cpPj z@*qcEnK?2xbLMDecp~h*K0UFkdhcF&-$>=gndy5EIHh`zR^19mE>ByLI=ek@CS?)gwb;UvD^er@Z%Kbkyyda7so&OmtnUO2R?a`0sN##A_bzp}Gm-;N&&KipP6F;d>StIWBF zug)BqDv$K=OZo7f@a|B!`^fa<HEWK_T=93@Qv`?2h|717&Hc?GIg?Y^8C!! z1LcW{^1x7d=RvrCFzmfGJ$0DtS5IFI$99Ij7b};|blm+Q+<&zCV7PjEcV*k1uz#wu zbD(^Dd*$HGaCG1F#No=J-PN)C)v?oI@1E+7JLN;is@txGgQvpY^J@0sMJ~(ChKKr? zsc_E+;nVO)a~%zfpF)ZaGCEb1EFU8XoT{-yEu57$^@O;s7MS za&Z>}RUY3~?%9hJp)X<2v2gGt?L{I)P@0XACB8s#;?7dCDxCl}j4je&i zn8$G9Fp?Ht>8qUDidso-_g)AG(7UThNO*D*@nCFe6~`k~GyQwiN2GUhcX)WDeEAI0 zi!^d623cA#Ib7}8UcGV%X_qLTyi*+;rNI)&gAc;Vk@5i3Jz3d%B|Niz=EGyh{+Agji4h>ds zoMlMM1BbCNC;~QTdg?41SGjP70SV8et&@zidU~)YJUABi(~PT?52vs&;p9PV4#UFn zNFzMmF=T5M=o-anS*0UFXKFO{6si0QQb9Oy)s%k zc0Zi_Fr3(39vPNAoWEYaa6Dai5W934`&J#hiY1Zvnc7voadD=9sB-YO zMDgBucwkR>7vaBH9z4&Hv{`fU;NzK|li~Xp8C6aF)eo@bbfj|ddi9E=w0!C`Gg7^B zKHS?E4qXd}K0*ts4-R7Xt2aic?_3S{?WtV2YK%!A5+wz^azi?WS)M!?j$ShM^ML%z z#a-d#5OPu-xLh9D9v(QYt7#H%g=5>N9~>_ao~!m?a}G{V4Tk3~RX#cr4xPocmV35V z25;%#op-{4kE>(nxLx?5cjojIHXn}=ULDd+2lj_Ol2U#9(fjz{aCdKc*X5aQXR#05 zSC$a_+1D#`w2!Xck*1@+7y9Vw%&{{lru^oEewtc2IF3(|pkg`uC(StT;j8lKS*$u8 zEFV2tKGZusxeNJ`|2@@DA7%dsPgn0BKohwm;>V0vPWRw1WXdKHo3qGFWfXZnfOnGv z+P58hE1|-<47?v+xx;;{JJI(m^2mL=rN7vUk&~4VcIe!XcU4ArRwgfC%)=9yrlFaS zc86mpq~im(=sryaD$t(F=zXK_yTZLE!-3)QkyCOLct9XQ&n~(~3&Vl_^6vg{&kt-Z`gIov zA!V06Jb>mJKO$cvw{m3%uC01uXL$dJG-c0TxwFa9aBMfiQ{Hh>Uybdop6%rTG<0U$ zn0y3gaPq^MvnSDr>aly39k;6YE(@g$p4ZjJt_sOu+fQ@f-6+0h?J9$Ik>jT)Mylr@ zpovW4Oz->Q)EnmKm1;E|QYB9@WyJcX7Ob+Ae@T4mUkWq_gqCovBt7;XRcN+Y!f&cJt{DE z?SAF_iR#|lW}q(7*~-*~%GBuey;I;2*?)ZE#nT`qOquWoHt^iZnc?2*vAyL3xU-R& zvwOi9(#M;(@$!<-dj~)@m6M}_tjA9?^5tt&mBUA>576t2xIB7+yT{@&EY$%J>;RG} z{5gCQgdnv#G&BQ(l5Fqb7PP8*b-RrA^?o5n5bWT^>Wz~)h_DYm}T;d6|(t)eAi` z>_gi)1!ciVN(Y(W2gj>dz)|<7?|g`YYa(v$!ZTJb2)Uu)8XO$i*ay{Zrz_{>cglxH zL1Lf_`5;7b@C3TUY=T{9`uo+dedlprLLwg|-oHcWVq~ZM@45c!*?U4Y z7}AkRh7PY6jvhh0nP}{%jC>yoyI-j3_!(&g=u!6Y1cpUdyLtlwLwb!i4T52+SI_W& z`PdlRB&#xk*bGkJJtb=}@Ns!`cX{|)c^BRXKQb)X+`C5_H1v@?<`K~ES>~d8aj<&- zKKg~GXa>j52uAj7Iob{M(6ivv1~e-8&v%^W+Y!5^5Y4sK(hz%9&3`SR)Vp$S}ecy+%#>A?HoG(2N@ zr)d@XxNolzU@vpQeQ#o0rte+H=~PA!;u;82nA4dLMlgEZsC>2u8DlP(JA47%EMI$H z6OFB&n5Z25pxS?3?b+8SObF7$R|09y0f}#M)9Q&m;hl-fheN{rpsaf!7R*H-SXcH0 z$V!YeaJAfXyu2MDL~Cw`dxp>gJP}?O-I!yLVzLC5l+EJA_Lk60o};BQs35 zf|s3Gj~$32(_KFP09gg3VX{y(g-b^d&^tlCK{RDpCYqRHPd@`LH$905nM7u!Q-^K< zL}}hk&na0>$=H#Zlb5h3)f*GK4jp7FhbLx^jK~_}9qx_G(-Bo+&%rZecQnEb*Pw}# zj-SRJDpUkLj%jKTcmr~7h2y;_4wkd}-~>vF0}A&LC*J2og$B1Tgy+v=A{52o^$1{( zpN~RXWEk0#%-~FMI#~O`6B>M!`ojS{8WV(m%^W<&M5_z?2Ecom^swhH0;bLm@2?y` zi(kexDGHnX2=_E|RPIa`b?1Zfu3pUS%%KNH<0ge7h?wxg#3oZW&@zm3`Of|D_J`rn zb+mhW>K-D5r$EJss__2UI_$Y*eYF4C8}+5*v)tgCo`JXNB2r0m%Eqk&}YTH;j2j@NRwOk&o0z?5%U1^OFK_R(x`y9CeZi{kN-lhtwa`F3J~5y9PUW0kRSpoQY} z@ohN4aOg0$RNjz4b$Ei2N415D2l{5-KS^A}pOw?NgAZh@@9$D%bi9YCp?rc!;aK$w zh-geGXzY0P#&ImFK+D;^^u4^-MC(LYSKbfDPN5^19l@s~{DIkI4CvjEGHCiA$ z)+>&J!I3k%d$e+)hhYTxF(#PMnXQB6foqbkp|j$4CeMXeF&&(KobcR45Ge9CZY|p) zOeKme9Osx3xyv0V(bn?Vpd{+_30SP~>aK7cXS!Db+Q9AVjWdds&R&J?Kpt?ld?Gk^ z`~%sIJJ$${=$%a5z@^IYpd#pF`}t%Bec#=SRmb(02W}}6yor15S0J!!*chDMG)6Y< z=#|RI-O6$10*G=WyoiGs7Lq)9GTieqMuuLOx1T~R!?XP|hP~s}omWJH_4d;2%HH$`+a#1L#GBv=6(Ny$^I8Gc3eBdrX z;4m{jJ#k(}@9ISL!ARJ5OkEz?NhDkOm~q}o{8Al1jhHb|YWewlm8s)=814ZB^i4n5 z4oyL)2n6s)BAxCY4F_?Qdq4u^%V(=MVd{ubXxmQV1e9x^&=EFPh8o-j@pTy6dq#JG zDLQpmT65~g%m+i2<2|xY=PuBAW}$rLkR;^Tq-^!>!_u;`-BKL9!^yoEPlZ32U!4BV z1K8Wj!84$*@`u|DLj~O3i_}5Z0rD$1h`vWduqD`g8wmD>_#E)zj$z|^&=DAq+XgZz z#+L^l+X>ZH2KbHdgak8IZkX^5t0D^Y!^41QMI48B%v>60cJMD8qjBgXx|hBXhELzw zIdk-S*t?V2$FrC3ZkwJQ3;O^DyDEDx$;aJ4$Gi(eUfqvVMotuuUmRCd1vt7j9>C5ubL>42v$`ifi^BqA7#2 z+tpL<-8Fp&z&Qc$B&9xyIhxX#Ke#D0azbP;C{80uq`dn9-C>t6X&ermy;4tEtD%+$ zi!!WGX5!>|l5WWEInO6&DNY(EX_GAVk?5y{Syqpr>RHEO-CUnPJWY;ejwDc%KkKr> zq)k{P-TCbCC8d? zLWb-+Khr_VfX~%f<)r2GHcPS`TQq1V35rp6F1t)vL{+Leo8mok5LxtB-VQx6Nw_9= z)THKikj9tcP?Mq>Xlx6f$?YLChNLQTjmUb^=k(W%61y`AI#W0IN#cm#TFr zWixA)ojj2*0pGybWNt7=q^z1WYSyjaCTEx2Hbf!MHZOAA*prxG z8P{cgNh5zasl-b9%X#ctQeG47)yS|u&2OY4pH5`nHhG_{i%BZXZZBK2|F$HYf(^`~ z+ANXxA6}x21@dq`@4U^@F4x&i0=PrfDXm?y+RI(Y#3RpGsjS)tL|Q_SBxRHwUs9ak zwoOK`NncHHP0l9iHBT>0GAtEY$Wmht$($ygm4rRCKp78ek1{-SnsKH224=gidP?8P zr|Ga+{$sGoxk4++n^SwpWkPz{!9MlL&?o)uTEG8jl3nbR>~?3@`zL$MC)d~+uf6iu z`St<3?I-wD$K3p6CvSGN^W6vLlW~5#ZT8epajf>tzi-afj{F;sMs+oF#k-&MbL3r) zxXIsB`d7R7Iag<0~fL;Lo*j@owj(dkDQ zAMNAkRnEO&j=5&e)cP3D*C84v4g%`H}@K+ zcNzgzmAFcqbfoH9P*Z{{MlJq`d#b;qoTVBSH|g;W-lKe?sulyL8pZ|FTAiW$jH_Q< z)0|5S&vNYn`gwt~)i!<3U36uxs-6t+AC)jT;v(OV@#(nv?IY6)>Ra&5X^!dV8y%yg zZ)$G1+XY5!8$Zu#lsJ2oH}h!Pan>BqI5T(D&EV4k?mWoYTr}g=&!^1EuShFDgxXNNbd1 zZ&FT3HH({H|A@)Bko74F)5m6Z-lR{^d>1$ zDU97thssZ|xsngjq;zN<21_@TsW_S#2z_YHdT1C3X6=^usIl#pbw zWn7!86Gif@qtsBqjP@^UI~y5N(dG#%5t!~8(5$^hY;0lMLJ?>Rq`*OQcY#OSr-mw7 z%1XFYG9Npiw11jSE;;Zjx!RmZSvr%JNX`{QAV2{6+M-5asM(7Ns41|4Dn~xC8EfD{ zl#`zz1B&cXwkc@W1qs9Ewj{4Akz8O6P)O#LlD7on8Axpzr)ANW5N)Yb(o>u%C6_7M zOR}Joi*X8fSE@N_f~o^LyU~PnGi@E4-CMzq5haYRRZoNTYPH&>iY5upsq_YuE^UDk zqp}Z5jW3W>s_Z)j2=v`-H%d9}hytgRFQigjq$(;0PMcL}84ywPr@9{uv5F^!6jS7;d$det8kqOOu&nQiq~g%%ZSPy>|=KBaEbE+)W^x&o@C_-5W@;IlEtY%^e= zp1J>;sPAO@YY2WCshTorX*}{tZ9k+O9U({fq4y-W3bY zonDTNfVILROU_y?9VG9~Y;8)kOG51I>yhn|4N<~3o257ky_P<#*6udi#r_(0yGNC)){61S>FO?z26!b@aO`a)nPElop5EJH=;v>=KnE8>>qFf*`AgV!*?TT2Ga&IZ& zoIWV6k{|0$EU7s`3bcy|H7i9MTY~z9swt=^Gif8+>d08BI4wO=UaAC)bVh!tKng!p zj+W^#Is8uIB}qT^hso5$o+-7~&yjD<27ZdtrcF(mXeUUbJ(@8}GAL1hW#j{*Jw>GA zvr__Xa5FmJSQ`qBlAp}Tuh#Csl!sC(75Ak`!?j}wpI%A8~O9XY36^mZi~`CMi#5g!xqi>U9fVU+kz+fu9o zJ21)YWM4VXlq!nKn&u8l;N}EMQDxWzNCvsAYJIf*PEt?4uIdMKI!7ny`#O{%>1~m7 zg9%}uPlgGKj1?|xOD0#$DP^2XV^=Z>${69#n19`jZA035faQzwy$SnCcBd<}fNe*b zUyOm=JX>oJPwr~9M>qr*BGN^+#LJc5j9>+0W_+V;vJ4zo=6-a6do@HuKx(~=`dW$| z_z9|Jq@=}fdbq}d6>aATHoyWzrdfLfig`=PtkHIm=5EJQ+3%HD5T+{Hr4ek3cI#m_ z88kQqV;~?X0_I(z62jihM3Y%A&(2>R^11;9R$X@D6qFZD1KX9juUZgnWMCQ{pZ%fm zJI1~sY3c)Iao8~i><}&y4Zybjf`tWO8jY(%puq!tjrY}71kD5eQ`K&bD8;PIP7j%J zN_A*sP&2FIE6vKC_}EJJN(wm8Wpvx`VWZmle8A8WMBj7lvAd@+Z(Mu;`afZ@kg zG>t=qy4;khfHAi=ubS3)bR-!_#!PAVh{O#+(VK?JJ8>1PK2uI_@wDVg&zmR3!+^+? z;7m!)Muaft*bpO-LV0o?HUKe=@A2On~J1yFWWbwVIornu#ODKcm zGnLwdBjl(#qJh*Za@Hbj>>A>>^7fJ4lx_<8DN`Dt0YNAK5ERWcZi==xRHCWJ7 zhQ48#Fz_;W%|@aYq|q2W=^N}91ZZrEjAXQtm0?93=opX+l5BPtWwf19`S~D4!{O3* zjE9+#Xn!mlXKXegnjg?)LS4vTRHTOa!-%W6k(^>A`IH)`4qYa%f<1IIN}9(lvpYvH zg&|-EGNc((rQM9Yddn8hT2bvMjNK|0@QXh@dx(G@$p4c%JF;V#- zCKl63IIcw@e+3n$Jk#9T*UZi{ zw%W0`GvTm9K}Bz(Ez1FZWgS9ZTl*T$5TnV)EEGYdahQk5>S2Clg;gYjrim~`#}F2F zT@ay|QCf`|gFeJI;fN^4U}Whf_6bsNWR;5Ku#d=;CTgQzm{b)X#>NclEt+5p^G6M5 z$BMR5V5DS^^JxfV5wx(OD1+IP1+KuIQkk5p#T0ziZ7BeStfP}E=^xNQ-JMMs=I)TU z3?XXUDz%^t4G0k+VUWYz+GxL?K$|v+L<7<+Fw0d?Um;^kd}#Xt1G%`Z77J}=3@n8W z1La7isd{a;)N7-N0O1obR2Ixs{=j%5d~Ec9xCcNGLM1hjjJhTe)>?l(=R?wa zEqYu7#t}V|C{n0Q-hU1MfT~mjMe>=^){sE6#vN8hrsO9?Rm7h>+dwd04@F=I;wnK1 zf|qNxR{RtfsePuZ5{8Mjj620IuvsP1YMYI{w24h!uC)^T>t~FQOFL_xgsZGgfWZ(A z1|izEOj#)z7DmE&P}pOn6&M-_qsWI_XbT(Mh(5uiYVIrAlIWMPGMIH7f^jHzv`r)0 z24bzl7Snv88G4JJ6BJ0PLiSf+oO_HiS{8&(UogBP(DqLo%p0aZ5AX z!Q|=;o`^Rv3EEso%jgLON3pY*T>htjX3r1bG05!oS!W(LfXz~=5!J@A=$xsK7i*)J z8s})6EC7-%F>ae4i$M&8f7GPfma$qn?Mm`XjoKroD)+{HCYTf4nTpfk*^GZkv13p6 z33FlgeP$3YyuDjACg~MbN=i$MWvB%G_*0K75bC1kXsN&tg@z)7Vo^j(&6SW6cgXVL zpeYrk(K17)l9^_|yNnCUEOc*YEtTZL;H#O4eERT8vkSl$WY zWmhuQB)16Osh$uY0tOV~D`LkqN1F)e*GC(%Oc)VsQ`AGPk9InZ)nFiz=U^k7?PvtB z5L4hcfEMEE`34u%*6JYvT$512lpizOTW2djtawv(F?^NdLf1>c17p`PImlqNg^2J2 zv)}x^V%8`S#!#`lN>Omle40=oZpy>+m$L;%WtI=ob8Fl#I<_VvxuRjMZMIA$K;0B6 zP`xM$+?arhsS-T}DFy(+Cz$Q6b887MnWBal*#t#xA??8CMl6#dN2(*BNdnC47}kMQ zM!v2AjrHdX!7vqixC$qz4iqmw%(6T3C)x&zpfGT_R7<7OVvTq_X))tT2+fS5IDm=> z2yQT?G%W6(urlr|j8#5u?ks?5iVy@CUTR~u*=V%@Hswg%dFGKK{sL=l#PCqEN6&#V z44vn{%uHb?R%Qqh0X~lD3Sy&&7QAN4tYo9TegQ2r#L@y#Rl-7HD1WeGmj1zJ2m+{v z7dsG{VR08PsjMhAE{bz>F5)k}(a@n;ln+HgY~urrY1Z-h1Rz8}(4^XNMCSMhL=7qe z99-~MN7YJRE3#uQ7yOh)awGwjB1|b4mzK9?Jl7+WPGSL08#7R9RGhnsbulV-V0*<8 zIP+KHzyQ-yQM_!#ZY^Mooiq+etQmXR!HEZ6v=uy9X%=HkRF6}|u{8vh)T>f4e2z4m z;n+ybf;lQ?V6PvSN`1kp>QI&!t8@p zP*I@uX5%_)rk%<-w@n>HeqHm7nE{xZt(*bX`2-u*f^vBnbQ^98Yw}MqpfD%D{?b3B#aai6Yt(B@-+aLM4_2#c7ux;%OAs zO=-gTE{$14gk$Xdq+%i*1dG)9=ninPT0hD~J7g&t$It`8sZL3q3kpjpc&CcKYUo9q z1#K{d?7a4qvpZLo2=}@&VqaObFR)sU9Ew9?elfEN9D*>Bo=u~U88@S{B%lC9L&K^( z0m^i!{xYgpz$6GO5`IaY*ptYdT2a9jvmcYIylP4wSgYh=S%3#c@FDW62gk?_A}L(} zHl9XfHYd*uqBy{UF2@hAfWDD6m6v}rlcJ)X`loUje2DK4yaiUADs%V(TLlJV6c)q? z`Rto!Z)Biib_%i;7^n`B2{buXyMnD?fuSf2R$O6GZC|aY(xSH3z8OXA##w-iG$A8sCt5#IUBv?u5W}Y_? z`FHEhh}v1pR1=kBi!|1lU`aWXj-*6TOazLFdg`H#fJm=Lc+l(x1!T@PhTsGgi>fe! z>_Y{0>Olo676dH7@^zHtZy6=AX-pjQi9oW)-B5`7j*DZAWzY1$C?>A9wjD>wvpFCG zyXML26Ns}boGZYTV9I#>3ytJRQ?a(LWu>C4ZVP!~>A<2pU~uZ46QKEyDW%Xd+u9bh zQb2i7v(HyS8{w_*t3fvJZSur=GzDWD+{&?q`a3C~O`RV7N^ zGg!k@U1(BNCTM~D5h)*flo=+EF5r4fHinPwzp>_6x=_F+S<*zNlByH6d{1o`)mqMZqnbBC zUF2+Ng7lfG(i7o?66gah5hu4k3N({c&&2nlD|#4PLy3$YuYoazJ_Tx0@qk`*Ae20O z3Veh$C1k>W$5&Xdaq|YGUeX%5d5cU9nRHvoj)Wla7(<{6_B2=iosNm{MV%lp8Ay45 z=GaoL1is|9!ur5#W%J0awR8jS(;sNBZ_k%W#WpqJJ{Ep~AT)2PsYRYVU9 z_2WzpG*Z!iqqhPz?CLff^@)9X%nBwWX=*xHrqGC!cs1g^U&a?w?^aYJz5|2AUnRpf zVNFfJ43jk^h(St977D|(fHFSRqVa=OW>gi9z|`8L<)w2yX3hjX;L%;nPvt72oOf9Op`1| z43rfWy=Yqps-~be!=t(~rh0*scq>}=P;+UxMu{no))Xy62E-lVGYv9xOn?*Z=dZ<| zh$HKuvA6(i!D?dnAVa|o$CbBdh4FjDqr4<|n0gEn(3Ii`DurMfZ%b%N^r7+x!lu>= z*bx=n#JwOSlwvlZ6u}d>&`RNiM5zs~#MlA~+tA#o785?e#P|#v%tBPfn^4!(c?qOr z2=uH+!9c+DqGVLCXJ$+o0j|!oeItH$b2;n~^n5Y}DdH ztPS-w@=ZZQc(9bm0#6WZv{RB#oHsXWCTNmj!AZ#kvVJ6nPEVl3AVsAQo_iJd%#)y? zU8NF+d~p0%$Q}fxNAZfN6-AL|Wx~SZ2Wkr@PMp$Onc8^^jPManc>+b*TH_&Aj#l+a z6m2LfoP`Ov3Puq3z=@`Q4b!j+T*OfT9?TkO1--{KM>2@>lKtc=_-#s>8JdYF4>?() zPvgrQ8lv!6&;((SS;j;}rHNDz2fe3WG(QSaP9jB4fMBZAgs{khayweiN^m4~*pN~V z2{Zu##g#auDJlygcmVp1@OZ58hgR#eKVNNvG;0N7&#+MESB#`Z^oJX>BJ``UMJ!I_ zUIHr$E-;3i&}|k6n*Ci&BN;{b}2Mi#zFH)JBq~Cc9?*eAe0InUbDuHv2MUh zLYzf(QSk1&l6tkfjMU4wTKc2!;3NU?ub2Vt#nyAr}EP-#V- z+F9HXKBL!BnA;FVgN4;#TY^fXIWcPN@NiNdDNrPe?a(vFip*9Ae%Q+ssOXUZ^P^&j z43sJDW$MIuJcSeGva_q@s|dXbOu=`$I|Cxlo>09$qIjtJrNFVQB$bzqIplLNG-ba_sIeC`;F}v+0W#zR z^p#LaBwx)usgXXHUNz<10=PA)!pl@`Gdk*1#5;frqNG{SFk9}?6#tuD`p%Q=K*?e( zqm-I4F*J-gPC`1+1)8Sa@ z8i>y0M=wuzoF{Od?%NQs;x%o7zCA4 z<3kjVeUI2` zh@ygqe9#=TUIc=h$K@bSTIyN{v%sXveSudom8>x(R+F><$|E9>+z3{1HAD13%;Shq z8MDk{XIJqoQjl!4J~nG+4Bdc)OK35dD*=~aJ)ktxfbe1Acs8c$WAYc#9P;xrq#7e( zo+UsZcrppCj*5g@D#y>jtcze;oq3Ahd{&__&4KlX3A#|TSE!54Fj9F)2v>PiqFq^$ z73qXLnn;*V2Jlck?R4Ic=0V>@h?r-^avW2F_|Y81PNK+?xXiZjDp(*Y1ZuTLB84!> z8@8Jx=c{BJiXd?z#6W3*M2QB=tgDf=1J8`bXEr-ZjgkI#&_s|AjzJR+sgx;dqcqeg`UurN7v4bQGqFuWJ*B7f;*P1%lxD8kjULCjQJe zQ)I2=aVA7W(7ilirp08jXRX(w93`UifKXnR1cF#tN=t}5YD1>d-Hhv_45+wDJv=~D zW%>ZYY6<} zEyo(+b48e;{yD)W#>QMlI|2-;4Nb4CtB9GKuTTNgCBft}QJx3HW4B?>=fco9pFV5p^Il!oKd#y~I+ zs%>W3b?+#53>#+vma+E8FRF=0TW4OZz-i5!+I)m2wxvxTJWEnYis4~~AwAt_F_@Uz zSg@k1$-7;?V{+NJr6khGAn}osAL$rx?*DqUWFVwNmJ6e+!T2fG$ekCw9xbbyB9k_E zz)UC(Fy0ZHCD6u5C>|5CVi81HJD7{8F6TRf{m5=qLlqq~nIR1k_iwG2Ld+Lo%2PIq zs-Yiiv)V-{i?ooRFa$8(3jfJWKMS=5^a0>Pt-3QF~zUxiH(Q)qg8 z3L!89fUP4)lP{KPYNf&wPUI%!4#1q?!DuT@(n1v-fRob+p1VR%xzp*GB|PQ|9-4ru zF)NymUu(*ZYAs7s%`J3?Xf|k(!SizLxX*@&LqsBld}RkYLn}u(A&kE&(V@Pi(`f}q zjpyrPE@+S)WawjUCPQm=#MVOri7tVPYg_>N%*KusFq@MYBuUo59=eaE@r3@EU;B94+ezO848x4q%H7Z(B}R| z3=1tcmxdq`VL^><&+z8+qawy;<@qeK+?O=wx_im-+$$45R2PM=w! zI=j3V39$;mSBt6=dBj)&uGJQH5(yHbx^f{r1=me1;6peTJ+CY(kyjt(H3x6N9|1Xe zSc8JJNCU8ZK*o$~Xk|=WK$N`+d0%&TJ*l~i?Hh;&gq zQHkvZ&?1^Km}d=4hf%zod4?SB6QL>My-YNZk73s3Ca{Wna*YxSa4(WGs)d6lSoc=? zgCAJYBGHB@e+eU_sY6#3Hf!mWPHU||z#2oq#a@E-1E|PBGsTf%kQggSkjl_ip;6A$ zoI=o=C+t~lsxmM;s`%ZYOLMyQDnoBztw`~g89=1KMAtlDUhC{8>d|UgB4Zvyr{#3; z$a91{EwoFm!%eY%LHH;ggML*&!f3-53c^L+ScQXn>(IKmvYOwlJl^a=14JR)celdf1s zUR&{!S;b%%g2`AiKE!iZ@qj6kQH2JulZJf9UIR_(!|G_sfZ3ElasSl9&XUl_rByoDs<+4< zNdsE7K7zBhUVmdFNgT?7TOb38rDgd?-J~s|>5T~6mI)>2)<(|0L2d-?Fb*E;h6K}% zn3R)hraY8H$@@(qWJpM#jfPKMC)>BVK*{Vh}v81i-tKVF|VdI-o0t=Vs zu8k(?+}pCMv_3IEw#94!4HlTE(PCCziBjKu>}7mIz(5b_fy@eZw4? zDej<35+ZcN*jiP=rU_Gag0 z`J)wL$TZH{7Y!2li2|r%u!0i8tQ@d2m>CEfDU42`SsKAO1~gFq-RMK>v(W-jU_~h* ztDH$@22L^OSd!-Sob%w^MCXHC>e@%Q zW>E=QnRMPPppYD)eL={QZCUanTSAM4WFdjrkq|Gi-^;IzV&1qTpoAx8{)U;)=X=ic zySJuo0XOgcEzfeE^PJ^-z7Ho!f%3XHK2dC9&Z4S%b37v4Pmb_rB3WUa>xl7;*>9Cr zPG{84PcaTx`o33R0v5noP8yJ$zJ&X{^#F+-i-hV3CthTMg~&~Fk-IdAL@Zsl#yw|@ z6HcN>GMVRCE$dzwD%3eDhae|U(pKZhC~9n^C7|<}2Of4o!DF|+k1)BRf`pCLqi2z}n8X3$JW-WXdmqGY-Z zx-iw-raSpbb5I{J@e^P#sFZtvUJ;RJJ`AF2B|B9FJV@oSBYS=`cM+~3d6+I+MJ5Pp z{_tV0*nH?HL+HZ5PT+i7gwY{&!$Iz`FX;~tjebKDh|2709nKDY0A;yTr<10?w3Bf$ z{v@=8afm##^;5V+#aL2y1j%sjwLS}U1Wu)*vRIGsR1@x|eT479$BNx&`^D!<)K_Ka zc1mnF?KK(YJmBeLjq~4guH6(0Dh!EAYXRfTa{vR_G3AfUBNru2uTn6diD9U2n}P01 zE}8cu;RMA=KL|wQT%4%FF3KS^Vl*0X1FnmnM$a43m|Ze$95fL?Eji+z=Zfwi_%z%2 zv5nO9R^N(|AZ-=k%qT3V4V$==t_s)TIjMo9P*BVBMd)?tYoH;03KrO4G;zI=Aomc>RAseU{nyPGoiFQ z`*-v@5ipPih7wW!I>3khTKebcto@i|;vGLEj0JRN=#SVT!hd-y?V=ZiG03y!^eH@- zgb@QojUKhGmT6{3MM^k3g*|T16GvRlE&={SJQ+O^y&CyUtb#Scw4g_g9MewLKiFFa zzN*8}lhS%5M#Qeqsg*%UduTBjC$8#JA!2zf49460b}*627gJ6S9LvEWU3mvt)JNlta`Qer0Yj%P zj5|{3cyX3-+dRE1>0upv45{tA13I--D0MQ96AG9dgX4-m;GjZ;hWrYxV@E8k75zmy z3FXF1r!bD^^ghEnClY|YLzqNE%_`*RM^q*DTdgi+YopFbIdZb=yzz255S4gsL)NHk zVcQ{`G%DZFA0o)HB-qAyuKEPqL=1DHoUAgU`sgp-W*-G-M@cBdds|kEaNitY_Mq7lwsx(f31D>!j)U_Vchc*1ZIXt6%Xyf z_}Q7CVglJett%u|BEbKF$Oq^T+Hq+VcI^>XRY2UA&;y*M#h}t`0~J}>01O|}Pdbfs zYA2K5ao^Yk(`$QAvI>x#oN$%-#sQy7W?fG>t%~u)fWo0Q~M8~I~@ym02)eU zmuNr*1&+8KVgMJNg?b0HAeD<1W?5a09P-D5YG-t^dYTB`1|nv4)BH@V_EnP;nw=<7 z28m8Ff6T-%#K+te-nM<@avq^rSEVj8ldoOoD+>~DM5v7u`H7GFa2)^)nmu^ z4Ba-*17S%T%B$1mA(@0=>$^idOraQA`<9V)&uq@xqd{$O`d6Ci_O3w z<++^D7h3EJP?G|G%qqTgqQxV%Mb0O+e`nb0h>Ef@d9KMmCz$;je~{yjIt|tB-!M3C z#yD~b*yiS{fAo|i<#7J)*7G!pp6xKcy4#*c#BH>w8Bc&HbpM1TA?)@IILI1EKI^RM`!Uc;L)_T8y03fBx zb8^lYD0^2{R!(7b@8t|6^;m*O*hk1N9?-yRg1bf5-Ivf)xSm%8ZsP#XFW$?hZV)Y? zY{sMDD)TiW?F8$!j)>v0p0d*;wpA>-a$ObgC>O=H)6w{2`@3g?%%J8?d*$RVDIR=v zNEXPP16`$`?0&m@oI=mTPprC0YL499a?6%!pksqDAm+%$*&4+-_KyKE5s1@m8~_Ks zfMu3MGxS7hTMy7w3oKTNPn`D{!sb^oNE7?;SWWnh!x>YYHP8_8JJ2(STK)!tUc8s7 zYW&@l+(b!WB;Xg}%g;%Nc`6q}%h{HO!8cFb>#EDxg@!)2ecS2~gQ zvk>`jgGmRPM!5ygwXxf!FRR8euyeLk>48e?TEgQM0=$0ZH>HfZfByca4w*N3#1KnR zfTl1EB}UJ{lc8cbN(iyyliOVm6~jt<=ro2H#(dW=&yQCuHFb;Z*G8n&!AveCVob1p zns!xm8`1WIO-8Z5{!mIQECccPZud%aPR!NvmtXxBa%e%^*2F^mqblh8@a(R7ev|%y z2*&!-zQ&SHdxM#AHxM*S@G5X{VD=y(qTw)o&2fbxIEa{co z*t}VJY#aukY`=Pqcds^I(!pd&NDL7jkkv!8`22m$Q&SHpH`ENmu|Rf+(u4=a)$p7X zYC3I1SR~2#GDyY}wE>gxUp>j0?DazB2uOk164zVH6MCPRltES%D-Q&;d-O&CTx)#+ zjf_0RzdEt{c8*dfRmJ&$Z0N>~GQQ*nYF$7wqP0UQN&&TwA8B{9e?R*6BM6p(zIb2g zo%UPFRfuq0oi*W2r=!sp4I^t3nUw=|6x_iBbr{^ii=+%rU6agel1n0@9y0d7yx)3720OdgN@(~!+&V)+!}YHxf06(pHRe};jC!Ar~! zZy}hAsY}>E?e4xCJz?CGbg-rRT7Sl)3`Xx8^+s;p_puNG{_#9^K^P_6{b*e$6p(lJ zA;Ql38F;1`Q%D_-%{mDS4PQd{c>gE{*@s9d@LC;6v@_%RFwRjGVFKmGU*x{nlk|tD zXhEYciXWnr4a9%q*lrN9Cl+~bok!4`hv7J_#7F^fNs&u4%Th^%6pKdxD9M6~($G4LM*?J#KMlNlUwxXX63xJ4fxGU%`pxqi z7~ID}r2FtWlYyiCyz|`py$m|zqx*z>qybf(YViW237;{hvbi4KqX=Q#RvL?TCbMJQ z6^Vd_R&oxKF2>2wblRSNKt5l68V82)rk#!(5+)FpS!9(N_bGN>G*ZSX^T9Y#9h&h^ z9)WSE{esI0u7^vPXdgnr^LPSWOUP@*1)bJjR{_YbliN{Dxr#In=@VSaQ!WS?~Y^}8HL)-f*rJ@{Zs zB54%{LFr1~0o~E_(V3hla1O9wiH@^ht?xXH+=)(BKB6YjGVHM=nnb6(`h@JjVaj$N z*@rip>j@G*Ow^X=>Hra4jug-5uRdm6@ZscV$OxGq5$@axsO&4e*qy*dOzzAm0PNB! znS|pS4rAfc)ej*@#sAFjxxVvYjBdtfJ-oorz;*j9jJGh^`d=7tADwuBpZcp$`FFDk z|KLZzU)P0|SLR;%cxBTK&+uP;w6Bx#_Q`MybAO&2mS34~bA3OLr_}HA?mo-s&x8vY zuHgFHYs1(JYcBtNk(PX<(YgBb1)3N_1_oi!PD^d(q_Ju+qn3T<@1$c__xE1 z{E6<*3$g=qovg`l0&}(Pwomd5%k%qW+Wu7D8Qx*;kP-MZT=zW~g+I!3WkH549z8t9VxABHul#+(eFwDLS0ZwD$!#Ps6I} zf8kVxofZC7d0~q&RxVliQp1P}Uo5PrFx&E1czR#^icGBhjs@@~s)|Ptz^V~1%une%z@Xu3x`-nWVaJ$OfEB7wE zy0(ko{*1e1qm@JU`7q1M7t3>KbK1{ekJDlqgP-F6pWqrfZsC~azmLF&D>pApynOdP z-r?tOz6L`s|NSn%%2>;Igs=9I<~aVQOtRh^wq5W1Hodg%UkyhwJi%UXJ9sOc!*bDb z#dG{ckMfSExyNTaC-C^@?(gy>7=Imeu6cxZG!O47RPb zFJ8CucmD46fA8=A{l9np-~Br)*Ztx@_=o@KAODko`p^FPKmTX{^q>6WfAkOk!N2&I z|LR}=n}7T7{{6rIcmMX^{Of=9FaO2=%m0mc`1z;!Fdzr zFym(==6o{L9PIP!BquGzBZj;MVS!Doq$LfjEC%nYum#x0^5?jQCu5)B&@~AK#%wAC zvD`EVLw3!C5XoIuDn85DDxB}9TW6OABZ2fYvVI4nGT%RB2hq8+hHHBU zz#U{f@Hg%E!~-}L19R3n#TCOAvR)*f-^rC?OyMWY$W+rv&8PeMfN*($BK!m}hx{SX zendz!c<)NZ6ZxqlDDM*G24j+5Ps9Afx=RU3db+F zZ9`Ko37(4}5z|C2O>R|~{bVXw{k_1&d^j=!jd!uql6;^=#uz9%8?zjsHt2AJ;@F|w zbqmA$>NkK_-bxsO;yujAhp@0KK~4Jr8;}Vsf}fRCGuWb=ux0hViTM z8RvuN?`WKlfj{8P+y%c#B>UuWEq#}KM^>u=-!_|*s1U9`(!yxy%MeAWI5`ObjDK1_ zG8M2*=!lZjNtKPV%DnMz1~FEz$fR1^yq!hQzoCk0P(Bm}V_6Xbn{VE>vwwgEQb=43 zag-0?R^H`eJW1b8Q=(DsL|70cCc{9pt_@96JV;$UxI2@vVSa|7f)@oKqwH)p)iLFH z){qmirGu5{qzWa)m{vs-_D9xWY&Idt+v77BBz6JpSz8!QWixKpIR+hn5lCZX^5jUA zb1#V$L&>8a^;i{z^Bj2dYQ5uCcr=QPRg#wQAzD=Q!|yG;6VP@*^alBMb}0r|W1Pd454Isvqbi^o&N|ioNgogyL{s2Q zA&Urr^#q&1Rx3eF;8&zTbZ<*Ikp(9ky+P z4>emA#Th6Y(jdl<*-DUE0*-XY#B=th5t+QML+q;4!YZvHvz3kG#o(I>7BB(;r>UYC zIK>VO5l3??*%FpjsY-^$6(pD`D#H$}!MTx&fIu~A z4@ws$5%q2^Se-Y&4ZH-y!l)TmliiK|BB3=5A#=98^j(J4?H+@FC50-AI@1KVma!{3 zsPz?*m$ z8nkZSWE)DI9{1#cwAn6WU~CZE=U=A45~7wKIg+W71;vbI1uHA8<^78ip76|qhH3F- zovPAPfdmZ?Av`z$S*Q0&;RO1w>FXFwG&4)hvYaS<-o6>;sq$s$AS@uo8b_IBai3>) zlu9+g&OW({J30S@O;(c`$(DDHC!^x%ySQ4tlf452NufQDY(T06oHFuUnOYu;N0zqF z2bz~v9;!1o4w7zA>>&i_SSPks1Vzm<^(i!aM_hOAA3Sx++AfN6Fu zt~q6~Rc!%53bEW<66U9%zF^;FKTe$+7dI=#15`#QAweI4WL$= zq>{g25YSzy0;*{q3_Db`yJcBLF@d}hk1Sl~B?8oFK?(shqOcWWi^dYiQj7BlXDmhz z6-Vq=)Eb$BLYdGfq@4r>SRk|rJgnAip{7$n#0MG{2ya!8$pGTMn^}%-@i~}7WnQv~ zFa~+p&7l@W0W$E?P~j@(C>&OZx+PA;UFa&ubUP&J&c8a7KsSnx)EXuZJ0UJ`@DW9A zC0qv5o^U|Ip;TF>GYu}AHOm63lBvWt-@O3tDjZ6P?W_ikSuV|nBOO~ZjB5m|1B&A9 z434*JCSEx_9MrPe7^o~*?I_j!VN^6b{)INO%@t}90Wm+FYEo<)W$fIQ<3}p7DCwp8 zw~C!(VGN5pLYqZYn0#JA@=JYB8d;XZ|3G1StP3$7@3o4}Rg3*sJ!P7-A}&Mg2yYDL z?EY_{^d2VdvVK5a0pCB+dPR%*W)K)&0a1ts$Sc`kXtblyohNc-cOfKw;|L3GUimEPDaC+Lu?!9)~GbYHf&j?8o`~6T|~PM7ak|# zJvx_mOe=`hePZ?GNQp9$TEKMStfnyk3%Eli)dfnIc!+QlHjG=;Iwa~sOp)E(8>6QT z*{5NSNPQC`2v$&~-1zzzW6MBvtATIE&Jyb%=7y9Qi~Ah-R=xqzWWq zy;yZ@vDVrV=$bt&ut(OOpF?j+8n@JqcFuO*n73p`L3#`{Q_B7T&KP#l8(aeHCDjBTM0 zkd6VJIgTB%EyqK(klgs)lt~ACv$AqqmSF1Uc`hLfA{A_|1h2YoVlFX%q6h9)2@w>u zo32%Ht8-!M&uL=o$DJd*M~!$aP4+dK$eA_Ds!Ui^@MOSgDq5rLfzxa{=Li{MlDFPq z3DZPidqlgO4(!~HRIGI=?NQ#wxvR!E&V-YTJDR|LcB2NBK|z=)!9Q4pTpYGE)g=?c zpEj}1vqkWDBob}PW^Pj(8+Z&wC07*_$Aa6=sB&qAhS==)PSHmJh86a~%!EN6eqtu2 zyf*ALoLm~JTD1t{&;?Mi2{FZB(E1oSrQ@tO`hpsC?c@x*A}rwcG8jPe^Dc~NBZ}HB zDtuRg0gpq$Lu#3yp{u)6`*1M=&NE|3yB-6rwn&eyn&Dzy6Oar~*hz+k*P@%PKhA;} z09*}^_(U6wk944DDM6@3X$^)W^Yf8J-<^t-CmJKmfOPcj#?Y$n|xn@J#AD^)p6@o(81sDgo#UBR|slryTZ+v-W(ZRpe>7+Oy8*(5NmG2q5F z_G~si_QsR5;}yw4Al<~WciR$iIuJG`je-6_`SRSOZ&TrydhZ&&L$=vkXDtnoPI@&M zdr=jWBUqBF>IgMo<0zx4R-+FGh?LqWvlh4 znBN5vq-idPFk{HWlU`)H4Yv=E-ZM+e4QaCJi<=OyZ(hDcd*E)xL}!&B7;!P=kfDRZ zCR@K{n22A1F4XHNq{IM=KAPK0<)#@OIeFXL?tke0ZbvCbFN2Dg>Hh;WH;jM*td-|z zG@dp3g!vpbKk74ysr$ApFtSF2JRN}?k;@wPdWBUTcM8i-vWm(6LqwV%Z* zHg0yNSL0Y0qWgI@5>oJZ8t*qTcM}V@S|tKt3yFX8|#1Z>HhFHFMi~2UiiY_yzrH)U-`P~oxe>ZiZ+#!J6<^|?>H`OJ%N ze&C~TJo2Y+eDvFIeCKO#e&_Kwzw^=?kG^#E`KR9a;?r-u@S&@}`^44H{gC#&@#q&` zf9czN^TyY{@x~K>_LI+j>CNXJx%wwx=ifh}JD>fS4}aycs~`L>Z7w};Df%AhEBspw z4|gAij*56pFf$}XhDpVOP0FDUptD+2f^zc=dOb{SE%UZWcsn&LX-mmLyixU!6eg=cWK~RCub@K&Q;^ihuwSIVO8q%Xw*geP(1_XAI_jTs zf)WAyP!ASxRDrS*5+nf2$TQNfK8F2leHDAhVhq`oY@z)!7lY48#MSM}hK*kEE_Qa` zMVp235wQ}7$-Oc!@CEJHU~mT^0U?VMNHb8I57Ye3herUJI1lrVv@q`l zIG=M4wxr+j%U9qjNo9^1r;rBXaYV~rTM*9qmH&jIS3V$NN(mIv}b8s<6cc|sk;o(9-j z&ROSPn#xP-9CzNrpZr8mxrOKRnGZaKYiiZSFrx}E3HLGI<^I&J++W1x5@Ev)u@*2ehK5~Ot5pJ-c6I^R5!X7dV$i0}E3 zyZl@u&o{J$UeK=^ZSG>McoBc{p(dJ9;v4?QuiRUs%E&VaTtoA?jMnlTE}%)(F#7&@ zTF9@=CO4L>at*V?pwU{6hv)nB$iDCs?cq6<$MR*3;kWWME~pMNiS;g8Li=kf z8C9<5#xG~U`Lix&Jn1rB;ITBDFZp*#3m>X^beT5S=bCPAr_GP1g9u5rr-qI};L3Vw zHI+Y^+`OpU`~ia|X7*4(9v_2RNUc+{>({TG9ypfSy9Wd_qP;q+xK0QflYnro%Gb*tXaZ}Jezbr)N*zE0ZyU{0~sV5H*5LgS+e6Z48 zI){nuS>#yP&^t>@Pfny9RiAR25GVE!~>)L8)g8A)vQrxAg=1J#@Q`#NO;GZE0k4Tokoyyw(mlzeB;CKM80 z8K!w6*=dWm`Nn%aHQmyR(H6>rDOGPHQDi;z}08N3TSlo~_&$##WxY{Z)K z|6~-&Fvc-{_k{x-AZz%I6QcPEd3o z$#ZTq3E{)B@TbH$i9eEQNw9dVqbZZ>5&H~HMW%PF>N=-XI4qniK>Hb(te&1N8DPqQ zc*nE?bUrZF=?HgeJP;HtVB1Y5{gIK16C^>i-f>WVMn~jksA!t~zM@XVDVPR666F72?5+|TO zm6X&)ATM+RJ8G@6(LlI-T-zEz zeuAsIT;Qsa^jB6zqs+JuYrBquQvdnu9g~&2<{;BFvSV1_(cd{I*YMR$-~af*hF?pHeb3xr!SXZyYNR_ZW^{ zQ6&vOU~TCSM+~SmrkXgp;CJdVbIs2F%F0bx{Knj;JfR*3{Z?NH^km6!9V(Wm+S1cT z1+xYdiAX}@8F3xSjgOWKnoNgG3;{r*!5dGsX-2AM&FqZUM zF!yv~b(4JS$Rbdm*t{smNS~(ymR6IJl8(r#Q{>UG|N15GNceKZwUF$};M?DUMT6OR zf_w}-1|@%qpeaPfwMTDg!TlXBG6lt?GX{gRU~}g#!l%?#vdoh)O`;wF*N?$D6I97i z=^f!EAVTDn$oU!AK^apt$94dg=&cEdBtgVeEXpJTY1*zzs~eRFl(GPi1}0eAW(*Cc z)XbpU#qaFhC%VRV7v%Kf+lOqREfQ=vv3g(%YO^NL;!KD;SdNdEhbZa??sW434h3*F zk#1RoM4fvFOH?XyiqLhKpy3cC9R`ky!+yx;$~4Ad-$WZLw`%(;KC!dQrU>)HKIOsT z|3K;(KN-K2zkwU-Q@|AuIO#g?GXQ<(Iplk&aky+vrZ`FLIDi%LrnFxQ&Dk=J zy7&IM@n~%ywSbz15DqpB!5VsmWcvjlvwbBcA&n~^7%1LUfMb2cFcfWHK_DAM$bL%F zM`mNvtR5`E`XkjYW|ke6hYP%#Z^G4_*gfyKJxDMuh4&B#g1?qqjDuFPab+N$jaeBG z5&804}ebj(44)fi^ z2$V3C-y)`5c&4sDr}bzbE2>$)71viEa8((M#T8%rH25hak#`VrC%C-5d1$N!k2r!ekgqJUdyDLK#usv=59F%H&8VW_*te`HSF~@x{1CPqgG0$+i62oO_RIwMvUQO`H9tnP26nMIKOIV56uZ7UO~{1PLh<&g)QLtqt*vgWyQ|Bmv)z-V-a!T zI6(W_PGltGETFm{j!9GN=u|=GQRGDONvpYL08{dBC5-)JuXN|ilpJMaVtG6E$dE8N z+IR6+h6b*kP6-PKaeg&C$vWq{sOji&s9lR9@Bs204Mp`Zx*@|X6>;TZI6j$(UJzZi z1(_!adx}>YJal_R5?MB6L69Cik(g_|ZM?$W%7x|lnUSrwfL-Y^HG5Na3|*3f7Qm!d z_|!D=hbIlKX65NXZz6vNF7f0VBxJ&Te_f3DzL52rtqJG)_9jH(`}uS#Idhb3{o&$QZzrgHJ%g10UW`FYMP;RRt zY3usN?N%{Iu9A!|r~n|I8he{32o6z=vOvdgoSIhcl;OQ}dx1Ft15R+)w@*bY^V=pn zM^AGzXN%U@do16u%T3P9vEk|oED?x2=r{7yb<)t8$-ZwUKNQaqsLh&%qS-Mx;es8p z@&st~E1i@sG!vt!LlF4Tp*|-ql8BfH?pSg9E?;6TTqzq4o9+rCT={ThO$$rx$YfYb zo}t-C?vZ0GJT(C;T$x1kVLl5N0`Sr+U?-L@8n_ubhSzhHyuCmq9b;al8 ztAMtHZX#g^ODa2OVVp{ST$hDH7R@ptBTk-TU$3LthKxYO86Dx$3^z?qsAVgFzgWJG zDGDJBM$k37xX}N;<7N`fjNs-y;L02LjTh}1LTZq^3IRczPfu3RfDo^qoSuCB5w`n= z6x2yf$lKw2=ktyGZa8=l&n~B~Fd&R`Tcf}-S)WF1`WxRdfGP6{gUnXX@)l8CN0*DO z#4;DWrA)DAIu^u!Qb8|{rW~q=+lwuVeBN@v=BWr#uZf4o1 z(RGFb?wN{FU@bvs_&ASDzqvf-_D)R5Gk|%Shtm{hi}RhrPsvlTL5NM*DrBKod~nu0 zk0t>m(kx!bmrSx>E_P=Fv%o`)yzw%tr}^)g8AQXV0-gxXX&Sr@jtmZBdd_f@9aYS= z$XJHNL9wN8!G!?{2nE>_!Gf!-RUN$tvI&9A1xr ziU6y1Nmekp9Y@V~1Sg63!R=1~gjgwiyNgU7G&VT)@Gw(SsX_rwaiF>rJIbtF=gl^6 z#Bv+h;a&kgyfnWL#QnHr90_K-_UN@n40X8w>chtKSs&K_17MdJ7TMo`$hjqJg_oy9 z3kbi(u%LYz$@8`#zG>ztRwTuTo8X&v*j$ZM>$U(8r&Rz?+WkB*l~bKw@}()xEJIi%Fc*pBbgAqs-v;E%@ZY zViS{@kar9#0Gyx^YMOa(pbr%91PH0zAc+|9fWrJl@JGoKD#-cQ;A)VS0Tj7`IhTI6 zJk32q652ExL7ZJhOjbECLK7P@Q3xO$Aaa*Ct-Vrh6b>;izVDYJ{ z5(Z;xnBqY;F4O&&(Ixx^EhMrV3LezZ&g`A>GpaK7uq<@8rR)L0UbQ#2Jp`a+lFp+! zHqNe#3AMOa+oDsG%Cc%m8E&ryAjJTK_uKKax(Ar`Vg#B8t_2NeMa zx-R-p5^p^|OglZz)BJ@PAVXLv^gs_%yWxu4G4rgH-ox6Djb7_Rs-`+ZmI3aP4g(aK ztuFh(Qc#!BP^Fm42J|#N;wblKW2#yUZM6w1s~({d>euG*=8j-Pf=@a!MIne;5`xeV zNP;F~We_Qr4tUn`qCM{f^k7;=&l`rq$YKMZz*%r+YPyJB$Mi)K$rOQvM4Ge@1RWqS zwN_p6oK01pw7RMM8K0sDpg&)$0S(EQk>VgK8DQ>>7wlwlW@8ssA3~QTQxi>%RjfV; zye`;p-%-bYO%>V@cg4%Wg4#aIrDN2iSvjEj( z&bfNm=M{=sJgN6aqk$)KXPS_yJfS@B2NE+X8xs^bbcO5-aG)D6xrM#Nb)sNuQ;|DK zY?z#vjx$|mClA_F^Z^pZJHR&;!kPz*o7K>{Dx zJO|D`s*rtDgTi%y){{(=r&Pg|;zZ4ML)RG-IJ?$r zY2kp_W#4cXSl)fQL1K)C?O>G7`pg`i4!60u)Z69K*xO2bwyU=cjmjCWt?bnJMR&0qE?55?;)QfBlue{++*m{ICD;ufGMehb(VT|DTWI?*WUkj?S4jkR{Fr zO%r$ys}j??5KU$-a2er2;(ht`GN%yLb>&wH@j1nP3#{RBt)6R%@a;Jqa! zfVX5bOUeM%lWeX&?yz4(R3+yR;A&)ylQqXSa6clGZcZb;tXR+%8G5L_Hq2t2;}QopZN4W*ofq9`V60+gq6r|KhEbLhIa~HCpnAw{~v~r>E(&% zN>-$o_~&VOjh>Vv3jQXqEH$ySg5!y6o`YBE z!@OI5r4Q4NFYyk!t6t(7`ISBh^HwuN<(=PyY3g|ym$)Oni14`d8} zkbj5MiKodG^pXN8^XwORK^$MLW_$@9H+wmcjDm+dj<5$uRXw_xBlk z4sRFNzc4;Ae!ijjvSf*pl?slney^j*$mhMbIowovtK3_Tq+{VY_q}}gVZWjGV@BlG zlH=-m{&{BVhpk?oE$8?JN4K8W*THT!J(+RIJuifF%h6zj_%8fZyzeod|MHJs;#V2R zKEO9W_|YFt?|6ydU>fW8($8G|WX9*kv=6Sb{2F#L`Mnqm=8`dW-ZBPb)NCd1h2M*3 z{t=&wRqbozz4DpamY%8NBxC&Yd|N0>*k^cJ&E;qQ>SN6w_95={A6eIAScBEf`Iw&f z--w&=i+O3SfY;PPtKC_njZpiLuY12n}{`X|jg30N- zKmO!vUw5Z~;Yn7o`fqWFy(lYGu}i@cC5x3TTpxvdN@gussQBz%&%zq@)WkA2?tPAL zzaG9SIJR=fhhUqkJ9sirlR*sTvM@-&)Wvt-;_r{}?+?)`*}7z)Dn7Ai!aXIkR@kig z^?Ba^2=8r{FrG|5dZ_b#-gzuA+OzyW%vouNj9&KK(V+FV4_>dlz?I}@T0x=kdtGu~pL5{U=X8z>@ ztC^;y{kF8m`)wW1@X5tV=d&D@57NFDm5J9L%lK4VavklHnT#{A`}A7e~ERBg#Kt4GMAPoYQ5JKx)a4>@kU=SA*-S8o1}D`(g5krnAc z9W{~+p-jIGT3EYh>q2vi*S_oyOzSNN&C zViW2L;$?2e?9X``b~Fzo6@Y25zZqQ7C8$|19-FGlEsN0h+_{IqH%86yB#oIF$j6WF zjO?s>VtLEjw4JU<#I zBq2mC?LMWFt{Qp^X}^gf|$jD|d=)DNqrj5?&^TkApExHSAv`%s?X^t}AY0 zqyW*!rZa|BmBth+HK`21o^fOoxsgQpV2`C`#+kW%bEEKUkuzs%1}!ajJs*!4s4&ga1T*y9$um0cINItxYn3{4jZFnJ78Q|CIeGEwsV_x zOji09yq}Rt53EjT97ks3_ySs#$O=>HAe&GSo}jA_FqomC!3WnM22jKg9E=(6q^xh> zgaJ-8Sa%JeKt(-HaNdJ-NHwU$S9@hKDG87`)RK_ZdON-dE>tOB0`iIq*D1dXSPmIr z#-)P(pg(TtMMfLO8q#fXHIgh9!{}@P04ktqAvA-7w(V%Fq#%_kCqPsfZ%ksX;y@kW zr)$KFJa{P=Z0v?K&6LX>TN?n5I52m3ubUWHB_2 zIVSCoAH2I4ND6@f>dlTX;Em;G_fVVCCbmFOy|B&VYry(+=`);lC>4Eb^aIP#p4)~* zXA|SubfYQ_-e>(fS%}vNo3F*C+`rRW;CrY|#+zpsL46FpqnldVx%2ija`+V>xe0*Py)(}f}bZh{GWDCA5NryBS#81pda3Ck)Wf481T8Q&s z3FN6lBhinw(FJ%on~>{kjb>60-nOL7_h*CiG5awRz|40=J|Ud|Ay6mLj$$1>tz_$d zu3aFynaV0SVBwA2nd^t{f}X2u8zE#$g^@NG}={i9uv!tSl5x9CrdoF*>fQy_6FAapn)-YFVLS zGY%w6Q2`G1ZD-y+&Pj3wU~EZKwMb`~&$CuiHjzHC%iD;ZR@zShyjUd~vo||BQ5_yo z;4&oG$_#_3ailMrpeTfn+&do!ZSb&B5Y1zlNW*;W6H{Cmo1n`4&uuQYx|NPiYbl_Z zqCfa=!-CH$02rKbIrw7!8i_duituc9oT-|D6lW9#(j^AP+=Elg5etHJ(m5Z7{P-=) z9^R2m0)c;&3Q|KV38SikNXgLDwc|T>B`n&lP3?g7{e{U|@zt#hf)8#*DUiQI24;76 zHlEKZ{ zYIMCd)D$V%$?`9w40aB6D)zZOr>W@$6t!Yx{JJzuMu*8_LX(w}CZS=*$W|%P`B7jD zpn7r}vR>4Gp@ZzY)r!+|1@4R$3`F0}_lDzOG#!N}08BRADt+RG*|4Ehqj^lX4QK0? z#pE`3JL1eXC-xn!LZ^0)*C4neg2Xw;+46UHRu)^GSed3wUFf6Xx!H_PQPw%8 zGmb#p2KRU#V&GPMP^uD02SO2=S^^hiqA7PGtkd^8}IM2AWAktO39$sfk zhJi#XxpvyK9@snrIrr?p$O^zXyTX(RLia2ixDojnZB*K`I4SI?+(MM1yffUpa zy@T;BDY0k z(z4Y3!xEuRN63NTZ%fxjfGk|WKC>n;R!{~q`Bv$mB$_jP%cK(?Y}i%54k(Vo@PV@B(#rIC(nG{Tq>yUZOsM2^dzJ0HChcVC%tT zLTk`O0m)^+F>kGY1&t*oOMCN*T6$%d;JA6JUK68RN^I1SR+IJXdN>{(hC3z#%{NG% z=`o6*jDBzcER3NtCI3S@oFQ#`29KWz9nfC>$En&AGe6v-fL6pz@CtM)Bjs(tOjxLq zj0cl(Rr)NV+sA(;0(xTg?5GLB>71bRbH0Vlylf*R0CQ06$W)O^S`y4-V{S4nRu&{J zTG1rjcl>{Daj4l5MSnT5eTK3}rn1*HB=pxNY@ExH7yCLmh}&DjQE_#*>}cNVq#&M- zncNmU_m1R{W1|c@VZQY_9o%9Fih~iM<;E^&JgY+Ee@gkH=(K60^t*9D!ePjmxlAKJ z;u+ygCJIO3AfUBcC(_*UC_VRbPBL$Ines&p0C$Bus_Qa!K+uvXi7aWC0kgkLBS}E> z5aCq;2UyyTS+2tbU=TBi@PalMYNacJgbfA2p~?)MQ6jiV>M%l7ZOyPT1vNpIj~p>> z6yqClju=^r4iA$u>A--LgPB%7GZ)7C?4e8BJM*Kv)G?l1l)1M?Ht>kpkFCC8#15M% zMQIw5=PIWPC^-RF&N#%=jzVP<;>9+neUuC*ql4HFR0l#8U{k5VimD;i=Kx!Vj+7!j ziMh03)bxqr)%eD2Ml9)-8%|f-6<*3v#j%18Sk9IWCEgD#_`94vz6q;1(T1tg8LEE_ zlAM9gE}|rRCdewCj}y;)5zxTdP+#pP;A)HJ#~Op{l0t$(p2_+Y`a{|X=9}Z~;nYOu zBO1jMl_#_yx+lM*(JeHm;3H_|T_94mp8qSTI7{*B#p?)^Xbn2s2rBE=kobZ;Y+t!~ zk(0nl8RaiMg?P$`aOM%Cz??`Jba>}Ro=`@=$H+SlhP@Na5ORW?L~x2eXPiGy8x}xE z5wy6gQRdEem2%9FQh&aAEEIvqW5J+7-l;;p$gitA#w>d<{t__FJ!)uKEmWEE zEY*9_wy~sT6>XimD1c3POxzsPuU5wYRls9FR$sdW(QfiExHw9^>cm&X#bA*!V*cXA zvMy@>dWH|T*ddIAWM24lB!}1oGy~|tVMzR%UBKyPhO$9&TcKi^T(~?IDYNp)Y8_*y zrZFPIt)g%&mbmc=$t7awzT!X$`bO5vS#kaXylt%g?#>;qfOoqS2_w^t@%(fCbe}&b zVxO|?7tZrZgUl8 zN5$Q#T3tp@T}9u+#f}7|-k;|>n;bEy7?J0Iz&cjNBC58QrB{W-w^h-wk$EJlVE9$6 zqHh|QpPik(XYC9O<=KG!dqQJM4qS!V`dLT~ZS?~0>3w`UhC{eLSY>L9xCl22IbqD? z-t4GMGL5wf?p`QNYa3b>JEzMxvd!I$QsoI9-`6;05U9?Cr^~D|?e;vGnazMcC32^y z;ehc~frl?xR>+X#1Yv$r9(rIS^VJI^>Xu>|qe6Bc!---N%v0B8EyxiNtW4^#dwEgm zo6DX0roe<9QU@C60{OKarK0q^+gmA3%i!?iP)yDye1ZylnqDV4(B6^ZX76%PnY(i& z6Jrx-9%GHgvWW@U8AP8@3!NzI*3RInhD@_^U2I0hu8$48uE^#(9S;B*Y2JPCnISd^lyB+P`-%e$eZo=5HTG$Wn z+&tjqNJ&OAaQHEsJgE|YeAqkGXCEkME}XWo{MZ#1Q!L(mfMC=JqBzX^3O}!fhfF~w z98nIU`v%;u9l|FVxU38f+Nf|#2HBWStTGo12M?1XC-FGy2spM%ULo1BnvagZcj62R zdnk6TB^=0^Z}tkpX9l*}YOmvM1{M7_!d1)$_KUs6S=ZYsK0e;&b0TM&0QgVzy6XUK z%%M`ciSU}f9CN{O5LI)*>`znBW}WjqwmN{X?vT8|$6K!tRQSmD)=5M`LG-Ng7$aDH z1mr-Gu(iB*i})MTr$KKoZXcO=7Q_hSy5kVb4M{5nY=9=@=xNM$g&LOmEv-upg50ej>P-STmv;!jUetk%N*xj^xx453*%g?0R zUX8=nXACu<=ll}Wy<|r_jp8!}R0rDUaa)H@sL$azvS!zI_Ybin;b0gXl<%zAEHcjj zjXl|&--?mbc8SZWt(BsuiC*U|gQmcRPP@KK#v<)b0~Hot0!@qD--3oXuI ztp}YTLR&R_xd2hcmzk(%t>ltcIa01++%wd@&`j$c+Fp%o`RK#mTg^GEGN`yk(sq^h zIJ5BmNq8ADKk@e2`xB3%Zh`g>6NmvI);j_eMKcpM$kt5oios?ln@t55WQxgC#yg;q z7^P-;j1^-|B{7vaL5Z@-02T}eq_B%&YjCm{0of$xSf_~&)9WdS$}aL>FYoRjTbt1_ zjItw$3zfG=+N{%QxAVMFlt6_;GUr6mH0E%c579FGiU1^XZE;)skw~$sV`?vgRN;Ha zw`!*%_5!1NE>col$-EeFwIF?18TA)Vv&+#x!WM@__H#c90Fq5i%>dXa-XK2h!eP4k zR>u^XxNZp|w7;m@0nQ;=H`kULiNiF6jN2j_6;a04u;4UJN2!-;A7CxN?R~|M*DY3y zwsNRpPM*Y@Nrc!7BDezeH_9O_0dI{&a}b{lRE-APp@#gRV_Q3&_)6TP zeuZ{51*GmcjsrW6VRtIY%MubJ+1&lA94Pa{>DhK`Fs1-%W4wdDVH5sMr zcjZ~O%{6699@GpCPJ~O^TSX8gB53(zvo!P~u)l&z%q&9hwF$#ZY(I4Sl3Z>EFH!-NqyRIQFW;o2)* z4h?*PjrA`+jhoIYq^UZQ&=}%}fUKhaBg0pWx|-5720v`U6KTrje4s$DJ^|aT`%smp zkPE+DH5luGUF6#y2hLVsH@*$$BzLj8tKh~u!W^Q2xUg%o$_eb!B#abJugCx77W`OZ zKoIcywl>|#Rb_PYiU|?IaCR{czASQ_cs7l1(~|M=QRi`qd_{7%)i-ua^doUBAU|=0 z^IX(h*T!I5KyJE2HJ!OYon5legr_zK{dY26;L8Z8!b*5_VhCeX4|;~VA<(yTANdAMOJJBnvP4wi zK^-|V5jCy68*&@Y8A}wwOw-7y$y?Vb+oP3{$H~uQAc;S+lsanTK7zJWWK)*%y(ta&v z^ZLY}jNy5fp680%_Z$E7(lgn7*%A{**8T4M_r}}bwzwvUzmc^TDrD9Rh7XRJiYC!l z;Hv`0@cbJzjuJ4v;ovP6?xK!Zgg8f73k z+l+M=n4K67H<3UU?|_(YuWjse`h<8Fj>;MglIz>2-7_2E303TLcS9z#+b%GOCi@qS zSOP_&EQq=V9X7jhJ=Szp&S&jZ$?EFOY+mO*5Dpbp=ng3|fC?#|v?MiZjfpiqcj89=q~^_nbMXAHA~? z|KkkD28rC6K)*3 ztBzITt)@HOM=~wM#&fVHYj8cT<%kM`amPNz*i>uD6R~+ZKw6lK5cAzDDsk8CDYjh% zxfho?<=qQQ`$+L8d6YT!sD9OmUM)HKTwYiS#{}I-P_}d(TNlz|`~bcVrXi>U{FviQ zS>|`j>e)I|9|G%k+t73f9<>xT?er+L99eFMR@TS_!APj}4U1&9AfBxTZ*=Jjw7mni zyH=s4qcf{`mQoZqN}L)zA^lydce#=L&(fR@fHGk_O}>nR#);|nN~7ZixEEwkEVBa@ zLi^t}F?o}JGb2n#$oD4mmlx2bckFRWGWEf1BKJ%u-w{ouzXM#w(aF;^G6T&5Mw{!1 zmeMXNvw`kkS_?Qj+ZVVrW4L4t&qm-{p7|YGLO^0sN!*>zso3{ggSDo>p zSXnC)vVzDhp8w&z+&RXSvY}#F($3O#Ah;Qj>HKc`h=NIy((fIs+Z+TqE3R9r zj&eWcy6C6@M9N8>f*UGIj2Vp!k!7TdrEeLu(e9n-Zl0?s9a^gNq6BB*^P8TT!mN0FTl9?Ak1pGnkr(GxBb~G2dy%6&!9W^TfBH3? zI`6wRgK~irqv_vbk3fl`cWM|)uTH91vZNafRUQ!)NdO_3rgq&DN@hh}A;_9zyxzBf zK^^6pBcM3)AVY_kepegq8cEpg;t(W|43+wSDLzZ@Pt9(P#pGI8f(DauozMz6ucEfn zU5=2O&`5ARBvY68YDdn~1|zbC@9{XT0MNqBGlI;H6`N_==ndB`Rj8E>RtxeBzAy)4 zy~o2+h_?^xW23{;dArtl5{NvW*iWRcU(T_l3Cgymx6rCi0i7RC3k8ewDfmrzVFSVerd5m0R*4@?>P*C~zsFU5V?Nzs9l zVWKzcIf1FbMIi9V4-0@-@c_|xwcOYDna~Me z&b%lVfkDLfh#`XsI0hw5idQgM0jzASQ2ZaCVNME84zT5H$WB{j;7>D#lk=mg(sNxg_FB!_Y0>G3yM-yW)(n3l z1ipm$)2LB3uf3$M2ysn&S>@>}3ylv)i*!l|ASJGbU>X8;9v@;kTje$7-RUF$OYBqy zGv%-N60?%Mj?-dkc-Q+xP4KvL`o4BD&yTONy}4kLJ@`IS+nvw%;7WqLKv$!Ih;6yV zk!lX}wS=G$#xhI}AH0!7R~nxp-y674r`t6^i}AV2>$X%GbJ*UEc)Zu6WyvJ&&2GDm z=oKpjRYv%9tYhyT@~#{z+lim@{SlDC^&D`CLPx_4`61=OSFTAALH6AAbV9YC!wJ5(im()J+SQ2s3CMY zH}gGmA}TsQMd?ZZ*uD~gV~;2O2qw(y7qGjP6|Wcc#B}a5yF6bLn!acCnW@>o$k=L< zi&KEZesInglU$uQkHM3$K-rnWu%1OSxVeE@Bl%RmFq~ez(%0Z4qSZ^W#~yIvwKiN- zQ|g=xwJR8FoCEjeT7N!({by=Xjy7$O4E@cHuFle4H3`HR;V&yGSsW{sn^urH^Sta0 zwsL@QSXvz)JQ2^R$FSlg8Fa>q9@L&oK9Go4Vq&Z#wkj<*|3q6U#!M9fm@fa4tu@v;dV zH-3vwQ67d7Q|pViu?KMrYrNXJeD)Y#N48oEcHhYOwDw$ZW;nyzfk1MAw z580y&1y^HD)n(jh+bZIzawC@88$06=WV&NFtqZjI-CFdsn~CdTjC4NUwqYkLV`di* zO?DBTW?CkSWXH#OdJufgfuu-luQ|EY;U)MXiTeTZ$0ot_aW_?;SL1zhbR+#%Dt2Tu zmg=1CE4ES3I(?4MO9d12MLP$`?GPBiDgJ|=#1F0Y+*l?4a#aV^#AkdNJrv83=}7CP zl*JBRp*<$CicfOUJ0qy!WVy*I5#VGrahy4*YI5Kmv|?{IPmwCcgdnE44eu-6SXOz~ zZ1-%`pxJxmE_SqIf=Y{wbFg`V1yvE;V`0Paf6HW7Pg>|Z>5w(nP?g)39u_{9abEIO z4@Ku^bdt4ZK(PdHPv{F;OFcuJhrSOxhbDm)n2;vQ zdxu@G9n$-FhG4;V0doiMTG)P-c|u*)G56@yjLF1WFee(z4IR5!tYzmq#iJu`Kf$`H z0ISAoyhob{2$NRCmdwb?c7t55jJ?`A6&78px6iVON_W-XZ(Jn~BppZ3fUqvRmcB5X zZF>h5Oa>G=bbPWYEXDyl3!PLhO2Epr4Wp{hZXP%&c6Z-foC}t9_37sr4re-v?HV@^ zB8#c^=MwkNjYs~E|84%C-p@b(@yI=!2j8bB@ZfCow~pDKv6owrHTIriQ@cj2G9Se> z$qu`T@Gf#>lYc>Xx4VRJZoFj_0BJvC2rk(_Rp_j3EU?%41qW`zXm;Q|zkYD>`OLu| zeNo1>uSM~}hJ_6p2va^uNR_uqg1A-q%*BiGd@zWTR+{<+s*c;f2kKVGLo_vaTs z`1;GgSD&wb@sof1hoANE<Wpw$3f4W z+Wh(p-+%qZPhS1KPrv^17k~2f_kZ&JFLC8hp7{LLr+@#=Z+xWJT@v)Da59!+05E*q z9{0$ubGQm~YGxwWXtE`COK2OO{fb0!a_44aESt`B4eu>jg;*XTbl%-Xj*+^d`r;>u?#uBOjEY~;@1 zS3!GWFStk(HqeA%>lo;hEypBj&pc<5A7p2|e6FD&TkCN9!Kn#npv-+=4zuA0Vd#4S z>1kd_*apM930Gv;B>6@D!{UM*yq$0%hPP0LMOYbSfRv#yJb-dq7F*$9;!-%-VZ3zn{*M?b>vHMf5lH<}boOm+1dNGC{=2u() zEF<%o^hHL~PxAL*>@1Gb;!MnE-T?0>Pk&(=6Zk)u*e#!>_Zc7NWsHsNjf^t?|0()g z%!_iGKEvNH^4{-Pues{!jLIvt>Qj6_SVd)c9DSF8(kIB=`Tb@Q4fiCyr61ioKf}W+ zw`O1SLi+R+f6JpP6Qpw%hET4R>oxq6^zS9+wk ze~-1}xYf8TdnIeOP3_NIFuU0W`q?nw(w7gUcb~C;eD9ihcEJ%!-<44N@iJ_r{?2@5 zP1#FkKJy~eYu*bF=x2C>Y_uQXQ_W%Ngu!Afk7)Oc=f0TvclK?iC%R4&=cs7D z=iz))hgR1?(o=i5_t~5fJ+Al3^-bEwdDDJVr*+qR>ENeEUwA&3)is={%}*R8JsnZa zjbF-_TwiB=a|$-?uW_iOw>f2-YsS0$wLaGo-W<2h2S$TO<=kp7;1#@=*VTdD)vxFC zWDdfn`*l4BYG+Km_qjBz4ua>;G~4h0AcMmx=X{>}SO;^bUv+l2zt&;dHA>Y&#_$_? z1%Hn5^m-mn*Z4qZc_yv>lRTfx_>$**b&LrE#W#G<%>E$rIQ218<~TDrbc9p9za5ca zqDQ~#70&*%8KoNA@yxG(VvNri6R+n={!K3;Gxn?If-}l_BjdyOb%r?K^Eqe4_juO4 zbEY}p(-@xrN9f7GryR=lq}W7i~u+CSY)rp zvqq^tSDS0B{vhK?tLP5jr(Zp)Jel^;g}Oe?b8LAjD;cOZ zvv$(pn)ijQPGeXv;t7ZZPpcE>851U`8ac+f-qLcy^(6x|Yz(RIo!UcRIIX_=&U4ac zyIgvs?w#b5(XLg`DDe~jV_<8(cnI&RKC(_rX1<=6@@jsHs5oMEC2ipQS|i-WpwSmz z%DC~lo>TJAjkJgVF%&eQ{^Z`e=Fc+w)ds%g36u8VrGMVC=VN&SPiB;uM|#aITwD#K z7xZX)K8>#x^n=AX_-f>&exmU;*FH8gvskhg7R!^&KyuE~(mW;LL+nE&Z;sf6g z{m_5bT<{a`dNdQwXXJ!2uRs$fs8*-M&H}V8pxtZRaw95dzh4Y$KY80E>D1&nfJh_%{5^L zhh?_rbxOZzd1e=ReK;vNHSm+qQ}S`p=U;F4l2BKfx8>=x06wGqg|Q zdzhWMSH5Yk(W{32o4;VB<~c9)^)hsSELX{I{c&16`uNmqU+vEy;@+>M7axH$n*RAu z-b;J(T-qkzc8|$dZFN6iPH?!;?SIB}Fk?Rzesf0#zH!@I?BCoe|8#x-VeWk7wc^VD zuC2_Q!&v>=w|-3jX@jG~JaJWxLa~^C%Q4`Wx;Gr%KmKH{cRsqEVe@uo@|-;T`Fwr` zX6|RX>S_K-|N1#$GcQhaewRVJ=JAR2y?*_kbJSz<9s2f2&%3=J^XP1T^vBhHzRx>t zgZ$o%58w1$^fgbx`b}$c-FM+*Z^m)v(J`s{l2Luki;|ad;hEp%(>vUkR~JRDV{@++B@HB1CWd1vBzojf7PKy)UVsgY(eoxxqjT?TKCN9wNeFLKNU;16Qv z=stpB{=s97(5Ob50a0l`UJL4o&=ykPTVsBC4lkbE)X{(n|16SfyOhJ zi5mmnIqjKT%h2N4sfl0@nv*-p30@p9Sx`ochA*i8NTJ`nEIVuaySJOeJxwg_zyg89 z#B`d}09n}kph;%(O?=wz1e}<9iF=G>D|wRUEzx~9Mj4#pd{drqM23+ea5cXJK!8~j z#)|(vL|~1oY7%h7@26axQA@!20pb!QpOGa>#xFzVyiP~7`$sb(44OfzMMa$iF->ed ziP7WB7@#SK?UaPLjQ6csA7cb~N(G%EpKuG!1eJ1rcNuT8Ae50)km?|d7I+rx!&xUT zoK*R2kkMp?HMqfG{rdiZ{g#kVuwk09Tw?q-(i#F{COK}05jOPaZ%Fib~52!ZHU zvBLDqOhtGTjUt zD-G@9l8VNg(`CRbt=G^!W74}RqF;anJmYb-Rlw4S&faHgVoFCs!?6f(=jxGd&!R;M z@NA)91H*)j_HhT20|BJqX%l*1G-KBH#8uTP4H9vZ%#e0K{O%!@u3VOo@5B8$2=b2> zFr(AZYdKnBsLtgojnXcy?6x?tn157CN?s9F@3qqP^R`Qs}k!FGJZneV*AKuz;p!FTBO>a&ZGAN@9eiGY48k z%SdwVUpcY5d(Y7$4;?0Teg3`&Nh=;+)T3mb7DqiJcaBp4xS16Y*sqJpM zsNhqh#@?SroYi5>KCO6JD*I*&3gd|M)?U(xk)f*deD2v(NrZjKMKYa!|&!fZ98G;Vb8aZUC+)*q*ed8L$*mIKfGE zdX>DY7dbebxH{JW2M~9BfA&oKGk^^u2o}26)O?_I{T{c&@B+yR0Puyby6N&OKs3u{ zqC(~iZGUw3);e;bA21j?a~(CVpo0q6&q7@AS)5z|;1RwFIHV#We>^5{Gq9Qoh6GM# z_wWFeJaBoNEMKNKmFI<6^Z~BM3BMl9ck*Y<{a}inofa%n0$K0@bVw=?nL6wGI3{om z{6fQm(K%NHE1*SuPZF53`eV6sfEPzG7z%%Fxy+;f?7+s5S71P8X#{aM13ZeLNyle;YaHVDJByF|YY)&`z-A@mb2 zj8el*=g`C3Rq&MttxPjrV0u_ZX2B`?1b(FgpcR!xrTQR`ti@YI0?qi5IxRpWf-bWC zfC#Z70?1QJA|}X>`PS0gogA$svPc6)7)2%gzT1|X#OPYFCV*SCVzaePP&(RnFEF#c zD@~PcYIe$FS8Y%~z#Lr;#nIRIiX~OCi$JUa zyNIGwkhrYvS=zRwC!ka;qB?g5cEtsIA3B#a>CfYJq!tZ{$G`>_r0fVp$y-FC*c@iK zc>HSrZ#;ZTmpQ^Z_c*5r4(+D}qua9s2WRht+~mII6+-2)%qE4hR4_!fUGLKQ4{NHB zno*sM!6XU+STSYT4Z9bX2n1PzQ$Z_R0qD#ErLZ=)mkV?c(bK8=1fw>9XFx0Hg-H(F z4xK2bqX3X&+(3bC&2Q>zMUgJxuMs`%M>jwg6H?PiE)Brgu{`?dX?`6R@uAza;}`Br zt&dL|7|mi;hj4~Dx6e6y}Fq-A^a1nEIMR|0-IYDsg%8?9}pdjwCYlS!PX}Q9Bb6 z0d^o?$@1W77}rzD*N|&w9L?&Ihl|iiy zb%;Wn-BzBV(wj7g`RQtUR*BNfaMvoa3m!S0R@bpeZI3QFP#9)|=1Q`S!Jn6cwvJPT zXkaE|L3@fqbL-G!UbIe){Zy+n2mFhHIKnf9lR`DQWE*2x&M zgmtm4JNlBqq7wtRX`%4Z7;1Q`?6w7VY^Kg-RaH9N?S|L&Q1z6+prPt2GFq3+R9e{( z&yu$(7N8UOG5CZ06SVHDa(;Xauxm?!8URa^vN z-0{`RIk*Z`Awqs+xxyB!eL=PpkX98Z1XD_R``xh1S#zR0k+6cg4*DsY+-uj@aZ<8Dz6#Im?=Dp`Q?695o%5?< zmj4u3l_%o(&@!dop<>ir+kul!C25DeXKAwNcVRZEZmvq45{hN3Chp4={n`fe3n{=J zhj3s(a|D9J;Gk?2g;$N#at#Yr+*%p<6e;J%_SYsr`E!quaH1>Ho_M+DF-7 ziRhDF0BY*mjl)p-U~+C9c;CaE7Fcv0R_h72er%~G=gTw(+aiu$yR!_fZ?;`$VpHM78_t{7tUK$FWILGL~IGF-^BR$u4?s~n{0#xrfj!{#+ zztmn{0@e4NTW1v3XLkTC1r-XVE>%ZRwZ8iG?fPTqO8#3MUVr&mSiIB}*ztj)a*7C? zbtvdYfm%c|{SlmIk#&&}S+WVxkn0>{NQIsX=O%25t(`kDmSL;8VSNLa6jfF$2i^fZ zu*y+jauC|aR41O~eOYwFpBM?1@(~!AV6)qgS!M)b6`Wi)BCO0xT~nTk!%ZgudY~{mQ9ddiyQ>uUMN#YGnKu;lMjNa!nfOw+=2Z%Qa-` z)CeOTICafPoS=^B!PzO25LYZRxF*(f&5m>IJz|4NvZ4D)vaC+@7e?)_dHcx|H$*Z> zXl?G_0MCFM!0_r|e_(GL*&@O!OEj76Xef|!<{l8#J}5;|bVSQ>Z7R%ga-}jw>|ofz ztFx7B0_bjLIkq*U%iAckOzjZoG-js#D!(mld(8V<8okz?o?R2HC_0J3%fG}m&srTB z42VlMu9yK_#Iea#jU!Qb0ixqfjmC@`$%+CUKD<2kcY)(4WfzG>Z%iA5$rXcCQn%Lr zsj@KXQdoCPpAhL+e8S%rMoa~-rb=3dcVvr-x106Xc1)f;&DgTEGApQym>6tAoWHRo zFDolmjivdmHoiu$tLb$znoF<(7$ddPN>T;IOt&5=n<4KStW#*7<#fd1rL*7&jJ%_x zF=aSj&+(Ux5bPEO&DY-iVGSZ?&~i{BAb0-xx# zNU}!7`gDp5wjk0|`fhV??cS8s_R^u}qz0Sj%s;Z-p4?t;c^6dtDgw{p_ zt)PZ5K{!@v_^T(cc}$<1*bYtAp^dzY3A%*}8)n4_;AgvM=d`Vf0T_6|o?!9uw5dG# zWFkmYaJB-& zAsmmvXu6nz-DEwK#v~rEJ3r#YXFG;tgkx7nmH)ixWLuIgCIG)F^@n^gy ztWAk&Wv#>nx6GTi_r|Rkb4|2?R@>Zh6rZhLXt$1~_wv_~tySP1*M#5V?qGcOOykKq z%6%XDgn(%3YMzmU5{6@@O_FaCUt^PlE)xGOi+uEfHX$C@*df8>lU5S!R%019ptrVmFT~iC7CZ&<7^0s1?hfrDEE> z=%?VKW`)Yc8xDNgG4X{q_qO7&q<7B1uTJ{Ect47D7}AWF!L9Yp86LtT5y#mI(Cg_ zca&JSDLw!H?HyZVA1i^m#x6&H8(&C_g;`Pe;Ab%l%HT)?7uyq&JFPg~OZt!zbeBnv z{5Rl@olS1JHpz&AVDFNkh|3iomE1RZvI`)}jgaIK#2Y*syn*JF1d-+=JOIRn_)BZ= z>#pfLuG}I{s)B^Ai3dfNI>=Y2s?Xbh#C#LvbB&{i=0i2n&RfeMhhTb?)cV<0vTd~2*t0p7G$iVKN6(>OhIb_25)xT9g)x@w9XZ?974Vyyr>Y#r z@5CyMP6Y18y5-gd-Uxl|!3bl<8qLAc8qVlLcies}zUkej;Svi=Jh75;?0+DM>J+;9 z|5x0($Jtqx_x|0PNeGkRP5`x94s6CtGBugW1}fw>WG6GQr%fQ1AofCG$RrR5B+X0= zsagjo!R&)U`IIWX0#b{Yatc;M@N!H-4~T6s;76tHX-VuU7CG(F)>cB5Ip5#&to6R@ z-80z!b9x4{_uB8f?(134dhTn?D64!vO9~TwD0iTEjV%}@=L8Zk0Wup#pPA7AF|wU4B4q8W|{V zoM$a;{~=bvE0tMW6SRk}r}R@)Or`Jv+s}1rHjWY`Z-kyuHrr#{Hs>_0w7REo`1S>iXL8R#QD0(gz-WL821CTOW!^JkM~x4Q!DQVV#Z_6f zBAQVIq0@u$w0A6E^OBz{3rpLdbvC__w@xFh24HWdKz^~co@qx}FHG34A@mu|9X+?h zjA3jf6G@fWz7wB(gFO8z;^tsKX_V*Y&70rT)!S8?UghNU(nT*xgfN-xkwOo{{3bbKi!esF&+uc%Eu1W50WJXM2tR*nugG3W- zgx32@EOc1Ea0-HKb^91Ct1!Db>KXW@+5leZC3(-HAn}zQj&epeM(Re;Bz;8Q5!y_& zvE(%3*ASKBNeXKelw1hm1==&J#Gt z_MbJVUfVk43hAVu?3qI3ZZknQIUPatqBsrDYdTEk4zwz5nmXw@p$@H1UBVXZErY#9 zPEiXTP@UndD6tP$AFk}a38QN2^uw8)+cpmkEh5k}Lo-I6cXAdF+G%T#_PLFZP!I8J zWLkL!edbh=I&HW(bdMp8cdP@gq}ENpRJ30h-(Q=q`2 z*hEfIIh(muED*SlFBs||Jaz$7`2Y~`~CHDEUZm0jkA?%uMCH{Ryt~ZuG6}j2=(Hpj1rvV^1e$oJp8q7UMcO+10(SMJh~#92U{X}=T^0N-c)(eYxIufL)Y;ET?)gQa)! z@|I7%ys_o`op_~F@^|gIe97C&DFQ%IC*IYc#*bT`?D*uTEzl-j;5?PbII#-smpr`9 z+nsX3+dZ^!A3cyiI9~7;9Uw**kSBXSB5HbsI@4GH_`^pZc)Z0Gfkg2f)N92xcqsUo zlgFO9m%cpCEmlNm`?KVh7ru|+vqyj3yxZ|n*BFAYzDg=aMKVjgr8SFC!N|#ZuX(V? z@ySzvKQ*gu){Z*Wvk6MPk6$6mf&ASqkNLQh_tP4!JlE+DGnBSK`E({&Ti*V$`PheY zs)=Wsk$Wt+y!5|t^g($6;Tv=-{y=~97p*)cPbl*c;>kYz;`RlfH2kULOXOZo_6{$z z@a`e=JNg6FCyyq4kK98}en$6^=K#;{HLs)S#pV7~_$N_Q^jwoqRG!oNb^kMe5WK4H zGmoX{_aq;`Kct*{$lXUj0dKV2SIeH@0~XrDpNsUvUZ>6EC;4=b zKlKqWxX_;aqv4&%+mE}i9er~@GL7NmwCBB+&zI_Vf42L`TfDnJ9Rn@lImdf1cR#aa z{(xArpp9MTF|~FOBg+Cp#gi!B^b!ty6i7O@;%S#$DJ*mvu3s_Q7us9sP6#bTEtk&a z-Nl7@E6zsiqoc8Awz+T=x~c%dGW7qMj<;u!J%?M)|B|AZk9mHX-_eMVJ0b51w<%bK5 z861zu32qim55HJdIE@l9f-%n}(YEoT3BT5}yu_*o!$T+iyZd{}TDas~Rj=~#a)Iy- zTiPUueecm+y~}CmWlNS1CU;~&DA@U%3uSA)Wo3ts*@QbPS$z>|GEtdAPzK3!6tpMm zH+2#)OKc0e3%?DUScsND>DW)V63p*DbB-++OLCQZI_8SYT-h9ZWvpy;Ne_9V(B!=jZ{RV!*k5)}pwmsxl~?&j3X#aNlM zn-N+0g>+FK;vC`{*LNV=Tn}N1{jpg^X-L+M;`&lW{|jm`XPb!_%Mg;gyyZ}3sv6%b zg}Ipx(8P`fO?fG1BHKo`-OPmu+!S|RxZpsnj%qFQy=LE)Y#ujc0i2MkLBzeM2aS9o z*73ED!-dF{F^MQut2%&L6d9!jlt-` z+y(9@s^y#dH(vlfc^5K`okZeg4 z9oYa_QD^6j9#^}XxZ&-&sLp&M3+XFD3{8224KYrz39ttdL`8ZzzCpTb5spLm zYjSF)C@5^_I3mm+wy(#A5W8DVkO3h_j_{aj_8T$mvH-v|%6{250uUyL(0SMjUCT8c z2;_;-@E6ZCi%414ao=_(o@rCXqP#J z21;TXgVkx}m)0nByqlo9PbbD?=7k)o0d0-s&K-|@SX<~Z5qs1I+rVUb#M>*5RAcdM z$)fQWN}0kR6~NtO;XVi$@<$d_gh(SX%7@}_5MjfEmJmaO@E{(4gV-ZPt>Kdh8w9r@ zT!}~UAafqu#ABp*hz}xlSaH=%W&(QfmRBDRVN6u5Ri$h+$6JDdJP^X>gtrH*k{Ai3 z)GH#Nc<2~9PXG`CE9F5&JkANRL1@>bsaVJn4UMi6=Y%5u+rX9CIWK}hndh$uxVpEst6pd}2=tNoPXr6_6&{h=Uly&HV` z9Fia~3o%>#Eh8e~!=wmPO;tXz%%r#LE11rtchW-HXa@NIw`>R=^2Ni#P@E!ENc}YD z@oMO*PaS1x=(l69yj_p+LfjSaJfV{qCbco2v`CuzdF5fRsGQF4vzmb!s&&XAGnF$0 zatm_%y`YfkGD%a8Q_pK{bUrsZLweOw$1<>K0qLrG*$T= z0$?mXnSDeLSehqysWYm|qk%CS^q(4h5t$#lkq-el@$tr)ROfvyDB|@~{C;aXpE@ch z?NjFqL>?MqiX31l3p{u|4)#2us|?&1h4DII085OB>7`eU3&>%NzRTz^)v`to%-#fV zsf5hlZTi6cd&j7UCMX4vuol1)W64*6SJowEVEOK~E#Rx*{iL{qAKf4)`FYO9v8wcw zUQy61WNGe-Q%axd8{P2MnH(n5y9BJ-LzN;AKfPv;?L$G&93eJ94&x;QosUzeY;=Yi zm@Z!JGl2J*WFGkG%g1ccc_xS1Cja|)jE=q~y<=msFml4j7(1N&4jOgyK9Xfjnc(hP zf%cQrMBFDw6YOWsafEAo+qmMf;4|8bHrA@@<>vd1H{_@0!btH%&a{oB6>)32gXnXc zGeUu7$EdEvAW9~R(>=$79rVi(f|h92!am8!p=HSRiFs?v4?E~qyInHwDv;e+8O3`Y zBUQb^B(b_9jec$1w9+l`3L~dB&aX>G8|i&xd03awe;9HzpIeJ8dJ~>k;Se--2;!?5vd~%kBGOGVH z6pmOo?y>EKIF+f=0RFz1wk&jqt~`WFZT0S7HT!{0Azr-#2fcfY+oP^|x90EN@5C-G zWepQ9(I&0TDR%c4D`9pXqlGieHRj}WnQNV{h*#Q3p%|SPv6n2cpP4j8vOfrv2aEijx!^-fa%&d)ru$+2YYhSJF*6xS#C`C zK0Rm?D7J4TTvv*lLd^NwB?e~n;z{=&&`IQWCqXEOBsX%S-EHWtu$_zekc*A53V?)( z2%kVE3Zh_J*fui~8bpfR#W<)dC3k=kdrOfUPC=eoU)oPf+64@e? z_`Hauuym>0(TODAu*kATam-xY{!+`=C0g~$FCmYXAq+#|Hf?~@0);uCTejyS(Usi| zU7Clv!ltc6oIivLwu3`I z7j2ixAv5%G+Qungtyk_&r3-x^Vtx=D4Uge8 z5RSSY%`{|MAv-TDUXoB?%7MsA)+t-JL~R|-%50KGf-h}kIdT9Fa8sCIM&potKjd4i z+hmHPebF^7pAU2ma?2HsWzxq{TkPBwiWLk(+d_G!&@84lBgS4 z^g{*50y-5paw&-}-!#3G4Q|)A#n8N{?1T^~GhkN=lR|(hrhHMj_0y}{v1J?f>A|6y zOzdQzpfY0x*JjL@>+QI)G&hJX_I?q0Qpc`NIn+Z1{)ifud^flgyUWXYh*|YUeDn;X zQA~P^D8ODed<~1reqW9zxr~H0-R2B{^Q`Q;-id{$xOnGEU8T1C`r(_|@7Ih5c|u>k zw@^_n4mO`IY)<6deL?e=$TwW4DJ;L(0+Foj2A{ukc;oKcdLUurZXJJ{7Iwes+%@5} zlOx-LDSht0)Y&6fxyic#&LrmqomM)>kMfiwuykOdkO~ZsEkhMSbSemdoFJL9_qz(L z6sU>OsS}h^Pcj&M61ALqY?eR3) z{3x7?%M++BTVRu_fKKJH!xk|i6OEPqwnb=genn$OZcmk0sl#)ME6f}+M^924HHR^z z+cA=yz-l}YRlaI{8k;=bizsK8-pt&mg=)c!@P5bi8Is%pEUvLM^bJ{bambdUH!lM4*<)4S|Tp;BDW-nUZHx8VBA=? z7F9*;ujGbvt^2T>A{SwLIn>(w+)l{W#tQpl38Dy(0#RbBR}SK>I~CJ+>+X{CrAc3q zCW#2QNNOIQ8c>5yVrEz#AL^Q+M$N@d7s13_gB^{=Usg7A+|a^~(NGf^0<tc_a1C_Y*g*TQdz)r{qfYgj->qWW{GBC;W)@>?U5aM@uG zHg3`}oT}PIkeT;M?o9$3I|gL*&~z${8Do z1JmpyfHvqh{DSoWt4~Qem4kDLgGogq=|Y5ZSR)gl8qF2Ot@zI1C?o3i=YlVG9u`=e z3hGYL$DvmH%bHa~H0Mn;PRFWxF1 z?41$|mDSsXc^T0_h@Ll^;xTu*PD}y=WDb?=rZuj0?n4O}VqP!j4=fgg;TD>6FbRhT zI+r5uyYUHS?_brEiw<%=Ge4OC<4rgBZoh83d2mo=;TtuDP3m%mzM^BAp%*pd70g~T z6cKpcu-}7}7V8R#w_r?|Q-?7SR6)mYNIe`Dsn3HUmVitn74W)ed5%}*M<@pe_dyAQ z5jS_ULp6whJi@#LPnc3wg1S_dyXTODegRwT+f1&jr@3Sp8LIA#`;zRwk(qgr4GG@DrE!cI3)>Y@j)S`R+{9ZF}U3TA}3!`Z34<$^_t5zi$ zMoxV@=?Bfu{xc?dmaJDd+qpG6w-C|?jaN6!$%5a;9`d*yetcp#s_|aZXtQ5G`XS3N zYkx_Fx%tpk)vm&JyAF&z3=<_aMbc6}GkJgVIrJwKAp#Fi&kKr>$Khewc9IFPhF;O-;rI}3f@PwJf(!+-dI58aZP!J0fva#ZR zftvTnK@0N2nTabd06^aPq{LiJbX7`wCh;%Ixq=XUIbjsm;Ou zWA=n`4Q@#>?;Vxj)fGMc)g*mj?~iGoMTtN>_B?M0##7F}wTfOP4O~yIHaX8^E$GHMWom9A{Q{O5+&Fe(K2#9E5|x*n?At5}v2B}VEK`=IRnv4GZcsSYmFK^~XL zxni@?svx26rt;$@f-DSs>eANm>1~&2MMZ^(wIGPsf}YSR(;u2c}o{E;$hQ4KuP-T9%Cin4MA3SE!LI5ndrZSRWM$y z5X{7u%J6NPF6Y#8&sYTmatV8IIJbCV@V03P1Cg@E-<1Xaxm-kU-eIEK`$WMulVwSj za-j=hj{8eZ=BKs z?iYI;1{Y*=fdiXL9yR2wOAue>aI=KpgvJ_07*`zB}RZ5MN_Ul zq3?y#O?F0678;f|cY}#2Ytx9w5Z;>0g2)+6nV3-7VhOP2G==2Qqp60vE`bj(*2|`_ zaMAIJX7qU4c+3vPJa(Coi)nJft;U#xoLo~J_Um?!N{A4T0eVb_bu}14J&51w(3i`m zIM9(fC_wYV2rn4C1?8xr0s4nf>YCt4DKVFWU@qsvR!%-=IYq+NQ7232D;Ww&wz?tJ?e??TAb4 zYh`BHhNR8(a;l!~9g7u5c7UC3Tq4WM@7`!KvLNpwE;tQTdBA9bHjyfK?-F?36917H3c9(XN8wM*LoH^jPd8nIxI@ROOYIlxG z2WuuOaW9Dfh&Vd#)l~i)wAwm3h&7Jk6qXl>-_RYeu&(FH(#;zq%>jO2Lh3&>%VSV;VJR+#5uMv88g@67Oecd?1|kHl=P*_}HBC z%iM7#Er5e3=`lhT22(-!kj@ac!*@K zSYMy3A_{gSJJ1or7q%@C)`ewjAQ|_V4UQWnnBkE6W@b2T<`CwEf_puBtlYlRs8V-S zHhN{(7HpU{?J#Y+#v!L?&7a|yw#L0H(ect57r#FYoB-0>Vl=kYLTHM&ZP%{PwT{}7 zX2YKx5LzS@gd5`w2xKA1vfKF@C!f}jliOP5IRjXuh;H;^pm5tg|1uQ*>g0+ z!+Gi>=n-xqT8Xi++~p zQCIO98{7Nnubx>voFK20{O*1vaJqTj?iJ_PXM&`#h)1KSH6}g8?i~4B`HZ@J!$sKA zvKmHxL4hW|FpNtO%#+D~s-SzQ7&joi)& z595#v@++rC2U|*q zE?XEW+k~)vPmC2oz|bhV>8`D}3uU-uE@cI$5QLh#c0${z`4TFPIIr#K@)N8bw;LAr zoNb?PP~1;#$9F*pE)H&61znL?t9a0w{&MgdKfKz+5q%+RSDLqtr0804_Tt6Ah>=DT zz@xE+sE#|v;Dy^rP-bL0%5>MUgZCUe_~~N@KcUY@_8dF-kz)rxdVJzz$0t5?eBz$t z6CXJ~ao_QY-#R{V*K-ft_xz{s%w5hOxrJXnCcsB%@ACXy{e;>AX}>9tq_;wt&y%RN zkv1plP~>ardI59W8ITP{1F8fPuETOwMXVtxLHrdDQA42jLGM6* zbP7>1BsEG|nH4lIC>?0gby&Y=rDzMK35pMTPHnvPwmjzp_Qcg>*4Ne&))Td`@WSZmYy!F(IxX^QvMe)nT&b#hC$K zq4c58=|fMuqK7;vlIR{)xhjexpNd*YS6A_b4v@#!omr(6lk5fg$t!oAzBjQ|GagL7 z8Y{bV!XdXNl>I>>icH+nrhvUra*#f@QxMAtwvsdx_^MvRZqE4>)_v2R`grrSks!{+ zP9vAcg*C|=u{ahOxq~l6QQ^l@V91o4;S|WHqM)I?-qfl>-aqXk4gDV7?qf@OVq?v5 ze2J$^5ov*4O?yjaMz>m>^n1joS}G{NrPq_KF5`}(dxM$$L1VW9So=7x1^YxUkG zHS1o^bVZ3w8^aSqWx>^lI87!BmyZNoDu%lW%^rEA$Z4Fn-2K(8L{$r->hVJf){a{nKxN;QJenvz$OE<~ITAewg3k#l8fX z-|yH7qjcoq6=rgj9`9CU>&hj|-48t>kKUCq{s!91YKn{`Z>ivjQV1We!we`DMudGl zj1?R^s;wte1G36-`yHd7-4aNYxBGv75ZYFDI7E=d#z$1V+cZs615~pp@DEx$ z(8bsrDO%=(W$am7fBEXQLu+c?Sbc8*h!b3C#OPF+${J~%C0R2MgW;{Ie$|8;H4x!V zqXacY?(4W?dUUV>?BMF^`eGCB}-!bYDRVk;4RBNbCTU)IGMjNegxiY%2G!=@k)Al z_sA1>TOffFQJ)}(^t8w&HaT@^I4e0rEV@;&34{b}w+S#TKRu>QF|9x$#Kj%%RTEQ~ zm1)qj)}+iV<-;5q8&RA+JGT>PN#Vp!jq`e!)N30c5R%hBS2(5}j7I@&Mp?4Wg!=^< z4$9??Z70|?$E~S7SLQF$IUHNKz#(PIxsY}znXm4V>4}(8Sq4LzOgU%6v6+nDH`|Ko z$rI_5MZ%=;s}sK;$<*-H;7yXww7@cY>eyZmJ73}piz?t`M1D@c!V-2xwP)LOu9yx_ zYeT=nwDp^H<_E>O2MiUW1tSB%29xLJJ1=}^@`r=L5>xn7ST9EDeNfhyJR{;SSn-yK zM~_10L(D=uJNXZ}YLu+#Q>WP>esc~0>X`h-rieU;?skILE!3R4zdv#S&?^Xe2xn?=s@&^O`3z@kyq`{4lb>u9*=KE~)P1lWd)0j7 zbTj{}@YSJ@{Lg>%j^KM2p3UI9oJUWxtoNGHQA_aAp?{@%^u+%!T_bKOoUr(}Z)n-CQ z_AXhX^yH-Gs29!lCjI2^Wu9DH!81lOVnnCCp%df0vlV*dYB-#&TQ263jXYDmkF{T_d+@;AFKNUbnAP~ z)=SOSGtG%VS@?@r{qmK~$zw73XuePPKGCS&d1UX?)!#T$KQu7=>78fYHorOX(yMm8 zc5Q3mso85=A9!k<{_S5~X;ltt0d%eCb-%#t;RlM}NT8G!RzDwK9{jXNRW_9pu^k=Ab z`zp@mq1K15Q(yKAGwIz|d7)_?Y8|j?o%oX)v(@^eS$(mS&c@p-zX zeuq!h-^Qd{KNGRe6puD>cMjSuE|VyR2R6Q?vH^v_%Jvv)g! z_>Z7M;qX0LUJNlUjyGLNO?{}YO+jHol6-`@vi z%yd{tD57&pq*D)&T_w*2v%QO;5Xb1}{B)_$_fgl|L!S7;F#lW2Cr*=>Cr$=^1*%^4 zt(v!LRo{8Blz;yPUspxSKfGEsZ~dyi3(6GR2=6YK6EdXv>Tiwv)}G!#|9)rMeDzX3 zZKab8Hzsv*GCA>GJX3e)knh5fS6{2(OTG$>zqv?dxtEp1tn2#=Ld6y{*=44ZhgizhYIRdSLFd!Ro_jG)b*pRvD}w z*syHI#np#btiQN=;Pf*FIlcBgK`WQ;?>wV1{!(qnX=_{GZub0OZROeK#N@NpTYrtQ z*Cz+}|H5SBUypQ*tzFw%m#u3ZU)TEK+Wjl~2U}lnO#EHPVEtdY#*M$;>REf#^=wV` zz`&Bqnth$;4^2Kcxb$Ck{^Q!p57t$_JJ|D2>ssGl*ZQ-yx2?+>6aUt+WBuCwXPiGY z@o2|j>l=ghr>kd;$MW+iKXBTQRMos0O1^B#4kafo*+~PZ4NV;B99;U1oqx8r^34}! z)F;PJoV=^E=TBd#?r(g5#q3?P_c#8fSvk`4C)#EZ4+#2vh&18ZB)u4_HEuJyH{iRU`TULX3ix_Y4V^+S`7?(6JtPCh;~`Q*-j zSl4r8XyTPtr)PyOj+KA8T2Q-9RZcr5v{k}q3wQprh@ou@V! zPLtsbEj_yP&zqHRKEINx2U_2p`1Y|zb>6B9AIk)T(j5tXIFntE+jn{g%mbo{wG6!|_`@ z$G$uGuFk(zFRJrz*9m^hexlvVeB_(zkI&;KvtW}21nzVO-)jc=bZ^AX{%)>oR9qdk9Gz5UnuQ9Uqk{G~7L z>K@p?`tC>QY1SBj@pZfY=lHj-+Bffouc!NK{H14ieSUmagT8($o%{GfVPwzhSm^_PRK?^-XLcMVk@?|JmS-+5vF_=#tCoisi+t5SPm zCSNmV0+)l?-b2+rAEH04$rZKg`{t4w>iPaq&kxsjY|4fve)z1Ftt<6Ts>x!b`#GI$(96f0bUYpEv=uejvOQ zw5|hM2l}tp%k8(E80XE{b{_A&#q;cUc-_;lH`Vzc=r@QxaSy-7K!Nl2-b;$_{SL8v z`t?Tn3}#Op;@4PB`3{p(K8M*o{d%K(g4$-~t4j}8_q>;6&zFZPf4;vt`SFgi1#9Q4*NzPd8F@AP@i$s>)WPwo6iwsX(Xp~}}MPITRAII9>8d3WnkYx`-#jlAQzlIxEeIL!C>H2tPdDdJ(SV0+HOm)VQ+o z%Z;n9eDqR)N|Zxq_Q#~=S?cFIW9ss^Ux9=Hm_2!L&l5MFHkf_6F@Eg51N)pmfzf%? z7?sBOi91YoR4pD7|OwaCGHSyAncRyY|(5SSIOnmD? z27gxL@bOuVlb;%_93E(Ww~a+11cG+K`~CjR!q>Vdaa8m*@rs`&7?W>N86`t-zL<(a|Cmj^3H z23t=x4nIGaYO9U$Cyov5J9+$DhZ;257^lSSrw8`Et)fE?vmmWx9U8GSK>)iRUgn{M=lIcoIE1wNZJ|dofV?Mx*sT zI&vxiCf5;*747E6X~t>YTBX+A(MDz(BdOXvWF~GkY;+>^n(C$vo4np*!#Z z>A;_(lj}(+kH^nUA|_E4^gF+QbyID|k$XB7@nxo2P0iS(0nW%~X0L*5dQJ8d*_qiJ zvNtg`i?hD$ob0@8S=OHoW*29dWS3{Zko{7&5%%=PY)7^$`_=5-fcHeUFZ)1tdv-_m zk?ij5W7#LN2eMCR4`*M@j%1H#U&+3jeLZ_7t7r8(4M7;qt=GHw*+-J~t7jecE?&*5 zpHi<^>Y&Lw)2|FC)w7eA=;!QuHnW~})w4PE4sxDS&t6r3RlPogbhXY(srcNPWXvk{ zD(O?}+5CETT0J|xKCfP%U+<&oPM*J}K8MfO*0Z0eXRoWDM02mNXFplj>dvia|D}F< zy?$!FK8rlBu6I@Hvq_v)&uV@2aAv)JGF_0&wN8h{WI!a^Xu6g z>)F{5q4h3`)8RK|*_rk1%^8`q1@yh1b=T+2u6KcHUR}=?W?eMeQ_p^?K8Lbz$tW@h z`n$W{b#^^lRG%|*u|{-uz3a^S9O~(<&!P41tn2J-&Y2nMIcL}B(382@913=4B)WJ` zhVIi|^SU#J*|mSdzr9Rxi+}t1cL)D|gMYutzu)EGz5M$a{~jja2EO$NrvMt%4^L@F zcuEM;Q$moQIz3N`|Mh3uE1s(5sW;}Sg?VaGo??+hiIiCb5|9w^k^lLRRCFzbSk9v- zi2MG7+7gz?{xse~Fk9A^yd}?5W1Hyj*TNGq932%gY)oL*_q7M_C}bFW@;oY)GBcXT zj*8eBu`sQV{BYh(HlP0qW^haIJaoKfSHjnv3^3<$dSfcR6<^*_2>7$ z{gWr>rLIczSo)*kiTKNoidaMaeSX86U+&6FeZn7_c1r!vvhCrCdeKpd{rz80&-%Le zYpVQas?H}7CxqG_;X7(})??YZ<>t$F;%#_ykZAZ68z2@+p;V|+QVLD;BCT`X@b(`g WV#x~^Vi`h{jpV({-;bKI=>G!tl(P~5 literal 0 HcmV?d00001 diff --git a/curl/lib/libbrotlidec.a b/curl/lib/libbrotlidec.a new file mode 100644 index 0000000000000000000000000000000000000000..7c67de1d6090378f008129187d5923e5f02fb990 GIT binary patch literal 57530 zcmeEv4SW>Ux%bTOB-w)T#+Liu zkKgSZ_QTwjoWO-y;@@zmdf0?))L0%Bo~BuSr@ zq^#%D@4OL`^q;-=9+afS{nB?NDg7?3T@_fd+*r9hP`W%YYw4mTOKT;bHh)p=z4faH zr_Nqfvy{M)UU$Q!*(+A9k?!H}NbxVKyGLMqmsYPrUbB}5W-h8-bnntYGGFm#dhOCh zfu+XEy1=59)l1W{yi4l>wX5zQ`lS{KEUI4SU0xknzG~&7+WQBiRXShQqOVA1qND^@ICRDDmKbY1Pzn$>~Y z>lTP{n7(RdVCmX`xoXut^{eMBTD)TE$3SKRW%*jF&8$T$?_N5P$B;u=TEBe75&|}t zuDm<2tWK}5skwL2N}jbCdjk2S^x4brUAFretdF;uWi^?*WNEM2s+ezjHu0!so9>a`TO^f!q*)h=CHUc0J(HL-#8ALZhyQ>G@lSOFV9 zpCw5n@+9ftUP=1SON^~02m9xg=pT;{{3^*5MdJVHoh<(Se?Pi^on8OB6!^bk<-aOB zK9Su%nM41IXc&@wI70~1{v?4gl<*jmxzlp{WMRs9MX*9TiKo8#n@qy!KfTDm#e|9;5T~~eGs>NTEa;{HR z(m+prOx4y?CQoLW7vDIgn3u9JXGyaQ{4Plsos#rv7L%mwNcM{OCj|x4#D&+95dS0q zkzOKAY`<P6NoR%aN=VQ z+riTbh2=NZlLqL*i!%Zy@uDPuX36!%#pwknUZ#eweCd64-1)h>^@cjXT^%mp*_n85 zqXPBd{VplsxU*A_(4(Z=x8>{8ZYv15z3MK9X~}v-bJ3XS@ebX(E&tBW;&zdRHeZ{k z&6ziUHuBc3F5UK+w&61E+w*n%>ji%6Ro%K^THQwQoVwaNdtt!};d zbv^rnZn=$+;nFSLU=#IK26Vt^_mfWH{Z0TnxR>zP0!)Fi8a@$S2Q9INkVpkxyb4&qxX;g?6&{}G*+w; z-$%IszV>CW`pf|{1e*~E_MF}Zv+%rGbeJ;tT8E9^cL^-P_hJ*xA~bWV z2^iC=$~Qu}Hvqms5AOS;9=v#BO%BRI=jiU3g7@y?_OC9uOS?n6OIvVf=O0kcaNMNf z_{By5Q4l}7p!V3Mitq{%-Xg*cB8(?OkwIK!5EmK5MFw$^L0n`I7a7Dw2Jtx0ATBb9 ziwxo-gSf~bE;5LV4B{dKge(JutOf{K4G^*#AY?T_$ZCL))c_%@K`N(HMo!Tl-aP)0 z%H_lq=`fs4QaPL|k`9yTT}k>J&zOyXQzrhV>zY&JzpcPl;8&3d6{!F=1YKViDH#Zz z@^tZZpy!*Oj3ibfH6w|Y80AccMZ8ZX{N%f5p36*P(UgU*%p}(BJVByvbjl}S0B(4RDZ=5tG zCHZHF{{nD#zz(L1sF-Ps;>n&=H9(a24Z!?Tz)^D<+#u~kv=jl%At4)*aFf!t%8S51 z2AIbLdk`H{etgjIAg*?V`w}c9(n=&~sVQGdQ)hW@Not1J+b$UE3xE~vn4AjuC8UqJ zT4W>w-i~y&JQWqc4RF>q94OfiPw~`L>_4O8-vmsP=&U4M@uW$N5d`o?gj-WP6wkbV zQzoa5$4+FBkCA-p297w8-{dK&?fBv_NqQDAf4rH)Q5W%cq?QUR02wsiB1x+?4woF? zsZ&G=JpBORS^;yr5HWb<`Q11rjjk4=z14u}Ea!OH3Ao8OQr9N0=Mej>E=fmm)0NEc zhAC+koDJGL0hk--ak$G7uy)*VLmFj04O)30Fi+HQxKRnX$;D}KXsXn3wz~)6&x-Lf#~O{sr~mfI(9B#GFNjr z(r2Q*X$8N6{7M1y*;)>lkQ>(*Pb^L))DGn515DO^gY%m>IhBF`g#4xhX5!jG`FYaV zQu;0Os{+im4{*3-J3Ld2&8Z!OxapSwcNO67z67`{0T;RiII7<- zE&*;V;PzbtTp{32Tmsx@0q1PMPs%k^{}Eh4LkbY0L&3R`{^d)68x6R*mjE{ga4RnX zj>>JhM7W)o07v7|b_sBw0o}>d1|V9lSmF7`xqSTwW(86)tf~6EjAQf z@uVA5GbFeRL&DwQ!K;C5lq3z?H1J5V5_mHP%hN4LANDOtdK5QZpTk{}KM`J!NoftC z_WtGDlJpU7x@6oX`6VUSPx7ScOM=V7T8)aEt|Z)-($t$oaH9cJI2f*Y(!|vElK#G0 zz)*hdg12RGJ4l^g3%G9!SfU?l$6&Yur2qIIV3Xsfi|R2H9P#<5zbi@CTdm+&SPw+B7UkrX^H2gWoVssBrHyRWHT z-QI3Lq(CQ!`;_2`cVi=Y>Lbb2jNpmavO6pW!+a_!-X-!a1>c^ahgOU)Fs+Dgy`)kzM-^`35>*R7)>=R5UyUn1H` z3bcP9GxEBnW>|cN`dzh7r_~BM>$X*Zez!*_TKRk3-b^Xe+_m04MEF5PpW?)l&?QhkeQ2adw$_x#ZY0eeF@5EwRMO%o9_t?!zO~Hc!3^T_mm!b zgmN@PO_ZY<3Q=~T7lv%1vjl2pBCR+cydamT+ap%LzHu*A8B}yo<(#L*Jqt z?MJpD@Y~mnCw9vLSw2O{mK=Pc0r1k=doehKsRyS@fxGplBY{jk_;*tMUH+?qW1V~U zZM4^Kom3~Va?}Z|RIfUL)dC@_7D84}gskEiRB8}+@!rYALzIduZjU~W!7e@m;%lK& ztxy96cI8Z}->3D^d|kKZyUmcI8o_qGjYcdsQnxQR>|9iby~$z1(X`4Zz@_|0fW4sy z&%JJ{(>wG~C0yB|HXz|ONV5{T`9Ypr$v1*G#7B5?5o=ohlZfW?XceLpdDMj{bs7Lp zBg(qb^7kW3`66{0qSW<>E<}`w9MRQ?P6fdsN=3}%nU$#X&(x@^z6=-|yHyzzMdY#q ziuly~j!^Pv^YH|%)zD4IKu2^T&mbSs(>&FUXbX=PAUc}^Oh9xNkM9THtAndtM(TMAzT!$Wqs;Wd&bvD*|$m@7hrvax?jysKb z?s!)JXep?*W}B_DCy>P$b@TN|(nFu3YU$O=gSy;vGjxg&PQiXO@G^oB2~m=`dZc_N zgSVZAJrZB>q8t^rZO5SfJxchZRJ(kM zy_MMp(adM5cY9BGdg?Rn$~&yeg|-?zm#;Sd1iXL+B(>>Z5Ham%NWb`@^&58&$6AtI zF;eqX5E!1k_J%62bs;uRjHg$A9VJ*Vdpb?~XFHL-+PDy4KD#DgEBck%cpDzfYRKuW zY#`;Zzq-O@RL{#Tx3{+v&uH?ITb*+by1hm1<@QfoY5aUezx8?E_No3iG|yhI>hCkE zKY%U4hF_EK%cUC0?`c-WNU!G|wdsCzs}?VFX_2yAU`x?u)X#Pk<4D^TJwU8eU9RZ% zmdI4}K(qzsoK4T1Y3*!Jm%8N(fQo*HahXsqVJ0Gi=g^^L5Yf@Uz{$wFGTKi}Y%^)V zYGrZQrf#+IGXUjKR#&j^HET2Vy>8Ek{w~MTRS5`E-xoy$~%aipVQ zH*1DIZ9ceTJpi!csQ32i!^&M)<#VwW$NBE)?-_6c^$F0yAk^ufh`JHL=+0ojQ{6HO z@kkb=gQ(GEtVT?MfTbA;*i8+1oiGd;y}kua7~KIUkX@-zA5Opk1)`V?fQi@ z2#urg5FHD8iev#)6!24^1~(`myDuX#lI2Ric^Gd%1x&KqlGPDBaSM0~1|S+4J_&oF z+-3EI`!e}pX>GTl`@MzX?6Aey1>AVNjWjq|GNx|wBDY8uS|^30nXI>a`-1JKt@1n2 z;U&+~G7lMCWcO|+wc2)qP^mFFRF93}o$zhw)>gJ6z=kX_nvpDwxR7~NSw>K-TY6w5 z*pCwZoax96EQ17toCxc|<5_CsaUhv?C8&xz8){hT@)vgL!M=V*U%iaD^kDxjYepN9 zFzOPw!bb0L~pOYj>MFgl4Oe0pn7z${8-Qzn=>$AX?^ zb@KuAe!Sf(S2(f%3&AJHH#xNEAdC=3*=2=;$DQGmj$ofk1aEC^Ag;AGw=m|dEYa;p zry`mhHaDu=7E27?%E6&;0T`?I`FigOeb{`)qDCCbwcH(h zERqESN7BQ`GoipvnzpYhjf;K&+tRe>x-@loZ9aY`C1oH@7SzU<2-)^m>GtsA?%1dr z^$IT%p#Fj#B|1c4Vw&+6)K7>BD5<0o(e z_sccvE5C=0@w)@sM%cWPRR1(#<+E2T`Rw5uUsHGecWMlEeYfeE;i}(?%-45&Ju{U0 zMxOE454(WS#nQDiVK6$$Z|~Gn5Zhfm=2V;JAf~Z_*LwR5Y`-vRhI^6rFcJ{D0`=A!eofr%ck6ww?NEUgUKsAo#?Q8LD zR<|4BK8NXK@Czy!$JpO_~xf$#!ULL>`j4bx}l^7e@!Pau#`VF_*%U`0*bmyZiGZHnye$@>5*4BLua>i}i^C$Q{ zht1bg!eXae<_c_TeN>XuGw;I(M4KQ!}0-Rgnp$0m{aRJ6-rlJre9TLVvV z1?-i(H-<}4U#j!PvRkx1<5O39>ud3(y_yb8PS?`2s4rVJvRfu3Zn<*eGnu% zwLN^?0a0)oqM$!b6zo6_n2_n|>jCP4pQYE=<#C){B5FVJ{eDJL;tE zre7wd=Pndrdwqp(1Cq~Q0LkC3hGFIxrlz;B?@6%lU8FW5S;T|I-KKR$7>1_JW(J9| zYMetxs$B-U*}R%mHybwKAjZa*(A)Viu3H6CB_K0Yzc$^SqCNx5^qF~ZA%S1~!h6J+ zH~5pTedn)-OVram0@T3hph zsqV_ftoc#Wf@oe3%QAOA^wdtumg^05mm&xIoZ-G~-N_U^dTS?x-25$8_~xhZ#2hV~ zzeVX{C}5Dj0VzfH$Ai%FsA~hjVcL`OQ=i#Nt`N)yC$bpnto;V68YoJ0ca`pI zyn=?4wzkc%w!cQxP$S-H#JlSMXcoN(&Hkaf`5LMl+;c^TQCdM|NI8nqCO}q?_7xvV zAMetA-ccV(GeToWz*Tmubw|%hO1X%XJ4QI@`7}Mp*|U?L`%CvJqc}paQ@Pa|+hah6 zV=G$yzxm}}!D7*WMh%7C6UdKbfr14unow+!Eb<-+{>L-%ev0)%y7ehY4AgyX^kE_b zG$nZaLo;-HKB}*-iln&zw1`5T3>6Bcs;L+DBhrJ&Z+hR?)D2sDwt?>`w!LR3aUiNn zFT*RGS_K+n84UOmo_u6V+f3dJgnFQxAPzMpy#16ozCBfM}0;pm*QPM z>$h6)jSscpiHmH+eZ^;DqnZ9Uh8vKfKeXOKd-2{ff{_nN&cB6x zZU$4`2P*KD_+=WNu3JN6j~Sk$YOov4L3$rg*D2lfbgIFpkq#&2y{2>BOuTQa42=h( zuN?qxNOo?2l(x)q#w$a)Sw=iuX_ z_GKR?6CYyGnaoruJDT*I2^Xl1Gl7Hd?}zmXgQ*A749dRT)p$g0xshse3So%U3;pSilJ3T`1B~B; zW+?YTNXG{u9kOe$)lmf_{0{8eXKr%@!~LesJT97@yWd;*Uhwz^YzVc0@(@sPcN@L$ z=tW&*TaanuQ=ieGB(bpuTP4(8-i?kj^_kp_Oow|q>ZX}C%oTgV1mVvxJg)@S!&bSR z7~q5n6P$Nb2lUkZd`K>4-gr7{Uy4C^bAO;cT;y-sO4wi6#yywQpJ%}ZI4`la5op4iQTFler@W!wNqKN(p zCM3zda1>J-_^en5yMrgPsD)Y^A9|SP+SwlO=U@$iPB6WhpcjP=i`=WuNEVr;NoU`6 zm*nhYMA?lwS;A#Z-4Xp)mJ#SEP?d0}Mah@1Tf;D{6L@zOVgK;R@oM8byhxG1@CE{A zW{df0U5~?iXb)ra%wgo`t3MH&#gJpSim6%F8YuSp?pU5-b%FfRbhwGxsJdZ0lEurL zK2*aG^M+q8s%~|_)y+()|FpjwuC}I~)Ly%38v^rck`m9J!WhIJOLWw6dJ6pouW9XD zk^YRHBeqeb3&|L9J5L*tjQs(zLIxLrCZi!!q-MlQS?p27%316~#5mk#r21Ie?-9Ge zVr9_sw7{)MwTOMlVtt5x#9}{%F+7>Yeh%8a$YPy{jc2j<5qpot=C~xOh{c{p>>3vP zGgR~6vDj~5FkjDNxe$gt_5j$N<9>t~hr1S}Pp&XUnv;yJO~zzw1>?BCM=ZwRoY2s> zu-Gbio9ZyO{jNa|Nl(9mO?Y)SmHhBR7*SV?3|mrjFVWQ)vbfNz40lGp>0%| z)$^8kJ%=^bzhAFDW~#r~@g!d8MV+P$i7?6VVB7p_hFW?txTle_U#r11fhZ0bdUeGz z9sVL`a|_Z9EH+||tzR)}HLdf0>$oAW1C$!eZ=*%5C_}Qi&2~<= za&+e&s*-N8z>mC~hUKw$knhSm41bKq#17bmg?7af)U9qzal6+O#@cdl-D)XhN^%>( zNlL}8Mtc2KUc0PHE9!dSv+5(Tnais5cr YOid?Z7CfMcm%FJH&3cfE#5oIfGud=F zQ&FAUqRZi%<8VsMa8Vz9PPcPnB`Ly5#|!8@hZ|4R67z#Q zc=7PDmF7pk$#N)FM44XeSU8#sYJ+<$^kdWqdAPix+$Kb&*l2dd=1nd8U#NezU|8|= ztDy$OjbOi0SFGE$=)YPNScL-7f8)Gl7rbr`8)F2!;CjbCiQ4>FE-Y6*K&Cy$YrPtL zlNKmHM14SybfjfWynRr8&UyOlHwF7M)J^we0BJi#(`rPR8m855(Sx8ENkg~Q-<23x zSSr+0v7$Co5Cl3f$j_kd>MmIy#@EC!#*oC|X^;e*s%do9CkKyz6jC(J+Qir)&L}K; zCvwoy%R1}jyYYlZOD1L5uA_UC8JbqRe)yzrIodGXaqUby7BjpQ}vz{zHlj`vh$ z_*VIR8h+Iour83&=TsZt2H~n{aDbb|u(~{_*Zn<))Kz!g00|QbfQD|skm|i}>cb|{kP0e}Weex3 zJqaD~Dz~9aT{?_d-I^3{7c|PM^q%K*{bpGAwVQ|`*I~EpQdq42d2M|O+_Jj?g(mpAHBuql!#=A6 z6GTM|pK|zI`|H1~2ir)_OMy%vRK=X|V0fJ^R3WdY+pAV~W8CuVv#i6hTb}m|>Sr@T9Sa zCU^sUO6zkuPs;VVMg(w>IzPt`gqgGM^8+;gIMOi0t^q+NNIm9+2nE@GWLjPDIXXET zp#jIU0`vS5d;x@}5L!*kef?>vv)9H3IE$P4qo1t#@fLgEv#0bp; z5zm#3(2g0*p*FYA2<@3l(d0__CcYBxx97pVdmieHmbeUip4*r<4{IFj0E|^g!#cpn z*0hcp!^+@}-A~JrhBeO}{R0(it;5uF>1osQp&$H54SN@@IvMt34G8@9juuw8i^J9C zo(!tx1v!w{MjLDVO-IzGH(@F2_PWzXsC63w+H?EiE5_OZUr1&LHOunV;hBE>=d^sK zPPnWD{ey**);6GG=6)I3WaNx#?P3Y{b<=~tPo40og&cCnQM|z8YVmjyj|}ECvT0sR zwT(2dMnH-h(PfCzg(y{CYM|j_eT)WRF@h4>2v)az{l#aBU-1?H5pD;*CWsk+)AM-e zw|_)A`|UlHhiTt?(twTT`Hi~C4Z#`xIq*&EfZu+MddqLO5^(ei0;N>;i1VMYTV?{% zuq*P}GGzuH*kYayS6z4X(|Dxui{20Zq24zwoapqO6s0ByfmH<~LoG9G)>f*!=+o4? zHP1W)h({ z(&q~NP|Lx08Evh1fxfV2alT;9r!_41GMSMbfdj1o;#cuoWp1lK*mnguX-hMshob#@ z@4Fy2xHi_4Z=tc7e0Q|!v8Dp+Wr6FB>MhNT5`5MYKh(h!?CDt=BX~?t8AZRV(c+C| zoD1N9kMAvhg$=_UXlQgS>L+{(#W+vfpAQME2j7EOV6F(io!e~`p3_+^@RlkmuH1(~m2go@J1-TGQ=6vAS-U|vc0VZp&RS`T(Y=DeyG zU7Qgbd6nroqHb;kb+CoN?~{#X^TwG)ubD-M^kC#8pY=K z2DD&|0on(%+psuC2RknM(SFED2nDPN1TTUvehB$Q(xa|;Kytjpi17du9;g}(G97+S z7alQq;17smG^_$*71(bHvQIAvY)Cvp7dnxwS@o9~q|@ziIceYuj78Y*IdI?Yu-4Va zTvVv-GSq-P`Oj>xAcGv%uwiu$_5n_xHu5gD@d&c@hj6fZW9MI>(UFng>b>s-6ol#N zu75td2J4K(VmkL{8SqB=4EsK}VXvP+ISyGl}!k&N8(gw+_BCx*uIx`keXZcmk<3l)o1l<*efs{ zZo~roC=-k#n1k>7tqRs}(_0$Hk(%?Wk4I{^Xl(_k3av4pgplj2i7T2Pjv=gUgi2on zyZ5QVrPNV1s1nWf#t=c8Hf9N;1gxOcjf&FtI=E0-nY5;|Nh2A=K&M96AOq1cNzENq z0pPc|*tM7@1ULi+6TM(462yKhsT!F4{0Aahh*NAq!LV;*^7A32HJu4ePjr&n_$E@& zQKYEz$@|&o&n8~%z^Q)_X`J;J?cy9w_4C@U*yRbIDG@O?qrXKKBJFy*0{sFx%k(bW z1g*odP;^M$vHEIw%zMMRrxrVEh_aV)wCYaN#vAq7oo|1(^&bt6sd1mqOS#7*y!fO>!=O>eaP zb7to@YAbOJDg>!qKTha0He)tCOo0bRqqnJ>W1ruRU(8X(i~6^q2#Mw~Aq!;dq4gK_ z-nU{(alH79VYgE2{2|2ybp(0Dc*7_LYy!t+s%(HSFo`39jWztFhz&K9NHMMOv&8S1 zw4FqNmc0_tG3m3MF-?1czEqGxqix_3FiE_Aik}mKX+;?}^hh5^xBW+%UxKob1y4}E z+!_wLnB`37wjyQYmwQo1Cu8KL;Ay4F*yD(CPv`@^nq31TN$>=euj4z~cZNJgHD^cZ3e78_*AV^`}6I@EE{q;nm;21UAAhtg`%w}E0e ze}KwpWLB2MhDX>F;^R4rxPB#@QaTunfyrfy;HwMc~u`Eb9$ZUhjsl(JP;Xm(kuq?XV7ei=tL5 zMQ!G0Om$*7o)yBiOy)Xx6f0ygsYyW^6 z#6+^M>5pn-E8ulH#bVH&Q4GZ|@LIEet%W~w`aEx73+~%S^&iMlcs)VVHkZ(?FgTBF zD{b+93dStXE~ZR+ zGXg&-OUK>=Y?Sg9eIObW$k>B+OV;U+4RkfSo<1=0u|d^|y-PHE;~a<)*c^(wIfN`2 zzjtC-{h_a8XBL}oV0-#TUG8Gr)8E5dF6b0A$B3U8sOdfAV8pZZNb_0<6S}~2B{(k? zpEnUgn}*{SBY2CvW;)tmd<5$Q4408~^xuGN+COgrW|U-;ZZ|hj{0YRl;ZHNGwzsJH zBv8?Rk!Gqh8b#$0?Pb(m1=)h-kTNKqyYP-#A~5es`EYwpCwtB5x8V_L5BAAE7#WA7 zuh_Xm)nm!E<&Tj-N>qCLc^O-TD%I>=epBj zhMKpb%DNR8Uw{^36$HaR&^S<`Z96*G=ebT8q;Y1^P~--TAcdv5EK?tx)T}YN9J3_^{)yD=-_T6igDf zA(UJ%xY=$ySf!zv*lh<%hTV2+mcSVn_yS;O%Bi4imt7g$Fzr~_K>w8(_Ndr2?0taM z3eU=)vBQrKC252sr~v#4So^u)Z~9aHePrli`%D2yW3R9HPqDv;Ls8wepH1&ViiN^* zEsUL5qlZGE)pmW*8hznmzC_Xm2h0+H<|Qw4v63N5Kqi3#TC=v!C;V9KRcsiuT(mt3s^YbF5p%@~+OR((9vdxa)M5;3 zV(I`IW#EuBdYaud1=!PYE7EQF6+_nU22rx_yeY=HXwo#&Q>==iv+1~8UED=4oNUz>X zi2J;*i-6+k$)q?lGSRF2q)Byo6^@{?p`ac5h{xwo)vGsC23Gl!kRG=xm+4NPiM4qf z3XWy#*7vEf;xkDxd}rtVNZ{IakWO7o;&(M)kez^BX>c>_nM%x2e8gT~W#5GpCS`6m zbAVVYP=gLwan@W#4`Ha`QDb$pGlT8taC8D2Xg(&Xt0U3lu7n8vH4H>u>~9qFE)!Oa zIc*+tejjV$rrlbA5u(ZF?@YUyb_1IBU9g=%c9_bn`Ltn=U}D6;SKfl{6X8C{B zSO&byr9LwQ5|z|2t@0^{ieEwIa}LQqb{sDeEh*jPK>q&=oyKmW5_vp*$Zokkm%L#0cHP)st%tRzuO- zwgcsw+3m;|YAHOGEK*F7;mM%#TXzCk-PMCOKZL$};30><`k>F+uUT;9wr|tz^w_-hLt^l!x;cRNga(Ft#5- zEvyTmU!a0D{P^Xt zx2V%^9gOO%8f>S67OIHb^OhAJhK~{!Laqx57ugd%_^bE%tUsf-i;plrCKs^i@A|a< zK205K@7aj}^*smjg|k8>Yos(M7fVjqjkkyI%H8uMV5rinX^)4Qygoq>`D;D}j}iLb z%*K|sF#4b!eNg5uQFleq_D1UWMl>k9b`m#|-z6n?w?q3SaT6vQrhP54hOfo@qNEr0 z!#}aPB6QPE5WTWf-PMkLQ$$+S(eI*f(L=k+2Sza5qF^09F@QK!FoF-@6i5rKpup2b zb9C&yZ#qYc(n&-w_Z0Q|>0~}XV4ooLrcc8{i9QA}pS&-Ui3}w4dbARqfdsF0R%{(n zTYHcc+(UdSt^Fc4ZJ_(x!BNDqcG-$}msPd`YqDN@PV;K7wS(ZIwABb?J^=w(>Kvx7 zFbz-A!!E|xrmb}G`JIqapW#dfIfc!4{%mZqC-Uk**D^WPoi3+}iH2xC$mEpvEbm(E zA*QJ}x;A&eS=jxFk_yXv6_8Z39Oy}^VT3h>FtLiDuK7A|Lrw6!Q{DU~Qmvk|J=_GK z!yqRUO|MuX!{e3KZf{Z8s#p>I2uPaz67SR^92Ysubb+m=rk>|-S9Onk(EGgg^BGVCkFVj(&#Y8H`P0!N`;yILF2 zCiJ4$x&0;DbRD}Jbx9e|trIckk<2_)ayN}n@hefhvz0 zGH5HkZK2eA61zq1iWOctOebEBJ8iRdHCo^PQB%A2ERZ)~Rk%kCKC-|B*K1cS)I8z9 zFi%7^Bbe@jFzv@k3VW>{Z&8=ZM5ea!JX|pw)U7%yYWo#ye^G}T`XQh~w|>}$vkdXz zxzDJZ_cJSMM*+I1xI6f4KWZ&uD-)M%-q3=JUi-dfzQXtY)vuJn3q0Bz+7R~@p7mFs zC0$Z%+PiiFqg>tf-EqY1zMQdn;47>qY{?;a4Eq0Eh5f|&61*dxA4_L;uAZy-WLUgR zjQQ-b-9GCjt@om@u-B{p;uW9sj_(#!*grjAf;xHSvK2n;lJ|KIt{bK`+%y*ZTpyuy zb=RhwXfS9G@1`J9VCrH;b7`N~s>k&2&VG%VLK;p91>d~rQ-5*LSA>HOP&KVKmF?N5wr)bi>bQFS zlCv*c=d9mZFQ>HE>TNo*e!9(MiDtEHyb3xNeu3n#ZpR=i4sVMB4sMSh3eCp8)%pWx zUyEes<9+-9BkO1gly&yC_<@8R+q#bqLk-Y_fxV(Knst~!&KcF@k#A&_2nBPJ_gFWp#`@MGk2b>)mZv~uTZy*08K(O4Q zHr|MCYNL;P_@;f`t%k0q_c-b<{UxI^2s9huzdsMl&j{Z9UBAHOBQuK$2s`(D$ zGJJa)GCryTxDDr-ajF{c+OY3F9^JwaNRDBTwk98C1n0FnqxU3VoIN7H%;~T{E>SGs2gzyP-+Aqo@Qtre%mVvAHtjR2UyR<2sziJrpb#m6dEY+nN~15?B=)QE z@rQ*~fGSG$!xNnhZ~Y&mlbB?xahdjgaNDnE{v=u$FS-B;%4Uaja<31kyzN&v-9_;D%9Adf zPC&tSy$YI$bfq2XxPcpPC&}=?%`w<;;|Du%czf`{4mNRM4jC#4xCXNK_r=D-iPgsr zWz8M%Wie+O){o2(2mv&&?i$$zpB_SQ7fnRxbkRigjxL&rKF~!IQEwL}qD4^7ASM*3gJCr_?;1D`y> z5>Z(Ja|}i2f$aH)sS(1O_S+*njKU)+^AdRPP(2y5jU8mq!HOm-^vRe=egMw&a_Qx> z4*9HixD71k9RBK8eHQE<9CW!8(}Fd?!nA;9qk}iHu$I%#CFaDickCoka*)>WuAhe< zI2>4x-ex4&XTn)bq%q(irQ^tVB^{)_fiDAAlW7j008Khb=@@ba9Hc1*21rY*-N z3WtlJF(Nl6%V}UnLE^wq+GpB#O4xyD!9Kc^sO`Um;>l|bPbo9%8O764CNYga)}r9J z3+p#%bU3%E2O(XSU_Lk&YT6T38-GLY=y<2+HMQv}nhCxKkhJ!FY*Gy+3YMOXZuA|+ z8RW#=8V-YjAsX12LLERS2GQPqa12AR>;#>{9wHq{b~Q=xoLq;xD~x*6oEne{`fDVf z*_=+d?`>Wk-NF>fy+<|q4+EKOc#hl9Z72Xc zSmM#oL8Br}%liHw4$S_S;ys#2d?RN6paL+Y;hA?mjNVf)gB>stPxxh+w*Y-?u5Re`tX5wb( z%M{@{NevR?VQL8;q!px^^o?YGPaiZ1%pq`&n;k^B3ycmQaZ*3ELwpMTw9IOz8326K z>ef=|P^;tYk%3uCbbwl9d|C(o5AP26eHaSn^>7BU+5bGu{yXXy#_qwg5)n|ML!uub zN1UXE0z@^LhW6V^kH7F}iUQ=mVDmXkY;I~SRMLEQx>`tvWB;0^gB zZqd#j@m}rwz$f~KJJ1}4WU72&v3k9bA#LL{hfT@^mj)#BYz`9|j z4L98a|3V9CT6NdIaR0(Z_!sU&3J3t6?{!DvTlkn0;DE0PcF-SVpTYzah0)5Mb<~eN zfsOQ$aMSa8AUeZ-{zS5t!l7`2s=$~X-#zNPsHwlu;7#b%iaOUl4__8{xp`qEpz2z0 zf3o&~VGbNo-)|t7D6DA|9rYE3y`QUqO939cK`sS|9hkw)rQj`MQcL(0E+?PD<n8oC$!>!U+N z^r=oQ7>8q_2=5b)1*E{Ua2Zm3p>p9_$i~wUo`na|xHQi~ia!4<4u*LHtb6GW2CwxR zcGuynOos;h7he49{)MEyl-|*^gBbRYyBK`d+N6sCetMc`VXn_S z4BH@J5P>jI8!d2|y&%8nK;ZAO+bC%?g-!Stbods^27C)MoO76Oq0D|l_!fTS^}LQl zmA}VA2o^u8-%ofJyzne=#{%;!yjkB0w}S90#5UoWq@Z$AKhZI$ffsbi{R(uxB{cI) zNdGX{pVNj);}{~0Gca!{T&(-kT&!Ma*$V6vb(Y#@bJD-s2Erl#YP%4B&;bJyP;EL7 zEfRHLZ!TsPJvjDolyMzA7!t2jBYE8LwGq+}%z1GN5#hYJ-MtR%){$^r7}dW{Ixafv zFH3Ba@>=I&pYvLGj4!}OSyJQJ{hIJx3`=@09=M9z{hIu1@3fWhTl^k^m-{Uk=Xfnl ze=SUZgL{{ydB07IsXy9s0DIRJt-xmpxKpDKP7TfaDEcsRVor@%Mm8&`|XI`&C=+j1aGjI z4npN`-%7^l>@$b+LXz>fzk=rAX(N;FhDQ*i)ni3^J1YVAWmf{ufDOiRZv`RnST5%M zJXV!-LA;Hoa%V&oQ-2=2fEag6d>bC2I#$NqdCAW>pJ8XdT=Wg(jV*Yo+YfC+U{-5b z6F-RkEo}H2encn3&eDD(oF2Ls06g=Qk4^7xK&rGBtAD#GA1QE!UVR&m9cxSUs~>s_ zorE*T8=pjoJ+N{QwttE5O7qqJspJots9P`T5nn%{(>bT6_U90jb=7xNhk8opJP#WH zf}*?`iLYJ^d?er$ZB#*WVp|S<-0dTrC#%0qzZ$t%<3Kq5u`x~U_g@Am+P)(;o<=YT zR6jIxDhLk8r0{6sR-|hD7P1&I2S2NwXgnh;@v&_}zCRzkcoNOS(K`AP_n7)Gaj^ej zH*HVJ$KKe0vIqWNTrhk^@Z6PaMnI>g?FYa?P439Jvy)c0XaE&<((f3HC9923$*27F zIo*1w2V`qn8;`QU>O+t?nwL0+3=3lfY?cl)G(p^P%ZXoj{R3MFX7I> zc6vIYY+565;ETS>VORqv)O^T|Q~n^Q8Yd!?RxS@1b_;d55o+6uK#Md`KwnIzL&-SO z#B6PNGUy?@?lQjqfsbA}oUsiiKE3IOqY7uDwdLLPRb_nH0&nP(WjO1V(SV%bY@uUc z#489twUdXReTu^5q!(}cYSfFz5uQYN>itr6!xKBYP!o#%bjMM|=x7Gs;aJ7t`a`sd zYwX4_6-h=&sg?VEoVef#rsrt=JLFXwZHD%A0uyVGaI?*o>hrMxM0Q#&exi?}2Kb~H zzAreppQjJh2df~HuZBUXdrfiJ3`XKe1z{s16>t7QS>y;>d;$OyjZ zFg^G7*Z=&C4_{aN+$H2|gx`kKPl#>jTzX%8o3ba*}! zw<3K#8G9lb8=4sG-DI8`!8q*QV#qKEHSO6x$Wzn#5Hq}=;~&QRwhLf-=r%YnZpVE; zwpT2|bYuAh-NK29qk1r&M?R=E3;mwA)kfN?jfs&m-Z}>dk&%rfZ{$j%9jw^d5;Dg# z|0j?#*IaLscV#$7z>8D|DDqA?KnW@70rg|c4DrQ-Y>&<4gbNgo$J_sg3$!AX`)!&r ze4Dl=(B_Gg=^i1Rw+rq`e$#Ik`O2fTEj!_2QG-vQyAwO)K#n-u3CA1xfN3H~mB*QM zF%=wQZ=t%GOl#U-xD4=BaGwo;C*5aaf8jkOr?F7ww{Tz^9=^By*4u{l2kbs)#E5NJ zrWNzkM;UOy9SnJvTopINwuvr7jd1{;>K6Mva>4Gz_lOf19yyw*yYcok9FtOPAv|s9 z%>y`5(MrAAn%b)|z7KI|$MUfuwj*MLP}0wK7a^~PUxrK!_Q{~9>61aq(+T(MjS2TF zEz!XPTaQl3fdkyc7CyKTQ)bgC9$0o9n9q{n_rSTV{U$cg7loO#7X!d{Bk0zS0yHwx zocKr(DK*+whP`wBa{WB`PpFr$Xcwz6EjG~pqBl~&X)cfRH1PJ~TW!iUAd?A3$j7|A zw}!meykV%*_adBrkc)D3nkE5&N1_i!w-C%d%=-J#

$bq$v$9c+QiWK3#!5M`D-xgF2T7`H#y8-_h-M1Wm@cPYsb#E689dG0vg)| z2@=^4{k9d9vXxN^HllZ6@5m`yM)-RNb~L2zZ-Yk5wE@2y@Vj;AQ!dnkG2edrtdlhp zJv@`hUhHbW>}RMqy0xlGSI{P{G3ef$b_? zP^H+evK8P@0~|NbpW!P~`x7Oq&tO4?YhFzHy{!)QnaLo0oO#9ZvbFBC3KXCMif&Q8 z7$MKFZ^Am=?{sWfFM`h=B$sT6ZnY8F;rj!D5gJZW*JE$fw`kCzrec>N&gleSECZe3 zq#)>|+bF^j%N9-&+c>#wBQVoqm^19$W4hHsbi$0Th9p_gM2HXf1b}lAxE(P;0_n#V zgz~p{>r|U`dEb6HN^=T%zYylK>HJ@L52ol>|5x5~LCY5s|KFDP!~`h<{A2QdE#Ci^ z$a_*AtC87|@}8AqVKWyA+h+EJPZ8s^*0*>HS-^TVTONRcB)2rvuG}`flm43&0Oxm7 z06nY*T`v&3|A!R-iG}}F0GFZwhz`>g08v3g0dT?@LIE&Rv0CUoBtJt5zwR)d-})9$ z;e>;)pL3u0=$00uod1kU(8;M#V%oc>QvH}p_zSYc6u`8ZGSKa$8o-}PA8hvfKW6q% zLOug#zyEKW{dDLO2>(x-{W+*x!tAg6MvBQFs700kwyD47UNZB`0Q=X?d_$P|hV>G& z&vBB74EYsg$k(6_FyxsLkC_VWfVteIO-8)RUe=$a&sN742qWGMDK-oq`+v@cpPaDa zaT@-=+Jtwbi60l~UtuQvoshy+G)6Gt=L!>^T%Lo>c-nGvNoIWXA4vw=%`=hbkdmDh zX0_6LNOt}tK3KgYA5&*^JwBJg*6aBPw&;V^%@gs4ZI(%Vu(~xL8DKS{4aH%ka>!c6 zD&G)~R2rZr%y#Hh_?pNIz-x781F|_XE7=lY@Q9SPmGPzr7hTZX?o> z37$sB4P(H^dC261VJdL>gyC|)fvj}NKH_PZPe3qS5HwL(K8T zrU}ei*X=eJO8o27gw-&|$E8mb_F;GXYB5ciJTO5?nI^0sa+=VphbFW6$q>_oivOl* zf*TD?*Ahfg2`#~ia0o3yRHNJ52v)bY5g3#OJ(y)I;Jk$h!!!e8i{Rf^m*$RPK7N*h2$m~O@H>|I6j!p<~{Tt z88VeayY@H@y_<}ULuQ=9=*$CuTL2p36tshm59B{8H0WtFr1+METxs=1}USz5)M1rCQhTxzLVIsMiJrmv!Wj=rFHP?geNP8#%b4*F^~ z_1&O!uQ7d&QCXqQx_!`#`9_7ea{hu+V-ChAt?4s0uh*z3|5*8n^ua}YjoEXwih+)p zUg@7%Ik&>Q;NxWvq<~81ESNpe?MB5s%{06Vv{~hI{l1EUN@*tgWI?j$D!smBefg_7 zvwXe<<+Cd1&K&e2iGvTtiWYK=S=72xjK6QzKqEi?D%no{ig*8<+h_U~P?5>P=2pz| zY12VNAX3o^a*``j#_-JiJ-y!fF z0^cF<9RlAW@SOtRDe#>F-zo5&0^cd{odVw}@D+it2z*80qbpfG6oIb@d_~|Z0zX6G zX9)ZZfuAApGX#Eyz|Ro)8Ni1i!&?W1awhN*;_RtHp)(WsJj@hfmIz%UW|j15Ab2=R?d)~TaJh=n)SNmq#wr;vdsOB`R8 zIKC`#e3|~JGVo=IF-zo5&0^cd{6@jk^d_~|Z0$&mMiojO{z9R551b&9V&k*<-0zX6GX9)ZZfu8|< z%uq1S*nG*tTyQWw=ZSEHB%}W_fzLx6hC=^k0-uK*-zD%}D4+0M0^f!53C|_)T_~UM zTms)k^=BX4CjO5TX;6p<;=ec^i2f-g{-==mpF-k)3We;glbUZ{7WJ6FNMUv6cYbZNc>A7@h^qMzZ4Sx(s*)w&j0kx@j3s~Gsoxr zPtP2m^FNIv$LIV{&m5ogKRt7N&j0kx@j3s~cyfHs|Mbl9Isel$$LIV{&m5ogKaC^D z=loC49G~+)J#&1{|Mbl9Isel*a(vGJ^vv-&|I;(a=loC49G~+)jU(|tg~Y!U68}?3 z{7WJ6KZV4<6cYbaNc>OZ%JDh>(=*5C{7=supYuOGb9~}|2k0*czX;_V&@Vzq4&#Wp zGY9m8XM{wd6lRH#D2|@9DMV=;KTqK23H&^PpC|D11b!aqkMQ$=?*#q`JRy`v;1{7| z1n?0$M*yFP#2NIQB|@Tfdgl0J1pXMLBHb}Y;ExgbV^BW9j}iD|P(FXo24q~i68H$^ zE0K!OaV35cI>{l+T~D0TGu< zfsarw1wKMYDc&M1R906q^v5x^e-d>)RIoWLIed>(TAF#>-K$|t-r0)Gt3 zC%iENe+G zH%Z`6LivO@N#IXH`Ghw~;7>yN87RLL_&m&&GJszSd>(=WfL{uH9*&bTfL{uH9&-G} z0)H{eC%nZ1e=*7@yu|{4G0G>r#R7jZ%9k=oj+cqB2CAN(o1y9{+y_<9-a}Qh5Tcre zisWV?2#Mr5$Co9JFAIEG;Nv~RN67FIGJJ##-y!fF0^cF<9ReTk89qXWkC5RbWcW^j z?-ck>f$tRfc+c<=GJJ##A0fk61im8h@n=+6`xSwY_Y5B)!$-*Q5iq?Y1P{pqq30|Sl0`w! z*+_{?9l%E@cK{!uqXYN|ogKjEAz3c;oFziCMCdsik|-{f%4E?&{=tGn=qQDeiqKgK zi;9P2@z8UY2+4w>=WOHve20TVxzs@x9q?hnA#|2H$ikwKEF}uFL`aqoJ!gY+fR9}d z2<1|2vP9@8RmdX1dxbPRg`}Y=%n~7KTzbw1#{u6(mJ9G*WPt$RMV18KyT~G-kTg4m zSt2A&P0!ijRN%YG;sHL~VhA0j_$((vXQ`Vk2@1&~pfF2>q~Yl~TXGYAm4iaLw8}}L zqqGX-MenOJM3^bUED^dy2>B2C%K`oHum+P)dTy2+puZf@j|23F_p$@@htS~w{UKBw zpg)8z!pjr*d7wYS&lC800w3=gK0=0%kl`bAIe|X{_<^+<> zHsE&vpNHe5EZ}zlpNCT<7wJD(o;=KzT%`YGScohfA-PEZ$)iL#PI8g{ldlrt6nxSZ z&#+i|m@8!yo&%O83t=G=zGIXK$4S|Q@3=~YQ=}ZiS6~6LFjvYUJOvgF3t^cMKK?2t z564M4gs)sB!YNWN;kj}|m@DA}O?ZYS#KI9$F5$aIiEx~hOZcvFd!x||I z_#ME{0)7YZvw)BHau)CrId-?dN5C45(zoJ;twGDj}qyULVY!grOq@(ABuCh@RF$|HPtvy?~p?tM}o;k(P^ zJi>REIr0eKU8dv_zPrrjCj6>0iH9|koA9feB{$($?UUSuUsWc%3BRh$;U@g5GQ~~! zRghosaF90yGk@$ym!y%n-MGi%F2Fq=_XOP6;GT$kGVZCkZ^B)I+lyPrZQ`DZdk*d@ z+;`w!h>B)rS!^PH_plhXj?O$Ntc^SuYH1rwE5Yx- zvzQmZ|H5L__Fu4=iQk{H*i8KX6N^!A{D{SY1G^wh+JHW3eUp{SJ#!U(ptF zh4t8W7F&(qhgd9t-&Pi*KBS`%3hT)YEY^VEO)S=k-zFBLzNK5iJ#b~g*N6Wp7p;e; zr_jf;WoffxC7f83L+`PAVjCza5sJD2GdW*-Xw|I6Y93G=`c#O*7G3uS)5?JU0oHW<66|w7_JCm%SjUnu2`s7^U0_yVC8Wha{$%m**qRc12QMhQvZMqS$#A-; zkDc<1_@#U%f9?3=Yz6B7G-Ju&3h$Ik3 zL1;SNB$K2&_QIkd#0c7E;xdS!^Hg+rxXd_$&w&UoVbKKe4U39P#sP6lhzla3qLTTY zs=8a!dGG!4-uJ!wlH1j%&advNQ>W_It$X_%xR4Af>Y5^wHz#nYJ2O)5f+Irae_1@)@X28~yfJOYZN+@C(N zI`9iO&MfUyc?hL%#cYN`2Vze_lD^-%_4X9C6=?$9i}8Gk%19Y$&%AhfFSX`$l}C|h zq0ktfUO*o5kVaCRwyqzA{dB?YRe2N?IbovI8~-MG5p+Y=Htj;noxN4mB$bCy`c}}G zHOVyZQA0OAF#o&WYAX(ilTxWkX1}RK?r)b|^L(mW^I?^TYNk{wDD*2V%n2|NlC1CI zL!0`jD8I@>D7`#I3`PAwom^6X>4rY4JTnCfPbE&3UX zHURdJsJSYSf{F^Y&=rkq${c)5ytOyyBf^m83bctVGB(fFnG#_Mf;m;+7rZI;TTpe`~x)@b-N$#kT2 z;=M~i5#5BHaZbHb)%+n*j|BxLc|DHA(lW7Px7iY1;T=nL1VsAiRiQ2IH6W>XXPT6oG@;X9Yc zQ0bv?P!QSukr6eVp_D6c{gH?F4p&j>nH4CflbP&5Nmy8D~GH;>RzV>p%Z7*J&G zCYk0rN`Ks$TryHajpbCvV?d2Ufo8qW{h?hRrJ=@g6yq_Vu4O2isVM#Q&Jq8$8frYJ zG9Ckpt~Mr_EQC`04VLC~4TZ-klo*czH5yctOnptMtnrcN(HcrDF&K{ll>uIpOqNgS z&3&5&WN0W_7$Y$r1B$xDBrEND+Os~GsiCqMNMbw&6m^M7rkRS;#xoaAjL}e;bQVcs zJO&hXiAkmrO=(tg){|p(C~h2#$AF?PG08N)QCgfKuN1r!FUX) zDGa69##85ts;B5s+&CDI0X3DO=-Nl=@Ru{kPt{OkxNR^V1Bzb0*0eF|)iGCHr$ceu zU_1sCUHvu9Z%w{`?DaYnw++T)K+#IWBr6jB`qG?*({w0q8;r+*vKr2{V{+{%s}99& zgYg(pHUr8tBW|EghvK%ucnqj)hEgQFvbm*SwhqN@gYg(pIR?}}?s;Qsjt<3bgYg(p zc7~#r0Hs@7XKl6XP~0{cj{)TXuQvDQtg&71(4n|(FdhRcm!atXgVN-OuYWpMLyhIO z!FX8t=QN0rrsLm)_dR&pwtj+lIz!QSx`I+-JS?|NT+wLVrLCjPUp0N?R8e>6c^Ili zTytFp)XE{%_qkLQ1*E0Kcv!BM9VKZ7K5@6+mw)~83-|Xk7^*y{vLr7OW@N@=(8di6 z^?MwL;Q!2f7l+=Up6e8@)|40z%O%jo8;RDxxTnTZG#wPdEG6rBIBl3<%I}2AS5epM zcsMFa=x1gp)JzrCTgSsuZ~)2DEQV5K+8lW6QKCqa)#r7G(=%8%Q}iU0ROzm$2zXc_ zJ8;Y^8UbhX1-)J!L7X2CLDj^ww~4b8nNz-1Ifzo}t@Ko_&`6vou2Ve|MZ2_mN;>g8 zs#PP-l_4~*p$a=uZtX-FVK^5g40*Y+u=@FFDfY9HSSu<6OEraXo<5ywCKuL9;yeQl z=SugLRVcMwL|-hCOT3;yi8o!>8|!dpwzoAjI~WL8l-U_a&=wB6J*D}z0M$b@XJQ?J1 zMtr_Xx4#H>GCdfGRJr_RVadQz7TKiQ;qHLh6~(5ccnM%4GQ^+gYK%?W&S1EP=bzF7WQ_c@~RyEP$Xz5R8$L5^Su5g z;ZhQMR2BzDb3a{HAsS+~rlAM5__C@pE3fa(tZmtxpTXL9bikA?0)7 z3RhGv4pc~?Wo2PcX*!+In{JTL5ex=`07JFt*@}+6EIJuF$#;j!VK{ttA@hmRB%vOg z5B;V#Psm+ZURI?T6&o_jsmiGvc!zLX;(3FP3CKW(GOd|;u!Eqxg0U2`wi@7F7Hc)w z%R*td-{bA7imuDGI)tHjRYiX>E~HFP9a##? zDyu5IU6mT>F=nml-Y{!4ok%pY(7n{#kwzm{RHfrISi0Sdo14H2m!EgEL1SW!=U@!c z1S&WUP4VwdEW`O8A3YAHYCTz3!_J*Uhco+R}s<@0;GCq1zE zccU$q42za{o*yTS8^;R9jmw(AITrOOS;w~`Mw+n=B(8@{o65DZi%*M`u}J^OrVBR7 zDrGe2AKP@rw+4Kp$MVIr!t*FD+7zL>FYV0 zCfE=aESmodaV4T4>cCI&cRG7;a(tuXOfOVx-jUra&y%uvK#Gnn?+Gd zjG`2dGRG)_Nl=A7V-!(KP?Q{_h!lsSq!>j>yy%h`Mbvdb^@vf_gBNv=QAD;2RAP)G zG8Pp5CPopN6N(aI6p`tms9TI8>NOO_$0(wOHHu6zifB!VqPQ4EWPT`;V-(Ta)Vw3k z=|KnD;TGE-MVB_(H*5x7s#$dgKFnx^O$HE$u!rWm4&YnnvAnuI#DEZ1EQYnccK(LV zwmqMu*xL8u=fUGr;KOwLayr0Y_5AInbXY_O_$8gcy?_o*I#}s2i4GZbNTY*=4*luC zYDu(52W>~dHD^uB8XH{wJ;dx4@q8i$tt6Sx?00PTnX4L*3!X{&&b%4{2UpuDW3$j9 zgAN!0t8E2zSVV^^{8+veUKcYP5C@3tAN7T2IXz0dwD!~-ic=fJ+QOQ_TEK*7ax;-3 ztq`=qYHL3b*^P<|5*!r7W(VX%<+k&CVI;ft36Slzd8E0IQ*1Q{OnG%| zZw+1n2lda5<~_2A4pur?a-&I)FfBA#9Ox#hA-q`h0;2w?`mZ@;Qsrf$GASY8pzXx8 zg>@2V3a2o+J8;2sRvf&QS#33YE=HcFHYBn(JRYkJlUncY(1!SqZGiZS4F8S@%tT(@#*6;eYrC6} z0oqPYfshY!^(HznFA^wx$XS=VVGF!%IOWq0#GK&1Li1!qm1{uEkOMlW(7Clm_x@tr za|*q9up26z-}GZ{H1!cgj=NV!9n?fb7vj3XO?Bi@>k`ymgt6HhI*gY_VF2?Sy_Caq zAF4S&Mn0!Kq~`FpfS^rRb8MzJI`~>nbAA;fR>S+Nt8p(*+OB!F^ySn{EojfLo82Bh z2alS)csMimz?(wweQb{&MQpRIV{kC?K83WN(*h^(a1f9m59iGvI5!~*^GOzRZ`T^M zf(KcH_e_MgfG62iO>Kiagolt1IFFu2yc;=hO5~&~`sS*o@cWmvl*Zquwz^!z>pEon zp;?p9xe1q{c&jbCmlWyfj$q0(JyL|ZmEEM7bwgi=Ut(QPz-{>y+wj9qPrD1l?0xF_JU<1so7f&jPBCxSm@ zors)*88$((JyW=uW5SefX|N)SUYE281QrMVmvm-82Wo zAtU@cw_Tx=*C98%j(*+lIOm+Qpx#{fDR^CQ=hD8H}(rFOFna^o05TA5oSU&EMvTeqj3n!3!ftbo#5lKq3U{7n@@I9Ev%sY;CKNwA|$voE96V4myBmxBY*9an+ zIvpkjK2!cljOO?;h{|~vB4jBufvs-pW%l9C=)Y)E{o3Z$-@qH?kv#cqUi4>Qc6-tt z=Cvcxd#!IECI`Fnn0M@pI*#y`vv{PUz0*Z|si7pelZVQMOAGsTn&5Mqh96Y~H{~CR zCf$ipKnO_F)?1N>z6q?5-=@kB@h1!M)$l}}<=4x83(4Lcve!bQjg zUVpr_Se+g=syW&{;(WzwjxX@^@t>oAXG8gQG8~NIFKjhGA$C2z6=v_~_ZSiDG03Dn zCsU#ct^L4(Z%&Nwoz?_jR#T{l&lYti;9w;hvB9nrs5lP!nx?pDuC9QE(6Pp|5>qrc zNrU937%-{261Zl;$rQ|>-L#}?t%K+q51mk)Tbu#}XB-4v>V-Mg9Egj~WHQIM_T)fv zJ830`P%*V24hP;cU)G*r0j><9fx+UoTNo=2iC{Oc`v|8;orsNq;FYMO^*ti!+6vOM zq*u5{g{DwnXdBZH4(zNz)-;VAju(FUaxk{xs(4g`VlqEDs zZRx*h-usj4m;Z>dzJKVJl220~Dtc$!OW|`#zt4MX)L$yT9Q1GV|1tHImA}N@nZ5U_ zrxu^O^bfO-jd?M6w#U6Q4vu*4cc%wDdeeuKcina&VO{QT=b znSW3JtN-gO9>3+E*S~hhMY-CxXYiBmk9$3MN+s|*|OHl9{KGDSud~n zsoPq|8(06k_p?45=Da)pZ;|hl>+=8e+UG03y8N*PA6@tAs$WetIs1nE$@59?^@VSb z{g2Rhm(<>HXyl*E+Xnve=H@B8Z~yr>cTaD;=IJG0^xIhc-o%~DelXuZ>+t9o0^eNu z#KIHPUSHjAhd!JzKN`z}@wphEl<0nhzq`nDWZ*nUN1mhmBc9XW7NZh+o}o+pi~g1v z>hHiql>hl#jKdf=Nl5k3%`nN=?`-}S?JdSpDv$CGN=Q)XdW^TDFc;B1&0ixIzSiDi zR5tm$NeXI~KoPG=rW<9FHO=onrM<;CN97@u{!IwF4b$G%x^?42#}m|dm`Hj`bkhZm z37w5k`*@4?rlYuT=RAzNKRfak8}&>&!0mJACncSpUUc5US2s#T?fgA(u|Hit+sn34 zv1N%J=Pvii{>$Af{XP_9jIoE+iN~;$g&m|Yo-v4>od13=XUzDqnc7|s-74cHWAx%+ z(L}w`3R0(!|BJmGy?M|HX&5Q5swo0kCG4q;Gw!M6!$4lbKYqK&5}7gI^BH5<^P#za ztl;6C3f}}ng)gA6hhl?*k=2(qR)Mika5jo1rc zk0LmN%j{^%iym~D?Z@HP8lfg;PC`^dYvZ~#sFaekZe}98LO6LG2xnt%0nrLrBR8nTX}W5B(+x%j-f*N$gE$45Q?IKn@uW-0>?A1!DtKF;wEa%dK1 zb(qtbrp&!^tIWNYE&>bb)!Dd?7O(UI0kRavh7$96{-H|*Sb@hr3kt{s_+@~Rr)=<^ z#0Mp|_HB#HY%r(6DSFNR3|#qa*fWAm;#_GH9oszS$x<87MWMnN`HciV;LYBUP!K!8H3L~iG=uKqj(I@9!q)|&X zYL!M^E~sx-ldn+8T-;#pRlS*Vy{fnIIvVgn2^8KH)x0aJHvtPGDPIXiqDDm_v#E7i z5#NhE#kJ3!1YJ^&5`4Q;0pWN7<#Yv9FE5~+u7C`J7f_CpsEXv`1(c&C3P@63KsidZ zYC*rL8=+}504)E1#pSvpljZGDjMrIvADJs_7IaH_);!LC5AvL!a+HKZ$VPYpvlc4g z3Zd=1EATH2)F$Q!3sVpF4DzA~S^74dJ>ovBfVy@@U20tm2Aj+L!twTk3}5v26kjxS zsm~q_r8=V~tQyZaqc9n)Z`gx-jhg)yF=_@3)L$g1lZ{tg-tGTeD;xcVfhIuh z4V14(?8XoIm87g}Xa+IKbXlNWAJ@F&+B$~6zeFXOQDbdjJ`nDExS+B&9& z6EPPks4arR*C=$!pj7$lb-&ftD9>>s)+h>UfuJPf(&>X@#?B#UWKnmE=une%pD4-vqoRERvsjO;{liJIwy z^CWcQIcebOysi?979H0-)S+MKi05R=QpfNnLJYn_^?d~XD2-lC&>pXM1u#BjH$1~* z6{=5`^$*TFvvu(>+OQ(zsE*HHJ3c9l%@y-uq223qM=HX(&`fT`?@^zTGpdbV0%GJI F{{lZ-oAm$y literal 0 HcmV?d00001 diff --git a/curl/lib/libcrypto.a b/curl/lib/libcrypto.a new file mode 100644 index 0000000000000000000000000000000000000000..1c82e016367de5549973f7ef8d6d65a334882230 GIT binary patch literal 3402990 zcmeFa3zVf*btk?JP17%+p<4vHKot4`G*FMGX^nBLuC8wCPj^+Ns+s^}yxgj~)qUxz zy2ZU!O*NCKNnA>Z@8zgN)X~Io9HK6Dq2mx^9ODqjQCG&57{_r;;vxxSOvYg*jAI=A z|9<TY-kv%B!VTA5mjBahNcV03f7xZv+p~AT zA-8W3IrjnisXzGeY26v?mnC!iH^~`AciU^_j3?^eaH*V8bpQIRat7UpUSD?qc88qt z?;q;!{_7vg8Qt7pzDdsbd*ardb)S^nre#_4c&_K8vc|gS+$L*w$&+(8+%IdMiW@yB zYkrvS?nh(|-K*dBys=Ip(VLl0W);az1 zxbBh{%UN{SZcXmcCOPY8U;V_~uWgXC-tso*KEEnw1^4Hlmb0vT^rdo^aqHxZqVBnO z%esGbPhT3$eMQzip1bp-vhJz4R~(jg-Q4Te$vV1!@wp$b`|NI6_jvA)FO_w4U+r=3 zFaEczdx~!TIk$K}M!KaJo!;H^%d+vQxCic#jYaqIeX_C2eg5UL@vAR*Qf||wcT34Ve_l3Kxr6t~ zrqPL?EcXj9mQ7FAy$16>^So=brI$DY^5%Dd+w$ z-Qc5gZs&_n&Aob6&V91(*Iyv#K2`S-q{WZhee)0G+=AP@=Hv1saffb^%}rG2uw z%DsMEHh<_L+5Ec?oZkJX+hz0Pxv$?Zo2~onughk-|I;Jqo&Vh@=C1gfoOe3+{BO&7 zPsAO#RL%?T=a=NXAC+6ZPtNP+?&+2D-moXRcU&Onz4Lufn>+uJH_4NATb})VQMdD} zvZb3l{sGw%+{->DTb`(U`yH|+IIOX4>E^!hZP`Ni$Dfrgk9^6wZ`~$ag8N>NZ21wo zt~0;Etxu;rbx^jx;$i3Ba*J&J_4bd}ee|8OwVV5$$7E}j`=b}j)<-^^ zyKlW$w!%I0+MXxoPJKh3c{=yTkI6HO?yrAAE;#>fKY4CwRWA5RcfYnQ7u+{47yP@u z)$WgOlndaVwPhlAt1p|p7nINSH4G{^>n#6zFD62V{jMlxC>K8w z_p%Lg@dp;m?!g|p_;K8}*L_(|>mGcGY@_?sI@$L7n`PVQE|hIwyj`|^=`q>%)g9g4 z-+o258P~Jsq*S`CS4huA`>NgcMd|s6zk#goBQrN<&w>Nj=U+~1;*LvjAKl`d&`pAV( z***8MH_3CqyI0-i&zKN(&wj03{*UgdrNK)dmdl@R_tqu3{QYnJ$#P%1Q7*4?-?&#U z@8-VqM!CG;uGl#zPslxQO0EcQ{DpGGKLq#M3Ay4oHYE44y>i7K2T=930JS}ef zv(`#iw_9X;aD7+EcI$2!mF?F3%>AC|A`9$4E-Y8cV-KSn6SN@>xd*{oQ-d%O| zV-np>pOLGcPIvp9T=kExdm21=Sg!g(++X&}Ro~xGa#x@8Qn~uV13z51`}J~la8oDc z>ZjAa`I~a}Pl|i+Zn-+R|FKrCej@IB?~|)5-0m%p$nKu;pL{nyA-g9(DZ5YnRPO#+ zkL>=XM}MsDnlrAFYqs25c0K##nkVAwBG>$=-EU3FH9v@ZXs=vT<^Jf)a!tWqi*fr8 z-EDhRu6;7@r>~W3e-!Rj56HDY3ir@Kx%P+XuG@C6ME9KU$aPijs@-xOUE`xaI(KTb zT-VM0>RP$(N9EqXN3QGUKG7rBJz4i9y{+-z2?N?mu2Ey+!w5-YUIx-=EH0-!qTP59|*Ah4f7%j zJEZUFa;pzX-%Hmd_o_>!?=|m~z6Wmkk-7deUMo-8ZM{(XpQ=0DFa7_}-0yx@`hQ&R zukM%rr{cczdg*_f+`t9jk&^3qg$!7C`C~G$Yw;hQO@o)bQU>U-CK28IjWR&@%P)WO z?!G^ifw#X&2HrI%1Hbu*47{f;1NVPi2C#24@Zkq!;3J=qfsfrT1HU~k1Hbbn8Th^Z z&ix1E-)G>5?oTe3fj|4E3_Sd48TiX@)Ek{zV{xW^YH7LFTwHFn7whv;q6-aP@U`Di#{ z#|q};tg6U6UpDdy$;~JmUC1kMd@+%Z%`DW8Ev(Eh*Y->|mqp3r_0I7`HW!=AwV8Ry zIIapCTBRM`p4pSi3kimnl@l$1t=i1eN^PdT)PXbtErIoc{t{SUnBBWa#>R(7Cnpcr znh=44+PGZXZpQDn+I*`%TN|3Vb$n{9)>&>h7mszslgC)hS8I!nyI{j? zV>RG2^NsrA%2KU9KTrN_eYqZ3lr2DW?M9=B&BAvg zv8Bc$Q=vXPtA@@rmyS2uof1CVJl5ze1NW&GatTJ7fY@r6!pu{G0LoI9O_@_ni; zt}Gx?SuIU6HfNES^Yhd7nG*qKge&0X&6!|!^hn-POWWMQBNU=EgH&H`lvG=h%7nB6A;LxbY|?cJ$BI;jV+Bg# zgtCh!10@P3tt`dT8k&(%@DDU&&Mh<+YBS62`H&uP^tKElbX)vJ^A!Bc;N)muZU4wrZE|X2Wb_a#Q3=!ZsCO3oYV~Q?->)pLbQ-fY zbX}d2H1oBnmDaJJE8;AI#GCyywE|CO`kO@z8Pci3;eWO$E3;+)rSOAE!=p!!3{MPB z4IfAeU@%u8m{JC$?Wp_c9o2HfVQi~8@KYr%`$ucbEf<5Nrz8oH{iBF$y(C!=aW%eU z`Xx-$FQ!$(Q(76U7^{$0BcoHphlVFoLIohDQb1UzR80Wb7Px|h^rasI7QxHJMDlb@BTs8=z5kFNV?$HJkKE=K&z!f1MFpV#@o%47+lpzHJlmX`ONE{ysbVOl z@l&rT@?kW(yuf~Psnuz&MocNf(68Oda&w^pLLvRMumWB>Y6W;~Au2q!Kn(>F^PW43 zkj6pn3_->s7=iiv!V+eC%k??5e8!Nadb@+U0md^)fnp|&VtLhMpaCgSW{x*7?@Kh| zf2^_CXxHbPcQ z135H2ijmjhk=uq36ay==ih)+}UEoDVG(tmIY_&1^M>3h@OR8&Z%RJ}Saa*cMnNm$M zRRB^@VmyNCGh{3pQ(m;znptivXW8OacHz)Qwzu8=b>}W&l>qkLxq>-Ch&Mx9S<4i6UNk;abHU-_=-zID(E8ai@z(nm@H%H zfn^aDh}g*i2Q-&4k#lP+76@ZZWivL0>7r+VPV?Aefy8`u)j*hJHs?;cn##UZmrkae zEh9p>jD!wP?O;0QB19mfEfkyN=4@kexjENtw6zt8xa)IrtTlZ{V+M;9Xf2`~dX9zW za`U9m&DfXGxL`_ds53y*HZzabxDZ?%ky$0Wfw{8!^rm!T^)Zc>Ytv>|!XSTPrGw4` ztsLgv%k32u_gQCuV5B&>hP!^Of980-eOGff^t#J{;>3{z6s3*=Da>}QQD2bBBkY1^ z+VgX6L_0owq;?k;+ZxOUHwMil9gk7+UNxT$z1&#!wV8`rEi8gy{bFUlA^S(hYIEo( z7yI;6EoaqS!ip%mC9)&dS(ytMSEoh~3?FnutNp{{gA;>C+~6$`r#>9(k^9 zj5hUaa~Q}IvvVGZp~Fn8Em)0+?yF(2dUNfj;ah7XqX)-aB30m2UXXQ0Rp2od_tloL zKBCE}3Fv85g5Dxst1mBOdDjJ_zEBjf2m&;WiK>e9co8td?vrg{eR-wb@XEA)YY(Y9oKS0~ zvxKs5kmOBky7~&8yAxBW*asU8L&FnOwZWse*l=Cr-rqFMELZb002>B#H8fpDCa2&d z2U2&f`k5-aw#Ug2dXuGjF3=_jHo7*|VCpdrZG)N!L@g0XN+P7bTmra;E(EQZc0jCn znr@><4*oe+-c`(C1v;rpGA`CpVVp4*wH6twx&S8qMMiG* z)ZV_L`UI)sNG6pD%9V`_USCv}AXOI0q%1+XGGBm;3UgSMW>8X`!?|)_VNym1Koy4S z6bn!QawR^1Fmz7JiVSOIkS^I78F?T#k4%nW)u5ORIjjL>P*R`6x$?pSM2bO?;gY4W zT#=Hez{msHe`LI9eS%bRB$L$%%9X{^oNP^yDvM-NmY}HYz{uqI;lW#{hHsftO_ny_ zs>9Mo!30+3#wKnxaXT=QV+GnP%Vb=gj}6BDv9ZI$gQIEWUjinFfA;9`=+JNtBmI;H z85&!VNi3-q#2lar#kP%e1(&z6^@>nTH5bE(r`jJprz#wfyzT`wRHHx_>PZYCFS0?p zP$r{vDk?$JPl7aJF=YZXMvDq;)+(82PVnP%AqF{B1P&GfyNsyg&geH9lv}A8Lm};< zI477n-fGTpz&Ve}2Zoz*R9nfIZRzH#lfo<$Q`Ml1RMQ?7ixDw! zOpN9+?7(PWA!x79PHVB$k<{SfLt_(K{0x~swWJ#|)|!M(7JN^-@s294aW<7i-IyDz zV2jv^F2I)7F=WoKHBK(o7BXL42rxoOq(otF&aLk{XbO9B`;Sh!rLh8(lP1E!ldIVU zu@tc==9lgZg0N%%$RTWt(W0UB$-1qg6T>%;-86h4rD6aqH<{(R#;AbMq^Ol+<~Zh8 zO%chcq&V=?;3Wtq(;(v#nZoQff`~DPte83^FxKzI?Ehrz1g5RggI^wqH1nL3few}p zaQ>@=&otU*I>2g`#?P@hF*sF(IcH;$Tj8BdQ``y9)z8;E%SV^6(%i_UyWqWu`f8 z#&8NyLCS|?gnT%|LpC~zqW?(6KyoCP@j)aJ05(r`T?;FSSj)4pmb5aA(xeMAODoe{ z&CxLeiretb<25Z(KFc81?$m1qDU+NKm@NyKbbvr(rl=rAg8q>dYB3jY^1dq~89x=@ zz%TS&fVK1lUoJr?9P15PiBsR@KjVR&U}Z)mbY{K^wKnkweKM5^5Sgl0_tv zMWj-t^OVn7QeL@T(;6JoAPP`UYH$T8wjLHADd`$1ETAzdGat@+3k?p@PK%5L!!`al z54x3_NQ94+DiATLLdquV5E4D5t5T|hUrC2jF_sjFeq27pQjyX>mIjstEPFu&19Bd? z)c{c0;$c|@yqNA<#{!Kdx)>7I>y*H9q5442?sPGmiv^16;*cN>n>8j#09BABgkKR% z!G$$KCmSe}C}9mT#Tk2gbv>Te=RBcda7PzC?f5j;@)NC#yV$3|riI@QQ9BiGH*^Qa z;!cwD8b3nvG6soeBd+@o#xr;L49D^CX%88aoSRO^*wvRgEC@c%3g&#~C8DYu4_uMe zd|u@6eGH8PCL8=XsVj|h`fWa$Psdw`aMOvAUTR^)NNrc#*l$x4sj|WzC42s@!7_F-I+XBo5m&yh7uH=t1WW7W*M`= zK(EX@-LsA96?0lSZYHWB{*XDp8HH5ZiLiR8axVSymnWm8- zM<=s^6A5xU$5)nTTX!w068g&kEey4}`8tlk(>r5kNXjQB)y0FpA+QXv59L0c_=3(VD79j~d7r}aDwwR2lc8M~>?g`bf@OrK{FQ^|6w4v?rqjveaq7zj7X#1Q*$_CutRz_)2brg_{~OcT(@bj2 z1642cBbHz#V&PSakxp5o5DQfSa!KQJG780Tqo$a(Q6@*I2hQbsl*tjw#GH*XIifNM z9y3>_Q<5rRl=DZ^bHNg*8vS*Ms^Ckkj%}CNVAy6#N3^bN+{N$OQoZR~C@q-`OjEda zYy~4$9BOp&h)kv|vK7ZId_$%jEONnPiHAE`t;I#Gv1t@(iluRX43}Y!aanvIlx z;ds$vZ4N@XIul##PHoQBTk7+lb2!L!=&Rs!& zt$#i3NmB69>~PZ&bJOXi&Ry~3ib5#VquP74=Vto%U=Hg9Z`ix9n$g$WzsGO}uJ7OL zz4To_u(z7i-@C_ZGkykoZ|JY~15>(a+uOINiv|1oo~PQT7jb$54asQDeJ!yG0MP^< z;Q0nf&(Lqr!b!j+gz*YJ;tw$-B=j9;dxxWVI8kGO=JfP@L(|fU&>JL^s)eN{G5qn^ z(9|uig&VE$)3tBzyR%&9V8juqb>S0T1;dFtL z2z;f%#Av**25w^&B^{Qcf5aySwAe64MNh~=i@hCBx9EYp0;epgVFq>TIa-pTjDq#u zZs4j}yM>O^pym?|o~4RP`w<0p&nVtAsuzEZm*yfb*2IW;G9?mC3m^j0T68C}ML*DO zx94~`sdFcq!iJ!Nxi3w&zPhV%Z9)R(+N}i(q1e(F z4hc`!_plI0YG0sYLrWIZI0M`%TQ94IxP*0?$vFVQc*xUrww%&vL9Qg{u-~B*D2TD* zp}L?(+|6%RMjlDTC%i5$V<0l>zTyWDL;=KbP19wm(^$c-Vj!n6h{Mz@ko-&Hn5tB& zxmW^lq#Lb>hLE&*DFlVR+;Pq3l#3AxIqiC_V)M=vEjRioJ_Xbi%T)T>sjRwB(bUw& ziYii`MoRM(6rSy<1c>GWR*#s>CuC!H^ui69LdBGQ1<(8mjs?T z)@~&Z3Abac!q|k<4r*xsq+99bd=qmx9IN6<{_u@$%KdJl9zHN`T}3S*$(9or%=MdI zF`FbjH_v$`zh;}AnK}#9@g|xeB8=(EzM4Of>yCGNZOZD~+nv|Hr#laiEp*e#b!-!M z{G8SvB^cGgDQDbp4JP*OP2U)jMjW^K<2P<8hHqUf_c!dAqS~$UgT0mh)yww)V5I`B zxj8mE3 zm3`?`W8-0sjsMoz_-~Dk`{rJ!^`C-qiYt=ZE2+#r&#TP7NsM(GCqiKE+gs}hZ>}S} zy-E~~tS|a43mmOj;K~V3c56Zu8OR)eVJ;+vRE#^2=rnSWD z(3mo23NzGQGzb?*f&saRDMux(wdqz1d5oRFd92LVhOtPA=H3AA@s#~~IentFvWU4| zk~YkQ9&k^oRC}?^6!P3C*v9 zN8H{Ak6__a_|V|wR0@Ygw3|eXCW$Np3S^7MPSs3$Kt+LkVOgQc+HxJUxn8jp8Yrst zJhU-}8ptTLIfi$AMxo6zyc@#R`{P(;!+*7Ygn7J<|5C&fiHV$J24C=j|J0Lvb!0Um zGYj<@*K2T0?o5oA%)du#6T4~(1fhDl)P0AHyQ9)8j< ze?UXO4>tKm(9n^|+9a+yG-gK@=UU8DK8!$gM9*6cF3wKsX_8U5JgAx`YeP6mg8L#f zSTq~blUW#>GYlxh6ui+^WgeNpu@wlSh7)z-ne^-dH1Ywtsc~uwL!8b8rX$7<;F0)G?*jlGE0#=?5bO17GlBcSi5-)Nr4kztx>3S8(!)%tg+{R8 z0}~+(iqSTOyL_}K(}`+LU$Ht2VXTM3uA|4Ovy!WEiyW;m=&bs*Q_fVnx)f}*mgK&@ zDVh$AP>^q>ZGFh86bF@JxVmgqjttVgSIw!2|B1#4*nrJ) zt~mMV@a&^+;NAGC9HRQtMB)ogCBBAufMpEj^flG}o)xO>|Exe>lu$V11eiA9(xJY8#zPf89ZUDS#*RXa%9==jFe4!iPFb)s(Ch>H4@`0WN?iGvm06yOEAV_jMh z2IASVC5UQb8_aQBWu?y~PSX;pv8Qd0Vr)aZ8?DeJQU#$2VL_{4>#9Zv*1=-2X|SNKj`~@P?;iE62a`%W zVAH7~k1)wx#@vd_UI>vRF+a0$M4HfOiI{PN0+j_2kFC=$nv5_>DYDdW!&^DU*JB8p9hXp-8jWA?%DvSL0Sacxv$VvNI$FV5Js_3N#eR3)Bv;$E`Pb?MPx)db7< zufGqsK@f$MIBTuCbSkVKN;i9 zn_+1R`BE3Br^+dUt~u*y0cF!j-zAxt6)|I-hY)8p``9z!3UX%w2Mq8^YT{VHE9T6f z3X=J50^D%3MfASn0%%1vFFwBf9R8h)n?cpn>bv>G^tK?#=<2UeA{)F;G zz8R1(fZ~9|2AU5=l#?yKu$9y>`GNAS$D9~OirK8TT4Ah2o=1#y>_D_x4&5DPb57{Z z$nnXPJ~@czI7;p5g!0CZjAM29kX#0{B)YixN31p5E5TUNH9BEU6-MFdO}}2Enj%pf z8pAPX6b1yPk8_GcG^=#j>;V4r4eyla+Z|!Be_LMJRK+*Oh`}RmcN#0|iPnokf}{{zYEG?qQetCJwWO zw^*GK@kOja`WKQH@z%6j83htD>E08>5e@7(PuDvQ?&eG#9@D!78JZ?iSl{;ZC?`3I zi_h+9CQG|`s4Da6WHq}&3c93ILBlmDGv8@O%H!UgK3c5uO3%045IP~aVS=~v+(g;v zjnY`iL3`T5B#_Z({c~-fM=-`~6*wM=eh!aJ@}{^GQ-WhfYV(}gL;xHgJ3KOUYi*cU z4&wTD8TRQ^64z?(dWf7Y)F<7!kUDUA1S5+nq&8_F~mr- z+@M3knPnYw(-Yuc#Zf#w-B+O1P#A`_8849vklw9`dT@|ATpx|P%9y>a5yeuGB*f&g z#*?lvKBlubKBQ_gmPk|`ja7dI!xW368dHq**;#N2+QmFn8y-r^I2ufArHyTIA0r$z zjU>6HJXS%EI$x|uLCzte;!r2QW9E`T&iPqEU@PKFWd-JMk!iqDfxDV!u~aT8^s>Zt7^@z9l@ogX7fwRyKeG24p9d{PDn+ zq0~Uyhp`+E5@|x9pj3;ni>c%Uurq_P(CiAz&hP;jUEi8(4~6>AmsTSWV;?;X9%NZ$ zBQxYyDIrm#Fy_V^^0#yk!LvdDj+6t1cgRUMW*Y;Ai$WHT+r;WO+xqoLCV|~&lq|pQ zs(Q@UaMC-CpRCBFXhgngOyNo-^SETUr|D(22$06F9pIUFvT;-dQ=UkA8~T*ziGE8A zDB*{(j#w;);8HOCa*BGH9AD-(sD8U60Stc5eTK;bAuGssy@kmI#z;8q==}1%OpXOC zh$ic=Dnr&Sn@!&jzK^j;_bhAJ3&>5Ea#Euf_URM*0Eym<8+P zz>RvbR*%GEnv|0~E;oDJ?3{DB5kz!NDiW5X(=jfS2Cf2`gue+K1whAdo_0QL9I)WX93Odn{tCX_^U!b2|4IpVLLKUQgb&eqBIqQYT^UFEc6 zUAps_j}BIA+_&OB#xT7%#NNsKX!h3bj9;q3anUB`;y!~Ay1nrR(p-2`Tf<3hXQw}% z{bN^t{kO+B=;@U}Fh%rg zH-Pc{vF#kuqCGk2YEsbasf?FuMvzWbBO;-0Siox;4@V_JAPIm)z9wt^LA7&bc~M(MePT`H75eFw=KM0w$f_Zb)0B+zTF$7fqCTnKa)kn{ zb;$jVmB=dz6%C}TRQL$BiXvJ`@PSN)g<1`HY80&kxejzSDhWk8Ke|pINLRFIK2BWm zWF2yv5}|d&#MD9cN1f^o@if=vz5HgwH zF?5z+Mv2`4 zgEt=zO^h8K*Aj&>CHixn#IbhbocB%RvG39PS%AD$-jG111SBoqO9CJs2|cXK#RGt* zU1()AAFklf6LCb~9*q{hTrtKsoR!fJRG+s{DIM+>pVkCssGj^fBu`b#ee#y$Wykx@etz@`uGT8ih!wx)=rP5 z>S|P>g!;v%S{?5TFY<+DoPOhpI@~*|6bz`=VNKzH(6$Uv5w<)9Qz%#gJMm~yP^PGzo}hq_{I0`W~{ zF3&hrgig3JbTYb!PHsi$g!9lt%kPb0WD6-7NHha5#I@^?j;#gb?TC=3t~Cpk-X<<(kiBPef4@9On_Y!d&ncz!UF(ef&U`o19*vcVM=j!^l zqD67GxCGN;(@a|NN}TdpRY~Snz?9aeS?iozw2aj;`FtD^YUwmEeYMtMv9Sm#qL)je zV2obo*TpPBQL1+6ptiKhG?z9R%+93(X0e=Y@Q86z>{?mg0OAACi@4BV;E{A?1pN}0 ziB)d`(eNY!5_MKD4tcO35aY!2To+gVVmi%E+mz)+Wz8C=aiM+!XOp!DH27qe9}M@!&7gvy-um`E zieJ%8V@waE$!}xUEf*${fEbw>%$M;Bf9;m%)o{JKK{9WwIq~LvXm|);mgR<+94m)8 zF+@BSzjT0}C|^vy7{_G2RP1~ySz}|E0UVSB07WHuP@`ZkrX{}rpimg=J1@#eGJZ~A zf#xyB89HKTtiJ|c(v9m40PBQ^RT8_HX?NPINXc~!%qTpS-}s$ z(U$p(ZE>x^aMO@Ij@N?@3<`1K&%$okJA;^{8K6nT%@chfr8eK3Zr5=UnnB{ph!$oa z{x@>D|A&f_@B}ci7V7O2%3W&Vr;>1oI?!&&;htZ?|NUfL@BOL8=u+Ii4pn2V(ZAF} zs@~C7X3pEDix9*ao-;Q>jD`z?0+B*|u+&$E+?fdCdM_~fOl0y}zzTjfCItlvD`+V& zk}9OTkCMwkwV6N7T1Ihd20K<|+@*-~Uc)FEk+YBjS^#y`UQg-j`D;xD_j7f8BM1A3 z(<NG=!F;UV|%lMGXbiYY1p( z`Fay4rDEpI;GX*RCK9Bg^?H33S6*Eu=5D7)Fe{rs)i=<4ePa2mt^HU}w!CT|cqT1c zq~FmVQXxtC9c=MZE&)B^;-^x$&Jl7g(wRW#mE)ymF7lGg83CrE}c_#MJfG2c2OJyxUo!QsIJx|rhLoKXFW@!6b4 z*m7gU6kVvV)-WDwALqM|8HyJL+@w8-@_33Huv#PzbSfSTcE=

i>rY}9AypwC)nwK8!- zHk$N`8ELS2JW4f#WqmGd6jj6mW90Q+#G;_SxuZ*+c?P+4xdP?}WQF`~xV++e9;5d)R&h0_%=6*%DVBmHem}{Dt+{IdhQaIM=D}Ok15|x z+PaBJCCh9e7E*!{o6$7w8n@H1b zg_+ z4rnW0YC)1%Xs5hnv3z^DP_~_S(?&bMG>m#7BWsRL0J?AkV?C7Ti&Ld3>G`2ZcrxaE z(CBW2F!mlnhrQfxVLc*2v7PiHsf`R;`0ShUz;>~iHlfq=Ui{oNQmJx#NEa1(KhEf7 zWQ%yLSn#Jj3&dIuW@>jp6zUsZ0~|Xrtl1qB%s?^G(1+m?aV#K?G&$)2eGy2_cC^V^ zY!4d$=-xmY{|-q09qs*NF+dj+m>zM>iQi0=yRcAzRX#T;VWH0vz3B@mEOo$J4%M*L zpeFC<>t0i>o4BtBDPNyZNx6{N!E@}~Qz3#s#{m^UeMm&^LMrxBc4)%HYWIuj>w&Yz= z{?Kf$x6cW4!+^nfG6u~U==`yzUMUw=UHSu^rV8b6jdP_x=i2+Toy^^$LCgq@1Z0nybXrIP0${Lf5@BdT0BTCt(dkYXBPW5ksUl|m3WY0TEnoCyg*M5bBq4?JdGSC5fd;gL%9 z!7S9}l!(luoT?qi<6Z?w_c4qGcoc&>8v#Kg6cEjNY#AjPAbmV3nh^DsA?nL*CnhoV zSOnE?5p;pxSn!GyhPj~@$g_^yKOs)M;h_6L0dNc0?wC*#^Qg zgzXr~w>E+pOceYFI0>S;D2q8T32`BVVfvjIjTbSNcwmi_Xm#Po%hdEr2!AI$*FfnQ zob5^2cCj#lnfm~v1Z1_AMueGTv?_1HDH5knQAYP?vu=)ZezYH@Akbg-%Tt+Ul(EC| z8%`tQQe{2>G7%&P%i9_Ytno5it z1BjeZ+Y3)U1~|K25JA*v&GoF_@&GNY$SZSbM9Q4wCuZj=JZRfeme%H?q&+kuW%=d# zP9OT%GVQoxn2s5UBNyM(rX-;aW<)hpDpRPYoYX$dB{Q? z2`#IU3iE^rxG8KTwK0g4F6%{#Iql|-5n>jjNRyVZiXVoX4hW4?TGlV{&9%0$)^C1F zOCbgvnm(4l2!@7^U?HEmWvsJArnj5zb)+J<=G{?y{DIK%I?i_BQ_~E8-QGGr@P0B6 zIpNDaImj>mTuT#=U@O|<)9GaMLtn%Pfp-OPaif7A{K$blntS@;bB>t4bf!maNx5vq z7sRd)^4Hg*{Pmgq^-=zMIdb@>;UoA_6jW++T)7fu;cK+{$S^NGbG;&pnXx320C(8* zlwe}JL1A_QGcu7s*h|gH(*%W_v*I|ifw>y)jHYpCRD~V|BdID*^kv4tMQ=qGe;}qJ zl}d0I+g0u~>E!s`5=yxyr4oI*;7nSnhZyZbV!5y@Q!DpZnI=A&4R6Rj+lwtRZoh_# zoTFh-5zv_h%4#c;L#V@iA=s;QVs*ZYks-xEoLqGvUbcqqe?C@`>G3`)dHM*qm)0%3 zQq&xZcdq>P+o0Rw<)kP)AnkQ$CH0=VX0b^-ubzEP9;-Hn*=e+v_SMQWiy0aKR=hG+NYmGW6&G%a=O+19-UitCAGTBkKfB1)zert%IIu?q@ zzqFIlko}cBesjdgzg!jIUnC}9Iy#2eJoW9R0)}&h3iIga*w7@VA^4T|!KtGY?pLA< zP)=%ZUx2j#ipuzdmw3&V_kUH+)8;$ra6H!mMg?P|!}#slq`=dvzMH=2NIE>XU&ke4vp}}&6RCQo* zYA~sbNK7m8ld8Zk$&sPlumq{9NG4qg%B>ojIBYZ1kuJ5!NeYxxuw-(0;^vW| z;lpF@=bT-dB&Dz$74b|DuS|bx3Dvd?7KwAKDOk^ru z0W;+zKqiL+6mu#7DY*mU(l1aZ1p?%MLXuB*VZ|Dq6kF^7q67DrZ!;LO{#}|3)-_#^ zbe3?6nkS_B*ilgGL3BBNJno9K?ok@2+4;nLqS-GMNN$Gl5fyYhMM-@)(1hcy)e z{BFd2r9ck)XYOH3j>8HJQeh$bkes8%jU06PB@Vqf&{xzD8&jYP92?IvD@L=-%43=H zGaHI=OrnJ-dPX^hiIF0hib6#k%S;>1N^Xp4B{z?3NyNoB!Nn*iPB~)}uN?7=m*SpR z6D=nugDbc;_SNhd{c3g||FVor0D~7(z_7|mV3_4J$eAe-LbI$s^l+s!LfcY(CtZJ1 zv*A$J+88n2BD8dS-gdSAXVux>vF+whE&4HKy^WtN!#euR$})baE8#2nP3_Lf8JxUI z7#fxIkXdL-6w%HEQE=7;IgJaCf?|2zwO;t;RY)a`odEDD%uFN#`oI{kFZ%XDX-rRI z4Djt>hN_Hq8V2vnh4E&$vN-QrYr?!7Z@_zj4}@>fpK zK*vPT###5x0_2Ct1`GL)pT=a$n1Wy6pq%+m(~A;_se%|gn)}jfXz-2;rR*7T2*kra zVqwb2^fHCa_UZ;^w4DM6>Ubbaz|w%l3Ht4%79B!G`+=N0SBlyI{b4+tyL0Ps$M-{oMnVFD7PUOj9LS%!aP25gHf00s4GD!G6_>L zY)X&21+bg2qMUw2po~YYWmeK&=EYES>8>0|24`VpoIHq(6+)KTMt3A?of72!oa`5tak%vHXB^U zabwwBL^i4`7*T%(F9lM;3?Wq&P>AQS4JGGfVdN|yf=x6hje`=VI2qj*wu&vT;^8eh zlQtO?b!KQ%nZYV-402)yh}sO6ba^n&09ZxB1c2Y#6mijmoexg2l^|WA$>FG7#c`__ z&uq@mPuKDD#uVi5gu7!tq-ODhm3q>N#Ngy;Ukb=Q-5KmxzZrqv2+s${*@)KuXLZXQB~Kp`_KB$A4}T`)c$pTV;kvzXfQcT5XWj}K)PrOaOP+T`{0Jm2IQ ziY?usYd9WSS*!p(gzczG(E=WJn>yUCw;|P6mXFf{bjr>!A6UY}kl6DFk51hAEH6!C6+nN=*elRl7wQ5^Xi%g$i)q;1 z4f5K;xjaKanCUIrWD1Z;9Sl#g|LVQ-*c+es;cu>ZNTbX{x{+Sw>9|0;8KXt84pAU+ zsM+{H>E#cNq^h`oczkeT@JJ|H`!M9mA8cmG`|>U*2^SKelv8Rb&$_tW4t8g9OZzaw zs^GY>iA&Ag!-<*Bz6uY$d3I)g^z^S!M8m+u|5%rB{3bxz4;WZWDd2uf+7`bMOkj2M zgwuLeDd4>EgkME$y-wxDQW%<7_JlRexowlH7+Qz1@!`?Q$-^v`{Va!p#&z1fn2GIUUa{G z*lm$JHaFk_Sin3l57e+7H8OZOMX^@q zxj;&|398J?x|DNKM-X~2?&_=WJX z(W&84{{D(9PP99r!On;ny+*EREwi>N{yFZHXP8l+<7LZvq$amok!Ud~qYl<8Qc!eY zvigYHljc-PI4$MEGjlF+*hLkfPLpqt6;Y!Cx7zhboMY#5gWG8iAz)&|%Srm%9xfDkcE9`$1AO9# zc2iqu{Z+m=X1hT8W zD-hlvdAfs~q0Ug0N1QWtQNv^ZZVcuu^t%r@8;x_Q?IvfF8my)%RO+TS6CM5xE9wfN zGYbmhAsCKpqI>{#1Xu9jb){Tlm?4dwSy^GJU=<6Ep6_>FLym_@zzuq0-{e2-^g=0C zy}F=OYb_tglD|_FO}79?56wAjHOFM4SQu^O6%hdyRJpBxr=DhHl{;nyFR);T#EIE* z0f}CBw$1TOoeeA#ATGSPpJ4TvkV z%Q6^Qlz&S&^X+~;*v;>q2J?Hu4#-PFY+6ix;ipcHoYg++I4}`QeAvPX#UDdbmQO!p zxgieKoNZyKoeh*wr2O$je=IY+Q<5r$Fv`e8U*KfxhMQ0xd45q%_t zS2plsvw|!pB@pAqM*Wl%2uDA?3T&$B7s{#o@VjRU!kBr7x}QFBV5hNy>(mC(W10Hn zaVp^QDAD|K?=wye>B~Ve5lM#$2){#eDsC<-kY=gk+>hV-Bv|GXCtuA?hKZp)klT~| zj9_8v0B$e4gZ>kd^ov*tNS6c>=Gx&%OT3|?HwMG+TLzRFpnDc7m#)HrZ*S5C@gxvR zFLttOV}rxEy3J`_w(LUI_~fMFa5RylTCoaHPU=9V0LAeRaT9vfX0d`y)MsSUP!Gap z^^N1l9Pu$24~uCb!~{@2aCO%^Q&54R=4XB!T}U}d*obn3v46C-|M18t4q>_R_sn{&x+un-7*$_3rVhXVL zrDgaVo(EQoQFp>Ct)Wp$Lg;)aW5=$LUrARW>bbOXY+YiDbMk#~&C%|+dhXZ52k;4dvbG3M`EQdJ`_l+m| zRyDw?Nvzt!u{rk`OJD8Cp@XjK1W~6v31@nWOs9#F2;P$soN&~->#krI{PuSZTK)FB zQ3@BVS@qJGB_e80%fBl;h3OizYBb)X}(Zn2!xj4Nu`` zawpLB+R&<*T44CIJ{&}ua$!Dg$hSOipem&!%#Rwcqw**ku14bYx4zbAZx z0DUBiych$rBEffn5Cvi(I{eO}10cxQ^rKv!h5?D%6)-6k=ww+yyq6;b-VA&MA$$gI znt@Cn*%QZF{6?Fs`&1q52cvPr-L)E@0Td4H)RFErCVcxF()jX+dY5ow zGg9h{R{((U?JWLXTES&&{9Re>9B+>ekTMd z4`*^t;y>M=U?C3y2g~?vEFx(v38c3`J-QWKuQ7! z@PK#CUre*K`HsrHtc$r7unM_)$jL5+wLDTV1B*b^Z>3To8EQic=G^Q~hggFEMHSkYU{xZ8qMn_k4T~^OPGW_xIg?BvtWXo% z12!7e_ zkTmz9yZ~od2qy?Ibr~#rI|rfd&$8WiNEst`j2WtZNq8cPJBoa4OM`~u@RX3HQ^I%w zrn1|Oh_yab>UqANXRN%gXDsHC&k!FD6CyPXQJ63uAhIUXBHIjPvTjYFDDL(bi*ctS zBsP9dij77gVKm101eSflEiwFd4kB$?$(GE#Qj}@ia_a=v zv_h&WVp1lSb*eP2UBv033a5P5(qulWIrLL#Co^B&cpBZ424%Mjw;#ihUPDV^i4+W97>$jLsYSRH&Mm1eMOO< z#USrBqNwRQA{NZG{Rb)npQ~g;?Kb;EwepNoqv7#b2mQ$g(_I)Oq?m!iZZEArIi@M|PqTvH~F9gmL0u_HdY(Bl4t?ITbOv#=8dRMp@w)33S6U$Jvz zQ2NKDpoCE_WVs#*2!bUrX`F7gunV&oBwa8Dbdq!7huxA~22m>eSvYTD5krfED6GtI zOsr42``E3ZU3BkQ0zhK)*2)M9>&pBx4Nw6`niSzhER5hOpj$*v5LK8-?z0mZ3tiZM zOCnm_Jhz+?%pR_5UtF`$;DA~-jXMYNJAuc4Gc zj1Z811*I;5IY4nKjvro5p)x`xQwWw!Ay_trXvq|UB~u7in?jB&&+hshtRv(~plcQ! z)LX;iZ(jN#hz%c|x0({5sBR*rdP0@HsNng3{jCHaP(bUe0cFuhrA!~A*V)?Pv9X(u zj=MGc*=AcTsOL@;&|@h&11Vy->t2L-o(bo)4DJJ2Xe{W0*U0$bEN=dHIurFpT&m!r zVFAiXZC47AwjW$Qi}+Z(LR|ohQn^YmCo|3bEaUT$D&F{=Ndg$w(=l;`E?#| zf!a8GEGl$#uFzwukXdpP4_hMfc#yKbCghjP* zl~Al#&(twO(I;T6xI=MDV$~VP(M4zmrjMaLUt*rSpT@BMnu}^@Ckwl?GL7<@LHd>s z4tHS#5PNV|L*$@DwN~2r9WwfjiK&HxM^YjZa@%4)zbxca98ft*yyDeD@}A-jF6R8W zrGm4HXs1|sc(rJ3Vr1%8-h=dOj76+KYhD*I&FdmqX%5os4y<%x1;hV(Z`tB-EVa7? ztG7RJ>7UR*DLq*`G>p@-gNOCEKX@4|N5rz-oL){M4J2m3q*B z`@b&D9F}VC;N-|`sPwF4mNwtsbCk^$gzWS+J?JUGRF^|hYXOeUfc4VRMj%Hrs-z7+ zD$Adm4~4&jrM#-D9`RXBJ$QoA)NJx9>o6IQSBFvRTZ^rQ)=FpcRA&?$TGov zgJ6xPr$_c5of`H>7cCQEMlCkbN>6-_s~9vr@x@Q#m7W6A#jaNenbrd9NgrJ+Xwor- zjt&b9G@yO{MbTpD%Bu3C%J4`j+M%K!W$C%_)l%o+-i2`^Ijl-!^2#Pu--hA_0M0QC zVlmp?LM@{uMC(i$)p}EgD;v|r#&QR*JY!9f1DP&nv)Ol7Ld#L&*arhh{N%JYm%5<7 ze!PG^!5=y#Lh-zCReJnI6Jqg0!^huG(Ar3OEaZXTCU1LHcGmTzVy=y6QYfKil z-gOx3q)V{=jF2jdah}7Rm-VHT@J>ZwdsWd2o*LuAaI&fkpyx+%p1_5A9KR&O9`Ynd zG10&7#e{>E6ufz$HjIfoeyI!>L5qN1&om%?4fvo5UD z1m-*8E*_C?-GZyMM0>;9@m9x;GP9^TUI#ac7CU97IBSY$Hy5xRKiyg_vz_PJ76h;f zpc7>_uVulNcC$aqDCXbJ`%Q)tm+OU+;(H(G}=YFue7g3VH)Pg@lp#`QQ zVZs2T9A@yClB2@AYXnPy>WRd%O1G6tX-vM%oW~BPbpf8c!0g$$={|CBWN2_|czo>e z$k2#?sksWTz_fx?;c70m@=!UvUff~d$@ z^zO4wF2djjA9vW6S~_egOTr|qa$$pqm)4l~2S#wdXnYLg8J$gO%!*in)>sy?m`I6H z&?Sje)DS(h{ZC?UgjK`}wCXBiQ6Z1;@CZy&s#aCNWk@wwz^c5QwCu5YLb;p~Hs?NjAA3u|(Dy2vjjvfGW%ZdJFrl$*Hl4VO{hL3#y#WxJ3-l)Fm_CS79M3bGR0! zsyNt*O8n>`F2q@;4oB-4SeE@MtGlPPKv&WSPdH3@vWrT3RCZkNSCiceB!1v6oFE~J zaZA8ehzZKz*eJSfrV@;ySD5$c6AeM!&akW+;Bj}UsLaKH(q><&C{#l&OoHf`+#|hV z6s1ORiiWDMXjEu$`EKUs#mK*IEE`Xx3m7zzg%N9=z>yzSDDP3gQ)UMz~!z*}s z1PTH!A^|K$DBxMd0vOULMldk4h_04;S7yoSW?)!mSUS;Mb-x>d&Ev+>a(#NfF%cfT z)z%oJ?BUS^!w2-WvZIrOhg>&R0hb|dt}0+{t}1Y}8|(narfx)+IC#W`l&JWndJ`3! zR{WX)t}ssB8vSN~C7fkOJoU$RO-@_p46uYM$$)5yMO~kfBNhNh~+KrRGw|G3snL5@No~Upen{s#IH>w^dbm;U4MIJ}6)4@~FjW)Jj-O9jeVl>lQ zSinkXMWlHch^IQZr&(5jxAqg8^#*4sFfn{&>}LFM_u~ju`gO`H zSqE`Zvc;MiGuC-^u01xZ-MI2*VcL>E~3+G2&V0T8L zAUlh3lwTiqCQ`xDN_z=MG^}}qaS{e=TDb!JKW1S3y2}B$O{RgX z>ew!=x{B}m>7>Mojvt*EAH#3bv8_PYnZ09@r2$8Ro~%0irpvk7#`j*yJ-Y{_7ykE$V%3RVN|>w6j{FG3qkUo zG-gd)tFa7cE)k9vl8QJ=Q}y7vvj8PMxv!*+38(>^qGH3PBJ}^sgI_hFp9IEmE1;5w zC`=9y2Jp}d?rFsI$M2rSr{5IRWr|76rL^WM1iO1pGPrORG{2grlD^l~J6gdjd)ow1 zqGGoes2@&c2YN0xvLpK9V;+i=AryD{-;RJ9KmlgtP{OTo{)zVNUY-Y3KnZsty{*F6I zkiGfP;e?sL&XA!Rn5$Z*EeYczo^;60GgI8pGSD#N%DM;8an8BkrYKQc!Csh4SnILI z^VTSg-qPXGqepO@YzmLmR$#TM!TpE1IOe7OHAIO~3P34vZf$yysjfD=pi8I`b$h6| z5wa}DF%U+(<(9C;{UHEcSSHg+3FybNF*jag4r0(f)A7BJujiSFN~dJ=O`Puf(mYQa zoxbtTI<)4JzMsuwa=NLi2j;LWc;Eo;N=@ceZFDFkhYl0{&!VT@`;%^hi6+l1&KuCQ zm^m7nt%PboiDdheuNTLLM!VUJ2XBQ1V<5g&b*Y;?`@`tQG9Hw`3(jc55MqPJD!>c| z8YU~XJ(-lek&_uz@RbfaB|j`*)!N8WAFIq%U$^vCI=!Qa(&YZ?xHRzH0T9l#tuKe- z_QG5a08l<4(^Iz@S? z!ql)zJ8EI0z0jC#BHPNov$m+{-7%|UqXyeJ`fuD6@^#7&hC*z(YTyEhA};OIXdv<3 z%7!}_X3hzmj9y*STF{r)YLg~E$Z=Q3Ro)@GlczW4ZqbGTkC`ZyRQliN;iV6K92NDK zFZ1d(_vi<=$+7N>SvarRDSB){%U*r<4o6p0=={An%8VPBxjB0Sxs@#`gasQkn=Fv- z_K=2@RxemgD%KZ_*HpifFV-T>VrNNWsJeC=^SVMf(T6YM1$OjT&8F{=Ud2Tuno94d zjuNmLgYrc-HsEF@H_aVZ`wA)&p=mZ*ZKuFT}K!hWyQa$H&DK|?$7bCziK z>LJ83&lil)M)KgNZzr=@Ah#>Zhn92vrZZRk%HA}gPtVopH<44_ssy(<@ZeJS5Rg%G zb>5&WZ?->P)K4iZahhNi-r!TwmhGc4mE zVXz>|9)M@V)bKLjj0wxkrXL@cINh|R$yL#dEzlWHPeOL(vb>q9kojbJ%Nl_aSM#&l zR$KE*{&@SQ)-88vQmTX{zg<`ubD}u7?zl@Q<8S{DX}Fss!bDj9qUPW6W4Dw>*Rz*uIcG2j6% zotFj5OC>=$qklT@ZHYTVv zjpd>r3_;rdoV;R6+u{=?qxRgSFgYyf(HSDKZuV462Q{eZ(IiO3$|>R^mz3qkWgf#_ z9Cy61=&_2+e6#aNHPCq^tB{;2oxA%9#VUV7$(ObK5v2%f=_#$fg~iIS@RV8#a_Gme z+KvuSO%4r?57#EgZ*up~D;X>wm5gaTHID}zxlNR-A_ET%lcBb9;1O;o>J~1yQIr$j z4va+P_{a2=;h&n*Z&r%TR{)|<0@k;uBcG{|X$U|jVKq>|+kp34$KC4oO<2zhYRV{e z<)~L!0)u3H+TAM6z>=g<83nza*{>W&JIg3_=BQU%0x4;K^EWCjfh9?=G86Q6^8L7d zQB|U-!%^OIBoZh4xzd7;GOwGzOn>ez*jUc+LK#rqNh+u;BaChGJHn$ zp?7nP)I@kXuXR?4i#tx7Uui0-EkNW2D)CuYlHWinKMyPk`IQF$BQ0vK{iY5}GfYcs z%V_~Wf(SnYk(Wd4Tn2`<2fv+ZIC&K-Fk(e9xNBH&PRweFt&N@^D@v=`MUZi;lqRDn zjMo&2`QJw2bAjQTeUsArN5=5NEGL9~Vm(q}&=ml*&x? zwl@SvJaC>CJJ?))al{-S*^v3>G_E;x@Y(~P$MP)Ycqugf9S>tkf~PDU1L_xfSJYE{ z<|B&X=c^s;-l1{dRD_7MmVzI2LjeE}TPnsF9ADE{c%ylcz+j@ekYs@9(Fy!r!f$)( zLm5^aFMHr=A=n#1tTE5?M1Q-DUw|1xTV+&y(rx22y0!zjtfJI&ki<$s*8aa&% z*L*nmRA;_*tk#y3@hf`58~dC>Vmy~e7^gY*;O;jrYo!1ZR-0a#tHkl!huCgg5Tpu6 zYb|Rq=1x2@P@ls>JCEf?8w>;Y8px9CF3bPvHKhBt|G(_AeftLX_N&b88yiO&X7yraE5&KU!Nhb|Iit-Wy# zS|cCrStGYSXN}0NHFEzAYvkbQ8hPaIHS)GsuaR{hUL%)1xJEwysWo!%@2`{O!KC$OadE1N5l)3pc<)?n-O!@3RXUf<9^O^GEjcetVyVlCC{SmHueC}VY zliiSxOvPn<2w_na-gA2=I% zdbZqs**Wr+8_to#KXZR+8BulT!jTv>hf zx$=Tv2lkP3LPnLfEJh^Z6Jn6mXJlXSx^W=heoG0&l=Xvs`N6we$ zKYNROb>|lO!0|2ev6pR;JKnwp6Osm0RAjRocJ4Ro?m0t@7CKY?T-P(N_8JBU|OY-`XlY*FICeaq5}! zu{S~g|gxNi{x9+zDV9Sb&-5{`XYJs*hTWe zdoPkd_?H*S7d~;3y!Z1L$%ZdpB=Jaf!U=HJ8du|M{iz?%%ppKJ&n(@`B&K zRC>O4seJX%E|m)(xm4ct*mGs?cb_X0&$wJ(`|Qi*;g?=6OK-hg-unK_<;E{vF86-p za(Ux-E|-X-GPk#j1@9mPSzP3xQcyyP%=&@b$nRQo+Y`s!?N3N9B(JSSPKYyh> zJbR^lss(!GO1bY1SIQeda;3cFQ&-CQ-@8&CyZS2m%uQFx-0fG%;Rmmh-oLy`Hhljo zdFeS<%Yh58me=pTT24+~E#G|e)pGZPSIgS}akaefdsoXNTXxHM&u*C*-z}e<+$}$K zVz>1Cv)%IOFYT7A&bUVI-ExiW>$ygxevM51)-|&Cp=;#Je{>Df>sonq+qH7-PhTq! zyy{vx_|Ua-@3!mYJI}dJc3*X!e6(?$Y(90Jto_yNWY7Drlb%li|MGS6$v*+_d)LX< zUA^+~Kkb#xztSsryrx&a{=Qy$({K06#s9Ha-uhp9W%~QQa{QTn@)w8uWND&L-f^r? z9$M{_H81UxOJCI|?|e<4-10!5y!MQKxo~U0^dIh*@BVJT-2Yeo^7`-e%XcmqkXQ5! z$YYle$l|U6dF4w6kbVPl**|@(2M$R1i?|{r_vNz4zMtoZCV0d;NZ2PP*>d|F!noYrpqiXFqOg zeV1UwZ)$z4`n&4tihn;ApT9Gg{{CGxD-?1B)?4NC zoNAAIo>S@b_$q&%Q#~1v(uUo;B41WDKTk0q*H-#Gr+R{WLRkF$3gdiI^+fk1*H>0w zDfp8rKFSmPQ!_r-+wQHr9{u1N+)2e4j`oF0D1^oOgJU4^#HF%zmhwrMd=7i?iT8qzyJmZyro>xs){~MlD z_S{z8hByA3u3l74;5h~AJF2Pbx2peDy`VZ-eIp*_p0r=@3Rw6(T|M%n{Q{zImRPR4rJT`Lc(4xFp0()E~+`XB^~Pfqwkms4&9ELp@hThb0SRy~154_Ne?2_MH+hx*m@@wgMMps??WP z;rZ6;O3y2*&*gbu_0844{%3jaYVogVK_@A-4N@(*dhh$rWvJVhABn}y@o zt6#6)+W5SsdQ0`+@$W6wuj0AC@%ir!=&v+j|FinS9%?a2!u{1R*FwyZUj_%C6o=93 zSLFGjN}s!1e14<)T%O;onx3atGu2{sSG86BTg=?Qulmo`f2sb5aK5|xhw4jOds^4E z_O)(qJ-ap5dTHxi>tEyf&FXD6S#PiSi_rxp7&Po{k(j?tI{Wh z{TEeuK2q`d3;FvI;~UH!d^P=2yMX^y^;gwjR`0{Zv1oe!7VrG$A9at$acvsm^6hW% z{FVIW8{cz!-SxK!K~eop?vj`C6jRxh{#VssS0Ar_8_)0I;qMpnytC5hcdAEz{&(1x z`1~%yeQ)*q@%e+Q`T70o&#FHH=XPLBAFLj%{@6W#QvC@y-cx-D{~ogE z!<9bj{%G~5@%h#kAL$pQ?r9ASfA0|N)h#}ssQ7$pz_Ze7ezY|`Qav1>sui9`wVIw* z zVE=Xt_5`?}fVbV?<=^}vrqrM#Lm` zPiuWG9-{vW?_Y!Gt6ERT^R;lPCE=@DHv%OW?FwIo--#B({7Xyqo8*0{^|?F;giHUD zKe&g@_kLI@_zZ&*p7c(O2A@OtH-x{3)&s0@%cCQJg244*Ws7{!t-^l=eE89|GpmoZfQNQ)y8uqJ|ivv z9B&;r_h>bPcg{PHwVsc+=eIg|p8p8Xt*tNQq4WtnFTisG&rEAv+~NKCttmXzkx!}1 zXluH4(r~^}${Q;G{6O^|tMA9ZLC@>1Nd5lmR4Y8ETjg_G>q^hL6;C z{<62>NNQf5@Y`*@T_Zo(nBLb$lL} z{?qsj`upOR%E{@At@7z2c4yu5Bdy;5Mb9@mxmv$&sBW;4_?@lvysE`V-QUsT^EyFZ zhhKfZ1Jqa9JNcel)t`Rr>#Kf?&(~Mw+pQI!1J(28`G!iLZ)tr?>jM70u@w;iOKNyL zegWM3@O*zOJsc0v^$pc6)%Uf&uXT(4`nPt~uD-3c)cUs8`POplHLd?B&(Z2=#kcUQ zDF0r-KiF_V&1n}vA@Z6Qt(He2Gk->^5zH#{=Q~^ZbFAX?U9buJ=Z!65`tNlaCXe!siLhws5f zU*Fw&g?m_PeVS4>L!i71t$!<0E{L4(7DS~{9(7tmnOnm9aCNCQjK6%|2yGc|2w%1M zZpl&7Rl;|QzTX92=Je}Z-z&9C>lpuj-+(cB`3-#L_AWWMoP$2Xa^7QPf?BtyB| zurvKc#fMbRkKQc#_hxGoXc6M`R#<)bFmJWBxLbN3_CPPjoQ-p|Fz0%?%zW-@m_Kk1 z;h(!(9F^aMv8g`K!Z)cwV?>U3pC#c_2OWv2CSNY-b=8QJ$nbZ>^nAVa?y6_~?_DU> z>>a)ywdPj*V+%z2Y?Ik;j!N4{>SyCa>)U?==dV-`h(&3%+JXJd zThM-~`lagE@cbsM178%MUugYg>&H-*KU00O`upmYEtZjM@jXdPAIt4OC67Z6-)MQ9 za`^u%d3+Fg&y;3P|Gy`Uf23L#O)s~Zg;dEU4`f8TEAwa zv0xw7U!rfszt^`eejd+#twGPx>fg7n^pySlceYmX#qticYcFrz+uCgXV8!QNv`sH> zZOQYk_WMfEx4`*waJ{;9k35_9dymZMw$Zk(pryP6DH@i2%IOI06Sw>Ilt(9U^)Zg$ z;Hl0F{q8iEyt?I<1^KjIK3FguO>5NkJ`%ZqB!o&4M^~}!d1XTu?G~O#dRT*q{d3qK zGFyf`x-z$Z*V;fLwy9yoWuwoI+~Lq(nV)v|DU{-G9liA=E}35I4Nwis)Z1sVqVkcL zX0YC{e?_Lrb=+Z%`x;l*rqGnH;;iZRF~p=!BYvcPyoppW-z?YOba~T!DaS~*39aU@01kKarTmWkPhK7l58cW3 z=u}tYp2dQsDV%Ovr^xd0_W1G1lbMGE`}lnx3(&c)-bG3z#B(m{LH@I?R}U?s1n3l) zTb`Z687C`4a&ufP#saUMM^)s7atUUWxZ0gt+r-6HYpK-FpKFi-ur6V~KZ}E%YT*Ii z-wfkyk|yp0&F}!UuE)Y$gL2r!jTqO%TbSQ}@Ziw1uRy5>aPIv4VnYz;n$uh0x{$SX z943*HdA&K605_;cv@TK5et!@@D0M#@OMUE`UT=!d#X$*Uge0ut*j?Ga-GHNbHlW-B z-bOn$cV>>e)L0VLy?AD5|KS=`0tLs$dg%#U;-bujxigu6A0EaG8Ev&5zU(DbadPVr z)h1?QBDT45=lbkgbS8(pbWIb<0Zbj|lw^S$;|RG9(Ym(it-#H9ftEt-!kyZ^ZaJX7 zaO#zf>xvt;^zfw;#3l#qonjo|F`ik^>PD)g;HT>1X56ff^+Q?3iQ74vW#tu>nHS6dyUEK^;3% zsBg!ec3w0(GSitD#R*T}q?{!|4#8WKc(c_~h7PcvQ=Ds3{fGF!*4dXb?oWDF9cJAVH6@E7J4Csc~%3S#buv#1WOkMs}WL zt$VnY+o0s#fFQt}NyO2a(QtcT7dJ-87C#BspRkwmB15^stIq4f_QInE9&FYlCNjpT zC*;_?T1hG?L3)YD03yL9ZNh5aTVj%}*@8`vzTnj8iKC-ggB-yiY#J%+TWpJj zM2N@5Y1$dejb$oZ8`U}PPV<25na_Zb`nAL{072-znVB4**p)6P%HZTQ+@wyν)&k>ZXy6I@wWQGj|-ZW4wBwma_- z$h@3SlMy$TE#%vA%tEXJGjzFF&>8EC5Lt-P>f&h14Q!N!WozZE6GUn=B}Jby*Kl?g z3O39rJf&L|Bc7scuA!WGg`ipFnuFe4X$bDri4G?0)9vwEnJOtE7fU?Gs3aiieZriY zIVyP-hbIAWWiCQRu?u+0l7K|5OnTDB09TrVpP0H1C{#UmxSk%Urv|1#BNW3u-I?y- znAMv191jw5Gz#Gc^Hm(tj@{v#OI9#=gaJ2^ODUlvG+?n4)PjzKI`w)}VT{;?Vf86R zQ!f%02A*dV#nKVP_BIxly9h_U1()MBdf`C~t=>=QBt!xaEX+i*A&w)BzydX#1hB+} z5stz`&Yj1HI@Th!g5HOy3nLGJ^~4cf5t8ubXa!9?%BNEfU`UWwH7CN3eh`l3Gg>Wh zR8Qz(BZQm_n4Uxf>7j9y^K@0Fyka;Sx@>5;+}r3~Sa6A%uo$_uP0UPJtp}pRPP-Ac zHfGQ6k8>+JprwX}NUkmM0N9l95sI?ewDMp?95kTf=*D@{b4#9TW-2GP}kR zI2Y|W9x+M)2=)oQdh-OGW(~nBj1hW>Pw>TtA4V;lLUA0&K(o{3@e_JKo4(SzMy|E> zg~i^*9P4i`28;(ToMFc#7uryWKc-IHD5R*9IOd91$1q6n;6#S_B4-ifKnEU@F5d`p ziX1%AJ-ayzgZc)h8Nok}z`(hy=t(1h(=VWKv!pvc_x!?{&9g97s_G(O{w%ITLCIU` zF5;`tk{x?W(Nb~33;I%;RMZR3Hqm1eNnI4%nGhDcykrcseZ_IU!{WlaIq+=N@B>GI;qYtqva-3P>9dGiq#JYs+&{Ovi7P%*n#vv7GUyi>Y$wA@7cmtF+jGri zIf(>=WU>&=62k-C*>z3g48%A&_>_@;aIncn`bDBP$C7Hv2hZ8V!P${1o`=F9Q0xnK zUa=5)CB85aO%@1powvLPJ^JT1H|AIGi~xf?bC;YUVk~{(b=k=QS}d0|Z);sAySTFW z=Zr#v1~^VGXAi|Z3YbS8udiw)h#MbMS?AmnHfDIpcQ z3YO_gq^2vuTvsBwu0(QOiR8MjqEPcRm!Lb`vD}7euo&PQr10>all|!6N2;5n%e7kM zWK~+5?P(n&5RSKDaCA#mkG>Z*SxJz~SpyeFHsKWqsmLKM!Of#?tm?2`Q$D%*Ek#{# zf|H2jGqbR)t*S^FAuK9{8!=*0THEZOQ#9m$Oh_2!HN$2L(qTXGjaI|GZ93pxVen=1xZJx+9w;Ii)#8mUocF$zS{a+rE`K(Efz z>+`IsS*YdsP`2sjS-a>m!)p*{2M!0=G2<91RRNaNqerAzkV{>`ySmr{N=FgMCPt~q zpyZLch0Cc3OiaS4$na$#n*r8BIi3(;^khLqw}s-}a`4uIgmn_<)oEB!bcBNF*)x5d z*4*Wi2C9dNmHi~BKezu3s`Cld!Ikia7aS~3Oy1VmQi}s)GkfFR6^bn_fH|=&ul1B5 zWd=hW@hf8};yRe(NIN=$va~-C#MxjQGM?_=Ico@J1)v~w({R3bL4e)`v^L=l>2N`aOudNI|AhF%%`LL1$aIGwy#f{__&@u~gRZANPxJk}1 zpK>6ma}h`CN@>v)1s(#$tDHOrf#=sD1>F?7!4o*3IhEF>{<+?wsGx5{WT0i0+Mzv$ z1O2fTeS7WRvDw2U*JxU5NU}m(E$^*X2#haXc_SD8tSM?+l8svE`w| z*FU;L3*H_WUJBJQ_A|x3GGET3?@!bp6(e^aHqjfiU7yG`< zHI%vbXRhJQbs%#c%v^^u*UjqkOEg4*+?XLyFlUIv8#EL!lZH5QqlQ4tMw&H_9y!7$ zOsC}D5x#N;?95$gNh5n7wmhVbdEOjCEYdq#QGRVQg9ru{k%lhIy$|LaMrsCm!}|yG z!EzA!4!hSzAK~~=`k3$aaU>=$Z|GrwMFd8H9%dEty2SYf-=s$hFJQSSk%^X|qerH7 z9S|qS6aZr$3Uqjf2&}e2QO0d5+TY+y7iPYMWxy{l7&Y)$#)Y`oS{6?&EG@_-#i zj`xN1qb#W2ZLtfVw7S3yy zz;v4spO(TB;-(IZfI3V|b*O6n^RVeKBwT58r@gFm_()8xc$Rm#$Gmf_a};;a$?c>a ztb>w)rL1W!2xz>UU^Zw+CvZ}*Odsstf&|bo9$hLsFr!G~@)Vh8*rLc|SQm{n zqlXTU>XkRU#GqJx&K1D4o)&OgluknPVsxS4<0#MUP0NcFO-s{F_u6{(l24V-*|ek8 zI8JxVRqd28nyqG!ZEuYdOv!aW7WZ5b%Gr>%!y?HqinrAtD##N|(7;vl^wG3BUhqMy z;*Hq68lJ=ftKfyywECTdfvet0JejX{*XW{$t&?KT7G9)$${+w8Q{9`TQ{gFOzrmqM z!r8Elo(K5L=W7$+z#>ZE80WzpNe{OM-Kw7|{9I^8}q}W;ZsmXr{?4sVO6JzwvUO!lTt8$BcBx_dONG*p)$%RATmBx{$4? zj0pKs=C{lPJ4Xa@X`s1}m z&Y#`ZB)6D5Sdx?_tU(-Ta#Ok&6R-x&JgHDDlJs^m34a4t_hk{iiDfIU;BT%-7ME#L zhrJHX)SyN)HKb6amT43T&|g=g`c(4Nluk9YQOlShE)(lMQ);<})>_wCmL_qn3B(Pd z;OU}R)T2cVQREZfQBr%b$zdHBx%BewN?=3L*m*a<4XTBJUX{moc{pGEsDzIiHN=G) zyl$=}R$X``cY2Fg))!rE#_et+9hjh|CSf8Av%dmlr&T~Q%sqMg)XZdeX6)o>djuC23{RV; zf`ojtQ$Ww5VV&*n$Mna%>pY#yQR3&|K+1PsHKG_zt<&zH!fbg$cm6IExw-QkqZ#fWY_N6C+n``L#V_{*-7+SPil92ca#lW)+Dh8g1 zv1$ybNCEn3$W_7=(UgIt(bl<$p#`nKG4Zh0O6-rCIveLO2AP)`tO6HnIeBrT@ArQm zof)4zZWnfI6XF1rj(t$+EPH&G8AoCl7&~a~nM-O7mD(*_E~FSn3_uVq*}^PtT-t_< zr*ujrXcERUCLilQwmYJGc8{?9RgGx( zTvT>!H0 zZxIYbf&i3FRKS^#GP684d-U9Fg@5>8KErb8kzC~QXJ+u7aYrkN3)g}x^sC~|mNOd? zV=r#GT|G#aO(WEWYtDNc8k}zHCbPwRSi(Y_hci(=5y-tTzc8Gw%Jv{WxLEQew5F^| zSWJ7#BX9mmQ(zT0q`IkNzjvtCizzl-53(?OUXq>?8124HaOqm{rHVj3NFZ4()=Dq< zq=ara<_^EhuP(>%Lbg-5z3XN6m|}YjjWsjLp;!UqGsreR;M3!N#G$XAW%Cq2M~1w; zm}xf_?@SyS(-jH$m2j%?!rO1vHz*iCt=so?(lIf`nL~jp4I|*VkV(RHZj>ezc1#hV zTqBI`T`A})@b$Qdg+0Ou=h^rcr2<`x=-M5L10QlO1f@cQpSkZaZ?V(iN@6U{(7@s# zBRSbE$VJbA#kNv{gN?8L$hv2hk}s?P89BQzs37mAFLOLhO_LHtLqD&cQ=*fWLZ{35 z<9-%+a0@Eovh|cBW0L-`;NTl$bm%gZ+{wizBONUFo0&X$yWeb8f|zoakR(TEdTP9V z`wUKG(GQiFyGB6#B&YGSgW{HHIjKbpQk?H9sQxm(!f)v<_farQ!mr85pmx|00e{F7 z+^L@M%$rk3u#tryjY#2DrW&+4SmYu_f;9rdRDvwGq2H`R!Hu;&H1CLSyqjTzoXE89 z$e0jfV0lFYQv^~?lPV=7SEqs-RVKVjtqKlge|%-VijG*ZA`%*h0HA8=Ypqxt9Lsfb zBaK4s0?6X5Wi&WqgoPwEI%J%3heQ@SQh7)h%u|y9g`t0j#k39rs0n?r7Q?euj_@Y+ z0*<0~3lge#a7g`DM^j3$`1zEeTh}cyT)LbZQBA&($O=q0sqT33^&QSo;qjVEkgxpH zZF6Z6Hb;!DcQekTN70J-#$Esk9d8IFR)OS{N{~Bo3v2=O9l$I|WJGeGIYXULVyYGD zmb3}4X#MonqK!4ow@$@Q$Fj2t)L1%Jwvk|L@LNFYvwQs5nk+;N**1DqAp7KDc}ei( z;NgBb zZ#@ECF--D{8;V6A6W*@e6P!t66lEb$M72Cxy0Trsyj3*Tw#D-qo~bQr=#VP1vRcc^ zt~})k7ikfpJS`HOrv>qb3?=*saVJa2UiN7dqcdZZwrvx7I|!wwXah>BSW)Vp(6c}{ zW>O)|s%{C#y6Xv+8%~0xg&Tn8@=0ybhj61lk`C;7>tb?!!X4wr7pF?WqwmoJ4_8;& zyVX|4Bh*#C$Bvubu(4`2U0;=!NYX+O4sN+$xa4$3jU+${eJt)8QfWW+{=Zz^bQEWYxtMp;^Z((L;-- zJlywDXlvWFqB`hNW?7kO_lGUQ<7mob!>RI?XU{K~Qi+o*@}oB^o63$YX=U)D4VUsq zABu2GQUSqtf|#XON{wcEo*Lu{UwhFX6*;de59X=M!n{9Aw>WP>M656C&F{wtO^HW9 z`Wt|xKrx5UZ1$EmdX~^Afg^fWA(|iAH5%MjZpC(L1wQg>LvJ2Kb2`$&v7s}!rwQMv zM=&tW+>&c2j(1Lsn*DfG9W2@_tbpdku3W6`g7UdLEKxStJ|P8{R1EdN7>8B@C$|JS zgqb9XNjqS5Ye%E+V#^L`rZx;Dnxo-6!R#`=pn42vAg}cMD5Q=rYc)LXnhk|r+N>{} zMP_2T6F(WUBrU<*62!9PSlk+*u0;3bNi?U@$S&%heqEzJ3S3(e-4jZ;yv2kqfG+9} zAT}7rf>a;?GgjRvlQ#*DuI>^oK=hVFNhjiRR)Q+C)H}02i|uvvg7U-3)-_D!lTVx}&Z#-Gx^%=}6a6}raARJam| zwgE+jOOhnL_z`CG^i{O?Y@eJS7!_9ad#drccCu)MljvUTna#`;gWzl~s-pQHDcY&n>E(F-)sD3@7{hCK=lGt-qnV9|p8%NhA%u12YXvbl)U3Zw#;o^)SJ4Gn{eTuwH% zD@ZcMD=?lAQYdL(yLb#wL9vNNE+S@$izmCh*|jyR*Ev6FwpB;#Qk{%%iABgUmt7$E zeq!Gk3g#j|otGtS&z^&cg!Za3h)`@CyNob%^<={;0w{gUIYlMNR%1{y$Pig~EHxzq z$&JZPLOp$m4vsddYnXpEWT~^tx>S_eD%xQ&vievx7hu>sF_!auir^5EbzH0A3AH#$ zQQk7|~5$ zkIAa?!p+Y<3F^eyhz~k*2HUMiA6UJCeIL5;BDqr_N{aVimB@5_Kop>P}LH-KhwA%mGo+10gvK^HRzzF%~CzqCTE*P*^I! zXazWQl+GPA2#_8)<2{8o!Z^Z7TaG2RN5;|%CEnb%-pO#93X*o%ffPFoV+eU*&bSfD z`AYqhF|i7#2Fig=zKdQ0+(kzK#B~DE##oTltli0F!$kE?F1 zp-B)XY=`$x!M-Xf#uvDNMW+reLtc>~A{@Qvd@_7R%15@CgAqYXjujpY3+rJ_P*9rS zd`#dy$c)AZ$c`fBcE$<8Fv!z%wwfzVFBtKz;~W|sp2s2({n3yqOII`0idWK(mnZ3X&(cq%@X?M7avk zfEg4O1ZE;%foWI6KC~JebE)vjt93GHh|5vDbO42*p>9KX*o0QF1*0Usfb$}`ZWt*^ zCO|_RVsmHy5yizxiOwb(Xf)S`cdgK+yGZn9tcK-sX&IRnMJcPdaNw*(oOX~kKtz#7 zb#S2e^dZCs?L`UsY#QPakV0!U+6Ym{x{_*!>ZigKZ-XVgg!X4qfSY2SuXBm1iDI2+ zz5+g11t~LMz%28Dr0z%*4@lm?PzX09Vds6iF8^*PwrW+v7g1gja;UT-6s-M1ot02l!J4!nPNZs zMcdMl_-%Q9ou;y}?$db99m6s=R!Zj#vUIwHw7U-qqsPk_u=qD~rwC~vSSy>+c~?^g zU`Ii6KYKqH4(D#KHR+kw2JClADpUYoYcOP5!<}gjccwMmnbyoAucf%1mg4qW2Eb`) zP|{KWrzPE9OS-+5bbBr7u4x(4_RL~bn6F%KEolr#2m`M{++0|n&H@@Dnu8&BHPoV5 z;u_Bk4FP9hT?Hh5T?K-56%4JZpm?bQ(7Fl$Ybr2hYbpp>Qz4+G3WgUd5Ur^|Fsabr zIOxI_SIoRQ9PD(^37{+bv_?a6xw!@LCK^nyVleU^VrC92F6Po`&=ItkcN`tT4#VDu zGe;&ptnSywC-A#s=^+;ww-pp24#yaqpE97j)KWwyA*3IqU5uhIHpBUSW|HIRM6FbI zS~lZMP=_)FxW-`&KFaF2w>Q5q8>Olv=B7A9?8FgtS)SL*x;%eS(iFeksH3Te`D;{d zeQtmE08VbQ29!>mY44rcdkmV4A!NRXfY;|VVEjU^gf08S5GnoG)c|#|no;52+QRbu z&>{85PCieI7z4cQ$H7@lM!p_A6kdl9M|8OBSm1C>-Hh$v(Ei{(fAs=DNg|fDp!Szj zO36EFfYoAgTFcD$kW_q^q`GZp6o+q*$bzj?)9vGS*Nxmxn&X^n)VVp-Jl2_-=I-)^ z^v0D=6^;iUJ&DgyTr^?3z;g&9bAZx3A_w1O04L%ZAoGk2ky*kj&v!b3&LHO&nr=zW z{1lqVlCX?H#-h0_L~&nN!jaV#8N1N(aHdZknK?OX=^K~>=)w;W(_#!Cv*izrPHQ|p zm;l~!{V*2ujA2wSf7EbcpMi)fK;u<(NjgOrD?MiW(Jd3g=#rp=7_}Eg8f$}EZv@hz zp}cYkN#mF}%<6_!GxPI22Ic6v)gHc$i54Y@$d?c`h}bc#Kv}x0@N1y=Yf$EQa{Xkw zQzS|ZsP`SP%zKk(#k^NV#3R1H^5bbb{=n3(;}lRwDP(*S5|R1%L3i6krJ zu#^ZJvD$L_hwjg-!O{}cP?Y)_#wvj?4>-XjEC*AUN)Q5@GiHu5$kCbUqix*4Ha&GKT2u`!$EaUd@B*#op2LDgh;@ zPN;>{kue&UEYgCL3n?_{NXM14XwQ{nY{VPoiRmKeRU1NeVsfT~B_X(!Q}v5Zst_HF zKi67GCfav^!X3T@5Dw#bdB+l8`PC09>D8{L>I;?qKS_(Q^m6kV4ims3fJ$>1c0WWI z`EFNF(xWXDkk=JiIm%b)ErvXK$0F0E6$u5lz5TctE57#?1{8hrore$6XFmx96j}H# zQjShfb>%9klcRXUXLuaJf}4|g|Cp>r%V;E(upMgDK#@!-gdpM?0Pk6=)0zTc9id7{ zzZ0F20iH-jbgw|2!#?aDj_w%5qUQ8MB^0CrkHCj^P3=u3DD#3rO%0+}_J6T$2dzbudmP4W^JMPgOuY4m~PlQtRQmO8)V*c3rIvt5(K&6FTO+M&0qQWrOPs0-{Iq zBqm&Jfo8=RO*x%;Y+`w-__AvtnU1NTInWLPDtWOV_C-wSZ8W;HpOF6*xy2kr&iT)`OHe8{u~C-Y@)j!gqyPVG$2wN0FjwuZb7 z^tDaYCKNg6=j^f^OBGnu3EeUIFkc4A1?vIp%?|H}=kR;uRu zt*!QZ7rD3-H=qZfROYO6E|V^dkp(HTpO@HA&R|iyO!%a&h%W73qLXcLbVyr^C0xj# zkscCKUt?D3M+ziZf$MjQgolV2n~RzusIA;W9|f74#)1l~#`a@VU)wI*Nls{*9Mlx9 zoKaoMr|-%J>ufGE0m7V|!jGLsvb&34CMxbbiY}=S5z!k2b7$n3jvwsFK$lnvgTrit zbaD$(R|Y>Zz#NJ)6Kpqoz%oJ!a>ECE3B4$s5NtB(;6DYouBe=ZgRN@9BaU$Jk3(?yjT)(Lg>fW!=h_}S_a?(+*+@S@`QaKF z-XIh!M0DXnGcsu_ z+1fsJTY=yl-U7iiBq215#VGOq)htU0)U!p`u-TW-6YxQs4tL9FV;f-<-upX^dB%)#R*acSN%+k7&sD)ZS?I4;ikm zEVm7+Wp%{8t`T&ZtXM-1M?#)>0j|qU8LK=gSDm}4PK^|?1hT|CYC};lYAOc?H0fK< zX=ScubA;>hiy5puS?)S0WUYg;eAQwBsC#1cg;GwH6Qv+`X>WwN0MB+$$-&Z+7YIW* zJ*l%clos-%fo{wSqt#*h7T6CDjG_2Q)S|#e z{{su1aFhj4z`O;DIonNv6Y!SmH7;f|Y9#ni847ye|LDfdwfB4E^&2PIw_qotIlI0>acyNI)8nxx4}+B(533XOz% z5+DprXU}S#tf|}t*K^HfKWCqqv~np5HqXrky$OpE$+V(-aUHkP%rEi8jT&!8<6PAF z<7YwV#Qb-5iA5}yISOa0d9ExK?cO#M5_S^wonW8oD7joa9;8X8nIBDA`nvph6*++8Ygt(`g@0`pN02jC$h_bI5ug@6;REE-kn7-i zR}U|&v5;H_;+2={1d0SRySZ^LOF%)_ZWiN z*u>r9h-EE!!*c~9Sg4>DtR%KOas1ejsC2MfYn=#j*4pK&p2!rD?(|qY_+2}*uwT}F zF?I*LaMoS>_*oXG_yv~p^NZfkh5bz$2r5CcRL6$%=5Bjt24@|>W*(Y$gHGf4gJW{y zDZ{xLt8tF=gHkNR5wRi{-67j==DtQABk%nLD0&J&=BtYZ30PBC`i!vm9YHVQG(Iq3 z)qzuX^n_u~uOZ2!9p=D;N5bh3vOh(V`sQw(>;kA0V@P#U3KB=|cBa&z;Dk9;S_YaC zH5(iy%6C|!U{nF~&3qoUv;I_`AyJmOlNu(HZ*Bn+!=WY#$a)18$Z9OJ@Yw~JHyF)$ zHUDG=Dfc+sR_z)my|j{v5UL^k%W-VLOW680P#%%xpw4c&3%ws8hhi z#L&&?=HUxT+mV~4BSnSbDlYoKJ%(a`64@cPDG6oYqXxp3c|;fIBtVzjCAXT>L>T!` z>xLYo+ul5L>5eebL=ziIhmys`3(DrlRX6i{0ms`S-&G?im>QiRft_d+Yd(nCM;Kn9 z-iLBg8fiH64S#LPvj#$VK*~l^mV|y$|OzxYVeZ1WV5n4ylW~rBHv-`)&4T&uTSHS5r~1e6Y?nhFVli z3)x{E+lKHtRy_(0{QEpF-I7n5q*y-4aTBu?T-YhCOU0+q&xYey>#)SB;L=H8OgBuQ-{h>#XHGzyoJ~3n-_-$$c~8 z#74U%C9L%qHn9TF$(ALq!o|u{lVsoPgh34lD)y-CVv1w#lXP?cMTXdDy&@Hx3^H11 z??}U@gTg0uLE(bW1N_HArtS`G5F^}#aWcHw%I4&jra3v&s_2B-_m9kiAq&ZJ1X<<{ z8IdEH**U@lLwB-0if#1#YGek45^Ug;%%^c46?G^c%}!&c&cxSN_Wz7j*Fj z^D7=Pphx_c09J(<6WWtGENw9Ro$>)w^`yC(UtSwZ%=624I9CV?KJe&X!ifh7u2 zpcExh3%nX7k?vU5`u&<7cLWJxk#VeKDhmx6Y0Rf6dOvc=4*Pt15Qnrr z(WNbHI2j>_WgUWtx@R!sUd6okqLatw0E35K|6B?~FdTHQ$s@rMl4*7(5Xr>pd4@HH zfNuQ)=i)i5ps3dcit82XtN?4A(j{ksTdx_hP_QKq?0C{y8IcFD-JRf}#>8T)QYMyQ zd14XD6N^ZhSj1|HMX;V&5zUf7&@!R!>_4DiX8=n5V=2mtqP!^;AT*vVW8qw3SEva4c98DWBhZyI<17PQT_^pGL^Kv;zUb$r z$)hu)Gq{BBB!*YUgKIIUwL58uPCFNYudej#>i|(k)It)L19dV&dp!h_htnTCdn@Hr8eg#YT zaYQq|< zy$wmsEp3FS=B+7hz$sHpNyL~of~K^gGfx{L$Y)uW#8}0!YH5*Wa4k8*q+Tqr{9~hI zd6j{&yrnU*IBhtLckW8opX3pk?inAH7{BK;A74j0ZTb#L4jMtNp4D<7Uk|jGk$g_h@={ z)_3n_@-#?QxF(gbmx_dgC1z&yI83mA=?52E>mdv7*|6?S@A4P z%(%eAu(5`G6I-!!P}lK#HZDm$4~1Y4l?#1f$m(IKuV>*hI?UaBg{-jP(X(PVwOTy6 zI{Vx#&Mfd$xyc6;ybKh{J(warr`ZZK2z>&~r&(G^8Y^B#pNT1R708&FKHlw2V67WI zeQ?@SK%w|}HkKfM4k~%2Wc4Kmp52Oyhq65O1j(ER(ZrWkG&k&J{<$QEW;RwSXiulx zJP{C$8j0Z3Zr4a5ili|LOhwsbV{~FpwmE|_E@vXjEp~M@?t~~vy4bw{`Rz1^qzD8J zkrG`TE-S+d$EFMI9iRo1qX!3uKFlD?9g41{DpS2o4a_yFlij_y$gl zt7#C^&NO25eA5zxA|W;}IXbY3$=LE{CL^I}>X;Fyu4HO6P;Dz3DS4BTiR91*&51P| zIZ1Xz)RRI2OEfN3&ohAx98h^(bom0(T(|N>?X4Y>fK%;6A~Pp!CqkAPl0&QKVHgSd z*_dZOzly>R;YAdpDABykejV}GRX02i4xTByQ&z+ExsNK(e@bP#JOKy9cm0_ z4n{)MNHXdu2$m+EH%l5%NGZfHFKqa)ofG8-Eg4r(Z{Wv3zVcQHOG%n7GrGI zL6?=dO?l)9CO8ZHHlSwm8O1bC`pz+C}YdT6gBQT^ftmiW4aq$#% zb#o(+y`bnwd81+Qs?O4@*yoZ4;xS7%Af*veC1MmD6PHZcrxat+T+vc$P)b*NGNo`k zi=3uvJOM=!;%&o*s+MZi0;Ga;jJ~vrtR|lW7ne5sI6bUDagsI$GX#7i~sY39Is*s_k3c;ibn-%DeA6HK0d_JJup@n%T8R)C94IApR zl}stWG;}RfSe&NE#pvAWRC43vrgMopGsk2p!(4TWZz!pA)opU2pZ#!XDfjv*8Z6{u zI7CxKt9r%e3KwVbc6Y2Jm*xVe?qD&sBXHKjcBDqQGT7~(_fkr!bci?-k-D2`Q>v!V!ae|L1anOVYg$#HUr(#}9!%;1vjL5bnGH3=N63A)@W9{%*ISM>Z6tf^H z%vDhDCp2f$p)mma44L^KkSHibjcMY(L&f$Zgc&9>QNAx@%d;DE=TgFCrOg*^q(#;X ziSkmLnlu$cld2$u1+QXyjyjPrKvH9z$zO{Y%SDO{U9r7aeQ}LhqT4s=sDh5bl`d!H zPIs{SkW0seB|>4Qfa1?n)&>$|fk{4NgPEXIuM);Wkr%6+CbPmKT>9}1Tk=tlK+NUD z#Pl2#Bxy}S68AwCZJIb^P~(%6x1O5PNtLK>fUHu?04`1QfUJa@@9B7=Yu=U@mX%2c zKG?Bw@^%>m&Yd|^!)<2g^UL{4)RwH4!I9J$ZD7`xq%ifxZ-I&3q8>rAM^auWNTU6;*;An8epr58z*3xf*-p|g%jrCi zv2sc-rcTV-3}e}19pa_A35^8<>WpHkLP{qCB&Eo&o=TKWW=YXmxP)Qsz4?nwjQ*w@ z#u+Kb#N6u(Fu*L}Xs!YLk?uMrS(u(Q7iW}f7fCs?uA@c7RB>ZqL~DR9BF*5C59X~5 zCnl)T;l|cp?%57fPEJkYq&pv6LiAg!B;C|02lrD)=y0Y{mT0$(kH)!AYU}21l4edqYPIJP#ukH!?{jvXx;mECGvAsxf1vzKoAINd@rA zUX40ZOU1xSLY9b;;0l3-mtxV+Luk;sX%rd6SOs^bI8d@-7(ridvLfRKl;q1>vV??I zj0k(OQd45h>X1@XCyfe4U^Xfwf^W~vxRg46AZSwujxCBgmZLC@gLj!}gu+(GQ~6Rx zUzik;vJ;D5%rr;j1Q1*Iur_Zbn8?BuM~kD*zfQ=J+PPjVC^e-FEQ(tUkRFN>SEJ=a z$B;BZa8@dFzi~1Y{G`I8jIIDFz&yTE3P|aYjdVT%uu;=>fOIjPHF3;ktvFpl3BE@K zre`K`04UcCgpWN^-xHkjGGPqG&5}!kEC4FRsF%(4b#C+IDGyho`?+Hw-1SU#ipVxw z7(Nk)m`T|Bt*9wfT%*XYBN!htf4acd%4BKViY0wcrj&xHBZ$eC*3}nl!>CGhHNLHvA9G6L=N)TTwLf=zo#`scx`hXhdbJ=Ips3_ z$mi|`FK!5!duT2&6g9BG49roE)RKiz!x1cR)CeuDuAUElqcWDQsWeSGRnA%r!E410 z=#b5HOYVU!0sNq^bMtgngm67o5?WLtS!&8tT-ZTpVGAW1E>w6?v5?L~eoCQCOnn{M z)|)TV!Uw&zSsZNQOQ{lzl18v0nuKd5j9^3QB3vs$1ncRP&?23@`Rz3BnM(OhS7?Ix z9@EIyH0YU~C^d33B^TXF0k2axX3s2Httg4uV7VIRKpD;NnXHR-O6n;kstXE(jU_T! zgx!F-PUD5WY5G^vy#cvKa}7w1=CZLyW3;bCPYp)qwYP$A>M>J%+yfkMU%EM4Y zei8OFqfC+z2jrK~dS>^i`|7R9@j>;R6n_KKUTCtih^wv}{mLmmxQ^t)f{oA0pnVHp zqYcUc1T5w9O7yHc)+7(eJ_>dfHuEO6Bp=hFZWXf~LDm=esV*}h3NDgMIL$L~j`?ig zjknd!MAo!r7h$K7IQx=x?_uMZuNIYg5ySVO}s(px2>iCJRiT1o7O#W}vP z5>esxt~)k@zq-iQ=nc7~hZnPJ1RhXt~fQ~HSzA|e|1@n_~2gqLaU||uw zJ{eUQ^Kjk3Ch7`Se!mkChizLOgfnX+#JxJ#w;Y92SGTEoF6tkz?a4vEM@h-f!{VF;Zz65cL>P#@|}t#I5&#Yr7@+lP@;!b>b;i@iN7 zBm#1_K3k(JZKQ_niL#eEe9jO8OMS2bDiB?Ai&{7vOLD~eBpJ4;a7L-fqX79l0>*&S zS2+SM#iOvgEFz^SUx+EGUQz|E6)~b&5liMuzNHV?snpJIhLs!%b1CXgqp8?rXeweg zI2D}!=Gq!Qn4{9i8m?)=jw_Yz-~yMC?KoK2Rt=!dNDm`Xzz_ZXj6vVsl+gkCf?H<& zEE@B0V4BGFfNv5@JT!|X9=<*RN5$7AOO)gI*&y%>LLuJ6f&0QR)nnR;a_U4s4a^Uw zJ&rwwi#<(6596#K92>c=2&EurdSlCHR#AxcKK{hUq%v>FHkv}^~{c>ee;XLy|TI+mZ@mVw-w;fP8+kd zT{f(xbcim2R{%}6_d#dyF^gkb_^1yNTK84J0Hg`pQW`XS;DF(suf4ol2+6j&f~^9) zLcE!eVb>3Bwl5T_V(*$7d4EOu4E0j762K zdJAcesbw<9&?ztDNcIr?GP^+@8XR_?V4f*q1wz5kbZS(0WA^NRuCTtdH;?95MBvQj zwIykhWjw`Y&Wf|IhIN$pKZPhrkF9^~-k`*~Ay)+{u{wi{nL2%|2%Kmel@$}BXZl^>;aK{mr_JKuCTaaH& zsbP!QSY0DLk7KTelT13-aoThYgg|uYZR`>-{RZbx-1$zhe{g#Q-8V zv36yxf2RU>U@;-smp7N}Cyy6!XuEu7_CO$u>u_+btgbJkr&S3_IT^?;5|$(Wdh(0z zKLKb8(Q^^#-?45#E+l~Jl915t2@8&^it)eGuA_$pVyI9rug>(*%Akm(M$eF@=1WPw zkx58sFy=y!aikMZ2x`EjR7O1YE;$~0n8+B8iC~$Ip!HRSTP308V$Gdh!PUZSu~7Y& z`3)4!klc!1&G8&@A#vx6I_20*bN0LV*glK75qHFa47V(oZijoxct9D_5*4qB$Tmu9 zK_V{9H%l}e?H(i|qia4gS)5>pbJ_eWG5g6i9Z;EG_>( z^w^o?^~9<1@#M0WC90L3dlpeSKBawR+-VS@GQeqGhJ51aXt#ah_7u)EPE*T(nL|UR z&pe7Vw@U8Qv2gd&C_IN4g)XdRb5;y6UOs6~39mFStU5?{!mdTTyncH=_ zpq3MjOr+qrVXToCb#Nc+R2o1Kk{i=G7eN4Rs6H)>++5Q+);WqvhMXqc88sY-wpt^{ zrbc;zS(QDxaK|Qwei6ovGWw3K3nM&^ZE7+G5wA6(7QrD+V+O$NB<>E*xyKTj+g&<9 z;?#H>*Dl{SV>}^*!r7IXkBG@GO{yU&c+W>eSYQpKsQ`rAd5msOFDF1r2#?4Q{^g^& z)=6CGq%QB<5c52Gl-KeF@5QA}Q~^-BzsP_*zrhiK7*GbruzcL&&3(>K5i?v1jW4k? zx5vb0izU0Xtn@i|_w;^A0YY{`g5J3hQAF|tPBat&jbIdU8!n3&86A-e0#8l1k854b zCcR7v4`^YAy7Ra?wcmG5WyFrnF87x1l8__jo7xDby2yx77#92NHINi zD{cUxE*|PAGC6~bu}_X36PH}lDm9ZQuOvvSrB-EOp<9myaXcr-Exmw?-b8Dh?K%*Sz)dh%7fh%p1iYA$bH`)3Kvr= z7A{B?7cOJb+eCv)mI|07UL~q-9xbhfQjWXakCyScmJ@S_tEn7&*KU3CP-yeam(?ac zG>&;MZ+4+d^cSy7$q}~8yb2{l^#%+F)ovJZv~)X&1DT949wluA&?`3zG~S@$a34e5 zzMzdGqvft^iy2(vo;^R?KZa1A;qSvMX_>g3F_MZC^fjD#M!s`~)9)41+uI#UuPDEP^`5eyAdn=C>yB+AKA6GgBlEdZI<2qvHYF!m6zJ3&1`DJ>9Q zX!k>UILJivR8AhaDgtoeNjMWRxZOc>4N%k?J{@N$X+Zf|gBhc*o}Y`!O$i}d>uK*f zCr+A5tnPHBAUYhRQ@XvBz!M~;^B2SyZTRs;cc>RmZDPnLmodqsJ&w&ak$l$Xyk z>f(bNoSh4Mg%SxvuGpX|GmwyF5wHXhcif4Xq(sQ68T)tfL>C$f?EOo=?BjpbC1jU) zU=HPq5y=#DnP^_5e@FqKy-E%&PfLzW4kNd)IE#~5aHE2J^%g_I{5fZ2fFqe0=KHfS zq|!E_jQ!dDxs%^Q9Q8o%EL>+cdrKQI9?2MvXT?Ljts%s;QCwNj;iJ0*fy)J;^V#)P zo@vwX23c6f0#ha^$tNAFu%TdG3hwWb>uUPKAs}X=4$^P8E`U2%W*5bLwlIg3K$nP{ z54wkj;U7+(D~$Vhm~sSo@Fz`x>6KGutQhq`@2ok^JfSrEhzReXLYzw}b%&tr6Yj#i z98%)h3~}*ZhmlQgSKy{)D2wxiW|0guoK_1L*5ZvTus-o-&Xqomv(?$T99s#OfnZ>?{)ZMGesoFG&c#EnIdvUn?#Ccgi0MUGewjT%oGtwW{L#S5|dmsQ$$y3 zlt=_KN;n`IB_fs^B_fQ%!qUz=j1|+#k-SH91RH-VDasWoYN#N0-6}y;ray&MLh!;W z5wOB45nwIS5C?CC#yqbfP2Z+PzhIll9MWM?V4!jUAnw9Yp;$6hnA=Pt<|WuI)KDQT z*_g0~q~JYY)WMGl&2N~@=T0vt4C_Kf%+g>U)DWTiW`>H49yCaX3X%&$g+a+sVL)t# zB$Ui15wa`;P0?tYFmE9q$xlFn2XCm5u$`fzaMQ{VpxjUqP|lsAp`rUPLq&wlP?5RKP?0b( zR79s4Dxw>MKp7@_KnxWn5X*33sBnB{sK^i)Dl)eiDr!h6JQ*q?t20z2EE*~t6b%)E zMMDK$$xvY~HB_i087joBhKls6h6?A7h6;xTLxqDv{oo88=ki0B%EX`NzQ015lHO==`}?w z+De3&H}T2pk@zD=R5uJorBG%zkUA3OWPCvs!J4!HWL_g^2}2WyySOd{>}@5CAK7g3 zn>)SmqBn}R68eChBHBvK?JOV?ELa>A1sAaCEq0F=1b<d z5b13t<|Eiaf`s7qQX*!`Ia>*(aH=ofWzH{00Txc}4V4_unR6_#j08FQ-GR1}grGNZ zF4#&EDcDLfB-9WIj{`$fTinqwlB7h)sVTOSDAn0YBIb&V2u7wPk<6jk2?laZ(g=9P zY!82uL0d@-jkc2L$RcPmaJ;{WWqh#}M3@6cZAwhts~qBmIs-qeU6ktZtCm0m)53p{ z`?d9q4On+ZKIcYCntz%1VurP$LgPFvbEmZ?z5N#&=Cl{e;aCnJXXh7S!*NS=6v*!6 z6v!_nRKQjeiX*?oQy{K1a|b z5Z^Hyl!fj~y)*pMMv-#|V2hbwU9K81*tr%P@y(SUHa|H(SU-ikUbvv=O)h``YQHD!H^U|%xagorFeZEx6e8hOSS7TqP>LO$B9n> zSc#%X04v;A=7Ih~?%r5Mx+V@7ws0*?e|8Zo;JDHydUXVBZ6-1N%u zU#*+LLF=CG2V29!J>5^&-(2K+c(F{WaZZhLuuo#Yd+#DlaNPE8@2e{-ShHuYMWkat zyz|6mdnb(5q^nrsquv}1tNw5hx#39i`S>ciq5P;7xd1)Ye2t3(`xOdUs^)aC64B-u z*O{RPdAlwvR5I(*mF#fh!gWCf9SCBfmfb4w*tdFHo)%FCE#_oFatmx9*&%DZL#q~n ztX1ougI!wIEz4qYJ&M0_s9Yi2nFRBL&_XDj--_LnZy4E%68pZxMX zLb$En;Tu{$*%(8ZjgbDJAwv7bcT^nwtYK-Y{%G69cN|Sl45h+;xJIqJxQV-137_jN zDuD-80@z%Mkeqr zFHh{oEox{QlS*8mn_L^KdgHetsVy*|KZhP}eiK(WMt}|B+0vBr=7mG_#}aBPvmb!+yuWL<(B z%tX=sI$0uwqtB5!mQrOTWCzK5-KQQZSW`-SD}KtUdl4F&gJxecB55YERcNH3HD_rp zm6q7*7o|bOfqL|{c^M$HQ4{nQ*bu;T=+3NOtOwY~7zsz0)Ff`M_ZmSxOQXgv`>QaT zV`=b!cOm|4_omd^l+GC{t$Lj~Wo5?A<_LFGWYY180n3Ds zbdPmTj5HEDSYvc@<_aVjti~r#HZn|fPE53KYb2e(9Iu%$P?IT4$Qr$z9G#dvJ$eO_ zS5ayKhFp?rHu!h%Iy_;6!b+*Xo>yBH?3tO(L>L^4r+uZx`gz|BIaCH`=rVYkjSrqa zl%}0xjhOP*Noxuhn108;*tZtbd0yiW!j8Nh+n83RQGo&i!YDwYi|OAR3~E12?n6hvJE z)Hz(j!<7*@>Z?vZhtml-phk(%i;cMVqJa-~=(Y2h=gHTVqw7ofZc-PPF`Zal;ozv2 zD;X0mCPOpA!=X;vrGrhWn0r~DJBN*YN3n?An!-FsGUk=lqpVPmqy~-%xX_zh80T4G zn0GcP%^fvV7I*hFQP1_TibVD_xr$oowIW?4>!eJp8pPQ7F<5oNmcA(oJ26y!gh+huiqV9{GJ{P^19Hkzm#_Yrvp8W3wPIy;d3CcteOLbkX211>6TaRW7rh^m?Ys>vJiKLaamPeSPM?|` zTu=i`(I-^Tde#m9r2mG7hYqWUmpv9U+h@}Bb?2c2&%Ai}Q1{S*o2GBVW?$Vg*-VnT zY%@vrayOG?VOTQ>mZWAvv6JhjIZ@3}jEV|Ck2}dhT3&KwY2hqx#m+I<_Ey&eHmk!t zF^CzP*r?d5!!YO})}y`w*l&uGiQ*f=1Atv?+{WqZu=+|A8G%^6I7<0uI=5XN>wt=qBhu{|GE|$p3+1|F?UU9$HZmVb(H zVWn>!#+d+^73G6Q(!th|I`5drv2zIaeq(j08v6}@?6dae4Xk(SyZ$|N;D9g=9XN2a zA}@RF{I^|Q@xPxuP*pd`TUFg8mlT@=KQF$ns-DrRs@Hs_Vvonq4b{}kZo;5uHnBCn z-BRtl|E4n-LOsHNcZ2U)(82$AJskU==#i=tdF!iL$oE6P6E(iI`){H#+bQ^5h~%qJc_ zI{f0#K6-TfD!`xEd2r9}%O4&cp8v$7cRsXdba>>WkKTD`&%~u~-LvySQ2u)NTw*+unZ0 zNALMS^>9_)^FID<4}H2l^pM1YIw212?E{}6=RNNiF5yL#+CzWa9{PJ9slX^A-(P_n zg8BD-{M#P-czftG?V%6vzWg`4FMk$^r2Mb=Ec96V=%XOsd{ht9NA+-f=wqslrZy7e z`u6q))fPX;_s|QN5eS*74pQb?q|9|bW!|!Q)9$C-2OgA-r`%F8zb7tz+ud-sw=dq^ z-ahw(quW#Wk8a=guJ-m}IB$US7C2w_&{gCw$_8_CWcTHF;@_X*-@A|RzI^SMG)fuYa6bc@aMoGr0wp@pK9;CdslnseY*fX z_j#j3ZyOzY2twY5ghe9b?Sr80ynh$OUGq5nf#0DIBV|xnSlT||vrCA9dc&p-T3>Nk*#-*Y*~34|GHP~ z-Lw0?C!>Yf`t_~9xaa+Mdr?P-j{)hbbI@*ksIHC<6kM|N`b#)>-R(0J0nAH z+u6Bp=K&NGzPGmzwRhgJXXm$2)W78xRHva2jc#iJ*?GsVo!{Cuy8RvZqqqp=!4LoA z!w;ttwfNeie7t3B>lJ%ZVV%XWFOQr`s>=Y`tgf z((`x5?)}UA$8LQ0*eCyZ?4Ebu|LCe3yYU@k_kQ>W@jbpZv-i5r)*o79w0$)yJ?cDK z1Z3n@w_bY2v&OfcyLW7BY45J_O9!i6@O|m0_EwNGe&gSbp$6e?;?jYeJ_yaL@$GTw zv%RtRy7pG9y>_Va8nwSlX(m!Fgd9l zOf;4#;;y}%xOADR=bO!IS!b_*9{%jTY4>HcnQX4$y6TYBQv7+wO*-c|1dq@py?crbTzWjIp%+K;L5pDXAe8^F0{E(kJA4KjkudaC> z{#^UT)*in1I%x?%j#iPy1nr@8uGSd75shJI`*MY!v7PtcFt+oa8#>$nV;7x|`J=JN z{7z^4O?&9rLL>0Dv8Vpc*i%2=+4|$o*6($89=v)SZDj`y+4!aFA2WXA+sAKwPv@zB z-+Ah1#-94n*i%0=KJ=FHp+D(t{ZVJ@cY{wjf4_rPcJk6S@c9w^?tRkujlVm7eSGLW8cyl6Gju;ac7_lf{Y_rF_A!%}p0T$xw9^@SN9U=Z?mYD$RZ0he z5B>i5&^yP69-J6@=fu!M8jFdc-7CsV(8Cz?%%buvuk4LZ4*Q9 z+j+~bod_rp0d^c%>TiS0Kr zFGhymGBWfh56+=s-u;xazy5!yJ-+4ILGAI_&PN{IX?^scqgmello6J;NA7RXsqC@< z!9313eSCXq?{(wb^Lx?WFYSH$*!GL}?i;)JR}cGEU*xlW*!t_StQ|9&;k8PhuUwZY})(dyB z{0;r)LtliBkb`10$}c{6H-|v)y>94_#3AFUkDEg%y8`9CdxrjK_`XYbqfgvAzGwLO zRa?ie9X`Hm>-crU$FJEse*L{WtuYMj?)}tbU-1KPJwEkVXf-x;|AX7qh+4c99pPzo z=+LAKg!OB}Q1*q_`82!!3(^sKLC3wKBlJO%X_eeuSN zpySp9=xv*KZwvE@FAZgX1Uy zZ#};6aT?Kwu12X~QF{x=Bfd0e*UFveqns; z*E^S<`#4)Y5T|Q$Oc6?X}J2XMF27$G1oJKAi*QeQff^?)@~Hq`SYUs=hys+y7w{Y#40g zzs|j%sy5M?AG`(SVr2UX#K!LVbcJ?n_bWdr&Eo?!MeKgnpTg1J{Y&q;e)lWiiP!N< zzr6Qnp?T-t58OYo_3?>IZ>S!Fk^0s@bnbc2!|>6$=e_##m;9M{_Mffqnz-@LCT{$| zLr<8v@%K9S2;8~nS8qX~2Kw6ZSO3E}x&YMoSL{Xo-#~+onZwh^wh)o=t&zQl-+JF( z^76m&tzR48dV6QYDa2y6oFvdl`f6WeO9L=kBH2*I5^Pd>FJw4%kJ#()@Zf$lB>2Rc5R)y=D|aVeVVaN zJbP#NeXoWRoI2ft`P(+^00@5@;cu7WQ`jvm7^=kZXf^zjtA;0b4WGIOY01DP)c=#c zH-U?)YU9W6z=){m9hcO~bgHSaT)-8rY%tIn8L zJ{Ct*X5*;LxIjiLIhbC-zu^|!Wg;eGUh)b%{4j^BnZq>_ZOdnHn4Pv*Rvl6JYWjny zzM}Ne>Q34|%PzLEo@b4*%(bQcmgC5JaWsm-4)yfRF4QItXdTVB*=8JJ_8_BB7b{di zyKA#n2U(MH3ytwW87EpddBY=A7G}&Du6uWEQTu|+<1@rJ%{HBlek@F{i zG5!Oph<`W49m@JY8}|YvfSuu$;_Jw|?l;USAfMH#FM=QD$Il6K;{Cw)T#$GW@N*h| zmzExonxQ9z)1(1N4(740tD~7&JW#TfC@d*&06lq(j# ziI`tRr{-{Nu!XMXu)~oV;K=NWaZ_*}C4J_eMWi~3;qfchHY*fB*V`mVQjKM~XO=Y;@SYv4> z_z*oRxC-)?#;q22-rxT7%nD7SS^ixk|5z0@Ts7=`Z*keBt z3K9~&CcLm!7y&ptauI5K|x zn}iqEtcfHvn>uwC!L@p|m2iI2q#1M-Hfx8MGS(0k6DGlYYQiLVjf%E=i>NcrK1C4_x{{@H|Z@5?WL zNpReL`=f+09XbpkJagZD;e6LkJ;_8wV3QzV_OC zgqqc=sf5;VzWF_&PW9?F2$p*FIuLG5O?`{7cmMu-3F}KrZYT7-fa~$Eo#f!}dPkjCLD#HAM1CJ86KKkg-gsin|yAekI{PRviVy8|I5MJrg zqku5e;n+%;*S~)eVcN!xJqSPMQ_R1 z+qQiPb*D{xh45@-(*@zVdb%7%?Xb!Sg?f<+@QfdgpUgfo**n9GGsrYVXay>5x&UJA5X|H zEWDdAyiJ>agyhbhdlDMdtl5nmL&#jU>VCqwjvXH+>>4}v z2ZA9h>p8;L+qMlSyxp_sW`g~bPYMY;#*F!n@Oi&}=LsiIovKdQc=+&bgf$~Zd__3* z}JAi4?M7kF!ZONb`xr6W=vnE#a2Bb=wj) zj~@La;gg*^orLPoKkp*6edU#p2`%4xYd+zgrcG}lTsLFJON7sMEhi9~s%l-rQ}gDnCCu&9=OSV3k3ViFv}o9{Ghx`%6P`Np zSix?UJ zUE27yYHwDrm%6{?j&D+Gq_w!=#&H8?KXmu@Z<`-zo!)zsa@2hB>w%B1{kc;QNB@m^ zrJr87KdSAt$a8*^qwjfl?t>p#UwCO&*dL4M@4DGkesc5rp!!E*Uyo?C?Bi$d9X|N_ zq_`=)cHeSmc1E{j3mOy*sg+;YrgKeufMw8AdKQ{bd`u|t{|9`Ik9NS<#fYF2;ePF<$m;qKmDuAPp z4#c&GJ3shv*9V^mPkkIscqV*AZ^8|Y<}4+2zGKL1gu6d`Y%QVLtjObp&(HV&jPSq# z|Cb5okn?>BUyL7nnvk(>{ELJ?{2aFtdj0n6MZ)qs*ZxYly?sO~;rmBEc!5yx^#D8J zwnaCNBt#yrGm|j*QqDfY($*<{gei`)dW5WQuYW*zY|FV71pgOeeu7>j|$EjF~}r=&7?m5I#%Vaw{S60l)o(1I=EDA;kCn z>`uZrCBfARt-oL5Pnf>^sW%B*ItG472nn8Xf^h3EAAUpd^M7;^;b_CDg9y)VY;qUj z<0rm*iEy&|i84aZ(fi*cjM#N*Jt3gl&)W!_+C9>YuWm;5OwIMZiE;6 zWPML~eA(b?1Y^L~1VUW&b>)QXXI`)nw*OT8I>BYVe;r}u&UYpd<`s4QiBR2@nL+sd z`hj7DCsrNHC%pG`&F+M!yQ;;6v*}G&6VPPDQzLbH8llZyM{R_rb)BCR#tca8N%*r) z`2~VHEvz5m-Y>T`C3I-n=?+3ob?0!xs6ijyOn7TxpG^cyhgO{lK{ZEyO?Wxxca`wn zvDY>eZhY&-cL=FD%X<-q?l!+q7%<_1(S#=TZfHo@|MH@mgq+!T{zkaxmcsi9^=@o* z6QNFx+O-HLGFN^dHFWnHLf2u_OoaNc-(n@C zuc&J#OzUBpMA-b}y=Mtuo@-N=u(J7kV+l9C)A|9z?r%a)5^7I>=m=p#?twhQUEekw zL-@qG@C`!US8V4A-HV6cLYRB;xn+deW%u1c=r^gw4#F*Mvr7px>^)Z!c7|=rB|Nw0 z{Y!+ITWfV7eDueZjf4-MEC?p-`r-N83HN>R%N#I-MCpn7Z_l+jZx0(s$iMr?rwHqBpIC!1?%~F#2uI%h!9Yms_2yi{p;yO^AbeVW=o!Mzi#G-m zO0O$AL|F9uTRRCo5;|-k9DcXPRzmZ6Pj4rL&iUpm!kzcs8cJC4;VU78_V35%5R!W? z?nt;ebkt~fc)B%VeAMkBhM3lRJ(Pei*vC zJz-yy-;NTV?EdvVgts^EeVEYqMAChP#tk++K}cHJ@fSkxGwTl%V*mVfAYt#l2@MDn zBl4#c)_iqx3Sr@>WnBnimUb-&OFpp15*psLG?B1)|7}5p;Ct+ug!0<2h7&r?H9SrT z4EnZ!u;aUfZxe?1%grV{wKjbyVOyK|PJ(UBpkzYcf|#y^hiW{!Eu_PTVZT^EcxTGV zUoSj;pwra1T9?mg_x$}4%L$=5!oHZ*wd&g(WbBnjsJae#r zwFTcs2IRG9`ofy~RKMJ>e)2cefA+D?FV+q3HFEdi*H3KRQ1;!Sq}M)AzUB8X+E3em zu47S?l)dA+AHU)8o0>0oCH(M6olhJ8eB;G_T^?Am`3duz`8k&+t{-r!*`B#=Gper) z{kop%;X6`~#Kt{1`IGCv?@_zuZ%@Aa^6IxsXBXZb_2r#^%v)9R<2`A;-x%8HF5@$c zCTzcb-{=Oz`raHg>2i9JF8}|RKQf1;*67h2|Cc}it3Q87`x=aai-ijtc#dLk!;e^P z;TUE;{%^o~iy8P&SZz6m<&hBJf8zghEbCZ->yN(}{m|quR$#bR;xATAB#r(_42vs* z?yq2RMLhlr&%E&Q7hy@a7D)mv*p0OSCT$rHKK@EOi2w@&CT)=j@ytTXu1Csrb4#RX z9zZu20auYi-MkH{Jb={cW;hpdlWC%t-f3b=81t%A!ua1LY<=Sok``-e%UJXAS9nr~ zkG~RuH+PZv`8}xGNl6b;j+O+aIg~Tf3Z{Rs3K6l?6_qnV@-Y1X(VB>FK%DA@H@!$)8kb?Ml zoj&4OEPsOyZ)Cqx@NUvCq{t^m`!}Fw$XLDrN*Pk

SVhG@?fe(~lK8fTZZ@e+rZk zM9<^uGcqC|4`m4aDMZnG{CNy4lA`-_8k8K=8V?WGAkC;l9)Ie?pLs}%hbI!0GGu^< zf`e8XMfdqx@aT_B#da9yp`CerUI~h`p*Q7sP|S#ehbPI$pSNLZH7+4}M5~eGQd;5Q zAC6TgKcU3RbH(DD%)AH0`vR;heXCjH^Kq}!ba(m{T;5?+MbpFN?IF0M$;VIqnl9ar z$E$HTe-v&B8iTtl4D$QjZwUs>%{w9>jwd$ad* z4JR1e$V1|u6O2*qr3_-tsd$31T5EZNF;o+l{4*=gf6EERx@{OE&r{_IM%2xgmG~;3 zU}U_HqQTsxiF(TTs!lLkL4OrI+kE)s2}VcOP4p%{LQTMqEUPI#Tupc?IzCb@Jqxrn z2Nq#UInh<|z*Z8=Bes#)4r0F&DM{fLRE_`%&Fz#eeq7xINPmYxFBDO!~P zIq3&-={~+hWRNjQd48VAkZ%bibB@k)V3Ch#G1rpHgi~f+(iwr~%Ge4`OBnYN z+k+Rl@mkH-5@x|+Vh7-V!Z~K}UeZqBRkDgN!F&c-ehFTv#3-h-G@gXBgk7Z3Mg9R| zTlrc?i$i?vrq6|Z?STcNq4AY0Woj;xc{^Y0`C362J8AJJG2!2GVnul6i^_AF9{f(@ z5xh$NptCJ}t>bGs-ChDFVwImq+D>{;p595_jX9^#>E|CKRzjcm#H$HRM#2V?=rkX7u=EHs=@4H>H4|C@7+BcniJaoA2rm>8 zULvGzq%q6$nIzFL;Q$e2`^&$?7qd5?S&0%rS}#ajINL>|sNSNGP>Yc)))&OF0C7A^ z&U{c;3mb+IjI86!0R^-vWgI91mI3ww(AH6}Wc@yjcBejPfXD}{v;1Z7I&=6gEhoD6 zW%@ud?A#_$7Qb_sKv~P3hXl$h?JO4PDWazYx}I(iF>Q?4MOYvTkqD(HQAiADj==WQ z$lxG_wa`$#Rp)tO%PQquAy70*=Qe>M`p#1VLnCz-_oO@Iq;qXg2DgmH&3v8a3sojT z^bMl=o&xt<9A25Y}j3tVu#DGBYXRHPNWa zcM&vPt%W7J7Ss+;Cn1CdiUM5>%9NdikmwaV2~i)sItd7%r0t@U5K*Cor;K9t%omk{ zQVQKh(rH>zl%Ejd{Wutq4~R@vodiVzG7WyXJBcDVm7Ro?&lNfew8W%sM*1f@E6VsI zfSpK?-fu#(CjCJRCjX?6@1B0Ms!oDJ3Jub$lPF^(giDce-kk&rl05<&6ao~|n^m3N z0EHMT5$c-vv0wKQdQZ<1ub-;t4$&(04LKgyI1j<;XQF9zr(JMMcGf z;yGal!=MTRtq7i8gW{3T6#PkMp$`bf;}|?Z-v|Fr5TgQ>Pi3S;bb0?##RL5aI(5X> zqj*r<3mshaxzrhHg2p1URwnMMiU(3C6hq1^c8F35IKq4uN`O#9sRRg>O{g70U{Zag z5EXqVyKv}WY66upA^t8fs@I_E2>C8l9hO@~RfoPvRY!C=RVg0manR=>-t0>Aw`nE} z1`s__V2nG3FcY`}z#d@-fLb$$GC~0*1J!A|M<)Z9a84H|g#Pihu79vgcODkqxzImk zA1^cwsVfNeV!i13g;ugfpd#=7q@S#2&YgnDMpjB1>#p;Vpoz$^IHk5ujZ!KdEDKRS zddgtjK$_4X4g#yJ9IY2xj*Nyti$&l9rFN|;M{J(X!-DFi9BrfL*PtA+jZ{>QpzAr$ ziS)1;Y043@mg*0yg4~au{RAzJ1Cc{xp<;^>q);v@ z=t~?DP$ojXKs!RX)C)N-N8Wi2s>MK}N_|O0Mc0>@CaEt$5%K6tuqmqcWQrcz;0 zy_At*CG+S@sOOr##EMpFP)!|Zi_n))IMkdpof`>4-KWkZrx$2J4k%7Yn5d(y@=|N7 zFsK&#(mA+x52`)-k{sC!PdKciS|#))2E@ijJ&7&xSAdtkq@Cc>^dT$S;z>23lMTld z5uF5oz8(;0Z!__MA$$+RuzUPbFowpflfyW7!x4NfkDisy!8R+r?6W8YF?hji18MBh zl5?1SB7gE}q{fYT1+Z|SonL?#>LM(t^n651|>t4J9a2iNZe$ z68dUz$65Iv70tIZj_-+1ZH|EgZJL6Eam=NsqL=#Un-RRPAe;wEr(rq*hi1=mT0)&l z1Mc1F+grbC$CfqRvcQq~ie)x!vgTOgc+{>r4y38gahNqiZ60BX!`oqT;{A#x6>LD> zwq#3Wj&KOd=azYr@|`6|B8x3~Ky0qx!ZW9o0mHFB+}IK2S`p>i=x}YZ=N>bAAzlvGxp3F!A}}kcI`>#m9pzRMQV*MS$M(LZd>Y$DVe{Po4TLsYn^(uBMOI42V5! zjq23vGy;;Krq5+#11r)1+W>Xy9U1`%QPX+4i?&S3Kaxeso-9JPFsWC|j^Zqshm=UIfXWT3Tfo#h;>p-SXku{Kr9g z#+$96f}bU^9^uOqr&sU~7pZ8i%I!zV&GxJyi!H0KIV!8VyD6ra8BU6V-X!4+8vEq7 zwk#u>Kc<8zU)9N0TsC1f+d3_uaLkr9LQ#WLtZMKi$fw{)h^OEvNT=Xe*>vzfOUkC; z4`)mB7g90>f1e}GKMA>%_2Fz79XPscbKs0^G;e(A&$H-pyzFI^4X4^6YKL1U+FZ-M zhx+1%uYbD?W%I<%ew73%vL+G@{%oK+^%XRDT&+}DpzhKI>LqZ8p|}!^7EDMmS7?~T zf=+m<5IE<&i)+vc$FlI**wtXx6| z4p(Q0K1QK=DTzV`QLtrE=rZUsDiMFzM2J4s!YTN0*RG;bhbToMPp2+Lf|-wQiBFNr z{sVvPKk&!?1AmZ;{DVB?AB4It$q`+lB+E=I&7mlpq>#E(N;RT~i4GRcXA9A>A*7xn z+LxJ8x}InXGo$nn(Wp4BIB0Np0?3q0PdU|TPvgvQ@kzv8lMn0?z=&iZA4|&-LqtLL z2842UB3N0GT*k$Mb`a8x|FvPWzVW5<*1)%;O?s;PF`895>mjP zcBsrYN4_!`f@3nKAci0silL2ZVX)u_!yxeQ!J^aeT0@wxuljNC6qc4 zOlqkE@=i)7wRE_}NjyqWJTghDxRoo5PjV|2fL@i-a&QTqeaZ?(Urir{O*`K1Q2YL- z$^>Z$ska3?hP?gfoEx(dSx_m4TD5{hvzp$64*!J;2G^Y`h5juU0>}j#Ja$*J_ndMHE?v4iFW>r~3UfHBZ(#^Z`zYCDi!h`tiw->h?+Kq__O&8R$Q7hJ zy7&QxDaRj3mfs0i6KRZ+(~8hkBuK!di5oO zAauf-*Eol)>p=O=_`YzzCsxQy~HZy3}j5HrmsXn zhCz?1q_0$%NE40Ui9D>R-1=l|C2in;`ij_nbY<1}|0R9pU#@wqmwn^V&p2gO`px=c4_Q%!q7broZ!r;=?`4}v!^J_{~$SooFj7-W{;hiMxJQHRQ1GbzkpA_7x5pxY7Zw}w5#!E1nSu9I7b8n z4*Qhj8oc@f3&NkozQG?48X1+kNVZ8}?Qk4LVk_NPcN|EOv>)79BOFPQw2^M?ZD7nl zqvDTGDoLLk1Cud0;l@73M~x)yIozB9FX7@KP9jOH22M>$x2=ImzI`|=B`@|HgxmTg zZQ#v1t;CHzc8gBScVlHfV(Z6>cXYZ~g*sHW21>%l14=Rqs!T&!uN||C!M`1?f%PN?|NAXG)T1b8 z@P8EbBE-vsfA^tG{n+F)T6}f$5-rZUd5sot-TWxp5#!FX;}^{?f80{qYFPn3cqATw z1rOVww9Jcyx+6xh199R#^-F!-p)jsyKh=PVJ;_ z`ABOZgHmK+{okzN&Kl<@VokKTk{w623ZKL~)?{DI>k4cKxX-6%Jnzv!G{L1AR zeC1iW%t^!w{CX0#K*N;Q?c12WpR1iq?9e7ueqzz=IhQyOy%%rJ<>TGFX#NtllwVfd zRhuT90R));OIu!`)kK_>!-l|I?sdz9eKo7F z4^u!9n_ZXK({fF?Aex?(r0Da;3D`^=reHfHPNKo1Wi(-1G_q|xqbw?K@Z2SyU zioldh25c@4Q*e+28!TZ$%)*pHm_+oj{Z59TCpfjFBSM)YHhhD@}gksM) z;CjUD%Z8lSi_^`54Db#w+KZ*LdNhcERZ&JLbWyJ=lo5A{d&+1(O%=+B?nLo08}ZGN zK)sCOeBGykkwfUwJjae65HodC|sqs zOo)YyBq%>q%M=)W76{!m z)kw}9s1T+?kYei!g=o|aQ)Pb&;zTXWZ^s=pj0R->>F)~4+%HgR9E85@QpEFpMf zY9H@DVyE#SvC|mq%wjunDsl+Ocb064EVj%B;wsB6s+N{h%_X|ag`gf>ixhR$1mm*#yMVDUze`6W?l;FRo{Ql$Vsr;p`8Jlcr z__pd)6DkpF_uteK+2e=UnqLwH7mm+;C3h(a@`yBk$%Val=?cLBF<1s^VeG>12r@oN zg(Yn~+_HZWz5Q8@pNG7#7ud(mZUj0xRYIH#MOqUyp|H z{fL$CC!_gJjPvSKg!{iZ@7%hIdFLB3;cTj6!kI$pil5T?XTQ~g*;Z{L@?JOA*Nt(r zd>~9lWtJP`nFC4t$&Foyv6Y-WZ3;}`c4IxSVI?P5$7kk`Teay~CS}*8@CK1#7K#*8X%!h6K{DayKvDOCF<$WNg)Quly!g3yZCkLdZkPB+86e{^>xG_ zcQzRJ`uYS?>Al$AdvG#a}(Z{l3P2=DZKgNETd~oCW_IHJE%5M5Rr<^f^Y~++R zW}Jh(aoXv0osT>^PCHI{W5zmwQ`RcytO4FMovzcoc}er0!lrYjT20khqmF-IZNKV4 zhJad14Zm8(+5u{yp{9ROwK~-m%(WX0b!s6yRZh9jKQ`;Dg)gQxn=+l4;=M#!Oh{XpHYr1j(+f`qlUtuLG!*ITzj8#U`}`I2M4R)aPH^90~TJo zNf~`OZTI&bVkb16b?UPv;lWDxgC7jOVd157Ki@Q9&H-z6C9T8vrzR{3Z#paZv%{lz z$12;Rr!`yC>&-VDtD8*kz1?5wadG~~M+eqjHMQL{3AeqxQ`x?{*_tN)+onhNdc*PN zwBAKe?e10Wwb1uxH2Bv1=(!>5m5+BmvnrwP{EGu`o7(Q>qdkvSGs=p+DpT4$un*}G4FJ@+vAjx53m1d<}106ecHE8m!R^KO5WDnUwi39w|S?( z8*Ys2dW(|#Y5Dq(`UbV>^6<>ZPL6y%y_0u2gP{cv17tltn!1d?f zJzdXu@VW9GitUk_cL0dIc&gUe0*M}w0+$AM=*+@w`hnAQXM zc&5nr!4!vtdnkW^VnQrDl*d8IMwxmj--5!A!Fnin!;g6=bPuH_C^2T<9t6dTy6B;#g2IQnD#Lmn zSe{S19z=Zf$4?mrQxyvaES3ut4^_V+&_mUi03?t1B7vmn3jndw=u8|j zYQ#`1Mriz8nebf#kQPb9MvWMrGG;_~C^={=X&AJdCT!FZkRS8dXz`tt+;#Vx$dp}jKK!D+7CBDil z5M#jCwzZ&1y^@ zCVzHsDqjT>J~wMMrEtAq&nC5QJ@zM!J}y;Zn3Y${SscI-W}GgLKZhZ<9; znlO`y;Q88FjunNl-TTNyL_}-{*=Ztc3g@piX2FWr9D#e~cL^u@*6f=HczifB~ z46i_jSD=SiK#vOa@Cw}FY0R|Thu2=R?PYj-uO++~q`7hu;d*!RWztDII!eLhX~o3u zE(Xmz#WWTzmE}`qdiC&qlMH7CdiWL7O*?n^6%t>-@V#?@#;U`|i~uuFDI)^UO3%tdKd$A{xsqG4vt4uNsS+A@*zV)R&Rr?z$RK<_%RKzv;}tO$pvXhb zBN!{?CTa9w&)Ev~-#32|cczaSB+^%)r;oKnq>q`UrLRCsUx7P)Rg?#PWBLm8^i^3h zWMK3P-07>Tj5LqHSE;l}qX&DhoIbQqFkNf$aoc+i`Ogts#nQz2;@!O3C~Ws?mRCt< z&n%GU@ny@mqFeIk@uj!U-J(W`+Qg*n=Ix1LyK}^wfv3#!1VOA)xqC$p_E)F_^m32z zc+aXU)(4qi*IFImt;nwepZqEi`BhL=eqFJ?Fp}PGk)*5C9pOSGtH7OKSE@%|0l@Ps z)G2zrS9rYFlV4TOsOvMBV&x!hf0>#-8ycZJ`i?TRyVi!gmPAg=QPUkz2yIi&Q?{#9 z4+#OE&E*O^s}6=go;u)r8okzeWqw zNUR2)x2jX;3KQa({q9hR>;(tgWf?D?|_BJxA<&tONL+kgAYR`d&aN$ zW#M}&lB1|Gvd|3tWz&BcinYrjxe!KEfSbsr`8D*>(qW=5vr+s9ID8ba$QvHVo?{H zSrI~o`b2%vyFO7}Y*_prgJ~9lSB3hN0SixVSFTSbk9usm!cbMrO1gRRT)sY)G=u(8 zm3zItc&#--n4}|SXzZ@1ErB){)+BLXfX%hh=GyLXEz#whBh!I1PEetF%g9`{c{>Z2 zMon1rj1UW?u$4lOoBOeZp3vS5Kk>Q)?})_X-;`5La} zM5r-KL<~^00k*91CU7Xfrlg0fb+1>0ktVFhf(fg!X1tLmrnbL#Zn<~OWdBY16^Rjx z%$W*#7On;}qtJuMysA|HD$6tG9hkRnU|LJ+c=DF@$&+?wvRCqLX@?ETk2CwRV9RU= zr>>Fiz~G@ zK#XoGlIjU6KtKt%x;T%Lvt&DqhQ>eWq@+NU63u^FY3BWqCC51C#y@Y*DB)flsc5sc zYGVnEm5}t7Cgcw&+Mo#(MALidglesgo>=zhN`iHHz+#YM3}Au9h7c=*rIiQ9HtAXn|P~3U@S?Y-bEnz_@SiE#^B&1tP9$`cKlV74abvZ*b!7wWXSk zEbU_=9cua>&HZV&-hxyyAxwfE`O8EbaV}m?_wLq?{s^@QDKu4g>&92p&SYS914<_O z^ryaYK(>_(7WSgQ^RkaTPdV47c7KS9EB8uY@TjO6(Kc$ zP8UYO4C!Zf6 z5Z2;T0p2|P%EQ%ocz5#Ec=$DjN<3&j7+w4bWqMN)HUXo1EeUkX8$GVL{)x7f1We^pgvu{x@aEmg4Il-f ztGMMQNQ0zEl2b4+^9~B|$e9=+nq!CVXr80*j{s7D)^w)E7WXvJTNJ%rDl&i9(x!M zZF;SO53<&&F(_UpM2%sgx~sYxgEHk1Hf9X&x#T!D2IVIPvoR<<4hPYk+)6q`zNoNi zLvaxiM7%#FJ*q4uKd!&|6Y>D^+l-qv(d1xeYZim*wv-ght!reQNT<4%ZrWesy(z&oX#!$mmv^_zeZ{e_I#1z`KjACiJWS6Ja6*$zSgu3##ZJwIvF7 z|ER50xcf)BU{Rre#7cs@f5dF{<@(1f&QELo<5lLQFV{c9YprKP0<<0lQP+Alu_Wca zZsOasX?l~G5Z8Ti_e%xteyM={l6zg{^8Mqr#|828?qS{iBj(PvcwiAxOU+()JoYjk z+VV^VAO3y)@P9t+*|aIv;M*U5i;}&T_dujl%3?b5RrB6PLf$w zP@iI5O>czQ!>nsY$ZY0w>E2=|qbq}1e1zcC=4_jSkxFy zoA*K_3PC{}uy>-DRgEd*ER`CA=F}?=WBnW$q4LG7)>^r~)P^*3U?NK4nP_cE66x(0 zhXgydRULK4X-rLV<{En7DwL2@eZCJw8T`6GE25r3=1n75Via@Uq)z_G}jY_D;}CP;uC$Rp&- zMm2bgR>#f7*VBnEpY_3l&aB4#&LINaY*2%@!i^bm3n~7M8OZe~H$Ric;S5929H}wK zL;{1i!5y;pu(kLLxbs90^L1YHeyGpgIf#)#$LynrY7A#QS%HpMs44Ig*WGW2uhAs~ zJYH%A((5vwAqe_KKT#XcR`8R>0Dq&^;9ucyT!|kVcG`Y5Qmq@95&+(k8_@n5SZphE zMdNp!LHoC5wX;wjRDA-c;)GnbT){sQSTqtjk-OhGEhnX?JB+Swdg4wO)ZjI2mHOUXoODf zP&5E20(3=3hvpPhJbDTn_2;De%!8&y*r4i;)fz)lPtEljzoMsg)L0a%qk%>7I%+Dq zQAf>1(K>1^qC8-<*Q6G81}ef2u^|Ft8rwajM6sI?d~F0TKEne(WKOh6I5iaAuK9wD zYNvbXS5!l%`V}?Rsm7v{@I%W!e)vN85LhJU$C=fEMJF_dHKwAKIX_ex?GLP1%ul@_%K

_`0YxB64a3C54@sfrV3sWXx6;^oXpcVP*6bs2tKPL?_I zEZkJS2~C~)47{m)DosseEwW{W=m*mR;auK?X6;|x19tKRUzPE5hlkU3Ef1ELJ34Jq zr#AG219JN!Nlq(=zqTx=Sr3N?uNY48S|I;QdcK6as?x(L+e*^EJEFlt1g-8Gk{5~DrSI`Kbv z$S(og>gCO621Hb1!-25}Fe+2r*n7b03EDDX@^IWfH}(tUCb#Vyl^ATem)Li}>I&K> zH+CFYeL-sgnI@0yg}SkMz~Ci(S>VPF;&6tf9dToe>*%x}Fij+FpGHtJRz^fq#{OnE z_8>4B`;QR3bdiQ=N*C>L0!6xb+Kp`mCS9z?HB!>W2RKzHX%08WG)mh(z zzdL>Y${@FG957@HY=`5`$6pzRw{%MdgOC3I9&-OlSn1|Xz^_Nn>t_AGFRIK6;)woHP%B}21*F(uZI!|N*?5ghvEXI5Ovu@83Bs(W^YPs zP~uQ|JUr}Gwh9Vs6d!n@V2!6r07S*q{;iJm}Woh5#4vq zXP+D8L=5!fWSSqt#&&3@yV38H)2ynxYR=o09%JnmItJx+6CGpcWgLO1c^QX^aJ>m4 zG%v#CF09j1I&N6v6VBu?Max$$E^f1yQynVUyUm(?y9)Mhvu5A6f_+=1X6w+94rZ_C zYUk0~ckG~Dq31b|HWk_hyLUd`0+41KWCYKnC2O)7?M(T1okyFe_Xms!o~q8H<)Fo{ ztHf9NJemdWpF`I)j~Wf08i1|-%FYHacK%oT-F=s8cY4$gq53p7^0DttA;*Bt3Uw3G%#wvU@!`DLT>umU1q_I}3!q;HS6o`&Gg|t(1HSgxSc9tYH4eVUNnZ=$>nM%2b``#k zg0D{LYY}{%sIk_m!dJ-_S*Ee5@Xg_h!dEv3W8d$JR7WOSM5Y>LID^)ogLdxqCAz4# zb?lk_Fn>7SE(y%YQ|IqO+eSTx$t@p9UIQ{jilqr;LR9E7 zQO%12qty8aQQZR}CHABuK4Ffwjy($9wxw)o8x)X{hvwQ#{lPL!dJR8X1i^oM?!l0# z(B<$aDs&&(6ummCd9_~mYJHVnwRp@oI`-V(;1#136(p!G0Qy}2h|`+3hOE{#k&VZgjKZUjx*a$md}e}vQ9f$?ey zrnU3+(*?Zcb_rk=r@4h=ym%y`6nE}+j#$D;`-nAl`Q8m&*kGwO;Q&0#hi6F_@hV*l zz^r)!+$EJUP%PFYl~vP`POvHjV6HIIC7os>tHKuY(y4cOvQ7Z7f$ zcmo^K3+@DQvx7`KZ_oX&O$QdTl;uc>L7(5p`c?lb&w^nIwhzBl>Q0)$ojg15_e&3l zmd=Ikt|lISYRs1tix^=F&u}S!Ap4NH{KBTQz+ImBo|r7p6QVrNd&-kGd%^Epo)9E~ov~QIfiGTii)vPN73&Te^{~WFmDi4vZo`rdgm3?|w#-pw`1TLZe9g>e zS0Pt%qFl3g!1Nzn#<>;22Lg=B&6w7c*fb2rCFa1gi^T50^qs_7Vg`bP@hjgFSaG2N zt=#)r;%&G(Zsx2r9;-H&9LMPcJgH9kKbteGcyes=zp#(|SN6$&Gxw|GvF?=ram(d@ z>WlJ!c9#6l`9%H~ey=D?4C(&e`~s`533$%fvzn>SX7!cY{el|T*cJG8%^|hSP4?e3 zr&)Z{;2RI$@Ok5L*N4?Y?Kbth=Yqz0nbSLi!*=~c-wfH^rfJ(a%lo$-yyN!UN8S4AEl13)Zg$@J&0VLOcL<)?a#4$mt-7>M zb#{H+n6x4>V?vMdLCG6ZvY&Zqa)U|RpPu=|fQe0>EO=`6m`BE15)O@<``Dw8witD6 z^t?wBhqW7eI&Q&;Cx_n?e`#cn&Cee3!1Nxgde!Xda6BKC*R5XnK9R3Q>D9abyz)d-JO`eN5?<4Y@E&UmfI>p`z>cqRMYhu&%M_V!sb zXAXFy$y)_)&dz$|Im`2hUYPsrqnRyS$1>)nB~ERZdV0!&^e3m?Gvm_qoKO7bMtnN` zvsGW#{L1mg^PlH^T<@bkb6)#!$Lt&48}z|D?-zc5%Xh=)fAmAqH+OzJ=Ibx#mHpUe zQSyTM3(qd@{L|CF{QNVwE^rqDpO*OVhBm=zEhE}NAIu?{X`wxT{{j^P6Au>+>LYaB z%nclO!(eDuOKCROs9ZnOU#Xwrr_`QkPy$CGcJH%Y%4NdK-=4=QH-E8I$3VPq&-0#b zL{M0k;Cv(J+}@8InNG@odbuSBnhT!~j;4QuRR=tk@3^CIV2+)%Hu{!vuWGr4^NO^a z=sXthS#IG{0Uyue!R;`ak#G+s8kA_3fub*OSV8f@9`E`@LK?FAJN$QKSAvIy`R|&& zen1OT1dJDFudA3vmbWgj`?u9Nol?tdu+%%ePk3Lu>!jVa)$Up!6}s6LiZ5VK4vcs< z=Ipb*E~fp0;#SJl^gECb5t*WLV(vNo(h^7WEm6&X>zZkN-F{|i8Fm@T@6Cs+iwc{n zQ~Se}E$u*cdsd<$xr@DdzLJ~S;02fQg|4m!uPb?QpV?pr9f!ARV7Wh|&uuuNj_*<1 z%GaiBqZ{vCy}HxPCO_D7R|N_mmP9;jd|lZ|KbyRe8Sw)KmbB^fx>4CBthC@V2mOGF zBWV?=RCE=jTLo2eWzwxom0UH@tr}Evg_%wnR%7YPnz|y;E0z~^>n74=cotA=nRh*4tfL)=;?_r=Ilhx!7e=UP;uC*xT zjGaBQ+Py9^7n*er%0|h{9AZ@G=eQd3(+SIrGnA6f*mb3|nffN36`63!}$HuyA3~ zTnG#4qJ?k~thuP>aSlwv<}Mx1(~&Qy6;t zyK>XDv*{L>q1_`|hOYR`d?URQr@slR=TvlLrqL3KyI)Wl*woee4OFW-|Fk;4NyiMM zYU^~oYes`cDgHLsQZ%AA#zx_2Q_4<9RzJZSsm|Xle9vg2Iy!C2XwZ?YJJ6tX*8iNZ zL5S<>Ym2MKdM$DN%f8~8le3Xnv7$%~jC4gA@ws1*M46;Xl$7cvkz$vmlB>>N%~C+_ zGwYQlEJ0*5vl{e9BD*Q5g^Ui*=nJ368c?SUDNFHv`S8@kh6q>8Sy!)%j?5MoM{>ZP^o$V1p*gPZXI#ED56ENqhT!ON$s-cS4IQJ9=r;6AEY#VU;fj)vIC8AP$2)^1rSjXXgv5E@bzPZ5Qp65{ zN0O2*XRp&!p^LR{r<>$I_N6J@rJgGDPi)IEo1)`dhqme9&B<+&?||nkjgM78@OAPo z1UY-LP~*|vr<$xetvmX7CuTWvtKw@Lsyh?^R3}%1Z0$wss=gnN^#a$X@Z1AUU3s^GVu+}*!?kJ3KA@%=xq_Ce)L5mF{A%Qe3p-+#>;hMQ){ESmm8vLthK9)_H|0CX_Im(HPGO2-2@(G z;E=&f3-Qkl8Ajy<-f~vyA~3o2m2$2x@<($zcqxY!(hA6BpT@8;_*7%&lRsbXM;g4V zFiX*wN0w_VujO($RaxiEQ8})XLN2gg$rb>L*!}8cQ@bSPxbw=Lnsmec=#7)=0M=2I^jeK3M zk7{>9U4wrt4=K?#&+u23f7B{IsKP(YG_mO256k`M z3Ve#*OJbqZY|9#BF)viC0csH)*{0=L02;LBQa7oE6N`70huJ%&8U3*%i!r70k0MnCDe6=TtCzVkR&O zX4!GDOqgDSIC{akOoP~bj~)NOY>fI-YMGnWm@{SQ4H-KSUVNN#bS7&~sn1c>P2BPM#&NgV#f zIDWQz^ze!nzErVOdSa~DMIRB_EjBzNBG%qBBC@|iQ}@U|vG+T|d-qnl*`s^Mj!hUo zf_k-L@7X6dqHlC;WdGO*%;pJmw}&DleF!}xW8CKW(at0@otwucB%6~`oX&*AVp9#d-7@s`!>EPXpb*?s<*xHL=i7W2U0Ap2iM>D{W{g_<5$ZG|I|PrhL> zpZpD!Bz%q*wt1tL$CcJI3Lc-ZIK=h1DsS7ND9GcA3kG-ukB=(~JCCcb`R9Ar_PEl9 zGJ?m)731b_pmgW+s5#`(Iv!UPe0T(pk1Gm7sg}}y?X#awR6VZ3NRxuVH#ZoHC#;2y zT4F=EyS%jSU-0;ZMH%LA(CbEdxANw7J+4Ao)1;j94Xd7TrH@^YoARgD^KvCChu{(J zr;4|>K4xIe<+JXT!zfF^(O z@Ohrf7LX}P_;imF`OrhLV-kiA$M<#cA)i>d89irQUp_ndMnX*Rh$$cTs?xu6q zWg05@YiO)DYC?c5Q2N)=yRs>!7^6AI^Sw%URm7oi?n%SCw8z8QRN}U}k_(c?WOF_Ytrbg7ypE(nTRK=`(k6m|-$1w*iwbcrB--4RzCar-F3x zh8tT9O!932Cf#lWCc`Lp+g@4t=H04nnWDNQPt|nxkD>V` z=6KH%g3WbKW^?&cTiONOl(q&z+A{AcuuUsZK5WaZ&SBXuTV|l-f;rRXjhnpajlFQQ z7ar_|hj`&(Ubxi@w|U{wUU+{mJkARr<%K)F@QEHgBNZj(Wz6t3vM=|to#|_w?Q5Lt zYn$#V&i?T`WPpIk z1VqJ^R6xKgWWtuXAOjhg(F75}rHUcMAXK)78N>w)CQ)vu(Q4J&RqdwT?PgJ{CZGh- zDq>sLTCmm<<6Chl25rgr^EuBs=iWOrLEhh6-|z2_?}52_?sJ~!Z1=3s^PF?gx}ZrC zmiFHNVxJ19ThIK>9Al(PabS@u^*IYIvJe}N_)@kh&=)OqhlRdlp`TgkAq#D>&<+c| zW}&w%wAVs7%s|IB&_XWyGIdVPh{icCDJFV9x=DaPqioAE$tA^c6UEm z41TZAPr5S-*~&*H(b3bZ(w$_-;9*)R(fBb2;alL@dAmtSM?J&JGZxnXpY#T&oPo^* zp6*}io`E1SNOzmTr9WN+gK?$lp!5J9xvfoUNtmD;`yi$!7%%TfRj+JOVLiw}N`+A6 zcG=Ni1|9dM%FKwZ53>BSDXN;^h%|iz9x?a$$`;jS`a{}dLaKsFx5yuY=YtM&emuHY zrLMDxN8%*Aw^WsXh+74yb?!z#otTB@0UD%mX*^}bxz$2H1tgVl z8z5;AY<@!bE}&xk!dS1F@rXCJ3dax&(SB0sN&v~YRR&1HI}?y_EC3{QX+T0p&7b&w z)#82xNa!B3xR)%{Lvv9Fdc{D6c9YDMVW5gMeHO2cX9A#_h7-mc-$!;#MT<23jc@Mr z`paVemiOc8>0O1pt1@$Xpq}`@a-`|22(6-gRHT_@dEnY|c~6z)jnrIJmd?X`W3j3( zAEZuCX8NM0>|srLJCTVMv2p%2fn9)SWrn<0;jc3lQfXe2D$~8a^LL5N6pq}-Co<>2 z^5BB3KE#gp?WzyS>NK>dRX4@x4%M|(AdB+ZSiy?%3p>m3l#iMMB)%L%1@}Wh#rTDt zM=kCJ3-R;>sk-M|XcZvgxEj!jig!Jru?q64fn6{p*l$inrBiB5f6qqLB?Dh(GN+R>6X;VDIen@(JgP-wh1&tur{#5DL;)oNGtE5x>SoNM^Y*I= z=~p97^NujnrsLJtDBoIGu8vnvlkSVA6SDQRqcStW zS5JK;m2SEVgNfAq3U_zB{Nxdl<^@=EVupXfpyOSYnKiyz>kIT@qzmWip_y?L3#uqh#LAX9d&F++W}fFDN}MEkbH{lMQV)q8r{hJ1 zhX~Y{c0>9V!Sc(yF^s5)FOk8af`Y(mN)YIR6~$14DAtH#gBYz5qYVN(?i5RjL6m7k znL$j|h^YpV(1?UV%+`q6263TATxbvrG-824EY^s{2C-5jRvN?_jldyqDsv4D_+o-v zPtc$@cxZwK%|@)L2^#dB9-5#*-|e9Z8uWc0nxH}7@1Y4A^hOU&(4bpAG(m&j>Y)i5 z^mY$T(4b%R&;$*7r-vqJ(7Qb}L4)4op$Qsvmxm^(nnuSqY}?G+i&91^gYz6f(*IRk zhy%9xa%7Pq`PUZe1SEazK0w9zg&od_rMEpCkodCK5ZqiqLbt@?IOi4L=OEM66YZ*}RukT0cFnLkIUAu%p)I!1 zEr4WJqJ|G;a}uIxYD++}fRYpif)&&fg4HajWWUt842n zJ7r4k(wbGPM7vdd#u>%FSLc)b|F=~~_WD3iuD9h{BnYiKqG0t%V5V)mYM!S$T54%bT%8)D)IuSO zSq}wf((Xwep4G~`md0@XLSqW?w;)8J>tH~~HvFneR7dpwEgx`&Hig#-LexSb&P*@@ zIFRCLVzHMnt3Qy3OL-03fjU%cfRcq>2 zDJn%1P?ii(Tqq3dJk^mwDVhKmORgX^LKFP@vNMMJR7X)kE1Ccoq}AXm7H?ZGHl#-};Ozjh1Oe zkou!lJw8}4MjKRGK0(vdhO|f(I<0ePMM3B9#sri5{8Y3-r4s`YvFo}`YKFy&_GaRE zivVyxezYN-#r6(IKB1e;vDmsXfPM*@S2P{FO`$6ZgvS+k0X!#@0FLV?MK_r~o?|?# zG>yS3x(T^-YxB{K4;rsByc_e;O^9mEu*AYIb_?k4(X{MHRJ;>|38Y^2$N9o54Hh){ zjm8b2at%eW>75v)V^Hl`;VHTaL3I$j?Wc0+V5>Vm8YmckhUc^BJgXu1Z}T^+@%;P? zpf(ceS%cCRh0-J1AwU5)G&>@c>PGhz+c*Olvu^5Kg1Jfe;Us#L89c2w!PI#P(QIHL z(q+tzS`-!a7;#FGgo#43se9W)seWokgV&*W?Ugz-x>u{2fa8F3_MxuvjbFtL5S^`Zs&?KGTuaNm>@x8CK3PE7=Ap@hG)ZXcU=3h6*K#=O0$ z-ZhQ*>2TB}E9CF)WFkhQ!G0RW^=BO*8(MIJDKxOl2R9m}C0BwyZf9>3+j zKNI6PxzjgdZ{b5bNytc@9wG&N-(=8Y5;>U9f;5p%Y&xR|0VlO1bbuB_7qC9_1Dp{v>2WlJuvTScRwyuP(d zRxYlq_ZtTBpwkuBGDz9}aB62vg@{<0hRr2yft(8`mXueYAD@$)aZ&Z`*qm5Zb*g6J z(mL!CSJOo&e*SC=>jdZxM~1?04$q7UdEI5z>6IqQW{Z;YRmtnw$J^NyG{)C+=j!D! z_g}Gm5zO-q#=M$ziEl8mrYvigUcRD!Now)3RS1ZTSqaHQr>NGjn3k+sm9DGDPJ`OT zb!xgVI|TICRe4{rytdAfz4S@s_8h#%*VNUfQ*{J$=~Ihg*maram|2&ap02O2Tb`P$ z(8Z(@?T{VNRzH-U(@uk(Z3(Z0!-^_ko>G=QFsk3F+1Sa!+&fjHfI2awpy}Gjd zM?X{lv;Tf7^Y=2n3e}OZ?`q=E;d5%9S{|GSvKRhJKDx59z=D7y!(I94qS1+*A{fWM z?uVdzP}8y-kokKwFwY+Z{ASSnA%|`PXD`-~?lsW7lTA0Nw8RntAl*LD^yk0_XXBkT zF^~_^4FS!_Y`SPki9a8t8wZ-H*>vR-1L`I?46l+8pA))3^>gCzzYui14uj6-x3nZs zFr(pjFKC|CbeyiJ@B+D&djD5V!|>=7U1@L|6~lWEbVqYy31`DAofs92JlUU))iegL z!kZkdFYKny$fBdQ=(tJc{_a3omB#bX<+CcS%A%uH>A3O1@?*TSvgqZB z?C(Z8Y!q;=*R)*mO)V#;XOnx0a`RCC^$v(M{2V z8jLuJH|u(A6n0ga%SPcZ1ii$jC$E>EE7dbsmX}C@B)}^JT>fPHVJ|a&?7`(ZUpeH# z`2+3=_L8A310)YudwGayHJ&v%gXx6()NT;KTw;s*n{ZRmxWgd1!hJ94wkF+|6k2KV z6m%?z@5V3eu+iM3pwsX?UqS3BzoQ^^2`CLTW+&WvLt&8tWquV@=)GB&sqBvw^#974wp4+l>P2mHl4zN?^T9jdCn;)teD?g!l%w2^pF}GV`FZ%zLmFFZZ7?H>Se?$64txH^uQ6?m!N z4tipFpy(H#!?8l}iAB~uSy>KK_C};9wzqX?YDv%eSZB{BOjRI?kQ~Qh}3BdR3GT3B?PaOLVs;%UjcL$0853 zc@@i+>iO1QALdCt$Xx4?0~DkBh@C!p=xB&TIeL8$Kd+59?(2Q!V0WvLyw---CqmG~ zYN4zMQ14V6C*XN=fOjL_AbK?4{$PUo#({%^Z+@3va#``nbaCx6{8@$nqeosg=G0=n zhAlS7c@(Qv`N_r9E!C%%tXN*Ws0N$fFFO?+{hdncnxH@`o-j5#w!~SOUa~Y*ykhyO z#n1!EhQylHAm;+!sa>&bB{=I(Mc9j0)Gw=1p>flqN3(KiO^SX8qR|41isYPAi%*z- z>bMKANpr=OtHv3<*Es0DPQdm@f4K2kGn2F8=P909<6=1lQV2{peqsCwb3((`Jp@0F zFmw(0$%&%!$w+sD!jYPlJgj(J1(EYh3OcwjB_xI^Au&t|iRqA#80M|`g=G~Eh>kNj zBSBRNg~2RJ>EZ;#*;bH-7|4L! z1zca7LY|I7$8z@$x0rwFtRH)_-)Ak2iK|m%ux#*g@kk6$_WQ1-FyF%{eEa^4A&zX!zoJedx;Vr zXlJvfFU~p{V!O|FFxvo_dq%mB>^|v@YhwE_5HOA5yE}Bcx9f4mkt|Khh2uowQnsjL# znZtFY<@%zfF?tadlc66W7NYbE4uhVIak12m8>6`VXB{XS<;_x{I|;vFTqoJM=tsxD&_?-A zNcb!;1)&Oh!ZqD|_S>JeahVem6itBZWYBuwD?0mETTb@4wA@nB1h`I7Tx?}@yFR=6 zv{O7Tz1mka0j{y2^-Rw$e)iI9#(G>6R8Y#sA-KDLT!8DVKmOWn<2)`c5mz*UxJnck zYY5%T@9a;McwCbNt7rmTQFwUgDlEV2t=g!^#U&)1q6u)Zn7p$NZa?e!=2DNVOfe~Q ziD151Ox{@s702y7biCps{Y$zzDVjiBEGFUN>}}1Yhf60|E^cX|Q#1iC7E_RGqUAbU zb153d|8w06SWLk=trT2-{qMI;7XYqa4vu)i@<#=y9@0c!)gcqr%Yo?`&gb%+(A?=E zRL|omn-+sSfChGH-Q_j4S1BFrKBPsofx6$3m*7D#el4asPAp3|n1$BXfy>j&a3DkN z6{3Ol6sr=6CYqa=6OUCSE7VzzD_5x1p0j$@RjZb+xV*YPH=ZSzk#~A^=jyTu}m~UXw~rnvDHYjruPD_u1(c1byi)uBvre3tWp7w4aR^Y)3W@H{#8e& z2qf1=sl96PiYphvta52EI$AaA!*Z%GgKE2e#Z^$M>eF%p<;Jst4vsQV!ubQUBn&k_ zi9cohs6CMRlXUkN^xfBdK7n>cjDReo@ z=l~HM6d}`!DxJT~Sp)&k;2C`Wl=;hjb~L*g5Ui-Ca_UT?3(KjU!4s>w*?xPJ3!JUmxu`S4tW{qM`R<|9@*P7q{v z#nQQBci(}YY^#<8aGq?-OecB+8(i~vvMrVYohRFB7KFBIm*`MEsVmR|CJ#>B<-B^}#ZaCRlFFaPXHPd*iAFK1cKb_oor z*ax7zHBIhzi5}0W!YpG&z091x2JS$Y#*Q5Ra!eJb9mXilj7bu&5e;KXw{q!{T9||_ zR2w6L23-=c>ARE>)2gh#TctXX0G-$VxYc`X?bsCyKR-_Tt54dWFd)H5qu(u2q z#&iS!*Lt?eTtRq_DWjF>9KDLPJxA#zy><{pjnr~*)m6irFJQj5KgXXmyx6kBp9&Wa3jRWj8>jJ9k7G_9d4@24SngZZg8ueCqto z?A$3*kb_9aC`eRN|D%9T`cDN!K|#K(VM}%(Z;5=F#qitYqcy)`5)g@R=9Y0NrE!8(jE7KQ*;^Fcl|6kyg%0Xcww@;JzoC7s;Stzz8{QT37*9AvN>;{qGaudvGv^?r|NMSdlznl zE{S8GJb$v4DAPs;YTKh zBfk9q!q4*sKK1fJspD{iKC#9vg%z?N$ag}|S*U6hbcLO{cn(+45Ac+xR*3o|&|(X1 zwa{qPZ1KfSaT-$nP4HMfIVFRqq`1#y;w$e%BWY{w8XAk-%H7Y8Nh^5|A;3;!x7*&> z-j&RR*cM>KfQt7n+KZ{ytiQb)ckZuf8G#<--KxynCYby7u19U95MR3kwZ-f0>M0BIxuR3rIOR$P<3 zCi(y3`+wz`TVHU{;%=Oq<8|+C!0bt!R+u^z6&fdIsahHBc6o?k@MxFMq47zBq|Jbg zT)oib1fs@BAnvdch;uxFHd&|$^A~B%qXAJS9d>@8-RR-|St^3bS}_oV5$``}hcHux z$Tal4R;#i!W=%6d5`uLYxj2tQ_MDGzIk}g&RvT<-4A*HI!wFuH%Ui3(EREs14%BqA zR`bW@t<}sb&|9nhOqldqjdNP2@P?mPkM-7SzqT|cF0*pwoU$Oq87{eA+V^~K&kmth zb9sBv{;V;aBNl`>A0gKt`|tjPXNT}tOJm~VtcmUr{0c&x{T2ecIQ+n=o*e>pjdX`N zhRdvyDfcJ{aW2fX{^Nyn6P_Ic(?K`Da&b;ZcPM_IrfK+Fi~4(Z2xd~OXcYCm`dbWC zT+9>Qi+?$_n;55uePK6gE>Z}OSvPx_kvTMTaxiz0TssM;-Mr$jU_PJ2wKqV6h3v8w ztLrRIxK;>GqFjpFMGMO;S})0giQI_iy`BY>gv5`9+oPZU}dHxMb7K z@QbMx?)F!UuACB+i_RYk?<7b53nc+;VaQuuycV=NGHemdW0q)EJ zILQzTkScfgZss7td8LA%NBr_ zg2IZ-%mEeSrw^!L=5(?bMV7bXhfN6!u~%XFHf~zLExQZ1Es88{L%ht;EnbF@r+t#4 zdBF_z>Y!jY7AeAco{^%pMJgW;0Y#}pdb>)#m;Ol6gySO@Y{8BaCcV;q&m=uEx;=71 zd^_TGB)K1CEc3soEYXIvw#yc-awc zF&^0weaMI&=^Pvx{h|6`c%+Lu4@C+9tyLcp$w}{wj9$w_V-^Pv9L;;0;LlMGgYgSH zJYL~21s#sMEx2`n1ovk^T!4g~Hvn;f2s<>!9-<&;^wPTJm!}pNk1XcAY+B_x)6cFx zFZsFn7@l!g66kCYP1ayR3_7I$;9}LZfBr29v5R51^7xm&3p;d)O$7CfR|Z^vcOwI? zp(Bk9xPIe2MH4Wkk^$E&#D=~8)Vng^lFOLcDH;Z-%)a2mmIh=p~4&`g^b7fJ>OggY-UD5pwo*&7#P@hE6MawCW zux=EffmoCKozMlg7ORFf5p>fvEi0v>n?y;4=eht^fhMkNzD-|wkS-3oi%jd#>?*to z!Qt^}L`1v2jjZQzHr~?U{kmLPYy!;)skN$$P~nX)Hxp6C|1&&q1+3z}Oroz2Ji;GTcdeIGRH=y||~&fkm~Y!QCX=&<-sr}h?S={z|%;28`9DI|eo zey0{q#UA9~jX%T>)ik72&deHkGN@cPC<-k0m!jli#by-VQY9gJz&=yRa?N zOuKXU`Mo`_cSaj+9O)6+9S$eUe}LD zwc-@i^ho%pu4=g^#M6FbZdc6P<_YiA89ck%of3Iqz|e}%?5pVa?uG$FGksJ*&8_QV zWa9bu?xu!o2X#B?l9t)s?h%b$A$R+Aot-DxgV?$sq`2uJIfyL=&}<4+;@8pY_*UNE zvL0R(P=%ep;mNw?6(#bH`;n1(9NO9zZH*VUrANiw?XkAq1r_C?b;scReB|iK)ZhO&7E}Pfv8-iT3zzc;LkH_#X9_h4m52ecO9?M;0);ZEs1(fcO;vfh9=%?Ii1g|fEV zm-(AdfuH1sU7+OU96;sxVS0<_aSFN|PnKiY`8uA#E<$e}&(|%VrdZ7O;L4sm`qLF* z?7Ugg>S@Wj)#uHflbkgZI7~&=^WYw%K{f`zkaMzs5`=H_sn4DnEgk!kf)Fb+`e-}o$`Kg~BD@i?dSC1&Pt`*$JY9ds#Pzx$w5o@bE6yQiET4qi?KQFV zE5LfH9-~MZ0Bk{sQ!VzP=blmcD^Jy9OkX`!&wV;Tc6Z+Q8g=#q*L$j-pII7{!j#6a z%ssA!KT4N*TTZXGH01J6$s&rY2v530zf}4o@5)fYnJYv2cAZ9%z97U-i~;{3v1XmO z<@5$04ZkK9UIrnA&ojHP@@FnTQKW1FA8vxxHy2xvl_Gu zHWS<5!C@6D^>sAVUr}3AUyn_Cs!v;zg3%{T-OZ9Q*v}onhw@Ua4twCEZNBmqtyos~ zS=}QaLX~t$KdWwXmc?w%s^!t@nuQ{$O)pQc!a0Ooo$3VCmM*Ezj-_^C_SPL+681=M zuMjRPU6OUEx98_GSIv$@d3lseO3i)%gqNM7p3|y*z}*ASlG557AJ!ulbh^x`!6HAs z%&gOkKT)1MadN5eR6y!oup=FP$2?tc{DYK6<^1_nV{)B%OFMk5fGTqimuELubJngCmcpS&;yshbMyycvmdG0=f7$fiF zI0!~WDoOJ4&`AC7)- zHr|QBQLhrH>?g^ z;1a>N`puR&c!X0uLJ=3pY(LS?$Z-fdRa<8OLGA~UTp z(UQih49XCQ`kzm@n|3R<9qX?NlLq%`!N;2aZSk$@_xk7dyTE1U_R7YQMpbepOAKCN zXCa=`6tn@)=?YTw@t}-DtxsAm!YwRV&etBH5)-+gH8Q9VZ-fDt(>_C;If&cMuIf)1 ziA;R>7o}8z^(`gmT;0kdU^wV2R8+M2i7QA)ie=GkIh+cspoLfxaZ2e_)`nP4tEHS` zx}0!p*tsmHol;Jwgsw9s#KYlHN(zsK5iWtM>PpnMCCaxxh=pKxB;M9JCfeFL(kzR5 zDmZ1Zj10_X(Xoi6=q?5%MaTZE$D(^CQTuYD<*H9Ey5?7WCHIQ5TjmXtJ(L_ZzJZeS zZfaJ`$)^(TpHRorLjx;!TxH1xeg@2D^{AHox3{(JDr|hRzdI{z@F=mNEs4G$Pi}47 zSJ2qj8yB<{mJhr((m9Iv5y2{&uWOHHk>aKvT}3IM8if~iy_#O2x_uziI+Vh#EvP7c zP&E+yp3Z5pjV#H|!q`Tx9iw}5KZL2f5DJy=PYu#bV)IeeHAAXeZ9V}3NaGs?NLndZ zmoxASJLlm!Q$bwBClvH;Jd+CAiKl$Ne*ltD_5zxUpINZmW3`g*cCOXY4l>dVnBimA zuTzyST?UcQLz2HOs@`=D&&^b9;}V37tU)rOh)@{(%BWq(!s9FzElY$-gs@YMr>}Me z^{AuSSc;>sD8blCh*@L_ji)-1rVqgwxrs+-Br-D#BM&%kTU$rCvSlRj4n=XF*-+J| zac2ZzxOhXnF9bw=9_|G{ly7V!0hPMOu3mDLV&j>;B45H6bYhP%i?K)l7(4C{Ff#5F z8PE4O({R2pv!U+@yLx%=WMD4^$#Ids8)Q z21mxQQ;%n*f}X%rEbgOnkG+5zQ zh2!p4RnoDIcOZ)BUbMNJc$&Q1o^a>$ZcAKy*oy4}xHWLMyAOxWT{5sc*6?xv^kLo4 z#!5?+_!hOIHe)Y#oCay?Cy?hB<)jx|gvNuSsRP1eMPb{t4Fe8Kc5kXI|5IwsbR3I!LCaa&8}{|DKe^?syBcs(-C-c^ zJT92tma`s%SL8;D?HV>c={|>gHRQ0?*TaR|rfnE<7=oF5L8zi-+V)sOSO5C20=f%O zpZXgCJqD=vl^24ogEdPX@285f*+pm=QSc3M>1RA#iB7?7S9!*umvrBC+wX_?em?B$ zpGNL(uHYSr?$gn|@{v1>@I5;ZiEV5_Ft~>PK%JktTV3@M7Y6jtv5mKYzf;VpGxNIK zLA*;*=^Q$@>+bb?tkG5Yg`GkaKkInd`4=F;RidFw_c9mIEajU!1JJTbNCz=4Pggyl z5;PA+h1QvVIiasDbvqOW{o>KsW8pl=$<6RYn8Ql~!;45>t&U;-X3D+JQSrv`ob9Cm z%AXwJp*O=iH;YhB=sYQ-M>t2q=At@2YhG1+PHb+R(+^KytzJIiF&h3%X~-#wmX4n= zanj_n^4PTL74aDkj_kgqzf`m;aKcIviH-f)JO8{BmFa=;fC@nc};a#&CTDG;|_U7j2(5Abfl5QeyrZb?nVwcBO+Y4 z?r!fGyIwklhruU!c+e1HLj1yXwa=gOu^eOPw?a`gfqZdM?QvatX7VmM#!hjSs-To$ zMZz7bW2X?vldv|N`@&XYoE{{sZ287XPS4Td5SvfNN&IsC1%-ys2l>!WJloAH{tBi% zhig(GE;3vl;KJ1#fr|zu0IJN46U<-DEB*@R#GH`h0nD`IIh47rGK{@?xUcZi02irm zFf8~hadCoVoM8UTyy9=ZBan=k&m;Q|7(MA@mLS&~b3~Bq6UO?yg2Gsz2ZgaBd{r^{ zd{6?;v{^iENMx{9`kI_IH$F2y2X^{7f>|H?!3bs%{KDm>3zsZsMEFy>aJes|N?0q| zSyEafl2I>$v5T`Lxd?*t>g6~(DzyX~L-4)?_r%y&eAFv(c}$%z22ZYQ@{}zE_TrN( zW4zDc34yZ<4%hcgo23gCiNI?Xh4!<;V=ofzQ)9%+IX+f+oX01ph#Zlp!#r7)Od0_0 zU&#NpS#;v>F;VV(ARf=Ze+>ye(ex+ErlZmElO`%-XIhbcM%DHC!*JG}uJ!)Oj@J-^ z(5E7so)8U0!fy6-jELuQRD@#_7TM}#uFI?=T^(qy&Za9Z4bX7~eiLYZr0Li@sPIaI z=3!i${~9#i*>q)5D#xw6A5cHcnjXZDj$O72Z*uU4kD*BTF3|8c8afW#imtqb^LOjQ zND$@7E@v!oj9$@|O_-z*`oa6;9tO>eoTI=odWp9zkiI#<55bIN5oaZEw*1P2R(PE9 zT@9K+YMRX<(!?9Q5wiyPaiICKrnBMUW*c}}$7$X7KvT(#!ui4zgnll-U*3qYP1D)% zCI)ZV9Dw}32Aa1xcY)(HPVyVPIfg@21!gLba<&3zaF%XT@K7ZxtH*-o zJI4#1DHs2gjz0YS|I#!<>4>f%m<^>X=!br#96ve)udM{j^dw24mGFJKrV$M3a&-kv z_uL%1{JMhk50dVpJapqG1aFvOx-ZG1JD^TsHW);wus}g-&8^HG`6(Q4A?p#=1PQSc zKcunTS))(*;Hg!dhA#A|yxRaOu=AlJb5=MWZBtf`u@Bo=)M;#ccxE>koQe$gMYMhR zQtZQ4dPFL=;>>>$N}dewS}#z~V6Ti)tr7~F-KP@mEO~9Ag{A+DXg78O^o>WmeH$4d zTZXtq#Rrl(l@J27?Ji4?O1AwS^2vDLWIsr}v{4g8#@k^iiD29*%2vy#;|N$T{sqw* zIkA!|lv&Hg;qbZ)zp#@2)+y+6i~AO!MG7YpJ8jn~`iDvi-=4?O3`Pfmzk5IoGrFqn z53v_l*`Tm4bxfl96&OK6_W`jPEFcd_G@j<9dpDlxq=u7RQ7Y|&HCv;=ceYCBeAo@X zmuP#dERFKmBXCK&h9dN~w??N|2~ZqqUeCzSz#|lC9D`3pIOIecPZgLS?fM7cEkP7^ ze2w%bb_(CV009=FK#`Y39@rl6I^TMY&h|RZdKG7T6)Ugz+TMbaLFbb3^b-!87Lm>H z4uoJxLF9oy1Q=cf8uwZJDS+GzBoUBGchN*q*BX?tI=F+^3SSrb>ZZbNk>)!|O687w z2u$9z&PWNtI@Z!l6=fie&6j|^V}bQ7@<-i#5k05FlOrnYOW0X}=VApd!*hv(Uc>YA z3fgC(A@~e}8)u;z7FuATD=qXT3w9EUqtFm4xR>mFJ3Xu0*vy7@c~T#h|rN z9dQL(9&+t#YmugA1Z>*dB~|Xfl5KAk;$D%p-Btbm?r(Ejo4Zph5~_~?M?eNKb+HN_Ag*p&@%mqBImgZQNJ~!F+CVRl{ zWIw0~bRg^jE8X!~oS8%VhjV%CajY9NY!AKk{E4rCg(d&`^+#$2~`L@lPO2HDGh5DXpY3sDBmvd ztY!TlFOUA5AMKO$=jy}$&-Le0a0`*lqg7Hj;Mrr*9F+cC6^+)PGm!_>pG!&2N2Gz0 zI!OJwDyJUx=emSGHT}61-Nm-(Sm$~yx`Wc6v*@(`TuSZ$`g19{OR`JuzoS2Q!Q2S7 z+lC(jFukW=k>2Y+qevf{Pmz93K#|@#)o9N<`-s9Px8<7-f;#j_whn!-);^;@p0CvC zGT$79oGrjFtSmJ+=!G4Y*>VMa1C}}*od&C-QAbz4cUtdIYK&1~t8N)RSxk+UDoUkR#*ULnb2<1h{fjhpBf7{< z#SG@4b?_=s)@T)|Qop}}w^-vdy_5=m2Vay5p33(M_kGdC%K&p=9sFn5^@`C_P>n9r z%m0ZUz9OiHPhk$#IWhW5XVj~3z9>~@x_YS+i$yA4>+FwwboQv2=Z=E&@e3>UCFQ4iioNkXZNcr)>#;7FB}kk{R&%tf=aJ zKEJg-(H)|z-xM43N5vLv{5Q1qcYpxe`p-6;24#J$CB8qpqv0AV>o>(B@h2)eF9bTUhr19?>zU;jF!{;#>-z=7q4)4;QGHkakIY+dgcnPwvSP5&uu|% zIGHc*!Vc+KwAe_~wFo5M{9iHmap>@$Ls5Pi{#EYZ1s7?06sQWfwXqv}qMXW57xvej z6ja8?8d`rCciW(SuPEHMVMrmiKqbnbmEA}%UhbGaM`2Ua=uuh;S-qh2kv62?(W1C8kvsV zd^nZ~fVEa1_ZYs>*-y0kz?wcP`ieIVGo7*3>c5Ct5Y6&p)(pkd>c_h(+~P`iO`+03 zc0R9F`u9#m`cn9X9iH@+R?ryKLBXW~N$<86&}!xD)pJ$L*T3BWbfV=aBh+8_1zG97 z2qgD%?c`rr6}41tjP6ibfArrdE3WRoFBA%C*2Gn{eRu-EhHK%MgjpE-&f8kC{VIkt z4Uu_<7Heut*Tx`aXxv&jvKyt=*wsHh3q9D~IFnF?R@qY59eqWAXM^N$aH%@A@O4Fm z*JB#iVpn5Q*;yGf%$0wS%}cMqsLHId@%^x`PWDAHBZ?hskM)l?AUVF}2R!eV>>%)K z_=Yv7+7_p(I1T&c3efMvb+HeNq+q)^0IuzzCp}jj|4l6%wPO5f4Oc73O_@!ZwrTG=^ z(`-`vG~-QM(}xjpI}nktZK^2V)bLR#Jye$KQc#lTNYfV)yXp#B;u{k#Y<$|JsH8|1 z!NLXQ;1x1T4!4EIcPb*J9#WCa{GEyQA0z!(u0uK!X|Cn68|%gs5}8N>R#>5}k?YSP zE;H}Nr2C={A6%hf?rR+rmCyX09m4@cU+Fj&e@;iDF2^tI+=Zu1Cw~n{mMf0~x>EVR zf+vTGu=5W*W#Y#vi9oc^Sgd?GJ_|2(npY{@PXWow`(!jCfp|?91;{YU10yn0`(V|N6dBRI5Gs&T?{zS^%o9Pl*B4CTDG7b^1Uo zzE`8tsPSQI`oEBZJ+dH?)UrKdk7^g|)s^1}7`ejhizc3UQ}-%HB2t~U)2Q2z>QnlDk`%_U4%%N@=h#ec+`+SA-6dLT4Xt2*tQwl54$0I_=wJN$ftdlHbW)n5W695nHgzCQv;;y413#4#L@RNHDmQqd{V z7rLteEkH?xT265Wn7tmQb>Zu5A4AwV`pxD`|Km}Az~YuXtm1xBY;GvfamvC z;2P*+3{hQZ4>0A8e}F5RMKl`Q$P6`M6lPV4ZRC`lRl0{p^i&VQYP?#Hu1K_B9|UO|0P#4|U5RcKIslqRh&EP58YH+q+k&alM0zRyhm;a>I;20ft7=Jx$t)SK5I7?Hk6oKAV zE4>3;L94+xbjo`>hU*O-P9Mc}ES@B}Xzp3}dsc&QSsKH2hz_T(;-aFRh^6P=dyQu` zILOi%uJHvDP@&@DCua`tIrKCC@T>;QEsfzahsyL*TvWmj1axBL_$8jzpwbZo>sbxD zI-LHBiz<1R%dAU!4fL!AZ?-fhu2~vGjeJ3f3VN2y$(hodJ*&aFmd0=$t}z1?*Bm_A zLPMqZHhWfs$5b%7w1g4?s#OzwHA*s~g>c$2Qka;feK81~D! zs0L-oFIRTh*Y5BxzwOTgf*WMH)WIIW492e@#2Fk@cDhNKl*@1Z7Nv>?zAz$CPsd^JHMxi+t)<``#OPgbyh z4dhgvjc~=1l^&PE=;}Hoie>Yv7xW)<;8RqqWg*5N$1s=LPYBPb+51Y-g-dIA4O`%DTEM z1eV$aw3Ll!6--OvTvK8lQLdq}$Ec#ou_rc+2ln;Mle3dUz5@m-p0H3}w$OLX=LAclfO_=h z&wyqs*FA8YGKqy~@Epm1BY;z}%9+g72ONVHx)Lsat>Z-eY)xa3imo(x2OFn>@8_d~ z1-RkkUru%UbM4}DD!iZpurh}jm5;78NXWTI40I_?Ys;l{Qq&iPI(l#&Xnv7J=b!SC zo(rUhHI3oVcbYZn+Vjwjiw4ibs(cE8J%xL`u4UNV>nzq*u1f(WKC` ztQmqs-iEc@=-|x0#;)+{lRAEfkc^56f*nYjcD2V>_CchUN_1#ibegCQuZJYQ!reQi zduOG)tSjEUH_~)JLW%B$k_LN^{~CAyDLQ7QD16Ht;!MTQSMc$=x8S(L(9^LoPo!V# zybia%h0+%wxaam)WY(^UH+NrmO~n7w2=&QK_RcK4Ej-SCV(Gp+D8~lp(F?XsE-^1aayW#2J6D~!nLp86>_(>?Syu10B!+m z;X<(U;(Y160nD94^Z8ITYKp>~d6Bi<_;g--?FZ%%rd^<7O~Vh$xM|x z?Q>{M?-y2i!ye#ddmIVH$9Lo5D)*gO`M=U~SGHtaQu3oPy2lT5OE(hMs)=BQk)|~W3VNaequO>2#ovlip|+hx{kA>| z1y(nVnTwprjqKXsRXM5`PGjlU=58J7bPaRP;Bq$7#I6l?=Bb}4=7N4WuK&I6=bKxv z`+D|eJ@6uI^o~8lP7Idjtbc@*8L92?1f~ew|D#z z6trh=dfEo%w2~&3-&2_#j}91Gd>+LnReYO;jGiac>%Ly8 zdF%HzAZPWx8+ZP@Gts!OI5j=yZjCkWtd2FdK8DkUkFGDRXo+nH)W3eTn1Usr-x+h; za1`yo#YCauW9NHS&D&w+)YiCfYAiCnE#~4j)Sd4%?z^rcGNTpNFd+VT{XPe2h)1Sj z4Bk4j`@`;TV1SB6rnRBB=;!uQhGz3OtA?x(Pv(A+Os@^FqA|WE`9LpfYb#vj7A6{d zseHmZP{rmm&qJ5xZjCFEyV6be9=NR#6d!ELoLLvLvY0w8et*-f&xi_d<+lk zF-M+cvhSa}rg&$@GIexer&uingqoP%_!We>s9+~~@3HHBXU3Y@zG!Ov z6Izx}L5STsY3dXAOzy2h!i#eUA8?!)7li(e45RmU#{FT-H#}|5H%S232kDW|a)lt& zSqGvWAY$C4B~7BuNnN$F4u^Ht6WiBv{e`b^{DuV~E>Yum{A>s#5{$jgmb5^9W3QsLktI9*LVV7g>XoQJ zb@lZt>UB(}?n=C=`kK{s^{Z6NL7K95+WUi7VzPO2XOuC-T1P<;$<+FSWkX_=HLF(E zLm0D2;uYzxL}#m|yxO{5qXnI2V|huj=LDALqzMz0NBP8PxlnLdxu^}^g_dWjE_4;V z{Q&uaPeo=^8W1@+mm=y)be%t9-wVfzr(_)yg1dS-dwvu&r?R(&Be~E8cZZ$^{6f%t zOVhCzP;`?-m4a90M!@4<&^)Ev9S0*tS2~$JjCE9JjD(!%0``w^{3CSHKt|Y@?}g`i z3dV=|nj8$ZF{tEnr9YS1oj#E%YaDt-RJfOvj}TQm*d>C}m=!NUsFYU^8| z`@Jtb-o=s~9;@dIdBV%4W4d2G2s+lcHxGi2@xGmhZru1NXNd=P=B^lT`l>7m9~up| z-DKrzdtm$2VwR$wyymW+Wo3;ubndB)OxP^^!pb`690g@hm|@a|v(TQ&#ES0=rz7_j zrpLfgKcQp8Z4QzUV;Ci8r)Fjp-&dG=0p?Oe6Se0L5t8;9oR8u>RZdVHl7v#QynR=K z>L8L$d^Ubzb?1UWbMbzz!mY8svKFu>szL-=>Cz@Tz7t3F?ZK9Y3OD{XtWh~-fK8dU zyv4@k`I{NV92J}j#N2tal48h}*cxGOtmp!b!`zIC@8mUZxDEwJ`F$5i+`$sL>1PD6 z7J&J+u@Y8B&fB$BIZao;1R4-d|5mpb@VmbIfmouCfE8HD1QGWWAqKR4 zkwN!eQwH?>4LvjQ-LZ{V6QZ&3jm>}}w{KFGtd09d$0A>8i*5W0kQGha(pMzfb{62w z$A&~`Tm7Xx^%0AF^W{E|y~p@!Yx|nzxlKmuQWZ58{*WAd3E;WB{t(hncb*6<`V(Rs zzliwqeMZBp4)FBMhs7xVty93oF(wSbiP`SMIi%oz1c*IK*m>OgzG{8nw!TC01$+&i zLL&JJB8Z1kFGwjHr||u%RKb>B=w+V7&gsUhhB~Rm*iBL4J{9K~0xw_>a7)!rTj5jX z_!5w?zl&R3Orf1fiiG-Dsq-FodK+ng$EVggj5NJ~0OWuK*pBZ!y#afcDj^oTkw-feKNo4{-Y0C1 zKut=t?dt2cH~#&)M89X7TG#wG@!;>D7RQ@uKHP<45qc*YKk6liyGEwHtj~yK=_Iu+ zdt=uTk;cmqBt$JNZqpiE+)>4SOlLDSZGS~A4u2ytracgXRAm(cEmX2XXl~tzB6A{5 z>MYHcwdmXC@2qTLopMYwz<7ggUO@2l3nR#4&g?BcvhTb~9T;KDql)G6bFi^I?!{k} z2ZiJ)kC@vYLy06+iTnmdi|)r5-6Ex{u4O8@wOn>$=xjD$fsfU>&?JkgDud7$y|>=P zfn762#`>SWN5dC8JiLQUxmi8wwwii+IO5P1Sx0euD|X$qqI+E6+fZ{l(k|U0D;XPK z*kPZ<>KS&P#IsC6yYRe3LG1cyWCb}eid=lT{1V?Y0g3NSKo=>x%K=HqJi<{pD6JKa z*8s5zi2Rwe`LOdbaMcQmV74ZmFU`}0{}=e#`Aonh=Ql(F@Uq3*gN?K6rwbu}sU9ipzGZ-<^Z62 z*8`~3>{;c*+fA(dVjEeKD)a;P$n!UI#E}AF#h2cgRZ$9LIUp&*20$$Nu)`6yMnPZ4 zvqC}lS=_GxNpbxSkgvFu3PbnYvz4OQZaQIS*Mf>Ko0t=sqo_hSF*6;r)JSs}9`_YS znz?GiEVIyb<>nyYmiaIGdM)Go@Qa9Db#dILfYOyAi<9h&G5BNq*IEqkZ^-zswg`Nr zzeS|!Z(zk~A3R<9fq0i11)9*=Jp(j4JDf?<*KKRug?{d7^!!lr*~vrtr+WTk$3yg2 z++4P{%ikU%&37ZHJnaGZ)nQYPn;7b@8G@C7Y7DN3vpcUzWDZd&OyH(x1*qwH0ZXYc z()2nz#mw25qMv7`=v=~KZZe&f+#wnE*YbA9j!k$x9HSqUc=Yt?w%r$P(?VKQJgVoM z?dv%?gO?9`IiQ93LHC8H^m#W}=w3k5`|Yy0y?|=*gD4o^McP^tkc3Aexr#J(3LJ&x-}}>r2-HkxTxDib6(--s*wU#g)6MW;W%@DyqB7Z!XRoe1-CkXX z_Ne!qaVLu%71iB!y3bU1*LD4WySq-6D0-=+UUnsY%Pw5%+(#uDUv?h)QTPo_n#EUA zFTP@W^`!{$ZA(DdF&>X9WKPQI^MIt^TMg(${A8kknSvg`Q%ZI_AmMn)Li+&87m&r3 zom`f&@s`9?Z>IKJZvZ7X45?Y=I?Ts17YxA(?HjqSRy7El)bSB&Dl=0snMfa=sC`~l ze&t7%IU40m=*pqco;k$S$%NYhy}3G&P|=}jU;%K!P|oTE!RcK=96jI^CmE^0B(_h? zeXT-GHp|p9h^O|Pfi%?NCyO4bZ|m{CNZ~lBaU3w#EV@R?VCk<>dq9-GMs0!zYt(D} zo3}8sI(Yf@KD&YwSTM7To4hBZo-T7lnAvW8=sGXH& z#fm+S|HxNyuLTFYnXtpbS*q}TfTRjjyCoHuyDS7c8IV-m6@a9IXDQI73S;qu5eKUv zuB)3^M7BHNJd;yEe1yIRsjfU|dKXv>3w;~AiX%-wz)NG-*htg2vS`WQt|?m*TN?K5 zjWlkJGcdurxbdUnRPV-*#-_(@@cK0*qa9y2zVDco*mcKtgw#tyA2bD!BE4g!kKkgyXN)cb=Mn7qizamc=S& ziE9q!L>1=>-XBUI**W>4^@zZ~1fq2rCVV_{FR^}GgU{Ej4lf|ZgYbackJ5hz^OfQ@ z%sw|N6z)z)G;iT<`ZnByt8iTf{7PHWSF6`OeL+W(<{JQfxW#dHMk39(3*0&kHX`3s zaKo9X@Xegob*L7hk{vy?0SIozw?dUjlj^yY_euG@8JuK#cs}oD>wRplck1)*p0?eG zGs0kLpiZ4buYq~JCeRD*B@fq8jc;D3=8dxY&t54Oa{+M*lC%K7u)5?%pj{T{-~$M5 zn1!ZT=pqZzFiGfcw$MEmng@%75;dYi>^T~P!f5>Mdgus5Bh9Mu@e;XmX9-YYF>XI+ z+F9}GoVAOxL;(l!7!8`!@C!M!=2ccYrzdBfAFE7OOmW7JT)H&vsE1#kn97 z{*(3thwI?ODlV=(u*P*>9bR*^XFqU^r770hRZa@&dgE6R;ut~x-Q#b2$h&iv!Wz2X zj^VmfWBLGF5R#IBTI!muV?EmdwqQEi1~4UF4eAe96+7xZc#^^oLJD z=xn6rFhCzaxN3*D)AMahQ|uH-2s+J&D6V7iBuV)Z4{h*vdiJq2Ca(8{S1EN0Li_Q? z(m49#cb@TfdaC(1u(S=30L*FrhXPv=dJ0dbb^qD-p6u=POzF4|wOm(%hHfB!1tF@} z$Uo{EU4QX*dafk_oOeG2Pr{&!;8zej9$YN>3vT@SW^bowsiiR~oTf2Fii>Mk)~Fi? zAG6lm>6x%JhU*B88Kk(Vh+}EI8G2%`x6|`jOJle=>d+0wuOLLV982T3-}=s*-cHXb z3E&2!G~|2z0io0J+ZKel7$R5u3;W;lc6z>SX$;rJ8pBm!LFhz0iMVz^>kYEgbJcQD zrvnLb2)X=fG`3F9DkJmr55DEy4?zw(MWdkU>S=a*mf($XRo=4aU*1m7vwSqc9g#=E zry#@@O?UXROQy(9Prn6-q6wsMC};~pED5@IzJ1R>Wv8d&Diy4v32+?+kAe`}7Tvn> z@0~9@Jr&n@!77>n7o{U!3d=5-dxh-uR9q8;OVKEhGX*;KUcp{e`m0BZK@2_RvL$jWh`k0xm=%vsLM^t};(m}^4`t*8 zB9?S1ibIp|LvhO`K2r}xQoC?rejkms8}%dw8f$k92C#N#U;tZVZj%mR?R_a4%QnGs z=y{hP_Q$QLP1SjKc!*_{SW^isPh)FUS`v+VwpJY8A$rDm$Ei1+Dn$W%e10mnR(Woh z=0G0RO__g`El%l#a(}`&7{=lGxoo;G7dG~AmUiu7&J{3M%hd@09a>zFcF;IfW^d`3YZ@ zliQXjnOF6fi8vZ`XK7mIgSI{6N`vVm-W)HY82K=^GwR|2RY$yw2a4e@Hx!IekWq|j zT}VE{kpV)X-~@t`BP|I;Odftz4|p!8Jo=nV0E?A3XNF_42z$)JNs3T9lj(EgbE{>) zG_W!qRlq?!n6l&W3pvI92E@V*&P0eoBlB&M=l2fMNDUafaMdbBO#d7juLiI}&~d!? zPT&Zh+{5`89h3li%-kmky`E#`W30iGd#HY;^VV||YSVEZR}f-TVSet|-FKk3p5xk( z&RfrYM-X~F=jZa)bN5*qlR`6Z11+3R|CSN>{#9PnJur!8? zYfL&;O0Nug9*MV}JIT_J%ik!ca|5?bP?|p>vvJ&JAhj_}Xf9@HmEm7mcV@X!;lg&!{>#j!!r; zArLOlN$`hj-&Ia{2*TLF6iCr3KQ$%s&s6+5QJx;HcXoj{-|&&^S%){j@cUt2u=0w! ztBeJ9@h9$^FO5zZ@68J+s&t&cq5gbEe=dKwrcpV6K9zYvX<)c_Mx)YD;V@TfooeV} zqZ=4@og0z5pMhqg?kU+66kTu_cX}hN`Jh>-+X|bLqAM>8-<8@eYPr7Ofv;@w%?(<$x2HM$Wo!bd)I6T#_Q!gBrlO!-%1L+Tup(=YrVA?;?iI zlk#gK*u5J~MCXLqMwW@8^iuwuhn*jXurTEA1}ee_5e{t|V#T_NObpwNTT`*hOv6^t z;|$^yPTzgJ1QOza&ERm zGvv*u!s96XE9fhDN?rLjASviy0us81014ewfC}*oJ6(9nXE@H^p|NoX=U~MA zXXj~56dn5z?4?5llw7{Q{kwnlBzy{ zl!JLW2lLGw%-kHzQ6`!2k=R2yn8yQLtFGYPs2)nVe&Zo@IM)X-`F4iM0PB(Qo669x z#_M!y#q9bet09^=yUs|C=#hiu2<}71&!1gA`|S8dYSxpr=PNL)u!KBihr7fal6mTO9hjSC|D6^B3Pm)5qgT74$W z42}XOH7VAz>aM8``;V@F70@3671i?&isIDMcz;a!Y{L7QSN;$;wY{H=eD}TjUv_>g z`XsHxZ^s7pmdfN|>R=LVbH^BIhHCe3(bmSR!pEljRb+7DeQQA~%po+9Ikym;>(1j< z8Ba!rInx?W@9(7FnAUJ@|B#b@m4ACV=|A8YeVm@qcI{4Vun%85awDpOqfQ8~#L&;{ zBAkj1y%ODM8(&tR7I~l)h}8I& zbtuN}qw8O5S%*^WE~;l)7N?$VS%*RdehXgDyz-}0BM8O{hCmo83-n>&6PeKKgTc zO_Q9~&2FchK04!1qpcgO1LZfCKl`H7x^W;v%BnV$p&m-RZM4;Z+Ke9oXoD+V&E%Yl z@)D;LE!|8*D<4@kJ2r8uaaW;>?RL`#wC@fB#XSUaMEx8dg581rZ*<9xsC2`P3yYD( z{LqvwOS>1GH!jE33qD=asvI@O9!j|@i=B}E|9{JOV{D!$m`QMDqSd^BEhh|nXZk%D z?ddL$MD>~vp8x19Y|^X=U!M2-LS;VGYfcE3seBHDkHuQ@^EO*t z7&d7V?&v(vl^%qcTmtYtrE3dnD4}<9jSigOBNtb8Q}Tv~>PKntUtM{UrjrF!+qLNSk7zP z@J-G4mn+WD-PVRLyIsCJ+u<8NX5?6RVpYTO>o$CC!)1O9V58zP?WHrDv(wYyW4RjI z4&U(6UhO3eceszQJx#Lg?&W|lV)3$^xi!h!3l0sq$qHvvF=|Yl5=|9i?|Z$pa8Ns^ zGu^VWIiA{yD=VEI-2nKeT}FPU*@S5)^B6&%SeLw4L>D>34sjR*9(xS?cV#mvaFEciInunQ9akc2u;d03Fz{1l^T zYp%qs{-USCUcziVEKKdOJWouGwBop{p5lw-ZCUY{9I|y{n;0&!QH2tEtQEeVf{X21 zoRgj6S!&CHw;Dh1OLlSNaFm{Ym30pHS-mq6qe@uS!ohD%rkuK4B0Y;Oahn8qCgWXxUj+z!{&SG5ZIKGZjVAYE44nR zVpE}_^=Rx{V^isal#}M6&$7Nf#mZ!P*W9BG38hs;pp_yVOZ``*=Dz}gYP`3`M5{?W z6ou9To_QtXS&vNaNp6jNq_UYGpK<+C4B3xGIo}jliMm zsSpeYx20maTVwe+>C&3B9}JCqd!%Bc5oYSk1FvOFA0Iiel>@j?^eqz(4&+7a%JQMB zwl$Gsmu@6;ByV#v2kIUM;mR$9yjxTI2ofGDmt(wA`V_*I2LJ1b#I4u-ZP6Wczsw zcrCv+OHuwrQr1bUUxP_9DbOL27aRQXb;!H}*9|b?L8wi7B^F0oUrl}#g=!z`#mEIk z9k?Yn%4~y%nwCUSG@~pE8;_+vs*4q3T9Ffxw>3l>cXy8VM%LM%jXt^Nn z(AOC7wjiZ(gWmV$=~SQ}2>Kq-3PIdLS0HEu&`Loc16?QROCXLZp~Dk3y;=|(6Aj~j zpuR%Wxn)P)C_aO|qNy!fl^b&!^1k57a8*(&t(S#+LAu7}!)4AwGL`Dc_q2C3g=tsk zlUk74XMa_jN8pQUf7?)mdvl%jC=1FRJqyOCBTyE}OvxPm@-q3a7aGg6euMeVs1;f} zuQ&wP%@(A#7nJPN))LCrEfqwF1P+oP?X3sHLzWO{I~{JT!S*a9t~=2vPK_;R*`=XS7tgmSUAF&b>5mLh7vKr?{~RJ0G5dxq9V zP#z;scR{rEPISa2oGfBo;;F;PBCCqkwzMX~P%f}N3w7~n$l$uv*ay%>OrKkwXft*+Y-3KMuj$>{uxFX+d29j)1-xsq2An7rtN6;}5OfomFc$CdNj99|^NJ zW`%3scI~Nn4c??Xp}r@M_Z4+sy?sJ`BG4fe{gTs)$<^DT)q8K^J0?M_#E7)M&9vIh zctJlw9X5(Esa6btGOrZ~+@6ecg$e$(kAlB?W#<5jsW$rf3hlE#=F|7mM^@=b>g%Q- z;=d5uODr}!6R;hDJ5fTb&m$ia2GI|#VM(gP)v)L{A<{U19cv*E73IY1uFNVdq3Q># zL66rbJG#DC)I{As)!5jSNgdLI*A_vka)`u1Yh&1A9T`Y)~ zS1Ij9L;DhFx;#A>X+J{{cT=&ini-&urL}_IH?%Jd-vrcO?Q0erbfZB!;hg&DD9w#F zh(~R1FvDIkAfGze8Gqb*5vl#SbENhNwET1V0SLE9dZ#EqgjpmBGvR1B+w zPfQySY}}LGWn*eOUC{v@pf$bA4t-WQ0P5FMMVU2+RB!uSM8mDB{ZhE8_q}X{z6X&?VKc(p0~hZcnNsQ5rwUmc(^Z9X;(# zto23*WJJ2);~dMZIjHIWIpp2x&TfsQ`}Z`l8=*!Y$tSYGNEawpk6Fq6xN>%A&fy|5 zlbO$&`?sIStWlE4=;dWL{H^0@voeZO|5bQSSxe}NO_8Vb@faVI-BDa@fyBnjEgPCo zp6Ud;mA=a+g;u|ZB#mT!liGwa7gxNYg8wW}oQ%9 zKg*83j6_B6olzMu3@M#LaG8OnK!XHvIHR<;fo>Gqv8bK;6i4STLH|e9HK6&Aq_*SJ zI+fk>U|{h`qY-V^H+BmoP4v5w4eXY;zQsOA?ZM#54Yk|4HVs6e5s2dNpNcX?JffYN zJ^?AZwx~12s{t41rgjX-Twk1sLWSlM|2IiL3_k`RbvT&*LetOa3Dr!>GzfAuE4*WU zaq{W)op6n@J@#w+CP)l#bTXQ+xITIa_{ToBrG?3MZorLZ{J?{~0 z9wL>tlkWuD9h03 zR+@WJg<=_&EFg?J{x?r^#MEQNi(yUTFYFVYK3V3hKz`TogxURqxz(a{#J`?>&j!lN zI`Fx(0?FDy!xc#SsilhltbZ9nF0=6KJ7d9B#m+84mNFXd67-%_J{{By-g+W&t(GI;w5)vuqED7g- z@ZfoRg5Mm~1T_?(lzZ}?WgsJ{WhxLj@8R3d))V~h^Dn~Vkz&ea1hxF)L$vqrhx7!$ zobArRLm1)lNMXGTQmh>`cb)cdP*3oS)JUZYk4K7wSSPH97v$vW34W0prBcGF)cqLVG(6EG_4=@YCCJE-P ze;hv0Po(HN!Oi0d>oh!dQhvs9$DVkaD=aOD!sC(ZFH-!D&>X(@#kc#rq_iLkk4I_% zc%7PZ)AQ?>3~)(lK@=YGl{1Vq17V#QUfi_0BPoG)PQbO*xX^a*Hz?N@S0u~C3;bxp zoNuKMsS2-aLs@6V$Kg5HhH|QhB0E6HZW;CR2euRcO0iovK2Xa2ZFv6FhH_b(81`*L zsq(~!Uhpex8)fIf+BO}IqLCuAjnAbXDc(x$ep_hKSh^VJ-)w*F_iA+r)|;;J_`}DG zJYg+tS7XN*4-ch=w4vKC{Ibf#VzZUMN_Vl( zE?ef_Pik!=l@0FBBgY%x1AN6Rix-xW6KDQKQ2{kaIQ$ai?2@WvCG<%o%9bStIM2i{ z7jNvsX%}D4t9;wgs6@b0H=&*^DXT1(jroiv1t&iV`TlKnR>(cXj0I!5w7fJi-*dsV=RkyZ zN(LZJ=fn5X4mA!g3ftow?Y%IGd{?x`m*>g0z+2#(55Ds_R)KNKL7pc=9>TMW z!P9E-F`MN*MtgUf7bC&W=!!XNj?-Y6+{)+G9Wnv|y#k&id~q0)AEQQi!sRez1YgEw z^0V9DNfc?r*LDXJhe{LM;T!JTsptyMf%cAh|GhS>=6lJ8B@W(elgZSv);R6eAotd6 zRu=4QZ~tB!mO#DNW|AP^%46ykIs5XIC(N#?MVbGd@Yp5S@Gb;uH#}aVar*v9b~bbw z^K@?smf2px0;j&O=N23*27}<$WQjU!eq4~g1lM=NTt>j5?Co3zY?#zI4fG0A$}pCo^=y5Q*OqW6xb?F z5w=Ry9L7ZQs?ZHLfEca+K~OT-RwNrwO_n3o7o_^?_ADL|zAE)sUFa@IwcyqXyC7}J zJTK53g^%PJZy(9vavScmMF>AE!(VfMyGVkuol+^0Rn^kYDG1g{&C{!aw8;Dv=mOZx zz=QbxuAtrcbr&PoiazxY*WxkKsGSl#4DVo9oVv@9F_=u&GKRbvQ#V=iMpJN7c5}Y{ z3P*o~=HB}!q0n}dWBVm1%3IkfVh+hOW6waG^o97VS-ir$#w|el;_HCouvP)k*?K$k zadw?s^Xel1B->N7vr^+&N2ELrHXhr{a&2cvj94pxVDU7`nJdc?YPK=%fq zw1-yT%Xp{WuIqr+shjJ?@k(Lc(kxtsf}2tvjXaIk8Y}f|hj~b`J8npB-HNNR3-VrF zSvV25{hs&OuiFtIU7s9Akx=xd>O*gQRq(FUg)<#*ENnR6Ay;wIz7w1?ni@S5HJ5;N)fJqq&GjW>i9VJ+B31I8b$?-Z= zx>QEpIB#8T?o7=Qt%+0iPu8O4)NU+&ND-5zAYD<&MYN0L1=xvV1Dh!~wrX+u1>COU z-xq44BkaL)_H}I9(vjd^k2Ot=_nOlMw%g__JlpQPhh4lkLm;0>ytu5+gE#!xx zw;CzlNpI%C4M(z^FA?RfQfpp-NbUI@LN{#zuy$)a`(~ui8`uNd$zJ!wI%7fTku6Z* z9FC@%1~=|(3L?ag3mX3%4em|$VP@OA*w}lpeNQf`-PD0m*-iH?5)Q>)xTB@LHZi(@jM z1FOfiv`jq@cSLAA@T)W~PAEDH=sbCvZ)j5XyxA0&C2?H7CaSKB_F;E#6x$eaznVl! zDjejoDT3E)p~B_t$D$^-8(?1n&iPhkv_`7G?V9X~?S2!sWcEkqUIX??c+#Iwy1SoT zW}e_oZ1uM@xqEH!W)X{QU{j1uj2%MP7lJLae>1K~;0k19=ciNZN1suY_sX?lBp7y& zO2n`U2OHhcSxI(pVnMQYmmVkxwxXh*suzV+Z+sw<+R^YqW;ClYvbJ02cxyvJ-sZ$I zvMyvv`e4VUJ;4hxG3I1*{RPkAS?C6~`PCb@r*>iqxM$~vJ(*cA zMAr6%qUvcAgJ>~!M5=L9_d1}vfjTW-3-laN$E8J(YFdsg)%ftGlcik8M%#jQUv80+ zw<+MwU7L$i2jZzCNb(=ujjw6#O6UT?78OmJRpXnxM>eqSYaW?{d*HDXVQf5gUDmUB z_dxSRWoqsj*>Ee}_+%ton%|FXh`<$39cb@cW1mX&RQtGRp9tGX_C+!STk$(p(Cr9N zX+2O?^h0?v5KCxg+hx5Gftg)({EX)`jPJjD8H{}=8uno`f>+{~wfejT`$s#=V0;G} z=O7;6mZl?YMvx62rB3eu;dW;k%pQw4ebZS6TWNU0@)Y9+ z@X&OI%?NTtNtTfxpE})H;(7xV8ZL3sPyMpr3T?U#rI{#pXv&1#m@YpfrzBZZ=Y(|i>G*{J}^$SNy^=*d7mb%ZP z;Dhaxa+Fm6r{S@sW{cm}@>P(dTgE&!s^Ea5q`J)T*ixTa{^%0dLwL^8f5k%`XF5u% zzcM_w)Y}&2c<^QfIr3$RytVh46CEYhe>Oa}RHH@dDN-Bc1lx3wNlDBaE^#Q(fLl>fRbmt1^HCCb=&Um)x6_?<&K;dQHY|o(df19V z;~OS-?5Rz85xeLe<^SJuKG{17E9Zpl;g|PVS zDU+0RL1t}Ykld8u9I2>dQU%&PanIUtM$sO)l6x;DFx&J!vtv+IDq>8rdNm%kAtx}) zA`x>YG(xMZ+v7}5l=+C}1=ZJe3?#i0(BXvN0fIOlR@!AiX9$gbETvTfohh_y z4eiH3tW`QK$ZC@rc+=3n1ajpRXVP^PT^GxD&E&*WpT|S7FY4o8)f~JRB1jtf6XfZ9w)#K*pB-Mt_CP2C90X#jQc?Ai}H#ByFc@J{UH z*P_Qru1EV%?N%4htjo{B%Zx}B4j2?oP4m3f&1a&J#BnyHb~9g#ImW!sl&`{Zf-W$$ z`35oOnnNt~EEAc5JI&Me20dobQwD7^=p}=g_ZseB4EisFn3nqVpg|q*&PqGRAfBgH z8qd=z;$b*NynaOEd0_~f(%^%s3rbLd`>mi9w>;vbpXUH(dX-iiy;&uiTSI?K?k zO*IF#1o3@Q@ZeXn3m&ov&DxaHV9JI777PI_7y|e*0$4BvuwV#a!4SaY6>yIYSTKab zf+2tfLjVhg02T}ZEEobY539a;IkZRlCK)p=F4t}#^pu7f2*pT)^K|hp{MW39k6%7-V1vlEQ<#t z!q(ysuxyB*fo+6+9(FtI%dk6P*;2d%`)Ak>U_XLwg8dBk3)p|avX%H2b^*ek1domcuTD z<-}|fb~)@y*c#Y1uqoJj*jr(5hrI*#F4%iv?}L2+_958EVE+L7Bg#XWAzkvM*>_OOXVYz#kGF@OfC&c+gZY|_&BJWV|2RjgU zFzi{dyvu`Iwenzjt}Fr@gJsx7uouBjhrJwj7HlzW8EiT1LfC6yld#KSSHjl7u7OR# z*2CTkdpqnMuy?`U3ws~z1F#RlUW8uyAMpPq>@%>9u+PJ8hkY4#C+wTB@4)^U_5;|D zV4Gk+gZ%>b7x1GWEDbBT9w1PJGH=nk8N|Y@PuaRF>Sa)GgTe+4Fo^Y8C59TrMnGw! z4azl$ExbO>Hz;aQ+@L~(rW!QOAU4$M%S?l=GKfutKAmq+g+Yr9N*J`vpcMvH8?@S> zwFcc}&@BetX3#o=?lkBggMMw$dV?M`=uv|nH)w-FPaD)=&}M_S8T67tI}Ccmpj`&N zZ_sXoJ~U{rL7y75&!DdjYBA^=gV-iz|_L#~K3O^U(>4KQes zLHyz?9}g-h8f{RnLE{a|Hz;aQ+@L~(rW(Y~g!(+gpqU0;Wl*U>>=LO&g+Ux;D=lHr zGJ{qaRBg~|gVq{!lR>u_beloz47$^xdkp%uLF)~A(4a>RdfcE520d+1gF%}O+Gfy8 z2JJBD4TE+W^u9s64f@cay#{@1&_08{HmJp*Zw%tsUDKJHffZ#L)Xku5gL)do3m8>` zH#{i{8#KV6K?d=PN#)~QwW84mOHjKxYGv2;=df&L*r!tSz& zy&d)r*t=lwg}o2<0oV>mVJ@?>hCB)T3~VFp7|^%l|7F;nuy4Y?1N&##4`4rnZG!y_ z_6yj5z#fGC7B&dkj<8)|yTkT?JpuM)*gmlRU|L<;!rlk_0PI7s zkHP){_DR@hU>jkdhuseQGVD&+%izbK@lVqeR{J)JvJ9=8LD>e8NBMdg)Z3u2K?4jL zWYAE9Mi?~Opj?B-80&<2B^HmJd%%?52V=p}=881#lg zy9|2Ypxp+2XwY7RJ~e2cL0=oxV$e4R1yH|w!iDl@P?ka649YgBr$N08>TOWiAhv4i z^B{wU8Z^S7(FWxjG~S?mgQ5n-4JtHfszK8XnqkmPgRU~D)S&qWRT#9$poBro3|e7O zwLz;5T5Hfv2Hj%NZ3e9~=uU&~G3eI@tvBdFgB~^Laf3D(^t3?@25mNIn?Wxbw8Nk` z4BBPT`v&bc=tG0{8uY0_`waTppcaF^F(`mG&?U%VD^ zn)t{zgkfdlmtll6x_;s8AiBcvgae2u%uu%%v6g0+Jv z69I8LaK(G?-tX)ndc*M8Qk+Sm;WA%Fa1o?>0nHlU@w?6rqQhi>=`3NnSEhP^nh{)! zX#Wyuz!$eX(^>X#kb4M!V6tE{f}Fu(9^8BNfBwzcWt0O7O;#J9IrZrHe8;oT?a4Ae zJG+d?!?dN@J*g4ALDTHP@s#do3k z&72jxoa+^bS+5~H9;t5Nb*>J-^Cu_#L3bj_vEGs5m8f{|#<06cG3GQIk}rIwJCQ_+ zU2_=W@r1?Pb`I#?d+#In>P{q)8ZAOnB6Qk_D-|>x2V?|SAm3@mA0MA8?&?`NBoBXO}HrTv^rr)`i*DME&fA z#Y@`T;UNd^bS~dwVY@S6UPaZM;tGq>-nqiWoC>IHFRm;tUTj|_?b>$1-7B7uXBRIi zIZ6cQET4U0K@>YI66Fia?EMvK+|f94)VQ!1?yz79N3BLi*!A7r#@eaw|Npn_u<%~B zEZ0r&3)@ADij*_m5#c>obpj&S2RtMFe7Sb(q_Ho@-z4xnV)3yaSvw*;j0ZsHSZ1?U zG-+8i+)=selm0T?u1L4ORw1Uh$~UGB-zf0JeSGeAm_D*yn`!aTO+yXR!@a=kW?XPZ8QYM4kIz4I*JOKlGWUUi-pSlgki9j*+8UtR9N9)XjHfw_m%0wf zK;36>Y#G@GZcY!RFKLs`z_=#9bojJFZ z_a5w>hR5!@U1U*o%Q%}Swm5w@{P8zVhwn1OV@v(aqG*SYjTKSFEiJb@9lpB^k1h4N zMPUcXc`x2g?R4h8HaxZzmq%&Xm2srJ_h4rk9!j|zHSMVJm*(M35W7%E1t9{+EKHjBDYQIhpp}HUKC*N+D851w1#bz@}TX+e}{m4 zW5-&(Fro1A+5EALO4Zs<{3~T%8_I4ErM)e-`ayTtIE5{Bp*5Ql%R=ed_zQPrOH@gMbfR$wfVj>Tj%o ze>n{WH3vgyU@&z<5^;=|T$8`CD+wL}SYd!F};{@$!9(aEPoh_)4_=Rj%qp zY8yMmLeFiFm2aOnm*KtI`1ih%#)CZ~!Gi@Q2Mfzz;W|nEl^Ju91O>SvD$Jdem=_Z&*WlhqS`_QNL_ zx4aiZ*K?XJ{?uiIFM8#kZM@TBTl@faweG;_(evYthq}ju8{_3066Uq)ItrnWry{O^BxYdrMG5j+}Fet_k1@V@eWDYPPupZ8esm+^yl zh5pzO+=&;iX}qlkCA@WeBo&B26GbGo43}n1?G{VLvm>c^&w{P_(pimc&6fgX7hUTd zyQ57*#v7mPWg$by|9Ea|j;A^aJGU^Sn=hMm3Api*4VtshGhWw42V0yZVt>d!sBhFi z{P(^0MzOAoM3L(7u}K-Dq-|F07%6wiqR>~*au-7HJv0P>*}UJ`anX8#inA(S@*>K$ zRE7*(g923vcW;aj-WJbmL6$W{S8q&q2XXoFID-q?b;oEjh#rA>kfS0-fX*hwKt`IH zHp{&c(pKEQak2=9*-`Mg3w}C|E^pVD;=m01mZw8)yS@D#8`gR1b_f*sAFX14(ml9Q ztM%ZsK({>M*{~1Ac7-*ip>XAxkV%qL` zX9n0ar#VM{?Qsgb4>Yw~R)5c#n2snBV;NhDA2J$#?K6V>_%pcPzwP*rGfrWe&~!3V z)0H5j6Fuffsr#3#UE_>XzGrysud&xJ@&?%5^Ta~-@P);C;u-Pa|5?&9ic}2_J3=a&#QmxIJ5y@ zf-lpm@0`LA|Hh5<%m*?Zs9^m}mRuMXcI6x6;ky&`^T6}2#m6SbiXV_;&|eO8K6kz zJ1_hTv;n7NTj%e}-?|2v0h5GG-8X&a=LYCfr=FVnUXy?}Mk# z;xqo`dL#H2_-+T!0uCr)%=?b@zVARh`w4h9SbVmB?kP9QGaEKqJap5vcM~P~-fxF* z_*m}=QSre4V~?gWu&SHTGcVF}WoPLE&e|k>-0M2b+7zvukR8p7WSb|ennCIYQa6XR z3#2TNvK-R$AZ3D->5zU`cbxd1*JH)~p}QMGPc%4+qa-}b*}hJjE$AB7Pv5(j?|{oQ zaIw-SYg$9Ae+Q?~cq;N~OrwOJhy`jJcGR|X3El7@+`@}%84T0UglT2x`pIDG8mhfP z+_P*?4PTYdv)S!=c7ZZ=u8;4iJqXXvhP%Go&+EHQscGDYE80R&Ob^ue{PBYArNPGf z@fX!>C9yeS0^wFYcZ?6Ad1@2mk3a;I3FJ+27a^cjeb0E!M*3NMXk`6u@di}e`lsVF z@fRvQl+#etN)6MY8@T(=N;DJnkJML_SgULvcVe-33C%#s&XM{_nq1s8!Wc*E$5&6R z?{-~HmoH36o8`obqpHZgVVu|JDpBfhvD{@XQ}=tl2nq!>JupI~%ums5uBihtN+N8(+YENXNYWtH9!8 z!`qU`us%zUZJLJ(iQ2=bhOWO7K##m~fM#@M^+%*iU^C@n!csvq@vCUHK@S+jA*Vh) z7Rjop)S#3>+*_tkzc8o_#ZYNC8uWree>Z42sx7|^nSp6QD#7-mOlY_{2V;D_i&vK{ z(Q>s)YIEHbi>i~6yREg2XfwJjJqHhu*z2bl><-4WBlQusV3ILQPeIXWtIjaW!vqO>NSff(z@*_S*M$ z+W)xU&4F8UUW?bZ;GUa}pcSNcS!FLV026MtN4h`B7=&Wm3Tj(J8+r+D%-a`=wqX7- z+9GNz^EF@PYD#{x=fY;nC6k(Jakv%D24cU_o=dUQ(pG$h6Y2KKEZ3B0ZQ{3{_GkiH z(1n%pR95SLBh^e8O}!Z9WsR5*nZ5%J1?=?qt#=Hq?uU#|?dsB!II*w<$FYmvPaQJP zI^tOzTK3lLPadn`@JsYLf~hN-N*$98fVBsECC=pZ@S5!?YxDv49z*My2vCb?3pm$2 zjb}~k$$+R>E5%SOwl7k@cIIw0b}SAx2lws5XXW~_V2ji=aN;{!SM+J5wGmez))jqN zH~sx+-Spi!dY#Mj*K!bBPM6!70rbjKC?CY-Xz-63K{eXQq&m#?q^4xWpJb<;xfoA{ zns};NV-bI)_F&1eNFKmW6LNfh$tLwygKq??!(-{8DNhA2;MF4z!3NOnYA(MUPvDb>4CxIiShK~xbpepU$WD9u0=*K$VcFKxny`%rM{ zvUuG^SrMygcr8&3y|>sqfj*Y*j&S}lLuZqm76F$df^6%FKoiyv3me@xu&T*bXLg$q z3B@)?^Y($(f*PE6L@!}=w+s0Y(RLvYq^$u@!YEn@8YrbH+A%I??_|opazOr?sn(eQ48Jv3DXUXiBba)%Od< z8soKxL!$i{SLsFb4u#e{%GlsLnnhg)*xli37JkAKSZx~ z_0JIR+QYpP-Ez32*K}@v~-|e*6 zcFWyvBaU5dPur}iMhT3)m*2x9ws%LmKc!u~oha_1C$)?BLKJsOuek**1yEruEiALQ zsHAhOZfPdIAotilI{!xt+{Duao;dsH0ms;0A@t;lb+NDWVmqu^hGx~@47JX_`iAwQ zyrP#@yu0dSG^2S%+g9vY^*%aGd9lqaw%AIaU#yFLm=|kU@dp{uta`exXt&N+6g|D- z5uLDTzMq+{1%w}XEg)>s6x|4<1>}9h_n~?EcY``3yOhsv$D(xw_+~};&05+6ee${> z^D@<_jhkeL-U-R+N49a+r>`1L`_oq_mo7uaHZy^}`;ta{>2}zkFZ=)KU%Cfv7Bp-V zybT+_a(2faX`h+5FBwL2(1L#Q4rxLl64C@*d5R=kb4Q6aa)NP`4~aFew5l0Nn}<|= zd({VZMepYoZCLU0s<-QkcI6d4zGBm=m+Ok&$SZnu#gnTx)fMfqvf#lLPgq&-Fz0hM z3vz)p;hoz0JyvD#1bWf+8(c6sJW$=OzoNlepj0R}<3%4q*X4ZH)L zZb42fsIDH*NlYK?hGj*;U7+E{&=UtSKx4~ayIFcT=oSt)5g%tFKEWU-;u2jp1ht>e zXJoJ9aP2$jsWHaOBhs;gxAWQ8CuQTL2fz=LF%WL8K4a(zx0|ZmjP*}%rWTuK(6vGdJ+#^CHaFc65n3y7i!Q=dc!NfQwyerll8SAqUYYg|^ zmRMV3z4nFXnO?bHBo z{GE8?%ePtLZj~!We0590Q}7wkrXh%(miw_lTJDR0^nIoS>HEwwC<)|xA2Tb&ehELJ zNG*Fv`LAa(C?HW(R(_6MlO9s17BQ_B;nn!*=IBy)Q`priwEEAWp-ZP^C!!bf;mWRmGF)kq_u+75pu0y5Vadt?Pka0HmGfWHM8$JA7uDz=)0t4xq`;q?RWd5j?XCon91<#9~3637aVjB{X5` z;MRoM4x|a=zB@V=E=&~-LhZqSOmk98CYSuG#4}vFoNUit5x~9BM|t92;pcmJH(HSL zzk53Lui_(LonfuAT)%tq{KL*BoR18Ty%mHNg{C8HMld88S|e_~{W)h7&L)fMY{I$S zqI41|uK6Da^#0PyW1USnKQ}yfSiGH`rZa3ta4~*Kc&X2-vz<*iwyp-A4$Z(*XsEEH zvVb#!cjA|C_(fp$1I{L#!-mHWi}9i90-F&$1HVl1&0RV+JDYIW5Yco&Sn9z?nl089 z%Kh++gnrN8{jReKr`hn>QW1-C40tnw+&RFu^6-t19(Fe2Og23BdtGl)x{1_7_~m=8 ze6R6tN5A}9!()flUlT=7YzDcjpev-l*murBN5A}F!(&Sgx6+64a<)HhU7fhv(Jw#7 z@YqsUTA{O4;0kU$XWjhlyvMF_PIYocf<~`UCOXCnJsTK0`th7O_xZ5KrH+329)`yb ziie8}%M}RA2G<^cL)Fg|-%@rAPI|9=%vwxr6&K1gqh9_*5!-uWV`-;>+{4%V* z?`;{US11=Rv2N@n6=8YLb%#OC2y)*9&GN5LeL5`i?vv+XJn>5PBgIG!{!RaGdWEu_ z>(0SL7~v6gvlYYB;PQUINWo5yxn;$PVS3I23M~=V#0i(+mQt2;HR?gidUw(~2#@>H z0Hu^y;)IZ8RBFHN6e&7hV**)5d6>?&=@4jphXJ2GVl&`hrLOSAr~Nw&y0;1IP8Am4 z+CLwz+ZnM(&9HtBf4-bJ;!Oa$6;b#m$1aRr94RcgA{K4$@$_jE+an7N z$Kb7FRc;S$i8fE2EtPUI3fH(UIr^0Z)_ct^sVGJ$l~sx2xrwsH?r;nT?k8}(R;smI z(@BW-k9|2&oLycC?<96*fVnc*G&5QbeNHFWDytUb zs_OFZms!D}#K;ZOiKSIIfj6%_VO=}!D$bJsdh*Ui)#6&U5D#p>oKR3U=9N{JEtZf< z>46oTZYEA9N`&SJw0n@xdF$D{n^>A0>PV2Ahk0W~`WgzxVCSlHPEY%c+!=b6RmbJU zEPS-Tf6GqZ(VReZ40{;7dAJFdhK-f(q-?7J;9Kyp*G^;jM&^!GivFI4zti2#E8OCr z?+%D*pi`T`ofa>fP2tPU@%Z;X=)VEa_3X;P@K5+gd2b$`1N!55cp^X7FeZM!9g@{} zb|!d!Yw*^yhI1|x&1Kr#5z1_hw8J;tchfSnYclwzSiDR>(LjMK!(Bm0dAr=_ zpGN~l9Y;3-onGYoMqpI~MNE*r#1XG!lC;Y>$-`I|Ol_=vA+z>S$0T;3a^-b-Rv;AJ zXrIq=c2^aqxGgk=xnr^~z! z3|!O~NS((p3v(JE_oRloEp=g5b46jQv9`5SGFM}ViQ)O&31B=sRy?z!o(yd5#C+tX zfXyQdF~8G1)X0tC9-E`drOu0|uFR4ZEWDtc!NMW6=C95+Z#j?t%KNT1w7Y={g!Z(d znQY^+RQqn^Mp=%DWi=*8M(cvnb2=o?kRQz^K^u%wc=dbD8jlxLcJ2d-xVaG+B-Y!dy-?REnM78y((#tgKJ0|5|gnqgRM8XmN=H$ zCv;gMNUcQXtU~5^(sLy)H)j2br3ikjGq1(}4kw*zXV zW2sk)Qd=V_Oai}Z-9ur;c8jL-ym;NQ(bOJ0g=cV{)|==tOSKI6oi#CL(NOH0h^L?& zMl!@(Iaju9?VOE>71}xCySgSvkN-JG_GU&Te@=%?uDs9?{AvS}55$#&O!?(^H8a2x zrF;v3rVEWt2eyQ5LAp`El5>BTDUm>p+)M4=IM`sG>v}-q^Wqn zp*?J9uK>9Up{}yo$57FfZNq{ES1>o)i$^RxRjl9GLIeFn=U}H!@~pUiXG{`DrTNTg z?&*1;D}{ql?6e)gnxMBSh~fHE7QA?BQC4$TyA@yzxKyhRW`8`_B6B{Fe$UugX>nsB zDQ%XaF?qCT-45hxBCsBZeG!RMYR{Gn>nF(F>D_o*++N#f`^W$_7o_Y#sL;AFstHfz z46pN5)!BK6@u;8QDy1pl91b(?J8I=5=DM&^Z1s6`6J!Rsw z*fhNmPda7vz&7mMxQ+W6>5K$>zd=zSG)7Qma$(@w;)-M$T#jMd2LmH>XMJy`dn6GA z**oJx%Kz?)!65Nb)7DX_)3fZ0lbjU;Hp?`bfw1(%af__=?j1pOr2Zp+bB42Gu+H$< zQm1J2WezSQc$)Z$Yqe9CoZ_q)gbj}^^$&}$vxLPKku1-?vS_2TVsO~-*iu6=x}jkv zWCS_xU|fqQeb(%(7>qPLwiI{g(Xd;e5uAfxzQo+Tkt3ZIgE@xBma^w2*~!lcR^yi? zb=IpdKIg0$*mILz1Gd!3R{9(xQf$vD_0Xz570!x5U&CWdJ!XZ@PHaYSD}EX3UDIRB zoE3vV8XjBfO^d?nl@Z*7U&{ae)W<${Rt(-VJhs$UEA(SUimf5@;Lsg=vz!$J>ZPMO zHegHLZ&5;^W(4_VqsM)hzV$0-#o!^sV@vU-K^j&fr$lZ2yl$bhVsNVAv86ICN)M0J z^`ZFN&WZt#CDAx52IG}rtr+CP#gu<`eD~L!6@!Ux9*+_!T`@SpdVb#}IanXy8@lIQ zg-1Bp8>Q(9t4gH!>W^PCaj0`6?Qh5cLmscfDu&|dBP~Avmdka;z&%qdJf0Zpia{rO z3A5?t@(Iq3w8PjU!3d9_+48IFt*Y(QDhOB~u(C;Z1(59|Sf%Azk9vXP=p#L*@7l*m z3A8gSOscyDR}UuJLEx#vOFfh+6E0|HE_u8iMUf(pTLGwgQ0U=d=*RKLGRpIj?Zm%Q zcu34P3cqSYu~$OK*CC*{uG%uTKfKS$HtNB%wiEwKd9@9tri~Q!;oC+bHR{?%DP7u7 zc*@Q;3c1_ZHcI)v?Zm%QZfrxT^ibMW03h>d4qF7ZO}?H+F_^gIJ371lOLV7QKDDj7 zFyF@)T1c;%oxn8tV$o?jY;oD#MTy13#P7(3m(Rwsf&I;nO^#h`+@5g3WXapS?(e&i zLD1p{<`30Vk0*v|y$s#%c}>2I;jz7%EiY2N#PC03TVTt9KUS-$-~kS08m*2&66 z#hBK12tFq@sJVT#E(G>_inw#;e0Ehy0#`B1OnRGuIg9$Qc<9f+^277oGcoPFg`tZ~RzBDR?pX6Cd@)Wl;cOO{oZ*wf7t3n`vVOXsN*J8Fk>C#vge zV@F*aLba06Q5WaXoIsFdIf1Ulvw1UL`g7AcqjU0{xoK_n&p<=VZz7Fku)?GM{#)jz zM~(J`$J<6SU9Auw%3P>V%PvoYec@`q44>CKkKe}OIt9Mwwd+p8ao;YHrx<8#_4Z{@ znuK$nJM^~6Xlh&S?%n4$;8}8t?nkdaxN-3wnUlZ_Sz=e{iGpD2h1xw08*osuwdPPY zSvN*%KY%K$4?1o5hFjQc4wAa~!P*bbk964{d5ZCFUMGIVyA?K#`d+$Fg1zt$7DbR-7|K*S`qYQRDqE{ln7^vDE94>c1i4?}cja5Q%~e zDh0D?Yd}Ndb;b)FCoj`2+T{iNWzd5PU0(tYJHogvF?7SlBC_ZF2;LlT8SS!@FUd{> zUbtx(p4uZvOxCSh`W>ArL2vwCLL4tWA-cmR9s$m*#C?7RjE%&j75K z>=3#MNrrvq4UKy{b!%7~j8yMFKT^G|I=VIz6bbdA6+X;~r5YnO9|T$;jTo>D@TSJl z>bvM4b3lA|XM5&lfA=8sG=xFJ7s&{+A)uL3xBpUS zkm(FW!&Z01?yl(|lg$FnW#1_o?hG=uv&q4oEyXZs*bsW(OPj{F+ZEdD)@Tzf9?1`T z&BHujDE)5oqWRg2upntQ@Z!eju>|e-lFA&abGKXa5!y)0uVVeRb%Ekq@X@-+NNquD zB-pctVvWgqad)OU5%Z#dOFQmWc^Sw@kndxt(%TvWF?*yP_qESq&@Ti}rNzhB;Mx*& zqyjl+AFAat@XYU{wCnKK-Wn7~hSThlWQn)8X2j8IX&QX|J}yp!kI}D9gOB6zb!qbb zG7UZ!{|D3Ldo~R|&V=kpgO76ryVBr01$-Z+!N)m+)-?E7l{@vvkIS@|zs$E&)8Gq( zZ+IGf40lQzd@NV<(%@tICDY*J{K)lb^4*#SACvf=H24_5jcM?44&&7{_&AfWCk;N9 zmzFg6dV}w{0r+v5_R0b4<*+pP&{PE`rpb3%8hk8&3)0}@uE-T>@UhvuJqkN$m|1|Q2+_ks9vnfCIR^&^}HA7?U$r@_baa!wk2e2=MV z@Nq8esxG_I1N6g%QI>4^#k8)Y49{>2xr=Onc>k zkGkL}B^(%@tMKAr|2zi*q;;A8yW zOM{Q?%V%lu^#z|Cy1>6}+RI;-m+%=jhyJ(6$NDiUO}_jz__*#;lm;K`$BZ=im~RWy z;G=)nrNPH`?I&sQ@%wvs8hk9Le@KIm{%uNwkLBf^H29dm&1vwl-93^9AN@Pl9xVdX zv{zo3AN|tcW4I&JroqSh`(PS;ET;`=@bNv~ zOoLC_jWqb!jt2+h$7R~fUxwQ|4L-KxqtoOoN`sHzkGW~^v3;pcgOB-ka~gbn-(RP} z$MXDi8horDFQvi9`u68E_(p?oUmART-vMXh$7R~fUyi5GPJ^!t_@Zg>(Z8ZJ_*m{Q zOM{Q;QjrE9%ipRr_}IT%mj)ld`%k997Y5(9H2CP>-Zc0azXNITv7YzhvcJo;m%l8} zL(|~ncrcmx%-@^R;A6VnodzG@qah7G*30+P;A8wgOM{Q~%^avB zhG{Q9x`KWp<{RCnJ-%bW5N?NWc#c=Aa|iGZ@$or(t!qDp%9V-%;U@$8S}nyG*eKTt z+t$L^TB}#S?PXLfEDxGUVEMW!$jM}OLK&M(xhb+qf5O5sTWZ?-@ zJs9{;J>F_KU-Y?O^0`ZW?lPZyuFpNs=brC#f9!L=<#U(&+*kYD3w-VhpZgu3d!f%= z>2p{4+zbVo$$GnKKHdg_fnsGna{o4=l;IW{R5x- z5uf`}pL>PR{g}`FJD>aaKKJ83_a2}74?g!wpZf`)`;R_1=GHwm;kQ2bDxZ6U&;6v& zUF~zf?{nAq+}HcuFZ8wLbT1pL>nZ{X?Jo2A_Ma&;7K|{ff{1s?WW{ z=T7=l-$J{S%-2HlO=;pS!{5{;ALXrqBI?&;2u>d!5gHhtK^VK6j(f{a2s+=RWst zpZiXq`@ekdyL|3n_}q8<+;98b_xRlR`rNwa*K_Hbz&e#3%h;FpUSK~ZCM zx}atF9V}=qeuoM|$q5V>v>v}B1#Q6Z7(v_cn=5D+e$NrK7r*BTYQb+r5ViP31@!`& zENBqW1%h&ciUh@hrV5$?bcvw(K$i+y26VZgwLmiktpl1ZXg$yzK^uV3gTcFP1DY>r z7Z7?CpzQ@h{{W~32w!fXtPX)dLJ+l8EEO~e2;WgW%>}|23MdX#EocT1T5Ztg1ED|4a zzZj(pPX__vy9bmD^pK!95WeN0%>cqz8E8HbzNbLTfbiu5S__140?;}jv}Qo-fi?=- z0E8AAv~57l<6vMH5PFe7dx7x%0BQk3%L|m1i8UBOy?{_#K^p}0uAp3?KMUg7+TDU? z0R2tSe4vj7Edy#2v=-=7LF<72E@(Z_mx49`{X@_;AeJ)359qL)7O1zNbwGUutp_?y&<3D^ zg0=w-60{3wh@ibd+*OP81IiJU)d_Puf_ee*mP^DB=xjl`K<5gI1LX^v0W?w2e4t5! zmH`zAS_{N|!^mHtDT3AmT`Xt=&~!oDfMy8V1@t{Zdx5Ae2k`?c7L?T)b9{n&0nHOM z2sne!7S`ms%OQ9tpTs7zFvJ$~rQ=_zOQDT0$ zY*|TJSt$j}=anrUbu8gt09sK_5kTfs!h! ziX{`4APdT?Dg#PoHjokfLBnMgWef2h))P>~3+si!SiEpaplsP9%0q&Qg;$-2clHpi zOm@-2R^qz(te7oZR8d}1p0F|_ys#XJoG6)3PJMu!l($8)A_J4yC|nvqI#-mEmobNH zF_H&|og|YgiWko-3uxg`0`fXgUQtmtuec&Sr`+0R9G*+%5((#lX1{Tl%*X2@u*FLZ z$tN+tY?*mfj#4JC!E$GZWhaj9u0#yDqd2T*vK;afyi*vG^Y}J~oJ3i3JA7hRD%%`Y zibb@t_`*n14Ye;PtOu+VlHPm} zu8@ST#M_mZGNHp(g=3l{f9E2x?T4l^T6NHVAX+^P+d@W##oeJ);gW4uGFt$-KF8&> zng*#4l9*P2OUhV!6KH8{L3vF(M=h>oC30u+lHv+0;=agno1Q)ilwa#AYszNTUDS2d zBWctm`e-7gL8wgVn+Va}^a;V=^jSqaTvk;QuraD_6`BC+jcuxyrG-|E+2)wH2-s9@ z?pQP{(U35|v0Ko}9h=0gEG;Wr6sSaDLD3GoDgb@;f zPF5ts+IYd&u+(d|8zu9r%1f+_B^_+#NRb3uiPGiaxy9ubNvLV@JxNxU7B5~-D$~l7 zq?M>CreU>Pb*m(_iF#G3orK}4x$=@r0@&++Exr-bx>^l~-L`lV-IeF|-u*W1mU+OC z-EEe6fSSU#wi1o|5^~HfpBGp%9}PJ^LzQI#zMfr3oeF^bEh}Eg)T6&n%WvhoR76%k zms|V{AlJ1vOXTO5&zm1e%rDatV5O1s?P4m@{{@v*ODm;LC+35+urwgmrA=a*`X4Y6 zAkgom`A)f0!4S>)ia@fmcuob11Ivtj#!v&9741K8lHz$~R!I#PSInzgT%MS}&@foZBn^=*v?w_T4Zisv8(!pIWpM)Kw;g|2 z0h5&`@7U_Hnjq8BTzNdEoTX6^7{KVr$3qHu=Abuc8H`YTJfx`M;FAWU1n}hJ z7ya?TaWCCh;q2z-V3fu=GE8n7@@53X_+`viPbs?0+0A_nC^W(&=sWUj@8;%K;p;#d zlGS;Lb7c55H;?BaB-jyFw)MPs@B7ZvBg5{an!@9e$`Yw#EvbjsC&%fLVfUd+;qgdy z5vd-Q)bpVS|DZ>PMT+Bp7~%0qbp=(AyYhKi_baTMenn~&X?nodtH6)xlo6yX&GfZD zT%<>aMQXHCg~tL6%r|?Elo+&?5p+2ut?=9Rd_s7%-@V4<3RK5?tvrq z$goJ|DOGqpQp_nw31ZU=@AuIo!y=V4Ld1l}BgJ&c2(rx3y#COToAt=BO63Sucsx?a zgPsxWB~Nj!>osRZog>4;EDc%0XBg$OACkac%)7csjwAR(ZMsm za32}g!XZ2!sS`!Yj^U=N$M19<8P3tdAv_+blSIm{DL*-R*?3hlsxj2UAv_)_hT`Pc z)?2r(Q6-})rG-OyJW?l%6my@Z&!xBaQzfG+l`B-?@kntZ&rxZd`@&c6sFG2Y(!wD; z9x1juj)H=WSNH!xm5hqiNG%(}yl79qu(aJOrDY?GC*C%yA1OhWG@74W_}}`wq_k`Zk4I{NNZIx4xb5dXIKU;PWkYy8QUgVb zC5v8JRYgDMe1by(xfsUT6eZfO3Q}uc%;q&Z${AWJCDLN>p3nd zEgQn)ks2>jb{jSHohwI=cS&j45FU@zxgur9a7W);!soiAv}_2EN9sJ0vRk(Bw99JF zb4h905FU@z`66{3erdkj>xoy-cS&j45FU?IK6q8(J*B?d`P<3)E-5V=!sC&Oh?L!K z+W{zBmqtoK_vkrdO%{^*j%t`i+8OJ%3< zc*2T`R8RcU#Ct#3CF+vWvLQSksTg=Og8a(Uyz^0hQOqT!WkYy8Qj@^zl-}PzwzcCV zmz0(b;qgdK7ODTk-kXOhE*LNbLD?iT zf(sCwq%ux})@rR^YfJ5>ty;gWB3PFol*JX7uZ7|QRxL4F(JBT+^ZR_xdGEUX{IxVq3In4K>jJY}4ROJzf7 zd|V08x_-^NZsMGThf8HcXnb5{!ev^bsb}4~s?6mY#&$s`f&CISUbv1ETTDeB|NUpi zd$?3KgvRIBg~DY@<(L_V=3MCEQrQq1AJ+t*UyIhh-DiS_OJzf7d|Vd^mnq9DPAl7R zk%voVLuhDIPAB4WaRIP4$IvK=mWfP4#f8YzU2y>tY|*(v|;A zT*rqL;TkAdq49BD3cTCP zzW&QK@k>2igM>?Hd|a0amyzC01HPGZnTJbdLuh%{BkF+MiDMaH(tvjgRXJ;WDYw{NgcFukdiGYzU2yt6aED2)n=g+0V*7T*D;{ zLgV9_AzY?44}KB7V1|cFWkYCuTr-8sgmA^7wF76mT*WFILgVAQQn*gQo96f5@Bhmy zJzOdqLgVAA0Ik~#cJMwX-~2DjP!MPx4{Fn2+ zTp}DoP?$+WoHW^o3q7iLlW4xE2YQsR1?= zF5kDv%O%1gG(N6th0CP;fj^zF`&uuT2#3)4xE2eSQ@-war)060ON2vcd|Xw+bsF9@ z6HA|+QRU?l;Sd@hR}!>tPik!cAD1P)Tp}Do;sh3M+LuhaJ&aE0-v8FB2fk(<0+A{#>E<5~tYT@dFH_e>Sx|LRYxkNUqVdK|eR}$ll zi$3s+SH4;4sTfiEIcBgJLn~Xln5k1lkCU4R~K9g2Z5XTB~c6h-I5(jPghnY*fw* zh@4}G4BxE)yyqTbF1CDjYC%P^sudbD+ErN8Bj*xwZBn^R6x;XDfLw05;h}|MDJR$I z%&xM~RUUb?aIte`jql7PJrfC6yX1W)(%_*(hRcabJQJx@Vl7L->1CH)6TX)Bav*rt zXj8szPjc-6qd)OH=-Ptr!aV3YfNpXQx&gzb{<1@Y=@A6{a?s7|p(xfJxz38Bzf(=^ zW^?C?2mQS)4?4P6kp~^J&6<-39sQk`2Oa%Q=0V3w==wb97`~c3=qLxP@}OfpZp(v? z{@$Gj9p(JqJm~1}@AIIezkkYuj!pFwdC)OkHs(RcYT)@i=osHO@}Q#}yq^ahD(s|I)-m(9(0Uv zNgi}`uQU%j#&>+4beHErM>)MZ4?3pbwRzAneAnke#}3;qdC)QaZqJkM&OGVzIeU-c z`)Qu;{W=diy7yonbWGr;Bh>QdWzLy>)HQ!I19Tw0G!?h|;87q1Bu zsDX}!@odJU+uT_t2dxO+3W*nyiz8DbQ}i~Zl^=I+!)@~q^{NIDFZdgqJ5q$1*$3^+R-K2vCvc zP2dt|BE_3-dOB8j7sCR|baR(bEz?&l8#Vw+WS6Zg&88kRAxYkV3w+9In`3n{S{V;T z-;J!>1j4$p&FQ97Lbt4eUTO|1s0gl%1-6cA-W^GQ8wl0x0U4k+q1uxejAwYmMZ;@A zntP6ld^g(H!^T{X)$n7S1Du;I;vqxQg=*I$1P!x5uTjiwuB~4>$_f8qgx`*R3>UB= z)sv^=cC~Dsra=r>oSl!Ou?syp)Yt~OtOV*z9fg_+X1fYcOX=ySI2}9k3|CpkGhfBi zTRPYti40M;{}z#BhoiQs>uLEEEUVA8LNyybQsGT3mbZo&hRRiWrUXhIt=GCw0!e0 zme10X>Ch^LAEFP4?sJeHAcC1 zE~(icT6G-0)rqsjg_8Z71F5d*55rkuY&@}Of2JvtX>RQ4HWtsI%veRQ0UHTyDa}S7 zuy3@BRn#%aQATCk^6$m!j?BdB&Z~P0?Mf{0>FiLCQjB$tJ(Ou*njO2ZXj|qvEfUR} zv%(ikZ}~V<{PIn2@m9v4Z$@iSu~jHoKV2(VqSdaV`!)NMb6D-y&EKA=dz`4o?x7wv z2oz+sc~d<7m#(Gf{+dBqRuaihX^Li}Ry13-FOrRZq1BM4T_nBikd=H1Nk}(hb+JG! zQ%4Zhf8*Ms{YA}6XcbVDhx=5}2yOuV>aWqjSCPzSJF=nL<543ubi%7`bMv=Q z+1iJ0IUZ3n6~CjhB~Woh(!-lWHPOR_=Wz!1LzILBA{nn(`2fIJx~XfZW<8*2Hh`Lq zrTm9tQ5UR^*Fhgl*LTMa70sdAcR&=60@rRLt$4H7S2Vi87w z=}jbEj1V<|HCGD#iH=QXFls^dAOTg?BHT}p7DQ_nsvvKBEm1~1mb~saRC6T4RQj$ujWIH0Ua8G8A)ItRu zswsxEk?cjm_?7@tqPd|E-z{89p8uV$@Dd2GD+l3q3s+J(Z>oI+ghuolZbN1KUAbHH zYl)Q`;QR1hRu{t+%}(}GEBPtV4Wr;-t~8^{+qlXnS>=d4Zh+2CIaFF#5{PC*=n{~v zakgxY$s|^GFWS~Ph%(5omen|1@~-H$Ob5X=p1Pj-&2P|kiL7IzQuJDB#_rl>CIm|} zB`C6+Gvkkx&R)a)xZq|z}{>aqhuaf;wN z1JVli5O}{YlFSg_0OX8FPYn_D%sM$ z1nxJs+tR)o|IZ-O7E~%|4FD{EpYPAW7(qk7+P)9jz9e`{`+8V6KC^{|4q8fXC!U0z zaUv3WrfV-dJQBag-wlQ}#}b0p3cQaKs2*=kL6#7OLV&2n2Cc4uH0QMG@!bw>r|L>j zCV1g8o1YeGiZ-B$ch;OxU2NfYVcZR!2yBcM?+o3!p~I`y2Lh?FNYv9LSx`DM&-q3e za1pn3s~X!y)-iE%#o5HxO)w0c3ylvdyec~h5Ne3#N!rkYOzMg zCnw^QIC`UoWdsp-4Ab2EO?y_V#z6Eeh@@jk@BJn{#mpGO-f!|lKX43T?>F5$-m!%; z-Qqih@9rLZ(tE#2&oCIH>Y(|uw^h2I_69{4LHAE~KgBKYH{GW+8PgGf_nUrGw=jlr z_kNR~V{gWg-}`+OzNwZO!}xi>8NOqUCH~3p{igd}TiAQQ>3+-alRWgy3-34mKgMHE ze(!e&e6waXhW@wwW-Vw8?b~=HjQrkj+6P+Ld%qbTcl)f~&+2ZB)o0V3{XgA($c>>lxye|<5ANDy`Y+=d;7Y1~tK-3c| z1u6kFN1zFSP8VnfplbwL1ZaUk)qt)Q=ypI!fz|+8BG99NZV;#*&@zFx1F9BiH=wjY z`v84kAXWkyfjR@CvJoX+pb3C}BG3##_X@NK(9Z;_2J{PoZU^)$ zfz|-}tw4_g`kg@afF2fTJ0PZOz}gLnIwH~!&{~05k#I02V2!@;!i2n{k@42}DT#!I zJ1hC{3QQ|HeoC3Vq7x&Nqovk`aXh0hh>n?z`g6?WIQ9wE}VBxVXrp715 zM<=5GFKfa?ggxTooo{RM&>}uI{p4sOIypMc{u*1kpmOoddA2_YKJZA5vgpM481rwF zPKsVMB|3gg)B=EKvK5^+flnenCXR$d5b@{-qJHtj$OKZ_|N4z&kni&^oLFY@6`5>} z!QnO|dspDdCy6WDsm`wlPQ)$T)<2PLCnCdm{c!-_*k*4<(F(=!l;JrV_$l~*9^yA0 z|1#86k=1MP}qTbIZ$5*VpXGbg$^{>fmp$)?RgGV;y|Si6my`215I$C z$qqElfi8ET84fhdfmm^s5Fj0j|_e%cDW9 zX{iv?QX!_LLQG4An3f7LEfr!~D)d7@pWyigo-gqn!1E0r9@*9wPe(jFmaPk(Zg@_> za|)i*?C*Z~?~jK^sBvn9|1@kkHH-=|j0!P~3NefdF^mc^j0!P~3WXhr`K`FV4s^By z6*|yh2V#CJ2lHE@5(i>_D=y|h2?v_sK;ETcj3AX<*XYN8@>GnQZTBGr@GHtUp0__b zsgK*>u5xI?mI}s1TRu?iz{TZZOoz%-R%P5~eVRiE3_UJ&4dGUnaK>xQjR1wpPSthf?5s)1pI*6Z>ZU<(3ayeS1Y|Ka9g?HreREFKM& z3GD5_7yZbbxn_^6YD{rxTDr{qD+o-+o1L~3N1y#cd&lLiHW&RY2t33$o@X{6pEODd zMjIWPmM*h2x@R-&I4ZW)J%IyOVuZ#QQ>vr|0mgu)&CUYj; za{cNy|MF3u6F7z`m(cjQx(FA`3r+t4uZ;Gbz`;rYMreFoRJYv_j=A*9w>>9t6bqB6 zd6>$6a^7f8~iMdrsgeQsEF99~XzJ+?4Nl;r1iFCvd222#t@6 zHLkm6yyqJm-#*n%je#l~LgVA=AzUU6JJ$@l)O!Ml%7)PRxWdB4HiD+_>34Jwd;C(_ z2*buN^QRHx$l?BhsUfF%xKuWT#^+a0;bN^wv$y|~H}~{#scZ<1kLz^My1TNfw|zGM zbPt!xhS2!9dI^`2!)srE|6jd4Tq+wvC?d2#t@cpKzIY zb-p}~+jLyNR5pah$91M~nKZ0y_s0F+6F5{hgvQ5pmd~%Lw_I7`J%K}ILuhE`~Pc&Tg%jgRXb;i8T~vwy%11>O@lR5pah$Hk!v zH^1J0eDLoFc>Ge?5E>sB%Xoov&dRjd*poaba12t}5E>sB^U>X-_M<1`|L~r`q4kE) z__&ylZmC?HjvwhgfkS0OXnb7EN0)2Zl2O-sPvB755E>sB^U>v+bn81w?+F|#8$#pb zVm`X@TDaii!QK-%R5pah$Hjbf{aQ5ngI+`3l!ps6LgV9NKDvGlzJK_K-V-=fHiX8< z#e8&gx!b*W4fLMCp|T+~J}%~?%hhz!PtPp&givKeXnb5Fd|cyhz32wd2^@n}HiX8< z#i20QuUlW;eU$eE4wVg|@o}-g<7z2g&pB(9_XG}=4WaRIjTA0ZQjWX#tLfeoI8-)- z#>X|v7s6Ktf7pMNn;Jt@HiX8<^*!NYtz?Y%1P+xAq49B*fY@y-A6hzTW{Jlyl?|a0 zM=NaSBf@2BwwJp8;ap;@!|as0))S~ULU*ma^`)3ITG4#tqp7;49A~+@s5TZbdYr3` z6wIPj)f|UNUFO;dV-$0N`NY3sK5c~wsfFMbWV>Zd8*BFB%1ZOaf2ENLJsYic{Z{- zgF(r1+kKpcTaFW=6%Vd~&WB5&mWxu!ay^Sxzj4I5`4(?yURhO6*HQ~oIB%Vf>PA8G z>50tKh7=Z09aIj+LQv`{=q^qRUpdbzXHi5PQ9yABx1b8o;|z}J*7TDYiO zN~VT_$t|C{JCbq42Fr>oZCA}W3wKS)e5}%Ecj!C6`CWUt)O> zI?^oIs)2Kr%nZ%XG6?3k%OqbK5`TQI8ze{im-Ezdd;4Xf?5xz6!ulRMc(5Rc4K5t2 zw%mQ$S>!c+EN(}%CD%K|W`w!r|9@roWs!duWD1_%i9*z|Kz-+*?v@;)x_}+1AK?EC zSpLbTW0fd$LkqQ)wCVQXe-~(;vg^!thHl6(ZSQTm8TjX28PnP-f;EV^H^hGv-W|Zt z1I@QKo$IeJcvb*@_JL<-aFhz>I6UH>wyT2Ui%aMV&`1u5?4SEmgF2E9iP* zWatr&*uaon=?1GVAy~^=i2pvw-n%r5WzbFN1`YECa4YEk1ezPWC}Riwse8kH>GCx2 zFMwv%F-pg1E1e!Kp;$~l0C*BKVp8BX}?KKI7SpHKItH36Vo3MxziwpYFHlEohR7Lx1>q|m+VR>d* zlOVVfURD{DaBs%hAZ2eQXidbMJ&>SPfj4^vpNp}0U80pzK@a^gSR)9c@=vT zjAvXb$7K>{#4=bff#7oOSbf~A_02F8x=5w5PtpFvEg*@&3$q@AJ2S8*&KFYZB87N@ zGLfnwU5;-`fgNTpozaCeedS(8tm}x$TA4De#l`l3VOXr3vM*{xsDO+l>XyU8UdbNY za()N6hV>wyB{B!&_A1v*I}mn`r@v<R!8z@m_LTU6b2Bg_|Hy}-j^$zp`AgaKvGBl3d z%W`RB)GEzl_3%e#B{bsM-cENDE$`ZVsuGA4)>ny0xtVl2EHrBqjO}TI@U=eC5m1%Nr-@*0m~V&OtM#BUCN$0fE_c) zqPV>@Fp}BSSfG63ZfRzBi$zGi5H?mqK`V|oD;Zsoe7rz6;mxj^N0iKFr1ZxzyJ&Lp zRXp>5Tz!>IErr~4*En!pBFFt>Su8)}2NxV;MHXUIy#tO?)P}R9_Dx7}rF?ykC8%YY zhUV>cu|q|>(g(f?-MkT8=_c&AStdc2Cg}alvNy?u_~xE$UTU$o0B|2yGg zkc)=SH~tODhiwXtXM*b9$WsyVGROMMXlA!@k2SA1j%NEl$7f6%G{ z#9n;RqChI{H9+j62Q99^WxqRUaS=+1Kwmr1NGJkYwQyN;L~NHjI9{fvwr>DZ-rWxL zB_Q=9#~O6IaA)T)G9ry)5vutNKEyL`MAA!x1*txf{Ux2-CwrK@@vnV+3#1LZg#P6+ zR&Y^mg`Y(tHy7=a8eu!EQFF$#NA^;AWV2ouJ>+Z)4ApSH5$!csO*6S|v9*ge%g6)} z#50?+WrxHro-ONeZlpt~mJ6p7nR&g!@Qc+ZY8E2^V5|KZ95Vs;3LcA|p(|=`pzDUr zAHOjkLOV_kJwaWxzk&H3&qlS@yAyP%@g%AYZwy6hxX2_OjD~`VJ)Ww3bb>@75KE`{jKwRyrMS%CkDYOQV7D8#BgpM0p)Rr4s zw9Vr>{t~gxQ9!1#^_w7C=?f~9%-n-;8Uh{5EZZ%}qSshEq1~R+6wiE9mib3nzfa@o z<_=4)c(wyvPV_@%b1?EugmB=!(9N=8*3L<~m!^B!sU2X6Z5@$}>aAtPAE!FNdes%M zuB~6*1&U>0Q|RW$@Tq>pvdh8qDZ;V0RQHgT?S&E=MB(}Z+Y;WAz@Y)c2CVB(l#kxc zAyh+bEJC$s!W}_oqkH=`#VVTMR0O-pLbY$gJ{t|PO@iWkG&YKKN-z7uLPHOW*iX>b z#rhqHXZ{lJ_fqKlw=-6mJ&8a==#CAMXXti(B^JlCA^IIYYPN-H@5etI+=|GvOzW~@ zB+|EKq0wKCtLxgw2nthzYJXY3FLmpgnbJ294RtKAC3N!-;1;r@_O;M$bFuHSfkl#0YJRR^BEHiH+uW3Fe!k&+?umS6H7t$H zyQK*JwiM^aaBDKZ(ks=3i25{N1E^`!c#r`T}p|psJ!AKLey3CqUY@1e^xwLg5(W;OrjR zB&P!eg*BFu-R?%^$$VtCb90{p7J>I*AHsBhM11RwVu~$*jqTCWVsAJo?ER0DGTies zePcg(e~JWw!BjQ69FPV}i=*AEF+D`;&)9q~a_a;HD&|E}9ydIBHQ3Rpml@xThK44` zgdmYkH6h$%;u`LKC^4v^QS5x-KFeftk*`+eFuf6p#^Z~cu|YoB0i7m0K<1wnU5RvH zrf*~nC*TQMz45+Cpc1^La{}(}@eVz}Y)GAhG{GFIfQlNT8?Tt+~a{l}5=s z+{VN&;L9=k@t<7Lc8l$H5dQ@M4zd;C8UFJlE_7G4)j2d_3$*}Dr5&oafC~aYz?=Np z$+OGc6>VHGNz>LcT$d`d3;`7c_P~xBR@*=JIM-dyKEt6gT&#F#nA`<{8F&-%>~GH= z;;uxCJ2Zxio7`wR;3){)fj2`q{megq>aH>~YhXJ#A*4b<(-BWWfJ1f10s3^pu7Bz( zGupArrRnH!(Pf%WcnSg>xH}q9<=sQD`zSyQ7~0Wva=2c#t&RY;Ai!a~BLQ9duS@6Z zDl<~En@n?r!)4}$NLvtC$Tyxo1BaFBDl>doqW9tdNQdis+nu9;EeNoIX1cul^jUAY ztIT-4EX`34SA&gVYzhKTr;our2OqRCIs7p0A+`{eD&|npR23P z@L}-)1DcR!xR%-Z)frg7%oAfBW9(DsXT3ih_c<6@Q=M;w}u zTX9|9isqSC7_JpIM!~bqC;k=lO)HvTw!$22#dSohxU;b~rj1pRbC&G9R$O}w3;xxC z-?mDPiLEd_Te;Jv6-~ew9(wbKRv4BRV-$SQeBxg*C$+*{(+bmiezMT#^62=5<#J20 z&8e2JwsL1ot6042bB7F@d>FdSc{yX+VC%z$`*Td8yo3Jk>=^7#F>ye9Yu&I`y`Qw>!3E=go--?NV`|tW>BO zozYXyFE5Lh<(z_S>4tsTs2hYcE^W zR{6N{`UNxRS4!!qLSACZ+@_^~O6f2%=T5xZbJ2qEP~&D)&hM5-5@Ro%$jRqIN(2%{ z5(rbd0|~pqNAl^HJGWh^Go{F?e9x&J=$k2J18P}^(6*gu7fwk+8$R4$*eaaiRo@Or zS7H^`d#~y|99=c&1`HnTv;Guc9Pu)W6KffnnH%P(dk^@FVOeZfW;WqROEAz0~8}cQ_uDuhJQ-upAi(xmM=5Y=RM@iOt4|f4>MJ|sT;E(kb#7I6lBv-W!lad2QY{$rU`Q)q3feI)Z`B>h2;Ncx)|sf%T7y|R6@=#x;7YEsKA z)_XQ%^77hU*c2Yc$mX5Th1N#fpI03T-B}+AZ;#Y$O??l?WT3|#STZ!Uc57tA2kp~) zRzy0!R8zn7$;`g`z3n#qvu*mrz^eA>rZ?e$Ed;VO(>Ee|7$;qDAP4(;{xd8_Aqd^@ zXxB!e9D_?{rq0>dj)M{y`bdkob4D{%b1Q5Tp=T<&jeTj`MCOdf>oC!?f5){QBU{>& zuW@!X^8pfNMWp)u70Ibcnia`uMf($V%a}4cv1gK`M3RJqy_zI7^`0a-9djbF4GqIn zCq}+~F|@WmzTtxo@s59q*1VrupU4c5o})WO=Nul#(Q=I|dme|4wK?|$vHpvl@wL@p zKz|X_N>h9?K)JOvQDSbQnC>=H^A zE-h<^8Kk9yit0=1|JjZ`;gVHF_}f>S>4!gv&}ob=PbZVOCo;ork?Ie5LY{^=-+=+M zQ{^m&#`VCacdsbTG?!HWV@2}hbkmB|$%hd>Oc^!a!V-bQ_z*^u#wAFXmU;W0gJbn@*!*^+JdxR~M-ABWEn(c| z&cU#(n~piNmYG!=T06geX=XmoP_YX;#w$Ka)K#{(hX^w}6B$#`Lp47JOBAPa9k#SD zHKl!F%hLWh6U+5JIgVuwx%mFlJ_zXks1;6~3u_GIy65L4`;}(Su`}*eDU6G{;tx3$ z&HN*hBd26e+bJ-Z&uILmj2rLt<&?$%UgyfHKXLSxh4Xh2JFDJDR&9zRtDb0>h^*pN z6}z@U89CQ%p$eY1;5>& zafc`d0z>0oMSX!Hq{~_mpcsCg>KmwJWbrR+?)7L^E|4{9(mgD;xJ3`&_nIV0l$? zj@tOv=c&T!xbNOeZ-S8;t{U3Hd9(7?&;|}Fa@VqTl*ru-jii?yO|Rsdn791@uV`p3 zG^!uL)0-eAW@#`LFwv9-4e|wN6TbQ*OFz?Wl_4;p8_Ef0*KinU7##Tx9fBdb&<)|B zqH8!9^CW1-QmA1(8ro3B==&x7r9m^n*7*3Rn%ux4Ub>vH(d2ZYkv8O9Uo=jp2{VcSWq$Fsaf%nM*mEx`Q z1{VW5Rd6+UlNRUy;T;y}QM^4VA%_{8QFLZk4D%_TNfHSwA~qPIZ?Yq1&yaBHKr@S0 zo`}hjM{@454En<=^+Ds_KJZwB#er}Q*8k_m@-K!C4e+lIhNlQPtcl%cUT~f z<$Kby^>I~YnN66A!TK(!-7E=_=D%Y4)ms#%$^?a$2DIcL!1M}E#4|ITqFk32?@L|; zt;07bGYV&SM*3~Opsp+QkOPJuq^b8BdzmR2?<7V9p>-x?I$=V_ne;Fd8uk%YtVy&0 zO#yToo}gTFqtHY6)<~}dq{Yiy+XjFw;L9=k@t@QaOxw-MtsuZUmet{`0Y5oI^#mCX z;9w4nt0yr0G_2za0-Nw=EB^eHTNb!_0t*z4t0zPiVe1L3e_7|g@Yp#Ix_SbqD`~j# zUMp}@yQ`ky9U6D_1XHuOcet)rXY8pA*3As-z8PPh=uTxwq=0p&GM3p~Yz6%(ukB*% ztB6`}tMCq4(m9O<)7Kcq++{xTufw0;H6Tg`78zsIoi*kY|LTr61WM!Ae-5MDh|XXf zdl-O!Oi*u;>Bx z^2>>e=nOL)CHmJE34JWv1%oO(%!0z0EbA=og;q6+^Hs4NU6zTL@(BKDd#uCR2TErF zX7Z9W%J0%iIHMjaQP~b@aO1^WLU(WA5L0X#kL_&)ZuHQuBWYtX8kW%7vi2MHw2Nep=Hjd)GVPs^#4_zladh^!aC+H3D-tSw zrKnz({@hjHaVwgQIWmpUMcHHEmUbFhMIMJID2Hchm$Dw;+N6B!K%F5X+I%=;VN@hD zACzV`MvGpneJv8Y>$zAq5ZUlv+sHb)PJw2iwx0bH5V$Jnf zyc4RK2M1SvT@Aue9qW!&-C@)4Ca{s}tvx^(-%^j%Y>sALh-RMmtZ;~I_^5rnxjv%I z(ah^rpMW4z{oac6SK*FesI;M)W;htxUtbWa`6-}iW@9A%_kyy_b39!)vY`Qk5-*oj zzg#_f)!@$Y=I7(hFQgjc>84=S4Gn(*JrCQ)ijo~VN)g$xw?nM?xyZ@`bTyjUu;i0S zW;+5|jX);qMmO(&4*vX_K4xA;JPV+dc~@k_nqQ7&J|Dg6^3H(`jUD36+ftvvuY#%- z4Sxp@0!5z}Pl%_V3(A?@h;U>>WBW+;3)Sa?>5zUOZN9(O?{4P%AmVd!wC)liJ^)t^ z#nT6aE7m6hSo%=khG|`UCss*qwyKf9jY|bj0f)SWyk z-n=nUcit%6B+v#LjE1Lf@b?hW+3t(!)VdW)+L{%541_OP1hGp-`HHg@?bTbxas7~s~&;b(9nT4 z%)QL>OFo;v(OdOG-dZ%n#QbLmN~nO*r~iez&WL7V@3J?d2Xy`*hfR!=Lo4@@-M^^zdDu}B9%@8WHmSd*<^{XQ${>D{+ zW;--SZJKCf*tq#s8Ex)bt1`KVMG9?q_@_fB-tC{-=9IRg@r-1F>+lK(wpn5-iR>JN z_vj0r{gWQ7JE)?Hg!?UnB`p+|9789fzIb;ndK{PO&xIA1-o=P*lKGCH4EJdhJtZ-A zqXstvOkR-|%N(!&iZ)T?zdMmy@+?R!kFuj-VUpH=&=8|Q3;qd6$ZtV&1=p~^T!=^L zhI)lTm+mLKSk^;$XdL%iXbEq?ZY^kTwL2R};#;+oK|ZyE{n|Fi;use^G{!ye@ms{R z^El9^;WtgLyUj>)ejaozj+f*?$ELVEPr6hdbSymCJm{#E*5yG*_a4lHj_LpVJm^@- zJ&_09QK0*C9(43~YaVnI&o}a*V|;h!K}Q91R~~c>-#dBGg+TXF9(3%n9>|l+B(xjlv7V{*|k9$oXK3+F+{hV1M-=va=1=Aau;R5;iZ74K2(0Qc#`;_a3v| zWP|D49fpO}x^kI&14^+Cq%RbDsh^Bu&tXxc%tOI0nZ9uV95@0`(9#3ZoqNGn0cq|9 zgL}}2Uf|BbEzzy8Kpy~$UsL-=Rs&vsynTm&8S}v`Q^QY?(@|^&fOfn3`vSj$Imoh# zH{*fNaf3^yzBE+2p)?bHqq#m4-Hsjs$NdhW53?J6nD@>2XCgCYM=3Y7?WL#KdWdP^ z(5gG&UUu2ONM>ImJHI}97Vd8eV44*3TI?g}HUs*bgreB*E6mcKmKyC^<4T%E5%->h z)#E{xow6I~_p{MAbl=O)$okXZQe&w{Ez4pL5xQB2cL>)-w00<(*&|`6mj6B%|M&Yg zvVT)Jh1+G`w?Z{MS`+&S4#fi4faAo#cfNUO^+Vvp#yrG!%8rI#gG2P(SjDnKu>#Bu zAC4^rHUt`jcA?v@hag7MUz`@{xC!%_`%;UId+w-TG_yV0Z)@}{oZ%ZdpfkmYZ(%mN zl)cPsbh{mUGX;v=V5I(lstHMq9@5uHG2?7m@vHP_@$VWw0an6Gt9bE&Q2Hfcu8jMPaD!w`Lfjh#)@OEX*hHD#iQB2TfgMnZ(rKSHxn zdRFStvp`spr}<74qvwyi1^jX!y7_2$)-VV3C|-LDki&IlTTwFhnteJ9C6j%K#9rjR zg|sZkf&xTvtBGL4>5xm?HEb&OxP?tM#<{kKb#5lY5?Q${*a@*oopRVj8bPvblv{_+ zDQf0UHO!_5hr9Hq6s+#d$Te??S46E?@s^w3Kx}H)pxtswBhs-l47a6W+3+_8P?N+T z3C?{mLH^;{?4cub_aY59^f&^3+~Zx7YX1Pz1O1?V12 z{*L!iOFBid93dL|<%Y$WIog?ix|%r^s#!wk%rz;@R1>t-RR~qKeYTE-#aknpt)-zv zJ+31``tL;rR}WVr>)8f491)3!&hj+;M#N6?xpk!MjJ^XN=JxzU1Z(ArV4HuRG4-Iz zwr93*@;^Ja!}*AG*iCFFWOsuw-nN z>kimqWN2UP+~|%_x&~iJT@SbT({MM0(@ED``GHHeLaVDOvmTG&wByn0hYv_SmNS+2 z6^J^HQlUQQbNB&K$C2O-~kmvvwo!~mpRdAaFB+dd8J4q1b$U63F zG_m%5R5-1onbRj_M%2|L)#CE8IyA04s!OZ}4r9j^YG)ABwI&^;mG)Hi! zwKd^88_+DlT>)sWK$zsRt`=w&plbyB86XYwgMgG{6QB~YeZ|533y_AT36O^66jYiT zmcD?L_cB0KnuFF1Kz5h`X{!Cuq1yyVL$wRgFyZ(J5N95P)|U=lN2rl;!F2_se)Iw~ zPjH2R&KKxh$95c``GUI?kjAajvAxNGegH^QgKF>y;rOLvyBUzi_XR*2k3a{#T_R|8 z0;Igh08-yDL1%|*3?TM>gVsfWG|bZhoh7(AfYd!5lQjK-Y_yPF0;+SSTMz~V+Le~w z0mexscnXKhSAP6}kUi9^8vhtNmzj#l{te+6F9VHM^D`yMJRz>iBeXkDDeLbY}x#M#J`J`Wn_O zcCBQ*&3xt@9SXmEGH=!hYu3o#{Rhqp&zU!}_qO<{|nbz)FgdPcvIO)Y4M0nL?FRRZ9}EbtG}+nECVLpBkz9W=#w z(~pT;FM8gcp7^6fV+Q}P(tz0OGdP~hn&6{HzIe->o|x~@gb@Po*h^2)76e!uoQmgf z3%-5ay*%MOU}zvZpkaMNXO7;O+2&4Rj0T3rox))KLW3p%T-4N##4~^KDL;0nFj&jb za1DpXf0ZIE1Rq>|@TOlkJn`-$x`v}_fgT!2GOpq9$AURm5a>!vm}ifldrJP79+*M9 zuSc}|HvdZxm?ku3Q_tv~|D^}4Q)y~WIKPkQ(t|;YWjguebrdlH!?kk5MT2!a>Nz-E z@f@lQFhb+Y)1!ecaP}77y7$wA`Cod#x|*hO-3u@0f9ZkBIWB*B=fU3jUwXj!(p>b) zN%!P`=>baz&9W}j{+0iw2TUcJqvsv{TK<o`l=Pp%dIdn9%*CM zWz#|ssh9z+xUTbI4l|uCGscFHhX-)E+N{+4Mc8aGt8zh7zHLzEq21YQ-Dk-Ig;9z7 zrom?}uBsGAY^7Ry1 zHDk|tzP94)!N?7E=4@nl|Ea4LE3I=NudQs)9XL}@?6togd!t%A2(Jg0gLU2aB?^N+ z(CRc`P>~+eYcB}=uC;(eh8GP~QmzF&Q!;QIDvf1!R(dr)le;bd|2wnyIJ@6t3IYGh z6nY!4Yxk%Xx@I82H*(Rnn7!`}x^}2i&$6pk7AJAf)*+0GJptg<5bNSrbR1)F4K>4= zpt;YcV_BkmUd@u!tnL2Srr|dYXE6uZHJ4)0S%d?B2Hh|1>XG$NN#_YAE!|^Xv6J0+ zkI6MFN-gs3Jn25jgN`Jho${bN26SEWprf9AdLDEP z-`RQ4F{(v*&>auD^YWmhdz12@qkC86K}U@xl?NUB05y5gG5zk&gN|~#CJ#Dl>c7f^ zt~2QVm`f#pkumxlPBE~M(G0&O|Ei8_fE)z zj^R5a4?3pHusrD^Ip_uq9|9M?!DSMmjiOo~3;ps{@D*(%{}>O)I?OmUV}P1M_Q+E%+z~) zjAere*6DDCg*+&iEvw&sQwy$HuyDzOe!#ni;dZ}VhJ$< z0V{@gAAx4z%~BDNVg0iOx*czJZUWW=cvDdfSoL_b;t5zg@TSJ8*NLAiPzQu|lt5uX z5rKvSDivq~ps@nY0d#>t)qu(b`U#*30zC?7l0aJlO%-T2pi2a50(7}Roe|M;f%*cv zQlJt*l>+g$*Es?$0(6Z)s{kz!Xbm7vCllWv4O>- zJeQDryG_X87DErj{AUNstHnhvTLl4@2%7y3znYjK&%KNDiO27F$1@0ScYB4#$3?}sAYe4M0XKY7?imEPbvB{# zadj3h$`wtEn}3HYR%m=&U0~tfxXQb3J%ixGluKxQT*n9(-!w!1-mcLz2yPD|2#t@6 z9US+D!IK_}uJ#Oq+hYns6S2y8e?$hwTVDBKf3Ww16 zxH!pC5TMRS^Wo6TD!hZ>DjY)N<08GA%P*gE)o;9m;3^zKiU&!^Y~ovAh-&L z(D=Ac5H99EO{e?&ed!$pSK$yE9~X7kf&kN&=GYZ?FYyk7t8fU7kBb_&n_s+D(>n;R z!XY$1u9Jn!)IGc((>n;R!XY$1E@~M5dp|vc;P#$Uq49CCZt&mk>Kz1E*$^5Z7wZ`J z4n*F#>Kz1E*$^5ZS6H}A%1`PazAG%XunvN&YzU2y>olKVyu;Uf^RLQ=(D=AmSG%dqcv~Dgxu`+N$ zUzf|iFIZ@NTx|VZF5YPDz4=#VLueQjS+c_aGx7MRI*74yOm!S)D4z#0R_VSp%lbJu zJwxQ?+COb(^%6m$Z%O11<;$Qw`6}kjT)brNtmK>)9z6VMUBJbVWs4>TSAjLH8Tf8^2PS)@~reH(>B^A6*IP?>q~0 z0eEN%@QA;I{Rb91{4=0ww&}p8bS=(6;GAN|La0!7ELqiuDik zpz8*@d-I?>7Ics1LC5%Q%!95C=r-p;$8_162VEF+Z{90w0yGOa4o`-wvNX*HDj;dTL54x_PyFCv&DhrU6KbK)1@L0y5m5X z%!7{MyEP9w%HRLwLDvU#zs-Y=^~Oti(9z%RdC)Ok-p+%L_4_~bpks&Qt32q~3F_u+ zDRP%{`s;6zbJMYY8Igy3R0}5MLC5aa)p^iSo^Q#6j`jE*dC*Z$x-$>DAn5MNgO2*t zeRrJ)Q?0!}nYcx&edy>oK5)SuuxNs0unZZeypodbS_G47rbnaKPrUc4Vi4E8j8sQo7?Qgt$p z$U%zc?x7K|coR=hZpHemKr`{C$3g2lymtsxgZEB>Zo~U;0{t29T>?3W7wPS;D?biH zrp&f%?61bDk~uD@3e|iJZoQ-m$Ngzy;M}8{{h?J16E9v%hMY|lJC&er3bt4rh^#~K zbXx+qQvMUB6Z(yJkduVZ{FIBeUdMx zn*z&=Mu*l;Zu|4~)Hc%xJ0<^~K6q5>=+exd#+}FxrVHbMBbW8+P*~s?$kl>5=-DFL zuoQDpMfHsfv74n;1eO;u@a`sObq|5F)1+1CSG=7=I)Jk2^;k{WYJyEB%naQFCnsmJ zhyNCypy>H;3&gI(I|7yC{e(bQ;r*^a*Wd_4!$Qi zZckHN-jJlYn*pg<-3my>id)uHtXc?@*^`39rJM_#ahL8K92PdimW?v|cECht77iF= zG5T9P(-g69AcOen_8-_7O85RP`@F|<5ZLo1z%1+vY>c-vDr98{DGE*-#J^&#H-0I?cU?f zA_$@>>+VHec09wd{5zhY>_^kgXUsJ7rvd69w)64UEJ^{=ELsLgv*;IqwB(0cm`*KB zVGA>?g>f_6InrSr95;2x?9hr7lIP___SZxwvX4KCKUT0(!LWrxx$iH3q0+syK=_?q zUs4%h*H;tvf|cNY1D;}b=Y|fbm8am?`LdI7HEZWk?G;djuz~&2C&O?@O3>`kLU9`Z zWslAd?b-^U8`U)Y|7~_?7E1oY-lWEV!|YJw$M}~%=%QAagVC54sF8{0) zm!e1&?Xr^xC)}Z)yFH3aoV!T-^O0vmKDbQ%o9!U{5!^sw%dYuHGZn#&)+KDOh8Jyn zl4=OrChQYyYTk~W+b3eDFwVEIulqAM-8E2R(oNrnYT5eT9$DGE28=6)Mbgc|6%D+YDqFh-u8cfJ(zqW3S$7H$h{^Gx zn$Gx6HyszM4Fg#D^aH@Zh$mFr9p8yM=>RnJB@==NeM-c_j(W~y#)Y#+S1?5i7lQ8= zK3~dzC#E%l$t=6xh8}m&qo2v0?!GYDIjrGnI0dmV3Yxddejf2PRdz!&KI~{W4z>Y1 zy&8K(o(S;H?;a-IYwPXG&L&KR;<%pGZ2T9g`;N-QBW!NsnA(L`C>-NO>rK`!CMP#4 zu$Jir@xs9{(axpWvXdoMQHh-3bw)!eDoZ2w#)kT$-e0+im45E+`&!L3+=(L;*nY+E z=-&FMK-2IZFHkw&s;J70~=}G}zD!2ro4+P?gupbIk3Fv8os0{59=m&uQA<&(Gm`XwGXMk972Cd%! z`beNR0I7R#18Njpca*Zt0-XX#ZDW8~lCV?P!CeAqqu{P^a90DW7u-SzcO#%}f~$6L z4+45kaE~~+7XfLEb_1F&wx0viG&lfghTz(x=qv7MKox>J*}>ff=m^1W0;Jl;c0g=9 zg4RJmqXjx0t^RU>1_M%#v4Ca^?h-)i#|%Jo1vk&ZRRNkOxaAJ67SKY$-R|J-2DDgk zKX-7y0Yp70Xg%iOu#MB!4tD`sDz*)d?a^(GhIAsJ8^!i?K(`2VCZJmdIuDShUlhjC{(a9bSQ z%Yg0?9JZa>{(cEawP9`{{i)a<0Z2nN2+%8n!|kTF{N>Q?*cRk6kq5NWWee5>1REB6bA2ZIC|adQ-KsCN>i5F(S>`#H=_f$pw4FqDMh9LO zQ?rWSrUT%fa>a9Da-g5dP5oP-O~qa0yW;mH*qEw2mc6)xz0_92W4zVMso|xN?N$mKBPRzb4>WHQt%pbsl&(V9`iUKy{!w*s}k=7rB9xx?)>u z>qQJO@e#<>z6E$o?G76QOV$ZAvFy|ItZ_V~gYloU<@~l#y(*bD`l6NZQfWH}(Hx|5OM5 z|EYiS#;j!9xAhtMH<{T`L)F-uk9CZoM!{cLatkS&A4mR`!A=%&qhT*kXwr0wW$$v_ z#$cM?b@YOM=4DJbwMo_4h$kTeCRH&A=SkTAgM|#bd2rQ&Gu2Hp>3HN;HEic|pnn5& z?pV?v6U+F&uTvWKGe!N8vp>D@%k9q_@TcKnoZpn&dONLG=WyRsr9h1vBJ~P-AJ>2s zJ#-b)&+OCPV;P*>ttH4*Ne!b9>m}8dhLhmVZ~z?F*Kx_83v?OY9}6@eZ`G98>fJB6 zyYT)*pkLwrzXCnv;Hcd_Cb*3bj?}vZ$A;z+fxf|;gNZm%17griAkJfdDo{5EM@?RF zmjO~&xN}rFRywxS>CO<|Cjk9gATFiWckTYhc0W z>Myl1wS69t^6mrlxo}*HV)ZY9t^)LhKnnrAEzoK}I|TYApm72{0%(sw+Z^c3pwYpK z0BHz{0ogGJq%pq|(3iryz_H~yO&WsR0QC}E>Q>78TRwIvkNPBU@-M*C3sJ>cW=V2Y{lH=JJLR)t5GPRF_w(&F!>Yy>h=(D+k4>vBXi5LF`rzVDKD(FI1JW6CR z;DaR7nhlM|>hocV8yS-!+Cf86oBtBQ zRiWssAGPG@Cj&^k&@Z10-P{Dex{I3A2iq=rJ63Vz-Lb%dQO$dFxV&jZYFlJ;6t!ma zrn1b3U?1OHyDe06KctsY0Oy8k8v%&p-gyHA8-Ypml0fs$dhy^= z0Q4ZWJKp?a!z7}c`X(o?2LK3ey@m?R1k~kcS5EjDE0@2D=%#*h{$i-KjuL>BZulYG zkOL+g+pa^dK@dbZgpBsr!k((T5YM8A)uXJ`QH?$1zp!z1ycy%=s%Mtf^=gNpmKA?d z^*!WjSzTpdJ>8@`{lJ==bb%pdyh!>j&VfX9j_g%^pl7OUB7i%t>c36kvZWD?4{G{{ z)^20OlJ`Y62YZ2sUM{Y4cy`C@N_z!tu29XjlAj=y)AJmv6Fn}+8kT^_8EvxN57o>v ztm;ST<_ScYu?=HlokJ@YM_)Q4C%b53JFEB zGqXeH;xIQSXkcqUK#DZ*;uCloVrm?h2<+B)?M@A8e8P+ln)G-ug45L0m&N~Mc;1WG zjkObFcd~{Q4a=SIg-!V4btea7%`YU1|6bJv;frPOlX8zMKi_Yh6k2-(eedq`eWyEG zYWzQaa{&%Br6Y^~Z1cPys~h9^{u|n>%l^tlM1>UtWPu{^HCk@Zyc#ZvNS>QM5De9R zpBB(?J>}&}pdjzbVIu4ABc~dNahA=)@1al5C2g_L?j`LI$*54xNpL1dV$5?Bqv7j= zCR=;8rVOQjC*gOJ4hlA^On)}B3Td6q{|k2;c7xkav#=+f;|(_=vs%Q*kPZQ^*D&Xg%&ge*si1xaR?>e(;)O%Tw5TiR~W8 zcFI&7pr@B9awUK>YOxPpO&vGIC4!uMF&${!k$uJVjWS0^fTJs_>7EKmHN>+4seU1& zDfFQ)kLU}_T7!<7AKCGmYq9M3*15*%i}a?x_UeP<;GV{`hXV}&q%j=~NMkzMv6T}R zU0-nr)C=mX+cQeeV;6vn9h^yg==`WK(e<=xdHQiGZ2B4AvF`=&$#iz|nACRXJP*IZ zLGOy>#lq9E$Hh!|Qngg|ml4(p&k{h?5`wZnQ5DD=@vX{n8qiL$&El=f-5&rcoepnJ z#RTxW!p^40*l&}o;NcR_S2X%;N!a^ui`g0g8=dkvIfEkAKU zT7EbxujOYUpeOMJWs9lyBz}f(&CCY@JtDSz|5G3iHmEIyz%K28J{8-xXfo86Cnc$E zFFqUW6w7k_40F@5>@ocD%C9@?BOU5-)OR4&1(gGA@2Zcb4+hfP zo2PHoMMNXvv_@fyS%?(2tA)Rkp(X&2O$6 zgEpi9*qZv(Coyyia0i)ZAht&Mw>bP?|6Bg`-94VCPHY^9dp2vEQxBuSdTo+}Vwu8N zW~mWT6b@6dutCX;V_nACe;sXU3>NKYzeiPC6FjLr!?xg248Fz_l%*Vp1iIY8-2_N+ zEIr?d?VlWIGaxSg2wE%++E{%6NGnS=6AICNg`{(*%RjVAmOJufG<#tz^QxQr_kqPp z{d3|OXi``S!Ys7B%8=y5Un8r|ry>h|eKYc+5!1R!+?}`6PMM9UM$yxt^c(k)z-3I} zU8x;KyL>juAu?EnG@jOh8_n>?0Hf}|SntwX}@YV2To3vLqc^inl2ykR_=!Xm%5lL*~znL*nBxCc5cPYSem|R$~aNfwC zy{m|vnM^IN>o10)Bxa@qq!Rxc6o*N&@ zm);Ur1W^9_b0gWv-c?RYv|u@W5=cxC49#;oW3|k3%jBg`jErnK65z8{A#?5M@Cb;j zkH|Q|IQuM=ThRVYPgX8X4p=mA=G+BGb%Fr9pVrw{)ts3{*8EvR2=pI_y*vCLgdG_C zA5t{Xx@sZzz6}~&RMfwCuw|eBV)gnm(0^$0w#C#l}Kn{<8-ev{5G!R{HfK-tF-`f8pylxd$0^aA?di z0i>ouX9Qf_6UVr;d%oN6+=C1{kpRZMkkFjYh|UMNQeua5d3XNnpnH%(Punl|G~Wt4 zMH#Mwz*@YSmS6N;fRNh6)?9}sZ28ZxC2c{V1aF#0o@h9S7&Qr-t0O)O0^B)wIiM%M z{A83KTR^Ib4vmTXQX9kg;fMrqjRmyrXE&9*#}+JiXbe}9j=>y(ry#&xbyO>6jqdmh zJ+^>$H}C~>gcWWPi#V_a0dg?ycD~Sl&JmLK_^>{-6M=H2F-7;%3f^(QxG^GZ|3C%uRgRyk2b)E^?*ZTxQ5&DIvTbGfoJh%+69h%XssS?fDdbw zLu0tuEYXDU6a<#R)nfsbkGQt49&JFoL43i4ER$jxMTle-1S0ria0*U7eV?B1OY7VC zg6Rw{jTcK14f~}90nUOj#Xr92*k9<;2DA(F1=Gdh`bZJ7mZl)^1-=-snv-WZ<#^yN$M^Fb zZ7@)|gvQ53DJ=*v3^W%#Wxe4!+Q80cq49B@09yBuf^O}$^z|HVFj$o%is8&=V*gs#R`p&i=!j%_Vv?> zy7cxOZBSGwY(nGX3JaI<>%$}4?+!~zlcNpn&B{XK<2p^adgD#=%A0-9@f>Y{W|Kx} zd|W+&bq~w9@c6)b&(Q`&DjY)N<2qfqSX0qF{8UY;=V*f>6%L{Caj|z>5MVyiG<__!D&w|s3F^ySB%qYdnhSVH6D>LXlqjpp;_N&P%W8x*N<2#t^H4A2$? zm`XIyPZ-(VbF_iIZCYr2Tzx@X5HR)JLw~&GanI2P_F)-9n{8F10UB}z`9(OrB6R~mWNAad z;iTVhI&p-LOWTIf1h__m*6UwCD!A#?kv=XRID{s^#kwsB*_yxM&C&^lJ}zw=LKEPU z?}F=h|Kwl)*TfL$^e=-@O&ToZ#cqwjneDF4nDg$o8Q7 z2G5`9QBq>KEvZ0qvM9q1h~!=E`HY-4q7t%fHQqu+BSqH zz;zaAy}ta>?%SuI<>S(}Av6K5V&Sr1^Iu$2G_lynrENoK0$efSqRh)M_tiU}iut&- zZ3s<(YYJ#Rr(-u=d;5?nJ}zw=LKEPcDqMEn@x7t1+%VP0rENoK0$lL`*D1gH)uC}8 zm$nU|32-F>T%XpRyE5V9(zYQq0WQk_UjKUTxO;wD;^We`Av6Il&U-vZMHR8u|DNV? z8TS@K13G9E*Wdx)3&>QwzQOQx8* zm305ip zttFw*>aT5RsH>{BPPW{4DLspov~uCaqfk-u>Z%&FWcvOpMF(ugq{rIi$fRNCjt+C~3{x39ve1bX|@FCO>53^C1H z>c%$p{rr9*-oA>)=?Bx~c>;cCqt~x8Js(9>?@jvQcT4ss#D5R}R}?6Ub5QZ}G*Q3x zmXP|ePe5}36GC9Jr1NWTi0AC)Fhj$826~AZS!5<|ijpzs_-=Ic_TVl!wX!5I#5{~Y z<{(F1Wu?07VEl(gnZ>)XC{9?!uy|M{Pgs+Rofn%MGn<$_Gmz(Yg9596SlagOQK`m5 z`3%W4PqPR-p)drNy4ZJ=9_j;9*qf31|gSl8~55(J8V2{Ed>_$ z#tNe>v$PL(!3+TR{haJ+Nw9v1)%YE;O+N=}!|IR|X?_(@Y5GIYYz*s5y>_gMb& z^y{VRCy{FZAzjbI=Bu<7W}t12yE_k7v%zH7lQcn``1jNtT8K)vou#dp^>CLWZ6>Kn zu+l1TEeT;&7*$egR)eSRh>s6BnewnaV;RlG@ZS)fVu1?tkr|~1DL=C zQTL!=c`2Q5Q1Ct+|GHuR2!SZt4-#k=uAByh{y%5yJv z=vYz7L=Y(Gs@F?C&o_4WKFC|_u)+WrJA#VM-onM_z2DJXD~VQUuGtpQB7P>P4BuU_gt26O(8cUHQPluSY(bSNiLAjtPCK4$EM(cV}5P^qQg;7c;q)R({8 z+A8e+`-ObPM+bc?@-x>TJ%FdqGO&Zm*E#4~QS3QS0?q91bff&uTkSsSS0j@}H!kqG z-+*?;-M@#KNi5fjB;V0NPhA{FSAynihR!WtQP2nIXwcmRns!6SW-RFy88sU28JHf= z-QJUxUQoLE3p2t9@)zy>va%=XjaOX*(_*+B{|BS+89o34A6w`~O$-oT4g60*Q)HHc zyz)&5NL4If0yGN@o%_6_M+efY0Nur)x!=$+`{Dt`#oeVP4!8p;!T5qmOQV9mILUux zH@aNDu?B)}FzCh^TBc9mSl#pGhY$;_&IUur>UMo-(E_fOoX-4hj6V(kMw)VuqNb}B zxM|r7uNCj!e=`WI1VXo3dbA8%-eoHCnD!@=>BMgQ&cpA!?Fsqvm9-8< zQ6Ov1-(|N5#4^2;O?$(Ut6sq?F0BqX!|wacu3e>>X~SsiHHe~PX3p;NG~6eYzbpPa znyCgTYKt|kuW%yYg#)Wtx;OV6Y+%}n%(NjzkETD`&70V7A(C|s-y6AhC0JsUrwxc) zN6!PX^t3_90ef2$yJDGX(L`qE5FEP>Tf09NJ!3tP#nS7Kj9R}N|%7Hglz7UF=P58iRO%MYFk)ad&2I(h(?2(290 zu@9me&_~B7w#Or7?XY4lrYjkL%9Ny#^3jdGks|v{JhVIfnK@#jvx=#aX#A znJIvb43NqP%r3 zy5p1Rq;S4hmVT@}{dBAguIb)Gn}^dF&aB=-QQ5cFN#AN}>lsTUv0jnp2oi4E+cVPg z2qcI9x6VK{(Hfg> z)ViJptOba*_u>E^YcG+0z>mf z=DX16^t56SVgTU~`5z2@kX9l7Lt;V1F0Y4J9WGE5S5AUM;#2Nufk@3t4#}$?B2Y1| zCkd3q^<;rWxpwg3M;?9Lkdsb6?H1smk`VWV#rWl*$G|~WEdUi_c@*NbPN4xVG#$`P zaBjf=dHCmwfz`?DgqzJpA*Q4dQ&Na2Da6*LkY7$ma+n(8;s(9>Pfo8FnersjjDYYO(af&4Gg|?jUO|PZJ0qfZk4l-Qq+8$T^#g|;@O|Pk* zVDM}S`p0H>(JDW(EfD$j^(+uS{pON;JqyG#lQLUl zL5Q;o=D6aR6QA)c5NEkGQB$5_EHna@DFvacapkjjPWwlNXMso`RSX9@mg@mUI8)EqF-0IR;E?Vd^u-6rYDsW|uKQZx?9i9audmV$&1lBp(x4c7$j=1OX^VI^;uZ$5I z;pfMgfg_H$N?+A_$$VlklgLuWP^%wY!zA5aUQE!TvC`h+S24$$GBZLkoHp2?81_aR za;-f=8Pjb=j^zoiVZuVc+get(!X|sokh#8Kv&L^OWsIkru!PhnOO0UB3+p+nQ&`bR z)!X$i#&Ge`Ra&9jV>(mbVTe;j`LLvC?}fN z=>PT@RMyWIq9ZCA&tcRJOVFCWg8x^wGf3|i9mhEP-BHqI_*sKt>vbJ0Wkk)TgP8}q zcR)iAZVc>zsxzUW=!Lrgo&%asy3-XEPVlJI=Abv~Z3PEo1Qt`$!)^nAU@})48W(R@ zgzR>@3Zn#=v$s4`H%R6t{{(Sq)4D;JWpn_u1JpN306Qg@80mrpcP&o>I(1zYP$oky5i;j%j{XVjFiw&TEStoY;+h znAD=|+DuiE2=;RaVJGG#a9O@ry!2dwU1A_hPaObHo9|)+UNo6*7}PmB*TP9`)9)n1 zN2M@D`ePqRB-jeGDGy#mc3BA=1f9=vW;+P~VL6|af}=WEruI23Cx-H~8Wv}Ly3&@y zJwMH1rwLb`aefWZK*8OJD}~Om^HW?^TzdqNuBeQ|+n^vCcFq746(|Adc!4egG*}>! ztL@7#pHHlNjP2TgEY7Nu(o+(JS7Y}2( zlI@hejH=T=zni~p1n@bYtC-JK9DJ^|?sM^>N;AcS{t=6;EE%vkQr9*E-iZ^?Md5+c z4%-mt8930x2?(Nk}v1uw7Bkj+u zmy)vdlcruKYq5Rx(#xwC3@WG>shwozAgwpm2=A|&W`IE}?0|y~9_Sx&(Lx}5FhLvi z=07RzTUn7KQ$dL1EG4Jp^3C^q(*CbZ_MWuQX)6PVvVsstU6$;)k3P7`llJ4lFi_f; zT9Gb9j7t0S0FmpBD;{{$llIdjK+wfBLhP^%D(!RJA=htid*er*v~TAKD(#b+Wn$=q ze>@kiJ@9|&30G0DGW$X zhaul(XmA^~(Md}a$z;r^fapZJn?dul?sTIA$;qyy2SM}uY`U@jM`U_$g68AybVU;< z_~~ehKu<@@P2)cVk+~$c7T}M^aPwm$J&|1K#s(h4DF*&Y&|rOD0_lneRAj9Vu|JP9 zG)hT2*zmwY-ybOToCP|r05b4#_P5H_lq0?Ft5Pif)j8-!jv5zOU1PahyV3b=hsxA; z$g>uTf*~vt%EL?30V$oQS$Wd$1ttb2YmC$JRovi!9Q|&qT~;X;Q>^O; z=veVI^7s~KG`v_MgFH;nGqFw7B1j79t@6=_FNxDTM}A)3-O_b^+KWgl210U%3SU|j z|6x&!>YFLYJ>{;joMt~#ppCe)@rIq7aAl(o%Q2PgE@5XIuI$)hhr)DJpl5L%BhV|j zMg{7?RbT46fW`{0XUMJ*jRK_UO#~E`*cc$?I2(}a;#IEFjZS2d~O zXaVtbipzmpGxrVY`N}oX)M?Apl0CM=yCnC?eV>y5P6bN_*KSK z$}^}C$qvjCUjF*Nw>=?pj!R?n+Cdfs)_6gPpQ=Lu&3-oA;t7$DlK_E2q`tW(MHnHn z1$V5M^M5`46;B;(#aya`m5V)(p&$Nr130-JJpI6DJasS|4ujAHl$!?t>!~Tff8Wf} zst)!mH-$#{FOaJmvKE9mO0W#SK6mP=o~n1Dj|Spky;v>_j)S(RNPVjLvhk|wl`UiD z>nSt=F3zVtu4LiGC#b4dxY+X$ghrr#=3R&yH^iD?DA_Un>ndvH7Q{bRGP!E4(yylt zim_=CtC+$pnr!v!oi-7d>&gI^+KhQbn(`(OVe%Rj;9~SESu`AJZP0W?0b@{#sm@A= zEz<_2IV+21g(bkR(r^H@A(zl^#bQeX7YRt!CtgDrJ8x{^#L8INw3)Mf+ZpWWrYLDW zLtI=#&83y8lqOR;V|HR%Vpb*0^t6$AWI#zyGpEi@%&t6l_N>ww(}a$@B!*N>pL(tc z?NlNM({d4phxgqk7uiV^R>FY|wpe%%2P6NW37{8+T@u|4|Ms^z!Q+u>m#?yXx?Z@V&fel?|3gaeb(UpUS9;6vux``YR zy}m=l2JJkDY5q#$^6!Xh_GPc7o#qFN8Orf^I~AA(49F zjBI4ln7|Bb1EQyZ<{?AJk9e+p8GQ)9SH58E69W~^e2)d)3`5KJk!vQ%d=}Zu^ond)?b z_B&Jc2+IP5Su<6Su)G@~JCSdu>JiQe5N4H;Jtwa+dW4@-Mvw4w%IFdL%IG%}-T3xy zl+HT)Or)Q{5wNlJ^QGy>iRW&f<~8V>>BIu-CpC>jDCA8F0au7fM7bxKxu{PvJ=x&J zxGB{g=GFx4R$<7AY3?u7ohEZw5m z=G&2z=AZ6G3#dxH0W=3E@t7D`n*vd?`3D|x?=sk+mNvDa9EY*Ac4|q&V_;6zr(LF9 z-C{eJ7P$vj>`#TzImAx%gI;2nAs1T_Ff9va>#ky{=Sw=9+zY?PEPud=Gk4PUzNFo1 z?7WqYeJ1{OwW~s)B(B;C*b22J)&M$3V%On1OQ5g0&^G{`E4UxxI$I#li{=RQ60UOv zdK=gC1nR7w0yOII8O;X>s{PcfV5Nm z9MFXl`;-g4;L`1K>D~mSC3we$PR7WsyrThWnOzNqw~uZZSFF(3o`Tw{H2qxqv0QzK zIu6_9BF%gv9)FYRRhC|WCCy&#C_Y|$OIPf-eF#Jn@03@6V!c_HqQ9_dYOhG7PaR@3 zRtL(V3TlQ-@0e;*-SU!X#v(I+4})P(G1iWRGxO_OURpOqOOh^u`%)zO3q&A6vnP+3 zTY-VO_;=ejcCq8gfuxP6S}va5nEDD9b*=x^^dCi?#Sf5ex%OFkrfmD>1Y!(#Z}Y2t zZ9+28wfyHze@5?`{Q14BTfebZjoM+lo0y)2;^}D0CZ&!23_$bouc|Vx_k`sPGFs(? zo$uqSjr~`E7T`bZuzsrq`ZKNz1o{M5ZNvlc%C+eZ0klwJhXc~s$!_daK-$=8p`@i+ z2uPdwY8STwkT&rj0n%p5#;zQ{a$_F=qzxNc<`w$vhiU-u6m(QyRV`2UFr+qI(#0jOu)k8{@g=bIxq^)!lq(WA@|}r)edHtj>+-h8H?M#oC?5BP>2KYnNe*>7$NTsbR^e8-soJ(rfEN)y;4bP(0^=s;6 zr=_RkLnMs7mZX+Cb@hv#6HgsEwt7*GfBwa%=a<$Cdh?%LIlcpfCj+0(Q^W<8em{3< zq9Uimmc(Es=blb)CU*UCHC(b9qWXuCFolbu1TK76WB+kBiDoPw98IP>{xQon_MD48r5$ zb9pwP+@Qfg8&Cy{wF$`X^@0#*dB-CD-cNSbcuKz#m&S5&EMuVfSP^u2MXP|wj=5?1MjD2S@?$}DG%=GL#Il?j=g#X~SSylS6P8e?g?UGZ}zSFPF6dH*S zo7~x>gUU?L!z2x(7)YZfyixA0edh+;@qK^wr~y4Z50l^a(*%^6had)iDNX!`Q(t{R zJxuylph6=Qe>Zf83KvHimSJgV;7y)~$q#%qL3JxvDm?!@Kfi9+nd)KEuQ(N&KnV{M zF18Sc2h+=6_dHCF7_C^L32+^b2v12%)vnLOq|s0dO@NCn!sDW9*XLo9A1(x;32<>_ z_WZCNHRA0zd>$sp36t1<1lz`u!evL)rk#I__&iLGS1zFu@GbM+j}k790}S6Ezhwk5 zP7W(xVt;A42y1J(M1P1d7}kOf8X3)^8IXm!BP-=*n+SfDoPEp&#q7<(RA*sqjgV8h zp2*6bg0u}9xg`rTGK*`7Wx=mTej|&^E}f86X;uWdvh9p>E6lUiDREwW}Hv0xv#8Nv2Kg%*S&jb z`>{s!V>+UKww%i?;;=T$DNSyEMvjrX+A z)~fg7?1p_$o&Gu6d0*NPmyou|OFnGvWfmE-d zeXTfE=eyhijed8mQT-e7Q~8bV-{5?OS9eA!btd3%6}l=gp|TG3WfuiL-wtZRD4zv6 zzbG(-#X!s17K0Q#9*@XqL0K`872NBU$j~O#j5avR<7SMbri!MMW zT6dmXxve|h=rR5wOX!{l&D-7S#*Q{$E6uo`KN!U8%|K3aDc{(Mqm)9gOYp-J!#^~1 z?sJS96(}I3sskuw`+`32_yFAq#2*Q|X@-_VyU>lEz)6rB_(A5WmOP!3!KDi(=WIaS z4WK!gqB;Vls$$q*jWp7OAaNOn|0>X=4IR_VrA?<~^L0Z5P=aXZi-Pq`sp==7d*0Bp z{&JE5|gq(zM(^qcrVd4_$f37jx>7!;lQebcJlqOUm2P@D9S=S@a72EjcaCVPOosf zH#||LdJAc~mzECO(v9sn`_oj(FoA2_%UX_EiVd2-O;`biX zk5XNC^Vaku*nJDf5)@6DlC62WK^{jQHV#T=dL%Q&RPf=1Jf47F?W-H^-krbgB=D99 zKQ4I%Huld7oHpeO8H1!KpDU106&s|OhJQ7M;)tf(bCUv9;5t^IdAODeREH}^ppdf~ zS5AW2DDn%;EsB4rZy=RSsH~V(I=6Cq;{3|e86`6%9sd)Vkg(^oOtTAWa-)d4Y1OqG*O2i5^SP17>*qtS5Q6E?$TJUBH{gP^^E=6dE0pHR!xp}US2`<3~jC$dOJ3+ zBekINVJQglv&o_U%e^0odFq+tTpG(&VKAzmSpp6s+P^bvtEZl^>LO1)^Ezl4R6WB_ zD#L)m2VCi?XF3(>Q_uXxl$k?*L5Lq%BEFV>_3NH`=5?3Gmay4is8lEj@pDT={OT8< zRrL(pS7r4=;ApoMm8aJA9b!~HvjGrW>rrdY`i-ZanF|bq&de1ej<+x+y+qxfx#F6%;fJ+ zlRe$H%0-eY&5c>5 z?BTz%skwbf8uEWEs?-tW?v=4*a4GBZ04PK3KnaQ9zJ`<=tuG0UG-cZ;>` zYVl8X_ZzEkOEQ3Sydrt>%7tqxXOzaJ`l?d&MI6NYpFlWe#_M}~a_=v!AhOt4)lR<@ zy*j(|zRG-g!MM9+RsyZg8BJvzrUT*=05#JPblWTspcwEt>C)|@H-h2t~=CqX)M z3``uI26VG8;Y)HY2@p80lCJyAX9)0D@~h+vxn@X5BL2sD&~aRmEg+wh-j@*HmPdO0 zoV}C>9X~T~%z$|Jszt6n%%9+C$gpJQMibkxM3kOv*7A(Qf;qx-v1-LXv+U9D+^?9M z;<8SiQ@Ae{Tn)TH?(SaEWI_>wUv`fLt+#F*0Kp6yiV-s zLg&ef2B##4N$9nI27#R248L3E1Z^6QP~^9{q0X@D${w%HSWY9XVMZ&TmgZF0<`0hm z-pRVAc3rzC#0MS%EUu&K{S#r@dze=cm!mUc^S3*-+$1EEQds0_t4P-PSS)KjP3l0a0z}3F2mYh^keZGu z))6)>{K8nyV9$e1o;_?B=(hx2o|!hleE?S0N4Ds2$8E?bZu`o0@CN`3y9zkqhMK_O zy^Uz<<16TIdN7JhF+VImvSI>_#C3{530yh$g`F~7+1tZn2Bvh2aL*A%otSCtWw_Va zRzOoF_BLGO0{skErWuwqu{p|wovpYk?=ygu_eDVLDq-gpT#pgxZCo|>pMa=P2s>T4 zCI#vh!WT%Og8?ZWMdwn%o#;YEfRuyc_z4m_1yD?&Qa~pPbdHN#0%*A4xS@o~2sqmY zG+m$!Al41G+5tLMAo>qu9l`-OpqN1a1xV@WfMBfP9tNbjJr0NpkFfI`pmKp;1;p=a z*x3yzCeS|s%@F8Q7uOFT34Nl&04W_sdo3x~`ZeEk0O|XfigRdd7uQz9BXM+A&1EYA zz?*lpthON)9X54V+3-pIoS_pM-1C8lE^CYqD_lKv+3Ml_oIs2@O*J}f=(0tK15;^3 zLt{-nk9?KevMQuGrw)Q2j)8UhfnWyqZ+Ms)GiM|)eMY8H;A>X!K;j06g}S6>QPfw^ z29#;WN-1vlm=Um!KsdLizP4&vbVlRyg)D&6PX(^1{}JO_4#{o>ToU;+^~+$WTujk$ zaf9CcCv9k`+G2nhg}j<@?S=niMm;ge+c>ul7>2N8RRu+gFy0p^hp~<9o^XA&w{gy@ zTY3tYUnXM?1tCgh4Aq0aTcjK3IL%d@QRD=sxvHe0jK=We*VbRE8|VBJaiIxt^#N@` z$X|)7q!BI_8bN3RT>SWZXa2ntxpk~6Y5Ws$p$TxIS%QmF5W_Q1zVv}AX@qNxVudEa z#SgJ}y4ds07Z-UO=SHxLA_z@@t3R;bNu0~4|ExikG?Eu}HwZ!#;5rak&ragedmsG0 zZ{wVKVL}t&QY8&uvIL%U>DxHR0Rv%wN*Y@mr_I|k##7RaFoHZ|gVq&Pi+bmTo&Wbm zY0pR62y^zN&;&}zuY-4%;Vt8KpW;{2XloUk0M{YH#ZjN(jR(H@HJ_5ENE?UH1h`a5 zLs^pH*Xiaz`;;{1?8*HpX>`uzIP2axxLfhZE0T^))pnJELx~>N;Zet^djrxR~p+Fh^%$_+_?1)A_r-#cvNsX6*qC zZ=TD-lw@HZ%))T|vO)7YI#3%t(Br8?)mX?Gdc=4M%XGB*J++i zn6!3nAgEX2Yu7`8g4Fbqr=Q6nei^=>e*BCW%DHky&9d4RdZJN7r5s6BJE}?#QZmLF z!Bl1?=FXg+h*NJ-Uvufdp|`;HHQx%q_PoUyIxaD9!2iv(Z>9V17oxWqHOh?7np+w_ zWoU@cn#RcQoailz3IlZP=Lh$M41<3LHdLYOc87W(U6CpX6$F_X?(lO{zuxH87L$LY`bG>GN1~Ll!J zqTCosY!zRLvEM{-7mvhWfe}S)3sa`!o3hNwd$xrdCwWSb*d`7eyYbKcf7kvUW1v5h zLzo-+G$QwG>(N+dwOe9#p=t?FY2;~z)}PSvT`xV4!cB04Bv{;dj+Z5zw!6_)h%U{{ z83bhnob@D(N&>~an(j9}o|qU`xNIjQviYUR)tgXuKhg32XX)vskfUI4LY^zlB%-wM z$hgW7R?riO@e+0OypL$R{R!1_Jj(34^ntnsiXox3`j*aPO(NYgw|bWkw{dzCY3YN( zAvYxpQ_Ng5*pj$KqvBde}zCCO#Z#<%&NL zaicGijcB?}%vJC;!f$8|-5CW7<39gpl(Q^Tv%54i5PQ+AkI;1k(}{3trfi5wE#VYB z(>XM@g|orf@b>nEd_&>Y>0KaD#Mi8w$IcPL#e-BNi+BdFq8Q4p#9rmbi4{noY44zT zdTn_9G;EZUHV})7ccfshw}>VYb(%xMp`H-$GV=1HFbs7W7nE}KKH?P zp>E7G$C^GqeANWBs(I*3x9>98h70_qXL5K*q=h;iTPrYAdbjJL z$#YO$Yj?5ABCX4CE=R`!*t{C7T+6{XJr^mUP2d`7878TzewhY9vh9|dN81xI97ulU z-87|4=ucYFs2qR&pjpPP5;6U-R}D4=a#Fx|H|PoVIQ_BRU zB%CwFHgiNWmE3r2c82KoZnyJdeJ>ANi<7ag?Y2L~CT@>hGtO6qrVYl#V<&13ueq@_ znK=*I&1r7R@C`K<9m7_f;jw#V5wky)eOz2b1|fm2e*lW&KkR(!;s&8%a1sc0ET9tv z8VgACEdz9-;CNt(;%Wg67hD}6&0{qnEdkf>&y(060MhiRvY#h7`j$CgAZ|SPvOq5b zx_!LJtB`j)wuAAh9&$RgRAUQAGhY9lk(Xs=k1Xp!JP0CcuM zbZ4!xeIdow2<}io`jp24(kDL+ke2TZK#PSg0ceRp&^C(m7xWZ2c8wc*DUNn zVJ~gOalBCEQZoxxY*jZsa}l-7g`cBiCNIOejpF@%($H#}UzuQ#(Tc`}Fn)+muUQi< zU9os2^C=qD;KRn~?x!}jbor#HM9o=IwQyNYG_^9iY-QCVAHQg^W3EY`NvW!EQemMc z>O^s-QKQQ)ll!P^11Rj~!J*JjxM~U{q)PH?6a%XGWhlnD24}HVqiHMC+j~m)_>n zLaTamzgp`{@6X0SW@oN6cRWE+Sx0AC-8;8&Y zxQ-Ame$E)qUij8yzMY)rSWKY_aIsGpgxI4QiZ8yY(zlbdNE?UH1h_bR@LU!;cf2*h zx0AC-8;8&YxL7u?=6`a{l$xVt+>w%Z^o1#!|Of}e~G%t?kHYkQdpACvxl!f`3 zCBSbFCttn&ZCUAjH4F1VAZ6ZMpM^Oni)&sM&AKd1eKuDXW@>;d+l_;pxEBBNKPM!F0Gc@E@9Y*wo4d77R=q1TK2oV z!G`G_cw?3+(5C8E)~TO%ZcD7-#td1E>XwIxV`1FKs9aIINDgMk(~lzTCZbP(*95uG zaaTid^m1bAY_5AW)Ll~REqoMOff2t7>(zRAA2n{&1SO$|cm1xs4SB_UBL5%mZ1go! zfWJgLy$Rh}&w173N^-4J@CnYPu;vT7^xa%Zq-gICx#%cWt2cKl zQ6A}$?!i3hSiTqXprcH=D-SvjDR1UM$B}h+o^)^Jpc^^Xh*L;szror$`u)N+y{#^* zRIO~ZA)=gta#2*E&@x)TQK|k$DG1+8oxQF4(%85e4T`WS1NWP`%20k;pbYJ9+m~&G z$83xH#53@K)s{N6jN8?^=Kz0E|7Mw{4JfNFCz9#ElurC}Y6Lv5)wWH%_SFf=t-A-e zhTB4I@zCzZUwRB`_9<+g-|-&Er_~ZAX4Z+PgHc=x@oHvwnm`nDMhL_Ylxk3B0-~U* zD-IN@!=f8d4o)Wro(X#>LjFCZY!2B~}4j={YtY^EM0#dZjzOBtj)6`dQ@od0G z=%hz<0KwUu&b~RWGW_9_oin}J_XwTzV51(&6UdA71tB&GhQ4RU(!SX@+X8~n1h`~o z9bzM7*m%pJQ+=~Z}x3w#H`C;33c{upX;cHI&b#PzRl-;f3t5s zFT)vs3O(nWeVZYCf3t7CAsc+NZ=Lj*je7pKEHi6&j}_;DzS*~#5erSA4rONTa&e~b zn|&K=E}@a4m}JaGJzF~ds_c_{t~AX@sB?;ovoIWJY)~4j;UQKrmstWAL&dTUN;Ave z;y1T-kV<$S*);%Fyq=MmeeTp49I0@)F@m?qn-z1WPymIwjtG?yC`T<@(apEF&tk_D zX>7yrx_hQO6QxvW4Em{&kSZhIac7iah98|FwD0vDz-qgYF2> zwd6s^=e;!#I*!FZ%Y%;Jf&22H<9m8A4>~r_hx4H0825Z0bWHD$dC>8_b>=}Qg5HTB z_Jv&SQn+F}6aZw(0YzOD&LC5a1A`d#&OKTo^`5B5C8=EKH#60QF$dfLXCtV^>y3#!9%JZZ2`RtzoA&z>N)=ZVkdYf3Z`~~KNV;)u0Io~3|D@Nbk_cJfiB1OE`eN2K>vfp zY5WHxo8On(BhZXahT4{~x(U&4Pc1iAX|R+@reB1^q?l3Cq<2{3nSX1Os-B6)v05ML zWI*~z2|)Tta{=iiEdZpC)C{QGBY7^<)wt1T)0imgI)hcR3G$p1`)w3g7&Gn`8^>5A z(H>7H{t4Ys>^GcZz_M`{OvP}lUk_M_?T)9*!?8VEyO}v22*Ta?7c<8jF;@B&FwDh` zY(!*cZMb+(dymF>JQ-MGn)dd{bFb_uFLA3LOTXt?MMkbY7z9W?9BFAnzW#C?Zp(q^ zr_t0~kd53Dz?`*dLO62OY#^J~hkHa?&So@@$HtaUTl$;Z$}%|q_`^1&v;ltFqgyxZ zgPB`YC`CYpJ}Tkb^+m3|3Nd>U;Xbg!;-T8u|B1XwPac|_BLj$Gp>A(2Qdr)!|C>m)wzZ)3^ zaDSeUWVmVHAoXnDwC{*W3!MRJ(Iml+?}K_H>J&K|m7i

tS{Y`%*^Z)heq+pWY;#JW1A;| zEfI-7iR@hm{cY=ihkA@dgV?k^XjSGbB>MKtUQuG3D5u#1;pl)sg&Tb8EGFP`Q$52wl(*aaJQ0!XPR(7Bt6xS5{3SZxmdLcCk5FYM-s?K%Szx=! zSRVI|9ogBIxet20D1^)O6JfHIgF2k7RjQ|LiZ;4kh^_fZH5x+Eri2%yMigfu6#3q(IN( z${rMU-o$m3K!3+oWA_2l*hBENV~q)#@(=x&jcDRAGnfyUP1BK&o

EjanJ2$oi5X%^LJ_7VBf%>AxrU^u2LCviY(Ak1J)5XzgSGnLWa&apG{aSF>0g4Lr zLqPlxhaDOQ>a+bC(3yh!4InM)Q-ETEJE*|o#sE@f_E~@`B(@xomg>uZ?iE}OAkIj` zP8}dE{W_QKIzZ=2Ed7RRZkqw!C%E4M(kK5TAmycLy5`XXZG&H07*PUJ++aZG3vM_d zeWD^jn(|CQ|3_jk0;K6J2E>LHc4$htS)i{2x?iAM06iekj{v0v`fos*+k=3pZ3{aO z1Jc}{0HnEbKh2$7nZOutpunh3k!#MBv?IbnOS4hD=7$;^g3Q9cS+gQZ8~M!y~} z!Wl(uGZi#lJ7eh`9U&%-gHoDVd-2R!Wtk;?in`<&7xE+`Gv6ugdMeo}O6|@mK_hIg zJDpzEx(e$~UAfntj6aC7^oM+o8<1k@#7|O}1Qwn`ZCHBx@P*Lc#{c3#r{j)qNS1n8 zcLCz=XSrjWcr|qqxo$NE>&`R1AzC7YB^LSKj?N)oOfbo&y`fm-rX8IHpjG4Opr?qT z$mCM|hnk5G=Bxrlu#wLSQq-pOFjRVC?W(QJpe2}eR z_d_A>T;NUfc+f@hA9hZ`^#p-9kZLD_bnDNM%dslqt0*i!ThLHMVw0Dk&3O{~3Vf2l zf#azjDN- zOx(vg;^vvSPjbYaZsI=85f?RaR)X?Bd)UNz(wF!CcH`^DXAk8_^Klc`BS+jlCaxey z9PLWbinM)YHyOH~kTyv{t{8hV>iU#bPsq_4i(X=T#6-1QdmLl(&ea|dH*vYzBV~#G zwMV)zVqC8F_>hUq)gFIr;&QdeubH@9?Qw;P%heudnYdi-k;~{TXRh{ml!?pL9zR9z zCSR`h_*WB`t3B>8ak<*#&rDpd_IRy{%WjYBE@L^e+v2*5h|g|^>q>~vZiDMa5TD)t z)*arhNy;vu&VKaUq;1mMzavMyW3|QXlQ;p8eoi<-Z^OTO+uAM=KT3*Q3+Q3N-G(cx zC@i9GjX)HmG?ga+DehSp$4`jj-g9yMj4AFwK+1c(iyQ9Z&Tw%F7sq+B@>aPxe&iIl z*2Uf6;=b+T?sjqay0}MO+|w@Zbr<(H7snN1&4YrumiZVLH`K+^jgZpCT-+QNH{Zow z>f*SwN7HL{aXbV`aTL}yywzs&kQch zTnu&Ao$jm>Lc0JxXd2!^pI8u(>7a!}Cx2_A7PyA}2>)TR3eeaW+}Ioyo1_=~ z;SLMXq@cw8_krK9Tzd#9Pna5!~nh7zsk0QC`2zfe>~k3{R2 zf%+Fvw* zto18HG(E%o&pk&>2EjG z8vx~RH$PRBzukNTC^VI@+mKoWQP(RHwTTi_xw(((Y zMW5`y6)g?4qS|M6W3*3P^5~*i=;^7ZrN%=qZhYvTkzHN!)`1tHb#0l}dd&>Bo+*+0 zE|fO6C7Ee-N?LEdh*-dTrOln5+So3L*0HDr?)OJqJ1BDHmAGMv`zO$4w87Qme)WN| z4efecjb`>*BJ|p{)*(NNZP?CM_Zt4Y5}`MlM5<)N>Vrl!7MHayI7qis13RF8H2hG+ zns&Tj-dchKn-j>e4ZUKS6Nznj80mh}ch$1euC}s?38(SR&R!V8O4I*DM`I)2@GoB* z#;MR4(9tR)@psWqlV#~eLyFmaC&Y1Pb0PkR#o36HKvm>!z_+7Q$GX~3pw8PUJ!wPc zZfI@DoaSqzJq?3^Ht7j~v`H@lvErPYq*H|`Mwn^xymEvsErn-VitOBapKSec4Wsad?T zUK}TSc#VlIPSw;$Cq>rBCx+*IxIn&@R!%NlE(p$*ZYqZUPx`l3nhh33A|p^IqA z`@ayHkVi;NSHCLI09?}o4Z`&rfuguxC(tllZxpBy*P8{Jfa|veD#n#x)R4IG{H{P0 z41OTcJY0VyP;^@P?A*_;&wX~)3a6xIp;KN}@5Jir@w>)3yKx2nmpQShIpEBwTi9=BT5js+0K^o8C@3)3f6Tn)BJWg^2A9Ti{mG=$ zU$|(h2sy?1q~Y)f)!3QQf8_;%r;_OVdO#88R1z94lB>t{Z;$d$CE4oIkjrnxNEK{B zh*yUGKl}Srp0Tsy)GQ%r#2rDDw~?2dy#2<`$|p2|yx3<8LPwfp@9ye-tZ%C^)w~Eo z6X4>z^|q6e#<$gYH1GBO2TOPeu-=wjZu0hRH69~Oj?e`1I#jrh&}ip^t+Sr=Z8a7d z0q)626W|&sT(%DTZ0`A%Z>#Y*O-yJ4T!#r4-!;Qqw|u*&Z>#Zm#R^S;>u^MPXPKOH z)2$cywih-8A~HEb6W}^ZxcEjG-nqT!F#lF#Z5%=q;QA71y%zPAC07jkl8jNh zL0KDz&;+=S7A~g7(EId$haBzW(#9b)0j^^}TM%#naEy;j8;8&YxTqy72n}XN2;9nl ztdC0@htLGLjsvaNdbySVI3Jfb4xtHfMTLua25#k#`na@lL=h8wU&j*@vNgZv_*-s2 z-p8elLudkd@repTtR;pY+;HUY276q_=2~b1Tql6m+fcsh!K>~%!N;X-LudkALxd}e zE5qX}zh61T$E9sUXaZbALF=`7ZW$Tsbl`RE^Qk^BTw+( zA^DLd#DdTQ+}IK4WZ_!Aa)lD$%4No2+u$mk_r9h+`pv3Se0gb$5}H5>PZciqJBIHL z`r%op`na@32~B{D(m??o{76_*`B2Ge9@l6cZG3!!HPyI z__(xf2o2~Q=SkC3ScafvuBFPoC5xssHvCWAS8##K22JwKEX;4SFn`Lz*mM4vmZo!S zpoGMKDGM`@XcIK@y{weuS(u(#>8uN2@^zK5G{D7TOwPg_oRvH07d9yQ4fYnlin%Z= zoxxe@lxETN%A&b8K$CsII=81aEUnTe<>o#)P@ZfT;JF-Q=(aVFk)~C$b&f8sjZ+M{ z4?4f_xwUW|Vz5y0+9mJ+CMo1{+U;ZO?m5F3wX(XQu6B`sAK%o(tl5>ZIr9QeHM;xt z))WLgEiof8D^^ze-;gce(8YRS4oN{uAZl^ z4dI8?X8ifS$-SM9mPZP!`Y11*2KB*KxuR-$jfYh)>561R#`i~X&!l@-)v%&SD(wHl zuLsXLmjbf&1rMiZ`)q_;lyPI|{bM!MR#ooy%R;NO!mq-5wcbBQ7n#kMviov?wEh{G z-Ro!W|KaXS-|X-_=qRF2%!7_aOXNYvdMV36H*$=M zdWhbCu)AW!`^Rh=oNau21IUxDcMXx>mS-Z(cOZ*+dYkbE(lp7zL0v$#PVHe$G3cn|D&?ymqAu0yPG8FaKFiFNI;iN_}H_{wk0G6Is)LN~4N zgNNivNqIixOm%L;r@WD6f{p*b@tB62&v{f=(%kmA;E zhGadya=IF+8{^k9U8Y)mJ(;m^)PDl#u|cUktsb9CyRe63+Mr~0pVEm>edR^(d3<)K z>MdpC_6;bQF06?$k6Vna0?T`D8RR$Q&!W+qinKffs*VqEISZ*%9~O3I;z})OSiIey zCeT7$IVTItsuSl~VJCwt<#_d~LP1Ksswmw(xIb8M?YL^}Gk}!$bwJAdt{eL=K+4-2 zO_cI&*ogpA-XVard^EhLCMfKj1xU-svwW5J0zjHaJs{14wn3W8S6#Yq0n+mQ#Es)zLs<_AT1va`KToci=3>nC2lOu_o<

K85MU$`&)*vfklm6G2Tn3;j7^uc52vJ_3jIjRC@1#BdGW@DCgz<`l z%6N_edN@1dU;E2FJM#B0gSO*_{Qb+IfD%r;<@Z0z-@gprz62_F^Y<@9se|E<|G2y} zfB!PJwl+JjeK~*sGM4M*t~-C2zkeC~_J&8B2j=fz#wygR_g;T&{{CgGSarhlzy6K4 zGDSBaCR7`TC=@Dm(J2 z3ZyQ}Kju_TRIa(b$(R{~OIHra`guvMPWh)=-DjW6mR+`-2T<2z(&mWLf%C(~0;)&E zeksg)Di_sM+bN08KXh86uwLzqq-gZ`QJz1TL#0$HXgaG*`DEhfmNhpJbqW{wmveJd zVP@bIwvAZWfPwL|!v@fe95X&3vQl2`k52qU(~ zkltfhr(6x1sce7HU=f#jUMp!)&VU%ow9$Q-KGg{~-AfB!=Ho;m^kfQBj^MH-?9!<73?oCD#?evH$h%pr+% z8zwTl?9O>?nvtU0%`@EYiPUwH@_s1~x}b5L%raok*?16lYwMgN-Mh2LS9&Hhy*l+| z-363jFPguN;wGDuo{OtO$Qs z^0nAXp&LJ9kq5VP77$M_8xpmTq5FQYr_G+V!!jR+GOJ9UO!pFz+mtxCQ8|I^_FwKf zGUJ>RGjq-tKy2rnuv9~JN19vvVq(j)jh@QfwiEHOO)ufv^si&qonfmLq?-=}QV!Af zW{~c=+sVva7yy&P?Ae`&G$Z%*N;d876}jqE+{80?KZ4kJ=8iV}U`Mu6C#%C7lc7h> z?AjGiFHa`YPoN=GfB-M@X>7%kH-=M~an$nw`|43EFs%FtQ(1kVnUX=WD_Y(cbe$vE&GuTSVGca;iKy1?+C}9V;86`6% zeI$1Z!m$sZj&1rGq7r>OA}wv0!l?b+KHs#vV{jjEwI`w=Be$0QVsOJR=Ac;9K4eUD zIGeFo?V77w`KW~so@NfG3(2y~xZjAGzuW z;7DfXBg$+MN+;ee&#Z!xpWQN44!8_9fLAXYQW%Fx;IK?N5ty;g!S=L$v2)ZX`}@n1)1WzWf|Wq8qV{rF{za7b*7Ced&>!=P4DZVaR~}Kh;`t;s#M=5I!xHr z3vo?nIjO@yY0q^BQL-IOm^3}ww6}}LYso=2k;EgJ1Si$S$<{=%%&q~%2}D`=2`G6X z8w^ShdvsU%A%#ax--yg&TlhVQHGPWAOK{(`wipxeHZ+?|0^Tm(M!}n3#2tnov^!N? z;G`xCvXkN*aN8U^9$_E%5U7x{_Zz@?Z7=OMqzS| zhSu^;+Oe{su)YuR)wii^DV@=Suo~_Ib9qZw>L^rabTg#@w2EiTT#$V$pC=Y zR9`Nb{X9KiqwO9YJYprbD!g9=|AbnPU?w=gC&tsCG(u6-H>Eo)ti>cRP6uXPS8 z?b@zSvI9@DoiUMCJ|XL+JoEuR4@hvQ$trd9;-X!);%@YcE>DNp|s zb-W1~!frYKh#Ii(D>v>&&?wQxlac1pXo%>8k(R&9JKkqcyYDzkBG8MDMv+*bP@$oH zNOs5opF|8)YX@~s&y*W2UP(C8d=ZG_z+@6TGpKDG(nW(~D5Yk@2HB`P(L18jI?aHB z4c{*yb5t#KZjDiPi)Lx|e2M0LX^-jPUP(4tY)nIwMc45+S+w~KQ|_%pR0s7MxmwC1 zuytJd5jPUN*0lC*Cv`9$&uc3Dx-_kgI~X-U=ti*$Y<2V1J-}2r`LbDb>%IQ=tGwFs z%K3QDB9G~r*=GzW%ajB^wOn$xDf*lDb#*QEQXuIWp4at9t-r$x$w&f;1 z4vRhleC6pk z(_3AzXFSD8?gRYd}eL3=m>DDGQf_h>{ySoDC~}ivyF=QYl$~q5&{#tr1y^5 zB~yJ7ThT$)V{8lGV`oilOPas)<(0LROU(C(nVzc}DFWJ2MG9cr7Y|D7{w`3Zol|04 zVqnQmiYF;r=LWuUrMu{aG`Ptrd+6SF9+Kt6LpSS>7ic-IrwLS#D?cq^u}bDdKP+4O zReXIC_Y(#8GOj8v4#X?cSgvPlY!M)hy#^4ctYPO5fHYss%ncn^|CRR?7sp+Midzqe ztvT#G1V~GI2!@~|1vd+j(s75M=DQ4#=6jDzN9P)c3&$uxnhJN?O%@#Y&7Cd~-C}4- z{{cu#T7*_`hQuZSDaSp4&J^4ufV6ycH?Jl51Q4eHVP_zO08KdoNK;-6s90i~0L29Q z7N98t?F2Mfpbr3PNiT%B!if^xdjOg$P!k}{_g8?lq+0+f#|wZcyM>*X0qMIO-^Z43 zB_J)|b%3;d-vLxC9QOdyJlX*1lfM8cF0rK$z%{oyfHb#7fHb#SK$_bPF5PV|-JO86 zh28Dab(>UNjZEyMLS_`)^o|)tJX2Gb$P9?>d1yf6P+WUOnmMyj$%IT;h*F z5%7W@R`~lA?YwC%<}JQf?xOpT9P9A7tl8=kVx$*erev0Nn4=Iwy&7}9N|W(#sh5>H0% zxMBY+tHIJS5%KgdlAdaDDBO=r5&R(hGS;8peRDiU(;M<>?-tlK7awnFs z_BHk^YSa03XWw{cMtEo&V%!I$?2VES0}idiWJ7_W`8HsXRO52iZHkhhSB4)8wLwS; zji7>~B9H92(;pk#WWGy{my=K)1M?UAsr9BC8^G0BXKT^_ZQM^4TGG#`@XisjO=+ZS zNxf8UW%Z4MB};Xf>A^yz4r!o7|~Uj?M2VH+SFHTM8gx)5HM(hUHl zbmf3lWx@3%?dxn0#o!7%?SOPlcpH%BI|A)qIi>^Bk&2d1I*QPmN=K^80cmcuU((ob zyRnY~(%k+4NOR-5j^d8QIH1rFKpNX^?D!T6XvYrB&C9s_{TzBmB2$N+tMgY30`8h7 zUbwH*VQR5qa?eQfO?WJ57+B4jsc;bn+Z7mlaDpy6#LGy72jF6^11OVlAoM^2-j#&xoh1Q3q7BPxh~RXlgB=ROZ|a!+ z6nY)vI~ypK0Uy0|J$KbdTKCe=IH zj&_U&iwQ+9)kokU;ksnYo>ak(UKj$GuP$$SE!8L19v(tENbbBz5XNK5Hz|sSg$l+2 zF6DdiMRHvUrOwH;YycV5i37QJ^D;Qt=)HAUugNWJ)s0J(4d|<~I?RYT~vm=$dJq&KJj%`7OcQyU?deAwIFWV%#^@ckU*|`Zr^Fb(! zG?V1y#Jly?{Cuv4VEwU^>hH!t#guG$36+d!%6V2%ZT}dE@Dtfv&J2`jGFk;#$}4E=|8(*1Eh;@I-ECG}L+t-HLh` z^n+|Y49^0m$fKPWqidn96&7M1?}#rv@5FW+i}r+x^<1da zwS8H{0pXI{e)4~=Ds`9XopOI-DH zaXenIrhF?V;}V@R~@ zX*?c{e}7WTtsw0@#UoD5262UL&)vR6Z-Ur1Y&4%;k`a_g!_dlLCP{M zZNOncY7>51rxrBr9T>T4A7H4VVS;!2)<{z)?#j~3(PI-6Fo+aWNNj!p$e8S+zz9-; zQLPxG@r3JbKaug}D7dRmYsHj`Bi}o zh+#xXVt@6CkVrDgm5RnA@t}|uZGw@O26UE=2f7D!RcY4~k(T+y%9~@c9x}y> zwA=exo%Xs~^&-l%31Mot~4kl%jaRE+j11tD(rX*{I!Ib;j@)>c4jhno`% zdj_5x>t3%wWKCvTA7NEyVxqvGxg#+FLwMaVo=n&LQ^wdLVtL1fEtiq)QPo%sld=7; zSPO%5ZLEcLYy@}Hn()VswWZLgLkE&NP@WYcGh+Ooqe<-Grc|CjvGdrXw$4L5Vq0UZ@qJX_+8W~$oW5z) z1bntfZf@^*f$JScMCf=7H|H>O{D);vx{huX5;=;7ov-6ML!d3V>bS(>&J^6UxK;>6 z;abP9d4P1ps{^Ft4He`^3f)#0_l^s3JY*@t4h=nq3RDJYmO!*W)KXmoNK3%oNK+;D zE|JPkRvX>2fjAXjzXv&b_|voP<=|`IXzy$14F55%9B76f8B^t=H zD$!V4khXjRQu=@yR%R>{ih;-;k*H{SKQItQnwvn#`A4K>5xN_CJ7zk6wASTl#*3}+ zP?r9CdHVJ8^v9ytvqA)CG#_Dkp*;O|X&TNP8zGnJ7lY+G6-nZt$T$VD)a=~#nMMIR zkIEg#S7*D3Oh@^$0-pl$;obSF{D`>sLhh6(b#(rEF0R^?t^=gal`)F@6(DW?j{(wV z!>wRP;tt110@6l08jv>4X@Hcs8qge}quH-Eb!lkopcY=FuqI!$ryNEbEr+6!!|#qL zOfjD@ZO4pud%zxpd!VMh$E=!?WocnwI*c=*dAJj_7)yFvEL+Wez;Rxd?%hG%Ad>1J z?N#4J;fkJtTt6ss(?ejeA9lW`D-ma_%^S^Qn<#JD>Mz>UL1SnPP}Vk};|)an@1K+V zKT21)vmiCnCh0doiEVlwR2_XJDMN}Ud5El;2uI)k+Ld&Q9=E~>A8jLu&Qf0i;iTT*zwQ7@?jl}~n9ij>PV|E+b%*)o+#E4-jLRLzYVkGj zz|81k#Mv6g%2CsH@c=Cr`L^G6zKN+Hs>|uP9KC5c0BvyzK)ee(=efA$fY`>v;>w2j zu=6Oc+8$p5G*568j?NcoFRq&23CKgC34p#Vv25QL2*h`I$@q$QXFNK>A@rmp4;xDG0*ty#7Rz^PG-VNd!c_|2*%zhQ0SW zkbM8&_4~f{`|Z8o{jTR-^Im%m?^=sCYFp;0VU8N%D5lHXxH!mqBc9*E^F>^@fxZLR zowz>4#U|H%xE{dub6i_+J%(!su3zEWiHo)NOSoRe^%}1K#>E0m_y3A(Dcofme;H4j zvA8t!N-^|GG2}`y^hz=GN-^|G9qFi~qeeSwoTJ7&s@zdkj;e9gDUPajRGp*Jj%sw& z97i=fYJsE9b<}x|TI#6t9o6orHIB+SDyUz}q)V9e0|}!qLETyutO$l2EU^ga)uIIu z!H}coCF6cEUK8<~dB^p_C(rw**W3St!%%OZ<_Ct;4|F2_Ro-#EmVCR$ZI;HCEas5SG7B8^_G+43$ zP$E7JfjJD^pKg40q~A`7e;=9w2#>~pp5d@8CgNKw*Ou~|n$9};o?V+r}gDHm1y?UW957%Ro851PTa67f~A9|h_& z+ZR5hy8X1{uocbVn3ZA~r{R~Ch*Q&dB&fAJ|1iRDr^Np~%@8Mbg)+=`O4R$MuRp!? zw{?CyrK=pq`qge?%E5s|oLa#Ab`Kx$N>X+EDX`XIC>6}pgGFjR?nmKz`q8;N4wTdk zVoC+WJfgYy;0K@b`v1zqj~_(XW!5ErbC*v)HUUc8h?1OGY|kDRj5uL8GvI(?_=_V4 z(?HAG7H1}umy_o9mx#(ZJjda zHP3CBHM1pyCXr`0FU0Z5gyTUwWN z#2lZ8zh}<(Jnk3SvS#tx4g?LjRs>dpfJHp@)0@M*hFQ(^GwbJunbR7YTTFOE4%E+@ z--O*Gn(OPlXABsE)Q(*#aP+!_32|&`J%9Cz*0z?8Hb!st+Q>c-j9_bf+u~LD0NPh9 zS=-jp(Jmj+#cgX>%W|i-buFtp+uKcAg|Z8YA522YMbGn4&y!Fgv)8mQ&LB*g#jO`0 zZ(8;RAfF+`UKT6x%}xldY6@oF`E76r86FG{gniKnS}+@2nbCw=i3OQ0OORK#C@H&b zRclMf;)~kCrBvz|iJgmyXPMmc3@NqpDv`H7p{RCb)^>7PXDDnEleX2Z8i1v%QT&!j zo-OW>?KGCPw5?scdTopRPgt~>?VUAJ%Gb2DUC`2r4H|T97ee3HwOx}ds;4H!@T_nC zvC;2Gvx+TY8cAy<_jyl#9BaEKl~)BlWD9~Vs0CW($bVbb9934^rj5Y=j{6c|noS+a zcBSHKLhkV&&V>)R8yqV&#g&KLy94%jpAx=5`f+y$Li(zQ6_+4Era7 ztC&1V80JQ0#r{a1gc5w)@;2Cet>45o&ekQl1*tDrD0P^+U}GBVJR zeG%$50Vp(Y0_f}$m}Z`qeGhXX9G}r?433*@+9IlLnIA#t9K)QVE{1?$aY%U4)zrUs z4rt0w!3n3I#~_4t!47T&2Z*kQ4|e!M-0uD)#wbn)mq}C{<9LKpSArTNydOH=W1v`O zaMT3u#|kBDwUCx@RTJ_6ur(p~xr_@F^9|YGVmOUTiw#&tgpIgsaDG?@YnZS&;?tPj zMBFo_>D&UW(%IYpqM_XjkTy7u5-+7!HG;0A3cs`j(yc?jkd8mgnXlca?R_2d#3fA} zeENr=m}Z=Wd21Jf73*fn2CjP`p1Lf9trBWX90B%&{1B0Ry3k_pZ|KZ_35)76;sRJ# z{~E$4&nPS1%n=i46Ehd3J%CWk5R4ATuYzZs z6XLj~PN-m(N4_#Bi99DuSAfvfh6x;KS6_^oo#ftaCx5!^k{|S(XHuS7ZdKQ1@Bc7A zm?P*IL2VylU^yt=_%7zb7%NsPfwIv30{FT5VidgWqc{Q9P8_AOk7I5CwF4ISeHS8_ zEGVYJO&u3SVT4o1JDCobEx^(-O#_Mf2ho^k;KRORj+wnZ;ka{|j>h`l4VS(aqwc*u z|C4h9$OI|U;b_RZnIVi}_TBDcJeMHI{9P2suEqUOp?2avPN?^AKTar4lBjJ86gvRL zu{%I%CBPl$PY@n|e=5OUEmUG7C=P2B$G+*P*FlXJ-T?f#P88}`Q0mHQpwtx}F{!R( zKur)_Xg;Xx?e(mp*ECTDdXZ6q9+5dpYB&AF?}uOYP_wDazHr5#x4?;>p>^4p#*pIq z0a%<>|JVBLf2FQ?^K=%4EB?s80uXhhc48zxCB4d2*Q-=GhF0~H5KHF{ld{6fqb|D$ zGeh%VtIO`}daX#DyJ>4(c0NvLezXij_i*9?R;gVtq2_sK<5O5e_$t1nt=amW4}cxZ zcK)-p{)ucoO1zd8{0!=WOmDvQfr{OwBWqC#UpBQ5^h6$L66NMgq+SdCbW-uhv4G1s zg7sTF>awrbW#2-9+$l8)&cZG0tV-uDeGOV+o#%JoitM9f63$KRdDRX4h!f<3?%n`K z#g^{RlAnD&`zYLb75?uLTl}2V9W0;(AXooS7I+kERBf1&+5@G-R~3k~so#@B#o_F6 zrZTKGOij6EBM`14{8{anvZttYGrMn=v1tqDo?pA{bgXKFMtWX)AeKlAnNN5t{DFiL z<7s@Bo9h2+*T-~cpOE0y?tY@IbmJG14VVk=-l*AuMbL8gxTNvZHjSC3%xjUuSC0jb zm{eb+iJUS^uc&W#hQ>IMB8ag)k35ijnA;0#EJ0y!Q+;uUe-ZHl8hkt`d3|X148Qmu zn=t9toq8IyUFeeC-q30_`5#9}N;g&^9YwM41Q4i?cjDS*kF4QI^{Kc)II}5!Q>;)Wm&C=sg$5I9C<*WM=@0)C;yzo0=K zfD(nDDdt93?#xtK@8RIMhU`ZWDTBK>UDAD3zM#-OxPygzng=Kp;v-9-DL|VZfl@(t z3#v}e&P>Er9NUe1xljiqowfax1f{lTkQFUIwMIZ#k+zDlzrr z7*Og5t6jy-1f`WDmjkKomqDq&4}elXo^!TufKrJBDpqynU{DnjkE1}bX#{LI~K*U*PZQ$pxDVNjva*dh5E}SM@lt<(pjss9FJ%B zP8Nw(j*9#ORD&2FZ4(;~^Y=h^DwV5c+W^WK(2^-;!$DOwMPu?8aIWGN{N=m$e1zlU zOY2`!Rb2f4uf832IO95X^)vPH-CZB;EveooshMzB%V4_uEzjXP2b7k}$#mIV}Yx?KZ9i6pZ?|;-e*!{4324?Y}cWqB} z?H#tR6pbQ!u&1M6D*InOWtdi_@`0^%*8)2{F%J?@FR(#9?69NH8IHMKhRfVwA8AyF5X|K=&U&{?9mPL@l;8+{+F z^~9l13f-2>8`CMI6DjrpY}e5qpb$6JGEkqIk#*ya;*Xw| z+WQ7$vgtV})nc=YI!vZ(yVCfV&S9}_dPJ^vSkE*7Q&)U8$p%2@pxvpmveHeP5YNV3 zLrE^)b4+fagoaIqjkDNR5Iv-MS2qoiMlAHjp=XWF1uJ34&cpF|Hnwho%0OfGDf7$G zSz{#PegjpXOC>S4etbQgx$cjsZF;`?0PcIm`QLy_XFplO8UsH{N#SioZdwaS_kFPb zGAxp~ie)mCqXoq=E-ckgk1JT%c`uF~`B^;5@p?C&jKpeOH{hzqMN^7P=RcJ~${5}d zN0m8>BOrrrJ3@(~a;8Nd|qHjvkH>K#CQuIwJ z`lb|X9;K3w8ttgyND(6#o-@%X|8LGxGG%E{altQ!myGHI)*j(!DJMHj(u`*p84kx? z5^<&<@i;$6;(NzGXNAMT-4(ro#7s@&37fmhvu#u~JJ7ha)_RIEywTdO^o6U(;F2r5p># zuD~>d5O+<|hXPEptE01$(9*5mCYt)@b>?@wiIp4&c z7Rvcj9_H{oPI#uS;H;M(KxHJ=Wu~e%MX~(NxG(Hjy*6V3cmmV5vULrsCS!^?*v~l; zXNqDnYVF>wl*we_tM8e-m~IMj3T*0)vG5idpSI3_1rlxoVr`q`)#9~laeS1Fv}60U zmeotR4WbT=7ntlIYyXoSI%8lvx1w##zrruz?eS&;P=2SRU=e?3ytZI2aazuBhCED-zT;FtDPnN?vGyEi@Ad2Bkj4!cu9yS)xcySqPj!=fTw z8oNa~w>t0Z`NiHRp{iVZ6%|gx1K1q9#{SM|z+n(j1J1S|b@8}%?=bH4iatCxKjPLF zdtboD%B35rKa|dPVsRt-tU7Vf*m`*x*07ac%hq8!+k}X16XRC7k3sLLKbKR&8eFVd}O^Ub1x0(bAVh zew0N*x3eKPWVGZ$gINU|4b8S30?IZ=aqQc;Yrp(=ptOz5XjTVw$!;jRH!#W9V1jflu>n$nYrJj&K(sP3pxe8 z{{}9|o8b3c$FP@9-)O#^jeOB@Aa1R0#wWS)IHs<&IH$KuEr~=Q$6-3%m^*hi#=rg+ zsB(CDvYTPx-Ujr40n(wG{D)LYqFf2=JurCny;gfzj ziXJtWFMf=4qDmv$VLDsem(e&w;_ zsMIh=Edq5VuFvE80%ss1QMf0Uv>O3@#scvp(QH>LOq zDwT8;BbDL5S8-AG=F} zrP7mC2@?jCkkE0yprHDd?|`6xA^pWbmqWWT=v|q9hzAFd+F!AHS3x(##`Tg!L|8_9 z&NG5KS2n~{o01)_p)lCzp3CI&K+lCEFKB_I6ipE7|HGb3b+B;i_EtxtOt6Vd!_QWF z29;Cf-QM^~bCTFrbj%BR?L+?#I!XArl+~5q|80q)90qqlzu~F{6XT)*ti4 z?7s}19^b-Jeq`3gwyBDA-kJX*r3OycmmD? zZc5?3TUN2><^l0sW>T)`POPzGo8vA9p>)$xfZPe?gX8e@zCQr~Hq`895e`Hf9&X~m zYB%kfxJN`2H*=OG><-EoOxSD0<@Zf*R1=n+%8fU{Lh@5GBb;TOpR>wFVO^u8kg-Z< zfnfGD;zc6UGtCMHRg_WzF>4=oIEavG6={W^n_6UB;&agwS1*tyzwddl0Z!`l#3oRq zaOuLkqlNlD?%HKxhHH!TkDx}2?LZ{*7@IS_WY1h(16y0(j-_2N`v<~P#XC8s4>#nouxl3 zd+*WyD7BrKO`C&3lp>`4Nc2`%_&Z;>-Ih<`b4W5=M{;s-?~blL{nm{zGj|QG#Ty#q zTd+~Ni6AG-w72uF75fv#EcYep1HrLhliPK1alG?!>5eSgHUr_)Zidcwo{jm+r0E*U zK2r>ubfn7R2s`(gx!Qe8w#d9?K&vy`AJ)>sEWK$<&xvBg-qH!^WlB14IK3aHlL0Ed z>Cxm<8$O74KD{AbR@(z*5hOYt+?G3|cr)iW2d#T5FSfGHw#%@S)7xuH5c=45YN+k) z*?`_AN|emfp~7MO%ue;+avC6p@g*qkaDMVsz>mYFeJrJJ#5;dQ#j;pza7W(Y3r|0u-(D#g1}?Efe=%u)QQDQ^KNw(XbW>cVv)u6A5B z#Q)#)uD%1gR$O%R0$l7vzlm!dE*8+sak0D)Kul;3!=?Tx#aJlCFe=4ZD8*1I#aJlC z6jUndDAp6o8|SG1w|jB6rNhQgB3^?#qkP5SrW1WHj$E4JnC<_t=AvN}C*0Tay|__= zAjV4351RhC5^*-u*fcx;<@PIm4~;!M8csNd`+nMMVmc1M_4Vf-zRfR-WC^69O(K2; z?)2-rYgT{X_u|^Xp&8)9^Sm-lFOJQ;IId;i8u_;G#c}A1hP}9Oc$o9PFZ$p&7S8s) zI94Jw192tdY#1`7W)0ss#!pH%f=W_DJt@ z0hV-!h@he3RJ6Z_ew<%p<$G-VU`L>CLM-Zr>&8()Ts56Gx5Uf!J!S2rycOuR_P(Mi z5Fh6$yR&OUtC?&!Q98CfQ)$(TrIncMi*#~B@s|##^eNY@UDek__-NCTfXU_QfI9)|53!BtgM2*cc-#&gC{XuGjygJFdvxSDWZu^#-hf%y-EOITdR zq^TgC=>+uf4>)Fjb02U_|MU8QV`aRo4>)Gmnm*vz z*Y4^Aj`?~N_w7F57~hBbfMfaH(gz&f+tvph^Xp-_7s) zfMfZ4qYpSj-YS5bI4OMU8O!}g5nQamm=J%`dx6U_17TPL2gh)51Vj7iIamXP8Eq^8 zp$;RX6l*B0e{^?kJl@&AA@|8~II8M7?loM)gFMEeuPl`lw+>Abj0IzEB7DxGZESLl z#8oVtez6&rHzmG6z0E#dkA2g)Mf5X`xtp#Avcc$g4o_p4hsy2;V)hwJA6D*a%+CKS z!U3i0OV@Ls-n!CXCZLkoISAW6<5&t-q`A!-=tS3PvCO*E1|C+$y^o+5YW2b!T8DkH zG5*wPd*8r>`j|#UCW)>X=8~ar-efxRCLkPCVeh+X;D@CfSD|>Nb{7?uZfXK$r`64z zDv;NaElbFNLSW9sX9XXQD(nND9uKDrxI>lYZZ3ss%$<4t^&xkHq788z$Zh2d}aT~t1bnZ-~CRPw}il8y~$r|J|w#lOnS2rLL;64Vp>ak%R z*H=9NhcPPD1wc1%h|K7HdW0VBc^rsBpx85&jj++xrFw4Z#+?#GB(y&rS)-yy?2Luu z94gv0f??4GcinGM{nRYJGl`7;=D(4~5(X?l{M{}F5R>oCCr>ZCbT+onZrJ)J*2sMh zv+vyaNvv(uppJ{Av-vCA&0?SN&czM615-cWE2^$dvASax7h|-kn|)F5x7|R>q~)z! zx;qgH8K_zwDhW*ijS49Y+}*e?*NW-P594sRbQ4F`Qa{Iy+iWuQvF>!pFB7HGYq?7{ zi~iA2_kHcb5+F5m^jxNYLP!SJ{tSXk;P8ROI1qVRrZM+9E|l0)xB0xHirw4_*3CU@ zvZO?dSQCet^BqK9P7*?r8kObT=BweM9umgg51DrOHguT+W!6H53nR8CPwptYu;>4w~-9;s(o7e%V*wU1JkCvqyzlB#6 z!pw;rZ!r->K(4)q`$vY$*QPDZq-$@2O{(j$1muq>y^8wGs1I46ozXhvwsd?ebZGJf zORsIAdsvf);V3A$yD=~LitkCH-#rLUAzWC@Bk%A`f+#zAMqG4d&3uNLev)e#-wCgv zWTdd+y1IV@qpA#)b(7@s6?bm!!IA|J?YSWIwx}UD91M}@nUl&5!1{&GL~eQ#DWa$P znNg(1(z>m%Gl9kbVW$;y0md?d+_bWw^DHnaIfh97KUTt4FxMT8veeDnl?Xro&Bd|r z;LcV~aqQQ)v$0$pdlC0Gp-PaBYC9a%Nx~ZmN^Q>s#RfN&931W?M^R7Y1hE|lN?oo3 zHA8r(fLbQhCqXS2Y7MCKg`yUTy8I(hwZeNCluEn|ibG*ox9oUFqC%T4ywRXEe49b7 z5Z)c2)a6G(smr@Su~SkUumoG z>N6rSxStMS6~{(`nk~FzL8;5E4J~3WLw9 ze&d$)hgCdTmm8egy`?rYGKE=_(oHPu*h%#?nGwmQ#~Evm2T#YLHJDgAM*c_F1J{t< zjdLj=UEF!9IZ#H5XU|#q?T$d5wWd)UJ3Ik`i*Hl-y5^LORuGJeq-(=s|dvEiKRW2eXMTtsv_tR!NzLPh+Z6i z9!y3N1FHMbClCY6lkm!6IFpLJx|#qOr&D82S} z74-T_P{|8=Jv5`qBK}f*{x0utX4zh-_36Y2)R}I>R?F#J=WCZARkwKt5=;`?CyMd& zvI&eBe9|g=Pd`7jim?lUpMa}4b`S2_0_BfljPRbo z{b-?H!F`-iZ{V(994EH)i{oJUYO&?~-5R0hf>QUEINQ&I(l0ItN=x+DL8$~4id2F% zk-GO+P*vg{HEY%1y`a=z?#HI}z~P|Omb)gY?fjHEYZs*p`ezldpd}}3%5ZEg)+nPX zoyzLkS604P!xtp$oE(lixhn=Q(xvt9-&xy;BYCOagq+{gIPkBTrPww(GXd2z{>G9W zaCXaOv)Bq5Z!!axUTyU9LwhP{S<1@ZG`ApdyvL@vCQyG)6|b=5-MB6L66YvHk8RPm zidTC6G8Tvnap@Uons6DsHwf=?+%?KKfl}MsKsDkjmIXg+g_?g>aLVP^*aAQ|v*w>4 z3VB@RpU!UASnb}lrMC1|B$Ad*nah${6LzIK#JOW}SI?LS3=VrQCe7C{&GGT^P#e2X ztI=MAcj?Wa0Gvtu5*EE;Q;okpGzah4CLnMcrb{9m>iJTWZQeeK%(`_eR_S#;w#K9o zE7(q497TtMf>6ift_30uYMt;{iGNzCMYx+n5>!!?+LLqWn72xFexi;QV%KW}d_W{^ za1_8HJy>WbU!F}M@%7E z8`LTFO>>$To+k9AgJP$orp>FL)r|L(>K8QE&z+TOOmY(<$PVI8LbKr#)8t2u=n&-|(I6D-Hd;8L4=c-P+f=#$OjvEvkS%vS7wJ$eUOyT+s-q+&#K6uaI z2mP0RSgMBWJzNjtx&YS(TpMu>?jMUiis!+24##x_t{mQv!Sh&LC*YchYZ9)*!9NPu z>7b|Mnu+U7T(fb#1wMx_Y1sJIIVz<}9FGkN<&`;#ABgfsIEoDfiHQrI> zj;eB0jiXpf)V*3qvAigcC0;4k07~)mQmWZe3mkQ>qt0{GQb(QdsCGxKaTGs%b$Pv` zE^*WbM{RV})s6}dY9oU&H-noq`trZI2=H;^b}^obIAhJaH+kSWTl}~6w8JFDHiqTD zYFHc+aSm)xBK5nYukv$p97d$!oLqP|>lkno@oR7=^~hiTI@xPhR)RwVCxPKmI2)B$ zj4%I%pSNSK({SF7p^e49W>Sem;MfEecT&GyvSXN^le^tv7#cc z>mENRcNRD_Iwwae#~TcDI1y(p%dk!xd-x%KzU_wZGI6T?PvrO(qJ6|ZX#~on6mD)3w5i~3D`bO zL~s*KNa_HQV(e&cc&On`-KvyQc9T!RgrqQE0l!K`1|5}!6SnGBr6OfARWKnb;{6gt z3j1wHC$LBf2bhpl8Mui!bB(5c?)-lSwjpKZ03(=?)KG8}aV;;W#qxQRGZiRPetKKsH!UTU)8;t`fQn4CDv1hl{gn(IPn3cX-LQvB&A;&hGX#p}P+?+`C#CT;{1lHymDh}&;;{b%pX9O|Vi z%Ec|ggrtUxlr2&HwtTi|ctDDOX;o+mrv___M4Vxui8pn8YeYaw3x{Arez6VX)9@4P zVjYJCq_l7dCM0#ZNa;6+g=cl^e|~sCN(+ZzLQ+SB{2DT6$d``@NNM2^Oi1cTk+LP~ zvwyg2%#i^pEgXUgNwJ;hOVpqbe*M}f0#aHy1QU{CPWjZhqxp_&j|xa>;SfwnibLs% zIBOc3sqepg=E#7Q77oFLq>{k;@9Qhi9y&7Vr7E>-2qq*oN~BmmY34NCFlbajO3Q{| z#C|;sHq6nud=2og14=fNgJF_9-ScS;vsHYI zLzsPN$IHaMm3tKuIz2lYi)R;iwr5(_v}V@lX++4rn=KI=r(00aR+%eSW!jc=U3}P4 zwOqXfzoHeZmhZ!M#Zs{ds!FI_+xi&w6`-q7nOSeQu=RQh0#Xf&nf0@(*k`Krjn5*2_9pEneB?Vh)!=8>FtN> zsw$_au|~?suA?!IXNpy@NoxyG^!f4VX-p2S_vH`hMzjL%VoLyqgCQmhgSK$-) z3t*m$;;OXj6A*61{TY~lM{&@X(8^zt#Fe5QF`8`&80T+g`Q)IB#MJ=Pl#i>4y0;jZ zi}G;c9aZVx7l64nimRxcsy{-8#w>~gW=9@wYF@g$3e4Z4xXSWM{grt4`k_5?xM`CF z;v0;vq~8Q!rblrVm6I#gDY-KqX9Lq7#Z^}1;WhwsQ$DW7w7HyncLDRuJX}rCTM6HD zz*s#O7mtcbRZ;i;4P2S|_c>f;MQCvc<1reTsrk6j@_OQ$fLW4fw z-e^4?w*^sLW#yEr2(BHNEAnw6g)Ca%gxmL`xJi?OpSh&pFM;_@6jxDIULEoGO<+EZ z;wmfi^0(|zj4fteM>O)AgJ-zC7Ti{h{wL)5(-Ft_F5riN-P z`g~IklJx6890N+YXk2_NDnnZ*)8C1})aBu7Ok+~S#k~c< ztjxz%2R){HR{(Q!9xhZ&#l7zV^GH4}w3>?U{RWs_dAKQgxDSCD%DxJWkMESJ)yk4P z-5UeUNl{#=7T0=r7BH<*Tt!7ywA`-)=9(xD$sDXu>F;g8{4^g|6%F5$!2BVKn>0C? z%#wb82WG%w8aW@|s=WIC2w=+daMd+6Dk^t|uMU`ndAP}@!>M56RswTn9xmvbrr*uL z+?|Ij&-*?e0p|HU+?0x-i}ZIFF#nT}%gc|U=tGWWKN7~JOXzQ|;X4VK*->0YMa2{q zl{@`y1!jF7ZgO>X07v>7V7BJtLf_kB;C>6tWcFBLT=*)gLpb_-1~4u8xKK=p>j38J zJX}?%L=*QPz}%aMs}3oU68AVTzl-3a`kovJdDmb-im5FttDP7wF0%Z14{+ny*M?!U zv$m|ZHtJp(_>~4j9F4eFQywb!{HCS>x3(Ae7>`Q|xfiZBBz#{4Zfh^@aWL%ZLhjX6 z2Y;91-tT}LBr`_)jxXICW-uVdXnezqT^ZkFfScEgduZas78P=DO6WHz;adaTZN0e1 zLB#JBa&Kx?UVi)xxHo%okNNSpg6@T?7YSc~jFn90cnQqD$_wLLYcK-jJImjc{P4{K zuB#XK7{1Mg+?!mJ7vFCJ_gpXTF@Ikz=w9_?8(uz{zdgVm!I2)AeZ`kUzGDnVfVfF~ zt3urXac=@}pYFvy4)>m4$i1mGQ?2`aGJF>S_nltcV|;&9(7nmQ-=(QMD8?)6JzXGB~y`%1qu*qxpv!W&7y$&(mGXZSKZiG^RdX!hkEzmIH^2yeu_ z>agBE-Mcv%i#>shW?$|xKXxXG@J8JWb)zJ{e@J2t?MrdeGQ`r_7X-9>?MpI*h?7y z($_G0U@u|xz+S@WfxU$BUwsXu2lf(159}q39@tA5|J~OxdSEYM^uS)i=z+b2F)mg7 zP=vIX|BMIr5=IZ~C5#@}OBlI)piloo59}q39@tA5J+PNBa+a`9Vf4UW!svm$gwX?g z2_qHi`xHhG>?MpI*h?5aFc?O=>uR>?L%Zh8v~RHG(1(GumY_a~jfU9&9wTu$0Tg$` zG3_Gma-v5$aQ{F!B|}F~a6KDd*!Gge8(5EkLmk+(gGzN%@h%e3bsUNlI=C@t5w_{T zrlC-Ev_}V!=4h^ZdI~7&2?rZv;+St^)%G=oJusZYd2OtQzPjjv>Y~h4Qm>J*6on=s z`fy`wR*L4*kwMWTvJAjvdh_XB0%oUc=?mT_&@|Zn)h0 zcB3Ath) zE;MOO&87aw?ZX+c3%SIjCQJfR)w(`4OXT+*DV{za&I5*>>o$xt&3$zz>IdB!=iQmn zS9c`9fg9bK;N6)$y}8~UZak~5euhA;R$f5PlO>)cMF*)<9> zWO6O}UT2M0)8@XBG{v!GOcV2)hQrUuOC5XW{a1Q5?K>UDN-;}lXyK*)x#d@TybAUN zK@el5(xxP-3icteXBaO2)BA6G73^6KW2J_$B*5_D{bIbl3id$`W2MF#&cKiq-v$u-{RLs9=*w{~4%wU%q&oCKa*pl&5 zjF+ll)9!hPu_1iNaMVI$B>FIO*^|G)uArGjx%9qGtEmeUaEpksfi9_{rZ$CEv&q~ z6yv2T*pxcYVXV|T!{J1@mtwqB1)Ea#Y>mTQ2(Kj@hK)5Z#dxU-HtlZY4d!qs^EC9ge4W2No}nr196pYn{?SSNL_Ac(P2J53ooHYCM(9qXiCa2P9f zr15=RNQ&_q=cJBy7%O$M;jm@vL&$g?=cG~&W2IJ`FdrY1V!V!bQk@QCrM_gs%;600 z7vpt;lfo|gVoq?W@s?>7j1NgMUgMqAUmeE!l`vsGF(k!!o#>{Lw+${6P?s$4r8Ut*kphy$L0NEyvm)_p$=oEjx(H!kQC!p;iM)y zjFnnpz8xxWc)u90N+-42VXV|m=G)!Il4887oYYAUW2Me8 zoa&Gi<5lgX<~WR%;{TY2N(MfJjMro*Wjkh*U5TnNc`+p<#du9|Qd1np`gOnYy(T2Z zc-1(mpF50|+G#jcGw>l~yrw#-7aYb)aqNxeBwSvK@jA&#O%nt$R%($6^T{D8#_MD! z)#@--YMt?&ekS5ff3`L+dHLd&Q=HVL4r8UxGn`XJYO$62%Jj!ibyCY5#!A^myQhg1 z+bZ;nX?U8G;?5d0r@45IFr3rD^{K%$Jl#nh5MbXP)?FbH_Z8e0rKl1(!Jr1~|l9mCsJ(v(xh+v*>~%lUv_b%V8nh@LLRYtJiK2okG}rsdgs@;04D6$43T1f(KNrd z{fjfaU#wJM1S3?Dac3spykGT?oqz94=hwghChS*Qq}Ugr89v~yGt=HLRz)y^5vtj^ z(||Yc*99wow7kLjbxr^i_UjChvVPt5gA21~c)wVI!3ajElZ`uP;?4VY&nI4+bf)ub zS^yLFt5Kxv0PwsG6)PIOU;OM~1S8ZAlkZJ<^L`DBFF3i$`St4nChXTNkz(JCrlNnt zh*{n*R+cb=5$Xpf%(L<4{rb-_I}V%e{JJlI3Hvoiq-@#f|J&Fer`cFE)ZVF(+e$5prn}+{*vwGoN?-wg(7{LhjCzC$&@aFxxXzH4w^PFFA z2QXp3nnlXS>jxL?xU$*%#p)bJFhbpB+?kIz@7GCpZg^+D^NV{f(GU~%i|r1-WcjAS zKP)}V`(;!H1w--J^~RmEMatG2AHB5m!LyxTJk^|rn6O_9z)8eS6Cw7}h{sY30)DYw zp?e`|Cj6aM63jweK3?_DeyeDq^XvTpChXUzMCw2~0CVo|4t?)a0l&235RBOW-sJl^ zc=LY!@tU$Uf(JD#nu+**N^}v?ALiBW$XDLerIy! zc>%wwVT*n+JY&qOE9D))1m8OiXz?=80^u*(quW){40vPr78|I7qj7TMMC;#}vzi{Da zoYc32m{2R_0+BihcbfP=4!ZvWA40Q^Loj0hf^nxEZyG}S^~bNga!I@M>-PbShVV+m zSt(LU+{r)WfX8cAI;m_B6AIxfk+S9RkU0a-UKI$T)=`214y$U6JF7*CWy6MWwe#zV z07gSNteCR8zf~eWPG4ddf9us-*9e`z?3?WVMvAn$v&FOqJtqJ$n4<$MmAWTS>R%?8 z)t!ATeU`PbM9@q_CGOV@`%T;f6JXID+&M!Y;MFyRCbE{1*)-7u7C+DL!Zc;mH;ik=_7Ll3asI^^O?UPlK#060CYnLw0EFLX3*y@RM zKP_@zS_W&nLw33a)P4X~cz<#sJN3)5f_c6o?75lhL%=Lp!fU4zqkKCx80AaR@oq$m zj<<;vorp!W=tQi;MJHkzE;qGc;0Z_8GM z?P3sh&d#orFR3eK42L-^ty~dc@U6h<=g|ZFf<;C4Zjc#7EyR+^0cJFp16Gl2j@m@? zIcguy=%{Ttr=zwmp-fgs?E`rowep!Aweh(fwTb3t)ZS)il<$J6=OKo2j;FtShCd4) zd8m6JnCirAq5wc4b^z@wn0%2uJIV!$K|ms(>-?}P16o{Mh{9}#7G10eG{Dmkg#JFE zP!zIpZoB_dKqOoojfInll*XuBVQVKHDyvc1LY7W4RF0#Pg)E(ZX+%Y$7EZ!_GEs@Bg_DSUN>RDO)=t`dXi=#!+o4?&Me*K3&VlL7wD)y? zk;*9*Q7%DpnKu{7}#Uv zXxcYSo0pAqaWA}FKlY#C-w8~oX+IOLxbQmEYr($(m{F!x?c575j}*n769O%7h#B`n z+j7M21OH^;xS1u5^*1=yOFsQM0Qny@vR;JuE=x~ypkSM30%Ta#M zrAlwyk}BEJIcoQ`lA_EJh)y!Sy|@H|vGhZ{i`&`e5*x+fez$ONhMX^$!+yNG&DnrA zK3eir=S0M%D05u8b$v3O8**B@wfVG?UE=8WV$LGO(hu;ij@O-5g3!xOxV2!iPiIx8 z&z=XRY3vKzKDykU^SZqr0CP~F94m1X-k6H%+*I!Hf8$mpC*rj=Rq|x#B}~<#OlL#u z0)}K{y0va3HuT39y5`7%?Zup54~GW`94gX~-GvQ?CDgjfd}boIyiezv_N3o?6fzq! z1H~3Qe;<<04jGwk9$B)zZlsJa**vL{U1?i^)@Wrx9fzwp_Fc!546>X2nvIpWut=6hTAiF zL}q7m&-kF#Wrx551!7Cd)byUr6cFR~KGpdTFnNw;=UC{#b4&Cj{EGz-RJ{Z5_8e9{ z^q2bq*MfTju4369e!NiM!Tm&`LNz}Nl7Tzx$#!4|{Gy`xY z;`}qv6#eLH@d5I=@@)`rFaw-ltjTFga3$g_?o7=GfAQbfc`dvf!J*+ssQR;!YzJo` zu0))F4HTu=x8G}g*lXdv3l7adC-tE+j20e!reAlyHuhz&g;zut3^zhmzxdJ7491m+ zmkEv4{_~%{*=ylVG+eKR#}y$o{H7Ce{$CivD?d~DKVA!u>n>=9h+n~f4Qp(_H6byo zg%_Mx6b!9IMW4?DafQnvIk5s88j|}IZ^md$zinUfEQ(E^Hm{{4vwEFn;sC?8m91+& zYu|~X8Q~d*!&ODrC}x9w#S^2a%T~0v8O}$0F{T>#?J^7G#);Yl4j(Zn&3>%2sGnIs zw*_0+1wrAH2LsZD&L0d|7upFATW)j9$CkFWYgexgdeXM4wS^}WuIgM9YhSTsE%w}Q zm;T9QKlfl{5UF{tnEbe#&y;s|szcCi;xrF#X2{ z$A_j%_)y2I!T)bqwwrb01lH{jplk8sQC%&`vEHhO3) zx!9TD{}Vrh(^<8{xOh~DoQu`MZXPf<7#zb_TQ;XQSRaBV_3y(5!*?2KdskHJ1e~&@ zZ}tRmyA789a_@zSp&c0!X7C3g@W(R(Fcuf}mo@ll1|vY+)ZfsSM&j=oz+K#nd;AAp zTfn`jzr@|r2OR%P-zQfj!FcQY>Q=wq;kEy;71J&q#Pn~TW+T-*Dlih3uufXvo zb=hqV*=MrP?gCg2?rLtp!EU(&<-I9;T0?GDN!P#kW=?=W=TJqlc|C(Czh{n>BW*Ul zk~u2-J9|<|&q0D}*sgltg3tr(rKz22S+s2&{A!ZWv9g>c6z|mOD398Qp{Ey)fdBGHhIE!rlh&{u2`R_8lC?}~H5^F?qt zJ(ts(e9LaLhlf<`y|bh<%@wojvoC8T;Andq2$QGj>``gtDU-=%XWC?E-9xO0>npa1 zWDk2_neu=;qx0QSKTKZB+-7zUx>b5C$q{gEF0NuZ1!$g7Q*hV3p9xA+YXK-tRi>b( z>g5i1ox^<%RG>TrJLP&jOm1L0r^OF_ri0Qsnx$laZd@wLVvbU3$VjmOR90^Y}E{+m^G}? zgC=N4KD}ngE-qc{i9(s5Gw8yGZq(t@V6mo%$9xc&Kly9=gt?C!!%&S&!@y|8W73XW zkvV^53|lc{1LaH`c5!Cgj=YZ8_{!>&&pJEUJY!mh8~&QQ!C^-xMi`^X6C8467bT1# zN6m*O!^j z_3I^|Y4~eT#2Ev|>&FK@^bOwu{R22Oz5{9%JG29OBkY)(vyZPh*LOhgHh%dI=vb4g z+5x>963n?5Mt$ue-vJ%(FgAodPLM`BpsY}6wm*E~D(!&sZJNVaDXZ9VAZ!zHHV~OE z+fJSG1-}gJIuk;_4D20XXi9M<;{4Im;TKQIZ1&5*{s9h6Y0Ub?kA;RGVj^CPJL5HM z>WjztWnfforV)&p1Xs>bJQ8uHBu)3%`(NQt;!vJFiGy!nHLQd1^r|rT&6_^{Abh53 zZVzBIVOSy49E>XwPvTBKm390wFxHVYf(eC?%?^J?!wYk_rUNH&RESVaFhXurhFJzy zjyL*6WgWi^EEm9pRhJHhjaOeDnZ2zma1saWHWFPyFhj?=8}fYGGv^uD`ZM^WxDw4oizQimA)P zJY@lRDuye~tx?XrJkGHefTv>a$>Us{CsmWju|sPVE|SgjTd@_tHR`e*rcw;=ofd$n zVpfDW`GYQQz`)_=LeNiAdrcVsgA*+nf$(s$piWEx)6sTei&u#87W1Ib(6*9R;(}3V z5gLahVD)`K4d%_f(p1;7tbOtFjzBDyVw^@tO9H|LnM`FL zHNNr41|ENaV;h1l=BZs6uX*rV04M4J!Po`#1p;C5Fo{ZG5J#}uE?U#Fa%p~KU{~I< zdTv2z;Q-`wF{)NBqf!~1n6bnTOZ7G?RXMpPFe=4g z11fj??`ljT4K{lWEAR2Kj7m+)A8l&K=W>O9Yx2p-D9EJnXapNCHv#j#D6YV$)GvYg zO%xa2h+ZoCH-Y&uimM1u^|C50L+j11@gUrc(wLu!CfjXzoC4gdxM=um6kK@2|5z>f zXQ1xd1Pl!?Nb))t+4=B;8|Dy8zul5| z@x(B&z?g+%*)W*kvEkl+V|IJ?H@jdfgA}V8Fz2SbMLFK5(pemUTkhVECWbv-cM5qX ziQ_>70~LXzQ$?z0xI2pTZ^8gvo)tK|m?z%aQ2_qNCrU`i;hq$VvD73v6%U(7vP>0ssndTn@b#TqvKrziiOS;F;M$5=3|l`VIfQzn8)DKULRX4aS7j8 zp;$MuS!#QN&Dic|+Wcl+Xhl(LtT*;OXh&WNuETL@XOO+>cntrZw$@CHf4IYwRn@`z zk1dCAcTL+8|C`;u26a->(06p$J@VZ?ZjMIdyM0RxhaZ}k3U~X?cbKGUu&|j;^Z%^d zcaU*sf8D+j4rBfLj(R0Y9`1_yZr}GE#!9_uINI&I4R8FQKWe<@D&Ot1-5NjdIMqmL zx33m&ERlCt?0Cy}`^cpcOsL^ZAN)F(>7ynmwc8h*3lxmVUnqAw@5pb6g^pbo-|br; zz=S&l2f!wQ`C2uDCtdt!KksPQ7z!p7Lhbh1uk6f+9=}ApefbA4(%qMh>-3+?K-vE&!}o?eh^jQWRsb}y4&V&^!c&0T}}7e`o;3iwyRw;$bu_vzKUx8%ADb! z^>*N%(IStZk->$|R#63|mxwWKNQbK^54HLDKOO|k%?8K6gZev_6_qpRfZ74fG3J9N zTyawzhQth9DPXS3!-drVYk~VVFn=;Q{$KXh*0dUhfQXT{Yj{Fc{`}(*_yvpr45KbH zjNu7E!LPjBbcDxx+0OO~gEy;H$W20ZW(utae?{FNhV8;IL6Z!nQC2)Q``jTk)J)f`g`Nf0;s|jc{cyrPipZjdP(&gVMHUGbony;#eE*+Is#RC~choCEzRRe+e>RghW#?vW0miyw^G~Bh3+ZgdU zoX~b&CNnb9%2qYQ(p$Hf{1P=bW*oCY8_lCYjm1?gT7-RT76ZOt!}eh9V!%K$*xIUy73$vjN{nInX~3MfwccmA$z@z03zB%rVziOzM4XA42qQuK5*!; z;fDt+X;x&xCIrJx^S{}^Hgyv6g?{mqp&#`xyfa!G*h^N)&mBDGUDDLC-;j5m2}s0Q zd?|J2*rBKEyb7e`mq-{D`?SVgz*iW4+PVaiQp5YbbG^>1K#HnOYZYUqmh%;c)sLQ? z&bn&A3)k(@c@;`wNK6bB`_!*rD#J9eS*4SI)`f$YYXcinD=J$R#Ca8!VtJv_2KEe4 z)$gx?&98}O2rfS- z@YtF;&Ax$c8~ns*!AydpIRIB!%FnADD+tAeo8{WTwnd!hhX)$itT+%^L@9e9AJ#CgRV-zlmf#b@La;OftVinqf#%O4!+gCi5^Oro%_wzVU=W*<;7cInh zm&?lG{Yu`9DcpFr%{7NY=4;Cm<;J(2T_MsR@#yJV7X?P2Jp&~>bVhAU>yi%drhYBX z3w{P+^}fJ4xyCaMW6PRl-WA_?wTg|xanABPL55^jhe8qqJIs&gMCBF{LkMnS$g9&9^^$B2J$;0KJ2>TacidomdIDaRH$A|fk839ar6jxC-DcC4x zJnDd1n2!sMz!J9-m@D&ep#x1N9ybGXcOI@{3dg9dp?i-2^L!qzDs&_mal3%|pFCW3 zd9cw=+)%Ut#MBR?#GM4p?0j6Fd#%8%kK!UH@G+gQ0p^Y<4kzVS1w6hK z^aH?DvrdNL?^epo($`XeycvL1(FRjvMpPsln0{L!#nrFFUd9<|(8hSW`&&es5QyTQ45gbz-X zBbe?s7>I}w_okGG@@*Jweh%EusC!ex>Bso~u8@0E!)l+z^%TTa+CQv>g}4t3;cBMl z;SOMXG+-ni)!~z=>E2O=a23@R!3-g8VnJMa=%}xwfvYWqs|lZ^Mfa8z!r{cVKhK^b|06F=Jqk!lmUU6ph$<;Qtndp_)Ab7&eS*3uxD}VRE6t z5Jw|@(5mqFTMqtZ!2Qr*89wRzR!pv;j5V);codj#vb7JxVoiT1hR!3_v4aWth|l7O z48w9-sBcdB^9+VK8VO(cAX@2juLABH28(1e;R_v%F6r`fV2(UYoO0{Ba1FHxKE7KZyYO^9X2Td*FRxV1ao^ z#j;ZRX$YGaAO4X06dw=lB|aY5OME;q9G|=}X8RgO59}q39@tA5Jun=`bb&NiY$VNt z%Pq0WHaBY=^_7n@r2vCgGBB0SetNV#%w)?8|!yU7}MiS>R`p}=2IaZdvG9b5Alx*#eJI+4Y~g5 zoWVZGT4NsoEEL`;4%S!f#Tf0?15tCNvX2GDQ&S%+-TXH=k5qNDLBN;{HG0LKd zaRCOFY7D@qixN;IOE~x$%OZ_XC~NIb0T}ewl+5l(=LWIBCeyhF)?Zk}-nFM+=}lWo zc6JUiW8hNw+#-`j+a@B0S^-sodcwyy{HdF{lH5rm+Vy_FOs4DoL}n7URw&)X8LHB= zx0DW@c_db}jE5Vs?K7(`-+)hX`&C!-6$Z97-R(ePkwj8L0YWPY5H*%lYl!P87YuXv z36K@b#?3R+RFHWeb(yV4@b(Zl*2Pj1&zi|{urx}GY7LtX2SjHNJ3P&(_`y7&_mFY5ZJC{=pH z*3xND)tBr@ZP*jA$P7M}`H>+WKP!4U&U;yU?IP3(@V0UD zrNtGyd&Y#SL5hUkF5P@0@R0Z6dJKQ!hZ69jDeyNzMUHhigSsv)-dnn9H-gc$=^gBC zkdsnKt3$MSWi6w0<6A(%smAPETDY?BvdlaWZbLRRdPHOP^@ldop?&#sz47Jn#%#B^ zkji4$1pCr6q;zB~#TEf)z?yPPN0)7{XDd1ehXuZA%jG9@9|%kT8>!2!EKcoxye_-4 z*rHNXA1~d!>!ZDUbMqZf3i5AU_Ao6nk99u+5VP5S<6Ic!e+$?{qo)q-2zH^_c)51Oe(J% zl>Rsdphvt#Bn|?lwev(!YJ0Aua*nzcluG;*)J~E8J*a1e+5<}4PDda))b=D$&x!3! zQ2db<$5wz+Kdy7sw?J(X+j~K2Sn%2>Q?d_~ou}r{q>v$>>8x{tEOn|Xcb!l*xc^qD zIkTCmvS`gA*;iz(a4;N} z7krKgz65CNe=@)ek~T4;aj}@23{h?wktf4NOf<1?5grr!MWN>4&VmjNMciK!Y7Oq+ z5NbW{nkmk#)^LSZ6(oS4iR@xHg$vn&8(zve^is^WT`{HSbQl^Kto<0;#K-EH?U4TyHJRlhNCNOM}@Z6cg$5 zLUpvQU9q@*R_DqkSYf!f?V{DKi!&=$ud1WgRonVZ+o}${b;K@eTT3F=v0^#*n24?D z=;(w%`{Itw{59ARwJo*^XhYJO3)+^(FzrNvRf{v7*t;TD-FE&{@e3}@th;nWyepoK zKOg^X`~{qL_fq`jcyLaM5&XEP+y|KiFBZQJ!JTC`tkYWNFiEk+USo#CZ+2fgt;afy zmEwWQbv118mHX#o9i^69y5JkI<22`7%TM^Qwgy% z>-}PCc%9Z;9mY!CYdGxTdMRr7dY#svIgFKB1~d&v`@9rW!!KpzFPz3NW&AQT3T6l{ zFU8dGQ|@1P80*)Q#&>r1y%gi+r`&(-FjneS!#OY{#d!IpjBhxMm0}ZvrWBX=i}CVH z88-@o7%TN76K2*WUW)PZOBwHX7%R2JTuloeeT(Q!`J*$#(NzmX_PqlMbQkym55Kmosg=#K(IiICLb(f8cxPqe$uVXV|8hI3S<0n# zN{6vh2bBPs4eW{`L)jqTPIlu_3(J_R`M$0(oY5l1nLwuIA%kxC{b-37e!Wmr0Sjg{La5%pq72zbA`w3iZ~Q0q`{;&) z$GFsZBZvv<_>YB6BF?&$rgq_li^qyoa20}J#QuA6dBl#z!>c>}_?j=Z9P9kLH-KTR zu@jrzbxtr5e+_S}g(pq_Xu>!rbx#l@^a+M@9G+gO?f3QXtUAs~RR%GkcpWcN^oM5n zukQHf@h)C=#e-nPzSe}9ermj!wj+;NIQ#_X7e@(ch|zdGChw|m>QjEx>)UP^@1&j% zVuY?UoD=c%@p^RC@Uu^JQfCG+p?FOYDgM)GK0V^Q*G&+q;F=75Ul*Eq5ffHVD;FtSHk$v~ex#mgCw{T|hY?IDgcacWbuC*;%NFX1b|O_JLZTF# z2uU#~{W9`!Gxq32rsqwyLWz0 zPqY)MDJmtHkQ4*q*U+5(!=sMY6YWH*Mx_K3l42lyyl(x&8RzJUb|N)Zr34d_Vj#TK z`wMTmT2HhSDRYjHU_w$1gpb#z@#(oWJ`F3FFS_0~obn8WU$3)%%MX91C)%lB`h^K5 z`dZL|5Y2grzxVlO!xY#Ko#lINMWy53b zop#wg}YHk(46X0;GrQ4FhvsA%Yna0;v+ zvS$Pls195ca)>;b@`8OznfO&pseHZ6-g*PE|aH)bH7JnyF0xeZGe z;73?y6i~Hx3wd5(lL`7?fNh;JRxTteu?S zJe-4)DBugDenE5nta%NyX9d)X9nvnRo7T|W;*T$pbZc&Cs;7uxXQlMT=nf0dM#s8g z1B8HU%GYCEMg81VbA4T4gH-3W#4j+oQ)r{pAh^Yh_6QHcNa4Vsk?JV3!P&lg^#xe) z=kq?YE|8fMVcD3FEpj$0+TEgXadTq#{OD*WMnKHZaLzjY-UG z&?=j?hGLFXYQcsW8Wig-{je5+$Wrq=1HS(fB%w1)I$AIa#!<7dVt76nMcoae<=d9; z-?}9*7*|NR7i&LIhx0(1TjtD0P9UQZ{WYtw0hy)%W3GjvMVMR|yLyeT6Ywb^s_PB& z=FM-IHIrwKSl5Ja&U$;_K7**V&C4j?mLZoMvZo5yuwoT{CHGfBoL3-6@sGt2XC$Gq!*4k@>(${;pCDX( z%KtJ_4@I_RS?8)&BgxNZ#j0hi*;!M!$Z;=jFBS$%hR7A0Gv(qGm zv2qTC+0GHm=5{w7=P$0VsO0(rl-jmcc8P4S>kB4TR#(aLf+W`$aI6P9nD`IP5Xvmq zF!a72AItiJNjQc(U>LG<(Jr{qv<>)&7ya6*ayH(bA#M{eb~MD{3heLlL*TYW-Kz{Q zrlorv#d$l5n^bA~4(c^=Y#<(DS{TmX0{hP#2h3?vTxCd|Smq(-0`r+DE~2k{9=zq* z=5`ljHm?fl6LS>q@IX5cud1(G5mL*Se&KPzEi_ohL-dKmn-j;9;I9N`a|9RFU*%Zp z?FIug4FsDq7OHQV=OKW2M6ffem1Sx%ydQT;`W&KJnQXjW9$>hj2)kvHeG&o#tY`e z$2})_iOFszlb?$T&k0`XFv%F}Da^ea4l5Ba72fCOYYtczr;|{-g z?^k$EaIC{vztV=otngBdm*3}Rmcv*nyMGUBH7~_@`8h$me~;hi=2a6f)?MNGM?WX{ zhQnCDI8I747?&R%E&J8(BmJD9jxHHYXrxHz1o^k2`RXx?9@9BNjua`+%p1zf^@hc< zNOqTA>8rgl6q`{D^d3T$u6Y7mBXv{rHU ztLKlz$Lrm%-h8?ITJ|xr_b)nPjOO4;ri7EJoM3gRoS}J`XRISmYIz>#t~}0zAx@!j z7}H{QxF5o2-(QFfgt+QAZz#mu6d3eymXS?23vaX;LYrLHo~*NR10aFpWhKy|!%^*^ zgzQ!n>F#@{T!&v_d8?*{LJ6g=0Upm5Ub){gi;6i!0olQ?)N4YgDkWp-SoYD_Ew&d3Dxl#j;mE>$3d4ZJ>C5JU6N7+FEPfHci!s*a}KLz)D2i zh05^&6AE`o0QOB(KXbE;?sIOIQ3}U~HnOiyH{_*(#J@(d>=VVhuQ=9#J8L*SjqgyQ z&cS`SP)l)V`=B_s)={Bi#6+=GCrB7_KF)nhSa_J%<6k;vx8E4hR`Y&iKy5?XeM?xB z_(7~bG1cPtgI@>^4fibx|K9ks2~P{@z9qq*y z(rcSyn>Q&48Ui;w$)ycm0(@x9{XfAVBlIH&}wI9E` z8#SLKT)au`S22Z+FlX4ByR#53eAte(=zdlRS5Z;z90T!VTu%VEUK>34rj5Uq<)Qj{ z4fwYKQ$_%c!%ecqT>0z~V{6XXQiEdC4~*1dp!wMpT6fK!jny;+DMo7X z&@LM~zyChm<5&(2{Vn7k{W;ZOh@;WJf@x?fOU8w!1J}`ud$j&P%zXzyR7cnLuApKC zdskFctgwI-D~l{H3W^GL1w^nb3Rn_r0A;gkG|?C}v80+9qlvwXy~P^4#u}qyVu`)+ zpL1sB&b_;<^1h$>{%`bNX3u@j^geUWOmXC%!B>-SSmnjJ8SVwllihSe0?8WUZqbv3 zfs|V!n&Y1&T^UTu%*>X8+H2rI(3 z7`PPl2@vn{E+jS7Y)!jsPS|Y@x|>!Eq~pxygkX1b(C#!3(fw!zFeidHLN+L;pe2B0 zf286wRJR+9BAG_O;VBYl9X7v>$o4V3y~y@8yfLYG|0iVG#7&(L#Dof4slRL5%{{dR zTnoy&HOp=TC_vkm3OCv)`q|)TnaIpXbP1|!DBP9GB>q6;M%eIX8*i?StuFYArwyD* z#?6OpG4RHc;H-;;uQgG|E+NY zMi+S4(g@B|_0To3x!&8EQ3GpB z`)~@42=r<$d5etbrE!^saiwrBY%rYk*gRtaD)+GI9j5J!Ldf-<;n8cxb&zvmF>%r- zbFQ(YLYJ^*7UJUi&ZM?856)GHxUlKQX0x9A71hz}dJ0DPHJ?*(bmgQEhBw9#4O?a* zzd*kfqX0%TZD-3YqQ$JAVV?gcZD%HOMI61x>WCp6b9wxqY?%cMCC&`d;8KisyvCMU zMCdjw@8!>yS=37(gdu*>KhYA3UigKY)z~r%)d21pVzho?{yOPJyw)dN`c<{ef^7>J z!jSC)dNWxHxv+pb(%k5a{n!x6=QtPs!E}I0ke>d~i&3H_fnzqXF-Fkr6P;u>r9N?`{Dw|eQ^*qn^2424gtE=u<&;5-0R1Y1}z_=j-* z0e(c_udeX72Yg(~ao8X*oK_d{1E?B*00yppCWA9;!Ubw?JKYDktVLJt;G(3d! z(dzl~0(um*N)xbU0)y=W;erBr<3nVc)ms3wfa8?>zyie}^v3l21u%Q;aQ6Ga=Kyop z78j`1fsF1sL;F_&+dwdizm2s@i!nbM0>)&E^V8~;!by5J!2H5-*hx}+{rtt$4k$WZ zJUplmtSM_(RsJ?sM^{$^9B2=i;h4Z+s>4I>1@L36L}jZY8zC}BFhXFIcm()2W)$|u zL=2#3L z&V#)CwaZ=@h;@Lu%W+sv9nF`pc-FwesWRlRuSQKDjg;XYE?rNK75>_;%3(E2cHo{Z z4y)}b2RJWZZN6cA#{q7cjlXd3il#kq2V6E_F5BR2{l%{FA;*A~493?Mhw0^lg;ix( zy7*|?0}Nj=z%}PskuF{atv)7qz;yu3a2uShza;^e$uVFh^SbcOae(vk_roA528;XW zHaPXX)NXIQ4KT3%`!uqN39Q}zy#$Wb0PXhgC2*7tkm`=yzn8$#TA+j7c80~+jgeUG z^{a>1d%~w1@X%_mQ7+OJz5a3t_uz3R(UzbJ42y5i%2&;dD1y(YIa`!zZ3POY>!Xq#%+QS?EdXh>BuD}V`MW)4wWf0ftAA_f6 zYc(@miVP8KD^{CXQ*>AeBp<;bTvD zoOKEC#?tFdC3zy*Cc~SR94pvZ$(aQ#VyA?@Y4c zT#A){cd#*<0c_}xv#yy!>!Q$-z&3@xrYT=hV+V6(8rYiB*VSO_M7GUfV~y8Eu(28_ zOSYm1ED*~!D3mz~^$az`xMp|&oRupJX{~b2Xbcp(%$ePEjb#P>g|cGYjLT)9(h4#= z6pON}EDt+FgZjIr6^+cyP4m9#3{E7?V9sJ$eE|HZp9YmgZ6`8Pu{AJR2Ya|diHP6| zzL1VB2bDe+0905r3o{u#=e>d1a?^0kNLOK#b9je!dpC2!5$<^ED6_RSl)Yfk;$?bb z&x{LsDt0J?8VyGLvhU1uqlYW)47mqd#vY~if~_!85SH*hewgYU8 z;}qCfp~pg+1&_1tA-q|^#X`!y;#nK^6$`16aHuP664}DR#tL6Qu(6^(9&D^=Vj(pW z4h!idvMmFfszAyn-)i!PE4f3hW@m~$U+~oL1MOIFpBmfBw2%{WEI_jr*>khPkCpW; zg9ZtF%b-C5-!f>Bz_$+?7}jpkAd@1f1oQ~d``O%ESKEwAor-Jv2TKcD&Ce+ccVT26 z1C?Pp`RG;*>i#N0N-)pd!Nx`?I2~a$?66gV6)WQI*eHM=q}{Lt4vYT0iW$!F+drUz z_kgu;&`iavR5)*ru`U#5L})MyP{9?~;8jyR^#mJBa~qw6qtV-BP$vgE&`5hOIM8l4-o@IUmG$pC!&-jocvLs#jLVDR(^5U4 zse=86XXJ{};_Q+BBp1RGX}KM4xq!`zYX)8@ZrKxItqozF{u9Q|l6J&wiM#=$l1rB7 zxzND=9%;EQdSavNmg1TFMw^Yfr=U+YhC_#*dnosCdai!LwVYl_GbpCaKdO7Pv!!P@ z?}PKG>Pw~bFnn6G%I4g|N>A^)#TA@4Fz4${3(JL%>96#b-4p(Zuw1%1o4cUsTtwnj zAVND?8g)KGfQ(tr9-xXbcW2N)P)l_>gArj(+zXocGJXaYbNaZukl^2<)fx!{D5i1@%LoqQsCQz;6M84t zsb9W?o=MRX<~scYz<}O6rcKj4t=DNNmz3UIR~wYB)1p&?&cSdD`Vm!k1m0wAM{o4I zbK%}frhN>0!7Vvnds?}}2OV7nbaOe_47oR#z#ra32xVqB(}4z_hAQeAP0(6wOC3f% zoyAx_)G{1uJaZW;c$6lza5>R7P=*HI9fub(!ZyI8i)%uy1^TS4r(UQUTAw161-LY{yu5;EEgpLWzBg|>QHjQj^z&4$1srhuekI07C*E08xf{lgXiemc*Z2bv`trQDO zEwE(~4K$mR`iTwi0S#AlL? z4rGuxoT*)O$8PXVs|X5GS7WGeP*Ko-7>fd*C%jve4PO71LAT1mqo-4<581rO6V~UhztJY$zVJp;bGy9A{)OFRmv=5N0uko0EB^$C1)_8eaMD^dXsU3 zkBRWGOzKZIB}yQg6>aL+&KRLD(Z79E>`SPEXfT=OX>#q^ z`Xvg+UB{xoiBs}xxU^^Mw<{RI)g3(oQve?6msa0a90I`LrZ4lWI(MfaP$if4Y<(RC zBe6OXv!>QByJW0cbkdA1&B4ruUfJ@fWUUM8^Rang5% zH>OK;xgNRlY`r*_R9NA{bEasDz~iLHJrAt6tBaQJBhS{yD;VL|I380RaXIO62Ly-Y z9S*-}E%j}sD;UA`5HM(P>fxlvWhG$L-Kvx1BG1-82MU^EN(iyZMpGOfnetdRk)Uyd5VC{`=k8!%Ai1z?NPSyE z`%ejlOPr1^NnF^9p=+q6OX}OI$Wy+g!u6FNKwwJ2tuqQnaCvgyaqQ=$$NiV;V5@aFZMW37)kwj(^Kyu1)zFlM zN1GZ_-_}6|Be-623YI=6J?1qA=hGVni%Wf5PCT8<=>*p-z@Wj@V+S2DHMTS>c1-Hq znvVc5gwY&yr~p(cchN3z(^{r)OMO_BFvMSprw{gKQZnTE!KhfNZ>xq1!y+`D$Ey-? z1;QI^B^s%3YqkobJ+e?4a87!x(P(=5|G0ta+fpBoAPjvM`W>*Bl_C73<*6X4Z!3d` z5HVW6suCBrZ)i|5gz4KNzi<=@hA^5mtOiskJ+`H2P{xDl+afMsMkNec9O@d^Wpoo?@4`Ijr4rEwdfmc~E7i{BwLImSJ0NLK$3+AzpHB0W{K9X|?83ak&aXCh6qYW`Z3uJX zkc8wh>=(ZC^=s!g!JPkgXlc(7d-h6SXz27_t|P>@C#hAFN|4gB^>!-W)VMTKEp zyX?4dbz2yQnW>>TI(~#&A=Jl@N`gmp+=i<-Nf-vHCCANl#UrQ>(1pZ=#YUPUWBZL5 zHj1BD8jS+5=pKBh^MK@zqdU-*A#XRr3Ag0YCg~y3RJvqTtPUiol&>(BhEr#WLt;~v z!%@;rG5D7V(gLChKfBA4Vvri&&!-QZmt)(?OvFm@s2d(`BbZ|;Ed|IzWbcS7F!mpX z+ff|>W(#?m5dIYld_Q|h>aZpS}RhA4IVZMbpG1nNy$lH_#pGgM(RrmbT?b| zFZ4yCWs)Vt4@GUmDg`dmbtn!XtmUYbAX(xFG`aot zb!slKjtbQ#EXp7k5#Z_RnN*RZKDwl2~qQH~wrh{!Sq6tX18CvcS~ zR7xQZQW#DXH6+VWN)V)#ZM1j-1LiefG(3*b%qL#+;WE;g=&(SLol72+IOab%W!Ko7 zT}DdULfGh~2DE25zCoj&$uf%l`+q}r?h1H|vU9~*Q>nNHwT#fLh-b;5U$k*6%+?i)Hs7B#2#2SQHO)!L`p&hU14W z{A~_hz)$J~_k`g%h+UEr76?=`{@fE5g+b5hjH|Xtc-V~u;2g+V_XWJM|8&-U18>AS(~Utm|8S-Y6WCW;)$0uVOZ+w%De)I2 zVxX1y%MT7v`e-En+CjqYOU=&`P9^TgPbjdvw^ECwkN4II)Eh(qaVq1iYY%T0aLhZL zs5sMMI-H<5(>5N9Ogj8#Hcf57Z1}g=b;LLV|2pZh4qy$ve|pKSH;Dj_0t^~VN+&(m z2;>T@U4E!M%s&n&X#S@nfIXNq)t>Nvvn(O1 zf^sNID2XaRso%2ql*k}in4H!})jN2*OT+B!?eFJDAMhe&f3o2T?A8?d7?_Mc;K}g+ zt#5#fmes8^wloc30nUhva9}W(>13-RAi$R>?1i`(zznp*`Kz6yc5OUhKC#33YD5*$ zz3%|C$rfjGf^#?EjsWIUTVx$kz*NOWJTTZ|F@JqDS7~E+;|Z83TU?O8I{9?jfa?yJO1QiS#swbc zo>pZSHmZXFGl}D*zl}9VzcKx+fLX+GGT*dUP$O;?VD{PK`~x)+#xQL8IXOv?7;?YYLdocDTSGV&pHx4FpW4ElzVEIMY`>7ce_HPNs{G z=BjGUk3)cYWQX(C9QpM^|DlWa;)@v4JwMIae(c(U0MpS9=dU?Rj_KSJFvB@cNf)?z zSe<}~%LL3kTUamK+QpX($jDOFi&i8jkOZBly5K)sRIuhC44qFeN(;x zrn4-1! zQ_~I?;H?fJrgKBUgm9b^UqgUK1O;)O0W-)J7pQFzFkL19W}Y2Rd*U2%KLKW+EzVyn z;eogdfO%qvv-h_s1hNhW6pRuNt+$jPO#zd{aWegUGz9_kBN;HC+2VpU#gwFPzXZ%t zTO4$3-V_q{!u&V~m8V0zf zfT@TP0)x#y!)YZ(f`PsPFwZy+N7KO|f#T%{7L~zrRRgvI+TfM|7!02yi4p9Vqd5j~ zXlU-}6BNLHu{V~nIKa)|SWG`h?x8PC_;-vj21y?cR;$p`jA_pSn_5^i&Vk?sZfGYWfS z_*wxbh2vD=^HpaFx;G9mtL@y=6e|kf1;7-;jS?`zJ=-}y?y{8Q7y`n}kz@&$w<->B zUIuT?_@yD>JZ*4qlq^{W3{0}*7}>;;7dy!k2|TU=+DVp3;BPiSY=l%dj7#7N2^8lp znI;0mIlTWhV?KOm=P%V~3~5zkB7A~Xjc_Yl$MA(?&3IjEst+6(griuwN5I|)4rAk7 zU2}OXNRY5|^G4&kVc1=B|)M>8wfTQ+i$^k5+1fj!8lecU)dT(mrm+c3fGJ!@SU#Ig+p+eSMf*s z7(Ayw1Fe?BH{cIj>q$ooL>ey7R^(}Zhr@Kr0rS+MW=t_FsG5KTf~%qNbR{KLBF}kt z&o%B-DzQ$V;HFC*ExzNY4Vv%bJRKZ`%`qGH0fs z+d2CB0^Tf(oT2_QT1Bui4qW%nd zEZu;LeG$75n)%cMexE0rjZbhYnt5g^VAzM%VK!5VfezuIk0pjZ6O;?ar^p8(M_J%t zkt7c7&B;tSA`;b}oPtZzBdzh}@%nZ+(92_mR~g?ju(SFoApylIN}TP-AFUiG2B|OE zAX5ZR3scY{u=+kT=0L!WWd z^p@sT0=3O6^HI~tqH7F}(YZiAP>v}9d;|RV{|tWdKZ9SAaMc3qTT1EW*D$@llwOe> z&_J@TBGj^tr4>q?xv$5L)ySo=plZS8=(T{dK*cC>lc4N`Cl;%>WauVxArBcUfqBYM z2G4VbN_d_!RKoL=p%Q*cCRpAx6niEi#V9*4lwW*ZvvW;yye>mi0g}fIMQENgbUS&S zhYXd#JY^_@=Q%?qJWm-a;d#nX3BN?qweJ$%*pK}28m8B0=yl2Qx(xjc8vQ(GC_?j` zp?k^eJY=W@<|#uNJkJ>_;d#nX3C~l8O86z2(ppLDL)LL!L7F2S~8 z7mBdDMOsTnSW18tR%&UKwgovR@DwDX%r4eKMvF@%zzTr8Nw|#yw)ERf;wt^AQ(93R zVOY&>6ig8wkbSEJp0d8$Mrw);QbH|zBP=^$zF@Tc3i1;mojj&|xD|YlRK_Z~G*&TM zwy_kj>^5SP$HvZU(ISSjkZA2u&g^XiIdTUieU0faQzm$rGXF{q25W(|A!5%HrJz9i zCM2ha0fa=aJGTnG?NXkVvcXPkloJ9rHaO`CHZ0%HBzM6^NFT!Q^F+f5%Pq1U zf_DztFxt1tRto%Qd4eNk<}x0gWaB56Ph5ta_1BRoQg_N|IViGVD;}W72_MK2p=-wU z7bz2(nli7Y#(}kfYvwEPDBN0326-znu?&G>CyY#KuGE6hM~K9v%q@Fzy4eLXvj;>i zr=|TQXgqi#W(N)?K_VNOusfuUD3;m}BsWC!&z?pS;l@RgQ}8f7w||kX54>5n;P98t zOFshJ-}LnxbD*V~Rr5|67C3VutG3Vj|hx;a!t#=s|6=;nLQBVlenC;rZ`_ zh9PT8E?_dXAe%e9jby`+g_7;R3E6t$gx7y%Fl61}VQGf#nqKD)?^v>7$gn!-p&0*X z2Gb1Nk^fnmjUpE?&E6xMJG^l@go!&%B-?)zvR%Xp*NzPvp@VJp!2=RvVQXCnqCmBq zf-q3Gp0RyKy*F;6e!l)|{df9h`jz@M`t|xv`mOry`d#|H`n&pjdi4f6#!`ELg2lU0 z-}uyc_=W~6g%-oANuxd~DFndpb{M2EbE*LQi}97B1zIto3kt@a{L|_F;*|UvF0Gi* zKMF>0EoNT5QA`M{EgC5%)EzwmQxF~*LamrkoPrU4#j&K~VnVw)f3f?8mq{_9Bn2b5 z2BRln3c=%~$IW+K*l#<{_ox&T8lhkW*GTS8VdBDd4ou&RFRQvpF(Gl)35p4^9I6Bu zG`PCyq^}QebjEb@FApguR2?X2iU1eOvtN0^#Bj+Aip%ByYlajPI<8;@*AAZH#fU2# z-dIEDPkQAc#f0`L7{N7;r)qKHDhqE6;moTOv!s|%x`Gj0K|J4Ky;hZ9SfZquP)h|P zQlky0V6Bw7j3r8n2}LOw!L^(vC22%)(qoDupc5(`?A8EOyn9zO& zBe+grwNe?@2R5rSIe)fYD z6I!WY1XnuGLBz{k#W6%pK(e>4HuRTDJHZ)!3ZwY#DE4%g*LyWn2@W2 z5nOoC6-{M$v|LO~2)~JIX)8k-vSL!7mlhl+Xt|`AkU_x+u2!5<)sBma387!%3Px}x zAQ=o!3AJT|i3#C1ad@qolFQ|JUbqt%_P~00u-$Mc8~o5!RWR1vBsycj?W#j3G z@8y?bLM0T8;M&FAsX<(#Y~(tHb!B2g=+^-SBe<6F9IQ!PSn@IIST>lL5d6@sR4^hn zwsVRHe3c~%%Z3ya+N)p$S5uzLwTMgIZb&g9qk<7!(VSA-j*E#20a=IYIMCEq%7zdJ ztpikT*tJ8}$^fzZ8t%5(1*wbIGz1UpDhpeTC}^PmTJDU!U@PZ$Mn4Y_xiIwNC?u>vIJo z{OZATupx1&%SJSM>{qi_i^S09CI2+s>&;)=sJJPDU? zO!rl|QWT5`;fI`pCCf=~f;XDtRj0i0Q@Ca*7{LW9!pSs-x04>r6-G4Lzi{ow3YWN$ zu`z^@IZ%_AF@NG}0xUQ-3SND0oWH__*J`5iSGX>4zXE{jq{jmwIEL8Wtwq@Yh3l$< z5q_;jN5BNaqZM-vRJgVff@8?eJ=X;hm#8WDDM;bMFry(17l2_Dta(m)9J!(S?)d6L zO^6Ex1sP4JBMkkh3o${{6doqniK&Fbu}u}fyj2*j=xHsi45=zA428J+X z>%=409DX_JF-=5Fn=5{a%i$5jisVt^Wiw9}Li8bd<(@|^6t2@M4C9)@oo)$Vw0^Zz zxTdQxj4PMB6HHuK%YQp8cirXTE9XSuKR>w7;P?NeUzfYaaAkyGZ7c%GByuj z2%{;7VL)}#i*nj!PS+t}k_(#$FoYqSiHEs0{BqJ`3yh|2yX`lT0`)T~F+Q~sJGG1& zL0DZ5;9Q7cF}=s@prpKyR&E%^V2AmJ=LNzTW|m-4D8uczHrn~VmIaG=nL817T;JJY ztPHB+`ofN~(k_HMHI$B>jN)@Y!g6c654N|&ANFs^o(I(C?rcD_eyC=P`!xR?U^jV2vjRm*d-HN)8W zw9#A!1En*#aDxzMWx^SW2@c64QsN!b``Xc^G#?3Ww8Bf!DTfug45X_iL1;abAP$18 zm4a2=;1QBytEN`5b~G$Wc0?>Xc0>{gkyMp@h!9Z?36GBDl7r|eNz|&jP)gOF3bLrW z_>`fB*!VthMLQ_`PaB$+lGryEyq2zwSDyjHY$ApfyO>F$Dr%Cbjhmz+SVm6LZDJ=sAcHD; z@`FwMcsn<*WE0V@?i3AyO`*Qv#&&Qk~gEM$HGH1I%aW0CDH1I-$T9C^wFB zPLj2um2_=jC0*tm(q#DU5D9&BN)#YX4Ol~P14$u5Bc%{+Ya$ObILaFsPJq%PYnlqA z)IJqXRxlONj)*SGilsu@5fQ1%02NeCRia062JdVltf3GFJhH(ch1_KFiGcEEDb0HV zBCsS=c^!)y2tclUMB;EMR{qvIS^a_nf=G0bdl+-rmbEs`P7imK7#Y#A7S)#F1j1*g4ygm5hY)5#VGvXttWqQCtBGu9T@ z*q2Y(7#eXi0P~F_^trvu`SNeU>Ck3FuZf;Lp&wEzFJv> z^5Cx@U?OaBevNTfq!fRtrcLt;y8>Bg-@*Raik~wy~r_~;V`o9O@tx3Xw* z1UJ{_+u+_P`_UK}nCwS)vWY{){8S4&afh*%z#bZ)=A5w>hGnD^`-!eqy%XVIQr(oB95_$)qaNK zaRo`D!;&u&&YGd!CETLp_m9dWx9LyyX(h~7pBumq$CAQG#-*q@6NjhwNzXZ2u=$IF zM=n9Q!LK(NDf6YfLr+dEUJNg?64?7SOPd2RNt;vRMY#*{k!MhFFy23kwY{~GB zB-?0s_az&=$Y8_&CWG;*3lBfe)6vuc)U}4Shu>^%R`ALcViXLU+F%96eF7GKT#sib zG;m=H-O8ImSKegYUh@&@QSdO|u?p%*tgI8+F!d72hM3M|!_-S68@$M1C^0o`dI$Cq z-ZZ9y^r7ge1A=X@+PJHKfE^=+L12NyC1RE|>=4k%L{Pqj+MLq*3`|T&#lt9g5G6h} zb;N)^X{m`RIvBaZ)qF|AbfBau7EY|--=XoTX(JMKbsKm!4s2?S?~~9sF-bip!^mil zny^fGm&Z|pc-g|DA-D6i$5C1;7{KKd#!DVYX`o;P zS4%*n!G23}VZ7vV6cZs3Be=fc@xpFIa$&sWag?tVjNrl}GHBRw6fEi(9MrffkE1kI zFoJ78r(loC{6a#r(-SAk<0wZIjNnS<6m}e?25_M9UKsO89!C*Jaf<5%SAL#8>^KUJ z5z!gr&*m6*90ji5Oo~nDgHFL!rS5$BdJ_F+&6SgWBK*RfGhJ$RSsq8pQe()D@kfIl zjXZ#X+9&046gKbS7|pVLN#erTp{Wqte*imqZ*d&O8-8J%@u;Qm2zeak znhL{`VIZeqPwAwOgEyA`%*#7Ik;hSn0|gCX$R-+U9I>-_A^DFYJ}2dI6f8Gr2&0J? zJB}g-Mv?alPGZMV)LT)6A^!dJW(T3=w%5y2li;E~%sDhi*&jMAt=$m89B|TOUZH8e z_5Nyh97Vk$LKsa5aT{84JxMB3kR3-ME|$>^KT>@sS~6G+dR4 zOQhD0RX^Wk$5Dt2dl@i<(Qs7;s*_%%;hy2++*Dd?`Rsu(8m=nDB~l~zyCv_l<0#}8 zpF0so!^MuHVC#YA#rT)rDy_AFj7k`?_Tia=<=RP)H5$!;Ms9zylJ0nWC|YDCU|Gq0 zY)3JWOYFrk)9o;LIf5_@lVe9Q+fgVxmb+CQ(RVrQje{i&A+d z0Wc;=a;&)$*L-bOdF93ivXU-MIrx!@Yr7VTU`I5HlA{mca;)NTEH0a>mr$igaye6U zMRJK!#L#vH5CX$V%2FYQk4D*y8`m=hH=~2DF9^3Rp9Dbuw zj|~~c{{644*V){1iapL?s6~@lrKH+Q>q9;ol`hmXp#1Mejm6mbSeIA6^&mo6A^9Rc?-$71h{>qEBd zFW6gbuyK#peS#Xp7in2lPu!N!3+!Z{($J1F#GIx95k)!4EW8Y~(COJ3l-_2*ijvz;#Y} z)BNzZf)QLe)<%QnUizh-AL3XNjcR_#2yYZu5Qop?{O~E~!bEq{V@rT0xXgnTIX}#0 zM93Hs!V#Rp=7(x7IX@h&U<6k!PQekL_UN0OA7XVtLm18I5UY(GiOxS81Zo!bK*KR5 za-bm$*<$G}=7(55vDmHZ)T)7;A10|V+R;3lA7c8W!Q)MAen{h2K0G9hCWLH$D8}Xg z+$}ng%@2u-cV2`cS7*^1=YAM3(Hsrk)$%*m<2fF`PUc+rhgGCqb`;^3#C&OoX=X=h zqoFt&K~gWSLKTDLm%|C05g^ojyTKpQ_~4IP2knSXqngxa42PUZl4B^Oz({9^Dg^dp zE*U!8ffBM4O+w^&NEzDz%60@KNuq&co02%nNggyn4s*QO5Qg5&&fY?!sc+-Ps!>ik zO4lP$rH)1sem+>O6oa@EfDyO#sBj7f zEr`Qg3QF-}s^EMz3dRUm2Qba-a2f@7go^@9q8%`K3p5s69E|D3 zCQd?sxU?s6Xum`q^mFkEVgm<6j+Mm*oqO%NUSX}x;p)B%gYa*U&aLPP7;IbRh*>*2 zpQ&KPc=T&d!G=_FX?JgaP%wh49(n|(06daQJ399!gnD%D%iY1&QF3W_Z&05C8aX=e z!6{gfB$sygCSJja5T*YBZ`aMy%Fn|Y;-RC z((c~4bH7lSm{m9J=sXyF#GJ#s-W-q4oiyWYHad3&4m8>8{SL~}IivA=3F*g4PGX~T z%oz*=&IIJ{%>@;Pg%DdkH0XaM8|;9!ox&qa!CTWV<)S#n+Swqv66*A#c8WQm1q#+r1$!Y_7o&M#IH+Z$t=j zH$b&}!*?DCL;Nr4Ep~52!y8tk=6*J^c08N9!@2Me%Xh6n0MfB!3d1l(czH%Dql^^* zg|gF*Vzs0Etf4rZanX!I!Zw4?a>62KT$)B-wHB|Y8(XR8W9l#AVp7Hz($(L9OFd(I z-9df_oZ-s-R@(J;3V*n zrhks;I8#*9VSvHrsJIMn^8sdvaEY;;Aink7sv$5iP_Bbxs|R-!Ko4G@7YKDP%Sm>B z{*@V`!T#K8WvB>3&>ZUo%@831>HuLKH^Im5tkO{3;W#yn+Jd2gNw>pkbuFWNa{%+B zEzZHZ^)|%t(GS*WM>8SpFNKIbSjo^#$RFEeY48`Wm&bGW&}m2O*4TEXag5-0v~G?5 zPH=#;J)en?EF0V#*R63Cm5ug2$oAS9i3HZt0PSWZ5{RSHH>_JrU>yR&D^EtW+_qrs zE!k2qjzK)(VMAhfvSBe}G+LDD4A*mG8;wlD@G>HPYQ7;6J;tt!jeN1w(CdZ{OASd( z8U|;Rz-CNJg`4k6SM*d@JM`t>9^8HpexSi(D+gxU!R>NFAVv(aHgU?E2DjT4jNlT3 zz&8zU#UM~FJx}58ylHSdO~DAiu&ANIl-Di?%cW@j`nv-#r)_b*S|Jr|>}~_b8CxJQGQJw;NIPnI zz_jN$>=-DW1GF+F*uZuJ%phA_pg}XpKwKJNrr6=M_dP8J+)Tju@OB2H!}3>q&r}%D zM+0UH$6*6QIA3l0;n}J4fO*bwN__pavLZDA=PFu6u%jXO{O#{AGXO4(V`aJ+_#BS$ z?t?#3fT@7(C>Z=h?iu`eQ%Pi9FgP#;KJLMm6AX6Q!LPYL6kY!@0pd zCYo!o=m2&$;O=oOrXQ`k8~io#hy%JSEHw3oC z_XUmtD;XM-`WiIpf`#V_;7URpghqtVcGVq=lQ+i@5MGYPq!>-mo2D_2aG0&8Jm9cg zw$B3&i(ThD;4mJsdB9=k*Dnt^jK`on;ILe#=fY|7&b}b}uyas5uYte~5mw@+M z!YF}n38MtQC5#fN4WlDjAcn;jX@V*~;+}#Cx~Bj{h^&#`X1J=rligQMK{K{HUN2KYak(nkSh?{7TLwI; zQf@7@$Ji5FY0aT8EYYkOR|1<&p#x3l1;eeupvYT~r?Jou%EDgBfp zU?BYkO3_nWfhd@3<`;lihYGVv7HrRCj2W7UX<_cJUADQF2n&YmnWK;d_WtX!c$qCs zMRiUBqBJD4bvnAh63f~ySXj)$5+y8Mg(Xf{`fGCE+Af(ss72GF!Rg8HIP3bsdkWc7 z;GIP_Of3u9FxnrIZ92TIWSax;sbpIO?`dRP3U5R>>sG+~BeJcB_YAVlgm+$y%UeKh zZ~0#SE#KYW^4;?--@RY+9n%U6VBj0R<8UqbHQ#3g9ft+x*L=r#cZP@UI$~lQNFAdH6QU#``xX-(DyV2p9G#jt6y*+6bP0(g zQnm7hO{eQy7+bfA>@-vVvHlbNEd6Z#r}{bn>*}r-@+8CY=<62ozELplI#zgBa!P&; zmv)DGy@C;3SaHzc+(Y`M-J!-xgGMgm33Z_bfhxJQJJdp5sNA96!+pmbmt1m(S{$WA zzvTJRlbj1j`;trUPzxaf1OTNPeOC2biKt2#xp?433DM^a1cjXZ)Ntw3hOPSYgo=Q@BJe z#KE1Dz9hVnD`>BI01Phw8fu=M(tZX0zB|D{j;d})nxDIj(4&$8k z`{0eGq}HVumDvt8t_cbmO{wl0hahOm!UGG};1T+IXvjzDQr$InV`vCNHmvz*%E2RL z8IQlZIz-ABqVH%3qghO*##%2rrq2Sd{v_oK8IQU_FUQjd$F@?I@#${{H>vKrstUuB z;alzy?%in5JV-GG5bDn#0wx_=)_2jbk*3(JtfT_+Cm|qKu|WzR(AGKovDS+S4Xj zZl!!-^wq(YnYwFQ#`i@Yt`b`lFL$8IGY@!r!JR@#Tz<%-)49W=^{YBkl(QUNeyUo7 zsk%Tq_nEqD;_@dZ9bq(FHHk|MLQwX!rVJrAU0?{K;qm~g zJgq)*DKdK~d132O}mJGWSgs3QURD?wj0`v)St-Uu8% zDR`!?(WZ8t!rQmQy+fj?_Yt)Rj_i^|um}-fH2}WJ13V)VnJ8;&pA^+zr;Qvi{*;Mh zzhTLo6N&0AMRRrGQO3S~MV`fWSaenI{|@)Q}4BS8`wy5erU;UMq0{dIr-m7Qw8AU+Oa zzTz1CH)z3b@_qrEY}x^AtQF8f+)KceFn#xN4*Rh4u6gU zreY!XTfqftl0~-&J~sl)A&$e*AnuIX?oi?^*attV4DEOt>~}na0hi3N=&z$4RE%GS z1NUtG#bo<14>)vhW*%{K@`(Gw0S>hMY0??P_mvIqjXQfdXk|NlCbGSDXHNpdG(fx4 ze-em=L$x_#tL0Au%@Szr%n>DZ_G6wFB&)nyl@g0E7*7fV~PiAgfL-RDOG_Wmp z2<~4ErCqBVNMM)O!X{O?g*HBLFKVdS+TIOZNvje{cfS%a!gAkeIgOXMT3W-$ZK-D5 z?ZFMG-fSO@ZlA{+YrV|YNzC7EsWsuMPeQ}a7hHFr&HS`Zq3?TwamhqScg}N{c3?DF zR9k_Kr3r3cVU=*EJ&QJETMO^DWTQOz_Y$J~n-T&({s##`XvYabeMp`XBEmsJ;A*g{ z=*Z+RFOuICcgviuE_iEjunTH9RBxFn*@butr(w45+Oi;CSfxa7C6xTlrrWQ6j@v@*7% zC^vyOD=jU-#!5>Mu(hYJL*X4ow)f!Ofoyz(vy~KD|5-F}n}J0m8Eh;XV{M`#BO$ZA7Hmd?mQ1XO6}7vGtbXqSH=x?5??nBU zbrlC2fvqDvycnssN|n-4hn$A{r@?K=Rva~mZBFiXunW?-qlV)R->E)1_>S(Q8}1IiAqm~ZMIpA!(ur)|@D3y!z8MYkgKy@5EtJj6dE_63uBu?p5g=liz(9p9(Jf2Q&z7_9gzk) zJVqpvf=JloiBHkN&JJiP8kX80wtYG@@aYsC(^)+##WeW04_W_>o`AtYpxj%~9MlC>X(2mHUo4 z;iSj0DTei??(0+XkhO<`5nO(pfZHep8-vrk^5Tthe@3jP%l#QI&gDv6I3z%> zk*mhlkoz-2izVuRWKqQ0i3V$#lYSArF*O^NSzKD~&tRv4hA^7-$Pz%6a)(=7&evl5 zGq{RLEbt->{Yd5{ERQVZF$~k@Unnd0XGWRFdD9M z8m{C1qq?&F8CnU(<`xWL$R?z3vA)W9bzOVy46DJ8kL`EjWdogH`F_cc!l$F;3&Xr` zhY6;y?8Pv@+EEVJabaI44C7j*!JxW0zO_j(h7r4YNXmy=?~>C}`U_`xEWXmXgCFr) zJYkqSS>h-BWt0telyB@Pb2OCKt%ky?h=Lmlj>~m9n*~a-m_t$u_G?~QwQX6x6!R z7Lepe*4H}t%D55+C&rIZGjTkl=T*Jo8x|>5;ZYKXEg*J+#Y`w|m^3Ovt7wyQBa|eo zvO*GRB@~v=c<|-oni#P#zvTj(md?@$#~>i(nrcud0*y)Rs5D+-3V&3wVpv#7^w#wm zJZx0bfRz4XdG2kia|UlezaUzki!0oBaxp5sV`?#NYWRbEQOdMq%fGTZrxkxVXIKQOW+@R!wOyoboqE@9SyQD_q3}^{?L9@g)TIj4?8gk zgwrn0>DmFkKVa6_;P?iLj^)BXp^yBg$e}nYQX))v6wvQo>;sIwdS*iIEVV` zeT~j0%XVY-t@0*IwlVu=apR=RFCbCFtWyh{Arr!!B0e@VL;>TZEA+{CYDqH;1Wm4M zj)XZ){n!kVG8(c?mi_2VsAX^VjpDTsXwArnPJ}pxq7(R4I1%ETA)GiG;*>#7_=dQI z8nzi(V2qY+MsUVB=@JVJb14j6VhG_<7fMi^$jU%GVFa9@e1{Az!9F#WO-nkmg@1uXf^4K)<|d9y@n&<>APH9 z_ZiMuOgc-Xa|B3PS)ScMur)?!?d5Dal6|9mRssCumKCPY8ksMvvy38%{< z4A&nu>@yj*8IH9u=3X|st}*3?=l+^~$px&DWWDTGXs`THzR+H1|2Yi)#t`O;OQ9o1 ziwXujq0oh(8`+nEC)9Ana2Dej<7~Fv6mbl-_QFVpvIrFjwVcVm>6X<_A8I+9eaj`Q zbH325-cGQ22cyXHp%7uC&FYMCzd4#Gx$D#qAnnYSaZg;U zLG*vKT#T@!-8H7~eqyqY(-~b48^J$H^8=xlaXL#c3XV1A38i_cMH6Tu-}>KIezHrI@cU#o%%3K<;S+ z*J{DK5Z5)%zTpW6!PDqsI`8eqtk7b*kgU=H8ZT4*(YxdSsdryu+(RwyxSOR(cw9GQ zsarrvXSS^<_v0)lt$K=^)u==*!m{0j@{3eQa`Mw3mIMV@0)#p9owJ6D54fbta?L?r ziB^>77334-)wpDnH4&=lnu74O*TbtzKA4@hcY;?JXL!Zthu5eA@S0FC%cRS`R6Z+G zpAF4Zc2-P2D5;lRpq+vLS&>emSuxJW>?=?ydgV7}Uv)DTIv$#p1`W);?8`2ph0cT) zdK#KFuAs&A#1i>}iUp>P$+F92$i86lHEtM?VV+wkiS`V}6 zym?yW6S4PeH9fILzOZa}-EWD}S@z=}XJhW}oVCygmS)KK7YE>|4 zOqN94nbcOI+e%8a9PA=Dh9fL{NV1o=^2T+zErLI|?aNLN~;g+WyI^smQmCyX85{LGD1^-ASD}mprGOnJ45VspKw%(sYfCC`Pja^>dD@de zT-(;IKzkC%-R^h=VaK{|_ce4ulsSDzKJ%pKsQP-uMP5&P?ZB2EB@CQ(b>Ll-Z1>^q zLN+`V%xoyp!EE&uTXV%0rPvY_+epP`QEcBSwyc3IJ&wD4mD%XS3Z+6*lAUS<7W(># zVPW0Ro;7l@3~qP(dUa3Js8UA)4<|)$8C>+H-`cuAZo3dQcHim~87<2dYQ6f*iLxJ8 zdOpVTZ4txKA6H-e?A(Z#UTZH_Jo4A_%j-TJUwfcw#@G#WCp5U%dhTM6$Af3CymDXf zQuf94%+u}z5(c#EGW@GoUB4dR{F4VCrOqzab|GQ0@52}0}{r>81-M0sw z@cz71-2HkrR~+4SH#5$&{21f@JAvoctvEksdhzm2;;h9N3~upZ)fL&J%ABgx*0A}k z*YeSEJ>z2jsTFg5*3y_C`g~^Y5?uO5!oZ;YF>BnG*7NImaMht3#uCdXM=$>5=7_N+ zO8>pG-lky*y>@+H|B<15YS|V&4^{nS%6#7qCztm;>@j#!C!hC5O`h%fnfarp%h$IZ zRO!anou5?qOgdQTbo|Wkt3QwXaje;A;_Y6&dS%@CIW6;MzM8eqXH`nfnbg8kbJvfb z9{*?95Z9oP2k9S#7HQ<{p7C{?yL$)po?mT2NdMi{=MBF3DE{-J{qANRUwUj&hk^aQ zqECB%=lbbaz8#hhE^=q+wWjZtin`l$!)NuLkFSz=Z}CX|@}L&o_9tZ(Z}mZi$$w8> zwQ!he$2S?{w)D0(J)Jh}Qi^+a=EBg5!QT$d?%d~xdhUcjD~_bd)jGTw(qOjt{7}=RgM~KtUhaJ4 z>Xw&ne19+K>6)~%ZKDcZmK@mTn!48%6kFujx#!2%Z{9X0rm#<3#ofBaC&!Fv5d5mv z!hQ$8s`mWJ&2OeZso`_(V%fB2Wd_B++*>uuYiY;)%bu-n?h`kq=1cSYhE5+`)V0{y zrRRc0Q-|$u)Okw9a|6mZ9o_v%NUJvaNanKOPGK7HA(MJGNPbmZvtBbRFJS?<-N+4Qxu z(xyMZ^5~*~_~^3iB`eF<@bVf}uK1Q$4byHd zu9na0dT`MnH&TbKKKaj&<>y|p9JQN6vqW2tb{KfO4%YV&TWNGpK@k+*%;p40R)UbFhUGJ5{-8bs` z*I0gOU6=X(eLbqKFLbxc%!HU9zP;GZ(kgrOgihVheA#21`>yqW}JL)=ADpR-9yp~;DPhQ(Sf78gXGG~g_tDcy!X3f*}e>TeRm)o~<=B{21S9DtZ(ZcWNw%*_}uwdrUo5}CB4XwL! zb)!OQ=W5ojuye(?Lzj)a_+9wAxW7M7`sJ^WhEM(Bc5bpSORL&%Z+5 zh(c+>rMfL@(WLyfd7nkMO#C9G$H{9S4LaHK@!W!+A6xv;`^KH?fejKf2Ysa1{93?p>jsS z7CnFZeZuX~ansk`FWV*HY?Bqmibmaau2%VO?n+(0iVuta^h@gMW?kP)ueG^)q4Q5m z%{=-(`Ot$k+cTR*HZ>5o5}oIkrgz;ER0z29BO8#VB*{J2=^VLR_jPV#gsL}Nc6{Dv7nz68a>#pyWJL{6VY2Lz3Q^&Qv z+2rcX`q zr4~H7I6S7E!R_RzA1BSPP$KqT=f=*1_I!1!Y55Y(3Vq|z?XT+}-GBD{-kb(oH!K+1 ztW4Ep)78m854(A*aPQ)iSJrFMz4D*cMm;OgyxscqiFIA8{5kierNzWrdy_hj-WSnm z;7Yg8Hxw_kd-Sa1)()x=H)eYUm+xwJTvM{tt;1BezMy2 zJ&P~?{^{HeT}OYD@vuw6h#Hl0ccjn%G;DjtoWd)AjrMNT>6-b>N1ldFL+;$q>3S=7 zw_p5Up084xjs5#f={CKtuI+oHbT7A%OQl-4uetKK>DJO8zADpx@VO)H4?GKb5VB|W z#({ULG;N=lzxuDn1!Jn7-V>QQd0^|d*P{ANYJPulpTl9br}bErp7r9ZHG8smc$As& zaq58qMLx`Eo%zehopoD#6#BwkVOi?WeM;+!e^9gDw2-d19>x@H@nBh%_~e!~KfXJ{ z*Es%@Y4>i&o;=sI#^7!NzmJVe{rkXo_cMcs`iwf1F|pvc3!h&g@dM&mhW;(z#V z!1vn=6y5b=sdM-9`-@C$^j_$K3_sJ3{QXY6+_#`=@#E)G&i$Gd<2L4OY`@@E{jMhZ z?c8-bu*L8NPduBu=MK5|XZ03k+B9GBQT>HiuRmUvey)G_<~JV)PnuP^cElsUx&vlC zb}wUm{9C?}jRrl~)L-}IZ^J!YejE6}-FNM8Yg;Xk*F`mY6jU|Ldx?O0~*33DZosJCoae{N^0mI5VIiDJXUdCK+UF+<;!uyxj z8Xe{NpssVLvy&SXem-Q)%|4~i_tyIAf>-YAGygfW^ig-Le;WHgcOSjK-NVAq=d65n`p3?}raH6D8=5rf6fdwe_%WRx@ zwSi}TbD8YfHHPfI*0NN#`TS(pJ%8_eTF|wcv+?UOt%J)A&FYoYA=c;Uw)rPM%HDLp zZ{re1ztQj4iu=4?+*dcAT&y%Wq1yIUC5tccxt#B4`=sS%CLP^>X?D#)mp^Xd+oy;} z(;Dly{9XLZUoz(w+i-nq(GkCUKK``dWFK4Zt-N$8I-@6YF{yFTc@aSjeaZ~EN z{9;GdX)XRSCbTY`n%ijZ(xJne1iXCmAntt0B~LEoERMKbX>PGWL(jRzyuUl3LBAnQ ze@m?6eB;RZJ;mzY`zlv=@MG7Y)kXet9q@eN`$?aVJ9nta;hBrR>RskcmRG5b9?N=k z*g9s``#C3@j$GL&C}2#t5(np8sXeiwq0xiymWA|hT7Tf~gAr*ZE8lB0Iv}Lvz&|^D zy!QIW#RZ}gp0_RUHmKsWzxJ0ny}4HNeLF5+=~gx*baJVZg@@iQdZym3r6=0;Ti!Qz z$>g(HH@9wiwc}dfE)zF>F?rkLyHDO99Tyqr6c?8M^5}|cfsdSjGL1U;!vB=-ppf+8 zORL_UVw|`lwzsa?mM)7%dHi%^^W2cInD|Crw|?}XYr8LBUbr84C-uSh&6X)Uo+fol zoxXB!%>A@g>(9Ihi?5yYUdF{L)-lBgW?Y#aJ9B!sp<&5gR=LlNIWaZj_k8;<|5#-G zk^CQQH1}CjV!`*RX=^G>SX=1)_m>tIYMA63=Cd++Gc>Ql+hLcRN?-TU6)B^7SzGl;m#p7P&jI7e_P@!x2hh^!t{ zqhq4~TK&xnm*ZobpWf-ZEVB2VsH#t{$Nzk$bmo`MN_80g=bjV8cDB3R`OwyS{sDV; zU-0vpcdFzE2_H{?R=nROU0iU$p`a#*A3i%CFlzhKN)2~)U(jzw&yawx+6UM9;P{sL zo92Eoy~K$!DXv?`S8jOn{hhi!gDOp3YnrjR`j(%E{<3PQ|3I&$<}PD~&f0Wr(FrEm8o|U zYWzKU-n#9UZI2pxwEDrR>Nj5>x&Qfw_-*Nt18>fcD)YxjCwuhW@bt^to|l_6`EK&; z@7vz&6LaVI9j`rSA9s8_V3>2uZiSzXD)ardiTcSarYyT&X#OXEv}oG><&2wiPWdf3 zv-WO-4%Yhln*4a;({bO9)1Pc{_^4;YabpkHT3BuVy8FvUtUB2};$c?z;Xl^Bbp4wO zmtOw3qV@b|pZqm#=kXf{yEOHzn{?udXQNVMX6j={$Hb-m6`ut&qf6mwTJmZ`8 z@MX-;ANX~4+SqKvhb2aJ@O*Nn@b-Qk4la%Tc-g@YiPuZ@b#wXYOOIcMTzJ_qb3jt{f`tl) z&0Be4o2l>N-v@X7X|H?b3y-(-2%grp(ggjngB!1|8Z>_3mlsUA-I|0JZrtL;ud6mK zIdp5p#*Dttekz$Xt@W^GTNAF$KenKkS9GOO+kZ+rGyKI&*IH#}&5!@&k7qfbuQ}AM?~?6Dmux86yI}U3q670^O^iC` z7V@>zf#O4NUut^pv$9(jeHPL8=4cZQX}& z*>&1yGf$tbdU#BqL&L_m_%-S0@@4Z^Y4CE_ zv5zw5)_DG?%Re`?OB%vc2Oc~KTLzxu@EnH4+r9AYhG!={o8egv&kA_Z z;Gr64_$O?*z`U^nBs06JE0g zFvN(X!Q&Z>4sc7Z#fH^g^DA5#3Py0@u~;;Cz{*LF$F9&8GAsPA0t#0p1b|`6fYe8l z@IacA9uFnqL8Qu40wxq7|KSJebo+noy?cCA)%8AnhKvvq8Bi2d)Io!SAY{TV@tT1o zOf=kzs8umQ2p0_`l8Hd8fF@MOF=|_FZEJ07t=g)sR;z&822cWC5pBh)m0E3y!4_MK zVAcGdXRUqqIcG9x+E+i{f8PC>b!MG)*4p>$+Bg2|f^;s_Vk|t_Htx_K*5*ZIfazgF z;VwR9TIYngY>QIU)29ve7Nj$cXuJc1rYZr40a1#JxbSlZ{ovs;Z$UaYEYNrd2APO8 z2L^FT7t{Ox*Q;*!7Nm1|HBC?J!yA<#s_dK)6{$4OJaqYKx*&bdJZzW8noJt1yER>J zmv?m`Cq&=T{QKbCX1a+*T=S}DCr9K<&^kIOwWxYgRUKzUjKT8ic?)Z*&D*EonIH0& z6S`dY0nw$0YBoS6=s=gLTA<>fE)E(a*i{qF~IJG2UKfMlN)~$gjf$`#)R_$-2U4jzO9~ zi!^@MSsggWEMYgiTx-Ag0Axv)IT&UO^7)Gx=?v+ihKKJo*-qP~{4rhNW05?z z3w$h2Cv<`D2=I-}!Z&gptA@`pSmoGhKIp1lYao?qzAtYT|5KBO@bJo^r8@w-_fXi0Oxe`9w>bWIG4PT|#g2G$N!};xcXnIL z68jh*LpL^l+9Oi&>gv}bH!Ous)(&pmD~oj`nj3N}nj6;KgnfJ1GAh<{zVK}D?kQdK zX2WqA9}4iH1Ba--FRZYo;i-yLH8!*wzkw2I`W;d!wg>jY?km@{mP(PYFf!$-r%H<2 z;obI0RqudUff*Pcx08u#TUyT{i?fnzae={Q7>f4?1*@lJe8t-tDhdNyA4 zeB{P&gMfts>kwd$iEN3OXPUpAGF8}Zwv)DE)Q82D2=cTrn4Bfe`vZOg& z9B*vtmS`^Bnm{ZKDM?`l*dJBRY_c39w`_!op?J}zmB*EY_LSr-%9oTe$x)J8l+Q$4 zeG#T^+7H&8*FL#4_FilcwpEUghdxmkOhTybbdPBwuDIbUX+AB#==rtqeMd=T%D&Yt zC6UCwb}VK1(8hB~YH#AICz*KzbF>K%jsb+_z*C(Kx*P9Np|#*SNU&{q>esg|##vpZ z4FYzY@SO^b&2`u*1I9Wi?3@kkc)>U?lqc8^fDIPxUSMj=l~03Dsvn#`dRg@3C_J8DuxxOZL(+(o>U#>J-%gu8H9nzq`pC&MDyE;&Gq8dl z-beQV4{P-0i|pKmjotju39+SM>u_SjgNPy5X}8nib?)2-28{)z7>nfXw|-ZLcJ9WP zPm#71M6;97--fVi&IxII={WPo9xz-xcm91}!V_3;t{pemPqbM(ZhGbw-%aN(AjPEc zb~@EOzwtKhxQUc${)8tWr5!guX+G)Ef1Gz+%LucgUU&jhjHjFsTOXR%UpzcYJ8t5Z zi8A4l@9a#{Fdl-btTEHM3pQc=bgwT5scsG_xaE@8h(QL0`G!38p_I!zQJA+~qdXV6 zulQHW{7#fRI#GfPsvA1UfF?##dr56H)XV#Xj3{{JdQ>MFpnY809V+=5)t-8yTCm7L9~N(fvNZlwC9# zXVRPn*Ey#@*%Ufd4yNDemVfo$1^BB0&!$YiAe%C0KHdJ7Z(BT8NZAz?Z96H@xVHnx zxMRT~T5IgtFejs+U4$u0K5)MZwapk@iK_>4(4#8m-fricGneZyI)iSEmmk z1B_RvyBnjlPG_1@>dgZ#?dJ{HPooHow>#WzKeSHQulm${-MJRy*E}Di)-@9Y6xlKt zpkx_rx~0zYO#>Dz>t3C3xhe9Mm5UZGp1%}#8`c|&$72YrAeJt{UOkrV`r4{XZNdKB z5#gB8qeex=uw)-9KI45YZe8!s3D(;g$d^*G3r0)7-gRm(kX}gMut`3)WjZ2^xh(R( z8_$cuGnttJhApM=6~u~!U>;@oza2bp8$RY~;Ts*i$A~5J@8J0~lW$aTpBhs#7a52* zxYO90Cl(yCPQ!<#;Mr`N>Z8Fc?#5!{M9@6A-uYcLy)#w2A&ME{8&y>3=NpcfN5S(K z!^ga-;dM)ga07!3BxX1# zv4-)#(#;iE(HPs-Awy1#0BbS4Y{ftntj=0K*L9#J zh_9Ik6rFQvMzFe4{>`~LSXx+~(m`8$!j+Bf*`Kukw4HXWki>$@bUd0a4ySU|7jjIK zv_-QxVnVyXJ{5CLSndj8mJG{<5zKU9Ir#nr!G4G*3sl%ykEil&26nvAp2JhWz6Ik5gOZcaWwL1qMJHAFO|b6&5X%96O-paTx0UmTv-#UHu?`LbOCd66|C#_3oji%f(_`FI`mp7Aw3P-jV|Nv)S`iQ|ZJ(xo3` zNo2mZ`>YGR6QX7&ItGIvs@v1OFTUPQ)fP9Vmtjf1oE4PXq@I&v-6*%6 zoPPLnhFHxZ?U{m=;Hi<)NqN<{3s;|@z;(HxxqUAbxU=J_-{W*KEi@=(GZNfXvVI-o z&=RZ5Q=2w9&MNG1NY2Jm^vEOK!FqY)-jf=-uUY}(rRAv)+ZWo9MImeoCo@I+fNWpl z_~M4VtrC%ebmg6Df+Ry6b)&I$^ zr9O{ZwI>D%Y&*KE6Hu<+(!vCZ+`K+_eM4`zNzibWNFiGg(09#%rNw}-a|xbt!Ct^q zi(6mBw$@9h08`p{U|KJg17n{e?3@Qo>!s^~jThQRU=sv;0~m{N*!cihsbB{qskCqp z2c|ZU0ya{x(WH$Rg<@_?u9q@_;5g8qzN?yn)6o@Ra+9xw{W+8MYAwy zvY=jJnl!bND~%)awj_ILL2T^-k~6RI3CeVftX_k+^ewbH(Y$&qXi{M#+vc+~ga08> z{3n{5)s51Y_}UPdP3pHad>z#T8og!}RShzVR6|v^oF9i(Zq84rPufq(##rxTlv<+w zP|>YQ7=Fuz_NWpMM((=mNyZV6+Ur7=&*suxxYT|#lQ{thJLlu6Nplyla-lte=h1?_ zg{LOrLC9E&4FqR=K7!YH(5_HGS{71{^KbB6KKe|yMHXVoO*@CG; z)NNQ(Gd^Y@5M-(7>&?)dvI(Ccwm=(N5nWJQpN!Tmsl9yR zTxe&Yc!9zNiko@0r^u(%PaIr-V)T?Kp23gx)k`j4SXI5>?~pqMLMll|gwqjfK>315 z`O*jL(&Lpd)2+S04g|EFb<=a+V0{lLG~Qs{=pfDPI_<~>T>AFDpLv6I7IqqMu>P77 z%;+Y58lTx!O@|sO zN-}*Nhr#HGzR`(?lVYyHQDw;`{?p80Gbl@{ z7A$dDj9U-ech_~6XV<8Iejl)z-_8n9I;+{p^TPlSDGT^8Mr~%x;Tol|ig%4tt_bjC zQ{bs`&6UE69tcwVMtWuag4%|fxs^+*lS}N95q^XIJy}&(i7Oy#X8S)-F<)1^B*cjxc}r!b;?FiIh0BuJbDAG+@7H)d(CBH}dn>;fxtO&bJPS)eIJP zp^jqZO!I%Hb&VCcZLs)*K6@Nl{5dTjQW>juaa5r&m`4f)=N0hGGG(ee=*m}Us#0Y< z9DKKd=hsG?%0J;79WyrRA3F=w%=V{6Fmzt{#ss|Q91Z)1frmHT)3CuNU#3?5 z15`}0GZm+Z1#eRy55Ii_e4BMbQ*Ia2aBz0UGj{>K6WY|X*z&>Ha1@MXkJXylz^(w# z8-~yI-^f_-_Vc5__aE>a&NdMS!P4-?@&oowB^^92Dyfj^t7cNbs zpB_)2lb1KXIovHi^r_gMc+ne?=1t&=?Sbvd+S1kUtr(lA+FYJfk%#k_u-O@_fy}uS zL)%M2e=p790SBRuQZ925yGm0#WeHC?ZtG1{Z7a_?CvSkb3E$pu9jq3v(1v&l4yzZ2 zwvq1~GkDrl=1{#sF;A_EIj6 zMC*gKKP}1A5lKbcQ?EuUHkVhOlh=axl17i<0?Ch`@2SL7g>~xd1cV0fX zzhjmdV@h6`-3B>X%EM|fEDo?-`I95#-f^fnc|Zr#A>Q%47u%(2L|kl-drUy->W-Bs z_;733?5_Fj2FMNtd3;fG#HbhO5{wD*r~iM6!%C5!k;KRg%;ZHfn>Kz;7x9nEU!8*uRP~Gt>`?vQKj5)2rQ3>mgdEWE{(RYji;CP0d@7qMo>cf2K=^; zvD?-G$4k>aDpFh4afFMLV_aPnTx%1Va0ylS`AsM7TlDUYj7(o?jmC{L|q zenyP8Pb;sIYfM%g&aacICiZLGn_FKQ+ZNl?_BI^C-$9V(Sth9`Coypg;8wh`2=yG7 z1(v2q;zJvIBjxFpxo|n&I#H^iQr?e3wf@uPsofGt33(fr0j4%w_10c!!zVTO$}MkP zAD$QaM@wmJ+q_8aVQ>>|ZSB#_Ss-tjchkHHk;QZSe$2n&edk4zZ_SI$dV5}EHsH0t z%!_>bBxvt~_8w?}*V;jQuDo$WZbi|yh7EYxJTFqW{_jB61KB)7DJz~&6m5t!jeu_| zLhJn}mSAn@s?+-RjH8_{L6zCDAyKro;oUYauJPyeb*z|7EFK^)sKWxMsz_y4nx2o- zRG%tIm4?gHOLGxPI4tB}@vA!AD6ib_ZILOHjPlQh#pJaH8CN zat@LyK$SaX#wON?rXAdgRF8zIMDZVmolfh7D8h#?UoUK(Kvx_|!*+^uCjLcKO_b2mbe0vAb z2H=@y?*sk~I0G@Y01yHk0AS2MWMD*fNV~Cfg1E-= zM2!OS?}ozBdQK<>Z*>PYeabh6ds7e}Se~d+pR-k`A#YBI8Vt%md1`EjHwAIL<#DBk zQUr!0@thDl^2~(yzkkq&-V_9DZ5mENp!$V5Ri5q?1YIV*Vaxi%zMT{`KQaI8rsagF=Qtc#Rm&~2ya|W9El;M+jNzQn^>`i+*!$dZ$(|Am z6kzF~VNH?~x(iRnPx$-Sf6u#LhIIywHz~o%J(^yCoX~7O0WbYDZ-F-{!M2cwlM?)j zDI9t7?ifl@YeJR>8tyCi?w46>d0eSW4TUvaPKYIl@p9}VZI^iW%ecyF;R(cQM5LIG zG^6(I8t6?*C=KI%AnL;%hSZ0YkQ@Iq_gu1q6lhI4ZBrz55+BBN%d&BipF$=!h--z$ z-0zxhqJ~}q4Xa0ig3`a#9#YiiR)OmA5WCrZ#Xnr1T~kwA<&nBM*_G}yJr?7i=L3{1 z>T_31YWYSYOyZ~7y5+bkWLYwxJlFO_t`N~BuZ92}b-hvE8VdBc^=c9C+NhjYGkbm~ zb+&G#TtrRp+_#0NPNLsdyS`nyApFj3gT+cY^eU_lY}Hd$+ouFcv;u$ zQbe(Uy%OUAili*{%!}tNtnIR%c~riCzbA7kHrk>hV+%whPAIzH=a;g&H@LW0dK?_B zUTIotW_6=?WpBxvR$$kFXR;PHpWd~Ion~up0JaJ|y-g8ejU@JsrCz`@tU-#wbD`n0 z?grJfvcsqvJgYMKV&n2X+i)H#UakYrr-qMz+4RR#KtBPVYM{qpth)u{Mk__1lkv9_ zJkMqFW!wtFaJ&MZe`fL(6mSS(4eP#-!BfG;42JbnHvKXCId>Tz^3jO?I951L-}FiO z4HzkuT7=!dZ;Dhk=t8v#B%QD$m%pijB;cZ(bP*7Y3N}5 zx{P?bEDWt*B;HykkzTYrGJbdaG1wE>A=;Onki%BU(vHR*J>(k(DuYF7fYXl6n0$51 z@;q2-RDV=HULI~ggwC+J6dTq+A=SY(A7-pkfe-9Ohn>st946RJcn%lrc0AeP4@-+R zLNGJd@Xi$F9huvbi+GP>H1ZUm!8AQ(LmjO2;XB^PbSCfAk(wbbUo zV}v4#QLx!+lG@D>yuXe~6bJ#&uf>7EAglkmoJRf68hs=n?6AdD|FZ|^^FQ_t?q{&V za$r(-|4ek%Fa_=oO~*0*X-S^h_))LqDUBahHy}`|#>BDUh!Y6_!)o+kJmgepyt`IM zgsHt|+@;~;1)_RZua2qM1Jm$M1g6@-X}~m;b(W^7B!iRZZdYM$|b_i5uJ7e?OBZBUJR?Tk(qf3uiD>QCKWU6g~(^xdn~@Q zruf_#R}DfRQ?Jt6FTyZNP5}IOV@Qr=Leln7PZDy9@jP0v1fEgB7S}F58HX}dU5Y&~ z(ef!#?3qhOaco1<3@rN}d35x6f3w9D2(GOl<%=C|NczG~RxtY;Zm^Khcq^XvC_x&j zoDiEX*3J)K{@M(0xbd;&iJA_iHsWXf{J@6mw7<Q%&=pVG>i)t|ShM7W*yJ%@mi(|5-Cg4`=K;&(y5$ZNdWsZX zCU3*W7qPe4m2!s(T=ArC9b!HmBvO-&)P?2M1>WFdfaP(eR)CL22N(Wff;YHmQWoFf z;?IV1F#f$^!b1x`y1^Slh6%kziVY{tujlVR&s*`NG~G0=;d;!FBKY@)30H4O z$WQ`}ZPsDJV%H-4Yl+^{iIQt#gCCTKspA@@%yM7xpKaj4Ua54l4WIHzCp$n14kfxe zaJV(#de&irc5*G>XoN{R*I9=NWJbRjR|;y6nVi~Bu4L_DsLJIVIw--89JoqH#|`3= zZycevDtlF+doP>;N`RLGt>6ftX5pMA)%Eo?m9v*rjb1W)@!Z-)9Eq5Wl;;jk#I1n8 zvyT?kPrku|61=fOLrqPW#|i~wit?jkxD${W6Faw1W4Rqtf2C_vCIk6W#tN}9>^4}_ z7g+YOLhxq03&F>+!dsf>r9v@%acN~;3t6e~qdTTx0TsTCF$$}Z8hpG)OR!X0!Z#++ zC6=+mH^FmXCSPon8lK;C~OhN5u zG6Sevrv=^Gf0ua#7(cg{H_~JJKj>F$h}f@YP7BLD?;4MFmgY`%w8o>%aEaEqWRBLj z^sS`t>|JQak~X776cjc<9q z*(dxwS$eZ{k>)#lKU(`)z1e$|P1WF5>HT@V**A<7|Fi_3)rn%-D4~CGJylxAaf@rR z9`S-Mq;#KLCg(s@T%XYk1+%{wO5u6hi#DA?A=v(=-2QBOoPLHb_AtdVpF-MndO^69NV#snr@@?9TnH-*wLefHfl^P=JhN& z@8md`(2`w)#Q)EFmVy2lX0eeAn@}s$<>4`>yUH-?zKScV`#)j)S|u$-*}>xF{c7Sq#ps$jpE2 zgS`U#a@ZomFrV2~+gzH>zT#E863D;q7TD6%3$l_l{hJ}6Ry0dVfD*bT{#$1Ab$qyM z5Kr%beUTfNgB06_6?Rj$CYpPllxSSvQa-~J|*Za_pr*g+bEgN@mtpbjeUky?RBm_Jq#l2 zi{Ed*FpGEbsWi2(z1YvWuRT_hs>sXlZ1dsS>8=M8=?k%(>b2xR9J<)zEslCs+;7^|t#Q;K|W(*y#q#sk9Eu!PTsI!*Y~0^L*Gj0bkV(u8(Cs z7nYmkwSQj;nht}wN@$3DEha@i=)Zqb=6UXV`xuVw#985 zyAVTp_}_~EM*KgF|GD_@52yl2go4J_Nta?NmTPJ3b1IG5Pcb$?im_r)j7hFo)M9xS zV}wFfF3j+*67O@xirb`vFhlGT?+bn%7fcCdP|eoF`&`80)Ms5?3)u};gibx z>AI7{GHXEY)A@j5#hDWtgeQH!?!fgWIs&U-Y>opHo+!pQew!H^IU(2Ofjgf#L`Pu$ zeZ0aGkV5MLDf)$GLvzWqI-lU*$16MmDW;}(tYp!e?FV-K2uoHgG}AX%5AOOAmh8&V zyjfD%T}NR4-M}j34(eFG*d;sxDY~Ni12Swpzx`d`4(b@I zZe2=mE(|Lgv`6~D@2E`xdT=T|1ET{5Mtq6tmVSE^q zbv$YYT`mul(LiNySbE8SW;V-RS!%Gx?Y1??+s(1D~Mwi*zIZueV;ex8#6klgFiVj^hELXbd-(DjsN}CvKOQv_NB}wjMFUUx>O7V zhxs}+tovYCxyqPNbBECQhyrd0&u>w>L1km8%cvzc`u4EsFf^H;^B zvp9Xqj+4)18+);0=rjqIQ<@X^U3 zUEpKZ!yJ0RWOJ9{IJFCW?6Xhq0^i}_o8JXKmX9mDz{h;m+yy?CqaSsFkLBpTF7VO5 z$GX7B@VdLnfr`l%&+H`rsSEazZ%-HaST1|B5c^CvcbUEeyTHfc&&V$D(Q9Q{_(sMG zv`1k4!-jEM2A?+@*tjdo69A)Yo!uSLofP5nufF^kRj~7cO&4qduyX}l2JEYXT?_0Y z!EOasDcC*0<_NY17)k*B2W)|0+kqihg0>SF@(ZvDU-|0Pb7V<<^^(Q2YaBg{CaUMj z%z?UMUTt0V;^?BfeRke#3S63yCaOsq? zXe}hG7u7CV9z_?{5lf?3%9G^sL9T|$LZXa%qIz!B9D~zY(BpD>pg8dkiHY(ko9M#& z=;GRBboRXH!o@gQXW`<@XV)y88=bvme#4?_oc-?-7S;(rmi|~05B`ZRZdf!23mX?M zjyB+onoFyz>mYx5wUex^MerBTcNm0dFw~1{jqjskMSWd$)xvoTaoij}*tiQ&g>P;( z?iNt4&T{n)RSUSvvfAOaRkUvQ5+neZTqbAFk1kqRzi4){YJtS(ey%Cm9Y zXz{33&^{%rJJa=0ACJxp3>G4wUxRlV7S}h_(L+cJUH)WLR&Yg>S+$F6G;PnD9-p3^ zy(Eb&aZqpn@Buk3W4uNR#ztS@hO>m&$cBS%730Z)!tZ`w`3+C2GZ_>b)#@lF1f#Ku z;)OoD_2dCZd2{A$qG)Iz=AK|&T?R%G3>R8T4kD7TE&ZoAXFiCGFv1fU^RlDp=?w-B z{Mi|v#zsW&5T1Zku1K*{Lo;T~(}R2(8`E$LPe6*D$ea+nOf>f#aK|}5jSXut7~u&> zv5V^IUQWN`mK%KVJ*=#!v6gt3%$07z=!M}=Y%-8q1p7ihX439Hb&1QJOL?oV?2GxQ9Hk#@M~=H#V+9q zNF5?lq|^Lz!0+e!H8z?#geM@yc<{~*eBk8V+x;3F%^boLkYe-d<&D4gJ^tT*jg4jw z;R#4lKjU4QGjrN=nCxIl6AfETGl%d5q}Vn0G@^IpANR+@eNvh^geM@yX5U+}d-uva zQ~iBXnmL3gAT>aw+`RGA)R@->_@p#*2v0zYgDOvt+CF>16-W4_G;;_~K#KJTHmc%D z6N^6k+>t&h%^boLkU9#yUcHewj^$7%^Siawl0^ao*tIN9sFXR{h%UzqF|l1uOwH=H+`s# z+UruXtS)yInO5=|V5*+WqZ$-SUD0`RkE!k%b*bo&)YmT7jioiUv*%W#V}=6|A%Nbd zyCao{D9T48C7(#79@QKns1g}ET54FaKD^5sRt%^M3T0Uh*K2EnAB_C}YZEYk7s-Y- z1Nl-ktcCt0&~eDi=sO(6o&XFxIig{W6={hOs^k0$|3%>0Y53S76278wS_TYX57g{O zq7UI}!`LNLzTh$)HnrvG5u9gwSP)ab!m(QFjeT+a&j!yOhL71u{TD0LSXD;a_lV(9 zisc)t1;^uiG8-(gw##&imAUN*jQdTFn5Li97SYi|`2GZ* zC;DaZ6$ImXB0j$eo&oHU!Pxp>Ofdci;oDg7oM-r8y_UCh>{08uRn8`ObxNqb#SP(*6x5TvL*1p16puS?$bp?3t$mAPWq&*mXry<{c;MvxR zuR!}O!i7AA|JT7&dV~_JyQA|1?otmk1w6mZkUM)b7@vSGvjRBn1KJQv+<1`9f;>R_?`k^ zclJ_YZ2XN0)_>39Lm%+G&VDHjhocgXKyJ~Usm1Jt`i$_62{JM>&II4hhS$0q%MTm| z%i?o8cpm7)7t1g7xk0{l;CVKauPB(Wn2rBncwBMgzd*f9zFpb)V)-l**03Gz#{RR< zV6|XN=FBC-*S!;8pW;kD+Sels-^jvX{m1&`pbS3$On|xX2mqXKrhjt?}_S ztRZ%id^%HIuCa(r;{I=}+hWfC0f1T=B!FOypPvcVX;VH<(Ok>D6RPF+Vohf+UE!bsv-Xqv@Jby0OkMR73V0J%yf)gs(E43vlTh1HT zPjyeZbK{cR+I?|pZ;x8h2Qis&ceN9#NS~XF6Vm!j!ubWm5!Qy`uxp4!jhjq3d4TUY zMi58l#XGP*bY*e-ql}j#UR)*_9{>49Xb5=iO;S9zz!PR1Ms8RR&s8*+xv{Nxi6_$C zX=87!@|0a*2S}8=8@{NZ#_18_bymWf_N+@a?Oz3^5%(c5jW~Ckl1?VEYG5ns?!R*H z2*DcHPO(SFe6bhX(zv%<E|Cl6s!`<(ob>zyCXB zg6w&vQ??4^l@gqI)3vNZY~QB3H%hWf znQZb!8S(`R*O|deBzX}^ZNo)bvcx(z=m@Xda3R81)?`oSPPqZeJe9}mutq5CLS68J z&oNEkeJdW5ls!`F0-Qkl&yJ~4o2+|3vm&_6B6nYP1aLQvX1d80{4!|?A3tZB1zYMnyz~jrY30njC8ftDO~Mn`yDu0p=%;pv zRJFMaDX#8itNkk_#cl0B1c}~VYkySjzEYZ;&g7iFx+8M!qwsnlSyzLAdfzLp=W4P} z!C$seN&7JvA5G<7QT2jb|9@uXPj|!-N%HqK$sISz|J>yye-xaoqBWtZYVajFO0_Nn zDk<84!>%?U6;~W*HWZmo>rTizsr9iI>=*x$oS#2)qucL8Ux~f0p8&#gLap|{hT@%7 zNoJ?6BsJ+{UTrB>B5}>04=#W(tnPKd#kMPbg~@zpRivlpGYaF(eP1;lmDg~j7jj<} z@7Y+Hb(+f6}Ww%cRfY=#VB5QSrzv>l;7n9l3c!Nz>B}W4aXAEa$<&&sR~g zPLqmNyH{?yy4IDm+w{EN9Eg3>D3Kj6wU1*IB|4=IWx*lIPFA0++y3a_2csGecMy(> zGy(_v$=M=UL z0>^_Xr$tpx%+pby7NlF@97-Y;IKHH^MOzN?|9pPmZNzBV6LQ)IPP9L^gfX_>jQ<)w zC{Il*W|#1=M0z~a8%Mgg78k>5Tt#peq~4cAfpg-w_8c@8W_XPtog4IG;M|cd$s5^4@2qV}Z z7pZsl#E0ZI;JCic?Z@H}e*XmLitQ9gUkfO$kBjWgP}B>z#=x1oLJMnou^bJQv3J4V*}eRbbtd;6bwFu6Mxr5Lhf zyqKrm`N-x#7DjwRtb&J+>XaN9X%;7tBir!?5rb-H2ogVLr+wZiU##W70q?7+G4{b zbK+z74#M^5pH6SJ(1cTIkq^X%v^>HT*l%OY5Esi za#Lj5{)!jqsA}ALZU5IHv>)l}xZD7`N*HE*^<-?1m;VsA$-{6PbUeLs>Lf(4o1iQH zs>MW3*);dM6vO{oT55o)_KSl@)qb_xuVJLjeRvByHNdoPS^?}Hp?w1wJEUQUmxgFA zdC+1uQzQ4Lrw(a+D*`P^x_EfXD_O4Yrvi5frM9M?#?|jgii$k!6Rp5PQddF38GKT`^MjCo;uj&r z96Z0dMqj?jwQ-j8?X8VF&+?65GOWRtb>xKan0Ppm{dss8W% z6|Aav>y7xqjw^Mip)ejix1K5e$62~I4rJ#SmdBM^ zVkn&Q^wt;tqp={WYvU-j%<{NW<%YufOiyZ2bJDDhqZF^3py}hdQWqOaUr;?Cp5E)w zf9l#ea?iCqt`sjtq~T=OERQSoGehAzFi+}7t3P;H*TzxmUd!W3 zu_~j%oT*Rhp85gT>)JSedw>s^el}b;DM2oT@!UFZ>H52LZ5%&;$MU#txrgO((#Vtg z#|hi+(Y0|D*lB!txOM9jL+Kxo>T}#dSL@n1O68c6(%(wmYbXOmit$e~eboE6>)JTJ zJ!pAcA6{iBN8qcM%7smPt8{G~rQ9R>j<9a+F;eV?B3$qc&(Y0~>_7NX2$5^Q` zv>Ha%y@dt=gL6*N-ail4wQ>A*s^xLRRc|O!e9Z}Q+MQAb=UsGKR51F`JrOkOxKart zHAtj5<4CDXb1&?nYvb_ZOtw6()P;s}9KPm+WJ(@b*}`LfrfcIUHQVyIQu!t=ju)vD z@T6P$N6xrI*T&(+8Ebi5sR4$Php)O4mr}Q1z3XLN8%L>QERQSol5u^oNG-&ZQXdrL zzoKj7G?nWYfQZ8|T&eGn35I^l32`c)gjc%Fcv#oQiBxSJXykFF9yK-piJ<0$&XBKI z`?j?CKPQSj2~SuaSBh8T&K+LLY-f^;(y4LczZsi)v2$AB_ z0k+U5Ki%=<2rI?fgl2?w%Or(t>B$MPMAPhgWBzj^trYE{8EK_BGf9&V$O(l{NV=po$CVmr;)ly7JgKvXe)Q02D|MXZaiv(IXjo(9gp605Qy=;2dtuBBXvIdyKZptLD{biP~0A_E2liy`hu&J8ODd? zQ_3X)dq`)?;Tq)`(1|A=pk!ZDD@#{hi<}oAA>$BPQd^aAZnN1EhUToYdKr89xNv1| z^)jEt=X~;saFdTXLJ>0XC6#*?5e^$Qx3 zb8)JVk4!ISA(LC~xMz#Lhje(5|}F=WhndwarIn1Y{xCHK17!#-7WCgT3eb zKKU)k_(VTfF2&BrxmY3Y6A`*4*VJ6TsFGU^>leMiH?jYJ;uXh z&|P&>7<|rPGvM4zn&IT;OCRUuQrmd;WxSd+l+LrqB(J8JvrwX#%WgbFVtl(KPsmRV zRuLlWF)~_Ral^>$l|hnpcWIt5UCCl!7Lw*<#HqvDgt6l;&d-;1_xey=pYDm51x2F_ z3)kjzFokuts1hfb3Q~My@csRLDQok`Xw&4n$;ON)UOr|T3br7+7BaXdmcw`675Y*p z->Bg6C**s>@BkGf_KnIn&8N~h0B+C5H+nR^WDV{6G%H_l?JVu<sw68cTU+~@~`fqYpzTg^f+BZ8Z-#GTUtf76i+4x2U z148?*&dL`&Q=j(Tl$9?KeWEx0X*NFg?Rvz{(CYjU+}aD+P5t$U+_LE zpBFq7Cu5ow1a{U5^FFB;REIwmj62E9Ih*b&ERL+pbte>}AfE|vr;1bWcIx`FjFbwI;0JXDKHm9cLcV_UdEW{K{VP^(R z=lE^{hPNRyTbCgQYRaV>YSN@X+C;)SU*qaJj(L8Qar+v zMs?1vThyd^I_IY>k1NF^Flkih?7B7O{pVXfo%8*c$Cav9A>C_j_ed9hr~V#K=X|N< zaiu01it3zQx2{?H*Kc|{=joQmmE!Cajq04;aII>cb(g1e<|=KPUXCkur4o$J*>$Vn zj-2tH&biU@xKd9U3SIGZn29kn9`W-s&jVTy6@VV?|C}shm-|8uGDf9 zt9|grbBo%3-H%Oym6peqsx*|oBIUYu#JAU+;pv>KEsrZjZ5>Te=R9EMojW|8^I&BG zk1OTYnsmk6`FYwA2gf~~v#X0Z)JlD7?CB>`ZhHN=*Q0;;bk3Y`qw#dkZz#d&oZWDx zy6yayr*r;`<#By@tg%OR&gQfHX~(Ja&QJEXgQI5Yl=?*XcY>aF;#|g8;Ih{-=TmTiXf4VZ&R3%@(=&Bj2F z*KK zu<1Fo3Q)e_&e9sthlA(VOuo^hM&Xk+pAg7HG9|@izij*VJQ_O1e1QCyC~AE)TCQ4adjHo zQL(ooeR-j-vXRS5S8r+PizOl63YC>R+xsVY7pt!HqXq7bp6rL4m4e5?x{=~)F`j(W zdxls-!VV`KI8w=2sQG{7r-IM-6RvudHEb_xGNm>m&>2zYt(N($c>4%f!HOOGi8oF@ zurP-u^)v>VzcmJD1JfA16qqjteOapG>8n0!#Mh-b%>J@MlLr%3{ccKxHc0RPjE=Wj zyR&R2s>-lcY;Q;MB-vQ8UUuQ=x%27CeN0IAwU+h4LZpt?iTUyu9|B3PW##vhR9Rlz zn?Se(KGM_*OtzU}+13`|@l>d7J^p2*&Ll48ddTwr92k}{<(7lzYT(!&)y7_@uw4%% z&J9^j*C`fCHefYz!_wAxRD7PEoQq|zt{2UJS#JBOC8>B``&6vLH)Fy!$iq*0?WY;h zcsi7dV_jCC*6!W#iTvh^L{57@geltITlW_AXf5j}?wJ*9NLj2Oa@}1qr2Uyeuwwu~ zb2sb5u$;!m3N-9|j3-MXj!uU)tOUajyHA>$NnpN`>02|IdLDiPx6>N;$GVPynE^D! z7y;+C7EAJA)mdSy)VQr>d9XM8^|s9E)F|1C$h+N`>jSaG_=Vq6xN&)&ldMUkD+?1< zXCsg7>qrjr=Z>>AceGCMXN^Sq>|FI%`s@KNGQ_0KtNPzMQ50IO6NkVRr*&eKe_U?q z+ce3>Q6n-AOe6AqU>cFLEp`bojlLz8Hp8vn%mPBL7kwe!6I;X%mBpuP*>uVc)yZY4 z-i`aZCEsh@m($Q&u3S+1&h~Q}_k|*>84*ZtuBVJN9fOzjxp@+Z)JDl1jsL;&LXJKg zSM+m|{jeGlxF!r&<{gT+)Wv;LmHC>{BzLtf1eFT{ZEf2+k@dBM@|I{mS7WVl@23sN zxT^-mMKICd;%wUqumTQTOE1M!o6u4Ku^A%L#GHoRQEoHARpY4*8vCZ@@R1r=4cien6JVP z>l$h!!m`*;E7%sipDMI%cyi7*EUPe17pylTlymrD=Lle`Um66gSZKq6#RWSPnA$u8 z*m$AU0Gl8fR}z#6b|)~+)z8|m9rkOFZf>qV_yDkffhHGr4FQDYFl%;(^k7VOQ$tP^ zPmUf#(!lf=jAeD8V8wWHJR5TK07i49q0_r>zy1S{9ZW_J{;vY81~5Z31HK9P8=wHe z`yu|hmh)!7&w+CQ{~+KufVF@p0P6uy0k#011H1_MJ>XTq8-PCp-T|}$-UGZ3_%~o5 z;1fUyc5}Jhfq;VneF297m~ck}m~4XqLjhFy!~kOeMS#-*aX=}6OVcI+rU96kUj@tr z%m#3v&tkj?a2cQhupDqD;3~jsKnlGr-RQ_X8dT{06WV@C0Bz z;3>csz;l2X0lx>l3U~wXXTUpvHo$v;_W}O~>;rrP2qE(v0JsOR6Tq7mHv@(Ojs^?@ z3^wm4<39%A;-VtJ>3}$(6i^Ph8!!zp1MpSAOu%fww*dV%J;jCX3x{ zv0E*6o5g-?u{$kxkHzk@*aH@O*kWre_PE7bEcT?uHe2jji*2>o%NE;ivDYoO!(wk+ zY^TL`S!}n(KCswci+yY{)Kex^*&1s4=31a8mti)moi&a=`s>RN+*!dRY-UfAdmc`~;Y=OmUELLZ+q{Wt5>_p7Q4w}H(Tshi`{0iA6x8Bi``?f`z-c=#U8fU8jC${u@;LxX|c@~d)8uG zE%vg-wp;9Vi|w%3+ZNktv0WD1ZLtq5w%1}GTg*W{s3{Y+Sgyr-SDp>`)HRAZzr z`SA%I-ZV_D<%wcx7Y$oP8tPzzQr-y86fibKdu+VGb~E9q3TXuL0^KQq%!80ZSin{r3(OSMeevLjFT31)CS( zNo%%W{I^?ms)pK5E`9@6boe>Kgwv0s;=h zUZ!i5@-^c+sY+q)bxpQQYB8HoQ@z;baHZbz2*w`v>|BFug0O7KedB*O2lil@i$~kv z^1+23i?Nx*5Z9=mr?{{9SIUi@C>M01L<2tL=SU}tJ6+1JYICd;5Bu4!(HN68RfeQe z_qz=E&pMrBwfrt4d%H~O%;knUb79MfH<7`WNqQ2zZ$^T12UXQ|NwLa@lG&UVPe(Y- zpv+tE{T2#R2!e81hZ*2(wJw^yJJ9)>^p}H=ld6@YvDg#ze(%=7#l@<2;IaM|X+5 zIOt}N{rrC^GdHn9YL~3(3+!!V>wjz3mfBlq9)f3h{sDX);Q757^ROi`Gb4c+j}t&2 ziE3wtsd`wzgl|j%Fwc;$56H-hK!Oum9qF+bxGaA*^F-ehwKLw5CF za2-=G@by4rb0`}D7zRi9f=4onW;zC*xrUF?qxR(o0>ZK2GVuJH5duT!g>SUH+Q&3t zoZVT*h7!icOF?14zRU3KYViEa@L6|b!7~q~9Ygc!o*_$bW}6A3w|>ZG)@NiUs315~ zMftlj__ECeRlq~{gKr<3N|eK zB28CAlB&HRJy`{v+@#fSCowJa>bh&eQ<~c0s@900ntvu9G||o1&9lTQ|(V<9tk8BPiwRDSgVh^?c~&hJH+F786NJ;c1_fsQOQ$ zXm27i9%;X)JoT|RS5=-fWq^nlL8rT+JTm?diJ>o^)!c6o^V!g65=Eeuy$-G+m{Tb? zb60dP5qh;e#lJt54}HC14UQwhE^2C9eK}zayb*TT%Vq5vmUA6hFNQ^N$12TN4)mnC zA##tDMjwiRrznrLG_GW1G2U=~Lt!F)UJvZ9W4X3$)V#zw51bljzXYc7^EY4`XOg3R6Mb?R1`eEZ=Op(b zh2kkWR0pRkv_Vd;CQ-HbNWAq2>?guGY4|OCj$HF2l>J0{c_F7ioZ##sCJs^T8&?iN zGPL5e9F{S$PaC%yrp!~PG{1f^pe?=kx zT$bw;M{e2F_B(t@qKlD_a`O_C@&@={vDc`$BOK5rtz(qPUox(T-CEmiB3%f-@e@MqnA1_VI3T+Y8f| z<+YEJ`OlN#|MnpaSTg3;BEiETz7AQp9#D>y`A;J=wp-`R#gU!$E+sT&AV7C2R1m*ujVzttmzU(-|4f^;ik4H3Meh z*Ro(}_JLPVOtj*a$&MH;k^dp`jtNm|$5_JL^MHs9z*luH(`r-{=g6G79#cB(Gm;B^ zC0}x38Xc2m>Lt^NW_6m~6Ajh*7CV%EvM219UVMmSRB-GAt-$S+;RE`z#jpB0&w!78`6sdZB8O= z$N#&4j{u(n_>FVzJptT%c?jTez>xs%(dJ&l696XxMgR%`V*#fC&H#)DlmX5HOa^=f za4z5iz{P+$fO&vR0E+=j0G9*423P^O8t@Ikb$}ZH-vWFG@O{ATfI9$p0e%7aCE(Y9 zM*!;pzXfanYyvzDcpk6~@CU#j0e=F#1^6rAUBKS~{{-v-d<6Iu&<(w5PG9x}^adOP zI2>>!fcun>1DpUj2`~as0N}3YQvhcG#skU#X8|Syz5+NGZ~@?Az#PClz$JjifF*#- z0bc{G09+0D2H-lt4S;U}z61C^;C8?rfV%*{0Q?g0YrrFbb%5UjHUKsOo(4P**ar9m z;E#Ym0S-hC&IK@zY4;fb#`UN8Cv?NN?tq?vqX0C=0CaLlG3HvusK!#PkHz{~jD=Uf z4zyU*VtE#0E>^zb7GsWA8vB-tu_{rFs!_#?EmmT&gvBZ>#?q`3=U9y8T4@(qY?j65 zT5N&EYAjY~v82V8S&ThDwRx4rnk;s$#jdy5O%}V^Vz*lCHjDk(Vs~2X9*f;)u?H;n zu*KF`>~V{=SnNrQZMN967TapEmo2v4Vy|0lhsEBu*iMV>ve<5mePFS@7W>#@sNPIW zhAqa%RAZMzVa57bte?dOSZtuhq87`u*bs{iw^+W#Mq8}VVy9WG*kUCXOIWPJVpA=4 zj>XQm*hLnbWwE&yTVSyoi`7{yX|ZJ%yTW3tEY@VPYb|!Y#cs0L%@(`WVz*iB#}>QO zV)t0=K8rnIv4<_T#$u0Kti@taT5Pk$p0(Iki@j{I?G}68VmmDMw#9Z@Y?sA$TkHdi z?X}p)7K3)w&3_i-V2hgm%d_Ai{)8th{c9mEZ<_IEmml;(=1kO zu@Z|VEaq3yAxKc@<6(`ye34UD>x|uD{O@nds>Sj|8M!d7a{K_`IiWw`$x+zPC(Kyx zO`iaViXBdx z9#-lQC77KMpEe79n`H)X{E42@1%5gSUY zVW<|sos4)xv+N`;{Qb9dI*Qw6MWHJ^Q8N{H4&G=E0_23K?qJ;B|NcQA>U0#PL~$-W zuGG_bqv-|62~iQqGom7EaOX;i?h8~nujULubd2`T>% z2IPdOI%KfkZ>)Mjr>tnRJ85*V*o@E4kz|6A>8KDDi44W~?^XOlr>rRDPTlmjQg=}V zCIaxL$A*3I!4_|K(fz_OFl4lZf>0=((5Y4`R0 zkQC<&ogQQOUBh_LC0jvCmHUeSZVqnit*Tq@kz`scV|r}S|F*x!ojkCX7b2~6&cRJf zedBZm^9(X6Cuo>e@wlu3`+j^ALBheAkSyP6-+w>JV~-@@T#{J9A(7_SJa_H~^uXB+ zWb}nX^7@D@(=oKqKL=w2$sovw%J~hr*mrRf^NL=q_$Fd#gEtSuTZi3=n0%dNk*DJN zboaX#<&TOf3+G|9nmHRI#Mve(#5tQR*^w`29wvDA4-3G{C?)S`Ns$6C^9V(S0Z(yF z!au-M!rBmqe>&eVIwl13U^lr2A3rdBtmuVrOz>{3X3+CdZ#}`f3&!%rM&~OU4j;5-(?@$(G6Z1YK6A@m^l+`HKtA;#&dqLPJU$UKsp%= zcHzHoYyEzAAkBq9*LNVP^+!Qwf;dD)UWs56@hlZg{N*mu*9k8iV6Hom66tA$ji+=^ z_Hy?V;SBMF?nY4!UwU%>q$)6*mFKd7#+x5l-LZ0@S>Fz=Ah#@evmou=QmryU;qFcv z3g0joh@FSg{KDOQeYa8D}ea|^54%VRKS9;?CoNg%4R6; zB*AW@n!NmuryD=|+R_Qsq;hzMQ;rYA(?@=5~0m!bnM`k z4P)Cr^Iw)L{%HR-ExDi4k!!eytR%IeqWJ(0%;2}1Dnc9Jw*;=rYWps2#6~7+^#@j@ zwya}Gh-+X{xZ*{N0)!i|l1C#>WxnDm zP`LT(31KN4(DpD8-9GXQV2S37ab&fLr;^AcJpfZefNqgTCg$)wdY+MNZfy~Y!=y+d$U4nb zoEPa^jN{6S4~cEzq}wf+@hvM%Z8j4mtiPuL0wvl^x}e*C(9DfzND zY;fbL-5YvSU+$RggH!UwD`wMR`+=CU8pApex8!)6#59|@`3n;EUShE&7IT|H%pHH!yWwCQ`chbtDt1p%nIY5mGu-tT=gWmek)aK{ zb+czh`fG(1%}eqU&Eqi#SGoiLSPxOU{V`Th70pa`#H;U+^mLDo&5e6|M6S6x%o-)! zR1w;N3aKJpn>%Usdy%G@h@bL~rxI(CEgWZ+6K?MlxI6&g;*m#6QJVIivh<&c$WPbT z?@E>K!dvpd#=RpksSUySrqT|l@ycDNL{@W0QAKKJZ*jhH69$ecU4`h>65;ASvor1YQ&Zc7* zC;B^y^o$)MAV;Z#@5T!9ac_D&(s%5<)``$YMIN0J)f_P|HSvV>l!1{g`ignq)*gr^ zM>gKAgCy!#I;fwq_&~PTy@U^#DPNn5FKxTYG4}z1BvhogDPt76s-`ysnLk*OA8YHFZGS{sXJc zt~iGHhj?WsVDDBu)Y_v5P^3F7aoV`yD3C`=(xtmxyJN3uigmztw=qkk&%>1_6S0Hw zV8|OQOY)+8@%v>l-rKn3TNAk??fIAv%cjBq*3Qcz=*mdRY&-mmbzl)aO(moo1O5=P zs&QRsEcj!ft$9B}3o?W!Bu<3$L07l(lShm4&=pB~R-Om+_eJ6IH!?L06e8FA;?W=-upW_9Bafbgw z!MK4;>u_odwfTD=nD$q@qgZQybucjXODV96MD`qD9B5$EHL#h2T>-32uni(|OEXoLO@YeZ229;xg{ih| zwtUZ7zW40c8R${#HfCIp6s<^28dA~B|I)ouXpw5>N~Md%BfVIEeSszycI5*?|DU#t zGQo}$Tg=8$s;R20lFowK`sC?@>)roTfG)00MtQ{Q!r3(ozg9ih8Qd_!{W*i@n!TpS zoy?f60x)ZHTvH3+@N6l7OY(mLXat@D^Z0ha<;qt*kK0=^Dd z31|dd14sjI1biFtUBC|jKLY#|a5vyyz^?!g0UiZB2KXIdBcK)V4B!R8OMq7ZuL0f! z`~~ngz#ae>N*CrJ{J{SMI0<+TXgvT20V04y0sR3-0geS64`5e#7=RsN)&}DMJjMP@ zzy!c|0Zg~E@J~N+#)~ce68zInZa$^q=<@&HXv#RKv9ZBsU*jcdv1Jy!!eXl|)?~43 zEq1-dZn78$PHOY57Q4-2KepJN7Q4q{_gU-#i#=?yH5Pl^Vl5VX(qfw}_N>LWTI^+u zZMWF#7TaO5w=K5QV!JH1+hQMBY_G*Wwiq>_CjVJ1*J8aa*2iM~EH=Pm11(1VhT4~B zu^|>?FIK77`7JJ)bJ1w@$V!JK&fyMS(>|={Lr~@_D!WQFN0;REa zWLQoIEClodyos;>z&}?P&>RoY+EcMyOY3E^J{Id|u>lqvXfgk^5uA`#5P!yyg84l; zxLHZ`LXMJ^z~I1)z`i0wkU7#I51JQamYM%B{`a>wV1?z08r$a>3j0gmcGlCc_{X2U zwE+t(k1M64c6V*SwfNp0ux8bQcfGX%Y^7+pHb8yZ&BSsKP;){Y5m0JF??LOmwE;{o znjTi_dL@{(0i*Cn7S6nTYXiPzd0e-~8P^ZQmz)r%oS0e@J}c7 z2Ni1rAk_%$x`Qsb*W1pDnL#l<@$|N{R(w!@vaTOspU$0n_qMaLe?W5(ASd))JQ?F3 zPB`*c-gZ_VVnK6|6E!h5(NLKCaEFh4#hS#zlb`gqvre)+uGG_p!U5?2WA9DCqo}gJ z@ov&U0?`hLf{M~?N)(ZX0EsIN-O#NGi-J3{gs>=^NjHlkf*q8yjiQ5&IyyRzuluMo zj;OdL1PR+9iz6s5xD(@oiVzUV|M$D6>Q+@2_5DWQ@A*I9d!Of4ojP^yzMp&UxoKW* zXPpSB<%oE-eVmnTltyF&oM~rWPV)xvWbJ<-r*+n0TIzs&6`I3g)4bjBB%;%f)dNI+ zV0?+G;$6{L@%b2EG=5l-AE3{VX1>wOmLK?n1Tc!G5%~e)X@=i(T&OAe0cR?>Czs}B zI5dIY6;-00ly_)Yw_zw6S6FR9o91O1(PZRY@swyMRj&F7R?)az9f2QdUiJ$#R~>iW zX`-D}xnhNdQ8X@BtdFQ;>Mu58M_%}dXeU*!as;htT&~!crFo@2ArDV#f3|2RRj&Gp zD@CKg1!j32rCeFLG3BoLR}tg+O{FPXn_Rb>6O*1;m#LFW`QX^52=am6f@ zDnup9BA!l(&zw;raYXRH=IpXgPf>C4%m(5tW(?#kGgHKc`q-(n%ruOJqZu=Gp5T9D z2b~>J75Nt>Nu#1(=+bG+xVSNPs-}6|Vl!jMPRG?7bH>irU9JS9KjrAMQ>I3R*Z|Sg zL1#s+`^5okE?3o;bO9{B%h-(G;PmM?z!@Hg3@-5-oQ3Yw*F{I>7SBSHIY+~nk|C+5b+#w)g;sA) zLKu-<>1z%Ff@3#uE9eT%{*qHDq08gOm^R!!dki$YIkSRcPAah;Ew^#4JMtPFa2EU z7y-J6K(oiBV>BC+nc<*&8YAT}jmgX~`se&gy3vi$o!Yl|t|JH~-a4)xU1PE-86`IO#p)G{f?wuWkPkETxCDIka9S=?fei<@`h0~-}&Un@1Z?eQu8 zaYfPx)~8NRaynv$0j0cL<$03(Cta7B-0zDwPwsD>$Q)Cd+&?+KKe>Nae2=~y+Y(a| z7OXmvN*%B~bSnJ$DtLtGBo}n_#E-xZQhp)M{2nl4RaMh_QYd*=Gqtg{f)VnEH$@AF z^)^QF3gS4n*A41|#qNRlR!^LzY^XO`>z#9k{7iY0wTyACFWx3u+d7_E(=}N;3$d@A zoIu7nL|rWU5O&?|Gr16;=z=J)efd0R;>l@~&oc{8j-)=%b$GIR`;^)~p?eB{&`=;aaQ{!{1B5yLGxboaz`ZxgOS&RxeH#+kxT6XPrb?Py)-QOni zNq%ZZZYX(e4=7y5tEb0*%g1n86*-uW7c#Y=>{=8+j|z^l}EWutVVQmJn>d}>k>JkyhzUc zUfe`PBpLCTQSFGUip}EkdJ#okK*Dg&AL15KV}3Vq_HlgIQ6VZr$@$$ndi=}Eajg07 zia^D}{oX_umUd4Bp#-xm2^YtPZq0Dl-W|446K7hLqJAanrYq4gbi{?DimOE*Vy5Rq z>?D+&hZ1UuS5MD^Q<2bEvO*{Jmr`nMM+=?e+F)X}k_uG@NaP&u0(3I0PwDVEO+k<1 zdAfr7qY%zePzX>j1yOU2&`k!!YVA`R7bz&<^KjuNRhpA>fmnVL?ni*6a+CccxB!L( z34?5D34@0wBn*+mxKMXezw-F?*(x%p;>m$j_jMGP5{ZMVh#KG^qp-3zd0@Q%#?KKX zg{K;k=5l zQRUCykHf?M@c#V5D#$!Reo56Pqqdp{Sd?HAl~q;^>4+z!1fEA1*WO>s{RQZH4*9dZ z{x&VDxwVjrHCDT-*&3C^6B#WOfg*DYeFdY!J|#P{6Mf2;RGm>6L+cv76FX)HB^$VB zf2SfxA%Oh($W9gd4ZtCEdJUp-Tla z>EiOaBU6!`)oVeAicsQT{2HLDAptx+)lcC;W!#X6t9}G<(;n)$phJ4v*>j45-svwu zY(o`rV!|Y)!=Ni(tvrd2cx8GLN8)w3CviAlI0@epueNpZ+!uI-Kus`~@M8hrEUeEn9nXOZO5hn%(ARhlQcxTPGgv{C{*WGLKOkxE+)k4A z&ZANCcd>?+0+OET4nWcy^ushx=zdN<3jr$KuAUX_Yg95QE(mE3XzL!*gTJkOaGgu+c&KBiNb?&KRrVUI@Pb%5;%OR0iv*i&GGu&QA3J`*+s%jHZAwg7e{EbnMlvIcmM zhb@AgN(+C-z?Q)-LNz%LmM6rYMKn2+VwjYyVeiV*;%~xI5GM}&IJ^hq&D+zTgMAV9 z71#>c*J0PfQd(g%?7v~(hNaBHhp?Z*R>OV;`z`Dbu=`5yqlJ?42QwCfjtuT zXxQUmJHvK|&4%UmdAxVHA8a1%nXtS^mZMV)wg7e{ELB)t3_AvvSKk%EPKBKgdlhT~ zb{;Hmz+D8p7}kI-gQfO>UPw1h2Uyv65Qx=5Ag+G|;^-m}D}_LO3d9aYpn!(DX^2%z z{&Kb?5UY|v9PkCo)eyS^!41?Z0TsG%tunx>&y8j5RZ zu7>7oXrYEmHMB%SH*09AhL&mQE)CtQp$9bdkcJ-B(32W^MnnJ9&z##m#hP5eV!~0 zwbM`s4RIDDbO8-@(@+l$_0&*r4drMkS3_rLXrP9|8e+dCq2+66goZ|G=pqeWrXlt( z;&!5jrf6uIhGuDq!=<>GtD*TCTBxB?4LR9WK!RhBhc@!@TkidF{zT)0ZEEkYrKSmZ zq}%yQxsjcyG%s0J=q5d-{Wc$G@BMwRX)IUQnHX}I(!4#*ue&DC|JvUBTdZj;SHsNE z$;e6bvW647@E^VM?Y%#i8%;}3K*dC)b%;raP4kkuMTXY%bH{#Y@BLBAi6&jU8Y~F& zTrfEvOfPo~?Y%!vVrgXWk5E_BAKBL<u>eHK2LUBEVZ{CN#jXTrDFsW+D_)FvS)D-hyF^wTxgoTc3Cf=6x4N z?Go^kaMLukBld z&73rGytQGZh}2%W>@hedse*7!U}ft;T>Of|%i?~PxvQhkE}J3FoH2G1=E~D#&%$g1 z`Vg}svi5jNaLIXmrhCJuo+exQEG{aa^wdgh%$##vhc5Jv6VrmQ&rDC6Xq}i2{G#sKoSfXe`ujEQ(NmGz zMB^L)1=H~P`|Q`a@3>~?(8PX?vvn$Ava@_G|hsymL9{QkRYmxmB_g&rW^|)wp z8b#N~eK+|M5PS`~*=9e$Wu?&dcZGZ#@Q;Ef&s=wEI=2d5&r;Aq5xwU}la7P5^3T1E zrNnaw;HPyvp{5HCAU9ka4*yqR1R28-7>3bQ{`KvxzO4tR0gFu<3n%GtE9<=oKmQK8 zj0~Z&^Uv)e^Z5wS6q`hF#5T$KE>#gB%H7RE&$Y266#;Y*dP_|I~ITALLjq| z?ab%tren)=NO24WBx$)o|6K&gkrwx{jvnqjgpAG4T==-`=iTjZ#c|S;#yT)MU{g&YFu8 zia!713)QjZx9y#z>Ig9iRkCapASwRYfTZ|u03=!Vn*K|^ts~2vZ7*0JE<3L-lswRS zPJ8oM@vy?o+hg9%XNBrM#I9J)+~mr;k_V3S-^h^xn<#87_Th7?1MaUlsJ)Z(aAvwA zHaOG~bhL_mW4+3qnDI7tnHz9V8*G)-^aRJA`vc79nhbp4NI9Z_K1j9LYM{AKQIo-4 z3q@u9s#Jj=Cc7)~YV54kd?Fn9_X2RlcH&bEYk{u9w=kYx1teQys&QjSyDAg_&blfx zS`}ixTH8A+P^$}bv5`+#zf?|StH>N_<%G%uq+Std-+RzkMjt(qBoP3a<`OTTIsB69 zw=n7OguZ*#im07}I^fw}K><94Da>dcr*JIifP$C--4!$tPf~b2lcr893g9~M!s4m3 z;t+cRM_6e#=Up%VLyT01^XrJN3b=pwXpkOe}o+k`yuSRusdO$^to^*V?PNGY|=zia~7~R4~(sh zhI5ZJFP9H=wRHLCdxZxES8C-4q=N@`GCyI22gcH83NLv4ixI*DgDXqPo#Uz|4res2 zVbi?q8|dn|bG{7=e+#a-90ktF-+EeoTe|VM&|t3KKmC?v!ry``wGJkk@VA^ir?$YR zc^}1-Q}pjXUY>62#$#KcA^*Ua2nIUF|4dl8<@!rS(3 z94tIAxYEoITQ}bIprKLxEp>Gi%gM9h`!{Uac7qrgMdRYPWdUpR+lrpw{E*E9Q%>+u zH0pzrM>K6`zcTxHuTvEk4dK zN!|9#>6>G7aX6Vkb3*+eW#+UB&4inJ{XSfr-Z{?jcH!ema7lQ8oQB<#a2NV;#-a_I zK`m%9*w?|Z0V}#Zmv>6D)e)e%#H1smM$rY`n&onVp9`92>igHHA1CSBJOpS3Xf9{J z2Sak@UtbrQ3U?`JwwZKnMvBhO>`{xr8ql1|kpf231>J0%>+oYRXjZb9hiM0^{Oc1` z-`0cNnVYQf$V3XATZ7+Z{96vXOb=MijdHF7Mf{G<1Olh!@ji{*i!={H!jy=+0yMHl!@^FvP&bxG zQ(QNA>b8b|RuPHFXkj@WGj=P-bz76U%@RE%zQNqSz`^joMhFqS#D@c*rc4xU*-GxJ&pJYY%Hl z2;v^6mZ0rp#+HJ@@_dLXDJ4Dm*5x*esmJAD6xL!u>gB9>(M@@Aym+A`wd?tUsJAp1 zu+*id3KN%I!AD$n75`Ki96wtbtg?JD05|3(_s){kSNdRSOonC*R`idtL#3>fs`7H%Pd+ngxMY&W5kk_G9Q=v!@LUxf`2>w-SQv`)jJI&9 zMLsXJF*X}3Rc4^EFwC{_!^mn%cX-T2e;4?cul(igS3*!xCPzz}rYHcUo~>8ek!nuO z2@N?l2n!LWb~~kWrW)iBr@S+H;8_2SoF_M6+}KiYxZ?@cFoahqeGBhc!X-!*;N3u# zq)J8v?aA1Wwr;8t3nh1Y$$-f>V!2hJ0AnV16&a9PHTgB}h%^>CC3s312;8$%P5B5A zso<(7<0H7YdK_L#$n`=1F^I|z$6LjEFw4&!>+GguU0)GeD1Zn}jlr$QN%{`R;rgt@5luCsnq#a#?k=?m zep+3n>M3NO7f6h@Ivyv+~ZdS$VmttH9MoBXilU;kWuQi`-t+ zML`4c?5?08vHVD2)=Vr$ii$nsPxg%W6rT+BK*b))fgabT`^gm`8wC3??9nK#<6t|( zc84W{&JRm{k7Ud}fKr+XIx_7}fvrzZ0U6>+-w!qqmdETvuo2i8Yys>@*wL^T!%|Rm zJS_d13OgP4D%b?{&^9zBP ztpc&`3&gr2&>0#Us3F#K`5V;`2MNKkeF-#5Ll&_oSQ(arxa3(r=tl^@>*En;T% zP^yrC1dYWu`+%P?&0*c_KwG%&Q$;}<%hly3h6^+Zobd_koq6OPHe-*aLStWg@sc1+ z#vbbk<5hCnH*0OiUWKL!m?BM9*N%vg;&JLv&Im)Xhl~!0`1;1G^&Y`q|qa+OL zh&x?J5~E`nKQ`kyhtdj@MWSfv-19f}gs2|gHk&ievv(aaSOHHe8Xxb~yEkE~B$fQS zji08GTiG>_7g)h)ezL-lxRejmNUBCypLh#~n^2a4YKeM0OknEqOO^VG@e?g4cmpGX zXd2fTbCf^Lj8}AYHFJ`70sxo>?9xf`qG=oxECZTJ(-I|9tZyq7J{tjl8W-AQtFzgx z9Pg)1oq%gbN~Vp4+LUR$`a~Fzx_LT26@OI((IzSGs^g#fu6Jp?mdR7BP23vdzD1rv z)Z?j|o^uA~j7QT&jjLss_<9pKg|rb9^;X4PL(s*EQIXo4O25;J?h~&Ss#vhQa~wMoZlD!LrA zBcfxNTG)3$vxS2?j2*we*3Ol}bDnwtGy^yw!{~6GjS~3ju%khOQVV2?8fG=DSc=xt+MQjT9gnKS^E5w2@LR}AUCH3xd9NzZci{`|$l zIRbQpOtBJl1bZ4e?TA zT(Z5_|L2v#a$d7t1yA-4&Tf{7#ZsBwVySSq^yryf#LXU?kF%hu7&Icc^YYH|?D7Kt zAYsptG@3d(cJgK2(sAMV`%&ZQ7*eRJR?SIPT3-ynZRCQn!K z6`a?XpM)S!g%u?UtT#T-Q+P_Yai$$qIEr_0n&QYxCzo1fByvNy&2gV*HeeOr=&YvhfM;L3H0rj1~{tw<;~nRZ}$Ko$(aF2BD@R`=SsScYp(CFJlZamiQXP=dt);LMYK)b z??UM|UMlX$0qCJl4TUcER>8Vxc17p~_~6O+53UH64Xcaf?GE|#*DPMUpg5W~C_Pv= zNr|^DJR`Riu7|0sistQ4d}q8-)2yy4KXnZlm=4J{Tm&B<6EY6{TxPz3%sfsq^IKPD z)<(UnSGVxg9G|=f`FIpPw)63t-ne7tU6(+kWV)TXi;xJ(<`)4;Hgl8RkG{1mPa z2j5n7Uhpb%HcB#&hN>1-eJeh|98Df5j!#G)C=sULq660hotO=#X78FS$=a+bQoPHB zbei%@*`WD)D{$pV%~kX_#mmx9ADTYUf9L9&GkDwh0F6EwMd=^ByQVuaN)Lg>j13#J zyG4yoR&-PnRHe1<;xQAoBVMiCrqz5Xfg=vMHUf169)DZ2fqj@P?#BXR@9*<`izf#@ zU4tFHwDHD^XquiC=!~Qtz%O*os4SJLSwxLAeg~q8cSh2vF*IOaSbS=Flbn)ZibG{23n*jNE5&!hvrce z!#QG_ms3@`?|alMxT%h@rg=(U4mQxMCWbRcxmlF%ukLd0T$>HFO49_)CFnsD(^9$O zG?r7yo@LW67d8;eTMNlhzKef_WzRQjm-}W>VFS^XC3I!8fjHdIut!ew*5b)@O&a=T zmau{7$`ZQD&|#%OL&F(gnwJw^#^H?7(`O4Ch_0+fvao@i3?23!Xc)W1YiSWEPCTo|N%`pnry8YlI6ivFf6(A2w+l)ulYPlI!HHcI??&qlzX z!UlJi@;8}AmH}I#7*}sPOjAq*#L4C%cv_>52_t}I$r>WZP zS#EZMjWD(nJ_e=!}Q z#iz`)gtbVm_y^<@%t%a|W-$tS3ll&+1(v6EFKM6N{enWmdr76bbwoR}n!d9Gc9e?? z{9X72?q$8=NOJd%7nabV#AO{Gbc-ReDc)$(kd8+91a9dVb_V1-IE~P`mg}Bu5Ig|7 zwe`d8>t6rUzpah=H-Hl-+i-aP0Cb1y`{yQ8OUZQUyR~D9Utf;$+OYYY(kPvKy*>hT zXM>LV9ckFfG`9Zd5cEMk{~D84Vh8<61G?Tg6W5#5Gi?}7JFDNeu;3F|`>(F`e*gsL zbPlWmY`B}pDDa_Ag*j$lx2OyafGM+LgWF3(?;Xpvg!FoNzM(5|_MNo|OHb2$N!dY~!4_7<50cStJ zf4}!c%o@0ur%g@7#;F*ym;)GIXvlD(VJ%McvM-={V&V9s?1|WQf>aYRslb0TF)|Tj zOQxwF^vX~6MC@5Xs{J@|b%cqLi5U9{=F5T}FLt%}wg+G5mV5W>S^t@F?KXvuU{E$YLdn6 z2@)ni<>%{6(Otu21I{DpxJ^Sa|Y;*{ImJNx1F{(BB09 zbI`m*0vPtAX1MCxdh`VFhDl@L#J@aO22R1xA3;~hZV^WN7j%oCGymp*rplz_tFieA z@rPNB6)=t3kLZ)rN514qx_0&GDDB+nJmUlqH)I?ApP#80|2o3gQs-3h;>0ZSdEag z!M zD*mHFAYYgLikzvJ*mBM&#SsN0X}JK9{9Od7iL?lx^+2ly*FpUF2OJb{=D+?ykS7mJ z^_S9J^1zft38kFRRl>OuB{3PSr$|#ygPUjGO%1yGShxzJDinZcmT+b$)y5c!eX~$E z;Mx7w1d|8SA0Y~TTKTQpmp@S6_0*5*Mj3p(Zg7{7tZcvK*DOa zx(*#IGe<82Ol7{#)xZU4=(f_(b0u5mf!~~`!tY)$!S1B~y3^l`nZ%PET#09Mbl<hj`&TcU6$79aJ6q?s|fA8o;vpy_XMRgh9hm zvZ>{RHL13j53K1l%+RLJ=~~NvTb$1viPd@3Uw=+_u?p$u&*`Q#jkUnZWah!JjO=r| zKVCNdX?yv=dt+(rg+^nz1>FE6?_YA+vlX&Ni6fQgai11B3awx}L!leJW_d9>MP zoMrhi1uhs?>!*(Wr_G~1Rnu5uJw&fz)Y3qmrsd?}$Wd=@wU-Z1C<<%&;N(yH@yFH; zcmHeKkFfR7nT~{yt3JLnQEW-JtB=oGGLjffWg3W?HRSA)?%#ZvhG~SxTJwu9!RVsY zm_!2__HLFDS9w+i0Jv{;xIhl zv&T`z_)D!eg6`GJ_o%~{HoCfUEyC0Vyu;XgIgI$%pJS*t_aMx#&>P&yo)U&p5V|1e zKHA(4=r+)FW#0(HrX+N3DYNeQF#t4|Nmi@jNa);BVF%#86f_Iilff{mLN~x#NGrS# z5n2J7SJ`*LXu1KMuKj|sRzo5WVSE~av`6<4RBx4>5P?day%k>n;+Nq^#8?k3KHkGe zHT&3Ld36`{0^KB-Uj9y{DzI?svSyj7c(e4>8O;Ft^1a(4sZpNH0`EJKRNRvu^X`qL zI^xEIxW^auz8~}cm~VU#t@tJo_3n!rhoTi<2lBmpqsI5qiW)#$jmx~5G2@+B#TNl1 z?oBu5dwpS}qc@bSI2cWqXQ{}h5O06!tq4EnEr+lM1SVA6OT&;kN;Qk5I>fvy5rKTL zcX0zr*k}_?uJpx{IFpsE@I}flu8SEfnZWqSi19WqA_1Y5o*}7r_rUewl<%&5@1{Y9 z?{0cABsJsI8Z#?wtP5vv2^()g-sW4Vg33uA@)-%AKWQ-QgP$1R7Z~psaNYIB-bxe# z1%pGzd&wUG^Gc3tUJMOJcj4Y>S?1rNugZ86h=MZTvytp|q2xzt{?be6WZyeTn!nRR zmQyGVs@iU^FuYLZv}BEy6`{KIk-T>jABBv~k?gmV2M+pg=*a*AsI*Wa_B|qFxle_2 zGb5?_x#^Kq&s>yduCKuRDN6YC%$Rp|BsKB$^aAg}P|9~Yh)(y#y!-OKyC{*T%J)#r z*cU^Y7kED}Fb>8lz67)$s{AP3eWj9uMlH<@CAWAW zHs@bn9yUhZmdQF9%G;b+RsDAry`8Cq&o0v?J&{U(>76S5zGwEXOpBj^W*O{MT~&<(2j@iV)EJY9I#Qi6I2BH3ga;Yn3{>!NI%CX_^r5Ly>5eE5F-B!%CRZNBB{W&d1BZ%Vg+xp` zE4$WJrWQ+%DzCO|*ivtavo@la@n6rXj2iTQsETy{ z#@HUt-bw0DL!I9XXM9Xg(nA$Lb_!M0bqZy?9`0Nd@>WK?KZcBbk?ha+y`?CB2xojo z%1jXM+Z67+y`r`gf(m#3I_&+?TWQqN(`}0Mr*OvS%Aap44s~Mqoj;)0-qm66p^9(d zy7TUeU7ftO=os2$4l*ullRg9w-w-3G4ZE&ba;56J{K*#RqL3-^!UFH6eD9Wg@8*cH zmYuIr$$r(*vkpq-+&(yU#!_QS4$l^H*V zGqxk@2p#qKjN4*$E8$lJ73SmxY)>QvUe99X_FPyz@-=+|To6ePyjI9}KSO~j1MU1Sv zb*O2o&o(NQ|Nhd~;fl3)i?IgPXK*UB4IO4z?%Qmv?z}Oa@qR`{=Wi?acN%JR%tBRe z+1!+(hgkWA3vA9DMFrP z4HO9fws2X;^w7Q?xWZ~<=hdzVEJXxv^JQ1mt+67olo3D=vL*34g~_CBE)R_zQ%N}r zj^-wt%NFL8liiR(jHKqKhx2N~{^7Nd>kWzAZTx%`oamGcm0hR~ta%_@cV;wocz!A^ zoH`eRo-HBT%FEBx?KW!7g}<@FZRo0aKHFPs3`wsVq81_{B@-A{B6s#--!l=f&MI!? zk8nfC5lj0%GBc)Er-x3To9@5)85A=HFu91#6bVMuMn{bVPQRZJOC29c%}6gu4G5*? zq=)i;V5{`!|CDch2(}}HL#;X&Hmb9~Ehwxyx2#?1+~eb+VW?bnt1(SUoCQ~jtEvYf zAe;i9fY*n!PJj_c~5mqx$_9q8rZp+P`=+fNCo93E`@q!|{%!yb)Hul_A!? z%806cp^WlK=j|cXm$1>cZY`?-`)F)JBQSsITkxb#nrgYLp<)n0O{|QdCZb8MRy84< zQH~y=w$l)!W80yui(zj$!|Gg4|Ixv=mHJq5sJOi5Iz(qkSv!u{p}I8@R!Fu6cYG=w z@j;^E=j_AG1>HtDs+#Y%NEzl>sEKQg)#3UPxE&F=%@@uthv#+#Za3@W=EQ3elubWN z1{~+WIh{78z$XHW}q5J%3s=#B+ORoy4Dx@lyszx+?*)Q>r)T^Ia6~ z7)&t8Byv_JmoR+3b&Xx>>MYc$ti;SvYDjuGRfu-56YXGUBv=<(bP%2Cb^g*N@F`R_ zsv9ms5eu0Y8aY9TI&49n!%e^GuY{92I@ZXnq0>*{Ke%9+J{mLAo2Sx zu8TvLsL~lSs%qNK?P&!WQtlvEZG3B1_^?vJ>XdI!T|+;lir1_diC9Yxl>m~abw8kP zus+Xoc#_@b^Q^+NyMkB)Pf(CO*8Y61o#aY}|Ca0Fy78o3+hqR6C)Ced90d4J^7g-( zYr(qYHCdj4{$=Rw%*<07PJ1IQl2>HoNnXtXBzbx_Aj#9l^3S=-MWqB|1`loI87Z#rQs0(PDObqMmj_?E_H$uI(v=k$Wf{a( z%5=qiO7n8P%oO%~;nL5A83|WbP>LBTuAVhru`Z-}xq7Cn{kg$nVMfB06%^`=71mJG z6&LO9x*^N>hDwdAU-xe6Q?DoO`AQP`C42ubuuFd z8BcIwCy$R$h0G|3=M>GIHGYOAgvj);5S$@fJU=NO`9nHpyQZ^07zX~p>j|?;=2$`q zzj)fQU;kikKp9Fgva~V6fKxkIL1tcFwh4 zP^-l#R8@nVX&9!+Y|@eiiGdqH_xgdMZKpFleSq)+lKRMc1d#0Qzqk z_7_LMlYf|esJ8eabp4!FSIJpT!m$2<$%kTcB!0OrMihI7HYkUqVQJvK+T}mBZ_vee zQ$OoJG{35m%Wn&e4f#AV$Aeyw0aRCTs(~4Uf9tB245xY@9twv8B~eq~5>E2m@;30+ z855rDS&MH>C``@XuF2g{|MT%{NgOtB)=bu7S-uJm=&%y+7#7=$>bM`1*b*~v;AL;3 zjS4h|=#l7;Ai_ATaQU18n=nFD|NEe?z*V=koJ>h<>8c~JG2?X`X+(A_@-#*Mww+*^ zxg*&_!QiO5MC2*V`N-O6-na4Q%2%0>OmQs=gP70O)$DL2&uCe*D&Lq6-p$)9P*o*D z@E6_>3L69RjcSRa71!k1o;WVD-H%yKG<7XvTr2;L{hS~zl4vjy)y0^sng3jcaUP1w zSs2`gQgr#L>AMjge2y9A3d4M17an>Qe$|EQR^zu-E{NdQ2xnKm@db2IX>x9x!1ris zv?FiJft0+hwX>0)KaL;y#0%^LTbu(0V+( zDQFv>-4(Q3L(Ne%g6jlGLK_0;1VuMZ;}&V?4}eZofA0mZzbffKE}+eSl<5QUQp007Kj9qmO8i&R0gESMd|C6D ztS<_bPD1qqE*5uyi)uc)AR1C#I3}D5>r;xmBul5^TdK=^4RH!7Mf8w{{soAWeV^w$ zJn559o%iUYATpiWD5%jQDlq<4V62X*gVoX0a|=Of<-YY+-Ee#sn8i_J3=U$BnQP{_ zqnlbV5}gQEe`Xrz4T`1~FHwG>YlyOIu$ULS>|4^~9f4FXRH>`8ktngw>|Bg=EBHn# z0i0Q3S&r6Y;~=;;`D3&B70Jp&ir^zxw#Ty_t`N%cR@liJumARy!L^Ia6E~D@iLa_z zh%Wzn<*(|K**2t*xCJK#axNfgTNeNd!1~neR-hEVISKK3IJD7~PhGj%LqVJI3@E4; z&wdKxa4fhZ0Evrw#dQ(S=8niWHWnDG6ys<;uCrE|XJr(6JT(Ab0WYGCmcdGT0dVft zLJg(<(zAfiH;Q(LUPfP7=Nj3$s%>VC#i6=Y$e%AGWnpp=&<4H>8(v%S-Fo1Scg!TlyYI2b&e2t>RnHTilc3^tP*Z zjl^dJ*MirXSYOjzd1d%RuORbuYYF3e?&PYAT+;_u7O6UHvr=`!8oEeB1|aE{*{Y>m zei0C7fIbgrUjr2Mj)uMl#QCOA-Qyr`yCXX76poW)&X#?ib2UUQk@DBjxF-NfrL0%k zL`DmJLxhcfE7dWk5_7GJX1&e%Ss1=>E=PTrS|Ke9{ABz<1;UI2JWD8L)zyXaH^}E% zX2-xT)nXgb-S>z(=Op$(K`i%L1#2CTC$@@Mc%}VbE@b96ueGK}=&@~*KWLw{tA!dx zN;|IcD?-VG-o#id8PqLnc|BYP13TvNGl42g#h}FRWZmTj` zGZ2A6lP62j%J8E#LCowi=*K|+9jg`V)jGW25y5v>QDD0eh?yeMXV)#s90y2}2|$~H zfV{HsHgQN%JthY+m=^J#Zv_cE!_5fci~}?{ZD^7xnK3sF7Z756j(3`ui{Jn-Pfk8- z%g-^u?v{v{3^2C()^N3;dB1Y|Fwgy(CSXdf-ED@&`Bs{j3uLTkJuNElbKD$zzoxNV zags`dwKQCDx!eZOThU1&`!ElON*Xf2ByArH!j#5iT-pNDdcxAZwlrR~rm$i;1P@Sk{Ojp(?-oonB{7Hr3Z!UH%Bd+FK zpLh%A`UW)X8_*1MVUYHjGm31K`16>JFn#8<#xg2~C07+&-)5YrCpb+vjrbFA#Rp+I zlV$pRxR5G$0^VwQf_F2|tYX~Js(TJ%8f9t<3sAc}8eVCZ;nb3`$`{2aBx`c;sEZt@ zy}>}l>8+VFCXbz#C>&ohHeOT`x2Q_u{|fVYVvRnv5| zTv=XHG;LDx)QOW7vG!h$v`cYWFylf7wdubFGQ%yHrHeaqtr&pGj2K9v1)18ynKMe_ z7Q6VD&b;>z_A^PyE#|ZlXPMF8a~P#j=@GEW=kLNT?!!s1ZH@z&gOO&Wj5exq33u1c zJtZCW;$2^#u8-)iw0tDpouIMqm1WaZ{^fE_W*gE~fzCSLt?6?5_OYo%_`eo(N1Efi zrVF~yX3@WF&COCfy~VnNy#xulo=^=~AHKU9~hi+@bS1k2}5P_bU}A{V20(nO!0ec50!s8?lW);Nyiz7!zj9- zJH1TcyXg)hfD*rYN)k{O?{a?NFcPj?XCNlQo_7y(5CN2M-SvP$zRP)#(^y=22zbSe zHRb{O72`lMMoo3dSPQ`VJV)cn0x`Gw-3}JwhwY%NBKuhf|b`k z;;PR!r=PZG;rEzJ78P-r4Ue3wgcg&*dc(Yq0CzUI}diAvNC7Y>ItcZ z?{?gr-E3I;O_Mjoo3(!R;nR=!QP5*9ey8**L z>^FV-$d!>#7C$$8!sQEA@5vuj{qSl11D3zm`#1G}z*kqcuDfjco)*u4^>yx*KVD+o z|6fnt->uF3b31(&>oIBMm!F-l1e~m}`Tidb|C3A4T&efO__yR+kj?=J`}KJTSJ|2w^y>vG$AO7%@swaMU>gF98eYYKd^Rk`i zbRU1;#*eq0aLkskul)AZ11;XZDShJh+09DMT64w3^E#c}q5U<1%$GiFf8o{R$4r}( zv7~&(+e1D||7iFF@lT%!4&HI;!JR*4-E!{rn*)!Xwq@P_=Kuf2{O_FZJ*N1KwvXKS z*|sHD-IMjoic3$pyYj>iSM2%djANEf$yt76>vy^*tJj_MX8x`nFRk3+d;gaGy>2GCm@b3RD|Nn=}zgg++{VNar zbIbf$Cse%o?mxzzFy#HUiQ{LVxnjU8wROu{{O!-@AO7i%+*3ony-z)J#ra!=2xhwPf=N=sxT-v(hpD+G= z?RBqK?fSm!V^=TezhTL%{^KIg*IjhU>*v1N@*gLMMm@ga*69mgi+;Gh-G6`Y|rSF~A;^Z@ac=o}$4^Kbo zh}yHmwWoX#JbY*Ti7Wa?{ zIq?0JmB+vF;FNw#hwQ1j@&4Nf;($`L{|HZjH|}2UHINzUv2%sYX5<*CuH|LwNF1MKL=~PdW>*l ze%tMij><zqo2RmrU7qHXS@~O@a-DS%) zjpgbV<;L3Xu)?bR(_>xi?T%%d#&TtClE`+49Uk7vNveXIQq`ka!(MywmE5t(29!5_(52#x-jL-K6^>-3F4Qv8Kr25@N_Z#;RYC7 zfzhE%>G{vfJwg1k)HNs?_4`iK)e-oDE0b3@qyOb^$~{3Oy3a|YT#>~@(+<|YyT@~7 za4s?6Wi`5~WqPhCn%HnKxyXtHk1r51*vu2A&ge4%nqFPP(8BY^U+fNyEuK`^2NJyI zj>G_H_A=T2=M5RGevCLTRuCDhe#nh9+Fjp%efpd3`t$}{(sro+h(r0)v`d8Dzj2rH zr)ihLez-ll(Jd&ct`vwCJ^GiDj!C){~Xt;wwc>#}STxYqBg|KtP;df)^ciBPc+dJqC zYXv@@L|dF>R(>|-0Oig5=a4h2%_o4a2F>LrcU#ldeB`LQ-(*Ir_geC zfX0$vXU{6(y0-U)P2D(RWSE)+)7^>=IU+lo9+LudGwbU;daPNg@ek88(d zGW^Iq3b*#b(y&+*UEiQ9|H$6{6KE<-IwVWza@>Ob_rZhppqXOst9P;J>fN$LX7V>!GkK$jHNgs3}+6K zUiZ#LAJ9DwnhygYfMM}T{<$`4lu*X-&Wc1o269Iy$L*i~=>)8u3+HVy>fV+0YEUkV zwk(@_I8Lm`_E*%UC9lc!#N#;pcTKo#C`7Q!aoqC70KCI_$eNDUF<@im)-S?=b%U0S zYEhT0NRQR6S#WN0e<1OBtZ-$t@Z9tm?mI3U0hz*;(d>1xeVb#(`hw2uV;Ngx8EXqV zza6XCe|9w0`tE(#WJU{DrhJRw_mj~=D76zYEF~N&R}6JP(1T!o>dJ<}3X*ex=0(tQ zpj%|)air6~kR#m}TnKGz11UB-FdxS!7H^r`J8IxOH*`8* zyAys|Cq5vQU5krIj02E)_l8&dlfGN)hw82SrjTvG*@Hgb17p$q@_wqST1~wYVI|p=;w;L&-*jdH-K< zmtU4>i4z&Pn>TLaq=BgILeNR3(D!7qi{1cj&i2wD%{UE z!``6#rDm838a6|J>CNzw)qxGOk*3(e-)W%7?sRlB9QdC$!{ni6{+q8ypvLaayNqv> zwcf;$!7Vjo?B-cB8Evzs2%^cMMLQu*eRdG%oz^lw{^gnNhxnI|^4Eozv}-?TNxr`> zRu(&iq8`=WiyxQy4~3Up25`wJ{~?^IZw7a*pbXQoul*9d(GN7$ z1$=}EI=cY$08y(4@Sq3iXY~LHNL}N!@Jh28;uO($AyuWV9-y^4;*(qzMax$ei$D)% zI;>A^TT2(9&sxiZA$aLDRH6j-{U zXxZqNR;@=vjtA=&Ufc4Nkbl|gL|gP(yH=o1Siz-c!fo%wAW)(E z8{N`MWzfGo(z4qJXIzvx5eL)YcNPA^4;fu*xUL4Uw=go5tJGpeBF z8rlX3vj+Hg2+x3mIw3zsDyUwsEHwa!1}Mjk#9K1AJbvRZB|pNyJkfIC!b7L{msKW? zRQYPrkYX7qmW*kE+}#PZ&S0w#N7+osH|p}srtbtv%ly=thy-Qb z2G~amsZohB{t@oZDQm|e12s*TQt4)Vix6>vu~WzAB}J8}#pyJE=>~iR_g1l+WT0Qw zoHPl&cmYlyW`uDrC04j8R0jn`IH3Zq62Y&6)IINOsLY9+Mh%-~)V*SF>iGbO>jh)9cp zOK=C|wY5B7gUivZ0S(72M8-O1oNaudrc_av_&Em~1eLg>=A*8Nrc_l98d6oq1Cpvb z6_5-F3jv)6D`#M&`jRIie}4cZ15q0k;rWX0L_nhyv=ERCCIOAHndrc)^>VVM~x>|9{&eBhoZ%Wo?%t1ZJc}zL)#0kdc*dm^}K|TLT>UlOi zEm-`OzqAJ&vH-7z`^CrN!-|3EW(n>^TVP8-GFC;rdz71R5w8LqFl8~dQBmM=AExRn z{6Sk_=4+48?EZ{XtSD5Bq|5MwoivR#cuk%{Owx#^;UHR%B!KD{yaD)hLo7 zRkaY1RMjg1*|Qx|_&n@i1;$zGiJExYy^i&DQC@S|v)aQ2L|avc75uNoK15^HKM<%&Z3V;wAd*WHYk z3I!#*E4paa5`^mRf}ANH#8A{}P2~nNc|`XS*1d}79DnIqjPK#?s zMk~JP9-X?<VFyvAHO)|7ad&; zN1=+Zo5!ZEe*Kd9t&oBfr>^-IM#hTjw#g3)Ym#ev`=7^5$xe1x6}45#_m3S6 z7k#F#xd(!H71jQxU3`m!*RiRqu3R_vO1S9%D_p!LE{xMZ8x0qEWtj^R8E-{Jb<5<3 z#{=xKCbKsR-5IT$;l!$QES>gvB5GQgn3H$(%Jvz$x=SMr1 zZm0vGG0Fuwc$X_E0!Un33`kro03<%&r2jq*XsmMass7srwO{B$8oEkD4{PXM4IQ3l zxfrOS5)CB*Ny>Rghxq(=4XpztxuH5jSt$s!psAHYa0hQAh5jgW)r}V332k&YM;^x- z!JdyAmBx0=)Vcm0Q`sHKmHBoKpaPY6W~5{_`{{tfspw#l)SHW>-Z5iyK6Dubf?F(B z2t4dPrm`bwdn$U@%-Y?D<7h4zA0cB~%z!q6$Sic^(xaIjd#nnXkAAC)PY;sku4qU2 zI6TYrAcB-1g9IO?s^}>oS3a@!eue3)l{yEyc$$cG}YGZY8_-|{dUrJSCUbTqW+|EJK`S6(5T}v0_)pbNsKib9HGR zL`VJVklg8S@b@F_{XqZn)tLEI?D91rdIdzu&y?f-&bI$wmSbEHynHqCZ&^jCbVK}T z1lPR||NN!YH<_%>V$w^_tQigvYG6T=XxA{D_{9ywpu>0w^Pkrnq0bH_KlPvMe|1zp zl$mst>R1*E?QmxFt@p7nx);ab_zFbz9F z$uMK?FzJ)<`OIQ*B~OyiiowExQ&l*U6ti%Ue*9JiG#>?2uc^kTu~nMmfj;MZA!abU zFg4nZsnMfW`Z)`-V3c`Z3&xD6JZkVDz4Q?3D73eJhw&0}PR-&hqFtPRsSosYjm(j_ z-jb1K0w5V_<^hu4xD1f=(5x|n<9b*Q!{#F}!Cj%DTQ&5EhW2TwwH_Hx)X$PSVf?faLFN4RL%CI(vM1RpZ{#&`%m_iw;%BoRa{Bky4+h zKOh+=2LT$Va3cZ9C^{REjIl{Tm#e>x4-kq);^3FbFwq4rWSEdq4&#bB#$gJsRE!4q z#*Av^*cxC^EqqvBqkkZuJr_gQ3H5xrkhl8$-yJKDv$Mjj=4A?p&2egr=nYjdxkWTW zZJ=zfIFN?Men-WlEx{TKtN{yiXUO|zLE*tz*;pS~HvUpFe$ke8g7;`2qW71!w$Npx z%ay0>M)o2KphdHRG67rp$_GG)UO^uYrNN)f?Ub)_Qd$+F;@Hc9TFeE9NAf=Pm)-&= z)nq{?ufqn`47iKWhGGYBp|ElFVgNr-HZ@00S}I)Rm4lazIzcvbHY^xza*->dg~PFR zh1G3TZ(VJQ8S4r2;6BKkao`ni}0#Bhk z7dbpw;R*psBcafbRDQ=4?IM;hl#X!s$iJi|NHqU=JLc4ye_S?tk3GeX&qtKEt0<=m z_C)j6_!lP;m_{nD#2qHau~77vJ`ALP`Iwd^FX~9=5GM7Zg%Qvy@LOaY5d<5{Ihhp*7RsB?06Q#MVJ;pS8t46q-LAF;6oTz zxVsY-ME00;E9|xeDh4FXv!#IA!1~n9=u#@r;=4%U$N-q6Antnz-SL2gm(Uwq*E#+A z56I064H_Jd3~|X)FcTmrRvOYhbdQ--{=Hr$62T6 z+tPavY8oqD4|~NU#tWKU@nkJY-<4iyOYc3YX)IS~ni#)wbpoD5eAM^Sdu{2x!J5W$ zwcNyHDOZ&A=mO~O4bM-qrT1ReG*-H<0SyhCRhpOMwIb=$>VPf1w}=EVZ9G<3Oa)C_ z*fj4Mc+%Cd0bjJSrT18tG;Osj&WdS{fOY4FExmV%rm@0$!^E^xt|%eG8rd%M&5PPe zT=Dg9O=G#@oSo)K*fcMh&#WcIPtGuo)UIyUG?pta8)=S$m21HG)8CE}u#1 zywP2LzDKla1f%%bE)4Y$T1Lv$p-aaMy~ssF>R1Cz`v#cz8(_Lx0pTq_-*90XRjdIy z*V#qI(3c>jU%;W3XPq#k&y=FM9=YghYRTM*QzwgxjKXO}LBLAa#|-NF zupArqq*RM(paV0YNIYerM(!l)H>AnKiypDe<7z5lbNlw2Ww&L<(=Y zNc8P97Twt7_!NjX7fqTvw`ihnsAJ{R8A+8Tv&LJBqjlcaMkCG(UpRhxH~DJ%z+gkKG)I{68J^E(!spGxgr)!IbY6!Fp0%rX|+0)3TZ@5K7SWE zU$^+KrvpOgJdv^tG<+%f$)H=)#kIiy89$FT`w@=&iq3rvn%WW^44Ne-o%S!cA6(d` zEq>e%nujodqT%dU!gYJN82Gn9bE!Ge(EbJcl7s#8#**8F0tv;!TES6Wv?6d!VcJa< z6G|p9z*Sv9rdmW(nbxjci)fWk_2alZDSG;XK=Dopy6j@K zqPRjr0V-6k3X`h>;K8f$)`Tl_L3p%^#wa|GQ4ohRfvy5{tiox=3D#kV1?fAhaIfp!5aU(cvBCAceu7oY%t>Z;8v=z9O};ap63yvpYsp z7j%f8enB8HD~fBA5#F|_cU#Gc)#Q^k7V;qAtM9?%HO|YB51|(cXx+|O!B37F$h~3d z!Xv_lg=7`}6hv{EM$}jkP@$?k-h`q^bkGzhV<%T-K4N8LZt^c50`~Nf^w1JtRDKtVs@>C8i9p%e+L zO$Op1S!w3DfBCSi(zWq#qbbA>i3~ef&`4)G|L5js)g?}*G*~LX!m3utiqx_#BR6a6u7#5on!?@|QPTlRr z?f^{_FsB&HOpGjc*{RTd$v>~Z-Cpdn2GKM}mP;?fibW%f-3TCtb?KWg;$C@48LArz zVC=;%mz*@R*ky;qP^Tx-JKKw0GJ|Qj*p;vz7KB<_qFocr8#kbpw-6u7Tag#wUOr1TCLEp63DTsSosjF-_x(i^tD%VkN19)}yyu>l#8QLKLjIXsAQY zJulPYF?&S2S>p$+=%dO)mxojahS3~Tl3zcX=k#^ne#-SD*PWuxn6R_)@w+keyNu?+ zK2|$aL9Rtz-2i)sIjXYinxnb3pjC8vc-{}1?e*#U^zNew%m?{JAA!cGKlxKDKy;{S=TH<>H}_P8>Oa3w=2{e2SI{FY?3YJ!R`*Od%Kw-Yq2 z$ijiq>FrZ*x*@;aPiuCdSof~W?RW~J^bUB2o8^tSjP+qtgebT+???aOH?r3!YXk8P z#>&0#7@N0#j@!eGije zKCW+cj3ISvaU{v){o5tIWhu#mC5u_d{(qNAlJrw|g?y)HFxT zAdZ5`ln6p8>En}8v@&R`nNocfyBk@MTd@l=LQN6;PuFJuXtW3!$6MZD1`vQ3>9E$_ zVy@FMQDc27Lj@eptB79>v3z4&I8}1cx<$fR>3{ky$_655YH|M|B#L4NwmNW&Y+l8j zb3$tR8Op8*`=8zz@osd_C_^~wlUI>we){>fvpa_J_7=DEew%$Dgye?2dqb!Np}aLE zxZ-VX7;4kZbR)v2){8JMJ8=q-K<+~87S2yyI}UdZtY9-%IbiPSCfZ?MYGbMF9XnG- zK9!2kr*3*mHDmr}X?I5Glp_hLJnse1I;jjp$(m3RpmqvZPa@<6AT6mrbp=b6DUh0a z?g9R?gx?Awe~YtIm<;)o^A{cTK*E>pF!kJ{q^gRj_7AB{2$;PFj3;t5#JEH{1oNxo z8k_f#*;;)*e1V`x%s7-dLTxsEr1AmjT`~^8bofSOjoOEiBR8f*9=ij|J36(;8xhXv z{G~i@4oOp$lgdk85W*jv=i}Oz05rKjV@1)ZEF0Vj_tVBIlRI~2SB72)fGCu`9W}Fq zJ65HS^N)4M;tKkdH7+S*|EmoCCD^EggwY~nwU*-L1#c6z^H&Rq9i)*v`q|dfQrul_dDlS-Ftfm!~4CT|L=RAub!FP z=bk#J_FHwT>eQ);<;|nR)hnYnP`c?@iD2B*0F+5_7Kht*ZISE9i7-HrpWM6f7rdGB zG$rq!Xj}?^Gtsc+mro7G7CdWPzs@PzR?T0-sI{H3lBmIX^SxPp>zi>H9ogI4Ucs7h6M%Z{PMbK zqsyhke7Y^wE;RXQ?KJ3u)|cb*7?FD=es>j zwpyHL$?P^dUw7?xr~Vjh_=TYLbM1~q^O<2ND^!{`)VKrs5GmYDou7>E^J-kYxnKbH z#_D6qp;uL+5iCpKaGaCcR5z`?w)L%Ub!GifEg_umlM7VqS2>e6+o1k{pxj!_j>N9p zT5TN0+IRH2Eo_PT`n9;GFzu{?y?Fhk6K#|4ct z3|Rt8ZFhR(Y#A=r-T}|;$rGk;iZ*_#aSu-9$M29W*<^JglS$>T*`CA^I!AB4fifC~ z%HKbWONFXdL1QiYd&K0df%avrdhL~Cby|oI0)xv_sc@TbsKYRclRvvBP8k336$huP z|J|@}GQ6qk)7&eeRQTVC=CeDhSIpapn<_B?<0@z5Gdmc)-m2Psl;u~O-=EhEp>s~S z3P<(%JrYi284D7(dm|tC#Rc2>daovWaG-g{D{2hvww8FAG)i!AN2u^NKt$DI)UgrK z1JuzwB#}R_5^Wgz@;D)(AFTJ~xm66}N}MV*8ZXYL`NiZI)V+FSr5C9xk6~Bt<*$J~FfI*3s-1$gv_5sFeI2V{#{3=G;x{FoJS)J1JS|_f$0F7*b%r)(f zA$MLdU=YhYg>z3Q%mbY;Ty`{0Q%GUnIK@yRGj1nVSY%FbXrSl=4m_UQbFDYoJdcneJ7^I+v^FenSi`>L&s!IVlzeOE}od%I}z#h zhK5~VM;SUYKE&G<;nFs)>%qre8`^*3hcNkl=1d4Lml1W*|FJIO;u+PWM9vC67ux-*IUSwx+VO6Ww0$ z+`0>NqBp`W*yp+mkMZua3v>*x-!9M{2)g(#&~e%3)Lo!syl3tL9Y>4lyFj-O=$7mP z9sA^4cY%)S`^7HM?G3s=?*bj`cf~HyvEH8F1v-vRuk8XI>*Kv$pkscw?gAYps@*u4 z`&?J;kM(w77j(zLT9S`d#~ zz}yy#dAot*fr*He%F>F6^f^Hwj;r2JbY@AFFD=ajr(TJjD_CJtmSZM8J_IB!=Y7pjuL1Co+k*j3D1)S+Ky*JAled43e+3WIDxq9da6KU&Nye{ zqzT@zJGJ5BA+gIcG5ihL1xzvCNz~vCD7)4c;^JJ5mT3)HGOu*B2*{C zzT%1)+|EMIsWJD47rszQZ6*S^8bQsTgIDMZ%_CiG-ki&_nVEBDhvvp+&XXwRKARBp zI&13et70>8-3$_l%UC>IX8NqTa~h^LTot=wYQxN_qTbVeZ@-LyVlI)wiGkGTQ=6jn z7?jjip4`0Ym4_wMb1z+OlvAPp0gNbGKaL&9!vK z;L^ZXRRQ?Rp&fC7g_6R%`##>sn`^~@p%WU{rk!HgA(w?YCeZci^NW*pt~Chid5UxA zV*##mc$I~vLj*LiY0@g4YmsYET=|41z@>Aos2l9lH-ECX&b5S#pAwwV1i1DD)=S~a zv$tQNb1mVbdIFr#1h`mEWw2MN?jLUrJzlkXh0B%5geJhnv8*giNrdk0n}69`wR(li z70-kwz{PSX3lmTGP=4M|RjXIHMkrQj0$dy&ycG6+@QjyKt5>+(U2vfZa4|<}4VB@J zZ@TY&)#?>4c0F)H6X0U~mWB5b-%zNf`B$z@PT}ID9!_WiTpWu$J=Wj#e(@sJ>J_f| zVBr#)02gEN@-=I(s#8>}SGlxt2u*;CZMH1T{L*cE;@uk6>Qydn96}S|Vju6d!-=E* z_=RfqDwj46p$Ty9CtRk@Uw+6L$E#Maa%tlbngG}S!ezd{$r}ehq*}eorHw;q0$dz> zytXm>kndh{fPB@;rHw;q0$ja?%e3Aj|Mco_di%JvaR^O-i|w{7%>2?-9=pe32l}|Q zaR^O-i({hKqMm!?-g^)7acSca8VU6Zd8&$0Sy+2T>>qzz7txtnXQc%)T;Ou?M|qA5 zV7gQrkXfQf)(Ftm1?9{$({TQbEN0l4CO5F>9^fLOP%w`p0%y9H&6#?UUe-l=jBsX7 zZ9SDqe28O+oSn{Ta2ZN;7&&*HKX=#XuJIA0sz=J?l^T8e{k@5bILpnJe_Zl%8ic-< zxhw3D`eWhAkhf4V=ek1>zYWZA=?i1%JRLM= z^c6DMU=+GIOxF4w`_^u+|7cv5?QR%w;ksC)dJvRmW0f1Ozm#{~vPDv`&5PU6jU}CE<9EdyyDmDZFLcb@*0VQWdPiKul|YZrxuRF_D;u5aq#n!imYpry8HyX2%u(~6%CdTnAB3}%fazs{*+4v)&rFbgzYe1~xNa$fa zS+xA$34*HvbfQ4K`urq;CIC|2^8s<*V{{{+YTy~{ zIUAm4YrhU=N}V=o8@L+#FE#KgZ6YWArzVnkjBO<8v|}TgVFx#ot6z&Y{sc)eyKSub zzu+C#XiTx1Uu;@(0bqLCX<7yfgC_2D;94Yd||_0=b7A@v!u;bC3JQYkhWY_C#!{=4?koPMDhfpXwyPU>Qam-$UY0 z%}@H`UJVA8;I(iFTv0B=9V**Zgq}SaKnT|$8)F+O{;$DPzRZxaKkZrJTRG* zta=?^^$Ty{s+y*jR5bN&GMaiX(b0wglGPGu_Niip8w72zz7@T_Ma!tXb!%%lJ22Ip z8Gz%@8R(MJ7!wRPLV@OGn@)bF2rT>0#JVqPr#)4dPd@cPfZ8Lyfu!61h6B-VAtb|Z zBpwWFvxz!v9)%oi?j*K89nPGB%m>2p#hMwH$h{Ah1!*$TCAHu&Sw@+!F0>&eu#+gd z!X^&NgrawkQ0i^MAXIgQy z04c{UfVAJ+Xd&8#QMwrxqRk$~JqJiRKJuXGp`U$)!V`K$sA8e5iU}N1WvWxXr#fe~ zZ5MAM@ledzkjziB3IS}_9|50mFc?jTDv1spwa&+|6aXEE^6UXVts0Ds^5w;l73h8} zOFYiL0Cr}6jg&4rCh<5s0=)7NX>|Pa;nwCza}C~FU+?DB4@*y5% z+ES}X>RJm*IIE6-eg59-3t zKnJTvY(NgjLrACew_2o<)QlKK6})MKN_3A==#W5XTYNb$^kr1pvO38z$3M} z)<|u5WxexSef6p=%$Bas46SW_vs>NKQ+mUW%)t8ahT2?9O>28MG@|Pf2@MI4%>#5` zNwT#z454v#_I=dWs$gwJZ`h6$qlQ{aYG~fx2`OS$5XCB60)5;P=<$s@Xr9$qt%H`& zz|)$CRU^O2y5=5k5v)6{xerh)ll9KaAesOIXdor)t6r+jwIyNwoh1>}_#B%bfbtmd z1Lisc;5JhZw@5jR1%~BNAAW^}u&%aa1G2p|{VL~hePi}#tDog`m=rn4SsOVU<@xRb#l(cyi9IV{mutm#pQ=px*6cIYB zy+BcWmr60+xfIiZQcPF3K(G_CRhU>Qp~{(4KmuJ=KTTN_)z6 z?DjCbOQ?UN4||~X-EPn$Tttn;G}}dX;Hk}h;%EeQ>DKnLbk*AN%_j~<_1C2#(@4|zvfYV^_!fvxz8f=_JZXYSP03rmt{{c-UIdG#NyZaQDg1{Gz{&c zeJoBnz0m9?Esg-Vl|VTFw8%+|dnBD+x1e!F(&5kQp_sgm)-VxRv~dyyFr=fswz=0$ zr$UcXLQBGoN5046q_Zb3I{-^vbxZdBLY0utx;N1QWxq{7+_rEqx*J&9J_eTHAWg+L zvdy70LUUYpBZNmYlWOjBHdtVmE&E=v!cswV%N7T8EYT6P8$~`AhX{-?l%0Z^*z0~K zg}asJU^`6t+VZ58JZLmy05GjxE#JTdX8r(RrPvOkR{ZTh%SXO z;wiD(>VIU)&HNUWN|I}<;WZEW`hk*C+NbS8-InvWQTWG21bC`Ub{Qa*$#Q^DY4F_} z%_t>M6QHpI-2rHvKz{+G(%A-!I}P8sN@CLhjTXAOfD!`z3XsZGtMIX;1vit!ltAP5 zFp|@JKwNExX<0z(`;7Jd$olSAZhXf8suhkYfKC-?1|XFWvw%($TtEuTZB|1)DF>7D zl{mhLfjOU@D+4R#ns*>KwEOMDQV>YwzASSVZjOGR5(do#-ogx^*32o7`Y>bAr)$8%ifL#XLjhJv`2VsVg`6muJB;y_1 zUc;Rg6&>@R8J!a&>5a+vxm)dm_aaoZ;NI8#D3rmolg^n{O}|&jOolKD8s&7xsleNW6ffB{*X6 z;f_Sdij?z3BKOG`Snx!|ICP8Vj6@ZlUQ0oai)QL!pj(Vlcx$3NZn za_Vy;@Ly&|YCiPnZ(a@wdfwbDBKA4X@ zn&=*R0{@S?iCsT`9TNL^@fk_gO_DsAn~I=r#y9u!iZ=tw#=Pv|D7@T9n-zXlBDx|GTyfBwPeNfi2k{XRp_(ps#j#$rED4PL>|U$Tr;u)wU7=! zjasNXVd3`dFAI4z1xX3#Rw)|3x@PAoF_K8v={fN`NX!2;J)fIo&_2;l3Z(1u=+5#u z@qZfsw@v&%*h&1wBgI5Mi}epMa^AUEvuGc~844?{xHlzPQz4nB{WWK5ExsD{Hh&{3 zb4l^VuCm-k`;=|MBD2Dzp>zDX;)~J*#_lBVGWKGS*=ha%&&&UF ze8XLp0lx#=KkPJqv_F$8_gg@dSYnEQ7ruw$H9LzOUBp+%@3z1HS^W55+tKslK)@z; zX3J2I)M%pRHE%gN;jBx*&b0Kxb(MY$nMIK;? z5K7r((E-$k(HXSWhAE+L&wMA|f{`o}m;MahN+MskWCtGK<)djwzAnc;b_xE!O9T?t z(ybO^eg-Rhq@a-EL{;?e`N|l;ZbukhWjj z+j;Hy5mVCc_rqpge36Snb@-2jKEV)OFHqq0;6$uO4$MvrtZBQa=Au2Z z;D@7ggRw{xJT(Un8nK)xC+DWD9E_NB>Fjhs2S~gDv1Re*OHi4lZIW=p&84u4Q&#&sA_)uTAHd%ffvAFB2JuaOYe}Q)I%7WTI%x4$r5dRf#K=$t9a?cEOO8IYO6b=2Li_I44pF=TlkJe>mxUF5#o7Rv|8|(7E*&$RH{cA9Gz^+7u>%4}_hjCqa%oMZEbT8`THQ z&F5I#7s`fIqIn?~ru~ciO&#+`g3C29@)gVa9nUALKhLi1Vnv@(%Zk36*6h(DcWb^) zM%L6itLp7^FxvPwm@s#JrPJEJW$;r!1Zu4Bw@EeuV<}OxlnTFH^H3P+k2(>|9>pwc z&DOSXX4F^3p1CxU`&YPOVW6}!&lc99RK;gn(5F~<2tID(bTcVm%-LArFMIg<+RxRc|5!>DpqdCJ?!x5||Ixsaj+7qiu=m0tR*fVT3 zQ&z_CszZicj10a^AN149W-?5HH*rsEB z0?oKX_Pc{ddQEr8&st~Si^{{M(38^H1P+v14V91V6-n++Lv-5Nha_@*1Rzog)l z*dj1dm67N-L1eoimkM$UMx>3|UPy~KB0=y$zUD*1f_4CQTGmFtcL?ecYyR6iR_Qra z%;It7zy@a}*8jE??nF?g6yhEJa_|o@h3)v{WMc)fc`N()FcI6xO$Z}Yco8J=)fhIa zUpCjnx!rK#5qN=C=p>ZFz5Il8PXK_V6%U`)rcujY(!a9m061a#A1rW-fgRs_05QXm`y}6EX zb_m+g78DzDyj^JiflGhTTV^*91Nu;*2dk1V&ZmVh*~Oxezd<$_$1rRtEUda<3CGwk zfZ2UlRKVuECJbyayN~nCSRt0uwCEbQ<$X}N3*k!{xf#uHfwEoq5`8s?vftuM^RK~D zm?pivo8~j|!k$kB+H(PEzj`$w?Zx?BXfOTovefN0b;N3>r6ORNmL2zdQnkW#hET;u} z2$1%=FI&28mX5ahHN0a1X?Q%>tg&&YSbcfhi2D8$koMTy0cpHF(Ti)moqFEIn?-bY zFTtvJo`X&e%w_O4tgdxxjy4^SzuOs&teEasb!rM7K>2%I3h%fb!|N-xrAXKKWBAdQ zh1;kEcO7u9<_u*1W%A~-xSBIFVI!l?`Nb-Dp{=k^k%qUx!>A+-?T69RqKEJ`*=XY@ zC}6Z@;bE7=FUK!wtJVYL6b4n?9dfmVtdW>p6%TXCVAllI?hbXLQ`1L6Mjruro8{}D zJgw{kC%q_QDc*rpv>+_Ms!bY+)$R4g%b8iK+PFzuG+Z~@)#KmrT-0Cp+H*oWVUa79 z%QleWdM~&H-C3!`A8kAYU0I^}nw<&bycn)T7~kZVFJGmGh7 z1UFtD46|2~{F*HpQf-B|irge@s8x|0+D0s7Epmw5C%Bwe>@Fm$*jIVlG+#iQ<_)Yg zQ|vBg{|d2Nw5M2^ScAR2B~kt~m07Y?n1WDWMcWvxTu1}*dbnugdPEFKdt+kVj@oHY z`m|_#OwDX6QtiycT}m#|a{F`L;)g};E99cWi>2BJ;}imq@cdN+}~G0AhAd#7nx zv@r`R%GWM$!>L}uWu7Zg#Yv>^p{~Er_gxvj-F8zLjBwDT&1+u%JCJtH|ACl zU9`dVuGCY_FAU18C}(#z;tiTLiQF|1J}Xk!ZBBKcQJFbij3A}aw+=+g(Ko#evB4)A zLF^K1NZ(8tD>puhQcvkkYV*72D?5ei3$pmzA&5x_(=mW_2)zQ33ikH`>W}|OXf>WO zf$Z?{)z+VkqEQBBY+&2TW((bPaJkB)T#P*Vef=JiohrnyDdakurjTjX6n;gzY^7Y_ zDL`e8*W%v;Kd?Sp8%*U+3tulE?xNu7v5STNCod!C+Ke>XjQj#n4F6qfzuu0f>n+ta zZ@^a|qcwEBoZy$w6aiRgqjr)iT!{f^mj zHor1vpCO58+Acp8YPv4l9T?cY6J6J;Wn2!!n~b^#FN27MtdZSaO8R0oro zITcq)o05YVewkZMG6czj8rlML3UQ@)WPD?MHOjDfD1l;cK3(r(cMC!VqWblcX`ozl zRa);W5if4E^a<}A^EgW8mNTo}8Wx(xBi5skw)=&JUx5@AL0VYwQ}r`9J*G;b-1~{v z>0%H=x%U&h42Th$!FmB^reeolQY`#~B2E{JrEfx^u^Y53mm#JG+>1kP+F=@N7x+ZpH! zG%<tu20V*kLa6cy8ivcRQ$QddO?jL8$0Gwf*7>l7qi zUGv7Lq)n@GdZ4as3p2I!8?Y5G0@}?wqlh31nGdlMx#cEbjg-r);3&Mw57Hf-@=K+$ z<(IRW`NSN2uyWtv(v^inKbM;Xwb2wR@y6+~N)feKna1k$FEBaT45LRU9|0G~|l`X~N9Z$6&lu z=o^4kG+tn#hb^=ZMoIM@ZlO6A+5kvHN$!DqlGyym8BtiGppPHd5%a(InEg-<5~a_$ zc!;qQ&^~>Czgdsj<8&vEYcf{WP>c-r7>KGxfo;{ zaot$12k(D&|Br9=j@ch>X$;p!7lR@K7mqs4r7>Lp1Pxsj|7GE;`NaRt)83x%U7qzOFm%z7;ksWDdW1gwTf8BWp>F5x-RxbS z^(RYXxTd<8p7<>b(*)6xfbKi$=WD&ovo5wYhU--~&HD(K>n%UTpwE~weQIXV;K77x zW0~p40a2HWuoiHyP8jx7#wpEr%qxDyc-x%W(>;{ZtaIy&_-=CL$((@6H{w6%!*vqQ zyvrNRyGhS{5210v#+irGNFEKug|B<|Y}hj~RO(4Hl*aAM;M`q-a7cYwfQy*T0nD^c zmiI}+Yle+eko9hyVg{O5{3>R@P8cpH8>b+TQ5vThZW0=&U`;2QTRYMGz7ysH69|6Q zv!hcumvrK~trN|v0H*5${5&e}iw;c@b(WcP{;WB(GZ)X9HND{~B4#wqnN@;9t%{Ai zAYm8Q{z-@~Uf4bJdoFf}q7enm+QBdm&D9yBbOCdH{!mKo_8GqtbAATR6ylbjPH_{5 zh)MQUR{w(b_+-;C&<3FoJE+t)VEu&gljMSiX)wug2nnqJ%$xzFC&PC=b zsrm`Y^HXOthqd*o^T$k>c+UA_&zMku{=_pGSKc9x;s4v~>rfyZAY}133r`Y;XLl6@sCZOs(Tt%KOnneoPq( z?m+yjRf7>STnQ2nitz7aI6RB;4;+UurHco`I|`BxwfKL^5ftu1{0m*sC`70)@bge^ zx4JzqdoE31d`Tk^cNm{CqF0tuPRd^{+9L1H1WPvHm~U~%_=U*=N0`U`3Y3hGT1 z)N3XtS>$?`OB=N1T`WUVsk(}*tkz*aHRY&LZmBjbY%J%@)p><06n6tG+|PIDxi{Sc z07Qi!p+-Q53hsw^QjXW#jg^kN{xQM5g(sVB zB(%jsJ1kU=mae{(_7sX)=r}e0Gi?`^(z69X$Ta6o{iv z7Cw{!-CPM94aa^=(Z+8I9h7?f$Z?8906xkgiiAFe4|xcX_`Yo0q&aCQOSl(raUa2G zR;ZpKJ~Hpa)dRxrZ40??SBA2@)BxMIZgBGl)iqCVk@ewM60-X2mH~tHt$#4Tx1xC2 z^74~WeE&pqG-^(4e}9H2%Mw8c!oezLy;Hz}<1MmX{0h#RZNQmnvxJwqT9X^tS*HOE z?plItd%bIiA6bH82^J*3r1lNeX`N4_O<8^;V(Nb%B&@FD_3WPbbv0v6A;w#1d}V11 zI+*!^4hBIKp_9XyB+~%Fjs6QJ6pDZ3me%3YpiZ<<5|DmM+&LPr7`D84m-_(4ZPrvu{D7q;{P=|^y#_5Br~ zqs5o|vBwCs9?-D@@j%WXfqDRn3B+R^8k>GV?$s=M-JV~a99_{P5wJ*^J&Z6>8@x>9 zQxEH1%M#O(!Pk;d4TD(?xDSR|I!+?z>`x(XXK_TuK|sGLpT(Q+1=8EL!c8$NWl!$; z-0~aY6N)ze0ZH*b;^z8$C4r_D*k88fB+~ES-yv?W;IM%O-8%p0*BkiKuRJ2OK~0k_ z5EQV1R32d7sL09yl3F%AW!uz|buV6I{0}H;Z!;1Qw}v=#YX_Pqc5@|D^!pwB_}$`b zw74Gum%vV%jLC`IB7W||W_k#I?%8`~X!n1n8Z`8xz5StRW4%P+X}3_og36U7NcLY> z*?9YDTI@UT4TZ`WHjb$u7uYs&wPx~DdKZ!m&=j@#W!8RyrU;8l){nTG1Q#swg@Us} zgzV4F1P;{@Eb&Q-4Au=-;y{T4_jR^MDRNWi`qAya6dJU54);z{=j(e*#?im|>t_l4 zP_Eu+j|~@~5^i6d$Su^`0h8^F50o(8E7^D%C24xumM%3|Oe;Bw%XHE2{{|?3Z_IbL zWXMq1j`OJ*}pXc==6eOJLvP_%IdYfdjyLiu4BbbT@@ z6uG6MI$jqaQznLV#8C96;Q>S}7#*Xjj|$UJj2dUGa2DW%Tn8pSHj|y7jEmAzIMU6J zC52F?;Cp?u-r3>QZ)ZP>?jcEjat$8v+b2wW;5Z-`+@Q)3@YXpAKOKh4+@JIL@Jzy?SLfj&xMo`s4r%1j5Jm z_a+z3d`6oFqCphilJ8l|)eEMh1vg?f-Gj_g8p_Ywgz#Z_#(c%X-^imZ@;R8fTlBiy zz|kqTXyYPjdJ9qOX!i^cNBd1$qK#8cI951nYMH;_5i~^eg-07t0u2L}kIArRXBG}8 zUN^Ao(Nj!@T^nrNn?}!cW|M`GGJA#cZ!ej_#AFXByZ}G3)?tgV6&SQ4rrzM12J!2J zAcE30iOlTh)~`#HZ4hH0q{7E-sZgcT3KGkFyxFnE^N{+=+|^LBIx-keCMh3IK1B5> z^8sY{D;|qCG$r58dFCK(WZL!FHrDiG>^-9JVueT1qIaz!#|qyEZHiOu=c3L=ehyFK zK_xa7RYzOsR6r`Ko&iWjRnG7fy2e5`Tj-Y-delN|E%Xkc!T68Jdb$d&Jy3%xv{FA_ zg-0GYyAQf8Y15%-tqN)n5_WP ziG+p$(i}|yq#AM40Sy!11%Ubqbc^-1L9gyL@sVu+_x<*4@lGZJ3uP_KL{u$9J~-jeYXSZFSrPW0)Y+zq&Xi9NK2?0 zkk;ybfON940+3ENUIe6*jkf`5$YXXlJK-5X>U$j^^`#j=Ey*?u{SD9&l7b>2H&uHW zy1gxQG$7r9$JVA>F6RJJjw=CaY}Z@gI{@*!iG==W>0SV&yY~e^8gHcBgmM5N<={@L zmP-ww6C{+0fHVa&EN%gy0pfc*AT71~0i7tg6@av?HUQG}^{6lx&`=Q9Og`~{?~h-b;O&u9BZzKy8yBbG zbf|D}aZ&d|K)2lbi=wwj{wfLJ_5c^dRMRc|Ma6-uFP;pz?^8d0<*W9{=Yoa~k@&b) zA9~R=Z;$*6p&*UP*H#y^r*OG1@caO{zc>uRqQ8w%5AnIwWxxt=vF z7Q;h{#wiV#B8*eaB>@aV#?4TM!i3CT-8k7RCeq8el@P?S9&O=IWSNf^u669am)GeP8fdN z#!1Loe}WX_FIJ7~3B!V4#mwszJJnl_QyQ+n7^fJn&l;zg;{%v3_grOz$#8{2*MI}% z=9Elm*u*nLemv6ml^dc6ikFqRm!bu?N8#7$ zell+9nRsT-#)TlWaVbi0FS4sNu}}~eTQ?y87T|x_{&V^4o*&-Xed0%pHBL}(hKtLN z-%RYRX3U=7;F#wW*5`;}!^C6g;Nc^cg7)IIbLoqIk%KawfACOD=jYe5;}@qW<2fqn z{2WcIzuU*{4=>$O8&1j2IyPZkc@i4L5dn_mLN|0UM{4W313J^CF-YF|bli|pl(noo z1<=$^bi6w)xPw>&y1Tlh3+_lJK-bZL-2g> z7=%}hi`M_-b{eX}>1dG`u(?*(HOoA(m?<@MOWjFVx_X;;7c7*#ORc%2ooz7tn%zr< z5iIE;g3B$l8wi2}`aao%)VUnre~hDiW^RY24`5D_P?n)qG3i9Qo7Q9cv?0^Y5u1sa zhIxyl-^4^;v^)!E0E%}MYVqUdFxq%BUQEzVYsc!=!ePng0p*E~zv5^X=G5Lyb+38GyQy<|Xio;3xbeuSi-p~vzuDgYOvDU;3JFr|3NmXr0RkefDTdKlQ zZ_H8CdRKWNz8*7f%yqGFU?#`W#ydff*!K5S7$+OR`JUPIA#t-r<`}N zn-rnyLQ;T)GR&y@2Bkj?xlCJ3F^TdK3GPWe`wH}T3%vuVpWr^k zQziF(QPcwj7YD>KGJ-4Sjch&z(2;_>+~R%*XrSPp2UI0c5s=PaICIpQ${;{0eJ22^ z^gS7n&Wl8(*3(Jm3IXit!5rT+Z3v5t8|$P%omOd%*i~%e>P2o*c_?!T?)lDFz<_Z2 zkXwCA?NEZv>JI<3x%^vo5z zB`PE7)=e>*@vCY{tlN|bw!u@8XpXI~@16>`ft^#AJg3H+C+1&iB;h+$v8nKF*Z3qMd@vdYBBzk!PombG5%$pd* zq(C@)S>6f5p3yjs{Z#XcU&Z)EF`0w-Cncak>?QiOz;rRMe6dr=s{@!W=NGOxYY6Mm zE)Y8B7qcG}2(AyV5o{1`$gXA{=I&(Ba;|~70w8mbu-xK=3kUU1Ci>V3K&iSR zJZ4Y77}o(_VN?Yr8RyTP-Y{eOH0XX_o}Jnt(mrD}ih_R0pHm5=`Dd~ zBGRx#OLN5Vo#2P<1V6NEd|YP>mp06qZ6*sbog2i&DXdR3TZmW3N2o7n3o6Fmfi`X$ zwZDTj6;}HDwagZVoB4{y#!X^&GK+QP#?$+Y2X85gft-t_epkbrkw*o?^ZQ%4YiZny z4tkM-5wguTAtgbmYeD2LQNKIUsNb1wd+L8-kI(FPW@w5|B$4*p5jNbDp? zw!{2Qp(lcui$o61eH(G_kqA70Hm>T@^p~+-V8{2e`@J?8bAffzW8i4 z6rOTZ-g5zI3b>!6DL_zGcw-Ur-TWf3z@i1;ziv6rtQfE-DGRgnVJ;>Wd!O!IzREoY zI!{i!UlFdH7IWWz)K>AVC#U_{Pb2UdE=J`v_eFlRJMQ{4j=zsX^58g2GOnwYVfu|T z1o%}hrxT|0s^&eNXo9Q0^bW3b660HhcH_E$XxC}%i_9y2Md~P7~t{l1e~t&jS8#=a?|ZL(5-iA*%=7k$e@1xIl%t|G{Y-2NQw;_-eAA%E8XpX zxim^?!W%Neyz`ggT?o2IOT!y7DnPdv=w9wByrDx(pTgi|HTIpZ=tfir==fRn#!RP* zvmH2_-%-JH4E^9Y6f~1d>4pSvkK7w{=YwWeDc!K(YU)X#yV9irC{D_62&7e?>ks(P zpnIt_yip?q4WSiuuY=}i?mX1CgQ3F$`DJ(yg63tH&gOS$bs*mF!sAWQe2WDR$F5S+ z7c3T0bND4_?qykWsxQ(pz$WPe|bcP*E=b`p4}yAl6GF&?kv zm<(s*jSn5H7=2ctAYO853|_(;5nRsy9X#79fB2lnJ1mfoLGZt!myZab(3PBzsYbky zbwxKkxcdG}@P9%X$LA!xVZ#I8Iv`)h>+?;vwOU7#>I;+tqKnq8k<5 zyKBw^x4bZV_`*lS(B-o!)G#%a*U9j1UkohCf{n4eh^)WJ- z4_57CpjlT+H!9dqvOYGtGyug(KH?(+k%9h-;T;IN zxJ%1?)Ku2g99JE@-IwCp2_@mxR1U5=Zg}w4UecXXLKnikR2L55>AHdV9Rs>cU0Qa( z3{RK5p>d+KR#B6Dgo)flMov@rZmW@V+g$dA_P*IC@+)2@K#E`BQu0hJ_u;3S2w0 zDz^$Ihel)XEKwP)?1pM^Y^uSLrj8f7zLgwPZ@|B6Pz;iS{D z=xw(|nYP8Bwd01cDMfbM`7@#1i-jP&Jv=i#ZG1UHxZxIrP?z5yCnf6ghvhykkKPQ6 zQ5)*3aLeEJSR#5eEMuf3vDkk=F(&hQ_l}@^{Fa)a*k|a3}dK6f-|EmS0jq}%lv_@Y5q+Lo8 zkaj6lo>821DW(ebyJNRiy)N3g8sylQ%%5S8wxAW_Uej@?B5X;Mzb+p|E#6C z^>tN9_-8RxR{5GtPuK;M3Mx*BZ!IhUb;4PhSp23GU2C%HW!w??6JSH9HTU}AgyzVP zSavtE$l@%rxD**muO~{+7FlieN)%ZuukF(!OXhoYOF2D49jkG%N+kCwi)>tZenPL@ z>ye7_y_~V-`EixbSXjJ+u7DoYi@7Jnst~vDOa6bL5YqDT?05cS(mTH&pGAE{JFUM_8fHTr{aXi8I`LDBz6tj}fPr%PA2w>_t7Wkos9TyBj{gJjMVWmd~;}sp)Bn9%yCPV81); zj@=IG5XX;~wxGwB{SPG>HKS!=dIlRlRD#$+CkEXc2EsvwcJgxjY=X z9GkDZ7Iw|M;mXNtchq*QN>#7Rya^?V>NUBw9l2HEDJwY^83}-$Bu1~ z?EWdXaCrr=?d1b80D~T>sKgMQtiozAKUl<;ITdw`q}AG_MZdQYUN(92N>VpnQYEQF zDt)Odp4=&uBW)bE8{#(;r0+iz^6R~C)hv6zmZX#x1}*&_X%(bXDu}*lGTaw=nZcX@vv;ZII9?N zYdVh@S0wxPxG9;hDQAK7_t!uCatm&PIC5~Zc{Ie4nsR;~g?zda9a?34y_(Gbtb87h zBDX;NEuP2t7Pqq-oe}*vQTXvL7yf8;bWSg4Mzpws&?Ki4;2K20e_YXUt)>w9I1#cyEjisBC1-8A(ZnR?z;_0bq4yf>1w zg3zSiZo*f_>Z@P*s)Vn>ZCXtDxbD5K!xgo4$mYjXE@D@KM{)(kPcOC7o(}a@*)`aH zf%w;&?{OVQm3!7fwg^&3uj7d$!*K#CxtTK+G@(p9)tn9|9^sY%bmCasxVgJEiE%oy z4fdQ-MG zMaTymMN2ff*6F#EMiE87%mnYvd!Jj1b6qlL#o{-#QBc_kjRMj(8%4X@D5ObCqhM>U zunDg)tr?BtD_irbboB}*JlP!|H13N=Hl)<_(_vS=LZhOU*8CS8Xc3Na{U3k^W9q2B))#fV;+% zk9B~E_qiE^;Ej>7`ET9~{YUFXR2(SW)`x3g*JfMMj}E}lIv^EqP4vZgunN8AfMopC z0ma?5%s>zWLCjAO0|AgVec%BLu^wk1cmP?`8y>y=9=+iKWKA!4^zwW3f(MW_mGG$a zdsM;$$eJGTKsV^c(E}bp)`&#l_b7)4kTnr-AkQ901Rg-*&T&|su;@@SzNbvxhNI#y zz`xH3w|^#zJ4~aE1+*Dx>&7?MF8&ms*P`fm{~;L6EuVwZ0Mrb9O0BJIa5#tUsk#0h zm_+`p^6C#4K^z=co~Yh(&5>4e3Ru$q7E*#4&p!JdUCXWi~=h-OH4JkW)`92sdrjyaF0SJ#;du}NSCDIYZ84| zq~hz)@)nPc_gVsq+T7}JUGte}qids$_aRFn!HmsE9JxTAT?07Qj&*>D_qu*;KIx#X zPP!iTX1$1t1BC&%TV3^Y+1BEW1WbxAZs%kgA76`nd_T! zx<^mxsrTvh5sr>7>d{j^LO^}?!KYAJU%f7iJC(OYn+`=NqL3^~(xR3jcHmDz9#nie z-9p@k4+^TTc-@vLhgZmSj^5f97qf7o`k|gA-WEdPhrqxe6~*U>D1J1jjzK}(O5yN> z8K>Rb#)=eP{IhLIfy34REg75(g%gkj6~XTY6wDdNT@IvBNXb{o$Wz@jvpXe#OgDB&sX3l?ZBomnixmMwW`TAQ$L? zu>2T-9U+IV*%M_*1(p(F-i>Fe8JUojWh`QRwkP1alwr$SkTtvFKy~qzbb) zgl`IS4YV2m%;h5dUxdFgW^DF=lur!7%>0-DpT^8mXkZ$SxLGwHdz^7Uo!}XvW zJ6l^>n0uWhX*smm$Fl(Zn58jXgIQ#7Oj}vFAD-lT_?jL!c@}_2SQ^9i7HH_W9Tc=| z>{$SQPbf%ZxNdjT%rY+vpXB;~w&s~i&jRqBmd0>V@}%RpQx@)zClRN7uVJ=l0XS-D z4A(3-%`Atqa4Vk7`h#t^qGVj+&^$|HxXyOH_7N@<*VO8Bp4rE8oo8tbSKh_!D_q=y zXFI-g+G(ry6)v>Hi?ZxO;Pwp}F6M`hJwaLcb37T$*jEm`q?bT`-REAG%iY%!{k5|2 zR+sD9-#>WyekQJI#!B#hmaCmX!|jj%vM|>Y=q7fL&fDK`&AW1{CUJkub*NiD2Y^;f zo?HV5RlIV5aPe(`r7`*H;bQphmxUk1lO=!E58jLQwp{yI8pB1acXS8hUwa$Ab$jup zxd)mQ+Ox0++7yb=0XlBLm4#m=3)}}UH!e8Ha9Qo_gDltON+!B^us4o3rtsYJdVK$2 zn?ko^1C2@H5|@j;bXnN6$`R+^c~~FIb)BU#To*HFxI^$?7XF>Uu!+3+&c7aFxn@}! z!^J_6j+t^_-<)T>h=vp~5u~ zPxg#excicFclBjSo(jt;m`eS$SX(y*DqvpK|M;k{`fBon{nrW z`yPt-7cP8*_H03a%eC6&;wY=NL&Sxfp2-d{T=ulV0LwMbZM}yJ*I+#9{*YSPc(_d= z?TgVJZn5H{`zk1`M=ZcUT(3MSV^>?n{(~*_+W_ctl&Q%5w4E1-dGm!ejzN?|!lLs-rE}nU=t-u><#2Nu#q~?X)f}w9jVIyUq>L{UK7p_dC&;_&l0#cH&~~ z8rLl}Yx*qcnVNToY=t@(iN0mVOqi=y_hkoEmBL1G)Z^pzj==I53WUk4y#qBeUh450 z%9$KJtpRXY;g-x#ZD^Q!mCFJm??4V-#-+xO868B4h--tSnk@}UZXh~S&n2FqeP06QWBMZK127)-&wj9i|Jj`GaW7<*) z+ON}Xxlx8bX5{2bZDd}p*+zZ-oXd=LcO)N-K0R=M5uAU~)XY?|_kdGmyRHd7Y}AP1 z-U%*F18`gubEA~oBS?~6cxOLf%L%TyULa!PWM{`|*(SFeWREEtbtBoWdyaG;g2o8t zmTu?}BY_BUGoAy{)&0fo_}Sq~cteAl;CBK~BV6WG*lvby$Y3+$1V)!VXjz_D8_{{; zji3}~9mAUhnh#w%FT5ecEfD~UwgWIfdYE%0I2&GkxRGuIPXYUN(7ealJsc&1H3H-94*@pqadFdNAN-_H6GEWjTD_uG-eIxy3qCs5*%{!D} z;W$~>^o<-L2>0;;ekZ{*g|>xu(TkV0B0s~_0e7|a4$ZnH6P{GYhk)?BW@GQRV49X8-OVK!N;tRgUZo)$Ew8q&1E1>->}C6;(ogRO*EU%RI2Y9Vqh( zsQvBsIKLRnx{{LxHsFYul3<%xgZi4x8F&vQ^Z(*v=V$%jEOw*%;eIwK`6E#B)*3f< ztm<679+(Rqg<==;BO8jmy*GyFLVn#pe^Hm}{spb!zV2^xu7;r0A!kQg1?K|Ng3kid z%DBlw@(uVciW^1eI_G)03E*#{)|s7aPUohpKhKPR}+Ikpqex&U~Z3dUIw3%(8gjes*Z_a+7t??=1I4oB`fq8gGr*P8GWwa=O&^ z9ndd*S%~zmQ}ibL$strUY-0pATZULn8k1I&G-0oN<`j>^NF-E`=kWqH;K?o|BKtI2 zh`+%5iGq6^PyH;{0MgI$4M1AN?7g{A*+q{ky&*crU>D4F9{zXLnW871P>0K}9avj= z-W13GnQkeDB%UnEWXWj$#{ts(PX(m;&jAX2@4jxSmEDp*D_?iFqzU%EiKIw(9ey zjn^zdPbdtq++@lQpqjBT@ZYGCJmSEfe2K{W@UGH5cfY|Dpt*S*Ywi#j3fgD=npid)oW&=P!c&Xr8-Nn{kA&Fn6yo?jT5z}EseLv(87=Z> z0clbCryXHnzwTYUix3B01pj4WRw85l(=-#CGF;cnI}Qiqw=8@lo=nd4et-S0 zw~O~3OJlgq{^?%A^%Fc!NHw#%X#u+c8ek z)7fHciRB?uPjJhJu!eI}0E2ZDyBp}y^bODupW(xG8qVS76~8-KUzOz;kLJERMSYH&YV7>>cE6}Y;is!z!PS*JfIl96A`Q3GvGY;7 z;JIYpaCR`puRICh*vTnf@I3y-h_5fkp6lFI9e%z-7Z2J!xEA>HunY96yA#BrQRzlf z1p8`dR)4yl*g@&_>00MS9zB6f+q62{Qv@fRPKEdxZF~b^n+cWur3bBqi)^ZsEg{|t zVodpXyMyzd+*YQZq<;l|kf{9EPDC586QnDWuJB~wXyb3YjyH1}ES^F)U8Uz*&%zVt z5U}|9hNPX*Jqms!rupZSbAUIZn#oTwfdvd)C8JU|gzlb9DDtPr<$yS?tDxp~5mXuz z0ej4hb4)qgt7703m9Kp_Vf66e%n$BuUE?w;g7GUc5!hnKwsC zu5;VJj5cPVLJ76}W5m!@v@wNOF*fD2Zdoq{{KLPol^?|3kw*yqs4~F3V6@Z+5`gIR0V9|c{~Oo0&by3MBF`4pi}WY zNTBm9^ld-~3+_fdxvCTi-G!%4j(-D)-)bcE2%Z|s3P2jlMnH#&?|XR01lkAH+E<{1 z0QD1SARrBo$_^R_&8GGh-|2vqt^rVg!BN9~fIu9sILP7hM+^N0kaDyDIzoJ(vAA|X z6v!f>1G*XGPGW)kd;@_NKJC`TI?cs*7Q5W$Q9L${mZ~deFJbc6DT_1-7i~NcMJfG(oi9fl zcN5%`ya&-YkB&C}3o!*v$VD4p1`gLcv0svloUo5!KKW?lV|a<9xqo2HlI80`$W4r*^ihE>hz(Y2?N~rsYhx_*4GXasP+!i%wEpe} zq?7nR0V01Sv>s2b({};sC)W-2z>hoXism)#g_gPZHW%Fq7OVf*BLb~_hHIumrscW z9c?@p{IGD1#x`Yx4cJ@2i8jV1R{IGd0h?^&O)SSp4*mRV@kG*KNzh(M)%dBRWNBDe zJ*lyMaiZg?MDB}Nb{!f8%xZh*99EMaIJdbbmS3v@JQBk%Zd)=}PemI!r9@;UAs?FP zcsBcdV%g>JEl!7h<;)?tv+|0B=w=ru5z#|m(D+itDZb{1E7`EJWQWhu*e^kOXsb3X z*?meenUgw?Jl@dke$xI%e0HD_cPebJ&@(M^8Kr;K>~|))TWF{oAEYn6H>224bdzyQ z8-_5G4RhzQet+}_+bWL@cm82~ED6^7dkbt>scIZfN<`vz!OL=2QmCL~cj7 z=n|R@WH$V4oc;$8oO`2O+4GpN8(T2ECUQ@HnR4FM)iDytwR!%`{RmX1Mo`atqqQe; zZ5<8k3qO}IgXM42$~2xYtZ30VB50N+qm8wKWob!zurcN<<7nei)*JW4p~oumrh!J} z49y0ODNqX^@Cq=u7erpy@Zzw-Qjm9UJ=)d^59y_08(5|GOJ$c>xF0@Ub$&@?Sv$J3 zEi}tQKLRuu|7xaPyTPaNu3hMJmhKG;?SXnyxrDW-qdk?uRTiMqwRWLX0mUU`o;Fgt z6@aueT@Og5jJE)(lu?cjqpxuAuFZY|QT0-xp%yv;kfv`8AkEvEfON&S0g%Sw0MZVd ziecJeQ=L(v7XbB>INk!JDfk$WhP(rihI}waPEF}CfRwHVkmh#=AdTY+>w6<04f%FJ z8s1%iG`xoZ>5}K)0clD<0i>ylMof5T0@64{geci_mb-5;Y8Y!6+N9%RPIiRJKoQwL3fU-mrq(McH#y9&#VU>hKj5-vWIR2J}IrnAiuWes; zp|_a3r;;F@W)Y1olx{ctmxb@Za}WIg@vwtn1>f}wEwnT-QMbiR-^J`MT$~q20ZseK zWy5tb7cXK0mA_of)l?b74!E_n7aeHpf_iR#wl0tPBfzo0e+Q+E!a54+}4S! zzahY{(mW8LVZQuD-_;UumrA9w;wIM)Neon42`s+xN}}L0D5B!B9~D3WdUo1<8lS-X z)c2Ci?S!W*dGDOWc^d$2@hQBw^flOtR>)i7)7 zWz=CrC|#^nQr!?fo+6@4CJKLm{R)Bf!V0PJ>cZfwtZDkApUX@Pm*k9c%e0es{Hwi( ziuW+DoaM?WX0WR@Q3-vvy+Gi-T*^f^Y*`9}lAbbfv4G*?Ig*})Kz_)8;FwII8#bz15bon;{N4|m?{HXv>yCe+3o7=> z`pd_l>89O&h#$JpmDtKZ0%7qA${|{H!l&^vbk7Y0_&8|Zap`P$Lju_ivG3dhnoD{r zFUMC6FKBG_0c7w;pgEO`LU7Cu>HG&`h-W-Ma%uQZCpUEs9U7<)^(lFpwPMdE;KK~> zku)BgNUQ6@nLce}Yv_?~9$)U_aq&%S%!Osu6Q`Of2k8<4P zQkiI>^8m3aL}WukKxGq_~!By*T7>uZ*< zQjv*b+05MRg;!LOPXZ1uETx-I!}O1fRc0L{v#xCn(~C6{y}heBeORvLWSHQoZFO2( zKiw_Y-tLs)?xpJ11;51VmlP^j!D_(cmT;ySB^%s0n2%|4EpGDS#nM_WoS0rHljnuy z-LM|9U_bG%iPYxHokRp{CyCtI?*$7>`JT>yjlx^E z1-s`H5ogSabC|f>Af3M41xTkaT=UcE%S(XRkwrpp;mMptLZ9HtzBdx;j?UqDf%rLbA`}UI z1JH>A(JG9_aSb5ly%o?&;`?Vn>?9%~p8L@_KC^Va&<&myWc2s`ciO$#)aU+JiTN9&2v;l}gbIhkgo_3`B zxoNbxW*nCU(sOwFzuXRg5q4x7nICg#Wa|! zn#4p`;Xfi7tr3XQh(hNA+FNil@l?9`fNBKyT|BjCy2V0w1JXX~&w!L;C7>Go8x2Um z!P7$oAJ_y~y!l=r)6Mq{xE8-CVyFm;tru7oU4A1_iF{&UZhN=r_j;f`B&x@iN1M6< zsvZmAQ#2N<0G2;DbarZ9pQB~Le_?*lnnLH;U?-!Yngd_w=CJ&M! zgybYMFe5V}B2p@d7z1*VXEGv1L<|v5rz3LJQfiS)DfL=Q(d$J-E;S)Sh^V}ZfK&mg z#TY3d)qp(m`>wsuIWv=l*8BOlzy3eJolnl}v(DP@*V=ony%sR?3H4rh2EpS!1;dDE z?{Zbr7!v>hi$Qdc$@Roq@uE&-^z|I2gqXGHg%<&rb?PLFOY;zNXrJfFio?Tp1eDHWCuX+(=|4YVfd5c45J z(`G~?x*=KXG#a+;7q#J8qG8*6BJ>eKm>;TP&{Lp%1r`rAW8JAbr*Hr&Vl=Q>=QKKn zlVjae1L@_YQ#fkH*;{KTpdXKwVs-Y`FO5CWtJb1}y0*pdI)%ed=>vP~1tT&LHC75= ziGy*Y-DAnpkp>dO$`hd8P&V*5T{uZ~o^jiC(tCz&lMZR4@JtnZJ>Y08g(Nsk+b<_DS>pZSY z4ry5n_)l+vCGeW)vEP)O?~~dv^ojEp>8L|GiT>PG?r^)HYR;*5PfK+OAEGAg(l=Db z8mVN5t*Kpyvi>JjemTrvqr``(t_>@HgHFI}f6{-t!`GrSoIq#L8VuVGQ2!ElMj>zR zN$;a4n7&05K(=|NA{psG&l%$`Nw5pwqW+`8Yu%10{aANa)L8f9Q99)0gwwF?tW)^w z7T?Z=$SzZ@7NO-%?NBR!s=7cu3#okm;hUyRg)#z+q(=*CDT z2~90GNX3xonS8_Hu}3vs)ft-pN~H_6OrMR$NrxFn+U zA_sr93H#i-Q26#bgcHaPOG;?7O39QU648l02Qeq3+x7^H+d7HSZIhOv$Fk`PHS!u# zc+25l*222#^K9T_9HCuFzYl&7IV9@|4C?(_J%(*+50o^?gNZ^QyU5$ztI#*5!RQ|A zcCZnRR-@sas_Qelp|VWVYjiubP7EexgwsGmvQUHSSdG=PB^(nC0lq*rVEETZjgf}_ z64L+_wsEoyd?x`)Jgv=tGCVU5J+b=)i4~w@gJGd>h(IvdX|)M&uwR>Wrn{p47ul=FHz%=Wgp~O1fR3jMQR_U0y;&alf2Zg$?K%wq$ zRb_ARkk-czO)m|M=;=)BViG;4CPBI0sY9gqjb5`->G?=10nb7KA5=%4>cnpsz{|5J z#PUaypqQ8IXG8VS@XWaBuqNCpnDHZvYKHY#k2+;ThOJ&pi@`l7ZCtFm8;jXn%{T5N9&7Ji&^y~ zn{(XvMv29fv4HSb&c^9rZI*lH?UMuq@z&D2Z7(wKfTpRK8J_H_SBO6hDPL0e%;QCt) zD<44hSv(~vqWM$9PpHn3FU3Tef-{Q1bSBU-!kzQa?po)&OBwl5C%SR-wY zJr@5u&1F3KmMQ`9@Ugubosp02pTft-w%;)%rRdKZ zAqb8x{((%XCKe-QkxFAnJGnwmIS|cKJ8mCQ)-clqlD^|QxCxxt#A@gI=1}e#m7JP-Y~eR;wYi+ zlH;KbpT9mW?+t@{RU9Q0O?c!e1+75Go3!1VF!J&g?+pXm%afxU22{hmo#;0l|5_mz zPs)z=zF*Jv-Y}qikPAmBUK=SKAnOUEZ6sD0jbYkvVE$4r4r6Z(Os4+4fnKhpXnkEJ-4 zAEuVV3nAaHl~?@om}&E>I1V9JmEt&r=48cj$m_~0emSJQPpCik!MWN8GR7}dUkxs( z=kImDA>A(?N@i#u$OC;Kk$#ZduMy2G;xPHGm$KQDm{-@#!r7_ zejV;m{LQNmYF(?Du3J<;qtQouiu%DvUkR&grD3Kos(;8;r}8QlPNR}fr3UE!1j6-E zL!!n{HA*?Ie~9ZCaXs?=b&Qmm%s#gyXd1>*Xd)N5B>%sRBUofo)&|Ok<}(b4_k9Kh z!5F8?BbCgAK!;2=aT5oSloB(XgBFzpuR{t)5iDy$D*S%c0wyuy5fo#3Fsl4$B1CEjg-zj%bVF&He6??ixA?IE3>yQTmz= zDNHRE;Zsr}?fwB};4}`?VA=!+ZC@Hi;cH9uer#;ri;$Hcgdt3VU2p_?VPa3s=Ra!!QnT0-0k)d5mSwCS0Yf3hfjFrGA_;=f0bw z|Ck+fea#d94v9+(nT~O)1dB*xP*^c z5BVYWkOLS9;J4zu565bBrY#($4uGi9h6~i@x@CtXK6MfF#Atj?M!%;v#^AVW6K+Y} zO4pZrNED(z>JW}gOQI;xLbp%Hzbh6W596aKU6-S+@r;T>W~1buFON0W^RKh)2#2Wa zb88FKN%|RZurP$K_ZVgQI?fj@(s8n1K6@11ue2`ZFaCEe03|1O9KC}*rj7RG{Q zNqtrnu8Glm@Ch?Vp$LWhh#qI7IA8!5>Oh}Li*JOb3Xb&}S@)^7`AKXDhhMnr- zRNh;5zovLB3Ne4js@g8G0qx%u3u0+jqmji*rOX4Ez!G^=d?YPQq(%~M$xZP?%m8<# z@}|J#bw!R=Zi+-y@&Qaj-t34%-=>KDn@vGkrl#m!TvUZmaZfv>Pbp()ZA>t7=ZmG; z33Fg@SjnneP=1+9++rE|=?-|`j|rE9!_7f^|*cUbB2#D{%KMg5a{ z$afgf^6ZWnXh2CP5QC15`o|J!#p!QSm)nbqCO4Ldeom9R5oRFt?nRhFe?WzoR}~tt zKFvvM%I%vIgX6B-H)kwzt~6&qBMU78+cmsZ+4SCbXi>iS(8}sPw5U-~HPuS(-DYeh zqULC>>pQk6cT}(PxTkU}W9x^s-cfI%(3jQm!8#jFqOCraDlN?ABZT!bSeRf0X37`2h`j8kis;uAx*=>%*rU^mLXu zlAwC=U#5||v~Vc;1Jw(P#?nHsqGej1(y(q?g#*YwW~Mu0-9Mr((~hd~@3Ts8pfR+h zP??7hAqdQq+?|TgL=L5@6$1_(O?l`t^3eNKT3Et6@e#0_*eZ=s)l?%`rLpLM;_

} zF+Acn2X53MFn9!O?O^zj6(g3bS^j66Dn3KR>{8>lz>o|w0B%%`WLc|YvB2OA)f95v z2KK^Q#!V$mn#&bTmRUNPrNp*S^_W`JN>W6n2&ZQu{ugime6IO`(%7E=Pc&?$#>N(P|%F%1!I z8cyQ{b*YyY>Lj60Z9dIvb0e}Me%m6r;$XT5xf5I?JD&l})Y7>MKSW=CqFo(O zc86-_jRVGUtIi4|KA=D-WaAX8bb|QR(xI8&19coI{~Vm_^ z^O)Q6bGeu}R6m3^02Yz}BMC>#CtNLET8nguj%b<4mzVLO3TxTumSZ*X58T!TqPb<6 zMU?j1r6VZb6L;9_j*(mt*aFWsL*{2Lc*@SJhG*7Msoeuir@)E>E0aW+t7-jHR%tI;F(UnbhY{2AH?7SV4A0PgRSL4GSoAEr(Rwk!)_Pv&@Qek=lcbZ_DYMx0 zxz@09CNNpb0#xs{;LzEs!M!jNRiJ}ej*i1;oA2RsC%$M*r=&!xO+)i+MA12rurwDULMedZLta!Q}e-!L0>N%y1QcA)`h z>ZK3Fumh9bXy&Q3k^!V@f z3MNsa3MR`sLyCXt%c#m`)T?H?`^#kdJ--Dg@HaJLcLzw0=q5`qdQ6q)F zO$C66#P6w)SDYYygb&9^jc;S84&j5Q_5h3dx~s(^Eg%7w0Ai;bRz{OB0B zLHne7>$GzVvhCMC-fz6V-JuT9`2AKl=3rLeOlX3MMo@jDvQg##_v$+m#|TtOPT@mT z$iJe#$wU&Q3?_YH_{k<%siJ|ACs#Tq9PGuY(#_tA?QCIvg?bEBMO3r%CD#2{K8WD9 zCaVTqxjnFp*3fw;{$U9Utt=e?Wgn1z&~G z67}~C2r94&w0S0A37K?;%GjxgayYenfjF7~$xFgZw-%~n#H!;;M(g-X}m|*tt3Fa0n zRTV;0UH{1`b<6X4tvh^kjXU<&FckP}odc8)VzLQ`F~9tp<`;-$ZDyr%3I|az$T(_ojT~FD>p`6mASn z0Q$yM>V~eN^vJQh!?SGe7^gdkm9{Gn2(IYf&=?gEDM9}#L$ykeWKlBgMT9s`@kB_P z^H&tjD~4idPDXd=Ou-`$wU^Fn(1fRv`6^YP9li_(n~dim=6f2?Oy+w9&n)JnrCQH? zU3k*zxQ?+_dD}#QtjcDvRQLunUk-dZ%;(D}0I(PTk|6(Bp8ZEGM$QY?3d9~D_ui@H z_j!5t3ZKu*v){wfWS%`S3&^$1diHZK&wf7#0>>zG5L0DH5PrdZm(yBaHTfMc&z@?P z99<*@2?IxB5#%Tl*aMP7EnIl+-@QD05&|OU<=Ov;16Vs~1!5~uY$qzd{H>Q~|D=ke zr1gLd3BfP7u|mo1_$(lr^Xxf4j3b4pIh-qp;yim|IS`xS#xLeQ&w2J>jHx`%P&E{7 zb;wcw@aIw!1niBO;DZh4D&l(}3#RSI{srNoZ>f&g*d+CxN{!U};S>MX4~Jf&`#^T| zfsE+``Gp?@_0x-Q-9OKjSZm&ZU&4!A`mr~aTacVT$m?C^LHdFGSd+KmM*0Tua!IL4 ze80%I9{&!%QqE_;%tSetb@S&wIK%hiA~>iFR>Js-3l`0uTd!~y|DN`>V)KY1BXe}q zkh&#?Kl;Z|=KELj6$_Oy$8vH%o}_)v*D-!vsUMo=Dr7}I2Hp{Q%Ah5S;T8L_DcL>z zM^W50yvQ1gn&J7QX-F(!J#gNlu?I&#oDVp{j}J)GaVqL9i;pc9Uv*SEzCg zPuNMhU!aUb?oecR2i4EX>@#SBFCA_cpTj2!3V#i}aD-=f3b?Q;LC*ndbHDHaY6W&_ z4J$wLDII-p>l3Q8g`r%QJ{DQG=#`I62=IGgpi*NOE3_EY_83;K!WYT1{WV+9KHG|0 zw5+*Kp&VTiIHC-&RIsXFT)UGN0Fc@i&u=XP*vUH_<8R^Qulq7?hCF)Aw&EHEY_#C} zYy5loc=>a{qBn7-7SKidlKROU%M^;#Tt}qRcSr_!=;3M&o(BkbW}qhr9+B?D(Xqr9 zWQQFn?FST>`Jz}e(hVJ_+p34=clQg_LwXK%-a@Ha!>_?dmWRHrL?X}VG>~IOD^c_I zZY7e`MOYx<_Mn3==&3l;;CQf^5aRvzOZe>`e$S;2LZdK6>tdDp(;2DJqjhpjQ}D49it<~d>-uRE2O zCJ3pnT!Ls=KOnhBE0pm+--`S_-=g0?N^rf#%Pd!lT5c=L5A|8OQ?oBTGobZ<+)2tL z{BujH^;lDPCHfwvcspI=$UZ%jHZEx6C=6f->yo>4Z8>^8u#r zhs_qA1p*%wHjn48)W+V%lxK;?sc0>1P=3_3n-EZkYq94r~pKofdp9I2~ikZ-Q?TSYW$`yQ%-HPFfKyrTZ8o69ZJ z*eZ93og};hAt8`(Q}9e;z6Ly#neWGVlCY&t^Y3^P@vPHOJ@ReD*YNSL->F||HRO1t zsfhc22wxftOMQs%HGd8t)tpX4x-g8)cL+X?_hsVt@es-I4PvmDRM;-~G8rr# zlM~0QhL6X5FMLM!bqRbtzE|PPWH2(pmc@KWRah7%VV*{!>bny@9`<3?w*o#M%YUnQ ze^9?(hA*4NoQXAyZ?Eo#kC$zp3i}Ow*$i*H>e~$;--dkwABHDt$bUD^nh?u2cH3C< zx{G7?r!Sm|%$ttm$gmTh!ThQTrI2xIJ~!=5gKtw@$gcfs-Ii0@kE&EnzMk zabKc3VyqK>ERlBmDu3kxEHv-7mlWeCS7k-i`E86-U`{mdOxmFReh-@eufa_xspv z??#$YS%7*s($os%s718`)hLx`;{6lv^lqf7hRAt0(v&lDd?QVB1yRd$pS^P3yOAac zIqydL6%JsdK`ZF-#_Nv8M}Yi|j{nHfR}MSN-npWC|IICkb-2EpTY~y;CJFKmJ!HpY zu2Wv|%OUgnK$iA_3{*1BLSYj}3UO2{9?#S2yS!~CecGyH8);IxtvVj+y85op%RWz^ zIisNw#u^);Zm6HHzQ9@a^XeBtKvxckPuTXV@jSSoK^0Z*Pik4&)+22aK<*`OJbn7~ zx`*d9G|rhm7e*%+(bbf!;fv~LE@)gdTrTZxRJn6of^`t%@4J7eG@0zMoTwrotQ;LE zXAiWer=HR9@a&n5Oka?qE2yA�aC0`+K`~Q=wT#pla3SQFqVM=U{i5TCfSh6k>R;rS*)? zW5bdCo}*u4(Q7^;;`F%26TTm;eFm)Y==S3_B7MRaPx$JlR*2xW9EEyR(7rG1kq$Lo z67u#4?^&f*>9BaTlZk@}O^1wmhiFHRd#=8MBaXTWdS~;ICz5cYZjp{OeWn$gz5@>r zY11X$mab)ZyiHTsTSh!O{~Hf+#b@9fEr(=*f(3a3srg&cU~RP;tZk4ikaS|mCDF4` z08wtaL_jeFm!vI{Ui2&pKt?UMIIyM0-6(~N9#IP}x22r}FVQu5T(EP!j16StP>5*| z57CFq3qcdf+I&h*aE~?QguSQL*7Kh0&#h+yn_7(6zOA^*D|AomXS$~M^h#}zKu>cA zDs>Mk^+;3e4SYZ)(F^;651#O~s8bGCU?Qrr>9SzSd(T_3IFA>aPH0GC64iR5r>W%( z$(#6gW9l9L6Fu)Q|H%7g$^u5eT0xoQFML(^3-1!EEMVTV>MUTB<4Y`cWpcl|(lOM# z#L}Wm&b!1CX-*SM+1ZV%FnZ?mzF{XG6Dvk&e__$GA%Gh#Rh+CNdt zzzxQKe`kDjy#4@)mJf(7=X>FdkSY9IG7i0yBQ0FL@hCsLz6T!lym!6_9_6Ryd*IPNaL@O^qxe4h9(cq) zKk+^AsJZ_1J@BYrI==@VHS2}%fk)*a?QXt~X+<;rFSMfhThMrzn4%BR)cY{Z@iAqy zA6lh$EI;B~Pa>T!C@s>))aZ10tP7ys;R|euyc%a88-YU)h6I#KAOAp`Cyv4@8z`>P zX=8gA*Fej7s1Nr#E8r0|T{SMB;f=}l2gOexR7+^hEjAAuHZ~929@q>PXzb!Kh-6#C zk(Fzc9tWpb&4;p6>s)}Hsjb~g8&eH_v3k(42@h-PX}X$W_{lo-RcOI@{H@3FO*A;# zo37s6iIuR&;M@;sH=AeDCDezSB38MT4NUk2P+=eA*eo@pajHup`3}m8vr3fD5YM=TdgjMiop0dajAlWi*SMui+EMcJq;lq?S&{n|z?Z;akKt)%zF*=wlKHmb z$?J5=u&;;l;kboubRQm!B@b1q-KnVr86rYA|5`GeI26u z>fxjF0i9+6d^|oEd^{}Oou}0S_CZzHf5BJ8V04tn@eaaQ!(i;_hcqp6y?r*a$owG& z6+U_gmklSd7%fl+A$NyH@QO$>)PIVAVZ>^~#(hkU8Du)uMrMa8<)F6;5oay_b*z9i z{p;AG&NKA@-v2*kDvo7Jo(QCU-5<67CH?zkrWy&;&PJ#CftrO$J~~CLMo7Nqq6Y9w za|0_is|kLPM!ks_W)OT97E^YE##jhiZkWcH-H`prBQ9fZc0=J~@I96nihgCxy|aGS z3?i)ZG@;o;8Z?E4BQ@D|_-nwahA)MKj`2??OxutKIa=|w0?{?pqtiBr|I$mC(j-LA zOPCTiIhx0{0#P{xxx2|Eal#aPQAYOx=tG#^L9cK`hH3>G-9)EcdE*;{_w45`K*)K| zeztRfeD*_q9GTQyK2zPq&wggIlx8w4I{Wdzey;~yD^NP*M*r^lkz9zv_xe4<@w>E7 zCp}t0DP`6#-+Y1#QBbJiGDXI4{6Y}{uNA1(6vu@qSST8Za16&U6tQ)+H1wIf_`@Ma zuK0k3D&|mz;}?o39<4xqkKDxnd8VB!K476}T7_dcexYb$_olVv(^s;&;sX|{lm+6- z5&S~o%od?2HgaFSxIU08K478b?KZ>l3q^;_T7h~9x!?Wn`L7Hbsv8zcK0IVNexag( z;jMXFTjynNT9JjKNgj^j_=Tb|tQBM;Tk~*bTS&AwEt+HC7>-}40f2gIM+jfUYc-;dc-qoG}i|8|k@Q~GYJC;L(y5X z;yC1j@`_&$S>gw&t(oYj86rSKkVoph>GM#uGAfQkt|_nh<ⅆAVc~~K{I{&?70i3 zH_m@#{^I&Yy<(X@bAjfO*$*zNZ)kXg9jGy}BBY_*`o~69iEe(w>{;`AAH^XPkIM7R z^yzbF&zrS)`lHIk!!zvvrfhs?YAFA5NS>Z*D-o|yZNSxwQ$x^;tDMdx>4aAivoZeN zJ@bfCGe6*?6FWw_Y3{}3BoAl56~(7P{Jj5^J#%rPJX7+dXy#5u=dtk)#6}w1;}(_p z9odl@i@Wjv19|$Td6wh(tIQ_q>A!$;R>q^bh2xdVBOU-a!s`M~vOE=e@%;4*(6LDt zaLB?UITf#$egU$yW&zGuw2Z;g%*WC-`CC_94)|l3lDg$-iK1nA<;C!M-D~jXVF@}( z%MhGeUegGL#lql8coyTMgAm}n`789RKmN7XQ$5LS`igV;a2hER#rGcc?`0Wrsa~e= zI9)Rc!D-FWX?kfQlW9flI!mmuQXNCbYfP#Kr*$vw5%qgq z!muk7hk=kPUcRWbf22h~QW%WP5S+j6XXK`FhIGIxy$^|RXa;Brwn+P0|AK?kGr{6J zB%*=4NftUrJg;nQNl5_heIZc`Zr~S)U(<9w!1W-ufWbtv^BoXv+@8EPq@fbWtYAJK zW_U~uO{WVxq5d-~`ee3q8(v=PdGgxC#R02>n{ElN0$jO*8bgcJ`9w5?t{%G8@iq}C zM?VWq=$dADGr{!(kxSSdJ!8@D>AHiZhV5l=SCrvROM1_0UAnEO&1U|z@lBRbWyfiF z(;B?8<*`$v@)if})1_;=PL7(m_!xXWT?d~WFFg5QP$qa>G#!TD2;0X*Tbh+`9Za+-4|?S-vQ8oM3nyP!(^6~Afv*02gFrEh}p@f zAxsFR>#)@3nTTtj90TGn2G7Ks-q%LE_&>iuPgJf(B3(p4f=~eVAW5<3IP&F&i7ms* zmyrwF?aP+4M3zEx%aZpxA13TJ9##KQ7*<+<;u9JZKm~hMS?P3|lHLa?zAw^u=v2s1 zW3o?lYG$77JcZB7$m&&(3sHj3H}E|X9zFhbOlpH>VI4aKAUZ^+nT{v#e?$Z2GuYF3 z^4|F(e6$|vG`~@ORR6;mY%qE!_m#spoWV%rD2Gi`VJ;QM#VC4d`iEX_+*W|tBWqb` z_vf~ssLHq{M+QgJ~?A}w<|4XqeF z!*{^PJ2a7MM9k_mkKjpb@@-5L;CcnAvXu_189qf5p}mxj9nA1j zPsBSf^+WLSQa=hGFZGk~@lrph`ZlOOK94BV0h@C8j1UJD9@YQtJ^3*7D{?ygYX$13 z1Xwcq)=|DE2jQs70C@N0-vWmm(HUBSs3;;7{W<5fnuU&S%9GX<|zrciv*3Pg)hy~IqM@Ss;2 z;ZNmI-ir;?k;t+Awm_5_)!|PXerNV7Bb-7AaHNco))|e4CRK9b`1i`RWI6}iyvhi- zG7Mj3g#RW(B3LN-h5Zmja~nAm|9v1#9YO6ELuU`3pU1oaWKOB0Yex^7c z51n@^jzefStT+y#KB_pDR^8kM$~)~9k$PWQlwS7BfYVDl1rR?Cg*>ei~8E7QsbJj zsIG(%p>^*;*UUbFX≤Q5d(Nq2Be-d^WoMKFNDRKNzyavcRLj8!3Tf0wPKl>9cnu z{2;OlDH(sDPl8@dh7w9?*4Hig{`=6v@)GYpl*Wxl^Gi$+G^dbbx#Hg2KL08E&>~Z@ zZ-NqD=)OlF?^J9y;`>H_UYr$plYsMc8IR^mzRxT4i;pIpw}A5&O)zk@7;`-T3nUi6 z|AJ|@h$c-qik9Q~n`E*9J_b0?^ug=3aimCkJ7u4D?_}?d59uIV)!rt8i7m>saFewm zg@&Y!kQ78vTB{X<(=xp&jfvucq%nG+xCSbrP<)LFhs8UXfmUiWSYfm8j1`y4Y9eggCSkjJde1L%REY^h=#bI zFX!CrqYXSqO@eqmK1ulVS^19FNq0`k;yJV;H_#VI9H+ zE@`K-RiMxH`0R9#h2C&7Mh?T`e4j#}?x2wQv#@tL3H=E4)hZjRrmv*%w7oV8^^B_& z35eCtCb?lHDa8TBi?ncqLCpGrq|HBS+9kTGnX=Zen#uQ$8=;MBfosnrb|a%xA+hgZXG9!F_a^!+p=FzF)(~2Xs4pgYd7@9K|z}`L5!b#e4~Z za)M9<-(Uv2ONA{^VNb(HV^pWv1Ru}U4i!e4Ky%sG)9Tl6)UTl!M*M3Md^~Icd^|p~ zNzA|Ar+y_%1bHmJHSi5#K2r5Oi1`k|$M=xu;Nuh6UsWI5Lio(Mr0fjyh1*&E1wvCl zNRT&0FiTD5_Y6CU(CDi#1B=mASah#Q7T)TnLJR64+8 zn=Xo5qNWWLw}3#@9p4`ExP4b+R2%44JXFVD{*eN3$K<$)UepS-2J7+v)bGC@ z@8vU|QgIZ@`Y$qsmR7A`r6>NEmJ~hU6@dGzilc;@B}1^-Qn?U>dcfw%I+J%#Ggrk? zLcJ(Mf>|h9t+iiG;e> z(R_3aFXc{x>B#;cusoia@y^HJk?xo*a{h-LG_a~Q*I%Z<& z%0}Yv@w1A`eeaFaxYB5TgCC_&_|9Bv1N8FzQ}z+2B0swSGo*PB+IoDI2TD$jZ$v2v z{H>>Vf8bqJKtMx@9vM}61wmoI5WEFCK>mUvA_{5~ejV;$Titj)?5M1U0;?M~caYWX zSbalm?M$~w;j3+samOXx8xHfHM~C=}fkP?R4Jhog8h-U2snf#^E9fX>n2Z199v~dS ztGV@2?+w#-@dhPKIQX#ml5{^v9lol8gi*Y7X2^kzRpPha(dr$Cf1QTr*?8vLgC{@D zdmlc&Em2Qxd)qJtGs&>}0`Qoz)(@d*7l3CpXdtV!4?>n=>%~CPlN#K+qNv6|uQi=X z7rQ?doBo_`mA(;$y<+QyK&RAY?}q9ygQJe<=lHSidsd(-E{nK9ka6@*PwZ1;rPQ~_ zdBRul%IPpX{Sso6rs?qQZK#5}ai?b#TS%OqDX8|(VP*7vXWm!P$#X+F`5)^ZT0tDH z&uiVOqY(GeE=x#Pt&}>Ff+Ok*iW(Y%@c%Aas$=no<2~U|;X{*qnyzc4LYeyWE$Em^ zB}}I%mELuS>D#Vx2#&0^qIm^M_l#8%?B>IdCdz7tM7b#m1@Ofe`)^7{dvZxJKe19f zQs&J_2cmrcSOy<&yvN|(1CZu?g{^y-P{44sdjS< zbe*njHLN^{93vLQ1q(Fu((qoII}Yk)NT>L^A|BBIjSdpexv z{jRf6zv#?+&zASGt?9cPkH&RgL3Du00K=+t?EQo@?+|W0m^x-Y3oVh-82403hrx9; z9ojipLt~tzBamJO!QvOe^aKl6VR*eq3MW{U3Ja(E92lUNC@))Vd53Lzhq@XZu&6|8 zR-4XUwR#-FnryJaXL$Mv;B=pAI+u^h*h5 zlc!yhma6+@(x;{DoxM}f5B#Q{F{n;H^}LMc;Zx7=;Nu-E7%MREU@`FV4(3ah0I?TU zPY|4d{sRqGEoCusDgnx`@J94PmnUJp~Zu4UAeu{Rt zQZUC;6nMj!Y0DD9FFg)$0Bj#2A? zUl_$tAIR_9r|G>v_fMg;dr`b3@cGAHiC0J6Rb5~z?*;AW6%=m(jsODD55pka8V!le z1ROG_Ly9F2XF3ItldAwLxfbH+cFlOrMCh}ap{du*!V&ab%|gv`O_N5_xHT_m)@e3q zHiOrN*FSvxI!g8Tm@Ca*#^}=Rhi?B_2UDzS)5?X~0;RE5Ia8x)goEN%; zD?+z$QwRwN3rGvd3>X$r9AFNp2oM9t1xyH-955wddO&@^?0`7|ivv~!GzF{*@B};; z@It_*fGq*92D}llJ790X!GPldp9Gu>I3I8^;G2MJ0fIJA8>3Cr=4tb_rP?xWg|<>V zRy#>MMSGuix^}L1p|(N0SnJlV(XP{O(!QeIs(nMdQ`@dRpgpWTu05^&TzgsjjrO|s zrZ!j?qBH1{bSb)QU5;*;u1Z&{v+C@+@w!R6X}UVyY~6C*3Y}Z`oNj||v+fn$>$=^# zR$aU91KmO0G2K~Rm+q#nN2d)82@DI24vY&-2uumg3Cs&D2%Hc&IdEEFec|M&LVv9f1b|4+b6%JQjE=@O4{8c(4%!g3DQI)h)}Wn1yMp!xeGqgs=w#68 zpvytsLDz$B289I21g8h*1eXO{gU1Dr51tS_DR^@5jNrM!4Z%x--NByV4Z$0Ow+HVE zZVT=R{vh~Z@X_E?!DoZJf-eMj2M6j6`Z#@tK2x8g&(jy{tMsCNf_|cYihi1Yx_-8P zp}tA~qJE=(i+-zqxBeY{oBn|Ql>QU_S$(JeqW&BGHGN=6a7bE6W=M8Oen>$`X-I8| zJ;WI@K4enJl#uBmb3zt|EDmW7kwVslycn`MjMzaB0`Xd?^}F%jtz84>vr!y+mp zsv^cmOp2Htu_R(eM03Qd2zP`hVspf+5j!GwN3=(DM0^l&G~!sqsff=b&PQB{xEawC z5fYgYnHHH5nG;zMSsGapIWBT?t}l$P1AdBdlAC2p0eJ)R z2bczw4G;&69WZgg^Z^S8Gz?fWVA+5*1J(`LHsFl`+Xw6%@XmnN0Ur!FJmBSYzxl<6|brOpBQnGdpH(%+i<@F{@(SF>7Ox`WeJ12I2?7~=AtS5GT?8ewlv9HJO zh}|7~Aof`7x!CiufpKAR(QyfJ>2cX{d2#u1WpR~pVq9&UJ#KnjecY_LIdRM4md7>4 zt%+M3w=V9*xb1Pf;#%YO#(fZXJgz$~I6fra5FZmC7oQZL5}zGk9B+=VjJL**kDnAj zJAQ8b{CHRVbMfoqH^#pbzb$@y{O8F=1LlUBcpor3s#d7ZP4f*qE>-;f;iy3GXCyBpgUMmT)$qGvP|YHwirn!HF@6 zX^EwYWr-DuwTbpbXX2#9S&0i17bh-DT%OpRxF+$%#0`lrCvHuABXMV9Yhrui;l$&K zClgO6exBHs_)X%?#JHrCBvVpxk~PVmG$HA}q$No!lAcRim$W`0r{Sqzg$mleEc!$A)s%gL`M zZ%uwZd1rD*^12ol=luN-0aJND))Uri@RSlrklyK4nfy zL(1}$rj)fQ8&Y0Qc_(FW%HfpbDJN4drgW!-q{gHsrRJpOrw&UkPOVI}rjAP;pE@bE zA$3KnJJplAK6P{ImelR3J5oDR&!%2Uy_Oo1mXel{mYG(XW=^Y06Vt|}O-!4XR+lzA zZDE=#ZE4!Fv{h+R+6!sx(>A7UNqaf%jkFzUd()1mok}~K_D$NgG+|)yz_5Wa0}}>j z56mA}FtBo6ftv?>%hGO+Xo&P_{qR?11}Ej9(Z%0 zkRFk4NKZ*Or`yxVrB6tomF`Mkn%Cwg%W12C?m}eYjEH;icI*k*I(~Wh;dgE;4V&gKSWZYzY)%dz`r?Jhr*Lco&-gv=y z(Rkh1V~og%$tcYbGwd1TGp1zRmoYt~A!AuabH)o9>oPWFY|D5fV|zwxMtjEbj88H? z&*;p!obgS@^$hKxkU@q)DT6WwWe>_9WEx~1G;YxNL3M*>4Qd$V8nk>+^Pp9O)(+Y* zXyc&GgLVwsJ?PY+vx7b#bYW2UAZ=zyW>{uUW?p7NW^ra|rZsay=ETe?nRS_SGMh5j zWWJF3a^}{|*E8SA+?&~vc`Wmj%yXF+Gp}S`%M8p4%Sy;f%F4^C%o4L|vz%Gevu0(@ z$y$=NENgjIbJmMlo3gfLZO_`3wKwZP)(2U~vrcAxl65-ko2>4v>sdl}aCS^~Qg%+Z zDZ4VeHhWz5c-&!Ik?qNTE_+?}hU|^muV%lVy*vAZ?1R}Sv(ILCXJ5+>92_>-FgR{- z&fvVkrGqO5R}CIFc;etGgX;&+9z1{W(!nbRHw|7h_{G5+2X7tx#^AQW9fJ=HJ~sH1 z!50UAGdLk9DW^22EXSEMF=tZF^qe_4b8{MU7UwL_c_HV;oDDfI=WNS)BWGt$YtG)B z!#U@2F6L-+gL5NtV{%h+({nR&O}Ul1Rk`-u3Ay*>PRpH_rLp~Vt$&hnHx`tdHa(zfleonqAzc{}#zbb!R{`mY!`Lpxq=FiVxn(xV9 zm%l!LbN-h6SMqn~e~^DZzbpSr{(Dob?ihMt=)s|${FkCx4czDF{q~Ynqvxg5GUOc>PxOsTh@X5pP z8$N&dlHtpTHxGYq_`2a6hHoCeW%%pEcMNYG-ZuP$;YWv`AKo=Qupp!$tRT7|ry#FD zEU*@gD{vM}D41L@zraRAx9fh6jzi`lvb2iR9ZBpXj)NS(VU|BMXsX7MN5l3MeB<;7QI}wwdjqa9Yq~Q z2Z|0B9WLrDx=?hb=vq;5advTjaY1ouu~@SZQ%-MX6Xip|rkqe(A!}#idJ2mzAz4^^~qDU0?cQ z>88>hrMpYtDQzn~R{BZl`O=G}fg^%PM32ZEVH#07qHILP2TJ!JKB!G-sRh%mwC3vuJjj?=#OaFEKAOH<{h$ zwdNPhFPb-*Up8+uzhT~Ge#iWQ`4jW!<}UL^^L4X!WX#C8k?A9IM&^$+jT|>}!pQqZ z){UGsa_-0_BUg>wGV+y?J4Svm^4Q3;BR?P6HS)^HnYfE4EhbsMuN2R&k)>aK-V8vlZtmzNzS`5Jp9eiXN3P zDt%PmsM1ljqsEV#IO@Jp^`qvDS~#kClr(DHsFz1=AN9_t_ECpNeKP9wsLP|eM`dt;dZ+4xs-sn( zRCQK$Rb8&SS(Q?qQJr0#Uu~+cs;;fJR!^&*Q9Y}AZuP3_wbh%eU#Wh*dPnu{>QmLH ztGlYZtFKjuh+$&17$;_k#bT*gAy$b~#Cma#xL8~&J}15^?htp2?}!J)^WsJEig-;7 ztO>43s!6ZOtjVh>sKFJrnn^YH)y$}As99FiRMT7|)vT>qSF@pJd(GaO12so$KB+lZ zbGatC)=-;Xn_ZhzTU=XKYpxw%JGpjtt-ID!`&{jo+E;3~)o!odUE5xJu=Z^2`P#19 z3$>SPuhoWF!Ym1vOiP}n!ct|iTESSDJgSn4hFElrj+mQ9u|mRBuXExRr6SUN1n zEvGEkEY~f8)@W;tHQ#EoidMUIqIHsWhIO%ZnRU5!jdinit96@om$lvMdyav_t6t|y z1o_9F%_%2e^ouhroL-RoGWoYZ=Vx=c4mcMV7MUX)emssQ6HwK5AU-AY}Q5jyDuT%n5%L1nm!Wn-d(Qr6w zH-=a4e^_-A@c3|z<|6*d(FrF{*W`O7$-eb@c)7E%7UvFtwvHB1~k>4;{mN0%&#I_Q7&PJ-PI*v4!+4qYg)E6dE-g44C1 zVzmn3Q(YIM+pLB+kC?s{&DX09|Gp1U811tNCoIt)StJoAgKEN=H6sWYF@s7lyenO@ zM#FL*jAr6`k@*r?4kUBDM>JLeM$KTA7YV^E$_b}*!cN&oWYCm-92&M^>W>luL_{j0 zaMcq1A#B)D=@6z@zD-AjZk}zja_W<9=~nbUFfYtxhOdohSU{Fwf>(?pBT$rQq`x0> zQat_rR_SAF^d8f}&c6T7qC|6t&W>w#p?-^g*BovuzxH{ z-&vzSCWFz)iTOLE(n3&-0x}Ov-4^C8eR74^q~qv!lqqIexs~S$8M2b$-WqhgANJ{~ ze%b0(C*Ho&BG(BG0d5S|T@wZSjp#|2dRGbz(8A6P8N_5&!VQ%oud!++GK<6bj7n7U z%WPt@5JxrcB1(gqd!_hg1IPHth86VX$%dl=p-P0|V_fVNVc4=JRT;a?Xe_=+hpf@C znN33%Mi{A~Xy{T6!jd5yx@65$DT22KQPb3{Eou?0WWAe;z|F^Uqse_sK=?;7(y#Lx z$M|H%xDPp{Lwsx=!cASd7k9`mh zKP0o#ep9Scjr|SgEO!mrUZrKB?_fr)_zoMj7W)~@Fl8o>W^M|Wn-HbZ>^H&7qnW06 zbi`cN5r0H!^s|b@(h%x@6(MuYens?4L>-%a6&cF9V-1;q^i5{h>DFK z-i+U86)8c(^OSq7A`r!~m#eFY|Lp>9+REa75ay-+WO(LBpjfa{+T13Gd!!YT`gJYs zmZzCKR6B8Bq1o&PY=EtY&+eJ56FpP2dTgFMbr3gUOmoTd5)A*{&@TFsvsfLm9ziUUK?3m}hIk>y^C;P{AQLNV8oIkOI3j}udtM93gY$SAnwqi`Ug z_yN#k`kEqK!mgc86{m6IsiqchdcmT5GDXz_O#)7-l~O?wj*un=vKs5YH{329ao-F2 zW1#y9SXP7iv^FNG(Lty%do0rzcHs~s&svDsfB{!&3^R;t!5tfmbf->=#03l(6`M>% z%x%+3Woe<8-XBZ0tlf7;!A7J_Xthf$HK%a$wyC8uqEZ@@h}2@GJ0Y&oPWDWVA_T)w z*D&rHg3an-2V7nNNf1qKfa&7F8LNLB>J=mTIS2ZP zkto90T#SS^RFrCK>Pa0JBjH<79?UC7a*rGj7bBtV6>X^=Fl}n(VkEu-+up0j3*=DL zBK~zqklTroP`fCO?+HgJulVJVygm>rh2l6)UlDgnLBQ|rgimJp;V?0g1xr*IkNFAp zo#N^L0D!jhUbO##x3_4zB884LNFtmrjWUf&iug8rp)Xzl>zG+`6Y&?h=2=GnhCB-; zb~~G6B&*)r=9miOHpeJ)>hZ+ilV~X_DK>jgC$L?I8;Smw$$bCH(}~hTIScIPOFZcg zs;}dx38lUu$dq8wM$1p4r4^348b3|&KkfJ<;LCtBMed6ccL*uyhK7?t zCeWaJ$bh<`c|Br~4oz!&8w*Ykc}z#>Np{s&oWruS+;jxEU8zL7s4Kteh^_lFq?&I* z&hS>F&DQ!EY++m0-mrxnf_+h1iyOlkPFDys7;QSzeOW=e>P2$xpbttsuD3`BX6qRv z%h<|U$WN{N9=}LKSfo6c-IwXtD?{$5F{a&mgK9>#rLyvMyg?SZX^CFL1?r`vvM!-_ zjQEt--hBenisv}-BzjH#JnpD_0@c^^#1A2I4~yXrPyG$30=lZuBsK1P-n!~`-f&0{ zWf?&RIu%iQ$b!0qY9z;7SM5Cq?GQ;_{0CbdyTbbfth_}wJq{~QuE3uCAUULKN9W#P zQjuJu-r{!MV0RGv>Zuuxyz(`WR=yol|)@HLRg0lxC}BZ_L&j?gE=^Lqf~AhOn?2m@Q(i$O+zONN(& zg~Wz)YzgNUtQ~cWA&+`#S%S@N=+UjPd8&oRuC7)(McC(hyDOCGA|e0pM9;mX6iLZn zWDkk!Lz&cNNLP0~3z^iP3__-8rO+`Yv3v!efOnepb()9p$`qzM4@@*42O?bjtC#Gk{`my?;p-pVSOsc0vm*^f*_mScn6gFL1f1mLEkfOJU(^3TW%wO6>(lD#T~CS!gpv=%4DAD%)d%u^9|-j&#q~$t^-HL6%0>ysG^>H6l4XWLRq;!HbG_u5msSIw zqPfzaokKKPzjyd3GNv3v#!&pq-9ul^AwW@*^2##P)j}3XCH@rR(2IjBnH&eXSHzY> zq4#8Z{UR@m>F?2SCX=buOT$s$fp#`D4lOq1d`BmT^nLzQI80@JB$B2Y$r6X@c|IX{ zX{i$b{21}N4>*68@#v?Tq?e2QNHfMJyd>i&F%VvFn+w$3_nVRQ4)B$t)n)k#j{u80ja%v%3b%6{#R((nTLz6VUfPAPx$^b1drh#xk0ue z4RU;Lu7;0hzTx>lJLR35?*xRLcWzeZ9>UcMMm#BJ^U7bU^3KgvbL1Ef^AQn6j?c}k zojCvyrEW4*2+gLxeS^=RKSds!lbsP4Twkl+8SLq`zw&^{)- z30g-F+3~LB+vWP*kSe2J38q;EpUjc2nKWiPayNaZYhE36`u2k2vT?)wc?}x6KJm!> z88A45H)wHcghiQIz-Ee=)Q@sp>=OYgPMUY-FOoy_x@kf4(#(4AwDfm5-$g}b<=%OT zuSMUX@r-iGe0!!^*j}E0%Dm*SK36jtY0}=3uECL`cH(=y(qaaXA2dGC11D3SBUC(p zbwrF_E5k>tj7QP3_{{$E*UNy92hO)L9sgbn;y0T&E$7kj*(8;gZj9bPI-j-q~1@*N&s0GS+F*MiHyqG8=0%gRHBl@}0!36csOxasP^-o5Fw zU}&7|{uqtK*cIxYA3_SrxYsvk_0*6a+?aKk-*bIM2j0>iN8WpmJe=ZRz4~ZPrxR%+ zy#T{gq~?XCe)tQ!=dK>;mc?~kT&>j_nj|FZklyPg`jruAXq6d4g6?0B0IF!K)`+!-h%?Ujg!<*4oB*xO6a0{;!1iar`Jwc%F zHwh2`z|GYY0_>g%H&7`PZU8t%Yh69%hGq2x6tGoimk!%;McMURraFq0;KA$~IFEj3 zC|amJ48!Yh!`#)oiHlh`-|+2fgoosxaF z?oZK~Y5t(^gB+(nXl_Rr)p)KrVKJW4C#MjcUixD_|G;Srfo6IN zwd0o?qP+CSMis}%zVbaf0Xh9aR2-%7(=UP}`=dXUP!9ly9L*nEfmQ*U+*cnN{2$)E z;Y>itc@OAUaR6hPXa!mm$onp{tG<FT7^Q!Iyx49d0Bmu$8Lsm+*07^>-@lJ@|MmRGUfo*J=KW zCvP*q7FhAsTliq}{5I=J{94>w{{uhN95;D$tU!l`P?lZ#1A3rkwX=*>4B{SQt$Os6z09Tqw zI#me;Cdiaf&9^WjZEkBWomJR1s3#9dr(c*95}zeD%t2UFk4?R|sW|HqSEjxbKu?SCa8J%A}Ga zb-Vij`_@`$bd~-e;@$)c_jd c*YyS z``|Q;BZ;>rnnaC><}lGj@s5Csctin>cf4=BHHs(ix4LKcK$7SAzwhsT|MOvoo}TKf zx~jUSySiG9h3$ePNcIFOxx#B|z|BU0cfyxRf^!!8UvHs=o z9jQ-Q!fY|noV9+jqwN@%>_;nFqyn%8^90BlMePKN1#{pHI-)K*!pGjW1;|dFCAYLT z`%I`Jo9nL40Ldp^s7csbwA=3>rq5AThNHSbk%+@Xk}jN2K4a3GG8n$1F0c#%NZ#WY_y%m;sc2jxamV`Y-r!EYmPw&&J z;7VIWb3P%t!$YYEah_OekNX`V{t-sRz`3IZu**NktO#*F>4y-1`!Pa1zex!3ubtHh zaoM&LA^zQS93h_KB0@X`dB)&8TM@L&>rxvb{&pZjyxe$%cz#O|;`#l*)+^TnA9U&P z(`sl$q`_-#n}jY7y^>@LT@JnSQy!t{l{7xmnAo=6tMd-Ma-ki@k7dn)v!o$Lfop?o=_Ed7Ff2a&D>LK;w zr(!v|Y5@%8Jbd(UySB$uxvmuu%=i(*$2#(%5Unk#7f*FqeZ+qrLw%rLJf@TSi2o(( zm5OHO06T*qwU#F32Tq2kZ}!AgKRAh`xKS|*wJBA14d8oH(>l|L%+cz z2am!5TaI~F%4x{RxbeeSE<@0C1YK7exCTjCVOkC`dqeeM zB|F~08A?Apl-d%45z0~-0|(lTK>p)QT`Qx}$rCwoxFB4DO45ae{(sa%i_NU1pgu35 zdnG6YKx!D%8;vajm8!CTM6X{1=BWY)w&QRun>&LE5qP2l_d4N67txZUue#*74)Fs4 zgJT!jWiK~4h({>*?@&+^z#Qca$GDl-ua(P;-V(q+01S?CV3)mq*siE##r{!k=PNL3 zJj<`SffOJ6g{~6z08Ty8*^yt63mkFMCBUucAAgSeVeh9sGXyBV!+^P@z}fSItI6VU zw+V)X8ZJAWv3UTG;djcfEMRIDhihRlIK$0D2L6EAs!a7$w{ZNqPMv;-_yWMp^W>@R z{pR{PBCN;jZvhikp2OMu%@F8<=O6HTJYZ^6C)OAY0rvth zzhVZJE(ct&%Zzdc-em)3ma+)pfHS(_Wfbu81z^f3VwcF8;UzH8rGKN5K{LS2Cxqi7 z(qV80*ZkPa;%a{Qz_W zKY{elsx~RWBK7pj4)uYdNa^f$)ik?^QVQHvjf@?Uts13J&sgx&37zbrScI%B?v0sW z{^5toWk)qjs6!PCJO@gXFbU1dXNE4&nJ{6exO{GAFRS<*Ha;n351PrY5kJ{Sh^<5( z^x1Sax66fT5N|2BH@7J6*Of`~M##1Ut2lMMQxnv$SB_=qag(dT&M5&vs@r^i3KH-) z21W3q;kjJD5Z_ltuuXB#iY-&njeMEwtx0W!I4kO9#i0ap1-y^N(b<@Fm&#c75vB!} z9Mjodywoq-l56ew>QZ~70a6n+>4bRPc~epma&8KF2~>=^cyq`bdr~mkGYF-lCSL4I zs0$u2@#+J6Wt@zK2P@8=)Am9&IVMSyHzGPBZCYJ-_<^?sAJr$;K?F|Zw#uF`Tps6c zX>d-TSOIbIld2-KNk01IRj5s9JUj@dJV8j@0+qkW7M!jB^M!QG= zuqRkm)YwJrMo;)RQO`)ylJt6}epUt|6i@$!tZ%7ipCi(gHZk5R>*`vxAf{&)4Za-k z&BBjqQYvYcyVb>VhledKOk16+=@e`Gh7H#WoAorys#=x#J_yB70fnN)~OT zdnn*6nRngsTAv>2V+qcSxx~HVTX4ETEsGrLW!Z-+0EIm;(_XR65Rut6acA}1?u_-B zaz2_UJ;CPwCpX8T<f7CqNWo{|ZmZscy+p(#d`ZP7<*O*cGz;aHk53p0+uq)?N)s?M zj@g&z6j_!S38h#hHyd_MGL{6_sD#%Ym9w!5GKRz=kU~hYKt@Fy$lE4i|Dzoz5K-9YfV+ zE&Kv^(rpxv_zV+7?8PymVpiNjjPcKJiHS;lThiVfV3DS&KwtU=v=!rN-jmE)_&PQ` zanIDJgd-k4L)qR2)n-tiO#W)sZ)#$;8hEzJ^&_yKBDo^MR@nxTApK!2+N)2dtclIg z34czoit*Fx`asm&LLDt>z97y55a(a$2~g%=Bsbnz>eDCh1h7@o)wSX%0Q3biFVGQV zM@S><(IL?RQ`!ci8M3dvk4D4h8|{mXqJ7(q8Fk}? z5M>W-r268g6YkjKLI}4kj&(nEp|hnWM0dh-CK4yoimG%}k$|zoY;r3aZu(nsXpB`l z0^8cyZdO>qT7yqaK*MK%7fhD45cEJ18eYU3USyRks2#wCDX9d$XpvQ#frfWtY*0Ev zn&F=6%dHq4ZDYGg>f37`gV4X!oG~#@<2&fY#IciXvXN>%R;{(>Y0MzC*5F{ObvNE! zFHr0Ayw>NPYOSmgtFo*<6J&kuRey_d@C=ZN{lq?%P1&|6`+0-BZ${hOKuk&+j>4qH z`=P|v#3-%#I6|I*4O~xS2B=MG&70EYziJBP8wq)ke+8>VO{rkjc0vpE)C~?%^l$AL zVQBI8>CQ_<-epTzY-~`x4Q<+ zT#RFiQB|zHCI7+?P#^T4Bm>g54RJ~vMk#H0IWZb-fLwRsiq8LK8$enma7Ax-x72Cw zn#=;Pe_#;OF*$Kf`j1T^d;J@J`joUcnleLa3J&mL-SJ}LNHhgf(WNQy0sUVwc)&k2 zMT@4mNvAV!d8KxvHu?OYwh00Xy1x_0>y!0t@MuZOax%?>sSVP9@;BkfsZl1zH2UPf z2pj)Z!}Q6&0JeDJpa#+w3MRz5xnsztM}M@?jRym$u{;=*>J3KY+Xf&A2U+Ac(AT#h zQz5pO1@`z*L0?SlY)hMar`rf@6SXsn>5iqwYLGiVQ`a9X5R2hH5qts7#PzR9Hxm}PE^wo;!^hy zdmK$<7L&vdKjC26k#$3v?|52`yTBJFlwm}lOdt6c`0rk?F&nO6S>!@NJ*R1Y?7^_W zlesCiu{%aq19r8(bk`@JLYlBN@2jYQup!7l&nmsL9=)>`J9~E^#+-adpDZZ>i9Y6S z%9sr;p417Nmw`X+3s9w@$g>9$cL#AOG!n9BxVR2JI^iQ45A?|s5M={BScA{o^zB{% z-8Q}D1wO4*t4ew6vEmqT) z3{a`*J@(+J>3R0dYO0@g6yG$wwmFFYZ)>}pvT&{K%{j;kh`Je1@6sap!UV%y>{tbB zu|uhC9AmK`S!nAEu+^H4o;KnfOYnIM$CSkxQ|hWIjrmwbMb~mH6=JX)D z{vl&=S;1(CdNsyRC(w||iLwwOPJr|w$>XS(dE7C3Tpg&rJkEj;hx>oMazJYsbdeUV z)sPBF+V;e>oywL`=Q(%B$^p5|r>hixT1`*fDMFl6dZuILV3-}okIgX&LL0!)#a9k! zSSG#y_}q2R9V-VW0>D*TP*ag&MOPX8w3>Bv$8Y3YH!C_UQfO?U%VCi+kVmjtCaj2{ zE|luG)c0FCEK-KqVbroFDs}e28?A9iLSLzm-pTKYJk%M(AWzR(@Nvj?ws zcAQST8!>cw3Th3BbLlFNpQEhY6?ucpvr_3Dty9uf9;v8bFe9qOR6y8~>h8hHvn$wB z)wRQ@sX~<)y-TVkxkrZS?Wx+?VboMbN(_AoYvD(m)7FS1np$4=RO%U@UV@rxj*_Y( zOGPuURP&F%{Vl7aJ=J_WjGBsgmaa<=)+4b9 z>8KmkoSXi$L#G{>p_S9PAjRa)-U36*;xR1)i^Z^o%sA{(dE-r7^Wv~^*k|opBwONS zE1YoG*L2LlkDK}ZXD@ugErNpqhKs!LHDIK55sa0f5E(1NL2xC8{;%vsXw}N4ERsgk zXz+Hr_zF%?3#TY{GU&XL;99hB$&f~)O(nrK4|G{!qVWd@*t=Y;++cOA<*!Jd=avN5 z+;wwSZNObB2``0;# z7l}}wU-MuVq1-y+e-vO=6o+db6yyxo1P^qU-ihLHEe$Ssrq!K`3XGbbmD|#FWt9?n zlj`GiF}PN){s}C2-?1dPpa2&-pmG~%IM@0`Q6f^)oGw;w3)eFQX}pOl39hBlg|g}ZZd-|PtyHyx zl~fP+vn9c`a$V`BMrlYPbh=pmf?VrIbl<8ZxE8@K^?Mg^JxhXfUDy{WzZro0T7k9G zvoXMhPJhCS?@P)rsHF=Zk&YAvW*<%rkISB4kn7TU9A1o9U^t}0N3L!;1RLOPkQ(ZA zF}wu2p84Jw?*l730U^lXS_Qc9(I?2Se@SpbK`#B)7wNA<7?~^cJnii;x_T>JjTfB( z^N1Rb%MJ&V7aqg!L-67iV4_K}!)1qS?&`oJ7MjQ?1%^W^?J&C1v--~Ezq-OsYgrPG zL#HJy(aW)1g#|IJYhjHV3u5p)D#48(Tg44?cY$$!a7~WIv_{S`lpCf{8sx&|pN0zb zVzWC+2E}J;G2?8NX#U(Hm%Tw1w{in#3t!o`$>Y7)A}LL$*Hf47v4TM#_mwSjWz0UQ z>s>afC05sq*t))B7Mz%J5`H?N9qyA^s5kCYScuQQx~xU2ySjLFlzLd?S~hv27fcSM zQ{?JInfijw=-Y^a+bULfOg1p1gi!sWeJ=0_61xx69q&57V@eaWGfD`M`#4#2;$vFczK4)El87W$; z?~G2bKv|O4yQZiKO}eS8cWQ00=_^?DimQmFR@OvinGyy8tS;4%WQJ2R$AW21o2-dQ zvtT{i!%~!E0U2Oxl#uGC5Q8DZK~W0Dz@Rt=8}~G}Gz)0a1AC)h6ZPmf3qvw9+=obN zQjRX^sy&%Dra4ch<;h;LWa;kMI~A(QyyzunUT_yZa`5D4^2qq-d~`82cs@Fw58Sng zUb3LiDIp1r8Zb@x+&yL*OA?ACXl@uwf^r3v>4pD2HDcyvcRKb?pKft8dz_*=X>Dme z!D&^oQ>xG=b@9S09pWQPvASMDT@N6tw8=(eKr5e+h9YNGBqxD+#&;8Ux!3~**yNDhUhz;i8Z za>a3>-;0tav*KYJ1nFBmPUCh9qkU)lt__k{}ZF4 z`!(qPH#jZnb^y(i2avrvjWt|mCG835v-@p4_HytsU!5gp9tTokGuUj#8XhL~$up7G zCRYVUTf@_@_%vU9l2uEeO!I<3>jxTaDvi~OQjj@0f07k6?#AchBe3|VjR1XMeAt4b z1mIqu*c_=qIFRFva4_o~Th1m`bD^G_QMJ{`jk&u(y{ivsjs!;A?M*_2#y)EldkC?^T`cn@awpz zq8!`$wf-<$ZnkO8BOW&LL~{D{z*;7cCz$-V1fPt%W5`H&9gl2dT8J5!v|@Z#q4WsC z+9c&2Er4f5=40r71Xz>shX(1B_hP~vBGK*URs@vIJ}PPQ6#|E`L_g$AHa1QtsZw9| z0xDhr6)UMd(gBMctWR$x-G7?97Tq@ok^1z`n&kbHKEwu6H*q^dPJ@Fnah5cl-YU6S zr4M0Kh5oTf?^&b{n3?b3Wr8!NC`M>zU_F9fkFvnKGwWbmgHti@*)-J%kiir*7Nvt? z(&d@4wZ)_tGh?e;(!zoCljQz0ZTt%nNQc{_Y|%YCR&U5~nU9Z18xQ>BG*>O$oNC8c zG8<_5prA30Pp4q>QIKbr=rCtEOfFImHYVSs5!5N|}yLf+=1_gA(<13LD%!x>weIf*p}-T+VN$8Q|!sACcQ|y3`{;5G8YHX>TKA_`!rnc zZG5diNR(YOLURuBz+ur`jBdbT-8LqV%jEYgxRBBIi+E%m6DR_IA`mD_=V^7*^qvy4k)lPUv?yw}-sxt+Yh`cHGoL2X7YxFTb6xI7o1hK%4mG{2Z~Nds0F zxJ!KwVn2zRU`zyl!L28sFk0V34VMl>f>}WC`c$HQM)O;V=B*75C_Iv;1Ce8ut-F^P z55`Gha5#dxL5@B#p3>|icp-KoP~h!O@@^EiMQLIyAsAOaJRU3P0_)1jJ>dM?#@4}u z;;h!pOX$2x;reu)yVWBLL2FSaV-Oto9e1*zp$JSRU7Q(POH6t;Gq$QVEeu?eLk_{x zCPOq8y+m)i?~X0Ud4%E0nl>4PnZr7=h~(25Ls3CBMiDy0nIUuGC>RpzJV~f&KCksh zSU=h{yAh9md@?ulx;wU+hZs$?Z9f}M*jPUnQ7dD<;A|khV6tfr&PRr~08aj30m9aJ zBL6>B@^{imQ6==;leM*CoAG}0XZNK>;(5rx(U5A=x%h$ov_%_E!C=RTro5%WH4 zkhq2B*_|4M)4f9w5a_&9Sg@@vM$cj3S zTd8;MtKF`B6*t`8PZ@E2ct52eFZ5G5L}bRK4`>_|8Lvh($ch<>4ubgu^atu7^Zkeh zIWaxqYZ*OrgU;ke&)i^?1?+~RBMNy(#Fi=ugr3R=riNymPyG)pH;!oooaM?hoQEpo zuQhF)o#~vF0`%Sgky5Z6s(_er0kSg#dI8KC8RN~8pb_Y>!k>Y02RN6Wq4oO2j|tz; zfNxra8HS%~+r{urqOg}&1gxKlE3y=A4P22Wx@YNAeg`}hW=KLe6S-3O8P8UxBpgQw z7!Mr+>-cn8*Z>k~I23YbSdfO!-_LXl|}_>R*jF2UQ*X})EVb9GhhQU&qck;z=r z=}3k!Ub6=0#0-mnp^1yO;42qiP(DIT9Nfpi`C%k#;b|oG!kaOWnDDF!8O6QFSKD+<>?t9On)1COwI^BvAyKi<0-3K&|rtaH_?qeLUPwtCnG6+wO zLLjZ(i;$Q4#105r(?XdLNPHg;uB^^R?Ven@7@m5K7#>}u zPy7YZH^XpqUd%w(7F!0S7;Ncs+OJ0<)^(|njio}ymr{!y1`Y#xBw*CCE-5iI+pg8rR-UT;x#1KyaGO(F0XYMIBc-PsO?JNi4+5ej!LTA^(yRj7&v@lhf!0puUo_t&b68*N~*SN8f;*DE5RASx+tX9Joa}Y|g>Z(4aS|W;hS%5br?9%#&EiP1U1zZC8jE3wVFEYEp{d?+uFOTy_e(dFlwr= zlo*;N)oSV~se0C^w7i-<)oMG8nyQl0gVkB8mP)Fk<1fFhZcpW7hf!0tQeu2rs@h7b z;Ys~&``S~zZ--G+byZ5I32Lo|7KrGI*|w%r4STAdb{I7kQ4(D>@#E5l(7eCqpy-zIYT9uaNI|X`ntxr(p6We2j9OM7rOtjV6;UIBRNgbJv!6Xxv>irG z)j^4=%~H|A5?!08343bWQ$^Zg{1kR<&cTE__^;K_G80|f|MuHf$DS&PM*>DIYk>my z4&G=rjg|LzqS9^e*i(`HCtdH@Q|(r;N@I{#LrYL}RT)>x&^L`zx? zEl5$q=~;U(*0ZOYV24pt^;UAH{?%$|d5R*o7<=u0*Pco>{d-qXQ~jlsUZ15JqNF+& zG`4Jgd#cNJ7&R5?W_0=E2Y15C`wpYBtp4^?rKosZ{`Rs`l$ZvHb=3+e2D5u_IJ$h( zT!@ZT923pJ*^QY36*K%HQ=nln&M*{S>xdBk$;fD*3(P+l5WzUa0X7Hypjwe&^rdms z@mSK%{^GBlHvK!jB3l`!$1y{Okb^7NoLy~@KIk_w2K)ULj{^=!_~;~E$8MN}=g}15 zfN*&oJA4%R?Hn*Co#TWAXKz@cP{LKn;@Op`%|0}jz zEdmVAh2f+MArOLQ9ckmZNRDz_2-n^B>j1MEFoP7k2|HX1bb`}GL;7gI%qb2R*izL* z81(PRZ!uuHDY}3oKUdo$%C9eArWJ>CDOC{q18x>zt`&z1a%nE}&2t|x<#?Ak+G}*R zogw9^3Sa_?!?~Jn36X$N9M0AGh(I4XCjnE6bZA`ma+@0icnrTc z#lNb6XKrg)3`BW7t*-GpZucpF#IBwc%YT$IN8o2A#{)8hp==hH`jm?BJaj4u{| z%+lD#CgWh8XxL{m+%+3e!li_VGlzV&!X!nJgVuao8fn4;=5wV?lT_G3o_naZKK-0o zp0kWh^V=KeEWrF47RpYFQofjZtAdztiJZgWMK$_l*QdWU%L}&?jM?bDEc2F++32}I z$^s+@Y-e0pjdIGofj0}2D2>^0K+N3lZZo7>{o@juw~ z=|!l*c1mcrSD}!$wAr&&%ReT{3t1gSqxW{~bwl~fq6tBmGVuz ze2$o7Qp97?aKvmlA{tJZq)~-H6vI-pR`;^?>Cb@_Cw!nXtgS76PwaeCpI#^(%`B*p zaG45fXPi@=W8|z^-nfioByjti7y%~Q88`fe#aTR(vQuOnCV1 z2Swdj9dcXvjyd|Ego^xc)lK$em<`X&hR0^Z;e_czJSan-vKOKb1n31~@&;}B zfLMKp=tpM{5%r@F577_Ip}-!x<>Lu{a!2ODS8i7D5Pi%;J#M)bhv*Bk5S6n4x7=X( z=A9WCpuC8A0FVOmx0^|C^E$D&p?I5zWHI;YZKgeK5lWd6*`MyAgIsdRq;#QU0lA+F zzVAjk)Ks%(WyY^Sa}fQ2GR{>q&fxDd*t^l@$7orEj(LG?bs z>TU5u&iPdIeJYx_nJQ+9q#~(YdvjT`yt`=1@yKC#kw>VyPpD$eWwlC;=QXBi2EY-; zYdn{~b7~FqFR*n7;_qNFjQIJC;* zh2Gz9mMq?o)S&uFzC`2a>6S;gt2jB-q+k6&FX~r6(Ia$RZ`QBAgnk?dx6=cUff0@p zX)s0rJ;daJG78{cdTibTM&(2l6c_W5s3i|C_OlmrSD?obonIce2bGmX`x%L)k^%t8 z97g3tGsGtaIgH9ce&8=kL@)B`MII|D6fZbKQay619$EAvo)gjNQ`DYoXmS9UJP=GC z1SSumcGaYI)kNq(O}vW5t4Vk@jcO2ttR5l1G2nujhsblxtw(yV0z44o#T;|P(;3lokfi!rdC8%e|kY2Xy@HrdYj4mBR-y$!RzplVI1$WSU<)S=OJA_ zp@Sq+K^9vo-TD&o+X`_Lw?3x(w)+flY)%whe$Vg(-Hpw;%YyC{WKs{YKm*q2llJ(y z7>aB|+7|e!t6(lRFqs#1mgvlgw7__i{2tC`){zEb3=;JR&BmTkM7lx|Ibb$My2~GW z>JN&>o}O53v)R%}yMnw3-D5If_`46ukz+EP!eB4TJ9ZNLh{he8NLqk9FG|^&cPk`Z z14rhE|mTa-64h;U=0{T#%U>nl#_X*LOl+-(Vy|*O}yEdMu`lsGmp3%&WnbJ zhSwQ!3iNa4Bo;ejBZbT)Nc8fR+5W_zX1mu!(c_Uu_pJsXa zA_8h}>|Ij%?TpLS^3BHOtb7qhQwQA*kIaVC2%-XKS>tn2{so5k$7uZ~rS&XteR`e? z-j^50yJ(DE#PMFN@o(b&9F_e-G(0t&L(x}QpHtB{2=C}};G1R`)zxx?=!3ek*v#sCVQiIJ84`h#{Xip0gQ{r-mGY|(WTLuH+{ksq>Bp1sk6~+ z(eOw#oW}!}8y~|8B-Ut_dpy%dc;OrNi)KO#z#8M{f7-N9N?FHaY?wYjn_Y&x+X$+Uhr zcTURCN}1feji%D+Q}1+aOZ}fe$e6YJ(KIoX0?_l@8 z5Tpt~F+<~XsQkJN@x<`IDy?UELk)7l`|{#=7mb0l8QxtRzfmn5VwN}FiQTDaAJ*rr zXkWrRF}%{{yj4{4zoK0r0GEd{Lgc7W0Sho^|wec z$7U6RE(25Se|tx>S|kB=LPOkxS%_wcXwrgjaCwh~xaDNhZEkC&_csT~=1`}MgHUFG zzM@mXp?!AKiYU*#5kjs1r!orppUUX{f5-@Eb!i(R^o_>RawKmY>2htHvVw^&3^VQh z43kSuoQG8%Z|ng-B;h?zD^jlA>p-(5trXtExU_^S&((v7)6-M<`RAVn zQ51!D-g!s3ckiAsV#Ekx!GZ;X*=!c7R;?<0`|Y(>iSnluq&V`GI%l`0918Z{CyF)!S|e_zg7$`S$t1BDqgW(X4|Ob|+yDkY2>HA>jLd9(2S_umURvr@>* z%M;#y`)xs|(+MX|oDjUdy@j4VdkXKp_nt6dzyRUgxpPAG>eYpc6)Ot9zP>{9=FJ7Y zUN0<;$1C@ZrOS$jC?m$Ak&Fxw*oM6)S}4 z)29n7SFRK!NfHJQ94IVVvP9_Ct()-CM;{3_Yt|GNEm|a8xNw1v`4t8Y8YJZB=L=q5 zUc#O|dq7N}I*Ud4=9_PXr%#^>adC0NnKNgE*|TR0TCG;NcI}#Q`t)hR!^1;p+qSLn z*I$1L3l}aFKKbMmp?B}zLQ+za;O6Eg{PD*hLWd3=gt>F)3Px;K91m-(p+koXPo6vx z9zA*_eEH>gtjT<)#y?XT$CQX_o zEM2-(C|$a=@bSkV3)in-7uvOJCyX06PT00>n{e#dF`-_)dcu!C{wRcng$b#tsluvN ztAw<)G~xO4=R!Ztk4q69#*SWXxOl! zFl^W`AtWS32*P&l2M-fULPJ9Ze}8}B=+UFX)TvX2?c28t`}gk`!o$Ob%*;%o zN|h?Y<;$0ab?ep%j~_o4CQh6v?Ay0bh>wpKzWVB`u@C@_!Ti60@iV~mSHSQ+!0flc z=s$zW-vNV<0CStc*x!Pw?|`8@gPCi9k>`VnXMur#0rO4+78YcR+WFvo5% z#uP9`T`pBQ)9Ej=|2i*pxG#WUuL_}F8v?xogn1_j^1%?|J0ZZgKzM%! z!Ce5MeHa2e0K&Q-1od7B>1q(r7a^PvKrpw5P<|f*Sp#8w9D=wzgm44|aCr#dArQQW zAat8R;8udL^@E_@03rK11gs6hH4B1u283!U2-M9GrUnSow;@DNK!Emy@EicaSsg;t z7XnicVfhvWr4NK;9SBGhgyXLejGG`7=RqL4Ll~}wAbbfS7zqKG3*k2%f=`0bTLOXi z5ro|$2)ZH&xqJw?JrHgd2)3sXYG)wOv=C;eA;{W7h%JNw>kZ-M2Eo+D8%WgA5J*ESsSPCVX~-f`OX7}(02;<1YS<7)!yFCMBoawn(a=kx zl7@B~@=5&But>u`iF#58`eVo<@knBu#4-)pG!)WMOG7vfc_c<@cp@=NVw*%S4S}T2 z(6B<{nnWOpUJ|V|T+onDLoullq}tH1PeT_C>ogRT%0R;=4WXnmghJGkszE~s4P!Js z(J(~fpN2|OlSo9<@Jgx_iEkS6Xy~C~n}$>x9%Pj65XU~keWg21F1wL@@Z%% zF;BxR4ZWn^kcvj?4yi+=n$fUNLlF%rG;EPtMZ+nnVkGKGHKQS!hGY zR31_RNDZVRkcN9w$w&<&m4}9J8eT~SBh`b{I8v)f4ImYP)ErU|NbR6ulT;~EPf2Yh z)r3?{QVB>^CG~>TQBplfl_T|&R76srNZlfJkkmR-iD{@OHH_2Eq|kmpFtE2g-ECcapQw7 z9SwH*1ti%FsJ#SMOM&Pp54QRMU2q@T@p6#=V36G{u-G>cS3g7Kd<8bV4HU(L1e$;? zMu42xf{Yu1#ae=uz5@yE1*&F2j6{H)jbNu&AiE(Dhdn_qiy^Mw1FL&Lv@8M}c>(>C zAUaM$w1q)j90IA|14+FLcDxFaF#w{Z8c3)u$h0-YV=Dp>jxh~!QX!{tCu--FaVL7tOA zN)^EdGa)MKfHkgzWO_k7U4+OvjjnwkESdv$s|2>vLA=C*gt|d=1c3c!Kpbv_=Y1%^Y6xkIcC zB>sn(tP3%d2ljXY@w*Kydk3U$#!!*~@*WTN83h(dhN$`)WOx^B(E*}+H^gC6h?Pu` zqz3GM4MRgch%F1m@aGWwTOq=K!%#65V(S@1!C{EpT^MrCW7rr65z+vnLY6^9M`QT-65=icLs3VFqRkLj-$GPL7;5@KTx@{oe;Z=*F@}^K5Ccasl(hr< z9)UP%1vc*sQPv)!Xd%SnbBOepV4;s7=9fVHyvES*A%>BkAQnR)c5DzcS_~mAASNC` z?7jn$wgp3E9}JlvgMH^?*!&YBtu{oq31YYl#7{QF&~%9PV6bTtM9x{T{|^}Mrh$bg zVz}v!VYw8eeRVhJD<;fEZ zrCBO61tXBdZAPqjI0hv*dvukyr^;9IDT7$8h78RpqTl}2wH=N@PugMBviy~NXbMlO zaW2cTZ>FgoMomRnpvwb4t)@Tjl<^1edpB}82BqCGbUF6Tbm0-oz8RX7qg3PDv^wZ; z4BEpEqn4GZ)R|_Hv>NABj(sz!b{I7k!O?}q0;Hm8Q>ybNukDK*`(|n*hAvM*O;t_F zr#xb{8k%UOroWii*v+wT#?KC;rs|}`@O?ARsT})ey4hjWRKt)nU1TxnT9%&Sh2D*( z8!o+|rdrM;$j%I@XcCiZIO~^wO&$AYR@q_HR4tVlnt$Uvdni?8wW|vq`(|jukuJx+ znQJ^kaSTc(aFpuLvNw)7_RZY3!>DDcdm~_Nh_YBk5h_^zM^neX89Hc_E(XIwCM5#_F?0-~dU2R!^%4Jh%(gdTbS|mh zv}AXf%Bo3+A}htZRxzXP2b=SLBL=I-A&0Bc(F3FV4IUjGGkL7tBwc+qIC|hezA8CI z^pJr;_9Wq5dqsBZ+z)Yv=0W`&@x|&D9UDXM)jFuDN{$^E?F?Hir!l;wVmTFyEtW>9 zU9mL9VoON#MtynNIPk66E}L$_~N~3;`#j> zh#9>-)M3`I_NsH{|CVcUL;M&rbFXWsn-9V|_Y|UG=C0ajpsYcPf|veEvW#z9;pz?to^!Km&gV)4rXlL?qU%7{Zl z8G{RCukE)R7(vznW|3l_ON$B&uDQ_;LxH|jCRVJT5&$kLo|kKI0c;6@V8l2x+?Rnd z!NJQ_#VwETgn!ckbFerZzG9rO?#S;vU|P^9jEm$A%g<eD;uj%Mi7583!~7EFI|WH+;n4wpk@T6g!crIBs{iyCgf zq%1CC={r?y6tW>q8{#Dz+ae=RIn3Qq$Z`|qz*OV}kNYArP*aMH0_AXR;D#_`pqJsC z9Ol*FK9YH}6wKtvcbOxFsP#<^H~MbiHdBp!y$mnpFdtT9UnK=Bq(ZhkQZPuWR=83v z!&5oTkIc9_)GfJIYK0WLEM6;rR;$J(*NT^+R4q)YRRF71V9B*oE5yqHvZz);tX3f< z*NT@>3|FD7R;H3`RU)n|tX4L)R%SVHI~g%zu!%#=1e!fIuj6gwOVk2MFPo)+krr6(5BrIq-KCA7*W!1cYy6&1=^v(8p}Z zmct0!gn9+zArj;13=wuGYEg|sJ`LA~B!(G7d;mGfaGrH6OMt3ow3BtS)IKsBb&|P} z?pI!hR);d~%V9lD4XBZvivD*RsYN4=Xk;Va$VdZqx=O@Kl~pmsYs+guRW=#+$zc{o zh@4S)odajliRwUaVT) zN`jOBMYY@wCxKP$8^W-{l0iIh>f0k`-nLVpsZk&*7`UpPk^1Ge>}Jy3Cnq{IqJdFl zZ!m~UM`EiCu;!f@ruFtQoHjEKew&*oGUr;P&T$?#A;fvOJ3^d?2P4FJm=4z9a19XR zaIF#Ia2*gT&g)T}+Y@dV;-w|+r@HaTY>56|#t{9?l=Un;GbKa$PalaCe*ynf@@G^@ zdhWHw3t@d&7Ce!T*Tb(%LF^V}B;5Q2H&MzGlP>v?eYrc`B4Om+A12=e@aqp_?*aJD zOj8P3lz|lRwd5Y#m|!hDg=a}Alxi%xKxG7H#lAHcu4FvD+DUU3QD%xinF2#b((`iq zk~dwz3zPH!d70#Iui(KfT~Kq`bOX<#^iYJOHhCw_3`o!5jTOl)+;Gbzhip@V z?PSl{<-Xhjm~ttH2r^|X3cwLmeoiN@N{iOw6-uzB5iP(H+c(){cwxq=gFM49hy@&8 zB}(@dp-pnaWH>0D2Ep%!0Uw$gihT9yPc71>o(Rb))DZ0ESSU(=iJ5mQC^;E*zrvxi zm~fShu+bnlo0LK`2jNDYm%NDZf;96j*dZr(dmnyE9-}&jT$FNOVmV6t;1|&iX5=!% zZMf0%UD4=?LU!{FWH9lDOy6UXQdnNH_b1Y#LgZnRb*-$@QGrls3`4g_v-G z+6A{>sgO(V$lsmipKZvNHW4j^$-4UFe#xk-fb71u$Z3Q&Jbq@#4VOLVpgnCOq}LXC z5h0OUCc&AVAVf%)l)e#V?}gGLAH*RsZ=>fNDUECZ4LMRKY^Sa8RxL%WfHXm)KSLe7 z@eWEYm?~2kQ!X=!TG06s` zWwH!XSSwYerC0z%E;v~q{!MNMW$#~6*Bg+4K?>y|H?MG`_j0&TI|&RB?HIj-jf@(k zJTzbF7e`m*=+m=!bu-ZE0Vbm^NCa0%X?2knTbI!C3usz0_6{0gSL^wOl;(#wtOcU9 z7sTsBcvY~$vAc!FK}H!?cn3u8AYKoZAN$a z1I}#76b<_!EI`?(#LUZX`t-knK;jvo6Y1c)_JEWYh-Z>0YT?-G#d@N>Q8&jX9f4y% z_Xz2lS@zs$ks0`*{Hrc#Z{e&}m`$S0R5pw~c3GHOx zANA?4U^2WFB9<|)F-;)67~yRW|76Z%#uQ=!lQD(Z#U`)g5)He=wtzuDwXp#+>prkjvJA)8eNQHIt)QjLF9g4-7WmPk#B0mIgGBwJ#Wqo9-P zs-agEDn$`XL2PeXlHxh42EMEs<{y2F@B{I|+7c zECSM4Ezm6xg#CPhJh&L&ZQM!3jpMFS8a5>95>d;>=t=kXa$rJ)bO^!1_Qt?OAS@SH zoevXcV+s*DNMVcYU5(QPjsq4AM@4C-AENI=O=>7T(x*Q%Oa1DK683=|Dii!3e`@m0N7Ni74w@YiBLa1#oo64hp2d&Zr(B@a@vuoF*&vF69)? z5n~%$-iFK0Edo~Gevot*ra$hAJIV6FTDR5-Sg$P?_HsqKk za}Zbo=X#p`tigM&X;Gmv>rQ=gkEcaNvKbTsbxk9i`zKwfm2}@r5_Ph4Y*&4bh! zPuc7b_hzzrm>T0Pn;T1_k8B>P#`wb4T@w9d^H?>eu51pJM1R>FtHv~z%|Vg~)AUJd zOrUHIk;EX`JWY)WfpNDahRP}NK#v+}lFcSbL~kZLMS}D#k{Btcq&h`*lg;o)-&1C; zd)4HpPk+HJ5wtiaK=iD42o^yYMIGkf%L;2Q8x*f#5^-6Hw0Nvm?j#!5@8=EwJk|2A@J$3p6 z`h)u9@xYUq^xA#e1gmtpSK04ZV<&#>P{&}Ug)1*#tOYN>DDdm&ePRCE8ZC5IFM(NbPW#HG+T}*nZ zpSTnrZuQ9`x&w|LAhpsu6(v0@jpLXRV~sv;)%>aG+qP)W*;Y-SVZYgsVaRVI7F~qC zXND8yKk(IpU<3=|Qzysq;Nt;BQU$~RCWiQ@gvFQu|_vJ4rJaCNx--pby>jGNpDZ1^oe| zFwVX0PHn$ANkO@OP9kt;k){{wYmrt1T|tVwFD7Ldn&s*6;Ce(vc?{cgrd zNAUw{P119?lE4>}F#?skpi~O~3HOLd9paYSPRqtcLO)5uRG@!!>C{dP{YlgB>nBQ3 zCkj~?5RZz|SrOkftjGJH$7%oIUP1&fS?O#stzA)4Vd;r|Q3GQXMu@>WYxH4@<}kh~ ze5pavx&(_Rr%llXR*ND_5nPhc^a0Ne-KKOH^%QlH(l@H3=iXu;ex9-+|K^=nMMaa* zF0drz%30hiu}~j$Bagd-P&pPi1Z2xYvk>BNC2%I+T4j@&4=h~kr*bn*aKR%l@h|5dm6)1JzI&Xco2*Bh)GwTKIC@9Sl&`w8XVIx`-dkG{|M z`U?GozM4MPEDt6p%VqHEOeewgaD!gdS&Lf_9d7+f;Wn`}ZZpfInrRv)HA2H?Vp5~r zK&hB%$uZ$CH9~7jjnZKT1WeJV6uzLm%pONgsd1&*qzTSYIc4&AW=fr21|GJhh?k5k z2sdVFuW~j+Lno5#N?G~? z_-c|4&_A76lwGiy9FI3+N+aW#w*^3bc={?`3pAF2P#v0a;XZcm*Xs=XAqICtrV715*f z2kfp=W61TaPm7M#8Pj^0f3Mt`899^RDY_KdZ{pF=-QnG5H9KEz^|aI`JM&i^zp#I0 zRm;f0PeyGX&`jU0&c)`xHyrU+w;$g7w0oUg@#w0Y&@)4t1t+g*Rumze%ir4Mr?v~1 zoXlL(VY6vM*EOvkZ@Raw@s?hBT~6G&|8z{PDIOo@4x5_T^zYkqyJf7e)1ud>J7zW; z)p6CJ?U7#AA^A-buKqr^j&bwXRa)Pyc;(ZLeFBR*hGv;xwOwLZ*EILZp1}z(qt+eR z@aNA>ep)$d^RZQtp35>HhSo_9>O9)>#I7r=V^)3CxmgWc_o^Q(-`nl7b?fWl?bgr! zF@3{dJuB}s?@fvBvp`?*&)FaJSfC63_(H4qul@FyT zdNmd9>aI7%_VKQ25IRlV-z zV?VUrx%$YZZ*Dbli}3sEr+Pbcev3MPYw1@z|NPZZ>GH^Re>ObVAbgR(`S*3h_2W+J z_jmc>$%sim)NI?O&ayRKemG=0+VH;k;na06rX4M{sC4ytS8j{fn(y9tY*-!bp|bt= zkD3v5c;to=yC%ID`|o$<_6@&1Mib@N~S z7PmO6)lc92Qh(a9h<-U;7RSx)eyz&(Z}020Js&jI9k|u1n&!+8yV5$e+16r3(Yq}? zBBt&>H9BC&kaxdbTJNc)`N|N$W2y(8d7S_E2eXoX ze5Yo!(O)eem(=dUyq%-X-M{ek3qCt;Z;qeu=|+o-7GJyQ{-d~It8`#m()Hoh!Yzl~ zChvW^YWm}^!j``^HOzW{|A&J9v%hu?PUyYR%dgf)Ys%f5apdyw`0%#DQ;rOHJ;iVD z-G$3jqq>xS88i9bnsqH=YIHgr{o$Y6TI$Z-3)u7d!ZM!yrk^?M^XT63l~bE-T2ZRy zjb01aSGntPs_5n{!F0BlY2m%!4kc}S@yG593F7Iz4Gle7XFgc+Z0eC~-<~NSrupdJ z^($i0%6g>><1fa0?Wr~8?y|SP&z^F0bwJP8Gv#wjJGH$rarpfClc#?DyzWOil`kd< zdw#0dBJxDP0k@uZGk6b-?if|RcEw?RdhH&PGyX{Q`x$|k4u3M^Osx=FaP7c<1O0lsNO`I@RjG^n)(~3B!52n{N)vM9*x|#Fd*5h z@As|hy&f~>ajn)xD?ffQ$1iq{`Lp_~E}RN{Z(pb3ol{?)zY)kUH zy@SRMDTpYSJW;bYedYJ>o=Nr|y6M8^@cXs<_sqST9B{u|%;PboKUi7qo2d3@Pw(n8 zaMQKw-G?n4aUiL6{^%xWG)Hc4%RTyC@Au==J=RS8#rDlcZ|*pLcalH z?j#HfzwS4wa^H>1qJ7TQS?Qaa_wLZGH`Z9=r=H$ir(Tn&zOC|Oy8154pKO!LXS;2j zWBKUy>gprDUcdTCm9@U50z6kmpC6Zcu-Un-H}_|Ieo%C`+}q~bms|LE+ZfUy`s)VQ z#kH3|q z=nwJjMk`jG+BR*BHoms|@>7umENu@CJ~1Ne$0y$mn(%I5{M5c{>b=ancIBGaKEL?% z`+u~KNPat_@UG!XUH2IU)`N|IZvAm`>ZGTiJ?Y=)?)dIcr=02iSF=pRTPwrIJPGJ_ z`}uFrPt2@xXmZNEp69ye^?lXsOx459Kb!LG>{C;EqHv=O6Uc2M@y=MD9Z<<(VY;)BKtC#tH zwxZRnvm1`Cd2926-Cq}suDqsA_KxhZR$Z#?@E>;X_+V|9>TPZPx!-;hj%*1Pyw=VblHJR`vZXtewxxDI>IH zcS`F!OW%GusIO@L=A9&M@2#!-w24`CB79ozs2MfSpD%rH&&ZL%-}WCj_V-=mOHKGB z>A~%H%%NHL(!TEVyxy+&=N6RN?{%YSX8-mbuYBFolwE7i+yjSy-t}z5@3#)TxEopZ z$c>-NobOUPwZeQ$sde|0(n2o&={0u#*VDZ!Zk;};%&{w%f9>nv`F+2&zihpbc<#CU z?$8xYC&wga{Mt6E(WNge3zytGwxey|N_Srt)qYj|qr^LVqvnUM>QTupsamI^nHRQQ zZHu2s}{km6+=ltBTaUbg!H$UBydOC8&Sd;C<>x^c|pDrdVUE}Opd-t=BE z-<=FyyH02R+pLZ4^SspVHaDup&Fh>sy!(9d=Dl~CKG1&uuzdag=~pJW#SVV8@Yj^d z^ADbxkT@Y>qFdU$Ukbl^YUy--)PT<_B!77+X?nBdoU5LJiRs%HTQ+Q5@MB28J^x=i zFJ1P_*AvTkKRe&AW<;ITA6g|ZKHFgW*`wX--<>vB4$ZH%>GHIU>nk@7x!QNY&D~%6 z6^2~STi9RxX89i#+D+))dg(18VbbwqjeE3zb?VN@r_1ZC-TA}1>6JQ_nH@eiV@a*q zXR5pZK4Zm#DhGnL7KN-|QkaqT{_S6@rFE$gH0Z_DL&H+*>rW+Utd))xUG4L6;f%k$ zFRhv|OuKsPXN&sGe_j;a@#fFL+sYj+THSiV)93HZvW|MbBc!T1ZeaZ>k9#MskarHq z3#*y;Shw!*{BLGd+ME{V74v;e;@Ul9=a;)Wy;9D~kNi779vJfNt&A3i{8BewG?2m) z&%fOG!N=*HKgyh5;m2C;wSM-Q9f$wi`{Q>a4xFpBcTU^JubbrN zFYbA-@O0NBSB8F6Wzif<2dn4W^sPG*KkIECaa3xxu>X7C?-y==&~=>2+VPXJp*zN( z@EsaB?a7RBZY`qEKRw6_PCT^5R(oh( z($x(E+nn8ec&FFQpx$Mly>Gg&&mJ|pzxBOt{VkdGd(@bHvr*978)w)3{i2`#^x|LY zC7Xv`ZJqS_baVOskqesn5Bx1K$**FKQ!CO&H8Rv}G)VX`V0r4b9bISl)K>rV-nOU9 z?}UjJdmC2oZPPrdWxIRlHG7RKeLpyQGpSXJyMDUgzC3p`z1F>{zpq)kYJC2gshvCY zn6qwBxUNe|UIn-3MN|A|M5pVot!&ZH!|y@C|03@_prX3EzVW#XO+^P4vFoU4z(z-~ zGB|@XN>hqh0V#sggaNT(0d>X+u_u~hEYVn_#$JMyL{MYH8jZbSi@g{Ad!KXf+&kl7 zc;5f}eCu25JBzvOyU%Z*vQIzvlnH%*u=ucb*Eeyot>d0u>EFsBYO0;%(cLS9eMNl_ zN!ym%xYRlIA-LP>qQ694S~i+w=g_Qv;6I}W9+m{ms~Yz)s%e*~IE!WEY~9?t z4bvDlQG`zWII?%;>*wEYWWKmFHR_+;6)}ESEa!Z;Y+w6(3p1`%AsfMtIbQRESh)*-Wc9%>cNEaHS7Ky zHsW5|gA4Q17X0Yk*8j&T{_}mlN;$AP`1ii`&GHuay&u%(#O^$)nN5?OeOfJi-Q;$p zy<_iGWry@R=XAw4$Ezn_wcOFZc9&;nx>^&a@4I)iU5^Hi-kUBb*&kLn8r6LEm0i9q z+PqoTZ1tpWcB1k*t<1%~^=nn!9P-G5Nm#@LO_Ix;iWtjMZxe7IZ5gXev; zT@D=>*1pGs6T6yC+vU(BrQlI)ne_eYgwkn_-rrle9jiSj?9lqMb1NRWy=`Vbbd-I| z&hwbjVH2~ydo}*FtLv5y^Dn0T>E*AhQ>Gkq`>zQ@Z$;b>7-LqI+jr3R?77aXr@g6r z&4oenuU$(jk|Yh=ubgUszWiwu^EF>L6K&|wsBW9#uCWg?YLEQzaj)tx>j_O} z{Z_Z&=k)rnHgVteK4;te&z+|ZpV5^5Vsnjgc~vzhBYDO3d*f1{ecRgkWoUn|g8EvdtYI9&(ER z>H6@_&s=`4?6dyF{G#D=?sQ&udR^E}n^{L|pKaPSiV@GZ8vnBU^2;M5*5+J^xN*5~ z_~SOSZ)E8PTK=)^QR(X46+8bqKfbWtEhj~zk}HproZn5nz4_PQ)1ME!fAv}Rl0VPd z_}}#Lo_V3QbKdNxqccT^U(4sOTjn&@X>p0OYC~bd0yubn$AwF$zH_$7z0xAR{l$L< zj%IzNRqn zdbjf{hmS4x7MOjvPG(*^yxEcXxqI(CADGd;@#@9r9#|IFUb6a|^?Q8&81r#LVC<`B zPkpCtPK;P)^H8^VdwtE&``5PIt~EPi+|_eGe{>4!aw{QLRCLnJ;;W6nk9#qGVaIM3 zHcvfg4mK-{X?tk7-`Qy^8(ygxwnJUCv`ylJTWwBP_Iww*?ct{KLsQo}PG7pXm*`FF z;Y&|>f2>m#WOL8T!E$S`^ZM+hJ;4@>%jT(nUc04gMfjtVmEYg`qRY-Tv3_H2w-&`; zNvQQlz5U^ru7q1&cKSB6)%+~&=Eg1Nm$@Y_daa#ym#OU4e^qf#$xmfPi@xC>h^9<@~+Vx}EP-2LHMhq`wj`Yp^aS#7?v+vr&P zoi9ReB=mb)>~;97ix#O3=jT27*lnWb-RW0%&K{cbuI$SDSeMJ%7dtP=oE|JrxY?m; zT*R(F9)-Q!6|o-)4?}0 zt(W!deI!xBBwI@>TdusEq&qo&@XKc}OU>SvUdZ(gIkW9Zp!LGWd+VLsawcb6ZJT!k z|BAS9?()rj4zh?khZmg;A1q0|b?s{5j{KM(9co7w4S2QaE6o=-V!|i=IL++u(njMG zEzXTij@uSEPrmB$_JlccPl`65$xV9cd{-6RZJEm$&z+q!XHJ{x`+C00?3c&cft5Y1 zzir{?Xt_u!-yM*eY3o$0_+Zo_-Sh8fO-YLhZdg!%eAjE8ns3Y4K5u>FbE|vqZEios zcHXA%S9bE>TruS4k3$rv6b&yt{cCpE!HYp}Zazy>rZm3SaB{7()h%OZWJbxK=S4LB zX3W8(8neRmjN?bQJ*yazIw5+YboI3F6c?{Y7c#CT>xR3ozW>xOsBK20;Vn8h&v^N) zs-jttZ~HHu&jq=C*frYstA_0?a`vwpo_bdDcV62CS&hdA=A>@DA2~C)mV9wPXANvvyxbWIbQsaf^Qx<5;WHs~6tAyjridnbUvsprSix64cf`uGqqzR%_1< zZNBMDtCtgQzD&-ao+XWcd+bDH;VVstMDza7UcZ#2PyK%R@(uo>j>&h2uX>n$ZK})0 zu@z2<-PTFGW_J8|qw(l(b~#ALu6wb#{n4`rT2&=>mWO8*TK@Rt+xV+*TB`Q^)5MDL z*nQY#U!#w0EAwg%)~H6+%L>mObzyB)_DFw4=vM2?{ZdZfx%=pcxo=-yOWxRdv~pFz zbwfe_s)-KsBa+*IRfr)iodM(=KS$WS#IbGeFo;hLnKytjo>hP-! z>Dm*yO=Taptg%>l;l|j?qo)ehJy&<>rj$<&@IAfbLTSCdDL*&$vHt6yy+3X_eo+-_ zGdhU*zSnTsp5Nle#MbM4^sgyAMq_tgtS> zcfFZ*bAV&J84K2j7J4i^(58Ej8w2{Pi3Mr}XPwe4|b+Q#;? z7p_|ufAP1_JMYr&+PYGE)N%2{AKgD3@W|PnqA-tIGOK;t9_7CuDvT)Zvc6zc@E;>z3@)tQ_WFU; z`4x+Yl?4@*K6O|+;-ug5sdbN5eUUop@tnWcS{5rZo!hl~KC7L*X9w-Q+l#iiyFWdc z+i0`8Q@5L$?UR(}*WJ~c**|OfXjFIa>$88(e!2QtsM1RvYr9xlkd&>kI{kKM$eWHs z+Ihb6nw|PCpy=37Q`UEBl)Uz9@sSZ9>;AF9>fC$h-`mvM_xOr7r|^1|d+=QOp@#lh z1t%;z%{;S5DO+Uz_jhw^mCw5Ka7w28x25ns#BX5ZT4UCfKdW~(L!_ONEp;q>wQk)H zqumZ<4I6e^^dWRxGz<(GxCTUcu59@2bsV^s9S zua5W28&tmY-Nurh*-1rx2ARzb3UoamcO%{V!jQ0pR*$V~6|ZjNGH_Sou;k@)oM-et zYUT21**Nv|4zvG0?dxv!mvi4-S;X`R5nBc z&9tHinOi$6N0VcHVt`->fPLoA~|U;Pm}(?#M25KQ*)@fBEw;i}0yi3nzOHDR1=K!wr9YGj&JV z(7l^4zuejV`+nWqUoZ;59Kc$JnwG#ZSKCp(fgUw`%X){BVBDgyDTZ=vpx$ zsz6!aLhqLU^qk-4`=1vSCVXT4eA7RBj~C8r(DcZ?ouZQH4mW>`&zjiUA#UB@${7ip zww2C`Zs@r7%K17^TcmgvYRB6iyZh_5x$Dg=T6q@L>G)!-{fw#x_vr^pjO{>;tC%)Y~ z+{WrjH~FZgcXryJukh0}__}s#(duiXm#G^zvwolP%ID-(MYqT|kyn}?k9bvD=(0Dp z$f0=~D<@5fVyf%NL-qgoYX4pT{oZzOZy)R*S-IDLf6yjf$Xx%ZzD_wknm9c9ac|2R z&m}K6rv!Dr7q{Ssy{>=Qg3{pcL=V4Qvmqz#(6`_2T5Xw{I`h|cJs&jF%*rdgYi?aH zqVP$053gHyMm$}yZRWnquX>6<#<-7C+dBq`d#Y_xE+qf4e!`|}H+!0uKOQ*r+3O`g z{?x(Vsnhv?Za90l{B}>UP0nDqeUtt=*n8cY@u|ag@kh#B2A$UVp6s-%cTsdsf#sg( zVck|uDR+5p*6`RgL{lO(+=G%xsMN!Ed8K)c@i} z$h5v|t(RK<{%~rqN1ak;War-xYJa>ynQ-Qimn`Ux@;KV&{3l%Fk`-NUetBn z9AzWlJND-~54G@Z`)$R-Zx3|2u}3l6qSfD_9;r@C&!$x+t7fTwY+?2A`jwM@8M}YU zz1*}}L~n~P(>66~kvu9Ppd@Tu$4=Jwe4Oqte7xoF#=ks09rFYUn$;pZ)H+Jq1dE2MWW8YrC{8m&NP!g&7)obp+^ix~&^Nu}~T)0p$yKKVBre9a7F5Lfl@w7P4U9Yv{n>Q%FEwXp0x1+MN#g^mi>eqK( ze5>}-I}g++XDw{8(63|t={K^wKkBme{iRFYwqE}Ba_3T;+D_?B3w>)X&zE#}*mu0! z$?cCP1a1HDaGCjt6^-g7y4F<=y}VE7_wa`V*UATFcNWj>)4b`GjJodAvIhEDEqZ%& z%JA5f!VPh4eAm}L&1^e-@{ZXrEeD6LoZ&k0!KJkgM!2v4P}w)F@oE2e0(SrYRY___<>2=@6XWC~W-VQK zMi(uvCry4C^|#L|QJoP_H^=_sc2<{b^QCRND&*8Y^D9f7IzG2qGXHtXccGVZmnmn? zx3tPV64~{Uy2sWk=Rtp3_p3PiMQ)2>ZSMbcz2Zqv?}^)+Hpve5^NF76dFOKDA8vcz z|6j@9cX#&b+ewB?C|ah(qq?cY}S zL@$rIbJP8rpBXP172M%K#cqdXyNVmdwO{QYbnD#f=;_^huRgjsXLY0RXKKDt+>R=n zRBE%=>f(k~*_N%oYddvP*L>G=Kel(scwYE=_xq^4r^U}x7H@s=_4~)QKLj-VxTRN0 z$n|>-z6);uw9(VF%yugsf8YM&1l5W5uN#(m%$^?e`;yd&_ui+ToSZz{%g#y`_QdX= z%Y|QTz8fL?ssHk&<*$0)-uqxd3N!lB{TcR+uKeS-c6;>R4_TAuJ&}lSNSBqIcjz(N z=i2T*YaWHU%pTX{_|u(!ac)2U`BS4K=89%p3Z~qAa;tg&{J*c<*_(dhh+pkrrW~C( zta9+np?%JL8F*akc>1SfKe?Qo@b3OBkH3$eau4k>bNr6?kGkc|w*2GvwrRJX?@kQL z-B$j`%4O5)PQE|aXHjs+hV>Tj>f2(^!~GryIwXL zd@0A{QCiICr#Fu%i$_i$G;f1MHZtB}&i0?CUg&z$cT#2k@~`e*yQ__SKkw9|VW+Gv zEs9WH{Pos3Z-&Vjy#I2&%!aOU!-8|?FWT$eGh{}Cw7C8i?XnhsJ^t$4iN$Z)v>7(> z>)o?Y26pe@bj4=i-XAAFpZ+km{-*dLlkTNvh?*^M@vT2T<$@^Yl1+cHf9p+Kt_+Kg zD}A_Z?d|(*=TzJ|w%qH^@;z(f!fUzBwCy(ce%WD*J6$A$2WmUbsC6Z|S<-J$Z#Gyj zX`z@saplXaO_dkA2WLMC=+pwHdbb`Oou60NQ}Wh($g^cWepZu~diAQ6UoWQjy8e^S zN9Wn-*0t{Jt*XDeefHg5C+#c;IJB?VFE86>M!~YklS8C+TkT8uX-4e}uU+OpF)s>A z-5WQs!_vC#?zEb=>DLe@@t=EnD}OCm_Cj}00c$yY;MWCyU%(G{@-%{9J@_4m6*J}V zI|#qu;rAQ-cEE27{LtXJ7jVRnp28IclxL%-Z1t3#o@%0}aCH)ukm@N1J>{sUI_oJH zJ%wvTsH||iI|LigtPmLb^1pclvx0RUV=iWJlRHxFzRrEdpCmItkKs<$n8R``h}8EW zh5FjAoY;duNe0(^q2W)GL6_0M!bb25H^Aeb_OJt9H!MY5G-1ghG5kp~u=kx9SjY%c zxE&tl{T8Vn@+ZlVUCqF?5@861Tc%p(Z>~2%7AVk!RWB+5=#SCts$IS5i z-EIx}(`Lr&F5&f*@8c92GbJ_f7(nWWw58s;O2Uaahvb9`}3#G zjMQT|zj`AG46Yx7oWLrukCnX{f7%S@dNhcknHl%3p~0NXOMMgi(>5Euo^jnY8pKd3 zTvd+-SFH0=qZUjb#Gf|PT!5icRYZonrI`!i7Efna{Qx~`u;f7%SLphJTgDpiE9VCutFOGlAbUFy#{~h15S%|DHsd__1Dn7y-;f|WHAKD;)GQ;@}=+# z#Ih$az9KkP#MPslfF;@oFDZa?q~(hgdEzge2`4m&>j{`wEDl-`8oq9BLYQgV^i7C# znQb7heh<7V*VTrLhv0saq1L*IHo6R3xz5iHE;@w$kz-oObe1yRNOPGk!diB~9{iB$ zf^5nZuhsF=v1N+)Ze2!AC{u`1qu%El;xI62MZHHL&Db#be60(q+Au zGnZYT7MB3_w8HgzXJSZ*(Flzunh>*tC>gH6(3#08VKY*h%mz!q!Rgbm*o`RVLIQVzsBL6A5$r00D~inT z*D8}?PZ=)x(8@e8nBF9qJq-oPHKkz@gG1q_4k@`@1XjSqwl}5rluCOHwrS0u25tn- ztdQhqL1m>Xn1$~upQlRg6P3j8uoAb5;AwG6ZApMrg}gvj1)D+OB8k?SgJ6%X!l_u6 zcTFtG$L&C}SAW4aef^qwaJ-qaszmPAT3J;l*ECmFmCC9PD|}97-BM^v6;7vQPUW(^ z*Y72>z69aBcj2MZUQ{{3WlQg*87o!Hg+QmLs=ShEuytRWu|QQ-9H=c<Nk|s?`x~ddo7jZx5QMj?I#74i^O)2l)_vHEK~|O7r^;S z@?Sty0p|<25Wx9TTnNSa0xkq_(USb56c-J+bihSZTsp-?11?=P{Wa=MlE0EbXOkD( zx!Bp4*e)P%7}ObrfuUVUc=hv;0m94SpE^lmI~xg!?c6Qo-vaVR1POx(5?=j0WPo51 z{8K|DXCncEC&<4A&li6w&HaeLdY)ID0nrIbvI#~;?qKQr>)hgiJ9S5yKs*^ct6%IOC zXRQJ*tf*SAaAXrGqiz~I$2Mx!UeXIz^3!Z$})u#Ll1ZIdO$Ys z1DlV^fq!+p2k!a+j&(+N*efti>2z{8;*@!Bq>>rSfWktN+10h^emtKdN^Q6|92ekw z7l#|Lp9yTUg&KrfFz=cas=&OfQrDLW^CY(BZW7x7H(QC5+;f`5DZq0cYzmVqeV%09 zRQZ%j@_z<*WG_pbsGViF(G0E$zMOa4n>gSN?kjaYYb&*r>rPYV6poC0c% zhK(m$1?*#lG=(jWkfw>cKpP!wELXtZNINarR|#!6bV0&fK+_}Dg*#}&<6x(mi(LD| zG*EzCm(m$7W{%WO3DbVmg*$4)(@hEnEwMppa>wEXeu3g&^r z6;A#rf^JL+<%4G|&kDo)fk2smTxkTfQ=%yk8Z6?NocTwa6^FJEnc=#?90qn*my(z> zaBtxa2o7@|)J>Tnby)#?ZG1Yhv(l1?=tfLdFtDNOEsZ|(MxYHZg8mI$0y`y{@~sux z)6g$dXrEGBE9S7w6>g`6m@7i$Ot~xcwrm*KDw9arfIkXsnYI{htny0DBr``qH3l1T z83p74wU}mu@MLkgxi&l*R3r|!25~WDh7rTXBS1kUaB}eoJGmILgI4igE`}_j4Sy{c z2STX{4AF(hiAnB&Eu3Q57Yxs=FzpUZ9Jx3?65^R77h`5gnM^nFieY2$OiTpWVRcoR zSLv(NDo#l99%03!%c_K(#~OcMO@d6O#Y26dGnL>+N!*>+R~N3j zjyn-)pdu)Vc7vhtYy2ZM2}2Zm>!FlH>tVX^_nL^|n(Pt0uOoS1qhRBtCL&ss9m88g z>w;%VpmeM*JVX-_r^$}ztrK|b(V%}#M4~1;iMJj@HY$#V1kv~>YZ6j;O{VgiOryJ} zHU8}sFoCz8$XidMsjcy!tVx){BXW7f zR5*M9wt7dqn?Y5hmb?4G7$`7V?%p2`YJkG(KFG$szpeXFJMDx*crSM! z+5)zQx=)lsw>?Dep5XwML7d!uBHZx~8x`Hhbk>o)=bqt0Godak$34SCo0X%>n(Ut8 zt<9RO+kv^yJ)@_V5P6C)CNDe^GoP=<5_<7`V9iMPSuEEU!EQ`V0(9QFENMw>tgzef zZ>>pyE<2ZJY7?6}a_tF?zl|mVI_j8`m{02w8;K^!R+Czv&twfq@46vuD%beiX%ZUY zQ7Eu~*PfsoYeqKFo-b%JAA2)`rYcam%GYJxgzQoG2tm4x4w@SSx9Sf({W zE}B$VcGs>Ov2lkgPZQ*!N%dseUWDCE7dTlHK3a6T!P-!1Sw(!tR34>ZYQrIt$%x?0!s_O0y zIKMzvAcHNyz2Q(0C4d1rB2qGY9e9W5Tqq0ts+4(GiUduyGM zqrywzE-0Ozf}J!Y2|LM|=FnO2P-@FT>MH59V|#6DZV&wfds|6;bLdV7G_-|)LigZA z)-9D!k-E>z;wI`&%Dii@+4fMWv$Irc?ZnEwBIphjXFUSM>CJm~@2k21JQtpf5&E;uMInvIUedRw|u89KE4{XuVYT62zt}x4rp4 zi4F!$5FPx6U=2Td-lK8EgcE>}#yDpzF!ber^SjL?)^&5@7mftb9NF#Aga2+boiZWB zQg$vJ(P%I`h#BrHPS?uEfAimMxGymLcbld}hWl>AO|0$t@asGNyA7V0hlc-dgJiOu$G*Vs?I) zvJft2r1V9Um+1JAbpSXESuVy;%;1C|DlKcH$4CAP%u+pu(-=1qPrtyR6iyxfe6_p- z{{<$Am8zrHGiH4>>=zjNqUY4`I{-UH%?qywlKl=qbZ7h}fM+IUvp|^ShCgm%KMLy@ zI5*sI%3d9xqjq3ZgLR%B)1JdhySZ@QQhs7Je4br97Cs52#H$mz8TNmhUw4Ijp!oT9 znrJT|eVVhe7ZxvGA%@g{Wq#em#lRE%NIMzxvA~e|W=}5xhaS$L1KbZR7XQ)ta03`A z6F-CH&ujt4g6V7P>uWq8j{Lt^4CjKct?ef`tYt5oz&X1ah7U9GQzM*+o9Bkvz}->+ z@KbV1oywNpor~Y_n!t~%NkpPtbnE|7gW6!ow?_QB$Pmq75-=kC-ivh@Bf^#pYY#@$ z7gi67g45$uLqh|k_#(w3k`^bju2WB#!7;P^x7!a#@B8v$Uj{h(4@UZLOpQ3U131ULrr?FVWI4Pp$x;M4X4 zCD15`wE3I1A6+xm8I;GiF$OIGZ9gzA(5zd&5pFHSu%c8~SHh%i3?bRG_1SOwT!vP! zj;c+oBHx7g7^Nwx524tGhNY|f_g|@TU0t{y2JyBhJoiIQg&hbqn24roQcMgpNVy<3^$<>Qu7;l~ zG1HC$jGD#i-E%XnBGUkeRog=rhnbkT=j{m;Z?Il%1eOEXT(0-m-5?s|xSlA$jAL=U zza9p_5^!%4V0y7R9^o_|UTn6de&ZsKc))yxB?b(3H3-h#)!++hN8npR8FImL1cvw5 z+rYiGVAmZm*I67EAX6<7hQ|#p1;$iMgwA-?5ZB8D&e`3C>*o=lupr8faQYTYcx=zH zO2jL*{!$#=G%WM?#rNG9Z}w~+{cZ91F&N7q;G#e?4I=X4yWgNk5euO5;2)<)f{5T-h-^4?lXX6gVR2+CemgvS&uDX}ienxN1Y zDa+&z=#2=!I~<0Ol_YdCi?YJ+4;R?ER=`&t&Z_%;ICs$3n&c0qE(C^*T&8&fifv~s z#yhI6Rfzcrbql9H)03V;fq|8PIk_K;Qd$fT;jPu%(xES#%r4~gJlB`-ty7Z!5ioEp zsEXt{?nF8^=^#84KVeDozXTB@HqjI~H*+(w3x5y!gQgVvK?Jm=0kMkr=%;2Hf^@-B zeOzJQgo~%^OOlNa-jC*-m|2uF9MSC|F{TPdR9gH#d>`{7=a<^ez+Iwv6v>r~VJF30v<99u zF?IumRjj$_8a%rb3bQe_Z30ve!lT)g`+BT|&tXcPQc9xbdI)s3xELpqewWe`j_r~; zX(6yi{J-5;Ljdu|kj^UYjy8dJ+JSWhsy?xegeUF5MgxU486(ob6DtiyG!LFF35BlY`70?pA*jaWO1ed4d0X9OBw76R_sckU(bBzDEXdjksibOb)Ds4lPG4e zV}ZVpbueGauVAgzV>qdBmV?O#t5e~LA>2Fkw=Vol$S^&Illp??U~?&EgdyZtr*d;F zxH^?;;|(i?F%~l=@Wc?dIX?3^KQ{thT4HMJrB<*U%uZqkJ0vzhtq5Lf&CiYetjBPE z^#U9k#EKa#?8vCfyQvzvf?y2B5I8ClGni^Y^4kUx#=}$N#|wvBu&5Q$QAw#u z++~QoM}$enVJfs%M1({I%E_1vZ&pl5j)7AUJ_(#UBRL9(uAf*W$H$~*r4v^|1}KKW z;1E6k1P9UNukho;0(T}R(^&W?rN$&13^NI;+F@o=syZqw9j@|Y$CTle#@LL8XwYhY z)Pz)+(Bsua(hv2?&G6yu-M`K9dAhlE<7fG>=!isXpxki-Afgg3Wvlrw6}dzUC(^5d ziF`#aMO{b1mC65NrUA~`)$lI3jUbZ@xwZ*A_QPUH##SEg*sIf620xky~0)s<9f-|~XZYvay z?SP4A>oC+f;*4h(u{wIk)pJ0jA**fO4DY@>0`Ap;diN|_Phr6({<{0%=s|Bj0Cf*A zci0wGA76JDY{&FQ4ti?}t;Yzgd%@qNV!)ETna1*vNm{g z6uiM2uDs$zp254O)YT*6#CvXhh8{ViD0#(0jI0gb91Y$~$AOOP?7=e{ zPzQZbFjvxm`s%45J;jf68FuQNj_K*p*7aiEUJYQY)Z@rUTMV&M*MI~XavY4WBwPfn zl?8*Xm9ghx6(Gj~HwHTj-j(pK6uc+Gdm{I)n~ff6NfzFRnO%Dx69UFpBT6xEIm6Ff zgadFFLMh>i6`MJkwx(2~o|mJi=n!@=H&+2+N_K#`5Lnk(ku?;Cm0961K+g)vD@5BnUH)MGIQ~`|CU8~4|kQ-{^&{T;igR(`73%DV=+ZHUrQCK$lQr5s$G86lO=%jws zUj=g|yiUV6i@2tHc#SGP5GdKZFRjRBB7}UfZf` z!RkcG%&n9!XAd(*$Cgo+VSEC$Z-kQz>dD|(KtZlDfL`SnpnVIWfpfwuL0Ci*x**qD zseJ<$aELhJLhK!3(I@vxvM3yYPwaSIpu1YN2^Feq9RRK1tVER-XL`t4*W}JKELiQ~ zXD-5Ain-TZ6bDb5hga))hk?SH)Le84o-|Xu1`3-Ub5U(@ow|ZMDyb{De~j{Qj~boJ z2?MGHk%-k(=|EB6<^x4#86y)O5eiddvI5^KSS4*H`EotD0qfo1rB+6ppaMHsm{Y1^ zPQhwOndF;Nl}`oyD^cX1lH_9=!Ak5v?J3#IVn*E>2vyz@1`ZW((EuLm28?gfKUSiP zzShtDG%f0@3dU8zif?rQti?21@7oOE!<#Wh_pKD73Yql{9g3c1T+jU6)# zN+7`6WLn@oZ<7_;!?Nkuufn8?!u4W;B+UXuMDw2cNz!bZ;S;>af5V&E;=j0N^%ErH zDy$MD7va{o_lFWB_YVW(G%~IN16;WOHvp&FG{xuerm#x9R2t}WA#0Pu=P;~pht>@A z)I^eh1ZLGB{M36`cQcjqo2+I9;auW>F8KeckA9M~Hci20YjpV(arrg4cQ+dzbs&+O zKpf0Pv-Om|)}YtqaT6?gd)Qi{9PqG`h0G$7`LI2}fKm+;uw11Mn==ApuPS3ny$0=b zu79BRj>@S_i0R*m52 z6k49f0Y$6Uc|g$;^P8T!sJGRt%b@Y7(yQwwC>HJ{B6n`^tsXWOtw}XNHZq(9kSg{o z44F^4WM(n^hYIYgCBV*mZJptuf_70=VAl$kJtZoAoEC-m3Q9ywW#Q3meL5VE?gd~3_z+Ed;TDTDCgbLQUt6Km8Yr(M=V2WTn00VV`rK+k( zRdp!qp3><8tTB5(UNx^TM8VRruUmj+BHWi?NnV}sHOWsCV9Aj8j`%(X-_6K-Cww1^ z?_|F~fKO@GZWXj@+NY4Kpz0&hfcCU5^bjGdk=IWucU;_N2a~VSxD_OC4hjC<3izk} zYx*^;Q(P->tv##)lY{hS?{=t`5S?A^SS)>?QT(_Ur<q4h{zCw9O$(QMxr=aG{msON8n>6fd)rHVrC;eYr(H$Le9_pWafC_ zpy8KwZDvD-&4-x5Q7I1Q{95LY=O;6F=rK~5T0wJzJn86B%*4VQ%3m*Em&{LQlAb$o z`DIc;cAVXM;k`PiErC01Ynd zq9Oc>6`ZIGV)~?3I8rSk}cxN3=?hK`G(Lwl>&^8C%x=dTjGTvb%PU^!>#5^9C4j8K&iUmgxyboYCSjB2g*0ic?{IRUt~nATqfpm{HU(!Z5{y z*)tb*`YZ}(9MKsC-FuJog;6l=Xyh_K`KWi8u-Gl^xZ(pPyH1SHNQ=@h@-v))6a+LQ z9wThz2m9HEaOoEuIuoh)F_xW(OimgF4rC^i1t#dDNY8;)%E?Kw5QR~MPaWXOjKDcM z6=@UzoEyctT9_jq{mIG~BkU;1n`5H{YhXwy1v8X_*pewpf#<@tF_~nk4L4WmLMI`~ zlhX9*<>5hi?w+3P;uu^TgH0-YHw+Pp=F-ear(}hh!~`wl8hTlEF z3~Wo8Sf*K=4>q=(i3ef=U@m`(GnnAZ1Ds_$=(xZSjov*E1Ls7(V7C=8PXsue2Nc%& zD35b!O&yTp4X#mfcJ=WP>IJ(9?tqJBv1ag&YhIjP-MR^9T$clXJYX8P2LcSXBc}Yt z@1>Ji4C2sGf4gz)N>N`@7Is7xF zm!`n?VKEfR`Riej|IqD0fSbW$^?HH%d7-~WfcqLS5jdFz2HRs({$hNOu^7amq4D){ z6Dknhz67|sSOCE2{q-_DZDJbOwE@fu7H19bru@bH_k_g&NeuPZrJL}>0Qy^}6MXK2 z9~!;CJ_gYh`GQ?AVCJ&8>hz3Lmb+LCki<}bJq$i@pua}}_kqRg{q-i?N=|0r#54>iu;UmKY64S*jSF22U6m|!+h z1Lk`cS6#lx^jO1U&^u-BW- zVh9i()L$=yMULq2SAZ*Iv3k99Gsvc*<$$XIOolTMU~0n;)5Ft1DGy*xxCD+r(n^{(2d%?ezuuV!$wLrsV1& zXT$1>%-^b$reH2(DWD!xbIjjpZ{D9@{1I(djRtni{s*9 zod4_q_mIT^NetDCyTQI1Ob@0zOw+*+4d)(wzxNc1OTkV7n0O9w z>S@p*p}%thcfiO!XSZ%bZ%O_;1sL}p)UD6ugESUHk!(J2_3{uFfAn_-;C^MX`uMuL zLaoD_X+RzXj6be^15;gjvjMxWSquTfgT~j(pyP@Dt^`~Ki`Dz<=5DY60&%wiW8aIq z#^H?hYz5XGSqw!|e~oc~7ZZ$J%j=L;X)Sfpd24X3%j* z{pAC0JB#J?=j?9K9Ep4ZR}L6!9LRy;%DJ)rnuDDSiy=UGVEP*4Y=J+Z1~_alhSdOv z@r|zm4#S;d0_W`N?QNXz#{q5yi{KoVmreVc&Igc{%)18#l|a9EG6HGy+>_3~l6 z79=c~pML?|Wfse&o3pz++maC&$tBY?dupY`{DAII(#&pZ60S?Q#t_C>l zmn^9vZk-97GmK}9^YdQ7-D9zwUX1f8hVP>Z_l$8CfU6^ehrpQ12bk||P2ik8y9u)& zNsktQ8_r^@OOF=dUcL$UjKhcVSY88MEx>K60S?2nvj#ZK&wFct!|^fd~W4 zA{JL&K9B-#KZ^m97*pZH^!>XAIMnm48sZ++09Oaxdt(CU?CR-mTrSP~!ZH{5p)rG> zsd+QhgObG{4vne!V*U#-frI%(gML#q;9>z+%3`bQCu03qWx_q<@@5OTmU4IqjH&RU zKV3}VU|!VKxE^;0Tr7*_^y2JcIPQ)H_r?R}9E+#0%IyYFupD|z+pM}t^p3`V`V0A&ahru7!jh^=>I`BhNU3y^uC5y!n zAUrTVoITyy84t>hhJPBsRkB!1g8TIQM^oTCDB&S6rqUPt2fb>5!*PYG1~}A9Tn%tm zfXk`@4%2P237j)DTfz>EBjDx(ZV!v)@{2R9Ul-=9CJfAb1Ll?r1i)Z@L*`Fi4af0P z;E(GMZo&@@=bmxC!g#D^F$4$?Q+me!#>N`pupZx2103f2Lp8vmd*^F_!}*s=6F6r# zPj{i7v3$G-T;~BmfT>O|m=Ane3<2Uh=4V$IH{pbd6w+fL;Kl_|6t)wl>MI<_w-2Nk z?pd9ld(;3|8yr#A0EgvuPz`Wcjv{J+!*m-}100Uu#?=5<7jRk=IA=F^gF_E6-M$9g zK^9wGx?#WRf+_c0J>U!=-uMD}3vlg&D6hJD4f8=Di=jxG4~)wZ;zrg0hvhY`1~{z$ zrkKDv`xs2?iJ}4bHQ-*d*y`$2OgFb+cnFNC{AUgJvKrtpzo=@63pas-dd=W_@(OS- z#t4V|UX1mO^?_LkoK6HkG&J2@eCfu8ya&;^pdU7U!vW~m#4^btI2!c5au1^L2j|6= z!;x&TuRQQXnc_S;0O#^vg)?a@fn5&l#{mTvgk2DL6^_xaBy`^I(IZN+fWL(w-C>Xc z8Ss;>|9Nl3S*?^h*gYQPOC@zd-W;JM#BQiBxP2rz7R@B?vBGd_X&Fn>c z$}Q{X2(;+FJ?wsWq%2*q3nBE!1(4$*+5sw?1QM&l@q|M4Poi;m2qAMNm;*xSikF&lMY}bI~;UCK|(EJsiv{Vz)&sv83bmc zATZ=`b-L?=Xa+V`z%dQQFCj$Z!<9NX(3vKGtc^y=6!)&WrqT_xhOG`HNHdG3y58@i zDp0|33vUCoM+g&^+rnz@#wuNXvLix&;s&10kflFmLBDYYD@Jp2M9m};tT1?=OsFKF zrVt8<8X4l8hlnZV$WGyMKs$j_B0#gaEZ(wMYDl;=HK0}ro7aE_D6q6j3 zl`;x;#ABvFS2zQ310%FU3k(TnXNG*JX-z125K~0M&p{sNufx8S12jq*&OU z+BY#RDHe{eGgc?bb0EYS44Tkj6tRw=>UAWP(Ef9Db?V_{jQ!&HI+nl;`#B^1oF&*{ zXiXV(A9O@BrU?Lss|`^ihG2$1d2rn;O`b0Z6#}*$2^9%c9>Jvpg;%K2IhvK#Xv>4HOpr|YmH8M>Ag*^~FC@nN96!t#HXQ)yW(tu%D zp0L|3G?Bs=pfS;~DWG}Nl~AZioZ>*YsHrY#HDHaX>g;X7PC=rG0iLB-EzP~&z{3q~ zG!ld2v(q5!CZ(lfL}&*7B>#d71_nJ48Vm@0R0Jm-;fbG$_(;HuNyE8WT_iXmW4}25 zzvW*p|4BIkqyL=$7-CZf{WX<82NTty5@{X_0SXTepa<%WAXGZ=q6w7)R44e+lSyI; zZwb8n65bYgCJ^3kpl}>0$XRjn74b+N&=4NRB3KRQ z(?C>YYB=g)R2H0XfUXPEo6DxaCPrw73=9SK$Y=~A2?dYOntzJ{XK(Bm=P2^?No+8N zG)-K9noW2ZLoJD62vBnf55qMKeq5cyrWwRs6$fbt&8LY@2{!IRgPsWuMtvmwXw+i} zCA9w>{kg=W*%Ey#Ac4oI(JY8jqtX4G+d?~Zr5^l@BF?U{kBtWQ~I5_BDx(tx@PO z9GUQ=shCYDBgiMO^H@%GahT7#V(gc(L&lor?73<~$}x=oqr0Xmv>)|4T1lu7z^x`! zBv3Txqyt4Oxg4OVe&+$Tmf)5Eg$Q`5p}{!d>;%nWSeJ~3vo}9qEgJVny^Z`ry-p@> zqU%!$AjV}Ep+bPFadV;=@OhPSS%M3Y z3rDd3F|r!?(QM3hK8!#{uUhu~|FoiT!w~Ia^Ie#lDk=od{28B?5%>RJTeOfmf({nJ zkI(ScX@hFF`d%;EV{7?2`Ol3PQ65vdI(f`?2Z`n|V-A8JZPyR!wKWH1CcC2rKLkUkLVKxm8$JH|t3FuvcykB&ut zAe19KmlFyepEduMhq=%g`)cec#>kZ6N|Mx+CGgN)QNH0O+o(Cdb}%)-sRKz%2jG0KT%I&KK2u$dl8mcRsZp#jqMPAImGmp2 zj3Cv%R;MH``&6f->XbmU1uB7Nix8k_wul5um@Q&6CZtyvJABI&QkGCXtP!EH&~TgIx?i8s*;!Wd!;370M%Q z+pqf6f^slQW+eC+X@10Y0^VplSD)BY^uIsRmBvJtMmSZ?jW2QZjlOXPoHZ~)JG8*q z9)=&STaOaT5uP+;#$$P~FfizvTpuq!)9FWxnPd)%$b3#e29ClDhUzT*Xd3)QDE#1q z-N@=p4Z;!uGt3DShy(v=Xs&=14b62zRTm0lKE}k9;i?+r^x&|_@2A%+KZ5N~cvuJm z2^9iV2%#c@(h&;t1oVF5lhW0L;>Tq{eFs4|%ofIl05g=(V6ZFUN27e7P(u69(bYwn zlc_GsoV{^aI6lgmYDj6pLY2^hg({({LzVDjnkb^296e8jO926$>5m z@WoB=l7>?_pTrQnGcd-ff-!6aQKB(yLMQ_P6ECO%G}Yw*^rJa(3DcOb23rvxrl8Tp zlOT%zX&EUoY7vPHvW?$G+3^{fFi9-ROp5y-O%MB!KwwhzBvc&fDaevXr)4Cm6H~xl zm`smDy=D?RMxB)rZ)iq;|}@z=Guu9;b*#>B^}4d=HYr@;ZJ;P8LkgbW~|LFM7`v*^O-4Tq>sD;Vp6#3jR= zg2$uL2Gb~~7=9%XW)85yQHKeZ$S8?3Me(VzG3kBNYTle;=!6F2lSIOZy1=vh7*Q-= zdNW0!V48jCcNv^l`n-WVSBUwXrqWDkDnqZSFGG2}&MU(*rX>9xib|w&t7N6NcPqb5s^J##=QlTPfq(r7O7aopF>muX2$N1e;T{KUx z)rExOv{s#7G%TPx`|8To*LuChfeY2mSqY06PLD(6WArsex_+t=st$Jg@sldaxCJ&9 z=MDNe|3av&u_>Yq?sEd0E@Xz5&qmcn_utfk_Ta~7tL~aqLm}YCRub4qps=q+RT!+- z1V5i1jGBYiiq{g&PGceCVOWGJF;jH8uSBAbvonhh2fwQ^ojf; z;uD63@1xc9E5iWA0A3kbj11r8&VKz>Ep>i(BvnY zt4ZNHPh#N+vA9Sm8o%nFoMx)i9BSsWUNd|{e~s|G!S<8tTlkR-qCu)6_#Y9IoCVbe zpLX&(S-G)@nFh06JkV!2G#Li?@tw>vQpDC($vt@ za(xFJ@PE#569S*pZ8UKjb6qF+(GCIqbc;dqB|NO~gAMft{2H0+yym9TK35=24Rb9Z zfsChftqCs@!eh`reVPcdv^gdjf~7y(B(Vv|HtwQWb~eDE{W8{q@oEUp9u;Dahxv?41kQ6AI zsJ=k8Bs?WhD)=#?M0iRGFCD0jgf|bK?FerPP&){3H#|EKUJ+1*gm)F5PJ~wpRA)k2 zLs@Vplr2zY1c&aSsV;3W1Jku87;0J<#nCeep=(S!`ebbb47LnrRRJTMKSXQc>{?vc zm@F7F1&fS}+JqKK& zQ;qY0qO;CR^t>%V(OKu+K+$D2CxGffWY6nykAdnM~;7%tO@>&gZzAPJ_v_`U-UkI4|7b}GQd&l>#vho-s!qdkPppqq+# z&R~QR^%0_pj1d~Ej}XlaA;3!|yhxxZ57RR=F(xBEj(jo0z9Dveuxe3H2q$!AR(d)t zY9KVZH>yS3_MN)AcI)ojR~0ZQeAvji(PPpxCrq9?lhH6=G4q*km~WXMm{rUgW+Sti z*}?2)3YlW2j5*94WzI5Jm`dge^OpH&US&SbV!Fiwv&Ck!Ei@K0EPgi2v&grYX|cy_ zmPNVQ5wlBXcg?=E&{`CT=ZWW7tQ2n$?-K77pAnxI-w{6+zZAb0&o^IW{*C!Y^Iy%6 zn(Hi1nO`@DjSghV@mToZ4}NH{AvGr-G%1C8rW8)~Qi>c!2ybXG^Wbt>-q4r-&9h@) z)uFEA{GXT^1y4vA(e!&(9r&|jKj<-1whRr$0E5AgY+|N2KH;|^(KeDlJ2qO6krG>I z4p|QNGWkoK!n|sC;LnZ?)?+xSF)RnWEMjIfJTa^d$2GghpBf?;fa{So^>nu%d%bxF$OMU0*D!|qhtBF7Bv3ID}r71uvpBAqE+uS>#DSrHC0vcw^NJA6Gc4K!`Dj7w#?-GZ;=ZDdTSs zX+Wfe7jqE|u{UEoJGeKKY950#y?ySJhI+qh2{1HX>shVh@&P_?ShYCrWv7?gD#RFs z5bF&w!*!N7Gw)%(>? zfT1D8AvYQ#vS=n0l!2!>EC(P=Qa z{elnSp5;=eh2Ad*0fu_JlFgYdiIguqQK@!5=i0T@ORW=P3_^&z`o#=4#CjV)aY-va zgkE3?hF}Pl!lqzrc;iEeH9%{K7`#UmtY8K!`44-;f)XBz(aF>X{-0Ep#Vcec!)Y9YDc7e;fXrL zTC|;B>I87m5DcN%%qwz$H^UmhK`+HNaTH^q`SwJLt9zdo-T0|JA1~~sfgu=5v9(qQ zc%$*cBz^a1NK^;CU!4UQ8ZZ2^hUN?S@ihR(>kGZqYl2`g1|h^cP0U~kLeqU^Wq>0e zLLbT{7(%L8-<{x%*F5G8C%s=G0t^k|Y5I@cEycGEod)E1cGOE<6k>>9a_Tvmv@z6t zC%x1FA;utHok<8e&5wS5A-ppmFZK))f*~%9VoO{XB86=VYQEv>w{S2gn`uQ!0t^kT z1A@SGg`Z))(N!EY^2yHu$`O zA#~UKRUp97prx>F6ISJX-Z(bczqyBAN-e~or=leCq}MAL<_%B1RJssj5HGCq=vAc% zDH>^(?j?v9ZT1L;xUilLGgd=y+nN8m^__hy*{uLUrnN?OFK?rHHM=-?x2J_6Ua9Td^tF z7vA^~-d()t`@VX=>IpD3gh}+DNKT}D;fcX1i%uLT*Gr`fFOX#RV9&< z!V~#@8VAF%AzY2UO^7iFp^8XhpBarNEdr)nQHox)OPf7{A@&|@y7z}SUh_AWUYy)t z?^h22hK6u9>pQklVnzy2#LKpy8zR#9$`qGyHd>}byI+$A#BVlDu_r$!xMAw=69;=L3$}%ZGwhi3_=(TTrtDt-nK5A zbislU()NpBi2PV|8cYcMcpYM&Eky5Eh5$oD=*{{*kVs8~Cs#)e)Jx%qRx|`-5W+#g z6*D%(RwQcue(1wNf)LX7i(m*s!}=adq&OWWGIonX^?uD2U}y-Nv*{jYAcgS?(@V7# zVhlnUPNdkbs%Y>pt=fhQLP%R8f-#VaAW}GvMiX`;xkZFPina~}V<0scuwn*By=aPu z+TR!~kfJpL z0OJ1<@Z-A42xveS$HNiXu|B@I>>tc4faP zffOxY1Y;l-4OlV5HUpxA-^*J?3#4eCCl~{%7$U{#u-Ad7J7NS#a3aW z+<`6oj1oxEd`K{WgAIdhHjgDzoaS-%AeKlWW|RYBAb^fY;bW0|cqPdq~45Si>6j!qij`uQ85X6h-UV<@@8cn1)&A-q6;4)eu zMRPB~7)T`&DXvte1 zu9YL2XYWKI7z3#kz=|2R_=yI#=sq+>;1|t@1Vdb1#sX7`6qlp0ETeUwEPpu`JV#|L`IjBE%SkFdb~g49=FI(fszYLAoG>G|v-^fz&v_@@-|CIu#?w z38ZMSQSvU(feS zn7E4W>qU^i5M$uiM05w{@u=BzdX3XWfnT)lB^U##Nkod%#?G`ETPF#mXr3n+1F6YG zitSj4+AAYoO%_Ped`K_`Qd5W&=65vBy;jWr|CoCd_^7J$ef$m?A-E;Dfg6qr8aK#< zEr<&df-{-`BH&UnLP6v;RNN zxG*B6dMFrA>LQV{@p`%X=oc=ENU0tQ#*hl25>R*95tzvd6z z_pwzGDb*;!cv2UOl&ufvKia5qwq*ONqLr;UGDLZW^&kO0`!oV*jdf{z|-+ z#Af2j;M9HZ=0#V!5WW?~cz#_aQnvlta?g!lTow8?N_Ac^p47KQsvJ+6#23e1^sR`L z>bzh)sc!=tw&r&qa?6o^FJT>=l3E~s=b2oq;3!?8^X&6488w`h?HutU_7bsi*&)1>X;) z%w0T!0S?=LOrUNQDXSao>D?$&#H6AaGJ*$8OZ@}TVSUJ+-VdDAqfv|(!ka|O<`;U4 z&)pOWq3XO~JgJ*S%BEq(83SItIU=PxFBnhi7Ll^G=-2ifKk}A{lcmCU;FfJ`^&8nzf^k#<4N5n zQoGY>nDg!%f7)#kDb-%Vi2YilM7QHD3}N-~oBQ7GLbyJP@%*|&r22_V=$YUD!mW2i z{8F74j3AEJ4qtGmNR7plRpyf;SH5|t^J`)h-jeqht-Uvt z8qE@<+e!Tz;69PsTWs-BY3`%N_eG>s=LO^Wb-zg2lt26Z&nMg;ky4!(j3@PgNSW*m z{`TpPUwBT9^7ZcBM~VrUxM+Z9tAd>pMPrTZplX@ zQd&|3<4HXxQnm*8=f2yW^jJhnbzU%@RJ-TbpYD5WxAusXYOi2CsmDcXH#})>*t=xt z#KMKGS!I*~FF2=03{`^vhglqjNLJgM~}Wow%c zV=cd2AC(eC6pSbJv`ATvx^m}7FMB#FC5k8*Pilim4ZxG8^Vz3P+z^!#MHGxD^$f6K z8g_mEKO3KkN{J#0MqHg@wB=cmqPnpxbNuzJND*{e6yy2z9BfNsrh*7Y<{I0ci}FQy@Fv-f*Xtyy)II>2oHNj z_IUC-a)My&oTkRi5Ume+poS*QuC^coLA?!vyR0%g&Yuc6?-y`xrl>LM&gcTnV+EWS z3OG{=IBNr7AqBx=9m{FT}KY?$CkH z3OG*}aDG(4X)55HR=_Fo!b86vD8OV2IB$ELA#9GP`L`W6S(ZLndRn-A7_+(>Zy#@KZi_l3_z33Zac0`_Vn1 zh>e`|S?n|V?yv=iGZX>3)I(Z_U$+(kdf&npu`hZ`coCfYDmt3)h3N!Xu`l6^IJj+h z5Us*PUW>S55;yXZYY|X!eJl)o(G%{9xtDijU=c{DRifU7enm9Ah^6~NrI^$CC&w1S zL{H-?V(l`MALA9VFZf)l2*y7RstCY4H?4@hq=0#hV*NK8S({#nCN5I3M-t4XYSg~_)bibN;dY9Igke(|@hfyItXF-6iJm!1DNo#3 z=5f2POMRyW7s*gPq$JO=h`r5l-xU{4#4b|F`k-y8gpVxH2jAMSseQZRwX~0Mc@eEy z3m`>nXCKwQJmOlUR`#Wf)W|-dFu~Z&`4f0~LNZ zm>1eeu`=~gv>+Hw)>7;TQ__m*VQafQhl>_*-wCg#_pO{lNG+eO~SETlzJ- zZzrjzwK^g<0bT@<4&j@H7cq$v)a zo;bDkcy#)#?YJp*&hEJM)P|GsVXpSk)$wstYq!muIKFm*bFIdH*X!IgVM?D~JAP`q zzSbcbMh7~%_M~aG6UPZ7uVcEjDbp}#e&g9ogZa&8@u0yK3pt@R}LSgh?(2ZzC`DG-oiw{ zNoH^(A+Q6TZvH2N%9+uxUAut=V}r_dL(W>dv^#stUkM!U(U!Rp%j4YNFEHr-y_u1~ zbYPGupFDHusAK`|Q($_Ti8Y5C?p+TnbBUZi9GH(wjxKPo0+=K7aaF^0O4S6A;TsRk z^nBc~Dw%gNu;5@2Gl8*tmR$Pz=HvY9T=miv zjPr+@vA*+nq<8(Bq|0bv?EW{08!ZziHh6-Y2He>N?s?aJ3ho?WTJv$kd<6Zrj(OkFfP8s&C-psCH-~*W^6ug z)JRVcm~STlvmzf?dtDLc6FUXwuKa{KcAIjB7q6=Xmp(wYI$7L29)zkOE2 zYWP9J3R%A_qp#1s(fiG~)GoBUoDZ0IkT5f@&+EjiIje!C-b!ufq+W3tE5#%2XjnP; ze)V=zywicExASYAyaz!a{P(5$IH~6x#`^WS;c)iemnwBqm>?BX>iimSeD5n#tZm77 z_JP=WeVx<^4rBe=*~FAnu_ZCqsf1jf{Rq?01}q0)fr;}EtkhuBH{i6dFSUb{vR{er z;H1XV5g1P8`%*hPDHchZ9i7yC6T+Rq^;2UfC&jxkX?Ai_XDLJK;85!5+olfP*-6cH z7#pwKj5}Pv^QFq1)IAPkrLKsnL*)fhTjFmdr_|6KyBxZG^_ulWHxT}*o!eOk`9}Q2CX_cXLwq9FN@sD-|=k zv3r5k?oO(Y!&s?(OqjWj9O?%B+QUg5;4oGyW%8oGNZGQ?T<-6rCOV9jYB2F)AKb5_ z$U)DeU3&c_$>f{y1WwMl9Zd_Ilq?XC)g(71y3p@<1_9)=+(hY0W<<0`X zOgB_uYFX)Fx>--*h{ZY`aK{jbS&bQv+>#BA7~eOXb#6mu1*XU{IA>Z0UG_ZVZDBCz z!{Nx=LO55>#^6&tnzg89VbmYvMz{6_E=0nZCmXSGQnQ=pH)Wc{>xi`xj9TWWNCfR1 zbIBF4%uj>7F)`FZeX&XIB8n8pd_%+~=S}yJya+Sb=th3nE&r=>)Av6=Ce{_>Izm+` z^R|{>#Pw}p!l3)EgswY9oR}W}RmtK*Lbp9PiY1FL=#t#!EF&A~ynao59h&vE^gO4z2R8 z?3OzI0fV7?V(eIKdgP|%RMy;zj60`KNoAi)<=CAtw@!mMCY9ar_@0iF?VZY=S=u2k zKhB116Va*MiMVz-hJUz^`Cr1q1jOih)&y+_X$7{^D|k3LE)&a0s4E zs(3I4Pc~X{xur>|CcLu&iU;T5$-qPhjy1TTI#sIU8a8wsgBkmp>5S^CPga7JT66Cp z{vV&+kjlQD&c31{M~o56rS-XGrS-W92>xd_2Fb0kI6t*!+Jkj#YH=;O#s&9D&ux1z zbN={T?Z4Bx2?NHD3Ch|oq5HYXrMRg4K@#Dl4L?km)Jcn%b59iICM^*o*lp*r#0Uno4BIRI2FI3QX! z>6PDuAP0LCI4>%cw)#Fs3rTc-j*8}ELZ#kUokZ}7X~mPJX4oGGUmK2c4s;mX$Jqc3 z&35?dx6Xtt+A(-D9Ob+~0L*rQmHJ2-W|YIyO220AuwxO53Doy_;jHFGrmYVnp=anee3kv|MT{g? zA<&I!SlB$f3RCiVy)W&e6u3MK3mv$YfYFF1L-z|3y70pVl%{2i8y3u#_+Txd)Y=5hE}Ap}#EiegMuT*Q&g=us zpa@R-2*XE=bRZCvA7U_$Z~F)}r_@ZZnN~AZ`wDY8`#BSRg}Pj0X)Ky7ksecPYP zuGz4OlBw)^{f|l1)jt%*b2XQJkj{3(X6-64YLn{(L7~-m5Rp4&K&thkM35;>bsW#u z9jtn^&gT!RNZD4bHn|yswmF33SFj$gTeCbttmm}}K{^{BHxg7_Ikd2}J&zP=83Kk7?D*Ln-?hA(!md;HbR4R@! zVBa>v8jD#QQysOR!uO!_6Fh3#*>oh|>*ToE+PHY7W^GKj9ut(UUJp=Rwq?_Uu~fEp z3sMWIT9F$4Zl<5ZGMs-0jEq#Sc2ixhRMR+D`)P{PsL3~M-Y`^;1ByJ#94o;}15nDD z@zuwh&?06o2B(6T&eaVnZ5_R}WoH#YvX;V$VC4l{g3Ruz+$7}GDHUReY);Usj$N#G zh1K~hyr;77s6Dz{wQ2T15z>e^R}i!2_ynT3Ni;^|t#R($9@mxCv|kNOS6Wl8YeG$X z4d2Jqv@gSdM5kp~>qV78%Mo69>atLyY=Z_4Y1jGAmvm|lM3V2}-D*gvA67FwXNpA2 z_7!cvcP{&FXVlE7IkTo=#s(9*o2~y$?!B3J9kpBFchEV?g`;x?Vy6++^x6|v>`1b_ z!~>RQ?G2v_O8dP`3GLn81xkB&4}sF&T{|f4-8~CRdw0x(1b%UJHf-;%AE*O_#}8r- z6eYk4Hh0R+Brz58y&^lRSy>4-$AKFZxpHu;Uz#FBGf2QhYH0*v=0+% zj-!@>I$U@>y7LI3K6197f?|rqgMCpg?=RG$pwyM49aRfzsMvlNluF3Ll#UTvKhXuA zy6j6B9i+0aq_QUssE0-#P!El?8k(Ju;Ar76)M|CvzoxSrRdKUtRy=_S2C25KnPg;C zlegb}=Z8Vv(SyvM(XPW!J2$ zZ+ihtS*xEfTm4Po>$0!ZWjj)BZ$wAh%ucD+73D#ucZc+fb!f}NRVp%gI8y~G7F0#MMsQn7vcpJ2|Gzu*>P1gr*rh3n zu|ve@{Bz_{M}$PSO~@OJ6KsK5M1rXjPaVR7RUY}&IJ4uSIm$5AU%ykUOR z!m~4T^KHAgXM_o%$YiIHO@%~*R`kH^}{5lX4>>LKcuh4W|W)w5ppcq!czyHcu zJ2}Fe$UX_aejnxaPo~VW;OSU9IlMX&qI*Ecw!>HM_|Z7rs8LZ^a3<{50W*-T35>%f zt457hmOOXFv&vvBTgUE|o_m~|IHnjbS>=VV4=TK+z}a(8c7U9^H`<#s;N?)8&}P|h z!unZUa+v4w1n>vak%$rZsy$e+5cd4q?hS)wy{qXrygC}+dhmY*%pr_8j7yi%NiTep zVRtkzYw~f!Ma(_sfVu^kK07HZbZ>;6&JhcSZ*O3-`M9LNmyUPG-3ZL}m_Vo589$B3 z2yav6gWwM?4}xFfM-#?(l;`gh*nI#@k_imsaKrsM9QIYl05fI}#j%Gh{tolkZ;nM5 z=-B=^JCXnx!Zm!A)f}c-!~3gF$4Ka#TI6JJqToiEWAY4;9gwjok12L1VHiG{!x=ep zm@v$PxGBJ#o{t+*U4WYn%=~=Zs7iJrouPZnfVnUqH`0$UahCyeRX#3RRT+&hyK3Jv zn9!4Q)7ChS+|+R^a6d6v7Wc8`m1AX`Gdj82Zn7-(!o zSAV5a6{)rtGIJy(91@1-hW^9ne6B>T(h6HOF*j@o7c6%bl;y|=ldaucKMrise z2(u2m-72Ik$Ca(VpAxMXmIj&qQ#qYl(l9dD&oePSARB z(w3vk>G;KEYC_eLol2^vF3O!E)B-$D6>24(rwMgAp31uu)ak-|1y9w9w?J{M8V|NO zp3WI?Uf0a(YTA#->;M%$TC&R8{tdCZ+?>+-wvWqJ?~3ZjpEcmBY1wMl%5HLm3@%;C z6y8`-xe=+{N|pnv-ywBt>i>Z< z)RoS5bf67oQQA_o>On7IT%gO6QrF zG1Q1i6;-zSG%!R^a_mI0P9b+*$Q&N2rBJhKErpy(XFv05siTllRh;O>8vkEy@Y;5P zOT|J_!%%FLDa>fS7Dm7G30MvSO7)$1>U=zyfT!v^wfPL;-GgUZs0Z;>+fGn3g!d0T z&lKuEcs2;d`_{D#Ob4Ydp9yNF*nSsOqfmE%I!mahLCq5C3s73S^4!na!qfWARaBg( zK~5bU(d@mc*`8YW<>EXhl4fj3uG9b8#JD=Tb##y!WK++tD$a+mwo>WBj5YmxBhv@< zQbj7eJ*Ol|C(>DMZZO$L#@O<7Hm2J>KWk+#8Av-GyYdK>0QO?%W+8{}|G3K3zN zOC_bwGE189v->b?^3a3BzRH7kXD{Yucm*uJxI*Gd2`Ujc-8M=CMr;K-nRmEB;cIBN^x~#%WgwGu4=y*176Pm*^-{ zX=l!>X}=z>BsZ_xx?4#QT(q!lYuW0H!D(mLSeY$*q(*NnYr7H*nV;1*cH2uIMJqh+ z>t z?E@5)>90#So##MPo}vR?+dait&7T0w2VeX?fK`CsgNK4mH7xqZkWoJ_3 z#I2oExiwc&Gz$exm8NqI<)#`(+k{1~nsx+xt5t>02c+7pfk5ZEAS*yUqL_~w(+^+TAmeMI*s#TvmXfm7TY+xf(yMIsr6AbH;aor} zcRJE%T!rZF5MiXTuzt>fZuSL}!~QjbAKu8;I=C`ljx0i{oyim;Q-T`ISv6#eT2T)zgP(n|8w0q8iCBk!d4 z+U}EoZ{3=F15rq=i9gFaBUN_XYpF5QE6Unfu>d=uwYseA%BS&CJP%u7)A>t0kbT&} z#l#_yu8nrxtnw_AVCcR&WMqD5Hl%VB6YGClf~|h- z5`Cucvj}i;pO!{kvps)w{?^pDul+l$#D%Ww(%EOQMG*O{DQdS4*#Go`d-7}+reZG+=YcH%}wI&oZ=)S+fO5J9vPSGJmq0&VNyMA;SZ zi~Na|b=kT>t~;=nHBn7_09C1ZoWpjT3|Fup1zm-9K!o1TLXfd@fN5n^5>ffVI+X8r z1gY%mr%RtMYl~9~ZO+x}Qlmdt-s(@Svl0#V#Znl2bmO$$hY7c@xD-(AdQ7Bq(<>xg z>Fk9GY-easXD3uJT*Aa^VI_PBq@L*91L>ID+PMov>vGEmq-PzIS~F>j0-5yGGHiIQ z$H)+yP7=(#v; z7uH=%oTz8VIkB$k&d!_EsG+kLN1ToJ;%=m66D;$l6e6zMrlugxQl?$%`~bz?`5loo z+ZLX*cAZB+UpSCy#4j$Fr*d=@58lR8Tdkvz^z()HFet5!-vY(qELu=#n(|6PG1BpX zho>$Qig($oEBtt4vG92JIDL!C4`XnfocmDC zeO(H=w2LooeJz|)!faL9m8@xf9SGILYCz{b;<7YDx|Gkc7MpZ7Lr{3F4c(Ab8kp4= zh|5goq|=f@x2-avOg$J@h@IR8QX^Fp>R+alYc+nUGw!eLi6Y`{xBHaDTahmIY0 zQEf(Th_w3LRfrc(M1A;RSlzH6ioNunl#vPNEXuBE2h8m6hI2ZXA@vzHgMD9oy|5y^ zW|Foj(2&eGP=%rnOK?{gE3pUtN{szQ6n4&O)tI_XtH+tqs>|D)BK1$$jCyu8aLy)g z*G^g|bbf{^C;1*HKXi&B-7!JxVLSgK?QJx_u?OlVIMlfof`@`Q3ct9VldHw-BfOt0 zJWePnuRka)aDzcPY zMt7Y5MqO@cX-(@fC1qEB9q!lXF2v*>s+)HKP3Ov-=v8=6zSp%^*?#D@#>-Y83Gh~Y zbD)UP8!lJ^+Gu7Dkdl^-aJAP(@6~klM$Ch*HQAa;!T`KN zJtrnowqY+jWnEc6Y_l?|1gCxl2*+n8fEON-e9y+8Y!i~!YRn?G0?MEo@aPTazt5nR zT}fp^sVcW_j70+do7uckRu;O)L;yH#r_u!N>t3Uw~F&7tbm`gr}+U#=}zgW-~yEwKwwkp;dV-3M?1D?l! zhM#6MerW6+RqCi69Ti>2rdWyRjlTSEev@)wZ+HU3P?f|^!jp=!Ze#De!;MjgI7~up zQL7LR!yZCOjO{R`mVJ5g%i+eTiyg*FZBPAzp>rj%Gx4OZE?gOHLKSH$~)8g@z9`QexM)MlFPT?qFvVWtlyu?b>}GY`)A z%`V}W_XjwP^{c|957VI}##);W-~Z#$-wMCHAL1}p>UHA|r<+P*^>{MnAG&Dzg7C|G zd+JO0<^46rot;H$vXOfKw8lx{m-ja~jP=VTPf#XObBxqM%TM|s{PLbDMN{Td;|b$V zIk*}xhVa{cJ~%A=@_xO;Sie}FX_($6F|O_~te1T2saL}<@7V&<^mBgMTXc2-w>X z>;>w$p*J5BetFLg$TYh-spAc2cW_H$T&v#$)bPviED687uXh-xh8}}RS9I&No}kaX zSa-g9t`RZZMseMHLY@;);^JB*y5$f*P5-eSriX?16k(dUqJ5J_Vcv)R7lzjC%W z`A!SvTy4S=a;_@yi@ir{l&mYj9Bl#kub3GHA^b&wU(Xb98Vg(=P!Q(d6>tvoLWoc7 z7q={(>q4ZK_Z7IjydZ>&3osuRVCqcirt|9ZQ3V{Xty!a(=L#JUoYT1=7p#D*3r!calf#@ukU!V;LF4U&e@({w7#T(^TPtEgcs(* zvo{LQ)sP*TJXg>dO+$`atWomz0?zaT&dUXyi#<+v+g-6M(RvolfL?^#TKy9~u?e%X zVKFzpa$BSvlE`Bb<-7!8^Q;2%+Hw|gH8^)tJ~&)BYstBbWeca{&29>Lp^rGjpt50! zJsn*((bAEYh0B*TE_Sc(B@`?YRED5CfD5#IUYh?AW$|xGU5w>xQg_IR9J>$(c~;Ys z=+Pj4xSBK}WIL#DBZoCwYnQ&3(Ooo5B8C}a8Qewed$4#pPk&@KglOZuZZCG8+MH?T z*~Z;(M=tb2;viDyl;Y@C>|n%)Rappp81Utpi}AxWW@xT?UJ;ctKj) ztzON;q1svm8t3DXQhz%(Q%v@TpUg97mV^f$ODg9x8>mSQ{3^S<+!xQj8r3upVQR*Q z)No36oKK3L;!3XD4$UfE&Qf)prWK3lH_zfn&cg3j9SXLAFKe2=XmS2m&~}Tr*#_=P zlzc~_(WDPe3zx~ZX%tR;Utxvv_JyN(7vJ3N6uD(Fs**W+?5&~0r1Ue~d`%r%d->fU zo592Iv9^OOCjK+MDw*a%=;24du<&$wb z%t(hJQ3(fL0_F=2zF;`|A}%`WA)lj192n-AvE}6jIF1*&`#EZg;n<&_+yflPA@h5P zYwH1y{{El`IF1+A_5jDx=Z8JOaYpLzJ-~6i^zR9^g0*zp)26&gDGZ103gJe%1pVi^YpQz)}A;_5eqH`K$*x$u~M0 zF~#zYdU{9?a7^dg9^jb2XY~NbYM`|TIL70?IsP`}T0LSoc>H+Qm;J)Yq zj`&&T%w$9SC4103s(MLobVKbH3pm+b+L^Rzeg0G9yn)*j$E zm-9>ya4hGq^Z>{Fc&7(Arb}lJaI6o$=mCy%<$bBF5mQWGI7eIF103~WzaHRNk5}~& zm+AqI>33!iaGVWa*aIBndtMK4Oy_J5a7>qLdw`?9+}#7*!N5Jz102imuX=!E`hC^| z9P8(pPF{jiQ%qmz-oPH<*uNUmL)@`Fz_E&)+yfl*t+@v{c3qbD0LP~CiXP%_?*Wck z@njEh)YEr*fMdFB>H&`W7h@(zOtJiBd$eN@aP)Ub4{)rij_(1E?QdfbaQgvgKK=!z zrdT|f&bRfzJ?iPY9^lwtd%XuZ=G(7(fMfanQx9;=w_X_EMGfOSG+C95@;I%zQywm` zCu8Ar0PM5D$B2&ypKcwpiE`YBvx9DIYUT9-sWptDZWoHu5eSD6J79bkmy>E3u(%u! zvZL@u;hlvqE?Z-iN8iBe*09sS42bb#77zJA-uumY@3ZsXoATc0i^WGQay)VprUzGR0IPd+Oy!Rz}?@ROEGkNbVdG8PAy)Vmq zU!M2ABJcg&y!U(a-hY_){-eD2Tl3y;%X>dB@BJHj?~mlYpP%>sP~Q6mdG8nIy<>xj zm*4m0y|2uBUzPWMao+p=dGD=x@2m6PZ_j(bBk%p;y!W=e_e=8L@63C@H1GYgy!X5E z-m`h{m*>6b^4`Ch_r50Y{ffNzEA!s3%6tD--ut)n-oKOges$jaHF@vf&3nH#@BO;G z_v`cCf1LMzL*D!M^4`Cn_kLsE`%m)Te~|ZnQ{Fo&Nzbt6WPKcybJf_HiOCsdY;I#g zHJ)r+VnGVegixpAd7w~p@#Hi>Om+<)A{6vNj(my*ND29BE*9Jgs!D9z@f;!4^LWzr zSg;Y#F+y#^^BAGF;8`P7DcXebLUG~uc%itR@&uu(LDdVD0ySBvQ$d|9)Lc;0g<1jX zG@&j7b%s#afoc%yPEcnF)eZ_R07CUVsJTLI1ch1|yiK4`--6l#3N}cq6iN!H%Rr$FfVvJ8v>Vi&prE&) z+Cf1hK|K%ZI-xd#f);_d2^8`l)D}>;2vu5w;i^yrK%q8(EjRw4odQ)23N;j{6e!f? zpiTt^Ed@0f)T2VJ0QI;~mx21JP}hNaN~k+QJuOr_sAq+G9u)H!`3veLp*DefMW`*H zUKff>+P@HL0I0Wx;)P%D3RMm2eW6mIJ{0OyP#+037u4^CS^=t4sLMcoBGh%D{vy=+AR`xPY zOL)F4Rw)y@Dv&Uz*%WX?7RACKfa=UC@}BHP>1ph?&G3T+4tkDmcM~nL?a!37)lR0i(OLX|{Ol zixJ=!HoCEw)XWq1(*%oGHXn@v&=;W@Xk36Wg1u*oQYz?^N=m)Qv<4(}WnW|$;$1Uhl^n&ycWi44w-TDo`%pVI>6BwlNprNQD*E-`yi6Kj%;hEqaq>X^W~fRcfmF^wX* zAe(n}Gb$&pX`!cOwB}g4pm{-4f=l>TIEBSlRf6emgk~{ zJObZg=jhTe8a!-g#KReV`QO|)o-%Hu(S=_p;)$jZp&Q3Virst|!FWk;)c~C$+Okail_XPt{*rb>p~5 zjZ&^)JgG8R=w@6Z4xTp&XQ)w2M5>xRZX5^3lPV`Cwl^(dt{QjvHM((Jq(&=OFrF0i zS1(^9V(dk4BgdUz$x0Cuj3>2=NbMoESQr^Pu30yZi(g4q4#9X*yNZ<6)ArjB+(kEz ztCT8-U_2?No|Y7P*YC*}$LPj!l~Uypj3>3bNO2S>X8pA-x^Y~kR5=9WNijwxG4g3n zK0bYuZVFc^RSv;;QXGGl#B8bEIP;E=^~yGtQsoegCpAE%s53N=Y+RZc5J`De4#9X* z)b^4Xb%y5OgEt+tXGBVsLol8c>yNOc-0{S&?R!O}R5=9WNl}+Vo$qLjy}WlQWo`f# zj3>pC6>8KU4tV?XeIin-8-nqqm{TQg1*YtyzK`r1ky70dj3+fvq--v~xX(+?10zzZ z8-nqq_7f?qhaGp%PV5(vQr!@YCzTK>>L<-UdH zscs0y^XmYS8jPoy+gko|KtxJ)LolAyfdGd!z?D^xzjQh5R50qu$9CZ2Ab7>f9Z?Cq0}&~Hw5EJvHmQH+19Lj&DU2R6p>Qh5R4~vut>4) zqM2~YdGUiIQmPw*@uVt%4a@SlpX|D-A|j=_AsA2U5RtN}vF`fCGY*MJscs0ylR8wS z*c#IOZSV ~zNT-4Ki?br`UrZltgJ^w7g1QmPw*@uUv-qz->LT!FWShkctBtNvV!y;0u8-nqq$j7I2c+%7kJp8HQ5h>LT!FW>Sm&Dl0(=53%wPr*_ zN_9gpo)q~dF{{19J{x!F$cU8chG0A?^7UdZ`juHVYVxRvlBU_7ZKMT)&Ln%?WLx$?+}l zCL*P}AsA2UD3P))?9x9EnR!%1N_9gpp48DIWmA6g=8auPN2F9Y1mj5^BT}~K@cMNJ ze0oeoN_9gpp471-#Tt+1ow5IEJvJhxx*-@(YAmo}eR%Q4cefuKky70dj3-qiQssEk zy!pZY4K)!d)eXUTQpW*X;?~=5eEYhZ<04Y38-nqq#)*{mtERf?EMyYNH#*>;TQnq|`p1I`Hi4iH)4Z(O)lSIn)ZO+?p z&X!3LDb)?Zcv6$S5UzaljVC5Yq*ONq<4K()Qnp95a>y4|Cq<-GHw5EJO%W;fuV_|X zbjop4B2uawg7KtI2DT)|o-NI?>h=FQIU=RHAsA0;DzIU%^0hlkKbablQr!@YCpAr^ z`q3kpxu5Mmep*CIbweV{xEsZ&L2cjMQHj&I#^YD7wPLolAyX(DAcs`r0hO`jH#Qr!@YxO=W~{dAG)W!`@N z_qsSa7;hI`&rR+uK8#Tr4UMw!sq>uX`Ax?D%dI&1GA5tM@G}Z47F-I-d?UrLPB3TF zFsEhVtPDO>TEb~exec3KEGH~ov`{}xn!l(K9|hqpLjg=2+s~T#)sk2mx5SD}x~W%5 z7>T^A3MF7mm-hJkj*(R(%%y|;zGGL3&L7YgGy7x&GAI2yr? z8XeVPS)hFfxGVc8hW`Xt<)7w%Hu%4UwVO-aY#K5XUgnUhok7ty=q+t zByn{>0`5wj5szb1IUKc`DqZWCb-9+AI8F&?5KHO`ur9j{hkEiD^{ts>I|7MTc13B| zQN_+@s)6(Fd?uT6dPo&c_3hgMYwXfE6=$y63%&J}^Fd&1#5tXzSv?*U2Ptvcio$_M zT(*-i3FER&WUNq3D*77_9>McCp?->|y7vsINJ8=;*J^IRtW0HJ2z)`HboGg#0M&m+IOooWwLxGWLxUjPq&acF2(kGR+9vNi%%fa3?9RW|_jE{PRxBFvmFn2>qi~Nncr!saH+dX;bbJt3MR~Adz$}o?krb(;;8xm z)V&B29hqFmvp3h&$5S{76lZWrR|%(?uM6+r%p9Jpjq7QjWPi4HBV=p1heXxTCgY%| zn1xoQyz~09xS7-)yxRKA3Y_{kV*~q*%(=Mio|+)k5Im0;iaqwjg<_v6CDeI%YWm&* zO4E0mU#4)VA1VnRuhw1E8S8^2)^c2)#u%~1nfIap^K?^A3f)j27ks`iRn|vagG;JnPLJ1-BKKHzJs2*F2qgapk{a zWo_*c=A{ZI_js~z+nsdKiWrNde-36@+g(vBxU>2vWaM~SY}sm&({imo6F>?lq1rRo zaKs$ASNs{=IrgMA*o7y};jmmBO`DrOK%AfpETlMY&bq+k=3ef608CUGrx#U<_FG}w z-9f&$(JnlJ&?}f1!OrRvPDPe$ZNtjWRpKT)x8PLC%OGJ-n%q!4Fif+qyOQrkBG9s* zgLjXHP!$!alhZdkMuqSC|s%?;xp5yn><6DZ`-AB7Nskh%TvAz&jany>+=BC>t z`!eCpo}SZpL%eewD$U}q-%0C1u;xL_LFdcnz)8+o#AO$zQXCMl{?-QSM4=YrsfE53 zRGsi{!jtI|m;Hp==CgRJ?AxGN1;m3t;5kvKf8nXNJab)Ztwo@;^~iwI#*N4Bsmra7 z$73s1whNTH%w3n-6DjLudm;yeI#7J80X0de$3Yz@6n9Cg#0Q|X@4{PiCyVW<5_`$% ziJ&yhde%E{=b6j~Wit9*J?d*Ma-}cqYkdtBOH`Gj9W_st7I)Nsh`6C5;!O&@@$XYy z)PU1fYqwZu*VKQA18W(!nYVW^H)y6fpZ@uq3V z@sOq+b6s<9JSf!x&LSvofx~?Vl;$Y4<|O>$!E<EIa)Z5$Ix6%X*&35?dEHb4!{+wG7?pv8h z0L*rQ-R;6*7!CC%l-jN7v;N_}6_x{<@Fv)E=`>6q{6eYkjeVv>_pQ+GB8RblT}(Di zDSjofHF(n3cQ?*m7an+c88|ehE`;MzhG_cYR}%Xjp4;PBGjGSw!vhcP;JvStx)~T6 zVoPE4=47Pl&Bs}o&m*l|kz(aL_O&`t9 z_?5&ssAdi>{P#zfh6f%p&NMqazkaU_bKoI|*bM8v?@f9lJn--nhq3W02abk=KmX{t za?wcI@d#lWVl>064TmFMU#g#z;^ELV#HiE^!`THKUuqX8H9LY)sS5pP4m`AJbH>aw z?$?Q_;s%VNc|^F zB_A%}*rN*xQcE5rYmIWg@TBB08VkUGBjsUe{ZWBCvkNd!7Pyo1qzVsGqkugWk+eFw zm83Dfg2KbrX!WM&GVcw>`A5$5lEa3gEaS2#MfiRN9D9f*ZB=T%hv{Y>m(!&b5z~bH zlonzTr&6cr_T&cLRqh|Kg(x%uqzvWGSjL+mldhF|MTV7#s5tTZ?L+u7^rL0vU= z>-*A%>GB0aL-F&${IG2sL|X}bcv?{y7KEFJbzzUIogXhuQ#}d^d+V_QI`7c0sJm1w zdzuxFzzWl=W#Qt+S@R+cd9_d;d=+Amt9jGz?y#=B+l*auHjUHtoEp8;So6r-X{RAA6|731PtWp*biI~a`rtAM$^09QT2K;&N% z&$YmG8JzQXg#VTLCBXGXuk=d%Xb9JI8R?}n!?zxow+zmPFaNYJCdVHQ2BaAII^Iua z=@S1LxXlL3R!CPfMsOVC48twGOUD6WS05tR`Ef$bPK04jp-OH(;QVCEPMav2%Jz|I zyIiWg^*67!zEGY`m8V+QVcwy)%s%qITA7)ZYy8}>&YLx=fje$k_eOubQFY=nZ%5^b z%gqkVhH$Dj%?aigy%i1i0d>?yC;T;%uY`|^xNa{@#3Xh)`=VULR3{VFdUAl7zptmQ z8B5D`lKaDnYH_9l&%=dcM0ETp<93YN^*Yn|2!0bD_~PFkul53F#`Tk>&!$E2HZ0?Ft9p+W`H&5jEWAR|9kGURtWQS8w**wKw$%7($KCd zAcm@ok`196uns#m;)6^4P!QKON z^S0jY#jzSPbmq)X#MQKJ-J@lD-1>t1h0>)c9xu3Akg0>JIoDqaU8|5AV`Q@O-83%L zwX?~s&!pUJ>0pF~MMux3V1*bL{Zrmac-PX<0&1MtYWi(+#c;d;(HFq~(A0v&$GBr^ zrK@20G5r5;&tUMDDjHUQC9#Y7#P9bH?zt|U!8p!g5~lBcD=;+7THVjWYW4oVosHA* z4OqS}R*aS6c$uTO!Y*%7~z7&Vkq@9#SJ!f*y-GdMKi493339i72o6U%sQx$~Nv z!WoPM9me|Amrldz48|p(nBN=j>9Z-E!QebBO*n(WYXE4<@C#?07_V>!quOEUSF|bS z>_kb7+DP;EA6jOHU*0Is%yP)fVTQ#j$)Ae|XE1DUfEe}G9zV{`W=V`GK~whU^UKKz zy4gvzm)Pk;-Lau0PdW7kn6DLZzFok1zJRl`fMe&fXrX@nssOW~fYV~~G?cOzB7~g2 z1sHo7M2Pub0cLdpXQ~EE!k}bR0mq-KDL!WB;6WUbM+@ALVUBmKGDqQV{I!kYtQnbc zc*#+ye_(Vtdg4$XA6f^KYwH_?i_eWSO+JgCiVG(c;~<}6I=r*<0U^gu0+3^EBOwZ` zeUzteSsO@lFIZFK0s)KH5uSn>Y8POcbuc1o&2%yhA1SU`==}N17I4V71S812bO=-0 z8|g*|qAuZ>N+vyc_&)N90Wuuld!KKUwo?M@VFzf`Vzy6N52Y?%d7XM8dUFc-IiH8h3L>Lctb}oS4wXwy9VSeb?)Yk*z zt_0@Vd|cINZwyP^Ex_EBj~nKX*@^oxFi+&;Mpq|cSBeY!GK*S2k7Z85jifKMr05!gj%$f?ebd<;WJZ9lB9U-4IDYAD zub#xnC6aOBh0LE+I@a|uLu38G9p?tIE`yy$){mg;$+ZYyBqiKHoSAuuMm|+KJ{POO z4xY?7z4;xJ9N6rT#%0{kRO((xJAV<~)Dg|hcI?gADsXJWi3+kB(ZTwuE+8!aI_Q>h z+4K|#X4A$ZH>#0bxn%2?vCK)>@wC~cBUJ#qjY^n=R{5BO-DOBL(`3seRKg^eI0e0> z%0`?DC}Q8C!ZA-DvaiGEmixPYYzLCqE5}TaWp+kx_h&|HI%(3I7fH++8}@NYa7bRn zPvQ1BEnBJV+o{}Xh~|mrPUnts6+r8)(cC0COl~r@SH@y^jqvxkJA))H*>9Lz<1q*I z`6ddh_Q=jQj^&5pRQsin^P>xd@DO-walOJP0Bksht8%GfB`9#U&huGG}lW)|U$q(30OwFo~tKWD# zTJCT+aO~Q`PRXYu;Qi~e2c~9`i~X3>wz!>Jl4e~4;J(MM%l<}OcF|*Ol+#gLfhbUq z!VPO@)XdP`wQS;!!!Ireb&L~g6`tdTx(Ux(q3*?Vf>1wqygz_CUU*+RsyFIb%@f{q zkrLYhpj2%|F(t1gr|gtgZT9Dwe1aCroJNvh2mSov+cO z7`=;n1jka@n$ooHkCvT}cK{N)R<`3Aw{At?4-*p`OB1Wq%EdgZFsw zFFdu{qIOIa9+#sh33V7K)svB+6qf>})!S*HCJU|+6vK#3@t{=V0%sfQn5hq1KhY`9 z)+1vrCu0Y5UGD41zLrEfcL6p@+gs8n>6X))aI-2C{8XE$+4ZY_(+ATo$#ttf?*&aN zyLuh>vbHRXbO5~FgVBaH%bj6TtGRMl)B0ukMSUbsx^}_KfaT_8JIza5%fNrAGO8Hc zKhnX8Glf`Wogwp%4HJfS{!d;%AZSJY+a%glTQ(j9eeJ@ogl5_0%EIGw8- zgxY`F7HmG%dVT8#>o0CjzOl0lJ&okn&X4hr{fa60#igR*#I06EQ-!(`Pwn{J2Wpz| zsA5#ic(5MNQ-pdCPxejX!RL7D%rPq^Rlr>lNNq+q4|kg2CV)C!sOg}-CKPv|Xe0A2 zP-h7522d)2S7&B`f^&D(At z9`tcI6PlbyLW=H%=V)x@ozm9A^>JQ;e^g3{8!kOp^Cd_O>OJW=-bL@NGXVoji zndmx)Nk|Ig8X-CY!?9yYjKk*LL49;i>wDo$^uGvz31_0OQHGg`<{-KsIMWVX+7!-2 z-{3GdUiVWKV9N3H=aj>}bdN+Z8rV||hd%gH;Y{?I5sXT)IicAFKVK@`OIH=asMIRM z*|k7wS5qp2;IartrG9D3&Tb-QHRblZ?s|+IOcWITe%8*^6QS<>SpSh>IL{PtlGb^L zSuJ>dD0~kSLh_Wez=Sa5_&e}q|BE^yPnEi;KvTv+Zc^$;RU(}7D#h4>`dLBB&ne)rHnB#XyvpMgUvJQf zUMu$qd=BT$vCXY{aWnSH$qItpz==ab%{{H#gvsrFvob5>I?!4@5H^kTdmEaRHBOH7 zwH%p>$CASW*=^{qE#yUo;f6!AX)!-Q<|N5&huYp;>YTlt!FpR z0#n1&WSx*({K2)lSLnt0fPYG|j`NLtl2z{6>7v&jf=T$%f{} z{B4P0isBT|26HNHo+A;i+|+537A`g{ZfaUmEI++ebyt%z90)>qqbV8lc%pR3+NQ4J zRMWHV6{ZYiW7E=xWK}hmSsE8h)XAtCG16xwM^`DsZIERByv_Sfof;u@&^}2)|2ERR zGy=}vLK?A&aJLyR$v>Q~nzy0Tg~Hrg>fSX6G_$36PFsvUluf$+D5X7ejhEE?^u`E44+qnO65)A{Xp()mQGhOb#18S{JOiUNuDOzSj=G zErO;NlvK4fVmJT)E9+I&{yGIadE@(FaDyKWD|K1-s2<4?movm+H%M@CJ}&8>fI!@L zfw`vuH*9ot!HT%2fcZr}&fkJ4dm1+ZvlILFFfM$_s*zFm*xB9RU<8PVuJa_TqbpJ4 z!5;$L5`$$csJIc{Levpx*1iW!2S*1m9Q+8b%3Dqgeh(bJy$L>G9~*{UT6M2-R5Stq z4ctZO$A5$UYZ!Lv)xD|_!Z43@`2ROxe$2fcFl_$?H+opqxnL#uuLE-uJ%kBy{_-I^ zu!{^vfOu&5h9#pOKMnrHz>R0`8pgSYS}K~(>tS~mFbA?f4dc=!IkGYuz@Nfy8ZiAB z02t@qs7j8soVg#=P+;CSI3~A*Z^ST%A@MnWqtJ`4q~gH1^cy~!>k`g94C+o`PTxaW z%w~;mbu@S~2X!|vxAs>Y)lhN1-m~QX5tso36c_5>h{|XP8Q;T!*<^6e-_fHhRZ^d0 z@UMDLoScFm4b(#Y9X%>34D%R={}%wW&fuKC!~OF6DR934#@>R+p{K-SxW8wb9#vr6 zS+S3LKy?+|NG}>P$?;ua{$g;he2nz3_?-y({`=x05Bz9c_(lw?QjR_!#lLfb89Gqk zoxjNuUJhRm>l=X?xu4>kzkV^7_180jnPYHFKeIR3^Oxzr7?>3WxJpl7h`Sh=%L{N` zbs+v;4b1oRaml1tfT@?a8w^M_SbvRfz#@}s@-T2O8Z4(t#+Fx(&BsxBdMA)B_|ee) z?r`@faGM!^G~MCo@AUogksN+B-TBJ_>)pUSX>cs(#r!4iQ()o;fPmQ+ZX_@#do5`^c!gus;^(A$4a^$dZl@_?vUio1Am1ZbBt zxaT@yg1d==x~9r{NqyifP%D1n=3y*F+T%9D)x^TXTlzoFfT){Ue8~KnTS}BOQ?Nja zir09;>P@3@2&mQg#bsMLi>>iEvQwVxW7zoH*M#@E(lx2B*3Y+FKG<$Cp0(p;so45s zw*E#=hFOel^3P$4cjvaPEmOOeAN?{M&767kE~xBVaNG@!A;Hq0LsWH5OXWtk9usd_ z5Hk1e!m_;pyRgDV0!!7;;dBkSnHj9%(9?KyF=MfUDnb|D!|F?mPEBJq1$*{6>3#6Z zba_H0!teUM4g1$2tdX+{Ji8j$*_n1-E8+Lttclz3(@p)X&*F0b&m}^=gy*F~aVg_6 zp+py>Cy1CchO%#B1-q=R3!qf4Oe48wQt6t>U9JDxZuucDv3I*F6?^)at-s}QF8DYh zh4m_uSa3MAlNF{W_(huFyDJI_?oicT%aEC^qvK_5oVttH4D33?z?tlH9m&2P$xhcZ zV_R30CtA!>1QzmBr8%3xSbJaBGNPuPg)RABCu6Ph$Pwr7I*pS3vLH(#?q$%Z*0g^g zQmyN{TDNRhc4?L_tl5d>J~b=8DiwSFn5`e$^%ippm%D}>^_=9NM%0Ckm6 zZJ@p-)E%Hy^%|*7ThuUY0dOFvqF1MmQ-P(Z# zGkz)4(%ktfTo&ysTU`f_R09VnazF%mZ0Bu2*5{6`X+0KN$gS`Z+xQngN&?%r7&^s?~mJ8M}z zM;6c0xiTzE1@_!4_|-bI`~$0=PauqesrLq=D5_@K#DJ!y%oTw#`@}>pTN1bj5v%>apl$wfnw;y$jVZ_Kqs> zi_1M>-x2DMcwQ|Ob@Ljbc0%-(w-2cA3Xi&}t{e+WU6~5%TCvT6Vi4j%CnzR{ZCJua ztZ1vk)CC&l-leXz0Me>-Ez#QTDAlc|i;! z%zRXZ{J1<7dtF-jiD+@+(&U_KbL2G5k=@#*WaL7`$l@mkMN_zINP8)Qi~T^>-ON7N z55~F_Eo^&*Z`bm%o{rw7<+^uC98w)b)Q;)icNEMa>U(Lt7o@~*iW-P1L?eN7SSI!Q}bCT$}g zwuCk9(P+ztIFoHwINE{h!UjB7_Lz&uaI=IF2s4wVYrMqg8+aCErnXh->^}q#5z1&&SodW z!j3j;Sv_a&28hO`UJUb)B{nW6_uVKIWBCK2>hRRoe?BO!Yx&gJQ*ImWc71kzS`Mm2 zD6rqcOA_4xl-+>6OKVGA`-fOB!iFJi?U*BGh&^%*+k)1vfNw|&yW`BItKFA0dShm4 zG3K#uPZ645=NI=Sp?h$9kz{Od6`%B&zOJ3w{@PAk_BofFx*LflT$7YDESjXpfzn2c zxu=Q7z~6*lJXne6%|fx`q&(*5EyCmTheC0-NnLphlqUGcpnfE_rn?@g*43jq=qh&%=t7Hx4K}$Ia_(hq3WwVJpA%O_H{($E_LnN4EZmdUGQxc}=}y4x z=CsIY(Npb{Z;?5=)ASh!>Q;%x6g-y*bqb!Vg!($3w+YpPr`lcsiXEf4#6D8=>_MW% z+BT-cu1JTnHioD!w;a8-=LU53<3>+z6|HaET(+9&jSX^A2(gjvL={lkVEY_-vOLfF|P;tp< z8it>AOIK;e29Ad{B{{QoJAUzCj-xW5?hqa^cM5eMp2Wt3-{Bcazi`((hI=LvGCQL7 z$UY};qU~(%c7@zY;==xT-X+vm=-}?u!LJ(~Oo-AQ)P+sUp(duGoKVpJx7t{bxTrRs z0g6?7JZQvIwUMc*+IW$(8Sk?Fe4)MTFT5$3scaZJPFx(iHNs(+DoQnQ4P3=AEy zb^BL1#+vEw(AoTw;#C(~Oc>+3+%i{8CWOU=ExIiZ+=7?IdvYrdv^=zIKlG4J#&A=s z1q8K`A6tv|Z0)czqdPA68jFx_VAUeTq4wq$-So=p2DR}cUBh}%9{Sn7pYhW+ax7ohIJFCP2~&wGW^fvP#i z*w#K?njRok4+p&_O|gB`)-x9!+DQjl7Fl|G#NmjWB8| zp6RF+pft6a52}S%I$L%!G__elYHGg+N>lq|P%Kw*xwbiy+Qs_Jd%D9ivhReARi-b? zm~?qkxr>}`%Gma4Yt;!q0?v%Fp^XQJ;K|^`Wpnw1LQTW-A)&&mF2TbG60$p=Cv~jF zNOxV8pgkCFJ}mAYjpvU;AMy+7n=-|@699G! zRX)Ht(N6AYjKpIUyy0x)td$+(5CA)*)4`x= ziuQp8GdmvakEd3dNl==mM}hi@*w*2xY08@J5#crAsj_VHwL)d}t339>lt)Fn3_n{x zM#r);2V5){CLtGI$n2+)McO3gAQdfHDI582rdw}@XaC=(Tf+<;2H8g?u zO(TF;XC4C;b8jTt3pkG#aMlXvp4fe{_Sj>wwXw%zEKSGZ$C_p(ezs2lGT0lxIQ}eE z>ZlzZRqm+W9K{Tpj34XC@8HLl@k#uCjR4o+$L)>l@mq-BD*R{?_^Dq?(J!Uwms0dg zDf*?<07p@ol*gx1gB(@isKXt_6ieZEFMi*~Zz_K4@%t=>6u zywY$g#c(Rca4N-cD#dUr#c(Rca4MB>6vL@JhEpkqQz_=!vG|>f-y;0jE-}0`Y^OCm zN-;c2F+55!JW4SFvADY~Z=-BXH1bOwHG6;t@J{i7L$ zpSq$HT~UgzC`DJ4qMo0QUlV?e*Gc%%&~Vc zm3IWJ!&s?#B4f9$?~XUR<{trjj>A}~7J35H2fxrS{|MM`IEoiRF@Su^gog=aF zgy~Ad+J+|Fw*EIJ15981!pn!IpZ1T=aNGLl4rBeg$#Aw8squJ{@x{Qk^TKWGw>gZJ zs_G38%ntaK#JDGhk+{93^v~h8^=gNqRCN9NV3A@OCuEProp0|T@^}fh@Bu?jD~WLz z4K?kw&qw?z+}i#n0Wi9?J?e4=xVTta>=34sJ3igfxjf3mf-QVWjQeir$DK$2{WszE zcYDvwPCY8FYyWxlx#1T1KY&A{TjZl*W(}iP zoiQ~YfAp{C?d)8>$LL|1U{>;p-|sKJ^Jn2U`iC4QKg@@T6w4=b=b^g0HkUb(5 z-SDc#zDNBnrH8(N9bDxwHs234y4p{qp5~Llxkv1w*Ddqq5QoVR&*88wiP`Wx`tAEp z?B~MM$4KoWnDuy)aZBIFhU%5fcnNlLn0%LyfNkjVZx_9P!7k3_w9!Kj{Yqj#Sw%H(1=97B0GhTw{9LA>M z2(n>V%1dIO<4HZd;)%9*^=fCl$OpXqzq{xmslUefL}|gVB=#_#tQ{V{>!8c@YG=Fz zTO7vv^)s?z`r}s;`xl<9i6&j~)OmWfGhTuXe8BW~ez7M)!&sNZm;#K%4*PwyT(5S< zi*(=le}I$vz~s)J;A%QEgj;^uc#>Z2O!V&@#)k0MM#uINDYmnW#F6VRyic!o#!K+A z!&s@842QK~No*XR4B^}J-)YmUo$(U9?l4wLR`6i64}K-FPw`}}x8c?kd+F8Ac#)nK z|L^1C^%?^NvoC)7!4hk|dp0Jn)vKLp_m;z0zwAbT4th#rr{T%!=d-e}->FwS<0WV` zx-roCwZw4tgKbHSy-PBBpD^T0z1kTs!3u}5e(h#B3D}mz*dt~LXG}c$hY8nS*yEfN z&aZw(=l2(>>+xg=PrQ2i+j_M#UILtNE@poxwL?rf2mBxM-aJ0)>iQd>A)`cGCb;50 zvI%N2VNFCdBMHnv0;u3p#SlV(NJwHbgSdcT5@n20yVy;?R@-k|TWi(UB512YkVUPE z)r!?tXsr^*1+9g+=6S!*x%aco43^*XeEWO;cy3;Eb3W&uyKm<%=Un{ri_Hv_w9=J_ z*EFQjq|GsyLBRNZ4RU-f@X)BQ(FQX(%hzDX*LV+&`nuj=hGh8~;`mB=Xw+A&nH`3T zFZM{9l~;avDlvh*i0E8se33%KsWK(zV%iBBqco6@bBtoPI^Q;&saYWp%?kPPtZ=w~ zutr1X6AjiVxX$zoVinVp71tL&8l%C-24j5r1%&80z~_sYzh}k%g%87!y;3`U0>pTQ zjg_{WA^$L|oR?>XoGl7< zw$GR3t7`E)f5>@R;k@lj52-i%Fbt=mc4@*N&PDbU|254Y`syNEIBH)6gf1FWSW@ND z8LlCJ%axbJt1$~RF$+U+VQcpG?4`&MSR&D!7X6BctHaT2|GB2QCxn4oi(Y zMIclid9;23#2XR|7gx=%Yk)wCk%+1+6CoT1Nr@;|jKdo$MW6hVQSz0g3C{H`x~(Y~ z;|UQss5~dm4NKDNp%KZ78mksPfu=2QdQyWnMYPPqVX#-!X(B?bn_pK00g;Id8|!Ky zB9ogi-qMn+ZH_j~J0G%B)%DYoi|5uh?}gTz``n?OSG%MUan?09P>4ihW?<4ys3x2u zN&cJ_N$$Ps)sbBwo9kO-q@%=Jd=6U}{YJFT5pMs?{v7f1Le zm(!Bk`o^YQzC@#aMrfLpTsi>N#p?U>)W27iy%IsWU6rdYpE}<8c0mi8g1^2UEQjfq zD!jtran~M#Y0C{$I|xu5j-jxxAz5Fq4MV}KLYmje&RktD@>`zlD$)&@-Di>za!PBc zn>X^`>Dt$cD^WgYom0&u!Vos0@q4b_Wl zS?inf7kP#-LD zDG3#C^QwV#gXEYpuQpMQny~)ZeCt|VtRzsR>d^XqBLqAbYDGpXCQm<4UNexk)&w<| zR>-X|;u?k3w(kmzEgU;qDJbKnymTS9Fs7LKP15Sjb-986h>Y7fzb?bYi27s9&2}Be z>0V@C#`)hLI2F7Um7(5k_>;kwuE?+N{_CL2#{zpUmz6MFbxU|YNf7M7BF-3=Xl-Vh z!C+N3hrV3%7tpN+&9}I*1jAr8Jb(JQ&fWu>UPDKALu6k@`d>dL-2teF{@hN2ap_9N zDn@P69SfR4nRH`D7JKQ)Vt&ogIQU#T1@n?4VjWlDxa@)mFSviZ3!2%&-(Q!%E_t9m zQ;es&Dy+`0yn^?wimVR1vtus7-j8V!4a0kSd(rqJ~fd#g2HXQ>kFM(oAOxKC?&n_ zFDZ$qCKU)x51iJrq!i6pfKx#a40U`AifdeXJ;8Yx4|T42qBFO&;vEPQ`sFssrmwx` zz++OL{8CdEiY2<1A2taZHuVfubd)c|^|3iNpHO{-AQ9$tr035oIadC)1 z+)o%P(2rrCEYNRZ4-@EV*y{QUAnuTd0w2IWMW9~T+<^`S`l5DD6X*~?+^Y=*js`SB zpa>xD{)GZV0G%#SF(8hfp#X&*6n7~gc6Qtt0;DNj3P{6i1EeXq8xZ&ELV^1L6$!-7 ztA4plFj8>rK=}f3|7?^%a{&z$=mrPs1f(hbJ|Io$J%C0F-Fk=a8HetVfHXEL?ohwZ zkYx1`+SjB--&pIiNFdyH1=0r9W9U`5EEmH^IqwEj1=$>EO4Rf82{I(Lp8{98-Nmjm z3m>h;1>tszT*z%XzPQUP`MzriBo%)QRWA)Wql38-OA^jbzJYEs14^wg!`S5NH>C0~ z3~!%$#;NEND3JhzU{&EUUm3`xOtv3NjbO%gf>6)A%+M?F+(CCWU;^3~_c z?e$*P*)K=|&1{i)$IQX18?sWLsxF65sJ2YcXOTwt>_W}PSANOv9lo&{5ypmZtqg9d zDA^LezJ{MEqpcGWC#FlJ7{DtLG^);t+K$Ijp^NJoPufX)^i zN0P$@dJs^lKp!}+{V{6v7u*PE{P5{8wPS~9FWsPTkCT_NRgRun(>1m8%)YquiJs9@ zaX=S)Mq&V9_KID&udv{D1M>9Uttdu=wsOD2*lY*p^Va22C^dcTxII1SZdZzs>AK5Y|^2vW?Mz) z;A6{+cE?LT4&O+jCwUoXSL}doQs|KI*j4mmY|lSMwsR5O(*?vt_v{f2HCNghUixZS z5X*MOI?pVWV)`3Z(N60;Xhh}k9c8I`rkFZvQQtcx4Tzjw_%q}pHvA2JUPnq2;<&SW z!2QG>^`YUm*FcrpRW`hbYI?Q6cf?X}fU45e1jCXBV23M&kEk-4QfUliSe-yVLvr1y z5?6*-PYi`uPu*|i#Nf!OeIo1dz5mFGd6CU$_9nkx7G9kf?=1a1RN@jIUqQA%%m*LWWh`- zpX^;5)6;+Y4$b?0G+iNyi<}=3f1fhwZddi=#|}+ITmyk;4TdY%ydc-dg8}_;>m_4c z)sHVaG}hOTKtsd%4G#yy7kRvQ{<0Mh1=s?*mjp2T2duB76=CkskUL?lH=oct-c|j0 zqC*qW8wsc?HTn3L7vxHstLN%*e?P&!LqiM=@6aGIFx$kocWCGr9>pABat@6y4o1rg z&B72dJpbutKgX9nHzkc04A(3)JgfElI?(ZTx`#%66_`@x)`9zgPVlaK`s-#wwkkn9 zGg1$QPma+5F0dH`UNI3Z0-;k(yW_{wG-qMR*IT2$Ue5~o1a%NH1v!maqnPZ|#Ccia zB(lP>XY&k89q-MenP($%XnvPPvo0&Havvu9{EUHe7Pm&h!?VipL0>qezBvoimKDx< zHdy>u$A4w{`fe8HsVraqCz8GAswC|b$gOz3qDN=FCodN*M=y{;is=bV$q zj7NksLY`aSh=Yrkx~uin!n6^ihK{tRiFh!kJe;Ep9yw^in8%0Rj7rzbh|xV1&}NhC zXrS3@!9?b?<~^rJ{tD*Sy-Vdi8{n~l9I8O!pB|lg>qhE?mBUJsz5bSYcBkLI8?3we zx%T>t#(MSH4U#T71Y0t~o8!yN&)EK&`9BgUoHK$aR+$bN-=%@Vt`T!vS~AdCpDRFj z`WU}HC#LLXFb)rpd4S;{qkHcDcXBoWzZNvh$fUsZ#ZTx;inx{J7$#ypXvUHNh6BIQ z6%`j33r4LN{>?Nr7Omm=_vX1vbSLPZHnbcIg|67IpX?qmHh%>Tb;i+fWvTIwEb%6= z3HYi*0)gl8qjB;Jy?k5`Tk{AUUIoo<1&SGfe;S@&fnOEyE3hbig9}p_C%+^8de)i{ z-WQ-*e3;T5jDIG5Mc#7ZEw&Fpvw#;GVUEC0>HK=&nEVp5i5{bLW4*!2-P_5z=!*T} zU50RGf$lek)+y(4{&uhnbell)2nz&;e4E5O%KyGrCGf|BMO|pvRPvpgzLHU_8*3^6 z+-6x>gA}?F|Je)oCSM2LA>3$$anm=3PL4SX4g*0mhnE>)m>mhPc$Bvp$R5NbZi;w} zrf;EvDdcI*`$%RXJV@G?Vl^x=jK=ZnxgEu`}8#B(A6Rs8B0?qrGbYrvM>*^s5#z-0` zys<@D;q?Q}p_z0=qept%)d2|OI71@=(z0i8kXTm{x}C(zBO&42*QGX7SZ?-up4>6p zp};J!X!3Kh)~oUZ2|OI7JI)ZTOf=aAxL@YF9=_8FpFF#HT%vrF zFmzw6l8-|}y5b3~!0odB6IC8k{J&Y_=J%J5h zuaKv^$E_QJvD9Uy6{+RLrlm}Z#Wqcv!N3qmV$PoOCibZcY*8j_^fe%n2=1Kbyy#P2 z^d54b?7kcEwQId!OiR*~B$IeKk{IU}Cl9VoGY_|22rPY7n8-;v z5jZL9P#}2(Qilyp&r34pa4o}YTG2gEaTo}<--R-WwJskJNFHkIZGcpI51dH_56LO^ zi7}{j5h^^$B_+3kC6)Tn#?L(JEAMve7zaem3Zo3S{RGtW%iG_(>NK=GtCNdq=3yb@ zDn*(x4p|xca9b4}c0bi8c^G_npKAKL@qr#0ZtIVacxn&yZ_RM>^-JcfV_HlOHc$-k zjF--A+d-taa<{d647`G@lwz{b_Mvsy8T+F3lP{YqT6gt9?H#Z=Ib1TGKHWA-?@s3p z2*w7RKH8L_9@_CqE5y|P;1{kQFeJt6dj%75FDxbkZjN5aNi(DtZl{wu3&f>_^PmWg zHxZlzYSSlsKo(t#ylBS-B@XVU52K#N{x(Um)MOyK5(C|mPo9@P9Fe9+X4YEKd%3b2 zMff(W&XKuRmaT8AguuVA%UQJ%zmOc&=*%`9-*W{w6SmF;WZf}JfbJUDR|wP!yIG*y zV3Q&g;8H*b=8pjBaLgA$bcp5|XF})_fRX~O0<=V+?*Y0}pnCx6yu>TVO9jViLw!8! zKz{~wmAHNgNJFL=?bU)C1c)4AC=dh0bcX^BfXJ~y;T52WK(_+AR-o?!S|-q1K!XJ0 zmh4c0(twr=#3QEb1gZeELZBKzD+Ou?q&dGC(Dj1*HlS94o&(e-5Z}IN7wBMcz-+Cd zz=?n~rK138KFR@U`YHiw`kDY~99IIGD}Jv7bfZ8w0#Y9yE(MyOFng79ijygrEpBqG zW5pVHAv`{sdg0Oi@X`B1bPZ!^?fEj%uf6NKfzdT=BDURm*%{mBWM<~gq8bo-CSf0s zwDvw!l5O+)AJI~?*Q0dtC@J8`a~V);f3{a2bjk2>8h!kDuRiFK;p0=Jb}hR=?o`nw z!^dX&Aor2m2VJ6TR#Z8>4kyyC)MEhmO7gmo@)5Vvf#2LB6KFtk# zm<=tp4v&X!3EyrthdByfO*QLIzb-&MD53*9BY_W)Pz1crTZTU!ReB|yA~X4 zZO8O@IjWnCByX5}B1uN$yyb3UUP~Ws9;)M;a_U&JKHSOi3g6})7>*nhZ*bmp=DejZ zU{!*#HaI-^HlnIcfG?1bvEJVhK^XAaTLcnMWOFF(7k|` z;1`l@x|;=h9(Jcde}TPFppRkSBG6H2WLo1CZ_zlM1%WDy(ZztaIC2VnZh9sZGc2J|Lhs3Gt${^x#mxf)^2R z`6ac}!|NU?AV8emb*h5&MoUG4S5?Uiyh4pNz(w>2eg;)lGUxtaGxeU$Z2-I zuGj#t>66U8r`#k_kl1P|dX44a)?j6i?R*{;f1cxc-+e}S_42Qb+J>9HkJmY-;0Im^ z_N@Z3y_0hb31_1G%Z^0sL$4OYt>hN-cgi8y1Q#~B+|sP3&{hmp44QH<{ouhGL&nq<)TH` zSxQ|uvHOPz%xN5ZO$0^&X@3~~3(}2Dko{g>jqA6)=^^vyJNhVX3q>x^^u83j4BGze zW2AV6w3xddZ{Qv6C3qH0f3)>@#|6ddH8vbh8@#sXRbi%Oz}}%_WfdST4Xzm! zM}A%*wg=^Bf8^jE1f*l?MnKBr-yx6;(9)3Nc>eu=X8(vRxBDzQ_K@6X(Jf^5 zkd8+hbPwrdKTVACs#Zk@s$^ct88uevp-LEC06&)?O0&5;l=fM3YI^HI( zCO9(mrWe>Y=N&e@%^tLzpgYP#C`JGEFy4C9LaxNKwZ*;VAt)e z@vF>?zOmM&P*3?f-odpkiwR?OU<+`N=(S|=*li26#qqt)a9gr*Su?zuZ5C|0#5>9c zo08pv3GijV*W^=`?e8T{vI z?cieU%p3#QUK?cc`{5hO$HLy1@~K8o=SE9gvN7EGSIidpHhG|;!8a;87J`Lxa1_L7_K8qkSm!SXui$??IKiuo2gtbNW76Z$l{m~+HiqenZc0GeUY0RG zdpnxP&w%bI{D9WQg>M-lDD0GdXg4#_fppwM`)lKr38@-3&(c7+trVY?Xiwa)^GI>D zZ3mt-GXjZXX+9j6%slAq0-PXQ0Jx!EncC6&0=59cZ3n|2n>qj6jcI(Z;`}e`laA7Y ziVjXJU zVu#y`L5N%Y9p#@37maOoxfi8y48Vx2xzF_*bbF$H=w%&*9Xm-{2)}I z1G-xvjtI(5pAYCB!BJPvj|7?zNYi%>APuDzkcRSOKtC2b-r&a1S}qTE}$*AWgxufPN%CWRubEpMdGbCL_jLyht%CBuyEoXV*c4x9k-NBDF5< zTu=7a=nV+Y)@VA?+S4a_Y)54XVI8ks!iwI28^PX+>|YU3M@1foAXZ4Kz6M+C_gp}l z%XxsV7gr9ytpcrt{oexV;yg=d?xu21f4csCf`b&s%y8QWKyj(Yl{fYk#0xS>&Mlo(5BD$Kp|*9ods*ERM?dTs-xmXJ0nlMi!a= z*}9O7oQv^qz>SOXN#IP7qK+B)6*V|)!>STVL~67yHesfUiUV`o`8L+K$~GRi=n`W zuzxBL_gu89s~zZaK(~o2Hvn}-DOK%P*y~-bh1*GHIO%ZP-{3FSF|hzoIbnX~*#&so z0aARd11^72G{<=+p;R8&R!bv%D?UtSJFv6fC-Jq`p1j0>)}B!E+(z_?^y37DXCLu zr0#gqIxJ~0xdSm@_xh$hrYrptbBWVnVlGMaO?zXig*pZ)nrS%hrC0C;u>@yl{dcEF-NI%v(KESw;AI7DLDC$L) z&P8m4oJEIDj*=2tekdVUAE(imU3}Q_1KeLf>h|6Ot||SzoiLm=z9?oMfEac7C9{U(psO7^?un`2R{)WP2?f~x6vuNe z4et{`_lhg8w{t@BEETn7FQqEzCM*%-spq6{Y2M^2nLq#grTOd4I3jj@%2nx4kh>_Y6} zh04a~h1)q8i?;F3$}Y(jn?ty5AUxY7dgm1HDAv6Oel3yzbty8l-H$M6vy%X}D~^+2 z&&J?#jPma8clZ{LJ=~;pm=nnexSG8l{mzZ2E}MbEe-vpANZQd7E3ti!0a^xU&h2*fc`oBpo>DHp_TL*;2c0`v>~LV@EDsnYR$hFip;09S?F zFTl$XfPN{^_W|7?(60a;BhXer_Y2euNJHt12Ctk)7|=c9s&hBg7r3&*!$cE$d1_NM z^^)i*FX2X)J$0v|ay^~Hu4{Ym@@DNJM3OJilMcIW5&b`WO=HL8s%O77D0*M*4VSX!^YkwR3 zb?`UAhlAb=(F{zc1N>K`!Fw-5v$Fg&#NcAJ=OQ#`FFy@2YCbn94&gH|I0!Zo?{&ZU ziYwqnMx7=Ui0~#3%nsv=vu0j!1MI%|-Tm%mzjFn=-gamrGUs70-bA~<_+qys;?Lh0 zJ;oLAy4|6%am``SF#MMnj0qeFe17Dd2VDWL`3{Zs)n&rT7hfY_Gvz~;{o^fHz-yyJ zV|`s^Fb9Y)UZySt^t)+&@?0g!R+ZlYPH7y-Vu0y~UtX{YHnVw)G#{PLhcUKOf7^~m`lS4nb-Lt|5TzQG(MzN%>Bm)g~KyQ={CVu!~1qFg`C!T2GC z_#(9B?Z*3E<;H~$jZNW`CY(dW7q4U=0qC9I)J}I57hCm%hXia~3qeB@#xE~OzcdTK zy#8}nDRF}$L1TU0YcK`)@A|s?phwwhp94fwc!Dh|<`d5u_xXOeNb7-uu$)M8-g&7rYzy=h`+dFKU3!e+jn*t|U9Dgl1Sp|QSpkqG8U{PKdl z0)7;r&3EiM+EoI)+o7?(&NktY7QSH9>=|_biLMgha)-wHdd0No0ibp3YsIEHKXsJ= z|HYxPz9t*Y(c+7j#ZLnCQT(@WxJrO49UANFuN*L7I8EjSIY|@o{tcUc=TQRe&_v8= zV;ZlhLeC4{h?-$7uOA%l>nZ^zhUQqOzP@j~kuk^%awm?hWYMp_HN#Z`Y?Y!P=lHrE zq0=0XUtW-x%;{_UCD9XHCBQr%q&eR4b%crQ1Yq-mC%~O!!69|)s$3<&$2v5&G;TCC z$hD(iF!V$-I)iEP&?v~(Koh~w@5_b@#>zvZ;Qa=3QkJiioVXtL&?v}l8k&Ll`Qvhx z05A5?C`j=ennC#G1vvuK^uPD)-xCwqi;7*Z@QjA@x=^d7m=z{u;uLeOX)P{hk!j&B z=CUlzA*P?YG!JCa^s&v(iHl66H5&Vdtn~aM3-g0444DpVG@Q-8T3$xf4GHFiLL=ZH!GdioBPs~d5BU$C# zH!H4pBuuq5lIOBw|0FA%30dJBmxcLVRtoccDa;n7Wh$=m#ZD1CD#Nr!Q}}FF$UCzz z&t;X^ud-;~@#U+gx*qb2HYQunr})xL*QTsGeIP6Em-|9StMg@6lU9-CE9ypWYWeXj znvN`*Em@e=z7*ybP=4K)LIzQv71!6ZFmrt&)7OYB%#m3oUr0h@R6Vs{VKtqu%}UQ1 zzK|(G?P&<6e1ze3LM9-0hQ%IlQv0#1O*MyVX#<-JLWTgAF`*Ay_3qMLbfZA(k_f?AC-cM(G5w+JH33mTx+Skx>t`>JM^ zN|*U1uJc42YIPz3vc_bCS4pu)tF2Z5C>j#ApmDNe@YK)iA{nlz?DZtu#6?M7uai?J zu4Y~d$6L!3y!RlPDnaECYmXuub#s#mXnocevKNKUo}3}%=# zUz>ofMIzjGe}YUoE@IcSQJoeqM0~JwA(nv)uYECXYN{1 zoc`XB(R^J;4hQmFfg5AXJdw6nH2FHK`$`kr;T zT%15zVko%W(Pd5j&m-#Vmn`N00oBzD+yv&(@a%McQHbCja*bx^oP{F8B}=9{k!*If zKl}6}%&S{a+mbN)5f}?ccAwG&>RM@R@@P^PMa9B{IH~e~v497DW|<1=c~ucz6g zZ9xcZ?{&S*j6<2bd`iw;NWG$CSJf_Q^6O=mYH6lscERqo(6Dw6`IFY7SD>Y&nluP$g$TAeCW8h1vc zW@ze0cawO2#)MK>B_lo3jPzu$(S>6@dAJDhgP@@bV93jAK8nVb2u7_bNZ$(3Jk7l?7;dF%cw@X|@*-yin$@G+w}Nr% zV|1a9?hUw2Iu@JL+;f6)%DJe}TYQ0kqN1(?O>;!ZLP?|}{{Jofi?)0KjBfSx`KL4IU=jcN4 zUXT!}eq1(wW+$Vx=b*R`06pbYzO87SXP%8SD#&a^aqG%lDd!=X-c?WaxM!H&L)u#r zq&>k@u{1e@NBxVuLP++%*hE93ht>R(eOk`nAA@+Lt%VqNLV6dOd>kXzb+~VoC1P)2L8xkwDT@ zvchWbO>C;@T=t+|3&zPEjtHY`sJ2^3qp1xzE5tQQ9vzmawhOYXWP9Re9txK1N#xtZ zzcL)^uH3*}>4Be!f!LG43H?x|$&=uR2hCUb6JOr`X7XVi=J!qi3gFV8M&&%1S-(qa z%?hw5Z?!o@INpllKC`W;?gco#L?QyZ?ax*<4L`lMGhLvWuxAK#4Q#C#mM6FWLUJ=s z>F&ojD=`#!688B5y#ky5LxGQB&l0FVx{roOv6Bk~$2$cYa@M6DR`By$4``TQ+q02{ zojh63@p1hC)f#oAC=&bO>Q=g+JwW#~Lk@ixN?gUT*|S12UUJUJx^!VrouS`hBlJ6< z!&v1GIB-tPL!**wq)(QoR9z>^{ZY1JZxiEN;d(bhj*a0D0$#fl&3ZrHT#A(wYL!ER zZiK{a+&7Jv>`rb^pKt5Vf5Ty+L}FU!>6XS@xeGiLI6B4!nQz%9=bkT1W5d8_u4s)1 zbTNJ*se7#(e)DuWBqG_D2y`86t<47kX??xuKsx|w2X@Z!{bSEFmF$deb()(ztvyF4 zuM^eZKSKzfCM<{h8-YV9X?aIe+oUD%5dR@1hQbEDTqh2QfI749hMVUim+e+)GY*LB zD5u3!e~p#=6Q%9m$?$cQ+YpTHC~^lw4(FxtY?-n>^ov0RAl!ZqdXlXXe}`karB_2* z<53I(NMAb@(A$)xe=-oxG5kWJKwd}4iTKtLayB3xAvrEyDs5CLjJ?TLwCYJ8rSW4v)>!8usxhJ{p zf44J6kUE}ehD1Gnl|bVh9EX!Rf@^@SU6n=n6O3HcFfLEYR%V;-b<*=o6V^u|>M>s}dQzE|hNkQ@ie7 z8q+u6cdv~}!|^nx^Zrd^vZ+WvoU8S)|S4*#Q1ErrtDeI zxga?a7(140S)eU~CsB?Aw*=in^;}1du33)6+CnwLea7pNct*Tx>G!@%eDnuU&9z>!z$TytqZSDKnV;KmVbn%|E{#^ z;5H1GlCT}}U9vuTb;s;?cdw6x+yBOrGTLgOq&t9Wj8Nar8y%6H+DV$(hRPdzPi!HOg0Vl4Z*e*$YS0o^1XbV5V`IRiqXWz;>1Vetxy8V6z_R*>5U-2F5tz*D5kciA#z6+JBeP#v!P3Y_h=Gb?h;@q#sfNFN4_o7?ck z*{-FZr=1JAKh))F^;m$5Ipp=6i5;93*??Y)z0r; z9}2g>1;1_qg>U&2zQIh-zYR#YexWoNhzZ7*d* z>V6!AnRUTQ@fsacY=tH+L$QO0i>}d<|V{bOmId5RH5365Sstn_e5Ux0r7B zq&q#{Qc&rVBb#E8UT-X2TS6daYwW0HdreGO`S%rYOpamllg`z2cdP>k*=_RkS|UH5 z`bz~lNG$D=Gt*yZ2xAEsQJT#+9vDwtIavR_iQ)0o7bM@FKGCAnM_9E;GqN=4QvZ_u9s?WQyl{r`Rj2 zQpF8Hr&GVYp``In2ee51^6XYqkOEXMxH|wv1-cs$vmOdO1c)4GC_v3ojRI`})FjYL zfHaQx9f(Ts6h{T<8t;jK$ZLfHd>)`#pz{Ff;bkY4FAacK< z0B>+A-8MkV!MzViIk+$eQH}RxKpO8zKnd|n>2P)ZF(56WryS@{fRaMjWhCz$(>1jRBKu(=Hx$ws0?d#gssn8&*78U%&Sr7E~4q7&6_Wh;2&JXCQB`8XbIis(B5o-%{F8 zZA7-lMK#H#QQ2Z)H)oxPWD3w)=D?-3{7pbw%RdFQQs~yg)*+RJc)j3uz}6b&q@z<8 zml-;UP^v|1d6ENB>w&sbz9pmPy$j$n?4P9m2)V2ZE0ZQHexlLl4&7@s*v0UPf zk=-?FpM^rLOcs98@akBUy;! zITtTVVRu0HcJ1ouQWSZ-V{$%T!yM4Mv@n2Pm4f8HeHW><2Py&11r0XZ-BJ$UGCmKe z*3W|#sbxFMQnfwdb`pX0Lqgc<-b5dzT3t+ojD zSV8cp3gS9%ZllBSeRY=NAS`+%Q|X%y5|dbjHRK( z0FUVq-B|xv^a)Z{FCSrGmoM~mXG^8MmtkCYfV^9F972M|z~1l=ySk?!Z=1?LXNmX< zwEY1;mra6z+k8}0Kz9!d6xpj=vF!7J5uNsw?=iY?%q-6v;461|;#5S+(-w%_0i@~% z?EI|lPBW1vcoj)y3xr-vpCT3+q#Z>po=RchFM+3b*6Ao`JjTX?aZAtW5@XrfqJ|I| z3mT>6B&V(X^F*qf$_s6J*qn|vGP0TZ{SMOjzmZ=&;f0g7Pb6)uWwYGYO3tcb)<7cZ zG`jZQ>z3GFZ`0_lKJsqqGua$&hYsyGF-7ICYsGkq_lWzIf1bZNamrWuX1UuDB(0j! zotUAL1-n=qV!k!TV0dW9FC@&{4FXlc)`8<^4#b@;9bh&Bx)Hxn;E%9Z3G`Rk>Z31; zUg?ei#33#e7z{{VxkOOcS%7X5*BU?_0&#OqaXjn2L2!Ejsow+9A=EFgziJAG0=ik~ zE&!x-3mv)^hpr7!r_g;1&@BSp1?X0R?sIT&1JY1F1EjHW*`To<2}ol*9gv211|SWO z!YLZwxeo4WKsv~71$3Ll=JF-8EN7yc94b@K;^jU$BelaU8oTb_MAxupxn;ovIdF{O zHilM_T8!<;#Z8%=PTMB6AH6PAR)dqC!$}jRt_KKdVpj<4$xcC`FXJ2mn2)frW!V~> zEUSVQ_B?FI+ufhXk&Xa{s$1{G|L7WNwoAdDrcac`w7a|J=R}uHLpO1GR_;7I$$1%_ z36b06po`g^eojBwgtl?Fzjoc3;w$|lEg0J+ygZEU2BNFduS-kPo_=d6bAVq+-rv=F zXPqmw6p*%nRzTVUIADAOzmSN3ldA~@9)_*;z8;X`_5jjQ-2T8pNkbU|Na@I}s^7C6 zTnv!5lzKqgdUCWGJ@v$qrzj-TI|9B9zvY)>YD*s>CzyVoW!VfF^mIh^>|jGbLh@zd zIH9@Ho|UqJNLfd@38&91$~TmkFaMdA)k94+YeCl-Z_Ph&31?MSkJ3-4}k?m96I9 z7>z4i{U$=EVGMae?tT(_`HRmkc4e#IacFD`d2UF3{67v#(d#YAc*UU#@KR=_Z`8_-cSJ`oH0lrT4h9)ngnQo5Jsdj-~*= zyde8B>)@A#GoN>5tAFUwSYPu&L&H^TUXYg$hX9JaHD{A6TU}2AnEnCli$gBWq4?zm zc@>fVr~lyGNv>@5QzU>n)baH_Ru9Z!_~iv(hRqcI@S^2cxU$uEIW#t|kjW|AV_uM~ zE8E6Hhx}uuD_hMgVl;<4agl|jIRd}D;8@u37`W=C=l|i#R*!LLY+Pjqb7Yn;SGIbJ zLqlKQYl=sSFSbUSzg&FmH&wQJ1YTcNoXTqF`Fst4Q(lneM{~ljpZii}tLbY*kz$2L zKr5|wG`{kJCfkA67mdA;n804-XZxE{C58IgmW81bHER@n!n9su74wnFyNhYd!u-PL z>zw#>5rc9=CPpM73`#?OILlXaZS_3Y7okhdxItK@@Z?fHKVdYSU{=0(vCbN$dCC_K z-7d`XMizz(Q)|@MPW>lH1$nw;jeD2L;S#h1870!iOwexP4ua~nhqV3Hj zNaHHWO7mSd!A^Rf%8LEcEMFB_ab2Gk&V5*tF|r$;tW#h|RrE2V<)m}_laQ^KMgp-B}fQW;E709lB6`hu}a7g6L@ z#BOpu5u4j>Q8k_-rr1rDcy{Hxd;wd(=6T#&m722>O?!*d`kJVsr6MHdNW`8$bNYFB z_SneGYLO*smnKxuSM!-6-Ri!In?vf=O}RgjwGH~vvg>X!ENg#3nLOvnj}()2c7yUq zmF=F5F&RTvSnZygrNCB|MYClfnT_*mZ3FR2Q&BuDORAS%M1a@|^5$$xj+if9MF`B2 zi@=v#DX3d3f+kUm?3gPoskP*iQ@m2>xb6`VUPd4dL?zLzD6EOMC`&RniR>(< z(s0~JJhHg{2eUJZkyRy2)d0zA>T9c;%{L?TO6d9$;Iyl$wO6^~vpy2(O^YBC{gv*u zi$G8ZNp|QVaGNcwBtWjLr3yL<43sT=$|j}K+NQ(LYphb)Q#UC6X3ALeDvN4`XeoOt z<>BegntMq1HfKNCZ8%4!scLR=zAF!DBvt8-m(vrqo~)P=wFbPSACJ_a$_1O14})i_ z%kA6PWtkp4-`NE(!mSKfv<$G8QO<&7A{W;t7B!46$LiLY8I#P6VV@Vz&Z6`U=lOB3?5W8F#)m{TG%`SN z6>Yn^r3qDG)lMy#nX^56tz~o6(UT@SGZ?br{ zPt|2N8Agjdhtfeh)?-!z=EbPVhLs_?(2ewomCD7bTG0G9lWvs%E%Q%N~+k!W%WJ#2a1&A15G_XBpw+wsBZ64Bj7wQa@{x75DF}dUpnV$LkK*weOf*f?G z7x|vVmi0w*2Aw0Hh)vN_Uac>M5Fbt?afc>~f6@G|M80gJmd;*}L(N@GGA<14kEeZHaih2*BBw_K4rJt9KAK8SU(4&s`DYhi`(?er@pfG~)xwjPxoD7?LNP6>xqk>b5h%O@9Uq$ch z0TN_t)4I1&m(#RHig*?vF9R_McAb!H6%+6Hf;+n>=qpE0G*r1u-x^F~ZfCajEsa z>#5wl^L)I+p=h2NcEq%=K>f1T70w4Gr@ha#eipoPDlo$Brg!d@436r6)%s4WqjK}x1-8S%oK7Kpw2=9IDCyRXn* zWv&3Rp18TA=gOr5MPc)&V~dVA3-Eo8;96j7Ia~usOR3$#@nlbNKLs=#zmRBX=Jt%9 zKTj0M=-|NZ;3bg>6C%@QRa68HKkE31m&4#}@t;0$Vp?f9p+gNNY{vS^fX{#KD)VKF zr*RLQZd8Oha9V~hPNX+4zGJg{;KVx@H2Vc2W=p6^5ki|6T!}C888_Xr@MZVFX^BH) zef_~;`jS34gEoGXK6~;;_rU3o4vqC?H)`|67iS9cAPet2=`r`fX#%qf!viOViGv%l z^(Y}PScfnATK3`3zwaJ6ed*9xUw<V zF*&b)()wTSfz!n%g$Ft*JltT&iR1;z$1sO?O}*qE_rQso;%Ru`r1?5d5$3>YjkrN= z=KB-+x(7}J9U7LQm&4HmC&oi_&pi*^qX$mjqX?n#`O*U?lN9l(2TtCj2%+)$Dgb3( z&>nki-S77+^}tDd8J<;WBt*N-M@~JD0#IVQOA7iZ?_N3|tF#e?g+%xEf=1kbDYjaB zQ&nlhA{Eb4B*@W?Rk@X@pSexch+gIbGK{)dosi4Ui3E3B& zriZm?jpU*sx!8U)Jy_!{sjg4fTAW~Vgi~P&@V`%>CQI!j(mXHO&nsCCU>$|Fn)2B@mT~;l% zHHo^$1|OblV~gi;gjIQkFp=nm)zCj`3$v=ac|o>cvs1vm!ND38woP(xARwUTTF}=n zsg*z_rGe>9wGHQ=Ur|~A5d0S zv&c}CO^;%l*o$|Dk?ozO;PqVE>*~Lg&-kgE1WVX`oqZ=s21Q zU6F6uDcs@ppm{7aywPLGzdDB8<@2EVG&8)Be*HQ3W3c66%|krlhZ%^U#5=N(3n9mx z253JFqD34?VVryv75nIpgziD!<$2q4Ra-=vr7U@pU(4)kHJu-`KMpnEBAe1Aud-%f3Oy5Cp zJ#ioCn7&i@fsW06R1Uh+M~(8eKbHU43_5qe0IM10jc2bXAsbiDHDeAg{usR?-g`j- zxO1qA>G3e+&T{Sq1XwPCa=kIh4W2K`V(oUcUGS!Yu}x9oH)L(g$INE0XPtVJra5QB1STFePsiPn5We6pN&|(>uSgMo{Byv zq{0`QA$f+am2IGhK)@AdmxI>}PXiZAA!s85Y?55QE&4>1v?Ph6GoduCuqshwfs)&Y zdJPl-ydb1Jb$yg=6Sv%Z>;i}$`b#vkv4ufd)-g=SCJHYyn8n*6KE%tvU-RDkeLnhd zFxq*e1XlBc4XZr$C4>7Xlhjd_Us?0zl+H89pR+ME9^aK%@Px>YPo(|oHD~(9U?dvFI|LygWXOjKmHJdhu`Udc{F7sX<+_U^t-t;U> zeX`=({N78G$43!dxNQ((0piO`!|ekATHz67w(YfW`+-1JbTsBi!>h{!W#LCclOWO; z-P1*$I^52CbSU-c?yiEw$av?hpj%$y)qRBAp&bv}SnrdhP5v#``?PEZJe?jG>x>3t zo#*yh0bVB-E_=ZUH(385D{sSNp`WAF7#6B1ITV4ECTGKrB)eeehuhy{q4uup?!teg z zg3KI#L0Rg>*1zQ^Cx}!Pvhrjkafqh9PXNu5Wz~5OyiExfuM=-a(%ZChKKZ&e+WPnW z#O8EfEcJA(^~pZvZCm2VZuepE6-{9TSl0(hjD^clGEaAZfqSRCdG5SQx)BVu_q!6s z9$sCEI$8b6If!I=>V?+r1LD0;&2Q}~NbG^K}4#$X@}<@1P5!tvisjuKCf{PYM!mt@w08xc&P`DH5PVQ0n>lw_#%`yn1plhKs*! zrBM_{40QoND2~6;{RL@ZopH3b^LmpXWTqFjf`R$aSm%^plqmx0I%juiQbF=9l>Ax_ zi#igqvyVdL*l2>>0t9xpRffynwnI@oH7P&7X%Yuw9jb3cR>59~5rYF|H5fCM}1?4<#_qs@8T>2>OKfS>A^Elu+&MCna zcxMj9*9RSSYx)gud)%{58qa2Q0D1KqvBnT<7s_($r0^rhp%VW-0JZU1LE_DF$f~wY zWzt$dot@|(FX^g4y|=fZCv=Yn8YPZgiE#J5R)eWQGGKsGMicC^y>=;-g3 zczfhiUh&58ALxD^Jpn_#8TeV|&h2Wh)*tN!16S@!yR!e-ksHK#1XD+Gil*h2rN)~n z%MrTkn3W$Z`I8Tce-KgQX(1fWx`-To7~ z19^?jkvp&{#vOSl&CxZ?p1lz+lbLgiowxkkr?aRlVZkl>!~zg^@4<*8U-W89r29Qy zf5(HL+5|f)wL0XuqPvL$mz1OEgFs7y_wL8wBl-l_wc5TgyTYaWZlJvgmbK34^mM~s zUAq@a3N#dY>b}y0&=9&O0~LK@9^zz5x{KwLnX(BJl@f?ZoX_w%ckhqSLekhvkYXNkg;K=%@k2!#pE&)jCz6nTE^#Y*t#mDP_W(u?u&?JHO z04f%!7tkz$PDH(5AW#&L(oJ!o^Bf3!iYDaS9o+MPG>&Z!PPhLp*BDQ|pr>cD}OIi4Pf z;m7HL!d_Ep!+LHrM)89fA?%9;;^y&D0+qqOSRl5ZuM6}o*jkgSk<<~hyGWFRRi^#` zC1@fGt};MW^M^TV3#JA+H&Bf)y58$FSKw_KdTlldFzE^sxhA1u{)qr!%qY|x z@0>X}c;?`68*k+E1g)Y5CpYJ;3W1w_DgCfzIfV=XR}2RGl=wzD>U(-Q*nrj@`N`H; z&1-S+P+<8IM+i-ycySRSkSWBODN%N0*O%f$AsFIyGr57sq<{s?lEuSJW? z2KPyx%EW++OFviiVmgAz5oUOGS8LDWyFdBhs_pY(ofc+$Xv>{GNQjf2~Vf)$;Y3s*|TQJaw4S(ufdnv9ye5VLa>(>5YZ zz8PKd=^4qX(G|1t4!2{&6PyGXHaQ}mg$W;;jO+v>%+-51r0Xc( z6PrEwHV(ITHpGOovvT;m@!*DvyrJ=xSRw=i;Tvyf$P~R)K|dDiO+cYi z_D3y`iq$+5@7<_voPwclc}fck^}{lPv}i}Y8{4{)-RXWVaoMWA6&=a#-8;YvYt1~f zF_aIj0V4Z3=$gg+51k3~@jrW1vGX=HM%v*B zXOn(yN(13FhM%7J>lA}pGsFKpKsrLch5mPm(D9aw(v1Xkso?Gcq(lAv4)iV{9dLF7 z(qY{W=2m6R3l$x~3LNTF1>p%8*b8E*3aAIM$M9y5g=!j{+vY;DvFh1x5un+Uma|~< z7m^ey4xj(y=5&M@lrtf2;RIzTjN^7Nz-g$zKoQu73p5Ni2j`$%Q8-2*PMyaKR0=yH z5bI))KxW4~V$Uz_|9rUmO@YL%dvSi3Twev)yeti@pi`efpHlpT0c8JzNMq)oPzWKZ z98&9LAO36pKo~4V&HR7=Gb!L~$n5?<{8wMsP#YOiKQC~}ke1nyot!YFrC;C@e$4I{ zXr3E5@R0t8A9c*}kwL>x^Bxv(4EawVabKrR1l7y9vcEbC0;&9hwMQ0}T(S zXuzDp7dcSkZ@u9g5aBRRf$JQaNC2Y=40&K0FrM(m;{%eU0*~!*kGN+6L$iOt`Z`Pz zMy8TS3ykZ6<|n@A9&sP-&{$tvOziA>dBIa*6LH<9{8!u~?&lpE>uZ|{hg?uzkOvI| z0S(@K$9(sQ`>zg-^|i%dxZ$1`oj$9&tbB&{$s_CTR}B5AvG=L+wPOda!%MU1qTE5x2Y=4(!3=>mJywgGZNL zF-?!SnZo);l>(zorKXT=f`&t6UXaHXOzWwCJ3g*Q+&D*6K?|X=zK&w%VZc4Zm#%DZ zl=(<#rz=x=yhCGs{WmiY!yKtEmL`oWQ)#73gvNI;&UWjT#;A@bFI1UI?;*U<_P0 zqkEz8`8q;;v94*pdw%c%m8le8qZBJNK3_bG(RV^gaqeHM7pP37_!_OggvRHKQ(azA zYaWMJzkM8&A1g(CjZt4hBjCBFzBqBZR}zl+MYJC=fgIA2HCcz}zVmkY(IV|@N|vE0 zIFg_-IH=D$a;MXFlODqAD^1WC#SF2Z_^)z>I3#beNC~;Vw!warCi^`^#Gd1l!WXV5 z6MJb^dcKuK^W7|(53(?qXJNRnV2$SMCLe|u;k_lRH1}99_^%ksnOmcna2BS@huO=u z1q>b|YHUcw2ujc3ozX!*We~($RLzZ71)&*|P?CY(IQNCLj$^dXPiko0Gl70pEYX3)WU5qm$tckT0|M}X~nPxU6 z%arRjKm_;((A;9^*z-yYW|W@pzr+!Uz~OtKS;K%}IIWQ`^Aw$vb|1pybmD!OnPKJ%j}zMVeF%@+aJ%<`j_k{!Xir{~ zD_*h>C+!1W1a!mqfsQOzd>`n@%6T8_#%IoQAuC(G58<)iF5d?_wgYYidrhu#VL9Ki z4|J@zM{>}eUNq9zkvK*DA%o7nonbed*9La=nhhE3^X|`k-Q0&@VVP4rqhFj3-NZ6K zG5kWZxz5su3T4=FfyjE0{SC=|aK$kSp!RCmB6J}IUcyHSUc>i2FXOv5R2m5q^?uE@-42rxG`Pg7!Gwfo4w!!9ZR8U$6 z7gs^K=NuI%A7gEqKoifqc*e}>WJzk98>;IAa>X;ki4x+Jk$EkRf%>|ZM5Ly=p`kGm znOhqXsm{f9EiH7fsc&qljkH{mtZuH2%x%VV9czKEkBDffMM1c;u4Q3lK4f#{ zUZ=&A2l8MW=OycFBSh9!*VkQLO<`@!=i@9D;pw~kq;JV=+X2gl&z(c%KH);Uu3s{cPkN-)%Qd3OWoO$zt zrLZ}-{%lS!R5jVCX8=RvUh^k44Qca&5!j^NIk@~IcMpWa360PQ#C1LmXCU~37Y-GL zk466B?tu&>0gTZ2)@U66+;#48$Nl6i-2>qoO}xMo8lSIx@pY&nXuA6EGj$I{R(3^- z78;+g1H>1*C(S*-zW#XK0})^BQ7}T|^QC(roJ?r$ZG1Vddm!R#lwyU(=Zoc(7bHtS z^Rowr&if`EJ*#jxk#vwF5U##D}AVZ^h;4j6OdG^57V+oJB>f5MGky;9mZghtYGt=NG8mn^Pcsb@c~2naea?P!o;8y`{0CMb^%;;Kj6o2T>Ocn zE=7$Su?+RAG!CfjIbIOo*VW$0l99#k9eeFiRIFu2um5|iy`r&ZpwU7u#lL#g&o8x( zWFs}#YHtqco(9b+c>rKYE_6l3W(X3roIjmqXcS}UMvn2;zsO$B0-aUq#6d>mHKUC2 z%&G3@priUZ8i%gfjA4qFr#ij>O|zNh-1Lp~1$YPOZvf3noZ()bxc6L$ z>UJfLLI}K-ZGvB?=wx^HnX&5O$H}q1%VJ)ngXh7BN#i^Z5LY$k%DTBzj#KvF>{#!d z0p|J)QeuvIakv|XBV@H>NJt@ww&#i&3yh4LF0Rly!45SDX+5dx)Pd$VQVKXw`fPx}*iJ4TGt8U zwSa#GNDJ;22igHhi~3zaTGSr{(xL_+27BMhCL9DuxJ<%-xQiMtb>+DApI-L-M598h zW?ZGT@td@1?Hlg0=RRO)_O|Sq12@hMR~^;aU zd%6V2xgjE91_ECgj4pfFm{~4Ye)qcHyGOsal=?cpl+{()U#NmLzCJte_>0`5UpvXV z>U1wOaUFpFdBG%X=If&W9@OX_{myo1YzkKx40D_p_HVZ*XX=uV)PA zK>W`Oa&DxrA$QJu&OQ3w>d;tUZyL-&;w#^L@t=G2+ikEy<6~`QNh1gRBuU+0c!Im^ zF`o2z*yoEwXI_w{ZjEQzV`fmH5$Eq3B3<@aAN;QzTW;3YGU=pand_mu0I(EOZa*DN zV;1HRPcrw)5DU*~y$*#B>2-tk#E3^wUv+lmr4`0^Ze3%*bA;m)!_|Pihd~}nJ?!y@ zCxixFU%zBAl{7VDSI8tV=V^~dp=UatgD(c9r&v`Gy`9_AGT0vVNGPf$%a?IxX0O_$ zL>3o&I{V72k0~iEa(Q*F-Q8#;vrMsj$2nUQng9PICo`kR_;~dVXj-E&W$4&)l?V5S_j}-90?juV5Db^{ zLRU0)v>=RiBmNg*U|GY#1;&YYbm2I~sQnxKI}}67QyflU7`^7huMcS;@JC=^7{|c@ z#!27EF}`@&pQjocA%vy*_3M*54fu;e*Pa=kS(ID9yo&RE(9C7PFdXX`UM5e^5$Y~O zLpmDr^rw&Yv+B&>eHnCIBb+|Uj_Tr7%HcOT=rZHw*z{NiU9PnRtKsQ=pkq0|l!NZ{ zk^XwqRA$(A%@Oslnl#xNKa&MIvO0U+sl-#Z)6in|f8k zVBV7@x$?aj3Czwn??Ok{;$D2O^&U(N^}n=5(!DE{}LZyrt;1qAjN7Y*e{Vw2W|D8$8ESpP{)VM?=V?2cM>)c2?pY`7ZIo zckR%!J0J%F(J+dsCHg{Es_32t=rZ%GRFX(;Fj$a>18MJQfZGO*Bnmo$;9ow`YL=1Wn6-1Tg&6(NjedAH@bIYIT zyv!LE|17~$#ef+n4FUtj%dw8IaaD1}w20}GB?|?Pg{@sB0!W)3`5DErdusP#fhvy0 zt#lVSxJv+4;un%fQkCu|$MqY4G?Y6W+>ZcF!!Hzg0Jc`wBMy|YC6*qPF}=!G*+qHW`mi;}RMuXRn{-Y)wJSWCUVJ!zw!YpV}ji0KF*^>CDID^K=Pg zAnX|exz*rE)hUxD)zE~}sYpGSdWFxd;_a+*4ykw(#oB zy?<=)iiU6BkT?>KlOTJw5i&(@r}On8vxo6&=!b@`Giy-u7m4Ni4OeBK3Y{ z>T}lnA+}oZx>;rL0J{5OaC^?(2qibIIWMuWtkI?EMqSKoh>@Hjq?yUKvCx!tEzuK#IzE-p!T_ zA%5eOfKYozE`~%`oE1pmW%*Bi833zU5&WoZ_($-N-tRVVeBcTn^uOOr?%C|vwg9v& zi_RN{wu1DpD^TW#q<7u-^tsA9MOdE%L{T{dlI0s`+R>gF|EYli~)$NhMJL44ijYDHo_}`$R$;U4*cq444u;(V4{oecRz1H4q55IF( zgD=Tb3f-&~lNb5$0OCOGA0?ode~6=!uW&*m&>(qwn-lB?1|t1K9Q=^bvHrtb5jf1p zq704h=0{HGAKbv8SfL5!t1moaQPvvWamBH(1~xEoIu9o_A+Cdf)mo;1)yrr9F0g@N z7;)wh2cgILfMe+zd9xq{6Y1oz1AXsT5_xKC`FaRLt9+kpm9T#C;+lDjEnjDc6rhw} z7(A1paZR#3+PWf3Q5kFy5Ye_6-zJH!%nJWwH z&Ia@XXioA54Swf@u5?65GCv0R3qkWMkB&b=H_99M@lMCD!yi2wLExd`g(di$OG5b> z8NewKoDHwc+drphSvor&jfc|khK?*T@BHPwgQi@9&XZJ^1#zUC-3eXr`%U`8@qck1 zok++_!tg!b3sAUBsJ&>iRgu*Earzdf_ z%kp@E2I8q%qR(K#u?^}1KM9B#jEh9$B!Q;kd5l1{cn%S00iH~JTsBsf3Uno&Y^G*q z8{8*jYb8)8$N6=FHLg^emouz_6&K zr2n0`%t4X8eFH{_ke-lp8o0q7i^BPH8y4%f`Z+VP4}Ny9$N~KhD+~_1oHK-{ggT4( zNA6F5&PyD-bu2mqPY#H)N8j{ae|h&ZFm(P#jpd5K(v4h=c=pEsH+R1FZ~pR*SUN86 zVgkJ-PqVz^K+L$lkyu~qFYn&BG=<(|>gOItmv>|E#Kf~A)9f1@Pq&Jq`$n|U};QTKhSECPl2AcC&`PiEvojH zcQ;uY6PMXiz-|*>2Kmc7svPKqMj*3HWO;|V{EZrycw9mgTAHwD`zieWgWF^K+Nid`dGWG3oI5s~ zobzYZ_CRf2WI}anJWQMGp=7z|aFI8gG(HO#ndz)OGo+JBL!iTpf1>E5PBwjb_GG5p z!1fi1!K=k}FJ^=E(y9^4rE}g1Vp(qlWnh?m%b^|T?D3_XAx~d~E9`V4ug8tedcmKH z>pVMyGe{E_*3_n!*48xC*Amp#OgQw0#kjOgIi^paS%Z1;{6({5v$&U5Sht^tnKB|q z2-7c{zi`;l={2(=HTBbHjVLp-=EA}fofOMcVSSpL%7zXr3Cx>0C}H;r#=&E~b`TuE zJyeIEf5yC-YuOX<{|jyN!JQzX`E?6Y$IGyLdA))|y3U)+JXwV%|4;bgIb$<_we#jt zq3N{}=Rbox4^+FA=B|T^tov}1%0@_rABQGU*tYR0dPYWxITpmv*!Zf(pC~JTQ_yc3 z>9un|1p@GBdX^r!$*^|ZVkTgumtb;LGfV_&_f3g|EH{G%)>h}`u?0w>*YK#9eho&t z7JG$Z?5tu|xY(r24}+>s&6SmBLyCTW`#7UU#|BiEwI`K!02--u`v~X$ zC3rWKK3&S)X@~+F0(AOG{VMmIrsa|&XZo~toS#ur6&H2NK>|(2Q|D}y0qKaJV2bp z#Uqo$yPeZ+aI16u1a2K^Z2KhL+6Ggny(`kK9~F89iY?GByoXBE$)2^^H7!d^Dpy`H zZ11TJ=kj;YsSOkO`{}9m<&7@}B+~xiDTus2K%?xl#iaS;X&0t+ zpD>$gkhOVeuTUT@--TLkp1iAc6I!GchN$PXvC`ga77fvFcs)Fgc}v42(?GGuB5g7p zZh@R+wGZajp`Q4n1| z#dH)S> GyG6!So-Okb!>C+!=2gN8$w&o5Z?40PQ?9GbD}EL8*{#)&Ucq^U?c;5KSinSZ`wBlhKCFm`T|Qw%}Tqcg&WMHJrU~qXZ8RRzHWG$6@l@~9nxhN8zs4W^gf4XqsYTudlnBZ9cix_-oGfsW~e zC4i9YtQ|1F?{tBV@$SdU3%Jh0V}Com3v}$~Cv<`C2+%oQpksI!bb*fLvZM=i46m^Z zbZqz6cY%)OcXJo$Sbq0*fsXa|a2M#9zL&c|$H{ej7wGt%im?y_uCsQ)_IzX)=$Mb; zozM*_EiDg3A(OsL9-Y-3VauIv+526jy2r3>>1;(f_dVM#T^l1rfMj22Tz|QMnzVP@s8u9wX3FJdYEo3D07IuE+BP zfo{cfh(Pz?$+fMTc^WRzRy@lE+J@&T0`0={G=XU5$q}eOprk-WfW`?_4(JSl(txT2 znhK~|Ac{xM7HBD;DFQVCI#;0U0a42ljob=oxHaY;-&CYvYkoUeY?|o6;dtKi9 zC3)}ldG9FEQ2ZC=y<_Dc@?V_yeqrAGlDzlYy!SbI?{o9sZ9#ZIPyEipzqS^H2B-*6 zq#F=x5h(_g#uH@&Xeyq_H6YR;zkrtFd6_^>cz#Ww>+xJJ(5-l`6zCp28wJ{k=hp?= zil-~kHax!}&@Mc`DNs+;6UQ%LaeS0)~xh(Jq_#qT#I{#)aEb5 z9^d)1VX$m&A%AKY&aKDIxp-rB!uXnacR&=fU@eug-v&#nHH+uhiA}c-o`wUzHrORK zwD(4_LZL69AkxGefW?HIRu!>gk1j~&23k}jkn-VoY^^3S*EHWvMpjuIucPfr2Cem&;C;L8iMB!KfZ z=A@=0E#!sh=bVOpe8@5DeR(10D|A955SQk3-SHob7J`f4x^6Sayz9#g3xS~%nvk|v z<%OPfBJ%dvHax5vb6V0;o_$+%<7AiaTXjD>?eDkfcJPr$uIRc&HFU{@8VkZf4dxcf`_qUt@mK2n~x1@$hzI&NB7J15#Z7{YNkK zH$;D)MK{h|=(>HU*Q;H(=w`Uq-?Qq&u3L2LsZm8fex=v?;D%_bMNx5TXgHKQAOsy_RRXOTXZw)v@Jh4=Jb78bPEay*+=~S9y{M|zH|U)BG|@= zzI>9m&JvnX$#d@OTdMo{+grCD7T_8sDHoa$mn;zN{SS{n`|S9`eJ<}_XrT#lQIY4z z^~w(?T{1AhrENoKLR_4a`&K8vvF^5Wj|gxLl@tn1h>Hp~-=^c-SAX={kpV89VhT-& zi^{lI)by0UG`#qoqXJxI5|_|~xC({Kj5hD5UhP*H;Nlt}5-G%gxThRVj4i_{cm4E% zqXS$za0pE(E^0*lGW>AS&WT?RaE*ko>dV4$aSh|!2yA%#okx!eaFq*}(1hX|BwYNS z(4DsKlwS-AaB15Rnh@8qpp8Y%C_3_czwCFc&oxZP4WS8f9Vc9@N4h_MdBs`B1-P_r z2u+CVE1>n`8vWJtCVnNrrENoKLR>|{Wk&2HD@QCX3UF!L5SkDd*L;3lRks~{ZE=80 z+lJ7DxQ-VtGXktV>B;+!4{&MQ5SkFzVBsgwXF)(j4CY1~u`8$uJ}I#Ia#;Ys(0++l?$2Dr3s2u+CVB+$m9CSNnFZ&-X%fJ@tk(1f_SM)qx{ zo-ysV5kq{gGHn||6XGJ?-;>toyw$mq0GGB6p$Tyj@Au_jR4*?o4RC4O5SkDd@qYih z{;et34-If>+YlPi`3Fsi4_nhz%8q(ha?RkwbE@ZLo{j5tFPW!EGc-`20MyZc5Z5jp zZD}g<@3f>TOk!h`+s{7Vj;1Viy1p~2Y zQtZ|m-l$N1Icb`*zv0qf4KI9>p+CH8I-}E3(gwivT;3Voun{^Ic$7`}bwSt1TdA;k z7;kX;LsAafqdXeE({(1dWsc4u$VDmlK&t(urcc_XLFP+=D)-@gYbYFIiC#skb#7+*Gvybf#Wuo@l%=zoXmF0?lD> zkS*98T(L9aZA=@4@U%sY2E_lkNRm$#XeORaUt9)7N~~cr2G2tU`YxWQ3-kb<+Hy7n zsu0|hcxpX;04UI|Xi%oJO>N!|G+3hOjncrivFRE;6og_uIn;kP4`sa%t^^xkm=dAsM5?g#BVIEJ%U z<6)jwG1B@6w<(!FgVb}Fr+p9fRI@ZIg81RTDdG_HjzsrLD@G&-CsI1IM+lo#`GNz z>-6Oxxrvk?K|0PAV$q8{=+~bf|B^2ht^k(K7Ya}GQiVwzxY&z1cf31y)!V*MnER&b zd@C8lJxq6CecQTIU%G$1FBCS1XM8IeFGwh!z*iRV-GKSp>mTj#k5Rp1X$oaF6N&8g zFg@`bi*jblZ|${nMsM|xQSIlYr)R`)UX$#_T+k}h8~Ipy5HZTF8+J#1-A3e9{&O{9R1Rx(&tTD$z^3^NvGp6FI?nDJBJN`{#Ls+A1-&-20|eJt99CtJyBvqm5U z&nvRf(lD;z%r_xiMR?Nv;DX^7`9fjE87mn>(37eg}oWF(1`!t@-$bSYPn(=3E>4n3eeOZc_5u)Ks*m?so{N5R-so@9BIK}+91I$y$5@4;BU%#5PvER&+`SznuwK9itVqlsI@@gUwz~;JdkA`=eizl$cU{6WeE6tx zU&6yt5ThRkC`TKOCdz~N_49@7;4UrWD%ZM?01ZU9JeZ$TIF89G$rur$TM7I!(0t_4 z@jEPZWnobUzrlksz+FWGIF95(S2{E#0oX=Ae3s1}kQ@^=-tdhos}SCiJ#eE6KdW#6 zm2T*$KtIMB33RW6hL)P?_$`p|hK>y7qX6mO0GemDO8m2a!@S#wgd5Tr{9cB{zsn53 zG25EHVWAA41$+S_o5cv>EM2(x)HDBS&iVz<`8AG;)DJXs@bFB2F8JH0$$_uOaGt4q z+Mc(grHIL}R-hAd%r%d|I}StHcbL2NRvPd;vGd?L6*H53dnS(8Hdbw8ZHf5hp~PJ& z#QRRu*a|>Bn#MZfg+PCq#!){Ti@VMTd9=!yIyJT`+J97m5C`F3mjepT!27X+yBJSS zVB(SQ;Q1ASer9oN0Tl`ENjz1Y@h9us4(NFC4J^j=5T&^{rf(oqd+Up=eNON840k(= z&*W?{EVE+0eN=nDbl9V>c-Z1`ySI0P{YbIf$m4|5)*XdZ43?CffG7XsA|+s(ipzc} zh34a3b1_+)!aN@NoPlKrgfQt1Xxe7oh;=$w@B@G{tHboEv{IV5`gIU#D|pUJd1Cbw zz_Fg(?x>-nbn_J0pX53cmZE*4N66@o6uHaxO`U|2Q(T*KPoa<+*7^p-x62Qzz83Er z1Mia&WB+XPSS+Nf+DviI5c96?SSF`LlY^CV)kfoAp(hm0YpDrOGCm1M3Qg+`E@9^( zVW#a`iC_!lar2}i4u|)N_>arxL~U5(@P3lu*w}^$)QqP#MK(6hZsHNn!Z;0#M>gQ8 z&GSV-%JGSX4nUps6uLtJX&e=Rz9P6ZAZ-AFMu{T0cu=8Mv&rvKji*QI&*&_Va}iK` z|IU1ZJ=Zq{T_jmg=Ps*GH?EKKc9w1F+yN9ac276QOWV;1bj1$Q8^w1h=~&{faTQHb zJe?+oKNFjrZuqHga$@Pm)_6L1PCA<#S1pNczoE0VI7sF8MX09!0ESB5zlx`p!Zm>S z8Hh(7!jl83kv`@L!f?)6ntlo-zBKTVWbX774C+=QQw2D<*>KkOV^OZoJr{z=B&PHQ zzhU@ILffnq&h~deoz9IbPv<67r<==gOVs)y2raRCD?G45XA$*e5y1lU;lV?XgP#+coI&^*+~gdKpW~aH4 zyb86}53!>gJtnbdW0#d@U5Mvg2#-GUnpEPNPxl0^gUhi~J z9$UO5!?wB|R*}bw(oQ=)hfTkRH9!c0MX0+Jjo&%nndV4t+4ymhmRiJ4Z{SDT7sNe6 z>05J^#?6j!UbeYm3r?=zlW}*l#0gU=+3<0M7vs}T_AIq}F( zE%aZ2RHU{JkcRRXKpM(!K>GFRgE~}!+Yx}2ZWti_B8>qQ7`Q|}W^34pID?%P2A&hE z??vda?~FXt^loDHXoQk(Z0W`u3W6>3x4^^3`R}Gh><>zvlso^u@ZiS+g9=(=>{x^B*1$g{OUIHT5Iac6qf$MTW<`Zo~Y?@_{g zVdFQk<|~NS3b8kIM;apA4;12Y^#qA<7AGK5y#S8riH zTiXh=(YAE!u0kXyoRmZ}%N^mH+=wk{-(bT7@OAhF_=%GnSAZZJ{&V{k3^S0TZ-K_9 z=svt?icanDfSveWvGX_~xhQN5DyiwVxqB+uICcJ2ew#9QH?H9iO+~ z22ba=QBxOJ*JJE~9wD*%CU~&1ux&J-xu*&9u~eif9c3M@X3I`Tk8EGDuW-!>(7wMH z@}>4-xnL4FShSyDClexVPpp~uY3K6^2h=8DX)iLX3!6O7f`-D(xa?d%MIe6Q`U%9| zr@qev(y{a{i{r%y>Px|<@}3V!$KjRMmqG-kd&Sc2uyp^9wyOPqBOo26-?zBHL__;2 z?1y-Rv1fiiozu>Ry9kV>4~~DsWQLZb{2Jex8Z-~9iqOv=CJ;3n($VhFM(7;`{=`?M z{+ut3#=lPP4;5%Go~H_=2@7aQo{@QE@J;|XwUeED0LICkX|LmB?rY-<-gx0nv=5W8 zSqPL4$K|QTE&>4H=umc$zzOI*^yMEZ;r@;na$Mr#3cDBnKfUm`O}>Qt21`@uNyQd< zsoGDtR^mx${I3>|R|&V-_zz@2!p)(Xj)PY$%GEaq^$~qGwfPcmenjXf;g(OItZs?v zf&W;PA0DQ4)L9Q?d?w~^%^AYA-BGQaDO zU%c6ua64Ye2SiL<<2_7o;X2FXnt4)F4`0GP$7G=1&6;d(8Eq45dc9Bhyp@-NLRemgTz!GjlJGZMs57HOP@!;iFa z8V(N5SR$oi`!P;2Eg>%YO*91f?H1{1pn`JNx@A6*hQq~;ar=^9-){);t6YU438#B7af&7pvu8t+vpy!%4W%Qd>mi=$b&G4~%wGzNWZ{&_xh6%KL5-~XFk;Q4L!xo)YWDPwSexE*sjs@)+KZ+)D9p??;Ho%ChU*qVsK3k; z4yz5cLU9V~(^^G?Ibrpk(QEeCIaE^D?=Zr>Fane-_xCimuHQc@xIzA-6&3vtRvmd z&ge?Rbe16qSP3#_Qz}i;ohF4KlJz7vnP5tHnAxN;zhxWZO7GY9ojB%oxXP@svw5`x zb~F7AZ<*8SCYOdq_>ar6T3smGS)C`<>U1-k-J;cTtK5+Yj|*Sjkf#u*!@3amCbRbJ zyG&$Z@#_i6C34uyh%hl1rQlEQ{pOsIGbFQ(@0@+}AHe&6~}{ofq7zofk_i zjfpGjVRT+t-0&Pxqf!IuxX%HMfWY-tP^1rKzj54SN5q2p|} z<6Z-?-W9k!RqJ%FgsTt5)OfKIx33x9qam(N=Tzpa>rwJ98U4^>=F!=?>wS9S=xynA z-Vd;Ee$g8XNm%Xv*6jaR4msR}9GI}|kIS~3s!EX>C7bJ~BC{QU9r%{cn5YNJkp)m1v>WE)4D*%Ig`@`I<~)57wFgz&+Gyn%cZIdbdkm5K6#g|YOy;Yiprm5R(DLv=1bhc)RwZ_}y^SP|yY{>65ZIgcF3qTkuM*7( zE}O(26B#}^ZJ)M|U2{JE<6?!VR-jTmiv^Mib#Rw9RJa!ps!s9*11%v}Vcl_XI(K&e zY;H_p*40aSp=D{0VaK+;spD9LMYV_H?yU0ey-qe?8n>rH2vcTrHAU)+b<(B0<XTJSoY6oo+lY5@-gVl)=ZvP?F-7 z<6V_Ks{tv;Hvy^d?SRvX-fqQ~_wj!Rqj`_G}sLaT4%UJSahE}#Uok60iJVFMA=+zU8?l2?O(z!4>VI;=$jh#cKzwtv61vP zaByps`@G}sG9Lr8n`7@rXVgQ>AB8^IDK%jYe zs_!yD+J097(tHLlSmx!*_;;&zc?bLMWgnCbAx>O3H2|;E@gEmkeU}MjY)dsPylCN~ z%N7P~O6fb+kFXXcrorYz2yaYPsXZ;j1e4tL4ND@&9>3&lC>dacY7AD(^XJU3nOR?3 zILX-TJ{gKmkW5jF-H>sgT!^408sa0DmKGM3EG;P(sw`}GsXMvw*d-Q~NfHT0a@dd! zB4zD|gJR*Lg|$M)G>OG6L*@l6KM@4Z$d4@jbv z$`SMXduOllrF)N)0M6GsAE5|Ox_7%!0R5l|M&j6Dr4A7XhK{p zy;$^U1_{^Wfj-{|oU0nCSfL4VaorY+dQ~n&fpb+}Lll}2S6|^Go^I7gYpw{KtMb+> zLKEUT2(*5EOQAI4CV)506FJX6XKQ#Nn%g#R|F4hG&g!*s&P zBM%Q6+tS7%G$F1-gv;dX+)MxSXF+3I+Bk$J#KjTIH>uX%`1nOZV_VudgeJtr@y_SE zZo#xgL1SCmID{s|#ZOKw%F%=FKhIfxRM6Pg2*CIhnAJ>%gpB@)9wxx|jXhK|v zhq(5?=C)G;#QIZr&IByyYTIelY_>#v~37Yi0jLs_1k=peg~cwG`6K}Luf)=9Lx2@ zC`)ANh~E!YV_SHMT*U{R&;Y%2cIf(~s&h%&rQE>#^6wQyCDc@11h1m)Y?lQ%AY3 z6N(9$H%_QLgS$V5Uc4}}_LT|nW*>n=p8n;1`Nb@{6H`uk zJ7aup3HQzD-7|WCQOexgTO(eg6NW|wwqySejY|2bGMNzVh(*#z5#=E|epUNm06NYamTh=> zHmuG9-N~T&hDXQFCE*PZALXkC{(GQ#BcBfC3oq;H0qq3MY;Ul&@s^L&A>E^V6u(PB zlkz619El{}JV`6_vA|4ZJzg!Butata{H_AsHjmckV`%sUCRYgWg62eTDr4zN!?v#e z19T%n^SnoA(+3-7UNYo|;dR5L_*71e;cR$i;cLJd-Z;>_>CxHnh7I>-YQiq7tG;Gh ztSGNO!Y4mD%RRC)x>2P%{qT5MeuF!s8&;|lDUXix--^!Y%ES33)A-KlhL(l$!FX47 zMmM}H)DB4Zz0T;$hK9Q$fKzXTM^JIPC^26YHi@6{-Tgck`ZeVMPY;b1qN32`P z31gNC6V_=-c+`!%qnGt^Cr%ZvfKji|MW7t?Ol&sfF?k`2RVE`5q`D~6xT~e9 z_K^vGi%hWXF#E<@c^EQ5tpoRRye=u+FlGkGg1M4|mleQiz9s_FqPG%CJ?3lD!fRa- zu$P=ux|W=?(z!GHOG3N^@Cf5~Thfs1ez!GoPD`TCnEp~`kn$dvZDv|kag=d;ur(ho z2dUmQ28z<|<%L>ul<&%^In%Vmr_debX8Wb+0OM>1IV5QYR{@%d|G3;EGfN=bw%mzD zUY&Xy=zOz!t9BoTeqCR%YWENEoopC5XM!W;M zd1V!Z^J?qt78Gn?&WEeNA>@pJT#zvmPa~R9*FC6%A@*= zE)VR}4DR5}Ia32WJ*D$^!x#V+wQbVA;V|%)w$OM(w`uEEE~|()>`L6_IHj9LNAG2m zPNbd~9lM8(Jds)(3IOeZp_Ye`C=4R2ePk}m15rb8h;(SWaasRJ{UC|uNX9bg)6vm} zen6+O_XR)Ik;HW^iMv`bxatpZJuS{8zC&^+IxAoObmi`7!wwA!88U$d(&3!%zqk|6 z_xk4E&5gUeU6ydSc~`Um7=O^-i{$8(+s z?H>x*xGS1i^E>*%%Aq;#Ey$aJbQ)JojW(Q$gPyQ)34@GZ2Tns^kXMmSj?dY!8ZJRN zy8_`f%*f=6`$RoY@=Z@__WX!G8c_tL$Hx+3x24eqYSoiWE9JEOhO z*)Vnn@{RnrpG25b=Js9&LU86>9L)o2;=I`8EVLY3lo5SA7;Eq!mob80x42xecG!njp3T-VYtYQMIXhJmHK}k7<8P!PkW)I zFwt*iGPaYr0*OW0M@Vv7w^PRY`?L@D;_7X=UIq;v zmp`hnBiFEl{<_}Zr~Nt!;Cu^t4=F;mG|~US8}qg3v3c`-3waM)8k55Pyi(<|$B*lR zr*D2+H92HBz|t5l?#iGmz<_IFaG^~^^q-qI#o3}^gGYe7_RSnrFxKXvGvkru1x$zH936yfu%8Aqr4RM zgKyY2p=xr-b-JZ7T%}$(j3pK|OWB*=xn{3wa>zB((ipCfh=vm_jo6ap+bxgX@pIMW z@NF+2aEI8^IMU1Mp}_j>aN@V#?4_C=G!Baxu68fYs>vAw z8V20^lQre4$syM}md0@1LNuIea@b$!ie}$(sA_Wf_DeqC2HLou^U|!E97-D?M2P(Q z?MqHqO%ADFwlpTLRu97|ODuXNpZNdF3(J3{njE}DbTJF5Q-oYWImA(Bz*nDj0w2V*V>r^_Pd1gvF$I4-5uW-yM8B%wG zl47#41o9%K)R~7AQfD5_B~R}JE=cq3?4o0(tmEGld2 zllhcV_pn3CO3GF9rO%SUi^BReC$xu+8ahfzs43I$O+QROM|+)LQsfT=okCy8*`pC= z)}c|JgCE-NT;h#y{1FLy-mM{D1^#MyzUt9&t}k?@;j==k@f|r5quNirL6!49q02kj zd^YH?sEAz0fZ#aC*6_k7mYLd*Kyw1LTXZ&kAw8LX*DFACzDLK;nZ_H|kURqX9MBBq z0s@ZYLKnV_MpmgyLGzMF$Lwf$VNC$%1Kqi-2sot+Yy1MdrE>q2tcnhI94E8Ec;P$g#h@t_G1v@>;y4|IV#j~pSYLz|2X$h zC?jdYHe4*z2V!5X_@q30`K5ayUU4~-XzyLR*J<1f<62kYjdZ*7LwFD&9Bh12Zkq(0 zT(fK0RHyNiy{Sa%6YO_hy3Fj|WzC$Xca>Plfj!7TYo)>uqJgwaWVqaQYg(>6xgAoV z7wWNV_yfpVyh9pB`eG>M{CSCPlNPZ{=?kDYzJY20!z5>!FtyA29)CID3v1ot4>LwRTf7{j^h3cP_fW)4SBpkTo(@( zXe*vvvBjnFo*+;Z9Z~DKmxcNQI#GN}EX4Jc(s8GaLYDyItPkfPdIt$;v=&HpO2M!ZIzh$ta_{cdZr=SK}cgumCGF;h z@`^@kOs*S&?v-m}j_`W*mDa@=yzBR1vV|lyQi~JQ|9ra@9O3Br9fyrGJUNp%V#Rxx z`#alHz|i^f(0ORebeO1si*q1MMI!082m1Is+s$1PzC3gpXy`~Ai*iO(0BHEPPld5^ zFF<>rf^WCtIkLd@z&~WKAmp6rH-~R}*O!OBOaeH{L-7HFdqAGXZUws?^L1b9tiSs5 zP>$7f+}TcFEd~B^;u4EeCc<<*fA&k)`0`N3PPf11dRGyi-3rd6nATtX@}^6DdFU=n zV^VmmhdBVhD%oTm++TL;7+)UB!HCY6hYnzZ;3x<2E_~3JhaP2VOui2AFr06P z_kR)->9REBKZRN!T4LvUArrSR`N&%#8d*&RZj;b(F6a>QuQ{0CYo3LD&{{s(A>}gvnhn>DEDEYFNJ7`;fXur6kKRt@vE3`g)sY) zm`ty!Uutf};ORYoHMb8zNhbuJbR_IU`G-^!7n6`d=*#R{8aXhsDu*|5jL#$^Oed^^@D3JQ1i5sMF`9XkG?QJ%>~{ zu100`SsK1!LOk;yX7y=w=eq9lth@R~u}(?z@cQuF*s0t+a3VCz4Oo(1j@<)CH=Y)$ zKhy5;3Ehym1hKVSBf6y_zYF1Kx1I!VPt4}V7G_TwQ_ui&=;Qn20KTq9xr*vMmc@+a zx9J=%0yt$%`qF(+)syNPZ!#vP%ogc<4wmfQ?4ZI@SmDOSk~rsWQiT}D11FbG=mHIx z(dpb2Sgs#iZ6--vL^T}OdCD#dH@a!WH=h=M) z+KuNy0`)^h_Y>$iK>U=(BPRnoSfE*eG!#xos3zi)NhW@)cHD&5bn|V4R`Pd4sy}`r z+}c%~+KK;&ldG6o`T?p|4Q!ib_v5VR12T;(`bQG0k3p!IE5eShcZ8oSi!TA0t~rQU z$r*7>a0kNI8FB7xEZhQ=TZpVVduj;zdmtMx$5x2}ncS5ARcH+%?;nzf#(Z%@gpKlQ z!;=6{IoE|t!C29LAYP03Iv=lS+WzGb5+}mA)eED398T$r9egyqvq@@wa3zXFhc!oP zn;}QToD9nlDeMx^b(^`6gv3IGiM@(XFi~Fh;7v%O?5&!%?p%O};y*4s8CVr@ImM#T z_whbJaJS*9GwFu`QPUNVwBgB_T3mEBiW`JFU}J)%VnB-H%#re#IBt}RM2-?@DWF1u zRslL%px{^sWZryKnIF4#7cSW!EXW(Ye>CeD#W-{O~NP~;x9mlvc z20nM4KLh^-3E(&b*IDt`72(amy%+h>F~9S3KwM23rvvYq<`uuNHrwG2FM6}aj8iU} zz&B1YMdlU1imB~@*&M=*sjQqnf8l%%UE-9B%WdNnQ`P}vY$cOUX-+jP7V|*|%<~;E zmv_MYt^%B9RK@AUt{TG-3SES0zO^#)+Cg7sKK3`E!;T!=|jKJ(c53uj&|+;dRM9VSzp_jFYAKzYZh==6p<%wTE*VNUiD zUV>#xWD?hzp<3%Vw5)>>TkBUIoa|UEjwD!EZO1Ofl=0GGU9=rLZ0NASz483yU^Rwr z@h{g*l$ZF80uWR72Q=VEwGqn-RVC{~%YuZYdlod?^65&4m*&&G3!0b?5q@~XMuj3? z2Brf+^L3AoBZkB~tc=TR>rMu=7BruDbd27U{8M0K9Y4_p81#USF?`kn+TfC9-U2JStwfBan~Kg=0Xmga3rrNsHng_>g9s)9`o?~J<#m& z=$IX)8yYGX(hWpps~I7j2`{*Jfq3TcHjjqybo;W__3KXPh78m5naZh?o!{iq*|Qdu zC#l`1Y3n#ED#X9PLp0=d%)Y&j^Sy$b>T!FJe$FxZtD=a|6YxVWSW)`IwGiW3v25$T z%(hT-;#9B~cbDmeZ`8Ugo@wu6-XIAC9p^}PE8(r>wE z(8G=>Jm$Dj|LhrTHPS}MkxwlTaExv_vVEXGgPlSGIDZD)ChukjtF^9N{tWgFOH(N0 zC+whj7!G{lxO^G%jh4o6eVqw{;~*1@@=HPf_NlM`(w8BB!_pLbvt_f(mhB-H<#&yP z*`OuEM*A}4X&#qaM}c>Q`aC+7A#)5P*ZVDx?DA#E1(wFdb-0J&kfCy2BEGk+$CrE= z^3j&Ya9!wOIK=z;I&9j{*ZMN#I!j}?P69QZ%8=&)V$D7Gn`6K2%aA$l(Fu(}e~_oy zQ%f#(gt8_7{v&@+?Ybb1z)L+0zv8i|iR-*~j=0m`Q+s8QCbZ{|!hl$mT*OdVVVvfZA`asaa;G;hv%ZW|uAg)W=V(KK-+fpxF!N)N@^*wF=ixb^$S!!h zt0`chKs>R;(D}_E4TDl)tO0Ofzn0Qpo}ORgtzH5I3u^1VcGSs8y-YcEfzK^;!-toSI&p68LI?_KjONI2MIvJXs>ETbP@)&l zym;o~=?fYzMt2W2_>KhF6)3?*hLjBtHpI`>J(LeCFCQlDlC6?6Z&-f9u((Q~e_^Z4 z+nMJgJy&4bu%E0{w0^vGsFzaxxe@*&@&7a{9PVfM7rL_WS^mACIgitWfYVl9=6$2o zgXa~_HI2ffC0+jdawq&QqgXTGDk9YtLq>#c63oP8VQwKTTYF80-*t_5I49iJ9glbm zLo0iaZdiEz`&TsYGt6|sbJcqIB zo;EG#l2EyP9qsBYPVfRw=!S>oDx2ZIbqRLD)+-^B;g#R0Q2L$)ej8{WXiz#N!^=ll zpmQtwM&i;)+o(Vo~D-SCo7Ik%v|P8`WEtnVbeJX<aTrZRMQ#@k7mZro6Wn|87LEr|3lH-;h%`*(GdBCd`v zX=&?GGWIB_!Wfw~GjJka(3db!am3Q3K(TJcH=h8xwtqL#g6?7JEK zFTp>%Npz_$Z141Y<^wh8lcD?Kbr{|Icmr&?Plln7x6$4VWB$-)MwgHL(dvIej&lG1 zE~w^d_#UD~`XBJW>mz2{GIqgWR$#v(_@K9;Y`wiL#{e9N|F|3jQ0P>P!^GeF#Gh-S zxz?9cU!4G~w78swzGtByTZofejpJTG%KMPTZL!b`7UH^0Io`3*Cl=~~36=VCkA*_q z$Dt7SR46n8kjBRSwunx(z7 z?(!L#nxzGqn!0{fHR=ADnhKmCOjTrRrWR&ust2W;<4@whGVQKeiLXYcCXOqu-bp8J z$BqkLsPY8CDtBv@`=_ist$#LgdrQ_`(*)8gcNgC>?%s^MJMAv7#v4v&ewcCJOS=tI z!H4sqk5##k;8vEUc-xuHRaJmyBi^sgU}2+R6TI*lpF9uVNTq|+zbmNdW?-@SeUoq5 z=-O=a2@z~hosq@ay2R~|W}}z_R@EVtEt%-#J&NQQ+@Xp%4|W8Rnf;X(LIP0Z3V^O4&3Idnu`a)a^qUus)o4!n2jQ- zYtu2QD1^8b`;BL0+$Ttybzjm_d8jJ75oJ_evaxAP(GXD1upjx3c+|`u)L)J` zE>Ghf^@K`#9)WKm6ssyhF_s_^D8A?5kBf}<;OG5x^s#jAI%XPsk$~7tgxi4a($Yud z3~P!l@Wo6NmNVCAk+ZFC1_DXgiIN8O7GNICMz>{iH?BlrV0bDUMGr_V#bg$KkD$=e z5gG=9d`~9&cvW-*3cWn*ZbmcQlxZI5poszepsKlSEa}rOy3{75|Cuz(*X1T|DdVjB zB)p$S?;cSFX$ZPo2KmcPt^?__0^X--+)c7G$odR4jj9^7klf@n2>+Nt4d-gnU|soaJnvDB7y?mlf3ABm^b_NHvC3ggRW zgtI3dTYf$M(V%W&7Qp!`MvZH$qMu}Q_pJm5{k$hwA4e1|$j;*^XJ+(Sz;A;G5zDkBXKseeWbj9lt%m9ptU&=<` zNv~=JLpKZvtUu%&gVW|!uK@m}cw?q@*MKvc`}N2)_b&GctD-w#TGk`joIylqHuvr` zp*h|wv#JGL(JFVnv#Jfyo@8-ry7lA3s+!{i$2a#oCbMcS{ZSxOv+h&Qs#i&qD#qoE zdj?Es?ssHW^rg(I^+0w*3(K^&ALc~gb5^|p#3!lZcM%ejTy|6zqv)!2q(X_Ok=}}o z`x1gUY}IR|EPm^)?d#XX_9EKwExD5IrN zaK5ntDvIkl5VZr`Zu=4Dx2f?G&!-Py9+mNHaT$t zzSQLG=d`|kh|~C&9%Gv0A2vDNlkU#eZTmGjJp?$g31!;)*1=BW8%HJGt*veQCHLRi z6_?IgynwA}b+ zBrbgt|1Zo*%zAE4;^M7y5{qi<@c7kA1UDzK=jl0#-LJiuD0nqdTwC{EV$nG>fOvCG z;z}VvI5JA(cP_YgzX(ohjKDc-JA&JW5EkI&8KD9fU-nEc05rJ(OsPV=J_!F*AugJ| z3Ex`(I$40PVpc9WhGfuOJF7y%fCnUIRo*SS$bN-nUq!6h=KHoFEiyUs3L|u1t#E1t z;6mA$Q1wk>7SNBtS6E4?UOb^t{Tv|8h5(`e&jSgB_xFN+3DsgYlvm1LMp@wh_k(OG zem(xZ<>cl6zsdHmuI2w(>i?UW{$Dl@cz@q;kXL55cltf^{u%@-m(@yl)sDIMG0`t= z$u{4q0~;3SdYCnT#4^L({|jp4|IOP!tTvmMcUHANXhl=p2Eg%Z|| z=Bt{j3ux-{zPTB9TcEyjsft`x5*JO^fDPP%Ju=1*~pyM~QeSETMn_qreA zt$2&O=4t$55uB@9>aMv}D5ys&-srC3&XimVtB)((HFt>5Z#|zE#iu%{i%@sXJ$O$R z?{e3)iN~beovQ)3YyN;|@lJQmp9MWNnG-pgyQT&2$>KJ54fCH%ou9k$8vxuj58_$8 z)m^hg&@+;`JFgY|Mm&=YXs3A0PUe1v-CSUJL_D^+Yu*QdEjC-y&DSxTTCRHOj&o0; z=P6j8$^R1&IVqUfnwtP?+2q!+Ok!)e6!pqw4a*{?<)Y=WhGh`b@>s)iz;aEp@7~u& zpF5dn_fF85nsE=wX6CL2Bf^Sf~UA~7Mfyx=UHfpg;rTQ z+6YqKA6Q>%5*7FNYZCuzd3V|HV%Tj+KR-D{zTEVRW!FIeae3%z5ZPb|~}q8+W@ zz7{&dLPZuDW}(w8l(Enx3r)Asg%)bC&`JyCEX1?bnt~r&=r#-8ZK1UmdelO=K;7eg z%|dTk=pzgDfZk1Ozb_z-?JE|d{!o4YU)CR<2C<6fJY%6r7MgCM3oX=Op_LY*CQ(EA zo`rsFq1!BUw}sYP=ur!8wa{x8ddor|St#Dq#FntoVHP^pLM0YD#X@5(G|@umTWGF@ zaBGuS`>QSPn-;p!`rc-t-&<(2rQ2$8f7#z`%zXyRsm0_j&PT;;zNroz^!FX??A`(>(gf zWa92KdL-_u+`qLAV#QbXbM|jd++BGf$SM;~Yg=EZIldAaqn)6u><8o_t!;+_-^1Cz z1*o$Q18QJvTR*4u)wr|&S`Zxp*7J^n;PXnS^);}UHM$ME__Jy~(jBERbpVtLEn}Mp zP6c_dWb{3ekw+c(MUjiID1O;p9!DU(TVFe$81V&7cMMz(Aid&WCie&N2WPt*2CnT}Q zq@pi6s~!YNx0L%Dq`#0?Ln-iQAbMl^3Sm7&`(@=&vSn6nAQdDbnbvIx8WR9z_{koUrt3|bwne9ke>z;Jhi(--O$Y`eqYrSqf^Dtx_#Vp zCPMk(*^xQGq6xgS+!#$qV~m`RV&jq-BA5S z*_!j>*_yBQ%+{RIJ6p53AM~%~>6*nb>lBAxqTk_AIzy8Ln+>UJq0}QWdJ*O;EI*Ugf?5%FR{oAE6{Jse%ZPnk;AnYZezk35mCd`Q}c(wF*lrsPmx6 z1rv0-dl2T{DyaN&)5=v>_!Qm{${omMVU?#nbQeH_N_Fx_+32$x1a-0RXQR(#qp)Pr za1ZvjBiz<1$h4plt%@SmjISwu(Z=KC-cT$s+$tE5t}1|f4mqu=NF!fvsu1Bk1l=pj zXgffv@1bRVp{jZG7!(qes*|B+WkIzfU=|@Fr2=?oy5_7wP`mC*U-bNOP~Mdw*r(8n zKm{E?WQVCXSw1rJP?BR`0jgkYHrGHcAGC_x8}R~3Dl#)7F#jV-?x8wZ&F zb!ljnvDucY?O4@KU|S2_;`Q*|3fx0g?whhTA;t1ptBs-no)u6+-imVKdKj;TQhKqf zJ9H}t%DAcs?9ZYE`y*YSLQ8iK(#T?fNTmTgD@5D+0y5qcQDSq3{62+X*gy+`YsbEg z{s`kaC`h4-MNHVo04@K(s_2Uu?Ze1MTb28IMmq2(+2U7GDisr&2Od%tea6%MAx}kU z85vdlRTV=M_~~Ken+FZaM&C|LACG3DJ2UPc>ChOaKA{eBJamxQNufGQsu*EYShbj- z*hCHEna!h1Q25vQJF@|8XA4t;9(QO}bhoGMgpwEC=ow$xnMP8e3_UU%eJL%2cQ@C*@e}Fhe#6oxtZ2slfV|Ljet=g|op0Uajs7rH|yuG2qPIWShqF*R3N7{hiZr!ZGJC{~$uok6+EqQTu< zrzlr>!r;od>zt6QEE!zc({)O6m1Tn~F({YiD$55~7PwA%u5$F?%6_ghI#*dSxU#?N zROBj?gDVHR4iv2E!Ig!sg9{e3gDVHQPBu|cS)C|2V+Jq~@HlmeKA9PbK2CMIv2`hq z8!hz~^?H!`MPz$6{^OBX@ze={7i3zsB{|#v(Tk zDpiZ509#tNdUo11lA~4TR9VO>&OSfNZ1bf>+2$410m&Cqf>(dDb>jwz5+LM) zXiQ9ZDn$Jj_|ctaDCvCv!#*(5ohF0XM1c5cAPxmv;hLYf4OL84V;p(Fgl zS_WDGYRKpl#}ox5eCg)#OViC~qj8K|sx{2oY+MI=s3C3f!XRfdcWF^FH{}GkHCgVp4AWRJUqZ?t+rs`19SW_mjB`%5vjpxK%rox$)(>@w45k9Zqz8ZtUn}ZqB^i z_=?<=i`~ib+!RO@$JQm?R0O~2WNt-$67#TRZecd*URvb1dofLMqPvssloOJ;p)-X6 zr}(90^eOj(61=~kbf3kn3X1-udqG(e6DuhEQ^lK8QCu%Mz8r`hoRJl`CZk*3v7k*PzDL0% zUp4bl9q(UF4O-`q$8QUt<^9 zmRSEL;5Py9*#UxIYZuw`8C_%#1k9l>g6^>!eO0^2^Xww8;IaF~#QLoWdMmof1?VDs z_T5EZv)$nx3w5&{qrZhZbdgm%?!m&{te55_6Ib3@2n2y&6?nicH1I^sjXQfPa9x`R zG;i^MH7x)V#rNGIKX=}QAACBn<+KS9HU?gcALl+AIfB4{XS(^$J0OwDHs7)Zf{=7G z4+%jZSpiBm+HHKrxL*kEq`(+W){qjv&16IYJ;5<#;~XdP%=kNU*HPM%%&oZxepv4p z;J)K~lDXy=1$*5efW`8*7qEXw=5A~g?0qeYJqp;C+?w}+%r!p^T(TIZ@}{(GV z=wK|{GOAza{P|sjY!BR`1Z*pp-r-_UqaJ`GmYyp zQ(9M%+52c>%~QCyXAZXNU>7Efb`GXe&};OGrZ+f+T6zu!j5T$hUl9q);hCoA28XAa zP{NpgxoddG6}_wZz@8t6N(<1)o*&R)=CWp`N3#?(tD4BWVHL+}y5F6S2MT0(f&4B! zwFJM|u*q~`CnuAT&HYMZxt1HjV%T%bR^cS>>etO}{vp7XuRwyc33pj1{$sO~_;w4t zCUxui)SHd3MpKEqvfT=tr?xxI{i?BL413D@{Tuv~-TFVZt+6fI9AEo8X69a|8mZVY zCq~|esCzPk+FAT6 z;YH6QsF(2#U9|e(64>n~>Qy{me&szx@r{EkJlvbaZ6j{=!POq_U9$cSthXIJgD5BQ z!dg7q*Math&3LpwLg@eF?p?s5th)Z;eG4jh8Z^(EVxoasiCS8kF*1WQHlt{2SZb8V zDN8iMF6zTvKk5V0ffI{u(*|ZP0%_^UY zj&5?F7CkJ{O;<4xGSM5a1MUO@NJmS$X(`fOkuF_thHwj0eQ@=Wj&bc*SF%BGiadl` zlYf^^=VaWB@TS?&8~odOjDAEf6M?TGTBz{T#l|WgUN<&?Ht2`L6H4KvynqPUidQ5} zSv$OU_ ze>9*~#?-#ifQCVgB}I*+3@9-H3_u{DZ|dn&t1=P@umwGRLMkJHfNm)idn+S>FgFIWab+YB;3Rtb zG_Q;V!W;@@Xk{c2<}e_`DkFg~hXWa283}|LM}a;aDkFg~<2=x(V`U@|W}FH7bg7I4 z!rTqWZk3Thn0o-(qcRc*a}8OkZ!W;`^Y-J=6 z=7B&Ctc(Q090z1vWh4;hp+F9;j0D0Q4`h60BoOA2K#r`81j0NP$g!1?K$yn?Ij%Ai z2y+6Ecrve|hX7%oeVvS;07TVu1RfrD8o|R(4v{LAyOM@n$;S4$H@(yPHMXst!A-AG=S812tN8 zW)HKv-5PP!IL~O z4zrq%!YcV#;(Ev8r(ZlaelI2f8a)+1;?(LHv{`NF8RSz32YLo=QwIlm1|3lc*YXTH zAx^q))yF{>hh6Z}219HR69$&FIyl@jXgAL7o7V-JQH}*;#rFRiqR2V8nz0`I&89yb3xj{tk8?4~SOtH5f>6Kw(WVLe0|DSb zGT{ILZK6au;K{mqtb0_`k$Wz&9;j zEOLi`Qus?Pyq@nTI-xA@8f%}GV2mhkLkiMP!zdu~#jDxXxPVpzPr5GdPsM-Q|m zS>kQ8eN`^5XQ_z@gT0>*WQ{@b606yAV?vP|Y9B)zgB)Wc&)gV&gB(K} z9J4mu+Y&dF{br% z+VnyMSSf;(;7-M3jz=qPLF7@$;ax+?I92)f2yOQf(czt8!=?uD=}K5J6&XHMPO)n- z!cwU)8~8Pr?X$O4G4mYz?0Y>;?@d9G@N7;f3SWfyrjTl;kiH?N2yZ@pMYw%%=pq)9 zFq=XG!|>yP1h%eFVl&nCmcifdq2~})cM#>{$)W<7LaLiW`XL>62z^C(LxmsIsZ@7I z0@ci9a=ep6v8SR;P*G6>Y{=+S9)X};FYB$>&g-Qxpq~x(ad_WMFeu{nQbxG@>aV5P zYZ^+8;yCqSB190KME_%v(Hx?hm6ai}!K}!c_MjC-_IPDe5tCXF1APYjZ;m%gy~9@i z< zZET<)H6VK3L6+rt0}>k+k}`l7gUb4+WlXG-v2tz2KDx|zv3jI0Y7RHqz{uRod{N=K znAC1zu8G9ogb@F!KUV=2X+E1k^Vx*I9{34Ilh_2~ly4ic#o;O?dvXrRgns_||4SN0GDOvX zA0iITjWnwL`w*n?hY;2OeFz(>9F=rC2qALydiu+ONfDEb)n^Kc3CEP!%@pCxz%yCt zm?5$Gz!X{6ng=36E-q$ID=~*+z&sI(qgr6W7D zKG?CYhtkmx)T2=(E~=^cpmipY{S&{D0`eKq83PIgxukDf1F{(qSxuL|Wb<7@ngKnq zRi1Sz2p<04CpXHX=^=!PwRv9*mmec~V@bqK_!0dEIz}YMIYx{hY8%mSq+`TC#zIUD zHJ$oUrw9zj)%sxA5lBKgaf4OfmbZepnwH-Wk2GAG?(%9r(M}@ zSN1^B0tr~-@dbSrs7fIG4pM1B+yvQxxb%;^-h)DsY68Uf(5>jv2f7MVk;rkWC6VV) zh-kY}>0Fp6K!QHo8@{%r8KE2z{YJfu%fM74B!3h_b{muzNEspr_mFM4<&IsA(6`tD z-GovkRSvCyScFMO81#T#fJ7%<*w&CcRdFh}?BJod0gOBAxJO=&>*yU`!Vr5&Dk>XfTqcGN z!!%qUpQfv3pupl*wHC3HZgeBvX?+Y|Xhr#Nmgiw_mV{i81gSGbqiv)08|Zd5PhQM6 zN6;{cqC4i)1h60xZ8L&F7edbo3Lp*@795<1>0JM>zaE~73R6%5qlZf00 zrR<~UF9Sk(FA&x*>i5!Vg9tv+BCr)=^Y*BM2q8wwdA4jQxGBX5Fjdb$7}Zc`PE}*3 z!*m7FO`R)#m&^fdQN{7pqON~meEpIl9C4Pjs6xPLQRglOlCCI#ofM#`IHa391egQW zm=53?1(<`>n2z8S1(<88F9L+_V4Qb^UX(ckGVee-3lAUYt<@N6X%So1z8!Gn zkMqO?_43wYsxt`3Z?$hn9Mp$;Vrl^w1Qjp{t<}EZRt=8##DoABqBs_VAIO znEJpWxi~YW*TXY&tS6>1Oc|)o&Z)iNCen| zZ{f*L9RI^C-moAD$kov#agSAp55)OB4hQq0ILpW5Og~bcITlCuaq8d%6%nky_SSA{ zHIH>$dn;380zKBe_EwNE$Yb5z-U`aqf-YBkD+m_iu^w!1jZFCX@=2834cd`7Tqw{nkUfu zv!g(xC=|L>58W7{!-4KbXqy)%kkl=5*MVMwIjS4cPM$R1%P;Aj?_ZE+xn|rLlBzmV(AT=|VDg!6t5>*;*ab?0QwG2w71G?NBq5gtKNU9H=~1!R-G87KZd-3UgEv z&g-S~hBz~4Hbyw(py&05!^5urX2ZJc&B_y@z){F76=?l9==H`557JxmCpZ-toL&8l z2O*_NrCekHH7!|`=Wcb_Hu}fQm?Eiem{h|tsmik96zo543K~@Q^rli#{Bjn=re>%d zKyNK;w7nTlUqF%E0@~mytfNCyC;-<>_>m_RHO(m33KCjoP z?GaQ*&lWOTd0Wwj^R}q0R*giQ0C57RRsl1F+Q>975T|&Q9_`|kY7$Kae` zg@;Qo-RVYtHjs*$0feIqGrMECm7I zhH9txD2FOLr|ha=V;F*08fyqAB;4})G5V2UJ4jxQ6u|kpAvh}u-ihB2d$#}WNN5<@ zmyox?3bDyigzjLJ)IVa5In=ubN6O!g4EZ8i$3peVlt}<~_%?&mMmTLfk7p`q@E0`|0Pnf4+fWn*?l9uw4YNgtJ1Z zeO3syFJaz41@jr>XZfYe+eiew9pT0czY_S_g>ZQ{dF(MfV4P!o{}kYkA0&@MhQ~#C z3`r-C6Xfxm;Q_w*_*XN?<1BgnVR%3`Ki=gdk4xn7r}Q8(I!ZU*oR4p?n}uv#6bn8j z$*X=mmq%MfeE=(VyqBlXhsY%jJOOfu1bm^|iAQ#J~+ouEGd>u$F(t)&60DjJ!J02fmtjZpaOCSEu z;-52c7Ope{i*f7^g0U{dJOd*uQ_nmoqMQ=>Af}gga|qXScst0;XtG;R&Tgs zIfpCOcerA~hbwjfaK)AY{0G`HJh0_xh_q>)3uMReOZu{Sc^WH_K&1v$1uU6xkzQLsGUXlyG{Aty7|=vOdddc_;ua*`c$BG32d_#-Y<40p_ciVf(x5st**GMveP=pLcO(LF+$-ctsyLLffCzzs9PO*C+G z4Cpfh`qqF*twPe}dq6U`g9cP$K!4o=+GbzE0SLlRySm%7K{2iGUuE{0mf2@QY{57n z4azrdFjvJD>FU|1LxSntxyWqVUJifq_EYOA0XuZx^Tr2sbpW z(d^$_X8(>9!KOsyrU*AFtT}FHAzThnj<81%&Jq@uT@(_WS5VxB^Og`NY#12!sK_UR z@+lCAcBJVO)&VL$Epd%2#2!rCnIhr!1iYq)MVhnEBiX|O)fK3rVNc_R7ElMwp6Ovd zvabXYA~Tj z<+8ccO;BuiE=w! zc~l@L7Jpa1NJBYh_Bg^CWtUW)by}u^l}?9%jgJR#BC9D2H$9R?GuH7YM;Z~qprA=7J{bOMRCdE%oe^W2j4vG`eeoT6vr)(2(hXOL|pd15dOF zxSrW}8i=x;k@Y={t9}if-dat`v?*QeL&Qy@c9{Qct&Z6v3hdce8i1?O6V)n)@ll-` zVBVF2IfA(L8#P;G%5H~ihoF9d6O5OONb9K0RUn2|tVw-D+pen9biHgd~ z*l<$^3@GsQQp}#dHL^0hucGpfhShDS|{gky$DR;WcDQl;4-s!p^dn(3C z-|A=>3>DEZ;B}(s|4xaZtWLcvDM#(D<1!H>yj6Dhe7oy_=rW*&$GIrGq>8@`WwH$W zFqKdl9Li~@>j(wK4MWTaqCUdLX@=Po151BZzs^x5OabI3f(*BB79Na7;knw00c|CK#1(1Edh=h zx~#uvR}4gbQ28epZ+#P51txWCJuPfJqLaGzQqEvm2Ek_~hNhyM~f(1a_2@An4EZ;7B zg)`z1n3vSOo1+UC8%8oiaN4^IPGkdc7V}}x5}ZgezNDo~birFR7;T=(85rMnY`PIo z8XCLp+4taouws}ai85O@Z-D8g8;)+(jk#qXVa267eF7tc%|%pX^p12v9xNUHAy-i^ zbrA7U8=!|!Q@}niCb3~h^sWOAImU#)evXI&r>mH{fFpn|X704h$pNzsn~Y z19uaRVT9tAQ{@(cq1#DsG+1M$fea(CxJoLA^iD_{h(=E3qSIAIy@sY3<*<3VWQl{9cH;EinYq2l*qNu;mQ?#Rmr!j+hyf$I@K#Mc8Vh6;w_iWdkR-` zabd6l)*f-ukmv=wz0Q1DzzS+&vMSS4mUBG~E=*be1%Sw)?9jIsFr|xcOoh0LO@%|# zQlmNOO0`(!?dStAmuXc%jA1Fs0m&o4k3R`JoU@By;qzkl?^UrqOCDauq85|(HB6Bv z#{`Ivnt%ea?SPrjKLVn?mMjKDRcTNZ5U$x@sRKiziDYE6x+S;_xaw+IK{4DQGP4;B zAUOL<-Pz|&xE5a&C_>br8}fnhsYyUB0JX9&*Pnfktbq>47fgr3NN9CHb#TYr^nis? zAWarJ6;}a-3rm1%0IEwyM$NO&RM&5+9|NwQNTw>FhmcHdYx3~==H$K&lHX{UT@r## zB-t7*sv4Y!05B^`dgp)|3y7-S1oJwoeL4X51wO*JFe_RO0PKp^nSCbFqWVzh;Cx`9 zL*^58ewdJ=(k-xUtZPlii)OR8B|LCulDqK1Ql6gyUWuRi3K1G)_c-X4;*7H?6hD~l z{7kf@6@)D_t#_LcCG5FcQON>=_D4EtAN%=DUaaOYvjq{EJW={BavJx1AX&~M=A%gd zs6TnhKM_%EUZLOvCWiP#j`;{{JkLfY7Bc8zTRQ>&4*mk!5d6{ubb-u;-f_5L_f}d2LAWNnE~Qp@$z37A>s@JaU}1P^jgFr zyb^PUh?A9$JV?l>OWy@?bbj7{nK*PHdl!H5alA|7kC{Z$s9xgK! zT}klwE>y5*Q&)#>CGH(7eP5EkLo3CLmp(~AA)l=G;9@Su z;rKib$GJ$67%Qgrsq-k#nGmvF;`YkG?hh$2&fG9^0_*}2(EAAm)C)!AflsRRSqP_c zp;nUbdhcQx0pUIeM6~cOl0H?82=HY15R~$UO5f^6JksS7@kk>FDVhwQ+J2ur=~LhE zspt1eKx(MDw>c2R52@Hn5i1!E}kDHpxzeUD|(Bmd5`4K`8Om-Tee{ly|0MG%U zm_-!iauxlA4Al}m3PS1%A`BMpTO<-f)(D+_p^AR^74KX?JK>~EBOLx7x2UInR=2B% zkji0UazC}03g;EQrKGxC{5`UrE>!m?NZJ;({UJS0sAM1_6ke#XG6~{~Iq0RQuK4WOW#V-J)y;tRh>mNpZD5BHNTCx;&#dHwK)6>% z6hO(Lb&-#0kXnl5`ljz>#lUrkwHAk32<@X}3JFzpPpTZG7r^O}ybMp4AgLfdG!2Ro z2c6^)3S)!nhe%Q=g1|J2LtPOk(m^?opui}qSk^u6e4vSc4|9rugu0Q}MnR#e0u7RM zfY2vF$*6Hj4yK2vmnTw5atKYB3=t@g>I2b@pr&{dVwYesk*XBPjQsR z#1}Sa0k}%n5uj9%%9X`W0fJsi@nrf45^W4J6ODZ|$$GL@iV$Vg{H6_FoX?0GMxr#} zfkc-)ifDVWDTO#IA4uvGo=hS<@UXFh&FV1}UeFieLA^h44uZr3%}Yg-eL9us=2T(k zWX)KDpjw3^10K&H0zgQx2Fi7%6Ju@>XFgWL???lf;bZQf79#P*csxLY(tiYgOc~kI(GNS3S z@}$RI==R`NDNWhf?}0rd*o2^CWAgW8iu#$pyNnh>qWKQx0(uYC2wM?)+(5GCg0#zL$?CNcV%}N#tWl@D_G4re; zq9VyXcM!_hf;=$ z#N!KlZ1DNy`AHQRyeokq$4P06-rL#bAnmQRBZBm9L0V5*f=madljxlj^r&oD9Tm-0 z9m6IBzUaE>c~m##jw#SxL<#5*%y`_3;DIl9H*&#`^Q2|SpcidI`_4^7CKi_QnXL!A)gToewcWvpXP6_4Ej=gt$+sK-*#$P0M8f|6}VXBRZ{ zq!N{pFiHuC?qFEu#7x{&L9odQ07k+qC(+ow^RKcZAO$u=2Q!im57MJ3GY2}2|_2x)5(Wz zB?^?H$EJ}+dHawz6#>fP)jHBMgun+~3G?qAM zRTk;>LWQZE#0Zh=pwS76h#e&+15}=BP9;JS6J#2PKv}AK=a=_glNmUJ`38hp#sWkt985TnRf+6QgrQL4!g{pGzfJ)O266+o8 zS^2r*D773&*cFKBt%}%?A-Qm*isY&wKoVsDI?dWbtabDNvBwKoBX*1K8X}(D$f3*7 zjtsm}*x$<5*>cna!RE0Ah^>;&d2>X7SDQ(F1NIJRcMY}%b~#dx;K`(&N*`ids%ca% zJ9>4copz^aoX?_kzcxbl<&^B(CPc#Ag#jGOYNjf8P9o~5oCw6l> z-T_->#2voe05$@{nJYA4tivU+cEY3#CSkzKQpzIQ)5*PtZ z^9a2U2<~SI_?Y^nDF>ZjB!eC+_KfI7bVw?=pm#tRxPVUx@-_M>dh$m4_PEEAgKh$r zeKmxlzGVYrP-m~Zsq5;!D3n6N>^WheW~IkNWk#rRrcG-FF-VzL0DM(k~=!k5gD%( zrR-2i;zsN>w3I{9430cl-xm>BEO(H*HL*dUMNC_e{0L^fi%U7nVTY7c3SqJkF6ts^yLu0O zg$b%58Fx4!yDMMFWISTKCl)Qa{D5+L*Q13~u1Q8G#Y!r7=N@+)CE{&f%`YV+wmj;h z%JlRtLq%dpiDn_e-LwF|0E`IIRiK% z{Ok?Lm}Ft`jGR6?ykd07PGToPvOGvgi6Q0y8YT{fBSjh@xISUD3}%TEh;PbeRq;UK zc}GANO@kx&6m2K0%)9vFE}}M1rD%A;8-zMPyMt{) zGUn}42RASx{qrAs28jd>Atv5C70aDnmyid@8D3w~{1X&9`VJZ>wgA!cpgHv-FlUS& z2c?Q^B0f4VRn#eGF<8k2&qm7B&|qh1x)VZw!6?NHCC7|dfFK{EENDyTIwgl5#;A~h zIl!o^CbhAcZ2~ey>q>PJ^ci}TQ8H30dX?REU6v^`nR0X;7c?UQ z`z~3b0$oy%?l2Z1P%oHDb-LtK7a%wkPSg8bP#OE@I;b0E2{6*X1C^SrPuw^c4`r-J4w88I-d#|pj+#06lk-x09BLe3i zF?tMdvKEV|g3kbZyj^X|ZG9Rc!LZa^u}9$P-^>)GBLd5n5=%%NFb>yc(K!Ov2y&>0 zje&Z|;krf5gWF})9rVS~9s$F$B!bqk;>xk1v)?L&|NEeeC8qDuDVV$bm_A!RWQSu8Cf)K=vClD^_!Kg6F`ti=H;1KG9elUmhQxL2YOTz8-bI=4yiPfWuKBbHH zb-6xfbs~$Nnm8noE=0CpjUbQKSTmjM(^g_vog5vSJff9f-d_S6_`%u9&p#r?{mId- zrKmqSI_v>Se{ysi{pHZ;wttoLCr3X@V*cdla3SSSj*fUh$e$eDPRRI^quUD+e{yt( z3JHI5^kY)MpB(-8zsUEKqo0uC{p9G5Qo5fU4ZTh&+=q?6Yst}_^yf;WJA*4%+mift z7rk#JM?aZ7;wf28h|ZxKK;r%6=&nMGJ~_G@xiyocpU%GU(CjnxI_mu7=x2n$zglv1 zcN|Kg%Wzs3>{}=%jJ`mypB(+HlV#j;nPu6G%2ee+z`{eEGWO5+*T0L zHam-+rNGxWz|GEzmLH2LzYe-7(Fx3siwX^^l>S5~yDUsyk3iP4ij{)VBil3{baC^Fjn_kw85S z)MC@T`wb{Zw?K6Rs?ap=0#K8uBxQBQXPjx?arzvSl=T!o>zU^5rq8&ftS9j~0`;d) zds0>xd^R=BTT7qMBxQBR=TOtUFX^*=QdTE?-Zafiq0i!#ipvR_X`D^r!twD1Ny;5K<3=*7OQ(1YEtLS9OGTfV}ntP^5%Lf2;^qjPwDj zngR%SN@}M|w?T$*#h>*fT1_9T9X? zi)kbok{q80=+s_#76#Hq6(g`-OZSrU!MHY0fhI_R5(fKkXdsxVs#vi6<)G71NV8&Fc&zP{}AVl}ts@ z$|d`8HV>ImuTsfGE*D2-pR1ym$n^ddT=(&p3VT564@P+=b^5!q6kQDSqrrj^wZu$_ zWJ>7r)W3Mm@xqHrxm1*L(zwbcy#Ch`QXqEGmVGY3D53L#67CwEQc=D}{@l=}2Ca%N z2K&)ezPm`!G%rXm#4=fk*NsACp9{p(GA;gE4hqLEMjM65!?nT+G9CDTQG_{eGK&d1 zEdSRc(Caq;QUnTDxd_%uMF0o?zgL7if(ljiBG7Q44s#9Hq$*JYSK>u6Oz&sI!>Idi z3T1TMT@@KO_0#zQ@|P?|c)yQQ@&Ug5^ODUgmz5o4!O6J$Xj&hF`3Kg3{|}shYLn$= zSRB{qAD?a39XSE@{?8|%r^LuZe42pZU;;|Q?|*Opp?LcI1MtE52Z#sfA0Uty75P7! zf8hPE^AE+TH2;VsD#p}*GXEg-gYyp%C|RZX2MCnxpOoysnSbC_dH$i0`us!S1LIrH zKS2Mx`KPj1#ry-T`<8$H!3RoMY5oBMC0q*U-_1Yp0;^7+e<<7}IsXv&K>6hS1N7g_ zKft08`uu~Bf0=)PLphegsXX|N`3HC~=*1YMApi9uRLnn!_m?94W&S|`6k$1~Uug<7 z<{#kw^A832FBRc0^AF-ZIR5~VeXe5u+48sZkH}cgKO$o}{}5Q2{1x*LeB}J2YiU9? zlVRqA#JCu7NXiq6Pq38ogVFiJ^?mtxuiTR-dVPeBaA%Mc;toex*jG3rzq-k#nO064Myatq6NQ#~tE6xYvxX?N|MIs`mHqE!_18Rn{|kA< zlL&)||36p{hTZ1>bROyd3wcCg3DVU916p40Z3t0I!*Y z3y@rbOzb=dqm4#9#txOPgv^$kaDl~}CCA_$zdu2T`Wdh_~~-rVm1a6N$-#CrocHfAUMz+B)Z~>4VwG ztWstEf2ain3f@|$wuk=Y382A^ zQ&jgS0^uzZQ8$Xv!aNUrgP@BeeACVf-_6pOO!dIGvFct7$dg6u4`g1_GXW@XU^hr( z$uI4a@Y^Q+$hMD&w;TW-P%jmpdD1fpIHVemC*Ucjd$&X$ln7D4p8gONFvYqMERiB|3q}eO3gCBR?3q5*@+gE*8jm5h2wl{LpI_ z0r0pl3BR!fXA)Uph)Z?>cd76pB0)Wge2(ZHz_z1-9RJnk~#mn8hM z1O+3?JgG!He!1!O=bRZSID1AmKX8jwbHf-oDuxCvDR#}cq+DmkjC zjXshs&^Z!FQH_99DzPeRLhp!)vO>ruw@j)iBk@uhLc#Thz=h3mFwDlMQLe;aZ44Jo zup;nR>4~Eilr_ST!I{&*(aT^fN(GL>Xj@G=$6&Ag*dkNTX}G6h30)KM>Wg%=ow^nD zncgsw!Ax(co*>S}so^p+SQjs+SHaSV!iZoz3|9Hoqcoy3Qb&q~UW!=qcsb{lrd)k} z`TsogR*V^MVA6ka0)FxiSU_K(Jj9>GOih~RxC?~^Lmx3&w0Z(XYoEAp=3nB{#337+ zIo?!Sg(}v*Oq!f29pg%yHwC1_G9{7(yO}=e7L1KMOjy8+3#CjrU0 zmkeLcfI?6ZS(X+C)De)3+Y6A48*BK!Wq zl5uOmK8B1-hP!}9TedTx9tPCMfQAB+aVG8e1K%!l_CDzHW|=v z13GCymjJyjN>vU>n$|W!JSI!p%78i>P;Wr8zr1DOk_>2p0WCM6ZGdDwnxON^l-nE7 zvj)`9fU4H_m#Q5g86(PoUN)d&3@7PZZa}plB9pil24n@)Uet0TAPiHqg2(V(Zb0h+ zp|J4XZa^0R{X^jXM$*>}!_6=0qbug7kSchF754e9`7mr|8M94`G_(zd{tn{a=!XD?; z2mBfN$4URq!hiY${(P=?!*-yfgg)sv%1qvuRvY1MCPm3 z`erJ=2tNo{>{BU(#gnyI1Rp1Y@3BVSH@CWJjl5!x+=E>ZVR5legrKfNui8W&rIw4_ zWscl|RwAq?Yqu(j>lR{ z&GrncPvL?nf|@D%rxH2`!^DkJE>8ji<19ltnmTO-ez zTivoo-Y`e*g+4On=e1F|h#k1!icflX$J$ZNjyS4{=P@j5mgu$OsTK=i&r)t%J=Q1$ zLT2?5TTK())f*>L%2vgb8O}&vaiCv?N!x#iPG8P85XD>6*Ov2k=0Bp zC>k>Z4muvi+GmO6t!|qmdE`DEi4e=d>MZanMGkWYX4A zGGeyzSeplk*FS6-}Y0E+S;W8X~QlMY(&tbMPzr-!bZc>Kf{1*q{rl zMIJy`MCVBtA*t7^c@amHU6z2fSPJHGhFa7eqKR)%K580uFbfow$-(&nj_M8*xXCuu zo*D~g%WAC|-Kvf~T37^oqO@y8q^RuIZILZDFHaD3S#wjo6k zbVO#L^rkrk-c({(ct`excZ|pilHN3-z`L99&cz^>_{>_;n`R7nN6}YAj;f=xLZokz z^tB1!TvbP>)tA0B{t=gIZG*vX9W4epicPhEFHr$@Nzrx0pwNB2&1Dia^lhruCPFyF zRUI#1{2AeUU?Ly1Ar4pHyn{WDlsih{zfVeAU_`7!>oFEn-1?I5O@$=VOJ`Y60+#ib!vu1Lgn z*PoUs#k~mJ=dgBz!L|^X_^q%eFOm`$jhIq7B@3k_mRnh}QQ;3JC+y{mHgI~o{7sTh z@0>7MJY2%ADBd=Q%NqLEl=kAX&EF(}+q|UIJg6gSw=yl_fL@Wk7%lN=F|^T0II4TB z_{gHkL0@mxtV!Y{bE513u}`OrshtoXZ%dzo z;@m~SYRLdjCyZEaqzS987gOWHD;XzV| zlnx9lL4M+dHAZAifo2Lw1RVS#?52j2-PBMUtR$-YHig2|&s<5WgNKS^TH>^n1mjP7 zih>~5U#Nyp8wWQ9m3rc53sDa8gNsM*I9&5VT+32;hTG; z^Uo&isWA|{o|b|-s$(noV~SO8PhC<1*07QlmFb^-&eA( zhVimCTb1||UD*alPrkL+v#gV2xpI2BgFBvG#wYh|$@+g3#iy9-u%&Mo@@n%RXVcH! z;5Fud$htJ$!ZzM;uvs5QD8Jlzh)-MfE`M#7g}rm=V>WnH3;xeBU$FOwMDr_u{GvqH z%w##Gs&?7BnO~UDgSX*NbL$W5wWRzX*_5U;w1Db`{AwpBAGB*bKQOPHH|aQ%|9ohj zRyWSYUMN_iRDJt37Pz*D_HEa<_|eR|y#D4@Y{BBu+KYv2`NVg>P)a(iVu?Xll)_6F z*mqTrv&h$<<<)xS^D3{u#rt1)h#!8#$D(rrjFAGQA;izx5ScCYHk>pXsi$2zaDtitDcUGE*%HrBy^88n#tr41mDv}zIBk*srof5 zxw4EmUznzhT2O;)OJcO%ch0i77M+;onRNbZd02Eo0Vk5vujtL zQl1_%pS{2a^5pc9Z0HA5wXxHGVVU3eL zonJ}q&6mGFgMYb3VVxt+vyXbVV)MrjQ+|5E%2M8boV~g*gf~9hltmsr!zMg`LCgNE z7GK{np4X|}lqGGwqgk`NvpH@0YcpQ&!3s;iQI`MSi|t?5m$m7#kd1IQWtSHp;)i?% ziv96{tiCxyd1`Mzwqy1JZPob3{QFj&v~Sz);(c#VVgQA-Gg;4Oy}-V-B?lRL)ynt7g*DemMRmc%wT2r%Gs#l+jx%mjMll`dN!|C zu=eKa{e1hSEy`8%=d9!6C-`U4UHP#Uk7#|?{m72>>aE1RJAxg|JkE!$635CCC zZ!cQN8jX%)o%@urGr1pXyO)mQ`LAXvH^ zKetkwRAT_!cxi%maMu?8?8tjsSk;~UA1{B#XZ3rSjT!T;_UGa8{K%75cBQlt+miYl zZ+rSAE9UF8DFfX6>4NVSPqCXV$#`7bf<7I0`wyl0m|xj%C%@BDFLq!H&oHMYUyS4ASm-3nsWy-kl&OGJ&t=gyMGuix? z&C1jsC;83nE9~LIES^-Q35)%FDRZ89L%Fc04}a>bF?^COn4KN|1aFbogtsmn!k^7} zpTBTs8Gru0)hwxPUG|E)h##K*rP6O0W1kF2)3&~Mmxu3k@VhgMSlWo5+P>60@KT!d?nQlBa^2f(+&iJHUwIaf|NWlU_G(YobL|ZN z#rR>o#<{)9tJ}jli+ox$m)BuVcUT&gQvGmh)$VRx@X-TFm@h0Q=0@im%p2D`$TT za5`uAweS5*t+0e70R)`#9?4QD;Y z8?-*nFFf0gKXbGi`*3<3yEL;GD`>lcKXSPmU;EK$_DaJ8Y@6vb?eT%deDWg;l=J0% zc(b`9m7zax<*RZM*wp6jSV2rQd$@l~_VCJ)$~SA$*&D4Vv!3zYdH-5gW!{xv_=$V< z*s>GPa8=#RUl{!+i?8Nj7f$ZyKds%P^jLC;*S=cFR?m8$4I6un`4-=0?I*Wjr~5Bq ziN(j*ndZA#NwbA~a{H?MTAe3&tNPWLdbfkttmRF

T#4{!S{}gfxZ({m!g$Oxrc@ zG~2Ou7yG#PMpo~g2yJ-PzO1OQ6ystYyF2f^vTXiAw*Sr~EpFD&?4h7Yt!JGS?0*ih z!p;NOo0HFKV@~bj&)+jCpZ7k&8`XXpHYMVD=6W|P@7$GLxNuPW?ztuG(b6u;lB_U( zD149-y6!fAXmnF$VB=T0wZTdDiRWE@;?PB*Hsv%MFt?-j zLXR~5k?kAy$e1fEr{oDX>7hWr@%3Q7Vb%*QEaRN=$QTF!lQNXget4JNEU&>XHU5FAug_uO z4@a<0Ef(?VuD0ylug|j&+pl6BX4mH(YB%D4@-LJx-yF#kG8^-;C&sa^2WGPowGQz` z3qRtQtA5E|{UV698rPpG0b^LtHy`2UU#w%Hy|?nVF&`;kzH*aU{}`ntH!o%Vikh&# zZ@t6IR!(O>C*5XMKE9~+t2u|oJX1@_3|hwfsczn8RZZ@_K8R3CvN*o_kz&@X!)V^@sR-@Th!=Upv~QFy6Wg=NbHmvebDOgB`(D;s&uI(#&d|bs zck?L$6Zpfmr?W-zeU!Kbd->PDp3s)oi{tA@HexL&cVYb>e_g2s(^yFAG9&%SeBvF3&GpE~};$6s#1AMMnHk2t)H zzj&|(U;c4bo>Z;1GVat{e2e1;)@Rf@cKwNtY;BYFe88If%2N}4JiP16?C`h@UK84w zMI{ba@Y+u8T9X;9L-sIjSJ3xtUdBT#q4y!aw|j;X7~PcB`S6g|u4_K;5j~YGwhYz|nKD@4z5BF7v%0gAyA752u8a63ZsOaA z4CKR7-E3|81a@J>H+<2gIF_>f1^&vzIsB0)Onk)DxxDJ7Ylli!# z$N94UUvXQLZ?rGo>BpOYF+{6Avo8DC+)8=k!hP1Xb3NvIA(t=Pc8*ObTh7jC$5>Xu zF24NsNsYH&!2&m5R}z2h&D#8_@sXQKS=Fa|Yh!G7exqK0?T`I)_~mNrc+Ef7^51{+ zDRm>8vt@_3X~9zhdFRsJY{INJxuf(v+x&eZo6)<2()7FQZ1^`#v}WfXW+u-+l$EPC z@zvWM{ND4MnL2$Nvo(z8k1f2TocL%Yi}HQRr(QY3X8izWlWzvQIR66MkhXxmkn7_c zSKGM#bP{t`E9aZc(QNFkeQa~+e15F)H5NU;zxL;>cX<7MpDGc#A-r1sB=+T$sw^|) zLw=&Ii8YG)ShF{+&0akFw6c485^LZ16gxg5molSdX@&P!^62SB?B*+dSo0PgH08|`{D&b!*u5|ZYn<~qcR0th zxfhc8qr)F&KiMwu7@RZCkFKsc&%e*Ue&QMBlUJwkkY=Zqul9b(-}<4DubaJ;eds-{ z)IQdiPyDQv^4i$l?7NARm9O_c&vtHmL3t)Bn$3S=yt3_f5?70gv?U4q*ykg;GPlhe zEGMZSPb~O?FVlX~dephjS{_f(9zJSjd9^2L(|T;vpEs=V>jAy(zi8$A443_G6Jgf&U4&7udy@@;n-@sH}KvQD-IY`EhS zrSV-eYw2smHXhu;r zzW0Y8c&hI%TVFnp-D>D!)3e{?RraUyZ|bgMEdDJ%IXFn^G%cKGXN_Qw{GQG_#>Qv| zI$vUsy?ayZur`RTX;Z?Nn7?K3S`YJ=Vyp1kug7b@Pn^g0ME*m|=o!Tabgs*<*1yi* zs~w~z9lg$%HdC~hrd(yWa&GaiAyatXmuYNSU4^~>#yf1#Kd11vER`*O;xY^V>MP~> z*D`shK22CJ(-X{d`b%7$|A5!Iyph%1_axuo+oXIOx|aXy_)WRJ>Nsn%x|4P^xPNEBN6PCtrInO04hdd=LjCYJ%uB}{kg1y$ekiDGW zkA3Obp?uY@kXt$9)sklLUzGRRf)|eQ!LIQ zOM9sayYg-nzgMkUSWezON$KazyXQ?M=Ix%me)t>O{Lgdw@Ka}a+P7`lvhSN{k4*{Sbxt-?3V!L& zr%WqWY9AWKr*)mCH3OfZ(+CHDzc7@)YL4cOYc*$U2lrK?ZpX9qdC{y_*X#V_-SNC> zwO0JK&MzpR9RhD_<5RrJv6?J0`j%EN)y8W#v9Wgj3R%0rwn{Tk3QzsH5v#X+4!b#U zqc$~XET4HSo^_jif!BVxP_sNygMa<`9BonC9M|o>ldIWx%T%A2H%rK4+ktzj165Pk8rn=BgXYwxmDDEhisU zj@%#0zIW~6sXMl^cBgCd@TG6F;OhO^ietywx`s@9c)>lsVBcwF-Mo0#a#;fVzUFc6 zu9dB|@7sx)C%mI{KU$5yHN3HsuzEbJZi;7NgQl_GpElt6_RY*!^K0eM%|}@9xuI<7 z2aoc@FEwMYy*h*q?{|Q`1Y7#AoS3PM&N#!uS`=xmTPCve#cwNvUU-k~x8LMXd^nL? z%-dOaTTi~hy+#}M&J^DL`~Libbq(K>^gTOqqcdxI1AM8IPQENCUi&ol09&H%Ql3im zuzwbHXMt}v*B+B|aO4fgYd z(d^i$`|Pu)*K47lwqs3l7ASvS?Z)263u!MeU(Ne|v`LHZvWFetH%oc*?Yiu#51&yQ zluhM7@)j)nQZLMj)%ks2NB)rYs1i`fc+{u`%BdNx`9=GW{La^B*y-&%q%Hb1(kjD7pVRDO2ulPu$@Y^D6} zlk8B9k;)^vud{_MZ)mHFUgUNDY{c&mYRVHIoy1p<9m($2iQxzH=kxmq%2`I_3TARl z<86+m^P%%Xlo~T9@|dbc{PrC$v()dQT-~3=w;ugjSr{;ZEgZU*o$vVrKfd8KYt*O} z-;){3p59o-qt_|?rD?aESJLESHu&wt6`g|Xdv zz3Lw_+rwv++@p8c|3lGvICA;6QT*I#s#G+zsEmdvLWG8v`Xxz43Q?jOVGmO})rU-gaq76~^&D6YOBGJ}ARK-(RbFLw#C|uzqRt`mwq@bx4D8pA<22S1L zq-?@@!?*{OvCM&e7|&?@aaDS#rc4eKFF^jpLi%ETiXE;x zS744e@h>Qnc4r+6`bgT#lLnkop|@{S*~bxW)E}%t$F{8?z2mpJGwp(>Uo(jrq@mX< zA7={6ggfmlcNUkWskuinT6l-5I=-`}NAXl3)4=V7IqFUAPtv&LhbNBf`8l&vy09!5 z?$#7*Toqsf%jr1Lg6G!Kh;nFKe=sJrZGTk_OA(vMk z4TQyPV#eP37+5KdG1BWXQ!$B4p06g0VS}mOXfUj_Jo#d&=@@$WHH)-7NkcLx@FP>= z=ERfoM-sZ&x`Dj>uhAVa-pgh%U@X5Xd zqyBKd^;nT~KCRFC2D zM1PuGrY}Dk@e$pOxxE;1qyfBt_mj{T7H=(m`tLr;oDh_i$7gFR7(AaduhfiJ)H45 zK||AyG2{O%F{*Jp?^y07+-LPX(8Y!Vs)%`Huc8mm>R=K{Pz<@m{u=4wMN2$8zfS{y zdgPg6=LV8$*@GP$S7AbtJq%|Ge$oB)l=p2qt*H0s?_M3js>$EU=Ar?jn#}kczbgpO z?&LXRy-4;zGOj!P#2~w1CL8@8F;gX2n$jAWDNN&kAO67Zh;t}1drCjg{-aU$RjVmW+-aW|ilz!f0qY zKP&7(iRwvQ<&QVsJgmaS%)R)?|AK-#XhM!2hAdD=&cwUC<}S$S##r2X*hP!V^T>FO zHf$x8@w=x6vE*EaUSkwZ$ZwbGPX<3hlU6?xkt_w+GOiNKA(#r z)@o0)##$pWQJF7LUrT*inPe96iSG7%Vok#Ct*5EZ(-vpK`K2DR+W(QxsP}lbT!X$% zOJGVL8c??X8;xDkOwnr3nNPzYQhm7(Yuo%OzNQD@lCXB#j@ z){2k+_8dAtYN%UN4(G?5r>l!6L7~lpiwO5?)x-`qvnH9sU(V+eBcIT(8S31BbObu? z4dM~G+K4$hkYociD5T>9Towdi+JGK%HY>2@rWv(?y2K1S856R-)#1NejYYdbfO}s6xla#@^`}ia_aLz^ky!>M=2|= z9~TKNwG>DciPG6mc?il4r^<&TI4evh6`zC5JlzyY8GbNNJqU%ZZ|PLOExGv`@j<_J zX`}K?Rx{ueEIm@8ueB9AQzO`mgc{nu{wxBf-=lcRb8KNqI?ifup!YK^1)XjmY5&zj zQqw#(*eHWW?~UZAD-G#xrZ1aW7e%#u`&he!JC+Qw#1fl&y0mBnOtnAJrpkU8yp6-( z+UM-BD}!vJ3#LV8ljc5U3Ys$xwgn1IbFDFszc3^ZKS5)cPDSn6Jc!i2h1ZI&NZpdg zkA>bv<}rD;>ed+a^xb1~7S`j-&AFJ+YKH~E=b71{R=mG&%a=>)W7h9-s&l=JXiX^? zxocyU{6^L|I0pynuF^uMCG;}%0qUm*6Tj2V>Qn16!}b=xqhJ7Ai}ft)=TXWM(}652 z#>lit`XlI)H=DK#C{GquszkGMflKLH=X;Eca!1wKqip$VW4ySQ#zMC%Ak2Oc%@k>; zYU-ssOIFj`-}ie!BW`6;)T{)$e0?(S zIJm4rMZ&d_%w&K-YzHSr{_rat}8E{Hjb7v8jc$G{Qwqf;UCCnV{K-H%#sit5ePgPS!ory1<9HouY zC-L;;NIBWAf6WT3?$eMFM|s@~ZJKWPocGx}qT%yE=CWuA)#h&E4nC9du&{{E`i0=z z!aJm+vJ7GS?3UQkid(B zG1Mddkn3G7rn1#*s8mu9qNBxGh2c6fDSJZ4yY^ArITw2F`i)MH&?4CyH@cLr%{xX+ zg)S_atdu+*W@fZw&sWO7rp2B_b)dLdlO&VpW2=4yo3rjMeucJR!hA!tpHSuXo^tf} zh#5QP?Sv%$gbn^~M0P1(S>Kclc=VX@O_?XL?%ragoP2;?YNz;tsb5grvWSh{xmF1O z+<@=MaTun$kj8BFN6HK>Y>IZKPhY;#5IundIZVQP)s5aEt66nT7Aj@dk-U2f9$Hr5 zP}^LZofFR$AB4kDD7W&ykqg%{D;jAymtI`ih}DaPo#oJDt|A|V@OMvPEkrG}d*4!v z_jlTpa-NMA+m3V6cD(JUB3-U-XO?mEsAuzNHYH^-X>xVceLapCMMp0Fa0fN4Q$gV` za}Sg?bjvexHMbar0ra_aU3KaT;ZrMX`pCAEcY1hJ^g> zv~O4od+u_P)+>wBf!lk@bf7d%`E`)i3Vm9OYr4rbypUh4NTcJL9!#NEjI8aauz6d4 zlFq6SQd={Kq$XWM`J^p4^J6WdEOKyOdn%7S@|UtxZXi^AG|KIl@fW@`$z;DWc}-eP zwUgg+o4sZv-73xf@R}~1uoLRz8_}{nmOo`>9$f+ipPl8yWn z{JORdHw$+NKEz1MUVaI;)&IgdGL4Lcl-`^rXtmk}OkOtw-KXZ! zhnX3){ZkQ>I4?#kGk(%7r{5TMz?R*<_lMTcYokpScc^OLS zyw5nSwol|==4eqm-m>W@f8tyJNS0|Z6n0W;s9T_zZU`<2U6=%Tr7`^q;YHo}DZFUQcoQU}srZ$$OS>~MES zKdCuR=TS8qX*Qco@=-AqwKJaUTwFy@V#KkpR~PxqRKU{3iEJ1tT$Z5?_HnRFiNox@ ziu6J3B}KLPa|Pxk{0>i%w(&ZhF+NI_ZKiZl<`|#oABDcRbGgr|ePms~fp3prh_`c; zap>-5n%+E_C00$u;yZ49nvW!Xe!LiFt1jc-92++N@h2)Q^rxP0atPKuho>54#64Hh zw4@H2TJs!syAG3gV-FfyK9bzKa-No2PWKg~`6tUmIBgk6pX(A4JyMxfd@rH?fm8UZ z8=+`^q{@x{n$cq6Lpdoa>2yOy7q0Wmuq3{mP*I3a*>l;N$c-3w=K@Kr%cZGWu}o4S z98(@W!nqs|G=G0V-*AA`mtBXpNi(_r3*r4OUQ}Q=n;Ge^ro!=B-1c85jT=!)KXf0$ zw4j)MPCOyZE5*=g@&?;-9|s=ILD!08cAy~~g{eoG%#Hh$I)5{nzK^HBVe3)M?J!tX z0q3oj(UO4iSY>O5<}>@4UAhjv_IS@a%eOEDCk=0^BP&!XfgXB=Gc1|AIq_|h3&*jN9Hl5GoV)8$o6MP@X5*S_Pe z4|VBs&qy?-4W!!HZE&i0C39nc&YiboO?x+YG(HK5*8!BO)Q`q(-E8H_KUA!*&V~*j zMwfTQp!!V``92xIPzpRu-pBlXcM1A>7t7e4fbZc8aDI>*X~%74)nbBf^kxuy9m_Fy za4~lg7u>OfnUwkQEM}!T^9(mrL4Ui0Kl*u?{LKYl@rJZ!O2K_+0EMhr!OqqF#bvh& zvO5t*jnm&SzuJ7^_a1-|7fQ%*b`B03c#^q@H^Ne~>DW0@I{qY`hVLmr@L)xJ*qqIp z#M4MGBMc%1nRL?O6SKV81in+A7G2LrsO|@7t-L^44n1%d&aj)OH{w=X(7`*iSaVhq zO3fVEimUr+_n;uIY&jiUm)Y|_Qn%<>buHW7`wj)k|8dQQ;;0|g${MSZP;}ruQ*LR8 z)WU0QVwx=?>~om;aeus(Ze#i#qfym4k;$))!^;O|T=}&>2}&0EIz{6~kT2OikfDMu z;av%IhVS=VY~W8n%2mqcd+r+0=YfLHBkaV1es|b6dnv5ct>UwHxWUzY4y8SQN=lw{ z;J9fhwJ5*gZATAa@anCs^|c#*jhxS&g}CFPDO>2j9}_8{aWwbXrAEFXEmE$MQMcd^;uFl- zecYg>FU8pvBf%qG)WiF>+L4N=316V_4pyB7?04uvBnbRdzVvfyG?ZtvwZ`I~O%uY* z#HhP7kiUuVppM=9`Hk3CgbVjoNJ}wImgr>zR{K!Oh$SrGegSM;4wGl!AB?GtrNwUE z^k>&YM0^axh5YG=(3(pjW*zK=h%s5LE@iR89F!AwghVGy!0D%EOx?;79f+e#IVa$| zFBI$kCBW4C2?EEf3FYn>Q{- z+Jr^Ky$2zxY9@U91G$`y(%5B^~pXqv}`i&Rga>t!Oie*J&udRp3?|}dpszkm?RElkaFc`tiAODDJ_>U z$zcI+ql} z7Sp^((VzwHIO`{g!9PDBvC)UR->Bg0@KSnw+=$)1b(?-`NV2r3*CaB!m|1B$(K)ZJ zeEI@ObOmptf2v}TiC@l@rA#P&vMfdW-^Zedp)e8P<^SS!p=d*dXf34EqFicDi-9H1D&bZo%ILT4jh5JpWuU}1fxcm(H8AyOxz(y zpN~eex7l%Y?Wz(q5+c#uVa<+?ABF|P#*x~@Hma6t=I-&AFtT|!E)A1IwB`L|4(Eq)UzgLlx4L{%<%=ROtWZf3_^PgAJM zA*vDfkJ9!*4D$PEVVgN$6=sgA8hz$6W+iQodPFb28A4uJPM9-};q-cC9`|QHETa0c zH{K8b8ho)d=06y&8B3)VqWESTLgq6}iC@>`H9k9WHs~&woREdtno{)8avhdsf22=| zax`PH1^arj1Nyed`O>g$m}(V)FMVqC?e!qK_@a)Y?$q)@UnP-#^rf)J`jY#qP;S}K zFR)S*_5bMPA}S-bLC$9l<6v6Bz$i6j60UUcDB0#uTolS$oq zDzvzU^G|Nk5Jx}Q3q`f9BbMg1@t{;T$ z*b~(7atBUVB=ftK7ip_iIGbT|7O{~IY?)m?e#*r|SHp`$i;TF>zidi%P~^}0fM>m- z)YkllLdsuaN{16xuQOt;JGWs@uNT`PE->45GC26=1s!$HBwYzvlq~H*;MTM7UF^qf zTC96lz<0p;cq_*-*S)bTGUMko@>*_5?^|&+{FAF zpHN+H9~qt+Md`tjG-2jc8e;Jue{5KXpN6KiPq~PGy}pV%|6p47L4!Z+Hl;MJt8D%U zRanhy6_E+pNFvgI5B)*pvL~WBqM)t92Gkz;MTZTIJDW6 zM$HzbJc*rHw(uQ~3_JprSCzCha4KE9=EZhJds5;A4{}!%&U>yno1{FP?j;v7zalZ( zB@v7dRtA`}^8(+2`IO&d#BG8N=)2u1zVYN-p_)>bo4gi9wre)5e4isBC!JReZzEkd zPp3mF7PM|Z(J(02ID8D4>iPw$c zm=E z^`h5gX7CZFCco)yxjn6_n+MTu11hLaL;dIBZ2j?cTC8v!doIbqV`w!0-Ej#z3(mu^ z%on3hAEwvNt#tkOUmDC{A8NtEy_%ba;e|7gFSdP8wv%M2-tNWCGR%y#E@m^ zX?(_Q+}4o3%?|E)cPMP!G*MIBNV|JpV~bcbWvnkp`{yXwj+{m=YsQf8@)j8Jd$`}~ zz~(RYqMz@&Xj$$Ty!yF|@A8eIAI14tIMNW)j_syd4XJRtC(XXz@FnN$VhGD4os@q_ zF-0LLb(zG}GX-9)vxNKTHerUmG|P0@fN2Y&`QxsIShOaPN5sCQT{dBq&r2yu;t$$H zi_sq133IKP)G>88iEa<4#!VmSrpE@9nU=7Q56N_GcK}mMTSuz<)4e%yGD+vQhrdi6Y9*fI?TodZxg{}kJv_yA3zd)bc1jX1O6G4FWiNmdGjdE7H) z{1e~CF0OHfPT)+o#72@bqaFD1?^f7QWkqh<#dKeEqharngB@ z^uhD&j_iqWjLMMSkJ#`)sjW<6Bs(F(sYHlOf2X>+Iq#6i-{W`sO&5YeZQElm<(kVnN~D5 z#f^3wHKJzO5f;)rkhY(%p&5U4spNAy4>b(M>RGLHX31gf{t7x$h}L}yvYd*Ll6&|kw;BPPoe^I600U0;kdfpu zh#6l%+=AciSm;+O>&R!v9%W(vqHc^8N*LV*4{Icsrr)WawEw&e65Knv|A-kBeKQiT zURvYN#2IW?fF@?H(u7mV3+hB9qJK%D;K&!8w7*RL>KRP?=qQRSiy7Ert(`b?F;dAa!My7KURZqJ`Wql3o^kOeESUQZG&p(JUXH#v29l-`VbSTcE9A zDDa|_&>}mOmv&x4ROAvYQ2IoN<{QwklrN|g$)$NWnu*Nza_%D^vJ|$us52 zs_XQ=s5e?bFB5c0JzJZF?N%h`@XzS@Blu_eX>@k= zM=IGkn$3PShps%SrFU+>=>7XF%6`yJ{fRf|sp@!KOuomng?;|@`a3jvNG^h^Y{*p5 z?KimTvhmX&fDPHnrCy1m@!KG%Nmby?&>FsaVJ!4MZ(&Z4a=>$~Swc@DnP0ol%?9kJ zJ7()>%}xVayVQesD=ov$pC@>C=x&;;R>rkrA^B-4 zJAUvY9LHtg#r1Re=%bb+7x1&`PBvF}D19JI=DK>r<|F)oX`cWO}j zSqaLTszRH#N?>iT6@8vlNKdL?QpM<4?DV!^3Qd~e!(Y(OoF(L(+s8NTRY&u^hwT1J z2P#X5rg;bMlABR90wYx^eE2{Ltv98>)0SMPWj2}5SxEb%S`oH_L)2fGUu+F{*R|7F zo~FxF-3n;b;u**{nM1)AsT76+3g!ptv*|5zul@t^F`sZ!*M&csIE++kUqZQZ6()c(EwgynF z!9Mip-(XW)nkZ!47Op)!7ol>pJS(J&8Y+!gqTrhp#YfR?+I=^omcc0`le&Q6r&IwbJEbfLg%yt zNO6BKwFN{_`DSVUWJCpaTAA^%(V_U9RfBWi=L&Q3IKFz4G>u$p#;0f$Aa(IymNE1v zVyrLGdP5)bsC&zD;ynZ(*%HbQ+Em@x2j~4~FjK;fdntd1_oe`NHeI5LYqK%vw>o8g z_{qfc8t7;7ZtOi+jEL_B7&k19uCR6#UedwgKNX~0>nH3ZLz#@yFc>ZqJU)S=c0Zy- zYyC%3#r8xVG+{NWKmFr}_ur*}Mf3TGR7tu*+AKV%6aRdTq4r-R=0B|?=@b>ZQsF{n zGIb>WH=PX-wWh0if9YC@HQDfdGFUtiX^GZsM_?Z<6TN}~r=#h}z^~|h%OD{$l@x9o zKr6VL_37S0;dBw&V0WIL-W=Sbx;D_??W<_#r?bc$Mr=q_8D4r7FylAR;rYe_wZV0mAfLeV z?W&+~*q^^mb;1r+UFLZ02gH_UkkS%i4zPGcpI@eu!l3h%xU-UeWd~vEg3Hu!M3PHc zmqMaDgnYjag1he*roYSzt)A0qklkXe+%L>r2gf5|tP#(<`IWrxX`{M4l^QQqauKgg zIHqQ^DPq!eXZHrEYzifJX(3N?)rTa~&$3U=lQ6^aHpTWQ(3*3vxJR!H^bA^AP2*Ua zU7SQa*R@f>_)oOI;3>%pl^Ctpw8(asG3>q!K>fEmgqu0jT8AiFzHI=F3z$y3-w1Pm z(;j}SI|gQdj_}w|Q>bQuCQEp=32qHzXtIkloQDUoyYoJiO<@*~9&iZy>nouco=TF> zT=~YU8899Fh>Zx!hedlB4gbCxTLPUa(f19sy`JIbXAekwx^Roa1=#zwf))+CL<(`W zbnM4@6ueg9O279Y>hC6mttz9tj;UB>kcFAR(QE3{zjEml>JMl<41BZwCu;xi; zsA`2b<~kpxbgKmjHnqiSl_nCs>_n-nCL-GSB^C;Kfi@{i9E>Q1)#VeIvF`(SJd{Z5 z?h^0ROsCoziCiO6nT$k;4%R-ToQVy5w8>UlJ*9w;9}`SnuAKH2@1$X`#8}O|%h-2% zCbLw|qu>Sk{K2B(v`?X#6%H1odp^r}Z9@XNE&j^tzopZRhn4(Sb`Ktn+`v4yGJNz& z!mzpm(mk;jvG2?%BCdex1_-4HyOmg?X*k}U{Eu$TT7YX~CbMH5%4jXVL!rl>kbLeV zSY+tnR?sn`=mj)o))@YF$9ilDc+aI}i)qWSL9m})NI&*lLUZw4IA)Gwia(DajMdQ9 z=p6Kp@?zR^-Dz1(AN{A22{qG`^mRiXo$@%r#))T>;v(UB2hBio&u}htZYtVWq|#x# zMQD4J%8Y-<&?DtP6lj!5Nn$f8@U0Ebe{?}`VFXo{2C&ihs*yC!m`LUxoIl=Vg&)mn z)!+y8Wcg-Ni4ViYNp7UkmCnbmIE9)1Is9MQASyiU#}pD9>55G@Li=K&>Ni2)ne-5p zzmH$KHi+6Tyu$Izr^zHNpAT6Pi~j4;)V^MwB$q5C`8sp_xIcnkl~h1tW;d5w`xSos zr?T|JLO-(85#~L(p8`B?vc1dCVWZp^YWvbaC2u@LwRD--vokZd% zU7m6^2TdQp@Xik_ktycPHb!dTklR>9?%7Pr?K}AuzqhcbSU&UF8(fq(U_Ei}h_Jju z6I4G?$oPwx8yrouPTa>c{T6casG!?^P4vdO04*Id_@_FA9Cy#BaV6oDekzqF3=m<# zo?EGZ%yqU(dlD}08-u%#v`HgFi|kgbQ-Qb#1q+y^)cpDT%!o@ zXrv9A!{CcZv$f#fc7X2QYGeLK1%GV33FTiEvdHF| zLY6%Pn{IAKTHrCn#0;TvWgl@RqZ1LXSunbi%)^Cz!2_da_HmIbO`Tu@8TS)(dr&Zs z8sSM1&!*z$j#C&SGnGZk^+80blTe)l&EzlaRm%WqW}o724~J2a;|Y2oTY|3>-(kc0 zy^!$rpi3`S;GCg5{~KLMZ!Y>FbYTq1f8U02O5p-`6+$wX?~?nSsZ7C2iryV0fr1wp8Z-+Yz72Hj!7Mst<;`QfCt&Bwxfs^jMwx0t=Gl56!zts-Xujj~b~-%vHXq!(9)JH!BDJl933r{KC*RveLf;< zu@Ai&ZiRg5G9<+QqVZqvv5@y!_!Do*qR;-Jc`m_h&))^mUO9zNOn-)BL*Da6`wWrU za)tWW%EBpUInG(AQJr}-SJF|#E3LycueF!f4w}Y1!rRDp+84NH>ySvyPrm$iB29gl zMiYwq@z1Uch3=X-@MH(69&UrYYZn!1Oh=yJHT@^Bu(zd}_{=5$AgkC*0?~vUmD`zO z`44nWH|9S!6;Y-5RbILC1XWv&=4TVz5m)3%7jomNEi{+CwV91}ooGHlq!Z&`r1I2~ z@j?c=ic1flO}OsLZ%jNyksAteHFP+_eb=*h>iw9%#|L|B^6@WDpR1)$fTW-^kcIz#7)vkR>0Gh7ja_VV>V;%dT4%A z6`(etz*1c%^5P{*?%F-V%k|Wr0-Y6Hb>R7Ez>2Gw-j8z|WC$V6NhY z^xF>bHwvYN&YPIOOgmjxT+UikW^A3(@Spv!qvvon#Bk3YvI_AJ0L6g zCg$#l#^3a@l=I;opS5@-y3U_NWBn^iES4e1JD+KzojjZKTa3mU342(AC_0^8FtJ$& zl^sDe@UR92jA`e^WBRB^{5S1%Y)9t6bn5=GfaKawQ;b6l8Rkrq}rX$%tKFSC8wHtC(cyemGuC=cmgzLjJla z4*L}0W5yL`_sonmwOcSKb}xnJM`6c|2NdKZ$7*&y0*l>5V*?V9m*2-N*82##nlAcm z=0(}Q&*3_uE4%*F% zLDGpF4#^snvvV>nKhp>IMJL&nuw+Ub@rU|1UBkwFF`igxL~=8gm~Ck+Bp=RzSK39q zsv3x!Un-!tU@uuJX4Cr2k922h9}I46p(Ao>*r;E{Hf}m6aP*Zd#pF5tHvhvCoeoe; z)+2b`bAd58Bj1iSH0}2VIvcr1m@CD3b%_IlKDv;aXcuDqL*Txlki-srpl$CN_4m)? z2d*5U!^$UEiScW?R9sDyHusR&Z(p`Duv4P)<>x(HWcQ z>K+-`2>HC_wc#jAWPE6(38L9la*t>vsqh-Mr+qtW*a0doU@#wWp2@1u#rH4Q=yu;5 z%F-VO%e9^Oa4VQPWSr>ZArt=Oxd?3KB&q186IpKE$v!RGL)OoOc%Al6e4D7nRQ)Dn zx5zdg_wG9yn@_<;(5aN-+A#C+a{PBo(3&l+NaI}`i)-m88T;|HeUkzv6&kZ`|H4qL zu?pvh>SKdw3hRHq4&&`Mk_XGf@RK^sSS*14)jeXP^pdgp))u~K=Uh^h%;A$>j)FvE z1^+9sJUfNVfB17b3hi+bT(h@_bNCu6T;k6aM~l-W(|1$l`My1|#roFq?G81}ml*vsRVMlzy_8 zzsh|~G22gbwOQ?`U?n^*Ne1V-6q&5b0UFhrNA=f_(w&rIzDiRMvp#B|EOHUuw=%;h zp{q)2=sNN~(M^h-d$97}C=xA~f=Ie6em1{nZqH4GEM+mv@f3Vl>oVd0Q4#BMC7H#f zpA;RL4cSBfDApZBavDJh8!qIfH#bwSUnR>DxM0(o|7hjkK&aTOVEgzD_$7Oo-`cg2 zCgu)iCv;@-Z@Cm-)_R+6j(N+Mr1)duiGeV1Xu*LSvv9#^2rZi=c(U>SwBGz7A?OhW zt$x65^-oaC)fVPw{DaCywz7x=vUGRXd)&Pxjz@OG*q9}5!t8mMqTSr+VvZqS-Lao0 zIt-`!_X{XiVE-#qf{LldOb`-(2GQu?&I66Rq6A+zw9h|qbXnvS~MoWnf;`y_)sCgHH>GC zdQ3@s4zT2reUxT0giqF5L88+K&|ga}Op*#@cY;J=;abXaOeB$I&iUbmMUYfk1sAo! zIIkOshA%y2^Q4X?t@wb*Oj)|H`!rn@_E2|4D||Qm%rzWt(5fR{>~haS@|Zb>{oL>i z#w*7$^M*CFUUwPg)qfTI6k|#fx&s`JeBkfohm+R>ADCBWW7oWG5Smh`PW&xTTCtz% z8w^OkwhFiEL%8%Kaok8B&O}YksV3P3w_Z2W^HZwuw5TQjoUi=s!IR{e(8`r-#*)_9 z1Zp^tgR!5d@u#DcQO{2?znOaxqW_92+P+|6r8jTaJciqOX4EtK4@rhDCect)7@SQb zm(F5L`cQ?%LhkCKpj9_bHzGsDckI*RF?dt$F6_I)dAMWCz0A(gfyJ_v<|=q&{i{&( zR}Lj6d)P@~Cv2@B!fcfbNLyncb{=X&O^G>Mlg+R-d}j4-ISjM=$+;V^aSR z+VpZV^Bv#-xogw#b=wbme7l6ghSUjjo-%S{0;yTz9_>A^N_$36X8#JK@w9p%sXn|& zZV@-Qv8Ot%chMm+joFwu+ntQ#e&bE_DpbY~rVp?4xSm-Q!zn0*^kmiz=JNV45t7cLmF6gve4HIe3`< z?iq@&?&5S~N)i4iTi2DQPRjp=6rJo{nlB7m+lTYZR3mTZYlb4{sNX= z-z{j}kMO}UiDt;T@WPcFAbspTUpx5*JrFXWtDpD7#_&2DQ#cc^b)K+EZQF3EdIYq# zRnc(6`{dDdln%WJV9s}SN$<>Ed?Mvd;^03H{p%*`cu(&LM ze7gHEAYKe3|77C)5DwYG31sr}Ber>{(zpjwxX@6+{(SpOO)I7Ood)85)enk`>G7s;nL9{}iDwihb<-#8+@} zD`!)98x1;noVL}yrN~i_v87`T{IU%B+@H5l`JsXwA|p_0?Swcz4SF_66?%!CbbS0( z3KaTkB3;9T{D%de@O0+xC}$UaYF|7ARZ^UqJn`Z1X@tv9moa{BboR|3u5N1<(-j;F&% z;DGLT=6+BMIE^Rh{0#5v@hy+?k%Hn7}YN7cba!t-<@gV5zTdj35H|8B>b zIfZ7%8Kap>}EJp7i z#$sQK7RgNS67Dqzx_QEYm86Jb*0?j==12pcTbw4JM{yJw{f*t?JzNqs`5^tJvR)@!hemi*el_F8vC=hPzBwyg?cT2>UhNgrdpmAGa~K4mS=#JZ)W zNK7f?DQo3$X7X!($vqFETMZHS!kQGS%Gvkd>X4H8Lc@-)!WVaQe#LPtY5sL!P4kyh z)b<$m=}i;Kx?I4*p$fvz_?y{UMPuzgTdp=xolMh0n23uT{Tj5D9qQE~et9F)7d}d$ z*=EWtJ~p9MbspbyDT-W6WtsTsEc$QkT4WEmhSGcw8sA<)`mG*huU|qsdY1IOx{v0( zErCx!5otCBvhTYJ5V%H$?=Kij83q-!anC7q@4tf?W3)+P?I9s=zn-qPkEP(*aaiO! z1qSK9^wrgmlFO~A>*ymS#Joi1k@=XqUzZ~5GMJe2I8@E-A^x#}?nf8E=h1u|D?32W zDVu3nxhtEWAmmk7`?6CX7Es2vb6okl9%P(;lf#30(mE}T({pd(&>n3*v?>IVq6aC@ zMh`V!M<~r;J6`lwakJcq_S%qM=-uMEanTTqdd{V&1k3ccv6!{Hsc?>vRXJEsx)aLK_-+?Twoig+%VKg9 zO=FW}lgatRbEbIf5k|+&L5yYrO_?+a$D_ZZZ~rdRX>_GUPGnrmdfH4sheff%Zo1Os93J^bJg zHZAqS@=yP$^x;y3PcdYQLWbSA^8fqu8uFO_ovG?>puXe?8kjDJZ&7C4Eae{xRvObM zTP5tAT7ktmhiLA%p@>iULlX|1rpAn!coJ>Se_L1MvB?fRGv7(JZNs_RaiO1vS(8%G z02CcNM(0Mn$H*9gL+TUSnR<_r?WI7<7+H)dIJ1FDLQ2On7nslG4;J*<@e1pKZ z4~v#%4R-bTImVPtRIS9|k0a=8mnKFCeq#6i$5i!rB{hvYFBHW;qcaKfXz3DLHah+d zl_qO2lQlk+;p2}~v56FvsYaspH_7GQFIuDDf~#$3nbxuvtm=EmW@lceX)hcQ81xUu z)(6;Jp>OV&pd*@xHItT^kdX+g5j@0^Y}&kjx*>6h%=XPBr_rxjmUB7Pe>lNS_O?=_ z-2{@2v7>FRwWRy)2<#<(anY7Zn09|KAMm&n@2{xw+1jfpuGJo{S;wjEd?_tFu8JCu zGQOci@Qx;2(1i2-wGp@@?<^=!I?)h2#mj=6^!x z*=|?7d~64`yn!&BrO0J=U!W2D3xrObX6j%4fZee>g!3Yf?4bU6NL45<|%6MVhbJ7xg`#^=S$g5T*k&h#AMm>#h{$7ga(iu=zRiT)JTS-*$ z9W73p0{iH0I33@2k z)4Po)6F!oph`{@sHQ;j4bAI6Vc>ERau(V?%D2?yt3kNQP`7Hasm4V_hz zeC6ElRC8AbL;nt;-Sf6n$IIPxuqlB_XBAOi_bNI%CL6x1o>Q<$2stjeED3w{SUlBvOVVsV)1I>mSt5~?7cA&xC*=7fXL-_b9?Evy z{6KSF)UwphDEckv8AqN0gUnv?lPA*Q{-c|MBdf_+ZY=k2dxBxZa)qSU7fh8G1x_uY zM!gCy@4KDWzb|7pvYTkcpj_%q(V@rjN-RAnhz>qF%iR;DA@W~8e=9o*xsxRstqdkR z4=21Z>%p1ROS$~2!MJ>+4ma1jAy;5RoV3hIXM_R^OuY)FpvM?3wA~C}AkDNFS&@C7 zJ`3OW3;we%vLw+yyeL=U`#smA;jSr?hx9@^SsSwxq;O>CMsmtMOW8>U{Jp&fvfSRG z=b9>1@0wB3ux+HF7{k3IUeKauJE*?iO8*eah8f>Sz^S>+{OE6N&PiZF+Y5l9HjuJN zMs1TS`}5~JolaIGnQpYn}q7D}9upkxA_f1UBM~m%u%BG0~ztEV29# z744CDQYg(F-*iE8bsblq)lBQ|+w+TJ#`MPE6uo;^3Gd1N+-uN39NRBJQ{MiEb#)7Q zOU4qcNO;Uu?dwQ%uRd+K{T&x1O-S*pD=v9_VmjTM@K5OjwXd5FJE8><_#A7iFCHfJe0PUZ{&@t z@l@3c_C}+D{G3C{p(qzdH`MsxP+f>e3VW;NHh2yCAA9cs6;;wKj#tA-P;@Y7Ma3L& z0N1$6=nR5_8Ff`eKroRcsHi9k>Rd<6dDS)T8rD@;*PH+oDk4EK?J8yvbHsG(Uw!Y) z0P22k-#hR9KL6)@_t2M`?y9~Ws=KSJyQ_P!Jri1Clusvo9CZMWP0``}@p-VXtuJ#p za|k#6Jf1ZlJ_RcJS%?dk`rw4`Xie2`B+Lt~CGKDR4)U+GfP%A&v8_)fcyVh3oLo*t5|+vD_GdPuehtv6SSSt4{x6$Ui7Vi6UNoUaK{I@{@yCgs%8V>4I?n^ z;!HSsbuC6t8!Dc@d>y;re8)aT?!ny4Bk}I^H+UebKiMv}f~PgVXO9QWz?g-Cn7a8U z>78D~%2Acz&x`ADjJ662*Y@D^ey4Ey#4Jp(T7gITUWp%e0ot|{Ck`8hQQzfa-6^9m zwaYJ%>pUB?7TG}6?<}F2^0Mgks5uRI`}gp5gsk5B8G0> z0y*tE;nau>1aK&s@VNhAm*_!2%`CX_ad>*Gq+FYokQRG0DI*KVxXfdRWu9 zk?4{A5ZYZikG~FEgpKZmvz>RIgX_C}OxI739VWgN=UGSL@7o2@{p~z>L}Pfzs&BEm zOB-DG$^z=PZNo;L?F+Gs(!pXxN$fUTjlR8xWA^qs=s2?*hAf*dhW6VA{Z4lm3)+XF z)shzc&l~JRali!PQuw>kaYN(bMc|N;LM~ZH05xX|U_U0P+3D z7C7>U5ccWF8l0cK2G`O)rB?ffu!oYy&bhGq9<9mLstWJ_s?OAO zPP^x%6QDkE6Fr)hWnRxUaCYB2RA0P^)^%30uI+olj^y^3K=x{fuYCpg)7wD%s@=t2 z$;nX8JVjjlQv}4%d&@$-+hV)NrP$0HvvA^uAU3J#QLk$He8%AQqUeWm5u6=CkJO$}k`-s`LrE%DkI&972`#5!4M|8qW?3nOK zT-}=XSvGtHiHG0Q`Po+B*RMDJcJ6y|kz;F2%|8atCttz9rdeY3W8>lQgO$*^_c|Do zw3fZUGXW;Gz76}!x&d96Dps1c3L94)fi2IrgM&+Y{F zc*mOd=&g8)(YaT}?qPkv$EL05lsyU;|LMz4``N>)3>&fJMQ6B5>unde=HitKqz`{T zi|hbT6&daSUSjXczB_RS2SkFH|LanyzTqL9o%IK#`+zuUl{f6`*d2uYy^wkfFi6Q6QbRE1WSF?9!D+DnI6)k< z#gp>#6JF>Z2pe{sfM)C&OgOkxEbZrkk0(FJ+=YiRWmpcR)@}^xDW##}tzo!h)d_f; zJ_S1Ne%v`~%{ZI`Cwfl7|p zKkNc_AA6Z~TG$j7x5|rmDt9Eya@k^YtMfSEN~QFuiC=)U-#j=Zej4ts#-x2dZRe|5ZT>v#`foa z$CRPY5D~rxe_lS4P4T~t<5s_7V^VA(Y0y20wipPj?7YR8=UHTrX*K@5vLf!!sf6#V zEXT2)wc+irWWV=VDjE@$a%N~N`{VLXQnCO$=n{`Y|#iqF8wTaxbO)&Ue>}e zUqDs!voImL66Wh$vQy3L;$FwX)BJb#$KWeFQsYdP$)ie^?nm4iV6_i4}RaLDTKVf3a4Yf zhZdilA>rh8$oeS>T1Sr(_f?n%TgGq2bG!67tI=NER{AWecP%EHKTTm`tEsHpx|VP! zJ67yp>Lm{EZ^>S3X5#lvE3)PNhT_o<@5QI%a%q27eKyu(40?|o&gQ38#*n2e+1(Kb z;F`)&oaL#<1FQ$Yy2a>QGY>B;UV>{k(=8sczoJEr@?xpbx6ts=Qku+x>p znE%jDtl4%gR<(J~wsbfKc5w;#_@_xY^yE-6QZ&aQyM4uI-yyg)tPE6KQUC>a%%Rt? zVCbIMjoA#kjq66!{m|i4Y26jYZq>Ts+ucjW=s6u=kt^+qXtWO39j3hs>RI?A;v;l) zI17J}X^-ixAH&aO4`RtJ$*?N;8ivi8gd<~bioeed!szM_ScnA z@u(xMudZNseiPyG#CSIKhl4n`PptT{-*yuupwpW_@b2$ntlg0yOg{Hmte9~e z7L}~W`merC_Tuzn8_Vw4aZn`e>97T6ufHhv-c%dT4+_INVRxYKvMBa@jyrCje--bi z_QXn_be^%tL&#}6MYL8Wz>7scvypq};HG#RHc2xTZVhP2J_K38sib)xUMGN@I)0G()!=j^E;p!LaH;ufEG*jcT?!w<?CC3*UpX1tHQWoYnpF{ZXm;cBaVy!*_0!>Mc&hl@lpa{;MlG~A8;oZ2UV?T0 zWibDB8LM*nHEwp;C_Z0!0kqTp0L{y>Fu#?X_@Q|js2sAH)&zQDh^vpdeeis&ljeg$ zV@oW5XoXl0!_a!c0nu@FeJB;CqIIjI`0(Wx*1@YXbZdA7B2`b}w@aDOVqFmaw6s2) zm~a5=`dQ$L;~mlWepd|q-UF&#e1sc)ZQ)e=g|MOW320O0d)VWb1RoaNL%$mUPh$?#$W0aL)WzQ9mJ(P5y ztruZOv4=Rd&k6_$?1Vvm*5Rl_7g?{_4WR>iqnph^$ox>79o;k^?=~wh#&*et>~~{C z-GcrY-(n{mIdlipE6stcS#*xA_d!wrzBbfyImKrEI2_idRTdAe&qCY7oj^=ifmgp{ z@I3Jau9&ibJzT#Y@B3b1F0-b<(Zx5JGc?5-4UaGv-4obx;sE&FzJybMdc|(<=m2Z; z=CVI%-@11B53F`TMVMc8qo^m_UW2PfgWaMM(D2|S>=bbyy*Hi0d6)jg-K)xD)y@+k zd+k*;Yu*t@_gpAC3H~@>_yal%NcW-aXSm%uhW6vFWA@<**pkjVz9xGlCAR-1b_)Ly zXSH6-dexoh7;UafanOSRSv3WjTJAA zX@lDrEyQ6{T0-TdU{-(qP&mE%omeII5S~}<61_Jz!KUN$*}#2|@meOsF=7+AU(z4f z!)>_!cre+LJ_qTJK4MzB557J2gBbF#C;t5XOQf;|8G?E2u3c=|>q z-2FNavz|YM(D#YxMQ85<+Bss}Z>z-d&7E*uo~`&|P&N$x={hqve~5k_L&RR+-G>r) zABe50+{CeM#<2?V41djh1Z|$L!GjUy(dyoIXxR){c=#`9;eH#>|L_WgJKb5qZ*8F4 zgg4@N^HSJ*!YR~E^uvYE|6;+(J@DppSC*Z!1$~b?pu>pm=s(0w9GCY8Ce_OmtKGB1 z8y`>6T&^pgCYgI?;86&D;w#>7bRX`VcM(%;Zow~AZ@^fs6VCgo3T)cn4Ql2@ifhvI zASrSR*)*PkmDBS=%Ss9>&`90oy(4a?!h^6!(IW_P5B_^*>wiZh0ai`Mt$%OAI8KX zZ?W00S~xqt6doSu$gr;tyY{IDu6NA9EX}l7;&b&vvaqOY-@)EGJlRMVkI~k(? zT8hzfUaXw@MR#~!gzdv*kWK5Sf$;8VYuOF zt%Py5=@`9aD}~v9xEZt&FZ9gA>i2Go8GgO7r^XWE z4h)B_HP>U=^<%JY#Zqi|${w7m{)PQKGZjW|+6-)CPqLTLp1C^4V&M4F;vI`wWb1P` zt{r{@s^?s1YrK!+L%Idewn_{>NpnEovVIsDVuQmXJYn#iTr409_CxMjhyzd27}tFo zyr;F^gjbW;Z0(<5x6FdYZK{NiHFWO($Wqww>uhv7Y(ci&1#$81-LPj&I?k-!2bTpj z$7yG8L5|xZXi2sWkGrIakFTwP(S-NuNFI(*mc?XWgk8H;f5>DbdhaRvz;0m}`jsbC49hRTz zj!iQLGRtYfFmdEvaqEk7@FH~LIH!5B?80%txALJx-m*l_nLlnpHj1DABi%lS`X(@#~{A+z**7~dk&U!cttGvGf>Y!d z>q6nYl?b}hkuZE`JT|>N1%ID09oO_+OzR@`nN3{vI1Js!COd&P(1-0g1A@7^Ec zsNHkGr9g>!vu)vZmr3Ha=!@9N=Nh{-L%?}^`(Vo&rQlU~0?XLpfvfi{#e?_EapUSx z_TY#f#-BZk*G9XbCcl$7tlBm_F4 zBXl@Vdgl#(xW62oN!hE1;Pw+xk@x|&WIn_C+lGjXvtHwFwKIGw9RUZnr?K$EOUPd6 zZ_t!%`VR~m3(oaCpmWv5_?N;Gmpu>1qZzs2=Xe^HExm;0y4kZ@qI_OTYRB{libe>5vVWM0Oe{KYhbOG?lVYbZJo)8WNtI_#1Whaaa`#_O>a z@D%Bvg91v?KJJCAqvdei^Ju78qZ;j5tVDZ51AD^R#Ct4d=VfT@@(R=T_kc~!JF&I( z0NdNl#Z>G0czx(SHnDmb92pgiF6m^~acXO3cKZ}G^T>c@%RMo(atn6mS1mTndH_f3 z=iuuT9dXN^8(251EUl5B#C!FYvx?eAxa;;hSiCz4t|yDEQJNDz81kNVq5Xgr7e9xs z+CCUv?g0)7H;4Tl@58M#18B{DJ??q&C;WEkFLt}*R%|onDvK(82X{9keL}*IIRCG{ zke`tbP0IevKJ=aelV6_^eY2`y-|SytrM)#4I822>*XQ86s}019i#lQFev8=!a|ZWk z{=la8n20$)GVDWkMs}@A$AeW>c*8uC-CKGTz341q<9-R~KB=GRU3MvqFJFV%Rl1Bd zDyQPy=gxT7IRSuW?3Rq&&5dCz>7KQ5JDaeQ+gHGD^g5hpYX|R7 z{(|x!C3OMPb5~|+mMRuO%LfJ}Z*vj*sbT^g*SWQfT*vfmw)Q06z5mpl` z+t0zwhmm3{$4(gi>quOCeJBj*Q$~Eyqy+q|pDOmJd#0v$=q#SA)f`)#n8@C>T93MU zBgD&@;qbt6t+-`*6AW$s2Ij`i!nm%fXn&jTW32H4Z_U1hZ(CduUz_iPppV^HTD6vV z{<}Arb;=&2>p6n+m9yADKTUk$PW{M(1Z?7v3OypLGR3W9XtC%nv>W(4O#JyCe(ZY& zb2bfQzwcjzFGlTV1*e|DjLzqnXzu{ct3=@Vjv}16bx@p?Kz9^)HOAYa`{2@pWpq!H zB|e$G7&`w_-#is&#|DdeQ8V%7(ci@9 zkDfuFsgJ})H`igv-di|n`%{?pVgYl?SP4tbBgCs4KVs`uTGG=a=DIg$70O@4VJF** z!#>o32B+Pb%eJ=|71;*wmMsSzXOCcS?rp?Z~#2%?YUbDtyTfpcK3!fKVy?NpPk~2+X{@ zOFS4f4%?MqiG8+o#PE3$?CA+d{HQx9OrZT7skKB8XJ6cy zKLy0ehoRfviY&TjJ$zovQuMl(jh6kEioL5x;o6^;i=C_dg?CDJU2HV!V1fJgQjP?7SgRNoPp_F1UXkS%lQE@|{&hi~NXT=!&FsrFJ zV73BJJzOM4FYiZth<;?Nt*e6D=(1wa3cw@x4nmUEPTamE1D;H;33=I5*!Q;sq3s3* zI~D4L&3pD>5t$|NnsrrNqd$dNeGZAeX7q*C)9$mEGiG8Voh^8d>52QihOpmL&%%bT zi*UL2C~R{&%-&~i!>ku$*$+QdLzm8>V&w8Bu&!Zs{H~V>qcbAdh{?XR&gF--A6USy z#0jGE>N%XerYD3gcnd?`w`3dkBw>Arx#IjIKVyr9&%mO4EHqx7A`XbY1Z?ahDAD{q z%(v+Swdp+2t*7I0ljRXSbT=MDXbduSaCQDmQ{!pU#p$*k53`Y;r9$!=U^m+xfA?^|cucDwTu-!F27>GwB9!Q z7Xf8ZVmpR` z|L8@q;dn`?bAB&mm)VZf8a%*OdvAhYlb`Ty=|*rk^LJ)Z5fHy$EDFu1;Sbd!#VHNK z;e+D~F?wb!roP)G{!IFUv%kND83`TX+4Q3f@MJxuWA=S+vi}QZyUd6!v!9E3WO4g0tpqh5Y?@VMnXkVy||dxcrP6>vWx{hKz5+C-bBs982dfs92IB@nK;@yRlasQjQppNQ~p8_*QG1?x42y^UE8(iv_kIir7z>~%EaBGuR*ke-^9E3&~^ZN+Y-s((ur43}=w^_iJ z=69H_y(>DJS))Fw63pB8K)j}Pghy@Gu}g7HVD^G$qV8TJRCTI{-!FKL0kmH`chgu{ zKC%IeK5z}9^;zP0Iv=M#a#cLEdp)i_bRRkvlp!0Eqzrz$0dKV*jAOdC!{-ilm}Ar< zxc+-5@ztQ+P%rs19_iwUm1j+Zkw@y|fwsv|uj2#!vmgj;9_)g7y#}*5?*N?N(2U{x zT~MOzBT;YH0#Xk*5MM_)s;;|qtR?@y^mCx;ht^QjhR#b9oW4tO-OiMVW6d35UdSWKn6xsr1` zz_z-p@rdnyafG=KCgj2aJjJ$VaS z&TTB7_^|`tJY9}0(5-@xQCq|Xx1Ye%%3~mS&tbeDrV`z^KE?<8?qIJ!D?sv?scb6Q zF=^p^l4bsCj|0sIVVh+MKu3GANskl|U0vC$n9Y!?naw6&c7?#sDPmdYyAbu~Jn>w? zBxqA^J04uN5uI|=+1k6b_FS_n(;V#t|E~Lg|6TX+{=4qO{de6<>)^jx+?6+^B@z($F9a{J~|AU;zaw2$zJqyKT*4LDA{Yc z!>+zqfM=s4MXdlb?7?s3;3Ka z{j66f5ex2}VAIM@fDa>t8iavne|Jn9 z^Z}OSC%~Sq?I7~iQy8+^3<7`igFImvo2ohoC4O8Cl^0uM)P7bZn}4zDFXK z8U2_Yy6yoxULF!h{qP%jRsDgjf4LaU#$||g)>wmnLkskFZ3ID0=8B;o=i-ky=Y!L| zP3ZpdM;sbygUi=m!&Oh}SkfB3v^}Dw z;(@Vn_rMyRA4QN`pgvhmRN?92U_cGGIca;i7Q5VjgIURpgO> zv>5Ii>1*(%%j7@9;XVK@{37TSw)~jWzvA(5ANjdz_)lB>2uGlI333+}y{fMOjuCTE8UI(0mtrL`&M^(Gu+-pvfTpnYsa)x;3KrO6GOk|ruE6An)ge_RYc^bw+Z z%!`{Io51o8r6elKd&F4T6H1x#e#sEK4TYGq`}F1>D^8ugV`KW(brX&;g<}oXTUw&( z&EMn#uhghl+C(+pgkz-YZ}2H2QH`NDPvpQ^&&ptNwRdO0O6 zl_n|+1C^5UB`3C(!N*pj`e2}%R`C3(t%<6=3CBp~VJO4064h>EzH$UDn>Qz+tcj|R z3CBoPm2mjOan0FeLurMS?LyYoIkJCn=r|tEpK_E!`Lkr=O?t}H+nl|kU)+Cm`1<+f zC8`m`tG>gB8*q$N#@H)JR1s7ZwFqkG8PuzSDTUJwF;}2($>2sQ7J!NpRVDJ|ytQ1Y zTDPK!YO4vy_^lg;oK}*kexv5WQ@FEN%G63Gs=Fo}Bh_d_Je4IXFKP@;2|DRAE1|N9 zD$ImqOyN;OnyW}uGdUB}v%}kQO%)T>2@{Ty%EREpYrvfDmH?>@_up4Hud0cvj|s;} z)x?nIY7*6Ddh-@Lc~6tI)l5_^O*lrXqXwVq64mCKa((x9-gdIOiRy$2$4JF_l|MDe zQCp_$4I}8RYfj@DCMsSR{HXy(stPiT0DXk0XyY63mNxA2GwYfrs%j=2BUMvFPB}-I zGhWx+qha^G(`%WiR3;oFRYgOZYfDt!_?ujCC-2L(O;puQI7TXW!`JO3styJ!e7>Ta zokTUzu~jQoTk@vIPRf_uXWB~)U59+lStBVFV4R(}zK%pC1sZ%M90^`(_*UIwR1@|4 zeyJ-_MT`xP3|7fx5{?AUF;LYjMwL)f>r+qumZMC;-x7}W)7ju@PyfxCo#B_LN-JkC zQE`v<244wBg7+DG>eK&1D(+d|M0K<%js*YAWUmJFuQ*i$6VRDhCaZ8T55iw^9`;eHo{`;aeO{2A3O2 zOg}59h35)Uz8s+a37#$5aPj2aPQ@Zz*2?8zyj!VYuv8SWQkELGQ0A-)tS33B$t z{Vjrm#s&M(fE!LxfGHuq;r`Cyz9GY@V*R254UzqQt$&u9ukeNO`(9xrLeeb#Z#lxp zkJ#pma8m{OjPnhrQu+)d!rv!6V0e`OXWl&bPE^}I{=WVr1BM%7HA)ztr-4fy#r%pe zrO$|f5NaI$#Su6wNBJ52%}7HX)^{n8Y^VD2{LrNncKPI_9(|BAq}&v(wwlAp?{t&{9CtmN>SvWWK10l?MJ8Axd;(p7v7w1bwzicW>T zhQs|_pk-pw>CoTd#S)%F>o&!Lb=0MOqz)*a&spf<|Lkmg4Rdg8Ep@AsC%uBHqf4Z~ z=7wIF_knQ zQ?+%HedKp93OGqP6}db_Pa&Q>%*np=JxX|O!YQaD`|zPp`fjUMMilA)D8j2$7ho!v z7U-em%6Lx2iVv1k1e*w_QzHotOnl(vRIJ|Q(9hmhwuXjN=+C)q62-OK5Fej(x!AUJ z`MiE($-fhg=Evj_9qj%E9yXzTaA}?%J91x(kAL@AGk~|``15z)b)m4h<^adZ@rSe6 z-^J(O0^mn-{Q0~1xCq*i+P6PB{t#@ zgbP~Xl$((4E~L8YwPA5F6F_gPcT*_iYf+`E<3y{;z1@YUfzs1LSvy{eS0lVsJ5{h( zJ9*eEGzk#}?r|rq1TPRg6&}JnH{rc{KM_MN$JLW}CB3IY=%H|nJ7pF3K{-B2JL8Qq z{tAy@IHwjeRf+0^9vJt|LP=Ib0Nnkv-PuLA1TMRShri8icb1_#qg5rUGCQjAmRh-2 zV~_51^+S#=!5%Vv%gQ>%^vgO$NGgI>h2VZN+HG6wbhS{3nZ)TdLb6Ospz4}Nl`d#O z@KU%5d7ov4ye;%vh2W~lt7a%2WDL(MfpzHX>O zH>HF|$d&vpB!5e(Kx3XM$Io-q#}r7VI-OGEu2EI(R6RuPtsbiO@jkA~%v&cSj;H8d$SGhiy{#pvGnJ(5 zM`sue5Er>+zs3Z~cwgb+Mx2N3JcTqj;j)`>&P_iNO`YBe5u&j~WKdjj!?u8b~(31^cY+Uok7CFNDo^)T1DDs+J* zgruZATU`$esq8HC6DUcM6Scw#tqSw)J1h4p+PnLoSMIG)re(5DQKqx5LMKxaPHWqK zjO?ME@i^-8|JLW{8p=x}G@|-yRII+%QeM^M6i}N=OoqOwfN77U;!fCRAIs6>3S5-) zXfF(CqzZATw?2Vms1sZ))zl)B^33&B_3jEowRi~H{T_nnW@Wq;5vkigSI$xppcPW7 zT+~YUMBywI*gJDK|1)tp1?t9$^aZw`GlN^)6)JsgqFaKZv0Gf?GlElujQv&=q!F}t zHH{MmZMrsL6qRa`MyU}#xaqw%H_rBC_dVDHA*pS)a{6N8FTwkY;GIjYMeuy&mf)F7 zSX8Cj2_E`{Sc+1rS)!qCD(;h|a#mj=p{7D1(8J$mi#t1`%H+M%8AI>nN}W?$QV#ER zdPv|cTd8j{{E#~;=?C>wyyy8kfskGpfz(OyF0DV0&^p~oo9pEHh%&)bL`mI0-peDQ zv>m0WyMKi(9_(yKyv-S~if#b4$O|$rN}w*3d+2&f-pPd+1lr2Tx)BmaSN^6Fw^PO+ zr$L7Tu8~=M?aOdT|n=BMd$rY7xP@W#)-XN@J`A5B^9&I`;{){HFar{{~O8w ztxj8@3wS3;AM$$7n}GI%&hw)#_>-px$kYYb)rV6eWu*2eW4Z-3j=c0*69@R zoTy%Ms?RB25XGynQM@FI*I%P}MHFwoM)8^`-kK=n1ig_GM-&D0<*Z!mbe;CC-usze z`zmkvCq&hmy!yPL+ddzs5mMarOL)`KRntvm!d2dFbdv^yLFT&73Z0*!E9oY6C7mtZ zrk&u}#hS385ow97P3_2y<+;TrQG4-B6f&q$(a6_0IqrS2R+TQbBf%@BF^z+NsPT+i zxI)eJO8)TAI!rlP5+~`VN<8Buaa9JdN14G0w3R{KcnL$|L1QZvJs1i}8X-$7r1Q3D zg@{u76|~eEQ~yP4qz?CrClgiI)p75rMV6FWWC<54f^Pm5bZ#t}H%Drd)C{Q643%2p z9o`@fP0iN&c;OGL!XMVhg)7AgOfC4FBvKgYIf*1iNWZO*yXigmQ(4Bnqt>#7cbLLo zYT=rY9{0{g89$Ufh5(Qc^4 z^M=FuKqK5HKH`ip&M|KtZ%CQEI(S{oh@=J;XcSt7D_Y?;)rBG z>j;wZcG1jG4!uK@8rkoQ0X6QCEYWxrN;G^F3J%lg?c$EaQsiWCOOj(Q6DY|sZ}J^Y z8FcqQLCot>0!W5&A{nN&T1P*~$f-K+E=e(`v~Axi<5zRa8F!;H-Su3Ak;E7`;YCr2 zolA~dF38Y7MgA5prHnRwj0;UBDVIwuPVWAx^wEB$p=GjKrzs62wX`nw$;cM`b6NlN zb6aT|GC?EQeIb%?8P0{A0?eq)Wr%c{P}F@v`***NA| zpmJ(d4hbtHsi;Xrp?s3et8`1zCb*R$Sm~ZZ-pAq!5|z_;nNchxN$ZzzeJnNN0&_Kq zCULh4v^0b_KC2PDQuQS@`iUgmtR)N};bt@Snmd*89f?#DZrTw*!i~F-a=?l(^j@ir zGlWE{g8hNYkR%TwiT<5cCqxs+K7FGcfG?G{@3hJRi7z!u+eAuws3daaH!4yCYT>j% zg8Dm6<1|UAxkDbBwrR@gd=1!LI4^jfpqWPs4W=h3>0B5tQqNqZITMG}e=a6$H(FEX z>GrqT@6M9=WQ+Ho@_ftC2^Q->xin(x4NX6+O^_@AN%Be(&AO7c26S~&junl=Mrw_9 zqLcQ7lV^$tyF+QAZfi3&>YZGksc1*(arduq(1T@~jt;{5J-y4C-{B-`~3ISIMxSqjZ zR|AzJ2yevoKxMXfdZ4><%1yoYVqPao0soqZesYO)43pU0wqUP$lNw-<%*K-nlNN7*RmnMT=23-t1|B|(8Vh~k36-}2-? zVo0rUGJmMDb}U6p{YDC<$5x}0O1oIyNK%1ZO_Ed~fw~B(ZlroD%EKNcnhED6PPUYU zg5ZC|$9%n#_}GO~^8b*JB_7vUCv)EA4959a8J{E-MD^D=STnExl7 zc8xeKzYYJCo1S=@x}0=(A(^vTeqB{&v2@RHqw+S5C|cpYkS@1O<*dQPicVfqTTQ4r zjPm2@uQ=q%u23hDBUd~zqEzvDuV}QqNf=xWs({8+EiMw&ksz+3R6v>u3ZprnjQ5-% z8P9^oO&M=A^-3}%_3iyhb7dSOQ%G$^W$ogowx@Ve>C%X%YaWQTXX(fv8!2vN`Jblfu|#K>G3%}LE(#5eGlJ(`{UFlOaWxy42j*_1u|+NX zNu#t!LU699Am-gAGG%ShSJw9=#oK8sQc+#esBSrV-KDN8Dp&BzCHdNeR9t!*ABt)0 zC|sLMW6&w;skFHgidUFXf%IiyF;a zM23=haZOD)8eRVqYT>#%DW5uyp%#>lLhV+da?0~SW!Nb%_k<}{p2A!Do#+;aR+Q>1 z%9(UA66qXs1+APBuL(s)H}|+FR?4_f#IxNJ6rEIO)CmKSBs?k=KBmm~V97M5NYnOw zKUHRaa~W)}I+Nd2l}Yc8oXibVNXYT%gh{t-m3wYO_N@GSI2a{nMS8J)9BpIH9B8~M%TN9M)!k7-eLMa%?uJr(}`zjn2>dyHZ)z7 zgne1#N|l+WnZGE{anx%2%aB#n~Fa`$)H6IQmS$_uf4LihBx_3G)bvQGouRaKi8{@k-fNH z^-q$L3uq=p!(kDHuC_o=Ix0$H05hnr%=rH*ltN0FF1Um&i+Wk`|Kw{)bD#VLG~B!o}}H2`6w|p>9dQJW)W33?;QTks%%;X)9AGyNyy~7?C~R1>Gf!? zqDrbqYl-p{u&2MxR!^28%|(SXviu;;9@Nq=5*p;W#2D(YjWfX{-l!yRdCf(}C^8d_ zLsHcprD2#VNEyFF0_sd|O5@WrQq!ulo=RHfS6ow@qqaWHRksf%Rap*=;dwI%pJv@8 z?5MNyXl6z^ctpB`tQ_GTk#gv^h87d8-_v|NZy+I)a<@EHzQh4)10Sffawrw*x9J+C zCXw`>#5pAPl43y8BM@WEdq83|Y0>%0mgfXrRb8}UU66(dQnmkJuIsJPjV&RM&@@C) z|I?e+1W&jX8y@aclrH2H@R8ms30g|^E<^vKL!re(S{9~79C=w-8Q+DdB&nq~F{~tu zlDz3Az-22tUpbrT_V@ z3_mp7$BC2Be^*ZKhG)Cd`f^7kfsPbKd%F=&omJD|q_s|>pQHItt@ZgLAyo(_`|}(t zheoB8B0&ZsKbeRWKiPS?#0ydp{z*lqucGgzAZFpK$3`V3&19Zw^&NQ`QuC!QCYZ`D zkJP+H7IBFih)HkLda)C&Qgg+pw%DRE7tf?&roTcr&cGh776wViQlt8yQ9a}p#Fvk0 zIe_#EF$GaG^F97XFp^ZwpRMnbU?hKp@+N`C6=0L-^m$JkNf~w_r+{np=DRr*u#>7z z_Nzb~CHsAaAqVn)xL1*V3f^Icc@b|H8hu-hUaio#(db8#_Kgc6pf9EGOXWx13Kgd^ zelUGU+R896aK5y4!N#8NT2MRnlNaPQs&^8nCd;e-9>Uoo-6c&ipYa}wIF``L=)DwF zd_sRJ_*2quhV5>8?=WfYeFOi@=Q|pXP|p6XI~sWBN?A~=Xw~~B=P9)+U8_o`(&3y{ zJg-hMAQU9!T9H(hXDf6R-t!F!)URlTT$;mKX^9glKqG`Gw8BH0yH&}{rqZTJsYM3g zr6RUg&fybJA?A^hp?P^+rmYZH_*MutZG{jDoV1Uqx6|r_45csRI%)5kl4G2>@I>={ z5f3?^d*^DLVie>)7UOhjqDZ3R2jlh#N<495k%>uM%oSVZtnt+M@@mq@Jj(CI;fVLTDG7M|8K)2$^{oDUVW> zZz6yej@7~?wO(OQ1Geh4ai<5(MN~9!8w%N&D|rKk<@g}V3vKt{1xL#d3Ma3RU*CiA zj_<*s7Wl6=TTlz6EEzEfG&V-#h7Del?{%egW0)*+c9CXM-OY7<6}kvR2hl|uKl<|V zV_>oIgSKuY(m0erIdvhYfWPS7UV@@c?YD5l20tew@mg{mJo%R!iucd|;FzD-&d6g7|{599qEyRWU()o+pRenIL-; z)W`(!y;?FJ*Zs(lvk96(>E`+6TM&nnq?G~|8xm7v?kYzoD;cbsSbDty^`D_atY+($xR{` zNsga*reJ`F+my=#OqHE<@F~+y#8c}*PjdxG(o)nWWQl1Xt)XD^(Tk&`ja7E ze=@}DPlhI#AYOm69~blZIgp>pak+sm$Dmuz=o}%rbSmRCa&!?K@KYT}$sH!Qha7+E zk(0|^hIqNl5HEKb;^i(wyxe7oe_4ijxyz893F750`|)y@Aztn>#LHcVc)80^IHfg^ z+#qtj$#o~!nOs|Pj^rMb%O}UrlkvXeI=QRlc>i&d9DiDnlk*}&JTEfD^CCk$FEYgQ zB11ecGQ{&DLv|*J=SBA8d66NW7a8Jtks+QJ8ERvKI+&ox1o1xJj9eLVCCE9GYe?<~ zYDWXe^&;m^t}8h$Iler~AHM%s&X)}Fe8~{cmkjZI$q>(%4Do!)5YLwk*_j}oFWHah zONMy9WQgZWhIqbYi1+86$npAUM6M3G%H)*fyv%8%cs^u^=R<~gK4gf$WvJ*Tf64@% zVWOAmk$)83;Lj_hIF4LJMK|~J%ofKnWS{(d7~)n)IDBhAA4^AUySbU3tcd>)zyFE!zOo*rI9<}8-pcH}w^ZqdoYl%6-_!yi68o3j>%^c=-KgA310 zf0Qsd&gU`nRG2f)3;g-nt-*2bBR>-j|M_l5bH5p^P&kN60t4ugNX8!yty{UE6e{_lJa{yJ(W8{URWuis$=95@(3{t^Fzrb>r70JDWsyHT z#GLU%61>E!-FZe93wg@;^S%6!a6Yf)Dil&!K4Yy%uD3PCY-gYk}|Mz{$to&p+5FAjCgBI?Q;2kcUkm|F3w5 zeck)(zM+ABUx~v1tG;qtz8>WNwP+~v@0`C9y%f>k1=6?wp6G7_{r#LwAM)X64e6|Y z06#+c*?~Z*Oy!bv0{&xofK;sV4?`KNfU3pEe@sMFu;Hv)OS{5HhUK^Ml$xW;xvh-B zPpQdsojt^_yzAvp(E&{M`SSgLa!Spy_$j7w#9YnDt(Un|V&t!###&9yZLa~xm{J+9 zcznjNV*kH#iiryZeW^S`c^jsOmk>WCRH!O5oat%F6=f|=YTIG5j+XBa;FdC^vp%QY z61)pM66*7K@_R}l{yZi>vOn(uOjV{*~`8%P0M7BGtBsp zTGGGr6?tP2>0i$pLn(yoU+uXfh!&3;|Cc&vzHY$R<&-I;5osxFM5LoEyj$eMvI54@ zn|H89mgV@_D&d}o-fN&*Z>H7vQD}MT^UXi*!a0p_DsM7@f%9o$uDUxOKSs4erkoST zqi{vJNjbGO)&&~&Og$~R zdBjIj#AR!gJ6`ros4&hw>7gB|H#Lp3GV(PnD=EL0w6cD?w%Yodmc58WHl-3R5k*c@ zEB94*k2`KgileuAlcgfbjBG8?{)|4P)=ajd&9r7QPI(83huvmmD&sFxGK+^Q6E2Wn z-g3fFWpZ@ooH+!`narQ~E#|LF@f<{T%DYCzZ%jR3HIwqnrH0~|${9TWd3^F|z>Z%_ zu%SXHQP?+GpIwXP!dyAy7|+FhdKq)U74cG@xmAYGv3GIo{YGpekL4bl=ta9!s8v;U z!zA?qDhE)rsWbAmEQ>Y+)zb3qLAPsbt*@!s3*s?0r4FsVvdHNg<-V%4Zegaz6s?dX zF|d>+^T<+^ok$BgE4;}{4VKHLoLf(k%OuASkQ9*1C&wS&tI9Jr8RC+*3~{+thPZ?# zLwrz@AufN(P|*R3mq>BBi2KkWR%k3q8aRsM$fLzSondkLj6YmjG-rHR;`FOdhwm($ zVb$gc^eEtS>5dN{=8O+299rAgYCz!(i^s?xd4|OYGXA^|K6ATphGmr43ujo(Wi+WY zisy@$4-HmdwUEJe!^Vf^fM3|CC?ZA}(A?;Mp>#Jk%6GUdXB6?|f|?|I{JrR+0)CF3 z3p}Q?^#7HFqWZ3tlYF9{ODNJlY#2k5xxFD_MH#@DrO*HWpGYX5oqHch+{u-gk$mn% z53fH-@=z5QWya7fdm-U`YAm4@;ZC`u>S=d*7-g!O#wp&C_e}KPocC4qetrOXKAdaE`mYh}S zztjV{I>nPkdit$O*N4;gfm4)58?A~8h^O%dM z!llG5HY9GbA#rE*;kFu8HYKitRz)KfPuz2=SUGVv?0+S3a}0?i15Q%O%`qfyjv;Xr zE+uY`A#rmIiA&OlSCMPC#uv5wEmW(WT&?!sWVJSutF_rTS*tsTC} zYITvTm1djYU~6@gtJUM1tkzy~wf6fat977UtwX-aY8@t3Yvl3M!q?Ug^ zw*K?P{kO+fL*lM_B=niEe=eBS6<)0*s(gdh zN}X_$K8jD_M@R z`3B{v{Uor``bnl%Uyk%uq|ec)&XOETNB-(_C5lHvO?pFTy`l;&5hOjalGRNb;d0Vb zTUpse8?>tlS+Yc}rey>|GRUU1+ni)mQbS3qD?;n+6km&Lq3C~YE-80$B6D!0g`(e* z&2su(i%ZJ%zc$x{uN~|d)XFQ}7%4#*WDuZPj^mA6Ep5sb5uAQUe zP9cL&w29n|FP=`z;d(owr(+@HkuDt`BrRVG(M!C1i?n=X`zSFfm(CNU)aP13@<_^| zUx^yQT2L#BtT`U1;@}3&6;O(_?=s|0I$Rn0LhGo}TXVf1S3Ukm@%N=x@;{2de}g`k zMj0;I&?xf_4uLd2bIFFr=l@7H|2;K5$%MRGNhbUTtCgf_Uacfee}mQPCJU?{-{ka? zW^lY(X$JQVRx8bYd9~8q_ZzI%VY0wF{F@Y5NB&3g$Cn}h@uJ#)6n}*p=>JtYiWreM z;h=B03I9j&_upR^|BvGDf4bd)L=`^ZlBn_x4!HkO{QXa>l_nOvT4`eO4OS~n$#^GB zQ?hSRj{1+{@4v@$g$t-w63_Lq`Sulm3cjU{R>#Stg1ooOr1`5*?O$sCjvF<9r;2I* z_>#Fv^OsASzr_a4-(rL2Z?Qr1x7eWhqi{*{N8ys@Z*d&g{Au{gGb#TB>!jqGLhquA zI9HP*ZZ53=%j&oDbnvN&B2Kt`;5vyqZK3NJ~Bg- zB5MpuH%M2QB;`^0Bu%>|?*L3mx@Bh27+O&jlHQT@g;d*#-1=rluB>+CTmQ&Q%jf_{ zia^#XT*(5(^CI?4=$D&7I}Huy0r{_D_q9~g_fQBa8M&m}DbyTwabfE%vn4m-xB&j%ymn;=4UHU;KtM9LnK2Wq=Rq4D;$P$KfUpl2jl}@`V zRoo1Io|!5`E>TiB^8)3h#mbX(wP!OPs*+`OuPU9iy=N(@Wbj3JPS#S272LJY%hhzz zivHhJjB`yz_LB+v%>)%{ivQ(3K;F_lKpK5{jeam$8SO%QHD&WT?!sUEG9c55Av$fM zrF($1PD2Xs0U}e_WD&;u%bS46W;+E`(&)XZAq+Ly&pG5F$>a%9D)?8ZHiSHCPvvZwe|< zj!)obaLC}(GpWe4DKT2%FDs*+sYukLPQJ zS8AuqYA3RvnGk7D=k89MZrtM6R28#YY5YMAj&9y6X2z8l?3X4e4fcbi3#HU?AC==5 zkR2I7$N&9iHYT-oAXW3PJ(1S zu(Bf9imw`*nMttppMIPCC|JUwa6*#2IXXXyMIJJq{LhL4i{SDg2~k4hgcOe<4hiOw z&?C`ExD;qik0EL!4f*qr@-#{x=P)75X(m4zmV=~pN@?S<^Ds_FVH7t{k1T8r&nVWCd~fsH|JC zp}Ta0G{lR$3e&cfzR^!8u~Qf5mij3?pc7v}ByQO-(OnIP;H|%|TP8djCyg)2nNyAv zjf8TePAC^}E@1EghFug8KHvek0;INB*pobUk!1$*eUgPU{% ze(|H5QNq9*SnTK?=|KxTY@wo{0j?Bw;AvJn!O^W|aU=(HIa=Ezt^vysqkk)NALx(+av?C7{{bD$BqTs=AGjaH(E7Xa*EJ_nT zz~qzg0Ye_a!Hzr<7Qpm};m~mN-mgRO@eZ>HzW;#WpZIuU{B{K8R(!nr;97iF<6DF8 za(q;M@abuCg;-e?;%Rb)*mx<_*M)eRTygzfDC$CkU8ul?c-B@q3SDTV3r#_|IdLC@ zk2g~>PJGLg_i*k;SUCgF=jhLX3k#jDtdqgF=jhLX3k# zQ5Rwy6vsFy#5gF#I4Hz8DC9p@jbMN6=jyM4A5;;1;Sdi~V|CCu_qR2L(r?qsy(ui> zM72~p7Yp8=ndi}Ja(!#UGlRS{^DQooWScV9=o!zxciHd-s$buSf~I7TpSi;YwogCIVudEH@Ekzjr_`2M`Wwci{8x9jMEG z8I-+j%DqWRV>+1kB+ZzbY^bhlOuLi7a}wV1da7cdFYeV!8B|3+D#I9aMvNRiChAjP zcB8?ll43*88x1t`KSa@uGQLp$s;8Jt{cE|=pePpbh>IzAqKwK-BY>IBdY4jw%;}5S z+%uqioh>31FR;*?4`KlaIsMxY@${?a{QUM2#bf*^rx~UJX>@Y4KnWWvPn80^JsaJq zVvh(A%kS%;+i7SKR19QGOGk_i`b+#j)7;~DS(cM{wU9nxGUqYx z)5>>C;HZ59F>h_os`mJXIOyYfWq7jDN#s4;o@&SQ!E_O?9UYg83++Q7f;C<-EQqfz z4Ji#Q`@<4;$qStJ)vZ4PL*Cjr&2=>2rDk}Ltfl#Zu3N+Xt}vI-{4+FhsPV38{C*l!)PzN6)ZQTK*v+?bmjeqTuShI$fi8ZI(C0IP=mTJ8b zn6~nJQ>{M~;DJ=@Z2~-)Dj$ir)KcXoZRHQ8%8$bn#i{brwsI_);-dH`Q{{Lv;ptR4 zmV5Bd$5gz%mMWjwhSvqlXSbFADOG+(TREQgn1}npQ{^>n<#--pF`kb|l`qAs#;Nk< zc-Aykp2U+Usq*u2$yTcTB0SWYYHb#;BdOL^0_3JzR|CMJSI@Tc{8a0eVrc5yR^Bhw z%6_b@t+sz#c{J5}Jq);F>tS9R({{?>M4MzZUOd24B4wbH7iRHF18<@jfYs%{48ZF3 z+xcb1zh(S!^Lu&h{W#>{x91m2LX`9U0Eor+w+C8NySdsup}6Nk<`#+a)Tg}D!q{U^ z?%)ZP@pOE3l1s4*Xhi;M(o4BMliAxMLqm_dEKUpPqo(l)D+m>j+ zSBb_$5)C9ZulT|Xim~1C)Z_61|6xpU_da7Xw**Nq(fD(G<(oVxfxt~@8#Xi$4O~-& zT7hUlBzN~0MFWKXXxy6-4G?^BH174H0a}U1y(SvZ_=?rW_<)ZY4eZBBG)l{39TJU~ z?WGxvMo%1B@a4vpHX4wK;m#&mv*rc}{n5BGBN`z1;%J~e+S~xGuTYi8@caO;)0d+i zY2|8e0)o4pFH{io{bm-bsb8s3K_K{>S*T`zr9uVK;csT4n)j6ol?WMsLES*(;;$S3 z=US@8U#U<*3iO*O5f0;bu$NVoiAN@ zo#q=_xNhdav-9PvJOxpPZ)8V!GY8F`FJ9%T?cda*r33!XHe5KfnpU&|gIyh7$q=}M zqi!8uVOXo-qo0Bj=E~i*I}! zQg@I&!*oQ1&+s^02y$dkmZf&4%b%6ScJ5UGE$`Q_#5ToV+4$G|*i+nOj>NW!=vi!& zNS>{}nIdMZfBOLR)XNajS-s}x0J+P4^Dk)A`b+9RevtMM8H4?=Xb-`O*0lhhX#F*G z6qfe*&zofqy7OU}?R@ITx6v~77@ohJuG?6fX>g<+cOS!%RaYKr-H3<&TprpI+cIv| z^+yvoeofz%c{glKbo-ro*D-Hx&)$$kC|KPyr)|w`3`=TDVoy6f=JYPnvU}gWRqcQf znD|4@0OG$9y%~46C;_B!kl;6_wbA!4|+fMKAw<$d*^BxG3PFLqI6#e zFWhszBk+XPF$e%xNFs85H`gp9^6m;(sUyxH%$E)nsAs-jI*vh8Ky7{gg%@A?{qQQsPN^zadd zv7+LUqehP@8GFpJ#~pvdiKX#zIRvK4a!7vre5o=d|ki z3uD=?qUvYsyGKazta(emK_mEs^i>1V14e-BsWi8k7 zsF<|j5KUaWIr8MSmw8L;b}`voTDKX2Rs&pI<0DivpyLv$_Yi(3r zcUp`){88V^0+{Se;tOSodiVk*y$L_w%Cy?~5azXo29}_~ZpxVz@!<`%3zsJwh6h&0 zE$O*cMGF>JH>59>&u?s$m2?fn{HBEqq+@Ad_%(|7xh z88tGd3+G%3*X836&>oC6Y2vRbzGMo3U&~5(aV+4+BAB>IcQQIwD&~K-mGHBH=R-y9 z>2$GCc29-u&S7xicZNm~(8RqlBdt+>xeB`j74ZgEJt)>mp(_sFDSR97zXi=)Rw*bt zEp$b}CGI%la3N?O$`vxljYsjQK!jOup8(AZ>2$GJARg>pUIWbqtSC^fzhjFOVe}uu zqZ>gpQg?!+C6VyO#@gyAlWuq$^Ws9sh!gSrme$B6ZI|+Gfdz)+O z^49jvS=~Et?X-|U{F#=cAbzHW6~xc9h=TZ;wvU4Nnbt)?{7mbbw>FZqI^K2eCdPOu zKJz#Nwk|M;2pN%4tmGXN$#0qrR6Hc$c!D_smJkdJcr?L?fCCBcBjAAqy9n4bZ*4`_ zSo<+Od*@x>K6ew7CFrT_6eKo;j7p5{oww>UP$f2eZj_*Q3hHpEUQmL1Nl@FNK7bO` zCP9Th*FQmV3<G4isaJ724f1* zI5)B3@XrtbychmxoD3g~nZ^^rdpQ1jg~X{s5UWXe2f(S%w}1Wt{z%*hyv7`B2SU4PnrL}9$|pmjEyv>#h&@i;s+9;RQn#DgW|EhxCmz!?)YJfMMM%I!1akyDgJ4*| zX#^tzP9V6CfX5Q-B48oGt^y9hxec7&*a6QtM_7m98(&3k+82VVIAtMt1h(a|Xw{i> zH?c`R0$;=#3|+JL+kjZYA`Xu^=;$pyQt=;NoxXXz6nWo;om zYRuUO4$k1*jouH0gEx`bMm&0eDFUue;&tMV^YqiQO5KMqj_X;VjobU+)D5O+v=r){ zeei&_yy&v!4?F3e9PN2Bw52SzB~Isfr}!2)r+12P;gi?6j!5TXPnx;dMxF%9TZ=&8 z18{QiKO&A3#u}0e0H2LZB)bDX) z6EZ$;Qr;cU=Uvwxe;_Ab0EaflpMS6C!Tfo>yxRw2LM}A-fb6XFW1@ZYp_2tE~h)-+x9RfCU6ta zrM!I{+?>$1>S6XO6MC##i-L)g{Tkfd*WQ`hW7TMmNH=!u-}2YIjqe|TfOPvySr71_ zhspajUtBIr;b5EN>!sx0r$O-MKkuT+<&*rp zR#qJMnTtOo?MLAA8eH8Z=GYJeXN&jMde*`<$HU4@T{oa-fvCIIzr3|*&m$$Pp-(`E z0Ej;m&>;}S&jfS`1o1N=q9A@IphF-QKNHje{!C!M0Bl$5Ix73M+BBO=egM4I%0ayt zU&Qe$xx1;&%CYj@yBN+j_YQ96Z|bE)>e<9*WTrkS49uq1S1(zR+Q!0iDV}@JyT;i% zuCQ+xyjYSL`(&~L-BlishqY|)`q9SRF<_1<`+kd5r-Y0 z=3!UVKW&r`1;pwfagGASft&BOq`16Wwenr*L`{BHrk;?4eNUMzt=J46ld~16CwM63 zs%wELOYO4xduUqIQh^s{3iC~F&qr?eaC1AqsgJW2ncnnj$FW$iStV|NrTi!JEft~N zt`AMO@NC?rT@r05-AHj{m`o*^1<}k|H1Rbomc2>#(CFeOr{kt!OR{|_by$~()a?>0V`XD#t>0MZhF zw_D=d-4g$li+kP0y$48Z0gGNJl#>&QbnTj(+oQ+6`}XRUpTFOJ`|p3i0S6s)@WK82 zAAWc=I%v?4Ax9iBbm&n>4I4IML@ZWRG;-vaF(oC(9((-pC!A1PI(~e4`Gg4-6(^lk zSvh6Ov}x0)&zyPcsk3LFe)`4;dF9ntUwiF!*Ij@8_r7=IjX(Io%{Sk2%k8)S=tp1|{PQoq_|i)+zx>K8fBMs3{<3}hU;p~%n{U0fbLTtny!-C^?|<;YKmPIIhyVWf z?%kh$`k()N{<$5N+p)MEfZI{G9ctV0H3rZ!sK$?sr0o#ej-BnG*^ZX&Fxife?ZDWM zh?xiZ)Hub%$H|&Ly%~Zz6y;n?P7XjS62CCR9v^;T4n@J>6yn2g6u&TsU=G0?f;kk8 zg1-8TR<_3v&o;IBY{ta6SOPFn5Ew8_eBc?gsy0&x1UF&lXf%g&TzokZ z81cazg&BC*JJ#=>{|K z5&TBDSeOg{aEuH5_+ah^Gw|TY2mf;6A5M6IA0N!!Uaw-w^Oj122KnBMdw6<%6y_etUy2 zAAI@v?Tz2wg~|>+AO7bf!QdP|{2~EihD{V7=tB5~|1jgjFZ_pDyv~RJ`N)ubBq%_9 z_(cN4414gw|9tqL5C37thhO*)GXhVA76KaoH34#S@rw^A=8qmPMB2h0<_OIA#m8d8 zltYUmg*Gkj`})w;v)9DJC%um4`0xvR znAMuCK1m~yfgs0+-w1wT4+4Dng+1s8!i*2Uu!or?3?F{selFZ+60nqM0f;bJ@!=Qt z1+ZrnVa|aWUnB~8eE5a?;2#JxKK#Ocn4_S_hhNx(ejv>F@C$pGhxr%xL+~qjW`LOg z?l#!r;v!NAzv0j#==5XHO$n4*_04gHxHM5_1{A5O_Q4kpae<$-i@vvi;)}MyxG+wI zMF((kxu5Ee>jwS9+XnlQB0*#QI>}(LC;=`m{?qqS!)qpcCrqZgG?uH}xQ_G(*KO4C zz1i}^GrVmu-hn}t>-sg+VAy^ht;3;q#EYpJIpVtCc(2oMacQhyDT85*!YB`(@?NLE%0~ldq3j+4m%dSY zO}u|JAZK6ib@~&9601z45%?Ddg9Z&;&BpZjaqpk3!(SrS8?4X>+-O`!XG6c3*--Tl ze*BrfD$i#%8_(AC5E`+!b&B0}n8Pbke_gt*h!`i!nH*w!TSCA&PGhoRX>A?xsx zY*LzCNk4P4VM*Phs$@Og_Th0VsHT3IBHb-c?qsIXEorPeueRD?)n{wQsUpu~*P9~v z)95T+GQXj=v2kft?fJ`>E?KZ7SvCKH+J<`BI^Ek#sV+}-!-A0}eAsXG`;xKg>I;Ff zv)i$r4FXiv2y~4(0yfx|mhLr+tE!jPCKuZ++b=u2GDiltqu-*SG@80N|K{sO5n1D4`z#c?<@f6z(D3)m1NgNy4sB^A` z#fzX>$W{W1$A5&bIQWbyMePQo(mh}*9vgO{8&ee6vb`Sey$hOV9p6afC3K@l$H3yM zAA@c;Xl`cf2E~R){S9tmHUK{qZP^dlojqm7^fWNoG z;#JUG!1f4=V}XRGzh|K>xlG#=$MtvA$UwT#`bucG zq|+4zce1$_eHUmRPN$0n^Mlq;LVG2hZcJejtX$Ou=x?BzW6pK4Y1jA`2MPk6SqYl& z7&O>XdX9oY)Zww;0Co^ zZ1gf{-ZOM=_(qM+h{tZwbl+e7b?HWy1n8JieL>Tg2@XYPOK~R7e?*jcmbX6{8k(s} z^Yb(44g&r!ouDJh?oQA#_`O((eJY#3q#M);I@Yg}PSCMFOy~q1tL=I5B! zMhiPZHw1L&WT6`|sxXkhEYIIfqvH~S?B+lqATB5NAkU~9RV>jALc}?R`=D|6iaNbZ zv78$N&tuODPr>Ijb*XGyP}tF{JodNvBj9n$Ten;iscgHjfDgqRxdtNvnaC@{UeCul zm1~YBWo2IZ&P2%|a!vV%m1`z#Gg&D$gQCe&p8t+t+@ZEjNOysByCG}2 zco#O4nRgJP-JWPmt!iM;ZUJ5J1&uFUX`e%Wjm z!^WmK(j&IV?uU9=g@Qd*HZJFG>Vyj&4`(A{URZBBet0xY4frC?Oz4dQaT=Kv=vL@W z0zC-*T!Gr5pC=F}E9VPzq+3=;0%CoNIL85^OA%*@YkQRo1$M++-c7JHlvZFP9FLPH zHka=Pqk~`mV5|I;-CjeGchx<>r8Y^5OIAEa8fGfVHey#bZRbN!unlsWS!_BvO@wqm|scel)(0v&srnhfw#H+rVn;7TZHF zU)|XPDw_$hkNov34jY>dLfvu7mlHxHBethwSnQ(?MyX?n<$z(YZoi6#(v~2biipwf z%9PoVXY5{)7;Dp+aJR-sB8(T}i#TjRFB0fX=&aHaDI%8$)CT=hfmmRg1=<3Ar9j*f z&<3E$g}A<A)hfS z(Kdlr{Ss{xY1L1n2#fxTNE9f+R8z^plXv~5)Hc(3%-vLg5U{<_*ei5~i?f4(MBDWI zxZLibqkz7k&?ZoexX44<=B|QrV`%PTuYPH3#~Sbjt=$h`{iUtlH6;47*6v;*+Jx4w zP*Mo(Vd`aDTT&AXrN*$z*+PWUekPixFKYQtum#g!Dm&Nm#a?A`b$c!eQfk*%X!v5U zc06Le4_1pn%lCs}h*B%Qh>QocS zn|M2H+zj%M;nu}rN}hI18X_v&qt;%_c`I+HBqds2N|xc@g?*fev!Z$v7ACdeZN>xZ40}19}%A zZ9pFcq|GMB+P(%9vleZza^OeS21_U^^3{$rzLbQgNQ_InRjhD_!B2UUgAqHrBFh#OEOU>>lvnQG3M9oleAR@yqI3j00 zw5^)#;#l$&Cjkw}Pm1VawjMOKG1lI?rRgx!RiY1Nm`xw5mPi7$$|B)>B)ri6vCM_M zw40ufOw#hgg)m>|m{Ha=OF$%wEzti~#e@uTzt)*3P(SD=2^59SbPUPnVqbw+#JNxr zlI@g(1uBJps6YwmQGupHA0*Ih=v;>jIrE?o6=*SZ_KG2?E+YhLhF&DlYUrZ`x(0fQ zKsQ1^R-oIUpCHf!(BlG?C7dbCYwKprsEkfMdHjq)#nG}vlndqcHI9dv+OXu@>SXQF zCu3v5hi#gV1^;wpbpsdLYa1G!A&tjG3x?E0=PyYP?d~i$ZeWf67-zY%D%`MSS?w{- zqT0IJhU#Q}!!b@n?SlGc%WCUtYHNuO zyp7fqT^hRux4>Z7GKNE3m){T2BUkL$-`i;AFpO#+Cu%m+noJnD9v==}37t^m&rUze z+i1PerLlg!pb?U-!ElIc_C3LMXrBXP-bU*yE{*l;27}2Jzqo?WK4#W_uN>rUwEn=Q zv0OFA_in<)`6^TDv+wS>-P>qA%cZegj0shDeBlsl5J`rv*zYZGqxCvqsJc6r>!-$d zwo~B{*ZTJbbm#2u_jntv_q#Nf>nwv|8iYe!`OgFN+Z*1P<88DqcWEpaN0?Of!3*J0 zj}G3~+h}E1M76IQ!l-eFDHo=ck;LovAMV_)8?D%nYFu(bEt!zI*00yaY&KCt2f&0t zI!G+4Cg)`6Py3cUs<2UG+x6#TGG8Lsov;;qFLdbS19MW+#I^63Y{h4mG zlKL^1#&TV1FpN>quRao1a<#fNmMh9=K(VBULu}KimiIWf?|v@V5iX78dSA(8%|0Aj z2@`AD9hW|w?CWy<%cZegxyGISVG|C`fzIGGrJVcsce#4GG?t5fF%{EX&kmF1?>V1W z9pG}!BmvX`j^*N`3{e}O{eSEOXH9V$Rp$Tvu0*kPe zLsBf7`p<+sYUI$b;YG?NGyyJ-2{a8!@u!ClIjg_tSFv&lO@NF2pvP4(bEn7YZ9r z?wNMuM`EX%7XKGBF#D^8;1%qVfth7|Cy`nX573OOm{L_&d!Fldjzi1>2x(Z9V%!Sm zy7NSa%hk5JxHMe(v`W4GH0b+eujZ0YEf39bhkcJ#N;5IwPFW(GI~5sR9Nk%^4wPp2 z#cPzUQm|(R&7U(|zCQ!Q2V|^La7}<_+~leS%a&UT8~14$ez7&SO5I^QW|d+J16)WA zx7Q<`(mZBa1Owk|ngYIOxhuex=CG{iz#q7729dQQ+7h2JIaW1e=Jblm6RVOdme)#g z@*`QijPOVTA~)5`8mlnetVYA3RrH0cE09@08`sFJ$lse}2ES4?LieI**v5{gz5;NtgDOyrhW)i?z zQdHv^%BN4STHchbs%>bf$8`xJ1H{-j&6g6Q2+OMRtXjC-6A5D76k(w9SyQW~o?Jes zsv5p8s&i&z8@FoeDdUKOBvYXVCxBk$p{I;Hsj6;CO;P>)vrKb07@??ctcz7~s*-k( z!~8l8$wFx`B&V!o5xAuMF)tdc7A{#@>qSc15h)!NlV_GsET66w*I!ro-$DAee;#gx^5+ag${hS5mcH1g4PC zj*ytT!VK{fFefx?;*}GpOh+YyStP2E16H6a`ehPT#f4*vJc%lf1TnJ3Bxt;;!ji5A z-rLXDB2hKQbojb5c58nxqfMM`wa&MF!nS)BCH( zq+0`;yVB`mBhA>tqk9N6f6Sl@O32W?4$yQl&9objSj>#3)IE+u4+c$9I$iNdGtN-D zQ}HtaG&iTy1%u~sxbSn(yl&_iOiJ902nvun^MKz2nktk5D$Zw1c^5?>bRzZc`~WnY z3>~|wy-DyqV`%6eRW?Z)ro(fcq}$pFI*#mK$U--wIC#xCl0JwBA2w%uy_2PtAmjZPW4@Oa> z`XWW%Y>HKYDk^%W#*hxfr@nIuibn?Z=)NvLDsC!poW+Hl+0aV`g4QX;u<6nzmJpXa ziyU2`bGRgTVyV9|XJ~^ruGbYI4OTeBW|sKLvrg;dEyca<(pawD2E*ne$mK1?eeTj&uJ0HO zOG=Q-TZ+5MrLkN;H5grr^M}w|io4&Xv0M!X<1NK8UcczG;TCTx?tGWVa?RDulr4jB zh@Awv?w<8O)w&diA=iTWhKpw&wB~T(nu?R@aEN7-_^xm6$?=xrY_}{lu*JJFqT8jo zc`&i^PVaksk+&4bX*-oH*9m0$Az8!>hYEl*K?cS`cA_oIb%7~0mk7fl4K)_^vD~6d zasK5Np$TxY28MCKP}N5(P8^|2ak6k?mRp1-z@-j{8KAM1twUEa$VrWS4QGXlC{fZ z8l342Cs>&-5$ofGw*dq_b@}}BJxng^vpGj}(7hmr4hAuBHEkm1@q^kXh%^Um6nFx~ zP9DB&?obpPJI0$kXrY~lR(qhyUr7&}*L(T>TILS1LQ|R5)7>aQ5qzI%*_PF0nLDJ7 zX}f@C8`_lDOxwi9O6bz=oy!^(E8T1_atcbE>LoRawhG<5hAdUMxmPIBcA?5vVH+Q! zAUo)AYx||J!mhRzKZX<%r9w_a;JDk5AC+4nvYg1all$3cUR&GG7iJ?}Ck{feLL3+@ z4p7Wh&=7>qck))<0_R*w4LZ38h>FzakGkYG6^bM>0#eB>c3uVo5k3>hyj3rO&@(eW z3^aDEKiW_#Zn$#AaCY@wK#?XNZo$2i)jbf$w%FT5==;hHN25%MOc&3;AbD~8VJ3z| zr0HZ|B$8($0+g?|afML8$p~r|S4KAVY3`NNf$PUKVhoT^=1-BhaE60WSGW&E9j_w$ z)c=m>IFMv#6OkzaJCKO%ne*8h^yO*R`co zgofa0KpZ?qoEHFbecsF~vI*r^rZ!ciUV_|dd@~5GELG|WBp);KCqTI}lSUL>EUtn@ zMd~prMk)biN)(EHkID6#NiJ_GF@Ayj`A|`G+&1_{tyrH23J z(A^HOb?D9(l(Fs+PyS1X?&$8NuV4@&jvaQ|K^-~)4r9Q@HuQjd#y5LIcMfE!yrDbO zii$l*FkafHWFP#nZdj!a`<2#+U+h9;te0o5VUyv<>0DWcG0cCf)UQ$2h+oBw%fOtP zfw?RL!&+;Vx--cd@vE38GB7{Sz}ytTAf}B?^F7pF23n@Kw{(91pko-DyRxQ?)kr2L z4x(b!c3CY>l+rkU=4=@P8n7{0-GG6X;;|G-um(%13j|tLU&Di_GzC3K8=HU$-qhFC zlKtH3rA@WgK<^}DV1cMrombybW4(h&3PEz#2-MKHc*(+KOjbj&NN&e7(Jx&M9a&uH zJ721kmisYZJJTeQzZTk5OaJ{^Ml@pz1KyOv^e!sfFjh1u{$v}`M1emOmX{bhwiB|N z7d-apG{a&wXmY!P0E%rB>C(^Ru|<2&(2$NQ+iD&sY@c_6j_&o$r7NDw<{qca{X0R& z)@Dd2=-3Mvb%KuWm3M-U?oICm9mfH+ouFg7oYx6Dy7%o)(6LXtsS|YUf9~!C9s7b! zouqrY6Ljob-|qyS^qDLSK9#M!knWI9&@ugrIzdPG$~r+u_fGEw9Y>4HIzdN&FX{vx zM}gnTLWgVPN?_$G_9yqH(Rr)g_D>v|HY{@Q^RmIY*J`<^Eg~ehg={SBo z4PQhSRk>^valQrpbb*SXvqiwkCKpF9VA!i-VPL5Z@pNB+a#@=BtTglDH1onV^U^eP zU7C4Onz=sBe0G`{W4=K6mZX^*)65v{1n4hFGhdiyz9`Mylx99R&3s;(`QkM5`Dx}A zY3B4SVNNiAb=jIFQWwox=5*Ow7n~C?M+G+<`XGUj7iO6qz8YEC)qsYH?Tye!2y_>8 zmXeUO4m!tHA?HcxB?4`Oeyl({pr0VnZs>7=C|On}P(MHu1u6h^l0YSZIHC$U2|!Z? znhj`%K#Kv*5@`JNIa6m+6aX@^b=6Cq`PDU1SN7GJUl-M#-l*=m!>m96yQB_7mL)Y& z6{C%E+=Q<&T34TpV)vGYC^x#J$@=6IBI?Ip;vF8M^2s%S)SR5raNQPR& zn1R;F7_`J!hKiP7Q=ocbEd#!+)}YVv5gPdiCLNPaQmko7vU>i~T3G&%L9(mfbWc~f z*)3CXI)poWz`|;H)~`SIy%-(^hDvD6BB)|G4h!SrF;)Hh|M&#m+wiZI3r&D4SGd@0 zQ;mOe4&MG|Sp93|LKEO(-{SeTtbg7d-P`c5l?zRPi&MgIha-j)u zF`Ybd!OhohZq>aF;TkDU>HbH6tEX^rz(zIh{_0P3Z$r4utWIbGTpS2`ey#l^{F3f% z2-j$F%It0Uhs;d9aLD>~$Hj;B(!CAg8lzl76Yz_J0~K2(#rLk6GuzwS7|s?EN@xOH z%wI3%`yN{Gyl-z~tT4%fL{JQpU99IYEgV7<;Nq~>6LvlLtoYR`W~^LVID{s^#k!~m4H%eb*M3}~V#dm)g+pip zT>S!Eb0+@cbrmyKE-f5F6X0S?;N{nvTNWVHKl?J%Jj2Bw zU5??9#j3q5tjMB+rO^{!?zU7Fq_nFR;@Kjc7ziR8YO5RT>lz)(_bsijuBpQFNsUR; zqf57!eYuucqp>!`(M6RAH0ZRY6-tJozwG>4NUUVEZ!Lt~isQ^gZ^s0s`oFdoVw!dh z1v*#c3U_yST`mqtuy5`^A@vf&S(L-AZ0CAwfwu=gt$pA&m~~7=OW_8> z1jai|x_2H~Jr5+orW9^W__$@yKFI+syK|aKHn3UaNFIA#d8^LFQw>;^-@x9yWAp}g z^RC@##*Sg?ICulApKEu5vE!J;MGghBqHPj3esJkTWvXUyRBreojlI5}e&&FTH;`yt z+g;my>1>~kbHw35I9H(A(Alv>0__I^i-sJUtJLt{ z+|e-A9zN4Awi?W#d4p%2>@` zgYiJTv>naf)o4eotSsv~uT`_{e5P3=er1m%O$>w9D*`k${3Zi)M+WBp49wsR%(nv= z^gvmBeLu0DL}(sP$pRoB!sKv>@HJ-B-kxcxHAo`kaVR?zyTHL@Rp>22rx;Np>^W1fVC zPR9O)x!N%%ss8Wv!8*9IImTA6OpB~VW!;ZpTX#w}y5i9R2kG7t&|P3?S%svp9<76L z>&Y)*u?jS!P37h^P3Y40H+}{>-r}`TtDko-W>H~@b&J16_+A4|KIg+wuD`LMgKVD< zHZ(#AP5ljS)C>gvXwXebcdw{8;BNwSb3k*up<^&hv)qTs7VFQ32B0Xee~&0C(Rqf! zk^lWPI&YnqH(A7I&rR%^muv4DsAwzY7$zUc?G|V5(wn=9U2_zlUm76Lm+%=TE822= z?<28heWW|M2wbnU2(H+{#m*Cvy3+OHz6Oy|Nsg&(JFjq3>qkxd3Z6GUpj#SH*>-8c zq}DwymI5)!(>|J55^93D$=^DL;W8D-WbAwZt|!(^DXnaqn7e@;kG;nY<0r7>t-6{7 zEteKLO%p+rKMBtC<9$3VW#S{`a*pm;3g#iVD0?8IU)3j%5Kad_!nYt81lJg3U&UBuH?N zT?KBTlIUpJIVxM4_)CtwO}H}-AB2mgp?EJt=^>C2DMb3A1U!O4-=4UXnq%?mbVsc^ z^9cejRy$v_P&WT-V7c=_XcZ`6kS?(WO!K26^>_ttf!e@kNWwI!_3wGB*1&|z_9Dm> zpA1TA%f%6=>6i+X9PmI=WlCXXO73<^dKaZZ(gou$EjdFm9!r>e#!{O*j>#6hh43o- z-FSh*%-vcy4AZ>J7-qm|*)i`ar4`&n$l#|S&L|C$;Em-Kpc zc3~k|abu_F-#m%J%+^V_QFQaf-u8iOJ|^ikA9|67zk_GYzV1OXGm?r0*<0aDKDYa6 zZ;;Gvr}75Lq^6P;>k#8h_2I3jT^l-1hI%sU1#f<@oEQvPvK~zTso1H;e%5gwRfFh?;i`mHdz;kEG;t@L za{b4$2nJ(yURm$r#GSOM2Q81!aEFsRtJLK-Ys9Z&ewBflnSuFR28NBFRqD=ntr5S9 z85W?)IysUlgU5IgINV7LuH?adMNd{MG82P&nmbeC?wZmCP}u~&vPyUtiCR31i##a(xBulXyMXotYq%x05gsV8z(rsnqOBme@UHPBDDn>G|Xn*sKxfD zi43e4qEa=cpE`y+lcr3bDWSAeHNPksVIw}~(lMM%>*Yy#HM)vUmyV#n{K5W$)LL`4rn-fgL?J|P^^p^zTi#f3`7fPLu37rbSWMih{tePKAM#-cyRkF(Cq@s?Zf5L*uu8NlSsj}FBM|*_<;Vi)=l?=25ag+oa zDaJakyibK+^XCc!rxLg2S+g%o#PQSQIq*jsc`N($oswZO|7AbQkmk1xkxO zj*2Ib;-%Fs8xuBA=4k!~nb)tQwh+nT@hE%SZ5KMwZ+hkpU0FbY# z*f!am%xarlU@>~jGvchy?}U#c-Bu+bX0=!(&=Tm21!{m!Q$#KUS7?=sTjN3;7OL%? zfX>3_6<2ffYnF&JN8?_^V_UGjmUr_;%$;R|%$cPI?Px$6wDf6qJ8mPuWdxXL%hkk{ zyr*4CM}^&&6sPFG+4yXzP`_F>PSq027LOB*z1c1E*?E<(LKA#VqH9ZgFWduAv2o+> zus1WW^D%L`vLe^>%x4#0zW zvjR9Vs;x=uN69`Q(o(Ca)Or0FO>@`nafpqUv6(J350J+9To-5CBOAv8UmOb&M-#7E zr+Tky$jj}|k^$j*9-%N*CRK%I@S`LbQElBhuh2GrJWn@w(_q(M)*lU@8v-P-FU^s} z0aL$#2`fTAz5>tm@2vx-m3YR~bA#eOV>iEDTO12R)|J++=XXy{)6|{2iMfves`3xo zSqZ=HRhc}UDxxsbFI`ze-*)EYd%RT{d%2spD)TMF#STqZFF5F1@%9Oey;Yf*OA|Ho zQF~Du$JyZ!s{z%mT^{+Rw<6A?Tv^RrapOrccp2COJliW2D3kY!y!&gm`bNk{p1txN>e+@ z+265Tg~s;-gp0XGHE-q7w|G~Yj&^A*SJYrQI10@(E{)~7+hF>^ z*5k?_*yA$qO4A2i8q38LqdEwm$CVg$%7ZFvNITXds)HQMMWGHVj>9~z=FRi|M`aCZ zH-H+{!7i6w!y~sRHF#^Z?{O+?NNU@<9^!JnL^M=?d>+@K!>7NkvWB$#6E&#*F4sGX zknY}-<(+i@C?jh~>s>C5jaN-bQ7UW5x=FQT=ZT9{){v&NTpG(Y)nK@$>`5q|@cRod z)hkWOWv|*i+zsLBrgle#i>;znQK{85&GXX)R&xiy)_Y}@wBD7bG*JnSKolRM8i>!P zuprF!4cS+7cN*VGnd49_qJDvLDTaDOfQFbp#xKHZS(<@)F~Eg&JGTv2u7J^X=M-8R zr4HC@j)_#veF2w=e~6kFiQGAXC?HX6R3T0yi>;o$EWgUN@*a)}Vs5f>y_RHL ze$Ju*6lWVwwsZ)WL7T!sPf<8(s*}|=5y@*&fq+MTOpC znhLf~y87tR5aL$R^Pm~eaSxPB7Yn|x%R$Q|&{U<<6%_?Mz8`c;K-16kxg4sCzp>y$ z!8Zec5@_BwbR3)uU2$;{Kv!J=Xb>E^nGQiQI=bo^3||@Wb_JhwRO)Z=I!F!^{{^>x zo4)E^G&ZnWeHZA$7`xxY@jDc|u59v49Q1r@Xh=tu?ffq3deae~l2yRs;CWV(9GOPv z$~k#!XIMB|&#~POI>!Z};>3Cm44FKMRPN?daUzkL5KXkS_rx#O%SvhK&Q&o})u$W* za5QxkKC?6sScBlRFhQ^4*}cMYU}_^4QQ+H@lFbvvH!M)#wwvCGR6f=_Qi)vgy(33F zme*o9-tqaYkHAE|l@X5qO{n4-0>7A<;}NyWw(4l!sqJ|~@!aF)avAQpse*@daD7Wf z%O#MQIk0lg#oK*?D;?c|W(A<*}sv+~#on&;u{@)+M3nxJu1 z-{sYy(?l-lW$$vO(=S0(92Xh%+5J7en<5ppgPy3EdYlDNjZW2IYWDN_dbDZ$}}p!zy{P zQ7Il2DlM2qTA?8P-45Eqi+Yu%tOQP3DjqS5DY{go zhb0&RdCS**rq<1gvNY6s`ha!l^D9z2;}q7q6e4wr&5t6O&634JkZ8FWA($Co&tP>N z)d|`HJUR&4R2g2ILRJ^RJ+uP)Dqmc#92M8GO2~y&9%Y!j=}^!N!WVIdKxfWIB+rfz zh^eQzIe<9li^v0c3jG>pQbc6F!e-^0u5uATej$-x>LCzYJ14=ESDxKD<8~LRqSu|cmTQfymaSU zZ;j2)l_~k8mPri&|72c;nG;HiFuf$tpyUeArTt^vqdcr0gx(hmEIO61a zS9oh|F&_&a7B|vaKojL2paGX;;S7|A)HhvMU7`8`NDTeKkReQUy^TG^w z7FZVisyl4+tWwN(tP#J8VOwBTj)QZGS)Q)=rzOCza`g-No>dmgOg}6u1&(zlBbVl* zq2bdDyo}T@1_fifw3BOgFHdO1j3>=45z})YNyz@FgX=GzK;g;Dtinw$5vI#^xJ}e` z(>%Noi~?2y5WKXo*ap;l#sQus>mgv3MksHwxE@fzNigQ9DVt)rFLTPQ^JE*;np!Mp z)H=22E_dG}z?H#ONl0HcF2$>JUK}v{jNx$#$VN3*SMilOJ3aie*kYK5Xh?cP{=++tNDhh!>qnKTPhswpMLT5-T7!S zXRybF!XQKGMg?V*IMDhhXbRYNL9x`UdqFyOxkaEkDT6K+5K>x<+A|Y053%im;)1jZ zUu=wERNDrRu0r4!viFAa;!#|v7}e?TXQ1iZN6l{dO2%*;<0@Jo2CXoiE^SuIX7(7+ zOiiaN%5?8E&@4@-i^Ymf>neV)hJG$+J~wpi22Fg6{nA3TF2qj2IDAxYJc@&}*KfhD z($EMYG;yyu_=v(iz@G=YfgJNdu_INwF~x!~S_6L11kH1XjvcXvZ?j za>Ex3y7w~d_65ybhK|Kc+#4J7xAG3-I}?e$kO>aux;Lhmq+-h2B7HbV( zVL*uQQP8~)nxAtg0E$VZ{*DdAgZ|cI%(s%`J}B4UqF5kZ4u?e>Xzn(91#bBp6O>V+ z1ErWrmU8q6#qyYKHGzY#LVFyYgizU56BzE1S?ETT1mA+7zY{?>(MW862ZS`-9O9^Dv!brXxzqqqfYfROpb&~GtPSV}bNxC0&lJ53S(B&W=Kj{P=HlH;D5#0f{N zXqBgSS9qo1I0OV7D3Ed^LyS2Vdv)iVz+}s|IPh-n%E3^2i{if9W>9PUC9|w76++O+ zMZz{(Z;Yq5X~0a>zHbZf@RT9Bcbo`&c_A{t)DQSdX3S< zf~zf0Huy*|+^C__o0531NSMpK<9u=v!*K}tmG~lZ+1(m}7DB&DpbMa1EfCiPt`Ue0 zg%+O=09`A%&!Ar?(0(CYGAR(xwJ6;(7y7OXvFKedbd)X70{0N08w9u6g>-$<6A2v0 zWlb!ALx`_!TGSSs*cKF=>vb&-(phXmzbg*e<;g_b^n9%70jCS$7*IJC9t9V|wQSF3 z3pHZ8r^J{1GrZqWy*tOE;G}(9CX+y~-j4h8>2uVPu!j@Pv2tzz~_3s{cj*>VT%UG|pSa^JI!4A)5`kRmNQY4<3je;==w@`{C#^&L!h=f7ewmsUlXLo?U&7FG2-vmNYvgv-W~h)z_R_dWj(bGYp=7V z>5Ny+-P9>pJMOk*@WLN5Hqsr3?8P$f58SIe7oe(xedp=EDj$2*@7gjS!_JW)8xF+x z@I~al)0F}>L)Vu5PC(j9_~U@I6@LZLYJ3r=!?oQ7=tjZiASZ4T=m0?97l;Bx zKM;r_-P-P73rH*EZGg08XEpqx(6Jh_l1F4eODp8tE(hOtRo*HW`YOFbuwl)+iWLWK zJljnvIZ|++g=z1tEG0($T}R%kCxt$}``|<36`KZZ2TqoqmITeCzKYv<0MPCw=yJ`7jz7MiV22vdrfHb{V0P>C7GEzkI)=QC!eA&E9v~YK{H-7M5MtANfujuFGT@R6Ft>~tM zjIx77$NM}FTC}k{Huo~fn;yw?cppdG1P@I^WokKk5j+pmmM|wLkW3RjN`q8NPzj|u zS^-LIIpfhkanm4aNX_miBRxqWE5AMvac60aIAft}J386LEpTxx#Y)GrtaK91U_NuF zUba;cNsa7OJ(9qFt_eG?ct8Yk(!fpCXuzVsvFK+kG}O{JUcX5?EtP98fZsY!8Sg@8 zxR94a({Y2z7A>;9VO@dGZg9H;mjaV7PvIm$-l}Ghl%<~K?HO&Q*vT$;%G)^n_76Fd z=P?J?><>~jyD!J36iA_N*&S*cQ_*&SIXpwll=kq*jl;M%o@v7wS1D#(_V$sEp`O#? zs1n@zLoUnCIA zz2eyW{X}qdOI^7a&|QLi4Ej$6@>1Df^L_P4w%SXXx}~z6z2|o=pLEUpc2~4am6~`J z3;JGH8QOZno;S*o`KbQC=KwIVrhHdrYD;XZdrF1_KxWQnc${d<<;#|<*bz$dfOGlI z`(T0_$zhTgJ6S^Gn?t4ekuB$)9Ag84;lv)LSP29xBK%6oUNt-xPjLlJn!h+YB7P=M zHvT2Yaq6Yh=){^ypD|0?t=$pmEqAq@@|o^3%VE>8 z41y#_xb}fDYoO1-JkXu|+4x!E6AqL`_~eYZO#58t0^YH1*{tsPCC|BWz*Uj*J<@f_ zKyT3RO7OUY{ttFufMQ`C@3`Y|IQRg*h{&_77N`{ZO#;n=uEW(c0sUNXjnID~5R3LN z1!7fxP#~71UkUUybmAk|B0WNo1b$~kokXG;&F5Ojt)(Xdu z0Hp-V-ZcDL>`w8^PHCT5hSrqb;zctX zg@8G~2?p;GH*HNS*X#o<3iQWuQ(9ZwansMG`|spHsJwN{C0*!rN0?Kjt!_gMYRwP$ zhZbb1XCZB^+Q9;?zznbXcDZ0P7B=}Fn{^L1hszsp<~;|7%jXkU*>nv{`e0MOPC!uC z;fpv^px-VKv%5y1xzMWxS`3|aGa?zXNFZjRw&AQzX9 z&=mJCm|2)2vcj%77)2#5@W1f45^)a6t|N0suN;~#P!xKuKn2iy2vi8Ymp~=ZIrs=U zrO^8dlz@JqKvSU~EYNJ|hYB3hGCPNmb3XJV1ZsvpRG`(+hY55I^brEx2)#(4 z+n|pU=q~6CMM#>IV+C3Von z8|QHVLe}uV>^GPa98~`QDZwJ3Rp@_NVKC9vGBH&jP&xW!9J(3OcucflNKF(69*1^! zc#7v32Zwf!i8@n{iAJN&G|?xD-rZ@CU$DT&$|~Y<^`XN?6pbo5_Jr{hD%qrQONLF} z82oa?aUy=lfh$@|j(EtElswg?v0NL4$KDagG=q1}&=vc=57$<+y;-B8kc@&$WxxAT^h^9aXl5wk)C{}>G5ZOc%*k4`FfYea-D849PorgoOQ5ltv`9~ zP2OqbYL~`xH5p7F;cB3c@6FhjA9<&dFLY@v7dHi{_QR*|ijd^*IiFW~r;#~tq1w-} zT%0vivDSw}FGFX3-+bS%cX_9gIeVh&>vCOh$_C49Fb(xIGRuaQCgo{lC4bn|odbl6 ztrkoF>is4>$TtZ-{%0yZy20oO@46@84gjDh^cV)=DUyd zPAtb=8XKO!m{_nz1Y_ZySbo!`v0N{Ln(82Y;n3mmizVrm(|+IPoml2Xg6beQ?ys46 zad3+^6I}FlN4Iu*QJbOg`5PcnmM92APG_Z#o%wYkpheuXE?VVUY!bhWA-3*5F zde5)2V{<he7d`#dZw7f>qlHN(GQko)IKb8C zpos?#_PE9$uGy$#x;W8QHT(RT*PYQfoS`dXMz{N?OmxkAFY`$%%k4rO5XaZbE1-M4` z`P11)`M8Q?Gn|p_ji6u4EmC+w~YS8MgQ&Ir$(49wO5 zW?aP-TpEDap^Q?Oj}N3Xt@g{ntj|b|PXb{k*W(#9f6bu5K;BjA3CBHFDdwNnh+oBg zI~a?MC&n6I1p(i)oE`BFCm7y^$SaPDW9IaV$rG!RE0)(v(FP6AU9gn&lpoR zqhjLZ^66C-lP65^*#$2xo;|8?EM2XuPBt~vqA6Im+?RCB54MB2Go+yw_iszfenD+R zJ#zrXM?g1H<`9rLIrWrrCzsFBJ3=H9jvp;ISSZ>{VmYxRXM7mlx+OJ5_4Cg%J@8;A zXmw*<%pCZUBXC5H%!)0}iY>~Djrp;G3pa2_vlPaKQuGYyg;&~I7RvJ)mf#!_QbeAy zt*Un~+F+oiFEr&I)iSczsDB$nm}_!I^C$?4bq$(-vXNT>2#xm zcYKiU8PM!VryCW#0hx5XG5f%70HD117MqEh;z{={&`e0D3!Ht@#lO=)Q=d*3E6j** z3ux@k+OEGNgO|*3ap7LjJ(lj?=&^+wGS#^&x(zhrC;q zsgrc)b&_sHC+HZy3p+u_W}qbt-H0)gs<>&i4b_l_e-fEuw5l_6vukK>EThW;vn ztgMTXKFLPd8X)9FzFiV+A>YNnxnFSc?;k;*cm1OfPK-mQ6ynyo&ovDacARCiLRrUp zvM{Mez1awIODZeLYI(VYfI(Nt3$!!~UZ5ulA=BeaV&@SCW0#R$vpVadM;LSwcW5VY ziM9&SXh<18B|i|*x5Wn=r7tC4{nf}*Uyb~V0C`4gREc#b($^ylrbc>FuzA&_;D$z< z=eu7Xw=C7pyNufAPOWS!pIw=nt_T&*mDyv0=XXtoMPAsV ze3I3}zE=z5~Lv>|s%a+@NXb2!q z0!hh)s1{E^#I}^DcG$2!0!cZ!eyS`pxRq@eJ7r^cG!31!;Bgg46fVe!9*9#$=R*W9 z^@=_1NXf;ET_MCk?1C>Wvj%D0CIHfk!G2$HwSY9f7Xi8oUqns;TrJS8(615bC(wPV z;oYAm7fQ8mX&ReIy`*u3A4j-R5@S>l5%t7T6__Q_47J` zB<(%l;0dJcl0!rc7QXIpl64~l*CC#I14>G-5M1 zz1Y*=bMR^GZV;#tdQu>cZoVtfROsgkG~2~32Xukp&UbOw0J>OkH@dh705uD4or?p| zDb){DC*TWlbsTyy?|i z@F=V64|s+dAh<9QH{6FsjS7-sM+GyIz(f*=0xDJw5Q3mUBAKYTu$ZJej!|oCwXIsM z+S;nEwQ51F1~)*hT5apX-%71*iK#7ah_;&V_dDm_`@ZkYpn3jJ{r=zcd>7{Cyyu>C z_x;{;F8MScNul{z3P|&Dyu;N1(tJG4;Q;i=&}Yq`+`N&_)8|K_ykW?iH!}sw&zrc< zheF`jnRi-`f_eA9t(S%3UI@4I{EX(17s}5$pwaw1L!kWp%<&}eb7%Rlc6?8TxW8e$uYEV}|F*nnLGe8+LKSGF-Pk53hw-wZ*bU28}_XV<#ocr&ia@ zJY~)qwe#!08@@j5--%%b#Ido@=*NHa;?V$8t63O&oq}`x`9EtO?_E3^=xE|0y5eOq zgXs;}<2roWLzj6MkB)RSmaEcW*vUk~gXj@V+1?*Dc^8jnI2y|})?l#h0xqto8HanG zxc*n(#Up!Q&x=PI!y%xdVexx0WV*bIM@I++X)G5DkcR6BkBjN@E*>R?f;5)vXJJKg zoc6dFmUr=p@}e}nc%(6u2>>u$UU*y#%Tv+zl;QH8K{#2N%`*txcOhc>DW?zcRJ5Ju zXlz*L7z}4uk+7f3yLi;-Xe?JRgW+s5$mLx;DsnWIYd?eGQas4zT|7F((O52amo#ja zUT!cCy^BZe3}}j79-gBJS(tfT%tPwXjGJ%x)Qv(4=D=sTzC#UnY)!Qlmva`8yX?IGV@z(&H{Ut*1%R&nDl-o+!vfQA>3 zlxv3xYj0p9Va_^A1MQZA|@;ZoZ8Juq|fFz-^)5B)T7#jcjvI#fr(9r)s2)Yd(}eX)0`=siD;z-tU< zKm3h^*_j)UafQf2SNLfHmmc;PE<0@SdXQc!;w2Tsq)#Qt$28+1YrB`OjrEVd?>&QH z)h*fLpuQ5_FI_pW!TsGpw(t|~ahzj6G6IUjd9e;Wy4 z;`nLZs5AZyBF5E?Hy5qgq?d|-b`Ld>Mq@a}a19o>1D$$Bx_mWxZ5{kI->`8X`g) z#8%0NU<~zA5uIP~(*)|qP`G#sAxE6I@HOA1qJ**uO@QlA;nG-RYI#7vgM62YMk<%k z1h@_haE&=~K-71sXq0jZO@Qlg;bK|QOnm%<2Yr`{Mk`im0$i+1k+6;7_7%sE@Lek6 z5*0>h0$d!~Jg#4-hK}`JDjF+HB25y!m~~`;YwqWd9_hPOG)}pMCJ@$9!e!GnXvn%> z9wjwOu8wgY1tT;8F76>j!W?I59y_VevBNyB35pdO0bev3FdSccg^}oOC!DpCn9xox zFs--Q1_}k=4PbD#Cr6y(g`>GFKts3hHtlSmVM=nQln z3~xb0EoQ%q7uvUxi3=d|Z-(gca{m1g#asI3`AZhp@ghl(+(YYuJi@C{i3HHr&TEDu zQqRE>=iv2GR7Aq^bVA+BB|v6bL8J$pn>$mk{!>zLcPd3Iz~A z8_$6|0rxIuSF>C_CJBNVc>yJO*CUXp>PdZ z(lyLL`*?A%9zc-RF$Us^%k>Sx@;4q5AM`PZp_jz4EKx&w+r;=ojC=;zbM(2|D&XCf zkW|B0E7xA9aljg^ni{lmnbLPK2xYXn2!B>K*w)JY8ew{l z!!Ih*zT6Rr%A9GUKx`{qgGYr%aSQ^eof^)^_P{U9SAYYQOLD%K=6o;6`CgRseNN6d z*4F|5>vO)(&iTdyIY8f#^L=j4_u`!I+$1xl%s<^GA%rh+d!bS*m7i^Y7Sfunh?GA@F!shfgY+sDRmD2j<%jPW! z&7Zd*eqLNI;DzQdi|ZY5)-OvzUGH?0W_3?!b%j4J)jLSv70LS8G z@M-aa_=3e}uGLr#{H;<13ww)~oo!OGYkwK3kQFrSlE3avOBN*!d-q7V z3^x0gpB3G;(c83~4h&5cg|1UsJCP=BBpip$xK5aI)Scd@C7T|N&ZTsVKx@jp~W-%)?0WRiKB+TK7 z=I5z@J+GUV!Zlj4LKEO(io91MH+*YDn{HYPms!jTO@NE}9SO6E(@a=({_Ebm5=WcG ztk49w*kO87VH3`r81ua=VHUGO6X4QKOAdcD)Bf=C3f;7n7@Ebb&;+nXc`Pd6=^t)lX;mBDWaCVMICVD(OA3b*LD7lm?w{qEe z;D#bHl*-K7#d6RQ8t;X*yOj%Gao`Z=Y+1<4IP!SDW9h%yp@Vg{x=?qhnnA_^|98! zV?ax_b;sJm2t_@jLZuIhrXD7HrOc=|quc9ntIRxYZ^(%5ucw8+?N&rOfWKGq_vPZR z2fiwEZwK(XUR|Ut*XFX!7ktIQfdAD>j2sJwOJO?re;564dFuGemUp1W?P)Fl?&smM z5iV7kPEmioMer4g_n5ko^fBAMh}rz`Z=Y9FmD!T|ZhoijC15Ht+mbC?4nY`InTndKBc1@$Y2}#@THXeGMI2wH zsUvWkt)he)sO*&{M&f)-Nw$k0VQ7+Uuf8vpQMJ?N=GAZLeX{%MR+Op*ge$7+g1`b^zhBK zw~H9R*U-`nkRmN_fD{VvRjV9H?*%FJeaBlqD{3mjrK0xgxm}GdpFyQp1yn6o&u!`r z>aJv>0~fMRifIPSwY>MX*r`>$L$M=>I|4Yo7a6adu)g_qJVRF#N>4<3 zPD8`QN73?wPRy3?zU{ ziRSlKSI=F|3|U>(du|wolFI((F60Q5v`Gd^t^OApQ7YRebwRWOW zLW^Wx&6kjoU0QJ-#s_X=by(Ndy8^E4CjG8gNHFd90o{fQ_M004qz`kxK{;8rjX2{S z0wF1sWrI&}Eti&sVpseI$kYa@HGt3_Ub_~$*LV4%y!VT#_OkBu2RkpZK;izIRUajz znbHBT0-5p#oXfLX z|L8NAN$4rTkF~O0OEA_GHmwd9@E_rfXszX+TyGrFFP-Z~>swm~xLBPoJVG=Y!gu=d za2YJzLsZS`)`M&A2DW(_I9T}I8`gC55Zq)^tnGK7cXvOdeFSjywDZA#I}|nL8g#7n zX5hOHPoXWFej)RLEfoojmA!5E&${vG1ob1omyA91rt4;{W=o?A5o%Z0JjFqb>cZVH z2-S+uA}6Hc`xKyJm*eLeLbjcmfDC7Py{t@MBMPLYu6Mvi>N+XWzV5;wVP?%)sP%(R z5{Pq{rVjKrW!3bPVHELH%!x-QB@E=ott84`PftvlBN%cz-@5S(W>PL%8gk>3o+AK| zWR_a()rM!u)Q!RNlAZ=7V@>l-o!ZI6zttuZ-vcXKRu!T9*i!{TJX|T7+q$S&aBfc|5aG5JEyTFA|d8QP&8scKD9pr7FeIEiP#tulGcL9$b zA68*ZjM$9#5a=n`T$V&b&%@?YBO2P`pdAk4gh*YFa?oT4F@oya=%8x>aS;*?-35qC z4Ll=?E>rdrL)Cz|Cln1)D0-kkS32k=KwRELL;rTrLnt9G`lF$@0r6%4Mrr(4{|m}5Kr=9MDjqxN8;-{S?rV0zC=nD1n{_q`v$KkfwaEB1<<8kcL(R zXqa%!anO7REdw-MTvs~iY6tbfn&W73^{nUVXm0CO8Wd4?{D@tp?=|L?ABGM!JvS0(nSpRt_v#g;HYX% zFOh0(S~SltF3nN#$Xl%EK_n ztr7JhBKjS`%v-R)e%o~2P>(ZupFtMa%82WawdIRKNRW`j2m@WiJxJKJ`V-3>?8f^guMQ{Av| zUQ;@aJ!Ht7lA~B?+j*PLs;vBX=l-4@XZT z-%lwg$v`mK7RGja?F9|XMf#k0%B?e#(0oUZ8B4!3UlRI0D9#OfyyrAw`~=-{l07F3 zATax&^0S|&@%N&N$+y3jJ*UyZaQ=u-_73-(y38#l*>ehRIR%;QmwzwGFA-Ild2uUg zFa=6qjC~LHk;W8KKA;U+mW0=kD)VGDUo60@J&c67gKn~A?J-`Hp{(tNrFmDt?% zd(JJmL9XY73XQ@yx4-pCDsE{eOU*zps_dArerC7uVP5?y3s?5`It5jnuu(ld-fm*+FAr3+BV&05eQ z)=}vh#sp>2d8n}pG@L`zaCT;PtxE-AEVh^zLGxywe?jFBYeC0t)F0}UOCD6$9x13Z zVJhhUYG_OlCVnFW;XVwx=A<7w!RevZ% zH#+!&G)dkrL^pC|UOoLM>F6owL5}O-G+uU0l|Y zdv}cC9F#-HyG0{L2iuX)8xOQI6uvf;Q#9N{^{N~*P zA!nw{UDu60$04cG%=EGiQ@9bt{msgjj?>n$2ednN@MS#ScA6`1QQ~6^<~rRkK|Fg{ z;Rj%o;I)Sfc3Q-Vl1zvo@XU=BuJ59<`JicJ9n*9l14wbCsTaCiVJ{TuF4+4Dq$1L% zdik7rRUYX|GM;=JGTmF^naZpLMxKB)n6*qOi-OPi`tyN0<+{Jw(a{GxoXKBgxEhAbXEJ5U{2zZ8QmV_YcpCH+39wB(7Xi z6~IfdBIDhOILNLKXCcuLJFc?@S`2%UK+9qCD;m1kL9GsIchGko^g{>T<)DWEor9lO zsr6N&LfOMy^<__DQ_GHCv77ao($X`Zyu#L}mwO8*j zuYF?AbNVw#`gj!BP;j4%Uv89ejs!IlP&$#VE|nAFs!Y|;xKw1{xiBKa;FtJ3KpSpZ zf0{Nfb}mc5#BG`9CNE{h%{ydx9Ild2T%`|BwXDR8a=LK9#v}tnT+*x`Cb#;-!Vm z@2WB{R*B9FNiX)xkxD#`Rh2ovh{58`AUw6mcXZb)rO6i3q%vpen}duKGA@awry&$7 z?T#`l2eN*cm$9o5A8ox%u0r2)kkkl{JtpySU*b!?L@fyO+8CG2<*xigr&whTlM2APmCg`#^X!TO>cyP7ZAnP_V#h0Y^WA;_~z^x{I>=2+`&U<~`~UW#K^9H8ttZZe~k zrkI}efm7!}utqY{_(f%NTp?CyZjj>01ors?EppJ+fOLHS5ugji^+DKLh_5@S8<6_4 z3vxt#ImAJe0I6%G!=2?Iu&VK|gyH(N?~n}R5(6fRUnI<_8$&(wtm$`qJ0v3=P2B8k zR2mE?Z;>#wlq;VVf1k9-J878VXe`&QprPUPEfVezn_+!-Yv2BQ-IaS4b{nNn$a3v# z{OK!PYhe>A?ftj)o{auMj>d8=G?*gcnhIOY&o=$alhI$|Xe^hNIPVAINcdscoH(D= z=b|-w-IXzv9S~qW8U2Tt3>Z#+BjF@$di?sr8TFowJ|9%4@nrO^dUJ*l33G)_k^w(D z;17D;m0?*m*Pe`i8)#^_D2aqQT#@UMXO5rk$>?W+q2c2on#3nfN_Pj=d!}LI4|cuB zlhNPgXe`%142C5Yv0AR6T>eO=E|IPW53~d*LpJgPXj{}b1@uDBA8dAGXD|am8wvlCHh#rR z-n`6{(Z9gaST0TjX!gV}5*{otcG*@Qc$xP&$XtWv;~<(bw&v|6T(Z6gwEX*RS9>!0 z)rQNH(U;W@uzL#^^Pgt!n&G#oj6T2Y`OV%gtm93b_kpXnFVfxBH1I0#agYi}V`F%y z!R#C0DjvM+WuA=w-Hyg`mC|dNf%ti0jsI@bU7n2oSfL<|G!@XvYYxRb?KlWtw z?Y0Xa{?I%;z=XcPaIs#|T(IBvh2Fy-gB*?J`asF##5xkTTp#ay-)}q_{T+_Ra`iR- z90(WhI{BU7ef0rPMxW23(i|AFTpt(=Cz6pc+a^ut3BUQ=lhNPdXe`%XluSFMxQ-^edy<47Zzhia|nKsFn1o9w!y!e9r0xJZS6e7ab2ugiEnbTZCMkS9)w@3 z{WO8g+JoR42_q$%PBz487gQ3kyL-aofp<$18GM}3!ESSF+fxJG(qg&!GwfwoX(3S0x%CH8-(>W;7luoM2C(o&wC3@U(Fu|M=UHA~N7J*`NgLG$3 zoIN1bK~4A`XAlp<9DVq%!Feol=DcvpJa>cN#J@HdSGS~o9z+9#GN^jq^Gp(XUN9-h zOPgj~EP!x89nOSZS}Cks+j!pDK9qPOsDKi8k4Fgn9Ly)!+;7Ccph9q=>nKE*qhZ|dkAv;5yl-cYGAA$U#`t*9 zZ6z(YwGQKjU~_2zdp0So$}=%;2lUP~mUcmpr%F`dCcN1uj)PIJ{4w7-F^Gny!Hx^0 z+YH_&13WrV)ctawM*|IP-EuPpTPgHVJs9SoT(2@O6o~#5EWfeInJSGH_lXrxFOC(T z5|8asgI}sRwnr$Hg}{lq9>K(IOJ({qac;ZXpFBo{lPXOe)1;|e6pWJW=h&?@$zih- z%)PANxs2VLw|TR6_i>Wkn&`1M)Kcy*agwYtINZfxCZIw1`S$%XC#lM0-~LbLq!QV| z!X6cSchJ*>@e59oh(WcL&PYI+Gz4k19UYCnQ7PaDfFO-mPwk{zm-uY7bo=42eqG@$ z@$IDBy9Dtw~`qzTC@`Xg$i&Sgvmw z3>Ws^r2CXPA9s37{2LsN<+{*diiB$(ZTyNB4Ik|-@mD$;%f*&Pqf2})=4cjlG(Y00 z;hUsL-x9yZV04LZxkmmd0$%pDCZ_gK7XQi z8J-o&^;qUHg&ZUUWK?ayTRlA;RmV&iIUz2F@04)I0BcAron{F1e>kd+3BJR?m_3Rz z{jHX(R4*Bgf>#e@<^3vXC}BjyYAAFN{S<_;%JBD7&`dBr0{;lz$gv4SB7e9;ajK!Q zc%d6*B!3N(bmtbL8yTD)kZx5$x(TDK|NMI*Xugf#o9r`S*xhUVMh9jQ^N@ya^bm7R zU&Y&1nqG2whPU#Up?y8V%`TXM_z7Ji!CuT6HsZVO){4PudV_aM2E*+!&}}iaE}ut@ z4fw~7np^$8MlDF@Nta9bME3Z zQ{7waDN1FwjJTp8PUr?YTu`CA3h3fwE1CI2W#)M(bKikrAfQ&kKad{O*^ArcZ)Fv+ zgMF-Z4!+zpil>k#3Zk$?Dy2FqDXr?0Qaw;`kpJ=FxI>H+V4kpPNSTUln6t%N|Al(t zLv9fy1>NwFf}WA}t|nRzTwDBxT90%fjdc$OCHxTwkR!x>V zRgriHvd!DN@XW*Hxv2~eO+KhBA@G4s0 z$yWR$eNi{0nXaLDmYkk-70U(NU1%rQvU_vqX`9!vXA))l_B_o6U_JM0h{?fhwMGY` zmS|$91tj8pu3Nn3EHP)1BeqXM^b|ENlFD3M)b*3(+9YT@8*swK-k&|J%9FEG zj)u5-&2}0M(MwW9<%EhoSTw}sDs+p3e&wKz4*C-y)~9IbGY1`vnlV9e-vxAxK=%PU zR-oSjI!>VX9ke%^kmAMwnkcS(H(qf(lu>8}AkM_1Axg$7^gBSu3+@d-+W)-mAgW+2 z6IUKfBn6`ImD2GIWnV8?sIP&He0An2JZMmv`K{zNWgsD|jJVsZkF`FFFX<{igbaN1 z9_oPNAmuONR+YJQ3)+~$o4<5q22sG?x)FC7aA>ty1o;RlTvL^)-^!~dmDy_TK9ZTI z@cx85-;K3SC2O{Nn_t*)rF&A2BZy&jZC479ds=q9Y<~lREb|S^lRAUkA^nFR@c`7sp~(T zD{GZD1vWBmJf(ni?5hT(qt;>veGiZ}kDmZ4gHO@WF90P4dJT{^(B08crU|YDP)eX< z0cou4{CRa{S$HjYFyU8}cZIhyB_%JeD7E;RPwojiUTR^l{=YZe_Y2E8{Qd$J!{+Kt zwc*7DqCG^Q64>nb!XdLO9>)&3Rr$96LGdAn9r6G6&es6sA`P>_yWG-oaMyv}&euRk zV|R#jbz$_hg$II{*?#(8Pk@$ALNqKdn%*JHWtAfL0ao?KVY(6e;EGc}@OHjf<}}{r zmfi-VJ6~L<(KNiV`4(^IYgb2O!y0EWMWFTcbzM4W7)ER36q@L0EEiKk(+@w7YyF%3 z$9Owm2MdM&a?7E{pIwBDi*;6kr|x;M+}rs&%F)DS4-V?HjX&JyiiEi?I{?rp!{*+q zms{w(ofgclAv8VrW(@<^Dy0Lz=kyWDcVpC)jO z&IaV^jSJmSbBCwPO+0}mH1cty@n;X=vf+d$EgD1&dXzlD?7F-|bDWa}whMQ5*v+PH zjT}JpB-I&hBAjAaqnK0eC;lqtnmo*=JPhx@S)*KM5et(PpkdJU&Z_(53?=6g?!Et3ok4L{{1|E9?!%4IM?T9|0%x4XF(p< zg8{C>$NIWmYFUTEE8UA_3n`>h-NOYB_>o#GL+EYhTJ7b=(TQ0b5yO!pNbL(ynk0z1 zPmEhGRxlB}z67mcVvh7Rl#}Asqxw8~Yy0nhQ|73d|{sP;6Ax8M+)wiYh3)t^iB|5S~lFBcz3Wc z{LYl}2Bl+Vrt_*ny`ULqR$q_b9&F1ldn4m%w%JQ{3teo5)gC)~wBSaMpI}J1%RWHr zS~dD}t}JLI2nBa)e=TR%|SmL=R# zqc|gW<}N^|!0`(+Zj-#wt~m4WG|m=$rjRymPLa;(0Ud|Yl?CWVj0(QC&G=lML&shA zT!}p9<_(~G&d_qQQC3`9CUbG$hB{8f<8a!FpPc0%ms-c^=dJvN-lGj=lCStHvoXlG z#G#T7yLnT_ZLBS zzhSBbi!*yH(e_AXuvR?@TN^c4&{aYfBsEYX1ko9H+u*=pWaR9<(kL6}Y)V&W-lBh& zs!3?1G*TlZIx4AXb6z}lYDesdiY?g9m&u}w{XtmkC%P+JRzmCEzE$m)Zo$IX?k9Kk zqk6HfQ}BpuW!+vwtLw^#Mys<`LyM@FE=3>rfX+=?acUqeLu`=kc4e797+W?Er-8F- z6%w1c!B-Z$enTo&@xG;$4V^~aiaje?i*f)9D?l`K5^P;_wgb{N=WT%47wB4&b3#*0 z$x}4tRw`{pQ7An{GeA-cm1S71pDueFJ~@W;iItSxFuO~jIL1cIMz*WOuIdxp{aaS& zB5b>5g>3SPJ4upCjr`6akZE$50A0XN0mKPjG;}g-UFfa^q>I|C0QnPkYVwq%Db_L; zYZ+9C;xXX4Qg^b+cvbeI;>rzR!nV-%)EdZfcCWgi8oEkT*_6m}4Zt(Kk_Xk9Kc{X? zO?a(&1d9-2FxVcXoq6dDLM;d@$am>n+^MPR*O8hi5v#(6uSjWSPebibq8(@?2UcfZs5bX-unk#_12IH( zNArQy&QVe>(bPz~?F-XRiGkZntYw;q{W}N!{3Qg~XR`m9<|n7aGx8K8?mMdm8lZSA2?$md}Uq+0xO` zvSW1Y@;B(!I`-pST%=;Rua8~!UBI2|VXgTrf?(6ECb5FC|?H`hFdLyzv{ znjIlzckHSM;ZmOIE79n@3m*_$9SHd~Mce>{t&{#5$$)H)6#u#!eFDjP3l0(}Tu>o}Lar@A9c_{4o zlO#x)S-+O~ietbw7Mgc31SNwuF=+47O(oZIL`be<8FgL<5C?Wi3TLk38Q6v=fLSeV z1O2)93SFhh#74@NIt{G3p0RMdQa$tOurKwARYrq{@GDxPUezi=tfHd-Eh$hb?4tx? z5285E29Flp42N3?=mf#t0eiAQ+2yKug0NoGAWTh>24i=Jy6djW7_C zq^<)U#F>NQ;tm?>pb`fSa}X;1?*j6x(Q(owyKOD_^;$bInJ_wn;z@%9e?`($#u}&(o%2lkR3A3E-r?{O`O?e zB4I8_n6BFIAGh4wJLEYhjqV-#C+o~T6{q7Az2g`2YIhZWQeQv|hV>OsPQnky?AEi& zpmW7|DDR;wP27~J-Fc#ak?>uxnG3ObyPxO@&z)}ANrT&WveX9%!{+Y2j<99kkRN+* zMF@eV32^EDBHIwnWphf;_PrHh7HmQj;9~3ZUg?;7)u(g4{l%k4idWJZX|3aNAPu`A z@0E^ylY1RROsK&A;?lhR#lYqwc=Yi<|K=e}T>BUSU@3-OyETe=z<%Oyp+^Mi%qIY> zQLeM>C;lqNzy4HA{;s6mqb0M3C3`!@FXcMgd?^j>n*yQZW~P5*&V)`yvDTrri=0FMR4fuOe2J3Wb;T=Oy=Os8;BH5@PSTCq9=vpe34x^>i?^mRxwA^ zR_f5A5C7zNUzc9KgwInHe6`PcNlBPx*jjVG&TH~*oH?>WI7E<&6FHpaX;aLJiyZ(% zPGuq@mTtgCU|vQc)?Q?|S;lmjh9jCAB~H2-7m%r83aZOh3b+3J##*7{)>+;B+BB4< zH7%hcMnff!ClMCe7Ew7le}!CMbr}KHL@f$O64=+iRj(kzF@-XfW0c zGSx%!#=txK^R?`%C4#$F4~qDL^!zeG^~lDg*DRx*P(6#N<;%c)Z1RqR%5C4-Zdz&dn} zY*7I7@HudS9)2thg-9&kM*z`aIkb28(DuYU9NQRJ(AxD-W`jN9w(EPJEJC+`6~z(W zaqZw$Oj*fuYvK?%aV4S`GWQXv95&~XdI5}sa8#5Q?I+NAusOF>-8(wDYQZ-rXVK74 zU~|4{w=nYZWJ4fNo=I$$v`XTUrcv&>1>>(V9F0&lhLwOchBEy!3;n-_IhLRVxaOpMky4_U5=RSxX9-c_9WyNuE_HJsK;_Y$y z*qs)pLQ7{bAT1s40ch#4oHXsH0@AcM0Ma$;3P76nHGs5q?gZp79g`ob=qHdL*g`Yu zWUZ5=YdU%NGe4bLePx%(YI$MYHFhHaY3#Ue)7YH^=>KM7o<_(tEGpH}!0FiITl-D& z4)rf00gNZka=0R7DyY+W@*ny8Z5MkJ^WlyrZU*Xa7!0S#kuZBBhBd41_Dj8q`8-Es zxpexZdMYAe_Du}yiQ*klWRA{J3~K-lC+6tjU@jM1*Nk>*uc#vVlYiVx^gT)xpu>8|M<*E+Q@MBy6vy;gV$3jQg#GD=Hiah;^v@C26lzjwr6RHF=NLi#Fb}hhe`fi zk3XACPW_*a`eV4o@0o7{jG~F$z-9u&KQfvpCIr+Kz6ty*aJ;WCskD74-S`9-`qr@a zZwJk%TJdEUMd?Zt<1G>Xa=W_{4e|jtN*LB^p&K1Mb7L>|KcM-@(6J4ga0BW~cL4td zXtr}z2t#tE8y8T+ItL!qV0CIWTymi*bfbdP7lykpR)izCDunUE9UV9%OJk;zB2A_TdT^#>Fp3Tjo@_9SIsM1>@p3IykH2 z2zw3a?lAtj_$9^!)QvJ7KL<@m9^J@M{(NCQc@{K}anOUQ#ZU8PeBjWR`Ip9U{33^B z7#F|9xPY2nhWj39x(%I+-?-6%hQv*|ei&Z2a)^at^_OtR1+}%-!h`Xc_}vgEm2NQz z-RSYGBF^yk?vO#K(}NYoeA0A`3chI#x|fFFH&p33HWfOfW%?dERB5bT=!}-(tm^?C zw_#rB0Ug`d8$F=oxck>0(6M@M?*SeAvFKs2e5O!(Nw-S@x)F&{fdXN^6z9+tI%|%D z?oiNG7+Tf?ch>B!Qp{}G)$!mbqPV%X;k^exyI2=ol>3k7-+_6mUls~#_x zvdfD%RQw0$K;6C!+XfCCHqHJIlD*Xy7gG-0Ht&07W9FH4F1f5F^UAZ$kjXf6E0VDd z7q?4zaXT&*;R(DyXqQi*JRZSGFp2FdJ#nHvvBL42FK-CiypdCAc+Nn$CfS^Z6#naY zt+G#ZU&*ts-dY?CTq~X|Lu$-n^+fnpgFH=8i3kPYL_tM=Wh zn7+dkp4T)s}ypCcO~$ds1j$wx(~Wh?;h`1H9M; zGArc`XjM_s*NI_LY zDd*l86Ot|e$!VI&%$tlKq*Jt|X5Ke4U;2zlQ1t0ogxrdswpVSrXW^TjbyU?vSnzhUK-eS#FG z3qU^aE?1-=OVJ6+kY0XLxe9I3hXTu5_obfTvX2hF>q3a}#BL^F;<^s7O(_T45?=qiPcs`m0S}Ex97Mi|_%|@IJH~4? zQfQBZOfIBBM)-9Z?$DK?uMQV4M*zCY3(==#M=tkN z+RoimdTjrx;jSc6YzWzEdM|`>E&EhVUYjJYR zg?E4Y#x8%Sh~s!~cos_4?S;EPPfY55y8@jq?kT+>T@Jc$+yP3w>{N%d!=~ia&?tDa z)Uh3F9SB%T7Y=QkFn90d4mtdZwXVUJ-rKnlVI?<&%Mg}4S=o6u5ggcB-v$w>+xS3; z?R9V?%HBSb0DpmKVwAL#O5DriY@;#*X}0(6K=}w$@)#|K-3ktjL>ypV!;8fx`%~Fw zJ9$e@cm_h_ObEKK60)%y;}B~nYRR>zh`1ILMNhVs1dMOnP)5bi!row~EQre0AM_*; z-o24Pz;Q(fI1t#nw~#lnij8d@kNruY_i=9xb1uZ!cDcC$_wjktx`F|>T)H*XJWjlZ zVB(i^_x5pLeJr_=%cu%3*%Jij>=5F!)n<0vUj0tyiKLMxq;nL`mR!~eW?f*lD0s&a zRyz~9UO@WLO_aNbq#{!8e7ey@eKM7}$6EUVqXU-Bt*f{9VT7g?38H03cQaH{n=dFP zC}PQB=J1kCHL&^a#>&{$kAgFqc?OfwxGU1!9PR7RldJ^Axjf3CT=>ka-d2`=e)2O& zZr2zxPTOl-v8&7A=Ffpr(o&e1!})rfqmCO@IXnBEsh+?LNiEgmk#xrs#tk< z=e4McXl3Z~O|uJ2v%w`YDw5!3RZJwLMWa3BG-~Jomj<1lX7V+C0`H*dydst9%zTz~ zuL?uKf42HHNLN3`Ig8vB!&|&guC}cRYlhA?)B|zvyjW_)bAbkZJ>tmJnpz=6dj)ZJ zx@jt&z4*p-##+Pl$uw$I&F9epNNgD$6YW^*|F9~x&)$f7`;PIRymtbft$1gmw4~M+ z4wTZo+OC3w%&9vYflO@gd=3cP)5w}{2fRYVdEJ-B)*piiQP}}~_Oa_bsntMO9( z_3Pv7SAU9L;&M16El3d~!)|EyJMcwgiRf;V=uYGUDb`kmWM!-0Y5BBwx?jtuc;S9N zxouNmNud%E_o6Ec8Iv+jcjeXYT6D%DEZYXQ%U+@|jp`8|YjBFEQm{ zwY1%7Zrk&BidVmbymFN6|Gu*0<->c~>WwB?w?7eUrO51;cB6rg@LW*0T>5-*tZfbX zkYzUecS!cr-NPb#6Ps*)>ina18YrYM)T9eniaCm-U!y0^HU#^ZrA~#1zO9u*`$GB; zg70BenO(^34FWi1{EQQLuMxIxWtf2r-m$BH&zM?u0#ANv)(5&hUPv)rC`McyxN15O z$E!`2pm|_LAwGUthsZllwu#$80$Hc6SocBPi!=Up#&^(+Y~oBB9h=PsKmB)o^s-rU zp*zWzdf8cz8_ish+8%`2y#`D+Qb})^!l?NYOYHiNineas!kbS;pNOXPQiaj;0*drx ztrvhMu(Z)Zy8g|REr8Five?k*@ik%Gs_w!h)Ko8%%tEPS=P8d2AT6EWLuU(rI{%KT zO9>o~$1f`LLoUvuqD}Z3fu4eWtw8U==8jM_v_nzs7^secax`jybV0O$dMb^v-%pxugaCLqv(fV7sB1JZD7 z0o^LD?GAS*AWg^50ck4#07w`9|KnW$>RfyGv#v)1sucf@0i@}u0HkR<7ts0Q+6?H| z0%ZWL73e#F)(LbgAYF^y1?XYHJ?d~zI-D*=PxZgg^50xgw@AQaVfSo7{Y{~t?H6UK zLT{FNCG%osRwvmhKD~}XvAa+Dw3coRjH~gLJr-KOil|G-_RyJkITGq@BbDhRd%5T* zn=dHTsj;_mU3_=fOiUkiMri`G;}&|?adwc*^pWc)6s!u|nJI=}1@_Nnr$HqM_5+2M z4f{)lssQQk1HZMNFf-JZeVNwTTLE##6AirtTj^%oJ6)w*XP0V*VZV0+dMMPT4YbX) z0SQ>>TNvFHPOr4%0GyU@U^B)bDLL$$1f~PhLyNDbo<9=2593zFB97{pIJS7rr1@U#_Y}?272xISdSmYFDgPDOl36m4d=@9 zA9ZD+sq1P$I)t!$(c*d?kZv5k14xH~F92y*$sItYn+j+Z@OY;Skam!>gDQsfcr5wo zWRPLH+xBv-^>Tm}ncr5h)!;q8=lr^Xm$=zGa&Zn0$|~C4E6+4XV^^~%Y>9Hd(aO45 znSq)xEd^0JhYeJbQ+yjUOq+qEAw4gvCtE)6l|HkpA^B)h;sbhH0$%=CWVTq|1m_M? ziR@a>HIn2R$usrYW@yIgItUg$Z{Ev`&xWe@;Rq$vH4rXgvzKIWSdeZ_bXRBohIX5s z9ZjxX4MGVh`Dh#pXd>4d=7#{KrrEtoVVA7yRq`~yH%F0E!P&BySIhUUUvEl?Wv;{vtA z?ht4bY^^G<09r4&&9I*kh-#mf3Dh4Dt7%lkUd|F|FmUq(Iu6j20-X#fBM@(YED-2y zKu-z8>*Qw(bUC1>1^O;i!A<8NtC4!-eMmU(Lx#cvu7yW(zbB_GtpeVecwX z3GDs?mBQXbpz*Nx5~vLJz5=CS?=Mgd?1KcNUvYuv!X6^fBG~M-!cseq5NI{*VFFzN zdxSvO!X7Emjj+cEbSrFz9hUjVu>!4yJxQPr*sPu5&_>u(1geKTzD<>H)A3JICl#`D^pnG8Yax?z!hrgVJ4Z>eGn0=$LV2;C2 zrMMI-a=6_b#CE5y%w~lKI_N+L`7fZc9`pRhGy3u0l*wW-&@d^HFqb%e_;uI(8t>{S zi-jhNqL(o~#3?Tg=HuXc6E+c-Z~W1{-qp_)jwWuTeg+r}Lx_Z#GUimnj<^2dUHzn@ z1RCmdiU{2sRv zXe`&KCV$vYg6Z-eE9-VNmdifZ!%i#`J{&ePHS&vFKlUCg`<{v69xe~LT&Ed;UnI<7 zorr$DBhPz}l~I&}W`N_e&pqu4Y$QCDHr?Mj>ni>>5ujiE?&8-1ypnQfl=?VGM)m_ z>?2%$sk*~}jfCT{*=DZ4Et1+t+BZHzNmE`N7$RYRnR*YJO?5OjKF^v|u%8R2!h6u{ zB}Zeq{%-PcKjC@{HsiD54`;sYJ!tlxqp@7nVoSpTD-y0njpf_8 z^k~HjO@M1K9K2`i4mk6X^@F{z#weH21h|F>m#I3TOP+u3ks%%zXSOgx6W|&OY$R;C z2JAO=-=QAYIAM|pfwXMuO$i<;|$r`P0TWwJTt(a<4qe!Qi zCrzvLFpCHpqcn9k;=n5Ao;2xxh@Y=lE<~udV;^|Pyalcxp^tQK94J%m#*48%#ZW9j?eQMlNx6rqlm#)cqF}%(6s~*>@60Tb6&%Jpxe+l?Z$%&>#^GrWsL$An7*Ty_d zcU~$!$qW6iyg0AT^M}W?)~J_OzMELZtjKE@hvk(;ue|u&o>!y(l84zh&mZcPwMM<1 zkw6oPYF>92ZTlm%}hN{f0 zQOuipaXuiArYJ8rI`e2UdAUJd7uIN4m*mA~OdidLdGUEH&*#d#lzx#HpQb#_zIj|H z<5&y{(YTLN79qFkPUla0}8l#G*vqUg0e z>eEF|}#AETu1-Xa@B7}tm4a(uZCs)s`J-NPaapU6pW$DUg3mZ&~B*y6r zL;3FK&Rf1%iR$3agjX!9TfU+Z+>80nV92C^;%+Wm_+j)r3Vw2J&5X+FvqZ%2v@xX< zYLit{XPhjb$(hp=wKHd(TseKJ_dRP)O@(}^*qi1kcM+__+~k^R-flxctj^GKE20n{ zPkO>1Cxi!0m?r*;rEK8hWebowA&Hno1jS$^`MB<@uWQC$$O>J`fqCl5GiKM+HY{II zzg%(inwBMM=gn^t1)Xu+|{%!FRj`sH4I z5{H^;lV^_OLz2@gPOhz-K1JR}EmeyFXcro_y4qB!DhLs*b(!QeOR&@#^@jQ9_#;7gR+}Yw zPBpzq8-{7I2Bj<9q1yH&&Z3m!%X$-3k(}q%T)rX=wc-g2ocd^`Z7vj%RRg-@$To~@ zKkAN*uRb`v7SM#@VEVlvSH}gB=o3+Mtl|qT7W7@L`e^W|L#h$Ows&Fi@Gd?oLaXcw z+o~vEexlaAF4UqeL(LxSr7lqIac0v74f(*m0%Gkg&eB4qUW_LYIJVds0LO`Th?#he@-J6D%vsaY?O^hAyi$Cws41uTTa!(WH zF#OcNF@7>Ru>CvsP3Chy5{5HNr7J})d1gKQy9G40`znt6HzwS19u>mD40R@U&sK0( z3x?!M7kvHi1klxD59>Cw8sQd)(v_B)JruIby`3iP5*-kiPuYmq_yt6PLmS{c4>To% zl#X*<^>1WAA@cqx_tQa>9;|e`JGy{~v}&pW%{@buj%xz-Z>-sbQv9p<^DJm?8>-)& zy&JmGZp91S%lK^q%?}P$I+xF5#s%_^nf@wh`m(@akWC`HJ7RQDNPjNy2Y}{cLr4G0 zifhXJo2o$JA|r0j7#e=l6q0#m@juf8I&QJOR)B8A*iu#rXPAyo(Cv4)qHH>HFoo$*9-a=5JeaN-U40h2>R~TgWUXMJs)Cdgb-Gt@@2RsJ)r9cx}yuwjTk-B zY=~+oW%x4=bQc&}*84)`!Hw`A7Vs}O9X!6ew*cJ;sLJwJEN0!WLHCxSwfQ_EF?y80 zA=QBHL(oh<5&(>i--t1#W;-4eu96Xxe#>!1kJ)>0AOr7M&#%?h{Nqipn1a3S^sj&V;9i<(a-=C zQ>fmPZc7j8-Yq~kV(j?5cK#9QhVtYN#>NkN=>63%G#75;L35*_v+2!E2m9UM8ybLO z3Z;YN&)<4T*V#k5fAoNk_5NQ4=thj15XhIgp!)=LrydOeW@qW$4Q}5yG(rfgP&je>MF32WXb?dI=2ksZhJ@5B#Hs zhIBNA(z`40&-Re+4?UohdS8GJ{bWF?4Z4=lyE%0JSBVoH=6$jpK~!^7%w8SE4Ln@4 z8*J~k@k6drLOsB=RCd>`Om-@BY}X`vNiGq%rq~Q;pLlb?Z572Yf9|Wg&4g;$2v*DHfd|Kke;Me*c*Syq370SH$!_Ug!G&@lryOxxiW7_D=fT%4~Wl z1n#!ST5lIW`%6|O*Pe|pdbAWg6M6M4)_M<66K^2cb`tF5+HV8VSp^WXRM+E=%iDnR zh9*)i`%-6{y`6j;a#3rP6|tW?X&B1HRcfR)+up+(h5D#R{Q zMNZ%eS6Y+54$Ga&zYA3#I%kU$+i|H?>kRYYIeJD3o+)_5qJaCoZEbIdng&(T z+THvu+!Wr17)kC8tg1te!z&)`6}V_w?vv$$W(dF1f~wdHy@W4KAL59Zk+?d(N9Uj54s3Vl2LKpjywMDQE9Kz?DI7HNOIflg)UskW z`GJffBWka@vh>)@AZ(+8csAKN$)&8EWg^ebxFag^nWmkyeS8Zz(3rGz-oYECj~B!9 zuF=-liQh$ceMw#6Lb(Q{o&AL?39u^jp{4U**mW8%^P+4^s&hLV_71gHPr1o0FH-CUHvXb=0YnEE4npkRqM@^3Yf|a~sq0ce{-MWdFG*3p zp^Vx~+Sz1{OoP-i2rMFdY!kW*Qn1J1J4m+ywK3Lu67U=PqMl&fSye>A+3$2fF9;Mh z6s>=RZ70_DJCLm703&%+ndvKxgMqEgPA@a9tuixJrNZ|IzAD>LT;29wthG0ZS}x_- z^cm^|K=$|l0%-iwNECrg3xH7)N?fG3xr<~ZUdC%IR!mxZPg3sAurik-9uU99liG}r z_yftlWc$><$(9ZM+d9f)l{=E_yCcAaQ*|%Nbv7@w8xR>v`a#VE1PI}aURf`nfY)Dk z#M)M=^EQg+3KJd>dRYJjN)em?RiLBbE1t(@Xd15gXv2(uNtoto@X8GpEF9!09!-Ku zmr#15Mk-Umem2&6A^d>MX=z1v%6KdKNc?QUR~MT^5XFr)d-vbI*=?(i_%)94$vkOs z<*|o4@R|-@u^K4j4Di&XyAI7uOOc*3mo021C<>^2;SPyF*T}>sRKc$OSiGpAJG%D7CqELKx-iYD7PzwRB}uh5ik*9$Tfq60 zK0VcL5^cm?f}I(sCY-UPC=ui&Q#56r7eSUoERz;UpyDaZc+QjU)SDaRLpl%p>i1m`@_&>?_66zDiW9|<%A(8mJR0@6|F zYzH*}+AgjwfIboE4nV^MdH~Q4fqn}}$MZh{`c!aR0cjp^gjHOB^nsisL__S6m7^4p z(wzrL2b7h7{w;LvfHY4jWUH=J9iwR*4@hxkfHd|zDp082xh?^urIiMx0~FOuX!*7{ zoQ$=e@*5qrsD2G|O4Qj#I$ zRu;AhSF$U3Tt2wo2&_gn63tHW3B*cbhw;ezLILyEd)1eLPSTIQaS;Q>5}9W^-i>Tu z-xu=jh(PPJ%~g1*uh^U1_syH!TOli~u6enX;EfqZZ5I^5=o zzx%^@?Q+D^zyyyop}e`4T#p!5KqWVB*NCN*TIjc6t%sx1{EiY#IOVV2hN> zka?zkO5c`eF!zd8Zd?CFqT1M^%5C&!(Rhf6KlAQ_LVr{noE5nF==xg=(t-RVg-dt{=LZN@gkGnlDRvyjRku0ywHXDaDQsce6@v_&?T z+R4An3C-;PNzDHDwfWRFH&yq?s!XTW`^|`IsB5To3>HBW0olF<3P`lcXcoPO5tIVZ z-UwRQ3xD_2_3cC9A;-F?zDX%i6>xmYE-IqXTIV`|V>nS+H|cmt5l9`~4hE#7+ZaGP zx=jM4BLMGz?t;PN$ex{OtsG_#{5ib4qN=uT?xGXU_aBtR34oVyo%JVBZOc&yqTQJOzN7X zGsLbUot-7RZGL$@zs)D|ptGOE&R(+tU4SlOjS%?pi0iKSK^PmhcHD~`?lwT08NULg zouw&e?_EUH>R3R@oQsCR|^u5Id&d_NW4U2xP%>B5i7f6_}_cATU8s`B0~ zwvDX3F*ELBlM6Ev+q*8(y3o}}Ymm(kzlgrekzlZ0$7^wsHHkD7lR{aM<;DJ`Gk$|+qOa!DA>qLh;8IV?@1%NcqR{_#;co>l8`FcR=%O*g|@v(E| z;Hf3D3mT|4)%>zSnVg);CRh=>xIVm@^x}-k%f$ z%HtdU$ww-DtWPb(PFtuyUka5+a&05x-}Mqo@AoqR=^$PUNQZ83>)w|pGv&1P%_>Jg zlFpV#Y?IiXJZWHgHaSf7(qTi?DYwF-nclh*TO-g~xFfX&+jrfoVmGW$Y%W^gJew_a zdMXuyP$t`U)v}$AF{GowcPT64p&=eKFQ|B-5MzH z0aPT=-GH>{Hv-Zkl~W2mkkRCq^9knWxo*N~a-%ZahiwNVK$_5`5b*8d?ZQ^Wb7Ytj1AMex&2r{lIbZ9+fdia|44-z(fLHd?Yt$ zitx$Cs84l{5y(=|?aR#n)}3(}kDopn%DHM-jv9{@99<>}R0BIH&}p!D7dl*ApH`DR zIaysXtK#IDq4Vc0X|6w-*De?66-ep*)b0?AF>JfCvg!9c$^faw#Xt3JtK9-2R|sXio^ z_Cs|I3+L6P8u~+JHhn<@kip8)lOnxTye)yfS|C_GGCPYZ zBk@(m+ky~sTNOv^uylIb-PPcGwct*Jol!`Nd~yoSV=_9o%9*n&C)dt8bq18_$<=fa zNj2qPn%wj&R%y5();L@v&`)#f3A4PA`B@L??(QKStH^cuX%*2fybRyh3oZp)tIZ-n zHwvy1_74PtC1z)FB|g8}G%Pz|Uen?xRGf69g&Ga?RW)cg6QcdYTEHc`b_%x%WZk~% zZ}ck&c2>ifsypz@twBE#+<4gBkqArg{4>F^1}RQEjhc$-vy#(iR97aeLgywz=Z*}W zI||v+kfzj2PtDGv$1J4zvO;+X?izg^8cOlKPH>FA;%WdrDmX@efFwzyKY8}ar&NUI zpuYY|SW2g`8Y@N^({Oq%i{C4|&V0jDd2_d;v0Qvn zmWJL%!rbOR4A9|^9`P+t<;`~;P2BXZR{WJAM8ceelfQYz-4Rda%~K|K||9Izet#}1N#EnbXN2mp2{1>fTo`di#l zJmB0LQ1``e?C+_(VGm5Ri{tvI37soyefFCv+_v?N<2{u(A2}MEE-N;lK2r82`1Sv0<^ppy`jFzD`MxW5Z8B z%2RpsI0<0-yRdFogxvIxgkQxMJ-+0?yBk%B3 z-ZVIxxTzaSt&Zl2@ltRQ@x6b2W0t4#hWeIi_P|dw=4qs#W&nPX@LbsRc=xRbzUQgD zdEQSGP@J)+aK&KLB)>iSbya!eS6L!70WR*jsM;5DHOy?lheIT6 zM~I1!fAFBHvk|T_$|W=bt^)#G5AK*YQ`OlB*I4Be8Uc4TZRbGYvU&Kx%*n$%bv6V1 zG=Z=V5-w9sLub5y-B?eZ&C%mDETIwbV^bCf2f{jO)0ID0bv7jWkDn$G)*-^h)=zWm z=d+LYsk7mL1|u{9t~jus+Lz}p`SZUK6N$;_WigckDtcy0d}=8hvF9rm%wH=$DTj-^+P2$@DX~%PeVlLW|P^6 z0gi-gU^87W$16(?b6j`$Y2b0Y}1d*bM8j<92`faL3i{rwOEsar5f@;R7n~ zEDi$Boyp9kqjx01q@2;J3gpW%bn9zv3Rn&DPz9L~;=UESrbTPcb)I*^W zu9S)MQNlGBHtYSWFFI~M%5lx`(*)8rOt{#_X#abN++d7|K zvEcrZzI169AT$9k))|lM`@foX$0#3{b^$^Y;9{NexaR)m;P_~dYa~-0lFK#PzJ6(n zh~?+353OM zZ*LXw@Za|S_C#M;+P;J)z{Ra%uT}o-^uJv)$;YMbOK1XI#|O9$?f2ZN$NRXn_6kja zt4z3TTb^=E-_Of@Tv~gD26RwfXX;oIuvZTkh4=bSQn*Mn$WKFryp6!WC*T(euZGRs zuY5dw!U>LRpvh;U3B+)+aB{0Or&@uAB2{{+t)qmOQTidug<7Hg9D+{(W*%$tTf~DLf@Dd)@6A< zzeo>^QGa&i#d%#G=C=WVkQ-DH|}Y zp2xOE<>f}c!njd+KF`cc>6|>8J@P{DokwGpbuwC-8z1DwaA_Xbet9&hJWQXw7=9AS zXEOLaHleTdp)@|)*Qoc3IV&%$d}U`8n6Rc-Xleb@y2cgu+oqK7hghRNziB`5S20ua z@^Iw;!`_=fM^S9?!!u-nut{7*6xjp`psb3Bs0gT_JS4^iQCSqt|99`LuI`=;n)m+iecw6X`RbhRzIE$& zYp?3+>RVOfz(^rU71c219Ep9fxm2dtU?_i1*)Zfdp%kZDDGn*L8U|aAj?5gJuB?BR zU@vtiZ6(J0b{HUs3!S`dcM^C{Fzg4y`?6r3uk_|$*iprg&v0{3Fw7U48;hB2*$t-D zhGD`kwQZQewr?ILT>mY^;%LLJOmF%)bGt6JD-He0V5W)_wQELqNf=<=;!BnWH@3}m zVn3q^$zJTUm6Mj@O@W*FC(+MI%_Null@btUnJ*9M&J)rBUDWS6KR5d?>g3c6OPr0L zS=hK{q=l{ie;QoQkhtD=QGL{jwM_XEpD}7LAS=xJd)y{($t*)0+pWd-z@}NI{53Pq z5a~TIF|ichnu7+=Ql18@4}NRuLM|01P5YPf*~nqT3yZI)4f(x;@2@Q%Q~Xwu&Z%&3vd&AJ_$+3TUi zueEU*McCZ9%vy-oVv9lp>LuqqW!s3n%(33gET!=xS(%kSD#eR^>{Mm6c??AcNbyf( zUCDKm;K*R_YT7N3A)E|LcWu_RzuD`I%go&C%oe<5Z!|NDczCO7qCw04d2C~#(LWjP zQskz)r8h8{*6q)zbc_wabd)Hn{A-aa9_n3YR(6Wo?~7kqXvg*SgHl} zO6Y2=DUjaUNDdsk^cI$iETRS zdc)cQ9WlQ9RE_b-TlO!at##1ppaT(p1*Wq4*rb0jjB6V%ANWSNcy0h@x|*^iZ^gg% zYF=M}hw*q1n8)a61B}MmH=}aI!|enxZuN`7jGukiprOEZ0_G`yT)X!2$xVU49K=Oy z>1M0XddeP-UzD1HB@oOLlW?1a6p#^eQ^P@Dfa2#;@H#QucYF|4B~CuN7sSptVdUoR}@95*@9 zHx|q84ZTsU1c7#Dg6}h&W2IG+pB7gq!?2-12DG%fnGFIgA| zNva?&$1L1w{@TUoEeh`|*lBjcyW0h=s{{)g>d;TIt2`)Kd_Y z(6NHoT*qPCVT8U^j9`m>oTC>EU0uoe{oN{E#(I;IZXxkk;%1ao2$?$+*~-eTaUmO_ zx6bw1lj@r3aqjC>atdo@Vp(#5r{e6wYN!|qJ9l0VTHuPO((t5SE^dT9J8ndVTmxBB z2oN?13CX_*b>u|fDXM6RG2c$CuXE0pgfw_t6ixoo$~3jgnT}*99o=5OQydvu+v7w8 zu(?D?{#J^Jq0mb%--5xXpc#8EfcG(jjI}iv;1Q~vvFwe6-T*)^$njk{TmwKol3x@f+BZQWgsd#*?TtE}g`E_X8^^RbCU7z{;73tk9pYCvaPWf69|poM5SM6V!zi0Fy?eoycn>!oTBoUk-8K8Y~F zAsegAIQ`c=tS#w8>+2j?TN2YLuM)bQ6Sg%cto0tQ7M#!t)&%>y_*@udXja+9+Cw#% znvOfo(;E@D^~2KBB>Fz=g;@GN#xgr}IoXN606oEv@Pkz1I|h06%1HY@MAn|5=qJF9 z3X-@W{TQ!hL&9YZ1hy=xXsoBF>iq=J=pv?8M5PW6Syb4~cV))uAUdP`v7K?7N5VCK zpZETF-_^JoXa16gV|Y&MZ{p8W_DwQaWWj2T_{(v#zr}%ny%6{XoZl#$sKm{b!Kjgs<1==_n_Qx&h3+Z&4Re z)P$s2W`L4rnFmUm8}&Q%zebi3&_5U#@5U(&?_aPBMGHHduxm3=^w-7Z7ywHAqyAnR zPbMho80Lba|12)YDo`T35tKCAk3n^2*E67EnF{cxlqI5xzJqxCV+@esdtd6Wb%a3M z3#c<%W#x1~H7>Zo*+-S76B?-+7@)hBs)|v8v8#p$%RK7pb(UE8<-33uEYiN+#Wko3 zqMeI>RBO;6O@@bCt9@`l8B~Q6)em@v1vAn2H8LYXZy)7t8nHjocec10Wr7|c$?7HUvWCiWoyg^c zm|wjoIC{lLF}OP13@MYI|4vYnE5kr_!R2yHz+F1GM?gvEM$J@mWe+GzH#cao-oYjj zXTG~>Q!JwraDQCISii>$;v{J*lC+qJbZlzja&Zmr$`rj4x-rEWZ{5=kFMveqK@aMe zq*?=u9IVZYpM0OA?@KU-48A?Z;M&8A3raVH&eJi$P(ODu~PA?YR-d0>q-d4uy$3W?~WixMWhWb_)ew&#=)nDG> zJteug$1*hncj*wugOW^}14^>05R_ye^|(XJA>;5&!;`lDpl|9{c#^4vOAfviDp>Pq z5GK4(P1V#?9Zgwh3&_*|weIgFgh9rIE690KQA5YSea_VV{gVJNE{EHJ#KIimyP^9_ zGX^wEupzbDBvbeIn8uKlOx_7A1dkvmeb-jRwQRtSxbpg7Jz9rArUI@Y=hJk@^~vRN zQ%(KgS{h@-=W$@jkbgl=nsKNODrC^`Y*Rn@83MqV`oUL~KU7LV&V%fRl?FGZJY?zz z(^7IW!8+}0g`xC=55q>GE}k+V*VGSwOJj@}(h!(TWn4i{>WL^_^&6%2H1&gNL_o&W z51uLvet`u!hr&iuYa3UrZ|Von))*tKWh%~8=OkT}o7o$e+-&Lxzo0R0r4L8T?8(q) zW03PB+$mo+KQsIeQ$Lu-6lAVLZct3{I#K>$!UIywQa9qDeT_^{@wSqE+i5vgkR$LP z;!iEI;^nqdobDfWzwT2PS5W|Y6aEeQDvP*HMl=69RDa>7^;$!H;5mY?bU&QJi#)cuEaZ-o@ zQK8o?<+GuYMnG}wt!0RV$yc5WHkg9BU<-@fXs0j3uoRutqK!BXw_(U}Q7O)?HlHaK z^mEei=o){2?MpM&)$9c3^Az>zE7^jtGllsPFQk!9)lNrb;#nOXQFZgD4(zjG&f z`tzQXo=ZnDS^dzFAwT#>ZF2h9^l>=;DLHing0TH=>)NGDa_ZRhlq~!UD}C&blnj12 zP&QCT<8+^Z#RxuO<*yj|NtGct!|$IGAgC<*#}BMjs>aU}%g+?@Aten5HD#xyrW>W7 zo`pkE;6T+3{!hkQEAeoA8dK)45uF3%hkp)?fG1KUdC}}2fk2{I`M-~GILSZ#&4_Fh z(Y_u3@u0sMG!nwbV;Cg=sG1T-LebZH{7?R7M75_61#NC9kMT$qjO1xJ1w(ICnT?O4 zPhD+pz$@b5^$y3WTEc3Mhs?&?&oCJc{(TsRouQ!^488jp7h&J~{tfV>@cD3-J|SSJ zBVwE#=GY1T@4&o$6QN}79OK&Afq$Xjx(A;{chOK4h9=Dz*T#M(z+~`mu8(mBE;97? zWn9}xwi~xtyz18j^K%p7EXE@iXK=KR2#+x^^gNGiEe5sAXxadV#$<%Ej?;*L1Fp6d zDT|@K!dpi~L`PeAuYORcnhNNKS8i`&lBiu4Q`wTp<5`wnoJ8FCsF+TA`Q2zbZ5XYcYY+OXKWU z>_sl|i-@pAa365H0^t1PNB%w3#u6wTp<5S0^nLl+e0D$ z>b1wsVgi*f#cxjlT!NGU(XzZhF>bECcO41f#d-|5>e zkpn6D*VdLg@{cEIEl|P*^3P2Zv=+nuMTAFLvwsHs>l^?V$iE$(EuMjt^xFSQlYd_Z z!1?<}{pr1N0sMsvt7P;)r-Jg zRM?uZllFu^ZV34Abj9p6#=2x`;kt&Fh5X%{vwvDg-@yg5M_er_nSHtPq;~k>-WWpW z5BJ0cO%9h++dj(fvLSP53Zv)=z_8J3(Rhqa7tD^vFW%XgT@yPjn4N~d$g?j8h0J}D zJo5j65C0aT6`z9}{sGdy@gZ|Af>C@YT$s7wx=?b{zx=_c^xGufC5bw42}S5Omo;$N z5eIzH!x&uxu^eM;8)6>Go-}4(kpy!mzqrjaA!$s)7A+AUVj*Djp*#8T6#UKxz~*ur zxy*n|xPP9}W(!5B_@_ouLLfG=-@qv9E{=u%ejX#o=Hf^*j5f))$+4<9y8R`eBgdae z&0#^48U7KPNsdRvk={!dZ}T#Wwur+i#M9!@3d1kz z`GdeWCeV%N4kSSi(Kw8ddG6h!G(nSTybZdAx0-qH86Hr5$|sEg{NlwNz6Cg4n5S&a z(ZbZne6aXHVP57lKH>@nG!FF*bU}|oGJ*nV0|cM&Q9usztCdA*LjrOLXNPm91Zjuh z{{i-f>*YJAfAx@G!%2jGGVJsnXFOo0Tu->-zZ>}(-K}7ptDEmT{EN1D{2DThTw~c~ z>M2`v7E*4?zqp^}FZQ`!`e$57J{3F3dc;>t0zV}|{6yZ0;H3iKcSpSZq^5u2wjazd zvo`}8*P(4VYxPR)*0`!I4L-PIH{9YdKA)wR?^58l=hG*I7{3#ZA1}JdRL&&wUnslE z5~_HTUk#h{96F_d)jX;cf{O%o2z-~L6DSoI?K(vBhG|}o=1tN(S~A&y zeW4a0KEJAY>osq`<{i?!vzk||d88-Pfc*;wCH}cJuZiZxXkI7Hqp4nz9jtj{G%s88 z@->fiY$S|lL4C;K(ggourf6DNs3V#>tEoRU6^b52aCDT1P(47=uK@f*)YKGBEe3Uj zU0(+EF;nY7(Z?7R8Z_=FP0@KNpRj8fDDk;7C~7q>#~@IjF_j03dT*EG6;M*XZ-V-q zd2fTF`r&fy26cj|gP=|_brzK5Uoj}j7xSOKKFma3J595397ZCL%}b0>R#v+ z8lyEDPj;X`f7npk#!F(J-gBLCwB<0XKv;UEFy>7~w;6xg=0S)7HdH0P03Br^mL-2(J3_!Tby+zC&bTpCZCW)qV-eUESIIo46wnq;J!-R83!(jXg6 z+kf`@dSKJiUecr4T?z(=#vGn@i+1(xTF|B9>|MMU_u-wt2l)nvdKUC>!&_upg0GOf zXo^ccga_fo1wF!8;~`#@KgfxGC9%`=aQJ)P=$gri#6>Ea`q@ONDQO?y*KVNI_VqVT_n17{*P|v*eSv?cIVj|ow~OZv^n}wV z4dt9fah@{NJIJ*=UbY4rX@ireVAv@`y(Q5%y^b$gclAa+=!Wxf=mY>6%@uctx~cBA zRTWaj%c?OP71n~W_vZ<-_asG}NSOH-%>{Zt#rFT+nq3RJH4R4YLGLSOFSH@^cjg_N zJ-wzg?}#TgIkaoXp-n^c_9h@tdKL_5>Netu-|}xjiw+8#!Nd=<@Sg(zoZ^RD__M&r z(KU>ZHu)iQMk2T1c3HW_THWpxH@r7l&SQ0J1-Hc19#wlGS0gDIRY5e5i^1Tx28;E< z%X7cCHbszMqt_X=Va_iYCaHvbtNJRi?qAVvFmc+#Hawc5$fbLr4}9r1yMdCfkG=?m z8mp-pnxYZ9xNZaW1umC^YTuVkeUCf6wp_ex@+qcnL6ttuR5+-wnYvR`8Jb!Esvf&i zTNP@zroPhDADW^S?t*Ip>Km4&|7vF>3{d}KDg)GMrs%AmvrIh%>RYCs1SMVR3Q*FO zt_9VAUFrBOaow$5>A!y{yMCgnNObj70MN706sIY2?90Wb1Fj7Ks zQ{nda6vWlRmgPp1#0JrBE@cqvn4W^(;RYw#AYu)|BLwsjp$>HKup-0{Tl5pj8cAe# z@y;+pwS-+Ln%EPHrcQ+NXsWNKk~PII8jtT^h&FBBJm(0GUn`6YMr~aHjA!=mH8;~I zs3)Y$E?As-u81SWz2ba@akEd=OI(nE53?Jn;zb+@sXqfxM|{EE>*9TPo$FO__v&80 zyUxcK+yv`oSfN6Fqi6Q6atSkcEe9}R_D**~%;CI4tDW8^o&~N&o}H&$YE$#>1&NMe z&(5zg2CiED&H@~C;pZmXS)8@HKPo^+zq@y@)m49~oYa4Q76cr=JuB2qwP6M@(7bxB0@0kM#X z?jVK}aR-RQL_~o&MZ~QjLWyVy!cD}DAi{~jyXCqWL{tQ^9E7L9Ic#?w5RGx+yd2zX zGevOWC2DG*rta0$C{1N+YKo?2X{ta|OEmSYre4$(jdLa3&6*NbH?xxKBh^f$u#kM( zIR}Y?5DHAxAn64d7nn_7RsqmW0<%dSJOH{th zVwO)L0u{6Ta3WAK%Tt}8idlXJ5vZ8u7ZQPrS$;VYsF>x~5rK+XzK{r1%<_jp(3vID z>D&O@GF&bP{q_5fsoQX0$yAi)QPX^Zc|A4nZcwY4H$w9!fO>^_R8Pe}O7`o_qxcDr z!d%Zh%0}UB1hs*A?`Yl!pf)j&#_EDQ18OVt=;bCnsutUsN8>f&(QHj2^XQ9Sc+Ejk zF}oZQnnzPZdzk0ZyuqOMGcQ^5=xa?{&;6Rp*A%@h#r1JbQO_ehdVvZ>UvNUvcezmX zQWffbO?{%NFE#b8rp{~1vfI79rf7IlAz^m3!&`?IGo3>!9Q>_K>ZhWbi`5H>zTI(9 zEKNPagGL6)0;+m6LiAn1s1XX%%i2_4KMIy$Gy^)S7C7aSJZ1f5ambE)Q0yB{DM-to|A9#3vKWcZXxRdd^VKNV7T_{uzJblHg7zOCFB->bXWe zjR&df{Wtx4?!W9GwLprW8y84zjPyn+&H(lFs^=2*+@PMu1&;L-dg;IH-)iNb8-e--#nB)>nOMG?`8Y$_m#Zf|n&EOf+_<-3it2_?l$%0P zI}<8aQyxtvfoh4%$?pLvgKXG^qPiv23{B0`)Iv=y)zorOqX@cZY3iJ&&V!1<<>WJLZf7bKnI#l$B-4|Z{l)>JI0&g=`#G0U4`xTZ2R zm944Cnwp`hd74@XDxUqLQ48g!lQ&2eYP04QYHFXR4r}U|rcQyPQKOSLAMMSQqnvC@ zfIQGtsHW)DK*6~+MbnkSqu+9U*%uEe>S3|@y{3j}YPhB{G?lF>ns^Y|8K7v~;dCqo zMWb4$W4WeQYigaQHfyR-Q~NY^7}PNK%MG~X>$9Zk7GrLt@+ zsF6&0G?k>OA(|SlsSHig&&^DhT?lF{Q%g0qTvOC;#dV#gHfyR7)OeOX1uBQBbDBD@ zsmq$eU{K+LHATO9^H??<6tzAafT5{aO?fnxq^TjA8V>4ymYo4=8dLK$wNO(_HMLw* zt2MO_)J&E=3@V?gW12dpsdJh-uc^zLqCdHFS=J5eA*RAKMO*O+FIrQvn(}Chet9im z*=$hM?>HTkH8n$1^E9aeDcY3h`w&S~mADEfkRIzlU8 zw8&H)O}RA{rm1jEMQaLTY(7SF=STMdoQ4MShF$Ti$oGUdko1*XDrU(Hl3?(}smhjqNp)NtJCOIQwe zpz)^DF#~t{>Xk#3=vx;(67KYci@q55LZ;}xo2kRN?_uf`?)2sAbo7t!+QZE%*Y4c( z)a=N}C>;L5ht*)V+TUOj`d{N9_Me&Zjur9uwCQ#J$*;n%hONkaepJz!?7WvlrlnWg zxas+!j%mTmewe;Bs>`ece|&oBn;S0`uG@as*9Ur@7&tEF1$!1dPo6vSeM&;hwi;EnT)NS3S&vqQ!+N?@U*G2$0`();ma~#v6wC_yRT6t>o`A#*y zXdXXwXp1}i6V$dH3dSyAvmvrqTU!$IpO6)&yfbpzm6LD3I&k@j#}3V{QnB3AS5LG& z6!!UD7iQj5>vHX-o({(+HC^>?`mpE!xLU1x@ajKnZ}7Z0XTXim^f>&;AE8G#+hSBw z^4HeaPo7=tS>AESk$dMKZWk99sHoaRN1>=zwOurN)r~9ftLyNM9+mt2touHAHP_EK ze=8S{kxYNb0Cs=;)i)zrzw~vdZ_g}!xcr!JF1Ng~PTgm+{+bzgeNfHdN0MsHy?f7~ zm<12D`smpfbN2o4@%Jr$S~K@R!*>eGw|{v3-g>{dU-M?w?Kq;~rKgwPbt&%DtN|^e z2bQ}qY{$UnV>=AEH#%oxY}N?75{o7A-p2{PM4Lw}(Ad^MRt{5jEaA zzqzpT@b!o4PMi7ceO>E5u<*NT$pPZbti7qdX8zi~rM*XI9U`*79K_pwe}QXanL zsrrkaYOs9coY)^%9?!Yw$v1EKW%CB#qYwXF>GYr*WBPtSZSnoJ`W0^PxPC{)wz*%; zyW_T~pMQ$4e{@U|MzDM4JX~Ru%T@HjbDa*3Z1mWMF3+URj49vwtp=CF)(#)j>yE7} zdfq$fr*H2H`>XEGW-Cipf7!2KW<20z^`qxRbEwVQPsdD{~|<~(`tuT5j$OWNY>{9477wzp?LxH4x~?7VlD zOkDQS$fSSFhu`}?ICu7r){l>w{=U<5snQFFJHEAlv+tQ6ufIKhQ@ux{(<%*#Y1J-L zb-R3GS!A1-i4l%79XAX=zqx8*;kvvj4=YQ>R_Pw z*%x>C(*cWW<{g;u@`=`OOs(5~O3IvFOKz(i^84erpIkk2?E7str``I)mGZkk9y0ij z&dvVV-tqP=Yt~LJK6j?5^03#lVh0@PUuAjs0dHp1In;1W%+-VUm;3p3zi^+s_o-#W z7Ebu%qkc{2Equ00z~n_b&TVkka#iXdbfDvmCzsxOYT3c3&erntsHCK%?8!@+{z^vV z;IVK2^~rTlo^Sk2=O2e`>A5^;{(a{X=g)3^TlCsWpU-WU-PgUp!Q1yf*R=WQ+fQEj zW$@tT-~BmvbNILSIGda~@m;mO?s3bnIzL}GGjiEm1Ha7rb$FwxB?V`;T4ROyeE8D2 zySh#~TC*^^!L}jp)PTurXFc8PhOM3<$rGx zK61eNUk?U-`cl%Ws!g2bjxL>B`}3_gyfUuSsEpSiuJiVy4?lDaUGmh*J)e8}A3i($ z?aKq!?@vlDy1Q1zv%W`Ss#e%mci^qBH5}h@{D)@>vS#K#xwg(XKaBmwFIGL)Arb!4vW8ivv~W!iAx{cmR`5Qy7&99yV&v2?VXw(8QybD?T;>;zO74- z%iGTWEA{!<3zLGT&TLuSX8ErxV&ac2-Sv2%Z@PT_*GYgl)zl_^`*rW?ZriR+jB1Y~a#FCj z-}v!klQ0-UU;5e3s5MQyj(o61o$w}kAAL4=-Li^=ShL&*wzwSrW9dh=w)GtM<+fEXytH`P-zFpSZQx6^)pX!yJZqt}1a?NF1F=*PSCp8i+OiLDMMTwe50;ojlR zH+(W9$XoPV%}#^nAL-n=*8|t}tQWWM{p)TSy*>G+?k5s$;gvZVZQG$VUjAe7i4{M- zysgv7$_t;Jy&xy6fM#{uHF_t_{WQR;c@qseEY|YfjgU? z96Gk>&YszgF|1mrfrV^Zv;?CG#t8EI9J|mV?su$gI>CJDYb3q{paNQdGDWm@5tLy-VHz2`}w~{ zzLa}Mm5G~nEG~X`ZR><4qyIJ2`B%}cu2tuXZ{PXhx0`Ys)_9{sdP>6D6uB%P^%i{e{K2X*jZ6A?~R*&f5X$=yTwh*+_v${7;MQ>_my+M+|y+LJAUDpJ$Y>+ z!%=!4-`m68Zd;#Cr*EHp?-A#z^ec~i_~ON1uluRbqAlM~Ui^L7)uY$1|M|^U%{qNk zWzZvA*Il0de(}+9ojYz``BK{&zZFk8KJvzD>*kca{Oh7$@?M_$V6_eXf@d#z_Rnoy zK7Q@S2V*lH8h^TTT-0L&Hazuy#K{ll#mCGXfA5A@A6ftNi(R)*d+Lw=$2Rx#ZF~3O zf9*JX!P)+!%E8k%eml2bi_jOI+#9-f!F4fTSEyd|&%*=bzrSVQE3u0kPoLE6-ilpI zeyBcS)^{)OojhsHtE2aR+%Nv4%vKMd4v>x)Ha>Fws+OKsdw+azNYR6j4!oz^dyA`I zv$T;NDD42=1k8>y;u^p7Tgs{E;(DJ9fAgarCnmdVR7kw>!n7j~jGD3L()7(Q^f>g^ zhQEGo7!}li(LF_fIM?p^qgSV?2@9PeGoylE2_4&~(!pt`CTF}~V|+=Q!515^y!nTI zsareT*UZyt$H)mMe!B1N@ZukXdk<$pWe=|Gy z8({vHdb3tVj|&SKHhx;t*|@K6Xg#6Q4+92mxPJZd8>ero-sshjUuwRv?oAWs_HfjQ zsQ7*V`*+XUbI1G}s@|RxT=`J>waa(Cv-06SZ#0`*5Mdb;AtBQLg^SM7yP#Unm>U_(r~$4=~D(qYqskN=*O zSiSBoY3DOOj4xUFVuzWVc6J^!ug9uyr~TaLn-kLy{8e>(=(%%EPerx+wELQ$=DzWD zkE3hrJ@ii9JolAd&ktQ+{P1HRe$sEmrYg<<`hG~->1WFKx$_x$qke?R-$Mns}-TJy!Tn@<$IThRIF+1K0bzgqEN_<}dz+<&Cnr>V~z z$ZiunVQR0Z9Z&Dc=<@mpD_WdgHREj9%#zkEXYH92wr2RCAssxwOb%ZaQ82ut@9W43 z@vk;Yd~eCYFBaT!rB>+bsJH{)Elu6l@`qt}uWr&|MdemM?=N_2-&@nG*M8~N3wyVG zyYtmvlddi~@b6$x26q~@G&X6|y<7kFMOdZnsWWO_YBclpGuw}~`aJFK29d3vNgTa+ z&JWA7-}=1P&J7(${P^qPN)MNGtUvkd!$%h+eUx$k;w@8?9~hU^BX;z?83k<{R@%1Z za>J=#Mh_d58u@+UcRODGaB{;xFI2kZX#B$cH!XL(ch9`~GpoOG^2>xflRfv|bD-z3 zhnl6n{?UP3TdzJppu*%2>VD z{>58!AD{Ki%Z|)z)@~FJYWF{Q|BuD2}NSo3iRGJd=_C-8T&`RjqO` zVP?O{PbBsHzEiswZ~fr+My@B)V=u-#=3F>_I(}D^{u|OKw)54gwsLTtQC&KvRXa5F z`pI)^Z`rxE!ogiH{Ze&ZqUjr;Q1^?3_o3M1~AwY6{V&=Z}We{#*Fmp)z6A??zt z3&~%PukhB*Ynnd(`@*)z@9E$3lgEBr8?tiWqV{9+Up@VH@9-Np)ru;t9&y7nuLm6} z`h0PN{C9q8Fy^zm7mk1R;ET<|vp&2s?(KqCPcPkA&vE(9$bU%xKNe41@BaN0)DXFQ zzobb19QgUq+ViV)_~en$>&Klt)TQe^F)6QYdu88&ap$i7(*Ic2GeQ60?)b57=K}-6 zUJk$R&aHWOb}J0|>ieosomszPMtI&2kKcd)rp_DRJi2?(&Y0qeI(PI)INIp3`OS`; zT)T9WGj0EUEkA!`Xh}+!Q#NJmmjd?nDmZ9CjCmxVj#U>q&N+uh#9(|f?(!$*$InLI7u`H*v= z^Ks`h&PVViLW?IzJt!2<`MBN#Zz=38L6a68ra2t6I3ooYsos#f%qY0g5(-+rQ4tgH z4e)#ob~2b#cgQ|oLIrDHRZY>Pv$)pOR2@y-qA9ng8fz*{Q@3e~CalH3C{0Ccihe(e zYpkZaX^MUliff{#Fzf8ti>my)cseN175J% zrliOYpAkTFP?t0I;wUd8!n-tvd?s^)Jh(0eIY)y-B^&eDLs91LYd33*+aW2L0SuXn zxPqK-;7*VZd%tXE?!NXQIAkh1jIgK%kf9K8Iy3H6W7_xFx6a&stsyvMf?3MCX16=I zLCzt#*TU7~lc=S^I_+K+!%B?#3#lY^gt%Keo;G)AqYaA5RMPRGpZsJhnSHV%h{vCW(!TehmJ^&+ z1!4?&<0w>drg|OZT&}`eP~|ObVWcdMy;h7ZtlBI^cQVVD{TXjL!MUw)8N+06{#(czhBK0oCjJlwyoP;7qR^7{)L)M&%DFcLq6+G7oRhPj-E8p5UBg#n{5C&r)#uip1V1t}SSUj6q~l-=%Nr*ThOrd&^JM1jD(ELCIFqe|Dlf*^!lE~}8CHw>D}VUA6P#aF zac;pqVl6P(GPdz3$|Sjq@%d-Ch=$O+DbG0wDMj4iCzEM?Tg zFC)J?A}2UYx}@V^40+?Iqsk(jrDmvfooLaog?WN=eJjQm7LB;gbdBxZ?^8L!S;CTz zgE178<586^s-HMvR)rPTWNT|V!I?0mG)9Iowy>zCVO+bpDSzl? zW4j3Q!AsA^#o_Bhm5gFb+Spd`k{;M1ZQ~_F~%m<*(P=F;;gqjJE$si4An`; zjIl|@+N4sdNB7@Jg_O=@I%+`DpuvxFsegE2O#E;gwnztre1Cpe3g)D6bi zq`KOqp8aBJjjom$O5I=#a5&>#wcc(lbtCg|lIZN;$`i*CU>9WKs*Z$6_5IaQ`D1bt z*i~*aU>Q`3^Jpolv{IZuOL1t_ZW!_T8N-UFaQe!F`9l6u3PbZPh7q!BDGnVGV;CVb zOL3Z);=Eic&Xr4Xwi({yDIO%*FsT90BTgwLb+Qy^SgH8X43lBR@i`l&^f|f2vF~SW z+Y}j|m2=>u%@0Fithf0b@a$T(ud5NGW8JBMQ$vY^U2SEBIl53wT(f}J2>vR}6@@*25PGwKUYS6U7 zF>PF|<7L#VTrVnCnmsyv$fNce-h>A@_fh6{8YcrsT6lEIZm;-cn*I&!LX*T67daGE zgrNF0sLkIwMp_;9)Vswui^d8o5d?HX-0&AApc5i@EhqW+5>QHhVFz@=WH^4P1#}W^ z&wx&d#|pJ7hr3N9wA_soIb)*K(VTAD!&=_J7co@+Ky{T|YmIL68c(+)e7JR{_Zl!qtRuY8 zI@^0K+zjAax2Nw4)5LLwJrmW$}O=BI4X~!Wx!E-$CnZJ zP#JKP-WSS%qb%N91{{?e?cHuQf%3Ty0B6d8qxyHX3^-~&l_?V~CQ!IkPj4&(j?&w* z3^3^@7=F|G`_TEI;y1CG-BNEvW66TG|(I7-LXGT^8l94Z5j z`n9uVz)`qAmjPEBxbg(Hm_YS~%I%gi;3&xEWxx^S_A=n8+>*+GqjDQr1|0Pplgfaj z{%TPfaVyJ!qx^fL3^;1yJIa8geEFyhIO-3+Ed!47i&eCE6)fY-fi!$IS z9k-VONB;FI1CE9xX=T7sQnSi{qk1r_3^=NPi^_nbesWbAaqG)~VJ*9F&Hmoa8=!4*oG%GIM?$o*U+`@??riGKD;e)dQF?2G;Ell|;d{Osv|_G~|UmY;o`pM8O!{Ruz&Lw@#= ze)ds*_6$G!eSY>A{Oqsz*_Zm+^Zo4i``LYd_LuzZOZ@Ds{p|Do><{?ar~28~_}SPxrIG>}MbCXCLEdf85VL*3Uk{&pyM?{=A=k zrk_2>&pzAF{-~dQmY-cWTt!gJrvAd|pwScca85@U?ld;TMgh3f*NKxiq;NAe1ouWv zW#CSKNU?Ap_vTEYy!a$yZ0i83HS<>EPQ8xPu^IQaOzp!xnyF*BcVy}u?(~NNTUOv6 z$5b#rcIgWq@dMR^sW4D?G8GM~7gHWkNlXm^)t{*hP=lD74C*eX=7Ac@)KXB%Osxhr zf~n1*&;uZ}eV{U!ItB`*4Bk0VX#W&HP$)@I!RW-%2ZE{t3cV4iFi>cxprS#c#)I;J zn!(f%P$)IPfH<`)+wUMdGptdkI57aiM zmV(;B)M`+>nA!~LJ*K+$yDMoxADn9DP0z_n8S6;N&5Cei7H52pka<~Svc^x!a`QQ6 zju9zoZcL5hw79&SbjJu#dE?yU^StiyBi%VES);(q8#yvP$L$?I-km!RbNUX;*>HAb zT4bgh3-8D1ncQ6W$dt^nlK1n1G50(! zJH?whVr;s5{D{%%soq>iX4b@%v6*RZ1eHg}+-U}3<$yf59QbD-4TsF}S?&=y98&XX zK3Ln*GDoFjmfvs`tJ^yz+l263cxKip4U$qaL`II!8K<2jyJULY0E|hWqTNx7*(gYy zDLKlUp}E=VC`>CX8!1f58b2;GWvqKdN^Yi^ek_)ph*Jb@Xm3uY4Lc@nB$pCOfJj~R zs;Ci=d(!y4v1#rR>27aMUREkR1T=k0u9P4CZj8&!%|((;*<6!li9uF+dKy;_OpWJd zyHP}W>A4Q71SxKswsiB_PQ}pm!rv)#T(+EDh**#;9sY-uXWqwlX%y~pys=|VCx?-rD#6wY7%3%Wv;nR%s8pHWjB)AS%v4>wl>XiJe$jwN}K?HyruR_Zm3-^(TkRvZEEuBt(OmmM)&q~ip@uIn#JgFo`%TFCYG9^_2 z(iLz#0T-JAHuF#_;iR1LC?$@Hnf_ddutlg!HR}v7x@!DG$4witSZ8<9UHV~&gTL5i z)Z^{WX!)ZHEl}9X<67Bg-;bsqZ=%My)t^e2;t)2->BgO6_UX3po~Dj&6>!KfhAH}b zBvS!bkdx+oX`c7w-QPZC>gc+`A;TE;-#|DO@d$DnL#SJBd7+c&=+fVCK`1?5n^Z7M z8F9J(vBKk`qs#x$BSeldHmOQ1RYQ6EZ1&?pqJPU$G$4Rsj7_RCxIs?(LLn3M<2Q{& z|5pCj3zsoADT-T=lSVRRk}tOl75!V5iV`kkY*JO>5ag^b&W;^xE7cPHTb81M3Jhax zQrCeS^mnW{v8!spV6mf6HMhO+Uuiq^MQ|IgPqeKCE1tMgLYEHO3g56qT=;hvlCw zE*AY;39AjqkTEu?8*EaM-wmj3(Z7w5%E1_$R4tYwKAD-Vve%3Lt%N0&gE2NK8bO;i z>h(IGq*?TD)rpUcu}RfoDWgW!jj4Y^^lv3BsT_>4NfAECNqjP6wzMm<=-;ZT2FBQ= zXk>4;ui|M#mV{B4XZ-bmv)5!E6(WJ9Q|5oXMF~%l!3$SLZjF~?1bJ4%$ zu<&P(3}b9kR0GXC%>A{(2#fx0q;wpNu}RfqDWl)G>4#-4ME_R8lDfedn^b+4GTPUX z^NwW}{agHFCc_w;lp9<#T}PZ*mE7ESOIT7j7-N%az*5wokV*Zq-a?E1ZKQM@jIl{I z1Quu7vkd0xi&wrT`nM96)D6biq#Ci5(X$O{`N46E{;fJ{l`%G{#w=EjKK&F{15-zpt2#@M8qvXoJKCx20WpXlFmSn6y~#@M8qv6S&9 z+L=A-szv`+9cjrJn^c%BhM8fVc8LD1ge7%@F*Ygsq78CVYb7(`y}k7<`nPSQZZO6s z)dE*f2+>WW{gdWM%HHg>fN-?MvMM!Td5n2u}R&*QlS(O z%mR0{9Txptbqq3NY*IAyWxn;!zcVbpliBySmAb(gn^b3(GTwU0+rGPG(Z9tKS~85W zNyUO|jsbQ~Uj22fB`m2MjIl|@v6NBggMT03vgqHom41UUHmNQwRU3CQQ=a|ZY0UAvz)TM|7)VF8`H5P(^I^y!nsP( z-bF#o9jSsN|8DUcmH?otcxK zk~=;Nije*KC667Sl9rqbo0ssIbI`hzhNJkzE+jxck_OcH93|keD-!Oql@;hC5r)2jSwAYGtqr&a z{AgglE`^H!x`MGST05Xn@3zxDZOJM}5{EJqD6~(+8&j*0})Zf3z zcDD4Af8Pc2k9IAv81nBjaK=A#9lti}rK_;y-^d#*f*>Vd)T>W9QGR&?;?zft1vfJg z4rks+DGWWxzlQ_k!le%vFnwV?4csP$HS0?o_4O;b8}Zl)%yEBQlzP<(jQ4vwBGNzz5t@ z3Tr9f7#ZV=fA#Tr9+=$b5Q{gm=Jcw?MW?vVqU za0(!0*fY3X{1^K%rUv5vEK?J4r?Pi3<~gSP4siSbVA=-bbh>cTKnnML7$AA~{l`U@ zW+}Q#s_49Z)XAnEUw1Ck1W!S=#DcgmI#;U)KsX;Oj?1`1ajSnW+2YD(O|Vkup*yESi21VmcV#$7n1L^h@R74j=LbXv+EM1NA-1j?I z%W^o!jk^=BUewD-wV@1_tfmZp5toaLLo)p}*k5Aa4%{XCKLNFxdGvmGnW@qR5vWOy z`H!1q6Dl0lo9ZSRD#?=!`%imU&W?IWgtWGnprp0k1xi}mR8TY;ck#I$(#F=oE*Z#4 z*IiMdriEN`SejPE{@Ityg*>~{w~rdTG<9hT6!>ynE~R0KQ(9;5j24|q8XK+o8@E?1 zZbrX|lSYwgu~aAMWXJGfo|02Wd)PuR#jPdyT8i5|4W!W;A_^r|oxrmsFm7<%ph1KC zBc0LQ<;HEMCPZfg?)Tn`({H&?L>=tQM;zBq@O@~Ug&T1K!NwH2G_ws+AIL4hkbCegJ%&( zz`f8qJ-!DTqoH-fdA`02@ezeA8Mm1-iM;NC-jU=jFZg<}yWgg=r7kBw4v0j32f-aiWIifUZHmCwWGc6n}_oKV3MY9q$0625mJ?Z1?RhemwypNTCk{^%gFvCL5WWg1bHQyguuoSL1O(aXIea+%&|ZsT2vj zGbnk>NoS6J7d_gr-R4`ZbogQZ;WsqL1-7t5uNAhub*X{MTh|gc6zKmh?C?NgtKoz# zZ1=UomNz+ty&9M0eS>q%RoFNq9K&1F;_GX%6vW+Tb-B$`kbpP9es2YNSqdHOt`Dz(cKd9p)7yAKbk9y=V*Bs`PwjKvez5Wte$A=N#h1)kv9 z`<=z**?XVIIH0*M!jS=st~HeV7vqARdF6)fmQtV@4eG>JH{)Jg*`mcSB`2runEx~UvO#PV?92k*31G4(-V-J1g;U2 zA&7~JMcnWNAI@X<_anoC&Ia0okQ2J4Hc&rq$=*5pag;V#4o^rt`W+^R?WUod0BIh@ zQh|&im3+nW`;f*kc-g5JAa%S(bqdLU7d9UBs1Ggm8lx984||O7FJ#$t^nY}aH2f+w zy8bcrq6-;Z7*ZXh9D1E#2yxkX!9b=b+@%vq@J(~WBA+Y?zKL~sm_x%D%e(60HQ!Yw z)_0ZV9Tm<4xna98`Ei1-TM@tQxLl4{+~ox`7?g}O#)5hWmy6ZSWmNGb?9z2nmnoh1 zXQ1R&LoXuX6>A)b|Mv`i4mvq;^O^GCPTx^-&|4u>LvY{8)NtH)F_nS)Zl@up_i+6|V_ zc|mknTBJ@YdrCyor{A10cY3{FV~nr{sL(3|8{~|`y&SFyYo01LcY3{BV+^SeRQ}Lg zN^~74n_GUiy_sm5!s7T?V+^S)ic__el)2MuiN+XGja3O=$5MCVPK+uOd*q9zDJ+f_ z8e>S&h>{F-h(S*JTSxMH({^?-cY2*p0GMhHL+W`-JWL3#ASZoT(AUk@W%)OVrYX6t z(HKLjlM0=%LC$+|C&(?U=e}+3^x92h45?wNEa)TO)IV6ATW7v#nu6^})fhvnyW(8W zQg`D{VO5B2*wWnTHBn;>sR}A|8V8wSML(XqS~N|;c2w0EL#l|_Ff<_%ZaoE*b7#*p%Sl3DP&^@`)WKy+%@1voW$yIq)fgkJ{)$5{R@o7i5>azj zxmBWR3X9_|jWMJeslGEYRbt00=DWIL!a zh7|4mPKNpqGhN-j4t>Df>9w227*fp?hsJrPRP#ZtzZFeW@{#tACsWs9NDWk+df=M+ zSbuz8t*yD!>pdD{NIjuicYT(k7D;B%UB4BHrYYH;)fhu+y5hLu8szLnAegl3O9#4j zjhdq|hE%fRGyqm~i73N*)XqOHnx^DOy2cn%%T=y6WT_dr6XVk3lb$nodVNu245^=0 z2{vLWDm8+<+T-S%MAH-&$0dz1q`p@EG=^)CvnhdK>i0dj(cI~k*4dG1>@cK^J#CwS zYqsTY@0xl*G))OzS=GZPT52J&VJH++DmggoU2~_`#~DEwBdi^&Cuzn~)HcbqI`-BQ z(KIF7dm3X%wIVi57%o#2?%BBH$IP8xqZmOLL#o6ntmZ65y(pO%j-L(|O;fU!S2e1+ zmTII@+5)bo{@lbZ52Tnoy*AevBdiVN84L{zO{tqZwq78brsTGjZZNm%uuiI!(%eCi z(@5paGmATzJH48_!5U#1^|d8SQN1E_tVP`qMbngQ{pkkNQiqjDLk1WM#jL%B^@?vX zcY5uoF-BOORef&FQq;;Q!=^T9*;zDAVR6K3j3L!U z7&kP=tba!%SPDYgn3|>ri!p4etU`~3O?H;2u?-n>r`PIM47<^Oeq?AKCCEt&OY?S42z~IMGb~AOyS@FHf?b?HE4G(JRVFOM}Yk+1MjQ2Ri%Pt zq}tX{^~dBqqxuAsb3lb|a-vl!o1AY-Nqu7DV1qi_)`}APYo$V8T#ECcjRSwu^0Fyh zG2%~?Qt>%kDy7$#!dQ}}a$~kF`_ z zgpp%cN~No9DNYSr=;Q@`02@ZaDrdt4)c#~WOGC=xNI{w7`!K0bLhk{|nYqa+UaWXl zt0(!(u(5nSLftcain&`Nz9*A=#SifG>4u#Uy~z{Pb23K;cBV}im2-M(T5gJAv3s78 zo;rq9K(84Btqjidre707!B{Z}E5pXHg-3B#t8z>G$oo6~jVmt;4Gn{&W5e0;St6}-3H91BA}bmDDx}H& z3|PeOQ2RAtk6P%br;d?Rjv8Y%cM4iTvWg$gftAudH+v<@8tkAz3@Ke$ZE>c^(MAwl zY0bJ}XWJz5vXgVtN17#!J{IY*Zkmf^QFn?~oqUZgaZ5Ydf-v^Fr4EE?ol%BO>J!^+ zlB!aOgKUUA9+QSt#Vi?yNkf|yMMq60+W3?UMt%o!rvm>wcap!BoZ_o4iFWQ)GZ9ma;WS|gL&;{GUFDhgw0Q`ah7=%-PDhkY z)s_EZ-wDhYG${x}vwRXiwZMwGG8g(ZIa-Y1Vxlc9M^{*02JU->r4b?H+C{dp;y9T# ztsI4mY;Q|1MXMTcZiUtP9A(ev9>BE#W`e@$aHC?R@~WUH+&K!PSSp{R)XIF}QgJN~ zj8m&EP2BQ;xJb2{+r+&V7-w7DK;do;gp0AMM$3$JAY4RvsrVfYh--&~Buz5~FcoRK7DnTuv9-Cykbg~p`OqI16JhnvLH_*!%u<@jg)#k8O9X}O_#DrTz&vuJ zFz5qK@+Hc)3pLf#gTQ>DaJrsG+LnemzJSBGz`RQneK6Ea#J>pJnxn(O&BA1CKbj^n-sZfceEOERD0}9{LtIS8w2O48ui6x1;vq zwssT_hY7%}Xe2mFzqE7P5)%G3ICME`>S@g=Hb`}+-hL5 zn~HzB|Ff;=k-fkFM}HwTz4&BZ@mU)r~`g-ibZ224;3!I}QW*y?FhWY~4Uv}q|g`WL|Y9F5apEr$GS z-wNr#MMnDM@1NfSt~w_F_TVC8`qu`> z(wb%rB6J3rKB`hyhLhC$NPERHMNG=r%ae7iv=)Ll*JEhZX8?PS@T7;4#!7e59-fq; z@`PqpV{!F$ht>uVhRs8^L53}fY#zhLYBwDW8)@a_wJUBBw|OjlEUpl@ISx;)5oggd zFjN%`Jvf^}b0Y{X!{y>_`Ia+9RbQxKni`|2DVlm6)CycKR(GQTLIBk>((x>S6Dy!4 z#7guFdaG0w^iDE3!xb?t*fXcZ8wS1ZV8tw4PD}&?|Ad98~9pqADWP?Vwh%Yj4dPtf}Fe8VBlmTrS5%&6}>N`Py~4 zru>zlpw<%wHJ@P0B11Q`RH{^>t!n|GZxsf8JnCpA%9Jlc(VJALZuVfImL*C~RNrky zMmow$D+>{dpBE@RcD~d zxwq?ZIG|{!4R?53s%Su!sOxaVJ|v$;v8P}%S2?I-m$AxGc(K78 zUcn&99`V*nEa)DZ2-P2>0MR%b7Y{%>v4&xgtad;yc14`)fFT+}U_^QfuwcR0)m_j% z%-0o_eo#1kg3{LKW)e82b2gKb^2@j(>P0K?q+gsA2N!RYDeZ75>{6%?fO>&lAJx>0 zn%WLZ>h@7k#CJJLpTT?ATNqz4N3L_TCrh$^s@-+1Xs2=Rf_1#p2 zH!9f?Z)_r}g6~j*@6$x+y%(t70aGTv8Ypvv=A}fr7Y?0)HAvl>Pp^nnuTpvPaJjUZM9v zQ>8s5eT~yWD|}y#%fVW zw)4G4db)Me$gb;+}{SE`3r;H*33P z`9K&Puqvb%-rP`-l~SaBcOF7QpC{4g*40zmwQpz1&YeZ|o%>1(Ke{}-FbHieFa!N#Kyec6A%SwKZIMT~^p2dpWnDO%7 zqKn72a)3&=xC?u#761Ff${tYHpdw#Vh@PQwU_YpDFp9XiCiVA53?oYB6vl=;hBjlY zLr@-Hwsrx#@r|XF{2PFxF_z0g#krQL&bY5*Y6$MDnaadnntz_AsB>7)t|Uj@g3GZ7 z_cxh3i~9zq&f_j!%*`l5sVMX^7XKnOMT$@>SRwlD z*L+C=q1k8k`^wH|mk2?^=F>$J|T{hOUMZ zynk=vDHt}~@b!F87jc6XHUa?D53>k=LSFuUfZ$ zwON}^+(svm)Ouv(6`z06Yg=m13+$ip-)_ZF7#~Rabekmq#end6~mV8HgaF zl$Gzo31bxPN<4a%^0G%kGVU4X;WcgH%_Ckx)y9bheS>@9d+#n<7fCBl-Mp0X0v0%8 z{bO9o5tK`EqOXYK1iGp@=*a6~^7AZwZy#PIQXCe6^&ghqEo|!^t!3qjxkLpevBRh6 z?00#kuU^FH!AeW4uH=qYK#0fzjx0HOd|#$H+O3)OH;En zwGGs2TrQb?Wr{vzg?CC*H83oZsz;x%QuX3Nz0DHCL6J|GxB*3<#4bmHc6|oaJItfv z*}>HNpd<{gwp=xBZ5aa`UcnupV$OvR^2R#{%E7CMh=hU=UiyXX zPm9}}PVA1A^H86zV8szF)(m<0GcaLiKd2LEOQY_BQK7y54|(qbA60ejkDp-%K}81N z;EV85@Bs<$C}>6!m_VW^4`~$xgaA#c3Y)>`}U)>~Vv)@lM4 zu-12Nv095>tHfyw)>aW8`G3D_?Y+-AGlOzJ_x5-Hzt3;yGbih;v(|p^wV!M4wm0If zoVcSt%1732HnYTo8}Q6dPCU38|0^(k8eP(jf2eCy5)ZOo*^U)RUp&}8Rduc{N&fdx zWvqtY-f$>D>BNOm?t?GP2#0mu|FMK4Lmg?T=NK; zKEPmbnH>yDLwQ=dzO9l%^jc8NN8NyWof!4hhm7`fq$DSdT(lm z+=s$DlmippFQm6-A1NFPYgqO+>`DA8#f3`*Ke@8q2 zlYq3^yYlpV;v~&kl%cv}^$s%6RN8Q7Oid=+Q6*ra0mXJ~0?Lw9Dc@AO4f@K`Qd>90 z+o;rINwrc^fN^$OnSR`UKvu?EUlANE6*wUnZ`}qQdgPrUB&WJS?hYZprN})YWSU-P z;-*H$TbaFq4j$DKqbgc3*r`4IMMeg_11;R$Rhf!CLE{EzK>`ym)f(-15W0Q5@3HSt z-L2jUgzXbk^R)l(WgD1HSYA6!>iEmpDkxOC!RnoTfV~U*m3yl*Qz1J$Qg=yDVtey7 zx3=twq^=e791yJ6S7M?iAi<0Hp*vq=)sT$U$1iLkpppvQk80jdvjGH!3=o#w7U|CZoTB zz%(LxWmV?DN+@bmJP)lxpWU)uB zYL2rqYkF@76p#;rb(sH?J5D)!q_wik^_*rSvTK&vSek>Z+*f{CfwjLIG%DEahSR$& zB-jJM=86tX5bDo#J=Nctxl7km{hgVwKu#sod(!6?Wq)!UGEzqZRW5Vq0Qxq5G4Emr zaZ^HZtY+HRe+AHY@r%j3Lad?+Nu>)Ej7n~QX)!P&3(M{-7JnhN)4!99+&Z-gUV5_l ztLw^GIU5IzRs?Q|+>4(XZ{)3R$eM3erg=eC`aQJs<^i%+6X=-j`pkl4=3q$4B2Iy- z%>XqXZ_B`M=@`*2Fiue+IUcljG@G=e*?995rNJ^(_p^_oLBayh)rVxK$w)NIacOr| z>3jQJ#tDyD{f^Dn5E(++Y82}F(;b!u{x@&T-aQgwYl~slXgguwqFLr4Y6?jag|Ur4S^*#QhuDn1zMGU6JvNco8@v?ytNY{=~#F;Ma$-r_ z`V>l@6h`)ZH`KFp|hw&Gh( zi3P{?TBdI{znXnx2Ex`{Iodi6FWkL9NPeiE+pXV%S6if;Lxhf`CMu+hMi;_gQ2HP$zf}$ zOBz|cm0N*efG>ZLA+-9%2;MAT=41Ht5{Dn5uc_63bNvGcFuw7o)P*oLva@B)JTKn* zZ}6fjQ@2A#H1kauB5+U{v7Z7XPOqaD1ei}iTo58w7`yfXnfb_7bjGjeq~cb@dv}2t##`6Ou!T|AMH`czcxz4I112M`R8nJ0 zUXDLd(d&lI@K2~qw>M)NO3PO|l-sU>>qm^|kAzQ!TT}y*&^1v5vKcwBFzE`C9%AE! zb@Cl9ra!~>zaN))YvVq{i}&M=ng=e1>%TIM`<)=ppy6RfbNv9@gCNf;eeDk z;h@h0Vk~0bN90`mA?Y@#-e%{Y9Zi9|-%b36u-5B>`m$uM)Wlq{c-_AyKY%|VZY_LOI zSq+5{(edr?hr4ufheOlF8X8Dfu=Mt083hH#Wt1e-GlJQ>3vuX@WG${lIpnb79LLc-(~cRijw$n94Eqkq&X(-h=Y&`4xm(xP zv0wJY&l&@Umn?(!16{52Lu|e=d&?=v1Z^|^Y;_uND)Z($h}(ra=J*>Rm0%wN(mFWa zNw9ei;u5pc1=Ul4gfccB&gskl*EM8;I|#pMw%#=$g^DMD?&nuM!5UM+~~f4 z(Jy>+LLB|l9qhPd>IMw+I~t*?_~C$#`qlAg`sRcl2bQi6xS|4`Y~p+f-h4wC3$8is zTfR9V9*n0u#Dz82VEO_Zjc{^E#E?I{bh2+w=psjB)5ZRlE{>lc7ES#4=7gFZjpgDA zLb`tV`Noy*{6^Of-<;6#j>dBR)?iq+(FofjJ%02*=bDQv@#6i#(O9nC26Gs``Z1)j z9^ahMdyd9(U2EzX^V>HWbM#-|toF?b-QZ{}*G7XmBE+?`>#U`|Iib59jpcfrRRQiu z{QR(4z0IC-hfGW4Zbn zfBJ{QqUj>voX}B@#&TV6TK53qTFWPXKN|V_MZP(qc1L5m?l72Rgp0M2E;(+_PknPj z-*q&W>q!&mV?pbe^6te`u`y{1*L%*vhSErK(A;$o`{smVro4`GIe)al z@cd6S!oHPUuf8$k1mB#{@s7rZl`^59AY7cG*|2jHx*60VoapE1mIU%l~&<%EB-Dz@u2(Y-;7+jQbLoU4U9p9YL_Z*E4tJs7-RJb1E z6TidHOf~!FgvL7>%T;dt875rkBP?>g-1ePEd~-t69gXEO2xCsD3LKO+hkbX~TfR9V z_5pM!x^!(avhE~cqY+A3=HuD7lrQql32k#UHmn~T49Bz4$fJDXS2N)3ExtLSpE(-K zwcVt2gm49WSl^t`tB%HUSu92G?)7vV{g zyEgsvSH3wR#-8pJ$2A#wO?N7O(a6DgW3E1M_78jb=7gp=8XLnGP3Wfy7bO5mI0o>| z3BBxSELW}ZXQXgZ!HISLXCD`B_st2_I~vQ?ZTuM}T*0t>b3#2?7;vLJ%au0%6ax#h zR`^b7wf4g2+kA6EH#r*1HNyB)B3!|+)SM8|-Y7?7xvU|=(Zcl`KJmLLcE=3goRBp{ zINHVV0#kj*2-m}g>xF}lz?DcQV%~g5W5c>1baZ3!i$*v`Wms?YZ8$^C3E@Q!{qg@; z7uHf!$HoC0ja&-v*)G2H!cE`Oiz`XJ!qM2U9x$Pg7cSCRM~t^$Mu?!{4wZJx=SiJJ zUt!9Wcri31D*Kj7KlU*_h|=)+?V|rX%DJKhH2}C#?Qh zbCZfeDhinI;ZmY?k_xe5;bRD`wy*fFK0lF%=@IgWpLgV?eSQdo_`ooP?~(d^NS;4e zhPX(7d2d6@56Pw-zue=s+!=BDOFj%ptlPKx;hM+6l<7)Y~5 zX+GWXkbb4vhSW;mE)kMgeJ;!u(cVSaERoU+E=a@%g?DRUCns=zbttuzVHl8&HBFbT z3Yfn!(QSZ5qm=bB#|Dr3P%9RV7S}h`uBu-F!!!*-zPxE!{SwCr6BG1fasBF=+CUiU z0qoh-t*Tj6kBc}#)6l#^VHZ(9YYLdK$)Tbxi_fNFHq&wtP0ZBseox<|4q{;P!sHZ; zS}6IFg|(@bt8(*?0oJbE=eOd0ex#?cAyc<%VPRikLC1aN#iG8Q9+zazKE^<@ut3y` zbH8X_(%eptFCmnvT(HBFLq$pFP@h&VHPfc%Q5G(nLX`V1pD?wn!fIuv&`0sAdDZH= zLLa5@+{b*IL#PZeViPt$JC}ds3Lt)IwVSaXgyc1yG9@ zEoZ}FwWUd*%bM$JFSQ8BtS~~`Wr;yL&ox5Qlyi&*<&ZFOzFDB0k5aC&YR}y}b z{A|dv5~OJj8W7T=XsBDdFjc?0j>&^1q~2*lwPrZ059_%!w5j8Uis7-M-DRZb(P5Z z5}1;zLCjLl_)oFe_0fmI`W!!YtRTls7&}J4@?PU!(q~S>3f^GTdrF-Bp0ptJud)3T zwzcpS285?#`0{}nGH`kN8b6^6-69FQ9Ka932>T$Um5!rJ zwNVhZy&@lTAJ#@ecn@J2x5jZOp}7$U!sNoY_YydaSKj(;v#%5vIxjE<9%rHc&0`GB zeJjt1G#{AEtY4EnqgQI2+c61o)Pch;waaOgWueX8WO@z`%>8TwsJJuF%Y(MrGvnB2 zh_^n5FVG;x4yWF=U_bKKEPUqh3rBjYGM7T*dP@H)(XlRrnq7*=DtX?o+#Jh)y9#Fl ztJ2lmcY;OkqdEcOHJs{6X4duQ0lzA!elr;VcwW5qeH372DYmNjRK}-m?cNr@VFxf( z>GjWIuYX4ZcO+qdJQ?W#KaTMsI01K;yjOw!ZFmI#vcpQ=>*|3`S=?XsBQl%RwpVml zxBV46Eb$vt3?==nO&Zg66)8)1#jm@Y3Cu*N#vd3vyrS(r<7vE=r{&7iyE}LGg0^I8 zU{$7V128UaXM(?^qXMTHZs~xkB`7=g^hy+ONetf-zhMwQCgKl3AEaVu{5l?tPdxiK zL1e0TRAu^f;*?vwmAe@xvdm7LHjupG_O=9L-f^n&$gXEVYtxHcN2ENfN>@A^zwQX6 z965upo=pSpslq1or$qi5__mM8uUTdyzI*k>ex$MIE|E@6w_$&3gyU^jAp+Uskv*xy zO){)%DE78`%KAI%H6nemCN+g4{SwrG2P4bc~gih zyC1JEeXDtwJ==~W34+Io<#_7{A2B=PipbPpXYA$Fu&T`EJW`oD0<~s(rq74Qo2}KQ zpEU1s>}H>;>j8Md-6yUv#bmFF5+UY2iKjvbp+vdP5c8;?Pr(!O?gqs5>6rH>Ag(#X zRsb5nQ38Djkm5dZxFHZsikk?CVhI;p0pedjs4TZ zDuz@g5I2?KT%{_T7a<^%b7&F0z|O;a>G?c@BKY*?^7eI+>RM#=%HE+B+3p*lPlHFS? zOFxdca#y+Ry)BU3B~N6ZiVrNub;rBQ2kl8cl&Oeie`=+8@Ms!HoDA=3K(Z0;_&|DW z_@5biYLJ8+N60S(_=DlwNGE>D4oBDSIz!k z$)0jKPFlb4pJ>I;CetoriYft=#3L?EKvtmaoAu=RBa07@@`&0+4G9CK|{7lWO z&XoTHeS-+qF1az!p2JQ}N}|@3zT5mH_Q)k7*~59HOF+Aq&$Cn1XbpFzsArbPag@9l zA6Q0ZwSTAw>NncUYuS6bIy(Trn8)(vN~RuPRUFrt6!%p?++T^wNejjGLM7ntNzCKA zpF-3&R+-f0a78E`<+u`%`n(Yk_fTRU*S5JY67y(&TBXxJ9PUUIvq~qfpsLgv3rMBT zBnNRvL%%L@I9?f}xExudwjYNRQHqoo!;K(&C1RLPk{{|9K|zA*3`Gd z$SJ)S=Ut&Bu%>%vu{8sb-Nz~41cI@nC;!Bp6n2s>M6*S_MvVkYHb{vN{QFQW4E8zGw7yk%8> zPK9Xr@?su_+gjFXd~UR__^%jljaa9chwUr=?_(KLXL61XndDpbrefy|Pyf%oOW5cmJ5MpF7Xij1C zgX4(G%z?QZ=G-}exSjMfLq~7bzmQp5k22(spjktY;7G1?#UcMXf&T$$F4cxB$BKk* zOxO-6r!D^hnhm`Hz&ZcI=3qU_)SrOnSTjd==^Yog^STY`9R-^A%?>fiHGbHC3%DoX z!Fd>~AHz{P9FOb>-RLnB1YsT#(0v0m-{grIICh6ZH!f_4aWn915B0oB6!LH`|Hi4b zQmh__T@0E&6uoeaW?8?ovf!;J#M7HbL&JBvvVQ&Y=os&7_k)i4aMOO!^#R>&`$>1# ze$bKRz5;Zk#)Zt^NQE;1J@_ zC0on-cccHGY78?Cwqxy}uC8#Nhu#{GXU?f%#FYaIGtrC}5yt`9xu59IQEEO{No?a)Qr}{p|E-2S5Y-$mG_k z!x1gSYh7_NeO0lHtpg^r2IHG%P9>lz_+ea%XSqP%!BfBf0#JqE{)A^J6QM6_t|!i{ z#R1pu)M;WH$WGLKtCPb`n#|D9C|hALF4rL!!QZJ8!U#O42{andq(G-TNcB|0`h}Ux ziYi;q^im0!_K`p^;NxTgbr9Nqg3M5XhK~F>gGc(*@#lhCo;1sTubLK$<{JjJw<39GOqQ0IP9T z%*~dyy}jlGDqGI-Ql)`}ji72bb;LFal7nn$or;nw>eEXG*?dN}5_P~oj~!ZF%t_P0 z%FNL=QSh&yg$TK@FU4O~R2CD;B zX0@Ve&$BAih}I)!4xfZFe^q8-QB?+0bThHMt+I4$le5ecKL5WM0oj7f&hlBZXH{j^ zBhRXaBGaBoseR6LC+;~e1BWhwwpV;4OQ4vCRESo+$=0im%kawqy2`-GWLdzV3zP@4 z6XD0X_{F@1cxnc)Q7P_PKr`j*_wYPVpqzSOrdpzS1>Hod6fz@VvI;3*0|R!Ig`<7t z(BW#pW^aXTs=AT`M{iD-MWS4&4O;YPXdQ0cu`n0?m>3RiUgrUkX4Cs1-5NyUK(vdE%#~`Xwt5yIu-Er4O zz@p5q1~n%ifYD<7relF^zhS}0$chhQ@oTwA+OnrC-g+p2$z+MQ9)PDSzK|GZU(huK zpOKy-q^D~V;I{6o4rYa$If)r$DrEvPz>f zNPcsF+nvbhLq;+2)}MgjVID>2vOHUzuy$PwsD0YUChSjEU4d{1WLNh5;6qlDSiEH~ z(t%j_&R$qJFWTWjK$9z!Pr>dgTU5DqYB7ktEOf=Jb)2nJ5u>2;w(XWBcG!C16__S?5uK$j=-T{^Z=$8wlDUEZef5Do=GF^v=RzlmA zH5(1_gXGpt_@YKAgecjv9u>817QS=eFNqRjW`Xt{889UtL{@o;hoZ=2$O+2|aCS*-J_~J~duF9A%lSu^}D2uOa+EjSYQcZMLG{nHQVC`FNm5;urIV z;d!w@ocmLH$Gk}nHv`b=f}h5v(;1T>b5V-PyhMk6{y!_;-?`CsuD{zo_(%XPQG^b)Sy@$8A;P0d3p zeC^bS$4}q!Ul_5B~n5U;EmJw0lq2+i^7+%z?m0BOJ>}SdqF?U;A*a zqp@MJD$_B=(MUa>%)@tnd~w{@K4jIVqxPZZ;Y1R_vB5+m+u$oh9iM#mRA2khUafwx z<9fz~&e|4@aH;YTK*v0=;Ywfo@I^<%u!75EjA=A798bn|!s{cR=p!k_i`*)}|MV{! z;o>G2G~4?8{3KsP@m&(Y9pd71o=F88do;2cPu8Rr@0}3wH54y!G>i}3KTHhcfTNLn z@ML^0`}t2!@HG@a4A6uxR%ZM1FZga~f2u__6h}6tR^gL4p$Vm(Lde&yYyS3!zdsa$ z1wAFWMzU*!6Pgg$VZfq>%U6sWW_~zBH57$ww4#M3#C5oEv5e@hTX)5as-Y-cV-zbi zAudXbXvA_Yy}#%P)ld|!vC1VhAudjdq7nK=_a7rqI!HAXg=?H*g+{>MrYu;t(THuM zQ%?G5FELn1&f7+-Ex3^tGo?cw^|Cw8;a`)9ow%E9SI3t|fVx>+-@nHP4@~@q&Ui_J*1w_|TZO#S z)Ew5=%aR=q2WlJrtB?)a*TS#?**l1x?nA}gnKd)%En}qvnz|G&h~@4k(cFa9dxrg> z!ifC4h;3lCsa4BsC;;=eRjtp#D}5aoPBJ&>{k&2gQ9iY1UTF>X zHL=TmDQ*gHu$$aP#YMhTSfBO;_k@zs>mpgRH zoVNs_Qc3@0j?myZ?9g5064NaUTFjlF4;rgn$gW)ICXQDE^IU}gOE5Cs#?dL9^KW$c zmdFS2Z8vD{=6Dj$`8O^oygl!?^Z=vJ-4L*H z;yJ*|8XCUS725UXz~_Vgq&twr0awUBMt{J5&@nrP?FSvxcj|u9jouGB4xcCP2OWpC zQ}%<7>6p16bevdRupe|Jso4)Y`nPgF=$PKi_k)i4eC>YFv5&oBKk0ZYaL^U1FYNoj zxF2-P=l1=e~`!}`J0pj5swS-i^*cwJb^0l)V1DOfIcs{ zeZ&T~4{@o4jZNoH&|>?Gx2zy)I8WO7@Fl=hl(-Egq2Lt>AR3Hl24gLWK&-dBSi>fw z*~v8j1D6+s%t#hVD7y6^`_ADM>WcJ9Ai4-YJ(@aSAf{E*&o7$(%K&Nm*8$S>w*ca> zHzpU@>7t_MiP`!o;RNQL&5kG{#xy=0h%u_uAM#_Y zyXiLO`&~A6^MR?;k{Jw0OXe&Idj8bDey-vtybnF0no zWo!0TH1%?t?ZiD~&m_~&NjmR|#M}Oi4<;YfbmyfIGB$bkKhEPLkK(PIhRD4hriK!C zvEZ2Q?cO07`PEej5h!yZS zIJ^^$%@ka`b$l*4XVGYV&I>&(PWx)iz}Fm@z!^+f#>I>D~>+^EoS9!hc7LgW0mdG&=FN2 z2me}?-kE$TeS^B>`>!QC-;O5RV_(Lvtg3Wp^Jr97;V?yryF651e%Fwtw5BIiv^;LRH(&4w>juu2R#R<4!@Z98lFo8^3Zmc3Pj_p%LEz< zs9vBm0kJ#BF(yEl3RDlMNT5bQLj+m_Xt_Yw13FQlTLG;Q=q^Ab1mZTC;yM9w;VI_P zc$4CG1LF7tS3W^#X=n*R4T9qd38pmW(OfHg5~z^@(r}vrH45%)fRy*!fVh|)^X_$Y zzXPN_#;btX??aId&?`aXG!XOF0IC)!1BkUE=G_cP zIlc#o%Y!lR#|{@7yQrDgavq#3IGRJd!1yt5EGGk*y$Pd;BFFBe+2G1QcL+5oetRJf zRv@YUd>#&i8F?0q4g`h)(t$u3ARP#BzlDS8m<$3g7U)Vmwcrx7&M7H6x3c{7qG3%3 zdFNElnq4$y&iQjI^nGf5-SWjnv$5cz?~SktQg_-CV!fG!Pxlh1W7WVrTb{lV4zIZ( z@Um>}qE%SUXl}T)Vddow-ZX0oqiFcBrV*!m=h9-x=|$cYV|WALEGV>}j!o)=Fu5!q zy=GVwqOY4eeej<$mPw*xyVi|4tzo_K&V>NnrHiNHNY52I;y zx7pC-;O5HHZnG`I8$;dHZ_oGrZ8la8x&s^+M+|hVUC{_vIT%*yy+5k;x7h|e8XFed zFdcI{8sVA;F^ReN?Dn_W5+s1*Hk-zf9TOcxh(_A+ahTt^9)4Xg8p`^T!0Psw?+2q`on zuA_y^=Hd2xAM1CtUtT3zIfN#})nB-5DL*@L+Ar0}r-r4KLuf)=1B6T49CT1#{r)gD z@~K=}IfN#}#Zf?%`@iD8uyfa5HS(!kS~-L!#C5E2nMNy|YUES7v~mbdi0e4vvUPs) zE0N!+kx%8)${{o%E_QU$2+NU@F|}>%?Y@yuj*IAoMxb9C%n5i4%XwnF0$ZNMQf6AG zd0~w-604Y_Z6-O4-46F@riN(Ft~@tn9S=t2fZ^T^Ip`D<-1bxtUeV8nhW~EM!)y;^ zzjCoPTBn$i_7(pXL-}i+Vq*GFkP5zS3GiPr|DK0=JP&hCUVK*OVXn>N`XG;HR~}|$ zUJTF4qhY0$R487vR2hMEUr_lZ44V* zQ+}L;NH-v5^HDdSxO-*KNcr1nVQ z!A3VVgd!z2jl@tFBB92M#Ol`QMLBeWMZ&15+El-?p=JrRQoW|j>r=JMMy3`nT3$C2 znVOg1BUja7b1|e`8cc0qBN28fB}11;V>V!jRu81PDq*r8JB$lc*f_Ksu9E*^w@mg9 zS%ytDQr#S<$OY)QIula{rah>jKgQyd;|uN(jv7~7g0Z@DpS2@cGH&AN(L&7~L2Xs{ zVYuC9>U(f3?V3Oi@UPktG=nJ#jj}EUvE61wH=C{OxRn%-*PdS^MY@|nvoV)$LU;?0 z^Y0&kX0YjYIbsw4pa`r!>GS9KcNb_bG~F1cok};c*o;$@?ixsiwV>I{VJ{pMaUE#0_M?dHi0cR2GGUF_k5_As}%Urx%?X)w%IiV{#^!|TTW8C)9_FH8y(i8Wq!>afz=!Q=v+M* z7uGLk@81BLFXqyX4d)+6EnfxAf8^4QnGh=9u?XlFpxJdYLk*P2gs@RDwwpnxU=gYY0wNgl~mgA3fv1oqATYrnsTvE-{aZ99+=$Fk}|xwk_EiDz{~QcJ`by7`{tX3 zCEthHj7+R>%@Jbh?}y-uD&3wysQv8naC*u-(Koco^%tMQ3Xe|zsFOd15hfg;W2Lzpw9_Jjit{E zL}TU`3bYW=MFNG^(R}YMYi!W_lrS*RV{W z>&jgn?Cwc{;LfP`Qpba4W`O1-u237A?63zB4=;O??8#c)+2(B}9oZw0u`r=0MUw6; z>EPA69f3_swo1*AFFJ_(CW><#$G&AQtK7qTeeHFpQi7;kZKtEv+LE;YAH#AvwU*

{;EXXbDPljY&T*bh#vRQ)1q)X4=1GGTCcDk=G16n9Js&y&{cPJFP1dz7+0?i_66uWU*TJR!Z5P%<^t6Ql~7={^YN~C;jztK_n$TWH~5g-#3(~@n!h4`qTaPg^5YXgQMIM_C=^Wtp>!?SD>ttsRaFP${LoQfEQ zeL=gWFNsIM3gt(h7l^k#j|P-IKykK+%hNj`;*%k(swX1e+LFdOXoiCpJLozS=EKnXQU-=3aW(TSIZ(+Cf{Rw|2H} zYd*>DWal3Ru!DgvNIrh)4S<#gcy-{!@-n=s$|_un?vK9MKW_>!pPa`GuW_@gj=K76 zoyIC2xT9H4+FX>lI8ifya}r;4oWT){j!}N%pg#ht#V_XVa=3lUsOt1nFj$~RzdmK4 z$aA;L|H++B@UT$wq*4t9=^^KO4&i$(!7 z_wV|;(4k!HKqlVGt!NaL>CRFo;wEH_o%WMhKvGYpT` z>v<5kY8yJ|7R47=ZGVaviWQs8uCD{39@?KobBh5oj79 zrMn%FHVNwCDeg#AP|g%$9=q6FVKc|t0fE{z?thl!WE_cMoNn&prcr4H~7MPt#?$me1da#d%-b1GyDBLOfhQoZkt|_4j011 zK!V32!H5?Uf;PEb8VrT*Ds*U|;z##kW+T7M!~6Z;c=uTJl(L=!Vn(RLPZy_SA=Z%&rZhZK4Y zFV*RfVYmm8Mj6_qNHUU{BmRW^z7I1;D=FGK;AwM5*JSWnL4(o^9@Yp+nj=BSafigi zdJaiDz#@<`J28*9z6En1FuHOWqNlY1bt&HZ9I%y{@;@RWNKC*J7h9GBXph+GVy_H@6vbnW6c#0;%@>fsiWf&j?48?2lyaum#rI&wSWg zCcP~4qiX;PaWrbL%B<4?sVq9jL5m#J1W3DBb`IJBKLThOelan^sl4nbJ}|H|SDKhCzyOWb}3x;)2JAG0H(>&6NsWNC5jR5L&)tbwpK= z(w8?X+02p_mGW}u9ghQtsun(C%e(P_+~NG8fcUy1AyJ&TjJLKaGCWXeR3y9zP+q9W z?TME4oRaK7f+{n!VLb~*pk3wRNnBzv9Iy7PR1vU=mMe#n?^G0GWo8c9{H8=BDnOEJ zkMoPgEq$|?{++WE9k9>wl>ZS8Yt9a5Sf44q4%pj+HThj&-v`P+$53As%Iq%+GBdsNDm*iNRvPJi;FfW=sTJ86zRm)#`Y%9#T&~ zA^u>iK;yGx&1(H-GZq9KAfk>|+cM@H7%A<|d_v*lt6zKL@@*EraonwGV8wkOIj;2V zicy$0TVX*5pYo~`g4=GYoOH2%bz_brNQ|_fGX%GXJpch)6dH~h8OK}K`k`xt{dRpZ zKKT(%9c>~GGS{Te0148I1qsDjvw>ZM@nIZ_S?AP?09}e-Oiq<5jti>G1$PUc+R1za zkaiTDy(z?XDurHg&^r#|O0<4G)Y(j_w4>;95YIkn zS9K6%nx^AabR!oFZ@Ghb)q{rH1c+;HG4Fan%FAmL^(!xUP-q#pnHCD&20#l0y4~Sm zx5IoL0qA`BItfsNKr;cY6sSN)W|yI1eD7B@z6ZOKZobGS#ZC*I(8S;xh;&z0KHC4L z6XNZZ5a-&G5HLQNM-A(TQ^Qk;eFu0h#xMZ9&mpqW%A1|D`%q%gbu zypn|&_MQc@YNwzJW!2O2#qZlBg(~yz$0wC}y4vGQynoX#NV_hAYu+GQM!v91)r>)O znZm9sMV{pLf`)uL$k`ES#Cb2)BDWbxJqfJT48J{74$()=)Qmrp9q(c=Xr^9FpfSw=DMVw$RFesCay z@=H93nrlZSsdKStW~&hrXT^MK0z9&PiWa)L#Xg zha@w`95DtIhj1YuCQ8-(Fux=-bIU5z+YCy?;L#w_{2K~LJA^7gtMIdSF$<{RRi&TN zZR|?yYKC^HDY&HYuv8&>t*Cg2J%aE3Fa*BV5k@BT)<5tT9G0&Gt0)nzz(_1GT(1>8 zB)-A%IxmXJ8N_4X0BaBsZ?B<-yH-(*Pe93gx*}Fto5JY6WlIm#;N4D55(|7nhQ-3> zodN7F6e9_Jg-WJ6-pWg-vD^&&JAMlABB7j75xcsNeL;Z?01OYb<+*s>MlWP{9v>X` zTE&JuMN1EoQ1F5=Gbg5L>J+~@Nb^TFXMhG~T+7Nc3os`+w|BXl*~ME2;u{Mhh~s`2 zaQ%b0_fd@?fp%18szdyL0v@;!|C5Rf@&BCsT+zWK!yhExDOlvQFC1@F=0H86_kI@O zEl^Lamt1aj**1e-)M7QRLf6NTIc?9!Z+sLLulv`?{FFNOx^k|0D+GnYx{A9jsXKwo-J9+0~(_nrS2r^>PM+nQ&&NjVXIxlZw%SwO1=7eU+&RpzkUHslr9hnAsJ*l>!}M$o?_bEcc7Z#%y3I+U-A7YZ#QB>!9^8OmOsw`_Bv3dYt*Tjpx6fB8GB}q+{y8IFxI1Lc#0*x?`n@h=Sjt z0`bZUneHtDAMI%~aJg?(~>~X%HYmK8R;xPuep$3CxrW`I` z&-G+SW4Yc}X3-suM!4#B2>1^!k3H+_xqj?uiad0|aQ*b3(R2MdFhsnvdCXu)Bv4-_t*>t|#7;oF_O!FoTIT^a}4HS;o_Np#&GN2lkV`%$#M&r&NnC9ZsObr*l2_r z07n5jbdgs(~icbi!(gB!|+2M;z_PM z27k9y^<44d(c%K#VJ<9=ap?}nFB&-(PaVg^6Z(E}7;;ug$BrQyp-3l5?46xYsh%rdyze<08`d^c$5#arq z{-Wx+;>CN~(O9nkG?)SS8s<_xS8{bZ8p}1AiHBo{6^(4blQoh~^;`*+2Wg1#4l)>) zlyb2nq*FatLWc%vi13~?`EwlLXoUGsx3+iprNnsq&^D)kjePGAukoH^Duw45ypS@@~e4q?jH)PHqRJx zP*a!QDf#_*J}(OS!_O;2G)To2b*p@wUv?i%%irEkf3qChDH7|0Z z>BradQaU(<0T=JxbWXXh&I_G8F4if{*X=9*E9Uh)%#ZT?5q%Xyr(AvXpWqZ+nTPp) zUg%txv`)!CXJ7GOF&t1@rx*_Gtt)J5xKS+2u3X$SvQ`LbdlVX%s(1<$unSXAxLrb% zziWLw4bBE{RYj)ab;Zht)Y6qJ>Q=2~3tX~l<%%2>nj|wnh;=~)3>u@u^sir~MyRR~ z!_UB7ta!8PzX0j8@HExoa@K}gt5poI7~tZSFl%hTfV}DQg^kcoXEcMHxol1K4NJkM zgwEPA`H_A#XspW12&Qo*beZMD!X?NqaIJ*eaD4+bVVjJKv!kLy?59yJS`HoOkOwBB zO_#0m{bF`QjTW|QYC`y?`W20cwf`m0a@$$h^8$s~5U(mNzY{Uy`c1thv7SQX4j;Mi_zCA4Vuw zi9v>yoWrpeqtQ}as>AHQe#Qr<%k1ZZW}R3|HaB#b8scv2)hrFZR-b#$Y^lGst8l$@ z(A+X;kqymtH7gsenPyvWnrc=oytK~L9A=91#Tr}If|WOypg=QuNE1#cwg9 zQv$VObRYl!MVjCf#stFaKu>lNrfSD=3I)e`ifSI0jN!6`b({fw3pC&1qzUc-{8SS+ ztWnId@1H<3meV9Sc9cRldVH`e@ty(xOwb&{0O9DZ33ptHVDxb>JXi;s;hfaKaU^Nz ziYE$2AKdob2AVx)sL9!>m{J$ExvT@$|c+hV?z1N z^kobAH@=i?&hg;qUeNVFQc=C|Py8zhYaU+=x{E>c2&X!5tTsYd8p;;0op?-a?&ahL zj$;S)FMKmJ={iAk4yQA4j&6Kd!~0rF4q73QSk3IQf8c{^e*; zGq?qYMhNlHbW8}<7cS7PDMUAJ%y`Sk|Bd+F3c8+Vi0OwrE?8{d$DkVknxp73oNGs8 z^7HR}(EQ2JaS$l+8($KN--W>U!bExzC)03#xS{GIM|oF+=1;kF5L3#j&*$*(UC=x} zP~Tm>3WcisGOvSXev#6-a7T{~)j#fXT?U#T4pKTccS*6ETILJG z9hGAl!b5tGhfp~FBn_9Kt%|;z!XE-w!&j>kZxyI@Y68_JfY?=Cu8wqkm)egO2rO+Y8VB)GIdr_)UABwFc7xfjY^0h{V|+w24wpZj zOwS%#gdNIuoXT#m_)ArL_4X1~72*ctr6^?VvTx_^(ix!HS@MK6<=nD1CjM0-X9wcSp$f1C+N#ITy9Lu;trvrP2(B+Zfk8wL8vK|EV~r{G2a`nEu40s4+WJWH@qpp_2V;2^FmY8YCB z%qHvt)*fuSUePbPwSvXz;s0*=&+BEsOhoOpSh93l5!B%M2FoCsvwLTfy(MqNQhDkU zn%mD@z>^#>DzSdMJDJgrv)k=B{bWySKzj(gs7rAkn^%M;xtYt`+@Zt)YxSryQ24Ud zH8nRkMvo#19xi})SBr+T{=4{U*>SC8H$Bz^B4U|(fw2UeL>#hzt_1O2_{HRyz?}kJ zj;CfS-|1b<+kvNM+us1)EjYVlYwTy>a?J-(A7Bx>BQ>THT1ULo{N$?4bXSyA;FiK6Ddl5@t+#Vy>PE}FmjYQo?DIXt%XWmtlQTb7tQ?UK~ zK|)k&xPz{n-TP!VDZ0aMxX<4V(;n}#e`m$fJ?{+y&BSxPKpf6|Um&)e7J*jasbALs z(yweX7s*#v_A3PX0iH_tGeAn`#G_`QY7(h%gdKhg$M*^d$6tWoqYye5RjfQy@fVy8 zga|ctQN+_2e8I&AR($r)7oYLAEPSztk%Z|FK?D!DW!6GQ-Xt>e`S&|jNN(zUy=UpO z@wR(GY;bK`0T&XIKL#Fctvo%^2uT+l%_r*tv8vh*oSneQa;au8=%V8918dkuPEbMo zEwK!=jDT}kPX0mOtp?&8=x)q)5^!~Y5rObo+x^Sgkxl}JF5V4FK;G_ZLrHHp(ojxl ziM}`oqAWx`6#GMgn($Pq*aqlFg8M3-%$=C`J3LiB{sWMH?RH-eK^fHu9S@zTROCGI z-vvhtC>sSj-$9EV^aViL(7Dd79Ii51mE1D1pAnLll#&!A$(E~od-2wP11P6XeGw@& zfzkxWg|tXm({3S;NKMoVm{2hG|K)mn^$@bt<{j<_pxA2bSW{mPrKe&F&f)H^-V&;Z z;M_O*^29?Fq7n+_td*crkyN$+=M;&l9wxMe`n>VjfNbsD+_dHRM34d z`yyHkh3Zq3VJcK-0b*T^$x8lx0*L!gK7{E0vms+#LDR}y`~`Tt*$gq+NX{yW7u zq#;Y>YXm<-BF1mLl~kW1GS@&L;xr~MZ5M%Pb9mvW@TeqB{I?`28jvqdeMx#AV#^q- zy>gX-wRl$f43rhQNaed^`Y$aydG zIv3~7RntZUede-$G(|NDC&AER`eKbz4LFSJj8p?cg&OL&kxdg#ALqYr9){>`#7{4+ zS7^4w*_6o$z{DpwI#-Dy@xoEx*3DpKMwMsQpd+}R*@dPjBjW^y%L$B^t4llMZ7igc zZZl$L^T7c*IVSg;LcPLG^flZo@VK=d@A9ZQG#S|q*fY*{2#oW&|AkCa$=|&%>t{j9 z@5a7CalwvVrT3Qrsida7_zr$Cxs7h4Ku_bT(4QP6>yh#`Pb$w8LkTXABak1=V`TBC zW#|LqH#2plI}74xOI7n{3(4I-66E$K+Jw31)VpT{A`U5G(5OvaiV;E^IN? zd}ctTFGoVPjJ^P9BYrWDB2=LV0Np9L$MMv`GILT(@B=^_@x#3WPMRO*pmIQg8Hmbt zZMPgBSK;JmKN-=cYH^|$H`hNwQ+~L)zMWHB3}}8|1$9@R746X6q{T9zad7`7K{(5C z*}?l3MwMw#WCupwRJ+rGw;=m;R`$7`r*Z3+Dq{vRbUv@Rz0m@heQps*}#oDACG=@8=6ETrbT=NlC zYvQdfV89Cxd^g7fBh&1fl9wN*Z+1+XteqRPQ*1OVOxaogA+K}mKTNoV#Q2y{{V#dh z4K;)3l>;Fs(--&Fz~(|_b~R30&n>cJeZ;|lu-=eicW-5;9XH?ERf93sG(=q6$udA2 z@r#K9l|mcvu3y=96zTxPK8F?Il$1!J9(!0TO zS>;x*2yu{Uc=k*yVZs9Diy+7zQ~29De6s^hnUW7j^D9is;Y;=f2(sUw4~SAHCKK|2 z{J@Z-q@!hTkN7PexLXPLb@_t>Bnd;1Yu5H=ox}Ie9S7L1Idp*?OzOZ8o(O#`gkfS> zy{F`PyCOzSQc3+}sksm-6*ITOKO7wFMa6MX`5 zczp~Dc^&OzD;TG2pTt&FHpCDfdXipRSAyv;cw6$`!_1iQLJkr!;JucoBiZNA1P6zg zF)>lXIY3NwOEhbkRhnHKmMU%+pofLdWE?8C4yd@)sZsxEA5lN0W&KCp&BIV?Ny#KE zil*O@EV5OQG3#!5rbl*|t%LjODIa6fMZL3(X&vaII^0E-D;mF$sB�P)#{F)y4>; zO$BoZ1$7d#uZ-<;z`iJYKFX@+TFnr=XwFnP$j>9~45Xd5>^(SD(XzK!s;p&iq{V>`6bY=JBSlqagv&Aad=L+3~$MKu1%YaBK~o0=v%?V2d*(4BqeL{`Q#rF)yNl;N0FTxBm%gtev20h2ix zOC76ny{R(&l%14h4})q|dT+KOfWr)?cUAjU{jkM?8uA)Q?T(7>uRvQ&^BjYidS584*Y?S;s%R!$5bcf)s#B-BCH{-ckpda9=rNj>8+k)ea zY@Uv-O+@Q56isS~I_p34L(!n3zP!|^;=pkh4x3N#VVLj@|s^9X^Gcpfbf zd$nT(nuq7{0xiI^NFe&pjwm9lO(zOO5jjF2mK4W85pM^cqXgQC=V*a;<4I8y@%G@! zSVX*exYVGe)H}Dau3^@!sv>6C%5&x>sw&HiX3jags&Y!vjEc{lc@U1NoZK|5sc0sSPuJI;HluFs=?4+j*t`h9 z>E5s=yx>@wxx+H#&H0sc6SFIfKgJuq87SZn5b&t?!C@u8iAKwB=B&A&ThtIdeHlS? z|JAyFx0;gWzi6ZbK^_9=$uAXe^L71bVTvw>3aYZ;5`*apY&60Z&jSDrdu;i;zOG-R zqp@68OOCXvi^LQb&E57jU)OIhQE&&iunshsUcg2p>`d9%Mvref(%1Fl*-5%yj?3ye z^aeH>;aSaofUar!+Xud`pS@$Kx8s^^;(VZRaYv5)kq7?ziLdMTc}HW@wF5MCs6hye zaft(}_|4zf`MQ2@k^t@?7uI8%m6DohWT<}j{&woF`&8Gju69jLQ~ed}B|&4uS^(ea z`rsFhP$bYD@lyL5)%7FSqWV-5v3(p@(r~eC{jfIdx%7V3^&|B;j>d+y!(i9}BV8nd zd+|%RKBl^Ue0$T;Sgw&Ke@GvV)bfen+@%j3p}KyIq1CsEdzQ;;uCbK-u+q=m^N#BJ zk;~q&*UxcPfSQg218D6bF03V;2W_~|*Y%r00=PpRmt+nwhv65ETnsLjT=9?JJ<8Yh zTMG=Guj_Y_B8;wIJKlQWH|n?tj`DT=IJlwnb^X$ckO7O{l1i@W(d~cnb^UH~G&VP` zClTC{_(dZ;VanXh7C*Pj*Y#_6G?wc%Q=^U&uIKS2$++YDp5yEKz2#^um(_0LKq?wx z2S+#agxBx(b^V?*VIA%A(AVQ57YAH)W0Kz}@pb)ZFN3bXXY zfp>Com6o#L8`}r;DRNvNIvN|+69zL#xc-hO<>8f&9eLLv$MuY(v0Tk2rGtfwgdDCv zKK|OT4R%~t256wGC8`wa(GcNcJErS9=}WH+5iZ^)syH1UMMGSapV0{G72O-hZuwxS z;~H6_SfLTH+=M<1Z_&s-eByWKua3HIn2RB8V9}9A3&HAHv(}(rM!MK$?tS^=ADrm8 zZZTY>38(8M;bQ*LO+MhuIEV``^p4-rg7kzYl&<0U5RI_r(+z)q>IuVrt}zCSe;VvX zCiD@+NV-^C?%Z(kc_Um5t!^D@!ZAEqxNIJta%X(&$$nU4@exjFLNPoA*eJI$ojb+n zl0_Pvnonmy&~SZn_mw?Q^SLG{T4+LCBZbQ} zB)LI%q|Y@`xr8RfHA=WBY3Oc!aKgExe6CW(3QdTs7$3s-?iTx8=I&yl330K4`u8OB z2HlbXmsVe)330K~_;usM1@&7-2e`CK2~CKLl}7K~1>jxr+NQV01h}+H2~CKL#UG7W zxspkK<*cy*F0C9wLr=ZCO+94st2RBcd$t|ETPsA_5-5U=RQ;UpZqV?vN81Y4DLA#K zeYb7!wm?Pe;nn78@{<05kUvw-o&|-w`jqvlheu3PYUSlVhS1y)7cs+3DhTVxZ-!{> zD2CtZ^y9BWF(keu#6`?c^L!qkm(pEU(1Tt*cqtE4lIM@ri)Sdxbw5Gl6hmti)+wfE zUg#(0VQ$Fd`dJ?4?hwW-lh~k4d^+<|@l+mWWyl|T@Pj;>a5e0UZMX4 zsh|-y2E)3sypGd;bxLz=UTz$g7oYb-p%=PgcukJ>@m%<-Dt?WZ)~&7K5O;C?(z>P; z?zpXAvev2pt*NO`)vc&8STjMluU1D8lLaW+;!@hxHSjFJOC`<%XrYEmX#rw`<-N1j z<)W-8@vBX(@e;GnDXBSk%Iu2SHM3@)UwO_nxd_{j1JhyS5r~6?FBj$pkc*m^gf2y9 z`Z3owIEG#>xiMFAqmoTHKX?Qd@Up263a(Jz)+vx5EtwHbsh(9ctA1%i-KxrlB`bNC za&ZmT?3zR#Tn@Innni1=z#LW~)>_PbYFt>q%Cp&T-SQh_=sM_u^A>fM{ffmk4b97!yELy{bcq(fsds3kOH<2CA2oE1EMnD2BB+9E z@pX&$@xd@GY-%WxR+-BX_z=21n)f+NMP3ppUYVx*$wm5f=AM(h#i+=u>&)sgt2&mM z)N%mZhuk7<%B9dZ-+$?M@|%L7eJW{lIZDvl!19rl8b&EP-~lSAK}uyvR82ege60(M z*77oMDI1i_Xu|H6YQPdVQ%+Jzs3`3%9$jCP7i+J6^x^_oieU<_=84|S8B=CW)RJXA z48GHEt&tixd9SNoyliCcNW^QDXgPnDKJ=KerDKG!i2BevKED|M%%nk!*>(r}`2R1_ zhaNlDj7>Grb?EPA`ieUEaxuFV->0E3dd2ivTn!MqF(tvSP8NqB#PIel zGsIiCz=wB0Gu}*H*zu`<#b(xG2n+oS>4CXz-!7vulWFs zW%27LAsn1=NnW#8-%sWHHS5>t8`pMlCmjsa?_@aGE{wMxBplc=|Lz8$u;C}466s%w zLXDm?7ZizK1W9%6U-c56C4mc{%F{dI+hEC<+uAU)ZFdaGb0>Hb4>H00h|?#|x9bfq zGp7;zylV_T)l^lQT~!KV9BQ@4J+SR~QPqfS>ip`+-xA%hsf%E4-2i@{Al`O4H-yI_ zi2Lx}|BxDtBYXGBNdR|97Ni60rPzVd_pn}&iv;G)&iW^vqkM{f!rq6DJLxTR1k=7 zd`q&dxp2(#`Sq zC&6pamgL+(RgO60qcXUgdqiN1f* zDJP6jQgM?=wbykxnvRW8SkI0Fa+@#N7bqsVJ{J?Sm0WXEZ62N(9Xy8!^faDB1$r0HVFGc7;zWT4Ip}ggT+PAF*nox$)DDQNE-~*`KwL?Qc^d(7 zbtLA|(w1_3;-JIOHn<8B6B}(@*@$_xL8WvzIY>_V;QW>z@R75~w)%yu8IR}8-^|vm z5jID$W`S2*C~lbDZIyBGAB3#W5u61|@`%PMl+Zk!`&_cKYhY@w%lOdY?H__^UuP?s zy|z%KCfHklf@kz_zA>48TW;$<3kI}jqRo^%Z?y!dGjW<_#gRhXkhiD%cZ?lrcPHQ9 zf*>};+ZIr!egj7{Zv)y(mcF`rA4fs&0e#o9U^NP*=6n2HiO(=*znfhIVq=fmcG0Z( z6(G zM`O9zanSX`FB;)UgP~uvYgfI$w>O9caNOHNWZ*^`e|iHB=OHl|OcY#QS}Nc4q5iNF zvraM7?JNE(W-JXZpnuqy%oH_0HG-;x@MRM@64Xb8;r zZcZa6d}8N|sg-%D;r8FH5AxMy5^Z7uT+}dnQGG+>Lf-%u%5Fya)S7vvHRH#42cevs z76ztxpEbiPDIPsxf=ux^!{ZPY5*hz47s%8Q1MlnKzhs6tF>Kk1Lv>oEgj9R3g-p^>ThT)QsOr@ zY!T!Td@L)?GsV@Nk^5MAD`3R+R=@=cF z=z9@F{A-}OjRg(I;KjdCYH=z7_yf?{&t!)W=h7QCoaCK@Z=VOvJ-Kw_Cx+6?ec+#f z<|Gb(;9Pn~hx3`~n~$MDyBQ9!{?S6vsFJWLurlE91kG!Pj^$g{Z)RC=_ZTQS&GG-S z_a*RARrmfg%!mQ06BHHe!l0l~6$oo0f*D9)q6wfZ;u=B-5`_eliGo$OB*-`fu`ac? zwRY9EF4)DbE(xf?9k+`5o}yMI#H8~Sr#hPZ>ezzrSk+ptc)Vja>6XLrKk2_QNNTsNm+Cd6>z zTyES?6H1%$1TrfFT>($`0pojiae619F;ZDnsrlxMsIxT z4(W1WCAD;jW{Fn=aA$oJmZ`p)L4|nsq`PmqC6-WN<<9J4%-WCdS2(BcOms{ZFqWzO zIqZ@Y$%=jsNIh4O+=vkc^nE(E+y@tBMFa=35~n)(jV=$uk3kR#AAI`s?M`9+V@Gm7yQ)CPO{AZ%3rNp`ry8RLHbyssnvE+gd%CFYop|hy)46jmUdjjB=i%tv3 zV;+zOkZ!ikl79Rv$-+Wc`8stv@qd#q+L1Q=ex$#aFCGt?3nknaSmu7Qi0 zlCOFpP=>^$c=AY8L(qr9fR1o;W0bZ^tkpE3>6FLbG?auHw`VL~#`?*5Bio4diAAmYfc)M^f6>1+O z^&Fw5fzqN}4ysIe7lE29)KX9ys+E>Xf+`o==Rm3KPD^ogjcvDZ;22AtXerJIsSw-C zLCqJ6r;IVC;lKt^3xs+QRHaZafVx1agOFreMsHj3&|6lnu6<&O2?D|bFL=D169Q~7;DnA=5c7mC5o5O5q{-Qdw(P?QZvbmc zzrgiw+k>83)2jr~_(0oEY@60q*3i;q4RW&W-#s`yd)QQT<#@zN`kr& zS6G%%>r0Id;f2Cu!Y>l44~m4!vMHxHw)FG`76Vl!xS62TM@@2C#2$UEL?%kJ8Vv2d;;B_Y( zrr@1-5^6)dz3|RM+f+KCZE)F^v>e~|fk+KomazL7_Hr>on+}DQ>e4ZwR7XaDQe9%K zRF^IRrSY+S6ODuUTF%`xc;ckl@l?C}PQfYE-8UGsg*cCrtKjV>nq0BI!@RqRzFm>-71T)f*E3mW{<-_PTVb2Nx-iL_vIz0`pKdUqTwpEKV z{jIRul)25cI>gEED-)kqotj^`%r=Bg&Y4XXI!!b-A>0;OpQ6c=U>1b@uk6hc@cAlsC<Z>TjU5 zt*~#JH-XX)`ct6h3vN3o?ErUxS|Gd#(pp`HXR^!|KVks! z8S1;&WZ|Izm!3E~Stzgl*U^;i%FvHfa0O*XTSBN|xR(f(i@WmhVRL${bb8U`Kn?OY zR*?Abo}Ix{$7#?q3h1eVOs=`Vsmpa|XOvk?)cKNM?QqcQ@kkwe>fNi{*%|!qLgUWP zxK0_)?2Lo(M87_1erlIHJL88IWBfYGac5uHxFNjso!uX}vom;#I*mI!;|7Pr39P~-8yYl)bi!pxvj=BTW16L@>FNid=&iu5^U3o2^2f*zSFj5@zq3MY$Bxil{ zY0k~k*SgT*37HiQ&y7}WBhu}(dJ%OiaGagTfcnw zl+`ya#z>8KIE+y!_z>>Qx#qJ+l)5Xg3oOP+eaGSKFH&qUG7=M$zgpq0ydGvTMrx|V ziHOuZN2>Y7?4#UMR?YdXTzReV$DQVre(>MjmDj8`XnI?}T9o0eyuK1oOpRBbTk?>*^19Vxq5;i>Z#$d=@r#v)2n%!W z&(ptirMvPvYB45+%pICOxI#g#5-@jf=6C0~E3c_HG<|FcPf&)l@_GuM;9cOjlONpS zuDoVbp5`Dcb*B^4gTW02S^k)YH{SKbTilh`f3z4A!msEE%ptf!L8c!ef0#b;cz5MB zM?Yx@j9*BiVTXK917*fnw2@%32s{$yQw?Ok0f7@rh# zz+KgtIIPDJy7HP*W_7J#d{T$`q(*(`fUvH-7Ad}gU<4!7Po4BR98aO3=6oRV!q$Pm zBL_7|m$SOAaioY)vc!m54qs=+C}y`$3R6yG7K$IU%}IH36@F71XT6UDcR1t68kM@- zJ{x!bEsevW1Y=Zcjd{ecaz4->;mf(ATs&lrTC&k#jB>`LrG{CDPMl);q+!~OBNnsD z=R2+I(l}@Od}nH;pG(^>P3l;m6kVQ^hRI9A9FWGzr>JApfeX^ynUEG!HkFJ~__xxe z*r+l_Ek7}j_}#-yG|o`+pl*lHc19H%9`mX@FW|$RCO=DCC}!2)p5~=_`MRQrv)g2y zjjZ?b%t1?=o8}D=T0**(Pfsk8z$;;0bXE2 z(c~#JOR#v+sTBsej?&f~VQAzr`Hf_!GfFXIZSv_;XHF}{DUB61y0DL`RkuiKJELt6 zbLTq8QD*jaUgKvy5nJ)ems?C6v2sr&Wje@0HpI4WF;8c-^9DOj%1d7uXlLiK+L3vA zh>&~ULk+)0}7Hn99u(+psy1sa4`U!2bPM*B+W_o+!&cr}-E~e`yR*yM>;_5Q1Uk;CJ z%R2Myv#ez6GM58AhmIPd69%JdzG;Tx@VvayisTH#zEbX=#cP>e8XAe4l6$=WOJ*46 z3^$Dx@t5tL7d>?#nK~0}SQ_s2u5dYH*n_f$?rrZ1H+=LM3j)D5^G99ba{M#o=-yXd z;V|vfYv^8!G@7NM%rv`u*MOLthLx5XH#A1h2YQ1Zvi9Txey#TcoR9gYr*c>QvR zMG7s(Nbvv*8m2=i=#_GZMNY98BULFf+PU^ixx*r+E5!}zv?=_QBSl~QQtq(G^A=;I z7COG`u!uK=?yyLW#TY3wl%vBUtP}}pKC=CAcUYv+k=j3Cq|9<59TxFQxx*qO9VvHM zWSSG^Z2bD;Zu{t=kRriL(3UW3ZnzuVQ{#-9pp7DpY4Gxz~vg zD&Eemt6Z3V-W%AG zWF8Wr23whQ*(GqGH5KPq)+W#&!v;*UerjO_7X0{JV}GowY*8n!x2dm@HNN_#vBLy5 zl1Ou~Gf&cG-ctBeS?))B61Vj9=`p`0!{(&CSXR{3c-9j|qu@!ec?%C-% z{KT z560f8xM(1zxY4?InJ{r1jcYbA>pJ7|{42aZfde-Hv-UWZWVVREqp_X1$Gi!8{qdO9 z;0#Ce(I>yKbV70hPY^K_(u3w&Rhe#?*g;G@U3LOc$GhL3af!^UG|j!*xJAzuN^T@KEsOU|%dZ-;3eaDM`( z$dPu#H`3Q3ei^uPff-4KfU)5lG18aLOt#a3S>@n7{*Lgba}987f%(e8dHl`s;_dyy;8ozZ1G90QK1U2LZ@4!af&Spn#*~_+xM*y;5kJ$?PDPVr#w4<%RIiq|D69?|Ze2*YV)vHk>ya~8J_^a}9^BBbq&-F(5 zFxaop_kchuE@!k;WW@4aDCTd0ySh-Zy)AB(Z|U0s;E$c87;|^RH_RJhHU&$%!j1Ch z+dII`0j|&)pkg!JiH8r!a?@%Cu|U(T$R5@_bodx=Gy>a@QBMN*+akprfuDS=%p00B z%+W~Y&p}2#eM%s3LWw>PG&uijOZ4w2Qv!jhQx(UirMQ>t%?&W2n7?;0ie&hvH4n|n z$#tq6VN-v9e}+Nm?~3gFW^Z$oTz_Gmkdj>d$ z@7)Y=2LbnC7r3FhJ~fqu={_4^kCAj9oj1nAlJ|V~Grb(ce8Q=~9?y?MUtT(R70LOUTksU?%^BbrkGC?w z@r&*53~==KptErEn6C7I`7tyD9MffThPW9S;HZCP8Q@rNFU|l*Jzbdrj`6)Z102im zuQR~)0q&s;a17t`8Q@s2y_F$uM+P|N+gBOj=ccJb~E zaC~p=cMfhI(^b83DD02Q0CyO0V>7_9ex8*9j_;2PGr)BR?y?MUd~dDF0Cx;NGr%!?#TnrC z0q*n+aP;?#3~}dWfMdE;WPoEl7IlFenlmEDJD|7?ics4L$Noa+{uce6z6dvu=_-HO zuRXg9+|ZG}?m0e>V)Zyq|@*F6tpqhGtM z3tZ>;a$IIzwbuvsYw;aA*NhmcowWZt;p|Q_{pk?%9(sd^ZuZbyJoGjXy~9JZBW}W+?V+O{dYFgK z_t4Wk^c)Yp*h8=I(Ca<)%^rG#hi>-J2&Nl04;}T;!#s4pho0u4=XmJF9(sj`UhkoA z_Rt$VbhC%v;-R;B=p7z9;E7ANhmLyaVIDf)Lr?S2b3F87552-eulLY5d*}@wy4gc- z@zC2m^bQXlKv}c8;i01*nseg~Cf`FN87x2BLq|RIFb|#Yp{IH1IUahkhhE{K*Be^P zWRYor zTI2PbqD3n^cHvc!7!gZeHfC2*{Yhg2bvU{9E%0weRh?)y`^6+TVohD$U4kf1Zm)Zw z{ca~z$zhzkFDDuwK7Tzcj&8~BX3<+}Qg*!lv22LG>#S{cHw$JH=r@Q;SO#rZ;3+KI z+|~=lh%69_uX^R>Szf;765W3%ku8Eyaz4s5zBkr^0rvsOP2RJJj-6 zl__qZ^5$7yrR6QQJT5)bF!O*t^<$;wt+Bi&%e&U{eqebwTi!1%?>5W3%ksE4#BZVJ z;lNX%t`_PAP-`V_uY&r%@ZJPtIkTaOo@T4hhU4 zJZA}y{h6zTIuZAagqn=|or05K%{s&GArMdgIr;2=DRimsSmu0UV@F~@%X@v-_t@3d zYq+ib&`7@(2n5;$x-`0eSvF#SadzF`7`swuFGGzVn-~P^i&^706wewz#!BNC1Euks z0!rhz02HrqputiaXGB^19P#8cz6cNLB0CT^wkhx<9h9OZcRW)me7{Zf>vAt5Uz`RZ zN`2shM(Nw2R^STD*83Wzb@QzWMd@HhHu3wY2Mw(VZP3GCD_IO zp01^26O!$a33Mshz9QZXPf-(mj=6S?uO*thmf}uxAEgDu zO13AVaZ&DofE=O+nj388eGiwem){_Tx6;_=pfzQ9%r@Yw8~ z;^qj1m;kz^DhDVu{?t$nIrUP*!Ky?<&V2hF!WWix@5-BMCFWZRw|a5ZQ#%T7kZ}Nk z33W=8p=okZyZ>$oJs8=pBFgH4A=U5=vc3%gb)$reB}l1aYiq)?@&k6I;!U>=SOGh1 zyc%g73L!1c$-)g^ldMtSoEF>7afr)L9l+ zZE>urRf2s_Ee!0`sKhTosVjGb;&kG0pvCeY1Eq@jwB>CDrD6FiD0TS@Q0iU;F0gSO z4zQj~fFG8V8C2pF@KoY7P|BMP>N>%dg8CyacR54O<64kX`M1E#WDtN!vT4jwlm26NqQPVf_Y|HyNh-X<1 z?9E_rMMt1}ymd9brjhMvSFa(}d-VJgzSis9oJL{x>QeXE@`|*dO0p^xn~LQ`DHGz8An&2gRS3U%#xFDXjEbxV-)c&B<<)cBV%gkD(CW5*bS2%FC$e9Z6E-DSk`a*YC;k&Jw!p-P|UP7 z*c#L#{tzgZey6gK=D72|Y;D~JN1TX1)_%O~dg(?o-rDexiCAmHG84LZeQUSG#MXjk z5^h*Dzy})Q8EhJ`nG%e_P8AI%?u@6_ii6@~`^}!}g7p&L4SgZ1!M+ldH`umC?H+EI zn2s``wOv8eq>h6A1?$7S6%?00R?-yjDDJ;@3j_VxD?Qe(XTS;uZ)`dxyP#=8zsAQ4 zaHLqQe%p@NXIm#U_3BpNlAT<`5F;dPO&?$bqN;L6Y*x(fh^d3LHsUmfU0g-&7`SX37-wy|#Sn<}5 zLC-}VdOW#~mc`}Up&fUKn#9nwjbbUVUMp?zTE+(Ea>s^gycDQ6r7TL z;BSm-s&MgyWWybdEEMOCEc^x&--6=&joK>d4n>m(JX3WALs~2Gf@G8_;M=q7SlDXc zb0{dyo~J-*_PlRxoi-59$)%Sz_JD}BoF&qwV92|>UVV{ zPQ^)a&b!5=Ut{xqEP0W_&GGVAb~fDP#0Prxx{Xgf`G7pMsx|t~f%amFsm%tjGrM=H zQX^U5%vY{6rgz*RJV*7B4b+HSq{q3N*zRM4B^+QpG#zR{X*#U6y!$M#8PpB9oU*4c zTl2QYmW9b@oq%pqeQ^U?T>c?4@b_*8er!XEyq1Rv$v=oa%Z~FRI23+qxY!Bz7N0Yi zE2_8RWoivoENACfQToK(rqhB2O|k68=TR;;I_07u*wWDwFW;R?+*^>mm-yC#d!^9t zY`9lLb|BJl7enUm;l35sfUv+tH6TEeQa$OR1#aQG02ZEL`V$DIR}%?1&>jc|1bT38`y0Y{o-- zkDTXC>meCQ9*kVr;KY@9jjMeRqc91J5kz4UBx%{_(&P$zJDMw3f#P1K;lQ1syb)*p zGQ-=~E>3c9PV8%mQy?YBu(7O@3e97$VoeokcoB{?#ez+z;p;=BXp2-aP2t`h&Bf*0 z@T$25DR7IE0=GyCaKGYfThOc46gUPkde55zw{%K@qGTkNJUEW-Z+}81@<^;x;y6J8 zjgm7aq}JZT#7XYoeku}5=wPC^!J0!Fb|9HV7~y3y366C8K{lzy!R~sXfYIo4bZg83 zKx+E2ENS|^4ocIH4GewJOZ@{i*SDJ_T1wi$IggK(HgTeV(TWWwW4v#vO~Z*qSo3F{y>-ZU-PkkPczH%wf^;Nuh^5vrYP}H= zYR%ygq0+SXM!!#oyyD42XwyyO=~QM>$Z1qrwQ5w^nAu}yJ8c2m^9iSl*Z+qz)Hu?d zcQuPnV(dRP)5>g2GR(Bj!AUSU|0^l$EJvY*hA zynL54ScoleZD-CiFc{Y{n=U(6RIXE9agLS9P=Z$+8~EC@K$5NZb?*uTXTtH+B^ajI zVPEsCu63AdI4IS&B2e0gmquggVExqnzbqw=u<;sc<1iMK#-AynaXrW4YAtU$D2@O3EiWzp$!C(A2cjL@!PcNA z!GB5>ij44oK@lR2d^@jvm(A)V&S3aonIlmIQ8kUDg_`;&fzli~&GOE*xEjk_21;|} zddp)oMBRJL@;J7o?!9Gsf3rA#OjmzsYlp0X*dw>v8mE9T!_C!8fJqiPR<*EvyLv~8Amw7z?mrPMX(eFZ2lj?0?D~xj&((E* zY~K^Pp+4T($(By2jq#>azli5;jzz9-E@;>YY!KMZd&GX3A+`lmRlbVnZH2Q9Ep?&C zLMLK~=Vk;@dt&FsO3y`C^OaajTVK;GXsTE_~qLi zxNd=5()gE1^kCvI6@3#gw8?>WnxiDsF8^h5`95KdEp zZkP?S=dh!vF_C{1)+(o#0ZTd|T+_ z`<|1)ZpCFr4V@Pl-&KbhP)|5v2E9f1+Q*tEuxD?09wMP*m3x$+61 z`4x&+ox5?rdGLJn7>Gb>c|IPL)&;qsw5B-4+H$0wpRK}jWJHxvOd}lwtOTX9i$SUE zDp2b3I?MaH<=p{FNB*9)JgHHzl~1Zia&yb}zB!v)+Ip$B=Cs`VX3Qr)TDSUcUcva43ch8|z@VIW~$#fMu4xq2>=ts}pG;@}# zBgtoWu4Gd+7-{4b6bxAL1y6&KZi>L{T-{3%QAO~x0!^#%N$p&nt%&0l!CnkatMEzf zT-`?zoU8(0ZYC3^RrsWK%3wIc!Ko`i+)5@)tMEzfT+L4mKyV@p5F5yZX%#-HovWjY z;ItMXSUb|R3ZK-@)tvbRHx?+OnM{~g;gj0AdXOSG|A}4y1|JvK-3{x8&0qRn)+eTq-oN1rQttDkPMQ?$vL6fFQ*Tsf}qPN1t(|NMQ?+xL6fFQ*U^S^6iuW-%den2>ubX_ zMep#SNza%+YwNC9X~nFQe!MtVJU7MtT@gvQ|j-Q zIs&7u$~)CkOD)Co($w}PONGLQmt!ez+NZcCOZ~}G_5~1Z>XqLVUSle6z7lep$M(e8 z9;md<$e}g{zV5B;%r}vSW&=_w^N)aCbuQ5OGH+Q7H+R{|{Q8f8Xlu0Zxpkl?s5k>6 zY>en@l#LO6jSc~IGioM1|5ZP)6@aJIsa9eRD3z$Q)Cy4AfWN`=_|Z>4v~2{XzHyjQ zWkJw5wWB`Z4t?+$?R(N~z`U%e_W^YOPR~bmdOo_-^MFpzY;SqZQ11h1w!OWE+3z(ccppGhDZFNw z_W|_qPS3taCN?`udN#xcp$6gpd!cf1r;Y>zaoqW(BPi!-JRsBp+#eQd3GUROU|La1nfcjLZ8$i*YVBl6z{}Ae4P+tkP85GBwgL~B- z>ESj1RdxR+_3m68*zNQh4oP_p2SmJPoc96r_)gC!cY4n6^c?H-JfYL`#7@twf4!#A z`v7`Ur{~U(SzxfEtR;}sCiLu=o5L1hay8x#jkf--mWV4;?Pcc@TnKuO;~ zzD4#E-mTzq11K$l1BKcQ-XNj2f;vv9?VyGTwF^{^P+7Q3`#jJW)EMDW?nI$-aUUmC z9QS;oX5-Fj9S9%plZ0A=dy!CUa4#0>2Hd9#bt~@N_zdC0eWp;Gai>ecz*gMP7HT{0 z=Lxk7_cEdQC1##beL-<}0qF#&k==AIj3+OCdwG#5ape`0_5U8a><$}6Qs5q$QLd^!XN~i^(8iiT{ zifONPbV{fjz*{F2h`nZS3hYgRy(zFa1@@-E-W2%1ngW&cqT|Lzr_3xa4lKe>#?|G~ z`DK+0E9M1oLd&3m^9Bdz*Hx7ZQBzS?TU{k2HVdwibd5mOQUn^=FhLFaoN>#FQ_O_L@Vc2R3$3m zq{nJnVTp^w89wgAl2OC*qU9AelqkpU-mXnqZB-6DFRz}5U9nwud3DwN%Jb`L$`X~; zRnhs-8?W7>MPMQo%4?P`PE@-#h+O63L}hujysqYAkHqxp#V%+<(Nyz=hj>YBqH8sI>hu}zldA|gABYJPz^>f#TM(C@ z!dcVgcf!m`@;i0HDe}u4BOJ$d%CE$q44wicoQYGXsK~_A&zv@6s_+UY$`4bOSSBcc zH7!Ze8Kk0NA^}OB9-C4i1QUx4-S1pTNe1#}OqXZqZ=zyeRJDV3LSSy0^XMqxf{HSn zStV@jIIc*?svOl#pkm2l=qZ&7>Mri!u&p|1T17yf79uAS3!;lEYZsLz$`=Gc)CyV@ zvbr`fzYOKVTXogdR0QZW!xd%aCAzt^x-MF~pt^41yl7Q*A}W3_E~~8-R8`%=g;5;m zg{|7Lp?jdR3im3OHi=TYV~GW2iRdL|wb6N%wPka~CpcNXXfX=F2~;OIQJJVLTUdFi zQ!-GcGFhc6ms;aDF4UE*S3Y3+X zS1e8hC_1mQCV=hZ%jTt3I(r#=Q($ij>`j5aDX=#M_NKtz6xf>rdsAR<3hYgRy(zFa z1@@-E|9>gq3?c?5>R17X*J>)}*I~ROu;Tx}*z67Qe`5+vi3PGQth(ruOY4KHgUR69 z;8np}f>(!r9Qt|4dng~K0dzVgk{rwjnTHWIp#m~ZA*5^%2bj6FTni>9gu5R@j+&9q zJc}?MLqQ(J_X|)XPutMjJ<0Y&i-|hZB0hGcIgv0F z7^#1AINk9Z3f_o2ClY@4s{?-Mo@D!$#Tcop91eX51()K^*%yD@C$Pmm$@V&nF;bfx z4zZyiXR<^<9dq~E&)k!2AGa7I#ifEY3|A<40q&H4`s6|PxF^~E4jh^uHeO6S8cu@@ z1<%5r=`#C;r&qZr*_tVmJ+0LHP9|`&WGGmU5FQFD@TWfaxF^}}uox3U?p#RI3s)$Z zjXMMb7Nw()%jFEcSafj12L%~nr(YHZ; zI_U3F_axg#EhZ`l$zef?;||k16nqnRGR_apjk_n=USu)GuOy=Z!x)8vKgXSrgMYT~ zf$mARS6PgaI?GA=-Xg`BwS@dN^2wdz-s=VlhT) zJ~I{OKwP2VHr%PltIvAlhwe$X3oXV-l{lO}A~hd(#_PeBTfcBmvYl=*Myk&7{UDLL z#*w=6#-2s)Nw(j$7$bG86Vro5>NVbR{cZQCJKU3OPp}vxb*tk$S89cVoRdaK(Q59n)afL~gSk;->`r>2L3>u_gkTs-gJ?>*E? zO|lpx^_b&3wJ#Lpd{oA3+{d4P^ldBkl*Je+&QGH`3|A;P40kf_d8A*~VOEOs)o2b2 z7^y7B_rt*r1#56;26;CYH*>C)&xxbZSy+G4HV5Dwzd_M}@P>`~O z+~1?6;3%PLt8g}PRf2^fa1^8zKE{zc8r)ED6z&X8{ezRTj<$Y{vl!#ozD}42h}2fx z8N!nf%bqg8N^u`!ngQ0YlUQ_N2I2|@<3b~pgYNiZpp}|nF(!mk;DJ3xq*yD`?0R{> z-yUP7x;s+GSiizfzH`!eC`fIj`M0;LryXmhdRmO}YmK90gMbYMc?2WtxQnK2Ic$)X zT4ymvs=wp=V3A_|M$`MQDRTx}sbek1NWJ6u{vBXLLDp|HKbSJ{)$drTc8f7m-*!^< zIABA;cW~$1C2@DZ=HskX)MAX(pPeutFH+6}=s@6jEA^TeBX;{!fnYe%9(6CCSkjjM zBx0z>f|3bK6h-F-x_ zs|O6VQj@(Hp=UW9)-z~pu}C^*n3X!)a)1%~$4*Rh@DvJqgaSEM>Stbz@9gp6BIQI| z+#4=Z-m}LAp@(lvLDa;4}Aj9`3HY@dXJtP5%4@4xf$Xjh7!zzD`CH3r;J(8TM4->rIej4MS? zU_eFsBU1M{rQk%7^5*i1 zR_Y-y#uvh|BE{O8CV2RZYsR`EWQ1S@a7&9w}8s!T6*mij+x>f{yaYM30mzqF{Vd1wN@BJ98c`@JOj53dSc@C{iXhjywFg z9~OF~R5=9WlbR$_CN*xW`O*24JW{G0g7HbQ&I<+EE~2@wrsq+UJyNP1g7Hbkfei&s z2)EyR&G@)0<(%6t7@t&;NEzLDul2B%MII^D4Z--NP7x`S^0UI-)}P{$Qr!@YPwG^k z)OCH&TYaiWN_9gpJ}I_%-STx%>5)r|JyNP0g7Ha}h*WRfX}V{x^Qqx4r)Q7plSKL0$Bc-|_7@yQ> zBGm_Xng@P#=4GdOq*ONqzA?)qrMe*) zpVS#Xsm_DHF22*xLMrbz9JJI&IoPn>k7M@n@= zFg~fXfOX&Ii}D}Csk3|qvb{0HIg(p2J}I_(LP6u#d6R$t@!1|J)eXV;q|WjA_1Nm3 zP3O2$BULv9bQmPw*@kyQMlNu5__=NL3QmPw*@ky2Xq<%7F=(JLg zlyuh?%N>{&X!FZC z%S|vosdAsx+t*)sX}L#Abwe;dsd*x0^lhbbpY-(hd%c1zKdNc=e&5q_@piZ)@>gyJN|%? z7kQ*qHw5F8su8I}=@HC=Lyo_z#v`S=AsC-jEwFB@a_LQn_p9|tscs0yCzTMXgXj^= zrYj#Fknl*UZV1LFRR?S+*jr=*fiJe?G}U>eR5t|Ule$=>x;s)&2Re?t*dwL7AsC<3 zB_b7Zq-u}&(dbJ&QmPw*@kuQasbd_e2MShyw8SH&x*-^!)KZb^>qwn=)$VCaJyNP0 zg7HaRDpDqdl~>>T{Yzb`Fz^%B1`+-~QfVmwTjCHw5F8S|(DaEN}nloD-LMq%`D$@kuQgDbtSn z{hMEYvfLx3x*-^!)C!R@rSc~aZ#{5@M@n@=Fg~f3B4y(BNVog1Sm}{c-4KjVYL!Us zgFDR$FNWV;<&jd|5R6Z%9$2@%G3v&f*VcQaR5t|UlWOou{q`@FRSm9GuIh$hd{T`f zWm5j)hhC^_^hl|02*xM1TBJ;BEIMP;p{qSosvCj<4&$m$0$d?d+l>0+=?ak|<`^%= z=hqsMG9jE6Yx><9k6)@$g7HZuMe0C04fE{dPkx^CNU25%M(nv?3C)$bLcy@m7?ZgB z%)ee~LnwQ$8H^x~b)-^0DO#nh6nC;x4qO(BXR6Vx#pSj|mE(W|&wDYn3h-n%nkHQ6 zaX3%PF;YMCVtlEwPNdX-tj>OY{x$17si7rBFmy05#Q|O=Ql^e-x@o{^f$)en|K;^{Q02hv>T*>}b$`9~8uu)75o zE-1wkh6)35!n4Xgn-H!{bLVoOU%Fb&6%&`MD)ll^dS#rj73k>1%C+G1ir2P3oB;b&81CZZyQ7q*f{D8vKPcOy#kJ74& zC5ci==~Aq#k@aHyt*EVCSPEYkmM>n)6sxSlN|A)4HzEwnQd!+nD_`RWOh0ov1xj_5 z9+)-!j&Grc4Y#l=spC z68<1+{422}j?)VUAW=#a3%J;&bU|6|0z?c8+_*5v8??oBPU?B$vbdt+!qSChh>B{k z8%rj5XI}Zjin5wCuDIbqB^?a^hWD`HoOgBkaPXfYcU8v;oi4HC*tGUp_T3o%jG*PWw zT^?3iHg6tWE59({JPR$UZuAoC;Sv=?=3^bz+%n*7j%ZAnAui98OCE1k<1}TRsC#Uw zx_h!iI`7HKn~;Ga3m0Czh;gZ@tvp|Y!{B={L$EFqnX(8PeM#xXWwp+yLCdip3sp(% zBZ^5)1qwpN#T6`m^C}i%Wtb=U%pFN053dF*F)wC8LCU4GokZ$v+eulWV^v;ZtFfIe zTm|*oP^DC%MgOHhmsKT7Wlh>tEFgov7F2pYm_8#mqfjekoBy5lY)CbiMwo@*6t(g^)*`>wt z*z|bm#Hl6IoFJj{N{UJ-DHbbaajnM@V@mTp%kupj#W79gP1Y=d-d)&A~35D~CIu!hxf4XLm|> zXg)|NNbJ8MY#ZxDCq= z&&LQg5BFn*s>Ge4&|R(v3q>{kj!;W*KTarijE@&;749bp#csk7q5L`F+i@87V)om= zw^U5dBNP>#1?NG2^ub%2sK|bds1L@XpK?MQRWf9%IT3N^`kTnw+b^xrAo~sew7nX!)!~# zB+@ufrg3(rxzn1)IX8`SMHaB|PJ_4h@-p{;D4^6TOd>L(U>Xn^+6LS`#(aZOd` zt-R4Ahif~Kt-M}RGG?HX=39-%`%Y3$`u$(h%FD^~wch>?Z#miXZLP3m%D=SAa{R3= zzIg|u%Ae&_`-BV5`D|-K&-&y7V7UD>4c`oklSg~|3e=sz+|Jh>jK$@Q%u|lu`R@M` zn8AF(!5DvaoJD!Ov$ZzP!5D6Sc6NSe9ILV^8Q>VKsa@cP=8iJX@A=oXLSya$m-o&_ z2)9!tKKK!Hc8i{R<{b2kBb;x4F*|^xMgG`~7F}`EK%$GAE^lrxn7=-rYHEgM>bfns z$CCvEa+5O#42vg=&A~0n-R8KK;-sEMf?u2jiKDnXUT$n&hSPk+g?N)VQQXwH87`G1 z+ayppNoB*oYrwaCpT*f${{3d9cf#a4jv;8 zNPF;`Q~eny$yMm^xy}AGD@pDuN$Tk>NUwyOUhhk=Yvq(*KWl6d(g2jf75ShBgu;o>ZvtE#^-?b&$Nw2y<*w66fA z>AVz_rZbyTnjcJi&5xHrvHM_7)%-@)%{UR;r^^wz_L$%QOrmf@_*ao0l0?wv!mrC2 zk0z((%qpYF7yqYHlizDJl+J+z0MM{b^Y=x_!8=9 zh8#7IIlp22hJt)+uwU@hvR9_LeVV5%ChD|*>m1HL_zea54xz6{w7q_p_G#?EAGlmn zrv5SFG^~C@!B26|!nM2C>^t2)4f}sI-65qhVaRBtzY^s8g;EWN)IQ|)X^?ti_O(*i zIUHg`LB4J1+K1cn>$4bTT@R7+PSzHTPl}-k1%o1^ zx1LtYOx6~RPl{?63Nj^WF1l(gczW7c7|8!t(?u^SB z;go2VXSw_hFpqY|jTkjT5qh77pJ##T$2U0)Yqk9B{Ipguqgm}>h@;t4Yk7GFIKJvu zWPoEU?Uxzg_!4|F101t|dj>fA`}YiR%+`abBp%aMx^TSm*e-BGhx_%9=|8O#j$_o` zcL=>2iEB1+YaQ&j@SLALEMLbrlkYgA*ynEIOW-J6>8&(0o#XMQg#+>nlaCc8Uy3K6 zjHfQjy`PG|9ao@!S#~gSWa}iJZGdyR_-+lfPGSIYSkIKh1(TW-9``!lFp;JYPy$lp zS9ZK1PmkkiaBF1kD*P@hDQ=p789OAW=Hv9`;^14cpskp#s} zRhPw^9y$vljyFv@Jf1Av0oyoEx{a;;3JDR2J-~ZmWWu{>L*I{PU55nc*8vFE#S3u2 zWi*~D*-@N)AAOIMVbo(xmNrJfYp{wpz=lWZ_KnWf#@& z4oB+Wgl+5r)>5&-PZj2Uaxb0(1(C_y;=$eV)J*iNwn-ogQj@X@gWC#{{CO`{zbh13 z%O+NFvMrwcTp-ErPTG`%pKKjFDI8hLBPN{8X`dRa|EgPL_21}M%TBU+`o76iG_@xo=U4q0xX`4qn~^^SBd`1AkGEeG>9+#3Q7L3!Jazf5$W^5{ z-m?8L)2nIk4azyWys)vOAX4yE0S*JLe?QbA1IBJ-&(xgnz zXBxJ*I!8M?-NKyb#rD6A$tGe9S2)1Rc7jmraGxj?holRH;(2(5Lj4TXB%vM!HCZUG zvs7v>D3$#UsJPhPZK=P4QrRy-4HDZh)GkM;{Xi87bpR-}JroqH6MR^(w#QoAA)v;H z?I>$|lC_-(YKYjLVr@^ewzEMUC$^>5mLD$F-$kJGQ%AzucJ7X&j#|PxYB5gWYJ48& zR-;T8C7&%w7KV#aS;^^P%gL)>o*#%bBtXWKGq+(N!>z|+sK~k{qA}EDNRdF1)?|3h z!c(BgRAsT$k@42T?c_DSwydnEd{Q`XQ)KN#I5~JzsxF-Oairw+re2|yyS2hQncg<_ z=^n4&cv-ysAH}H(c>89NQ?(TZzbH;tY#aPlvMwA8Eepqzxbnu=?dN#k-Yw^~dd!oG zth*BxW>M4KtgVW)w%UT<%TQ}=EoxeQw#2Bg*#xaPdHLoz&P8sI1pg5aUcPPc<>AOW z?l*u~_JwO@Amhn%ceD>k6$X0jil^#!MH(lf)XtCegPIAdICc5v$hr~qH#IfCsC-ry z1||TB4c-zD>PQYsai3V~;;iJR_VM024Q~pF+|QKLlxmJNz6H_bj#%>IzLdy$E!h%J zmTcz%!cW1b>7*kO_bhna2N}c;A2Y{a=SCWT3=MD~zXqhW5I5vQM`Yb7K%2rNIyNKJ z&BZ~SC0=-MVa{Lw#PoWIse^>y)jq(fQ;@6DTZtz>j&(d*(lp@6qK?*h$72O~e^1oL zRxI!6S%*4xS+79dOUWIBw_;R`HT@P;8C#2z+ugC6<)!tP<6Us3geh@4F%sYQU-?HS zR(5nC6FN{b?ojXchz@f)qERA+Z7Lf>pmt)y#DiOO;vqIv^Fc}@%9P0%91TB z-`s`~pq%IDua8Bt!+mfo?vovh^lmtq4uV*F@C6{CsnK}eb9JxgwL}_z2FGsgn>ae2 ze1Z<_f&-C$fs$0XPjNDQFrZn4{yncH@!g_iGf+kK+d_#b2(LaAM(*y_r(jL5gX0|= zi#j&f{XISyM=0<9;*v>@zR^CmW~~#DyNmk-`NVvSMex*(Pv@AY5T7{p4&I03d0Xn5 zZNejCr8UM>Y~+VD=1-)t5|l~GBVsGRq#8#W55~!g)C5=t@aAtD4WcCPi%7$lUvzYo z41N#qlgPUMVB(E35c;(|UcW1==EzRT99h)>`TAX&)I~_@OA3;o*T2;d$5F=zKUbL3 zJb(Q}q<0v%;&Apvq<43wH;A>}nchY9&C%k#mbzD^>bi@LeV$b_97$N1+!d?ewl5qi z9^B$h&yrLxq(73=q<;y<4KF2pFpB*X5DF#Gpm`$Fk6~jQ=3krsg($jht^eSOsnB4j z%4GeKUWn@k;!JQ`no5#8ijp5nnK5GV6so1VSn`Wl{a?O7#%@J=o7P9H{)^CMN5`6q z2Xw4BY5#GA*7fD%S2@p<5xI8bXU_+>w1;UE%lje`Eh>Kzl~w(FAq;z>(sf!2$sH0< zgu1a=%1dPG=2&un1ObYHvemq#B9`i&DhcOpj+C^-%TYm=Y}3+jnxv?w$Bsvh^m#{z zQ&+cL4I1Y|qGB!F&Hy0tTKl~gPZe&D6mCMZWQng?64RHAskPgm&b+n3MnVi%IB*H> zrwH{Z?vsRSfYzQW)NRyXq5f(qHn)p~_ajg$dk|u-6n15DB({K3+$W$)M1q@Puy+{_ zTn8Rh`>k=r=vRr9d7wb@I zQF*T`i-XUN?|8Fya$h7dK>30)qh@5H;O0HvkO$rR>md` zAyF0J#gceSXx8&&a8>W*uJ%*tPFrs}vAl0!*;sKF84zgu61P<3xT$DN?+fcl!)7p& zn;RcresJ5ZW=7@ zEd{B`S%s)>4uN_XC*Klhll#UUbo);wR?Lb*mhD&C)zO~y%MVADTL2#gz>a7;-fBp) zo?XO8a<|LEFbrsRX2XFx++#u|ac6l52d=?AE);t@st`G#v;>?5>NK(CL2}wmehie# zax(lNv3(Jg>h5cxRCiT7p`2Ek?mGt|m*~fl9Qlzmnj^gft@)}yQma51$sf;dofK7a zQf})cdVwAi;~}TzNnYacdO19nr`Y#}#p$>lRrVZk-uQSTC!UJsLX+`MP_J7j$%qrY zfC$_b=S8=vBVKp=!G1a}$6cJ#9#0kJqwAUIuB9mlNAqHgCon@m`%yFhi6#qf4a60c zy@Z%GdSc@KLPc@!Eff=m@9?1Pq;aTF`M7g3nVw_Hhy-y2MQz3Ck@gT1%-KsUIbl5J z2bWgQpC3IbIta6=2iI0!T2VcJkg*!ru3fJ}!2uv{RbLipyj+%hz-iGTIT))M2C$8V)x(C;vaPd>y7r2gsjo(?5kl&HuEDY-)8o(hn0(X|M+dtgzGyRT4DXf2} z1rrz}^&>vQF!w@1juSKYo__k8EA=}PrOL6eL@|`|jsYGbQX_F^g?q@P%g)J?xDw5L zrs;u8w=ZP08h&@#Ir^=ME}Qi?+`dp_F^nJ>*4m*UTLNU9T~sk#zco?HEXv{bg(}qm z3=NCD&L*VPhPvB|^jj0{uH+47KPy#65Da4+3QohFsW58wuTJkJzT!cSDCMtUd~s)t z-3=p3*7X{%+ZTGjp$Wz(#p=la4Q+q%i&EwrnqYiVYzl;etlnrwp8v!3x_zNY4OgyU zd{QiZq2MuU9cX##?dNs-LXo0^zzD`C#cDDXJVI>IR;^m_Tiw1;q?pw(g7HbQRJsct zhcE5_fNozXQlmsjO0Hjj4iqU9!obD%+@sqUij?yOLohzSSeJx?^pWP`mi)DS+%)7U z5sYAbQY=HE;9#-EqUAsTe7@$TN-A18pm6kbqnCkF0SjcM%`iEY>aZk<`KWj8R%#@EtKPAg&?~H_>s@l zBrc{;n$(km*PDcgOIIwftM99H+0+}Z%Y45W19!0ept{^VGlZsO8=i)_#ysM;tA%s+ ztD?mv5CaK8_2Q+vW{%5qmO9^DP0hnun1wu~tb)r_0(>l}u#fsVlvt@X>0AQmSC!6R zScc_p;<~H_^E^AtpETmGeEFXEtXJJYOsd2oQl94tvdqd2l|K8w@-i6umDcr6pIvun zF2;MX!V^7*k+#6c)~&8vq8$22ujZF(v&bn}18@M=g6es-{HBXDsH#h`-Y(;ByCZXl zkB*ArOheXQXoH}dJ=w`c@ztUC^z*NoX*ed&>mTd7g;2!HRT-tGalWxSwT7ZU#LpGL z@GVcn(x~4~hx>4|pqn=Xv(qWAd|wN0ttNS?BE#R{4T!jlK-}Y0V#&xFo%xFao#%0Bkui9xIKNF{1CW- ze09U{UHl*aHkr%5{V;yGYkWM?a4p;@Nj_DQd`w3Vw$ovD&z2P>AH@)YJ|{Pkbxf*o zF-LY=3kD1l7zUh~mH3z!yN`+A@q$bUYkVzoZ6OBXcFPcexKNZT>8sL%isdsPhNyCy zOPsDg0)vl$*EL73ZRuIEZ{m>HnpXWLmFw%Wd%S1X(1T9iw?9cm;u|q6AB4UmR0HnE z3H3AFj~A+o4P9rat@1V14=P7>g-NZdKh3 zz7ZSzdZ;vMe{5nW?_5ld}-w00UZgGTmx_SUx7n zAWs%-#0BV8VS2k9DBQ#4lJEPF@l&Vl44R7@t6{ zIu(OT9P+KhS05df6Zg!>8?v&oxh{lZtF+t}t4P5nd?#$*bRj~;iZLA6j5|wSIPe$T zHMe^rZfuf=0|P*@!V3pZ1*H;f�zc21+$xkNIBA;hQH}AnQM$w|q|1gpT@My&_ix z@t$yoyyE5ImGR)_@g3XTfykodq+To|saO_jtwC{ATTz4}kn?;&vK6&YVb0?kZOosL znhKxV+g?CuFkTsHSSZ9rk%sF)to(c>1S5^yBE2Xzsc$^ly>(&~4}rG9xW`kIa^tCZ z-=fs4zTzaOH1HFOGmh0(3L4|%vEwkM;41Ex&+q#(j@LF9PX$O$)&%W`@GF>|=#bM4 zch(&3$YMG|-8lKi7HOo{DCP1Y#*}tORjUFCLM%BcyRmusqit^^l={)AICUXL!d~%K zY8439OjJ}aF8f|l)8$cm@A|Kk5KzZ?>kNFpoGJAi#ZYIo&Eg0prWCY_x5-@ybF!EU zwg`dE3M|`C;)<*av@exmw)PoLQY=4JtoRyhKhFdVdE@2^Tja{Kx^iTPG7fYQQ+&blnU7WS>!jS2^9ao1M^OE^0f;Xo0RSrvB? zC{@>+Kxrk`3`!N36K&M?2vBVEgagNdQrl|F(;-psfc>-g!I8lI3ruyv*X(!VP8A$a zLes!F0^f%SGgF3=m*hUo=k{;sbhICw)8Xi`xMIq%OzGgT|0a&lFq&a`2eRQ74xEKM zn}p%O`MB$3fwaJ3oHLIzm*R~(6aAp#(E4Z1D5}pdzK9pV9mzM%;%<^5;y>TU>K7A6 z{hA1BEUs@HSv^TWJ&}U{Op^u22I30JU;zgwbY!)+P|USHLNT!p6)GQh4(@r!Q_CwC zFTgGs&Y)uvY_}p;VhC#?t|D9|xK6`06W5uzy2G9wSgIa1h2{WU|91u*e=l)nj5!FQ z>D_tIk?kWIchK=BWjKS5ABtTdaNXIb_Hzdve_=6Ebg60LEF&;%BZh+Pr0~6d#kT8j zb0@ExK~Q(lk+aQchz$kVWudlY=k+&v9qLC-upKs^e7B$S;7 zu{g3bv1nSn@buD&GiGBOCX5XVPij~WWtCPe@o;2Zi7Xw*F-4%0Gb|PKO|}@~a2OxH zX28oG6rzMvySvQ!hGn;>Vgb6eqNW<>lsg+%;V}1wmE{QTT;aRH^ADIw8gwy)#)wEQ zK>$}97_m+(AzXKLWQ=fkjBKK$nlmKkLZ!HON+RL85FH!SO{vU47{Vk8$Kc4aqPnMwj(aJsceBgNh}=8};*N@CpUr=DP0R9vnveC#P# z0P}r%2*X#6;PTkIa?M1L?*a22zV~3Pd&B*sVpCu@5|~w;aXBM>;p3>-T3~MJj2rG> zfIAJiyMQr!Q8Rp9jf(MQcN*Ui9wVb-IeA7U#D?;7I^nt+6>A1=0dRvT0K?{6CZl4r z&Y12_PH22SCZjaXF&U;QWP4 zT(_|il0RvVMYqIO>FQ_$27rLWb`6&DCQ`L zmFfT3X)v6YfN`*MH^t%IU|hOWi;iv85Q49KUKiL?4V#Vh{%ot;IFrDaC)5~i?KkxBnN15S+J%{;T^aMNF zcd!I$4`~J{4f=&Pz;5450*q`KCWDliZjoD@>Vd9$UMy?*A;nFFUq}d(E#fRf5K0w( zf%F-6?xv&Q+7Mi35{NfGU7Q>OUWP$tlH6@+EL;d7o=ag0GH`b-ZO#{y#7^ zsjV4a)qmbg2T<#gMkm%UMY1*g3Vd{7b;Kf`%0`FDok|p0$4Wsuy)2d5v*kbxW|cUZ z+y*{IHaT6T81otJETmEN|8f+hqTWc&z=h}}En`4WUMY-*m+xkoq zk`L?7CCSi@+~0A*+e1^uV%ljhI3JX%6Z1(2a?S&#>U1qA7OyY{A&u>`me(7BU_P51 za7$P683_aXvRL;L1qM;HQ+p&ljK6p8&4IwM8cKHzs`_7?)5B`@8+)E?jfVqSsObNh zCJT-Y#1)jDC)?THIX#2$%-2v*Qn`;%e5dTW54s5ZWR{&@5uI0gKEC7y%nTR~U$7hX zAg&f%kK%e9*VDM3!}SubS8)9e7ndQugI{XiUvYhi>r-62aeawvJnZ+u)dSbJa50-X zYlid1IF8#N7dy3VQlEe;2iGWEdAP>mis356#laMg@t%fjCN2)#o{OstR|T$0TpVVR zp*Z+^0IvVJjxn=eL%Qm6&0v*_JxTQgbXd&r%C4wa`+F zEtRm;5=&iXsTG#uOH4zs#!_o7wcb+KTIvQ%{m4=`Tk02wXJG|y>ui%nFz*jiq|aE2XN;nUZ{8ejgl4m&`~_V(Oi2j(md8$7yG8H0TPwgnIC zumhyf0_Tg;JJ*R}qRGM)3bKVr>e>Szxm|}HAZ11!V8alm4?8qNVi>O6PuF7o31di8 zu0PJO1KX4g&(n8&f0Pb8z-2S)0E~%ygdi9lc3=yW40o;*q|B%TFh*(}MPOJR?rGS8 z`bp!?bz#zgcqBLh+cj}{GH|+4J!eswJ|J<4V z#ir|FhqoLl{^)z;t2EBCG!C`Jm_5yBnPvd^RgBGM;m~?KZ;nyl`C>OlIUkru{3@q! z8t0cjPWoN|ra$PyijnHl#qFY-Us51l{CRj=)l_RQ-(j)WZ@T#f@;dW&{FT$GTG`|i5eB1ps2WyiU=-{$sX545}4>j zQ4x1pLJ$-YAyKq0!4PCRMsY!{t$SOoyR8f27Q}+PsQp}OTbJ4vjIF3Gf>rrF&wG}8 z&%HAND*3+OA3bny-g(dSzGuDXp8KBdvLLRc%Go}PxZ8kP7Q~g7JD;h<{R5cYwg&;{ zg!x*@Iwn4gDm#U;Ufeh!!~L%534@<6ync=&5{17PDw#Gk#FbR*<7t#q z>iYzkemkk(Hr&#RP`Q-=Gd_f?stShN2FybtTv>TApI-y!`yeh+QW-3_U0`}i(fk5u z<5yA~dXCNn=B5xXQB|o#<<9gj0A_g@R}zfhrn_Je6BnHgx4N=QanzmqMgcQBh)WbZ zld6cj1DH31xRMfQdpY7(0u$HMbZxjLrIq|%Gmf}Jfteb{Ic7TIt^nq#ATCi|;jho^ z3;rIMZjECzDeX{6u~Ywu`xh{q?gj$R;u4ik{Ufdjm_0(cs&aq%61N{P2ZwRR)eJy8 z;)VlrLJ$|&UuAPdXdEzS?ydyc4^&pf@=||2I0XEKz zw*j8t05@!aLV5biomqmT;N1w!?IB!+v-8Y0P;f6WPw%bt`O=|}a#MWjdjpug2ddv* zxMigY#ghAVxDN$pvBp__C5}275`G7mKklQ1+5cDhht0_qOYYn*V6Q>=de)t|B8#hZ zwuh_({|jKs_gBKca25B$xB%=>u; zm^*Z#d-bo(X;1Hk{FlJotP^MR5Bm!F6VsvYV7 zf&7tp5aPNO+tlhStM-RG6&ZFaFfSbl035$$RKAoso2ZXKxI+%YLi2+K=CzXnEBl|} zeJwEO@xg<$_<4#tH_9>Z9XV=Co@sfqyqJ)9Z;+Ullt4 z%KZg$1pMY`i~w;{xJqXurIFw-11>&Xp;(`5FxPfyNu{%46>(+2%nss8OUnG^OWcjX zEDz&K{OuZX-vW~w0Rqkox4P8dJ`*<3_cwmjvdogIoekpXeJXDE1#u-+iJ-nNV2X|rb)LSG%IaWy zFaVgAAg;8uI9UJY0`qPNS5g(Mf1d$!@Uek#ON)yWiY0eOeYrgcRX=- z1G74eb3QvKHH7#E#QZ=y8R4ow55D}-}92-NpGULm z9~Fn*M-LHmg3{;VN}TU_hC2wDnPFTg|84_jWeAsWzCWn1|A{DHTy$QziLy$?k~?wp zfcY?pOB6dB=Mh(U686NyMTc&vN^hcAov|lewIjfJz$^*loc=iVeF99`$x6_tucAcj z;veFU1?G+*uB6224-wY|OwlQn^2M*j?T8UK1ei-gxH4xk4skyN=CcqEh7bmz9dTQn z3d=DrI-8D?Ql~#e+)Q9z2;)NU)xQE$ahj;}^kJ9yD#eofAlyd*bCJgR%GYT(i2FG( zuLN<4%BpIgKF05#z|@_tm^K|S9|Y4o9++Q;aiRD0GGO9k0{Tka@4Vl``%sNhNZhmR z$9N;y{l}tzg^O+=F3#@ok7JNe-2UV7{>4RSaArb*+972*y^^toA6A=n1D%^F)-Y_Z z^nCoZ#WDQsM4z}oPUU$MzY1iV$Jd4WVcOoc+Wu!FX#11Z_WnlD_KDT@(MHhrsnzzk zji7C%)%N#|ply}a_SHtv_N~>nW+Q0JlbW|DG_BnT+BiW|)n1O@n;8#gx1bGu7Px<< z(zfMB(8d+nN?YHJppDb7m9`x=g0{HT#xcepnr{QGHm>CPq1yJh+6Hd~Z5%OH`Nk3Q z9~!qRtBvzNeyBFiJ5g~vXd`H=v)VWx<%h=Y2&;{DpdYGjq}9gxF+Wrr7dohXJ8mOr zJJo9Ae4QT}H%^XMapQ`(AF6GV)yDZlKUCXPtL?0fppEMrRZ7p@2-+^R+RpcB3+zUH zac-}+++OXuz2@ZhN_$?i0iB+&nZ}NveKBJt7TN1UYyx-gq|7m67k!*x-|=GWh|Z(G zYhUyI^usW-5evrU?UQ)1eQlmTd?T5@el^~C=2xulrDR&p0jGr$8w|$Mo%q{5*(YxL zaOo>43018-daMYFZj#Hls=Hru=^WzejLe>Px#+4VHU)p-T67I-7hDC> zEF6{9(8ZjYdoZ|HN|q!+T_qGh{^kkwBT!chbs4B@gqm-Ce*@}T;r$!bbwZhbrpne- z8k@8>OsdNqg9W*Z;&nK0Xb{gE!g69{WtU{7nM8@1utThBQ6q=&j8e0mmA-mTFU1<^ zmm8h}RKA^)nJ9~^R?4n!ubD-n6ziW`Ppj1hH!9WfA$A4Fw$OQ)9n3w!pMY%UI2JG_ z2b(hWNFw(7;-DP1!_cmdkE0qk@<_p%ldZ`@{POlxKYMJ^rnTDj!mzr`uC@xtmh;)Fu zL8vZJHwv{B)K7%s7spLPvDd4#aLiEQwg;tf?C~hyQcx<48c-?>E|>c$E*ubrJ5ORP zh_Fq+S*Xdl-y+m`xZf(&Y}{`XY9a1D)b7U2)qDgSJKk&=SeH3T*Ys1JnqIs1Obe~k8_{3R@ zeMD!UeU9ktw-)>tb_Jnc-no( zh55pHP4*^v3%iqJ$-<;nwaxKZ$2Aa4qWN94{NUK^i}0hNa|DXNKGN8E#>j@J!JsSh zEoEPzSQrb5E~(|t2AQi=WK%f5t!_XucO@BwU1y;d+XSTKl&c0K)Mj=kZH)dS741&S z>I1B6h$X9+od0vK4ml{f=&$*VL~Z8i!iM&xBa@jMl>SlBpQ8SYSd~59-0M^AoM8&k z-GKj2MEIAIH`JpjDb`*ngS)&kaI|9$L8f73x)FQAA2kWph7V}6^C;|nF}k?1|P?zIgiAccho4Hph+& zw1e<1hHar+&dk(~UGyPdOmC#0OQjckZ>MLN2z_FKtZ7jjvtwMkfu}S1qSkCwfulMV7^T#m3XVD4BYAWRDAlPr57fQFd%#j3 zg5ru?-DP&4JH1^i@=>a}PF-yFHIfnUv_HcwkR!3V8QfFVOR@H;p?yvN+SoPE)fT=P z>o^O(cw(`qP@;>iGrA0&{o2}}+qNP7YVCqT2$_2Ct>W1?*?EgJ{+$;WBg+{8)GA~$Vqfm#^4u7H(|z z@5tu{NPLk=XG&JwpvYFEO_p$1@a-o_nEjHc1ubZC?SdjQ(&(b9O=XwPxei*%^x~K3 zl5Ib5hNEmc-oCW3v9o2sa_kk%XhVmM8U;Dsz^bdgE1x$FVz{9(#`Y4T~m0iYFo zBB!x}CpP;g(QcypJ6~+!+cBD3^v@FrRxtVVvpeagt)ojyG}bW)BB|)tCRg7x=ds{$ zlofs87fOYeY|WD%IG+b^UuOv;7^y|vxLy~Utyf>w#?IO7t6{No`jkzKwY)Gf_Rb=l z_=txTi?*;)vuYPs%z=-HD6QC6C zGf)qU?+(cOUkh~vD8-uu>NmohX{n!pQu=-k>Jjn%z*4KN@2;@fKPtZV{b06SenFZ; z-N>|e;go_!Et^Q?UU)a;&1NCCWkHL(4^sA+Xe$Hd(_1^*{|)gBAH4Q&_KsctI|Ppv zZ^_I_lkoYcwg<;{JeMV-%eWoS(spSbp$i?IOidrwAf8Z?ZkLu7-!sW{hK-<9hGe>( zRdZ>(eYUxTHnEBa3!DY2eQn?AmDNvD^x~n(OuMw6)KUFHOQCrh?XG3Yn;{Nmh$6OP zcTt0#qkan|iB;`uu}^prco~V%;MF*?Aa=!C_-Xa&?;Ff=Jo6TjjcssVK>lwe{HALq zDNRe0gP${5y0o3mHu5pD;sFp1=(<2(8`Yw1DoR$r8|$dyuk^FRlr%^_#AZ(?zv(wr z%K8J0c}HC?;W0r4#AL3O-||7dq6SbT=Sg{8#AY7?K>L%D_p#Zz=rO*SZVt-?na# z`@dU@aQ~)t3*6VV7T~^mX}fuQuHZKWvwo{s2OHUjOtc|$%qGe7G1w-)wpf)uKOAF^ z*B&%+QCHza7RqI30vdaKS?A%a*($eg-M+dgcG>Y@wm-K#y-aZF+Jl~9GrZzZuscV5 zjzCtgj9pet5MM^KX^m}vl64HPupRM3+H>rdlYR+{dR4ps9Xvf*W}(P-a8yIXu{Kk% zX;HO;4X&y`wdv>z_CI|k!4G^}62IgR#-!tCppq&dllfBesivhkw!)~+T3!;UmyzAa zCsuWjPG+>YE>aaWuLgDx&2Gzh4lyvcjP9ZaRKZmGD%L2mfhg+++g7v+2LSpLTm`bB zwrU@Kjo*(W2MZ#7a98~anvvO>6hvrOV(l%6{0Vo}1KAY174B0@ZI4G!@y@kW29%O` z*z!IA<@R5QjjFBviWBcUeb8IjIpHQ=9c$6K zUXRXao#|M1`#P3Oy8rkebu9f~kcS{4$_{Xxr6z&8QHt~&P(KlhT?18A_gP<7cx7u? zXmN``DSN>Spp?CUHVM^TrAqox?cE^_ObQx>{3<^%nQQg~SVJ6d8tw!L<^yP&pgv{u%>1B(S?;c(D z#_Hsa{2q)hTJ&*Vs`GNT2ab69@(2XbkS~WgHr-?AbNi$MLfcAkadJ>3)^~W^yl5q- z@mO)Po$ADo1Vsx;flL@tHbM@yUn#t1P)`aq1(dQcvZ^WBpMz2osskXOMrt?91|B}x zFe#O}nvuhfoA@-kD4BVfk>YpjH0IxRixK6T*mX;53O_(!z9@Fh;um^L(5-e#6R^lZ(&~ZA`zh_8m!5_n_pgMGT=nb6la=CsVYGG^F1!>(A4Ru$$eB zEpK3yo!hjXw)lEP`YB10L|PrLFbN0wwCp530c@2pR!)eRMZFRV@+)%;UZcX%uhAD; z3U~@bGJOqUsmv^U*MfqOie*pF&7LVafXsH zq3XU=tPZ(&gRYc59WAOQ(Vwl|eFBwoH6rTP;$(EOSA`K1zd-jP{$HrJ8zv3`-$MW+ z)%rdJr>axylSsU3ZdmCRbtx#-WXu7jnv5GkJ&lAFL~aGe_f&x#=WwG?OTbgj(yO4@ zvnYuC4wN!peh*6FI2^8UeL&qJxNUJ)Cd)%Wsc<=HsKRv`BRkk3RtLV(&HHAWu{vO* zJZpG>xn1Y&l|@ikmzh(5Kbh+bakn-Hd`_8N4)I1nE5hR&Rn0Jc>R8<}n3a=|@~jWc z=0WI_#FI_eQ|kf@Qbdx2m-&njo+)7g0O-IxU#ws1HTbDo5Sj~A3o;25Hy133@MEV- zC>F#bp&ke2Z=HP)PK`D-a%h1D%v$|sYTX(XpE-2CXo0|PoY-8H%x@Kw-HL|JTbMO$ zWllnpVzaLV6AX;{`EWR4FZLaB9UlU<5zeIbQI zNNd#)6Mo=TwT320FGU?g@G(Wr=4F;WQAm5oBarXLxoV3L1*u21QsfPTyX4aywgY{7 zlG!39*6}Nd_(EU7S9b0UYrPm)77b(CJv9VG;gvQv%~6&2_?7Til^YdtXY^cP>nOI~ zjVdSMRq5;I$fsk2XDHEeLvT3m5Y@9reb38~NBj3{TYuO6+)v^693q6yB&fwg?Tq{L zLQTW{w?gr;RlHX~EfL^{7z#-3iOHdIw0+%NOn+5oR6Q zdvrI_Z|ZJbLsP$bspxZuV)qy^YV`pIjUX$9ytSm8u;LbQJBNSXzWOVe$7%|{OmwY! zE*k5&0&MvRnExDh6spC}*R@s4S}x%3LOU+K++@D`)WD%=`cva^=6Ux~uw2)GP!BUC z4o_CEX&r*SUM3~eY5H^*OO@D9B7^Ud?w#fL;Fakmox{IwU%h4qUWMITrXQCY3<0(Y zvQ?+D*tM)|e^#E&mcJ!Cui|r=YQkArDi-+0<{m;Xw!DnjAHV15mR>Hk1yuKg`{K?H zU_s<(xU0ruPv}q?Z{N4h?n}Do{tyJbZe2@@>by(!lDB7mvh!Anj+{)VdhtEH1M4!9 z1DPA7uF~|5%4&>{h<%bthg<#UG8>n;DgLzhwIoG^kfe{-_2OPdJTl#-OW`P7%|l ziV;exY#F#-&sn{2P6kiCaK?dBFBi77>gCb_O0~I*K?U2_<4xB@8Fh~6JovXj!6>-4 z4S!m;0>Rvmbv%rptWNR)+!(9>qM`l!zSDQl{_RJ@;|eyt=-x=vrFWv`XT5o#W3w4E zyBjU1O-{c!nf^LCYbi@!!Px1EUB&?!J?>%@V54do8Ag`lgK9Z8Pc}085n91+d-m9I z{LOrsu3+n*Shb=Je^7utSxq%7C=zt<7!$3~+DX(0SNDPbD5%(Oz^53^GIetwn~OgU z>GKP{Z(`Tpcrn6%0{LGM;X6weJUirydd5=kf>M>?15m0mYzjH`O}jfN^(rm~rC!BV zpw#ElVW5;X|5#8;%SoWrN7h(SN*~`-s&Y*Qr7G8tKD~`YnTA<4l({$$!Kw-JuN>mcpiI9OrH(u?-~aGc1Df@nt)(ee1cnJ^{YJ=Viz#U^!$+s zE0ykGvx&;^f`oi6A3x@fQ<$q-&O>1?CqDD^hk~Eq#b2GxcgtDMs`xU} z(^*MGvh&em#!Z`JF&J!p`F2o7T6WT|;GjiDaw?S`r0T$&JCReW4!i@7G69-k(#j+iH}b?5FwG1}SMue(0z)v~v-XY;iW)4=(A)}~*O*Q1P(iwYdM zy(*c0oHap(->&y7JRF=GC9bD|QlDdIf_g=Ge7C6lkd%1o;465r>YlG!v{~y8oL^Ai z@jkjq9BC|sb)s(eTQH$B7;_3F2!UKj2n`qwv(}(bed+n{)y3ax{T({iErS}+dBZ-2 z>?mcfW^5tRvTGd;6^-d-X7)z+&SVd&ZC_N_Juv90av{27*XGCs2_CrBb<7g^#rM{$ zk~)4Bz9y8U4$ZFaPZqYuIddeLndfB~Vz(u`^ypbtztNIMJ4fv#WsjX}QKv1w6Z&Y} zHdh{r9$X>tJ-PnyoQf+NiQ|5*P`wdGiw)y^p*XX~qydabbfc!@!d?r*O9x;2QJEOS zEH-H=*r@4f>$Nbvbf_?XfkgPzk-t&X(JtxejWE1)s4#wv4uF#mgxr(cu;+tDsA!}& z!tm0e!szVPbg+$zMtUO*FC8k3x%qB+Y|>L!@j z-Q|?IjU9%U4%O~vbbDpW1CM==Zo{5))h6~v7+yM57+3acI#iq38)10qP+_EXyKBm$ zH`?9a2*XQhiZ3eelh9bgV7uP-QEbpONVNA`L%}swmf>H z-R+GqymYiN_hky7KOMc%?%p5BtBnzcmk!nLUZLBoI8w#>)f??@Z-n8cL$$kC^=dj) zo7fv+c)~PAl*Q zUe@Vz`?2-U?TXf;KHmm$RiEz^DvA3qh3bvaew8z{YjoObfav|S^+ss9)7GZbX4;|i z`;9~@b32X)^yK(_--k<;+k--}+kLd9`ktf-BwuOITBVKb8aThgyD?mf8m zcxIMBTs<={3dLvU6`{7%p)qB>9~!5MGnDxMN@!Ehy()iR{x$j6=C_=Gef|ykx8~oL z|I_@RZ;aj?y)AlY^q0|v`A_EmD*8-v-pzTp<=vV0%e-IZ-Iw=Z-mmi>&0CQ7 zWZpA*i}Ie&TblP$-m7`b^4`jOJMX=`KjeLo_i^4|@|Ndy=lvt^i@bm4eVzAB-gkLz z`R)00^3(Z;A^*NZUPcRWq6x0eaczaGFRtxyO+=lz8<;&n?~Q9Pt^;r-aFyfwH{Op2 zL4H@@*5GOYuMyY7;2)2_H^A>S{2hmjC)Q2IbvCYZakb*Q0N2I1X5s3R?ONSgOuaNlT?H zHPTX}EOnx#PPNonOHHuUBuh=P)HF-6r>;^t(^3~%s?AcfEj8CtS6FJErLMCSQ<;yl z+zi*2xMH|CC3Xi~oN4!p_TLBeez=C>D#cZa>mXbsaNPzB{~n2}3fFPCPQY~vt}(cp zaGincEL@yiIRn@ExHv`SQe5r0F2|L@brmk+=^nzR>V%>SEw7KIiY(R7Qmhk7Vi!xr zEyX&ad5n!%6F2b zrdVp4rCKb-I-w*kvQ(R;SSOV4TuWVHsd<*V&QkufLRb{6AD&Y`Hs&c!H*TS{7vN8R zw3v5XV-G*lHVsK_YQs9wVvJOD zYbCW=NJ^d3MBmLU#z_5La|%OJ>Xar*ePuC5>d>voHwQoab3>iLM87(VF;WYed2q}o zH#gM5&-ClE7$enBr<8wOsV!}8>|`-UN=~bW1T)u_@=jpdRL8JS#7MoS_0YqWQYSEh z9r>Nb7^za7Km6lLZEa&%Z81jb9M0Z^;~!TlW~Ev!#z=MPI2VPaimcQUi!o9a+T6qb zmK#=ID|N8N7^$~)ecmP{wT+efgT)xB=X8DM+&wp}ZLQP`7GtF5>0Ip>lImxruD2K? zwUf@(?Lt!9S*f_i7^xvTSGNyIZEvN@EXGJ(s&jRRkkk%Vs>5Q8)M{Oy+1|Uk(cema zZ!t#d4}6H>cEsgM?P#SwwiqLo;X@3!6E0V3Co6Te#TcnZ&Dl95wX>Bv&SH$zo4QZL zx0f5%E>`MYi!o9~I;FdYq;|DZ+gps0dQpeITS#g*EA_g?7^(Wr0f*Zimm9;~trX6w z7q`1@0XEZ|ct|R4rM9vd6V|VES?nQFe9HJv=-RD&mp!c1gBD|?cG7X)GbFXAm5N)8 zk@_oN3vhek%8&ZP+RI9PW-&(UU>*8^kkkMxb-2YCslJ-CcSve)E472g7%5H(rW=SW zKe{=7F%f6|_V@<|TB&-AiOZW5Ii};hk4PPYJ0TrMj;h+nN^NE_M(Pn@=mz1+$F~bk zF#vVPA2v-7vQqrkr5hA6QlIIzZZNp{(Hn8+`+DmAmmWLVN_}ZDM(P9|`o1D{DDI5m z`#WBI(Y{vdG>b7(hilG$A~h9vy2n$E6ZW%GNsBR3{WWKQVDqC5xHGKgpWNMVe=D_{ z#TcmrH0J=38l|O1Kl1rq2Uw|6i!oBOHD`!OZG(WA8x2qW^Zp@L>cVl(16Y zT8xo;PU|TlHp)|K_||;+%|us;m3qNqjMSq#&ZQz%hdX2V@h+>6E45NjT8xppN4E)O zBE=JI_}VEw{o3D`S*eFChEo1rqB}&2^>84rh2LF)^AU8!BAk*>SB@(`+KjaGCG*fD z<7&#S=D!dCS8j8RGu-JaaOFoo!JW_G8^c~azQRh~4h~&~mAXs^S_y7`^j_Q%T;%He zZ#}-!O3k$xrh=|rr>hEdew6)ty1hpo{y$Y#Ds3@FYPNz!s_{2JIu`-4bUr+=WnQ(F z`mx0rsez0T+=00AqyK|Di=xjXpY%V_O6_kkM(Q0M=YvFw=jgE8vgEZ(CLLs@{%A2q z>S-P4gGGv8k4*2%4_Wq#%JkXvB~Kn~%QU8A$W|^t`e)o(pD(`T zjlqXl&D&XwiO+Q^yXExE{3vJ7u=T(F?a#hB)JolCF-GbpT~}#Y$&a%4Ld947W%bvG zS*hDB#z=jl(^VrX_SpIVHOx|$%kT3q>2PA+Gy>(}_|{8}q@gT)xB zr4)fX99Mqy4&3qhL~bAb=-Y=|saL_FJ3L~f?$hNp4BY(aOStnnefNvU?jL5Qer+*E z>UtgLI*~d8ce+P@G2);)EA=yrF;a_IUEu0*sq z4YyK{`Y|GPzwR54aHM{*TSIz;m3qXF5viLrCmE7TTB+Op7?Jvs?ol^5QbS*T^ScHs zb(tR{Qj;|2h>+9~R_Yu-Mx=Jvp&#i;9ru%;eRHIh8tBJ}R3FVrg``qeYFj@>r26aL zd!r*Ye8B-E&Ujgn#|@H?r27%TOuA0y~xnsaPO>R2oFjvpgZhv*VK&XMXr z``H7Jvr=__j7aUPIqZ9QF{IQeE0yqLL~5{3>G6)#^T4bP369hwA78x730CTRKSrcJ(VP=QQYTueZa+q(&e1jVBuDCn$4YlT$x7i! zXmNrO>Qv1+IV5$mm1^>1MCvA8Gf#1(${yTo$thOqc0Wd>=4j5TA*oZXRHq*!Qr$XN zPjjSNPk82@)2!5&evC-HqdBLCq)xX|fAV8QYK(5f$2d~I+5GQ&jImM^{TPu-Y0lV? z)L1KZoF5}nYjtZp&XJmTWhy?-N^Po3Sui5?nU)$Kk{WNNzVc&4s#}*}lOwg;zXxC2 zWTn3JV?^p*&6yCAnqZ|q@MA>k2_5HVN9wvkzy4dZmFn_iMCzBCGchDJ(MsL#$B5Jj z9r_uL)bfkI{qPJcb(9|?Qe~PmDI_(?N*(0Kh}22CW=?jb_IvfV9Vc6l*ZjgEXIZI-{TPwDUUQ~|q^4M@oBbG(+C$gOvmL3`TmJ6K zv#r!1KSrds)*OCgdTlSIrdp}({1}nigk3bab8smsz6x4q?U6diO7-z$2#$QIdvVi1 zyHeAv)EYlVq#n_F&UK_V`RUsg=US;J{TPwDU2~>~q^4V`yZsoEI!|+EI8r;UId{bj zD~0VY#R*2JCe3LHNwrw1GyNEm`nT?Nw^}JO9x9x5SF4rcHzA#1gj%kp&ciR2heql= zEA_b_BU05`&-sqj^3UQAoNuLS{1}lMs5vu3QZua-$5H77Bh;5Vr5E6r7sD@$&)WV1 zE49Xt5vdO}=faTGg;wgXevC*>)xGW?Ia2rRu=U|TvQn*nj7XiLIsEGMVo0frtkifv zMx=^0=VC|d*80Ex;$kaR>BorFu9|a6Na_+RHNcM%sps`maH&WQ!kyV%^VZ+qztl>- z?8k^yxz3+9{K}6Ssr)yd-L=h19qh-5)OY$jZk9+%-xAb|NA7X-EGt!@!xD^09j7^$ zIZ{uay5(M%S*er#7?B#JIqiB{TPwjSHA~mi`4IhhyBB@y!1|TkS`OP z$F&Sm$G36AQ&s)nr7=Z2etF?+GyRKy6sJl*DIVwBs0UJ*ojit?;_d>*Da>sB6p*Vp zExOJ0IBfNdQ<&kQ(BBPdE;b_gtE7t6AK@#K^AU_woUKC`A4KbUDil_oQG&lp!M>pw zej1XxFBH}#A*tO$nCC*AcSD?igg6I>II}~gd}au9UnoA)oK&3Me0I|`Hdopy1}AGUc2m^V`Jv zR41&atQfAfFiu6Je<<`(p%`u&!flh!L*h!XEk3C0dMN$5VyAexDd~ipU|95 z-p@7iexA&l7{EBpY?(1;^3=&H0+x+vWcSE|9drKlanrK#&uBV33mdAldyHwyh0p0> zBhECoPL+r-Bl*+*7K{kCO>qU=<;Aj7>>$!^GlVN z`K9EW#y17fevXpxa~M_sZ>_UwywyU43B$yD;&{fpD#%Av$q%Airf1>m{0L%Ijs&^m zo3dy)N5vwD?TMSPar1Ip*Gpe+8;;6t^GoH7`Ndo@v|GXft}f#sSEa~sO~oHKfsd=L zpr)Saykd1TEUi{pO1ggZND*dEp&;}afIMVj7M=pjY-yg^GQdcelvf0$!z@S}rmj&< zXIGS&yd5(h?~Jo%M0AC0nO<5F^wLs2c!@%tJw{T{6anjtR3Ew#L;Td+eBLt!QnhPd^7SmYA@h`D`~$o;Io3&xGPIQ<{?ylr33^ z$>u7|M7t1VB7%JMgX}SQu)@ryY|Lh~6G3rk&Bh)B1yvz1xrrdx_Y^cuX&yJVb($~B zB*~gPW%Bsx%`;|98PhWP?8#Hlm@#f*^BDcQ4c8UsV6d_%UZ`ROp{(p#pe)@W)becH z*sHp*dHOjK%W0lDZOY^(yz|Bj-&6-*vd@{;JXNPzJ(${$&nz;)OGc3IBqfBNArHNy zfNy+@^GR#POu2&(@_iyRATou!fPz`eVlo z8+D=!)1^i68O`ISL;~2!=Z%@tJoSv0N#?BrAS=T}yjEsRiVT@D<-D`UjGHiF`i#kE z1RyQrEC(^65IMGrkDK09HhtXG3Fn+WW_;_!fb6(&6AVYok`sPn(Kv;Q(_xw7Br{x` z4pbGV!!pGgl9sY_psFEvSf)6`(#Q+6puw2CEFE)UhGOnQCFU+m$2=^}n7dGkxy#Zq zcbU=%pfUDETgTC5s(cLM-McHieisz_D1#Y(D@`KF-;pch96;xpI&WV94u7CoI zY#uXy;*h2x=ZrsdXq>KC?&_v!b+0HZ6J}{yb(QiRyTyb#oS74eYy}JLf%^MjQl#lz zf8vqivHn#Hxo|a+;;td%XK>h}N7n}2(2|OBKZr4V3WknXwMB)7jCj$=u|rGCtAe<9 zfLR{Il~i+5nRV3nB{2Eg9^>gN;WRSqh}#O7-GVqyne#a+9|X+l8pq%zeu=VDA1rbY zeoO~u7j1L0xRPQAcPntkz`U+;Hhzf;2e%No_kg)pTYIg(M3sX(7r48CF*7u+zLF|V zG_;P^_dQ`-ny&3j48EqQreYrB4$rWy~F=$iwWEdmpQ~baJ2Kl++Krod+qOe$sx^geTd52 z+{t`7Jh4^i8g2!uwqsquTsB*Q_Xk~!t01yB?o5<#|5>$pw>n`2CrGJNOL0mTHr>R5 ze3woi-q?9beB!)DoEll18D7X^LwNpWTsDFKeeD8*RQPhTT^lx(CM!8>vHJ7<+V8P- zC$<@1)v}jS(ttg=l_H!!q7?-q&VxnNaS}%%zN{z(k?SladF~!{s8Yaf*U!q5jM`@z zo5tATYf_!#aOUOYk}Q)~4Ww9^n#)mnw3> z1sz`y?g9~SsiK*HTo8%tK@TphrsLbsmGYJ?e-V)GR}|G=Lg;4M`&k5OSHu7{4V0)~zSpC4tXfl{Y0J^CNs zQpNe;&~0v|URDgfRFPc>M(2R`r)GLf72mKJ6V{!Y!-pzA$_@p?I%(h?mv~DRe`PU7 z>T%8CBat6H7k7sB$M2rr!dt5Nw8a>yod|;C+#zoQPUB6B&s9qm$4{h@Q6LH<tUNb##yoM41HQA@F@@uZIU ze7luJl0r!F%TAnNg!;E)$kg`ysA--a{H86{SA4Qh5co(-@elJn64_qv>ZUkHhd7+b zVVuHn!j*A~!-mT^#o5FB#9zf>gJ)b`B->yhKP3!;f78et^@)RAu)|r050?=?4rTc) zMjS32H)CpI3@$392-2c#hGg&)IqUz4;_(IwB7{2(8x?AC49lu$Lp-Vv;*?6w z^+lA{F(k>Dyj<&+3Ylnx#0smHPz*4?>}Q~gh|gQ>D1L7-6HK2lu4Nph<(J=E)oY)6 zspmt>%PZ7Zo4T*-D=$%6R#GZZe&rn`WqN5`?We*Y{>ENBv)tmn@s(Fq?5~CL_@vP0 zou*%Sd=~XrR0*3-dW0nE%GuDT*&F#Jp0Wx!k;#3d35X)QFExSN4_Ac(6@6l;k5 zA#MRMF9vam@-jb=xVL~Y>ruRP6g!`9#GyrxtPSZaNd(ioIo=XG={JSdS5;mu5z{y7 z8vsms5SJ)(J_m_A449E2TyetxIY`{ez?>DrC7jQ5;#z?*vm|W%66MwY&qm_r0e5>y zU#0W;OWeJ{JQc!Kln3*92{7-3a3vMNa6ba(%Mh-#(*L>2aK8m+E8T*7=_oA;hPwkW zgMv7JrGl;#ag_k`V~u0OEA_dg)G4=nz`q5Ur0!r^Tt%_JIOK>v&a?lw#@YClmN@$O z65j;x*k}2kg|qs~5)STM_`L;89p9R8R$ocAgJb-T0%o;n=v6qrjxxZ>&{?k-@y4&h21^B?u?zBB4QE;<`- zRh2(mBE;PQ%-@2zM7d*LBQCZJ_5#91XZ0nDod$-u%Yk_(goEK&B-M?$wZI(BPg6Kg zUqwl|V#%Gj^MP3!!c~?A%j0uk4%-OAUKhN!TS8gx9S9DR1#xa)ayg(d_ zo;e0b59gQH)-*w5rhs*bJ;avX!EW$XE z`5kQ$jzns5T7+Q>hBuD&Gv}uzVG+iz9yA5h1BPMwg9EkJ9@eu(m@0y%Y}X?E5OgVv zu%c}2Ywa0}Jy?Vh4_Jh8|Bo!fI9gJ2egiGS4@;E2h-w?E&mtVi==HD&Z&;r9Y!S|u z=|PL|uO$t4;I61pYSg$y?^=X^<7VW4>nrl3rxA?**4O{mS9ioM+oS&9_7$}xIO6u- z_O*6&wm0fU!7)~JO684OnDdQ#RA<3=%;4Iuhfj#akCJkH{JBN*ylCh2i68k8Z=lZG^7u>0PDs*@U}s%XehX zaMuRH-MHm@T+VR6^5ru#c;lAu=$zqxp~H;>vGL3Iq@3Y?t@GK0yK&3+)STgRq672R zgu8LecTCQ3|LMzTfHrdZj?WqHYMsxf?bx{a+?+GqH9Fkhd44D54EGxyZX5`vdE=({ zteoNUC6ZKCuU^(^nyfRM8repi!&f4%Y zMh%Yh4O}U2UfC8FW2E-cp>GkA^5&J9ZFsh@VRdOKj(xjfdGpGaSd0nl6rC=PaJy38 zys~i?W29czWx?@oS4zz*13U7D#Tco7YCRm)cBRz3GD>}8F-EFW$C+c?u9TWrMyYEp z#z-Bab5+_xX9H|CuZ&W|EXGLPr8#}!>xSiRfq%cn7%4M(f18k$w*~%8Ewzm;udj5R zIhO5) zf3X-NwUy>zTsDv{Zwq`Lq(jFo@Kq`QNXI!2uA8p7P1h`oF;YA{hi(sCZh3iI;Gb?u;}-K^%mdRyQxwHPDyv<`hQk$MPsLJr*YrsKUW@E2Q*kz#*_ZUCJM6K?~s(Y1^&ktW2C;*aULjA{yOh%fuFCX2HLO=(wu!lQr;H$wH9N- z+C_5)g`@`AbnR&|MrxQ&>0pr>i96ebD{r}VlfhQ%2tNkC*wRk7B>RH)=Jf7-WJlw^ zR_bv-Mx_3r_3YLNcz(7)1p4sfIn zx@F{h2Uw|x{1}nqLM^%>xV*52P5E%gAy#UzA0z0)b?8GKsT)>bvv#PJ;sIoIf)VO{ z%_+t&FRWYNzwp>%EA_D-BU0z-I42yblkXdNl(z-`#eR%Pt=f z+unYxA0twWHHUM3d|^%4_daiX`uV1-u_5GMx=Jq<$jPz zF`jhyE{xttP9(>sdU^(vAXM}4k&#F5 z%|5TbY24Y(Q>IKFXJ*&`0i~y=lp7y!cKtAo{SW8ZTXFwPd&~6Cx3^48Irr_#WP-=U zby<0@b^wd`(K-2cE`PQiZJLZ`S!W%b!Eb$KeS1z{S@)dV7c00CZ+FhWqdB)PHTU2P z&7suTSxo<|lT6$_MKC@iUj!Obsh^mR+mm8lYn4jN%kic0kQk1jTYTZ4cvhPSy!alKe{2a`_BZV`S zTh8dtx+6u2GetXcF7##Hk)qUH!@!TctUFSamGJw(I^weLNKwZAwspj1-;u&uA|-S1 zv+qbz>Es{HoB!RB;=emm{C7tROj7$_-;rVpo<0tN6zRXl{EMGi-R!JfkI7+DnzGfj zmmP%Srzx8d|Be)DAkYh!tw2w1!@{K@IQtF_=ZKFNE{92aavK&d&AZvdJsUnIpBbKB zuu3wk+puus(2+gd|HB z%5QUcwy`L?J5v1BV&dAC&s7a{e5gFDyt^aC0znXCq+ZkIh^Cih?E&2VRv!;ccfS&vg)R+S!@uEQ=H?>PyAJ! zxgkz#h%+I?**nBJ*x_W`kwSe+c(5msZeux{(c-h3)gCwMKed=q)UlS4fp1xB%^F4q zzPf#TQwR&6ls=Xht#VNpFu2TUDW?u==#Z~CCa+w=%7Rwvwa13RxG3T?X2s9 zkPKRiBeJY|6=-qP`p+NY314xVcUc@8{(r*X7}3(no{F0v>1Ujoxl zJ!zgkcLBG2t?-N!o)SyPKeBIM!r8b$8raJ;Mu5EKTFJ`9n2G$O)dDZGvTR8*{d%(F z&6Yir>9n!*!|EAJkU~4mBaRaoXWasF@Waj8e!S#f)&luK1azJl8 zTm=y}0^1994DRfKnZ>m2pXvSfG7W08y#>rX?yq;+;%z~(sVazYD2@C$E;gCPxO#H4 zd-8-Iwem%zdW3B7qmeDQ?(45`46e85G0j03bbLFxJp`{ea)ls>iR+em56w}%5mq`@ zv|HYt_&cvR!f{)=O(3O)WK306y^%fP#}t0r|GQ4FH^LDjx=pRr2*uF*WAUBHdN%Qf z`x?Ccv5xX%gr2E6e5CWuKz8Kjk0-8H4|(>TlTO!C{G)0!^TjyDVU;j0FEVV>IQ%!i zDV6p8q8lZH`w0joY2PNkpV-<+xAGz;uOF9VnsK$kPm{n(icO>cA2i}xLu6=qrP|OZ zuH3rX&#J0YU;D}D3w!JB7>OJ&)c@fQK$Rt?wnYTY)iy z;;f*8t8{l#puUB`y&Tk6?ljwxdBFV-FwMFiu?mU4gu4?3+oKDBnWu3!+%k6uk^P|H zCSZQcX9$j6KG9d|?ohNlaHpXEexd%LV*4VvGS~W64cw;qxIIjN@Udl6`rLde1CA$Y zZp#4SY`AVRQr$fuDyVJQey|= zcTG`ojV#$t1~#Q-jLpj~;KkaS!>iKss?~34wVEBW;^ zsG?ZkB(6x!+?m)qc37coe~?~@cd@Kh#|wQJM7VyaKsN6@OemY^Ohe&9Dn4xmZV^_k z8eFEUae}wnan@(6;gRgTZ$KOWW*(KFnUe}*j}40_qbpO@FPyh~_EhnMbwwMh8+JvF zJysJ<9@N2f#5#^8Fa1s`T|X_A`NfCe)y5t#7?51_VZ1)}Sj&LC+Sp^M0r|;AA5}Fh z`fG8+=1Uqjf32bY`GVL9U9rLSBXQNp9@VHTL zX8uZqhpv@=gV%aO|)v z9KW{}HQ!P^psr5zy$4Fw>u$^Y9#p;fdOI=bMX$3ylQQ=zu&M$VpaPGGCkHQ?u}k)h zn*ep)M|xG4>2KX5RsGs|qp}OIx_9rC-OpbNs2a1LXC$25Os0=VsnkzG9p%EYROV6E zFgzEV>c?UtpNgaOL-7e7isu_Pe+9c4yAQ<#?%9mpq{9z|`Z`E$kv zFgm(o9rf5irJ?;5JeelZ$xI{i5DfqxOP$v5nEpsgKsCkF&=e!fxeq##07g)BXwc%MDD#aGNOd+ZLnx+58DM699J(9z z?%Syz+RSAVCTiZY^=xF7Kq~!cn?$K~S+a9J$zW3}{#pH`!5yX=T!yM*APuf$CEMIn z*8Q}1AIw;%I#op0quJHUeJw9*fzwu8kA(1BuORXSlO)uqmRbW!Rp%`ss4C|GP^vl~ zV0k@P_Dd}8CQCgCN>%5NK&i)QmE~=Yik-6!W+n1fZ26hl;5L{!vGLkqM#9P0WLoM- zD%~*`d5Eq_6%cqb0;%u0#Xt zH3ohwXNRGp@gPu1zu zEN_OTuCTsdAL3!_`>Lh5LPFK)m7r7;&6)AF60T~Zb)SAD&zcyS%A7k%mHA3Eejj2l zvef2XvDthkYnRTs2ukQ^ncE>&lou;HqNq03_e$0^{GG!Z+=zbsnK&Jwq4RoHFcjv8 zPx7O(b^-5_Ly1+u9NDnnElCZ)i}T%v^t<8-uj0nc9P6dqCa`x*tfIEWoArq<1KmVk zeq;+rJ`qN;+T#FPpR}* zjp^@GnTubDov;dV{ty>h=jLU#Ps9OIlIB57c3w3X%vAbg(Y)mHHvEdj`aV91p)TML z5D>b2CjRQwUA8A8F0pUK$rxKVcC2mLys_i&v5s?rX@8c;NXrPYW7l;75u3lLa8Ydb zP1KXQTom)eVHX{C@S8*;vQ)x@1gg^7*z7q%tZLb`{YQn7)*WoD?bdM!rsXI}+Lvgx z8q)eZBlKe=KF%+znM~> z$qh~Yu1Q7TJap~HwF{^;nf@a2rYhp4(nzsYTk$k*iLQFQCa!!EWcvlIbq|B8Pj{uN z=de6tm)(xv*ey|&>x)VKu30gQY~A1;f~V`!^Dn4PN4w9i?X3B#ef2-5pH-LcN~R^O z?h_MT)ZKbgZD;cH_BAV~kCgQBK%C(XO{6~_q0+OPURf3;M+PZ4Y7I$a?UeQ`yl z64Qzom7x#Xt)h`Q?mH=}{}0orrkGG4uV{qpp^-lM#iE*4G!6IMu8rUx94paYxKx}6 z3N;A#!9pc*-(M))9M`ws4*KMiL|Ns5)$pUKlJh(E!!;CFDXvOf>;oKz>s4Sz;O~*R zxTf=%uEli&uAkz%71y1( z?!t91t_N`q#znU;t^)is6iZI=n1705kt>QNsVL@*qPT`eQE^KRuoQDk`7);zRct95 zA{DR7QXH~Vyc$cfHBda}xuQ~*8fmFfmO9Z=r&?;Pr6yQvlBK3tigiYX(PF8Ymb%DN zZI+sCskxTA!cy}rb)BXDw@3WmLi^Mk`A4dK!Ib6$4ul<2 zSMkVm7GtDd)?S;#CqK&J71*vL?>+jP>%5%{Xz-x(<{wSgoGrl3k8-euhWqy_&v?Sy zxq#0m9d|BJNxWNg)chk3y%fR!ink9c^mZjW_@3ba3dlvQq3Y(=jy|HAS>JFmwE#NB_i|e{=%@ za9dlcj}$}Vl^^9BB#P^gSG+#hn}75-i!te9`$We)$d9sBWR1+UjCjzSe{{9QP|80D zvb{*%h&$WjTVA}ZPm!b$KO*cQ(DA*KA7#5Eb^VQJclCBRFzcTMLvZ9eEyWajQY%NF z`ntEf!B71dk@}71aInFfMU`rpKHb~hV4)u)QpadcKapY%80YP7aH1b0-Z9Og9X~(H zGNL>G`1ZkS)GPa#cDsVfJuhuc7hs;m>RUFm?;}l1a zKngS4cs@PMsa>Rzhs|f>7$VZjWf}9&GZT?Yil?13<$^?Mak*KQX`~{NW01$bVSk=< z~lochX{*1 zN1!9evxFdLn)jF;f?($9Bh7=w+S5trwhUUQ;V`G>h$+4q)5bNaUvgm9#K|+8aeBF$ z4`OAejhm3D7;<6r^mE1t>6=FOM_FsQ_GW+9=IZ{8P{;rw#*t%4&%>FBN zjw6y6+3(O;{6#m)Z0BTlLs?asKQ?@seNK#SU&aVyUAK~YDz}ynVCBohX#2SOUy$?1jR4IQM*>F8B=sX1T`M_?5cnC9(c~3rvdrQ#dADX1SCXJN1RQOMrPT zh;xrUQO^TH1x+*{3A{<(TqPp4+P`x7R_ry_7{w*{K3EZ)$x~)`XQ_mdqSu5C0J3jGBkK zBhdAp1W!i}os6&)b7ud4JKK4<#Q8eh73G@jwEb<<*1oCqi^~Cuq!%T+I$n&;7kkuc zi+2HQ1TOy+9=#TZ1SaVYhnrxO#U%b3~pNX;E>(GK`8dqY{(CUW4iyER`$>`#S>P5thx;GGHDh)uo zel@4Dy-8$J&s0yguZ||$mm$3R4-=~}3Fh6{?lqWP^>xFd&+~`H9xJG-P5-O5?Jt|v zrB}3lv03b~7h`w65WA+U>%-0F)^FO78HN+tk1S;6N@6C$AUW6@27L_M)JnTh%QY&{ z{y{4JzC1b&>GzZAf2T6_?=H9$$%5LqRv#XFtj}S4yntCIjhofBf7AwM?OQ8qH(xY- zZlA-FnTwYv*Dgs`W4x%N2_h@D#?3T3?%=}L2?<;M#id zqZfOU+N=#qnWp&yN#RnfJsX8e;vN@jH@SN;Fx#Ploz=Bv<$6pv27AFnt%J-Rg98NP z#ejn~J-N1?JmKfYU?4c_iUISjseNckdDTIO*80DJm^b;nS*Lys;W@*a$3k;4su+iipE1LT@e{?xkfR)D zrqQwM@0yGYq-^Ln!D8alN5_e{n!}!?E9IG|KeZSm#o-bT$|nB(wrFn zy4#?7=IQq=#z<|aLoX7k6Y-0Tnb1pI%Rt1R}|~M?u zAATu=HKopY|FGwk>6u}1>nA$F2=!~NN12{Y46oR0zqHy|mr`80NhcVg%x0X*SZ}1h zpLWqewXv?G3mY5}EEth8YZp0$O>1tDE959>yt-83G|!aXJjZa>C~6<`9N&MdOs7L(EV7&0*|jiGkx6D3Fn;6(YGMow%s%!RJ~oA? zVo9%EnoI^3*gC)cOPA^Iu3Xj9wQgb>6!FkTbefC6vVjv> zxGmGCM20wsIsiU6K7jmm0KV1D)F3|{ z0CL%G1g4XP-$6)4nLik{^f?4d1TYC@A1(C^q{U+UR5wMddqr89Fe|IfYCzgY*^9)K z1T;6aYtc!Nip+WM75iwJbNsQ`DX%~?b~BqYI6l;B^_P3jG+Slv4YeSM3#`H-?m1xI z3gRkU`yO$B1m+(>To$|RYG5{JM+44_UlmPG)=}TKzzhiD%3Zq{aYKMPEQqTpr*+FZ z;u?TCIf$!rmxB{G0hrbxuEJeqN8F{r%nRbmic4*vAc*6hS@#BURjxggxJQ9m62z7H zwZRUIpUZ%m$}Sfi+e&5UO;id)-+qt3mjQDsJ6UiRS6b=BZz}wz0rMw~WA9V+mAdEH z{~P>of%%%wGi{3C8i5p34D=&Zh~M6u$i zJ8=&Y!wLpxapmFFn6Ir5ZOzzip`g=Xo!i3hO_zoyBq%F5RU1o|PqA4aaKZH^z+x&Ny`@)Y0|TqQF5 zS^h|4bDwvx_CMKK8|RQoePXSbE2;GN$wmLj$7qv^%YEQRm|AVFW1H~v7>A&k7NkIYjFu zA6GOI$DI{X*{{zQss{I|LM3tMn=&f7T<5be z^z5l>EX{YUrQdYM404CV$ib)XMjTdqQmMp?ied44myE96x_9x0)fQPyTudDpR->f= zjvuJ5ly6wgVvLj-#)8ErAmt6KZKtKU&zmBfGza#ZfRs0^HrZl~lo|MAHFsm^4Xc@f zKW|vAFD)u?o8xk&ykWH+EXIUYr9-Ec$CdJi)wr^ej;lTtd4=ZCmg7o!!)km?=(e;{ z$LY}ffa^+mt3FP$7!%gxTF+J?DQ{TKoEOJoH3jDiF*;gv+_1c1wVzmwkuoa;Vj(GS zSZ%nDVa$fb`bWptbAI#|+!=@DzL&1@hSjtc4Vbtd!ZX8jthf15n)xX8b^GuuykWHu zz@h7FrCN2Iw*fal%8mk~^RM~ezT>Uv;Ho*gZLHK`nnSxwe)QkCGptj;FaE1HtX6L^ zaUH`ifuWNjv*@RwC^c)vC3|}-I#v?^*UyHvrPf13PkuCwI~i>w`d;dtSJ~HMOjtVu zL#Kw-jt9kb-Spdwzw*wj+=Bo(@4QO0OYjch=0|Bdq~br!E1B+{S2&H9&Lt z8qJR~m698`?R129Ugf?PW2D~DoE=4qwivb`|8r=`?cRBn@A@(Dh53)F;W%~18~B@k z?%X=>yh^S~q7#fzduu7?iYJxmeBcc4yh;v|(FsPV3p9r_3_YnK-NPUD&Z}(mV?^rT zI?kM`;z_-C!HXTk31@9szqyJ_~8-g%Xy z{TPwDQ*+{u)T!T2`D0wlo1lCA7&0Pf>CpE8?WODG$6jCQoma`jJm>@?)azQ$p7`ZS z{b|VZ&%E<0-}Ylf%1o%(OQcxy>E0bMJD;3Lj)B@==$t1)shmbqJH;tAKk-*_9u9GC z3UOWtaXLbr!$Ta}GL6eQP>Z29gTYgc{8M9eGV(W}*&D2N*rgtyW0F5;5Vv_kbE&iG zG&L$_a5R_5@DQ%S`o?iZMbr3FI~eT5KD;NjNp1E4USvboL0%JZ;6yQ_Oolwey=^ib&Uce5T?>Ux@uX@K&^^R2q`5J7}KSKz~HfEg>{CJQg&H% z2FIIKc87r|%_e8)TH+oao>oZ;j8XfT!MM6Rbvvb(EfRVpTP?cN*^3%vV;++MW!SWEPA$-oY)H2l6+-|=GW0Ap+3 zdo!#TZ(m)|vQ2=K-@0ouGa5E&wb`MveA}HmPg{(gZEjN|R?872M&yWnPw0j3lA(We z|CR|U##IpEbD*fBKqZ97?*T{ZFF123#tvVT>Kuoa5R*qbV-_Z2h!h4orf@sX2_|OsddnFMd!(XkQ_=N2u!@hq zFPqKCnjK6DW%U1t3t!mI6-4g9T~S`P_i$iUsZCjrLqk%b_3+Q%%#(2e- zs4L}}4UO@No5iSygH?!*#hD*v4~3z2POjb7GaIr|rK8zURqa<5Lz@lRU!gYlu&TE# z#z@6f*hwDo*0rtH)~cwj zCZqyNtGI$vEAGTtMQag6$^Y|t&pmgUOz`SYzkUACTKvv0@o4JN_VT2s`PYOne*^ZwM~3uO(Pp8Qp~{FFpl<+jV-MWA=Ty|LoA7c6YXyvn8|gfWQi^wd zQBPK|uE4NTihCn-9G`~YfPXnKL%D(vW8!khIPzly-i-j}V*_W#BiA_>7YD8rT8WE| zmcn#zwDVplR{1r+ylCKS*t|4w6Fx%VVMmat;#C1cb z{#N zj(X-aGitWkp48i^n6Dj3ozn3uZbRxoDr~({JLR)Ed53v4wZVTjHuN|9cL9XC!!s8b zCc9$BFtI_a2G<|lY)rMxX$}Gv!Ot&KY?FmDXL-I#1I83FaYY9gE-X67~bh`Z)0<7<$k^>4YY;Z!2 zE%XIP0~%(00j)ASQNVB?j2WpWf#&ZEtmTZYq~^)7W5?eHORRVO-W7qh4ESROc&u%U zAKse(ShgY$X&wGposhAilJN*rHufgBAywph1RWMABwterzDh7&ROksOwp(u{0GA%o z)arwzai1#m)kKci6YhGT&~ckWx@cFzy%s;*KNf^a^wUA{=l8_$EEZ}To+U#47f+Q< z-0^aT@Fe+XqVKD!XZ`2C*opO@XTX3<1$d^0AY0y8Az&pvnE84k zI1x^LRS1|8Iv40On~sB-uNQ(5aO$fY;zAkO)EYeiv*iP3}npBNmbnp4Ue6f*l z@Iw=$rM{VdpNWP$UEBF(ZA6Zk810uacr*0-Ool8W!;k%7eaiwBLcHX`q{V}#aQZ~5i5l;8hgO4delJRPj%TxH}1 z5h{xGRU5@ws;&61IH$Lh((6xzD$En@Fb}tLhpR5yD5=5PivNmJ)edtv6VIDbD>y> z>VquzOzlDT*L2&y21Gj-VT|=B5ADtsAdzq`0G)N#+?qH7Q(IeItJhF!bLUdmPwLta zBW7o+)f9k7e(AXamQ%S>g5&w72Uwrtebn0*e7w(s0j zU&5hi_Jc;P`Jc@`huY5q-;VnKpwR~KpUifK+UqxBd$TnaH_FxwfaKKYtH5NbrbSv9 zanHGt(Q^WD>|^O82ByCw_19jx%NBh$aQE2UQ?s4<3Sc~mz-?-38p<47Dvi_}?)l|Y$An`Cf`*;>gPBa-YwG~SfU)DF7U9^z@Onz+sXnV9 zzY{+W!xd%r3c)z}_%MyKe4D2cR~v43Gzd@)kt*GOPtf>O{@9RWC&Sq>w*~<>niwsm zlbszX<8D`m-(49BU!`zYRa#85m{nT#Pb17seuFZHkUQxMY59 zjZecU`Cdyu@n8*C7U9TXCKo3RH2N>8gxhh zzLOmiBinyLMxpFQRQZ!aCN2J`+&p`@*qodR%)C_G$oA`;KLF;3?Qrci!L0@6C#krU z8#?IkZNU6773VBva^uHiz`T`;%XO~%9fex-Z(uUn2EeeQNqlpiX9Ru+KKK6nSnFX} z)D_N|ejCB>3(RW2e6=H=j(X^3kCCX4L@jOAWvq~fS2aYKNKrQ$~BI6mpbtpjFz zDlXSq4miI5z`!UU@a*V|J`C?V_@Z<6u!C2e*6ZL^ZpW|K@6b~2uGe7v4GEcjPgyFE zRf1-$ju}^MAin~aUj`Y@!523S1%;b}xgOSlSddXxHxYs1?nE|UrPaQ&sY6!Lt$BfnNd8{T=5L1rvy$Jin&^PtN)HMOPQkL-{?dapQ&BjHi0L)8w^)QnFsu zU?pKK37AQ(wC3=T!t&Hr8KfN!Dd72)hZJm)%S(4)LEmwo?!dxhI_je4#$25_4<4&1 ztpa6Rd;Y4DQry5a@$j$+f?iuv(y%aC(oi)uFwnz16Gd#+fr_tHM3z6!tRJScUMV7584%9 zse-C5Z#PzOcIp7yS8&1ziYhmypj1F5P+T}vrKLErxtQJchH0pVvvZ>LO<2p7VMkPH zJd;Zz&Sx#0J|tM2XevrHO1QLtQLGiR`YP88K^5TV_dJ7-K^7?e%OG(OQ+JSee8mnv zM=q*^f22@b;Rh;&>4)!I^@9TyujknmKm6aSA3^csAGWjt!(%GorX`K3OT)9XoM|-} zue_cYQsQBB0qkN9y3S#1Z*lr@EC60l-y=^s`DlIp!TA~j^WFq&X{6P}XsOQ)j#?U7 z4IBL$@Y=GO*3yWy3E)~wBaazUYH5VsOiIl?tFXUy*rLhAXur-w{AtwE$W&02+Tx#j zky;wTpolZ0gxC&SG#OHCC#+Fyw?DpEWG#(swqrzomBCRK_UG=dRov?0|CHYsZP7Q-cFk*DHZ*^XoHUn@*`JItBwID;LWbQAqDu(hFH zK)lshoM~rH^q*Z~jm7oFnX%eXZk{rv+q+SRknr{$#eB!zZ)d9KMLF!0NeuhxUJCc0yqAdP((ya@*v! zu&p_9(`rs$lVh9yHmweTZTg!4=k&L@DFM{;-!@M9+!b8cSfHoCziRh&XjFc?^Bq($ zbCgj`>>oB;$#Ib1$?QdFY>wR%HUnaF=bLZMXfYcNMk!&W;C&` z4kFYj4J%X>uUiMJ?v$D;So>JcrqwR$9Fo?i)%{F|weDvQ3ZVg5wvNg%b&e6#z+)F+ z2OX6zPpA7?J1#p?q5IkHfgE2K4^ob=TUtaH!q3C;Q@WoO#g9iOe(a&~zmc7w(wl42 zvrR7D;ip~oywxOo9_*?&UI2;+o_XopuZO*Iu%La{bK$>*A2bK+_1&)^zyyuN(7hwo z>th9BSce_I7&Bv}Xmsz$I`vYcUdUz)OOIN&rGLN3>h&!%F+roBbDqIby*_3ReSd!7 zx)!U~H{XsC`U-=?4D@*!PMTGx|6?IJsBjC*OJl=xa!9we0YgG`7zlxf%JwPRYI3+} zqm9DY=eW|(SnCE<%l#FE`T#-A%nDf^Hb0g8B%N9`H5xffX0KgbmLsm~FQ2{uMm5^{ zb0ePu(=W|+e1u$FK_emclrO89%Nx4geh+d-jkMi!&GL`A8sx}HLj4bCvqR4NG1w(5 zOsVXuozJ)Duq=~JONYxHZSQ3XZf-hU$a&8-Q)EdxoKvBUhZTW4zqC>_Rx}Bp^BN6V zU)`C`y-^Ub8EKbL?gty+7}LF6=R)jQ$eaYsf>d0}I`J#ORRMFF(K;{)>ig&TOnROH zpQnX}8MV^H#U?@$liP1>_0 z|LJ(2;^bMG>fj@mUAgIhPEp&N9qm5XTiIo^cg~zw?+FGQ0w@a6X+0iqe<^|u3G;ktd^_%ZF{Wkfop?uKrSs-Tx3=ra)XIa7<1AtUs~ zM(EkG!3-#L=ocr>=b0ZP^x?LdK{NP$U8NH%yNcn1W(@zY`v!NxXByULYs9+r%SBl4 z)nEC01woAN8#Eal)i+ShJ!UDs$a>Z48*DN$T1xkG)QpgpnlWkScB^mD)$o+-9TF){IbCF%0z^Cm6Oz z*Z22YGeW1C7#%{REi^XEs*WBG(!De32iA;`?kRDztcsVOw_&%@=Vb%T5N4hJ%ob}# z=wrh#&Il=~9~+$R`0w+wIVOM9%DTI(8KE0ZjFvjz;PCV3^RjWK)coydb+TrJ=9?HT z^_sz9PU*Z;ER}cZ`&ahwXojb(w6e0g%y0<*GCT`w%gZf0IXH`q?Q0e^xNt5NI8>D{Pse80%M)>K^)tuLrf^whd1+O=CY=M-HRV;Q{3WF;=Eh1F zaR*)MD+Xn0c`5Dyboyf3iI?)Gs=BJITyMtfXzzg;Qc1-W7Z{xCW#zSt(Q)&P7@cqQ z$bw?NazsC7OpY4T^CrHir1HPaW-lMZkA@u}!#&4AZsJ}6W<0;*Fs8p_oih%6 zeVTz0ARfv+=Yo0?{BwYNGu6EiltOAj{LjJf17P}d^bf;|tK1vo=(4_n7dgQ6P&19v zpex*1#}#%xfy)QxbPj}J*n}%wuH)eFk>Fnf%ufxR<*#!F;{+tc?|^yPn8mbk&U4L$ zz`YO5@FVD}Jsx>u6h}Sj?<8Q(PsNRLp1Wr6rv{jt4V;-DPH&~-@Ec(Mk&4U9=K$R_ zjOI22qnVN}W1Z)p*@XT(9S%KyyMrutp97c42*H@)8aQ+n8o`Zn-jK<9bOmtl8(6cxjUH()_EIl1F%GXZ#^NS!Bx{6aehBhMz;xnLB#c@9 zMk%{~viuzZ%$xy=!;XQ3FV9(jnZNfM7%eL}jD+kNN8F?7aJl)80KN;{CgAQJs9ZC{ zm+RaY#gAXj}ec>yCMT4Ks+R!$L83BC)&WO)8d@vna%gAbht5& zW?UAblId`v{E_)OAo$O8`B{2gjy)bdfx9~`E^o9wA`IW7X>rc0D$&$?o=S&H+257v z#rFufH;#b-j9D*3IgX8694U4k4E+fB(LhY4^T?1r+dR*LKM|P2h7e`@4(8^JvR9?g z@$N)mjvXp6+xOCWh38(pE(B&AGaAOMzoEQ5dqrnQ_FMxaKs;1^8{?SsVEJ2^7B|u{ z)k56Tw75}@t96O1ONYyKz~t0_190yeSTp@XIgX`)v*F%uU`{;_1dN3n>-fO2T$KQG zUOU`KM>?}yl^YnkM60r&HCxIE`~pSb(d z;qsljkBMtaha2rw#YNnU>2PDz1TJ2SA@03&xDbqi;XmR&Pm3EpTK4YPurFq9hobX2lpRo*&iEB%iG>S_6JtcZ$mDrNWixZA$fK{!YANXiu9~Ath_NX4;XRYH3gQb(5}$>Wr}?Qy zqi@Sqa1=oatjQ%nv6o-`NQT$z3H+vMX$@FeiKf+WP-XL;$qT&kOIGj8Kpl$5^_)#; z&m&CoN88YlhS&cVWD7s(xO*-tKL1w*TPvw(+lsUata%Syh6}U*9wdzp&=u)jT}M|x z6li?j-C2RPbKpb$zD|KF8$d)G`rwr(TGstXQSWmT+TPeSc`6x(N{@Sx&z`{A&EOQ( zZ|YuBHnFI_tw*4KB}9=Wu|TxpjI83sCwg-rtifo*%q-YjcGH={Awm4}I3pScr}cvL z@9Oz(Qh5Cu{_h-KzZU;B(n>5nb*JAr-M<1d8X;Oa>}nQJZdBrOMxnUjk}ps$9%Z`^ zjV&dZutOSq18aI>JE`&@*eCn;a ztxggRJ=dTdPh4vr=ZvcFL+)hoK3ah?F*Rg6vprD8PQDh4I1ZqtOj@6#CGUzf@uK+ zs&m**2US_+ia|4nOX#K}i;uOt`7F zU$}n1cX^CX-q;*To|_d(ydGZt9vjkdeOs4s;D$}%%-6$pZQl5l@Mq232pT`3u%Wsw zlK3bx=(BL5Ins51oI7kWi4UESSQ-hpofSlB!0nx5TMuvlVnvrk7paKSUO2ZguWek> zGk;S!aO;Npwn5>*b~BThrosf`h1hP? z+m=N=R=<{hkVP|lIQ~sQtEcMpg=YI_wS-&Dwk}OYP->9Oig2#qSqtuE@@#)@*HG2~ z7XD$)g^BG$SpiVEGmN?r_LAGQ%U|f-K9uFZqLIbFX;(jdftFXI@P|?Q!^ufmh`f}2 z6#W7e{ld)G3t03E@pVSQKMr>Xd*f%;?;lhu6a!ph{C4Yb61dekR+RWV zw6_)|UW)SYDGJ52QbO@DE>65(oOlC;E1dY}rm%c1H%0t#%~Oa?>e#p*@$+0s;w2Ga zpC}hWLEEtmm$mQ4Zu#!$FUI}x;o)Kb3S4zK-bEXtv68ZlblAHgnrPN*ew$8}ZM&_0 z;!*rYGfLt7je#HUL{W)&-^IEs%2`g!-(l^7@}io{DP|dpnPun>^X(fZPs$L!8qySZ zR_mqenT5z?}perIErS;jN7*2xz35B5RuB zXQa;$mIpIG`l9I$HNvV|NM}Pxb$(&H^=;rR`FfT#WVxdHNy4E~5P*vGskQ`;w~kCnt=vSH)?pOt;CsMOn@Qct`ob__=QK-Iy0(7rpxO?ab>>v- z6Ikmm%v>4?Jk%Ij(}<5>Q(->-UAG~U`EYh}*?UG%Ifi34DU2lM_O4t1VmqLszP}>%Yv41Xzbj^lq zXtvb>an)^MO|lIRO%b)z0UZ@BCgD>u!4w(kkD-qhj3l0#6K&h6>svBxcF_{=s0zoi zYc_sHIWfI6Lx^|ZB!m<@Xb3IuZM7V2f{Zw2gsKp|;gIT~ODrs1e;nVQ^=tzz_5Y*Wfn~zp3~Y;Fp765WlQI4{vnS>T7_a zF}lmnDE*Iz3;**0OA+cH#|u3&;=Q6})8-W?)W!{IELsco$l-`bJ0k_rRO|7~@y2-O z>x^Rt!--e$^UDSBwh@iqY-4OPTKjxp4JYrZ*0la)Phibfu{^^f80HiUTD)&QwhON} z=3~q=o%NS3M%Qp`YlH43GypR?VF=p&iy3JG{PH+)!EIP@`&o z6&&y|;H}Tj!c&bzo##vW6KjY%G5*5#5>7w zrmjHpaZ|le?B!bfRA5aLT-c=gM#agl;XPptKLe3uQTHNFR$bEaE4+s;UwjISl3^Jb zABUl+KbqL0CqL9^w14;!H2-brg2u-dCQJOSAwb*?MwKixV6U9m{e+$`A68QKR7rkQ zd{7BWO<$R1!$&D-etIN}^?0A1&NEg7DtONiO|k!B=++Pv7P zwa;JLRa%;?%#Mbym&0?jyW&esn!6o zyg)M23Sif13oOfL&kwR&6I%y|ZEvZS*22;jO-yreyh;5DQFS9(;5P)E?N?|A(ptA* z&zO@k`Fl=7tw6tUQ}<}u#Hh?<{uJ>lZditc1h_xqld!P`@G;hb{Jnv-Kf~+C@PkU> zz?ug9hr(r)+>e3PLx;rv*5x>kAa&}*sG3m3K1E%vIHcZ+h72_-mawK2Gh1=AeGMGc z&5G3q=?u_sobA&>$Y_M4eVU3FJMi;+I1!}k4BHx&YoD2vE=a{mZ&9+KfK9odeWoxz zL0R!GGNCl5S@lJ-A$2W&j!v~|cUYQ7qBmkxy=YRU?hvMKVX{k@)1#G2JvI85YGyRC zvGs?cJO---tx%EQwMbMeA7K$P$Ns zx3mR`O-PqEri)Dc$54#oNEeKxY{iJH9I6;S_|4L#%_?Hy^^SBwcx1Fcr@0bQQ0c<) zluDOYlTztoHZ94}>H~M+;1~%RrfbH72PhwC!Ad;0_=zJFfmfX>3CMf%)+zs%zR@e_&|r)A|GB@;2R^W#rbnI^^667?3<-Jp7#)K5S?gWpE{evKddbkE~=9e#YrPYDYV4Qqw+Ls9fY zQS?Jm^g~hfLs9)qs=rAEO=^fq**7*KYAHKi$-$PpSN19sqopzocbJDhQ-j0txi=ka?aIzHFUWCqv%rZ_nHzr0)J!o)PB7I(Nv1D-W&VI7h+Lis7iP2Jz8|lNXC_e9zcrt`PKjD*)tzFrF zGcj7~3Sejs!_VjC_Df1tU!Q-abx!{(0$`}Zm~TCv+vJHaFaG(!s=p~EgEzrwsa~q+%jF49siRG)BTS5z8UQzF_}}OKA)bW%x@P&b z0jAUtaA*d2w3Lykveu#M7u&d(Uw`?&fuQWPkZDa4yh5pi*7&GlzQC6XeqyuKF5g^TVR^(1$Xp4&XnqAVzkswBb&2<^?7IF$w(v{ zpXi%yO1*1hwA3etJFNRYFT+Xm_U1XsVW!kx6QiXzFri`C5?W>B<`vf`k2j?@n;0#{ zFBZ)S`1!nS?P*T`>`${#Fs0rzFh-;x9v{RH=#4Qh7$c=ZX|l zl8{Yr-4e|;r6!mdEj7V#XQW6y%O`%T<{f(TNK=YmYnqWBE%k*F(^261yr1)l-_QpJ zzck8}%3uQoGs={D+lc9CaDCpreB$@O+{TvCrquf;hJM-mkWrCh$!9xu)hD+mMw@-e z*+zKA2!_2Nnt53R2aYjao@-)sELIzSjRn>!;V*Xi;jFQy)RiViOARqT?sL{rcR9Df>arZ}&J;O1j&4KhE^4zzFkrkO{s|{MoZny$io!i z=kxX=33KMh&ul6%rEWDbT56J!K4D-jsVg6O_u8;26*Vzh>Oq4u$sv{dYu}_vrWBRH z(o8bbaJUiEQ^B?TI^z2E6HYayMwuAx*DQlm=#UzB#G&CrQ|bZ}qovLsV7N57qN=pgy7R*3RGK%+t#mJx z+K?sXvBfE8U2PF{9)h*K;58BEwHge8?VVigps(Dpy)!T7NGE7s%aQIS(|mq>;oPd~ zvg)d(FnsgeuDym6olXD*?BQ*h)C#-2PCut~)%tuBq zt(?mv(-)W5R$H9%6*ZL=Ww?lDzVO=xQuOk~s^?0s9xQ~skfoh8qiDOig(+ok32XvJ z@s-+cW82yQ&zX~^%&n?ekXt?f2X=&2n3+;(50~2#>tOE>_RcKl)@?CqV|$R-2YJPG zDp!rI^QIX_spC6n>~GSBhT=7)3l`8(=XrXwNR&c*Kb!vQC2XhKC#)6mB{h}E%oTH& zR$Oe?+hTfYw$Rq;Vwlxw%aI(nn&uQZz?<3sYIN%;BDj&x)7%`0e`M?W z(E-8bI*+dtcOV^ZjPq0>Cz=nnb@)v8MmxiI4PG1#+`R^tJyaDB$Dv!#TJX03Gu0Rj zvui52QBL=WTL4T;DsH6XFua^b{?foeM2w2BGo7PIziwEsILnyxGt&>J>$M#JbE1~F zz29Qs%zPW`IMnL-6>xU~a~jtrV9fZAaUA*<_sW5}#K4*E<#K3l8BW$*3CxY{a3PM6 zO~XmhTY>p&JDl_MI&qtTc_$Ue848;Tg8m4YfH6m4hA))ESpd`YK}H<`%y45?iAgT$ zoT3e60r-~!^QM6_-5cvTtS^)A9~cH?K5u7vIWbq{{9d5KEd*yE6 z0l-xoSTlTRSZrR%;j)$K+#566kuIF5T$>IzI^R)$PXq2c;Ha^L#`JgO7)Sony|>c3 z=TK%L<$iZs+~|}X7Vn%7yFNGWgf+IhhJ%EuWpPgIGwtxTk5v1*)K&mvV@={2 zY*WuHOf=WO^<`pqCXdqPZ;i#d=szJ^RxpmlXix6g zc=mfv1jR~aWdt{(>CKeb#=wneHY>KC1-`^3^+u@B4Y3sP+ z1oX^)jDrri)SjDWcf>j+qnU|AqRFXp+PFL4K3{i6W(HqFooz9)H}t$p5q(^l@m0qK zIQORFu@Y3d#Ar31L7{A$mW;EQNpDI}9Xq4a1oc@4bz>C!Wzz+9AA))&gW4sUJkuUj zwMkI+pKt)$sMM9nd2rC48^oga1=d^#_jU60*%R575yye+lATN+LBwJ@fiA>3 zxZO>F_;a6d~-adj?5_mPTz3M6`$k*s3Tr_C^v?cBIDc;VY*h!NML|^@C|?&G@b1Rq z)`MxBzd3d?x7;?y3tE?_FW%K~RJV&}bD;`MG>?__Lno19g*u>n-dU=dEH^_RRePx$lTAR0+j z(WenHoJv5Mdj*wUa!9+4R#Lv5BNR6=xnDGiP2i2OQ7B|`Dt-_PDZbFEftTdKu2P~D zApW{+0BCs{TdbMddEn#2(HOI}l~8>FN2y`8Y?`!{y^4|nGQL(*iQ{zT@Facag%QV= z33z=D2vwth4{9EMe%T$Z3j7hM(W<^uW5yzRTLNmaP)~zW60d+#5~=mtI=V00lE1a1 z`zp-38ZvP@q3M{@9BOpzH@BS?V>4iG)5L~XXtk)MV$^MD8_+qs2NCzg`BgHyFNsT$ z)ot-!t$l{J?Z+9#$>?hdE9S2|qpP3wmFF6UA}MT9=XTKan@07yIfk_>JcI){1E90V zzLA$lN_5S#DFd)R#5&qI`e?;A8P1#2EE5r>Vaz+ZzybBISv-EV}M<62AV+F$(o3~LAALncN`kqX*QQ+Xw6z0p zqKVN`Y)5I>b?|vP)xi8(a__?@S~~!@5&&cE0DMp}j2(a+LD1o!9JjECwFB@m6Qlk5 zyOBOjbD#HDeB#&Vy(Ocq9e~f97%es5;PenFyIJld}d6~ov8$f*sM{`XHi@>y#K;6)}zOC6xoFn#f}cG$jh?x1XI2cX_3 z+}HH$O(RvA=GK15IdA;D+S&oQ%fx8E_86QaM2h8#=I*8auCjIjeqmy?)HDS%b^vOr ztYZ$j+}Z)i&mhf_W(c{{h2|*yd|tZ2h(2&n^IxqUfO?MNC{s%BMqr!f^RkxFaEFPt z1Mog0g#AsaYYh%}<6HHMJ4~z{fIl@cI$l!^4$G3ydm5e$VgF7mHd;FXXPOu-brC@@ z1M#!`;tmsQ2jFrOqowi;cY+S7;8ES;LGcxA&jb^rrH(f^gG7oLZOHL-upfXIw`-G5 zGc(_P;J}dcsNolBMXqsR+G}r?RRzKgBYOtQu=H*k<<3(MchaxyFQ{0AWmCPfA3)<{ zEhUsFjn65o`UV#lVZ>^y?F;(G3t1N8Y8RGs+B;U$;Tw9BvU)FJYrhYmQ21%q?u`&Q zSLYSFeMnLkz7>p~wTGrIWE=jZU2wLgLh6FB@hbg7GF~2hrPz?}U{TlRHWh4hF?8zb zk=dfMJN+uH1Cp|is$FxgyV}w{Wx>x;X3{Rk!NruNJ?%#=E|IaXtSMjGEyDpWWhZ4F z4s78#Vw18UXZVz!yTrciW+0a=P|IN>#*9=dyNwmCuUgF-os*NNpj^%3XBHEHXt#B9 zYwzTmbv1?fPFAxut0V`jf+ULankmbzkz6(-}=dZ}v%GES!#!;2@!&5{gBy{u>JRg_&UbShZ8%o0{|~OkPrB=(mEB ztxLyocC4%jL)v}Q0u3XOUC}a3>pvSE24!pehwZ=Qm}o=y&N$|t84(>^yXbtOcS6gD z$mmdG3y51x8Ga~hf`)^uIXW$FnB0}u zkSMK{xHH+hG92o0WEGSM_3umsqqvV}^19+2=$`ushjiZ~t9xH^GQ#z5imfMYKHS#kFRE|!)i-?^ zzgqO3ZD_4RwDY$F8aP?o@-hM$KLp~QFb>2=x;8};o5M}JdV=H6n!L^r#c#C3-<@=p zyh3<;|9EKsiyaznYJvA}$eSK~lQC&yVUBP7l!o58p?QNp4DU-4Zxng=ZOrg&lBMUO zvS$`<@@IBKBKFRVwryx@DlYpNiG~neRfNDWuj`7S$f}-W;9`|dSXvDN- zCKWZT^hQEE0t4018A^vlpI*4>JxR~%z(ZXSC9oHHCpY+mg7Dw@3z)5D?j610}oAX zdM`8FwXHDG*7Q+NxIC`!BzPp&?#LyBv+781!NWQMRsO+GVpko>1U!-nIPOUJg#>K& zZ|s5+JJ}Bsh?uaHY@rWYS%;K_UtRLP3za{oVXh+VzH4!DDx7d6*-Hx2y;0xC`ei^?p3iLThs@64-bll^3E{4L&}blJ{SR5!KO@}qA?ohC3{d~W)}5bWwisjtz{pVLQfNsC z6mulR1|$TuP~xhp)`dumi>V{!xz_WfsW>X!^j2nJ*MEf*|3UlI6Y1C==?K5X4(}vw z$)kS{AZb4L#tv!vurtDeEa{INg1;LJGkoK5K~zSON}4dzCY)$$Yn-&v->ut5jH)-G z6j41VlT1y$^V?=iHWZeq0!0t@S%`8jw4fyMWHd2jcVV);rnt--ZJ3rB3AH^=AE4~y z(m|8zR%Nt}j~^iu*piuth4zqnU_5jfZfx5aS^IWiOzN*Q7ZmzmAm? z?RUS```SpYc^J=eoxdBb1p!$OD}pA>#D7Y#YL7My%V**B z1rU(W9&`~gKySi645||M2d-k+p!hL*Q`8&Tjn^eyrJAv;DDki2#Qv6nh(c)3xRc^n zw)R2HTWgDxOZLJ|PwV1>huJuzE^F4M>OoDG1dP`Ko~`2 z(p#-B>wqXfS~r?@=zo0z5ov3EU?pNZ0zbcplY&8^9yY1es+wp-05YKBZpHAxz(S-` z-QKRUzoBk#5dWe4t|{IdWh*P%wi(DtUNmSxuiRGL&^xQB?P;S$U8su+N`L)c|EhsS zfyXmYFjgGS$^uv4`T*c?L%1zmw|{5s6`3>-?`iVIx|$Uu!jIw~5#C4$ng#;{>p*&@ z1Rn3-GyFhX!NVwLJ63e!=f?-;`8}};2|Jxv_KfhuZQ+L$3fxhO>(i)lzJfJvE3S*I z*|DM_vS!bUbrD$W3y}I~b#|Zy`d8C?J)7R@-t~2~44n(R?r8cbt6<%@(7IJ2ZzS{e zLj2EwMiG2LH~1s@PY14=kJL`=ZW)h%=wXe)zq1iumGY9x_Du{>0cCXO3X@)`p44AB z6l$KJXb8&|rdARpS+`C2qM)*LY3=klT!kmbTGgCperJOCVfql04kt~(eNl^Ii-Y6F z2eT`xV#7G_tX`NcudoqT#&*Lz;Yp_!Mkb#YEt+zAamg8HPMvnv+0$ptJZIMIb4%x! zEht~OXmQ04F05QqRb6vY?b29$+42=DFUFMwBS(!MGd3^(gb}#%)G#}Dx3zt&E!O{? z7CE8qleURU@Z?j*F>NUA@n-n^ojP~P?Aq;+?uQ;0$m-FvSMNTD_w9Ftl05RL{znfO z7#wuW;2}egJuZ9L@h6;k((n-sgS@woCQ*l;zu8GC}H!;eYEG^M-kc++r=6 z=*d}Y$)u+dD)um(lg`$X2^(7)rC5QKG`aZCex;f|CU?hqr!2RYOa_w$)7hh^?Oss~ zLump>o0;Imim&fvEt$M-VzgAk;1KKca_q_A9R90oS6fRaKQ=L1YL3C-u+rz{NR(3d zt(tp}wPaFeVzgAQ!C^Z2yhj+e=9hnXo3&(;XJWL}ZiB;Nsn5$%DyzbiM^DEB34Nv6 zqyE{JOl~ze-SOY&<(QS&QNMY3qqSsmhl$aCEj2jon)$pOkWuQv!e2aKEt#+_r8(3? zDf?)aGX_2{CA3jXCc`mVXmJ>RyHo(L)FFIgdjI;m4Qk1RQo}<^PB20~s2J391gWrL zd;Fd)W345Vzt}NCpJs4+;J?pXXV`x8=NWa@lF1o%jL=&Q4(D>5^^2Tz6T$5deYu^k zr7B--I=Z3{%@;1V*VDD!OlD2JMb0?&%)&^TOZu=89zrQoo7e?!GDVZg5N;&LF7C35 ziro1X_6zrveCp{5rew?y(6`s6z~1`mTuc4`oy_Hp z)oqCKtpNYlptAnWn8#r|D|1#UbACba_W*M^t0)W$TR|4)gi>}c??&?;1SYGOz&xxI z#M$dB->~-eKb(|h(#=`*#_JPZ;Q9bp-~z|?c7_Wa>-hyPaBLl`UEtXM{LlrC>GC6& zxSzSeF&@8lf#c%tV=i!9?tIAwj*t&r;Fxb2bkt_jm4ktJ-`5517~saZz_GZ`a)D#{ zD|dloJXX5EvE9Gg1&-mn%>|B0e6I^!Kj4~O;Mk|w;Q~j0KXrj)x^$!GHj^%Y*<1{C zfn$E;y1+4fY9F@caYz21@4`Joutx7N9l3X<3mntsXD)Dz#~)na*uFgJ0>|?AqD$Pn zE^y4Zy)JO{_YmD-1x=GK{aEggc7bDjk9UD%`H^1fS>^)A&uPL1 zj_LPP7dX0ij|&{#d)NhzV}_?(;F!)Yy1;RI^BosBt_h0HHT>5mU3p=?4b(f63}8AO zXO+jez%giZUEo*_R=B_s(%=F|fA4aMYjlBQ`Fq6$j^*V87dVbMKX-v+z4UYMkj|=qnhPA=D|3NkI^$+ zs|y_CaVQhfX42&^af4mpSnl&(;OO32X>cP#xglFnJeb_@EKb3B%(Z5{`}q;i?zYY{ zv&=2%SmNaw1YDDfa79>_14c|1QOTdy4(G6#K7I?DwSD zSEksnOtIgRV!trO{=*desuX)=iv5xl`?3`Kr78B`rr4LH*sD_PXyhD*Eg#!cubhWx z56&z17_ocd_2l8n`FpP?if2%$S$GZ>3S~j|3V1yz#j;nx>sbftM0tA?o+E_18&9^% zUfDJ>TByx<(si$AJD#TqwF}P)LhZ#fEL5f!+kAxL$^vJ85k62;gvtX|A{4jwPZeqw zsI!Gy3~HuOD?rT_Y8|Nag}MpUT%qm;HD9RppwI%skIkSK3$+~-auvK?ppc%R_JTso z4JtDOs}e%>1BKQNylhZtr$KScGIA7D6jYs1RECCH3f^K+Xn#Ph0EI6FsCA(5jRAEN zD13cD-3U#dP1nXL2VFfJ*X#z+6;<$jPQZl zBGfKW&j_^_)N?{*`qjlY2p_0z!pjErs!&uE`I=BsP&5R^T$LA7ovj0H*wn$Q&0ud0H0gNgef=CZ46 zJ@c!AHSzfb820$Wh2^!uSao%9>5|gQN>5qolJd&Riqc>^|CMH#py+QYN8k+?%Bq(v zfySO-Rdp=5G+t9vT^mCTxIb7}6;RYuzN8$nHJH^k<+Y`;it4I%ueqKe%q8*4SOvs_ z)eD^wbwp)B1%nQkC8*rgyVPUx%wUqav~)g_HMp?4Hn^~&W~rxK7C4LuNJ0cFt4pbv z2uWVXzl;<8AVq;uwk9P6s1c?iX4fa z`5tNSlsD=Dh0Qo<^wNq&2z$IricAnX^%hnvLNpc-ysW&oV&TfPZ>y^+R|c!A%9k#7 z)EUcpM_rO)8(WO1BPg*6svSnFyJjR?vwv{erv%-A!)LdA$G%pyhy0EHxc~x+J zZS{pnaB-)mwqhCf(o6YpR4w}pM_obN0R?R$z%Zgfdt#-FZ24*BtoBe<6pywVrAb?> zYoxYmD{EG1<)Z4^irC^MkU@hY?Fn*y$$T_9Xb@_v<5dfms&~fA6bXZCdTh2z47X8I z#c2b`9A1FjLRzp{()sD|LP`NujoAfjY8R&1t@KPErlqAQdy@9cYfEdSMUi@kmbZF2 z%FXiHYH4loVQ{v5>V+-&#gRh}v#%lI0h1B}bdGNMWd z<6inzfM+NC{(Aqk+pRqvXMjUv?dc$zhFG6Bh$llf<&B%69!rH$9q$BFVMxd^HvZ?( z#OLKYBVB$!cEWILPsbnvUu75K{&!4Jdphhp3k2hk$`mQ~RcT5$H(sjt zbl7(m2*x4R6e3~AY-td~*(;-qL6<070 zsYCF>=k1|hdt#sbVuRY#AyT6hTQCl(?jpq}&GC11zC!Kk5Gi(+VFcrlIuu;%C~?7E z=ijOJbcoa#5fV*A&fOV@iBy()?OD=4Fx%SGF?_6I3&!DBz#&yo`Z$89h}hC30E)++mB2CJl0;Sh{Nila+QnfA%c zW}c~z!73?LI0WO6I!dHi@@a}cXdb4H!HQIFj&KFzkm?Vtt2 z1p2(XY^3d(j4-)tB0zKFqD)k8-j624FT2);kmhkyA83$ zOO*}5IHZP(6w4<~+vK)kLoKP1s%!|xA$2UUmS6q)%|Aw6gdrgusmg|698$-Llur4U zCH_0qMHos-l?}l-q_Rayr^bm_wffXW7)nZ&4Z%31hKUqgSDLfu51ptk!cbDGYzW37 zbv&?E{krd_)3>RMFqD)k8-j62o#2pqB2xE`x(Gu_sj?v$ht!E8#deZr<`H`qsf#d_ zlqws7aY&s6tQEqQV@ABHF2Yb!s%!|xAvIj2bPMoKusNhI!cbDGYzW37HA19x8deM$ zv_V~jAyUS%LBTkrSZ1v6*Gc0}nw?{nC_|;FU>s5`Gd?d{SDG`=Dx0M)!ccyxvLP6U z6!}&w+B56cE7e69N=lUt!8oMIw@UBnFFn6fU4)^eRM`-WLyCN#mtT3BJO1s89TlrOa%HI9zA`B&^%7$PZQsi5H-T9Nzt?H5sC8f%SU>s89TYl9%5L1?GLI;E|ipNHw5F5It5s32XxJ|4NKG|7fMQ%4Z%31#)*_JQA>)B-ZIWAhoe>5 z5R5}=yhyQSpqX;Ze>SK~E|g!YYzW37#o1SDFY^t7pWdx5xlmH7YzW37HBqGc&?A@= zpF8s}>XHj3rOJk298v|qT0Om8S6owFV2hV38-j62g+=NJJZZ9ie&kMd$%XPul?}l- zq$UAt#p~zq4k%WaTqr43HU#64I#r~4(Ic3Lf7`u9U2-8(W7IcAFb=6gV68GAsd_w6 zXvJ%cDjR}vNJT`7V+xvU&O7735u21M8-j62O$OE)1yrs*chF>;lqws7aY&u!kZPHF z=Z{XaNvX0S7>88UAys}y+k&V~N|g=4IHZb1>To=1-gxPpE=4veRW=0UkeULlrIe}Z zzMH#Du}P`2AsC0$=^~~5iZ}eF_;j0;DjR}vNEM5e&gI0RXDlkVNvX0S7>87e!>^j- zcMmJEq{gbUAsC0$86w5r3(eBa$)RW1q*U1uj6>>7V6Csi?=LSn?o6AMDjR}vNKF-~ zEP4d<>Z!kbV5&_@l?}l-q^1Gu^Rh2TTHM9FM7Xp@!2*hRW=0UkeV)1x&_$X>(h&;+oV+45R5}=hQqI-MYZc@*rZh1 z5DakGMIukNdgSwF7`DHETI`=GboxtV$_yO;DH)ZcirwKk0PbWrC9edf_Gb^F9t@nC zm@BhhxKcxHw%1(f+E|L4LOi^Uf-~f}v84)^Wy(B`lTTyuP8w`xre^G){scq zwcm|<>@ler~>{FGICs)H;5=5i|R2m>Jm=;yc-6pRdZS_KH2x+r1voR{Usu z_$j>*Ayo*3tFAQURg>L~%;!JBrD&7q7dD8OMFx(}D);j3neX`={Ih{6p@%S;_$l`s zFweul`~sNiodqT{KMI$pDuiOoTIb&ljKT8MWle1yF)~M0H-pLW^hZ88jJXE~Cv%|* z@bGBjX=B4pcs-j0rTSrGC!S4%4hOc4?0@)0VG~E#eh~y-i9|s9{AbxhK8r}(BbM2 z3Xo3GhTjjV!)rN1h~wDnehmxs53JtH>KFbCpOHZE&T#&V>X0@LBNjJE@)$ua2^4-@ zvi7NxK;&cPEp{Ny3%C8fFtK1rc4F0#U=dU-Cz_y=0cTr_60Zmd2N=ui|H@4F#D+u@ z=MTv-;l&LlP(ZOy;Wao99HH?aSJh{Po>G1R`zV7bHXMOm{kHDR}PtgKCIBSB`-N+Z!xqmnEdm| zhrZS$!s|1|`F+vEC+6Gnh7?>XZitLB`9r}kPF#{zn2Zlm!G$J-+6(mYVcr8zud-31 zOqsoK-UwMyqAl8R$^FpZYQEiuw**q#vv<22Q;!U{infPxLJ8)Y&v}=b$PeqeR zg=9RtIC)7{>mk=fLT^Xgn)0{Ag2@@9qWRCoa!S^|9cu|ZH2u)~!|QqvDQf$hypQip zyn?ggy+b=voX8lqC9?M4vCLCSM#WDoOzdil zxBVlw4Fa)eOV+l69o-F;>GHkXAiFr4>`U;O;>3v}72MP=5q z&;k>qkB%-gIGu!`&% z^B`efB!wPoB{dvMMUYPJq?J&=H@*6FY|3CiRcVdm8CU8Mv^b`gK(Y+=ZchDxqOWlI z+?v|zB{g>4f4ugn#^fU>fGETE1?fCvAzt-_tsr)I*%>Fg+k=)G z{q?Up5j%R+n9*aTyUr7_lO;p<*Wsd1qs-bHDKi&Si0`DgK03$I9j=C-ehgKY;zz>* zD81p4qaD3m;;sZ{PbzM-G2udC7~;C2gR{~Y6qxRfYVU6YFkhtNQtnpjhm^}gNV1K- zIh$4$zOicJfS$q-HyM}<#wxps8|Azks0^=H0rR?nV|IvpA*Z@Gc8a^?!Cm}ln1O;D zHPVqTbnh5o)*3j=J?C9CbnjkZ9#3^IG}1BZU~{+Gzu!^ zd}q4EmASw%U20t7R=LEjbBVjb1&&>|+g#%Aa*4ao1&;0KgD!9k-+Gt0CtTt-y2Sm% z1+E9e_o7SOJ1%fN;ocsXxXh&h+f2Ip%kUlP5_f`2+&GuG5*Ike_X3wVY%X?~j^cZ{ zOWgG?aksm~J?H|*_-=HG+wKC#{C(dgZodm0+pF#|M>3~9Sx#I(m$)G=a2%%QxWKXh zGTH@>L%)eGaC9%~5_gtM-1#nWY}XdLz%d?6T;N!)mbt*O|G3Ttj)U^6T;gtUfnz*w zaf!Rb1&-mn&n5057dV#Z$6ex{c8Po01&-d@IQm=U0!R1GaEUv|C2pQeT!jl9>v^pU9P?wD z3mkXlT)lPiMz`s?g5v$CtTvTxWsL9iF?Zhj_Lf7OWYSOa7^c}%ki+8 zboGe1J}z;CT;fi0iOY9^WBVL&i7R%AJKF`0^A_j2z%hJtT;dkE#9inTSL*`D{>w@i zIF2tbcZs{+1&-sC+g;)wa)D#`HoL^V;u811OWb}JIL5d83OsBkU40{NfD0Vso8uA} zc8NR7C9cc`j`6@%V-C|%e6MhUV|;INiMz)Ij_ul`E^!-O;+}Vb%3mp67C%eQ= za)Dz!rntnN?E=T}o$nI2zy*%wzS1Rbg-hHT7dWQNH7;=M=iKZPcc%*+=Pl%#3H;Y4 zU3n(1$%T6i-?J`o%(s8Kz_C4e+a<2W1&-W zm$)1kIQl!m1&;ofxWt|30!M!lZ8^Fw#I z#NF=#C-WsPam_AqTU_E^aDijG>~MkOckp!=IJ)<)3mntseV4dTT;e`=iOcvQJhz#2 z?E%Br%>|C-zNZTu>(Nmza7@3TOWY6_IEF9V1&;lpkP95s!B zr(NLa-U}{pbZ@5%9P^{a1&;agsS6z4+wTHL_d4tS$e?M`wJ-es9_j)|fBU<@(Y@nb z;OO2M7dY1QunQd9t0EUT_S;Kb;Ie?5?Gjhv61UPNF5wb)vkM%@dH1-)J?0Yk50|*t zUEq2ld>^~S`7Z(3X3~}CK6u~PCGJF*xUfsyOcyxD_d=JrOI_gl!o6!<;_h~dd%`8| zWf!=?2;aY5;<7FU*k;n@FWnpI5;xNYj_t-u7dV!yOI+aS-gPc;{C@nz1&;pS>H^31 z{?9IO>|Z_R0>^p6Ctcv^@5?T5?03HA0(UrYZ@R$I-@Pty{eWw8funnUFT=xT(v?5D zH^2ps`8&oXZlX(E)Fp133moHnt_vLFTj~Nw_g1>V@w;E=0@ok7qzfF~yUPWR?)}LH zj`4lQ1&;OnT^Bgk-}hbMSYFy(;xg+1wwZM0l=Zwvoecz%xDlhAHxldw|EM}V>_(r4 z4$oBgnFe_gaWKj=sn3R}^Z*BdJr{U^0e zAGw#;7_>}DP9M4ZjHG`gt}Tvj4L#NRJnt`%n_%ZO4}e?GVlB`w$K!{=rcXHk|2zmc zp#%F3Q{lvKDHXn@Ae^I1Lmo>*4h|{fX8Xhzvpm%A_r_xN`!fP-w;|x+$5rtd4;n|Q z=j?7h(!4LYsD5L=qSXgjKmu!ii}$CtO`jlzYZCmRf+k15s&)-@%+#CK$I!rMAYJp!oCG>Ut zdJsi6&%C_&7)Yx^%UG&Hdp9V1#(ke^+giVNs?Chne~@joInS5{j0ew8M%yta+Q8lf zNPoMuRWZ@y1~?^EFW z6!<;`zE6SgQ{ej)_&x=`Pl4}K;QJK#J_Wu{f$vk``xN*-1-?&#?^EFW6!_LsU<6#k zZJ>BQk2zCyn`*A`f_T0lyc|%Yg_noti^7Y7qRlHBeP0sZJlIbW-eNpo7TyX_6NFcX z=QiP811c=MoABg4o46|!RH5+h$MY58HG<+4DsBzM^Ht$(2Q@`_JMr8hyxpKmgtr&Z ze+n-Xiw0ALmj&uI;RQjRExc?{{}NsvsF}hm0QI`?s3>r@@MeM9DZIs?&KF({s5gXH z2WqbH)`5CccsGHXFTC48y(PT+L6r+{J*c;Zw;2>u$txP2-x1zU@GcbIE>Q0ZZ!f4S z;d!v+@}BUrKwTufexP_esk*zB3J|=W9Pm_L=7CcATL6m3w$y#DDkZ0ar&4zoC~k)J zdgg&raa#<^h%YE^4NI32NF4(Jtw;R;Ig-6YwKNemls1JqL56|m_7Xoh0pVqX`doNLaa+ipqekoS5DKym#N#{lZ%e>JZ_r0Chlkb)dQn?;22Ev?92f z8PuV|yBn1M|6}h<;G-zgwV92m;=ysGzt;T~{!uc(L)!_q^}hRb4fcu=@RXfB*e{-_~!s z=jpeer>eU8?dt04i*4(HIm(j zSdbS;Vv~TzaI6ogH!G5X#tk#{%_b+cY40H#xo_4s;ybs({X7+hQO& zZmk5G&bHM+$1`s&P%+!q14+N64rmtJwgXAOWEarcY^w*7e#rr#xom3$l75L7x8Bf^ z9PKWU^h>l>x~Sb}`T;Y+DA@ zpVM0n^e48h0h0d9dY~G%Z2*$~%XT2@RiKRplKx9QP%Yc`0!ja+5oiV5Jh;h9`Y(w< z^yYZ@B+v<*Z$F@G*p>`b&+8EYx{hrjAUW<&0=j{1(|}H7Z5hzbY^ws2e$FzWHEdf6 zB>kKohYNH-VdPaMJ=*ufH zo&!Kq=0+gt8F>eBOg#I^ZEfv&nOcpgKYsI=@}IOWwC7%ko1g7 zflgst8Ibgh76YBiwq-!lGg=KaoNa4>q-V4qD2HtufTU-%9Vo=M9YE4Ess}oqZF_;F zhtdc%nr-x@7wH)#0-edWBp~S-^#dBmwqzjb83lkQvMmH8J)=oLe_-1*An6&E0ZnCF z6_Dh+7)W|X%YdeF>`EZ%8LbAAp3xehB92|FV>bZJWLq7O99MS$&1Ty!AUWpk1)9UQ z13&|$Eyg1%^V#MFl4DsC&;qvkfaExn3{=UsOrU|R4FOfLtpG@lDbs*1U|T7WwD(m& z7qe|K&>+^X1X{wj)j-mlTLUD$xwSw`Id;8{tpmD@ZQFsQH@6Gu&ups)lHS|_pyh09 z1d`sI7Y}~Wc`UpWNcv$(K+-q!0bR|p{eYx5mkD$&+X6t+n=1gio^6wWB$ZO2o7h$c zB)z%CK)14O8IbhmRs-G6wlzS~n_CZb7uz-fNpEgD5S?A4wFQ#iTs_eJY}*SY{j~!? z(uZpV`U}T;a7(AeCIUUgwj?0w&GiF%lx@jC(whqa(WfeKz6B(`xk*4zvTYiW^yaYJ z|2O=%2L4+E|E+=l*1&&j;J-ES-x~N|tAS^@Z-T)rPcru;(P8({wFkMzwV9C*Hb2KE z18rqnCQyp>TY+9=TLDli+ol1%!nRVNG`3X%z0S79K$6}vAjxAT(3>1f*C8b3H9(Tv zTA;T%c0G`!w*g44Df|=gk!6Kn%K4&s1=`?F9SN6V^;#TX4`5Yubj67ox-tef!eWcJx~Wm z8-Rv#Y#mTXwrvOM%xDMDFpk{?)Rk@ZK;0Sb1v-^u4*(s*wniYSaSuxAcoUG+B%Ogv z?e+tb`b!3qIt>6xtkXb{J) z##~CZ21rV^7AS>d*JCcF+5jY_sv{f6ZpU0owF5{>wF@YdW9u=OQtbtjQXL>0$2MXv zrJ}JGDHV-O4CB~DAjy}`FC||(R||41omor1RC39ewtP0n27tsjLO|j#1wf-Xb`p?y z$uuDGoKm3EIJOK({G|#=d}uLHKF2Nt63XozHvq}{ z)&a@-ZU>scu{(gI%)5Z3%=JK%Id(5lCMJx8VJ>BE1e(IJ9$XcZGJAof%!xpS9Ge6r zW%dC{nfn3F;Mim!$u|>7@(lo$aBK)j@+|<8d?x{wa_lr9$+r|p@+|{8hhwXNB;UnA zlJ7F0c^tbENZR%_K#P8PvUB$Nb+O`46*$07EaqM;=*%x*Jt!7)jw(SLy z{o?@8jU3wuB-`AJYjC%)EfGkzv=8Vuw)F#&?VAa7C))x*vQ-O!?qS;`Ao2TBp!?WX zrfpR~vM($KdVph>0m;6w8i?AM7|$9YX<63;J;JsP+ExeT9D9Hs=hz)U((cv+ZDiYC zZ94!Y?QD=mm}q0f|o*0Ew?n z0-|;?#xqUFmg?9tpqDwe3P^loF_8E{FlX!le@f$BZvDVG$V&+ z+7?RPO2y8HstKFUWst$jM+{~@Vlnf9#m)x?D<7^nGaojX`8Wn6AIDL zg{xJeT2~l6;IZR)mhP(5v9{TnD9$U)?h%v{5gyK z^wIk4oUt@=LZ-V=u|VUJB3CiX zNNK*2QdLE{@ZrQdXTpk4Sn&lrIm?2RGcBl`fpyNnI%i;&Gr6+Ljj@v(V<$HUOK#4B zWZD+W#u8D6u7T`H*Jj3^N~C?0lTfpp&JV zvhrbrnU7;I@^LIiK4h`-A%nR-RP!oNs(yvR11_)NnNyJRigXikS;!_C5aN_erx&5M z!h|1MD+LCWsn)8vq}+pv)8c=m;$Yek%Q%p&5iTc+n*w`_gc+T6wsfwIxva#S~ z1Su~_ZfeQNlHzDRC@tro)2kv&6(=~mcmR1TbvZ`ld)%c_*3!ZS)5}yOwyr_Nl0n6i zL8T4kQfbMh(vm|hnU17OraQ$UfFiSn>Wl#uenC+RP1H=1GZ92Hsi6KBCT~chh%yay zZZ6B`rg<>2jQ>IBf9&k^PdU;*$+E`=2aF8`{T`m>XQz4cv(sr3>zLevocwHmMzUuN zh!idV>HKfUatahpU;vtZfhj3yyhB0yQx^CtS@7prQU^FJ0j^b;u$tV|OinR%00GTS z_oq;*sRIZotHX484$I&G4svn_-?Xm@ZXp=5t7j zFQ1d@0u;sXIi~lU@o&ZNjDI`+o%na- zcg63He=q+1_&xC-#Q!z^!}$96kK#X$|0Moz@t?;3J^r)!z480vKaX#S-yi=){Fm`x z#UF_OI{usZZ{xp<|33a;{6FFw<9~?%G5)9cpW}at|24iTezA9n_fOtx?^17#_fqd= z-eumf_s`y1@8#a*-WA>}yeqv|dav?c?Y+jk%6qN%I`3-l_1+u2H+paK-t4`_d#iVi z_crhC-aEW^dhhby?Y+ml)_bq_KJWeBb>0WOfAK!(UGII!`>^*B@1x$wypMaI@NV#K z^gii*%KNnU8Sk^+=e+$-8dyMCBDHNOVy86bnK(BefTp^ z_A^xC8_cm({lSfmQK~y~;`90&D)9~GSgI2&)qr=lq@G}?#5b5@si;+sjiI9}g#ix@ zefva1CBDHNOLY>sZV3nN9MtI~LnXe!97{F8QazkMwEX}>CBDHNOEu6^)$F)=&_F{a zzQG(zHONx6{ib2$AXk+tzQG(zMRqxw19+BnSU)n^P>F9a$5N5qRULiZ?UVe5N_>Mk zmWu4LF`XzQgtLE$do#sQiEl8+Qjy(N^&Y-8Hq}sxZ!pJFk=-rfiEUe5kY=dFH<)9o z$nL7{>{rn#-B5{dFvn7n-Blg4=%i0G43+o>b1W6vUDe|HVLuHvRN@=Vu~cMtYh%Ha z$DWvJsKhszW2wmQs!opC^JA8)!bms;=2)sBtm??Ixas<$TXqdGRN@=Vu~a8ps?5T@ z51nkN#5b5@sZOy}H%+)|@F|8$e1kcbYN(}(d3|yJp@vF)gE^LJ7^{>YHat=O&@e+K zzQG(zMSVcG4sUP&(6mzxmG}m8ELFfNVa6C=+kl}G-(ZfV3RMkmTDxpZh!u~sekx+q@fbuV2-64#VR^8qTtMkmMYg$?U}rHQ?8*B-(ZfVI?Ymzz2KI$rx_~o4dz&?(^;jCmDRPY zEGD)9~GSgL$hsXe82|GYW*t_ovA6qsYFMzbo8WAOms ziif@(ZK%XIm}9BVV3pTV-SSv=|1%7g_y%(YpKm}99XSgMqJJ{dZ}P>F9a$5KtSRDVuNUpUcK4Hn;Ej-{H! zDpm8|+_CwS43+o>b1c@eSr!s$xs^ z`jAEKiVcZNcUOw!C zvkjH_26HUcIjmA8Jo}d)2b|-ovcxx-W2xp?s;Sfd&|!|D65n8srJ8H0-W-0?tht6t ze1kcbY96ap&5w%zX6-yfCBDHNOEsTW>bN}esy}XYpKm}9BRti1Z=@917;sKhsz zW2w%y)~o-|eHNW-sKhszW2qKcsz*yQW-TyO;v3AdROOcHC(neGaziD)!5m9fVX3Mc zug$J7RN@=Vu~e0os{MQQ11epWKbf6_IhN`?R;i=jq$fr#JkM0Ib1=tJEwof09cZ(6 zp{Zi$V2-7#vQ#e&96!6tRIzg~$5Jg~m1^hjC>}Ckk*Q+mV2-6a-%@@4VdKx|n<{n= z=2)r=tP=kD^z>6MFjedv%&}A#TB>gz`Tn#EO%*!_b1c(Z!pJFEwNM=U3SCi zOH38}26HUcpDfkn$uGY2CsW0~!5m9f%_`*^PaW^uS#7G=H<)9omRhQBZu+?OQd7mg z!5m9fW0kPWDfix5W2)FUm}99fwN&%A%-(mYsbb$?j-|THQk{_4xaBfa#lFEDOSQ~W zef0MpiN@?Fvn6|2d+CJ{X^du-o4ILv2QTPQmwXB#ZSNc z;%ZaHzQG(zb-kq;+jHUP*PAN#4dz&?8!XkH*qG`YOcnbEb1c=3tU3&H3eyv}rQc|( z*f*GCscr(-9Zk*H(K!AlQ^mf)97}bxrMf@&^V4rOR5CEi97}Zzt2$v$;l}GaU3QD9 zV&7nnrMeYdcl_|plXgtF)l{)>Fvn7@VO2-WDcrR4w9+-EihW}ZV(jb7w~>Xf(F1sn zICx6TZKjHSgE>}Sw_B?F?kPTayQyN|V2-7_!%__%cHZ7QOcnbEb1c=JtWtGYz0-T~ zou-O?gE^M!E=%>&{FffQ%T%#%Fvn8eZI#e-$2%|IZK~Kem}9B#u~b(qS#$e6hDruT znPaKeTB;M5z1L^0sbb$?j-|TSQa#>r`;dE075fHrEY*FiQgzsUcgf%GGga&x%&}DW zTdJ`$?n%GjRIzU`$5O4cO1R|m(r)Wa75fHrEY$;+s>5H7EqlOJv2QTPQvHQh?J=iN zKXlfXznCia4dz&?2f=l(sMZeoAmu?*#lFEDOSRrowZ8Y*{Pm`aeSLFIO#+<`H z_6Hs^R5CEi982{u$gwf1Wt-UkgPsqYD)tTLSgJ=@)mC!yJaXFBwvU)9_6_D(sz)u= zz_)gGe$-U4Z!pJFJ!Yx8jjkB{n5kmlV2-7F+)`aTr`1`Hn=1AV=2)sHSf!53J&)jQ&uGsOssbb$?j-}dcslMMc`G(D=ihYAQ zmTC*DRLws%;oUV`OcnbEb1c;htU4TX3hy_qd+-HAB?F_(u~b{Zb;q$s&V2Tvt)_~7 zgE^LJ8>>1{MhNFl9XolOsbb$?j-}cTt~-vM`S&ZAZ8ufy8_cm(FS1Il*RQ)ve|phW zv2QTPQoY0~wWplyIXd`~sbb$?j-`5;RjTc+DY^FfmrWJ>26HUcE0*f?Z;yK86;s8& z!5mBVDy!61?(tyStbw|Hus@OM}W2s)ZRBtVN?dsPJl?;qB z$5QQJRRZP|-dT6u-W{fjeSJ4z+t(;Vv{M;L+ihYAQmg-GQbw<;e>JFnRPR_N zocM8l?K`H5eSRnbTKg>DqrcUpgD)tTLSgKvDQXX~g!)@;0WvbXWm}9ASTdMsh zc7ANPt4fh^QRY~x_bk=>k3V|td!~wggE^M!eM>d&n&+F|H&yH#%&}B^Sf!4YJ#ycj zxyMwoZ!pJFeZZ=Am{VxKd*~w{m@4)S=2)t~g6m#)Nd0r_bAL5e>>JFnR3EZRwKl>JFnR3BNYhJ$CPe`KoIH<)9oKDJcFJCC07v8iI; zV2-8wgjK5Mum5s+@+XE$#zmQ9ss6?))%)82m(vpdW~$gXm}99vwemW6=YxOx)Ksx= zFvn8;-CD0(&+a_@@1}}k%qjG^c~sv6riy)oIhN{caNR!k-;35w{n}KqZ!pJFePgNa8S_N; zH>QexgE^M!TUM!~`G*JAJ@l=qV&7nnrTUIlYAav3V|?g4Q^mf)982{*t5kcqalq5N zzBg6u8_cm(2QAf2oBG!tG*#>y%&}DeV3leCzHS^o<{ySi#zmQ9sT!@kZhWlZ=|)q< zzQG(z^@Eky!OKrB`N34NZ!pJF{m81rF{d!(o40TK(NwW-Fvn8;1g?9Q{mA3h1Aj7A z>>JFnR6nyy4dz&?7*;9oefzr5XE9`Q zR5C8g981-TRmyt@^=>t+m8oLiV2-7tC&t`y?BU&Ke->-1*f*GCspyj-ZXe*s`j3al znJV@T=2)uMR$kZb4&T_?RIzU`$5ORnmFmHc`rvJU8&k!;!5m9Puf{e?c+aOh;!PF% z26HTx*UBq!@47Z#Q^mf)97}bWmDewC-SpXEriy)oIhKk(r{cDvt-k#6fwrcKeSdbP|3I`b1YSRR<(x@QJA%D{igP&ihYAQmWn>^5*w2!BG0S6=2snV zs@OM}W2rh=s+T5oIirKAV&7nnrAn|=7uRLKnqaEfH<)9o5-rvJv3EX{XsXyZm}99r zTB-?u-rcvOsbb$?j-~3vs!mRAyt(V=`JGG^`v!9?6@B=|z3%Y#x|&Hxm@4)S=2)uE zmTLNtci-!5s@OM}W2ug`RFD2J`0gVOm5hrr$5PQ}cw%FYaMtVC&))KNF;(mv%&}Bm zEmgOx@9WytRIzU`$5Qc=l`%&;d3|@>-1C!675j!feQ7?gM;`@>)v9mDbk6T)s@OM} zW98M|QjOX&^7ZbfihYAQmg*==byfV`j~r#H*f*GCsp!K*ZXG_*x^dOfriy)oIhN`e zOI5WsY2PuXihYAQmg-nmb#>}6Dfye*k2O{78_cm(^f7?g7^UiwUAwA>p^|Y?=2$A9 zrMmyk-CcdAihYAQma3)7eSNr-Z7W?hz zHVi$^RIzU`$5I{7Dz&GqxbD~i$D1nl4dz&?epX)Bthl33KU2lN!5mA~pH-^A@xv2& z3;P=?85d=ar8>bX;X7S_{_zA;#lFEDOLZcvRKNGx6&vbLG*#>y%&}A_u}Yn%Tr)R6 z=_FIdzQG(zHGowe9gjLPt~zdjsbb$?j-?uCmGIb8k~$AGRqPwgu~dUtrOps1e6sfS zL8gj*gE^KenN?k!61F?4XjZbRV&7nnrSe-PENr;ykA73dzQG(zmBOkdC$EL*yzcdV`$U?lV&7nnrAlX&^27J$Z@eMh zRIzU`$5Lfjst=B;dmzJ9v2QTPQVq6LvzK2rXt1eb-(ZfV%CuBZk6th~(^RoA_^7#-`#lFEDOLel9SJq3DuR7UOv2QTPQk}vo zb?$K1y>H)mim77XV2-64%BrKCtz7cm>9-DbRjD#A${b5I%*t!>2kX`iGga&x%&}Cb zT6x8fd#dfJriy)oIhHEGDpiN41+H8aFjedu%&}BKR;d=-pYr9aK~u%P!5m99oK>pD zp8M4k@xx6O`v!9?)d*H8pRc_9o^MB(D)tTLSgLGGwWIK-%xqJ|zQG(zmBT94igp;* z`q>;)#lFED-lBJbO<^Rf>KWt1fn&OKCyU1um{~HtVxVm0CY<`lGK0pLRA}XyQC>2A zK~bqP;GGXR@hzHLrVY+pAeOg^w1ibtiU^53UhP2I(khCR=O*K*&QP0Ct7@d6%#@T3 zild^JrK%vDFQf9hEUG*+qBvD55&TO!JB-Z4LZ7};K`al;9~%We8kO?ssNDNUai*wb z@h|CAMCC=Vyj4Lsoz)`##Zn@FY!`T88ODi(V0n+nRphj%tgI)90(!>6Jw??-K~Zc&!MM_KwrS*Ax>4v)%fLKLS}6zAJ0 zj^DD7x8N0QYSmFc182^jQ{pWDiax-sn3D6#3g_WqCm7IVIEQRhD_g;$%v_5-~VAl0l_U`SCkHm4Py}40vs;7|tlj89jDvUg7L{vnvYu zjezs5WauTlW-8_~C1NepYDVzQW#ZGayJ{nH3qm<#3XA6#PMT)d!s_ADd4StS*PQb98o(PoW^lB#l|C`G)TwUFKu+d_#7%jYks zC@F5fV0NTcJ{9F;QB_DUO;!0RJY%M1Mltj3 zZ&#+Kq8z10$}x57>VQni6rR7I*4Rm(bUT2W=>6pHkk(Q9pK zC3#KMf?5-`>?VXYQAV{UYFU$LO$GW2l#x>47fw_8 zRgty9mC#O3@1<5W_Aq78G|Q?BX9?L~qJ);!CMDkcBd7s#6$c zXU}(Os&<-FI;GJ{emg0b1IO7^+U3*&-Vmx6)$6MZ_3NvtvPgl~lPXxK7MzODkSJ;v zX3lUHoQg9n(llrSy>1)3v|cuA+DU`=T}?nC=q;?e5XJ(pfg6WKm!=k+vidp3+&XN~ z6^{C%Lb)`x1#FsSHH+>F)dsMImK85krMeZ3elaZz&{-_R1!!7ZwM{&9$S<2wGO%di z{26Bt^7)c|ZV)W7hnrMdr=wH*8oI;X zoKYMa5M$op3?5QZygQMOAEPgCJ9o2m*F3!P-3W7mcjJ2ZNaxBcbtom@Odi-#)XnJN z{sEk0I*ElY?=mknjR(;bkG>VN3Y<00*c2tpyo?NsM*~9vH5ToNB|W=d4o87b18<@; zu12?QFwZ~OO0NLr+YL^CT2TaA?LcBdz`V3acIt;d=5T14LLf0QFeuG=AAy+oHK|WW z@I2l`Ylw@eHzD6T@TNE;le0Lzkp zC}#Vxruw|)Lz6+?_ZVh5H3t)xUP{vHUk^)IdZVDW2{kuD2_n_yzRNKK_QAAovEa4% zYgh>5E&}rastA+-Od~J_AVgp+z)AwA0n`x)0vsTa2|#x(Gzq0e63E8`0j60AKVuKI_jidkF(q3|aD&kb)4 z)zl>{y#sVGyu>)uVj#LQ*nEDsLA0+Lvrza4N3+?*wc|@ewfWP+ zD6BD1sig}RNu;%mPYU|#7+!`oz{4a75!Usat zTQdJxcvkSNVByrw%?qfal)%~S+2LV$805~lKfZl=4G(rtRB@)2y(9l&anRyPJ09HVLp8JQa+3|_-X#mp^AkK3U<}~IK=eZ7Z8hMKI&`vMAVS`4au*qe2Jp(A6d2@g= z82t%|dJl1)8#HBuS8p1Xjxuu3K&a)awO0@>) z6t>aFN$FS;=XqN5-qGkwAW4Nj*gA}PKA=+>4biOC7Sk{{k0ek(Wp zD*SCbV$>F-CZrh2glh_z|IBvep^iH^)NH^a?}q5%GAb@}8yUo(l zza!1;+L|3mG>7)bXRu7I7nW<6*I}Mpv?Ua-$potYAtqr3ebKO%%MgA(6ke5##ikd- z%LDj-3U!Y|ZwXxev3lUV@MBc|PY#7xBRjag-5+%U4knI?_vJr}Vxt_uy|NF=mB|o}uhfsUWHS zzxHM-eJK2l4}a(|teA+x*WOITVEBXJl27ZKnl1^3_XL;xt&tFWc|+HP9@!u?ZLO`L zY6@m;O;~y%grVgZtw%MZY_x@R*>2)2VCJep?pQObJWV*=A=rga7b~-Bx$3GLz2%4b z>-JrR)Mu`&ZuFJM`Cn|9=&zIVBqYYg2NM$W;u8}lE^SSlAz|X>tq)FVsbc6%gnx{>^V)F^I~~h!mr8gvQOlS%d2H~6z3H;m7Pd3O{f|B zOHRk7(Ni}ze@_2P;(Zxq)zR=SwY}1Ij{yo`iu26JTv}&3xCPmkgyIfoM4j>x zjK*tp4iI(_XfFWDVYCuxB%`l^MB51^5iKI)U4ctM`ZKL@JOSel0J&jaul}vTH9Y%dRb{ z%By`~F*4+;&I`}!lSxNa>E>sLFYM#P@izP(8k?YV=tc)UWYs+#6i0E9Ct*&9Q?oD1 zJ<;m@0nVQLpwugtKIl%M+}a>Iif9|R(L(t3Q24Fv@HVH9*{J)NjbRb7^vx{4{1T7lO*j6Kb{ zw8=vUmurfJ?**OS7|u-_`l{oV-LF~zp-PP|~9;w_+D zOmUv?F{h!MIM318XQY2ZcTS$hw#nM|q()J`yJY`rkX0W8Cn`DNt-0ZML*bWs(_^z% z3{d?`>emL`HT;`dg|zGMqcXM-Urq71QdTtwD=w)XmRNZ{Iifz{@v<}i4LxD6>5P|? z0==Fl_-rDb^5CgEgsjHOOCU~SuX}+wj;k(T_RCLAP1QfNTX;!mdF##;Q`CN0C}z{J zrjItZ#xA_?CfHgiqv;0O;d-0^QQcU(qf$0(Qz*x8)x!l)?4!Fpm#_TfXO!f}xP`}T zM82rv)|jI>omYlpo*&lq@y0vQk~Jg_y#v;S8k%nmU?$bB_Ac6Y$s2HnRh<==P;)(S zZg@+G_G>v)Ow6wB7pfgCJ0<8Vt|t2O{JKy$uTLi07>w_rBaeXvG&VorR30Zyi8;=x z7$r{|rM89~jRqg|UW*<-lGyEkQyq11n%OY5g|()Ryt!vsRdO*!8heHnX`Y-)spafL zpUae^gMd12_;{n2Hs1$W+}M`TTZHHiqkS(DiYN3Op~DD0M(B3b@V@&Ats!(9q1y;u z2ShvA>6qg91R#&mJ(%Y++KjoJkn91H9rR0}?i|}!?@$*3iR}&`*=g?wl5vLjfh3i7 z$W~f!`mmGi$kzkOPJ0*7shsiyK%*J)t{Mt|I(2h1J1uqT)lQ3czhW-6`IWPr_P*jQ z?84ZQaVDPZxJf_kU;g*8d-Zd7uZsD`Si)R(JRVE9WR}{@{`WWbMo!KcS_$C3Sy-i( zqg4|e-i5t~3fcVLvt33GLbcDVr4^}NzJ~wM?w5LNlei=yxNZO*u|xbgyH7G7RVZte zfV%1M<^1s8pmXv|uDr@k%uM5=L`p0Z?(L?5YHlu#igR>N`)z6u@ML ztFS;jUcfX0Q$t8QZUB=RuE9cIOaapfOx`mCQvj10Zo@)z)}4w zseS^O%#etM!!gBp`e_uDYvrpGXC#PkfNO_*N5^dhELF};E5ZA`l{eSqmBOrK)fhv^GUUt{_n(+`+_ z!4!k-*c#Jem=4E8H>w?psT(G`X|^XO8e-^=iEhF4V@k)Ag=r|J-KfN!m}r>kB}}x# zQ2Rd_aZ@o($5eu8Hm13l&c#%TX%VK2FfG9pgeHvt<(RI-vBW*#vpDt-VI%S`yn?qa=-v*2t$(AC1TvMN2!Epk$4x;SpP=MyF^L(1><^;e|BH z)2KkBaT<}si(-mK(=;m9s8pjl8kK2Op;47a7izRvqoo=x)97-IR%&#OMyoZtNuxCy z-Ko)9jn-+jUZY1f+MvlHl&Dc>ji><<9-XuZ@@Yh4{$ittxdhSUPlBk)5|pM94KRr9 z6paEJ(W3$qOO2eMJdFx88mG}DjizWcO`~FsN;R6JQJF>+8dYg@p+<`}TB^}9jV{+{ zrAF6iv|6LPfv(0Bi`Ic!D{8?!Sf(4PY4DRqrD&vb5~eAbreUI%?h{NjctWiog|3*S zB@yJ+w)Pq&YSdYyB#n;N$fr>sjrwVHl19lIrD>F@(J2}QG&1jp}oc}nF&x2b=jSq1qASO2E zCJ?EccI}lz+Qo6Fh6HrIk^*&dVq@qY3#z|e<$XVHty6BVIg~O7r)cEEu`zVV1)X<=Fujw%U#y=jWRe#hRQkgYI+}N0G%sXP*v3mGxhv^zyXdKP995o^oxIwy>TtwUcjvZ`bN<>+tAd)NRQH2Jfz~)ShFXXYKo@;~ z%LDDT>R}=vFvnU8%E5i<#0R&HTz5FD%nz_KhxMO3xl<0YG303!CO^A&C|Nu$JcvX+ zBozeyq!#fnmW(J)Ps@UbmFASpb7c~FvukkDp`Mir0vnw&lT|F#%Tht$oi{-hf+^IcOK{#~BiV9+(3n(fG{9}}*k0Rh-B0q_;&>64_!l6r$ zDu_jGMY4+JNcm%$z~xaTd{ZUDs<|a|i^^2v!WQQyJinqzI&}R?1%Y(jQ9&%{M{%B3 z1pG_nT~Vr!qg1n_EcaQK=5LtiyXSO%)L#ze2S*f+7&ob~Xg*ev)+?LujnAdK%1f%) zGJ@}nR~A;N1y?X~_PptHlmhpAQ=0Qi7P=YGed@;T+6BXN3f+V~!Lg(Lg}I~0<&45z z<+vH#lQU*aVOb^0uwcRb1D8DdZ1t7pKgo4Z@juWI<={EIWA{S<#l~?L^MqlD%+jDCqaJ<-1T(5_KD@+;i&V zAXw)5F4U~#6p5v~Q0W+sBOjWjUe11K_M{wB)SvI)au@30EHk4?XmzOHz0PSz=(xyt zTc-HUX4ONZvUJ15+n6X&3rjq+_ds@9(_b78EmNSoEt})fwE#2lU73SZOjGk1cV+T; z?1YK91#BfaY8W;|m)G+8_~>eBzL&?%)o3VSRdS=W7NH&%g3*0W`j=^!c3iNN)w+?hd91*rVFFfF_*KF@j!IO5$D;6c{fIX)#w0_jKfo3hosV!T*Kbdch#Wv-2qHWfnx7jGVo>~zM)doTY0`AtS zJS({2Dx}hoqSn9VjnI%1+(7l+&?dNn)?O*x8f(6;s<$LlMbRnPv6$jK#hA-VtkCFM zAQ^|PoOjN=`3vWH#!W8B8QQm8ni<4Wz&fML$JcYp+Sg)ZXm_Vw{Lfuh z{NSEK(Z-}8r%;4;(F{ROk7(y7eaZHI8Sd#3ZFmZ;Jw9|{%pF`#kGvA?DF`lqSWb`3 z4mfixm7E?a)lSds&2oCgZ?khcUCiNhLr&_%x9d<+X#V{HUpOlIlNOJ6C&wz5E220P zqAWwAEZd_jX6q&?-x$Ryjk5HLvXGOi(9$!JWqfE-tX}|hABfH}s3S{9@PgBGCUgIc z4y~Dm1!Hn26p|@-^vE;V9?}1b>OgP;<#=kZVo{lNBiJIx`)1PQ2=hSS(g9q$T~bCA zErpWx%ucB&4tAX1lT?Ko+VbzB%14bQ|C$W5ZAROLVw zg96h~Um_*?J3;{5VuMe5Dle|>U{0lr@%S*OjTYl+*P&x)(~Xc}M4LqxxEl9m8FK4n zw`)>ozjf$rvLwUpwtOv!@~Atu;b>|1X)jVwn!D}3YO|!>Cl?{rZ8zro1KX{!BWzBmzRb&Wk!D6sVPt zjUlI_GHfpC@tq8dVV$sEFd;C9QD2^`VKKFqGpF8kjqLEzM~nRIv_d-Hb%f5*BA^!W zFWZAUH!3vOIy=pgqTqiPCTZ@BlVe#~%2dtW}}SMAEf&rD9~Yx`;GSFuY9A@SKthD`evG!YGuoJ#*IPbnn<2M)#?z^q4`m8 zes*|tnCAZA;0z!)P}9?$BF*p{`hyej@N7RCA@GH2&qd!(ZuP==z|o=Vty9!;c$2>l z&jqfk!!5}DaN3S%P6g0_hV&qh2QvDL@>s5$ka**+p1wb_Q!Ss7V0OT!(;6JZRdxKLt@|fnjv=qIDW(X}c<=KcM zha41|o9PZ^&^1j8ZkP5CVsN^&bQ2$`mR`Q;68B2)G|f?6+Fp)Dy0oLQM5^Guw}0kd z>FuXEN_ClIp#!knrENWB{!Q+cUK(1Wz#K+-JpX-N+UA;a+6h#k(t7wNH`{W7TExF_ z%yT-i1T9YVl_>6y@{1qTQQ!e6q^(x3gy7d2d1%C4jyVyrs*|h^4oqyhzpPW$9cO*O zU}a<{T3$;*M@{PpA}_0GJGXFN<(xTghx(r$NBsWO$m7UBR28)d6#f^FBT@io{#%bD zbh<{z5i{^{B;6jTARgTnV+Q7>s?$V?A>L!n@glAOguvSZUVCvfcU&ROI^6Jy?g?dp+2X|Y{ZX}o>qs^<-HeCUsKs`VAevm^A z6*Sk@Nn61Q@oXaI(yACI{c@_#?TQmAE!-ha{+%;^RdlpU@&+B%F8$M1DJ3JScl#eP z+UZY8acfHk&i+TEoe`}F4N5gT+9}^c(pl5du-Va0f3j6R@~vh^JJU0DS_EjH`i~jy ztVCfJVxsZS-xC5Lml}fqye8~?r*wyE!WL_e&*{Vvo5JrK?W9dl;rESpQdgaVG-2ds zbkO-{qn$HJg22s_Zo)44$B@x(*Kn>-jIQAj$MV~oFcPR{m9QK~#}jmdSWZxj_-}r+ zQ#D75NF7(B;Tw}%kdvS7&qy{qc+%>*Q7w1roSvLZwfk`TZDMvOPMbYwFX`1|s&hH#HAuu81 zUW(N{Bi;;f%A3(D*9XK5%}DzKGi2jcw$oKxv4 zEP~E=uzY+YSFN=Gjr!_4Wmah%2|_nz_zYVKc0hsb6Z;ixqdC9oJ0C z)T3=lU3G}Kf1dK9L#V08*;1}FTxP^IQ|1e8hPB2Q9U|_Zr+o1t)R!D0Zm}KLOqrM1 z46Dq4Iz(Kx9oJ0COPLYCJcy|?CNHMn8Ui4ax2r&BCo~i;_hR@M(Y!Y!dgH^bm}tlS zy}6J#sX)0Lhe>kj&&Y@QNsQJY2YRIxS^lTF4B`}%Fi&CR!<_m|G5k30&B!GgOTQK3&yDWyf z9+L{RE~jCVT=E(DFfU+4@2Y5pi7fxqbs5Vk(sr4^$cOo4M#uPiAJ_k+K`H5(Cl3o| zk2)>CVC;m+QwnF4l%6xsJYk3d+rGz#EI42K7v2YS7ah3}u+q(5G@&slej77$)S2-- zMJrC7y%<~NJ|0)2IZ73BEYt_FRqms2qcumVRBJ&!4f#eZ)gj$Wh_f7&HX)T+Kt2@`c*gPyUZPk%l)j@MqUh09=F07)KhgO2Nau=lC)~H<|tLJlY2K-nI-I|RrLN)3f*)Gscoh}m&WY8x@#4+u@t&%6}_I3 z!cmxP)lpid9>F|HtLPh)6zDi(Z{?%4DpPaRdQpv2pnip&*D+c}DN;B_=XJnI=U7;6 z)v;Q2P;*pX-*YO?`(0wpI_#lUKWUCq^>f-EALkXKIi~c<&lmbwMQyyg*ufmc$_qH? zzb7X5(sTdf1?zh1yc(T)W)6`(Pdb)fmTK-tXRhg`Rhvu>tLhy~Z%cK8f6^DdwTfO} zN`X0yx;pFC2TN`Vr`>;Rn?72l9-d|nt6Dj#zLu)zyG=2DwTfOcLV-DqUUqV)ew~|F z$(TKdAE#AsnjBWW=4`>^S*5(-wW@ZXkOlpwX1`>(i{oS_N&dx2nQQ_#J1M)CI)Y9R z&f+MQy78N661iGQw1r;ise*9sREzi*%bKW^Yok=JM5!K+;;fJ2tcXf^b(CsZlxkj- zYObYf?lPPV_PR+uift~V(TJhXSr}L2U~xVQ5@E%MKO!vn3P*&+`4~qtRyzm3FmV5Y z$}5*{GR88MMq$cPVU@C4ro0uVIEAfSCY-f%E+LlL(V4M>FOK zli!gVD>;(y<#yImFHpvML8Y$^R0h33v3kLOh?@hQHFqu)=xxoZqlP2xRD?(yWgKZ! zrEAU}Y4a!y+$EK+ZE=_U5w|!xt4H^!@S85o&1xBG#ViA@m1R&_M;R>x zA2g&Iol^xkspcY&qXs z!FfEAmy&FaHB-KI;Jg{h%d!)seD{F!T_g`4X@;&?_!XQZ>8uw)*KXY zi8O0zY&{ck#+a))woU_DEkw~7a0^jEI|{>{Pg37bo*<)h#GELC`)t}sJFb~A&rvpm zlJ~*%Z%jV<-Xx@OyG8Z6=rFV3T!;9CoJGAJ6xB0>3ktP&2u-JnY=L zYj$J1oB8h^(!7l_LBNV4FFKl$!F{w53!Zy4M-9ha;8>_pv{mkq<`T_Osuhlf znlxMG4r$VR;V886DAl8mg&HqgmP+#&NN z08-H#zogsn4_ZW!Ax%0)5SNA--673ih=6dIRxJ~QM}{=%NJT0dN^*xZ)jj8JwTfz- zf(&V@68b;bk4vhgr=W)8+#$`ECE}1nnr~>1TCcMl%b|uei#127XiX@{kfti(?kU61 zcZW1-IEI2dr1_B;_!cO8pvE22{7iFHUgeI3+828$$sN+9ONbQQAx+f_CBJpIa&ULM z%iST(0@l#5r^>6FQ@yl(?Gm~}nreu(lUA*D(mB+S=3g{N<)z*sM{TA%4D#W;H;#6P zG^aS_VGgG-$g#+fCbcN!pU*C-^tnTt877BS!yStZX)4vszphMlhcwloB6Cd9Z-;SOoeH#y9HhUaQXleQX#rU3(-2c|~F(is)UMx;EG&%O;KB^_m?w8hAY zN5xa>j?sEAgpn?dVN}YQu3@FzqOFvjW99s!8I+;2>XTimE9(?hsw%=n$w!zdJu>ld zh;!~L--L}YMV-5X6?yiWT8QNM+;sM=^GX(|v(tZe|8;6sdYX>|-A~w_9U=uyH+5er za7hHVIRCetn?~Fh)EBvb2OsSw4$iGRpPTya`w8i76urS&F9#!T{h62ISF6P9LFskI z;UmjAgwQU;yohsCI!ccK=UF;TBhXPz&WSU!*x=0G!haGD$_;d2MxbORJ^Q|;n_xcz zhhcR;93?Bf3?Mh`1f);NKjsx1B`Z9aLx@yggL6C;48dIw`@SHu`yCDwX{OIz)Vq!H z@G5)t-l4t3z{82jQ#aEU4LZced7?fPnjd~Wk3SR|3crRgP|(*mD!a?qUHorK5@F|? z979otP|f?5si9g=Z6L0?KCTi^HI9#Szx8tQh}!%(M!^Zfw;KJllc+K_tXb8P{^9PV8W`c4ZW~dtC5DMqCM8i3$U**l6R84 zhB+Pp;D#pAwBf5mvhtc(zAH(Q*%*pfPJl|n{93whPAI~Tc zs2`&RK>ZoXD@!8%1JSawk^aGS_hYhE^h{|Py#=i{H)&fA?G&io7_N!wp_(@nmR=4E zK1_kH*zuZTd*cmYv{mT3p*+;;Q~|yp#_H3_3GlA1X-snJrE9jF!p{9CzQ<*%2+i)&Dms^|Q6twExQ0*B>_=+BVUxk$Tu%vvnL9)4ZYeN8j zk1s6d#Hl1utUjcwB@=y?1z%c`)p8QOxHW&MOY!*=M!GbpvxYBD!5W`{2|Fp~Co-Zf zPrdj!&)1j_VDu~I0~yhK&&Y@3JZV75jK*qPF_52a&NIUFbzt>?b1*5dHZi~U2J+ba zn)fT((NoOyka2F)Csgf&@R%|x1@DY2z-NQl^2xPLov3Mj)ve%b%C*UyBI!Za*#peH3Y14((?6l3`_|`oIT&GV?uWohyc7 zYp=)F?xUiE;cW`$)HKnSKOI}XkJ|FSXM7Rq0_;O0~;&=kkt>W~dS z2FtP`rvjyM>_wQ2S4XCu6bi!Ns%>3Z;YNOUHCXTgT3;)Np zkaDP6Xw9_{Q6fA%->`oiiXvO`93ZKW^MIs2{tP7bu?k4)<1rwkKH$~zVn5ZayD!`e zZg>b>z4y|i`ZyZWP9}}$F=p=wy9@gMnCT!3|H_-EzIW25hBOwJj^%j&`NC&P+?VI6 zOY!a#=XA8A&>B;04E2!O0wp)Sy2Tx7*gymX_lfiO#DGx*Gp|`bbbZ?=NNA^#QE3knTw1QJ9(S+1ToW@ zp7WMsdfl~pTXpmsuf;Obe5EzN-B7*M+DM4raZQUHFWH-C-o^9ro@F{M6r*OsIM3u! zgjrU;mhYa7O4L}0IKqB8qfweUC9|d%Eh?nfU&}kP)#}19ud>W7DXmE{491JFt+GW` zA?0n$i|{(hD4NtX*IZN_CE>(a!v;?In|~iQMK=2mYP~`D&5}kP=w)WGwq)k?$~hH< z#r$e>dhs{j4Ou?dxRCrC-VK@NoY1@P0{YK*S~{7!iaJn->O$;qbgZF3f6bk}c7nb6 zcSBky*LdN`(Y$L3jN1CExjE>8ZTnkOaD`nv}h+Q?=2 zTmT(De)9-saz=(bf=RtPJUWi;q^glqXKTwd-@oI{_G$Lr2y~)(C%h)s>Alb&w}}{n zHA^-H3tbUe9?A3DjT7~3F9V0}oS{IwG^dwh-{q1G`_+p2G{tVU4CAo*jd>X)+ zN_z$Zxu2wm`>TvV={*6CdV*P}mzqApV$SGHIr)JbIRHtTgcBs$JXuL9xpRhTakv)j@ugQ|%tLB^y9@AWYbe%~Ze8Qc^LTMwBlCGY zGGWEjtk|tTL6ETYKC;y2Oye;Ml#Rb-fDtlRMWdMeszE~<`!2=5jCwX)tTvt>pXPx{V=?*4M784=DPvu=+lQ&qp=LhUyn=$$15+B(N=t~8(*APUdG?;R<8<7So$^e zI$KmAwj{QGgqOVzQg-b#i}9CNJGTl$R0+4#<=1?XaLp#!rru2nHS7==#Z*3w#Ncc4 zrD@l#mytujW6LVqhM!ksUU}h)K0ffHJ|~SznUE9y6`yvVxpH*vDW9pdPp{4U)I$wL zUY^lPgg4PBYQE#S!^3fRW9WTMZqt_htiM;*)z(n?>Fe;Z$V$9`2TZ2~r-~maKWfQ| zhHs0z8%e;Ac?9lh8aNQY84J`GQ=I2=%#UMqE9Nqc{sd4zw(Y=Nc(l#?vyGmak@n&& z?JY9E>JG2|-}=Z2oCEoYQ|c~$>BmiRR3k1pE5RL}y3$cmKaSGGL-;&b{Wv-p(gEh|8++KusqXO9H$*^iZ-k)+l!6yiYz!SJ>EQU`&#$(1ho@+Npg=dmNC`dQ zQILL|nU^~})kbras>HFhh0@+$WbypwA){BAEi)<4*-;kqR276nquwgC@{Ac9l^sOhh=gccwu&AtphCTFnO-Yo=VR3Ibf~IX$r)8Bh z@ENee5=oS+8K00k4cnLbBGU?PfKf=^*Ye6vh{cY_8b z_^V@XI+V22b=UVGP}*XPs1N$e27S~b`nz8(e-VsgTKfK%F4*)1MQK#o^XC@MsGMo6 zIggw;l~g!?j(Mj9M>%!HQP`xjXQ)#KoDMj{Bz$5ZSmyeBSQ(iqa#KEyq>N-gcoHr2 zSB^)RO{a2_$p3%KSwo8bUbh5f8b>Xg5x7_G&$M1-<3s!r;H5fT+9!mUYTZ@-2JAz@ z>ChekflmLKmu|m*Xk@I%a|1Z_Q~-pNFflJ9nT{_yP;mi&GG#HEb}yk(wo>EFV&*)<)Vw5<=NYV4h8pum+y=S z=z31gNHvPg2jGbgN7;EjQtkI-(W&2s&GFLh^yY#0P;)%L{XUrz@OpH{n}IP=phi=+ zhd<3MU=a4z;Ovg#rC9IbJ|Dap4x9)w~}fCV+FXGx|aYcFs5AnFiu* z0cU@AQEFalmP(5Mr(&LhUjG%;^GDG6`tAF8h<80W2cvjtDJ*nmr&0nq(w$0uJ_I_5 z%l62$b|l(A?r=E7qaeIA>-2jp><@t#=UlvS%ZG=ISS7R3`0D`9lxSYMIovP}yqVx^ zb$G77WTcuKgj&e=!12-92ZGBRY<DG-}lwJ>TN}_lv){g!vc#FUp*_%=` z+HrrH-)x|%nSayaFcC8;U#c}G{yOY`1@D1A!Xkfk{4XU_Ogyi|JPT(Rf1xuB1nRU4 zFU5M8jCl3nj6aT81~1J@&QpcB%fM-h^BcdRK5w|ob`X$dlLYuifezkn{HqR(H{5FppJ?PMrE3PT;eqLK#$Gy?`@lB66zrXL?c(V1b=mG2s*zJr$YCK;HM+zI9|P~V<@vXS-m~+3-t4phe0c!AAOL3q@aX}#G5|xr z%BCj^wiP}AgX9G9*<6ba%iFD~Mo`ve+-=feVx!1F%@;+OaVfg139NT4h6 z{G~uw>P2d0ZeB@{QFiK>Q0j0!5u_-qo?7 zEV(7)JqM{_g(!zzx-xq}8X~})%qMo9)iatsy!~{00|_L-0iUMcb-6iZRx+2V+SPO* zUZ4&OiEzikNJIoexgP`>`s6blTELKKnGTWJCuSP@X_#W4hUv+VK1K5G{4`9HJ`Gd9 zPs6nP!%vZ?-+vmWTRsibmp={D@nNRK;sb%mYk!HwAAJC1expq+ehujDui#OQR;)dG zG$77&;t|dR6*tY{76RIcUp$h-Q+xj1fRy9s&bJkijs}~Z?_ZtoKLP0o(H(=K@_qr3 zhI}F*9W_pOzN4LQ10Wqqu5!MMo$qacbabJhRYT^fJq>vsARTeGINvv&??-@i6e{at zd3ys=-T{DgWU6t#7dhW4fONFF#`)4@it^In-wNb89(mCDu5`XMPotySE6$e&e3Z9) z%#L(N0MZ-{0;ImWZRfpOmm4#bTEQbS82GxSa>GizD7Vl`YI9w3)g@jRsPSjJ1K%^{ z;oDPRSVn5b-5Z|< z#{{w?aD!*bGIZ1qCIz(TO(8(qm-C{?5A;HYUJz(H7fmhNMV-cMNwO8=dbVj_9H>~l zd0w|nb6YtRF7e}%ajUVKi=Nh{>C6lYgdvWt%Pm}j%(65l@;C-=it;wev4(8A*k;ES zAZ{-&=F%faVm_@tw?vuO;T|sD z#{NvIV-xm?j=}z59W&#-tuf`Q(QI0?J@^$BJ@%~zGNtZzXXK>E@(QHrb^IhZ2d}A) zvzg({h_p7{zAIL+DNvzcac#IViylAs`Y4v*Xc8BtkzfJZ%0?rI+aT+f?hD$89NA4R zqf9}9ORj6))g^Iv8zyVA7tZhh?fAt-8R98{v<C+U z7dZawH-K$(1%C0!pYdEP5bIZGtS2Kgfz}(mypAygDvWsfVF1Ic4>pLKE^{ zNO`+#&6=Y#Y+*-dyx~$l-K5Cc2N*w7fUQk?TWWGrW#!pO^!}3k$qwS0CX{@16dhyq z#EEn>BxS#hcXb&?M(APOZcmoT4R~BVoF;)vM@yNxyDEUx$zi#a_hgYVKGmc6S2OYWR(V_^!jpHb6Rj zaN{vBe0=t$%@qItrCq$V14=FY!siz5Fokts$42RrI0|}VY8gkN_HN>0N@?{OSTg!)X8zB(3b=x|?^mW>|FwsI||7R#^0ELM;} zT#!&Q$8NtYBSJ2DuY@l|){&?rsP4x9$`G=6chJFQ)rf{ehsC5ra&viq*sQfsn0w;IMGGexJ!j5n{Hxgx++Z zTp7D~XZ93Z%DhhJQ7#0}&{77V`d$lI{I8_1+G^>8GX zJZOUWmSGuVYFSrJIu%~o3*=gvgIpYW)5zwkY*RO8qO($81kS=z9|~+RrLIaD-rg5V zFz|4p9E}K`$1g6{v4T-?rWq=fEXY1}p=ca=g|euMtGPXw%hwTWVY#rhgNb$JVuIZJ zq6vl{E}Gtm;|2WUavCBSTS3t<8=typG>*KYX|C$E=WDu6%}{vgM{fSP=7*JOs&3M;U$TtA#D&)I>bQQvw*5VhJ5Oft{3pN+^ zg*G%AAgku8lq+WcU5nX&*J8HsEM^B|Tf)I8W(T8~9gJdjFpAm1C}szvm>rB_b})+B z!YpQpx>~b-G1E(nnX7v(=92+wF`ofQi@6ri1Nf;q04?V6c-LZ{4oHi6J|HdT#elS! zzX?c-`EEd3%>NEZi}}}p0>vEsyckIohNtSGOtzJ#=-F|s{nFlw)Ut&LKza@+PB3N@ zGD{Bz7KiA&@((^kwO*Uh$d?G6l!vcng>^do|Ab#$F6!VKRKIxl3N!}KI|RBMPfjm_ zq6IVH2a-AZ|6DTJgyWHqPbLJC3-1B#=atek5w;d6SHxPN=K|6Ky%5m%@QX(#;u$DV z8MjnY`URwL8GM<-M6I`JIc7{4y;~^{6zSTfD}neQcP}AE*i*!Ft3aI8ZWE{+&zA+N z!1FHx^}+KMfhzHQRiL4G{#BrAJYN$igC|>NR1TO>@(~sLD}NK{ay;7wnu6yW0!2oP zzGuZbP$nI%dY%f8pFMthW43YjoXBx=D#lN{V&?3r*(uX2jyZ15F%?ZS<}}TkHFI{h zaZ(S2;ycZi|88>^#Ax1v7|ml4qj?QtG|xedmR1m>r4htvsRS`vIzfz*Q}Qi z*%=sD!n{R}T{+TMaNp=?Dn!c%>R;Uz#i1=0t-zBhdu#t6EbtZFk8w1X>m-uHak3tZ za(=cSetr6Fz!jL9Gia(g8q2lIcrmzGlvlA}wImDtr!jp(QfBM8dzNJTNgMgMEHHB9i zF197L=m8+IVZziAzNJU*1=1xPSG~b-M2khaDx-Vm`PN_fmL6%zhmMvWH7@S*(e004 zEILErNaV)aRag0z9_@+f{T=ke*VU#}4-~GH;p#}< z(#5~LhPJoq4s>z#FzxvuU}Mp1_{6W*FYh?fxAa)%Xlz_Bns7LSh()Q1%F?{-hszs% zOOLNO8p~yEPaGm#_wtF~vyc6-(zo_v?7oxAe$U znRJIbE)%)AyoS1{?4Juu8qfAGuVH_nD|cLHD?$zy$D)>N(u2DX^)Ig(?PzQYZI9xP zQY?BYo=oBGhvXLfm)CH@NO!o4Ynmd=|b6p+tJv#zHTtR@HZBvt}AnK z&o_JQ@Gr07%$ly3i>rj0hdTm4f84l#PWjjT%WL*?G&Zh>OuZi|TwFUaUyb8_{00B= znui^Y<@$yhe~uEak%sHB8@}1(UtV*&qp@698%%|8U5+QKbXR4c6%`UIUgVZx{;hEN zYA{?!1B%gj)nQ8YIN_?rlPO$#>#F0AbEVPM za2@AL;}yeoyl`ENCsWvv{lnzr9oOF+jg4!a!LSwkW%!#7C$ya4xHdQ%%at*)_iouB5^A6)szb2gG*&tgqu5;%F?_;RbV}i;MX>D0#xT6CGEDqp@5& z%@Dw^Ni6yVp8QUvCLDe97ai9Jj>dA`U~o$WqMYx*qB;vLk*Pd{SH;&x0y8e12z`5T>D%* z`{jO)YmK9^aoIzFmBKX-PX;{f$k_ub9oH{dg>aQFt{M}264+RDfcRnwTz^9Mq~kir z(b%}wnsE9H*DO3)8g%^~*M=aCxyeLn7>jSYiMRp6b;_Kq9S+6lSS-XfP`Ef(p}VIw z3mr^GL9SDnd^n*Aaq&Cu*Yd=t4;nMb=VJ2VgeJr_7}!|U#`Wsmhc^!PxlADmO^AzM zu2__#BHhe?Oc^%B=VH>}ghrsF`DujXdMFm=S;JFb@kG|DB* zTX39Fz;%Y>YBOA4G z?phH0(*+?f358Q=gWa51mD1A3Ak2CF!?|+A6?WYkW{8&vG%Gn9`f&OVsj`Fmd{WnM)Krv_h+{Qh4 zqkd*&)gP%<>qe4m$oHnqoK%nl9;VLDpVipFX+&O9g>NznNIb(v_8J&3Y_=Z_?=5$UlX-emQQ>Krf*tze-J^C`@PE$2$PoDGo4;qxL z>YTZ8(#H@W^nsnT!*@XEzDRce&V9kVXWwLyH)P+Cy-u3xKcgu4tHP>1=o zZm{W$^{2%Gi}b;~Mk{6$^Khn9sKh%z8ruW%@$41(II*SZ1{itEi^}zxeAZ43FXpjN z7(b`60rnX4(1jS2B^f32sS#CW16ypq2eO)M&@#{W0?!`2Dm&ql0MnVGffYqpHWZ>I z5Y%naP>SO#8;amHF`a~yE{aETI>ECZizKKrA1C$A0*~~VMboA;eA5q=V)H>C3hUEZ ze&`>(@j|CZSK#YiZob6Q1_EE@V&Lau`5_s;)$ar>vHpa}t-Ux(*35}qE&})L?1?_# z2-%`H7J|h$UJj$|YoOg$>-{0MM#7T$oT{)TT9%QP%4#nQnpVVqEbL;)`~#~dMEp`A zRTER0J2GAk%-usR2^PXMMAFUt3jM;+QqNg z0kcuCkWRZ*Hn0P7H9NfS#@<-hCq?LS*&{zdpjYrbP@pcTwu1!f0q9_Xf=voYEJE;b zPG3IDZK?$(Y|c`#?STl`c;4G~HzZ6pYUYQ|x5M;JMTjUSoI>p+#jhjcV%j>L0|(~D zW{Q8PCBR>$`F;V0;xy}&=4|_lzlyoC0CQ;p=CK0I10hVYiMS3RJ{d)30aLz(R+^nP zA5zJr%FcWPY@8K4e@3C!NJA)}fC1#$GCqF~mWp+fJoTE!a0v2k45UHcXEmrrXgfxJ z>vpVJ6QF_CjTbHfpGt7+5Rhtv@=WRk+shk%bC zAve@OpVxZ|Bcu*wqTQ=z7xRWj4u7(L-A;$U6d)b` zE&`;(-xYv#_*(=>hrb5_>G1aiARYc*0;I#=Yk+k43$_wgPr0Ffi$7c+`d%tj$__gwPpTzafh( z0ZEW~a+fU&uU8gz2jR&H3Fm2A967&`>Vd@O%|CFBm!( zUVrXg_-=oAyaJkkmMG4JmkgN~lJJhe0B|h_0XP?4$f^uRGI-nwn(uIi1n0u*pA6;q zYw&vvH0PL&78l-t0o?F#jv51FKr@6xDIBw-Dwb%z34}J;;qw#U zg^x{m`*D`0v#k9W&v%DTs}a1~tj&{{bY zYYx9bKXMe9*$3m1#dvB7-RGd^9h9d)pI?y~tw?^N5li*|Tt&K*GEC7?rfD6DG-Q~D z{ZNNxxbcr?W{}xprB|#e!LD{O(qKUcOn#4ag*4wmssV0K@i1*io3tHbE=-XX0Vxo!3K64 zTC=}v2CmZ>335B>*gXqKxX#P@$& z4bA$OYAF0^#~pg|X+IH{i7rG{>PLZ-3k=BfKF5#3gmAkV%ex}=040XrM9X35$(po8 z%f5t7@|q67U_2$#gzF>c&59({JiW6Ll4#k6VAC*y0>daA46=t1KpV*JO90tQEPfLt zFm}&V2k_vj156KK9ik0u?XN!xjI__@_c47Cp=RzZ8XrisY=Tz~)7QjeMq<~?II?^Y z?jfXE5Sdtz@@@L(&e7WySXtg295v+?q7q|DBIvk<-HCBNO7iB_`L;R`L%z8VVf^?> zh@D?mei^4cy|wM{cJ^s(?_bR4E~Mw&7Pa-1nFiv1;Y3RdIjg!Sn#o}E@!3oR)pCRlGdOJw z&P{X@h)HU9odm8@Lk(yGnH)~ZE?me2>Je(ria43jA(<0cEvWk)^qhlq69lhxD9Aj4 z1u>uPaR-(%9ZDZ@aS6#d&bjUS-o8j>6)<$Z9Qi6uh!Lr90Z9H`YhQ+5qVbB@%N)B# zDvX#TBca&i4mPe0tH(nF({gd5N5^}a*x5B?{^c?&7G)PC{>6S*c>Zw*tlGqNcU)Wq z(3Rk)_Y^RO_b(eV*gx)YFA3mE9G6wz=ZX?)%V1%?hTQPoulvUxPGvxF{&kZR6=9A$ za1}(7%FS=Uu#O>)Om#FiUxynESDUdY7paVE?6?QV`o|qA9F66=-e4%u^YhjHxQekRD- zjT2`AR7qi8(Eh$jp2s9e4WW`F!Mc3rY56#O5&fR9UQJ%$;e-`tNutKacf+j4#sd8v zCb>{)rnq3UnA(Kq%$LsU9*$JAzt3IyF}vIYDw9KeIj0JcUWOd5(zFuEux&A&{QX?y zoME%NBBx8E?f+2QzYHQOZw%WJegSEG05mrlc_;?}m8*pXm>ggq1kHXVfMf5`@Iq#` z#qvQpXx=t-F1+w{2{ODL-c^Ef4+(F;AX}7zX9@QyM%RB}h>jvL%3wztT4r0r3){&* z3it`d!poC$_5t0ZVsznRiF^RMe+S)<(FW-FN8;@t7O=9swiz1IiL-LV;G{kzPpQ!5 zATuMAT9NmxEH+KrgFNK~a0d@-yY)l%DzmJaT9>P?pq0MMAx!C#SlrC`C~%|Y#jALs zTJ8XVO)&1a;dQ1wDC?+}uVR52Vw5wnQbpONw2%jEVm*7zXkTf>P&Ahe%?jh#};+`Un%N7|F17<7~t^E zh5Szop5{1Gfwx+3qcKi!>2?&lj0i{IZ(Q~{PZY><*1{SFTG!B&SCaBZ$FawY`TgaU z*1LIkNA{3pD@=OsS9Nanb)|@CsJAH>UvlZnT&mh6AS_Eviy5k9M^KyQKEz2y9kswQ z8*67YiYwO)=Xi!yQMPvjXTyU~)q?Qq#lC_F-3W)YkeCkeC=Pwg@H0MZ__8j$uFF78jpFCIA}_%-7Q7M{2f^Vu$pMo5T^nsM1l zeeydG{MKI>)jJwHjivm7j>B~<$}bxEPu}tH5&pu+F1h@L5sQM3gR&pjPy3&WBX^oJ zo@7$zFN`>_&~?YpkLy=Y@4zOT<+@)eNMlo&HeMydrLzXy_L=n;_3;v_zR<*j>dA$GvVmMh+j#%$&Z%J(uGkL zH%ZNDn8-GS3*jo{OfN3#G{i!=cjd>sO4E)jp{1l(Fe;xuX)t>h*?sUnYY>v#IiwM+g5a8VfF&mlcKR<2%n`BO6B4j67>t z1LoCvcbMe`No@e?^}3*;#hyo^UinxXp`T!19U(M7*U%d0;>-X-Vv5kD8l-Ja!!2z- zzf($ZN??T;mQE?li(~IXpPqE#gp3}}98=v=)0 zhfsS6`GaT+XEX zaxuE_mDV!0PAx{4x9VYdR~MrjI+&7a=Sa7>7+qE9k}iq&)*^I4aT5b&JGwWIPP8@# zh3^Dsv%4R34;fn4o7~LYB4thqSx`0O`JvWTEOu&LA5%e|`shR7zlJsDIa1<&fgW6e_?dnQ8RLa&5@usxpf^vg7J<-)A$bU%VxI4y6R8A~UKwwCN)3exny0 zn_j#zdweEWlS$`ls?*+jm`6-?Jf$Hu@A@cvaC^VhvfB{^O>J{vkUdD-nf;AQTdJzm z#u~T-#DNkDiyxTCIwO5c*X16%MH0C)JJf8xT62w0;ieG?+oa(jxwX(-s6E$- z1{h1jrpw>#Zn!Lk)Y)#%p+G{-9TF*p)q3w%ef( zAVsy=6;;!{?Ip>bsb$Rfp2}zYToInIOm#mOLAZi#|2=oWzl2|0%o9uzXd#|jlni{T z;7Y=MI9$AGZ?%V_+fe7NlcHlT&q;+c*pWRelS{B3kkN1Y868y))ab>}XD>z(d2biy zGrLdw@i++eaT(>oC|^ROZOGhszg{zJ-hRu)w&sZgOQ6XF#~xghz-wo4x=fEZWX?b- zUO#s~6~mf6Z`>cUkI4+QD7@V%50xZWg>X!$?Rc4=ldnke6%1|?Iu2XJT?}$ABYPw| zM!aTm>pa{^Lfs5+H-c2H44jH6h1ja=V@QfS8R3kWU%K*0#B`;^HU`f?--U@wbiaUL z&^vc%+H;aRTEO(qtqAz%QsKAY)j}{G9-#Ej?Gt#*rSLXs>J^Q1vPgmNrU69z3ApJ6 zm>C6_nFW|x1sKX3!Xfk17RJmez%X@Tnx+EGT)|A6K4a#rt7gy1Hq8w#GRgdT3+GsY zbaDJ*(F5^htRGe#c9$=lW5Lq-S_`8TVT5yBXdVE}yl?lO=nLoAJm@H#iwR_nMRdbk zEJ_Z>weFZ(JAC0>xsnF77VZ;XE1cVgx9;Tn;iW(Fg>w%$nhIH_>2UxeOYn|IAolI9Ey(oUgUO*$o}nv9TzZt6c##|G4W0 zUpUuH0=OO#o5BxF?3|axqOEumF{f`swXe0%#gqnxb4otM#Ex|-xVV%hV%LJ#?)8Op zXE++m#Vgh5xH5@FITc`N%gcTk_l0vuI~vRNGHB>HcaKHMOV@hohu#N%nUs>@9I?oAu+ODNf%=E~&$3Eh7(GZ_+q>(Lv&NtFH$)xZg zV12IZS3deR-$>(E9F2{u#b6E&aV=bP`A>W!jW;_Qas?OFhX@yY3Eew8dVWQXGzN7z zghu>(Xv2~Ni(!L5hnhBrgC7AJ1+%8Llp~BVSGnW*YJf($cwrvhVfcl)4s%>}0U8B2 zns5#;;5yuKJsY4=t{Y4^Unt=Eg5&Z6GzwZnYP|}$dO0px7{H%2%JqhcouA@xzK(EQ z?*wR+tB;ADpVTndk&dfhfJVXdO*oukgt?A#To(sultUX0-FCWzziwinovOV z{Q}HYA+FB0FGNVrOu+pJ|2&2!#GjQbQx;-sbm8$V{_pmI;!A9f32=B&oq|2n7g2`%kW!8oN7u=Z=>y5hl!^0lV>en@~j> zj|?V7@Y4$n-I%tzhixh`qFy8{N!9r5_+tHs+gsyj&1%>auk-K0I<^)HxM%fodt3c0 zlZJ#=3Uq4lUzpKUNSFUVxVP26GPEc35YlrJ1~F@InsXf8!>KeW)j#v`XE*5PnBk3o zbk8NM8TOx`p@nH{CzDfIrRzUXL)ydB%BZfMV%4`2=p$BGtSFD-3fyQ?GYgmQPRWe{X&R(Tb^(pGkm-5okkooRWLE91 z4k(Z8e3bL)7@`ATw>By=OJCz^a7K=FQf(;&s-=Oyg#z@v^B5FKrl5F z(QC4}mJB3DOzwpgaj#he+g7ji({SLWs{W&Qk9y!?wE_s0^ z2fn|-P`uT3xy1_!S+Nx|0t-F$Ml*+me}MPunnNL6#5suNc&W?%jwM+?@gH?dn;!b8 z=FmjTpBaQ)M2GNh!HbLb>v+-QER^3Z9doGh!Sy$!r;y2FE~=|)ulL@lOAPx9(+|&j zZ>#k@y{_+Ha6zS?%(s%8!E5Um#eTR3Sns`VBVT+ugfqO136h%9MBUMgD z9=Qh3Lj_ufXSqO|9rOwyPWK^BKpHuPk4KILq#T0)DaSZKoT|qo4S+bcjz^{g;*>fb z`7t1EHZrUNM+YRPzyg|wzI>LJGB%lzx%`VoIX-br`t5$F$5lX*IVU~bkRY8EW*W#T zJskxBu_#9?j!-urf5?5lfTTAtbiVcyL#I;#3CAw>;1jzpKE@Z2JS-HXv2k5%FdWsx zrJ>_|p$<(3rYQ}R{Lw-5%m7L;Hy2=56kxdYwobWNQr0Qv+x8WI6+?-db&5&aSNv5> zeF5eN1(=IMn8N9;ekTJ&VgrZyZ>WX-eFG+_@?yT}=EKZ7g%?ywCc^6Guwi1(al-s; zD;1jNCoIO*+@62EaEQp9!yCh=FEPVVM{R9Q3 zBql|(#?P1}38E%{!{n*+8tv>vn&Fh`4ZI^~ik%sJ?5tqm(Egk~R8(+QpaPyRqsg9Z z3M|;yf@K(lKOc>kuto%hF}=_ztW{t3a`}q)5AVS9Gc;Nok4vJ`4I1hY0KSA@1L*EH zwEUy9f}w+gbQO3BE<))iba``!dBAT%AhjGC;M}aGe<)g!mR|wSCk&m7w}0heLPUg`iB$9@#2C!x`>?xVcJl^X+s4L z5#mVadAhTlT!$~|ZF-41#Q7Z6Ij;Geu*<6PYNYpp4Mp63$-QmZKo}|8s3n<+hv+v; z_cp>?hsPld{^D}r?|6Z%p0I3!HSdl!^-QgaR>Mm)y-key7u66zyFWs#;qu#*An7`0Xr9^YKdduVkEpX!unryALPYrX5s^ps)`nvGH=U)dA#Z+K-* zo`7FGQio?Bfg14)q+0iYhO#s!E|G(-u{fLTbE>0_= zGWDnsh|7x-fiA?8GOMUux5y80G_nj&e(0i+t$4CKMI$@#WOI+ofE^h%t8vEp=hszm zB(LBgJabZ{WS{-^Kj_fIgTp9?uJA{i7%ad(!;80ONr+nKu_$YwahzH8IPU3aTu&;(?CG!o$$#HRD~|H_be;~-geCC0r^Aw@yJ*T=|EYUA zK?%Ijgyi-;K^u#*b|hr3sBBl6SLV$nk9R3Q%cXq0gQf$bXeJ)H8Bfk&0wTUXX0Co!1?SnlGfPKSXhG#h zmSrZ6HTs6dCfl4Eu>-|r;@DrHp?D4u$k)?ztAPrcMP~<6nAqHALPma%g&b-*r<=7D zG-^F1*Clr@Zmmw-zB-dgZ)lJ6UD72vmphA(MLhiA#Kq1e7i96s1$c5|U6?@%Fl&*5 zwu*s7azuKB-t9duP!p@VSo4Aq@ai$!XvSSwG@?Ig3WHhXS#woh@R9)^W z)T+@zGn!k;4k%Nd#B4&pb4&J!+UC_Xzx_cS3fS12MS<)irf9o~uufE}>{-8~5hL4X zTxRX33dGd|6(#Lb%Gn6=)-uPAsvNhGb ztK-_kQWcwFrU&&>=dIV0Zo{d{bxo&GlMOn9IE9HHR&=A$Bq0JVm2PFlk-~wbA7%>< zEOlOK;7u-@2A0F3w!sB}PWMwD)Of=o*+k1i_=!p+mNrkC%buHBgkglazUYzYlBbVc;YpErG zbd`1sAPz;*2sf3n&&oe$MRi0)aI%7K{<*KIIM&kf(-Vtwio)5+q1$d4=dY>e07FMH zFh)Ir!+KAO7C+*Hm`J;_J!1rc7o{br#+j+DXs<{bGMj^>;^OuImkEU(m*)_v6X9ynEN*?d!?i7@!HS z`q;i>QMM4exxZPB(=j9tuKI)~wCbbKG8Sd6(H;1;c$4bM1y_ASBmUOnP8r@}QIk>y{!{G@I>y&F~0pU)XI+l9|9bNE-YFkNE2>$TLR1PJ?W0vJs6FKSCcgbHe$@COkvuktp^GZiXyCG zyBg<8`{VXs1`ZuE)L)VFqZo;_V#KNz$TS`UclPJ=Sdr)NA22&GPlDz+j_Ppy7)yBlhYS^jc~s-?IM95@(E0HW;=;r^3Q->e z%^))lGkQ&5_{8UFz<(7q4;wmuEH&OrK)$;P;2%NrWiu!6`L zrN&xCkXHCuMG(1I#8U)4 z3z^EkejESvIT+7KV%&M@sUmpx;LLZH3<|_2Xp4@$G;ggMLN* z-VOSd!LQ5ADp;xdfK1Q1L(Qx(Ak{7+Wzl390LI<$60`sV;mq|!+zD#Ep@*C0cfCv{01Nu*BprvDIl)l*{|lR zNVW%;=XxeI*?Q^9gTSRRgk&wVD7l&?4C6)Of_v8>Cb+0X8Zd+^0a-yc1T7ch9s9IW zPN@4hGS-wtjqwV7P{W%cu)YFQfPx)#|;?s=y&sX(^Q2s2uD#2eAz*PQvCmkc$RX zGg7|lC!7A#pY~n|j(QKbiLHV(xz>AP_2NUB8(vblcymo6{nyM=!9aS9@v^>;X~_#l z`_1f9^dW6#nKd=Lz#Py4U0S~jUxpfQYrVH!SotAbM3UwOyCT_Zs5Huy1aC~tj#tl% zb^KY(<*bbXHFFkVj4dX#?7(zRDZ(Sr5mX-qV_ojoJT55_*dePa#_YMw*#2TOfiz1W zkr;SH99o9VoaBq&&UZ8wMm#|KU346AVo|PDh&cC0_rB_j-O?`SNS-PUJIh()XMWC|a=^Y&+b@mnv$4(uoi;*vBmqStZmPbPkV4~7uPr&K~t0+hqEy^cym-_{%^7MzPUrdyU-SWt0 zH+Cv@%cJyVZ(;k}fh0#w9NpU0iEk}foLQsekfB1s!OWMJTY6Z<6k7Iu_+no^Q)i;%a|mcIG<58y8eV^X`kmuQH32lsIKaVKy5JX=czUleG<>HMiC`!fk;q?= z-_4-=wHexNc>TgEE0M3m<1s^{q1p5e38l~ah5kYUm7hKqQvD%V_v1&$ZI|k@%4(U0 z1`i!IzoBZlkR6GjiE~aK(rR8XFOnV4h{(VVeT{_w3)kM5{9H)W~ug(s0Vu^pex%o?}j%}&L!!;eX9Z$4vEdf|B;I^{Twf;+a=~`GpGGzEWMrd9xDczXz z0%YJxdn<&kZ5w#f$&JYum=kWiZ+AIa5b<`kyTM%T*`%}t$mQ{)hs@a9iGxmgy z*;Hm~>F|!`UEQv}3@I2eCW1u7YbQRLiDJ#WFXxPziSb35=-MxJY?V}WWICR-=^~tJ zd!szPWHP}eW92!QPj90nkYL;2%Hfk6vx_)r2sF)F(#?2Bm(1<5WNgfP&g2SzC0EyV zYp)h+Zxid~St<4+b)kVR85vzNwoCPr>tbmXO?t`5uIVLXyDhm4<+6%uD}dz>||t*mFW%D((pf@tB60McWYiy4=MFrM(S_2mc#f2P2pb zU`zFVA2ic{;ivIItD!CH9DDlY7+%@PEZzHwO)<7tIDDwC=dIs|N z4A2H@FO9w@x$OH9$-JHAlq_p>} zpWSDLaW`-ZFuPBs#CBM!?+Z22jp^hwHOZAV$+eQ*O4J>)yMdL%>`FzV`b?Dq3S>8x zT!CsG3Nq&R^iNi=0|WJ1{i*6T{jbz(<`dWJXj88je8PII3)Sm|pSoTz`B&=o@=so` zQ%t>1`(*VxDNwJoK2^PD|CM^3_etyZhJ_dvwQBF;4B->j?zO?%y@6lHPg}uvadrJK z)bVot5`Mz&d&3=wRcrdLf0OKgg2DM)w@H%i_Oe0e%FsAoKH1MV{m*XxBPwy z;F-jO??H8z!~8RC|G~ION{- zTX1^s>4=Tb+ItwM`+nr<9}Kqd=(pv?RCGrwi6iPOWt6|GRpQ(0fj)QFDlp`huf-Dq zY{`A=4}enMGx$QigL#yEzn@7Vsp-BrKlc>BBJCl)E81QwD_!Hwj~fAhk@>nRHp{ivYJs661BNZ>IV80NFR6}IspeO@*LJL~sd_Kb@?&x? zex+%%odaS5ScAE}N9zZe1FPIt=7%ZF4#f{Zy!~E8oc)T4^rXa5)sbO|hvNfkC;kDE zUa)VZaz$!Mdf&*fB?k=&MVTGU=$`td(ft4mm3e6onxmqq>d)7{gAC{dtecyZNl6BF zq`YTxQD!NEnV8L5ojGZ!Q{QfyX)aM{%5`NQ7iy7Ov8yO-Z?RTTBdC=HvubjU7!Mxq zj^C ^<;y0E*!;E{;b-S3IunhR5~Ym()bsww5ockG5gq(zaww7tCb0mS6>f|4ZsI zM;#MKOTnc1(ypntzm(OKK9ye5gt`7(ZQDxHrO&5J-%l@D(47a#vNHYzc|5lYUPmCP;a$1<54;tL z^&XaR>-i_1>R8?W2-|u;Zw036GNnF*VA+zf(LJp?STr>rj(O+Lvfps!8~F%e;OEL) zRjD)FAgxYAI{-7;zBOADeHTE*ps6+Sa1aIadAoF;j6l)O5ag1)s2A+>zR1?qVA>70RUTVNs6WHon3~Pt4eE1-y)oN zcz%zz*Gjx=4w{^pu@XM>_eqy_@HLf~@eKHTB7E=Sa=yMq#(mSJ@9^cXe5^~gZ7s#f z&>bVl+M3em+x}XLfo^r%>)nxbawTTG37-Ah{#xSA?u9fYN}mLPh%3_Gu-@=~2fvSU z{oA&cdhZ~d(&rP8yzgBz6aisc+a1GUy7U=u_UUbJc5nMjY1==5*;4wBcku-%4^V7p z#G7kM*P}QtL`eXJs1uJoo-S?k&c0-FIx%BS+iRr=IPpkF=}X=<(@ek|&)NFCi)W!! zN;RN$snT^wT2>=twy=Upm%ixzVhQS!fo))5OhiZNdj%=@7C+bC@_R^|n6LuBKTS?d zTZz98!$pmO_=8ObYB-L~C{dkd@FWn@K?{!p1D{|xAz)!H`Hb&Q9fK(^!O604toC9(Q(w8+^TyCbQ$0(c8Gwq-pkW-Wrac`Zm2eb7Ps zEZCS%^r_j32h7;OHjaGeXolrbtdt?I#ELr9*}YeJqt>FfR(N5L(0ewWE9K+>-=}ri zuOyC2%WG^jvC}H=-<;`T$$guX`hSn5w*Eb)aAp zi(kh{pzRqP@lPD3$HA1hY1KPurPXmXo7QcpyJxE7L@bo5v^aTl_3}lOnpkKa%5`w@OLCviJ|x8O%d;cguNEL7s4o(?K=&_NC=cMt_h8cKzO zdON6(gHCc#rGo}KC@B0!^09G+hjaS!S#8ZSSnm4MG3T);Mc&NAuhw^6=%1CS28NDj zCBj=@Bv53cq~dGIo(N>>ni*W-5H7m4MV2mP(a62 z#G(|L6TfQvkOTbw(SKZ>J5z+D2E#)h}zN5@8N_M@m1 z#;+p( z&Rz(|9xrr*2g|#Cya~GZLG!xlFNayW{$Y*n`+FA1` zc|H*M$M=GcgW8LGLC5aZz87>%-+OyO$MX7MFX&iZaqZiH)D_DwtD$5s=$O95UeGap z2Nj{~*FS8>k@eIokB(=?^Y{Ju5j_TUgAFay;r9K4t6zJ{8ySBcG;*|jpNu!WLIfls z!;9=P#_(bapf!sp2bQ@mJ_1N;oy4VgpD9rOY8yv}aXb}=Y{!;sbUdq?8>{MT%ZDNr z(EHSN_I3my_V21Cq`r76bh?9zhwcX$ipqvA@md8+rkj%s4cU)_y^5K%=d8y;8E`b0 zo1>|Ti(|)iuujCAZYS2^g&O&DbJ6BqT@o#;z}37fnrQht03L^Kx(=7!)aB0YQiQ+U`xtAJ?q-zsYO9%#8&CsvFcsmqA70#V z3jAFC@G{lWytIW!0B}`O3Mn}kDXA?NE1itbTIfWiy3%ilMNgCHJ8fbM3}X68yxUr) z%-n&K-!kiNzi9yyF$}+W6BkK$Ly)#MJqmhv!kPV zcRX>^v7pQ3=0mBLtr;7OJ#WcG+rHGXjm3XXoj0naJ(l*mOVw`Y+!V$mApl#lgT%Q} zXcps8xY!ZXGtt;%zHJ3fUf$MLvMDjHHL?GQibTtk!nggm_(SH~T6yjP6m1f0V(}0C zaJiz&p2 zqISlW2h!?c$)j4r(3*y-wg(Di8tUA*E=M0? zD;|SQv7(3G6D{iy;KI|UH2_R9)nx>##q)~-aXF#5%K@Dt zxG4^IHK3&6u6H;Nq#XC+k#9TPj{yx49H;0S9{VhpT=B>%hkFB%jyxX%I!1iEvStOM z2J>+Ol{*|qnLdK!l2_>#0%8v0k)H!PTcD=^og+{?pgMs*;&kwTfh$28`BTGhoEAl$ zo#bd_A>OHv8I3H#lQRiOPw?biG8&maa}unGUwFZJsk1I8&T<_Luo~LCR&mHj=5rW0&yN zcq4xQ8_R#=FX3l88q38xpyNC+7UhsjuAWUv91qo;Y2O19G?wcWx&NrLDjQ~29r5Yt*DKzao=RSYo&%RAZny@&9 ztvnWGTIe3R|CeKQ;U6?gAT*&|uzl%uP~=*9^|$}nnJK#93|vJwe9~QW^jFJOZ(B?m z^jECVgyPx{9rb13@0=pF80r`VF$flNVq89f)kn$7gv;i zzIKjzWt(0vBwSU(q*oAyxHww*`8uS_!GF^0g@nso+bT2?z(J<9aIzDNvNh4&J$u1P z#9*3JppQOr{4^;2il;o-({;QO01w41vab$vYX}pxmQ4@kGSwxNim|6De41lSniW$- zXT2bW#SJ^ON-X-&xH!qOPBE|BSNv7X<`AY(*yYQIEa7;BsuC@=$-qlF0_xyCa#ABK z95$+7$nbPN_Z}}o@xv?7@pg6<_N?_C2!VzasM+mqIT3S)Aq+lXdbddkn}6ep6pI9` zw}OOZYUB*tUhtEkg%Syxy$(eLZSfu~(Z<=ctw`=;tu6GgN)GX5a@x`_L*uVDRTlhy z+FH#2`?<*E!q->J?CKJH-U{p*axxfj3jx!v;YH>{%&%N^8LTq&Hv^fWCEfQybCmfA zSi0cIO;V0LjrK!91Y9v05J$RsdqKz1*V_xaLqT`PUeK||9^4B$=3~`f&~fa2b}#6d zkL`Ow$1m8fy`W=$<95&mOjoR&8SfYNf{tI*6Ze9S@ebJwI(}Fv{;rl_sHGX&z7 zmx+xFjp7&^P`?|w`ImEg$^qDu^>KPt;A7JgI?QXVc) z22U;+qmc{otPp4lp2rF_NmqV=)xjr}D@>w8?^ou%ebYHS45`Hm^*&j)JYZQzS!wg=gh(7WEEVGS$KNmoH^sKXv`;>gZ(EQg0oa}8gbV` z(~K);%)EL=#jNqOdC@}S?27FCS&b1y(bQOBC?osq7yOcNauMD_)9J=%xe{YF(CJF- z96&M*J#yst{FT^9p&(5~MCUZ-vmvyx=tB7O%P{(|^0WPw7`q%D!^5Wrj?I^j9pC3# zee4B?_$#rag~HH;=BbRqUsqi9XwR&!#5hkiOuFG3;$m}*McJ+B?*8z`TXZF+vs=Xq zO^8cZSsX>_esRsXyL6Q$Tx_*)LKEWBRTjG|-4jb6xOIA=(e!b`_{ub*QSY??{e`l*KTN>w2 zIPT2ADvKj2TxY8+rh#tCv2Q*dSY@%7!!gY88dz6ZwhWugzv%^5S!NB>*(%GXaQwGg zX9reUW(~tO5RQxG;9pMryHgf*53I71`oR*KP#JQL5R2Lr9{9?i-wUj=%;h6O6XH5Z zxL8VbQ*Q10z2GWK8;8({|9p9>NI4eOK8MqK@7Be&ofNLJ$S~1x@sILo9u$qW{p6|B z8V$`y9gr|Y-8|S}apM^vo!#~3O*ZIT4U?N-SZ+=}c6Q_VIWuSItv1tUj-S*p5pP*C zV2}iL7MI}k=HXNEG+~JskqnbF@R_p>N92^y1iyzJob43-<95vl4H#lbcpr_ng!56{ z!%WVCY|wjKYyz;~ikeGeJitfDT$J&dN4N1ECu*xKb(f zxdZW@iXres)4`8)bYc5t_X9r`fqcY(;23Xpk^5+vtV-KGNC;PKX3Oz&$X?Jfp448@ zaqJ&ngs$I!p`mhNcq8-Z+>Euz?r;S@k*|a2U)>!(5kctg@D~LtzJCid%wx+Wy5)=* z+Z325W21IEQ_u^)lZ3gSgLK=FX48xr6?d^8wwr5nUlLPjJ3wBayAGSSu#1NA0xv%+ zNAUHF|DI^s2Mr|yo#y)7;ttJ|k6l_2nsSSN4AhyzYfDy-@eU%M13xNwJ}A6PUAFx&uyOHh zPRBGLRa$Iw0afA`k8Ht{GlqDC-ApTlTi1#UY)R`m8ZpRzHz=W7yzo?RKVL7~&)0MN z`9;A$PSua4GH0=a1AFo9^ejX#DTdBoUxf0zptPMK*cGk--u5?c%Xf69je}LJBUEi1 zlnZxypI^>a!cAiXokoZ)2wDRiR7oepD)dq+oDK)%6URV}Lp6YY))|XUa&l)d(UXvt z?K6>B?&Wb|kE79e^79jqoQG$HKo{ewxT%1S72H)0cP$_;yW^1-hx;iY?Km9d6r$xv z&Mo2*?%#5G5s#b+Xplf-g7ys-y>SPS*0L6Q0WMXQtInQ~MvsbI@?&tOyj9u>ShKeQ zVJ+y(fW24{&|SFHeGU^XvjvILZd+c0D1`k{ny621hNVP%&#Lg(g0z-*Ct%AS$8k`y zqKr{g4+;vRSU`zH=ZSd!jyw{R3^EPpx$EI zOfnrGHN_EDo%gr8r8T=8dM6^S%QfO__r6WI^Lv4QeH+W_qpva*emN|jh*q`zH}K|l zugNX6`p_Y4Hq*9OqFfapy7o0){N7j1Rt~{3H7;A(F$L+)4lADK?1{zFn?0zoAe+7g zV}ILgICvpz1?81`45^4Tb!|VHjRWP6LJQPr_7K5&+YzwNkMw*4!+aOxLmx16*&7$} z8fWTp(OOXGGQ2BvH6TvA;}H)}E<@uHevnTUs1;B4-FRdxo+@G>kg9_70Yo!*#rJ}{;BqLUo7`MM`Ppqr-Wk9IBg6{(qNbyReoR!FaPz>i+$yXF#(!l$`9SaLH9<>dEXC+<=7+O_Q5YKQtC-e zlrhr%kTI~A>k0qz~8tZerop*17bOq4M{nL<6?vMH|~EjeP?SxEXOZ9 zoX`k#oylneZ+=|&9rDJHh{0leFE{S*6>5F3bwP<;U*xHnRVFT?y2y6$^humxs8h_G zDdSBkT4B|nEdliAQ0p@E37*k-92F=Axf%T!7;0UOg zOA2U?F2Gn*fb>uA42*84dq(5c4YS8zEq5K_W@xzv z(d?SjY#MFcS^IV71_y8iwGM3fs$D=Ub^Yjp&Lfn*^o{2RA9S3riUiJ_6TM;f?WoU%Z()ABZO}QrD2D&MxN0UXu z8xjgm2HhKjz24I0-PcIL(ygF7kKa%@7hbZ;7Ny`Rgqj7KKb!9gySnBh9P$0Yzh%EY z!fENkw^E!4zdP|QUCHk$9LEd^Z>ZTS5iIoS;PC`#Mwl;?qe~8SgD^?^;&(1+uF0nx zD%>3PzN9RjTL)NWnFj@o}%Q?}0ogvBs@J;}aV)-4Br6Od1 z>P1=9a~W?R>hxbVIfDcDeBhA#G@LDevvqP}ZX1s3Zu~jUQg1Zc0wib)z&NBn4d>an zyf8WO(k7g@ehTNUN0($CWmz)9jF&0bHxAo)>%FG>Bo=Xd53F1z8DaunZ+bfh94F!z zm#MZwSK*y=gm`2Do?jGb6`m@15rGO!njsKmq9Nnq2>rv+nwHk=`I(Lt$#u&ZSHSc{ zP2#^=Q{K9i2P+J1ZQHxRPT<0AiPTeVu*)FxJD5<}oc1=Qlj{&r7leVZn%0Toy5w4W zk9x4s5$zNh70;#0A-@=&>}Wq^av;7;#~PG!)rL7IWpevvay{Q?GXLhA!pP(RNzxP(Esx@)b76jPQ=8Y`JVX5@e6wLVzuc*r%lFp6nU9+@T z={alSTr@{=m-VX84P0LjTO76ZOHW_l-UkKX=dd<6yrkCaeoiiq6CcA%MtK8YsLu@{ z^%qjP;bn;JovQUs&qMrOQt!Q|UQMsoRIQzTS#%2uA|-c~+66h9bN2LfZf>ts)r)f~ z&R*IR_7mQIZ*%m8x~1`_+31p+Yt2=cb>6PDH@CNUS+6z2E0|EomfCxC3?JxT-|rY( z=B-2u=Jq~qY{i`J-gAU|;RsS@;`+L!1J~B&PG1YbeKu8>n_SXfF6Za#y^m^hBTATF z#KiO*o2qIkYkI9Vmw-(Q+g}>l7S^WW1r7HPuXS z#JjKzGRKbLmF+R4O*(_f7cWW4g%;~UqC#IT7F6iViB~_o1&kH=TM#N&lyfc{O!a2G zO&#OPQr>E0@9N&CjjNagTOzpH;=QYp*Y3<~t~c`eN}{C|q1NSQmeegheJzZ(l-GO6 zR=PKGy9T*kC43!PyY-qa(qwr%=_ybY+JF}U(+*eWXz1JqUw12^x%BlC>l@8Rr z3Prlww6^P{we1I~QL5uvZEf-1^y`|*mE-2!EgaU3nA$WW9TMyvrZj5d!anP81(wgBclZdyrV{Kx|*8ruwH4qh!fJN6#?$XQK z5B7~eEgjK;-h^Ir-6Zs}k-6Tx(CD(S+q|+h)#oPlhV1Euj%VT3^!IiMzgM;&fFRNk zVfy^N!GCt{^j+9u^ZC(GGP&zZI-UZy>FxH7xsj0m&pio^E^)(mk+9(KwmKo^-4F~0 zzKYz~K-)XrZ+qBRGUJbHd*^MM(Tf4+hHKlyAGW>WXnWn-y9L|or4u6Q=TQyZuZASr9fu9)@c+~@% zch_7BRm#g=zPQi-wD{$4q=t@DzgU#BPtG`x+&%D36~9cIA~(eYN16(=th-j;l{OZg zW!~oPYMtSWUv6+TmTRNIsQ865Q_dd$Ht)7t6~7=ZncI`hH!*QGU*R}O^mSO$FPB}b z;ummcfT)wVdc?L{L)3BR(aa9C!E6)KjWRuBwzfp z+R<39pBYRK{8jM_5#u&L`)yzR@+(JUxuzS8h*qK};tkP7N>6zFzg7H#d`+4OeSMPc z<5I}&MY^8&#iE?;lIxfYAN-AfX8?D+=z4;SxsF7Z%2P#9u_))hRv4vbEc~ zO}pB4+q$ybf|P2V0Sr$eydMD#PXj>+5Fosg|L1$oy*D!fEdKZ9Zn?>v^S$SO&-?lP zp6~gdOJ~2F&j4{6h84PwOIoe{Tu38->3QcJ&Sx)Jl%yRD_PhL?V*p71$f=Hkii!eT z`-asgG+EC}@ubOx6;mvhf_$7>I<9yM*8_Ap=@zPes9GI2bxLu`xFY+4MyIl!Kq&%E zZ7Ukw{ywgt;#=JaaK{INm=(o^j~8~u`cPpB@|Rujst`*b8Wcx2UjpTP%aFJe0n%Eb z?69s=kad2;f-h$MS5VH~CG)e0e3dloxaUIJ)(7(aAb7HKCXaa06x~ho$$7H)@C9&2 z=q?mTi6>H=_cEM4Y2nzORd}~11gALgYvAj`$yJXNZ(br^l&>Fv^QsIdJkrK>`fj#6 zq;j8(xe*+{u97&sfwIx_;SX9NjL-SL75?ozhdZ_}eBtrCZ_4ccZqp}93cwRIdwcTv z4dj=_FVh?#6NSs{Z77j~v5TcW$jBbQ-c4ARs9p4fV5s}b)(nfd-{yt4m_N4vYGY(( z?>qZ=Yrl1$EH|F^S9j!_KaK_>8H4=Qr}90(p42F$#21mo=?3?Ya{q~01Z#SS#es1lsRqXOEK=1VuuPC^D zU>Q5t(IDzcv$uJ}TTia_W-s>{M?Hq9xekTj^~4sTKmpeyzHo!*WP>NW)gPW(7Yv79 z@E9oZUhXwwu~<*^UvvJB3 z?g&rYbD`)_$9>Qn9@{J`#xIxv5FmrcZYSp#O9CiuK7-;P+jh}Jv`Zq+g{L)LC=s;} zob?!6!ecQnR0iltKDpVOjeflAyx~IXWT%up0jlC(nzqK9y(aCXH+hW9W1RL>E&AzG zGak@|zuKEtPZ^^o+MB%;6yua}swyVmW3d$K!ke}_8`b>;P5`P7+C5cK?LV4E{iI1{ ziSNy6CshfY@@W6WeFgQAMimmkQY!&e;)f<6IpqG31o)_T<3kg$UvhoX1O#iRE>La% zL(|}`E!^TYc18x7RrRVQ>M4n}-n8Y}G%!^XYifPX=NHBiZyMbw7CtG3v4+mmJuNXb zhi0QFb7}U;G$GICdW>zuA{kfN1)l5+uYeQg$wn)u)Q2~X8lASmYjk)cD9v^1Ek(** zx`tp$#nwveqj|;`4V5Q2^(0y2l+rHZiYGaQGDxYSHQwB%Xi3c7WUQ{L|7FY8Nwkyp zSbcKtNu4%vipA2r$-aXq1V=r-M>OO&&ynt45yH-rRbL{D}5MOg^JYT3+sIZV#Zsop{blJY+qWZwx(0>}Zn5 zpztv)WwXE2m00yyU!o-8};6#zLoy!_8}Et@Y9SJ zh_FT=2OXGdx^$*sn=P2T+#hlG@+=UxcOZxPCT3y!YeyoqG;;KLKDwr9v-fb89>cTv zWtzQ{YkP8u%1Ad?!@%W(VOcveBRnF*o@_OrT0}i$_uTCYVd^{;Id0P(H!Gk1s)Lod zbxDEM3j+p4#-jblcTnpP_Mt=A7gbjo4-f??F2Fi}WLh2bzqLj{EJ@#Fvrx87yWHhU z!b)63`c77mdaV=yx`LnEbvLHaSZ-GVrf>?}dgTrzkE|E}D}^!Q*VCFCkR{Rb)XXz? zbWvJ1B+I{KV<4ua?Dgqwk89dLz=^5yh08whw3>)c#x|A_^Bc%YWYea}ucVp6%yC=U^1|XCo;4$C#RibZSn&f;vv$VkY`f z#+6mDmD@!ZU+_{i3E}RFf=QE$$|_3ZLcP#EXSqDlWO{)%yH+u?o2-FcYKMsFDphB45=dSgq)|O{z@{|d3>TDqtz2T6M zsFgyHV$TgP^JZ@euv09wC@X4XnX#<)+bkNUHF=F_%9AfWvN;y*$<0;am^XW?TnTfs z0m?HZ%=a;~j3dUW+6pM#sSDJy?Vi_{vW&`LG08n{*=#Pa@SI!+r7KG}qqVkziGJz} zK4TH9wZ`(S{;bw|3*`%?o6W*%z31e5Pd1CG&?{a;7MtGM+c%Klv$C45iXK}1CX3YQ zr&#T>s^&UDadyU*|Wo!X=i#IZ;r>Cm^HS_7?o>+ZPA1kMDt2a9e*^IO~G<4L6 z;c~LUo82I*%rDh{ZzRd}8b_oUBsv!E6a^Ggi1quT@G?P-j)?Tj^i(bWzA-_p1sNz3zeX6JG?bo0!Jh8Vk ze8xF%xY?WCUVA$v{7O%Fb(m$pu^2}}ZXXfp-`7*MdkJdy}d0Qg1&=t0yiqS&0eED<+|Rp zA5|?PDlH;LA+WO?a`}vRJjOfWm@qUTci$nkKYr|mbCOz*@wPX-U!hWyt9)UCT!jm$ zwVxOn$w&%@H`AEvXagf7eX?j9&kcX-*U~n8#sS)fFT0r{_JuciPHv!WG{IaTebPF! zQ~wa4L3p#*D#i%>kSNF=MJG)7{52;$*-Jdeai6i5oTWe^BIW=t#gjwv54rtfzWtdOm~7S|VwpDXY@P-x8Aa^*-JtNfI6f5$gOL zh37L!QxpDxNmJFnUv9A~q^WiqEQr&zR3}}u3cN`NTXtss`*yN~zPfO__Pw(++fJ8P zwDV7+3lQjqlDDbnt&8K62hIF~$JlXx62EuF#x^^Nf$(Myka>)C7f$5|eID>RsjQt! zJEF~9r~p&;@BSAjp~-~{x+l?VG^Mov)8VtRD8;u{YK*oymd;7~-l4I?SN+zcvTu=* zzab228%&y2)W@hL{I)0rcdL&gR7BfEIW)SWW2vYs}UrBt1G?0dowGw8_sy}4_1W8UP#gCipDY#PFK1uvFT^_k?7B<1oQR+;es zsIrV9d+9NYt|E3?9o}-+dXr0=tOn~n@aLCEHIXqWLM!umr_oM)|FY)YJ5+ph-JL2v z2239}E2xez{*FJLh>H*ek~4-DC^445@z$Ta#i&~6Dq3UxGd~;9Jw7g{oU7tI{l#A% zNQ{%F?+?FA$DvQWT{H0T1`38;zAd>V()}8PqTfkdf|HaRi}W+9 z7XPI4OT$U%_SoWdufYt&z?im$D-{{dvlz|)`E$?zmeE`o2aGoKVvq5jH?2KajS5xK zyt*GV1g;?FD}6@0nlZQGq03MlwP-WhTf^x zB0pUJ-4^&Vl|HH|dCaV2-)vIDY$=Q!#l{aaP{76y-<2BnWQ18NtW_+WbthoqR4tJe z)@3e^#o4*c#i2FmN0WE|d0d>qf02tL)TdCK{vVVaymT&((4zA6KK#<*o{GYhw~sp) zr%NjMu{tLAJj&ft&E#Tk47F3#X_AI8NQJgyrTXE0oxl1B?mZ@p!R z&C2neMXYdFoP`DrQeNWu8 z=#r}~9C?@LLJ|qWAvuJ2)7~pJ&S$X{H|5sEdp?AreGC@yjaO+rhdXoY%?UgHLy0#J zoT-*@m&gjK@NOEMz!usHqwE84>c61FBMBPsmYchpJ8pgWWqgru{N!=s9dxs>@}1{B zpf7=wHb6T$+^9hb(W+xqUje5_j>dDiLPHYIF8m3hs2jl9|8C;{{I;HU70Bn0PLj{7gcd8Amd;=;QnQS-`eG^DxUeDJ8obILjQri8ND}uO3H0#_r_@;z*8uz&iL?R|`!|P#@uo$nIfSjrKN5)3|rf=KAd^|WO$kmbX zKzK{Dgo1GB!*T>*@!#??nx9*po)!ivYCk@S#beu@aMBWgok!(QW68I~Kii*eC;B}f z-?$?2&-Q2A7xRCy_zkiV|9d|p@z1ax+rRzp*xk}2Ej#{KNmGjdRZ(8?zs}^uKhu@? zmzZ1Lx`m%unw>}E^CGZaF1Fphd=hi}e#SSynD`f;c7fy5F0kDCm+;rEyppWPE?Bxv&-L3 zkNs}js^=wY6Pu8Fc!qb#!k5UPiB>0$!}NfH~zB5E*X)HKPSEr@xu6?Rf*S zgB%1=691?HLibOmKhw;qaq+>-iDY8c*JNQP2O}cYbVPOaW=XI=GDomH3$l6Pi*gJ` zUXJ#Z*PXV2Suir+Mb(=FYUG1CAkrXK@8>ebvG;f7TQKtHe6d6-ZI>0yuk-sVPfglW zt5`Xqxw5ZZ?~CH4l++N(0fmo~;g39*&#WEilq629mux3IC~VS_5Nu>FQ!<&Z!>X@| zVv^g!x?tp0afy#ceRTUHkvf`+9jx|}BCbrGwyPbPFL#e;f#eeP71q8!*O1EiM@^Jn zDSHXnS7#~v@E+@;9-LBS^1xHv36I=$i6=g|fU@lRdykss$D5Ctj&@i z`oa6WexP3e?U-5ihkK+%k9y7W`sQOkF05=W!dxcbPYC)6K|j%~5dMw(Ez6GZy{v(z zwP&M1TYxt1z$n|x>zPx4kE9tyT$l&?G_=K2mXTQ*>pY{lTxSA|YE zOL;AbiKl}Y9nE}blfc^6@;Z5)-1<9tqnKsqFiK8?UV1>j9{?(Un~b)dCb^x>e4Wsa z(Q$@+bV@1UMjn^Sm$LRE^V}JH9A1uF;ToVu4hJ4O%eR(O$Gqk(D`O^J97 zpj6dk@0%RPBxSk~j_~c!5{#CmBxVZnFv_{_B0ZU;Csn2AJE(=BQ`m=aB;LF7S=V23 zmterS+$HRazuYC%VDZtq#4Ni@a9uF%?_<~>KJgLy1GDAj{&2ZJ{0F9pk6nKVbS?>0 zEfsDQccF_Fs6Lx)*34zwK%LG;TflPbJOKUo?h!Jd^&5flkZ(5g)-G}M)d8(%CfkmU z%7C&1*iuNxn6~!GwAIGTUS9Ud%Pv|F$^}~9#pZ_kmV-=S4@$t(uOH#Bj%NCAlj&>f z>;+=|&%{qTNc>p;Gx4)hM!+TVW*rNA&w@I5T`d1?iC9PrS$cRDRBCs%YL_D&J7h^* z8&T^L4iGO87M}Vji*FTD7A`jFAwGU9KJ-V02sx6aNRBu4+Wyo+@u5DQmkfv+Hi*?X zGn0!hGw(#!_PNmr&qBE5i#0$|Q04$dPbG0+4W`+%C>j zy6#oboj~^~=n){D%kKc`Tz(fw=kgfP{R&SJ!AK!TX$v;xn;Q*Ox93m2iZjKCBKsqu zx=?tTDmyLfT(v~7$1a9bYKakdlgHXZ!tKB~4sK>9nVGjk_(t;i04X>SODPnb1{pZ7 zl3-dslW^ER(77~F-I;98TuB%5&U$k+9_nlE!h~i!wNS`9l^)N6>$DSXS^`y$w)FFz zk^a*Iu{~*{BG-R`gY#F#k$P2U)QUUuJia{(UeRIL4LdhF+noPwN+qu5{O41u1cwdX z>L$~Jasp4QdHV=l2gRAOGX^n{L;yJJ_vyKVemGx?Q~)ciXl5RATK$ z_CG8RRZFCABn(PZXbifihJkcX{UOi;{M?F-{|yCw3y&J_X&{X^6G-EUZXb$Xa8%!r#w z%(M2Oh(lI2$xw(mTX?6ZYG*s2kzQ=}h1YtjceVm=$r{aIGc?lc_W& z-(%tkD+^G(m#|i7~l@n?vJ4zDls>On7 zzIDtKM%eb8>C4_xgs$>Y+q`Kl{@T#&qG92F0dG!&*LO{bN4u}%gvJkgkE0yg;H$7;+MpqhJ zSG}vlf0ARzW3~{)f}nu_wC|PMBQw)fLc+dTcSQQ6()eEpAtm^xq$U`S`j`6D^o#In zYi^@bCOxg8#p|$-NY@L&+G+GRIbPW0??kkD%-n#1ilI`v-aG!BP%}8o{Kg7DG1g8) zH~txO=I2RRDDOZpTpA_hxgm4p0kB#_kv?W9d?rx6(g@{k3x>A_%#nmtxP?6I4j2ew z6GbG0%dKS{#;Wo4L3akj)7pdKPAHUAbH>$Dn6=Xw0;V+u%-4ux8)0uF>{moTJR)?s zz882))SUB74;p8JXq}2=-0!cBC50mWh6M6fPR;^RPQC;-Tvy`?Vz{&BSSw;i=71TuKa^;1B5TP(P6g@V|;i(`iJoK{tCwj z@;~%G$^SF<;Mkit%A}uz0H; zA6gh68m;l6moL)47h<8(?LFpOs}Lmj#Lk$W?8c%R^uvwX=S$np9MSK|;gO7f!z2Cr z=@Ekdf5sO^to0nI@6hu*%~9_%MzAvM_oOdpH$koRM1CgYg9pj*SSM)j=@8%brNKZ8 z_j?M(alyRJ<_rYdJNN(kEaO__hq46nGeU^PfpoP_|D(*ZKADma%O(jgE!V}ZfopxQ z$dt=z{BX>ga%ZV2x0#u40Uf?3`b?u9GBg%*;n-JX%-}#}jdUvD=@#d0EhqZtSmKWBBvh1L1Q)b0j0j*jB&!+SY)vgYcQC zw+16uOCqU+L3c>c4^*F{+xMW`6H}C7VpYxHi_hU&U)FVVff`B&V%W%|GW zBX)0@{_nrE?oIFhrk~#Jr{&blW)zohKJzE4cUMZo7*79wQu?>Q_>}Z-f9!DI;!f$_ zoG&pW{Y-mKUm0FQKlElFrXPBk($mf`^$-0vlM9GnLA={qB<%2ow|in|>9H(UY8rj! zr~|&Vy+tF!*MB?bJ@c(K-pDVcUx!yRPI%QgL1?Gb-YXg&9{QwEym?E_8A1c@KSHNA z2TX+nGA$E+hA#^vG!SDt}l@Dj{T#jm29ejnLY~sP$@rJaQL1$qWKI|QA zm^k7F4<}QsoJa#7;Rr;<%KV-%kIc*;3=}J;rb&H^v|*D1Vi1u~1!x(Z|ss_KvefFeNxz~C1UW=LGtajKNOW6%1}%{&DU z-!EV(sJU3?CAm)Ki^-7AvWP$FEJuKJmVX7Lvm8%AE|~RcyJB*d*cqpDPk*zO)+4~Y zCJT7A!2({6TEL5QEnrTa1w>{8cxeKa*k;a~<;t2j9xD`H6%5yGxrzn5=qZgf0MXJ! zIKVGL6o?g&nfP*^tE3xhgoBAN0Vaqq${XANHcwQ4FoNOzi7uSRa&SObEr_t){V{_5 zr55MXrAcTV7J*Ne>K z*eP|&KD^wbab<8$nXBA{U_DPh!Yu3ab@qa{$>w*Xkh{A@-eH}{JFF9Vhjr>z#3LRY zQ^%JUYnL2S_8s}uD430c*(k3qN-$!p#JUk<&pLrbCSs!yt7W^O0JUJmTKT#PdU-p` z=mH^PFD@8?$9HUWk%lPPFUAIh5G0PaLt<>gDM2h^FAgOVpB9Ta%&XeiZcc9NRi zgs>e-uKXZrBUxq}+Z&Ui<&~(0m5Y*Bl zYft6y2SsKfD2)e6j_jW7Ac$QO;Q>3seZ;k)TZEKyDLzz$d%H!5d&dDH+$a&QlOhm< zdXgeARfM24vYA8v%@&HLU^|;MKOa+fB`r5z@ZsN?m9^kQyv9}O0C(ThDptRHXhbiK znT_Pmx^Es)8$z$0L**a( zj3&RA(B8=-gAllvoBZV_f59gIn$zTOa0vd7VSB&plG{7;@8$M>d5FK*5dU#)@5nFs zs}{RhI0dTe6?-#9UPPEd+>|gw@=4i6N@5|jpb|rIRD}Otc14uemVTCeLv3UL>r+ld zv-ij7Z$@sQPpoZ*0ptp+PyUI^Llc|i*4FBM?XVaMWqs&3xXLp!8lQfHJ&H(QAZzKU zwl7}J!a?{X>-^!GCf0APe*HML4D;94h__(voPk&YV-b7zE+CjEYA2&cg0eR=lvjTq zTOG=`IdhaSQ^MMV!MzQvCKa1B!ygQ*0E4o<(hkc+E(0Yli3I-0Kql5n%bDz#GZmMw zJ0DByRR6-aRtpHJ@=oC6qo z>K1>G?N+RR?v6MlvZgI9$A*h|2VlomF?JGA`F8e8*q8v?pq3^Q7c(vn6J&8$zFWRC z&uh0fSl0try9 z%P{b^8*e&*Hi3?VS;|t!UMk}GB<|&8gJemR9g@@1Mo``(X{?(;c^@aeuw)(BA&WxU zHNuo_qlz{$_Q?CAgv^T0TJ5l$du*>r#IVddM2WWSkW%V5GEf~&4d&IGHIK-q$5-Y_ z3o>WE!;F)#$u9dJ@Wp3_q#61mePr9i<*+GReBl;Ptc9J7^>8yjP+J*|Md6<-Y)?*< zQ_I55;8KiOpg5`-D9wF~qryPp+`3CNQV3%NjwkzeXi7L^1r=qlgM-mU>~%;>mA#G% zVS4->>C08!>Pn%ESwTk6W0*bbleAI>(g^lQeQ#XB8`p~zunsI}6)6CVYc2k)t5Gd^?Yi`uC3~nNHp+mcm6QqrLQUB%ii`Szx zd(~XK_Q(<{le#WjC6&2M=Rx+n%tq3C2nRO1%;`G6Y+|MQZ&PDR%}J_M4Ml&fq>$Lw zlyYjh(!4g`Ra^5Q6|M0in`P|TADkFPv4V0BPTX=w#Qj+Y5g9%Fk(ytbE*CpN`M9(* ztl(0I3laqRYJUkyd;d~3zz~lNI?{?l;YG5w6Sc>w@QX6!wcMo`=D}L^7DDqu?Tc!( zkS(4$GG>JgHdfx0!6|6G7tDE4#w|uGl@e>aM-6=byp`t6L9~WI-f4eWdkCu#0_L5k z2}}}!Tt{XoTpy@j&DKww+zevgc@||0?AII%zYUhF%a}!0Q>e!+}Afgwaei zSCKvywfUMtC0r>1_H;fY0h)KV`A=>N8Ygg=9E8HASVECOe0z8DHKQW^{uVbWyr8ij zcJ^cmIq#S`;~g0$liyTXtA4*d6h0lO-qn5w+H#8Q0h6t|I0igaO#cdu>&s~;LZ?CY z%BX3cqdylk;i!hn28K%71TaG-!v?erO-4Sekw8XDs7$;alEJiPH_fJhIZ%geq0;;q z2pbay!t$NRX~S(Yj6ktNIUW?81A;?GD&HlWylpa4l|%6{SniRiWSA?Jfx4toUezA4 z4Adp083LL4XdjS><9F*pYOvg=21^;0)mT_c z-)`GX(x5MiNRi|8K-sA_J0u%2LSiyRs_kfNH~LX2()D~eM-d8Hs>KKCb%$_h*+4<{ zsqk0V!y-Ou)=W|?;?3sF!Hh$yJ+pK0;8>UW`X9zh3qX_6H6tQ}u0f-c#qZtZ3vc$s z4#V&5lr3ENy+?d$9Yx--_TbHVx2j%-Nb|KL!QxHbwwT#CzDX+swRVt>hEFOkGrK(} z2nr<+oXZH`J(lTwaWHSU`E02Sk}tp+ULea9XL#%qpr9!|oAOsSKC1l6CO_jNOlM5L7aAWqyZO<^M}O@+wWc%Py}*wD(S+d<{P^L~UtFKKfJCRx zKy=^8&}hEZ8aFbsV-`zmXSdwjH84(*f$qwh|E>w6i{B*W zGn)xY*r}?Z0DkV9&CUpGkgYPE_+*=e7g=OGGpR7Mg~Kai`kMZL5RvXFOA)hC7^^bB zvM^vpq8B93Tk%YPNyVcF>{KC=YaXZeY)O5!;Q#ofkD<^`U)+rQ@kyVmU@1S@4U!$~ z+Bvep!yWB)YDY-X2@5N!e2YxDCV~D-pcgjEe0U&^Uhq%cf}Dp%%^ULr9v+84hLyR1ltd=gPpz zjUnTmQIU*C0+Bug{8fuodE~8_d{xM3SI&rx5n?EBnK@%);zSq~p3NAJNOILuJ&V2P3GeX4K7a|bv8ble9CgZ@cDN|~ zhQjsbAeyDtc9`cvJGI%eWaqQ45=)JVe|q=3!R!h28gZ zEom@soB3>+Op5=&qzFp|4uS9o^ngy%$m3t)pDe!!|Agil$3H>HxQo)GhJ-YPdj|hR zT20Abj8fTsb#^HM-QhXLglS(}){>gG`v%--pPN*z)75_5-g#4bz zKe6XSMj#O%fD<9|1gd;ygAc%br~&3fIHO(jp?>*Km=9I(G9T&$TBp|Zd?PGX>Wd@v zX}T~GqHmHp96}#D_OO)mc*Qm4B6Iv=%7ZpOT@8TZQEK_I^|Is4ExdRU z7H64kfIqe|Ssdli|9BY~%3vcsw$@EJ+gUr96GVg^jR$Pj3uB`E0EIgJRT=jAt~TWlgHV24GWm!a zkvS@xd6c&t^#;~P{7n$4fbzC6nA7J8LrGqb$?F95>NV?+?h!xg8}Y3BjbI!X^ARM` z%hz+n=8^3Zwu}>xu!bq$j?;woX8lHC{T0j5R{XNeLXsC@FHDd@wwSz^H;Y^G8lasd z`;omz%}g39>JdZ3B zx5bizEoS}JJ!bEpr(}Lg3Z?h&Qsji0*X;dlN~_xV?)_3q6M)(K`IH86;L{&cqT({3 zMzU-6o|!UNVV0?R3I@l_6usFVOZ8VbS3)GKHO;RytJN%1mnV>cD?}PgH+$_L&dMG* z${Q`tNddVmmYsIoWq}9p+-&6RWyLz$UI!m4HV6QBy5gvesJr5aRr66c?4_j>bXQlD z^O4eM)ZkPJbkY8&Qe>}3^$V@^Ke`_M@cu`#M5{$vN)`npz!h@5j963hm8}kNpbx>O zFGRRuCuJmMay%WQEgfIw8$`fjgF3viL%l=8ta%kdA-+J&X=%r5ziWq>XU;WinC@uDy?7(b^3FAHSe&en}t1X@u!w6 z_I(^ZPkE(S{Hedv@>1ES4>;_qzf@kA+m|zDC~8N_ON8E_S`q8?EI^P=OTX!54juH0 z(R5Io{-=M^&vBLZ)-yNke*~SS*C`YKn zD7(uo8FB)S6Ri~Al*dPyuWQd-^_^?cYk$O(E9b~CbAF#RZ}zruZ2c}z>N*rRpXUB3 z^Yupdi`TbQcetm`e+yQuE9ayV>B?D@xB2NMe-yFHoESUccpr-Q_wfF{C-t;<)+b?b z6Mt^BWdSD+l5ybR_jsAk1}M2thCL+)ifxI74p4HUyeq*`Y$ZvGtwc+)m8>bY5X@nizf&^-=R>p(99-K~5q0z%Rg zzbhPQodfLv8lk@KbKH^<0o6X%00q?72mZ!(dnwa)Tf!u$zrOfcmn&c4Z9un(cAJ!K z`^dP?hL(KJhE_Sy-u|}RAqP6)K;Z%Q>GGcd=~TU)1C_60bEKW^%jK&MzCe-_1b?|d zSZ2=Y^IApP6yVh+3wXJ~0$z+-z?``j5UI0(n%M#%KU}HpdF9wN&wQGeS>vNQg~F?q zX0^z8zW6z$-fc7}8$6zprSIQXE_Na*ZI*d`b$naKItQ9&V?8iy9hRnQp(pMYYnjJo z!BeqbCiHb_7!4SrNUDRyU?V$HYU$G|^J0@2&f4eE272G!zPh;O&a-M-v_&O|KjptX z{uGJdnrfz=7yo}_{uwx?J}Xt!OzUCbo;QRl3r4=Hhatp`Y0wNqCpi74&&K9Pb30px zb}b$LNUbw`yo9(U|e#Od0s^l*J{2CcPd|6e&p}-84@kA?~8HxWOw+AO5N%|KU>>Z)@eIs zE;dRK)YMp8Q$nDYs6ZNp>#+XBJveb0q5@n&Uo)CF#rhLj^Ki{TUPnb($@8kueTpPK zFCx>lwB|lO%Ok=9fE)qUyg%R|5>QwzU(@jik(ClxgX5QP`hht90+THhC?syLrYh*2 zU`|8=h1(}7@f(}`?774G<0ZfmI3+3&%HzPA@<6;Q1oO^jVf}$LDl!PxADp}uu>Ll2 z))j8uyK)57eC<>q=L{0@5_!-#-NpJFs#$+$VEv7NSR$noHLSmgpc45&o;CKMZxkVHEmXW)r_xr!YQm|_GHyJ$;<5eSlGr!6X9^g(tBh~o#C z6U1xB3gW16n1S)UCeE<01_P!CMJGq$nIR}TeJEYdARLl{ZdoKn=YEExfvJJKb7swG zB}lN?oOzYnCaaVl!SX2MZdijzt4}oRL+g=|31T@tfR}Wj;b-^@E%7rS&_OVhFt68$cvdYW!pzINNRNjQU&E3mGl*4 zE^xfM0#((jmZhz>t&@t?iYT>=$R(*OAP=^>0#%F1fLJY2t1F1BWoc>WsVfk9l`c`N zZdI)~SCH@L_=y5X(U)kcD}dS2a+nDnYJwu@8lBCWJwoov^rH9$as5>|h_aCePla`~ z241pQiKmb}Dbs@}M;W29MKdF;w46Y$Y|yj7)lJ&|e5xnh=21@Ja1l=99BDw2*Oz2ms>`Z`2;gYtPi3e>^csZ2PD zr-i4eL@rNDt+ojFtc7e>Y`#`13GM^PqF$oo6h34V;k2m3fZfZ0CJG{2q~D4v&x%dr zLoxj;)+%puB<9g0%(}-ZAf1i)I?GZUW;NGPZL%#^mXb*kU|*4ieaw93%7NOxI$ztL zAFaRt-FR&eF4y*LmDtvL&YVAbhS!{*|04|luP{b0!nkjjIlp{eY+ouDQESyf+&8>4 z)0Y+l;ooDs`g+r(OH7i^v7|l;$D^@bAWIinvPf}gqc|>+khwodbPqM~K2sujo{)H7 z%lk{QU73U=u7AL_FRm02GP*u<$ubEQe(3!CHY)(-nv5ciX9VG_aJd?ngY;cN`g;lF z*BGPgG43PPyHkB>j3z4XuEfvpO8hzraJ@vcPeR~wC50=lEPWU+k0uong`l-a>fvY2 z&wl~K{|d(FWf=E0Q%+khQcerHqUtKA_JndGl2%n(dOVhxq=dgOG5v$Y^c#su3h2HA z#I)@qF)i$hNf>TRHc6&Vcg4hVPO>A6gT@VfdRD^!xrF~a34fJ@e~|FEUnKlDy26)g zU$R=lKid`l3Kjkl#d4QPw`B$2pOZ-bQ6l+QiDb1z^6tf|<ATl#TeayabGK$X}U;eqFqrrnaMmaFKTmOjmnD{%ZPH*vsctXPNGCZ zv!ts}WtlZ^FcqD5{5J}k9FrC7$k;mgJqz<0YSnBd67sm~tLV1H~6mKGu-U(F$q;(tiIPOG67CXpsZ0 za3JnAw(vGO&<+RM>p&kk&~XPk=RheGfR1e%T$Q_2TIK-hBhD`YeOYl;%a%RA?E4 z{h|{lQQu-!y_`PLtr2Z#cB|tSylBmGb567+3CgN^$w0aKA)DClQ8C_%DJR$6t~)XB zRgmV?+@p`_XEEv9JQ_cWf8e0h4$FkFn+>jL>EpmPkV;u@Cuti`*HUl(n&?yx`qyWX zEPv!p!Lrrt`Q>c;DUB6gYAdqOvcplG$vJ>dr?9)Kk{v+`uxg1UOPxL+yLd3(Zs6y3 z4aXd(ASurA3M$6bZqtBt1=a%T3jBK@U4dit1@c3za#tCRjA_;7Zf8kl@LO;tv|a$! zT^GeEy(Ieq8yDUEN_D^1sBh`lSHp&l0rqG8k-yhxhwAgCn5-ef&S&+KA!Jh5R{=?N zy9Q#8SC9u&_r#FnRt7XdeGOy6$Hj-$roK+2vNN~IA70}RABbyHxs9Tl^9OjKWl>v- za}bxYt|n;L8;PHIfmW!q=}uqvX>WMBXZL#DD z-xof>wUZEaTv7|u`>-!>$+X`?!})UddKA+en$4HD@#(h|+uNJ79KJUJUH@rcHdoaW z&R$>YA@8i473UkS*YcLRh;az-`)2>d6KK83?Zgq4hDs}DS9;>oJB{@I;oB}U3!A0o zX3bU!Ok8EB_oz;1vM0RQ>IUASW4c*h*pY(EbDe2wg zP2D}~8h@vfZeHHZ2S=XRBD7Lc)nM2o)aPO9rlz26pc<@(ssPcW94TTC?Fv&g9 za+9@e4oqC5)9cAb!aOQ)>4&XE>>req{Ep6`dc}aH8X( zM}GBuY^4>qcdh8i?T+2s#?C##SeK93I0YA4(`rCK~$*8FZ9r>b1 z-BO_O{M;@XKlJePGso>s$89-~9*GnBVD-TPQhZr-K-C!!7zi*V_C%U1O@P_QY6Db| z^txd-t3hr!%~|fvJLNG$YvACX2u@r((wtxN89L!{RlR$CXzdPj1p|x;f_F7-w zqG_K(nby=8>sIMjp0`p-VavZ4&F1vaDy@vw{NBAJhw~ZzpX};LW{uo(pnBaVl`>e+ z@;IzwmA=lF{O;*HLi$$2iq^?{=rf(3?CrX*_|mv(SlVq4V}+f%zCJk8i_Q7ci9CN+ ziJPZbv7~Q}oxayeGwFNdN$J<|X%tnlah+`iQk9Ll)+rS|tbH{xeJDK&t;{#)ck1Ll zEy*JUy4d@iQIX^w_U14&*vb2JP2<$J&G}!3LG&k;xCM52q;IuO-xHsevn}P)iMu+s zF29yOY~NjJ-^3EL^p0q4!PQF!B=o!M$)xUgSCLD-SEeTHs)O-*gCP~B&&gL6hU$}n z7EmK=1=$wL)V9(vq&n+rn?}eYeAVOh-8pex(4MPVv{!;e&&ISJyEc$#lPvfFSJr9! z>bctfd{obtOl|T0`EIWQoXqR2;op z%w5+)9B~=}K4d?PeTt#c%9jpduqf^c@?949qeujXDjGz5^RN(kr-j4P2opxJKpKUK z+5+?AvCZs2$aNp%+eu5i_*VCjsI&-&Bt9*h<=sgOOc%S=h;wJ#l38HG&-jg@d!Vc z%X^fn9iYuX8v$jMHVFz|K5XGQ-oIk}l?X4tbfQZrg4B&n6Xb5Bj-%w^ zgyhM(q)GQe6wjV_0g%Z2wTMcYXS!6+?tv+(?^tRjHOMrV9}-zDq^ry}8hsn_>9gNl z5M*^D_Aks*I#(Oq$@0TeQs~MhZCnv#PQbmRgA^T(s}53h2JP?gAt;UTRS&`N zZINxCHi_`89U;lk!q9OMQp%I|@?@NSA7m*kgp3=RmA_PU4$%l>+ zAp=ywA=<+9lBsn8jz0$U63wjnJsTE(l+hp0S7++hwx?(|%;1tya&N<+Q5a8$W)rSl zLR5lA!>${Mj!D_bw$8c50uI9Qx&lDd2c~^5u>~z5oyPC`HcXYwH z*k!1>=+#`RWTIdcswt7aeCVviE;FTE%{3)dr`VHP96;a8W%Ub`n14+B1FN!2?hk@{ zxj!UaRd=~Re6;>x?|Md6e+a63efo6W>$8(VI_Q)6VFi;36Pwc0CflpBX^b5HW9Q%N zgZ#8QIJgO$fll4)qb>~UcCQa>Ls>hqHk755tPN#pC2K=jYsuQMN!w~Q#=BacVXO5T zYsNa}4vQ`>XSUNM$df>NU0CTrvmEHhKqL6MT_^CY@eEh2N1ybq8DC3(JgKbq_r6XUHe^qGuo1_NH0m9 z<6he9%f^9TR~i4@;{j6m9BJ&AbgqY+bgoEQkQ_*xmlEtbJ$**fZHFeEPJy-Sg zxR+;q*0`-_eb0*It-U6v-IChqx;Oc$^dUW$CH*Gp7s<&z-!Ufkysg)^w4$CzlfRp? zwP#aCgAq<2nCwq^BK@?xpWATXo%;D6LD&3VO}&2Nem3p<#$rh)&o6-nDPKi;b;xqter z$xkPrqpW8n1$ze4R;0Ll^hCf($1BwLkfhcO zBe|z}?N_IF-Y})`$tm;=dFXhqWHFpazufRp!IT2ajSkceM_k}QO_)4c0T?VkyWxn7 zeuN(-53?9J(ksRPuh&2I4{jAdFRovT!Q*yi@%4s^uIPn!N;a~r;9i>9a-E{4ENo>7 z6Ca$DSGZiC1zI;TxmOP-WOkF((?f+UV6qh!yIS}fifQos(eDlotIXIFYd788( zm;8z^zGnd4^}F9@q&mL#IXGFWLJcc}*vf{M#Cl8Rs_&#ZzS0~V+t+uja3t-? zMjuQ;>Hm}OHm5tjsvI0Uh4Za&hy-8nVM<92y8h+sdO5z{aBys2x!}knxk)xwVoE)E zhWvI*hU4p2T;$1c*}eu?rY>D@x|pjGxxiHyu$G%>eS@9f^QmJX~oWt9KPyJ zm+NytB@Yk(@!vSU);c(LT*76O2XuTrEGECdTmJe9)A1#oPI*k?(gm|sJGe5jla1Ff zrQ}_2P5xe{<4ej&o=nG=Tmuv{H zRpR>W7k_lsCmdg6agpZ}PF%mSYVeb|CL6c$CIOFnY+nCQI=+OLCC?}ErOWW!+QB8Q zBH7rDDYM&mpR6eBxRTz|I05y9PLBbPUE_{HItnO8c#mN+;Td!Tp1X*joD#3rljI^j6U(2n-|c)&P6%0WN@bB}JxQ+N!@fSQq;Qh$KwRR|H9y$l zJeLrT;7oqB*a?X_rKq^1&QCjk7Vd<^647p*V9r%|id^J1v4+Zb=h4?n^ zTZNMfD+;C*j(fE5sd3Dkg%y(uO2!pVno?0lUb-O{PMTOy{ui-I3o0f*Od#bI#gAJd zcMqr>l)?`~h)-5`&rbMLCzKRVl!SN3u!8UUPI?|K99K4ViiP=j;lwFr72_sNnd0Kp z&EtwE72BUCPb?@YsKAACA%$fRO`XUmHDULEG*tG`*UHMKOm-Yb-FHm=~IhvMEQmJ}9Dnp)mHbE*=$ zJ3drM&FH)o6;p%Ochv;ObuW%_lgh?DTrl}z*9|2lkC#fU6_bm<=-Y ziiv|N3MM^NRyuCN)FLY=t6V11Gzu#UNoVn-veIIz`Jv*;Q!0ulOr26(Hfdbpl!9?L zjeDYa%EOdhktB$6f3nOD#A$Zrx^9Xph{I|pI`vb_Y5Ij$oK`iF*qqKnZJV`SxCl3lks&`yb@souQbuYKLHabovW^$o}M6?x8l}{NrvAn>g3Nm-# zO@nTjcthEQM{XRL)%9pto3{)aq&^JFy)}2Rg2tym^j$p?KL3KtW%tndHLBe^yW3f= zf#c)XsolTZ@AFH|bpDNlG;Evy%)+9B#lg!mVewqePr|$L)*<#nOu5UdbScwQvP>jAGPr5H zLANLe%ebC6uK*|STJ0dK9ffz(EeUvOeAo)kt{XL;%w7tQ3ehgw?1OdFKxk)v@;LDh z8YH4V&Lbhf0K5QB2sumaudqAh0yN?=c}^3& z;SIXQUVJL|5t%O6KNq`PA6WCq=WM*(Awv{`Wk@i0e8=VbJwJJ<9v$9IH{GlpEJN0X zYr&~}T06+P&B{kYMr0*e56;AC8c$XS_b@MI0Q6rA)~ z-NL&mFQHrxLJm9x&geNB&&lu2Hz(AGi-bRG;b=_SeJ1VxW@$xnkKp}%+&iGg8=TPo zRCqtR5MEwF|40SpS;mX_CqFYY|Hi@H(ie|l!>O6^f>{rX1jKkW0g7N&%{sQFqkhx3 zZDBs>_GUA}8puWk!dsdp4CFK(h95O{@!#??nxESxtw3lYw@XfY$Ya~0UpMiGP8j|) zmV8V6v;En2qTloJjVluWY=5?WG5;5fUkxLbikJhA*(SEU~kd{$X3oDt1IVD8sneKXhwZmCT21 zE&pMR^o4}Wk7|*+(3cJQu^7N}Y(++4Xh z42z4y+-6PPu{iY*)_E7^GbPki)~`!iN-ng#+b7ae=wK90>Pr1E!onzQma9@OBrS!` z2&Dz$U2Np4l(f`?B8JsXTFTa~zWl#Ge#$|#d}4`ujQ{@lAtNPztpAz#VNOq-9gMtL z2O-XxNSHa0>-N!f(P9WGpwGTvK>O1)>_Bdk0zYkj94LoVY3Rv$8W_41TxVm z!W{NN7BsQMtO)N@3mKm6Gcnzg0TUu z6rEy-U@Hy@wqluJD;^5AVya-jS_eMTcEWv0H~^&5_)}7J7e9UC{A&t|Vt!pg$1#QP z>2`e{4#8~-8sb2AIM6p8s0ip&3hx(=+dKynK@lCwP6yf#q~cN zJ`Qv(&s|Dy@1$6@5r=ZXDwsZcsKsx8Q0O_3n z6VUw%PcgE%TRoq4V{@-^qk-!7{Ha$3!fXBE6`WnJ3x$`d^3-Ros+I`$*u{`w7W+8i zcwXWOD~_GWneWWo?dio`I$z+BYv1_ec2#HKZgO|x z^Z52GctwX{H}>4MfSZ*BRo99!t1DPxJ~-T-mv} zXk^$Ma>Wj~V>{hxYpugR|2H* zrT}TYe*w~XBN<9G-h)6I?;#+K_fsH^*KI75BSQAT2zz0AX}Oq%C1wNKP?kus@AXKStuioT;_^WZ}NqG#b|9`IbPWu_JDa@4(xeDaQ)%X?3Qb~>eh$` zYYVyDa@TE@;Fu9NDfO&9=wnE#YU;p4n2$R>RXf}H91Mq=IjQWa-q{McEEx7};R;w| zRK)!H-dB{;U) zm%REG1oEQZ+A(v@nd7Nr!fXnXNPS+A0l8>GDf;6ykQ`-HD#bor1soh{ z4h~AL;#I(LmagTb!Hl8=UDb`_nv)>i9 zg52Vo)(VpQPBf>6{sY;@c(~29E4wMDD5BXZT2Gcyer{xny zXH{n#BEk_)l*0hsP`+A9ZRvu5@s2+y)C|rRzjcM_w5UJt zj5+i3BrKH2y+Wl62zhSE9C-k&)=;F6848~XRIfxA>9$~aYrq^yNQKMD!|s5w${!|* zNXA$E5m~9S(tdr=ox$+5c2QSaeHL}3S4&~mPGbm|)`S96;@C#mT&x;;#c!M|^T z7kJAl8{Xg+v4`F#`IoJyOB^3Y zFh1OOY2yP&c85MdeWix-cIfdTkhk5OIfgE0tCGlgit%A}uz0H;A6gh68m;l6moL)4 zm#1op3=rJTx5^VC4$oP%Ax=pUL>(39s>RE0HIgJ51$LqIZ31FgwHjo09#pGEJM{5U=(n+fGH|nVc!dIA(%3K zb=-NI4xunN7;&e=rV;HtEX2n)w|sH7tR;fU)8;azvY3bw!~%4Esnz`0W|@Cy-p&At z^Om3?)4soYjp5I04}{MJ&5^7$#p!sMSEFG>qYB9e+~R1ODPuvL5iq4)-laSdztMABKKY@cRi~-Glo!~%^IMCw`^kqB_=gsZf&$O$CnLijPR!&Wm`W9)$3JUWTMq56xqEBFy4^`MF)wFf||MM?jhn z^GhJjnVt`H9Y0G8rRQE-Ez&GP>ne~nTqTZdB)kmdA`N~4VK2vJ9j8jkJNB&q+{`N# ze2%Koi)CJt>tw!|4CyS3fW6Lg1W0H3S3o+;@vNr>PhM+ROwJNJ<8<@sZ#JQrPk?z1 z7Vv7+0$!eL0Wa2Bz?|6@5UB*<#=@F%Y%}N0@yePv8Y>iD#hn&g807<^k1)~zBx;M3 zrNF1cp?|fG%*2=TTv|6l$yQLk5*`KdMR`Nk(cXE|AB;iLOfQlm3|Ks>D7yrfa*Z zc!dk2BCe^UIN;|+=3)~#W~#(20(NY!@v0IVi2On%WgSsba%m~q3Pipqds>0W5Ar#l zz-1uI@DsxEZxlCha3$3b*XB0qJlH99%0A3}HKY_L2)&fK07xmFCq>GA9bZQxVwNO6O~-+)a$=7MLsyDjxQ~ivM3m6@5rY{!E6-FMtN;fD!H~wlp8Vj zh=TGmxdU*cD2rG3f$S0OSQ|z2{+?BE=H%ka0%4aGY?C$YN~Mx(y;8~5qEvFJz~pvT zg?>=b)is)-}J*1mFyZ<~ERAtIz3`+}ox9WL2LkfjIYySiCdbdK2<@|qLm=Fg7Z zBzljdkBUo!)g5eH8*WREiWa#>Zh$=`$!^(+KB{M~PsdHEm)paKjS`Mrs@Q>&u=4Gq zA?qM%lj~=>J=nS2&a#6Ap4Ou7`Aw}G?s5pe8=B|7{QBT0V;~**85mz0g$l7T? z`~fPtKxyQn2eqfZgCKTEga_;h_Yoo2k*GqjBczl|@u4E*Zea?eD?;2m4iMo+iEy3N zzZmMGhbC655+NvDz$*DSTjY8=xz6F|W9mLj>#bgt>aRMjCXbqbXFk{Bq4C>f(h2Uq zM--Wr^}B~g^wOBwc!a$uq6E*YP{q&T@7*9EZ< z-~x^$7Gf##A|jp2EvhUf*_qKM;vAs37F1#=7Nl%&mt7I%wdKm%$Ux{fPk5Q7Loy=D zi`F)?wc-k^Pbkd~O>B~T6RY>N!;C8wO37~=hRVywr{7@rKavGx5m8Do;N<~02uE=p zcXl*EtUw(O!Kq~!_s590VC|ettbnly3BpzoU^6Niff@c+`q@tvwZDw#1?ER&*7Y+ z8+mLbqs9m+7P)$ji!m{F@p^6}>s?uj7PBxd;CGr8cd@$2e7E3qEmg(eW4lGqbR##h zq85V%Xikb+KpQWp^2bM z&`$jUpSjN-f<|slFWD`xjq)lKR0$*k)CK`Ua zI}eY8$#sVgX@uvK5--^xSrTQ3^|Io~taXP$ZHnP+CoaBSz150EsB69L%= zFR_d7Om2?MK@jaRaQ}!_8Ao{A%jdfgGDa|lbdTZ7-5+Vj7zQQU_C8B#;8=f6y(^I4 zq=oNE2JQ;_8l}p>S`_dik1ba@Y*2B&>QVTg94j10odl%+uRLpuo1vvk>O8; zk-)Cm`qKjK9#W692dVe-YA-eTOX{Vnaex1kda4==5tzqbpG*}ZYzbfyvqBzD$e?i4 zVWS6U6T*sslu9dtN~#CHiS%JZb`)t}YK|~ss_&*+e#FbPq6|m`ds*LG*Wqa+C<@~q z9DRwgpD;z)i9wtk&b`awoK=x@U@$4iwN;`T#SjlJQI{A~?nNEpR6e*!C1o6Nqoz#C z!pIM`DaM*JLBJrGudYXuy&%_^^+`fyqOLLWMP;s$d7vc;ju`{Z!vkg{+JiE`Fb}Z~ z^FEF$6+CG9LKG4VhFDH*eYFb{vP6>S{wx|O`A)iEZ*#%n*Fqgi{ENi3mmqWd-#nf6aOrRU8TG$8jd>m)u%Gdug+O2y|vLa{Fh-TnSDy z$i!U93fQoMn_WsCA9+R;g7(rgOeYe~67bu1F+6R;5#RAm0sCRhhTiOhI!lzw@C$y`H(~64IStpSn1G&#Y*RZ8JpqocH+W?;cqNDed=n=k^0;5}2WVBqH*sHmVS`2=BA93TcQsbUZ9r;d9Hk-9b4jw5E`_w8w6x@@Jh0)>Xx)(JW))dFw`f+!|A$`f3*mo^4U-tA_a zG5l|t}O9JVVV=q4+WnQ#$^dH|8v>%=z z_+gl(5{M4RJBuHNe*r(AeZ_dm4}(4M!vIcw!)&=9B8J5eIg1}BkBBoZZW0Gp+(HiV zk7I~1q8fAy_`tt8;+Z%iN~+IIe(0iUyCvjD&fnJNfg?UD`5`1mFhtZhPP0CDYyv}U za_g%thFG7#5P|m&dDl48+5?v8muFi08e%fzz$}lw*_0V!zp)(*(F40O7@mS7Hl&>Z zNA$!vVi`H&kK#F^5Eo`r52B-)J~&MZ``?p3(E-Zxi)#V@d(tNekm;iZ%K*yZ zPtY1A5cMwEPo;~{^SrhYEkJUm5hOeQ25+z=zB42;Iq$;)hR;d;_qyNdRdH4r~{Jf z8~X=7Q{VH1)c0)h*|#C94AP&!%^ct0IBcmPl3H$zZ%!aE4zi$gfh|;nzh*7;J#Pi| zbx_f44(dl??AjI_f;BfHawu$Ki{6GqtJUbQIc4a345c?dkXr1>6Jmg4Z)AAdgtz?1 zw+8L+jE`pC>5ujq>|4~x@(ARwt2!rWKOwxamh zp{1}iN6pumy#JEe5Qd7}m=*N%2TOMC0_2Y3m)i&yRs9-Apk}e(tSO&`)({u>x zoKD6o&bOP%D8-qUU6evX;{#=s7SoU8TuEqr#KDqr`f-GOM*VoHzh)K2H;3f-CWv)+ z*7(Lb1;d+1CbRm-M*G;&h1(acriw=U%Li`#eRspB(1&lG9p0slKj}$3G+TdNV7)`I zY^}jihp!KoG)QgFeyqe1`f!Bh^4ixxWzMj$QV&N}ZxEv!oS`X}%`~_%yz%PJDL9NZ zkpFI+zDJ%>O8u_vaF8_Q@l5*fwO^tC26@Kmzj5qhOi_m#qGk`XAJBi3YDz!Ct&Db7 zmXQ;j`&e68VhJLG!B&@g5_)o>Qsg{_(0{LGHGL*3Yd6(%ag_xts59%ok>76mZ?nG! z2cmf-lqIy66y@_M@Nl5NmJamSunmm$*Ye>X&|iz-*o1goB(-e~Yk_gl$hI>=a>N5GJBav7!TFBiHus>eVh& zhff7Nf)SqJP7qpVptVD`(PoNsK${Wt4C<9D4xmtR8Y=iR-U}nbLkOwjC^LDd;K*rmdX1DIsesd5*mh^Fr8|j|-ma5$a14B|ef{rys z?y^IofhO9V{}u9b_x2}JWXj9(0aW^bDlh--_J?F)g;05N4$B9eEt&g~(9x^FD6xtB zPwbyzQfcaoNcbqL613LJBN@1To`J6`c8STw&&4|TPlS6f-R2}QT=Ycei0)9%eQcuv ztufsw`o{84+*;G8b)cd0ZC{v06M@$c6Ejt!pb5a?e zw57#FF;+=%auUbX;t`g(z_5$$5H}%G7?VY40h|;%#nudqQ`|6tRJr*=+_vB*W>-4I z96g)xsZS9SW>ay(G-hhGHV$dpV7FSil~|e!S8lqH@sMK74Fli_n!z1J9g`eW&B}tgo!}*J6la2X{f0y?^pu9z4qP(rik?!UFZ~Fcx(YF|D%JP36^X*>c>%gOC+fLMzocycp1`KCIsK50m@na{iGz?&)K z9Ni8F1-+vm;MPH@1gDFe{Fp;A$a-M8lquT8jeQN7vgEeV89{&siqaO?FcBSSv+K2`ebPJ^y{k8D-s5&{vY*gT+0nDT zx(oJWo7-wSk{2xf3xc-|IWCqo3~9{Ye*enlki%_58ekEJ&#%VkAK>$SZr3SK-PxEX zMf`d7ZOgD$*8vY~M>i32CbpxSjz1KuST==!V;R+8v91cwVxblO#mX!Ei=|lj7i+Wd zFBWTIEgTnfB`hvH3#plgpVPJm_iKdfUCZ@}6w>b&%T;Q*7F(`Y zE!Rf4CW&v4!UYW?;yrD-lF>g(KOXy5DBcdR{J!4Xe0vBkzj%8u=wE)Z5{3%WZwq!S zmaZe`o2~_eY_)AW1Ca&5C*f3;k%4m0<` zTLqU4XJKJXqZh$!1K}Y- z&&YjJKZeeGDqiz~QBMw>*t|jLy!*o)(4&L#*LIVPKM)a**lQ{fdBcYnSl|xjau!@c z`n~89u6F`Mq6`#TZl;9#Zu@3DFhoBLD{6;B=^xC;mK5Rx#4AG3CSYeak%aNl;ZS)) zgS`$a?`_!q3R>#Fa#JYnrIY?4UtrlPBM;b5#Z=x`OO^K*PS^! zN4(1W5Co-9L17iAkLC#r;~2eS7+But0p17R$Dt)nu*+BQMjh2@j&otS3w;eW;4}E* zR3jhx_7wITpq2otagIpwE!0(}+8cYVi4p1+4mA7R2T;dK-uMm88zHD+-y*GIr%-$g zoh59>c;pRkE<9mlL%{a+}81S z7zr~DG=V}DZm9#8hnp}=sJ{{BNxHZew`@JXS_4oNlb?31Lrj&H5*%(z$LiJYS`P%2eJDC^W`iCIMF-cCYs8tE5i+ zeQDTjDaAod-XZG@dmq?{Zx2d)A3yAUETwp6me-DL6HTRfvsd3N&BRgt;Z4{~s=*68 zacIRS39a~H?U7R2{LF*R&uckIo#4uO^{o#hHcI^E=Qj(UacHk;l8pWWB0pXu*K&h0 z=vcQxw8pOd&~cu?4MPA3{#%7I2jV{58-#ncQ0$1R7PTyNGMn%LnOgKg?PGhSuk8>73Rwg(?yQCPQW3-M1&Wxpas7)>A##En4#@k`@vNaj zKe+|Il8Iuo5{xxyQhS;+E-28`u&OUVC8O7NeTfIC9HqT2###pZoson*ap zV>Sq9XfvRZj!sB!)Jm5?e4BwWUZv2`RiYwMacmt&spIb8c8=o9qxEogpd&1&2L042 z`cn^oiu$=Ws@d9*?aJ*JvXY=!1DNW+4pabU(C|e&zaSeq#VsS-*lyd}885#OlU=qWV(F+ z%?kNHVxj!M=283`@|3o8;$n}swBRw^e80eLVk2%-_h?HiHZ^?g@}zB(n=CiG8+K=T z(;5KyW5b^Qo-{UzIcyv&o08ypxM2^#B=(h!VrHTqo+}yh79#*W*D{jF5t7TDwh_z5Y% z2shvJxJ_Jx+tmFiryXBWPRn9Z#mebKLOCIlc2QcAA2TMF@WYJhDaQ0$#>4`edH^xK z`xP<07K@3Bhn3rysZ+6-Hp%QbnVl_o^$5d%n&JPB;lIuBKSB8KeMR`M$HHf|uUyaY zzl?>yPK5uNm}+9D+qMqxzt2d1%1D0CNY*owzkXG9qv48fsw z5kqqPi!nO>#h@MkVib>mF|5bG80X_(4E*sgGy%}oP(zTQt$7-G{T6;s+plm(D&YFP z2OKhP%vTX z`j+Lo-g4bwxq>J%iJNS>rdh6H%T;E%LY8ZRCiw41Uv+&D@ z>tf-W1ee4WTet<5D-0L6({kFLg6lto>jk*JD_lZHbITN8%_q4&oNAjZlqDN{(a9&| zxfOy`Kp7)^+$B~|IIUt)6PL?MYQ#S3Ce`T;dG+D7+7tC{Nf=qxtjy)Xw-+I{TSSbb zaOaLxPTK_BrwEtS6x||qL^vUK6JBhQBw|*<%_;S6w)PManCB#x!OFoGsg@^Zj9vDPZ(evnIW5yu$jVYhD9rx zEU~N9v=t-p*%kOXZDVjR5-t|!bm1z&UHUD6OIAz-E?I$3!X+zkGP7Ir$!Me8MMk5O z+hw_%SrQq%9a;&w-%~^64-PYHIj6 z8QVw7eIBvR9M*Wk3J)5P*svOV>-rXT+CYBQ4`Ot7^}X2Ws%=#4y?@p_h1$|d13JAI zo$}~w-JAD#UE93&RGGz1Ft94D%)G=!f}cb@=S7xfn{Mc0hvK6nLLJ z6hWl-_3zk_S*CfIRIB`x(>n^~g(8ek?JmqL~6Kt05*FTq3rXxIt%JX`#PcZWa0iv5CeP? zdh1I;_Ocg_%;RCSr!JfWT1=1tdP{=_M8n+McD<<@K?6Vo_vD{+YrzfBI3Ekl+BjBQT6!*+ z#!;iOr+p&$#6j;6P|G@;WZ}(kT+k2OfrlC(XOj)M|AG>=wf%ASqgZAAwmfD>``&Ro zH7@#~`7uVNh416|m0V)G*moa^OW+az`1G;a_nf{dGJVfZB_E14b}h_9fZ{lVl~S$- zCS&`Dmfu&W?^Tp3$`9!S-|3n@lM}3iY4)x>EL5%qn(bXM-s{X~S-;pOHuzS7wzN~$ z?)~R>VzshtyjZNvW`D>tWOJ-?2ZVQpR%uJW1%=yxi<(_#hKKrHFY9;Sd0gaNAvQtA z3V+FXWc{}F!L)5(G-Z72gVeWaKa(cUsj68yIDs!*jyIAoyoy?wgeRv>2tbJ^R$=J% z;1dO+!m#aQuHgt%_Tn^Omi!kxu?l9g-W+q~AVd+pJb68iMVPV=20;q}a*OR;OwX9< zz!D@2`jx&f%m4H1<^Ltk^8cGH{7;;3!P3^(lNlzyI}S@s=y_%c{SS3eyQu6F2R2u3 zwDXxdjB;+aSb6w--uGOH!6w$ILa#dzw~vK_s2y)QsIU^+DACe^KXQuPJ3 zwPCt_oUVPi-PHl5*VPX};pOyQ!xGfOFF{F((IC4u3!#_Bn)#nf~>*{ zmXrX;b2h{Aj8IpSa$ArtzKS**j&MC4pxl?`|0_%IFZL9sxDT#~)`L)trh}qOZfBs- z^VuBYzi*cKKZH|0IJ<~f1_u!9r>n3B*C*V7lKXSQnjepQxvl74ZY#Q1JpMr}v7U!F zrwQy73h>o@^(m2`68R|~Pyd1S&DS{EUF;bO*LJwJQa29MS}%=Eu?I^F-(o6!EBDF4 zA_ie2jOmI-u>t8iu>t9xE$}WCYE=@TfRieO5}x*{9sA%714l780tI{AT#8VnmWoN4 z-F(j#Rux|&gFH(fCX+C}Jr1vq!$|Zo=80Yv9k_|(cMc z_Cm?KmEoYtY8_Y`QE`wqK(N};j)3T4Y$*&m#qse*Gs1k3R))sKQ{^iTv7~T%0Mdp7 zyQaLlIpJ$S&xq4?=<7#%VN|k0N7cgh+;5RIy#`oxx%& zMJboz3lX7MGZ7ad{5!rxg!>rbUKRmwC_Hhxk%$lwD(4S=jtIe^W*p?Yk85fMlK=`D=t*v|u z7AVPvAAI%By9k1e5paYE8?{cE5^c3K7@7-3oDpsLd z1qGn(8ho|m3*@7drC_#aydkeX&2KTu1L~(j6U^B-drF>C&yEPK8yRAMvXv|vvnC*1 z6vpwmiLiRaXwV}PC?~v_ol;I_ma%)2gxD@}K^1*P1D!MZs$(^*gcOmCg)5z zKT>g8#J);Q!!dT`r3wupF?JSa85@Sx4B(85ov%7pG4}n8T`)!7#Hrk(WCULzY!}+{ z!7mv*Vw!Or-BERLiBR`S^9n5-iM0zH6ZgNgJwReqZV$x%yFL87J^bI?9-sGMmZpwyTx1_-eG|nvlk1Xxn|5jDTh8x0vTbYA$0mI{y*OoaQoAeQT$DUJePd>;?MPCo zYjwtfj9;fzrF@irI%QPqGRG^)52nB1aHfURCZ)ZfbWvKSeNj?w$|={;)WB_dXXRb{joisM-we)YNKc7^b@-$L%MS8m{+Zk}a;#!ovFm-nNPm(rf=Gt0q{WFgw z^-3>wJ>guP@h$s-jC1V2PWcW}_Y(x%HokvqMlONA4v(2+VoN+WQ)A4oJ zc4t}2nG0b>0eKp>xiVimNFJO_PTCLeJMHF`K9Yx*9zynjEC(Z$0KQXx_;=i z+X_+!+dfVDL)wp$Bk3VFV=HldCuD8?1B{$licl^bEAbqp5JoW8V zw{vagdG>2kn^G$sJ2R@%M!I&{ra10NADy};>9*=`;U-G>4Q_g`-yK|E3l9YgLX+}%N51o&sJ#1frl)aSfb&XAlqNC1Kbq0v7?l2^<9^3! zl=b4IK&n4&U9vM}VAA(dH|N;DWq-oiE4@GJ?wx^D1`%Iz zYCa3DihXGtT-I0Ai12bDE*SuqWAGvea@f=G3BP}J|Fu6$v%bo*Fy>daMmS8n!`=sX zLXJ&&wJF{DimG*9>4-}@g#j^qFe{I*KERzNb=&m^r({@PtuW%su)Z1!46jW59QLi=tHXE_SS^!@a zqBOn+SMji4kLzuHwbR0w`Fb4~UK)N5`yIUF_lL=I=W5nhjqu^6St(@xd9jup_Lp#H zeUE$N^+&R-uRekguPp1UBS!2XC45D_8)-}X=&2uPTVI{BFgZrPz6}hov+#4+*W%8& zCT-ie_AKkGBKYt+%ZlsIMh%_~Ux)ouJTc(>KY#ef+16LDSr{{}1q=iisls9Z5O>nn z;#)rcaUbie8u;+)W5vZ;TwYul;IPvGg&y}#oU^a5_0@U{W5#uz;nPoiH3m$l zV}P^S3JjkC315v*dhMD4)>mWWG2*M4hR?YPUtRHD_=R(=uS()E;;Zi&KIe(A*p7L< zwy6_K<@xHa;Ebxf42~!;;yss0@fwITUOc6WM zGpphrh9)lwzc(RdV#+E^1ams(`kRYNi|1Hg(kIqGn5FSVLOA@Y>aG$iB=jk>OG=B4 zP&!b~x7*7~?^d0BO3bxTri-Z9wN1&#Er3ESghYZNsZ!MJ01e%vV*jW|YpTgbzvwi7dY@ zGz+gpzdh)#VEJt~m6umnSsvpjO-l6e&zW0{>{-U=;nJ{F)B#rW_Af`(f|lrDC$}uMRUrF z?wC<^hwX~e(z#`fx3a3_c3Wx5%*x`bs?wqvm9vId&X{vsd0ElS&}<_pqhw}*M2ahm zkEudS+K5 z5`$c1@^ecy%GL(E30vCB9ju+Bb;6@52pYVOR2Uiws<}Wzaqg6#fUoR)* zaG+%%QZ_#jDXs|UE&iGlS(RhstgQ48d=Zy_SZ|-6;foZ&Rp|2RWAKA93XY^~cXw{Z z>Y8@Utz_ZM)-16Fa;G+LwJ$oR-52hxz7n=1IM$g?yKb7B#6 zqc4ABsLdC>0cQetI;*nUN__f?)~(11pDX_Zrip$WQQW!Cr*9OC4`K1;vb%>)>TR!^ zlws#n5}%Ur1dHuSE(f0+cyjQ`$tNeCoLB$`ljcSzblv!!>I^OQ)tu}-ZziH~%^S_! zV4-%+Np0@s%d;5!kdyklnmyQ^%{e-tJFmhguIlta#539z&^=eV@;6pr1|tt&=Y}rx zHQLg^XnS4YDm$%0YC5&bgYhM$WjWkhwsR1SX%g)OdZ;F8Ac=*%W;MOzi-bfqq0Fjp zK;T*0;-`_;puX?XfPPROdkH)0&dKxrkyKxv!yg&z^5vnfME$H1_2bu%GgVAl-;?_AMx7!k<3B9VZn9~fnRqHf|tu52@G<<57x2c zTz=hyhq!1&9Iv%yfTCcZB=a2Z)N1F0lo?Z8_<&xheUD=sE=WWrthHkox`Jb??bQR^ zSa$CmIw`pwwmY6=TU{TAx6bMG>FaR9bM*{RmhbpZK^)CpssSHPa@z6bXW~l`i^J}% z^Eh#C>(WWdN%V9kd4_tD4}0o7jwE;8Bxe#1IVu@0{S`tHDxR?rTrV?LhoCQGXs#gEqd^?G9wVJddmyE0(kXBa94 zBYn~WdLNBbFaG>Bp+kZEdM$i4K5CuJFrv<@{L$f8kB>U94B$h5O+&jc|8wmzZ%QD) z#jX7i`{l3D9>c*RtK8aS*i7v$+_8x@9-4vzQ18z_3V3QTe>dO&9>=@YdG(&!X(?Lx zaabLAayDYNM>q~^;l*@Z>`m3e^WpO5oYcbQaQMWI<}H|-6qmI|7yCkadhvkPK(8z< zYf`UvE$deCJSbC}vIqW?GPATPo3-pg8Cv$Fj4V<>CT@XDP+>!k4_SWQhfTM`>5Qav zjVS4dp2S1jR6zv0+p*c;mBFab})I&HY^-5FFnZpwPQW)bv4r5homy z4JS(7k}=2k0hG8CG4zoa$HKh$4-JEiz&7!>&o{+%7p8_m>Mn@R;SCqZ-wx=X#DlHr z(U(6E8)J#bOQk0;Ifndvwc#U1OGZr6OZJJ~M+)6#TC?vpg2LYo_(>^s%uU~(IB7zW zgg}B7U3QP}ATqE!?;`fhnpO69_3I->=H|!xb!rN1w*D9*4;HR}VZT0lq>%#oM;pk2 zJ@waJ`u~T3y9GFNyu>OJ{d(R==s#lD3B35Yr|^a)_Wv5_;;$gAPpK@xWra7w)VD}~ zZnt_In3oJfvv7H%^Cd#wMOb#d+Dt_^$;E zU1|to%#sXmXhMEH@LvZ^Z>m3V#nP9TCw>0L-IRA=ZtjbCbG0e;TDINYxyD`7k{a#v z1WTf3&uC9tV_mjywL6C)`E>W-fbP$ownCckV`YN0It}VvB{;yN|F!1hRQEDw(Lbbp z8Ehx9sJ(gK#Daw#j>@kG^flPse{`K2VgX&bb#Cx=x(3&|)1@n?&YjWbLWE+J@7C6O zbbqFM;fH_m)D6JlQ2Ut-v0`K}79em)I|#qH!^q8TM68t2YIqe2Ca5>bbt{3$J%bmf z!PxlQS%HWfi&@@vcS1H9n*(c?&JLSx-Z>tUCugat-~z^!;M@s)a>w=+f%VTF+fO*Ma>ts%kL|yV zWVL(%Zf)OK_*n-+Gr?z>;IoCpl{>c2GP0uO)FOFuhiks*1lS!1ZEaUbdwFl(r?5p0 zM8+aNlr@bk1@(i=@P*A=yH~6I3mn1lvFgpiXkq7TvWG@L*bHgWuU(H`<)l`5DLPOG z{NT|Xh&uaW(}`eyL)F9pw^1uU)-0ZvBC_v|nx?hY#ERMoS=_o`mS| z#7Zd<+)gWB$^a*M*m!7b>n*~gfr3fRo^}M~AF@@;O2M88T2`h*o3cjBMjC25&<`Sv z{Eb@eAbw$QZi}dhf<9qJ9?-EbaFaMNohuD53Pef<`y%(`dg_W(-N#lIgtC3nTe7gS z1wu2W^3K8>cg@~ZPu-rnFwljLy+mL=Y~l7I&|(<*RCzi>=#ID zXma+m`LK)?-KQS}o!=b#7z>-Q81)v-m$t5{P_v7+;KM$y;U*BHFFH;G**Jv!<`@sF z?eRIw&@*@XUSoCPLa)D3``%N)2K3;5U(FW~n7#-9Ky-FiTb^a%N7;3lx81L&2>ErG z_k>?BM7O^>%NS$86#WZr?nEKu7G_Byx3E9OFny1abx<&t6v>BKuR02Q zg?`>qm>GJyqc9`%!;ZrA&|@8iX`yIGp{uRV7v2?!1ovyT4M>wOIv#?`7p}??7{_$h zoaodZZ)8is@-A0%C!_w%N@=2C+rTrcUg3%I#7hYdTXs zxlX&@%;C<8c^DC_lSvCii`!9Ov2-KGs&st3mMLjF--^4zj2qi;1ov0pNk}J5P8mLB z??x2fnUEC4}tg)d8>?)#8#LEQ!1DmO;h zzC43&4dTXg0{wO)_7SMGM2h|+Df&fH^z)?XUy`DKN{aq5Df)3z^nZe)tH0Zg#!SlY zYf)E>va27Elp9C57$db~(3KKT!5>)^jBa*6#%v~~;mAbr?4F1%k<`3NbtxXbr5m;R z(XPO*FAze0)cFn2L_1EXyD*3&^B(g$aI`1>oWcAi(c)I(AsHt$aR|f{e8lLe0Z(A? zZ{u%eAb%(RRs{1m;9V*PKOl0ar#9%&!u?QV7f(*s!oA?|Ts#?rA_rXFoE9y73S=jk zmgnMW7!ZAmM@i#?U@b-|2zOW@xqX73nG#RI9}5azYEtm;Koeg{!FQ0gPY>!Fc*LHL z^@4)6d-XjgcNYYFNsNGf`m_@P{R^+Y9XuXuoBUMJOglktAJEHASj7F2zvigm_#@pl zr!9`Z%Ha413}wpS!|DV1r?l{NG)I4Qf)cAA4y>ncaw^UwM7OkHM^)b-bpRisJjh>p zRAJTBwo1@Y1@`6lH+j_t)%e z57@s5+B+ow6hah^k~PDv9C$<2c`aG=xM-hiO%@HZ0gER43}Rf%t%q71SQ)A}n#+gS zIVvB51HDdsId8hfYMuRZJ^j#)FZJ}Z!<8*uNpPJdTn@O-rk)8qAcdOS z27B}qV2*LDv0ot1nQd~#L!{bp1(}Dw4hpy($g3~1-~@!X=;RjU49}h0^PofMbX8sh zF(@$PGr@@SjBw?!+@eT-q)%_(ut~k}X`c+L7C6p6fJmyVq0JHF>OGF?3*m@$O}(K7 z>D2;lTn1!O44^{?%uE+xxzkc-Z@$J`X0Nv$54-C;8C0WqdMDv&51x|5lLJp5;t3K! z1G2vX%ct~Ki!*qK?2oYpW)0%kj?T#^tWKyUp%c0zp%eNK)HtWtFiggw`+>Qoqg(qygWJ{MUU16Xno9?b{tu?XLE0wO}AdtMh{y=_immi<=DaN5^)R0=3%32#Wn>K;I{X zy;?jAc`q}?Gc=HlMwRIRHxYs#8sR*n+eE-!T1G;j$;Kh0H~LJYWq4D~K67e9;{bEO zCFI#J%-agn&1aH)aWPI;|UuVxNE=A!b3qR zo}5ium?R@QKyS_(WKIj8&o_dV>F5J_pkZvhfNrqg_+f#*E#vjfv(XJ^%aipmUJ%@E z54%Bjt>;*c_{VU?b%?iEV{UD!yUH}5;e)WXm!yG&8)F$!THRb(>W7bJOk)Faj3Bls}!0?gQNz^SduB0E|KO$zG^pS-z z<1(#Xq;--9?-|{BcRhSl%sQ#Y_$p?dRBrf4>m=hr{7KbVcTH+{+l21c6Fq2K4UK3l z20N0MsBIOHA{b(n%7F94o^iVo?X2p`k;6HM z-D5Il%;?$Qn%SLIHgb56UmA%lf_fN;^jWiK{#{z)p+iT-X^Ba{&|sp;(B_C&Jcp1z z-S7XD+23J_>fZp!c#=WuW(uecjki^#KS%FNOom|q3v3e$t{j;-OWY4(y$oCvnF=lj zEwrnN(b_J;i)I5OfF>?KF+B5K!oR6qO_Uu>ZK>REcmuWvt;1L7mFHtvQsIf@c*A?O zCmMoKT0T*qv!>>ag$%ShueQE=-lG@;LL6`m)i7I%&Jy~E&Zb~=ey6*0C8P?idMc)) z?U2<&+uDM)(0Z03{qcQ|_?{m_2ja+GSJw~UBb>M(v|3K8nZaymy#h}`eKm(9+G1{7 zB9)7nHpOttUGt?j@0%Q$Mlv0~VVS8u9sd~J;YI4aKE6o6fho^GDrUdw(gP{fOQ9p; z-1q7%bmI)Satx&FTIMn#a9;#LB18n3;)`Hbb{J-7#Z0=;Zdsuq2yI@I7%AP1#3rN< zlcFJLWg(9R=d<4rUD5h;U_AP66hOw%J{skex;`0oeR`t^O_Wx9KR{GL#DE4U8W?0Z zK6TfuOp?CneLF&1TF1s0)i1i_MikXBSyZXM2o$Axn4|BL!V(jubq-1k1r?cug5s-5 zDYDdhDllKq<%MuFe0k8S!uY`9<79SZ90G&Kcu{ikL5WhUN2yg`)UCw&#+TUDZIvvS zwo(?AEDw$$Fu=)e#we&aiXg7&s=W!a&R5`#QnbQhQ5s>1vRvcUFY2b}wRgFCFaeNq zIo45QYF>LV)WSwoyAd@ZRKcsEFMyI9t0=?_3Uue31-Ax+FbVKA9E2H!GtaAk;$8?% zu)cfYXQ|rKwR-S9?U!pP6c*I)Ln#LTPHTj&a-_d=Rgedi-3;MS8ysrU1}~sYmnhwG9+P&WJ*xi<6A6~eK~XA} ztprS37E}bHWuKuBOL7fFgA0x?)?&}9^1Rl+rfXW&Wn-8 zNsOIg=pqXS-l=1TIxoGx&iOSzc5w1Xpx@A^;HSCk#%g}Fy8L~iU$)J7^#5P@V^C<9 zA`&gP;rhDFzY)a}6jkCLH1VAqnl8jC+^kDJ{3EBcFE+wv|KzZu|H-ps;_qPT ziRz;e7T>+G7joFy!SUKN>%2E({nEA4(-3yqxiR&7`yc*pOxX2U7*o7sI(SK8mt7sN zVZV85WK7sK1?!lwYYONT77|O0K4=NuOlo@&-3&2Bd?0Rj;+`l$2}sfCub3*AZ+jNs zFss}(A8FOSrR32P+S%p^>gbUdRQPMY%&K}2b8%WNDI5GnC^-%O zvW%0M34997ATzb2!CeP&q-MXp(pkHv%p_v(l0+ z&|M&UZSJC;VvU*3^bj9($n#!7R^uciNJXbp=PgN)ic&D`;E#F+p=WJ1LF4FiGLFf+AaBG732>N{X0Utj3W2wgS+*cJ@k{ZAHb|4q$Q}(H&_)mS=h^Uue9ND zy>UX;=0h5IAf`_t6RU%X%-g+nJ&B#8Ey}vSvC({lYNOtlwiRP@^w1eD2Hl1s+!6 zp>-c_{)TdvE${megPwMZsy==8%7v14h({Jgft4U4`^FAi#WRHQPlyt<@UTYMK{2Tkr1 zGkcs=Lfr$@M}s^nE1x;2hG4P~se%le@D>DMg55PS3fP%I0sq>L&g@wD@350E@w)Ky z?NehNo!PO(^gLHcn4#w(m*VxnpAS~X^gJfZi`i}E2$ZSkF&@MpH9v~okvPEBY__cfu|7$-{)K%`US6(|1o2mo zS}MiwazhrOeo6EtLuoq{yKV&LDPYP3#UV2}N z02YIU{$N;AS>cUN9G4Tf6BrkldEv5f!$u`oM=gLbmJ7^_hT_A*4bK&01^G4J1Gg2J z#hhKiW#NVUb81Te>3lo|^rZ{&=Ziit zQLsmDPTjeAIV11v%dmZs@e`q#s6HAql@V z1NuWP{7`?0A!4c%iNa{7W{=%>{9T{u2H?NjchS0lULVk&U2|O!r;l%J4REafvOn{&3oJ%|3+wK~Q`4t?PUj zZGZ)xf8zmv-l>3oOGQBc?);#>C78D|p#SPoz=Qhx!Mt|@`tN@vg4piM!zP(;vdatT zyL@@rw)m&)wP^8_w+%H?FCI4d^U!a-xkkWt`|>a+KnwKmHw%wep&a=B4n7QUr*H$E}KU{&lcTpHQ!qtqT94uTP zAf36wh0V-G!A7Uv6k-)E+#i(^G%w z4*qo=(tQI7{yKh6v3D|`oVHoGUoKpnJCJ@)T7G|m>zm>&^#tsLoHmxnmBK~6d9H9h z39@1na@wAOi(Dptge{IOtN8?WPNm#`lbf~$BFjZeS1+nSN_k15)3V*U_!U6V%?zCj zy%vnMsOr*FXd3euQg18m!?2105GdV#1D`;2?sUwui2-?RM6NA$*U^ z%)nn}Zeb?=dgT`O!e8&)Ld^e;(Q;wDL&K}Xv?|216+eVzO2*pvC`&;&4`sJDAfZU4 zkkntHyXH$*Wq;Tee9f2NuKlq7hG^!cK3d*4)UK(XPCL3i<`jEBPO)>>erE>kW}wv+ zGwU!XfXPeDoPe+K7E|dNuqEh?JYy~$4&)ls=x`WQ>2HU&woxldO9IUJTN)my-Jl<% z$Si02VNS483x|*a%+gLr{+PLjeU3ObL>81|a4r3$#kYJ7hjQfOYG2w1zPtxqu@EBT zGbPv4S7S*_^cH;n&_WWc{#oafWS20`5L{6&%me}F$jM1zVE+N$N&;s)h^O;La5qG^$k-hFGYmv)uZM!rVy%3TXO)0YGOxW{a!SIDDh{ z|2~F$VXm6>MM3JY)`_}Nz+kChO^xnOH15Mb{ja{7kK04gKQ?1j5W0>OakBMeK}9t0 zF#y#cz<#Cx+D8NcmIuxZ14mR91}>*yS2(KXLyd-84fr@19a{j|*(GdP2VhpW0Ebo$ z^V>JU0-3Y8f&4X`zV+6w(`tW!c(7E$ukQ-Nys+j&NA2g1|S{Tc=Xq-K%MUlt;f`Mb@bSZ{#tDY+baz!88|jIqe~d^8(l#xFvIGax3t>t0NMH;rlT!#i&;RJW>_$<-3k-x(J=V{q4{2G!8a6F zVLz<>u+i0Mkl7l@O+o!_Ut~EO05^Az{6UhQWRj6Zf}QK$mVoXaU9+6zXRC(A-M9i@ z^ycYkm#b@pAG`zlf)kN(MjLbMt6|_}i`0He`k|FdMnI~O+x+>g#2D;GYOeiG!QV5mRqLN%mLe$ zV@|YcKp%hNXKcs+T0Uc+$6(ecW)^LRH z(~tYH-#RAgBcXPz`GaXLR2)>HVh8Nb)gF^!h%u%=;u(}RZkT6;?FQXBickIdbg#}Tg{EO;sM_?thoZeI?Ls1P=q8719{-OrH!wGp;2+3g4 z$<7S)RNpHhmDrC4>_}OMu$N;NF}A*>9o1Vs7a2i`hzy>91s1admAf^IgA+z*>H=e| z`1F(EMPSJ}42I;K(<$r^C)UDoJ_qTp5i9PXd-+0}_qti!5G6U%4h~tv6r-I_r-7*G zi(vBS?OH^PVmZ>@39ONVAt^MJ^ z*DLjz_lyooU{Ye&)$fh}-RJ@#X+*{w+fkyt;)#bSMNMnj+movj4*RlbNAiTKQ}7StJe zlf4>zOxA)C#^{oy3^Xu>U^wn0gUxPN;j0KixM_@IHYzC9LJ+YY^hB-%# z)4^&4o4H{aI1C>X*$kUHj*283fvh)bTr?9cjb5iDE1`S^J_2qMVgx$WVJ+d85&z%jYtb&du@ZrH{p0Qv7m22i5|%qJzDFtw{DFCDwV% zP?^=Yitt5%oj6M+F82u>1WW)jT0@S(LBN;=2ccTg;vmVOveuEfF&zjy^ei|C6#!U} zc`2G|!Gvh$jMJc)PVp-sRMrjTj}Brjw0S5x-+qr?}MFCD0~S2u`%1@$a`0|^4Q;ED?YIv$k++~%xvXS zDXl;R4Mct~#gwIqyacr$<0TMNq-X${^lvj08k|>uS1=RqEhL36LmC-+4(CJ8rYM5V z{eu`t#)~3B{gco(vX901E-pS=bNUyZHpCImZv@3!KGRcM%tL3y2RfFcQ%QogMBo;b z{A%%vgbdSh_p*B7lyfV){d!X;4&hu)PfPqj%dnUUmcma)BZe3OX{8;9#S7VD(Q5wr z7p)>QK(fdH=KTz5_b=MZh91z1+qK$XAyBMJ^EVvC%5=mnbVe{+XGedcv)OAu9v>x6 zy}gW6LuRHCDVAp;UcddlVEEJO*$~Po4}j;e1)h*&tgmd*Xp}=}At_sQF4(7N(d$I+ z4Vi#aUF!f4ncz|#h$ZwC+H@*>ATz;^9%kBaVSV})9ARK3wOl>Xh$69Jd6#V9Uy7#9 zr4|rAPQ{wGxAxu8!)Vr_Fq(8|VZ1c3ADaH2r2!}U|Clh)r$=F62iCT0;Va`Cttkv- zra%^OCdvY_ZY(AZID11F$m}W%#QB=Cz}s=MK;rVJM^JRKX>wVGi%5CRlBh{9|+fuLVpBDmDOxN}>TZ2l zG=h)fJS*=-w_boQzMa}0(L`gF6l-|U!N_)(&~BkVh1M0#qN0aZ%P4V9plqU|rFLne zKTl|)=#S%@sKMNfb_cbdXtFXw*<>eI^w4I}JlSl!G*Nt@+C+^`*J`3PHn2L~fp};g zhZ|%Hv{JK)=EDaq{0ervXsS5hJ97vmcg=6d{1{qp{zln4+2yXrt_Y%$Zeb%8E2hx@ z@&O8hFG6)}q%~-yTKHZxDqmcuD;w&C?C%j7lunIVe)|cmy}}qBhp=))&Cz&zJMNk3 z9HIBl!u{6XIk?}}8)NgV(%wdYjB&c~$re8Bk+EyTBo_wv*#jZFG~_^M5&DB@+sDue zwtXkALzYe2=#Vp0jQ)5uhm^7}mTlSSi=DlVt~kzDbj8rOu_sn()U#2(vQclhTp53> zQ4baxQK4iPhdKo!GjaowyGI8izhRGBvs@@gLuobtE#>lz*pPp#zhQ4zRoulsIe`Gn zsLpMW(lNK2gLP0j#`DTx8kR+U44eM@3Ichv3c4urVqbs8uU8@he0>mKi|3|b+Q)&s zDhLZVPlwO}`$jEm3W)TTKD|l$ zisb}3JOYr@NSxJi3az*+7AO`Ry~bc<-01#oBgMp_OAn@67&ERaBla}Bao9Qe$+&`--{6QXJ-Elhm|vNj{H2SpI2FpTcHI8om&GkT zFusayjM@PVFP68%&T$b-bN+Mt-;FIjFwK@SY-U`S8R2A#ul%^P7+3A-Hz2n3;F}i4 z{EF$}C6^w!;o?`53sbL)ZH&s)^Xg^Ab)69o=aL=vvvH?KH}ln;54 zt{rwW=20&`{vds9J=no@U(`U{$GjPrB$dPFBmSk&t43UWA$?YN!%*#LUdC7EBmSii zhfwAveZFTt;y=mOeFMlImS)T-EiIoF`%H%OT+9REbhr334IpB$w~?m=!wCr~no~Tl zNBv0i>@vej$D#BfKds(Qox@h=J^O3s_%13Ln!P%9?#rGChmdD{| zmEtq;%z%nwkGG5O<#SO{Nm)hF9o6M?N^R0Tr@H(ObK^r}QHhZrY>8OXZM(ysiYT_M zBr$->V(i9PW$rJS_^#U$6C+YYOPx)@Q^m&Y&Vc_BB4$=DouK zz;_dpa%`17gpKa@lq6RxFSO?#o)W@%dp;McbrvZx5XC_Tw(n9F2*?9*gAx1taH-`0LlLP+@sw_mAC3`9Z|LcHfDMKI|E?-Cn?V$ynp zCsI5g>qC;T1O@Y%5w{D+a<^dQ+Bv0vF#15d`&g3})I1$n=M~hv9b5sWEgk`4!BUYR zW_v?%+e#uB2Tp~>up0dU2} zgR_0w0~owxXPlGQE!xd~pFZob1o|w09#$=TTYTEH&35P?_T$Bz=GlI+V5Jmut24l~iDc%-s2=j|fBd>++t)C+)OjEd&iNnH`1)tcKF=u|wzY^np z6n@$MKy-K-%&^|E`}3N>vI2Ps(+lA75s*kouIasIlYZJ zt#aZJ(@VGpN^dy6@puC#@nFzy?K7m+rlHjHxSfl;=It!Yc31E(E6cr^WjE}-VZX4F z+5RgC2^EXThJ{*;i1#z%gj6xlD3(Ja<0)baE>Z1r%?;%(_5}& z$BsqV-u3K2B+wUSgq=`yY+3}>0d~!34t*pRuV(<=Iuti-OmiieGd0dxH$*30n-z%O zoHaf=@G4j&z>V#yghd9D#dY;7gZVp{6n}mrlZS0+L?SmKkxbpkTKGAHiN*C=_-Q!Y zucMA_+>Z0V@FY`*;XH}^_|Dg|@XqY7xHCmf%Zc$=o*0Ns;*$G5DFGd8??LuhcVF*f z@@Zxj+A7lTMtH3yxWx+~;l|F2YFN+H%^I?ASj@x4fG>P7fV9Vw7A_L)lNRzJ%CLzA)V~I+1 z{ZnMWyy2tcV=2LdbDzyth955uMTP7)Dlfric>w%BGBCvP61b81G##`qX0M}1+(@c< ztc!zu4N8`ALeT+r z5sCTuF>r4JGv(7R;pL4qbtmEl!_$G;&=of#(MJ2{z}XMlY`?&dmzCeV(Fw-pWASba zFy|c-uo$k3?e%JKg&;6}K9e}A0c5?&XY)>a`7JOj3>=w>z>P?><$e|Z?*LP4=mSzs zT$goPKSTiQfSGXw09;l+h9?@~F9m`802u#qi5rAJNiQRWQMUB8*_ggRoG_o{zrc-@ z=VX{~&VgfHPq8aT2-SuTk?t-9cUz`)25 zZMKD31@%{sNVL`G_lLXS3bL@Xd|qxsd*ks($ACNbGuDL7b{d+hf-LMAkl5U89#rU# zbJ)sam%xokXl}OK&;bpMKSBg>fg6=T_5!zXRQK@W7kx6O6#Vv%?TX7P=!)aW;(!8< zbaX@k*B`hqdca+omq@3hvBu$SU)S_a?3O;#<+xd0aozJl1@%M)9P77C5qGyDE~JRN zM-jI`5w}PI*Bki_E8y5ZexQJ(4f0PEa18Hd1sua$rhv-??i~dj!`rEVV|WJ@a18I1 z0*-X5-F9X=<w8akv7Giu6$mIOgDb1su!Iqkv<06BTe&zTc#PV}6Si zaD9NAseohp<|^Q_ft#;@WBPOj9Q(mX6maBMzf{EiS^>v?;ROX8>E#a!IF`%n3OLrs zI|?}R@!bkI#@nHQW4v1NncF4H$ZMIG-YJq9SgpB5t}O?hZv< zg#s=O;r~ zxDyIE@?G2PGxH7NoC-MBhf4uRc_T{!$Nu*cMO>Z&j{Wa7intpTaLn%%MO={rj{M+u zMO=jfj{N=}1su!eK?NN9qem2QthZ+raFpABqkv<0uPWe}z7-0%vw+*8fMdV$S_ z;7%#vSik*mKXZFyco!+)IIg`;0e2yAegz!mp*s|CGz6(qz_H#QQp7!`fFqs$R1x=r z0*>ihrifdqfMfca6>;w?;5a@ypolx9fFu1KQNZ;B?z94q{O{~L&P>mwtMe3a4DV6} z9NX^|3OLSp6e!@B--!x1>W5}4;7A8$3OJ_kUIiS>?_mWT+vO7qIP#6>6>u!)KPupu zkCh5I>dm$&;27^G3OMQ+IuvlMj{zlTrc=r#mnz`cZ(XH;y|#;93P-4seqdaO{slin#j~aW#s#hZS-ErHK2HBJO93 zxL+yYC||v(i2I`gj{M+N1svthdIcQo_iaVoW(6GOh<6onA1UCd2X0ruv0Z+yfMa;4 z6>yXj#pY`KH?E%ACF{e*P1xeDo^a&5*$O!FwaXN6EayT++>Hu2$}hJn;MfnADBwtc z&dS#Qjnc_o5>1RYhEb0*-X`mI97+x?2IqdOM(iV|d3Dah(b{ z(zC1V%{S?h!@Yy}NXBBXiubx-HvEToT0*>{&QW3XR0e3FK`&a?T^x5W|xxJC! zCoACCelrws9QX87z%jhx3OI&$odS-0W10ev{a}d#j^pXM3OJ4f9#X(D-XAI8$Tyx- zz>#15Ndb2;aBnE!7~Tg8IEL4%fMa+W=ITtidG#bWaUQ#`0*-V#Q~^hN8Lfb0c(*9v za)7&40mty}SHLm9ixqI}e}ATcqyFl71sv;Rg#wQJ?;Qmk^#XepaBN4PE8y6_IV#S~ zuc)8QP{5JzUZ8-ZKJiKg9P=?&0mt&2qJU#NpQC`g2)O$da18Gm1subBK>^3|ds_iV zy~X$_lg3J^t@34M|pCG0#3~9D&Qy=A5y@vU4Eg6vsay&PDxj(3OKfp^AvE*?`Q=a z+xayLIJTp)3OJVEO$s>D-***o9EaYeh$~mXF@04EIP&`k6>y}}|5U(H4tr7oN4olr zBJL#x9O>W{1sv=5H3b~gw@MNBmLhJW0*>XpT>(eB`l|wtbkL@VJFb9ZypHNKw{ymu zrGR620~K*Y6mXPJM=IjRD&nRp;KyCATZ*{x3OL3)Qvt_*`d$Sb`=cina2%)nNdZTF-FgKa)3;v%$NW0yp1D3a z-#t(P$NY{^z)`PqlLC(PQlWrjykSM$FBEVr=f5c6*e-V};F#YN3OLe1zjhmD&k5Na7(0XgB1$69N_jU;Fw=0k4%rddeRdzA74|zF@4u6;F#Yc z1)R{oDB_+`z>!YhRKT$v?NGomyiXNy)s?+XBE;HW1|zyHkiLVfH21sub>OaaI7>PQ6~!yBW3V|X_y;7A8W3OM#} zcPijmzxOHP{!0PJ^!-`^$8!0j0*?7;P{5I{HYwm(&VNywyyg&g*IvAmVV|e2fa13vz0*>`NUjfJPbOjvw(9aZb94{;-{bhjyj`TcP5jR}{$Nb)zDfR{t7tqt8Xaa7~W_F9LGoF6maY>XDQ$~e!E)%M|!SN zz_I*(tbk*@zgNI9ym|#3%Wta!j``THfMdKJ3OKfpvlpJ3UWmI)0mpc+QoynQov45# z9TX|x7;l*Zj`1#5z%jr7rHFe@0mt+$SHQ7;*DK)2U-l~CNLThnXRcr3`Y7N89Vp;f zZ&xYcsCV=$;MlJgE8-qhz_FZvtbilGdPxCCKDk-}M>%ne0*-P{ivo`Q<#7cZ={||a zhs9kz=`l$M*$Oz$*A7y^QN9|kfTMoHtB4CK;K-jRE8s}aw=3YN2f0rH$NE^LfMa-% zDBwshk161okDn^w*pB|FfMb2Ut$<@Y-=c`yqkv;R+7)o5XJ^fs>6v`@Yy}*{8?1n1 zc%u|>tlxkFj^nMH6mT35PEo*-{$?oP7+$FYj(lyd0*>WZqkzi+?lA=%^|pUh#4T0C zy{3qJQvt_%YgELoR=}}7-d4nIQ@}BOEebf&%SQ@0(m}f-?z94q{3X5i%Xg#0h z@aTH~T&LIR@M!$ba(L9ApL2M0oO#vZQGcmAJUSox-r>=GhJ~iv(@Teb@9Uk@j*Bl-l&%bhb zv>d-Vy#Z&~{fg>a%IU4_^je(W22O8FhezXMw8NwQ!R`)^uFLjyc+?LjIlZjYJKO2y zo!<3MugmE@;`GW+?=`1aae7}my}Hxuf2KW-s2_x!-bzld#p!M6^rB90jMGavy#t(H z+UZSkdO3$j$D<1!9^Jp{ba+(XV-An%d&S|=@we*m=>FsaIlG_Ie1|wZx(~OJ!=v+! zu?~-}FL!Zz;~gGd@9*L8Xg{8Gcy#`Etiz-GYdMEU`-4jz9v!!CaCp=Y?sIrF--lJhN6T@d!=rI|j>Dtt#`7H>E$^ickNUwK4v+44-sAA7zF7{B`qfhokIsu< zcX+fPsyICAf1f%$T8^5-qjC9z!=wG*?+%aFbLcF498td??C@wk4|jO9Ki$INQGedi z;n8~D&*9PiwZk1AweJLnN6UMb!=vqXsl%gjbdAHK{lWcC?{SAm>#ywa=s5F=!=v^0 zp2MT{_qD^L{p24GkNfisyFb(U&|rs0+haqANBwlP!=w5pIy~y9$2dHy?^K6J^Mw&F9?f@UhezY1#oXnFr|c(lI?b=dudycUN?=bcffH{RjVdOqCY(eh>;9`%>=9Uj$pox`K{-RJOV zfBKBWqxIM0@MymOad@=63!G7)JgTq%1$IB6>(FH! z9=#8KxWl9Rws&~c@Ar3j)K8Cfcyv8;hQp)%%Y_b)*57RokLLTR(|gY0(e>b44v&`O zBZo)p`B#TW>v_=&?fydRWw67ee!8B+qvK_p!=w5pI6OK|AL8(6IWi89`g6O(qwR66 z!=v^5ki(%ZIXv3F zhd4YMzb868T8^BR0zT zJUR}}ad@=;{_XHqgZGicqvO^>dAnbcx3tr1c6#eNz0I87c1~|Mr?;=uJJRW$3!(*Y7UQH&-=sS(Q+(!sXdP9b+Dx!9?f^K z!=w4G?(pcj6&pA_I$rMV@MwQ7C^CraQfJo!+HR?>eVCJL_&pEx=?%Ej-XGBY z$t9g$i__c6>5X@KM>xG{PVaK3celf%^Ui0S-Um+aXNO1o@g=Xaw=Z3XuITXSe(bsq zkNV5z4v+5t?dtI8zVZPMkFNJmad>ncb+*H!`Yv#IRNplYkCwO7={@N5o^^WfIK3~O z-tSItiL34YN9$#X(`$8lZBB0&r?2zZ;jIcU?eM5SpYQPKczM0UqtCBC=JaMeJbFE)?DSrCdT%?ukDT6@ zPVWb&_lMIPaIM|{X#Itp-trEQ&i__*dh0kmdjH184v$_p*xupM`PD>+N8{))hez|B z=J4qL?j;V7+IPLfqy5I+4v($_UT}DHp8bi_``+pGyUy-^bl$#{!=v{z40Cw2zuMC2 z#hu=MPH&RKqt~s@aCo#m&Ubp(IK3{X_qfBOe*dDwqt^#NaClVTHx7^L>wmr7uV_Cs z$mtDsdMyr*j??QqyfxvCcX)K1KH1@|4)1D*N9$#d!=v^5qQj&8^Lq}Dw(qwNkB&zR z-e7NE8s|$mJi1P9c6hYBYdSotZxe?{`|&Lu9=*Ob#^KR=nc(nfy(AqToo658@M!x^ zb$XXLJlc=n>hNeeN)C_u)hiB<#>XcPuNmGVH`@J=-VeN%!=v%Lox`L04sm$29A`Ma zTb*9F)BC~Ut&8@paFf0M$lK204TCqy;nDiL(&5qid&ud%@AUe2+RIDx9p>;_;O*%2 zj&pifIXrs)!BY;8j$5BNy~S>}*9+CRfx}x1-X2bGn!}_0%N-7n_E#l`NAK`=sf3JhezjY{cf|jFL_HkJi0y~;_&Fab2EoW%e%e9qxC%A;nDq#w8NwM zwmUrPR~I=v+E3o@@Tea=?(k^7uQ@#Gr(ZfedOuv?cDo% zy$^3=he!2o>F}uk?cngJ-|y-0XnP#u@Ti}j=J2Q=T<-8_`*u0KIS!BdX^+FB_56jy zqxJlg!=vRGaEIOh$Xn6jQGZ#_;ZgfGad>px+Ro{Xad_0Pc6NBQAKJ&^QGJIwJgV;m zhezjO(;XhoH}CLhzBf8Ns_$-xNA;B)9xcc74v*&hzQd#We&z6}zMmZ))i>ZyyWi7t zEbZ{9zBQcQ`c7|4r?rU@&hey{b z?>juYFZzYUqki?h(+hOj{h8`p%;|+49vzQ{I=vANk3QeMrPJHZ=^g6yvQF<}r+1sf zqyF-Q!=wK4g427`>3!hv=r}#s>HX^T7QM^vr!?Oco!;6`?_W-D2dB5E(>u)Ro#gap zIK9iA-mOmWVTVWeeV%i8bUpK$(|gC^(K!0h>3!w!=(tdKc(gzL-Qm%7-okg={hsPu z-QiJvBOD%m4t%V`qx)BBhe!2Y;_#@xha4W=xA?%}(e>MJ4v*H$viI2Qnd)2L;Zc2K z93I_=OF6s^;GO62sJ=N4kLvr%;n8?&zSmwa)bH1Hcyyh&j>Dt-5gR%@I=*e@@Myjx z9Uk3p8sqSq;T`Dk=sv@AheykMrNg7`ah=1X<-Nt>(SG-Chez#u*x^z8W;wmG!=vSR z$?3i6@MwA8cX-sVst%8iAKyB?-yI(9$AkCT-ggx9*vK)93E|t4u?m}dzsU_*6H2i^zL?g4>`Rj zoZhoe?-hqfV9|!=vNE42MV8s~0;ws_#apcbCJX^YKR<9&L~J9Uj%U zP|;q`RNpX%NA<-W9@TfO!=w5xb9hwWqYiHkcpp2w_2Dh@puJwGeVaQxYTrH%kKPAx zhQp)d{`C%z>bu|JQGKsDJi5>Nsl%h=@9z$e>I*$&uV=b$T+`vv@qBBCN9~I_Jh~3p z)8Wzn;8=%8>v^ifqx-BEIXrs(<64JD^>sNss_#*UNBgzs93Gt)zv1xc`t3u9NB4_= zb$Il8#gY%({fd@%b%#gGyMe=_<=xWZQGMGxJnC2D93G9M105dqzbOunw#PXRkLtV0 z;Zc1LIy~y9uQ)u~zVACcy1((A)2ll?dOzIn4v)6m;79EKN1wwO?(pco)D{kp>f7Dn zQGF?gNBhZXPVW+jNB#a5r+1&zD>=RA93EYNyy5iTcY0N)_l?v0#p(5X)b4+@yo))# zWgH%j%fSwh_PgslJgP71@Tk7s93IuTpTnd2j&pca-!z9u_2nHNjkg;e9_?Qqba+(X zGY*gHd)ML7eVQ*F9vv5&9<%!&)wi_6qxxDL9@V#*!=w6ka(GnVz7CJ-JI>+JaXRPl zs9#;}@Tk6f93Iv8tiz-F-g9_V-wzIt>Rb46yB|<}%?^*Qw>ETmbRIFm;Zc1DI6SKF zOovDHUFh(rz6Ts0)i=lCQGK5|JUT!4-r>>ypkK+}ZggF?w8Nw0%y6f-iNk9`eNl%; z%iH!h-g+BEHbA5kt-ttxd4XUkF#MPU_MNn^Y5`g=6X6{pF5NGWhFYV4=UoKnhX3-u z8#wrvaj~giHpgZjKD0SDgXSBEO@C(6=-5o!*959uAmy&2#$P29DM zxxPKMtg(RYpTuUg1)q-6>I!6I&5KW*J%2DS8j^zXSQjm_F4}_gVxdWk#-`3`*?Z#W z^p~;r7h~>AA63qvqK3(xlA?PACl= zHmZW3?%30#YWSN#``F6Uqw4)Yv6*ALW9?({|8aF)68zOdu^H*$+>M?dIkcJnV8o9P z2Jyd#=ApZ`6%PcC8u1J-_S_{$lwvdcqXmtgGIPUOvGy9)L~8Gevs)lez)$}GE&I+) zM-uV+xE!<#(=DKe*T>SfL;9PgJ$~*^^DXT*|3^!^cx*;Ah?O;Y(-A+;jW`y1(0?s- z|5>pat={FnR+sy(|DTq7Q^#^I^Eb<#4*p+R@CbG9R@9Gu&Eiu}7!;T^U`AUAU2y<9 zQv{u9zOCGf-iuY&7=Hh=^DaS~b4E1O`-d2rGkK)N+R>k7th5zh#sFx0kamzVfM*rC zQZ(S~8BOxX>!PU9amNsGcRd6|$G!f6$@sko(;4`^E2oXY-Ma^!u|RB#X3XQ*3iJ2I8M{3Zba%($m_cJ*(($;_9qD-7=#JZf{=Pf5 zzc~GsNdwW78iTFTHRe0N*n-xucGAgz_D~$Q+DBpaj;lBR5}j;G8Q{}P1E)WMInLeq zZwL6F-BV|aKVD=;fd1|*{M~%BANjW%c=DfH_ivgJ(q>HF>ho1`cH?iwz-iz9F>fBX zWLg!p1s~Oiw3p^PmQI~AD-@VC4kfc>B+b{}E&uL7H|o#B`rkBnQEIN#)Vr_$r^C7q zUV2~J1RgpqpvEw!6O+a;J{r^*#wUXs!}vTDyCRlEqNld_rQ*pt+ z3(*3skDvYl+Eq1997ll~>tbIbUc4!w#xW=dY8->E2F3%h zECfaly#I*8sDbzYKC=C1ZYhnVX(9Yk+sy5{r`8u4ctNQxJ8$^Fi)M{(pEqsRAmbXGZ5>-Eid~y|y&YoNdOx|hkDFgU7%n1Lf}OHW80sKwZA&L{UvOsXGXj-w!Pl=AiB>y-jolbmcZlmi#F;M+CJ@b z+Mjq3Am=)?-JZq2VpPqnk?kM;wE~J?K-{>@o4IpSJN3)JnD$9He`^00!)Qdnz{wGATYZ9$;qqh^#K1NtC-Q4_G+wgu|ubMlcr{{gFABm>yCY6?Xw@G zi!%O;(P$m5?5QVVq)r$;_2h71QhfgSX~dJ;Mva&^cema>+FvhK+E7*Rr3%*5yt&6f z9yQ`)?%i{@9`VfFeNhmb`meyG%={J4p^6WI*jw%VJIeVh9n=0ZH+4+=2l9V8z{&a< z)Bd?Ee51U*jy-VXFTDbDiA_Bz7?>3Pvju#}LlYMN{3NVWoN-_|aBVz&-lSFAo*qCv zx_zIZ91qYnWgd-7(XrD%j?FkZFllJp)BT6iHXq%-*U&%Z5C0;^Q0FR74?tH%XV5CK zYxs-R_VhyixT3xPtmoUm7}@=sznyVX=<`L@sId!vQt1UvzXvtuu?p5+qb6+UZp8Lg{Dz+?_scU)fAjDdJt|4>@;h>dl?vIxRh@T)9JVr^WKCH3VMx#i=BGE z>Dxj>5T-~aSjQ}>qhDr5F<8#J=LG^;XbEbUKvu$ITn7#$up;+?js^`^<| zj~emH=a-<6{+Rp3=l9`XxO)5ib}n7GQCPq~Mm+QR4fx;4_NPz#47c5IgY5?1KXl2qS3e#(?3cC? zbG8|H|Hvhq+FyRPGIB&^^wcL7m^yo*HvEj)^v%h)wEb9WnzRO#K}&8kbFp38iZr(| z1Mi$QdRBF4+pJ2z?Pm6mjvO}Y)elE>ua4fk)r=)(eK2_8S-9DNYqZ8t<=r=(>BR8U zKX3qk@6Vh01f|}MF>*!|R@T}JOj=;#Y^)Yk>AxmPT9C5k+(@-k~ri=4Q~-~M;jj9LZxl8i{a5bKxmuL zuDP#?wgYXGaeYb1mJlytc(`@Q_0g@^z9u^Q(|q^tOG1X>$KJk%N4FoSJ{q%qO-m!B zzIAY460$+~p>2Ga;Zgsj?Mnx~z9xFd5P5V)-`BJpLh`2fB_RuocaGuFJ6@UN%gu(j5^}2VF2kd7OJn#U!y7CfpYQhJ4iRro9}Y#$_@VhegP*>p zRr(6&%T@)`*nDxmvcJRC{;u$E%7*?;+20kdjzZcVZ~a|3U)dV-abLJ*U*UXN%Y57y z4ns)m`GdYBWNV4{so||{f6fj=*)*aI`Qvo+7uxj(|0z!&EU{>OBf#AlP51}c$>rVOj~#)ICRUv zGtn&v&lH73{XS(ZM;jbk&qo;E)>7YbhPRD)CmG&InQzwcMv2#Mc-zW+&o{j7q`pfG zFD72W@J5Swv*B$o-ra_`gLn@c9$iS&cAH~(bR9t+UGVlb?TC=PHw8FafAqoDbwcl-?gOCn`z4I_CB<9H@b-o0 znfCKYaQ4R!ZMS8O`5qwN@`iVycqmA2bxqrORS zXufn?v#)6~LaJ|^;q_I={MqsN2i>dL!>BInd`n*ZVD#Cy_Mj&|{0 zGQ6|Id&}@x4Sh^^AR})v!@Cm>9aje$UYB^w8s1&-sK2aicz27py5Zd;-nxc& zuXr07-hJ>q)BTX>5_Airz6apYdfw9Tig4&S(`I-N!lCn_Z4K`sIJBO}7~aF;?Phq7 zz@u@rm*G7Mhx+q@hWD6wM;YGZ;+>c-WKml!+S@(PQ!awyn77q-{L)Hc<+h#jN!d6-fMIT?=$h%F}$jHn;72b;%#ksUx+u> z@aBq_FuX6t+u!iM67NXE`;T}h7~a?7O*6cjc;_14H{xApc;AY5gW-KAUYFs0FW$q3 z_k(zNzjdF}kK(;-ct45vuHn_i`^@lu7Vlfb`$fFp4ewX+f^?GK$MhRA8kb8O-tXcK zHoQN?8)kU(#M{vD=wzJQx0T^F!K3ry?G0}Mc%-DN_w^5%JD4yhX)3&+rx#FK>8@!=vqcwc#xx-c5!#P`o=0 zk3LR9^L@bZmK5)C!=v}TP<@TJ%>({nT3Wo9jQR$N_om@3Bi{Rlx2$-d86JH~ik9PR z!wZY|li|@@|N@t!uk4a9rN@HQ0h zO~czry!Q=nWAQ#SyiLUW+VCRc{bYEXiZ{>jHWP0E-L>`WHM>1{&Vx;)M-w3-MMl zJo?NmDQg)Xy>F6~4Gb?T-sXnaCf+E++giLG4Uay1N}FPW;f)k;AHy3Z-ob{qt$0Tn z-ge?0Z+J2BPBpyI;+<)D+lzOu;q4&aC5AUfysHgwtavvW-j3qkX?Qz{_kiKW#e3ZF z=zY7?U!FF+UBr9I@OBmNO~czwy!Q=noOquZ-gxo8Haz-7JT31}hDYyHCU2hM?JnK` zdXb@zi9VK0^$j$P*cer?$ z7~T=^Xb4?xct?uYX?RD8cbDO%#e2x`juwxf8upi-{?~sTBi{2yeaDLTy5UU{?>)nt zEZ%2^cbs@N!#iHQpA9bqk6r>>fNo;-F`WR9ZpklXcqhW6w<0ZScqhTbe}TmfZ;I5n zgyEeGk6!N%8Qv-IXnB`5yi>(n&hWD0t!Q|si8sXXP8V-A!<#DJnua$`ytNH)Iy~CG z>lxk|@MxTGXn1GBqpr7w;pN2J&hXmdd8V`AQ9sz(sBZ>5>Ib_S-r4YIc@u^=6CNG+ z_cgq8#5=_B&K2)y!|Q-Y%X@<1ohRND!#iKRQw{F|@lH3q3*mXDi{MfJn{L#1F+92j zcb4H@BHnq1mlrQ@c$dPX?R&N1T_)a5hIhGmcN*Rm;yqw^SBm$z;aw%((}s7ocrO`V z0Um9SHx2I^cr=dQGrViX`^@mJ6R&1?*NgYF;oTtK0*j%MeM~osx2WOWB;Fvy>lANg z!@F6$H4N_-@zyiETg8hQ-fiNw8Q$&UZEtvYz@z=uu7-CfJnC2D4X;bQiH3KVcn28X z-SF^V;4s6x2NEsE;f8mw%=ak6yAK}iUyd`p`{B_zI>qoF5bsRGD~i`)cn^wqso^~Y zkBSLV0C*C4U^dTX7U%WwvR}pWp z;e8-pi{X7J-uj03k$9UM-pAr?Yj~fC7dO05#oNR1J`?W%!>fvSq~U!oUdHgg5bt!u zn=9VghWDj-7aQJJ;uQ?@|F}$DP(fMirfqjqjIy}1W9$(3HavRn z3)T0$;jJxRx8bcL-fM4_~6z=d_u4iy7X( z#0weT=Hd-9ye-5F8{U@Utz>vxiPvm+QSpWvUYmF=hDXmQqJFxL;cX*ctKp3lZ$rZy zC0@kvwiR!4!`n{0#&^d3bC-#UH`1tYw0JSY+g`jehPQ)wal;!U-fo6BR=kAa(Q}|^ z`|f3UJBgPxytsG=7~am}r3`Nu@eVhshc=4tf-URWo zhL;d;n&Is(Ue567d0Vs`XB*z0;&m9_UgBM7coW6T8yx>~C0@nw((vg1)yIZ+w0NHz-ZA3+$MB97?>obz zFD#+<)eUd5c)uIoapEnoBr5G=IvyU~uNz=^8Sxf3yc5J*+VD;kZ+XKzNxUJ3N6+7* z{<6B^oh;rk!#hR1bq()S@kSV4R=kZ2?=vSg&2)O_IK6Y7 zUWd~=&*`1-^e%9E7s8|a$|+;JT_oONhIcVMdfnhi!@C3?jgQHOmlyA3!@E?x>4tY1 zJX+qFhIhHt*I{^9z@zb-H@qvwyTKc-M*d zrr})=kM=_q!@B_g;k_Z=3WoQlctZ@YN4%ki_m+6W4DW66h8x~H;%#7f z?}`^OynlB;@V*o8F2nm?yax^M2k~YZ-jCuvV|YJ__p;&D;d!Q? zo!&1_?^mbyo74N<>HPtZw(ncUdYLEQ2Zl$3h_BxauL&NFw{Hw@0r9>!ynf>SWO$x! zOU{C*kM0-$@_(s5?|g%pFRefRqS!wEXkqb!gZhvVEh1jX@D>#>Y3N2?f_Rr2-iqQ~V|XixceCNGEZ$v)H(0y}4R45e zvkb3Uyk`t=74cp+Jo=s(>Mw5@-fH4~Xm~^6(SB{N;jIpjuH(Nkyfwu8(eT!k`TlBn zE#fsTgPHd+4HIvG;jJa!;)b`jcuN}|eIF04zvT^YUGat(-f(!HX+5cLb)&vk@zyrH z5#o(7y!FM~#PBwNNBfN}3~xj6MjGBm;_YB~^u0$k-(3uE6Y+L8yoh*7!`oE6gAH#p z@s2dSe~CBQ@HQ83is5Y`-c-ZeQoOSaZ!7W6GrXvHdBdacp`z_}wc%|o-i?O0jd-^k z-bnH8HM~*cJ#2W}iuZ)!Z71F{h8GjB+wew<_om@(FW!5Gw}W_}7#@8u7;U#N4R5S? z-x=PH;{9THJBin{EN0%v6c;aOcss+R^Ou2!w~Kho8Q!kq4Kcjk#9Pzw#)-F{;f)t> z6T`E%FDCQu)pZ)|1Mw>v!i7l;|&9@4%Y3~x`VZ&$9WXpyBN&Udr(H7w<5`J3zc64evnljyAl5#G7Pz2a9*S;ibeo(eMrt z?_|R}RJ^R=9VXsX!#iBOGYszt@!AdVNb$}#yraZB*YMKfoo{$Yi+7RX9V1@e@QxMl za>JV>-c^P-S-fiu?>OLA=`y??mys4DTfI?lHV6;@xj} zC&Q!r77rTUDeyegsqpByFvqAbE8Yu+cba%_7~bjPy>EC^#j6_LH1WPMyy@coVt8kW z*KfJL*W#JtEoOK*c%G@<>7C{DX27HVvW(Hbv&CyRyqV&yZFuLvqt|CPHoSA;QUBY_ z@H)iX#_-OA=b6rTdKWmo3!UCYPVZu;cL_XNe`AdGl7~kx9gH))OX1OVzy!m)Oy;|{ z;ax7?!G?E*cxl7CQoIuk?<(<5H@vIGn_+kb@h&vHYs9e zcY}Dd4DUwqo;AFi#Cz57I^og#pWijSo8ft;Tb$mlPVY8&bYJvSqkXr-qwCALhIfZ} z-x=PW@M!%0YIt4Z^$+*GcJ2~yal^Y?+PAFX-6P&$!@F0!H4N`Q@rE1T{qXQ#U}M93 zK)g*2uPEN;hWDU&TN&O%;%#ks4~sX-@E(Cj$LW~iJu2R=hWD6wdmG;4@H|t=>CJL_ zPdL5VPH&FWd(!DW<@BC*dS!UD-#EnB9?yt(wBbDqk7j*>;XMb5_G?oN?|FFi`p0R8 z_X0dxjx!DKMe)uxyqCng#PGVsyV~$x7Vjp*dquoE4ewR)9x%Mu;L(2kal?BZ9nwIao)(^y6#PB{8Z)wB(NW7H{?_=>+H@r{88*X@?inod3eFl&A2T{YTiWf7y z&*9N=Fm8BXh_|QV%@yw;!~0UaqYdvXcyxU<#qjmw2$d`@fI<>Kj3+$dGKg^3^MAYn>pkSF}x;tw4Yqd@D>nn1H|F; z#l^eO@RktoO2Zo{-i?MA67NpKTT;BD;VmWJEW=w`yk`w>ka({e-ZJ97Yk13w_le;x zC*FSyFD%|qhPS+UffX_6`j}P_Z(+k*QM{!LZzb_oG`yAJ(f(kl;SGjI`>S;fZwS19 zn)XM~#B)1{sRh3eVQR(i!8)*S_ z3YT@__i0Q;{BERW&@?XV#_uzkD)`+DbT8E6m$WX z#XuJ`B{WTeF6FW`=nAH+rX8TGxhxO5mZ?+IBIpJ#D}iXKngZRLRzSCMSyid7X%IK6 z@8C29x{Ik9)L5cc(7jw10X@JJ(=-8kh|7|oN14)^W!4S-j4sPxX9|HDZEgnja9N8|MAI1P9Zus)NlnwB_c+Zc%cej| zDWho)^c|-ipdXnEns$MH=CUH_H>R?tJ)n79Rsk)5KGPJaX-c;`7UZ%ZD998BHI}Fa zv?!Ogf|g*4gO+4UfCe$8K#jl1fR^L3ENBI$0%&EXPEa#b8MGQxH)su}3aC*_4K$3) z>Y#O)!ng^r9#b=DeWoaABc>QA!juC2izyA-k|_&n)Z77T+ND&|v>QZwpr$~NQdQGB=rB%c2i>3$s4?GW(2<+%bALxtC)H~^sQA*fePq)Cc3n_i75!8?^dcbumRXjf3c0gPH;f5Pgpi_5zw_K=d6uI1Ym7TW^{I9hw$E^o=x4 z0s7ud`i_{UKvB~&h`zrCM-ruqrZrHR(>mxmrXWrM8f^}P=sQW80?i=$mJqaF(zw=Du})dpeaz-G>GrKq385B1wtTtaz0uQYAjJJh>n>}0s3w$dd@sruW15A z&wy_VBtcC$I-&KNW){bb6Ej2 zoQb|!rID6EBe<*#+K`F9*QAkFL7Q+{4YU~(eXB?#4S}}cvM?yhMBnMrNF$(axGW0V zmWjSmqmd>-qq!^v8pD(W?Zngp+J&hLG>)kVqB9rl>p*)lRX}?))j*A!0|W8Ri(D22 z9l#U@HPRN)!Cck~I+Q66I)W(yqBEhUKn8RyQxzY0GIdXgX6XsF6lNbl!!23Yx)`&@=@)hs)ARSxq}Y=W&`>qGv2N zYA%8<k*EJs^5c2*y5$p4@?fi{~8B zvotXFL5=#FLG+x9ra%jbo;-o}X&M93Qz4oHaS%PH0WH-u527>Jra%EiPc=ZRG%bPX zi33f6GKii5fS#x+JrjaHpN}&w5Pf1Et-|Lg=`-v&E`aD$e=C8AF~(BWUOrOziW%oNo$4qA-M5}<)h^tryq-)2Bdaak6$3{!`u z1yGpFIzcNk6*Vn`26I_AXceZ4rZvz|E~|sqWD4T_^Nsn2L2GeYGiY6=R!yUzRxXQy zHegCgq#^1JrcH^=LXaWoAN#&`C@YO=F-_ zxGWAjjVY-qy|-x^mt~Z4n&v@ga#~R8(zFCRi_@}FkET`7OipV`fpBk|L!b^$!%8ih zMnD&E8dZvGngm_UX-X-hX%2KLryWWKO}ju>a9UKN*F76+vIlfErxm4|rUBe9r}s$V z{)-_&4B1#LD+jMb!b`u(R+7r4hN!l(_rtT zX&FTCbip|sh~9gGy^p3f5WO!1`*9GxQv-WP+;5|+aGbe;W;3;d8ZC{2p5n3?h+g~0 zaYoY=h+db+nHz{+DMy<%?EulM*iC^vh+bDln>D5TpLC^tPS`fYVfYxgo1JUaO zIC6r5Olc6^JIB!qM0c~%W>BNPJc#Zz<7fq*Fm&MTvM0ZNjW=*Rgx{HaU zDX5t#uySwBA<$}E7FKG}Gy+i%Mlp zdq5j;T2ZQL8W@bb6`Tf@!l1^wY61O=(^jRZrg6}goF z)U*uRj?-?Xil#Nt_MFz0fTc#DWPc!v@54+rL3kMpz)mM zl{z&of_CS$q|~ix1+*8ZRi(P7!Difv;WVVw43bd`+K+O@e8_~(^jRZrg6|! zoF(6j)$p3_dHqNZigO`LWsRWz-EZsD}96dc;y<}m1XPMeilHI0Jk zE;GijQbN-d=pIhfN?A=iK=*T+SL)QX2zrpyl2W&(70@G`R+Z|S23NB%^(@S zpeHzuD8)2QfS%+usg%|<3!*#d7{5w+O*=u)aoVL+(zF}&BBwn{RZZ)lmpKir(Muta zj9<`eoVF-MG>w7Y0;Dx8*;dNi$qKH{{d6j-yj z%^}dIoQ9QJG>w2h=QOGm*E9+GlGBt@M$;VVYfd|q3YvC-zU8#2RMxZy^aH0ArJAOJ z7TgKsG^i8?$@m5R%4sX;52mQ5aZuBO)Hf1JDNQq={+wo&Iy5bS25{P`RMfN#T7=VX zrHZCC(Bhodm4d^1+Z+akIBiyH)ierPn$wt4LemszSx(bRSxq}Y%X6An>eRFdT8Yz= zQn#iR&=5|mN_9YPTDVwxsE^y*YoAgPqrGz(gr)0|RX(@xNE zPP>#!ns$RmaN46()wB-Ukki20y%Yk;_yujkX^T=s(->$oPUA{RP1B$)IL#>KG|hve zoEDV2G%bO);k2yOqiGeiEvGf5z&gEc4uM8<8dhr2Gy)pKX;dk$X%e&(rzxe3ra90q zoOXc5F%>lJ0?{joxLQ;yYuW?alhcY)P1C@-xYNsNP$>+O@eA6Q(^jRZrg6{#oFo$1(+n_qI6M{JCD7fRmX&%mt%C03 zw5Ajo(c9(_sK{wpsYTNW=wVKyN^wn-pvO2(DP=Uxfo5^qp;XYc3p9t*qEcDY9?;XA zR+MU*2G+-&cTR&!VNhc$w18gVv{fmpX&glF8Nl&ZDWz!!^eU%Wr4CICpf@<}R4Qs( z2ED~;w^BvZ8t7e4>q@~5dfOZZz0Ya0Qmdv>(1)DHloFbzK%a1$R?2GH0jhGESL)QX z2%5`jNvT`Y3g|zaR+Z|S1~!5y|1~%%Y5J<)^XdzBplp>nOKnrskS4wJ{1}(;E zMk%Lh9yE~Cf>M{JCD2lwmX&%mt%8=}w5Al;xVOzA5WTkrcRrO`G>w2(mbC0Zn9zX_^2fxhx6VpDC?r7IYAoS8`m-T=qGgURM zgECwe*bJ}tFoi%eLP4i+Sqtbirii97&@?WKD5U zz4r@un3Z}ot%5G#w5AmJS8tm`po=*TgDz!i(KG_Og3F?ytC`}OCPCM7SqgLmQ%2Jq zh~9mMS93wPG8HuK0^Px7MbKSLWleiP_i|YU^Z-*$)4=9%6*Vn`UgxwM)WcNKv<7;I%j%%_ zn1WmMwmA&?fXkXeA2YRT8U=mEWiikfObJa>ps%D8Sbr@_F;FvmanNc^ zNl@c2(x5fCETfduG!GiaX+fz=(-LSMPRmL?npQ#UaavOfM0@8O07C^gmStn>OrlO{0&^}z&4cd>XqG=6u zAeYraDW>4oy=@MI4&$0;9_O^I)T3z?^aQ6hrNF4(Hitk@ zavD}@(KG@oa~f5OYnlW-$7xC_qiGKGBBvcn1x>p^FLPQ{Dr?#UdX3YHQccsqwzx0P zX;3K)lJN_Ao6}aMsHSnyzd21Pr8LceDx7AOIy5bSKH{`fsioAbL+a-h%;Ztg9mES1v0l zb!%Dy{lRG!)D)z@t!o;L;m$jkg_N2>GJZh=IE^U9G);gO;WVj~)-(%RoYS0AUeiuc zh|?~mlBV6Dr8(_Us%lyXEz40;R_C;=)T3z?)WT^^DX@KSn?sp^n{ZlGDr?#U+KkhRQccsq4!HBqX;3K)lJN_Qa@wjC)ie&;hSP*nO4AHz zTTZh|9hw$EqdDzVDr#B=jp4LgsiJ8Ov=gUwrQn#}HitpGaN4ZYs%aE7j?ejRZ+LzO+QeD&FSlpNAG^ErFlJN^VnA3<-Ow$DD zP)?IdX-%`BBRI_|PvYQSnx<9I3@)oF1$OFfa|m<} zr(vZQO(UT5IE^aBHBEvpPo?#d)piaJ;rIXQmdv>&@4`4N(oIIn5~LG|hwl z!)ZaOOVbkQ8&1ngJ(^ZQ-*Z}13hdU~<`C#7PQywqnnpmsa2i#LYnlZ8&S^?1qiGIA zpRU8*D5Zj?U7&uP7M04H_J9`Rw4zkgG%yYoa~f0%gJk@I7UQ&4DXM84G?3GTQcBYd zXemy!N*$UOK+AC2sZ`Xo45CjC;(fkK6-{fP6*;Xd1;_WcISd-iX|qzRrcux;oW_(A znx;TQIZZ2NHSGYc$!T7xQ_~`7Elx{H-I`WF>vCFEs%sjYfIIJ;hLoB?GJZiDa2ipH zX_^3S%xO|7t!WmtDW^H5yr!L?%{lE-Drwpc+KSU2rK+ZN(AJy=61@}x$@m40;d~|c+KtniQegMqHitkHI1MYc zXc__S!D&<}u4xi9k<*k?M$;UKKG%xzt5ndm3$#C{MWwQ)J)na)ttizr4eWu}2sjNY zg+VfYL5FkNsua~UPQ+y}=QdZLr(3za(l{z&og3jW!q|~ix1vHb>s#0Ck z;9htQgVT^wGf2iS=mJh7N-<3npo=+8Dy22ef-dDWrX)ErIUhw5-&l zX%%!Yr!~+6Oo6?7+Z+Nt#ARX7qf9NDMnEMliz>x6O@d}~no`PWngcz>X@^ol(=O06 zoEAaPGnF;%0lma!6{VV{fqn3*45vY*Fi6HP=ygt8m7ejRZ`jOMBQeD&FzIfG$(-7!4re=_gU(h@*izvl3O@J0y zgtkHwv>;Pj(<~^+WjUq1rk$WgIqgy^Y1$21g3}(Qs-|_&lAH$i>!lD##xH0Pr!7hm zO=Fd~|c8pdTc&^kMngsoe%Th`iO>>|vIqgs?Xxas8ucnyftpi&ql;}^6&r>#m+P2-@koFjpf|ZJ3VNF0s54wplKKAb1o}_zGNzE z+5`HU%POF6nQEHS!^nQ%vLJ|_dV>2%AQ?xXU%9Lm^aoQ^(>SPUQTmGns6SIm(+p?; zmt{eVFm-5J04>gCok~Sb%b*aa-AWZrYoMh$tt$l&?QL@yv@EC1O0AkkLCbR*Q%Y!> z00I2BPQX;69R4QqweO8%{GyIZgARZ8-_&43Q&G^^C1X#sQur=3bgP0Jv9&Jpe-DOEJB zfsW<0t`tOr8*L8bf5&m!tkkM$6m$ZoF{Om2DbN&7(@I%QJ3yy$npf)7v!1}hgVTsoOw$DD98Qx;X-%`B^Ek~ZDWu9Va?4Z4ogj8ab1Jm^MF z3rby@mOwXiT2|`Ov=$!%8ihMnHFS8dZvGngrd)X-X-hX%0kB z;llV;DrnjTdYIFqQd!d;&|{odlxms=j>YR5oCcM`pvDrlfaY-8sua~U4tko?gi=b= z4Cq--vq~MB7C+No63v<#vrjA8sLRWz-EUgfl|6r9xC<}m0DPMeilHI0Ja;xwj| z&@=^lm(#RTR?`m9`<&)MA2M}nS_FN|MFJyQrIV->U_m$iTfGetCwfmY$NIA|zSQqweOO)krT)?&(Ong^}R zWd#sDEe@{1<^C-a2*fYfhh&r zktqk-nW+P`8&el(0#gyR2U8i;SQ|Z{iCk6z@ssNUHBIROy8Ck)1RcZ_2FZ8>9l~X; zpu?G>n#PH^ECD)(DWz!!G?~k?pbS%ore)AcT-FUbg{h)x^aR{p<+2!P8dCz)XjKYy zCYPl_XE9|p?EuZ>vOK7RsZ-M;=mIV)fi7n1*0ch;l*_81E12q<22aF&OfCz7u4QTl zHCojQx`E3gAbRp2-v6g*0(2{vB|&#Er8Uih?&7kXQeM+e(7l{?fgWHgY1$2Xh|7AE zs+!h8k8(;6NN!LF)M#@vh@MA?SICtjn#Mr0IgKkNHBEz_;xwa_(=-oyhSP#lm!>7q z^PHBIdNi$qUgET-6qwT6<`C!=PQywqnnpmca~f5OYnlYnvlj8>G^LEDInX(6P9>*7r7%cF8R#=kTa}`k#z9|jngD&pl+rWn)U*uxnbU5iil#NtZ=BYZf~WMhISiV|X)|bn#c7?kY8nMC$Yn85 zkSU>Q3bZJfr9n$DWi{;pEy-nh&>*HxO^cxAxU2+PfvH>53TS06tAgkmnRx%7romHj zPms$(pf#A9K{9?p!?-M>lmM;6Wl7L_OleT#FS4NZxhx0Th$*jWCy1WNi6aE)UrZ%U zyFpuWSr4dX-)2LEh(?0A zIPFj>Xxarjkkg`4S<@a+iqncxP1C^XxbMhmP$>**EKv*SNKRXoqMF7*M{}A`N@N<~e}pc6UmR;p-P1D(uiT`4%Vx6NTtmeXdXR!yUzshq}?5}Kw! zXK_}x`wHwX*cM4F6#l^#8lO^4!VWQ0@HCXmnj62 z@e86S>f)#ix`!#EX$*8fm&HL3G9@)lgC60s4CryDoThou6I@mRJ;_u8(X)E-xi-*q zOg*4RTdJTJxvU0ynJI8aZyEx<#${p9n@la5MnG?KSyU;mX%h5rPE$%5O>>|MryWWK zO}juJaavR=YuW?)l+%h*O;h?ZhtD|;DuqEZYC&Ie+Nu=QG!FWj(}Yq=(+ucaPP0lK znifDmaN4O<)U*t$bK0#`(XB~PF6avYp1+C6$i&8|>7>J%_ zjXStXNlnwBwK>fwe93X8o_BRFP?{+?v$xG*(6LSz?Ck8c-P0{Yx>!k_ zNN((Uq|21{o&w<>7@ zlKfqF+B&2=l+=K9w~{)M{;s68NcSsg1JXlE+KBY1k~Sfw9aVlv|4_Pzt+ds~Zb#ap zVn4Q${M=7k`3^>UTE&jE(gYh@iS(R`on@s48@mkY1r^(BrL{KpbflM6?Acb@Xk#}a zy{2L}Tj^mNyA|mT6}!z!AKO^x9M%L?Y+oylL~_q)0@8LBTWY0QHnsujJr%peO070_ zEz*Z7cDC(AtXU!jm2@^zA0=(D(q^P$rMt&U+mHq*-F7SOKuW8+(f2$O zRV8m4rWNb*|))Mp#J1ZlL=EkoK(Nu4%!J<{$=*COq$ zbepVnkB!}eG)cv7MT#hCyN%s}B)@SG;KpYiQ%Qr7(&~)DNYj;W0@6$+Rod8jNCzlg z1Jc1tT4rNAk!CC1S}UDyV>ckxs@RQI+GJzzL7JyxAGXp~8@nB8zKZ?WO3wKv&x4T` zs@RcMnqXrqkq%X{v#iu$W0xT{tJqd6t+lbIBORt<&$iM=8@mbV2o<~8N)OxEtw=|! z*lkG5lq5eB7FSYVq!mht~8j#XTT7r~O(psc0C9Ox2-=Sdkj&z)ou0{H( zk{(7nQAt~nPEpdwNIzH74y0cyY2<~hpDHPgB)?%1aAqN$r=)pE7bs~7Qd-rGR-}uR zt`q4}C9SuyXCqy%bQ_SaRMNFJb~DoNl&NgHhJwMh3V-6o_5 zm2{7d-GcOp(rrb0TuIw)><*+Sl}>&J?w?8;jFfioGNfmfZi1C6ZR|Xxttz&`O3Q3) zC(=tQcCD38x3L?LURALht+dI;-h=eIihbBhTW#!iq_#M;fH0vu*4~q#;Uo zEz(dWZMLxwBaKkHEl8u3w9UqTj8vj@JCMRk>U*il^GKv|N*6}jOG%|Rb{5h^rJIMe zkCK+y*jA){m9EoD>uv1WNaZSagO#qev73>msn~n0w8h45L#kA<+pV<2#`e98HBc2h z*h*m}_bQYk9i(C_tu)WZEDe2~UFw!a&I}$0UqzN{* z5^0Un%|bd>Newo38PW+#*NP;+BE%bcHuiL+la=mlq|=nN(Z+5<`i0VMMmj@DTanIE z(l#r7jO6Cj*~qG&itTHqkw|Xr1f=s-Y$=lbdJ%n;jcq`>MCq0w{Z>h>Hg+x26-u|> zN@v^HjYwCk*lVq{*~UJMbd8GLg7ilvZL_f-BmG(Fb|7t1Qr{~~o<}0xtaM?dzbL8H z#?C^zUFqf_-KnG{HntV%Z%WsRbgz=u+t{;_9#FasNDnLNS{u6==`p3d2k8kVZLzW2 zke*Vy?MTlkX@`yNdnK!WN;eqkMJ0ui+^bNE^or6|BFQg8F^;vdOOW1Fx@AcJR#K;p zU61sR(w&aYv_`t^QK>AkcoU2$jQ_^50 zH_u_Dz!346fD}?vrH!43RHSqbNd1(w%*J*i4OF_dNb<{8{Pk}ey8&qzrQ3)!TuGa3 z>^(@kD&50KW0bVj#%@O%t8^bD?V%*+YLn-|NP8;XNTdl$nqXrqktQqMETkz)YOt}( zkjj*<6=|xH*4o(9k!C2}*+}~-X`_wZgmj?NZMM?GHg+r0EET&Asai=6pIhM<0VWY} zY5{El+=ToW^v4li&3=F6pA#O>{)V7>aYX&b(k6T+pi3}Ubx;*fwO z$nPGtKr5u+7+48y&<-6Szj@RNs~`he$ibgEUL2C}J^B0!u1D@7ZZ)g{`Sqi9a4Z}L z$AkRRp!^r*mZ6*i?1OMI=hedg;qV^v5rpSp_fydk z|312N**{N?fm{GV2tgtAfotHW#QzM|!-;SboD8SHTKE<0LYm89DZGo%nWSGt*cXbS zAM}R-Fc1d8P9VQ|I0SZvU0^5-1NpVX5ik;Vg;6jX#y|<|2J-ucVb~q^fN?M$_JqA) zZ;;e#5X0+Mxr| zuoRX-43dmiqE``|%%2p)z<;4yd{UV@k56?hdoVHIQ`3pwb5)o>EL2HW6ucmv*q zx8Ps!Z+IKF!#gmZvN@jfd7Q8i-fO?SMhg$>=LU{1zgc@DW;3D#KFizN*Ij)Ov3%38fu^x=79VP_&lhCLts8EfO=R6i=Y7xg+^$C zW{ARKI1HA+;cx^TDIv!@ituPy3djQ=OFL9Q)a0yj|> zH^WNe+h7RspTcMGIShb-upc)2!(Xtu4K~B=@H%mCz?<+E{0nY?P4I8H5!&$Ugh9wV zK_BEII0OH_gjH|~dAX3dvtS#X4VR+341NojLxAgC0AsK(hJJ7@`~m(5HBbvzz?Coz zhQkOL3A@55D1|a8hYFYq(_lKxfJ(Ryu7Nv&WeVpq_yc+PBm4=jAn!}a<7tFP61P9$ z0dOE31P8+`sDjzh4jqt&PFMvQ$U+XfU^T3Pi%ItqIe)keehZhwMz{j5gsb3c_#ONn zu7PLZ1-Ozlu7a!KcQ6#)&tN^A2){>n4O|O@2#I1PRd z8|D1rO1KINxh8#}2;{f?ilHC$hXF7U425AZ9ORe$M#8Qz z3P!^im`gd&gE}|_=EDN0hlQ{Rcx3E6N}eBs$KfCF1Uv~_;3@bgJPpslv+x`|4_n~{ zcoANLm*ExoIlKz5!8Uju-hemZE%+Dw8{UTP@D98S@4@@<0elD_!N>3kdEqn*x!~em5z~Q=GKyV>!fQ#T_xCHiqJ4xd%xEtEA zm3#X)$Z~K0k~04_oX)=7_j1plgM1C)`Gj(R|BCoC;TP=7y)XB@+}{_lFZcHu#GM7d zWMA%mx$n?L(X#$4aP z_h80hZKTx!?U06_a=d|rzXoY*|G@r3AnoVRVJvzX_v}V^HsLu?f*gj)Z~z61)<^e{d$rr!cj!9U??kg@)ga3^V90|^)mXTjKz+kYV1 zHKqQ@$8tUc2sgv+Z~{o5use)}UqcwAZGN(T zpF@zPuafracf4&ASHRA&5bEU5xf&E6pT?t3QXcz+{p_Ft^fiC1zu~`q-v0n*4g&g~F z;$$3hIHC00GCsJJxbF$~MK>9mAOe4aDey3 z{{|V$$XI6`b~3iuiLer8!hWznRKS6702~BUVFnxu^Pmn6f%&ii7Qnr4u z$UDO@7z0CKH0%OHVH6C95wI)tg(L7glCT(-K@5(9rEoOdK-z_b1uzhHfmVt_6Z{HGaQ?naBsg!Eg{92(w^+*biny6?C6dIHdPC{GW#x;T8B8UVvBO zW!Mff7W@!C02vd$32(#uAY(=uBfbIug16u$kg@1icm|$@kKi@<4`s29@O8KcJ_9pm z`~vwC_!K^ezrzl=8~zDT!xnfF{sB9a)>DK}z~gWq{0AJ)^?QPE;XC+0xC`!w2jEe7 z3?7C@;30Sr?uBpQYq*iLUxzo~O?V4#fKBjk_!ry+H^bYo9d3bJ;cCkDALQYE!X#<^ zTtf6`B7aQy3G7Au-Y@|cqc1@BKJwj!cfwt80s1C*1^vr#8S*y5$KeBb8YW`568=J5 z1^f)%4)_MXhV5`V`k%vT@Jsj;`~u9J=5=iT%>KpXa~1M=FpvEOa0u)Ni(oD+g#BSY z)WNTy9%OysJ^UUcFE0_c5xzsX8aj#pjPPyP0!xXzmGCzB3%mvo!|iYk@h0EZ#a5;I3z<8U#)FOr6NR`4XcE$|fl6P|`= z;8}PMo`!OQRpyb33gRtI_cC1HxRPlPP;D&m6B2Yw1C!13@iI1x^Q^-u@_ zD1ZMkt4$z~OKN90f?&I2PS8a4zz7gv($#Y=9U%hJH^t6`x~Z2f9C!-Wqhbz*_ca zpf7_?ai|x9|;o2PdQ7iSVb`oDQe3znT5N!tHPeoQi%uAyCS zpX=cUxDn)D^!8JaVk`a3ZEy*37s1a#`ZeiuP66qEt^nz8OkX4Y&Jui0pCkRzFYx;X zcE15{Un6~t>2IX3nF-$hM*14*b8dnRzG+wm9U$%0E$FX+TDTH^1~UFKVQ zT3`wM8iLpyPIw0V6b@(qeQXya%UD4A{fpT@k2KDK_mHJOGWV9;SDWE>c$N6wVJ!R_ z!f-dVf!xPe5&niW*Te6Se~Iqba60=}vM+Ors|n8`yoT_6LYZ6q0r^+hoe95S|M%>l zM0hRXpWp&ynREOZ`3!8%f?u-#NA_hNavkBhglh@kf`7pma6h^S;6b<#GH@j4aWotS zKY@$TT@07NrEnSi7A}X4a0OfmSHacrJNP|Z10QmXqX=&%Kexc`@K?AF{tVZ{4R9;m z0e8aPunBI2o8T{S8*GNV;BT;sG~XockC4BB9q=uD3jYTm!kiUtL+pTdNW%vB9r1;b#pVz25KKpZA@;w5b;SJ?-9U5!ej6r^Z@I`nDUWQlT8F&_+gXdu@^vCvC^0Nl{c(|VZzp?*3JOf+dOZYoH3(vvv z@N>8ya@beHY*+A5fp7pE1XE!K%!4{O1m?p6mdf5*qjK%;1n1RKZicVpFmhmI0tH>27ZO^4EQw+U_S-N zKr0+dde>5>MaT=`2si{9U=cJyBg}(3I24w^;cyt#LlhQ6Gc16)FdshPcwfUV@CCdN z@4$QTE_l}>Heml9dGL_yRtGPvLX;JM4hF;h*p{Y=I}?AFwlNJw^Bg zJP!B4f573qz9;w=zJvdRyWoC!03Lu!TxL54zI(X(f@(?M7Wx;9s6Qzu7ytM2Y-Oyz}avfoD1i}Iq*lQfzR-L8@9kw(z=!K zHuwv?1`osSa3^erhu|*wE54)Q4j2lr;xvO>|aRS*>F6%H`u>~a2(-B==LD|kZ?TV<>-$@z6Za* z!@Y1H+z$`HgYXbM43EI0@EAM}7vuXPY5W8E33w8=z*F!~cp9F8XW=<`9=5^@@FKhf zFT*SFDjWwLxFGa_pTY@nJp2q!gp*)BgkULjLL1~@HFQB1GSC4l zp#@su7)U`JVz3OBLlRa%0>;2B*bj!oPOv{503%=|42CKwfg!LP%!XUvusiGlb6_sagK;n(_JleZ1v|q*a4?L9QkV`E&;-pe6{bNH4uScw z7wioaU;)&_LYN4XU@|O%888USpdS=LG4zFfAOihiC=7ssPzf_(7Z?VOP!31Ik#ICj z+lA=32(u_;NLJF-voSx|8GfmBb)%y zg*CNvoUV>Uaz&~mnQ$`MSR$Kp8k?%ZHL+YQ+?0%WWm36y`-JN{;!~VSr_DR~5DJ`lK#|R1ut4-X%VsAx zg`l$RtCK4>p~+0K$xN|1QnATQvB^xa$xN|1mtvb<@v_tA1y0*BTL%Fhs%(tX2MZKR zeg?{BfL0auH^Kl>k2dbcKTu#aK_i5WP-KL@Mi^j(fm$dijFv=821QGDik1wHmJErO z>>MrGC0a5xS`v?Hf!&A{v?$4RIMKM@z;^ez=^4(a?ZsNY#`tPbiw* zPx32*oWT>7p`e(RxN>0f_+Wu-f~KMb`%Vl5P90?nd2q0Av}8{XTUc1+Zi6}q=&(SC zMjz7qeF;N>lV%hIhFNL2mikdC+}M6W@e{j#K~qklK(u6Zv}9PcWaQ)|ak{_<*ory8 z2YM4M07UQD$4bOZTx1Nn3d^7%Dw zD9K-GY363-aj}7)4U*>ii2n``e4&2id+6F z6%4T#tYGK7xJzENwRUiUt+#^Tt(vD8s(TO`c zbw?-fnDhtg;|$W_PC6Xyh5>!tfIerM=;H?TaSKcWA2bFMy4oA9SU!A{V6Y6{x z>wFgLd=~3`_S1I#v|T@K*H7E^({}x}-2fA6`vKa%)P&lv)Lf5Jb3IDU^(ZyhqtslF zQgb~@O?50a^|91c$kKo=vC=?)8Mp|HQ72E9g66*9J84Pr zxqJQMyifN@1a>u2Xkau@$p0C-^)lHs$K!CSr28>Co);|{A1#>?Em7U)fp|P|pz4AM zq~&?yK-F`4R)tj^{yVDlHS`3uqXB4n`4%j>g@_8O% zeMeepl$AzXX^fRhthAez##(7lE16532<&Zj6Rb4RN|UTK*-8;BO|jCxRw}hpnU%_| zRAHs5R+?s|=~kLyrOIe1BKNl3^voR9R&IV|ttyCy_KAk7S|+tja#|(@S|$ZsCKa|! zDr%Y37Y!;0ol^irI3Xa`=>wQJVp9zLpg#RZ6 zpagbdRPdHpaBkrMv9d(3{ZXn$}d3q1t_}! zWmib~774@`QN~5s6k$_@O%Y{Wgk2GKMU-(7Wn4rV2eA)gAH+V0J?kX0Q5v;TdWi^< zQZPtTL1wFJ-`y&MLM0a>_eJVUq4(Vb#sO}9@#=g1akO=eQ-fvz9_Z6T-I1y1P&Ev2 zB_`0t(U9(jb*~%HqmW^GtT>Db>TdYb5f3vX&wv@s2h31DU$OJ0oj*nh=ejxl~5)i63XmDLYaC6aM={eW{hk~ zWK%4gzOva(He+QImd)<6=_i{#WHU}SA=wnlX1Hud$R;400@>^&n~}2FRW_q!Gg>x5 z*$kG=5ZR2E&7QK^OE!B`z@dO_g0i8+1EE6MP#FTDBH8qnO|fkH$)>+-2C)3%L`!y$ zmQ0^?a^Ev9o=^Wz*KfsOUJM1VEGrBKiUT?vro)LkH1Q+#{ysVk>TrY(SNsTm_})DyUG+52S$`QV=cC zYe#))>R3$LDH<9a4ecBa?GgI4p8X6xB?HLX26%Fkj4NZuK_Kk*0qoJ~Bs5}~~h=!&{L(`(6>C_s% zJfN0brEc{xRZ6Xhibk!7iZIGV*@`&EXr>rpUn7*-+m7mIZbr`CiXj#+%~FRr zrOA_M(N7Js+%B7ds{9hlwJZu0@XrWR7tk>Kbxm#PMg%Agl?02c$&Sg%^yFmc`>I9;UqO=&CbmEvNqk)r$=x{Be65V}w+Zxbefey7-Ye?@G>adRv z=?Dr3pEmDc)p!T`JG8|CCYQ36<~-1!X4^H8_B$|084OYegOtG_X>X(+(O9{~p--Cg z(8Up;anw;#?NyPdJh!euEw6+EBB=?kl4P3e>hdjk zfhXZ|Q&47IIiME|%_3ugdf33tR$$ur0&_zam>aUd+>iz4rY-2F@4CFZ9oOt+q6TXr zXvQ_}qCUq8nqvjcv4ZAUL36C2IabgdD`<>Lu3pdQKZgT2t%ANK^IpH+IX-;GHR3{UMY^=5;o>|wKOQky`iHNp5ER}0zw@0LM z?-|)JyH-3SHMLDn=klZ&uv^uUKoO~)UG2CA)BFb0JO)dqm6ke*R3;hEr8Dco*<@yQ zDxS=SCoGvl%tVLynNIaWC!TI^Pj@VgwI`iwcDg!pnRRM!fzy_b$J%(BsCJv0oop_a zOD@VZWYVis9r2`6FLKhEmRLvX*qEHLtBU$`v9@SODyL#704X6=zBAlyB*Ak_EoM_K zJk*p2nOc$TSe>^9N?oK>A{kRY zu7*Ti4XG-P99C)MxQ*52$|(~sS3a^Y2C{GCNkYYwg2XS<`)T%@=2bb_)|jevTJBk| z)XCP=ssri#dQYmt8&P3n-DwyH!Tlgws$LY>WJy5hO6 zOfsRad_3Keqp+LT@q6O!Sj1YAHR@V9ay?TWEzKz^psIe!jHqJb>%?1QZEeYpmSjUL zn_ZL6Bz!5Gqb1jpb|RUmPG)kc6{$G2v?`a&q?UK(l38bAGMA0VIIa=G)l~Ve4zZ)k zX4%bjPH{T2;$FKp=dsJD7bYUvk(HaeBP;bworz6RG-0K(1+0sV3K222sJ5n-0?tQJ zz!abHFoi50Qmk5Ep)RtiTPlXDTPByf%v@`Cua~P$`y*8$k&Q{Dh&8CvZ3$83+ajfr z7DZByNX42y)igVz;%+mwvtjo9nmOev8D*@~(#e;pl-#29myi^$TS6V#*|BUgnrX`y zv?#)&>Bu%FSJUdqh4ESB)!ME)mRI>KtEiBY&E)0AA*m81dn#CvL*jimxC zG56zIbuXq85xlZp%a5T|rxB}5a1?5MGNYRF)fM3;H!e(M*b}=lxh^XAoH3JVSJ9bC zt>%6~q4pb+nN&Jq%o^NCm70nU>v)}osy4S>m%hYvaMZ~RcW`QT(k+oxHrtiVbhEBg z%5V?k<*{rkUd@e}%fwP0xva?yl_VACX3a;$Gi?jI+L!0gzPfQiSZm_>5>?kQMN6Qw z>1ih1>nm}wu3T$cUY(&NJO!s+s!VM6f}K4_U7_VG)b(LcT5R^D!In5~c8TM5W>4;L z_T=WSuc?*+M7&&&5%iwEg=IJqnOZ6%3JK)in_8+4B#l3!^h0wOIxUp2+vhedq*_qs zG@>bb+f=MA>rgy3DN0e=LGGu9w6`>+sJyY1go>6S%fbf69^Qe8!{~t|b)k%qHJBmTuQ4+3BipJHc9>t7!WI$6bNy?B% znl5Q`Jk42|48U9^qp*mtO^lSQHqsO+-u_09gt*agmL=<@QnrqeLLZV8=oWM!vZE?Oh0v`+Jarto3O<)(oWowONl z6YIp=QtbH*tCcF;-7uXz)I-wlt(3Th**);#AEZwwyQF z_1HFNy0W?O0&WPK_x5bl+-i@BZp7!(9wx%oGKfz*?b+Hn4EJsJbf<~IoKzd9vM!rT zw$pD(O18Q0EuloREf?diGgq)i_QP@;${BM#(iw-n#$+r@F`A}|Xjh|7kb8SIBk}~z z6eEtLQ)hSO^}nRkw1h0w)i_PLOuC~*#w?jwN0KtFQS$}WVN26eR$keydq*=nm6KVF zXBeOwA3ggJUv9>!rQOXc=%%_QRuQ4PHgi+8C1ns}rYq|3If5cpxz8}u5J7D(Y zSQ^J}nbA3RO;;w@&5pIG5o={rYbM>rEks^LCmn_gGi?%NlkrSaDYCH@NqQX_zA|!Y zaaLrwXA*7htVm6fNP!YwODE{*TAVCzW_tHkJR=aY+f>fBzN)&+X>E_i&Dcq9-c`9s zyff?QVaK7|1*&@wS2r~2=&p`5w{NniNtC-jywHu5Vw*nI_85rLV>H#*)id<3BCV!< zMGjZTI%CUI%<-fPlya0gr|WEr(VcdR&Rj=na=Y6|L+!Ou*ShDWHr0WHJ z)2_ysVI8@sx~YM_#~qGj>5sxjlo->_iEJB=x~4@=Dof*#l+j0Ic{;JqK^Lx9`{CJo zKN4+H>S&WMX35ORv>DElnN!p@-tLOw>iY1(s%Dm{?KJmt=_@5Cmu;u6MA4pYiL9>h8!_REsNOxAM(@$?J@A9xI@;?U&qY}7NHQqNr-&}b)t3pHPubbEye*Y&l^fKjZ*FRq zI^x&W^wjAIZ4cX;#nnx^0{1wk8<*{52%Gdr#$qPtrt;fTCyKU6z16)SwmjLE&lxf8 zZMADVV;zZkbZe~g_~LX9=P|7F>A7N5YCZe*9)>ANtW&piYVzidH0PV2ad=~C#TLif zy3{@BR#P&^ZOq()p-xU^+*6Z?)af-QS0poPF62!P1-&oLYC|Tu!k781I|lK#t6oQS zY~4kRjsKW-B+{H-ne6bTD^-@X-AYyGspE1U#4%E9PvvA%*P~>#YezD(K+jxzOPOd{ zljsqZW;~YRdiX1%J*vBE!hO%$TYF~@Z%;W;lK!)meC21ty++3=B6Zz*dS>iA{09se z{>xxajpcgeOA=-F80`iPiCJgpKEbZ7q@7rkZ(cSl>`X zk$iRV#LzYQUBq-vCgv?s%rWb!l+^vs)%8ui`xDV4iFhK?mhc{kCRkOeEPXw-3+QTN!7_RKby)tcd8h6u1u{p-PbDBCZ*ICy}AxDx6_KZtINwESbP$y*^b3k zu!?1QlySG)ll00W$+ev<+@x~4qi~g}_Fk0Ma%P3ePFciSx=PgxX4+Mw3CL^pU8597>{^+XL%_P0hXuI?Mapa;;OTnZT8ey$XONV4rU4?qgy8yr?X^sQOgW5 zw@!9*u}n)cCo{KLOuB|lnuUez@|Mm>s#BI&=GR-*K-jyZqo zLp;_%LD3mVBPnHqPFfb}R${4)v@NQrP}AS^qGf7M=fnzj)4KNdDz|c~bg_+6F>}mZ z-I0Q5yRht#Mo%A#CGf7!&UA*kE*Yogh6v7sZpsNLOw}rCer{h#XAaPr3kUY$7aSFfzwt+xG8g8S#vU?N$Ek7USz>5ugx*0p#_(tijrEyLN?DjRBI<1nX+eN zG^gnfcN`+htZI%Ire)Dsdot2Zb;|0EPa8`l?0iX`x_DE)Wica}Xjs%>+!M@iyX)FA zF)WylcIa`xICJ}(8_4XsbzJsjl&~`CsmQLf#akLIaH$cmSH}b|v#x=Yl9olE5JkEm z)v>aX;Vg?her2~j>8dOFl1W@=E~X16-N8gK!vadI%?z-)QKgiVi&o4|Wmpg+VNrFq z#p2y{Evl4_g?<*gXhk*C<71hEwz}Pvc-y$fWLB=Wds*nE)MP`~eYt|Vflx7OF6y>~ zG_K@Bv^?R;(37`x*SFAcswyT%w7TlL)BmYn^w8?2bsf3b+Q{lMRZvWF;%-f+Ym9LF znv>VNeeJ3i%v4^?&(2eH66{06>gkv zFv40#mmp8M)j*u}H03Ufap=NEN&h3)IU)UCSJqLti>#!&#;%f~4HMnY81;qcnAu!o zI-PUe6+|V{V90txYr8zo&bJ$^+LhX!mA8ZCSE?0`df%y0YG+|| z!2%B2#*%Q7T5g9kIo0Jh>4>m>Mys9+^1PxgNe?IYlB~k(fuk&ru`4aSeyM`Sm=Vz0 zby9!zb11pZ^lDC%egGz_ZVNs7j^l2XBWE3TS9Pk#e)NppA2+#EL6%+fG45c^yM6LnLJUrCn zDXp{)^aWh!EZu1&wm(BaQCa{n)yX=SqoFDDwcOyo>k94V!R+AvOMT9dRa0wdRc)qdU+;d z^zvN9=;hgo(aS?KrJw1(2ch)HHhpB9KC(?8*`|+d(-(V_zS!&Z%co7Z`4`!wFS1Er zWRt$gCVi1j`pRCXuk1;`m0?SrR3P4kpgWKU8qPd)jJ>VWUD@wuNi*7urP6k@tmX{~ zcfqokl!?=;nccI}n3QM8Jzcb3#wAXtyvY%7b2?LPG=FMq?^!i9_p97K$+dHvit09o zqOM}D^kkyxVr`6?F<#iD+a|Z=YD~5ju7B!l8R^%y}lUWfbo6`I) zPp{?S4zr0BvDIm5qmwn1(n@u5`mt+gE7LxerdzD7Y1YWwRezAN=kE?9)Efb&NSfWp zwYs<#%j-21qltBw#_g`^BqhF;Ib$;|HAn48>KxFI@JuAevVmH)GWq5r=jzi5c~Fs1 zGYPL^Hq%H}BjnW`e{GQpR6fILU!r3>ST7m0h@^Hw%OsQaJic%5YVWR%t@UcnspUr= ziMr;-r2DoXPe2l>w7sILlgP5jC=aMgc@>Ybx2Kl4&lFm-j(Q$cKd;F#nn-IhCV9{1 zH9Y8$yNk}JHMus@$(_Zc*9hwpX09me_O7;EO5$t;r1ViK#`=usfO%JuBLb;>>$xVKu;$O742e z_(Qq7UA>zUGY4^r6Y4j{y1Oms=m{~F5p~raT*yv|l{iY1;*s-xzOOg=nEHLAQ(ReV)-ER&EfvOX)%U!~yl zXY4UlMMEig&%zpJ^M)LQqUvSeWK|h>Q&9>j-)>G?<@4*70Tw(Hen+dYZc5`jp3-zX zpjYR2?RLlpng4Q3PqAv1rx0exa`D!xM0={kZ|T+hvLx4_&aEZ+Qm9W>t?H?5Ot#En zkj<6ITlUP8)^s=V9h4KP>saM0zuHVDoyj{j)YY(%Dh(c;%osuYyD&%l2$WujF+ zH>pD&Pg6;4QdVKTl%|JIx5IfVZLQzae?V`w<1RCY^{PFGvK7o@YO9m+%`5DI)qUYf zhcyUUa#pVf(=X&}RksLVO`cs{=Y2s=JJGqYB-T+avr$KNZ1hxWZkldkc~&l=n6#(l za?>TTpc(7Ph259(7`=pJqSscu5~W6&NspqcLvB0)Y6BVgb1a3Uttvua}PT_?tQ_;SgJeCGX}AGb-up5xHqMA`^Lzf>rlV* zFRl)`sgg;tdnU%xP`Ifn%KH<_Z%r>-(i%7!*C4V@{l)IdpN0LX5!u4 z%KN8sNZve2xGM%W11il(ZT;eIn%SidG8wm8_ehcI#r54)&Fb2FvJ;{Gvqp1uEo@;$ zUyrbo-D;wHZsklqSl-d=ya z-nl~7sq@B#y%R_V*4d_Z3Or6W7o_ERZhncyMzpDj_H49ap(mPgJS{+$hJeb{!IJ(A8-za}b*~_Ocd-;TzFLG9tFpI(7d&8Z5@n%hg zg?(oYtt~{>F!-lTdRh6DXAxN^-62mPvQDnk4LfxhFYoMFUN*gg1xzcJ=fw&w&X5(( zczF)nnPpy4Y_(Qw)2_kPyf_V!LzI_RuF)yD>#54kT~D>5PC>Lf1rbdOGs;y8Bvw&6 z)g)FiO%`X>Au6WZLrkqG%kb@^Np^&(&&)1ZhGlT?J>R7#3Jd~ndLf` z>ywwX9o0+gxUyO|tz73IS5{Wx>Xf9?%axh@DM{<5SGcL%;KX5|a=`>t=NTS;wX}z?@9WB$AVXLNTOD(5q z>z)wpoan=z1Q*3twk6lGkY2tpQsJlST2)e^-a$C%3qxv^quSy^P}RQHju(UeAbd9cixyQrx-+!(HyIz`!pB?DoPQk(sk zq-IY29}>c-J+ZWf9Q8Dpyh`;oxs&{=`t0V#WX}=r?)lbP?3r+>BqHj{nQr#VE6b+N zh_L4>BXI`fBJ!O!zHccdVJy^5(V1Bhk?4#rz#iw=(5PzcTx_I}-Hh-yagXu~yRR7M z4QEd6ZZ>nO$H-(OQY|yqH1inw4izu$waNmGz8Ka>9vk-(Z?AhZFP5s83!9ihb-$AK z2;D7g^1Zp+Nb4S{iu_;-d866?i&6FeVpQ|L7%k#217sp){QDpBW{gY!7vsjd>RwWH zYXP@fZ)Ij9^TpA#%z82ES!TT$^(?bqjCz(?FGfpvp3tKNdbj(Zaz=VTlsUPRf262X z^nWj`Ze~A}scvRJny36hf21_JC5Yt@9hwTE-f#Eb|B={iX1SibQCh3W@}3%xnZ4`c z-J2^n!!-I~ThXQEnmN^2N((AS(BFHN?m-OX9Q-Dt@fdkB*jpb$mW}(5b|St5|CcmX zx&BY7{%~I1rr1_vUnX@s?Uod4@0l>|qUV&QA5z`5BX3Kz(eO&UnP0k7TJ^ubsc{{f%jtdS3leswPu*>_MV6AuQgxxM`lI1 znY^S}-1KB`MJ&#XGQGT1v9_$d%&frqRz_1zH4AmJyw=StZM-XyFqW(d@;w9fmO%as z(e@R5lk55<-{j;~5=xN5Qr0E``?@_}PBE{Tvj8W{+4_r`PI?Wi%j&(qMe%qSU!0T2 z1<9&5zRD@@>X?DB`;tw5jPAs%JZpscZ;|e68F&-0vR4ciYvUm(k0N@?ttG z@;n)e^B$__iZVV^U+wTNLnh?iKh_`lwxa%HI{fV#UgB`SY|4u|WZiRF^2K1@QRPKc z`L21lJSE!Qzsy7Zlh@xH4r{E7%&(pAR7>rS%Ya8>+_CoD>Uz8S+rk%C^D)()n7A)S zM&P_6qP|L}$LKa0#_OJB*t5wXdy>)PdQUPkwl~R$oKHsfOfn+plaW1}8~dhVbE7>a zUO36GXB)lbMC(=3TCb8uPZ5~es&_VGbvo-_JChGtn5oq-A=7xce}_euQjF5`M;+?t z&MD)~-xcal{WP%_+|bk{&ntN2rh%s+=4_TUH`%jU%VM+W<#0wXvgqZ@|8`y|e_cdo z9TAxunv|Gkx)y4l$b~bjGM=wNC|gdj7h5T{_n2kIB)Grrj-r|0QjENtcvQ zn^rc{Su%BMrBj=5cWM)!z0Owj>=PctE2vriDv7*opoTN%uK;=@+VR!lt`)M>TfrQue>**yye9T{EbR2 z!6++nW5q%liYv0%s&6AGWk(m!<=k7UoJm}|ZCzPKDGz1T-GzolaaYq+U*TliD;)J? z&6N-1N=y4>pApMnc8Kuz6XowdR4)vB|MWvT8|V9~+4e{_-pY41_(Kj;-37h&sqT6n z`)WCleYKj$zFN#1ybsl!E>#(b~kIp-uha zJielqsF|nM`&K4am|XR4K?C^TZFo%d-_oI>`>!@s%^$Lfrx{+dWcXjQ?Kk_8ymvGF z;S=y1{>WMQ4ZEL;6nTV`<2tak>7I+)Z)j?$t*)C>S6kzBHrdrjbKgs~waqPU$d5O- zrXl;U&8;`3UYpyVDRpaZO&8!zsk*m@yJt#j@wjJa;!UaMe@jVy_p@h8l)Wt{Sy$;T zG1Cf$b84E=5>`Ejn%v1Gt=IDRrrYbe+C&?4rx?zks~T9D%gF+h+Z)N)E8NuFSX(=L z(cCaaV2|9>p48nHPHQh3a>~NE`c}33HvpuGJJzWA3T-`qjCF;Sg0@68SH3F1WRdxn zT2YV$l3BiH5Kpp1-@+U$C&i*X_~T*SzTLf=XSAZC3H5!y8@>A-aF*%ytghQW78!4j z8u?}-4;OX*q>r;-!Dv!DVf|eT@lr4Bt#g!*mfbUINv2ouWTd)jv2>^AsQ~BXCaAtD z$e(smr?av%Le_ay?v_}_nLW3Gy>O%YR=UIU;1&Fx0$x*6eX_vX=cc>{ktoYEN#EXda_tDdG(i$%-iLGB(&xx0!KJh3J*42{-z2+>xkbg*;1n)H^6Dj~0tJtc2SZfSKhbI;3f)+1M{bU8V{S@)b($P7Ws!1Gwl7O&FT=T|m= zJxs|@4^uaf-AyHz-A#4*bvKoKbvM;{btlt&tva498Y`%5vw;BFXdor50 zcXRz?_L5s`ue1JR_L605FFUb#yLauUs+zy)=2;8kQb=1*YucpRSDLOBskLgciocJ@ zLl2%$$vZK8p>_p7rreQAgbxTWjMgt*$hX(}4;nIV;=Xei9CpOf%hLPnA0S?-LjtE3 z_{kM3$q&c7x&c<&4@rJhd7cgloI}9%b0zU}CGm5mDQek{T|NN_%Eo@&ohb?Vrj7gI zH

Bh=w2CUd}3s{_s0N-E2hTe&mPe|H*C?Xfny3Pt zXxI?zb+@%K$2wRixU=$lh&{>cN1tAH|IXH{*4mgdlsiN|yMSBg#iVQWS%2BZdPxnC z&n}Mfk{^(l&rk>kZeuI;_}#|SYKB@b`4M^f47FZiwa?GV69xkpav(XcS4R|f4YOW* zSsQb#>m);bhC?v$7g8OM^skSSR}8maH(49w71x>(%FEo#Uw%^a&Is$3vNpzRiO#d! zS;2t#%4cQcYwJf^ub)^O<0U@ANobI>T8@=4aFd&&>`Qod!#ealAKl1m?X{cos*%df=bKB;IA=HIg@^T0HY$Fm z+B(iy!eAgF#mZ;mhwGmltGu!u*2%R|@zS5kCk%P7+%?af8CG6x9xr9%yMntbuRd($ zbNz@@ezv>vn!+-!t8*M>rrlU}|Cjyu^?12eO4<0lBve z#qjScD?DCq+XBo&YYh2DtGIKvhjII&hvNWH%srBI>Y1T)(vIj^OBqg1G)ilt~uh<11ddUZrxBe zJ}=36{#ZA^weDXtJzj3zP&PgtN+2BU||-U%S2LV2_tuHbwklbwk%E8Mz4*h4@=-QEuldT$)Q!8|+~bS+ z9xu0UC>x*G0_A0T^L=-GG;e{&%dH#A#^+V9yi5*{-SvU7^&T&`ZYUd{*Fs+oKZYyxh8>YZKjnC_FJRsLxphO?_`Ht5HW)Bo zcPxH>;}IS&w{9pKpVyH-ug0rZ4m;B0<<<>l{^X&z{v_|kZ|ulN+4#Jc`n+~r^TLFs9xu0UC>x*GGN0E= zf4Sv?WgaiLZYUd{S4?@CvFKNc?G-VPms>ZKjn8Yj&#UUwt$mk!yxh8>YeZrCyee+r1{zYGq4Ya!&jbzX zbQa3K4K$>>kV<)BRpl;1*|&j)R9Cu&^NW|*(N!q>Hqemj2IXq~YP&3ccO-E)q3qj0 zLn_4D#($pQSngw%5TWebKtrlKsf)knpYJY|eH&;<^?*uc{c5|U`?9}u525VaKtrmh zwRLpR>Q3CcjXj03ZvzdfP$>QU+A}SDNT^WuZJ;65i&SZgSH)iOs)T(TXh`*j(yyXn zqc&FTEtGv5Xh`)T6*&EHTpywA+dxCAFO>caaKyjO^u9vbw}FOKKPY`47CKNWte;T! zZJ;3)2IXY^YP+P~G}}8&DEl_hkm_%3;}_+4ugC8GLfN;0hSUJ4)V2dzFU?$gP%cW<9e-f&NTKZ8KtpO2R7#}^t&A-@N+|m_(2yEU zs&@Oxi=*RJLF+$&V7;IrH3mvQE60Vb%Qi+Ti~|j+v81YX+`oCOR2T;uQsbcX?Hcb< zG;Ewy7zY|s<4JwJ+jQ=DsW1*Sq$bccEO>cfj|oy?9B4>QB=zrBr{5E$!Z^^7ngo@| z`qg%sn9XhGB&jeCG^8e5+xW9Rjbc|_m@E~>freBhlzx59fAHN)E4e{y6~=LT%rHA5Z_424<*pXRMVH;>j&9=7jpEp)6b;vkdDr^G{sX0(-Z3nVmo<+p@ z%#jM)KtpP-wT(X$c=&Atuen0mPmH1=6%FNLJCOBqbztHT(NbX>Xh_Yow(&o^sk-{} zzj;z&8)!()htiMo`n2t%=SzicpdqyYO5YonDqC_bkP6#CLuw(EhxM!NlIl_7It!)3 zHqek-WNjTC^fkQd_1bxnRM-X@Qj4K7SijmXL;O3hUMv;1friu)Ya73fL#|~yEs+Y_ zKtpONl&kGP)=Q!-JDx0+3fn+KYMHflbkLuO)+R5WZ<$c`6QgKIEr)Wq9msk~HZgkK za;dNlG^AEo+xTbY(2x!LS4f3zpdqyq%F}ir>t)csJOfusg>9fAwaVJY@36wb<0)53 zg>9fAwHnIFb|C9zNymx_S4)L$pdq!!+B!O!rdr(2&{ymDu{#b_sS)UU`F1_7kIM zNNu#X@jr#>wqs|{jZ$G7Xh>~>()Y%+T#5T^k_y{ELuxaWzBjUd?UQ1&RM-X@Qd^+( zqugTYyIfnO!Zy&5+6v`n{c5{hzS!v0R;jQJG^Dm!TSo^U>sQ<5-ioQ`wn>F;pdq#0 z+Qu(x&xF1mw@Za>pdqyb%E$WEb{SLfZn7OxVH;>j#aP?;SAYzk54pxjg>9fAwG&Ez z#_n9E!|9zu*-wn3A+-xi-}8Uw9pAf4s)E*UThNf&4drS3ruDMtN9F3frNTDQklJHy z<6i-4yd4p_M=ERs4XM3Q&b9+tFB7tOcG)Wxwt(QlVl(WM3fn+KYCn{h z?LgMcn=H4Y_Dh9rpdod@+Q$D0oSPSOr#T=Mwt%rNTB2TED}8 zI^vM+|8dZtZTznKIUkY=+dxCdI!x+kwqrLA3uQksiiXq?Qll=;_d6mLwtKLglwacbFCKa}UhSYIV9roThbzCZJ0}ZJYq>_JnUG0Qa*ajL>CrRCP zbci@96}Ewf)G4S$)~~k9z#_ZyoRSLLKtt-ZwT=IM%A!w6dYzUE+dxC=43vKD9e?Q8 z*E3RK8)!(Kg-U7tYP;0#SN+pjq3kC{(U3Z4ZR2-XZEEuq=cK|m(2zP$>dl6lY0gW9 zZJ;4_0V;*{tL+jtJ4x6Dsjv++q%K<9_|MoWZRM-X@QnyGgXi#(4Evc{#G^B1rrLumtT>@jfdEJ%@+dxC=jd z3Ha!P6L#H^3fn+K>MoRiezo?G8FW`FYy%Ccdr--(Uu~CuEt~zhCl$7VhSYs)8^6P? zHIFC1FBP_dhSUR6cbmRA^gt?X0}ZK%q&(~NDgIC>`-xFBq#luaeboQ)BdM?rG^8Gr z%75i*y2nys8)!(yl4>w$!KzrPunjb%o{*Z^EkUa%QehitNIiwp&y+s1CLen$6}Ewf z)H5jkiaq9aVH;>jJ%`eZ3O=#v&~vG<4K$=)(6O#Z^=V`Z z-LyASVH;>jy|uRSpRxNDt5NB#RM-X@QtzPjv(kHh^=$8?!Zy&5dQWP4NNtbzQehit zNPVDd_~663%^#$~Hqemz2<2q`YP+~5j7a!VDr^G{DeGI0_1@6$DRl$i=KmxWwt$P_IB9#5SC>l~{9fA z^^a7+#d$3MgtDI(MMEkMD!uiq?J^j*^>C%^(549fW^W3e_3pQ5jpYVg>9fAl>kb=9uBR(VQ&Jdunjb%Y=862(IFFVmBq54#qw}R zsjv++q!QAx{(Rl?ETL4`1{zX{=vW)Cm0X)hDr^G{sl-tF75itpnDL3F!Zy&5N&=-n zefg#Kx{*XGYy%Ccq)=(qy)kk^+p|f9vY!`4Ln;}Rvr_50e2PdW6}EwfRC2n8;Tu}l zNiG$(freBHsMP9MgG-I7ltLjIYT8@DsZvy5NDz6=S9(wa)Hv%uMeMJ{Bn^B+dxAq9UUw5QiICrq{24P zkaC6cQP*(VPPZPeQehitNV(CmeqGuA+f6EL0}Uy6D19FuuGq7|2`LEWyxEm|$`lnUEGLn=L#-hA1(s`t}Ng>9fAl>y3K9V_F4;MfdO zVH;>jc|oO7>iXp_g}j8apBF_#DkGGBwHZ3FUU){Sunjb%GC}FjQT5NHU6e^GYy%A` zZzvaa4cB}*cGFubYy%A`A1EiK=D2>?=OY!ifrgYXl!sFJGwpfnD;2hZhE!%KeQzY0 z?@>RqRM-X@Qdyw%<5i$~^B!5G!Zy&5$_k}lMW0k}7LrveYy%CcY*4=HcGZ5gAv~K@ z*ajL>+38q;-AmQWE|mSeC>l~Z=vc08YcUhLcYLLRBG4K$?kLM2hxaNNm% zVR@y(HqemD2bE5#l}|S9$tM-IfreCmDE<7(^!VAr{8C{XXh`|dH7vjG@Fzd1unjb% z3P9=Cs8nN*=PV$U{k$j|QU#&(J-^fS{nmm~VH;>j6@t>Ai0W6m@vM+k*ajL>g`xDP z%8Z*2j4mt{wt4XF}PdWX%grD;?`Dr^G{sgh9op8wQz^skaqVH;>jm4edS zc=$HrYAK=Y=S9(wDh=hTHa~GngF~gI!Zy&5Dg&io4{Kd_Nm52CYy%CcvQYXnzB52g*x@ZP@>&x%|8273f%_vbN1$ zK`Lwm4IQf@lz!b9xT43^ic(=4Xh>Cp(w_m=7u|WGl2q6R8d8;^^yAg!SCfa8rNTDQ zkg7t*>d@rY+A2cX&x@iVRh5o)!{y-gs#0MaXh>Cq((7H|-+Mtdsjv++q^d)?sU0p# zvhr+osjv++r2L`u=fhP`A9VGX3fn+Kss@yP|7zmzy{Cp$*ajL>HKFu#d0XD7JT;}l zHqej?fO1y1Ys#!Cp97@AHqel&1*LyNcV|JyzqO>oHqel&4W)nQ+a&bkuG&&z8)!(? zfzq#Rb<%WcStniDP^` zS3LLDmkQfJL+U>$eII`NT6xTWQehitNHu`cucE1U4j<4!Dr^G{sX!?G8dbxw%eFwN zunjb%8bayEt5!tB*M?GI8)!&1g3`~gI>p=`G?EJ2KtrlAls-E*{c4i9#!_J$Xh=07 z^}_SdrzS$#&x@iV)s${m&n~N0HI)k6Ktrk-l>U@*;d7rv&7{IM(2!~lrJt2m(oW0S zTq4XGATF6vqN`oYzoEu_LW(2!~grJpH>7P+izDHXPXhEyw3erZj1(RBqcGbsVsjv++q&m?xyu3L7=T1^#8)!&%rej4GXdc;FDr^G{ zsV;P^M3?4Tx=4j>pdrBKnRnsfreBl zsS~BNLY8d70&4Qm$v(>P2jYy%Cc{-l!6 z81=QkRM-X@QUmB3x}FSdIY26G0}ZKxQ2JBlpmjdGtv`mb-b(!Jrf?B#0}ZJ`Q2Mh? zh42K)2T6r(pdmFFN}m<+Zug?;V5zVTG^B<=>7PmUzBM^yh*a1H8d5`{^zB+QJy-Nl zsjv++q=rH1M|s1d`e}zrg>9fA6%OU8wo$!h#Kv%;?B_+%kQxr9@58t&qh}763fn+K zY6O%%(;i+iq`?TOunjb%BB1o3fn+KY80sv<=(}O zk_y{ELuxdXev}g=^lCm@Dr^G{sWDLcmF@h~g}!5?!Zy&58VjZG!=`7q-x(_vwt94qs7s`HK6b-2fbi0nM>^)?HRM-X@QWHsS_BeiX zqEy%h8d8(!b`4$YR&A10*ajL>lcDr_&tJ>mcCu911{zY4P`>J!GQ%a$<4CEn4K$>t zK=~;3WYVBAQ>4N+(2$CP(%W##A2~8gDr^G{si{!jO@s1P*D&wg zm9M8sg>9fAH62Rdhr9fAH5W?1_I7q# zS7)wN*ajL>(NJ#c@p9cd-zQosYy%Ccd33u13t!DLPbzE!4XOE1&gxhdlPBLXUn*<^ z4XFimyDIJq_Fo{B{k$j|QVXH<``74&Aqf{sg>9fAwFt^dUBm1fKIUE|6}Ewf)MC1Z z#ZJ7MyI3l00}ZJqPvO8)!(ah0?zpEt1vm)>^5s z4K$?ILFqFUovVeWStk{?friw2Qj51$$+%uBYy%Cc4N&^$De3Pn?YBWHYy%CcjZpe` z^pie(Y_U-)Yy%CcO{9v>YBX(=RM-X@Qk&^^oh-(6MS1%lKwXyeeWp zFN%iLR#L^%es|a^6}Ewf)HYHBi>J@EO)6{y4XN#7lKQs&L++hYVH;>j?IQJWO7jo9q{24PklGEUpDAtI z^o`vu6}Ewf)E+2(#w`2L%BA;6g>9fAwHHdi>m8W4BWSNs_Vc1>NbMt4*)M#|KB=$` zG^F;^HQZKyU9j9f0ywuf2%_p7uH*6}Ewf)In0eeq5PyP%3N#4XHzPyG}OF z;&DhSYy%Cc!%+GY(U>KZ3LKUS+dxC=2$X)5i;uP(Jt7shfrivkQY9XG#U7Ok+dxC= z7?l1AUBHL4PmW22ZJ;4_97_Lev`W9TkB$pvKQD@g)CoG)`~8uVPDq7qpdobu-iwtaz(u;atrsU&`LfOxYq9Jt&O5YpZ5=Sh#Bo(%ShSX&!{Y-h$?d^-pQehit zNL_)_i#pPJ>+UO3VH;>jU4_y=HM?6fWv{DJVH;>jU4zow=r_3eqH9uN8)!&fhtfY8 z`8loiqU%y&8)!(~AT>NRsM`&xunjb%ZbGF~J6!xa=bW2TVH;>j-GXvgYHjL4y>Cf{ zZJ;4_8%nP?>%oSpZVP2UFN%iL9Xi&$oE1IpNQG^nA$6CIwZ34ln7dM88)!(~gVH-p z7rgn=J*lt_G^Fm+vEGDr^S>_@wtj zy&(1HR>Bc4q{24Pka`KF@59lx9=3le6}Ewf)GH`Yb-NzaoLl{sRM-X@Qm>)(8P3h6 z0%yLK3fn+K>J60sy?L=;DLvmvg>9fA^%hFs^Pgfn+<7Y%wtuMcs$V^89G~K`Lwm4XKY%`aNZRC)Xw)rNTDQkorW& zdU505j89Tw8)!&_LOH8r?LJyy z+gGWu4K$>_LFw1|Yg1aS`X&{&friv~D7}qVFaMPNE)}+chSU$bhH>sgv-}XseqIy} zsh@PLwq>{M{3#W-frivCD7}r=iOLoKB^9=ThSYB;eQ%VQw)pICsjv++r2fz~d{n~o z*dM8|4K$?wLh08Hzx9j%{*?;bKtt*usbv?J*Z(IKwti)ZJ;4#`;W-S|GiP)q=$VRq{24PkV*ih7qxEbo<#|S zvY!`4L&}k^;pu)$ZaYeaZJ;5Q5K7iRpHw ze^}#YVyUnVG^A|*B9o(o-r>7RtzD8xg>9fAl@v<9&KGe!TPCSg*ajL>$)NNz9fAl>$oN^Aj2l%b7wdYy%Cclu-Khuxrz{TT%*TKQD@g zlu!w`bsLPunjb%QbXxadQVQ=uaR0RYy%CcG^F0vt+zdmRM-X@QfZ;| zqwJo(N};q;VH;>jIYH_7l>W;C9ym#bZJ;6L45i=ooNo-6>?{?wfrgX|l>S|t=i<}X zT%^J_(2z<8<*wd|j&#|wEuB=@1{zYXQ2I05^G``)T&2P`(2#P2(!Ylto!qgnTf8c2 zKQD@glslB(d`yi$ZthZH8)!&*Ky*($D2N zQ@Ur&C>6GWhEygf{j-2Pk1nswBo(%ShLr7J@QeR1)%Yh_Tg_W4Yy%A`A3E0T13jns z2xUJniiVUgl-_*S)l-W3N`-BpA(a_Q-y1(-Z!OL&6}EwfR2C@xYBOr?&eK_>!Zy&5 z$_k~o@jiKIldMu<8)!&ngVL{}naVF~o=qxj0}ZL{r0NY$(l5JI*ajL>IiU2t5gXLE zO%AEB4K$>3Lh0vnmn2?ub4rD6pdpnD%2lm5Y}14Nxun82(2%nITaNLcZB7qq+da2X z_Vc1>Nadkp1%&Sm%_9}IfreCGD82caE9%tAD;2hZhEzT%eP(HV{plm~Nri2oA(bCW zpZhAhu+-xGQehitNclnO*WR!7zfSj)3fn+K%Jy$v#{ai;yvHqyC?FNKfreB;DE&_4 zy20KLweCwHsjv++qzXg%sBL&{&A7j?RM-X@QbnNjPgKLYhPf0G z%6?uH4XL7}QmmMmsi;)g1{zYuNX?8~{=1k|*ajL>#Yw%Y)aqMtsjv++q)I^PMZLR| z?`a9Cunjb%N|Ksc(mhv6sjv++q)I{Q9ritXvT-S?unjb%Z2xj>{GyhhnBh@cDr^G{ zsWNm8Ps~npwv1HR1{zXjq4ef69|^rxRw`@*4XJWadc9Yp?|GIJ%6?uH4XN^^d@n9t zQ(h`;0}ZJPQ2KQ~_-giQ6{Ny8(2%M~s^E@#2P#U1ZJ;4l2}=LnrHfP7->f7Rwtj`IG8eH)xT+Q13K?$J zmI~WIL#hs`p95C7*O3a_Ktrl7lzx<5Lt2!pD;2hZhEzQ$PxbClVMMA#^`yc!(2%N6 zDpAi{*Xv7#ZJ;6bAC!JQytLQ7)qg_S&x@iV)c{Jr0z7NKu4MzMunjb%0-;>h?V3C* zQ@%i{unjb%8bayK-&vS>K|`sq4K$=0K{=~qE!iF9)krFA0}ZLhQ2H$K&sz7AHI@q7 zKtrktl-}XrQ%=vDNQG^nA=MO0Z==P}w7Z&0g>9fA)r@Y}A*Uuz&7{IM(2!~lr9aOv zZg!zTbE&WmG^AS4vFfZZZfPNu{k$j|QZ1pzw4Fs&v3n! zRM-X@Qmvu%pVLb^yup&zQehitNVTD3m71_4TN|mc4K$?Ml6sbF>XWuoVH;>jwS&^@ zT^uu|P&=ux4K$?ML+Mw5mZhEBwU-LpKtrknl>RJwJ@DM04pLzoXh;Ro?Miqi_n{!E zunjb%I+8juJISk#LfOxYq9GMbYV>Na&%sh*8)!&%B9%OQn%kYE!Zy&5>P+fX-^?F7 zONDKqA=QP{*eWGobdd_%Ktrl4sXs^Zrs^scwt14vbGb}{Jysjv++qy~~YdhpKGf$^%C{k$j|QiDjf8=S7iAgQnoG^7TTdi2aY ze6Up51{zXBNZmei*lmbZ*ajL>LrFDldg}C0sjv++q=u2|7JB#jFsZN&G^D~wy?=e9 zbhuR51{zYsNgeOo{q}IFunjb%Mv$udJ}B`Bsjv++q#{VgHdr$`LMm(n4XKf&+MHVa z-$m?se+nSgEiLG^EDSu_jDw*Ls{(*ajL>%qI!Zy&5iXt`Gp~QnIsjv++q^3gYbFi!1 zfV^`zwqNUsjv++q^3i;DpkMs{`u3T!Zy&5ngQjc)X>DW<7P;O zZJ;4F6H0$_IGpU=ftgZa8)!()g3_Oe(%wD0ca~Jx1{zYcq4at;CbGH+dk_UEfuzbhSWSLeFkPxwe6GU zNri2oAvGULZ$8zz$lmj%!Zy&5S^%Yg?+|?9=E((8VH;>jErimKmuJITdlpKCZJ;5w z2uh!GsQj@(f<;nc8)!%^hSIOSEj+V%FO~}1KtpN?UBgW~%dB1^l>NLY8d6K4^fRT_ zTc0UQrNTDQkXi=itez)l@6Riw z!Zy&5S_!3J+3p{i~_()WDk&9OH&ONDKqA+-fczp}mb4oPK6p!Zy&5+6JW` zea8)!)FfYOh0jgI9#b_iuZFN%g#43vJa%&`7z zkr=744K$>7Lh0x7iVJfe?34=IKtpO5lzx=+tZ7qkmsHpW8dAHV^v{Vhe`d!h7wIK12JE_KK%> zde_TQXlV6gQehitNF9gL&*fGzI9UVI@aoj*@I39fAbrMQ%BWLQH z*-uJ^ZJ;4_3Q9jKTNO%Q?37g41{zYQ=~$by_>?;>l>NLY8d7JV^s_Qur)I~`NQG^n zA$69H)nblU^RrT68)!(KqhqB>G9mRjsjv++q|QU>_peUno8>$&6}Ewf)CDO0I=|-l zsdg8n!Zy&5x(KBo<=Z_9<+&&owt#Lg{z&D}noBuL@;9FN%iLHM)j(R~#vIO)6{y4XNu;dh_>7 z-uiuADr^G{sT)xG^{{jL4DD`6g>9fAb(7TZ3(vCNlnUEGL+TdYuHQ~OE8LO_+dxC= zHk5uhf7i|J-fgL{4K$?gK)I{ejWzT7CB7pSwti*2=byq5E0}ZKrQ2KRa zo>TtM_oTu$(2%+hrQaP=SJ-^$e!MDfKQD@g)B`B}$$X^igOd-W!Zy&5dI+U|YBu+5 zXrYHvVH;>jJ)&#qnQ3IhM^a%MXh=PV(y#Ll)%+SimI~WILn;9fA^%P2P{*uG_KToB?HqelIM%S?Xv;JA1Nri2oA@v+eziuqa z-EQ)8sjv++q+USj^#;seIrN24_Vc1>NWFy8i)#F1=7g70VH;>jy@Jw@*VE?#9bQR= zZJ;6b8cKh1xbFXc_G_uI4K$?Q(6I`yyME`5RM-X@Qg5O3d*y-KrDwgB3fn+K>K&AR zlwAt9fA^@)x(zh3z7PeR$xi=rX*8OlSwvL!0etMzB8unjb%zL1LW7#aFSDr^G{sjpDZ z>R1b=Y+n0SDr^G{sc%sFx%|2A=Gxz+!Zy&5`VOVH(c#&f+25tYHqemz0j2NxG^srP z{g4XVKtt*$l#{w$2kz~>@>42o0}ZKPq#jJ}zxtO{*ajL>zoGPfIIGRd4!@QAVP)%|#?FG^CQz?HX9d zYg96+unjb%l0)fdN~H$H4=0xj+dxAq1*xMuGj&fP6}EwfR7$#CJ9?e3mr^Qh0}ZKE zP>7n#{rEhp6m-Ir}&x@iVl>tgW zUY_+|AI%^YwtzI3eZDe7$Ul?vNHLn<>JEAalU zQ<vM>d5dS03fn+K zDm#>Z6-~ZmL%QrzVH;>j<$%)f%a__;UY|oMYy%CcoKSjEL!M`d$SD=JfreBrI@aa_ z&Np&Ng>9fAl^aTL`JwbPC4Az%+xdmEpBF_#%8!n9?sk<}KdG<{G^7eZ>3gH? ziAJ>wNQG^nAyp7cFRJ0iX#avzVH;>j6{2G~OrKe-kW|9fARSrs@ zx4Dvc!rF3DVH;>jm50)=^TAyjTr4jYwtx zLg`1@5`8&mRjIHIG^DCQ=|_3+3HSwtDP@Fk&{Z-mI~WIL#hsx-bTV+JDS#!3fn+KsxFj% zlpV{g>s41OYy%CcdQkfDT0LS*k$O^L8)!(?hthv{Y4Fhvsq0IHZJ;6bACx|07QU9fA)f7s< zVyA1|xeo@WZNri2oA=MsA-}9AjAFI}0 zDr^G{sSb3kLBSjEc906&Ktn2s)Rt%S%LYk>ZJ;655z1XXQ_hT!9otbVYy%CcU^>>3 z-pwBdONDKqA=L>=zxFnMo2Wu3sjv++q&h?C`*3&V6CFBBg>9fA)dfmFmp4TIiR&Vi z{k$j|QeC0+pFp0ztL^BnQehitNOgnKi`wqzey*ET*ajL>AyE32ZQCZdu_01n8)!&% zhjLYq*Jc0PU%E?$ZJ;6514_Tn-#oTtWDlvZ4K$>BLg}BiEp6k!pr=&W1{zYKq_#Bo ze-jg+b}x-FSA6o*X6>wtx}C! z6}Ewf)Bq^`OetRCP22#funjb%210qN9X6>F;66|)Yy%CcK~VbfDo}LNmqAit8)!%k zhRULjwV=q9q=TixHqek70;N9@E#23+=@6-~4K$>Nvg%MO-%z3K=S9(w8b)f*zuJq2 zNri2oAr;OlhtJh;sjv++q=u8q{Mo0}aH+5jG^9qb%3Zt82&u3QG^8R(y-GY|Y=l(U z1{zW$Sv~miXQWiv1{zYMNPVgr89GWTYy%Cc(X8e@PBdC7Yy%CcF{HZsKYl$%Dr^G{ zsj;l0A{UMo%6?uH4XJTZ`c*WmrG4vhQehitNR1~o%lrA3@ls(MXh=;U6|!gXlSzfPY|wPFRM-X@Qjw&b^W2Y! zlnUEGLuv}C63?Q>PLT@RKtn1DO8;4`<0EIDh>{B1KtpOO9VGw2%T`*>=~45_dUG^A!i>Hi{hpGA}J z&6En;KtpO4l#6=Bp67V4$tQT3n@`QXG*>EY0}ZKYDE%40y;75d(NbX>Xh_Y2@=(`s+o&=1<_Tp#FN%iL zd?i|BT(_W2yM zNGfat4XMR+EWa!X$}N@(+dxBV2_38J(zCCYNQG^nA+?l__3Po|N=v1}Hqek-M#rjI zA!@)fsjv++q?XgM<{ip4VYyV;1{zW;=vZgM9W$?pS0(M|MbVI238i17zD+D0v{EW; z0}ZKFq?#;z-EEar*ajL>t4UQ#-}(7!sjv++q}GsnlWf~>(yxdA@(x_ENhteyQ8c7BL+QU8c(lUdDVwFjHqemT0;T`9&cpFX3vZDM z+dxBVE0q3yiuaC?@U2o|8)!&vqhsA$o+j?PfK8 zzRPZ*?B_+%klI7)Ov{11{zWaNi8o~QbWB8IDVZZJ;4_g4E82`>UUj3fn+K>LjWBCDZ$!lnUEGL+TW%Mcz3_oRSLLKtt*@ zsYHVxhn|)S+dxC=43z$PWpw4&zGtMuHqekdOR7oQ9fAb&izZt#8TBNri2o zA$6YAoAGxtpBKu0UK9Dr^G{sf(m6jSrW+C>6GWhSVieM-skwz9bd4 zfriv&Qp=}wOK@2#Yy%CcE2NH3tbF~7RM-X@QddcpOtP z8)!&fCsp=AlPcGx!Zy&5x1?O`+`PMbVJDMJj)TqSbCm zg>9fAb(>V;=u7)_ANd>|FJfrivWQtv&g_IoH5wtm0+q;@t<{5Do9Yy%CcC#24e?fUhJRM-X@Qcp=0N;~h_ zQ>m~GG^C!9>U%J5@H45f4K$>llN#S7X^-bpVH;>jy&&cHy!gQvQehitNWCO=aoE8t zFQvjZ(2#ls<*v>-oOjPX;FVO^1{zYYN!9A>74TXrYy%CcH>4)SwoLd&DEoO)G^E~= zI(@lX#iGQ6n?Fj0ZJ;6b3Ccq~UJX9SF8w4Gwtr>PnR^mq{24Pkopa!&zbjd zzgYCQRM-X@Qh%WI*`6um27CUI3fn+K>MtE@)$pi+f2G1U(2)8^$7<|dw$VSSunjb% z;-K_>I6U>HYH?Cw8)!&btS2er|K*xu7k@OgBs72jtEBzBC>l}@q%sc3`_w@yYy%Cc z1fptRM-X@QjVnNHJV!7Q7UW$4XK2r@{GNmHKA141{zX{SS3#|D3Mgy1{zX{ zNzJ=jvr}TJunjb%l8}lSvfySCsjv++q>_@dEWLgvsZ`ho8dAwf75mR8c`~W64K$>Z zlNvs;lV@@$+tajcI{T9q4XG5Qyk;$FlESD#>O}|*sg$JF)_4_=(x_ePWIq~GsYr!C zEcZK=Q4Z>*3k|8%q>7j8_ae1XHPop-G^Emya<~wlD~(Z6>NFJ^QfW!;a5`Bktx>ns z4+Ne&COWlnbd|yEEl+F>15*d$tQ2 zQt3!VTunMOolz;&HqelACG|R{_hwh4YN(rwhLjtr^tXbZxEVD@Z37J{cT!m@9d~p$ z>VkUtM?=bk)aASv8+jPzuC{@Olqadu4tIZf8r52D0}ZM4q)zuZy)nH}E7dm8kjg-6 zNy^P_G8pwS0}ZLn zq*8Cl)HAbDPt}hx(U8glrT;8(ki}_K7Nhd1ZJ;5Q6)LO!&azkr=I))y) z@>D7&?SpUGjM}HRfreCesLV?Fd(-TIIG^BDu z>CbFmBTjhbG-{>V1{zYip!9!FuhNv2b#fW?RLv6&sobPW^_o8-w^3QtHqemD1Ev40 zNU4AICgm}ztJ(${Qh7;vzAsxiuTfjoHqemDM{3Hi$D8sQ^;><+M?)$#Lh*G`lvoRpdnQhO8@@rd)W%! zMU5({wtD zIjL=+AypDe-2h8hpJJ~{8r4*70}ZKCQ2Ny-`_v{yOBuCTZ37Ld(sT_o-JX%Fv{ANm zD7Fh4Qe~j@&tWqpX?44dQI*xrMMJ7A-LAA3+bt|>)Nr*8G^ENw=~wLU?%q-5j5?*Z zfreChD1G)I>*Aaa<&APucP$!H6`=I*vahe3^`e4NP1QEgkg7=P{QF5x6^&Y~wtsF&(fB^pwdq4e+Q-8)`*U)iXFY8z-sRe^G~Kb)52V^$ZgV$=Y&4K$>x zLh1LE%Qye@sA`n$=XtgZ8dB9rU0XM*Nj0M~sBNGjRh?AZQa5f_H>#=H1{zZSq_+Jm zzQW(A#p+>1L#hUpdN?haz7)+}!>E^P)M!Z6gwoqc{kQh+nno2=zZe=)0i=?RD>5m- zr~zslXh_u}wa>d_np#F3Qrkd7%Jx1V|1WHIx;wgeZKIN@ZJ;4l2TH$2WqN+ar;bte z)i%(Ostcvwwk_u}_vl~Os5xpIXh_wgV|h+n<6h6G&uVCBNY$rfoo?h-x4uyY)i%(O z`VUIKI~-o=o%27V2B?P-4XFmC3Z72+u7Od9)HcwN3MBQYO{ejJMkQ0*Ktrk_R95>F z$#Sw`^%D(^s;{m%8d8m*awxU$*UC+ejGCjifreCLDE+B2?8ESsjg5MwK2@S2)dVV= zI@W-1b@MbaDwo;@8d6Q6^gVz3Q2Kp2 z{fQ!*n;Vr(Z37Ld7EpTg)mpSD)WWFxY8z-swS>~2MTh22yuGDSbJRA_kZJ{`Uq#o% z{G8Its7LB|9B4?jhEh*j%gwqehqN{-m%3}wkZJ>^@53A2f+n>wDpYL)4XL(ttR>Cc zoN8;-F0~Cbq}oC0PbrQqV=uNd%0X=d4XO4}>SkNsym0euZ&VGn4K$=WKQg;#>QXQexbS$;+&yMV9R4%m*G^B!|^bVJPZM!_! zs8F>HG^9F_iv2d(sgqH=)SZNeRA(stZhro0ioniBIjC)*A=L#+-y5A0<=ETBs2XY; zXh?O1($AEx_Zm;@YE+ck1{zY`p!Dm8Q((AzH=}M@zh}FkAr%7UgYQ}_>D~nW4Kd1B zZ37Ld?oj&g-j?C`jHxw_08sfMzvOpLPIJHDwjIe;kZ!G zFr!vlzh}FkA=MvBZ{zO9fUNzE(*Kz~G^7SV>Bnp5u%2!Mj4H3TfrivTQoB5-Mh-M; zh}s4kQiDhhIPO(vkWt6fHqek7OzPK_9KnN)N~N}ehSU(Koc24*l3>NK+Cz+LsJ4NI z)KF562j^cMYSetS4K$>Nkvih-;yTQzr|NAD4XJP_{on5mdvoAZxKa7kHqek74y8X4 z^(>XZYq(Li{n;*PNR1#B+T!7;5k_55FL-E3MUdJY(Y;E9QK{56(2yDlmD_$*EQ?Mb ze>Bpl0JRM?q(+fiye@11QASNu+dxBVG?adw&)X&Vz-XiHsL!HkNR5Hg?TbInjhVAPB5yn^?SAp8d4LX)D5sC$#P`vM5E@btAK{oBq)8(VZpc^MJE|` zM}43`LuxXVx{EE_gQ|6(Y?PBDhkTaerH)Cs%DCcGU}uHyn%+)R4Dzdj19l^Y^qTu)m@8*)HJAq>R7E3j@&cN zsNrfGXh=@v8ttLUU`O5PS)?)E@(*2gi^n#rD>;+ zYiAnORc!+esad3a$DawFWz=f54K$=?L#YSGQpfL9vDrpFSD!`EkeUOfcbGA}jb)Be zerg+NNX?~VUH|uC=v<@1)Kx%3DjG_E?#+5|OJKB72h=vukeUaj*IRc(#ai=>N}{%b zhSYp0{TkJ5Y4q6nM%7i@KtpN)-L9%l(^Okv)GYNdq9L^qO8+jPS?6&L78+&ybBDGI z8d8g()Lm>jKe*xKMMjlW+dxBVF{?%G?=ChfOkD*uq?SPG^P)441YTNV)B&{(G^Cb7 zsh1VYfy|W-Ej22My5eX^ErZfKY?0l~f0j$4^t~IKz+6Ed@>!9?r za&66=jn^49OKk%Usr69$?=Ge8o_^JOqaLVFm1sz9fKqp{B}u-6P8*EMp&k%4q&7mS zk93v?E_+LDG^&T%1{zYEpwv~dj2(E`XOmGeY8z-sZH7|cw*3Bl%W<<&aq23dA+?2$ zb*X!`;4MZ~SKB~CYAcj}et8#2Tz#uik!l-gNNt1CuNzadc8=L*)JruqG^Dme>Gh85 zliGQ^Q90B$(2&{zrJt3VA}ie8VN?&b4K$=;p!9ls=K69!#;6$efS@6@6H4!}+@-wv zb{Z9@KJuU;wTsmLec9LSGOD`T1{zYkq4cvdsO7-4yN!xe4?Y@Fd!Y29sw980YL8Jj z)HcwN+6$#0s2b_90_K5A63x|7h5I!4DD>AlYD zm{A+mHqekdPRDxmA@PgjMt!$_&vrpW>I9T}8?XfQ?AY{#QRUS((2zPw*RXEfe+5n& zHAig&4XIOf4RfdcarBf?H`F%JkUCAr^5|6Hz-gnr)i%(OIzz`AGG=bT8KZ*LHqekd z3#IRkLlc{yK5NuQwGA|+&e1hIfAP)Zb4GnvpDNLiI#1VdZTV_$=Zz|_wtXSn*7&S(10}ZK*bgVzCvd+0^l&!X1(2%+WrSFZD_bVN~WR$zw1{zYA=~&4wm3w&E zs9fqL84al`q{asnEpx@FV6`YTq^^>hv0_Q(t41wXi$X){8Y#Cjs~27~>aBW;qak&j zRJw6qQP+(ssuqQY)D2RzT-mw@3|0`DXqt zqf)6wp&@mf)I*2iNp2g}P%R1#sXL?=HVIvG$0*zHg=`lzr0zoLKSkhry5jA-MtxU9 zLqqBwlzyGxoBUO}dqx#i+dxC=KBu;h03uKCa?N3{(!q#i-(cZcf*$_{;GRDik)Xh=OK)o@L*C6A4ornZ5GR4l18 zoxIb;8g)l~h(<%|2`T?i>8?C6DvR0%8d6W8)XlcIuf1CIsZm|6-?LrNka|WcI(4t@ z&x|^zwt&$6$Kx}+X_G^AdWy7e+mDhHqelI2cI111jYs79 zVAM3V4K$=aLaB$-k}*lX0w0aKq<)`*hSVog8wV{a^2w+)>K8*p>NBb8P5O9zHmb4O z1{zXdNPW%v)9Z^-3)MEzkorn0YnA3_zZ&&iJs@aEeIqrq#PyTkjPg_4Ktsy*$KCaFgI`Si zWmH?W4K$>Flk$m-sr}oig=!mUNc|x-^>e8je~h}PK8vCu^_SF?`ZKovH7c9h1{zZT zNM+9F5%bTe5VZ|7q~f5|!)f_bsn)MJqqeJUpdn?kJ|>P1`dmuHgc+kPiEMxW%Xayz ze=}!mNZJ0hMZEIOnEs`MQB~D1hK5uEDE(@)EvjtJ1V&A=e$RG6L&}j|9F4qUsnD2Y*j)mtbUQc3ApliEz~p46zS>WZTwl?*D2{m!y%^NW6*%&19f z8)!%+hsvQ;@4Bvck{fkRZ37Ld6m+bx!8=Z+Fe;3>CC_83{GX#dbJHSq*6oa^HC9hujfi_R1&ofG^El%=|{PGm-MaD7*$nm0}ZLP zbgaj#I^0NW)FibHG^Cv9Si$**)^sxJn%V{$QqEAh?01&sLE8SV&PHWa+dxCg1*))8 zZ7(ehb1^DNZ37Ldbabr!RZqW8XViMN4K$=&=~xwK{%-GT)K~SX5)COgDE%6hx=hqv zH>1j0zh}FkA>|IGzHJFef1|RyQKQs0(2(+g(l30A%llpSFzSK&REdU^CzQGY7MH8j z`g5 z^A>QkkLjJ8ZMk z{_Qgx6{EI+hEx_PeY-yYJR6Y3sIThd6&g}mq4e#_=^4E*t5IduHqemDMrv7?FD0@W zHA-y*4XNx<`rg>>JZ5ipqt2;qpdpomluvN-kvWWVRog&ADkqe_59<%kG(4wKE!9;( zL(29ie;xH7G_-`g&oMTaQOng`i-uHgDE)b(O|p%1avNp)U5)L6hEyI>E9P%ZlgFr{ zY8z-s<%QCp95VVbL4K$<*L+SM z($C7dO9L+yH7b?b1{zYupwtHoOWT_X>l8D}Tb=4dL#jBGe%*LnuSk>PMzvHABN|dA zp!7C|clbBBgi+CIQD{h&gwpq6#E+R(N*WcbexHJdR4GzLyRR5l%BVbQQD{h&CY9?? z)&ZrB>a7-qhEy3+3%jJNRK}=1YEfuN**+aOI_TS#^7g}gWsP!F|2G;^CePWYCbR2&G>)Dpf0%yrNNg)HcwN zszfTJO`4pQjOwhmfreCNQYrp^xl`Gw&1xHHNL3+~_0GAURgC(nUMA6ystTnauiutN zg{m4=QEdYascNKZ&+M42no;A_orH!|btwJkvCCAraksirm()`n4Jm)9to9cO%a-2T zqWz8XRNFv9ss^dPum2>kVN_eS4K$=`l6w5*Ntv2P?NQr6Ln?q&i?oy11sL^HeHKMS zsuolZb-Q-EjQ6i)RB^QpG^A=nl&3tZ37LddZb3|DO$LmQH|9$(2%MRrG8P%$_GyM>l?LDZ37Ld|De>JWtq1r z)tdi|dT#xm?Sh6>13K2S>~CWl80Dw7freBdslZwH>I51!PHh7XsfJKl>{rDy|LV&s z4UIaXwt=8gsNqW20)TZJ;65gpPHh&EC&VjGCdg zfreC5I+pj22mP8Fbx*w+q9N6cjy1ae%2&;d%BHq~hE#Jp)=i%UC7T-+qPBsCR0}#* z#S_n#w=inE^?SAp8d5ExvfICHiK#z6bxWgc|J^9t1r4cIP=)N@w*1^sKctmWjny{L zkZKL3w^6M2`irfNnxVFVhEy9Uy^W9gvb=0#)D`tv6b-4iQ2I~LUS0FATw9|usBNGj z)ecI3f~^%*?_@ip+N*7#A=RFawLPxZ!S+V2Rog&AsskM>-_gg#IvDj?y+NTN6$GV! z%9-ur%$OjfN~>+4A=ME|JusHot+BBkjf${-&vrpWDwvKnWWoHs!A9Bs`?j_V8d9C0 z^ck}v^%J!1WK=eF70{6C45dGd_Wp99PiLdrt8Jhm)dfo5uBh&bs&+AIt=a|}QeC0+ z*#ob~g|l}x>a+S(iH1}+DE-OO2G^Bdcv1Ufi?9tOG+pCQ2f`(Km9V=bv z^e&-BEmhk1JRrqyDNp2@R>pHt8Jhm)dxzSk2-VZ ztY;siBGfj}km?Jif99JhGNNT)qt2)Y1P!TvQ2NhQw6C`#uAfmZ>WZTw6$Ygrud&w} zH4ihYx!MLAQvIRyec0afVe9@zEmhkG88)NA#$LqlpH9c%phja3F3 zRoMDH+XW4&K~Vac(k9Q0rh|+cq_%;E)LQB(2yDmrMJ;}P4T#)Mm1O4KtpO69c$0*Kl_InwNz~b4XJQCR>j@f-h~_WT0M+t zNDYV5uK@Qp%$z;ksKRO+Xh@BK(mQNas%(Z4Mh#NiKtsy*4&dlu{env#hwNV?j5?yW zfrivbQVn9gN{%!th5E(NkQxQ0|L)SAGfga`jB22^friv*D7~og!=K8HHfp_k@X?SO z1En5LOZ9u#3XU=Awfe=-kQxi6e+m=yC1BxLqYA5E3=OGqbgT-i*Cifj)FAaRq9HY& zj+G>EPxA3b9Z}mrLuvw)e%A|fZRb0|s1#}&Xh=;Y)vj#@w~0nIP}@L5Y7&%wwfVL3 z>BUJ#MXPO~AvKv)tJT+{CmUt^lR&l$8d8y@{$82)JkqEO5(x-%O+OsBNGjHH*}>S^m#w8P!{D z0}ZL!r1sY7)nK+!d(<}2keUOfU)k2L8C-0RQI2XGXh_Y4((kZ$yu#PbHOf`}VrWQ3 z)3MgvPvj77R0FjrG^FOyvF>*I89mRaD77dwq~_DHGWj=-m~YfAb;Z$;T0qC@^lz=_ z0;7D@qR^09NXI%eAtr92QJvMI(2!b0$J$pmAZU?Mo7JMwkXj6-U!&G1`Y~g%Q9spZ zQ8c8MKCmeR5MANP2<)TnW4QD{glqhqagT()_cQL*ZZqan2% zN}tvLl09VLa-)3JHqek-0j0ieS$n@<=@mw`RyP+7sg-oB&;O;Xz0#nQ zw$w|jt@T!_U{Qlm!FsJ)#anAz{TCYBqMx;R<+s+pyyr55%=0~8pa0JDo~-lk_3r!G z=bXLI-t*I6{X(p^nzo@hKC63uaXq)^u@CPRs}j>T6vt=vOJ!xBD$61t-u_FmI?uEX z#qn9)r>tymGyX3}|K~ojdeF2D#qn9)?~Cim%I=%*7ps4nXHmuRSv}y3>y%qA?0G<} zPBLvnaeP(}`r`VaKzT z2W=87{?-DW;`pqdR95!uMsl7Mt4XG9D2~r+v$C>fxZmiH@7^p{-KK3Q4g++qF~M(9 zR<_N5ZPp7t)HqJXyr%l}Nd23Vd-mYX&S{xn*VtCy(n4Rl0&3=UG&Si{rSY9A4L!Gc zvQj{WvocF_ozm+=fit(WslKCOzUT^^DHG1BYgo|k(GWi73#T*P;iVvjbjSKQ)Ewy3 zOsJkxcX3m?lRk9X>UAH7dK7{<&1up9l(xWWK-si42*reRt1ldsSZmW2UJmos*yYXF zf}G*lu_W5+Xw$xsN6u?*u{H4}l6rBdZSEy?ji^I6NoV3#G&0?^Fg=X1!atT?m}V_D zw{|vlq&Q2nsZR%+z5#ed59yxy(NjlT1i%j;XZnmV1TsZ;CP zyV7+{9UW~Q-Z)#D>RV9~I)x@KRp(k`qVs5Mj2;y;hKOUGt)7snXlZro>Y5j{*EM(6 zx3qRGaGGQ3y5zLU(K?t^O`MK0NH=w~*0(t6SaWU-? zEiW!8CJ4o0N+TjD5wp6upqQYjpopMER4fF=1Vsf!1SKM3At)v&Dkvf-UOrCh&7!F2 zB7)-MtZz(ER8T}ve5~*UMFm9!#m5LwP*hMvP<*uT1Vsf!1jQ4=6BHE`5tN8qUR+R2 zP*hMvP$DK4f?|TAf+B(vQLzvd6BHE`5tN9Cg`k+AsGx|Tc==eVH;ba8iwKI3v%WDw zQ9%(w@v*`a6crQ^6dxlzK~X^wLGjVT6BHE`5fo1dPf%1)L{K7bd2vB8K~X^wL5Y}H z2#N`c3W^9yM8!f-Oi)x%L{K6k7J_1eqJkoV;^kwc-YklWE+QyC&icj#MFm9!#m5Ry zP*hMvP<)K=1Vsf!1jR=SPf%1)L{K~-JV8-G5kZN#<;4ZX1Vsf!1SMi(At)v&Dkvf- z5fuwTF+ov55kZNFSO|&cMF@JpLn3kEXgzPGBrG9ILG;EzRO_Xn%DcJkGM*k%Kpi7rV!ia({s56qh>xQ*y+o z=cbmtA5N`o85Z8)?AlYjgJ!8^J?TEFC0oL?H>Xyr83V1>Sb6Luj}xApUMX^p#gQ|6 zMb3#h@?)qXhh@&$qatU#=oke~_Uh=#8H|wA=r}$mhP-{}!64|#^n@IKsLKi5kTY@W z`L)xhxC6d=z&$*#zPY8Vqsi%Ny|lIMiqZgkFUpw7WybY7(>F4MY z_BKjR{P;O$DhT?N4j9ElP6du^hAU1#Wo!|WuH9twzsLzYI&?G5sJMlpF#O5A?4w}~ z`-zpAV$~e@I*#30fYaWEAvRZrHu+DX@qNVVC}`*u$2Z@^sWNxpl_5j!I<2p=VmG2p za8Mkd6)VL3C8o~9ZyQrARwGUGR2-ib=iS^rY@a!4J*Iw{L)B%Ot5|WMbDS&H(Q(+- z6ozyOInJ{m)fDN@Cwp#-1`WoF|Fn(wYAJAX&#Z|OIv+oT?5Y2G-z(UxYLY#bEZUj8Y|^RCBxM7C&nT$x4<5{rFm}tJ#;KF z&h4RD)#wFL2KM82??s?Ia~%FFJv83?ye^44=Uy>YrcPO%x`!U;r8%s)d%$_a@Yqxo z4^P(nbhZafo|l|4|zzuN^ijB)tRSKnO!xR%ZpRp2f)AUnw=zUtsEA{KW9TR4v+4^9U{4&J#$s` zX%$27DOJ&rbCHrBlAF{|OtN&+qdn-;hhJECQSzc>9s2ytE(E5dPamS0$k|U)nN9FY zWe(~-JG|uS12d^`?^gCDyj>MJXX3~kT#>rI*ohZ885|E*=(jj>Lc7TMyPyw&*ku!4J3by=!=YT0acPm1=; z-h4cQ<0n@|`tkyzW83g|#?;_4R?}Dts_wwg(G4r#PW@;d3}R+nY{hK3hyJA8MVI^5t;ADRez;HaX_=qcax2k$C8<0~2^vdhZaR%d2#!krp|JOIhRa)%fLsY|h)Rq|O>_l=gJ|FaV3qA9$on}cdoiic4puWLkj?-`EOSMVtpvyc09=tF}~xpUBr zt8tIM$9y_86KSm|ja1mnINEdVCqIVn>XDTzGdn-uvnP4&C;WcpinH;snF5&H&_7ch zdiu2FoC&ynsqjF{StH~vwOuFI{^JMBL^FFq-8Ds?A_yvMq@=0OI z^-n;XTDjjignd>+|K+LBrqfi=w~>8{3c7E}Qg*XTJ}E9)HW3;=42k zbawK~l50O%i(|>MpK1Ln>aW$f21(i3rSV4m+u5w~OzLNATuOY7#_y9;rSWd!a*b<= zPtv%E{G&9!llnt7Wnp2qxiMcp~U8O|`D)B0Da-=y(& z{M-3!jdu~>qj8v=A8MSS?YA|4hx%n27X$Y$Lf{V&bOO8!k6t#85!BQJ@S~*OnE;>D zYYM=8YR&*yLvSiUB|!p!ZKU@^fFX#n_h^6$g24dmXkH4?L(muCZUElu_v=m;WeV2A z)S1Lrr|#K@maY1*HT{7c^VYJV9-O77Dsn&<%pVE9f>scL};r&?AC+1U)V2B|)|~T+hz9 zX61qGxq1iA8(DHB`xo?}OEwKlE$R6peQdJ)ocFu>RFx-prH=sKt?=jRM9wb`Qu5P|A<2va5HtTCAcgM8C7?2MFHoiXglXoB-h?6mb$# zVeka}r#=li15yE*2$=(^gOEQT!f^PkcNwGtLVl;g)bq2rE(rPTP(l!5HlGUoUxWWF zSc)=ZIkMe(%W*i) zM?fNw1Y{g!Jfs3r2}wa}AhnR`keQHKkU5Y>$b3i(q#crmEQBnAEQTzFEQhRstb(kD ztbyDHSqr%nayR5&$ODjdkoAy_kRHeu$TrBckQX7ZK=^y|Z{hztkard7IG)#Zpgim2O#Sp>meH*w zVjrc$G&^UO^8CS|@0|ppAlh1Z@$tP0+J~UKI3-pzVU*67-Is zcLnVb^uC~7f<6+oThQl%9NcSk>GGvRqhdk*1@T2h`wkRTCWtR5+BYm{m>|BeXx|Zn zB7*o5qkYE-8ZW3qP^F-hpc+B7f~E_aDQK3UIf5Dm%@@=ns9jK6&_Y3r1T7Y{RM2uk zD+H|)v|7*_LAME7E9g!^cMG~#&;x?j30f~`qo5u^TLf(r^sJy41-&9@yP&rOy(8#d zK|2J!FKCybj|A-&^tm7h&j-5pIb@+xu^_%SY8?kaG#V&~uaa6fL{L}|UoW*U2QD-k zA&9S>TF0RYjm8NYFQ`ILr69hVY6}kCXjChRud7-&Q_w6ya|AUCnlGqDP`jYCpoM}K z30f>@si5V8RtQ=pXtkgJhX>&^AHO3VKn{D}uHQdP~qdg5DLhL(uzzb_x1O&~8DW z3v%!-V%ndeVnO`{l?oats7%lhL196|1PvE7LQq6dLeMxt;{{a+suYwGR3oTX&~!mF z1q>rc%IBLi`z(FgJ-fipLYhlQgaN8aV&bO(9( zbl3ZhBzZpuXI+pNOJJ>}>&V*%&fD2Md;#n_@;(5k&tR={^MNHS9!K6`;EW3Luowf? zBaXa@;LHs2@HwLhsQy)MoL#tq((L;5CAC zWfpHV)-1Y?yp`bG9^_%UUa-A949+vzysZ5G37n6DJgi*xI>uW(1XBSJIyb*#uwK-4 z&SZ(oR5P% zF0}JF#@p|3d_fMObMreEYdTy9?$6?l$?6X_gR?!zi;cm05Z5uk z?}HNx1HegsV`H-VjYGqjiigk%j|*x&j^UjacARMtI^kh)oA&Q!hQ=QH8^_1kz2B#y)i~AmjRQ+BD&JTh-Y(@}lSNDUnCCH17_FZs{cRM)$ z$l{I3dX5MkjVW{po#dCBaCjWUI{}>2gFGyu@)k6C)4-V@7Y;qft^ z-}-r98lY02^p*`JavfKyjKX#Uqg|E5G#m%sd4^kn^NP}nicw>H&Ba*^{iWda8XjLv za>d&p`csDC;Bh+Mn6JNLyk~-Uh2cuPTp;do6~Nu#JY#r8INw{m|6@4TT*X_CO%*(j z@$La{)G=Bq@s7rlERS0ZJP{oA2^jF+^2<-S4>=YGkJIsDVVuYDBn)1y;Yz&RkjCRG zfE&TN)A06|U&i~a;aGDO?^tZD;&F`kb@28#@0b!Vw<_?s3gE-RnQeG`iZ)fj$X1t;;2##SR9R{?w$I5!yH z-r^kq-b03C&2_w7MeRD~m!Hf3kKszZW3hDKe@;QB%K7Vl?u+qZyPwnN9oY^R=)?pyU}no)8;pZ zy?tEAc-z4HvEjP$`k$XG!219t!?p1S?{9~I z*Onu^AdmI_tvq-vuN8Ul4g&8xdGJcWTbl=u;oYAH??CV#%Y(=E_PacIW#GM(2an(6 z?ckg|cr3p;dGMIN);xGD=Wpi0WBRVogEs)YTk_zsK7N)5kNJHlPhL+RyuJwU`8;?` z-yibiy^|-eHxJ$b#QSj`Jl0!Z?+ZK5b6p?I$02#}*#8}o2ao;f@H}{>;GL2OkM(hO zp1i4f@YoNXp9hce*5|=vc=L1cMq!gA@BL^dcyY4@;szSErEX~ zL}Zr<)T~tVHo1uW2*)L2Sqg%1auJ^k5c$%WllZ)kn3cxYV3t=JUE)5{=o0slMwhsc zG`^E>8eQT((&!TRkw%xek2LPgH;pcFA8B-n`$(fp+(#Ne%r}iL(VxcZ%!{ea?|iM2 zotdV84d?}5W7{X4ADVqdYj=~ej}mZ+`zV3W@+|?E=q~|Z-g%9?#C@dECGI1QMXFF( zuKVaUT%tdXdntBJ&%2gf`aWvOO~yV-z$NaZ1P;u%1YDxO1hQ($CGI1QE^!}e9F%Vw zUE)5{=o0slMwhscG#;668eQT((&!TRkw%xek2DU?H;pcFA8B-n`$(fp+(#Ot`KHk& z?jwyZaUW@PiTg<7$@!+yCGI1QE^!}ebcy>&UA@cF?-k-}`&5NEbo`P+wLn~+7jpOn z{IWt*CQhrZn^t}1|XB5IAFSobsT4QfI ztj_yCm=^0tJAPReERGA6j>W;R;X@9K<06Gv99q{7RIhXkf&QS7Dx!&1Q>Rx~W|a?z z#=I`i3MA^u=#KQv4H*x(FOGXDP;Zj z_TLuZS5@rgDv>M#z76P#y;AAM;hZm`AxAYxB>dc}Y16Y3o=?rbuYwtl@@M|RD`sy+XpH@5J{OMKG{#Qx=HxjDLe78dTN_ReG{w+!R>yq?kl5{@r zOPNoroice^b~l+%p?@hU52>(Mne^|iQ0dQb_vT*;zvYthHzeiVlJY>Iqx%Y`GkDH0 zy^eABRpAW>>Zg#`KNrrY#BWp~v6a86Pz31P3bB>zS}=`e#+0+GDsx_<`6Rwn1A$Z^S*>DX=D5O2UkTq+h?(O9`qB%c`v4 zy*O884OU??ze5xP$jj}mJgjjrE~~ed&D`d4?9-7DC!EU@I)?j0l~RV_-pkf19m|U^ zAiBKnP>AKF8%;aVPnB+==vD#UqjYP4JpKH%>d9x;;8r-TR;9S~~L}L}& zSHq(}hZvL?wuTCYy#Becy>9o`8km(WDkR3{-XOOs9kcRBg;cVqRZX2yJ+Z20%EYXe zoX>sc3>6a7Uab(8JhaxQv7c?S<>I!E=Jfmpj;Ndl{MuWm!yhGceVaQwyP7&C*Dq*F z@yE*a>Df(Jsx$mNTyuTPw71rpqSs=i)lCA8AX|)TYbut8VG4h3Tf&&Svgu zdU+Fm;H<5cJo>b$KpZs6$ojHGh9XR`{!qA~O z@^YB_^R993Qm0nogv~?CwMN5B)U`V9?1#Ul_s)dcxn4NdiZ3H{{BFaw`l#pG-R?4` ze=7z#*6JWm55n=EYxRxyK6zhnh)lnM!m(E0H?gzxaIKgxy&*EK)(Xd3JzzBa=UOpe zdP8JdJuDn+Rcz{r^R})P^VLsvHnciOIM!;oNi!!WTr1}50I?b=9BVbf^oE>scCDDN z{$iC9j~s zZwkj+y<%c#r|w!YU!`L8hH$J^uh9(fSutM&#Oed#SgX6hraKto#>IRcELOiz405d1 zCX;5)y1Q1)*CArHRXEn_K2w7OeOAoZK(SgU9BcJkqv7@F#>IRcDpt=3$6DQF?wEs= z)z@+4wLE#o1qTljtDA*mt@zX5bewQ140)}-CRPs!$6B%M=y>aOQ^+zb6D#`=P$p$K z+?3B?pB2k+uvm>0j*Y9-)F787xpA=!4->0F!m(Dz8x3>hTCohjE>@$2W348FO~)lN zt`+k&M69Y6gB)vhp-D3rnz&ZX*WqGSFC1$%&h#W)uHjlSUq^`5X~MBqwMN5553UvS zb);C$5RSF_t*ODVvhvn)Sgf8AjMz2vR!4+D zhdUPHrjYqMR;-2z$6B3kuG8auR?OFNVpSy^YgJ%kAMUeazJ`lcv2d)_;YM@3&x-jv zUaW=+$69R!o9+aNKVK(^)su=rjWmBO)Bx0_PsYoZ$$^EFPa?iP-<`i;?W`G;%8e3gsUCgE7C6=2hy3~{ZP zuam{F-a$|LP8F*I zg=4Kac0qR<#GkLz#Oh?>SgRSPE>8DZF<+;P)hyvyt05-#3ZE78RUuYK3&&cGF`A^$ ziuuw5T2MRVg=4MwicdEI;?LIviHk!I`MYo{9mV z^Yjh(ogw-9k%yzB{icciOl7qgM>g;cu|12<6svD}IldI8loj7r=nm=g_`H;|Qa>%j zZVygz6nf9ZUX3&NCv)b92ClA_xVT*k9XUGMUzxf%3mW~SKBWBk;kXTdw1pv?!q&d$7U(HyRm)~glj11*BTVd5 zm6dIWEW@c%8pn7zI)%5G*rzG03LKfj$HyP|lAdYAiJEHQf5q{oa5}W^m9lnK*KhUI zs!AbmQ*er-&_yQpb8+UDAyas+q_D}u(J7o@YH)_Ks=(2f;S8~=_HukFJWpBiU7POR zJGLKqo?FXios{Az|7#dD+)Ri+g)=3t>pUDC?S3ZB=PRoU97(Caal^ysi&cLw$Cttj zl$E_wZX9*!p%=I*p+!V(De(hZsN?Zl|DXK$`PT^2fJ{)^+uVuEw zSz>j9m*Y#}Y-Ke-2kJbx zI*8k2Up)8lH|oUdUtW$cg>#fuDUNg#_ka0YbKDe~Ri$&_qob`fvDZ@*vRBHj|GIE` zy~K64hohtA=Sy^RA%&r}IPw;^>(qtqbH$2t$8?J0OJM`F?hlV$+O&9VgPTILZe4Md z{Vz=HjmpZVaODr)9@HptJ>=o&6mknex+aL5!jp!ca!`|4z3k=qQaDdp*(>Gfb5axM zc~YovDvHA>oN1KH(e|41nXjxCZ%z4Jf-|?4*<)WKadFc-I&yRhZ#Ly~DKu_7Y`9^+ftQLE zw}_-u9A64spe+m?pnQR@e4}5BCx!Z^qBx2%z?9DdWo65dPYw$tE^aJFM~;q`zt2F| z3UROH(}vET+A3DR_HukFY*SXH3;=Gxt3#K!c~YovDvG20%T4UnFCrZtE8S%)j?bzS+`%m5uAvCqDf3H#}ClMJbNY>YK{Smi+cRx<2`) z$4a*i#qn7!Qdag}c~5BL`HMVOx@{z)pfpnO&$KLe_iLX z(rrU=d{);hs{uID-F^G)pIq;;(rrU=d{)cBb=yX9XJpNCkCkp4isQ4&C@WirtA12l zlkr&TwxKvas~db)RsVDIy*Id4W{Vod@mX~%tG+nW4W9ntXWbqv-8K}*XSD)cH(!?> zal~yaJXX4GD2~r+rO)c50m;QHJyyDHD2~tSMxWIu=dW3QqsL0O4aMRaKvU`@0@1-8K}*XSEt!_o;Ho&PTsk?OK^#;}pkd zb+fXvZR4}PYo5H>W2M`M;`pp?@mc+3*DL4W;<3_gLvego-&0oh?lAv}A7;MivC?fr zaeP*5d~uz3-w{Wz@mT4$p*TLPTYYg&>v!HIw|cB}+fW?vuy=-eSoprOnyGXcDO^>% zm>MU?MxNAuVV-t~^+VQLTacnDqNj11GuS?uK&v&EW`%QAmgWlcbjqN#Rh1{`0%zvv zNO@gz+QeizGkqL-F3Sq%*enh=;iXr{id4tnT? z070$$S!B>hK3fZVm@nqD)$*lowwL~FI;fXrCqWOr*dnN9)~YLm+KK$$EU0w9<_h}Q z?-jMagTFF6%zSCAzNfG2Y`Uy2oirOv$pni>uS=BeF)k6W_=4_m8QYPUw=m7F-S zYTC5A%BpD-r&iZaubwiQ2~^3gnmN5{@-(ASNuGReO^u{~LiO~zY160TOJ`9{nK->F zOIe*9?b5tCWdU)01I@j9x8X2-(xswp>^r|eLrzr+PkY;EDQQd4~thsJ(bDO8*ZH{4!YG`!l zOMhRt;Chj`7cY;MDaf2=9zRu>HbsG-N_PF!4>{+!D+KkPrXTcj+kVi;H1D9=)4qdV zZUYbc*cP6xcbj;&pDB-^hui9cKBff))ussr)w&G@wVoCe^pYl{JltwP&F`go7^hD0aZDniJjNu(mTLxg)gP=LV}FF9fJXB`t6HOdxZTVD z|H`iV<6`=i)Wpg87tYRHXr9RVFI-wXXOw^QU-hH6OW?UX$cx7Givvw52uWaEuT^ozC$k8l2u;dSzP^GeCd0+l}hCe_Yj=(mG2(+rPE zyx7$UUgC}dS`5xl3{S!<_wS;31bDvy=jk9XHr5v&)AzFB*hp0R;{NUOISTY{F5Xyw zc&CGBzdrGWH+r0}To_)|4mud3ig&bclT7v1@#(pE^SR&b*q+yr9E;lj)eq^kg=rmTW4naZ_>3);_G`RCiw_ub98iU91xYMW(%&tDv0T zVw<|mb|fu~q$QEK!{Ak;qUX2|6H}zVu$Zh+BaRxW#QDqU)l~QSi0sX-fi{h)%;r?) zOz3*jCqKbRQ_DV1$5P#Amm*DF19X~@`piTqdeVbD1u13MTM*ro*)4^46hfJz(o%(E ztwQJHsEe@)=p3cfg?Cf%Yu_Lw?W1*(#kK6MhBz?0S8XR^k-^tDo*QD^C+ zQ0ksmd~l7qe0slAW8z|&=@f1~qZn~I(H^vn3bx%@$%~S8vo~)=`O#y;aX37>2NQtF z^{s$a(WjMR??zRIz1!$N6;kAk!cjMQUV*yFUjn2X`sF~n!EtDJ8l=d10>?^)w&FNl zp?~72c>_>2x?vsbG@*~tpP7E^RPH&^7153JP?$Kp z^e)oDyI-_?4~E9XG*TD2u0tlLJv~C z9T~6bZZESJLiy&aMy$e#xz1AExb@hpG+nx9v&&obdT&AIkLspldv-pG=mI+fNEZnk z6TdeqQs4A=iqoGyCatEX`<&urcfpd~p|09V-BWRS_oVww>OO2zrYyDWrS$ko-4m4V z1oZwjnN69e(ATCiFYC)S^Twpi2S{u()05fNd!VYr-eZ#Le`Tg1)qQU5Bt+7;raM_W zDHCFVxOY{Tr850IHz!^Xo@Sh6_kOPJ;PtJ#D*7%`Te9?Tpw=)UPpNz6GpZyPq9kp3 zmE5?6lFhx8ypXBU7hS3bY;&4(v^Lg_^uS+ z%|L;&<&E>&_m{&XwesF!i}9bWa`~44mApkhQ@v`FV>Xzl-$;nT+g}rrJK6yR8P+P$z|2JFH|=SLd385BK`)Lh`1|( zNMA{C=4yckyhpX{?^h*td>AS=dP7~%oJ2#XbVGpQ{@ffpvQlBYhSV2EF2qG+-QoG z)c_o+_*v)jWyNB}TQ^;?W3A3JIo%&x{Y^7dIPtt|zP7(u%@&Te(leI&i$tUl77RH0 z(?>q)Csu2rq3b7ctv2ECm8>vy1dg(3m$Hab+vO1j+!JYHFyN4YlarGCDwL06>dkMI1 zTz7Ytttb(zbA)59LPk^Svzl}5Nk1wTtG>dqR+pRDSq|>E+B44o_s#)gwMaPD>OB+A z!OF_E!|nUOF#2Gz>J^T);?^W|hd>HLe50n~f)%~b9U@lT!i(+@$68G`nt{+3hQc^w z>%ZjrHFpmbtLehAR%~^2he8TNT$4hphnKwk=R?J+9|>@WI@Zd5gU;*2UmAnNYM3dF zL1OiQ3dOFK<@I8cgVnR95S&Lm9IgAk(ePeS81h<`iPd%wM_cjgr5g+>v{mjre#-PH zHO^jU{rQM&U4heiX5xSsGs9)@e`fN@AVLS1a~r5T`V13kj>zR`v^2YPIGLUpUl%$%Ap4^Qr!) zbQ`sY_$G3(s$fX{%GR!WnHN!hh}gM3&|qpJp##7;rpSc=w>4>Nx^6Z`Clr zso~N(lty!7bNWg>v#53L9nF_x2aUQ*u~WyCT1+)gtEo#bs7triwYPOPFVq{)nfW4q zsGx$A@p3h#?wbV+e9T~WB&n-!Y>d`%6BKW%xCKXDLt9s?Og)b5Xqwla?ii_Jk+}uW z455!;r=Bp)=gvHKHktWK&&=V)(0NKj#S2}e&h7_NSD!`T_9u0ndZ&}1t^O6;EI+;V zNSz9KFP6$rZw6B}btk zmKKj!S8IEH!=?T(P|PY~Y-_@h@XNb_c}G=zUF~%!ejOAWZ(VzRM`u&+keC3q*^MrF zgkIO#HTROHhICykH-Pb#n8`v@I;uTYUcGaWfkvg~;C!u0X%tJ(z0?Kg?^KntS{(k$ zaNFEVV)zkZe=2Mt`1S6bmo6f|uc!G&>VjT+e;ArY>*m&XHaFysk4fVqL8IBOpsgl=lugCw&T#SF{->E?CMY!!& z^41H-XWd+5;bG`62j>>UV<%dHU&0&Z``tvWRe{G^a8~hV3CH^ZdHOR0rBVkz0d3?1 zsK@2{3vCXMq(eKx!UEO6ctILAHR$4>{&F>>VdzdUe`5hI`f)q(SC0_Rr* z&hc*Vv%fZQ9&7@vdA29L4Lh$Cy>Bz`Jt1ctj=Z`v81UQ%G$`KTe_TIG&==4jfNYXg7{Yg^KYEQK=Bec+OO4 zIM7)NjRTsbPztD4p_xF_6q*k-L!pI0e5(zqy_jbyv&%#9Db)E5N zVZLkP%v$SgD}~zlG0c|_Y}KeA7au`ftMxnn6W1f>%E}C8DUQ!dkDMQ@19fKn zydM1Wp+kT9G?}-!L6^| zH(t74kDP0(sESN+d{#`GJ0sBf&yjQV$ho%CjYDyKR=gj(GaYxHRS?l5=h{j)4#n|V z@u}Hu^YvY~Kcq*_wUurhisQ55yG3EhJ~F&s@x>B7a;~j(<4_!*6`vE_l0WT*t^fI& z+cwOHjEdv4DpOX+;7GUUtr0hud8~BfP#m8XudKol^Gmn*;&0wR*kh#|hvN9G*a8bf zw)K9tp!{okmr0#3-8dA-XT@HpFvR@QT~RgoM7_(TvNCJt6~|}A_pZVak960DPVUyb zOlm9LHWbHa#n$eYVb#NBDZR_2w$g1waeP+n1>JnrZa(R^dY4IUrQ3$$_^kNG;$B}r zd~Hoq?=q>ablXrIpH)~{@w%g%xT?>Luv_xxv)eFy{C(6>)Tlj(0i3mquNbFynbdLV zjze*Laj`FVSBW2Z>iv`TE|c0yw++SdS@AivFvONdxA;ff_6+r;P`3@m@mUQ6w=l#W zkM5b1)=wJdvC?fraeP*6w}l~=65SA(BwGz8s%xi9GGK?=_b#cfYi?oI}0C*Sjbf!D%=5@6; zU^DZe8jnq#+>D&#+AVGM7|O;OhK17|c&-FJjYrjC;;9C6tsk`vRgZ-mlfV$QPTRtC zzT>3PNPP5YHBicL*7bE$h3;{K$(r|h$L2Qp|GzR$I>!I4Eql?8czpOhA0goQJfpwy zEjR5zsnuNOo8auq;*A}n+osF=6r2)1T);_q@rR%`?V~{sytdGau zdj~k526@qP&n%tZ0lEl}ScA-?o0MO4TtxSyI(-Z;3{EV_E01TzJ06_LL0-&XehiP_ z`(F~|B_g_;)6uFOs?*?H7vx2wzV^cKR)KSS7H>>k_kcP;^6mxa@gOhoP55!(Z3E|D zLEhMeFMX^xj&C2thf+8xzgWcgu{?QY;MlQi;YG)djVVigAa5*qHNo(r5nn?fkGqau z8sx>}-r!Wb?*iwBATQy&j1+G*IQIm3Q8bu9`hEq@wk+P*h_}CG`nb;EZ$aLei0+(B zm?z->2jG0&yv9hmj5UvwhR1q42Ar`$UbMVCSiebdre*QQ#Yda4_>bYu2B$5^E6;AH zSAx?W%!&PMYH#>-go z^aGpl?f@Eu7o81!*@2UM#J#Ove=xZRoC^nN9^cGWcw_v$(~!X>;A~>Wz%ko8eX+6L zcFHG|iMT)eoLzI0%Dm_M)R}Rvf_Q#_+WRFmy}$j{-rxCZ@9%!K_v)|qzWJ-YZwYws zk5ww>8*Zljdme8)u8$AaN!kG~C;Bv3QQW*KvrP~04}xxu$A)E9U97(eXQK!fl-Dm< zN?yNU5qbTB<>U1W7LM01STbI}K(S!uj+=*^WdcUd0%0o(76?CG59{z)#=$ZPcn6Cm z;2kWPfOoKP0^Y&$33vyKDBv9^CDkrG8OvEvnv}DwayA|lUe3nj@e7txwZ|`5L|(sO z`FQ<;h2!-LmW5E-wEqjy79;M_R zuyW~>U87UoSTayumU$zy)fBl6+$`@>i@>^TOOsboy_PJj2cwn8rQ-E|@YJog`pKYUhcDRO%6JD;)JgN=1B*X=W*5E5JS_;)+)OX0aK||V@4}I+!EB<#i3lhAj|2}12?pxbw*#p z!UaRy%7u(}$)(0z)o54eaMWroq)7cr!A}&b!I3SoNUfOS6HAfWW0Vz9T3bmf~&2&ww`v5L5sZ1@|TpZogJIGz>M;|EZd#o*h zUQ-q6rQZ6fzn0v`W2FmWe#ptdn(XsBA+=FqOT1kn?_SEv3}DQ`H6s zA_iU9#{ucWJ{d@-hN-?EVy+CXOY-*w?($(a#=n88((}41jZ}tBv1IAHRAa@<(q9oQ zIo(MgZ2Zlt&do+&vXqxYYRT5(=$rGD8(DJXQm9P#t3u<|fn`P;*nz2Fs#P@UE6s^+ z*O%%TP(t-wq}hGmZnR_n)lgC0eMa$C^=UcRxN>EnXOZR!OlWH5HN{;^H*^LHbaU?@ ztQtMcE}ycis-kb&c92p_kJ$$FswEEiJ^(3FzxvH4T%;zbb=$ZW=gdu!>Y8=i;HALg zDpEc_QRrD5^=0#SAl-8KQ@^^d%7E4>UKr@t3Y`G-utL8Kc?Zm(#_%N$;`GV? zXR+|$FrE-dp}VxERyfwG%H))9&~6G-yVritU0QRtaI94yQy2Y}74Mx)&Y;Ww(BEBJ z(_c8&>Ze9?pt3sHSQSs+zD`dNLgCyi9BXy2sX;!W>In?SMJsn{%|pVmR{e~IZ@_*l zcWF(jaIDqOO%3v?&Tr)|t$9E=)@q=sivd|y?$VmWgk!Dj4;ru>{BgNUYi=`E2Rqj4 z5>tbGboE<#mevTzS~Zy(WDo9IUDNT$o7|-}mkP&P*(E5vvh-9Rle6@_k6(6|)*NT* z%UxRYccbCkhTEck|NO+HyR>GPaBN&3n!5N}mX)3$gxc9H9BWl;G-X*32dN_9o}H(0D{n0Yug`6pK;^Q9*U={Hq4HifSkjhg)PS?LKvTD>70 zYjv-wK{fg3v(giUw0cN5*2?~5ked7xtE&zf(O*vx(#rm1(BY1?I^WcVo*=Z>^6Hzu zT&*VvX;mj2YxR`T90^~yMg33t4JkcANGrR||B({cbEdw+Syo}ygV5?_;n=uNG@7Hb ztn>sSt)jxQRxg@bK03=vPY}}TRpD5xk)|$&W?AV8LRxW=8QoCHm;DKvVbJlf;Tzx|5^~O$Dm09tuNuz>lSIT9$U5p3kz{Zdw9)nsd4Srwlb5YHCn(7Sy-k*PE5MhcnTaiv>*!8rrW6at`o?qn0DN z6cc;BFC2Qmn#Ea~rHN-*v8Julxi~tD!_f%qH0SNC@_9O|e7@()1?{u9Z7$EUI?Wey z?ggb4Ss^E~G})U*zh|?6|2h}bvU0j0i^De~>$FvKR$S*~X@2I@?CoO+esEyJ9)Y&3 zKVwi|FVr_QG_|L(W=?+`+8Nw;xW1!de)Hu`bq!tVwt4e{zW4yQuJiH+G(Y8|ww$!P z(Q*-Gjy++Onp?5DySa+WESHnrS?S?hLPv!s@%RmMvxl-?Rwr93t5bJx!CkLQZRM&H=f(u7s3xl@qa)02qY1UDTX zf0GoC##4wkHCWxcm!#zI@uVY%ubT+#X;NTMb3|{7%`T-?AKIvD^w&tXzb7es4Z}^4 zpW?406Sl7v%Sv3c^RS$A)hm{0VzH=a-EL!7yIy+g+rOC0VZG~IzasZ@udHjpSJ(J( zzGd&NvTiS|93`hFsU>2MaC#q)dhPIR9Wt?v09qvqTlOmsY551=%{aPY+Fz_x63RZ)^&@O#^1oF z?$~aitzECzRZ*ZAswPf1itK%_)tyu~BiXXr)dkb1d^{bPd+zDMl+x318rs^gtZQv+ zZSXBq*303u)SeZ-VXk;dL`&6wro8U?2-a~N{8sKDKP=WY! zq;PU|bIex;bowZ({JIex`Z)Pz~7N zz5V;Ie6JYu@3EUie0 z;MieEK5Z&q!bfwC#S6d+Ja|529@{vGr@teKj`lK#!#{;U+Btd&$6+ANi*%^5Ajk z@xdItQPJ`^yuRAm?{z%;C~|fz)t$toCN{m(6NT<(m6#xNH&N7ZGe?gikRoR|j(poJ za@b@vQgc~$7D>-)VoDQ%*K}VN<_y*Eqc80M8&fYFqQq8rA7E=erCHWQZH^ zEmF(=*eYd4*xfQ0Ti#+1zqx9&RZN0c>#q=ywke!kJu%fi1-Vj5PpZjYmGmXM3%W)r zFE{N+=B7qJ2DzeS^;4dWb%!D;EJB@F4h0tBSE})CnL^WW)V_0p!b-OQNA0T%+_PV- zF7zt3Uu<>ewd%~X8(3Ys&^cZA7S1q>x7Be_v|4Q|K66G`&A~mWC|heX^UAiKF&rn@ zK=0!XVU57nWYgVdDe^N=+R+%=nn-*R@m8ExaD)YL(`t{C= zDiJ8+lW^*({Uc26XFkbM`JA59ld^UzNjo`bH!W5()Mj^84r`5r6gd?*vZESIbo2VH_`U+9o7V?Gx_NyGq%Vv<=pR`R zMb1G$-iyVz8DvWB_M75%$Odf8xM|LlVNtvCh^eVg07+#5O z23Jl%AKcyN9@Z7Vu$Wwy>Yjl;LC?@thWfwppSY4ZWjcdXqG5aWmG3TD_85G+`&32u zEZJRHawG2$r}FYExoIeRyCu7e(#!PuvhRWDy(n!e7@tbX@ja=+Dzq{?yIykRDwrI9 z#_*D5b=WI%YoERdSA~GW@LtwCH$!13g;%EbEcv9MWXY@0<%%w|mHBy6`A%|@nca_a zP);{#wsfxbrCnALd>8pS<&4sjrBS46$!XZDbY5{+B3bhA_+b@GF_C>E{7a5>DoP%H zA-U&O?Du;f{1y!hRqxpX|E|C7TmZtnRXDB5G~t?fxMG24|jp478GVi%(2ZMSQqWdkQ+p+UYgp_=$irwX(u^Z&Bhn})_6}QqHJN`QoJk?{@l`b|+d?`oJ8MjvIcw#R;i)~(z+%^g zl80-C?@|8g!{%B0rwW~thtJ*vj<)>QwO4(<4JBN%Y!K4ERm~`-x@Ye|L)|&+%RPHe zWv!Mh;|5}E36Js?@9DBxS==XhE3XA-=Zr7*u%V>~?@ZzRl&eciR!oFy=MNPH6_c~h z(R-Gx_&RvlZ4@_=vqGuNBxmu-k&r}NASEBiaRxOX0bl&UsfjEt)$%ytxmcIOIc>=$U>?V&rNx3|NseR##=(ydfC z#1wCcvZ<=73<(#c|7@=syr=gSzdrc{8too5_Km#{f`hG2WrNg0+!fNrTl?Vo!Rb9z z$JKjt@(CosIhD$;TKp&g!tF1{w@qz_B&!97Af#nfc}Qk~J;o9-No_+7Os zgq=g7<87UvQ0ZH^?pZkjFkb1FejmPg3bdvRoPw!becjHXwiI@ z#P>_2j4#R@DUI#YxZVc*}of#1Py@bC%}OUozFxn zG#^K;TL=_Ux@&RNH@}RaiFyZulcr;(`^n+@_I7MSP@isYYaPXx_>;^l{(=20ucoQ> z;`IEJ!^bop*zdr8&dFg1$5Br0lxfq$$8?5M)2G*tijIsxIkBy=>C|I7?f(%|)fzZz zysv9$1DHd>L7YDMzx-O}T@yCi0^&;Y2$_4r9DICgqyD>a!VX#<+<8WWmH{i?kcnpA zy7>F<*D|w(W3BioL&sOO!q754;|8$F%75iL_j#}}=_5MSr`3ipE>ud8&w zmf>B8uCHU`Vjo1u=2aNt%Uu~yH*CAl{aVIO&bVL8bdv+OKcp~p4~~pAz2!NxoE|6Y z%SryibU)1=Pbn<3Y7-Ff@y<53(qh~oinalwLn`1xpET`wQAe`d(tk|=;vvLc@4LR7eoSx5;aEjxz(qGFQqP?BLmwoF! z&vJS`S;8rf&q{wS!}6z#K6zu@T z9Xj+

L~3#V<~*)0z|PDgJAX-TIjxTGP*0hI^SQ<4~7`#ou!9jJS3- zwKk%cRhefYq_K}p-Mp51EDQGUg6XlrxL)1F=`-~(>U@+)Q-?Q5>x~iWD5l^p^ZH42 z?oaWl@l>m)+Vh)gdP0jzrmeFM1s+&?tQr88F{kG#irU=88=*~%YJzoj%?sM=u(b~M z;cQa*tM9~SHZV5Jo7FBq!T25DuXphm867pkjDhxiS3D;oiMYEnBrh&>L%43wG}Yq0 zB^g!LzyHbzVqy#*pTyk?v>GkzB-2;2YtA*|mqa7#1ZSPObFlMNyqIqRtJ*C7XxtdS z!Fv}RgVj9$uQ)YB&tLKi@xBGeU==SO7Vd z6)H+ADn`Z454q!$uI@80S&RAks3hZRuJ9xk&D}w6!wHReKS8>or4;JC6w(BwVsA-oNun#;5QluWi zM=Df-<0ysZ;K-(@NA>hmW*5%&Q|1yN&69yL{e}BN4z#r6mo_Hxmp0t*+||!yl`Q=? z?C_MV(u)_drN7{L_d#6w!DehtetfLi4I5l3FwMb1z(Nj(yGB9MO5Gw(p2MG+Vh!+)R@VRwv_dsQ zFE-?hDjOZ&Qs7Yvk5Y54THsK`sNWlzZv7TGT~Pk99vz5PB}2t#tInGYj>47gD;ZUi zj3yxcS}LtJ_H)8a1p_=Zd_Uf&?t{wB+KB=wjh48aqMZ@^tj#xiYOyznWZ7NR_ zKX#|d^*q{Z9A$Z&ZAsCOy+aRtq~G~h8XyKnJSp_0wL%jtS^7)pRKKw4QC@y3HomVO zib;m*%x~2>7H+6Pt=|0f?$X`5q6% z=3L~&fR0s&V~*PQT%ZX`H(L;g$h7WyAbrWH7RCkKnctb;Z*!OR9h{&R%;(Jw4P=PGZ;FE);ccADnbMc~U`V%s{i z<%$zwa>3?n6gvbs{lq3Uofo(me(otCF;jc=FguIUJj^oBLO!1(=Elo({Ny4X^XGpo zQ+|yFg4S?uB-=RUTw-tW-_J{(QB&KpXr7t6uu_eA;pBf*&d}!xh7Fl@ znjZF})+y(@ypT6q0R9#8wLH!b9Vu$#P_N87m11LOopQJ#&N}&^Zgi#aiA|+7-w7t? zQ@!w{#5!Nbruhtq)5j;ad<$A&H&Pe+T&68ioKPU2*z&P!4ocvB12t4?XC$jrwZ9-RP_Uxf zFmLgUwk7lN4KG2$IO>vGU*pfJy^;~il1WAm7kR|Dbz6ON?ok=$@C?-*n=vajJvCDx z`FY4WV?)fh*3uyEsKtwyE#Zs3^ALu} zC99^NI{ojtKEoFIOl{R6mzOgG85Q@`6?%_NTXd5ZJ} z2Iq(89$xLei8p60Fv|yMEc@B;96Lgu_Zs*YVHR~R8*Dg#9w0H^Ngq!e-vdqf;=L4C zfj>>3ds_E-;1Avh)6n?QVTz&P2^Jh5++{Gt(G{96;MC}YMc|nHr;5O_H~wQ0I2PN> zMc`0$-kSw*qsKZ1v}EDtW8jY27Xom6Zj%d~?7Q}_~6tcac365jUMM1 zD)Uw$yjtM?Y_JT!Q2JOdqd5=?xkBmV^Ej>u9Luk=2pp^38Aae&uNsQL?G0RO5x7CX zWs1NtztW%XwrG zIDU9dDFVmxTT}#&`M9(Q9LIIvC<4d){-j9UV@2TDu02--j`@AH2pnJAkBh(^4%}Yy zkUy?kEDs z=hjsOj_>(%Mc^3k>qX$ofs2GcYH-ha?(p|3SfbxIsQ_;DxJmvu6LAHd)s*GLi0U=A zf3WlN!yjk@I(GAuE&IW`n>nf_8(r^{6{R>en+^Fl@x#O>u6GJG3RmVWu!slEw&jBn z%KELC8fIUD`DGC|@#zWRqeW&Yt{S30TVoSdibO%B=Kq+eyChg9>NueaOf!~qg1oFE zvw_EAXOF7NHkaC|!gYMbUd7K#Y{z8ZRo_DVmDy@#Rdh~{1p1%QsuCb!G_z9KzOvM7 z9T5VoV>|0(PL-f$18z=^fSClpG(A;ia8m zg=ARl3iwoI+dM9uEUnD$Qw@VOHe;9zU5FI`KkYS%?J$aCHSg$S4@>8gg4LsJ9n+`J zklqb`c#}3<`mjz(_DgJ+dCPJ~A#4N^b_RY?QCPiOC{A|VBh*Y>&k|}buJ;Png6la# zt;SU)t^vi8iHaGrTA^do+dIkEAe@GkLj*MidUZUXg?`2NJ_aZ=-9;r$YnhU{B~D+{VO7Jr^L71C57EL=%d zY2VP#uc^>ef8O$|U=~bG!6mu`2xUYVATs*Mw#tSjV4(<){;iO$xq<-$hLh8afniEK zH#$v8`(tIYWHWaI+rDp0{tv_TyFwj>t3J_jpl%f26rXoGsGkduPm@nD>Mg|e7NJ^k zRoO3q>JnZju0IfpF{v+Gye{Ffp0Gwly+?6X-={&X7vAr1y;>+vM5^znHAJ!$iMHtT zwjq)Xvt^0n`Br8J%DquThx+I8!|&JTdOezJw9$Jb7BsR0p0p1;Td{`?O5WU{srogL z@&a)ML00&zxM`OdD|1$v-8XonV^>`(te7O^ge6E-tm6h@ovN!-cJ+a~47yqyVOtOl zM7%OPV5o@n-F8mES66`~90GPF+pcVB`v;L$EYr4~k#M+Jl^sdtNYM6soRPr9XDnP5l`8tf8o}K66bcm^s0*thm#^GFvrNS1ieS7Nvt_ z-=2Mvy&D6cn43SvvPpA?C8dWoIfstu;hmK5Pj|CbqB#Mb8F1ky;mm{;)7t`aul^{UEAIwbxw&g>iOz zi|~tzSr0ZyQCVc&AXExh9b&Q5(?J{2I%s3lcOiaJ?{ZwVsrnA6M&Yq})bQ9HYO}cs z)MMhi1=n8)^)jv-h58WJdxY8v4}hUZy+NQfF$7v7PeG-R$SFwCe|3+i#9E(Udx zP^*31HK4kLM?+Mf7wQ&J8Zr&qJR!WtL9G;Ov+w&CP})s?>{EN<#nmo$s85xH8Z5HY zKxwI+2}%d63qh?C-wQ!$yfg&YF1#=MyqiI3T4*~|pF$TX4UZ?DEA?kkI$oujs^cV- z4?ulEC~96kquv(Z_aC4h6kZh7UrX{}P+EQ?Kf@09EYqs z4v{*J^KfCebNB{yDSijxr>6kMg&L0Q;X;+;dW2AETt^5s2iIeSYH5Q}jh2>$&}D>1 zB~G4OQcumnHYf~w_NY8Pnyt0@;>9>3ubGFb5g~`AwKdLbYhBdTjGgBT5T5J)RX&;S zG5Be^#|y=DGsO|_{H7)zEhi_`*^|}a;kthnMQ%~znK-VPq74f$$<*V}BqxPpk}HH_ z!a3^J0~b#gibY*5)FNDKgj#_sM`jV861TLz4yO;I_^_}uwP^`XNXIdO^C~v1ye{c{ZkFoJhHC2eo51^`e_J#>dY!R z{X9O?9OYMm!?KU<@5SNHK$y_ehbsQ!w)pU}6~h*<7~%D&j{!F|$7kRWyJO?I+^U9_ zRs>?hJRN7yEUu5IR^TW?hS=i!gjigsLBQs$zfdwvQNSJkRk5rvep>a#YP~l z<772mT&}uX#E|kg+1&7r2)n-ICL55&pBEMaz0}-?7u(o6xC$uRUhGIE6}ybhmZc;z ziC6sEclq{!KuKk^MvJZ`?rCE`&~VuPlthlgmHa8!uf8r&QW@-HtQ5D^(Xj&v;(Gt9 zGhoQgc**y*Vyx6TyoK8Zzmf>DVlu!WLlVi4_D^!vM-Fr z88kLu4TcbmquRpRx!`cWzjxIh9w@26OPpXFsR7^z$Mju&!Y2oZlvK=gqF@}U-9>7k z2I@7eTys-MNrinGoM0R&;sfQI1;hS&Mo39ztO)hF4}@u;`|9z@okROT#wj<3KlcDP zzCR@qrh#tA@gLq9+6Tfu7EUlieaVz6mjFs4WxV3|MEvv10;{QC3uByou|||cY#(}W zV|D+~v5FJm2`3mwYAIk1|_p);LeoD}W@Zg9lhot@pu(6Neq#o+|wNbL)5a9rfo zS4Uq9AFIf+^*q5iQbR<_KCi{M9D05DSVgUff^nqy1_#Fv9(~fD<>6x$wIT|}k>aOM z@TR1{F>`A8SVgUff^nn{5Gj@t-Ri+#y*G5MVnQpTU>vCffej9{9CY1DQ$oio8ohqO zI8q$O24(n-5xo;a$10kmDFx$59V}9O`gG9&H%tf}tC-L#B^XEQ5MYC&L}xbtY-H$I zMRU}ZU>vEqNb%{@ZU5X!^W)M+$x(-9Uqc)|ZtXpkoQRcbKj`&j_*g})8-j7-I!vVa zMChKL`oAB9k5$yVAs9#MaA1SFacJhv&xemy)Vd)UM{1}@*{3|}xdCRTN-oDz2f(3 zHC3f1h?HO)DUQxd{MDu5*%QuFtEnobbwe%wVJ9@S~mpaNR0xvB*HpFSJHUs{%SQDjRCsxi`3?4Ge(}{eKTL$;(z+oSCobkU zs2g`|oP61skd)R9!8lUPZ&30(S2PV78I&c^W-Xr z@1Awa`IEiHzj9XSpYWCZaUN%S9%oS=hm(oc^|inELkqya!Vhz#=>2?NX^hIl;G@HL z>NzkEbC-``Tz#njiVCO&K7uerja2k{Wq&E`?+FV=9r2xR<~eG`OQD!4Yn<2G)?9Cx zs%tCTOl5jzfx{QARcl>OLupyw&|0@>RO`I?i|a=j|I=%@S+$U)<0D$Jx#k-+RKryb zjv zU^DlQ43%sakQ~*_NNQW>Lv1*O%!z(fU15|H6_l?fR)!_nHM-W=zzsVTIajMIMcICYx&nTah!yF&ZHybs}N7Q@Q> z`)qWY%d}rMvF(lj#dtMWn^&CegXjWJoS>uX5RT3E4S6`{5M=pyzujPrsD?Lgoc2nF zIRpRq6~av%tNp9N4aWaYCFaKbN&3dSI@j&++Yh+!7%V4i1UI%^`!yrWX^_7FbIMN2 z;M9WPa9Xl~$lq*Sp9AI?&ZNLGSiy}e*FIUen1V(gP6p-_ejmfJJOww#wcbeYgYf)^ z;YY`ErjFL=G0x$^@|isvn2EW#@oxFC=#mD*@Wh36wB&fvLBRo%95)BLR(hCS$eROX z$9wJut65c*on2N96M&Ow2XNO)ZZ*Y1Y(K8@?oyeZg2mxTHI}1E530;~vVdBxo+l5f z%og7>9IKr^$ zjIDV9carhyMd?m+)Stj^rbo7VDGMIEM&E|bE?v|W-wyFL8Xq>_dQjLBT60Tf#tntd z!q!WZ?Vt2(U50CGKc{asuNRij4mZ8Z{G3UeI&KS>#E7HmUg zh{PgI&de(T3vIKvAt%XogAtm|%uno&ZgETv;VDqgzg$tXi6Y-16ny6NkdfaP8xfqmI zl+~cL#lIGmHtx59Qi(25D)AI3m3R)6N_+t7B>bXY6m@;FP*e%hT7NdEr0^Dlnj#d9 z#!VHf6I6vzcY#U?^&qHeLcIiv^HNc-8`N~6aPeIl6g)z%QaI_#@NkKU&w5qr*Cq|9 zg@}ut31e-)Fy0-kO7Z=m3s$AxXRi#m6Mn8#uqyS5kBQ^UiEh2&aHJ8eJe+aXyWPR6 zlv*zcTPL#{R5{QoiOgU?aQ{5??5BfOsYgv=2CGtAOkAbF26GiBzP!uKU{&fRA7fK^ ztl@CHQ4(p#m9ai^;u$@`s?=m3W2IJ`*!znV2VMg~Rc=~wS+FW~rH`>vcLPJW8-68` z*}UTSmF3l6*HtOpi0TRdck`^&%O;!w;9}+mY2h>5=_~i&sjE^%v(C{C@TJ~VhORh8 zSSAJnj>(RqR5skjOga9AIzpubjaqJ@im=r##N}d7S*&lu>yh&(4#&E01$WUJ9q=g~NWsIt^fL zUN~o30RCm>W@%f?BA=)5@8-o-%$!GaUR+c&v#zhr<~LdZ{xtx$&ekcX%n7Hq6pWo(jJ~0yfQz@#+S=Z;RjC{me)V_GR)}n=Awe_g zLXO}<6D9suaInbGN>oc-yN<39J8bC#mEp>bi8Mk5>6 zIe(TPgK*in)Gx=>=VCL3BLc7hccDjf1OB-$&IWVIPTNvUIxP$b>rXb-VP2>e=AU`w z)2vEt-^YgV^Xu^d<}Idz8*9222@>mWOqaZcYF4lfouw}mb^*(jfiOblXP&ec!~!>g zS{E8H!-gV(%2!AXwS(GvwxR^HJWHx%tU2S9WZosxZC zKa<&>as1#3+*26Oyn{xfi(?Hqe(>ll$ryek`Hs!%73dGG6gg6-?|<`Mw)(YK z;h*ljW9TaUiZR$ZR=m%seS99P@V9gu0QS?SdkHdw z2>Qi3?gyK;(?SV~t+@qEBq}N6Oi9R^<@f*rH7M4x3Z9@!V;w&b*>mv)xdn!$Fh3)P zrD7fY?6&6O(%dp<742hJT@J6R%*yjBGk=y1Uie;sx0yue_{5fOPBhw_;)^t#)n$mpW);X)K;i`RU68+YX5_j8zcK1 zst0|-rlDhNmXe#9i|_2Yci9}Flr71_)=e0xj#rqk*j1-N#1!0n8(HaM9e-sg*`4uq zJH&qRBFd|-1{)^qZ4$1!j*_(Z^^!RjqAEK)+1?vz9l@_CLaow&c95+T2&ZE!e0w(} zC;hn%J5}bMhZGt4Q1Zl3{7nF266w4L7@S0_pXSw>tu_&B$H6bQW(BTD>H~P_z4ntd zxqbRE(bhd|rIF5dQC^Ms{dOehXzj}VHl#gRgB5>0)%Q&vOa2AARD%c1TFp4h9?vE?zB2)CVweC&k9VZVaiW8{<1gOMb!9u2Ftvl z;U}JePwX1tcE)~eYvP_!>tp7Oky8HdL`JvzwddhsJ3XACBooPXRoOkNvolM%gm7H4 z{n#i@VafcGhE%bE8a-oj`}%%u&6o_v;sH8H-QR}BnTh)xJD%3%-FF~dTYp`u+& zvwvZ~Rq*qhgl%}wm^|4EnyiH_O!mORZo2a;GH6~6 z(ifN7DEi|51C+kF5i|)ZJDUSNeZABq07iA~$D&uASsGh&C8BIUc5qvZ?8-GW*O~Q+ zu8t=zn}_GJEwKf2|E3ei5{o=Dog&7mAGXy0k&HF%vM?EIJay2*SmSJOVXQT^4VPyY z#6I~UP60r_GUfQdbn~x-Pvkm~$!szQTTD8T6nR14L znesKy5}2Kim$U|r%XZXt7+u~br3@52J|HtZ};2{c=wb+W8`5+ME z!^7aV=VF|JhSt*thV&t@%j#%b!9URmow03PvlyMfWjkXmnjDKGUQAaFYYD&CrJrH; ztqBh|mLp`FH^~{E;|jmwVi&5bQhbm)kI#pr^YbTz(iwe@vvsZDE1*uoFDljvCJVI% zSAEQHfKndk`}Khz0ZJ3sI0bis5!M=o?b;a3tl6IZkW zUhUuBc_f(5uktZ*@zpp0lW*LT2tQ!hRX%^kx7G*K`TYri+u5^HKQZC39WRNj7e5s8 zjD}N#>HPbAOk5_#u?d9|$RGvAIL~ed*SWLS+?cLwx-1GSM(GjCb`@7uR>3pWsWCD}-Ch^`|A&l~Zsd~m$ zV*D>(a>*+Lgf46`bh^RuPs2GlkK;~}ViqjdB4!clfRHLM&3s>8TqQPxetN#2hq=}k zhmV<`$GJFYg;ZP+_T$vBKQ9@ndwfHPvUUK zIu3zu!M6uzo$1(z$c%HMd?LTAt(yX(7nr1WEMc58h0XA4f%#58t}Hja2Y~rF4>xh5 z9bqtT#=HOSFd>B>U68(s<2V;!9dVxr=Am31X1Ws=gny>*kHGB90RWsI-k7p74i2qj zc;kUto{LLNnh;JO!@CBUXY+AmbHm#P%$S(Q5X6guwvpnW;ne`snU8bgW%_;y%o=!;j6Ii|{rAb2tZUa2zR0eHr80#H|MZ6kxt- za6!Cd!jD73yBCAiy!Pr>z{G~+ zhBw~H2+L(8Fim;531%am$}`?hV4lpwl{wFixL1K0wx7!R<&r4Nd*7x4(~*mtG$EW_ zsn0h9vo#OrmLK!+2{4m6=L6@*JJGdi&GgaM=(qE5?paw3?|xuD%Ee8XFoEG)$ME)p z*323B(fRRC$WLD@Fxb=U;u20XF7@TNz$6Y-oL^rOiLuJjE9>7`z5%|9u7|GUnMZ#FgQOv*jyhULNdR11M^lMZmhEe%JPfhv+6YSX%&Pw7P}?_ z$MBkfxg#HEwjnE);XMh=fJ5}&53hXEIOXV-;T;9c`FXerlfpQL*8$9?Je=DeFueZ- z=CHU*`|(b6h7r>KO$O$QTwG#|vk`#d-2lvs`8a1I1=IHtFee-e0?v;&F~)2XRzAb~ z95CO^!=a;Ah+G-oy}-PmgA0G>6UgRvpTkH6u8^%@HUmc$f#cl4lp=6D19wUhICjsc z6@lZhU|tb84*QlCfn&Uv6oF&B*&=WpE`6&A9K*Y<2pq$^uK;dzBH@hd#sK$=9GriK z9nK8X4GHPY=E}^IRhg=x!>eTZ!r0kWOOVy{HIub4nmKm^>(mzfqB6UFuTX5QUJy$6 zhqS*|BO2(HnP)09kH^mJitSM`w49eXrZ%PPw~GfFi%g$lLbGP>hGP)Ui+-pYKAW#U zIpOcnr2p9oddDYy>t_=F{Ss<^(d?-72jRQv|F?_&B}wpbTpto@N7tIa_@Qd}`9-rs zlfENsO`)W3mF(CT>fcWK%MuJr{Sl#dbg94MhpOT4z)~-i^c`91g_6EivQuES{5hD0 zeOB8ktox1*Em+Btuu-?bW~x0^rz5NOZPS^Fx&dmNzh;h+tM|VW4Ob=qDip^xe-mmN zu8hWRyt8eoHq+Vave=-MG^OQevCE2Uw$ZF|q{!92sI2HcD%4b5L(QtI9k65b%PD`| zPWNBV?^a33fBaVUNHBb>ej(J3eyd*dL)Gwi;9FHF={xeRDwOoClAZs!)L)liSn7`p zwWCY@4L?*3e+QO&p``D~QZJPBt&*Mpk8RnT5~16cZ3_~CA*T*bc0gP9mITWO^h=@s zD{a|-Ilo&a=l}6r^|l1_*}YZ&kns7g_Vre2t@wAp77B&GRpR_iipG6w|Lt+vJCZ_{ z`qM(~=(g-#KU58W2exH}lJ1tufA&BNC4H-8=Rba++a(y5`ZGf9=u&^r4^_k8fu&w3 z={vI23nhK4Was~55Awc5==LBV1c}&@J;;X=EFaKsh5E1bAphn3Zk3$>$8Xg~63l1U zgM2LEe_9XnZ#Tn*lD;F~szOQML8bmrzto@e%jX55>;wJJn&D6UP&ND=*p?Ma`i?C1 zLP_816wSX~VR|K)&#tah7cMFa|Bp*dJFwIXC4EPhdZDCismt!nX_Zr9>nv`pv3WC6 zXT}Thsl^hfJ^h+frk+00n|XRNUNf^2R&-MFQ&MN?{p=}Kl~d)mCLk+vkaC}#i6f(D zrDmS)rKZMf+`CYy73r|&mdJ~dmm+_Oyc~HY(jDoEycT&q@u?R%(Rd zaM{LY?H?F`I#m{_7T*$KaUovdpSJXl}ZoI>MjFn}X zaRnCA*ZUY77uCV(_QB6BL$#1jzZxH7rA8Xgz9JPaL$#1jsj)uBN_}j~XNX9J+YPml zPN{xIYKWh&Ek=qn*KXZV3+a@4$;a5Z_BL-EwJO|vsfBb(9pGcE)Q4=G=!2gdms&^{ zPa}1JpTb`msRKnSoG-PIPO0Dc7#r7*4Cf$`3YVc;NT<}@KE_H}J0%B;)LdL`JyZ+n zl(M$+5B5{Yy+?G1;OEvuwUAD~ulpDqm$ljw7pZVuanq~7y0wvt`*EFOIERW*_) z_!uiS*Kmf3R5*odA)QinKE_Jz%*O+F1b%KkJi;$S94sR42)_(pV>1DFBz|r^R14|! zd)vp@xYiraaFGh9P%WfWYLkz#Qa2k8*Mr=+)IvI?{>R5ysW;4fdXz|o<5COhlzPX< zSgBtd&e0+jeqL%Jol?K^F;?nZhQrl)w+z)nI;C##F;;51;fxfiDZJvx@rGJR$Bnnr z$5^SW$c7t*pWF7Tg>?FTofo)K{`0y>8M1@VeZSN~I=z?s7#r7VhC`hMH!ii1PVX~) zjFl1%25=MjxpAq5bP7!11uo&I@JiE?P%XnPL$#1jv>sT@t-m&|B}R&0zi!=73+a?< z@iA6vis5i3#f?iXq*E&GW31Fr!=VzG8<$#0r_@nC#!6jgY9@2+#-$e0DYeGOSgCr$ znJ7}>x}g@*DRrTbu~Nqy4!?@rxYR;ArKb28E5!pq=_cXl=1VQ4({GrMu~H=_r^kv^ z`2A7~>6F^l$5^S?OiOZ{NQLtiSV(`{$5^RNhI4#gT!Dr3U-=j-b%)_d+MF@=34Y7= zQy)XAunO3T5*J4}bdMkZ8Ago_Jk>c z6kiB9eJah#NKFGbNa1%j95Z2BAjKB~PB4ztbZ~>yU-mlW%C*x2DZUVJf^nqM z;0AHkJXrH?I*>|e`zIJjs#2u*-9fi8nS8r4B&C%@FycSc)J$#|DT$a$;QeUmZfnUw zeOL&~QKQNvGHz|w7c^zQcZlf6ir|OTuOoTJdu~4OY*{bB#-ka)6xd99}>!jrbkR25df#00eMo_=1Dc>acAIw0u8XSUw|& zT0>&Z!^1tLW?nOnA;odDErn8-gJAk{Sh?Z$=`Cr@@ijH9a3X?qR-~6Ql?7Ai`!Q|) zO>U|Rc<2+gANrdkysqpV|1L`x7z{Auk6Bl25v7+b~hO`mFvQ;Q& z2dXQA8Sq-npldtMEv7a8oeyL{p6@4HVpS?sBmDSlG5O9Z`5IP5Tz!jpqGRb z@?mm9x4B`Ms`)ADLDjOprgGZb+^|B(z)R8-@-g+ZuP~S%*^-PEpIWT;gzAZA`cpl_ z(jiH|Y^|`zocK3EV%;cmL+}Nd2mdBl+D`+QqXJJi4fONV-~vNwa6KdhiI#jn4ZLw* zK0NLm4$4226pexD)YY;AiBu1!Fc+f2xm-z`GMO-?`g8DtefUN12_HA9yj*vTb5HnC z8S5M!Q91di#8a!onp3e|&s;lFPYIM$a@1#qJiu1x}dTvz7c!g~bc z+{hQd-`m!^>#Ix}jUMidtt@dEOVo{m$~Kz@>CsIb>vaQuQCW6j1W~cod4W)4aAiqH z#XyvQfG=G>p3bKjbCzbNOvE$4n&&i&;%_boa1%X98m z3v=!l=iH;ub?}Wj_m}3}ugtk`%DG>fbAM6JeRIzJ zWjXi$gEIu5EbB|e(N>u}|KZba14%Y}L#*W-kG6<1DrN4)oOO$tS;gB3yz0X1Ey z;h;_ysvK0cP-###Ld^knx=@Qiogvf;P-h9X7SuUHeG^ozP`81aFVs3vsL@El)R|}1 z%sLeY{P9WNIB&5xf8K&PEJERAi1>o~x~2v7!U5TQ@zPeI>l+uu7dJGjN5ir>%o*Wh zo^ng(o!?Lw$El|C>zjqKbY4r#@}}kmagO(d1G7dg4NZ+csG%t?BgFW^c@2wk;HFpC zuyj#ua=G#Oi<{<$y<|#)c=c&$ zL})DyEjahHHNFVxLR#TTDRUdg$8bx%+7|S^TAP~UEsL6P)qc(9p;`5H+fM4DUXc}tgF z7^fmvJcyO7;Ev@<0Z)=-v(eVr(zbLd(pbMBuI1>3Stgw*euvGHscTxY6vr4ewzhb? z4Ga&PQBN>$j*IW~W=HCorA^qJ>@0~)#+3u)LvDFH9q5_O0EaFxl1MZiu_ci>u1wkN zk%xn06Kwk&!N6B7xbmMP?2-rv(i}XGSb58L13j}t34jxfv-ZHL`VxQD=fDGRJyG?{ z!mC+=aimH`ih~HcL%b!|tDc#h>Z}VEs*C1Gu{AA;aL7$})U7*zAuy6SimeQsU>vFb z;09+o-PirM>r~H7;uaBo^rbCnTeEH%@T|w#d0W#uoI!HzJ1tps%Iur zW;IJNjuguwILUnZ=wIEbdS)u6l|wL&6bEu85q4d4L&tpgAk{NdDXkoWairM&1!r&F z^~lv7s%NHBS~&#cNbN0B9O}`%e$1WwtDc!kY2^@%Bef5(LCH^^H~uWuGgB$89D;GA z*ewV3@Vkl9vsBMarL=Mg#*rE#Qmi3#H=nd|qUxEclvWPGI8yro8?0IWATequ)iYBm ztsH`Jq*&&G)ZzEm4pu!gmD0)~7)Oew7d)>654duf>Y0hum@@bpT{K6EEmKg21J6HT zmFk(Pl-3QwI8v;E!JCrlck6ztXQonGHw5EI9V}9|41c)SgHNlTnM!Hh5R4;rh)CIS z-^*M6S+9C#Dy4NpFpgAQr1*~0?Y;8$H{;S`tCZG_IDFhTimh@eU%SsZU-isXO6!JT zoVX4XDb^Xfj}Q7qTJ_9SO6!JT94QX_g17Sb=brGi>Y1sO)(yc(s29ss4wM)5RZi5Hm+^V5t_GGQDI*@?R{os^TS(t5SF9LG;c zj1T7Rw9z1o~vAolS82z&UI#=1SsZh&XRxAh$68%<|XJPYe>jWieoxTYV zd&)&sh9?Q7*2&>c)vu;ErMAJ>!$1G{Un>8Z-@{72e<<)qOs(K#UW}d78L>hyS<7tD z9MX>pU^sp$-I@AW51PQyvz3`wt2(P;+P?Z#0d{m{<_?Z^yod;@GjCL9-WBdJ7DxO0 zi(?)4APiwuwy%Wss=0&P_5)Swwe5+&L0;Q#_$$XrKkrI9-U<%rjjh=TRx0s&_aE`U zkj^)7Um-`+;HccKL1Is10NH9avkyXJ1)&E4^jRo==8z+vt!pwU0V6vsha+Iuzbf0d zja4FKKZ;&oMZOELF{4t5eK2170_cju?AF5Un+vlyfQ={6{XWjIn0#MEio10Jtp5i^ ziqgkXQfQncbE!nH)PTRCMZ;6>**z#HBeG*cxxZj2Jlw+xQ6ch(k0)PGAKg&O?Zmoo9qjGizPK z8i$kN%d@GElbLB{w(;xU`VmjGdA+B_w%a(vC)9E$5wC5zyR*2#%hEI5V#7#w*cOQf zg1AEvF#q?B9kL3(the%X{cgq{kn;THucVJ_>*Cp4ib!m?C#Zc|+m+$LL2U7z1G-KH z;~4y+-ubwW6si%|Q9@md>u90)Cb33Dy)In&tq}Fzz?I|wsCNKLlwN;x|#$d(P+apap(~ zAXPq(!{E5^cp|XIu`j5@g-4x32M>jk9} zF*IT-F&>oiQa+FR;{1k-daHcjFZ;ef1a++VZuEVB@B9AK=k1PON#mFR>Nt_09_sNz zQGf6Rp}yq%-sbzR2gRx3sP`w|_e0-zubu39D%7IaTwVxDM-12a6c?K(ODGS4N(%KD zD6KEQ2Q@`_TYcYdP+AY(_NkA2s=!#}c_hk?MXEEu#tAig%w#o2S2)m7O_c>BuGpGx z#3-lSuw{AxH&xl?<<+od)>M&gDob^|e%V5v<+z5U3LL*PL|&$F0Jp(IP8Br6xVlqt z(p@y2-s$jo$a`FvC5^sVkMgDRYai{Rs& z85U}bE{C6OVR~w+I?s=9Om*?lt*!?+rzi1LWTzs_bGz8_@({_Fl$*ignHi(l^!n+# zTF>@McXoE6em=ldijV}1TBdi>*6@isZ4K+gRQ#e+hbx3?^LdwoQXVs`b(=HADZ#OY znI_bQptOFrgPJb9>p-Q2x)qeR13v>*DZHmaoh;M~J{8);Er%I|cXfNSX3jo+R;t3` zQSn7~ctg9z+1m}>7U!N@wnLk=!{45W9n%1~_)c$jm>f(_<6WqNb>6SIQJ z?>`BG7)ph|O!=J?Oh`Aj-u#u~C%@Ts(48~zp{I(U{ATAucj}9`O)q}(n=cg|H-HpB z`8`O5WGhGUliyZ~+bfEn{Kj{ZIBt39Yx0`_j^F48;^)>wa*)G9?{++=U@ z-_I+2&Jo`b>-u@&^pXpy*5*3*Y#pmH7f6wMI4?avwE+BUdVZIOxhs#ez>z}ii|ZQ$ zmWDGqV3?3+=5aVtZ=L47X{o)p>ABd6z3}NsT=BI|V?QpBGt>g`ub98&Vb06rjLPF| z&kLu^;S}DOpmT&4_%1>fjlp0)0&k(R9WXc(8K@tkDG&J(oXR$Fqo^R`(0M%t zM~)HVoqHsZ+|}1#Si5*0CPwu%Ao6(3PqVpaY8EurnnmNq4fAnEP|M<4EJI`cwxP9l z{^#qPn?j0{61&9b=Rwq|gFESMWbQV=if$ydErZ<|_6DoYGS4ap>@+qk7=r_b_!ibL z$D4@7@==QyFT<%i3l?CF{d^JUVsx!6MzbAgsa@Ex*c=8V$�d%Aiv#YtpHiwFt9d z@@4tnzD>2s*>fato)Z)jW{9qms{8bqLr-)(QF3;wIR3BZiW3uXpoUBqQ^&JRD$klx zp10mqqi}z1YgX?6XEIkj!8vxo+Y`0<>*ylCU#hY1hCi7Do;Zf%DBtnpZ7{m1$)=m) zTPV2l@%*~+-4{U30_Kkf$3MZ1ch7e?9r2FC2=Pir2*>CJH_1Jx;%DGL2h0~axeUiK zfZ)cJYoQ7k1|rbRZUp89)3xz)NaHPY(#P%g`=IIi{(dTWgvBMwoJnt<_k9@Fzg{>{ zaeh9=ILC%~{ZSATFcO^1^&&X-a1!st2~PR_2K=Xh`Cc3ZT#yg9{EkCDw#1RfVFL3& zn*5G+^1%2`^tCxEO}^z=UsP{vi#>Z(LMO$7I@zY%xN6+!ujc& zGRP!}kn}-`TIrn)m z-mevbV?M4a0yhA-n~TK#xCk6a^A8q*V?B7Z2ppS>r;5Ps1KbNm;F#aHi@@=Dd{P9C z&v#e!8(~+d-ZS3)i@>p+IHCv~zhO=+5;wC59NUS7Mc^3k;v#TpCcRY!aHA)y-_)onbUbbQ~=WgIci%v%#28wZ+0|3rA6QN)Zi4#egU$=kQ zzxBZO4+pmnZ2$1!wgb|g(qZ=OXNf_U*u@YgrsO(=heFns2LH}K>|U4A0zUM(YtL0p zZa%!Eq=!|pLMV2>Iu$w@lujJ+dNO`dZ#J&i2({3s_?)VRcZJW>sY`Qgx@NH|^UI3N zrb?`g;t26@qNHBh^kEI{ZDBYNJLPBpI|r;-{Xs7}<=EAKM4TPHm+hIZdpwzWzr8oo zHZbvQH&c@6?dB(DDziSh`Xwx}Twc{VI8oXDXi4JPs!l!>ywR~k){yWjV)u^QE4luS z=yVVVr`ER4{HLRH#Rz^Zj#c2^39o&?z+q7^~bm#sa)$wIrd+r8Sp40Ke>H)6$ z5cr^!N`d0ac2qFR`yB4ITHge!MtnI#s8rtUa{Fs~zCD)ktGR^#TsreheH6ibaBC$N zrL3a|HSALspBN&72?Z*#GsJ)P1luHg$Bh?VE!okPEz!31j;}_DW<9GPAJ{>~DbW z=q(r__2E0V7xd!fYjJ6zjkG=jnNui`SjRf9!ypnn1WjRH&94$eLfSx{bppbbx~DjxDD?S6t>qhRb)iRCD98l zm$orxYm$8%dJawWCbk5{uZdZ+rEOO#QiycseYB!0oHdr8MKt(L=OB{(@r!yF;<`vE z_6Xk=ijAjIY;~0S5h#`T1t_*JQSW)5`a7tLg!iV;iy$Yh!rK{?O6&uQt&}bbE02r9 zpBLU3A2%7)O5vq^-kG3O_8gzL7}P4kUF7qw^m$+Mc{hP-7u*kg-uU%=H zh7iX(5^v-OolumS0$1M2JNqvNNoBTtY!~8#%##{gOuIi50 zV_#oiy1u&O72K6Rete|uB>Otp8eV0VAMJqIU2RPw4m)J-ehy`{v11^k#)~=#%a_S@ zpV&m8y}#;W0ID)~rh%x+JUm?f?up|soq2eO{N2O)SCzT7oOeGTNjD`mz49Ubn-Q=4 zIl_~@AohcybIG8d+!>viUjIJ2 z<^jXe-VREx<2M@?Yz2hA>8t5=Oe|+a(w&2MNw5Dfp3X`JZ5b!mCE>}Q@Tbggc1Ed+ ze2CnnF(_N#i_m8u07XTOI6JL$W3=3RzyrD}Ysyjk0enGarPN|;mch3Ynlc+1Z|-A& zN)(^O*}x<-8=>1$)wyzz^gk7uZL2Qb31zTnvU6H*s$)C+FaLY;=PX)qP_{b_>Yr@i z*l)_lit&TIRVxSekF9A(`YSSTR(6g%vGWYHfOrO`(lJ;3e37SczdXs*jEZ#P@z}l9 zL(=VU#qmI5YhDJzB~)kdjmR;a)>CF8T87%eb@0$rL&}n(zIXL>CNA@?DOY4p zmi|pq7_JFFxsKyCTaAP7K3jdOGClUWAVNuit^0}Xx^j-ZIjy>h$3)O`vp&zBZ&Md( zZxeerXKta6r%yh3GataKkJ_SZ`z)-Zfve0`4CQkZb-H7~kO$PpR|)-3s08>7-$Hgm zij%eq5A>_B^Hx-JuHch9f$s$>Md*n#ka_}mTXNF zO8rWD5Y$chMP+4WzEGzjJ<96g*pl%l5UxT_uD2@fL5{mu4@}_`N*&q5m8n;y( zdu;V(KdmV^AJmN!N|R45_o?SWX~?@qt!x(5ts-#~C=K~J-?wfjo8~r9Hw*51Q1gYl z&F5_d^?l*}1=J6O8n81??G=8__Ni8%lCgl!!|5kk6#O`HV zzor%>)j`*s0fJxIb}oeTPWF=dnAaYX`^bS{M0VoG8Am1?sy8idm;&4g{sVMWFsia9;#xhOU8g>1t2?hZ zP)3Ko6wgosI~h?)r-YG}(#n+ftQ3DOoU32P11|jh z7a^pclu5IR!xXc*lVS{FEF4Tdg0b%+kAjt937@hvENKMlcKo8!zWh+A$8fzvs6XL) zr%==``;kziLH$^$Nucf$YC5Q&2sOv2R)8uM-Vc2ozvdM8q)+jCO>1;st!#fS%?aqq zpE~K+Ad`N#ei>1rpI?i=KBoQ<%;KTtIs<^c3S}5=uHa0-a1cxF?ge*RFxcvoDR!q% z+9}>6keu8}!85`8CVo-r4v2`#{kMdA2-iM}WA$ruLN6(%tgEA6bG5oRBr46o{r z-qxx1-7xc_l^J}%b+wHyTuJzGYAXrGkC>G{6P-gU@k%;#57$S)L$yylo9z8P-j%gi z0?s%e?t))tef#>sS|j-$aqS?@w?tp1&TI5t`vXKX9lr%0sf(>)#?#sBX#-qTd-;u4 zk-et|_sQ&;1Jdmu?h(7<9WZTrk%D0SZ3aoKP}V=}xjW=+Zg6aJZ#P>!3(N^98OHW@ zp9dthYq^O9vqD`M>M;Kp`!K7vz0iyxq>ip+?0diHJ_=Gv?tADwj~U8#=mRouYjPdD z*%QRpJPm^FBIY4uS3N^6bapE;uljjzAAo)))A1A{tLnV-2L72IBmB;rrju)4$W}SR z37SsK(X!cmwbC?G=p)a-maVSzqz!EY-8RdP%PZ?nEub%bpN1M|=sAVP{=KIR%$~85 zEX~l>qmlMLin&Pwc_N&Npy5Ir$DBSe2q24K>)WSJ^4oS;jH1I<2$r_xzS%v5$dI&6GK{iWJYoocsWrDPES#bEj!!G0KYJ?H@BNy?5W zzwg;B(T4h-*6HYX3^yHlH0Y)Hwn%y486F<)2(t1bm57km#qLw&gF*T?5$XO0I+o** z&!6HK6{Y^43B@m3ZCJh!>Tcm3iwdf|g+6sPs1f4JS+jeDDg~vz1ZT*!mpB8Iw&mx7 z(vkP~K$VKbuRv+YfAVo}`V{tY8`*(AH3ZbXnkrBy3snV5my1pZrK6pBK5r4IYQZh@ zd22!KA-rorX)ks+C|2sIw*}NXp}0QB@j=v!p|G_V8{<=XJ<;mdZUfkkkE%0Iq3M;? z!e8Rex=RY)egbkof{vO|Et2bYgPiy$AKnEdCyIBAb=-|YmRj?6%6tr0OnN`o!G(pe zFb44|-2VQ~v5w2>i`@}Z?dKQ1g(o5utfnS2U3TVf(zaN~?3{3LYr~1eIws<_DpNlQ z&AbfWlI!@)66PgkbH!d9tw~j8<&f;d>{+phxft~w5$5N$WI`ez+H!_dF%hQ6qY_R5BydfLw;Ddd@i!ZfzN6b1QRre>NB2v-_cL#ICvmp<`@Qk?Be$ zwx=`CB%V!ieZET`cPi4GZ13$S-D@&dy(#f*&#>4bTqj>&k$G$TGpk;TCV#Uv^UO2d z6{XQwy7y5`MMfuWZXKyB+MVgmt3KFu+2&+t`jJ&1?6iEBWP8^WJ-_%e?!U+TIPU+a z=bm%~Iw}Xtw~&0Z1$(&dQ+Gdp&qtE&qwo3Ec--;R0z2Gr)eHyCilZ3wsoT;|#PGHv zTYp}GL2X550oP{nZ5rO6{%?#~!|EzSky;(G@>B6z$-ybOep9G z7r&>XFJx@f7(g&t%4mBZ>+ChKt_CieS9A5j=}0jYkb(}+tfx|e=jvd%)O;5 zyz0uSBd1oSk~4)mbw<@$-jrm;$XRFAq`Vp^jgOoK3ued0#~lM}QDuoSW5~?-)HJUmb;`&}*!ws(jwyzeHNtjmd{|3Z)|0t?uF}kiE8SoJFx?;bk~7Y7_Fef& zbGYH1S)qe9sY>qb_6lzg>+8(V5XL_rw9w8mHAc*9{P2nK(<`UXz}B*gPTtQsaGUp(pZNV$A2m8amaokWT+HyLkj zo!qYb!xqAfUSsP*@VICe=MW9tk$O2b;J!;wg!6 zRihNtkE{Rur0x&HjW^WCSgCtWIK-AjIBMni=SN3=p<4Hc;l_K&$5^SYTELPn?0Z9@ zOagAgn2Yw%{b7{)tBrQSEOv%E_p55S+L zF>+4qeBB>LsZV^2mEu<--2nVbBGhUh2x`dxKJjpH2xpm(u~HwK^4VRaeuFDZ<4-#u z{H@>+POdN0?e1BrO(q=1P!gfWdmPmH-)Z`5a0utGe2kU)nc>7liu&(EK>g~1D{F#7 zI5~Gi7ek1ev>zx#Y)Y3zUc?>w&({xqQ;nmE;h=_Pf*J%VP3&tXUmT^EL~g;A`Fiu@ zYhMly;e6Z2_;Hz>?&(O)zx(sYsc|&!E0HZJ@ZZx4w?1|^X#?h237-uKt zKJY-@P;c+azZ~{>$T->ty+80~5-5D~DHbLVOj3ae`NSR9Deeu;dKMWa1 zo2XKP5t3RZbO+)W7$1z*Uv@)q2q$MF=>+4%br870QCg*AzurG&9Iaf0L`%bc$_I;- zP2rC&OiT(HM`Hs7Cm1KLL%39V9saik6hHmHZAMt*Q# z$T(U;tCV0Isi7h@h!Me!`Od^chI)KVVp1)kRZ1|96bD3T=P3er#5Id8;uS}Pq_j#2#*sQwq}bZi?Ri7b>?1=`S~&#cNDT)zsE6F&JUk?&l|wL& z6x*sGh1^R$B9Jl$0R`ho9VJqHTj_W#-ccbbts8=Iq>ctQF#E_O_>K-qY26TvBgHX8 zAjKWndI+bQz|*=R7)NTPNU@El<6(Mw2&YPE-4Ki;H44}uuHQ}g`=9g>PLM$9>S?oS~mnE{@0t=m*3s)UTSi@0(+_Rcl0i)UsAX9Vu8y=gS;nT zn7;CO6Bj*{eA4u20cUs9Mkxm&x74?iR;N-M^1}IF3&6j6u5v;yX16zk7~q6VsqlX4 z;&xXvob9|Ar$JJ!+dAcJby7&bZ(9KV6_a%^Ob<4fwpf_#?QRTj?pCR*EWi)vboCIv zlE2TxOmpI*H^)HMDQOP{CAXg(jGp&}zO8wrRqDjNyq``_;}mmvUhJQ@0Q@WF z?7VQkoyYlRUO2Q;WnDjS$-Kpjo9gVn4Vk(R)+w3E3wg2y;9oI&>{_=w z(nl?sw=^hqwk5I^-cNO(TjUFEh0i&FEJ*cyK4JeL!_ZE3XUlxfVP&oLD_WhjhIh|1 z_acnvfZ~J2)7m8sjsA1vL)2`C9*;cg(DTvzAe9U17uMFH+RdL=cVW(!e7`*AHP?-6 zp4YgbX-Vz;wuN3TV?BR)?K1mauA$jGwue$sp)BX#2Zd&nN`w8gmtrcS-X=DOqqWV2 zpuQPKkfFecfUUJ^Tz>w=jX28BW9p1$0bAcc-L8Oqx&^`e&kM!Suw-d%ZSB0e=GNMV zrukxcR;u*87M-v#R%m5@B?zIAAp*YUO|6THwlgrXe2ki;jnmEm=S{FD4{amAT zCHuU7CUyqKnol4T>$UiQ0lya0ZnFWEeex4@{AXZ=|LlHEorj-8eTy2X7C^@k+x}w1 zQ#IIcB$BZ`pej+tB~4Dq({kg-p%u?*P@=$ueQFz4YCeYFHcW-~Vv`n)Beuougn6(` zl7xx(V7feQw?m|5rhN`(LFaBb0RVpVM7_&!B|IwDjRy)9E_~+O9l&Wx?8r$sep1k} zi!X_=$XU#zo}2rAFzLo2GhNh+n{JYMpkw86Q>fLcu(=*ia#*KbpgXV#56p<`%QCc7 zb{mj)3MkjW2`5eZY(V{YkSE0EG+KOI&U8nf)nLN%|75mFgS7 zUkuLyX5xw2)_myk*SHmTBd)Y4^1EEz_;RQGz6;zxf%*1sD(8piCQtUiYyjpwGpXU@ z5@Veviyu}nqUA;S_QUzON#lZ{H~4(bMgX(W;QSVF(ikUwe71A6~h8j32{037FNnxQXubWq98M=7l`mcqhLM??YgY=R_==A1_`Y<>-~+oej*j zc{tbd2*bMvnD=sU;aN_GxDS4N+ld%5;QF$JaC8CO=y7gW!{;QdAXClzUB<%*@_Qz`GZeTI6a$&c(YY2M|;M)K}A zac?u5=neOeE%33+$=w6+rqdGUQz~xv&v*YF_tZXPBB6c8zs~B-MyrFZgXH`b5Y#?< zj4SJG8$LZlP`ucznF{5ovhKGGT8lHtPzQCtVrO>A1LTE$y_A#L3u%-purI0FNM-!p z5it4GX>P$bp#W^b_WWo#ivz!?ta?`p^&?zQ z7HU1N>^GyLK2s$WTit4*s9LQO%R$W$9+h-d_GVD03h#DMNullmRU_0RpiUF&MNl(^ zdIeO4P;dG;E>vlFgZo+KZd$w5w1`Fl3^nKr6@HogcS(k9e2?x&iS+98lUIq;eEKRC z8;UA4<^{y2xKKbvyx%57=M_KB4bCcwtbVOrs`nj3R{?;H@nQ$y_lYgW@P^cMc0g1@ zh5C@yOGmY%UhJ%7?{mUdRy4?BSb!>~*ja`e>4ho*)gH72i&m1ZF=`H6 z>zIR|9(SO1=tA6|CA_O~4OMfiE9B>+f-yfA%10HR+P}z$eNgy3fvUHyex_0J^*8>5 zjLb)(H6x4tjC}e3nvu%?YeuA>+=02M^>fkS=c4mpR53YVR|Bbu@-p-h-g{iyEdrw9L(&CU(}oG zCy+@EReIl)Pdc-?GV`R2j-*9*yVq*^u74G>w8{dzK8J!j8^5TWXqgm>L*dT}^E z*00PwUPM=H!^b%67=)vp8$;FbnVoZ-@U>WXP}1i*L2E0pBa^QEvMri_JL#--TI$-B z@90w3p#nqI@ONOT7fSk$EcHT3*HZu2s$OTGdhX2s-*Y~PV4OvV&Kk2fQ*dS1H*3`F zbAve_Dz?%Eb3R1V?Sx-Rgi{53f%@8gUxD#_%G34NzmTHU-iE^&g_6kexDvbjv9H}8 zC|XhFfo^Bd&MzHe0_40wNrck~WW2QV3nhV~)i57prD_bPRHRZyYU!D8J|8GraRVq_ zsb{5VDuixV{7NGHj35>L#sHkxZoE9|chl|aOWh#%R?&)gET7V+uQ@bOwEDh}v2i_a zIP6JFA~)hnskOr%eK=6GdfLZWDV8Ws%QmhNE<5EQ{`Zf9(8`oZj!?h<&?O{rl!b(oalX@sm>V`bd`FXL^MvQez{yk6XVGF>&8oCe9 zo~zW1y!2d{7xI?8kel;3G-_jAUvu&@ZEiu{?+~*tT4DJWUQ2m^voc&u+0;EQ4_PtK z#pL?SeQmw2VS9RKPwaLV0ZjC;oSqX#?Lw^U%2H{=m<5GAxynaFd1JzX8Ezt}F1m6=s!{wb|j|LoJT*t#H&t7GhVVKW3{7!Hl;q(qeL z^ZMDWGmm%TtpTR3)jg;vKncsms1*lx2rM!4c&?LXwM0et{Qu6J?t3db%_ zaO2BN=O}E^%zqx3PYjOjuC7vz=Vy@bc7{hO#swIZDSS?0G^ZS0!x%XLSCPLq8`@Wz5|3aQQ&$;KW z&%NiKd+)jD8ai@+p^FsW^?DK{_4|yp&f*B2-#mVx6zTpAH2aw#9K~wVc?AgKDZX7m z+0^5@+hzIKA<$8jS$GI^6gICr1UhCvdkA#cpbC7U2px8TeBYPf>Dzg9&MuICRUd3e$*5ZUT2@<*6Ud9jX9x>!@2IY~{ zuQQ6QL;>3bTS%CFh!oCoPhGskiPSX(D0Ba$Js4^!!?*N6;b0tq@kF-T#bjB6X2OZ4 z4XyYIgqvT)Gn;@3n4HO*WWbsc&TMY~83_u>27y$ z7I_k|<}NyJs|B_kf1$uaJjoeCft&CgB+zH^94!!Mc&7_=r-S2HP`Y0LBHIfEp2Ksj zKt1uX#|bnX5EooR0m`{-?V&&&ppOW22_WuXgaTIr;v7B{psfndy+VQe0G%(;Za|z- zh5~N_su74sWupRd)nU9qNkB@+TMad=F6raoY;>lYSN9)HPh`iJq8X-oCz@6z0=Ras z@C0%@;>M=oy?4mZL$~7x`<$P~4{p3GtJSt%o14828>qEtA(=<9x`?GwEHL7GVw+Pg*vYL=a3&MINu1tPGzj9$FHcmi#{0jx<<2hWQb$D{N8WJO0 zF@f&JlPeU)EV*p@%IVp4d+22uM|gM|M`4}oou4u#3YXo>^08KGvk4SVhA!AKM1izP zhx=o1*DXat>=J1y)V!cAM0i-b9JR?rb<t}+|w85gi4LuqcG{OX2%__F4q1dl~6VdO+ zj!)M%AdVp)I>*C@Iz~piI$%3fE7$I}ydQsXZ)i4_E9D@ps(`V>o{7JZ)Tef7u3#%} z4j}ESR{)xXzfj-?JQD)_1W)aj4?EDyfV4yX8Bh)WLZYv(kaR8T!R2)+=n-TuD5Zs~ zt*E4?``02|AcftH=WDY`+ooV|1Rch-cNpJHWY?3f_^P_^z_!~(XKy4&IU9c=X*SxN zR^mOc2Y3(7ds_X!^-}YsWP1dj7dQpDP$2GJmI^c%PqOKd*!0yeaS(=PC4yh$US-d= z%mu2+aR(#J{@BOE&|F;x7$cX0$gqUBcP@b493H|}%kTQFIvQ*v_3qqK(zH9b9g{t* z!_k3YykLQ_C}o((Wn_W0%;RN&d#&XlSpBlP3o#kZ;P+PBU-pGnFxCUE(vmq!c-ft{;zx8b@;D4G+Za7f`nR~jrcc5HWeW5A`8aj54k|3uq6v3}v^kRj(4sYw$U5Ec2gTVE{UrDfuPyA&U z-*St)4o^l$=dQz(Mbh=fpZ`)(cOCvpp&*Sd7sn?$=Bp&gi4OC+J^RpXcO9PHo9-|P z<(>5O1GXesCcb*WPuJmj9Lpeet=_k4dbosQSURqndM?C_C{}2Ep*Sh=uh8l`ydM41 zP(tGirR(r~()E5|!-={MFQGWzzzK~n6iehD8RfA+U5A%Y9JAnr#utj6);;_=VD+F9 zU5A%Y9LL~MO89czdp5M?t;as#mjM)OhUiU>aue@$QfC*TAWwU5gez?|H#sF-U4xVE4scVSGma( z_lzz()RoUj<(RSV%BL>x#nE^<52BMYDcJ4vLs|LsFBl42J`+s9Zf=nu=!&8LMoqHs zN$})C0G&hUUl!)5ak>?${qw#k{2ZaW2bPdrW!|PoXc1X2QW^rXqwyCCRNy&4AWkW`+!+eY z#*@-tD6k&SfdY}MA19Ev!7wXUdIAVX3>wu3Xo`nX3Qlm`Ih&BPsO5LE7a4LnZ2zD!;W@8jx+;~3vK(4_L|s(i`HQt4+wW9?hnbiET1M#>3= zwJXGTI_|!lop-w~lY7skDMWlYJhy4j|5!0ldDSq)rreFSqFl@B9R71UjmIOtkgR)a z{8e~AL2x$y4>ap!Yj(J?2N3?J>X^l{ev-uRvCtM6c>KSbz5gfjK&R}TEt0K^>RK*) zzXKRLm%Uq7sqB3`{1}QVR4#kZG6z0NqIH?|0nQAH_07M)EwI zp+xXpkmI-_FO64Sv2bb1jx1I$P3IZKbkrhMRT0HgM@_%~iP)NIFctN08(S*<3nt9j zXz=8O;meq4=qzNcU#INvz)u6sBqK!dM`j_T#{zO4rHmsPLGzZOW3e^9 zF_ixuHy_Xd2#Kq7*6+@`MpygB=F5?{FM#IV!!#%*bBS+E#4C~oIPTFZLvI!wj`c2d zmE(Nr@?iASpqa?kDLD33rSq?xZN|RT$3Sx`#eO(WT!e01mG6TbhYCCUWPIPDLMDqs znm@lqh+iS0!5D`AI6~>1dKov4^Df8rz?x0)4Dio$6~)Ss_%qxj(A7{~yRmW>X|UYe~H2<Y?RrHJ*{TiN4 zMIE16o56k8G(+LNP9z<{C)k^LF`DUQt|sY+h!@XJlnEVQ+|T#9OYMjB9Dv1<(>WfU zD0a<{;4dU+yY&-)3-9`ge*@?o@!f}~(j5UVp`U#+Af@9SCfWez0AlyFs|}e~Xn8xJ zADg?g`mv=M%(~cfV)iMkDaE#kZYNo9XUHRCW;P2F^_ZLdy69IWLAnI|BV&Ez; zbE_a%mw60@j62h%CrR-l*TWhg5VYX^;`lmh^l@OfTG&l9@wObNa2K-7wk z4D;{Pk%9hc`t+uU#0Y%qq;BH5hKbwme)@9y=PA7BTJ{we0Ds$i1K)l!GmY3Qa#ZVXF=EH!* z-Ec8gSrWxu@VC3k6dmQiaB~j~qqvaz6ulw{iP{UXq8nDT8k)MGSE==N!&V?9S;sOC zuE*Mj3~8Oa{V&{1epj38cM3+Q(r9iHOvAjAY2=JgV^bXaLENV8euplH^}#a8;kXbzg{sxdnW6aT*ygFi&0L#XeuHArL5rP- zz37ToQX-q<$3x@vR@4n3FUWf~znV-~R#nzlRTB%U%8;7sN)2(UD%{*I)j@$?DlOc+ z1BmuLc-V#&M2n_0rc9gPTUqt-sB>lMyv9I%s{v6~3I%xAm0|r3)CoujZ|aPwireXc zG!~xGrC1*dd;(C7K)m!KD$ut9jTh(-fF=mk1t=!a2vlNRpap<5U0&8pMi~mM1ElQo zW8sVEIxz1P~hD-^|*R&DKNnHSq$8<@yV85mnXsdVAyNqt}mZPH-~ zoMRp(f=T^=hg`pDQaG@FQW;(#Aa9y}^cJBdf8W zKZY8OHXR722W)P60^W3}>_;s~E#lS+lbeDb$G9;x_uK?0M*Au;& zJN}^ndBTMPO$MaBc@`k;&AfO}dvgwurg59&`&~dPB>lvpdmfO+@>@X4cVzN~Nfz!{ zkL+vOUlzXM5u^waF_Fjyabp<7@%_D15j=4R-}m7a74fs_BY|{{tswtRU|e+TxHcZy z-t>`Rx|<8FSCM8`EOX@ARly$VQL*gQ(s-r}KmFpF{?T>&DQvBnR6PD`7`7W>JqpC$`M$%Cb;VT4KwxR8(;3F$Z zr6s9MpX`tX!_B9H0^O`EkqOE@X&pJ6VRzh&Ztx0r(yrU*Bi!>yM?b}4B&m?krk}n2 zH=fxP&HOjiQxe%~X`MKbWPUOG*$D=TLkQv9+REG3zKz=rpYH`Wok@2_n;z*M&%7FK z`%8(#HOV;cgMSitwsNYMnN1#28ouGr$jk+~e&eFKSzVDVmH)gKyVWw}qR&4nGXJFr5QqdBfY9Uh171{niVp`-LOJr!*r%e2DOU zQ@fH~TVm^v4xyfe_7mzw=xstc64X|jY-;VS-je=K zEYkq$0U zpx%J`3DgVF;R5vpbc8@5Kw*JO0F?>U15kf~f`E<$6dDKMD6I@({hsPjtHzg|gsK|PuuUQS1X4M2@)2ycC`i)Hve+G>T z!thbjuo@(8Z^H^VH=>Vd<65}zklI&!4MNoBE(j(z>_TsoUcLX6m8IZH?LSA`s>?i< zJoVvZZf03sW=pbZ*RJGSJL+;Lo}X;mxHqzMVfe4DxKZ(qXn1+;348f-^a%^Y%U@g= zp0i_NxN+y?zu|Gh8+I-p9S>`#i_S|dMl~7l6ottAAci!{j|M! z^i4E9T%Ks!xGPz`BfYM!`k8R^G>FmBeQg87&5Jm+HMI_`J$1_kxub`n<0Xf;)@3^C zg3scVNTTVFor$-0Cf`CP|Ju4Rd`b)o_~XNCYWsI0A4L+~x-c4k{xFmmo#Nrn+UjT1 z+mh(lEh7&=?EMWMPRCr~c1+a1zy3d@{#mqdX4>mA@0uPuP+1`7tLUCDKg$a@zl%05 zEfb8UJ7(AZB8c+X$4JT1rfB%SN#Gv6_zT`KF-QQcV`2{i;2aZ62!L@+3=sg|nAnp5 z*v3Q&1+Fo%H!)xu6H5tzXH4uv04!r-UjpD56AvQ*hB2`p0q~27hZ6w1n0N#MaEpmy z0$>&s%Lss1OzckptYYGk02o?1#p~U0ieYZ83#UlcnW1VzIhbbZT=UghQC>zi4XE>bG`Ljr?#A~UJnJ4%r&JO$PXmLLB6$>2Nk&AZ5E<(r?Q1H?K1!U1A428d2GK)i;D3cq>k>TbXH(}|`( zVQ~1p865th@BM2tEcAT`-+K+x@^y`iJM$2`&@4`42f|+{z}=@hf&K$eof&-+jBm2w zZULn8mu~}7-(sqa02)c07(Tr*>G>zGSW(r*cAPt)* z)Gv~47%Y%Pxj^zH=2$qJY>)oxYP=|&cjXKA)QmHYc+xvdBCa`Xw?GMqGduHeb zbvT=>hA=7YKLLt(?&{v?nQgmEkkBq3Vz1j_*>Je|2aJPDE=#w;7&ut*%w6Fd-b4{7 z`qgIBJ1{M%h~=hXTEKbWiV=zG$HPs}^Bd+uM`2z-`@&$B+1Z_S!51LIm52;SL(j>~ zZy}>(p3%9%Su#jMsIuc^eErNovg=VZD`=Nl!SHRI6dcxZRi;hAtCwcBnJEDznr386 zCKaXe^|gmHqC^)VofQz$SpgxP6%f){0U@0g5YkxzA@8inMsS%lcmrq(bPr?C)?c^I~>u;OCR zd-L<01tN@tSVo3~o!%S1p#m)(lT}J5!`-=9Wo1oi^?_wmGKX@i);bzV;4=SZh1W}z&WX2~qGV?D`^Ew75a??FBvwrwDz!KlY z%DnKz2@sk`?R^73N00iK@x)})rd@To#hya5G~(v74POj5)4H1BjkUQmOH^=9W_Chw z#_^A2)2p4yw|-{@=TH9w+_A3udEt(dV9SvhOxo|q!x5bSB_kqa9M2q9+bzT}U64n+ zMJL`HZhn|`;9N7q#&2d;SAOGw*mKUmw_QqcBN(+<||Iw}i> z;BXU<5K$OAoDpJvnE7p8@Hq-&-^V!g@2_ASsrOZIssRiEy>995+T5fnto823HxXt4 zQ8o!&O&)FxaEUzJsk9l=)LKq7o0JXT2MlL-`{z*bgUi3lf$Vy!m3tTYwh^r?J7ch~ zBd5Vd{&#g`ZMr9*OQ}%%JvL&U0Vi`uhwKdakHtFj|DYR7axI%F*nSs+Z9%Kl)r0#T zPMFO7AF08Qm>Nud@=AO0h9P5{AHaw!}BcfzENDMSxUHYy_m~t^#DlMAuMH(;jr_CD=a6Y>dLN7mV~| zPtD+JFw;}Xiq|6*hzW5Tqk5NcE_5yg5ej5nh}|4+Ivr(;<|gCJ;Qrd+{={3)B!X|( z246~Gg{Y}7{N!xn!w~ag!&{qn^-e|K+TmM?#XA19u0+>kvGx5EU2P(BZArft$8PKJ z$Ku2HMk#h3*S-#EW0u|i9sbf!Jg#0U@oqzKWJ*_-5MSSk>-%wk;DWA+>uZAoy+^1A zaqki;A#{LHh|oKPdJ@`Cs28EP3H1ikE5*uJXRNw4eWxt_yq!O!VG&y^jMr53Nd(W2 za#Y7k_byE9%RSmRsI+o+)UECJ!9NN+Uh7`M3gGq0+!P2|k0suE5rXSbq_`Kui>~v< zuu?{$rA&pEvJY8kxri%$eIT-zW8rOAZT0r_x@h&=;pP&oQ`YR;JTTP=m8IyqU6@*3 zkHNS%cIj$|KU@d1Ey2g?G8>azPmR;U3uZJ=#Ihrz zP4A}Cvl7{>%M#hisxg(>xNl?cbUoh7WLP`z4kVGDf_GiXtKM<__&Dw)YJLI90ITaj zz@E7&9yl%fAopk5KZ`JOjSCX!l^$mj&f+j-)OHpS_ zu{P7N*U1_$(J;BhWjYRwe0)3lAUBNSnfH*@)acr5!`^u2Er}GW5Z}$M?2X+P7Czik ziegB4cy2m3`l_Z)XSP!(AQL|j&BX@y#`eq+Ev>O|a#ytNK#5b}T%vbV>k%zm!^yU` z&XQR5E|W$qn?4Y}^(3^AXwxRB8@?Apkc8A^evrN4TmO!43jbl<`9G)r72WyYtNvBp z`QN7gHAVcThALy#$i;F{wf`OuR#v2GQ>X)$vP`DV`v$&BI9Cf_=lfQ+--FlO=yVPI zI>L_DUv6|G0yk|cgQ`imnH#II%<2Pm*>eX&O$vA0q|4)(-zDZhCApE0A+zHFh%A{2 z4UT8tz-HHuL?*q9pBYQQ0bF^tc5AN~^#RJ_nH|x#-2;t^Kot6dP!g!k%_&=7y17P9 zd4=z*3#?D{T)4Rg>^-*rlG05zeWtIU+Bdeo=CJjb^jp8`@Ywpq5wZ1C!?kGf{QQ{A z1=8uH)Al##CiRZxmg@)Koy>l`)XpoRrp5VrGcxm;7}Om!JUW&FYklD zY1pOfA6tJx7vLm^glX8UyC?|Ed&F>Pn1)Tei+TX_E-@S;reX8$q7q;ZU<|-tTPWJp zdLaFynthu}QiCz-G`(7afoEd)J{fP0oVfmI#Ml=em;%SDH>F=eb_cHM)iEfUJ28|D zJ`#NhBYYq_{85xQvc1ljf~yPesm=VcF1rxJfXeRCOhGlk3k5P&&uW0|-LN-&^EOmJ zssg%TCARV_fkFc9S^PrXz*NVFR2Na!#Sj!Z`hJxWm&#~+w*-~Y(zWK4SZ4Qd@U?Vc z%|I^kycF4LegNhA9ofxL}&2o-e{0$7GO>Lz-PP-BPop$4dZ9sH4I45 zf&X=lV_nzn$nToI9YfhZm_@dcUmY!N1cR2ekxu#MbwOwrqK&M9rjd#p7y;tB6!LH#p$Mp1Id=Mke*IU0S1l#-`Hz}6SmAjUr7Wv zLaiFZN*CHh-R@iz+-kAmR(08{oJ}26Ml^SwsSFI($+yrzu;b%)8L5i!%}=qr{8hWl z6y;T1+F~VSeBI?ks)T=_yP)joDudmwauT`$vPH(BjiNUA4nMB;mpBIc>9yIbAkOQ3 zQ^LV7Hyr$BaPT*a)CoCwNSekT(==)avszXzWR?61EfG;V)tuQJ%U$1FhJ-FeSXjwW zJ6%%_b^A~vxFedA3KlliL~SCh|F#chWe0Z<*?t8@Yr^Y%w1`8*8^}^wM*BpfvUDHNXQhAx;lVr9rSj6>`!S(G%dv-}w?f-Qq9ve0v0_Xn+m zHZTm1m`Mz?hsD-MIm}MrFq_0Mdm#qJD2Lez9A=XkW-r7r8|5%NK>}fzy%57}ltV23 zHij_TrhgnYRj@VM^rw=@c2I|o!lMuLZjOqr4<@>{Qgx^L*XdW3k6wRT^dV)P_ znZHUsVC6~&&EPxustdzcwPKC~g~XaNh^)|&TD>EX!epRsS7Lr!G8h`%e)XFaQMn({ zz69X^#V=j;4}a;eHbi3hl z-r+Bb!HN@@?gRo3e*Xtb-n4pmAbiV3SeT4Lg2wO^z9ohi3|H|CHdP@I2#0Gw8^{WD z{0IhwdH-iI+);M*wMje*mPh{0d8^ z>ige-)b~w5>Pv-G_1z6fefwe;U48!!NO1#7Ev^HQhUkM`boCt$NJCua;I4IWVH~E= z5T^ms5aR)9h+}agQhnccpniv2x-$VO-CKZ^uI~}ncLX4lQ$Xrl8n(W}02yCE#<$G+ zo(@QT-v*?lae=DvtQUw% z=yL?(yFx1f%@y2@c+L~Zdk!8g6m}W#aGbt;kOt_EGjXFWA}z`#Oe4E#`5mr>qEj3i zYj5IGbPqbTQH1(Co(zA}+Mj+!EfnE0s(F=*fr9H9C=Z|?z>Sornw={N9*Z}o^?bJW zSFXK@(GHDGYpoXA7@$KtkWhVpdVa*UP;{e1V?+JHV9*ngL!O#PTMx`iEI=IGWeuz*!ZGSwV-!A#&XWT0a-*#whT09Uz zhyICBJbTYC{pu@gN4ZxN9_G;4P{){f&~FinC-F%#p#6nq?iGb6IyB|xEAIyl9r`mu z@m&51fWG#l@ZZ%mG8#txf|V;t0va3YNERNB-?t=q96rD?fIjx=d%mQmkr`^m%DE%~ zjSY3G$urIvAr#N-Gn((bar|iaib781==wXMdYZJ31QvFv5SRl?!>TPS^ol~X-o=&k z7=}hMZCY&MbZixB02`b)uxfkF0r!eRwg5U_QK*S5G^w+`{e77j98N20hM9}s)~V@V zG5ldr#f&8uH)(vcNu2=|eAq_oU=js1=lC$RQMh8h?Uy#5%M0SU-xrGB-zcD2~zCb4R z=L$mYD!}~N7Y|eSej)XI+(*MGDox8I+#`Uk5?}I4{&qpA@`6x>Y5j#!8mAE)>x*Y; z!%|o@wiLED&hUK;wuF_7=0+@)MljyK;#VS=!SZjps9DSJ0yc}O(7dfL8j*|Sv>zj+>6Nk`we^&1M8eCu4!~^ehN`TAxi9W zik;8;hE)=k3FyPcG^7vbn4xCW6OvOC@oDuFW?Ukl77fe;E?vF=kvG=QPX*ZW(o110 zC}k~DTfSNJ_C<`hOP0^8Uj&144J#yfbuo!~NyFuH=U-Dle@Vk!AD)P1Y0tfiY%*er z+ObVt^rl6BHH$4H{V3p=p8EHA_`ZP$F9Gbg@!(Z<@E|0DSr>XR64YQ&QS+8n&Re|9 zd~&f_w4`C)GFBnbm4IOEx?$=3MpVP1E5w$P-!QgZ5@|#hzZoW{F6M#*u9&-Q!E$_( z^uhp*V~f=!Pn$C4Sv^h4gE8&GgOOGt{WPyx2+p(%3)9&6)yr2{V}WLX(u!yGaAagO z5-Ery_23Cl zY9*+8oQ;dWYr(}r@NCA!jE?e^(v9`eEd#z6#Dx?^1~_I@=-gpd@RUeC3z}~mIxyHr`6Edu#OE}*Mj&k(d&t29=Ey=x&_UHF3X_9ZLQQKGQE)K zZfS8K{E=bQdXVYfX^3(t{z7tYc$h$w@Ek7CMR;-=7z!-FQ+>05&Jf(^@H|tXpF6lh z>oevyCX{nLD&zhEAl33_CJwZK915DGwNswRk_PMEj%HMPR&)b1&@sZPjD6izM#l)P z982laS>+E~T~;YltlAun=+D9*&RXNCB|RI^NWo3SlNA~g9T=?}8vf9F;G&j7-vz`_ z#zYUzS!v_Iq&|^NYI&PF2c%E4nc(*y^u8H$>W*9`M$I+;gE=JJ}&0>cd+EBGIHzBx~tZI9Jvo!f=R9D-M zmsob`D%gH%bQ`&zIzYL?&G$>dwpix1x(qaAbhlk?%&2E=_Mx?;$xg&qufeHKQ^L%SkchK!^?8QpL>Xgj9ZI>kBl zZu&>Zl<0<4q#cA370r0dBx>Jmh=RyQ=SF5fj{Us0jfq)*N6m;$OdH!r0g)w!M8}bA zG$bo6WLKd8KlfOHzKSPVaVYQrp5&XMz*BhYH~tNvYQY_gI?-=j3Fsq&`?!PS#58CQ*ej{FxD2Md&z5;fCqGs2tqldIlmV5R_ zuDoaqod!tr%r&NSB!AKxaa9Aqm^OWm(C2#mtm+W=|e}9$(EF9O?6ui=4dI4J!yh8i}fv1jn<8pUx?P`a{ zhMH+Gy(QFIFPrbn=d$xoc~7{lr~c>uu_XJ|#i+Uq-xb@4ilVZH?+7bne<(yCTfm8l@oC z=B5k3xW!#t`>R7^bNGFO(X};}&O{8`|E4&ByFE0D`;@`3=5WQCC)D9is9QWV8tRKC zYW7&y7W$Hle|#Jy#!^fO)n6^P&xcUkznfKIx&DKKdh+3eFW+ABuUR z08_Y5#Sz6i4aJ^monpRVU-1h&`3n~>X)u`gy3m7z&g{#fyAuI*7RM{9FgY`KRMoHK z!iK?(k4~B{iv?n0e#(Ry@fr2gXG}{@o+Ma9H9a~p4oU|#&Vdl^;#9*@tZ8C(K^HqD z>MEO>G3h^eaZr>>l-}QDOl>xf!?%^2iG2B$ ztajt)gzPq$c=VNayVALotNdWA2GwJ$$GNKplt*xs7xRQxflP}xaCbi+%Bn%6qQX1j zrXZBUaFpSY1jk-1v*<{LZ+U@qUj@xQ`E=F3MF_cSY7=O7=F^QEM-kL+|Wx`E4na?sK5|UOruw-zGHa zegT?i3h1gRzB!I`uYhKMK3#<4x$8)G#9@$g@ki&>%Q(O7ZPJYcO>I71bp-`O$B}Lh zXwn6Al?C4;1Ddbp(~b5OL+bAy&}`198&~OVRzkNEG<);uD*aal%|ZS`5H=Q2;DDp- zR#P^$#(TpG@s!T)Ff@FplbeUe_-$J=x8DWbuMI8hPgZd%Bff?@2lx)qTu6}xuDf*0 z;P)v*BZPQpx?_D6!Pm02C+bj`H^p zraJ|6*Be?lUBAurIiUL-Xx=b%-IX^Cy0iK4I4!T=b~)2MA9TwMt&?u$SYP`q2i*;z z`DPwn{`V~d-F=1zpg1k>IA6PBx|=|^FE75cE3190gXN&>i%3T>VmO<>{B--n?|efe zgm_50qbrz{Yei%60PO%E>YX{}k#PJe~;h<&*P+BRgLoX57x`^pc`*!yDJCz z->hQsjjiP3jpOzLnhmf+xRr(9FyLsOk}Z#Bo8(>jrvX05dC$I4CI?UXPQpB7gWq!jgjj@hlppMD1R-TZ7Y#`ph}Lg0BYAD7`z^P#aHN(Eboo@(>lxu^flx8Y4b~(V(t!uJQ&^A50Q?wcQgKifpR=I2vmdTtpX+R zR2(bgvw~~H^Fe_QmWMJ>-6oVw>vxoPi#gUC>r(6X8v@NuVWDnb;0uQSVA=lSA=0ro(tTckgnJm!_j9{>J6O73 zIz+nvJVZKH`nU0?pY|bvYViE7K>V~iD)7_(KyZzCYL{kSe=IoWeyTtl99*k|+vVVP zJGg_Dvka8Qn+2A!xkjpuV&x+LtE~O17m2FQk50N^>hw!5Yq&RfU-0L_4Z-_^O~D(3 znc#!LUj%OtJ`ns`@EgI0g0jAe6zRaKv3(+-dFaarxsA8S^m;O|lHdS5IqJ;&LAuJ_ z#`~K?Q!c)^0L@@1S-YWzUU=UP?lxYD;fd}x-hY6aj-9~`^=9i6o$fZ?T%jP1O{}hVDu>2~Iug`$oI<;yST0vZp1qdt2&d*BGI{32(GA6Nsfs+QH##&nts711 z>}_r+mP=LS8R}+-#)kU3!Ei?9hGMx~75O_I8XIaDBZFi4+)yl+s>suCBp+~8k=M-H zE7Xqy)(ypSxhnFs!tz@&Z*-b#WMcoK2Z)|>7+#!2fU4~>G)N?523N~k$_GKXiseB8Wa zoltf&QfPcRS|w4uwZakYfbht-t&G;-PM+af%fhUnugblAsw%13$hm^VBdmRF#Gj8egd4 z5{mtp?ty{pRt$GTRV!9#e4$3bqa?^No$l%8tHzCRLq*sZRPWQ@HqHRn4V9?)#Go@g zp_By(jW4Y;eW8B%@snqr=?SIXQfQcHV7PWpQI9JLvb<~?!@hs=C1*(}(o}e9hzMBa z9`f>%;3_;>BiAqf{tF|WQ1i6$3BT6}ZUhb8+4w67mg7m1Q-*wf$k|S)958f3<0}_y z$?eN8RzH1Lg{NHFnT5s|inUY{CYD}#%4{ps*op#>cqa_q+cy^dhXnbig5AOJN^zV1h z8RJPy8@m8ezY-Ed)n6B~-57qfJP8@Y5AJ(g$a^sn`U~Ti)+Z-VoZ@D{t5{}p zm5h!ts%F55($e(gq{2+v>a;}B8PHD~KXXRBkkqMM(CUWeV3YF#gtVl&3+AQfEy*Lb z=^0PAHBza|uf65^i5iu!g}M4zKD3R!Fo2W!LNCF%i9y*eFVD6#d1#v$iemZ^%7BAh zq7KL~221U|Lac|@L{v!b_waTAJL zC|c3Ur%wMt3)HTA4 zVoYA>e5vYE$NAoo&eBDEN^`&#an4QlO?xVM_^TqBc?Qc0Dj1KvY(@BpRIdL14=Arxgk8%K)d*xL&mE zAIw0JIC}h3aeM=1IrMx)XQ@3DHItoa*_!$&?PTjgBwRBeiR`p@f8cDGvChfUL|HvF zRJ}KKLf1xnY^-|YbuY*f6fp{oLnt)E8rhCoG>CRoQh<}~LHG;FIh(-(Me*cRFeDbp z)i;fI^;Km9dm`llR<(W}92hySsp{nP(e@-$wv36Xl7Z%A_Qs<@&hM|s?Klavt$^oW zqGhu;die&M!iT*q{7a-k$L3lRB)4FyNBnBmCU;r*5n$*-fpQ}>-l+&Vk5CdM?_j7) z{&Vde?y~R?9U2?zRfFk;UpK8||F);yT^8Qs(AZEH8w?l6+)%Mt@Hg(V@N9?1hAL%- z;7al5hFY1cUgItcAK}p0Q0GY)d%EKqyphkGe9x&J?y~R%hsK8bl)>n-FgXyp&KDji zsdJZw?L^XD7G{mp>9Vk$5`J&xz?UulQvdwO0s$hhpsV4zb;yACQsOhU2X?MMW2ApjXs$mu#ig zJ-2d(F?s1d=~VIXIc+wi zSI)h>!Q-LF((9KjpFejAyrJUWt-5MlzPoG}Pd{^?F z<*KT0L^{k)M2kJ|n)=Dfn25M@Q4{%ik#gp*NLeB0pgQoQM~#h?i{r`pKJvjz(O}Km zm*&`h#%_K;6e*{2oKHNUiL&d^iY{h%h2sz@qkf)L@*40z1pB#-%mj}8OXx)oxq4TR;2iVqoqFP3nj>^6)bdhnoHo(AeQ}K5@Xm%SqWY@%3sVfg8 zf@2Tr#Ynu)N*g?J9-SGT!C`XUo(&*Lp4Z4}UB8yE)GB47TaFM}K)6fpGk9En9!}S%BgA+byjRl5>XRJDT1LHa(B~ z$y?Krx|Xf!Gihjjs6F@^+36mAjc!=PXd-$hz5NIjF_FQwsxV^z`BsF7vGvln+DyDO zeSTf$iP{YAe1CX1LIikH_;)BcZq3n?n66I}AZ1 z%Bv@GODjD0D!>3+%$Q=w?SeK}JagK-4^1H2^@z3C7Oj5dI^H~0k!abTIvu7>VQn2k zA@Vwm*1^rmeg=F90bvTY0!L-H!WuPfwGCi(NUrQxLPVvANbh-%Wm~p@pf2-PZ6-B% z7>_}-3T&K`8y@+BJyuf}FjrWlE@GhZ)dk3$x)=&iK`6 zU`~djOp(P&qn6e}UqFG!3qsYZ~hTohH6_02(CF&jFE#(dU zwF=AwcPwg$u{1zI66jVuwJyF3NbBMuK-vPOW!ajj5zC!o z_yyJzp7u1T)B-dnlpeex^Sb8>xOld1Dl1|dD&mp^cvJ-{quYu=voM?{vjdhSP%Gdo zU_cfv<*E@|F0&n4S#C&#fHwDA-A=~N?%XIJVaijv>jnzxTOJ|s(le2<)|)hn1w`5lpHt|xExQ4Y@xsk zJh@pF3S=DUYk)Y53%vm1!}*%CyDpDM!4(5K=J zMGO4mt)Eo8GxYl%8k@tH4W7TiU_wd3MpZ`84e)`ZbtWE2B$Z_XFn}8xa z7$OaIkEtIb74sDz=1}L+SNcLRw%P&=+rM?1)*C(=q}7;SxyX{3{CviFw>kW30j9+l z551o%z*xlz`pRm6>X#J6Lq1_$ zcPkGv`?W-YF-TeVgXS-4z*+uASY(`=YVg=&^sF9WrmeIK#E4@4io|@F>_bpd5caJk zaH=m@6PI1WFaa8`n7^{hXVHL`4whjX$x23U7Yam&`ATzs{;o& z&JBm$Iq1R_6%zsT<6WMSB@*LDGlSHHH?MiN1N>Mq4Pb2!R?@FZKl0oqi|4MSO@#`5 zm-QTdmsJ$nU$Dz42i+?gRXw&`99L1uB?Eywz?e@n?a(`-7*xT}hq8(?Zj3J-_IWB^ z{lfG|ju^V?QDGN+g#I_ggIOOS!-nG+A#|ht@o{|>+Qos19E9M=p*24LNqzCmfB05C z%$f%WB)jGTgXve*!GsaW>TE%1Wf^t+Tl$C%7Xqe~U^&q_~lOnN1MTIL*Ers}i*kos!1J7%A40V*YBN|CYdQ zoQ6nZpmz(sv$2QqA6{kso#!iM=2CV^@gsu$QVl1!`P@S3R`q`5hi=H|p;(hJ)_*_k!9*$Yau zN7m+M;%=@PgDU{+B`^$sGzZ7bVJ+g}Xr|SE!_?gD>I9Zx_VN-uOyv$>?zTI!HR(vz zn;;z@j)jT6iTN`Rm{9xDjIErpc^9`D@b1(SLI}0T;-b%@9IL`176bcpC|SmVF2$cp z!#b`1B;Iwhb_XD>jqd}}8hX;f>BPgCgz2RLn1tav*(C4Vd6a-hAAZzmvKH1YCcR)l|#g&0g3Wz-N* zWD!4&GS89ojB$97kxlw(4C4g;LXE~q_vFCjx{WQJUv#DWiyWGABl|pMFg@{G5+pxn zPe1w3KflM7?*H4Nv7xvWKu20AAtEhu3+W=jC5~alCxczT#Ig_Z48syR1{1 z3kvcx%7-bgdZyBXjfs-0m`fJpN{*FnRiN_fFBNE|iC&i10+vr2q}3`h`K>mS$H(g@ zND4_xlYRj)&suYVeQl3{?*bd!MJ;L@u}U)NwN2&f5<&eYPZrI~1Z;mp24A`O+6GVU z7+ceYbt50%jh&iGwD3g9`B3Gu>akXGqg=+m6bSqV--hEEotGCVrttZp$YrC(`4V~n zZ|vh=FfEP!PUNU+8T5R#1us^Pk`)rwR&kBHrmmDhqExhMgy(|OU*wum#R7PAAi4i} z(G6E4>ZYy%Y2BourA&Cza&LO_p_@bPZp4fta)I&<`D)_dBu*{k&K!^@HT;Ly!g?IaNuJUyonx=GXr_oJCBUy@{5+K2i2|BNAEr28)81wYuLDrnQOU#% zcPQj%J|mChe60-iTbsT2(;&5bfI#2!Hr{b1 zt{3$xP?`9ic;;1$#T10b-owq0OX&2LY~7wjrp}qGgqyj+hdtD2u6A$`J~|IWO=jYq z60j%yC*?vzqg`8Knbt2w-#U<)xg$D!8}^uv7@zAmsB3Fx3$eqW!TsjD5X0W_xlj-@ zAIxg;wgG$Z+oZN7wvEUJHqEm$8!2wrX5%{Zt;_7fBw<^;1zXZH_l9pd42kl7&RDRs zsr9{c;yc1El&QH*x~u(pLOZcr9*^vcM?`xO7~ixhig(M`BVD#K>?Gap@Yv0GJDJUN zV)Dr^qLa_rx^JTib>N0pB#2u>X9qfN227wfySlUeI&3|}Gh1-OEv|gOKC*S;NUJX> z6@xo;?~4rxMAwJ<<)T5W5^kKb8YtPh@Xn z3&U0Crf-Cs+4&RM7HOlI_}=VS*McBhw~Ak;sk29vssw>pxNbLeD0W2Gy~6yUIn-_I z+L8>yo;%{4>3(Cj!p$H79{0=R({FGRy4#|iE8|G~pTK5UZ_CD4A+hT&ES|@-6BIGJ zS^v0$_7*4sY}eE2d$X(eRKJty4A*X~o!?3hV6_H@zZ1TNB2UxmUBPrHvbAFjl_cVw z3&W?x(6zQiw!ifjzGvtdQ^THjQ^(2bC)2;)7vCY@(eXw_bgmEe zfOLW7Qb4-EvK){uuyFB8q3<{lr)i2i2J!0h%L+is@u(biEGR;OW(T_2fj;j*+|JMm z^YPp9F;^V3lVw*Ny96|JDvoh@W&OQ5Vq=Lr#s0WZcsJ1284O2ZznDo( zpquTfE5%PADxmTETc;TBaIcu*mH@wsxwQcE4IgId+$ES}xhPD!3ogtmKB4}l8>m|m z^2Y@!K)U`h`g63M3X!E{Kv= zXbY9M1qe@e8-cIJ!WghS$$*kHJ-CL*uYyBHQ-dww8w z8iXE4`OFNs>6+*U_Wej#`*QSPh*2PlY^eMHuF^rJ16N9^6;pVXjA`yu|_X?<> z<6uRr=!O+UaQHqNbV>R&fI#od0Q#0T_(Oc^I8KICzY1eG_bvD$F01vJ%slG3DdYH5 z8E>(99J-K_fsP|T4bWdYhCub4t{%9Z#qOMBHc^Grqx;vgFTKvZ`*V-mvIFh2P>azG zi;*4FQc_-``f@H_^1@k-AEeB{;bv|&%Ndb$BQ>p>KY@3Asc?(zy->gLSwxn|QfDbo zfr$eu>dQ(btV!}Bqu^>&Qmx1IL+vXOvqxhzFXTN4DWBIW^t>$NZ`n+9MrA!=dmD|OSU@Vt3*xg3ygS5P9;?TTw1+z%Wa z)k~D_0YJJTu@8{u?{M_va*6pwK&J{c7?9FUa(qAL_)>RMeb)jyO+sV=4HD?ffXJ;v zfqMXH8jk?dn4bWoVGjTrB6NMg=}s5uSU^g5iUXbQKqCQZIW7gHF)smBE@7{B=&lE( zX?)(neZ|53(82u_kj5wXX4_f2Wy!Ue>()X^Ff+3g8)4GI$l!h-WS{Hm_-Ha)ho(%= zPE2lf>yF)d2M895b7qRsF7Qe1qtWWk;oO%&0z}McACswN+We=!`qgIVly>ydW)6l5 z?j}b7wWXuu9+t>9mUi?OHXGT8%qZ9H`3bbrrp}&MXN^7D#Qe~@L~zUbUAv&Q7jC{1 z-ifA<2Er|u17aCW-=X4YxMdoU?Z=oBIQdUz<0z_9p7%9WcerIZ2$3fV9FP2&ftw$L z5A~|46`07*Dvf~wdX&H)fj9g7Id)SqLGJzsQ?siEb2l$A34xwK-%AT0Mg~?_W%vU9~P$Z z3Dox-K*I&cE4M}nv z$tS)B+!pvzRihDb3V(I@qoc$V!aoa@IuP@%zT|)kkv}Tr6&De0-rR+l4|d!0X^D|} zWm*&xS<=lHKJ;aGPWGHbQ*P!Q34@_5iEETlD=fh`A6v8Cos&&=Xv(qi>J|4`7bQV{ zX9{_L`q=7Md&=z2OGBTMpq3XPoNkSJ?QjW=__fK?Dn6nR;wDXbnrDaLiZ9t0ZXw<- z)cQc7;4ak{d5ZeoAsx><-;;5TCslyCtN>$`N12$0`hzcZzW6seRn^NSk{lLMM&$Tt zoyPoa`-)%1@OxONn4j2J{3_1~RjYp8iYt^1Du1cv(6__8e|N?=)s@`%R0KJZc5e@6R`N}HNKNPE zQE*Zrj;~Q2^d7Y|fnXwc@xp7ox`57ILH3p*L+Ri>`hds~6awRy>i(3mAA+LJoH5a- zBZ%sVcy$EjU33JOrc+A}c|Jd`!c6(O7u{Fd#5LepRi<@#8MJLM`M)2^e7-8;ONI>h z+nx?VPnpk;@!xLK0=x+0Brs0sM*DBoIRd@qJp5f~dQcd&N*A$984~(ic)kRhX7YYG zGFzn^HC7Pj(HnXDCTPA-E)7R=r5od0m#6^UPS702Q2~x3fzVZs@fTQp^B#7;47U?- z)`Ra9zO8lkMp-kEn=IoMwb`kqbvOc8!;Q4Qb=f29veR&KtUr$hLgkE?X!ha%OkXY{ zKtv=aS(?ls)Yep$8WE@|>o|kqvBn@(&cJ|$!N}S}lClY9HRu&aT9cWe$%Ox?==VTk z_qJ-GElE)sYLidW;(%vXKOlWBq|CD2j1f{I4p?U51681$ip(X-YO~iuQmkZ-rV14f zOAdqZN1Be9olg2MD!vAhwR5Ik+`EC^C&4=^oH&t%+=%}wz?#JhNZdA0;pU$s0Hp9( zCOz2VA<(Yp+%3wLg(ZV)61n&`?lxkh5xQ-n0m{VLVjvJ^_Cp&kmaWsdEQR4_ct`>` zqsRA0gm5!Y50(Q&)y+hFZ8*MJXT)e!&Q)0PADF;LuAPrqbv6%leQmadyEj1Dqb8A^ zi1fCN-Br+4pzb&s)0ER}dj1N$0{+ep+D<5FZhN2xD6J8bu$(OX9|$k z9S=xnql*CPY>KT%eV+oP^U~)5>70yXY&rfyff4vXrwTL<&}jnA0W?S;DsK)JCNE+}%@D2u zMjJ%as40!?i=7il&t&DJI+QH3ucfsn{P|5C=R39NS=5MbSb}srjxX-F6n?gbWiNRZ zbTygfBP6qv@fN#j!>7G(3DI&Is zu(~EUBRkFKGE~3;TLE`-BZ*qes)UJ}z?ni*3kh^Y(PzC|B9#4dME|kkC0vf&b&M_U zw~T&=Rx|4!Sqoy1Lhw0w)p^cEfOLMv8HrZh&46_7^H)GcE6&=!!5KPC;G?wn!i%!C z`VQ`6gF^)S!&G=NrfY~X}YwpKtrKHl)4;lzp*jcPy7_jV!SujjI=w`}b zH15MU%K#*w$J4=mO*4w@`I=var-p~YQ)i8wG3u-_252PyLV-DWQl<^b9TOD-{Qysn zU?DM(&oMLd@FwUon{866#xg;%{5?tbXp%wr@H#Hq_4yhAj_PG4aN{K5^->W8I@|T;ZcD z4cJgy4Tdvv*s8@Fg_7#J=NG%iXP$OwY^Zk_2^>X6|MyZMviKZywTXuzMVtt{Owc&R zWbG?{74vWbCSDNFsRfwAd078~c-R80)3nYii04U5fM2EgN&$wg-#VrFm@gjecg|l* z7G+#_NB=%)3Gl1&Eb_%e@AC?1ID%TIp*~?>@moyAnfdYWi84T+g0y(%-#U$XhkeDb zV#o=s>u$!WQxZ#c7y>3}C65}y^$n}^Wx|Y0#Ehj+FOOTQf|zmX)VTLjUTb8p(DEhD zVBthv!^(zbMRfcmE;Fg3&Yv$a%w_ZDpw9knp7OC(4#Z8mQV`h!aoVHjl;SAz@*OSnfaLLgPc?a zJI}f}Cnxl?^9`A;aE}KHio2PJAV>ktzS>N>Jdv4=MfBD1*DVd~ie?%r!nbfenG59A z3qKv{itNO$t9L)vMvwi{mTf3svd~BD}t)iDEjLO{i9QQ|IxiI@ubw zkw9$2{vsu~+n7vtW;xWjhDku+*4YhT=Dg)K6rueJY*+a9Q6-S47MvKv%^wAAB0H&E zXUnT(I)K?)KWMBDwA;;1tNWFOTkd1+Wa}_v<8G9hJ+VH&N)POW7`q0UIA+8bn(1d8 zN~tB;Dl0Ua{6k}Fm=zEi!vnI1aoymGZ2V}RqvA2DNEas3l-=cwXT5i7d8hm_ryC}6B zlNz;x#91Bu&S>-;aFAIH4cX69g3MdwdZ z6|+wgozO{K*(f);L!L9M$~$@?fAmBy+&Q$>J(UWlCTA5&btL{mq7$F5gva#^-O&6` zK*tE(*YVWJ&vyY06x;)ND&13njuRZWm36y#51enK>|^EMCq;pG+1yq0@B=n z29TEMD-QGwAf4Rr0Yp9;3h+9fp#lvAq`nn^h6yePNN3J8@T1Uj2g(5&A#}GnxV-J% zMREibip!nY+ufVUJTBi8%9>&|>=yEMZtxDn-fJ^(e8cwZOG1U6T-$MFCwD)*f$;9+ z+I`Y5!YhqcEZHUA>uH&^D#k8;4+wN23F;A1>I>r>!fHS`%+vy$4R#;wHi^IxQRE|$%-r(Am7_cfwywLRxMWA^c?~L9L zmZxUT$Wu=Q=XZ97lbLjB`@3Wr$}ntAKzp{Q)ESP_Ha)V)w?@P!pv`m=pfm6n3QTiw z3jt}ZQHqOTZY2(}pNJIPyP&xiW0e%CfsJo^*o26u{v)Lpd z^}Ps?<^{x#qkN0&(~ddYD_ejvZ`wo52fJChN@8TTnHD7qw*HYnT=k?oO{kYP^S3Ioi9A-PE$YU(3H!>(zUGEOG1_6spa8DB)XkAJMkcm;`$q+-oTUu zkwI}2uf6V0Vj!Uuy$rxkTuGtv+(FPd#k^@>@hjVWc^i@R<^rH~8tRk+OxB0NmQoSx zqF?aQFviylFom{4HWttvrI6r^G{ zSOWYi#x4-hLopW>&`k5CPVe6o(40{~L(XfR#>`G=onjUjgo;}N{B}2W)Y*Y09FC}D z&Ne0gz^ZQLVS{bOHI3F*zuC{UM&n1WXjs??TkBKD$EQZ8MeB-N?=Lzn^vzx{DaDj! zrJ2&0w?o?V%rmOejk0jwWYfD5DrJ|`uDW-axB1D&a&TiPw)iq1EUZmI%VsC9EAY-F z?WV7T`$slG?L;tt?=x>tw7A_A|4yli!jQ`5spL0WJ88-^kF}J>ss(l<^q?p6sw&LE zymHPg$>Rb6F1}C_qw{iq#S}h2l$oV}A}Gs0A>=D+dK3GW?jZUJ$-`%YX11Z@kIWdW z#`-c&{N;wm@vt*S?3L)*-FT)gnc0@e2Dwb0$kdAMi(w3A1P?1TW2lF{c#fin;V&fX zzg+S3vL_vqf`Kw`oiZ-}LZW8sgIxHvna~lH;~8tOX4N11yCZ5}VCdY1U&^L*I-+{V z#-0+MeiT0FNTb|tmb|OdkE`0VpzP--Y1=A3HlA-n@kiqs>cbR2x*+Y`p<4jR z;YE3(DjW@VxL^_82iN>l!HIgmmIc>s8mk%(xpze>t4#NDd)I6f(2f$`mf#d55BP9; zSHzbJXGrW_+%%-)qPX;~yn7+o3V0pjH2p{-ElKZ+jJ8Wr3@-S~42>Z8u)V8@aZ6o) ziTX}}rk3EiB({zhK@y)6ZR+Yu&5!xikyG<=IuNJw)EH%LW-Lz0tF$jBh%kBg_EhXA zVI2X7Xm>L&iHvM?r7uwPC>Zd1!{H#e3jswmxAUx~h+d@F?>P;Py&?f#&0>^WLigDbr{Hq%+{}06H3fp#UWwoiaQRNN2zR9LITMFmSB5 zA^j^@3a6KJ%2L>T*kq>my5~nOOR+2DE=#eZ^!u@t7^8)AS;{Sn5IsVdrEG3_w(0#? z3Ug+iwnSFBb&4t6(fE-iz^~Hqb6KaDEA1%(-%(7;+8x@Q16@(6bX z%=rI4W=UMrc8AXO#?;f23B^CgFK?Cd>KD`ejL;)@9J)9~?zs{=a+ZBol)Fx0ecDr3 zqbo-n5^_)W0;u1D1zjl6zfm@+9PJY(*pDwO2?UnmkB%KsWs}M=f-n!#tpd$W`E;Yl z__!wnQAK}iKHZoqUwmwu&w}RVe7dn?s!fve!$5xl4NRDdbMlvWii>n-fo5Jl-I$0k zK5|4JF!ee!TKI&q@gTScbPpO@b{3%<)boO~Tk_+7^|8@Ym=VZ{_nNL?a zioqOrDxfDp^A|(sq&uq8SI?yD0Uk0)`G|C8Nq2OWuN)r--8j(PX6RVmTHfjiK*y2p zr=aPt%K)y{T;9D1FM#fB(3EmGg(JDd7a8p<2)!rcG0V{LyXj~b3K$w1yBYI&U%(>`Jv)rD zO^*zNhL430vZtkpw210J4b-1_)s@Knyd8iU=mDjuEvktzF!@sI|7WS}o98K@`;5 zir59UtxL6<##&s8xU_uF^SDv6xNX1?5tUY!NcBTNBhKkKBu z1CuyJtH3WVOOyoZHCAT|rFwTfDqAO$A-`Fa|CfIIKYX^lmu4lcaO!dxY*)4~TvpTm z{gqxY^a~JA0NjxN#JX8y zgqH)bT)s9G$K&l-+P@D{N8erw+d(=GO?*nuA#|G@+2D@G4;M4wSt-z;3SyzULEzi^m@ z^jFZ+HXL?#p46tTJzw%xzTa^eEA^C#GP|@`l+}iets|Cw;VEeGn--0CI$?DW<*>)n zYrzS*Z^^Z7o`TkRhp~R$VmQ4-%KBAxOT!_ag4Q=2#!78auViB3h49$H+h%(TTALll zO6_Uf;d+L50rAxH{?*~#4#usWGJNW)&oI|KjpeFtnIC(^~& zo*_0sK&U&{*nm0C$`IyD@35yoLl?!>P&>F;#T--J)06XshV--e5PSp z#vZO>?KP!f8~S!)eOo+hLEd*1p{oS|y; z`rPV=tTA*I&ALUn`>#t&UiM9ZUjeWyFv80F0SY_jq9YKlW%xFn?e;rMY3ax^UG3mn z2K$*vXgf z^!}5XnqEEW-|3dm4qG}9cM4a(*fD-}yf04At0`Zb+(!6VF9=j#TT_e!^PcRHE`P51ojIE;2mA-#W0OXY9PZZIk%?i7 zBq!VK`-en3_7Ri`8L(deQT@x%G7IlR}LqJM6k zQ#51CM`spY)qfh^*5hph-zujSSGQ~|t}TBh` z!Fxh@x-}?pmod^D8}6{R1shyaFTRgWe0_4;Rxax(-plj}R{Q>*@l!{W|JZY?^Z0y|qC>sfhiycqw- z^r*bHvN%dAPO1kfSXLIpflXKpcrspH{)g;uxPkAW>fHM3=$7PGVERn0y0%Yode@Wb z@)xuJ+*Db%i&Oc8r04XFCnH)%dQrn9nI9l?&!yWrUNke^eL?XPQe4!=1`1^tadrzo z>c4{z`tRUJ3mgw;jsX>o9OG}`SegFUA3c9<0>C;Oi?Uf`Q}&G;9=*q#OtBH8@xD;} zQyJ!?C+!*5JAZP2u{W9em&4dW>|=(blPNY)tjs_DXzstg$n> zjZw~(_7(q?@O-yBg@q0KmD$BV*mx2Ha1?)Bk2RH_yB*q=EEqmuXz7j3 za9(@eoF*TG=gxznLlxSZ!I|R`;PHYk&6>YB&na?3Zh1_fV;=L%&*oFtEXH1x+;nlW zw4vEu*0bAj(eToeq&F^NLm!DOK`FI`(cf&il+GjmC*z_~c6P6xRp8%KD3NjVO@aSp z9259bpxx3)SWY!K7XOOk3D~g^7(PXsU@-%jEo?Jj4#1B%|M4i~a}NF>TL_=w34HlD zE=B&b8#wy2r5iZ*Hh=3T?xSwt_(eh5EdDp9P&@|0t}j~}pDBc6JW9HOI~2Gv-M}%v zv$}y}JQjBY$ENPeZs7I@?%HnPSPt&!29ECis2eyAA)f38j;kjxbpyvWu)lQ!#~S`& zH*g05SIpkZX9|@Au8SSl4IJI8=mu^8aOV}k4NVRUd~;(baY-J|X}Dm?KOvvQ)<(AP zI_h0Oxe+DPljA(x9lBbEa>`a(EINo|J=T>(j+DQ#y)VsszclaNC9ENs^2|@D(c{UI8kM~o99Bi;`xaMh zqw>8WAry0zL5N0>mhw?48bK<{DnT@IEvOU4_I5mn3Uxo8EEQ4NfIdQ~XYec&Y8#%X z2=y+Wrwg?c&y-NT&0x&JwB&RIN~4A)X-AG*FX-8a?s636sa;0+>ug z^P-uJk@}g7G6}93B`}!F)@QQK4UziAumzh7Jc&h%GYL^ygb8ygB`E%wYnS&P4+ewIyqhV(kUA$=VrHc}}H#Q-z z&dcs=$-uq`mgoqo+43 zn+y((H!CBWhS*p%fhWWI@tERYd9yN|TNn&%byFAr>#U3eE)E(V-E`+c-mGj80Wg9w z<8lbO+Rsol$p>7CLqOh@;;2!ytnZ<{lq0w!!-bc z2}tQDE_OXM$6YbxLjA-gQfzf#1QU>A*kVx*>1al_eKB165-GNZFoFq4F@L?(Sodl4C;Ev?q|At2Faarc zr?IF_jgK#Wu2nyAiBz(LUP+f53rO`7DO*k-s=Dd#`iV=Wv~UO}AjJV#EXrXW&Dvkx zI(t7U{VJt}Lofj;b~|3_eLeET?frdHS~vs~kfJX>zaIF@!2NwvS~vs~kYc&jkHH`! z51n6o(E&awEgXUgNU=MNMHzCMGta-^>;rvLS~vs~kQxANEXtBb^W?EVykme*N(+Zz z0#Y3O#iBa7j6^3t;4q(*mJPwsI&!r< zbv4!dkoo+_HE~Uu@VX2I8jTeHanK7@IC<)$;L3q zqh24!x(&k&lU0h+;iaYx6h3jM0W&clH!P@{N!%P@uE@tF%L1y3#N7zY_d>W~f$*_v zt^sCCKCX1wNYftxq2Joy0_M{&u1qVQz~r0!KJXmvlo%J^VZ*eIQ?}qn0&{jgE?HKR z?_M1+nS5MnNnkyQ*4N^3M+lb;Tqs8CpW?A8AD0Y7L&En8F#inUMvm0(L?c4$7~0YS zY)@fad`pvo8_I|~5tvj6R~k@(C2k5Z3qrWz!|A>?#H|44mV8`tRMOuZ5O*Iizs$## z4oi--j^RIXTYz~xj0+qTLfogo^fm3Ni|?=!e{mM~1_CoGAD0|e<}V0z5B*GJMn0}I zIm{nn;xfSG!nnZaNaF4Q=HW1I6s(*fZWA!C=Hrqh0|kM&e*zO{MS*egEiDP<+W=rr z3gZHoebc=ZFjMn!$v`wD{T2XoRTwwSj9Mi;bng~m?$5{JYiWM|{t}oM!??gcJi7Nb zFrS5Rf$ApV>x-WFDEw$#x+F&hROjj5C}3(rxbji?`8xxcY#0}~<&*B^fVne-3tk#Z z+{3_Z4&g?I+Jjet*&f1`huY^j#uf*0d;#Odw>)rQD*ZhPm@`ATq(8cnep7+DID{J! z_*_r-t^(%Pd|WU)>!TpaFz|8^XUW2pwmY*(c_I_(HAjN39 zl$7V^$KQZEV4z}Lx{M6g^BJ%{9+>M4j`>|EKR6NIWH2DbnEWX9muJTJ_rUFOlwx|| zpXA4gq#qVp3I0LAe8b?l3?lgv9EM3b?Eq%qK>)x+@henL_XYnDgCUN_q)Vy4V`cbG z1nxqEjR_9tgAE_pI(7+hEB!g6rH(RlcbmV=<$5d9qt+%$vr(j|D__Uphk z0#kF0I%vyjemUq5>um<3NE=@?M3#a7^!GjB4n0@{KVgTf%}8OI)8@+ifLpeT=+XM3kIuOwjAWgm+iqigHfc3Z&|ROGrpUF z`@~?KzoUX%z7oLgeH{7^{AesL-``@`onbHn#KV-Uz*aN*J07^J^4uFbvYb}VBtYE) z%p-ZYe1BQ4HXDo;7JthE-MOUm%fR(!2LaPnJobRyVFn{WJTx9GUVU9;`@&|$%g;}Wpm1kB$IuB-6v3EXD}qb_Rr^3#R5=!q7g{~3>b z9K+MA8#oTH`*#D^8@Lm?fup~}yMgNkTtzo=>2BgCbOXnDOzQ@YjT`+yMbeQ-q=mtbKStPeSWbU zIF^Igx`Cs6?{)*n^1P!PIJV>e=?0GZwl~(x{H9PnXaBu_H*ien0o}lH9C1Ve+|cBR zfI9O;;7amvh3>Cp|8X^NHyf<>tLFYn=xWyJ=X`HJ;twEzn|$$Hj{h1MVh1 z9xxc6P#AyJ-7tE<-GtEt?k0>La5rJx+}$vGz}_|Vf<5f!{`Bb6GjiXn=pF7-GuS&?uO9=?k0>La5rJ}fV&Cf``rzr2i#2YJ_ z=mB>V#!tE%Mi01~FnYkW zskZf3m35w0y}BCbAoob~VwESc2T0R7_aP3)#@$Vai@?6P63X!Ps+B$0z}rY?4>`jj zQHK*Um=j;aFD^HWTqB{X!TYsB%?6e8Lh4iv5y)&G`re){6A#2))i|V!*L}H+9^RZM z!(&7_#8G3`=-Ho4y=et4?qu~MZrN+8WSH8^T`)aYP4dD;5wd4PG{E!@? zGRXIQWBpI$TbOscJJO{#?}&=ZvI0;3)zrR0s0qOFrm$#a8YouksN8RQhVYi*{YIf~ z0>y3Q(a7zfZW8JtP`ryol@2-RiOLq=QFS;vb6izrC`)<*;x{G!7tl=12k}$=$e##> zN4L!GGNQN(S8PVGIDMH(e3>Qey2@yqk@<18&M{ntGK$)kno(?;kg#~3Ej(tFW?mDh zal&IpaYuMGaucX?gknZ1?jcZRnKcjnup_-Qp{_%!!_Arv0nGF|0Z&JAno>2fE;X*QZc^36>QqfAHn!T?K+%1_VK_G6r*U{nD8GFn+Pc|Q9IQ;fUw(d} z5;Vibkz-UXLG{9$hIft$ZT?k_n_5+aEj*zL%Za$(FysA(L4FQDjqY!R^4otI{r@() z*3JB|SU!`fP;wNiP;*>zcom8VHLJR{Rut>*?*218ci?9ebz;@%>IsGGgx8s>ql5F@ zX41SQPSMdn2t~}xLgCRZ(^UfJjP#e4r$$Kx`tEhqi-lJPo+j1=P+obuRcy5$RgD{6 zH+uZI$yMVf@3u%K;ELZc)UV;EMe0qV{Pu-tTZ2jpS%PQnyGju&#xyQu*oM<|m14Gy zXL=Pf*8fByOYrD!p&~oOrMOpvwF93939ra%E-V92YxPZ_v;)5#ly=|`fzl3q4Jhrv zw}8?Pd>g3z4!o|*W+A^#FN3t-FrDAUPxG)-D8K!e(Ou_yZf3Jfm5$at~T+4|@zKSPJ zLZ0CVi_9>QVF+&%YPKHAK6}WL`EwUVW)Eptw6vjdaZ|%=&}22tuES+^b$+&P#SyIR z)Di6B%)Ex?2=)mr!S5(qR7Fh9!E4@TfZ0@9HzBOs<-QwEJfCj_BRd??!(ReK7iP^wH>= z=&zz1qMM`7MYlv>ivA(`r|4_Zx1;Yy-;aI}{UrKXbY+j09@qD{K6ZPLZ}qsd$E~s3 zVyj~}#BPk;6#HuI=GZN< zxn+-tzz1+i(>Z55QC^+2}F+w9crFbOkSS#CIc z1f-5V`?0IN%}!T4jFp;g!pXMA^XudF&+qg$J1uY+D>ck?==|qNUH@Cz<52}Z{3~V5ft_;-(C?bb-D>N|9O5fHM}DzDjmj3O)(sPLG+}U8s2$+ z7dVWSsx>j)J0Qi>@Xqs_CAjV29Hyse$G%tjVmv^4u z)ed8&t~b83WA&sMFYi3Rn;phV{n&8&1*8}+?>xVsIgFL!c#CE~{5-!HFWu}!I}Sc* z_H*%i)P$MeEj=m5OE)_a{R@Y&e)Tb>g*~k&#dzsvCrb5m7%O$O;jrKJq!=&V>_n*( z9L7owH)V{yuqVZM>1HQNo$N4H>Jt-Y_B@^x5A8`YUb@+d z@C!}KALOJiF&y^So)qJyo1G|isl(V1zDza@7nVIK#!ELl(T;ODnnRpl-!Nh3vb!h6 zcz6%+;;?`eMp}MJ|M+-9q**fwQ;zg(MmO&FrN^RVt$?Aq?S31l^SBgd}2U~@jB5- z4R;tTHO{zml1MSv*r%i~>T%jhPHM8lSgCKDF~AU!Vmm;oaZ}IlH^fPO$6>70LxwXn zBsJ7YJ?1c0YNFwkgrrKG)HH{&QVoW~k)n6x6+@VGQWranm5Q0+Td7Dfc8u4C2e#Ih zI;q|cW2LSzxjamyuEvvNzEL}WIewT(alc{xEU;jPA(w+2gI9v9n{_Gm{V^|JJWRH_ z<0VpWTplhMmZB(rC1vxS5DcXJCk0C=&ndkpe_{E~EQw$-^C`VN)LosH@r?SfMFBUb0 zGIGzoA51P2DQ<5zLUNXcCV3B&UmW$vqEa3}^(mTuc)3XF;({JgON<7##f14}ky=j) z{D$p!&d*MEA-v9y354(zk>co%=Kl9?e&rMwLc673Fk;`yB!f8>KMf%r{^VzW{p?id z*M~lgdi$D5veQKBbv!vPJYx8{J5O^`fAeEt>wTI%9dt0|Pj^xr0n-R35HHT6^t^D| zx4!V$>NC7}vG~IXMyPj8nXkZ`m+})@&zfD~{Nf!WG!^)1ybjlYa^8qnqJDMiK3h{x z>S#YE5W+Lzj<>z}(QPBYbEX$URy7#G2vuoPbu`|*l>gbJ(I<{}ex2>ZsJHgy?@E!H zfhWu2`@h^awbDr~G$9mBAcR#S#nCv;=W`#ruF4A`t1OIQgnHWeJ_c`I2&=~5b@&+P z*YiG%db`Wy`&f}$i6^`FwWYh3k9AV^o=(BQ);pFj4LVph(oTwXl}0ducvXYzZRx-L z{I|AOd+}nU0wWlqVkXRI;ms=>$KJW;J7+n+_VQsgUQd{Koh?!`@MOvlyKmFQXFI7) zeoP>QH6qmyPnwU5D)!fJc5*BN8!#Bb2z93^nYDQHQoiH1TfbfF{QABRqamy``OY3P z7JVI0*2*cz|K+T4PU>twCJ@5$BE`80P3o%`)aW--2_YLx7{Lg2pGltyc=JNoZ^-e> zCOE%-?8B(H-!RIK7_mRxHV?^pj<9wY+ zZO4FRCh(+Rm%MrB&KXYX3O^ zJ<}I2?TQ2wkeU^cdf?Hw`^@r5Y4;$QfKU~n$_zETE%Sm2 zNG%X4n;JiQ`!Am@@JVUu6-+?tVv#ZhE;3`Un%`dRlhU#wn1EEHNSUf0S+@SiKX3F& zY1t4=Kx&~#*|Krt=?5kj`lPgM2qqx4NTh5FP&56;*^7KqS~dg|kXkHKcKq1B*TUw- zJ}E65f(b}9iPTlhU#wn1EEXNZAmk zzEi!h*^@HIH3}vmwM3+B8tygfjPsWGq_k`ZCLom&Dcb^^`{Tn0W_(gwHUtxp$_AvK zer4PGtWQeIhF}6xOGV1|%NxpnH*Kj;O3Q{|0#cWXlr6n$Q%6s})F-87LoflUWdXky ze74_jmieT#YzQVGb(u)ny1Z-8xhGualhU#wn1IyfB4uY%fBQvy=5n8umJPuKq^=Mt zTcVE0-Q9A9PfE*%U;Eb?_f7u2G2=-h! zxzQFz$6@S!JQd=Ug~F2v z#p1Y7+}DMq{utue`!qE*?DZ}ZJQsI-nsY|Od|QY!C&c+nh;v1VGd2*O0vEu#GpTF< zu196o(UqKzWwdKm-Lh_Gc3IHUQ#%XW3E15dGpeo$CuwEs>NCrHr-TPD;yM zTOq4LJkjw{-5Q*A->@*0UQP+fS^G}0S8W3MWN%7;IF3f;z>|`4ZB)_uA-@`jscI2V zjXTeG#gk77$px@rHuL%?f9~5XF2Hx$YrVvcLsg?E(^qL~QZ-}8Pvn~fw;D>4W1(`K z?~uP75+omLv*a0=Ssj2}I@YI5BqC~b@z>%tgdj;pL153ODBvHntYO4ymQB@gY+ptPmnw_F+AZn7>T@d3%!8JZ5UNkC*TH%s`Kjd zuE%nXRETejZy^g;enXc2G8wY;70QrZxV(iR!6qqW?FvlD#xzF4m!cFx2*XP<)_k0C?u0-=gIkUDI^!R z^W?k?42gxTJgHFDhJ?F9cy0vpJ|thr)|0gbBP5n*;YmmuREF>YwnOK`B64CVF81s0 ziJ`+vhLy;Hp$YH4x1Jcs>g?_R*Aqi^%47zaSL6TlSoa!d#_Al7CyFP`7@92C$)CZU zga0dmdC}lFm=#=U;J~QJ$Kd}Hn7^9QE@$V08x}aoD8ewm!U8}P3Uj?QX4f+r(!&iWBBpBo&P{NzNdVZjrH$lt>^@4zdT zuFYNPfeWSoh^xllr7f>`D8tTA-2Bz6rd`~}MPv3x3Kuq7*AI=UGr-$Qt zuux~&o0l+{WfEz(zt{jLV_Z?Yeswx2~xtxt?vWt~kZex;=KW3u!|& zBythPIX`9^DRqA$@+H3iCk3}|$ z2RUAYS7NShI}9-&B(XmU&!dH6rW_+w3eRJO8jt5-p=RQFoKRQe$*hb=euAfF*;-I1 z2=7(L`zxpuh3DNYu6vZzITpfoTxoF0wU@V{7mB7ywrm61gcw9M{ZrhqY5dJ5hO>R~1b01)zHLJq`>sUZiYglHH zTK2wro5)>dhXftqjV#kl(0HT*&xBAj@YF;K6f{i<6trqzLCbA|Q@FbDG(@;2_hBlx zO#+CJ9f_i{jtg+9HEb%XZKiHm6UA%Wv)R3DK5IJq@_7gV@d$Hws8Gz)giy2a8 z&ldMjcU}R79}S~!{3C1+M7sxx$e-n@UvOj5kMYKKzjE6Cr+V7QEWR{7ofNmW({M4z zyD@sgA*b!*X&-Z!Ce5Bs%HEOO3*1y#+IA z(#a?8?`a>iPonAV{Nj2k4Obt7H%5CG;BjS-h8Rta(Z+YCK`d%sA}2@wat=9>E>`$h z*{o4_4%UCdRI<@J2A*;rvm%ajP6#t1#PJtUb!STmb6kjXR>-gYLY&(IoFy06HD#B~ zb3FCygOJN_gg6Iztu)P?Jv%8IHs;T=`!mckL*VjhSu&W!iEtnUxNk-o#xK4HFO=3f zh|WEEmGqK@^A|SM&kRnPm&{+-)Ywqi4gs{`bFz{sa~EddRNc(k3*<&++^k&6d!)T- z7KYGyvsPa)%qAJ6_xxGeOoN&H(lfh%###BJ;0uk}C8PUK@-QVX$nXc30n{<58Z@&O zNXdHtE|souD}lq=za!a8TXP|Z3>t_nrjcMhl9BZAVfrb< z0B2z6@D?zY+Ng<^p3Vq{2WAc%=-xh&$O!X6i!HE@%*#sr{_cQ#Hv-effeOrN_zA8o zaHM(UM`#(|!GPk{g9IjD|JA*cz#Re{z2nA?$i4~1v18Wo1&&gW{22TXj)dm8~kNDBRdBr7@fvHUc_-_C+hGRq+W}mp19A4s&NI&ow0khKJJoknL zB78k?*8y_?2VgKrPUGIN!0FR;Zz3?W4bHhYGH`@;HX^o$~4LEMPJQ=lsQ89sViqPT*Dmvy=q@#^pzH_$a@}bnh)-b{L#< zFL+d{gooSDdU0F_L!6#b9gGLV4OQdF!TGpkX}RBDrt2Vs0jUNvP3;gYLvNBh9=OvD zmLs%^;*yF&xF%p)^Kd$8a07P?*wgLR1KyuiF7;fDCEdH-9FCPt?z8v z*|WKSx_xPaL+QO+PLF4S+SIG_MK?}IbrfB;IJBEBrK9t6Q&Uq@Qj@2iJ1M>Dy=P#V zUj5*pmHfZCssjHoYkoG9#mq3>a#5bH`O1@=I zb4u68SEZxR;5ziGP^>q8#L{0lV%nPRtPPd=!;#kyH3h{Ky#sr+` zoM&et$sPWA$c^x=^WegEm&2~g%!oVwg9@fT&7e;>`N{9o-GHi3|46s*jSx!kIzAv9 z!NX*`xTgKG0kybZeOkJG0u~HXy$~wIqvO{eX0XK!2d0E^GPsU=0kVOt3dW!bRvpVQ zDDJ{OL;Gp4_d=|Bd}g}+0_5?lnevuX;@RN{ey@&Gu_HPkH_+k^BCbDi2zp0exs@ndsqEBV+@9=%QdeUB7f`lH-W*}`- zye9V<9JfUUe&6s2{7wUkHI;`%j!Y`tE3;~QI#)R;VI4v!ACdy&pi2Oy-$T>wlX`K+ zy}$a7<)++dFc7^7#x*N*?HR(Dj&y%nc-8gKBMZvt^O39wo2v#h;gM%RROUWYQ0{3I z&V$sslwT6vkYArHIGlu9t z(Ajnt48*%8_eOGS&FZQFjJSAB$Ugz8%w5^PI`wbGqG2rd0XnqU-XoQWk%r2Y&d$TrEmtNYnIn)UiT2{Qtt<8?#Wg*HV-?6=8xR5~a|qYr zavRoN9rU2%0;$Y9OgJ-ph+r*(jukgu|4Qyi=eDO;J@pJExjJ%TYI^FTRNeHAsWrEQ z)!ADYFl%z3+jO!8&Py*FpH3`}P9F@YEvhzq;QwF^vrWq-2v`RnXTp>5_{Af2c(Rv> z%i(Ft)O2hmFD5gU^@_SG-gz5k_Q>X*cSIrXYWKi`&O$0StsLLJiW>6eQ#v|VZ zHAkrLfSN1RqoCB^UxS(_ygz}OFBJPjP4OWZnkcUVl%_b><`)QVCa8;rnh#3TF9)ho zcwYmxP^ded?OITpx-WoQB({HY)L;yt)ZcPY8s-!z4f9!`7K_A`)Krc_>@v746aHGu zmTls5o1RDj%X%@ny1lPhIy>!4Xg7?@r*srG(jF*@{_IF}^lTw&ZGGm9fsSQ|bnfv4 zBV{W>@>Q=2q;flLEwC$&xoy6c<#cYCxYOBj09ogC4%KRMwOdekdx6DHV<-P_uIewZi0>>rdgD0m zC3N=dUHfH6Z#xGRwLS}c%gzHc%h0G5we7;24uqO8Mzdqho%1ojevF@(uHMUu(kk&QwMAOTu_0*8a{ULKYT!+_)NOJccI*de?YvBJS=Km zjv9+rYFh^n12Jx4NVbgb3{JNjcj;aiB}W~~PES3~veVf!^*D1AUL<#P%tlr9l0k=K z2ihTbUk*!bH4Jb%mwl$FbsdITp5=?J{zf>`=^0<*6kYp1WnrNK%~eHe>UY|b zCxzyB0B|5rVQ+G9!!}|68Nu3#nM+aYOL%Y3_V4(MxHtXX&Z6WFRy8)iC|=1|z1G4v z?W@YYYa3w+4*D)|+6B-y8 zNd-kRFbzAuE^nPTX{~L)GSYdCko150yB(LJ(4#hk-_ZyX1IL|6vq-M0e@*VA+$Pp^ zn_A_YGAHoGj3QCg4o%nNW2+AOgOZTbXaOI}vg8h#b5t8i6s{!G!McQkAWc8g1M?ek zhDmY|lB6d0cX{tDs>yXqpnr~rN}_7!@f^t}3XEhizFyDi%z16=F$mNbI*?5xy4#WS znf@}I?du!LKG}JUM#A;Yg@&+b!QgOaADd$xa}Xp%5pCX%jsc+AGmghE9%*$HKV)g| z$dkp?b{|mMv$8A7h{Qx^d!DnM>1=s!vdX>(N{37bqFK`(_()L7D+Q&)x06A!H;6~h z1f_lZxuDdQi$G}zxLsBI_Nzf@-~J4!Ng}%il*+yZO8qzh4Wm+2^j6=_1eFzui$EMBqiVZOkqRma5Rp#J%f5T_)7G zK+P8F5l}kl?S&zoru~7S*nP(%106LKln(t)byT&Z)`3!&p9OV=$Z`{yy7E3K4QW3N z2Q^d!L8Q`t9(5-)9XVu8$ z)LNvUH>>_JUeNIjsNwjg9xifny}D{Agv{)nE`LJL(8_5oqW4czF85RyqP}I8J2#+S zqN!b9bnBD7p37bUXJ%l~i??+7Gex(q@3rOBXts(Y;rau``I_8O5XkMB`W31|r1L6` zg!{kPw#WW)9b3-MT5E&)>bFGdqVG2|Y|{YSI^H?h3i%~c1tcmlcWrs9LfdDVwhjbp z27Yll|6sXL%=lSC-Gt|rLfwO>7TxC^kLw#+n0UUh7UBj_ItN(@YO%<2r>ok2-Psmc zCtU-u9ei^}QR7C~bzB==U3cnZ8zq>Q+An8d~AM9Wphk<7uaXOR_A zU^Z7I;1kBBMhfEuGa^`BI~WamD!1M%vut%x{03tvwFPB-xY)2Te~ug2ip3qrWY#Kl@p6s8q-yaEInHSJAg4tAnEU)2*`siLCh z)o}>Z#K{B~q_Zn*YT2BWxzW#%1RbmcU1U`g?YY34w=i3DHJg32I9t^EN4#Kxwy5p5 zbNUa{#4Owj*Y>nG)uwhmSts;%q!Jg#$@IeEI(ZGWJx(i0y_mo$W$pZj{%d*hPKGu z(1MVXA<9fPo3s6}BJH)Qt*mr4xlgKdSQh&W-NTrCi>^v~C6g&>8Vm8LrahbJxDQ1lkjJ7Qg@i!bueUWnWpwI_+NirExy@!#**iuT7Z=}*{TI+H5Q_aMr9Tgq!03!A~7h0)XP{W5k$u|aIA}p zaW$+uXCZSt8@fQGh^XkolB-gkN9nR9<_w}6R}g9w#1)%LC!~E~Q+BUtA7SRofC|(BZ;63)D)X z=7L%!6psyNTE!#JI_hIkD%%^Gp%hp2m0Ibj2ORYzC>>97SyNqZ0;M6%fohRZeG`<*J_Kr*@VLO)D%4w`Rtm+2zD=mTQQnReYB;E`2z5HB z*+N|eip3@#SqiE_s2f0O2<`=?@puK)wPO1jC>_o9MsJrB-l3qBcLFGN<>#O@XV!zd zPH>+%-Y!s!g_pPZSjkb~uhY2~*Y!ezNxA-2BY>RmOvWttCNya4mVqHFj9N&{>SBqh zC%PP2zB5y4TSHbY=bV1?%Kp4_k6%^79a|EEW2xMBTas&JIApb1nID=CXMoZ;*MMrr zFD~QV>xG(u=W3xi8diyKgVGeyfsI*oZQ|&+i65QKEHd4ma;>v%$LxQ$XFL|2OE;^t z>sbF7cRP4 zWo@WCYvQ&~!3cM2QR^Q7sHtC%YOakHg`N~4J9f5_0RqkKcCSCU;hT!vt}fdZ}SzVP+`7(lghoCN9;{8Zspr=GQV*T#y~<_59-2A;EodJxaFP>a+63gHrb{1f>;=rSa&c)oa>5(wWcvBu&=voQU>VEJL)pb= z*LHlwufUp+cHJ_hxD%LaR&Oklyjh)FU+X@27qvbno_(+mjf*RVtsg5>$_WeDQ@(c; z@pSGpl=52HEil;MyL15O>a{od&9<-C)EV; z2XEuRl}@%sT%DR7HK7X-XMAB0W1(s%L4`CJ_@&wbqyIm zkY395=Iv;=2G5bj`3_rgW2s#?a|Z|+T5{rpHej_ zdoZR1z33<^kcdNQPHGLUZ9KdZZ_8k1?(@!p);gF9l@PQrm$CTF=8f582>>4e-Z0Y> z`%wck6vi+2q#dv#B#(O?26ahH0E=#5c}0U7k^qq08xCVaXErPY<6LX_I0hi%peg1SU-$Aerl-3Xb`@;>5lSun+5tKbCK7G3Z*)nz{bPO6j%Sy0CCqqRKt72on zxouxj46f4;sp#duD3Fr_&BRkcO_T^QJ2k2KRGvm9_cs04Ek1o=rvY^X(}eVp7@*}| zl+uQMYb=?!uE&>-qFXog+K@fn7F&E6C{4aHYXsBekwEIiegg)|h$lKePoi*E*^ zHlEy##suN|TA%c4`fXcX4Rbm-7MANX7uiVU?B1XiwTQj{b19lhfZVKFhvsM*a#)7Y z_KObfA4req)}V;Hdml}*91Ru+(7Lzp4xvi%^{u@2g3+94q{6cj=jT=6o32sbybeJY-M74AY+%o^;<#aK{Ue)!Zj#H&?{z`F;( zxHRA25sG7{?+W!pJhhB+=%lv41$8%m@yK8CR9n~Tv~2LzNX-F&ocSIoRt3*|A7nK0 z?dbQS-;eg~p-UA<15%6MP6O+W|9antQoZo5R3AqbJL+Okose$DkF%s_@lJCfe(H)+ zbVVt;q7+?G%D+Pcj$m&W9?s~Ce|H9go`)d^yZpL&f5`T@z!5^ab0MCTKXlY%eZ3ug zI~*nWbZwKFFCggiWDCO56KSZS1kx{;*f63i@2!)r( z4nAPuBwXHrCsX|1;knnnU4CDHL&IHuF`@eGDgVqaKko844UF2GmLB2l^6Td?HWm|A zShVe9(H|ka%#pVq95UM5VI!gkL3~Za?PzP2MiQ5{Jo;`=KIb z<39B8)VF%Oxc>!qG<)F}i~bl-2Dzze=Lqi}lDEL2*~^9JQWL_x!Hq>ZfZGq$^Ml{& z>D@zerNh{`CxD@0jAK#mC!u`l%GAT&JtW5v0MiG4X{j>NGWU>hcgf+fZ!Y`oChr~+ zhMs00CsnD!apbkeuZ()-QhCr76NM7HzESempDwqlmrxZG5zrL z{5tLXlZSfukeur<)~~rHrp%>S^Z`8CB0Ra`^D6Hi5_=l7cMr*NMv5iJlRCH0FD7~S zkPLMg>lZ4P7>+!=5dQT2$h+P>B=@e0Z>P68Ez%RJ_b$}^zk;rx*Mx)3NAv6c!7nC~4Nj>kwsMJ2j zcaCYj^WgtjzpR9uNEdr%lcwDuLfy%kbXE@bpDxNSB(0`L1e~Qa8?y}_htz!msWYp` z%Z^PCLr#4LS8^GnaC@FNnaX+9Rzk;_z`|;bVpfGPhnTn%rkGYM;y7bNoGl^F*`d@J z6~g==#Nm|88uk6>rbQxGIj00L3uiVqF0QvS7Bf5K`-V{5UkGtd4*11%_HP(g--GA& z(cjktQsfK^rQxk1OlN>2TRJIfOpgeCpHqjc%p8YAV?c_W_CPE|s<|PrMBN?0Q0m~2 zJH11kuWN(}Hz{vVF84S;43(eo3685nm?eQ6q-!-H&d)-=Qte)J0LB;wo-WYi<@wn;xd6&%E^X2nb2}Z&u_wokbaJ0h_AI*D z4S5WMz%`aQ#~>f3TycKV5-`Fs- zxvrtP8CP#=w}d-7d21*W&=ji1hPgBAkspNWi4|TFlDP==(FeCINo*#N+|OC(4ow^9z}VU@HL^DF0NmKvk|l))ZwUE z++WI8g@;8fSrkZ3IepEX49j$p$S$cv%OycK)oSLFMajC%;<~1p%{WETl_Ay!8I@_K z3&{~*!=)JYH8vWz9LWwJx1u(R16r5$$VEEn6*Z5?f~Rl(0>G9)xspnAShZ$dRu{gY z)i1qeGJTOj^6v6t$^6S30y)bVyLw`53h}<=bP#`d|BEw1c(90y zdgq3amsjxXaU>_WUgl3}Le?6XSCg0#P1)wA#Y+^6%Gbn%mJ4vDYO(;xn=cF9JK#dQ zrnT@PB@|`qXcIE)vPCm-a*1VX)i+Fbhl`u^$WH>i13=vy>xFkbi)XtS(?yJnSzb|AOHq-1C%*776#8vSuT)ajR@PdDc@1kxWG|kZg5qV5O-Ym_ zJfpNeM-Cq@7Ud&Gj8p{AP2u_!&bq^tbeZYKCFF+g>fit5+?0`JBmMqS(X$34ySZlc z!a<&#Z((k!u-K-v(vb!1ViuD-;rg)FpuZ)|A)X_TC5C4 zThnEDz`b99{~|EgbKwYv$t}1M!E~Mo{xiTF%mjwvs8n#nOPFNN3;{L7U@TK`qk`^n zW#+;{xYF_xE64x*rqc{uF&CR)T=;^=t3;AWml|NMlUw64G7#S@!2cI8P4X!V zt0)#XGI-uiE%-M8^QytQ_>L$^!pa%0;{Owvc18%sb8n=7Ss}6kc0T}S0T-8GZ29xA zDwB_BL~b@1zSC3`7gr1|D-F~mwaI%HI1h!ZQn$dp9~w8Aeud6MVKL!(L7x~L!$+Ka zpU@q_svT6B+mw6Bd=-2bph(N-Ju-DIpGS+@Zsi+xFfB13ZHroe0#5GIVk$>G2U4}c zJ#FWrwie+!J?MnEDB@Hc-&~P^eWY^+T|LZx3cifaU}sm$vP7h!=+;f}p!0P5r9Zd} zVjiWtIHqI~?5rMu==D)=X!^#&4qZ-%UX;xl^zH?0m-{srj%)CX%bp*ln()q|6OX)! z=QyDPpBMF{Pv0@0P@SME$c=#N&X!8ILk&BHJvFO?GRH6#aQX;SD@`SsjPAx2POfRN zXg+jS8vwNR^8m#PD7g89;kJq4zU2BhSaW@GyhMl92@MdUSb?WTn_pcf2#>ozlzI@9 zCcw`e&y*&&y2OHc*ezKs5B)6wTn-}PoXH)epA4eET1Nyukm z#IUH1SGsp_btyIk6dd2NpzY(3{ME%B z>k+B2m%k&oz1KR(=y!6u@C06bF4(V-?Ni~>M5wv!)xmGmVaKk?cg#g0dkNGUO=a0U zCIMWe^TK=wGH3ZCk~!5E1dRmL5Tg2h-6;gEJrYitgLVC7LcWs9!Mbcv&cQD(C$AO> zbvm9Cg_?=yB%wI)m@L$7cuoRhqq;;PD0>2aFy zW`R;wh^(`10j08!g7VeCz;VP@uR&X|ox87Gx-V;V*Of~FE+K>MkUuF^hnP(bM`>Dr zMuE~=!-y%B1C<|q`xzcPIbU!ZC{V!2U219sR7L1Azba@VXyb!J3;b<3w@0a7hl&3I zncgipeV~osax{w5ptiXT<#UYF+M|w^x94>zKKB^|&8#F)h zZxb7;^x<=Uy?MdTZ@f*h2OC%C_T+Bx&GI!7!gl*CFbnXt-tM*MZuE+x+ctHMDcn?F zf;e;zv`T-4F)3hdbLZNA{rqnQ(Zau-08BGzjH8&W=i?WbZEF_@wboYUbtH(JN)tc2Z&=h58X{}OgICPPmf%Yc!sr39F?2|srb_h_J_WIet&NoSO zub&Or1=5n~IWj`^q(R7|cO3nnAlDPRb6D4|Z*7TYuF_sWrC% z)3WnF*`BF2w}P}`@N2tT=e<*8jQY=s5YT?+Oi;7&i_3_vK`55LIYKSKlch8+I+pW< z`Wl{Ee(wdP<@aGw^TqZVJSi2A92*UkU*?oH&)AgKIH;sH_kt=|L(dS(_?a^_shA0E zkmsfqj)JHn1&w#HM1mBdn%YyhP-|z}WbK>`72&v5cY;=8WqWO0UG#R6WQx!>TW_*= zbS7+?`3D4Fhvzokuti39!<30q9#6D77SllJ_M$Hm zY89SrMR9Bsp6be@paQkr4IA|&cb}r@LD@8>3yOW3( zjx?J#8)+T?b4#=gg=`uH`}&kmpmVF&#~%&8b_49+wMcMiqa8vkD2;4>w7sScMPUT@ z260aY53_LR0UeOR!4K|jK(@$48{L2$Qz@f2o>zGke9=ZX=_u(~r~`;&AaJ%ssw|!B zQH%0Ky0|)rQ)ZqOI#HdAPT!c1Mn}=ZaDyWZ&Jk^a$}HBYjonfS*QfZVHUlz!aO6>T zpzP!6++$4%!Uk((T%V|~#XWKN8RU8@Y%gUtX;(7;ymysI3{QpTG6o25V`?ytC%40X#Nn6scn|jToTQ7;l&tI8=hs?`k>aCfM16(N)r9CA@6myGk0~(2;IG zOXvDHOLKk8hR&8xV@20o2O*<>p04k6T{`;W>AT)wBswqB#N#gZG#5Rx6W;|E6B9^d zvj|#|iD;zGD()O%fY=VGz~e%|!2;}~iG%I-?bTRGcs5hKvbwk!I?|}1ePzOIGRHTA zD}|Tr_Tn-%ohZ~QJe3kKesd}way&RA4$}4tMe@D@~yYZtJ z92?WH0IFL`(JiIuj#Bo|0fl6f80YIkKFKfZk9XFbJ#yhQfWgpp9hq8th_7TZSm8SN?P7CVfM#mk1ne27I$ z@gyVn(bl-9p!=G`Sg9usr?*J)Q$t@+2fa76)l<-Y#$l{f+Qe%wk=lYMQ*6P!`p-S( zTOR*QL*-jd=O;|=@Iyi@YNgr^`1cG?`Sxjtu~Jkrr(vmzMfp*J^2^Wr$G1G?+er>% zrDhx7IrWT1pU0CiJmIybZ+ObL3mnEueFO{*(*Wwhcrtf-mX&|oQ@;Ha9Gbo^UfkbA z!xbvMK$wix6&F3{Dc??W80!~Lkf33Gi$#YBjjOfpUUr_Re0#gYSShQtwy#JXV5C<4 z^uvXo@@>MzYhM?_fyNz{&{*_NJQ=ThzVhY*Px*GR!&txO8_s?r#m^qhgD0N&?&+TL zEw^^kc*?iKOiWp;V$m!3#P5YE%SU?3x8)9F{aR!=`-@a9o@D%F-o;0G%C{MZu~Pps zzB3(SQMP#WYvl*`Ug#;`e(o?<>RZO014U{Bo~&P|^dEbHr+j;l!%)g!bJ;J(qRcf) z^*`%x_Z}!U*N&u2xV0+IeQ7VkmN+VP_>nFro>*;3Y`K2 z6yW^K#GOoyP=^IL&ZQx#zNY+mQn`@Si6IVarZwspTT*M3^CSC;|H|QD)f(ko5DL#} z7J&bv*w!r-;_(3~zT6ey6joz1 z@{31^T7x<`XMSUYdHv5WjOe3IalwKjQ~(!c3aV}xZ9u;wg}tnX%6X~);=5E^8RiyH z(dtvZ47n!QlkjUud0g*i&Ti`is(+&JX79)pSsRY2RW;+yRYe{Y*YJ9tlJZB7sxhjt z5@MT}2l&*+X>Ncr%lw8#1#UF*yX=oNdHT!bJ&hbn5t;#M_7HbJS97O`>^i#*wSJr213zB$N3k8? zVyEIqZ8pEtz6`V3kf&|tM@v8uyZLkG*HaxU-;VJWCEb7xGs5Xy8AT-bZgsG%K2<=; z%H^9;&vTkro??|izVyNPflJVum@ zq%@LYN_P4DpXg&H1K0UPIJDzFqc=>q$M#`9N6(D02+rIH9{HYnZ*Ag zu&gsU_7>t^GH{(wWEJ>V0%N;vhbv8TfzBC*?@(AK34pQw`UiI8bLd=UFnp&Gy_w-k z+b1VtJYZ{*!7|!%FHv$>07?GzJontqwpcAShg;|-dd__~cZ^3k12|kLT`0BZ=%?*X zx0Qp;XM4FSmT(p10QQJ47sLmyJ%GT{Rg<% z#TF`;VBPp^S@0N(l@A`G@a(D`98jm*nGNuG@*u1Z*9w#a((9qgMc{_zj$OUo*LUlpau$0lj%#-^C$sIbq3`bIvkA*^4BEhT5zyV4oW1I zHHFd=6vSvz?e2bKJ6uM(z%M2Yh9hlMpu}qH9Jbr~k3&Dn9Xh_CLp6?JZSo z28U+Ph?RO-8D=lBKVH723WuSTzYgkB1#2PAJ@yNwk8sXP7#Mmdck%&j5L z_7Ep(11&CVe}i2T#&k6})?UP-_Jtdoj)Q_5FWgQJC=Nq?dGw@Fb=-$yMk!=UpXlS6 zF+f#q-KEXAe^KBnXoMyNtVG-ndKw#-VmHR@+07U@1QeKckJqJj<0`Ahn6ZRqX^m80 zC)HNhRvCZ8eCUvyI7IwFhQKfcA@8F3EVpTzu6B1lZTaxBVO~$mMItnUXl7=aB=)xt zh86nvKj~>l1~oS4BB!~J{D)dBWe2+SjKhI;$@XyA#2UEGrj=c|3vt z3s7~AW3_@IT-^&?>?hy*76bDOgQNF?%hR~#UGFag^En|`l4qb4`kt39&&q0Xq&1gm*GwWeorczv40CyDJ8-iZz99>tDE|fTb>p~Y<$3Hh1 zzSFRW&&P2Qs3*G_pOKNksIpKGe?T72_3&Zk37maW!)vquh(qw+rPKHdr)MAPx6O5o zrdW{Q1Cht4m33@J9rGV}scg^A;B|IKRO0l-1Ryy74mVubFDK&Y_km08*wh2co}R+h zNKv?|q_dvJRqz|*YRU!muC~IRip&8F3POZyy!o`Ar9Rn2U9&8%rr`m4RXIH%5y}G- zIxF3WzrYuulux|#c#BzkB-lo4@Ebk^+?B{fSyw*^QCGm|SquX1Sp4GhZDg=e6Y)Gw zsLSwVhR5Y(s^f*a56=^XdKgcxb;To3#KLsIn6a4X1mdlkB5*o|Vd3Ad!pNbT6%BfFo% zoFosYNPV(7f`3JADLkR{>pyB{h2<2ljm zXp>rlGt72552@fvtNX%M`x~q8hOItBvQUaio9Ezb#)<=%)S8ueI=`L@SXKC~eqgLP zu+4Mu24kfT4)&xnmr7~WvzHOYdG@QHsS0zd+IB6QgVUdVx@f*{)2TIA!7blM%7EQ+ z*xAybme1C5Sfm_lm*)>ox%;zKn&C-8Ce=~7Z}=KqfptHgRHe!!yZ~nB7fpKV*8E~-TB{ix$a@NI?kYdWRYd=nw-*rQA96s`Y;gYTFN96ZJ4Lm@|-ap^_1 zs5 z)OHo9Q$*qhP^Sv@9Z+2Ejz{>hjQyh33(0Fds&bn|yYAP#$W*cyRX8&n9RzgccsinK zVUd07*t$V$%`1&BTU8g)$wVXUbP)W_>sLkWS#cZ({F*{iSTiQ&!^*+6USU59R%hTB zmxQViss>Mr#6{!!OrcidsmXgCsL{fE(DA1DRercJgjaSry=0@;f)v;vtxE2*l&6x@ z0Vg8T7X_4bv?wKDr$vcbr$x!N)#jSqHSeOE*AzbPDSI#}Kh;k{11^U~|FJfQJDq$= z7E{@@A^!rY-nJvV3<1p8ii0!s{i%I9;GJb%Sl&p>uI^R4L_E@bs+5b47-H@J%ngu* z!;?7@S$|j;UM{7V_e0PYuA5ZHicGRr?(L)#%0%s3&<2peNc0u4wUp>Fq`TY)3nCJHU zjtXRu@TouYiMSg{V8nsuZ!{D$CJeBL0^9!#!^i4`I4Q#!ZDZxa(Pe1GI{u0nbdf+; zz^bDaZ5cAs{I|jXf%uGb3SBH*=xrrrNZDk3S?H#A8M@`)>%v4PSvzxZa^NhRc#s z3hdoes)AqCI$u2g(G28tP5Y0w;GfC%Xy!z9&l_go{#A7honYwR0iJ1_`xKYg!UZ7D6tKa)#3qKD)9tItw;XAuxs>JIS6OsJU&yC+;i6+5 z%cjboUcRp5P%yhFg4(ca&F|nhev9)rEGfx31+l2U{5d-H)sJd5Q;&F=uu|56yv8Z( zbHla>s?~254?DgKNEg!n5Oki~1!$Ge3!C2Fus<(6^L^lSyCgV@7E72Mj=H|O{9i@4 z@rYEPhPhU4+X8iL{fuK9WinZw#QOnowh})aV@nT&nuMng_Sb^a4vMXU^0=m=y*?)Z z+OMApN|#1wI36z`)BgV+P-Dd9M?fWnVwoQ+)Sp15g?bBAwNShW;w+(dfl@!tL7h_f zW`R=oE(fKuSA$a7n?b4U9iUY9C!kbzJt&psMP(}SIw+Os1f>#O-a1=Ca5$)xP{)B{ zHy)R@aP8n1fmbWMrJ%+Mb(@p857cYtz{3+_`;8cSXxp}3Z)8!_ z_E%WBPB}PNcnenA+OTu^P=J_TY7uAi#6?8(#kduQgJd~JybgrS_WfOMP5TU7mf3$$ zZF}V)R3L2`(9&n2rO3WiR2qv~S3%anJdYQEjpoEQ3=GSqVC8i=H+3$x4M9++U4}Xn z3)^v|=Z)CD0JrQ`TlwsP;S2|m*y6`~OT}fIewiVGw9A~4+U4>vRlaHY&pJ+#Ntr#E z+9s60#b1d~*l~t!*m1>T4+yf{R^g}D+GxwgdZ2ZS<#w3ZUhH^Z2c`9mgYomkc8jA} z=FS)1CwQtW8RWLsk9$F>>{?JN`x{Uy@fs+V_{iak(dH;F0ZMT^sZnvGL8*K7pwy3x zLFLt`;8fuSx#5pD2-q|(YP}YLHEU@Hf)ooD)L#l83uX4qY|Uj`2QaZ7A+=>CaP0Zr zAk{1HoQ6$9VYf1J>M$nM=$o*Wmbh2!%}J8g{!Qz~P2R08o%TsGE!#l4)T897O zJh#ZaTlnl^m^T?42ytBsV-GhNzqqv17YKC`o|@8^g3^?}8q|eid$Y6s5vabx`#qkT z54#-I6S=AF9>+671?O5jY$`V$?n;18v^{WnS8$Gb7jlS|&b}o5& zyN`-mOW_N*2$3n9vrJFV485H)xy|iu#qjff92{^D8LP7o@%-puZO5EAFkCFUVIMfG zTTy9e4i4v*(-%>jM#Iu(L@?{vf_3~HkHXe$!~&Pe`KvC|y>o>oj(=4A2>5n0mX=MF zFT2Mjw+RIkD)k!g)AmA*$YTHCr|WcPxZaiyBuM3U$aP%TW#G7?W#O1ZuX>7k<+fc} zFGO=+{lSzWSSLHb+7H}H{QQG2cGe}rTa4#)p;!#Y3$+Q)2|^7;X0Y(a zBfJP>oKWLH)d|HLVRb;k4k@#LfL@jemX?=V*Cr^cP0BJ~8Gd*avpaKG!lPsBfW7%Roborc(0ltV^%7kTxH z`EPljh(C3hg!z=(9~hcm_{F09V8q3+!?x}FJMR;ulDQ%|h)wAp{?FxIcNhO;;R$D&8UuYEyXuwdix zy(7kp2-ApWZ}H3j`G`KmqLiii^LdBdtlI4UkJy3NK< zrz+&mtsx92zSgKay!F}|<#6(8jdEJ_pD;D1REf1lIsD%5aYzjbxzl6;_-~FK4jmxO zVUsoLZ7vk%4+G&LI(U>T^%-zjoOK3%LA_J-1}#e+2M~H*odjrZ>%Huubfvy zF?}HrW(iMr$vi9Al_H5zk}$Ah6fjk;fP(6rI-aE((EZeNNsU&dQxDayQq_a&=QY&h z*u3WXOQBIJXS1sI$p1s$yTC_PUHjv6m;n+9PEb@-)QN(EFESxO@R21nV>O_K@R0n! z-?h&)-rwhQH_XX8Yp=B*Yp=cc+K;n$&;8jfPZbw8%UWS#_sHKp5Y^hE zBD-1aGf~|*`&d*JF*muUwnEF!PVb3>)}Bq3{FIlRjH-g*zONpqqRReSwIjI3S6*H| z_l~=2;&+uVs!0z>Hj6@>HC7g_y`kwxmwGo#r=^p7OVtUb?u;^a*%PdiVHXQ%t&P%D zg84i=az6G)rv+)BQK|xzt-x~ZX?e|}xwEV7uqqc-FRTCxn^sd;607qj(|wpul^C^; z+OO=%JsJY=nQxt%YZHfx>Fgb%k>uC z>F^($0UhHl&47;PZAAuj6i0OibR48C%YcsN?K2tBQFK4efNm)0R%bwWG3dB>#cnA;BTLXYLoUx$9j212H`Q@85z(~&iF#u z<9dr1O}DQ$1G*8QGc%y0{C<%E9owt64Ctr_?_@wnxqO-d9ovn*r{Ljoy~%|^4atCx z@m`Pt9fu%SW|@4pIO^1ymwcVwd1?w9Ya#u3fXS@2)-kIJZEYQ(M>_*&kiW$*;JW}%wmRzk zq}2iy;K?36AbaE#j!^)0LYD;}=1TL`s!xI(%16`Q<7w~rq`g0t_Wn@XJLVQVDOsBK zUXk|x&9wI?)86k*d%rL3y*};z>uK*R)81F5y?-U`eL>p${b}zHr@enG?fu(n?+t11 zX4-pA+WTW^@0jxP$n%l3_pheC-;wtIK-&A$Y46L^-j}7leu9o5B_z;Ic%Cm1%2HYYP3{sHCAbDWFA)eeQC1T*-}8Xj zDrmmdc#ajQ4bLKhw&Qt)K>P5#TA(gGb%C-pwakR{0h%nhk$|ohh*O?r0!0B$73d~F z(*?Q%&S`7#-0B~)9?ht4@Ae0(#`v9Rl0CfR^ zqycf89@->8Ljj>R0W=a2>Ls8eK+sq~+^oMspql`pRRHb|K&an{h91N4+Y+W|cz&^|!l6{ri)_XWzr81{z(4F&WQfq389zX`-C z{+|oPBZ6KO=q5nF63F^M9rFhjOE?R|kLIn<%0p^)MXjXy)YL`jj@dP#s>LCEzg{sn z9;%#&V+ufySt`rFYB8|5hzOte0qgBB9Ef(9$J~s}_W;J6^0QLYr2ui3-i1UAYi9Qu(Yo#mdE1Aql+~Jd;;b zTV1_)31gVQcu6RJ2jXBdpxSv>DPN0w8aD8gW{y?s!R=sID>CxxVCEcoP|*2#UUPN;ZBGz%?lSBh4AHR zPjpSq>;)CJ=G9i+Rke623R+cCDJvW26fD9>RY$7{u_#^m#b}+X;!4F;bKt2=3Z=?J zmwZabIuU{+1voC&^6g-Jtjds-2fT0WcLe^Rksp&}T z*Ft!b_IID3dv9vZpQbmR&ZHGTJx8<#we`Nc(^Dhzh*USWmC z!^MdWzeYUWu@U<&P$$?47p*Heq499#0_)d^r&~2Ec85B_PPis0tk8J4I6PA)Ad=#{ zm-O$iPOuZMaK5k!jfd-G;ksCSeZH-G9(!J$V5hjkf)^SO*D1nfm-5o{>*DGJJH@4x zLufo)G-K7V3k>!@_nv%6onWW9lyV4-hwD_~VjAeK8~U4#>I6H*rIbTxJY1)NHWk;` z3m*-u6YLb1QVyZEcq#Av7K?PUxg|$84wmFxHue9S8xOHExe-Z=-DnVr5i%y;bP57)vp`B zw{!P7E-s}TLgV2&SGbs8y8Hh6TW2#tp;Pq_G` z8?f%Kx;z(`(hZ^UaGeL*RLk~@V^`mGo{LL0975yaVh@l?Vg8b9j-T)1QVoaDc({fO zm)#z2e(Jo=;Vv$v8$#pZ8X;V)cXWRkea3(hDXuZ9-4GfN7blkd8u4`BYdC%R1uib7 z8$#pZx)8K}%`UGWKJw=g7rMBVZU~KsYou`5t<9eKAO3Zui%aQ-(0I5w+)Zh3@`Vro zG|I)LbVF!7To(zKUB8}xZs6RDTwF>wgvP_g_A}LDzc>B|?_KQTQo12D9rzh&UzzxH;iWDvr5i%y;krz?C|kN6#b4B4=HgPiAv7MY(V$J$ z<*92g{ln-Kmvvj7(0I70Gk%SAobK5-pVISPTuL{D#=}K?sy!UA@Zou37njlvq497L z@7GxRbWb+sZ7*x>1ULMZKRs6H;!?UH zG#)PEadxusV2UBW?xL|SE~Ohn7bDq5Z zau=7<4WaRHT_Id&SX?W%Zh83%7njlvq498CDO{&mT#p?qZM)LNrF27RJX}`^mtD%G z6V`t9Di@d14WW^6FG#_$A2rr=9{>+HpS|99}8~@p1T6RzDV#lIj58+ZY+vvM@kw> zPc8gALEeEG5C; z3>i?GC@(70)=q91az?B>Svp~T?LOQ!P!!d0oe%!hAI=Rv^eGY-)z(HwwL}|lEY?-_ ztj|cIt&>GW(fZ@LOU{a!2V?bnJMpy!K03jfH2avZQth+)y+M9)yYfePH9PBfLkh)b6WWk}Z7DLoE+pTx%v#HDciC(P ze1#6=e5Yg`{*by6$DD}|iEv>AF0DcIINk8J;+9CiVlCPj)gaB_(xK7D94vMwb$vC5 z!m&|J*1;StB~vw9w$3*@k;H97Bj(QJM`!AF?@{UfHw-g3C)>~TPYKn%ON4H=>B)U( z*6ra-#9uPpFq1k6B4*R%#vx|Jf5Q+ceYf8*Hxq4WJ9NcpG%o3Dn4js%4j?x~%v}Jq zt-AS^p8WVsU3<+iKhTqZIdfv;l_Tp~kwBg474dq!44`x%0 zxeYfCfNBcgKq`6iqY&=%Y`8I}Vd)@qQ*vK!!{n2MDJV@uNhmnDBsVy?U$nJE#thc! zAUHG1Ix}M`M02XBM+KfrQD(|vT{Cs-lig~baaq0MzNtPv_(XH!?jZ?%Xe3cNEP~5C zB8l0h_8*X`e(A_h;+LPx~3##>BNb$@Z*>wugrlC1!4l24857nQxTg z9EU{hzOvv8ugBPAbe1M&u8zU4)a(XX8_14CwboK?W7On}u|2AFMNQ+m7#M>ul;JzG zcS_CO;5Y^v9AU+f&~TKQ#{j)sro9%^j^Ue3&>kq$_C`USC~E@w;WG0rM9>M3cR><0 z4%Crw~ESd`AV_`F11RE&+3}ibf6w8q^^9aJ&gf_QK`-pc?247gV zuT*;ze`h@p((N&A7Z~@0=txXERHnTHpSDu%a5TYOG{;aktqQiaO#2K1iJ_WV@-)mp zA|YjFJ8_1&9xWRZ{ZyIxD%lM4jhOZtFSUbjW1*?FlqQTv%}!M3h_+p?`+&uutD3FX zz0WsQG-%Lr(WrMqae~2z&%xm$(L~v9^KSHCP#P$f3B@vJ4~Mc=dk%PU+aGAmVA|o~ zIQ8;BIR$M`CiAafqt!w8*3hq=k(z?$v?*O`3i@_=x2K?KgV3JX@yF#;Qd7|L9U6P$ z+BP-&!3UEvvGzwjR{QMg26S~1)`NOYLpPh|RNYI3=&(5Y< z7+QE<87iBvr+JL^2`trFZ1~gbClrpgY12_+Qf9-gHBs9j#g2IAI8FyQhsSx_R&P23 z7Emhj1;=Hcb2WPpyS5q&PZhoaORzvn>o`;E7bi@IWxIBW`?WdQjEhQO6^<0h%83P^ z=+8gI`W^2ze~S_MFqHJIR%!ReyI7%KGL$xMTnEiBEIKHnwO?BeRPieAc09R4&XsOD zhF5%o{o2=BG(sqJJ?`@m?or|$z}Jq^f?4=zopeP9ZQePCkf1Kq1*t!3AZy%CrJ zag(5(@w_icd#^})pO^OT4vR2j8iHTu`(Dy_L(Hq4jZF%3L-Ur*;qrM6S4iji)NTNK zmxHX(lfc2(#Ajny1QxEj=1vbRbI-4=t_iV{FJ2TME0@1aX8mib+o0V=m+Cf1O~>lz*Ft!*!p5$@r!>`V3hb4(ZI zbWY2B<YXyuamet-`+b`;(@Ce?NH>_kazcl?A^yX>Bd z=&f5#bz|hA`zn6cT+%dsN`xP1rA;w8=>Ogflg*a#1e5Ax7go;6xQ`t_Zd|I5RZFmb zw6UDLr*m6)3e)rX59wpWV?Av@$F@9M+U=x|4HtQ)gt(ABy*D~fXllXRzQMr`Q_UQC zf|HN)dDe^D30*vq}8#QM=Whk$a7CVo)WxjY=TZVt8qk+%mmt z;oDX?s%K(h(*5Zh-~4^5XL?R>?w;vCEsW}!sPc5}6aVXrRL}IXLZWA~hbDG^rUo=_ zu2j!N^`uJ;XuhNn)_}(L-@W*%L~1~DqeElIwaLQJJn?I8uGBdi+Z-C3Yqy2T?!l#c zCTR|_3yx%|b2RLJkFlgy7b(NkIT~Dlr%T-mDS-gP9^A{NdL~le$p@S|M}tr?A8?eO zUmK1mb)xuqY*kX1e$O z>>(H7341T;AZ)@<0jPnS$anhm(u&#km-SW$gwKQRaiCzTYbt8zEiRvPU%bMD?}6}s z$gOx6FI<>5Y(#RfW42~t`RpZg3zY%M55wK5;%CRw@hZd8?ZuCdPvBJpi_=X?-61LO zbj!Gh99uLY)k9J>acm8G$nypI-|Qj1w=b~Cdw|;La;k^S_jCoUcHaQq0;`2*j#SU* zHhk3i(n-)9vFP}Rbm?CWLlnM~_;9)2MvYW{9{J;Tq#Ipm&$PIG(qLE5Qh%g-b@98J zFK9GdeFhI+tNVClfJbcoZ1@VWa^9_R=5yVYiLbt^JAO{^x5keL@e5};zhZ>1lLubs zV_VtEI-x(jMuSXn@H?LS$R%`Sorhye)mgu(ld$x=?Q`iS1S{D#lDBM#n z0r6O>;PqU?kXH{!M}O;BQ#tgCIl%PVthFJ;PrE!I+x}^52Yi)ya!47Fo0Vxv2V|=~ z#~T5;W0GxL!1oJ0&lZS10QUj~eCzP!#FW(=-f*MSA6i#+tNg{R1(xu7S!tRmbF5gn zV3L@KAreF$o*{vj&hd?&S8>niT2*CLMS~9=#E1q`K}YQ1f$?*ni;5Xf`kT$~HzAS&*yURXJ|GG0FC{)#2ISJ5+F=}?`x-(g(kau=Yh zi&VD{$;F^9tn3L8WO+G`CMm}-aCRJK_<$vI3(DutnQM1Ap?uYy$Wy`UY2U0jreMt2 zRF6X~fZY!3#x``^Myh!B^7x00$vpiCuIq+EbJZW$f{A0@keRR|UKQqP*8E%ZZb$B4sSko1& zUzZiZ!Y$U@0&?KCIyy0uAnLS8Vpbqx-WG_~w`A2H4K7WVnjHogv$-%4Zqgg4bk`s5 z7ku~*NFz3PTTFYy>V8V+=6p4#Z4R%;X_MhCSL@w-bSzd6?~Zl9mfW2SxKzP=u-NIm zWw&AZHbpiR@C-%vZf^D_F7|r(B4)EfWVc1anFYy}qT(NL)EQ zVlMOPi3f%UC^~bQ#D~Q=iBLC>8s?EPvwV>;ivkVjG%VN5?Oazak=5GU{1LOgVM?H( zs&B;HC-{EJ_Mr_^`ip#*bp@9`%A&+-Z>LCkD^h{j4f9Ps5g2Y7UC5!16Ndx3xz04) zIn^6Wy6e08Exj4Xt&Ty_A^OR5{;Rupn{5(zceMNUhAMeZ z;gd_iLmNtL5UCcwd*pdTcf{P2nAz14jgZa}D5aS$$+wfA42?9L(lAMDxUNsbbbqAb zmO!LoQr}3!b^Xl!9T%YtBIXVd)M#qic~T!PJ5TpFTo-7#tFKDlBoWPZ5Y4(G&pKXs zOZy-X*b@Eqm{CjuI+&n*cuIiG_)JpM)KB1v|ZX!-G4?T_}g6(^PS|U!IH*d z<$y@iime2O|4V_qwYs)b*Nzy$-y*ATCO>chUteFL+*x?6&)Dv(UGrGD=<5&y7X zM$ESb8UkpWKmkDX^#^_#KIqx~(o24Zh5tr|W`r}#Q6!vEmLlPt9{E8H$gMwqdvMk5 z%v5Xrhs@L(h*h8=fZh}+0EoW+z?zu0e+^4&{-b8gp>2`8ZDuP=Kzm0!r28izJCGq% zk>zt6Ad<8oKq;SA6ppSPQ022N`3cMCNeJ%HHqxLZLB{gw(zQ-iJ}t>lSU&KT$lgXW zpb{(}txM}<*|a40O4(p(I+@$utjb3Z{ucWg-p$psp$LQVwh8TD_9krD66@J%-jy~+ z8y`9bt&Jo!?2kYTwE_DR&}u<9lu|y5v}{)C*_C{6AbhcnWt)Czn~~R|=N&e*{Skkb zo(;v^6&baGB`RBA_6&kr`;F{Zb=(bcXtSQTLpQN^r6uC8K4xgIgT@%OU&oy=$#+jm ze%dFJ{icDo_0SgGd|Od<8F{Z7+BT3FqYfYwxSgy;PwoxsoA(*nord|gBw?FjZq)PM ziTLmRJc<>1Lpx-Q5=AXRDKRtk?_D$T;$h!bnkGtmagL>=k&B1?65f%E1K)lH*9>%9 z`@)dd{fKX;%JVzP4<*lf_R)xWNGcrjq8&!AQL>Ry8(HdxxgR@fkmXO1<=44mhFLyr z?bC~IOkc;)IPBOcA+d`ebIIxC#p|2KYW<_;( z*Ka5HN}i#WVd&+?@SFZ3J^M2#^r+(q6MDEY`5`jf?$@!`NLrXfXkqfU`foa>K};J* zy#un1KqcQh32M+s&)#WnJ+w9NsBRwA^R^)mP;#XIK;9v#MNAfngPT9f-ie~r4vjhj z6iZa^ZVIldL>8&hk?bu{=;V93*zAN&7u086uI@SyZ7=UN%fjzCwD}Nzf5Gnq{1Rw` zIaSQ-7ybpm`|w+eUp0PoG|K|`XG1h76^^r53Sw)nAP({r#1W{1*xM;6B`8Ar5 zG#fv;bJt@5S>?lv94f%SY6wa5mhRbj_g$$WWJqwNv4@b94johB*J$k0-Foh?XQqab zwxOGve^vXV?F}W0M?ICL+;dphb62!80CCt$0a-(rNisMow>~U)VS8e%FVoXTQ8K=% znCmP#{oV1+xUogn2#EVSC`6pAfbypj(zz8yVR}CQ8RMIYi1sb~&QZE4BUBlWSljk{ zrpkq}XRK~;?d9ASO=#Gx1}hksN;MnUPupKi+>XBTCjnc#U&08OB^Vs68;Mz$5eSf# zG$3bDC^O709VW~>)>ldWpPXg!RwK%UntNnp{{ttgM(~zh6a1^H2qD|4^6sg&^tTs? z39I^X0YS_4Iv;?swdkHrG-syz*=ZYwq6-qo3vr3Rn#+r#z0H(C!Djd!h} zvT~zoMkYB~N9Qgth3WbHXJ|8b&IF(y8?6H6Y?Ns8m~q|&f#xrEp<6!1a;l`=IC;rE zZ?@K}ZSCd<*rnN``Rb0W0F}N*o-gwm36}2E>khM5dWDad_|StB*P~Jdr@X#uOYo5^ zkq!(b>yKmwzk`dST1v59y#9EoIQUpgan{@M{A}SaD>s_^S@1z$a4_zT0bjg?_~H;f^5Id8ow(8b`s2m%OU0v@9#iR243DX>o8v>o z<92#f)8lq{R7WPf9$fh?M57-}4vmk*u1|@$3mA-TA{etLhT#f%{OVh?q7#nSehQ9w zCGMBt2GRQW{PA-ExXckF_?yC_NJC*!6c^ieZ>asWbkyre@Uf+1Rd^VW4=ZXIR)oK| z7HJLm3DgHrAA$UUumQdmyYvs&ZmvJ_VDRe+q^4}{TI|R#^>vrdZ8k>j1ip4a7`Np% zYqd9aEGlihNs~d%@#vwq!&{<_SAoSBJh#|q^trAZXU*VDiK<-b1stLsmhZ7gccu3J{{Utcfo_{wkpWnkww^Uk~V zt|<@A*jDlQ>$m@MSj`PhLw@qL{coLI`|7z@yz>6$iC4Xm|AQ-kbHU=@pR}{2vj2@2 z9yt4%-#szO-!-`P;G>^j{b9ege;VC3|C~3o_I>pBifNx5TKR8Fem1u3&WoNrbIaW~ zpBjr__q|QG1&03c;=H}3iF^Owv$O}pl%cg>#;Dk?nd-^X;n_;NI-{H6c+ z<7I#NY}e!ue)OHC1AZL3w{c=Y&X|b}Ipg&Pyy)HQ^!oSv$GTgL35S9!A13Fj_iMMrV60lEtbMC5FglD| z7_j&g=y(B9#c#HvxoG~Q=nVp6Vsl?ZBr^v2@|*RB$RHnjhw+{$;v*US*1sS8i_Bfb z4AD~d%w;wriOOdF*n!+-PI3QpZDy7zPkQ)oRaFk8>Hd2*GY99kJAs94)gPOR z_Fk$Qil@gewryl@#Y8<^{NJjFMLp|b{{MsZ@LH4(>mjejrK5g`UHt#Q9@?u(xTl%* z5Oomsa9OpHsDNGioBsG+Pb2QeKCnY>^y6`T0FUy%cr5LQ$AkSF3|~W;mc&v{vSDT) z%nW6}8fln`wGK>m4$a;aX(+?&|E#{4D#|jlH$)n0@zvE{%o@ENX;=nR>u_?<&`9=v zu5OealPXV(&@lgiYvfq#FLK$RvAJ)cMxKglKjaEjN8J2p)%aFp!WZ%LSRLPrHkRQl zs{__3wJT9}3>Doh3*eT(j^AThC4O-6uVKDMGcUK{hCZ_H;a4j&*5Zh@Fhg+| zW`(cED#ZUQ^_3byEht~!X8y0#SF4^O3F5rBgpwcO4EFVE3*Z(A?v(qM}R@YDTQG=T+ zWe(btqN%A%PJ_~AZVr;#HY*9M#?>|}6{a_n5jsmx$4v!f_f>`Ew#kTXf;NmV*Q{eb ziF97PeU}r0kB3YynrGXRp}#v`wY#hY-^9nx*Mh z(tO1}+y#`{-NX_ean@ZcPPJyH)zeG3k!GAJEI78O!}|a49QoC>604bz@3yV4w$%v_WwgK9(aBK{8z(jf{(u*};nVTWHRcrJTYt<@J>H~eHC@}7b0I$XAEvM9!p)-JBzNP|Vfycj z0hNvV5MQsCnO)LV>m0ztOn2@rjU9UH+QuR0WAdiBbkyH9 zFnB7F6-i7DB<{tZXilOSGl0!kn#+EM57!}TV@2ZT*P`aErbuGqx`=5ENi1oLnzb)- zoie=52*0jl{Z_+bY|FqhY>>hFZZbJQ2g2N7mi;hdu8)K_D-^yIprZoX=S4;VNMA^a}B&Gs3I;!Q|T zo1x)bB*3*_-&+sTho{Ho|WvTe7Tx-$20F3bDz+=kn&FhKTkFQZT?!;U!!9V&xUVF(4yx z%dt{()^0=VnACXX(7INJXPBFe@a{7611vcs@5$C|BaHQ1?2amXRNII&4&bo}NE%|) zvpe;0mrBzuyCaRm&WPb_dUF=y#%JeED!8LYcq=|D-$&twKf|6JUt-c*rjZ5lX*)zd zP1!omk2tgyOVJcacx}XAHYAzsFK0|78H%24MGihQ!bedg153?)WZn&=9^SxD+|8q8 z*ESp3YmG1#`dbD_Jh$w_&Jpu1b5>Upao|vjy0r|=d^Hk25YaY;n@JT(-1WYpeH1Yl zeGVDx$tIN8+CiAMJhUZ(Rel_A5Z>vpZ9>imYTJ~|QDA0s_|;@f(7?VF?L+EG1aqv~ zn-TNXLtC`tk?ft}0|-f_qEmZEQjvpf4AS0Ia)$1Nn<3*!_=uwV*qntzep|=ZfaKZ% z$<`pw>o~L}8wqUl@KgWL$M%_eaR$}-sY6iej|LC%DY}A<#TfucF9DvHcB|z)Zg0bki8k@ zYJ`&!|E#QJ6Has3Un7{c!v?*6VX1^ z8w)3>@<0x=AxcmghzzlY4|5q_dtKC(ipq@{hZ$Jjet+2}RB*r%ZGBzx>H8kKnex_9 zfw{TC$ljxe_hYE?Vnq8$Z@hA_Dy?KIMBmDa6fxgrsZgj=ES*qPr&J8H6SW1B%!3+t zvCJBW`RdlHNLmIY*Y=C>XcTyM>UrBE{+aud%_reyaw8_tRbn8@h_=)0JhUmh3p?@r zv)Z8GeJPw|Q;wzdW|y=Ln;=U)+=SCOa-o4)hPK-(P;SQvW0MK?X}l`Hr-t^XUf0TW zAg@$IZYVL~xzory5=kuTG}ufu^&>(%pw~4^lC@5hqJd^CyjI8lDOAivEza&Z7}4IY zYZ<<|?AByUwsxF_!@3C?G0tfXDIQyBx6ASb98M#l!FZ};>hcgLfYi7-N%Zg zb)tw!Xucgro!ykz5=NJEq@?l6(>&#q!`2u3XjJ+5v12mXl;tTLR7GadY>9+l$Ig@R z>!pc`)rR(7Nn_zTkgG}zWqMr7L<-2r+rT=4azyP(HV09Iu27@~T2K@q_VcK6)=`!B`6!qne_57x6M0%2GN8?9SO9Zi}ECp=u~5 zz^PKA7C_5B%tLZMOw2;Fz8wPY4*{!$w2E}4Q)K&S@m?$cj=B+6E&VS2CcGXJ3xoacC(WTZ<^dVJPQRODcXj}&_zfagmiWKXTAt?!O}~~ zR1@|<=PN-9*DR@8%c%;cfXI77-0g~yID#_jqbSiS zOBwA^Wu#0&OY|&eWDH&JYpRTl?A_>UnhdR7DpVIvUqUf8tAwjgiCsDDENCARwF&l& z6qTfjIYX;}E`*yasr3hFvoxdcgn`3?QqtKY{V$HwLc_J*u1+eBbqInz2kO%%DJYck zkYsbeNO(6Zlt@Q9B-u)v{U)k+Vj1XuIyD%?YfnNk!L)IglX(=o2D5h|h(rZC#J%W9 z#&}98Cz!!EZ41DitEnz0Qq{3^_@NMlYPbSSPOLWWR8vNu0( zH_GTm5zQtXs#a9j`quBx`Z_DBhP|pyup73c&yp^^1I^x0h?r^s-D9UO&GdE_br;HK zNF>}ev2jSg(v)QDK-yZ(1I(@n8&`Y>(B?1e(%Skm1}Mq^WrCPVcG2rmL}+>k0cHV7 zBA~Jd*p<+hhrO^%HFkFKKt<6ev`8($s{Wy^2KHY1jeY1<3~jBYBp6Udw9V2)v5i9q ziYJ;6tB52TRz|5shPhi0x1n+7hym)-7jIS(2_Y*sw(X)}MJtbC&nCzP!?X@=7O!h+ zzh}|?kO!)xlno3(Sg=MO>|3aKct7ei>`O(&Ds}_{fPD$$Q_q8~D<-IR80Dm-BULGg zMiBc%Bivs4q2I_&w)6#znxtr0rMcNT{0{pjoI$n>oy!rnd5k963gb$Z(1A#}8HSm^ z_C){@?Lb|#5Hw|@m16;+3T?pFSw6MH+J?HdDtwgCT7>bQxdT?Zln@Nefq_lX@wo&)9CJN~so|!9is$sRDp$%2Hy>i&BF5l|(}Y zAfj!wQ_XQubB{8@n2N@ktBep5HrZNr$v+FjNVGDW8ViTkwK%1Ofm~B0ygd&Uf$i>U znlgoGA}n=iK}!X@3KkCtnj(3fP?=m+mx`>SYROW=4-+P*RhP6KVs5623ZsGdV8?Wd z9aE8&Y|iF5e;ryP5nwAv0ui$_+?BV9!)$gGc9m9Ap(WEQEkEiif-}J;zr?{pYCx}ZWcl@(fL)%fQ55rPDqpn5L0-eJ!9Vb0voR`PZUSd`! z?6Sr}F|lm@=Kv>rKYCyc3?O%86{FzrW;9e9N{|7`0KF4cHryme z?m85BQhF!M4|Pyvs6;RxX&iE<;?JlUG%z_4q`|bP-OeCoG_PmFc-*Zjpe+VgJ@9T~ zXGbGbP0Oss${-9{n*K*&vav#-f;J8-Qe}zx9f<`~UYGW%1G}zo@BnZ4$EA{E$OX+abB$bPp`=l;O)@Z3 z31B;-Y-SM@8*RyQxYKUcXrU!rav)Pg3cKZP4znfOq+!=UPF40)g79HfE2t+(+c-$( z+z5(~S%QTvGYk8nh!|K(ImmoRHWVjmU`oucLnui$efXe)vkXZo9WhnH{OSTtl#-L^ z1mrP<-9$IX%tw$iDD(k*oIsV{8s@_Cqq_D-^vDDKWeu!1nEUe2%reY%`k^=G?Dq2a`<$MXg|3Z`d{7Q;s?7ec*}7S!PLAVsegIl9QO6YnJ5NbLrglGHdOX zi0mBv0&;zz%GrDe_aGooZgEV)3gGN%bF4wc%uP}ARaxaQI)j6a_wjoJzjgTi8mk;+ z4~{aPYc*cvGDoy=*>mCl9%rBSSTiQ`utevQj&bc3FM@_YRyR=!bEbSFAEl#6Uk;nuVE zK9V|T=O(hiW%=y57Al0gmrCQ38*_TfNk5;j&e@^2eJ(-joE`4ArsMLkU*iHCxgNP` zWohc1ou30kH^7POA%(Ec*|A>ak6KLaxswn_oAMKW$Mx~`JnWR7mpc?(UhZWv*;?vN zk^L5+wGI-r%r2kJb8oC=YkQvtw{<93J?--Y3JSvG z)ZQzuSw|)Rd#*s0qi(>ttD3^}eEvgra)if(!>*`CBRw;q1@$=!$+kw;dM6aP$$VT4 zJRdE`Ioz%QN5xTeW7*g`?mmR~HPA?-1uPpIYwg%`2pg63VMJDFeWJnUNzsiRG&bG&=pMZtopNAh=ZoVqD#eF;MrTlY(55> zAEwid^KOM>+w=?2tV^dGTQm+{j$?SQgJyR+-Izj;Tm~UQAA#nO)#ydFK|M` zjvv5_Pxtxi@S{uRBfr3{2)QVz1ZbYI+RI|lTJrPUGqDu-v#?_S7+3A#*qkZ4!Xmc- z8SfgmEP_vE(@_zKYMO{XjJ9)(nghyugWDUD!g z9)0!%*bcw`7x;Xg_|Z9ffM#HbRT3u$8tNEA>Hu|=-8k2b6Ycb?@doh zH#h@2_ItxJpkuurl>yx_&_y$#I}>#CGN3~>_btzWj^(i;13K=@{6+?J4DY!N==y{1 zKQf@B9<0uQ?hMd1WkAPvVn+sajQ8UV=-57eo&g>8<*ymgu^;RMJJRiX(^G~wq!+r; zh2A}U%ts#RMp?8@ds;Zg)3cIp3}~)MryJ|(2E{%zKvR}Z7si2Fu0)>+_(qGyL1Rx~ zdjAoE=iQ+DhDFPCc+QXF0VDSG0jBe@^Dc&i2Ul&01|vK6F=TwUDz`PgLpX7g!nM-g z^p&mZjt|1=P=c%PDz3d38}m!eapCnA=K)NAWZ6dxa@XLuC6Fm0E0mHDgNd%%6(3|% zF_`HR%snA1ocit|@hU6Cl3bpMe*Cl*YrQ=KfO0H@NC998A$M z%uNvlg+1i~{wMHi1+V^w56bpH^-+$TT|ukl4g3N!V*8UoQ}Em-(Cv6C++sj%;sU-E z4(^+P6y5UNW4R7`Bw-Wdf*b1_B@u_BK|#!> zc9=N+OMO=X%uUh6sf-IVD>&oJAuL1TSkbZoC&j30$u(a`zossDDzlOWb%LVEX(H`+ zqvV*rcAjV?i3{&)zZEc&8Qv9M-#!)aS%^%D1Lm0}=u!ta!-2R@^ez0<;gd?x^>|l8 zeFP8-AmDo%&p!+FV>}gI3!t|J=Q)_it~Zb%?>XZ)7x+fHj5AXBW@aN#N$s*hGCYKY`N9WZqUp2-SGhr; zOgXMLQ{k$zZ~qx^Rz&?IqGy1>y=JIT>*Lc@0{yF+?knp($R|PFF}HU=Z*=`Y>FX$N z_0y(B1ViN*QpR$L#8Tg-#n0pxuId2v0@#3qY)00pIWOR2(eg_XWqnsPerAkiyM(aIV?bC}&%XS;Xdy;UN@% zBW_)4Gyf&oN)I0`8u+ZAo_31}?B!7$#)=cup#CBbpw2>hXC4XvZWr;zQ^*#YyQo>}9+5?5QWZlQIao)DYp-N)I-W6sD)IbKAPR{Q27KSeQ)OQ1 z_zkK#DYmi-g?>HSYIK1Lg?eo+;7$ck%+g=s@V@TetVjJgK_1^x=~Jn_RaR2~$>8W% zm0RK~sdf4*G`S%gwat4~)ADJQ3*-=0wS|;AR&_eD;kL`Xb@<4rS;`r1wA{^D%n>P> zNtsGswZ8V!j#Kql&>D2RLVWNS;ay->q!NlX%iRRcD&{;p=62as{1Lx^?mDI|ORRQ~7QNq?!~yKNeq0OI)YZisW#eVl;tM91`fj5>s=n)Q6jp^mCAF zdJeTbhq^q2PcW@=dhLY>{x1?m#DOF-?C^&IsI>u_E!PXte@|Oq29FN{FBO&Dm8PvA?4ayA{>bNavAK%TFYI%*3YxQSM4Ds{kprd>D{Y zOOG;6r7~ih_|}Y-akQRNn z-0OHM-_HT5`mUjgQ)-+8$fd^6Ed3>*e5r*emvX^3nuz5pzmq^kVabvtE8=&8cW=e6-`j>Rp$oFfDOk2*cYXV+q3uy z%5AYkj=D_gDw-R$SHu!ChI^P|rgXQpg&h~d7OkCT9ad^D1|iH<_`KwMEgd(XoTU1bmx8Q3PtcFU(#TlHAFJfniaeh?-gA>c&tj#Pu^#uu=5uYw?J@!U;{noO= ztDbBEAk{`)4d}1<1$?(SzN|Hy1joKl`F<794+QrZo(Bc`Ii9-&YQl4xKpXH>II71X z!P$+9w{YFH(euIn9jueLqdSn?zk(w;ySrblKhi(=Fi$LqHnMBLIio`!#kV$BcfZRo zc~><zEX32cni$LnAJP9|CAm|anOapregaphXH(qUZe~CtLh#(mKea`6J@I0 z&3>=o)z|)n3LwksjDjocfzVs=faj8QPj>E-pfG(JXEH&OjrI@_IxLmo%9((qgoKb^ zlcE>Ilct_c&Xd%kb)%3c^y@Im*!Ue@Ls96f`{kx;HPZbEB^@>QIdnTj1a`eo7+pB9 zHMnv#vcvdSHIp3KY^MbV*`%`eJP<04rAQBwSG%aykfRuSCT#?g_PG;f?@3#JGe&QX zWxHW=NRmVn$kwEU@i}hj4X)gaXppAb0;FemM>d}OXx5#xrXN$Xnk8*#!))ouf!Loz zE<|{u-FGO>w{8iA@NihML?WXIB@wAkPzgIAES@9R$|O*AzK|aWVWrwUVACM7@7e9C z*AQke)4m&tz{s_30-KEBD#qA5^`oTzC8(isPSH};_QC^ZTZ~5t?@!4_3=aCAgMxM^ zR7x-a0F4)kxERo?E1^#+-zs6o~SXg^F-Hb@7Bj=eUAy zxC|WD;8Emt4ntt`zRXdKs2by-q2`nXZhLj6B!a6hhGdNJ`=#cEwh<0{5@O=igq{4A zVGv<({AEEvvYcfIuH+(u!tjml4Tr6XnMgc8OmetCfe&rkHM=FtG|9`XB#?2Vc%KR^ z62gYTH84i;OLlgwp{A&zFj_-Ai?(HIM=dV49?D$UVcCfZce|7G zeOGc`VH0SRw;#eurnWre?~5!s=8cd08_^E8BXLLZV?@#Mj1$z;ocS?#L=#IlEBW z>z+wk{RQffxkpHpT-%>UWr21X;lD)fgi4;RwqJuH>ymO|Vg>jF9HnO5t^7MY^(xz? z{EsvV^#dIE>{z2}6qknWmX85GDmBG=&l2#ET@Hz??Zq#iSNUX?~ee@6kIEyZh;1~z9Ws88w8|sw9vu* z3m_WU0pH_*{v;g#21v=J$-!*`q-GBH08-OVp8@J4yeFY=Kq5nD{&L{?a?*mfO=m4}^I6eckN1y>{@D=YRfK+%B z9NZ*8?+V>5fK(`R0I5*!1f)WF#G(5)hweQXsRUFBi1E0`Lhi9nXUb2mu~A7ED|cfoku6D7 zrp~#T|A->(;Vt%;=yoj*VB28Fh~6sjGYH*o9#%{9Tfa^ceI`6q88OkSe%ua7B|2S_ zFwLTgyN9Ar$3^0>XkqyDYR@jeir4)5>X#ksSBrT940D{RV9XJe71KaG#YSSj2DCn) zvRC^7V35n z{r3pVCt?k*Vk6XJ6v(k0yKB}Y7^L>_vA{cg46aJTzXx;FEa8l8aOJ;~TTKUYxPr?V z)Uc3#-+>?YyW)cPc1aU)4Zz8e(MB!55B6=f-uT4u+tI-4zeiGiG6=6f(r0NH`N2r@ z55jKZ^NfA`0P)oXj#3J@!>qs-RZJO8Y{Z^xiOZ-??(Sol7qn8^J`-O*XLXzbv*6Td zYe|SGJ9%Oy*e?;Y3#Gyt8;nyeYn?59KLi@Uol~|R-3&;LOUnVN_H%{f`z=7K{batC z?|%VOeFNvtQhh^z2{{)}g}W8dE>PgkCNAOmIKP(mUe zS<O+T@jJy5zX_K3uK4ZI#6Ss2%^O@3O-%RF zThj(b9hcY@F}%y&hI|t-*;TRQ99T~wARuy;P);2zpNc8URo$30b4`++4%}@E8~Ygk$x~LcaJ# zDH43Q<4|!#U)nfAQlWzD7}-1J#XTrviJ7_59$M$aBIWoZ)((2*5d;d7p{3@$;i2A1 zxa@~C23P)2(Vl?pMddrP_duw_h$p`{-}t@oDeBb+Q(-fUd-aLHC)%seMXo}q9a@$! zF#ozkT@&YwapHYbgZz=6W@9`Os^|T1fnii3$z^1Y@vG^ z5T~>PK8i}=eg)`0!BM}-74WUa^8tZg$5YX<5r0T<@8kKPK%8S-B~Uk>10;^q@l-fo zPoQvD18NYun1f@3ln~qk2X{Z9M+CRZ!EyfS8-n|ugQHRVgy7hYt2o*Kv4ITuwmLY@ zDoqods!g6lcTkr~%~qXrps(X(jLy*&xj3+;yW{<|u*2(>>4D^|hmDfv+cPJ@mFyZ( z27jZ)v&9>H8MFV^-M$@D=i*zg6k^umzX8k z62}QYDghnAo>Zr&p_BpB;fH7-zV@{kJdQ$|RZCC;=vn*%zA1Pf6lgx4KM<(O!Lddu zj^_aV7{7q;c{~*d>;FLLF6t7XZ;S6+cs?f(>%XEq4CtqVN36Z62T(#Fvv=%J%_4rGk6hq5D@re-d01p#K!84Upn^8<0u?r&ks3 zARv_j&Y`~|96>-Y3v?zRDrdlV9w61;T>&TuTmiXZ{FmZ86}Y58Hvv*1&jqAnt>XJ@$M^SuRCuip&TFXQ9Q>8EMy*vlbF->pm`JlG z%U!d8JFFo_7h=(08ic11vnAj-7#y9}V8osbNuOS%odYtM-7;p`v1TZPTHQYvRm!Ti zG%kJ(ESEYlecl}}(Ho2XnAcufYMW+UiMFiBQEThh9>*nkwpab`{$%7dcz?aSEn*r0 z%)H+>xMQBff-nDo0 znLc~n$lh8I^Gx-_L{FRah8(M9aCR@&_PXQqV~L;$N}1?JEZwA6!?N0|I|^(Q-EE*# z7`9rxEYo5SA?ZEGMi^sYFo*T3#xg9T*sX8;B5tU<9>cXRPUwZA=0`A%?C_{&oMOSP zeZGzddyD;>Jz}TOp}o7Qy-u}|ghBmITsQteHd|qJuGN<*YgeCuyQdzeuN{9{U}}D{ zA1FkMXyqROGpYviX|q^Ws1K@;O>`rPu%MxqY_-fUm;wT?%NE;2ywJ`ThjZdxA^iskD+N_(_60 zgeSXzfNunzijK39s@5z9v`y$Zuu#yy13D_WO%B90H-+P3g9>E~AQc;k#Zk%u3;w_M z=N4pGlkYfh6Ns(yY=J^}4i;!6oXqhe!t-*0+VH$eAZk&uK-=-0B+#_!y6<{i zE{x0NLx4lpE$;9WcM6`+ga4CG6|bFj_GJH86@3AOpcI`WTurV(UnEcn&wsR{S0j!R ziS2Kz{0Y?i(y7y@yH%X;wwjNq3Hhcjsk~=)yyDX9D(<^HG;+ke(45Nnr~$r3i|5rY ztgX4+S6w>?7gZbgRxhrqsES|in=0?=G8ac0G{_NU?@ln3A z*)?~0{6kAY81h*``W7viA6BR|M#yyf?1k}AX+_n7_#Kyr^6&MPRaR9ls)fdc3tchb zlU&^4y(CmpS+Q`Q&`q4=@XOj~V=up| zcv8tN3m)(DSf6k7p$c(jiRu(XKgQwGm+<#H_)A-ZZVZ0vMn(l?Ik+4L%5@;N>xyou z0}XQ^_s6_UDOb8uPQ6^lFPSYQl9EP43_c2;Q&S@V9%zHoXoykn+`j5B8!5jw8WAw1 z(RbF}l{zYaghOM0asIRw06qNLQ9QX`cfs9fo|XEN{(BBhNK$~on}z8oT=yZaL4Xeb z>-WA$eM!I0p|Rt-iR5to@$+jx$CHT1w=Eo)`jY-OhsKWUn3ZOhg!Zai~u>$VuTrtLLJ9=+{ohlO*5&PW$eY1mcJ6HI?^Q00|q? zj%$TdKsjFDubpObMUMs^4?0|EEJZtm4%f977q!nD7Y_Gk1aKV0)8#r`oW7=`%>5ci zdX&q(3%XAp>~P)U(AX)w)shc$lYg-^W{AL4|3xhTB3ffj!*o)bG{Kd z-Qh|&GWBBYqCRQ z$F<19&_ecWSMrJ9+HXxh`%H(c#-XvfmLW}aXW{49xX0;SK+iv)f8kjUSG_}Hb6sI! z*lPPVem0#C=m(d?W({+=bce>~dd3nxEqA~6ApBXcW9ZZK?>jU$*RMfCcMg7j zjhpAFe|H}X4mro+T0;W3b9^>ewG|F?gB}ENQMXQAdgiKg9j>J=8l1PWB-N>egv;{w ztsM28y&>Vc3>E~u#D(zmYIq(o8dFEt@boF~<~dxKg%wt41YBhWe;(dc3Xw?P!PzNRiQNqRcmTvo(qLW6YxW+52(0I5mf`@9= zNzu75df`PWt|G-HG#;*th09Limu|o6?u%1g6BL)wc(^!X^=o!(v>>bbl1oxt*3lV4 zPg+b z180SB|GLD49`<)t8?JJ3DcuknPh3|E*C`g)7xRywd9{m6>4wmFxULZ{yM8@B_Imvq z7njlvq497P3m5wn+ZCs{tovk&;pNp0oft>wPrG6F0o}!=bVF!7aZMDilkuc$d$f4h zL>HIR4WaRHO#*Eyt_v^A`Ozd7m(mTPkx;oTP8Y#XwHtQcA~HUq-%b~e((hkd7^4T5 z;c&@jD)^H|asAceD(S&h;&2^v(I~F1R!28kxa?ZF_q-clC&uUNc`6vO>-n&p3g?Nw z_Pd>)D|%qMQzTZ3PFBoart35Dx+MSQX zHQ5ugal_PdPJb{hbSgdldvHzYk*~k>pqZ(HaD`Lrp~38IxjmLi#WlYN*L6K|y3G>~ z8LsePCQd1zyQn%9kd+I&5rT)pIN5YClTu6;%^{BrnPz)jNm3O~yoWUA^uW}6!kHMm zzP!3tjWko?oa)I1@f|(Fk%cjO!70ygsTUV!Xb*|~M~`rp_TYN82hFoRFcqz~>9+=a6l-DUeXddekS4WQ&a;LWKR6@3S%7T7-dtmIAg1(BY zZ;#l&-XmYn_DIjWJut~0n1CmoUd|Ux9m~h$z+DL0sKfg>(@`0(SX6#b#gfYT_xV_Z zr(S1#xqQ-$o5~kd#PiFmdG+zUg359zuQfM}sbODb!Mrq#O(XNcZW0GEscd@rw2HZv z)tt$VRn1?VilKaN{9YgZr&lhhs#wyCXDYqbH8th&#lpb~g&E&+narJDURANwN7VJY zfoyPsSK)3Nn?IpkFP(h-G$GNaPYIXDrpz!V8!p84lV%t*%BRnm7Mn6z$XqdE-ntxf z)Kzhp*q98Nh3?@~Q@NlA4%6ly9K~8r>8oH_qbsZCK`v4Rk;(;_)xJT>L>>GnquAk> zEvcAa9ba-;TD~ihuAT&LDfFap$poGrk>K`1h46^P!P=68dbq?a$Z4ARjO*ut|5_&Pby#Ig!;Dg@vliH4+b6)o4MxvPM;$8(*?e>W(NTYNNt9MZ@+$Xhc&a z#nrRt-sNO)@tiwt9Tcrb%4XM8h0D2s>h|ajS>Ps>gGw0$icjv&RP}7$yvnKtK2@62 zj7hPn-oi{fuyjt9s#o)U(p9qN&UeX8`d}w(&RbbT_0BHQ*mb<7eD0D8EQ?7gf-Zhv zwSp=Bc~V>F+*gGaDOW6Fout)N2j{Mwf^^kKc^5f*Dqsq2HBy35iCw&Kp52<HX|wu*{`qQ1Kpsi{!< zsv2uvqgruKb@`%sX;_?mdmrnSs2^0XfN*8O>~bZwiPsvFW~AP&21~T3NIEpBAMSTn z40jyzE?NjBwr^q052c)f)zd!DwrI@wB1OUTY}JtV$Af*opQv6}sfGog=+8goJlpYO z)p*T{^i=#U#Mm=tjX!BW$oZAy$E#7Ui*6QZmZZ}agjMETbYB6@GwF2WyyxRG-WNc# zE}gC@zeoDEgXS+i=sd@#`WPN(2T!x+-<*6Dj8P+KSNbjj%{A$C;|hD^cRFb9NT>7U z7SqiL_W{s+Bc0BhJfZs$Xx60Dd5c5nUI)#4>2%}AS~*aE81Es_ zx)5lJdeDVE`6V6B#P-cgryK8;-;JQV7c?7t(B*q1a}ns?1I-|7E{~R~(krhXknVKQ z=;?F?<2)G-A%N>Za~IdX;5ZpkoQu1HC#Y!^LEMc4u zUiYLINMu2?(VovE0#4*oSYS=ED;(4J9nigI(WcT@=&5hFgYF~HT$`)-I66}48}G?4 z)Atq7{KBF;QTph;+M-b*+UXnX9)nA{wSlh7qP5ePo?puAG_=cZ*W3A!tY7D3NEgbG z?z{}?hG$53K?Zajd5+AG?$QkD3NoOh8jsI_jwD6~bZjne$bgR3adrlDY;LPEpkwp1 zG()=jUg$=To#5%;PDglOPowi;le>K=kM)U``ZkZ5{xW_6*$eQrKq*3*ROpTH+aAJb zqcl;y5k8Yf$WF#O3(6bycRYkW(pVwh%+=pXV~X(aq%lSK{}J~l@KIJ*|M(0U5Comz zMzk)&q6XIl0wk^(NMIrpL=nVRgb>0~LlVgZK?T7f$~eZlYZt9n+uEwFUGxQPYXZpT zhS<9CTB)rqX{T;xEW@Z;y| zK(63Gp78SyTDlXLc1L+IG0&Ux!hFxizbc|WBoNbbr9h1JM*>a8vreGtHm(8CRf1b$ z<8A|#5Zrw>?nyvb3vP{#+Yaa&!M$PQ_5fNYxK10#72Oqr%LAlo!E0774^)($L9R{6 zz$w?oXN{L_%xyNLKwtcDcTh`)yKq6N#i&4dh;xT%aPD8G!OxLT%a|0JuL3|?#>F-c zKvvGlD~d_96%AW216aR)`J4bh&F2LIv9)SGZ@0L5`k_B#WNG<1`ZEPRl@t9r)H+Z( zCE>5BdsrZr(~SbLoD?@1P)cyq@q9#}20U*OXo-yjkdQV<60(`%(^oZ$_S1{ z=XNX@CQdUjMIh2l6X@$MUZ(Ur5)(7z6yF_!E4Fb=;oX9pZsP!CzemIf8S9` zZnS9(*AOdq*1p5Vd^t+V`8JK=I>*9Lj5}P+m!p(C)}}FBAA*_=3k@zV=F3q^{zNEL zDOnSHla*$UX`Q&3FGnf4#ilWF8OgvIfWyUnIZDY)2i*X>43AZWD1|y)%$K8-JjA9k zahatQjsP7l#-&QhWH`&>qEfOZcA|yhl-%KBT&k2z?~802!*!gMQ_2>ohvG@ZuMb=I zfTNUbwq2=|tmM5du7TaS9Hr#`HjUx>tA*j}O-_(&Nksg7+E1z+rR3__K*2dm$*mUG z;lSnuxndN=f7#jZbvjDPn{1khe1HOhS1b(2!w%PscMdw)Q8<3xrZHSRT}{XSm=lcP zjcIMDx?qo^aBQ}vg@(i;(fE55{&RwqaaJ(E7-#_r;DpAbD8o6Rqee+pR8=^3tD*{x z@bhRQ9cv1g?(vEL$8LD)n~uUUPqosS+6>5XM`Dh~e@?IzPqyb@FB$(!N8#8g#|sU7 z1A%MhsYmj>`EnGFZ*bEH%#-kR9O^qMEd9eD8XSe=@40BS5=t!$drVGn1)h{3MU#I& z!BIHo;bS_X5$H~N>QO;&3LS-G&a&u^!@pM@>Ud&o^|jR2XI@c-W0t&8=M@^V2YznF zeu8kBl0W%@gZ|+t9RJEiqxqU)VIsmc3r|Yn>YIBX5wY6_Eep^^@UKGd3BJM&#=kdT zs&Gud-|_(`G@ceU1lSy&^%Xbyo;M#*g=5JV$Ix&>BhUsb_Mv!l>g&tHSDxl59B*^c z97y5#+-Lv&luO~*TH_nWkUc3pQR31P!U4|l%fE0b99!Z~XgpjedAQ#F;mvt2h2v51 zgcBMM*U7*-3Xu>0;`X3R;drz#^{8-cQuyi8^UriC9FI{h_H=K)hI``ruh_8BE`?(b ztKfvjlS0b0oFKpHbica&;xR6T;}XRRjfd-0csN`)esSAqm%_27IxI9EuG2hRr61j% z?^ZZ2l*oj}!*#lF@q0wK=$vILXo@@-?p#x$#<*Uh9w2+p7D~x~A~19 zR$F%!q{U}7_U;~r!91y^8VEdMFxEsOSi_9#lTwj7iZsRyUOj zGF`TZ->*gM!Fvg4fMZP>@hH;4mK;)x1B zm4T+l`h;`FEOeti!3Fqbcnmb}T67e1LN{WR^_ACPIYQt8*CRPpgmdV;x7E@f)Cr)8 za;OZ)@xG>Sgf$uxbf5}9h5c}AEdJ>jy~gXk75HZ0H-cso>Wq%jYk1zvLd7%lVRo&e z9;>aew1^!6SZ#$_NSH$tW&Cyg*6k+07+!mxfU)=vQ%otnuPSL1;W~L5b!*}!AI8or zu9X+&ji7?bHe==-c3H);`Gpm!=YU(sij$bYkE`q29Ry6?H*6k1jDz{EBk>4`>7cFz zEI%zTpgGXXVyP?gJ8(B0tbN0Dr&^sfX4FkOjO}5|NDxe|+SY|}GXa~IbwyVcpkwyN zzU#`iw~A;wzQ+;NVEl&yT%aBz5ZjEc1EkNx52`=}EeI z1H(Qpo1)gn5oc1G8a@@`h)f}N0EH$1($vVdQq;Pc$~K#9-whK@mkw)*1*56hFxZi* zOqb>*J5RW7mKdv)^w1{L3kWTiJ{(v6zy|!dyb7zPr13l{e&bNxykjsuC7;nXk)K35d*bZK`5{)X^YA3 zi0Q?7G{<#$yk*%g(<@;OY-`SJAJ0z?K=%azUlLVo(T;i4hD_1zL~-irWiZW9VqyFDZ1 z6z+;4evOBrTxHj$fi4x#jg#ydtH-iX5$HdLgb_ z`8O^pGB~|3K|*9cnm5BNW5-#>;uqwb+e#XxmLsZE?x9?o$~rDE8Fe^4_YmIV;_T>M zxKl4pFiZ#|0n6-`AU%6=Uczqiaj`%x7Qk$Yn2*3H9zrsF;3O<0%a@#3g#y)h^5Ys3 zW3PP$x)V=MjzWP~@KlaB0r6WHlFQT->V>LR=m2BbohEmUz7LJDzuqrM;7IG!$}zzYR<%ZQ3S=@DWeUU$(cY13<0fQklO zam$`szH^M0;sz3_QDBVJRTF`+%{P*bZpEZIE4cAaEB5?$XjBvm3b7az;ulAu@qk$P z<{RL;G1i-=QltqT)g;1v40=pf>aEO_8DX4~1XB$6Uom&i^|JSGi8|UBo*|cGY3lsG z7-Q|UUtp(w4xmAj3-_oK<&N1j9=6k$|IMA9uoX6i5Y}1|!J&ZKuZ<0Gc6N@mX(HAv zn9YffW3!wfzxsq4KR;)@v$JE?etQQD7r*#)eejZtnUe|oRv$Iof)0ntSxv{h51lgp?wQWJabDfc(PpX z=)8M^v$OL$Fm(L`hKp8T=?386Xkau7>t+bt% z#{Kqtz$%~Hx?%3M(nAjkN9K!$tXIJEDm3)lU@*ANIS+1>3rD8qRd{ieJeEEL|mRoYMTkO`Yr4@~?x8_BH#W_7 zh$OCsO|@+7($ZB`@PJ`2>t3bQd$1uE+WhYSe9wAxHqJHzoB^CmovH5P`aAm-Lq z;TRN%dEUf+p$RhQjo~z2wJ6{{)?}}b*cqLP4R|YB78z=LQ5B9`;fzepqQzCU*3tkd z>^v`MoQbAydvOs2iE3)FgUnbu@r!dV&f-j(iSV0hkboM#u#lx)E4@2LL0cp>b#nqU zXD(RSFmpmpVqDXrMK~pQ$$T8gnNu+*z#6Qcf2BF15wVscWVym`wPM7Wq9XB>)e6cN zT>1_1$tfY7Bt^j(KS(|$qY!HajY4^w!fL*8aJ%zc&U_}kDjz{tq-Pdb-n>QC?cERFn8D$Gp^8+e zNmz3$)^a+-tM))%!%*>_OyBUT*We>pbYS+u%Uk#Go@t3fCS>qMUh|Nhh()#6Oq}R{ zAH%h+KsOyQo7^$CDQ6HHIc zqRoO``w`$|Tpb%PLC75Qg+xnDA{E_$z^mL)x#z~5~vWTiyZsw zBvEmVz~u^#8V`#5C7^+V`-hF|v~dM!;z~CT&|yMX1?X^rsF$R^_W(LVaE}1ud?FNh z%EoQ5asLfSL)iz2+9#nv9z=@Hjfw$rJRSa-zl zo-18HK*tJ)`}>XJ%^2GggKxZJ5l+Uo-tj*Qj5JxA8AW2m@fVs@NJjyn3-|o!x6Zte z^BKBOAYzTBDKY3ko{>Ug0zR`3jD<4h8l>aw*f>r1Z1aj=#iY7n9`A->YcS4lEREQG zOrr2hYMgLojLGTeoe>Z-f)C4S3ca%rdQCC}_*EJ%dKxEjc_u_k^PnNXZ%?Cr87ta! zPXlrWtJU*sa1a@%;W;?Pm>0*U7uH~CZpNyt0Qk(oVd|d7>Kucs-@Iypyn}IYlY+zU zGiqxWFPvF5XAU%C=UEY2<6{3ovZkqij*fY2s+MLw<}EB7IeMfFdbvZ#UKt3?ia?`7 zp#O(s-r|v?tR%<}<>P-KUkZk`izPXt+y9XNNbs z$lVBK37t}EX(nA^i6>^txTHlR0pg)!@}iOEoxh~J*N<*Qkte^Td(4-vM3qn&7#!)I z^`k5Dp68`RH3qB5N2lohU=%c`#ZYT=Y4T41D96d zC?zyJZ@fn#te5eze2?NAj*?izEA+(sG~)ddmHZoiBH--sioEAmMoYgNyj!a@{!IHi-M`qkYq*u^Af* zTW4(OalffjE)>PCQ#AErg-P|f!BU*-KgP_K+|#WENPNcxj7V|4;ibCnj%!qoCqgoO zF7?8$E3t>H$-$=Uupb6!Wff>pIi+2SK7K$3{=#4rfEjU0zWTd9!I! zZvUpI?ndB}ah-*GH-da4?>LEQlxsf1cka9CmPj*e#kD+pmN(npPAS)64FNTYiL7p( zG`B7p>sMW?T={4(0h1rmVi2_-%2kO^C(P-UIKHCg!ugm0<%-z{vuP}q`x$oNbkaEi zyR2+X7tZGfWqwSr7TU*qgpj7L$pxH)ZUMPTp|?wwrT#L!Emr*sXH>D^TZSlFvT^y5 zpKUJ-?uvD_%Cy(aqsvq8wJ$|*r?A}cACiGtg+OeRifghVs!v}azFe-IDA0O5;{t8N zvr?cx+0b7AX(${{a{w0#TnOkwfj9%!@HjJ`EI2NCUnJ1OfG!s31wc~-qN>g%0_EZ} zG*zGz0co0fV}XXpb%|->%gf0$1@8m8RB(MD>!%BJU|E2@;8*`wWkIn=7M$YOZrrj! zE^%%jfIRO;YIS?~0|FEU%doo9rg*3S+Z_p)uNpD*)uI3aNmROk1|h%>mAHtTjd99_ z3DGsRh_<}s{p-%D!GTLEcLzXy=^^j`qdp3WU|?YG6~ zt(Qs2RDaffI}gw|1-HV+QPKEYg8Lny%LVGzt5?3i8XmEh$A_)JZ#?xpE>x{Z{Ske8 zbNPROarLjq@TUE1*Ma*NKE`iA;YUC9QC!g4G67%P&HA*Yx^=f(spUK{Ibqu zhx#UDeqw4o^-;RAA^Cal@TyISF!?z?v)>f}pV{Fk1oSbiuA`gdrtf`~sa@tvYd&J( z?>q_ej#2u~-qBGC`tJQp`?Tq0O77Fww!1&OD>t&ZJh%CNReG);*738iqFH`ZEcK3j zclTAK-jHIE58y)S5iHFq?r(3oUuHbt-XbvekZEcAec)e~uAUS9bYri?kXXw^DF2M} z`2xR>K0>AtZfZJcw<1l8%y?iMaEW+!WoZnFzYpGnLSx8TT z9!cdIk22Ia=)g^cuGvKQSVP0WeTQqT!Nv|;M9)$=R)Xi~40&)T_*WoEE^FxBg!}2G z_AvNB!`0elj&1`1iqmMVVZAqe;X7yt9k?b_hBcDJ%z@13W+1c6GmzP=1DVe51DP+| zPew$3H4$Y^Y=tLh<0{kmRGG$6h03%mY^V-U4F4fHV68Ikb-d3I+)=1Im1I;^P)Ww) zaw^G+0jVUL2S~>(X+R7;6!-}sm5k2NQg@2spTafFY~=hlLM2E zVbMRJt8tLv(q-#$>LIjF+RS)EMgh_q%W$)*uMEVP2fB2-g-D~MH2*C}1<)uKG``5T z-mg0aZo$=YLo_{e&Ziq7lzN^Pd zTL6BUY32)%uFMPsSFu9)rS9!PCdo+cgC0EP)AdRZo>4^D{@ec_((Fp66#pTyn4!|_ zeY~s8*#}5v7{_la!wvwD zG)vO51yGehy8x*~qFk#M+=+m6BsUq*9KrdF>DIu*8PmN~$>9=j7mla4N~N1FF4_m$ z%UxHxtNyMi8LaQSjRO&A^S-j;^Psb>o1qOGMSNx;)xH8L!w?XY^zs5I9#h#^BW;<1 zZt|wU73pdDUL|B;u>JX_tJO!-dA@iM4lEi<;5l<61Ql?<>IK!nLAyA~BP&+qqr%IVHisW%4|P^_*@Pb#QL zPg>%vTVR(}l$YPIdM!usUzGwBmOBNE{%B>xxX>=rV&CYovplK6i5|lcRLz@|XDC!F z4O~Y65}Cw^T55<ax1agy6Snnu#Qkb^W6nhiI(`5RWiQ@ z4Fo1IQ0~{vFr4pepcp1vUfMM1wZh^s#dZWDH*^L!lYG`o(}arDf1?3BiJ}!0xcYnX{Y;gbwq@08+6u)`s}5 zxHKRYX^#L>QT3z^tp_v<|2pkeXfNJX^o5Zag+|#Bg{6kV39xc31jMDCP+*nq%L%ah zvSBI*C%}sP5Rh`@pbx0;k$}|qVn8~~n+<5LgxmyZoP0#aTMAeHwyKpOI& z04eWoK+4-I$M8}&KyeEJX>6+jDK9U@RNg0Sx^;jSNW3os(sMR!N$RSX(>3h(O`fj0tgRw5NMxn5aRo`#2K-n;Wp&DhTfb%!_5CR zXs^e0zhiB0(27_!qCKAe!wTTysV{KPeABmLEyv+4u(l5#miT?ckgo0LgN&sgSOGLv z)tipTC&%9;p~G|lZOtxduodpWSlo?lXFNmj zuQ@pjkfwSfAkHX5G8a?a%{C6e|GA4I#-Nx~87fdNo+k;EhbOyEFc87>G=cK*q#zB7 z3JYs8C}X`50+r&)A`aS@N7ESp(836`fuY*Z8;0vgj5_cCTK{GoWDZ>j|7vvtEhf-< ze8;hl{!N8VWAtxGO-G5~<#Ntlu$$01=PoGE>DW!Z*Q@He3+hFi3t;=8U?FJXZqOg= z+{LNDFqn($chA#v7otsVT{e4=&9$DaaDDNw7u)i!Yr)iCJLfL85C!L)yZDYGtaBGf zSZ~YrKefX-cX78(V^a8ug<+1JxXwD{Z{wVE7hl*khAZDHjs704-#zu*yUw|bGi(~e z^^k=bAY8{-p`QNp#e*D+T0gaE4A;*rxm7?)zqDy00j+R;vFQ%Q ze@>9v3~crvMO!a+ENUHT(-^KMvcQG$j|(BuRG<8k5A2lxJoLr>jzz8KtP~Ek{!R5*7;UjJ=~7VTwlz#loOKYqL$kll+cL3xvGn;&#@r$+S}#Z zhza=U?Gd}g6};%KHMy1PG(*4g(2(mJd{|Ct=9^diDrT~WYhkw&N@Tc3JA?2lSG)eW zFmHFmyy6L&r2o~8##r>DuX=WNq(E0%bCV$kX-aMPB9O5 zi;MlxIQ9Ie2Sc5@?kAKu2Q*H(rkYp$N($W-XyyG|o{-7FWe(#soVsoy-|k5>(gTe^ z!(+webFPU?$;N2_FL=VCAD3l}Q;-_P#wpmV8zyQ9@T;Dj*%;T8R;6eo8lpfK^6h9< za+pv!bIO!Bh}@c#O5r|%g;QttVJZ9Uksr?QOqCNH)HWC6svh2LvuJ69Ig`cDtiO*K zU=b@mek^_-!ePaNTW)%Y#p~mW#p@vn(^$M7Xf7vmCvPD2oDOfa{m>;*>xjkFOWlJ_!%)AT0JfkJ7f0C$o_jMV^~4ZWmIu(}awkn~UCq3z z#Dc{&!rp*>hC_ciJ4T(~I%?iZMObM3C=#rd7f!mwIjaVQeQwQyc|grg#{+xJWz8H< zm>QLK2O8Y*crrqlms3L)vZ1C9UC6`Y4v+Uy%^czJc0%;=?8aMoAYQMh@=h-q=|wX> zK_1Ln#hq%|>n9hK6po3|Q9qe0HG#lO_@M5#B#IP<1^4vxwVcTt!>NzsN&y~=f$QZQ zyuxuzBYK}j@@hXKfNllNFDyC=&{E!8|m<1h2a6ig|j`99J3p&R8LKbu!Kkv?hj`g-b3p(awAS=b?{OXtE>uxBK}UJ;uPo?TeqUxm z$MB9|W?ZhP`W==99m6{(3pyq(o&_EAQI!Q9+rg47>2Aq_j`?^n3p&R8WEONJ*_Z_# z`{i3%()}w7I`&IB`o~|(`PDDi6Y^NtF6T$b{GO5p9rJNs7Ic))7iB@m_HtzwbWGoh zEa--U?yfB8xF+*oS-Y04=-BQL)de9y>ip`B!(@JvEH8Yp*yqCd#;P?4liWTIrpQP(?)9pd%8k0 zMWAL@A8gU!l#z9pmZJ62Gx2CgkaCXhZ}<(#CJ5K9Lvr@-J%KpZXHL}gnBo`(P(8Z7 z@ZsP+NYxb&WlhHW+>CeZwtDF2XS{zq;~m>c9{SphcWkhE{OdB_S7p4{XS`pN@%})@ z`|TO;4H@s(WxPY5&y${OGv1ps-fzozzdz&sI~nh(jQ0mK-ZRsi%<%s~#`{AV@7TEW zq`xKO{qBtSJ2Kwy$#_p^yx*GfzC7c7Nyht)8SnRHyf4Uj&n&-NGW@T~c)vd5eQCyf zW_!3R!+%l6`y(0eD>B|!X1w2!@xD6a{iclf#*Ftw#(Pu7`%g07@6C8$objGnzCX(F ze>mg)yBY7_%Xt5O#`~Qa?^kEML#TKhB@Mq*dan{Csa|Eqv6F7o^6MTH1;B_v)A8g8 zCn)+M+>r?e(5kF$UzD%4?TegR+rEziq7)1U*5Elxpe=Y73-kt_XA86&&+`Q8#4{=o zH}A^?$^$e(Anp)eAW$(NuInIufF=tx9nchk<^!50&=NqG3A7r} z3$z9hBrI@S0L>TZ4M32R!0iSE`3I;I5L!B*zWAu1jR496gwh6-4+wG(5RafhVgZT) zS|QMMK#&^1%?E`32WSZ(NFG3|0ijO;x(^Vf6QD-{K@I>~0|*iV&=x@V3G@aav;yFE z144fS)CuSzf%@i{E6=El^Hafbf92-_(PGCF0>uD5DbRF4zY%CYpr-{|0%)y3s{#E^ zp!)zlE6}5W)(f--&~pN90mM2E2HpVlyg<7Fy(Ca4pjQOy3u*XAfvDT_xtAe%&wXfsfmcW1A*r*SW+`5 zG9Q+`Y8FMzVmOJgS{s?YG*J_&u5YSK2raB8)Kw*#7S#l1bFDSPMb5~A#zzRvI`v7^*GFor7R|%mWF)j-BXjE)MPL>pB8$mB zeh8(hwyDu!L;h-OGhQ=7Sun4rF%g+lU!zIZ0-2*&=7D>8S7Qa)LNPJ37tE7Du)fOV z$lYm@U+j_0Ths)zXh?GeEVxe17mvbb&>r%_z}y9kkdpf9L`@=sot3KE1#Hio9Y^y8XD>sB~UfisyU0TCScJ&7Dg5#ahk{ojpQRqi>emZph6pMyp_t#cWZUv1xy2ycBKuZwyImfOCEiifz`yEMj61K zMP%-RhQ|i{T$#T4YHLKfk8p+X`rvvHPzNeX4jwz*F?0Zp!+pq>myL-w7#0F zno!vdNTrl1x?VkZMU*>ofE|8YM7A)R`k*qyd+M8Vb4j-N4G@o*+T=S z1<58tWNsBKGU6gYr_f!cqh%;YSOQl`)Cx1dc6{1<><9y{x{7$>aC^1o?~DQ1O@ zj}YQ2#j`j5zkk#EZ#mjvlYpUftTBGXMe8RV8T_TTtegF;tEzy@KE&*N@tZ7|^)BTT9>=821INjX7N=Vf=6PFHO(;o<-pPG~$_ zxxhMi&Hd}~&T7>L6Rr|rQjIYW*FfPqR=oqih<*5iYJ&-vb;p;`c(@J|u5Vaet>Mk* zt2UT&6$)NxJX~x`P71G`@tfyW8%()48&LZ+-ZJD&BqwN6IC1vRu-(Kyqg>iJgvJxs zk-~Kpo^%_wjz3(r!IVoIhtPPqNbj_$VS|30ui9YBrHw;qJY0i>%aq2S-wR&nXoH?3-MCb_=*qsy+;`xP~X+Bk&9!^O7b-0^jA z-FY+hensWd#vwEwF6PM5(Yz!&?+m?PQMg7FFae@D=B+Q*R8DZ1_+m}8&u#PdensWd zwjng0xHzM9+QyXGC!VkOD=L?^4WaRH9WPv_maBIkU*o!8afG%Fq498?;EC()As2kA z_bX~#+BSs7!xa%OBR7%*9{WqgX@}NzI6~v$qEvQdZ`<|vUat2mYFyejgvP@)M7Y>y z=+@L7ve|vVqP7j8@o)_VtrOSZ7M#f>*8-LE)O+lJ71xVSRl$iqLJan^CJ`xT+%K_@gGu9Jn!ltx|f_Bz-7iX*jc z2#tp;U$`h4=pHY6^&{8)iX*jc2#tqpIB1JWcX{RCuAk<*U$IErhR}Gph8HxuDGn9xXh$8s=B` zUVW~MOWTIfc(}N->5OfPCms6mc`hy;ZwQTt>wMudWq8`lU%q#~i;MLe2ndabs}$Ir zpr!-{E=*P-k zT-r8-#=|vUxHx*DJF&CvmGLevZ5u-4;hF$ir)}K6|MT4wTwGcsLgV3z36~jF9`nHi zdt)vxZ5u-4;i~X(^`Cd@6%{TnZ5u-4;kv-XRdDN~f(u+++BSs7!!=R3%!p|IoxLBJ z=;G40Av7MYxNw;kb$!*(ZjZaTv~36t=wQ=Qp1Pv%+_C(^$MI05`1s#aTWxXirax~w9a&UdEDElo;o3*?b8kPr#*HuT zbrSLPd3-Gzt|PP^ndqu|V_gIvj2ca%T$AOe;kpS7EBj)f2YH|asG6`N3RENrwugtY zMC!gXa^?H?f!dgOh{Cvo8V8-vz5SzM7z?MqN#Q>A4YQ$@spl$FFm(C+ZpKCPG(52W zDso^fLfF6b;Qd@;YD*833o$MA#CR8+g-ey^3jS7iAY@)fMDp6)K+|DXY~z%2j(S8~ z9uWzGcNKvn&*i~;D#NQrs7Job1Gf;u<7o9LaCy)uPIwi2BZ4Y+c@&GsKbUWth;mX@ zDjqMXN6h6B6OX6pfol$7RY3B=;2#1GR?UKKyH6+!c6PPC(wQm`MTc*OU4EGQf_0aP zFxW5$b}Egvne@~UY|)rgv#6ulvGle1S}y6zT%3f4&8NP``Xv0v@*YN>!c9+wSv_N1 z09LMS3!F{0(UxUF*Z^2Z=}>NL@1(v&0-LYF8Dtap0WPkC={3Y{YEpm2VnAlw*}!;m z7*C;EsX-Edh-|_LgFBmOc%E#AS6xl3Iw%gssE=CkR{Wl-({F)uKW zga)u3b|yOd$5OavGc~aQ1{LA$Y5?I?CkemPcKV752vaGrfua5f%;~$Zk^^gV;DmV} zPv~3V6Kh$v#$*=1xFpeKi30VQha^Q{3nMNq)@nS=T3VTR+sw4CmT}YMMA#^S)jp5S zk16C!Pb`IfIa*QkBxsC=iDJ=n=!hRBbw||7&Ec`pe z64Xrl2k^ca0GA^}Vz?n!pgKGU3Uq@F-D5+K*-$H>!|)#pylF%KwxRy0ef1q?L+9Gi zG#je7A#UX#F5x{7h(pOxfSdJ43e*9J!{$(chtW6$!7ZhL@&q~w(9r@-0mS97P+%4y z4#7gQG0%ZtC~&JyN8=Y72kpUf$`A^4*f^efRopN@N>^gzE&!ydngK{twFHo+id*WM zss{mSsy5gVx6d`?oDeR+lX#B+q~Q$(q~R6WxCu6{3XpO%0pc=OC~za7h(PxP8Z6MS zZQqTy?`wdDi0{8`s1H8l8VWC@&`?eVq@i@Puatbhm=`t|RHk5AX>&C7N9TKLed#vG zaDnLEt*~ktzPl~bM$<``;oH!0Nce=(K(y<*X!6TQVo-Vb;rAQS3qOawSnJc$^lk@i zCe`eL@W2hMu*qNrxR+P_xGwWa9Bev7$6*FCg1it$YH5L?*!}U}a3bR!sgtb*=y~s}=dHN67Ik_+n9SCl!dBv|{ z7J4u^1ebA1iT_oCqdZ)E+2z3?9G|O1?()#^<+W~@b=@$mVdFH-pPN_wD&}7v3}VkX z-V02|AzWZ^LNQ_UX*dtq?oOFZQa0qf-;lxslJ-r9JPir$4s-Mu2RY3t zR!cpi+aXr#>J*f*>&&Y6j4J#llusHrc4jpdZT=^BsW6S!!A%W`>8!8S+f`~8%+7jl zH+sy-qKG)2UZl_o1pa(TAV3jB=N2rA>Hhp$=5~eFR-qLg*986>V&@0A zw`c&0)AV_7Lzw`dTm0xo6}#n1;2qGt3OX1}5y#<>gg46C)KIkOFUByBO<8kUc0r*l z*0m#xOfH4KA2ffo=k+r>P1;O^R$uGRo z-Zco){n3wZjJG|L?p;5+q5@C-l5US5-N@1Wg4>RC`~B#Oz3rKF10XNlPTSv@Zs8r{ zM>o>jP#IpnAKi%2-SRQok8Y&3RcIxM{ie*1ZbWg3JI$n<;zu{qD~Cuj+mEiu+x{*G zT|MZYw`lGDQB>k-FYMlb$_Q^oZfR@gDQfb+ok7P_IcJXY${~<-cV^8Bmh5J<)0>@# z4c@*lJ(hgGKt|DP8PU4i@Ys!i7>8?3ESCkQO|i6yUSOIAs9#DEsquX`kDo=pwOwCy zbq$ThQj_MylAEWCIWxW5QWy}{Nii6B#I-qG{z**07`baZ!aFaM(iuE=*hY#AKXsca zjv_jI8QOp7jE8gxw%eE1p*gWDEet zQd0JM>5vAiUgkWHQ#$4_kEe{}cn`lh$~zd4CMn;>*->Hb(3ly#6!j8eyxx_>OZ1k~i=~#MJSRwbDn=GKcx;H}A%VKA72=YNQy5ONZI+pX$MvAmIxN)SZU%~d ztFo3KgivU?(5f?6tnrrdcI|3D)01)ykY|910nF0cB(n}Osn~dx8X#r?x2`ZLh^22` z?ZA^JD*+ZtBvsOmIU$;l|By^S76~*5PpwdvaHHTTl@+?)h8VWuZnq&e0mVIRLyz0g z8bBO0hXNaI=tV$Hg4>CwHXqY6v`6`sH9L!|tP8g$J9~xiZ^Qaha$~`a4V;N5E59M`H=_G?REF?dJfFj!86jZ8@rO!>!CSHqBOE7nj! z1TVqIQZw_kM__gJF!*SrR8;Ef2=gEY6K8DT7OYnOB{p=W4P|BrD`$3gN?qB(%2yBB zNncdVjJ#Ue@73_Cl?XVVzO1ye--g5z0I|w`&nN1ctHHGSnR+EImwdUhhwfg%^}of% z%;X6u#ZvZU+CqQX$t`JOsVhn)gDm22fDjVdB9t<*GQT|L%6#0;D2qUg;k!1JnRzVw z*_p?(Xut>>sXfbnX}Thx+1*juZ(CwgJbh6?Wxw@_a^~S zR=Qgy-32Dyn?30+K)Pw=a>j=e$jAv>*Ta#p%{YaAM#=MBd#U6lErH*`UlU$N({ z)boa`+FX>Aowv_+48CZN^P1W|H0pZo=lGcqZ&|7}iuGpH*q~T?Ad4xSK5XT_+b|$a z^iJ;U(=-^H4=9jJhUJ&BudBTF^mVyT2W5lgbDD82{<%J5IrmJC^5^SbBI4(jj!97M zSjKwK?t>21B_dAR&EkQxM6`edW;hNla)K}8*%$xokNj2KSt6>pX(HAV$Z`wANuOg8 zbH){u9&@yrY1Ez0v2FQ%3&ZJHPH+UD_+R>u^X98IGhPA@*)%4u7cC6arTHS=td*xf z;Mlf&)uu6AJX1x-?`uww)kC*rUHz{e+m?T@X$%)H3ZvtAEhor1AtmkGAD_EgwVB-u zCkF=%*WnfyM|e5GD4s+Ne5!4+YBS>{KzrqM{cWx(icn4EAO}sXuUBW6KJ3`Gyv(LC zaq+5mxtj8MA2&R|_M8V;QJEC^PZRpKZR= zv2A%L3E*hkQnNTn5tePsGpx6b^KZJ>v2Do@E?ut8WjYSWY&pRspZFi2`^*m<+m_Z8 z6l)14u781s?lAo41WjBw1osYCZD#s?#0MO0TWShlRfKFa&F)6Na5nhfN6N_w&O2!Y+F8N(-^Ktf{Ho{ zKTex}v@s8cNGz|w&utpRHC?kO8xRgx?vVaBs5Udhyuzk2T<=;KZdN#4#rHHms@lxt z;u%D`Ji82y)x)EKb+}e+p7j&eW+wG_trQ+@a~X?<$9TA6qo)2=wVBD4u(*z~xmH*$ zlamc6u03A3mg=vqzu?AMp6HZ%Q<&CU}7hHJ3J z74dLw{ruw_B6iz2*`_gEqb^UGFikq8xz4cIm=`@MJYz0S*;zFEyI|=* zNDFP3l}a<;7-L(e`qch{XKfrGm<)o`X0 zGj|U%an-doRZvi?t%Amxcl*NOlN4W-nS}*7L7Iu{hNyE)fit#Bwz0>gLII)T1XkeL4J)1vBRatTJIT z&~ACG+n^YfL3xvAu--N=ybd9gnL)_1uyGzrqy)#cUBx2hG-qK$VSv4qi8otO1-i{7 zPlfe4x=1&mMiq>5?L-Zgz8%7FnNx5&iC4iMpI^&P)Tq&(_&5f>r8jIY;h&BoPFB1} zjo=i*b{s+HU_x@1wG%~Yr#leE^s*gCwUa=z)1tG(EAkrfJRfwQgQl3%6*xP*BJ044 zqUH2o+@i5iR{E^N3l{Ql{C?AqZuBTmK1jFFkFKb|Q!u1k;YT;Bq}Ym5en@wxAKjRO zZgfBKqbnRUGBdojesm+e>YuRH*%C`FN)#)+mEi$yS2r+KyUY; z1Mkuf#*FS(&V&5uib_1~g=3{t{OCqoN5ql2uwW3E_oMCpbd1h+4DYXgbe>kK%4>Ul=|*|-YX|HG%+Ap? zXD5P}61}Y3L|pFPO>*u>;C6egJnBjvRwZLx&kJ)st9Pm))&UJEy#&0lm8*_iyo-Qw zF8)JuW6L~&CgM3?AX!%P?p)v|#h|VTYNVd60ImrlP|kQXfYWR!GpN){KFPl#oI8G2 zcwp%){7%O2Wc-%mw=|sFC!9MeH=H{y63)G%AUtq7{wGJm17o@2fly;T6pGtcdXVWo zvDBf=w7qxY&NdUsiJa!T8j$9CMMhGc!j|m5qQRq#kK|Td`cNyn^JKBKqnA^pgX|zr z_6DgdpzgKH)J3{3?yOP9QWr%eL=Q?=l0B%t-KlcBqjV|P!&uOrs<=C9eg-OaQ7i+4 zluph>rOm3lX4Pz=>D$+_5Io<>8dlhy7pye9)`9Uh-Q}0MXnMDVM`w8mW?2O8@eU_M zU-x>g5eB+m%TW$TB6mdxUFWFuaRZgkS+6}mQ4r;jGu@+B6Ys&Ub<} z!{d-AC&&>Hq!gKSGXuO z>A3FVtk*tm(-^Mftu*U;Ex+}27w&y&v$I}n=EVI1hU*rKOV?`+*G+5xe!H&MGK@QH z8pCyu6}zt28m@DWJ|ya_*Z#n!F2$r;v|jEuIP0}n+cbvj9Sd`y_1gDr8pCy#h2dAkS!?vJ*OuBehU-xaljq^` zuGjv;rZHSwm?^jet=GP!B%m=|L92WYv|el0KArVierV|qv|hVFNkC)by3UHryIxy* z!M@j=_1YV38pCy$6^^dgnp$pX{9>@PUi&?p#&8Xy_=7vpdhKyGjp6dH*P6Dm{g=1@ z`#|fpJibL2!N1dbe>8H+2hMtJu}x#*V#??St)XIZc1{z=r#SaQdpnb zCH&7hnNKV!dj)VIVRge&hgUG@x^9gBXHPqjMW7DSx@o8CnbYDg02nXZIog2BO zOl%L(N@upRp=flmYgd4?u|VK{469BR=>MT?7~x%&9f|aC#Q00LN;v+gZ1Aq4EQkY$d%)S7&=q-Czso`MGthjXbuW5DLN~&@YJ3*>W0(-%z)3Nj6R%ef{#t~^b0-H` zLsE7z39ryHkt5taJd8|&Y9@{a*A6R7Wm$rrnmJKT?qgq-lRW?kuE3p=b zrKaHsjZ<19N-m8~i%yMRLKRQ1!GtoN+}wndn^;(kr=PeFJhAlsxA6yellN7*k=jt% z{I7VptixPJjswNFRv^34)aH1q3F~gla-%Jm4C@-#5;{MM;68h8Y|DTV(KVEj&*DE& zvNwFoFfb&y1fy$~08v)5E8KDzFtOCs&UEu?pknEk75L$~=jbL-z!E@eYM`>EEH@ad z-X2R`4oz%`zkJXH3U|g+<$aCNi~f!{9=v`BzbK&GSXXN-Jp6dLQz$2hh1B4i@#;;Kk?E#DZ1`Sq?~!tl zgW~@duxxl&tomgEx&AsH7q`b#qAK1dhgHjM;{;2thZcS_&dl#e9J$C`-|(${k?+)= z>ma|*Y%|5Nf)*wry4x+V&^yNEaWEZm8N$66|%TvrM@jlCMW>2GS9QoDR?U2N!h zDY-w=7%JS_aY3qWH5!hUDXM|5!g*37H1{_{lI3O1h^o^Cg z()1x%zA<;M?H_*ni2l)nBl^a=+F~VJnsC0C#fChgzN5Bzhw$pB5LPtV)k{|7qT$NT zc1Bp(Fc&E z%a99bbUL|k(hv5^!q8DB10UEtCo1I4Z}{m;4tWw8I@HS0hpErnFN5U)E|KNoKNR4C z38&hjz%D#FeGUb_fn;z>912VT#A$9Qa4{fGT|(31+D?a$z@2))t?~HPT(Q} z{TF;PYm7UsxQk$OPpaJbTyy`uYrYjr72Z+^w z1fm>=w{P7FprRTUQz~~yVLPSzAF=ylsq#IAU4=VYAa?zx-Ux4j2@q&Zqu(^RjAUE} z6f7v92kf>&PmEV{3Z!kB8Zy{|u`Qu9%St-0KLb6vGuCnh)V=q*0?O^$5D$JBKec90 zSxMJ*-{}}3$?rHFVLa%e6g<}L)0LgE;OF$NOzo0b3U`7~pwt`aGpms|&k^y{ff#~+ zR1cn7d3OLBD!3oxIZU8uY-lH-69v~Bm7>sKKw7n@0y;^2rFtOCCsUSBhA59il$WJv zlv?7vxD0X*wnQM)-69>U+6Ca}sN7eiQ=*tE#@G*4oSK@bNWBLQQ7=A zOQct%HdZ!wRffy{gY)%L5HfJ2T;GRLO=@#;St1aAptX5t_<^>*ZQ0UJ*(#FyuZ zJxD~fYA#2fSO3Q+~Q_ZX38>`-e1~pw0 zP?q`teoN2{W2vU%M8wn(ec7#tTV;Xlh?~I1;-cULG&&@l_!%rVt7A||fyl_X^ zaH7{&re3Z13?$=M4+u;MKRw`hdY27`Po;Zpb!WU(JMe0wQ&vq_km8BM5VuU7SCPild!mXf* zrz>Z5EQa8;V3D6^Ir1|Kp+69h_`qBWP<#jCM+U;f2@MBi1n3(Ool%I+(_EsnG94Ni zF9fA6F+p^!OC&@g^ZONCa>yPdA~9x&Ne<&J<$IWsI4nP;pJE=%U}MGpb|%8ip_M)A z#ig4$$ihIOlhxe(X*}H&3*XAtkiMJT$$fqCrQ6Z5EV+-Lyd51E!=S{Dn@Q%h2*m+B#3*=rxeqSC;;-lKg7bldZUi<7d6m;R%!F$UF z^S8X;>*f8vC>#7nMOSOr=4i=(uK!(ETX||%bodsGFcameSIURCl^5b~dwD-RTgwYy zDG$dw%ToIX<4oc*bmV`eI?IM{Z{8jaSL`cG?Hb-$*fw}?VOujg9jZ0mRIvQwRA=E1 zeA%O^ZRI6@j8bF<(1G4550{|}d{LHqy=?e9(a(042j7Zzt&dl~6GP&|Pak^}y4tZP zL<@G7N1o?%^|42xJYyx>o7O~!zhHX5dmikTH|*v?=`d_U7+>sh#!P5!#)K93%^`q= z@Uz#-`u!dA;guUHD?Q%>ksb}OpyT&de-ateFY^vS`rYQ3P9ctZ)%SBi`i=gp{k47( zeO5;VygKD%aA79f+i;u$C|_{r0E!4S0nlK9rr6N`^~`)YazYove@>9oFCyOFT6c&u zGe6U&F>~xi76!=%7bjz!fc@k3@i^RSc?Fi(G=}Rw3&XisPLNYGPDFoj#^Qd?cI5*$ zjp6EJVKD0g7bj{&eE0Oujm~!E0Gq~enMM7+!o_JDr)rP>`SCT*cBN6m?i(;%_kf0u z>GH0L5aYLGPA$vE`BnA`7r&x<>5c$+D5luF3I^*78LJ81R~*Rjh?mP(#d(~EhA+#z zVQRZ!hIhlT1sJDk-eO+ys~B#C8K;;}%`1Kt!!fdPih0w#; z$W5i#$_e9DJGJ4;LbD7N`6}(y5ygepA~n~j**PJe(X)qIHSZRG7OLCN*Rn>PVHaT# z8sH`PzfxPUYu(6uefyE1c@8vhK?Kr~T-SrV+HJ3c?gP*~M~MmNS~n_Ej6UDT&$l2S zCs5kK+2M^TQN)3sW_^iMMm+&MU8W|fS2-gYUXJl!`L4oG%TinVZ4a;Bj-Xn`eNtB9 zT8j1#z`5jO#x?B^;RPeba-Ncfd9XL|9o7jLM?4(Dz(N;L)>;e(`i*>DhkTpCZlbDe z_!r3yUpDVteq6kzX&23gt?Pn67Grkf2dh4b^SYjI>c|XfcsZ2d5SUr$2HjB_mzhcy ze%jnx8oqlIu@aQ5g-@5Y@aW7L8>S+3ZvBVkNIRuiD8Mvxi#`;f)K_S&4ZUPTe*vVk z|BnD2jsK8XV$yGY#wG*S;9AB9&n_=*Iy1VWIM_72tYuPHa(}PuCY7hQ6}Ha34MV!i z1HtIZFPQPBOR=~W#bC3&<5Is-(6>QjDnKT6k}aygl|whq-mY*DoaTY0<*OnjWN63AO_9{%gDq4=LIL4~| z_JmhgB8X_q_)khYo&A);o$dnhG~(kyUXDU+X<_IvMrXCV@Tw4eBpQ0yjX1oD9nvBf zlcYAotMG^p-ycnG`VzC3@U1J!*BWp6J<|zmcTdJ!p7;!4s(BBdb8o{)Rd_K6ZaRJ) z$1rBP9$lkv7|FgXB(6a%rn9YyE5lFU&7gRid5x7AD;N zok#ME)l0*cXQ7+|WlWeiyMsq>dQws(%L% z`RJ9snueHOIl=0c(G}OB4ict2?&-MLuhCzLuzT)~C-|{wcVtgI#?M=N;^XXZ>+SyL zOUVA#k?hvlu0?0N0$y6~e+8tS&HWigp=69@iNThS99R)hJ~Q6&EC)LR&Ua=J&k2S5koxy548N;6LH26K_0)wwneEIX9t4K&AUlN@ zDnbs=d-L8`eEjzk%?>0cnPa2(8cx?#GHzstJOL_C=8bB1war+7>f_6iWgYYdIk z^vp1?_*D$QhQ=x8H1mqzo<{95^t0(sL0ya+JC@2JGkH;G=7Bf*aqwFQ^%i^doH52G zjnP5zY?ay!8N+QdP|pWkxHnYtOZAJUVmm1S4?L3QwRtl~_z*cm;2ufbqiG>J@KD+! zk^S2SD!W)C=dT(!7mge?YP2YKaNK;d6#2y`=?$`cad&vTJ~Du>XWZ=F_gsWHPeadq zfV~qAEyCKDl~?=0kHDj#d7S+bj^r|K9_h9J6$5@ZXbQByLA0Cjytl=38DlzVR_Z)m zI;@0Oglk}3j+(r$fadf8ip(|PjqnV^1H(c0B4|E6RO$Gm>GSR{^Stv7kUxtDDjhd! zb^LE#AfxC2KX88oP5;9c!E6iNh=MT|iTsf6BG4@1_5hq+E~C73G%x&H(EJy_hHy?k zy!+(e2i>LkPX3!;T)0vA*Lc1A+Ajegis0r#{L@h+3*DH)k%F)u>+u^J44ZrSr?cxL z+x;BS zeGIzkCjx-u(6}_WpfqE8igQr1@33w%{CAU(TXN$zi+LcNh$`H%vV^9R!gsB28E{8e zTPl_p+gw_JJ#cJvjfa)5)?EA+ZysL?`50IOVTH+`92k?sQ|4gSRlu9QO^+=y7^;E} zTSgKJb-#Ke150hvv{a<~6mDHvtZ8X$DN6-YQj+i-Zzl=2KP}Uj}_@jM*9U;6OrM|qv`Q^2oRfO<8cCQeB@c?1Z<^&L}@HN zsnlY-A|^?VrQXuAN{ug-(I>;mt4L2P#c4e3=~~&SDOcq^Ab=G?YSCdMR#Krgz1-^;r)dE%F zxkMm7mkM-0p4SNUS3Iv3=s$Q~C(z+&bISyB3f|J|O1>Wx{V>?#$D#;qR#v25z`j)j zPQmq!rxzf<({n4*m1quI6Z5qA?~9johMQL)ylA>IFZp>eyy`eaAhyhspZ5u``aZmp zpZ5+ouLMw$jt{fi(0vsx7Y1V`ZQ&bF1HIoQl^N=YM$_eaRAVTU%QNI&3e{D@6(5DE z)>x{Kh=UGa^#RUy%*@%CSBrVp5h}2ChxLu7lU+%x-Y(rwGf17=a@yw%uj-G4RwDZq z>GFK!wg7hA@QiR3wYgQ|N!(*psu%%thn5jYwY8tkwJU^S1%5d~XsLv%OMF;_ zrU3tqB}bS56kkMnYaHb1@({pOF2MG4L?TvpA_$~uYtzsklMMkO$xaj_RNN6FLE14} z$66W8*wvvDlSqDEW6*VJzYC(*uTG+_0`1Aa{bn$q4?^w-g`{;}FVH$XR|rI5!}bsg zur;c01dxg%uE5+NzEyyd0xbiyN}%rpVrLBnwgFOJ&c>DZ13)UqJ_Dp2`vKi39B1S6 zu~HzPwqMM)54{=QLm~EBA$)4k_AAi#uZ+agSE21sMcdzz7!ge_%L|5^??X_rl%DU6 zrxG;n2b~KZo<=?HGWFPgBjT@2m(%cL(-5tAcN2q7x820nB1BhgmL)sUBRde8=um*O zBDEVWws40@G#lUZ%wD=2sy{Ui2qf{H_NRgIt9JIYjyyk~D11y0)c8BDw#x!H%~;aF zzdRDN7$kcRdcUVEmY<10BIu0y=#0gl&gfFHv`XZM8#{6ULbm{4Nbf}+UzOyJZIy^! zo6$T#H{l;Db$DvSLA98m$U!mDbReXo#nmLOxAEGljs~4*qER(!At8h~*FQBI<0(eW?385PT&J z53@~5-r)LD3cP^Qqg0kQ7&mhx*j>`*oc1$kl*7*V;6>@(Dq^)j0AQgs#k#^-c3y^Yr8&Db) zp}^aKRtn@J7BhwfGA3JwcD4Y6-txR;XDHm<0$z-XP`a^Psm5q(qxnJ&@$cj^g4GYy zb?CyS(e%_9hQ;L=7DFN3)<-W(y^AlaqY9m<7omr^;)u(U4u8SGKw@rgT^i}Qka5OQ z)t-Ta<^R>AhA6UQWS0M^VH_y*yEGk;R!0Zi0jdrg>4Od zRijfoGjz{q;hTd(o`(L5LcSXzRHnzfd+f{7x?hltK|#zJwP5^PnL?T1!!lmSF1LZ( zbRAP{sW&|xcKIv@k4XzEV;U=ibCj}S#i$I7a52_lX`(Nt)<>UQ(3j7(=$!m)sP$vlOL>0BE4X8_LIuN?6X2Z**(z_dfJJZ?17`wXg z41ectJPoP4>Ns9+KLp`uA}NNDuu>!}-56`S|xT@?}8R$_<{9(w}qR#z!Xn4meMZHxL7;)3;n`o zZ*QmapP%Os=*dx+R>w~OAx0Q~*Yta9WIKFKAl@3`u+zw=_MhPe)7Ky2Cv|qa%(l9| z4Bx_Zl%*SsqRIWJ_>b_G>;mu$0rrQR`E5=v&C3lpzYfU68scR!01z0Z8X5JL_3*t5eVG{ZWF6PLT)*Kb2khUuH+P)osOLm2t z4negaofB^E2jY$=QrG5nyvRl(RMC=6%g->ecnjna#MAyy@SwKtgJQ#e(Kt`+NL^dd zam(rO9ESf;;M+FD+3*>H8-%LT&mljN3Oxcyec4c%iBO;&5PL!>@ChK6O(-x1OV zeg;T+e`7;$16nC`G$yOiLx2_uZZjbLNXsWz)n;@Cf+1OW)y0TKEv(aqP|J~E!f?jS ze8a0QgTD`&iSt3vLRx&#-}OfakhYjzv*kXFmy@DMzi+{ZZjq%F^=2xYqWP=ACwGK84yQw?ZFU<(pWGEYz=?s=fa@^L4>2-d_1Ze zcOnGSOxqW`Q{~7K$_P8h4w?#s8R)2VBGw_t*gbkSb@wFCOaAD7NR>&vyOVM`sC^CF zhN%rFZH4|papveleJ;=ysrD!bJlCV#W1H7QS-DF)Xc7xX;Z+^v{|>N1WmK)SQcH2Om}rmrDrF|JFbhaWjS<=^YCe;IpD)s zsN+1$38K-pY`h(~9bxY}X^m_8!MkH@bS=jQ9jh@v@dS~_6s_rHqE2m)!9S;`xUvOd zXcWESj|qu2an^mzFr(!a+Jf97u-( z)qqrZa~{4@aJ1xfmOu{xQr;&3G0&mEQ#NiRpi;rTVB*RVn$O9RWT<)4Xw2qoRKp!BUp(=OA5+EwDKq<1$!F}23k+2vD(+w zwzk;nEv&tn$0r^AnW)Mddfc^Ak%!CCcvs&+iww zeysd9d#*D8+=a^TQe6M8TsPqo!Xd+V2QEDc$)U2^PvpAVH5}LDIvg&Y^7nD+R!f`duYn{^bwQ?Jz_ZRfZ+9)>fVM}=>O z!F$$ttg5-EoUUU)i49u=BXnf@{hs<^It?HtbrC?@`S$fABsGqG&f&M6-#q*Jd`0#v z8bsFErS)ToBa5{R-;lfhklo>#4E zEpoD4l3m1|q4wZ^OSxoB>iP+3tiKA1A=m%UUzwCpZbRuJoTXd?dG=MVJf8iOtB7ZR z<+6C5r(ENB4py!iJTFkLIXrWe>mi;OE7v1DB_+cr0-parwMssye} z%6;!0cTT(4mw8s-e*MoId_m5|d6#`iTL^bS#)P!Nujv0@azDfUTW(p=E#ZC<_Y2&E z8H7UiU60=ce&6M;!F@GABRFOm_xs#}=VcM{G~eY4aHHPsxiURhAJ3KTxde`N41sj* z8sfQfJXfyg%JW>8doJmF9e0H15-8Aq*LtpE&lU1qmgkCku5q4gyyu$Wxh8t9$(}1! zd(6N$UDZ*1Scv@-)kTl06s4slFPQ@+k2S5oc_^tas=V;c@Z|^$@6xUq!NkW0e)4QVgQ^{iX}R+&^6{gM~Pjpf2aPZetz-vtt0c`|Zk zQeE^JCst3N8|zWWN5XQh2CyZtGVZlOUCB*nB4dzCHl68u3GB$#i`#DuBbMOIU#*_@ zK+;C$Pzk`*%ZoL_Nk?kzH$)FjaPD8u`tkiq8=10DkgK;BOQ?3aB&^>MZ8NFio8Q^@ zRMJMK&?$1A<;7a7J)AR*B$l*h%bL~CC2eHB?uBvdb&POwoz3kxgtC#=XgDzSs-%rf z*S6EyDz8+nmP=KvsXPa9zkB0N#@VXpdGYmiQkHh|8=~WO6|VXJzTlRm9nJn;7`Hro zB`Q}Ix8GR9Qx*hY`N5ufNjsYR@sTS_l}B7F=?}T2?0%z;r@+sIhps#?X-9Ld7sk!Y zwE-z}p5Iu?Q(FAj#=pIgw4)hxVo4b73^+dLc(J5+54~CXX3~ykUP>6$a_1(8<+&=B zq$bx}#ZM2{b~IB@SW#ipVhIlO8`7V0t*(21qPC+cv4)%4SA|K7HGmI(L)uTSKYeM@ zh1!m$idCR}RhYC`pW;I@R-?~PNW~Ix;ZkAJVhOB)Thv#dZ^^`;jMV2IsaRKQZxtpjme4MKS-h%i zdwbF6^tneW)-~E!g-MHbJ|Fysj6b;!xA(b6pL?WY6=`1;CM}lCFUb;KQ}MUEv>i&y7u zhUMCI;6I+yb~JS?4IC;=TC5zx`VE<7<;s2hXTQl&Q-F@8fg^`6{tYql&1=^;R$KbqBOOZvhYFJx zD_6yG>osEOtgq&#)Jp@03X>M=(<+u=D!HDz?`uatof1m}hYF*>qOJB zew~)Gw1zUznHEO4s_vzopLbvR)jlts@|=}c9*Hpgq*&8W3UmKSVPt-CFP(cR zEtYI!K6#V7krqbc3)9`b&hRmT$o^{Y(jP7F-K}X>S}ggz{G^&HnZFZL2N&*+dugBM zlhWCo7DoCa{oJfmoA7h?WjKk8&_Hh=QO7IEdS%LNYy)=lbL`dL&0cN^;=D?hj+544 zCvL_A9@WUFe=yw~W(5Ik%$+u6Hm>f;p0pt-WrzNq0zU$L z>Kv;(=A{_A^*ZBJetIz~Xy%T2Qwr{!mE3JaS<7b6Dxc}Cf|aS(JLcXoQ#ZAAg?EBh zw`!c`R4q+{kpEy_DtK<(TJLS$vWmp)P zcdwWb@G_E8&zm%5?lke0l!z<)i=^In&zpqhSbeBk*`)ci=T3Fneaeh!Q@)yH7feky zub3TRK`&4^0baqR8F$Q^G3oB9ZfaBYC*7BhVE{P?Oj!?5pv!J4f$-#}sZ)N|1?X;A z;M56>4Ti_*3{<7(&icf52F!wy1v%&eJ~sCHtjD=o#P5^aUKU zl2uGh+_DDL`-jrQO~-#A<-gy-aYCW0a92A-DetGf&|~oQiL`(dW!HN}Ws7sa(Jj_; zc63-;Bni=Tz`$DrYWZkr%e2Uz>zJbqtwLaRQ373rhF@|EHHN*EQ8-KkxGYq$D5;eu z`J`gDUF5M`yHdqxLIiuUM1Nk+r4A}(YoQc{4$4p_b%e&w@P&BFIwwPM@P*RM@Cjc- zRyP?+GeuS`8A|0^Rv{URr~E19`ZdqSiI39DuS+P@s4k(%9drqA!KF)>3Xw8x{i}H}SCWTZ0!e;D;80-iopWl=N%CNv zWfEa>9IC`!UCPSOZwORM{LgG`$HI;~*-GomB|I1nuA{Vv!-H{N)K3rfJoPr(yHWx| zGe*Xy5slhM;bbSA&P&SUUfQS9edSmCj62C^ZkmtebutwhNDFfs+CgxX7w-GGJQSa9 zyPk=DR@o`1O@|DCkeH4Y_)||8Dz-~3sHU06{#VZT^m0?h_uiO9OgZ7vojg7<9xW`o zCO?Ts1wwqj4ww>o%Jsj9M+@@x;?60Dl;@iO;8P9|%8%aXc(qI4EL7+PMC!1N~Sl`9Tdu6c+KA-Oh_0tTwZ!tI}3R2t+=w?mWsa@Me5D(Ytx2TE=qp8Yb6f-j(&WH;S&a*)$=!XGW-NFqA6$DI zF)lc2m{S6J>c7 zmz)}(KSapZ5+a#ht+(Ge1nMbS|tFTj6 zWA`Dm>!tDq5&Hy2h*4U@xNvwNJAOLW+2J8Zy*1^SD*=_pxtA=mqtzKBwFy8woWm4p zA0;YQMKt!8*0RYUXuq*|JHd0%&BZQgXEa`#t*r%D9m||I*Icjk&raQX-y(jBmU3Fn zgM4$l+}YmdO+200yOTcFs-2~J{**FckofhgW7>>j397uV8O6oY6ES05CB@Ll-C{{`nQKXrbURU68H**wo6J52scK7#60RSHZ!*pe z+sg}xow<1Bf|8K2E?zRks2jFwY&(k&Vw^JHe zO4Rxox*9?Y39aK=p8*#3IJ!GQ49W?ByWL-giKGuz=zYn(NM+9jN4`-uC^GB~Ocdr= z#p{LL4YV2AeU&{7gU)|>t!C)&Ya$L~umj5jBZ|y-|cKCfh zg%`hd{}mW*ZwcA&q@b#-MJosgcETzxKbmmGd}d2qrl-#pFGnwfZI0WLP@T0XF443O z+ewf;S4<}3InnlY4V0AwfhwQ^08~mm3i?wvHsL?@TRiLy{G)P;= zwGZ0c*g23yqGh)d*4K8KdJa2HQv}nx0&A;UYsDQ{A+}OgEmKCoCI%gB7&i9COW(%~ z@33~P{6?p&7*#o!sk!0Ew^lZO|7L(a8TsyH4Z&h;aloj@kJ2 zVj{jD53B`aHg|kK%ms`6+zgDbi}_qUcxLpAV0NAAV>Z67Y!Oz2hez!7l9(X;SaqN5 zo8m+IjWs7`gZ1mc`s>Tz8(EjNct4r9ei3vOG1j%d!OJBSNuwp{JdKtX;nE1@m$)>7 z`U5VFpw6cj8bKA}5}tR4?-pDE<&yL2G~$u{TpICIc`h*$rTyx0X~gpeE{*1d@2K+~ zj7y`ri*V(rlzFJD|Nr#D>{TaYS;+W}Jf4);_qhqdS;>XjdM}K-#Of)5xb(tI$Xr2{ z#lM@^m0Xye?S*k;y`$o|!f_#bCCKnmOFu{o$KUnBxUob4ELTr%mX1zdhx`5Yg`{x& z3NMTsE2QFRLAu|_bl&7g3&+L8CMJW_C0|LF>pt~#h2u`5zKV_82J6Mhsh5sY6ZfJ= zxqjik@~eGP3G`Dj^JkvY+N#W#?xoZDqWjA4sg6gJ&o8Bgkr(M*_tNP+&&kh!35U|WrXV$^4qk*q>1uPx zpw}GAbW2U5XA=Y_zpuxwvgD(~<>#lScS?6Ehf*JH;~uLZd#K{&GaAEh$%qNr;bs2AM-Yu55?}UA; z*_#q6n_Jr`)r9Ut-q$B_ouj^P}A4?jx)XihPhY3~zb^|k8L z^LPvUIBU@laBwa~Xk<}2c2dUYW@1jk?IZdAW4^mYUHUHE8GLb@j-Ob+;VxTo(XD+Aj~6rh9~n(Vdn$!trD(<>6iW<)5i__d6$TO<2gdma#nYp~q8B zrv9@RCdZjzgqb0iCM;x>3wx^LiO;^5BrLwCLZothr#e1@*V5~yG2N-B?LAH``T68i z^2t-_WohZi%NI}bk=}4G&=%Kg?km6AXXHsfbJKiI%>&l6fE!St!C~p1PO|F?VL#zK z>dlCyh6~bI$m&q3Uexn;U1ddr>zVT!nH~QAb@I%)aDOFHTs|+W z;u%&Pvsdxr3Btnc506m3YaXFU*sQK*CWpyYN9L9f(YBIuvla`%iX4nRxPQyV$-b)l z*qe>{E_`4hbmB)A;Vn#^D-`a>u|=W&r}$EZ`NFJ4t8g`jTLf_srJWy%f_W3>a869& zcb#RI*4P!#GWo9XCST@LdihbZpE(RQC3 zC^dv&DKEqw!J2a3+tf~0I@2d+jgG=+hHo`bJvY3COV0?R*Q#fje9t8tQ1x6Rr)2A|KftADos%a1 zh5H{OIk)%WhlMc#VQ&s%NhbB_UkK6i0uF@elEG+u0=pekgwNk_A#{GUT`= zMFwbwmXHBgF#w>3=CHSUZr0+(1gYu-c4VI6#KEjZvVjm2C~OnY%I=w!JvKY5-xzMc z)o2J%X$A#t2J`GZl5*R&8^bGgs&CCm3zr4}L6U5(BTJhj%NB1h`#Kg$9MDV(whLV; zH$)@bm>?CuUYyJ~EjiAQ!<1NBGyCGP45764Ngi|{KahHD-P(2r zzAgaUTU#IH)fpF~;2GtXe>qqqJq2SiDd^8ybUln5H_dLNP!en_{UMg_jl-o0 zGwIJk+!?+$o_e4O+-ruE5OA6ybrmknkopf?dN3cvr3dq;08q_d5+e^fm6@L3pFO{A zo~sp?9?b81F4-=qSyL`|yjb|##Z;gu8XuP#i+^!)4DlEYM2-lJbnWJhr+nFoi#;6- zgvgn5`5p`1?O+wQel(RkOI7oKn*RI|xyqHn?Kfl=&BXQRroSXKV@pUArOl`r_B%PHcqqi&ou>+Y!q^JaA;YJKh( zm^7!*u1MuPiE5zU9Czn^>P&l~b0=JtKXTG7kP@p)XhJ zXw*I@KmR5Co}v+H89mLLP`6DoV7Mrv=J#B6m3ns{vcv8GcP|ORB@nBq)^4Y`3xd7C z2_xa;($sB{e))S(kGf5>93;ogt*z=Z9ysL@>LMU>QJ%6I)pjeUJ2*+P{LF?P_q1Kn z(BrFCR|8f~=3ZFU_z^_UpI?lMA{^2utq6w{3fZz{oM`Crf>nK!5t+j5hg?VVh8jZG z8L!qzWoBG%vc*|u5k^qNWm%UV9IX{dtiMV17r>P`@I!PSy+<+Z+7%P-f*+;h~RqN2Qw z%VaFtV&#{xnz$%9tWNSPT_f75b%oXpI1CY5l?@Px7tof`vzZ$!~ej8iCEydezw%qKhxW4sFOPIEGx1o~qy92%9B-`wtnai^YZ93MT+$>5S)uk-bK zH#yA-)go7Nn#)n|?ldPuO|DU|emjty<}T5mDbt*^xLh)+rPuWDO>^!TpI46T@=n?l(MgBMFMYmB?flGZn#p7Rswau$!BzV^*`c(FSu97jt zC19}d6%o$H?H`~5!&rO1#J636z&VrG0~N zTM2WE(D+;e#CrBAC{P}M@8Qipr`4iE7Ez00+X^(mYLvOChv^51^cC^^_=Jp5d`@O4 zzMxMiJ{dC{6`*h5hv8a3obzYnS<(0vl6SBR4ZLu3d~60TJKPccIA@P@v9VnqzFRR}t)xu_2^_8QT`tsl*aPIjbocSmiGt7&11AyJLMg zP=`BcuMesO6GMZ>p`Z>Qv^RtUt3&>9|FE%zmte<+U|==wFz!VCnc}OG zhJ=i*;_gs!#a%C9Nu88e2N%{m^$Z1?LjG80&{#>OJDLJb%C%LR%~+}HBh?GrTf>1w zC_XJaWb9@Y&kxFBTZ0`go}_7dAMJ64)BA$PF4tYCKS2J8W+X2i61)xQnkbe4E3Zx@>O> zc5Dg;KExd|>UDE9)setJyD?hcnz~+w4;lNtlA>%{cK1~VL%l3|NUuyI)GuA&{LHJ@zTIxB1+r!1La^Ei!{8#G@HHZ7AjmGs3* z|E7?!2YBuulDMiBaOtQhznLov!^cBrOH-{hnzXgKCT#97INfhKTD7!^({!qJB)^a? z#??*QxlxK~AC<-;Wpbjh3Z^nubEyUib9Vf~28kE1=wlu!j5UYMU4RMj$bd7q2F-&( zpemLfmf?1gf}c6M`dT2WQQ}}H469{9GZ89`wS<9{CXUHorCR1-&?NrBu(2U52ZNU| z1Yw^Z(Fx=NYRhy29B^L3#*Zda0P31l3LMMbK#@t}U>F!QwukJ}J|T&}OXB0w?L+p6 zVROlt*f~Ljr%ed}KbUAF_7Tb5+-0n>W4;iz1XmC@sCr-3x8!(`qwEVy28PYLU{f8% z3?`Nlad+4}8Z;U94M@m4!x}#_Ml~czR3@b@GC~Sx_79tH2Ah_v=Gq=M_k>N*;sH*Z z&kY+pJ?wbQ0R;|!h?g{*n+q$3m}`Mapn%i#%pD=R#yB1{-VfP3fSr)BS9b~g;1&UZ z%#c~z9RTWq5(lU~c#)oFK(&X=y26s|khxE4r91vZkRoG>(WwTCf>0R;QXR%+4!vF& z%P@}w?Jm3GH~^ra8%R?yvx?!*Fl*^PEL1zj1_sR)p~7$4~E-)6dKcwwLGAuwr zwRX5a@Zt2q8r=t!k(O)?2`*${=)okA4SdVUSYgM8FgD~Mcfc#GrXJla8Rn|Ok}c-Z zraILeXohYJnunOOgZ4(dgfXZl-Za3{tu8nPj7qfvJHuv2$UYD+=_63X*lZM3wg%+M z+Or{4Sl$ve8-h(hDpUdWW|$sJ!$5DmbpH1Q&Kzt5cC^<91L%)-81?Y>LlRse9fe-1 zuN}(BmN+4ML&#hm3TzjYLt)Gv=%h-80IuDja{Cw^B2{_aE@5bX7^)soNU!Sb>SQLYW(?lq+!KCk(QD}zhGMPex=5cyEZ0w?geL-U@{QyMjv8j`2B#9GrOepXnc~K7Y zaJ=HUAgF<6LPj};)o5J$6DwrE@!R;Rdoi9Z44_lkT$tR5`1!qfi1JHeK-_2 z7BV*gnL%TF&^|=n&y+@DZXdj`UJ3vf3)5EtW`Wh=z+s?~G2bk>e+cszSheD~%;FNy z=whgkt{(DP2DwC4eMnZ&SKH`A=B}{08KGbc4Oa*Vu4;n#;AB=v)sih?nc`GB8oQ_j z1ox`J!{o&Lr+N$05_RD^^C$zmuq3ys4ty+a#A=>Z;OhW^=>S34Zej`u2M)rw2nFa-tkn%fa9}11V|^GDg6$PX zH!w*bYiD>?j~L`;r!Y8(Jq*PwEiUjBw%=x24w@f7hH zWWnRd!sg*%fZ+@j91fY=sWpAjTo~>&*|s3{Wpb3U%>c<2v}%)sQODL3;DGKE%)uEp<%uVr%Y@in)J`Uy*l;w8cJHRrSpaW79 zf+5-DiarRCJcJFP&;dfp05uD0sB5Z&lot?Cou#JmBm{tbp=N-9utEdSO9Fq*g%$mq z8c|LTny=A?dtJQ@2#pO6I2NwH_Iw9&G|B;yA7=D~?A5C0 z82Y`)PMU1_3b(_ay$IZ2c6$3ThCdHDG%XmC0G$0M4$4m9)EO(Y~ zO5C|ha6x#B*#IsuH-QS&^w0K^L(JlW&&!#N0r`D0T(7V0-+N)5#A2cZpHiM7Ar3?c znOmhy#}%puy+b{;1`Q@J@Ng5gf$Hhcuuw7evQ4g^FYUM0?mo)CeTi2F-RROg3789&_NWGCLKPv)YB8H$UX` zp`Z!jJ+n{PJb?JJooSXClTE?R&?eBhP=IDaX6>~k6*k-P#RpW=%nmFWXJ&_80eQtt zT7KN==%DcibppS~OE=1RGB@BuyIi7c*Q8og$Ou(BrXRW@Ufv%XHfWxR#~@*uf2IM$ z@0g6W%yl9pT%vh`vxp&L=!i5MX>jD`ixTt{ZI6f;*y!x-4{U!hlD zbxwB?VIUD?mWOUyD_G7-$=GKWG7nRtkO>gk z%>F`s9+F-H8*XB0pyqoOv}6c~-P|ZW7lfXZQpx&iy}1f-45%V8awMzh7D7=xk;8b2Q^WnlWnBs!JFnW zvr(Ew)=rE}Xd9RZ>t)HTQluW$x#vLROC8?f(WVQ*QsA*&+MR zYz#iv__7v1{4SP>Pq8Pk6vk5yx3iN9X1g|M+#5fU$-=0Sr_tv)gyAuU7(-()x?=6eeow7B1(^ zjT~i?KrzuojHnLZSUajZV>vIpC9Fj21;*(9{l+q~@0!Ri)v|9|RVRwGe!xbWJ|iro z1VP-v%-S2P`&?>OC58kmF;}Zj>xfp*9}@gqG3msHu}KOYCN0VdYB7#F&`ilVA{}qA zv*%)VMO}Pz@4G2-Rn--$h&qO^S+)5 zhg64iyF}MYcWAa3LwyZ)JB*Qo{jh0&`;hpkiB`46;_-|jl~z?}(cDWchH}jph#eVL z>lhLDT8k>Gs+udU>Ws63H6q803|oO_jS~|7WHheWwZX1U_UQ47afxHXNl7G|IIG|F zKn|Kh{jLX^{P8S_+C#BLH`zD9&V((B15PJwQ5^6!VT6&vuprX}QDHsp8XY~ue#l4Yx8TVg+acSPHVc{i>;b#TN zt?G&;^s#CjCJ8P-o!ijuSBCBg;Cgqd^JB|c-$<@>6mggbup?cYG z| ze->{~n&T8%mt10wQ>1%{In+}tr?`#YZiM(|ZR*A3&<*74wI|)7|jqzgqX!`8AGkudL-92;8q*-ONXWW~b z$qjeUx&x0iV;L#&o!vv)C#4k10@vMBQd08u=5xVSS0`nJA15IkX^tpLN(lR@mUwHZ zwn!>3DpTcq`p3USLRgS)S>i4r`6Zz4Vn<>o;H@NKBT~Cq+n%i;Oxy`4z%SuahpN=1 zlKV$a7z9Q|ZwU%ENgG`gxl$hn;ZA^a@6%hFi&pj|kInzV;QQqsw=Vs1bPAVq9mS z_xEkl{p0fT9iiXdr_}d(!W?tLdG#Hc9#9ZV)&=wjw_INN3a(D;5Xtun!u;6@=jB_F zUSCPzEhmghkVkPg5?k}?YuxwK{+?RWDHEBiNes`T28KzkBG4|T@Is))!?mHfFK%&e zYAi2qW%839w_vKqAkrphBm3-+3>5c_Ay)kJk~=EhHPf>$3`zX3@56A7KYmshWJtI( zJ|?4UvmMUoFe3RK5g*e>ev7aZBEQ$h$Ml!q;`o?>@*9ee86v;A97`m>(fF8L`JKo) zPVzfGKIU@yoe&?BFTa!HV@AmDRI3aAQTfvNm?C){hX(qy@iEtSZH7coBnB(Oe}Emf z!fgLe)b@lWX0D6Er$~eXyFx~*u=7QHhlF7zt1p(-oujJz_gYx@*p=TIgeAGS+a z7wE=F_5po&*+_h!z~$n>ygC?e&L8gp68* zX4M&f7GZ0T)jnr8ut2sqvyyRE$;y+Y&NWZSlDfBfSk`>+1vVj-3mkx#%kr^NRhlLh)JlvVvy;b#B;z zp?Vx~NbjHtulTslLNIVbWSoH&q<4Mwh~WzxB%WqA4OS~lxbTewSfAO46ZN!s2a7~L zhlPpRp@evwk@H@Q03vL|qY-WsTuNE5ovQ>oU#`1#BwS+2l*nWnv`?^*4hJa8ksv%v zR&gweg;zy>yM*PT^4n^!PRUQWbn;1rhC4%kl*3#}9{C*==C{gk!@~N5{SMw1wqH%= zC&e;P!0eWFYC!l$1|2J$Ir7^bgmI?w+a^8W)ek8r9HPzS2cH&MaLAK$kRPlyiA4Rj zFRXv+!7qG2Y;R1>4@q8w2rLCOS@s_`c1oR9etUFJ(4O0c)$ZkYA}B1uE|uR}Kf(+H zmYy*1S&N?#wl3L;%;WX140$GOzmb}o5*@%Hvc zbAVJERd$=>;i!=ai2zABjARJkNjm*pV=II3w>?$QOXtz^j@(HYj_@yGAa=+g*S!}6 zT&2^f94mC>)QpS6CPDz@4KNATDB1A|f5}AQ<5PKZf)6hZbFT0=j4xN6qj&=VCtR3A z!j3@5-~yWnbKp79NrRQ5#QH=X8Nn_=sMXWlhNRJ69}+3R1{n?Y{)+Ji`05ZNTZ#qj zo@*Rgn0RHenH#b@5{mHp-u!k3Mdi_6ZI8+N*t7CZVsA!LLcNPSOgO) z;Q)-JjmR%48xRPm8JSfrb$L~^02tTn;QbL^#0>2yAA|$z7+{lONh!n&{K3!?#0&hP zNKsb$%3Li#rQKkcAwvOI5gl!c1ED|%`Ac`ea{(UUU3N-liiP53##dqw_a-IQck)lFJ8SvP46 z#-XZQFwoBE8V4Uunw`ARxDa%AE(jZ8a^0_cyzx^QnwA#xIys7>!tTH}m_UJD2qKKv zRTq#SkSNm#m>IsXXgEk~I!zKdgk>#8MhlFyiR?t7qM?i7wHiCLvJKD(MpAP?So4I- z4*oO|FCVWpP~5Ch?qT;*EH8j)keyxV1_U}K69Y!$MpR1Tv2pBfX_k3>`XkuQ0X$|- zWCG1*`jzRNEE0(<^n76Hj!V>?4I43Dkq<*Fkr)(AwDi`Jm%b#4+*`a`{cy!#XQ5$o zfZ4!U8xM~VEuuj-9MZn#D%`Dp-9cIKRb~4}1-+FxTh*IJ&C(Ob*(6ETi}aj3h|$ID zVV5$Ax4|mxOIPn>(u0l1A3O@2R?~ z7Bvqh4uEbd4m+%?JIM)H024}F{-ioppaRyU(Z|O ze4kQ{ClPTYi;?MbP#8YHJ@ZvPL-FAVenIo796qe(AH0}OWajD1w2Bl)7krS8j^6>c zAoQqAcLOzKCDc`@4SR2=?Z9i7KsBCGamO zTfE*^yl_~{ZA2*D4=0%%LT0DE*=R)l+g_Kb&5~w6+e{d=EK1jm4`JvZCa82^mH-rA zL-rPVQ4p+vdP1UsfrTL5Uy=_RgKxY}QX6ceE3qMw7(kYQ86yDND+@F}B80lUT{4kQ zMCXmc$*6%=L8%EMS$FMb!B0IA${=8xMv&&f7JoQL5ne{UB=lZy^MnWnYAGa@z@8mM zE~Q6;#8h=I<6O3iZjhM=u`y~KHsy-t3F#~3m!NwZ*ElSyB++Wk8T3#5aj|7LVHXdQ z7?Hh@0ZdH{AU!ov4y-0@r(mc=F~9g{LIHljh-Sjb5BsAJhvej1l(*RBWv{uod>sHR z9;E{zQR!d^(ZF5>)D29+YKEceRKz?KubAwwxYm&UrFr%iL|cf`Izxflp#5ez@DW-v zjBe2#GMF9($`-N@eGdxagc@}p(tdei(Z-_H1{rVaWo%_EJAkrW$UiU<&D1hHS~z)%1z*d?Srt=K5A*4x~PC@?n8AA_<& zW&<7-ig158und`6&_GM#XxKQ8f(M{0`YLw$RDoJlJ_J$$7KjhDz2vQ@iRlfsG#nM5 z_`Pxd(rcCO)aHvT@{D5|tY}_ehlZ=bW;90DCK_qIwRVhQE10Q^iIv8n83A3@e0yct zL2kVDHrqwX<~;^M0Fq%Zcx;WvSBjPtWHi{IC?NF#LQK_CB+wDqJ7)P~6R4maFbo={=g&1)h;MJmEhLAGXjD_EeFM^d3XE#0abk45?D2`z1?;v7 zeYZf16jwS(hBig8*Fi=|Cd#)b2_7UHhki!JE3cpfWLgdO7PB(|ZbwC;3=Sw#v{tKBleKtob1hO5w!)C#Xvii(C-eN7>u*M;g@4&7!f zm*npChbM=OX8RzTvZ^BnOBw^9kwkm;i1zC#D+Qt0HLWNMe)Uc-)k#|(6d_~)CI*E1 ztD@FvYy?~wu!?4&pJ;44UcJ%ZH0Mv|_+wKIKou%li8rMpLZA-~Y;%ZqT@Ufo_1KqA zq091%ELIw8r5a`a@Hm-;C}I`;RU;3ZDc-FE!DAQWKXF zSL0@rRD-^F4eg_9VZr%E#Y2yM6PgDtk}V;bwpv5F?2KQ^Krg5&wW2?7qdyW@X|PLR zCROLV)Q#R_EJ^pPy78*(W^XkibIbE!F=-+^C`9-Q7Gv}iS_Tkt!u4X*#Al9=mxIA4 z+p!5?csn*3oNULYVu3Fk>;>9vj#M4Z&wB9Y_YngNug=f34GS)o=hrMd+sg1yfNKW@ z&kxKgzh>Uq7LsJyvrvklxxP4LPtInRWaR`u&*t{S)3b%IH!~;XpD`q43xBVCDY8z7 z&6lo^CU{~!r=(#H3-)g@Lvs{-2cU}8kj;Kt# zBCsNLdanGlyC{3h&(BQseEpkOpZDgR{E@fy?J&=(?dmsR!i-;k@5t1r#vXm;(K1z%PFm=$sD5*TJ9?wSpHjb_MCoWbCI*p z_;@*cUYeXe?;n!0&yeE(Q{?P3khABVM$SGXO;S8DsE!w?Bxm8bpI*+czlxk)yWIXv z!kKhcszyVJ+t%6!7v^ZSoINi-YK9|c&->@d*>h9n?32|lAmr>*Pa$V_o4C82eeAte zM~0N$Sal>PYw;%P5zp#kn-*f29#-`Y@b$4CTRl2M1R992W9`q2bOuLf@Ffvo1YgeP z`J#Yi@Nbzs+wyC4h;Vz21Q5=C@FfWpd|5)hD1m~16Dg-H;J8&(2_C`E6`picB{+`GKs$Fc_d4!cMt%;#aW26rV21PA#&93i?5EKxm?If@ z+6JOkAX%ns6-ZSyz7VYf*;AL{o6b{1>^xir%Fl)A)8nXO!lBMX@y02a!cjRmKNd&X zZ~q;Qlz*hDCQAWyQ%M^*O_hW5bP5>%%%&2_jfh%Az9HfSkpT!_UU=og!4{^nuzQ6Y zE38uCVG3VSxP8KPOWgg_x4t#{l>-e=B(h$8vQO^p%UiGb?V_?9-}ue56SqBd?;zPE8u%lDgddpy2r@l}1_ zpR?qi>`x`08kBkOHAAEGtxKPK>Ddwg*=NYe8-Kgyrm?Gj_T|H~htGKL!S9vLp7Qj9 z{tH$t$~>d-yGOfTd8F;$aZh#p>c}gH7JRKCRh}&}%X9?<@%iVfqP(e66u_0dM2anv z>z?uKeo0l7Jzf}BMIz7f5mN1Rswl&~FcK?OzO7YJDxL4`_Z|I4QWeG7nCfhv7HO|Y zcz5l%X?ju>MTVDLNmZ1U+QU&r5m~pil=+R%y_-};S?h&yYw?`pBQ;Jcu$11g-AbyW zyy%5-WBt(a(W)pS2ba7=4JWCJ;wtzgRZ$i?vCiVx54rAaDqnO*W%6X$Z+l_fy!uJf zT!Li$hRCX=#c%u7w-@S@VNn4oC>VhkS0A4nOZrkSSylTDw+(Om#eieUlVPRwa>>cC z(!!k7s-9XyAzd*idFty_FN_;YY?sOjP)xH|nsd!0b# z=Ptw5V@U=ZN=tZ3F_b@5HAnYTs*jHU52))%${(Y!BS9RM9Z_t{b#ni^T09abO^?Tk zl;)RKXivLGospZXx-7N+DUAV$616a?_4DzT0SXJutCD&@GHOtLVxZb290P)#-mf_-=ip^h3g2F)o)>~{&`maEYUxY=$}gU6P&~P?&LL|Qjs=f z=g-0|gfrIHtl(#uyi3v!4W-v=-E?%Eyjgzal!>e10yRg>*TkG88)eLvNYnC&`DRRQhWu$ssju}O?-Z6#5DN?W+Ixu1=) z!_O{#B+}GCW#Rrd$IL^rFd|0OEYIPlTr^m`lp>H0PY&d(Xpfq86g@9m$lA^(8-b~t zGGP$4@Je6D*72SlN!0qI_N_Tl`v#ilP$aQzK-8W-kWDs^@da9e5f6M+#zLluGoU}8oj&;_>H>hv4H*gtliFB-s1_;>r z`RP{Htj+S+Y0(FEDGeFRB#W#_qA{0xWs_R(NMdnBOMze0gimxAL-Z_ z3v7(pCyuBqKlw z2w6)(qXBj}9f?RP2V-z{*@1wY4wX+wB7rS2Bp0duY_aEyeOkkB<&BHTVq zwgSY37nB;r3LK3HjDw62ulK8mWkoi6Nj^A-k=SkAO~lxjRnkm^maH%B%IbG#9#QToqJ}Nb(J@xxwf)$Gk!dYFA|pF% z@n??<3lb}@NCz$Z<_S?dG8uO#Zp*SqMs2|=C3%+p=n}$5ZH-lI2dk81@cn6o`44?MPTnc%iG)cc#UGS7l_SpRfm4ucWm$GtC8Em~+!z6SWsCflSlM@qv|lJk+PB zVC9kDl0fs{^-!=Z(}l;N@vr6@ka3>c1S8xcjr1!=7#HHyxn_1%>MR=-I+rXQ`(2+& zPpSJh4>z@LQ^=>7LZploaMVM63Z2SO7&CelRug( zuHS_MP_BiJe=qG{`5gku^^pGY;a@3ERsiak`1)5o@v|%SuiyDS!}--ezRKQ?!--$% z=2z*2bIXyb)2;lUUeWgV=_`XDzajLQTth~_(wSV*3Pj44Jb81v_E769zai9`wEH=O ze}|9T1NVAi+;z+?j!zGM{f5wP5_acr&bcgUAnZ0TOpdcvAlLB`63=hU;VH2W@18O; zxyBWklPkH#yW&aFV+IbN51%tTIa2Ac-F6zYupD?!zj1XJiw*bxXx$wqv`jP*Jr0(SFuh=jr%As zdR@U9;;Yjp%`SJ(&XzSr>RHNVU)ikg2Ic%Sp<{rYL z5_LjNnmcRi6t#!pDzhNDn)$dr4CYlV($!){tek13{=YzfTTV4oM@VYTQ{DfPJq(4{ z2$J-!*Dvt-e&_f376!DJ^qO9yq%Rf(s~#ZCM@~4y4OieS^mTNfAmyGHIWNwSUd!aC z>C6kiW+&l3a>9D)6<(EAzV{`)i_!h(mP>dcD!qdIBIV&cq%f1)5E$F-x>7ex18Se@->TGl%b+azK;;*=iS4NFdZMAOC{^$ zrD;B_ab+(?!PRMdPju*RPu8HRyh!<)CpUE)=hRQIUU7DQv0gByt=)MzMb>r|&5q$w z)?EKhB{9lIN8;Cr@poU>=BiGk?0oxR7fY3c z>=;Sx&0!;NPS*yz*6P*HnX|F@{LExfpseCd<}2itJ@Im z^&v1jIT;SXx5_S1U5%l7FT4hF8Ydz^K6^%Lgz_2Ef4_fL3U_%*{Z82>SoN0{UM!)h z(L=hRb5hca&$P;E@8=$q^gdyGNmxrC1wnNdBvWG*=PUmdBl!_Rv~CBJCEH(Bvh^AK z++oB(?Bfl@u-p1HWcJA;w!as!!O1SdPH{bA^UK*pADhs2UP{74yzpVSTSz$P4b|^!VA(8zT68Rb}LT8`I7LbQb2^djgaEd<4$?$$0C(|YDW?5S{W8HaFX>Z zCY;K8a@#;}&=52vdFvtL!Vs;%rhB8jmt|KgkUu{)Lez_(U_6<_I5*A`>GrfZ?RXfKmrPOr5Ocw+b-(bAfRm}n!#@h+f&+P zDiX$m$C9WmU~YoW|0rG=O|`3D=w2+7mJK)c1( zLX3k(j8}CE1yKW@lf)ZtiMH4-3UwaQqr!gLO-bZq$GTWxi{-BvXBnHL=rF(V+Oz`~ ztG$25X3N0j9hNc@x!B#3B3UM8@Wf+~utn`dQMf~aI#lOlu&~Ug2$m>~W1Izx4mE*j zhi$~79f&0!v;$h@+bA#w(aAXyXpj0!^CQNF7-yruaOLM>`$Y`Sd&F2BwO2~cQG1n> zv-XgjDGfPC1FJY6Hx@V=G1o_oRWV~n%s|Ckn!bRtIXP<&$yxjY+k}TIb#AuMRJDvv zQKP|n;ic{NLJ_{pJG$nHx?IaZQMQSssB=?{Gk9U~!Q7QH(0Tz9TSd*OS=6YD7#*C) zC)rvCZQ3afuEL7nd9*fuu|RvwKBoAK+oSA0j2X*f#v2%fAaHKv#iHk|!y@@tej6gF zO4Ey?=)*n+#cbV48Di#&NMIesiUw9n9~#XOyO#K5iy@GDVhxWPyX3f?MB{ln76D=b z%#zlVb1ZP!@|P}%VvNw(9;q3$?#%xZMFZZY)9e+hBq#-wIgzyonM0v%j+&dTz}g6= zP68WXW7As^V{63N9#gSs?X_e%JZd&-4}h#w`~vWYSHs4P!p3A)iy7}lj1v)KhxNCg zjve$z(Qx2BW;Dcr2AV;*E+jx2GY&UyOm^UbCMAc z+MHx|!5fbSTBG*fDE(%x!HP^&5EHD^PRTq14_#-jJtTAdVu7s@;nc5>1Xfx8AIXdp zH5i-gBhT;tOV{h7IKw+BbrknvSxz zkemfK2o?mNQ3vq@tMIkXl5G?TSo@R${5=Dl9%bvcLP5Ea=V#mhc1W~#@B>pyo$1b~ zDgfCwQ3m88QFC83a42FQf+4T)nTx|C2AN6c(BYh1q;NRd3Kp`P5h@5K?^sU}qW&jj z8jQ%;++fxG>Bpb?oahOucaSO402yHpN+Ys((BYu8gO+&^lqQ7>9E_MNBTP5On=yma zj-+E4VXYuCna;Ea)h1SJG_Wgb?<4bQpe`DJLT1q@gNiwWndAAZ&T0I#=qRao@PI%n z`3p`5;7Cb4bpA8}`O`Rzn2w0KmV>W2EhA#U;eTQYss5c=m3dS|GBh>Cu%``VYKi(6 z%TydOR?v6W^FO@g?zN&P#k)q*xeVH~jxQMY)#yi^|1?-8e<{KhHVNexfDVpI5 zYQ&^YOXQKRU*`Jw@1-?#7b0Cl+M_&xV~WEDtx`6EY>hP0`r8nM6-5&Jd&JCTF>{qd z$}K%(n3znw+aqGWZuwtU<0@WKB$H$l!wY;bD7PqTyrc4ZdWqy^?1>s}3e;MuO~PWr z@t4lfF259A&5|46|M1C2G5sx*_15;N}xAu`B?;iMdXvMe#xBc8Mjmkd))G$pkK9@lXTw zNzO=mhCils8!$jesBE6^d+SJUd4n!T80Xb9xL z;hY#J{Wh)DQ&SQ166_w4?&8N;ywVOa^SHbx4ge+Z0JN3@Q!0a@*2F&g{!lcoR*_NT z5RKfake)#J7Vw3FZi8l6EKR1mOg^oERK-sfE7981DvT{Y&I2)v89#m!O&!;!B&*sh|UDEj^+52`Bhl5v)^ozVZoCRKMCqd$^Fv4IBm0Od0o3J%2HE9)ptf96`uUNT3j zIVJ`&P;~*fA5m%<3UrvCi+~OXkl;mvxsiyM7e`GRY=xSDpfCB~7?UOv7@#Yqupp8d z^fY}4j@_-NVu+z;Dxt}JH8%^w!@^2b@9K&8|FT6uS%N{j3#r=-_Q+IAkQP~c#DAn9 zTH#S(PH0Q803`VuJ;v#?PI6`Hl+}cuI>kdzovZ^6QcYGDqC~*pkqKUPFl|34VjR{j z4)MZDPYq8m*+S_sbfW&>b?7l#N^9+m1~x~G zkAzr9F+kC+Y#V@q>v+rRgVoD&JuWCF`WLkD(<%kO;0Q>YBT;i@G{C~>L=3$H$ZW_w z7RWK9jYWc>Xf*&?=xO|<2bL~3J9+C zIUSIQn!vKGLZd=E0hEMlWl#a3%s#J?AdL^6kyR{>&jM8lAE17pP;sKN;Qx_ehp53S zo;T+>)oLYHiNt^Qfqc~KHc-JT>*A7POKP-1|2C{H)bCv7nW5Uqjp;?{<{wZ zV1W|Wb8pJv2|#Gk+nu6aqN*tcDvk!W;H{@X8qN6xIM5bwAlj_}=nKV?4*D@>ybV5z z84L*2pMH0^MrH7OskzFd7OKpHC`y(}g^T)(E`Xq6;DDT@R@5PM$x}!Q0 zjMIp*UTWQN|WGv#ug9YoQ#0Xlb3aL z^l}z=-RO?gW!;$gcXzg{QpGyqDoN7`Vj(YC=;;X+@ZPPw1f>Dq?mVk#hV_ae3B>EQ z97G3eNqQL!zt-953NUTylsv?qKctn>?5yI1@Dm(M&7Bdb&?z;?3WLSk+6|yB2A^+T@n!)6HXb&Q0|j)E>TWRKgOBrd)br;HZB=rd}%Y>qk^-bNdmO z+T8v*IS?byMyd`}Ms38W{yBM;jR@60BR^`37&SJ~@*_&ME!G3!Er?*#rK(wr|F~Q2 zkQIS#nnK#`6eq}?;k$$9DCG+F_xVI7o8kMe=elWt>(_@pDf(-|b5)<``rXNH6#eyC zPBR#wu?xhdcit(1W%bl?odP`>Yz-Z(I7ri>xXQ zt422FerDKD?nFZ`)2fjzy0;s*J<40QRU?~qx9q=i0B-}W8rimc*CmB_@s?xN$OhhT z-}sk@dCRkEWGnC4!~4K<4CY%kvZ?n1>$%aq6*Vs0NT&JRO7*U^Uf0W2@sk0a)Qi^p zW@%vB*%Phb`lVYu#XKcQujV@%dN-z-rvAKT+)!-wy9rYf_m7J|yiUR_URlQJ@s&6u z!$6%3&id%E!}IRsSLN&fxddzbtk7f&k4d<>2t8mhu)YCT+4|f~nW&6yReK(=hHaCB zt^29f_!gCdtx|B63iFg^UT{(=v=HW4+EtK7r4LTp%*-7@9h5<9>qEkYXwX^DTio{K zBtl)!o#9)|GgG;q^!%22uHD{O7fO=QlcGwgl*-d~9eX=r$7xMUtD5N~bjG+!|f zqtl|b75R9h({ofX5RhwhT1$c$6STY*sFe+gYDI=%*Jej78y_3xg(JLr(FEVCC2V>$ zk=mUyS|}yj3Zl6!$%@7?hP|EL?^%mJ%3uraw*}^^YTsglsp{;N_3aisofVQbC1W9I z@w%>ND}G^0-jZ*?DJ~YMyaK~7$x-jXPA^n~u@gVZ(U(wF{iN}}k{ON9&wkNJud&32 z`1>@zSOz#4?AnNZrAXqP97kTJJQ`xXPN3P%(Sk#qt-&`8Y#ks~`X8{BJimnJ_Z}`CcL4BmK5rSmD{$$!BXQ}t(>%Ygd49k0 z{Ql_qZS`DohIvq>cg*vpj06o?kXPXga+ixJIem zVxHe^p5J26?@`b170+*#=Xc!m%LEVW^hV;+d4xT`uX%nIp5JdhzyI?5_IQ2=Jij3* zuj=&VEDxPWiRX8R=l8JZ_Y=?WRnKpW=ch;owcTITNnI7iZk7>daInGzZi~B!JCA!H zcP4iycMJ9>7tnlZWF&jRQs~I=v#E4sxF(g3gteSPM}}9V(vb)QQs_wZ98>7XaC2k$ zn?gilU|=cqSBok_l8ky`i+uC^+u3I#m6S~$ukl4wloCc$M{nZ_bGuetoMTk}sZ@66 z%9jp{Wg10gf9}_-7KsTPC}ODW%Q}B}LX6q)29I)``SsUJXo?m2H2l<%fR`C?xADppdMr zfI_me0t(5>3MeEiE1;09tbjtYvH}Xp$|_Khn*QGbgrcoM3s6`Z+xTyHUp6y~H$Y*Oy)0wi>^<{& z0~A(VeZf6T7eDa@-T;LszrX3x-|sz#m5B=qVgMlx6h7gCEA1qrl%)jz|NMpM<~+r+j>)m#5DOYEC$JQjReY@9rIOTQ|ybMnm2>Fx@@{sysya>>d|CW<|jcR#c2cCm@F^FM#|gxE#dG3AeOv5m6y&-1Sp`zU+=@b2j0 z*hu-@RS)(TJ1JBB2cu#u#mFD^lGsam^xr$ziOrP!SH|}cyD0;|cwm#*PRahwv=XtO z@|m2keMxMn)HJhQ+d4Y;hkbrWvTVkU1C>d%Izzci*1$F z-wEy!`zrJHOqnk>R(@6U=S^Z~<@lcul!~pD$yc6tz1Uls`%L?jVsmBx$f<+H?n>U! zDHn_FmDZOZ+|h>pl>zrP{8?b>Y1VrWjIH?Kh1uuL{q0@tJ^tgd6~A0wF{Sq(&OY)=#$#XTcmC)h=U#Qz*Un#5 zk#X?{^S9^yAh)sj-=0}j@X{+Q2lRgB=hsHh&i>i5yDqr?zeZiR`jw5#qo28d+VP(a zd*HVHM>l=;nc1r+oi}0hjo%#ei<%D&NzM$X5GSw z54*VToHtK7cu=)&VZ=vY^PKdhMt(zfC7p%q@l8L!Ik|)HJ}->B(`~#H8CCB>eM->mRq+Dj}!5;?@43s zWOJt=tUK8}qvepiGIKcnr@KqlPBz%u1mEu|vbF}t@PU^c2{@ZMOkZ{Pn`$Q;-qg4B zFn6*UqCJcH72~u@g4)T3RKpC6UOQhh8b>?)?6TTUuN22#K@g);Y3lB1FI2j$c4^nE zu)RUW`sUHzpz5qWy#r$HIqYCir5YIhS#L=ys&j46VUj`ho`KP+9@5g`U^>Rh@3eTt zENpw#NkTQ$;5)n)@s8X-QKQ1_I;bQ{J23{|Vny87=LrqNf9gRm*6PVWrIB5F z5guWeAm%z`;~+sI+YzFFb3Y;d3AX)%zy>}dG){j;qmWwTc`SGi}=sr8N7^uDfq$rt!@#Z7=rkIY({n$FQ|cuGE(O2|WBr<;Sj>j9ck@#h+H)(jIW_U_Ph&CEGluJwHEtSoFtb?Xs zg^c%7`W~YxQTa{%|J8o3>>Q~5T*=T_$45A;&{2fcT~@mag=~Jb91wkW3M+4xV`XU# zRujG=@BWrTsIaQCCJ^Tz28Y*kV*}&j;P4Ee#0KUj!qr()AU7EVdji>T_UhXSDCm6~ zY#)Wv=^3_k+2F;Vr`o$0yk~(U5k$mFs0TvW6%}!52*KYeLZ2c8ho=bjLMTZ>jR+-6 zs5?SkB$R|uii8po>Mo%!2=$Oq974S$v>%}~38f&E!4MpZ#AEUFD_Z6<<*oyF2OtzE zh~>8M@qQon^@kgKH(W#{S0`mHsy*4aZXUfKY{VAX{{7+|0?xd#klD8r+f~zvP+&ra z?s~!n|0+42VZCId{dU+E9Ghb&W0!Jw4cufT(PM>wJDi|n8~WN#a8LqgQ1o*HpX4pZo9FeHZrye-hZ&!yErPTiT729;;`h!3T2Zn%K((;d1C8?h^I zXzl3bIsi{M$d9KW5kASq6U}=1bHE}GIG71c=mlR?Ie@{x_2-^~{czP#(1X4c{P3IJ zDE_{`#xC;8hfn;F>R7k}swqx#e}gpf)FAHhiP!_*y^4OS_rQTdaHR{58sN`O?HAt; z-hkl4S{MTN>c#K|KMbDF=z8aCxOss?sFh$|6+Gq8fxzKlU4rE25TGeu_oq4j;xw=p zuB#wOxZ~W6J;>?z1`mfjk`Kj|(nsRoB7Sgnd`oa;ZI8*=9-mv>!*>82Ezu1O^0?Or z7e#LPHKU^|7knZq=Sl6Hhv50l>ptQc78fXhgPa69V}lDW$=7`NTCYdG;D!rabHkz7 zubzTjnLjrD@Nv;e$Nz^j=Pe$48Sv08D~y$1WjV<&w$ibJN7+QNU*{i9YqjC>$d zpWqI>z#vDveeQi;H@r*LQy`cG-1G!%A!&zw?w`HxT6k-L+%QWUz~7Zvfd=n1Nh(M6 z$Pfz1{5Y7MURdo1cQiSk`CWX@AGlLH+`&^+;lKz^o#5sHa)^!F;|Es9wm+fwQ@3Ps z!+AJPhd+uHE;tQw@AUbk@qMgyTNs8Fnnky^V&Z0KRZO63_O>e9muCE6CMGZ0t{eMH}Gzjr-?g zr~LTp_!f(TR}OAh!Tsjpyl7Rh&V`q}aGv0XXCGv-4mnyUo-dH2kB~YX7zz|lGqQYE?|5II4yC* zpS+L8p$=YHl=pymZ*@}KqS|+F>-se+5S#7ej))L9-G@7|-Ea^OiPBxrw}bC2Mz8UI zj-ApVw!J9r&|UanqZZJ?QcWjFRStYl;Eq>GA6%Na*ZL>GE7q_?dTQf#_3j3^+Tfo1 z@bUm7K<`#?JOJweQvh%FLD+%VcF@RqFl$IuX(U7l!sOrS69pE{fV9K!8>FrV+9;WT z$ADiwRmb29C>aGu?oifGkP|RhD>zG&ki7%3#Ev=QDbRv>TNsE2Mi8>DwUWbQ++c%5qJ zgj+(WVlc;3kP)cr4he?=^uyiV1`&Q}4cPxaqNzph?;-0up_=ew)g|DI!$-|9uMVH{ zD>_H;uOwtWd~F<{ctQ;`poS~If$_pKk(f9``zJ2$*9f``bR^C#u{5OVgD z50=jTp~u%FP_>7-!58yC!q>=pFbFm)o+-g7P!r+w<}gfFFZh&!$x00P_QMZOpa6OR zeTSPHs^eKk0$CCj_0Zapj(#gtO*+%9=K>UHn%xf_&wL~sZ`9zR0v z+Bso?euURL4}6anB+)X!k<%y0(i+Lq1Q>gY`&!(AOCI-j)LAl|JfhCf1E|WtcNg#r z;$?=YiAU&S169G6ZxuaJz&IqOE~aP-4V#u3N_ zoF1~FWoF=cZc%L(OqG@wXx;lRI`E^{4k#43O082qNRgMdJ~%0X^?)xGj}P_`evX7c zFgQ@?dW}cuyFgXYU@>3N;94~Cd(dpt^94P?p{J9BhL|>VMF+8qkUt+}RI`ZSQGDW} zUnd94_8Uk{a+8r*`# zkj%iqyWuhiJZCcsOBJ**uzQJ3i^tP`$g9Z2+)`>~cM+`h~ zAVcsH2d^;V@(><|AVRPi-+@`w?P10h;tIG0%g0zbsR2AK;~rO~QG zL&b2yaxUMMb<2ig@$2w?1Mh;vpy@^GrcRqXIei!cPtb{Zpv)oD)3w-osmOyNa{c6bJcoNH~C!K0~633%}j&EcOIoW`24$ka8{Ix zPRE3MHHLj+Q1veKfa%<2yU%sdms;y}Q5@0B z+lzg6V9B77&=DA#-EdTcGkkBMzu*Nogq=xk7S#^;Xw0`_2jKPwVhvjiSwue2>La7u z*i!z?wkVN3Z;hRFu!cSj+9I^uUn6qL#^pRl8lC8>7!$3Z^PqCn4WDv&N0~L0E;h&E_Hnb7mkk_&e zcCGTJZuPmgBAG7O#uLS%A3caAYi7M@%X%kza=$uZbg3`{s|Q@TsQ%E%5w8a8Tfwzm zqrYByi*V3cgXcn34yi!`+zNW;$BEubyLlKx2mdiq7xWrQ%syj|`)jya^Puq(b=isj zyY9XiTD&23l_*RiToVS+`E~z-;fl1UzfzUasKP))f9RZuy<23i<)Zp;o_KV!WDYmc zKSB232uk_>MfTv&^_b7SjyjV9n}!Nw=O5jn58>_%svi_<(*^9OwPA+{z54^6`RJy7 z=w}C9_1;rqTleIEaj6?}T&n_Av4IJD+@CwqL1F8`h812&*}QJ&P>4=Pq0sTEi-PM1 zUGP3s1^VDz+(T>XUgMeH z!@b2npY5#64{uw0&>p$=!D*nY7JU$y8VpkQOAnti2PF=AQ`s?se=)Wpk{*;e$>m*C z`v{C6N(ZTd@6;{YK!pysly0E+zKL$OP*;#wpiwv|JmJQVJvw!w$$dwHHdmPJ1d+{gPhhoapI`HS|^w z=&-2%e3(N#f?7wvQA+f{UwR3JIfSpoBPgB!3sx75n4uW3Konw4H!uQ_eAdf-Hw5;m zX98L^*u!M18nr`usID3~qJ?%~^*%oDgMvGMknZJXvDoOk!eV38@tM#0sTc+dBE(L}JRq;9Q zvg0i_2KIwCrV9<>(VSEm*rTv5$Sdp&3?ZE3HDE*r!+sR~boM&eYg&Raz1i`^pmgQ8 zu!DSn*75X1Y-tFQi?!g13_`&bSP1H7n%Uh%=NFazqu%92gQIsjp~%wb)ce4(kO7zf z^VDDc+gwnEjjjXe@F90F=D)%lm~{9s8eGNJ8fWLv&RRN#V}qQG3~q%9R2hW$LS$fU zSGt_*MN`oHxeq`{C3D9xW)Mx0o(!ztkD97{ukyAMH`yR?z(5PazDy#t&c7di{SLa| zW6o6z-u0k12j*jt1BbdBV91~@+tGpZreYqUmcGmBqx2vO1$D`2jU2uT8^}k%akw}+ z7Zy@o(8EL>Z;-(lM3WpuPow}tKW$_K_t<2jrZnsbt8|b88$FD}nOBET@|q%j8&hxK zxKH$^3SGnb=#~8Hbz%mg4vK?}ZfEmNU223YRyBM_i!z}7qWZ}&ilR7h>S`zsT%T)- zgTWRRC&%A}K@2j>+Cxub13j9H-KLXt_7UmJ8d3wzk*q?)kyVUi$<{{EorB&~^zHV0 zHQm_&=3?6G2jmtL6-~}BM1kPSca0Cek~z9Xi?bP>52Q%#X}zfKeV9nmp6wV2LnCzU z*~<1M2Ms#42dy2H7TuHyiAu}SZGv8*)m5s9c6ve@Qi1hRT8{qJ4&*giwbSr#2Xk~3 ztuq|+qBp@zv)_Z7qNP^~1W)Z4A)s%>aRS;BdI3d$NV;Y*i&owWiz)Jd2+GAVxAb{1 zUS<7D4~&la&`4w0JpuX*O~zQ${{=cj@P{6hCfe)%fHzbVjqIUIOBGLoL?C}Vys1Z( z{v610Z38FK1OFaVbr_s~ZC4_Q8d+~HhfeoS)dsQ!!jue~M>m{qB6Bh&=%3F%t*Fld*S6Fnt{_|t z%k&{E8hhFtTcV|?MJt4}&xrvYROc{Cg!)Z7ZBcDcm`CY@q4kCqqqRV;&;TpNK`#Zv zASlk)P#pNl8-^s=LZkbLyisw`uLSo@FQ2@RAw0ASc}&E7B^cO4)CR5H0e{d1$B#L# z)lf84L@^rwuSI8Sq2d_&Z}g^OA`VU7PB`mki-JK+d?)Xs;20Q5Bn|FiiUU)fka_kb zbfrNW=nad~e1m%9^bN|6jAEv-9-U?XG4bi$3H=tR4BJGGTrfj`;UIg9n9!P!F%4Rq z{od3X4A@-3RMc`1wTvDu^rg5Lye^}y5ar&$*-tpr#M!wUJwS0?4`UhI2E(mqU@eh6 za$1L5)LC-$Lv4=5iH4<-9-94Mve%DUMJg|P-vDyf0}a?3@Kai%R%p?5&BkbbKIo{~ zy+m7n_N5-gARX)s=D0S}y=|a)C!9@7V?%4^-o#Eh&dx8P)7nHw655;E5wMm>7&-hz zw4EM{T^J$z(dgGobMrIo7J9m>=PfP(TmW;(v^V0eKDCEYFO>yzkQ}hU$QA!s!6w=or2g`%*pEK{Ys(5Z#8w1cu>{Cu-gmeryxY**Or#@IKw5*ht~ zqY3v)3_|dJMl&_5;nO?FMkU}wdsBlf*5D30&YW_?TNmUM?}I2QY@AbJ`}XFzm|2<} z_T7_V^w2>x6oj2MDhL2_mQ(hViSI68q(k=`%#N4nnN)CNStUSm8)CBd5% zB&-bz@ca*{Av8CTF=P-;w2TN~Ydn~o;fMfz?-elBL3C)*?RV{Ew_l76n%P5a_t667 zIFEvf>~4d9sX?CE=56sgG3`%Q;blgW6MBMi^l8)+F-V&+ptGupOqPnCNcR?Rw~!gm zH#zxm{-qnVirqgc!yMXL2cJz5IumZg0!V!p^8vh$kcWiSYV*(#t32;t1(cp z2Ns1BgPS3H7>0?p@##aE)wD(IpRK{%KpYj!KY<-w3_H+%_>Z88338l(*DYx3@j#yw zwW_x$^lxGcG;Ia-}&~g|>_Hj8?{ym## z%sIh<^ahG9=j`^d$)dmJRp{qJxlXST*%mV z%2H`gG*a}5y5eHv0|)2rpk{cP$O_x);aJm$ z9JnNV-vP!^%`VFH81BK;l8b1bccJ(&J?OS#Vr`ey zb39V!&<|PM&q`jWRq}*1C5LrXd0?S#Hd9{ohz#55f)z(M5ndokWCa_~xmI*FGY{++2X zY`Zw73-U2l$9(=ne4UJrGA9dR=A3J#hdGY8;aY8&c83+u+>ntaGmA zh|fj$(e2!|ZU`f^eybRI^w)N&V$6(3Ki=!c5c_?$A~Hsl8E=`%Qwc*|FkyvcS79=S zPl6odRU(=JOspVHIA(8$?lH6srkbq?#!&t}7}xt!cVY$%U4Hbqj=)yKOm1X9KL|5O zvBU&)Y7OVqU@iCt8I2L&b|*O?cATSAVh7bm%glKuP|BzdO*3ZtDD#|{UX7*!>fm$j z@o}yV&l~2z&McT%Lg$!9q8^>B)Gh8U&d;5{G94I)E}a(D$s}7{EB6=9&+%Rwvvy9% z?0#ec*6RocK{BO+=^g+2ROtFz*IGFAb{#^0QzY{X7)f;fWI&IOcSg*jl`=8LX6z7z zjuRH>FLH2GhaooXILFyy$=Ua5hdOtE0`}pxV(J=9H@McOuH{4~CvdCceV9{pHeh_F z-j{Ys$9p4AY$3Z~J`@r8WVZp6v71t1H#a#qIJaVCUJHJ#5CiP~$m>Rk^@E-f)-JgC zAkJGQVi4|JrAFcOyAFwlz{3LlEOojK_DQ`M;*6EnHQIzR2NGvLol^zi|0j4kNaI(F zaflxcGlwc@M_`;eOH$yFW_c|tI>)~omOb?#$MLko%q0w9e7bj0kn>H*BQyg8RiuqU zFdl+_D;w>0Xv5JhW6faB3GEcTj$_!1N>)PE$oI|eEu4j>6?4}6nRS>}7fdUsh)|U@ zt!Ox*`_yXKKld)@CwPtJTuD2O*GtrmHE!&dxQPm=`jWr8K2KfgS`U+p$`7K8fzg?B z8wa7P;|R5G2enp{Jn|xs^O7tn(ub8rH|~J=uV06WD=4#6!ftsInqquujw1OdBq2|J z4BAuCwZJI(M}O6)KG#ui>JG1KE&5(qYfz8~b-_zkbdlKGppBspqG^E+q92Rb6fkwL z1DT70oY2wi0CLH)i9x_1f}ZC^J+T)G*h;D4M38J@=6hUP&{Qffb^v1A4<*2;=LAl_ zz^xNj4B-*2{CMNc*W_qfvD_mAuh5j>Lk{ZjQUW_C@r9|hb{jANOWlgDC*HjI4`Zw* zuis-aKZhN*o`osJyvHw`C&CH_jDCDhYz0(IX@*J0+jzFSpYSb!uLqof!HpYw-6$7c z1f!D*jbv{&4KMt<=U@pEtuX2yO%oQaAdQus+#B&0RvN2sF+qem5n2tr5t6>*uupS1 zEB}+v^?^6_7q9CxHnb}fu;bL@cn7_X8o3@XP_XX7eJBPURVQA^Lt!B%+vKxj4~ zmc00w$Oot;w77U#j4_HA6E@spa{jYE=NCwBe@;w6hHx3%q3yvN#JEL4nITg4R5P3y z^BCHM7rh)1VH|_`I_Z^RybAeEKv7|yH(<)hQ-FRC_Cb^74;^xx`v68gI@ch5Gz2oM z!}QsIKz-Kaupy{%);m9>xB=>NH=_H9?LTTf?feC?{&qQ@d9gYEd9j|$;{5nK=ou9c zmv{bA@t%2!+z|`4-640eZ$q|!USf{t>ZBb1)kz+FX9VA9_}mDaa(TS6mduZTi|4-r zUs~^MlZ`{TP|db+2zO3M#xGXeyduPr;QwJK_$nknfMRBDW1-H)Oj&Zrr+Jqoff}ge)Tj!>_#G35zrS64=B{OFgmQ|KdFSStp z##(cvSujgHHdV~bFr6}C?RIl(yff1>Ek0(|mlKWn6pCMQ@URN3iU~jeH`aKEuH8Nb zmHsq-e^;M5h+xQC>-2P6hR#G0J_V))KbOHl;TBv*nq2EA;?4$UBv1W4n_ian*ZH$D|KLgT<@t{Up12@ZSJ%3?N^`j`}T|fnm!{v&tKyA{Rn%9JNMr;e;ORDibIV)pLU(~8kX8> zJ8-!-Y1_w$I~CI(M}GA{C;M}YcgJwK*y3F=>@h4p)M8*@{3H7ZddAAGON_ksCHfMUZNe|9wKups(dzM2tgC~2lk=<3z@r>=m75yeg);A9nQMk5EQ`fZbtlTa ziubw(ccIWhMyIj^%!zPx$~T!R5m_xN6LVMYp!Uemv`04g ztZre?3I|HR|KfgN7dDDvH< zn^)>|FUz+Y5%HO?}|7z(!*2H_pNJ<%2g5V@d5&+#8WXH zfO&xv(~Z< z1Es?%=?xGkEZI277k^|W22SYUqXswTS6{#?Ll0?B+cUW3#lS#pCRm|m!5heUGq^Gl zIT;e@@)%OZVDymJ6MF|n@#rz5rywa|oUkoI5+8&7evl_D+vp7>-5;!tLqd4l4|>$7 zyB6zu+}p5k5Jp(!^VWoA^$E)`g1{WY9;|xY$@~mKepol&;P=ViK2mzDFq+$4E7~5B@_wtHDm^6p%phVg@E}!)=1z|bi~(i z{IEG;*~)}vc;DFoW_+obk%9S_mC3<b12Ws%nE)p2^+hk&OU`Qs{3u2{E!m=OnP{?nXKm_-I2O^zARGO?0ROrp954?%@ zj2HlB8X|#7>F^XRBB2X6xJco~B31}@Hd3HWM3U_gnHUu4ax-O8l!L4Uc@D^h7ZDio zlP?etfe3~R#44LWKtG1$V!DmY2qrB1C}9~!hkGFpyEJ*o5_upms9=d&vf#x=$OCu* z+j77&BApsv9$z3#PS#Q+M6x#pMvN4>rf^0m361|Y?dcFL(@tzw1;P7m@M5e| zjmW%=&Q1&&2ScU{MZ&VJk!sYC35fP%QXiBE-A0W67i>fZY{W{iaiy{mm?T;m7%@@V zhyxMWAo8GBs_;P>2~O^bawy9?g_?07GAAJuv5<)x%EW5jN{NvODppdzWNKz(V90c= z*V35r5%5-S3<_jq(nuIW0fPhEU4znW@Ioj!Bk11m8Bq#7*M(x6MJO`*liE;@L4l;l zVC~Q{doo}pF#Q!6GE2VDScUZbbqUMXK`QYyG)S>2!JRPG4Qv;8pjDEF677B+@1+KJ zqTSz$V3#vpb(~db!HKTcYTYGTDy$(-W~;P=ZPw<%kV-s-UqNAk3Le5z+MW{DB-WZw z*?@;srlws{LgTU_e)|3$t@ar2Rbt&2BBPC2@^*z7exUXn#NCCsOWu&yede zaVf@)g+kM7VO?04sm3f+%^+sS6@>WJw18<)F@5Gp2`8~#5dvF z9G?T(k^tsN4oD!*zfJzf)3>#4e&Z~322>w%DnhE~crr#4>NCCr7&ofB|H0nmrQpW@ z2i?iJ|MTu-<^Q@n2`&AfbSGg*{zKhKST**beor$|IORXlorI+~`VRkAcM@&Q@9R#E z`%iTz(e(b_?j$+@|7Ld*9gpAHokZ{F_jf0?9@OvYPO>v-h{V6uon(jfc(NTucQR8c zM&#b8-t$0vVjo|GcPG(5|GnMGG^nZGbNJW0lf4Xc5uqOyU3ap_@3#{}@b>ffbtf@m zGz6kK8xgTPi7_kX;dgW=lmAoQ$)w-kolN}qyOZ(%lkQ~P|F}CD`#yC6lihyL7=dv!3|l-M9U1*!h z$IdfZhC>o2ytS{(iHjMF+Ldi#5NO}J!4?!4JErhIbe z-e1@4y5P-@%aUq)9PM?&In(|)=j^}7);*uo;mo|7T0Z#jz>z=R^}_?#dd9XH^xcOq zPX5PVyF9l#ZqL07zqse;syiFvdr4LJGhr6Zo5K4Z~qS5MgYq*Xz%Brq0FQ<%2JMZ1Y*8^ZT~==J6G)9^Loet(&szGv9dX zp9j|;nRL<#;7@~y3d?pyx!!F7K-w{k=K*1uN z6WYD_;yE`z^2pSqS6%hM!EM{FdHLCA&%W{JpWhvvm>8RskWlmC^UpuqqFp=R*!=ts zg%3P%=HJgaBX{O0r!09iIl1L&Q>Q-k%k0^Ye(Q1#y4dR-mAHBHKf4beeD}xiz4z^y z$&>%sxOeY$e^|H9(==*SL2R#HZO%IJ#DOE;eDnLuF1l#lq1Rq}xr^UlwD0b_zo}fm z{?!|1&FWJ6=Rd!2;#p^{`7R|TuE$ePHRN7$$^F3=EpA+R!wsK4HG1@YD;gS(wEy_y z$|o+ou==mZj$Ksu$3H%O;i;z%zM@N)R-GSx^iSs>I@A>Z;fMP#`rw1v?~NbdY3ROv z%SX3uyXcPM;&B)3-#=j8lqo0Af9RpF7If@*^IaEQFudZ)C!ddd;)#+~FTHeCean`M zm#$g!%C+ymKkJRV?kfIq#*A&Rop+x9nJ>RQn*5i)>=`m(K!WGob1$A23|{@pWtUyr zcFvr~_I~tHpIvk3!twi^-CxhlY}x6wGn*$wRK3FyWFm3l==` z<%kg*9((xVv);+e8*_@=J?#3eTl;<=7uTZoV~_pgx*KnNGNnU@`j5JGTf67lYajml zg%|b?{Powr4LbYmTb>*`bmJeLPH*<y*uWSp2a zY}n}2v$96a`P<*hHeY(_CyUCP?%LO{uMYZPuA*244EppQe9s<(2oY?b&na^_UYc;b#A9lD>uINR{1BLJHP*V`}Q~8GjU?_ z+`76$X+QmRz5lO&{bBr`J^eRTRDAJbpFa8X7A{PA{Hw3#KJv~x-(50){*~Pt8!ud0 zSol$(ckfl-{No>4pQWbeO}D<|#B03&>PvabDc?2n;QtsW-)!~~IjN*BgnBuac+4E*qT4JUYs~Fo${L<1nGYcn8nKHYgWSYJ~o3LZx zh;fBuZ86ph@VIqF<)oq+mUsHiz0vQJ?pB+&rA%x+E?E6i~{u8sjSmuo|CFlmL$ zv@H?HMErfgtk-Z{P@tZh*$+YEScuSWU?%f{IE?iAcvOUTehvQ@0+UWfz+tB6wv~gD zG#HqA4M+7*`O9FIjN=-FHUg7NHNs)yvTOye!i~|u)KhV+IFF6Z4yx%!V7h1~#Y`{F zw$kAV;AkJ}HJnk7zV`I)1#Sm0*y>ac1D9#bo?|@jE&*nzhBKb)&amTFiek!st=E?g3m?# zp-4D)np=pp6Du)ATXmwxOL`u+tsK2^b6g}`ddT*IdLq{U`U(*2R-PNc627brm96T% ziG<|(MqX8a{V9X1};l}D+Q1}3b!(MX-&eCTXFF=b;`S(lIC8m-5nf<+m+?A znP4_tav|X>lj}tZa+fm!(&S>HTy9`^TyD{&Ns3-kgR&Ry#pM^Z%JH|%4O|+R7u*?x z1*__IU`V2(9D>z{gOeLNFb(aw2jsu|FkO4AdHD%-v=KgeFNdN<_AW_ zd8@rm`9(EM-RIt+e83M4#BQf%cFb$4%UfL2I4o;hRf8!U-lo+)#GH`hKe?e{M0Nc3 zq18#-a~IblSMaR8I@hmP)BZq0(`tW0!^+vm%?i1BPtDRz-h>Bgym2*E`8ffnH*3R! zocusuoYxPRlCc}TO<0j%=k2+^SJ%4(7d=EmR1LNfT2u;dOZ(TdWO`X!T2mFD*R(Eg@iFHO*s|a|d@M9<>0wD20^&T34Llq3&zS`~`F#vt#5S~m zGvLK5xTMWH-aEm2C7taRpez^Tr;DP^bhIRED_iLbiUN`Gxkc@C78^zdvMziT!&1jq z-I}OHOO7P32edNi zU9zz%HMeLZlx;&((BD>5H7OroyH2QcuWmR1HQfp|g-<7{sVI_NP1`oqvSXo?@-BoT zE2T0Mb9AfX#dnZSFYHQg;F7qkRX3cWXB^ql1+JDfn<@w9`Y&MtAo;K-3%cZ1UmWN2 zhvp;`w;NjJ71f|PwcaKySJG_=hvOq(Hl+n-;WfS|g20Aa;Yl9e7=%cMfdQ(=ETq ziG61mbS74_38-E7CaDCi*;fL?MrSB~x)fRk22X`UpY;JJlIo2*aPMe1$yBP`rn=ms zRk>Mf=Szd18-P^?#h#`u;OTB_AAnL!(b$XUIP{CUF}#o`7a1XGM709P2AmV>M5T1^ zo5Bd2WlYR!w;-N{ggf*=>?#XGkO&=j0)8=04!c_7*X`^dPgN5P6*CH_RLw#Z4s(Lx6cwROFmMpY zfzs@rea=)944^72=9mVDIl;h54;~oj;8~eCvzvbILj%UC2?kJ2on2gvIIHuBcjQ{1 zU|5JNK5P1|8-6su0|*)zySi^DZO>zv)~O3Vp{^EE2dc?8>B9vJC>Y7x%N za_ywACYa76<|2lNavs4@BTqOuo{4d?*rd9x|BMfnV+dS0e&q>==@_C1K{zoB zaj=UOh;Po1anxf$)V{O z;&Bbv9{*#U94zu#`7eI|Ye}Mj<$^LDL&On;qXT|1PA1B7wdt{bwCNb4t%1>b z_%bj&lJJXhCQBGDfZsj)1mze4&nl~$siKpNa*0htB)iNpPFhnQt+!wHqH+uYsyUNN zt3>EeGN_ae!08RJN>fPHp2RjBWb*9dii*<0*~OCINwa59(kJm)SFlfNjt>{|SmUastfCkyWL#I3 zDSB zt0+Do3?VXzRW8iL@K9x24TMyOc|}WOT$NM^M~W>`oCGbx_eoQ$%8DG76@`;3%G}2M zWOK8V>FHU0G7O&*oP%&UdZ#%Y%QRt>2TSbnPydzK$@FyFmpW9^r*V3V0UQ);ZFVS) zJ!k#k?GJF;9f}K?4dd;@IJKc3<1o^5XW71BBJOlxGQx1~KGx|bDr7D&6T@(Q)2+D9 zz*PcsM>wtz*lrxeJq66)!*HG~>vSD)n}GQ)440AK$4E`BlXSxRbfE>pVU#!BW1HS( zdDDRLh2w1HCGIj{%0h8&x3#!pTyF&C{xDpYZJL$oy#P#27|z|VFYf6F`TP+u--hA( z_Or?X`9izdSy@W6yzYK!p?vNQ%*A224BNai)4LKF^d{vn_=nk3kBX8ran-;)8;ZkQ z0Bbo|-gkl77=}wv%e16N+*iQ-9E$Vwv!GNX))v!T-SFdK<}b6KwL+L)KVb61aP|-A z__&F{%nik*XLv%>yA7Bp!f`hK@wsmRvnCYh&akpYeGW#G6{a|{n(AVvv z^>@wkrrQLN-We1?G}a9DD~cef=QrDqwC1#igf($=}_;JR6F0 z!*J+{;XnEOE-)X3;?g~~2lKgmfcYgH7p5QWy5J26emo4mxYNVR(I1!*VYsZmR>9(P zi-4IMhI40ymg6>Ho({wH3$x?Pf!Q36%dn=$VtxZmi&I$&YdJD(&n2!SFzzs1AKPmy z;(WkN48^7QvDtf;w-OkCI4(>t9|7jIP@J7DqL(Xy*%69MPYY{5egGzxuL^Kj>doeb ziSm*ROj;-|y-%i9-&l?uU@i;8^-Z(#nYfw2+!%(lRhyLKK44x5!=?2NP47KmJ_^M_ z{;YDva_k|7F9UEGE&X^~qxL#zEXvV6F?rxihme z43ugY?f~ZLFq}KxieovJ1G6C%m)M_2rKn0&D{mr@^n zQ!rS?kB5nKyF>X>m;#x`kB5PCdpuTyz;fJ@;&42U9}feU-ZxA?UQcm2R^!LRg6q>q zMah}v_$&o)yz%2<;%sUzfSd~v6Ftc+&jX9IJ2 zIL@|_0dZx(JQ|Ag*u>P44cu$M9Mo{JxX#AD2-ZzU5G4~vr|2_PjKGndm>7oRG+WOo zaGY54M8Nf?=R?a;gYbpG{iqx%Hz5if>!UbI zTxkSc?~HV-8Fyqm;ky^Ozn(2wlPSC7mE*c|6h=QsDhKm-a}>A}fV({koC~cozCH~jK%9=pm$6ac$d@akz?}%(#0a?F8TM66 z*}%;N?j;SY+o90?V<_?;1M`c9gIJ&(*gWH}=7h4tGp z3LIZQbdG@Q?Xh(eC4W7EE77pW<4ZfFcUOe;Lis{{dol_f%lkqET<<>iRb&%^dlR@$ z+8q0D>CqT{9v(D2BJq#;n;ZexyN`VXqio=20QZ81Jsw|@fZH4?J$Gh?wSSNc+&3XO zhh?={e)Wk!IMj>THVA!*U#z^Np~GwKoiJaeR#OBb0_l6#1Zw*YMN09J5Fk6T5mS8B z4#Yl()@-%~mC7c$@R$vo=f_GRJDeh<;GGb9{9l7V@vp(3{MX=5+2CPy@ip=rRb80C zX6nKOHd7ZSu=%=B*r@A5!K1DV6CPDvnDD6T!h|cRvzUl$4+ zUKe4q^=-7}F@epL#{@Q09uwGnc@#FhJjc;<1&>;`On6kXWx}J9Efe01Z2b^zU6{aT z>cRvzQx_(%`MOZp@VW?-t%K2)#{@Q09uwG1c}!sQOkJ43=IcUX!|NhUwi=@?j|pt1JSMQ2@|eKp%cHPSl;>!) z7ua@*-U@f1U6G1 z6WC07OknfnQP`03T!JN``YP`ASfHJ}2gPtKZtPe!4=cjo<{YJuE-BO}B3Sd=r9P*7 z3Nh}(Z}rB%x0@399m!1yHcZ5F;gsCKtR7g`sS>*2L&R5|$N0sWu~nmT1KDx8fn2WS zhNmfqrngaN_sxjha#C+M;sZul)2eNJIsw^V;#)spCmNVh+~db z^Lr;ks^;EA=+9<{TNeJOsl8SM{r`>|j>Sh#sO-D=NK9qN#Ydb8OCLv6E*7ohpJVUc zyucolSWlX;gvsYtpTrx&(uTRYfmXQz?UNU5%F1Q17kHO124Hcc^O_5C`GpJ^+(Dx< z7Fq)0+Bi6%ukMVK%#e&G`=z&lx35BN7l0eImW(hOMG`NCY zrO_c`8ZjX>$syNFgUc;d8s|hzgLAXiW2E&0VW!c~NTYwmG@{8zzL5qO zyOH>DkCDdx5+a|XImpXM2cOYeQeurgE1@)mPLxn4LeEKP?3lt~V}=yw4I4Q+Z}?cp z^hp)d3n!IME0<95l){-6(}0ccI9^`xAUQ(It*5Hr50$#m`zd-v$p32Xx<^R7e#z%{ zl+yAE&r68BI9WpE#h3Uw9V2n>B5~sodO0e1 zj?haI0&hqAMmgpb<6G?VG6z`6-PUK9lvO%rm6w(j%_}UK;wURGD=KyrVeKc@j9%?1 zo?BU5MtB7>^xKDDyL~*i^FGr^JWeu0G^k*- zchF^yisGX3vMCjgnI)yACHz-3ySxI(=#Jy%UZ*}@?)Cf3`)?g7$GJ()@Hn2(==akU zEbOe`C!Zo6cWIH?k!~W6Ld!IAk8_{pjwG~7K>1W9psXDw$gCYD$g>c-0Es&ta}hFy zHe2EzK-|j`dIh0D5?YQBCu*FI4LA>$xUC2&;ogssQi4W=RC;V4`Spj>k&N?SB$S4; zQi4o`3?&#lW^7^J@WCS>DYHu^l{zX*W)?dp6%|#@o>Vl?Q9gSLqRXaXf$t=w{@aJl z_yTe~slj9ANYws^{$u=TfRJm1Oqnl`xJ<;oBB7B8jg!zggkF^pWPZ$8@7RJdT45?D zRaR9vxE9(mby7)b)$HQJlCr7g!2kAv#N;?$8JNc@@XE4t&i@;uAPvnCBlQb{56ta$Ak1MZC(Q{Wq2 zIL0?R&ztWksi>$bp55%zk+vMam4SIi22|UY28!z?jv3&1-sxZl2Kh!qAakUN)1Ht0 zHbgX=<3n@u$GTf;WTR0Y$!y$WWaF6xoY2jlOO{7^>BPJ&`2nWh*y5+TLNaR`Mmvhb30qvO!5B>ig~-^UFgY%&CCugJcsPk9nq83Y9JR9>|%$+Tsk9i^H#h903o^A1Fi1Le>}c_Mi`QcIwK&wGsl{Jo0x|c*SU(LQ4`XyjBFy~o_)mUC_pMfel)e}z2XX8& zPJX^B)BK9=pn*xzhCnB{0K!3znp9^EU3R0nO-~yGqf=cXH0m|HN%dpRx<+%Gp791o zr@E1Ed2#TcNpD*#qbgCOPbz;`l*GnwdYwh2D)clHWse#d{3bfG~vmWE@ zj5Dc*UvhbS^DDY542(`STZ`e4%1&kZiq633R8^Wd@;#%S%KVD%Is>Cq-KE9Ehf%4o z=n(C=-@xcpr)hP;*PA8}S4T0YsJDljlQ)o`r_x$56u%cmGrV-1W>b%Q3EtY7n4l=;pE z)lvhaQ{Ah@a0R+aMQ(I4s2(yfI@KS5=D~H`CKb7HszLRDAc)baf?7#Wvr&;7rx{fG zMoOm{RPSgdRGf(Ax^)>oQjrU;c)=2Hx+1_Ps0HEA)aVN|IG)d^ZDQjHuo zX_DDBjH;_irKQ}}pi0(ax`k17GpJ58FnSJO(CVVQP+4WZyFvA;fzhc}Xfc#xv%Xl% zXBbp#42(|oEYLj8#LuK+EuU#ny(|b~bgHcyf6lT|v6jy=s6IC^I@Lz4273qw9=?OBxho(9!m1EW)o)?&DN&@30ZakfD<&cNtY3xVcAEjOvijdKjD zn*>3OPW7@@(q1+ya-)|)^}2!4sh-nHdah7expA&R^%n!9Q@y203sx>6hgO+C&!BqG z!01#TYB9aTsCpYz9~&5*>SImj)556I45}RlMyJ}R#kj+$+y>Qt1EW)YrqxBdP+4U@ z-Jtr?!01#*v>1<#inZ)9sG1CnP89^2M+ScOTFx-2>IFfJPIXYL!9F%B)^Z<%s?osc zRQt3Vw}H{A_=123 zKO3=gBg>%TJP400gBuB2>)9W%CKb8S-=I3l!069vsnz@WLS>ct^9`za1EW(d)6yAW zdltDdz@U29!01#PwU`TRROH452Gte=qf;?wJTAn~EEg@ng$9*Z5X9(IQ?+`($VNqO zTx3v{8W^2widOI0LS^Mfwn253fzhevYc zc^+(g7P&Flpc-OebgDuvW{8c7+!$g|6&o0x>JZR8a`CfsBiEohA_!u1sx!5c=Gmyo zjXZ;@mx0l#x@aZ6Sg5SrxY(fTYG8D#DVnVtDpb30rcrT2!j1z}VL2Gv|EMyTR6`@?w-lZWKSB?eW36(dypw5MNcqhh%( zHK-0)F+x?OS(0%=m5nnK{`-IvH;pr>uCijZ9d`l3aT$IwPL9xdBv1Kq|7AjTUIn)C z&z6racU;aamu&fo;2B{$`m4pU~E)H zLZ#Q&t8ZN1vB;!i#|MXCBy_e`7gKN*+A6+rv5tBLZt*zFgB`bLZ!>b_Uqn#VVZ?X38G+ZRMTx# zC%y8_BhxKZN~8n>oO&Cv5Q1Kq$pzsik?O9hL*5t;DZf_J{ zWqFnoM8VjoW(bvDuJ^ZZt(jq=Qi3QL8&#=LX^o9@xq<=Y?^1GQqn6JxxZV>{I$3;xzTgs z#fz^s%C*;uu|4ZLp=vKF;axzh&aUe$&r&ik7#r2~LZxfvr7xe>^?D1Hl6k>Mx-GQ6 z#C)O3##yhg`9=<1R*dag3xrDN;p?y8d1!&+a?_~s3oTSi<`?2l3~xJfG_EdUj3I~5J$6dWBBNYGtr*+0ZWO9^ObAEn zy)W*+(ef;1u?1tJS`4h&>S3RcCl*_%l%@#AMzut!bRORD-N)Z7u}~@L6%4cDxKOK$ zr9w3kXUgJtC8z&wsZlPU6=QqWO+uyjzOvu^{OOx4&r&ik7#r2iLZ#c@?7FHuZ?;e= znHLOjSWKin{T89h#+edD&fj9>u$vWQdzN3Ql5plR;OWE1{FY}anHP-Q*PQ~~imMoB zuEb%i)BnI>#yA||JL)mEyRIAvtBlOhjfWA_i9qd8nCvjBY!=LhaqETwv5IO?Sj-q* z@D0qAu$aQI{G1&2^z^W&r-sG6uJM_fRKX=mJs6?I)P`aH6c&>cMwK2G^I}-cim;dm z!(y(s#f%&}XiUGt5;iAtsEl;CVa}UcQd+Ft|Fy~CnC3J#$axU!E>*DH0)b`mp#26`zJ*4N8EKEv*9F;QEo*En zH^LT2go@zsTu*k@7Q3FCzQb_h4ZZjvJrBEglg zSc5ZRcdXp8-wfwa_9r@#!}?R z^-0Sr^yUv4F`8F$6N^)QL$GSdmI^r<5&>@7Vhm2&Vy#@njgcer^9EhUC2Ay=r~Af@ z^$j1BH)1$rBnN{Bju?^e^GbxJjJDNG26$lJSS%L9lG-6g)QCZ2ePNLWV+Uu3;D-2y z`$l{7^Dg)0jLjS7BfSf>>NKcHy>L2vr(su7-{{fU^|P|D zc=qh_*%m{=Et%DBoz@yRW5d+LycJU8wi~R(kO)+wEyk!sTdcJb%^TrrV85pq-X0su zF#BDd1`Oj3({@ftFDaaAjVMW-1?67QJYgGVCbeINM?uAx1_Z&C0Nvbs@hV^HQGIDQ^wyJ^UPPiU~ z+|-3SBsx?RLT>9+PzAXIqg_}&`Kt6XEM+%Yh5FG7hYkrgM4nYxG}$gRdK0U~Y84t1 z%L)zUsfFM;w=^-Z^h_)?_G+-_3AJEHnh{!>qkULCt7^?6f?A9csLFEcwO&{D2ZY3G zNrc2|kFr#&{fXf>bT-+VA`4NNC|GjEds>}_P}pPjXM~7H2uI;|-?A!L>tkQaPS zFg5C3p51Qj+M2?HKIqPsZtp8y@Cr%m083>Vo#DuV6i3=b>vGP>D2F54kydlwp4sGzle<_J0C-&}_rN)|Cif7>e$GG{khU2(ga2d8u2xa^K zSPYGhX~UyL9cSBvRZSy3jPYuF31@)ZW!*)i_3!=i2t-#ZJM9Zv^Hu zZPvp`FT{smEpYQOs=tT;986Zy>to+m_y@!Xfq6xn+2BNgdaiBLMaK!KfWeq|8rlH> z9L96)oAEjdFg|MlCcC4;b;CbNFT=iz&tk+siV<~cvcehs>u1m3L%2N+m=-519H$&4 zy-eHYn-1c}1M|;NTwmKJlY$#{3ckn0kB6R~>NKi2o;l1M+}XTlDAMjhDTvRF0+$Nh z^eAvl&mRSjD5Gmqx`Om0!Q`P6a|iQ`B{{>Z==9bua8E7 zqkP1`j#`gMa=`hT_$Y8RE8O+idPGW(xXw}FI4N~T6gZY+K$JLN6gW;n503&z{ht^m zZgCVi%Ke`s;ClD7`=q4&Js*NIcGn8^)@b=&9KPWAH8`9l9)P2^C<+0QF6LzTcOU?;qA9zncGj>d|;w+Jrg^^eqAxXHDWYZmcS; z?vn9C>(}vGY0FfeQSK>u{*^v=Q>4;s9wnF7+|Z$+5MJQwbN$g63{6DL7 z0{EbQQ{`uQ{uTKeJCJfgUVUtLWX;jA!oA}+x#)vON>wBJ6LhZT%Qy8Y%2S*8Y14rE za~l49DxRR2-4!9l?A{3Z@rxDjYqv_M0Ox>&rWv7Y5V}p`h^dy)pKw;y^CCiCiF*@g zRXst3ZkM>#INu?mjX0|++lSDd5_b@1byxF|ImUDe=HE;oeZL`sc^aR8hX}HGD*y zJG`bfh_MHSa#X53A5IXDn?ocAXX1RZgwDbF4-#S-R89vX#8+ss;+#%VjKsB~7>AI` zeHg#<{cH36kljy0vRZi(q%GI~bDqCOa=#oM9!JBOk@7EHG*SEg0+qZg|9TX^Vfe*5 zD1Iu_?AP8cam=R5K6PDXpMt0;CL(0XwD%IL;^xykT|NB9RdvesZ?@$frGb7`7&>!A zabFBpWgnEvZpeU5ftFizE8l-mmE-Wzn(TyoS2m0cFSW(W>68uK!(nEv=J~g3i9(-s z{WSF#+hWifu*zZ`J#kjN%0x&BYBoYjP+6JER!&DqiDCsp_uv;R=1%dH3a0Gm9}!ZV zd=eo=@fU;?ZW%&~_kTl3dg#`<+Qxmj;e@|atYBbu1E(rW@r8SZbjIy5_{BO>a8^u7Lx|n|SXs__uY?M5 zR@t0}&~a=_KHZzHj4U+L%w1#TLvOa&%2j6RLX+p$gb9(|S*$?SNWJ={h|1y{MH~?> z5f(ksDWeq}wnG;FC=H`tT_P+v3unb3zHd}g!}?cJLyR(SS0SWipbDY;@QZcainEdi zVwA~y7$GGCPa~u#UNvyb5mHj~9zrSyYYkCvDI9A{@sKGf9C@v9pSKtj_H5%GqoRa?AEM)^P^T zN~F^fdPw4i;H=okMnkcgjfSF_h>&7mIYMN0tcb4a$1nv|Z7(B40grXOjk99&`v@tD zjR-v=cemkeu_oa?$YC^Ywn_jK>D`=ar&mRObst>8pKwj(HSD$+eaFhHbRz&(5BItM zVR2c?9^`ISlK~6URSZ(+83jPN|s*=7%D72D7oI{7}3Isl)x7zKslETeNRtuqlUsuX@H}R8hjxXK^FXU%&S%ILx*P zogz$FG6vCJI<&pPy(xr}wFi5=H;t~gb$mBm9PeRORcI>rIt4y#e~$m4*Wc*VS~9n8 z%I6-J@4sQ?8#0bhb@Fj3XOd^wad)onNzwos3_s!)#(XT2MmI9<~zF zQ3xsVABT{l;DA+$>-7i)@QZakV}vN`$}+7(hz&@rgSO{!34MX{bO}+^AD7T!oM%Yr zD9(>dh+D8cA)(8R&}~MD+pRn)cWV(+IbDsA%IOA#R8BuL?*7BL+klXITBC8d$++9H zg`VdQ2&t4$K}e;Xijd0vxdTg_zt-}1(UL*GNo%Y8K^e%P1yj!DWkb3YJfjRh)xtj|A@-b9k$ecL zBIP5baF-&aip1U&+ibm+4jHAu*4su_?}2;L4ivIWqxX7MgN?!s@GiWttg5Yd;R0uQ zRV(~!;i&8rO;O!V4JX3-%T9^HDUoBn3)2M;y;?GvinD4_*&;2JxC?N8TtX9ZR)wC1 zkSa6_tZ3&UqzcXM;-B#QKT>G&G;*Q2Oe)s#?-g3n{+}&$>~RathW6hrw4#kv=-G~{ zvPqLmi&HAgQ%cJxO-bS2WF=EeiY8SS_fI*aqV;dwuZRf1mS=N7oHC<$p1RMSo~9H} zom5p?S;(-q`A$X2w6fyag?yguhg0FuVnAr%)&4k+^2+Ie%0)?Wg=0#|wBm}&3UgN} zY)Yo@NTx#El#HPwcoBwI+u6lMCERAM5R@e#wC+MxST+e8RKbm}WCfeF6&6jOR8r=c zGYNYHku#;`OoQU65kKKT8 zz4d23Zea9h4FHA*^A+QqqlMmh@3!Tw461x$fjU1&MCMThhM_iJyYTg zs!;|;r+Pt)aRD3SESD5v?Y_*|<1(mTH846Aw_oGY8owCl*Eq9W*qETJ+Uhb`G zn;D_OCR*c$aMyRxfA%d|{rP!#pINLvy zA~s4qKu8c80bL2;9YMU8FrG!H;HY(~p z>;}#}CfB--b+hD935Q^8RNa9!Ki_=*&3SN}=tP`)mJ$xZ*r;eJO{!a-*!ANX7Ahqi zg0WGZDOA)29#sbytvJ&{rG!H;Hmb9LHMzl$?as1LDd7-|jjD%@s>QT>p6p?vQo%qtNJ>);0`pJ*J2SrGgo@n2H&NWmPk^ zMDVYL12NL=)8iy&R#nAxJwnURlVQ)A8W!_vSj-qB6+O=zZ295se}+*>Mf*NwX`83$gKYWmu-HDSmG6>~g-lje=Hz)Y-VRTkMV4DM)y%ql?uKH_DxalH zwXViR5r>Tc95k8n;4AMf9PWsP&cG~45{akUN&c031WIM}aKYhdNlIHe$T zAuv~JIGWyUcy#V<^J9)USm5cvJj)>)j&Ar7XB{;$p5w@tZ5T3-NNWo@O6?d0j*mMd z3LHl*=S6|zsBK6TxDLRLj{?WuXn7Pkj+AeT0>=^2{ZZgJE_p2q9Lu{Q3LNY6t0-{f zb6h-5mg9K!n;Hd|KTx-8`S+K_AXb!_EX9CBSAa*bi34S!w8_4Ogw zcn503L#}MsSBG5B4!I5$DM}LMQ#l%8i>>^Cu?=uKs2-dfbjsF@DH0loGh0NbyiGq- zLg1n-5_QUQ&t4Mu0M5*sQ@(Mdlsg^Eaqc6bRXAr#Xe-X=OK1XWe;9edUsEMt7N%g3kitPN zMn3Y+RC^R}S)=v*sEp_@3^^)GnN=<>tJpA+q%aY|5;v*|YE>(=ijt{y*Zr1U{&z4yI0Z-S|xUw{Am`OKU1&OPUD@9y`Ub7#z{jGGIk z;`6KO=g(-Un5*|mWxg__b(IZ`bv2c|ampndAhQ|Ag)s9M;J}wx!DuqEt(LarP@=;Da6LbqV%%H( zj5t@EURtpRjW^ab)FF5joy(a&NystHt1wm`jaO7uE@+TrVslj8SX1A)U_osi0*KE? zq2YG5x~hh`^Fi!+*h|6|)zz~4XtmPX+_RT|frl1?Em%C9)0h9vgW~ZfZ0u(tt}%FW zDYy4C-@~}Cjk*jNItpx~T?!g&q`3T*HM)50e92 zoXn`jUQ%p#*b7)^y0}Itm(T>bIAP3*a#}`r*M^<38gg75AK-*0z{MF>PLx9wUD3l^ z&eelrNufD36Pf@Qr&c*pPL}Atcz8ox4~m6rv|@!Oz?BORwE|CygN~d#TMvqbi{loY z&;+>neRHB*e$u5^)h6_ySh$K5D>MNvrp+tED@I(IuLs4#We&}RCcw3maIp^39lZLv zc0DLou6)4?O@NDK?tSHREelnLKEQHRk&DZ=(b)yZ>9gBSSyFn1h`l$a-vKFUG-CAF7+K0=WFE< zngCZn(B?!r)uFrd@;?pq9TXeAWT6Rgv5n+Jx%j0!`^J}Yd?jro zSNaZ$jfF~~32@0Fu4$V3`C}vHgo4oFj=Y0po1zI=QB7(=T`x4`No6VkTv*mqEDj2Q?`fQxm>YhM@L)8|v)LGf_yH-sj@ zHCVXV7U;e>{HEi42gSp+ZU{|)>p;+Yaoza$={Ncgiid065Sjp&90I#B$i+{@FUwc7JCYzl**+TaimjN^uuy6>2 z;a@iAc_!q{x)F&JmU>>UN+VZ#4um&*z+q2noTr9_3B59KyI;*>xf7A<>V@;mFzIStodbpDB-V#3e=%Fcd)>0wNCOYpx#4rJKzqvJ$O zcJ>QKY7G!lzKsXM=N>`+{SFpM+?TN^a zV}x)dSGrN!HUz60KFdH8N7>PFl0&-8lLGSJXlO`Bmu*LqmGIV1&~aLHdnf3a{0BNg z$LZs*J3+@m=c!K6vHYLz1RV$X)t#W@r1m3ml)Sxn9 zGW8PGaNe-GXsMROv*hJwVS&|`Kn|=Nz+!Uc4hJRGLFH5@7MX-6hn!esHlD25G13VU)+ShNYmB}5-YKN7%9#jyBaz|(8U(K%fmks+&)pkcY%^i zpIZS0)n#=NUlnAUq1W^q z1e02a;woGIGk{RjID~&~dm|HNsn2`~OSG>qF8VTe*;06mqLZpti?*OuQ*>HvR%5Vv zwbA>Sm|G0(x^GODHT#U=V_2d{Jjq%tIA|eXV}+EaGs^=J^BGT&M;^Cc?Su^Eif&=QvqrDH2^w7eEFr06zEbs#|U&ao(X|& z#*_1qSmalD#szu^PmOIYps|8`9Z!z6vBxFYZ6S|^;>Cpht)RqhJKTD zxBny+8HsW&4xidq38>Auc9=}PpGf&XxBoM$hWL0%FAG@nH58EMi)~Ny#SfwRDg~tZ znhb~oMl5oI!<`Ojg5c)inG}fA7jmhhG%G?Zl6Tg?daTe(+{NsN_K2t&Lj|^Rs<69+ z)8Y~Jk>rf}x$%VE+);{Yla8Kr%<+>V6U}ZN_ldynAJ(IY^{ls_!`esZ?dP;B!tCeF7e5HTpYV}yKZhdUbX_8L7bvX=-K&Xmpy%M;`|4Gf zdiyz7IU38g#$Y&RJK*=+%91)y@c&*% zLoWY>pu2D}9=exqI|A3JGCN#-3knaR32^lQHYd8BA-HtY|9tD)&(S4dhx<7@8m^!3 zxN?whKgUdEdNSldT+EGke|x$84?zpU&k=rmuI0|H!J zCFMk!f9rhvIcAb4GyyIS^f^)1E4s$QTORT4=Wqmt6Pf^*?&omQLHE}Ax$pV*b94!) z$^ii`)+0|a`S(A(evEHFhwU6rXaZb20qgCt-27;_7T62b&5ID zzT#goqM&H7iYW?(%n{Ezr8&mF;$Jbp3~>z&VRj8+=7um2g)q}Xm>GfCv#ttd`Q?#) zj4)8vGiwUwR-P5H#!4aJCRUyo4i_=B%FrupP-4?xXdvPUThLG#!_kadI5qZ~6+_Xq zS&fhitE!pB^8}Id@{C7Q$_=7)klXWw=MbF+=QC)Fg{IG5X*O>a9}}C{5_6DQB;BkL z=Pdrrxrfe(jfv!`gp>~qxfWE{WXp#e?j$l(3e`9}YnV$JIDh&X;{19D3WofzHE|V}4AmA1NJYpqyL8 z#QK=xxGpAXczgEm-|*z(BNq8Po^gS` z!Bbb2oIGhL-2vr`Z(l&1-o+x*E3rjbTZ47MtR9icwbfM>XUC5zEj~2PW8ekQMxI?& z37<)|H5E{^_9HQ!9Osi`sH;4)v8t|emaZ_UO%DoyMyx^ z9nCwdO5CKuAYY7&T@_1h+Gm5#@m3TmM-xYU{+TyxQBIT{65ZCL-&n6F#QvGL&;+=+ zX7RXUn?5)~R}?a@WpTp^O@M2AU_Gwm{`}%`-U+ciwH2BGS2y9}lkU-%yX@^dAvQB_ zp$TxwY9Y!FkM6K_j_F{VeGbibX`R-^ zm+dS5731%v6~l$Sb&C0?eZ{|GZVF*O3Sp{3n0G>$gF~1-Lm2K1S=Yh21=_F9f`(R* za(lEL%$|4yfSEN>$v|eCJ~ZZxMp;G4DAK6b5FQjQ8Yhbffdk5T_9{^Hrex zrJ-e4r}ZExd(H3h1ZZ9`bnbf;jSkc+(!B|qzlP|71UZTy;`Ox36!-=dv{!>$M)+eS^aFX z`u&7to$Qju1jR%aJF{35{k(E*esd-F_j8NarV?>EXz~2=S2vv0s{*mv6)G^lkXf*oNQC zZTMAe!*7<)&l*EcHmw;f-zon^95&}(w z99>r*eA0v7(a!^p#&WGQ7!E2qQMPir)0ZA{n|Ji{q9QS9Tdq4y?A_p#6P?Q^e$)DI zzRElL`IV!wTx$%byKu3~rkj4^SFO5G<6DcPv0RN>D0-|T0&gVgHtF5R^yr6N=Qp{c0SI<+64fWD(}d@ZS1_$Ri5kFd^(Q=aD5||>vdB; zy8s*HQc+$~zwKx&*KG!~YlurldC7IBqp@6lOq#jX6^u(odC9e#qp@6O84~Fi;!;sw za&c3FuAj@7^!dQ-j$be?73C%MP(I*xcU+ts(Qyk&#cNrH6BbpStfIX1dJ;nZlzcC(Mh<9vr-ii85>Tln!dA2cVDVa3K1?a|Cu49lT*m7 zzKk;H%dIH#xUHxL6uJMKcj&=SGxO|ncb>`Q`aY1~%caF`e32JQfs#cW4KrDMb#$3I zl2cHdGQTG|!$+hp9LC4EL@dB>@+70U#ou>Cstmpl;1Sp_AQ++W&Zz|#h@3^M`*i^{ zlbr=kYHu?y#IX%8^D)q?*_OvBeArN6#&1$-aTX3@hm9^6ZnhES@5fGr^YijY>gFTu ztK>@`l!t-u*QPg;6!?0kY~X+8M0j}KNPk=x;)T+@M{v>$$C;(>NsTmH_kxxaWA26S z%t<8NMEsO4xJUB?`qo`AjoXP6CAcJhr1Kxu5YPGH$DH8!T(%QoMz^^WbeuVUpM`GN zh@kX0=N>&VMcSX!Bsgx{jp>~?CNq7U&6gV*($Qs0A4mAPouK2qW?3ib81Lnspkr2V z=mZ_ZyT223tf7x}f{uG(pLBwbv$h>Lsr0#Q<;UipoyVamsT}C+W`X1RYm}i#tKbe55-; z$98^GC+HaO-JPWSO(*EMc3j;FI>!5YC+OIJ{;3mm?Ef}(f{yiNODE_!S^l;YbnNDT z=mZ`6#V+hDeJ)$QXS_W-N!P0rbS%FqOYnBPHJ=!T6fEQFVHY#&22=$t(n zxnUx1bQ?qlMS-era$3%1~KGoDX4-ALbLiqFX2DYpQrj=?ofAN*pG zeek?eph0+EB@p{rvqZ`i^;hrt3pidV^V;+9^C#q^W7+1LN{xY-l`bZ)kgpU%xT_S3jg z#EqFnoKYWKYxdo>8b^c^@YB1nwCNp!_iF@q7@pj?(hE6{66jbwm5ygb69qTZ;i>>l z7TlQ*cMhOy1$PCW*9mkhp4SU>C!W&PG`QMQ}$t9Iqa_QE;;XH3>8y&@h1-9o;34?gl_h z#P@dR%dL6keFRW}__FLZ-sb^n9De|$yu7wZeg6hXdH)V*r0{NWzBJpbyu7SPdG`dQ zyaNF#?+`$R!b@|`>YD(hyu2<#c~5k{6@ZlY3_$$uu}Gcsy#SE%UI9pXZ*ac90HnP4 z0y;u?A923idRE?704eVuoG-T#mG@IX3E};_^ZgEx^7hQJygLKZ9PJHAc?SS07TzJw zw-AsXxN)0bIVJ$oI&_S~xq-%ibj?d}7yqc3YsLr=9#FH4u^DaBQJ|v>3Bn$O>}S$1 zr#vP{4{DT2i~~RjPl*@hx^s+jeLO{X4g$@Zg1GtH;lFQGl^(hn3p3jy6GIL-w*zlzDNZrV)m z!@JTw3P_vjT0krCi$z|0p>c&}>vxfFSgev95<$iDc`r_9QKRWiXF`hZXT%`YjB%aEe!9S0}E@ojLUCVjb{d8Z7p6!{VYn^*F_qT ziuxI1OI?k@Ro2a~YM^~Ka66l9v@9o<-GG{D{O8Vqc{`xhOdD?gg4sHun>rz?)XPzyQfFy$nTi=y6R3osV zcgTZtDHL5Tj3dg|Wje{`#qSwAgw?!8D6iGkH`LZj32ZCn@roHWv?d6qxie~J@&2<} zjdE8UEbTQ^&KH}1Fc}!pYIbNm!fVlL8yn)av*R@PB@XTRwU#IyTOn=!JOp#P8_$jz7th z=i#)S&Qs;CG?*^H=0vGcHj)1Qzd6E_=b7hd>{)rK!E_a_AJBs&0d2acY=kGzbBv=Q zmw#t|d*R|LmF|%he_QA&UMNn5aDyt(>_|K_N-s1WGsLHOk*|D06Nsz3aB)pbx9`12 z{@kZ{!PNzv&Tz!Pge9p*U z3%=aZr^;QVTtXAz+DW($Q18g&CA}8;RJn~oKcNY5?JQh_4cD66&U?ylnorXpGyyIS zS)Qr4yLL=1_nYR^DkU@lu3d!7e3-~iM;`LE-!z|A4xtHf?J8WR5=0(-re(d~G@s&y zCcw3ua2<;$-Tc$uUgtN>r)dzH02ga}PSnOV=%4%a_nYR^${{oXuHA);Er@R6tBVfu zo95HXAv6K5JwWRz8(lHuvBUhP`LuEfO@M1p;j(S{x~u=Pqt7&-QC<+502j~pJY$d3 zZv5>KziGZa_+k&5GyyJ7V?1LHrBAJW!*7~T>xR$-xVX3LanS^X-!z}r4WS8e?JHbt zt#njG^PA?=x*;?Ht~h8t^95bcEjq|=noqx@&;+>p3m5wnIx3?1P4j8p5SjqjexUVK z<*1hDH_fMYLudkAoc4KKRLk?5=F_?%Gy$#w!o{9}?#k=Fn=l~4E?1QKj6px432+Sr zg%{VS4cqPQGtFlXw}mFa#p$Sb=ibR5Za96A7nd>UCo};r_A@z7mhxxAHuO2b$E9^c zXaZd9XS_O31-rpMF0C6v6X4=BIjCTFppQ%IhR_7K4iYYohICX?JjlnTbwg+ZTnB^J zGb%EE*?Ef&_Hk+55SjoNr|(`02i^SEokM(FS~r9yz;#G~>xhT0J@gPCm(~rT32+S+ zE{?O}p8xqFLw#J@ZwO6*YZ!>V`~BuUaryDXd|W!H2u*;CJ%eXdWZau?%*yk)Mrgkw zG?J7u%z^0m^}QaTe%<4ZS|74Y51wSW$f@9cW_ICWt_xw7($hG(LGDLynIkcKE90j zP6~z08L)Lq^9TEif5ki-!rT+W3=hT5&06aed?SSUB!pQT%GZ@48m{lHQ}Am0ihsp? z5x``Zc&uOGS0UX3Mu>%BC0{PLh*5ybUDGDAVSbY(kgW<)`-KmMVM58IlH(F(r6-jX zPc5BTqOqx@;n>otmL z#UKJ`vkW7i0$>3(Rli(az#||l>G}9X%5YU*7Q8FUEPhj_CZV-LVUdADs&?e{|qJxNG3|F=!gi@|Cku2@k5<4i z=h9b@Z%i#Kem?$g22D4!baCm+H#WYNEV3uYi9w)&4SR8nUgHgF3=_Z3&?u#$D<~MP zvoyuBzPz5D&X`*F=swOym!Dtc|Gr;<{9mB^sE_jTvuHiYEAoGmslXqD$nRhR;C%TV z?Wa2*errH;#Lhw{J696kh|xM}Qnbj;%r-OzrSazHkMa{TS&OpK6^`_ii3H9i+34~| z7V3OeV;PM)a5w1w#KjlfHTX&TMg=v!X&&unEG~XONXTS+n{@s?FZysA&~Sj#*k?9r zEUs=EJ3+S}=ziV_I+8rq3A)`t_i-obzUc(rE(otT`cc2jmfwRxFt8JJEZ)hTpz8~| zg`J?|+Vj#*(Deu1gPovbc&}!m8W$r`lk zMm#p*CkBq8Vax6SXWGfh9(cM3E-;F=Rz*CEf;h|~Yj~<84rw*+y>Jv!tz33*F6rKj?M8VC&lWRqzFRr2sg_7*D)T?DUN~Xen zs}c8tG~2QpK%G6IjM<(wXH97Oic3JEWsy!or0m5;h$^%wBDE%&ngATc7gn*9eMjFY zqmkL8O!%T~>yxY~!N<=@m&8(CpJfS4$rM6L>C|;`yt0#x$>m*I49DXA6v44Tv>5mq z7YmNXcY#36@)Cib!PEbdJuPn(mYVbK=MQdLR*n4>cER|C^NBClF2Sk zA#O-qD7eG$Y!YZZp34L}+To@;+^K+?#dkKITK#Jsbe4lI26PdAf$DEsM`*z}3vT_Bv8w zF^EQ(JT(HR1(C%2WWk+|=OqHMU^2g^?RUg#dAihmxzwU=$)@$OjKrezG3n$KRMKhX z`=n3dF0vLr=RX>I2_TI<+}DXTak?~)*4@xWf^(utsqt|w8Z_w6+Ubxq#1Wr%a*enjm*y7w-~f&0x6XsN-j^jk1qlGKKVq`tGB}z$RxF(c_Urt9Zf1n4rs-HhiY0^NEHu}eO{4pDsBgLem{kLd@QBO#KEAqHz-aq6|=)Vc&O4PdfN57;t34@|5*rYCF}&)%8{(<8QwA43Er za2xhESs0(k#7{*=tY9}@OCZO#mnA49!Eg|mDv7s&BEki!x-%`&7%2i0Y0r%!n1*=& z)0DZ7yRpNX`>wC%4nStK@AW1j;~kCzl1^5t0dcgANs%g!^;dDXIl4z3?pZ(@@@o$I z&_O-Ww0$23)5z|}mif%Iq>i18Ipqlf%mQG}G8k$L_=Pwprq(BDsq`gNoa^)3S)Lap z)4hsafi~1o9C4zOz_%PTn=-2oz-t=*X|0;VvlxZnjkUFp36k{`h}8`T*})Ys%*LcI zL9UWUre8j5emg$iAT+gh`!zcH7Wo@(Q?osAhR`0z+AHu=OFdfJWAT2a;Eu!dDuGVN z^J;m4sra_kZH5twFzaZ^-`+Ibc(sulJG81 z=w*i?HPwV3I`wU-H$cj)p+ER^qH`di>m?rcfoxcAOm`D;G{`_y9Zx}bl|Buh%oB_a z^co#@ZeFLh2a=#k<7`alV5NYT;1`QNxlK)wz8nOF zI!#}S8XA@sK}-b#2CjUo0$L?8^Ifk3=Po;#Xe0KT-)`=5DNUd1##_v$a+?<;c5eX2 zl0&DSloB@8A(48{>AR#S>D;oYC3iWc$kCJrn^q_y#>(8@Lb2jE6GhK8zEY}<&5Qxi z@5ybR=Zi93SZ0!lAe&1h$jez2n&m=g;Q zx;44Wt0b^V{cPtg;?VAf7wWyBD}NbP>xI^rK>A}X+7+eF7TeBr%dCI==&~crGOG*n z7_8x0C#VUK*>zpE6tW&$e_IDI>l$NnMp$KfxrlC!+diFZ8F=W4?GyLs|UQ z^g>>uSFp!yGTnEr<`3v^N`i+g^lz zLqG`+OwKYqc2*Be$TB>>MQdc2wKKA075W&`$G~qHU$&hnS_VsyrbbKC6HRr(gn_*N z;<#IR(Zx;yguJ&^;8Bv_j*g1616AC#^(HuF=XAi6) zeAA8^X6jk%b?7Cs$G#A;w@#IDlfE=v#64=jo<2VfCeak*`~?H8Qb;JxP28?W{a`{av4dGU$;lg(ibU%*;8zhS455SG0N0t zZ^m@ot$+O*eTKnhuUH9i+rF!HkgryCv{bU+&URfkSoD*AmIi;gZ@5to-Ncdjuq~L^ zGh24+#Li-i2XJMVyX>-WnQnelTMo@{0M*)n2dZ6bwfv(ylwl*c`FS*>*4L#iZ83Sb z>1>^f$ZaD1DdeKK^+XKD)-xjqESc6K_;W?heQn&ifai?@&BgNyfw*wd^&r=7y1Kgy zkgn+-0;FrYRe-qui$z|-^Cp4b#`9)@KEm@Bfxg01cb~f9%j@3M&VX(e-$MZ1CeRUp zZWkyCXoWyDUHA)umH_&tK-U7&@TeoJ;ZfyDeK!Hp#TB~-P4m})G|iMCnj)d>2uN3o zy93h28ao+XtWia2iO^9ANyEF;K{o?ZjynKdFLVz9Vrj-APXW@9Ijz4#aQ^~yr$E#} zRos4nSgx^163|S6rU6pk8Gtm7IzXDLYXDUW-7SFT33M+Ye!E!YaX`wu29WZ;2}pSd zp?+#U4gpjn9ESo@j`4t$<9I;IQ4eT|(A@~=Zh;;JbdNyK0lHV9KLYxdKwY|6<*X5a z?ibwAfF2O&Oh69`bU7f_qgdn~Ko1MF8qgyGy$guDJy^p7`n5nY41~WCs4t+$1j6MO zrurl*8_T7aJK<^LZG_={Z^od0O=0X20$wX_YNSf zb)NvzTGtIHm`{rDE`Zn`Vv(VMo)TyRAZuvlavAT5K%fYu7`B0%c| zx*X7R0&M~Gyg)m4xBEW(1DYtf(SURZXaXS3$BBS6AG00ZIgW0*qq`l@dI{w|KrI42 z?{FIcy&$;10=inDe*wBkpdLMJes=?;B|aF?i{g7Epw$8;0c{XyCZLxDnh)q@fi3{_ zia<93dR3qY0dWF`-VD&|0{t0~me8kww1g;#qa}oE4GnIup0?~04k`uohJD}4*fEr> z-UMCyxVCYINpY~y5WnW88pNsK=E$Q54Y=&3} zb@L7fbjz|z0!B34^IT^}K|5u(libue+1@-dnFdoDt2?`M(lA6(NjE*#;4CBeZc+&{ zH;&-a;63B5a|1if1;^_%onC;unj2iszpM`Tq=bLaD5Pp0i0c69sl29jn3Er)uSwpPu7%4XcBNvfKiE~KH6DUAy%>ty_qa_j^z^KcKV+&xUze|;CY)V_Ybu}k zopIq+=X%!1M>rZA*S98|U4`p>Jc+pM(Z^5stdGkl1a?;!*E=X{y4~>8n*{i__?7u9 zJ?rB%?L)Vl<4T#h`T^^4ee&84`6emlm=zXY(J-ZjAwnk(9zh^m}^?xp29`hP}Z$+N6txl*2ilcO&lfc zmlNGfxWMF`r>$sFLKEQH8(ull0fykQMY}HYX)ER{T4(}XEQg%veuk_5v5ifBZAC>3 zO@M1(;X1%@jk;;YS3YgU;ffZT09RbN_^s(~`FzjYecFm66dT81ur&G;6SZ7*y|#P8 zr>!_rxr8PV7jxukeD3jwd5`uFR+_xx+rr>$5dOc9|8a4{BKsi@wO6Rv-CqfcAW zXgLc_fQw%$C(2Ty`|P`oZ~C+q^R;paO@M1KXuY_;+WE9+ecFoo1rnCf2*i86=nlj$ zC(03%?y8AW4Ym;ir=GtKaeZw1 z1bQgVWM3mwjJ=n`qxokj!t55{g8qxx&?X06M;ChU8wv-L8t1l?>yU%i z{SmSsfsldelrCU05HdA%8tdo!;v&fTxpi7Tmj*EP4RyHU*;3e24eP^g2$lS-K>09) z6(LNwP)+C=h@D(Tp^!%g@HR%M+cRwY>RbxgpkETBKEp`v3=gv@EJhie;qrEl| zGS$E;<}a`$COzXrc|SCSnG(Y67AlRsL$RL|h@H{yA1V!QPFbg({}ZC&Mv`^v$?X{H z6tf{zJ~xCgOG22R+d%NI;XD;e&)%V2Y#+kB7Al|jLTP?HL~}qWJp)7Oc_mcNvqB+v z4b`ab0h*HOlgsPp&M@P!&FSO-4I{oWl=r`fFjGSq*WJ1@{63V^PeS=RnGO$*Fv(CE&Isj{w`E$V0bCKv=>wtkTpKFqgG1qPGtW8= z`K(aL&xAt$Dum${xOEC18lt%`l%CC@dbmd@g&zgd)1mG!*Z6wbNn`=?6jWy&H}wR$ z7lTBVb>;Ia&(`}mD&|&JUhR4N+(SyA6IhR)N&#Ny1hgoEK#mC zu+uFy?|yYzq8MoDlqu6njw_#1a$ISm%nQ}0;!H}3DR9Ax!x}|s_dadv_`*!w)DtI{ zNZ5Y$RY5QblAqFId7pgrxGAFr3V#}E=^E=@`aNgK{!*3_V`-a@&r4cDU&62KEoBzI zc~}#|fS|++lVkSwn2ZENc^TT@O3cf}OZh6LgTeGE1>KtSLhGE=B0xGL_Sv zhhGIeA&i5Ia2e}zK&^|bWlq+AT zIxX`_+*$(_aJhGSW>qcJt7q}mH5%gZ?$@kmta1g9utBw*sdTFC;jEE<8{U#fpANh~ zRKIS##Y?7r^x+7lEY)b7Q@3{+VsuuAUV_xxU{Rb?S1!W5y1H7dW^gi(+*bQ)_xLJU z(+jmGqfkHYxDzK&J*J#VU`3I6d`;D?g4&s9WGhGB{DV{kQrCeFKIat^i_xObsWgdU zB+|fVmCtBssH>XU*x>hK4N!B6m4TkWv2Hs69!EJrhsFlMYL`9ssFHD0l`PO2gv3+=4@Ri=#eElx@DCn>(+I{*Epf&$JhbV( zJcMsl@Q|6knD_*S2*LQfTtP_b3ZxycfSKRHSy-_5R)y|tGG&<23fbS!%BUhNYF4@V zv!qs|Mi-!FhdzD4e1nbFLx!6xqjqO7>6v3sxsa`3+6P{VxjZbJU0tVwR#P&swSA-BQD3+BgGSg}*WrNGTRO zne5>IzjC)!VS!tzFxt8JRb%$~dou&&WL31_GqmctZ|>hO!Kis9C4%wpnT>9EFy20(8w|Q4L(7S|NkKMn%C$EMVFoq!c_@xPpG;|tXL7u+plj(Z|bZZQ)OJC8*5Zz0l`C}#>tQYtT zdLF|26g0=0wT=63Fq&YtX(eKQk6PdQhe%0Z!DzD+DP$scb3W)cWrjCA5S-+VJd-YexW8En-4@Vv!`MdW<)hI5IU)zZZzs?ch3N7_R*=SlW?G1@V7R{tvs}v! z4dWGuM1)lGR6V<>Ps3QT`|!plQc|)9I{#2(&eiwSzCI=9fPicQ1H(`Mj?5Li8uml>D*X zpc_h)8(z`xBt?IWO?P>>|FH1)M}${Nq^uHG3v>#enT7ANmMvMmJ4%)TLWUkWCL=glUX# zG#o`WE$IJvtr0Ki2#@Io1?-Ks)c(^Jc`(wYDIDWcI2TZ-TBIhi_m3yBw?B#hY3uBC z5^d{5H`n~;%68-;w|H$Tk>}S=hF|{brnB=Rx!0}kxE>r^*irQ?v;|%G6RKyY8gt<` zk~OBIWR0=O8uJs9bu&szTg@#3W$ls2m}KeDleCHStPVlV7DfURNq4o+t5$hB*)l$f zfN57}FidPv0_RqVXb_&a3FM8trAZw^Id8jt8-6Rc;rEMe`2BJles^rc?@phevr*Kv zCMgAvOOGI)eBGMV3&b~|Mn5fb*l-mn{e4x3sdNcci!P>EZ6x4!Ejpcg6V3@WbmnYu&w4@;fZ%naWt083RiGT#*6D;k@>&##5?yk->Z-N zUKI7C`i)HAEcT!D}ZYRg}xydP8vKLpsPcL}X6Yu<|qp>OMZVrh13YY!Lz4z;R zp(oy%>u4<3hX%7tAg)`c=iKaxcYf+kD=l+O;t{;A087^r#{ccaZ^FX2Si+A!mExO(D3-&gic;^&HWAjCG z7<4M$>2J%Pc;}gp#&YrQNIDhoTm*<8=jk!WKIw^fQnQY3PxqDc42GK`UcOilRlJkb zqa2Nmi`u+&BDxv1aSi=b@?910q~8aQ#&T^j7!~idb%XU##XHIMy`!;Q*P0K;rJ#2m zO;zpu*HpZdTsJuy%k>+Bi3=C&Fx|iRJ?DQ^ypwNFIvUIMm8mWL;p^4;d(R({Qt?i5 zedlN_S0B?(_Y*Fgug$Z@uTt?&a_#15EZ2O4Va@X5D*N_>w^Y27Tvps`|A^(f*l-OH zE*n?BQ}6sx#XHHh+|gJrnV-UEV1R4I4!`}oig%LhIaBfjU0l1GoDLGMB0O0UM!#Bi zzlwL_C9;>Jv2lG&G#s~0R4kkUpLy6@n^nA%ellgi{{b$pcTJiH0~_R0@lJC6+0odz zeqk_dc|k6{jDlSEI2y|}$b9#MLR@+o1-XVe8p}0b^B3VRaiKQm3bqZc@Y67u}Nrh-mW;Tpd&(A_!%^^&6 zfQ!P4e(6#TXJ&}&o>1(QLNsFkC6J!_5Y3-M;XE6n;jOvWDfqJx4e!6TPC@F`TBn%% zLYVvzX1hRXkpCM~!wG9RYeSea^OZfCa|s%!T=&>l{43_I5T-d0PKV-NjSW@R^(ya` zi;1i|Np+{xJV|vIK7_qRaKp-FIdA`wHYoDS8*u8HC2(@nhv&``+0&q0l2tlM^G7K`z#3JzvI)y11te+wvAprKEfElR0vhf!k zBT{jd?EYZP3lX?NFnRL{9XX)~$$?4}xx_n9Nqk41${7?m%HZt4Q!=CX9eTM5ux6J^ z!tuGIVt0afzvK{6f#NkZ{&I9QMtXwp0ci*#TtSGSA5+_bfDy~5124&AhjK(@^h+PP z82xDlQC|6Mzod~Pb6=LxSmC0uFQW+WONMTP&xd=sc;EBdo zKJ)ByT)Ej$1;vcamgM)!9y$Yn*qAWlwh~6j*Dx{D=}9xOUm4&Rupp!7U0uC!KIKd5 zAkx%9SRz#vj)viM;KihhV2oeD$X`pX)QrEH3Qh%keoS)6eP$buzj_Ex#B^|>OUa}u zrN>Ot#7Nkkl>6}s_k?rK0?v@=aVcV{bmT|AEFw7p-fj7lpQ1706v?;f(8p9g%r>&r zI%2a2XxJu|7H452cG&3AMSA;7C+~n6KD;PjNGXjoPzL1R^jEEQzDP2B!*n+Azaov3 zpEqK-FS2IL82*UK3e<_k?S`kEMvolnqf#AvO0^F(Yiw=@30*(_G>_M33qv>ix!#7uEXSm8L_o~p3*heu&5c}P!!g?u-iY8S{Sx56 z2hDk0Q^RovCv*ix0qKejz^??&gvR&&*<^m4 zkms`9g~5%gg1ARRh;*pW{%Rl_Bx6B$5`J{d$C%!EV>09Aw#M~wJbW%&yqt*M5%&=R z%tps*a#ttlcKj{P=%jJts(DA$f&s-(|}$t9x!I=-3YXcY==P zT-XUZ*7HLbX$1Ts3I!QOL6Lj35Jg<{ zzs{g@cdXFXwXqz$GKreC3B-})fzKtEKQLek!4@2{;Gbagi@D3L0Z^KHbz?Y z3}5;g`Z1`v2ny!l{MMGI2+9^K$~?LJ)JIBFFT>bQVkK4YCD{nLdG!UGV32%bYHL~g zafWa2Du4yVpG|E3qT!T@sm4fY(|UKgfw|e@Db^)^EdKj%w#b9|#^3vF(B=osP|o+2 zXImE&$VaXBfPp*d)%fYXEF_FYPR5g;K+R;=3bYK*1p?iK=a~Yr4fEooV2DDJ1GXQZHITl$ANaMH$kjC*aAa*CQ$cup3&|;B|fX))=OF(A} zl#5DxjzGfzaZfN7nE>cqf$9Khs;1$Vg{7ar4yzqT0!lFhSJ3mLZvvY1+Eod6UqIi6>tY3EJ62Q=Tnu zs54le`iEyu)MuXetVJ*yY6GCr(6`G{?X>I9_SKF_pv_9d*%_&au}EL?6DkVAOgtv( zTUVAY^mhJiV&-Vrh_CGwYkHDdEwjny%aNLI+>OFE z$^vrv4a9xcGJk$0(aiPhh|89#HNRObvV(E~$|;G{66L3^-|phh!=6`sH5hpwQjJ! zs$3w={2$o70wLp%S;yZJ`72qFdtk}w_)W%d41Rg|#qsNnAIM5JtS~pgBQ&dqn$Hd{;{nU0Y_j)f6;){YID02(xGY#@0AE%a+R$ z(&x4Kld|-pZm8x$3RAi0&<@St5^Of`wwG(z*+X=F`}#z?yHz7m)NQ6b!9O=PoP2aA8u2mRf0LdX`Uo1fw^y zrE!7Uvmp<fKXFPR8@7$N_D6h-+#g)-GQpaOPL`;#-qwU5>LJ;q?f}b} zIFd>>{!{M!Er}SE+<&uC(dmi2CVe-Fhkt>GrVw$l)_I%-#873MUKQXEznVTUM3Ky09-G{#DwQC zf!@bc``yn06$tJthwFkCqQ11&qJ8l&K+A>h2h3l=trr_YELT6$K%mI0OF)57U8Yx8b`wUmH`?mz9&21 z^8xAD!`sp|l-mJK7do09)=-{yzAb<>l((Jlp8%aG9G^Sfw}3P}iccv=UqBk(o`6mf zj)NSIHtLjPA|T~B#rakMDi;o#EY?si1f(2S0aA_?&i5WbGlhe~P|C3$kaGM1kaGOh z`L+S76pn8lu1Cyr><&md1_RRYh5?!@97j0Z(SQmCcM_nh1v&?imh&>_OABg;iSNyT zE)?hvK-UP=0!UN(CkN>Sby|W`)RkxTwjH;(rk;p#o0o&VhQ;;fT!aHx=EkIT>Fw{0 zHuNt`Pr!`z_}*9!lEw}xoaXgMr2^4*4Y_vc!@9chXF$aoPEV#6^|NRh#NFI)ob42X z#!|WZ@-2h|3y3q}XS4lxm^jilxHvr_&u@AD5~aYLo9#J&3tIiX@!aOG zk>1pr)vaB5kIr>#;~SQI8*SV@nZ8alrWRe9F)rEC+v}jaY;|s`7iuTsN*Yqr+vYY? ztjA^slT-f)w*V2hz6yVdoo3a!g2Po0m=ZUCh=TOWMz6$rzcad)4^ zP}9E|{-v<#Z~U59pLJ%cnYurgm_#fK&efJL=K>p(1DpC~tS@ED=Re{m%<1Ktu+My} zbOdoZD;q8i3kA{mO50=w=)pcCGys#4jW<}Q}>a_x~FYG1| z3+g(7IRC$1AbzDA1bPck?G^qBXn(;Kpi&JI=p+aI5)dbvvB-UZel8GK12+l8YB*n@ z*8$xu5XX*N1o|A%tpfc3NXMsssQtGIj-$ib0&z^ZU7$w+X{w$Cv_f!e0BOI(zWx`2 z+X6__%zpisf*Szn4uMVpq@m0Lq}wIcfL4fa10W60Xo`6^#cKcMQ;gVG*2@3HP8C{` zd>{65I^9ie#kzJi#k9Fyz!lh?5`G?@I?5jk=q|xI)7E2X+IkFb-Q(o=+SSm+$h~&W zv)JNl@3tnl`6&=%jU*9ew`k1|fHVbcVmEDV&t0}eJZ!JCxPeV+cei}yrCi3yG_LSE ze>z^=?Oo|^O+|eh|3np$FLP_7vvX@od*d-}^X%M)k`M8CV|MPwwX<{Id0{E8ZNR3} zuVv2xQu;f1`*e-B7N@qz0(XotN<9n-x*NY(B!TBW0{cEGIr3b#{QT8r%PV7Td+4>M!HnlFXH)QH9vz+p z!^?5-MH+BxS9d|!PS5_Mm1AFo8y#24Nyg_frEA*(| zg)@zNC)4%L3+=;tAF0qh768(mjRSPQq;3+P9Fb#@)9~asjYZgf z-XV}w2ES%gvCKJ2Q?He!bl;qMOy-mE+NnZ}Ri)|NWLg#a@JS}&5*V0Wf3cy5d_k=D z8xONL>3OKZ(4y2Of6>;)J>5$Jm#lf2!`IKZqfc=1F$bx&eY>;?Dq-rDkE|QoKHCQr z+N&N2h+j-^UDv*urSOp8W;lptwp?)M;dzBXTxsa{eFTv9c%d?CDT%RrVNbJ+n?^cG zYbuI0?wd@PIx9v2+FROoMl5Z;EOFv@QN&*? zciwqrI|8_e@zceZSB+RWG1(5&ipPOcD;@`(N5%IsJbx|F20WGHBZrGjhjh*Cv*Tij z>Cl1o2u?@Y9q`{9Klb@pQ38>3qCkx`^J;1r)x;}m zXH{aSxUr^w0W40T#&C`5)~k(o1QC93D}&seV~ zSPc7L<7?~Y&uEBHCI>8ug^-Y%F|)c7xqx(HB~?WA~QJ54>D+oftbh4`g#HI$l)l(L><`;(J zUrv-l8M^`M((6~h@bsIwD5Hx-tPJpIMMS#bKPUQUJbU8z?DxO_ji=xAGe;Ab6yRvz zq@k;DQD9>iK)2ldwj)>j`~fS*vD9Sa4b1BY)<}`nGf9P={LzPjnG&w=~sba6U&J%!IP!= z^(jZc>ghLG$^0E$T>D2s1h*r8InfPxGKY`0J^Ncvzv)0nW8lwm6b>y=tk49wc7{hz)Kr4V zL-X>BRKH2MhAWrQ1i0A!p$TxYedI)qcjOn>w|=bpO~N%& zxr8RbwX1NkJEnX6i#z^D^_zrilwyS@z{Pg&mHe91ZvI~Nn}o|Wc%cb!vCMO#thsbW z+s80GxbIb{SfL4U?GBHes7>KTvj$zH`b`p7k#Y%5fQw5H)l(qFp$WvbpK!5O)4g-pP5b%G z*XL{H5Sjqj{-E_t${#%Dp`JeT^~S=G&;+;!2p4-Qx_2T^T<$YpZ|qYEjrcD$eZoMz z|SN_jqC;Fg6<|1Bd425#~}*$+`J#owk3g%|xtXCh4D$ZP#ft=3fN3$b51r zuB{=OznH$4^y;}hfPrAJ$m!CbPH7Gch0M96b=!$)NLWmq};9tXeHiYpd88m@v;JD_6Laq(vVsL;a zyW#f*q1d~J!l6u#b?P}QL{s2Pw0d3VW>)K~pE6`h2C%G6_yD-kQIV#AqVt61U`8_qvs z(wV~kA(PHPs*;a0x*W_f7KSdNYKxpUY_ZUk6#F!w)U#?nOqJKb!m_3Xp+k*IOq$n6 z%FD|u=FY2cm*@p}rETOxTpKR?~)B)_9v0 zsfoD7qhRDHueWmDYWc!~tU)1zksiZF7Zr(Wk$I>cV0}?opVl()@S+hT)t9fNIx@qHbRA{ruEqbupc!WdP%e8_ zm!?qHK!%QoFO-Zp#0;X`Y*D&^3Y6@QUhEra$!>LX2wTUJyCEB0&|s)+gWQ#kZg{}3 zsL(x;jjqt_Uzmuw;G>L$-%0uk%*x()aM}1S=z5uH4QCTVH?qhq=9RDy%B~-14m2y| z{+13pYf7O{^4Htl0qfx`UOEF>Pm*rcWIQ&J2pi}P+Z&5n_PoL`T#x__PAlvIXHrir z%#r2+@Qg)D@f<9W9+|qRc#;A^Ufg7x@{Dw)C-pYcYZ`xgk}+JEo)ov3!4@!P(9)B} zSWHp?%6|44KL)=%{Nnia&h68c$1h_0s}-rSX27_bKTuM45T5+SuvM)VCSoEEGemIA z=ph0fh38O#rr=51n1}>%VH*=M9PWR_M5s&YvgCW-|7E__;MspKr;f^K5mV$`HvDU5}4Y&!yZ$4BI)_z{_tPV%e@9^Y1U2495>fFJp`n;q&#!-oA zUx8;8il>MX4lK_|;u2+BXa0*7?#s44GaD2R8F@yQKs#&6sX2Y}~ zf?`!(Y*e7kUG|Km&_y(ciCUO!-qJAV|D*`p&^f4F0+kTnMf>&3z}p@vs9R(DB>B8; z8N4h|NH{}*y_W>Ieq!xJWR7gCI54x$K#2#M7Dl47W)P^>K-P3 z?=UTGyf}E~L^;PGP4&~sG2UU?RgNZZmi14WaP%;ZGmh@~-9P6K&v}PwYaET`y24;M z0DGJLlMg=V2k$WLI!9x<&NP^A!qv;XJ@fh0`@O@oMUKXD9mveXF zsCY%!Jz}|Ln4GcP;S{e#ZWTZI>p=>!aN?p$TG*W;9t3N12pu0 zK7{#O2-8=YCA4h!f6{|pg>_2)wSC3EV%`a1s2pgW(%556VmrDIaC{&=q}(eMPELsC zQxY1tT_o$4m|dGUoF!XgjR?anQm5kvw(%#*eiZLg%ZBG-+iVJPf5YA|Koi-%0}D4)=^-8$e6wH+Z^E{S2lpgmL4OEWVv*zyqw#f3t+5e z?!0V!9ms!XASj27O^$4-WPa-#YU?U_`r>Y0%0?+wTvCtqxw}Rwa~B|xJ#QO8w@BpO zzm?$INf1BZXVk3#AHrMtXG!2tIl z2RS%4ZC$mphxZ((O}_78j@V0>FG&A5bSkn20EXY3zzn2XS-|4bhfanYS z9{8?)myNDB2!>{%8-{yF{JdFVyGr-#Mp|*!MC$F*)GM3Fm&CN6Q}zb{uVU|RC-Owz z0OXULVk#+7%Y+&(xVm9pGWBJ$XdU5GT-?z74P@LMZ=CkdVeheAMeUocG?gDv!mc_o2ak+hB+v8EZeebaVBX|@? zdY3k>j+Yg!ZTzUX2-=A((uuIOo!U^^^kGiJ002&Ay0j%G18cG+_BzNS$@aCS?JqQL zDm(DSWYag_FFH+BCq2o>O#0H6;&)i+ur^Wrx&Xwm770cGV)|K(0!?dUrA2QvK3bNV zxVbDf|J||6cle6j(DvxIen~rv5g%haDbKQ0(`j%Gw!G1B;qa&czzzE7J{xWubERM*I?^YK5xFoeHap1ej z^u%}N(@?>6+>*lwMRJ$z$~pl#&W(*d6HAWR|4HVd;ns=Ke_3tk=(=RZy2O(6y0-U7 zz1P^3SYO<=J(5#`G`=8VNi}bQegu}e$()IslBsS`tLXL=^H-K`{1Bh9ZGV=qOF!29 zWxy`^_LKx9=S$n4yQELDeN7_wiM|7xzU>YU)Y+cN_7~gUSJChFQGBvB$-_?F+OPwt zlc^ovO}4LVyPI(O)U8*-zqshj#`46H!v{nfr;#>2Z8OMTmztSUeUAJWQ9jM9Q9fB} z_RjnmftuY`WQ(Wo z4HJk0ad`p_aS-*F6n8BujxH;o1*8k*&j9H{xd%FIP1Uafu}h3$d&I{3DxkRFJ_4li zQs+(6_isnn3!@oDfnt%p0I_d}ZXqD0n}(f7wT@7hDv6_s42GHn{!6xM5n^vauLaO` zdd99@QJ=*J@Cu$}#hb}=-`AnMfjYI1Y+b%lX1+Ie81vt3>$M6Ail7R1S%tVGsbk}2 z1C_<3D}M<)*qsj+k$Qwz)F=1y=RjGOT9-)u0o7`O6HsSs`!l@Q)7uR!;4Z%nxJ0T2 zDh$vkYwXpQgyup?(buY%MM|r$fqfq|nfA9(+i7CJb?A71xoxP|T$I0|)XxigE9A`{ z{*Nu=%65oHp)4N+S4fDq4YnO8ZuYtzuGVO<#_IK_N@Dy35ka57HN8FG`p6r4Q>xIl z=eJ*(OqXn>f`^r8hwccpu<|#y_0s+Z{mR6mPaFCjoi6(Xo9-_*{9R&=IUu@jON*hAG8pLm**`K%F_AV10UY28rcc6SM416rCSyyuWoZlG7ihp?w~k zn%0qOKw3wx0i-?7Lx8kD>W`15TWMv0w68c1kaAoMNa-GQbXr@c>khT*!pQdYt4&3b z#V6yd9wfuN8-1+u0>`c9dl4}TJXz5-S+wr_L)ZwCX$&v;=$qIQlIa*;RyS-wGirYw z0QwsxY5T1b5uHprntJ{ ztw1y+XV+D(&^6-OkS+ZQL2?JaG6eIs_V{k3FMdvxId&3)Nc={Q>DoHWk*ziGdd~KuF z@O0O9(OS;?y!ChxFcIRxHWJ8oD^eOc0YB}->Hz6j zd#;0)1JX8d4Px?RL`o9 z*Ve?Vt7L<$rU(d3O^&hi>d&;*V?MCvNy>g}2|l zucL``J`A@`o>20@e@>LEWs>Z>as6oBZ=S6Z2tw5*5;wxHd&s*A*ylvKb|%;A@49{N z?Kj6Ajg5;fjc$AVa-v*GcL%ibo|Dh;_M6!T>9$8)n!>*+!YFTWUCp(0(GI&@;O#ea zrbkER4dt@C)Qlk~N@Wv{=TDF7TI20EFCq(^x8Ka!A)W3wbItw#*n1c7sH&@f_zW2# zqB0_!eIcGA_^n2fa|L6IhZzt!>I(x6RuWR4eUYldF z5zqayz+Z3P&EYVt;QX7od6DV#0Op$8UcW@wn<-AMc4kdFM71lNd=ck<`yQ}C*PB%c zTj>NRM75hx4K&^kI`xlZb-h`rINX2{9D&%n(G0*7=0n|A`vp&b#*xJ*4S9R+^#mCeri?8RFS!YDs04|c3Ie^ z21L+ruP#$(Pphgdt*lzu*l?j|KbQlE?&5j~2s&v;_14%~Op;Z}lCg-v*IrmvpQ?ja z?~s%lR)Nv{URZU3ZFF>P(|#eO##%_X)m~65a(2oiX8lt`RVy2)WMjy^yNw99S8<^o zLYCDvjaYMUm{+wRRbS)vPc5e4RqxkM#}pJ5Vu=-o5>7EGiu1tyqfDXvUt2q!$R5%+ z#Q^KTRzFwPlD1#g9Bl(_P~-UJ1r}c#JXX=-fisIohi)+Typ^!eNAr3mn^+jO@5BqX zjkITL#TjwXmw3g!z}p+)o}2@3 zbfGyHVS5q=SsahQME4PdOA2 zdok$E!<&!Z^UGdB&uXh3gMd|!CLb=$%?Ne%gfOvo6Z%GL82VnE^*ul98;xlQ|J?q~Kg6WIMN#(r+q6ZwoL}Y}?br&p};T;!<|vc6dh;=2V{a1q9V&^3;}pGBiE16fo5<( zCO9D~9cZ$tq50y5>9^`YGdLgM#z7HcfAu8sRFWAsA{EZX+ zf#xXFhzm}LN(Y*(mNdVvzvsljK$A;{Fg*=4E!APSz4dlrplSBdbf6h*?%81I8C?2$ z(J>7p^^~xriz{I;f+Nrc^5&UfQkmYydv;qzR6Eh`;t(X5%a<`q!%3etxdutLL$^4p zE>z<^Y<4+i=cVh%fH7=|Q9@Hgy`H_OYpBMd6MS)JnX>lwCFn{oTNsXzIU@H+BqX{?>3>(*&Hm3|=0- zjej9g>Y1=#3!K5^W*9a-idQhn@VVGm<9#%6ZZ&vpb_8$IxFDKW3VWQW_Xd;CVc2jP z|3dduyaW6FffFHT!?3!mf99mB*kTb4zh?pGPJ`$Cn;70xWw^fp&PUzw#+oXm9@4+h zfm5Qj#gE^Fv1TTycwB9n4xFpH;f)Vwvv(6BbOUe>H?^L@OFAYLgz|;{tpd(R2G6CV zu%I9qa0T!_2Ts}U0AL(m(ZozQmN&Lo|lj35l zD|C+-9Ajnpps2up^Y<1!yJKkeb38OIU&7T$c0g7E=lyKF!f_M1)@Kd#?_a>#nFC`O z=U?IY(14hDgMl-=8{XK0Aj6P7M+2w0J6?zZS-np*H~__Hxs4q^(OTe_-SszeWwA{vy)h~S$uPhhd zxUg&t@#g2k8y~K3#9NsQZ*2Ia3-NBvg*RqQxA;Aj3vb+nN$|oMvdJHE;f)Plk|RoL zI&cUF1)PUh=_MWF1*4qq4oe((mN+7 zUQsAtSS6cs;Y|$R_QP<~x$p`L#!Q5pH3tE>Jr~}jaEH$FU7ZWBurQQ?ap1j?8*hBD z;UL}@Iq}8?(L7$}us;^F?_&gDTzge$^n9qb%57pgHxy$b8rz=-2d1>=aAdl{;WtfB z>j9_dz{5Bv*o;ej7H8qD99Z0*9WMKi^Rw_6F6Q|K!3x6qe^VBoo9CbAjv?s*jS)cJ zf=BjtG2t&P%P`&8GHp-oY8=!e-M2iw6_P-EKgQR#Z05U3RI zc7bw)J8gSnQpAKFINO%~uz5;e3c7;J`5i*Q-@7Tmkh&cpNe54N&v+nTsEv2RFL;-PY4@nESjI3 zIcM$BuxG0h^>|l{<+lW7>>5;46;QhPSus|8w$_Zoq2#ap@dUO??)_ppPA zqjt|YXp@8fwbc-f+ql1%&mm}+Z(Z~-j#^mxVofe zL(1J+6>NNuhcBIDpt2HIb3x6gD5+Grh?U3WdC76P*lH1IY=iCiL#0^c))g@GGBE$r zl1yrmqyS9^gsTDYt zD?S5NZa%ZVXlv=(M6ibp7x62@C^`tUTE3B5#Yt|UR!zlcu1eZ_Uv1^e@|gY2|IA~F zE{6jDmFQ-9+&#J~d0ClWU5-<}8Qfe_OfFACEi1GlZ$O`0FsH0*b0w^bP`#4}S~1tQ zN)^w9qH0)DjE<<-iQzEc!{uMjIrWx^48oCJ*L`@RqC1uCQq(&W?_UU1gSXoCS|ao* zAyh`e!DWhprcWLiINJ;x^A+eTTVGmMs9M3H9$Rv~XzL|Mv+py5MrOc_On%qK=1(IR zLPTrn-knn|cR?#Kxy=kDvA+|(k|5x=0B*L;f>v=O@$SZF>m=?+;k{m<>=78!gZz$V zB3&DrcSJ7ii`4BsXKi7-OV2ESOhvgZ7M=9fyP@r)fLg4D^?LiXgCfb85!<&-lIxQp zF9kuT&Y>ZpYzR78*(NCb9bT3}*r!7(?DZtFI3RgNmC%$~O+DASuOJo683T+Y5I*_h ze7NoTgp4}qNAU=@pDQ}Ph4i`*5Q900!M*_zvvBywY4~WJdkQ~!D*{VxT)80rkPq0CaTk@MXN5FZdt?lfHaf|}Fl34v#eqv{g z2+Jw^q_H4n=q;_#qntaA}<%h)z%@Gt}G@DxJhSdnf=+me1715=DHFvjIT zH!ia@cXmW##Ja#tje4#|H?Q7X2mf45eEKWgIKm6irMcMU&EYb6a2i7G2AO~+1W|Qh zbs_juPsl;)o+QZTNKW@*CdW7!531y- zz!?N~ZqNAl^sLUzLbK4k`OEb2apM=}fF)?EGJQ+hin|iLNAJj@>2bY&uKDRmdRES5 zlUndv2j^T!WUMs;4@5AUUCraLMFSaI)eqO_&i?!YYdw2#9TG~_VI&LId&9q^Oq75sGdye3IpxKrwb6UJ4Gi{jZ z`J@(0;yb6K??FekF}YiLSGyGf_b=ZKwug%Y{weXG*s8qFC=Mv~qc2xR{L>IJ4>=eF z&*F*7GRW@*;*?V%p2^V`l1e02iR)2-o)f4H(DMROb%f&Om}@cSNAr?|%$&JxCv>qW zzJoc}>uBoR6Z!2acb#5%q{5_hG~;F4{jjsN{0kH5S8xk&scrs>f$o|=wB1lxGB>{z za@M%F=`D3g>#4*O)?=;@Y#cKgi1n@XIeT{=oI9Wduxt_O(pxUgA;CfjQ|KuRNY$@l zVzgl;OKQXV8X(QNU0ohhbw@kwqh2WmT%bpPvV%kznikfa(U6KSNi`+o$>mFH;}C!z zJ|BWEdst@_s~^Gr=RVzVXam8OUaGD?L9m$yhIJX4zsTq9ZA+MUUD3gbJk~hEDF&mwrChP~{6%HQw~N>GNNI-Y0COF;62*K=(CofWpH*@?aH7kGOOFz$YI5vg{8h`o=)jN2T{*SjUdDEAE9`0~# zSYwSp97*Iw%J61bcl_o31AT29MGnV?^|=Q|pv z)%E!BzUOe_Cg-iLkAXsE!>W7lk&&vpo>Vo4YM@KkKTJxwP@EUx{x`{doPCkErT;Qr+orEY+#BhT)VqFOtNY?DMxD7N4l9>+vD;TmJ6ha-+fU*q*Qr zpGi>F^;Rt+srCew20NP75r(^7zGC=4?)~)lRdqex#ycDv!)eB5Z=qrd)BLPy@2gdH zJ-;d(j-|St)-c?3%!_=RZ#=(0Uw@HbU2o((%2jVS6}$B=z(uM ztE%fsHOt{xs+6%ACRAthjpx;Kk3D{vOV>9Yj-~1_HD$O^G3Qx;Ywk^q8t$k*a5$Dq zrf$GHRH(=yG-qsDd(xqfO70qh?V+x`Dw$<4hvCVKSgNziUP&D0sH|S2!yMHIhH6BJ z>aHoTpD@Bved2Iz3=cDWI5I?4b;*~rM>?vb9FC=GHvSwQqPiphqgjVLss$GW` z{N^Y}Rqt>t)h;Hbqe4{Yo$}_&QI3k5r)WlbmTIc884X)MtaBcowclt*RpxLk6&0(| z6yWixivIPx5e1Iw#}3C*^))tyA*$P`-kF%7?G4*;eGJ*sIYL zIjVZKkaMy~7pT}E4eIySnUftA`*@nkpb86Pb8Xwd9H#8?OD{QEs3;OFBzOr=i(QBks={em)jo{*^LxI@ZPT#UM^7EUs(nc!Lz9|8&+BQ~a>V zq%eXb&CennhkJ!`gI)$Q4C(5Ag3d}|yWqXW@WY*;W5B$`z#Ijk z9<$nIoKuF5&S8MmvkNDnGB2jAxk!*VrfQ(`yRl)(QhR)EVQqbFV|5+1qT#q6j^Bk` zK}StsdN{=Q3qclivjkxcu3rdYA+AePVGVHba!GA+QNw)kSwr(9*U;$G8#Jab2U;$T zadLK8Mc=!5!*s}Tz1$)6;6$pLx(1v#?B*fk)q@kM8kRC=b5ix-M5+aKI2zgmSx;`H zZ7O%wlImr0 zhl6WHf^Il+yZEA7zvSqqk*VTZ9oZpE10p;RoQTEOd}MxO!*bIi_+GJ@)9UZrk>63qRY=96vVJ(!B736fM!Fs+xJWDQ4u*6w3)W(>gN@YvuAPXc=zBh1B6O z@|M`(NikYGM#Ywr;jgd*Fq*=2nn9fVWG;mKp@&CpNpzuK#IRi?GnPbiPg+D6U9*z}9uP4CKYNjP# z@xbEZYzbPfs@WNw^+60p z80-~4|g9k=NzYL zT`_*Ct`~D&&qmf&I*EE%%|L&sJD9)tKRDMveo~Phx07@In#=cMS(q!XG{JIKo9^%b zPHh{<>8vxHCGCoNrJctzf2FpCPQ7{F4`6>7@Sem&!%`Kz!mzx55$v}EXS87v{s`Wf zaby!`E(7!pIP%sH8Xu27_~ubMAh1WdtpLOI4DoO5q>z97xB|8E3D!&)=ij(7q4cua z{T(=;7(AC=oUai=`@%$`3pib732%4UYdXeoitfxXK)<1<0i*F78w!_eS+4-E%iwaJ zB6x+9LjDnNF!!0*e@|S#G}b|9)aomb}#T4pYQYnkI}y|2j1whq2qh9 zHgIPaUXQKmq43nmnFJ)tDDBV2dkY?qvLc80G9rEXJ+W;4G_FBF+~>l4S$yoA?)FE! z9%c#WIGWIT_}Ak=9z{YGQ6>>C|WTyKebHF%TnqTUq_x)u;Q*e1spC(E3l zPx-9yg)aj%aiPmvxYW1__R}vRMjZm!1xaGJ^_9u!qXhlgipk@zc5) z#G2z2uXqVe&;9qzd63@uRP3R{usl<#@{2&ZhWDzLq#xsMH$?i%+Ky%L73p7W#gDHI z4HN-ghh-V1Z*CtHP+`abpMY18b_dYZz z$3=Ku&r4JuW;>tD`?AdOP#uWsBP?Q~eG;s8HaP(W%_9Dmi?~@z5WI2^eE*6dB*|!6 zQis_>$;$m;&Vz0H7cGmfC{82ukA65GUTd^i)Z9xeNf*G0B+!6q)rQjX95@CTD^3$^EwPvL{(jLwYTp?>)D#k0&ya~_X|KJ0�deSRB|(sG+e z@%95$DtIFRO%tdHkWwT7O%=OS0cmLS0BL9!08%`PG)xt|Tbq?Ux!&Vk?*|m@FZ~Xg^4(T9?{u`WvaqZ*IMg5Si8!ba2LWR5tb+jUnK{Y} z_>YOAc8(N?QF|3Po1HMKLD3i04J#;tDqSd5j*=uz_B(mZ4e= z&4|T-&RMQ|tw?WQd9;^2I=1Tg2z1Gor?($7IoA3vYG=oLc)6+`YSYd~Tx^Tbd6Eo* zI!kh+CIYDCnO%ozgfkVxLOfxG^JGjkDR-L~iUGatSdO-6E&%2HWe!RM()x1)pkh2x zkF80WK)=OXDK-Ks7rV`PYd!lnpg0~dHp<{cfd&FPNg!_fXf0d;NNdf{9Q12I%9W1+ zQeIvINO_rxGQ+$KscDMQ_s{HH_)^h^eegU494|I)&78Ht10_^1jwfBY!?erF6(WJY z4+yvu78PNS3W4zIwHXP_h)gKhXGKJn0;eIWo{JOMh!@9uh(HxkwG)@iY~l;BNdl#; zb+t{DIjoLj0$*E$i(Qs`UZXd>Y4q@dNp;Ic4R0DwjaY+*?6q(F(BQP33H@&`zg&kf zXi%0pmtW|16JId?^2=WVe-%L#Dpq|M!3j|@ zzqP#Ro;c~$sEQy8)mYkTnP?u4GI_|QG=H1^XAR}g=;B)UWk6M~EZ)eAd9Lvg057%S zSk4-#k;U$d{o=3U+-gGiZLF}9Z&O3i7^ONeMAe%uZ)9`URy93jEwDy?9-Qqn?_ahk zCeCw0ICMO}n+->d*5p!ai}=*@N_J~BboTw$s1n<-T3fokXc6$MRL6vT)eNUf9}Kf!bX7opswiw_d14wo&(8%x08rBIUBK;MS9P##T`M=e|sq zm5@}-m~qnVnN^Fbn-)n^tJtmyHA~CO#upUP89Lq?&VxuqP%@w%8;T|nO}To;+*Z$A z%Sy&Ui!RI3W^)M}{paaz?$Z;Mr9#=0VqDj_sITr*lA(&}n1Adi)kn2!tWztcGBK=$ z9?9jp|JQwIFqjIdMYibVgDdC^qu2XY;|eAOG~>!p(%X!lfh$fl5-|mPeE(Ng(8q=p zd`ZJL6dZ143(4iWQXEn+=lvEA6M@IOTxi&g>Pm4~BMtE~sPV_KpN4UGV&^VqAxFnGb6I8MIpi``NhIKMV{thBjSo|(R<434GE zwen2*b-lpjv};2SywQb|I7V@X@qQxRHOUPt_Tkf5alU61P;>79MXvP7Nwu@J| zPU0~)i3)|o&ZqMx>lR#HV$GF#kaff=XJGM(CE9T&rb$@RJqJGr;(Hh#UGp9;P&wX* z3Un^sI%~lo-dufhrL$x4jKC8W1q~ww;wb7cf!5=FxIll$`v`${K?&%3!k&PX;s8KL zi7VG=IBt!4m4MXe|DUHG`u{Xfjh6Bb^Ay`%<*7n}$Ww~<^*p5%VV>fUSb0i)&dF0) z2ErLq)bR&^ZG;b?eaKctX{~+B64LH=rfqr6d{)XV>{K zcb#y^nrkI&T{;k6@StR%5g4<)20-Q!?t2p8HPzoKmkm^!<_>JvSQ<6v6f8= zr>9YoS05|T@px;qata{!i&1Y5-r5Y*0~#-O-*wPW0qJtgqkyz&cpi`zC>t2Y21?J+ zaA*Tl07#dOCjruhnKPZMut2bz;%;6fwV)*ZoNVUpBTHD+MrAs#1TMWwe_Ebyr*rH^ z6g9L`ZQX)EQK;x#ZfwtAo7}1R%5{OBA+$cV2$(icT^7w*%OvaCKpCJxc%t4#cxxg6 z^xDLMscSU4GJ{1IS)Ac05DPLm09sRBv#1v8O!o?o<&Y(q-~~g`kN?e+pEHdA7-k_X zCXyDu)C)uBsVN$N+2v!kFv~6+rwxS7^ZnB!{ga=cI-Izf_DnGT=(02~Fd5*~Q`!$5%(rFB-uKQL%P}mka{x$P0x?YEbw* zz^+2Y5hKm8J^%i^F1rL58U#n&ACtFTc41D?Tye)4S4(r5L)xD1y9JWc$K!14y?Riyo)sPbw>0ZGItqL?!9&?yX*x5kY8T(A!Un3!uPoFkJM6|2sEpG7U zk6EnN$DdLWwxFwpX8Is`o*LFM_>^vFi5oUs)N*(h<&nJY3=nOri!q?;Sa08yl zv|>oRrz-;-CHQ6pz$1`OdkUZExn}5l!rq=Iv(zH-S{PoDV2ilIHj5U~-oKqK@j3tq zMyRQ~s>0@v@)FG-MxY8Q)_Ok>F}p6$ySbr({`s<((et_XFbR6F_*=au3NH7l#P z0K&-R9ZtBP5KwM=TuEygnHo`@qII#h+hB)bkkxYHk4}eh+A2PAqRpNV+oE=u`f$K8 zxfBkaKSi|g=Qb0wXQ+NuyQud|dLSz^L=8reaZrh|5*bPbwQs=Z($;sNNMs#;Qjd4u zsuro=c7B`l0D2Xb?v=$B^|<)Fmq1rI==*@!4Me?P;k}PQ&*H5^*3SX$CwBQ@qM-tD zKTrp``vW>a?C|Qf(IFATWJev*fg9IBbyE%1mD^~$4E=xoBAHW7625BWcBaFLn?CDY zW3v-}aoZlUgvmPR==C^MjSn$P&9A>#TaCGFxLZ$iP z_z#EZ$cpxpY_tDz%@*v^D$Xn<1()OV?<(w#=ovt8w&|q#bK{jCmGUoj^|xySndB> zuU0rAbn^fktZkV1?94U-h9$4P+Js4L(5xXI_5r;y*?42dgt|52O#{wZ*?5JMLRU)= zuK_qM-S8$Ba9(W<@oomrFS_G}M6!vu8aOX!lc5C_YdH7W#bi23SG58yurI; zEdURVpD&Y&xKdyZ@s0t`$=&dZ#*DE@_$6K~a4yQm%i0GZ-Zj9vGaC<*2fClo5FyczCUz**W2Z){O8 z9XA871vo>wssO__UHETYSdyMC*mU4LZSY+D#&V6uH=Kw31vn+9sb;d3p9{zMSlC0s z#}44U#@-o*GhxLGv4Qs%?8l+8+=Klz4Eq67Kf+hxAl$Qna~6AX7~j7Mp_54$pfh*? zI7hG-hoQIX-}ul?B$coqj@9!j7;qY-B zyubxBn1k`Ce+8i{he}~T?l9=G!b9VSJ8o>S-0p^3GjNV%M+)Q0Ep!hK7UAK+Il#GM zq~iJhjSpS%KykzCfpg1|iWkR^#&7KSAOo`6zJ_kP({$C&ze%AB6ucDhJ^{|TT=9ot zA1wY&2vuM24R~-RaB2-3aa~66ipB+-A@5M&{Tnz387}H?@o;lZkg-mJeJd{AKZ<54<}JF3XLxvC-o~7o~W`uzvtJpBTKJ!X=;Xe==SHqv3}0uK@0& zfOn3;^}`J}(8a)O1kU{iucvSa0`E1015k{FJE1UC9t`&%z}xo}#c|<|4OL4??&x0~POAU@< zYPh-ZlD)uV{w?bT9{K9ZUf{8v_--%o*sa~s3p`HTALs=h)3G)O-sth;#=yxLmd7UG z<(;Zlt~|osv=@i-Uci}{g_oVry8-VcgQGqgJ}3&yMeGX4({tfXnmE?d@t6JM{BC$N zyYT_r#TDJ~2Ij=Oycc*Zw<~&ycYQDLIFbK;FYw6c5B35tA9#=S5^qf}@Yr8G-3vU1 z`%EwJb_d?3Uf^-&{k*~J)0*~X)FM5H;bnHGGuYh4Yna$7SgME8}NB@TP0*~oE zvKM$mfH$!hc!Pm=QZMjig`^jF%cZ@*W4n{;CEkU-z+?Neycc+k zUu!S$7{9A}fyep5)xE%DxZlZvHySq_j)$8y95&yag-1E5Y(C}uXf^PTJxwV&Z73dC z(2bvo*Ypj~`v4EkSK$pm1AP*nufpRZ_i_6QnLmvh|Cf%7vhu6m3uP@-U=iV{&+A5F~g8Q|e^jvgYOaUUINrk+4>d{D@WReM5{>V$e~ZF3W!i zp&%(6lbdL>o?o89my6{%s>Eaum7@~xQi<7Yt6YC6b9QM(dToLNna`E2FWmtoj|Z(Q zUnqP@!b-GF|DyTRFJqVg8!p_-`53?0?;(oGwOGp=u;W!G@yy_|%RcMESL}+7v@ z|1zap?KfmLOS{%u4~y1b{6z319K|XN%P2(!bpW$>lz`AA19w#L8VtR)3s}41ZVx?{ z*Ew9XMB`v>v$mlqyUF{4mWsTUUh+0g@|zRr69j5tN(H(S5D%V4y_*4@D9|cECkgZn zAmy>w0ab`yhr`dPsB z0(GwYcHeg?pG34&QJoQz1Jh?nK#2DG_l=?)Z3BK@kk z!y{b4w*s!vs-VU7II(d86BSyz5W6>6xZR0Xi42@vw5avrbWofOvZ!}Hpp|%3&}xN1 zm*dTRiF!W*R3df{;H^3P6rkJ1?)P|W-i2;8h_hzJx%0R&b|v|nqJ+tPcqv7!^;&#C zv=Xn9q76;44nhyb^|SGUvh=3%^mC=@XL0#q^X7iP&L6QFdA{n?SjmoTHa=0SJMvVs z&D_y;N@;p?qPe|aV)d3hZ0DAlx`SMs#CzR*1|M0Oo+267IiPT($vE*z@+_`rEJZFE zIokSyUh#^=<{k&Gx8wFCYqUMdi}9+wm2Z>w|K#n4ZSPReR}I zBxu88OqpyZ_sC**0fQ{I6fCwql@Ma#&Z~uVU2_-NtScv*X}iIr@#{TA6pXYqpZL2H zf5t;>Gdp*Bhy!M{D|2~wpfKQT3B#a11G@I&YZy=ttV&ky2Vb)pFa^7nc%t4Vcq;>b z3y?BkJ0Lb8QEwC8%7A|bbi3Gf;vHl_ch32Avf#{89%ja_{wB2VC7If#l{MQS#47io zX}edr5$tvCAj~34(wnhEe#y|njX3%Xj*qPxvdiQlvD7YQU8~EAHl#i%NxwzbTD{}I z(t|dawv~02b!`Z!Q6TYfoO4d3*Gye`%wR7yqNHseaqzWQS8{Vn(OWAH?qG$%4W49h zeDB`z7{7ssuh`Z1;iKrq6;skr$5urLm*BM*a0}J|db+gjWL)a<*#Q@hOg!8Vcol8? zf$Hp=c(@OK6Wd=X$!~92lNy<5+jV2>#$^YUr#DKs@LH*~?xzP&9VWb}eEB4M_ItEk_?PZ0!>7)H;U-Z=f}z4+%Q$qt zJ_ad04W$wFJ_2+So~YM^Zxje1mZo;(HvrNh;*SA+15ea@4DZtgdLD0eeFu=b4g*6f z?KnW{S^`L2d1-~xHaOQ7=lUd|+a(4Y0cl(PCLo>5ZE<#e!Tj24?*T|#?UBxoSAeM9 zseshKGXMoza{rdE!gdT@lSfbo(t(e&2|YSheCZx~<6^>%?qVfdwMWKC`f=7kU|sTB z=li1po`NUqCRXi7F}}sQ8wj{3VmGWwytv+0A8< zH6`hdBUe|{px1q|@FgoNUXtlsiduDZd!p#o*lla_*GOQg+2!d^k(6XXY}IrL@o^3D zT_|UPGKP&3O8QU0N^F0*tfp^CezIRzrf+97{U@;F&E=8R5)?4+?-E=)@DFy~cOhA4 zD31Z6z1TEC+fqq2B=k4X`59GL#gxs|Ojbzc< zSlcLgXa*cmx+BAI_X+v0Qq0w4{JySqD{@^sV*FaY6l{Bn5env8o|&@6E~hR#i^~d+ zHt9pOhPEQdS_Xs>Vy%5)QJ#qo`})BC40a9$_6#h(GO&BX2(i}h!Gb9(&kPxs0gv@b z;I^rePnN_gFiR@~@12rgS)*stTH8xvrR-&6SFWM{jB`LL`G<60Q$dg0QbW)Zb{?n$ z=@!<-L>H77X-*}Io{F^%gB>hv%cXOfP~(m2T}Hh>%*~JRk;%sd@fR4R$6Ei2&yw_# zEftwX7&yJJO1NxKK>Rg8u-}ERbG&->6w+i?45_U77sTt({g)hs#<%pLt_|tZ_sVfy z7e4MQ>;hY)Q?GXJzj|{XJW4MQc+|Clys;g;0k3_2=)$Q9{}UH+y@g^0V{Jjbvf0uy zS^W7BIfEJAN0>O?9(3i&&-9#kD$xE!P=>AYlOm|sXx6=n$X(;Y$1j7moqCc^7l34mWkd>$3NHiZa%*)Jq zC)V->${3AQYu6=vT^Czbu~Ylxik&=;r`pSl)~DVt!H6O=`#$tq7%iZIxa7c+^y){_J-}+KO7`GbtKjL-_$mH1=1axQ2Z-22m)v&&t#9Rbqr`jusVmp|Ve@r~#J*22YnB zsh|FAFm~miK1V1+WF8u8*&n{*^3|Q5Kyi4;VrbC<5FEFyZEDMg{Ps|KXQhKm4cT<&nt1AsJE zYXLE4XwbmviZ{?fXEq2LDvJ)KJ`})+5||$ea}HrG$?9!w1c)0l5lGfwEBE4 zAocG~KuYldpt*vVwaUf&K1Fp+S!R&5ikN?lT$j61jFqf2OI_pPm3ll|G*K4I+8^$I zr0Of2XD;nR%XTtWe^3oqY__v})Zfo743^=7-{-*vzs=H^uQXGzt^PNrUTYI= zO)~Ye`UdI8zNP6k>Gdm*DMGtZ+BTK$E03AnmHcaG-_kTDu3P1%$I_zJD|TnIW@Lw*9bz7_OY$TOQmgRV%GKV11>xw@d#&KWo;}XZ+gwpAC^Zx#;ohF ziAN}V+j%VR;?2XF1%1a*Oy*smU7GrK;t_DLhk4f{JMnkV#3SGs&buA~hjHHZ2uoJx zUD9}*gE7$YZPBOc4`&h8c!F~8xko4FP##*GYkms<3cJwAywHiY)j1moQ3a!EREpNe z+BiDVoDr zYZZWs%v|)x=rc~iM_GE#28Oi0bOSV0@mrxlD4gZwFP8Yu=~Z0 ztJy@Y`yk^or9))3rmeD_F*ng0=%RiFJ)UtE&2fvo!!1DnX~Xjy@T;qpSf18&>TSObG?IF0BJ99 zyMrDCq|G)bvI@QHAgV@GyW;@qQr2mJ&IU%*n+u5HU|A8+?TA^_YXqc|%oPr51Eg`e zACSgi9U%4jPk^wg30mGasS9TvfHZ9%0-7zZc9+u}=vHm=5BN^f>%?{Swu}2Jr((im z3ht6J)Th0$IMxDuYL2kOa$G2X1Yp~qpj-K?y|@0g=1E@ak20E1J|`oR&OU`*vXm5O z6UXI1&1>!}DO3VTQ`&7(*8JWGi5m_gn@Mrei?JJ4=dYFyD%Sd4WF&7&re?!C;Emra zUUEX=>z(^&^)#HH=}5b1?TSMI+sfZ#5^&M5o6BEP4li-Xy}wfv+;-6{G5a<>`d8TA z@z+p1W7j;#Z(ZC&+Z{zC=CT|y3^Z7Q>ItyIHPy@RVPUM1Qe&t8eJDl5c8@Vr`zXoxQpoc6MGahv3gn%+algQlwK0e1U_KfVAj2W>r^i3n}!ZbA8|0eGW(& ze=n51(hditRe-JhIe4Pp6z9rK4;@ne6cC$?sK-uP!^qN>xrppG7w5^yQdoltv)el$ z#=c*yT5ejr;9=p2v$+euZ4g#*Ovp*X6Xj!`eWzHQdHLsfV9zi z#o_(a*?r;cvIo@Ipv{!eHJN+K(6Z)BioN6>SSv#DdGji=qCh=sw{|b* z=|n&m;<4*&S=$Ab(7&DjBlm($F>(%e$)32=x?<<8sY5Wy*Hx*G@fgh+7`xc22&W?s zOYUj!B5{kga4QD8Gs(CeC9!;I`7mRLij76;j&^_;ucbT8hBMc^%^}3Z?}#VJE$z!k zGoY54QI1BUYCFsOz-iG^d>{hXboJbKxTH4b3ZjJ^g&g#jr6E zwz<>Q(Ev;Fl{#^u&3+mEER%upNJ8)#vGl!8kfZhHR*p@v;}~l>1b(C|qizq=t!YU~ z$vENn=zhwm4MZ2*6GcyAgtsHs_6h7O(o0_LJP->2*qzyiqmW#@2q4DV{vb#lb}>7U zJ;;-zB=)Bv_RJF`jL|MhF9>ExX_V2t7&y!kTc40K73mdQO47C4lDndeSE6oq+^T81 zW+|8-$0S1wAX4{qhk%Xh;kJi6h&>#*5gWhBJ;ItxE`FxtQ1~QqWT$Q7ILgGaI_8Vi4DqCN3%Hh?z+BFhZVOiq;f2;aK+CH4Bl2P2pqw>(JokZ9$B4$&C|yu#O^WQy`5r*?i398rXln}sGq)09;oCQfykQeG6tM`xW`2(3=hzr zp`dK)y6+;cWfp2@QUs_9`4tsa;tDN=osM1Et!P(s8=$#@x7|^&!`FepnSiwWp9iQ~ z@Gihx!??{szX7EFaravN`?qtYt~_-;8<5i83P?xooMo%sqYiHaAdLYVJdMGtfOG)z zuEV~f6;-LwVbZ<*Z_BAcM`+!J)oczn4`ipUX% zD+Jj%GP+YWM=Dl_L0cw*)rDBgl|W~2j|)9e4r~BRGI@5}YHRE^PBPG#;YNfXpd_&y zhOMhu3oEYKFnfZooBm#wnU&8WR^kapAQ8AirY5gAe(_FkVyCPILSVZdUe>&Nb9(E@ z7s^Mzf|ao5&jwY-ras?sEvU*e*xJoZD#`TA838W(L!?0>Ky@*(RWq{o&!7$~cNF@S z#FL0ZzpsqKQ!e841!JEYj9rBdGDqVYjMab7gJjM~G%O!w`bggW1_WrOn0X5&^Umxs z^H|L!;yXZNw;CU3)+IJ!<4^K#Yp%Rw#6Jk;9X3+4^X|SLBi?q*CvZcqy{1uatwe}r znW@NTEK%ex=LbN5s3w>HFGsU;oN@&+7isV_wmh7;6GYO{@oEC#MeI}8gu zx27^q?py}0WWZ=6oyt$vWnZC$L@n!X7i+nR<(3Iwx5N<(8$67d#vnrMI6P^kuz!d` zMtT^F(jA=_V}e}*1eAy;OE6C?pRTVt#Gl{N2}9J}I1T0G3H z8gf@z?9SD(=F9L^kr__^5?y~tT=pg1V$EFb!gm^1QKa5O;h4g*s}yBzd450K!Q;4!y&UIQcUq4=>a3Y5Pd3?egP|1rSMgzqM@sP;36_!A=T zoy&zQR!%z)7t}HXD>B9T6`3;Bn%&@NCTB=?$9M3R%a6NY-+5Xtmjqm_@15VU7~w=T zk@|lUH`_A0DZJ(&8sCca=3LvyEW^%?tkF8$JseOiG8ux_fOKTX@f=rmq8`_UbZGm1 zKul58W5%oN{eV;;do>`X{Uab9(Eb(Bn|PvkhMH5Lge--r`NDX>|9c|P4 zq)WGPxR6e5>4Z$^9`IIcSJtw=+*6j?f>v9a0_ox@;R}mE7tfP3{-$SH+ng8d92LLl z@$9;Gawhg7qjo=?vYs!9w;ao$`{$NAhV%Xznu8pMw8_l=toUIa#BPF~jA3X7inSxL zE4Xxms>o(GPB4%@gPz=%i||p&dV;{t7BK7Q>~e`ie2*=Ryayx4|Y-tmP-e2 z)P=P-yOe~y&^wtZKkE8Qtg>t~$ICSHGJO%dWCd0V9xBhA1G!oRgk6Y#U_4OnYx8a4 z78nN7GJxHz16Z{Bp&qy+iFmT(qCXXxU4mXoSWG%OB#W*ha}v_aFcbG#!G&1MwC;!< zgBiesbE1&Y}t;Ug^WzJm118x zap7<)g(v)1QplS(F{0Ou1{%G&9zhA zd;J-pse-o#(D4Gj0!a5>-*I*$;BtVt@}!RXd;%a1m#a7mUFe_;APwziKnLN8dUxXe zFZdbteg=q*IWED&`x>$PC!k?s_c7k;Is{Ftx*iJXFmXKskj8*RO?90C=x}l6rFH7c ztLnCi&zA$@a47118_*X5ab-Z`@*_YR8b|3@iR<%#WL)fVO4F#ll)Wz6W>2jZ8ULkVXz8Fs>Ft`M{BY4g#2E}oot0>~J$%KXg^^wE@&6cR(bP6Bq| zj6pdjnKgNka=iF2C2SHgp*QWh^|gZ>3?YaZc7Qn@FNq_eI6+t1(q7h9vD4N^x|jj6 zl9zQMD=~7%qyBnQ`AF4Li6aJI_AkZku0`^q^z%mt0O()(Md|`LefH?C^7Zf3B7E(5 zw7-0PnmQ9-+aJxBuYaW~@U`vHzVh`+Y6`wSl1s1qmwudrWOnIRnP&Dc{V;W~Nxmjk z3M&A1aLR}hH}_50`)@VJ+?;i4?7@=pTNkWuM}|MxUf%rWfXeh+T=xq2RNlOQr01Xx7&pcSvlBw##iJS#xq{|$Q{aEHoH*9rCaf;{E(@{@5kwiVIw#N$?{qP zMVnZxo1U_cQV$<>RpdzrZ3Q#|g%_1tuQi|Lrge4@T-24dd92{^t*(`Tio|ZVv%3Y5 zuD4LeQ7QHVq;-+4l|tj4>oI^d+~WZih<{4~X&Bc!yzc^1S{{hdF#Z9EEiaC408$D> zzE_6algp4txihJX*Bjw`L^KsWDt43bR=e_<38*HlZE8BDx_)6TTSZZ3jvq0IPsq^Q zpkeUWQeOc6 z>xOB60Z&A(*!-42Gx1Ifv}AF;x1@TRml{Qdov0Nv8*3LV4ty)4rA95TUsT(;IO!wS zHW@B#@(iiToW)B`1v3SWa6ERs{Oyflgg4>Q%z9ZM%Y;4AvoI8s1<9Fx#M45X$_vAq zyaMQy8#jK!#7RY?g7D<(c{THE7bK=0Us5^^6c>!+Yl1*W%}PuwmrsS7aE0dLhWg3F zn~tonUQ)~73##i<1ibjpp3R`)hc}5oo&pp2JG=h8`i2YZn3! zHdrPE;g0ks7KX)-Pf9bPbInRnLk`E$JS zXRcTo`Bo$yxgPgl-V(Vza%bf3$j>A9M;?fL)aTv-P8 z^H)57$J2@D13dTRp((=?#h-=9O=`y>i9+NSg@!nYe4}|9dx#X<~nG;gBCfc&Ou8ZlyuNC2bChT=AZ?O z;kOpQi}CPK!*Tdd;deQn6?nLs-ijxUha#a1;m%ceZq;!5aR(l*G2M;l7kGY+=K(wq z<9Q6vYCKQj;V^*P)V~5f%`7}xVhZIuJC>N*vBVT&i7CVqQ-~#|P~1Vo95li~EHTAn zi7CVqQ-~#|5KBy@f#1d0zu7l<~h$W`3EHQ;xVhXXu z6k>@fv=?~&3VgkWhnu$F!NU;(hkdu@f z6n79yOzl`=3bDi#Vu>ll5>tpJrVvX^p<)NI#MF)@rVvX^A(ogzEHQ;xVhXXu6q@TG zmYCYH#1vwQDZ~;}h$W^FOH3j1`|LbSyYQ6b8GwgdVteA*7taBB4#smRp2P8s!ZQZX z1U!@ROu;i1&on$I;+c-;6g-qaI};C&Gg6Xn0iJX5)Z=Nya{-=<@LYoDay;L{a}}Oz z@O&H3O?Ym>^Fus8!t)b6_u%;@p8N5v!t)58$MLMevkuSGc%H-a5}udwyoTp5c;3eI zE}nnj`6r%_@NCCZ9Yq_0XCFK?!A4#BKN2(xkn*# zk3!@gg~&Y$UF@Kh4r+1Gl@7YvLDxCx1_#~jpj#buyMuo0pr1MD=MK8hLBDm-Lk{|# zgW4VRq=Pm%=vfE7;GjP^=v4>(*+H8f^p1nJIOshGZFSH#2kmgs=MKWK(Bx^adem zUG87xaI?d)RLnIRI{0C2Ykzi!f04sK1cNx1YOj83#UG#QqQ8Cmo___`{tm}d-D^V6 z4^c5){uNxmb~u)5ow3 z)1^0`)9pCEU^=<@6FszSxk&E$Wt!zL1xMTKkRPQ+)OLYKnX!gXD z7g+#zrtoK7Z@#>zqZ&p8m_3m$bcZlY<*m2fNw*HJBWI1DSOWOK1lF%J*K^VoG~4c=GE03Y5+L$x2^yhtV9h>~|*!S?F?oX?{j zj*ZVxfI~ABPhMmONXWgXAMi}eP)Ehyie{*1)BcfR@%>?&7ol4Jg8?0uD_aPhMms0%BMXU$@W2aYuCqY-r;63zx-tuvLC$sJoB4?!~xE zMbzZ;L4vb0N;wW_?Jc`3J;?do-{IJ@m~LXoybNC=pct@n<+}^CE|WitX6^ zD@zX>?x;lh6l{lsO3~X*oDUVMlklc*&;RJqw-0qx>l}^^>jhKFhY1z0DmWO>Bj5Yt z*~1*w%MQne^`eRM2%+LaEIl6dv9kc=95= z@PPfr?_c=i=p!A~I}XQEQ3#UeC_H%)UVktS&>k;6`NUC<>h}(ZRKa>$Csg^!im8Ae zJM-qFk8&JN2@aZ3c=96s@wFGAK3`V6Jj(ez$KlxcaHD``G@iUjG2Tq*_0BMYn%&f zb^u4gjV6ZUg{l~D=HZbKjh->yQN0kv3B_=NPz}VJX3wps-9EvOArk~6I0A9Sie@67 za11B9u(&lvLmUNpR-a}P9zPFR%99+`SwWmo49VAd5gWth>#v$xG>JE}23oKOsp5h_zfz07EMQcYa(#KL2JDi$V;;Do5Az}C-=U)_>?a*9vIf`Sp85EaLXc@bMvZt%9A zb(~Mdf`Sp85LGd3QJ3im)B5zH3B^7Y3lpXoPq>vx&?YhjZ<@mUPZ*u>saQ}jf)fgB zDs1y29F5aFcxU5BQ++CPOM~EqsE!A&pBtY%@blx24^U|Z6CCmN04;3MTj%q}U%&VI z#U(;Tq~Spvp}N*^W+}e%B5}Nla`?VionPvxZVKXrVmJ-Bc@fS{XkOoO-HvI27-|I* z9C7Dr5zPsB@*_>PN8A@1n=*XmMfMRp$Q_ z8Rqt`ed(c8c_4;b!2~Bnbz+EWxBIR+;lu!yGQHr0sMy#09QEe==iP8pfJ&KOa6(iS zA*$`4Z_BF)P$|<3PKb&l-n@BZT2j_Cm^WqQF0 zQOyu4&c|sMy>WEii~yA~z2JnXW&$@aVyV2J&OUgiPc?=;6jT}$Cq#8JZ6b!@h=Q9v z`K1?BE6)o~i0Twz_+efCRL#Is0#wR}f)k>eB~-iPO|#EWuKV7s0G0BF;Do471#Vts z7oou}hj$C^K=EU!ydgLts@XziYs$p)Zdo)tK&8API3cRjglZ2HR>c7w<4y}uDQ^f) zi0T_cWpjSk5!a@^5uj4u5S$Rz=|W}O!{d)!A3Z%lrMw|HA*wS%VeRs#9}YbuK&8AP zI3cPth05mP?pHmq>P(-?TrVd$A*!>4Y6#vmhp!!c=2-zM}+>|9aA*$L? z4441q?%^tvBkhK{Ur=yDR11X4ENOX{eOxedK_D#U4Z#UfEeyqQ>|5{Lyf8qeydgNi z!|sw0>fv>1a428^$@lQ z;S9D718n!H=E6&bm3z3`rcfxyT(=y z_^Bz~%~mq8;RWldCe2TV+sBhj)Cn4+R71P@v#OiTZ@Z= z(Kvq^N-6EHQwM?ur@5QWogtgx%omK6OPKizJ4$e2aWAE+U6yRDu1QuwD6EP? zVQQNdXJLuNtm%bSi<7lWZ>VL1?2}vnZFhCdS4wiM$(@o$FR4OjoP? z7^$Ef!VSmOMJH@+MOC}u!@))|+bcMk_`yXAOET1c1oG2b%{czlQkTi}u3L(lQuElR zb$5Ui++q|+Z58AP8&Zum;7Z_0sDXf-T_~j7KAMb!WMNZ%VO90KCi+;Fs!ui5g4Y+L zE^90nk7*PhM{;eRUEpe&X6L92CXm&uY8F*Deg)FFAd)0qEgI^R)r;$c;f2HsH5%Dr z>MiaI5oK^iZG97@2CEj-RWEGvN>4e3ZBbQiV`D?3^u{%Hwbk`#tktJ%mS&S^!kFOP zY@r7n$9;ukPN%A>#Y>h}F&^~|Uftq(6#cBLl7^ZcySDu3>%!uus+#Kh2Fg6vc~w=~U7|$J(+`#{KTI`Y8;Z6ISy$CG zZ{gA^l_!U4q*p^hc!5TY=wW;_eggq<9dnYK;FC`jDWhNV>k`#pwyX0f|OKoPTCEVJjL zGEH2-DHM5i&J}m#QjNA^@ls@EfGLnh8LN>eQ9~A_>T9IdRyQq`!qlo;#STbn1`DYU zqP$h9N%Fn4w)VV`1rfw;s`SJLO>A-9F9+l-%M@U;brpsJ%SY9WYM6KK=z_R!6xR2I zapS~cT;bS4#hBZF{qE^b_|A<_3jZdcrIA3ff1_Lo@p|W+m`O z7ltpI9|RgIjycKD=G=Nr4UOKALO>vjZ&N`0#zqi{MT{v{7c@cZkKC zq|;#IoyTd#)fj$l!$U)FbKQ%~(cf*TBY4CPhf-guNSBK8nJATiZ2=li#p0MQ6ov4V z>>7SUix18pkEg1VjM4W&w>H6DYYwYIdvTf30|(>_+!5ytR0KgK)SlF50lj3Z*3kH$ zoIwpA^t>?ad2$@o_~rC?f8XOuJ(CUXQhjlwjMupzjys!!!db_xR6nDrggO|J9)?FX ze+?Ii%Vk3Zs=@nEfg12WOrTc0M+o#Iyp`hDfc6r*-{Gwk8vrTAi-1Oo>))K+dw>oX zyKQ(MAyAIv>Gql~sAimvGmm=u4w-$;!=NzAT1B7ZcAmJNDCfOLSzTEs)l!H!OPzQe zG+tum%Mm%3t@>wiE}QB-amd-8$$rWl^Y-=KC841fYNusAQ#?ZiTJMHm<(W#9*2dIL ziB*x#d#*E|xLPrQ%YdKIfM1Dpwk95obgsl{Jw%#?Buw=yI6EzTSK_0z1&22~Xq*1@ z5iS5HL<5!$`^vl2$yYNNYx%ZVY5ss=6Dzy=#9CNX9e3j86j+4x<}HJZRdP|DnT=zZ z(uztj9lt?yq^I7SpPZz}@l<~-{hI^J(qlXR zMF*o+)#~)r!}i8Mn@{VZjZ#AGiru(6zIx@Sk<^)rf;zYY;mQY8J|-SY*uZ`Xz~aPO zSQJo50R69iZP(IBtd9=kY`rp_9G2fPho^5Jx(MIGuJ07SZnMKzcVe>+wU+m2QA??5 zAFOf}1S3IP4GVrERRsZS{Hr)W87i=~tQyzjrHSbL7VEp#M=ttlO`ip5Up!Hdwf{(g zxQ3#5D*+uPcH}d4y&cg0V#hpCyJrEZFRb%wcM$ksl;Dj8G+Lk%Km`IV15_wbGoZLY zR|4W9W>k*IFpg1=8|sS3Q{-xQGN5tddIlgaI7hwtfVhYp_38kzM~r$@0-_W*0Mgd( zUO@0`R|V z^5K6mo`}4;%(vE_i5Gx`x6AtAG}aA<=P4vdbF6{Z;+hTC26SR;y@TqNr$X-S=Hvml$o`idL<8zu)IM=iYl} zCOYri<^O-r=QDSn`<(A{w)>pro_o%7d`wKnIzVgE%<^B3n+8MbfXd4j1j~QzvV-29 zm0Ac49mhKbkrlk+chOHL4-S_9@?!{{V9cAFa`;pVB6bGuu3O@Dy8Ji1{6#R1R3DLI zXmt0#@LY#3|CP@GR7p6&I8yxRRS>aKgHQO?{kr^DKRSw#E)jO5s40Qe!e8%qpf3Lv zDOM9W!8lU=zzsfC4!+_~V|DqjNU;*a2}Y;^=2@^mDTwf?(OvlVV`obb)5FJucN8X9 zeRN@MRL=hPaRb%UbouiRhA;E(WIZD|#=($7gFM#t$}u5}aPaQiS|4CY?Qe99w32Kw zty2z1IMykr(%#}z;MUY1T&w`dyzD zSK8q~N?tsJa7g{c!H}~gi^F}!)@cg$qo4Ay2z6P*N?XWZb<@mK=*`dwj)vfjikTI2 z;#D;>9S2}-QV%D6>dB@fqU2$w>x$ro1QNy=Q%%^zq3;^c&+!?9tDVW+;Ot4_% z@46Z^s5K2s>l>2|%No##>U%m5fUB$B)pP|;fgBZ-3?FL)S>fnV@!9TY;Q6CdGKd~-6$OU#sJb zdl|U!JcKcIr52Le(dvMC0H|U31@@GUIhoww4@4LQ-M@2K{Jw<9XT`W!1zC*l zuDFkVOiX++{M3Y)VX>8Rcg4{X0o@LsmD*JqW>{>c++A_D@Hi}HO4P^+|5;sv6uP_O z{y+fSj=mHhCmjpFAhH-&R{!?qmGgpKakiBbj5Fx$BT`nGu0DC(m%*?YUg88J)ES1O z!(yrxQ+~`t-}|)=i|Kt9FL1=T`(1Qc93HrbhQ($G-qWzy4#7E?4h@U>4hyHl;&8LW zL2xhx=Wt(l#f699f)V*^;p!qE!nB=9Iks>xH*;RcQOx!iwbv@#+4Ysh`5vrn_$!a)yobTP4btT4=l-Qlai ze2|G7Gu|165cfGSJF!N?`QgFhjcr)S{~3O}19O|fvC8VGrgVa--Gq4!s1x15tSFLO znL!fV_+oZXzB>Tad5HW5CIHTlw{%Q6T5lq1$Zf!U^ex3v&cr)5JZyLoeC)OK2JWFa zCR1^vi^Jn7HmKhL<{E?Z<1Hx(!@L4?hc^Oq^PU>s&>%c#I7J(U2ki|L1^X$Ee-dx$ zI48dsA)>4I$E+AL0LSbIZro_o%n93j1-Q?Ed1kQQ`?%7HY>|D}8}VK^1m+ipDa%ja z_=%1ltbljF5wK2$A05PGv^Q$P`0!(suU$U?=JQP4n9-cv^Buz*bg<`b#E*^*Sgz3{ z%l|@yA&xHBsE|$Y<$2)x0C#;JI5zvg%LB)b>fStXY~mlx6ZgkFaO|WX%LB(w@3}m1 ze4c;F1IOp|b{;r((VcnV`U3Y!9ymVVukyfgz|@Ze+K|hoFC2Fc$peQf=}pc9$NVnH z14sR<%@cQ09ypd?OCC7pcS9aH>M8bCIxbiFQ4cQ31Ba&6`*9vPmdg!!;F!KGdElte zcjSR%J-Ry&9LsrI9yo^gcpf;G%kz2QIOzUs9ykt1zseI=VBZEHLznCMvR^LD1Gf`! zMLBSz#<}AIwnKYm;P^Hk9*zSdUxf|=?kIz$UX=AO&YGn_m*xEom&U-IZa^41BwGh|e3AG$ozQ9Ml({NSab3ol9 zyzk?Bt5Cr*f_cpCneWZUm?W|J`XL+PEh{|Q9|Xm$bCJg&O*8W?e5Af;)6S^xSmx38 zSz*!H52H?-DV9WFfn2|pn+#QL7EuX_ivuo!NGB~v;Sd*mR-fMy-{K(=8WY36JP5N> z?Chs!-~@}=_7i+&c$_=yJSmXrA=(27n?@Ld8Ic}TqI zmhvGHT&srk!gbz|g4Dbr#nvjXHN=b)P;U3r-T4c&y$twk(s?Byo&2C`%S)ekW_H#Q zcG))v#}B-nEx1%MS|>FuM9z4ch&p!#{Xj(rEH~d89kNW#96x9lh$J@OxfLZK2f;%j zD^q&*3lEsl=Mp|olP_O)_1m@8G&csLOD@O{ibux=5(Iah)U7!?@lq6sKw`g?bBD4do+H8VbKu z9w)wYLGcAIDu9}4drZ5Rl++Dl!ih}*BZ(#pyrD&?Xj!G>!5xwybnN~B-GBR zS^VA|^@f1b*!Wh6^8>=E6JOo2Ew3Bw3{8P+ufHIE4HfNA?t)U#z9KUVRV*{k)I%y(vNU$7wowg;CFPS=$2`{if)<99wcnjT{^o? znwjV+wh5uwhJ6jLzu;uzQ%;D^%%H~fE)wTg+DC*}bZdcWF*>qM=oj5O&9>(qAtU%; z+h#h0ZCl?Awrx~1*tV_AVB01zgKb;3Fx$_Jwm@C|3`4TE1!aOWx@4u-30q^h;dhm& ztY2Cs6i0+-2z4~BcL}u^SGG4%Is9{-Q0sA3-*Z5%7T!a+epjeRa8=(oL9G!UOImr` zLA3~vpBWfZR8GrKUz%#uHsnxH%HuQd5FFQlEfuQD_dO9*yYL!(-bSCg*r$H&Q}_GS zOFs3nPxVE;(Rc@dV*aAuo}lg#>OfFwp@#XmjKO12b+H2V$;y=Kl^GuUqgxC{&N~+Y zaZx9S#h=R~vJ3o59>NK47<5#c<*SsQtp_sNnhMT1o{#8{mbb0HrRxYkfbGE=L0!XV zR|}9=(Ep zI7IxE{#>rP>2=&x@j%^2D%0yQER^QT79GchZv&8n{akJ~bv*}~9byhP`|TX;|H;kX z47Q(lXYFk(eC$)S0}-P)oitpMTZ%QzN_92?7QYP_uj`QbZN2$FIDQ*68B4$8w-xgL zTk+d=Pj6UUo?1Ty-B6M%-aoYCVR`Wxgz)eJSb^hNMxf+hgB0>R z|24d_*@GydtjFWD!Pi8|J3AHdnXGr$*E%_=a{gykT;GgyQUw?9ek9)ZRqvv+Zxg&U z=10}_`%NNp&y?=h2{R|%b{%809#;BOA!Re3QCwVGT;FvZ&(X$_i9mHogk637xN(Hm z^lu6j$8VuKL=fh^&O8eSjy}}9uA0@gi{y1RUUR}$S;CDTG5Hqy>Hf*ra>c?n(a{1nL6(q8=L|<#D8W zq40j{^L`8JV&PG_6-Vv=vG5-Ed0&9i%H9jwz)nBv^#%2SP$i($_q(7t4HEUP1GP=4 zTR}Z2)We_{dQ=S7|3N6W%)^B$gr0J|8}$wbrQwx;(%3k@)YxW&`lH~E1NA4N&H$wn z=YhIXcwDif65OP$&C;7b?gLOi72Ib&&Tn+$GELyO^y${c(#){#mh+S)9Fg+~SNRXb zJc+0lkL<>D0h^lh0c!gKlLS|Rz|w1@J^nO-;1j9o*z?hmJOB&H?aFPesjj;u3FbHe0GXRTHA&dUeTt*@RY&{ zFKXvkozCI70AuPY^1>2m{}kf6f@O{Er~g zo!v+g5~pdPJhfFG(d+(^taxgtKmh%8d<)H;30N`!Y*p&?!cHop2BA;6sQpH8a+OH9 zAux&(#DlY>*vEEK|8oid2z=X$WC+^~b@j6p6P7EGix5Z`wiZDhSzB4!AloK*$!Kc7 zu2H!}eh8EwZ+kZzL-Rsx=I+8HjBx;Sz!>!w;(C}+%W!>EsMBzLOsI2kWpfi1AFaw< z*!zU=CWCrXC@vL!N~m^FPYZP!sAq(_2Gp}cadQBB_o$qU@w`y)gQuZ<3F-ym^?{bZ zC{zs8OG1qU^|DY^pk5J*wM|pS7ufTJcMd3RU~ch!d9K3^;(NdEOI!D^3Xc{nmEwj0 z4R10iZJdJUXTEKKhRduh4&ro&nnjy-Lk?sYnrbfe@4P8sVYq2d`|3IXeH4!TwVfY& zyksYv>}A1bs9<1PnZh2YM4_!+(D5bMx)i=|wyI#quGOi|pq@~{83s>Y(>G1l2x>~k z7&hH`F_<`mtQ-QmS1Ngt89kYr)Y{$|$JUr-{^qH6*T1O!6nJayPz4d375rh>p?)fz z7BLQxRap*@P0H;!(N*8!IzZN~O`!?s@d!kRzLlV~XFe9x82t3@>32e%g{$_Ytf5M= zpB*N?Y*FqNipr+peF^I4!iyj~uL-pesB4Ad!WiXE0;RDn0j27*5|pYBXL*$R4yap2 zR?iH~P^b7^8{o+U0dX2N-`m?JMq2yc1;UeoCg%&%ac(*++QeZ&1t-Go{-~|-J5l=G z6&!Xmwv7FCspoGm7Lj+%Ls@%GoOUjxEUhbzj7w7^(UyJUA=WHmsQrF@2yDTaCdzp zvi+EC!R51vtD9BG;_LWDS7#hQg7bYAFve;)9FI5k{RtpGzpZZ`AAT&NxXcw(_A)!x>tBSbW2nE04NQagDXwT)1WjhFZ;Z|_!Lj~ zHGLw&`fs>GM8XzTcVi9^DuHW>Pz!MVZ@8XPF&>deWKH1zsZ=y2aq^yQJ373zv88qO zYFLA-UpmEGG^V(CCU+xMENz%w+nih{H}$J(8&-PdGv|8q=Tv&-4b8%}C-mW{K5ytE zY|yQo9gFL^jo#r6jbfQ*iZ`czc|!|~@zgJkVcU-%@1)%EX0XGl$ncUhO&U59#|9!{ zN+5NHqe+|;3#DmNIK7jQ;J#tcAi=UliyLz1Aib5dy`?6*l61*{_46sb85`biJ~hav_VKBhPnCk=%TX(S7vVP(znu`{ z-uUtT;z$$wUZ6F0r5L+Xj9n?lt`uWeim@xj*p-U;6n6%nh+p`CzT76AN?CO5Q$5^SynKZZ^@hgb@%uvrganIE|n)1M8f{(FM5he|ePo*Hjwc%_@ zAGmr3jOy4T-Ofpw^&uAKb3L*#K%J6RQb5FT$ zacOB(gG*pSI>wLTa39On9{e;BVNmkHn;S0+wz&Mm$7H7GaQFo2`QiT8ZSL!*r_E*S7D+ zFn;^?`N08FV|`3!`AiWh`@C*DX171@;)l$-OIL(nL4@DNzXj^5{c4{m@-<;s9}_dr zYpr?8tic75SB%sT*S20995QvfkFin*ns7LZfGq)2K2LoV4_M$mW2s(54~(Vf~bYm6Q; zB~oLQD;P(LeN*VjiQ2z(>mgGjHCCkr<4Eo8NcH+~_HXq7DUlkdQi5@$*jEHr9L7BN z=tFvdlt{5@gAhbL`H?SDW> zN|i$}PFx3y6k8a&KhEnoPY-_5xJCmm zKj}8N-Tc*%kd!KiU>qs7rUel`eY%}@d-#o^At_Z3!8lR}0UI0;@P6Ub{SOLBsd5O$ zk>XohP`_r~cjM||At_Z3!8lUG9jQxOe=~S^NJ^DMFpks+k+RQg(vWYTKO&GaM>7b< zkvdqUY#Baz-Nma84oRtQ2*!~*M5Lm)(*5A*<|hvcNvUoK#*tzVSP-$=OM~-=hNM(C z1mj2@CQ@t_>3;vi(O5Xn239nxRCPlzj?_pXf|7shnclDKp-w8Lx*-@xYLrOXd@cXt z+us`%ic57vFpgBQNSSWH+q>(7`-4NBMwZDSt8-j79Shhi2v`-T{)X8i?6pSOqvenJZAiTW`&-kq#>LhWER^1Sc zBgL`}4!HSKZ0(tPsFO;mZV1MaV%Y|^aE6t=I52dmli8~%7)OfrE|9wR)d5H8p-vi? z>V{w(DVA-p!I;~U^-w33Qr!@YBgL`}T7bO{{@=fZ4|P)A5DakG1!2^Dl1Om`NO#DB zy%qnkt#Vl>wr4VI^W?U&^S)I*h-v_@XK`L}LS`IX?QWfV?wE!7sjUhCs^=mz zwxOhQew!urWEQ8!M&wJ~b~3GC`kqFhp}5t#wL%l~o#N zJ8|VccA?A$f`1L?`7BO@6Arzv$ikfKa4^sdpWa|XPGp7CYR2jm*4R@{z7S5`ism3_ z^}H)!7^$gQ<#U!3@~YaEE1T*9F%5_9pmjajn);0e;9sQ{IVq$!=Q*uYa%)z4>KqR9 zm3u z_Aq~hl843fWJ}Fz7)-CnIRFhSmo%*n1tYKJFehd9?$i8`V_g6~YLXy6He|EkfzaGR zkXGK!nwO}U;~TOPKWnrqD`Bn84K*v8TC6F0CuB)nC}l8Oe^Nb;G^kx^;Y_bF0!3z6 z8mF!pyY(jFv`+69RBbZ5pk&&$rlq!VDGbGDrFMCJV|{b&N}8%#vMyPlX#-wg?1xay z*wL!1Z>EW@I$G2>hFR2pLI`7QZRLP2QX^Tu<*S-jTE5pOVsb^hTH$Q_X18Em%UG>y zS_O;ybx9bmm*)fzJdI+X7q-f!Y2%!0jZRw6ntD`Ca&58{CakTnHQD7_NQWhOSnfKt zW{p49qha~C(q*U#^~`K#m$N(tlvzlzni}g@HZ;Ptx}FyiD!-6gs41|XN;n&s6;_~3 zUmsK^j#;XiQ*n$~XS4Bef?IPy^>?`JE_<|A#=O;pYcB&*LuL|>JlBeu^X42Iwr=Lv z(7{x!L{j^Y95Dvz$8Kc7vvdG-v=p7iDGxpQOi`8V*2B_)pCdB(dHnCG%^ql@(oBFM*k zz}QnbgZz#jJ=R8we}=a^CW;T{WHFqNn~lEOV;GZ}E-==mYO22prZo(KRzcb)>CNK{g zoS(i4PWAA(x8@~azS>QKlUZpAZ{h@}oEhG4k*I$#VQ_wU6UTq)BN;} zo#;G|Ll991FkPHJh2t!hgg0TLqX|cYKMRTfF*5+?hc|wFSPi_VF>3!cFl`4aj@3!i z=h{?}~Hvv<%))9}2xYOmPgaEQj?+eqlSpU=&FltUr!+s;{KG0=QO# zWq!;0m%&Qpct@|wz)u15kiqp7FU$2qg8?Z{<1G$nSK|FAaEFalj2~}lv7=XI@Qwp> zror_T@3(-v)?hS5n_s6nka+I^?mdI`<1H!8$}f$pmzkH=p5omFk*x^7*y3LDTROqf zXJ%>*a6dO#Ki+ZfsU<6byB(MVO(~$7%JT?+u>(u=sLUxTjW-vrJP#b(yF?y1>Q!|f zIM&zsdEoj3SCa>hUxAwP!0|b?=7D27wk{9cPk=iuPuxJKg~BLF#vu; z8qdu)jREi*(ii~0A&mhrlt$e~tlMe0NP90FxYVcZ^GNG}MB6>EUlYN)=;Th^_cXEO zA(#M~#7%yo!*94-q9b{rJ^uv@q!X!WvW2fdSI42}NfpWR2COF!El~Cs?VqsqaDcS< z;-EASvq8OzUsSfttM6LehY}uN7+(<2*ucRI9B4DJr)Ho8yGE16SZUr0Ge2tzOFFue z$Vj)7n9pDxAY%tX>f!1XR($`_$!j4Qf4LQE2=p(BFrH`!1=OsbuLr#I3 zf?rg&jlCw+L%3?=^#~}%y$MR&fOmb~KS8~YU)1B0{WpZ#%cr;>NF}C%(iBvJ(vZ1d zLwQ`yt+;hQZ=;Vp$LC3dykH?V>&Mg@SbAb2U7Fqzn!f^vR<*7a+f{g|b&0l#9v(~E zxCtBAh(hKA)vlfWdCDMJmPOQRyLfX};txRKg#1qM5E8EsWXbxCY z0gy)t`XH!gtmZ`SpN4rXY^}Y{=!WSW{0*BlHU$$U+@(n4SSrCre;8>wtg61Gzsf@i^x)u_T2>=42x2i(I?eucfBK9=bt02*RgHUxNIChiuPZ%FJeJK!) zN+Q+znLTjtLvBW}J46y`WMjSTOtjnUJCZA9vm!PH>uzFX4AGzSIBIp*nvxegH!>aR zRbE$v#JYKQP>SpZ_U0*Qd$0@=X;DK#mAu&AamHAAU|l2a17Pg_4i(4TLmY9~4J2s7 z{7s3lI3U60IJJwd2wRD$cf3!vfO<=K?LI|$Rpu{zitUH;VxZm@34T)}HY#V|uoB_4 zEb!R=U`L}bLF*G5?^U2QwmW>^PeFBwL@&G&Y8%Bfl-?8Gzp=s`B>}R+D3wuR7Kx3J zxb(tOV}=$`Ngmc3GYB_QV~UZqMEdBU#_S(v_&#l)^(s2|P+VBo^-Mrv>}-Pl3%e7u z==?{7hpp^d5dceFLKdnRcG8(D#vPjQ*>sHs`&Fz;s@TQCcdA%by51|=^j-C^bxHzh z1Wz`rp{m(PlRKp=K8dHcb+ScH_eNnPN4IxWrBNV>+kp3O?~jYr0SV(^@DeE$QZ=%j zDAX}W*PdEb#xy_zLmq~JP8y);D7AImzit*j7XOS2OirSU1+ zmc(jC_k(OH&+W%1VYIEmc(lP@&G;5}F18AH-YPeLvAW_b5*iPmX5+CB8;^mRjR!(T z>rwA-yh}aMwJ48RS@JMjXIgvS^&k`vCDq@bW}BLF8K#O2ljGxN-}8|W&^kXG)cg2F zy<>gedQjR9oaa-$@SL=T+1;l`_!Re%s_z_7+Wv5rh_*j%ptSw@F(_?+ZUm(guYmfi zq=2h+-Vmw`l#XdCK#H%erl-iBFChD7i~b&?C5#9LaOkr`+axd9AA6EHz`-4cP`ysr zD&vC_wq}jJ(0N|ik(l^+9Dnh`4uKW5UxDx$>JvqqE(BSXj&N|*H;y+K)Ii}>V!ZWG zvUi-}w^XHftwz+iL)`UM>2JgHMcz)vz>T6q>0KozO`fStA5~b1QI*s^_>Hc@U<|Rr zbOu7)F9C0+97H8>$0#m!Pe})ueI$Why<~_ZBe~5;%>w+Qvfodsj3(O*qVTGP3`uTr z)Mw#6Ca+Y81UG>5=_XRoBvOx?log$KA6O+XqSl~ePrV>)9dsPPK?g^7Rq3^b)u}Io z-MSB~Pnb>N9J@#x8}>Y;>$GLx*KrM+;jk@)brW5)wHuCsoV9eTv2MeNb#hgD1sdnj z7-ubPyWrL~d}r+04HH#rY+&NnqH}5GAY5wht63a*P!(PTO4W6Z&-H8$wPA~Idw>Q0DG185_wK|NI(e}3Ks}T%! zQHQnzaif8b2gUJ8)XR9qbWmRg;TJ*?e+)n=yRKnTh zoPcFYi0o)|1`oPC#kmLvv~}6{F|zSkMf@ymJ|0yB_ojx2j7MzhST~em-h?pucuf)z zw4?x!7LOE9;YUFZsSc9E)^h67k)kB45rLbFP!P=e8~_lM1e3-Qyzkp*#iA;u<&4AH zHhku_qLHse?brS56#NHLWu&Uo4ZbdzGR0uUYpvkqMwz7J9gH)+HXVNez)wdR&jLn5 ztg;ntx(D7ESQNEyA+g~DuXP`7#BAeJwCN5%L40q)k0+R$Fgn{Ih5=JzrwT7wDk)k3 z&ex`B0su%+=TZ3AazO;>#wX!kLfGw_LfHOKCr?4icC;SF0;2Vg_O}p9=O8=)VKBrwWo%73>jDU?B&b92~k3`;;X$$D|HdO!Cd%IqUA?=#N zI4Etm^njvp4Up&X8Br4MaF~0yTv4#fo1RBBm7Dubu}uSJI1`bN6LnkR-}|tlc3M?V-1FyHf|}#u#!E!DChqwn2BH0Y zp~!QIy64CVM-S#D48<#I=NvRj#}Bt4HK9!nPdz{% ziZ;vv`Z*{AlF3O|e1_J$JoQGk z8TJtKI`iniv9!L^c{uB)I}=>AiSG-+Y`aXgQw54P4TZ-x=m5R<8IM>x|H>*|J|sq7 zNq6`KEe?+Vg7#B}XeN^J;0O3K$$Zvl!4nDZJf5MOuy7v^j594Zuu7PftVZ`+4HH(K zPr)N3)A>T^J{$m3)A@18Gb4hl;MKKvD5S9PPvL1}$6M|PiFE%enS@KgBFfJ2G;hpo z>@LP#);xF*;a;6zxLrBTWim%WqBeM4F&j%b>EYL8qrbL~r-@E!xvb{0HQ>-7;TYi> zhIsU|&Y_@my1WdOwokJ_-HTt;<10s-P(Q#`UkW)@sJI(JX-j)IsGIPMis_IKg?bU! zTZDQISLN~Z1{;c~7$W#csC~hseAGJ-6dz|)OcN+Y`*cdtKAqye=ktCB>JyRREEOvY z?A`g)3!t_O?=w(;7K%m!J{9T+P?Lo^0hH!)2`DWM9*OX(_-+BEudlQ~r!!?w_|y&s z*0;^4E(LX)$X*WWGogM1s!hWKr6u_yC=K~TP%5zWx8iFhF8Xx39tqN}aKp&0l;vODBpcq*uS=>j%y z0|7q7q5V1DRYP>~?)!XHeBymYn>mR=4q8sB9h_I> ztYH#w>_zP?TQooz18%n;s~B+y*?hS|^MxWY2}H?+)7X_>7Fb-87l?F!C!FMZv6=LB zVOWb~Dn8pyNAhq+Mm<+{5_kIWX4= z#oEA8cGUYeu3E?0)@U8t=<_ZDrS<-IpgzYhDpn^S7mBU5hR6D&;r$bo;%H})?R(VQ z50v5tgHjxq_-SlMfKmy5k$F}m7W%klp!iN6_4u->p{(_N;gOds>;csue71LbgzgtY z730c$N4yERDla~FPHp4zdKqL;#yT_(jtl$IgYlk>pB|IjC=@Q@dP>tb`7@47@XJi| zWx`{cPZ26Uw{q#MW=(fyIy3KcrJMSo={{8`T*UR1ZZt_>>(4kY$4}G!rBKDV{;yC> z_h~{g-S%YoX)Br<>gv7BzEfQilb@`H}^XVTuY{omxlMwp1={F$&k>)wXaiYV*iXCbN5n!(S<|pI zcF;jFcrwV?0Y}7U&abK(5nI1L){}%p>I>bSPGux*o4Q)A;TXFa=Myo)0w)~56MC+KbwH9ya!7W2u zCiUgN303H!E#~hqkK~jk^(UW_JZ(c;ql(g z==%EkvOBzY0ymIiz5>fe*P6I?@}>4-k;C=FFOXus0?S4*A7fKE-f%cf45XN^z_QU1 zKE_JTVMK7d;1@_SUxC%4MS>v4O8v>CxyX@Xz5=H6Hm)q@>&iav3@j4aI=-79S057&(^e4SUKvt{9q|0SYLN&xUXhQn zah+>QV-Jyf5?5;frN3AcQHw;l@qXZAV#XHKF?e~R8;D;)WCpH;eAN1Ksahn$jmM(^ z=?3~KJj8I=gBL^&gvhR-uDPnNKrIpxUE*VGT+bWMo+1^FODz&n>Qx_O^L4A?>?Km% zakDR|$P-(3SBpfHy3@zlxL!0l-CLxnAt*+#W52F_)FKgXyw`nUh67uL(2fd*diE!g>@-a59K86#6Z$X5+ zc-VqWdL~*IlXAh0SL9=CT)#GHK0u^aB@AvdqYLN&x-pxM7kISU_K=>9!xWk97 z-=*gij#Z09lq&KuHm(m%IDSQGsQw>Pw0q3Rxs75g|`7LXI}EvmXmmIQrc)uU3mh1aXxo9Wk212jw1? zRq!9A@X#%zW~oIYdOsS*I4L|-q}Z0y{qR@cJ2GsMNV$R$@;DRwVYqWss1}I`S`xx& z3i;kb$FGAy3TNKzE+EQN1ip>5HnV_HKNiN;VCmJ;!E zt&1_~fzflfDxzQW_3Zt$H$9*&2kR5=9WNKFMcuoQUhKhN)+8b}$tZh~>7rim2CDs*EXyJ^F; zkd!vQf^nqEfemcqUC_V1sXQd5x*-@xszRhV%A>28Gyju{kd*3%U>qsFV+Fm#zGsXr zn;w!<-4Ki;#nD<|yX%XGlXuMsNvUoK#*s=mQkSp0acLqXrMe*)N2*e!tVW$*d-LSV zkd*3%V1UC^m{HiHL~1wTVK?9Gmix%@da(Gl+NwDa+Qcs2LEv&xj@3@Glyjj?l+S4r zyk2^FYJ(+U31@X{%L<>R;dEt%!~2l*#&O$eCP!I=rTCg#*uuR{d$DMXeRph{nQ%i#7a2FPK=ODV7?V zN3yeUehPvhTWAO>#J438=4yJwoIu``1U%Ie*35YoGb-lz)}^FiD4B#QnIYkH!Qc;V zPGx&o>qa%r^({@U&2{y##gq$YGSy;&Xee!lg`FT_mQU+Bx%f+a;5U>m&54)7gxR4a z<|SJKyG6)WePau(N7XD_S-U*T6J((Xw68RXTfg~QhR=CA_2Hcv== z9YqS^GwXuNWMtPZW+yk9v9S+i*`3lGjemr`_w@t6ep^Mm58S5I0;#h#Q zl5J*eL%85d$MKcdcW;9FUtnyXx+Cs2JlA&3@4){fddM@)>sg`2jVslmE$-XkE^{SnzAj1Z2) z4#ACeOf1RQ#<9Ts*x>x~~A|GAl&#cLAjB1`8H)1J|8~ch)CICEAYkS{El$U2H{4-K)Nm- zifb8uIB^hH@}hFa=2W3J;>zSiy{mlcI#A`pyA{_8q5K8P;o_>oGfO>CiBm1jGHDjb zaVRM+zpun1Xem6qswt7`P5+YebTtYGtB60cr=f#O%|j`h(#E-!noX=(>^jumgcd=D z3Nu_(x@kuAl1GLgh@?-Kf* z8Cw9bzIuD>&L%J1^qD-CB{HRl5;-VmiC|NIcXFEO(h=093B2DSLkYSL?D^4K4GR<{ zej-bSdDc>4{fe- zF&TPu0D{vNZ6qiyE4F4@R=n4;S`13dstJ^8&}pEw)UE)frFN~)d)Vha2};9rn(|_< z`Y*0ZJ&OGYFiH?=%@0OFq$_4~5h7R1^FZ_GDot~al5G8kY7#CY$*vqGjploQBt$dI zs==A2s7H0s#5ID-Z**7|<%%t)*y-g3Y6?FSK=cZ>Yk#%keun#6ehZ z*%kz+6C=2Ac=uIId~XA)8p6^Q#BNxxbf(>?u%R%Bx2^lD)??V}E$0?8EHZvV8a#3q zVk3_|Np^BYw6%94eQIG>+&&1mV`m#va^H~7A{`@WC(ycd1yBcJMpCv-IKqTVP_`kbeN((vTza$h%k z$-dmxr(35=I!@U7EeM4`Vk$?QLV~ArhzPu2T4O_{HSq%$){MfSD-8Dx;i6JC<+}BK z{Sr`a2>jNL<7{ zys~Ax1c7S>;D;G)A#y0YT^RpRGG4*u@LS`u1?|&&J-nVI$J$Lc>;tedQ1%*C;Iv#D zH56eHl%PDlBHFbEfX;427KeH#Pb?2GMVo%ZG_YGmQeQv-Qmzngs!07E^`I3ty0kHf z--(Ckb+To$niwwJo$2{QTuQbhHb^G@COmfRJmkz?ze zMA)?(SL+|@jsy4Q<{@k8LZe6DHmPd|9u~aaH?UyRXA_0k!|946Nw$8JWACMI)QkHj z82HAo}rYq__gX=LueTnNFp>{#p@HJCcu>hkSf&E(0QI5WB4ePS=W1c<0=FPi&ntc#>YFbL)>7{6V{8iV1%?i-38Yx<2-)QqL+=XKQa%U{U4PF? zZD)eu2H;l^;am^%Rrtwye+t%8e(7VZ)SoE=w<~@HSZAp2gx4=?3f59~8g8(bveAUY zuFNfsU@av#vC)0YV_e}mA&!%RH2^$QOV?6z9fgSCA{e<@Y{J=Hq^v*x$-(>nvijQO zNVS&SjZQ$7Yo3uJ0$&^R`1Z;JHbS2olCLPB=Y%d*$4`m7`r9nZ!5euW(<5d>7@{qnh}se4{p;D2gu-rA9kjD8Vp|4Qp$%v|FJeA;^QgAd1V@J+Qk%At-_2f*4l$m@A z%IPi1%(&aaAES9yS||U2-L!bXz0cAdCCTmp&4Y)tSon94JRqf)6rDd zH)oOvan!HG8#Q6{xX?$fZ~VeFdg7Rp;0qU9dsy+p;Dc|lbW+?(_IUk|eBmlB;Vh@` z*yr^_d$6x*SJ;^77Z7vIr9raC7zPY2anZ5uQJniFg1Fhh)Mw&K_!b{H;?@CkUM6k~ zj-(7Z;;sV5u7vmF9W%}e@O0pK8e64ldO6OM^o^OwalG$n{p@^TUgw|_j^hi#l}vEr zT><{77!&S;kWh#yG)wW#Io4m?Ib=9HTGGahd{03H1g;9G!g0DKX3GlqD-< zPX+E8gJpghZ+H|yDAV)%9N}f+IC8x!58OV$J&*^E@xGA*H)`~l(eUye<9#y&7q(9B zSZ(8rw)ygdHypEHIUaP&^Lx2~RH87D`sU>V@{Qa8!}AU) zyt7uod}Bv4iha@p-l4d>G{f`;nA6e&P2^RZEBrTTSa4eiqbD3kV+VV{#|%ZqXI%q) zBMtg`9ZX0Z06Yi$x(j=RP)FiASt!1jatINX&*(Z?OEuORlhvT~B{7&$n5Um<>}>Kj zlO)Xq_q1OHA<2z?59Aj5uY~n+qHQZTo>y&V=pMfk`d{EM5o@Q=XnPVu#+8jvP>q%kJoP{)L&K7 z13{@uQC0bD^fQ`1m*u!G6CPiYnZT&`V_c^Sbt|sZgn9s1mHiv2a^Vd?!==YNpMaiJ?;*OI7B=S6>A2C$5(z%s)d8JEkCppYB&5EY!5P#|2S5 z8ujZo(AL#@1NS;&-`GLZXM{U;rrfc;fB-Ok>aMqVCuyl9U5$7W!Fc?-XMsJn+}7imqCIc#>RC4 zvjNAa5=e2=VKDV_v5&D*PZ^F*y>L*#Sl{1k^98}w%L_gxW?p$|1d2|lUN}VHuwakv zZ|)jQz1T?tZewL9=!scP{_E7s3Q*)<@SU?-gQ=H02!IoeP$T84Qw+h@oHKWO4xSZl)3sTbB7K0t2G38r4o2w~jG29`mv3E<`G zyDrnI7u~d>VuEo}$XXRlQEa{HqxCxVB2ui#aDs89sJ8_X4npX-B|@iOM9K^-1mj4t z9D)>HG3wNDI`tw_V}Ta>8wwa_-2&{LG5r zUojUtoE|15mhfy)J0(#LL3!WGSoEFMriWK=XM38p+I(NmT5@feTpt-)hplV9vqS1> zq4e~rvu0IQ#Ak+8b1cjd}8s|asyX;{vg3;(#*0O!vzAYeR_WjY6;lL6V~63jh(f+pq7a31dh9zj;G1DIPz1tO#%oDhC$$e1*}=>qdRU9l2p; z{rzX&(4FHuWmYdsW8F8= z%YmB@%*O`Dp@PIa)_n#3ArdsSAJ$RI>kQ6>w7Al->~Va@4ssHDqN~^&!LiYlH|o(7 zOj9jvSqk_EU`pAy!1=fm_YITbeH)m24UU~}t~X_NDz6y~NO8J`(ml8FIrw}D+*9nG z;P{v8O`gS(WFdxJu5-pX@Hit69K$;+4;;h0AWz&SdEhvRyCM%9i|*r;4L%6MZ;27Q?^T08`Pv(K+An^G-aLn(Y^T2VC(v=5}>HB96+^ErGohhdefGa?t zA2VP${^inB@~_d64PoMP=_#YUEe{;)!yod%QD0uj1IKtf^T09Q&-1`BzkPSZCFFX_ z?>>3p*i0Rk2afIClnuIItW8p{L6dNei<9NUfQdEyr2 zf#dUCmIsc{Bbf(|&*PjtaE$k|JaE*PYjfa6m6mWm(044qTQYDx&dd`Ro*vf;_pQ_s zPVe>L6`IeFo6RR?nO^D{J6*nGRjLE$24eGs+D@0{yR=u$BMOr*S*Sz4YAIcp?$k)XB*erf`Zj{V&tk_MLaU zWH~0&D^s7^vW!o}YQHav&OH_jTygN5*R{+}n}5yJ`c#VvPpvm03Oo5;nI2e;m6z4& zS?;{LJxj#SsJqKgbA=iYg^Fx-b;Q7U3O`+D{j^ZW;QEYE=ivIRP#62uJ)k(!kBT{D zmDn|c5ufnJ_|$YzG2tBz>II>=GKT9}qaIC4tHcc4|2JGAB6$fvon&VnRtuYKZ6e-c zTn7s^7uWxW`{wj4Kr$j?68yiFo|h%YVq9MlYB8?o3-xt#_WlQoq!L9RkWM)o|lpOUue>aZdw?fs!!r?}kDj1cYl(?*A`pz{j1-eVuw7 z3jtM+E6xE|qDEgct6xD-0X~f%z>#0JWgX?KR zU4rWdp{~Srqfk_jHle5+fSdvyJ}SVd!9!)h2DUPaYAxqh8GP(|fqIjun^PtKHq_Xx#+B>5dXp@#kN?jG5%Zu|ax!l(&@DCuM3Ve}JF^ChQ0>+oY z{EljWY}yK%$64yt20Y7}+qxR2oa>juw(;PB2aizXfh!bn?`OSz~nDgOtWN z5yG~I%((cHQxIW(>6ZL*;oiZvhmqrzD;OuP-Qf|eMEK`v<3Cap(h}DMl@g32wTDRA zd|lCWP`R3r7O9CUB^XC)ph!`x>E?ZYXk1N5>r*Zku3#LgLEr~Z`MFnqF-1*CtCT8- zU>vDEMasS=?D5+7o>vpnDy7OH7)OfJHGyf-ZNHzGR1?xFrOF`~M`~}8Vmm-rGwaun zstIY8QsoegBgL9k5aH9O+j{)q2i1hMN~v-P#*yNzQJ@=xwzfXKue8}JrOF`~33aKd zar=qX2e>l6N!MQeRbWE;B^XC4CQ_^mbiY39){kSM z6sk(a;N#Ym1IUT6Zqi+K^^$|tgtW$`DkT^vt^vF8z!pTLwV zLsF_yf^noq02`$6?|*t=!-$ZS>V{w(se?s|Jqz7uPmgIhI3%UIAs9#M5MT=;w%s^> z#^Nv3gtR^{)eXToQiqC^t(A`!Ji2elgtYmpEf`1YFp;ul_{)QTu#1|ImbgZ%ZV1Ma z8Yxn?44;cU_ZKxGtx~ERf^noqIdPqyoRV{x| z)AvsPGv#RKQP8d3F*qq< zsRgagV{w(sWL|@w)=0^mW5KNx*-@x zDlSr14}UbGdtAtbv{~aL7)NTVNLk&u>#D+QLnfrhs%{9zk(wq_RyS_GKK@k5gtXad zBp64k+(}{S%BcsG2l*Py`l!>C?o+N1DciC=@$G_{6(K3r4Z(=~i*i*vKcVM!@z^cX z#V7ab(MOFG|9T0{_RBiublO||E9Vca4#p|xt}G7Ut*q;n*EZeU>p%zDK=7||otee4 z>!azRm>09slgN@fE{k)x3JbqSGr>z5k}dvb)di4{#fnoa=hc`^k=%%y$-_Rz8VF|b zxh*gk-$E;9&abYR6Q5U69$L~_*Sr#DZEIVwLN#MUsJ=uF2`%UhustsJ3_-$cHQimJ znd?)HeutxKtWUPo)ncnI=UHlG^QbPe3?;{`FUl4kn&#!W*Hd0u>K zRfX4=`QeuJeC?HvFP<$A6X&OIVzKs0 z%J#m8{|&(GXvQ}zM$N}K9RU~|^HFWbK!zu{Qr8}>u5_J~B= z8RB&YR_eg(AA#3_Rdv&2=~=PzRL6)1TlYlZ2x}q25?fcDjAIL}#9HH5oNif&UsSe3 zE)t4*r&JrLV}+N??iLJewXN$R9Y|tNsYeoL#L_c^B+fz-7xbLO5q@&Yed;7PVey4_ z#gncLf`L6LPVS=R+MqPxm1%7BO$;jOE_tG&M9*iA-wnRUl~2tufG83?iX8?V@3j#4 z!RYMsCN%iGU=MeOPpO1ihQ~L%usn^WM!IzvK7$gQ=fj}yhc=khHZTj)8$PH^z1p=y zNq2?BBca*_OL79dti};bpnD=^-^MR0O9D8mi;6L{_^2 zrLMyLV&UD1YpqcC_n zfM)ouP$GT$phVr8n5h`$IDH*!$A%+B?yY}K))jta*P@B;gV}c9Y-{09pZURn*Wnix z3mr>^3Y5}BoqELDV*D54+yh~2oa|*Z&S{`RaoYSR25IrIn`YbN+aH*lXnW6?ybKl| zCTq~hur@z$QW-QA;YMUsB0a5t71{_i75TIi7Sq+Mq}y*9PT0z>UR#BrRU8SPwhEjb z(N=+7y|w_$KrO~EDr-Wt1&|`P*)1C$GIJ--zpy7pmO>2wuPKC0ZDM#24+qaiO|8Se zDpt4N&IJs%^+hV(`?hUs6KxNy)ykl{8tx(YM|sstnT_(PS)f9VlJ+-ezE_69Ok(r( zLpH*j<}i;>z_#n=ip7ak#g$leyCRXAzg9FNbx%o0`$MNsOKje7Wyy=q3e(hw#+-7c zvHNK4rYCppru}k}pSX4XGgwetPzBTCXWqwXjfr;-E%}h69>>S*4x*yfg+j3{RbP4N z>?q^L0EI0sT5OdlO15*+><=J;1+!iIBaPu?iUkPm2(e;yLu1HxY9*Err@gB5;^CET z>xW=OP#DKQ$0k@W8jMZu?0ML7RdpSjkn+hhVyzcf!WM)KS|m{z5w&CSF07{V2{F&c z`~ydUnzI=`#gUAb0N=H=zW>OlZUPm0gj6X!v0d4=p@o9g(?qc<7cD>T4e$#5LW`}x z9^8-x-dUT|Vl=6!QocFKu$6YP*nc;BZYBj|K}ia%WIxH&NC7Zy2dFtvxlcXN*3ql& zvtFl;NOc&~A?d@<^cU{(T|rIR!}w^)Lm~pr+g@}94W1510iLk67#K}%87PjWqOv@Y zt%llJKUt`tDOO$4^oWuQiIf$Wbcbz_e3(+*^)0V<2gZvpNle_<{E~T)Oa>d+l@bx( zDD_$LjX?DpVN5{8_f(YOFNsV~0d1YYoVTO;1WlSpa zouVK@tt`NA*_Qnt4wjufW~2gZo7MfgtMba zwegDI^5*wTgJmb1e2h&YO`y^h;#Ux{Qj`C9+M~g;lNCP3O5JKWeH^I`+kQDHSau=? zYT@6*@iA6vZ)O9IsvS%M5B~nM-wl?X9N=TDl(jv| zx3+=^yG25-+`ay^z~qCqJ=)Jt;VKh5UwsQAY*8t-%PHH_!LpMUA7kTMZer(4shZ7T zzWy@w(H8=f5378Pl{(vS_}W2RRX)bXWo<_iueL`CdHa9&J5HCK za01kt$=uz~*ZU^Tdx+HexUw$)ahD6O4o)ur*vHto?g55wAbtfA&VI0du3GcMzXvCm zZv%&JpdS}QrW=G`L1Zwl4EVk$@7ggqxt#TZZjdjvmohxQ2D(zg$>lL0V^jE&;ZV9D z!XA=t&@SgM3{Eb8Lz&n~WToaC4!b-(GoERV-E>2FaB}%^KE_I2ZS;_BcR_@MO}23h zeskv*U3Nl&U-}qIh38ZDg>Udl_xOb;pQg)BD8*MUI>88au?dGca+eos9&>*N`Z){Q zI1S)Rqd#Q!@>bQa3L8*0E%wD$L@>O0-^5P3mshc1cFn4#V|gP^Jvq*@4j+b+%`{%* zJHzkqzxS)P=-kr(4MfL}Z5 zq1UBZrTV!Q!9Vhj^X9To%DmG_PY>ov~6%YA0VU-^PAG@)+PANk-;st?3Pm- zl65Oa$|sbOTJKlX*TMb)NbkQ`BRUsIF`0L!^vFM(72QaG;y$FrlC|IZ4UU&jB6oXt0Wm^fc+K? zwJUMr;Sy}vaQ%vL8f0$IhL)Dr`sSKiq(ULmB!;9-!fO1(QA2)4*!N8WuCKR15tE@DKL0O(PD{67(Z73KgN12}CEM@vh5;K|1%BotZ zSH>ZYp$O|%;PlIy*46lkxlDDz(1D7~UyW@I_3CNVueEt~6V{oFx=PGVjrA)V8p9_v zis9FAcEZ_YwFu=#G}fr6G#;S@hJ%pes^RkS5FivzPJh2-M34qy{A6b;f3f}A2je#8 zb6>H3%9E?odbOt$j-O}@!^HTtkA0En{T4%rQ%r*(2{m+2fBzB7Fk?#iQsTR-(f(DT zgZz-)9ozu?f-D~GpmK5kseXyxd& z8sR+#%)T6&!f~uA;o&o>FwBJ$7uN!_3juI!zy+7_)x$%0ut??|%Hby*NAjA!66gEP zw}3kf7<&pIlPS2-?kRkO!QT;uaWD%6jt#!z+|M$^O#!Ah3+H~dvKbfyFoUx~KQ`ZVup zwz9{!FnY`o+W8Jl=qU|YwCKAR!I$P%)mmx%PAX}93$GT(&rc5$)%Il+2NGH!OEbQO z*8tdhRQzt{qVsaH+qM-}rDd4u&chYmGAokk-WKnE22*1n#bu3>4MP&ub~3;3nQ6mB zYCVsY;)!kXR7dDEn%3|5Q$`0OI&=ErMv!*a$V@K53T&l0h6eMG74f^#9(Yxeza_dK ztxEGDiXGZu639>AQ%qkXbv!-|@RQo-6{!y@{KAu&sNmF>5eQ}`eo?WaIz=c}oLNH6 z#Z`TmgNh4}Qz`2EeNg4X`x_cFEVk+CZBSr0B zfxy?nD9-v4r4ri<-9?*j0$&+ancWc~ri07V6;YY{(`hvuem9R7;vsX@ejr;rZ$|+3 znU-{i?E#I}mh;0=QXCOM4#4ltOm>UzLeEf2F(F3v(;HxB zxx1*n8j6-X#$>J-)tWF)-BKIOW~z`ML${Z_Xcg8^hm9=t9Of;9@1iz72!*p44@KB@ zBfiHleZRt&?#|gE2`bf5!lU^~RV7+Bph6=BKJR!?#|w|!DmYIP^;Uvn%A(#C zpfo&DIXi1#EQb){bhYH~$i-^1S%I$Y1{CpjfXA-u>j6=R~1|~G;&wxQsU@-$nMs`1j zwy|rneWd(MV3OJ1aXL<+RM=w|O`(U&M*=zN z!4?OZ?@0H1LXPe?0JToh?zd}RW!nQ-)4}N{@BiWLTi~OruJvcg@D!PVps1*$AOa#} z!ZV0yhQhetBeQWKr&p9&_Nbmpl?)=Wln!UfZ_uB7$_G9g(;Zusx<%G9P4<=flY<-D+ z+9QaU+g@@UPtP_;K?c4&Xc?1+i$Wq7M=11Q7?96zykTR>?q_bMpmWs%Vyl0`;c zPXnb{JQkGphGvC`E91_f>dDlrp4D+|8Q8|5$Dstq0A~HE8J^po%G>^24ST09i2i+D zuHqc1mVJJRY58T#ZAxu=hb(0ZQlMu82szadgNmP~xZB;W!+lqTQNrZ>Kc1VYP*wy;kp;W##>~a;lj49 zOaolBc>P28UyAz&7h%(rZ$(*Fkab{Ff+f>a{SHWKCw8-04!6NVr}^7(uS@H zY~s-sYSa=Xjs^GxJfXlTmde6r7PgPfHjhBK2-Vp*< ziw@$_csFE(iG)){ye-E~VE45gd3urPLJ8&^ygfyl3;(I}JlkFxipQ2T%*}%(1{JZ~ zlGJ(lWJ>f+;Sxx#13q5|48Xb02COF_l|SdtdU&sUN+6u8J?Hf5p%Kx#4JzQ+7@bTWt3Y|x@+6d}tQ;CBDxNh? zW^~6vzfZ+_D9A`wEQwrPQHg2g@<_${WJP5))VoA@R3UQul7RJnWx02Djuqd(N<$mW z=F6Q{Ldqs>@p)*&0OpfCexJ|u88DdzRlVi+V-+uE)?rOZV{)5qugonF( z41Y)A;tbs}plQNJx2Ta`9+t@K@Ea z&Y8h16`**(EBn-iRZHzho}sD7Qh8t?3$a986u5d_l@WxD! z5{P`|5{xe__GPZJgrlzRTHsLvF+#Zn=71plKc@5F^!AFg~unaB$Tg zbm(ZmENUo^@SHcI7Z1IWZ0~A0Qj$tuV-L5`{5XM zWSkwNHtg^mqc&6B#@qP(j|`s+GB7-=68%bp6ZjZt@U|X%`=P_LOOTx5EohSG-!EpJvToSl`3zg9Mgp*}L8=f}<2LDqPm)wW_{Eqk}{uyOU%RnOG{SE9F{N zU$$VyT8pE-MkT|0LfSeFn-)#~U8-CSw~^D;a5qI^%D#FbxLh%BS~r3o~AvJi8f~k@N_LqYooreu3ENivy&kz z*wz}H?}F5Iu)iCa)67uO4Y$CI57a-dCkzE7fsm|mNGDH@PH6vGSr z?E$eF1}AjW{aX(Y8{uEav5Mxni6?&3aV#eHk4Jvsp<(&UhGXIBcs8yI#Y4mI+O}|y z0Q2`F;QE38Qnd4WAFS>lr+>~2pv*%*JQFCLEo6PX1dns1%}(3%)KWu2&miN>aPB^U za8_-4Um?QhH-&pnF2s|ECxRz8+_Mv>^D(c-GO$AYj97}rNbN+Dd2TqE$}5gzLY@IS zOP1{oPgfAWu2C_ebJkNs8e}Q9x@tGqQYy#!?m`95h`Fhw(dGK(ec-_KenaO}r-mtm zQj>Akvzaj8YJhlZV+4Ckg~uW;^^q2b&aXNP-E$1{0o%K#f@Mlw0Gu8t~y zT`ggXXdX`mwGvNArkz&_wFYmUi2R|Y9s{N6waZd_EcKeD((^L)yry6T2qy)T*d>5- zqFOXgf`hlXN%HFn%JASCoR3DKLs3Ay%c5_F&p+6b8$LxpjN&->R_Wa4TtNIHiw1+?cnl+JZ1o$F9K*P(Qd!AgR`OzzThAN-MDT9R3M!-F7zZY)@^ zBVpq>%TgCwioJoR4~0`IJuQ&wxE#YdbuLR?{({OTf>k9X>fybfoR8X}=c^K_J@JO~ zaKrOc@$u*NtuEnlu<_^R*5u1Rr58#XCq`lqb%7^N)gcn8*PqKKwNr9YK09+|Jdwhr zbZAe!bvviDW0FfnsojWfgy*jKg}7Qokyvp3ES9z|i=rB?>xkA5)g<09zi(znhwJ_- zf?xyH1<3EKx&*>?uZYb8%)}qWT2FEGz2fLcE&V;0R8LFw`)i^VOFB!tBwBZtj9=X) zTzfm28ahvH=)O-g42wvJ(>W#MD+1MHN(;WId8)K=iitSp*qs}!3F?b=yOM^bSUS2g zH&MF_v-VeF38_=dcb%$X|D*O6#2cnL1!$U6fTnp`xJf8OlTd~xp$ttz8Od>~p0|Rz zdzRRkYw5lbR8Kr1QM9i~`zQR?{C*#l$!|-2VJRlEy7sq}X{=B#7IL@8Lab$?sx;1R zl?2k0q{$(hHntAKrQWSI$6}dgKRiTcISUVmhOO;|U(QCP+9wt=2(d_D?*-2w3|XoM$ZEFCt(g*xmL=%PkzOuwl_9$V-Ld)X6}h z7UEqc)H=MYg}T8~KLVxkzspj(;l&ooI1`~zj`coS+?kuFoRVUy_&Kd$UE4X@)Le&{ zpkRdS){?*~P2&aF$x*rwJe@^ytV0e#)L$+NZ>i{9T=(9UPh&0qK=uEfe@?w_d0Dvr7xZt_7em5zx00&;azgm}#R##P+ft%U!h1A? z0xv{iWHx;Pe~StEZ{&-c2p0*1Cc>L=@g%~t_?a~kj!BFDj{!`Jen)ugM*m-5W<^)jR`{HnDmlu4k1O=w}v<2e9J(c=qDigQp44eRys|^ULn&AMhf9rm*o3w}EmhfQ=R^d&kF76yoPJ z;T^taJ3)<&f^EEcD}LDua}$1qxBQ59(WmO(3}06-7CSb5K5Shi{%~*reini|{Il&< zt0aMtXs6Y5M8DQDi=!nplZDB-wTCXM8Q});HtbCh$t%NK8oj?ymk!i~3GFmy92xy1 z@~7){3vOdmP?HyZDtb`!$TZT?gQ@-DL6Vv{^v^W*6{>jZ<~;}$J8@%=G8-|3!dA+s zT8@+VgVCqV?%>uJ!gc*oU~tgi71x&{3*m}7^lMrc*L{SJFMM4U3Nsp#ov}?{9=)!I zqzV!we9hNjUyOG2gv8Zfe8o_&jl*X0bt_N54ShS)=z5NUr&;I0erIX+>Mw?69LLh@ zk0Q}ndYeQX+|qpioyCcpvtMtX0C()(Dh$^S0#*A5#yF6yk_3&X8u=3vUKFl7n$F0k z@opSFSrD#kMzPrR2U-<|>)&EY*;Ox|!N!R@eCismV=;2#6MYIYH9rI!hLT*5U&#D$ z{jb1<-HGA4Z__77ei42XZBpA%4Q>Po|2E0Lnl%{oF2pkvPa&Q>JP|y(cmS)}k7qBQ zJ$Rb%+=u5j8ATmzIlqla^+s6!vKFojP*~X)?nJ97)ocs@yJ)W5$a&JB`DM7Urrm^& z>R|Y$?OnEq>sQeZ#l{&~H2#4_gyT(a3vV)|)m1>1JRa>NvMqUhA~hp7ky_U!wu@i+ zftEhZ%#-1ruY`-3&Bwx;gRIw^zx<-L^*X?{tz`OXHz?1ZX*;Vm!LZhyP>vjyvpDQWBo zPXdYZ-Zz#6w@+w&m)asWeL4&|v0w)q;5-RKTYC3f+WFi-8&Y61h?*fz;Bd#WF~h~& zO&dF-vxBWWDCFn6(_N9~@~1qE}jfIZQkaxA8^RQvf!>-N^XURwWVxPA((rZ@KMnP}Ys&nZ;FAFH0{mZ!R* za4Jdd04xzM#_)OLJ}LRwF1%ZVlXTX8m7~rtQ1h71;kr-Q24LWcmiUhXrSqR?i7%1f zIE_I^>+l2|v?e?Z>Ut#DQaqu+EqH6$GlU}q9b!uvu^*J&ICgrp zsbuieRej^Z7qMXvlIyTgiv{aCz6zb}67qBex(wrT9Jnm#2^elaB; z+}?8feZlY+EWn<(*Nra+lX;uY9ab|uK6roC!gz284$185JPNTuS2!1B zPbH^<73QN3JC57@#f^*RPQ_?CCZ@klRj zNepk4~7X7X=qXl@V&)?$sM`w;Vqr#nF)J|Irr7G z;fjGX)^Kv;B&KQj+9%=eoDM4wT^$eZM!F`LrqFIyQVzG$*EHooxR;8!Z*;RZ1 z?E3K+ON9n-!YV%g{J!C9cA>O2zXC{ULnSmwZRC{FH2lPst0p#(0sFS6mNwM%EiGS# ztf%*%l%}*LZGEQp^G@Mw_rn`V*Ox+;hrVy5tNk*R9G9s5GB;e$QNY&Y;M_8-_Vdo+ z`uo8^=}Q{cK>9&xzJe!I^W;|W1Y)V80fTt#q;}iT*h2$g;|X1|-yflaKs0v*XZEyN z@EWVQotZ#7zXVCN|9Fa#a9S9Cv2}wzzQHLg?A@<6X3wp#L^4CaAIhS(O0;f(^)7z3 zA-XEQo7zQwPxOe1owH-S11N`4WPkfDP}U?lI!<K*SzrZ@{aNi&A6x(NNzV6{@+EwdxN@ ztpI8xn)E#;Wb7?AXYSlh^!+VD5rd3=?r9v0b47+CXX5tX}HmXaB7EnVjsMefH#K?ZyKr zB0NF@i63TzR&45O>PZN3-QQt@E!3|)!j`C|kSVlFW>TA5Scp7R+8$3GuW%|u5=_0i zgI@8VnAk}aJ0prtQi{bvDVfqlpGbZU7bbTJ2nm5sl)PL7*#8+V*_qH-BTmy7cg=sPs_9*X2m6p@fVoj(&)|_ul zi}g<^pR=?^!8x2X4YLz#{I}&N`SZ*)NG@Q@pW4nA#o<9+zz8NZ0EuejUya_*#QnUs z;*Qa-Cm)+R8GsV(W;KuaO+I}6#Y|Ex+_Pvvp}h0t9g%k~-k||b{g&ez7x<<~q>FFa zhY(vjKH}8E6z=POuco2pg|iSBj)g)p%F)UEM*N;3c6Z~gqp9D6;&)gm@HyVv6(5hJ zS66vT{$hF=OwIao<`6vu<%tA+Oy zP%3k8v6|a2e?Y8qtOm%eAyys z3Y`r~dFO*t-Wx!vd^V)haar)YW1)3e+`1m4Z@PE&`=KSA)`Yz7Lf8_a-Ry zr4xD`rA`2){+$U*{hI_z{VN64U&2@jN_}1jN>le9Q0nuaL20V(v(zV+IswBu&)8Q6 zUFIBAp)5#nKL3y5x`&Wf@!D~LaQ$ycrJlhYB|l9&$8<1?QDkNX3)j^`K%L<#YUm$p zEE=Fgs{_bgbAAScmuuo?$ck0ch6}pH%dvQh?-MGa*6}}&IoEM8zy;G*4E|n!xDXz@ z&Zz%Cq_ePT+sNkV3k1_V6R+5#Yyh7DbGNsna~A10=?fT(PuN(52{ z1;AHD(gcdNJ{zn30;4c)Esi&K>`w2z$$np_FL#Cw3lDuLU%W|N(#&Fn}kMTt{h8wG>6FywWrU(%(#8)8#@Q?m( zU>J_bkoXEr&B;*EV|Uc9P6#T{EbB9pn!z6P}(2d32LDD%&e^w>O)ZK z-+zNr-W-%(rH%!qydyvD4MZCj zMW$_dD9Ycp>+z*o&lNS0xggIW*?^JHyUx&H?*KAK( z;q<22Vgn7&;l`IGv1W8BGJ|SwYMlVzO=^WnGPO8Yw0`sb(4T8y|%2GeF)GsXc8%uEuvGTqHs)tA~72T`mx~L&oG`>T){u79S*|XN& zvD!lzBT%Xm)xj|X^GKL5o)E(X9hG0t!ge?eu9g5H+r$!DAyBaE^^=R2rp(sr(tH#B zX_y!(86S&;uWckx!$j<2IgekrQX-o#6-&(gac=KbvEym=hO1y>`Zw0`e8L9r2xH&{ zBKT*4f7UWlrtoB1(6FLexzJ9w$j2qK3{$${`qx3k2k#1B!_GDygz9q6LStUH`LA$k zh;f2ICjetxb74~&F4`7*xC^M*LlOP`G^P%cT{)3Z|2S-l8fFcO)qZwdvK!v8yPI|e zd&2cU1u>~Hgde-Z^*7@O`u(9;UFnc$#X`nz%*l%S3aoyFdQHqP>N#{$T~W^<=8PF(M|)SoQ%p{3YkDvonz zN`+7qbp|_2pQ9TPP4|yGvBGsv!ZWNOaX}$f3a#l_z?>Us>B&9?+fPczUx{sMzXL|L zxh037o98Ej4>r!I&RIQWLOYL z1?Br!G(%hzGy6`ot=q>Me<7Ywfbmc&OVTXkhs{E)c;OpnS24>kc2i*;>=LABBK4ez z7L)mwI<^$C+OM#I={unG3nv1+iqE<<4EFrO*;Uv#020x6Cvv66RKixZi8YpD+bD_- z)I2au@q=Dahc^Q05Z-(uDYj<;bnUOE;Vs$0U+M^Ji1*~RoNopf{ja9o*cQ{I^*&9be!;02EbWFSHQ@Hj9fD;^^ zB!_axaHlv*NP?G$^oHgyUGZd#$SGNT04Bzlbtz39s(OV=iNNzqu9kk}DXO6XENex) za|*Yy&>s}Is1p_GjL|w5{0k*6xB~^Qbo|NzU8;6rk+g0;d*gEuj;zr*i>=ynI$fXh zAFE?nDye|?j5)IPGYrptiS`KM6>EJ$GQYUsK)8McmOWd>p~$iK#1;!~Abk(I&tj?0 zMX3>-BFc4qcm7AQ#{pmz(1S^6S1~&u&Hq^Ht0Gw&TjrY$g3m3#;_G$<#d>2Z&jRRo zImDz#cn!sY6mHqTq_01gGH=V#T}yp&>aWcgfwJ$j=>e;w+uAaTNy72 zm6cX%uH-mUN^`vUP)qFyIBCayJ}CVT;b>aB@E?Mjjwcj&+S(lerMTmeHA+nYb%Efv zgVL(r6{S%r4sDMU*J4oGahF=Vxz?^4l!o>@>-vaw-DB-uvv!=JR-exVr9O*xB93_` zJc-G=!v^U}5;O{y-oAKO;=O#Sg!*eU1+wk0h z=a+cy!E-O32k`Jy?NK~Uc%Hzs8_%U98Q$rnTcl(o(u3? zgl8e1C3u$MS&3&2o+O_2c&@;+2~QoK>+o#Gb0Z#(cD{$_Ry?=ixdYEH@Z5#xUOd0W zLvt3M5dIvhi>10-D%VoIE!Edj{VWx+)BsBjveZyZo7tOO;q^ zrlsas>HMDmzKK6QukTv0ZVPQ)T5SaveXln+HI+4Ew#r|FI(z0OTA^Oy_R~VTyVS?UW*1yBY}`Lk3POLezYuBBM3l!J9kDb_HhB9++YNTW4Yt#*`JDN3yrrB*6pDN3z&lv*iDtrVqJY9c5~$U~2H z_|Grw5AdJmj%Gd{l};&2rxc}Aiqa`X>6D^$N_mfO(^J1vBn{?&Q@K(N!k`J^$q7;p zhVj|EhYq;Pl`e-3O(+oI=pN=c{TIM`4Y=6bGkd;&sAaLMT#0E!)6sIB!9ZX-;mHXu z#G4l7<=5TfDpxwoVw|wn8h<(q7gM_{p7E#D-Q+4)y24@{t~tQaFb8siQM?(iLA%eG z?J8IL8f<8~SP2gh1j7(=g3M{gu7ntd2(JZoPAE*yaTJF-wo1+p+cxSGm%3i*dr@u#JZ0DJRHLI%Pfd!H4I%%9Sp(7>DaY zvcMdTCntCx-b|O<&*?naRj%|1Y-o&bJDin_{`oa=|ETuG~F z1)~8I#*-7A%Qv3UPZqr7Dpy)zF^+^BE7P!cK>ZWq&D!yDGEn0xR~khCOs$_w#%6-D{P$SWLRl zrwf9wQ_ ztYV4c%A6pN__Nf0eDIqUr&z8xEGAu^2(URp6G_kk_{(3zpngbxiVZOGThHt4`Yvfk_i*mw9iH zQcQtK4aM-y8F|Mjmp3qVyxZq9(SF5SkkA{H34J-PKyrO1b&D^o?3ZU<;|mK{L1j@; zRcP{peyW#$&#-xwj>ahFMxW1g@>m#umV2!9daq@+EI45m`C`Fzu3oWxjT=^$tFn?+ zUR`Pkt8MjINK4!Tl&l_Bz8$jI>v2S%QAK64YC~Y<^2JpZ)zvF;O^_C`MO9UcoI9=7 z%WZY5D;;l)MyyqfmakmAdcDzxlmVh{&uY1iO7$6K1su-3rfPZFvenSK)doK@arqKO zxKWbml$EcpsXPMTlGTvE5=bXnZ3P3>SyhY5p+w9gtJ{KB<0`AlHeFTT!(&td(@Lr- zTf8Az(WYOHP?E@PiL-nS^lmxVab->Z>ay~c6^jlFF$gJ=+GyCag7Q$wirq&3XaP6^ zKyGDIgXDV{!OmRvnoCW>~mT+k&qc*&Jv zl}jqt^F}%GMUabR9HIQAThi{_68 z?HJhN#*QAPHu@%R956G|anWc&o(D)=IWX%paQRVw za5{##&A{BAjvJXN--EzBosJvpOBNZX{TY~lrsJadBfJUCa64mM+>c{p7#rVczE8av zae2TLr{hK!2%qyJZay%T>9~TZFCxTU1I%~RanTX^>GItTOj9OqB-dgbL;qd|ra1#Q z$_tZp`4X63{5FQM@huqZ4OVaiff=8Ui{|@)40i@FOEPdHduFx*MNRU2#v z!6Cl+`M!KBg#ER^>@v8v!sX=3-wg(&7!B8-&J6b};D+^AOb7gvbk6r{qbr2{L}0El zxVFM&eD5+CkYXgb}) z2afflvK=^fFB{s4`$ju(%(w5f1INj}+uMPYdfpBkr;#7bf*T&q^QmDR1l%8hd*5K4 zdO3WIPl>8rKlCXu3C=;mFx}bi4v+e^aYkT&DKOtMILE*Aa?1Gr++aY8$yN@SANRHc z$M`ES9;p?A6^Tbn-MUCq_)Ha21zh?B!lE$;> zjNO6zi&7f{Ed#x0^RcaNA5M8S;H-q%FPu+*Fp zh&Nz^uG#Dil?I+$n&J&>p@#Ed@>a)ZTx515cHp(l@ElJ7ui@dXq>iVFHa*1#KgYXR z!4u)ev#}=*7S4uExpGZ6aG&#YL^?VAoICKZ=6gJo-hkcRRIGsG)TxpI5jW`K)S>2Y zU;q|A1+jMIfu$=BwGiN-680>f1srx>Vy9zHoBkCw)P!&`ZHa2oEp?K|(G-a-*d?h$ zj;@1nDNa7&e6%-Y>>M;n>hRQKucKsR`1+fenXoq}!gy<|UYW+oQ>%pja*o(q1(gW) ziVIbRlXt7|G?>mE?*^PfQ7EUx=OeOoAAiTRFD+@h|y zqd|R7?09X-UZDnodS9r~pj74wpcqr!Pz*|Wxu-`txFbSwn?Nb=_12DSH_H1{P|ABh zC{33w7WXWuO%g^6D6UF}0{;S~GH2N_zMebA*XTXkQkGDDpl5@p$8|?8OFFl5kHq-E zDd%kd68x>TZdWmr9ov3CYKiYc_0k{jJ#-ofb1!vF-1Uy`=D&4j{V$?&i}#S8*h#$8 z@i|toGu-%bNP;RdwS(=Up6hCcL%iWilyMv_dy7A~t=mzgnY?e)xrO0+Zb;#VY|p7p z%D)lvib7G23e7He6SWEAv|u-UlO$mDcINP;OYO$@0@zI57^>&edaC$kIa{!?sU*b% zLp6uc&{GEIIGUVDS%YTpAKu29p;N^}7HcYQWz9~5*MB4tot?XB93u3EL})vX2<&!p zC|p+znVB_u`bO=!Nu7Zu!0^z|Z7dr~UyG-LX~_M8JVn9*8x+IFQ*oRD(@bXy+={Hh z0lm~eOaik^K*36uSiFy*vRMCjR_po~HB9J0Vk=*R!@-^$q4?iK(o0GfL#DnwG^S^V zMB-nQ8}T;hf{4eaCY&BBr(`Dku7sX39{zxh)2BkQO;n4Yc=IL_9vjh}hL+xNPc*t` z+cjT-zQUJ}EtjK>h1f`g`hzvoOq!!*rkrXyy4j2h0K>-irkZ{kvAajIoXH)GH{>-G zznq#JN;F(FAQuJJc*!$3xa{3T1_z=k*)At15+zSa!!((vN+`%2r{0I_ zc)V3kif(Lj>M&1>Ze9dsgz?%5NQ>*l&jq_pi`8 z$1WwdmECDer`T3DyqP{(KQtE3k&LuRHD87V$z)bf9WR=>^)%Yr{JS==94jkDyUts^DbFw+`Qi=7lr&7jxtwXfWMTnpKE)%m-**aj z1RroiJC2RPm)C)HWb{fQ(r3;8Mvw1_hTa288*uihlntG?PC1oU>Vhe5Xv-y+qpd9! z*}`m}&&|i6{lFn6NT1Dc@DiD+i=|#qKq{ zKM?Alc(({etpH_09R=!7LQ%cD@^Vx5Ua?yRimhEJPz6eTsRMPV*m2X_heEM0y-TRu ztsPJIXlVZhYMHpc0ZK#r2dIz4t`(GiPIJhquH2%mvT#e$UcpTT^=qMKfKpi&fx1uZ zmRh^@pxDMkbBwk79w_}B{t+k*<6%&mrq6@Y(B8GwK~Q_emmr$fkA><3>hD6G0ZKVW zf!Z&2)ME1wp{9f4KtB{%3rfSi9F&H8J1FKvC_sHI2ZY)NO8pC=Q~R6Podill8wHAk zjZok`P@0nSK&gK#L1{`RK^+tvHzR2nKL({?P$`)Dya$x}{5MbjXG*K6O@Lw-%=eqJ3e;?r9S6_Qe2UBO<30(t?SRN>s{9M51=%~ zp9H0``~Z~t*9uDG5$fWEHXM|?js~T?6F@0%F(^&bQfoH{l*a8MP#U*#P!UOk71r)C zQ0nu1xcpxj1Sm7AL7C&8f?q*7yEj!R6rRJHT)5806AW;rgs~0=CKb<`lbD>C6q{2# zb4E#GQlgj$jQ?PSXvd3E&BPN748mJOI1(F*nHchBGn91;9+mY|q4My4NT{)RFB3|H zo}ZXLc?O`m^Be!fpvCYRdg(O`ni;2JUnG>*Ju8hs4wp0x<5BU6N$iSUA$An|aiLV~ z^XA4%{>P#(7LSN%r-IODhy(|<(|4gX4vx{d7L-@Tj$(f9>ZJHVsn-d0`jG0G zt5+^B-!Lx1;~4lkY3A&4k<*6_sg_@Jt1GG^(^uo3^ont6QMsaW^}5Q)c{SJ@xpa9& z6&S%aqw3;CmCG+%#0yA0?9*#jEv~3Ky&9nEz)(RJuU~`kmM0@~u*1-SnhQ$D;p%p7 z@Zx`LK&v4USiWe~>Z*$aYedY%5^TSea03uDPy_K)x&W?i7k}w(01Q@~K&6PUqEs7y za9if3P7Git^b(|q-=x<($CY`w9gpVKPND8_9L@i>^7-fO#IfG(#uE%g@cu%mLcE_5 zDvtN1Lg6K*t?*crpU0!Jeks(FVdZP8xleG(Fs7g;5PqyqE~}_A=~Y#+lxdn|aw?#5 zb#)*zW$OOmp&)|3Cu zGh5WhK*Rc#6YPmM!)Q9WrJs9dYoWzN0!ljPjXDZfAG~S5_^z6T8=?wKtPn`k;&u3l;pK%eg6I?(j&A@|G{bDO5Kvvsk>I1>KCgx=N1#dx`Aw(hYQhwBkz)6K`lc)4e`wponB#ny@DC_Ju&jF)?6 zYqTJUakw@anYro2A2POPZtcxLk~vduHnui*dL(?@7}GkITh)xo5Wi zZZQs5vG6!&wwzpMyxcQe(=5i}y2Z%M`sRkkc)4e`ZnYSPYX}P<49l&{#dx`Aw(=~- z;o@MKh9%48V!Yh*Se)pjanECYUoFgeEN{Hr^H@Kz7$>Y(jLf~^;)ca|x#zLovKWV} zg9)9XxLk~vdmgKc#W-C2M4;iMvCGAHx#zL^S&YL~FFek9EN{Hr^H>cQ<8blQh=w)K z4U6$|&tvVf7>DaurX@LExVRB;7^pMX|MMF6JQj6C(HxI5uO3i=1kDL}a)R6zxE$1d z$L;yTJ!`eiVjQj!#^yxfTE;h??|yY~ynBvnoEHOEoEs0yzd%3y%LzvCCS=G7-@Md4 zBgHe~G=lM+7&{5JIYH(%&4O=^_`aTz@}4ddjJR(${+x_oIYG7u4C^o7fAb3W{L^B8nPa1lva1p=FgHZ|JrZvoIcyfY;cvHe%3zuDbn&tW{Y-j}IldwN*bAn-U z#r4LQk9wuQD`CD`3r5HnOy~oI%Sl5@IKYPGoH!&#CG2guP8Y61yeZ+;z2Cj(bj!sH zV`v29lW-tx-83Bd*xi2}=t?+3m_)UrreO~aGH`})c_loSh(09(G32y$Kb)Pgd>eD{;7nYnV1ftjW3sn*sy{|LSp=t{m&( z(!wDa9~ZMfC&)H~=D@2B$pR0T77oGqxW)nNwi`bfb@@-mxm@{LHU#728ZTTNxzP;m zv+2Ni50{n=!T7k&1~wJtkcE5jfh5p+(?z)4)swofDjiHzAMjd|~56%eB{wfvf6} z;{Qo_a)J@O33=@7qyIR`ay%Yz=+ zyjo{tq&Lsk(kmDr*JR;x(s1@0bH1aqA*?B3D(5Hut4+iw zA)OtK3#1jZF(bt)Gi<0g%`wWgFT-ZB&!(;O-GFTb`^~P~-WSUQu-;vhcHoilmt>^ZX%)2Fz0iP$KQl^!0oQ>7k1-C19?tm2W;0Xn(3 zq+;o!nw812Bo20~y+^F-ic2#btZ05mH(bBHCv3k%wzQGtgCrN=X#Bhp=0N<)F5}QA#_<}k7DNZvcPA#4!KTRyMd#~Wc^f|>-if55IGtTLjHoi_! zZmPRbH}>(-s;X93If;nFzIkP4uGySXUY=hi9v~EBQKmk3?Ce2LI*O<0nTW7#WLu3c5eBlFeEFV;4*3Wvd$2H4E3 zUZV$}T^4B`P5whSz*6tQ=xllFIauu}xEZ!qc5#v5OlEkXZZ3K(J=rL>j5T7MkJx(Z zJkDRYomc^8%%bWw5^v2N=hXJ1GEea}nSoR*%Mw+ac}udoF3+!4zf9>4RKpwb+_BIG zg1);c;Y9I5%BAK#yfNJttqa5)=2skl@4h{CPx-()xBz zq~}M+j2ZVN{3*I>w|yWfqB*7*sZC5qsQnF)Wx+BldHd7od4u2{p$_P;0)Y| zQ98hP{W}MkSsA#IzN5qRZz(XBXW&LL|VC6(Lb*Vp>fy*D89^ZF> zIhcVPl_6g@B=#vxa2PjTM(3sbHv*V=25y9YEh)RmcM&j`X5#X6n65ykOFb|@$iR*A z9SJ7xUSM`);(SMGiF*~857TjDed39HoJH@0hsKR>=1Kj*z)VQTjU1h)ocd;Pvw$f# zIJZ1UN9f0l;-1F8RltlnMt}38U(4yp=qR<4H*Xl(2+Z@xswF3{1Xqyf^)7G;0;=i@ z)xO6oj=`&c(b4)zsrEe)!5c9PeY=^PAY5=`{U@|vgnvK8Jnza=l&`;o8&TjZf5!m# zbOd{NPF0)@cdSq0K;Sln`>oTk-;r~XFwA=s-;v%N;pf+iGoZ>B4-LFG@%1HNAQ%2U z3e2;E1s32Gxu#3L*E>;L{00*31J2*USoy~I6gJ2nj2~mRt`q0pV36#3GQ6O`TkHil z0GQ3`xDok2Tp{@H0_FpQeA+%-oIR>>Ui_TbSiUKdWt#!4O9yC(TFu z6l2IfhdIF28LW**{+Ot8>3bpm{S=rE!}WJ3{G)t2#!)-IkHRy-U>sWw*Vi0KxC!7k z7%Z|!;xRnmed}wy61xd#>tQL_;M;^h`|UD zFNT|r>jry&&B~7BG|buU@b75ginHK`kM*}}`+=JU+(c9Rd*OGs^y>`!gT59byL`lb z*$!M7xR9?#XZNoMaL2S0cWOIuOqb#9!1V_1>~`Q-u4c9a$NE;@PF!U>aL2*F4eh|O zzr3*>xSqiMydAh);I^~_*BiJe+ks>Hz0nRF%fUzOz%hS6ZwHR`x{J3%#_w$PlJ&P+ zJ8(>wUhTlKA2_WYIM$E;?Z9#PfRziM$rcZmzj!-vY{zD|1IKn~UORB?AIsW-WB!)6 z1IPC1(stn3p4PSl$MkD#2afUmSvzoS|L$oAj^*Wd?ZB}=+tCgj<$IwWILh~0J8&FE zzTFNS$7i3n1IO{`vEBhIerGGEY=?%o11J4dJ8%*BH>({urgK#m-0*1B_hB{wxGU3e zZEBt<1K6wn0TZa$dLc?F7WS6=AfpRBf{ZTk2r|0BBgnX^y)wGMBgp6ik07H9Jc5j= z_R8o2k07H9Jc5ia&@ZD;f68W&PftqE(>w4YJR=?9{o#6>)~zH`FVq$U!}T|kZYaay z(--%Fg#8rUeAkrR;2h_KCWcbnSd@NkSn74>Rz}>}n2Y00#q|ec;hS)*5qD^DN4xk2 zk51v?e{(dHXa9E+Z*QpGa14KH$h)SnnGHk_%Ed_$p1Jz^0%=W$NYUm>B2UYQ0vCfC zDpV~f?z9TY`F3^vDeQ)c-ETngZYonFv+Krybgw2-FPPZxkaM0?Xzv`2#JSJw|AOB* z9!|X&xHSvMrlCbbRUgR7?xNJHP`K`U2n~0k<6tN5+Eed%W^@yHanjkfh=>IasN;$! zdnmJRALR6&o)bBEm_L!)DQCe|RReuoN$EU?R}-mX9-|G{-41w3YGIcIZh_hbX>go` z%T3f(f%C)8(NckaAU;3g^+xQk(-55#m5h9@__{A%+XOF)_o6UR*+)xWykTB04qoq- zm_chp3WwTxc#J2Pk?D>Xa+T+^k~Z(yGJ^}|Q_Y@~s&BgL+3D(uzNsU2WThSPjaq!yt3 zI3VAOi@{Koo9_j)RDfa5RiMZbNBM=EU*;`Zhr)F)09e$pDg=!HjsVmMu=$xU z;meQVh$Dqazig)jW8$i3YFp+~_sQ$#I3j3s))qIE8TAC-^M$u~I1{^yr4rebjLnjK z8mx0X*U1?Ja%v}TcuV1yxHSD4U`_L^c^uNDKLX7|c7;S;y;i)ru+wT;1u818tf2Wq z{Q%Smp?(EQ`vfMeHhMd)>&u|D`+MEGb^#wZONIj6OsBjNP|8aem0$s=QgDR=>#SV^ zD3yw*7^jLW73$w0)T5wA;lZtDcz;{$xD`5%x3CWc! z1wx$9nY^2HJKkSL$`s0@GKc42NQwv-xh% zg^p`mb9Z>^D4Fr!a(M<~ta)7siX|9IQtqsdl>Im zh1!AlY@yhq{9ULw@qR<7zv0bW_Ry_?QlC%4Z?)rSLw#nwJ6CWFQ^TDCN;&4TWOy&h zEu~tDS8>~Ig16FZ_Q$q%MG#I4!G`o6{&r4LtHy`awrCS>>8xK3zfF$skTHO0L7ER+ z+%^q`3FZhkeVGeO?bUGOCR!|E!^MU1hVgOT?d^n#aYeX}mq|GM%-&v}-;Fb&)k(dM zZM_}RMc-6yD?bC>GNTmzLyR57#)PMXpq?U*a;OpMGu*xCh)pE=1XK2nw>anxuh7N5 znOq&)dK*b7WvH3#>pWAP=wXROnNsY+L!mF|(#-Le)Ank>HP^;|T?Z z<6Vd(4$1wA9M`D!ByAMW$M2Z9CP8WQcs;0zV#ie1G1mj2w5UB{DHdlfoS%YH-X7r7 z2K8i6+Mx0qMH{waP}&_#1*Hvs6)0_te+){S)?b3shVs{-l=lHplkni8d29CxDCOX8 zWtCK_LTqkqj<-6X39Ky$gzJ9<7)Hx>fXw2X5<9OJm+QX{D=JWvuWO^G!yPR+dR$5x z7DAQ7a9sOc(_8XEMt7ZMh{6Ne)Ra`KXWKesNPNtwaF8J9OwshT|)iuw!-jUTc zZd|{S)pen`CRb*Lxn5mnWxCv`F6dl1p@&Fl4Dj=p>T+_XOOv?NL^)b)=!wyw@9N#; z@m^In;mr?2UBV+spFoS-H8~?J8MN?j=a{{9co2|UK+XoGg^=Td+wp_~bMXG5P)qUF z;>f+i%6?~{GD}=goT*c8+ND8^Sva+h{G*Hio>ugZ!`ZeoX0qR9@ zU1eR9)^#%|R<}^#2Y73${T7r~$%jE{wMwfl7x43PW)a5|FQNCS9T!N>i=#j1$3o+j z4rV5z1bXxaiSjz98T&`fX?Gjv?nP$elHS-ur{r8?`Vb3~+R)68U#DHxVg?rLgXc1I ze6TL8-PHlZY*PzMbO_@p#iQarRI<;&>lp{QUnaZ;T7ndqe&wZo!#fJIM3W4o*V&7F6Cy!OLF=3Ze@YPSpspKpwNGc1pp7EjHA%0ZhQ zj%Fuxy7n_Z8Fk%F+I`CMqFIT4aa5XnOCPX%5#c(1sivWb!ARKpf@VafzmPK;O4?7r zbN)RzC%nZg$k-0wIVJdSz`30JZ@@eMd+;v*2HYkTN^W7<*LD6dEqTNB_fRdDKM}+A zPZ~>4QibdH8cR=tgzG;umY!&b>w9C+Og}x53)c@bmYyht>#1bPWN`B=&?h2(TFTj< z{S{9rFdlC$<;9>lm<`F`ncvnSQC*>>yu!M&o;8ar`!999*1B>K#$GZcYChDJ^-O)< z0!n!w1EsDzLEVKX6kv^0I}Xd0<9$%d@sV{s0O~$GAvry+99E(WC>94{%yW!Cj-P#isk0vyb!FSmeF4$dSg z$FHpGeV}#=2M3JGu@jVXaH>i|6V3u%=6VS79zN0Y-t!LL&?CJsQUc z=~KxMrK)-y#sZ=P#4L&@wbzqI^CdI75q>K7M_!=(W7w62Uon>n|o^xakbN3oQYNE}j!xL2u2%U{OcZdOGNyB;!Di^|Q zYTk1uAJGr?m43^78{rdnck_QEN|+7|U-u>mPF8BeU_wYZ>4rA&^37aPESg!&VM^1$T z-vy;zF&hA#d*aAWac_b83Qs8T4&FLeV+S7;UN#$Q*8#te7Q4=Pt6d*Z{1pnEVC_T> zvE!7u;`pIfDq)-tN~Pl1PpMi<{TkFbJfQ$Tnlx_wXc{bb?nhHcR5DHohXSm$38AER zct4$rQqP-;(a?)iJx8G;#8UeuD{3$A61ehsQ|`>z(C6I!@Xmb?=ZtBjTuvkPvI7N# zt7C=Q%ljRUGhRDBP&1aoU6o&ZdH29oLu)VZ8@OtqOg`0|Lhh^DmfC4F_!Y8X$6%!Q zOiA<6cyn)FC~yua?abn!vR55T$hux^U6Y`W7uUo=?`J1%w@p}_5+bgt-L zQ2b&D1s(*Yp*4Zh(AYF`9z|!3)Rm=AT^a8Gh3SGoHsJ{dm<~lkF|DQuHJ`(`{{wS) zDK;Akh{|TZ2}>lTs07L8&JN}i!SuzO(-x}vh>dSBz+QzNH+^WIp)d3B1bNJ44tC08 z_k0AiP%y#V_B(8MX?Ci+3a3DFNf3&Cvc39u2)x zs64!H5Q^ziBIz;{6lda%E;6xmV=f|igGetk5wLmtB@VqF;Wq4GMjY9qZCONZ&N!}e#HbZx&k2k%%IJz?}(hG`% zp?gO>{Tz$5|MWLoma<{dqF!pVl--(UsoJdpCM0(2L21_C2#VcWP&AS&?mpOc6T7XT z)Gjf5_FSGjbMpf%{%GkRJeNHB5h`` zrY;MT7C_F-1!XdZpIO1c8oW7`5)5p@`%$5;!<%C@EsEQPx()B0Lea0?La|VC#w{qn z`MDDe?7{m*q2^XXv)7V9jsBZfu^}>P^{O>ht5+?rt_ZBC*x>m!Ddu&X6!SR6mM&es za=B=Ai%eR!sPbZXxyZG1tY+7&si;D5aIJR9Nx1G;S!XPb%m6}u1j-%j8B1NuN$!Ea zNPP9mB|zB|fbx50)$+B=S5{nH5jlT(a@mrqMe8a9I7Fs)u2swzmzXy$-2$^r`KFe; zStXH#lyRuFqXN6hDCv>u)IBF^?q-?tZma+x2#V~wksKNcoLyWxbI$w;0uHcN46}7b ze)%fQ5**uHvl=J;Shb4qqiXr$8mh{hNz3ZM>dKWHsEAF7Niq3Xy?RxJQz4gE;=0v} z@+7#$ZBY_;eUm8`3mi^$9%P*XRAer-_<538b^D1EGv7^Wbx4@tA_%WrKwz^WO~jLa zVi|)Nj7UYM7dCnN7fpGj!;TJHJItGZQQ6{(WtEq%yKGaiHkb--4nE!CnGVl(c&>x@ zG#cBG9KNj4AOD*w<2sp!hwV&TD&x9aOvH?Ks6m&8t&pF~RTU>;t7eLd zuw0dK8!X1*YBV-%!CWpX!g5u{eaB)Pt|x(}VSD9rQE{28GVWPH5aV!7GtFvO9~Tv2 zxhmt%vlxeqI(KPMdpuz=Uarcx7c9o%`m?b)%E!fcxhmt{vlxeqgD4sfHvI8&RmO3s zMAO~ItF!UvXxO@3jF+o2?r4i~!aB>OY7ZY5)<2C+FCQ1<<*JPP)M6a2TqE-_ zJ}$<~RT+1z#W-AZfTrn<#~&|OW!%>UL5#!YDC_Iv<6^vAm2r-;zCM=g*`RuKtZ*?+ zXhHRluFAMST8tA`m8qx43D?tjv!)H*`p(C$%DD9w<8WPT(xaJCajZ$>o!PO0BYR4OW#qIarhB9+hQCpYVD>u8Bb1d3f}a%$LAXdtID_~ zYbwji7sCqXYp)9)Rh4l}`Q=MEnj*&Ga?~wGU<)n;#CYBN z*)Io1BvhXLceo;!>n-?Bb1I&k;4;4P+*Y~c6IW#%_hr%uMyU6Vgs0(`%k}i8ADrf@ zjQh}w5w0naiKaguS4rB=ML+y6RT)RO>0S&i>_^i8(5e*3KmxAHIHnYhV9arRwK*OC zkQ(|U&~L`suc^v7uZlmx2;#RUrUQj5k8eCz)O`CDRT)PRZ{wjMM#-=d=nUB81Q+7X zMq<~L)9!Rt#&HIUMle1J2f@}=taQ`wKY3eK#(7oz2}bzKOz4A!ixSe}%VVw{sw(3M zq85J|VwB{ZB@JtEPB4Nu?WrcwRT;-QcpAa@Bs>$gZW>M>JF5ptpleK>x(3iLL1fAJnw8AlM8LuiOm@+T&Jq*U0N^4q_haeBW`+qMR=201E zPTB~@$8|QauJY22@AP=UqcSe4MM^L}u5*OTsVQfk+iR>xWt=&UFBl)!1mWU1mgXnN zKflwXGA^n`N-#dIbAfeRw)icxCV5oGMYTu?#>Z7CT*u)}^XFGDU0Nvpm$rvmI11t7 zPx%;aL`gLWs0RJ^7F8LiTv|8;;|pt|aB&<(^Wumz9#WNY!evza3C71Y30Sv1%>Dkk z6IErLa%tHRjE}2GxOy`nn8$wFS^*I0pSUf+AHS9}-J>$j9HXr?2SY9wbu4%yfm6uNQaB0~PjE}2C zxcH4jbJY`P_9}6?i~>Eu__#`e%?TbWJh)ymCwgwFhfB+bV0>KDh0Cd58_PePG~L6c zWkWDNt{K8*8d*{DIm5%HWkWDNu9?Es)kv8C!7ql-^l)j}5R8xOJmCr%uJD!tzc|ms zrCpI=d|b1H%PEIv|N5NsXL-1^-4KkAYqoIpGGVP9a@J9^JzUyu2*$@XN4UBfuHSxD zSUShUrR|1bd|Y#d%gL`3OOIMJ*Tbb{LohzBdBWwS;jstKI%l5CHB$Q&!T7k&7p~4m z!rL#I_T%$CTv|2+mP7>cIDBVBKt@8Qz2As8PQ zzf;|j!(Ah<9P~90mzE8|__!_muReR~QY|#$M#%(y}2K zAJ+n4bAl%d4@P>gANSY-50{n=!T7koE?mbOuICq=dd1g0Tv|2+HT!hT}Lf+xkhQ(5R8v&k#I%urg?tt6_txTTv|2+q@7g0BGNznC3!&;OP){YE$ewksj#upa-T$&Lt+}B}ETWUxz&hUAyPeRPc zS9&yqnpE9u{dIDAYlb{8XZZZv46asRSajC5MuD0>$LT+@QgU#H&-eRcN+>Tac8rq4 zGi-j6VZ+Oj9Ro$^Sm3EJKfh{)a`B)?*PO9`61hh;gtGQe^@U})gr{nQsdoe1wNL}7 zS?__1ravfk^e6~~N=2jRE^|56qpH*6ugifY3D4r|Y=KWHo?bjFRwALRjp+KDn3z+R zp%c{ODR(jmzZ*9RNA)~r5zVi()8muhAzegAlcy^4$w;p9Wz;K58T@KKy|F5jR5XdE zDeA5%8Go5?MlmK=Zjuo8z0E^w@f;& zvc;>RR@JLSRmzf72%!;^hXGE5C~D}tMbEZ$nI%f#j1(V|LGHD$DrdbFHo zDWx7)k5C@l^l~ar-m*5^tGw0Yhsm6Z3V+EIepg0MNOqCIO-fO?%8R-NnA!8TbgXL9 zQRAp9fh|!>GA)VBObri5n~vm6OA`-Ux(nmvODu!+ODfsr@x_gUx}^IOK)RIKGz_d~ zjxWhK8dM{ZyohU**0-ZWH9BhS7)4Nrs*dGrF#%)e-t7-~@Ry zh@lu`Y%}8wN*c+XxiDRS+5NEZjJ}^|!D%=o6I|4Mx{IxDSvvp>uM?-?KgEsJ0lwI_ z@#>NrFuQWG4L*uo!dzjM8Ni2pZ4B5EOvRve0 zOtSDiPQP$quQhcDd$04jHMTcw_yH1pdL^i1#Z|ZC zo5RZ*yAnCPoJc*-{l?=(WSpgRj&k8FC!)I2Cp3kFGKkniB!r>%P_QN*uRqup|4<)4 zBb`X?Pvh@`pt}AmeDe-Dm6&Ign4AWzM*A#K8nM}+G}?)%W{gC_%}qy!E9v_hi^`62>u#nd1D!f3>;QXVb=q1shSY+tsS0>}4lo3M!K_@pdW9WMd3=}9S5>UiFBs!V`tR~2M?^kl?&5`k%O{oU?8cP> zPKR@({w67?rm$9cxD!{JVbV`V#VrvkUR9k`=``*k~ToO70z82=r^ zcnpvFR4_YE{{K$D9#6gR)B451kgIpj=X6rrPLZ~q`nT;gux+Qo;xuX8@bj@%a`n3E z;VYLf#@9>r%He$Q4Yn3HNd($(Z_9o-_n=}obQ`|Xb=VrT6ticS$SnjIKhJW1Oiq*( z`|2#qp}(1?4eB*-AQ4I%Qa?s3#jwTI)dnJ6gCFB&zB7HOofc~X!|-2*>v-gLT8|sA zwbSx)xt-Qdi*dT2Qe(po&c7eh?X+fFjKlR~W22pxH!OE&;~f^`a5>#-myEF7osG^q zhr6?JknxAB5`GEYosGjRhGBW@KK;uHMvQy@g3lh+osC@6G?u#i(Z|IVEBC^<>K~kU zy6$Y$RafN`jE{@+)j2`73}W8B=S&!cQy*wNaYfYkBh5*?&^Q1OFkN;I~#>-lyV71$Q#wd>})hYjK_QbkGgk(ud2BA$Il@tL`4%26&3ZUsHg}@NJ1iti6nZW z32zat8bT6CG$b)OQLt!1pmIE*)<;WQt&iH)s`XlHD_XAwp@NSp;-gxy9)LuAa zEzS~mP8K+}m$_NsFhoT>xl(^=ryPG8Id$9N&^959*6nTtms zW`Scn&9jpL4K`DFoIf0v1&+_-|NTN)|Zw^VTeIEWazVz_I*R zWr1UO-_8QZd_0;3j_u`_S>V{;wq=21yV{inj^oBY>?A&usl9MqJ2DGg47lPfa4bKZ z)gCaJ;$?nYv%s<5mSlnB(06kdIHvEREO0F6jalH>?qACS$HmLvWr1V6`ZNn1>+PTz zE(wJZx9>*MAua9o_YCkq_o zeKHFi!+Smp9EbYfWr1Tp1{{rx&-7PsL$km!yrZ(fF~4K8z_I;J%mT-8e0ml*4rz0; zz_GntlLe0L^s8Cm*iOHn1&-tC<5}Ri5cOgfIF`#tS>Tx80mtCtGnv`}(|1r7IF`#v zS>V`SDzm`FfSZ~HPWpKkIL`l;Wr1Tke=iH%7~o#W0>^gnaTYlC-@#0z&t$3(zDJ#y z1&+_H>MU?f-<&LPe9m-dfnz^UW`Se9t;qt%=j8)g;Mne;%zztPTv!S(Yq+ZSTnOh* zN%7REJs#P)XTR-a;&;Y@Mt7R;7y_dOO+0oGC*xMs`;f@gK%pJ3XNX%dDCQ(La+-CM zZ=F_g8)H1?e-R_&567qAKg`()_8Cv=|(-Omr*w}$Q)hwfK~?%P85SBLJe3Ef{By1y)R-yXW}4c#vY-7gB= zFAUvxhVHvU_g97PZN(XaHOmo3wGqXH8igx6f~v0JxThLgP84c3uA_xQS<3goXauQ> zuq8($D8C51mFf#A7wSG-CkV9`*NH-H#JW;Z z4n)5u4?fx>&;tTUwBW!!dQ9LRu?OyN3*Fxpx?d5xUlzK*DRjRibdMeri0`YRd-R}y zKYD239z7^iJv!jOCUk#y=>DG2{dYq5sG~r5=#hc@?}qNb7rIA}4B%1I zfqV4Gz&(0k;C@x;es$;`?InP}K6L+;(ET?;_cw>`?+x8w7rMVObdM1z5I;t=!2J!O z`<0=4j4%QGmqYid(ET?<_Zaa5{1_nv_ZX1^_qT@bZwcLhD|CN*=>Cq-{kKE+cZTl2 z7P`lX7)TGEFoAoFsDb;Xq5Eq?_X|V!7|{d#-w)j{58a1{7>+FHLl}*Q$)Jj}227p?FD_S$C`*1}&0<{)bv_Mds zam82!>J40p)e#x>0csbnC}~i67$eb#K@A6m)(UDADC84VIjH-Eii7&0P_scjEL1C~ z9}Be*)K7(43F>j7)_{6asQWzq=P`g0AC{*46PwUih zP_K&HC{Vu=svOj>g^Gjv520p*+9p&hsNV{;5Y+F5S_x{0P-{TFFVuaY{v^~|P#+4l z8Ps2edIJ>83+V&(iBP*h{g+UAIq*ShQGTFQ_1h>=s_?BGl&X1)gW6wkvq4c`1ax(Q zqDBnVFDU9PK>dQEhD_8iC~Ct*{en75sI{P|?-KP3ikfp#zo145wH*|-u%doJjS(s@ zS5GZM`aqS4+bB>xoC5U=iW*X>2=IcbGp95_jK8J3qp>|Qx3M|45K^r%eqKy0>S}>Y zPfJ-zthuGBv$-XPPl=t~k*3CuM69W`rRlO*b88H$zeKlItg#)R9Ge%#+B#yCk%}c6 z=VBuWSYnMm9Yrw+P(<1~AjRF*98={}o!If=xy);8X>X2+(6#53=Vdn#hAPpl#eZFOf}l=nMW(x3xb>yCgT=+r=0V~l*45Yz(R5Tx56iQuwXvGGNn=mU zg$?h^Iy$fHkocwUJco`ps%=xxuHNph&YqT-&q>Nz9c&?>GUs=8LoeEb$d%olC_|NQ zlR`Hxrg=2S+PY$pf1_}Ww4ctomqM{vWNrrwp%{PKXh0xu(h}I*=0ks&dZ1!h?e@+n zHnYtMMIFID1(Ymn_LW2R8_?w{%E@Q4f@)&uL*7 z(%I4+Yea1}Q8ZASpG5$R?EpOy=ip1H&k>DB8;5g4nk50jhUNUFrJ5YKwL=MAV|%P+ zL04jtFMXbSYs*43-uc*B(uT&>LjA-E`#F$2CE)6OU+zI3))_1_x#3=wyRXBVI%sz zmp2YVogMSq=Eo?^#Zj2!k_nXqni-yauFWlp#?i42^#~+CXn3G$3L? zZ0pdW&o`ier>9qXGXNTPXS0{YSm!)#mQXh6X=04Ay?bGGCeTEDJtiEd_qg!z#-9SX zvG$gZ`H9v@x|1ChLR_XNF#e`q^pTDPloZ<0%nRts)|L)a3^wcCEtmH~6=Dz4Zi>xQ zfGD}qp6v!_j=Z*RwM;U4;vwK0VzIf+bS>8dyb;;bqn`!cxD zIJrT*SBW9kaed?4FD!C$gLpSEn6ND0K;eqv%KRL0=V)v*^|HAiTxbL%REbvA(_|J*PaAgcz?mXl_oZR3saG?>5P<3*}w^jV-L@D)C z4QglJc}tw!AXh_Z1QU>y+ZV1*7s`kc--VJ;#!5*!a?l7Sz{MQrM2Ctmq$6H0J1l#- z!C{8$@0~lRWiL1A#r0Uhy#uqC8}v%F_iGmo%U*79f0M%3ww?5+{^SPzQd9+j(s*=7 z?~SSvQKSvaG%&#g%5aEq9cbcu@u@8fR3oBrjaO&E1h`lZPO|ZvwFTFxMnvH%S1!Q> zxEPDmuJh^amfxsGMB%DXF2Mx2SW~W+%dcxZLp34_S5cv`2`0dGkZ^gmJbm>q4^oYY z%2gy>f(dXPEL_Yl&CWZnS*RKjm8)1>1ry*p1nw#;OTfpEjDJrxA}ZH7;Sx-MYq)SR z4Kzaw?z~PlA}UvjxC$n~btv3(qU^^shtwQ8Ts0ypSE;xPCct$V+;gHwh%Z(uuPC`& zH6kjPHV(lAxY%x;T<*xij(?~|MCH=PA(#Lc)8@GTt^U$!su5ASv~dU~z{RvV3ERo< zT)$K`A}W_Q4#5PtjuftAaitkHcu$XNL=-Ngc}XwiSkNw(3L;0RgH+srENnn z0j?OZu9h!+W_e!Bj!|QZwQUF{z;(264aSw``BT=`t42hPOWTHE0$dzloxY|>*ICc1 zMnvV(wjr1R7t6t=u;=0SL~ooYl>E^Qlv32+?;tm~CW z9&qg~$N5S_+lF8QT*nKS_oVvIP5-|5cpsOx4Z#GsP7tnqTxq^{%RLRM5m8g9Z9^~t zu2H}`y9DVPA)iNeKklBPCs+XU5!C~=L`wjr1R*Ga(UMA`3XI^SM* z?ny3RRqQY1Oc5pkTh4Z#GsSR<~dth)25Kl(Hx z8qG_B32?DS-1FfQvQa>Z>g0%@ceY5zUq*!34NiBd!dee{jJ|K8=Va+BO6e;9`xq z5n%gCmrwR-L@d#^A(#LcYs5Xje*8$+VLpwBCE7Lw6W}^EkgwOCnR|*)BVviR4Z#Gs zCJ5IMTxm`}<&2Mg8WBshZ3rg7bsDg4F8YHlL%!tGh-fq~2`0dGx^NxBh+v*u-FL4~ zBVwtx4Z#GsCIaimjoY6+c&1MyqLIuOOn~bQ;Tpz>V9xu0pFHl4gDDY`SEYopAFafS}gp2blntjV&zy2IwzO-!! zCct$ru&$^4$G{DRqUv~36`z{NL3H`DvswA=5i^TnlYLoflZ`aoR!mra=F(}-B6 zZ9^~tuF1mX)$)-0Ms4^=G$NXv(}D?b%@!`N40l{{ z!h1fAh~u?w2qwUFfp8s!E6wOT1`qRTL>#YeLoflZ3xRbd|FelFr+gX_%e8F?CcyPY z;VNK6Fh8CY`wyQ+#ByyLf(dY41gx7m+@IL;tWP6ixwZ|#1h_61F0V8mxb&Gn`!ph! zYugY^fa?~cBb(P;=F^B+u5Cjw0j@d1#n~p! z`V0PY*&H`+lO{qsT9Z9Xn-8-fXNT?(ul0nVs;^zlo5T-r7SBcc9Mt}0EH z6U{YuzkmO%sh0_zzSEY@j~N{Q1_;fP@=U*40r6eV?Z$lza9y(-DatRfyxB0Xx1$N) z;C#-|KbF};oI_gB7>;4^e5lGwbaLSP3bcLchb>Pli1qXmfbTUK{WMVVB@dISxDw) zh~h6sT~Xyh9ZH8iqKMUi^((~~PV16CO6`6tGM0^tdc|Oqr1J%Kn-?;Sh z8xG7VVO)7dAjizdcwp+nxbf!UX5uAo7BH8EaV6#@&WGy-=K3(syb~Fil=H2?{2+`A z=>lQAKL%!V7*{+lkPnv2R$x92<4VhP!1ASU;2@md0!w4dugpwR)LGJZ95APbam5w- zm@_y&Gpd1^6~>jD7Z@LI4lvze+<5cC?ZYhw=7un?q(~n_KHM5$?hoTaJIk5AM}c`J zj4Lw75%|K}0?cp1xZ=V_p zdrruEpZK!%zKk{cyuBR?@sxnJ!z)tsEOsg6-?l!vSvM*i3^&fM!ZF78URFNuOl9Ts z&Qw-D?@VRo^UhROK5u_n1#=t!pXPQ>s4!S`z8L-G3tdC0+5#;ozKez%mESL1N`Aj^ z5&8YX<>U7Y7mnXAW63OAUy!j_IB^U&0)JqkGC?pd(^??@2?RU+=PeL0n32G6LaDF5 zbU14I9mhL?fT0%SecGRxLmm|#2y!`rfNG2JxL(v5sDA91153QPoIt><7UOX(G_iBU z494XI0m{;bkfiK&~!}@lv>!&M<>vbE144GxFDdvCru$5P+M=Q@p?o zwsDkbsXzd^?zR|@>u@^590nUqp$Y`h?`U3N4znrjRtIxL zA}2r$n5Cft0rXzT3k;7))Wp7|4(5nNPQ%Fci{zObR3L!fukivi!g6_P{kixOOrZ({ z5PgIxjUz1ASB%S%0j}5Y`qNt~5J0X~7UQMxBIClB&*0O6F4*Wh4`Q}s3S|w3$6RaG zH8C5;XaE#x_l&xXN^^NPjjPsU!M}2SFU_Uiq>vs;K9%P3j{sLcO2OpC+yg#@)XCFP zS0Sicnu@`I@jFkinKk9yn(9nm9-3M%*4? z3e2Etaiu}+>U_i>2FzH4W3UolhLx*Hz|0Qgf(u--qS6k`(lD;X2r3|a8peAYFy4u~ zHr`SrFeIo*ALJM$HMeq^~r%@^U0H_$y%kYF5@b{S(|cb4a2IuND6(tRDTv ztROL&l?9d1P8-xENZb(2`4@5C4`Xq`Y(!%4`#La>865M$@cdGya1yQO&l?QyX{hUA zY=t+8R5w01-vRCbW)!Bs@J7Jz7=sZYE)rg``50sz`6@9ngmbzNLRxlX0Q(jYR!do4 zyn(L>#|FIWR4szOJ<^-PQ@OGt!%rJ7j5-s>4!A~wKrZ|^pi!=nDa6tckWD9&3CNN( zAy%DVWz^>{q)z#+c=GkSWKE@l)~C#gV=t@zs)%cyhPEpjTg1>Ms%NX|Dyv z_;Mr9;W}0*&hF0?>P=iLh1zB*=16(DO;mXq$G^hlArkiCsHBQ-I=T({2%)-=o_~ee zdn(Kmpx=ZPz=wTCw^vURs%G}gn#t9eke^#~LBn}7s?M$v_B}8{WN~4lj)&E~+8Tk` z8hGk)J)^moiT|>F3q<6wBTlP~9ee!fN&YDV3o!V$q(%DA++1^!sU?<^3To0JsFZuI z#dz;?4+BHPu|CM<*3y0|2x2@g?;UHPaB(0T06X{o-g38=HiJ$u11*=g=EUcqt}767 z!nr@a)~%&^YfghKmrlma#u-_+BiBdkUfAW<(uTu@#;v9O+~jm0xVpHm`rYpL-CEi& zEXK>%fhNtmmiDZK2n8t5f2G8&r5$Q9G4pm?Xk7S!gJ2Ru<@96IvR_}~*3!I{nEjA1 zP9`uuo7isp$}RsQ!E4t8s4`k*oxf@S>Szpkal zKrzWYhTg5Ec@q)A1Vjax8z(OK+LeFKcbjYAB}Onp%~1!Vl)DgjjEl$6yS23WK1@&@ zx~`>hdPBp*Nqw7ZiquswLLOnthi$|ipL+4xKR7{KP3F~ze8a^cwCesN&BZ_3DCUMV z%-kyPXD9jzBm_GjM!HaqbTn1n75JL$JZ;mySX7cPkBk7Tm!Sh_G3oG)f+}zN0 zS=+*fDU)VQZD?$2YUvWS1Jhf2x**=s;>m9KIK1NtKZ}uK9q!CL|B-V@Y(rvUq8R&* zeMOP}de0YDy!+!-To13ykbGtVTSXgsd$0}Hyd9^fHHiA}97^XeT;Gvz8A?}tUBzkFt^(%9Fm8PC?UuOj0JAoXE3YW_!s0)1F97py7*|nL8pizV{s&d&nJc$>1oG2X5$a4hGmvcR#Ktjq$( zX168_9A68*p9PNPvLOo`<9#U$9Lw*W47jnSX8QvCX%2?%3*orh8g4Hmfs10EaU3iS zA4`=5g_WuwHu<}>_0{tL(Dl`C3*~^iM!N&9GKf3iodICl`lFCujP_kP2T$a z6(gdMrAjr|VNv<=EYD!b?()#G;iB)^HK{PKfo|>LVF-M%< zDh)k*w?*LX&Wo?ugCyYO+x%Of&U-F@#W#@Pcq%`hIv9z>vAHX@<}Y6Yx9zZzq^1=f zvy+?qF3%j-HYwr>9)D-YO zn-~^P%>uDCf5nj~oxU$nC1S*6bVD4pF5$DJzXPj_{`U%XBd*^SY9p@d`v*|p6E`j( zD|HO0?~7Yn{Ul$HCtpG`Bnw-S1*s$C0|mpfG5JV%>E9s9W{Q1PQEcO!4$2o3PHba8_5faCyF`;`OZsj9q-Hx#Wi{x0>qOsa4ZwUhqFo_-qMq6s{DlRi&mN`c2qMLG9h21=e52$j^1w{`^@moKE-W zPkugg_vX(=xi|kopW#p5{`gt>UxwA@#5Nv{uwt$iiWT#KP*ZVTArwnk-MT=n6t{)A zJ}A^pxTb_!gX<54dKlLmgj$O$AFk2J7F^k=REeyHw-fibirX$+9}RPd5oyMGj#X7rt;!qbJIL| zhM^Xg6c$z)ZJEtutR7V3+tS=N)fZlGM;nxkF2G`DXK!~?ORZCI*gU3fstcyOWj-`j zwsf~NLm=kt79^{&ogwx_rkpqXlE(R$cHI~KLG=FU1JMVgKa4&U{Sz|P0NVu1BD)2a z^~}MGE#wne8ooK^N*_^*MWYm_-Ab_nl;Q+Iso|F5G+y0emhvyPabWVVZnM~F{+VCP zs4AC+P04*9;ukC@dH#;Y#N-tbn_`R$M*zpgFIett*@qV6am{8#FdP>g7r$V+uVw6I zH12EJi6$J57LJQwu-w-&Pi)71E%O9wSSyZ;`Ep;&9yTGnuVw3v3p=CZV!qthvP~A_ z<*N#48oo9{^TQ zxNb2ne1UUZ%$NIG_6>{ixK1)@<}}xFF<u#dvZ3C@R6oAt|aThmc2xKJjfQdH$HicwCGWQU@wiqSmqUTgiB86q z4nI2S`sbZ=`YjgYas8Wdq0B~3lna+M!)qR>bkgZRu^5l*I)xeO^h(@u96ai{JCAeH z>6`)391a^)5Ww*}C(2$=bHicBz3tT1shg_J)CTD7j^UgiMZy#jjF9t9>@nf; zr!Z!oJW%4{!)OYh)L=yRAGHjB_N$4LSKXrO>gc_}j|rsk82Gpp4tZZNB)LNF$g)3Xg-UQxNdf zRn?yyCtRvrOqe2q5%SOKAfhs^mig8HcpKL)A12syPk>KOlzpA%Yft_5ofBMKloW&! zOdy4$;F=SaS3po3e%W^BD92Sw9(){`Aqxw;A_z%?2kE`>`j|G{aa9Tz7~FoFqi zodQ>v!Z*Iw-h7JVGD<%M6W|&nTzt~e%xyXKqcJ`%?J9x^aE%4lsWCd_?#ow>^>GzT zSb_;~vE4eQ7=Ia*^K7AyYn*TiCcwosIAtGYsqf4v@^NY75KMrJX~>CsB_A#RIN?)Q zXTJIgCcwosxD>v%uyKh`U7e967EFMPX>j$m>HcHi^r@>W(#9be;LzfiJHZi?`FwVLZ7gb)l$3(}FJE zh|zF9NDJpT9svJ}c|FaA(o&vLOi`N4&1o(drn&4BaOp>8MMVR==ulivw86=&1YQ(X zTqOZni;;eJpR<1j#OG|6a{>Y{zSWY3o|elS5>~Xu;e+n}SZ6>Kre%ST$?w_F)Jh-8 zQPt!NC^h2~$M6Z!_?Z}@flZoOGqYjF%;~k0&!%H_?R3cAOqqUxbCTd{t4f`VPQHRA z173=_$jiPj)<7`iv*yyDe6~$-H7T|C zGcTB0BQ00nHiPLV$R(V23UVp5!Dx!O`zOQ3ok03<F5XOx+Dy9waOZfjYFzx0!Nw}2D_~53V zYvF!9FoU_u1H(VTl?KlhZH4BBtCU@2*cVmaqc7%iPOuL@R9UtjC z#@qAa-|3i$=A(%aTkwU%KrIpcgA zdt`&o$5nR6Qg5-hJxTF>1FP0v20ky1MZSGGUix(ZOd&tEalzs=Nec`3bfI{iC{!)3 zX9&gDbxm^|)W5>85mv(LClW3$=s9~ap_sCNh1q*5&iPj)0ded-73cn+NJZWMiB#18 zpGd{z{}ZV=0$Z6*96h$Uw9-Gj;f&(*{y^g?tl+~sxG~9npgC6G7%?8k%nRm0Od1Ry z$w4mnf#z_F@wmE;3m?2eF86`PQv~Eb(7a%{_;?L+xeqj3Eyjz>TQ+2W405>-G*82i z#(kji7KitNYmm!*pz#)mooXOHD`@yc4sy8U9o=D_w1iFLGe|S>%y7IxnzX6l`eSLRNZo z1Cno3O-DPMi^qV>t$XSH?O6xj{`1t`az!T&%EYOM*##WN_aAaoV?!7$>l}Meb(p39@NsBg%ax7o z*(Tcu?mtYPo0wgI7TM6Spk+Z*7nIJlUKU>U=|7^Lo_4JAb>lG7h7QVtd}fmhGlZI! zZ#AZ^xJP$e+4VRRdJooMf@~4i1y1vw*O}$6sIs!6BDc=L&tw=k@P!~@I+cGWV4Twa zK9_ZlkhWiro76J=4>P=Q5SI7!alu_o#0|p3XgD88Fcw!H)D3bF{Eh);yuoo?lJLrd zyH|)i7nnI|IPdc-05HTQfJugNrNQ+O;_d+EkuYw&InIQE!4UThFmI*d(szsf37A~7 zj$rd)&K{A#On83n!9HB6hv7fttwLDT3`}Ej<>n{@b(RmImjXlmDm1p7%Yykm8y>d- z!!-vQ&KPtZ#vDH;t`LPmL^Cl>x{%Ws7(V9&R}x%r7!7ysI%?;H1;(atTu=)w=Lt)I z*=}%r=IVM)P%AKT1Cgi>CJe^nih}K>5`L?IdBNb=3@bD2{^2wCBZC1cMt7wIcUke% z*C0%U#&a?R!+c2kip;?~;)*iB|GB_i7Q*>OAqb_Y19v<5jmBFTSWjZSw*mKy&j=4y z5qUF1c;R?CM-A_uV!UA-tN)K#hWFuE{NZe+^-)9~`-a|H)Ts zlP?-wKhOAd{Xnw~_59>7-yx_sB?fA_c}woE&Z{ZfQ@6V1;dt`R>g31bEAac_U7P$x zJT)~B>VB}G=e%wdP6WK($B|f!i0V@{k-Fr&q8!LXlxVJ_Z_od#qAHc z&JpS`jPNZ&9Sv%pP$z+6=%yq1t8dx+v$=FR6|0u<{N?--U7NaSB$jC3d}0D_T%Eor49~>(tb=Z- z?X{`uk*JlLowX=XZ$&hoIxkX}s@YYyx?U?%lKMOtt4@5UYR@zEO@Bj6@q(mcsSUNM znT%|Gz1Mt_ZyLQxwbVexX8ADqZN;+Uy;={TW?*q??O}mb;%tP zzsC}8E`7r@`LI2EL3s_yWJKH1vW>F?jVMzfR|W!+5jpPZ%rfn|@1ElT($>ed?K!Zy zk@InF6pB|J#n^guD7hL`tN4B$*EXTH;CiW0f5i1Np$4FNvT{4z-nz1~o_A zE&!#ilxlG_wo5_jcyzDzeE<~a9#EzQO55-b>$?+Fz4-0|#n)QQ12Af7Z0BJ=i>}K< z{}{Aw)sL!M&HtKRrgXK9EZbP9n^w*d{$p_M6zWGB9R(P6NQT7I$9{I zK0&TNceD3YWE(w0$z(WsPKDK70bN2B;yObpN@HCvRMn(OH8W;3RM*UyG`)7}%-SiF z!SdhVlEVOXy8wrm=w}unlQ&C{!*OMEj7F-?n;D-ny>{jW4YiZcn$n;tgAdd){5Ll* zR7rTFaIF^VxSrT4F{rDO%?qc4(8YxaR(NEgAh=`TkP}DGD=sacSao*S<^I<{mdoe8 z5bQ0yvH=DcG2KG2Cu8asf=ih+7`z9CxZFbU1dEBuWIGZm%n_!Lq&}sw-9m7g#duux z#$}Mi#km;ze@L&@42$u&IM~s!xjMOON@Kf)U=BqzZXvjiLBs3=>$oV5?G}QkTZ|Xi zPUEs~fQ$KZ3&DT07>~H<6!OOe~@SY%wnEr;s|u9Ulr;Cy%?;Ed;-AF&-Bm4>X)(=R`T267uJ5mCJM? z*i)qgM_@cIPrfa<5Ip*>Sf^VEZZshahU}4pjZ1JL`1Iqt?r{sjp2jS<5bQ1M3_}P` z()y{>_TTCx^}i(HLlF!y0og~kcBdOGcIAqHQ%QYF2^%I^K+rPWVVwAC>ZF7z3+|-w zclt0|oVOVlmUm7xhAZ7E$Lyr=Z-)zwU;-)RXzJuF=XKnEk4oW-9CMK{iGmYN;j`)x z;YV$kLdr2aDf}%yOi+&bFyZnZK!a-QH>(uB#8s?pf(fMXaN%N)ruqHr1K(9Ce7~f% zU;j-!_O=&k@^V@Qj!k4&8l}j)It|Ns@W^$k? z;i^*j!d0eRf)R3yX@^`obTYV4cV2s`E+(dbS|HoghKsb;yQeSExtvJS7{%ia&@!=-uAQrFYJV!9wG?UO?`LHIGj zFH-CgEmxvfw6{mHRbz)QA~@&pN^~5f3(kChu(xd1on0zfDjy`AWa?~Hfrq0O=lLa1 zGZ(P$qeq4k&LE4Lt%AC?;>Lay)@4kH$sZf=-ux-0x;KBy!tTvq_|soN^wW_r_wR}P zqto~p;G*dO4@_jMYJ3yRUol#QDWz0D667yR5JI7+LGF$1f`6%}!5 z!x|3p<-m9kD8hAp-y9Zfki6r>dq(hk6+X2@erm$< zc>9&dmvj_c3`Z#?B*+@JDeg!U$M`r_V7Uf2i!cN)gj>hm*_ zHGW9i91DjkB^q(+Q2&BCK15(+kQ3I>^hKPIhH=1oHO1rg8LL;-Q|qVI#nW6nzPzkd zefdo0>om?v!QZ*2*!_LoIHmo4F3;qUM$rF4?R$sxc?pnba%pg{0+n4rhep6C&Ky&3 ze5gI_0d%}g=53ixR&XWb&C9C-U&Y_czaquK)jtqUkY%|}#`M4L{xZq}wi%_ulVSOx@gCY!N#PvjX<*)A zKrko6YJTO`UN}~+(q?MimK0R38yoyIFN>kKhH#kEtQ#9T$(Z5Y9>Pg@#p8=?1R#jJ zHxn+XAXt>uKM35D2FrFO@fMek_lL)J^h_wcz+5VIW-`D|`ATrqCaVnULZF@{YT=F*3`#tv7St5IRXbroRsL-ormP-yxr z;6NO4pkMZ~>7}ifpVw3S)@uZbT!vAPV`l1-=V%fT>39DNS_F%>)=!8c%%>6N%R6p{ zQ@x}%uF=s8(G7mHJ~^Z|IiL=8fKskaZuQE54D<%lw@OID)5DiQhS zy3}yyX^`Zpx1G%i$;n?n0F8@HFp|Ig?`sR=X~!!6N+d(rSn?^$SQxPL2u z`9`p4DJ_4T+@<2mr6=S10kTt*iVv?&#)q>Saf>it-f@m}CkZ8Sv|tklrQ^2tb+Qoi zyq0IG$=B|4{p}vQ2kWKjCx)OY)K17@n>%-P38YK5)+Gxw9qvIBvWa zY!mKv#{?4Yx}qffWhMX#e^wK|9tnRQMOBwP*mMfEyVUT#ry7GqsDt#M>gOfZ+Cl=E z#}+Y^-;T4P}EqP znpRMiszTFS#~ic#Tvx5wm-VAvbwF*!Tu_xiq?VUxU1}DXo@duV z|9-2sqF6_Z5g45ItHUW%7;J!HV`gVNrvNcEn6sjg4=C&`NS%fFw-y#X@ym5D-nz*e}W9;L#SlMx<$wI zy$+UYjy{viu{*I`ffBtS7XCDGPJH#bd3_JXlb00apT91D$iPi!$%EtXTh?zsD!w{* zL*H<9k8e7QAHpKWANv~P$wEl1#FHONfZlm#F*#xD;tjRHo&lRHf(=To!+oB(nN5sN z`)52=#Eq5n;>lmdQx_KY9UMA@EmcPEvr+0MyPn((vO5%cJ+AL<|KkxNR><)ze~wqI zTlhG2n?94*_ajfVMU{u1g(QWOsv>8BDyd5q)guk zN@Kp%$D6(?oLmlIS^|gGB7quG?@#*%A(9*f&C-TU++K=S(u)TY+JlTbBc%LX`tZz; zr-rgA{*|q|it`gFL#@b5>@-b8o%V}Qh*N4Q@j>6OteRE{cL)cr10)=1=S4stxq$YG zSH$xYf66}!P0b5>f&}xYzBhxxNP|A|?_1aZam2FU?6NI7xjCL1j3}OEu$IHGUKomD zmz|CwWlyBH;_*?aGHu7m#%zlDCD-qf4<<$HcE zFkzzitv-VNGrn5*q&mMK4tV6nQ|M7=$I!E&uXpMww4Zo>HJ)7i;xV8bjI}~iQwlwz zTnX>UzCBX*y$_fI_mua>_Z){fBd)OdYN17PG^k40+(;R&TG+g*ZyhKt?3tjnu)k=1 z8$oGdw}N7ZawFZiP7rDluH`~4vu+Q8;%icFgljh%-a1Qdw$w|YG`u%JXy&PM^0td(41FT8KZmHkM>Om?wX4sH;Y>)_ zSrB!rLc4etQpb6WF28zxogVziNd+2;HoDs6WE93UBKgFICg!@Nq_#deYgAS0lFC3% zP2JZ%~G zgVN{1iuplIf>`*|{N+DH(6y^4=k?uh222&^E_$nI&yIWGSM=77Z{e>l zc}0PL?pC`x_nE!}yxE#+;NXl+PxAF5Ick7M^?*{} zt1Yzx6l*0nvI>-@k9)zDdeBl&SZXsUO~Ff`H0Q5@(s5~ z4F{zo8ImEUk`I+E4AaeYMk8a(C-@hwk$0&y7Y1GaxjLXdZL_%uHz&%aYMS>J+&{}n zmJUF6X`E!Kr*wdWP)?K!*EEma{rom3S$d-3`a;C}Ky{9B83-)286qx5ci}JJ{fhfQ zHPvD~uD48@1_{@zyux;lm{{ySP`zt09@k|i92Ra)bTzJY_{FV9z2rVnU2ZWR*Y(DQ zE9*H?)*l^4OnI);eW3Crp!SJ)Tu++V_Z6<$xYDdSa{2Gv2dbwn#^dtNx8(b7PLy4l zX70zgjdPNv-!WWHvUIU=;WRua%I-o_vHcRP${Vl9wHD*W6%&+qV(JaJBY)3f9~V2x z(&H`0<2v4i!w#Jj{VT4VhORGgOc zJAaKj$x?P@nxU}Tyu0OIbK|(^=p;)yWujq@mCHM4l_eMCa+0OqM@PYsT?Tjl9|Ws9 zMore?;!$%6fDw#PQRBslU`|xyk3NxH5jCPUVdAIl<5XmeDcw+#=o96;9EejzG<}(8#O=;>C(i9vF;3vz5ww|6|Y$SHrp{h`m~CiiThP@|(}9x+CUv(Z+K|l|Elt!#V7zKO;M&;Uc2!Ge|GJjOEBf)O zZfS2xr1^!kGKPyn64!4j_{7cp<)=BC*VfV8FDFiP&EO{mKmE*x`r66$RkQa3m^!^? z)?U0PVbmvE-n)K8gJlO=2~;ha@Fxq2_&lf_>p(I6w5 ztp>)T!qRd29h_giIgCdly@y94TvDO&PaxDK{rb6l^)4D;R_2R}t41HeK4`|FQ{X3G zMT>&xZ;pX`2j&sCb1nhH;YD%9l&16A<`8Oajjm;FN@1| zRpwvEXA9nZ65x*GWU@F;Cfl>k3;Sb+dDzn37vMiJap`W}=da*ufQR^mJ|`{R{SWbZ zAIVjp|9@SV?*1l9vA6KQn`$oJ9)moyspZN$&QU^fs;F+Qpkm_2wH9@|0o2jr_AsvG z&y@%0u|jRZb)-;y>pM;;HiP4Z`VFop2(=y8Q9^xy>xn{rgzHH{eT*w7TBv-~)@Y$v zZ|tqPk-?zG2sIScSfPf4;tV1;awI7B(A>yKQ0xo25xy~w6RHqYiBM&r^iAtDP#hz2 zBWHr*+Ei}Dy+uxjTZOpI1a+!V+yumTquj_GP^SsSY2fKXwS$@{6t$P>d*VV+mE!gl zP*p;$0(GWPH-nla6yHUwh2nZnjZob0dX`Y!E^)R{d@GF$rQZ|W?)-gNv=J;_42D1g zx99KRy(q0TTlH&kpDQ(&CzO8T@qPNkQiu(uG`U^^#2QoLM0}nqkna{rZnD-d)komS zz%LVuvr#do0c%FNv#<-FI7f$*#1xJI@6vRQD=z`9IT@>NL{K4Gr>4xFlzo8X#! zT9e8Tn|uZ1$}RX?86Fm&ba5#;h;BL6$%*mQekPE_Twh_#!ornT7`wc}n9lsJK5v&P zjlOYJa&#XLB3v;YiQ6#)7bKxN`J0;LE)(oEUoknssJ2H+u245}i!J~gB8sr@x6_f{ zb76C3w{x9PD{!qB>g%{_+1>*xPu!lvRm+w=O?ma3nNLlFceGzk@}>IZGblEEsIE>e z=!&N*Wc3&eLz)vwa&>aYvUl^B?fydkb(pVX0On+$!}Rs>=*t+~vG{ye(OXq(zY5o? zzx|>hfBAc$b__wA{TVD8XMS=lh`v~L@?9th@HXDpCZ9nw>z&&-ixu`NkjV`}1Y2PR zU@P8QcpA=h^p*&{YN3l4n8XBp{)&x^oL{h+rkn8JHyZ`sJ4Ev0DV}%)?#N}G`ACX* zI^)TSeTO42lNpn3GYN=ZXqS)}`r4}2_JWuB>@D{8+}HTk0N7po6DIbK>?>j_<{6H} zi$KQVKDh5tE$9go@ln_msQDa&_997@1$KT2b&4W{r)UpDc&_hP9Fnwxr-3>IHdoFH zn=I5%a8>GgP*cS16q zR@ipfF4zPtcWEt#T>`rtb|vg8*qdNqK-g>We>?15u=m2=2m2uG!?2ISu7!OPb{*_S z*v+t)!X6L%HP|;`--g`=`yT9e*!N*~!hQt13-(i3&NXvk^I!+Va!>FuST6Z-r6LA9 z5_S~qXjpDYpz`r@*wbJuVXI-|uywFgVQ0c}Ds~Yp!)S(Wg>8rJg5^YOA?#wy$SYK*fp@X!`=mZFYJA=55hhS`zY*M*e7Av!ES`z4EqA?7T8x|-++A^b{p(_ zu-jqZhusPL5$rD5PhrtOBe}47u!CU>V28mDhaCYMgB=Mw3U)MXA#4dOj**L;23rYR z4I788gPjUH6LvQ2MX+;Vn_*jF+hMz46R@0;E{0tKyBu~U>?+usU~h$81A9B{U9k7U z-Us_2?8C5+!mfpV5_TQzM%c};FTiereHHc%*tcP~!M+E(9rk_LovtMIQz6$H_bMN7vAFJMn-3j{< z>@L_(VIydFxv+V#gJBC`hrteq9RVAI9SJ)Mb~J1uYzgcEu&2RR!cK&Z!`8u0g`EjI z8}=gDIk3&Jt+4H|U9bt*g|LfZm%uKET?xAi_9oa{Vb{Rk4tp2uy|DMeJ_!3T?4z)B zzZA*mRFwH<8E`qD{q>(w2B#t%j%74_CDKzEmEvPqDZUmfRbZ)Mmg1|G`i`(v%u*vQ zHOf+)7%NAir8v5(Te+n;K~=X(OI2GcZYfSD6vq)>DUSL|@wGsyi!3$AQq7iXwN$&M zx-6Bj)Iv)ww$u_!Ew|K4ORcihO_sXVQfn-AyQS{3)V-Fv&r%Os>S0SgYN@rBdeTzs zEVa>6n=SQ%rM6h=RZG2Lskbe)%~J1KYP+T0x71EcePpR!mip9E5wtS0Sg zYN@rBdeTzsEVa>6n=SQ%rM6h=RZG2Lskbe)%~J1KYP+T0x71EcePpR!mip9E5sb5@ z{aGr{QiCm3V5wo2;xj~fM_4LmDLz%yca)_@TdL4fC6+3;)M=Kgv{bdF;+Cqj)Kp8& zwA5@%U1X^_mTIr+H9#8EVac_uUhI2OTBHWZI*h^Qrj){zNL0r>LW|- zvec)RieO%7+MlKJEH&6t1(q6Sso|CyVX2sg zsJ3Z1ZK-XRde2hZE%m;o zc3SEqOYO4MrqQnM{}k)`HXs@YPlmTI?Dm!%SxT4<@omRe$|<(67$sa2M`$x^pk zYK^6Cx71yhy4Ov!!0J)D}yc|s1(u?Z`uabx;c<*F?YLN@H~-92+JDbs76zF@T%4K zSYk9ziYIE=8D&nigICz{QC~g5N%0J_7^a8j9VQrv0$W?IJ_(zqti=KV(qi)J5KciQP|U%l<; zPSWQwi}BKPu*uiH!ezW8A5FXLGP*=ENLbMIYQsfZOXGEq)w+Dm)S$zROT(O(=5m7u zM8qowy4;hN(|6QE7?q5t#ns{k zYr|QchWS}qdiX@~jE3x2@S!e)(l8}ydH-3O%l>IDKTgZVFVb>)Wg1s;TAKfm#?_LR zLQi6ddDCcbNvroSriH^dSkEX|B8{ui^c3P0!#4}hs7ps$nn$L^<>^)=r*dub024V+>N03;fX}%>8GF3GNHINZLEiLa$lv%=3 za&jQ9Gyh&Fll|iIO;Eq@c9Ph$NW{qorY)u0q%D_jB5a|*0WI&pOTcFem$!SC? zGJ$vu2u_&U8w6*Lv^9MOrYX_T)!ow6(w%7NY04N85PS0us1r*sEx)QTdE}2Y1qB(W zhMq)YM{{F$GpnVgqX&XqnR051V?kqA7b+$0|m4O1q~m@4Yex)P0Z+gql$ z^mHM}mP{4^=r=tgLVY=cN7YIEK^Dz8LVAO@KseQh1k zYuVP!h6#`&4j z(fx5ceuHaZ?6V%Yv z(%shS$$>IO?&;Fd(bg>L6+7o%T1?vK4aI)JhJk?=dX3($dKR5Y%*aGdy3x^lEUu~!_8^Nr23+yC%e&g{T`6et4=Xw%vaapN2n9ENP-a-3A!2JMq zV6cK47gVVDEx4EC9rhKz$HLh36$N!3ana%rz%1kn1Pte)8s2z+vB<8+`+>Q6h`?l9 zhv3SC=UX$peTPOO--4yF;T07XQeMw9%;ql*#&gsB2Fs7L={JF^KTuJ&{S_Bdz|We4 z;Bh`M?OZ#7aq*T06h4lC-?t4$fVfD!MWv-ho&)}gdmR^NPtS0H$+i%|Rg4QXXnra@;ZR8U9;P_k z?n{H=%|yj70_K;@5DeiOZ&@H-G^xnTvZs(JHHr>^_N9pJu7!BQAzTX03C0V!ox zZBq=(N3b-u-ik^}{pCX3mtzPImd4^rg9pzO_pMkY@nAUE0KYGEQU4%OJi|G zg@FUq7~XGVk;q?RX&kQ9-%O?a_r$QN=V*aB-1u?+<|4SmfjK1&R~jg1*86ya(GVl1 zKD;~qC$1(FF4#S!9nHvuD;gIlXNK398CUKfV2JC?fD22FM}fOKgp>2mDuU;`@sV&% z2xoP8&2kc|(6llVTAt#N(i>t_ctK%E^2I${%#PJdRO;1;oU#cmg>`yR4fFnB9?nqq zyEwjQn}}*&yn$<(kW&ju#inh$rl?|KTHs8hBt%lzB~ITCe#jD@mB+iW-ks?2IGSh9 zFI!jmID3${wHK&;Hl0<@X!}m`BnThpSpCEv47R~jguD&@Rxt`hYS~S%h0PT~YL2O%1J1t~+@^V!*{4u=9OD z;^3ln+yURaGoGr2vWe+=rmzEd#RzGogjR`bQm9aoQenWjFtd~+jna8e!BbRaf*Z(vyG3dgzU@XDMmHp8}v3yyU~vzoCaRQN0lNrIhW70)bwTg#mfMqBO`@gy{(oR5CFm1;Sl zuW!?yt^C`CmbfUM?1DTu8W*IHjkqtOJOL`E`sVMYrX=*fNuPya8B=6^UE)A*#M)Pe ztG*nsdYtGt`t;FA_)W06vLWHCLY-^f8bE1}zZKNY;`{HoYP0xHOASC}`06cK#E__$ z^Y}8f&@m_kO3MGbHn|Im4JD6|%$}SY$i`K|#)XoctjE~(o#JI4QqTJ#?hM0LA98Kr z;So%P-H~JVNX-*BPw-BU9n-e>CERQ7IBsdHq>n#$K7sb7@5cvVgf-_5)}>CYU-AF) zmviyCF3GI~$ycZ>>%2gC-XPiD zmxDI$r3kMAp%h_r!)@!35NM=ZzP`7cC*PUMxn@pH(R+2P|D8GNi-nX*Rqfemp;Z+d zuP)&oHX&%&NTEkOn|P}(H7!Q{Xy-fNNH84~A4Iv4M{#A7&W&uqRh#`* zP>OpGl;ZvYO1sA>#HUmRDCJlT>NX&9BVPygHKEK{x%B-}zJ`GzCVAT$V3vK%3jTON z?|jtY9Mm9-5!E)8e@VEkUNHxxRPbHSdnba1_g(NF4sWOiLver8^tjvDKbG|mjGuRL(*}9E)_KsZX6gZUCs>L$=lW;jp&z& z<7IY^ZrXb$dMLZ#W~N>`D{fb>VEOeOlF_fGOFJgR+727RXvA19-Y_3G+VjrSXJasW zJS(8v(Iw&}FA@1GUSTl*n}m3}cCbTf&3ZKG{9B*SdoF(kpL3h|{*TRS&m=eWonTag z#j)Kkp1O^hmMoxu)b&kvY6Gd|XSeuNY`D4%wAmY#%A2ry9hiELS+;vX;_+p>qrJn@ z!|Ki5GqCT;YB`OTCBtzVgH$gVwRj!`rIYw)KwCe%17*Ku717>- zoP+ul1yVzy`VC0)3yc@33hs(KQ${=}c+$LKSm-Un;PeCw$amat;xLSVsR$=0hjTzU z3Y+uH;wkKV-fP%l9zH^d54hfFUI^gAH-jW7D!-sT>5SDMD*#bsYarOoj4 zV!o;9NHzx4EmB5j;yOVnj*9v^%4deQAKvQ|g=ifQzYj`7c^s66vdOx=Y2CJg(z;>R zQ?R)aK9SC{<@^OghJf'hF6mmKFW2 z=&gP$+zUHYvFR0h3W`HJ!em>p7l6`^&2u;0P+IYS0HvX@8Z;CRi0Z~^mb!69ttmLcQruOlO+YI?pcYnNDWzyJEz4gnW7>w) zpgo&W!}-@egxI_qg#x?PtM%TDqnMhfA`=GnUd1uy7&eJQPI37PN*8w^!LnANL-wh- z(}B7Ul$LipsFkp}GMMXt{yp4(UEChWb&XK$Xv+H$DCM~&IBXy?++t^*9`f@?QxV99jVr`ktC#qPDKX+Skz@sv6V2r5l-_ zz$=OiOpomL;PGV>A_;Fci|k|?*mL5kyiGDoVR>M#z!$?UO1AQ?urB!%mNDKKHsenc zEA8@G+*Ktv##0PI^H8xde>JCoh^p^EyvzmtuAZ&;-V5Eb@@Q`j4_3#VLHIFNyCsd@ zlj>7799U4CT9yyhr>>?$UGn2#dEQo!M{seSdHAA$Pp(T&GzEIRD;uw%xoEfJ5$s}T zG6z=uocH~XK0A^CjzgZl0h=od4s?v^!M#2VZU@E5aISm^)B*j+xL+!6zra=d|I47% z_f6}&%eqBS{OX$rN_qJKNXHYZhS2eZ?|0gBt^}p6pE7PreGioO1Ik}=EX$R1F`33( z*(<3j{RezC^}{gcYrG>sEfrh^D2?}AP#Ui{2gaJTnFNQQSC}y6FK4Sj@AAr%pR59l z74g)>;9@ivsPmVzM7-G(?r-3sKSggj?bddpSex9G;l1)|bl zQS4Cm)kCFe^$q2?XHUBjH;hZZsmEgf)O7I;JHCSy**B}eg3%=Scxx{^Sco31zt^wN z^6xv*ELZ3=oMWsedLK)A)0nh}pjXfXk&a+N%NQ*C@I^txNC31>%Rp(JR)QJ=n=2|j zmI-wMuG*Ha0HtkdC8%q~_lLM@yIBuPpNTJk(r4nYK`HMSP=6dZRjG+m=UBJ7ptQ|V z4UhJYUQkPggUcd^3AG%QJ||a$($wDxD%2vEtv5<#4gl93!f9J;z>nG$e3SoFZGo;d zknc{PpHov(tBdk$5h=9jLQTnr13}&8!%{`MKb*Vw;&;zp{Mg?7X{##m-Zc?Ja@ug; z9S$(?-6f|XRW`q=D%?f#h8%W7^v0-P;DR~$yru0w$VDVD{L6`+fh%Jjboy)9R6vU6 zBa4X{`PTz;)Q4k5PV{8GiR`{^Y?qUyKh$D8u2zF%!_SF6fNLJ?-;?`%;3VlgEXL!y z72_GrAlRH}HLi3x@R0kiaFX;?Q$#Z;5))AgsQY2kU>HMAbQP}qz>ao|VgAaL4_A|NqUZ4nyZ&2E4Nf2Ce^`tc7kB>9 z><60@t-_UY{l4ggmz_S$zgdjOwb0~ruy9eVgE^dC_u=oIKFn(@#^XB0ROSA{bq}tr zgI~=Y{E^d#InH7{u6>LP`&v$vA|Fia^!LgRb^0(p>Fom|9@lw>D_^+yJY#a^fBO!| zff%pI7cIu)dK4I%0@$1=$1qk-Vfpu;clt1&fD285jq6J$9FB-N(e1dhT;5zZ=yy&Z z=2DA^d2Pd#>QLeG;>y42r9U}+n1vSOrErR=L5?QwgzGs4M;+z#VV-9(9v9O@GYmE- zn!uIG`LJ}#V5blB1Gvx(v-x^a9aPt4lyeG}#=al?<9(+O^Hq!S@->!~3Ue?lbcza% z4`G*%Sm{n$FSQsih55z>(jGpp>VdD9x|7xqvKWtx%ilD^VRNF_<4VY%4%z&T|Btyh z0gS4;{>R^tQ35W53IZ-TNI+DCBy0h<49Q@k0V0b##t?!;Az(65u(FxZG9AIC+G=ZC z+G^|8)^3W}T5v?>D(#lLBtC#GnIf=e^uUE>#fn1TpJ zQd7!bFQg7Oud2# z#a8I+?`EENu->#z>iLewa{b!)ezb70meHJZ{@*+GrgeV3>}V_($9pux@DxOTfUiM- zj`_{n>-DB}+Wo}QSgzlhR_hqyVoH$Y%-d!UJjT_pHyn-S`i{ZGbGYJ;>xYiUa@p%` zhljYnc6;Zm!yVTIlN!T4%Vlp-KUTQ-W(fPxF@oR+RDswc} zuiHRPQ-r4g`fSxNhOo$SahyO?orGX{d(VEMhO>7F3nx7L#`X; zxIT0=mdgZL)YBD2EZ1A3cHMQH<6_T2bDRrdT)v_21iwDlfMXB1cC_PSIA}&Yt}{&z z9uKU~wd1CHu07sy)jAp*!X|?`A;eYo`PREma9qnA4Y`71IPCokA`!f;IZ?RALf+QL zfJQ!cnOZppUj-5N=``oYmL5)wm*+%TuCCpN9Id%3&MgkeOEaOu_(harX8R-tv%$p6 zr>QnM=wql|*BS-4TXNjFEC;hD2lMlsRDC8C zce?zg9L%9PT$ksBXJC$BoS9go4xDBBIAVLe=9Z$>md#rL4qvptZqD3Uvy-Ay`ASHH zFIt&vM`7(;yIIrDOjgY0c?1#at~)0=yL$Thb+w7vi5Y^;@gqMel{rJiy)~8V@yA&4 zcn=T27$y-QhqOA+uQV-OQP+T@RRRA^SZM=^b8|=_NT7*OG50)?Oz#a1JnO+N<5^21 z&U!Uo+1LY>`p9T#uzL(miNv!t*B;qYVwm&W7WZsxVhXogmbB){Kc@VmCH0r)aoD#? z&Yq3acsTUd(t_hkf#eRQCJqP4iHlqUMt;e%WtX=tH+I2XWObE#Ymap3fi#P)m|Y_^ zT1aLlW+de+CkzN|N!{}Lminc+-Xr~rbM0zo%{psdZCyjk-JUF7_}RrXI@)lfNn5hS ztC)R$?c7;)8kvU6?YA7V5!O(}VCpSwT%KB-8=kyY*@bCoeX3!xCJd86Kf`Lo#Zy|g zEypRVMY$dsywC;VoPaKGYgxXmwK3NP1~reR2`t+ScRr^Ms^1$f*CT$ZrlpMjAQ*gQXRLi|Q*d~ot8oQSJ=NQ?LuV{15G{2iXlb0FyFJneEe$;bpO3-M zzv4Puih{Aow%1(CE;c0|?g*b)5)YV9I?pp@%B0Ck&htDR&_V7Vvn?(F(numG*yH=( za-L`Wr13!yIbpv8-RF-?r_14^$nS@wz;#0OQ_%d%(6Or)x=AIIgYI$Sv>P-ZX48em z_ho{02u7Ww%*fNZH?eF=wtG`SGb@{J!laTQT{k`&K(m0WFfd#o(enyZiUna_aYXPr z(7eq#C=AIp9#gos>&(5NE5~f0iw?nXu|es==OpF;e>c`T{)g)wFdW|q-T1IJ_op!w zD#Cp9uUuDwnTSW|CWi0yrotwAb{`WGhKn~sS30Fk5azWQztgb3a1YlQU^vn$A5dOC zu4F=~Ak6C${5}Pm(Ogx4VYZYHsLj#(&R{JxG^C>u`Tf$#A@`V=DbU?vXc=7fw&&S^U4BVcq zCk?QBy8aH}Va@tyx3}B&-hi$1t!#p2G2e+tdzX2(y&D+;!NZ8KdC3mL_DBxga!R2mo;3ruTH;T-M*tRS@IWm*5=QKbw^F+lETCm z_Gb`<37)%xaLB~Omco1%vGsQXEli2E*Ax|cI8D$tr1J(KadGh$cA~`hgU5SP4_8MX zuSqxV#tp^;P+Q&(2Ym-+YATE32qkXu)I%LT`p!UqQ#@U9T(c87Z%kT$b_0;KM7 zx28krh5%x5ih3skVwH}1Qvt0Ls1?v>1iBiKhU!{C+G3^wsmm0-3bdj@;nqqyNkgHp zOn-B3uO|IyBK@}J1|)C|7J^0=YxnzAz&?%uFaZ!myhjK$3GZrw5)LPAN_P34fh#H~ zTZVID&zP)TJ*+03DvF!TaK7)ezS~@e8Mpxrh=Dli*`*FSw3H? z#a3ogY$YRv%& z{Otuzv==n{_kyOd7c~8QL33a)Xb#R#6UuGIe?We^P#PWD3z~twpgFu3G(&npb3`v_ zj_L)?usk#@KY#omT)-2q8ALxzbo=AsCh%C)uyuI!zNs34*bmMUs1olD0?|h4>H%FW zxW#xc6o?I6TA)pM&lBi#cz;$P4hWR@`+%+$+)weIEznN9)wf>&Qs24&ohP<$I-W!R~J@iuEK+X1>_F5mV<9M9tf_%| z;kfHdRmbm>v0?R;r()}$6*>sbYSWkAE>;l3Tu=F$>TVp4-P3tJi85C}2K?&6_SJ=6 z>QDrrWS97k9%chYb=ub`eqR88B=9v2XT-(L%9E$ZW7pS-Q?rItWzHEQ{GAD4s?$4b z&^=T`j5qc`qyy5N?9*r9oPBlX?80QGU-HDl*rr2>YuH{BdGwUAu?|Y2iNkBJ?#AbP zNQuq}aB>tpa{&U&b40C$Tc_HD!YOE-GvJb{4vsL_u8E9`t^b)oeE>ZQsH%NO0h80` z!U*?pV#Yal5a*6vCDm7=+jR^kKS#=C z=R75$w(0Hbw~1}6Qtm?2(U?eW3K~Ia`%?{q5(q@s)A*7+Ks;;UF$5 zmmy^YVvD5EWlQiZA2SDm3(sgYAgiV0fiKjE~}Ev#(;-%sF#sC#q-8og}wc@Klh*6HvL=*xEYv6r@79y`@dfO-msXfqRVQ z*M(qC+XCLi+v-B%5J$&P96Mq1sW(P$ikyZ}k3eds5LtHH?DEzybzzF|sK#uC7+-}B zbP&@-aRVI`++?9sY&m_SA3=p_Oy@9-rhHIY8VgdG#xGiz8~39^!$yvXZNs{b@@06h za5QmGUFYD2hD(tJ5w>~6zqjpYd-oH5e8@0`zx#QXt4Wz>(O9mZn_%=4E^g2qfamnND|!psbnD(Apbdd_NR$L8KUOCdS!2Kl>eD&UbKtMw4n8XlR&|1(9;RnLDet zeePgi&X-LojnITb$X1{r!Z6TWf56=zs+=!FIJQKwLL=a>6=CFjZ3urjr(%pR=lfp) zny}>E;jk%)u*A}=Z+UKs%K3_4rHU1rPzbp*RuEzBpc%Mk*CLhk6|V7$6`Bwi%Yg6K zyel@2P&r@WVt)c7G$Ago_WOQ4_~D2*RL)npSbSlGCd73Fumus;Kbqw1dGD#5uW(IL ztk8tGxcnKGLsU6m;bJ!hBQzl{E@2l$n8P%&2a3L_a=yaFz7j@gLR=i86hySVV1lyy ztq)YrSGYLqgb|t$*DzpxzgGXL-*;8cSGbJ+LZJz99V1*!Tbj>b@W+=_&R4m#NC{1d zD-PO%2x}zGxpUsAiA(#eTv|BdunE`q;l#LjEiF6hP?hslE-f5F6Y}fW5ZB7z-91v} ze3eTJhtPz$MhMp+ylEc(-1uWv&R4m#a0pF^s|d6O_DTkC^M~`ss+_NKY2gr>5Z6fI zvL)(?bEj+>8AuH+96}S~8WrLy+I#-RD(95EqB>DpL%=`~AJ!pHewr<n>$RmzsZ$N~#wrQMImS3!im56zc{Jo9H_ygX90#E#+17%jV} z*&+~9Xykdl)hYZQFce&V-}H?4XWMetfJ5>m7&=v;2G-!`Vd47szkacMBfCd}W<@trFI z)`-hX8k_C6b=eJ{V4*MLArpjaSsAAUCSk*__7K4<}Tqx2%Lx z<~GQhT4He%x|S(^+Ji4mDUAc>F3B^Jvk{jtH@*;c9?Omox@SL_jDn$Nzwx%`96c#LCat#9-hB8v)O3nDx;Mo}+pO3C&awvQOXM7McAUXTT>)yN-1Xits(dm$xYFEW% z0~M-?R9*tBs%-~V8buZOpc+={RqPrC(TUAlYvB?!t0d%P`EL5lMZ!)bLDj}po2`?& zpjVw%?GPp1q}c(Qtz2z_rDOa)kTsc46~;zO;>C_nzRknwnOV{HcaBUy+WvY$Kd4ap z9Jp#4wuyqjBou2v;p4{n@Jx5P-7f-rfvC)D8yph0pdJJ(m=WtZ9bU#BNDiKXg=vTq zyiqW%U*(+$lsYye{U%f3nf6tfPaa7vJ#B;9R~33~F-VCpx>Y-p(mx=W3Es)7wk7VR`qKZAizXZF*F9??8IQ)?bR{(w`#bDE`nbsx?@qLYv_n=5Sbv zbxyolTcV;xiIbYBcRAie1X_bPCm&H+apQy{>fM1iCkavSLA*I>h6)C}IR%J%@8Qj1 zebnQ$kwf*UHwBR5Rsd4EwGQ_MK&(emj~fK)G7F&c?r}H{Pt}%ADL`Ee=f*=g@3`#|)bfB(0=Wh^nd<8*)8aq?$SI?3?>Q&DL_MEU6=-$OPavV2yE!XG^XhX{uL6#prHp1`v#Wq)-^wW#b50E0|{WFUfc{NA6A4} z?4#T49bP-_v_1Y}-*!hsu3)dhPQYJw*>CI134gJV2~Hz40@*2@F80|eO|)_KW`D7d z^@K)f1p2nTHOs}5aktG>?*VS1QC$e76z z9)?)r_AaipFX1qCNyBoSWYZyd_Rx+;b=t~sLSw<$#h6jxR0GFfr77Iq#fZ{+!O9d? z;Q7_Cq_MskCzMEqt58Z?n;p2M83SRtB5Q0uFXVWm__DOV73YHB7|t#>wc_Yc=nfqn zVEQgBYi?Z9)ZFO8#S2)nX>^RrkRldvdX9`&+sa%70Gg3yL+f%gwEU!z<>V<-Ci)}G zQIfQMQ4uznME*Y;S(f111DnzKm7WO|*Be_ zwnr%)U0HZUOS*ZWTa@kIl<+AB(k%zgx@@`$;oC?^mjTV~*>vMe%+e$XU`Y2(&^(w; zSAu3;DD+i?fNuxQAJ{y>9EwNMW#af?@_FX~e;b;ox3r0p8Yy(8p-Vi3ZZK9{mzq^q z)?B3v52QKXxCJ!dFmx{cCXX+Jl{2LKHfSEsrYj4dI=LNmPk_eWBIEp>l6z_*jdkRm zW-ZzITNcibi{RcbK{L**I63zwgv$%VcP?le4V`mueE8NEZVN0kGyug&y5N$QV9E@H z1FJ!I(}7Au_m!?BbQ{iM;D=#<23ne2ibH}!q;Sw?qEdvN=6)JKRgn?38j++VP2%W3p4{bRfA#gFLb4o zLgj#TV?pzILuca=?7PX&WaF(lK|^W&Y&z!C1HGW5KM(eTj{ZK>3p!@k6TP5gdE3B^#Ww~SCfZSa)CX&?@sa$sPfIGEKT(X&-$ z&sH3<^x)u`JzLG_*{asJ3QOlcQ={Us?NdEoR3ZaDClmWlBK_iSaB@Pv>3RHCWd_@U zKIh+$5T!goCq!=7(SMDWBHA?lW87W6N-kS)^Y_(DdvI{|TsStsOF?eE$3U(whGUQj zcT?ARUdJG^!|Jhq=Nez`-dyR@^)}}ZbMQcS8s6*{qOv=?OrR>fmkV?*-scO{i1!r& zeF|?jtWgmtRNjsFR^BfIY7yJJ@K)Xj04eWNfa=8dS-h3^w}6!Q&wyIR_V0KrFNfC3 zD^tmH&V?FyM3}O1>8Egg0jH6nw1T$HgjqkqX$A^r*<&JZo^DPe#GwWLF;;;E;wRHY zLo^nUhUip48lr!d?_b^a&-u>rx?f532oQQSudN6Cl|J4oVAg9ylB@#M!Azyo5PX}A zNv$~?0JXbZusXIXa~O(M(ul1Cb7*zLlU0!ds-Hf&Dm}RiT678TS2blam$$S8+LHlL z>U|Y)y7EtV&UyCi-PMbXW@1Xm4Js{Os0wY4=Mf`Mz1WYS+bgKrV0z< zbCORdDF@UDS$*_Lpt}`XS#40JJaNq}a^FX#uTt`&#C$y`#9*=ciOPncR?*4$)+);H zYsB_ayjKad8gHe$6%fCo-ko?a7U+JwmG`HBw1WK{(B)#w<&`x8y^i-3Ge@eVZ5{b{?30e-tF*T)12Kw#B2T!`8@!> zjS?S+;C;M6alFR}G#c-50eaK^FA`by%x%_3)dPftN zi6gpbgW;+|*e`#Xbep5GT$2mvla+}K`sFW^p6X~U*G_|BF$(+T%S1lwXe`(BrdV;k zAk5{pkN;Co%;QE~Oj_=(Gd=c9$;``GKQ}%jDMc z2AlNZ)U6<*oeipM+iAOenaHCZjph0WsA)KX^tm4VZa-j5z`Te74)QG5VBxVck({%W zd9bZ!jzsDuYPBHobVoS-xJ=TO5t$YBU(8cR@tw6eyinRA1rCJ6hdnhq~1G9G!+a z3{N;-zP#gYj>h^$jn6a#@f1XuCN#gk@s^+ZdQGo&G?uHMsg;93TM*&04paY?Ll2wd z%R9y#jpdqaFoz4*V!WBm1wa1lSAD&v7Y1oyi-i%B7tC#yPbK2@E58@>^_ub^6phdb zbgRLz+wi#_d-Kk3`Fc&i8l(}fm`VAeA+FA2fAf1^uj%1I8sWObV2*HH`vLmvHMO7f z^_t!rq!F%rOsXE~xJdHr$t_3tdQHC1?3%;PiR71#|W26Vv(&3$UCyHh7p<&R~%SBgm)ab z|E##wYLTBCPae;U-!1mqpfQs8jdgt?9-CL}W&kauK{4kI+75RL%W z58-}qJX#Qtcbp_lvJV;dt4O$5E@-~4kI)nzeWP-Fu-V6>tRA+qoKXiVbNu2E(Hf-*kRZ&x*|5u%CZvn2 zth4x4mmkl;+?Rv7AqVr-9L%l|rl)N_*}yWCcOX*!PMHYWK?=@nk1YdbUGuW$hDH(d z6G_3D^J;4RuUQpylXIc*a(4C1GkmQ1RPrl|PXP;ADk*t|jL6o=>3MzEInK)7o%_@x4-OUxg zEMU{Zy5*NQt*8?>TN_)hY-(t%S=LaWa_Sia#76M%<9Na{fVu}M0nmgFiuAQY2+pLx zL4SPcnwM2jFQAFlCj`q8hxSba;(}R0t8ZvaEn5W5haVq?dPvGPUD;S+h*J=!Ec%3y zgjpDZt6Ct8n$M?Z?Ef|`Y)Y-9YCo&XFpu+j=>kPrcF1#!gvvAKL~!x4B@3}tj~(!~ zhE&tCX6#Qd?Ah~=qYh*=YLv;Sg?={sNXk0;0nV2e!E!m16|{Hx9wc?a!DP>Eh&!Yy z>`=PtHI>%aX>y5zTL0S!-1-Qu_n#Erik2nSmAwnEl0y68q%z${*Y_vwyN{n-T4YJk$L67zYLlq=^+d|)bc#q067JzFf^p2;XdWKl2SA9QyfPk z=Ya0hhL-WAzuEhl9K?Syk9*m49R7d57j&F}?Cb>{^W&9X&~c#sULLw}rC|wMk__OC zKWMCkZT7w*Bjc}w8!bn^uCusUvjlQf93*6@y?lf$yM|Eqi*y4-HVTq^XJB6=TC%6> zklkeG)<-%C0l#gjO78oqdMF40s(c^N!({6&7mw>alY4P%t}ch$%@9#>Rm_bg4#QcP z^_Jif0+r*D@DjQy`Stb(s_5-*X5Y%PGoywQMA`!9+@v%+U z3+mmf_Q#;b3QPQ_;@bRx528a{WL%fquoS$=vaK1Eu=31v`VJBF0vHZ zW(v?Gf;82ZCP;BvfT9|TvUug&jLeJyq14ODMC_h$$4YLta@!D`!^QDLW&Watk(o3_ zaA)JqWn0x=#qobscArib=ree8oE{Zr2#VvV_!PlC=%A+ose4g0Y0Rvs$7{V6;_X%n z%?C72Y!?7JO`s+~ae=rrtaacrEDx*o?9k*1TCRaGMl6ex}N#~Io)pxG^k6{SDat>|5Zf*mp4>Jz|jKDZoHzcsiiTVT(NvfQ$tfK zUb_sxE4}LG#Z3#`XM9He^5r;};zz&{TckAVV4(PL-oaV?d;88ht{EsU594F%q}i`HlLjv zjej=(EDgSj;zlf2_-y{!jwUW{Vq45$*vS+`*5FO(#Opu!$X|#4jH8L0+5cAzhGncE z!T|%rd|l(INBis0cQ_i$^)1lQ^uyzy86V$r(I|f%`a42lXar`>q|tTgazISYZHq1* z>#swb1r((*BT*2+=sGlq7BoY@-@jAWp}8`oI71^JR~yuU`1Q|>^F+444!tfw6Bd-# zb!eM2e~JtpuItdU3T1|DLK6xh*FXy*?6+z5PTu>Du0sn~sbYmD#1(@@L4-pRnzN#3 z4A*sN;bLIcK6))FyXyG!0RG|rRu?6y1hE7c^ztlf>KbE~RjL;}# z@|`8ZzvE@~yDdK=21B*H>q*R0YgpP*28}y}6|-LsrjeG$D2?50^DXEI=*N%Qy7)0J{ouWnC_(nZWX_VjfFI z6iY|AC1xxZm&V0EamG5K*y#7?8ALYOo_8l^O4Ch=33gWomGkrOIfFRGG$HC8EB8g1 z-Yw-64~C^&XQE}M(GawpySfTA*BLri0W-ri4Vh2388ko2rYqqP&^JsGZh8JLo31o` zSdnyp15IDkia3AAPqaOQIC?kUM}p>YL&wfR!dE(xBOqrM11iPr_lsr*O!stV8*KPN4@5G{1V+%f; zm!;H-kRZLmM;tw(BG@4@Aph?9(@1&(!v?RX`I8+d`tzr?hKtRCuQ_bNJ#A&a9M7j6 zjhzYIZZK>=e6Hipdf-}Lj_2!+#&YSH*2?j)A~Qq6y3LryG<`kG_1}t+%<=sS>o)tn zqp@5Ijqhv@3nF*p%_{lUS8sUFpFdsZXyRtB_JMIn=TD3A#SngTYVs0){uD7>LL>BJ z4VTWJ%JIcK;H=A+<6!}&5t`79LFZ34Z8nu2yjABf%%i^9(tNTnP@AgRIT8wtEc%B!%6etho$EP=1*qG#0nVR z#b+ntYhxPqrC;6=m_L~Tl+c9Ikg4ZO47{;!&I>BXBOx?NFEk-8&UAfEU6J!Mzg9UO z;WDEap$Tyf6fTx4n(76uuLks%O;)VX2zaj|jNURc_VFV3{_!rBe++^0&hWl$xcH-u z78M{{qZpfu#46?&mcU^i%E3IIgPECwX$oO_*dv#ryCr1L=1(wq>7q^ya+>7OG%UNl z#*L7o4M$wc-o*}VerH=@#${$$x&GPNm`o6{m6&x9Hn5@V@2vVU(H&3OrOkD^hwV@V z^h)f$)?MDXvaYSQ{?f)e=-F&qW)IZnnc(%r;D-a-ohC)O{g@LJW5=D+p6s|`nrnxB z!!mRJws-r66G|opW?`%x7=fcMoMB2ru+uZBoS%QsEG&Gkl1;>cXfco0R#TcQnZ4wh zH5~_vS&?f=pQsR0L7@k;S8a_J3#mTC%DJa^8vOE zR_7!h+5R$JkLv{;8|}966NkV4tSM)X6BlciRQ5GNLg^a( zIgU@r?!^!Wx8~Np`4lXCbwMxGq?6^`ZtRN-XmFFtklnDx1|2S=NtQ!15H=lS9iJDJ zJl9ee!_+?-vV#&#X{+ujk?LgF;gCv$rXT2DgA zQJ}(}-i-9CmTVyI_A%2T+?Ir^H|CcIwla0IuH@ya^ov#N9)AiU3hAq1ndhiK>ao*e z#fy4Z;yqQMO?c}D*EbyWBS1PQeGHIt{0fjxKmQ9*V15})()Ks?imDmu9TId&GIpNO zY47WKiEX+R6&c%`={D?b26i_=ViXu5xgTx@Usd}G+?3RDH^I!TLY#$*b=-~*qjQF; z@-wprxUa`WKYkhnGuFQm>sSjQxNrDyf(Rsg3v(k~T$9HBX{L?2Qk8zxCiVqXlCNnx z<;mD})Cko102u9VB{pV*88nn1T;b6=G zjxayms5UO4!qjn_6t2qwI65Z-wGl%uhJJ!mi-1QkT~;ms~M zvSCl5zw!DLM-w-b`R5IW8CDSCh>N3vYxXvN{X&37^Q+2Wbm1V5FXB%);{pOy{cLo*?%!pWMgkq>EQS`-MI5=+U)iL!q|71ScNNHYF8h7ZZV(g-l zVtTXjO3H8LxN}?%W=;;KEC<8B&YC`Q!+EZv;CC$nel^Uzd&e5Z*hM#D6?3U25KK=? z2}|pjJH@>3?O<1LFR%@?ne4%kyyzr&y?fOB;DX1;;R~AAx z0gJ$V-t5#OHWbJC#2sBn*YkERHGn}!SSfZ$vlcGS%i5F<-AnJMU;e$`VB~{K9N{>M zO-~!YO{J-j$g{5ZG?luIV3SdEa(989P5*Hv#a0YimLEQ84|vL?lJUAu!98HM9H@uG zJnu|_aFC5FH3shK=ijpWFuv5Z73%Bt_*sGq@DHs7(jUp}zBD|$zXi?e&;sm>vSEU` z6OXO}g!R?3ec~P56Y$Wm;t5^ISFAk1ztceTAje5CoFxn0`0%uyW7ubp#9>epz#s@p zS315}5avZ^P6SQT&^dogi#bSkhIF$))09mYj)v$%Xa&tXhK@b6#-q5zIR@YiJP8c# zH{hXR3o3LIL*B~0xA%kQX+!727mkLc!>>T|b`D)wD-rvA+)ofTR(e=whoL*tj9QHJ zFLsjyswU1hQ>9}#7Yxh>MG#e|HxNW!brNR4zU(VhTR@e_2i?Df65AK5GSdsI8-AAP z#s#dWJk|9iCSH~4QQR{ODEAx=-%h}zdOa077vCI&eB$arP5K$=K&?){P@R6ZdIwWX zCvGKs+V}Q}U3V|W2ax2I7~%3v%=KjEyA-<=nB;E3h0ITFoc>Ywlke~F!21x{W0lZ` zGNTX}6u$swFEGftL@fFDD$I}5$;Z==$~3NVKuvnp{hT7tJ4!qXUH%;Fm;}!<6=TxL z_hb^xO{>I@B313H_F@8k6~3VAcI)}@8Pd`d?A#K;MBvI|9XxLYov_MC@kVC8}IVs%tJ3<+_V-^YlCBiaM$( zF-+;lx}WtefQ6b8ag8f4Ct$p{?jLlMgHo?DR{5%Pct@WpJFdAeky%}s#JvBOZHbO2 zVjUNNtR~YqV10MuCrojynv})X$KU{z6?Yzq>KiC*kFYVxB#$~d`FL#o6Y%OGda{)x zCXG3R@NM9^J{+_kQiGjzV(W@&?>Zw`uTKUj!-m!|m!)_mkEhRbv`pyKsWljo%~X zuz;fB=BkM<3h1|4+30#CT-mH^C@+-uJ{76dc{pA(HZ~VBU2RgMx*gql9tPvIVCwo7 zv5s=!)2rgunPFC~GOG90NNui!oEVC4Ri?sJ*(y}o1hg+3#ng!@J64^Ek4jTKxbT)i zIZVC?pP=p6>i$~!ld4SYl5B2`m>|n-wu;p)Nt8 zPPT1!kt17IA#36e)O~-MDz<(l7pBgHm0hhuT}BaKeM(99q8r#w=oOIk$hb_mxaKUD zP&XtI@20x~p$L`l@JvA4k(QY59)YL@>XRHx@DCQ;hDm5<)luzl zMOp_TS2}-#32?YPpmE~DPN;DbJy+CDKA~G$$iz>XkBJ}i9b4Z7H=q;?S3iO;SPZW~ z)lILe^iiwlAW6iGwe^QNrs>0G)U-d6W3i5R!S8e(8Qd$tv5;yqAf+Aw+(QZ>a2>oV zQxcUeEE}GVeiF*$XzKJzF%Y@@c`=>2SncVKxl6+;;b zXv==OCUaacL#QVse_1;eWVWm!@+fZYlA)>gK&gW!Z6?eNgx9W&#@3&QB4;Zq;(?rG za673^!YyH<39~0cb^>%g4awOMbbgNkGYQF((*deblM&m*lr!l9EoVKq6tRulLD`Ge zV#Px)YCScGcS?j9LdGexs0JpzbOY0@BQ2}(by1z+oclzwDdtYfiwxN5YN^)@uSw!?^RT8(5ucQJU8E$^ZJ zqJafKD<{|2+g?Xj+rk>_xCw<)T3yxSUX|`^m9ST(&nOhZuR-uXH2|d}ZZDceA-dga z6zi;|3z;@ph9hM%Jzv*)G+21;c&KZQ7NMnl4t^ocVja97K7o;50=I#q>scDd;Ux(* zYtmn|#ITFR@_oP(OZXd~gC&S<7ny!cio15JsY_=-Mc!f68C0h^I(AvVttP!UHO4go zlGr=oh747pbKb8J9e0V-d&P$L(;j9+q&r1BP=wHvHlg15*^^pbmBF2~*?mB4!!#wc zbrbPgUk6m@33&PCvg_iKon5CR@t@N?Ls8LE+Q~hJbEIg!ffOUM>kRkVb&4&=WDOQJ zyLn)|ARn_f+&%}!5O62RE?X@>M_JsHd@tSxZI?+DlHHN&*t91QNu)^<+c@qU1q0{z z{O`Rp(tkt+-g+Z)H@EReSnlU2qpiOVkp71yi*5dAk*rmj!>MBMls(h-i^SIRv=y}b z>-YfSe-SqU6jn`nzA9GnG}_=;^7*RtJk4NSR*bErU2UGtc}5;wf0^n;1wG1)Pz0L8Q3=&d<53&x-{Y4o9)eB&0^yXN08|cV%NX_ zE-xtOK&^vH=8)|r+dAKdlQN3!WJR&fFn3_AgwxF2Or$>xWOsuZ^5xC9;sEpXb%goq9&78%WL1+$> z*i$r4U~VdC+dy?4wB-EU+C(;dJlT2=0l;b5|D;|1fWv|HwBP#oC`>Oy8)1vm&ctg zN90O}D?3b#BG_=!7*T`2LMH%Hx-vi`#E(+}X$eaL(opf-zNT6;AmzB(L3aVtRC^eZ zmZ7HsX{!AJkfz$Zj;=pu5SnVk0BJnN0@9ez2c&zcF>;yX;=#T+uRxgNb{o@kcI$v85?L3AkBqUfHa-22c)h%07%2K z8&F(A`mTfa0@4(s+^?qn2tXRQ(SX#p6p->xcDRjzv}8X6Xqvc;^O#1iVBmokR|=>? zY^MUM6lf+O<^7bSyUo#k4Ny|(-U6g$tv{Ci;(~)5vB6CMr0$*XaG!EeJ0NxCbAXih zOMo;+-vFew_AzJsw6om>NK@mtfToMTuL0sZchu{2bo(D{U7iZ)46&^Sgn!VTjUO!$ z=L6DQXa#hL*t!!VnSNE7Lsgh+0Bp2|&I`->Ko=j z)^=Q(NI#j}*o=wOYXQ~7?JKZ?FaX1DVdHcr3Kl!8NV};vCSBu7UdB8Ii3(e{%%VN4 zuCWXauEt#R()#YzeG_uJq`xc`cHS4^4Ac6w`Z%lxh za7~t5Xj`!p-~N;&wbi6m*Z1JOtl0fjZVZ971hxv2($=qg_b+$(}0w26CmxxzUpkZIp_sI zO7|y+;~+|L)asxv&jzFoTBE~JKtt(1<8TyRQjR;E?K6Nh9$ZgSj<*1*dmlR7C{zXI zEd!)p4)duS&-`ARSQ!#p_1AOcbt5;-aikLB_>eqZNGY2*fjvCn~!7 zv49t5%7*0c;H2^ zGJ$Il$f?>w%_^p?X4Sz1AtyC)#Ob4g+r21o5Xr#H8U6TIYN+4@g9c+*_{H`H<7w|( zpMTh`+N6^qLh+L(|Xs^}Hff2r9(o3rhXQ(OAD& zrfCkqQxI8=H^aInF)HPsu$m7H%>m9YF2vAalmjjuK6u`n<#(*~HB@}T(OADY0Hnbv zBr9INpj1LANMpHJ4QPR=Kg-vYTm%e_uPJ$w@jV7?L4+wubI9N>BixWH zP}Ez|ATIq_gJJ-)-hSd&G4{kDEfixl0V@W6wJvK(@k5N#4ALKip@d3M0Yo3Kp?(Q< z;yEJ%MU>-lMjiNeP6!u=Fd}~9co;&2=jz6mWe%tA3=f3|G`R6@VSomhtb5NHFKD-P zMjdz|?mydL_&Vix+O%z)L7WY9$Sr)=iVKEuO+~*(maymJ9|@WB<`UE5lql4 zxYLt(mFSu<7oVR4?^IT2aeXWFn5tqSsEH88LTb~nZ0Yj)mc}}J5q4fn6>AMMs!j)0 zZP5%RkRqiOmcSB}k(p|!Z&=*O8^s%&TcM1o)e8$k@rzd>wy44h6YTod<`SchR0^I3 zS%cWryl7bfnG+lqRAfF1V_kFGk|oAPic*<))FD6(m-|0wznQZt zlXVLlmo(z&SJR@9IF`}}L$jpu%El!@y&FMGNjb^v962rHS3u8{I#Q9GJ-2##bwy%s zQb?+kbJRjyu$oB3&8+MY9E&ZlqvW-Zh*ndp)cZ#HKuuwi)-7slZtz0RT?(5vs4l@x zaC-0K@|Nb_YV(*ladMe2$u&sI`Lk#{YfXulB(tTzhu^qYd`Yl-?}5xK_lma#?~Lt< zZY}7>m4x*`?vLt1Z5|8Qd&6+}t`b#TWAM$jpt}`)^%15G=S)^5n|vBVNzlCxn&a3f z!LUmZx{|PH6Fa=?(F6UFy$}pLWYPtthKc7;B+5P~VDf2?U|Uky3pxhBUoYqwoV-5nK-FwK323jY*lqT@3$}Qjwr(_ph3R4&4`#4v{Q<&aZ-zo}tb|=nrW|{$RS@sl z$0Kpyo`FaXF+tod-hJI)SExxp+O-MHMh49ClJRgd4$X>N7w#>C*H3rtFTY0Y#YC7= zVy#qBh21pH$ne88F%N4Eb~D??FSzWp>U42SceN1~vruHiV&d@xg9AZ26{LU=l&k|W z{NLfEIJD?68J_C8W`%?10OIsF>Ro{MP=Olp)|KC-fRtkeAP#4v-denMO>YArwfzPl zb>$vF>dN;3jl>i69>-fbo^{Y~0V(f$fYi5cK%90&Jqnu~D^MJe+MWzZZRa}Mi<~V* zWYmw9fYjyB0%A)Y^*9Ak_qcSSbl-7wKLMnEP!Ll6c*EiRx?`k1Rhw&N`WLv-t~&iI zULtSS3T0ot9X?{BU!AEef!&2Y8fO2;@Oq&C0vCjC0H+1E7{q}6`jQPzYa*W|1p+m|ES=q z%W#n<7Y@#BIPm_e$oA8^Uo(z$o#sN*eQw-@Wqpc^cR~IW%tf3z{H_Ja3PdNTG>A^Q zg#IRY&AoW3o)9MKe(oV)yu>4X3&mytm6=)5MEh$|>^(yu0g#`&?4%+gg5JbRBmHe+)(5V$1PZ# z0HnMp0#aU{Un~^cdjTZ``Zb_w0`U?HwjNRM5I~gz4F!}G=mbF11*!$4yiI_n3C^!c z^Ae^m>FL_a^bD*dv-hb^JTb!}H2a<8p{e;EKp}D!T??Z#-#E7AM*t zXYrAoAnT98n%sCzQM5{1UJBE8{1*a)HEW9OLMT&v6A?zVvORFEI?!2hEfhsW91R?- zwI~SJ=q+k8iv%)<^$rs97efhsODyxsoj>fr&hGadi zDeX=}u;%gbQD3eiYx7)^qe8WAr(4;Vs69JTqWL=l|WS(htE88iu|g!U-#r zdi$yiAd_LD=dpy-py4;`O~)$29N*>im9e_<2TQN_SEWZg8gd1v9GtKhMB;cerQUsM z*dO;3m+&Fs;4i0Y1rbhoivYzBJNwK2%5{Gdz;NXn1TbHfw_UmB^tXVROBO>$!p7oG zN0S{MhQhzaiF&Pc6DyZs7?NPz8FqiIw)D^69H%SS z!eu6JLKEU*fe-7o@{jnA9Z#Rk>UM~Wr4M;3ww_nN<&YX*H`rMA;Sd^e^?&4T@A$JN>VyHmev7pVL$@3)UtET4 z<1EV_lll*4tiWx=nePcTe9uYhx5(z0F% zS9L{}%eT;h>@Pr@OSeL{$@AtKv@CvxF79FmEo{T$D0UngeNEA1!Q!YcBjY1Eb58ZF znW9zN+@mE zEy3>uv~inFJICTFtG1=#+kj^Gg(^nS?9a9fCV@v+cT0**yDNBZmfpZNCt#GWbYjqB z&j0QK-SdW)^})CoB$EdA<$Uf7zy8m$-&maTMPTcK=(OA>+++d zRPSCi{Oj=hEzpeSSQsXdev^t7CGXGUT?(3~3>`Z`O_$;_(>Dv`UeGljjjNr8smC0GYWkIh z(wR~H6liWSbS{5U&4USZKPIEIc_h2vR*hFsc1s&U=U-p8I@p!ctbZjTy z>;)a&d#@LCoa)K4Hh+!DS6=8|^jJ%wzxn7`4hHmsjsxB!dqKzcerz7Pag$3!?Hbeh zlq|Y@yIaqJt{QYhM*x6f9do-|x=^9JT9xT1)4#N$dFkz2xI~O?lBwVBqbWAwtR?XO17B6ju010nW??IU~j*8DTO7Zwf>iCeRmGG9atnNCqz1?7-C zplTr)1_;n)s>i&)ovnUs{a_3U%rfCaoNsPrn_^Fr?wNiPPEfsw?q)Zzpqst|`#o3# zw***c83>Hnw(l)y9fB>Twxhacubnw&Z2;f0n+VvY%CNjxl$kyzy}f;Bd3q)U`VOvY zUs>k0^~F!QmnuAH8$3!+A7i=ULzK)o?}Y`_ceb7jYwJ7L$j4;{V2PU~x~GBEJRXQK z>sChlAc7FmG{^I)#A0vP5nI;6f%a9=?zUsP;tw(XyY{F1B|FnIaR66WcqL`~O&?=D zos;G1NP4>ZMDBPcVhixHhu=^}>Enr_U+wI*h)ghSKq_!*)!U1{xoI ztS39BvzQ=JHDas7e#AO{0R#dMmgtV8)F{iz1!S&ARBc3GfbF{YmI3(bH+=%-rLp}; z`DeRgN_`$zLR#5=TQ@dtScAB??;C&B5n7HK4$M?VUcv^|iC!M+p zg`(~2TUcVcZru{6{f%47`SaN=Y&*Kzw=jU6JSQ&++_?-;_Esd$=OIBPH*vPtM4Ky! z!TdbBz06yUW3W|)u?ME4SC=9B*r?KM=?b`D`DX|D)6==F!xN0wBTIHcn5-&`%$7E! zw+{wX0JI&CaKv$fvC3M*n?WeYclAl_zh`=J6b09dOTo21&I|i^UY3uR?2AZk7ytD1 zOR~tS)4N&fFAY1!-J!Mv+gEwrDJi^NgLfoB!SbRhg%WZ-H%Y87#{v%cvN+2ZpRFxa z*+zufu+b4p+-x>iOzj4JY}2a@)WeZlE~TvXx+ZPhFbHZO+V}N|wLbuqXbSLmw=>AM z9qCo9=+dN6w*4z0lk%%5$svuT_5RfJSv(Q&lemX2jA$5sU|~l#9I;t*RQtAv+V@Vr zYI;@d8;`YY>N+hbwSVeu$c@aU2Q8*O6rVw+A&S`Jn_27PI1gSCflC+-Jv4EYQvy3R zCR4b6=j!Q{GmbsbCw<0{_I;7m)Yt=OMz+6J*zc*Xal!EKIAh3~wMcO2y+BTl?z$;E zea{#&k_2!@X<{8q5Q+9OwDJuAsNvP5Uu@IqK;Sq?(0$sQ-TwBnXo|XWEeDk4zSeo5 zxKWFM?~1MOkB`m|Bxbk~w5rO*46$0C)i(Hfwa;mo#ZtXyCdCv=MN9!0<2^Qnc@#Bc zgPR&g2?eE}k^TswK{u?C;K5suA(G<-h<^mV~a#HdGc=K@mPr4F|V(07Fny9RPoZPep!U-t{{+kn0& z(1U=K_fbIV-U|-*2B7Z?-QS#Tq%Y>uf;-qjBLQitn+!-xoos{Qyu!xBp6;FPd*7F_ zWUONQ{Ku?K`YDVf%Q=p;wJq{!$+q@={i=AnOE*)Dzng`8v&x2;f^Pst|kq4d0k6xP(om!dWK&mAR#glUHzch4P`%_Stz@s^j z$-yTAZVXKrL6j2M92wQe6f-qh2Qd*I{r zTPyltKw8lyBB8=7;X-r1XM3MiVaYZbt(~}Md!+58MEa>j`>TBt&+kq@_5O1uyY4QJ zqhG&yTcQxMHya+6G41isnG&(RGur-I1a(Ra$e!(msROpKH0+sP*0=4qu0(MTdH^0X z`wGvzeuK%ENhjA`VMp4kIYFu&4OYxy`q3NgOwR|IjxJ1!!tM>*v-zm!A)J9R?XJ{; zmK^>6kM~R;(+7c!!%2zty(QbazBL42-^8Q$dVNcvv3TDl(3yB^=;u3#rA}LUP26+m z1dhQ$O7q9C#}(o{n3d_zgK}*;W0>>HSL@|_ z)km{V61x<>{|FB{VZ1p)jd~a1%>~4$w*qgrWKgbv_tyow)8Uv5nw&cTX>#^Z8ZiRu zk70=^N?X=~-oV+V$4_ae#W6KVntI9Hg3R<{!`Wj2{8%TVDL66V6P!RVlQ|RhCz|TN zXWE25ZPAi#^B+qh5@)bZ0aqMV9Bb9tiS$kg%b`|vvVNgnZA-krjWr7j3b!Q-x2KYo z8@45+awU%6R+)xd)|s`|nZnf2J=4n8wjD;FRK#e{_5p2ieoDi_CY)99z=YPpX=Ty2 zKJyB#y4h1$Vv{x{+^`98pnK|hx;bB$|uFOm;OYGSeZ#yWlefR!snGuB45Sz-|QU?Xg zLLh;6yI}W8{n!8Bf*t?g1bf;TCT}@b7Xr2Gu1H%&BE8*JF4U{%N_J*duH!2=Y}bzK zsrio?ep6#j&TroxZGRQr{9UdCn}!bTPb{yt<`_!*DPfToKzmTupE=C$Qa``hgF=AT z??Shyh9x#^lb}={?^j#fjk3~*0)S@N1iT42w^uP6o*AZwmL@r=P!jAsHK>Z&*ePdT1SJXLsV@KCsYE}rx7T!iNmJPYwG#j8*?{LdJU8IE8PBbFZpX73&mDN~!gC*<`|q9X9W>WL=Q-#i2VLSI)>RG5 zVh1g8&~gW*9K`yn9IS5&t#wd`gIJ@~_BsdM;2_o+wY}9rw>xOFgYIz9T@Jd>LH9f8 zhYs4}pdUMEn}Z&A&{GcjnS+ADP$=S%PQ=R@{Rke1Me)g^AqE?>3tHJ|iIH9>cE-HEvWyeUh3xneG9()e=4FDSxee^U^lKvV+I$l0@B^yP~G%hAN)W>B_v zf^a>DH=((^o5%Qa#b-yAjXjg{xQePmLDWv3ug4v!86H1GD$LE9O9rJ=$< z8fwH)@@C_Ee_;JPY%dvb%rU-3jFh9XT&s*bTudm4984!+1{{09wZ2A-c1L5mh8fI( zp!K=RKHqwmuMvZa2x$&6c$4JbL4U9GuMT>^(O9kx1~WjoxO%`+GUm^NI#jM0 zAKoTMW4TT?7{;$4@*3XE?`ID5)~Z}FKD>mZv0U#F4a2-Gh;ZSCAsl_?RXbI#7$4pT ze8C**S*|adROJFhL1YTvd9b zM>GrJLr-SH4?2#Bo(>G4h5uuBl2U zCw_dc-+iX}?4gdU+|k&04L9x_0UIrcB)Q{LZ&e=QxQ=r)mg_--Ia0V-8fkug<1Ifu zQn;F-XhL*F0DGhhArGk19EGPK(jqWM6T`P2d6e^umpRZJ<+wgF7_LngME3HH=Y#3P zUpd-wMNN2)c3jsOF0TEB_3sRGT-Q39xXI;VraW^Uupn|j>>0zm)8B77#&L}d(uCUQ zxNsRq0efCtxPs>_;=qPaObjO`!j_8WTTk>IHQaHHWd(u}nvh?|0_$J0_3oWN?t84y zRVqv(0~Pjbgm78EiiRbdM)+Lgl}l(seieoMTE6t7!B#!U@x zjr6%D3X`0(3Wso%aIpoZx%uz&|2oR&nxt5v3HimI%kPOM{dLGK$N5~7l}l(sT%(1H zJqyj)&VlWteXcUa3QdUXcvuuf*uK#`_e%Pk$NOAtx?qGR#B~C&1rggjeE)B|-a5hO zGIEwe6XH5ixNK^~zq79V!~mBT4xtHgjS()k)-?44ju|*6z@>#lXhK{kf!6O~zt+)x z-bn#2EgV7<;^N}Hf41n|AC5hJY=BD(htPz$#)bUyKHOD1F2JRQLuf)=#lmGvZ@<3% zhZG06v~UPbh>NM@pH(^J;xAuZ65!IpAv7T_rjkDf_{-SYe=QAgY2gqW(BW!4)BZ4( z{9Jy#?|=VQ(=GRe3%R%rZjFL3nzn^l#W3xxQOqv_4UA$gvIO{5%#->fcm?mxq4}G3 zYyp~nA>VV);N(AFGcLqM=U&Tk`PVs^**TcSIhbuZF{REnYZT;V4Av+Z2#!e&&L*r; zn)x|g_KI`T<>>7pDA#WAeW;6EM; zPfz--5~RK$s%OnhP>@W<|!O1RQ9pUox|8=>ja-_@NAh zVOi5cQOOmGEenVsW>w5h&aE?ts)!YrXC`JOg~|DYH7cqI3#NCgJ>%zS!7SR?nGRS33*p!l)mwZsBs_ zabdCQ;KEp=2kv8?&$eVKy}WT{U0ZAYrJ+E%;=8bMVSpm%Od8suWW`)PjzpPHkQ5;`)gtr9FhG*jvG7ucdTFZ*{PhjGs6;E{3P?xL|{Y zW3;=R5YR}_6zuW+Z#jKeGQ~^^)LRNkbIE8w)1`4iK~Cj_51Hi;W4_xPRgVvDZ%k0@ z)ib-vNoBp1yJAmTlNrTpZ8BA(#R@xQgRlp+mEIdftb?;^tLuQ;b3|<4*>VK}D65@` z4z~kE-7k=GE)1wqSY~ilg^8vY)}9^l^#{+h&Qna4a?w_b1)oz)n1O@(nr+74wlQ6C z>YRa3UhsO71ipRgWEBgss)d8KT~eQI7&EoCim}%kkz)OH?lO zJVc;d@aBvmDq?#IF)a@h+|TeHDA2F*9wgB3@#b1X)a!=~=K29t%K+kPTbdW|7qhFe-yJk2eUZ`Gdl;ve6U8{2@JB}GFzIZ3w4G(7VPE33++yL-*Az9lRdReG=ds!m@SQ0^tL6QIDS&8-x9L| zV5TU=jf*BwAxY*fJHHA%DJiwLubXkNt1&0M4FDphDHc2UFqadJZ=VlE$9Yv zR{(}A;$GR5PypFb)q6U?}Bb#p0c%2;^!ln4#1e$*sIwYm~J0*Pn zmEGS^BrdPSr1AYN4#nd#*v$paBZkhoS286;$MF3ZXx_=b#M%xFW)a_Y`0 zCX7lYH~Oeb{}NiycGEE(eWcE|`oGxaFAR72^MZES!-1;xFQ-lu`rlTk^`%=`wW53$Gb`(c1Faj@aCBUeFg8c1acxa5dArnayE!y ze~hr=s@$KlNgQ_8{4>Ned}6tnK@%1O8|qu^f~EQs>v)AQ1Zd%%rZ&f8PYaSaZwqc? zRiE~K1+mZkfM|2?LBoNct%^LKeiDcFGJV_k9+kTAR0>zLEw_WLl0Cs;7IVL=Ilo;i z?PlkX-f&&)+dO_>TnGx6xPB8Ljp2jSPeu{pAC`#h19 z;!&)daz(@_Z+w-A9!s7r;i!1)eQ+xvq}9H+yX~l|3{N4A-pXaTuw800PoZY2M_VZ_ zCsx<7VALi!U5x|^m902T(u*)7mlE;%-d_lt06*NT!YJNa2Bnq zefwyt?1XkSIXo(5j74)>ITTFth8w{^N7^1g>yC$ebMQo^BFz=(LcHe*q#~PRCP}awPGEFb|-?K6|t*=amemfEevUAZ=IS|lALV=evoOeaM`Iq76RyQAJ0IT|~W z8Uh*`4g?D#92YWVvB6b$`(h*9=%m@tvs|VBkGVI2kFq-V$7h%UgQ5e9il}8&P*8y+ zB#^jfAc2V{$m-H+LkIz)A&JQh1}ln9qE5$DTbJ5uTYGO8wY9aI;!+Ku1eYqV#cC^7 zYe`32tX_=PlK=PnJmDidOC1eEwFuWwizeR;H1sC4rn%?-uSN4-w<453jlP;z>6trm? zAHVk+ciYH!9E^?6SSA%_B%V<4X1qBcZD{-^rdY-)Fy6sfuFE;ugV`TXD0nE|gxtU3 zN3HI*kqr*Ua#7JF%>j7)T<*4!76)Uw>_-XKs!)*qEj`}<#JLZ-+eWT3>2kM?@OEq( z_U!IPiTn$L_qp3fcylF5O+S~rZG>kvX+}F?*^lZRMEqRtwvp>h497TJRM<(waX1t_5pP=D zeD|-Wy4yy03YEs)Ho~)@G>72v=b^i8q|(9IbbVKNtU5Z*n&~lf-rY8GkAtyX3ry&& zOImwr@%?j}6YjQ=a~+K3`h)R@ooXn^nr|Qw?wBeOkkK42#HihF1ESc+Rl!&}^|y!8 z2BY{Og?Y5)hFNRWpHpoRuvXG;_aIJfsx6CS!=t}gNjiSts?6nDg<0+`AO(a?=oKN__F)}Xy%AH?1gx!25Y+X^CsGT^i zwSHwwqIH_Y(fP=RbFZuoIB zHnH5gI94{6+5VY3ZkT{U8Ip~4aw7X`AIKONFg4C6Kc+*!&owr#T_c~-@RPUEXn0x& zVoR1Rs+_%aiG0J&uSu+HsrOfo!E!w&W3VlQllCE>iI!ZjprR(()KXi=o1rdE;)Ad6 zvy>@RPd3)@s+_FK;}n57GKaH@(#v3Eg*EUx;6NEp<@~wl*nG7`zicPUXx#GfDH)Y}v*!ZSXmC!rGyUbp`nSPg#6!F^y*{O&a_huba^Yr_ z`0Aha!}s5QhqcT5vbcL3QbaRlqwVp;^B|~Dl?QQ%G9b*mc~i$Hp;+W5C=S?`*k7bV zawBS08edd#0{zM4cz($3-Ng`7e}gomD!pH2iWiI|o{#mGUC11QT!~CF6)nT>*?7Wo z9BhtIK0%PVbCm0Xa@W;+{VT*`ry8+X>4LmOvF9e31il_0)Em=K)0KHPW)L+}NS12P z%Zz}gfc*kuUS`wS1(#4F>8_s8xwkO65c9G${L~Bk^&`fCYG0x>@o6n~1RXBOeYo z`5UqM3(;v=-rx-Wm$*R*yTFsf)s?K7XJ%#b)ErsNI=WR_k2jB7@^WQzzLUv|{zWGL zAI8PxbB^|s?{6<>xs}B2b<#0hJ)Eb#$tJc<<>Bg8zh$t2Wo*Kp)Z+@1cXS!&Mcap;H>EA7uy98m-aI6mn+2zyR^ynpjam8|%swFT{vw&-0 z)L=LYyIi+#di;7BJmTwgUdDstn5htXN}tIw`WvY( zO*X$`7k=d~SLBv)FqZ4*#zsYMUM^SU_Mn5YT(=t=*4t2!6D6kWh_9bh;fmb8<6tb; zGsZ?mZeA`|V*@0T4HYb@F(pGJn z263HaSscvzK^Us$vu2s#5u zJjfYKXm2q1neUM)401{~tnf)?7_Fw}L~Lck*=#L=!Jjob9l%hK(?LSc16VVd4!iktleq}|;CsfLE^KKXO<)BCA1T6|Gg4)L(WM-R3 zRub5MdO?0+z6w6%J(yM-=XQ<463?zO4&i~oW2oqy$IwWemE7n1-y$a|@-G)}LbK=o zUMg&$;ZQE?&l2CVT-*k|?7C9!xHWeRmQi0`Sru;-#Kv4~vU#qz;!|?=R_vyZ68q^M z8q`Mgir|Hs&_?uf=7G(>^~-qS;E3K4#8!8`oyd#zh9`=fqy9G1c_S>Ual5DE^@l{r zZIRWx3SNM&o?W!Sr~X|+U;ti7W$=fN7U9H#boHlL5Y#Bv*mK1-%kxeCq)j`A zr7Cs<+I{shs`u>=weG)>on^jbK%G_3nY~aGuJYMZ?n-pQb|0BTyfvp!{|Zsokj& zP>9{n97jW>;p=~YH!v4DG&);m1!bjNxc{jqxwGY&f*{6@uooB`oh_Rm@=qII z?h)3`Hwe@g@B=r8fm@SpUah5j4mIWc_HX7yD6 z{C6TX0YmjVyNu+T%Nvy%`lYk0VSg?>dDPT%!nw!NtM&s{vc!DdVECJccU4T!l9Ceg zW)_ZjMmP&^y_5B#EsPKo?cHy4R$lsGUCguBIns3%L5j08Q+s1{f6$`2m3^XBk{M6U zg}kvRaT0sP5t(V8jd{nyvxf%It;IIRK-!IYnfr7t#$3dx$i`W(xz%|0I7dh{-jPl&h0_&1sS$mo zT%NlS8hN?~BAq>;JI)M7I^U#adfvDPqa?7Q6gxNPjed}wBYs6Xzb5X0gdr~xb?SP| zMf8H!jZ@#{;%em6WPqtJzXxLr6wpKY|8E6=xVQ3tTx2t%t67DhR@ZSV6{utIgyl+6 zMkgHj8{WqW#l0+AqErl_6ve_?wu^xI-!ORyWFnqmfF;Lf5tKVv*>eN~t83d<2M!oB zcA~dKLmac#h_u0!kzcBX(y_|FjvS_#A?g>p!T7_rtZQF}(es(iQSKOfi-WOatPN4e zST-YaePQm>t6hoINR2GI6w5Wi*r-H`T^vJQb?WKga3xZc9E|099~c_W3qwJ6c+9*7 z#TP)WkpTxjA^?UP#k41+42p)?uF@~sZ`-)#Y*!++h5#7B_)g`kL`vriXfL;){k%$~ zyc#wHBm7pvp%N+ED{fvN-=PCm?it6U!mBSWGtRfHQ5)+QZPn&{3vg^WQ?mw}O9q|$ z<_L{5iv=!*)MWb;|JCRCARF%px9=6a4CaQHGDpM!D(QF(XLWtME>wNzi@AJfoXYjU zw=B$j0Bp7JE^o1l%-XkL&yVW#hlg|RDiCq0Y2YQ04J#X*)w!7_5x1s3vAP-aqU7?6 z>+AINs|SwwGTNGetclRzXnM{bwG}qha8iS?%}TtXu&rhgi*X}*up47plW1)l>i748 znfb-K4CTy-RTwHmQODVP(s(-(wHf^Wx2!AupDRVFH2d8Hw3f*XLuM$&z6noY6QW0j zfmVGNQ$$?$427e>d~M@Sf_S=Pda2(($I(mVI4#14a54P*s_~Oe);TTW`LZLbzjx6y zjFna0=LI`H8F^XVgTH`$P#K4ahy@${`5;YbbPi{c%p$mLI$=LHfK z@w#54x<6fYb${j%Svh9Tc<^UL8z#?ZQe*WXuP2i5vG7cehPvaqQ=`x|-5st#?%EHl zva4F>TWr1Tqr!n@cyp!|7HyWg4!jk=m0Idk-i|M!o!^8Tw7_C}efli@0E0dCr$a4y zWI{QkI6u$K8tm#AYQ|Z*r5`6QzWQUvGqIePrp#Ans40IMpA${qT{(Nubt?xA_Krz{ zcSjoU4xxAI1AP0nb8msn7oxyYbQ=z^22idN4xEYi;X+-6x4Jes6h*g+`!XoS{m^m! zBB-nJbmHm2!y;zcbm93qp0D5`dLf>rc(~wXD9qAZ@Gu-24s*IMT&XQ+xn)GlwV*L{e(AySp4NU7^-*TL3MRDv;tI#u>18}Kjhy+Y6Zbp&c3@(!@ll48#e zu(^_i6=+P)o5XnQr%hk>|9{H}iD__{7o-zd7(ZDSj z0*?LQnjzrWyLSx%$G-L(L%>Y~?w%pwrUJKP2sp~BhI6d-m|Xcs9Iov0nOr!EZx;^% z$NZ}u0&XgB>xO`1{JuX#+^>g#qu}SmA>cSNMwn=i$(1i0$B!EVE(+W!L&SY{2sq~R zgI~_t+3{CjZ1?u8-Xjt7pSLa)h{UivqQorlNd!j-{&(GYMfx33NXR}5Uw5O9Y8_g_Q6 zu^r`&!OLTEr9=ArA>g>cIAsVp&dk;f0muFzH3S^P{q7KOtS`SA0*>X;KLi}d%j3N= z8vM?ce_VlA4gtsb)eQkhNaql6?Eh{Z0*>|I-XY+o0JmufxF~Rc9s-W_V1HItkI9vP z#2r5b9Q%#gL&P-<0XHs)s{w$!ix~vN8Ldbb{GVpTZP3f}?W5!4ipvhho@sNPU|sm? zco5gr#O)^$X4TVpRKC4UsOC!oOPktS>gy=DS`n?QZ>0#U4(Feu*tDS}H19?0TU(o3 z1IZ??4WfzWD89!94HrOoTvyb~H4$Fk6WZi@2l+Ud0}1|pBbry#+t}a~ zSYtz76hg6pH+bi}V{~P0LnF3$I5$#AfR3$~r=cy1O)}ASNb1_!Mu^zFju4zj>)Trz zTI*McSA)R3@xlwj_LViY3C+l8LsM4L5s>aliJ}}DR|NhgTDAf01FU(~SlgCZ+5(Y% z{Xc~@K|bk&H766%=9SSk^=q12*9F?@8&^uf_-n_$?6Xo9ty^8&(Bvsj)*GlitZlUA z<;hbIOzPgcXks-K!DJM%Dzxnd&W(U5WZ8(arf!0;G3tK!g0Cv+Iv7 zE-28P>MyeBWVR>Rt*LFj1d(o=5@=~{ZeJJuS4H_xqJ}*M4GE;f=^u=jo;=dbt8Hv- zzN~)5$3w-hAi^c;2f#_XXut@ z^l0lmOij)B(E`hcL{uFEJ1070)~r&r zleXq$YhAr`cBq0(8QOnKExkjZYu(!dxR_^6Ljv`gH8s&%k1?X5xv^Gm`$4;5<;vy6 z{TiMo)`m*j)UYPGM(X^U+IFGYgq-O58ebNBRCeQeTc_lmw()Fi+q$MiZM)CAY_x$e z+oT?eN0KHp=%Iv>)oSA#6YWS6Z*EISz)nN0Sc5?(inEW%J0{n(_R0l0>`d?Esc`<0 z7gdOQ<^q*%ZAmn6FRrn<`I2OdiDpHG&y97S-Qs2SwU-34+EKQfQ~9I1#U_fKJM5KK zuW`Lt+H^@%^JTta%O6jjAyDo~87jpSTpDmn!*wO+R#7~ZB2UJ{wP8MF&%1bbt@W zO&fM{F&v2EH`fJW$x*H-buS6$&e%GKH=nTN@pPez@Gcap1aGeKRM97Yg(dG#6{;NX zGlYuc9TTbwZ`$j{t@DIhg7;ZMosW05P#5C8K&WMSFBWPA-scLn8gG8H2utY^8c|a3{Q~c=3bhgMTZDQ9Z~7jVx^ufwkK_F< zp|;_DuTan6{T-pU{1NE3tth1YiV$FR*D6c#nmiXp@mt*wD|K!$?8OHB0 z{_B^UVW7s`^NX1Ky~lpJVN39T?-?#!A>+rTXMFJq{g&h1LLnI6SE3QZb&}xO1$iTSKN5(as!b@^SH-S15R_xS|KXbJLM}SV_WSCjcWD9~XNn)u=@G zsb8r+Uk@t@*G$@JZ|46VHVU?Gy6(96&v)u!CE=PSOw!Z&xegRA%J6AE-+$x1dRR%g zO4L>`z8JCx4F%aN(mZ(aQMGzlNw`eq5R8wDLN`}4(}90^aj|DtO;H4VukeH$^sth0Y2^@%kLzIJnno6w<RHJygTsi*{K_aS~mpa<6;{L z1({1UM?LZPlwK>PVQJkEjE{@GQz#h4o2I1Y_KWmdDdp0-As8Rm1YljRVc-As0=-sB zxwLKw#>W*EE|v(*q$Q7>8TF(~>qZnV{+ws8tNOP<1iFe=+~>Jgs!;2OV0>Y*Cvp0=Et#a7p@n7;@E2VWqFg~t{!gVs|MNPC*s?%4G5@g6R%8-nq1odB%ci=K1l?>;)g z!=-gYFg~uy!bN+Uo}YdC$H^Wpts8>zadBoE3bI6K{&CW>^b`-5)(yexN)_TMuv#@wVq$DYMmHFg`BUicnB<7;BVKm$!Sa zl`7J@As8PQ-4KkAi*a!00H=)4 z+u^xZ%BZ;(jE{@;GZfTXiv7`__P;U1&G{m&8-nq1F%Itjn`zUI`gW0rOY4SUd|b>u zx9=@@^=re5JzUyv2*$_7IJhx<==Wb+H`BwVbwe;dF2=#F^X)H>xNw%sWwfCS#>d4t zxOJoPy!x3X9xm-S1mojk9NanEz;E~7RqEl=x*-@J*D1oq5sIe&hxb2!iib-}L@++C zQ-O8UwfF}k_MYnD(z+oSAJ=KZbua^hIcnW|Up&pjrL|fxKCaV&b;qxD`=x(q^={CNyYQ+`e|RasQaG;8l-j@NPE!s8B-*T8&7n%#LfQ-fJ{lq|fJO=zZa` zc4q6owPd1ks5_?%^9u_~Wa~6{PP0|vJ^)n3zY6t#xO2MHf2OP+Wj7Ja%@h}gFbCl= zXS+(ZHjA~W*f|tS#m{rO2*c79+zh`)E%ILj%*_S|?-f^EV!M3U1mx7sw}9y}xRAva z6wlH=MPMQ``aLl7x!{Cx!YwJ#2B6k~Z{Yu0U`8LP7D$pwN3l<}S`X|m2IfRY6lMe- zO>a@YH@z*eUkS`B2IquZP~_YBSBeDg1!mT0`lj+w^{-T$npy|GkN?*KGj)tw?1z7X zEB0#;i^0D(V18k`&WObo%(PPh@!%Z1&pIR!_&OdMH~;)+_jnoc1HddiTyc(nv-~$N zO+>hV0_K1t6vu3o_+{PqF=1FB&<)Iw%z}o=7F>~;{wTXh2CLBF-C;UCuqkeq|6Yr8 zVSgVmBe*Pq8IDK%n`ss~VvBhl{+9r=*Wf5K5!?*_hx2=3KOc*gzvH2C^0{E9Pu1P8 z;1{Cu^N_hWdU4$P+p=d|-;zlOaJfjjpkv=L6?VI2QTO1#~RNX}b<`If;s z=_tzADS)zzg#Ks1Y&AG1UuMoIH4yoCC>*u}^T(-bI|BbCy`?jC`eML;!T)2XVYV_| zEu8WwDD-vE?Qob1%=b)h;^ZGTMjNl>-+OpxfZ1Vck>g*9|DKj|#BUEUrxde#8is&l zKDP`3Hww694&3yTVpDSgfZ@1ubr#M!)4h*-a~@>k9~y_(E<8MtoM^@g=4$AsIMlf+ z#~yp$Ac)rzV>}0Q$4pJ&9wTGff~ytF<|n zWREhd)(^SQ4+qR`Xz+7ikz>4W&U^>`upBDVkAXkJFTF5EsYd+f@EI26>pvEX!{kqd z$~e>~pg3y_2ZkY+m}6o2{P|O%j)0v~$2im!hx#li^-m7*p9@WVlX=)ZN?nQ5;#9{+ zHIbW4vInOhI{GFX)t*Xj;Q+1yPIf4c7;49LpHfz9fGP#xbTd-P*l9+v9{C-2KHHK=7>C0 zGY-U4{YY*;^$Bp|^)rbBhBx#5cqu5&){8*>TwHPF4!Ns}4m`KmNX~ZjUv*W4C-c?M zJ}{u#e=KgI8=wa#2ptVLiDN2L?^h0NGN%vY-R4RgTn3c*Ogz25KQrFr1gr^TAo&Nz zTz`5}z?S?AiQ~z5|57Lp%J&OZj`ssXF;(9ZinEQ?Lbc$1yHHm+c4<(aGWMk#%3_~$ z)Q+alTgKCdtZT)m4oggmcWjQXgqaqZ&td_SnC{LOHFVw>aB{u)O9-4S9 zMrAa25+Pz|&P-9`ItIBmcDw_p;C};3E5o~>*kgwSALIR~P{YyVdMXH&XJwtmO|;`~I_S@$f(*CU zlHsw)8ALHwo*Oh5I7dPJ83+Pf?t4wE++MOw|Y1((crha6G%P1>(I2m~u6a7__ z5o@hhoPTR|kAu=QaJiU=N6#B;qi3FI`mc9zQt50;Z6Ek-JbeMC0c$RhRA?N(sdRQ9Cv>W_vi0bnG^O zx9ud5mW-_Os}g|{785j6^~EDTLX)M>JdAwLufCtr7@#!&U9eC6#%%i(Ks}+ zMLMa9GWG~Vt|%C&N>3#M^T>&;U(ijrHFE!mj{XBL+dmfh&#jR!&LX1aArVt8KE1IYp$&x zy-4R<@H*Z-H>kN(Fwl1^Elh8N4ykhBIXie)Lu;M*f2R2Vobmrm<3HyM>JzgmvoPBe z#BU%mp7G1YpC|*q;DySRjas6Lo_X`5GBpq%z@34;TGEkg4&FO3(04dq562LqZJ(ZQ zF}1^Onr2SLvBPv0(m18Ea)gOp7`sS&NYo6}oMFl1AJ+0sd{4{ImPew@EsIR%I;R$W z0owY!@pbS^Jor9d5$R^l*2;lr-Td97`8!MU_gRy_sL4`(M}ZO9qeYm3x_6yUR;JVs zmj6HHe;pYGe#vG@I&1pdutb*V6^ik6MWF9J*c^-O{1F~i!LUiF*{E}yg<20PPpEG> zc5gYGt^lRJbc0e}-xO@G5NV}cd*zChvA=1gYQM@~OA20(|-NpEY zpBHVJ_=DWjP;(Xe7?2KgFqq3V>JD7j) z&?yYi86=apW}@D-^kA)xq(Q6KZYcfQCS^wpC7?VKGw2pGyl@4&1&`i)`M6LE@qR+6 z2E1<*ietLk-3)50*s;WWg(9C)9LN>-2gmLMhvKHkZTO|P%|9uW)2n+`tw9k?kwk{s`INIu>7I$Ufo?eN>{ZaoUtBAr|+pi~3p-R;|B8wU1oJ-R#o z?F}CfzbqWSJ9AKX{4vmxYx{u;KN;h|?-Y@GhDyLyM_U%G-TT`FnQ-VQZs2dY-T zr{{eko?aS=f5eu!A#sS?Js4%LnV+Q&%ltT3h%MmAT%XJ3Qn>UrqX)|e;Z{&>?4N_3 zR@I9^X?62g(5GM@7U79jRiYKQ1C-hwf?A+;a(izFO) z1=Q0*nHdmQQ$}!-deM9BLmjTDMa%cz4Sh)D{_q*6O~ZAum2mKSP2<&vSbi1Gz1Z!?OBH`L zwOK2d5iFs8;`(8+!XUOSQ)SZv6-1{|WRZa^Ei*dC(OeT5E8V*OSo|nAvcis%U~*?X zy#V5>SFJzWGhqlr(12Kh-31M&mfP`!W#2q|`><&Ac|oXUc*lfl!uv&`u5~D`MqU!T zyYN<=ZSPMsTH6! zdCj0+#uE;t@z#Xi4(b)LQ&E;yMw#1pTpm6w()A5ER^p20^dg9Kpi+v{=U7KcAkw)3 zlxT#;l25PEkwT)t>SSFU)OuGy5IDwDBiJLy|Z>!;w7oJg;Fntl))ed)p0uMmAzB8pxa|xh2)RVnG~AODA(g7zUrwm@#Rp zPVJ7_z76tGGjo{^_uonAWq50sSr2M~*hyFAt`k?YSuU$eRqTwXmhOUhC7o<3Pd$D0 zTLV`?r}y4qqNHQ*uw+X?Pi)Vo=z|Bsi%7+`c&ZvxrS&_9MZWkI*p#Q9!{i@2#W$2r zgFtN4&dA6unJdwCWtT8kSR3=ffMw`zE5gQ#6w9qh*EO(zl#YFzAETex4H`{jkS8+F z{4O#9zE!1?J7S{5*W+C#jtK49GR#_;gXfWQ#=F0w;Jtl$`Y-}?JUvW8e^W{T%VZQv zqF^9%$cx9wc~OnoA_(tLKcaVVaxXlHTZHgx7I$_)h83n)Bv%T<^- z#7t)#6Cnvazblq{!us3yByymlYakZ6#R&`1M&Gr&Yfq$;x3KKl5=2gyclKAMlRFZJ z^nDF>WqW#~#6-GM_=QB8+VgnqQ4T*Suy%AfPfH^IiZSC?w7s#S>%BTeaP z-NJ?W&~;_7j8S0rrWt{hL-L;!1LxxhCxpEHn{n)DhfcpAqH9ZhA7zNJ7!yqU>=@R5 z9oLPi-qeMZiF|^**oDj8cMdE?mOOzT{}?*k^#Ew(V=&&)AKXZvj_8Sve1ZUpV_%G^ zO8qrc=v^y{_nYax-*1Nv2~J+ZM0pb1eqQc`CT4pQnJ9J=_%IWAzfB-|EjNLY6m`vO zR%LDiM>$rC9gnYO<8&6r?MRFcHfc~CPs1V(RXg@umxvxO`AL zJk4_`mZT0;UjlWxaC{ro?}hrgL%j>?S+P47O=-JOl=M6=)O=7n>hqTEH^lBPP&hYGi%az-3QB#M0ZM)OEGYFQ*PP(L(;=cGoQ%kbtO7|vmHF>>h}y?H-=7ef zqvBrQ_k-_J-%yIUOG|oYB`3jU0Un=5>^M8rvd7qe^ZQy!Imf!Eu{N*`D={gS>KPOQ z*Q7{;?at9aII6{E=6gKCxKP5W_J?Q(mSxh38xdpbd07Q(l-V>n*@#Q~L7dQFDt0-` z{E8jYDOG6~S@0TavM^&_Cj4Y)ZA`C!cO#jr>XN(A=S4d2ge4@uqa&T{G_i7q7S6~G zKLOp*KP=Mub0I>Ju17#rpwqhHW)OXp^T)d@pt+n~VmH=L>=LmQ-vRyGAKJmcqd%NH zGhMMmHq=IL+MKTb@am7bT?4l*Zi?kSpI+L3^(W@{W@zdDGavf1nmbmc#=4}YRVpb2O1sk z9y=W$@OH$e?5(bICh8KSzAKQc$AbAyJbI3GgHX%y{)14QbFCNZ8sx!SLfrxCZK3#K zLha0K%kw4mDQ~Tt?wMX3r?m|WqfIfV!^eG!seWpP*D1D$^W-z`I0U5C?>JC@lweQ6 z`yHV;mHLxVCIVdWX(PY~&4)M{ajRkne#Nn$!ClHH+PD;(^7pObai|*AJKc^nu@Eyq z+^!h>ZG2!eT1@w-$?=X&JH<14p~GA08_5%_|B0i614tSC;PeubDpQ9O5K`>UjN(@# zWs}V`?6?V(X2fj2@ zCZZruPW~w~M#SUzaSA^L^-oK_wBZyeE30^_;DrsPCq-`F97}DFeY7JUe5xuPA6<^t zn9r_{O`S7M{+CY4>AQ}Um8RAZtTZFnF9Sr^DZ?aJ<$@Qi*14QAV-qMHksb%dG={}R zU6(rb6?4#NRjPV2x&!=2-{4)UNY{Hbc)uh3Y%zU8Y46Ru4oAkl*C;&Zy2>p)&W927 zI}j8gTdPW+igdjWn3;%o#|A39;{ydRAaHzE*Z`M6y!1DTbr88xe4lz|!)YaDiLvqS zbAy%L^8l`zI1t-#+G%CU9hE^yJDY;^m9qD0BYVeGDY?Ef_^H^x>9?;3vMTilKnJ*L zfq*r+C=PGqrMnX&;vc;d4}JtT{Kvz#Ja`RT* ze*j~d30E_y8~ zLDyLArXi*n-d|k#=v0#87Tk3Do z&3RAl*^Ik1dSF|YxBD)Tys4$*ojnBu)u}&bZjo-IY|qwU@+=jpM!t9%8hUEehBx2X zunB_MBO=$VgataBNGGST$oojwrSxvk)^Mb26{vw;NmgG4aMr)PWDI#9}d`wlO5iAg2va#M%H$9Arj%X}B`=T0DKx&W?BX+Bp3gv#g14gdaO? zeB_J22i^BqM&;RX-}CrU+0h&7coyG~2l>$VGdLrn!y{dsk#r0Ui(LOp5X`ntcKlVT zKUYopTXpK)%8y>E4t`h}e7&+eJeFlsx-D|;G9<1%g^Q`M#L`9c^N`?Fm~A4QGEwh; zb$12sSxxp=O?d}Rxjc0R*E?+SDBJDTW(7&`K>){7>vvR_{#T5>Rv>a^I}!)#N;O`(H+gWT*7=b*cSGrkiG`I@ zUd65}+#j76ALywp-IQ32W;r$(>t3{d!zcSkzPh=hd-h|o4gKR|k+0&y?Cn^!Z}Hf;Vjs3X=sf_Rt9^w*c9EgER%?S;s&?;?2+Q-RX9craQL2WEU{ zbEt1R)Ptau;|Wk%t=GH9-I)vvEM> zw3S%0;FfR<>71xg{YEVHLS@|{BE1aaX9fCvh>B3dSEF7ntLS>+%HoRB#c2C)!QWWN zCy;uwgGUpWx?h#*L4S)KcLUq;bv4rURk-zWQBs|H9P8+QP@Mmv=d(BPM6TnS0hO^o zwZ$|aek*_%v4NLTThVmBg^q5IOx2UvL4k^Ecq>yQ3ZA6U;D{$jLab`O$zlq4cIn@e z^AIBpEtO{8n?kMSZSM3caS{X&C&bfd=f&#|vD4+$rqu4r)IkL=pvwv#@xsXMnc=b& z;u28T^fFZ3h`8zsmwCDqPgv&fI#XowGGaFld8e-buQMNxqpBnEU7_6hzD_AC>soLP zLR=PQry~@~nePU&nRrR*gGn61NW+=Uf6Kjm_VfKaL|-J=US2B18Mb#QmL>U zi*!8&esshC{Uup!!{0H=aQ=T?c-D1Qvx3(xnT1tY`K(aKywTylYvB+}$H#VjJdjvh z`hH?tlUS(I)WKRT^IEY{-*2bL^aS`nBVt6E$UfKI*ozy%eH1MBMB0xN49+v=fru#Wo1 zPMOqpGIeh8KQwkFNd)o>3TG4*&zx0K8k;?*ykahnNdzXf<+sDBy=f}w71Qir;DG0X zuLsY%r0LScWgCM3+Zt|u5<*HPu{`z2?KTJD*YYDjxYyNi^GgRq4L3Ara{z}KjwckX z#G4lP+`av8?rjAN9gO9wgzq#X@Tdk3THLy8zk}S{3eIsbmTR5{8Q4#_j^!KAu5mAJ zbT2=ub}*Lfcm@KKhbI(l!JE`o`hJrjL$P`}wLG8Qlb=*fg7#kLa8#D*w2?cp(kfC0fw|BK_ zxS`u;_<}ju2}}A2*c^f<6kLEelm67`8{Sb3H|zsy>ejHTd9LH$Z1QI;Y(qhQTx8*N zAHQmkdmZ;S2V-MsZ=mJ0Efi$Qu$14vB(&STjyq|%4n+(#i5*Bk4L@Uqg7@OhQtqm| zN-2;AggY*>^G(=abX!B)JgeZ{37GJ{->Y3sv2&H z{=I{Vnwcbf zG+?>b7@K2+>jJ##P2uH-B~-%=egxVajO8jbwdGj2hJsw*uou1H!l@;y;RZhfa~+K3 z>NhDp4z8i#hj=rr`=wJURTzKubf1(<08d}!Qtf^ZLJL-)jm-npURM>`s z#tYnz^_R0<4L8DqmtcHc(}asgPRw6G~5&`mtcHcj6^7CxpqBMdZ9N@aW~3{1vXh@=n!o!(XGk7+(yT z;1HLNj`3)?DPSn7|I;5sCO8x{4Jq)~&z>0dXt*h0OacMH_`+g>LqWC@ns0w};3SWR z8*_YEFg~slVBJz){@u5Sc{JP`D-F?X8Wpsm`xZvl?Y zW}iO@oi}DW#)Pi_#8$~;2HCtfD2BKBe8$Yd%-Ga(^pa_h!KXG&gKS0(%CVJ$(zSdL*K0lu;@sp-s)qHh{xfmr zzpyW*w2@DyBw!SNz@V@^Oa^nBFAs-$TikAsM;g|0pAG!st?n8bi4T1qTsJ83utxpi zt_5q9{PUn(z0nsIZXKvw&55ls%C+8yq0_oSxzXwiopmgSKh|6P9~NL(E$dt>vEi++ zj?vJ~P$0Hy^O}ROrSsiEF{~PdSw1N3clqMX_~=STSv9NJ7b^rjH5_#(0a327_93w==$0kmY3L8%wJkvu_(5r zqMS)K1II*Ott&eI+XC#+l51*~Hze9LdlpqJ)ZDRm7_?>I_e;g=6PZH9-Hk{Rmrk@w z?^B1n0GcpBG&U@!ruRlFlxpIL;mI3Brl6*|uFYDa?XYs9plfOx*0j_JPXm7|le41r z_@VjR;0cK1$K~~{%}iB8TaAz|1EMQszp}M?4RS~%W<(-43YRyL!UZg(d@OD$EN^c1 zYQ*xTUfi?;Kz=q_9GUB>_TKnee`&I|(P!hSDPEvho1!Qf%plq4#jj|tX{VMh$rCL| z2^+U8uPAH~3&fXJ{K+u_omT?}XiaO@UCUC!%bUE{FN+mI(M;FolBN2qrUq9Sthx*p z(=K$>bLXc6F!OPBHb1n;n(9~KPJy-c{xWcCnJ*ign(J`qgwIMWym{wbF3k$$=8L&g zq(*E_H0;V9rP$KkqLU1D5)UP}vu%;5xQSq;TE~_yiJ!Bma>)fXmGkGGQxlsrr(*G9 zb(&W(AFZ%T>YuR^PbB(GEo((NEwQY550_gY93Jk)ofF!Qcb}HsCS#*KcBi?#nv1kz( zby;h)$Kh(7TEkw804o>7%F7oaBdnM9D(=epODg77EMl0r`1z-xsp^fe~wJ9*sPKzLblY` zU!wGE=^J4!(O$e{QRV!3jP=qbb4#peEiLs;D{2~Qi{*mYnzb{m(!6MX)HO=$duCCQ zI20AkQX)#Nd6WZU4Gyu_JTu%$78rV8|Nbqvz4~jr9o{ma0dVP+PD3(l_uO}-pl2+YL>=Y(76Q%WZ{WF&yGvpvo( z#J?E@TxvOnvc<4x9!Up{pRNHd@E{OJ0e7OoI^jZFsn>AhPZ2Pq&5VswDe z_7?;5lEFFYEiN=Gc=h!e{QDa)kD5g%;o@I`QGly3xqadjV5%u1g>lkb=-2jj9NcOR zMu2!}di^?`Cc(ZFxVsJ3NiXWB<>UXu@ccZde=~K7YQTr%|C70JGiLhyV>mmraE^8) zo|u4gk`a0uqM+xZEfnB$!s^>9t6Q;T2i$Y1=Xb%G8<`T-*mRk|K9Mb5d*n-NB);3T z+0Azd=tyj-Fo%F}0?2;<#b&5iGov2G=e_}GZopoT0Y`JgMO!F1W{Sh22vp;=1ixA8 z;Xn=ET&(AaCsQ=X*{+8zM^5BqcMIdC2dr>73GsT>8!tT`An_V5@$y87QP60VgVJc6 z++C2+w9q&BlV)@WJ;Mey>lQqgi_07EdHI2lE83t3Rgn)x=a^R`MXHi84N( zqZoe2t^AR1Z_2!s9pkf{7@zON*zUuV9RrE|I@XaF1#j)$_*2fYkApE!;#5=WxpM68 zOcy{0N%9bEz0+!eeW2K3hFC3fROH~tDjtoI6LPVX9?FCz6lKlIG;#YP0t!IW6hEpN zl_+yS+Jk`wPm0%>Ik}-R4;1?<>~V_tsk1z~u*`N+Y}4b>VS50FveQ%XgafDJeVR~< z@#e2^;7YvD5ULCBGlja_vHOK%*W*yzK$YRiQ7Nmi&y3q-pZ2t$BV= zf13R^rQR%A1CO07aZg+F>xDKGri8swIPf{VHRe*P+1miCu=@{3=(!E>IaWg)gPFxr zv}(+x{LZHC0&E#MNHQOLAWiwonYINuW`r|GNAw&xfS{-+jS4{0i}T9UA;F<|PiF6M zD$97LO^&~ey#+_?a26T*27g(}mPpyTLAfn?!U49w*+OxZ%(|lY|Ij`x8;CUZ_v5#g zn`wof^QW&M<=EGRbYuHv57L9pP7~wlpeT3JlZ`ei*rN;$AiBi{4Y%WQIfO^iu113W zkVe8bB5hm;cYNYxQ7lhBMY`>b89x?VcaUwfk!{dHwAt;2S*V&A>m%XA5xtAHu$T7Q zj)01@(Q19BcQV6{Kg5?~^vD0?RXcUY?=b$Wl5K`@^yH>H+>HpFh|q)sQ6px`=U57Z zQ5{?x@FxG!yKC^}+(vk&gRxxi8z&Cfp&)$?;n~#_`7d`P!bc9qa&efX;bkJb*rzq|v5l?Sg`ww>` z0zcHyjC8oHuyudf`eW#BL@-}2uvx*zkhOzGHzIJ7#88hq^N^po8xh$3(;VP%Rhe8J z1=~>YV!rYGqQ2+@cO$|g2V=uJ(AZE2j?a*IvkcPzNWJ84L^#C3SgtPvL&H1|1=+0< za?o9q9(6Y&+zcCP^R5!lVsj0sq-7mYs$!`4+SKkBIbpSv3oUUe{* ztI^nS0pfmKIeqHN`*le&SW!7;BuRGq#%KmFGyc#L9~drC;g*ZxV%94KRIbZ?TtxrX zvf#gBScj}pn+xnu{8yW22ibgQkk6fiY}mT3QGagqVHjuccM`>L__YRCbggV?tT#XR zV$fL?Y!_YYSO{8BfEzHfgas5c>mrv9YgMqr>kxgGE9x8T6ZJKN>?uv5C9=7p2^Xbi zv01rMU2_s*NAK#DQbjj}8drD$hnnW)ywx?gJH0gSlo+%mjjH+VbTPYFLFzB_3eo&& zyVMmv{7XqhLD7u-0>M)f zagPdY9asjh=`Rql=>k4B?6^m^DLe^u-)`0GJmIj(vpUif4KKdlL4)1Lpf?1@HLh z^G%hn?Eq#?p8D_Lvh-3Tt|g7IJKdIUbLeZ;?;2{6^US8Y6iZ zBMQUnAh=m2b{-`5|3Jmu1k9s{%1`Vfv*qE(wIbZj7~PAG%)*uU>wN$jR)R{%I{|2% zaI+*xcfu_J%vcr-jN3knd?Kk|!=VtEfnyZMsi>qQOTT*`?EiQyPI(`vIJX_)#t*fU zcNP4bJP~1^pq5AApXOhI@4^h0dlUK^Pr0PpBl`l*)u<+d2_p zxqbMvLS2uy+AZ}fv@Yio)kYAiNz6*Mmz5P~Fyh( zYGevPX}~NFjm!ea&RKV=3Y@%x7u+@LSfJR|JHiilvCX3?--Hv^)>>-q_@VLQ!KyEc zlP$TqlPNxGi1*H25T!%!+&I&M|L3!XKFA*r@ueP^@+^&~&VXv2ajd^8vWTbV=F_JM z@$|g>bUcbxCirs%wO5iv{Xw#X{oMu>=^9} z@u;p*b{aX7o-4(PT9J_r;1HxER*_UEM`zBksghiP8m9l3Tu98{- zQD)`T1hqM?ouE9)fG`tEtKTT-sqE@C5QT*gX2O? zeX)%Xh4PUUO1~6J+*>G8W?!sXw|4-DtNWLM5YYKqpz`k7dnm)}|EM)DwXn?V>gjK& z`^bp<(U?Tq43%%GZS3}N=7#-;)+QUZbY+Wn2ox1ugvYc9erHI>R(k|jr3<5L50oJ$ z9o`;K2Rw2u|4Ci#>{+Wi)=dsTIef>J3j&G5F+fp(nU+p|e&xu4NM{>*a};U}!FF8P z5=icc9~>hL=&*FW1Gz@5)4tE)TSsI9qxM1M%Cg3lk(Qn}S4Li$JI)GP8SG!2$VWPF z6FQD|^km{}6aJO6aTMA2v4BZMS680;vp_IBAi@TnI5{@(gaL?Etn`U1&{hw!5H`^( z?TAtVRZpFFBl}`|=1q-8y121Au4iLaP4|upb2K*7fF?BAM(K1$$)o&!{^Z<|`L;yH z@G&MY@#t9Y5F{=$7=ex}qk%}*WRU5(luf5%jVLVCjAa3+G{y%cZTg2Iv&`@y8M4ge zh79u1Urf+q(Sm7!3&KF3hZ2c*86 z{{dAi>2}C)%klyGs0@Q3zNg&0MFXUAx7ae~D|AokYy$LIS_sQ*zQbyI?7G)s+grxo z14sSZ+rB2~Nna6@=HrBP{ih5`$6ZH{U8L(jVBOb3H~29R31I5_1Z>7BM)MqD zKCI(%wAsUA=@DpHqku&r2PCZ2>=w!W_-%a)0gWMMk**3-3hFBb{Ux9&3k?VE!n;JM z`|;K;_F+)k#Xb#6yVKV}X{Y?QW5+;0k6+;c>sXCYXM@st&AFhKiCu%^x(-yW*iq?= zhISt)4hZ1@Wsd604p8dLTcFgJ4;)vXidK#|DD{QM<223}fYN^UhoHDDgZ2kdI)3wD z%W|=MA5@)C2VlI^+&CGO`ZpKUsp5LRV|NiK4Py-`&6g`dX}(;F;Z^frbA*#{Hs`O<#P(xpl=)35_snt*QM7*g)iF0hLil=dp zh&^1KI1@hw60h4hXjFXXCB8$q9R%*zvdGz5_~gGfO+4YH_blJrP&k zse0+hbd$C#PafEYhL}>_YFwP4RiY!GV3YwvmmO>}hZZ~u&2^)oEmWM7Zx%dhhazaO zgUS<}w@2iA{Fnmea26n8;^AG0A@TrCvSGgY4?py=FRR6-$xKT8n&?S)7f+` z@LOVqQ`a5a*=SR-3o&6^<{QThhP`5HHajrrJqRR=vpda=3?#d=v^{0##}Whhpi_vl z2Z9JQ()CBN*1m#~dpYa(6Is81nf3d7_+6DAQJIb}tL$C?%^f|BCYzJfP0#8o;W;c` zcUEJ0dNx!g&TWaO=C4M2+D!}-pSN8WdM6C!HcDlYn|m{}kyg%cs#0q)&~R{wbn*aJ z?`*LyPqjA2Q64^ZqMjknYwT|+GC8S=P?>=sUs~42ZZz{0<(InaYi3^X=#iz)xwU11Tt7j zAZ&JbsViG7AZs9Ak-EI4ceWV~m$xHZOrbHW5_2&TSRF_nl%Ctt(LWYic(5>l_CeFq z;Olp14f(PXzrq2kj9DerB2cS^S`Ml~ zDDF|eSg0?9VmRRdKfq`Vo&?1l3kO~XMM*$mvI*{TK<|(FI#d81V5V%-!|aW;BZme@ zXnlr4h;R4ArfjXQd#9>&<$}v*I1O&4)8IZvXubybS=)9aoxg)yRl13#ib)r$-pbYK zx#LjWA-43oxks_+p_hmAM48)Nyl2kTXd=RW3mXpsN5>9qTtJ`DSDD%|u!v3Qx}PB5 zs#0rqSEcH4`^I+uO4qYi+h);uH1f%|mq+1_fvP&Sb70{Duy;KHi@v{m{P0YSBVWE6 z4wxK6U1)N0-xfrGGk15YoHZYgbXU`R%&hJFnS+E8_aJ3hGqKfDj^)H4d0gf}M*$Nx z^_WrAQJn$4+bYuK6Hkt9+I3*8V<)<(3gkff#C+=Qm~3a?;-#j!uU-}^80QDY?_MO~ z-w;11N)j9NERzuq@|lxcoqJlHJbev_8;XB6+*$m#o8E$qL#?5;cGI72@4H7zrJfOn zQ0U2IQy;bY>?4m(g>oILbxj;pk&Zcel^LPII}yyzGpQudVq#Yw5>lj-I^F@Ju(xWq~yk94nx6K%>Tt$2+yJt+9LxC8|e3#U^pzODFZgeelw8*l0J(kLd6mqczBh~rsnMQcj56J4| za`yiTOdQPIY#-AI>uRSF$rDjtGGVamu6<7-FsPnSiHoBSZ6>0k{VEs6pT`4fD@sxA z&UYw|quL|3gHqfNKvB>IT`!=jh3W^TyxicR9OFPK2Q^qI$CaRz<7vn45cEE3cN8e? z*{6Y0|KbkC3AXy&2ugisAF4h-2}*q#iT+V}d2U|)n*d5jiW5NTNa0MijnoZ&tcu+# zxW5d_7O|%bYx@1A2CDqE3K|VHem@Yqp&S$ z4CZb0J^^eu0>;;l?B)SMd zP0^X4G(~Yxw&Zzjl+pc!sEIOg6!HU~{M^WklRX}?-4U2Sr1wMYX z2_K{|ksU@%@4OON1UAb3}}gsZP&5`N3m>zMEfUl4nro-YuIu zc8=-jAC1j<4~~OV=jP<`>GR4k5C8IPFjic*7k*hS*bj~ef=N69PN{Ps)a%>8NOVKR zcj}yys&tF9uTVdF?Zii~?N+-k8ONhD5S^WMqs!BAe(~Bad4kVfk_jL8!=IfUC zlUJncO}JSH`RsLbPu{jj=Tor8m#*zlbK2t+0GBcwN8(j=YO*JC{SS#T<+G1yaZb0- zX#EI|`-;|$a2xbBF49GD1*7FeX|=IHJhwTPi($EOe~st1tMTk@hAg zu_Sjw5@$%ykeSsxujOd?<|aRJEM^$A%9Z@C*C3F>mqbdIm+25D8(23|bkp}sEFkhh zX!mp~C><8~TkSYG*FobdP&!mR1S)|?^?oYH5y;=9*l}0kTA|uNu|o_8c-6~dp?IkH zGNJZIqfpm#K0w_v7!hyFPYA>jEu{#ul)jFY$0i_b6DGoKqq0V-wticMZ zHl?}yzS%}Pe*!=8J*?8Kzuix_mp&MU)8J3H7eExxdqX0l%UU91=Ct7dGW=hL{|oSc z0sfcae_3R7ATl~WIx>1eG&1`9{K%Nk;aMDwj5&LBWK5{i?aKe#-+t|=#EP&4PdHG3 zxAxZ*B&pqhfVx~<@5ftv_(wsVFLqn;)>YQ8L20(W?AT?kvf}Lb%dmgD9C}A}u&+vg zZv)`C$RJhmVO4rfOQoHGVx8sC7`BVh7H*_Px%ng@J-d~&MLId*i9vIz!(Q5Z1y&hz zG1kPfww}K%etHlUsdaW`-Byh2hapgRbrtE%1AEq5%^BbLeczeKVWcZhCBxOJcjDb# ze^vBXb=S35bzjvk;sg7+qWv>fsgKIjN$9luE`!3%vsZTULW3BD2oU6$Pkw0sQ}7+t z)kl5hN$QbK*QHZ4US%#)ZzzY}$X8}ONhMn(p746;Bv z3(9{y%h8drM|Y(&bEhNyK>Sq^2s*Y%XAdl7Vvj-fx4d7%fxZftj`h3ILy}3R*Q=ef zfZ%MO!a4`!PDql|hBWcAaxlze(9c3{4WU*~QCPG%@=3`}UL zY+vy%0ZKdAa))9Y)ULJ;)G|C_=_(cXA%1^B>^_6yy+SC;YSs%i2h^29B^~MkP%3Ys zo+y=+aK*u}!+{Xmi26Jpl=cMFWTrjAWKi07w1DEk5Dwf3N(KJxh|dtak?3HR_aIQp zOR0_aBKe@S7vU;I?auRVEktav0~s&J=#T%&a{;dyzp-vXSa~hZqybc?h zaKP@7W@ge1#}f*E3vbSq9=PrD8uwg4Cv0ejJ6u+k729(t$igIlWBotQanA*;qZP~u za4{y>9LT7_u;qt>N8!y}SR8-k1NU6O?GDDq@B{_|!wMG)K8ZIyE*?DzHsq(7>R>Ea zr8-DzLcv?`i(JQTeRYO=F5nyoW4WxVCeFj4@Xok@;r+ai-E#q7*Ti_v1>~EQ9w1zM z@g9Ze{hvRTa?b_KbTBro3rysRb;BBQ)i*lba{)CD#&S{KMZ?KqC^$)I40YeUey@8j z;AsbAx&CBwmDM^F{EXpx;Kq$7x#t4jb1;_co5r7ra81XX7T5fE{c-NOfd6zbmTR){ zXS8s!eQni>2MVkj&(4W>q?WW9Pptu5HTdzn#S2(u7X0l z=bs7+)dLDcXb#7N-Ufa!hIN-7bB?Q^u*kt!E_>2soN(RAH=b`?{k<`+f&8E zk#G$Ks}L4L-Bpthb%aQy7}1mt>PRQ72E)aE#y$OU-s6$~q7CZSO6*IYmd|BDU|>K~ zjVs;^7j3oT6r1|v+B`Tu#XZtYN z`!A|i{61ecC>2%_ts7R%W}Sr2gAM+ZFR~BcbF4*Uc;FzPQ$8D>MHsAF>vm<9NGkak zU+8rBhPdiWF`V~Vqc$H5%2lh#k2uAAeh}s(br7$V+%(8$h7Cykfd&!p;TZS~8?R0( z6V_Q~+#$1i`JS(IXwS8lHHsPVVQLZ$YwA6l#T7Hshao=??pvdnh5An{mHgBK@Lz3s z!?87L!?mY1N`7OI&&OH-{wsz(ku_>F#+UYeofWEYZCJT(n%4ab!J$V_+T|RPxaldI zwH_KrP4ZERmS0l8&S;)ki9+5*TrLm#TYDMyRQd5^`7xh+R2c;({u3G3NY7-qQ zcsoaud`zo>aoN^7!9a&K)F7SjsH~|GHA%H?O$Aa|HHkIUmBDhWv1f|B{(688YEZ;* z#;LWo4kvxw$Y!S&I*SlL0PCCDpg$WLvGqJvT`h9MYdYx*|#(Elzt!|>s!~{D?~qzma>A^Mf-&t#h;R_}f2o zXMr$t6vJNI9!GPNAd!O#sbp(IVqHyR{o4A*T#-P7%26r2rMaTMC1I5?srS-MrFPY~ zwl=ro1R4?NYrRC=TR9pv;GkGN6o+|S+8RV9n8(G5Zew%vCCQeWIvn*wbxqX$^8k%* zCx%#~orZF1bd2k?#>Ta4sNtp+_0hItwk3qqTE9|l44tDGq*g#p*veelgLc@kqP`Us z1r>w|_0&+&p_Yruw4|0~YfE#R(ez|`G_RGd%CqZNq7m%FBbgOQ?s*%RR&#OV5bReG zrFm`2PEsd8$wb#XC~Qhf!q~fr_P~ARO|7T~$`wBrqSS!ww$iY|mIM2732KF6e8Hm3 za(S!0I}S8LHyUcc&ns09wZEp3W6d<2m7M-BPX-p27MB!8X?QY_V%b38tMj2$z)U(M z?RLc5$NzuJ$-o);GYUQ7tw4O<#u_oswHpi<&vF8(xY!E|+zs59ftkg17Yr9Lf-5Za z;hw-c`gUNJaSjbbDT$tF%Fp*sf;usAxDhk%v1S#_iMsk%WVF4K8+Le_fcdh)G5ZXz zs1&p{oCe(n%)F@DIPohg^~H}ma(@WS1IH-N3AdoQ)EmDqzzoCreo%;S!yNk+u`s8Fv}*Zr4zqG++pFt zRe^p8m=ROd(urR|u`gc^f%AA^rW%|RZkA4_58yBhm=jM@|0rzGe4dr>O-KdoZv*Cc z2IquZSl~O+NuKwCnRK%H=fU}uTAcysQeZC2#?A1bT$}@38klFZaixA8Psbr0e*k9q zG!55HhcEj?ze*c0_ZXa$FF5%rYc^$ zf-A~}E0|e4)8pYmpl9dAmE?N^CT>Aa+$`T2;A?^VJaB(B*b(@x?X9rL8!iPs$9OZq z!IkD0fVPIX!d$pQfB#3^oSe9sK4oOg=OwvtGkwXB{Hx7{EAacrd}+>!%b)2@FLCR0 z;R=g=0pA2%8o1AxOyK%W@~>zHyK2XL7Sw6L+-h)c`|#^FI}f-!f%(Yb+;(2-%hv0F zI{-cLO{O>Ino!GaMv1pRCt?2tFsGQ#n5%!ml@$0=$1VKJfw|XoPNOU?O9$U**iS-5 zv&XNUbf8)Of9$<^d{pJxK0ZSR1yKhS6%=b&MBFeNBoUDeBrwsi35Z%~Ko+GUAk1Lg z0+^&P(=k-v)@obVzP7ck-ECcJHGnm!t>A8}RoiMMjasxCQK|V|*L^?FbIzGFLHhgF z_w)VZ`{Xkx_j%5BKl{Gix4-<6e}dn_x(8W!evjGAp9$P5gZ11i3gFoNT@K7wL%8BV zdqCXH!2Bu~S6o`;PnYL`YXjy6lj*M9my`sqZXW{N)4;rLa4vksMS%)T+&_Sc8c!Uq zq&zS_I1IRcz!c`SOw|GcZ5n>R0&b_lx_Vh!9H=2|ulD3~uRPfQo(f!Fv=Ea_E8*NLt{CedmoR*D z11*WI=M@3riL6sgfV5_t(8-3rVV5it zzzo1oaJX>q$F*UAyLbY0kW3Mn?8zyvqR5ZigaECs1?Eh}VOVS2D+{!zAH#kIFlW{& zuCK)vmj@cG*|7f(FdrJ6ZU6jQHRuA<;l!z=JX6)be^oAy;W;S}?v#?UK>jj6%5rd& z6`AYaAmAnfcb>treW~hS6!JF-`>zA@vca((Ax^G~_H@lNds+Xw?82hjY~2VR)r~iQ z9b7x{i}2V--H0loYjHBTik2-eHcp$$QxP}>7eA(%RuSQ~mq2iq$R6LT0eeMV25NKUSz-HPaIXSuftf4~jPNd{?Mtc>YtU6rS%1bq${H3-v0VT|y0mn;!_JId!(G-qh<|a=;W~ z>zFkhV9B|z^issNsHp+BGUnm(Z6bZPzb86G>m23NVPHx)0Zf)Pr3FEtAeQ5==uzm7!&^XD~ zmhOjuFEF>ZSVG_`CmXz;Vv9!Vc1Er%arlhXAv_V%WW`N(h$H5_9~?`K$3Z4IKxe z1kaCz8icIXBEb6v9Pq>y+g|DKXhS=d=(p${iJcA`)<_|H^rg+k!WRc&>dG?W5QUm)Sd@h{Se*0a0iy*j(Ju%_}o+-=!*)j^5Y z>Jdn*w>rwu6{3ZdcbvuAiIbG~qd4KJp_W8*{d+&a80N03!`7#c#-$lV8V4}D=Oz=G z-y)+nu0uxQ6fmC2rgejGis>1WCKqt}Yz;hvF3-@F7lXhJ@T+D3ZZEq~K!$CiyXWF| zP3kGUqlzU&n6Jr@)NhiRH0mYP)ZT+s>pVQ@KGfARFrFh}RJw9J}>oR{sJnlC^#?2xe6aKLTZ~6l7 zh;{1ozAGe97;il6o-(fvSKkt?lcP12e?#8JTW0bmdbVaKUOI|FL(T7Q6cILus0FAC zC_nGvB&u_-bMih^CF2T*M7BD0{Ftto#6)_~Ql??g~=c$Wi@y3D$U>deaJxc`;L#T9c+ zr*ozYDWddh_w;!+t&QE)*(L8Kx^dqI^{45PPrRYTZ)-B2)MVbEcL>;3S9bg@>;Y0p z8-+P-de4x<1@3)j9?^>inVJ`D93_5Njp?{m0;u6e@=Ed{wQy9>j#1E50)um&OdR-q zrb3CL0MVPUEznsY3DQm+-Z^GW|fjnN}f3 zyB`sEQ+MKG+z#82;XGozc{bVv)P9r_+`*1F^S(Npi1NO5~q8OaUGK@Nm&?GaLHlS!8iii|He6$1kwtvSTAjIc zxs<9z_YP@taryRPEnWG)5jy8}k1^?~J-?2g1O@D$$d{pLK6%0V5wiW>(?arK}y zzRN*re5s?dkNEZgD2>~nL21m3v7n~z)qqm>&H<(2`ynVEdyYkRfKpy+z+~)Wk$-_w zjzt*F>sKDb>?dEp1xj6c0+fbom$TasqaGfNibbY^Qdg+4OI^7hl=^YIv%3$JhO``W zc6IO9pp@ffP#Pm@bWq$NWWg};V?3y0p*|1lSfRcRN;&p6SA7V+V!U&ojM>ura|)Dg z7?j|}V2B`^7m07;F}S+y(yG9;0r%u4VjW~*mz?&jz}kjXD9eL2$y&l`{Ip! zpqu`9=Y))BU~4x1EB>oVCygjPEt+V0HsW%-Abw31KK~l25$Qb6-H=Sge>KH{ySFNQ z+!yA>TMy9yE-<&WIViFzHHt%_Ua6s&9WtFVU%)J+F}F~#4f4i1`IG5bxWF{Z@4~hC z;*w}0+{&9o$NQ4#Xt>Ap$>(0G8lgU^Fy7La-D-BqD7ibg2P4z&HjMA%o8AEl{=q%) z$6Iy)Q0=5Dx?2ZZxqPIpKr1Nj%Elrug3=ab9NzUSM~M3MX;Aug3Gzd~ejAj2?E7|BRYZ|EFxgZQ@vB2&+A+MCBwHajg`D;l8W{&pJQ}VoY>|RRXR2lTqT>;iAlQt( z7E1wk7%5krcmc$g#3La958svlMu@^&{bc8U5CwCRNCWY#*Fe6XjuCOYtlNo!G>o#U zVXq`H&<9CEjR1A9P-URB@tXol6J-u4ZNwM5uU9zg%b>KQxE_QyrZYtc~F|lT!_+Qv>udp zfg3?-if#d=94~-Uj<-Pd_fk10g&{bPH*cl6>e?JjP3_v;Cw*|T>A@Sph6}VPI|E#@ zV&FC+)84(kyS?~DkvVtv0;H=qa7!J8LE9_oH^en_ZBeC~j)!AjREFV=^?>(~=h&Ob zD)$3xg4K}422nrNwi*@KK3B~mMrt$2a>3Y0v^B>;hH`3`Qf?!xumowY{v4Es+G+%Wgq1t~hX zE{|lDIaWr(hD%r(2^j@Oi5HmNVIAbh%pkbupDW!B)~S??_qP3}vKr{ejpD57*pEqc zRgXBjSLz59K2|^}d}if%C4eG%!hhqc`6jxEnO{>wVW0FB(u;H$Uu;W(rUeprY&@>t z()?t+rIf{%5%=9E?XM3FSZ*%_m%F|_k4L<$lMGw!K$cKT z_ho&n`)rA~aBhGiHwyNRbI}JR(Nwp*s7v?m>Z>f>_eFp^hwc?}5Fqf`#*`KP2a+Bd zC=HP}+%0~zt};z!TrF+Yt*O4<)$!_G2v|QAB!#v7#+6t{F50V?2j_a38VAP9gbDFD z*w;&;QggO|V$UONfpDhw)1=k%Eqg=KQB45waHLQyG6U2RLM;F_NGP^KTJj%q)a#%I z%UA9bDXs+XisP9;rE<$B_QjyFsH781|4*1qmHr%>r*@h=M6%lCYOR9|*P6|yC>;Zz zG?YBLqkf9}kR&Uqtzu^5_*jfzs9Vyph>?a;YZt`ZYg#XrPTm`dA^kYS;2PA~TxRZF zn|Y6+HSLbo#8Lnc@qvZp@I$p&i z(bSGr#m41WPGol4@BoG^<(ALJ7}Aw24+C9S`7yJd4e()A@#b4;W%@-fJR{iCFu%cS zv#A(d=v-^d{egZD%$^ly!Tv@PMRKxjW;?FKx8kSZB}8ykN8inyjX~6IC<9CPbt4Mn z3TMB*rWV0C$GRe^`bR6C17Aw(G7qi?p2d}cyARRxT9w1FCf1E;qhXJKrIS6;Zam;N zgf9JtNZs=Yr0Q0d5gnbBfYLH}iKDhS>OD|L!jYJa`HvE6IG)N;18RuaEpv8RXZH>>^Vx4KgVijp||0n`~v=DDd-p0oW~1Gj&Qi^H6Yr{=myg#lWhpsq0U z{8UIC>s^~2Kvy4kuKoexgd#f)r;HvYpd+2L6N1j>>ZCK0i{Lh#^+eYE0$g^8k8$j2 z5IuA)-p$m>uK99c)Xc%9?3=oM#)XhbWU2|o5pDC<4!iyPh!=sc^AevVw(iHnKA>r3 zHG@(^NL04_fvHI?FRptM>%UMmD3VG{^-GP@rnhr=4_+>Zmv-wiw|$0Bot+#q^2&KE z;?3D6!%mCrG*BEY$3#-8;#T2ZE5n@*_fv=43hEefkHZzE*iC+fH!GsM=}j%zb(yx> z%#O@s=vs?pKv~DZbO5NKd;iRH2G;w` z>)FIAPe6EPrtc-2SnmJgd%;Ag!TSUe_5QbPVuA0Q_ZFB;QS>QFUA^QT^B8I=F&Vdo zs4>Zj_R)w-L zX}(o}`a6EA?^JVo3EtUM#YAAE;%qmV%x+kZ&;A&0*qCc^V~z#%2Ri=DOsEa?y$uSy zjWTck#FB+gbn7!S&$mwLYTDhk_E@w5t=Dw8>mPNci4Fqh<2}TPa1E#E{Mxm|PJ`RpdQKwUpP7`lOE?-5blD^j3F8`na=V3Iz zfFJ8xzjPb^Np-fH&X^t1js}HRM_|%=o52_p{WuBRBv86$kp!g^nZ=+eEn5|tyo`?G;z5Gi+ z#86@eeh@8`D8jEW*}ma6e4@eO7iMfSGoUV$=wFwqg&LBlQbVx|2BIz5%1J~d8L!!f zDHl!@O(}$JdSEAX2lSRNnaLF%S>=&QkDOu3i|RBvj{|=Qs61Rx*63UW)o)@l`-P&; z*!na34=}zOHg?ZK0(5k~GN5&(Ej`SZ+F%`F^zzizHL%`|wlf>>r_m$J{lf{mkr~V!*^SaePb0E;g;(~3@ zGTUrx*7T;1hw4n5Ui>I$j;h6?aQ@aqz($!aUO$9h1RN%35=qsG%~j8RhXmKibnxT^ z(iP3^9is?%~PIgROquhWu}0lCa7puf1wwZ`5O{0Ru8_CHe`H5Zij zQ&)f*gO7Fwq0wiUQy2GMMLE)&XGUUaBuMvWY62 z*%*UBor&))o2c-;WoG){vI*PCaqN3_>6X88C-!>$*NM6j#0Z@xji%4L+*7r%ax z%%uy^rixM?4k@&a;?P^$DCkD0fae{IDXGVc!~U);izjpnO$&avD^N`9Dgb%2#{?i8xeV& zS`BX9j__?g*nu{pe3cypVg7Rob3I!-qUF*1;Y}ny?Xjj0d&j3fj))J!d(t2Awbh+# zFOFE@X&&oPxkvz1XtU*>7cY_TDP)4ODMq$)j_gTtI1;&?Nc?(15wfB?Ts zljv2v*>Qa1CHNF?`5m6{tPecv_!(%N6X=yH?3z^6O9C-G9EjV1%8IAWZ4DIg&NDkX z0lm^;cy{*B0NBy69y_bcerY`|vxnDZrwziM$Zb;Q62FR~NFiB?mEy{g+}C@wD6GAHRH}Gp5s`=wP1<_doe>y38e?Pd_c^C-hlj7{IXCNq8R+a$-x9K-LybWNkbjr#y z$KP6glAyF`&vw)gK{1MfSxa^O=ca*9b~Gm>WR#6T3S>y&=?A_w_|k+H1ZF zN_)+ZK|t(r^G0}Lt6Cj37+{6^IZSNpvOnS+ zAen7hkAKzKLasJQvGKMRH_h0e>6N}0N-chhf^%mw`^$}FYOiU-KmO-GHk0i&9P-kJ zX^cuee^=*VbFjGG?sg@x7u{Ofn{IYkL7iCD${r3`%Xjul<1EaXxLa@-jt0Z+NQ>;Nc!2%12Q{4*pXUzVlcwI!*w5y#}?)t`92p#IeC%AP~P^1C4CSQqNMw_)YCax3In z|27f*Q!+arpU%V@xjj7maBcSNLa$d$_s{I+v8BFE+lO?pz+emwMQ3NKV?0@o3kU&z z%ZvYZ4vY!eqjc6TVB`J1rtJrI+`yd5PU6Ztt|du%NG*eNgLdKrwwW5|)n@)w{9@-( z=r^6(vu<2enyQG(tyj(9i#z1wlsE)E|6Pvf4>WC$bsmYG=ss0l?dTtETBiy-kEd;2 zrqcu`_&wbZ2mJdKcXzyr(w@Lz>CXP~7T$|vE_WqP>Ywg=XP?wT9go5aw+~tqL-XPTUtusShn*JkJUp>TKK=gO_|R?4d+J~O|MTaWb$5X9@U>6?vi$R^dj zT+kngBM7QXLa%@@e{O{{{cZj>Rm9RSi_B}|Dzf4UIoj{i7f~*ZH!sCl26BL@C^O#7 z1|$iU7#S#+<;|oO@{Z{@`m*zdu6eboBAOl#q2>KiHLxWJuHkT^X&i>6FG)7fLXe^7 z=OFH>XQ#ek!X0nn8Kw?y5&)aVoO_aUq2+sE?05;^8Dh(@>2WsFHS*dyv^sn7PKhyk z6AP-&zz%1kT5lIt{gR!tQ&=Q;R@Wtp*n>zn4$EBpQU3baNkmVFHhe7N%I zjw>0R%zSuGZ_Yu(VAl)cn})%A=E~53`*g#*=n!w+Lz%ALGT z!QzRxxND}(X1dINQZp%g725hZ%lLt6(T<+LH5MqJVWn!Xj=xQU%v%PUEy-By0Q&a1%9!} zPWSag_ceyLPmkBdL8;4>Sq!C#kM zTU3)>Ixx}oaIbWc4ulgQJRFG>VxGhGEZb^g#D-SYY>wh!F9tlFhfZx>;o4qw{!_D! zeNgGW!w~T3h`P$FB8{b3GHL!3{KIgZL*dRiEw-x#k30lM92Q-1+7OE9R^*KeiYiTEw;aA8Vy;m4^Hb>i16Jxo;&Vm)yhLd3P!KmgMF zb&kcie!fFinlzoq!1^e#pwY`=xs}&Dy7Ha%<0{SB0IbUU1zQhPaz_7TJT?KrCFTR25iC;XI((};_=DMP3#hF^)&FMorPetP=Gc2`9oxp+0 z^_#KUFKT??`1+5cX{dm5GduB*b5UP%%7knLf<0c6Xq=;%yr+xZTu>8)TH(I7IEqL4 z6nC@3@i1GJaLfrUbxLBj&cHC?Lm}miv-Uz_Yda(t>cBEQ&qf>y*R>(|94M{+oaL%r znX}_T0zI)DS-fQF!u0Y~q^Z}Y=ylQW_xf7&=IGaYG0K|&;!Kcp#SifR5d5d=(yG)zM{%b4E4)31-?R8Vir;JaaSZ$ue0u@EzvA~ie(&OU9)4WrNH1H zIjY)Ge(7_FmZT~E8ABWFpg{WILSw^dGTl9+5g&d2nl;uA-BS*RHfmmAn+L;ODu^zI zOK7Sir*|B5wI@9OWrrz@sO!uL8gx70`aZZ002S@`?bkfv@uMAvTz;t*Glh#OjLs#p zr|F<0dy7kWku#k9&o2eh-y*x1a%<`r;EuM9Cd&fNev!h6#-!6kh+!{?Hsg(D>g|zl zFZTq@zvD1A7OMz?VVNk17UD@CuDiP9I#0m-T8FV**BKlBD~SFCPsV-F+$EoQ0_JaU z7#qSjP2hO4!P)-!qMJMc^PLW3xehWhWqmD( zvI%1d&-m?+mw5u_4|N#J#kxf^0KbChKf%J({P>(3w|D~P&maJ10OF;^;zwR*BuXQX+FbrEkl(nB+xBO()8=ipq7KgE1*BhIG!o~e`ay|3S z@tvN4`ENOl<>DeZ4NpTBL?_`%uB~_V>*EQSU*a&9>&K=RaNDXN$}t&J@&AQR>jgzKw(;x~5vpC+8(xDIs~ z%k?XhJ|_wnS3zj;^1R{oCpxYN9L933H8vbk6+}67X4L<*?x6oZ$#GrjFqZ2=He@g- z<5v*fh$lxUCEE_W^<>Aj!eK1eMFhc&#;+in#*~?p%241?B7=6xK=xizs8;7xe)td5L9^xu@T+iP7QFqaqd-*o$9!ba~R7t0%#geIlUHO*W$_dk8@nCu{7gQ zqO=Jy5sh#r;&H_n+|*~7|T^*O3U~F*ZTGa-yQF`PInl~wae5vj%qx=*xH=# zxVjw1avfsa;q=qvy6}^$_e^kHgB-?k?JzB5ReV)Ik;V_o#yT)c>fQxPKM8|cP!&t6|O=~*J%wLkvK6vtKSFqZ34W0Mpv?wc`g+r}>aebRAlcNlW{XOU+K7kSwV z#C|qmS<=lSziPN@1w#px94mZf?2jL>buNFyVG2!4`VPeh{E=s3l^YhIiH@22)nwE{0YIBz3jcByf%ioE(p1Np6Lhag2w&1 zP#RtsDhZE;@{~Jj)~Gu_3&ra)3&4NHydCm=|ByR>2-$24xx6iexjkg_eyHaDDP%Jw zl!M<1rE^y(4Syc+t0x6tPP-RkKNm?{_G^G1`0r z+FziLNt92mShzg+IoDRan{-y4MX53vpH8tH{bE+VnDF`ajcMqV-Khf$XdM$4zviLk zOD>>4mG8tbn4gR73v6VdR&H`Z6k=TG9}ibk?~uW>2pV+53`C6k;u0 z{6#S4ca$2>Brs>!oK-vd-1-@bvl3H9*O}Ndt<-(1z$_=^)HCH%gEnK%Su>{3su3Qw z&YMy`jzyw{Dr6y=)O-=~rKE<}gsiCkd?@3BI-&g0WALEgN)xt66l3`5C~?bkLj&Hk z*KoAxQ$l9<$if-0Y{i8rl|4ji*$RAV@M*Tnr${a*pAed23C)^F&Dk^RXPjAcE^3=m z{dNAbl+Sw6%2k&^E7xkMUxV^AtAS12V?wFMJwL!XcrkP|En9Jc|6AVd7o}u=#dLWC zyLx%RZ?Co>BapIt`&_?t`N9j<Ue&Bq|st%OcYC1qYw2Xyt>5FiGHPt zcHFQ6$~@<+67`1?FKfSi;Tmh-W76zJ3u0a#q*PJ8s0Gy`g?DKP!&(weU8WL3X0<;J)8(r~DwOBBjC9mz=QSms8_ec4>GQw11gc)CqtQjdH2Z4V;Oq3MfK%r6 zTotf-99>r|U-BlCdjDlKs`Ea0ftAKroHjdryQOZIg@w~=)s$3RW)@Hd{|h{C2WGZe zvEX#xXiDPNnllTrGV)_!;%2phXE_8HRL~iD3HF`9w3`_|ml@RGpvEyS5{$uPl36X_ z5`o~x76<%g_@)xWV>>WhUKHGz@<4r+AA)g04_2RAJ^r@1r!y^Zp2sf;VJ^r5G63T z0r#fCx_IPh@~nfuUBFD_W(17Gm6rt4nb}omFapFw;xRU$KvcqaZa!Q^1vgclVU{h; ziwkN}WcsD@;R2yU8367}z&&lSE$(;NAdc6di_f@f};iEmdcD8m3?5X9QPS90;Ej`FyzIpaw#g z`=f!o-e9@RDDIVy3Ajgpf0NI>%77v}iN|C4aK%MqOMGFz4)pWDU3i#UvRM#+$BZfS z!Q^bztH69@a4!9dgY~x*OffVnp0;l?5vZ z6KL4(R`s6|(ws*3&M+9_X!2=xV|#bjKHyk>&)G-ZqJ6}z$b&njJg7mL;kzscM~!kK zM#2+r!D}~>`&Z$y6F=OUZc82CURB5=^+u)x1uGhvNh(moNuCp_S~x$>V|LB>#pJk6 zi%>jV@gn_1})V!%=wzd#KzRxe_@970F5=Slz$6-zEJM zU61rn?cY9GIvBj*7XAk)+z@$$mtN_?$U;c5e(lh= zzcQ0?Bj=G=s&D&b#y(Qq)^Ex{SVA}wgU~B|6vZ)}F3yjF617p0)KDlWL2$}Dp|wS? zCh)==Z;jyt#4&Zw@Y{a~M}@%)4DR|PFclDyP=pJ8_W~f!4~Fwak<=k|*$a{s6y5SO zeCfCh?nZbv6KL+FT=$;hKTu!+xTLQo1iri5@hZO!q&r)?x^5s73Z-m(Q2oe;U$!85tI z&twXl zv@o_$zK~yVi~28n@E;=&R9#+tQ))RVt+1DX(n|bapf(Eb7El?X?g8~>p(tx6E7a4V z*iu0Sjl+#Z4OI6|0j2JhgVJix%ZRPQ(Ew_bQ2!0;D?)t()U`tW2$cHK4oZ0sMgyQ6 zBS0xf2`K&Q8V|p;Kxs=G;iA!%kgd(%Tq4bl^hMmgLYkjzivg<(|bRJjS)_KakNTEpQCMwelz7dm zjY5^2Sc?0F>s@N>JC~7mHktr{)pg755`h>fSFwse8Y1 zc9N11N2PMIxCiV{VWWt%(5RqzLfYo_09oN;Pg3S<1*_U_TXE8h`~~{#d^=7+@n!ZDMc!?xi+&)ZL`yT)is$x zore%E8|o=us6}S&)>9Ay4QUN14e6}hP&rY(7$HDgEu>Fui$d<7_?KzyZ-r*@r2E16 zS#gMdaa+%exU9Y!L>0S6d47XjR#7s=ek_lVqC9r?mH=CaInvQ&8VyR5&X$|LGgT{u zC%o)~r-p{?vWbCK2$++W**cLDJp)2Ahr#*#yW{BF?&Xld3IOcvlbJc_K~^azzLH~b zLTp@puI^3r<`p@v4%w@#s1^{-=fx~DbAX30BrPEIbUuda;3z?H+}YH>7lR~6MdA+n!Pt)ce_qL)PvUHTxeoNVocERe@p zcm|`bgndpw%Ml**t)-9N>i~r9-q%ptUW8=CKAZIdY8n#6(YC6V8q+XSZAuZ-Zh%QR zrW!2TQe_YgC3YBAmAc>oZ7q)?t8$s~LMH}rIxIoRt39EEa(R_STib^-L1{a(43u_n zD?n+}c>}1g;-?xKHVU;FPtBa)gVL(<94Kvo{|f4B_^Bp`KzrkAw#~)uQXoZ4fsIGs zcGGI8m_!lgHv-OS7TS6kkUN+wcF+na)CSIzpVvB78!fhSy_#> z4f;)_fio?9U_63hkBmob1LrGh73k6CZyk(~UN4bn0&fzk$EFSyE}QUGI82Iqs89#N zA&gib#ZX(NOln56QuWqPl-*~#aE|InqOZ>iml00k2C>Fg3zNZEPDld`S4vFdBP~gz#i!&* zOck?`h0-gT?XTT7L-Y;d)8f!%M3CCppfNaD5~!)IH=CFFTkmBmDanzcde4SIi>xhG zEsr(~&Oqj0?9#*0#$2>*m6cN(-8O$~aU0clNSZcn`B+0T1WsInUo3KxbCzwj#@RGo zK?zuBxF(R7^@h6(?t#j_w*dSjq+z#ZbO7B3y zvr=$P89-rP6t-FzwyFRud;SD-q@YMXj8Wi7Rf>AqGzstprSL@a8PEc2g-A|p}uR*OB zyRFV{2PnTPyxh3m8la)gVOevO`WC&h@Q=Q z@6%$B{7k7BT<4FgMxUui#_|7c|B$7!?)kqJzh3YUGrZ3vJy}np5!OW3j%egnJXt5A z5!OA{glMD<)Ow-p8MajyEm~6^S#vS=)8&LuWX&2JxmdmoM;e7(vt%`PCL{d@wnXbM z@o%*;>4G8&X!D;HTQEvo)FN0AWyiv%XY7p2qn_A;(GF86SqWWjEJZNH7DRu6XJ7o5 z_CD-qp4fsb9L93}4j7vK@GFRN^Nn53@9wI#B8BGS%2M@GVx#e5SgUqz znCOWlplC*#zTi^wRAa+=Z$Xq@Eel}PtM{$-L=sdvjOA)G>BHC*M4846*YS&wyucGl z@QA}$E-JjGIS{{s=yW{k@W`dx5B5Y7Y;hRNRY9j=*vaW-Kfc{_^C=&CA_-1+7|Ug^ zh8`?j9KzCk|EAlq$7#Tks||5*#Bx!H2n{A+@JqT?P0NMSgy1QGgHsI#75m<=2*m zRi}C)3C?pE%Vi3S)T)B$RPZu58-IV^xt>S@mQk9+T^cS`3y2$_UkN;!hJ(*b-r$KO zSne>^ub-Njva?k&94yCQPcA>#6G`wZhbc7mYol>zuy9SllYZUNzUzygNPeI@~?U#8X2{>S+8RqiqPsaD*uq}vI@`>O5%RboS zi6r=|!`Kjh!~nsJz^@?64N}(6@x7j%=ZPc`?*(JIo-tg<3Rel9ba+#3@hndy!5**&8v});+ zg{jd+MSS5fx*)PB@0F^>CY_1XVoSyF*7SamWpCETGi0TnP9#FHe zkB|?(BY1&>qc{|ZBik#NFAH803Sf9!rzd_M*^{G-dqWi0=U%J{xQ{S=3WA6H7Olh~ z$sT>lb9E))2gAug=rxRVJh*dPL@$q^U5nzL88?eXxv z#MXc4IviJe?>m*97l0bMWXWndki8dwiuH7MPY8HaWDu));&p_XGuKNIiBR_52u)sN zk;1vx5#jJi3*m>Lu!N6*>s6hJXVgrZtsi>|mb8ouOP19yTg3y(J;6)~t6#Wg(Oxk< zeq{6`2e1$=f?NA~TDP=(OlhGQp4R1X2Wxrz>ry^x2`-7fn9t<2Zb{`>zn2NT9Eh%A zs_7osS;%R%l2VTDoS6@bivbVj;>Hx0I}nKB_&o*8`v%7zPTVUk54cwk`)**qV7hka zZ&^_Yw;Gryb8)4?Q;T%(bzrJFZi8{|m6lbgjXsIvef4{CaV5omn5-B*4or<1$IyF; zN4Xhe88oNe7u&Ipu@hWbdB9)duE>Wg9vg@+Cm5N0xU%3e>$8FTI&g0qtc!1PsTs~` zU}o_j%AJ*B;^B${`Nk*10aOlY|?PMgfm*^Y~IjuOA~v=(PZU}K`ERpcv3<^-;beC`7E^jW!lva`^VY+ zl9`4~ce52`_(T@V%9(vqqx@xZFt*pRpY9dNOkAvosgZt)VI z#&Y#02!k* zOBe289l6zEESFup<~D@q*LQz&({69!Uh)m!y@mUE#+?H~T;9U{`3__K;-V}K7fK4E zm*dGixaXjMe8*e3XO*Jq7qMJPwJ;0!?6YYoQ_WkrpQe_;Sgx0i@9ew1vSf8sEfOWFk3>cTxo0nD%RXRdk3Tez2lC4#YBEqJ5Rg?o+( z$o0UjU%b~_xX%&*<1O4@q!wo3o+AWC;=p@e8{{qAb5EFtvV?;Y%MO8ULDWQBFuHKh z#UpveLoo7kqyZj^w_vTLO(c&bE!tAixHVd|nakFw4VTcYQ5&{T)~L-Z_7(rtW~}}b zds#eMvl2o&tl75(CZeCPEcmZZjtIES&(!H*O-~CkI`^L8Pek`;20v$Dbqh!Wrc z2-6q6hbSTr_~x55omF%8^fPO!d9Sg^yDn`-SS%}9T)%ory-e!pcnxYd`#Q@lFDWkbX1Q!3B9Zs7&&Pg*MiNWO9-p7dEVsNe zFuR!w-=D#3bEs(^Sm9)rHg+tBDb7@(JsAT`+RP5wdnm3{maQ$2Ex})bnQLZWoa_p2 zOd01U&Kv%epy9GgFJuY7C($F`gr zY`$h@YK*qvg3*XP4EqOwS>mJT4ZCg_IxD!bm1D%hJhtHfeZW{5 z_&)diu*ez&{2p}ZCvblYhCQdoqckuLpACDFD@p*2OXrH2 z5I(v$2_5bY>~vwAd&Q-k*g5kqs9yr}J$AD&9D9g+CBZv}Yhd3GooXXHRv72rnBqV@ zKE}73fVly6gNDUR-Kz+c)5Br^sKF3NqqyMRUq716%%ldcL7eD2_H_XH_T53Uq!pqjHUd1Jlsph(Xy$=EpPX=N)FBuGL>256S-VRN$ zuOj*EA$a)G4;QI+Pkba+6v;qgp;5mk$C#4=b!C$f;K}&KE!i#cv{yaY?rIzu293ixpfrYV&WB)N z8qIV1TznC0zak-g9x2N`Sges?wRANchTI*1bssGL_?COTl_Ku=tIw>X>a*X!zHm#+ zIlbgiR?&GqB?4fA=H!mVPstdBHR-sv~$fJkuCfgPMk4Ok^pj-NksK$UUXst?=ouw7N1 zt+@~pbw|#(c8FO9O%o#N%4DXzv&=@m$EX9}J2|c#Au!izc@;%& zX1jZIryw4h4$OK@2ew_B4og94I%Es%^Ahv5rm{KJTDc6A*2**}j?Q9oaYXHIc6PsVxZgTErkrwo0BR0?G0}agF7uF) zx-uJ-W;$1re3>r&gV~3`ZM&MPO!bIDd-oq{GXe#82C6Lb4>tj~SRnyy67*hoW;b;7 z@e)@NufH6P5S%2TU}4khHW8H1$J`dywlMyl;q#_}L4_NKy5cIF++R(hyD}9}gOJSZ z&$@Po)-|dT^tCxaJBv%=Q3;%fi4?}9gI2? zHVodSk-#wcaqQkP zSZ6sS-n1DNkdejy5*ysy?2VxKhSYLv58FyyBN~6KSpozTO%%W2$}MfM z1|(9_gp?J~Af}gM_ECT1(FN*G4F9~t(_2qG={#>gWw^s|MVjUY{U@{Tf@l?j#bMUD zU;o+1-hRr>4r9628k_xqEr_Q0#IIL!-mTt#%9RddxjtuX_7|=r@TB?96VW%k{S>WiM4`?9y6@@I#!T=wWc8U}DZizjn#{t5{#=)bq0!qE=R0Q`b}dHX3V1!4D7`0{0Aa|r$yMBl|zO2W^7y4$-5ajnDH5Po88 z4i&C7eB$?uOCx{tE<(guTwo53SgvkkGZ3}~(U0-$jo&dxMSta8gs}UJ10B~fhU+ll z;u;ps{6BwdrFRkHSckEGJ)KdPm<2;pDdV$Jf7To1qX_ha-T zgnxHQFyg|Ojqihm%Q!0kXcOsScd5~E5wUMOK0M~@KUb>-r@_=Fb!XDVSvY+N5$MJ! z=Ei_u{KR(3nw}0lQ$MgZ>JG=j)~L;20+{>od>VReg`C`PY z=l_TkhlWjdP=ujo+U&E=72N~5o;Wn6fu5480oSV*e464B}n08 z%s!X6x98tP<9lwPG`QUSS}AgSdjK$j41gu~Qi%0u5L2Op#JLHK8`I6Nu#eJR$Hs@$1Dl;IreRg7ET}^%JvQRh%!Uc>tkfG&yx3}$ps z03M<3>APl}S6K475eNn4&*la*5Q?4vHWd7xQ=AyMd~CUa%VkZite-P`a)n60U5&Kg z*PX`V(lO=UP9sM=n7p8Au;UVmpRMRU{QpdL8gn*Mis3h}Wd6vsSNx|tQNaVI>?vthsK-i^R<#~=6(~f%X1wH1N;s9S;i&yoxjFe|i0C^N}_RN9jUhtf($Kj*wju0hN zVDj{}Hkr=#*^)jS(}eb_1L+vfzx6ME%3Bxbe3PB5Z(c#67D;ndlHnd4{EXE`oH&y+ zl>^!n>L|{MdQJ`lo}=9yC#weeg!JThq%i2nQR0Zd=r9Js2?}lgvy+%Fh>JSxE{L+g z(2wo^+*s&MVir4$9WHS`PQwA2r=GLvqQVYu60=Sa#8|Fx8ylU(F!SlxANx=HkvECC z(_t*v7GtB67-kX8@N1vH+MC31;!M-iB*yyHbpIO@_BM(6nmS`9G3G`7X(bQe8so>& zJ|Idn%+!z#SHi7PjBPAv+tWcCZImqEUqJYp&a-M}ijpT)B4dSmPgHF*rpvWQa@gm3 zeInna3ALZm0Oxbro@>eRl+CsK)YB0c8@hlX{yYu^zRS&qHLEUKw$CkbMcG)dCFZ;b zX9F;@8YYxUE<^Y9?=xwMb6UD%;5pZRITNJeKWT|e$H=>VFx*$+qdl+aa3#S#{QH6X zK0YqevgDnC2#Q6H+(#TR=bP~EmW?E*V+QM&2_?H)El;iM=PgriZJiWNF50#e3=uAM;xI7Qvmj>aBX7f? z;nZX%jXi02g1r6tKxZ+eJJeP(ZGx>$F!6m#R{(6_X3_3DL}g*sm8XJ^cjj+h;5@QN$7 z%G9h_v~uy1iK4NI@6}7Z_uy7>H|x$1H<34Y*6l zIqW|7xJ4DdyM!D7q6Q$7?7+-llWof9{{KvR+%dtPbQyB{C3tM-7Ov+D=>5nInR&N8 zpKtrm?7&yUS!^6prlvWEA-mYr)l@Z#=%XyC#6Qx=b`Fz>4qoRkanJk$Wor;q3NNpL6|xR<3Gwq z=YR)UJUqwK|Kn|zjldT!$;afNE|*?o(vT>1FW!}U!cng|>H|mhgLenxEhfV(7wIrwo=WR;Y?&VFE-o#v&_x&CVXl)9{~V(&Io^Ud ze`ee0c0I6+FZ}2F&XrTuI>4F>#P>78%G^ z1jY+r@KQN(qk!SbZ5kggpecp8xxlQ>#Z{ID=7z+537FeMxUp=bogt2=z<1>0ipQ2z zI+T`!*MR8`;{vLk=-#2&XdKPWMi?(1MS*Jr#7zWdei#=}Aw%3Hz+4l;jVaG9f42ei z>kw{ikw3z8Z#yu5&&5>+H5d{12{41%Kf?IpQS2WP5O*>#$q=qAaP49kaPxo(ouV%; z3#bU9dpt#dPp*3v!Mo>l?{Q$>GB|YR+8$IERe*Gc?)5`2Ig&jkj2Dl}^4xlUDll`x zxWF|Dy0;9N<`53jAjAiK5O*UmzX;<3i@LKO?ejuluFQ3>cx*+f_@Ixe_;)QZe=<0B^xA(E1@eQq-UD&Y z2tOK!3o4Y7b4Zs1^E-oc;R|j7L>Pv@19P+)HMsbe`9l{GTrn_&31KguK}2c zL%5QFgVn&j0L&1s4Z%2nONvTM)JmRJcoqS(Di>EAD9&=7gIcj3%Egrw1+M8Zd`|;& z%n{n8!o7vE}N6K4;?JE5H;D%JH|fe5@Zg8ZXtr ztPbIVw~~mX=B~R#xS;G3;Xh=pa7b1*?gr+8T-=zFkb92+^F%JL zEO-lx{=NXrt07!a77B5H2j<;eT(J5|`1Sx3!`PI@#bZpMc^2Hkz#N{73wGy%D+Fd# zF0MSdBFylW0CQ?CZp_#*5)ktst{RxS5Ke{RSuAm91M`Jk+}OY{Lc(_;FspKL<$>xU zxXXdLIu}<`9BA)H!ryBQ#)iddQo~-KD4lrBNMG00W%fva!Y?Lkvws#!4q5IC{4f6= z{ICBW{Iz|7KOrEr36XsYy9eK=uzT=*3cCm2r?5Z&?}goi?^D=4_&$Z*gYQ$=xBPoy z_u%^!b`QQ!VfWzs6n3r*{Tt=ogYQ$=J@`I_-GlE_*zf!I!tTNMDeNA6pTh3JbHn~* zZDyO*z@T~ryyoV0i2}RQzX`=1kT-0y9@Z7NP zEt}tzD6mw$CDcBbs<&O-|D95m&%1ppRi1agQsuwl3UNxlJK4jn0+kFd-?i=K>XL{M zW9j>c#Ai63nvlhyG@HhO+9hAT`#GMPxc|7PntS;?wfnZu@nQrI5!K=r&W!%7-w`a9 z$8eW)NFC(3W#{&(%TB>%w-oM6Xqgp^y{R<}_;(~i2|Tw6H5t!$h0@l{sthjD6VhmCpF{H^71TVp#B)IY_i+}I9Cv`;kdPlWr7d9B18PWKdj z&dJo>Q$f8KaMy+#2NcvTe^>(!))cq-!g?ZH(In**Eq_>10s`UV^%%`=WRK4|Kw~;{va}Gxz~g%&65!Ae>-U(2Wu>{_oOxMPh^4G*Q8Z<|FcP}#VjXj{pUmKjGzZk z0V1wrCHo{7p)jzB;atNg#1|S;ch{PO6Xr6c9^2qr&ij%eRd{v@l~dL-ZRqXmGIcK3 zYVA!gsZ>0}pi_(ypg#Ej>4J`}|4&?aUVQ#PapB3mx`3NrgX}4hIvu;*&r+D+CZulQ z<&%N=D{=H>Ja-F)hi5(nNjE(65y+s;$03_NA)9}NY(5Fubcbx{QP8hw$fj4whQ}_0 zT(OW%Z?Snj`nTxL=$p~EqHjlAdadu()N4=lU(pYv&AmR3eiFU9*GJLr=!RbY-6^{J zSs&~CDvyo8#PBPKvi$eL@5leV;9uTWq+-454>7?J$S2ejRIU`h~c>yJ;snjOF?#6A$J<{DOXYchf#}7|V5l3G+cAF7Iwy ze}}PLx3f^d9E@MkFYj*J_Z-G@-D7OH9TVj8?xy|5VJz2MCZ^o{2y%IM)Bfo&maDIc z>3|TIcQ-BWFqZ4PY@%Qe!7u2ScQ@@Whp}9njm@DUF7IwyyTe$n`NsEwAujK3+9HRs zTn)yCOX9&0dUw+r9maAUVp8?+5SMp1ZIHuQE~}b_!|9-3o|2vt!*xW&avf`Y=Nu%+ zG_Q*heKQlpE5Q_2mG3L_IZbRN_t*!80*(+<2z?>LBBjD zJ@yvf=bT@>4@PqgeqOxjm#3uXza7TgEpE4^PewfiLD;@%{q z-t@V-!%lL3eZyg_Uz1JxaNwvn=q=aDj;qdL92d|uqwy<OQ6+O6eSPKL zik}oau5yR5@p^?UFr2{_M62;6*T=7P&o6OYufv9>#QC+$lxObEL7o7fkPBImXx|LtIJ6b(#;OT{UX)44hJZAc)GecZwI<9^`jB?F1wV+P8M&e0x$IVCnnl_OhWHS8H z^k_t=JI{n{E-?LU!8LwZIY6#s;&0{Z8$Me`bH)F4ErKW zbE+Xs54_heUUtEfHRgt_q>r)iA(=j5TZSQQD{>*i*2YHe|EP!B`HmR9ddbpN(7Jin ztb~_L^~mC!@7163o&4$Zp#u@QkcVBejqwP(JmbtsvnuK#dGKyo*gK`e+?K_j? z)4qoTAWqM!ozj!9li*}e-z2%iPWlUQVp31c;1j=n_aExdUzWlJIJHmIO__d{Pl+H) zvoDjDT4jU5LSOIfb4$PXCAS)QU&s?I3(h$*_3(*Y!4eYS>fw|1%axk|Q=mizzDSAj z5~6m+(v^&WSC#3oweZtYzZebs(a>7gh;+p);9=O7*n9;yz_wR_^Noczz$U&0Y#la? zb2eUxoE2lIVQ^N0a?K@5+e*{i2{zvca`;=!9G)INktc2rD zXdk)8+T(>Vqvj-EDvFdO+ZUGzB67ef(2`(;>-g@132E+#<=hJ!GqzH{@?Mw@CYv!{ zv}-w%?Y@yuKC&=Uw7@SJG9QL^Rgt1LY8dV5yR}~r+$qIl?81;({|L{MFmC*V89Q=t zs^|Ix$6sal;&|T(kIaJOQjO0f;m)`m-1`1A;BWBUGQDf^ji1E{d%x8RAvO&^U~ z+Yg6Gth9T`+ivC3cO=<#+Q*Ufghb|v`$pk)r`X|;%NJBAL$|E06}Rn5#(!4!adqaM z6vUCfqqbI%0c?}m*vDO)qiK8;orWqMG}(QuIG4xnKJJEzXY`fZRWZ>z#|@sC$XMZ~ zO)RnqPj1A-BAli$FtG?HN8B)pMQ+8Dn;@~s_wnS$h9|8evtw6$b2PeR{#IE3Kl2|* zfrI_^jb-n%-s!%<1e!C;f+%ZQAN&?I54q0U>Au-v3e9YBgR$w2{{>MND4H)k^v?C( zPWOMQrB9NBoxO6JT@Ymrv_^Nj*%I2uK``=}#g2w;lc$4h|C8^96jqw>1>gMA6}XOX zjaK|6_7(qolBK|v5o?r-JGj>LiY#fsnAd0W%^w%7zHAj_r7?Q-mo8fY9qjjjLv$@` zlo7@YssP%bz$5R_mBt1W=hqIU7 z*Q=NIIp~?DDP@l`-NzuRDvL~;6$0cw7P^o3a^1~-w+e%BV(*dO^eZa<>M2Y1GTP^G z!*&3EvB>dwYX8FI<7RkFgnx5`TXo_nwE^$StB24suUlDhHiDTsdy98@z{!HsA+6pK6KGgI)7J~mT;HTZ##Mqi3A}+tu(}BBGiz?WJa_{j?h3m`#0s(+iP3< z_}y!7U!L|{Yaf@R+?FOl31F*$)<^4A)IPvii`qg^OYZ-_zP8b8c&$~=jhwz{*SzB8>Zge?A&Nw05eYfbqugPU6=ou+b+*T+J? zf~${Z!|3zPz|eoOfND(`ovk@zU~3w7l7tZ79Dv_(arSU zi?|T@C@Sg~txC%gqtJQ7GZE1fpwag`PSkW29)%db)xdufRYtFzvmUGPyb2S1PawQ| zP)V+{Dmpn=zQc3i+Q)g><)`EROjsKGdm~=$td)4T5;Whm=s2cUCwD8ns+RbfPgyho zmEjn`z2;0L`?Y8D=y+l{pN{D{T!e0VWEQs?*oN)FkvuvzMyaq#6hOLxB6Ruja{N4u zQ&X2ImOk!zJi7?pbk8|z>AxrE(W$Y~ERRAA)z0cWD($HCOrBbBH!|ma%eL_wIB&N# zEgD^~%M3p$B$30s7t^EtP;XqsYb(mDuZ9VlQ0imE&= zh%@p#`&K#J8>2%zxsR3Pf#Ie=!X#%KIZT#9WC2PcUJFPHj2(V8Y*5`rbhUz(!Iifu zK-CJ@V&m=rBt?8Tplj4y@}T(m1|W&!TY#pkw-3XW(f|JdBy^hrNhn(ZNhmJ@ItMoB zdkt<(L4SiAR}kA^raS24Mkfhn3?Ob93;HeuG+#mG_SwPOY&Fi}uTixlJ<`KN@?M&f;v`m^^cZ_1PmAQP zg_O`plfX=rW`Yff;4TGZzy?)DNVc#!5V`~)!Lgu)t`3kiK(_&s2B=P5{i?3rTle~m zAt2rO?`3Q88aM96)ZL2-^NHTmprTLROoAIm(`)1rw7wnj2YpG|x``W9AKXkD#op?E zsL*<;expDsXlnj@77xkXMa1dLV~Os@vkHS*B2@%&EyI<5qDpWF4iA48uO4%nWJF>$ z%AwC}z^jD09WAmH3R;)YhDAuVRHLp}-bG~cim_GUP2b|=#-INHDaL)Z(?S=lM+i*P z(ar3$Ys~$2B5?5T=w?r{p2sZpLENurShotAJB~cl^Tq|ZEN-^d!m5&0ApjZfQq%S! z_nhNOy-s^)8NUOW=R=MvALwA#ZD(1yE)7%djPq@oU+d=KsQ#$T=DtlABjx1HpxSpR z5G#>z%pySKi=dj<2<}sOzE0s-sRg$V(De%U6}U+SJqlO4qNf2#SM(~NFl{z|yaO&aH1)z<|f zGzwND6+k0l1AaH#JLjs@Sk- zYg&XMS!b^llvOVDMdH`FLyAZ_SCvj<^G>S}DH;XpFJaa5`jT^1^wpM0D_TY4Ng??* z;Adzwsc%2S$u+ofMiKdCBA_#vij{2^8CyrFUzggiBCz$UR zU{)1i_7`AoF2MZQ6IXM4Cf(`9G`D0rS2!q%{VfM!r6*p1d7%Ka(}Mx~xUcgu?#+J6ulp90%0tZ1~skUYpLSd8$$wm(0-B^t)I&6fM=EnPP&_ zx3?EyKIRFhaKB<^WqliZjLyy$Yq`lc0YRztCe7G&qPM#v)rtPZ*WT8-@~--3?An5A zTFR%Opd0#X(`ZO;L+xozbxdpT^uZ4m(XMPoGV7aL8mPxsEf^J0`)p0$sk_>-gASst zTX`3hlLk~tYdfBkSf6|0Ng|uUTFB@mEmjg{)Z@mg0-StHK4pViM$=eHuiSfO1zGS3 zdCGa~>sKKcR@dLD+g0(PpR7!=@=B@f6#*lpi`TAfNiF96R^o+a!n?6L+gdbAv73#v zJuXT&84ayXBx7kHd<*xvaLad zFSV*YefLRd5}s9MT^SPQjuB~@ehMCC&qAXyMY z@M3t`ZqeD{MJndvm2EgmSPzH?m&C(5(EQq> zv*XRvyvP~W%b?Mx*q!h^3R~5jXDo)ZwH(sIa1<%&^J;wj@4&Z$<~$B!VeEKkReHXc z^RMZkS!2<$SX6iwUb*&C;J*W!zvt7<^6s!A-9;Dzui-El#tzS0yh`%$9nk#QqO-rl zqo-H|Jf~xDyig`O&i7V$FAL(Bw#}kZ5yRnk{D01)D<-dIy1Pz*jw8Cy6``9x zv&tIXf?zPi_N&8n2{Y(8>-`$S8^RBQxf!;)bVjv^nwDT*E5d7BaqX5PnY}XI&y{o? zy*)GB(pJ(}a)4n#dke&s34H^O2%oo|i#IXYpl=e~xPqAEY6X#ruT>CT_69-U;InE= zuB~E|Eddm*ip1$cK=YM<=Nq)XC`i|-9BcEfcrTtI+Zh8;LIu`i3dUm8JNg(2{Oo!?2~H(L*id`G}eA zjo#9yWgv!GH%`kz49GzY$U&fl3D>8C+0vyzjZ1EW&$$?RTeIWORaoc*V=c0juzYLgLRe`aYTq{N13{b=`_Q%V*gI%&yWnn~~$&`n< za?)|u+Ivcljmn&XpMepXVa>g`!42!@dK140ebg8kb;4z)}jxWgy;gbuR4ruouDxVMDOfU@wB5 z13MY^Dp>N|wfN;?5Z55N6f_!^5|2;9zK!?I`28z>*%7@5+luE;!%{NIt581+I~JB< zQiAwp*ssA(hy8D`--Z1??8C4>hTR0a8J1OlE9?%~-LOx_P4Mv!oC9gN7&b3 z-++A!_Au-_u*YDB48ixq@}60JzwJb%F^E5rc?Ok;T5xQZ1Y+YV5ZgF`#@WyW8w%SH zSwZO7778@ghRA|~tFR$fe!)>*FHp4&#cas1p`;Df+R$PfVwI9mZn2@|Hq>N8D{QF6 zhT3f?Z9{k2&^_fDL`ah90z`Z`;sAHuUc{^oR}p)P^3l zp`Y1Mw+(H#p`AALD;wHlLr>e#b2jvX4ehs~-`mgu8+zS_4%yIOZK&Ud-m@VNEToKB z>jYvw5s0-#pi&!R%@N!<8{(Rg;KDXkWHAqv2`{zuM*#bb-;UqwXt`tmMKi+orFCg=5Ek&4!)3q= zCOt9PwHjl^b-L~A4$#nygbnzwpbPuA%~Os!t1+vAp&4oWdQ}kW8aO%O!IVE3iCySu zxl=}bMc&qfonecfSUN`Vdd-M$=6c&lw19hVkdaMp$s zCv;(bW*M&Hv53{iCn87Nap{$vF~A1=*V2Xk^x94H98Gv<0Yfv!_Vp7hK+f+2ewGo< z!K;7%cUiH4>^y^;+mty|`Et+X#{%!HL~Z}oXJ&~eJoj3eqVbdtQ{k)*h1cHqWzmG^ zUMo{H9$#lGUrZ;>le->&M>OHN*RK?fdOykfu5<7duweBohav`i*8S#X}_eVXLykHm(il@^RkV;{T zJ2FY(pFH8v!v>EpKK$B)$y-vgQdsYyspk@k2g3)}3vGt@@)oPCa2_g159^^elIF?! z5x>RuR=Xs}7G()M%0fd&s_{;1%|OU-`8l^$x3#A&3Kv3kU}Zwb{PfTjAXLU!TeRIi zvE0E~fEB!c5(;}^shPW}Jqfdxuhfc^B%xh6OgJXpw3illa&=#BjY6n zYe^pDuLTLVrtQuYm#X4-MKztuU2L~z?c&0nULKkec8tK{>RTq~RLrsnxTe4!9^)c# zC|hkBl`a7Xbx+BfLWMWF2p&0>9c9%X))OVe_S|vh^8WEeE;sJt|)!&C2c zbHd+%pIJcv-!NbZzyKZRT&!w(!* zM1Mxkd5n(5@z}XMRNdkHFd|F%--|~EuocqT3yCe#ijore8?Vj==f$cHr8}?N7@TKx zbq5jyy~(Qm9luo(`G21@S7BS{w4`}3X}%&6K%ljRQ9z`fG$$tf+mq!7lKuh1-%X#OC>Z#-&4zf$qLxmJilb z*(A9v`pIbhvTfJlOQgoKj!KRF0iZKrgTANWa+vsG*J3gP3;(ts{P5xTtHruLo_H-T zJVeb7wh?h@GsI`zG+BQ~bb5^cq19;bAsaQ8W{uXPWH$d&qh|s-j?pz5BGnqRC;BK`aS_9x2}rou z{h}|>vwQy&^&&dPhcxKf%_c?sZa;I^68%{fDPMl9k z%^ILhu>r2lG@3|l4z_!hL3pi@BguIuK%t8}HV1aSUMtI&8*8jp%Ut|vG_JL>DE8s-qMiVePXc~^C_nB; zul?H(9A2DieVD_G9JA5m>IMH)MI0^>u6BdmkgtL}9eDWBUBsWOwrO6=pEA{2C@NS&V*Ac9wy%l|w36M23 z*%iQLT@C{&vXc!E(*M)T|MTW_H|sFFPj&C22jo(t^;{!H4jITkEn*e*U@eK0^KkP}GTh)US36R62A6y9NqaX`lHZf~P{Kvm` zIrWF5NSeXwkGvI^wZ-QvUK7IVojAqj423fUYhKaN(b0gN$@KX#*gW2M6KT1Xi1NHu z2E08-OQlYPw<9wvT)m`x*e2wTZcf}yoqSZGdrErAyk6~A@HBb*DywHBOQ~M6YEEH- z@-dpXy&CK&$7(j9w~iOa?Mx2uwivwz2OaP4De1|K2mdFIynM%KH=`e9R|$G!c)wjS z2814y@P5)y*7O|TAAA~4(nO`$%}OD9>{QKQRY`P_Fryb-6%?MQXFvfEHnW+&oBX9J;D0LZONQqkLN=nH_P z%6|`#2otsglEDObuCNUa`i{aKt)MfJyX@{z4FQRdIe<873;Lpf#wv&-A+Gg&*dht? zCBOQu$Js?X?bxYUpIcnMO(l zYSoYUML4NdSlDn-3e(trw;MxvqJx01!quo^jhm#}Y2COQUeLI?hz6B*T2g(zfPpk4 zh4qaqZby44AD|w*?V)=LffcrvMw|$1v^2UMuiu|rL_YdulsCDT=A+U!K7zEcZTvja zM#CSO%jy+jg)Z*sw$YLAC(K=F0@Ig3dg!k)x8jk~O_zK#y0*%fK0PtelNi{YLF0tB z?Fpm&iDcD|%m}TnqOUd<+B7D|{-Q#}yZgJT(pGv68O%g3Tk z?^pM^-IV6U>pnTvyBb?qvutjbz~Pp|=G82VC~sUnLZRE8b5O^t33DQPOyR6_RpZmy zKGV3%K`@2x2Qf-$LbR+2ZgbK#f!cA*J*)!NiGiJweJ;*VRP9M$0InTb8q1CxZ47LU zuiuq<&G2sp+Z#u~qC27fFF4ui6!v`rvt%IYhH2_sm)U zSe_k(L&;?lCEUR{6g`c%*(Qg!Hf7pRxUHU372$9f#^KQGk-Z#M(71D5Foo_1!J(W4 zkwY(I(Zd8_6^D9NTdH>jj@?#!v;^se*j{7fQomjt!unMDJbUz*FrU{qsYAZABY2fM zJwS~&+c=1l#m zY^%G49c(D2n{I|)M6Tht*^~sza5|!Lt<08ASVS^R(PNfEe(y{AYCwQ|Xb3fok`|w_Cno<|t zZ%a^V-IF)~xQAZ#X(}`RNN@ZQiaNjOz_U4@8TaA07g*po zt~r$4n0h2p^rYnoXC^`slU`uJM4-Q`>Ou%jYO0QfzO=PucV<}Mykym(HKP$@31ZwI889{+&dlqJ z8Sq;s9=j^xrQ4`_7ix_mojEgM{sp9aNO*SNc}CT9|1t;O`+@6L-qXVpxnLPKQbcoe zB?KJvf^cNrcIKi>N0bf-YP%5D?!G4}dy0}rQs3Zn-^K@}G(2ARHN{+>TL z?Go3oX{3jBR}$%A>4Rp=C5<=BT7rAyuA=d5!IiZHEnyw{{nKzGHow)qaaYlJe91O= z?d!fz-0(Nq2Jhaut7ueOIJBf;+Pu?1No{dyEptH|wFx%ehSJeykRIP^A~hA88jozE zu&Gr(@*3ODyE|LjZmaLmL)_!e!DhL8d}bGwc9&52K-3V3UXSNW0F#U$Zsmo0^GmpwW1ddq7gr$=Va zIGH^kv**sX!~o18!mFHSsuEZ z(PTXe8m+yB?M<<9YZ&<7vhZA{+E-f*EgSA71m8%+`3~rYT0Jgh{ zcFkfH4u%w6q(WzF|6&uT|v<4x62S^NIwXZenX zM&DUWr#jJl?Q(=~N8m2L4TsZ9Da-f{G$3=iHFWihiSiwZbvsy^m|i8h;w$U3h}c=I zHT*9b? z12r~|lOExL<$#0-+5t&9awSiA;G2Mi2OhF-=68h1P$GPg*N^VNI6MHyYKU(rQ?vHnb$Z zCo~%HlA8UY(MBzl@EkHCwaZobR%%pDuSQL;Moq6?ju`S-<>1$Wa@wJN7HIK*Xv6I& z?9D8Z$gb$4J``wFHAC8m{^Zd5L!jAA&N?39_dpn$qLN;UUnIRc9Gap63Smj3w;GW! zl{Kh~MkQ1YxpGbCaW6?gLkTjZ1q-T?Hb%WqzI`LEDx#((G=;!QhUaSDqhgbg&wx@L z@R$zDL`k8vBKwT;H;vFWdkwR;1T0-kp|w>Sk$nh$t({GxUz;&MhSHVL+3pEXRRQ88 zF{tz`3vLOXh0j(35)N*+abE=_9Q>e-+YCtj{tD0~utDFma4%I5cQnY`V}PbA+-XRQ z;4TIvxM_eS-WvdoRCH~CE>qB*fW*gon~rCw$)iD~BSTW!W7GY?hTaA=P0>;Jg@nTM zjnfs*rHeKh2_1UL$fZF+HTv{_r4TNpHJ$L1E6n6=|_3rCu@ z6LJen&DwBo;aIb_EVpo+Svw`SaDrJo75r9;&|UnNTNpNLD|3l5)40M~|2^^2r|3rV zU>qRH@i~B`6v(9Vw%*1y+jQRsBqam3wCGsUlDkexzYd(0yY4ea>t6523oWb5`5{-! zMT2HMn2VN}@seD0q!}NXin4n$wjA{@u|5xX2f!dide3p(lBfG$8vXH5s&;XY1SQpEYLvI*mSff zX0DkLGgB4KvKrZS06p2VorW3T1H$gkX*Jl>w|*iRCDHXxN$88+sMKqX^1aYH6%Kt7 zLbmkyNcX|dBP{W6*1>`O%%i);0r)z(hC!uVe@S)P+<)PB# z<)xwW*p+KT<;g4WGrD@i5Eo{CpQzdzTF(|IdU)%&G!;dt51cXFxnlK`J3&^>-;K>YjI=y7{{As9h z>6!yLJ7shYytlg2y^kTZDL5h<8?`pHDK^3nU>$)W06s$?0H6yo2NPAhGfyWsX4WRn zOeHMy!1%@MXn%8Yh)b8|;waX|xj2foB^O7rrgJr=ITYx!ak;t)vD~U~EVryImaCf* zGwW8MNSb11&2kj6nYksFi%*T2@phHJ=9<68a%+}G{ZB^CH{+3`(Vm{txc}F&$ibeT zk-!S7geY^>dkQ@)w`Q@wH*WqW8u@#)=a(Swi$$L6=^p9t6%45RV&<}bg&h{lWm=;C z7vtuu@yOfJo^7SM%!-)*#mL(|+YrHvf-JExppK`b{yni=swp1X9_`s)ijQcI`(KGg z_VsLqhdqKu9D*7aMOq^7DN6qzBZrUN5+Xl7RM&>W09wj z2>(mwn#Dlo*8CM;5BewK{@uv7cJ&(JKNFAqjUO6Aw-NUrj74^$>@Fs3Pu3ir7>cuSxtBwr}Aj6i% z0vR95WpOO9CWtI)i3Q?F7=Cj#=~$p1m`pq@BbnWw*b<4rls0MFk&&jU# z$IV00o&(rzFn>tTYvZy@0x|QQ?2=%1^=Wal-+D7ty&0CPYsoGt$*vwAMfWOxMyNNZ z$Fd7X#?0N>)uZC(PV3bf(Vm0j@FJ95P?~KU9kpMK0Y1Cn%@RMTZ^VtPu*|v*fRxpzl{^DHCitK_Z*|u^km`fD;(p*h@cEQwa+hrDdnnF)E z-^?zUk!_2Zhg8@z6?PWdq3nW+Y};(KAqqc7;pfK8m$M5hvu#x|bHBo0uJ9kr)ih-n zT#;?N(hB@4g`Stp)petBtG@FxG*;Eg+_IfmT7=TEJqhlG>c?QN8r(1gwW1=&3S6`N z;J4lx7>I7XdZ4TSDkHbdu+X8;?M9=7^~YTN05)A3T?eZ%)Q9H1o_WS*YGgyZ>oX?q zPL%ISKr5dj*^73yza;dTb$n(1)+mRX$9KXVnHqB&UPyzB4OIwa|9~k5G9T~s|tz^}n4qV9`-*2{qU5yH?p|E$8H5BUzDMKt~#=C_s z{Nz(DlWIK(oXX*p7Ox((d~v)R@Kf+YVawDp&ku8ivVXB@ z=*zt>GF15rTkpG8O!+f0VlL%J!wiFksuT>yD0Zp&%?mr6OBNzFO<3)CfciChfhmCv z_&JED5N7@M2frq2ed;?p zEG0RPS{A->)cPc;4L&gDA?-Ta#;HFnaT zCovwBuKw0cvz4A}cO%*SI^3^B@|P9svh+Pl?RB!W-RuJiY)+ zDGd#OM0Q-Mp5NEe>my1s6IQqFMY^fmc8d9gx%0?#k$p$rG@teKW=djE)!%Uh?+%-L zF!xh;2SyMN+l3E%<3F>5S#aj~t71;S!q$<-=~pfn#7Qiz(8FZQ7k`S>@F5QW*JoN+ zHn(-yHQn*ZN#Nks!Sd!*I48)wDn*W-t=I5QjHBn048~dU<1HQ^HIBX>8AOhzT!w~C zvT*ba_58k$&Cw7wiW+B#wTyM|kSSI}JruK7>2$tsE+{_foG1$+!s~Y(tE1ke>NMn@abDY9+?B2M%q$rb@eqJcekhKr&@1RonaBao~zqla%&-v3r6dEnp-i4WH1h2 z{~S3(DHF{{rKNruX(3;`jpFN**;#QD_83FK288BkM-FpR(s>qk#q(^4x%J?E2pW>1 zAL2*NOkVBBVUcrh*f?^0+}s-NdSzI1=r6k>hvDvn?arI0RyJco@))kTFQ0q&x zZixi(`)YG&`SZ=82H3u*0KW_vwr{)9wWB0a^>$_#9=0}z+IPMIU?+f{IslOV{L79S z%x*4->~iElV@skl#|{r|+Bf_e2!klV>5Ft@&F4$qYR|K~pvc*$dPbthhB6~z@z9(; zXXN+ZuV(3S=!w^?f<<|MdL{4k>1=3D)!&NypfDU{|C!e-T-K8ecjl{nDB^q&yCvnvdXANtFO?sO z4SynfWN&oh(dh7=;V*(DHrfyOo-uxNTlu@B?ClxAwFECl%a56dj_ip|JQN$gbNEY9 z?9?3oW}<8BkeaHeGXIrfAVKL1;ddls8asw!pK?fx`b)}p_qdybaZOYC) d0AwL#;XhFAlDA=1!CQ{JIgveaCvw}={{}eNi8BBI literal 0 HcmV?d00001 diff --git a/curl/lib/libcurl.a b/curl/lib/libcurl.a new file mode 100644 index 0000000000000000000000000000000000000000..10581688fd6eee07f5ce52843a35efffabb9310d GIT binary patch literal 1859298 zcmeFacbp|f)&JkRIgqoFESb4??j%47yF`&3B@DAOcXo%Jv=cTUAQ?fFr~;w_f+!}E zB8Uj`Ac_(MBr8ZTOHfcz#NYdzQ(b+!Z_kR~=Xt$;|IqvDyVIvWeJY)*I(4e*^m^NM zjdU;gz|5`J&0kIK(f;#kd^)!J%`IcjE-OkN>LZoK@h`>ir~O9tMOfwyGfEg5)A z2Hui^w`AZg8F)(u-jad0WZ*3scuNM}l7XTO%o!i)@9gRy9_;I>j*g8a;dyLyad&6m zVBeS#`uqDv$J}#QzXJM)x_WYNbdQbn=L!AwuEFtP&t*Y9eQ9v0r`}obuMb$TJ`UEG zhB!kUqg{*Z7T!BFTpzSQN9u!J1A!cH!(Ahz^`x8ZEbSyCo#TUJef{ovv~O^JzXyzs z^bO4G?;2b<>QLQXqxJ5g0hoE{;P}A2dMuma!KxLQrKNAMcc|B~=o%gEn;+6?<<>P! z!t({yKQy#3Ef&r9NPS=^&1l!?vcc}o(FNmUJwrum80qOLg!Bw8=SDlQgX-)QGZeRQaQaXsXH zY^1xhXK*yFLJ6Xp`uheK8i}y(uI>f(&VhxU^}(@`koZXM>IsYj+mX)t$jH!0DEqO# zfqGA0Z(0?DLraWned%x?wP}KF`KphN4t0k}Ev;k-?jur{hU^<&+`43F1mVyZd%ODj zd+pD8QuGd46X|OzYcKK9}F6{Gp8m1w*ENg6? z1>$JmaFB21IodxylCc=6_vVXP2)U9Hf-fm~9!@(kILfmxJ9!?c5A>uh&;D*w0dkzX zdpmoCbFKkGTrf5^+&Mflv~*dgG=K#|qapj@g`Tdlu1;y{bTyXqlv8Z}fiP0cu|Z%Ey8DM15A4Ok9)!Wkl8zNTQyRTp-2p{pV>Ikssq}V^_cW3Q`Dg*Ea_lEezN8VP0GBh=jd?;<>8_J z{@4bJ5q2-=>I)6bf?S~l>DI9$l%-7_vp-j@k8Xcb(${++t>gwGopOl#8D9wB$OBbWQ<{3%(_4bT9=}*Yfwc2Zx1^HX`0*UKt7eIMcJ91dNq z(DK}Kqqb&=&LpHZt;Uqxhm2d9+X5Vx)Ph*S# z13`((k}5^eH`tS_&O!^yGLTAci7>}rDaDAu3Uep3U=aFxs*H6H4-I)ebV1kX0@pJ2 zQD!ORC#d-g>&wWXDeRU7Wsy^IM;D;ZclHx=R=N}l>T!^41E7jVh{lv-Vo6)tTOV-= zGNNXH&VQh9EM(2}{_Y_rAt6fbM+fP+>9R}cI$CuO^-Fk`$W8{Rfxf|Plnz`x1I=zW zj_9L`2?}s$CWP8XJ0P~cnTn!s^its#ujYKXFDV+oXQ*@DGSXe3NzKqVNxjSLZm_;+yem|m>Gz#E zagC!^zDK5*Mr4*7Gv7Bz5(dYHhK=*U=-@DcV?p5{eUd!J9M@5(#yKv1M}tZwjm~uk zjP{Z}Gy;lluzN_A`?dz`xQ4iG2RuBln$eQVrzQN{dr_J7t z(z6WJHX0X1444F_6K)9PE<+rt8cvwYqhtI!EL;Z9BA*PP*n$TU}#R zIy3noaOtSo!^E_NY|WXmM(~|7sDuV1k6F8nUSdQ?b8_GYJ;1!6#W5XCp@E-3@0nKouzBp(pnteiSd39-TV4OfL`uOKe= zWYVMUdw47@%yBe#2PU)9UOR^*Fc0S5n%sF=)4fxJ2=oa*1aHz zt4O8|g_)$2x4va;ESg{6Z zvt6kYtqA%7OMK@j#WR#mV>A@yO8V2mF{VnRG^K$!W%BF;0|l4H(9<_x#`dxph+nI% zEX<~x7A{?Pr6m0UGovc}98dc!6$2~( z?h#bUfu5F$d4>`y#{{X-a*}eWPRu7_nkUAj^^ST=8@E49LSCb_m1s!PNBdPL6Y zek_LZV`#^zYAT74ju4$FfHb*Sg6WoWW{5z_b>V?_^iXOB=&8>e55_4O9E& zS*Oswq;qIoM|7PHrQ?`U#|QlsX$gHf%``W6H(WMMVl%f`#CT3Q(7!r6wOQ1~d}Q?@ zo%(pRE83VUN{fu`3h6YO+3@LS2eY|fW}bk{f}EWp5VFxa5ZqKMP@KLWC^~Enr_+r< zBuzn=&Ilo!7I!y@9D$)J_uO41U_pdr>Y2)2;0#@`r2##vL%XsA7&Pke_SjJ8;NmVT zx?%(KEskb8kVEBK5Qd5TaAk^S0TTzX9HX%jvHPiXhXlZlLbcKmxf8pGl=9$^&I%Q( z%3LOtYIDp2QmrVXq)EvrR6sVDNFTCbEYn_kn4Qo(vIym`?DbJyl;f3tKSWX}lI;2* z9eC)b7mSX1`<6bYTD)aAlDdPI^J{I}}Sq)+0K5BhK z>^_W~!$!>-OEa2;PMKZgc|!1EcaX&hi7LoEXGv{XiYrUF^RmuV11YFK%Q zJ?sE7sZAHnH&iNN0#Vt}>?meHhKbbZ zw_u>F8$G>S8>Q;Yq2X(5?V8tL7rlkiD72@zhd^zU#xv3=YNLQh4fKC|8M9EEHAD+y zAc{0ak&TSAOh-~qJC{LNOaQ}OeQCoF{78}rxg|x6LocUH8-9M|HM5>gD%y`?rpNxEm15jz+7QNI`4Pr7MC zSq|3cJDE@``#!Sz9wf-(=^h$p-Pi{G#a;bOO-(4oaM(S{_JZtDw*(D_iIv8nibhwu zrl=%pahREggjfWIk)+joI?-ISWq-x@4Mw=c)X8lPL>{8TBo88HDI~ABqL*~dL-fY! z{POQ(C(aCq2cG&9w|kcb|%)6~>9e?Xdqy{a{rzGT(G zL_iv-g=;x77AzQYglgv~-B#LL3j~t@TLc=ZVoDd&%Q!h=2sNI}%mdw?wLIdo+r06C z;WQiMIwZ5dkM7P}+cjZ1aSh#x1_YCZj9KHJE>R71Eeu>0Dx_>Ah$KM;Z7kA6!t%7y z;YN1Q9KVX>)y5^)V3?z2v{Wjc6~9I~INz`XZs1L6SuRtGm^V_5FQt*`jF`4} z1crTki))r`dJl}L(&j^ZVu{e1h9m{u3&sZ*`r?i>`nz;Q$$(kXG8*kZ->(|atWv~C zB(oXW?_pZdNL>t1L10}dagNgm^o|UrX8BxT`AfNpkB_T3QF6S>5-fdyLGlSR8&{qd zTYVZ|Rxs9;hWXwc5gYA$LpuxRLn*zyIWN>;!+REcm_M2*HCjyr*PJq9>0tC38tcpS zB8gYi6R=cB4&c+uxI|7o!2JJVPSI_U;>7Fuxl{%PPkqv(<-EQ$mhG zv8lQpZ=$@&a&+wFH3Hk|74k4=@4fcgdCmc$&U1U_8dppavmN)Jv-|GOjM&#Bi{#n( zCeJ=aA}yFgSxz0KQ({Asj>nl9G7BmOu%VNYlBruLzus!PT`}F=tP8r?24vlrJ4P2> z+@n11H|r`&IT&Be+o=KhLvveP{~%9ZrIlyXXr=f&&6=axqj$32)}~hEIIw0!?Zn&I;tTzlvZQ;;CWqS4lq}8II`{DQ;&k$>7)zmTX2vX*?V^-qQ6I9< z?N*;dpCNGx_aG4&HHfWf0*l=o8_RO;DfiHuds>`F=D93Rv6esCtd_IPMmtZYr0ZUX zv3Y(2ijs8mLjk5VI^C!}#FtBnvDcHS95xPAqMYqMrY6@BIdE>?kfo}TEa^|FDp3@Bac`=l+?s2mq--3(M85(>hpb{Y( zn=VphMsZt$VLIUE;c92m0E@;jxxP=QybO}68=16GMVLfGIfn-p(b%sMWIwfkV%kbq z64>ssL;7J-8W0P%lTiPjbI?`YbA)F*- zCMTX{AGWvhKpJ2>N@ms-1H#<6^GKfduaC{;#FCh`#F!8gZ2<=kHr);u3m>orG$0#(;?t08lJ~4B|Dw@vZLP9M)4Iw*sjr1>@E2}qF zZZI;tGL?yNL?-lRtX%~V4>?)3RRUQ`NM~cZtRPDlA+!3-B84%KX?j+%-DZbS+iVtI zc+7^n0HIZbG@pq3(q0`8#qsi^j@MBar+u^GFBbC{d9Rcu#DC5DtU!1e)iI)Z|M&aQ8x&;*sGA zj2N+-Nue^}<#xN00($AVeS}B0_somWbd{Nopom@-jHOTE=$EX>H6qeRWFTDw z@`pP`>gsCE*Dil4ea4_}GO`lTKcy&D*-!xv=X+R})?;OjQ{?^kp7X)|Thje&1>?b} zj1QS)sMcXojdU%+R_rzd8o?X1x_ax`;#c=*Hl1?^V zEY-cqG$-~CdP|<}eTqme59>LzEDhAD)-wCDb~V~j=~mNtPF6@+uOW;&b0!H^TiN@e z_HHXF8P6#Fz9HQwrc(}Eh71J>d>NgAnwX6gqLu|12KXYaQX~XpuD+#R1KiT}5J${r z4_Xi|MBs6y#L=@MK#A^bl0HjGxU^)25<`9Wp+wS<+Y^^fPS8_i!7Xf%b@Xh#ad>E0 z=Z>v4i!}qeL8E)@m|VE7HfGhW@7T&@I+$f7uWn~lIszA;zN?j3B&Kr@E#2((;&fLT zEbbdkZ8(Yyx?&-nf!fG81Qe5zlCvW7%w=Cv9k6R08+rR6F^j0ARkMC?YIJt1iy z2h-j@zlbIwvfD4phQ2MDZ-7dC@xVSbInhubz)qcw4np*YIj8|psHw#@DAkiWFCbe< zWgmNAy6I2&#?`}o1C+tLdjV_lmJ>~ZD&=&>Mmid^I~J5MIndsku|TYx+JsHn7P9nc z-SS6ni>73_Kv<9`EE@0Y&Q?4EmH{|D8qP{VS9fx%O(Lee!7{% z82gJjDn(tmld_KJ6bVOVO9w0Ip(-5Rx-mVop{Xqfg*-@6t1`x{Et-r~;OxY(iJXCj zEc>m%1;beAH#NWvW-PRNuynvnTberPu9=r)A&jY7!1#Ay8*UJ6m!$5orB0n1Vvm>2 z))-7#GN$lytfXI-vDq;wh>v8l@ra`4(={x&^+bYv^OW;z*{-YNi&?Kz4Dr@v3Ckm; z4CK_uV4Wt!^oStZxjQ}aWvulA6qyh63fV zV74+V$ZoblFsaMdqD3Kt-l&L$fQj@pc`3BRFdY$!)PWu|XXA<^r?L7GOdTW4;( z(-*9D>NZ*J4jeI@sg&+8H94dU;|_&RHa-%1K1Y_d7Z<-pBOS`nyrUcFQq*O1E8|S# zR{kN2vi_NFvhnnc%EY*v#cEo-MTisxl1xNWYmSambQBh3$i+I0s1VwpvD?WWtpTfg zn`Bg75Vc3s>FjSESF%6Vc*6+LkEUW&(eM~nWC{{wZ4v!_PddzybWM^^xVD)XEqMYPxgfzCag8cbi>PUR5&=U=Jr3MG7H+gcaSYnz&I_030 z2@d58=dsQM57?z$+Q<_6we)~s8m2S}6j0i~um?ypW^8B_oy4D>OO(e&<3p?i6o}?3 zXq2K%H!=uRtTh>*p>8ZE?pa&}6`ctU)|a?*jlx4FTp5qS@gB}8*)!)UhQ>^Zz}&o; zZ8m1#l{qBmc$vopAYJv)cz4Q$2e!NhmJ*VCNLlF4*ke+dZIiWk#`}0Dg`xCHcWfat zPYr*Xal^=A7Dr~BLA2ZNvglU%og<2u>|XDsnPgsny4jJ$P7^nxDkV4=N!ys%vWpN| zewTI@^~S!@gBYN?_8!?)TViaW^m^T4Rwlf0;E}PF1Ay6+INJ!CTt2xv%gt~khCOEW zWp$h+rQNu&Mn==Mm6%g2D`nU1cc^qzVsVPCyBYW2ZO3rn$YNTsf4zHds=*KQuuJF> zBX6yed`fd?Y_zEJ2W^a$J8h$+^vF&35_-*4t&#_~xjyVC!w{Tqkdv+>+c_gD4EB}K z*Q99KR~Ry+%Znq~IiLu^{YxG)e`t6?+GV6DqZNRn3FluGN&qcc*wYn8xB-U7U__Ui z3Oj%7&9wB{&l6a|!gk(-GuSaHF(9{wt|Cj27vnV5=$wTF3Z;;X{+=R8C;_C&V{?F| zZSL;7?!5m2o$?^Ptgz^e{-MNC<_O zGGR;O5=sDR6Tu>uQ=t18K-nNR#(}ixVS)~0Q9f$y{w%5#Xi?T3-h`NxOoS zkP5yG_p*(j|1FyMhbB9vh6i8MY3+w1wLNag2iDw>;QG?8(eA#!F_}Ci$$#zDzglZ* z4_^J>mL$pLHzvsnlau6aZ~c3#1l}rvw@Tox5_qcw-YS8&N+6biP6>*N;;to!?((W- zgC3j`a?=tex|3J>oLLL>(HkPOZLOLtdCbuAXuKGK6 zhoG8@0W9alclq`-Ib&qHo#M*PYi0H{h5uJZy%IOfIWtV~cHH1-IVcc!N497Zq1n!iKr-LM`AmBE!!Bn^#?D3sICl-k zC%+7AG;^0+l4J`gyi)FfN!MCr*4uFWOG66lHcAV5c{3h!a(KVJ-vZRK!FtG>bgiQ6 zM2%-0%;J|GgedpF5-`j0q7x9y^{nDky?l>3fm?~68P6lSdRdNJoQPSDJDC3ypEzN) zZNl>XPo8)F(>WH+cmTyrmHEL5mVX8Y2m%v|bqu$gE%l$5Gr*4xOTm93qXEK7mRl|rrr)as7(HMrj_ zca<&r#>Cs}h)FDg<=hBZPX1)|pdevy%2{~Ukkpd+<`zRr*B?q3NrG82wNmESOd_?g zx{|Yx3rGt&Z8|XK-}hB1 ziT~r;m?i+WsV{Z(*HCW(od&RwntFySzSH1;UG@A1r`g0J0k-uuA4y583enT4X7=_# zYuGoQCP>dT>F}9ST;~v8c0Ghrva>_>4#a%nl=RZ_BF9KHB->l5?|U+BBi&e;3(I^h z=g4kBEl2k)Ok#H1HxA^CPi zqa?p2Cj&-3MM>q7S`f<8ZIcDjDat^8LaK44B;6$9KBFKdE^W>&qbWWs73srW?%3s& zb0sbe{4P#;n>%xgE`(g0;i1vlne+A>nrQT%?6#3c+M9HXukb^v-8?!mRY6jR=lx&`En3W2m-*X1s5tZBK(rTIx|`vke% z{#QQLZ6CL67qJLs@{rr#76{8Zg^^Qg0(?1#OMNd~%mgkA{EAQoN4^5@~ zTuj!)Lu3%Ly@P2Agh+ymT!mbEGJk@TJh>B5A-;(Vv$P;fPh4d?N=))>&vV}0t@9Bc zibgv|bt0snz=;A;TUyIicYNXd;;kxH3aULqx{nMj)8D}3IAo_C|1n{#C@ zlyw*?ce89xiL*2ZC&dkfEVTiV$st=s#i?>8E`d;dh37E51^}B7iKofh9D z*^9JXW$Dy|wql>HP`2q;4eUYvo!X!O!TpX@1m)@$euP31ScZ5AJH2w=Fhij1sQbV7 ztx46pYL=(C-B`0El(N%H(9@j6Z%sf8YH_x*1&xM{I~RA9A6nkiD+Do~WxW@K9EQ}0`TubnXqtro{Z`DB z)BoL;%Hnp!(S|LI|Jz-cX`0{M7Rq!xWcrrdK*_nD*c0oiNS?wVnVd;G))Wjh`bDN30=1;+{R9nh6}X=e)D0vt7p|C3(i$qdH8s z!Y`(s5Wrvmm3K{fHFe?WS(tOql0un;mB}og<+|a^IHs@5 z;-q^yXV*}4x}I8e&*OT;l{$XB{S z-B=l+PSMNaDV!hpPtFV{c2<}_&M&30_MhjHuWIL{ZMsWj`5pq)~Bgx=kqG!)iQu*hCFG=Z{(L&vafrKI|q4WLiKFj62 zNKWViqwGu8S`fMKh~*944L0sTh#I;+XHVkVQCgc{-BMqX+PN~eglrqlX4{z$NTqV> zseqHxDv;jvM-W7E<97`#x5OHb`j~eTNpH^ZVr1#}b6>$T@|*QIX4PAKN6oDzzQ`JV zxDiiojE|foU9Q)O^hS4PF(?zaNV4^}GCrEbtXH!)WWOx3Nt-|s-Ry>KS? zffSF*=c!S*T)xK+f1Xn{aVimWE*!v1qP_|&XT@e!jQMq*YfU_ z$~`oyDKA@PE^+JVveDqsvE)-ba1ia6lm)dNg79}XzGX_Zs- z!lizl8$a9PoyOXWwD(*;FNo-fG3W0fy7AE$)#0Lj*C~6R*db%~Rn&qL$_77bjh@yh zF86&{DZS-=Og1wK%8Y9QkBHguEg*T)N{BlQg_;c-@>Kj9o6xeVm#0ih(x*4)^Rf6< z5q&%J%3_Zt4jhTH;4TuODt>N9clo+(3BcU*SSzqsWY>$dvK(y;U6sB%N5lO{-(U{L zf~*^aMGOnx-O3$JiX*(}Ezf(!Q(^i~pRCRGCneueRZ_4*6uz6A)miyhOXZ8ZHg<@^ z1vQ&+CO`AGB;jsbn^d|iLs==wQ?_kIIx7F|Ps>`tk0Ky3)1_bOPrHn;j!kGKiO=Oo1`E!|NNks=M*cA1G>*Oz}n(OjLnk{2V7Y4p;; z2cv@spmyzSOAN&sDB0$-fXOr&BV@k6)PtiN2`2XFsLmac`w&&RQ*PUF=OA9EQx0)F z85O@x-UKQHmuH@G`cm9~Whz&>!>dNua87 z&wh;#)(Txz`M0ts{06rV@G=OS{A8V{s_Xf46M4c4pNdj~^Sv8B!tKQ_ka9HA z^JADi5m(egoYO_OL)=j(^4^$@Mh@)uw-l*v^;}#L(Q7+{vryPEVl^8*6*W@gI%mYF zHKp*LD9Z&>=3*wki7Xc*^vO@1PNi#``d+%!B@bCu%Twu>%nON&`i{JiPh>uQ`J@$6 zl_sd{JAOG=KI;8dzc7Q)S$Sln30?8Zexe32#?gXTS>@}D+!^PbG-hPyzBeNlKc}Ev zvx3clnUN`@`2pEe3t!XG^;{V-e7203?EupEmDrekB}bhpLl)Ahu!b}#HL6S5%M&;U z&ev4x>$i~jl-yV=F(huW(-;G}F>4{9ST})OterqE)`m!kZ|&GhCkF-vFWKXEy(6?2+X_C^^O;>>$tOr76r0(0L? zkcae}38~+%l$Nnx;@rby-nZ{0XCFn5B=?4XCp(wsqHA}1_D*7*|F+D>vZc8&dr-T+ zJ29ir%nEYe%az!0Rzs=Tq*os^Q%HQYIf2z-Mog!dIXW}ovyMh# zM48;UJ@PIjGr|>!vUc7r^M9Kugy~I2VF@m*sOYZJ{_YYDhKrR#YaLaWd}N>`mdYnA%P;@2P0A>@leqVGDGP=mJX zsHwh}k>Y3R9cfq&9|dNp_vu&eWh0>Un~IbNHPpo?>A>uP37Y){Np=**2l)=TLgwdv zWq4XvH31|9_ML>!*axDhCuw|v#Mcmln^Sg$ zhjZ>*@#%()3?n-O)dZC%sU6gjVrghRCT8g;uVhs^%di3pug4|gjHCOkeJ-1$gZanY zlYU%_Y^R?NGO00X;Oi_)LH~opUI7MKLWo~EkcZfr$U~GoeaNLToi=My!h_E0EFwl<*#{CI zvcA@T-(V?Ul92B^qpj)pT7_ApS-V#bDNT}*Bcl`%_kZu!nLYHXiCTo=$$tio2AjH$ zmeAPYnhWw+q4t=$nHH>gsL1#-;)dpHSf285`KX1%tH<)}_3=En#iYw8)5~(nH*$=R z?)4fT3*RhUD$~`>QFQ#ikYPEf7!p%(8m&`S!{nSikG?to(ZNrDV1OU%u)QTCbR!A! z83R6>6jFdl7u;QU;|azE=KX2AN|86kQ-34BMu*zog|@sWZn#;w&JtGUm%He@TYQ}~ zIPYGLXK=^9+*LTv_Zz)|GqH=ZB1zTf!Bl#L;@yyYC*9Ji%GW1Dyy+uG*T^u^qBHND z5AmFv@0Kfz2h&J_+-5uJjvqzPn?9olw!aFu!Fog7IsM+Q# z-$<%4W`BDB`U#W4v1Of2o!wh?Z-ps%>n8QjYd`k4{kGO>O02Y3s@1A^@jYs0&uPD2 z4L82Yi|<-9`P}>EuO!)O4At5GobY$ur0J-wR8g7`q5(T3O}A||4{tsH;W`1_)|IxF z=GF|jEq_ja*Q8{7Zn?+ zN>*G;bF*josp(1bBXCD-Wbv+=@@sCYHamtZL0@HK!{qo?tIh4zl#(RJ$@}0w7qC<0 zS@O|Rt5lma+zR}8Un#$iYPBuHt;nBGmf>pc6<;ob`+XU%xxJ&^#rwwFljQH<{<^8< zWi8&*^i|v1TUxSsS0?z$%_b#(+|qDsr?^^6bBC+9mErf~R^XZpC*`F4YL)h;j*Qt)R2EaX9 zhO0GKTU-IY3~uK`CMB(hTHNxh@iy1meSTj>;0^$@`(cKgmg1_Frix47s^HEBbJ^jB zqnLsmH08?qMFPGB=88_kt(oGQ+nPIE`E^4-;iyT;v)pn;xv#dhwYvPSLfD@IMuGfj zKKMM5m-}5{@CLZK^Nb(OAjP#+UAai#a6!Q2_*E%BCkNY-kLlf$k~wwb7t5u&z1HUB zS=z@L0h8y~QuF=6X9=9zOZjojHI-ZQQEjO;)s&<^m+|`xFvrg?;%G)r?*9tzW-!+* zFx(8Dm0zW!-LXqP0DWfPq+~a4x#TzCeDNjH-g?1|1zfC;j;3ZO2FYx2#|I35>Sg(; zRythzW)gB{8IFFa-PP}E;4Ub`!Ob?+;YjU;+iWhzCJb}eX~X< zG5#1XwvTonYmyuy@q)Q{so|vDm0wG9rOmaE^WeAfvPsEzjxk*9cPs5}RhQv~y#ISJ z2Y$qGahz#xL$C-87w+@z&a#nq7U&f&MVKbxt>aus2*A!>Y@N6!``L z!=HL7zxI|~yOdY2T3Vbu{}|k~GbSbXbITR; z(cIKtbN%>CD&RRVFPvG#b&wN%Rev579v`2S{G3~^j9*8!+2JmO-|xVj`3b|t`fX`$ zX>s+jlzC9@ggMURZAi=CFW^{AlKWoLP^6I+)YWDa2c8ZfT%}TLb@j0uxP_&-w$_TPU+IspFT){KUJn!8?WMSCs~?cg0e2s`&WkL+@~io1 zYwc)u8Quf>abWHWxL7Xe#Wjap8Qc?K{t$3ct}4wft{X~*z`Y8l=i)-VXzgDAJAF;` zSTHlLHQZ@w`f8Pqij%*?h-l|;Pf9Mm(QvWft+q6K{YBFEqk!R0y+Zr&%_#XGA&-{f zD)bvJ-uDsj2H&wb13N3f=GGRkhpkKC9ygWXTAFHp9~hi`9!d$J5yY4X!DP2cOKxQ^C}lNZrX-+S|<Bhul}fBMj*WRss8F6IOE-nX|C38;d( z{$az-O8He7_FaE)7{Tj3GATLsal^?xSL1DNt?|9(cpb%GZv;$AG`Vl8_;&OS*c|x; z^ z_v=Z?>c2BwHebk1^OElq&mfpBe{Z<7-nORq^W&TJ_dA05UBG4fDGGjC0Q~}qAi~{-5 z@}qwJ{PJ?>EiW0bJg%cwbrte7fscT@@nyrt{8pR1Ss)pqK7I%0u)i2C%P-~P#;u=F zQ741h>z{^;^N$*a3)hif4ZmYvpOkF)Mu8vmMz6?rP!M~9IaN#8l}n|mt=Y+Q2mCGq z^T69AWe(Te+S=msdkJB`4j2XU6XdVr2bw=YKk4n0lc7n*5B8y)D>avmWID-T7BD$} z)k=#uboIdI#Ho{$=Vux}(E~Kzwx%XOE=c?T`K-yw2WA^iel2}%HLqWN6nZb1=L0UL zuS&CY<#IH*7r`7V9|Yry{HP8;ULFL46Tv*PqT!>tokOa*GbK~lUquUJiQS;O8 zWE}dzYfMgl$}N}tD!&T)i_@EKC*Tz@-+G7PWWHqaRyw>sv=aHa=be+2C*Nhbm_GVl z&+q5F{|_+tz1wi|tNbv-x#CNtOaEKI@TXpuzNVV*5BkaPmhYLIT(oY1AN{jWpUjhQ z2eZX`hKq90LbG&oAoiHmMbGm1@n;FYly5oCRjz zZ4I|+Okbth+mRNKzCUa?IoW@E!)4=TQ%+9j@&50?d~gTDk&INXa^t?p!GU0I3pm&t z4t2xp8=J%6Au#{m(fGyjlK!CT<}YyoE4lgVx&$6vifgI* zabXD!dkMG~cC~m{Wa#fWzq^CEHQ=HgF#GlWso)*}v+IY9 zUxs61=HeB(ItP-kQd8v%x8Rmx;eNRds*6y zTbkdTxib-5tqg~C$ge{@535dabN4r%Yw@0@59^ClvlHp7H#?vt-sW1HA6M((4lBpC z`w7Dd;BEuA!-2*#E5BOB&-0EXV2^;|6}>cl=#v$vzjT57@thTyIam^3k(K8AfiV9q7*-ZEUZqr*4Mt-!6?ZE4H#1Lw%}65x9HG zaMYWZgKepR57Z|o%X%&DtUmJX@?iL#95DQ;m(~Y%i>k}7$kpTEzCPdhMft1NT3cQF z*bdz70b|@!`9ltz-gyjx|C#{T;&5kyTe4tsGO4eS5413^AN&B^3SjOFxR^d>J>F0w zxM#s!d2}Hk^yA)se+#&qz>F^};A%{`T)o{3?hG&o_ZM-7k z{G=Tn7%=>)m(@pmyYI)hB;?~|IEH;U%p_t5{!SSVGf36-2SrB|iDkH2#jBHv=s7o*;TVtnI`KZ>-YCN{-SYEB5sAHqO43(BU32>Qv*3;g*EL)y z=SpjCy<#2>Vmx4YMK3F7^iIcbKSCZ^R1$A{hd0+Hdw|ryJwK_ zlfj&|*!ac%zPVcU{rxWR`*pxbymFbmwB_2zcSz6{OC~4JEj50zU9t-1$JNEW|M!4V zW*I*;DyM$t$v!9NIM?`*K}MVeeL=A z?>gjTZouUEVTg0_?v9=2h~p6(a8W<4wz07# z<99O|9156}YW2~?0%l4YB-v?8;{-tzs)Z%!BKkNF7Pdw?Eb~c$s62q z!QS%0GN)sg$b4bdD<&s@`?BHWSL0<~=JlLk!{EJNnVd}dn&D!8n^_lk`FJ^)~E`Bb8{xF#NHyTb%@fvS)TeZavnDd|y-84D*8Mj<9AM8Ky^930%p9izk z&4!C|#klIa@#I)=dxH5vdH9uaSNrE(@WTF8aQJ(TMr6d{n$T zo{0Q?3EWYS8NWCVR@i`*zR3T*+{c4?t^rrAd3(;UnBc$t@yW@vPZ_^8(|ECB`u$Qr zfd2ibCnqQVsu*uatJf!Q0QUtj`#)ni`PF=g8N|ueGV<{eFt0poxY$ot&?g=48s6XQ zIpm&OuE>w};qB-{gl&xQe@Yqv7wj!w%nW`X-XtRW0+`ERFr2g==qgF73{w|waxXXe+9Rv;9e<| z3%e(UM|!P*;&2q0fqxiI^dl`7_Eq_Q?QQEZulVQWWW{%hr720i5pnEabMc-^!XICM zO47NZ;bK2dFX`ulcM#o`U>0m@xD``=&6uBEKlBv*UIFvq=7x*)i#^frqu8JKUj{RG zivq5_-FGj^yTHv082;4DEv0ut7#xjKc3*44lTf9*Y*zM!Tj~A%7HZU8t8ZOpbwY}y$nCIblCzz|-3jA8x zsG262|DWc*0n7#MhJ$^`N3-8vm%IV}{(#|6y{uhg&vtSu?Tug5H<)&NMN!nRHFubj zTshZp8^B-lQE6}Xdfg__C+#vN*_>Oh7;mj3ztNn0Y!7DpT@5F{%CFj*vo~!BZV{MI z?PfS04Oe4Znk&DDpnn0(={*DHS(!I1-$Q~P0P}@?4EJu{(|B80e{=a*1^Vs#8b%YB;@IEm zy3<6~aUUqdQF?BeNyOyy61W2nGM>_&EnW;it{=LOit0ajO0w;T4JYl?%B8)4zImep8%p=WD|6CNTFMX}DP_j%{gvA4(Ir_jgW72D%IvTHP@v)vM$t!i^C%w7lqt@!@mr~~M>Yb7t$Sqft zKdiv6_>x}|&eXPJ#NViQI2hhHGYB$c=BJ`fd+yIACLaRGTr>5E!lx zv9NIrn7hukG>RS9r;k}<;Q+KKT(l!d2zt- zr(RYrEmc3B??uQd;2sFrOzznZ=j2)TH~qSdAG@TzVsaA&vB9UOBu{?E(ii75%^1#{ zpnetH4i_@cTx7UdzwGDt70VfZejWC70~5Sx3^As z91G@&fQxdb`n|MD3rt>nx zW$m(q1un^%T~G1fO<*p(yvVPm+3O{b!r*l<4}HyWYx178U$zOl_InESYrZ}useQw6 zF~9AMgBGR!evIG!0wyJ!ys*&Z>P_^a$IEb-Z9TsOM1lM!{r$Hs-Ys}Ee%RNXTzDOauV3v>*im4<5^ymeSnIqU95u{*+{Y?i{Yhc4b#E-$9TTf!Xv2hFcx5 zl}jrNKKiQuT*U9oV9vb5a8a)#A6}sx2KPfSt^Z@V*dNr`sPE*Um4ZDI%msHEF1C*v z6E0W3QXkKO+3JUei}lgmk+Vzv5(e#H*1XSf>+xQw-<-kZS{NL4|CD5v2O8qd*_*^9 z)dl9&hYh!B#;@k*Ghc;%_M=mhZ5}h6%P$su0>kwZ@y-LY-xI}n*+${=dnFZmIhb9a zGTb|P-{b%V(CI@D6VZWBqfb6>IBD97qnGscb}{rdelsQcCbwL%-a0tHpcMN#od5m+ zX4l^uF6M(-w_kS=`4|Foa=^v@qcF>1kn38;rTdtVj zTq|M>gx^D8roCjiIKQlRw0S*D#{KgHMj7&B@|QDHCkH~m6x^!;8{2QKsom>;JAzy7 zW%?^_xkyH+-`sRR*$VoRV9qMy*jC{6Y-vZI2J>{l#rj}&uv=4z<*3hj^UOo^5gWDAAkD@`y`mZ1zfDR zYPG|ci{RGy=al4lZn+$egNsViAHiJ$X3FaY9M%$FAA;Ke%vlXMw(l1BT@7Zne--$( zcKBuDKa=-o z%$}N@&n;IhXRKzv<5)=8RbW;XgObN#74U}OZ3x>K%uxXs+Xua_U&ogD%+X*TUeWl? z;62SR=Wu;Sq-$+jX=<{7Tdpj9`SU$<;dd;U+g2{{>!6?1H|=L_{(HwNhDpg5FXH0* z@x7_8D!3EZG;Hi&FmL$r@&cHwu-4S%GH$t|T#*m2XU`$v`(WPwPQ%GOL*uR1SfJKd z_2*gip<}=tv4P=4@3!=@!Nj$r8_93q##57ZH!)l+Ki2L2eugdRK#u|Qr7a8>^$5(d zUQhh=Ox7E>oSIB-H{AAVyqpj9cA6uI=$LJ$CXdW9T(k?+SWk8W_(k4-ZSK_MlAR4F zznTwbAKu<6{qv&%!=HLtesjmS5;@lRJh;Byjo$_!6_-DznLG#mu05tEU;Uurc+GG% z>~(J3ZzJHxg4x?}GM`g^HO~3hcnH^Y@_RLy>kcv8uFw_N-t3qClC7aHJn`3!1YQMh?ZXWlz+6zoHFIFi$^B{Iz6@roo z0Y5G*A?yt>;|mQJ%NcJZUJj)HybsJT0xss4RWM&JqW}E{%m)3&FY13-C%qma{o)6~ zTvWudKf8&=5z#d~eurVrQ{(Zp&?eITn6@Su`~n8a15! z8m^s#Cp?7fS@?Yw%qJHcF4`^Fe&EN2t-!wyX0s)Ri{(H|j%dWSc>Bwf zj34vC%=xJCi}hP;$(>7R1-HftQUj#h6TN;V{9 zy)qp6@Z-l_WN>G2vp;S;MJrN%HN@1l-)EtJ0L*%46>+sTFMk_@+aJubfQ#kFaai9^ zNei#O`0EsWF7PV)^S8a{7o@}3I}m$eV{Avb=E6Yq9l zt_`?Mo;gtB5-9et$H1KTY2zpDMa!kq)ZydZ8wT(B%+zGyvxa+D#Ifzm_4j{)e(EJt zlck?4rmr1KA%Wq#f&V`ZW{=MsE|wq1WcNltvM* zO~CyQ%qrg~;82JBI5QXg95AN`Tr8JX{4=D?_V*yK0V@Atr5alOU6 zI`5ghsy~nO`%^Gqy47$rgCNgM94O9k-{H@j!Hj(0a4{d)ON#Td zW5G%jyF)*2#S{1$F|M>+de4kMlUbACht4wSeJIy{x}#&)MNVM#!w6 zFrVg@E7mW&v;9Q$62d+QrsJoDc+r}?{optziXR2@`lE*1gZC_64m7#)6Mj!WF*P~% zNy9}s;GB)G4>@moF__DrGF+U8GJJSB6@Kq{n(>lbuE>vV3Vyvp=6?@?c{$*+{L%qB z1#5qB{{*wwuZ&-;5B4+o{a0TFHxJAT&lGS><9&bsC2;G3xhvqJ98^*4oSdEv?lmyS zK3mKOhB&8apMv6gF_`!K$#5I+o|ZH78NV)6BZJ4jz&P`w;i5dVJ;!wi$xgigS1|1_ z87`I!{j=`?AA-S7VAlM*;Wmr$vV7_4_rna3H@`MDS$(p^$lj0?$8LV#K6Zh=&D3eh z3EXnUcv-e`*-d1>z?oqFJk4-%zJ=E5H`JU0kDaDZOMb{Lm!wk5h2>D!jFQRld;5%O z$y8b3<%;#eEX6B|(r>hb*)!l=`h2t0{e%aBc_84TykO??@^UNuehub|Sr%`^Ayr;) zIvm`0z^p#IfNNntq3ciY0k=uO@TXoT2OUhfQi|;}e-+%66^viZ2leaiH18onD}mW^ zCBsF#E&aHc14-WaO3fd@AXCXY;h=(iX$Ta$!}?k6Tw0Pb-s^r)9#z73-Jo+4l!h&aZ%3wZm{^ z%hK1(F-TXxGF~nQv+*{Di}i+oF5jPu|Dh%@`)+HvOrF`sIV!L%ejU= z1DZdY;58Ufu>IWD25wD-v%KYl&fZEMhiB^3l7+p6c$vrh0pxaYXMovbegiJ&7veYuj0IqxA28gyyr=17dg=G2 zi5{}ikYV^!FO$=j+&H}}Ar){-12&c)`&oT|x<0s*z+6$pwXrYP*z2#%-@XwrDOux1 zFY)JHWW2lu+=h!RjZqF*j`H=Z<6FSw_+ci@jlTr$S%zcVi0_9EC88U^tuSWs#{5=M zCtU?UM8H~L{xDv^(I5D7S(S$PDwt`<7%tiw&~l_tPp|FacRrX0K4LiewQ^ye>=d1D z=xZN4E%^wyTrqteZGKoywj|(GFxMStxY#~wvQb}O)t`0wy+2@5s>wlx1J5ZXNo2fy z3EZB?7vt^7%?D2ccMzCI11{EEvn*8))c!^ggoir`^3%6Xc{Md)*`$=4KCjSC+^l65RdOPZ$ ztB&OBB6~fF0p}Lt zWgmc-`-_186iod*!)5(_{`~JnfQUp2QbeiZRO4rZGR3-NM3$}8H7 zc>g*u8(d_#m=Dw(pN}2DwSid@aIu^_TKusw^$U9u>Ec4X z^v_NV^xWNC!F;xe!|>?F)hjk(e;AnW++ny4;2-2ZXOWdAzvi8W;ZMC3$9^Q=Z#+%N zZs0cgVIkfsV(R*h?I?)tz%0GXaG5-F%+M8JKjZ!lVAj3Ia8cjDU4~!x+nfSB2F#WB z8!qZioSX3aknG=h1kB6_3>W1EKi1wZuq*tkV3z&daGBnOUnbX%K2Lr>`0%vkcieKt z`X#^KZgCc2e*yE+M+)&W{q_4N7p%-W9hjAVYq)XV({kpNhqP@LrxL6;Ub9}$?DiwMNm=FEaa7XZ-#@mrI11Fb4fAJ0amwy{B=A*&}HYd+3 z5^xcitJK4Us}J^v`T6wC6xg+37EY2JIKRZKI{O1xdlPo8U?v+b#>@Fyzix08xS0XN zpL%IN@WbaFDNRA(js`b0-T29`)o(|ux8MJe^nD-9sk00h$4lAHS_={I-)7)enLRz( zc16P>w#JXuD8F8@FBNbon5$Pa+{P)6S&wU$$z{+tUSoQ47q?tlep%ObKhP!}2r@bG3+;T=y zd0@^AxY*us-|hu^18|=Qb9<2=e(AjYT|q=Y0W-9t#T(lP>+xRS9R_z9m{sN&F2>7t zd9Rn;LcAM+`BlKhehv4retv#0xEXUPKW@3Qcw2Ml)!rw#oeiTveyp4s23@%vioi92 zJ7YJ)dinGFZf2u6Tm|O(0}Qu*s3cnQ&o1UDv13grlb?GX@Q}dWysD=-bgHBg1{N7k&eIq_%u=phworZ-jZ9DO z9W`96H*rtn^uOB(-fnDq^7^rcTQ}v`k~6O*4-)To$4^gII?-@6`w%bf*VV76!#9Cx zKf`eArMMQFn=8Lj(s$CC)00;}Zn)S!Xytw)D&zUP&zhcmms_q_AJ{?sx@ij?=zU-& zUvD^hPs@d2+Rx)}fZlY|^yE2ixnjInul)X9QP*eRJU#iu?S_l{0C2zI_dj>RX#2wq!eU|{BC&1^yJ3>F>KVE@Kf&l(|_^GDtAs#R{WviJK6UbUCFT76KhfS^G+Zoax@W&0D&Lj470hb^7xRl-FmE^80o+%leHbCO$9;*G?q-TVVe7 zFT=(8LUVp!_y@o@zhRj4U8^^?89BZEV8)|G;C?hyY7E;Bx8(!7yi)8(_7z+=dj|VO z4aaMS!+(?4clV=Q_F8F1a_MS@TRY;|X6fW_cle#N`i$hUH4P`f8ZYw?e{k_i=*?@* zNFL>uOLC+*Sr<}@{rm-fo2)$}dFML~$D`pm2kzV3%arrhVAg%N;bJ>tHQwu;cY^B$ zv-x`s=f=T`*LNoo(Gg&dTF-DU}&OnZ{gtv@6AI=5U= zUTW>Ra}I*L5zJjh9QIDHx3327XJDRd#IXV*G1w)z7r?x2gF?KVdiUk>*)DWQFkg}d zJFaeSt2ZXVF29#RKjmYT^BIPV{e3e7i0fZIKn8aMbK04Pi|YogGx>$_v*=HM4`%U& zhTAudSNxXocY6JVin{c(Gm?du8SWhfSo+wX=;lXfQg1_-&q!Xoq7bia8+PfFdDszG z&PZWK-WdpxHb1JwE!F(m)V*6$J+;wZZ58(NLk$B|_ za-TaND*fpiS6Q42N^z{d`T2)*N&A31DPUvzYWe*oqF%yiN+-bKOzfD1=@%sLLK!6mzq_>zC*}>;kxRVyl;SuB zR7l@rWjOX}dHq26Jzs`H8}j|GwCk74aE!lx|Ku7})IY(k`~xe$tlwpOiEHSmz;7oo zKMc57&h+^Q&x3jXe~h2}njCQc z+zIr~Bxw6PXC$ZGWwOOJvTqdxb=|XT=`-7AuwFe5$_RTc6``y@@x5M%AFSyJ>s)q9t*fw&YVZ|{qrOu z`V*L!o-lsz$@n#Ud*X*-@UCCbk3VI&xb6%;FZa^#&VG7E(#I`V>~}e3?G4M15_US6 z&R-c$el;J}b~X&in|A$!cy9u8{d0y}6SC!(gLiIR_#hFT{rrsN@!uLQ>Kpjy^7AOE z!_9s-BRPUwu2?R_>*q(mg5M%A`~Asq>w>j-`8?wxJ_+jXGxGTVI2Ik&?n;iM&7f#oQ{?~xv zPrX960!H}BrTM_WcdJ^E#R%hSM$}^MuHZ>Kgp;QCZl)8;di z{kAq7VrKb}&r!K?=2qwrfjO_qa8aJwH{$mxe3XLy5}1vuhKq8*z7ao9xdwh80`sqc zi}k_2Id2~lJJ+=4naQi%a>f2nrtz*nxEBF_Uk%)@hWiv)ldD#rjYRs>yFO$X;U|~X z8)}K;Hv+wVuM!;Um0xc>5!}^fILz&?drqWWH{ZL2AGvU1m24#Of;%E$W4W-K!Ru?Q zfSV6yX%UB2z|TL#zJ3yzbBZ|pGx+&$C%B8jycTe=o%0n`Hw-2{;MUq_X7Ukkxnlj2 zJ`Y@%urCIT;N;SBCVl>(rr2BV0QdHNjbA2Ld}qM*ryl~hCYbIbu9iPI_7iYR!0fc2 z@r(IjKaJmCycFC~0mGkqY5FiHx^6AGfebzh?yQ52U$mF7-00`~hr{8DL%!9@%n>zHxc$>FsmJAxY*v%pS^zY9dJ8?`BxD~eR#cOM{rvoJ~J8SmMhk8mHKrJ zRuJkm35;mqVBZnf%y60fvEAE^GlQ!p$u3}S zkd2gFJO(*n;na1MBKHeUH;mxqvi^kwosQo;=;wobHDF`BxI6Uy!DHZ7``FCnkKA%a zIb}KC%gfFZc*ac5TorKDCO)hnfp&@f9vUzyEu=5^ecinX902#-fOYB1*|{*wCy#;o zcfdtCK(4$VE2{5|GiN5-bIaxO!GTjH>5mlA{$M^$su@2y z=lVA=tA4x?FVlFhPs%=pjlmpxmf>dco|X&ewtf5fDGlc?Fy~)jxXn@=`+~fI_a^9V z9JYQ*4qS6(>1)Y-uWcI!!WBO=GuiD*!_5I}^}%*b*Ws@N{nu9+M)=94IL1J@>4A_`Ha9(kG2;4njF1x;v57rxffB!jf-wzo6)XU0`>9m`d z{eqCgZ_%(-BofTxOrfn4Y-&OJ`d))gJctM zZ@Y13vMIM*u^l0$uKDVBtD3=lxrpObn-iBr-nkCU?~6FJFu%`yfP}vSrt4;lH|p7} zGr4A@dg8MIqY30k%a5<2d3(gV&|fOUaXi@<%=+L~{_f1A$}LySFXxH9U0IH~YzJoT z9~e&Bv&PG|Vc$MxQLr1|F*B+B&~R~HfwkSwSC8iXy8=eyl`F^rCn4=we#QP*xoc+f z;~yD6nYE_z`U;V9-r&cEk@w`Xa>0#~69m!E4lBc9zw+ll{!KoXfLnZz@sx5>esbK| zRq*ws@9ukNCdb`xxM<&{K72b8xwdmjfxkGXka2KTLpEZ!)8Y>)N&nykNlAI!y%8ScHjr{yPp7G3$B1O5KTOY#fO>p7Qz zJL-vYoG<7d!M$FJW7~s^S8(rtvXo!Dw+qZAgU6TQu(Nu37CqtzzbN5H>+t(fuAtwT z_RE>cSD!X))UPOKr~V~>fZs0yhClT(`O9rw z>vItczqh?SGue_`uE>vG&Fg=nzqElFYrye=b~iBG1nzh+ZGSd?Q7=X>@$LM0B03$+ zlvfNF`vba3pN~zcs2#x^{hHxKAGG>t>G1mfEp!~!f6Qd9PBbCr!YQsb=f*4fI`p$P zo0W8IZaBmulpo`zYv(fG|4_j2r(PN_erNpn_I(%}2JRhO8NZlczSHIHQsPJCXfXfS z+HjH^%SVSlewiE(zayJwB~Mlj7wbdL5rlNeedqE>D<=%t;~Cx z52lTNKg|Zv{|#pS?F!}6+>~>Sy&1SIz#LS>@x4knebaTdqrhC=i1X8hrRt)GWYQ{J|@_LTQb5FqVr(RYc z>|;y`{4e~LfxC8>Mt*)Dfbg5OYe{|)1J{iw{{puzxOeYn*w_z|J}+2ngBu7K{?tp; z$97xaj^?6Rp9=2B2O7T(L5BLs`J)wisT@puA z->-ZdxLd&-|KS1-?aKEDzv2B$0!HGMOVh{tpdZgaOGk0?VaCf)X}t0wiIjr;fqT!9 zvywZGGHmRxu&Q`Fjm+O(1@q%B!^M6`w&6K}k^bNp0h7jJ>0{Z-;iP`2%_~bE!;u@0 z_5t@UaQy)r<7NKl^C9t`0OslCfaz#1to1mayi(Ya#m=%sSocvn3ptn1L{s8okfVnB)BEMSR zpUn9%xC6{VA2WV&9)(vwZ|C0|et!hB?HPuP{5ZYu$7%Wg(avB#^>M>ReU0xG`E`PI36>@&|k_Al~1DIsRP3$*-0RI6q&N z@%)cq=ACD_*p9$?#bhIJCxE#!;9`C`=j!)2y^92W6Uu^#37XOX{O2aE#w(R@g?xeoB7&{w{2R&qACTv47mr|#zqGX8!sU=+xY$scaY zo%}5%K|cgnx!Cw2wgK1D-+?a2dg8L4bd0#8yFrPa8>Kbs1!EF3> z!^Qfboc)ABzJt{S=IL)5E|X^_7Ownmpu;=lnpw&0ZyQefC2N=L!*l)6LC}8*rgo#@ zV!5Di_;u4A!R;3?{Hd48GuwTf90>0GG8~_m^zB#tAwLA}e{L$|7rFQS{U5>I3+CqU z8ZNdsyi>bq6Y)RvOu&TXh5WJ{?-;&9;0w1HuN)3B@aybH6Zp*cN^ne9yekR73>e`jm$l#a4&Od@f&TU%&PsOUmMgXo zmh=2N_B%=V;b4~BWw@9RtmrPgx_{_IFuVP@z>n2)uSdwZaCpFI#QbRbI9=g}>Ev1H zUj_HcyNzGe$6H(cHj3nH;O+*q_$P+T%8&WJYroR;z6|E+fXmtu8x$SxXB5O6VD7uu z_{~hy$2lP1Z>&Q>G~YKX+4FwGW%^%R&h8_)OTc{VXNB~!U&^n$Ttqy-0dv9whKu#V zXRG`?o@sY-LBQ~*URr+4dwf6iBjUXU+$j$g_~EC+&jX$UcOjT14;wC)Gt0jzfB9eR z7S{(%N)PeoKEQP&flrm;IJW5JY6-YcKVos__+cgV_UF3^T;b7DT<-gCr+|9|++mLy zmTZOg!Lc?cSi4d2bueFl(r}_rYd&f$l<;?YozEW~znGQ$lv}RIk7W(NZXol3hrvAf zOT$HZAy%K?Z!ti&JvA%&;~xz-pZ7w%EWk+&cAZPb|M{g^$;p2y@MHgrZ*Y@H&~L!} z{uRSTd0|%J^*R|J-w2pA4vm*{q~88A9|mi^iazu=;}_)_JaNi5dE4w{^|#AN>G~o3cY1y3YQi=F^FY95?U#af z1I@oFmzTi2INA6`y@YK5{(Q37X%|f~jKnLK)d$tPKDotWjMsy?++7s`)e6a%oa}H&_Ab^dEah)*i?@jr zB}&qtEBXB*nB7(=#LMmjZ?BVfehir7Ry17JF4?%`^#wxRuUA8uUk}u6K=1D)_e})O_{gv6tbvqhP@})RF6X&MC$sy36oI5+I z?OaG7pONqb;o;!+1M`i5%jAILB(6TB-*_0z?*oo%406E2u9JhUpuYlU{aq~H*pG86 z(5LUa;99}F9B^@*Zp|&@(D!lfZr9n#yZ11DvH#;cd;Yxh)!@DWX7>*nj$*R(aXi_} z!Ew-^0(1CYg>vC@Cw_h;{sfN!bJD(sTPNiw-GM8>v!Nfm-|S@8{)UU?!aUF0y?Y2) z1I+)&*nPm=R6cM3KX!$8kx}Tiw|6fQ5sIuxg{(rdQdTsOk(6YV6um`JW_wUcN@Y~i zR7pcBG=xgy|NEWi-19#7-s69M=kvL**S+8OIp^8qjC*5GaKp3vr|yrd@w4@oa?T38xcU7Su4=Ik&tbc^ z#WOC%4>vqK*3Sygxf}8LD9G`)9jpJSg1;ZU75y7t+=}v}AgWx^&4PI-)?s*Rw=XT= z9*6lZ&fzjQD_z)*{|wXVjhOi2I>y*_m0>VXc+O8}Jk`aXH?seI1*X`WCOqF|;QA6P zVH&}m3DYXxMXh@`fa?J>Io?H`_sc;+zZ+)jJ7&Kuk0yWf^X>C*oACa!o#mX~yJF&t z8FnlyUy?VR~*?Bs4?LEYILqcQf@ZCu-ed9zH3AOD}E0^Xo5~E4v)D zg6jfvm*@QYhVIC!9?nar<4f0e)wBqUi6$F zUwqw|eZLj^-`73kMj~>2c$$&jud;pVT)n(A8!v8tczB$aoq#>?*#ejYu@3WYd;G`m zhy4YnSgHw+vu~5mxG>l1R~e7dFpqoA-!E=swy#632lq70r?C#rl|9~Izx)l%udxnS zhuQ5U%hgGkIXp3it!Te^ERMDAxCEaq@{9}d!^_{O>u$#4{j^#ptZ0Y(d#w0!{IVQw zU~Oal_5kN4?d!e2h8qWSS)CXc_3cdNIlaR@6SdzwJWnw42L4@&*W@6F`GVc9T?JRA zZa_SuAD`&<`;&tl!n5bAvk=~!K@N{~v4(Z-^|qbs1?(5ILHk75s|ardT;uvN>B7fV zSrvUcTq~H@J?G~y?kcy-Rady3p24r~X6iW}zhRYw#rULJgYwQZcyTKVFV{{!XFWc9 z1!iQ!nB&Wf`Z^4UpHB4*!{g@e7pH5j;^MGhm>cBq7(P3HIgUtfWcJChxVhnFVBlo_ z>;CM3pAF%z^Q<2aT&HT+OS(xguf;mtJ!2o=g$Q7~XCk{X`^AMuRt9&*hZULx93O_+ z_V?@!f*TOza_zH6SUZK=66Empe)f4GOsAc9;SPJ&k1s}(c0bq~ADn>c-pm}M-!I_t zDt3Ii-j|qG-pR*{n;#yggZ4ra`++tvLp5DF?VN(i&h5tnWB8VZOiGxJ3M&>u`G2UKi#1 z)y<>JJ5OI{oS%MZ5A1RFb=c1~n7lE@6^#$_G4aNS-ZmcpUJA3_a|qtsuYI=$zJna^ ze+YBs^)cZ^eVZJ<8|*Z+r!cK28WX zH_k8b?8b|mpC3p*`vM(~4?c&fv>;}`cs_`IzOfrzHq3O-6~!0h9J>M|!Pda6S!BXP zaWuz=T(i0lXB+Y(^S<)c_JF#9~` z*AJX$vabWU6(9TqbJH#p9-0wvzqqZ^I=*wT-yJYNy=$Dm-h}fc_BtVxa>9G%ot1cT z^Y@GKq}`66iO=4E`OI^EI%nhi%dB?j9=LB|#=URC^V1pUaqRg%pU1rvX3Pi1`Q;wZ z6SUVS|A1Q#^T3D36}2z9QTMU19=7|)82svPZn?t!IQIPpWf0y7xEnq;)=xi7ldWht z3CPgbVc!43xLOF&4G*IYdtH=EQg!#0cXs|{+?5fBwv!)~vB#s?23B{*|3jO&5p zb&n6%S>jLpjqTXm=NS`u)5HVS+-fH$;_ttLyS%lrXl}f6k8)sz_#57T3TDOm#`*b+ zt3k3NJHWqOZ~7gkMjPY&eh`<3+3hp)CKG0m=luGC(`EMcTzn4S6qqp`O?VvVx$(gD zyY~5R_D5wePH@`c#SPK&;*pQdearnZ4?nxY?DL#oKk&64R&?F-jme!&SdqUr>5Rwj zTlqEu*PY7II{*A=f{`V>07Qk{^U{5ME=_38z00R zc?b9K;nyv2bq2N8vDUfq$Vrb{-#7wy z%hd_ah#|)L{Tr5P?0LnLh~V_02~N(n#`*m|PEXtG{LGrOhbK7Q@Z#o|tE}9pb+f(r zpf^m;$e82H#$`NKL|EUR_lz4Lez@^KGilfJfp|Y{bb>PvFK&K*V83>|aV`qd3YdM@ z8oZ!kM&n*A2_m$-1w%HR_? z@OHBjoECQ*$MWOG7t7Cfc>KPO=JzBxL+2ak_eXdxlRa*#%zT6SWMPcM_oUkuiRZC1 z7bQ4{@#5ykgI^zNCCpKLcILea&T01U#x!CO2&o_*R?EK~TUT=hX|NfZc!)-fuc&P~QXV2hQcQf(810y4E z;NPxzB`z^xMc#HDu3EBpd@nxi2lu;Y{dB=7!oL55>k%mrBshf+nlSzL8Mmd{<2trO zwU#D0_u$3Nk8cLPR?Etd?fBpUm>~}t=a(xyF2i2Wsf;kbggNH9qVUk6TMgE2aR0$f zD>UI1wWrZHYIZ>ZxfkZ!6~_7VC|oCFueWbNczYgAaHc;N6CTb&*!{;AxWzENSH?Kp zUSW?T*bk0^`O9;DI%nc~OlyGE4z9|o1m{Y;xcTwG({3#0FzRDG<3ju}`HSa!Tj{bB z0XzXWVYLa5^AXqKDb{xVWqW$j8uV{#jq}HUxK7Y++IYTa2FzB^`SlI=fm_wc*#UP5 z=7n`8Jl|oqYS$y)C;SymoeeSZ#j2=%9Wwjre9z!lcXQ(bXV;H3d@?f7W#`!CbOPLi za21|3`}Ok!-`Z#QGgWZl888<;YaHjBCjD^vsTJW`c)#`w#^6_Xa~*Dbvey$o$0zOJ zYQAW!KR(6ftoC?!Ir6Os%<+xJ`SmUO>olGAIKGLS67Y;n<0>G0cfWWFvpo*ubpSWL zmf+m7#W+7dFiW=QM|^JWV=&*oZd}p)9FJAA8W_&^Q@18KKfhs|-)|v2dmWhHcbD^K zg41i8aeleN{g?KQvn{z_m~Y;SJwBW_wZ_k@kWppdPH>*yVVpl6Lb!Ac^(h=kQ^%s7Pu~iOMBO$(onf<$QXGOxp z*KgSk2hX41bu7W@cfz=$`j#8@9A@?dH+crXx|=D__?io=UF(HlZioA_RHAEIY zQD1}VG{cViotEg_S=Kneyx?(>*0d4d*@AIXxkTsQB;!&d;o)mh>~=gG;dM+-bZ)6= z9Dlm|&A|Cz{2tlffvb3CqVr`H8goNsk4pq>p8yW!agrF2<^cv zm>;UgIIPpy<*z#qV0ev0XA@rB5WG3Q=x*BKr*C?Oj++|~+}&+eH|IFs{}68bIVQZK zc%T?q9nx~RqcHcT#=7Y1f^LL+1tzbiafp`LFV0@t@wf-+*9qqHI>xbFM9P7kF6_^G z)=hMV;l-^ezEQWQI3M7%8(`YkGY-L<@Nl};UeB3_53Yv!y`gdZY4R6en`;f&`23eU z8YMc5ni}Vq7v!(KPRP=JQL{wnGQ7C?$A{CkR`NOX@xeftqiMz!)i>OLWMxPjgmGDV zqH{l9-2C*z<74f9x-C9i3-gQT{QYv7#tQF3xW8c9WW#ywfi2ewm7tFJn#`)zG zS5MkIeiAM(E73WaZJbqJqOQk$5c^HaNp#lW#m$cg?h3TWbt{n0n_;dlFs=@)n;*D8 z&+hlH#eR1*Pjqry#OxQ(<+LZF%#VIBBRuD)3(m9K=dn4j8}AwX>TaeSU_xm1`)v`x zQn;^L#_c!ix~h8-!fEFvI?M3l=EoPS8+Lo}F+O_=W_GI>hj`fYea2%c%xcg1@yI~G zZxw_#_~2QX6Rl&85081bih(;nKj-{JryXA0{P0k$?EZuOU{{#=7Z}ImaMJ~+Q|xx~ zIk+0_5}iF48pnEST=aU~SnTMrixQo)IvMAu3%+mLKL1e*f8WeA_|@Iq@NjpnJz-@% z?-t~6`-ko3!_~eRS$2QP>!9uka+nTU#l_(~ z^l`XXdzdhb$^j;3R)_gI!h0L$&Ym$2qfUDs^%LB^FjFs$ak#p~9*=Wfd5&lBtGl`B zg69a^2Y4wyc^2-BUM4)hyx?qwUG8hb)$oi7&C3t;=hpDWnT!ux1v%VhZMO&P+g}QD z`B7g_>^_I(C%ClB%<&bKD-5u#gl2zsnP;Mp4-0Ho`;v?guL^d!vOe;cc&0dh9UJ6u z7Tcaj(M<_*_Csc2IPbnQ$YtScJ*)zb&vq8@8d|}wHycXne|BU?{ z2VUR33+@Nc7M0V2sOt~tj>05d9#j5sovPhlH9`PYVA@<^oZr8pKeyM>mm|EbFhhGA zhi1;yb1XN--Ul=TW@8`YirUHisCgNm1KFW(qBH4A9gaK;!&z zEN*wU`}3(dp2>p}oxkzo=9fP{FVcO-{K!VdsdH7LbNOK7{COGHuk3jlubW#1Gh~Qy zeta?SvHOL8;ikh(8){rpz2uFlMLXvCmaRa>C{F-bb=XmlW~4|K`&^R`y)8+gqu-b@Z#pDbAHt0vz>9+Z<|{Z zo#$^guBg1=a$Bq4`U&wZGbIsg#>V;e2v1FkT9?8+bnNs*=lprbU4VVN>4&F0S>24Y z0Pp`WKhe2qfpJCU59cMV`5^Om2~68X#`*OP*VozYMhCceVJh8coS%NUO5aYuo3W!y zVBTF46CQd6dmP5=*ZMqQ4AYOB8xM3dRt4MZytKhSxFwc4phii@xmzmq=FDu~vS7CO?I-EAJ z%k#T%pTn$v$n4ioKhzF;+?0d^{~qSV!^ZjNU2yxLoi2+J-rz?PoqzD+W~EEi^)IvV zS?A>#PvXVRN|&hhI;P7(n64{~^V20i>b6SfT)3$)n>^>I3$9zYPrOXV2XDfh|CkBS zua~&&#=dTyO~WvlWuEiHi~gDhCk<{D%*U|~<-qRud41=8n1-w3_8YZc%<#IyO!1tx zU%ME%$hvX%*b+_pFZOmFF3FL!)X_5T*B)> zUkP#;KHJyfy^Q^S4tM_=vtK{oaG$l^?(+Jp?J&jG8RxfGxO&{aU!xmb2blZT8|Rl( zjGF9@knQ9LFvp)X&YySVx^;WKlh=XvehTgLGsgMt3%}0GTKIVc`yKskqLci*aYgMF zg0uP$-tU(N^V|!@`Q;w<(jIT{d~)d*vEKBOaen#Z_kmjt7UwgM!Q^j@ahR9c*FlYf z8{nC!e9OVQp4IRc;J|mmm3cKLJbrz*72oycNFH9%`yAs^AxP~+mC|z7|g7l#tp*Xx#bzDXOCaD;Qc=DCpy)48;9hKI1JeE zA8$Js2UH(s&>rJBZgj)LW$X4j$m4kbx(^ebsvjBW=Nnc9?DHuc>JNii>N!7MP+siu z^8;`jVS0TW6CSQ|v)iF75x`?GCH5M}cHP7m&kwWGr6MAD6sF7<#`))0QCjTzDz8@_ z2y=A5aaH~B@YrOlUpU(o*BAqMz zkmzLpWSl=P!R_K!G@J&A#~zr!4;kmzOI&_$*Iz!ub--b?&wm)#)Y`9oefG@=uf$(y zCr=tzG%mpn{ML?}Bb|%?jrQ+9GCaBpM%ZGxweKV6J5z%|`?nf!=eSgs6r zW$`3uYzgBSswr1^+`5&{7h%6=luUAZlrgSW#9=wdKEB3qD^E*uc9%8IFQ<6Cx844+ z9r~(Vk~1yAIKREZ<2&v9Ie9%?LSm9LAt~ngc)O65E)1`Ha+0$?#W;=^+<4?hJzmPW z90@zJLXz`Fs&Q9E9J))pLpp@_m)A*h?yhT`->#uGwWi6=Oq7@BVOlmY?#xJdxNOe8 zK5;gVFR@{gv$&CQe*R*a%O02P#^0aSILSGL7dOA3;p2F${5=i(tm!K_G+*)P_I?DqLhM6g~4_M2lIuLCpX0AF)vm4gX*KOry4nSmEKKV4Aj z?e>6av=(N+=Ww`@@Nfec|I%#t;rNch+*x44^ZRq0-?H03e$Q0N=Eg++)|6*lhisLD zeQ=Aii9}l0@Szm#ul~Dcs`+(zjq)WTVc9fXk5`a0{vhl0r2lWycWXTaFKEN zGn3AE9F#q7XF0tYro_d@`Qu&GH~V_2WBB_qFhe>U=jSiZ_t@7@mPB}SVdi%=&Ts!P z`m@hN@cGooVLt0=oL@h1`<8ut>2PZ#cJ!Z^RZ!q=zR^X{IA;LP3#ua9y5xCy~o z$>;otjH=WZW`uG6^}E@)KnHP*Y)A3SBcqd?Mc2iIhjEx)4vxUR5A*7n7?+)C7eD7q zq{~T|PsbX^pKdwD?Kt+h^F_ED$0a$L6Js2neq~?i#_{QHm|r~S=PyPj_Ilk>6p+7Q z4o@-RaVYHWHw!m*q~kx{#?O8__+S9c>>0-S<$#Yzw+i4o z{QZ+K{b$C6hp&sVs=2$qaRW@X+l}+<5xyqaj&CbO@F|#IXB+32`yAZhV~r<&#eVbd zNOBs?i8(%eYm42UCL$i)VEW%>oZn7nT}Xszt_sw2Yt1*Z9Y6P`bA%8q)x zfU^#6AxxWv#`*mWW;6DUC#?~|tuQ6;GtO^^P)_ah8VNX{o-l(RFs>4g*OV(P-&+|x z4f{Rs!6aw%Qsau^5%qO#&IIiDAWZ*4f1Do>*j4va#FS$ zS2N;pIhWlbeT4V>zJYe_P2-BnJsz)O9p5`}qhRv48Rz#OxSY#APqG>AL72X88HdC0 zjxR4N-&W%NNia3vHqLK1FyFG{n~4k^3UmKEG2!7fyM11W>&nl=jN5KpQF+D}wpsJC zN8pyiwAv9D9=@R+A9~vy{Cg$L!8nHp(OVtTBphGqok`A=T_!xgoZ@L2_I$q?+(MWw z?;7WqgN)p$?-^)={ieT{;0{ly+1j7Jzh!VLJp zIQ*H{9^h+{t$6V7uk{RmbvL(M;XH{Q52nk+K!@uSt?=sLz)S2&a_WB+6AwHW){aMK zgmw=y|c(=o~{M3Z!mn)2i?DYuFBl>tIDm>gxXU_vVAb?SD&wg&g z^XqQ`ZlsF*A^yDtuToza6M5T97fh%l@8H}eD(q!&soxmO^P{fA@WpP&N8fpFF30;9 z!95%s9v*XSmzT>>u~)+sKV6eYK4^2lTy=^D{ zZ3c7FbACC<;TKRx6uyfY;U)fsd^>5v^W%Yj(5^^-<4?Ya`R4DK{o;F)>~ggfuIxWa z&MLgPA$U_>uo_{XXZjcQ?J1ZIB{=dh&(Cnn6|PgY=iQvIb}O0ed|%2qzhA}IyV%zY zu)I_)o$NHhi<`e+%zEtW%sU|=a$%;PW}H7hKtFA-+va1y{3lFC72}#BO!xS(-efOG zl*f*aR)sk`X1}=W(_S~L2X_WcdNt$xc%WF>rm*sRF%xj)Q@LsvfjJjXE02#j>reu!UZ^ek?FuQV%^UD=4 zBeU9}s{9}?*{RyXI39;vp0n`aRV&}7Tag~;>H-O zoK{0d&4XLh+JxtibMRbKdp=khA>^NLj2E1De0WT%HUDLQ*)_=FZa;fG#Oufg!hP7r zgz48K)Hb`n`~~jpw#iP}cE&M$Hy(JLk-Z+l^ncYeQOAeXaeLj7@%SLf;b{+cJKhHF z#~_!3)B72bJ>c3Gq+gTv$gBU z5I?+pLxUQ52Wy@9^+b@v_{E-g^LWneWcC^PYcITfyZr6Ohc)4jde*O(C)2-+aQN=lf95s1#UvH!;BvvdfR>Y_ing)oy{>?@xY2_ zMB&;4{MrTPV64McU-rD`DP&Yqmt<#4Hxr)U@AI~u%%bqF#jh#dlbxIJ;^xO z+rGfO<~hIqMqjq+KF4)C%*LKE@xZ!NdWO3T_s1L@-#0L$E;Ft?-Zk|D->++>a|`U~ z7nmkj80VKitY+K&^n3XG)-XxEjq}@a+^u2PbFLpYgPG$wKOR^GvDdHe#0QIDYW6kZ z`3{d$u# zXScgI;_oLFqTR)dn;#E6_1td%RwBH!A4WU0+&K1kZo0tP7l!kD((hQ2jC&l7^XEqx zmDuOOzC{E}uS|A+Tw@%oL?oT<^H!JO{dd+SJJr@3=a(zY0_^p*>PXn;FqdsG&L79( zYIM83AB^x8!2IDkKR+|Z;g~UzKX;E0&yTQ6R&&(fFOMfXRsM_#kGFwa2Ur%a zqi3SR!{e6h>ks}$#$S3e+3D^url|9Hx%qzQXAW zD`D8brBzFD9>j|qlF3WwsKFmLk#=-7(d7hDc(wUhi_vZf7EoPvhN`Q;Dm{PsNbBDmo& z&ona5j|aLByI|dlefsouZm)zT?+F^oWp%`Ry;0%dk*HWScmDQeZeGs03$cPCKt5SA9cnmx02GcIvIKTbF*?4=Mbr<@X zhhRpwG%gL{yZMIi^}w(G#_RCfwn}k^wKc99J~8==2gq6lp(@^=dVw*KKQ;~zaOBM9RAE}PjNcg+HVzn zumEOtR}-EeU)=X(k4vt{-+vEtMK|M$;(>0}Y7clGaU{$G-D4dtgR;u=0l4)ri+UL6 zw;LJg->mv^H}<;?rdLnn{CbXbvCHY{2yZOR&6gVIw;L$+cKY#9ABFkCbNDl_ykMS; z-y_=?{PI1_<-JUJMGozsmCkkW!62BKm&L>b*NxcgT<-JMVG6D=j^)vmzo^sG4%geW zdZ#$8`xxh^GatX3896$vF~IeNS=iS&KfXEmx)ZBB{|&bZ=7oO7`SlIwQ|$Q%+qIPb z7$4xp&EGG--o;9o%_ty)U}_C9t_rLh51h5P(`6I(n=&-T*>#O^emTXoC&S9$4*2_u z!!RDgiyQvTOBakItntAzygwMG#I?p1l>-zQ>-cuT)r9#u&f$U|t3AlTj>->Dan2iI z!t>WR@}ln#T?RK7rpYMd{C<$jbyhhziv7-mxoxy@em&y%+2FIt#`|Vpg}Li`4#RuYsvE&N#muWaD~ys~qsU>x*H&_ng09oENg! zBl5dp9yLD2>Hek(?_C_PDW`ZIk2P=~i3}L}b&9j+JLCN4VBqnmc6j};-%k#tIJw^& z=jSiZH`?ojmEc-?2EV$SyI)+dXLrDt;*(x*t3B(NQ>-W2?Hc=wS7DCCIXnQ+N*9j9 ziXTjIhU3M}Pd|LGv^|ec!ej*FL`M;8wy^{w2oYK25v4jDc$fv*FhmhwG*6a&S6!^a;%V zW5%6{<8{jczb?kgH(uZV^zjrY{SV_J^{v_UR}UOJ5P#%tjNb^)MBZzil+-%NjTYVY zg2UlC;{se7R&DL^5Zj&caJP7tf7d#x_2x8OuV-JUN_RWVycic7kMVFzJcD1|EhxTB zucSXs+IbB74NjLzg5&X36)6izDLBUWU%@dRwf_pwH-^_naO_ux2Dmgd&-lpS*w0)CchIvO@3Nf6 z#+TuZJsE#|X_%G* zn_9yrcfIO^80W?p>yB1;P z-OTZ2Vc|RSj>+G{aDyH8oS3`f6;%FM-+uKB9XAsmu46R+b${~sj>C;A_W#4r ziTt@6ULN|l$Q$^V;gu?0!MPbPZl^lFrugji62`a?Kiu$eTY^15Vmp)z*WRz|?^3v(o{fZ;hGk`YU4T=JD^9E6%*Klw+w0az-QvdMOqY$Gq2p%SNi6$h zng8=A>(N%YJ)S*PJIU(}z6=O2ww`mpCk4myQu6fpbcqd*uAJaFUaKfLW?_Ng*j|kk z9P80y!SVQZ39dcd(Ex|>OZ5GDa0O>naE9T>rtZMczkCHj_pBZ!8L?COK?2T+*WWLGj7I?`ZyIg~v(FEv;)CWey%Ws7ISvhK z?|FQ0c?Q3_TTne`eS1f6%-;_L$K&}-aNO^Af@6PnL~yKcM+L`p{!eghU&r=0^p=vHqSZIF{#Df@=*oMsN)8Nx^Zx^^M>-Pf1FOPro#*?%LPgG=QrQ*VVIZ zhgqJ}@E8{RIvM8M$e8e^a9t1I7h_+4KsPSH#pWB&2i_dxg6ap$)g6LkeD4i#X;|gA z?|0_<>)JSn_-5erpf#T4IBW~tZqG*AgV=bmetaGmUVMMfa=Kq|4Db5@mxlZE?DYd4 z-yyiaJ$tI-<9+r*%bW$RPA5S6m7q~0$dtS z58CH@7~kG-*LwC;@n!mr4Gu5rdPjzLBiw8uyahqw;re3xIt7Ne7;aTac&uMf1%`*y zt5!NQyl3Iw2nmnp$oa6G=Af@63C1jqaxDmbx69t$8yz2aE!+w z!Lc5V6dc2wAUL)!(*(!-ohLZf5F?ZN3)!pkY+ksvts3zY@OdRa$sY}axG z$NgR)IM%oBf@A*n7aY@hnBd&?2*I&mxLI)A@9lzPf4NX}YXryq*eW>I%MS#{a&S;^ zOus(`$8;%HHM~5typ$K+S)!{iIQ9$Kg5&v__JZR$ae&~s-|Ga&@z6BEv7F8p9Lvi> z!LhzA7aZHGwSr^*J|#GozgGpvcH=$4F`d5@9OL_o;Fx}YiSG2X!pl9|@hXC2eXA)r zmV<_Z<9@RR$MW1#aO?*=3y$k0R|$^gWs=~y-&ulVJz6R_rr!#|v7D|K9Lv>a!LeMu zBRH0*PX)*Q9ugeu(Q&~sypm^!muIG5g5X%LstS(z+fZ;kzE+~UNN}tlJp{-7_7xoS zcZlGaAL9ha^t(-P-0uRxF&>YIZjI=k6CCq*v*0*>`ABdaZ~P>>6QV0oExg>bpGg!P z+l`unV}4``j_J}ublnBVaz8|HY@bI9j_VOO36AZ?G{JFw?JmKw+&?Th_6r*X$K!im zaO|hI2#)Fej^G%N4+O^&`nBM=-(!MfeE$_3+o98|hu078x2oVco~$Lh`hsJAG!Y!* zn=LrD&#eTKr$NYFiaBN?m5FFdn=LN^( zdrNT4-`#>^yY`jfxZeYUW54x_;COt03y%9eqeghWq^l@6?ze{Em~Tx)S0Fg{tL+8H z{a!9O#$&MHSgvjm9LF!y1;=)BiQpLC6M|#TZWbKl`+?w?&ie(&{T>w@^P}`R;pLC% zTtRR=zB+vy6J*r|8c+IIG$! z7f%f@2kehZ3y$q>vf$XBRu&w?t1US8s|^Lma-S(Uwg;^Q$8_#0IQFYo36A~waKSOW zNrL0?O%oi~z3&wq^KG5rSTA1^9Lv=X!Li-=Sa8hWgMwpt#{|c6P`YM#{h+HPIOcCX z!7&~=f@3*oBRJNNj)LQUdkBu@Wq{y#ox()HalZ=$$M&F5a4e^f36A;pl;9ZN7QwOH z?-CsQx32`p@^V~oj7OK95eI+=~D-H{e<@to*xK49=?eOx)<4Y18`-SR)W4bgD z9K*{N9LrTJ!7(0P1;>7-ui#h?MhcF{H(78j_j5$IL~u;!#|6iF^sL}`UC`TtV?4eV z-LHaUemHf)%PGrqvfy}pRRqWV))yShLB8Oae(eRva@t>T-0uj%u^dbi9QQj@aNO?# z!EwJ23y$Hf6&#Omqu^NI-Vz-5`-$M#FB}jY+p8mjV>|w*;24h*b;HX&<559yEYCFs z$8^pV9K&lRIF^HMf@6I93XaD&LU8N{ZxkHkF-LF=??J&a$JPms?bU07<9^=~9Mk19 z!EycId%>}s{vJo~xl zg>bjQ)xN}7&JTm`7vlX}{XK(U-7V;T7nZ+4g5x-6xZqenZVhm}PcAphJq-6pA%5Nl zSG$La2lG299!!@9JcD1|jq$*9HPUlp!YhPp-Shv4$9TNp885iN`>42nx28wnF?n2(EZ96XvPzFJpU9$ur)cy6M8_h}ieP zF}xaZuXvXE9h7f%@&18;@M7=F;(WU7W%2PvJ<71}FH4834cEi7k^SO+)2J_Q=6z?A zgTjNezn78jrT`avd`#z?1;_N8F1QA8cM7gH+%tk>yZf==*iP;j-66rTzMc>q<5A-B z`23Ac=SFb#1lI(vo8W4}-6S}+_sayw@4r|tIF|dJf@8b(o8Z{KpAa19NB;=Ut>;&S z=f`yjuZG|lkGTO3?R}nI-wNRtz-9F|`)0or)NU}ocXV|}aMH@v(w zhPy~`HQ~kzj_u?k!SVQB799JT9|XtpTY* zIF^^rf@8bUQ*cbbzJg;s28!+m!EszSLvT!&`vun!Ze@VO^I7d?&B=#*5AL*nrpz!s z&2vfc*sWar$J++r-!3rgJjed?RP%s({lm*2$3Kk)$95x4aLnHv!7=?>3Xba$odn18 zLVX0sbR8o&9^XX4G5ux=j{Vdff@67JAUKYP9u*wNC2t9i&msL(aJ-J<55cj2OB@hh z{#ahJMb|=bJYRN!;JDxZf@6C+RB)^x*9(s0h>3z@d6_IY_D9nN$8!3h;COt6f@8WY z7aZq_>jakrw?S|n;JyH+`PohJ z{<(v~_sjZrjp$|xj^n1s1a~dm`-1Dncw7}859Zq(!Lhz=799J_w*<#7@mIkyy!uyb z@#rSF1_*D4;8_0F3Xb*dNx^aa_l)2;etBJR%(ssP$8uh7aCrK$pFT@)Y@Ztmj#aOn z;8?CE1UNkREz5p>81wB`xRst|x(Cf0Ie&X2AiUUhhRfmh1vspm<=79R;`}IYNCjso zUfftNxL>&3On&HX1Mu(NFh6^a?Q78S@j04T4h_!_wri6F$8q*l!Es$+rr^53JtVkP zxWj^Dc`koVczoFp))XAeL4n{{P6rB(^Yfbo$9{08=x!Gr%f}s}TO_)|0GF1LmxW#V z8~ef4aJ7e-JULZA$a1ybGm$@b*IzQT)9vqTZ$s z9Q%2th4|zZxPHU`e|S8;EuL`$!;i@E+26xfi1)X_4IN>^JJq^3k8iSP@TxXCaN#5#OyWO^1p^tO5U z_eGeCMw$JxKXK=m_#WdtYn)Sv_xHivI@&nazf;XGJ6vZBh`TYqvF#-D^J2j)v~$Ni2F9OE%Ya13v<;8<^_2#(>+6&%xLf#4Y4GQlyv%LT`DUMo26_i4d# z9PxtS7~WfgV|Y77_l4lt4;~gA>rLq~;q`<0c9!Vs3a$>qOBWpHmpui?_U=l-aUHY2 z;5fb-AvosmOu_Md${fM5JU<@ba9%v!{$8>Ha8JWkxZdO)^T!>p;cM9J?*-+$%2dzb zS9de*X?D83utzsPz{R$cjPLR|hx5}pnf7B>okF-(a2MWSj*s;(sK4Yqbh>BotGflY z&l&jSNx^X*^|j#A;L45-FZcD}nhTEo-T=XITz!?`vfzdaj^`Ja2#(*oxlwQ|2PXu_ zlsj!)c>1v(oh>-7*X0PV5!}Usvwk!b z9P3AK!LeN3CODSU6@qIF_p#tO-!DEPJicr<@lo9Q&Ea1;=&t=LE-b z*js|*em@c%+wpG%$82krbeYs9>9FI>E9NUe@0$f@i zuES$z;BAHYcQst68%-UKj89|7lN=Ym=o#-%F;3+5j(NDyE%FY|_2Ac6;rdUC4iDdR zk)30mcjouh?DS0JuTQluP;RmbtH@!$7{=P)(^`lRli{B9EaxLZ<5`n3E#m4tc zh9|hXaPi54u5WY@ z9M`$76C96hs^HkJEfid5xU~U}-)nB4k9UgUImdCX8^@;wd2Cc78{HkT>DMjp{1)5i zzvjfc`14>KpO&~Y-0?cbDuQFVY9_dmaJ>b`@y0g6@x1uAg5!AdKfy6Y&b})=T{!-0 zCODSou7YFw-6A-y|2-i%&KviN?x^4x-?DSV(}hFOCW2#l0|m!&FimhQ2M-CZ0PZEh zalc0e$Nn-YYov`zHj)_@>SePnT4<4ua!6V5s1@-+KgC8}0?cah$zZaM^I>7lg-`OK9f{ zj_v6L(ajee(`BvT^5OOfj^pfd3$^$b2(CQB8!b4Fn{E;u=L`1;j{V>&!LdJoTX1au z_6v^rds1*r;Yy3b)0yMMhJs_dv=SWG1$qgN^=O>n7=y)vW52LkaE$NUf@Ax$a#uc9k+UwFEtBE0H?V|i&QIF8!~2#({S zy9LK_*eb!XUwuw+Y==G<9LFWU3Xb#hQj5dWne9+T!7;ohg3E$CS8%CtqXfrvnJYN9 zL(2un@Lm!e>-oEaV+tP?9NUA^_lM^P+k;%e)q=Z5aGW3AAvmVr>w-HE?lZx$9#vVQ z#WzE691mS3IQEzK36ACdNx^X(`?lcN|9&Sp?$>!BJYDFj2#)ETE;z>HBEd2J1`Ceu z!L5Shdfi;Xv7dQJa7l1$1jqJ%li+wB?I*!;9qzc`7?1x1$Mx)T4~CZmhF3{&Jigk3 zWBxV~TvNFAg5!Mp2Enm?nISml?}LJ4Jk|(~<^D~eBH1r6>>_ z)8%5pF`fGgj{V>bf@A*PE;z#qI*DaOy{RWw?lADzXO6}PW&r4maF8#@O)!AZ6-J#-vxqWd(~HPY)?lC zj^pfG1jq7RC^(jbX9dS}*&#T__iMp%9QM25SguMv9G-6!=LnAR$P^sg-3tZBdU>_r zn9jEfj^*lJ!EwLq1jlm!w%~Yt2L#9b_(yO&zRHh;=NpeNQ*>Pg$M$c8;8>652#)n= zt>9RHw+N2uw_9*rw>=~{hF5-hcsesb>I;tHwGkZCrLW+)-Z@5ate1BSj`i|U!7;qo zME9}i4hxRuxx|X_{9rqoDmbQdrr;P}2f?wPUm>^`;jR-L+wq2vhR3%YT=M{zmRXR^ zwUo%l>onWPxG4e8o#8yRON?``v&>4*v!8#;@cP8KpzyeUa8-;m*KOiL%RGGOZ4B@F z7#9>C=f9I;9K(yfE|UAbO>iaP<_nJP&?3Q=fqOK-rDbH~WaZ#PZ!5&VYv3+^%;YhT zBj`F+UPpVaXYi}Lne@xd&o79)W3Im+4VSpmgvWFW3a=sFALg0JUk9Zh-F(4yhubK) zc5vlZg_q|{xbA}Edd_WvU%|0|yG?Km zZ-wC4?rs+x+l_;wJ0>{R-{Mcirwg95ouAG^;%!xM!&)+2!!^dTpLOq_#`C>1tOl?U z?>Ajr!P$uyH@2IsA9$X0W@fJYmiwa+KijRV;CzP{w@5wWb$!_}uGRVq&OW@j6@{0T zZMTz!`0TO`6`T`zaf^f(+g`E$cYo3t7ve`yy<~sXQ*cNYXNcf<+}8+>*O`wM9LI^1 z1jpmMUvv+MZfStSeed?;o17-au>Kt5rX+QXd;S{B-}a}%^Mn1?X8{iPb!6D(uN&Og zF^>Di^P93V(($3U(Pcgzz2AtlJ9N5fr*Qdfe7ucrcc9D8v!A2>30$pbDmZ`P#jPY> zs2@DO%si{yGrU^Q1{_~@Zg#fSza=4quZNrVys;b~x%Dz5Hzzj>|M9jB`1hI@;=_xr zA57;eFGjnd`oZ<~RKal^+emP3zbrV`%eI1R4RG(Zw1G7 zy%U1tkRs`&_;gOo&M(Nb+S7Eni{NhbtXE#*;=y^v!vW#N#+S$Uvfwyw|448=AODl! zIFCx+7$4u*n%8*U%ggv93rn09Mf-~=>8BK%R%y{@N^jr*HLhc$9loB zYd;{kHgHv54nIDY%ie;!0Ir|l*bY4+IL7x0!Lj`97hD?Le}ZE_-Rza{bfL=@9Ooa+ z1;;L@mEf}At`i)~!E(WIzaI*Y;gxB4zHFTt_C-4Ng~e$Kb=+h#qQ5aXrMX|IK+a|5{Qf@6NP6CBImAi>p!yG?MMH$Emfrt?n0vA_IPaBQ!N zZ3$05j;G29j`P(7!7;qE1;_DUEx|Dc*@9#Gbr2lqZ^H%0ay3D4Y!4n1-B!V|UHd_B z9IsV)Jv@IIj{?E9gc~S0j!%~fj{VF_g5&(-C&6)ie@t*}C;ts_Sl`XJC$^j6N^h;; zyondLig>x}8<_ONl9_@WVU|~ z$GD*Ond6+zf@8XTDLA%&-wTfUQS#0Ba+Q{mo1bsZXV?xUz}4`qNf*q|v$F6&Reb1e zoAGZ0n1h}>)p`#5!8Y3h_KSSW&+-DpKNIn45BG{^+23*A9XtPEJUYG=5MD-sm1`!v zo^U%nd#do5Zitgm@wJ7!S#Y)BHVckR9bXHM z=l!Z|*N!hsaQO&tyx`amt`preqI*ej>}NI$j^%BK=spviyRIxa){kSN`%iF;$LTx5 z^Oxr#DvPd`;27Vgg5!Rh3y$OBc7o$L=R(1;UF#}1hSx)IY(IMoj`6)pbfZLfqu>~i z>4IZC<_M1Yu~2mP39dK7TOv5-+wX$o{PGXMu|H4V8D2lwPNoTt?OI2{G5xv;t`%Gl z!LePNFF3CMEfXBqx!)EX)A=jGao+f+;8;!*cE#rhpZjJ%e~sgfGvV&??5V~FP2sA( z8y{Zm_<-vw?FGki=S0DAy=jWz7~dI!s||Oj;F!PbMfaKDSl>#$7oL8M@9BbL`f(EUfr)Jf9Wk;^#ALhq7Z_(0qpV zvbo?mzw9bFwrj%$$9e52!Li)0797j{F2QBN{VBLQa7}hc=SNWbasJUwa7>rcf@3+j zUT{_5CJB!H)_l>e6&%aKTY_V{d@DG{qr?Z{>CEdP&K4ZgFGp}ZzLtXH@%0rP*PF%) zj{VgAg5&skrQkTmJ=0Isp%IREV-xKy}tqFW?5 zo@aknaE$48!7-h`6dcpCE-X0>N<|xWC}IJ~u{i9B0oE9Lw`^!LciT zT5vVtz7-tD&!s*JPe1mn$%11@l?BJ8yGDXz``1r!%(sbxV>@|=;8{piwj^*!l!Eq?PPjGCnDt;QCF5GXX;8^~;2#)3I8o_bA zdxPMZZ_5P7_F#wLSWfo{j`@37a15{1XW{A0@puivHGyj*xJGcJ1jqhkvEbPMz9_g< zxQ_(K{T>$_)1~s>@bqIlbgtl7u6hfO?c@x>v3{%;Tq@i)!SQ;j?*+$l(D3u{bZG^5 zso>ZSEfgHnOBRJN}#e!q{ zZ4ul6xE}?_a@z6B@N`av8zMNCmzjdgf?F*(_FG>Hj^(AozVLXk-DoB_u7_PBIOgvo zg5x;*ZNYIK@S)&1-uO;%rQrS+U9qpi(~tA`(t=|>swg;)+j9lSe&#~KFuwSp=e2JNj`Qvl zg5&X({W?7TI6kN@xJOd@CFO6Iov$KvHyKXaIEKF3XbLUFVX!cIG%4T`9pa6vEMHvIIa)X z6CCe1Z6-LDzm|gIc(Q9)4Kbg3&+`89iXXWA!VEo71 z==#9S@tg?{_o*YioPvnLvq16d(=gw}hnJDh550}Qo_VN((+)3gR(P5A_ngs&F*@W6?e-IM(xKN5b=s` z0w$WbF`Y~P7F*xqpNGP7Up3CfKlhFO^f`iKf7C#5Oy{P8WBTO?j{RyY!7;p!f@A*n z6kHPAK*4bwJ4SHKkFkPdd?yKx{niY@F}&G=W4bI99LvGOf@6L>CODRt4T58QUl1J2 z^CrP@zi$YR``szJ_X8Z}zZv#(8+ilqhj1SrHFcQf%sl5QJ2Tyyug=5!<9@H;lsaY{ z;}!JWBhEwndj`L{ThRQHO~~DXONHAkIF^I21jlymJHc@sA!-j1=r}0@bbcT_hP~EdbnPK<9uec z;J6;UP;i|0EEiloxUB&$Ei1hsGany%8-M)~uGXI>Z8)xNos=H;Ts0owI?s528n_O} z^m|!w>@T+oj{WZ*!EwL)1jqgUAUKA1Ty)M~;pK|`)ER=~JoGHVFy+t|-ci*xbmLU(_hi%%Ec53xaToL_z`IJVEl{ti!Pu7}kY z9M8|3CpgCUa>23P7#-k{&Ni~!6Y31AN0vv}Ohb!$qu?)|A$Nx{&KA+_o5O)h&7ho4#LvZXOdI*l~ z#%-dTBe+HgZ-L<0BfKm)=Er-2<2>a@!Etej2GQ)0S?d8&$HLjSq|m}xY+BjxX!giaBL@^799JT1A^mx z`cJ`eUAb1t@bbrgtGnP>--Zj0@trF;u0OvfIQDOc1jl-GQgG~#s+9^)7oJzEEjaGC zq2N;CItq^M__cy-3wOKVSWdSKj^*H6!DYk!D>$ZeX6f*B<~XxJa2y|;E4m(WE`B{H z1>p^kb4hrfR(`JiJu7SvZVqspWTs zj>p$YaI7EK2#(ir&lVi_yGn3Omp25*eEUIgTz4#UT6p@gTvZbsYqbYcFc36A}Fw&1wm&Vu84gOP$`zTGZ3o?m@ja2)@=D>&xcUxMR0QewIAbY{QM zN^tIdpMqmOxJ>lcM%-N_g4yz`FoY%IBuFMI9`Wxm*Cj1ZWLT|xNii<{-}CFc>eM{Nw(lPF3uMm z!)qfrwrlML$8yzQa3$b|2#)(5CODSUX`-7WIL-qW3XbRFpA#JO<2Au?p0{0a>{q`N z9QRu;F}z$gg{veuu5+~&9Ls$t!STpu2rd=we!;Qbcu{a{CtnpD+vmN4V}2YLUG=2! z{9r$Gf#BEGF->m>>TNj^(sua(KG1|40xV=Xuoy$MJod;J6Ob zMReT+$9DG;(e)Bs4}{lSa2(gI6&%OUp9qfa?TAA)1Q->5=({_^-T1jq9R1%l(a zseOP;%PUCF;zgp~HUR%#3HP#R*>Cf{^4N7kwnL38hR1{B&K$w9-1iV%Be*LB$M*R) z!Lj_U5*+6}PYRCh#%{r}-S|gvY&Xt2Gd!J{g)Icf^@y>8WBq+Xa2yZ4EjaeS#|6jp zoHZ(i$Cs|7;8+gE3y%Ht1A=4udrolY!+j+<){mN%!{f_wSS!J?{PhtW^KGW!SpJ?C z9M@w%6ddRK2L;FS_mAM1e$}dkryu*v=7M8?d9mQwF7_5&J-ESw<9Kb3;Mndi5ghBs z3c=NZdrxq@ZvA(`u^lf}H9SAK&Q(@$te5ACu9x6=WMc%!@z4yxF}|w=$MMTL!7;q2 z1jqUQ3xeZ1&HI95`|_XQxZktS3eR8Gw`{?2zwHIb_F$0Ucw|!r$9lO)aBS~43Xc8x zcY@BsXkRRza#njyF@a6JXb{^JqBaU8KzaJ-J9M78kvGJkUg*8=WR!LeVs zM{sOk){E{P!Lfh)PH;@;zXZqgR&}d~ryt|nQ*f+r*9(rvH&<}1M=uJF``srvj@M2K zj^!`4MtHigpXnvIN^mm;$8q+9g5&z+9>FnPjtGwZ`5EVE@y!(+`-LHbV>`4^aOL3E z2#)#jg5X%54+@U`QR&q1bm8%xBRI~x8w-y8d6wX~evl_Pmiy*{<2PIx>x{+lN_=G#iaaeVcm;CjQIRyX|khQJLH9P9a8f@=f!z2I8IHLMqY zd`!P#g5x-Bir~0zu}E-ipH~Tv{n1Xrv0peKxIDNY1jq86T0cDfIBseyIL7xz!EyYz zOmJ)`w+fE!&}V|<`06LYvEMJ%AUs{T{*o*>=3A=ZIF6_-xKeP91y>p_U2rAgaz)o% za6Dgep5VA1)=qHDk8XlXh3hN0CU7?ij`ebt;5fc|O>nK?eh?hTu?-rAmp``m?FGmF zZLHwfPA(H1`}1c7mjm~y;8;Hr8imJ~Y{4-7Cqu^5Ez7ibw z>of^Z7mmkk36A5EO9aPua;V@~UTzQ^_j{w@xZk;gWBFSmxHI6E36AApmFPAIj`PMB z1jqB|p9+ra*#`v2b+bPN$Mep$n}(Mwrb`pSu^eOzj^Q;I9LFVX1UCS#1Kdi_^6!G~ zw=a(OKNZ5`czmzmSgwu;j^md<1jlm!pWry|EZZzR-#Ff_E4p(9$MV-*aO_vF5**X- zR>83z%@!QPdqQx`k7oj0T4r{7IwvRI)*AnAggfb3Q?BB#L*clyXne-j+%c_q`s^DPzbOu;do za|FlpbZrHf4L3k=sc;Jg$NYUpa2!8x5**w6S4H=R;8-uW3y$&FEjWhvncx`Se!;Q+ z{~$Q_=SKv`@JI<$OTqnV?9E=eh%kxyhaU3>NaIBZN z3y$l+^90BF!g|4RzfTK}@!cpm?sv1`xZkaUW4pFPa6G;b1jq0`5ghBsz5s{kXXoT_ z@)_BRInFO}F8;XzJicGD!pk$=u>hBrotss_MImqFxa2Rmlx!0w%URGofca6+Gv1%V z#XoTbdDdeMIb$8mO}obYnR_0yh$h7xE}%>?%T=B$7hjk z9)3B!prUg>UfdY3pnj13$Mc?{;}+EaHpKg{3Xbj2LBVCim1=H|4Zpfu(0=>jlLEmt zfV)p{TpxN>a18Gq!Lc0tCODpVNjNt=zD&QCf@3}EEjYIK69va|aEsvBug(-4+p7(N zYXY}Ta2#(O4RBZ|%*eCGf1DqswunvV_;o_g2h-zRe80tznhTCyY!|_?{LK;5cu5LU3GXeLKLVW#(pC%f$}c!rgFZ zoM+<9c~wyR$M?H=2EV#nP&>r>ahc#)uKEj(@fapJ9^dtXV|X_Tj^RxUaB10@_@roS zfevGKoa=_~3C7n9SoMul%{R`EEm!g5M2?$|#W_5eE-yVjFRy67t?}y_Z7Mn)@#4n$ zSJ3sWeE%lT&~XdOw>o%#s^A#jqk?05`h?(k^cw`n_F${vc%JE9!7-hG5FF$Cui!Yo zFVQwOf8*N?x-x=ee9H=s>0C*0j7K%m)f61#QBQE(ZzIvA36A^C7997RFS?eZYZKt` zJr@Nz)_^h<>qs5ohF)OG0?+FNwWrLtv)hH27p`B`6dcFxnSy%+Zh+v}$`x-Petc|C zvjxYHS_+Q+YIni0eI6h9Y1?GYTu#mN_i zmjlk<&K4Z^+gNZMH(et*uD4GU9LvF6!7=?72#)3XCBbq2yG3wp4}KOL%T?Kq;rYRS zx~kw(;Tnmqqu>~iYXw&eZl>TEk5z)>dgqIRV|)L;;M&1`8Q{`#vNH3nDHrEawL4XG zdf>&4<3Y}QFyG3xm_s)iW_65{ zf#A5laYS%TuO^+t z9NV>dg5&is&kK(A_Y=W!zkda|w4ChRyli~vZ3FOc&8`)lsd#bYd^2eMfbIRyo}uFw zR6kgrPYRChc!O@?`B4TgU2xoQp5R#SuNEBpt!o6w`Y}>)jK>XvV~R`?-CV)3ygVW} z&bPLT?gPQ`I<2n-$8xW;gQ36A6Ty4}Oe70YvT!7+c^3y%A}IKZW4X6EIy(et*} z_;(=O!=7dQgX$Z@`ye2^*nW%k=%C=(AN?XY&MT^15}tk>k7o#u>DOFv97nVk9NWpu z1;=!`QE-g!RKc-4FA*HaiE9PN@%=`@v3$HCIL7xK!7;qug5$j6W6^ytIFA2L2#)(L z*(1FC@w{I}!7;uWg5!R31027<)*g3W1J@pIoo5-ZpmjaAFX=tQB;W4a4c6_1lI%Zh~T(BbpB=G>Bn+#i{RLwFA`i1+*-jg zzF!ND=j{_N503}ijf(_V0C&CM7~X2p?GYTy!9Rjag{yW&czn4I(n4??XO9rweS+h> zY>VJH@BUeEEC*-y4v#O_bIunW%ky=DV}CSDa4gS{2#)9JJ`Ql0FXUuf^MyKarTWCi zH~xBox^NBST>N=wma8s;WBnZ|IHt=C!Lh$A6daH5Il(dgJ``MWxDtJ1(=R?<*glsM z9Ou)u1;=vVPH-&u*9(sIa_2#)Iv9R{G#Uzh4QC_4h}?F}#z4V>vA~D7?II9sO*aeqRJ+Y2ZtXYj1BO9P&`Tf)WUVvPghLP!do{xM&8FFsr*-FE) zYm;ZryywihJm;L}Jm<`;0>}71QsCGwKT+VA-!Bz7jx&c8IF9Fs6*%VC^TY1@7nXBx z1&(&-UD!~gvEThff#ZBXuE6=h^}4Nl{bPPdD{%DdO;zCNN1CU=aUaDh z1#T?3*A+PWcMm9VoM)%q-hH`@0e6l9N7uv^3fypT4=HeB9Y=v_-{T4#$4jlE`|_iG zkfXq{{~M{maUO7<0>|`~DRMIuIQI8*6*%7aUImW!UsQpkJ-$Yf`>6s)zre2*x%CPh z`?bvq9NR~|0>}7vC~&mHniM!OUMg@Lw^|gqi@=?}sC&I8|M}66^z_DF6D{!s#D-NZ~T`6cLBKc#ogzZ z{cf28$96eOf%Ai_R^aG2dscy?f1_4`V?OE?IJV!n6*&4|{-(guAMud_M}7WSk^4fC zODJ-O6uH9+oFDo4UV&r(clwg<^^f+@*$N!{`$-BM?>kk2V||_{tH7~8{jCDW z`@XEevHa>4IF4^`DR7*B>{H;*0@v%_?%O4a^Axxd-~tL9+uI!q9PPiw3LNdfA1QF` zx}Hn%fpV?IVGaE0I|D{#E;?Ft^&i8wHO2ZnFZ%^c`2^y!Usn2ln-n_lyuE323w^D&)fAD(+j&}A- z;OcEQ1;?G)#jLmY72-P=+;IhteW389Oo650!O`Hr@(PP z(ytUaw)6E09PeAB!12CsDsmqva4f&i6*%UjS%IU*r$oEgdlCZ_IOg{(1&-s)1O<-y zn6AKa{Jm6xqds4yz_I<_sleR_Zixby4elES?tXCTRo&NzA6!&{<8!IMQsAi1TNJnp z!8Ivxlfh}#-RGkK+{FsqMd0pJ;5bitLxCFu?tlWvdBtg~yUz!?=?Wa@d0_>P>07G6 z<$-%ff#dq%+X@`lH4Z3n%t!76-Ioi;nLGuK@tv*66)JGlgYy(PuE$@kz;U0)?Ft>|aV0IOcSQ0>}RJIt7mY zp(P3&$C*_M9Q{&j6gcYD?-V$e^JWE(^RQY)u1;MOQ`ESFsh9Q)IMD{#}nje4m2^5gvc4h4?>VpD;;6x>Dyj{ehLR`=!~P>-%u`<>v>Nr@+x)VkmGdmqiL3 z?Spj+9LN2Q3LN#|T}AE-1&;pbV+tJWZAh&9a;E;BtHAleU7^6Se(zP_IInn2f#W#6 zO@X8R@}2_668S`dqy6%o0>^%+=bG-znSOy03LN!if&xeV3n_4n?*;{q`Mp3LNLF zwF(^l_y1DhIDhNEw)=A7eWxgJ?ALBl;27US3S2I@4GJ9l`;Qbjw)5{5xtt$$UoPC= zIbM;QslYM6w<>Vd=SLJc_8ZSAa9pq5tiW+SDxtt}UUABQbzgq$?@v?U*k9!-aDH&Q z0!KZ)R)J&rty1Kk=)iS+zbMz4{?LKz_#RF68*eLcY)3sG?Y^8jKRRE5qh3u>;Mk5X zQQ&At+^)cJ-Rc1aj`PbWI^o8iS2&@FlN0+x{rkm9TxC{C9p4vJz|92qXFLA?x&t?> zZtS?Cf}#lyg}pft?|7_zIWxYKe@BAz!Nn(Wo&CNG=ld%ZIL;eaDsb$F)+lh3!2MQ% zJ0IK^3LN!d@VfTp(pi4#w>@8h^Mkuyf#WzGRp3}I&vn9$opAoSg>Cd858Sp69DWCD z!npG$(8#qvKq6u1g-DUY9AejUq&^PaE*$Nv7O3LN|UR~0ypTRRmvrtjlUIQ;%} zVc|*o(&LGf^9%heJioB*?_Tr0U}uB7{U?&8{@{0SI`l&vXD}2z>u25Pm-B@J1&;Q{GzE_NxT+J5_13oESPE_pxU`?k zG;*BitlsDcxyEK7ice?#DeZPkfn)joS%G7_{JSF8`^oOhnReo21&-x>y#mMfcE1A0 ze&`_ujyd>^0>^pOs|s8OxGxkq&Zoat;Al4`6*!KogMQI{eXu_$SKv7A-=M&;et)XK z(Vtkaz;Ql(P=TZUa>i5L=a=#QK!KzG@Hz#K^U$aQ$9dy#6gci@*sZ`(?+5;}`}}g8DOBLt|6QiQ(N4Tyfn$I5gaUUS zxR(?-_V-^ZaICj}|J{AL&|Vv-z_I*pRN!b|JgC4?@1IoQXb-)sz;QhPPJv@PI_+28 zmkax=2?`wb{%Qq|rrRn7j{WXt1+EO-ZUv5Z*y+!7pI`O|XDV>a?-T`&`f{xTcQd#u z1&-^#2?dV&@|^-F=AqAaUoLD%=PPh*M{^Z8uD?B`z_EXMUV)>YzM;TP1h-#-V|*ij z-F>-`2q|zm;I38RXgA%X$o)!zW4--Ffn$9fP~bT4>GPZJ%cVECVg-&dl__#RP~>h` z;AnTQRN%O7YASGy?{^AZD!4x>aP0p!C~z#lzbbH?r|eVUXh-Bc*M0qR{1~UeQ4eM+ zaO{V!RNy#&Tdcs*K7C4o ztiZ9qdP{+u2ktWkj&|&%-*%s0`Wfz3;5bi-DR3M=URB`I!F`~>QUCs_z_H%af7g9} z8Q+28+KICiI8kp39LI&_3LN$R=L#I{oQ(<``-6`aINF_u6*$h1PJiL# za_(4u9Jj_PaP04|Q{b47dlWdv_ag<4`F&1-V|?!@aDH%KC~zFNdi}Ff zf3bUgVSdk2;Mji0D{yJx3f&#~JdWr(aadjrR1vcx$aYuo8xf7=X1@#*Zo^vmB|e{wl@jE~$R1&;N$q662l-pD zf_v3wrM`4bAIGB)!SvYDw){GByze5Lfhazml}jnkSPI=N{uT9hL&c5P zhZo<7L-D!bF|^-pl5xU3J+nMx$DcppyaG4Gvk!_HnaAF(%_k$vbF$x&dNqH3w&!+y z`RPiZdB=5Np0~NK^o8;50h8z^KKc_+y*k@77GHii-gQ=fy9VWVgN&~)`nk^Hn}zs}+>z}G+$lL( zza90;53b)`*`7jt`C>CwvpLQmI*X6(a_5R{ z&-eK9Bm1?Enwe&kGT(Ld!qRA(^Y*KIClt4aZGZwD>{ph+}B{vTl1f}yTHZ4 z{NNGEv47|+KI*~UYqLEo@#Uv0Jzzeb2lKwob(N0-aMOO2?OB8`KfUqo?7q8Eun90* zehD=^ zlRiZMj4wZ3)!XlpzC~b$?vdQBU^~kP;|qP9?U|1+KV8K~J*WorlFfCc2mNv1p?kAE z<3Ew{mEpS1?)xypzxXWMbNAL)94?!qs#J+I@-k00O8 z;$t}{ze2yUPjX$AGxK{bn3&CVm0!kp49viI_wmgKW7=F-@v%M*gGv9FjIXQupgxZU zGu`I8(r3mO1@mY(@#TVh70kyr*H!<=`xYm%J+txUr>pxiz8IL7Y_6;LSbn|sXM0BB z%THJJQH682gE?e#!*JYL{fhQ+0PO=`e!40@a*M!3yWyCR-+_78=DNxUx%_`)Jja)x zuDEk??l)le*jyhRcb1O=gwH<+{lk}^uKH8nx5pv$SNQVN)qOdxM#22f=DHeJSuWZ) z=r{1?r>pW~`lf?fVsl-kZ!)-lgBks;jIS$ulJ~6#v(x6fy6<}QFGs*U|DBBQHeAneR5r_+yRduHOxPgmo42J(@5JloUj zd&zMhQ)l_8MEFxl)Q5+bU)TNG7@S++9pJI><)^Fuy=?zugu4e%@)+@AYZJLBja!~7z8BqKZ|dc+^@ z8$FU08EnK@VV?P0|ARmmKA(K@c{s@YLP#twKE>wqoCoQbLXx+L?)Mw9+j9MzP%xg& zRCAO*K1Ow2_!Mn!oz|};2j7gwlDr}YN4NRsZ{;nx`Pb)h(rGm6>?%EmIXg>S<(x}9>TGcUhuZHY)Vy$mrw5)m)~Px0z#HLuPH#$M*>#2Gi;bdEN(3L+9>9%_r<1w3fI zwijmt(Z-&M)IhRP*EURVj<#fmzm2x|!v~@*!^1nO>cVd@{P1%hN3=j}=3!lwef%%D zkl`(Mc#FOX#*`=ivK@ZJ4nLxAqPHUcq#b_L4nL}IVk?bT+u_F$-W%~B(>GCR5_d83 z<96V2eG`YW#FY&E-VXd;-^B4KQO>{(Yii`$=3Qe%m!^ky%FP>hG0osoI9L%~Te{JVa&Ld_0+?mi!U_jc5b3WHz*9oz#*&)P+H=ehi|1j1XbekGw#1 zEA-=-tsi$G2I$8i=tp9Z5QJWAP4u=8pbuN259k!ic(XS8a2}77b#{E05>c2ulhh$dI z0*^d-Q`o!IA~f1^rdH)asIl@jo}{Q%JtJar=~U8d9r`Plp5>nO@#G@so(+Mi74$sx|k_uHS$;K}4sJNfLN+axHHCqH#gzSVjXttaE8GN?X| zRuz94uwlMw$6Mp1BjLO|>;j-^iN9_+qP4 z77n3GMfm3`&r7%p1wcadQNQGIt4_Mt?nX>yg>~Y(pe5o!c~@7oUaoD(h#u(^&Ws-E zsa0RW#6;^;TB8b@Z(_K?ZH!o`$u3?xhzquew8fXnNcMtv42KWJnZmk6kBwZgH&$-j zjVrEPaJ7DwK3~6DUod~`SqSHI3O)}XCE_gG=eZQp?_dM?JU2jk24<7ba~q_~CsA4g zX|9kqLRyI4)8}C;lu{gh?0<W2q#uYY93#t|omW`r*j1O)qH?S^!zwnali|6B`A*PUk`bzI4v)hi zTZJfLjaXM_gsjCmhSke1DC^=Zx5%V`D8}#Hh-I^JUe&Q{&Rv4vbP3{x8#C$k+E&f@d zS&$wS(q)h;g*49$<}S5DSK;4XrREK}3(?rFDaD_8hIv))tRVi#78x`z%PqpUz;1%U zT)$z33}mOswvt8qkz%G*t2!O24q3~f7q{mGtm%HkEJK@>#KvIgoo33?i+2%ikuRR(J1jGvK%4Z7J}wp z!;BP#EKS#5nVV5&Ef}Ilk7a08cVUcyggh^hQdY!?K7JWO>|4bR$f(-Uh`q2mk&5bN z0g60PJJ7teb#*2FgOj~hC>+61aKy0Yl!)`ybs|4n>2^t(?^N$V7v`_8JmQUD(3A5P z{FklEJcy2on%%Brx*GwUb^1IO{_+tJpXVt^SBNg40g{}`U4feWjp%R|K(b(0`8-vS zt`uB7q@ALRdJB@A=)DhV6dX@J&t6Dp3F&`a&I7HNTwh3Xk~j*IoI(~rlJ_lkx!c{d z_qbu}Aj!_^Wk~rVAA2BOB~tY{B-v?nGACpsaN2kf{g>HjnC}J5cLR+`BThAz?H2!I zb9Ni1?BOv5++9_NBg_KdX{+A>bDN{ZL35P;8a1=5uvyFljzSKapU4_TWM;jrj%Z6# ztBT{K_Db15M|dzdyy@_6ZRH0DL5C>uMl@lz?i-)hU&|9xq`#QM7?#jS!zwXEvv~j~ z^^F(_aH}Ih^P6N7x~OGVS^sFuu_e3A`knF3(=vut8QP0)8ujs9^UeBC)4V(KcX~08 z5HV>Rd|v%QUoPe}f#hEzPw5T5Tr?$_?||7Lj0yJdVVOG^#KG~&=#i_!Wzi#J!zF>_ zJCOvkoS3h_#$+T?b@L4zqgZ5i%gh6%LIYXu?KBXVhTmw7?;zt#1TZx*rg%@e*Hh6e zaTOwxw>6?I!}J ze4LgS#s7wg5O?7Yd91%S7y)qu6R@CpEHNV#y94urPYu{r-d#p4FP%AR)S@F-lAvrGU} zUsg(m&{uA+gdU>!HhWP)LLG$0{0{vE?jSpSvtH_nna*1d2%6_3H}S{V;mEAqOWIam zyPJ*Qg0QK`r!+k-hqMrm6`$uyNYeDU36eBDqLAi`w)6<3tA+GONV3hn2kEIZc`f_( zN6`KHJQE=;5ZrP|vi1D~(nD}G`8+Ldb$ytzY6{&h0QVUAJ=lPY( z)k8Wa!rp@9z6e+poPHs7k8f+|mXBWD>F4Gk!M z+*T{A3A%DrVv$yBXvEIsX58WU*(LB}JjsEsE{YK38Lk(PkG8|ruz+!zk-bUCFMgQDB= z+Bd4#GJikhiW??b&AVZ(m%SY~w?6GCUz@jp!`H!OTxYh9??72^>C-5=czA z2_M%7)tdVqGWYS3x9k+TZ@Q&Up1ZGaOm@#3+Z~HHYFoseWZ`OuY4K@MchLmUjj+S{57PTMJ#ak*ztAH(v|z4L&VM~rR7Jm zO3hGrh&W8e z;XOPIi$fm{m-29tIP8JLB|NMUhiN!m%)`6IVLESk0}_oOt?Eh$VvaqVi3A0eyb!>cr-aaUmm6M=$!aWdF11fKd#H89y~fFK3*P4uk1)1RN{Ws>}d*j zB(k)jCAdYsQM_HN%0w8F);}Y9)F1v=^k`=Iiy5)ro%JbZjABUq%(|{FOM!{dn>;t@@`jxHQAd z@L&5ycu=ce<%Fj&{Bapx7P$jalxCzd>|q(EN3IZIJ`t}ByCg#QXK6+c3=!zsJb(1Y z@4^|Rg?+nLorKmVhTG#uVV$<2&K?7hzASA+=0smVt*RVX2(38RQ{Ajpy^eUIC#Gms z8z3O|Fth@}o1I`ge_>AwgI{%m*})4swR76X;7ty_-l2Oic%u{iq7$6P;8&dBKRChZ z3}(7S0@=FSYEdz@Xa}AO4a6pMO+c%D8btgRgj~dsWTR9st@=TRKjnl+8&eRCP_>G< z*&3RPP@!^H#TT`P`VcBquRK1#HM9ppg$fqLr?-ZtA(W~JcW+^9XgWeg{ZtJ>AV-SB z9~SNjnQtU|X+xoaZ$L%EAr$5u4|VJSRV*I#))~p|!IyTD~u?c0x&kB}Pm4#NgxpKA_iJ5Z{ zMl3KSEV%<6#@@tWcH(W?gSlI;Jb^}aA)787(rnq|AxDouY0iRR#Ac-+CG%2r;p#1; zBa?ecFtY)18zc~^BvN(Z_7%isE^(10d?b9jZ~+TqoJ-_Mq6di{x^M>zBFiPxB#}lU zO&8u_K^$PK7wPyM64H@QB3&2GVnMv^5?dsZK_WvJzGFfB)+L^nL?($$UAU43@t{l4 zp21yulIW=m&$1wHa*3-X(ThYcU3i=YQR))3ju1z0620}!y-+uTIMXF^B+-XNAANIg zhw!*WGb=PUt1pSZ`equGB94DTkmd1LNoXWAeKR-x3Zlj(*u)V>7KtoLx7}uV{GpFdA``Kr%6KAf%nNxY@RDJU)_8CK*nTj+0d8WU< z`BeMNIpPc~v02$XldW&Ym@G08K9wo1{xx#fs;_z_w66NU5TLI+c+eY2bHy=uU>;%l6TqZ5{;6evQ}t% zjZ{{|@uEvSD+wxVMV4M8l@&zHC8Cm`vR3rdYoxM*xYZ@Dl?0Wx;uO6`DlLeBOI#=k zDsRQ9dW}?G5Tjh;bV*Q&EBfm-Qi(zIa0xE_BDYlLifmmxJ0NQAGla|X_)ro9NDR1SFKl=_F3q zYv2NsalGdeJ0x)ii8J&XOd%!ll1uzX5<^K0)oU=!O5zchsFsAEgkP^2>JYcP#PyOG zM#AT661pVLBypx*Gt7x2-zA1hVmOK6dd-;*k?s=TqqQTqxg>J+n&A%d1;S-{ z?2*I>5+n4QT!+}|5?nJ!93x4L)N4jK#4laqaY>9KF-or)=@2ViA|i=A5_x*fD2JHu z5|>IMp9Cgdc@8njB?={R7KyX;ntX>CETOJb~EbB;sY=@K_eqJTt! zUNhDqLM|~)5``oR^_l{Q80`|nBr%S}IK8IOAu?SeiSYut9ZzDsUNg=izCySxkAFzw zToUK%HRB!P4VQRT66cXPPp{#ORFv4ST;eB^IG@D%dJX;Df>`MiOC&LY#00(Oe1}-z z5_2R`M50KqncxspTw=T=ib)jfHAN0F*d_W&Vj_u&dQGuI91&(4$J>8HLU~LgF-fnP z=nx;c#9t&anZ#thh8C^J3thRg#C|7za!1f5Dq z$Au&=)N3wqh?y=?CW#UfC3?+;4so_i43~sXLf30b9HN&?cqK8F#8kaTcZj$!+gKhS zLqa;Hk(j2}Omzsln`LfalSCrzb}+{}RmSA#Y>A+@46opRz*kF*%d*Z3!gb4s+l?MffZbA10J=1~nzpG2cXZ zR^bl4^5~h`WA*fhl*TS<&?}E%i_sy}7>=6Y@7NKjaW)x+v|qigt>QwBft7${J@-hp znICE!w%ASv#2n0O!V;$zG`Ab$%k~DWBOAQqNReQujOc%#|&xB&RnDh3F zP32~zL9waWY=kLqePEMwW9)9KU-Wb!noJKb#@`gJIvtnd8V|Oqjf0yd6uAsXv#_Yw z2PZscQ`N3;f3pc^^vFb zdU_tK4@8f9wGCw+$3v`ZrA<{k@CWmLXk#Vf!9p}Np?bhUEC*DcI5Tn;Du0nTklY$i zMNr``+<|4AI8TTy%*0tjgg$!`LxqUp&6DUaM2zc7ar`;O3?m5QA>kV{c$ev}Ga+6r~q!xe`17ARtuiUV0x; zv}L|l^)`fH>}DTM`1D$4ny!)}*zMxwbNVrP zx+hNe)VYO2oL=snjzB2ICMNR`QqT)fFTED26;Mz@+?yfS_;hopRy7TwV0(k@t=D4y zCRl%`EKPl|eZcn7YdJ$?+WrTLMAA=+SDN}a_XXQmujO2k?DkIC*Aa?%HL#jqi@Fi) z&pTxwl`LGG)3fwiXp~^@>Xf}%vi-pJ(`)y+h!FX9~lc7R^X zxhL6$ow5rgI}q$ZT|D_sc5~P8Eg3Z-y zhuJJ&Y|t@phtX9cZzI5t&}+}M*}o#RBm0(Qu{(GANWFHr%|6#D`;=ryfgPpS=GyH2 zowAE0n+G;euN`5tvpQv`OEw>DzFs@hW^+4b2TS%WuxIJDqimMz*B$frZ-k;8MuQ!# z*XG$Qz0V!lt&$xBc8p%jc{S^e-sg_&I|Bmce2t~YwU<>uyb0nixZ50=t zG+w-l!1%f7P>g6}s$o637ROlFE;HZR2gy^$5e;WyvY8D5^LYFZ5RKS^6l`#SiC8Y| zZEeH$=#h!xV(!kKfDu1j3|k<4t~kUF(ID*at!O|o19tEZW3yuf8``hl)K)!@GojdRxv7EJ{kcflHe@j=pHzS~ z#q@f**x(=F2LB)8@{6&-KZp(fxMSG~dB+OenRgRQP>oDmyW1{$CVnd}oD56qdi*cr z!q4ldf5V)=8%xZ`Y0Yu5>kPx{Yt3oFhFaDScBTkhP1KM;%x}dWU%=MOvIgZ|K5T}2 z*TC+cPNBdG9ml^sE7XF2ei$s++Yq$Mc8A*T{^NWOyDJKJ$UAK2vKBroxC1A@ z9{545odt@w8`{h*hFR{n%7f9pCsNDyn&m+QyNkqj-O#?ErNfR~j7^DGWBYEvZ(sp? zQXn=f2Ro#(XEUgkz7?`CDVR|bG|P)htvScT1>DXVGqU9AP*cG4CPo_OKjY7fB&BNo z79%fw8t9+o6MYQpRKuK#+kAu|%xw%aMOd`hSB(D|D7^69&6N{iG?j!G8dl{#4DSp~ zi!ROZEWg~|c7^#{MtFpn%W3$Ford;_M3y6@JE$m9Y;+doXN5BCc}|&m5Zf(xixSf- zmnFw&)oW3cm(5!e6KjflL1)&$067MOZ%`X-O0lr zibFP~TX=YbIK=k;@C`iVJgBq}HuQ%V@KCI2_esa$6+E0{MC&uqJTkavDhute`c_nB z{C|)HEaB!SrWnb0QErLzz@;R{a!EH@pNc{kYq<5k#1PRlMC*GbPJx8A+WIt1fuoIB zpRLE5D>U{wQ8#ZTG<&`yl>M#ng-BQ1_11v*ZA_{9+_Y9KgMMUq-wcli(!V#CWD}f0 ze`$E%nvC*U^DP$H=U|1ka1Rex@UUFUizrVtqRTQo;qk0tr*cP%>OQ%GQGH?-3jNOz zRf8q_yhs*yU^3C|w(7_@KW-c6u1@2uvExkqR$lV^wwFBB=_RIpNj!|Qx98G{LH5*{ zI@SlR-;;oj^+BiQDcr?5-P0e7>D)d8yKlQ_{PD99Uj~LqzSGy|8R1HWkgkU1;`00Y?&)P=t_^e z5;u^_YxyR3I~LT6j-2{D!yw62T?tE8N)NcwpIqr3Uas#FbukrLSD+ zR9Ln0+6!IjR#$r5mA1Olzg=lCtXz5RbXQvBN>91cTds82m4?IWmDkR6rTbjzH?H)a zD zQ$~=h+QOh7CUxFF+PymqXelr0XC_y}#9!!mhN;m3|FLrn$|t2;wPK4Dq|# zI@;j<8nJ_--v!358Z~U;roKmFlb>nYD&<&1be%^d?JI- zBH+9eJI-&U$)p!$MKbWrQczOPX+HbF5$FoT>WBR&a3&_OnYaW4Za>4sspJ-npUFjZ z*iXgQb?klr0)I2Z=$ZN@`nRsa3z#IATYV{lObGG|J1z1N5xK#Vk3g7j6(;fUL>MEc zz16>XT1L2^c*GQ*I~-`$Vw|;lv0r~|i&5RIYme3G8BLM<;76?5#UrF0|LV&!>LW%l zR+22k_Fvh_wsTqTg2~kX6qab;X%qXO8kvFP%QC&8*bm^a3TK3h;dA{k@|z?x}4 zFyrnn=Kh^F*+oHVRZ9>}z-$g$%QFl-Z=)A4=pFg;rn2HYGa?_Cnu(A#%6S$bV7}pO zMaLr<;lYJFrdHlRHhB*HiTQsC6u+UH|FGuok35&?TUPjW>+utOz@Um|gxJzfGlFIF z*cNSrRs};tR#g!DI8ZBfZPEt|G$x7R_zF9 z1dF$X%yfyjDdaeNLU68jK-1- z9vev`M~BsiyY@RD`|J@3=2O=qTJAbOnrw>m0bh*iusXLH?FRITxLj_0W*;J@kSo!~ zmHpR`T`3JUC{?G-mE>kn@wk=w1t0BeWNU|^jb~m5mc}k=*vNFk#S8EL9!LS#z%Pwm zK|lWgEFTzJ^-##@ zx@LRJXzlz9M<~TYxdegmKniA_EbI7(I3*(D_AzaPSQy}Z7z+c4<^>TrTe!gqRDSw# z<UATCVZI;Pi6R5PB_*bZj|9ZK3%p4a`fm}&3@2!b`J*b5`jqIBuS<* zaEAyyN2}(}SY#%hfpreqPX=O+&_`&=dT;y>2(qWt=sD4r>VvY=Ls!{91N!0-3N?LV z|BUcl^ptaCaYYul7F7a;f}$E1xvpI?{S(1<2U-Z7YO`h}R$xT5rD(U2<@2|8lL9tH zk%IS;f_zb;Mubb1Iw}k8Z?#B4%lOE6WZ78)N-X~^tKy6s2ORy8k>iA=`rRJ86esL0eR8Qy0d*n$f5EuC-0;G*i z`5gSgAq-|GQ7-qLQ~3Adpm{5_HU55`0MyH55dyBITI>wrF-Qi*lYyZ;_T5vPSIUWWv0<%jKan1VM``?E zTkJDIJ_>B$i9~epTTqlx^?fKa_-VG4%-{M0Nb6AiZC)T^;>jI86ME7}Esd9;`EJnM zif2UdT$p&cVDl`*U_W8N@t~Pen+K=ec^HndeZVBwh0Vg@a?)cb^bg86 zv^)Z-Ug+m@kggHNIqf1D_N5y(2zQc0cUXqpQ z3BxuBA5OsB5i+rGUkA&!v*&@M`{z+5XVGqhb8J8CHQjtaV7?7UovmI0E1V1C8paqG z)8Vp&E$2Rux@<2NHFqb*I9`hXVBU!+9zhf+T*saZ6)*8Gn`l^we@A$WQS1%hU|6$Y zkL;pRQ$eFftNIQFYM7U2#m~XT?QKLDg1sZZ4#08spKQVW_O>9rFJ_^Lc^6~0jih)J z4qVGHXnxBlBJr5&UTM$qS?~xf#PD4-mQJz`(Gd#k5QfJN*A~=;EtrNbvr}8}udTKq zoXYhu0%4O0BM=s36Z*r%X?XKbMq)DWx2}yT_-CAh4|00Oq_X|kMT{e>Y^h#7eTY`| z6JB-^UL2HxykMmq#!&#T8oDb>>xcIVz;VcSJr9s$=LI37rc2Eh+uEDg&f0_D<*uMv zq`%@#{Jj7%%6aI;kYv|+BP6Ndce>J2SNaT+v<45jlB4vj?>q4LIyLtWi8w<-eoL0DF zzLDJPPT=r}KORWGEw?~SR&1xdVbyvtPhvICbfzfPs3aCvjy=86|;fY(8_N~_HbK$Xl9=E{jemNyA!83o>>h@#K;OG<% z&z|LQ){4nVYguT*WsPyi&Y+C8kCR<-S>+l(GKcp7p{w2IN5P)U&0l>khxrB4U8U5 zhVvWK(e9G_a1v*+83VeMZCEoFV&s&8vCuvtSaS<_!T84M1-wEqh-bLMrRX^vZTSB} zO>A{2p*mcEbSH!oTng!ckgkGsNJ#g%XV`m2r6;$SnnG%RK-yD&+ZfD)P@pq3_rQ;{O6c2 zw)M%dE;g8iLH6((wC>K6cgGF5dUpUsi4i@L45!(tavrxv7bP0R45vKc*gvT}hB@Vt zb=F!$b(XwSWjpPUx$yj`E6U~;5S~m1sA-y0P`XWfOp+5mh zHt**k-7cKB;?uOkBX^=3@?t|0}53J8) zLiz?@pXX8h^~3M#^ZWwR8_-Z69!7Lx5o+3A1B2E}R0-O^Rh3AVVe$ogj>(Qks!!@Z zbDSd8+#;1;!GP7by$Znew)(bFuYmnp7>qx|s`o@rXBTQ773yhjwY$|s_N$mtcoKg5 zxNr}LE0}t#GtlcAcv9Z>L7KbU=wdl8k(ELNU-rK9AjwL(1(Gaw_A0V^9)lFd*XLpH z+NK|N3P*Ou>~^K&rg^34_BHVqK*L%iTP;?x=Ky#V#K_-($q~xnkUJ|fWvSSyY19qeQMmT1 z_(CL6zH%%ux56x{=2KIKmCiE75vOy8Rqk)DtV6TU(yA9C;MFw5V9)Y5t%n>B3v7){ zYtO>E=GCI}!9&a9#E)eMv@6^*dT)kDTeAhBwuWeHxD^}XkqGO8r^Q>jem*c z3U_#X6)tfeZy)VE&mRjNbjr5uAZJAO1N{^1NAc?up_2fzWv1e=+y<_yLjsT`X;PkinkGoWpL}qtn*T96}t}h$pt~{p|z|8Ji`2Bz5d=_ zePzp09B<+uU7NZcCzfR)@EDFO`XqXYnXUN{ugBow#YAxxuWwU`=njyaj)nMP>st|y zp;X(x6``v_%tg_B%Tjh;3t(h^)LL}MMA3bV&7cQ4r;p(gR`U?%uJT=#qNT$*BgVPt z#ulb(a}laz6Q7PWw9+?Ur9Z_{6RS7;U+vUHD75S_><%GdrrG)!o{B~(b#Vt)>F>cR zeSy|MfJUy%>`0m-uYyc3~f04@oX!-2v$h5w;kT?5pVSk?$X%AJR9Bu{;Gy zzJK6#Nb>yyO=u>PmYq3q$eR!Z+xETAjurP z2T7)RFC>}fuOP`Ze*@_)k>>9q$u#%ywd+A)c*)MQtq;g>29yhplYKyEJJpnnmu>lB z%0h!(FOaOG4xXSQBw8l&GFMsvsf~BY>B#+@2l)+aoR|(D0c2P|Sc(_DhSQp-`7$Dy zdFcy{*b`6l4D>`R-R=77b#Qf&L6~o@+$zpHPJD3!8wp}-MR4&)kx|VhzKrm&Ag1L$v_2k5@!r~LdfgcUe#A9cA zOY_QNSQM37)gAbKuWnf-d2pSv2>&M#Tae__=cz#HVkpp?t8%3k zJ0f6J<+e9totYU{yUNTK(I!hxytudbcSx)=`{bP~#GUaXwz3v<1;JQ39J@14h=o^l zLTJWEQY(U`EOopk@RQ?Q+-hA34OsngI%QU7HM`W1WlVwzt@ zBgRIpy+QN#eb9Ee1>Z>Y5i7a*|J17f!m}s69*W(A5k2916%CE=E&8YPuBcDY#rpWN zD6RSuFjg5nN*^Mlsp0X3yVmLtmS!`oeqV-(GcrN{B9Xr{;C-V*%GIF9ghZxZXZTn zq!%6z5LIj7-CeP{@?FwyIfV-hz9=`e)S7=67WKpn9)-f0X;^J6!T@TPXP8&#Fs8D2 zlm&y$X>e;o{g=x9cZPM3J(Xa)19u>Cwd+sD3+JMEXQdlScp68SX#J3&`7exEB4LTK zK?`+cg$~9Cqj=pJ5AK3{t?d}U^r^OYFyRp)#sE*%RIAiH&e!G~3Ru3s&9qA2X$hIW zzg=uXz{^eo(Ieg!d!+70m+i(I3U9|&xH)?(t|-Hdh3BOLyY)f+4OyiP8E_@#1uQ5r zk1%hPM_D||agK6$rjZBr z!RlWmQEE0J^$n1GhO1Ii-NYW$yH%PLd`U;YC({X7=`ld%fl4s9%r737GGOXN{TKhQr z-Qp#x`Gm&24k-;a>htu) zWq*Qw==jT8{X0mVJ%@>$DjvacN{#auymZGlHT8|OH8<1N#QP+h#IroDwx+Y=Pc(e) zMHSAVT*M$vxfzh8`Sb%w(tNrak~E(j_m6=WK#R``?)Dj-64>O-8L)9>#pJ*yXU>2_ z&Kckk3duKaVRz5ysTpnN4D~S1<(sm$8&6>0Y)9WNCZ}zT{3%Eb>NaGzMcG%nGbQKM zXUazY;r2#;C-Wn-FFH@z;|c#RO?7FK4uvF5(tJqLBn?24CTTk#g!EFE@+Eq3JGgIh z8y&RH!v)Mw`DbNy}N?&-_NR(`{~>pXtjxA1r>He33J(gvzBg^Qgg!){0o|2!Pc~m4^y~Znsx%=6dm<{@a|IqQSC|N63*?!$z{d0h!*iA(@X^We`)wLCii}c3T z&oBk}=#AyG_`l3tep#7$$2_^DS$-APHOp_qNlq{EYTU#42?UJhN1&WSQ{;`|1oGpg zd?RUf-O_sz@zcBjAJ{n(3b1LSW53b9E7FNPZeUTmd(rH^L#yV>tzkJ%g1vVBEIcKQ zCX*?g1bBo)tI8#ZHz?9q5a-k6%-FfP32f5pohv-F_Ih)m(U;3!(7hFQaoO%(NW$Ga z>?GT=qb&upo!i$nE}V*K4xjJngxVrcnYmZ0gRK@aqot<5wS9>5Vy`zxfcA!*#Mz5< z;T%CBSAcB*e^nozU*CY*e7lnH^0bO0+7}Z=RiLjl8ogCkQk@W^8h6I z{&jBPlBOZ&pLdIUaHGqmP;$6lAW7~{NYa55fh0$$C?wf=#~{hhdj}+$KDtz-Po6Fn zX+qKnkMOi%vNm>!lLXyMB z5E!gSG{(XQ8yATyN+C)26W@p;@5Z;J{AoD3Wsv0Eega9}<5@`Z3NZ*>-fA*o_&vao>*^~u{w&4 z)!XrpABau-FYZ7y2Ap7=*S#CoIs){{4=^lw`J{EcJTkCBPkOK&`+AIBYj|Ib%8~ww z(G7ToU)!+opyt&-$J(MFPm#a?-^aUDt`Q+OHI`0U-_zr?tg2^tEBH;|{)hUped8e& ztm~rEF1J?lt$pU!=x4s@cAqJZY%nn?XszMVKd8paJ5XHpTP zkofvCpXVb;VWGN3!2U6kVSJ)dzMGt{G?9{HA&G4bUacRW{+f+Rt-G72jpEY&$z(~K z=FIW267MVwiq)pberLOjZNujw8M5WJyOCaiJNbDx?xQeg7vP3@&JR+Rnt`I$|?dJ*p8X}!d-rrO&y+Fz#2+nBR++T5bE{EhEAe~E#ub9C-6G0WYRC$U*N@-LJ? z2GfK8e(_(9%ZeH(Q0%z*f9Ags7o0p0@Zf{8E2@fz{63^N8RdPolysoe_xqYb3 zG`Ji)^n%tk@CBCS1oF3qFTpe%uL!O82a5lW7nXm9R}#a37L6(7y*Vf3{UYT3GMN8a zWHUD#?MoD6jIK*y6?(4UXsn|Jv}rJFVba{Ziqo5?7kMKC3+u3Rf75J)YGvC4(eJ&+ zpt@k@J`=sxNqh0m1yh5s&vQNgN-xKpwp(EA=Rr^)vylB+85LN~7yF;W*lorpg!;ji zxRdxjHgr2^RJaJMhbRagKQ(~&;5T6!a*^qScU0_U*@`Iq#w0zjqGz*SgqcAM*Bh4H zdXHX6SQ{Y`{Q!EhPr5@=_a~k}&x}n<1x9pBo-mqiiv?vbTx{0m1qQYO8p(2hoNpTz z{_o52WMBupKYBe(Fb#a+z@6@oPXvzjqgnX(3eqJ9|1VwX|EH?2gC7%BUx$Yj?W(Uw z0+Yh)(XQ%I>|bw`Rgd?-uE|sMp zy9X*9K>yR6$hv7QJW+VcmCpAN&tpG_c&;2ZjlGw3LA1X)i`heHe2J^Qr$}#ex z9B8s=_xX5S_r1gbyGz1Kx7H7PPsE<9U#=BeH%ZT_c*2N5|EvMnsoA#eb3tM>9t{Z; zW6x2@%E13fB50 zaj$!kb*I9$RdA!%;9`nzxv;|U|T4^0~Q4jcqAD`&f(N?$wICHyU_Qm>zZ9xpgrElQt zxE{q%D7CFf+j}KPH@r#&tSBVz=`3zqbQ&6vwwgo~MJ=G|_I3qm4u%?NUMIUdM>ElMTqN-0U@Ug|!zP8hxC%4C-qa^`{~P3~T`BWNo5Tn| zPQ=`rG&-#@=%asmCz$`Y@Tu4b9?1W;0-I#f4A5WIMgC#;0UT8WW+tr6fOi)jq+|&O zOiwU>=Xxjy!|g5+^Bd_;l#l44N91;D@dzV!)n$tQP^@&Znz7x969b{u=@jhEx#H2M zCebApIbDEJe9+LQHDDWi7N3H`LkGoMBB!C1h+Z(ifn_&1@jUvQD&!w=-6T%>eN7Mk)2cIl{lZfG#mS}%6Knc)|wutTAhexwZ^|-uP1vl;n5w3Vrf&EopoevJkBE)nAczxR_-}1 zOyV^kHwMhF9W$11p(sOLz^{5pPyP+{yEG3k_uwz@;MZQ{E+uqsJVG=fI~sT*w2FNau~#EUCXUisk? zES0t?FT;DRV+@gcyo~|r=K}{A^SPcJJu*8yIDSZIJAyDZ70(#B>4zm8G$UAmx)HX_ zXE&`4S|hneuLZ38bJ0JS=AsvCsVEIuH)C%DejAnkNh|{9qWjLGuMdaVnba?wn}seL zg@eSxx`cnKA!zzTX70OfBFb-+kKMqu<~t$$M)AjJTFA#Y&Z=v`dw*_D!25l`d&0;+ zrd4y0iEqa(+~(zs6nOD9t!k}`?vsGEf{Vf7vx3$rrv7rK(7=Yl#AQ2w*~tF$?_?aT9Kq=-ScB@|4Zj@Yy_+*3F21z!O58SYyLQCWrIuPnFZEZT$ zq~tcCwhxO3&A0GyjonP}BX)AE76U6(g1e1j%X7ApzcXACEIx#1qOfRMk69ObRT?bV zgo>S6^|F^pet?UXj|+IG=Ol(YCAlc0F-??1nqvrv{5giRSW#U1FS*ea*4bBMkRLgV za#JjSRoeLtM7IOOJOt(#%gjyiwMZFFB$&n}9{YawbdhOBmZpYS=je$8`E}tLfmnY` z7h!j`>E)K|%s{{^w1bzt;&cIvUPxTPp98YHZ!uMr#^ls`GcD0e$PiNQ>1WqDwX!e! z!AzM!{(2qeZL(5D)qn~&%!CkRnck&iD_E^oyHDsw-pn;lw^~* zDD5PViY&@@``AS>vg)yj$GL|c4S%#FjA(-9BFy6MgSj!@NwG6*%O7%V|Fe!+&OH94 zd*G**-r+=G0&mpr>A6|rce|2US`)t<7|}*Dizs;up>a+vbQ}7zI-#y0o`v`5E>S1IrfAsdF9n8#`s(nrtU5&Kn!})(Ceq z7s0F0L-;(mLOL#7)vYbe{pEIc%#PC*gDVES#%3Mw8LfVpCxo_OvzvJ8=|3&z7*?uC zs`EpR@J>3f6~)s5=u@u6sIac`LT{uHKiGy2C9Lb#>gRB~Xp2v)%7Y75 zf1S>{XiE>RsuJGbIDg-xAsw&eKrhJ+3QTmnj#60AR^|3oc$q7o#Mu(9`jvjpnjlAf zx0bc465N45|AjlB<*de_13zhT_T$Du}!8)e5-X9(i{p4d)90j7w@&2PUY}&zO z1Q%s68U*Hf!hM2t&SPp~aYsDPBmu?M7_%M(_~pU_u4WWg8P0{$Jk=9{#0F2Rs_c zv~X4H>%IFB0&~7jThoZTu`3D=1*;9yJ>6hi^iG_6Z8zJ@^1{7!MP}ozu4KF&A zLt^m+X98xuC~ee1A_IS-EwjUZ)Fz&hs9|Qt9l{gZTvw|6i+aLs=4wQg8xTbe26_{{-UWP%ubN(qzwk3#!N-!6RRzQ1R?6 z@+t}eI#c~~boC;mzobxw*}(gK+)Sp1%l{veXJ-<<*8fW;oz5X>E!(J7je&}zR_mNG zO>bV!{tB-d!O-W?n;&2&>DQ`%$RnxZ=vID)-?0DRX<^qrtX9<@u|hR4Rb+FG_Yj91 zxstO=P|$oq#v_@r=B{=GCe1zQlc2X-S=yrl>4v8FeYvtFrBTru+Q3KZ8>d>1Ni329SX z;=jO2y9zLEJB9NpCv!1A*@MjwVxJ*}nPKhBo8+!3-8@S_qb6 zAQt4i(&wC*`e1)QFED3hOl>Ijdp(uQPW05OCo=YAxe>B1Kz9V=62AhAJD@v3cO)_b zhgNjC;l*1gN@G4g0|F)ev2;i6!l1Y}GP10F?LC9Lw<6fd0`=aDUv9VXLb2QUwv0o# z09%b=0ij2C3Z=ZmXmYNzDQtA9dB3>M9#asdlemN?H)PqdL^cbx8NvLo{66_2e%rnT zPpZMpDfR9%rI7lE{m4V9DgNmzzxS^9VLSYdd$s7PxNM52ZoX&nDEy?bzKLSuRBJW) zfR_O_im99O*3#TC1>xV~^#sksj?akWQ(yy5`s z*Up>9diR_<(Fa48>W-Hhl)~ckr*$Q8x zl%*!n9kO(alciI`W7}luKmT-tR!x5>-mTDDg^`G3TF_Lhx-N~a>J3L>3))nZeAOym zVJmI_Y?g!hkzE$k^5rVh>qryJ`R!jSZ53Z*6TcPnI_CaTk$d}r-(YMCl7>=i zSG}m?|HIw8z(-YH3*R#^NVv!jUMf_oQKJSyO#e8ul=HPc#kaPHp7vn8CxA)7ssY=I+P+2GTBbuS+8RKSy#KYHz4u&# z)t=Myec$hmlC1sQuj^UQx;_5HihHjCqrmlYOXe9S)=E!EhIz*{n22I|1LtE#)LkY^ z*v>Ui0_A1*&bO8e6&x(k14Nee+*_bKCA4Dle=cF78%CdaGJFKT8BecDuWO27I8EBb za7gm$8OlOa1WEFE5CMBh{{<@K@V)51VCt1e(MuP-1h=%tbhRZ9dDZE!1 zaf19UTpd>zUj*@7`6V6$^~ulD#8bX&vBDw3KkMJb+ZXa4=3DX{=ATNg5V)@L-7IhB zF!mfDTi@Ai-TnyQ@LJb*;N&VQ518x_&t%Dl?TI~qK!0}-7B<$ZyGaz!MI1PaO-vY0 zn`d_6R_z8WHxn1i+o&0@XIpQ4#5>UPchM8&cSTd|gyKB8sy%yLs=hn{&)} zw05N3+#%n?t=q-()wLa0h`lIzB&Sf(MVgFjob#M+v%f0mKP^ifQl!MP)`#_m)| z;LUHTM;W1^+I|k4f019oBlJ%R<0!w@q=BrIsv@&Q{*cI+ z^Cxrk7gGgDT-h^{u$6?~@hGYvCHv09kfLSmoe$PZeR90?jL@#+L!_~FQl!WRicGrT z3q3Ra{LHV_1sD<__tV78{^$VVDnWSSO*N5!p5sRp}E! z{>(wY1yqSaB^-bwvbVsMJKn?8GCt1BrFEtcwx!DZ!>!F+KM5$aLa_(lz1DXXr?;gBWBkIId?Cd|sVujMmh-OZy+PwwjP zZ$7`4^JAr9@B}7rJJMtEx&<$~uQQT4p|5jrW*CZHu!1`>e+UL8Gd$Z<;|+>; z|AQ?kXa9%3$PSz+?;S-zNT?Yq@p%44Lf_)|ehvFI&<;)a8jvYP9!xRv@S~tP zHdINDD}nZEI(f>$l=mRe|K^a4gygxYcQtk+(EVC+FA#ku_6U&q28|sHWa`KO{Z_+n z4Z^kqE#n_@27a6J_5zvmE@YiOtvNmmWJ01@<6ap+Wf^EL z(4iXkMIe)7VGw&OkjeX_0Fr0CKcYEy1<*SI6yX#$IVJ#oLPz6jps|``A&?o3B|s^S zy#vUsk_UmtX}Wbl6BLps!A*Jlf>`nNWnzZ|nb=E#j@2BO14VTt<(2FcHLMk=P9X9o069Rnf;an>d{%<3}nV-2heMba3mClIyPZ<0Ugj4b}x`A zr3+}X_U*+W-JgJlYHe=;nH_K>r0DS)_E8`cb`H=jkYbV0)FA9mplVHb7m%5^9|66n z^{x-niO{T{o<>4rLC0@v>~TP*RkMJ0Y1m~z-s}VYS;LkE>0SadeUn!Z%sv_e^cC%S zBajiBeHQ4~n)h-b(|UO$!Q_1hXsgB!Vcbn^vw=+Pmx12W*qeY%-e-YKj_p7uM;-gm z;iZ@h`x4GLWjWTr(FtjxBX3S`23VXxg4 z(pLifZ{f~oPJ?Qo38)piUz3w8fyYSmC8rsRX>@Ol>ooD ze=w<&NG#n;C=89do#KVJrh%L1U|NbUZvV`Md$z~N_QyvoW?o-OpObw|hB}wK=Xq)0g86{R_U5bO z&gAF1qN64bDtt;Zr#~B1h3cyO1bR$y$v>eYf1RH{+~46$t1IwS9);EJA33Nn%mWW} ztRRS)GCGX@i2F+g0|QwqO)`Xmt*)vq7(E9sJ}&V}kd#_ClqH#|Nkp(;O!7BMoc94W zUi|^_3$?oXVs&NO9_I2aTc>z=p6*LZ9r2_Onr7-mV?y+&F)59rJ{@RjqsK54D;Bnp zM^*1iIEgA4V#e6S=)W6StftLza0<|iptL|`0;lhupGI^8&@x90;b09L5qD_8BHqWv z;g#I5QPbclTW|AjJSnK4IC-{MJCJEs6>mrtb;q2oIKdd>OsCnr#L>1b^QVM*koGo5 zQH8^xHjxCdyZ7y+1}gQeAWIZt#0BWa8Y1f%u1IJ+kioPOpipQ{2%=Gc*kuF$LRJMo ze!L$b`8eW&A3t9HmgcKW=Vz!)=jZq1EA#pBmH8^u`S~l;`T70$%6xu&WxmREe*VgI zetti`GM^t`nXfXPpFdpjGq~bsXvL3J@pEj&&!;PXmR9`u)%o=w@P7R7PGQt@v3}@w2t!XIRCLj8o}98K=^J)fGQ}`~3F$&GWzg=K0@# zbNp|=IsW%>@5leH@_zhpPTaDe=1^0p1}&Gc_h03=3yt1AZipjGv6Dzdw&E z`JPbuL)?Ute|*Vj+0XxENM(0S#kEa-17yAWu>6hiQ~E8DrT;XpX;o86nx;@q@kHZH579&7Y6k-YLpy2GE{ z55DKm@AS4&X0`UWsi9j!Bvv|6?XW%UrkpLX+St@$I=FNI2+ zDRfx}kZH^^>4E%oFO!~0ndGnHFMsx$ubt-4cK%R|#CgR?@+uR$n?Lf?t%D~}!cEqW zaa%;8;z3D>N_h>k?E1{d>@1?@a3+~_f80UB!qH4km|BOS+{CfMOoc{DU_YT$2er4p1KR;Tj7b{Jdz7y9 z^IfYoOmF=1J%XWuXPp*9u%{-;Fo4h_I0q?JeOnAR!?|2tBDY)?Cwg|Oz>h#WwhpGJtReL7{I?BqXUbrp z_mA9TalI%=E2n{ro;p(dI~!@XW;-&3+N z{VgbCNIZI*_9IN8nO_;;(^*0&3&_Bh4_!=j1a{GPJNuM$C7hn|;TsimSINd1*eJVO z$AvhC;#J=&o(90<9!iy&BMW28BM4OGgjt!1s1Qw*mLSZRc9|j0?j2-a>qL1bQ{Vjk zHd4G>m>9&8`nU90HBvXrY7#BG?S$k<)AfH`mt<7AF+#sXx`&J6=bJB)8e9L9%DnkR zZ&hk8`p@4Q*yQN8(K#&bg*X~T!_sOS1d#t2i_d;y5|!efR`oSn*P9PfMX=gr zS7Qn#hHO->ABpOQZH4h-@9F#nf#hcXjU3Cb!((TU{HWD>3O!KAg&VLsk=^W0-YV8L z)tP+CJxUyHzDnZZF0J#PY9a(JXsWjAk5UsRyud(t%l;7CrVYd2>J#1iOAEvQE z30{e`ZQM9*=A#E`=4ff=&uAvHcu^en1n#Nu3;D0mTJ~r4L8PHptGJ;38xqm)%RUv2 z&(l|np${_A;%B%>%@hOY>&PP(|enLP;;gkJu2a02a+HuIN~t3!bfVyeTp9O;f#Q(M1as?E|n z=V=tFu(mV(W*j<1+KB7LD|=-79LdAx=er~Km}s6MPc{BE^G0cUp3ttg9X*2N7;F78 zrIxHyvwaTTCx|ELn1_V->=jYGp$e>(dA^)fwGN4BOxBbw+9=hS(ds0f?L2E{yM~Ya z=h;D`a!*}7({quxbqI1tG%MmLGJ#G4U+8lHYe>N8p{sZxoZ+>}!gVYn*;M&2NZCpe zsnICbd-3dR2Si^w+Ytvxx+8mRt2&I@KvO$_EzdAE_1Ila+rf&-o+>|bM-aIiekY9G zPBdXUX2x*{@R;4#6;9X0-3UelBOMF72WxcXd8@if3X47ueII?k27(JrOHL;ybPP^- zM6V-?8fgx1axywXCb_A0ah`?xrLV~B#HualRQR*D)8!Zy@8TZAEdmeN>nPe!2)8aj zSeU(vQfe^IfF6>0#%@m5iV%NQJ4t;~$j1kyE<7kC ztrEN?lr0Y%yv_QOUqXEHvXs(oB}BtN`kOXPN@1SL-Ec^aHZ``xsvc4eXpN8c0s;vL zDVy4>;|Dc2jAyi@*@X*e&t6r^)u{3>Om6qGd^&Xbu!T$9zOY&(t!9d~^?AkdV3v2S z2*`e!2JJKWux$vcG-07qbrqia)1==~P zVH;}JDCC5i4)If7G9V?(!0ZgVt*PuMWW4jEz?0sYkHYS(^f1A1ZNE^3){@R{A|QV$ zJ;pg${#SHt3hg#ejIRJXnT-+&tpYNh<{tn$MZ+WIXV zxxJch9Kufn%?h9|0U2I;GmsIjJ_%%)&c6UMqSXdk`Jk3^7LciJ29QbjL!cKl_CJEy z%|YxK2>E~0SRv_6-YG!Oogh6r4=AcFT?k~#`w@^4fA-<>bMBVv}!$&5$-+-WQ4na z1&V0B`+#oMdLxM9hicd`ps#A!5kSK=Y%I`i8deK*sD_OPTC8Db099*PBhV5Jivk_4 zVF{q68g>cLs}p4Wt_Yy(1L!uOW=(e=P>Vv}1G-(I4xp?;KLcu2=r=&;>InS-$c)fA z2*!;H%2Xf|HXmq$?wKV(ZJPH^AT!Qi2Wrw%)&ecl*!4l|6F^fn_BkL^o+pbb%7#39 zS{MHt@KJc?>=I7-uNblrB&f$6&q0Zuuf!V3t`H?f;jS+#8qdl#qMCpqS?Wy5wQJXM zJ->%kBKT36sCYh+x689T25sFLt?J3#>Sia=-L>J&!lWyf&DhL-rYhxhuZ?8B8c-xc znu$A4HUt>BqVt_jXX8#HN;pO!*TBa&T7S4EN;(Ux)Do>-sgQP(8?mq_tF+bV zyV;e-M9>`60x6yQ0$PK<#%c!2IEeaWNmQTqBAhvtET>`3;Aa`Y)#b8%+I$ zrgdR2HBrKr2@1pwTj9{+w>+duNh^@f^VlKzLmk%o-iD4S1B?Fld-ky2sAJcvFRx4K z&o6cAGeFCAVcZU6mW>1SlE&T#WERE?Kr1xeYd{9Az5(QDm}q$!q$}P;O}Yz!Ol&aS zwr8H~Kj@AF6V{jVny(QFI26N9b%Y2_58tO;44xX>mmHDVY4=5;lQQ^-NXfk@eXb6D z)5Bpd3~Ka%R`E>u9Aap09NXRSm4w^2ofb;y=l#$o>+9Wx&$v_TBoq?6M4Fv!JmZ=4 z(Y`dB+eZVJ0Ie8%oi|DVsB!RnME~tUJwUJDY6x9=So|Uu?xg6dh~(op|yrDVmMZ zRQ0A^^}OBu2kE}r&Tz&{`Bv*n^60yxc3+z=Q_M~&PRCCuAmEDXy{f&jln1;0u@vtq z#!2Aq`zf|Ko;(B2w;$VNeXTqHifOC9ZQm^|^IDWSj~=9PRN@T{!6<}&+^>R_9Iqx! zToK+du2_Tk>^5~%dRJjkLtoR1v|PPjhEL4<3_4m|K6cAIUfS2J7Wmv4xR5LkS*@Mg zyk_4T-@DiSKs({z>%Ju|w$?x2WUcR#i;I5);PD8!q*_7YHYu`jgINjQ456LHO@6nB?YdlxCIZ3QJKoL_J-v7mb=cf)pkB1?U1Pq7`JNS4mL^}^CCR< z*?c5jeHET@pi3d>H}Pe8I1#ot@I!$$@Bp{Rq&tXk8TsAvW!OJD%34kSWkS=`_c;F| zq3`h9IBPkV3A$6UP!uSqkofO61cSKAI!3AK)7c^hTb&JLFxWLfhS*pFWbo1NfnHN= z^%o$6g^mUv8LakApxDQ6c3rrn23l9a|hVm?RRO5Ft1pzYveM13d9`g(t<>TbM@9IHOv7gN>N+-&yHgV+9UMu-0$v)-!uu0zbLrZM z)h0482{VK;&s-xO7V6zn#n_XlI;xndrm8IV{p-(Qb^v` zs5_y%AV)T*zm(mF-AOM^{vhU>w^x^ZH0Iu^1^P#;xSsR0P2Filk13XV2G4G;F6>PF_$^ghtvAyUpC3J~gl%hB{y4!@6tQH2U#(mQG_x3R3NWx8ka>kGWA5YH zOkLGBZI&LhcWa8QAf83@T~jb&mr+*Xm>9z*!&OXW3Mg9>+VC}`_ZyBovVh-g8V;-6 zH2ieG;kJ7SXrn#}+JIZ+F;)jQ9*+2uYl=MWP&zuGY#f1_vJr#iq_I+FKy*(>iHTWyp1?cp}}3p`M!{smiWx6@o+ z;Y0jbj^0FQX1jM6H-kq-IGuXBaIm2l8ms_a+FK~fn?G(Ed_dcn6CJ;1@+_#e^7|S( zN~Cet%75kq=B4dEptVSip1B=-Qu)#am!J{SNKtX#mOj!vmp5TLKFz0(iMu$Z+?Ls$ z0>RDXu#Gx@6md{Tz!Tk_{Dg(zSK;yL1+*IEO3EIF^syg|Uw+2n${xPKd9awWELLJWSAA`>4ZSAGVt(i`TFHd?A2>8o6?> z$(uXBx;qw`MeBHdX@`zAYk=dQl#spLz;S`R+E3zoNr=%@yUCYwuk)N#LK|DH5v?L4 zBgd%0!f%NMR16G#64BsGba)I-tHWh5(~A6qtD$)2bl&oir0-h8Q=Ue;w&aFXIE`aX ztN@c?-hf1|pl*7tR!fOK&rN7H%ons3lpYtqFEbvbtH+D)q(_dXg}%Q)KLrJ6&dtl6 zTVqOtPb%EHXp|oS#j&$6mgbfQh_kedL7|yh^q(RyUOdo`)9qZ0(F%4Mev)c^b`LWP z@d}OLbAz}<;`yu}XSi2OQ-MYoK2J523Ik1|(iivxS$bmPo~|!_rjmO@3#ZCQoj<6@ zawmQc+x18-LtDO4%yLma*&?J|_%Ew?vPW1*h7J_gg@J_L=+yOpC6GZ~b*$V|mHIma z$k2CFfebD8L!kFGM>|jnvMZ|7+u6O)A}v&c+6ZfICWwG1u~Y7))v0qX)q7>LY(c?q zpBK-^NpX&Sksy;#`$jTnmDrz{g~d3lvB{F7gR{0rUG#0>l4$S}thR1d(+u?P{Tr-u zvfQSH3`(7vx3t$w1N3X-4S=B&<&4Mzly*sdTO&QaPM8VL8owy!< ziwD!wpXO_hVL;%_p$+h4-Or+he;yi0=hc*2Ye2so+=8GF2d4g8ht5l;Vx3$y)Y(`= z6AXL*+yF`d{aVcmU^S|HQpI|66` zZf@DtPNc6k8+cR{z8}m8UtgAn^In|siRi@6V4Hr`xJ69c?odS5Fm`ZO%*4t)AkMl* zRhH?RHiqXC??(U?N?)GLeFhVXYgx`W)+BPVYP_9{X#Jd);Zp_y_$ z5f@A>KH}d>@_a@-yRj;}7}uG(A*2m?GbGQ;yRjNKCHSJAlh&Z)fGB=RHxAv`QL);- zMB({0e03=elY)uB&zzj?w*-|CF>Pd!Xh9UhLR=oc&~t)ND=N zop1*w8lOwoCY{-J>O1PKK%v5F71>DKnF{%LBbt`4C2}b%(LUq+85ewZ#-YP!IMKSH ziT0TnUNGm9n%OgEI1z9kZrh#nt8pq-XCdr8gG#uViJNi;;&QH0xN*Ld5AWnsvj5gYQ3)#n{saEx_BNwuW($dML>y7q8it>jD3`_}`Gi zXakrdLSe(;$_#>U+|aSYLg~-FxEAe^VOyMwYxCQGRm`E%Uv)*egWH$DJMSrV`4?L&2f{9^FQ}Qf0 zIh}J8{jWh#)O#j@Ysp%+lcgP=IH-SvGpml?PQr!?cSHnsSJymxS$`k%c<~idw#)i-p-f8y50Qxe}Z}l`oBg0#?&j!$d1Hm_-6H1-a zDB(bOZA(w{=qx_vseyoI9VX`+flE$gc7>59@YvvZdq&ityc-aRA09dk&sV8j*w^?7 zl=GF*GFUs6TY`So?+TwNJJ-8ojIbaAO>B3^bO88UC)Bj~V`|)V<5h`ke>N$Vn~0P7 zq@@)4FJ&9xa&Kl$!ktUVE9w7Cctw@5HpRJ#2wl6UYBlQUgk0b;k5-7Iegqx-qN?%2 z9g)WHs;0p~%hw@}^&aT#+&Kv7exiku?48r4XO!n}c@8PeQM~}j9M!@)Ht6Kb0d$a= zxmqZxdHRSej5ys@wtoTsN_E%ZkpF`3SxHyO84k154)5fU7Xa`=IBcK3c$S45i8<5wp6E3@1%O3CYWC^in`Y&Y z0YA!Pw|kK61C4H#Wv=gJcNyZ7_-~ct(faH=|DQ@aFUsJG-PF{|&rj4pAYuV%cUecTw#Y z`oVUl@yx*t$fPAzkco#kpA&AErex5L@2bhSQyN*T6WOP{(SJ>f&n}$@Kj%e2JG-<# zl%6RIN|>S#66AHjYJGr@l1_MX&t)2F?#zo(yPh+!7lkWR6RxU?KeFdDzy01fH`Rm^ zjX$&Qj58gm2}_}-HZD)zO5^fWF;rZhObtgvs?0IEe1=d|4CgJW+>AK~TWV3fVe%p( z6(zF!Sa2fbVMOOCz52A&FV4xVHsK7*rS=PcJ1DK99b9uwJI+nHGY-;IDK?o~!Wq86 zOb@iwF`%ofp;vGjda~R(LxqdVl9bFK4>K`=S2Kb0NX-150-1kKICBD%N3Z4D?vrgI zkdozo0yCQb9lyLTiu4F~e)}RfVvGURzKRMPwyBCi(!u@TtNRnVd$$v~!20v%1=jUP z3O-LbJ$$~xzmCARdV%%jFRtd-|C$4yUtnFg3;1~c-9Xao{>oFx`32T*{>9)w(|4WF%x@Hq+$7GWnJMJ}M#+A802tgQtQmf+G`^WOqw*9)SQ zMcl<_kY5hrl4&(^!S705ai>2j{|$+k@?^buvu&-+@?otXJb-E8D+?5^^w=EAh+J}P z*&bl36dm9gsbrG4h0Ulh(GZEcjR@{DBh3J8&it8dY=3r%EK2;)G7XgA(HmEno@^WA z!Bh0QwMIc_r>@x~=S6J7_0@^_&-$nix4xZ!`!?mF>B4{JKgNxEY z#E^dtgO0PP+B_B91Qa<=ZWYsk%u~Ulu4EqS?E|`+trSt6QR_s3&f(h-37-QJr#O+& zO+cnRjX6%jRuX2)`xTHW@6+sdF|Qy8zYo*$T7XP>lbN1c4Lc9Wgnb9-WDWaK5XMUO z>OG0W>qw1l05Ung33QgWYA2A<+dG}C?0ve-XGlH-=L*X~eh=d*oIz?j- zLiYF!B%T9#UWm~tz9I^qU;>YKuv_}mbsoE=Mn0eph6+i#q(~hEe8;4Fvmr)*LG^J* z)KQAWs3i9qc6jpdC0ZOh?0`y&a^F9RVviBiC7l)d!5{Eim z!r41W&N!u|Ephj9C5Auld%sz&1n`HcU)WA%oBp#5letfR5y;H)p{zYa$coUZ zsWulxpN9RaPs85g(*+@`Rj7tk?kW@#P(9BKEsV39N5b_#wkee8e>&l=67-1I*hz`T zXK##l#fCD2$=dDG+uw-w?~YLBMY}J8R$Z?lQ8>5yXV%$Z&>fs>|Ixg7XgK{);U`dS z4X@%*BL>;}!<2JnM+w{qUD^5hrO+>zm!=)}feBJ(7<-0#YFkmC-9 z@>E3%MY-ksq6cH@KZGo*qks;raxamu=s_x%OgWZWQewnYINXbn#nkw;m2Dv|aqTZA zv5Jn+J@a}p{95)_-U$A+JFB+n6)536*S8^@83UoE$t+?CNdLj>jNLb_c2F9d<(sNR ze6qXnFLK>1$?qP5HkMB^Px904%wNY43)b>)+Uavk&LEX&O!SajtxWH+J|Xy#sC#~0 z*>P`3|H|DumXWE~!K?)`yVVS4*|SLKuIjxKzr^Ay!5_TzEdq}jjm;yTy9u=qv_eY>3;Y-QNQzn&49K287VJ^IR zkcl=}qoKo0^~21VxcCv>5BCl;$?$*I5FB-$i;DlB+1zOUiRnhMhn_?Da^r!?FNe_|fOaCz$-YM+1%&Ubl73sa1OaD-G)!e2z$;KV&0%}PM zg%E(j#T>tEa~pHs?C*si)GG|rq5ATucC~!Z&7?g?GA*7XqjF?vZvFC_ps%<-d!ZSE zACfKU;*(fyzkfmjK)C08f^Z{5a)F9lAiXq|yO~+!omSsVmKTXg(FPZ|vlj|SCELZE zZn|+6i`>j93J#&n@0CISYQy#-=KI;jy`l8K!lwz*tPl)_ z!y!EU14*^&MO3Y)(n6Ge-X_&k^`y)ffKW*_7eqM-_-5DEHM}Bk{Nysd-LYNLfNrt2 zgurAopXSc~l{0%MQY0s}OXn%@;wAf=QzCWFzssCk*;^@11o2|LsfPvqP&olDvD=4e zf#RZ!Gh!2qg*3vOu^w+@qXN+3-XT_Opr}2a^b%$9Ve}Tt!dk!VE}SP4VL!#>hkk-w<4X}V zuv)Wx*-y^nck@%i8agC>UEIB|hf?}(mzzU4gE{{no% zYoa{*(6Udi%ep|l`fc&v8q$X`_M3)GrU_RPh@x8Clf+>Fa=3|UMIa;Uy!mNFKgR0v z-Njq2ax9lnz24KE-@a++FD_upAMO4236GT_^s)_TfIkTjRT$!kbhh$Cj zmW(Yn4W?C4Pt4hEJ99zZF^`|VhVl%jEP+0QoZsINOyIno$Ua?z766QjWOi>=`V-l` z)#;#IJp3()8Tq@enqL zD#h}1|7@;Fx>s?^{Vx3zzp&Dy-Hp^5jVdnMvH~HiUR7+3>X7HbA?55BJ(r*7uV?-_ z@yu-5Dm=-{$y3QLKlp8hMdUj|h|iC4pz+X~duPY}dS1-t(3@VRPWGnMB%Hf7*k5L+ z3|MCHAP4E4&+?bDw+oFzM>*Hx6q=Y<$%vc{UpYa}-+u?XSs~eyX@$Cgoi2Y9> zlS2#_Oevy2XD(Rl1L&;)ih}&kI8xf21S%o-0zqZ_Ji65Us6l+Fk>9R}uh}5JVLr;M zb-yNPwQs|q%wc2s&CG*ew}Hh+4wT>KT4EFD25O}HZ^;B9}pcO`RTDL!|vmnG?< zE;BmnPKOdhCtZDza%88RUTv!>AwxsN$kwB}f{}5jM4T}6)8MpFR)=Jc_zM=`Gf7-H z>@A=<0#ylgHIQ|<9f`VAs&P5{XEF}}nac4JWJZ*Z?RMrz~xpO(yorUvE2-JDkJz`@Gyd z_T@qqU&P`# zVE54q=NaD#2qHz#IT%V3GM1kHF@KXzr|F3<6Qh|V3vR6LVA(Kz<7Ay)3G@~%kA$uV zs`;2ei-DdVE|3Fsz4mFgU3RI19q+NBp`KzKrP49F*ICu+NgdoNO?t#WMG^GUYCV%$ zkmu+`-Ut=tquf%Ko9Xh&ewU9acA4J6WKVf|Wpo^08Q%HG8A23~JNp{v=#?Nep(03u zchW$3XXnKexkgt?@#ZL40J2<~d{1Xgt#bpsiNJ_72A#Z4+4$iCH6!Hk3pLrr`4t5J7luVRNew)rc!jW%v1`y(M;u9 zATyOGGyEn;1CYrv1<2$OGgOmf9+1f)<^yK(&4LD-nfr2gY=2FYT$jLf@`r^I@&v`9 z42HU>pzZYd)~U#&{dl;v+r!m9?ZrK)x@B=hN?5{k)T&z{tam8{{h$G9Ewu+$ zs|}?@8~lfyu@x4=_Bd$+%XXAeKS+4a0=pugp!R$fvCT_|guEgSi2YJ-#(od=c|{at zfU;fhYBz=)tek{%On!sp&2}@9U5I%1Ju1WF*QPBIOpjJT^P;d{ojfARy(TffKT-BZ z_Js-OX??md(YQZ-gxEWatry}!V^jf=IJGN!u8@rr;^71F@hmf6&9M{Y526FLwlzqD z+!0=1x}h{Y!@>Mf#2C#j=M(wi{zt+&Hvb;dC5@3DiP@G8O#XEsS#p=_@)FY5ys*6n z$l!dTulFjACG1-B27y>fysKe5g0K(+Zt@-rWb%qjbrW_~5GE|{uWN0>qcE|r1hK-= zc#AS4A&XU8!U``vYmAR-;kB8ij-JX{eOaR$j=n>-TsQn6`VKD@ht*RFLQ|C8E33h{ zE7-`%5&AZbffNKXswcv`H$>q)ppwRw?#Py1bI4ZI4ONX3tId%>d2Rc7F*AeZ>|4fg zZd$E^&1`WYLYi1dcdVxxRDm8!hdRiC>+5ZqC1b3IQ(K%ZoqrsheQi)~N@P#xP*Pga z4eIakTU5f93qd;r5t(R=h( zH`_SwA388a1NoFWESXayld4VSaw1o@-8NZnWeoa2N@b%mZ?%e@gEz!75;DqdYuFI^ z-|-7k1A+NJO849g#`LwAhJQi$8{5g4a{p5r-yQ4Vcc{DV=lmAj-LSb~o44z78t5MZ zU^^e9i-Qr9Mv#=aU^HL(Ra)>9e|N$AyrZJD;PglQanyGM&yAnV);wIy2|8@27?iG( z`4VLmUq@#`(mhl9Bx}p-33*V*Ne+8cb(~HW{hR{?6izYmqEE9~6q|@X>6)z~o*v(O zO^5s~oFp1IedQWAZy~F$;bjOZ#%SE&qbWCrHqf#f{*+EU6VZGDjv&3YdI{0NT1{%& zU@3TO^(+nb)~e8>#Vf0Svg8jVIFY+&jr3DqWi`l^#fQJB%ov&Z-9#0~%IrK$Kcz~T zr{9x|CCk%xa}wjMykew3oBm>5JYcb2o5;1TkpdhwVNB(o@K)@80-d&Ae#hMJ$@2Az z6@HH0E&<-btyW1_$o&huynsA>GwEu9Q8y=LXxfyUljS6oYWibF$^T905I;K6twyV| zH$gaZnQz%7$f-HY$ApSCK+M!uVQjD+R`P1d}(07dD2By>N}YVF&A8;%ft z=0O6ZjhXaR8T6VUQzCckslHJI`kocLK)--6x`jsnzqW1 ziO%l$v!m&hLA+e(CTp~MAZ(LQqdi+hP=>Bq948k}kB zj;*2XR32ON=#mAIW|Q6^F*0B@#THSGJ$Bq0b{s7gw!YptN#MElY1t%QkQXK7xW7TW zd@Yda@&iEk>pFS@=o<>@N>O!i)%(U+W7e3I`?a+sNI4vY3HWQyI=&LlF!v5c1HRsO zz&%OgS1IAP$Zpo_`~u|1GP}0$kS;fZt8Wn*b7!L5{fd}2jW3tkoZlGPZncU$EYZI) z)%bGejg<3(Ey~`b&vzo*p)1Es9Ax)zh&eOsUBQL>)!tc*zWI09An`ErAWDst{?}*vcX^jo#0-kI-@K3H1NqHg=PYMRiQ5edAQp;=AGHB z$(d?-Dt2^nqQ0bW(j?s{Z`>pxOb+%q1b{H95?H>3thT{q@TelI&80O(&E?*JGU`>zNVUJM zR$)GP+SwiXHa<+Ub3Y-(*GSqVHnjO4XxnG^nj_umgx~Kg&;@7tOFkltI*$oW!Bx@j zj?~JSh{oUWwL@QW*9fbpIg*d{&;(~GK; z^x?L1lGkjJ!NFbTggZ4weEw#iYUTI{lqU)1$?$l~zPzl^+z`PVTpnZo<#Fx{jL*x@tT08$b!}9-O)M!%_KE2EyjZ|f-|Th%PC*yd;4H%g=1S#nlbG`(*(Q>AQc3yg$q4ew zFZ;}wd8?lJQgh|HlKE0T)yw{T!TntMZ7og7AFi`^@fBQ@;(;Nf>M1j=(Jdnl*aRpSe5-npRXx4hs=lzs zs=k!>U%s(RLPy^v+Pv0i=V$t-<#GNruawcO7SlSbO}dz0%P&3Rx|?Nyzygax&0e~w+bn&HI=5d2>&vQc-c2rR^zBLWwZnW(HeYMxt9pfuiB-M2L;u|0 zD}P4+^F&E9`fKC#&mAN6&+YrswvfSco8=7^=k|F7=Sv2movOV-kcI;`F$ni7SUCtQ zBy{v$i}a5p7>J~E_yY$NRWfW&998{l*qmKbbrcef&R0j+?fq!qL{GTA1Jq~_>!F(h zl?+?@*6bo~5ovKprdoFj=SA>m3H4&N{y+kRK`xwf zQ5EQp?e$2R-4&$FqVud)kqcQ5$KH8R8Ei()08PWIJ+)Mr*KUQGNyzV%}f8DC=s|Qd>&K&9&-u88Z+2LczsIEM`g_Lk0 zW4Rf!aTe*uvANN$kgZ@l)8~080fTFBRdw?Y$`H5-c#W2K5OhF-OY8Y{VGX~gR~Imu zG8V}rMd1YB5kdDEH4Y-I0A;hy;X zo_KgGl#dLS4CK}yh%$w3k9!L>HJH-bdG(-33iqQUP&6cBYY zGwpUoGtQfyyK~;I@^Nd_Im?|I;RQ?hv#KL-z|#>B9BFg}+67V_fgT|1@M$Bl`b9@z z+7b4XR}kVW3D|OWWIMT5f2Kwc5YxCil9xrXC$f+09j8BY8NMn(X8s|HJnb^s=P@5i zK+N7}h$GPfxfOLXh@+2WZxv#;3`y8HLhjOWbawM^5V+nPno%jScaZ zjccS|IsX=m=7_G3-~x+?f4eWzk2`y#&N`vbb%EwP5h=#VZWzcSyT4a4zZ|IMG}sJe zn95SBIm}O|GyjjK6Aphw_se3SZ)?~JAd^=_g%4=h>p+I?y>Jk;u!hYAGUnoCk#zwPL%2dvVfb zFG*3UdhhTQcPAo1d{qUA(}YEahD&E*s)?6t@B0W45Vx#>@}4v)|m1Sma`@=berZpSjp){iGW^2s*s#;-=q;>(8qjQ5vKXlbCbDC z!vKqiB>FoGr>6{Q#R(amu&RmFsrj2zrZ*{+u{sN%PGFTA3%?}c;jO9hJ&Ep4AxKj= zM-rp%A*seUZ@VxtVO13?5C1)h_QU5i{L>>F^QOwiJc`7Z0Pf57 zU>TrnF!8tJtrs-_mz+9fDd%Bb6yhUs{`s&tf2tx$aZqD-En7n}_;bsI;*y{4wsvwh z0|^&-e4Dg@KTYP(O!H@+`6Gy$xMuTbwfVD#KM7x4caLOe6s62y6i@Ivft^EccD>I; z)V6x#Teu*V)0QP#x};(5JyJkCmy_cBhsdzC!|{vaG`s)jQMaDoZdI|!(gGO~EG`1V z$3345g&}P{Ze4W=nmm&l4~8cHC-p4!%~xi!h7LBLUmNxp$%n%ZYiKaoL5AvYUA-_d%@;BmL>UomDKiAh(^zF2ybucokI?( zk~_zRL>uKhYk(fs*tI|=$IpTO zMPvJc9@SW3E1A4CKt`r4x(TxWBcWG-zO6Za4`j&PeL#k!4Gjr}I<%A%fkKpt^8=t8 zG{av;-|Yk>^OeG8Bo-7Jt9U6Es&(fuKi8Qt?C1)exjO1T)wj7w2y zr{slijer`e5!R*V@15>G{*IcXaNB5{-rf4He8`WQXS+kikjA&6F-m4?!0##KC7nND zWs`YvAm0HGDzNv2-(;=NiXnzGRFvQyJ+n$M+8~3_DtQB%`vG!;Ljx6qLlVxC>gld& zV*(~c!ukA|n6m_i^-s0kqG)=Suk^!-QXzK0!Hr?R6;BlOoXxG$M+q~Fl+#{=y0Grr zTS7Tq7*I|Z6d4oVaH#4g?7*gy-C+v(8|0PI&pId-r82_(MnCJXaYxA$#}FXq@SpCq zzH4NvGeB~tC!&6emb(~i23lHTT8~!kE%qD`R|kS}WWY<3of9c|RH? z7&TOQ4<+AR(i%od2FNf})(4PWBo9{-cpSUNSni1KqgkV;0-5#wN!e4!$qE+TC9}Tg z1DTSA9buqlKxWOq31oJOTrNMNbrdg`C7frYew~=#5qBTo;4k+{!k6i8)o+>z-(aZv zknqgU2CnwF^BV+_nHQO1W5*!koe~C7peI5_N!Jvda%`6AtTDD@a~j|2RlYg>3EvV3 zc29+&1qS#=$Hq7GLg(I`Z&}d;xr9p1AbtVJ4B~9Vm0HVq__qf%5>RLnY=RpH*g1QF zlJ1lm9(3se71@2w_YhKLwf#nt2$SlU-EFlL(9E|X2i6EQzD-zv{OK@%R46dMZHM{V zZT^JFN0Mr-|DH7jLI+4;0UdC>w-35Gvqi0kILCWV)U!ZMy7x#91b;k2BC8Kq3z7^< zKnm0mfDHIV-2E7zq5c=#N&FKUz$>qu26z*tf`A5S*(5{5uAIB^o8&cT!1sU*&Ta=X zxcDicF2$n112Q=K&j1Ezi;kvAcPP+iO?Nbq!P&arjKj&A`1~z#_s$-()Hd_jis_^% z0|oZm@y5|8g{6mi%;e0UVOe*~-FPh3neE~i*e)m;t&%i-AML$ooow8eKB)x$XbC*3 z1RjJnnfDsp+uYmanJv{{N;s_d+4XY!!PHIGsGRL6EIl7}TV&Xy&J=j%p3q2Gd4Y;+ql~( zyfD~>V1Im7<$h6Yu;(M3pXDC#_{- zKnCKB)OZLjnf=aJy;N0_%8OTde%VK|ul60=HW6QyOh*CR7>k&h=@I%F7TxOaYB{>sHz#rp2odSnbm6HCOs$?=;LkNDh%1dfFt z^)KS7#;rHh2bb`ss^A8W_Cca^rwUM_;SRlm$MGg}r|jSMar_Dn!535|tMU+hLPE{% zL|~yfM6>0;ON1?oUrR_z;-@@wQx1jf{^~ z9osp@8r`a+;;w8TCX{x2FERux1|dG9#%YlO$}Yh#?vb`b5#kHtP5TjxGPSX|jlc)U zxl%`ATnTnTV|$RdP^{J$;Pzq+Fevk1v2DCE07^Cz6)eX39%wMUI~cr14Sim z=np`~Qthum=C$2-fsWO5hcGYW6dDC&tk*6AGG56p2b!R<@^+9prH|m;JyFAIflSzZ zpgIlvauDX@LJ&8oXj{DVwFn-UvX76JtrJ=zC_NV$9Umf}vOukGb8MJQK8c@nVvrlg z==jS%sd421QsXoJf}I{0p~9k%xHevf_l~~Vr;t-_q@yqr&9TBze}Hqb8n{i6#44f@ zM<-_Ypj&26U^QW$L`%)s$@MV)5gE@bfX-J)q;e*<4XDIW**ES)h3z_d_M^*rQ8%Bk z3{giZL2G9cB4}-QfYx>^S~C~-2BFdqfEx;@dxXc|P}9St%(x}(lO1-A=a&=|sbvvc zZYaUn?q&cm5d_8A%+QN6L-JBP8@XC0rLAviwcDbbx#LN*nKh}iPB-%{Z06Cnvm3gu zWFv#e>*e0SS#lCxGmBP^O0#Is1~QBGQXsQv_XC;brn6sWeKjA(aLQuA`6X=-g_FH=Vghdq_>9`}VL45Qf}OeZ3w7(A+XKp&j&K2 ze;tq+{X2oo=$kQz==aDJA-GX+=dLU5He1)dbE{89SSlx;=u>+b4V#hl$lz|lC-}ZF z?cs*OIuLTty>KRK!qT|Ui`()kBsxv;#dM$&!n5Sr25m_EAK#F8WkVVc+K^ImN=)gB zG>lv<4ei3qyN%Ch{>%wiB~RuRhQwNVnGgHEDtg7}!71R9xj}gip41&?bNlg{*#)^~>l*OezN z*V`P!nc-i{tnvTZEXjSE?*WhI!!1q+3&2`Gm1jnOR~xohpaFMtgp|&6&g|>dJ$q&j zioNSVzB9XHmkCwDYcCy6?CNChR6auB`-Mp-Qx#niTN>j+2dz5Yy;IBgT#L&Pp@egA z?^e~uHPq$V#h|B4Om0Jw7OWDw!k<81_~N=O&cSx#98A=Pr48oNY`2Tqf+!pJf?J-& z6)7<Tth_t%j?wCcJO)QtCnsI&iK`yiZe|JAmMr;EMr{x7K^Qy;pGNh+g8$-jNh_ zQ&;QJ!;7_6n@A6vKaG>5UTwqgVy)bMKStFl=MAzUcv=@W2bGM`V2%)2C&}8H1h;!k z;>A}MiM91J7w*|^KOy}}js26XzZKJ&qvVJ$Rr~EdD3i&UK^~?{_#Ll}T4Q%?jueK2 zu4?|(@UK4J9cz-XME1S@w3T$eRNWPuJP1(^jc1iytUb-mML}b`X>=|HJ}^=cF&mUl zy0hotz_4B9Q|%%FQCibY%}h3SC#@;QEv(<*GfF5kqeyT(o{@zrTQat+!9tOltYVd8 ztq}eT9*UBI|xC z*(3L;ouRmu+7J&f z+X=d)F*{@^cu&G>j9iUN9VXJ49e!hWmOD#4-)oGtWI}mMhTy798xo&?uW873(~xK4 z<6nqp-whhFk%sJ+hSV{B*-i7jOMpkxLtpyKNwlKf7P+WDNEdirz7qxiFk@7;B~$8_ z&NITkgG8`WMSBElS~g$>zA0R*<)p6|fSoUNS9P$Nluav+0gq{y^9ZNGnIpKC13t2j z!rOQ7D{e(QlWv6T;i@@AxXbm)9LRx+$`D8j-+527=-&Z!q;Iy?ui6B)>@JfoiBqTJ zvipw7Ofrpv0x{ebk4%P3F{v=w#06ABF>YL;#>63MugGV7Yss4qo_-wLNH}&E(~xP$ z2?`Oj*(m=ap^f}bXxKAB*l@a))UcC)E>K7u)?BF2Y#@`jz2&t`Gq)2H}TGQP71#) z!Qpq}<9p-X8w3+@)ne24#$e@tDgU}O8KWAA4T=q}-Wxo_8|sm(cVK%X?>yrG(F`c8 zFc|!W_Zh>s$6?=5i9G2e!`QIRZF$H{L;H@eM?_nyBR=8Bf=H5$zg#*k9%!D&8@m>d z5WS+0^TFj^jBeH}Mjnd5nhZQHaJ$-^evxhY|1N?oD4ulM-qM<;SPMpq<1I+1Hx)^{bf zF*h|FZS1{qdOSDsWtb2j#b3|FcrN;KmGhfDFHXxvj!Jay7_6pk#x^#QJK`98lbmV~ zUQ)*z;l`jO3vyfAomSW1Q&>r@{e=~4X{UL>Ok_9)(jDoult4(=p?ZrvSqxPn18)~9 zvRop=ZDp!x?O=bDL0Sy|fRMxVrLW%>hOhP=BOj}-urs@nC#w!GkHo-8Eqc60;aNz` z)slN^oackhB#?{qGx!Z)(hDKArGw=sOv zto7HOG|}#RI{b*>YTJrFV|V_3u$}#V^#Xg?v+1of+{v%U=U+hUH!qqjKHn%Yp50QF z%-P|xA?3Xhd6jee?xcHEs`0kNc7nw+e_U|hu!+M9E)SnY-J3^78{f2UpAT-Zvt3s_ zDnu5e>e0@O*Jl~QxO)`OVvb~O@WiT-8@lIJQRr5dq z3xrX~kD%y)fGK)|S807=XMy^R$XdjE#xCF^KqWL_`E@?dndM*SWg+QyfbJ2WbD3kE zUpnA7j5=P$TyVkacy{tp{kZtcZm5noZq4i#uK-Mw=%`sM?xmVXz*GH+#-4;VrN?w6 ze=d;?+hX$nW*z|)_uR$#>)#N^G^W+kc?Qq^HnN~QdMpQM(j9kfBKvNC`d9JryVk>> ztJ<@%nkz*5**zO&4%1U(&M)y7jxYQ4xMF!T8ZUcqT^fAXooYOg!41ovSmTShgYIU3 zH`&(LH^r*qVVs55(Q)XA-*5+^5j_^8tx9o93fCo|0(^=FB)RtPhH z;HWclR@+9R@()S;NhkZlYb9ax4-&{z)%d5l@KF{_C_O333EjDKaQxBdy|U>}z@@#%b$-cjMf%iQn;@ey~&9wsD@Vg_wGQfkk*O zz2F|dQ9iUYd|=@N=J&NuSVk+~p(WV^;p{I%aRhCMg4QN;PiWTM_hbabgZRm1`*Di( zaP;)y3!odbui%ON>FQ+T8&>Nxl(S$;H!-2mba&+GqB4+v)z^(-57ubDst1MkOCK_& zIeGes@PoRn%*SBKl?;5trAJNai=JLpZITX0X-8sTQ_L;P|0c#{nzV%1h&x+e4GAKi zG9r0852bEc(DGU+A}a-t1fBMt4zpIKlf!y=+psMQrZ^X!K0JRm-_AxREpwRJH4U$v zdjxZ4-Lr9z*yOcrl5JXcX|0@7$^45#=k?Tdl~LlNQUe_TGLC5OrDIj-bH zsj}8L)z*fMwt&`AB6fC*N(aY_3YWFsuEqQIVX%_>rc{M9fwsZxrUdyNl)*my7&sX^ z15v=*!NtUX%I+Anb!SD5q&`)fcBj|0zc=@36}gWo);+YW?g$SMmR4T862Wr6!;Fim zoLjZ+URWhAPR8_YDCxoL4Vz($D{bW8!hN1)aQlWl1U+52&`s@c*w(U7*19!y3+pwu z#m^fI6#)ZT{MDoXDo@&eLsGTu(wm6qkN~1Xmh<@7 zZvJtpj#b0jtYJh2UcKNaxc(E9KPEdLP5GDX&etG;UaMXZ8}@SgmowbUp52W~iXdL+vNP8}OkH&5 z+WrlN$GK;%QB(&Ok|FXg^kTekm|P{R2scDX5VzodV~f9zd8k&zKJ{kByarFMK4Bac z=_9rB($UwX*o4C)wM{jiExNytOKBCKHspxaasFp=@qmc29!a`aE{ei~mrK$VQg~8? z!ePb5Ud{^C061M-8@eoh(2th3zx zsZEOwqp>-F%D0fL=VLgF+4=hZu6YofyR7VFv*GnYY6F(%O}ciCNIx$YR^9wmaR&P`{WSr|Dax-GjOi{_KKGRC7_NtIZCAku~J{WKYPPy8nnu>{wW7y*nPZc>&KB!;?w5X&V#N0id zyns@O{20~AHuMG6R4#7K*wDJ!(*p5jEJfy<^FDQ*deFLbKJw`Tto5mx=reR8 zSl&7%7nvEbB87#{|Dny%s?80rC@XTJ&x&L^MF{fF5I7ac;x=b61&M5%vLagKMULv* zdOSSHs-6{aB>!hQk*k#xd58EQF#Jc+VlUxD%CN_U3&~~Rmyi`ZY|)RfTF+*6!sj_= zx^u*HQ@Wy~CJwgyJ8-B`hwl?^;=Fn`h7`803HyZ|_9LiIhwK+#bvC^4$2}Xud|0i0 zR26qGdUl5_BdhffeA?iH^P=#;?6%JI5>755b-roN-RX@-JZH78Ar%B~s<9{YMhc2a z+(j*uyLq9lf-II|yb_KTOd|Qy*L!)ZojO*? z!b1_E1;p(1hRDX$uz1hv1Y)=kIvAdgFrx5D)=C7|nQa){3|6?S$gib=?@w@=8l8Lg zytWhN&ViiWA;9V~h`W;LSV>MeY-#80nF%L4D-)js=Q^C!@3Dm$fP1VMQE)CcYEBYN@iO5_xP~G>NOq(MJZL(@r>RJ$@=-JvmI4P5agX2`t>| zyP$*-JYM$}GReeX@ikMELKza@xdSE4C2Lkm>GG@en{qFEhrH2NW#93{=0uFfprs3& zEZ^N5i>b;;RcV!?D}?+izWAXLllc9@Q0f>u8-Vyb-@Qz8UKz+wF5>rp`BGJQXfW5^0#Lr5j{l0JY^1Y99d>jV@^Td ziE*bZj>V9<%vMRMOn1*)w~N{c3P3+v3L_A=uV(SbvmZ*B(|&j=+PcS7*r!=jX5t8p zW^JTdlV~Z;nu-TMIC#0r!@OzBdNycNtei^|#dJ%0k|v@S>_d~6VghH)yCmU$F7BTG zDnwp-Y>61-@?K)JoX+T>A~5xHIDhgw9HhE5!h$DX@;3FE4NU3 z>5Wnf62soPS+T1xgmx3{%-6c~nbQkH`pHD~wBf!xoc>EGmUIWpo7#9o+dQJFw@vr+ z4&N&;p;FJL;nLsK+PHg@X?VVwKC^_1gXzGzG(_#7zXYTf=2rp5S*nrHe4r@?k_M}V z`TZ;)-9)bjPzww5L4!(C{Qb3o`fOh}K3|qiEg^0r^;oXlzj5AhT4$E{;3PB%>pIxX z3}gtb%4VLiFKI%;J&H@8R&Ix6Q&(;7bznPByY7yLz_xOtMv6O~C>9coG;fg(_neP{ z=!7+dyYv)`N%vZa-*;1o#tX@sxI1GM0-7Yt?|iegwn=#Dc*7s9d|p0vDaJEft<%#^FFjk?BrY#dWvP-P^r z&0JLyQyBBnh*&LVe)=?nfM4yKM}<;{`@ecXA|A&2e`Wm~armD4k9Ls^IcuIRMcJy*-TeN-K5wXGRV~+WSk->S8$1{W&Qxr^op>-)rmvVnvF(Z-j8|66ArG1V zp5m`$Gz#C39oEkig{LJ+HR+k^frUB_^xP0fuj}?Fo0zsM6s?Vzu)B#kQr-#pTfAREcs) zH@RudEQUm#mc$e83c=mJo~Z;#+cgf^ww#G$jQhx z=Y3u-z4iFN#>rqeY(mJ;Vcjy4h7|Xs6~YIXGg-H6XZ&fZw0yU(?9O4LKacd{GyD;NRlZ=jB!#GumD{MHR@LXP@M?t6WU)w)JvsohUoD zroz%-;rez;f4CFQp!WmE#h>ym60O|+G}m*Ph05%_KoR44n)<+1Qwtt@^92;vd(7&r$Pi%4?Hj3p)$ zvOysXdaX`>xp~y$g%V({=XXjNV`lL-gt4I&u`n~_+(Ter$ZwuKWu5gb@w(1vW8WN$^T$ybIuRt$M=0~rs!Ub%SK5c&#hmuM5R`|Vy z1Z@bm1sh2SriGhiv*t?tFyCitkAkw6Z{kqP&D>{R2s1t+oM`xP-l*blNa4gZ47y3P zZZVnEdL3i&(&&o*^~pI`s-tRH@eB9{b9t%xz&8X1nBUXQ?|upQI>9QQoUEbR%KcE# zzdMyUFq0r%;3AN@$Wl}~Gw#^c#b1&|R!hbAIaG9FCF481_t#B>?cU*2d3vv=96Xfs z0=F{L@$0p~tQjoVF)}puByhGW2;I<<-jZS3pt-LuRSMoB48eV3E&&%{` zAAF59>^c~l&-e_@p!#*J%APKRl|Cr1O!FBl_j940bcU?l_soyJvt(uOA-#kOVtO4D z5Qd0e&(t%2f)Qik?#z{Pc1|&8=Sk*l8EbmwoiB%(q=WqPb4YN0LM);5_3Yl~^fJ~F z=2AHrF~_>!2$aOHd?)`$LgGqFjc7kFzsE>g6iAI|uLe>h+Lyr9O55!ON*G@HV<4sN z#IxOcDIYovNWb)%s2V(pt_0(pr8Dq%>u~YvC*2m$_GZ zv|u`+kD_K5P@Od0%uU-)c76PyO6!-mW*NBc`x%7t45<=Q>6I7x2|r%vae~hkNH@YM|sQp|cS> z$1`UTofLVlNHo-?4v)L|5QdvIJE;#p&bz(W@ILr)cyWAYPpRgQXuAx<%i=}CBa2rg zJ^tcd5iZV?%@Oqb4WNpV7Xqx8Qc;XdS|5Pp@1@T*GCrwzXfdXV4*P43NeqTQY0G}jr< zoz;Y83Pas2nCPx{kD#quPjdRRvPS??#|u>pAVQ?HC1IZaO(?C}OHPMeqXfcpV)_wu>Me}xL@OB+g#rhL91Y?ZR zo$fhUAcIrYhOLiK%~Qnf^SVZF=LY_DjZ?j#CTmLdWis#;bMvCTbnI2n2yy1$)=0Pm zIn>ghD_voNo2&`$Sa2Uv0})xKHZR}M(ixIZf5|1a^D&UYbwC^msS#_}Z(QEurq=Ef zYI*Fm!jSz?HXtBHO(oLNe)Sts5-{=-5TR^oZ98e`M|1rn9^42cYd~V!Px=H~Y4~!X z2Om*F$jXT$0uV@5!fk-ENY5?(#k<^Za~FhIG_mmy)+!15Zt|*k_4Wx8fXxYKOB_ju zvopc1-}b*kk^bY@X!!58vnK(G>TEHW0M;jGznkcP?XG0Qi_oNhfHr-REuM52LkK{{ z2#!hO|1OD%n{NLMt>LQfLZwN$C@nPULZwL;Dottxn&~ak?p&?NqiWJCqM65Q%|=ZB zm@OI~e|xRcs(-Q@b}!D^7{3?B%9jdPhl|&lGd~F>bz@DkVYik2FHT+&K<|7l5c&Ay zZ{M`ORiux_kjMRr_=$Ih6F+&7<~W zH;H}A_g+i7saiy=-RbKS?(Bdoq-I10b!Nfq4uf7Z*9FLGzYvhUJVzCQyx9}NNbOq?&E@cS&}H%BM}hWOKOnYzSzYGU^a%kWyv` zGU^H)1Ee=L1XJscjrl;o;o!n4Cy+|1PGdbPwH5<9$KdQFP=#b~FG@k~2C>qkbDG>0 zmy?%ZwBl7_5gq6ub}zS3=0>9Jf9dBXu^F1#3>dnY&4B5iu78iYPg$inLCNcUUjKBT z*YD#;CE?-X^8yC{Y(BAm8lhGC&@rrW;@qzWkZAA}`z`@e?ECZJ?Qeh-4-1bo!>rGTft2ES3P`z*%|Oaw_<`6=>cgR!hi`qC^Ae+2~kz*WqtVkzat`fwr%w_X^pW;N5tFkcrP6w3!a=W=|V z-T`B+O8KOFmPiwijH6$VqhE)@j&m*UT+{p4lkN>wrT)T&myxEiL-dyjtCM9=Yy5hB z3cpfuwW2pIU>jp4xz`U@5%5kJk%@J^Ri!Y{dh99(uRfE-V+K5BK3wXI+#_N|0t4cm!lvtic|e8gc_lTBN>h z=^drfh)6*TJ@FUX+l&3P+eRhFB&w={{I=0_;$BTOonv@FHgfw_G@S?9?r>08`j5nY zUdlJ+pWQjR#ynx$=#v-k+%Q^Zm=o>|vkWy-AXmb@Eh7*01Nf*|+9Xh;Uoc0cik^PA ztb4xH*F8rc(VW{LOL{JtE0g+4pnkq%DYbm62Ks{edugC6CmTZtsr5`By`QufDRHzrskV~wB{U8m#O7;pgvSZ`F^hM zA~T2WK+gZ3B z&v!6mV9Ir=26KACi7Rb)y!mO4e>wZ%#QUE8+~Vc@r30ZYoSomb1_D4N$PAxHeS!yi^`<_`|%TlZB?*FtsnA z?p`CNK<}n6>}%emN+{~28Q4uE

n=YocTb;hO8#Q-gPGkG+|=dj1`5l*ftr(00swOIyL#+_Sr6%HTT817xWw)t-)7jm5V*DWzt?;%NUPqIh6)M{a#8`v7P+H z?k5x6-Gymb>klV=4dL?%{&dW7>K}UYc;Xd~bS-}H+I#0~&!H!&tSS~STvre3wDe%~ zzpM{!k=)(RJF6XM1=Pt&iy?0Yl>}hc_VO*=iv_)YtFb0ykoV4A3a8l>%`rvbr-;&3X#D=7^ zcoaTvpDg%B{sg{4Pr|WFKRT%+iqk0ToQ8WjeD~f>mzPDy2r0h}=q7LZZNkAR(<(T9 zI~YB$k@64Ye>wTvyf1u>&9x(ZG!?XjS+*n~2X?lOoCexFNZeG#k9nCRQQUr_>&PXb zA1PW0dP&3G1iD|{egfL0ZX%|=o4iZ(cGNm`Lvzt}YXkj<|0RJhv1T-@@7*9P!K z)a?zBtpGcH-~N>7&+02O8C&P}c|-}<#`|Bod@`RqsmDk{#2(qn%o@Vr$<3^2<{2(; zWG9{=A$}ATC2(e$M*(``nB3LPNzapT*#%|M;}>8#;5_-teXEULO_b$F5^~0EI<`k? za$L}P+haV$a!myRl$NU6qD~Z&nvX5V7;3CNYO)hcoH7(Vxj7&Maimb50Jv9?#-pqB zl2Cbl1qlncBbR^7(r_5P&}guQ*E-OvT2L0LX!gnTyZa=qOL28+$60)?1o3AB*pQfe zc9$Q4kIc3IFAF@EuI*glX!mb$Ldbtg8>{%2lM*{iTA`xGO4NHN5FHXH<9>EaBkEKP zpcBUrZ5}@aWNd#A9x*ACFPfff7__mi1k(JXgvtFHZYI1N&0X16IKFwjT$C4WsLpEx z&FwK{5^o0aBGY5cJG+AMX%I*HA<00-`SL*h_yNkgdKs~u89yL9emH6e3!KHmyM}V% zy5z22&Z2(woj2W0?{hN-k;k;Z!5cG~@g+`LCZGJL@83)gbL(7|>8H zKYf!MN;O1=&!@;$d$@4;-d*23{sh8^l3iClnq*tA_{?Nm zN&EsW+#d-gZIl;jPIfBm7*iTG@1Ua0R$l*VC_Lizgi9dGi}=(Nf+q>&drKofKK`&7 zO^u}(L@mq;JFCYZrsMDpNwleDq_ceD;o+t?hKGBiw?2L#PD8^zH{f~%uI1)>WK+uk zb3Cf)jWTt+u)OKb(s0jB#2FOsxw-Hqw>0_NNS7|Ou5N_7%bMYi$*Xz1v^DhGwLZ zf8ju}cGaZ>&Eti(MUirRk;!RIHh%^w{s7Ns_;0(S7Zu5!o_U-@V_g9hL+V))5aC-D zqp>7#AIQQrf-LScpi?!Rn2fa5>>wJ~e9!UG_dyo-e$YL->d6U%xrwaF(0Y)i_aeyB z>q|w|kBq;7A3Y81T#vKZ$=3}e*o0+7X63_3~O?giCo8>|A2 zSGUcea};d_S&RZ`q`HYc6?3y4g?l5lS_On*Zlq=t)1uia7e%vECq>Yw&7M6VyF!fd zGA4uvpE`4=>?gX#k1U*0%U#Oa%(+8inXe9wWiCL{=J_TLi3Cx6YAWLjUt_H5C6r{F zxT?zq!}Vv63`VltSF30aSG^K;#_g7U^^sroHyURjmt8r&QI6{m@A(3=ze&?81GU?^fcWE?Bu5TCGViCirEf#oCJU%5<-6 z-?=q>XnVN#d{kVlNU-^OU9?)*R1RM5C!XzG-vXViZTdFIdO^g+KT|51!uHh~H5(ct z?Db=KF~ue>)tisMnSsoc6?>CW+ zXxll9WV(u)QO}9lKF^rNV7a{c4?O(jU*Ti#Dm3Bhr*89hh}4_B)aT5M+TMVaH_5v! zTAfs*C(m@X-JHkCf zE)pT*c}g?mL1r7_LeM02o92hR$`3co50?R5pyBTD!~NI~_kbVn3DCtFZav86z=_a_lJzr3=Y?vC9Z>sbt8%T{TBN*T)V>cv!~dpArI)%sMU#LC`O$4}QY zi3^ZSjBZwjqgVubmd2B!hdH7McRHfDz>X+zWP`UQK7$IK!Q6orx!oFmY&C+%mT-1# zm`N_0*;B*&qnRlIo^z#W44MExv8p$i-r#7pU7VYC;MS>n+es?WT-#4JzxlkT>s8+K zI$c~zg!J8XO zQfeu-(Z~6F(Z^ViKB_v=M>fV8Bbt%t4;jgEfDYGBC6{b%zkNO8hW&}9~4o{zR9|lTraxy^udJoyF-UoH0;cYWq(r}wK->fBN2zVraC#CpIk`L>X zPngC06#D*~N8d4(skg#H$fIP?Tl`CIn_&4?n}E&8fAKEr|8yfn>7+J@tC2Vqk)J98 zm(HZvus0D)NO@EZS|UYekq(M-(tpDvl3TQt+EuqUm&Y>i@j&mhsABf(uz*M`#5OG< zSACPtbLxLdyqatRI^p4p+>H{SLAqUJitKT=o0v;1kcPR+bEAw+R&c<{_l0rP%}+)nJBT@Nqs~(gq%Af!5!JLljLlpb^|v^ zGL2Y!?RI|XROC0PTL2&~~TTuq~Sg|;r#SRK*AK{Ai@u}X~2hSqI zKz+d3M~D7Yd#&?Ch1cc7IH@{D-Kug;2A@@XKE==7qelY zNh)Bl#)dUbVG+C`V>jm`*_>zC(cMx!N*HJPITvL%p*!!c*}O?Or?YG9 zGQ&;;i<(nf)d#%%!ucNRx6JQ zN7}!*I?@6v;d8mqu70dN+_v9*eXme*&txaPLmN$rlyfn9uq=E$vg__hk6r0(v|?8{ zXzL0uLLcr8&x5+oQHAa{s9o58K45?6Ny$E zOMME*)npR=+?WD2ej2~XPF~YOy!S1n&g_13^qLeuQ0neO4CGpce3W=Y% z*Q9#5x0rOAUEk1#Asy+t{I5xelQh{H)Ac6h@m>KUeYY@)6ARzP+j}C;Cckv|;z*jR z8{99`=pu?WQ>4dvW#V>YZ~yVEays}QP497#m5OVMfj8A{B*2M%X}Zi>UW8mqQPIRe zoW(mXu7p-Zlk&uzyh!{f^%rrMye8ZlKgoMuFNFtZlJcVc?(JYQFjFaZt|e(qCJp8= zrsw%>l^eZl5{&qb@^W4J3Go&)=%)fq1iM?k^$kHmVZbp zpFLZ+zamaY&N^@{4`=Il(At$-5c0Oidxg)apM?+Ccv;DG;cBj>Ct0I1TcVjO?7cr} zgIFd%w*Ah{_1Yq4GpKPvx5|y^$2=k7X~Os+Qqu-L*k9bxBOF}Z2+7EOEzUv_fUuG- zfwgo}_Yx#8J9o~I{evzibu6`D*|g=;l~z&-C)G_nT(;gxp?Jh}eL*>|W+ohIDEE9o z+}y%AGE097C|&FAeoQF+oU9-w0Zf46I>Hx$ zUgUpCV2SVhJCMx@e+AhbBgL_Bt$w(^^qz$i`^}c#1t5zddlHNB9gyWKf_Iy@J6aps&CeJ`#H!?<9-XWxGO;WoU_bM0I~q4iMa@g z=Jtn$W5?Wh!zj1O(0(uU^07Uk5NhtBTLQBeznAb{E^8*ateMKVGL3{X)K631xilUXsZfo`4I(e_~B>O>JhKrc%qBQa42w(!EzvMCU3%S9{{8Q1(pGW_4B)hRw3XJx5BAh5x+rh3MTfD!+*(PPyPH) zLaSsB7Jrm86I_U?{a6yH+fWx;#fS*h)H7}|)^!PVxiS8IuYG3k)jrcQZ9|+$=H=17 z=3p5u>r$DXQtTPvfOucC(^*Myu2X$hw`wa1`0oW73$ggwKXUm3QB7b!1gUIt|@NptxZ_+8G3Y1h70@(y3H2rI3)qVoHLwz@a z?pO2%=*NnB1c{;OV9-w#9WHK!;L;1|XX++un&vhibgQ~82HEu32wI|UFZynIP)6PU z1G2a>T^eKfG02$3{g~p6G3)~}X7M!m3BMz0Pbh4;;>hl=ZmQ6|%&?DSFm&ym5K!LKQeBE()9SReYka zaZN$ckAq#11>7`WW8g_vx&<=Av6XB1P{PQ}4^ za4j}vF4r>G-G3*!d@!SV;qCkegEiS38>u08ds`dJ&mnUJ3f{V4;Z{L30#kL2*TL?qEG^tB>c8kAV- zs?Lm`mp>JP6Q^WTcbrik>+X7u%pc}@VXXk4b}!CR`Jf-Co5ks7ah$X)Lebo0Ddok% zaBedFhb_9J;T5B-2TslVh=)ppJX3g$I47=N(N42rEUs`k!lO_<24Wida+Z(9z|I=s z@N*=X%m|>qfJCf^LlY5Sy!#lRy z!qZ3mJ{)|0O#45v_9w-N?^oFfO@`Jp31#{&3xcnsRhH{C;tngHLd6bCW|Nz@PIW@# z*gZfM*}eV*XW*$F%O(ip2j1h2639JZ$h5fw!oMo@(GfysN76QC?m(_eU3rGMjRKk0 zWf)|3o6ZAWsJ>dl;+@^XcSf>ec;_bJOl}$LRXF**vOv5~Wn=Pt0|HKZrgVE|i98n; z&Hem-nlqYvY^nZyYiT(5m_+g3BsZ(3JmZvXD^K*f4T~3s;~yp4dd6AFH3QRbj=1%c z{{Da>I?I=6s+qPF^el47Ok0<85o}Q~Vn#s6=9#b+bEEE>7R!7XL500@ zZL?aNLLY>ZLZ>v7Ti>2i-}3m5WZMae?l`*jwzfc^CVP$+-E)Wq0W&>dE8fC&(jlF6 z2rnby?ng`KP6wGyyW2sJDbdN$v#yuTm36qBf*KJV53=iia$ssia1O}QyW4kj=OlkU zFq6YB>7tm_ew(Zgne}X{`ucY+Fm`cU9nNgE@6`F4(ZG3ZV2EmT%ay*i!=%_J`EGmB zU-BK}(v``4h~m&hDQrI8xdu_2YcJPH---uzNXjr9;-qerkIL3@b@NKwhY@6b3?;aV z4Wx%*faXL#IbeP2ZwPkkr8uYQ`;gt{}#a>wQw%Esqa*7LriVQ zP*oo|X;Hjb#?yg_CyoThf^3$biR|2l{L$uqF^0nbeg|Q5sIq2MzeAj~P%ciG5(?*T zAnum9gHh8X!|fOr#~}E}NzIZMf9EasaMV)m&TRnnIh%df<(9i`-sT_c2D21!%T zcs!Jwy}7z>PtQ5$@KPBH2Wx6m|ByXHD78Cr89BZ@KG*M#YG--t*|{MXgcg1xyXiUO zYU>9}@KqE)kXXiB>+|j_4D;zTRJVIr;wS>d55p_oKeV1h^+@|#nnNu1*5Nq+m`LVN zY?=`JGcVNsWyK++gf2G5aM>>D&|(L5@ILgKL@{us%tXkJcX$$fW;{ldlX^$oncvX0|DEj z#5seryh^)}-!p@CJOcf_NT#)_jTeVkc{Y9Q897@CXdZMhkS{s4T>sY&HxF53-3w(I zEsij^!&s5A@S}I5pb(ehd7Ct=Eo(8G_hWk@BaZUDCof6seF)X534M)A(Z`6_0REq* z6Sr)ps}zj^*-IH0g3SKO1E60!(izJ^qcz+UpbK=(hShK?_rOS&&n9$z1mkuuE>qC3{;CzXq}`(gM(l z+M1mRdf_{gl3#eg|IN-FYf3l8dmvF1QJ9r~ zEomWsW)6iR(MXZpg_yvrIddsn^F~Hzd$gi0mg{p;B-wO7Q=hx|$_ViXh!}?7Uuih_Go7htU!X zzRezBDHi$0vcqHjyI-oF{5Y5>soYZdw#Y1!En_OT=y>fY59?K*LuxadLYU>#)Y*9K zw^Y=j`0CTMrarpg{e+1gLV-F5dZ1IF2W7890WfN^Iq|UY*+VGnAsF39)*>mFl*-fH zOQ{6u_L5|Y(QQUEZoT&IcWGX4EUpzU*+#<%koEmlAnW^EL5%}tB(0{ax=?{<*2h2p z5Q2qlWjVn>^P0q9u1;mEOLuOL=I)RQBbvKs?tVO>)eEHn^aaPxDoymP+{mNz^&}n< zqhlOeaO@w;JR8kytlXk>pa2iUxK0pP-Zthi1!0;U53-H8P~WRG zD zp7jD@qAl;t+I`$@jbr1UL;cuXE&)WQ{|S@PCDG~6M1wDc(486(K^vwlCR$VoY*@Za zP-s7YNNEgblq}QrS_-*BAoGzGH9}}8k$cxNx9U-hG@Dz5^@WjAP74YHjkWS@pCN9{ zqGv~emX&-I&(W^ds!$5iI87- z;Tj>o)}~(Uxz|ix>rZDLgzUuRg z(p<}jcTs&B$eL2R=VDo(tqZ05>8V*Ynd=6GGZ&PFGv}g%cr2DfOEEn=oGXrWa64~0 z_&Z+oZ6%GtkxT-)P2p@yRuz;ARnVK)b-N1XzVS)!hbRf`Nd!WA$05|dMYyPJ z_v|D|n#3ByuyLU$H+Q2rPEAX+`{e^X-boC_*$S0hP!=%F*obuV_%h9N`-0w)>EpSR z%zl1+StPf(ZgMcNaKV5QQjFy8svFhQo`tR2;4J=+6f`rjEPo~Sc9}1V=AGFhViEnw zyM=hORTh#;+FTpH#vv3WwF=YQ=F<$Iw*! zDw31B5Fahp)e?kB`zO3cvctKrv2;UXmUmeEzdScO(X z=@dx%{T%uo@w5!3NM>?b{$y>3FVgoMlgmhS(uYyV{3%kmFGe#;wO=SG1ngxZ8u9t( zt&?18i%;<=t#BR{b6urgGkp)vk3A1wftTnWagLG?h_i5r{ykF(RZa^(zlYL?63isI zpVyo4sTTDi?X8DF6t=J&aK6ZAn`-P3Vr@m+jy zR}e}XUly&{A!j>Ocqj%whr=!jW6qDx;=(gkZevo6?;p#4ZKUk~w~5w!wJ5TWG+j8c zwqew5aUiGSQYJ#H)>T-HwYNsS_v<3x$Qy;!ZS+^$lPec)RFGI3 zCd&Oalb&DZ7Ok)O%?>Laf5PM*j?;Sq6*GF=WZoYCjVrY|(UiOi^ zux!2sAARH_k*u3@I_P9AeI8_Oa4gH0l{5+(3PWBJI1e;(u%JbtQ#FRzPO#GN zwZblZr-A15_F_>Um(RS6a=*uZKV-|<3R%ryeKxF=6|+HEA{e1i^2s4J9QbfB63I>( z&|1@LRxo~eI61nP=)flD^_mn&^obiFx$7A6ig?A$KYAQsG zA;RmbjW5N%UWWIvSG~BM9;?`VRipeCYC^545^2^twlmFsh0_jO(fl6VE4S?2DG98p z9_ug>tqJ$s9d3HNJl;cdDX=r#xiftHxn<#%t>^vy=RaOojwbPo&aG>S8eZA!Hv=!Z z;*7tw<21jI-F}s<3dc|&$^Q7W2ZZkqU)89EBkiWQ&k8rS9UI(?Yj8tk`YqaJZeUcA z=YI#SQf>=OVJ10H_grqLhZ!P$T6JyG=#Yh$vHLv=4t1a)-}CC$~>)bt6g;oo_F^Qq}RMU47+q})fuk`Y`szOh3hZU}coJ#ug+cF_LZ$x$W{Jyj3i6M69 zU`ix=%MeeC*ffpCCg=7E+%Q@suJbqZVqhbTHss?y@fLMzH_CeNp6A0hhch2%UWsPj z*1Cx9#NU+0UZVY5*I?=+F`QHT2Hx&_)=6)W&dPkOtj_~rS236Qj}F%abiqHGstKKC zUJD6L2h>M6fu4ADl%A)xQf}!RdE8z&0PjMiw|$hE6@v$sf*&)pJO1Up<9g<1i0jFH zGP|jQlNR-#%58bEaH!`d`LC8z_9+7~#L+gcH8n!XI-Hr04p?)oUc_ajY^EyQ2SjrC zII}^R-V86~MWOZu&P^{+ji+K1D?bIV>c@lV{%23*8;xF#j?(+~!eDoKq&z6uEz?HO z=HMzo@F@u$zuP-A$@Xg!_2Vha+%1YURze7d?e~0?>YKR2>TX_|mjy8tq+Rfm%mdA} zTP^1g<%iF5`9-I&tT4#*-#Lmh-px-!dnqlk_0gr;hh%Oq z2BKlbEjR z+Hy?@JrZPQ#c6S~s@zF^g2XI)3WOa;gm7soCm2O?vU9Ti{_b{!OR4cgu-F={`X?4| z&bKVjEGh3e?z=l z2;>BRusEqj$n=Yc%aq>-GqDq7ytx$W+vi4gT%dKa2>%S9iWQCU8%Aw8Nt9Q%!VeV==LB3P&k)yTyhlQ@Xq}UM^>Cf5s9+0lZQM_`MK*SyhylrZA*5_Kveb`ozxia zV8~>}ogNmY7O(qKchgFK>V(ENAR+h8pqi;xxKWRPaB3Sn#<8YGWIrKJvUhe)#ohEh zjx#B>d|pcV#S+lvWO~(}@K7*5swnkym_~}r=%z0BvbvNie-v)in9)ty51_Wfd?D4g zGB{Z1@~0!MMuV*Hg^_TrA9UtwU+ds%KUS{x1EsCZxn(GTi1;#`83XsVaGg+SC)JFH zaaeY$>|#VW`lEh=dLDh=h0@?2KKcJAh?E;NeBqj%* z)Rg7fM626k-|aroU)A>kkc^oUweI(_x;^c?{RL$0S5oRB;W@4MSAa~y{1WJ)gC&)} z`Mx_qk5cE7KsWB!Sf39DnI!rQ&^Rq=7*wO^Dp0MW`Jl5EJ>a7ipz-SV9LQSZZBSU< z`mlGg);JUtQMZ#pmWSwVnr{eX6gvTA6gvfE6gv-O6#FFT98F~%Xo8|=L6-6>pf%c7 ze*;JN&6798GB04XQJ)&* z1iM=_`}G0Eyhmu2y93=`v=Kz8zGFhRW;hc_dMjil7&bfIqBu2N&R6){&d<1P%?YzI z=|1Eb$yU!~295VLo!ipHp%MTE|M)z_RqEBFu3n~&(y`4orwK#DLf;$x*#X%I2SFVD zX#G4%$fjD%Bw++;zj&Cx-JSF@iI7=UMnqm2F8x-ry@#{tNxm9X1@FN&Cz;_(bEP1O zQTgBU>CUA2d%)S6(wUT}2a<>$0UqnM#PmHeFP4+KULtu)j@g`K7tY8#JWfguJffLZ zJGA6!IT)1+pApTbZ_`lh!rvDw-SMFzEX~KhLz8iBKH@?BA18Bv?W{igq~tH=`SA-QBe`GQFfO8f+ZX-ZEolx9)j4YqloJO+jc7pnzTz zSs|&Rr(+dTE~qdn+1{-~E!opN_FBTqEmsTrlQb=C3{vQ+!F<(V=VjqKA>&R<){K=U z-3z50>X*z|*}Z!>lWX%!l~qj3ujWKgN;fuJGje8ABhPbJf3n|yX=3zZFkIz~-K^EH zd0f6p7Au`(ouF^_0HyJSS%7olq|Pc{JI+{~Q#u({9tFE1{VP z$?QiAuWN_wb;jUbpQZZVv67@ZlvKk;2Jy)afxxczaouZ9mv|Fylbe+FlZ6kfd}1DIu(3vh&)y zC?ST-NLHjk{5!4VhXxaeMY+Q!@-I`Kp+M;c?9S>Y4khVM(+(SR-gUmIn#i z>Spo!{s zF=&#a`$6xjuSn^oA4>vq#Pg22y)M2moh1P|e4DH>T0vh?bRKQ6U47+5@H};!2YN@{ zlAyDWmbi;SmhuCje`?CV2IUn!>iez%jXhdoZ1UZtXV2G^PXY%UB4O4CHs#mUthC- zH?D5*GST{Oh3-fKWweL^TpcELV*-icY)?hV9nO{1p(cgC=#Fa#G8tMEc#8#sYj0%Q zJJQ2dWoqi$aw>b7cA*TdA80p(K&JD#*mt|fcWVUMm4s%{T^eHx$X)O6KRLeOF^Dy|!%eH{ACgql1ijG1Gae9CMY=?0L)=lTuoH3J*Jo37!Gb`t#;iD*D{GYsi!GlNLFF* z(x~gr4VUDe{!UuNzIo9W_o9vVz$qR$&ZUuX?mjtgvn4X~EE6tfu4~;Rh?>kBapTJImx5UiEwT1?01xrTXZk^x;^SYlhPkID7`=X(7;6M6Qe#M zsgTk>Tr3ZFRwC6b409_jRfu1~-+l@7v&`E97vd5YH@O)@fG^EC#!ZF`nQXU*SQZOo z!3{-O6vnuLxDIJE^s=Djk+_%hx{$Lv*wn(1l6<}!3B_HOV!Y z*n?BpfXxscGH^*kXPvktw;K7YRqmig%73j0pI3y(7vVFC@JU5@a1lPF2=^|+?MRNV zrCC4H$^Uzx9Xdf~L2c^xAjoe2Jq&tZ-PVADr^!fq2K2GIy$sr;=&zs>_1z7!@hDfn z4puigur5=?HGseYisW{P<$D?EOX~I=kmW0TgC6SkAZVbXM?e-sbi9vJw+*0bMRMEm zP(`~yU)6b_lwrAbpp@AGZBsN1)JwzFf~=%+6n+z3Qxb^#=vL4u4fkWv(TaWvI$n`1 znP)1JMPHAH}GD$6*agPM;@XtN|sB9%z?dzHQ{zwo}4{jk#H-;u7QfQ6H z!Hjsh4^v5Q#>aKe@L>tV0`BE$nX%n`&Xb&q4JJ)6{~N-(RSh?%H&X!lCpIWjn*g0E zPJLy4&|S4vPo8Sr$4)E1h|UgY_G-%RICn}>mm4wnjP#r{CY7CA$`qfi&q012UQ=f* z&U;nx=;BePz)$GCX4*WzOOmpwk#OEEnfwYm%T3k<@S3lzJyNAi)5>e8YDh1eVscDF zQqRRQXtYb+xa&PK(naw@;+RKH+f5Z`qB%9}5w-UoDWgl2UYe=-N@Si|&5}kEiDs43 zyu{@&ES;5L*(D9)?TWP3U3M^@gV5F#>FVSv?KiG&$X7NeUw(#(E^f3m33$iPlE$OZ zCr&HTfPvX#@9wog;!&@W-8Rktkf6|pJAX$V&Q<-^_SS>^1WS*@P%T7e{iDI;9t@|; zjF;bO6~NO}Cp8G&>ULx5bo@K#pdmOx+&86dA^c~CP&#PTAo<_Z7GE^5SM|JDc>e;C z@~=>my<5ZUto*6c57t=uUr10JfQ4b2_A$Ia+g{mvCWP42^-1)zTrFHSCzFHdxElp~ z=~~;Sm*NQ>P1A%QyGVXuBzm^QvC5H?8CKI`D;dkY#cdvc9+Z_%=0TSR;|K8}3II5Z z8KIkqsdK@vaM*j~%9;Z`SsY=RJXTEjgW`EGpTYBg=vE5dA~7=DbhG;AKO(Ob$G+~Y z{0`n;bE;OL+q81^inf8iYFz_?R9dZZ(4p>?03H2zkpKaUPN50tO)iBS_U=i_B*W3| zlw6~a-4ReU?((wZb?3kTAsQ+dBjHjw5A=x7TJ{brs^u&rRult8W!P;SRuw6YOql3{ zyEB{&b9b82vv!N^I(2yYi6qRj2bqBcprGZX1m&uxE~J4zt(etnV_#JTl5{!Z`ExMXqvh`39>VR=RlXMo3M8l?q8s{ z40MIM$;QiK$iTZ&-L3`AP_zJKCn+M|u-w*zzM;M{Yna?ZWFB*m7Iv%$>yCvh2hG%Q zr-Q5nV?malTq(43g0F+Vq0H5{KzCE_lE56$RaOGfHx-Fp@~agID|d||G2UgVJPZ1k zx_t!twjwc(@f}5ngRBInfM%&%4d}ayW`OJ@<$Ivn>Q)cBR?&kXlVJP~WTjsYxC844SBD8_4P*x{+~B7)K23-@J^wLul=`SL1+toVE2S^htq;iJ_5<1Y zI0|&V`W_Fm7!yEN^RIv|SKmu~-!9vvhnOBZwn@(yotWw4gYo^gGwR_g9Q)<<7hUGw z!Vzh@$g`Qzy#-JXUM6%pcu{prj_fwK*7TiKBKL78maYsD86h`+JA~X5-A$1DtV%3< zE*E1qVp~HZ$W2^NR4xnEk<25k47W+{+1}n6+6qTVh+aoa2%f5^%T` zQx-0BDwL6RD$f5*1g4CBt<1>B#KaKf0Rr;|foEc5sawk=kswebu_2i7Ru3;mi zl8aLRPzSfC&yBMkV;%?Jg709Myxn`f%Y4Uc^O^WUTEm9=(VQzA(s9q;HxprgI zUk+5zYZu$ZS7Uqt$|$N}VE+M5u_Q18bi2kK4XPo{l7KKgc3m_Dx>;kifYxbxc~Dkk z91QK=sYuuti#r-*OJfXVOXK;V#TxEwemF6|n$?uA2W{7sSAl-0;p7^JU3ZqF9lP!v z1KpxAz6QES!^J^X-+f5n@1~&Mr0!Ha7T`0A5g!_XhsUrKqHjm$=JFjz-_p~Hkm+-U zd;J1gY;FThViykm({ty-R?=IB2R}>g=QjJP)1SmFry?u27a8>-$*xt`T4~U0#Kbi$~$rj zH<#?fiJNuJ-181&7baK7Csvs2NGF^fu}k!sU-iwk$cwz$ua>&Xp3O4#QD9G{8*@aM zm*J&qjqMhu@M9}@Zc1ZlA963OBY9Jctv~Y_W^M|W4bLM;VdP(^S?ec|S0p%dmg;4- zuHoq~tfU!>HC}(xOA7axEXFmNpMRna^4NBMLYY<4Op%Nx?6#}z0a1pRBRV=`Nuyqa z4>`51oVxtfTe!w?@`ll=9b^?Y+fvcYBP}HA_C$>d3EQxeu*4 zs{4)BZMf-c$+&vg$=wx`izj-IB9kXo?^e8QQg`X8JP|w|gBv^Pzf%1uuljmt4sr_j zf0mWIKx)H$YIffyyW+fTQNlp1Mk}h6cdD_kN`0Z6M88d~UGap;eT~x8ZWY;bFPvM_ z4VMH83A^0YPV-NW@s^Yuj;m}hqTjPiG5=69Qi5kpK&rIAf4Hi79wHFGE25d5o?LUU zf=4rd&%E{pijFv5ip#s2aJ*2%-FzrDG%HV_FqeBsYLr_do}ToT9OYAQnJy$4ad+_T zMi5xJ#p4+fd5Qx?|H2LbzZE{sD5v4Kl8MJB>0~AHDWy-ilcipfJc6WD;wA?RSL~x` zE~jWEHulgZc7{=lM9eOc48K4lL-@>-M3bi01R)D=yfKa!7qpz7fYw>Ojql2B?lp+a zdoC43GEcjaU15;S$IA$c(8#mk=8k(!Hnv?O1<;@ve(Y17RS_&WCH=L^Eq49JR^LCQergrf@6>K%wx9q0|T>8ZVdV*A&;W>c3 z6Fq-ZBop3YP5Gv}-E4E0(CNvM{!(;WWvlLR{A)d^jOcpA{l}v9NF>9$Doig8S3N)P zwW5Lh=@TbC-*ub{&35G!T$+*VPQRgWny(!?73K2T)5G2w?VBY@92RO{UvtJ|!iq*R ze{sp(xn)bMT->th34wT4d9s?Ua%dEgrWUf$aHsJ1Z+*!t*kKE|%y$X1!$ENuO@pw^5iNead>&@@~xAOItF2r(UW_3#}=qN|$ z-Vo;FyVAF|eQ8cF<3pNM8{1PM_Zr*X=ee64y~6L#PYAm*I=o_;cbT1?)canq<^K(; zk?n#GIHL>|%W+;Pxka)AhjcL7y6X&Kf&c*;)&YLcN}t?=D#$eonCS{EaO;grg~9G! zo8n&JP3)C0g~wfYTU{$R(glSt7mcs=)j>iuDmN?92(2+!!E@H;CU3?(sG1wa@+t;m z#L5}|uR7@yNEuZ}?2V!^0BAbje}YO&QS^GG1^tK_Z{C-+GytWs0q zUS8ZB=A{3_7a^R~TLAG-$6=iEuka;QcCt@pLp#=5_wx9c+#%3~j%7TMn{8M-q^I!h zEjY`+bCUDMlm*Vo){MD`i-*D}37?=Kvva$I@J6DtHS(x7Y|XjZ=vgvii?l5?EOBrB z9f>G8^gB0OLnxo_-PCN+&rhIZT$fI4@iSzZ!Om(cat|0=S#QwPcGAZKqPa(eb(wJ+ zB8%aC^HXj=W%d)W9|=^vH!0rmzSpr6ZkFrJx=Zo4`Z88Y0#3SPBSXtdAt36NlStPa zs@{<4WTe^_0$E4**dwAPf)qFXB^z3k7o^ApSbwan> zld7euBH3HrmBdMX%*n4lRD0`tp!~6TyA2jhRHE>u+7 z#WzDoXy7D2W(pM5-{i+VP`o9aD-3E*ZzY8MLqW_%V%oX2(2qOp>InhWR&mLA8`0s0 zywQ>^P44Oze=WJIN8+y>@US0rZFAC_9C_GCzMI?ix&Vi()+d%TVx*bL%#$C`B3N2P z9nkjD>|$yzR_smM%Kj9x8RaL-T$#$YV|Zy$7=95K2m?3UTdh8BYsR$zAIoLJ3e3DWWIk8KIQkb;X%g{&Cp>mZ1~licS|Z>&&- zZ*;VAN4t9rX8v*NX@&R{31t4&FEo*Q7U(>VCE`9i(r_N-&o`IKWP~1+wdtr~=lw${H^pbAjdC2JoVi}N7QS6f zL$XiyX=wUZZ@VVMB;*>d+L{>ScRQnk7coV8@fx#rz1NC}HIu7a_zJ}PrMAV(@@ zJd|Z8je4JZ@xg6+4r5;|KHtM;`@iF-`OEnUdoAaO#biF~m~J>CR$5^ob@5SWx5W8J zC_&M>=SgLtaW_PK0d3tt_1io57p=!6gAz5fN24a0ZoK~O^tQPZarfkr?jVp6Gg8FJ z?zcQF*~dxiQ**8Wv`GC*11kTO4?}hxRnlCZ65i2gHa*hq#I@wRF}?1K;+V7!_Rb61 z*N0@z`YHF9=vY_OZG?BQ5MJpYf|(^Uvs7W0ywFF!qzn0C_Uf3-d@3ybR(fc--$R(g z>hb{gXEHY({OKMl=gu{70NTDa2h8R8&e&TFC*r1DH@vEtEj5-JM>%P67so$-D2t=N z&2pbi{Ryt0vod|3AYEEqgiEh#+poTqOk~}(olb;Tk7PXx@Z#0&jQf2R} zs>z^qXLSr?{XCte~Wg*2-V|;VSZE7iwNV^RD2m!4s1j1s9hURAF5h6kNe-o z1bb~|GLrnCDYEC}?)nQSb#cgFE-Q_#Li?KLbhe<;c|@2OTld}6`QPH@&gk9<5{p?r z(VEVMr=19+5EIQ*tAJPb{4SobbqiPU?h+GJn?c77;v3HdWEXdrO?8=ie+qU9vSU>7 z2$_?b&x939{;PY9Q@d)JbYF+)M64A@a_Kf^zesM$H26i=S~27;)SrGuS~NRc_r0=d z;*2eZu^&`;NcetraC^d677_wjgbyqt?*UUb_rTPae3{sDSO{o{f+IwCJj;ANBJ>|gTRm&sY8p(W;=uf*H?YphMgtFiaPu6*p zxUX5M%^9kP>T*>Zvg@SIU}HdO6Z4$zmk9q1ie%thdhb=ww`2o_>Z+?qrBZDZYvNuG zBY!6y!B(P9eslhsWIHqEZzn+`^p`Yej>(+c2N|;UKCF>>7QcfFVhw0vq}?{aDl6 z%oEO3DnwzzVu+H6*$BB3Wci9NtmV5Dbf2nYEC-F(5{S0zt%_Pew<(g%p6SOr@Vzrt zZDpE!DC-2Ks@zZScd% zPT@iI-43!;{_Fc5#`1Qj#t^+%Q;#_nv_##`0$n{=N-zy%DK8W^_5BIx7n<^eAWK=4 zNX+*G&|MntD0tu>DjEj5TaoCbTDVI=ztU8ufh?7T?<*3&nG?$x;WgYHxG2hdLx ztp@#6k!ZRtRn!8qd`17%%F+*HTBo9aYWa=<-LEkspa&F92U*-(K)=%(-43!;e&PEr z2R*1Unm`u!W#9K*&>uAJhaijFv(!uZP>|`ko(MAC)r&zt)AZt?pDRj(exc}g&WhS^cRis0LWrI?)$y~vN`9kAfu+feLR!_+06ALAFcM$KS00L+$z~$O*>jz zd?aYPqH&<9iY9=pKQ08>Y&HWF(3xu~$nt#zbcx20XU%Nxd=7M#y1fjVq3AClOYbd^ zQM+6|HHz&)s#f#UK-XxD5XfSj@B2;#8MRBBSlk7^?{7ih(YW#!s>OZQ_k9^;Wqu1} zv+aiXHPRa^AgcPZApAXCTY%_aJNg?VzhP?hcU6 zApJPtv04rTeP83A2D047fUJCB&@zpC9?0g1Mv%=-FN178-43$(v>o(&jnU&EM!cef zK#wXq4D?4ub3t|?coArSl&VVtw}U2pNzh#&tH+xl%dHh;x%Fb~T5iXHEVmOumfJ{> zyv1fq5V~Co2iu2C~-p z56H^5KODpg^*so*Qqd`(2hNZf8PHogjuwNgZuf%TRJUJ(EVs4dt8ur1?4HdBpeNMr z09t3E_Evw8#W(_Fy)_2(q=pNFzM<%1kg0!81KHi1IiMRfl?5P6Wf90ySqw6b{U7>h z8K|eW%g{r-`kn)_`d$FC`d$t)np_N8%cv>|tOr@Ch73T0d78K#5BiUyk)Z90t^&QM zC=Rj~N`gLAw=C#xos}O3*(~rnXqDD-2WYjTHjr$GN&=;a@-B~}!$DTQV?kEt(V*R$ zat-KiP5CPztNAxTHhS&{S^vHSvbcW%S$e$>LtR)~@?ema`EZc6T|l3emTfW)d*UnFw!8x+v8bQ|d9F&Jc{_IS`bje9=GYIG@Rk(TNzkmYtA z=;_f?qgy~WbKMU*Mcw`YTCZpw$X0{DfoyEO2eP(r2iXWX2yIjIJql#?I2Lrcmb41A zQ+qW8vJ#vFvNrvS@Agg5e>L1}-)%9->UI~%>h?6KyQcgS$l7@u$mscBpo7$R2dKZI zHjw38ikXrD>Q)9aw-Z6lqop-Y1zE5D3iKm&dla-m(I$|+9`uIqyTkV#d=xj=ST9Nf z!$3x-V|{cU=r-+zOF@?Jl^|=Y+dvyNkDq`xDf*S~`!47ib=w7cR?*OMco0RGfu2|N zP0$dnTLNV5ax3Ts^}P@DW%d0X$V%`8=ty;I1`SfQw`D!{(NovjrJ(ceML_nW*NA1O zS9tqsdw_r5u3Jq9vom*6{n;vsq&&HxG!WlEob9om@8f8O_Do2;k}XS@JwD70zPz_Zw*U%^48M^%;mw9X9jViAk)E^Wwfe$b$70y1arv z`Fj3f@LG-59v#WNSafC{%WQ}RH%6*9%>F1=wIk+?-BIWlN$x41ePB4bYfxx)IZ>m| zxc8#jxtNP{B2|Bm^Jwh*t_T9zLzp^;Gd-f2Ib}QzFc9Hhyl*s!@~i)ro!aG^Q_ACO zmFUlT`*D4DLT&O~X3rRXS`B2R7dA4xxLXaV$7K{Q1KB3kkVb;c0@8fnE#tfW4rCUPmV?X!QWMDRnAlM99xh)&%htK~+>~k?aKJ`_ zydh3^1U75V(yQxrD(@Wo|C6U1J3j$^Q3=`Selw(wEa_O@eJ_ho{1;CfpxA}G zLFBKwsmr2fBt(yFI&{D^S9xXty0kd%X?h%M&fZBn>LJ(jwm>--B$C(jI06skpwK5q zutJ$8#OazB1`si5KQ@w!4hcq*pY-Hiv)T6-PL>M?P9lKwN^&Yfwo0jx&RWo)}mUo^jI8TM|3Q0v*O83Pn%LX zNjuTIaB|%$Nj{LM@Oq-$dcqz4oqI#goN)0g7eR z)KMDai?pWKh+3adYrn^X(9wa#Rh<2@5t7D$gq%e?sjcWlvqPZh)BD^U4!$_1{f*j` z-vDVbW2AlIr2Ys*l5YJ$D?u68;iQ%SX=BRzJ1yoH^BMkhs&V>NawtyscAD2s_ao+*&T z81&o?GV*iMM@wQG_*0yUJa^}&@(8d?k-mddmm-NYHh-f9mFcXmegkdQt(Xe0z}Kh3 z3pJ=WIz4Uhkh;3WCl&XI?@Qu=WczTJG;cV_^|68ClaEUk!NjS4PXE-2#mkA~A)ykX z`RDM^THN{+PWjb*Drwmb8>qP`k#Ltp2FSN0B8$EyB99K_{~zMs1U#zpdiNYp$0`ESc+q$9b<3Izmu3_T;FOTSNy zY?=;!(cg-<9=5!%?$7;3LO*4mdi6wV^Lv<|5;S>2FdWDE!;#-Ri24j8#leZ^$OlWj zX;qn*KgyQI+(}jHcwSEEUaFx$5$vusLbHhWv2_(({m9=lmv*jGlHvxSixkQNeNL(P zUjePxuzvuF?RaTqfBst7$v}V5Sc$PxvOreKNQS_mgMlo^Wk4ru$tfT!?=7GsHS9y6 zKWcg9>@+KRI*^qz8^}t@gt2!5?V{Y$TR@igYmA2R%3nfWKTb<-13FfrTY;?JZvj~j z@kC*@osTSiqNckP$kMd~HEP((Fl=`y9pl1}1gh288X(K@C7=^DY!T3@3W-$RV%GpY zgeDSE$!9EYO)NkKrS!ElY;bML^GM*tJ0Bad!cb@s>6U?%$V} z^y`OR>`MdUlt;I@Wn7+lqMh6W2s1Sko^zi^%+rZo-;mt0OV^CF-#K5~Q33-Z16qG(Sa~lnIktYv}0&4XA zP0{D-CRY=&z|S@4tWCU*U~5^YbD$ts~{f4wMm_(xR7xl0&Bt?P(*&(l+~BaU3lo^VQX?PExs7`r)ebx?1v z4!X71$&!!6&4JVNT(nhOgobt!>QP}TA&gI=WHVlQUuIpt6#eRngrP!D-$5VqcVQ}4 zLGk{ZW@*70hzlScbUlTnL(yXL7Ilzbo83@Y2;xDqP2IhD_3(1@>tbD#D@i9Tn~ZZJ zJ8v#_5Nip6Wf>zOz7>ElExMF4I=B&gwkKegu)-TBgT=qNcm(mR2=A9t1U3rT7f8I0 zg?K{r+N7+l&E_&A;eR_`v(MZ3Q-t#n>mYCBY6Y^?$27PX>)lLkPI!qHC%IaDW7})d zrE(>nMo67O2gJ6aSI;yx-D*3Pq0V1rR#^Lx5wm+~_Rjib!&1~CVO!4lqzVHgjnv=d#6I*8yHq|XBdizL0vtLpsQ zNIN_|Axk?zg_=2J2Vjq5TN`ouUYV4Kf3P0&?hLCCgtD2<9BWSE`aLs&A?t~x7RH)y zs*0rN^f@y198~D`2XhSMACvyi16doP3oK_pLC(agZ( zjV!z3%cH#~0b~}`DbAYTvvJMbSXC2A)k?`wm225gvaK{O;U(AF9WKS)jJ2Y~P5u}} z+r;|94l3QTkIUeSos-<82)Yz)J(#aTw=nppd_AOuaJNJ1?*!#O;EyyTc!(=pgXhA= z%M|+->8ZH??RakQOKy-1!&RViSTR9qnL+OOs*bxoK89y7TpVc+jkbyW%k`A)ZGEa0!G~NkPJRUkp zX)`UcdW}rj9i5qf4RV)CnqU@rV&yT~snPtL%C5ucR-!Q-1`-A zRIjgIlPjey;0wEACEdiSkRT_1mf6p(_S39CjW}ItoW=hp{@3w;9RDl%U(SCrHE!Ym zCjPGt_A%w#R&iGz0@yQwKYK*m?%~JXa0o6(BNIk(5T}MuSVRzBXZaiMVPWQ;W~4Bl zmDN4bZ8&zm+l#tk!Z9(+Js^obW%YC|QlgUbt2?}<0>grt$8fiE$zJYiEcApH?Zt+% zviIRAN#WDQEj{O#N?(>xRBt>ISiQA>fhg8i{ua(kIZp$V)J*rV=;B8y z%J+igb_6JLc4-T*7*W^9>+78r>Cx6avJI_W7T3*EM`2$5F}A_Y{X!%6<1d$;f-<=mXd#%_ zD&XsZeA+vhmkkI;t&ci2*HWoJ2ElH$l$Hk8DUzGZ^f5=?1G3bSeHNPaXHAtK?Pv8} z=R4Wt+DByaG*+o1WeyUM!MyFBZ+@OquT+loWgz2R7ls7UPBhehp-nFJg81R}K3U(BBlA!R&rTTP0$;26|8$c?`%LUi}fsbmJnx zyjs)A%jwo%v4eb8bBMV4B`r_nz_)5T@!@Id#BOn&raKGBa(oNOax4#HSA?;H1Z0N$%5V& zNOKG&#!A@-=o}3@6ljh@bAe_lG!MwiTMT5aS_WjTx({fkrh5$NGKHQ7nyt|9fi73* zk3d$+MxbwL*gt`+1s?-l3SuaY3}U8!rLiM{EcQeo>qi}srJD@&c};f~kSRDX1iD?r zRGJezyIB3tL%h6%@WfM$ek8^7BPbZnA?P9chR+M)LN0q2x_o{5>3#EZ&z;4drg<wAH#iT67H+&m_+S}XH!im{dqDz{SH*VJoS=H zxFeoj)iC^slAaE?eoTIX<=8uVKt$8e-XZ<0ApHPK-^3Gd!;h%?@Z*jp{Hiid9=Z+% z_2=?Yq?kHK2l%FMQ%BdNPCNSm(4QKPS+%Mx*XBF3LWdaoiG=6&2z>;sZXnr zh%j}9rbdj25b;3ZR^8|)0KK8mX+U{}g2wqRp&<|u(hxgjwfgqsNp7;zkw7bTZHjW; z)^$)sH3lnv;2l=4+>rPKdf=|c56N%GsjRm;tX8b6B9dF7Ai-F>h|x;$UOmU{hlFrL zD@d!q;?+_m5qWv=T7v>PYOvU=sH|OO$JIdpREYjZ-qb;u2K1;T(p-X@sS7?3+ zY43Wg`&H=StNRn~bNF%OAuYtG3GX79r|Tdm0k0W>mSmHA3#Bz;WGTP%9bdn?n2WmZ?lT>Z-L z8_V2OIX!(i#GFv0T@fMgoUSfuiK9N(r7yiG@<90?8@eiWV5lAGg81JHB(p45Orhr| zb8qJ%_-!6n%JdAvk5Ji)v`|(-GLvxTE1_Vun*ni_O)gW?DiBk^fJpm760UI>lN$3g zbq%bc)j4qmPzzuLz!!i_)o~q=9k6XcHF^lW2W05JgklYOR{$B}KNZN3avaDGmnI-X z&ldq1Qoa&sl`i}RKt&5*mxEepwY*tLR6)GXH8(E6J`a^Cl%p&NxqDUjSr&sZ+@^mN zy?4xZI=t8J6ePS&xF}$4o}+)hf1*!dZGu_o&Ds=v0;eQ9fVKC-QKR=?=V@=hIV$Y^ccuO%}D7tRWg8R_z3~ttv{8%sf zVP<<>Y7icC(no8)eE0;Nk6PLfXYe`Y=E*YR-1HGp{)<*kAPb?iFLDlHa3vO#+!hWG zD}>R!Ztg9paI*D#%B|wXf0q(*x*%Pd8+TV5QRS{kmUK9^E3W>xQ~SOXo%nwKLccEP z3azaDJTm6yv9xJ-(93`$jW%{P5ZrGT5ivWNp319tK_PPBla*3`v>q!?e1txis(^yy z?DV%49YH-d*l`!I@urT7j)4_I9x<}C!g=K4Bj;Ut*_Tr%K}J^WBDvjZWvd!0Mn$}v zklJ2LFE0>#&{LGu`?J`C?rNo~dTlWDO1Ttf>VbQeic%+GsY4Ny>@fcce>|R%@pzH( zcrm}bllegVu>HVCD=CLQAXwkksa+|3c(Krd#o8m9cR_hPJNgue$<%I%5_A@4Ef0Lo zN+9LD($U#D-Uj$^Yqkjd+Y_4wsdP_I=_kiA3=sqB$86E>#ubW3G zX4?Q8f&QdnuK>NSIo<%;qR;>~%D)tv4D>fmcUri4VjWoRzza}p(J1xA`Ev7ylxSd!X z$MwX_94(FraWq+R*I8$u6Vigw2V+;9H1Ue4dMQE;K7Qg{Jn+#DA}&8^;^omcA$Glq z^Nx+pyBB9NxADd1cM{%2R+zkDgqb7LtSeb`V)Hb?v?i>Co5H~JEN}*aGs3`01me&F zZ-_FF-d^k^xnSHT?zC3KpfE;hQcEKGmQiHjP0^w2qHQA3kAo)S-gH4GpPcWn^xV(4 z9*}&fm8Z+j{p5TZv4srN*)&Q7%jy!w8HC z0vrNn5ilzVIFSG}3+Idr0uCjhjsPPpD1$ekrqvKoqbbbhAw9sX9mJ~OEZVtFr9xi} zp@ktNbb#%NS3+nXM$*Dg4$Ozam)Itfl6TT20%k8Vq@^#o(v&Ajpiw3qdSp%)w)s|$wC28l2qQ_a$ za*0+l)bSa%vr-!9wT!V0Vz6p{9N-#zd=Ucs|wL?=y8#{$Ll%;hDOQuQjM?8eUBxe-(TVal#6NIv4;uWA0cj8if3D|?T9jZZl%o)K}yRd0z<$V6Lmjhb6 zaK_Hc5tZ0yY!8?)DtM%IFIw$)iSt_Mo!=3nPd-TWh@xmErJ}8ZoQYTT)heW9kllCH zd9%eUnrhw3n1t~JQU2u?U#ZpSi{l9*K4I}=G=5WYJVC@CVevH@|EJ=3f`}hs@v}5u zc!jWjf{1^UAlg4pze?LLFE=gppQ7{&5?+L9DN=s}2+T<b_OGqd0>}7)+Nrj~EwIK9)Sk4RV1cvzKy7|o%mT;xfpzpL zwNKa|KJmD%$k}YZXj7deU0#yUr}?$JPd@~*b6pq+3lkc{!Ui#%7IqAfg*iZfA0_x% zbO{D64xyifP*(`O9zsJ{q?Y5b5E46M3)>4kU{HX^mD1hH!sE}j}2Yh;MUF4K;HJ;^l=a%XrYvV4`M@kwzzJde;cY8o3ztn z_zHT-Pp$q$+YTg9#(0F|B1mPO>?#4i^@aJ>ep2%3)rI{eMZ%jPKeyueCv3 zxlN^1ehlWb=LHG=Cc#km`ohhGl4dY-rj;PxS*-1LyRLcI@xYhT25$0*w5o@9m;&P6 zOw;na$C^)yz!G>3Ys;LT6_WJK1Rm#-_?&+u`r!U}C;MyMeRc;*Ir`uS-1Qk9#j5qB zi6@PYrk{-Wtl(qcc+bk#jpJIw&wKpt+s6 zunajC(IxCO@si@ia!f`(IlW3Yf(G_exQL62m$2Uc@>=ZalW6NwDp>GEb+&lxl&;c$ z@fnHttm1)_c^WJ!zHgm``vGPY>5YB~ z-Xf_n|6TvnM@LXM&V>^^v(B&?xjI zibaAB)$|sJu4;s*9Y8wAy$P(*h@j(r-J=Dk+wMB2WW7_{2{YTWeHkS`DSzNp9%tW{=ROxg^sb;Lq!wLL(=T|lEVXOAq>v$ody6VaZWGHHQ{6&;0H}b`$G4x6Wr;5Vd zV^c>}>GvFWN?HCgC`i90eiamN!_9qxMpnKIXkk2s>st`6Y3Nv~G4x6GF&uw-qh`+! zM6Doo=Lhq?7v;n~SGtgJkNb138VX=6SxtF;Hjv@0tAOmdydB6E>_Bjl#afbqbpC!t0`m;2Dpn^P^*{N~^|WXd2l0 zi7P+JwUXX2cY$^ayekX2LXva6_-Rm@*$^Y0OFx<)wL?&}Eu$-QJI~AnYCJ*7rQ+1L zt>aM{`)I=k|FMq;)-puuY?$TQ9?ZSnjHTuIQHhdQW2+jV+L9pBvHys+zNK^bF|*VF1V|!sC z4Ax54Bx<|C>X3@%5$qhxMJm}TRQDv6S;P=xT<}8IdJ+ye|77?n#Fuu z$HO+BtKF<@zaU!+*>t2s=tUD?9mRfe**+ChY;K~9DW?5bp)VAPl z-5MjYtbh6NG>6}=KmfaAqjK+Jpmipr^z(y+fSe1IR#H+VuRo7U*fO98IEYIl_X3@* zu|kZWqtJ6egF`8+A>M6-8N|MfoU7>$Vc{7KcoL8y?P+0{SW{UJv66a6%M;{oCBF;g z9xN>w$fo(OwrbZ9xyONirLCU^)Ig1;5xL1|Tu~b6HyV2*koEF5pg(J??hT<%AUlu> zc2#-8%uCM24D0VT$IC!=APr@G+cC5kkhQ)6$Z~u+47)Cb7KhMJfKn=&5ueePBRr(s z)q$^xvtqut2_wUvV7Uu76>XI<yp(Hh&89J?(wqQ3dYQ+kF)+sX)= zDoTP(=RSQhh){tY5zln(lN^gPh_|De4N{dmlm9n$%X15_ao4*_s5JMv`sjlrPFXUd z0v&`ry0B7^5a!c8U1Ut%NNnjTn0cn&%5?9N!lC$A2B2VzfC-HGjB2sUsz7f)`~&G>S$+9cX`1%XfOOLOyVeD_?MNNIu6Jd$1I@NH0+Wv>>!5GrhhWfePy!P z&IPjR52w&SAicV#kk06b{czmB2S=&bd>3_mQsN@B6ty!d_m6B}yQ30$1WvW9h1c%% zBO%y)`Ad-6h&D`Af&jag(>1A*`bFa=Rw@;M)}!M?Xi^BB6GA&>7*H{wYiMxeh|dQ& z-V}R2)5+c@C?t_}$1!Ay>}^8mB(mSC;mgT>>wemX__L0$dxwb{gtzTcK{Y;`^ms7l zAg_cwqmQyBp)FoRDn+tb^T}0_XzR;>NkQoT{Gv!Jcwu>pNL=sAU8)m`4pgu{?oWN{ z*KvJO-8V^`@J`?@kUbk)*QfW){XtsjUR&meL|a!75YJ93f%f1`D-|#FYx2AItWa%Y z1HMAw6UdsnrZM|@ULE;BUmaP)t0ODW??5GXHMYK=zL4TNCTB~V`TYaG6Jssif-0|@ z)Uc$av29IE9BD+-%QNqn-gr;GI`r?sD<(&!4D6}Q7&z@7FE%Vooy)~4&gcLfwtU;3W(3XUuq)7-!hEC?s?vs{`E}Phl3&YfiWcJ*W zMC~(4_s{8s@Ze1e7%J!+y$*_9Ar>s*o3tX)i#;yVJ)UaXysB|XBrbwPC;@qXyKz%+;gH|% z$QW4w2>hl5?vPo=n{=ERWwCL}-A8ea-sCZ{Y~4rVKf*U^QTd${n(4!sZiX-Ej%Ozi zO4M$NE}ls?$4hR}14@kT(6P_CHBcy{U{BP(11SMkLrlO&75W}+i*S(Cdksg-!>>!LAo_cGlw+0r@&e44 zDSO-6d-106D_WVG%%8wlQg^{u(iX>S+=Or_wI4W`&F60vIh0EWNv|6>CEWCuM0Vkz zRSh+z^aJ!o<7Arvu2R<$Vt;qJMwJ8rnq~+akAXqwnr_UB!Lc>zsDRnV+$}JQ)9VxPYRu-G#Be76%N;O}3zR*w-;7Zwk>3 zO5n`s%|81bJ(!Lbb5niy*MHjI!)4bM`a6ONk=Zy>`nyNX#IA;#ve=ntol!h9BWz}5 zKc&9FZT$*wiEuaDIwLHf)YydAtmLP!ODNu>=gWPP;tW)tI-tR87EcHLZR*3xzzNiF z#1)gh#1V6Ott&l94$#rD&K#yTDqt+afYG-1-}f_IPFgHn`bqKvNlpV%REp59-xLq{ zDaPzH#qEBISvyT}6)Ebsf{wW3F9f>O$VGFw)mSsvGW)G}0(qvA4y{^8YQLQ(+mmFm zCm1?Te(q$hV6`=$3L*8dFrS4E7nsIq+pF6p3LF*=bMs9@;JUfaUOYdKNiz1}4l5Lj z4Bk0+u9Uy?RV+k&?s(EjSGjT;P7dZ>L;NEu+IB8goaU7tv9tJEjc+)jZf6N9`~=0* z->Zgg-PQzWr*rcsKSk3{Q{3mLm_Z8eor8ahniKXVORC(#M1GmBzkZOA4A%k4BUGgk zq19TIc=#gQVvELJ17xvlfs7Loa>Jm4>CsTOlZ8DTLI;A~jRdI+p`QX-I=R;Kq1Le% zkkxT2P>+U*HHL-BWAXzImiApAhKcL(K^pemFif0~muc7&Vb}{m!!>ME7$%o~cGWO> zH^%BX66jD3J0T1^6KJf4%>-JEWkqSE73c^JyEROAH_*`<_G6%96nZF(eI3ZgU>8al zsj>S2y`{DX+V2vn7D|ubXNlHqhU9OVRr)Ur(xd*dPU272&huSI>In< zmvXR%{UZ!hqOVvH1@q*1=azGmm3zOKZJpt8Wuz<9&WezKm{x@RTfH!A5`qCmeYx;| zyA<(%gm%@7z93K-bk&#n=_>;cu)b14y6VTsPxG8AZZOE}p7Sxmz#0+0=|;5gvx3x< zXGtinHw$tE zAPMiX@~yF|lGLuT%;PdAVCXJMD2^jUJo8IFBtgR6%-vDxyxf}TX{rzwOza4&JDSIn zNo;-{Z!&iiW--b0P)ck~ov?M0$(Fg6y{NZr8E+Xw#QRFps1PI66G!C|rYVjEm6XasjT+Y?=@~z%CDyeJRiXJ#etP+XLtj5=qHb@FGu1?2d z206y+IHV71KCKFC10BkNX}s_xmv1I3qZBP~Tpo*#Y($K*HPsM|%y<-~y>Iv9q%W$s z`zv|-QyxC|Rs1$U*s1#$S|E%t#7VdpIj9(9ZhO&4oo|%aJ`>Hv;RF1U%B=%8%WQsl zqTm~uYvF84Bd-Ass1Zo4WA5TVPU4Aa)_s37kc@q4GBX-5JJ7WIL@@m zUc5ZEDpJzmO~(gVZ0icxt;fj#1gS2f0U z!u2A~Hf6nZ=?X-LL}}g>mdsU-FGNWXVvUuoY49dinaKqZs9@8 zbfyt+7GFT?W%dWE7q_I~Z&0q=Pl)VKq(;1^x!oDt zdCdvQlJ3OV?s(TCiIIQOnWK~5p5ivjitdc{d|hJol4Bz3Y|oF3yGtd+nwQ_Bx+782 zo!_Nvpxlgc{0k}CmarS9+cM*4+i0-hx*Qf z^P@n7K8NK8Al$24&8{(zYMHx89vzukqCfTX zqa*Q$*QKH25e)EFX$1cPoB5G{U72P4Wt5;unkssUdFutQ*b`;eoH3;G$u#yTPqUe9 z5F1{1MtOBl?yFkL)LDL-uKHO7Q0`Qv8Bd72f5Vs9T(m%5N!%UmpH1j0#94KIuVRA} zNT>RcZk!s>jrH@iye{pbUv!;cSzu#@eBK?*;w~In((3(m5sQvzABDyP?WK^AHzvNl z6v*&*XBhUk5PAdX@q=WZ2QY$m@X1|GgXG?#L2^gYp!p$WSiH#oT2OyQ^ue#&`fU~= zNMZe^hR8DGtVNZ@;0Xpl8|QSB${M_Bl}dLf-4$`SsiM(!@OWj0J#WU{DP?{>>98%% z5Wn?iGM<&{8=?;`Z=i_{Uc1!4}_3?%wn}^$K*WL{PDoT=jw1x zf(K8tHM!Wrg-_+wRjnS`(2ZhZB0H;e1B_lLeLsn zlk+(yVT8Oh&??k3di9kYP8^vPSh7}vvLMih15+M@9wcDHDsdwBDoXpC( zVi(oRGKz&d&|iVx@ctL_kw)Wp#r*x!bh3ZRF2ckKIWIjgpC)gWMEShoZ0Ig z@BX!V?GQ5l$lhY4P`Q;rdsN$r)VOvXG>qJ9YulQBL#<==I)jizA(iAfFu4ux3TUOd zM$%mGeG_|YaEu?up>34E3O8lp=ZJ7yT)Y>oGW|p-jauIw#NdqahIao%G zo9Ux7^v_Obu98vvmb2{x0`g-mo~X;#{2}>;a-t8tY~5zsF?Q``9rBy6s$ReCT}iN_ zZeo-@yTTdzqSN_CB^X6Y$)mR1_O6J@-Nr2pYh}FiAEmHbn(i}b9-4Zq~^F0Dw+UPxPBFP)ls>||+1Bo!0# zO6rZIP6)>8_=I=7)YoUM5<~x`V|AkQt@yT&Wvq^yb1S9`x#gt(^iew;o4IXUi-#>S z^qpYXC@?=r6KMOVX7@OmdwbGI=kQ_i_MyKR{rQW>ztj^iSsj0P_ZhYKufFz)o@DLn z=vPGy(dgZyonXdfeh!BWxy!k%LuZf4>3ricDuZtz&*;>I;%mG+MVyyj(-^ z&f4U_IYl~9LZddG%gmJUd*u$&frm#^tZ4Z1XZb7A7s!eOfDWDUc23Snk=tC;CbvsQ zh7rMr)z##va6!uQ&Z)}0^3l*0?m1Pm@DLM+Yp#0zRvMxnwxW$I*prQD(B8mOWSs-W zC}vl}3ICWI3J(vK*U$EXOd?SdMK#XK4;`WnZbZ%ke;RzLrKN0ol#+B+$Vc zJ0pyp17tbA9ESZH$WDU8K!Ixxl2T3tDkAa=UKK)zBv9SxmPf|Qqa#b4u2?0NV`cf8 z%+jSom1l0KjHG5_Gr)OCc!=b&oz#_sMTV{k^piuc8(*Itaa?Bm0Sk{w&VFsulH(4= z3hz+4&FsFI^sO-)OWxz%Vr+~!e1|2*FRZ-!fd+SuxDfa0JO3q_GiisZ<6D8uJgaa5 z_|{aFzNDq!K49ayK9vglaH;f4`p}cd4!W5_@ts?G3a)dzXyqwIO-z<-i}SRyw(ru) zYpVP0>Y>-HAwdcSBxE!Ztpviij$Nl*WM z!h)-TiY8V#Q2JfrcoQofH&z)f9}q2{!n%a59Es!YzU$QIC5u99phOyey#H59> zinhunXh-?|5S6mP@mZ%MVdB_(B#nA*ky7vIEbB~9Q%5%2tJeo*DLF0%Lpz{sE8z=L zLU9E}rB5QRepTsVh%MUNDWD{Mq7Xn_7&w9$A6N2Xh!jx}vic9$4=og&KifW?j z;%@*i1_M%+{4Gn5aUPzVO3gdE`lxECx%A$@8IYgUzAts;KR2i4)Var`j**{ZQ%CDa z6)KLo8<3pnXe#1SfuE0felsvX;5Yl%FBx%IFtCSf|57gm2N1m84pQsK{G#*7!R4&_ zMUeD=`Xs%r-&W+(&{H#MxS<5$ifzjY@_SBE`PYH$Xm||h_VIeu0R2g0cSQ|KumD|x2~`wv2@3ocuaJzeYC)R(z~(de#2&OhZAG6)jup13zqXmM!09=JG9r701sxbdhldcWXD8JJTCYF|eMll3t4q{IQl~lI z^rnOtpCL#ZL!v31d23RqA-XTmpCb}Ov0@I*Rr?*hUJazU8IFrua($}Y>6%zhiz0cP ziZqqwp$O~B-LzDpf&BX~0Smt=iz77ebeWP&$Op zl3}e;6-IPydW*C?bG@h}o+b&@>=;GM5AqQ`XRE@CfQzMBP_b*EEow_rXa$?#X6q{a zVVTIVbfhrOX)4d3=+hY@hjZMKy}P=PkiL-IT`}!yFCj!voNhOjMMuu#=o`mWXpc*| zN4M6=EWl>ufS{Fa;?5@jM(-0pFRttAq=~TKlN=eX0p#qOR7W=u6;5*W7eSQ2p2Dl$ z!Q!|3-(8Djlgq#6AAgs>A4kV9S_t2vF-CwEY^?VSAziX6NRA;FVZUvyD=klr<_d1P zT*2i=jZ^tZDFxY$rkU}cR|>xE=%r>Ft(o>DtuC-#7+cFk@|TNlE4REU!n#1EE0^Uu zQrOIOsZC8C$A40YfM*lgG)}roNouFK-(v`#AsE3Swfs0l$oOI2k_-%KTb`2QRYxYC zuO`y!cTW~Q5 zU039A=|Kq$<@xZ7D}tL*BDTF-V+jq3X;}A7V7VYsK;XgHVmucT4q=@M3Xr&$`-vOp z$Gy@|+#Y`1tNp}v3$mw7p357>c+h;~9i@+d@#Fs9Ph5u|_m6(!miTd- z`-zix#Uvkh75cQL$&Y)ZpSa`vxO_ix6@J{C{ltC93X%H$*-xBsd=mFoKXFg_ac}n% zcds9}rJp#_MoXD^V(QaBaU3IY@AMOQrXTliKXIb#mVEE^6DQYCB<|n+#6|qL9WOG< zyuZdekbK+v$+y~%>+UD+7k=FKe&U33lrrD%6PKPZ;UDx3pC#c1k6yvLOgj?(QQ!3A zB)otQ!t^3oZww3xg7uv@*FSZ>7Tu`Mw}Kt0EOGv&LuvF_#T9b&`leVw<} z6)PGm@8B@(@Gwl=Ia)foEMw`!v6O|)4#UI@#=;hcVYi22awE+0idfpx3GHcN&xT=t z2*X|v!`=?V;1>!>|*>uv5dZGs3X*!mumDux1mu!q7hc?Q(l@?049LKyaX81{A;whM>1t;E7n&jp4Uw^auyS=JSoDoUTCT4srNo=WYcfhPQEFh0U?vZT#Iv~Ytu0F>aNpIG^kMOu))rt zk`AOD_YP}!80^@?{-u)DiGk3TU5%8*S=~jH*2K%5^6gF5CLF0G*kJ+Pwm&3yB{dY0 zZqQa}-eNuLaSGtLs1F*dBn1~GprHbK5-}D2i)r!hz5Wh9QkEz_ZsHl2P%zavu z;dYgb=EJT*>?rtzZoLlc0wI^1oZ4ZjgIQsa*m0$-OOvh6uc2<%jWzD)5YX(?<9381J;vG4~dsbrGvG0&7xL zTVqhJ`&*@JQlluoFakKx=vjwpzFfFom~amc9c2GhO9&qT_Ju9C6PlTT`UQ4ksW1|a zUZScZ7AU>@TP4BAs4Fb2Dhd5qen70g}-ujr^0pZ>d$p9t`qjdPIpd?_U~L0$Q87 zr=+U{8neGZf`Drd7N`;Ec!f>}x(C!z8j(x9mSZ8%c#XX|jJ0>!!woW5HpncD(C0Z_ zw1ZXrq#UCyC&}uMw$-qBWv&vz3o`Z2j(7O0gE1JB6vLk>ND7`0M}vK5mNQt#L-r%( zML&~p8zZ7mbG*;Pb0G};I;~5%;*|6(G;B9fBX;(63<2#TU>+*^o4R2ge@)90*-N=j z_|L!&WTcqwpU=~5@!G$dbFOLGlYc24NtV2gc5KiTuN3E+9jU)WAKZ(ZhHJUiD2!a_ zro(@g{21tuNc~BBj7#5#bT#_mNF?gqX?!_czO1I38ChTT`p!m{s%{gW>)dq<>@1A%7+;UmFUvn|K{Mpx4l1Ov&zX zl#^M} zvZ>{bD8)cj-Mw#Hy__j9dn|o@F!Zk zBtA7VPtEPM|NR1GV6a_o32m2yLj3~w4GP@NFAybVAWUUA?Nr9RkTEJfQC9cu(%8(6 zCzgqS2j=c%`6!R1kCWeuNcsqs^qRjwO@Wi$fmdTJ_+s;o1A8W?M^vwAzHz|ECm}*F zS>v^yDAR6k3=NJC6wkRJ33ptsiiLe9@rGmO0@Wx+y9UTGkj$g`&N_qTWYZs?h1NB72%!XL`PnQEQ@1GrFYTRium-viX~uLQ;wc47*8Bchmb3D5O*{7|lXX>G#b5Ej4ncq_0ePLmRPNjBQ&N z+uAuS_DF$tN=6%=@o6V1lEYfg1WaY);(K#lK*LZ0ZiKv<-KwTr(Yj82&(^C54)5Dj z>%^G%nmWh*ih~^b*w7$x9k=(wr>^9X6HSi#Bf=d~*)!>(u$?&9c|niuz&x1;Mr@O= zN3<39zG2p*>)EF_U>f~+uut#z_bIx5*LIn^A%FL6RI*J^@l`-}?*9?!F8-HB4q`{x zsupe1DF;i~2|%`P^_(^XG+U?YR;)`^Zs}P8bs0Ayq8uHF<^viL0r;|*4xC_d}YA1apKOj!LelzCg#7%MLs95ujL%^83 zRBseWQ0B^#jhWX!8v2soD9#1!G*#!N7S!t1pAqzlytja!*F_;3LepU!8$uTWS?pyY zbPG_C8e5gawiiEn6W&Tq?9Ol#HuLRo!rA}DCRF=j*@VntaNdtovWV3uNQW)AJ)o8M z&L7$D#?xULCnyN0ko*nDyRG-u+7N85=RhF-?($2-(szX)5*M1%TI1jl>wmsR7mb!) z4rDv-2_V~XGW53NJ^-4mJ5KCU8x-0FD5g*aknO^L@ShwJ0UPOf?cJ0l>kBq=lCqJ< z5NJc*lRC8JROKQIjK#AoITX~vWl`u9cuFBOOmV(5R#Iw_Y68qUX+EREyN)9Jhi^66 zKSn~rL;g#7NbX;m1^}u&U?aJ2u))bTf>V{1Waxr-F@>b%Q6)hD@R2KEBGZG6F7vFa zF-%PS zLM$4^gQvc`-vVpWW8+w}&Pt*U9*EtM)WK%BNvw#Zf+aM)6UOFJdSdInHxe0boBB z&=aSH^u%c)J>e5|xl1(ZIsV}vZ9Pi9ebrrVEFab8zbAJrXL_>ab)nylYt2_-6LS=Z z`pU9o$(xRQq7IrLnXLUVnh_Vn3EpcRyGah^rT^j+AFLy)GMyjuaAS0_JR=p)HdK{3 zvqyZ*DOq<)&&zh-1pAu-(VOKNsaW(O;^%aBltmxvh-aP}=uWQ4|1eBd8ol{Dl8P4{ zOQNfZ$BpCUG5MA-0maYgeLnbM)qOwHZm@SV5ZFD%2wzU5!lji7fF> z_6nCmbdlx;G8S04RWjG~Uv9`)i=&@b)mz-3j%RySwT&{YDlAufRine}xL5;~yqUY3 zqQk1nqBq|oB}um(?Ki~41uz9 z-E;bpwyBa+$sDzmK0h|oT%QI*nEN)(kiv7f8Bms60w83eY2U?&&k*UifX-H=d5^@Z z03r`$#O1$3NbGMctcC z7*0H~E-{SP%dtEn646~kjMYHo`Z&S}o=RUQ4CbLL0plk$ju15+={f4T3AdA8BbVzD zOyFG;;&{cQLf%5so`(dig#TjQHEmXOxB05)3D13DH)02>@baj3P$SOa%rM8G#RI<}dMOBDeT|XgzU7(8Qft zPh>emvuBS<$g3glLMP!~R|k($Bh5ZHnT=I&U56zNOZa@!+b!XqGb7=i)|8r(^vaUi z>E%R02Ew8YV6OA0AZDuzOTiLJH4KxR#Apdq4AH+va&Pbl!rYI_4~xrX$%#mfcph?q z8qiYv_@zQMM;ARViFrLp4j&Oa24lQXVD2^izZ_q0675_h?Ywqxzm09OKJtGLB?9@- zj6}pw%7Gk9dJ`!pfeZtm6G9h-&=*5!=X6=-hVsb#218s)Z$3L@9*-(b9`NYJWLDQk zS0Rg6`+27Gkhr@>7J1TLoh(@sukE-RuZdfd(TQ8~`zxl(eT&rnJ6{?i{-F-iTcsGd z7rTfWCN;Q2SU2T}vG8?N!uedorOF{(qbd`ZMkQ!079u*lZilx03Gq_UHXOOpwpN-A zec88td;F)ZN=ey$T2@Zh2|KoCz?{yNWpgIFqic#nk}W20$wHzmlGZVEX@b zn3|&-hH9FxiAsRY2SL)bD+j4yNzdG6_p}oJ;cevFh;m%y1DXO;N zF2>VpU~j7tYlKlS%X*Y$m@pii zKhIpa_P;2FZ#fB3=_fhM38Za-!U^gg1AaT1Hi!|)4r;9aS3epYq*PneU(Y{tC!qPt z5)&tbM5H-V8NQ8$Fjlq2ij|{5i`nu99RSKR=u9Bv1%4lf9msKEgv=r!OZOWfV+SX2 zmRi`F5V``Q!NTqavbH=3WTm_XWNd9W&>05{YdWwjU~3NmvUEkVd1E)#$~}%-T19ED ztQ$Bw?_AKv^%YLGeqik3i)CnPyY<1z2KPC`M{c*GkMPyW+%(CGq+XESesT91lf5T7 zT}#$;-}mZ&$7{F8d66T}JCi$mD{~Cm5=3JxEaZDdcu!=bB1q@eOppb{RD;_I_Df`^ zg8f#+I$r_%t()VH;CSZ7slJ*yfX3Lvpj_V?s7mYYJAX1$x|kD952U}MJcQ>fjPSGe zuPL;D|JcK_SaNTP*uwA1_VC%y?OYLXYP(WZL01a>Na+h6#od^aJ$axgK!!Udb~Q*c zy9+>pwKzoz)~?dP;mw2I!)}I!e`=&bHo;;*V9P{|nk`Ijby%3#*x3?$B8*j9xwpRn zR94SbuhA`pQrm|TdbgfS^df={CFD?n{sY>!(`K#|dFSU&mIYV^bhtt_Ki-^tvvlk_2b#S50kos^fh%kZ|rIh~OxFi+)J{Q298JsaDTE6=72l@WWO6t#RL1 zK|pHnfZ3O|X+0`98q*tRBI|uj+jcHcE8|ic`4Z56y4_Pirz+Hkr)YUoWqaW}|w1&`2q4zI0( zLWPwYK@yQhoe-#`5cV$)wgRgj^(`*qZ29jNF8^>RHcvy8i|?>iEpmZze_18#wW{2^ zoDE6$@%fAe57KMz-L_^K8N4ykpgp8d=4S?ViPKIDstfe4H^{hT?`-Cq+Y*w>-Hw%; zH1#%sbMNJ-8Jbdf9-J0Mq8gGQfHRuJ_N<;%R@Z& z$Lxy`E!w)AKx`!g?PKkVR8Sa}(w86smMPI<{@C zeQDs>whsGRra!LK7%ji8Lw~-dDaU?K1IOOEOajMdZ`Gf+W`6R!scV6ty=_e*D-^Nk z9M({1IC(A~MFxz%;bc9b4c-HPp%`pU!)q}GTgXIK>tLxi`s^D6oEt&5aLzW+yB!zZ zwQ{cayXZu_6K4HOKUv4`H0%DwSvU2QHL}yJucE&QYkjSstWT4m{|4VnOg#Gy>19~L zW}w2LtX&tXPmuE%l!Up9Ml(Y3?DxA#n9M%09Au;(@nGq6t*PP?zaF!~H;cL! z$u$`HCpz`GyQoYMSbOBP;b%%X0dx6{dyDjq;4iJd7{u*JlI#fi@A4`4Z}?dP-X{4x z`+X1x2U5oD3P%?BaTCLH5%}Xm7lL5ggSe>vZEO&bTZ7-aED7Ze;`FE(Cf7^PW zfA1I0zaBgPw(W58dH%B&|D<^$-}P;Qaj?TlHA;Ho0FN$$%L{O{?Lk=*-h3p}?7W}y z5%<*GIqvS7%r06&c1A&dn)#p1ei?iIH|!|Sbdy7_b;PrJfZzmXE}-B*z~1O&XNNbQTX{)b>XZwRE=}G8meYU zDf~Jlm){zhH-5+X-<9&~cxTPU*l`{&)Xmpw+dA535#Afi@>&LdvT61>kgadu$pFh& z+##Mzw*|Y3n5D%KdksC35R_z_bpgS+RIF;&1K&S9IQRX2#(jb(b-@m0 za3W0=LgVy+(1;hI*}<9XAv8{e@lf}8NA2iwRp^ak51RQAuq+fdsCj%O{VO526YdX$ z-ogdze0tW44VPIkFDPFGGA}4XYMU37?*o|^ln;R3Qx;+nMOcneK$b)7&@4wIkmYzA z=;d7mQAAl1lfZDLkugA@S0esYptpCIurq-EttEdOD8}(w8u<~BF#t~h{hI%!kvI5j zp0*AL)fhA@dVKB?8MT@GeEm2^gK|BLazV~QRoNYFu9;p z8u=wqgSP5Pfn<~-8-c9kJs}4S61lrUH;2$)fM#lcOQHC-X$wXHbu099ppSJ7hL?q7 z3gnL|kUyqCHm1J>verKgWUYT1$XdS+$XZ`MG!psVcxh=IXuH-nD}-8rrf82kfZo^G z9MHeDEhAuKK2Yc&pl*eZ0-CHjP63*&Jvvj;Y2HhLK2+#hppO*tfNXxB1A0eG88)1Y zOovFT_5rf_EiiMwuNdDdP3{4ROWyC-F(q;L8~T%ZLUtzn!Ug=m-m#0o=Oz(`eGpg3 z_+5IRB=|d(95HXH97dV#?1s$*3;xv83GybH{juN@9|wrE#FE6l5mkjRJGz9sklP({ zv%M6`Pc?j!2q`ajlU0#sh`11!el5S7?{RU_GO7;a<%7KG*W>^NmVbb9D#|}faA>-e zZhSIv65z+l2=t26At5qpOqJ~Xi2)j^E#g;{bsyui?v=v2ekA%w=$s9N(|7^aIk@i~e4gioZB`SK9rfKmGo?iOI{gj{CrT>4_gNBH3XR1|`)Yad)u=?O|y z7jfGh*W1KExfy9#zkGDt5^7^v%Ua*sSsra$0$PLvitr7EDWnu#>?RS%nSROhsV@_Z zvamccequ#5^9R1<&siwU7_CN-M)FZ}t9Ij@5&DZ~K$${t9Traq`m^vfVJw4jC zih{+d1P{~++6kvF+M4CF@ATaeOy5-jpIw-w{CNzM?U^+^>c`rJkYe>--T1$2x{oM~ z5_?$DY0FcB%X(2_Qpf*#XJ}RVJKM#@3JXZqnH(0U`}c(WS&O!cJCY)M>0xpeA-eSQ z8oFoZh7o)u`3To?F9I`nj6~T2$jKAHmr$D#hgSj_adDfoLSCYFb^4vg>h)sLt$w2=-RBUBfxR8>qdvGI z_6Q~5Wubm;em7qKys_+v7+w_Dz7c)o^^$9zsoUCBB6liQKnjf|p;&v&OnCQgpi6T7 zZhGAP1FzAQbKR@KU5#VX`!*93&z3&F1NtFnM`~C@ty7+U2d)%m^F@l$P6soufX~KCQdibpRq~q>o+;rj*IxNH=su0JCu3Kl3r-Z@0~ERsXeo=%SDN5MCv?2t z`vLPYGVq~7A~_#wB~V8^P(d6%?-1;9GXI8-CcVWrIUT8^Py@@P#I`-;&&pb%A$2Nt zlbLuI^k2q_v4nj2;k*+qfc%Sli*0J!1cSxhC+#cUj`E-b<-uAT`U0(EZ#^X4_X^%! z>q3&JPW1+=mB8A80s{}Pxo7*<)ulBP&QVK!U5yNv z=+=y|=_Tny6JADGlwOL9)KI7^o&E96o~A<}BLU!s-?l;=fdRSW^Q!#LGyjxg;IL!K09@5UkHhkLV?w6>nwM@xO^B zGfS%Hcdk53+|@WwKSd1oCit9j2sX&!{ssxLR$+gX+x}3GPHjh#O;N@p9Ta5?=#hP; z4iV!2kMz=QyNhq3s=DMQN<_DryTEE-s%88Hj9-m1eq;16*cT?SEG{?x9a;PNvX3WKmZ*JJWrv&^rZis zMiWnSjNQNNP+RLr(`ka=21)a zn%sK?u~L`u^Kj9ebDzy-A=)~f`WxJN<-YTUggc8Fx>GXXh|m#t`~z&NdOBR4vP?Jf zNIiw*VtuF+^$}9hUQ6}eYj#&z&!cGTvoulm+}jW*-0WYIs>l6jGRwmzf{j?fl{A7S z1L5w^*Z&FlES<8B`Mbup>Tw18k)|7Xb{tu~<`IfT{jsM%62X}?vraJ9A>6G;JGeD9 z8V?S>rTP?aMBY;2#35Px7V9~<%gH3puh-?dh(Zeotv>*%1$41`;|?dTf8Ji~pSLs0 z^5<$1a>)3T?B@>_fxc2*n07?*^Z^kIQhf60;=knzf^y&HvwEYS8^UBG4P3Bi%v0o; z*)%xQU78+}EcuCWhHPL#5(v3K@8L8-lT8PE=Np4UqAGXfwTK$e)5F2Z z3coGSOQiNM`1?>Jk{uqOa59zwFBh=h+$^vimfBY>{gDwiRQWFm1}V~;1;>{&I*RPa zC_rvUv5cf@vPI2FXtBbyZS4DvAL28P-a+$WYE-Pp`{#S zlSE27IM)0lYom9CGbLO4PpvvTqS@chatcele@gi%j>~!6VDcL4sD7EmW;!dY*C)Kv zwcJ4Bg`L|--S^7N30y9OMV< zHfjEWB*sCXKXsUGX8G@Bn+bM2R}Ur}TqAmtL(FSiMtIVHk;%K|IArfk;Dk)~ZPB(8 z=93qHBaymj>r&vt7WN%w3%(K)HN#gQk}@am@`F4N5KzdI^3U|UHB=XW!h=$~C9)gI zd}XK4WXZJN5EDx`v8K!J$8RK`pcgWx34GFKOPdpRX5n;cMR|-r6>)Em72Jkg!2!l; z4ar3xc{om&uPMMGb7DQK;iphe=eXkz%41ryHB}!7l}_^eVnLDj2Y-pXrT#Jghw=?$_gM8s)%IWgevd&KuYd22Egm{-`G)kTg59EHa0k#JO*d*6=3LY52h^bHs)4#SEER^m3G}vxZ3D7a?TZVE!CJ}@K<{Ym zNkA4`5NL(^m(>&>NHt8H0nS}cpc+}iKb(^E+5%4P7)UET+!<~4Kq$=!y=M7T)~-rr zCGgOdA4u|~_oF(NQ`~)Ae!5s=Vw~`}@yI-JDn82a^HqnWp##arYA2gC6Y~Ub=LQBL zMUVT`_~(rpyraeWFCO>dnVQe=xQ`7)+`VNJEsnX1H}li42B&eYkgu0Q`6@%4MmD#g z93IDb{{5j*`|$kf+F0`~0k2QDcgE{ulU?BTqpgc*Lf1g16#}D6juYrRa)+d(+u1J1 zA6z9*?)8e{%oyqp^m8fg`y2^Ag=u?+ML3r{kElgf` zHuk~YLR==?WwOrj8~|}C%exnGiE^Z!umS1e_P%BAej%%T|B1Hj(AwmFMCi{+XINN{ zNyEZo6=+y^4Ul2s9FXDOHn6ba-X8!N?iInV;oiRinJ~N?$Z(b$;^RAjY?uBJ$nf!c zpz>P5N`DPw4`TnEt{9`Rn|tZmMGl$t9P5G(b8q0Kiz#EbSql@3CAfNP@HoLSr zUea+&3@`2?w|t4Hr1wqR?0j#cmE7RtkyhR#Y{2VJkqC3W(!k0DAWp7BoXpFsF!9g$ z7Ut2mUy?hwyVNFSXSD2FtZa-YuaOA%1uc8)4rQ+kZ!1gr(bmbN)jHn7y$DPxLE<(V z{aa!6%C~o`X*;RzCixa4&7T6OBIK4UfpTJwqV0K?)+N0{dtT+c|Hc&a2-Y5PoNMh- z!L79C9)i4EWnpbyQ5J2xlh4dEWv+&ZJ9)f;DcMBKX(fp@yY z)h&|aF1eS2LJ@^o46sCVr%-Goy=priz;SUJ^MY=e07stfgpYb{32`KL)8I&7?E4S} zi?&-H_R<%r@5ub=RurY|Oc9=Im14;Pr&^*H2Qa9D2#`kp zUOja2`fG4^;6*k&!vVgydh24_ikIo|aGSTtn>y&~bl)FK`VzcDp*`s>+jR=>iqRj{ zwKK@cEpB5s#bt3BsovRR50}vn9VR3QqP_H00|kFxzH$I5iL4*FGa|2OroN`{94{Q6 zZ_$-BUy!ZG6Wcs_99{ZFMZJC>{|tsMym&>u`EN=Apuv%%cUy26x6=~=`OK^#+{2Ij zQ%TnZ_^3=om+ayM|98Q?--1{pHPaW_g!+TgI4Kn0TMlAi75k-5s-0TS`tf+SxIET# ziwN-o@!y^(5jM#;-O`r`Oz0O%Q+WGKl1EZ(-j{QKQRWd9x0wt|&>DhHCc!vWvE^8K zM%#%(?;yoP!+{JtifYfW;{ia19lr=<*zspeNbAUIE6_Tam|O&+e5}eav2jW)#27B`G@FGXDJ=~KBe>#IJ z9MeQCqE|Ske(FYxAAWO{)Zsj`^^8}4^qr?F#rAZ;B&VI#DE}7b(}JY?yWCaE0}Z^)aIfQDhoj#PM{jwWm7NNH+tYUf*`5}9$oBM4*$+k|i5}H*JPu?zx_~Ulk?d^CA$#9wB#|{6jr1Cj z(Ma;%#X-8ytHOQWXD0_Q$i%XBNN&oai~omu65dQ~k+Dt69#89dvbuDUQ?liho=r*b zx3#l^+67hcN~>6mAeyKsipFR{ph|E7s;O?8=Sv~UNTL&ykeJ2EN+t;cE>wf*22En4 ziNTmLt=XuQj%Xq_ZvFqBbKiSa-DqOwGxM3>pTw^7?!KIR?z!ild(O%bR9)Bgk%ImY z%_UQ6z-1#vn`EW3Q$ef*a z{+QhLa&q+R>2WU!Jo=qv`%5*+(Qjk9Nxs`(j-qDR(Yq=K4@d>n;(Z^r3TB;T361Z?QCjDC1z= zYMBBowXUWFtyS{HI>Vz#TN(?zX}mzk03{lpOP;c_M=*G1YsGa|;`6|t@I z7lS5mB^-oNu%$1O%V&^VekB!Go?#Bxktq_WeAl5RS!5b!4q?hznL`*{3{2y~nf5?I zPB=?tDV|m)#|WnGs1i&GcY;AgjZI;hqkL7&UAbEd_bL3!oD}o^1YV3X^sbOmUtwFR z9WiG}8I8WlH{k7h9&3i)`JHM#g+ysb7aZ%Q-`s9*pwM~q`_oq^OM5^4lGL09~= zzqjJi`@d;yH0}IM{rLUD+ymFMRJ~0V??V;0?((Frv(48E?rhu3H~;4{x=mEyshcA8}kp6eJt(Uka1vdc77m=GxO<!$Rn@e*|$|PzglK9&sj%|`~F-Bk>9VRm8B5clZiJ=LC>k>|4cx>yn64cz2<7WxhlS&BN5zHcn zRSfY4mPk{5FsfqKkO`9(!z$hY8@-sPB@0Ko7e#TME>6L1XB5=6d>UrJxbidEDc|d` z(TxcBPPQSf&zQsRYe(R8YB9n`Sp&0`$$UNt6F%muF)}^142DT3Yw|u-S(XPgMpvvY zh`krcDA9An;4zA#vS3)o-v!X0fy{g4z^hc$vpC7~X-<=8f$f1#`iXqlg-3M@H;+z8 z<0+hD2c+_$s5UK%w{~thFx(L6BQ{o!g2FCUshn351uEynucznUXu50UgF3Q*uq!I( zfEx&wf0Q7|Ev*=(D(mEzfFQpYtN8{0y-b4bCXF_Gm3&idfc@^8-4Y_B@inrzs|3*n zKl6Ms^B>Zqi3zrQx5F|uKCu|PvKu8^(w+D`{7UxZ@*iY}tU6kIeu%*eQ@NKivr&w8 zIFaXj*O)^MZi_iXbM9HC>x@IqV;qlqyULHyVX4CFU*{_Mkbj-pLV-vzo*52O$cGmm z1*FV+`DxsNSG0I7=+7*{OerR?KXZcxge%A71cWRtaZ9w7bX_$Zy@FV{^n|JV6iqAPC z`3W8lA}5A{B`rq6y(tkF4d9`t?XOPYRonjqI)VQH8vbj#snNWY*IiF7880BrFvJUi z3`2YykYR{LYrrtXI#|`#o1I?-hsXcp&d3uHvEV4UV7hW#(3NpPR|J8pyAn7avc=ko zqw@()o#~Sy3Gk=Jr-lD*GM5)eM%z!NNQ3jK06O5<(EQSBB7FgXnE7;OgBj^P$-*XW zWMTGhgy!A;*3<%3>y-sj(9i7wkc7KmfVY4XFp#oqD>eQ6p8Ew4n~ z>7+P0{6J@9OyJ^(p@76UlnPs z5;o3VB?}l(@^$$&63edrGtva~1RbO-I3 zB*g{oiEW)lR$7%gG-y$)h+sct*?}eoEDVkeFwUyJ zW!gwgM9;pQc~rw&1E`6c^WW8+NV+|t%zWk9qvelkRw^@%(L%CY%W;!x5}EgKN2VfD z?lG<%J3ekMGg4fF%b>Zl_jr<1p4Ao=Z2}%4!N$21+^js$Q9M%Sa4q^RV!xT^;f$QB zyL_N|ka4kE-r{U#=0Zoq?|iG+PcE-ko-UT}os~W5z}mfjg2x9{>KC4_`7v2+ePl60 zm!IIjNaz~={+qIE9|u~e&}V|!X1Y+XCxW#=_h=4LX~lskK7(%m3r0gBG0SGCw4Ge!fZ zasoSti0t0fxUQs=lX0g4LEN-+kJKZK%Ex`_`aIkH4}&xNGALK!y;r;ntQcILCLfb+ zw;{hANpWL}_t;>@C1dMT+;yQ{;IZ6Bj4md4kUnBl5!>yG9p>gt6oSoJ%XCg|>aNq# z+6-hy>&drI713p<`k@*i;FJI$M9tUx~E~UlK4? z_}&J(Y8RGm@HEc-XZxM4MdIZjiZ_ifSS^#8EQ(oAC<|Ghozp{3bRs%ue-E?ncE)<2 z5i(=NdVg(}^{>hqxo4W+#rvvzq(1i>Qh*pY53iF7;%-6OfjY+o`p`#55nRO(c<;LL zL?Fi|tCS#|>P?`v*Az@!aNR9^v)xCer=?HPYO^^BB{{@^O5U=Ud1>Hay-Zfi8zc{I zp%%-m2Unjcfk+c$a%IROlQ)v8qI)TTQO6kuRI)Xbwqf5C%%it{gXCVdX(5%WFpGU* zwAN6Qs>|(_;>NY+DBD$pb_#2OiRm^m3(ePh`KnvJL4Vd3_2-^0`5E`6d6Hz@x|#Y@ zXwsk7@%%8LpW(-&-nJKkuA1$Fr}1jrpYcmvY}VbrGoJASl+#X#6Z}hzRr*t zTV|yHb|CMCm{lF9a!iy#C-SUA>0`x13-U^%98^9IJXo&{s-811KXi)QXeo9)Nph;cZV&Hd6nS->2q`|(?7I(y zvm^35!j5jjR^6&@8Q@{7bew}PnKGJZ=%TE)K6LR2VxLhOI2ULvCxb}nDj-7_$1t)6 zIz52C5kPVXJzZ(#L?A=?gvA$al1NDOQyVmPRS^4api?yLCqRZaoC>WxTf@!=GGPa> zPx+T@ISe=9fDl)0dtjcrlg`gQp@0rctaGqz_PQf|hr)5~1>bjR_oFkuTL%{t5C3gK06&o?9Gi|Ps!M<#nalg+)-8mmqAGDZQ_ zYtg}ISZg~w>@c*oXVL4X@0%qZTwFW)3$SLFqzDc~s^r5E=QiSiV-Q7H^TZ z(>)k(Qw61Dwgl?3iXg>IYC&gwROD0FcSc5?zWCEOb;L&vLf5Em6RKuZvL)Q?-35zU zXN{Olebw|Ir6#e*Z}(Z4a{c)uIIEMX`GzsFpw0lQg^!7ZE(9`$CuOOcvqvkCu?4su z$Vj1zKqmG`aK*&R9%FpNW`K;vzB_9hiA^bB2 zHB79}^caQ!4Yklj6}%p>teanA`vnorwvTgH7B^~{+}NkbL$iESg|cx<|E!I5_#wQ6 z7;oi!xXbpfk{{1;VvRT_9D?V>n(W1st&Nw|hB40`Cg+f3et#{NE3?nUwhp1ZWd6+| znKM%1UF9KOfelYlhF2U;AOTA~J)Z15YpM6;@36(v@IF{} z76BhqqMru(*W+a#F99-c@x)w<2@?UZ3400Xbxxl=Sp@pL=7Meng`BXDp(Z1*l7qjIR~gPZC{=Dx>cd$G zCC7f`nY+xhOr>fN7TiW?NxA9um{{;WU~s(KKvUSI!iF1Jzj`)f1Nk-9omGj%Xpm6S z;kd`67P-fCI<$CQyvEzaSW0|TJI#g`dPfJsAid`)qDgl#@f3j>Q7%u6#9I)_kOE^f zSMdFC#t*uZQ+=FpGT$*T5Y>ZV9&=+1eL7j*YY1a~jwrcnod`Mi@DK z3g{Cmub&Ha@7aQTa>VN; zlhDzmd+Es7W=YCXi=+!>r^Nl~wAzkAaP>^MPq{8 zt+x-xdJp#6cCi2N%iT?)IxLB6E3@;pQaL04{YI|!+qa&iAEbSmWgwF@zkE4WWN!NV z#pCEi`=5!wZ`sdR`kon0+2bkOtVmhdiWjk~%-+KYDd$xkvHcv<8}tx<$v{H540I3B z?R~ea>WS55TQ#+rtNuZMDi;l2$4-C$j&Y>NM$t6x86a8o>}=CBSeyPGYY19?570V> z*CVugw)S)~ArpGas#bO%PYsv0jPK>s5rI*)oCVT>{z+AADt{9 z4v=fQYCODD@$k8{n;BcH3$=GgzGvX#E0u-&eGTg_>^rKQ$?bGO_OVcMek6y?(MThF z3oQ*Og8HX5kDk!V?3j{RW}qRJ(ieSAN?*5KJMkrAdFfUJmmi4oe5Ct#s7cEgJ&O`2 z%5>vfp37YBH)EE~)sVak}PEgy1r+8^H~#(YuXInh6&#By8Xq^ik&`k!k+(w#ont5!VJ8b+Zy zFyJ0g#aqgt(5R(=V&w-rQ#qLux2=jC_{83m{aA6t&N_2`&#gETr@Ks1Uyx$rXp4x-IFZv8pJ%b|EjrKUUJci_XaAXj%|E)fmO?V0kWv)^XzqGKbVNTZ0QQJT z!U*=SFZb7Q?e=VgKaB{v`%U{1DR-6T_4Oh>lV6=vqtbHayf8CuZq1B_W{Ggtie5|+ zuPrK%lJ}N4R=5Q|y*#Ya($1-}0|k^PYFI8c_dS7dLuYOW8lvp{SAfnuPgbyO&@Y@T zP$y8F|01Dh`D@aNC)Ph`tSIA}Sb0$OXAS#g5GHS~KCKi%82gMud7vcU=HGUo`e6AfbYhPzz9<<_$LG zSReg#I699O;zeto$X>4Y=%DAlUAJTys#x!(H>3(LcJZ_4jO3wby|T0;wy?#IUB zF67Z1jbW?Hjwls@5zWW6g_Ij4M zikaPJccULyLfp~r+LxKlaif4vS{?pmC&|tLeDu$gB z)@iQJy6mgNDl@{BZ{<)}wady?u)FdGratL}+?7(Y)1H4J%*|4Jw>4ykcaK|fxn|gO z<@Rr59x?17w=EnUQ|`(fQ2(+02(vk{v!OQ-NqC#_u?G(BM|3iOm&8$%?S5Gb15d1$ z2c*=$GjWt}u%(5BvIz+nmx&%&elU5z6;Ey|Dzx(}=7umL%{-38XQUh+3=tBJ?}t7g zth$pM!UysKh=hZ7w$6nE6n4Bf`|swY<1<9t&!kv0Q+ENGnR*B4b2?Kam?^{B_BpY5 zJcPTlvPq23+`u|Yxr>CE$b3u}R9lXM`tcGhp>*Nw4)}<3B;i@f!gRQZITa?tTQ>}~ z+PTdP!{82E=FW^^DDdp=6JZ#APN`n&Wq=Q>;M9Q}kKuK$r+H`%ev#C1XS*)^_h0Mq zJdX+MX;%4-{W+e#s~nph!b8Lvfx=PO$4J*3B8zY}Sp;m$z;l6z08^V`!UPS5=R8g@6^vZ4PC&6&Y?r&e$8|HWY(d^5fc#5yg(07r645l01$gq!dr9w$g~W(O z!S;O2sxJ~{cD@Q#L}`6D+Iou6yQG&Mf41cUKIA`4P$BiQlAYV+1Q>gWRwLeedw{hv z4;0JoKOwt}1T(^k!Ym%YZ+teEd-I@0NBQZ0ctX7JiLJ5xJ0~o;DrMdOm&KP!;u=W| zP}0OlRuabw*{%6^Pgru6ZQcLc;?s~RUvh9)toUMt#HmBNV!0QrMC~rp!x+&RRzxV# zg4UK;=uBfr5P^JRHNtHaR)1-=P9c#f=a1Vi(w}iCL3Aeel7%yEqG$ao?%dqzQIt7^ z0=drJ5|Mu^vS^I+I3~R^$5;>6HNSSoa#p#uv8g7O-+RV_*pMz`q;g+-)M^n0T5Dr% zzH~Zjg$%TBE8!KK| zDpGO-uxCm~WTNy8zr%YMWg2!)$=xxr_Y85Mn%`Md`YCzfb&a%Svy5nIwFY$}5`WjU zXUY6N!fIcJEwn00Wp;ks07Nsq_Ygf3MD?JQ5n*wU(GeL{DPJxMkRTEt#)irmzaaRc z^1=QGtIBK4(X>O+f39J4J=eWKpR~1f48NFrZ+U=MMt1mdd)yOfNp;f(?LQpJ*Ypm9 zBvz}q7%knwpVKJW2&RQ3nm5f?0ex_IH3v4djyw@=C(#NXqs)?=swg`eGaFK2W%`to@H z#bRMv7?JhR(^n70A5mgYN1W9b>&5Akr+(eoW3Bu+xk(f`KR%(`YMIMdzUO0^;nG%7 z>`OTBl+X0aBdey&7oX4foNKjRAr)^PEgfVySorN}=N&6QRf64RsE#bDNj9T|!?MWB zSr#1HD{~F4{ow{sR~%*w(Jo6?MM^KAF8^} z!i8H=0yC$<7hRBS+?V+f=3mV|>XR&q$1&#^8aWcH#Vci|oEOTAgaie5sonkVQZE+r zsig3_y|Ra+RV6p<{+%j_y@!j-3;dNJB%;shp83dk;O%nR9@Le3N-LOfpB||#TK3?+ zL}&rcS~W)2?A-^Vl338`wyT8bpzi9WYRqu#Qqw{l=4;(E9xaC z?}b1nb^(x~Ah!n4pMXqlL!kzSN=*VXVe^78@sjaP5Hu260c5DpeL$u>_4MYSY7H-v zmW#7axi*8PScYeW>*ggpBV*|%FZBn@57xBAIG4YLbtDT@YwXS6`L_9Izwv^dfAL*h zcFd+zzJ8<-h5PxGts?*KfJHZ&ld!dMMEhU37aM-W>R|%E7|FjlK5lKC7LK*=iLmoR zHHHsbJu7T&yfmDD(UPbdq6WnZ!`EuIS>(R7Cja6E=8HY4J;DXYJ9fTv05#Ptxlb6n zo8Pk{;!%1q8N1 z+r_2&Oj2|t@L902p{WJQ>(^yKd)s+Y%pG5Zt3}@Ml!wK7+d1=-hA5I{ZZ9nFYRdHv zS&~X{^jx<+(ehN2b$3TYv8m;+*+uLLPfaTf|6G%`@r|j4;d5fmZ$eE&OD;>St|Pr+ z{<1%e<@ZPK_(pk3aO7=3JLS2|SxvcjPtTqvv6+)%9o#Y`dyBM(hLmoD!b-%l2!?|W zauX4!MrC;{t6KK<_t2(>fm#gOaqU=76W9UcW1|9WF1-VRuLa@;Kcme7H7V59s}M7OMONBZT>(g(Ba z$is90-v5g2Q)%g|+R~2%{a6``Cvg0C(bg_!ydiM0x6XWTPjY=|UW@W8$#ZJj;f>_rjB=8oRA86j5<% z1b-tG-z%rGV6QZU#@}D>s@<$8N34Q%f1UG$wP z)rhi=Jzi_sAD35Um26O|yW8XNH~+e=7LGkDSj@g(JraJ?gs6#Z^?f6Cf%-Wiy0Qm* z!)UdLO^_gG|47kfO*lSp5iWG( zqV*e0V=y69wd|Iq9}>Kva|-(;!+~W7=QsYun%T747HL79slvQ4o3g*utd>i?3PfEF z>0q~s@u##$r_^dan^Y<1oYFXcX>pIX_!vH<#fSE3@gT22zs0o&w78C%IC(@&Ro-}{ zoWGWu7|bywe;eLD5)vs%R`EXuG+a08Yk|y)z9R@*4`f#K0|B%lfJ9jSA#IUq?@r{>rNulWs;3Ci*od>|UTlwPZQ6n7negGEz&~22@4W*kY9Y zggyGqH@lDq)v&ax-_cBE7p%q3_U|$lroq#V?YF$F1pW#{3p+EzQ{f%Fv`IOf)Gh?m zP?fl1yW(-BTqHxl> z|JlV`%UAUo3v%==5(!Xh-1BzfN?z*iv#sRwcKcfqyK(o52Cp)b9~D$^*Z~!MA0wW|DT$M zOy?;2|DuH{_ic23#e9mG#gw(j3X68o^Pa`OE>BUtDQ~4cOPEyp!t4uwp}i4ceBaK*RDZ_#BREqY))&!Ij-U}DEqRY06(y=6nX=b! zLKpVN3)4G%q}XSzTq~UokRo1~6ClN+rAbHFAP*z#hoEipZ$$T1W3=h^0H+EPX zGZVVba_?gPjp$beLJn|co?{bP^;&V%)z2ah(ElZgWh8;1ae6c{Icq}S>~o| zmm#{1Q){!wsph+En;IrtX0bdJU%EJISXab!Y|+}NJG6}caa3gZ-LrrUS@!welpCwn zX-bakS~SEC4@)^Q>`YcITHa^gU8E5)>z-n)7EK1(qPW75b|q{qY_{(iklgg-8^(+X zR-Te?bTfdFk8j%pO^JODJ~U3=*QyS?Yc@D5&@hr9f?`fmb-X%%X=Sq4}+lGtWQtl5}X3ju;( zK&^`(9;NxOC{N=16VR(jNW@g;iJHigBcmm(3Fug*^nT-H2rBRi(z)t@_l7IB1?P#R*Tn8%$2c``rqK*zKDhXe3hU+yW3zxgp4jo^mu z1bQ_>CtXltk&fP{fR56zJdoM^zYKJP#%>MLJq~2@{toD?V+4s_1~MwT!p@lT-VLC^ z!d7U>qAYlfLgsi7NGQ!wM-^*1Up=jN4%cyEbMsQ$xB0qmH3ceqzs(DAIYOi|fj4;Pn3ly>f%JtQ378QsX|3yM_ z<}uKnKo@G5Vx&2zVVm|Q{4YAch`Y{xMEY}8SoYQyo*2*qbIcGe!c<}E%v52z?Y{y6 zfll<%5!ll*EZ1oI#^~w=>(l)zgzCk6eIZ zOy6tBAX6K-Y5*NuF<^4V_EA*0Sy4vrzzoVv0opM@#(4&idB$;B0Nn<3lcL}^fy{%r z4MFTLfNs{<=YT$`kZ@B*1T_eBGmuCmKc%rJ1z{rgU^_CiC#tUW(md9by-6LFa9#g4 zrRBFiz~6!9j#hSuiT;x{4D1I!;*F{n%2>vVqwm~U)p8Me1-9Kf+q5)F4$x$N`+74s}`PTvTN&pQE zhWn@h@&?|hM#LLe%5YdMKLQ0Xa_HHBLjiAPD%>TeiDXt@g?hz2XHHg&XzeB4W=}^B zvmZj~CE4Qu=GoYNK&qFg*~J1=CHoios?I)~Z_SfXV)SpwiFzquJjEsAT^yzN)kTgm2CMD*%)ITRV@%TTO5HB+NH%dsG?3`WvHkAATRDVos|Tj$$X%9s3i321LylEx@($7;SdT@ zF{619l$GoGk$<_beV4!QlrR3kb(;dEn5qKbd-zqAS-55v;72%$ctdHenJOP27;8!+ zNFJp^oWej><3=K!*IR2l}bT{t(FI*bTHp!%9I| z-2i;BY1n8WlkPJ>+cZo(xR|h4fDEx40{3jf%&s5o8r&^4sq-!O)3u#Q&-sV!iw!;< zk*CSXCE?h;*EI%6l*n`RpWdw~2cL zlTwTU9H9dQ8x<0Y8wp*{-{e?C0) z1D^qqE@tAsV(odT;F`VSDd-R+Wcj$HTc=h>qi$HHsDDFz2D_o?-gPQP zqjzYv%9DendxU#fe%pQdH?Or;ZXqDQGwf)RlB_VlX@fJjaXVqD;VE}bL|Xa6$@%>_ z_E{y3YwnbOq(rzW&os+7Z_*j2%{TgOzS{1ueLf@U)~X}ysqfcXEv0-??yd<`SW_NV zU30e1RENTmjxs!1^J9V&awhPUC2yorM=EX!otvQ;wGqgmzTET9*09MyCQQsiU94ey zgD}~BMrkR!Sd2uZFaD{{!DlEr$!l$lvO>$}4&}ALXe~O7XNp z`l8-B`oyvy_Q96b=#%M@arYubhSkR3yklGSh_EKF4MyW@KzC>_za5N*>D#5TIkDgj z668(@t;jj8bBk?HX3sqnt^xHq!A^xRWE4{6(n#XPIt z)f>|y$@4xlwnz&WjS@4hT|nXN;drO8)+Giv6qEUP!uFBH)Q~;nrR^0AnwGII&B5Az>(X!&byh=UQSW~ZUS1N(`kr=sLprp zwxOI7j-_@PXK4*|L&z8pItOQu+IbJB{j}w|Z zLB`QM#Ei>B%z)j2al?*{zZA+J(<-EB-@-JiS+3jnK@4Y4OG(n{)kSl~8aH-1ym_iF z+7#RWsLi|U0of8F*YjhA86CO(`xgC{k57hUg|vSCg0EX@VhBhju4o<&%Di|Soi`%F z-P}K=5ZM|l#1o-HBo`}0rVbom?(KEVHA75X=x_pxjVCV*Qj9Y`ZueqM@=27Y*3U7nvuGZKpn(IpqWmL{Z z*ey0N#ki;j`8vqS)g-{Ory3$M z1Vs?zA|L0l%+e1r#`}nIQp`QHiV>=a%I~QpR^%_!S%SC98PuYAqh6P3Y9Bg<+r81y;P$w4TNKfOuyiRsjbfI@0MO|mRb0fr`K0(=VoqW@{oSR=BF-qy;t_~)_Mv%s!ou2I?!C5 zMqy8{S7V6|w5}D%bJV zw*NizNZVzeZq+dqcGWDw&jFdc0~s}QckoRhW2ukxxM$u@OtHKPIf{hdQ^c!B2bHe* z=OrOWj52%u&4ntYQ3tuQoXrp>~UNqcl`&Ugnb0j%yt-PrI zG9a@gjhi+sIz?D5BCb?JDjd^33XB%Z80)wk=?+Nm+gp)!ly;ZZCfx+=W2e<3ax9VO z+U^{lQD38!|IF!yNPRM2j6(iF28IRWw(4kpfA7qh=yssOpN*D3Q8ga4kL?moy$-H~ zFlO?HOgeBopP8I=TgLW%w0edw2|ZC1w4hmf=0kE1|LV<+|L99^XXQ3#%{|h1>?5SY zczm8VQpezMsslS1Dx0Ai$XC*NUJR&|g!`@%DMsCa4>DeVAZPZkL2kBH}e$ zHm;fZo>`e#Ice@n1N=$4=~~VC5T%Ba=cPwV*39T=xOkK zi0}vpv4er%vqmoB<=ym=?q`cEnSI-$*<}E6WetrY!Q$tMMO6Lp|NiO2`(K# zhRo9zy>&(jmD5T7o6_$$s?Z4cM-o(jCItKi?FR`;wQF-4t8aRY+nfn0&1 zvpsy+0qMdnvV4oQMU-@vC%kJMP^rkD6fT*Pu04}8i%2lOCrQ0gxAI?+1bA%WHOfqu zDjMvfux{!Xdzq&YkBYr@Tnqh`vTkPTWVPewNzc|hGdS1~ql&>wH=Ldda7u7`=+uEs z*^%Y>=na6@!svOvFA0}rzRJ+zDarm)odzGB>jQL^Q-v^hKDzpD89lNE;aGZoCPNQ= zBaP|spZW5;rsGP#TF(Mk%d>RIWXti0zO_cARbKb|+>FW!NqXvzIw$2DXp^o@S@46) zmkE56KFRVom(w8E{#rHnH@GS`>+>*=M#=S-e|ckEqFORHN)vQhn7hNi>fBVA{Y!bU zN77AND!<@uVy4^raHSh0%9@8AJ z0+}3gfAF}5O$(Oo(?FdX_IwalIdk`U`pj7)jq*K*ZJqjN>K0TM*IC@W-LB{%1oJkL zk`(6I2wUIQ>tN(T!N$4tx_x;;nwre9Nq6YjzH|(VmY&y%i9A`5y_uOlGEA$QkPC%Y zpQDa3JX$Ci)tM6%^0^2^?yg)}!JXFE?!YlOPhZ;+*=m;9OiecW}0 zH>~FI4Te>nhRTn~3OsU>k}sg2@?Ru0kOu#oj-gzmd*pBqvS?56INQY}vo~cYplWn^fis*e}lx(sM|BkMiaQ z@pJw1W@`vg@?R7Gjpx58|8aaDRAtFM zueOp<$_PC*SVm|Zkhu#;2GFembZ-D{4WRerQF)`lAwhKzuC7ZKJ~kGADYLoT+T&AQ zr@f&l&jh=e2Qg}_h$_ZSlg=yUF|ZW@Phsd&T8L(j9BfIeb8l*c|#3BV|7PhG;8FLrBae0ps<`g0+4}*?&SBZJ5-h zH!JzCZX;4o{{WEENMxL5U|NdVP2~wNCf+7=MOAAJ-Mq+a>GH_|ag_1V3K3tN8uuIn zS8i6)&K`fO5H_qcB%G~!h&q68Ig=Pe_C66nZ9qrq@+<=VL>J`_AhRfc3uH)UlG%7v zW2Xa|*qeb&-W-rgw;ssUA(vebX^!WCOpd<*8FDK`c9X`UC+hPzY8IUYZ2E@n#DCDOrxD03_R9ju z37~%upkDx;Tqoo~PVmM7MxVzC#@;^H&?*^tGUeWec`T57RHAI~T zW-yqaREL4(lg+?#xAT6U0F9%peUhT$DC@O~qpWw0qpW?lGh?JPEt+3(YE+ert@!Tz z3cP{qt&$Oe4y8w?zSzS@1Ixa6t0?Ag;v>W$LR|*MoGWWh@_GWic_-mCUsq6kl`Ld~ z)f3`K*)QVmR8jW{$QWzIc4m%@J55o~on!W;q?4@06n2@1d7hq6+_|1oFp=O)qePvv z>V5EJYVWUocs^l9f^a2}F_144X2hEB1ke!rvY2bpNa$i9Gwts~yT$LE_&7uyC#QPI zUT!VrC>i{g0GRVm6|RnQ>r(!g>P~{%wZxMk$mHq3unj`gdXv3B#p(9q>yn>%eL^by zC%f@^+1Jfhi#>Oi)tkLDqqu2P`z9Ow^8CFP5{{X*+N4*F^2lUB&hL#M#zo;!v%gj* z4l5_RhzI3wuMaJq5_jjD)Z!PEL@7eU-jIcB zwkm6l(5;kvmbZw^-KXyg;J}4c62EoEg^%y;uk>|krqm^8prBlN*ib1qJGe{YSZ{$Y~R0~DmL^ZKsjzf@N8J7y)nZl7||NM7xNL7RM^ zgsH~%6=(8(Y?JR#kbpZzpE4!--Y%v-zDtya!`tM}rd~xgMz~eJU0U#uo$me5wVtqgu=3y3;hXYhP)ETBnXiASPLo^Z?k^+Z9 zx#?q#-OIkJm_H}VEc$OV_lAgU0y1JqdH-sNNDXC}*r7ls_6Q&oI|;~;n0Wydq7kD` z5W=zyXtY8uklA@fC+!G&(@%=f{L&r@@U$b`V z;{X4aH}0_?#2Ysj&x8%dzFZwY$pU73+_v%3R!032H2!XoJ^Rp{a}!|^KMoNPpYoV- zcP~cM+U}8N25G-4Y2QMoCBdKKb&LYY>yQ%Jx!vR|+sLfibP`;-Mxb z-2xmbe`@W*I+?bZT5s1z1zhBQG{Jo?GWIZ|gxFP^$emQL96V>UneMN87oP0YK@>{h zpE(f+1_Fpf;NUY8JYnH@`8Wj`E;JUW2cx|S=yz^}&rf*o=Hlq!G(RSYX;eDAt9rj8 zq_L)=U;w=P;Um(8w)M0<;oc?VPK&jdSeWk_!9?|-v?4<2SboJ&F3XMq+}AeYAkZgs zi$5cY4TM%rM|y)A`7=E?bJ1G7b(-Il^ZllP2}bC0s<%X{$J&3m>T5$`!_`v|av!YV zL9~gA6EZ`B7&Jo=!mPtk_7c0GVcwvnH?Y;J^#od0=dVky3WhW<+aLw47}F1>-YfmS zwnlo7Bbl|-lytwKtHm3%@(P@a|6ewak=4DLkwv-UfaR`n?p^gDiPv&&fO@<9l!J3- zu`}tJqhk*X!zSzGM8wGr`{M55ypS7_J+yp8(?%{;^-HXMya|T37X5RjDnpuEgMw#Wb{t@zJv_bWvL5YDHpL^*Cf*mfdg%;OPs zQktxF9dW1i5{g)mpgHS`O|^R`f{Np*GvySTh_Ib?Lc+*bPd=x0ri4N1j!ihfRBTQ- zFUB4|g%MunV<3ICu)A`%umSt?3I?%2=mirev0O213$Ix?oVV` ztQOIZ<0?<4;_f1SmWeV?gW|j&sG0y4#5{7yg79zq_d`Qsn`TmijuethtF_1%gwG^3 z^gu?w9kbpV#>d?}Vdk}k)%tZw>&}P<7Xw!7YJw`41IwgceoJMC=F}h!v|116V}V(= zBSJnGyufLdSE{jx<)~NM3uuS~GWWJ?Iq)Eh*MAPF2zf+y;M3fGV-#=vJ$BXw{jJvZ)B;JS zuR=mw{)WL7PYT=^6hu z&mnYtzrhoHY}q1G$wGPqxrGIYsdz)@nCvZomLT2DOH;9Oll#_v+;ac!pB?HwzNTdC z;nQfG*Zb1ndPD|2)NN?&^f;+Da>4eGD`Z(vVxd4PK555uF}aNtM5SDMLZQGTee3Tb3_~D#&-gQHbE-RfCyeB?hO^Wo{5TavC<*=LKheAYRaFkzebFo-3Q1(^m= zi}E86OZ!Uqy#ed+kIpWo?~s&{*ca>V@Qz#VmxLmglL^Kr*1LnT@z#r?L%iS8F1!V^S7F`%`i zjfB<$B{cTSK<2RVGoZ;D_A*dhbBIA%Q`^-*=516K$kcHM&_$Y~4ans90g&n2GeDo! zmJVX4G^HF5bOCED5=sG?bc=yZy8DB44-NDm*8UNW{a5@K3BAMLPiw0duvh;;OI{9S zTJ;4W)2jP{F4tB)3$#=7MrwI3uVIG)#kG{tK%#*e30)3ko*CW=w2O8}LiYoiI(7od z>_kE(AX8h-5WluVf#zw+#{ijeo(g12`6!SnWd+cOCQ2#a1DdZnegb6L@>igHv`44G zK#1|ANa!peGeVPq43=C7WDb)VAk&u502zFdhn}X6r-2q|9lL={9WMZVUF*mm?C1R~ zkQudmfIhA{z6oUd;i8Fw%R5HGCy`EId*(^IqPn*6&5XRZ)tC+)qD%EWEg ze;XC(fEE(#&7OxApq#}~q29KKL8V}SU*q`apJpHs&JSg?)d$oZE2IhffNvgIOoOin zx=9qCfi(>wksY_Av7@ zdiMeOUiHowU`mkh)^mJH^d6VGhGq z_4FSCzaH86{5|K^OZ~1)_lc@8egK1z9aTQwj}7>hAl94j5ng}g>Kbj%psz^L%|kv} zPlh7g5lkLh)rWn7r-OIR*ME^MDF0L0fgeD|Q_0%m6FRSIYA6Tx+wURe3ol{3j zLAHBkRH~TaS23xoii+_2gUW5I%a3~H*Z(h-uLHq!s$RY-xL-kyMn?9@0D2^VM5u0J zWpx?o^Z@E7N;f((s0_zCo92-bDNob2`R>>AJ8EK1)3wR`Qm!Fd>REmGIWy0-jYpMb zxCl#kd#q391NaWU47D4uzz+No@9}0x^i@PswqK;e=pexvVNGe>{6+d-h<92<0pzk+!gyTL1g?ycE;UK)e=r1 z@IWQ9Ga*|IVuKQdQSV+#2H}#KFR19O?Gtk;HT>VyvWn+}!I*x>c^13bVUanN%O=s9)rn z3+X7g_SotLmDX)@(|cNX#t@stYB9mw6VAr$QwG^vUcbES_W4YY-PpCF-rjQXH_m90 z^A4YPMD6)I?fG+Rv6Rv@*$Ua%M;X^eVao?w^@(njLRgg1|Hqo-J)EB@(pWC8Roki0 zRlRONN2VO@q_c8-6GD*Nq64x=8RrVNdvUFpQy78rJgaFW z7HhhV*viCj5`o7R+vPlWxwbAX-wO2~PKphQ@o04WpR~=O`eSu!%3bA;)v#bZj8v;! z@swi%aIHce!4QoFK1K%t#@!o)DL|&fqD^N8K_0~Q9|WCJXII?WCjEk`_inX=VRCl) zCVDI)%~FJet}>BS)f@M7W1HZZ+*LA&vBs{LvnyduMhfv%V%*~iRN=yF1d|fuo`^f2 z*QCyuy`;B{(1FY^XNVT)sOWe3Ba4U7UDkf6e5yvC=nvWGsv$eF|B#IUua4`3TW07K zxB89WH56{fPaee>=<`4ZoxTiYM(qbcW+Y|TF=73f67wD}?xZ8U3)G3m7kJ^{q|>fq zmXr9K?QYTU3!{Y?R<>#u9ict-b!zoZ?u%5ADl8c5dETgO5-I1K6DX{6RTF4CFcCp)tE^Vg%k)Q^flJ!JexBgcGD3@jK4#pa9`3QecUVw$00Mta9j#b0pI1k zQcOE9^v)a!9c&dEAItxAAO#Jw+V1D;qWO{Ur^0(NdckxcTD^-fX~e6XAH1o_F0q|Q zwU3FvIf@I6cn#?~SIMMDfJ&k`OSZ~Pdy`W7cVcxwXe~-QLrbd&K*I+nXayM@jJ z`9`MqW@)gm`C7ipE29cAj`b0PbfzvLE`mteW6Ni}Z)9e8&^Af$m78Dow@_xNbUQo9 z8_Rq@dpy^W`bu5=cLE)&tI~qbjZ#R?9R|NL0VMmRAsk-^GB_u?)ds)Xfeg+)9)$fT zkSV1igm<~AhC~RKir3u$2LoY)+OhO5suQFGuMSay7vw&P<1zsG%#(0T3pr2ir5NZd6e_F?%5f7km|c+x>{4U-uD* znXOHsCeoaeK(K$9$;f@S_-exM)Ws07>>b=X6=uAPX@f;)#PYr2>>a!Xm8#4zbmq0C zQc-@{LPL8t^A%DpX+o5a_73oGld`AESz|Kvt9-oI7L0xNsaq<>8li9ojA>srk?Oj6 z5-e%*`(L=_*Vvi!blu!|^U|_fUl^^E@H>(muaG>h8l%vsf&PW<{y>kg?wvY{kjul_ zfV?j1OjC@v5Y#52DYF04^0PQoqx$B@!woS4BHm-Ue+i9!Kh!Wsa-@F-H87pdGr2#= zWoQcy37(MZI}_R>FlKkkxvm?;sMq-?P8|>6q(rCFy(r4G^E@uG+jPMbgvGW}xnB5w zN3s-d-d*eK)@+RVE6KH!v$%y`Gz2sutYZ`A6zNEHJ(p6E$!>+Hbn{x&=2~ow<%( zKCvD@=j&zFdynw-dBa%V=smW6L1%p6`cqlvXY<+dwb*76!6jiW28LNG;%0hMFPAcD zYcjmAcUlm}h1+!xCCu;i!l}_@{--qyCU?f8HK#_W7tZFpgG*8InE5t2(&JvR!@KQ) z1B8V*uu$O@4=glOuO-$~;)R8e)kk8R-!w(h#8kN39w<-t-lH^WqR$KXztS{rYrs(N zOoQ5odDWr2VEGjP%y6ua8-Z{dGbTpo1;jA);lQZvvOyY)p$^cAC(1Ja0?=Gt@LvgH zp9eZsV_ynl{}#l`OVBek_FN#7SFEC#l4k+^i^hrw)NH+qVql7I?@~=4+wMW`%!Lib z^JXo~clG9XU>La{(`%k~#E}|7TkdL*`^K0&}<7pNXgm?S+j4z)QK-&rTLy{}w5jC+|i4Bt)VZ zi5-6EbbIfgDl!+J$S<2`7d{OYj6siznTz9%P4!ux(P9_G$Q^Zc%UR;r z)MA4C8~Y}acQqy5k$49Xv=ohzr1PXWYqwhEQ4NoRkb(6P0_xkE%-N7G6=El4 zusQC@)|Y*ar?3ci;jR4PnVif|92?5)EN!PPslt3zGpE!EYuD07K-`^DpAwaC6r<(1 zSg-7sDa0!wGuY|S6PwM;A#N~flOcz?UgS?s|AOeIC!05}TGVJqQr39#kYaX z49N2qGupBxtW_c_M!QUy?1Aqw7vt5QDh84`=<^B-@#{S4>W#k9&8rVEx;Z01X)xu7 zmQNKyp!afeL^a+Gz_@^!nZL;uBxxawvH^j4yL7o>fXp0Y<;u*v7;4}_uFP)89>8M) zeGi@en;q^E_e!D2lA~dHYcdV-#@p+&Jh5FI<)9*yy1Bu`h3<*Feyer&(p*D&46OF#%vbG)BC7^H$Plnj#Qnim|9=C+kYulL(MNjWll4QtNnS8to?@2el z0*m-cZdoLhwi2&!&2fX^!Qk9#RRe!Rn}#0OE2?DG2ToRX0>pzA#GL<1k&F<&$y*LGu;cDF_Jg{@VB37T1!uEiheAPd$=%ki$ zD$J5%3|QPbu|aHX!qjCKn>f|C%P))d?J2K=gwAiehBEp3JHU07Jwj6gNDrmG7I22pe7Cb6OdT|=YZHIM-$K_ zjkSSH4pAMQqG8tnnH-CO&ebrnt7*deEegYu;-#Sl1pgFuaaWISoYIEa);cmLA0ADk z`4_T`wAv-kc1f|YvZAlR}Zb9+!5!L1lMP6oD;^+1^8z>ol^7>6kV9yJn?Ib zK4fj&=6m;RrdV7PJhu4uWZ{Y$yZJ4t&}tKQ9jiXVa*h|v{o$wZQh@`%N!lK33IgNp zcH4k*t4jpz|r~^rZkJ)&> z^A+=R%LwMaG=oJYe-j!OSfSSKq|`0NsM%{?;maj=c0~D)-T}oMb%vOogJzj)1!gYk zyjwk9vS!`Yds(hqv{mxjVraut_Iaxpg0viA)Q-Ohu$~e+?qNZV|JG&U$DkbILoRv8o^4vfKUO~cZipXT(0wH8uBE(aGZ?Psd?yXF1I{a?w zldM+iMq%n1(|#O-3dh>~SdJW3?2%mV-Z4b>s_TG0t^*jM{a`EZtw=P&Z1C`oK<%CnShH*Ux78u$B*B7qdMhRNn#lC&!6d_@XR7LGZa zmxUgKg1ZrOj3GA(q}d&jBSDeB+Bl!h_i@8Kg)(nd5?KT?vp1FuX4%Qvzseq_v4v?! zrrgyoMyV$0ZW2k5Ao=({Xl>c}S@#-kcx=$h`*wcEu_TLyqczfrVDvDVAm4W9D(RH` zlTFv0Oa045|8sjI(Wbr00J<`OS_5eI90U~!x7KG4@va=+#EJR;nXF#o20d!SuekybDg;FO`)!U6WAxB^m3(zcqlyk*i&$B^c zdQH;3YNXxxtkot`@U(krUE1k_xyl?HY;S3&oufjsai{oieU^>$+43>E4v)|?!loz< zBy@-D@uJ%$Jb&ZUnQ_$%(rP)3;&rGPqO0n(pZ*x7cmTlx;dC;lc}d<8ZwS-ZsfAOI zOE&(>YU`x@xbvK}KJ6|UX%`}+@Y$7W+-tQxB2~LH>bx!aNbguK>_D=yxajqC<6aox zz2#%{OhbEnd_S|3IsJ8b5-4V^k*k)my6Gb8s5;_Ym2?KDoh5ap!9)hQSC>7f3h!2& zRE2ZL&?0bdid7dGWDPS&*IRTHNp&Oddx7!3N1%a}Q|@Xg=9Uc>334IQRNnRsVTRPa z%wQVw^K~%FK*QJ`&0_B--Bt=@S5En8&!8ixd#Ey@&|=v_JUVivPen#jn0I#zQyUds1n`1ErHl_j;{cnPPvX)b;AEaW^hbRE1m1J=?$Ja z_M{tWXQ6b>aEI>ld``%*PMjLRZxppnoLqTW5MQnJ={7*~K};A)`% zQb;Zuz8sO*V1G7yzzssz=BXOhleW7EiN?On{It6&M+V#I?`~oLXHh&G>z#8$sxYym z0m)fq2-EHb?6B;Jg&EPLdnp2YNsiJs$rs8d_q;5Ll)F_*6y?7Wr4KVq4f`rVR?7*5 zpgOdkB>gJw{es#4CwBUFy0kv4B3yD+s@r6z2JP0CAn3W`?iue1gc*pMpS?d_+cj0OWZ zMDr3dZ_F2eW)5+-mwzEzfa>-# zjuJycMD|~&Fl*x~!PtV`o8KR`+D>3K`|R`lp?BKhUFY|{5NqDQmNa)9l7BS9Z^&v% zlWcX|6ZMKU9OPPxmUs}qMwY0uH+15C4UNc~@qer=i{6SewI1H<5X$URp^Y&VAGd#XZyrx=JkfB9{62m zDAyaq2-)_)@3Mc>wt#O|%Xzi3);i#PLJ7IPdx6Q}5=A&#Pta#19gvhF|3&IZS(`XF zGR$i2km>F%5+D_kJNui`zY|7teybBbgXZw@CvDq{eB`#C3X@&4=uiyr$+I>1k_pme z?Nn@&BrJW44n0Jp;B}TSrB5?aIi-;4j8EnefWK&IAEF-7oyXz9s(V;UvSPV8tHloV zzIH@b-y*8tkv!9hjBTFD-?$au5tx6H+4nopI$soV&Dd=iT>5u% z$C|Yf*2Xp&XxcL0YMVuP!_JBFz_0y5Yw9Riy4AXxS-HI+rx2q$)&xh8JZf z5Il_iaJ1IT8hw;-MoXlSR_opTHHpkn6wFYH5xVT{n2eb#_pn02#zB}m6MIQ6$L$_5 z`@!AYAm;5zJSt{}=X;LlH7V^#_I8+v?4NzN#O$nA%aP>pABc?hpO28;ytMDH@2Jj= zWvO@*?&ZWRz4WSLo8TaM(T7QwH(8BF)^4r&Pd+@-=AGbEY^wby{XtSO3_ElfZ2IdD zprM=$)H+fG1L%)lj==tnD}5qJ8QV~&DUrt&WvJ#W#-!ZTj-CUNfI1o^XMm0Y!4MK! z`cP1+KMJJ_7+`DTU8jH@Eju$udYCDzr$V1!6=VpC)YjzI45x#2h7LW-vszs@;8fcW z<&CYbmQdzwuZ12bQiT>Qoz|a_(geje)M}}vc|imH(YZzv1$77AxkS37&v})CgpfDU zo`8z9zRFkUDxsnB4~o>5W&Lt|8eru=Np~g}BCQhRYs(C+^(t{8Xn1Qfq%P?W?{ZW= z>a3Del}7eqDO8r_!aGlGsvukG9uRZ|Tk;Wz_=95|}D1>nWql|X>@|xqVRykI&zG})_#lLvz+mK3EM}fp^?jlmB$&i$= z)i#gYLQu#&zeeL7$zeTL9rC9UA& zAFrg#NQH#1o6*JU&xWvv41zQlQ{krG-u*twIz%{7k7~hWMg>)s0(yB$qsj2TXb9zY zwdZnLy@>H)r|a!1z06x$L#+wIUQ7;$Hg|7xJ}>wb(C1Y9dn`a{qCDyK@p@Qk40BLH z0&Uep<0-YYT3-GZ9i1MQo$L)PZbh?jyJG-@hTxk|@Jp7EcrGnUf0d<@M-a)OyxVH| zE=6)#pyg)|isjBf!)jeGVeXm@`~)*8A95}^&8M8a?g;F%7|Q9}IHnKC0kuTiy{n1$ zfj&!FRiy2-NsO=#t@qNThmNL#(sy5%RvH}Y^6m<{eBg~kH?K_R)(ctN3SfePA| zPXXOS%OW9p9o??6KLwHlO(Y~t1(wx-UIQ{(8|^Sz-#k>pUI*Hw&>$AVr!?K6K&HGU zKsRaFN}zYxBqE^~fqt%ayb1JYg^r}Jk16yiAai>DH=wNM{TfhQ+wvbk8#LW>K<03{ z7swng-vU~yIR*^&50_(rp3@u?fSy-q29PP`ngF^3=uXYs24q^g4yakf)&rRy$va<@ zcMnjT#_kPbN7drNfvqwUIswSi*zrK7ys1DY?;If0-)n)^)=Q300hv0s0!>i4fxPHG zPoZak&R6JVpeyPnM-R})6&e6PZ|aBw&DXF~fJ}K)fF9SLUk&tM%wikZE5L$kZm^ zEgD;UupfH@&;kuR4al_q3Lw+p8-PrI<>j|2<(EKr_ z`jF>qD3-3{H&)0^favCX<}bnjxyr^$l90ZLNf4{`vwR@w>SCR$bY%je z@7-#-OYPI@f&b&J9!RTyU>daBZ_paP_pKC`7;$~GM4Fwu&zPbz?(8*;bGS0B1OCSw zIDnTG{_`&#a6LQvLPu{xG@|^+57Sn28#fu~Uv*iffy}bH6UdMeIn^05@)aN>0sJP= z0L}3oAVW}o3G^2wBRxQ$*Vq9Jiz%-O$dq>>kST9AkSR}eNC#<-tAR{;;^f8h1Zp8a(0n=<9^S{v7xHL_py`{AxcOu&=RY|>vXO}6_5V}0Lu%y_!LSWfU) zh#Ps_2R+yJT($ZSl{!?ehHpG0IUY#^%(RUG`kHowKi&X+637hDQXn%xc_1@DGO1>O zWKzul%?@PFthqlCoIOaY@*caGB5 zH&zC3$p7x(4e0tn3+_If0gse+PpaHa2Bv^^Y$CvGl^@420>?`H1X#8=a&rLX4FfUyg%DvG_ zIZy;-2u-eEdqZxueg=d`J;d7h1wq@U39qSGtMxg4+7q?y*$WZP`>*=XKakF!;-l{I zRdl||+K8&yP@mpwUDVOEdV|#Q|1tL_@KKdl8NhIRL(V{y;@Cz~*q zd-Z)5Lld`hY1cQ`rkvy^UIhGR%DsI#l$qNisTe5BX-^kx*SgeCO>O2&T`l*Z_0gEQ zlvJ&hA1)TuKms}-b7^oD8mUuSI*yx|jUqXAp9Q@n;YtRKs}lT0Uh4SJD$=qsMa>7f zgP*b9>RLy}!>J{vbh9iP+qN>3wpsrMWSjM0K(<*$<-j)U-axiRHvw(eV`(JI&~khd z$Z{MFWI4pQziZ#}KWiyZ13ffG(!Bs=ZP^B7)VKH>u)D}$)~m&i z0jy|AO63nNxU*RK19x zy*_ptV=rioIbAJ_7}tL3BNDmQvVbD#dLA#ZRRtc3J5SuYh0tR3S26y?8`fupyc@?% z+a5!JMSgIeD=ztB?WJL?>Kc)YeL@$2pLp$f68%O;Y!Z--*!4g*k2xTlN1?)O9`6J? zTyuO2$ma1)pl+Q#VdMNwA>Ru`%iEnq2HIjNxI%jP!^}O5sdV!F$iT<%NaPemVP5&z z#pzMMncc&joIGmZwO9wl$;*33aAR~(oct(_(z$fjecYQdBz5U5o=!}Rj6Lxsh|YNbYevL!r5csY$DAqciMs2)MIZ}{m{ zae8sYw3rowq4FeW*%CiVlq44oup~pyX!_!Y%OqeRzpfp0dhvj7^K;SZ#oP8vz zd(-;TNC|4#bnSe9XQamjyCQuMsA91mK%ffeiKSJT0z`3u9R&#eZBMj3)k%v~Ks|eH z#}prLEZYTd^v+i9_~@&ULRlk`?6TWN$SuwU+3e7CQ&0vky)QE&egiTldB&>x#ygbE z;Dt~u@w5lGh%!kRKntaeT2w15gjO}~#fz|lS?OrT^Z zZ)Nbj^twQVBx*mdyrji5rn$C1BN@7GmOp37OQS8Rn)P_6kQ2xjU5O?H=s_p6m4S|w z50}$wXnBDA85aAwNh-K~_s*vZP<}yc&nI8Kj_((N;`~G-a+!EePb9fs+xY$v=s->P z5YXNH!1d#|@sLHnAJw_8vaD-)dj-M0&N1=50|onltfue?yN3_lYRy7HCJUI%bwm+0 zt(GNh+l^&^QldBmJ~%ep?H^?4_w2!b-l%G32|SLZ8g^XkI4fuNWY?g++@9UJ$J}j5 z{*!J8mz_byguGroZ=U}sV=Vj6{hWfFb8zlw&}JKYQRw-34eGW=>!);3!_nPk6p&qp z(_g4zQLDL4^;|oJI)Y2n`E@28yhBfuO+a=RdJkx_m7B=>0k=MWk86dh(wqF@}pNP%C18Hhc4&Q3xRE2B_mA+Upc<;CISfCbQpb z+I7@r&aaka;hfk1Z_PP(qLP1su!aebl!qUkF^JD-!B~9zwO*h8{Jf#EXY|SH;9X>l zB)yfk?YDo(wts{o#6f^P5Q++u| z5L24NuL)FS*Xt=jw)BL4u%#zgL|b~YR&43r4>Vnu-h)84^nML=lx_{_PsKLH7XRm1 zIkx!4UA8U$?*Z9jm8;3In)hKK+g85@@)vM5x6l@E%u~je+urhOWCEcx46W@rNExhM!tE38^jQI7 zYusgBd?fDlJK^Fmu3oP z0r7-yfWSAw#r3=^p-e+5)|)#k;oZ6(FjZU-^)(_oauOi_yqu)O(R|B0Z}2%7g5@3l z3VB6?Lh{PVFJSjOD-$&n5?pJ)%EyERg1RdJAlGI@n~IagWhA1+2j~w9v+)X;PoUsKiv`H)q&ww(%fO`PS0R}h(PrO)buXD;L1@=1>ab}H>VBAL~ zQIBQou`E4p35i-Kl^jnc#hFUEZ7j|dN-^0Q3^7)ho96x^>Ha<8zRxS3DeoSsG3DK< zZSd}tq8W6I<*`%ohaT4E8r;2(6&Jr+m?ybE32r2M~D>@Vf_Q^`=g-0Xb+oq5Yj`%_4E$5D7{0B~0B zVSR9J5&F{a#}ifkc)_`48;3u{uafSx*WYe5cepgy-PpC6&R@A%n%e%>o=W0ALY6a% zBUa*uXQnpQAE_h!8a}Lz4BT_`zFoSO?Apew0mvUVayH+75#f3!&t~VADa63d{wVF+ z>@3@x)U@wwsp1G}-x(CDGkJK>zTFL=HtyciOR!6{ahrt6;;h^=7{NBaEq}_rvy;(C z_G#mN!e|-4^`o@$d1u*INlhC;)(1!%n}arv4%)cO3~K|wTbe*dZQ!v0lG9(O&MgNK zu>0YQ5`+EmM`_ycoMkVdel@K);y>tPBvtcPs(94QszE%&s_47^{Nei+d9`)715}OP zEqw02ZC4QUQARD%z^F|mF-Aq-PS~goVYGB+_X|d?YDZ{`e#EOMf;_yekV!vAn+3}6 zuZn>`D+J9@=_CrBcyCF0#ZEr9Nl59lkgDOyV;q`RNn1WqI6jq_!0U@eVuPh(yo6Vj zO0_6ao{B)5%i&?SSpPjTWktP=UzFWMmdF#-U%HXKn=IZodKM+{M3t*&iSULMOU1yd zf@Hhe>zu+)lC-?q7|9Be!0${PmCej)T)_j?JWwwz($c~-`U1cOPJ_te7(K4J$ojC*=Y zR?mEXARSH?^P{B|$>P^Xk7JN9Y)ClqH7RdGlb0X;3qp23gG#(8-(T2N^d9EEz1{PX zXK?zzoxzy*3vB{Zm>Db67wi?$BJH-VB8#)Mi9L>etEG<7a2e9}ZNuf+47r3z>s~Yc zXU%2T;t$>+uT!{#%(=&8aq+Q8u!V>WWtVB%(ma9!el2vG_1wc)>|vdUA_nl4_YH%D zxZ&%g0(&6O2UV>J_$h5v6llZBo@%27w&(oKb9v0ok6t62$Md8vi%b$INrjPoMJ#*U z=yp0==d8>rNiMi1XvF^=cUj95?($sWCc`0)l&%1Z1DIaiJRo~{=4l|i;ZI~3O&e}1 zYtzEILg+49YGEfsEE)8>5W0rBw6H${#g(xB2T(UZ(MS#BFj2z>1KmxH(a0#E(>3g{ zFzf`NQ#GtH47&knka9L#fF@|{uYr7hK_F}MMC4%hUeB38U)4Gu1ZvhCD}b!tx?1*~ zh8+wfBNB}q24toD3&=_tJ~$|44$w5s@kJmj<-0&fGa}K*uYs(6?*rMZKchK(&KoPS z@|KR(5d*R|Uj$^eeHX~CEe`?NwPhucU0WUpGOqZqfPAjFT^A9qeMw|@FZc#MW>vI~ z&IH`=BNBbN-{EPce(krBR*WcF$5q0OnL+kM!n?gUSMa2OD|mFUlSO&Okg-qoq9BE^ zG%zBy!hJypDuH#8^b8QrxCp<-=%bk&bUmx(SF)o`{sbJj@=3V+mQCHnj+hkdX+!$e zFY{HuGHrS5K{UUN|MXaWiyj@E^bu30LyZv5!UPUqGzh#4>Vqz!+1^JUP|a$fi)Z3O0p50e~iE@rDteHR;XqX5ftqu{|d_eztvAe=0z^HR!yLk?ruDd8uUZ&h}voC(b zkV*zNmhCw>eV{L2%Z#vhOlvcH@}S8`jGKh|Ns8OzLR+F^tz<|z$t_3&+9)s8u-3V^ z4Q&_aUe4~!kd(W)Rf4hl+)vB>1WYp#+>LG=zoBbOV!sWE!A}QR?B7d!wTO>qeZYd! zX^Jm-!eK-b?!BEfq-*g>?2Z~<(^YK|O;Ng;_@umbu|u6ZaXr&;I#IZUs4TPQH65%burAAFdUsUCcRg5(Ygbmz!)WFvpSK*I^x;mIo%S1A5KLOGd+^7KTn3lthJ0$i4izI4E9Dg+D@C@5mGUBG4T`^EEEgXEQhV{-pZO9Au=|ztTZB+U` zh^Uz-w#cA@eaN@*@+Q2K{~^(G?Oh^rkrWQ=#;$R0`z~Gv{K?wZ7VFQ*zdE(l)138?zk(L|S4^Gjw9wU~sfa~;%=C*3|vkJsL8H3W>C zkl02|T9!$;y{l%rdT)>VSZ8^Z?(IfX<5??P*|uI2kZrvgKtI(DcQKG{xFtaS50-6P z1TsASCm<6oz5`@iSr(0zcLI==cN&mw<*7g>T08^DN^SxAxz=_YkYVMgf$WN~9q3Vw z?G9s)We->#4M0{$9LVZ81IW&R89-Ktn7IE!OSu-vTK_1J$e^N;CxNWqO+b%pm?+O! zk3|2=YTF;kYC9CjYC8&OvgQ~M6dk%g1v&Tpby9jmN+a2la~KjN=df!w0SS7^ ze^27PGx6`bA-#9j6~C>~Am00iR^=_5Lnv1Qn5%xuLD}z0%J`?0g(~eXIxHA*EBb z=e;p-uj)_iRsDV+YxVn;o|O4BL{WMI_@mQcyF<1+c86?ZIEH4j!!cyiKPIkQaFeT2 zckpEiU=9%q$Y$sz6xfUK7nE|p5a=1*NTOuCL80@3Y!eoNY!iM1$Tp#zq_zovEU}v7 z=Rmdz1%>z~2|!lL5V~!pi2k#cA_nPJidce9(o)6&St(P1+BEDcpmhq#O~uf~w}A{z z3F5GlUk0+0-vF|b-v%<2Bq~8xvM3O()$)b`8A=MN8oRcrif8tnnpoSb{bSh;vG@eF zA8-mk(b-e;mP)d;6CAO}9}ld<9p4c^J~y?mjGZYb{1&$%v zWaSA~xAKGoX65C9OwsjTAYak7>LDuL>8%s=FMCIH(F^xbMa41(kCQ}H(;0z5lT#3U z+sis;Uzr25+EnwmkK4?7-;$W41U52GUY0WLmA1&jXoS757zfjW|XwK=sOAcJc*E_RaIKIT)J0FhB;prQO#t;%ULYIVsq{ zAOqhnGrZ;cxS%grTlA~UJa4G(pFq=_Q8UXmuf>-?!`>MAV~n;U8J?Dm)dvZ5Tp>Yv zeOK0NdatgQd*Suf^6;FYjq-`~K-^Y{JZ(QSs>=H6?0#!g6+d9eQ7xNkx`){2vv4&k z*ajp11JfxmTNQRu+8t(ZV8ma+E`Ev4V3*)B71%ABq83Zl?D!9am-#O8$tlc+&2BT0 z&F(B9o88X=jndf_-iOWZavYSJ8X&{|u1x#w+pTkLlO`nAb@N|nKI)ytH+g-$R# zGV)FQ5k92)V=VkN%32&-=(InZ_>=N}+{p}*a*G}XGMRr)U&5Qr+vph>fpO_Bf@@{1R{U zJspL&sWnTAl=q0VIO#1F_M-^w`AQWv-o%v5|EGNog5sT`5)e}Zzp<}CR7>t0K4-K5&C+`)N*d#J4y?UM(>0v_NP?1rgXSEc&YF|zImUcnyl^!Jk z+PY8P?-Gi}T}^SCSS>iW=m{O_UB%JE<1`mdxc0f%qi@%rq4l?h8V*$14QxgW?3{j^ zP`%^L+E^FQ);_TT)w>N%S8g!XyArB*zgc)ZzCNCuUYsgc;k2UnfozuJdAELp@k7U>RV`+njEx~wa@t+t>e_m_?j?M`uN%zglas!O0>L-%5p!eSJmUKpFlYuU&&_9?%?_CER28Ac+Lal1O-L9lX;?N?#PbG_3Q@_&|OkdFp0>^`%EHS%znA~Lm~^D z@G!Nxl7-uHzo@D7{1x@LQv~PN@OFZC3dIKP@X@DNkQRWUeUH28qXTcd<*}CJWAJ0U zbQZP{?xH#T_7+{k9w@XuHiy&FY1;DtgVyP^xP>J$4n>_1b|}JQv$OhF4<~fDIK_b2;C8 zUCs5-+!dKFdUz+61z$(6i2WpMJo~sFT25Zb+PM3EdC#7;mp8ocEIyw!K^>R7g?^-s zd%BUi(J>OT&#eV=kdK!GujjX?9C$b){Krp`7j4ojPl@rzDU8<*(UqPSj6iIc5jYl= z?p|nZm1MQvhsXk--bw!quTTS`@+MQ`E%|V2z$pklmhcYbcci?Ra=~If9g2_^e?=6F zg7+Few4=|np_`?H+Osv*&&Nt~#mnwI+9@2Z-anh#5~5ob;OCwmzYlU%-jfv0qmK*b zF4X`t)>XaeMa3|{!N|rvB`wm2SwL8{sF(DnXG#%fR!tQ|F3flaqdj$((LNzqZ*aT+ zEq;&rFOt(JWfBH0a|-uUk6(#7L8+?97dI>+Nl@9s|3PKtvtsTaP^W>F3x>jVE(}pGwiNrE4Wmsn5{6>zDG{sG~=q| zpZ%Qte+a~?s^KVCyjdO^>v_uJr@r(2TQ5AXw@>BL(tmj3cCiIFec{AVP#Tq*)%X`L`S-rL$GcUkic0c0g)hk1 zRjvmdf2DH>8o%N4+~d*@@x0tar`kjfRV=s0V1i%oA37o8ddF`-FzSLdgcPBY-s`yh zD)T&qbSg>=U&l{SB+ZHWb{i{&-*@>@K35rBvn&_5O9?`)5q>opCZ~e zEu?f4-c_N8ZNy6QeAAP1)&>Dj5+IBtGoZQ$$aD~eU1U%<&^^i!6=CO{3he{*byb)W zQ=K=*2wQ0kkTDG}1?mq@h(^8xWTl9ql|e57J*TmM4a1IM6`HQ%TR`@Rtw=9S?=J=P zRay~^d>6=C&;fKS`OSN#wMD#V{#o1dFCc5nV7A9w8a4vR!cGISo2S^j+s*S5pzWIO zDj>UW=7Idjc!73k?2mw~l#M_)Xsg5yTwD?T$XBy1mT-)&)zAA~u62GpZDnfrE8}u2(Cb?AcYurs@>8H?tkr1b z5ugE@?p2^#g~~u?)%yX^o*Fg)3e8HX1F}*M0^nNJk~fRaqs8C z5sSON;i~e-5dPKCZe)4s*=n?Uliu9S&Kzq~Ox1%kI9X*aXwEi19UP0tRB2|*k)~Ge z$tq`gg-2H>}D-LZcUiu_w=b_hK1kdBud9x&OKR8%OHWydy}R>c0sI4*qCX#-rFUb~;V9>&bym9?fAnN+as$PHV1tAyqu9CcXrp z1)G~|e&ZD4l44yydh^n1AvttFBSOl) zRZ1_tD+vQa9RFyQwELMxY&IA_pHP;^Liheg7lVIFjB#-e0ceQ9x;+pa3nV zE?hfF_Z4{z@5Sto#L>|o`cjBhV*1R*J*q%oS!V}*tm_PKO)Ri_Uy0@@T029hT|`B8 z5PT8nYz>%3o7(WC*i|yK(QyeOD)UYSrXgvQ|shlb(?1$OaSa z9NY+k8YFKV^60xxt!Z@h%%}tKQMCrFtX}GKH_VBo@t!tqR<_}Uo8rNt3JbQ+z*JsI@mXD1NTrHR-N9(I za)w7rH^~g-ZkQj*d`4V*rEy_`U!kV9j;8eyLBm|(`>5A080kFPym5Tnd+kE1qi4^` zF4uvqhKOr0cc+sdN0|@Sv{F1=!BKn!jock$&Tuk~(u&t?lU$S{ZNhu^ZSqB56W-Ud z0v4mgrFG8AA;W!l-B*jHy$@du9Juj5SG{5m*M|J++(amevQ^VzKv>^GazVP7NbqFepn=P)Vig2N}ZhY zYY9@Mb(PEjvYj^vXqJ%ek-LDztz|SKyYV_r_dbxN6LyS|$u7_h8hbmC#XbOJrHFRP z%^LfB82b;PpB^eD{|l%OIXFX>Ko-xHwE$M?@|63OEr?2o+viq6F~3F&FqkuP&T6a)*8f?0gop$ zn8}kO7S?x=P_omD?Ym1X`b*;Ma!ie+q$8~8UiwRAB*=?8373>=M5QSqlB)FCH|Uzl zE|uZOe!?74i`^|j_F#4xK4fQtjstA02stBC8-d~a-FT&=7l6>nf7UT^7 zEci4P8{UcmWp#}tfec&C1`_2f9Hj!;wR0!X?MiwaPOrbFkO*l_v*-~ZD^EBHh6gtS z*;()$kX?7>q92e274<{NZRAjDD))TS{dM+xBS==})#vVJZvsv@bhPBD_ue%2Pf3*! z{U2y-*hgDvVL&5R(b(_WyO|KSIQQyBUjGyFI!7iYuWu&7>AlJ8{etu>4viIWd@|Q_ z=yez4Cv3;O3ni^m*D!0k`;y}E;&l+$9~^q!2@u!s%sYm}K5>l_Q+&{e64%ZxuhW?3 znis1H>}Q<9WS_upc3(`6eUBOoavKq@TK;!rkk^q4f+aw-y$En8{|W=duqks#De={U zmx7}#*Cv_dvhsb>rQEC0(tIO1_8({{{54r@_HQ#tXN8y_DMIjJO6)){Z_^o>vMzcI z`%ueCx#N5&k(2j`W>92DPBtU}Lh+|cvjLtM#RqoR0ps@x5I1uMl`9P}0efi%D^FUJ zY`kZk9E)oYry%MBrAB_?uF~CJuB(t`Vry!Cd7oF;0;;KkV2c(VP(BRORwCtJ?*x0`476L# zKyM!3=G`GX(S0%Z=6mjA0tzPHJ4+|A$ƒNL2T@;C+* z&(Z@0arbVEjY_FMF-OxFyRM09gI(7y0J7`ag^ZY8*Mt`P!3e>qa!IpvvMud_+!|KA zQHMi;Rw*{#8|ZFIibh0})AB9@GKT5;5PA*B%IgNQ@{VAPENlXhm3$G9nKR3qeRd@r z$Vq3d-#>&t1@ud8!I41Lf)jwOlth^BLZFPE0#}5wKLdJF^F9g`*VfzfzEw(KLRaAO zfk*5SmGKI5!dp-$zK0RgEW4j9ws`eIwphLs9g9W$EdQ$La9?u75uFgWFLAz7SE2{v zCK5TGA8Yc=5c*6A$z{i4|GU?R6aE#CbtI+l=B?pzeafjA^EqQP+x02qC2gdUK3|l3 zq8l)>;N2$yLH!^1i8mTsyJmk;?z z`fdCP)60ka>soX-ziZMn5ExIeSm*pMXZW>T#-=7D1rf9Sh~X=j6W|PAnbkknUPHP$ z{LJ8|k)Lt=)bms43_poka>it2pNmPKzYIo2enx+8?n<%xRiV#jZubhLBln)cU5PMWK_SxysDteG{rokyql$nCr?GiGR( zS_tZw+c|gP7zvN(cAlL%d8l}kBfLLBnUl+>4<%WRpKigH+|GGUUMRBM&iP>A^^HNw zy7GZRO39gaC^j=7x4ynCOkyn|D&e(K`C+;BIJKBLV3(@dyo3+zQ?;b?tCs7DUv+Je zvZ`vy8CD&wR6QuH`oP?J=-y;)ZpXZZ2j_MiojxYF0R$LqQu-b<^BAA zxHNEdpkMan&4&Bw8akk3k~M89w_n1WIU!XX0)pBMS+p_bPG{ZDO!N+FBxpwOAa1oY z8xu8a67G2u5?*p#0t>9d2K>HY5j_>J4a=4fW}y?}-;uEv53F4F@aOq=Hj%G z&F<69h0Snfd4_vb%Dq>%e#*T|Hg)>YX0N8XID?nBQPYcWPP%ZEHzX4@YBNZFQM_9A?-?LUVa*oy5EBLJ1yu`k2Jsi7VTlZ@#1sMd4)ow$l>r-G{|%+6V?~ zUAlC=peoFXi=vla)s9AMM`a#RDBtkWhrm6v-lgtKpOErD@|>ZVXKSE*#J`=8@?jrw zHr(cJ_27FhD-NBv@FjaLK>Chw?$yV08yf9R;YxSa1UKak2g9YmoNU-5eL%{)0EBrx zcjc|=Xwtor!S5l|{ajsnG;yHA{Uxd{iDj@%YI#_*`FLuls{0=xp@+=oA05v3S^xGJM}7PSQ%M=;6WD$+%p zCB-`<^>SRys6#llKg|J$Bzh^^eVIVx2HgZ?N(h1hObKCK7`rKqeL0L3RBS2=q8?(< z4Xke~Pkd-tc}sz;yq^MDx;UN$!`X#x?ww=>wYGn9gJ4$dp?nQOskbKaVLl#yloEVmgnBo}|rVBlAdoG3bZ3^tZ-ufGq9o zWw8)g#;64T1sqi-bKL`C&K>Jg-jC-nO|f4x2%=K$Sbxb?@Dt1BJkwH$qWA-Rinwy%IE~#eNH|(+K|36 zEUY0YjP?3fRf!2_N(UY!@y04|=E0sduf#t|6&uAdl(|=>%pnc@8Zm70$wN-g`~)zy zXH60w2QR4AHaDzKy3b`^OpM)>sL{3*(qI-8u3D*-Ro4@ZJq8eQ77NRPKARIDVU6bh zX(Oq$4k zB$qmgPJg))bpcWRA&zA1lMS2F7X(o=GN%$1C5qLjQORt>u^h{}w)b&r3vy=zl~2|8 zy}F#jG$B8S1YeW*LW{LLInlGeygyk!zydYb_OI15D65PE=(c|m6rX_!i;||O&yA@`J>;!ux`13$^rx(>YgD$3zPw1`@357u-A~tAU2#uw~ zR!T@K8%f0SOp14!XH{T?H3Etoy2i`_Sg!3mf174h ztBr_Pa*#}@GXj0whb%fQ5G@?on

-$Q@NwkyChH3dhGXoQLbK^cHnP%GY$e`qx|f zHjyJZkw6|qP4KEYTy$X%N*s2I%Imv`+Peepf(58k>FElY@y;VwP$c!$+@0paH ztm(E=1Q{IZ6VpL?trJL5KIxQ5+w91-!(uK5H3E_}^E>Y@;fm(gd}n-{=+tqQy7an% zc3*avZYLn1-f&Gbn$Ja1!FX99qufM&#S~fY1v1L*FF>ZqA_hg*kCGgx0?C%g&yeEB z7Ga;t^19S-EEptDJb?{$iVi`7ZJBq=*h(}iDUxmo=#Lgbr9SlO%&28M_KojZ?b4Vgk{hwf6G{KJ&t z-JYk6t~J~ce!%B@YZ&K^RWIK?X>!0VUaVy-Sn&{nv?)2j^&+2m{@BvP-Ru zrP`tQ^feW7H+C!vO3UnDp73Ec?c#T4SaqXC+SmgFnk%=C_J;I<32(TKwNrQ*l~{kg zlR_wD{^%`}<@MMmhy5l)u$@XMWR z+y3S(WC6&rq3#yUhz!PCEZJianeA`km+-ZkRKuDW?gX1^H#YHBQ(&%P zldGC*R?v@S#Y2d;nAtmoXkVu?{s;%N$Q*JsNDJehK6M$BCuQ0o93Vvz^|r@W6BprC z%+0*2w#0uGGj7jfCfwWGi1a&g8KAj(xe~|*Ot9fj9h@Hm`GXVdqkbe>C-!Dtmnz@z zB-(lgE5wA}bf~or=@V2xXlk9^GGLiVXy&c*0ct;3C3g}vqN(*^vU*JhFLNYKfO$Q2 zoc{G-98u~qY+y<6UpOgNf+=?IO8pW)CoFGHP~I%RylbqyrOTywiabIaRAqoger28n zMFc4`uO~Vd-7mTM$DzA|KbFQAF7i!^HvY&zQf!hxGFrl0F{!ptjyb-@Z zaW2mdPtW67(v^}e=}kflswZo4<$lWaO0;j1ZuFI&rLRl1KBHp`mzyo} z4NiEHp;wtaxXkP)^&?*ykye5)dW|;8+V^hcuwwmtm2MQ zqMUh39hs<0^%tjKGL{G@jPsaspF<@lYyw(DQKT&Bc7{RB_>vKHGgZ8{&UOq3o+#p{ zidRR=hgt!CX=|B}9XgeiJCwR?lk*pWN`Kg#Ut{_}OSP~lDn;p%)Ka-X^1$hI>-xBE~{Oy3K-PodYStO^A+?|#6_%_)jO+l;D6RTP@ zRF>@#@}%X$LFG@%2Na9#`VqUfN>6`rw_Le2`U_fEKsD_6o*9iY(D^o}pilfL8VG%~ zPhh%1c@dXi(a0GB24V>4lx4D^h1kmY?J=yj_NRBK_k19fTGcfzo( zKwsAO^}*T!uUiBFDNr{1*2!N_dz!kzpds6SPFQp5Zx(CEpmDxPJjYFK3#8}?7{uUOQ-JEVui zz2&kQ%6LiG9QT$V4$jh9 z$PSz=NkC&}fAaX4FFmXZ{=K`_XMiylQ(8YwF7}3#{|>qQ_B#1xd_d~^ho+O42~kGV zwE(iEoMm!XE`5PtT~kNbWQK#{MrK>ZyoZ68lL2?hbxG(qxj3*YP9ccn12MqRi&YZ}#D^Cn+GhA{Or(tZelly`-(`BrMc zbUCBw6dx%Rc9ba$Wm!Czd08N&Xf!c*j&4u^yW7EhleF1>p8({JEJml{*%6l)~rF}kPX@qmagl2 zV(q%>IA3CR4m6gte2A&eo$a{AfVr7}&M64DN4^U3L|thfzYb+y-%z|KSfNMpir^W; zHQxjp19LVSX#+C+_zX~4bG!spR7hmEPt)~iWHHcl3VkaKI|M9tzLq>T#B5W5=4)P& zb@e++@_sgq{VUJ_4ci%peW)bQH}>+Hu3<^Bf-|)YG);&!7c(=u8d>X~Pq-OK7WPb@ zVE+}WDncrKE%r`Af*BF@l#{=Objjk7K|DKKpKSPN%9+Ai4&V1^uK5BkNdJ_o`D1GA zo0*lSx_2emg|*5n*1mGC$n}L>BO@XhU2rVj`OTU6$-XK^tN@|>V z?)OX-l2P-n?KriwWRlY`Yv_KP>b33ng znU9vYmk=2^D?(QY6TD_`PF=H?9?j$NH?Z4be78_w=vVH#WM4_o=L6LGS@dQT#hX_M z3i0Xr#NF%S16EXWpR`MEZXbr2N5#D}Y7;JoeIen%JeWUUP(hQdg$HR#JSbYuIOUVb zLijRm*2mf);+=eoh0O72$Im03oStJvl7?=v|6OpTLUWYu8pKy{T8^mI%)3hx33aRp&a7 zK;GXzRgzmjFy?A}Db1&!_Cekzo2Q@4WId_}@cxpz{X4lGmpQo_iR)M_ zaU6X;rS~}|f-`u0We0Kw%O#czmo1@v7?Cl(TC1B&HHmVq%PEakT|!&wip9vR&*S8R zN)bjI1QU47?1eldIT>pqJ*)AIcvapN&jia#5Qn_F%6(u9-z}&8$JST4Ee+ABvLd~#rgZHM zE9ux@$bg#+tf~Pd< z$=*>;?xzGKy=Lb18?rogP)kBagj?n`>3oPYS^9!6mx{d4pEYOc0etK_Yo!4Mi@tlq z15&gd19V3^FwGm$8Ea+7gvi>xQx=QX5AnX9bn=~@Kj`GlV~L!8)TS@&(A+Y{9Xd<^ z5U~$*${*C~B_d@xA?5tSV8OHcf)W1~aAiy-BV#JOQXJA`g$?2$3ajq@C>{E$-tQp=2VRRlr1yJB?~%jX0PKmS3S)Y?^Vhb^ zorSFQj;1yWVf|s3x7Q6a5;ACvgf=1J6+0z1*MLD@9BQd}E=@(rp2niD6I)eJte;Xf z=4H*Dt<7v+(X-jcn)-Gf>yo_a9qeapW19qVa7?is)naek(tjx!%uOTyhOmY0HjJ zgLJREESRB*m9ay8*SJ2x_1Z2!`-!-`*A@4eo;>%XPN>WJm+Q@m1STdQ#bb(m&k_KJt<8?EC?SeB@&wl5g8js|9U= zWhAtMWzuomFKmneBUMmT`9dE_CA}1^UiiUHE0U_A;1yb>9dxiTkU7JZ<)%sjY-BNJ zG(_eTlW5HtzG{E9pQ~?DCcPn}19?blbZrIn1yEAw$V#X$Z<5e4mC$h&&{wUO1dWx@ zgn^-nP}Z;|{SpM3o+3o97_I-9`&1;ok35+e*(*2&gGlIdaTR4LnOx~>QmA24mQV7u zJKXS(3OD|};;}14FHT+z$Bkf50hJbN^yxm0$z2T{XRj#phKdhCz<&XJWD(YD4 zdy_rOmus{=BoI6g;GYEkk(+CkA|h!7A+J}C4C(GPZ%C(&haWC0ZQ}iseD3e4Q_?_@ zSQ0_ke~UQ_^P?r$oO6EusGV9wGb`4BS9hD>$|!xwVfN<%cQP+El* zL{&9mPNjTwR_t66p{;gLKTChJ8bwxa1YiBGH6fL#+#g><)FsDj=|22vd1sHI<5FwP z{kl@qBA;dkWc(0QXIuFj;Jn7FF|bqVn4nV3vNcN_Zf7r?r;UtxR<Lz#U>X1NwLn-ajf5%s~@G&z+WcxO63TM zeBjK{!UuQ+C{LznWCPHC$|Dkv@H9<#KhRhW6FXXiMEUG9$_0|6#`2yEbhL(j7U+t@ zq`WTx&DJon6SH&=0nO2{m0{R_fYUD5u*ZNb-B4(xOEqk7pg1jyM&dwMYS>vomhN4k z#TxdnFl=8I)eL@kJd@v-YCl9N&n(sC!g8DPs~!aUp5}cR$ja*kS_lUx8hIPYtjHQb z$Y=8tjoi-fqUQJ}(B0Z9c_Q>?t>foF@6d{9}#rfzI1SKv#jPqLI%7 znT+-kpj)-%$ARKn@@AkTbnJf*Wc<0)U=X~itv?HBn?jcWeM$3P17!X98j$7vCXnTQ z5$IdmsyBeXs%_o_D$(Q(Uj&+~rCbkWrQ8l=rTi#Nw;AXwnr`-K z20cAMP6Tw9_Ty|I8}XZgmTTA&ARB}Gfou&u1oTafT?u5f|0|&DbR^#dx=vLu>b%Lz)Awm?8<4eNH@rAu)CIh_xY(4x*z8?d7x(7Y#(h56lgbhl z>iSzO9DF;ail1MBae9C}eRi9#PN=SzRiiq<*DpbN2AuTDJvKc9_QCFXW$6=rDUC{y z(uWH!^MxdMm98e^+=qn`k@ccLA?= zWP|<;kS)t_xWr1P|`08+)Tap_7&0g`rb~rMb(w>`8%6|d zhF~TTF?R<73V6nq(Na^Hi)oCF&wW5Qjh1EnBOqH?Yk`*P!rBP*kdB$0E;eT2NLBoZ znIZ^gL2=QcMG<87e7Mo@-oIGK3-{J_SyZCx-0T&Fm|7((O+}3}2~4`{;%H-Ha3q4p zfT4=8k+mFfJH+xN-q2W=L8WWHaa6?}Bln4J%7Yr_wkWsTq`N(!M7h*hoRb&He9F7D zE@WDrvJ2A+)vi5N;`7NSZ<(HqtnD#X_YGs*Yj=c{t-5STXEZ#Pds1qQWcF66S7@s3 zw?vk=yOS1LAvKT6P?TpRyeX_O6gHr?P6{;5V5aubG=qWJUsqSaz(kA?^CzB7S}Az^ z1{c|YK0I8Jg!>FJx?RVxJ=mD}l-@{0e>)%n8itGP%9Q`!Esc{HT7;&!Ub+)RqcrPB zmnV0{#-LZW2dRQVb@HwBr)ppqs95;>1nOljt;+eDudtcxUyv_-dQ~1|t6S42`Io7@roZnh(Eoxy~m89^hQc{~u;v-&k%xj>1#)q= zJ+dE=VUF=YX+_*qftKmMSq$`3&G9uL%W+>A`vTCF`$)_ef^ko4ziNNLQ;2m7qfp5_j|I%7Gf)u@&+E)_* zrHSCHnysAzkrYR4@`ck0Z!c9Ch>^Bo8p8jSH`!R)A`XsuO9Vf=8*>|B&@LCa$z36c zyGfAeY`$|FVAE=x_n~t_Sj3KH_3|_>}IPxa>?{rUpGG)IEg% z&X|uOQRpZM<;e>LDtVC$3LFT(x?k~?46kazz2j$uhKfSplOl^j$)zQHieUHTppf*q zssfB?KPb?}*}Ials!5;&c`(#&8?h$@VU$m^zy3I+$5oAivC%2hbX|fn6DS~7x{22t zc6qf4WKa~Z(}u%oMX|4~s6#@AjugeyQq9;2gyV)iKlWjarD1Ibuvf#mTHG3rLAGiP z{CmY!6=cGU@XnLYR_SblPht#hV~M4?9WS2%TB{5E5FpzovItjem~hM{(b{y?D5{^m zmTSM?`pO0jtw-lemTQ{bU&{-C?h8rrcy^DhnS^&E9ClN4Y5HyY06zc2+8!}6zZbaC*CDVox;P6Q=(;OiE9<^ zI_1MZ6FAVcu+pZgK%e8N-E}vyM(6jU(=f2@2K5VesLNcM%>8SSQ&`GJ>&f%d7srkt zwCdt?W?t<0Gy4xlchM?)bcM7g_oSRJku*l*1K080u~@$e@>%pk0EC?@Y^SxQ@A50e zG~1++;nu)wwS0@_(r*BaPn!cOwQ0I3sH`o2kkaE`_7_~@{PENNs*qw7>pJQFihU%S zX>pt&H9<6QYRb2zj}z^Zp5PTH3FN7k)3HOV!wkCi^pm5*QFZERU^k-?UxYqb-o>lTo3ffWw0VKxG~aqRob`vn1x85?M8a zUw%qA&^Oj8a`NX}(oRyyzmnEf{C9&cu6uY(ay>a>zr2j!JTiH04ECwjq8ir&(GIVZ zGG)?B7c;J$+QOmktm06IT_|n97c2abHZtf4x3Dab0AL#5jInOR#<~AUHN2a0Ccj$} zV*>o?;SxuCm}q}3>URz#HI-0Z&%QH7A&pGk0u@&oxXZO3UGu&xvu6BmrQD^R)I80N zwwL0P!pDpHYTz*zSiqtwW;U&^x1>5#2{s9wqS%VM zaN>R}t>;#R;w&Diw#WP(Q`*3}AXLlbfaGaNxz9Fvs>hk&(3=oPEHW;|tpJh0m#R47 zAoG_~{%d|o>FztpqAJCwOpXGkH-}cz`)hQ0-&p6iyX&llmE8=|4(<&c8KvLS51#I+ zpF1p(+i^(j3F#NAFL29-B^%bIKgDGv9Cp+cwAZv{v8~KU+X%pLQzlKd&>Qp z>|XptjSa9#td)kz2>av2OD4jXJC~b8)BGUpKp*w=P3+|Vlg!9ZxT|rK@Fh!?jl?G)SvZkzKO>JnOUkFc*kox zd8o+PPI4ZZv#Z01u`p2+wj0O=VVEck->Nr@6+n$gNFBlowL0WHyg_d&by0{X)@n3z z5YT3A{joq|$AC#CkU7%004S?DM8)_wn(jUzBdvZ3Gz20UWoRH%W8MPvil%!L$VOuX zX{=R~flQ@r7SL8rcR7%a%MBq^05S&S9bwo{fUJ(616dtyKvu_#KsFj9IXi!+B_9T4 zB~J(;@#|&`%WnhSrnB`d&=$?{`!L-YM#md1eG~l}>+hvNme&Kayuy}UqUn?{3<*e1 zd@(D;w@VTvpOhVoBOJX)2UsYeEf1v;C+Vae4P@Ohoo)Y$SFa?gc-j*CMNSp3QEl@xYtTj*FLJEoMdWUkBSo+|;#mi|G za#?AZ9_dr?NHqnIR8uhg$M*h=afyy8W0-7E$dr*CQzigKh`oj%{8vqx!Ot9LcrGg` zI;PBr=#%IK@GMEn-#HeRlbT3*KY#GuCsL-nXjhvCu`0hWsQQhLoa|d^Xh%-2 znewkACo&5W;E{8af?NgBWTq4H36YE1`La&H)g$>8jDZ|m7S9p6gb40e0ok1@j()D$ zeKVxGo4wQILU>G5!*z9;cay#$*M5*LTgV8BksiQxwP#b(w**VNpQ|m8TUAvZNe+*@ z*VH9C$Uqi%R;@6V5^gO9VxxN&zpjCJw=NImBv70fcvDwzK;{Z(?NuZ*am1Gy4}<;- z$gst5@J3GeudYsgrq*`=#Nu3-!WRnkxoC951Qy}W%Lbzs%)@rpQ zI?u75vsB-DO2EcE8KN_|yW3@ROmNveI3S6jkj3i=L+leAIJPu>XmMn=Hr7$2I_#$S zTHba8y)yM+56E_(zOvf#cB_m_@&Am@%3t>d2b3o~cgl zdCgfF8=C8^iFhwYkN!ad7lY5)Gy3Tbk zd~%_DIFm&qSIn+vVqe;{!rsyoe}M8%rhm}6FRhE8vLb>5jkuQ_L3OCVh;CR#&!POe zpe^m~rG6MK&>=}jcLG(2@+3b=`?h`-8^(OnkLeSrg)rO-5>s}+*>$mc0^8IT=Y1)ys+>@J|o6p};NV*N*YjaALUN#McC z%gPFPuwUlz2kX-#;N3r5Bl9&Ruvwbd@8SLv?)~N`;O7o0y+hL^zAN1vto(Qt_a3(8 z=JfGOYz!(NDIbRgocsfuj9~KpUxjaCbrSWz@@ikTYan=3 zRk}|;7kT#DBE7#}hxAS$+mYV|GS@Z_0Ywjy(^7=Mm+Dmh4#-^F$mTNFHhQd?A2OSW zSgy63bdmJXfM2ch34IMgJ(M{sZ$^;-w`1PqdPuwV5GZKmLw7!>x3KN#uF8}}v6&s9 z>(9+ef!uQLY>(IO;F7IsKfzObL2P35fM}?ARIxm&(RiRB8$+;*u?(@lu>d+8f-(^$41KrN39rMU_QEZoi;v3 z@GNt=e+Ndt$ARF+brP9WbW`0gI_xlrxXd@iKj;Zxj#XwJQ^yh54uf}M8gSkUp+nD{~64HEtKh))# zR@r;ff)jAJAPtVBj~c&~D@t5ST4afaZ1Ee_vojdv&M9MVArz#hXGwaK=Z@c%iSmi&q=n!}!TH}iKV|9gT1a?;5?%U3{n++Rg_ z*tKbC!1OJkz;OBUzP6o8TfFR_LfZDy1)LS(ophJl)0YG_&zse^GqA{a+mY*6#RHEF zKI>GRFl-BsRXA+hJGj6jtfA_jGB-UlP7{%?65lv zXou#V17v&pdZ0h)LD^@$aP1O?I?p0_4`ivzSt+hyufC>oOZX~2lkrxGpF-j9AyDJ> z4)8o1MABC-P(rJyjx739-ZiymLAuV#i;$BCQTvMpX>-G0nw=^CP!X(2NmDiRMmE>H zm#TTMdF($j|5*~c4ukmF7;4H;KdBdFIo7^HF}|M--^R!bJ)`(!hv*#Rz)j8}|3<9W zcV8993M|Rk30iLqoOa+)rH|7N6i{nap1!mrs>MGuMfM+>fNKp7Q*{iGJBU&WzhV$rl$}WHw?PT1 zWtT?tY^PNGLIDU{HcRH&Y%F`{llr=ogfERL3Lk9xhK(7y8qXWY4j-o6D4Uz)dM_6?}(TBELm@NPHO(dP7_q5*PM z?gk{Q2bV7)@t&em(bu_xBx*`{`{r(75l@PFcgZ4be`^5l2zhTW8VA!%ko7x`mBK=< zun1J^3$F(u_uSW?sZa04T}M_~eR$&SL$ebd?NMofIEirAt6L8_PpK_Z5}D_T04CD> z0g%wH(a15x9;Gui3CQMA&!lRGo!)zHo|EEu?HHs-qqn4+?6lxo#?;A+I%G(lNQG5I zg|8(xOhbJuo*F(l+vF@s1r#Sb)6b(Yp~`8ZXA!7JpefNT%4sjhyroj9>ZyeEnNtw0 z?FXY7OuTND^19li=}#oN=`$edV^XMbrzXxCId3$xBNSCvd#w>uB$v`+6IHD36fY#N ztdDa8!YEbM2h;XL=ArFhfbi{q*ml|LtJhPXo^eC$jC1@p=@4!uF1KT*liv&wj-_5O zyssG&-kjbuCX3Bk`cu-RynXl@!q@$LHJPU)4r3(paw22OIYv4h5^szzNRi*+aw=by z;)X<@Q$e56^zB0ojt}}g#^+~ONJ|w=GGAzax9LX3P}F!8#AvWtaxoF}dvkg{hjcu! zO$OPfw57x4DKZ z!y*ZDUqj0EiCA{$p)u#qwP@q?k2zoKAfHUCsZll6{vorLRA=+L-wmQ`_Hr!Sv&Y;| z#Qu|4vv1_7KHl~FK2P=Sn0Jq);$6Q>B-PGX_Mdw=w_Ni7u=g(DQB~*S_e?U7fZz^_ zg7*QV67d2RD-qOe$dElc11KQaicOCdFV#~GGk{hhVJ492c97QlskYR%miE-P^n!pF zl7IEl~As~|f?_F!}Ju?Z=o_^o+edl|gk4H1_UiZtp)_T{w-iwqY zDQ{H%wT;DMD@lB88w-USsdfzHbk3r4A7qDlRy@;J(9ls_`FdNaiKT7TgZ#hcEJA9X885hpY)oNyfNVM4@x}>1Vj|Wg{sl z%0UEgz(a%Bb#Q+osrhA@_hi>SL?4XgJH%wCxNo^=JQN~QcN<+}p=2F=0UcZ|`uE)~DZ(q&Z^02D?XpeyYxQb{ECpJu7%#F`w2X!r ztV^iasX&@!xEV;BS)T)>%X<^;5Y6Kmu&@WsxqPAQ+l>nmfS98O#kwI{>no;(5*kj}Ol#($WcL|EujL{RP>oGEZ|p*Hg!N~V;c zjOaCoFXieZm2zTsQsHgEEgwJ9@T~Kc=}Cr4vpcV>e|?FDgIhY5_SU??ux<<2e(j;u~6>inL)(ln8e+ZB=(U+ zxVlzKe4X?-G=wIoEJ;VP3na7WZb{FgN3kQjifgiSRGtSk zOrhf!fqud^%9#M9_rnGtec+0slZN_mkZS03??@f*L2?`~KUqq-9!Lu|dJkm!h1Of< z_z1H^76~)ZldaV+OniU6{1-tjaBn7(UU`7Zkx;ahBdp!U{?>HhJLy2Zf3sQ9Vm7=3 zfwRC&wBQJLktpjNY;ID&XfWh$duw`82=`^Ze9}ucNSTS}FyJLp`p4_5=31k&O>PXQgJj;B>Xno5y}qP^n7X8{Bkp%fI6Wzd zu-{;FwIro4T~ltCRr7Y(UH~onyc7nrIzA{PHxu0ddO=1~EC$idWhCid-$PB3k17l6 zGm^q1>{;hSOGz%(;&JdBIAjWK7ZJ`nh+a5!VJE6=SQn1j)`Kt=gQOL0FX@U29A7$)m@#nm9{KZ)L(6?dQ!O>L@ zJ?W^YXwbN=KNZ^3cDY5TpaN508r(iENGUYseyPx9q@kkL&Bqs43#|)ncqfjFZi0Li zkPv|&kf?;MM=a3j+b8>B<4mfqzo*0>zg`=So8>AC0X!?2vGBLQt65u&%M}l!#X(M^ z@kEMfU))JjTItK4r5#n_rihKAP@~Bm(B#^Fv?{Rx3D?FgfRS{3o9lB7x|K_DI_jD- zHyYQFqT0UUkJyo7(mtX#__49?YlY^n4T;Wv#^Sj$g5AwTlHqKl@yle#C_9@b%LiKd zzIs}j<0!|^6jf|bm%?bgLfYmroYBuSl20*=jIl~6oC0AzgAx>*(X40euRGHtUEwK# z<&`&04ns%mJUEKmHtn#NPx7F|8V=R1+p!DR;#>%bXRlWmwN9yA8Y5Z`rvG5O)IMGrh4|6MB zBD*EPv$ckL<=+BpQG6NOxn4yc6<}}Jn!mnisDpwy z!wR?)j)yUES;oWI5Gk2148mjA<$l!5@T9fh;GP?Q0kxbmBY8PRx+jx=OJ<0C+EI9a z@OgHCbh#z@K25VjyJT1oGW)PAxPcqVpVPC<3jRn3Fgl+&P;4|#qVZa0qR3sOm?!AA zNNI-q>Y!$<=R&LhNr3tPOwy(HJN;BidD~DLKbcy=!^DDlESudRh91NvK=sd`!(T>V zDL=XZl~Y#uHyISYR+I~r>JZMiGw|U=dr^3m9|;dZ!|)oP17(kL_uFt+ zJHv}<-_GD%12k%_`+)t`Nd8plo%Zz<+LaxcCml4Nxj3sgwv@&O=YGQEk)?U|?r^%g zyccDZ@IsR4?2j^^SbA-|pGvLOQ>L0%O`RH<60S6iMq%sdfeo0?(rzDyu`^m$%&^u( zCe?%|R)?opBe!ta^a`&AHpfLm)sc~#tUjCKSLm#z=Cf=LD(hu5(6o&;Q_Lxmky}iA zda=1Wa&Gvl>XDmBf09mLW{V(Un#J+ZKT>(au6W6;K1yZjP(v&I`I!_zL5k37UnDaq|LUJS09t)! zK0A?*%&6YbsVf)BEX&duuV#%`Vy+yh{ipPSl;@|26G$H4d5@G6NZTU#i^7*idG&DZ zO!iLf<9PdkkV9h~i@=xJ&9;uPA?)FeT&V5Ea_5m_^%7&{0Gvmi%Nl2YarC9dOI=^K z5#RWW2QsO>8A|jwNlB{Y*7&PvZyJpq^o9~0(`M)s2(l_nI+avl_I8T^HvILOl`Pt5uK?*1B;8P zK2LJHqo}3gfDffqqmk`Lwwjt_0&Qd2XMf^+9vj$fJ}b*-Y#(E>C@@Kyff6WZqXcH0 zz~dxP##aLW=mZ`wffS_z*E)fNBv1}=N%=D;aIge2j4JR!C-4LbltGY`^-kc45-5vD z0>ADAo+N>63@Y$yC-7tm6!epnrW1II1cHewP?*coqf;f2b5aG$#YqBBlR%j!$u0!3 z1O_GWXeUq*O#+8Vpy31xRVIN$C9up1T;~LyE`hL8RGGhU0?Q?kM^+UmEKbROh6F-i z`NsA&5=jZHUvTD3qp?3@oY~IsfmS>k$=<4vtC=L-H(6=Cdh5MxZ&#N#ijvvR#A(}+ zrSblI7Rx&f*dyef6qd*LFrOXoWKTXyp3G-^)W&ek`1-MD(GJm9gA7?SkVNivNum5@ zv`uM83#-&sfgImfeFiny${Me}d!Yy_D-Wa=8Y3ekH548#;_+hT@X^G*!||g*A#0zk)c%r52YW^`tiz-$Fp#q`{$++K!v^CxDO0@fHWo@Vwg*~Gb*}w9K!tGrSWiq3k*6H&jc3kExFF?0r5Z}4< zG9hHTDeoJLz13NaSAZ6rE3Fb%jqb-%FzId;_6U$J z`4>Pk4qy)C&35Vu_-cV}VFwNPz5z5_<(LbkOSvEDHWl_gFKhr*kj{HE(2Xkg4j`Q) z0W?R2*} zlW~Xbx6kal`X(zqs*Oi(GdEhg-ei9%l?g&L$UF}nKBj^ zS#x1V@^h)gPArq3^o9KOc`U~JoA{F2TzP$|4+2Al7S`F(b^lTc7KWerd_eyANxnI; zDSQ^POV9-mN&?*CrJoblE@aCtexSbExT9G1JwB_Vz3y6qdC-O@0OL}{^FCNJu72zn zgYhank{8vT51}?|T*KH)CtYDAKc+u~meifFYVuVf^Mb(ftL372LF9O4mq!$Y%;#mx z$YfQ@dwfN8C9@hXJv+z?XX5ViDqrka^#~>pJ2^9SoNE-@SsWizf9de}*sN)4Ys$DX zX*rnKchuZJnBubAJ2I~C_bto6<>2ZFv=}Pa~-$k~rFAq{Mj2HZ?q4NE?lwB`^>0 zt=WuZ$i3rG67S4wx5wl*8ug^ID@z953aFIE-yS-(yj^u`v!q^hsNneQ9w||kbPr^= zs(7?#(8ZZr&U&XCS=SYN)-Z)l?aQ8&*FlVdxWkbgP9|pX_UhD#U->hq@nt^G*6+*i z9?f5UF8v5dpG(J3mKGZj70@Tt&h#gsm1-aS8<5`PPX&#hR4e*SAiW!03Dl<2)dDrC z*qeZ~X^h!GwhEi?rAq@XQDF~y>3#(CZ58%&FYFnh2UOTPFKjE&!z%0zFDwJ}Un=Y) zFYEwN=Q*gVj(WRsa`LP>K)=PbE0rJeQ}7bO0G+}yDdmKB6wJQc>p{QqpsgO{jfmdU84Zz%aGT?3p&|I=g_Mz1hGVc7GS~?T zdLcn4WSAGiJg8ibiFt-~gcIV7Hz9)NQgW4-tI7#+6t>*SXz#7U*&uk@_Ozd*8G00C zkJHdt51QyfwH{RGK}ipK$b*)9P@4x8Jp5PN3x)Y=?rAQHBMTvlnCd1SKgM`^;VSaX zI(?yBJ5hkYNFK-1YnJf^qrA*)*%g3ujQ=uu<(K(K`5=BOvatU6koH6;-?9g0`?fC> zSpIq2{mgZHlsaN*ydTnlv5#LA8~qI(g{puda}(MKS`a_sSY0Z3wt$W*4LKxwSZQ;rd+JIL5#X+O- zr?kMTc-cy{GyNF1gEA4ELwN~FyN`^;DLyE$NNAFXn7gZqq%CfaFiTG%%5yZ1sGl-= zHyG~e*yAT$95^k0C1Qcq$N0nPyZn-|G+Ma@du8!ISrwg@|DY6j0$i_V=frXh=Jhr& z4wS`@udfUu?16#RKG=aquk7{={H5wg)lA`zpH*rh-}RmaOyKtETIEM|>K zUN5!awzFy4chJZA^sy`UpNb@Y3DNm_GFf`g6ln^Y3mGhL(K#6u=k1%r zGI3m+&`rODT$-vDxwk2_d{kT1{-UJ200B$p#3kN&ea*erYlY?khi$5hPK>NGTO|4*&kz7wQ%U)V9 zKZ*Ut#==D^z?xyD@5J5BW^3=Z>@oSzjK~dXo0BC-(e{aT@HZIS4K;p{w<`Y@D?Pb* z z@YMX$EQV`)Mz|#Ngwm1Qt<-fW*!8BpNJ-?xRuyuz1&-1MSKyDQuVEn)N8BwQM;Yamg@H2~`J(icojV-${xbw`S zDmKIFZOCV`?1qW*)al8M7z9d(HdDR2YcxAYEB0a%>t`q#Qre(|8O+sEup8_UQoO`5 z$Rt1()oY_2-K=4xK{m^%!dUF^LOPs~9XdoAwHrm)4T>U{14=_z0-eK(3i!SZG+o7B z??J19VzejV`wP&yD&40ZBuBhHzQiPghR*OHCH<+_#~R3IeW6fS4YlJhwYtHz2Nww&F51N)Uw7?G2Jo{#l7;@UHcsI^Gt^g^)s*@e{UJsFAOD3m?dwe9aP;p6w5( zR!B7R8NWS2jeh!@NH?u^!k#^01(B&wTK-bj@?L2)J-axn(=!Z@o$zboCZtE5*5~b( z4~tkQCm-K*Ld)O#CEmMCJ_a>i<2PGA>}@9gb{WMJc}Uu_3}%@B&F0ej~XKKzcj(Si;fbQ%Heu zK;~ye%xX7_E1WH%QX2PwnqISIXIUtH@-b%1 zZr6DPaRZC0n+BLI*?vw(1{PO0UFip_mytc()f!DHC^|-=dF;5B-Mte#$1)lNi<+)1 z3U{e?NT0(AHDv)0kA>yOrp=o3rB0V4Lu3auLOWbG8&+vn5%i4LMS?d?(>N?Pb5%KKXv=P{!TlwXbi8lVG<1-6 z7>x43(xz#kz~{(&$&C%DI5vsDh^YLDZ!3MZAB)wdaes4lGK7iqW&$JW3B_{NTGS*t zo?}pa&&VGn71>aq0?KUS+Y>yM7T@2RoK_OMur1{8Yl^CkPZ(If@%49~($!Zx&(1tZ zfNFmvmDLfkTQl_p(ug7&G3O|$AZ}*Fy1w*L@B_~8&_HZ?b~pipq|>@R5?ma=KvKzy zP^nZK;{#?bZ43D>Q6J`W#YF15;@G{M)|tIYML5-e;PSN}mbD!5LuKxd#79{Ex4bUJ zF^H;KXDoVvG}1yTCq5w4&ZnDyTIU?2om%_%rF~N8$nBAe-Nr)cGCtQ(GekV;4Fm=v zske3!##DY1^?w-k|J}0Py3P8#FYM|o^b3MEAr!BbF;lDf`^zLGrGM=E6pEy1;O~uv zpCEXUWy0@O=)fQhDVD|=jkmK)ORzJ7Ljp!p%z9;J@CSU#9?jLmS+}qjkcU@numTo% zHMM@u(g^r&25LT8AcHwA-0<0L$FM?9U_0-o#Gol$WrfIY_!To6Nl*66;x`rwr!taW zO0gX}U65W~I)kh}r0V@0mjB~$1+oKY z5fZYeTO;?-veLO684D&)x_;mTQUA_M&90r4F@uO=W3g=W&j+>ThJv&;)NA5ey9kP6s@`0O&&89Kn3mNf-BPGqf14;n~`?iVc zfrFnHCQ_v0t^BUPLf7eor=c#W-yxlqrbAt1&qCC}n~ZR(Mok9g$Yki=Iens!nVD4U zG`)B(rV{g;{RQ%58>FQocoj}9@Jh;*lMSTe?W7sKb5Vulmh@WTM5tMSguez=@gUk= z*vc~p2I2!8(!{K<^u;HbZGJomgb`obq6}x4;&GIIfY0m~MRmNtDO^?`1Jp(J7|XA4 zSSj756#6^7X1P1%y)!8xAC!7@QL}%S-6C7YKL*HZ`y9x}=wknxxzy`!642B>61EaZ zTc182oYk?n0TrtpKLPr0brH#(WaGHZRw*58er3M3rQ|Bu?p3het6;lVRS|VNr6bQ# zCGKqGcZMWwubM}Z&`F0l&KlmAq^`YNAtdeRgqp=hk;wLAyPynz_4Q=Ois{*y3z{SA z!k#cpsEQ`pzr({Pj4+lw31n4vSVp8H^O(R~tS@ry7@TL>o`rZVymGQ@SL9fnkd1a| zei!G$j%6S2|E4`*bmoBciSjOR%R?BZTX}=s@?3|@Jo8eRMQkrp^udPu4ypf2cF&=1@ z;G4F=qLBA(>k^4E7K;kIv@+R3@<{4;oB2`Bc3AwXH)=7d6#q>WE?Oh@O}sZ(4Gvel zU?iWBuyj9&p_X8{@^c(A{9RS0MReH)qW)XUu_h(QV5DMK{3lvnGWBWHo}-%VXjip` znyFngJjAquu2uL!+&9$FiGqQQ-g0Wpe8L}`B-Ha$WQUr~6tjPj5pCDqCOA70H>%PZ zywKEY&Au_0-()OoC)J*D^AIo;3Pu!plfNv;D5s{2+G;e6rf-oTl1|HrI)l=EibW&J zX{WOw1P>>>Gg@Qi>~r)MYYFo&bZ7LO9y6-c7?DwL*JA)rD)qKgwsnb|`3o*%FX1-A zF`H1!NwXGI^86*?jE~7%(TOyDmHf$Ullg{Yf}d{9Nxy^uEHBAKN}El$&7*r@;hAom zUB?$rt6VH}KI>ER&J)aQN#JcO)MR!K<13ox?lHl$-NCv= z`pou$qppGF@HENsigoa;$}tW|A6N}QI`&McW?kO(K)Sr!fX-FriKQN0 z-Y*AzB_xI%P+&wl9ie;+2MQI6DN~1 zzT16~<+qkjvH#11?79j-&87@{P{E0wm^Z>_eBV8l6$^%Q-mV(f^PFBay3AQjR>gYv zv=$P2$@eH*y|$#68-hD^W!zuV@nwrqHT~_3M3%2T=mVX_0=t$*`*%w)rpWXdy#%vh32kgv_vnn8ZCk|UsncMHA z9ct5BbqqyjPs`WLwpA-#`4_b@i0e?=Q-Iwdw(nI%0wsYomi-PWq~@~)NaMmQK;u-{ zPA^Q)F-}(V&B)#!wC4}BC(QGACEg1t*@l%;4gv?u`H_E>opY)pdNYf0>72lV z7F+t7S>DCX;B_d{Q^_E=BK~t%x9+b=Kz2}S{yax6A}`&@W>;W=j?P?nhh$X^p97>j zqj4kQIEd3Nwt}i;mz_C?#K$tKd1hu*$Et#yO?+$iXdrj$fd2}ABWZYim zwLE0cC=J;o%)RSG%dt8&6SWy35Rq!0XWCT(iD30&XQSO{+(d)~l!Ca8FY*Dge!B#) z*Is1zCqsZCdLcN|mT|TqxC6fCWybYa|d6F#7bX74S7v+jyGU`w0-TKA^FALI3e>fpbPs z3;oKP@X;zHijyq{HR_O_W>Gg9B!48wNXhksdI6om28$?|OArK9_?i7Ox!yox`gE-!j7a?7AZ{MZ%qvI9nL z&xp+pv+Lzdh9O@u!^1w|VtIMYhJ&&piEHHeg$&C4bKOJBsYkkZe?g8eZ#=Ta6d!K* zTquJD7brG*4&Px?MTT?kDV&c_!2*+4DOm)G;%|=Jz9$q2#70ZS7noh``F!~N@rq;O zyRn{D$Z~lZt5N<1JF-Q;@q@7(ngwToJZe98vg~yt+ovJXyU^^c66(cN37q=`i; zMd60`zUhdk7|D%H%ppWna)QNwirQZ**P_IalNLdhAigHWVHm0xiG5wX@Q-N{w}EW) z?V$rS0sc4^d!h$KV#@Up^g1#YJa3KbdSG)CY2`xO*zB-fCvB*PWUT^SoJn?mD- zQV;u9iRHJOkCi*_OP&*yh%I*|_G0f5+YZ5qYl-ynoS=mFiV?2t*%~8wHMn`>E7AWb zvsyA|-n?ZO4X@aIbF=(r&y@XmucTFuvPi`oC_qagXYtlVGah$r6RQgv^g+s z=BrAtMukyfn*>4^4CS>k?};tXZ6-n+JOsXxJ(klnSceV1eM6oJN;8e|udCKou9FAF zHyqlTvN)%3Qbg^kYs<^9O3e=AwVwe{eQ2Zona|~^?ud3BBj>cXRr(Jgt=n)CbECHpk@M9W7rzD4_a5;>t7ARkImb4N zy`rA_mB_kcK*$R)6p*u|x=BHGJ={cMktX8QN&*VYSHz06ZM*KGMccX_UP=;~gKc5# z(kZF(<5=O7qO;IjZ_5MkdAw zF+nuqAf6hG=QqmIXTgw6aTDkY7C2mWD=YEMVal}f_#le~FK@$Whwph=G3rgkm6W7g zVt~0IRrb##Nv2Unntz@ms(%fnk>M|1>=hnb$kWz*gEeKt7M&L&@F@pW}@gR0n0?M?%#C{jfZgOTz*cngw)-H%8brW^H=v{L$LZwrj}WpRSn+~YuI zDFvnL@W#&fI{g@sCdmpGfXlvBY)=dMLJ$VTBz zn(QEQ$*@wzYSHW!SPS7G6U2x7pB?X!W(ZzZALW@=?srJj%2EGIC@EmExC}FRQGdIU z{1Jta^Z1-)nsh&$KcUES_m)k9^YOqwQjzt6tBt81ZW1m0Xld zpi~A&h94D48R3R~!rrXw+@4KI}Kd{q_?;mfxdIP5ZxxzkW^Gt z7)Vo1LO(UAFo#*o1zpq7OlJKL8j1e9cUAj;!C$3P?q^^ZSi_eLI|?*f_34*3fAe}M z%SdI*g5lv+NB#KxXf42}-D z)?d0bEIu~k5a#pBeDNXt4EDuOc2f>+w& z#5*)MQd;UQNlPAF=0}>X{Vzzf>vPSXpqlL%)i9F6>dP~#;n)wkj!@@` z&scJ$BuOup7K=sc)zh4R)|v~Pf8o`J^Dn%{@BGUS&}?U0ZfmZN_6*L=?XgkO)LY># zABKm#6s`C~;32PuTe3yrA+JRJ>bvE`K-B+Mlz8KpABS5$93Ap^h+l#KE19u_{O{Ks zB(sqmp)l-!-t^2~@UGkL;|wU5|3b3X632wvQ8J(yI6O;+KXK<^K)J*Na#3jT6~c-ay0u|H`88jZuh^J&T*6L4rnOm3$NvDvUElCu)n1B3&yC1N%Nns3bHn zXc<3s)o5BQ7A*(vZDCXOt^O5jX4MY@U(-LE7<`y;7EWwg{o&mXI9dNyAi^t?|( z-OI4v%`>u_dfEO{W%JyPI_|n=5b9yI+-UzN=zNT3t79vsCq74zVc7C_Yskytiq8Zd z@|uIsVZZur`FkMZe>+0F@k>}@e;;l7u~g{b^S_x{Cm&>31CW7rc#;L0fT8w1Ai<1+^E4rL9tQkU~T{^nAuu}ErR z&i;e=>6tmqq`NvNmlj4FNs$;fjk4ZokaY;BTN&oi5?qln|2Z#S);4~K-x+|6Se~-F z##0Ym6+{4ZI^@E53Oo+`L@IoD&H!$_DmQeiWJHig1Jl{>v;9VH$b_39zY=8mZQH<)B*qt#20~A(}>{-82kV_3k4)xrlW?8?y zSc(Fn4GDEW_8G}jKm>4j+D-hKSsNPtijnL~5KF}$@2^zFOtJddKWjYCSahk6fa$-z zniNI36o9!DMR7@CDfD@c9(c}lWRJJ(UyCyxxfAtG%okreatHPHVd1n$<(9VGVmT;> zV3<*jHHLLXj;?bgwVjZ+q&@udX4+cBtMOYQdvdjD-!4v^s;XJZqa*OqM_8%5#j%s} zChhP{xriaS;D|Iwxtd^GJ=LO+m37Pm1Z*Q_7sjeR8R6+r`K40K*iMi(fY+$5-6izsfb zy3xmurm6Cb$h~)AJq_u8qZj@0QElCr^p}#W=XKuGAm>HFG4rin7RpGScxD-eb9@O+ z5wRCgJ6y*-{pDk^)Z6`$Q0j%NR7lpjD#y>0uP1BCsbBa?VkTVm?*UTgoutDH%X5#_ zBU=hr2bS!43e6$I8^^0sr**g`r^HhDT{%nP>L_){s6$!X`=^$|7jNL8LR`2+)>46` z@C|HhqI?oN3Aw-b893(%_1g9m61bzC{BJ&Z+7JTxM}Y20ln${-6^c_jE0&tx^$M6p z!fN}rcSB;k=@ve;O(-$(jYZLSIb~hu#`S>)%fI2$t{qr*f0 zsfLH3fU)p??v8L>3A||rVkB$E6611RRsL^Dfd9jA1u6+Ia6qmRc0*o@*sWwkOCwtG zVKhC#zov?4+~zuh$}}YsPPAcA(lM%`%6wYdj!FS$s->~V5*tbF=E1?q1z@%Xdh3Rz zezk)l>zib-QD!0KPBreC&85_2&(#C?Hiwh5EZp%^b{u%#Q~!F5-!I6}WBhU!9h}i? zB9)bxCw8lU1gHn{_vlOD!AN+ZRL%?j8w5Bn2yW%t$U^yg?}dIPX?niUd*;SolP6w1 zWA~D>y?z6n1QBhyvBZnFKKVGt7puZ_IUZoFcxjFblw9|ilg7>xrZu3i~mLWZREGi$YLn*md>y{I*@ zzE|c}DO)Y!vnaP<%>PK5!;HCi{wND3m^zo@dRQ^ZAz3V1>1;|pz-Z^NVxkeS6zX6URe}4xt6Zd;(XiZy1xqsBk*oax^5jw5Z zTu(;%=lJwSxCtvoGpNk1Lx{3ps7a!9n9Mi@kW$*D;e<$DcAt5!!bid6%3JDTM%5cn z5t}&Dc&hcl{SX%Ue`flT*sWm|o1ET##PHrft40ji{?lqyk<^6bDznkvuuOW#zs$Y- z@mx^&DT)E&QnpJXWq{Ho*R&j4dHfrhIJTpm{Tj&$$E!i?(y)DRx#m1=6tVRI@O`)? z#?LJ9V(^}<^mtz!`@T=N-Oki*p>YNXB+ygG$`Q&ze)IXXbn+E>)79mE=A z*HetK_&=~tp82bq5SNKFZZ$POV0jW$Vfq|rx7V6{Q(UkWF z=vHFgiBl)WI8geZ&Dp7>Ir5yjw9r4`XXvHQ-1sto<fPkt9=NHIhx zmE~;Vzu;pz5CPvshc-iB#U!5x;kq z*=NyaT9jQFPW>tSnu|%9{*>#YK&BIJCAyLy@#BTP%ZJ+IxFg?Gz{TMjomEJyU9V@~ zQn;Rd&3!p6$+4?B{BmQE{ar3Xhn7mizJG{(I=V`t>(wsUUcZA6`KR76GdD7yU*u~b zPsahD484XXgB;py^^btG*=jMtlH~t@?>GFt_Y{GC52VdjzYlb!lI%GaWY?vf3#83f ze+lSv6yHiT=kxy5yrd=rt$cWT5+pNehMmX_H?=Ahym| z{g~`Qe*;1!oOBIb0K56LZf~Rr~PO>_8`R@74Cth5`ju$!7uS z+Fk|HW~R3TJwitVzKPuZwejnFfTpYRz76yx1w8|#jWYipNE=}OBhWdjCYa!8+U7 zlu>`#@K_%VIrLd|E?;IUP_D$(h7~NUDxx&{W-_q=?uWu*oCv&7s_TKW?>eJ+zm~CLXM8l3-@AInlXj&Y0Sv= zMM)0hWj82x^^|mJZ08Zp>S<24V_fg)LgE@plAQFrx*W$I)El#`&TQ%e{_6312uLIR z<3J}WB>ORtM)=pfbe_zNE4}Nm*M#Z(FR<6RcxY+eV$yeS>o)fyFV{LpoL!MquTs71 zYa~9{G@e%5@htOnWqW9O&`8SjW;p#lIb-Eek-g6xs?L_>+~uC+lM4hw@o24l>~iDn z=z-Lx#K-vR4izlyhE^3y2l1kqt1*DPS zv8Onz1Ib~xKOFzw9U?YB6EbXFK2%p_9ylFbsatsi0R2Dcc|u}H;6ynZWqNc!^aej( z%6U$mCGxuD6eOpr*C8R-w#Od*C*4U(7V=1cViz2)FDPGYW0?bTv^>XNC1(jgU*PAE zO*x06HKMfxiPCDox5o>+m%-KsWtRi#z4HYiokN@==v_2#QO^_ZF58%ceq!SJUqHXZ zaFt%ChQlJGCpZ2ZQn^@YB%kI>X`pG@C>UevR8{!8MB=Wcdv2V=mlCCXhou-!9SvJf zO`*_>Zx9o)pV>hk_em^jA05VABf`37s@d$i5=WM6#aixR=s&uLZj#VX zyNA9gp?kWAz9gZ0yN7O;(9Z6mTP1W~_s~B|=>G1ZuS)1=-9xuY=z;E`Z%F9p-9z7$ z(1YDW-;&U-g3yTeex!U%I@^98wTEcXH{8ueug%&cu1$B3S;2H2Ze4D7)}@iONu}2& z%n4t1fxE@b^B!pm>wfo$br*0goXr6%4Ts+7yv?C+{^kJL+!Gfy33>zj#d)++FZ73j zGy(V<50dR-s(Lco3RDcEJK&SeO^eR;VUy6%7l5>+=NJ#F0s8vslH!ho|EfW3-4DTsF$%Ar0=ilCT&7s}-0Nkb*605+gV?$! z3u*QLa)a2qp|{b{|KA|?|0aXjdR|1=LvI2K?Q`}elxDT%&}yhpmokBn;XT}Dz~WRE zQXG5JgGr^20=XS)Xq*Rmb!d^T|0kT4?4WW-PoRB~e8@kj9@m10=WOFl!gYH^T|h&3 zde9>tBxa-?`S!-G^RKfS_Fslgnz^^8Hk+$o_{|gFju^k(5N^o~58vFP^io2~0N zM{aISH8nMbvE)$gZ^c+B{xVK$+24x~>-w#cueYwpysy|B3X15((aZAoG!v z4MKNKncNXWT9@^ndoD5bY~UGK)j}k{*{s1ahXz3DJ%9~ z1q}wePeIqe7#&_HFK0d%(_om-SL@iG zd3#vMKY4E9ZKRngkEZ?*QCb5iDn2{IOci;$k8GpQT4iOIn*=rRwV2o*eGq+)f_q|IR9kFNb zzW!&^YV-J>EOyJkHC)+T z_i41UGir?M%-ks{-16}Awhfy{lsRiyB=ugT;$>{|g)0sk3m>3h@i~s9@%+K6s_%5G z>L(O*i1J0m%_|?V;go1_zzMpy@7K`NO0_0-mKZ+4|rIx=D*z%dUJPK=?v-bQjIVcLUrMvM`L6J5c&fgsk9H9>kQM$%D16MO-A!<8?` z%GoJki8u$1uud+NR-}4IQuC2076s^;JN^mEi&H%#c@&Q`6ly$ORWz%mxzu>NS!`Eh zsB9Q*l;xGl9N@uA8iaL*?hSI=b2dw_N0XkQC*7KatK(?pi?NdaYkAVl+w#c*X?z&~OBv>G z{TUHpRU=W>eI)d>U_BB0d_BhDzodzUQmj5$xg6-fI7Pz)$UdFS#DRQW4;5;{6M&o`7l9_b$`SXf&3&?zj z%n^T93gR`B=T|HbjqJjF$RQ2pIxVT6IEww`2G;6GJ$YF-jn$i5teh)JN6)64cU1{H(p}BsGb2;ziGPOdsSkK0ko3dYWzIaQZ@_Y%F zJR>HN%Khjk@6QI!RC{I=`296uVG0aT)5 zX95ZFir-Zreb)a1NY^HM7CLMKB$N)j5lDxLtf?;VXqXm`c5?o$7!jw{>Qpw8LJ{s6 zH;Si#SAZ=0+j1O;D1DRk+#3Gv4g45OR`NGexhY~qHj$=`0gxSHf^rki=to5C`z7=r z%~gWNU6Thx8oJg_?;(el!QUFYLKFt)f1NpTB-9s#vNJ`BTIO(_nizJaE3`B`snBn5 zDvRI0N>-RtX#BskuE|tV%|B5|S*U_M59HDziWgTwj2yg*w8T$UV33SyvXfl!4|w6M_t)FbTt{*KkPd>dw|g#2qB# zmC87qkoZOwD@PfK&|s`q%oBZ1Kz1g22u9-FJku~#8P(^13s}E-a ziA7s&KP2w7(N5q#vOhL4^BZ!D-J?$>U(PVnZZV8RdYqL><=wIk$}UiO3WMXfgjcby z~( zH*7?k(ash3%Vzz=pkGu%&av#P#V-XJJvBl~-|pxQ@fYMUS#(ov1q5RW^(7i5m9DHhT1=jnpf;|3s;hxd+J`O{sB6Za0lb*Wth2YsVnm_T8w+_7ydrL7R3~?y?aEh~F$xZB1G6|JG zWzqSJM%js!6|yV9De1713&Zk63%fk~eJ2D={N&{Jc~zWmnO~B?$@n7~3WytyUWF_% zOKnRaO7?6F(F?}rmGB0aO($JY5DGcBAO)}_9i(#S)XE;Mcbr8R$x@7Q;qkiPTl8e- zyF1YQQx4f}y`81D33GZiHAHOHt*9Sg77F6$5sDUf&wFBb>{%pIR;YTUN$WPk>{03Y zpqkpFHJZrYJ51T_$jvB{`R=uxF~p#r{cVN6t-<&xR&GjtWh=s!U9-!bTH_~0>_uuu zTs}xY!qJjY*)^nhyg7hRC*g6_D1NzYj=j&0huv=`A-5bb>nA#50TDUPXlS zWEJ)vkUs2&vCedki-C?;v6lns9H)aQI(8(`X)4wP(y=RmhN>{JT2n18^X&yXLxpt# z={oebeziUjgK`rN;yKkHyVO0fF5J_grb4!#&}569KJ}VCEp>`InpEc zlps2)nEitXz^=K@EPcgjd_l6YK<@~P@cqVacHa2_#dn%x8Fk}_W04 zwV$3F$*&NcXN_FEn&lBQeTA4YmW(CT+XT;7Nf>K;%IK)wyV_Ve$WaWe7R5j~g|g!e zqm}S9l**kRH?<3A{tm_I1gikANj{oX)IPpSxU$-T0H;8BMtM!gSwRs&qh0DI=<*{Ts+E)l|{LG6Y{a)MCE(%wkr zhB@XD8+{^~^)L_U);}HknMgUx^!Q=Gj2{hdp<26j-m!AlRbo>2@pZ~>{2R0=oWgM4 zc(@_jTzunKq!p{lA7-x4Qw#k{AidD#C05%t7h%|oRP3LDzROm?yDyNoVg4bI&LP{B z&M^gOl*(}(kk0WvAZ_9Nhd?^VMxc=@-Ai6r!IEBCRb3uv-c{r*-<*YUShU><%vHn6 zTo!JHXJI^I-%_T=DV(@xv@bRg8%2^V|6+zU5eQNiX~Sl^BI|U#Wlv%SZj2r6DQYfO zarS++w3Dk4a!Ycd*QrYCf1ob&zH&1l6x91G?V zBl#Mu_2cGTSx&=cKZc1;663#$nGaRRCAm{*1?-@5zfi2BLKG{4ruKXEEF zVwIqpao_Q>j@+|I(@dI1`8Em z;%+md^{O?C z1`8rcvIh^{I*ErWSgP>lBem0aZKe?J@y?_#Q%K{qQB52!X1g~u=!&Kr6mxzrUGC5vFxHoe)Yy6hv_8>LuA9%8^cpT;t?o-#SwR7 zI1d!iIp8Dt#;aH{?W}W51rpQ70pGPikB|#LVL&e_wt}#RBPv$d$U64>K)sc~N-K~q zS!AZ`R1TrN!zzbx^K>2g+fbsmdap-9ID3#GTT?0Ka|^d7aeM1HGvarILyS!JRWa7> zRTjm|?`VE-YBWPWy@Ctx%JUqdx_joqy}8}8?<%uvYK1NdlF3TXg{d=L$d1^ZQD~Rw zm@f^U{SA{t#!822rD;GZin8KlU_7B?CG_r zS{O;KuGU+$SumYsmC2O&qGPPVxRWDUVpCCSdhM_L8PQb}>PQLi%8j5sv_q1L4z#** zR+2z&66t9rq9V^5(X<^(S6;t{gfNI1?L;;XhQ(Jn=i?BqrO(TXBO52n?k~i!$Koo&j&=%bRjh4hLwI3L)zrEwHw=g-k(9udXZZ`$ z@%8)rL#nkVc6>H29au^h*p!jV&y0lZT=4k^4raLV{~muuEL0_S2IBa{o4Gks@d;)t zX-lLy-hm#2D|zY~>tWc&z$A~@wHTxnPekiu76$%Gv=^c`xro6h6!#QrKBE2`@j&#~ zsQ+*9594dHXR_T_DQPTg%p}WLIG$~MPt6R5S!6oZt5AyODNBh|?#M}_vdV1h3I4yg zezCcw>t79|>hGf_WaefWE+#3QdMkhY1yyAf7p@^aV?~mA#-babFrxl8q<-PIgO(W8 z+oqZ;Q>LdbDm!lD6mn%QBDFqus`(5h_r!W9eqRJqL{q#-t*oitysI3WA2Q+h%rl!x z)J4}w4kEEfUiIZ8kJLO_NKGp1G?sKwy0fJ&I6kv8_obt^5FqYwFi&Sx>&u}KoqBgO zQ!TmM_)nynSAq$d$APW~5Q<-)hFY&;Jwx@Z3i|{|GZJN0XuoOIKst6dkdFNXNO%(g z-|Y~kdY78-L1IQ`n%bp)4wSb`<>VI}cQ8SrUGm()I5y$sGD}QPcQ7Md-r7Wn3GEJM z7|md(noy;F_1km>u;!7<#Z^PzHmO+!`I}*gJAZV9)lTQx7kn(lT&xGHO|MX}N~}V} zZ^8`#+rVAO&Mv@AX3YqzqCHl{&4?as#T;?vUd(bIR4$WVX+&|zN{tB@FBpM0 zz7gRu3x)|7s|nBR8{@}jCtCWg_E&x#6uZPF^s)Hpaapw=tfB6~dqTuM3f~TSObXWy zwYq#MA@6HVr7AF)j_R5G0g#@*-vM2xX6-qkyjgQ;S>;3L!Mw52ep5UjIx5}enux`K z*a%+?YMA|b{s116hGC(vt|Q_%Ve4IqN1NOTt5O_KdlK#`3slL$QiY_8$Y{5RI%pLW z9qN={yv~C;Cg+D*pQ~Zm%iZvpyL@xQ9`yS9U+(JCR0y_l^^c90Gl-I?tTQ%t=+9i>-7Bz1aT`!Dm_A4z>t zO}c8mGwHGx9sR@`*QHEH(p z{6{1XMJ}+EsQkST1?Ypn_aR23uqn;@v4eaVM-uR;M;@T46pkn7anI){{vDy*CJOx0 zw@ddXb>UuTq3~y%kS$$wXmnQC@6u?B=|D#d$G-*rdFeKweC**oAp9 zz4BsuWB#ONhcsbQZ-V=c4Eb9^sSOSdK&I%;8^0d;Q3--OLqcEQI6hRdVUk__f{(>& zBp;)dQG2waYL)_1${-xX7|EoZRjHYb;3tvP9t0O6=`V?jBonX+2h{zBh!^VfYcB3L zH2!70El)k)A5BO7;#;OPTAAg^JN_paQM`(VQ%IV;#R6p3BNPg&G;^*Lt_6_<8yY|6 ztZMHKG0_F5sNcxu#_ej2BNePxWuXSw#WeHyvjnqEAnhl<9_Xv5O4wqcX+s2(`i6Mx63Ioc&QjVY52}xv z$85Hv0DX;@V%XBEM>QqN2AQ}AACu`q=i3Jvjd;($acNO14 zmtx9h1l^cnu9l8PD_WwsR@O6c7?a+1zDaL=1m;agkeP4|dArlVi^^suK*s(d8AE^|An*dz*L0 zfUn?4Yj}SboI%&9J8aR2{Z$lH?=G(uv&`4Jrb%2=Ujt>(@MDI(rJFF1-#)TSoMbC; z|I>2f{*sE@f@fvs&tWC_w6dOXMj$>YvzvBdVBdCwjN~>#;Jhp&Nw>;eqbtf|2^=|B z0rE+5^r$mua%G#SgfP{-C<;fxQ$o}BcPEvq2~yUWCY31|WQnHF=^akIaQP~E?ZL?u zqlKjbSqEYNOW1Q7AqEdbh0IDnSVo-67fCM&M$(PqJ<>|2C76e3UAmJxlK!!H9CEeV zNjzDl5;wXkq2fP;{$vaY?U>abdZmAt*hE|EM*%kUrr&4R3`>RHY7gx$rB&^ror8UY zS*?v#szNcZXqFknRQ<*PKadnoQQT!4Yb8x8gv=gl$LXuFH8qLgnleY$QzUq;Jb1Lo zlnxV`v5KnLNnqf+Ku`cDt!nhF>eOu?GAI{`k`}v52$SgSgtDuPN1bivirFfitE1Vl zUQn%ohkFr4-bM`p-;aQ9SC9ye>N9Ad2StEBX9NR2LGAqtx(BG30t3GLys#3cW`Qc@ zSfINVBoA`X-=vevn-*Xd9^PxmNLayQa6LDMQivk1S5zL3sp9Z)gr9TEXl>s=REClN zkk4!n1!=S|J;}MK%`#J=B0>XQQ=;QSP4|?VZK3{yXAyF=>0@g-M-s4;JdIBy0Z*2w zvNb;WIrWs+szFOP^b$Ri&}3+%TUEYDj%e#9ZiQ(PG<~5R1 zZHCc6Vjm8xxL}=0xcI8NU;C=sY*p@$l_Dl&MesQ4-X$ISzwk-4hQfZS=!Qpu9GM$! ziM!$b+i8`%tvJ_~)bFEscSK!Mp#^)Xf3?^v2Ok$hbHx)X39JG{!PiUMotw^?6s)oFVW1zY-pVLC*aKNKS!j#N zmfaw9fo^^WO@EK3|FvIN$ava1hLsZCoeI5=lyxu_+Ar6)dS5*&=C8UL@;Y`Bxy=>l z>7hxipFDHjlw37(-_{SHS{O%*D(mMDp)f2vCAC|_7jNK)3;1Xx(iaG^Ab*iy>d>fL z1Nsf986kfJiA&7(nkq5~3f7b#jqu3RRmXsuH5F!R(r^*g;rEhRq14<;Nin9%XJYD3 z5|}EtDyF?AC`Fj*iB+1slX%uajamn0TTSWt{80;`Cbtl3g2vP1Wf|1SGN{qZpoV3j z@m+cJkUg`fM-LX5s;@h~o2#n{=SFj6ls^@eKSxmh7|Z{#i}H!i>Ugg#UNSa=@RpP# z$RA0~sme!u#Vz<5ks9e0@ma|Jy-9GPmQxhYuR1`#%0<_+6rnD2j$N9MaJq*$wj7|Y zJhbC}?-V36If18pCL;3O?=2|J9hsb>=fhtuJVj3-q}wTaoEnwabEjyoK5a-K(&RdFQA)IUPDgyYEwn>MF7+#rRL?AM zBTBrg|5)l11DkMqe@uhz#oPEht9`MoNCgO|5E6RF`(4c`6^T~!Wu<+*H5cAIA;(lgnj- zkR(mMNiPzeM;VLH18^UiuJ5z(SOvYsN~UY%3R(K#Lain z2F}%X!LmOve3<71ObTAWc~bQ)VK2(8Ag-WOw@SC|@nxAs#0YP|{>BVfN1R|YeQ)_6 zA=wlAzH2NV!P)@BjpSJXYDkkK1!_1@L1rUa&PV2Q3RH2hMZL_A;o+*Z1?Q@y(6+pa zjD**h}dt5^m1@&X<^u|wKi+YaVZG?6oze@t z3_hwInN0VMVHK@ni*xM$W-gRcQZu=tBc%Szdg8)~&#|AmoH56u@r-afbbtk3YAh6a z4QthuspeHvv8NfXtl=en5_4!aEC@^qe<@@nM+;i6ni8EldD_$oi1Yj(>fQy;sp{(c zPlf=4qGu3PP?Vtpf;SjZ%K+*G5=b-=yr5V`u_(n`i;xIj&_EI(o<_7@s`hDZ>y2KX zR(pW~E6f1S0JS>Mswl0Zwv`yGXmuDsng4g~b6t@7J~0UVH7e z36Yiaq|_3bBjp8AA8TGH&q@SBxoN$vj2P*Z(PwC9j$e+KM#SvWW~avHsnU;#t4%K> za3GDYQ-hQyO^n}5*it`D22bZXf*c|3jHYwr}dR) zU_5OCrku6L%KVJ){jE0}xu?QOYyc@LcYAzb zMR3vukt(rqI-xwRCQjMDIek>YmU5?+xgCdSy0M$N3qos}%5i{&;6zAFW}~FVpiXv| z%M#SKFj?e)(v#UboDwKRP%`aN@lW*BK5-A`3Ihr6kZIP;9>oj14-@=9xth@6zCtZ> zi@1Mhe26Kol@UEGnt*dtjKUq!W?s&ihdUtJ%4M}bBws7ugot0v$Th^PKTe!3X5@H$ z(U_6*tiYNWyzh&x-t3goIfp`%G}SHFzxMqlDjmJdEcso$xm;Hs@}ibK$-U>%07#?kUWnN z|6YQWkPYR03XkFZg<8?&l%#PWFPvhTQkp*0Ruq@u>T>xz|C8PPSXt4h5@l>TTQ6Cm zW}p8b%u>?7SjL8ykd_NOx(C74@JqhJXgsxCg{ro2#p|62qD3TpytH{+%o>SV))u^- zr_{0VH)e#J1Z<_7glP~byESb=+Qk=1PT?^;LpE=Dcu|Yn+OSEckbv_$nZS1%k<5=l z_ZlSBQEev5n*?ezaVtpf3OyBNUni(v-zov8MbCNK<|mq^Z0KlHF*) z_bdMX+@!o5q%q`rtj6ff2z%4`)_~qKd3*p;z3#3ou6hmUFp%nXF9&^O!nJ_ZY(^{S zk0zA>{Ep^v21xT52U6d2L0a?6L0a=GL0aD+J*^jk@}Lh)9xs42l~+I-_id2IeGjzr zSgGYdL7K{S3`4cmxCEq@9Pb4^Kw}1che8IlmT^$gb=&NexW0{zX@ z?H-Wk@e)WaK8}ItsP)O4L7K{9ke2iwkfyi7^Ihw?Z3KN_Qr-m8db|SCJWlBDrgs`h zQ#l=^y%hp!j2K8`Tm|~RNpB`d>zfCyGj8{T9x~`*&@T=8sTb~dpkEocM$hdP&`ZYc zP0&vaddKtq1oQ{v))n%kxg7;+GHydaj~i6w`L;VAyJA+m15%K)$SHT>?#`c@N?+ z^D)k^Un1w_RHaP63~^mHuG8pBwv?pQImq?(V5SLz%aB6D0VkC7WBJgLoodBY!|J!0 ze7sB3f~;?Ma0PP%YNyw(8$we)CFx1K^J5xDH(LvYnT^!?KA8{c@%!>;HCf9xz+kMm z7G&^2F=9{E26rpCZ1WgSYY%8jzlk(xcXY_+_|=;qdho$MQErdPHLpp$-<#wAv*2?o zLizI=cw@79Ru7Ooj=7mzUp$%FG<&&NRQFq9PQ)zSq!Ty+(y4a~NMmF{I^n47`QGVsB=>yt0$~Cwl5=ch zNkRC0x%t-Y+1_*manG%mR@JixJJM8DUJTNPguHaY2NFJf7PHp21A|bWhADM?c%1G>a0b4cdf`SR6{<&T`U!}Cp9 zD`)B23zI?G3)4W_3)g^@?9ByfFG#Ze>E?j1jA5v8yMr|D;UJBBH0V>aSPTMb+%X_E zPPxyKylLwfqBhS|+B11=k}G(d$w>@o9-SKHOY~`8D7{^7Wql;#=tLAGJ8U&pZAgt6 zEuHT#ef#|hiJ#+cfTKOjuAzJC)=sTwBs({RI`MJxLoJPXn$QllfN zkwa%U2P+tb&T3r#gsEV&Vec& zs-Ve5y)$VmJC4N6Hk5)xdpedo@hxY7$zknOwwJER7!p?=&TL2wg3j@K)BD9SoR6`d z?ARxbRhfecZW<(#MDq}!?-nJ zo8npKq*wLyfvpX*Y=&*<65GnIdM_6GSH3YBcIh7S)FrOAgNh{fFHhA%d3yuBl%X^a zj*3afl!}<6B6+)u`WC7n0b}q|OI4SE{zj*9r5&UPNqLZ}+dKyn8FIk)21sLcrfcfW znl5jTDmn(FBvmx*m5|D$dfJ3L3-rh+N#%S{t#SJrNYfK>+A8Cg0%_a_J>Q>$G=^Lf z(ilg>5#Q8b(i;u>t>yvJxEF#{A?I=r$t58r3G%q2l7wG_lq9SKZ8xc`0Xamy0V(|y($EFSq;J|Vy3;r3w&wV1AkI1%ZwTX>nB|>$#`pUQT+lpwHDF!o<0gsI_rtIfaHe!B7B2N6C@cav z7Ma@_>M9;t%W#!7vy?Gw>uN3>nkA(87uoyjcJ?mN|KF`OYE2eUlmEx9HEKbxr=b5& zTWjoWEm%kyc~5n6B!3eOVN+!1mf|6$O1zQQMpXjt8sy=;#18&eCf;H3`h>e>e(VZO z>|C`qTI)WMbr)Kwu|C*{*;P5`nm8Mo*;oEwx7LVd_}j{hbt9;$_KTcr>3ZTSX*#;? za`R91Bx)vd(W>S@ap5YS!$eCG9UXa>;jD^ab8x0#ZYm{@j`HZJ9n{kR5l_<%6%n}@ zm6l6w4PDsMUd(B`3Bg0Sj_>R$cy}&jy@F3GU^ksyfF}9>nP>+R_Ka>@gLwQDb_~>YCnA7R*IwHWgBD_!nc^XI=XnPUbp& z$17Piw3l43FHz&%rre#_9p4m_7gpEmm8@TwGbhR^m9mzFyGl{gZ|v>HHZ)4hnCn?= zYa_XN+pUZkUXI&W2z5e2KYBCk+lXi5Lue?SDK{P?-M~O!Zw9(*BD&o!`;JQquTzObDl78>rxVPS zsnDfP-o`^WB*L^K)8M`WO^m)#_(NCAOU}34G|f=TNh&$?UP>E#T8GY0v~~WcbpHFC z0`1%R@5P6_uXTyH=*$<}b>SV!#|i_?0Ze#iEH^^lgDBi(zV{g;x8ST}JZNJoHOJhT-1?()0-GUPrTz-d$?n)W%MnbF}q; z^KzM7cN-zDJsiyRTxgQX-6_$q=Qr4o;G!W?z1K>MDtO%fg?Pm6$7>|F zd>Av7+pI;`;uW>;9D$qK@=ToAjxM&de7Oz7OWTSkl+sNIeC4bopa7*dC)c&nRVu?< z^oe5;o1g>j^oy)3(g=_^DRVscxa805qg-)6w`Yc9nvhF``_?EmdU&gq9l%EWGwSm_ zNw!^m`hQ-1`kFc%woe_@281cUmAO|acl$ad2Jc(`g3w)-%VLe(PirlnCVvL$*3#6^ z?xt-ZAF7z?hkRF1YKm<}K+L{=N7U{kN*edpN!Q<3Us<0*qMY49Ai6)FY>MTt`lNV* zSoRFr^FEQFnP20%LXrulThFz!>p&6z^QQZMD;NzXY^ThC_AnZo&`{k{!FWy z8JDefQ1e;yuv1Zq>9GClVPfudI10wmAs;vo4WWS?%U$VQhe1Qn)x)I4gz_)BkPfTb zP?*4v^hW8ri}#)9;~w?rMJ2N^9voaP`zpDW=xk!!A6LuvRf(@~nriy*BM+TI6?HQz zid*uvkE(aX+zB!UfS+ZF^&a;^#2lHwCcK!<{ zLPt)dQyZ3~eJz8H3;U9s{4-DJ6)|;2p9gK@%*ZRB^EOw-Mh`_w_O`pgdhceVx^R${ znMX}HiWVAThd<&%4d+8ny3}2sZd`mZYeKF*l-rIe+G*R6Cs*JjmxHo$#0m{G#Uo_4 ziQL=#?KtU)Wro5@@PUp%+R7Zw!V*li4z|+WN!XDzo@I9@Wmi7|?Kr#&&-2HN_M^^j zv~HgrZ6bjR=kmvk_TOFHXrie98M$3bpn_;QQ7#7k#ZoO8y`@-bsf0wr}#7(zZ=lQYg3W zrEN1WbLtq(ZNOHrSXf}Duq1ro8IN>|DV(g8Swqm0(+fv)@#naD$`23o;pnnC{GhAS z_6BlMZwMm)DI`p4WsDmk9*LMUfDkP6Nwdv9z-h7uU#nAX5pEVP6#h?}pu+|Nwd z>+p*xbugb9(2JStv}U@cr?u!v+~wM?)2zezEYUyf-cE~_!RZ_o6v_$b(1F4zDWOgP z9fZQS$u`DO7~IZh$mwFIdkW7;kkU9|8HR0fzR73DIHKdwF3trqE!yIU;%dh@=Sh&# ze5NvmOXB4C>=@@V3F4gYk-DRBq<8#0?W)h9a>2$fObFjtJM?(DQ6iPLVEwQ%vc(oc zQw9S)HvPNDr3G2SHcIG5LQ6E!)ng&*+`1>UcwSdl8?!p)Cv^_iQV(`M8+5JA*4^Y@ zI`s7CAm#fy_Jq9x6)x`( zEW49}c-~_hH37=zD-4l{QnB8qVxvjV3-}+b7_Xbra$2e5phN8{Wxi$SZuX-%Rcq(05)d_r?{$t%T z{WprTND+Tb6w@zMLdsOQTO6dPosd~S&ZQv?##8Qk-Mjf?|?z@^~*%(-64IzrqyBu9P~+DVa1`sI(k~)A;&A?R5|VwY@~0taKdT zZ>A6x=C@t9eep_uL0XvOjchH$Qyt3iqA7!pgU>9+=Z;Wo@j;BMcI|zbJj-2)t2@eo z`>*8Z5)5l`Gev8cdM#{tp&MOh`p`?-=|ivmK6fp#7LO!OyQHT`(s5jcHPAERKJX~c z>g}w3;oKYBWwh+eyeKW4)FKRrm}-!_42u>^(ELFI7WNH<* zw0%nl71p*DWpHJ_C zL%NXKlyD4jf^n3u{6WnAOb+SHFFH3q_|O@b3w{G@;LHsMYHOnOf|kQets`(pe#OSE zjX_4z$+t0Du;lBY!rkJnE5AwgSce}fsna(J(jnC%s^6Z*ki#5~mz3J`+3ne&!oh?n zHJWTV`0N>sCWl#shGY&TP+=cHWb@JxT-VOoK$fUBuosK@CG zk=UOS(2%zUFS0n57Jfe+K99g1E3lsqztEKDU$j=?s4rT)1D)c@cF0>Ti>G`}IbVGL z3zhR11pAkbT}VoZk`CQZo21zve}Oi+RCd+>Y7&@^Eu2cQ^t_LJbLT>QhOCWD<4IL_ z2b`G07R%o#o3`AgB|BdvNZi132$CGYc@t0v)DTzwtM; z_4Ua)$>gHU~s0X<;Coet9ahCuU-n_Rxz zGf3(t0vb(uCFmh@=CBTQpFz)qYD^2g1QKCFz}F(aCY5`T5onC>gEYnyAdT@$kjD6f z_?j4h5jTT&g0xh7L0YQL$RxgPd=CI=scr^o9vP74aVJRgxF4i>)QYc(TUqYrF%qPC zh)TTX5dkeR;o>08<7Xhvqc0mn&0`Qq^N>BJ<}p!xP28#CX3)(b&0{`D^H>bh(Ub>i z9&dm&j~LrI&ErCl=5ZNF^AOc}&7%RNF`C59^vA0pjqxT(V+4@>XpA^WWBklRUDySv zTQw+W%3K4|aTNh+`OXLFNW2-O<9;j*zmCasK{_TUgS3`YKpJ-jNXs`1q~*IAq~-fB zK_=fukdDp|J-4F{cHKfCZOOAiIxo)yX>UCQ($fD3q$QBcBwB*sf;5k9AkCvI@;OcK zV34MFC`i*g0;F*Vfi!L$q;Y40H0~Ub#=Q-sqcaWCxQ~Jcnfd!mkhZ}JkhVcRNZa5o zL8c83W=pDhoC?xBMuRkuu^^q7=YTZ5$skQ{DoE42O?*vywzwIz45TUl1*9qe6{IN_ zL0bBqAdT@AgyI?_3ep%8K^o&CkjA(ar1h-@DK%>VDK&cqq||ITNU7d_ZLUO&O+Clr z9Wwt&eoE(LkgO5}1p?rVIWaLZBEuSVl} zAFb5^&a&)AYR{W)Cv6@UG-Xuj%_f%UF*fC38XIxXdy$dLPt9B5C-x@g&^NdyD zFt|4kMU=cBuJ|&skI`f+g={!83Ubu6(kE5M`q>J}&(tMq=S5x}OgHed+NUo1T_JnUa+hD`qd3 zaU*ZSh`}{0^ANyMc`8O6)0YsK@Q`gon+aNA&}|@1<$jQsrQLLMt#6_k+Rw_KO$P3iyNN0HW0^$L8_mpX-5tq4 zbha7w4~cWbg0uMOXDz>@H^0uqY{AwSG1X`-UvdO)d|)U-f3u!Nqt?CJ!N-x7D!`U z0MZzjfHcN*kjB{W*mJCICwuJEUaC963J|gPd3a~{Xh#O&vL;rj&XK9QTk}YIPp4V8 zqtu+}x0k=S_CqGIqq!-R+m-rY2NrHJMGEGM2#`5-5KCDdk_)Ex9y^Dp#T?tFFUweI zi{l6t>%~=tBj?zG9mTm6f@d1~!<~3BOQfPDV!OTcMu!{=@8D(|8!Tl0?yS*2A@!QX z)RJuVT<)A;exXU#6{TXb$s3Ml92bw*xC8cydq`VI))^BRMUh72U&qcF?v>e?H{GYU zDasQnIpYr07r*M3x791}lzs9%8-vbTUbgifAe#z-+m2X6&7gRcmJ{w27?j2Z-~umcVo{DJ$XK;c5;wFk}f zm}E#7qA-a>&CRgbPkX&h4Fz49AU83p*IEnv5XG$*Ds!Gt@;NzVxV@qHCz{7K-ij(v zu=QCJ?M?InOsdZ0;c@V+!lk5 z>nXYY1az74T?4w(psk>97$jD-t}v);z)kOL(4Zj__k7RoTcGPrxEnz|j}zZ{pqa+) zH=t__YJ19Y8*a0W+lQc#>5n0hVnx63P!mY&yA?Fa#L)eucXQtCCKt<q(xKKXi zAH!y9sk?j_cQ`CqBX6TfM>-otGH_7aMp2Ct3^OX;k=*m?YD__)yJ|-(sy3S;${IR% z5RV%1)=qxDsA^&kwNqrp3p>w$>#^^xtBmY?L+(b^Zx0mvp|D=zOlcE!H9VcK@ZbEY ztw4kqnYKQ1^`>v2UWsOMw0`@Uk^0^JL;f}C-6scY5qDvxKei^l%LZEZwLM!iH6}MWVpvoFPu&csuT2 ze@3u%Tgd*A*ys)JT<5D1e@3MIoG3qWE41A_8zD3Tec^oP3S6VpdfgTCuQ{XjO?zTx zC_ly@%GFeknmE|X%LC*)=Sy-J0brosC1bOp%tcoAJQ}rOjNe~a1Q1PQw$TJBW#@%h z$xUssMfIAu5esp@;5oq^LSrBO_`6c&+-eYe=>lNO;C zR`yJ()f(Ju633SmKn-xXk99gJMRIz;70K;rG{Qn0sHZ6t3(EBW)?^1Qe#Y@{7<(=MEf z%a>}t{iI$HZoae$3oqlsh~holyUk6k^zPQgi6MKwd1XAk?NhdtJi3BHbm zvH4z@3eFkZXLn1eNG@Mz>XBV9KXwfla30u!_?zdq+DWn^euox|ihxKUsd|(fha$1r zBvBm>(3r_S(_w+&V?9mK8ZZa6TgTXto4XyAGJu z#|{7Fz+nEC)#=uObEd*f@0$HJ30o#%v1Zd^!XD8UHk7}8HTMVx&KZtLn_aU{B)wRt zreNJ00iuPvHU(4LtZ?~yBEV!&80mcT2+kHj%>Tz&{ycwZF`CYsq3n#lF<9xQKs zW3Eq#0wN}|x=yXv8=+ar(?^B`xfizGJkQQ|zcP~VTMlR6Et30w6ZvB?zmA{gluXx3 zD|-whraAQk$WM8)Hyw|L2oGl%R?~2>g`XO}Kc#o{HlV}b8sk+Kck1Tjbt`K~&rAu@ zHp8LQ15#WYp57y#k^FsTJYlAAVn;Tp1Qx}yPKAu?6WvLN3K=C*ipDI}`ZYZE6rbRa*e zE?Da$zC+;KHyvhFI<%hX9}B-T(yZL)f$kkHYxu>W?;7+i&v!FutO+M(r<5la5#OCA zTu+cP9%8`j3=?jo7cL08+k|VAhKgZ6O~nTN()iv3(o{q)T4hqH1!;Ospr4p<@^t3| zlqcX5{XtDdPE0hFz93Cy7)VnIf;1J;p3oTbio?%MdI^xmSPaq_-v?=Z*Mc<0Mv%tX z4AK~X2WgBwAdT^LXqn1wzXhsi!egQiq~^D72)MrYfgaKtfxd6hUqC9${hJp~^eyy= zWgN(=lJqVBX}E8JerV#}28#3)-|vESr}LN>Zj0wz@O+y+-=p9H9x425H<^K}!Zn`Th>laD8Af6F3gm3f5wg_D7~I8cj%t7N_e2Fb&o9 z*28P^fl0Xga$O4x_?g~la`#I5f2xRgQ3f?Y=WSTV4=XIib$=!3{2y+l#;(jJU!j`p zLiU8pU@I5aCRAd@Eiuv+yI}3OgQTvXZJJ7+%UfROl17JtkW@mWCJeUjoKM1y%YZqohQR{OM6~ z^<+**KnN60u`S|MBzKrP#h+OGkdQlO`XT0$EKUmqUUxB zW4qSS4>1oFA{H8Qpf;NPwDA?1th0O-=vT%Kj?anlDM<5>k)X7qH%MtkKai#;Mp-qL zYe2s>sfa$k=G$Sfs$7rmRfEV9ARxhf%_nBB`Y;tR6yzXE+)f+Yp&&Kp=`R||(2(h& z>h+j~V$YbBw_JGzj5~k{P|0kW-fG5Uv70l8{VuiH-wf*XFJ{p6^lG6%erw@D{BS%j zWvyOR!;h8r@zFW@n&F8!t#1KGkDV$!4)gPN08gm()oU z&zY}csAQF7d6W`Js{5yV?b3X_B+cBy8SJ?b)68Ed!@pF3vsNhENp5SF>TD}z>$#ux z0A()pOITAzjUPNO@uf=06OMJv|D31^e__g8E0nqLRbo&maS0@4@$ zA`h-qTNtSL1?BZ$M?i|DN`E~T`9ir5jifA6y=hK=_M#l#JKG#Jx5zub5nhcI{gf`o z;9{i=4wk%rG=OsHHK2qMmPR}`*J6h}qRjJI?hC%IfSSkZo{ywgj3}3=2zYJTYdGDE z=?I*ik6c=Om`U6+q2*%vrz_<<|MXyfQmf=XW?8Z_>OPztZR|>lOcl$CuivRh3Szcoa&U&7-#489d}9>Y8Gk(HC5i;_r6;XWv;%F?nF6 z+**{zFXx?8dcx*t`bnd%OmCazmTw6}BG9^z8jOCXJvKLB8b~Y{T zgl*?_NP>4pOj07BEmmOSD4yG^E-He(bH^c4&U=>PFPsC~Pw{xRB~DC9hoE|_HZNwUOOuqRmkduJlA8`oP;p|!PRsL8&8hE`R%KF@Fz><$ zDx)#AtKXcDGaHhJMC`8ZToS!Hq*BOJsFW=O0PCrLO&r}eSnPw_wO-}`LPqVQWiXV- zb2}YP#xs2htpA!qI-??oVVN!jFiqY7!&wl*j6+F3XM2lmQ%BZ?^!H4!uTTe+5Bc|* zgDR_@Zhj_$G~%`Jpw5^ob|*JUh*6c8;EpI6KP4kd%v#Jgss{rk#c93fNBkSjAVb_Q z-JLwNec8-7N(8W9+}Q~G$CeR)M z-xVPBeF^k3G$P;=VdB-N2s#Ng-JsJzAyNwPKD^KOE#r18NU5kOgK54GgEYPMAhoOa zyytchb=7c{AT8e+AdPVoNXxefq~((XP4(Rl3K`Pb3euFjK*z5$Wsw!aq39iKj@t`# zUi=rOuS^^ODb?A2qBBs1*G{hzQt3-pd85dXPL3`5nXWAcBWi}tjpIZ}ydZRbl@M58 z@~9Fe*M;I_jPRNG*jHzCRLb^8x>5@-a&oPjNWqe(8dE{D47%O(ZMSzwzl(83dB)Kw zvKlJ+29gyl>qS?&hT|i=w_Kui9x_|Jj_wow3Y?sjd=0O z;FX`)l-hm3tb(5sMwG- zSQNr4FdR28(2{YDS*YHI~~M zm3P;9R7ze0${s~JV^gD#9ho@3(8Ej9sj=kxn3swP#!^GI;{LbWx<1nxg6lmm#WRln zl_Lq`wb8xx!Th8K-V3n4gE8vh?}V?kvOgtAFdvsk38K~`&sz%~#6bp7)dsO2d)i~K^?8w`H zi<1nggM2d5a!=HfaL#xcdCIl8dTaA#eC#VviHNIrC)T?WT7~n@R~h}X6NuB#p2|}V zd$aZi^G}NAo@-0OG(P&sv|eC4zWi=*g2 zqH$X`>yPQ(wWFpOhS`k#QUWI8bcTsH9hA`ho$+EX5fYMH ze~`~iAoJ8@EVp_KweW_4C*XrN8bO&SOE=BDqED^+yJUGhQ~%-zWnn_gxu1yg__X@7#BV zbj;t7^19fg8>=LGn?jzW=eAT_l|#k|e=xnbJWD^0zXc=-qvscYNLiRhX7AtY{mwdH`Irj zceqQGgN$6rIfS*x_YGDzBzv08?BsTm4l(?EY`Uc)aX5T)^0n!W+8zGXX~Kp{%Y8(*OL#_es-?K;?zjB%4gHx0KCq$$4y(v*i$a;@>N>rh^E3AQ%LHv1Wh$$}$)BpSD}1~8O;m7&(JStA8y|n!P}uh_We%S1aI4!IqOt!p#+i|eI<3L#Oz)?ftZq* z6BC1V8Y20cDZgq(u1!5Iq4$_+jF#kDjy|11BLgOHDm4kDm6`+6;p4n$q&tq7NW>cD zs@{BS;NS}sb{C4tRU1g<^%zM|;_~G*3 z2Uif*m+T+2FP;%+t?M0ZPRl8|KXEXE*XH@MN_9c{QV-8NF=Riuo|D;N^O``SUof{O zIA3O99jZ=S#Cg;9V0v31oZTF@LTd(^{OgOnp!rr=wk~9awuHN_4|m%V%7tN|&!aBk zZDu`lXsE+DYYW?P{48r(yd}4>?wvsDP5I$922>OAvrI5fWYqwGIS(Go}dt2&Y z(7T{NQ-0A(yio5(RyqPjh9VDN{XUXjY4(_j;YgXx?$TZ&KW?8d5!$35L93#R)nk$P zs?pUhws}mPTIxcSeq&F!dgUk>3|DXrERtw1rHayziKQQMx}d?ViiHw~Y|Kx^LW#te z`Js<{I1VNh8T^n6IvF%Bk`MWZdlNsNyL`w$+=V)M?(!l3a9_`l=Pn=ekHSb0tK!b3 z^3!99{wy+%rZDQgP$Cd&i-yu4U8nV_8{CE1n0-QSk@>Ng)Z*x5X)lxy)^_vLXuc#) z%5Y~jMyC6r?9^3oE20zM$^5SrRyOR4ZuL;kLvo=-eIN1AUp(}&hYq5lHQYcCJ>a1~ zfF5NGJL;`6l;*!X7)MXpK(s^4afsPB3^odQdq`T}9C2-#%YGeV=2TiXy+%;U858$& zd3H%2t9AKR%rT!SjA2&}Ak8Cmi%G8S5xO8ccg`zxvu+?JtacUbyP-!f{5kICCcve$Xj z-Rr!v&t9idTg5KtV&)HnMu%y;$)kkvY(e?kI2Iq2Qxc`{vhJyZ%`}i2O#cB$*L6`< zYN?cd6YfR(SNM}zMq+g>NY5qYm81TK;HE&{TH5w-9P01#FdHxBxvEvvd4#=Kh^y1? z*(FzYle2*4MIxszPn2hu%n%2xfTiVKd46QMMKC$qiQ$BFwNkYESV-5a;Y_#cyQ0p0 zEhD>>#lsLhkwIP!{}Aw<06Nx`{xZ;U23-eIE@C$5MB|nQ4KV0V&;$J6L0voj?pz^{ zGsC$*#B=MSBFuV$T}mAxWw)};`PH6j47bSl3L4C}ax#CMflW(c7+SoZ78aRNVr7mr z_5Yx1b3C^#xS|{qYSNI~sEdBam(w7g7`D{f*}-N<^$MX_+8n#*Jjvc+D#?`%u6K(8 ze_?ehm~>du(%|Aawjt1km2O#=0k4maB+mq$<4?WudTQ4N$&=-y%=s87A1p2SOicEc zkAV3&p9dFH=vP@8Iock5elm*RI6tXPNS-0E3^+D9Two{Q*~!5I1Hki>M@iIElZT0m z7C;i~N@9DZTH5ihHCr*2V+;q1bgiQw^UwI*xgWoP<0m&-I>vMTF5K5IlzT@wLea+X zwt2hgC(}buGr)X>%jsjMi;T{Vi%%?Z?_YusEx}^n$PND~iMjZL68yIkEL#sZ%pXc{ zeF^?;3I0h5{(cF*y98(3aPd|r@#1V3T;qZ(Trk-M6I?LP1*f~<6c-%tg0Hxsj|(bX zz}C>v=KVCV^fvo@9_HBQE{E~$9%@mkyR#p}magTNu%Vfg9GF1;G_1VY+LWi)7S`S^ERwo->b;Mksd` z^6INFpN}4c+ZdC!MU8Gnen|@2ZnAOdA*T_Sx#67#jkX+QzN!JR)zA$Yxx$b(utd*{I9Mx4@>Pw+~GQLFk;SYyR(rDh05`-GLi8Pw8g+@7XIJ@)z5?26YKX3Z z%dxQ~BJ8CDDi|1MVMK56Sh9?h?xVeAsl5rL2Wi5d-qTOqL}2?(I$iHcDoe8(H)UzI zft00LNUNTsOE+jZOHjb~W6-(A?WdlbJWq6iaYM-LgnJcqk#T#|b87~@1qTuE?e*L$ zmO-Q$RZmIvw9~K)^A+2F8e<+V9^FOk zS>;IBs}T8f*w}sK{6@m^CgeNMEBE3CdeuST$Bb0p(2SV&WqPZ8jh-&C1#MRishdsf_fwS=_F>_*@gN^3Yf04UCnc!Xud(3W}c=?mxh){OsA@QwD9sWBT zeZEQ&HPwYOH3N8x2)9`NN0S*%vD~(ZTxPeje}@(UD}Y-S_Le49SP6Vqpe?B;pDPHB zh}jiXNA^{58yV+jGFXe)ke`Nd`D<2II70TYCx8WKW6OQo7SA(f)@@yu2@d|rP@1>ah|A6&6y}mLxrnfnge3MV_XyHY( zmUldlT8(SW4o>uVAhnA?n--qHE8cCRmA!{7cCHnHs*W`~)}(9Vq4H zA!Y)bx0E+0Urmi5n}cvK$mU(xQju%O$(YI!gViaa2Uhl7oSZH;q3GpTaEjT!Fv8|w za~;M|j${0Q(5iacgs$QItSB>uYFEX^-#XLH)Ln18K|8e(LuG z&R?v4Vaatr^*a&w!h=*23s%AT>r*5cq6E^thv4N7$K*L?C??1A)7zJ<;iuAS}%)a@BP_BMcA^nCwXsvw1pWB#zm2wWmo9@l#Op4M^hmfO`13l;Y4RS3d zlK*ZKZm?s9+{lsU`(hUZiIY7^`CxI|id%4*A3o66T+^G^*8d=Z_=?yQD+ugG{?&dW z|6o6EcR2A$t%8S#_7h?TZqf9u1B7gRLJ;J3n+?tc7wj33#Zv7RP5EgFwmQnU?D(XPe4u#PxbW3aMQOr}djM$Tm`^J5x9 zlzp7`NS?%>W*2vocrnch03Lm~;{5u{SK|5vXt#{vAqnmAH?Ucru)GBMKMcu$)%W*W5+$qUe2) zp08fb2*1m)Nuse3A}nvmgVeX4TonzX7~`>&5%7%!%{6S&G|(*u%>mtJkO+e38}#3x zj6r^gV4T4g@bv?2B=vxAJ4jPb!*(fppxn*FFBfH{H6ietO7ywysR5O5(Wb)@{)DDEx zMnvq2)5`11X%WNtnWNS#a66u%6!6KR%KfG_z6a9Qkm-1jaeKjYn{?s%7$0#?B9%`} zS=lE^1Gh>tp^M~4`ImZK?S+0N$LVYm4YCrQtB_9L3dls?ini$+G}E`-oxWzuhRLMZ zlNl5125;odV?&Va1#+fG&hoQw&Z9MFqZ9Q%$nQley-$91I8xIQnxFjao8Ry+nqPbJ z)K;w|cGnivNZNMJ{D_cejS}3tV0lxrid77K$$m9#H8u<7^T{zgMp8D0hP`U7+8pY( zISlzb#4v%7*kUI;LS`yzDjcPcso<)*jO(3d zF$2^kW^)2A{0qfMpgcaN+_Y!R?hytvAS;kAHP>}YVp%K-Teu8dbnstJU_aDrCi!4Zl5Vu) zbIK$3WmCmi?(l*v1WUUodI~$_kSXDY{5U`9FML8&VG%UAm3fD66y8((IBLsIA$GN1 zI0HixYp358v5zEWE3?{!IlD4qpYN5SrS(EnhOJd~=6q3hHW7O^jmK5fyZDIO=WyBh zLN+EFFseY;jW#O?Ecfi>JMMbM?H6Jth^H`a203qf5OEoI3=(kmX2F=A!!Cq_Y9lp?SLT&%?8Zu!ye zAG^TK>;*&RTazbOHHWLVhH|gN{G3t+7t{CTU~X%8*gxeQG}vvAEX-Yb<~GC9AEskx z7A?ZZ&HBGq94=>kE6vEY(G1M22)DI1T>i)8B*HU|JJ70^U^Pbf9!q|Gg4m%QwwwGm z2fKY(lW9$Kjkd1U{5B^Bd9|vO3gr&q#c5eFNHNxJJ;ZAbS`_R?o9hC}Pb*mGlcZX#_dsy5-6 z{WatkzmD)t_c3Wst!mRp7TX`xN6xzXj?8Td4QoMdIMi(iuUks%HBy^DGer)BUdZ(- zIrEL%_ek0@U^gcUv{5N7&o$68qmMAnliN~blIymkq-|bfGAhhgRo1@{T)Nd74i z9AMMPkQH`j<-X)V-L4(2+qJ`WyT&r)Gu7CN+m4?&|qkX?j(F;2rxJ^G)fuG z7Wd0{wEq1-+>i6?v{x%%v=`5`&#w4)BKQ7xB3Bx+EA91Vif-DgIpr9YJ(QM+*o&2W z^Ij5d)z&K>DTJhi?TOe3?x6Cr$C86Sq41~3OWT{?iS^$Y8L|l+>%TctUtqj#!ls+} z)xQ(qrc|u|s}bv$FY`4b=x=f@(|y^sE9lVImu_F^<# zMTxB@;TcfWfM=k!9G>A-c!vAxSObeaJuzH;K~x7tfjhe)GHrtfk6P!f&(uZbCZGK^ zE|BcH@e~M#%(5BHY28+^7^K^C-El8XJs`qxJP}THBcKe}A;J-^Jf$rnqA0VpR<#Io6}6RJ9hC5+^mf%RnnDYC4hJ+KB(3k^K37YuVZU)UK10{hm5G zbxYZ)$s<{9#&$wpp5Pp^WlG{e0(C-+h0tIIBu3b^)UGLsepKk-Ieo?~j&+t>JFzl9 zY%GF;w@fLEr<)(y0uCoMC(*e^p0)41gJQ>b=pkP;H*T;L_@L>Hou*KrJq3AxZ#DZ= zpBi9Pt+TaNI6P%qxEj>+bZP(dL7QNB1HL4vlR*nWdc^P*TG>(AEWJWpsheD3ozV?? zW#vF3n9ipZRwgc!y!5?-b{b=%dQBZrB{S6Mk3@C%v?W&FcGGtIv+|Z9xUuqfn>22F zD{m#1+rs%<)NVBdaclAKYbdR&?%(#r<`W z>W#BLj#Ymcv&MW_Jkmrco{N3F%30jE-qk<2s*>0-Yb=^Y2S=+L61`E`aSn<}E*L?d zIoBnYyRjl#Z4~-;ySEzT3VQCc@`gYkO2ckJBk9gsM%SgvFMU>3WGEKbe}%uQw>})C zBdi9bN5z+eROf9fLqrd|{tVKW?e~E6Ah`!CkNO_(p>|gp+v_!2Lw+l52;oIv7FuCl z)NBn&4&(ny{;%MFAOG**%v*{gcqS$?QiAyhlm?e;=4OBgpJ9ghBBz^s=L@C(Ik%sw zt6?at5Aqy4ydbRYNBUE&o^AJ}nE-6ig+yTm;mj`%PyoTKi7{1a|^I502(T z13HUCU}!vl<$wU&rpA~R+7@hnz3?mixoIG!&YVS6wA5DSZOT@)l_T9i^1w*0A)fmv zT=frZG^(haPaK1}zc|ANrK4ZN3P7UgF(IARlG9f+vZML#foSf9=#b~5eh$s*5;dX4 z*KtcLA4g;n!>$X<4R=hTI6>z)B$#`aw6c4U-*OU0pK~-?z9n%*EVsAtRRn**XOO?j zu_?-J*?xn!C~qj;GBj~!y5-WuNUusrl&O*)#IYSlAx)M;U$C~lhn1N@ zX~+=$*=;fZj@XbE+7P|k!V^-;)^%LgEl&3$cW9_eul@{}XnI{)aTG3$FJIN>!bsdc zBchcl5Xg-zG8`gzV#+8_jHWL}`ge7)7R@IZ^nr`tt9l(be@)HJrh(ba%Niw@nd`T8 z#=qY9W6+z{FH6j6^H@{j(J66Ro5$J`k3b^a=CQ8CqjTbfHjigZJh~)$*1y>qav5$I zZ>{h@&!6QdYN9+=y(ymCm_$pY zJ~m`S)W50NC7NSXNQ%rkhKXxo7KXXIpVh3}*pc1+$w8^nWj^*v5X5q_SM9xL`ckS4 zr-R{l5=R$MvTHTdBWT@5LtckR4G_fEgBZ!s^7w(nuW(ev; zIGm{@D{AmFgnfzTFBrg9V|_ztKqW&rJ~8-|-^3Q8F3T@%Fwvw$fzBi%W@j{Y3UqEf zA2^MZ=(rVL7adX;AJRan{On}PX7!~=*5U^wCvMZXauonlr$<#q-T^j*$gBM@LqOh> z)I~lZq@3tCo$(oE_R7jmj^ebHI5`zV1`}BoCd0Z6hV+(M3s#USw{W@4(wewbQoR8c z`mg$m*L+6eT3pG(FU=u4aIZxY<*asv3ZD0NT4k7&H#zpfh*bnMkZTpL$vkzg6OJTMS8mBm=Dqo z#6uo>)I-7ms;@Axiq?2Y&PLVkB@b=$kcjiu_ahHo3enIDoQFUL3PuyKKS;OLUj;p5 zw&Z7mo){$?anZfJ#)w4ZNJ`V22HR0*!pYNLx+M}ZiMst0q({;RK#|s(aJ@l0$s4mf zpt(p+0zO%&8;tMio^K2khC~K@*Mh!o%69`u%l8-1QWK*H()7gQ?sDVCg%rnaIB0`$ z3wmxbP_;?~%>un( z(o2D~d^wP62Hyoro0K00X$gJ-y1~@)Hz2L$iy+;Y9>_7>hxA>*7X`_Cy#e3VpnFWu zJmUHO9Q31J;`=L*rm_d5F)o28QIrK~dOrc(1w$3^Z3JnrzU85Rcxb1G{OF@4!^B%$3=u=XYXf^gC-t4`c~0Z?dv^5=q_U$M8-XBzAXTw!_Jr zB8_!uskIt=`NeP~-C72d;KWK!mKe$NG&FA+5g`&y*L`YbMoZc8-xQXES) zFcop%n8n>kAYB{bhf{nOn$FFFI2Xt;g4FsP7eB0wh-_2UP?z(`l?_a5@x*q5ZW1>Z zf41Wt_x~Z7n&%rzMAEUcgK&d8in0UTbyD)sSpMp=cz)_$(dRm=unIG?}t%v{=tBzYp? zVK2%144Nlha|cl3V6I6v;k&}gTcV9?q-_jxR+65xq2gJ ztDp5TvUSqlRUGR@SmZ<)Wg?{bV&3c%ewZoXK~ligl>~`cV_PECFN>M4EyW@G_e{J+ zdC?qj_$C&*qq$!@Vkkz8&dPTm(cp(U+a*$o!;Oi^;_(F6u;vVb3$N|@E)ny|0qF*| z?E7d%`{{OFVV?5PUqDKWL|0!a-v=P2e6FR*h|SV~qIpdPj~J!5`KPRf&^S8zZWvRb zDQn$NIsG3LVKlmln|~P zFg4B?$-T_kG25yZ0yobe1x-cRU*sc{3nLVX!`xn68MCKNHS>mya6s^9kFS8~;*>6( z!pV6rcBO2Cg*iJPO^X5R+@av;Vp^GcyoCct;o^b;Xgf%7?$orNKT~+XEphwG0UQ|q z72<)1IR<;zBzV}T3}ju%w(EZxOj6S zyG;Q%k+xflMVCr$7Deo{E6tEg{DiZb%6L98pgfXKvXSE)LV`?!Sr1mkMg@D%UWCr? z`WV;P=n(Yh!dvX{M>)AFmk>*;j(uTMYc@HDMeG9^$&x^=q?D{JgdkDrmUFG_BYcx7 zm6EZZk%ue1$B+8)ffWrs3EP}-9zW_PQBQ}{fE?dxgfhzFn%q!p5bMFlGUK^~@Dlzb zu3o|oLSFVs_(^ef_Kmr^oW5y<)u9JWXs3Yke6N?zZTn4UMq4_?Wmi#%-}aY<{7<0Y z@qfT~AQMC-<>!J1ohoi}V_Zfb%m?Vlh7Ix4!w(t;M_5#Swq9)3oM2*n3#8B1F9QuR zZgn8mOj3~xN<)pCnS~d6kF0U0ge}WCm9kH-5`rGF{p>3|VYcx}zEeEZoki;J3AWE+ zL%1RN4rd^P$%tt`uEzYDSJ>7L0V@@XdZ>*IT%dYgH9`c~%y1#(1vZ3p%}&amG$UqD znHsUnWA;SeqwUMnWK^zE|y{Rs2LvZ4p-9eIz(0kr57*^#6qOB_4Bd( zyr$qY9}!JBqIQS><0?@V*uiqKlH{Q(yIK?75sZvlJd*_A{Tjnf;(>BsOe}-xE-EjXMQvAv5fYOU@_*CzQPY}TEr>Yjh4S1pCR_gNXaWRp5wn$w>=&3R0^ zZR1X%MBLG>fF?twUJ;5s7~T0Pj)li1zVMv7FeA&ldcz;%U#}qOpsP2Dgm*~O)phcV zfg;I`GhfxOjU0dH2o}=F%5FdJ`?V`az21siM07>Z$<@DEf8(mwSoKD0fyli{Phuax zutowu5V^X}B#&6A{v93&Y#D_51kabRM_yxPOlcPXkZACRt;vwllb5FeKbC^6sTpI@ zfNNsi-Z5_lo@;8My<1Yc?AK|ByErD1G!j=u(R<0(Vb>Ve`Kl&NC{zT@!f7~kGk~d4 z?jJB(#r`I%eG}|Kg2i7zU|socvE!?>#(elb3zIDE)65=MX5t((mPJ)iOmhc(JwYFv z-I^E!3-lK^;l`(#-OzcUD-9aY_&A0Cx#`N^c_x(wpqmZ41EfT>1JPr16tyEpsim{d zQ};wy29hCNk=B8f%O|49v7;pe`BYLy+780PQ|@nuKQgP;#gq$fUnHVdMxLw^U0_{7 zoY9Ffl+uX?8^4wR`}Ra7?UWv&k$n$K_Cc_EX*a}t^(e?DU&C-`4C10vx&AcitP{oIXhE|;w;H!!fo?ZQc4`X@8cHW+4boMqoyDfy%VCE9eRV7i z53DH{qMSt23GE$#)d(qqtG#e zoK;?OK1dh+4k|M!fMZgHmPz8CFi>z`VvP;&Suom-*nYc`E z+FKoE;V`zSX|ChR@>(;N$AV^X)~7Fes+(7gsfH)l<9E5MDI!`USe6|1ECKmo)5=N` zF_|D(MOCIvT&ks30|=DGgefg`UTE$sp2_?VIu@EDPj%XBFnPRg`iDQxi%#P}Lt#N- zl0aJc*&waZLeI@SLb~gKIfrmF!V&OeX&Z8iWgxA_l(n>hZ@i%-3>M#YUzJon{zSQx zNC|h+_AG4T^q4&t&DG1fDK{r#w6PmaMX?|`)ohPKqNYL zc*||PST5cYw{NJFo;n^gJMKv%){kYMb6;IN`wuQGRMw|<`I84k?OQ2wwlz6H*nfol zLT|k*r*g{yO?yX=(8|cxNLYDuo-`Owd2iZU@*2*CK73BUi<33(QoWFP%00P`Rc}vn zi5U6%o930zMy9>Zj?A7}*_f^)NAmMErfVG})lIr}H8aNW z|E4F1U;LJ-U*blW!{A*Mw_aG@ry93i60tGY+1+>BdCtf$VwBa?HBsYwebt>5PKj6x z2YAe0TZZnG%+}#H)4G>u)7KfDJ5T%LLW-@#;SV0#2KuoXpu*l|{y*N{1wP8+`v2cR zgaFD0yx~0vDu@@NRzbY5kif2P02LLjD2OOjR0s9L6~4K8|J)cZq^Kilym7UN zZrRtVjBT51UX8f=&u!_|*q5gY(leoUnOFH0JmAo zql|M53maq^d2fB$+B1r(_mOC<87!I#;zA|5Ctu2S)IAHjQ)#vuWHb{6_ayzg9dxpy zJoUnnXyTz#{Nvt0VjEA&rBIWQ4zfkVg&*E5Xjm+=Uq;)#^_5uO7B(=Ga5C|)ggOV? zBP$(M*;ABPn&qmG&CR1mK~NcwU3uKWD9Nu>MMy|aptK?+&TEd4#jOZwCr2nrtIFso zBxEt$Z#>{LoZ-J|=HAtZ#%lDD({{P;khPi(ug{l?R;@{6+lKcksy?#H>nKW7AkKBG zjP%Q-zjJuUjO^snTE;)i&gRUUf|j{l^N_hP-bugB<>>&1{gLg<3# zhfE&pQ$BKYM{vN#@(I4JKA3M-b@9$@WZl9`HK0?JL#_jTC(kPd>+H;{d97OblJ*!K z`4P-3VL?pRJ;IDc@jO+tJQ4KYIyopKqI-$}TZjDSoK$#}@#!L5ToRqur;ZbmjJZ$` zjc_chzM3UftRy*TNQu~BI^hJMBtywjqhgsnwhayVE92e7j+Nw&Nd{_#^s=igu>&h2 zG6TM;Pkp3$V5#axE*GiTIR<1meY6=uvp?D#LbSaj|VX_+XK({@Q(E= z@3`JfSlItQNnIcJpgW7;wUUgZyUiEM_IGMiGSkGiexQ!y^7U$R;Ac+9;8#4mKvM+D zQnUiq>@s_yN_7HJ+=3Qvk^JKe6Gdxsb%9or=({GF(FVjlYn*3I#WHwseBl0)Vmj__ z3N(GLJ@#a}ZuSd8O3^C9fp#R3jqrUzf8b|vf$89h%Fhpd*i$Fqy%&X;>-9p68TdZKa9o@TGp0S|=8;DgN+lw3Pu<2pc(AZRz%mOz3mQp&o zJPHaJ_ss=}$Y@bOIBM1Um2UwDvSbv=EwlO2HA!Vs5KhHKMp(t6?;i3svsyl5-i~ga z?Npl*^7$SV<|_-Vg8H_;(Kf$Q$rn)SXz$iMVf|~KBsW+;o_U8w3#zb`Xo^0K5l*$n z$e8<|D^$4i|ESPb*0VzWpV@ILx2=|nvv@4MvYxClqsvX6vN)_g4G_=F!n#+zHGxS; zN*=ft*Y34Q4Rr7bXG2kqvR6+k#}V?iU=i=MVv#Jv(a2G`f-Qu`)L1r)`q=gX&vXxE z6YL##`BzoZEOrmRP8RJ-_HC|STD~cPFdHU^0-JMZQ~EqgPc$})K-5by6NBc6z?{}A zwr$QLKvDHUL`CObCWi4?wDPa<^w&jI2XTeScD7cw@+FQkkUH0C$3qJ2Z~KS>QZ8rU zZtutz7(cLuc2t$)5U~h4t<5w87JoL?$)e=JdepRg8%kuYA@t;O3CI>}oKsIV+VMX+ z<|LihQrMi)bL0JDrSbMLtg@Y$%Ajm!j`XQ9t)oU}HM3ZqoH5~<(wejBl>?P(OG<(+S*- zLY5+UIsX?&9^+p#OvIsJH?-E`$i*O2&3+5=bV^UtS6%e02eS3Z%b>0r_NOqc#c-Pa z@fbe1$sRK_+s8?7JSXh%P!q#+7VCRPucS$2XO;$bTkeaYQgP2F#cb8MU{}?vMBFyS zJAH1(+h0ng2jknn7UQin12Y9f|GF(n#v_WtLh5d$@Ty(b)fWbHJaJoRyTh{mRgf)% zuR)Ej-)aud4gdBix0b)YeOsaBHs0wAwcK{pCggZ~dHc3R=C0nGDL$5|?JYIOU>ter zp+RaY7R#|bGRWg&UcPC$QKZ}6GT)u~e0e`azQ?m7q~=T3nK^sRnCk|!V<8?d6|rf# zSxG0O?5~(;6W(3DpLF!Z*wyNH-AukEyxQLNQtPmf;+aR*@*$pib`pP59obUYzRj9i zm0jLj8d$I` z`#yRh)hm#xIG9lXWcIiYiS&zQJVPo~NeskupIv>gZmneGMUvjsQjU_;^GhUXW8HF) z{Kwlhx%~@mxUzw&H`ylAE5#2zlB!5}^QDqXFp=sf6Cj_|Do{$4c=kTYIhoaLv6qe0 zxZM?P!2Ry#L?2``{(L2y{I8TW^|ojPuZZM9R^FN|6$TkeOl z=cm)xzDX}@eWNRifJU2A9c#SBkgc?QQvr?U$u(uWsRrb${g6+LOyj3ZN-_0FY;5Cf$fCu@mh4TXl%Trali9SzdN1y+Fpis1 zQW2aJ%Ig7+<>KCHaqo7N%*#vT>1DF#7pX3b&t6>u3RB5KX;r~iLTvU|v!HhL5iYR% z>M@ubgK;g~wwcrjvbUh6X?y-ULJH~;94y^kHKOYAf)hzRz1XVp{do3ismAPG{SYVB z!`Oy?lAMFF^LdLJ*}KHsaIcWrM|3Rpa!CxjtG5i*X!;;N`EQE*g}4N=?szlvPC<)w zn`X!CUHcH@*3#L#dWa+|nZ2vKl)QJ)CN0@Yx{G+SVz!ORB*-=<#cpdGlXrvusRo({ z!+4^ISiE0{@x=GTHZZq`=zBEN(u&8&d001#BYy>*rludcPiugpYP#GswOycg8g>l2 zz(7Sm0-dhte5g1`(PYpWik5<&R{iXGkZE*VL1*e$aYgQ+Xg|<%8t+ihLTN!nu1cNQ zOHlg`F73e}tLgL*{We7PAfwewAfv$>AfwekK}LhoIPdJFEyWQz~~OjmCOYUv!JCPTrnI8;j)qw*x3T59@Z!qn2oB}H}?n$0XCRoA0-uHQl! z*~}=^Ne`1SK8Aial}J}q-M39AeHL5}71CfNRR?kbB_S9}zkTFVZ0YWCingxq6tvFLS@p+AWQo;$jbNtWM#-n z`bv#=1jyu`JgT`|(|wD7f~;J*tlVmq1ewgd z3}iA>t_nAq*$6V3Deo+s)OMQ@aW)rZ-;k@TWX=v8es^O;^@>pI6JANcuBih;-N06E z%cxc)H*EW#;@P=+CG6}*xukO2>dx_KWmEa4ZNsOQq>kZ`Rr#i+VxdGmqFUjKhMNxx zjN@wTFgtKh;to^tNvcPcXs3XTXyPeyzE0k^f`%&5W`n+~VQuy;(jVLIlU^6cy&9YZ z_9n|Fe8P+MNo49usIjc(YQ>jHjDKze{#a%aR5@+DoIYdyC>!viPuT{1C)}LN*eR?Y zEoLy}g*?|CZ1zQK59S9Kore4Gl8^4v%N=mG_x=t+zHE{dF5A+pJ98!?^%SE?i%t$~ z(oOgRlcH|I+dZ}HbKns9Jb5I&!2@JHSo;h=5?(e`$0V$gu#5A5xqd+(>v!MgX(YbVfBeV)k#=V%MwF9)x)bi>r&{G^x|c$Sk_eE zfT5#x)yR4FPUX7#;+he?<#g)QHIX9!yM$|JjTT@HiOwI+kDxLB2`i)dH%r^ULU!0_GMIcd9$K6xD6=GhQt7s2m*(mg&*jA4r>8 zFV$~%=J^|CYki*>=GPkN@a}GECxYZ;y%PU`c1^x;k*}ttZC3`C8+C z^J_@N-Br#N7WX6dRo!uP(T0l2YegH072)(qg{1PKUqCrm!p_m*5UuSg?b3278_WFt zQlEIg`^7k)SnQ1RXnD7vm{{zL^ZXR!d_(S#stHQH}@txnE z_=K5GPysTXUk#_3=4 zXTgsAp3>eXzG~h(MTzzn+5qJm($~nq-D1W?t*ve`>*Kiih`_RWRl!aZ_6jz3ZC+(M zoq3q<`cb0!NAe2?CF}V5+)Tu|*d!NsMuil^)9G&YbQ+sAAtgaF1*Op#i689f*??4gsx4q}hUJL~? z4cx28)%hE?q&F9#=l7BOT*5(B*ig+g_e)_1?l_|Be+;@vyHCsw)_wJ$gnoS)bdI8V zu)`%9Po{x_ZVq>(xhIEdi{WBZOH&O4@)pYumaqo(}3GArA1STgk%zIZi z^9zk&yh(DVS-~34G#gm`GNDFoL-heHL@+dk3z6Jj`bE{x!M4l2dNeIe8u>w&Dft(I zjQlTv%)aqwkl8nc7N&12P3at)=@Ql}O1sR0h)5g`@Kic`_Zf2eM*c)o2jRurj!Af> z%4OW*UDHH=noFdSiAmWlY*mZuKX&zZsl^pq$E(9STF+h_yU0CTW7RP`iO#$tg;=_M zmB_Gt)toy}&ClUTs_Of3XfWc44( zxHSd;o3KRs-^F6uizK2${_O~e*fRnyaO-YoFk7Tb@x&C?PVczKj^xP%pvy8_Q|5OEqqRS!1aD-U9l{0f`r{hD%Ow06 z`?Gqd?=&>i#RPIBQ2ss0v%4pW8k;6`Y67QP%^y=ny6%Y7i45=0v)L zanA%A)P}&rDNvvK2I`aT3Lk>)^ht_{q`GaZ5fYbhfU~}mH{-vquNW}rK@3!wi3zWm zr#}joZP1$@32#$HOWCT+Hg(vrWt%u_{HM#dZ+Dl-RBc5NV<@DY&oM;uo-j2~1{aAh zUV3v0FeP2qU#6u02xLmSNM2LYdobY5Y^IwIHsHqySB%n0l=C(>(V=&TW)|@|nz3JK zZZQ4U7n4d=_79_=y*eb}qM_AEWSOageHQI4r*0^x{UdvE(Udx z#?x{af8Um7ao-l5?B`u*ni^R$?u|lbjLUsLpHovoPOYPz6GSWDgrxn3ct;}SD2}85 zl}<5D9p17?I?L%a%f`_Z)y2lBE+(gLdJ!~I$8LYnBpti_6PN?f1C7$JV?pOBnhv^F z1IX+oYeC=FcyEJ7>(>v%uQ^akzlz3ZX~kdG z(sl>U(64>MuP29JPY2zsU**i-IWFl6FR#Z|Fl))NC_ zm3IlF`-e8VG2&s_L<+uDfxMBo`P7Hwcfml{X9x<7jp|zvtrd-}LPq_k!JYNdS}~Ke zu9JF*cXxD1eLOp~L>7^H>sVFBj!`AOq0GJ(tuICyMI!Kq=&Fuavep%pSA|bQ6+R7B z9+C*32Hb@PuAP2hz^qHeD#YDx<=b?<@_Fd|YggckjM>2dJQ>8l?Uj7NWE`s7tXl@F z0qG!U*qSnX5f;k679l+Ps-hxUe`6FIk{!hRRvLxk*F7F)SkI>aj@HTy9#Z-teiT^I#;S$8jzHBSF5t2bu_wr7vdPTLZtHxQ4^yTL5xvgFU2slI`@x!DrHo$cm8+ly0B$rcNKv7%8*p6G7}GBV*EU=>hK zck(s!j{VHM%~na^yi-xo7Ioe|InajsN!cijR`y}LE!!2W@>3OX-49cetU|L3)XnI8 zdB>&7J3wl$=N?1dN?K5r+2HEsiz|gpE+6hKJW@tq%uyaG2N{pZ9;w+Z#9n7M3)wQw zXgqm+*y6npx=X{hhGF^9YwDI*shCwU{pV*@!!0;hz3q>nR#xr_AS+k%Yia(PDKqv| zJ@$o`Znxu_`3s$0O<(9I8yPIxWYJYv#wuoz$eBucl{m0LA+n;ixAHq==e!BZJfH({ zdJ%B~>7g%xL~APuiKUynRG$-1&uVI4eWFaj(dXJ_<7;YmY@1dVeeRs1ifn8Rx1VpD z);;>%`RyvQL*&=LqH`-r+n5%&8P+S!>M8ASgNBY}E^Ey)=LRe@R9NOL$1>mXxaY;I z+GtbpRuLBi#P={f{Mw2M0s~$4Sy|pE(ktru!*%O0p6s3Baw)(058v?339k97@*ZDL zP;%gV(Ya?*y@Xe{mfr}^cxG%Qbs#gmjKlCM_4k=m-p_HF?^o^)_2p%fU3BPsbj`+u z+@tWRw zn8n(&r52qlS^zdrt0VV2aTv?hPcIwZN&R+8{kZgsJKni$`1zoI92D%pMO&#ObSf;k zIw}#?YlUW;J-6M}jm14qFM}3J#Y|RevZkU(J0TnS1T|C2afD!yTmU!ly&L<{1Zy=% zlw({AnFy|~SIIrIg(q2_&Nh$lmd^fNv^HB@lP!+vzeD!wpKET;C|6ZwSG4ZpjxD>G zB9wG;Vey{KuKYvt>1yZFMbK^JqS)`fU47k2Z% zMOd}&W`@j`5!v2@thXxhE%W8W) zWns0gaV)kEd}S-kjXM1OA4nb2O=YowEr)EzS2Hp2mFf<{&pFH-N489*7c zad7)lC!So^7>SP_J<9QbjT{`KB5MZolmQo2wPAzy0UMl=@S=rm&@s_C9KRZjZQ*=z zO~K%2FSwbr4RYAy*xZObU!+DeF(Bfqiq-|s7}(f5ul1C|0ntJ`giQuUJQX{&cu?Pr z*M~oYfA-v~Q5m==)2r(-i?!-mu_3kTS%|QO-d#`cwin&8OT5UI_q2bv-6~sf95mLB zl5YK&zTyIQRv78UswwbDG(idPJ{1$5a)w-06TC);RyP&B0B3pGLZigu=Jh#u!$?&m zGuu>yXzhLE5~>>Wgd_3>?frCKolc-?Yh8W4KuR{)uh58U=Z?-lUw?4G!RsVm;BDty zV>fvQ7?n11k?OVLu3|`T9=uQI&5$4P+Of$X2C=eF3s~ zdoxBJIz(pkgF$vzWgIkkKMAV_S&BD7!HrO8ocCxAE(Tc*9s*gsKY}dh4?r9HNiLs* zEa$-;obK=xXrbov2ax4r^L2}zVRXt-I`4L(ja6#6xML$#(Yg0uP=%#UIQ=^N1(yic z@CiLorW>=mww!-uU7ud2tdYuV>2;bWbe86(#dWEaj-SD~DQtvPcKz7aycR46{*AZQJ%`!mg7psqFhX349pD&7Aal-FgN&43q071+9>S7 z=7jP~CT%QA;%Kcnc7)FTFJBV}imv|GFq($_3lJfHkI%-*z-^Sc?@&=Qw~K2+gi9XPvTDV9N1I18wi zc9iX7ss|hoFcxeG{0~`bTU0UT>gaZePobV;w4RedW~`kFvf&Wk>|z$YSRl&~hxt8b z*_)GhFJI*{_%U4hLW9mhs_EOY*!hrZ8TbDbTQE=R31@_T zq`=)qjj(sAOzV=X)xmg+@|3#sMCV`6kEGW{_U>8=vv5nzKbI&IX_s~UQjm50i(y;a zsOqynj?>>Q{dwg=+1ItkI;`I(b!eZEtvCFySZe;h_h1ze+b~P&y$zgM)Q6>_?n(?Rs^b;L}vN3P$^byFesM!X3RONdq+3xYO8e1#1xYx+LZl;_a;f9e? zxz(Px=4*S;BR43@?oii{3qvICs+VfNzXGy;e+#rk`(1k5 z`h5^&HOEjnmT!)s<3Q#ZIs@dK>08XaF|+RT-ncCIkuY+AnzM2uh9l8hF_i`zMsk&f zUUQdVzST!~kxI@2OdLrO_jq90tk8BKt6lIR>9xmwml$qjtM8GEtIt}n@a94Jd*wy= z>LHF72GXUx(<=j0RK(!bZVtkA;QekqG7d_5om@RHH~Y`76x%rOrJ^bLY!B`t?f}!V8ng2R_+7E zMmDtqn{5RS4(@neJX`!Hr@RaxPQ}16YKskQk4I^;Q49|3yV4O!Z{b4zly57rt;YLJ z;>ih3$2-#DsGC7W!Rln^^mQ_XXj?5l}LH00^2rAQc%3dsO=Y~@GBT_?pCzgKxV+I5=Cb8|5fU!#_Y=-xM0YLXqL$Cy@iwqg~7%w5d5Y%SohEK_zT|-c|1q9<&4`wMel4FOizUJmtqI&p5gKB6#bpft$7`OD34==vTHZw3m%!FnDPKz%SCP<|>hPBzI=@s|ze^HoQl( zx`^9LTUd^`PKx^}_m})&0nOJX#mO-=Dp=BkxTcDyga139z@7Kf%dh$}@bYaNIYuuM z)htztK2Kfa+3a8;x@_5)#+_uTZcB>Tk}_(6;rE#{HIcOMDM{mv-K=`YTzJiX&g)~wAz zm}nx@XUb5iJS(1mgjKx6f^1;9>h)|>z1A0`$QrNKR3az^<*ZYcQa>k4T$U@M&y@r{ zCA3mTo~HX zg??HXTH->vJ||yVCl@MrlUfH+-_9=dpM{}aTqtgx`M7(#Q0{ZehwkG-amdbxc6Fin zhUP<~E|fR_EYx)w%i~rY<(|@J)w9_R4j$jzoXl*l<*_=I4XKl$|9gZi;Bw?(e&f-( z{n|Aj|tNY^6N-XBS$Sgkzdxl z%y5jY)aN#GTSHDb+@0b`yBi@E6qsb$*HZ9N*`ve41o=I*u!{$a@zAR2hJ9_02_eST z(BIfo&Nl(Kfl00zxC%lz*;*G88WA4(TRVVm;wOT0ZZDqo_pV@NuM|GE5Uh>l<)ma9U((7ry0F9>>)Jl5&18 zO)=QS7kLbpJQ|0WNv~SB3G%xZRA6F2gw$nPiT9{PX0>BQ$AHLQ=cgbYQtmpWPn%(O zfG}FVD`LU8gck67PzOQ&olQyv$kl=f;{zf*bf^+xDp4WABgRx+T*KfE=JYFir+2Zn zQ976f*{&0K>IaayqKtW3_TT+C21(K@`WJR1-NltT40`FiJOMvM1%!Zgf01G6G2qz! zp&?tpjNVY$6fLbPiI!g2BU(DPPqf=*y?MKayKCR4cG~+%=?AD7 zSmETrig&-*xpcL>1$B%oWAv^wc+nh{asS}G2zbzu7Hd)~33jx5vf!`^Hf<=?P4t!n zj{;c@+-pFUbsq*C7p?m_{q9c}nzk9B;v_h2-*_|CyZ;up5x{u9@V_Zg|LJL<e5@gwevDt~CW4EodOr9|v~DUUl{ALd>Yk}@HI5t;5MVeG5D`*? zeUZ2bupq7=znjKw$rk$h&JEZ^ea%6PHU+~xXb>Dznb}+w#E}A?;Z;O!+pnnOwz*G| zJ(svWOsIbYLy{XxS_>OGn4u((fYH4(g^-fZoU;7%!H{ZY>dhZ9O30ktl~OR z{e^6g>lF7iRB9)OgPmHZg)S?R3~5^3FNwa4nSo&eqVD5FXtffYPtpVbJA(66N;X~> zq9TKh0p=!8} zl@0PO8jC>`ty|A0-{&7)iFsFy!K0=OO~nZ$#&wnVYuPz09NM~@NOh3WDE~WK4eB3v z4SE}{%gaw%;lBv|TMx25j;{MZ4@TGBqzXq@4WYgWp8Nd^ARm2k^C0=CT&CgcsX z3oxLxVnij@Ai{;)88xz=h3Sble`*P_W$k)7>Qyi~W`_5`|Jj?bD`>vey~TXvU(~N{ z-S;5%q&_X0)rvsNw+1bH7Q%-udxB8^0~JHEy1jy(z{Q1K0fS;o>QE!j^41Be7ZV%d*$ZF z%B{zj_eDiOR}kw4Ip8#ZpTsTDYn;fcTSydtna10FLzHQpAdPc}qA=`SxW-N0EN5GZ z@D|J2dTk^lQL1PITTnm*|NEaYz8mK(=qwF@QJ(k;WpCHEIdhPX?1UVN$b!61d?r0+ zEt~jTNKjH5cT>?&b#vP3S5%hr`w+>>7v#$S{8Q2Cg&m9A%0$^Nl=jx$e-xvn6Tkes zKo-BGZG5`L;$JQC5kL|DGSKcDpn^bD>^3!5jyRj*@X+qe=3hKBXED-)HXKQo3?f(g zH_9o7)&(^xjn;1IEycBv?Al@LHC(4SMo=}E_=V~N8}oDL1r@KojdjpvN@WB#7jnQ6%Y6|i_U#jVhC521WPzu6etr;^~>(PE? z&Iz!b{~*8MP|i?*@lS5Zcsr+DXNisjR<)$)#;L4n#F6A_dM1dsoQ zaOdtd+gFeO-_mU1zknu!{25z>CcB+<1G`5!F*yFNJDLuwQPs5Ff8J3DKcr1iv>-Qq z{Oj*h1CbSZ%TG&L(Q+*nTOu;kRi^f*B-hUQ5!#xQ9CddQ>i?_1(APLoh|fmY+wlTG9u{YQLe-T)4SFo8g)$@vRRgqF^ro zE|ir)cIZ**rlX>Bryv6`UC0hw++Me0uVWc2zleVopSI2U4%}4|t(!p`gPGO_HBu+y zzx20YoN>1i?57*UqFC$VEw(rU-=WmYyuj=sl2qFzb=Dh?p@nQ0$;C!}X+muI!DNa( zbd+>QYVYX011UVVTqddQb4~$A1_v`c9&GPw{}?rso=9-be780_9HI*>5zy5PbZbQD zdG||kVw9P`SAY3EXT2I}kefe4UN|%9{-G(=z6Z&?`QxArL~mXn#0=O7+pF1Cv8-^j ze~C)2+H)nxmK_pX4xJ-@=e|-_ON#`9Kgi8wfHqJB`dJ?ZJa!sn3wf*$q5cvEs(Fl4 zDNVqtmo#-N`%ub4c+wchar@5+<|5a!|9s$tcO-tsA|YunoQS+~^SPMT8U$$M5Nz}>CIW2N6ABsI3Gy%a zu(_Eg%|Asn50(eI!e3L|BVgAW9-^1I*bD$LV90qwhc1W9C*{{|Vi{M#$zl`UTO8RM ziS(MipoAMuBa5&>)in^Bly|E3r(DTVEDwd65X7Z^^j*a7*i~YPSdm@WJ!QJA&?C(RYK;Wr9?UL6$E5gL~ zG5n^3m~-l`qQdeY3#0xHvg1G#BfL+orBUTf-2grkr-zGU>my0R#)D*{Ezru;z_4o0 zoU=#<5KmKNVLBp4E4Ng5k4xlO^DD9RR~@41atIe|_^^9y_6tRkPC}GL#DxA@p10sh zet9)wqDnU%5L0jdifCm$5v=H}R7lQ)^%r|5>qUf%Gje8DyLQ*kVCn0~hUymhUW_L+ zy{jmC_u2Yc8^_&iJ^WMo9d21HhZgi9N`1g%g8a|kQ_*JDL?l)~)oAStM@vzG%`&q( zJM`;x)4tKUmnx;8CttJs^biIJ<>@!c?qiP9>{`q2-AiuOj+T=*^K_kJLF&xL^~iJ^Ax22fF26pq4F3eY;9V=gNd)0z{DC z9UVDrNMYyx-CAM>>3rvA8QQ_-3w30PQ&7i{7t-}#$Ci&Id%4%BbjCiciA-!%c)jn4 zWxD!j^dg;{-5bFK6SA%xq-fg%;$YT_Wd4CI!ki7v|MW=7z-a}U#&pwr(b`K9fO!3K zwhuEZ52dd3&gbkCJV5B)#GWzlpBhR=K$d zpHWzLiyVgt-e!r`tz~|=I(lP0gIWAP)LfOfX?XL+rolokVNYWRwaI8O1hH8e?tOql z*@xj}`QNdUNDOR<-n9hapGLTF_sup(&_zKP3-V9=i*#|YEQ-k9Z7iFRLyc}NcE?3R z&LxqrW;14rBC+gw>)G&)M<3e|y+fRklDx&r8an!%dxDooW|Q64bIKxGnRzL;jZZ6I zk1hM-E3dp#75&XSiH2OSQ zc``rpt#r*hjL_Zhmip}^fjTOv01Yxqu_$+>;<_Gmg4@_`-JOV~2gQnOVo#8N$R=(T zU4DoJo*=D6COwHZ^z99K4ZCjGkX8IBs6#MiJVodp8u9}^QJDiNQkeQXqJUYC#$@pW zyR&6cbiM9ev@46&W(#dH z!qkP8om%*@bxVE=ox}PF`3qA%Rrs-W%Dxb&X4kZ6-6~>9b*_un{lOqrs*|*klSo|B zE4#V4m%+G^=)8Y3d-0{5AJ*%F{G;BcztX$PrtKrAg_o5P7LN|y2vdteK-{|rzFf^? zj`!8@lc#6pOwv1nGA~`SgJuU`Cj+vaYK+R;M8_^p1zu4uLn+9%(@ zHB_N7)?bqNov^v!=Eq_(oVWvztaMZN=-f{ca7#uI(WdguDyDt$&r3|$Z$YwX)mhE& z%iI(3UnZWcV{4~MPkM6~5QxQip?n*wL2l}aK3AGOXKl@nrsy5LM8|2a=jsu425sSA zG`ijT^!w3RW__$-OZ&v^txQRrS#Ln$r;BA`;%-s0;`seqvfu>%_8HG-yh-$p93_qT zXRBDl$|@4jyRQ#@sWg%v94<3t<^?v=QU#k3PJv)ToJs6(KQ%6QbSrVWJRWK2XZeST zJ(QMT!m!)sJc1Brqk9c`BRUt8A}~nvNA@j(`F&ln-&egn@+`4giQkGPf<@K;9B1&F zn+(qaRxHw1wo?Ozuu*7F+AUWODv)s|XZt$e3to)93T_UBjozOWvbJN)Xx+~cc>Z}T z!oFR;CYf48`Fb`#3d#=TYhOb5AYZ%ksVXBclxX4fG@TWUi`reHGkt^64|yTI?IyN` z&}?xT0kSjh@q_R3)8vUD|Icqo{Q`ZnPOnm!037%@m z-h?0w=tgz%MY9?&M{u!#mi{uLhHWw9$loAke6h?~vcSQ9Q)bhctM&VQ|8^=r^-ckm zf6R}zR7UXaiOSdW$xgyCiRt*QkXu#WE0B~4)Ch6;G5uJczsUqQLkm4*QB}bW548<| zGmB~%)@fN>B{J_49LqFL|F1Bmxh2t19KcC>3rf4JxC@qHws+~gi+IgxFx*{RUlrvV zOYs)W?68WFuQQGDY;-D4&$+ErSIt(1b)_)L!sU&6iNk-GD%fyE!SXL-><6nc)pvgQ zMFD~5@S`n(r%I^xv45GyaB{LhMUUPgzW;mB&A%gp@&Bi8z5{aq$GZ8rl0yAebn_1h z@z+TnZv7w2ycjI6(znMWIPoAl83L+ZWvjkU?_kmNM<(Y$)P!qDwG$)*UeE5oNG7id zd*2x^+7PhxS-4G2377$2O7>k9Pw#A}>OwqPwJKgTM{eVeduf@D zxw3Mt&@7YIUCqYyR(?s@=_U8lz_RL62I(>!`gAjCHB(joYKm_+7?4(s4R?{uvfuz2nb>G!B;|&azo2-D|xk$W1kG{gKkM zg`?4pzSa|z@PHp@@VW>h$+tr_CTOImiD$oyL}=8dC-EcxzHAhQ1UNuBK3whvsz5|S zTQZ~nF&zpU_9F|cvmpOiD!UB*G2%Z!jg#`)rRHcg!&2FHq0v!x&qh ziD+WOknG;G{!fVoeO~tmryGV#{SY z>^iz`KXDfwuBL`ycfR&;NhL&l8{wXQ1q z*vrv7d}uJQ}8`xPJk5m_hfcv5k-D5{b&9yQl{4}(3orx%K(#| z5_GU&h{l%Cm(m$aseZ79;ocJ@P$-L7bT=h1Dm5eB+;DV@)*dTL>;Ge4ZE>oBpM**L zeZ*uN+{4FBd#&7y0wd5qj^otxiRnwlfZt~w9p2dCSn^pW|5#{uLRlWmf?})t9)0ee z^sY`RzkE~8&f}x^u8tRNOcZU(MZ=doEiU|)Ci)lYot;vjaJk$W^mz?sCZ2c9mK}m+ z7Mb)|X{`md7%SI_E@$c}2xb(DX(kUEJOzwgG%+SfTI*AS0Z{z+~fwH>zT z{A+{>LrKhSE`DD;Y4t_cTp#u6%=OfpaB~MQ6A6>sS7l6YZ+$bJ8~%q9nAw=#d|SF{ zL~OZ`n%%Dt{O%~$`K3kr_8zVWQfIVq>#UWNvNZ#l%w#wOE0GK@VlWc!tuGPJ$sW<# zYx(AP5@BE(e;7{|7bzAUEp+`y3v~V6#1AepZ;>Wido^A14e9)0`aK*{bwwyAt>jQQ zg8T{%*BPrT6HjdUFi7I>Ae63%_eBQ&nekn|$rpW(KcDVwZeF5sPG_J8%G&ctlu)vE zk%=$Z5gjNZHCQE!tdONIlQHbBO7g>`V;$pqx9%nm3HViOr0ig}{+%-b7rNHo3P(!Y zMS4enI5H(R){wyi|Qm8<(s7 z^9-iK$&!eAOYI|?RBj^=l?1a@@C-3)$B;EOrRcOW(972a9N?C6ZTxGEkfAeHnncc6 z5@zX6^_16pS=sVsqxE)PT)D3YIPRT~e=ls+Sg9p*g(NrT#CYR=M%N0}gQL0G-1&e4PeKsgAZEu} za-yp_d=hK^v#!!y^hJ8w4F#axwBz`>X&&+6M73UZUUc zUZj5tx3CeWQtA92wHTTD6HP4MqE`iquW;RK499>y16E5_w&}l<$x+njq*wE#lopa* z>yq0Ko)tTbZIA}ps5ksu!qbf%WZE-DP>|nqwYr7o{v2C=n*5eWR%6SV*CPHC3Ncwm z{2wV4LFF${C<>8Zr|>+1H!BpO<=+5YI!sVKL(#0I{-{@Eu$UQ&rq*>=jV3?rpTiQ^ zYS^zK$loCr!X-|!bEq=5yeC;>n2y%UrEPjJX%&NPsy3e~JDzz|bR+)M%O5%?Q_Ibf z1wPZ^{-Xa2Hd0K@3oN~UPOB^mdTziHX=E((3fs53k^dUs!ZW)2{9eRnek0#bS^M&y zq08&XlGpYZcOl_I$uUhuLck~Y%j(SR-dcO%f%AyqL{x2s#tsK?pyi)HC~9`W($4=k z*BcfbmS|z)9U;|F8!rlrxIY@l_}`asrKZ0KR>(7&<2{oXJ-=}=DXS{nxguvoDtZkq zi)Cvfk*}H?wscQ7b%@UWm1Jv#VUUV9OCiBp8YpysJm6jbI1&bWnqS1A2&xBtUp2i)%+8b6kDz-#j9_r6q5N90&xH6+~3d*`N~X^o;9;n zEb}fVsS56ZDQnYBZf!;!{|v1x`yAA(j(-Bi$ldC|bO*lY0LBK5pTh^nz(@y%IdG-} zr#R5hfg>H@2?9%A>OjW;AUJ|kfuR^hgm4p`kvW+DAEE8Arb@zx471*f`16G(`6Eg# zM&121*NwX0x3v-Zi}GPH)v*gV0jrc&+Oe)j_pld3uoT;Ri^kt20>PNbf0DX7{BQwY zP=IUmICo1BIXBIL$qtNj;9>_xI8f=p84jH6z_AYWgb^4>IrlV5t_`CTp^%kmePyr* z>;_c}V}Edsrp|9{Gom;gj`g`}xk$Nyb(Tc9m{Yq`)h!z)_L0kbHs(%qF;Cd-APYoN z?qL_rv5s4J{YSS`2%ot%rPf76{oYhl_9j#%f&TPjc=QNGMbrj2fOfx+A1q2?Gs$kn zG6uIz{(g=r0xTr(<)Tb5ehCr(UBjwIuLt7@d6_T`Y2)c8$p@Qva zTST!AZR3sv1zVkS^jFd2u@$1aq<6JTU7X&9Ue|>}b#_nh>YS>G@%+`fl|Oyi5y!Y zsuqKy9x=*AGBwGfdYr3cE2Lj?zo!wV&1h||r#2iNn98T!7{llx#>npMVGvl7_*dEj zY@9AW(RrOA5`~P@6o27gv;lD)kdsvWavBo{5XsRvv=d0}T=gHLj(TU>+(l#; z?WX(b{Hf7j!>2~O4IjtcG-E9u$3my8)QioQ~g?p~mTf!?X z+znqLB(_4Q=&4^xFPigyz{Yj;x1AC1yB=oUJy(le61Gl86I@>ZV8f7XaRO%rW$ZcP zj7UvvNV;)BhWiJDBNzcS>Ymu{e{cxw=3T0muJmzprT^b~muhpSa*Ie8wdb^YnkpDS zeh1bz!QAeoq|*o7@3UHcKcUs{!(08{!vk?|p3HPN`*q@nYc#p!Cck!a-h00xboUdVe{a4t zq@$VZofW|EOYto!;&04X-|tJ~T74ELlU6}b6r|A8?WPF2Cd$(utx}Y?4U!vATg8%T zvsF-2+gKm94SKz8klY;HDzB&720hp&C^w^3svFxx@h7wig3vnc`Rlf$46RV}MnX&u zsu=iZ0fTIF6CK#o+RGLNu@!3KD9)$!KZ2KB;v)j!ug?eiFXVAseiTDvY=tf^e?ui* z`UUwk{(q{Z2bl+1xVAHBt&9X&`se1$$es8t33Nqxa6ZAFDzA&uFXRH1U@%=!fQN%+ z+x^W!c!x#a1YLqdb8$rU%PY*_$xY!|i*ucX2hiF)cE(_7L5X}qGqapfz zh~z1Rd$k?!gDRA2Ux19_ahd?xWc}Kof%dqT`yEgdEiH~D zKo;)-(5-NNapVcmuMZRS2axz67f0$rmh(#>Yti39mi8pHVMAww?CUw8?`gT$g05Ax z7&Jvu4rD2IhNu*!!_poOx=!Pb1{rl1fOcxj7lN$i^&rb-1IW_83$k(#V%P9`&E+D{ zUp4KWAj|nNkhN$jXsOcWkDx=8E;~VAB07pA&7iln_m5)d@dnLrB*^;XX3${GxejEt zdK_dq{~<&dcXd286ZD|+%MU?fw=Rx63R8)Ug`2i>UgqPQ{5P&63yuI79vXr_j} z0NMms6i14Y<~JWL=m3!M)mb2;%W#lUe0&&oZ5Xx$bh7q-BgmxkCXm&+Ny41`X93TmiED?gCjZKLkyJUd550fNs^auY+=$;vJBs_yT0T-|--q_ArozodB}B z+zOhdxjY2AO_A(I8$YiT1igwQ8$b(n)aF2z%jkod#WlrmK~}#vK*q%b4{`A>1=aVF zT&@IJF0(+EVs04k9#D+6Cju=L02|eL>dBgFyCl?lB;q+2U(C$ezx9 z6*QN5r8u(BVMzJDg33T9^{PO#wX{1x?`zIWLDse?^QX;{$AKnlT^W?*N7Q81^;Dp3IuX=rn!kE|BR%kAO@c z`VeHjl>=opml8&k(e!GN^-%-JX8Vnx9vbfhknzEnAnWPw$GWr+fC4=XWaa(=WaY}` z7JpUF-nXBNcO=N-oeHve<3ZLl3qk9&+{ZvcUxF5Q5#D$WWHtBg znqn5nG}WJjeuchL9BBY;)OfFeE>^S&WbJq#v`o|f17vC2pTKTyCrR54WbwWW`bgvb z9Av$9#EGs~M}Vr8Y8QeoRdgBXVnq``CJ(*`vi8ml(H)?%8gD+xc;i0M3JrTS40{~( zdky`SSe+s{T z4H~as<(R+eJ_mx{RZ8{&nY1`9L>GZIXz+JjX$wK789f2AwhcSg@xjkQ|JE8j1u`Cb9u(31UI)!77H)b6WbOSV4Et9Y zHuN+%LeB@;2%P}35jq8A?Y$9X_4_gCZ7ug1khNo<0q*M)Amh_RiDN1Hf^1x-L6+a$ z;aAbIO#^)cw37d+a~Sp+$VP><)zTKz!Um1k8DwdDfh^v4Ko;)|kgZ%r=d^gQfUH(; zgREC~hGAXd8cTa1$l}SYX}R19dO^#*2V^aO0o15ruY_U3qn693Au2s15_v-79SC|% z(UBm_xk+BEpQ}h#-&U*npkHV%_k%2#r^2tNpXJ(iAINy}&miNq ze}hai6rb(#+aF|dqbF!K6e*6J5`Mh^G>_biBX@zG(sCaM*{o3yI$Tq{2eSHo4Z23- zbr|gGcLFG>Vc!8+ykVg4Y1jymjkjw+(=@;7Ai1QsIC3+{YJUgF;@u0nTE8v=-KOXl zpmBT)pX zzclBbpx-Jw4rDnG0vUCOgKYj71v2Vh0y3Ij2{M{q3o@FfKt|J9Afw+LkkRjMkkM)( z$Yz(HfNW;^CCKRaJCIRhImoE-BFL!mD#-NCKZE|Dwf_KQwLfI2y*D44w?KKCb{-FI0i7w=M!1ttNu3r>BC91~Wj$ zlTUyy)Uovps4tSGII-PPp8AL+3@R+L-co0o#wI?G*8hE&_jxfhP%4NK}N|5AhRDV0@=*I z5@fd0GvhAoJ&emfqa;--g)*EEftX~** z8pvelSz*{YAd{@;g<)es!Q2>zO$C{(n-PZ9fK1xX4a0s2GP(Ou81@9nF9SD$Y_5w$mnts$ZBvF$a#eyUqu&CMQRqRCwfCnW%kLK;o2P#ZvYcN6S-<@$jQ0-6=8yNoc)LJG z=XRr9ew{&MWKTb!?lRt9Z`2zs`9?Pr|N2mK5O5R?49)UGGxa#&327WTTQeszf z=hlPu@?f7_O;vp^8~=n#W+TSLGylLn-#Os9C-1n$q}7vm@}x=Lyg!D|)p zU5eq0lxTGKlaG+QXQQ>VDQ3@gOi;)F#mezq+|;0*<`?$OwOLm5zg?SgL2dNH-OH6O zT;(iXx2ohF>$;tE-APmg;uUn+v94n{yWOf|+@;>!d8rxF=t)5_@@P&$7X(FdEXs=F zV!*maqUMWQRkEtOibo&+@A<v*bgfWLfkzJjl+5bA)#l~u>L_v=tVYc zKoBz69o`u>SVC%^c#?m=F0XI#0wXK($epS_T?FzJEdtquvIg{u4$2K6n^4{c-KFt% zf=oR*la8Y@?r^znl6)7mT638IvRr0?O10d2 zkd^i~&}$m+^Dtg}M1-jm`-kY55Q%}ozMdPR3*(uOGHbK(qtZK$nlZ?EGnhL&zU+(9 zU?XE!FFw@%V11BZ9qrE{_6M;ofyg@fBeI1*L-kKL{*_HG6wm14JEg1`4}~tKzLE4s zqS;H37bES;^tHwt4ws%sFa+|0SCdftn4 z&rqH~?q+!y0x~;Ht0yOU6*HM>;IP%xMK&H#Q>>l|7hRptz?t% z+&h)#M~S%XV>OLlye-=8#y&8&W6B^Vq1-?ouyf|~XrJn>RDHnZW8=+7QCdU_w<3=V zk;q~Tn;0TTQkQOTzQ~SUp4c)wl(^4hS4(dcw1wV?%N^tNSG;+17yg>%Rr8g3D0X3N zw9Q3vY4Tu>ZYDBsB)CM!tDG9=IR)>AvIMsW(m6a;vL)eFkE<--hFe%_axx>YgiqvM z+`1YvPG+@bOChNo*^D(`I4PbzWeulOj~GlJpDJk%k7q~F*BAAOEs45|OQh<%?~*<^la|q} zf_{<6`F@dK|6#w}-Kt-N1={q>m=@0K`F@%5P5shGrC5^ZtdrjOvMO&%?{WG>s7DFO z%xk=~9?!g5<<<7Ck$@~FW?W2cP<$S19^HFVRd&jYk>Dgpm3JL?M|_exFOjWcoLv|W zjI9z?N5;EVUUdmCd#8?1cq7J@zplshgDKv-v5X5lHdUAN$=!0B>Yv`+K6hfQu_M$% zWvqvTx%SRpCB7^+Hg>tZOdRt@aO1^O9oQ=WAm$Cj`&TfDM7HPFiD)+-eF&7*Y3bLX zZi;rpt&S>_X~o!aiN+VC)RkHTIWPJ$Y2%sKszfGN@eX$&F~}_>&JL3phpxVQLEJk; z2l9QADtj&xgn=qxn0aTG%L%{4Hg7A@!@r#qB}tnBI@99=vl%oXoro`K1%Sf%>Pc5$da~9?@D> zhm`+I(z{J5-w*0eO=iM3Pveg4rxcR?3L*RDL8W9`smPSYx&5LwOLC=3%o~}^+-)6G ze-qD1z7Y%VMV>LCP4C!|-`uaIdxG4pQ|&_L+`X~o+7ox#QQur`aL)H8I5RjPFAvMx z@kD=uLg^QOj6&%YzY3V|m-`92Tl?h~AnTW%pv<@TOO-d#^^1-QeIwUI#PDStipfQ^s^HbOEsLhjHJ;?IQOI!Ju!8yzS9Rf1&X`IidPju{2Q z)>a^-7HG%hg;YC)_8V36y=u^3o4GWE%r@rsUZ90UYd=NWx|SUG zZ7u1qB_=X2=1y4PT9cgY|EcQA(nP~2N5>}r(V9{*xk*57kk(%A4`@^Q&Ougx-!}Cy3O&$+b;Ov@gKcV#+vEH=-vDCDYjh7 zO%A$lWArY$w<9t6MG2_rH)~5`!fWo@Wu8xH_{Z7th8;&2ZHP};7cXjv&)(q^FM8Lh zB=TiJw!nFWOR4V?kjz}SwIVaCiExg4Yz=Gl8@{DiKG_Klh}Is%4@b>@-$qU23m7Fg z&=J$su)#li@&={ldSi3opu(5&1N{t|Wo| z<_|!bk1q|Gq3ET=;(f;q{QcS+S2iaHu8Q6va)~-f$^GUGmdFd^lk25_j^Ddo9O!j45^5r>l9;%E zFp0jDXR3-=6fPn2Nc^C6@lG4ko7?f`Lu|2xR2@{G=(IjD`zxvJV)-W-9lALXEaB

$Y% z`4&$+_$}Ui&=?gl#kBGo^a(ubK%aLOB#%T}X_X)=Z6wHYxdCLkOryazmo$K`(p>%s z+Htz%BGuWU~^8OJs#1&Y(Hl?Oid2?&Xp^Ywj@uXz7 z_v-RZSLa_IadS-1wsQ;`>BXv$Zc2EU_2%l9CnVFDo6V{Z^WWij`KHz%qP44}aBt2c z`6H@iUgc}Pe;&VVeyfoWLHWkzZR^m)i`~SM1>>KkY1dYH6*Aq`r^eScSHsz#b7Ql! zVahe3bH>mW@}H9dv6aFgJe=2mo1S#*R=sZ=Qz{)9u#8HBHFKI6F_A_+q$$Z`nXfBU z)hn|lgX+*H^1+nk-+@lk4U8V-bdR#c@gQS~5um^7qWuDp$KWrHOe&8|Iw>*8GD~;)LpHQ%;yZ z@x-fcm@xgsAkGPsQrAuC+^cN#q{-9EuAV$)V%d!G)61@zc>Tm_<5Lr_D!cNgvMH0V zl$1ToDzBQHDjT0FyGhEpVaD}k(9_Jq!n2~#GHpBA}pd}QjxY11c9Peq1|zbdT5 zq#LHEt{;Eh#N)~)UvvEp(>0JR9ANwQ(aZ*s-A_(SX0wg-Cay~ zRi&2co?&tL+@hk!4FZBh5x($=5)m{mXatprTNKoY!WRTF@PR~S35)W7p68r%@2%>( zlSCkl|DQLR>gS$&_T@eAdCz;^(~8EGs8ouJIt8ojJNF;wvzr>ZS~s2x^N1f`zA zy6UX7s%3ZmH00zENyzp;cYA$Q(#wNtKCP#H^&;T_hWzf?x`SNu-HZ+FVAjyJn& zBtM@!d?d&@C!B}-`4IZ(7LNkh`|)p!cM*QSD&*rA4)}i_FA(ajj0w3-!XJgirZOglSQ$wnR>ri@aiFwNZ)IfUHk;_}7+c}{;ePH3>SA7b zVqGi<`9Oz-hJnJ4aa3;m;P%}@lR)2uj!`V;3nR%~Hk(Qo5#zV-`D9Qdl-HS|LVI^x zJRg~&tjP3^h7fy4SR*aDO~S1!Gz&CnsBGx#aeN&#R9>d9pe&%WpyPECa7-P24!ipu zc47MhRQh7Cwq*VmlkAh`L6i^s^PfRYzD^}#-+F_P5A-G>_N`wKVokn9h<)o;p-G@$ z5@JpMiV(~6t3ro?-X(M#=r@E`fI^}}qa<6rg{g0EJv<7`fFZtNJ-k;r^O4(!u^zH% zR+)K_{=@!UFrXs79UTG#Vgs^FO*ZI9;pq#krn2M>wT~wAxm@O$ zU#Ye`t;Xq{{?M6jq|V#k(ZXzEK6T9ZrfTiQa!WIc%^2FmzjSDIwc;#{)yr%*bcZ!C!Q^?*bRS|gokpj;+8cq(v8p|iRi8N-#rmacmOE&xb$;%YYxTA= zw^rqvq3tDuE`>U4tb*IG*($9HrHcAUDQ=HF_jw&9tBV*>o6pH zpmW{qo$If$U8B1Ymj~7@e`F+eB(*=0$rJ{SiHFVYr2!Rr0^|gSUwM*{k32j@h_fu! z2MlW;@+-VN$guX$7UC>Bh+laC)?Q%?sp3L7&my9S{b>d@L2;_7iRTIV$P1Mw`WHE2 zP23~8I|+Z^I4_Gx9`dvG`OMu`gnPWuHlQa8k!yOgkPq}Up<1O{@6CT5lMA9gu<>x)?-N&_1pC zxyI(Y+)MaH8-65JN3=|4m|u2C>Y(`pYxyNkC@$iKI@Zp$#Tt3p*wAKqK3{z)2ryUM z%|^Xl^();fSJP{a7XGf3>;8~v9P{m0ZTfA`i6!8@iG(2a@VDEOap?x0m)fu=Qm^Q;hkeXo$AiD6^0-3+A<3TLOsMK*4=B=Ll4 zU~kNjIJzU;)t3ylFHzf98fze-aN6lN%bZjJsvFH3Dw8A^RnlB7FQVxang~a{)(P)W zVm_PB&P=%37`5MMf+aA?8u=0v@Cwz=NK$#3@Y40g)h>lNYvm0q;354rVcO^*XSzFl zc1!WkNqp8Gh|cC$kNtmmQL z7OOsINawlJsx2?0&#plfR70Zm`Xaj9GU_JcDQ>FW=_Y#c2x~nVtb|jqot9jdm4;!D zTrZDgvuEOs$q>Y zYvaI7;o`|lpC>gR*I3maiRGiMb3gO!+#lhB*}o)je59abpnk2;R^%_@>^;W5kQhcE z7mpux1a|RG_PKLUp3hnRhCdYg>gg*$;NDk&3!Q(Lkb58S_c5ZvB;Jn{8VCB4CMZs_ zpBFj~^sho2K)ix)i+2;ySA=c_@)Y(Cfd7!&-9W!7QgR>A?+9Jyr4AQU^Vvkkn<*3$ z`Ls8co=FvoBXd(%c**(1oItjine%dqh2re~6j;J}@33BWd-+Tvo%J%g8T?|cTyJ-q zl+j`!7ZQbxU+#jR!ej%AN^Wqi$}v%EuX+3`mYP07cTE9}B}^`e0do&{^2Tz#b_Sy; z2tldtYPktY+gY!It~l@IdWAz`skYo@=-!CiVffw;LGZ;!7u@WLDpne+7*#=v^6u(L zQ`;g0BuH1QjApsrUT?I(*e}dya`|G(R!qs(6Y6>3!%lb>|9t#&4=)rpv-k-icHF9v z^WpwtG1P5g1|O|}?bpkm-NI>zoD2428k2Kt3Dh~^UFLf)^1W+(?`6LC3isa|@Yb+M7=$rlKAK{37+OL-Xlk%A3l5dzsiEQ+?o*Dh;dpQ$nmz!{%{hz5Lm% zZXf6~`Z^5sIiYc&e-qjV^aY_wp!kMY;N(6<`#;_{BFHj?zXG;jZ0z==^8h9eNay{1sq)U9uO*Z+_7MK|B3*G!^(z&x|4z_7~iT#D*d?HyaEkMdwD&&#}Qbo@Qxr*tz z6k4w|SFjGHR5qEL0*B`%rl#gog+i&2%;i&FB2z3JOxi!CWN|*@VV#@GPI;I&a`UO_ z6eo_vA^1eUzmndA^nn+m&7D8owI*R`!l)y!1+XR7Jo{~L~=G&vf1#GsrjPu zJiCxRP})C}Eln?Elf`r{>m}thl_(}GMB5gl z%%lrN3sIzk%AU&~$>$2i>2xYHg?!FuruC!Xn41#Z$37bpBToOn2rqc6FP6eJy7a+079V#sp$TG~OO6hC~k#h#1i6cfb-#D}2Fbt*aQrDmpVcMrOCYJNU9Z+a(~qdc~hO1s9# zT@Pe0m`0H)`XI(kP7NhLNzCNMRB0}a z?vkA;p;b`~gk{d>QpMTalwOgEd@hT+c0+)E3J22pQa({Qh}M%YB<}u}lF6hn8z_}G znPakeDI5&G+G+OO#b?w>N`sXx~f8OgfbHkffBRZ<+3F+Y7V51phFc7O?e0A_wUW54x$!-3=nNl zM-LEc0h!i1ql6Yk(F=GxR4QPUPn9z1xpXn|uAw-GL0VE%2$48@Li0&)!Eni>r$rSss_A_`rEv#@L7zP6a<2xVBde*` z5i~_TW)2`IIHs8Sq^DnvU%*2g(V$eh`6H!#Y90fKZp@y0&F#-k9r3a`^t&0(+6F?i zB%8y0%=I58@oZ#%3}1r=SCi%Dr##Nhr35H^!ON%7g{Sfh`!i{94M*^vPaR62In;p4 zJb(6#?}AG(KZTI%n*;M=c(qda)v} zjk=={yRW!XpQ2F$_e6If3t2YPH94|`k1?wsGUhNb>tqJG9n5wrjt=&oVU8Ct7U^sX zS+NNGh!zTTK|=OV7!lkwpv-48`hnfJ2kaT~dM_R}z1Y1(3YjUTk|oI44yxAimQ8?J zz}%hBGHLgowXf5O40vqUQ4Jz<8UaIo|#4F7V_#mj_)s-8K&St$)q%$z_JU` z=!I+)cueqG{KU5;IDUuIQws^6hxi{e!2O?N{C_OQ zKh53@iXYAcpEnG2#qrx1_eY|h-OgIn%df~JE$MNHpcyU zG}96MZup08#-<0t{ejPK#>9Ua>Ss_qdt>}J;6A9`Ul~(BG#EUnyis{}G{et`>7Um} zJw@e{5!hW zpUku1e^9%Bd{AcKHWK6hWW>Y%&>w#)#{Y+{|NhVS#`K@P{T}W6ff)A}$GAKC+@DX^ z5BuFOj;YUAA^v{9O!74`{@)zqUXRJ=568scwEp|k{-Kz7)@?lf{$C&C|D`eR3o-7$ z6XX6@aPLo(Ua25A=;2A2K~Ev3pI)|1ZS&zX1^s zD(`Q_36X2ua0rQFDBim#`u3)jQgiz;`u;~ z`=7vlQ2*z_V?O=mb?)YC`0Mw3w4Y`|FFmN$^A^6mC8ode=-Z%YYLFw`-WwCo@5i`5 z2Xto8IK3(+-91QS(5D}Wspnf_^7*D1cbe)N^jtp35pKU9lkQ@S|98RvAUgcMm~r>J zG4X#oCjKwR`2TE-|3P(6uRQlW==pg#vi|$q;Jc9SptxQ%C=$5c8q*(MfOrOt3zu$x zbZasG(=qec;h6dB8Sp=duCB+FD-HKS^!#v4JHER=fw%*xh~vuxdxJSSKIqd>O#DxXalbIe z{qZsGZyl5<+^&pq-yc)1ooL5F^yK=O_I+lIyW`*bliwLL-haK{qkYfCl-G|*_gOLi z|30Q%7sLOc`DHwY?maywpT8JGpB=y5U){eS6VH3#-tU)Q-y7rq&tvN0FJj#9igDi+ zQ*R%RN%wZdGpOF)AJe{WJ=-7M)S$w`)7N71*@63@dGjqX`FU4NejXo_?z{RkXy4x# zlb_e(`=F?JKx)u47t`OakLhpkj7fJUroH|+rXKE&sfYK+#Q(M!_giD!cf`26bxMDA zEXDX=jG^1L82>LBRLO8#j`1ItpOqN@m6-haNTa_@%*tX+JgJ)a-s2)DnEai__WLC@a|a)jI8#<&kYmFRf~Q4fRW-*?8u^KUWk7sGu}R)f&SVpL`@{TzoXf{U2i7cOw2lEol&%~7X2>MU|^O|RHtnfU?>x8&R@CKn- zpf?E}2l@peo^5%H&`m(M3f&6yOG0-5{fZDN?5_&l2lOtXttj1Z2>C$2CA1IdJwkb) zJA_t%-Y0Yx=#PYM2Kr;6+kpO5=uV)&5V{BGuY~Rg`fH(WkHE!{Lc>6RFEk1CQK7>? z9}}Xz@J|TQnDjpj-2(J!q1%BzD|8poeM0vF{ksr}^B0A9O#aJ4<3L{%ng#m0&~czg zJd^dj0rY60n}D_o-3s)0p*w({D0DZ_lZEaBdYaHyEb*TyFEk5O5;_iaLTCf1Ds&UjiqNe< zCxz|+ster>bc4`+Kpmm2kHtmaLO#$Lp?yHF5Xu9c6tVRcA#Gt zx(nzwp?iUTO~`wk=l#0SML@qPG!FDTLbE`>Cv+U>y+Rv6e<*Yl(49gwKKds@cL4pl z(A_|PDRdvuhlI9XfEiuL2jV5&TfBWh9}&s}-6OOD^l_oHK%W%48R%0&w*h@d=uV)| z3EczqZ$kG2eL-m3;~`HF8V35R5UrN}r_f=bEg)K3ye812gl+_Stk5k$7YOm<$qR+< z0@@~YFVItkJlvk}455pFzC&mn=sSgGfxb)VIM5|R8$d%sHvtU`-3oNM&>cXdLU#l0 z61op)uh3SoA1@H{fhL6Z0bMPW2bvUG0ZIy;1>%(vTfCcr(n7ZZWrXeo$_d>AG%s{N z(1OsmC&DeZSC6KsO5A3iKmFcL4pE(A_{kA#@+mPYZ3`hHLDE ze4y70?E`wFP#)+Op%tJv3(0EYSZIIu7)YLK{H;ByJAs}gbPv!|gzg7=y3jUkeqAIq4D@WF zNucKn(MayaLQSCO3Ec>^UFa5|%Y<$R8WFk+Xk6%Cpglq!1X5QDT?F((p>d!W3C#js zD|8%azt9FyO6Vq_S)p5j4hY==loh%g=sKbMfQmv}F_#|_@_}9=v=8W*P#);G&C`*VWHcBepKi#pqqs51^Ou=vVE@+x(MiXLgPSh5Sj&glhARXUl7^=dW+CaK(`9r z3iL}tcL4p0(A_}4Ds&&vyM(sl_cw%m{Qj2EKK#B%D39MegjVqTKB2St{Uf29@%zU@ zx8e6sh3>@fUkKfU-@g*NAHRPswC!2o|AdBt{$6Mj=%Yf1fj%bG1p0)~jX?h_bPLd@ zg>DD>tk7LR_X*t#^zTBvwdadM7Xf`)XdLKkLbE_$7dj5~2!sOv2lQy6n}D_o-3s)0 zp*w({D0DZ_lZEaBdYaJI?*#uR5;2~7fBBXk%jA=Ct#61ov+M(7rx7Yp4EG$(WyP+sU> zpn{P1T=0KF7Xcj+8V9;wh(?M*lg`5jOtOc6d7HHp$}YGv?;fzW#*X91h0yoCPYMkK zeM;y!&}W3!JKj)xs6Ep`9Mh_*2J{XI8a(>A5cbU5-2A$8z9#6yxfihEeN4*+ITs?o{wU! z#%{n0THa>zw*GCXoHbaTo@lljoyG*}X@VAmXo(s}0_L5`EMs{ZE}<1IXNIuHv3$Z< zda)+9jNOzm8X5GftyY8P!er$-8aFIb!IXismR+ZjZCZ$g4a829HpXZpaklw!2Q1S8J7iKPHt2@#{zYd|`*95`TcDm=Qh=fhjhI zT0S7RE3Y4I)M*sd{2BGKvNuQb>a@LPTz#0WLQjL~u=(kv|AH&`UAe=XwPxsPG=moI zWigI+t6;3a7>@K{x3j!T1IQs7^+rS25RSt5nX%~ZQrbS$-tOXDU9B#cVUm+ZJnGv! zu%6axSAAzB2**=+Y#IjWI<3<_!?{y^)^y7#dO!1@fkjRc8`pYI{w6iN)m+Q6F3hjD^6{8}=RE=r{lw;$xDV8Nt{Le?=LgIq8ysx>ch<)bo{tA4 z|H%*snfdT(LYxnuDa3*JEFsQw&kQ%S+3IqmQ-ftZ7^z)` z-AZqNxm{cI_Ty3uOhqP&3d|lZ;zoyZ3lpXyGB(4E*+(2Y*l!z`cC1ycaa{#Pv~%T++FExF)(}@=SvZV%2~%!k9fTp>Zo}MV z85zO^>I%(tI=tBfMV~OlW~$X_`itFm2c~;%)xZW@XQcsizOcGhuWkeeJiXLfvqSpd zTs>{F)2_B)flV}n=5%REbEF7UM8Qj@T3_z0@YPvw-fRUk0kdzo2;_|H!oe#oPkJ(1 z1ban8ZTz@dB{*g1rI$wLU@vs3R;`Q_YW2k`T^8zVy>6LuyA$|BRBRB;R^z*2R~fc| z_u>!mMDXL!%oY1=Bt6t&l)$RR7;c*q+J*>bggB^QEaU^t32}Jmg~ovjLIB_L=b%#B zigb<$F_+g1F_$GFALxV-b6FK)E?0!eik}pk1gZ(^30!ou(B`yg0RzC;I6fO{ zz(ly18uXu+=Y$3`q(NWpcbM=GRIAOA#A@wS6;YDD1Y@QH_Gp#lz$2q1gm2dJtmTxD z8<^FG6>tpooVlQ4!i;WM?gL}cu6AL-+jwRVB~@s96J|Ji6Er`FfdXs26STmJqr9}g zi{&qjS+hUeQaQS(V&j@04_U1*b6VUz#^~G&Y_P$8tLz(cJe%8QV41O5UOZVserUSZh`gNsg!n)z<8_tUU-51V48{56MnQ!x3YUt^)|K}9m713 z(>?6Z+aWG7Gwx?KYqHzlC*%YDyAZqm7lqjELkrJemfIxUz9z(O|8*gD`$ueL%4E7Pt zbGyB+S|#?gCO8<=N8sjZH$A$h47w_sDX=(CGo2^8w7}`NVRsV&X%>@HT&H{za|;%C z6hN4%K!d@ye-NAP%M(l!q}nX+7-qFv#|wsm++FDv8*RsSuozr(X`_UZ^4bg;qtK?v zFmo5gSFSUET`<_~+VZKr{Z>bigYT>5Wv{&6o+z)K@s?_>HZHVUZ;zO; zsP$7YkPX|@CRP{(t#Srr0OMr>7D8L6YKv8Wt=1MFjogF3hv_{S+-zg|#f2+&rNK}o zMLgj*Yq%1j5(MUCXKGQ5btL*$by>zz|0}WEu$v?I+IzgABSULLmEzFs(A-erB_JOl zi;@3noja1>B>0FrEVr%(Yxn{?VcKG0oe1aebC7ek0m3CU1X0 zrSP(MWOgo*95MDRf+VA<6<|LZogD3s>Z<$aObP@o?!f@_Ch^b5Klg0IHk+BApDMHs zAD$r;DQy9%mcbTQQ7FXU!=GS$^q0X;g8iap+wv-|wg8FU=`)6EW!9{Z;b>eGC*I5y z>@B+H; z0v1i1-A<|Qczar`_U-+2XuCc-0fGg#z20rY!Z|K6u{5;ZV~~!EW}~=|wl#6>x40%&E9YUC_Hv#1OHb5AN5L;tBJWX8|GCVaUS z^_)evQ3yQ;`f_faH~qODE|d7j&hDNIp!9_$+}sJj|p+m|Eg-y2QpuWgRkR2pI2B8|4%5yWbl>4|4aIs2l{7yJq+||q2oYb z(bpBA&&sU{be|BwdH)bHx_o18)f?@AOChT=hWl7**cri%zUG}*`|1_H z&B~HjZkh{ju)-MQ`zV7)9r+&aIIq<xKXHyiY@6EAVRr zQvZ4(R@xhdSS_~*u`=EwWNxOxl2Ki5C)VSTHgq9!@7C*J--UIH9FW(luHohodtcpy z2_Qcui28Y#;Y37mW|HGYg}6uuOgO}F-1LU@?C7!JA|G5BeFj<4zG( zGWLOYdp#ltL0?GNXZB!qKgKh*%gx1#gF^Pik8E`NqYf@g!fMFg(?|)1DFSa@;ch?f z*M^)?_k3ZK_cTkpx_YsPdq-AFre>BZC~?$byP)>#~S!(n6W@MseeW}tm8 zi*U=h(<(6W+0|Eg6<@ishI|>n=6)u#tTW!Rd5KFGDUPs}fgOYB3JNPOG&omrZP3Ki zSo&3}{?%-+K7UMCvWI?uDRa@4zJmw`)v zaAnd4gli@E^Ve}VPH@w>`G|Bvi5qGh+tKJ`L5PMfQpAPqooYKw6L*$DTI)n-65E|C z>F(-7Puzs*Nj|1v>`@Oreiy1Ig_>0?sFvHOU7taZU~NDec>+C%yH#e?d$uR*RuL(= ztW{4uKR=q=Lz2ZvOn{L&-Lb>A=x^?fx<+?XrJ%PQu zmX~O@@b|R$V!C%%A!J(i3e~2U!xbgj#wl;Ax`;gi?yjNp+Fb-UMmA~JfS_3~RH9)& zx6=G!2oUNG%5-;l%|>$%$mRL<)R~=0^KZ&7_P$r!MVtbjBpnaV4NnO)K%Oo%47ZDf z#(|zK#A)HVLX$uj3vq%l=s3{x}5YIL`H*0Lkv&$W+C>Yw+gZMyiI5W=~vcv z?k-^K2^6K;*@=tIu*uV^uGg@U!E9G?)2E5WdeDq$Keg>QG6*dM?g`iS>?;H{f)d%`7tjwdH??B;HNYy4Zwzht z&`0u5pa(&{psN*hd+h|GKEIy#7)f6bmHkjaWVZ*~ZI=nL;zoqn4S1Rkrv!oa2u%X* z6XK9E2xUJ1=4xB$t;pr0oTT%^-_$~%hsumNtb&Kd-Qqc>?Vg~}SE=1d1g;Sx5l9HJ z&8LLe<}*TU^A`(E0?i4r%?&yZl$Tq3?R->g{7bbtxr;3UtMj`9KvRHhH+8w=6d{`AdZ+fxhuu(p!sb6ueNk=|Hu0qS|U; z&wlZSE>twbo%!~x-mu1rr zbxiF2s#H*+$aOU04fn$0=G#I(-M6<4dN1XO2j#cZI9aVneM0TD3hlF)h|MZ+RQteE zYj<1C5EF>wG?$x5@dPW&VO)Sd)ZM{i8@2tx*>%fL-Z2>j3G3rrS+e=Ru3K%L4jUuU zfrbZo)oMFZUlpp%K+034_6~Nx*Q%rT<`tJ+>c4@3)t&4W`SKy)l1dM5YZ<|X#iQOZ zuAhhYRDDNZSbG_9+qXU$QtC!z)6LD>!8k^DT8U}fdxRT zLW94*OZbqD*usu_xaGcey4jfnmrvFBunxn{0=*h~q1MkiJ4(bKS^3yL67lDx1byv2 zz=yd{^nuzs63}D;LW^kedU{pFv&#pU9?%Y^4l_HU?VDw&fa0tMo0a0rpm}`g9HMb5 zqmt9OW@Ht6q}Z+PR+z3G;p|AjaI;#=PO zzi)lp|M{i2|MIWAHqhc&;HBj z?)%q&`}fa(;fr6o|I1(b>ev3`KfnGBmp@*nV9Fo={k$lDwqfOi(c8|o@Lz1Ky5a5S z3#;JHQwQeE4Osdytgm@Gh|)_)BPnrrnuNS=CgErRH!G^rAHzNZ1q+Cup0PwArQk6g z>OGoMOeeZEs6RtGivOkUzgjy%VZCop=RvLjAC(cx6a7kcu||=@D7NLCdM5@b4p3E@ z(gvjEAjJbd26~NQI1CD^`Ac)poD4Wrt+kAvqXd~aI3TTU3^!0#XoS)$h4T<>Gtq7f zn*2B;IN|e{g_VCU1ygn;enYz<)-c|U-nbdPtS}g zWmc$ZGUNg`tOjAd6pv84Pg1LfNTH0mav6%|ry-M3cEZg9tQ{re78&>4UMQ(pncAu3 zUW^R9FB}fTv}#o}{4gqE-pXWlD06KnitD(A33y$XO=hbJ8I2yIk-k}wd3eHROS_Dk zmNuIk6_i4;0G4~GnAsTJ0cYDzjzxBvy#=$SVY|UFMv3H0V^-c#V}EO$gyeo{hl?E1 zG@8}=nB*=xu@}))=5BIN0=XW!e-XWfO~NsS@Hl)^arLWC;q&@BTQ|KQc+-^oFmISV zR5@lXC~~_ITB-8z0Gq;cWTunzhA}dc8a}3;!eNCzgk`^90b65L@xy^iseqaUivFf) za62o;k5gHO;LbBHZES6E??a=>3#UQm%pKoFo-heUDj)HzuAabw0FWX_MV7kt#enK8 zqcjN7E1s}?%?Tu~KFWiXu5=_<;EcU&cMYsM_ghdII!)E~SJ0L?HmHM5<+Vl^x&nzh zc3Z{KMQL5L+_tL6Xla`-Y^SVpka4IRstEE${cWizmqAS^P{AgP-Bht%7QpBx-pC5F z)e3eB(y{OKH7;4|N9U`K4tu*P&XLqJJZG5nXrLPu!2^yPyQ zE`K#0ye4Gg{$d!8^A7G2M7xP@pRAq^dUx&sRdRdNW)#VUBJhWKZsl5$TTB718cwCO zuiXLBIEvF)u4CDS#%rlF={!Nw=#G*sBfx4o0kHYhz6qoIK_rKr6`xpih;qFQ!lXRA#A8j10B)MpC0e*oA9Su1zAjF z(-<_^c$6dOMAY)ZT4U85t%GLHNq?yei9YJnZYXOwx@t4w(v~Fw1vQ+qjc>t@!(j6} zjY~dFA5asNS4nP98NZ*(#*5(=siR@k+>NV-zqXA0WQ2xrZ40Vjv11=4*6vtPyvQCm zrXENqaF`YCtKooCpID|XW2~5ScF+Le+KoM$Ctp*^SuVP%X@R11OUw=&*MUvO^3e4F z9cFdl{A-}f;&fGZKpzHs`ECu{qv7EkBgzQy7}Yol!dX>>KyvT$V5TUj2;fXnRHXrP zu^mQ%MpL<0z2p#%5a3_}I$yV5J_VwtibLJ>l@g7B$-<^n&6EBEwwj zGn;M|{I^+XXyifd4%A#Ts9Q<2%21A=^@75zSUU_E3S2l-2cr*P7obJN<#sM1F;`YR6FZc zFfHRco^|CFSM0e0z0eAXP*yI`?5RvbERe{-s?$KPj7<7!?PL{|c%r&k=FCYRrhDQ< zt-ay~rt*h=Yg9?Xab=q*l!O`M6A^X>{eg*Uj>mvnsX?m|eHxWz>sbsuwt}OT6jVfX z>_d&j7Q+P5Vo=DgAzH@s8_L!=nu6Y^Yg0aM1H|({feK?pSseS%aB8`SmjsFR%Dl1tZ2jA{(P1taW1?5VQ@7EKSxk>j)=~_W!!Xxb z;yxP3@wd=3{2XC16m$q0hC`Qb?C_HFNAkr|sx+TEm^*-J#J%I1UpgfdyxX@lmC3|> zNzSH{2ZC>rAi3%33~zxBBP^EE*`7!f#l-#uZo)0#zUIhv%B8t6AY(0|vu-S(wI!xTRt)S3*!^);K2<*=&x<;@;(c$9w|$w%&M0ed=&Njhoe@ zP77JxmK}9EG@r}PlokrOyp?y^i_Bd}0pi_j@j)cjEeP6G5S{0M$@j%3WH>7UvgGf38^R z0iQ|-rf^5QLIRbNn_D|@cB3Hl?K11GwGY26m}|w+g7YbKzDNqT-;`43R&%AC$<1&a zrLyTDuXBmRCg?os82u-iLXEqE*c!$q@j`QmNo}jvre<=W%dqZY@>NLBU~pnyi6#azo8i2J`|Ay@_J^S= zG`{aJPvRG8;>R!o-F6oXoYQ_|5zIfhO{tkBvh>UMX5+-_PDHN$P$KM$B#^LK6B}X5&f{7cqGT*fu=1mDjH@#) z8zGAJtmGf3^{`V>C{CwSnW=)wJm#JSkof8O++4&|0FTDOmIAn(g#w5&CXZBNj@r98 z6TviS;H8SSt=*pB@jYwI3wt$H*z4q`5zjSgqpgi)F(h?WA3FmK-ED3T5EnI0MKMvN z1kt}awV>lJ(pZL3k#^H*$U1#kr?ni(lUk)+t**&_5(rd<6=XdipSvM*wMC)K3pEI` zq;)DzhK1gY`|wbENAS_?+8Rli7kPo{9oc@-mtCVFc|ynipXYySpr;0^vU*68{xd?P zeIJ)59ckZT(alMqzm*$l-=~D~K+n+E!$3c-u*ZSEQ*LL0&dBXXpic_j1oR>ur@R9w zD|9E&QH8h*=ri(n(H7)IY4|`N5gG>iZuy%9`T@D!0`xK%p5Nl#0rW>EKA>0Y>s>(m z<#rEH`C|IxH9NC%<25@SrG{kBs|N-0eETnBbM}f$nftAHYv5W5GZnXl*ls^8Gz`RR zDz|+N42+)sz}O6W{6UV<^QS%EV`KMtoNB-mlWJVAiYXK# zj`^mw^#MU6dC$Orn$(;3S?peM_X zw^lw)Xa(rEF5%a+K+lxh%|Oo*;;og>5xNt|7rF;%46_*i{5N~7HCS)GdcvqdK>2QQ zMa+u+SsMuEVK>i5?THwxiVjUpttJlFwonC z#(~~0WNd~*Iube34QsKKA9#lfJF$&U8ONgZhGcAmMs4SVtcZN4#CCPQsGCPTiCxdxMY<^d=!%oi>uApeeA6ZtXf7L)6+c zF*0DQm=lqaP`W17axda&rEU;8K^uj-SwY-UUl9w_MwoT2F%tt@xK!iX$z6I1kAfUZ zRSA+>C?TBmc)l4b7my|yjSA`M*q}}nWJEwg_+e^BLn_UK8mkaaNgT9VUBbl|E;NK(R|jIwwj4nn$u#3<(vC>yDhkxwYOL?tl+zZ%O+ftaNXCz3wM(Rl=obW+WdF#QM?idq#NcHWiJ2?ApvRdG# zL3EJ(SFm@;-sCWqo`H_`$lTNweVZFHyDH<(7|g6_>TIt;br8q2s0Ex)(}uNEyXKt_ zRGmX5Ej2vogPWi&7%#aD$Mr4R7^#;OqAN~W^KZsgLYSF zf7tB1K-j4R0NUVL-SBYsiHbguq zSo6209eAW{WOtaMIAgi;wI=jD#$BU({6*`x3-vbn>;F()HK#HMMS{M1 zstUy@C9Erx%mAUea11M*t!THQ*4cs9E=IEsFzip~V54cB`x@O=-Ony$GCN^A%>cucV+x&HkVBu^UR4AYOk`eG_DRU z=_d9jqfP@-K77Ua3t^@nH@V;@7BrEE8JaJO+ZLzoYtUW23Q3`Pkzy z#ST4jQz^z%REyVU&1k#Zmgbg;=d(^Dbri%Uy?C6~k*|JF(tFkgV>mX!GV*9BOjm7+ zEym+cb@5ugt8J_L>GksI(b&L^lcT28p<4C>>um@9#dFAGeWJ5%;?KY5k!E<3nf&kY zkWGG_Rwh2sV{m)3F@W?qA(rBiLi>Q8AT$Z|WT9E0rwQeOo+)$~=vhL?fxb&<1?Uo? zCeV=32GFq3S)j{>ZUhD6UfzWM0FA};PC?Nz8Ja15WymIBGxZtQ{ z%^L2+zGx-`VEKhL4oL9s#do~fAX9S;x^dl<|)G5xDLcvTY zb4&%XePkq`f^Kc_HVaJ}Z$clSYhGL^ zcoRvwjezt|B&p`Az+hs*D+9W>Tpk}b;3b`(OFfC(B{qPJ>yNxcsdyEPQbDMgQYsEin*GG z#UOoIZQ>#(oOo3uvJH)`V#t6NOPwY@!Kxs|0X7nzc%$x-ce*Nbs*5@w?Y?S=p)8Ot z&>}0kDQ%p!&@`0Ws#Ocfz8V3revrFYR3Ag79 zaXQ-}ln2@=#OZ8I=s3_`q2B521#&y3ZqzGoTW&Yl#R4%8zGB46|Oaoy>BCWyj z+!v-79E$Q-~dj%XP^{{2yZm;O7y|Gt$}+V z68Y_3;6aCwmQ7&Tw2TA1BqW^`t#v`GmY`DEUJ1Qa(1BVFSVVv&=tWTja2`A;NoHh; zl40>7Bo#)k;G)Kyg-&6`uauq3oH>F)7t&_HC94>0FQueab5oxmyRJs=xF!butavtS zkdLqX9ay->@pi-nAm`G}@qR5Fc*Z%o%6501rQgKD zNOnOax~dGwh$+o>&t}L&3xz@`g!G#!+i*J1e_A4qlC5)D& z>Mgj2AXlp8@C}0N;Kdd`@@`5TIA{w3accMCaxV6rk|;!u=7hhG!lKwg5ZfZAq*SD} zCScHTF2mMKqz-%irCjAkNQ`S~WCqjBG-xC`juY7j5#v@fk*>UK_c&);dsKKe+c1MG z&@($(91-l+QxIMSSq_RpyIDGu=%smkWi_e?jXv!BjhtvyPCGA(R|Ch?h52Z6HvvLy zgp;^F*xCfc$h2X+Lx&EHPzZ{NLUt>xylsTS+|VtEYiS)OQSiy#qbkNCNzo@_&&cA~ zgvl0**!uwjecx5t(D)t>blV-G=S2I$=y1C06cl^Hq%W=_@HSbjh$Oq|TYSncKPD^O zEOQm3CXU=!J7MOlUDlKn@0uq$F!l^Bi?TZqh=S$hhQ?rD?vB_JgqbjP5L^d4ydxro z9;R7&d$TNj$j$~0ZXk3s6| zB@Aq1!n)=5@azsCH~Vl6-caS3{~}%7DA-y&Rq>~J=up$WNWLhh@k!IVyc$>Zv&$Qz zVeN;$k51wEsx{V(n2q^mZg$~_JXq$+G3#v>*BV1S9{NO|gy1L$;{4$xl1}4=9_>zJ z5EBfo2g>&*4Qx)D-AKm9Eg;_DVbd+7iah3rgu$*}y=${`Z#MG_g;}0I!`a(Zm<5|x z7dVdy!;g$NEayxvaVT*l$Om!+D$#D#ujcqdpfUt(#!g8j&>*Ub++wJglp`8t zyO)@&r;?OoJ!5Wab_35cvZncwAXZ(@gB@`84&2=X#u$f!DXR9POKvYj!jUt!EO9)9 z^0fJ*ok_NvirDfijxcd)z^(w zf?ehes+L3B%$jD_C;jiEFJWNJvbLsOZP|?AHXH4dm!y(_xvQ@|xE({)2DFFSY68VZ z@)PW}$RijUldD0caD}a+ZNj4Wrx<3EdJUX823H4&Wv!09&}{!;T8T9Jv(H{=cf+_x zLy8Jt+VuzZ6~AGtd>Hu<={1@GmOe*)m|!SO{}gVxkDggw!OuO3JAq#~1kB{L+$dwG zXLJAWm+P;?eyExTGzbd-ys)r%QQE}hM2tBwG(WClN7c&giJja`pI=;3xIs0#(_h&Q zX@oidC@GLXY>46rn+Q53rnh3%a;7`NcI^3V;wP0PKWQVPp*ZxPAZ_(6kxjRXKEuOT z=DQv3gZzZEWB*An9=VdKDkC`Km<~IX;VE`wek85rI?5SVF^r^H+^n7^ZL&nSyJK)5 zkOrJj6J0T;W=b}@ipdVMFq@{&i7WVq>lIy?MZ)N#@njpP2Cy4k>;~pK1*Pj@t~`9i zx96C#gg5Ufqy4|;57ppYOy;lT&tA_~8D}|MM2C|4b!@gfOGI3jm}vohYN)%`4*i?m zQ;>%s2GR&?!3Z`;M6%pRmv^p|m}ML0@=zozm9@$mL}R;Ps>TVikl+AmtMltI#bC+W zm$a3)lUgE^SOA-Ye(n$?k|N=yoy1_;t?VHZ#PHqwK0 zSyySZ)LqlJC745nsCcM`z9>12BIx}TE_hr5G0|pZu##N>so)Z?{Wd?QYuWx}y8@5D z>Xh*lJRyd$m2Pva+F3Lf2|ynQ zM`tYI%W47qtirS`ZL*>C9Ln8Fvt+An7_+%_X>4f*r~~8c z^9xIUjzsCcND~h^0@sPCatRWID36i2SmP2=<7!qwMoMH`!sYhQR_;E3kh^M3;X`&k5F{nhQ3K?^-4;f9uIZ}Et%u=zO zT;bBfDGICU0G)V;2YoQ^6;T=MTtvFvM%V{O&+V8L;-4?O;uL z5!J>zxzwDD@9;`5Fd^JQCTodZGkduw=a%4TKL^wZg{Ve-5EBR3J2#s%rZuQ})taaF z^5;tYc<^9b(9Ll{&*k{XXU^XI8>N_iNs_CG8enMCzZfSL!DT?Y+ROm?mg?#13H-$l zf+fieLOn)I{|Z?(@)%4EP%C3r!b#F)7(Eez+@#-=0TDKQ47^(V(4i;tT2fAE)Gub* zh9G#x#+?f$yWxln^#&fw$N=zbcIm|h89Q)h+Ms4!_@~z7_AkClw6t93IzR9`_6XP;UExcsvFFKgh?A_&fb{ zhGYuQ)S(vcQvQMN4P#pG4{l!jfKVjhIpNvK@bj~Rcn=_Qb2Ke0&mjv$2-K?>C%g_Vbt!ti96gPlRVCxdwFLA*Eom*X|ZhY;NB1o5s1@tzTaSPZJ@ zRR|nARSz1vqq|0V`f~(^mJN9|G~Eh8I2h5hDO1N;0%`ukNkio!_;x#emW5E)M^~rC z%{8n>jNx7`Bi6C&HtH>(0hQSp(Vr77?@YUc^-pyKQ@bqtf}e0Uq+Qlr#$*V86s(cC z2LU#cK`lD8RLf!C?;H03U4>oStG%nRz*__ZP!q#u^k`ty5El@)8ci7WUG}(FMFBS_ zWBJn;u7pU>$G}T)rSD&^UrDdLQVFM^z%Y#f%|b7I#B&Pux=y`K+Ux>%!E*IR>`Cjs z>QQFhsN*IAsf<(_Qp#wbtTmfqUc@h-fFdvV(~Tu!<5BIToa6MBQABQgm(C)}9HK0F z+_Hwjt&}$nlV2(BXg8rvji#q%Z%&KUZ#G>(h1LX*euGVm2FcVme$q4`O=(|nsrCeT#GLE1(ROtV#)jHstaJ!+SmyTVN@r~q9%XAw_OB@y zS+3S;G#hPzsnvG3i~Upuo6R_pbQ%|2_%t})f+g zn;6*@!BDyNuJ#HE9%aA~A5ubh~QcKxW@F|ls8wHDZo%9nJ3S&Adr2TBX^a?idR9K zx~E?q_Zxlh=NkIo`{VEDRleEp{pm;Fw}@Bay!lumALv4%aiFIPO#-b6<$>Bl$AR9V zbEZw8_gq3QME%U-a7`-0weHe){i!KbQYKvIepZp}s@)-~(MNw{f7C2le${l^_qd>-6^8F&@rL2K#M|0p{kEh{ISWh$d6(ig{ zNvN`KK8I>)pjPGaN)v(e(v%dtd^`HbZP|E z>bmEFo7B1eb?09iK6LqbkYR(G!$ zGqP?f_KjVW3olSSoLKb#g%@C1RRq&>v0EBaki|YWl};8>hf*f=#->t8Glis)?pP+5 zJFt+S@M2Ohe*5B&@k{%AHV4%+YZD;BBTdJr@Hm;vftk6>{#1jvuP9SgV zT+KIdU$7VTg1IhS@tRY*iUJcd)oHmQ!b?{KR%5#`DucjP12T+kjp# z#F*dtT>9g(@Qrd~Dz^yvKyMaeifTeff9^N6uoV-(r46&9BsJBX0mf3NI zLUq;48LN)EugS~MiPFEOSA@QkPG5WT)Cr-=0&XpI*A3ykB@MvOCn1D~>Y_XE?#niG zUo4XOq3$)p;I={InxNaL``RKI{)TZEM27OVTd0))vt#E!^RBl5ehUdT!DP`y~%rVg*N1XvB(M#N>jkK{3)$ zgl|NzlwzWLCnQB2QPV+_L&Orp*>&oS(fX328k{rGRT-JXB|^AJM0+Y2H_#i^Slx?1 zz!SlbKQl+lV09FkO9>yb<|Dym#zsA^Ur{)WJj$5Rp2{z77;us`7hIVJ$>Gw*(s1{w zKW3Eb5R7Po?=Aa#ckhB#U&qRet2Bb%V-I_C|9498OBnA))btf0QkVY_B26KoGAG#{ zDMb457$H)P#|e>kJwa#^=t)AeKu;0M13g{nFwjLp$AKP+3$pF`F1a<~_FSP2pwmd) zu!9%N?MApgPv|C~?Ls#LT_$u3(1_5jK;uHU0qqgG9q3A-JAhs&bSKb@gzf^mR_Jb^ z{X+KuEh`820;S}3AJDAO{XhqVkVP*mv=!(&p>04#p=+@Eb1mNiTm0w$gDGf=41TJy*m6s5lReG#G!+(bRP@7kNv< z^V|Xan<~zEqNJHLwBv*n&RE`O7=zL;Ntp->M2buZt1O$65HELR4i92|XFtd@H%p3K zs6o@E(=0*i0KL|dmCO(C=pjX&=7cB_s%q0?&Jk{f`*GD1&I5Tf8p6^hMcgBHBLsxP z+zTm-+^9mSRk+!sN4^`L&If@Z?}|f3C7d*XjF{C9f{XiM07wYAZ1jf~BlA5a1=Mn< z2+Q1GXw6ml!)O+m^{7+*gHj~25|rCS0!MDBl$=R5h5m+);`XAIIZy zK3-ktMD;Y71kF6wnv1@9)0`sR9PBtnp4YRtNn(YPhN+iUcd>)*64M5eiHzzGxLK2l zF+PedP*+6Styi@|f8(Up4~nz}bV6XG8)v9uv(VMWp2$EVpI2pY+_F+Q?D>~to4wg2 zY8w>p*$f7+TGxfpi>uod&hmM>dcuxiN_2wVIy6MPcgEITx9nd|X#_poTpWptU_1(9 zH(uF&-FA0h85c^b&wKwDr-O}C zEUF|~O+6}_DO-dSyd;ogN}ERLy5}fIpiLmTU&RCS^75g|%ZJ)8M@e3; z=H`Obt(RE!ZltRyJBKRxpTSV;9H>#>tlJ*nL*sknj_{BV>miHkB-&LYI|cE!={Byi z$bzAhSB>mY5@KE;2f3p}fM|k1o=uM27>)1>l%R9rM`nvz1M#gv%Q@sbITEng=G}EN z?G&Z&0a4e@OgMGxEGVgSNqGVG$3Y*BfEr7tB6{6`oW?PUxv}Ky?9f+T7lB1#XDrH@K5oq987K4yx^q3j8dm?%hA}l{gHeR7 z_P{gxb(glIT(lT$P$v~l8q`ciy@v99vLICbk??`5O>|DBi9TqBKy&2{N4)*34K1Fr z7J1Z_G_!J33e`qJJp~%9Xadd6$dw&VBME7Xe7eT8RgV6N(GA9+j$6v90>l-LVO-F8 z%)wr>G03UIW!6h}TCl!@oJ+?~U0}0HNYFDhgm&+~(%l@O52_Maq~aCJh>AAU)CtI+ znNuy8F5UVHQ>JZP`Zn_l{Zs1*`q;Q=nDq&2iG4(_LBS*VmkhNp!NE*iTh&jN=!hi6 zEg=>uX5u8EDG}Qr#KY(X>1qMqI>#HegGO<)EaWk+DI=|zvbU{b#%#d!94BW^1dP?Q z^RF{MfN=?u?&l8d)Itz+)ZB%QP8>1dMnY%ox3Rh1WFV}C@D8e8Rnd0%hCL(jdf^S= zC?3NY=^}&^rm3)z#icldm>$U;BaU3BKp}<>B!;z0X=jA7vJ=o$ZiL$s_CO${Y3}|E z&IPE_L%4vRiYZvv;y^uy3+6AiNaO?GeYd9xMhbMJ6%Cj#WA7C?uu2{f{DO%^O`DBc z0yP>mR?(TTPit$BK`Am#AnUrFshp{tEv52- z@}mzP^EHy~p4m=cf}^k#_>n^pCX&D>RN0MERy0UoLJ^tYF7z2As^k(zEHe+EVM5mK z`KG=tU(vpe(crcn&8b*c59JfKFS_yGmjyG;_BlrKwcEQ&QeNW&lO|-ek@8crUhyP0 z_Py5n#z?2wE_f6OgBhF)k3LU$FTx4$YuxB|Wu0m8c4~A;BbZ&Ow6QG<6(A_D896qOs*^pl_#t2BJ`mg2Da*_F|$RL!l_0&V#fV^O5b9#=6J*E=8#T_6l&2VL-)kQSw7l;-MTI`Mmb{x zcv+g_#IP|pR9hOWjv_U8*A(I9RgB*#_D2{Y*MOor;pPntq@fq1gy#%ockX?2H9RRs zB!)cCyXs76qg6X&$SDe_lc2^d3Eng{l8l&zF4+bum?dyrGzc}}?=QD;kFzet>HmVY zGy?0B>=810h%BwFJY*?hhz=3fap#rJ$Z||oFfHl)DrTQ$?#3%?rn`=MQ=!|r<1?9i z;B>8(!w2?QK&33MuxW849H!vlPTQf#@z(+^YtRoWG18m}p?-^#rx-}6Oh`(F;E(_H zy+UUcF3EtSVNV@u7gHBrP=wr=dOi5O$J-74qh0tn4l^K4qX&fgb4Q3B@uhy8E`sOE zBtlwDV@svOs<`;O$@#C~w)twy-0_XML~BoRHkiM9vq zqPFsk%y-jLnW77Cp1)Qk4NX#0er>hr3u_~Mv;O>XX%~!fl=KI1UQl!R`T$b9C2TRhQe4GOqqd_xP4rBUErxPYPEhDBeHFZ5&@aa${`kLX$vegl2(WA(RKYT=6ZoMj+!u z5wSrB$&#DvIp0RhZO%`jkA)qRy>e_9cLQCo#*`II&iy`lg}ko4k9wLf77ztGc18yl z%mhyhIy{2Y(rsNzWp_`)E)DdNisng;59f-x!wD^E?mEbke20vuEMXf;!|nz`VpGB~ z6pblnL)_0N458lxk${G8M-6EgsiEC}o{0=+A4(uxn;GK^6g_aNK{2B@ z={ZrMTg{O9p_LoU4hAd_Z&+hHIVC{ZqKVnxEg8UKV#$_6GE2~8^Bo~~n~laSM7nOy zlMMdqT!RUwm!^8`93$rNiOPu_N2fZ{m7A<=HSiXw=au-U&!lS7GxaYeyeuyn2Jf59=EGGpZgq#%ZdMOHi?? z1`^$6a{UPM*K9^#I|pRwUR6CKpOQ&#~Pw+HM3!?B%E=@{J`ekhMH= z=V5~b5_ZYu(|EGG`haJr-2n<54YppGgJF7G+2!aD>=eLj73S;O*uZwWNN#1$Z@f+# z3W3-F!WFU3QbYl@h&4Jsr_6QLwDX{vr5h+aY%9fw?0RmQ@AsK^=whW5wdl~rIu0s~ zkPsv>p_jD357DAEiXVJ5QpXbQE~CbbGuN?LS?W+U4qre;%eb?0Ik=*hDL@ngu>+Dz zW@+da%^+zDw&3u3s(@;`(Js$Ojr0 z!T`}UgC3~AIB{=}+E9K+=^=JnADq#ZX)}QO3&0)~WS1bl~0spqryjCr)x z2&DO~KerQz3<{~s)Hc<`x7mZvH@M-0yq$6b3szV#&OC&mMHy%L!5MN1r-O5tRpAi6 zu3MFbd1ulov`1p*z(mcv49Do@&CNPB5WM$jY`_d!C# zK*Ek>53*J^%zZboD}yHbIX~262cMjPP769;r_5hmBIHhG_4O|GBeZ2J)o$ElvgsO_ zx>}{YT{YHFr%n&6Py59-Q>l;HW}&dGbP>4na|@~96SC%PY_km)Hn?Pjhv8l=UIsu| zv0^^Oj0&ow)-fmJ+A+=9jzYPx!`G^KWpn%F za8hNFr;@sQ-BOg4iCVm0Wz|^TiDSN67Ki%O+9+u>heMHeE=cU((*h1v^bGoIcGUvq@#A^J$?;1u8Pp zr`6^$$0q$wJg&X?zQhSo`I|JLI@!>GuJO)fe5E9VTK)-&<>D2#p6zP6{=TVT7!#Sp z9vT4S0q5}0iJ0z>#++>2sax@u_8Me1R@T0gz;U{Fv?P#$cNG5Avdi{Vjn#Y0#=eH8 z)CO@iojadmv!?p5P1!V|xSz~K?ZXm(%)!0N>$aEd)Cj_6dCJ#yN2z8=T1=N(Hnj{6 z6^WCYH(8mS3LAoIB6_IN&}U$Y7dQJciqeh=>Faf#ypgnFI?Yb+dUFHzHXc-FIDL}P z6o<#v-TY8v!yQ$_YSZnxS_}1URasQPTQ9N`1F9$003xHF0q$-qIh~s%h&31{!db*L z)wpJ_VGc@e?iz%T$6icjpTk|jr_%=X0TaDgR+WF})$p1r_{wxK4-vhu1XX3ond^sD zlx~S6j)Q_98s#c5E0JW`vBwZ5e|6CfM_VOv^`}F%QZ8Ea|q+Qqeak(;9&qbsho zI`o0&W)sl_O^pdx4YPqQx7r|EjSj!z=%QD^%%T9WnR*a^O zq;V!`8Xo7YFJ;-ny?s^zyg>w&Z|DtPZ~}?`N?9Y>Z4Up(MR-i zmxNuN6AU%->?A|l!8ygyM$mjii%c_>veBkj=}HZ4znw65T-k8;WtX0jH1wE8l2pk} zccpZ;3cR$TwX<2u*roMbTP~3r$oUQ9FU$5xvT19chN5;J>J5xSjPOK8uL%KFmopBhDp~(`WX1G32VJZ~dxLTQ9Y9t18_u*dCYa;r_UL_Sc3=Jo_6% z%}wo1>uHg+PLy^{Z@n_3BfayiQ)=Iu_8}2WYNJVweYzrjVroQExVIkCvZJO#tQQz!60i#8s=I~V1<{4ve&tF=}=?pL9Ldyq^6U!?rh=|IR`1M zY4Njt`xXw$wsmY@pRngI^{=LFTeotUV=IS1UR+}HB~I3wo7m9pvY8@8Xag2v>rKs^ zOZTO%x=%eyu%H+ICvYomElusH*)gB2Eg8O;)g4(x<#D`pUU=koIeFI00M#=#Vnzp> zN5(sNp}~UHq4E3?tu&9Tx>3z=Sx;$ z$B1}(mzXUF^%=Ud|IA`Yo*jNvzGpqF;FA>i&CIJ3(f>#2*khI~NtP^uB`W$Hy;MV` zhQ&FCF1_^9DfKmgP{xfMaWAWL&iDoQiaLHYxnw zkVG1aEnJd4F*KS-TuE6l%i8n8*H$|=$@2VH5Z$9iYR-F6!+N#gkv^W2SrK0nm?1N=NeMGxUVN-bG2#pCj1 zK?|WS_9B3lEy&lf`^I?Y4%k?3EhZ7URaV6ao+U;rMPtuUMVDS#kUsch;gpu!E@RM& z8}pK+u>iqFk-cO2X&fFH#KvHq2Ff6vW;}nEa6q@Hv5MW!{;cV8hSSvU@}SF- zc6KVwKEQMjC6mK`tV_7d(e6)?ghrjptK74E9`|E3g(ofqzQQLy*%o%3?Z8Nw>EOpK zBrU<6K*<@JwYWq{RE)$W|B}fnmwM$V8XvL%yAvM!6%$VBJDjf8?t?8Vtpw2o8R*e* z^2#r_2wYm)Ffzu{MRN*MoLfC=uj=K=BME8t%T!;s>D6v4pOTKB>z;3fq`J+vx&VS@ z>fVwGp>+R?S3TDRHW_R1|1UthANONjz+Jm|?(sqgc(&FMqnNn!#I_V^2E$CIY6b2V z2sR%2bTt5H*vv<*9`k_%MyO3;)Bq7ynjJ;$C8in;mN+UV78~fyY=GHJTnT_j`%X^< zC>ouAcgl;t$+6V7k%3Lsk+E)VSxP#i4H`pn+tEFz(UvU&Y(Y$Ee;}12XZn#!k{n7L zjo;yzKr!B@LaJyEvgVc=kK(f1dVPB@+bWUv%CH8v;F^HS#u(2b1P3%13c@4X@ng3k zELM1>tX5;?7YEp-)5*i&wTFPY$3)5o^eoQ%AfLi2X-ZLpLwuU$5-&x`9`Y$8&L_DI zfjFqQu$O8|Us$5_ifEDrY_oVIq|o6n1i4yb?Y3NL_hE&J+9JXr1kRPK5m2c;_ zq<*XchWX#MyFJq7(fYh5_OPP(_1+efs)HvXl>F4&UYB-W8TDXLNrzX5aK%C~xM`N5 zp21!$h)2jyR1#z7>|2z2OO@RiUhUh9#;UHRCRFXSPxsu`x_Rrxt+E{CCW`45_Kbf2 zH1cjwN8asMhBO?_I!A+03G{435tvXNbA6W*uDLUj!1@2dU3zKvpGCYcA&ByKI>79(dS;Si`&uU@cI01^3R_TZgJ1= z1nV%pK8soWxBBOzY4*?idEV@wi)OQbeygy5E}C}#{1IXQTr@HdpwE0nKbQFDqS@%5 z@8tPL|6DXICXHUtn>>*)w$1EwJs4Z&JM`lL(fhnBzniP@4tv8rcaa^0rrBp$cylY( z4EP9daO75Q8+_XIyw!&(yu%mbrN0z*i7tU<89^W6-}LW3`U~Fm^tTyy^n>6FJ&m4k zd8K=InPKPQu%mzS>0kXyw%ZlHo;L~bQJtxWzwLJ=%+WtL`@V=c=y@ zJysn_I;M~6Ws`$eUl)0-@^AB4<-gfumH!rxRnA*IR#~-s+y;Jy$8*8kJbsX}>hSn5 z*p)((sBE|U=PJ*OJyv;IrSn_mw$ndXd0yhN%Ev0y|JK)waOdIlT;+5l?&G)zasPok zjyx~JZNa6u-O-WJm5v35W=5Z%c&fAcmPjovPFrJRfYyzd8JjW}w9Amjj~+uM&~8H# zr%e}+DLonDF+^h$hDqQvT{gjOy6s!r#Tc-BoF?^hn~dUwYVvFx{t|61zL;GPq78N^ z6wHeiq=lPsJwdCi4kp{s$B~q+Gm-HSL}P8q_RbA!lAWDfLOYbnr|M7E@3hn*%byC0 zAJNvMkHmni@ct|BXT_gRUsin6(-Y!vvc{n%;SAZ7K)+$nmVsIftphnDF6vho+Ou7t zTTG@s3UUT-4uG6FmqQ?D?By2FZ`vDofHoVt2UIfj0I1#2BcKjLPk@{$orFwXY|msU z<`P5490Q^jxsB6)z%5edv#{e9d~e1 zs9xbnsoWlS3I*LLX`a%2F@u2hY0i(h&1yt7F45t;gv_b_ORgK+VFGqRk3B|lsmbbq zn-9?E*2!Zlf3+mHeS0Ua)#kxDY|n81n8jE6XkhJ$I+stcZ>ip^{*|teAlh?U8C|7i z&L)7Gsk8IQYTA{Di8wnaVNpY2?yp%OJ*XJhDnHxV_$+Hi#4HEHVtmF~)QqDgz*L2RasdB{Pe| zYj()U1lM1fgd}QxD_Ltzy$~<9%p_;Fg8|Np2x@9ImPOF2<6IYdhfI2o3Q?uh6SbzN zCGZAkyM~ZC+Yy_}j(;>wrOU7@xk<*l_8}BU(>zG{tA*&#Ov=9v*?ANt(ZTE5;zb`UdgsrQ%6iKLdS=?YqnwZ%+_c@)6A}~m(W@} z17_AlN&_965f02rW^L&#wQVk8k77l_oYhlt$<&&clwY!H$v&KT_I)c?B(`P4n}PAu z9-PTjb-RL%4K}oJHir|NoEr~k_MB#ro05`CFKrm-zv4=;DT!6dsvKczQG!cqXl9?M z{IW{x^Y8OYdRhI5SyET~_(^OZKa1_-7qNXLC#a66C&TS!ZEV{Lk1>6@Jw8-x))5B4 zY!At#xQyd4;5uay^XS;z*>3AzQ-7(booH$pch>-+R+3Vx5Oa)$iiuLIk`ShfWFxIW z37V$2!q}#x+BWhylaHx2{KeZgT*5oA0mV_rYSWv98lv(&kD zE$U3`q|vmk^4tGNMPr_o-=#*A@7fTxDA6$~`;!iSW>x&ZhN@y2_F)?~G+2DgkOqr? zHdF%bv?X&R=sWg|KYro82K1OcTL=2Sp^cz_Gt>_HTSGfRKQgonwkDJto`RFWkme;?iJh-nw~n6A}@r?pZNo&9I}>O3iIkdb5~z7MeQK?i*^uv_son z;Z9lYV%2OC`5op!SlLU_E{=ALEQGPXJsj2^OWD?P13uhKn#>z4lC49cgVnc}*XT{v{>Td!(geG4le-@W1CXl?wK>la8&;7j>+z9M94onA;h1Z_vD=nY%zM z_AhnofNd>0Q%Y)(ey^HP>}ZO=lGEudF`7wpnD;q}HMM_fvM-#EN$bU$0tJ(l88aZ9 zVENX?UskJNSei_nF*weNTOJr3O%_o5*qNlA3ixcNa&p>mLPGV@Q&8o{QS%?v^>aZlF2vq~7 zJ&{f5V`qDJNhlj7JXAxjx33NIf z8Ct5)Wmhjvyd)$@-b&Tc#(XbjsYem&b0Y3!9M`raT=pVX$}H%>TqP*~<|Ts-ZpwmD zgK;S@cfoX8B@8F>V;|oYiqE!BmTSpQ;+ASN5}Z&~j2kdbYA$O_UZgT+!-9k=Y426~ z5kf8+6uVq-s~{d4nj8*Y+!}^%O0~#V(L{!qbW3+c5rqb5HU`x%F zsT+b>Zx5?ehZ3T423Q$PNIqawqEmeQ?@5TpRj*h{2chdAxS>P%1bAzsT#Lb$igr0v z|4RmXxehTV+FdkL^3B<2qOh>HJI;fu>|in;_O&L{4ps>1*;KB zc>;mvmu{&FGr;w6o3tCz)JP;4vfZM-D(y6H?h;xUAa|a-y!#1#3~qWrd*Lci-G*n>_m~by=`lAvZZxLxpm9M zNymQd22Z)t*RbGH=9fvvFs$FSrD+>y>iklwia;~?w&sgl5Ob9{B;$7NG_)AIJ-i3| zD)MC_+tk!7;{Ovq?^zMn!M7UHI{5vDv=07&p%Umrh9o7q!;sd&A2YND^rwc_f&R>p zq$GD6Y6pGV&`!`_8QKNdfd=X&<_pm0{y$8e$bB%je?#sGzI#(p#z{_8afDi)=D+y zL!eD2(mM<~!k*m%dXAynK*t!m19YsRyFhad-2*zo(0!nj3_Sok#n3~b`Gy_=y~xmG zpfe0T0ctSx6sXY<$w^*pNEa+EH6*>6<%Z^ghAs6a&?@$Mz01v9M~7yb*i%Y-?>n{i>jr9uytprjw3g9G;i9JtiOcgf}5L~w{hcb zYYC+W;^E{nscG46iQ=ooK~}`+WQ*4r(wpp%vuNEVe0t2`A+P_?+0@+B+)+aJEOGBy zs&z{)6N4s%l`GC&2JwZPHn%1_SC-l>t2@Y}0_;mG@=#2b_+A2 z9ZKS&j1pGBHCbyC>1bU9Nvj>zNBZJeOl+JIKx2w;8tgov8L0dL#J!e~Md)p;RNmn=}&MrUOzZ`f@Fl@DAN++M)KW*Lg#GeA# z)9#Uti~xJ8rh9I0a9cWd#Z9onaUP8}k&cFR>1AKRjubdicSG-aUiqq_Jabd}j#5SYVxXNE;&#o~5Sd ziwIbvI?|KHNP2YwHp_xaB}IITU$yUarQ5G3m4Ryvg{s8x*$O&IZJd3 z%QcJ(?4lTxXdARnDyf-oS>ou~bBTssXxf#Hz$8ejtw3#8)yc-;QnyxOPKRX;v(Htg)Js*89Ysc<^z=o^c@k+~kYF#W3k^U!YNREP8jZvjrnslolLn3vr(UPcC~qU# z)?OonD2P-Rpq3k6;1QeE16X@vd!=&5PZk}uVk>+LWt<+wC|aqormcB@Ti+6Qh|8{= zQd-k8#F1f!XQ$z#nHn>&-u|=+?77j85t@TodX4pRD&<;Y1&bs)=4px*rFh3j`hlsjf+&0TIF%T#I$?TX|ScOVyTKC zm{Rb1Fayf;`VwYpO?QgU8D%ON~KUi8iCY=gg6ls%TPLnU`spj$j9$GbJ6R3$V{M9`zSq z!zSo}*%7o^D+*X_8$#Qb3GGR1*9|r%#2-mJJq1f1sYAV} zzavp=XjrkDajy@x;tkEEm#jH=)za8nbumoXI#I=;)2t56{DCH-65`ELspx#K4yk7( zwfmjS25Ey%8>*jar+!JyD`S*9T1qXdwcGv1eZwP@d;00wPSS1ny(JxPAJ30=4Cb`$ zRR5@qWZLd>7ZFW=$A`z}lnLk3Dmvr+j;r*-?QsoW+4i!-xI}?rfr{yEa#8XOD0Ko@ z=W7`?DuW;etAnT;^p_1^r<+S^(e`8xwf^ERz0<4}wz1ncwYTnQ;>spBgH>AhIjQ}s zuth|RRv^nZ}E%IYFyNibRz>F9Kcw=yRtla&G-ZjDf~is zxv6DK!eB5uK1dUD7GRP!OP8<0z|{ZEpD8v;osvoSZwSpLvsW0J2ij+-1iHphBj~M$ zR4U&#vpnouQ3&`o!-3I!uJ-Y*R!s&YVF3>54?g9P4Lb(t0grV`C(PW(V zmFyemKLe{943nnu{lh)|En7N#%SkjBtgyc;?Qe&h7dY6t#qPaI+Qc~9b`j0!H5@KQ zKG3dvsMvC9>sW$fn*<-)eo7|##XydC?e4Sw(qY|2@h`zjAIxU5gB@WFOI=(R*zJ3h zt0=PN5eH7&7MrH3&BQWgUPDeD+8bh%j=nv1De$Ts8Xo%m zD&Zxo?0OXjw$!lP=hBo~RaSDqi!PYNWh0O}MI-I~U_gT9h0IU-GzBfBkx>=4Jx&#v zGR6xPQ=p?=`*r%ttX+wrl3Uva&}T&^D*5SCgA=3|n$dsT(=cVYv)>t3jIfcXa3ik4~eB>~7dS zHl;lA0zv<`HVzsPHf506p+I4a)=3?Cbo~ydj?Qd%d4)vMh+^QjW>Y@gC}3^ZSIiJc zqO8wTe3e%%@iz9j>MNq6_16z8^nELAKO!I!Z3g=88yZEr%Y_b|gwZsa7#v^A@^^6U z)aqp~U26*MiGFkQ_NZMlRF(%uoJYpEN=lp%wjUUc2S>W4;%Zjwn1pIRf4Vx%$H$#1 zG(Kr++q+TNXTxxU}b#3MXAjUUpmx) z<#jE+oK3&5jZR!>)mD0|aS67fYS5Ig;Q2zJWbxSFl?lq-du2J*eJ}UlEByD$q_JUY zQPOPYcS=12cE{;BHjop#h?ZfD^)zMs(Yt8vF?!7#>+#g~1YH81yu?rTr|2P<_qpez zqwaX0y!<{S6F{@q8gXyAU&<|ZuA{XLyrsz zNeNU1Ym(Vgik$v$Hlb8VQVPx}*3|2+UR+xI(mYi)S?_YKHB5;nbJqAw;sblNg0?!6 z$T^h~m#?}M6-fg%$2F&^_|;48erMHfP;rB^uc9F(KIM$PHpqA}L>6JCN2puEtf~wv zLxi;HDN&5$3fJ@tQ-v@(*^Mz&RUf;z+psyi^3TB1X3*lJ!9WVg15 zkfTk7%MCRU>i+mGlS5oo&t-{w*z(nFQcZ(DpdkY#>Tsn;iNBNNt}!(S0sB9Xv?ZEnVrD$;Mz)ZY$#?X zGI?NXMF{VO&`Zlmbh{{MHj~*~P$rRYZZQ$4$!ASKZtaB0UhRG%%24e=IC**^B1ue> zfl>6H>0T@$$Mqu$FsBDRy>Bxy(le+dt>M}Eu>Ct*Zlt;jCdSWU z15MxXBf625>U4s33Lm~|YcsYjs5^JPgWt>Ug%fi^=PK{)r_zUXRv5+hkgw)AOsJBk z7pxy^s{(d>L{P(bN*2C520O0PgYn*4)lC{JZ2_VtQiHcGVd;R^LlxNrY$grz!m54~C*eas{Hu`DdtG#D5r|tZ4HASce zr#%vuzpe!A!Y>WG-sWi{?~|V;YfgMRyIMuJ^B~L?bC5c+) z`jZ>g!CMv;d?2n4-O_CW5?|J#fH2c(cM9n>e;1e&ilY}WHpWoFm_gMQ1@EFxVoC?3LH;aZ_`1D{4j4pLSfbr8)Cq`8Q!uBQ<*Ej)k^`v#)wO^F-h1 za<`bSdbT3t*~)3pw4s}5hGSCKwjO4DbXA8NkK>#g$2Z%S=7ztq!TnN$Qqm%kG`A~< z5EQ1Gts`~|m^8J8L_|^E#xl{uHBxm6H#jLAH-P$yywtp*w0_f8myhm&kun!E!74b5 zA5OAWvB^w3k@UdI%hP&85;>GAYm@GAS1Osbdt)=jWpP;&-#{BWyrB+1t&!FQy2veP zM4HqFmWsYMFpAu5R^^nQwHV(N+)+|j4(LpvKs7L^B2ludNJ0nQo8uLRg^ahjv2(b` z+CqAmM3l#xK(=^oa<3XfZMisYn7382=Ir!~_Rx)SdFADEp?EZ^`=4SjSp>NKSeLdq zRK|I)bdFw%f09>q4|WY-j>Nca6Uu<)ZRkC0-JFDm$E|NtNYkk2b`GnmO@rjLs;ct0 z1~82vwjFB8mU>oLh|0VfK(0N)fIrf~iM4^BCQmk7Sap$g)sJurKb*UF zhdA~Ob0rTu)zNa3Qzz4!p2xB}lag;>sh~retf6%M?=qX_^pYS0XU%R)scBS7OqhkI zr^SnZ!m_P;1Xp*hjN%*~bF!kK;ZvIKF9EP!B01p(JWVRq!!4GTb8g;4qSl-AqipRy zx<2b1*@Le7V7=5n6}l?#_~Tg~Wrq^U5HP!sx?U_Hzq1bqrn_OV%+Comh99G`tx7)^ z(7StekNFZtM13V;i?ZZSx=D7zx;^X;j`v6vOJdB1Q4QU?v?gJJ#f?cm zPQ*OrrdPcW+bD%$9%@Ac4=DXMfAr7@;y`R;9A#=x-PA%!nIzcH25u_wwh$(L@z`M7 zj~2fB^sij9;-%q7{0 zv<`HH(QO1h$IwpDF^2jpdqpu^_- z1n4G1I@j@bLps+n-{^Fj<3)y|lwK=)l#66C$eEq*9grfzXo}r=S7GZP`0wam+}p%v_6Gg^A1aZ>V#+wOJ!qwwEmc z_2?k@3aR-rA~hIUK%C8hYPC5_HP z1W!8`f#!;)oAAsBh@lnatx93l+qOdWIS+4CWH;f7vnfhyD>uJa^|OYY(EY`kAs9II zvVWu%xi{p*Rkss8qbtgG`PfKV{R8e^OQ_ugdyo~E-6n+|nDpH9(Jo)Ho|bLv>~x1t zY@<^7veGpM!?OY=yDVOQvlyQiQe-8W&#RW|i%ZG0-~PZ8eO40v+;A*izNOnr(XFQU z`XP-$${TI8ET-GY^bsVK9ILkaVN}HkSL4_4NHdh$+DMN{Xe|;{JK0-#^zsQC(Y)X? z9k<)hC>x6jzA>GeZ8Syh9%Ydr)-L0D>nz%j&bm1rsCdX8>1B+^u=G{vO!Sy@G& zIN_mUK^C>ezuTD^3)^wFo9PAuI}lMLtgJMrG^rDT`tE0U71^peEHAx>bZEN9ENkit z%r0)i^W&LY(F93$=%1sI=-djShUit5!SON;48~~d7*06(2b(ago_2X(-{=yS410Aj0=CC?ar}gkK~ocs zw5l~f4AC*G!!r&ZpVAO^O?=wLE72pba2L_jc$%cdm+MQ9*vmo&e$3XqnkyQEev(_n zNFC4CIqb>k0B)!}yFfIQQB@-iYf~g$Da*pX?)}{38yWdhYLzXvB^`fgnz79EX_9@? zUh^FW{S|J_lTs=#^-(*0YAM!V5uhqGw_W3A9)v-CgS`};m^i6D5t0oCiTa71o2nqM z5>RHl*7jum09Tbeb}wY}M;p4T850%{jF+u~S>?$V4Pz(^R`>1RMJ0uGn-*TK_|{HS z>5r{(k{88ZF0yeFDN-CLVvDFiLO&an1_!#w$NN{9^3X85ezZ}hP*OLZ zqSR0#U7l$KQcu#O%3xxRtoHrgTrjF*J{A+|-rAiU-_It4yH<_3@LAH=yJGd~yyn@;HLGf#tyujM3rAboI2QsB7snr~m#HSHFw#%W6`20P4Qep%1r-Y6UD%S&j_qFO@3mLwtSdjv%#cRVS)K{*W| z&YEyHM$@r6IyM?bAkbk56`AogE#6?bi94pH1_8XZ1maD#Y9PGGh+s+)st_rQA+z3C z+T60bR8a%4pto$7Nn!jtHa1aS)4f|vOjHoMs*2Z089L-Bo-lnY`xS#h83Yx550p)f zEroYUr6CoV%YMB?gsUNup-oSXjxFnkT&q)8HFOp9EUaTEKG&ws#7!hl6Cjq=ub+^i z-qq}BIHAVm+J-eN3&k}V-m=0!pQCPl zFH3ebZQFv9J0}wy7pM&bH`0Xm=thDHVO&H78$DL64A5gyNyp8cn%b+b*fzrIN9cUY z1SaEKIB05#bB&p#CJp1~ET!3>gLqLrJoQsrE&eHA`nBB-1ggPRIs>)EtYqV9$~&dx zRPo=0J|~(wCOw}PNOht)Wv>1Du+Lg*T(Vqy_EphVzmXOtrlXNi-mGs{lbg0oH!6xU zq%~cKYLBtfrh;R`xkd>uztk8(`$ugYJ^2lO1o7IR@-tI#WRm$Ll5O!O>dH_p-Iq?8=T5%Pj8Zzk;eywHKUTcMd$*|t>WX0-p-H;rfrX5h?$wH7)K|aMw6gc3rB7*Or{kJ8VW&C{zX3E_?d-jE$C(o_-F* z>q|->2^;~cM#+%-s*2gBFc+jd>s|>n8Q(vI_4>=X1uUIb-WVJ{$NS~HIdnPfM+rX0 zbewA5ch7U)9UHQDCC}KqdtCR$yCI}QmOFewx%?$f%)}TqQRc;g7=_*ogNb#2E0L-s zz`I!~?eQ~amp|EBL!>gql%CZGO7U()4a8QqHLs|=C#Q#Ns>3)~S3V{r zM*AunmV{}i0Mnk$m2K;4AJnJOov*}H#l&cdkq#xOaXDrlJ#EI$%I*=28?2L_(M#Nt zTbn=>33FT5msuQ1wQ4zD^;2ysT#jcv9L|;-gd!lbVGx!Z*X^v&q+Jf5gh-OZirfIWjDmo zokC}KbD_0S*IzO`d=JX5#5sO}a?Z(=5>Zb{i zI2q!7yT!Cue%YKGf2trWq`Rv~cTXcl=uml&BUtf=YJyz?|J&NL!ZqueNETSzqVE^h zJK{Cy9_JWEs%ZVSY?UW^Q%BTU0>S~iwQ6NzG|^D(X4Wr>L4qHW;f)DcLoz}R?1^o3 zane6iq@}gIfP$-*YR}}o)T+uBOQDTfBnnc&X?k+q)@+!>m6J_SVd)gFa7&TfSuj)I zi{Yl$0M$XKXl?iiu^2~Co094^TxDUQKzVhK$)l5@?!I1j zRprWP?lgJ%rHTH%9LF7{{9Bqr?#au&Pxy6dvYp#en~hHQL28qTgWAbDoIcOSz~K>g zGo?e?VseP<%~QU5t|!`fV(-YTZ!4S1VcgBQTX47HZo}Pad!pg%UWE7J9XZntOspbr}w1bx)dDCpycCO|IaDbQW^>?+Wo8#)ku zuLk{vJv$hmT?6_{dv*wPuc7NfpEqe8G4v4VF+&f7{>{)MpdT4} z6y!pA4D_TudmQu=Lr;KyX6Q+fE-ya9`h$DpX&%kCX9;caNJB?}jyH4^===8W9MB8w z*<8>(Lnne>XlNejG(+=2ryDAP78qIpT4<;dbhe?zAeVw=5v>CK!eUzkT4HqSb;}H` z108Ls1+>!8M$jBXZJ_5HY6l&(P&z>`v1dC$FEylIdcL7upqCr!1+6#K4{9|u2-;|9 z6m*fH3D6cpQ=nHEQm^hbbO5x&(AA(<8afEN%+NKUU4{;UdJJ6;+HL3vYT+o{9Nb*o ziMV;V`M45p0j?3Z7`F_!3bzJ#K5iYZ1-B8`hHJ-l;&$RL#qGlN;`(uexKZ2$ZVGo5 z?f_1o%Gh(ArAg^|n<1s@CPPZw&4!f1cN?2p3@N9dF{J!{&X98bH-?n=e>9{L_-jKdhx-kwG`?VH z7wAz#Dw%H>Qu+LoA(hfYhE!HxGo%vx7egwye>J4i`+*@q?&sVWYT8k0t~I1Gyugs| zy3pqY_mv#$zn{t1t0{gLx)xN@4jhAq${^(@8L?*yf6S25;zoOgJZaAq{*)ob za;2dX=zkbejIJ*#-q+eQ#qP#rrNNEUN{Q=t)AJtk070tlUu_{Njc+idH2%J!>NLK| zp3#Am**FRpuI#_}b7{0ZP&TCWbQ@AhJ!!X~mLgKAxMwO0hg2gDtpoMhyBk6MhT1`w z8_FsvJd=mkhL-X-hEz&lGo(`bM?*^0Hw>vvbjypJaB$O~U67&+etPyyo!-?usuQ_i z@!`up`aS&*Ha6&c-STI~|-Igs1447#qxq zBv44T02{v9!MK!2t00G97^R~!>h42D{=+&Do*jWt#W;6W=TPi6p-%SOUJ{q>>4SDQ z5Nb$t%56&8Xl3q39>^%93W0Sop5OQ4W^wQ%xW~3BK`-T%Ox*tXW79ms_n}IxChs zT$0%l91&LE(Bun>Z#k*z9qC7jvZyV)z;p}H*vS5zP|^|3gmMoCH@XH3yQ<~W)6FD- zY?_pHU0h)byJT{^kOK7_q-DBcFRvc4rCRP~10}nb-OF?i+il9G;cYvbQXaaz>`rOa zp_86mHi=K`nA1tGC33ydM0eb8mFKUki?hRbCu4FvU9D5_GMZM8hCHydv3n$kP6iLy z@I}czJ0ZJ~gl44QdKOA(J)=d9$q|@PH#>9)uCM@BiOr*2o^xS6i}P&xD+Ij z9i1X?8n5jM)uGWIR1t~W!74~bPhE=1;kqOyaxRLb9s$~qd9BV$TmEJCBMag%W4HzW zQbQRe$T3Bu4$oLD|4LW#r8n-Bl+m4^htAk{S<`_j>SWih4^n!ae_D&Y-J9S_yWszCLd`< zqj|FI_{g&6!<>+u4bpM}1Mex^rfPOIjoSf*qJhIWdI>aMt{t zig>+FQAoyX(IQN-q#(wbuvorL%&>`)(HT{z6(Ga~HD)CB_z9o7Lhdcqs;RGnb#9EY zu<;ue+B$W6i4pegH9Jf7S(rd*N6!lCEYRt|5~1dbw5nnkaZ!T_fsS^e5?@3}8?_Ts zMKtyKUe$<-52ZWxAJ!O1Jqt&4D{MQzpC?VJ@VBZx4w3gw6(zFXz+Ot4dPYY^3MF)^jF=#=?}j_)X@nvWvnxIco$gycVnge8h!uTGbV>;pT7AA&@K=3{o~h zl~t}tYbS@z@@!7xElfK`mQ7%_s7u#!azDxXs60N}t?p4ITkG)!P`98gL8GL)k6Oyz zA98JCa#Z77PRbmK1}zm?AyMy0xqCkaT93$`s;{L|2i2a>uscbXU6M{z%t8O!_fzAh zKTBV(!zR*7#RBuz|eFMWQSCn%$UmZ#BenfovyVxo?Hjgq`q{{1=l3M3Yr!j$a@xH3k zP`|)PiUct^#U=5omK;d8IY^pa$8O51GfTSKu^Taq#5h)mMkO`>oCtjl)mwtO_K=@9 zTL#l3M3)hjiW-Z1DHONH&YeR1^jFZXLs8Ue3_hUDE@ovF!r_RR4xHtbRG?x& zMmkc5h{(#?8P2ElzLMJJiv~iRM&!gYIT5SGp(@%CrSAob{5f@CbcKj=VqqxA@peOn zO`)R`xvdRjV^cW+SWQrqn()daDip41<)CbKv(--C@|UoERN&93S?JIE9G=e(fA_E* z&8_uy`P5*SvyiF~P>vbBuHv7+_eD)CdaC;fcW^I;xf|LrP}`M`OiZ zp+j!~Qn9YJSvFGfY7-;e@sq0%QxzBtNkL#ky{mGSCb(NDSMWC8CF`Wcx+NTN4kYD0 z>O_#OKgir0(WBb|X1%n%!cI%x!?!_^Z&}o#jO@6pU^zvt7gG)DiBy z=4!MiThEEiW!83F==&@whEbLY$6vEEWUnw8yFx5SYaB%}$TWdw2wmhbUgnM{zKiG` zqZXpDw`Z0pXXkiki6RfyHfNLrpCWrfJn8b8l#+jG#EPsNJCc;b4D#V$oBB218y%!{ zpFuo>BUsC>L+=_L6{s8TW>9lI+=p4lv__p^)6LIU-3(vy9WU0$if0g0d}-w~cqugZ zJ_c&$pE_?^dC|bU`M8`CL-vF1oHABka)-U~@zH^Dp%R;$ILw&tek}@geO|d(T(0E_ zoPYON7w5aPdwDwE;*r(2R(ru)x5x<8rE>B$%oTat1{Q+&732r3T=OS+cgbw={;sDf zW&u6XtFhajQw+U*-IKX;0d0kqdss;5cx_Gq;#vx+R50bCy>(;=wgajo=Y2)%Tu~M1 zGRa$KowI9PzT-p1-s6LL46feh+Q$5#nez&K3+B6?eRgXEoyp|+x$6Q)HaT1<_21_L zDc+rQAr-7;P-V@@ivi{X~4^WaiSl*_w-PNjC|J*?p@ibl0Yg z$f@|kbeUE^cU~>dWwRjou|lQj4cVCq)0I2No*M~nk%{XRB+01U+>rVC3rrQI`UBC}?t|FzJ$kuxG}Uz0O)#O>L`POqD4jMVcqB^d&ekQszRb z+WaYu`V&%`f~hithfar6Ji*x21BJ}J6NS|aC35w}nZne6mh>c@UQ$FetPQ4FWuu`? zo8xMz!z0<-Iu@8obqWT)Y^|)ytGQx{3Q2B}R7hy$1!C!3-%0?eVHS=qNY9xY3i2th zf+URFSsP-(E=~TnkQ#|f++Y1t)AXBFHT_u6DN2d?2ia{-^+uYWJk=hf$SrwGhz85d z7E~$LqR|q2VvOkMq7@O@ev>65Cnqw5Sr~$~WG%kXGDCusH`tkehU4U2FGW?(F14wt zgi7v;Ch5shnRBvzn>;~=c+OrHQ}t$hICbra)@2QWef>c;E{bm zjc>PEJwGDb2hE(=o$+P=~6?t{wbZcidF+0mu#I>pIQJYZ^!+FPr#5F51WxEbC|IB2V zW^3cHL_1cqK&itKh&x0=sqGbGxCU}J^Nrs2Ez08H^4WeP)EsF?+%wfKtrToF^S1YE z%CbVCkn*TpPL1z`pXC0Kyu$D#1+B~vNMV;LC!md+o0^MOE9UQ*<)RQ^-Lc7ClWCWo zp{|}R(X&d#&Cip0^RrEevim1l0_%{BLE55-N03buEhin3h}N1zLKKM93Ox(QAoso# z$mi>Nd8*=JF{ZYliX%<21X_ztZRw774RD!nb|v{VQ8XHAbBLt!QBUj$8;ydQ=7*d> zY~^Z0TLD3VSGmASL|iu)=|$O6vVJl-Mwgcgoy#nc+*$-Gf&4Q!M&b*bpo$_geK3`J zVR9-|<^IAo^lmgca?i(GvWENi6paX`+1oDboVhHI^~s)*QBD}TCA7Pmw5H{`5kM+l zJ>ywtiYxwRontt6gi(c5nnUJ7Q4#g^mJv@D9J;l_8W_$GP{}Xj zYNHB1k|q`SW)4*G-Qwj2@`$c(Mzcwz9CgybA%Oy&uSqWQ|l*zb~9{nOw*q z_IlAmaT9A!%p%mVP3P`Ko|vm@w8z=$9|H@6kAC+rDxl4Z4@e*mX@a%eQv09Be3h`%JyM!Xyn zE1;?&F|Tw+j8S$S3gKA3fJOXtg$xVk*}+Yf zbsNS@Rw?8{>5ytEbh3QQ9FD5E<6t(xs(g8QdEsF#cd?;*ZGk*05EWEVAdy}{u3Re+ zQGo?iVM?X%V^C`Es@gKOLC>l1X;ZaG?JEKtu+(m;#fNS6p~JJfab)O=yg zC|qA2GYYpV)$Wa)rr?VrQ_r@?7%n&D(})Y0+>D~i4AI(6$aE$}Rh)I_n3N45E%bG8 zF`xCcL^^vhzAVEXN;%wUm7Sp(91LSTXzFO*w5do(Y@k<%HVcYU1cmulr$t4Nb7jNK z`&>L@E3s^`wv~5M*;uTwk&@S1cCQ%7TWq@%K)#r=_suLhX8Ldf7O$>ZOfJMI z*g3RtEYh6BqRN^(XL7Mz(QGO2LeZWGawL0d!DXj4VO0f-P@6y_vfYt_G1&akyr{Rq zl3n+TA{@?*JZ7BllrA11qv0RIELQ_QUY)MX;Rr07p z%NS--DJw447-QkoP>C^o*8qF^;p39&GX z79N+!F~WCo(mapTx6r&*gTnCAg!zT$a^a=(IXMmEZNcg&Ro$G#%w3IEiefk0GZ_=u zv?|DEI#Q9%?C59qpfoL*+RUd2vJDZX2=>ALBD+JT3X)cud4wWO!uDWRTdpA~>k`;333&!(KJ#ej3vzc#71WeTCYtiKtGcR=ty2ISDU+q z8Lg1I^2u*mvC4e|5`A9nq^GaCLy?~k3q~X50?~~rXcsL(O}8EaZqY8GZRnd8eonbK z4gF%i#~FanQd&nNVA`E&0N8d3W?pv~V@ElvK2jn^)eB(p?!_hfZ6^JG$~Zk;N%Xuv>CR zHtB+y>9T^vw8^yD4y|DCb}$RN zq~A3*eZPVb>iK8S?^c*T20CRHe`F+e_J(~3bp}bdcY;#J1ZEVl8b+*_ z7G)Y5O`1g(;S`n@VHRLcST@(ySLRhvDn|>dNKNhvR9HCPF#|f?wd}H5a3TgJZ?9CF zC%Usr()tM*S56+a>XCtBty~I*&tNyKNJ}BCA&rlp(S{%`i;h;b#b@!k&A6h@kRmHg zVT!J3p%HS+YFH8inS?X(e}3hLycaBT0*N*ji}K?8gUAZgn4+6utTX6hA(5&Xgxt9* z3~_MCr|{`}2K&Q`bU6R^lXTkX-Z>3AQ27)V4k&?^F>a=t()p8r2u!PzVk3Oy6ZSK6 zWokVZe{5iM=M%t;6)bE`Z@ZAf*-y=Gggsg}If5C4kvq1#U`*S;@ZK$rIen(eTU(zB zV~Ux4*ert7`deX{pW0f{B?B0WBpy`IrRPcSt7|T@V{7w89jk*eoqAin#$IO^r=`)B z+d1hU>)OZMS7Z#zQ55Q$bnWgdIK$C1Ua%iibSKO>;Zn5O>M~ZtZn>Agm@*>Ynu=Fk z#bHdDN+vS}HmC|!ip(HNeppr=j(aPpuc1DA=!`TYjYTk?#4O{%_~%r!XbR?XC8k`w zv&}g)j@g@nXigkq#`k7ootk7Nn6F2k3bTM6Hmaig7knY)YC)NQK@*7Y7f$;|Mb?Xr zBvpj)NDg#dCBwRq6;g_@;3(4Q$f)foy(CW^t`bZU&)qZen&J@bWKu!Dv}oKpr`$D3 zg{DwIS|MY;&S{br8tY4Ssd7c(m7=!9*WH~ns=Wi_xtb7`GA|LUS6-fM28r{Obu%02 z3R+A$fps?7j8q#9b>lUn;`Xc^T;rMxxB<}^k3_wBl?+s|}_{G;*2jjrkVabW`Qkqv)?g zamD07Pk}DC4<4Q~_i{~Cjk|h!`m$_&Ssv^dLe}kd!B@ORPU-Njs-f1mS>@(bAD!~0 zmMuC_S48Rzn`fSFvhcVVcWewpbeQsiO*7R!v5$EoGK-$M%xg#1vni?bwx$eMB*>n? zDhKye(BO-1XiHHQt+7*NeZxApnNiG^@f4wBPO?peXVT^r_=p;(No6=Enz`|4q1pK3 zZryVuP)=~7lL;0=@x~4ejv3qs#rb z8n@hGtU8M=C24mTR?tLV*rZ*vFXT0>EYv&d)T{-it9=Sif+?&X4k5FnqA@8av-ENi z&Op54DQ7H>QLuh`$P;9XM2*yL%;fZb5naei;R-?b(d(!viR5p-z_FSR(L+w@7#(A@ zv*&D~7E!Wh<$@IqUQOg3r}hDkX0%Led*-j67{yn46=%g;H96#@EKOLvpfE}|i)5Sg zi`@erkO^IPvLm9ajn{QDxBZ)YQZW@9LXF9>Jf<>5CuR29*rumS6Yxm)tLqc0>CK4H zwYfUWlQ2{3SW{M^RFdgyt$>UTwI0s(F}vmDg3jn^B*MWPY=*hwXPO4ErGr@ua7QLV4*ar&*Lfq&6)>T_ zxePU>Ze>+i<}NOAm)S*X?Vv(by!fopb@yTTN~SNeRu$92q}>ec-ft6OZC&_wSa`D> zJ!9X<829n*8STp5+Ew?FchRW`jR6d2nO8mZ*i=jtCAkyj?VTIeXz1Pt$CAJ79Tb zVN23nPq(K+br8;?It-CN|&=6;qRBsFOo=Ed{ESe zR%i>y-%!5D@9LGDNb*W91T)xMHyDxR1!Kj;Y2KVNYT0yQYe#1}pI{I}2Kg8HP8Rxx zEDT*Sk->ae#|b2Co36}BVwxl`mw`rleszKwAIdeXZs!HZxTU1KUOWW@T1bjW@`6!2 zN@>~Tq0l`xbWV(D(D2sWT(N_<{OkPV!iYbdC263`}T$RCU3 z)`3~CoAvrxZ=7|_thda1>#Q4Q9iH`$S?`+lfmt7(b?2;4%=+Z4PtCe#)@NpYZq^rO z-9PJZW_@keL$kgy>mO%5I_qC%JwEG)v;KY7k7qqK>*up>ntk)^chCOA+3%Zu+w2d{ z{*&1snSJN%Pt5-0>`%}BtJ$BOec$Xa&3}!sE%aLzA@`fW1 zANh_W-*x1Bj=c5A_aFJQBfoXjKOgm-qrS8E>wEuU??;dR_|bPA{rRK6c=VT#{@bJf z{^-x|yKmnY_WkWKk39F=&;9OmzxUk7pZk@4ADHu}bN+13U(ET;oX^eq!kqi({Pmo_ zne(+dKb>>%*z1mc+p#wt`^2%=KJWVH-T1t>KkuE-yXATBecm5E?+4F+;`#sa{QrFZ zPoMwv^MCdH-<|t=a}Un_gSl^>`|i1aIQM;XZ=3rMbH6$FpXYvO?qhSmKlk6}{%G!# zbAK}TXLEls_rP(VJ?_5azI5DokNe(nk01BLR~ zf9&`_J^s&*|Mc;Hb^K?K|H|=SJ^nwBfBN{}J>lR9H=gkJ6W)2kEhoJ1ggZ}o`h@FF zeA|gPop|$!?>_NMFZjv}zWRc+hRCx7wezdiZyPJa00L-Vei_qKWOpZ9@zADVZ^ypPShYu=yF`-^#h zIq%+ipP%=|d0(FQz`Td&eQVyM^ZsStzs|e$ls`V@_ESE5%12N6_$hat@~KnqIpzLS zKK~onz3^Qx{OAjR_`-XpUN`^s^WQlCn)%nxzkdFW^WQ%I-Shu&{`=I0|Vc-q@fd*^Aloc7++ z{^+znKJE6?K787pr+wnIM^5|UY5#uOk57B*w4a~$%hO)_qN`u@h8O+*i{A92LofR2 zi>@xcq4fKuHRt}DH*^#0P9N?$2`we(==>!p7#eW&zT>HDRBEB&bSWa%fRpOt=5 zI&k{yPJjLB?>hZGr+?t|kDY$k>2EvZrZa9n<9%n`cE$(K_}m#^IO8j4eD#b6&-nTo z|8T}P&v@jF@1F6NGjBNa9cSKg=Eu+c@Sc{P~%`JoB{+u3qql1;4-GO$!b!xM{)73qG;nlM6nz;4=%pu;42TzPaF$ z1>auq-38xU@c4osFL-Lf>l$9)@WzH~8s5_I)`lAz4mZ4`;av^yX}GoF{S6;z_)xbO2fAs9&7kX!_OLi(Qx3b*PZqHv)*{tHD|r$thb(Z%UOSN z)|bxu_p^R{)^!Wtw(zEfH!pnm!arR2#i`pC{>j2mF8tKOdlr6X;pY~9Y2jBEKDhAf z3;$u^Hy1v#@Y@T&yYPDpf4uOig+E{T%Z1lo`PM66+j!lT*I#+Vl~*^uq4D<{-*)Aj z8V@yI*LdTVZ)?1%@$i*5UHSGaZ*F{d<86%}Z2XhPk2K!d_=(0(Hh!w{GmW2Xyua~l zjgK{czwzH1f7JM7<4+oY*7%FY1B+g_=-{F^EqZeAXZQWpqOULd=Av&e`re|a7X5tD zYtMee*>5`gy0dRO`v+(L$JtMx{mvKv^Na6T{ISKKUi{U?Utj#q#ou21y~RIX{PV?c zTJo(`-&ytKs-LZT%jz3eziah-R^Ph%yQ?2x{o!+ea_)gOuUqq{Ywlk2S8MKD^OZGU zUGw0Yudn&!OF#G0*PnOIc{iMQ_j&i7_oef`e%?3F`}TR?JMV|*UA_Ko>u+BF(E4wz z|Ht+JwEkD?4>tcn^P8KmZN9$w#^!f6|3&l7t#`J5qV-d)pK1NphSy*C#tYwa;lZ{) zXnS+pwQbk8eRK2QZGH3=AKmux?f1X(&A)ZyZynlo-LAjhb#2!>x*r{QV&ulrw~xMa z^z)-%9R2?2hi4_p%GpUW_Ut5i)scyPe#+k?_?ILO9Tm}>i2jmyZinP`ytnxINpb;B zpC!)eM+9n!lF&5h_NsIMmlck%sIoIZUq1cwxYLkhv6)u20ZH{i~K{%qV*+}HW7 zkHT{~a7bY|q%a&(DjYg7qInTraYB-8dO?!B0ng{1oFw1j_s97C){`LNvyJ?_7#vaz z4k-qQ6oW&G!6C)q(AP-gW;Z!P#MJe!aI2XW_vpCJ4f;HOVB{x0PXDGrAeheJxaLrS?rO1VSxBPvC-Afm>I z7Du!!qE!*CiRf3PsGnc$>@ZI4US;@4eE&N6{wVK_ zQ05;ZjE~@^*WYJ(rnrAVT2&U0;V#0Z>o1h~=XtI&U-_IQX~A8E8^`V8c_{Ozz*%Mf zHJ+=?e+Ty_-gy`9?{F&fukszrd^^AUacA*tHVwBAJb)X*U4hFg^EdMR%eZTCD)XCg z@5H?a_deW(g!Li5KY}|N{9WAT;77^J--5r6`v&e?xNqbB1^0d24{>__6Wq^nzrra^ z&%r$x_k7$5xRX78C;g>fIe(cri`w>Usq@gbh3mELc4+RQj-SJ~+UgRV%K2;jR(+=1 z_K$hCnP;!SshlstU54wzshlq(Z9{xtfy*oB|3Mhn;(s~c*YkZCr_Uzdbt9xh6p4SP zF~>dAnB$Pf9EUVQI;0WOp;AN(B5I6CBc!9#2mq82Xk$ce5w%Cu z8PU#&E{$kcM7H7GXhahcO+|E7L+_bwmdvx+bDS5nUhA;fQXI=$43X zjp(+BZjb1Wi0+K&u88iA=$?q~jp)9J?vLn!h#rjSp@<%i=#hvXjp(t69*^jWh@On- zsfeDAC}Do}?JuIEBAOG?+=xz$XkJ9~BPvC-Afm>I7Du!!qE!*CiRk=@)+_bwmdvx+bDS5nUhA;fQXI=$43X zjp(+BZjb1Wi0+K&u88iA=$?q~jp)9J?vLn!h#rjSp@<%i=#hvXjp(t69*^jWh@On- zsfeDAC}IBh?JuIEBAOG?+=xz$XkJ8G`?yd_5iN+QF`~s0EsJPXMB-~*DCbACE~1u* zHb&GIQF}z45$%lV(uj6N)Ekj_X&3KcM57T+L^KuARS_MC=<0|LMs!U?ha$Q@qQep0 z9MLTi-5Swt5#1iq9TD9b(OnVU9nn1z-5b$;5#1lr0}(wK(L)hE9MK~YJsQzt5j`H! z6A?Wb(NhsU9TALQXnzqM715lC=0_|b40g9 zbZbPnMRa>acSLk&M0Z7WcSQF@bZG21ZpO9Xp2n%n8;?a&k6VUYg8|!?oi&aXWFB;&$PBas9YK z+$e4WH-)v4y1H{))>-HN*ncRTJ5+?}|)aChVG!QG3y4|hNA z0o;SQhj0($9>G0|dkptD?g`wJxEqM~y|_Qe9r3&*ISMxiHy3vzZXRwv?n{*V0=^q@ zi*f%1{VKlK;GRV|`n;ZUbF+m*N5y9ld*8Vcofy%)h~`IBifBPZjS(%5Xjw$7B3cvC z`4O#)s3oF}5w%6s9#LmRJ0rR@qFoX7M${kCU__%4O++*m(Nz&0i0JBw4n}lMM28}} zKBB`B-5k*^5#1WmZ4uob(H#-p8PQ!4-5t?A5#1ZneG%Os(E|}Z7|}x!Jsi;^5j`5w zV-YM`{jS;m))E-f1L^~t8G@@M*^+wbm(O^WQ5luui7131@ z9f;`ahz>^dcZ{&t(YxQv2>WJ6&fmm+7k38FKEStR_Ivqm;ro?*3$O6_qu`5izr<;8 z^bXufxDB|E;l6_|b40g9^a{{8 z?hUw`aPRZK_wjut?sssn!^!^-aBsm~hr1E?4&1wO@5Q|z_d(o;aUa8d0{7>*Pvbs= z`#kPTxWC4I1NTFmK8v0cT7^SL#b6?fvGu zp6CAE_x*aFHS;;^z1R7E_F8-Gwf~&G_c=jHP!zIJ;pUeDr9x>?I+OurLRpZF3OBzT zC>P3u@}UB#5GsOfRJi$-K&4O_R1Q@@3q|(%DqY+C1moAqcmTV8#CRzGB?Q~@AbY$&xWbJfh?Q~@AbY$&x6oqW!p?p2{S*`LmOjy{H500!K97Q4P2UlkO;Any9an)=`l19l=J+(Ws+8tT#j`kJVr|rLMlpQA7 zr|lzEX6a`9j?C}K{En>kj;!@Q#c1x+bUv@JM&(UXv(zHBN^MfR)FBNCR2lXbMw^ssc=MmmpHJ}Qk#l zSxS*or8FsB%8*v6o-F0rQjTM_Eudlmq2Lc~Cx702M+-P%%^j zl|p4uIaC2vLRC;TR0GvQbx=Lj05w8QP&3p5wL)!BJJbPnLS0Zd)C2WGeNaC%0PQ9U zuAg0|t?No@L}hj)w(DnyNS5MagQKJ)P5NbVP&||XB|=G16xv*K-%8u@)zZ7-t2JKF zRsNl(*Vi_FtUgy4D%#QlTHwf9;K*9w$XejYTHwf9;K*9wC<-M*H;U}M`C#d2=|Jg1 z$d5Bj$mZwB=I7{mk)6r> zEZIK$94R>K`AA$Fqc@ZeWv-5Fu8wT3j%==utd)+eha6cCIf_Dav>v*3wCIuS3V)yS zerZ4&l!hdGGUjBxXIJM(#VfR|FG_a(`!?nOlPjeuI$KYb(xi0Bo{X|9Ia!i@a>$W# zC3}MH1&xyeXN#p9_bzV2bG^L&#uxlQi7IoRAnR58YxxNW6CoWyN%wjmd;e)#A@1} zfQpyw=wsKJlB6Fc`#f@kVz$(AWV*DiR4vs=yGV_aU60yJYL||Ynxz(LjaKd?9Y4C2 zuhn!&$ATE?c1_!H?OrKY?^{~L2yvvQ`DF_7$wr8K*G7mV8zGKtggA;qwhg(m6etx+ zgVLc4C=<$pvY{L(7s`Y3p#rE7DuRlk5~vg^gUX=_s1mAzs-YUF7OI2lp$4cCYJ!@f z7N`|!gW91Es1xdfx}hGZ7wUuhp#f+R8iIzQ5oirG3XMVI&{`;@J(U|JF;FZN2gO4P zP$HBBMWJLU1xkg|pmZn$%7n6@Y$ylHh4P?$r~oR2ilAbs1S*BfpmNAQp}4-PgsPxw zs0ONq>Y#e40cwPrpk}BAYK7XMcBljDgu0+^=(8Ao0@41^o=p5f`{MVN|Em0V=|k=B z*4O@OwemHw8YW7&vww1A#g5{jcqjo%gp!~rlnkXnJtEsCY-_OX!0xeKt$eBUu(Vui zmRh8jr6;9lq>z>^Mv9fV%(XIUH#8f!%DS=v;d)Vb=0~@Yh$+Z2h|^Q#rx_#yFY2qBiyCs zy-RU6hHUg$n$NO3vSoK<%kIdQ-H|Q3BU^Syw(O3gP%>o8?%uU!cVx@%$d=uaExRLI zc1KxIHe}~f_FTDLFF0SiNlMf5{jB^q=?^KQX}b?RQTb%au5m2>i|;2*e<%GY{neMH z*la2A?Jl--I(_8G`pA*>kt6FPN7hG?)`pA*>kt6FPN7hGnBIHtakOz z=JdF9l=O#W+u};)$11;2`3&WjX4%=04Q`)op03R1>B#!tk@dYJ>w8Dm_l}~F^}Q>z z_BeW0H7<~BZ)#5$+#)?My(w*@kziZV6Ji@>4@j17rge_2b&jlcj;wW#taXm8b&jlc zj-rsY&Xrl~9Hl}xs~u0OqNmi`N2>mDsbq7VXR54BdAU>}RZ3M-wNxY3N_A4b)L_!S z`XJ5Yb}dVv&R^~NRFTSyr7Ogx%Kta>YgBxb)GW0~tx}uRE_FzqQkT>%^+<(k@B6Cf zP_5hoo0fw5ZF&B?`VZ0dn7=O1|F-^K)zK&QO9RrNG$dWA`Hm=GBaKR9(zvu%3Qg5$ zlwzegDPBsD5~U<5DkV!P(({^6n(}lhL&}u0q--fi%9Zk@e5pVxl!~Nc={tE#m6u87 zl3f?7R9+=jOEprhR43I-4N{}jBsEJdQmfP^wM!jRndZ@@yj$v#dZj+8UmB1Gr6Flp z8j*fb{HXHvw{qSeH67YQ%P+-BaZ zsLD=Pex`JebiQZTDv7xA|rFD8FC&|N1SGZ#0kKTO|M0H>4U= z_Z0Q{=F&82YiWk`*Kd*Rs_Fmy7Rml9`@emQ%1!>C+tB@+=}A6))9@zcd5X)I3Zz1*NIFH| zKrB&SDwRp)Qn%LIOx1g<=2xxh8mU&Qlj@}gX^F1MzN>jo*ADvZjdeFv`GeX|eXDE3 zRVwdP%(p7rU-P*^8dUjfdcR-g!8Wv9JN%FJ-a^gmV~wd%y*DOJmexwaHgvMQdurOY zp%;|fHk2eyl(N+RU>o{H@7XrARP%d99Be}|YR^%cN1ooxmkOjp=}q;^a>Z>WE|top za_JGpRw~~~?|m$9jrd9Bb;|3d25Aq~afKACK5Ef)t4TaZ%hacG+kZT*`E;wiN9vXO zq>okSfbv;dUqi}=r4eb3G%Afriu=p zhEegDG%jtSb|kC4G1{NSO16CQ$`hnSDM^Y-$x@1xDy2yWsf`)RGo>skTl!hca+B&v zReN%^ob9TsQ04C_wpe+IR4SE8$9*52<_cc1cp=>vIh*1YX`-C<3SNdMhEl+U$p;Xf!r-B)QIyDRV2bf45O z4M>C1$!bS}-Ww6Gkw&F4X@AwfvwUak{TLl9XDW|V{($o5BuinPHoCK2N7}XcWp+O4 z$~4q{(!%;=cK5DUuuoCQ&L`cwDUh8{y0SDV9m;?*p)4pH%7JpBJSZP3fC`}^s2D1N zN})2S9IAjSp(>~vs)1^uI;b9MfEuADs2OU3TA?VbNpKBylWfCix< zXc!uS)Y4>drIP!rS)wLq;<8`KVU zK%Gz*)D87Oy-*+24-G(r&=52XjX-OlQD_Vrht@(NokRNL53+l1{`iCJ2?$q~03||p zhV9;sLdj4HlnU9^Bj>PB_>MB5OehPoYeX(C2g-%=pnRwRDujxlVyFZvh036Er~;~l zs-SA92C9YXpn9kQYJ{4gW~c>fh1#HYr~~SRx}a{T2kM3Tpnhlo8iat%O8J`J)7mqvLJg-%a!Fo zxlkUI4;4U#P!UuNl|ZFX8B`8cK$TDxR1MWYwNM>Y4>drIP!rS)wLq;<8`KVUK%Gz* z)D87Oy-*+24-G(r&=52XjX-OlQD_Vrht@(m@$=Ve3}oM`b8FhZRp-dQRp-dQRp-d= z+dHyv)j5hn_N_WsX5XrFWM}D)>|1q?>|1q?GN4Q-3(AIapj;>q%7+S|LZ}EThDxAP zs0=EHDxgZJ3aW-`pjxO7s)rh&MyLsDhFYLjs10g|I-pLd3+je?pkAmC>W2oPL1+jX zhDM+@&?qzpjYDgpkgg%QwI2h;LUB+$WKT{wM?sRJX;33SYp*$!bDu4>1BB&TDf$W}|n{ydd4pl&vP!&`S)j+jS9aIlBK#fon)C{#i ztxy}(4s}4CP#4q<^+3H)AJh*GK!eZ_Gz^VEYoJkR3>t^lLLprnbUhve#X@mVJd^+> zLP<~*N`_LPR45Hfhcci{C=1Gla-du&56XuMphBn!Duzm+Qm70nhbo{-s0ylvYM@%E z4yuP5phl<(YKB^%R;UeXhdQ86s0-?bdZ1pY59)^oph0K|8iq!oHP9$D28}~&p^)xH z`Qs0=XTDrn9AwXbxv~Vvo&|Gd_C%PYC}dBExv~@}6-tBBA$#`BIWnOvC>zRwa-lpZ zA1Z(fp(3alDuGI&GN>G?fGVLXs2Zw)YN0x)9%_IZp(dyqYJpmzHmDuyfI6Wrs2l2m zdZ9k39~yuLp&@7(8iCe8qtF;M4y}bkvB5fzfnp(hYS)d3cqjo%gp!~rlnkXnsZbh} z4rM@@P!^O8A?UV3J$`e$!r=7)#qvB*KMY3PKwR_>e%6pn(9~Wn-EL+Nv7HiL!r##=L#g|J( z;$mrnxK#O(8lC0JE2K)PO0rMUHOgzHI;mc2kQ${Xsaa}~TBSCrUFwiJr7o#k>XCY- zKB-?iRrT4u+#zXL8j-J{CKq#x81Yn6xMb$>>RmExp$DM3nvMl}M%1WIdl#u6!Fk<5Q`;N~)G>q&a%e zy!B%H4pXDlBsEL6PinPXYL_~sPN_@kmU^ToHP1ff{nCImC=E%&(ulN18kNSRacQk& zzoi?adycV^eTvvr^GFcecbJl-sFWXbSv+XdZlkP&wk|^}V~TF!cLgVZQ}spb1z%^+*?~o-B=_e(``bC=E%& z(uj1m{7)+8V)el!<>QLI%V&E&ph?@zHHxw4KN2-PN7GT|$x@1xDy2#3lKs|lrt&N) zs_n?eO|IBJC*&(HkhWL5ilN zd;QAiDRxl#kTfhUQ~M^UY)j2^Ow;4i zTFIV$h)K};m*S*&$v%BpnxL`d?%g`l5cSLShEJNMPcr(H2qi&LC>ctDQlT^`9m;?* zp)4pH%7JpBJSZP3fC`}^s2D1NN})2S9IAjSp(>~vs)1^uI;b9MfEuADs2OU3TA?VbNpKBylWfCixgLLTykx)B$xuT~IgF1NB0EP(L&P4MIcEFf;)CqAAe9R z6bHpa2~Z-G1Vy1_CbIs01p7%Aj(n0;+_n zplYZFs)g#HdZ+V^8CerNz1godDDXargVjY4D4 zIJ6cD>Ac4ue^4wG2gO4PP$HBBMWJLU1xkg|pmZn$%7n6@Y$ylHh4P?$r~oR2ilAbs z1S*BfpmL}Js)VYbYN!UPh3cSsr~zt(nxJN=1!{%bpmwMO>V&$WZm0+9h5Dd=XaE|7 zhM-|+1X=@)LSxW4v=-8dUoiflSSSvPhZ3MfC<%%}$xsTE3Z+5mPzICDyfBy%?LUB+$lmOW^1m{hH&d{0Vb~?KM zrhGHyUn@UO`A6F0-mm;~<@YK7RJvX7y{>8djezr%+jsf*mMl$;3qBJ$ilt0%`0vI; z2~Z-G1Vy1_C{k+| z>dL`1Rdt2R2c)w!uRGN?`+c;iw3oW-D18b)R-c|fm9o{CTlD^zu2#fro{Q9^x22Et z6!Zk^R;8m^CP%8uFSBKGWwuO?Y?&OH-I1*oM^PvlN`X=#TPx0y4%u39WwurvWkK0c z4wMV!LHSStR0tJ8#ZU=U3Y9_SPz6*8RYBEI4O9!&LG{pLt>2F{^{Mo^^p$jt*5?n( zf0BNcF4MIA>cs?&mkp#z(#F!J(o|_n$zrxu{*7|`i(dA-*0ZJErM;wi(tgqblKmRW zq0)vnwvJDa!xlm)ra;W`<&mRsM{X{%Z+D|$_I#@bXI$T;PJ*>Dl)X(%6bHpa2~Z-G1Vy1_ zCbIs01p7%Aj(n0;+_nplYZFs)g#HdT5c> zf*tc`Nxx|SVEaV-b-Gu?c24l2a=WT-`!CyvKC0aIU$(EA6{F+0rtP=i?eDkQKIjSQ zY3Ucef4+32^qQvMl-`!!l|GO@mh9IxY#(}%Wc$h=HGQ1)y4cR%&KI9Awzk=wmrbP2 zB>S6rTS?nU?&HAJeo^n+c4+70w@VL7*48^zwyxID6ls=pp345N{1W9$q${MWrKQsK(oNE> z(kXuYePa6su>V{q|4{i0(#z8SZJm6f_rI3DlWd**Ed3_^A=$5v+ix#Ul>V!AvYp=B zQJN|JO`0R^A?+>gBh8l%ln#*=NJmIVNykbjNGD6DNsFYjrSqf)l<5us-FPSgN`#W2D3lDPK&em~ln!M;nNSv#4dp<&P#%;I6+neh5mXG7 zK&4O_R1Q@@l~5H_4b?!kP#shcH9(C}6Vwc~K&?<4)DCq(olqCl4fR01P#@F}4M2m? z5Ht*pKx?2;Xbc*M)~a)^?AYbXQlL~Q4N8aX*yS8{ z>~fR^*|E!&G~W0!N-vCB~vWXCR7Rs+>S zbx=Lj05w8QP&3p5wL)!BJJbPnLS0Zd)C2WGeNaC%01ZMz&@eOtt${|NF=!lG3x%`~ zbiEb>#X@mVJd^+>LP<~*N`_LPR45Hfhcci{C=1Gla-du&56XuMphBn!Duzm+Qm70n zhbo{-s0ylvYM@%E4yuP5phl<(YKB^%R;UeXhdQ86s9fg>pXge~YRRtE+LK0AF?upZ zxh4CBM0eNSQ7mP8!+$p(N`MlfgH+c;nzQ|`nLVdu>2c=j$mZ(E=IUrWU7fM#R({tN znyGp=;#K8mD{qr#OK(d*scfb4_mvxW`E0)fxk}SlEB{j3Tl2YFdA~GITp%4_EL|ct z?>WjBOZ!VtsN9}+m?PdpGXFl(l`20_`BUnxSEN|!zl%BSe-LBOT-ep51SwHUlJ3wI zrDWyyR|4#}7SfcbOBvEMb@aZ{|J1Wav48w8;;oKMDOdF#Ed6)&*g8EzSIOK+ab)Y% zk*!llHc}j^F+SNyab-zR6iS9tpj0RgN{2F_OehP=hH{`>C=beq3ZO!$2r7n3pi-y| zDu*hdN~j8|hH9W%s1B-!8lXm~32KH~pjN02YKJ2VB(xD6}6Uu_Jp&Td|%7gNu z0;muwf{LLMs1z!L%ApFV5~_l#p&FsJ64}BmD}G2w^YL3 z!;#+h%i34Cx?Q?Ux>tHYdRSU6JuW>ZJu5vgy(GOVy&vo+u-6-tBBp$sS! z%7U_?94HscgYuyQs1PcGilGvy6e@$tp$e!Hs)DMa8mJbkgX*CMs1a&{nxPh`6>5Xp zp$@1M>VmqV9;g@UgZiNXXb>8LhM^H?4KxakLF3R`D5Npy#zqVj3&lb4&^034>)HP9 zX36$(ws*7rn(fhSUuGk{Rce#kr4Ff6>XN#p9;sLAllmpw5(cFq$?mI+C|@IuN@LQv zv{nk~J=;sfN>e0DE7*D*#Zndr#X|{DB9sJ0p=2lpN`=y(bSMMLgtDM)CV5yGy}+ErM~HwQPDTElgk>X$x|?AWkGWi}d0CA+e^p6a&|WS{HaQ9h#lL*@T( ze_1tNZ5+`1V^WMbLrRl2)U;i-v=KBUO_SnOZs{AA$B`|MBU>Ivwmgn(c^ujDII`t& z6oqUwxv~@}6-tBBp$sS!%7Sb(x%uTlxlkUI4;4U#P!VLK$<40>Duv3Ra;O5Tgzi%x z+SPEogZp>ob~XGCXed}nI0(a3T%RQ7Yly;OZ zmwKhkq|c=TrPY!p`^%E9Mn_hoBMWe3H9E2y9a)WzY;8J(8V!_CW)&C8L^%aOMpy*O_@dgQG~kE~Z+Tol?xw2Nx) zP;O5Da%4;7C<;|+?zc&{Prpa9=e26|uAL=VI*M8yS*?z&R!3H=BdgVs z)#_-5R_JMx9hK~ebe&{>*Reygdu8^wAMLr3S;~*q+B-oySvpO!dtLTqX;km6qkMw2 zfiy|lQJN{)-)PU1@})bZDt!jKS6U{%QLec7ku8ZMTM|dMB#vxJ99jQ4 zibBay3X}?^LFrHilnG@)*-#FY3*|xiPytj36+y*N2~-M|LFG^dR0&l<4WfSOdFge@ z(i`eFH!>Yr&pNW6b@ZC(R*fkeZ&&+c>wA2T%;(5_j`mfoJ-unyOv{wp-^=+}`3}l= zmh5jiTbi%ylCBMoY+jCRUXE0qPYF;WWNX*OMWO%cws|tOJF?mxS?!Ljc1KpbBdgt! z)$S+?*&X0@wR~O550l-Vy}Vs}ncuW!*i(CNYINtS{5_SOsC*MmTY8w*II`9_ver1V z);O}(II`9_ver0?Ldj4HlnSLmUuccpDFu6zhs1W(+_vK*q-Qk!ob;kp=C^nSEp}ur zc4RGfWG!}NEp}urc4RGf6ostCuFP8O$Xe{ES!AR5CFxbEU0N$WqIMlA*;%!v?`fMO zYnvl$n zF=N{!Yk@1X7C5pNIIP=V(~;HbC|{VR z_Ft$rZ!AvH@|>=-zEPFUSD8KWQlqkoD(jUjeZqVl*?b+@d>z@cII?ANWXs~nmc>yN zvSo2)DNrh8YxxY#zD&#Zpfp#qzw}{G{QV%_TJ5dX`yWXEklvP_kbaXaZMsR&|BkH9 zjx4~Dwb_xi*^#x`k+s=T6tXtEGHbJ=R45HfhccjB)M9(i=xNEmv0!OCTItAI>Bw5? zC{J{dbbxe*be43kbb)lSv{<@ax=OlMS|;5n-6GkO+jmL#N)Jd6OUtFlrKhB4rRSw! zdwN5>QnIt__oe@Qmi1ee{UH4${VM$~+4=GWX#;7Jw6V0QG*z;5=jqb6(hkzjlAVjq zmUfr+lIBVKNe4&=ONUB_OLp#kjC8zol60zchIE#6u5^KPv9wsaT)IlSR$3hH#+30g*qt8(kveD2k8Z$4B26+%T&F;oJTLS;}nQ~^~&RZull1Jy!xP(9QDH9}2LGt>gL zLTykx)B$xuT~IgF1NB0EP(L&P4MIcEFf;ygEwz7rPo~%W<3D zvoweOjH6h};-Gja0ZN3DpeU3Kr9i3B9->p#mYdX$^(A|L-%=)Rab#_AWNmR|ZE-YT zbe!DRD~~9*G?zIzvN<@iIXF60u`lW9`Kt7Wv{G6vy)V5d*?0GDm;SpLtIvL)!hQa5 zWc4|+`W#t{9a--=vfguKz2_(jS?{?r>pe%-dydkebSMMLgtDM)=xfp5F?tR}vU9Zq zr9-3z(h<^8(tu)4P=2yxpWqisXG`ZvcFuQ+^w%eBV{IL%>?SF=rg*pbKFLO7ij*p) zNw!_v7X5R0q{V4NxQ0 z1T{k~P%G31wL=|HC)5RXLp@M0)CcuL1JEEe1PwzY&>CnI8iU56wNOZ7(5>kh$d>$E z?RW0f-q4I#J1LP<~*N`_LPR45Hfhcci{C=1Gl za-du&56XuMphBn!Duzm+Qm70nhbo{-$Xa!jbgXoObh31sbhdPbbeoZWPR-@3Rz#fGV5zc8)=N4DA}1ug05?vqbo-XH0$+r zH_iTHll`Jo%ci=ns)}cd7l}_+{+Ly@zkV%A)4y$?U%FBwZqO(CJvF_be80(WPvsq} zzgjb2BU@K8mQ2;&T=QBnLDyNtr)WNZh?gthLgg>1ETZ`=P+c2n zbw0SBMzMHHc`wjk!m(fd+*~oqs;5?M8Iboo#lNnYXVqnO^6abpPIboQy>vxGij(4{ z1SwHUl5W~v^H4rbN|n;2bSXp1l(M93DMxxEs8`%5k2R_R%(UFwiJr4#kuDbnug`fTaH_mc7fX;2!HhNZWqKcpLH>T~fy8V3h! zd6i$MyhVzUc9tI3`!}n+Q!3WX$SE!Dzn_?HC6co%I}dXrDf7tQmgchbdL0h zR3cSK_e=kj?vRd`_dDflrH%Jd8?`KhYUj*DRHyWSG++8mS|YtPQ)eW~_ml3BHj*r^ zOS(`>$kVyB@@(a=DIW`I@2h24rg6N7^1Y>fr1{c;(jn3U$;SCn%5R*dy@K**wVcmO zi^LD8?3npl-nqI`n58|r@})C%T|xY<^pLcz$_|hk#FLcQEB{9NO1e$cA1Z%S`4LjH z^ptd)c11PHuTVZwdA-yiHA+pA#kENH>HSUBKi`UfmZt8ib*B7xX&seMkT#GeNt;R6 zD1I-+Y$-lk?LSW1L42snqRMSv538?FQQRD9U1_%To62I9ZzoNcu9Ph1ca{GnT`ta* zj+E@ZN@*Qw2kAj+q55c=^}p8N4CUKPJ4v&oU8UWmJ*Bx)jP?<+(m~?COOxb1Qu)!+ zaZN|#AjO0%_&=c{kqRsVa^3Mp3G@)Rj5Svp+%B)125 zq}`BTW_xf~77r=dFVn8eC)sOC1z2g-%=pnRwRDujxlVyFZvh036Er~;~l zs-SA92C9YXpn9kQYJ{4gW~c>fh1#HYr~~SRx}a{T2kM3Tpnhlo8ia?I%H2SI&UVF1!Y4y zP%e}Q~0H5}_n03ME7K z`#5fWq(W&>I+OurLRnBYlmq2Lc~Cx702M+-P%%^jl|uHkj%#x{Q~^~&RZull1Jy!x zP(9QDH9}2LGt>gLLTykx)B$xuT~IgF1NB0EP(L&P4MIcEFf;)d195$Czvkx1e$CC1{hFI2d!opZ{hFJjD3lD@lO68eR45Hfhcci{C=1Gla-du& z56aiM?cb%tq$8!HrQ@U%rTwJSrBkJIr1PbVq)VmCq${Osr0XQR=C(+(J6v~4E2R6S zhoncPtEHvVEz)z6z4x^Ay7ZRxj`W^nXZxQ^mX1jXKIu7%r7RALhZO8P5}_n03ME4+ zP%4xLr9&A|CX@wbLpe|`lm}T)yX7c=3ZWvX7%G8Ep)#l(s(>n?DySN&foh>Ts2<7< z>x!3jkYvB^Vo%4~Q(8w$dr5Xx^LXiW=}hSy>3r!T=~C%3=}IYG%8+i5ZkFtMpgW~| zr2D0OsX($PKc1BAy%o}n(ks&Il0BheXXWO%bZJ5`CLG0576-*c3icf~CY-~@grg{A zW5SiCK&em~ln&XLa1I+2jDO3iPLpCOy z!^VW8D#*r!E31KOp*pA@nxX!;b$*g`s&s~QmUOOUW94G$Jn3@jD(PCu*6WSZU!Uj+ z*7?IKUoJf-{q>2Sa!prAw@E9dha~$f_McDm*x0afY3cHWU`#lQr7RALhZO8PY)m+Z zjR{9l$i{>#OMz0MG$+Ly=`?APbbw^z!S)ZANcMe*D?I%H$QIc!Wg%7Sc6xUw857s`Y3 zAsZ9UVPnEk5oBY+m6brHP#IJX*_dz+8xxMIAR7~|tOlxu>Y#dP=kgOPZ0?q9RYd&t z;T3o#y30{~T={XXAf%6${}E#)iaGx5vpvv@PXGTS#!6hOvMyALks@Jx#>Hsz0efv8 zZwFo~GJ zb;c1caDC5Z=W4cuv#$SY{`$Dei3wb%z3p7OX`;F|bQ7V&kNl^8041pFOkx7pj%T?* z-GY>BlJ6?Ibf?=V;+jQF;Cjs#UMWuc(-l8`;^H`5ZxIu?<~MkzkhLum{#`>vHz`9; z9lKZThPVzQCUCuJLtn|-7752|&?JgJ*yoD&Nx0r2CUE83>8g_Txm>EtXmS0()st~8 zBqnhE{ciK<4yY6fKQi5&RcE*CsXz7<^x+Z21g>=3{FFA5BH?2^)}6wS-q9oMfopeS z0#~J-Tq{{OMZ*4|4E^|4ul{gR;95*f;QCnijVx^Ra+pF|K$3M4B!1W6;fh(`Zxu$rof2vV7`k!fRe`N};!-0@r5CoXbW;Bz%Hit>->F zwC~VFT+@gNT<7?sWpmGEYt7P+AARxZ=D02-CUCvu*FIITk??-1C{|RnNnzPkTpth< z^?PG$zeKn7J86HY-msqExw+woBwW7|6Sxk#Q9(-6 zq)6EI8v&=USEgTL<2Dk$(|4WO zSbN=8xaJWPxWay$qn_(0z1lwR`NdB2knGw2Vw$Ov%mk@*>jz!S4%fOarm1%<9dLYz*TCCp)^y9 zgzwO+)wTbI?O)Esbrvy!>ys7*DWyq~@H2X~<=U|Ff;-Z1eL+m%+TGt(%<^3RAPAlJ zO6ZbVxUz@|Tt6PGaHU@3Zz^`_mq{E+Qsyz3-ox*hU@++X%7Lbo$SaX5tzmCU7luT^QO^ zv5~O9*rDdPX56tSt|DRr*O0%5^o|Q*>wim=+uz${FI=A!6Sx-JB}}EgrAYV{y;^T9 znZNYWy>ZnL6S&Uz&*HK?*9K~fxjs%jr63E}CB#Jieean!D@bXs6bZkrS92}e^O1RT zah*p@P}kmm$vn?xSJiCMXSDz8jCr{BB_?p~`j&!}Y}`h|b`8dMe!uR2|AKvR?Lkc7 zTHI$IJ)tE#0@>@8%cJ)pB;`)l1z?Ehjv679Y zNZ3Ek3iVwSnz|pZ*~A2{7YjX8XujtB?sYiVnuLl9<5tRKMOopyk2cCD{lGmvIV#{B_?p~Z--%}d?^xMWUtcl z-&XeJdhhBv*ECmhn6gOticNJ5MD&j}2PGYb>nvi-wewkjUX-!F-KtN% za>PirOXvLUFz;+Y6QRfNwpZPuk|JTd`e!lKZ!Lc4aOT`ejLq57!0}!dvJ-SSXPf?_ zed1Y1;QEM|VA;P(a4uT`k+6+(OKe}o@7igQA&OCkB@yBl)B z`qTB;ftOD##Pt9%fve#h&*a^q`}fZmN8`Gkn81~PlXD&8)fIIUp^N8C+4UG)3yBF_ zzxX9~5*7&uu9I$f{n}%3{XtCN+TDhNQjzrMa{aSu`J^ITS;Pdc+ih2*be!Zqd)n6Y z!vSw?e;lr6VglFS?l6z;Nl1~f?U!stPwXf;_jp{p5fix9u|TC0q)2!-k9Fp?&fIfP zz!ghO;F{@gU&Wrw&M~ZoF(d!nrWn_*#6!*{La{)2`Ip^!V?bJ2^n|VUqwy&JTc6$5WDpERGiiB;XS^vEL!AVD* z%$%Evu{m4X+200B#F6l&vP=|hdQa7o5?txT1g_ist;yQ1eS&7Sp{O!b@Ink@S5;4d;x!_`ep;JU$rluD&Y zcr%Sb>$UpQ&F7Tjx|Nu~b*jHLo$k5LQE%8M-(`=ScGBs%%7_VE>-gKn8J^3Y%35F4 zdC1`#oPjHrn85X`mc){`hY$ZlWMi!U`{l1M!sYF1y_mptfxlgpsnnf0*hqNhkIUwk z;i@7g7|)yfWARMSb%S1QqrCpEC(F*nWzQ&BIx`g1wVOW<&r)e5ypGx%D|$BN&APL2 z?M+PJy5eq|i~BxKB>aHLmTSc>S0|p0>l$JL*W4-Q(eE)yZtJ$GLvQ(YQ8}*p#01NA zkw3<4l|;gKnMJAQk<+K1gKG&fL0zl;1B;#LN5VsTwMAdG>&y?&#q~8YL0#|JP*6Hg ziiFS7*swl4acbp9=i&O8n4qo?{SP!1p6fNezojTM^VY!%T%QqRuD>3am;Kvuxn%Yx z&sDI!Z*`w$q;$Tde)ijwHu>Dd^O^GuVuJQ)x96n`JlAeoHMVxDnyVLGfUA<2!1ew1 z&SfX)+KZ|#b1nH}*CiL?`k9!(^|z(YRq44J-9%_4C;q`oT)PnyxL&c9sbm)sBH?fJ zs_H_K4-a_gB3y406S&T^m7#R86bZ*hyou1mRi$wk%0?I|shBH_bTk*%-#w7kqExPB)laQ%3< zd30_kMZyhwwa+pStc)M1#`Oy^fotn#1u0!7MZ$Kc*Nz~GX`g?18LsV!iTcN#Imza6 zXQ`2JjmTEnxA*#uwD>%G0YjV3!>+;h%I{PpbB-@IK#O7)WN%xbn9h~BvR%Yu65{0=d} z2tU&whc|exRa$o2F1~KP?ZX>zokvWt6p#D!x$)oXDn0gwcW%VhNlZ}JJio*`<(yG=GWo)|+i*QWOiKS+=Z)#n85X* zHA=}2NRjY)+Rbh(x^3wV*WQimQDOqu_OF;n-_4XF;axq}h>B^+ZpJl}n7}n-i3_~P zb1l`Y9WM4i?~}HBaP3G;;CgLy=epN(P1Gtj*ZAF8_4nd>iGI+E58#?kOyIhF7w3A=b8Y1&LK}ZK`s0JRYKaM4M_cD9wMvoj zRFCzI_SA)EwBkB}n83BO-{yxr*N(ocqJHSphj6766S$uC`{&_*b6tAd>Mb6|^&ByQ ztJmMJKH|AnYh`UF`n7NFHILw0Nlf4xiYiE{O>$S!ZR)oK95?N#RRVFuW%)g zDvN|qbQ7Vef7I>zD6X4{30xCvT;OugRi#%As?d=upPjiJ*G9wyuH)t?NNI(nCsoX% zbotLU?JIDdOia|@vu%~;;@Xu(!pF&F$J0GGZ2i6+*9>BUx<2#A^JAWCTMbp0h>2c}Ly-nzi{U$$->p5Zq*D?NZc*1jSWHV6u{L}Zod;(W7F@bBD zRie}(MZ*1hwe2hIAIEie;A$WyaQ&X5Af+cIcQ?nT@=N#J@JU=T{=WA~)^hqD7Nw`1 zq)7Ns^`Uldq3vcrIr}MGyAu=CHGZyn+%xu(@Tan@uc=FZ+9domuHT6XT)l^RrckFc zcMfSQdh7K+%I(Cpl9<5tiNA+@#&adRS%lILnDhNJxV|7Ja7}sD1wQM!vVGUFr#yV& zv$(b(CUC7TcY*)#Ts!-&xKrZa{s*qFi3wb9_$6JQYcJn*MaB;ocH!zLCU7N9bb-%# zuDyL%-4`Ro;7gus z4-E_(8;2}?_0yMdB@+|4Ql>c9%bx29HxWAQ*HwGHjB96N0$1BPF0jXQy{%Wy=kRpg3a2?eeuf1hAOEfTgXA(j@#T({S& zxb7t;a4q&rUQ=u&T&q{>jkQys>v|1W4Kac1{d@%}^-7VjjSyR|kDqONvlrJ8F@dYS zT|r8(OMkj9SaNLa>$sjGCUBkRAJN|MT((79UHfkI@Fj2HI+K{d^`jkHmF(0u5;m{7 z4jnjj>o;-zLQLS=;BEye^+}QND!rQP)`#D|s1H{>F@bB3n-rw|Dfx@&wIybUA5?uw{eXT6S%J0-!p~! zJ=f80BD8YlEWB$kH~ag9cRbf@-xW9Qsh8iubq6tlYmayrXuTH+&-Y!eX=hAX zg=;P`f$Im`^p)O~BH=ub^%VVC4}JA6u5n@l*G@aSzyZ&d=DYs+$HF%TaQ%&#z_lRN z1-|FGKGUnMkC}>5EHm&Z0(ssBc5w>^@gS8XKwe_2(BH830%#yUEG(-BH{hl zbI)q;f6r%Ueu?V=VglFoTR7KOo@y`ONQd-A+t2*i!6pr!*?* z&XM23MJ+o&JBn)oF+pAD`}6tUbLGjkfoO}V+a2{iu1kmsTs?sz z1Folt30#N2;F&@{dafI^vTS|5`g>`@kGKkn30%AR+v%9+I?v4_RJ!3SPmJN(o0z~g z-Da)yPwCIQDP7csn5;$ z4cCLj1g?wx)6cb@>oL7rb^T2XpIM7*2{D0d=7tJV`j@09!8G7)%vWCU@wflNwJR}! zt9d)~xZi@0gg^KDa9PI-4Zq`hfSAA)@kiz#az?__v|KjkA3tl}fq&pypP0ZkxzK7- zQhX$Qoi_h;O&s`RyQ=cLCNzbZz*T*n=kY?^m0RnLB|GQwexn%h|xLzkFaM|B%wq)N|i-aph)`xp$#UCHRbu2Maf4}j{F6L3J=Q?MKe!Wan zCl0LhWDKr1i3wcG@AXWfbv@Tg^Go%MC#9~7tAm)pwf+gtHNkUTrB~~X&azTa2Ll6m{qzQBF_SVlMTFvgQ(AUHSuGjsOR=bWG34fyZ zH&yH_hxME~5!c(q1g`XEH^Vs3^}Hsmu2on6yki`$-H8cY&*wUq-G7OMZHI0PQGduW z85`p2Ato46m*zXyB+qreUN!7P@7$hv+9X_85EHnr*xR|hdxhR}r&ia6=QhunjO!X= z0@o@2J|W(#Ympp+(27+zKNOEkxAeUf9}ZmG`773LPDjEKHE&l%OkLRh#zweyA|`Nc z)#&D9-_QE@?`Uj{YX&iaD>2ErHt}3`-fQWMv79NJ;M$Uyz;)~WE-t}y`5RK`hJBjW zO~7?0F@funN1bbm=gQH9Ae8s?4vVJXx{R2>wfJ`D+SGGZYr?j#^j{~>+!R+0F@ftN z`-rTxnddr3WObE1HtUAXa19d^xPExbJUT!2T(&PX*Mb${0}^qK6BD?S=bA^q%<8$k z+O~Yj=D2nsCUC{g@J!y{_0ajo1a~(ucHJAwr{da}n80<pji-O>At~>a<YhzVQ|?B!hc4Jn<6yNS@Y$*1hR z4X!p~0@pK7yTD}6WxG^C=)C1Wex8i$1!4l%{W=y}n&G*=^+(+fu_L`Ra6Ljy;QHkZ z=i1hDt=5Fq_4JbAoNaOaK}_J9m*`yftgm~5OVx#z#qIF-?QrD~6ZJ>b3I2ezGg*D7 z*v%sJ@yiWgr{Fq;n4qrN{z>%qp36p~)pbX1e9HE?GKmRXPtS3)-@$WP|C=j&Nyqm) z;Chajz?FZ5bJ=}l_Z=VGBdtnXe8P^n77`PtH z>!s9i;CgnhE7{3&E!Fn5jSAu?J{rFhu5MxiSEHToDDCXIQbg9mDJx5xcE)uVF@bB_ zE(Iyg^jx-zt(#XzzR8@4E49laEGBTJp5zsHf6*Wkw$Z5nq2<@TaeNxCU5E)>^SYdC zmRDE5CTv^ox^#>CX5q>qChCuk{rμ<;{ivj}~>bZE*hxDFvEs4IG~3;dhsD$#4K z3f{W9EbVW&wk0O0E2Y)B(mj`*4O$CpZ`h+g9oNpp1a*DkZ*jYNuGeLmCf7SD$Nz0t zT;C8AxW0Ye)iv95ZR93GyS+a6+H727#00J@rn|s7o@-0r_3ngiE}nzy8e#(1786`x zhUc=U>1?0)M&HS&XW-hJn7}pLKc?*Fx!%-p+EA_wJ}n;K4Ob>Hf$Nqz=-G zA6!op6S$5pc6DWYt_^f}we9Pc2lhBL8`lZM1g<83KKptuJH@m-)L)&U4}J*?#ZLj@fYzCsNR-htZ5pJ1$19BC2!Ot^p=N&jq;n_=yR6#eES_to7b{&k^FA){(qCev3vQ7x## zM{c|Z;g{+`1tX(s$X28HbXG0dojqE1kS&wfQpPJGr7sxLCCdUrFbk*K>=;r%r*{gs@JpavqND(+aL8jHF{ z9VMX|ds5V_-54qnGOE_uGaJ8C&&@TQ1aHGbm0M?M0<{?#RaeuQzM6`%JH{EZz4PIw zP`8m$m1wb1%|vB16({M4TyvU1r9ej2IcL(~vZ4UJk8CA=-8`VNo zWvbAGb1A{sge{=fBBLtGaidy_szepu8uNB|j%o=N3mH{?I~nCGiU$F!OqHwD@P!IO zMpc1rMzs>vg-&9;5)I3&nbZo(2N_j!j~UhaKTFseYB4gZ9@;r={-fGJJx4~>xE-di zwxam+s1wnQ_G9bJX$v(48C4VQGPe^IOoDIXUS|$j-VSOyGOB#-oc5ylv`-tvN&bA< z?)Fgakx@0o?m@nnrdJ5i@93neB;U2X1Jo#FR5i78I*N)oHabGJLPk~d+0--@KT&t6 zqqI~zyEfi#Kd3gyu!?xKnkiQ+9}@1|MzL~z{cyE%x7)Cjw7iji^I9B!vNKO7w44|j zU7p8w3Hkob%{84iR~Aw?JxjLe4D}KjRlc?ze^F~l@OG}g^w?d0sP@RHDro0)5%tb4 zVZ8N$Bf3BpLq^qst<*FXex1CVYZ)CBDXBKa>sscnP{)u_HTJY1`94H?tq3h1-%ku3 z@*r&h)MR8-`PuV)H|c8*2_AK;ch7L|1{Hves*?63)Lj(cj_}r)G$z}R?oj2C@s#75 z{;D>NLR5N);$wm)oDFM##OVQb4jEO);Q+(aI)Zj~$K&UgwsLGR`jrj~! zH`ipEia|d&YQAjJ6RHq0x?YVsurZ&$>E`-HJ;tNjfEQO1_kwDHjH->i@>F`u67rcd z0o8sc+WNRR)HY;PP303Fl|G_)gmYwX`23Z9pk^bZiti`5^cBUAi22SbIM&%GeWCbB z;L_Kns(PTzknafo|MOZ2e1_ic2UQmtRVQsb{iUyZ)Px)Tlo{MDZDk$A(XZ_^$>* z#YaX}g>e+35+o{w2%lTVRc$mp2&x(~s!9wIo)8h3{?&pRn<$I;1E&M zsKUoroeR#zAy9RZ(b4N=+ZiekAU(-M*E6#(WsH4 zI#Pv46n_rYNT^uIs5;rmD89e_=U+xfL7hiNRS7$1^ncW7sB*}t8fPCIjQNim12qL1 zRa5erB^>)7H5O_XGOEh*X`RYAQG;WdPrk^R?M{wyP?eEk74gbAORkK`$n%K0doOtR zI9wUm^A4dhURu`2u>6^6$GP*pM(-<{D6t~PJ_S;f!6QFJ)qa$Hou*ppn#W%`4 z65g#(k!m8;VPsU@3o&YvC_Y44WvLu#;UuUh$f#O%!l=ojicp0noTe{&|C|i90U2Gd zJWGt4B8sp3d@Tt2U3S|Ps6xo7N;}%9siF!|g_m&ojc{Md zs(t7@4eBK_s^)tcHC5Cy%N-DFQ3Zf+~fKsyx1?ui2s=()pVov2VNI zz;8d_nx8b3+TsNPJ z?dHl(7t=&kn;GC+We%3`1Txy!k=BCb^OD_MGh>?1pDOwyq0d~XQ^=?)bj+xEvV_fO z@%UNd><24umYDugP0J(oh=M@CioY^I%MqWDrl6VC2_ zwe~E7s)~#%c{-kQ%SGAUAkS+phl=W9T3+r_<`wHC??8C4J0nZDME z`bxj~ywQ1-6S5BKIWnpa**WV)l_tUK_4;)y@AXh8kWsbL?!gVBdRR5rXZ@@VQ0tLV zRc0Cmsf3CeNmIODN1E?Q6$(`e8CAWnv7t{C74?{=Xu=s>KUU0*Py>-sl`=gWdR|x* zAInMUr%Kg@aW_GwMMl*HJ~*gs7FC#jC#2f6dzD~ zP2B$R*|XcA-XWtZB%GS2vR#x9O+}`kp_z}Y-ww4ZoMutk?o!nzv&@k1-f(kOrwXfy zLK+-x2(>w&|@$6K#fL5l{-Ihq_S6( zH%-xmQ>jw6^n0NaBcp0w3pVEa2;5v*Xo}U5_+6*%gIa=&sxUhzT>832_ZvJ8Q$G0H zJ{)Q%GOQxrQO~BK?&c~)J1Z{vCwDw%hU1QU&1Pzd%6@6N0JY3(vf@_nT>H`TMr3q( z_?yhR91uk}7gG3Bhz~$LMaEOcKmGkDgUKBf30;8 zYhRV@dkBg?W=zTz@f_Yi4ZhP%3Nerom+4I<%p<^RN?HeBpv1- zfx3c>DnC!7c-hSBE?DKvyRz(2r~qVC1=&ZD$3*?2y_0}cqi*@`9)lWzj4IzNrmy3o zU*hK4LBHeDjHxRk zKRgK)6B$*Hvl?|uR1NBgFBjEQcD;29>LoI&F4_By)1p3-;B)4ApQ$5GL)}0|RlhE# zuQQ^;s6rEtN0+(_&p-`EM%5eJ&RJ0>tjasRQO~nbpO8_N|Fr4roG33E-En9}(Y|Mk zoP#QgjH&~CaiYS{C($Ph(QiIlig?uOcOL2(GOF$@5hUMeLuYl`hOubI(feuYUx0dq zjH(aSjJha&{h$g>IB)Y84!#KW4H;GKZ9A7lH8f2)Tkd^#zXauvjH<)D*{EC=74Z@4 zWvG+LsH$q)xgv^36E7iuQu-CB+Q_I{U!8k0-`_%?dPh^Njt&p>y9yPCjHiRkD(!WnZitF)`?@_Ra_9}H zOvtFZe9)+yqB2`my2`e@H=%AKqbhYXqi%^ROBI@Ma-J>Q;1-k@GO8vfGwQaebXKMK zQNiOj)O2K2t+sRSh%ijt{gOr%6*rrwkau2<$Dm3Aoe%CA4JE#uGsJh+dE2T=oKo6oBDj9>A`2T|=hc5bWBk9}~d3R`Q`NA$&`xA^N?Pd}os zoye%#n#ZV5qWH7>s5@tSizTB!LG4CH)kk~meEv^gpP{}ZqbliT)7KYKsi;B|&gT?u z5`Te8g^X@PxB5o$BX>7f9jfry$ap4N?5|KUkWrPOt5M%Xt+6WUpPoM7ppqe@>cteJ zzKdE;6&}51*Oa*P9qJu2s=E3c^+Oa79p3UIN_Ox31F9!7s$!in>ZhpT^sp{H&FFY@ zd9 z$IvTvzTtnNe2`JK@q$r20L*tB@DdiNwC=hSiKn=1Lq=5vyUZ?89Vp1pHMLsMZI%m) zUoFSQ6-m|m9cB){1JS&ahaU@{b#2NY3F<2{s=j&|d} zcr_D@Au1kKc;E87?_)rnMaI*fGoxQODyFE^^xK_g+$Y@{f?A1J$sHP-n z!pZS1fp09R&d8{Gbi?!&TT~HRJU+gj6|3RIhI)aFs!sMiA4gOZ`kkEA#=4O`;y`sn zM%SyeujwnUsF8G}@Eyj>@0oMN71b^d*1ZO)fiGHqa7W8aR&u-aT)$aU zd*2&vVymL@u%;`K(KRie+bDjuwwr4N{pLNmV_T}$@uA8hqw4lpqY{W(O%c`NEF{6^2m&}`en~VP_>a!727^L zmsnI{FrM_r0I=5G~Ns+9RXNCxZ#5 z6_u4LyqAwJj&dX|RB2>X)h};UI#GPT!An^8kDn_YR8wShy{cC*D!r((c7OG5zhZTI zsJh5#U%BnQA3r-puL`CncnLRdaXt5fDu|4#lzU8H8ANrY3Xct+u{nBVfJ%#us(!Zj zjH2S0CY;XoJJinzH5eIHF_V~JCQ%KE@lo0C;p!HdpyDCJD&jrcJUM5MrgMR? z%`)MfS<~ILoLO4tUCwLKce#6>%xJkjGP*pS>@&AnMD4dK>cy7>vp{u2Mpa2)(^pne z1L?-blV(&8iQgQkR1;)W#ZPT=xlLcD;tXk>d1G#sK4kCP{yr};@SwScdWK?xsWKVf+pzw=3nC%fqH?AsnbDIHjZi7+4JIJTj_Y*vE{;MZF`z z`>TJ7MFomOy+cOTBzu7>AmsLnsBm2-=C`#)M;e2uj}^kEiI}XtrRcep!>Vxm4>>DjH=)c z6rxf_R4`5PeM0#o^|F+KT8NCQg)J#WrL0l3HTWLr_0-zg%0ew`$qCM=nr829%86=e zm+;v5Qv=FD1tX(d!=|_etP_K|t^}WC8tE#9xrsB*Pknnv~sK3al z3OHth)kNK+3Qaf}21XrG4XPJ1s#^LPRb3Q6wxVJ09Ih1SV0EZ=$fznBVpI)Louioh z@J^+2_|$+Zg^a4j`HiY6DjV%Ag3j@f5=m-8tw2UqzyhOciONe$$YZ|#tun=HLG?mL z_g9|TM%5Nof%-~JGfte}nWi>WA!M|#n5B%WBZ?d4aaiC?#cg$<;vu7|oZUWkMe*R~ zB}{d0$GEysRgh72wIPM5@V8pfXWhr6cL-1|=bW7<>OtK`M%6O=2)e$g$0TUN$uc!s zq54p3kWnRXz@S_MQGB}O^=kO!QQihnQFGHQDh(p33h^~_8j9*`D$bsRQ{5XvtwKiC z>Lw=0_YCxnMbuGrnsMvQ#0`z0LXlDR@TgIZMLnbnkB!@FQp9Ks^&A;h1NcUP3O}>q z=K37Nk?&5sR;K%xCQw6>VHNS-c)r{lFD0Laeo~abT&oH0jZ=GZyYwulw7iI>c#F-g zUVBtiwCshIM-E%WO;xaDW>2k&i$mKPzTYuek6 z)#jr3m5+R~>9pzB(dJMCkx`Yr4fo_YEkxCzDemiGl&$+(K&3%O)%;#;9H*tImNHFC zSls7SOQ;ZJRK3h=g1(}nL^k_<-jWh~e4*YWqbkt>qgshNLce);r{j05^iXfwXMJ{4g8&S1rfMui^9`{G*X#*7#8SX3MXjv%x)RP2{ z=T`4Jrf!3M8ptOXDs83Z#Wcm+IWT*LRBh36KV)=yYT6}iCu$Py(6pr9x8Az69aMc} zRORH;1eNxpQqdIm#gACqi)ziUNv0o@QMD*L*XeVMM4g~j$VRn^^SW2>fWDR^!z$vs zFOqfVlMz4Ae7a}d;SN~$<$OA!(otHT7~gRUQO&(%^HUws@>*p6-ST2-nLCa}KSO76Odc5mZSAVDk$fzn&okCQ)h+0a7&viv- zoygV&svI(^67mkC(p6LdDPF>PpUd{_3Y8ogRTJ!%4-mDRL}dCoH7EJD0H|rm=|5 z+7rqH8CBIb7}ZNuRjTk_UVE$X+Fnp~kWsbG_TF368>>SLDB zj*TRfo-gSGl>ix4ANCv7SJViq@HX6hX#20eP~VVIHOxLL=_l&2RaqzZThDBpU#g9vK~n2Wpz&KvAAC>0XRx z6pdN0-$1Bi$gqld)>+fgf_8(@at3=e1xd^E=yz($Tuc;wZV+0|hK#Q1D|?n0EGj?kcOIG3 zy!Kof4D|sS-KuL!QHaVAQQ>q}_oP~!L1hDmKy5@u`|`H0UK=XvBK@Y5wliaA)e%FX z@*$&r)tE;iD#Jtt*{jv^5?{KI|$Y@^;rx`Uu z6yJx_gi|6(XVe%` zzNX@A@Ad4>7^uC-sETjL>R3_JXgkLsd9<5np|Ma&kx^BCmuY^SsNYnfA>=GuR3gqe zsH(`Q%41(=HD1&Y>Zk;%mO<&ZjE5?OjH>S`XrZV~5Y?WZY|2Ho9&LU-ngI0|8C6;B zGEWr66+W|VPgd~YM5tWIs2XCId6K9u)fs32riE!}I>EKz*_NE1%Xu3nF4L9IqcRWcr|RA!6H zNmD$+x;$8Ubv9ILWcYaJQY5eZ&j}WFlMZCQ~EFNn}(tUSZT6Q5~qleKr5& z+kFmHOJr1SY;DwBQT$psKC7<`9rb-K)HY;PWy@+5Upw4f{0t#qWqg{Ax;GChH!`X^ zPBLn~sN$yLG^luR_k5_X$f$b6mwhS=L^YuMsN7Ub9ld3z1yC=LQMHXP7*rOD;=i2{ zbUqJTd1fKh9%NMAw0GT$MAfD(&sWgOH=j*i1a%)7RV!z4PxPKXQT(hOpV=Z!ym@&s z)Ouu8rJOCuSt4o~Rd^tL{}ixk2~=8SR4t@s;u0e2BmJiToX$b*BZojOLxxqv`;BD@ z9ok=BBzOrg^xqOA1XqwFXJ{6crP4CLHjmFp)sHQ#yc8{;LPnRTqCE*M6LpwW6jCX# z_S?G*syZ@yT*L{d5S8Vk+~_xtx^_u>j93npFq{*dQFXPFnX^Kay~T9=3QXIx0_rw0 zsv2D~YNaT?*W%-XUpcc9ss%EtUhFYy)qm6~sCUSy`fb};Es8d_^!37j*@M+kZkJ8V ztFc~Nty=RRwFYW8GTK+0=)4|umoI9rulf7w-|@@Gu7&bLMpdyfruTKC=23+QOOLW? zW2}QJgN*Lw40g_XQN^j_n50TZ4yn8zDjPDYy4YtbHi#Ne*V9_08r;6vWCK(nGO9A$ z(Hko2Bn_t&q>c`V^d}U`8yQuXMpB5%Mp1l^!AsbAdRV57P&bfK)!Ux2H;HOS!i|1h zP2Y^%1T_#DRU0Z(h{|SBrD=-y1b_b6W~eR5=$5aai4DE)Pt*vS;&bMc{mt`*K{Z82 zRj2f9=>37B_-mmZ%hZ-MHDjH(^kOm3?vzMgWq`Mh$Otx)@rQB}d-18ft;&+7Af z`8M@)-v(6;8CAvCaNBgpBg&pqo#Qbl25pBbi;Swm_Re7k){FaEIAF!)9Z)5ZQPsfS z!Sb_<^e+Aw<}vlhn1g2TgldKi@2`kwzvXiF%S`?7*vR_quKP}${pw|)SyXmO%lS>k z=@B{P*Dkc&1Q{I(@8+7|Zc(#o75Mye_RXaIdJ+rU|FwkE%2GLUlt%)myur_lfePt(t{o zy%BSA?t}V_jH)lT_i$1EBxu4pIWhECIMgp>R4q7Q7HYpJz9w_w*Gue&T8fPB_jn^s z?tmyAV>7(h2OfY*f{gYxBEYDFqTEfznb3Opm4i^@kkP)sHFJqk zhySAvL(M}*RpOII@w3Wqu83RX2vkaBRJB`c)KO79mbvgdC67XNMn=`GnkIKlRAL%V zQD}zGq$l}~K|Mf5)w~5p9Tzp6Dm3Bjf7a>Fai}H8sQPU06HbU4K!Qi_g5$#`pMd&_ zjH;NsC`9F?sC+cVYIWR=$xlMXLq^qV`#iuYQ5A^L0CsZx*}M1@R46j49&e)%mD8fi z(Qn@R^HTS0cN*#?GODK7cFu_6_hz!{mFZIIGf=aTQMJ>yb5>Mqx~(d}>P)tlXQ9H8 zQB|fMg{Yhp)s3cje?_|YB2&O@C-M%6bv=Ypu> zBxu6%%{leb1*kvBs4B3XLR2n_a-+pdO|@v>(mlQi<%5i>)wZ2Wq8ih0J~Dfzte5r@ zR46j4;@NgCi)u!~jeqv!uXq_M2{NiuwxAG|E26H^6mN|fd1F<*0+kjSRV8?1Q@JYY z2mMY$wP%?Jr@9JN4jEN__6c&XiK;@2$M^G9nk*W64QdcFs_NNxu8ZRHJWV+JQZ@~~ z4%Gx1RhjLa8=~%0U!J6QYoe&K*(QDDP$d z9+o>$H<0m^f2F^^FQE|&Xs7lDF z%30N@`=XXog>OZ(mRPg$K2&~WbiFEXGU|b-bf)60s=fKc1E`wFsA^?L%R^Dq?b#+l z*6jx$LUlk!)kM1oABh@mRm*jqPCSB|j*O~1p=O~Ti^@h7-pkj@o+Jc)k_Srd4 zM0K_*#*P8Gou9}MTdEPSLr%^}RY9%tdmq+;;^+HtAMD*HTnvu10)^aaIb@cbe8w_4VQk872 zQ7=Uequ+dH^SGXI+)MP88W~k{a~t(aR5}_?bg($TD$kqn3TiPjs=kgj>a{4|oiyQ0 z8Ih~+YpCDIsG2(7s5hd5XczP7O;mz^J#Pcz5#H7GclkAu_6F*e(BF)EPREXOLPvWNpj$qB^(v|CWD`Eng;q>Fa|i zd*XAJPuOz)1Ny3jjE;@?-HqaBQQTa%;)HFz^WY;?Qe;#u=LMqjNz@QiaZXg&8~h1s zEi$S;B{sp&qIeH;;crX%4D|yURZTLQ+!s+9sKQ&m{iuv3zCigRquX%)BBQ>Fif`5B zO6|LTg$hAN)#H9feG?VeDt;gRH>j7$s2XY?v3?iTf)t-cYqp>F_B+&QWOTj!?K1PV z)y>t01dqewU4v5pfa-yas*Q^%MCGR_Pno9AVxm{8{)F1L$jtspV}oK;zS(8|C8`9? z;rR#C4n6-1>JKuicK2pW-`OUr8cnfk+qOlg-%tmTQT2W|8~Q#wQGDahTVu<)$YFn= zz9OTl^FcQBzCTfYOvM=#b>GInP~DNyEuS-m4N@2MjbO9^J!r;$abI|_bEF(7Su#!bO{gaG=0Su zm5mflIIU`==o}mB7&5B*+R+Cn14NdVzTN7H>D;`t_WK@-3#fJXwE$RbJ(ds+VqE-JDAF3)cs;-Y?L$8Ao6_-W= zKL*K{!`n9j)LmqBJMY^d$Vn(_1uY({w+T}vObB%t8SU%RbfXf9+CqxAMyW0}*Cv9x zfsFR$m))quqWGygnsCZjoPHoNQ~)yCR}9|RRFa75lEAz^{OQ(`CzFV3*R{L9Z(uu{ z`S(azEhFI=En#;`w217qN`jG)yNVzuskF>z5-#^54_=m3TJ~+zrd8j-whSqwYmvk5 zGKKif>sh}PqqkZkS?W7jP&xr8WxZE*#aB8Td$Y@{X?3^^B`1HhTZ5;WmloH2KwCsZ0_RIRmh(uzuH`|8&uRok>sn~+hJ(vN~v(uv|% zgU6!UhGfUCq=QO}jBX8=uOKJAs8e)0%1SdH3@mdZy(s@~f%x>-^lqwttv1R_6knTY z!a1A$P*yMW6={uTRC(Jw{0yRs(5+q>iu6kJJ68s%e8{khcwSv2M-v~Syk2EmG-;Lr zM^nN9rmu|Ba&l8~;#6unFe6${j*KqP;mszPNfdut0=Hgw&6wJmpiUyA+j(~yqcV%C zMHQNGf`5LFk{Rj%GO8k_H!6!L`_E3^A?>GUfr^fdsxqENWfc|ARGjQDyn?erRYFD; zKTF7k-$&r)ifJnHJZ&~8ein>NHtf?L)6AUgqIhG`gfsEeF}LhceUZ_=CfPYTL|w9K z`pCSE)sH(Wo1apeIO%=X2^@v}od`_t9$f(Lx z&!}9YUQC6nE^St}08~w6RK@o(IsUX^HzH66QR%3{>lN$8>v)Br{E<<0zP?d~MctyU#plh5FMo6_40RP5 zRY7NrDk6&SE!}Cx))rHq6oDFnjHiqNx*M2jR8dj(lLD^kWp2Btx+XJ{iWZ$_1Cz!C|3fiDl)o+FYUf4DQYvV7Z26fJCkQF3H2Ts?dxMv z(^n}`e57!h7d3f>Qc&NKQPsp=Q%Z|^MuH}s*nN^^EDhz0jH>L>xox^;h{|XxP7c?8 zzcNsHkkR$JHNynUipphG$?cUQm4$kMjP}*6lnIs-Oi5 zkWrOkplQC^Kh%MmJug**%7%=pQMR4xqRR3{rgA$*2fyl26Od8$;DpK55XE=hT<%_o zRIdiqGh}q{B;^|yDm6v%E2;P*Q~AQ`-!-99A){)ky*;lb>ZPgM~cJ8m-v7b}wLuElm_g8fL zTwH^H^yQX$QD6h8xX5T<8SLZkhN6nuB`i7r#iNE$*^p87y(f81XEz?jL7~uR|BcYl^c(f@IRL(@a`kM->|6 z&Wq1Sr!+&$$&k_IiEpoQ%|*pEO*j?v*9&V7l@u9O(e0RTA&Os}!rS@T&OO6gK*dEy zN5cBtrumklCewE2JMaF}^381t6^4u|e_CfQzM=+EUj&`leXm{gh3bKfs(rTiR-y)T z15~zW+rO?A)L~?Fy*AmSvbCsQ200nr2X|==wH+B%1$eknX(OsEP4Nmv2^MKZJ{P1qiXRo6Kp4HI92#OHrxq~)DCI|GOAMBD}H-XiAnI- zXtla$q4rQ-$f!DMpTX-ODm4*ScVdov&;jZ+GOQww)%7w~14ww#&)Ri+K6k)aeUgJ_ zQRyfxXQV0KVgqt?+T0N>zd}Zr=Z~G^CyJkO;>UYctM}{X2Nl_lRX;Z!3ESIIh)O3> z>1m4l3Ty2u*9mGbGTK)ydq(OkDyvmT+jy+%4AlS`Rs4xLT=-KX=+)OW#eHpg7%QDW z6u+~Gi$5(PZ%_JnJEx1NIYfA{WI5XZa2Kdu$mn_%$}iaIDyp`rIDUuLyLW{uj*Rv- z$=>Y*h)O_x@iLtGwIDPAY6dc@YSMX%OE*z^me`hi{DN*!^^sBa$)0Vxi@Hmmx5ktc zmlAY``hkq9`D?i+y5ADDNT%rw*=P^VVb3K58CByun|}!uWe)(SZFr|AflyPCQPtSa z=_$&twv+vG!IM3qS|X$BjgRT8mna^CT<%|6H?bGgCuCHWEM;=NMZKm9ugx2;+f#c( zl}AQZ6}z$dwG;HI{zUjOQT`$0+V+8}g^a4FD@!G(C2*6jBJzk6&wT=ii{p#KRX%~B#IY>_ZR=w zH3-V(ry1?bJG+@PSX2WdG~tXm?|)!0R6b->(?+*bImEpS(HD^zF|=9kWuAl&%MJ%@p}sRy0g91-q*vS z0+7*d*v3A_A0g@z3GVJ*!DXvQK=~n~eFcv;t1?m)pL@A1DgSoiNT`L#XkYHDOm37Y z9rHPIR<1P)Dlsyu;*>XPw5Xa?;UzqmG+x8ePzjMy)x4rnW3Ys*{H{+}GzO{-GP+)A zcmq%wE9y4wW!^c-i)Cs$7AgZWs`A@8<3y#U(VKcyt4rMPgr6OFo96Homx;*e@>DSY;7ky;F`9X{Ir_UJ zdnQ0tLq^pN`>f+cQN`)sxrgv0$ATt8-9tuIiVCKcq7CBg zFSVi8RH$Lds5+R|sA;0EP=)tS?5RDgPJ=p*jH;(ojhZfMIxQh>5U1l(&o9%VUL&I_ z$26m6h~j%%ns7prjovZ?Dlamse%W?ripoHOR?SKLeEXD{P?4;f>87fCV+v83CCY3sW`1(cHK4?>MJs;;@P{(d7?VeO3}gV zBrPy?`#h*5$mr<(c3q)O} z3eV3pXHLfj=qo!is@(G$wNO-zsOIw_gU3bsxDYBaGODtVGis5j)l}ha`1<_hzKfvp zAfqZ|yitq)qZUK0LPk|v`>fFtQK8fXj}3l>+Y+cw$f$~u%k&ju6fGVf%U73g+#dqv zj*P0}^Nd<5DvU00d==@N=636)P-T%(RmE=AWuoenpb01Z-k>4NplTtbV1(;D zQl{dptsAq-a;RR&sH$V^XHh`3#A9s&g2Q?fSRn6_3^`hciHSB8c9P6RlAfqbvO%vSk59NO(N4^bEUdX5# zblIp-QG931n{mj+vkMyR65XkVE_jM^k>2pvta zXvT{XuFIRCypd5ga)nWwMcGrT)8^f@%A29aBcsaU(?69kQRQih&n<3`rz{MEii(V? zawRE5Ws4~O_yFD-&-%C7u?4D1NltJ^RcBreDqBVIdq%jg;IUl>ZH4NNjH>x*1v%S9 z)i4!j-~sQ&+n_>_Q8mu~$$h)1hotCa>kO!Mu*-I+DafeWYUk__wUz|$uM#&OJlO%Y z8yQto)=-GbPEmzuiYA;rsrvZugqnqns-L6S(EIE}@w-%FQq61Uw7a{YT=uSe7i~js zlV0&@FTA@&C8uo|o#t-K-hce=|Ep{gb#`ORx7cOo?1AF-DiXE*rae$?kWhr3c((V0qP7|2 z6dJtw=Rv3>$f#;&_wpf8y{&R}j~?d`RBL2Z)tzX9hee&Rs!G*rr4BHA%&8m|#eai~OSMZmKb<)Wbr%`k@}2GJ_L!(?B)Bh+JD=Mf zgX)fq_BFCCg{T}C#m_?Un7>+R#Dn8d34mgSB`HPG$PtDvE zqH;4S;pkp%UP%{$f!zM%jC|9a;J{?k?%`a;OBEtsgTiqTA-Lw z=S5YZ3U7_>)vk;=59Nc5sy_A}@`9+jAY0J}KaN4H) zKJX&cS7da(I?kaGl}n=1n2NKpRTXeZ4zif|o@lvg*f-=RGb%eL+T54m;%ZHIOW3c=(!5j2^m$Z=9=8KfAlqeQDB8@P#cg@^=6q- z*G2Jo=fdxqy$lwQ1Ovb)%Jo>cSPkk6{p6#dr$8`bwWnf`4J{~ zS5yY8s#J~D;x5!xWK^|1XM*=c<&0#`NZ%4B{Cy9q6Edn|^Mht8_eB+;F&~9$?^kCz zbss7LGCJm0*>)a?`bZ)&{VdD2zVZX84ajI;RqV)oC~7DPns6pA@}Bw-sunV;w(yf2 zR33?1MpL|mdr~!D^$2PgGO8v{W<#IAD2ju8W{ct-Z@^=y>By)mZMW(ZQDvkB#~J)K zf2=1^6_HVuKfnZ^iYjH*!IuvcKZPoajHPW3J@Gjw^1Q3{3@Qj2RXh1MpUQJl zc}&Ggov6RZbEt4+RDDfhf-gk1qY6zpBbwh^_yX!TGOD~&8ue1tLaWv{KKK45R6b-> z&A08m5|ukOz2=ML&?TDaL)MGXn7+tJXRyNyjfcIq`^~>Mnh|l?C!78a;RONH_~!LyQW1FR4@DnEpJ6e z*ECy3vpjD_HKht41(U{P`|%bkH!^zcj9g^YJ5hY*r^RuCV+~mL4r)9ys?PQ^>b)p$ zs?g?fzFhoL|2@=YWK^B;GU|hxG-_X}rWKK1aPjurlj+ zsFKL2+GC%y`XTBI?a(Bo#&>Lx;0M$}WLQN!3iz+nZmwh`cqDuuJ@?5E?43IHj_9Yf ztoM)|yzd?UiIy87qsx=mZo^-qM$x+SKHa$_(&b-Jg^^KJ({AVAqUO?NxH73Evx7GL z7S+T5|6eWk8{2uOJsuTJ}apm#1lBqhgAxVk%CujVB|=gldJ1s(x8a zFqWuD+!2*>GrB&A1vMBMRne=OTx?Oi8|ct*K2$!RB{o!CWOO^HSzuHgQJE5$Pf5MC zr`F9lP#KU>m7$zb{LSX(J;iibIiEs9f5e5#hKw#@aX#dzxQo)qJAoUgba00%i;VV_ zC8kmFL`||=BX+GEqvJv4L`K!7YDUEu#pgPPBM)SJ9Up2tGOCW)G0#VYIYX*S0Cfr( zRlS>nW*Ctm&sDa3+D#o`MR1%5ef97qNXk7M3iJ;0LqiV37lUP(K61+OttIsLIHwx^LS_E-F9$=40&Jj%Q<%Lp?=?Rm3BAn>li6XSE}> z{ouuv$#LZF9*^qdTiMpbjWgr1_#)4KEW#Q&4+yr-zZ2wx`Z8Clf{ z+k0A3?`>bvtH;})7JZ#VMpZU@HRn(Hpm*QXO2s4D|6R7{>7a5Wqw2s|3QMyjH-)mjNIMxtFPag$H)~*4s7uJGdO6RiY@+N1#;KmQTxd3^_sFPvz_-*?vWpsG z$Li%hdlzSidWMXu3Qdj5A*u*fcpLg=F48>*R5fH&1=KZ)KWo#?#rL#a3I&Dq_lD|) zjHf*YkEZ9g=~e!sd}xa6(-%G(o)hXcGTPV16h`F|RmZ9qr~Bm01+@(sRg;=fkVJsxEgUvbQl!pf`8*n;_?ULvEa%^{--h?-+6&eY1o z-xh%KLq^pvdlVED6=+qHGuQhSgo?x`4=M%e>}Q6-q2*>yAyIp&!t-;tY#*->)Cpu% zb>$N|mBOMP&=ji~{ci>phU$ros=lU6r-&%KD9)|6HE$Gw3PMKJ|K0rQK*;5sEQlQj6)w$_O#--B|p;K2PzRVs!AB-6cbg&_BA@^8DN{gytDo(AUZ8MjKx{8ddb9~TK zDI;n&O>tjIKZO4(19b%%RYRk)q0g2RwSlI1y-rQ9Ikzm-Xk=8i@nA!bUPQ$)6?qqJ zIVeA5RQ;l747rpSHOy3;Rd@YAmxqdEcSw2cuS}jMSV2@Wt9muL@woz24rH{i0Z~k_ zqNoZ~k*zVeQkRNQLy=Kc*>0ao|525oY9gcRm^}(Ai{j@XxiqZ1_D^M~GsvjASk&aI zh^l5Pj^F9xk*h#mM@H3F+j~_}t*pxR=vd~eP`i;)HOn5|)kNw3>Jz(enQBn;kx><5 zAHP=@#XFBzZRqHs(W*nOLPk}OU1p(bh-yqEAVlqZSv4QwypDGOGBqrMU2?)Bp2R z1!_Y@Hj70WUBYAyjH)Awzqx~-C=DC)EoU95)W~RGmoFMsSJYJc%~#m6^N#{2sXprRwADzkmQrJ*R_O!WAlgqeftrboDwiEUO+}3+!F@fxSFll2sA$Nj;`e27X(sA$bjR_e+MY^N z!PA;Y6C;uhO2Ta2&W#GTg9Dy3|OEw;u!GtgXGzDldWH?Tc_`i^gomNz1!%hRkZ zg{ZU;wUW+-+To*6Nl}^^j3@%$~M=MLi=y z6VCCQuip4Vok2!b+@2Jo(n?ebT7dXeOZj2OxK^Tiv<=iR!J~|-TZ05Stwq(Nij0Kt zQUR^e*8^l!73yeI8&N;$HxJ%7BQKn5163Ru-G*uHoVKEplHl>vuk_wsZJ{zDqpFIX z(@qrMKl2jq{H$>gy(lVcaXu=t`xMnb#XeKaF%NBufop~@no>t5a7>IR77SBUYU6B=V*>Htx_d$efR zxo3|K+;#x%QyyJ(rnxBpbGnJ*XHfYDEqgQn-`&vHL1g~D#rD$b(DN;{Ugbz_+jMet zH*B%V*G$XZrR8;0p_o(uOsoan(eg}WbS-lG8P!A7LaNY&Go@;;R6U>yBBN_Dz>e@h zQD>Dp7^^(Yzg=qk2OfMn+Y2 zd)DeBDu_sQQuD7J-q;7KE;6d}`J2A_ib_LE7?)Z zu2BO;U80Vn(2OU(G0qNznud%jmmC%JdG4aVk>YDg&-Vuh4T6e>jH(`1&QMV+W1DYD-k!dAw4qS7kWn?yuGcV88BG(;yFOd%41-#NjH(XyG1_oZ z4`{RJAnBW~^3UN=U65fF@fZx3W6+ZXZ;b;(C(Ip=V{l6annh)VwA_)l7_EqNIBfUd z5omcAGI~y!8qS9P4kU{2+<6aGXc;V85mjEpYNX!|74Xi-z>wg=YA8xObccbpjby5l6xS83}w zVcm=JMx-)bT3$&j&ewt-bE{;Xj+RRyqx(H=aY4=uQK?MD`E)*?YX(#%WOOb3mYLv8 zQM{|Tuf2J$UziCMfQ+h%y^WeBim$+2__e9Cpr#|EYUg^Bn=L8>RU*;P1pg?BWR1<}=876m6&{&SPR02<7wQZ$ zs`|$>YM!VGw7+ODI8nA0i82pr2r{f9j)X)1I0~kPMQ$<=BO%&h)AD?2`3<$qM@yci zF_X+k%W;tTcgu(WF~;82cO96ImiJ9CEiaIkH`0#a0iNG)^85v8`7koNrmx2swNO-k zs_;=cVToIsg-{=n(UG~|UeOkbx@osh?Xg2DFM>LXjP})jp6P3`C_ZO$NxC4x)WuN# z$Y@`G(wp28QNC2+G1jg7&az9OB712@)jivLh^V4;2=MO8zAyjh5U3}}=n__2WZGFO zs;j9ule>SswG^rjGTK*YT@zd;sv)gcT$(W=Rp!mhptd5TeH~0^)N)aIslvx;vQG); zE{8gfjP`ZM?!gtJc+>D^^hkYl=L)Dt$f(+DkEWHP_%4N2_3+KkN~lA~sH$s^rd9vw zt555|?yI00BcrNF3u>CmYEiFfiYA<%W8DU>hAN4SsyF^@=o1D-b)sF&k1HejS8Tlo z>Ju`mUf47L+J7uzrrC!wt%Z7rjH+#X(WSCZ)Cc;_cRSsmm;bm9Y7a81C?;jSs5rKk zz-Q>~^-y}=TpwB0`&uTrK@@))r^|6&v+eLk(3Loze#znik9qKzWs&-~EYKN!-rs7m7 zp5WRJsBmOdIrhx9Q&eNCvMt*-V<%KpWK@;6*PUIWev;x*S8>w52D_lDBBSae?+_}x zMI|A^>oq5L;ugE1t|Oyr>MTLd9#NjA;tVR7IR74~*~qA>O=&KBMb$7Br)<}I$@W4u zL`Kz`GbXrC)J&@I5;oYoVC+7qjmYR&jk?gNa8dlX06yjqe_e1r94a<4+SkLXM(r2H zR}kKYse2^PydUa0GTK)?JLiC?lSKGvnqPn6$^%eMkWsZUzv=6sC_Wu|sOVf`e&rh6!dV`FrceeM_qDqk98Fv=vD1RF23o<%-`B`8t zXGEQ%DUPICa5c{vs7O&c!5Qt#qo$d2R#aIUguIt)oa#T~EL1vVw6D~Ij5;UE4pS#= z?Aq$*puCXLzD^7@>b$6&rs5>`+_>pH)H!5SB^_mg7ew`@3XhHbEnfy*fJ%joE@9L$ zMqLz@jDA<586!U}x_S{RHZrOXZ87SSsC1^{jBGpo>?NoZ$mkOOYHfm-Mctwb?~0J0 zVcjo7MQWoNRo87hS44%-X6JKM%CoNWSD@}9qw1l(x49~+JpHB%tCQ+c=c`wto+G2{ z6@Jq6eoYj=`kE%3L6fS4T!T7-jH-=8jk+$1zqOf%Pey0mADwQlw4`_?mM**Oc@rua8STrThXa*cqKet|%6Rnc%v(@B zkWp1B$f(<*R?={aM>CEEhGn=7RRbAT5$|M<%AE|KL3wNZt#P`~ZQRKewd-|9T3$r| zPK)G>NZE4P9kg5u8C~~AX(>eIuBaGxEr#dbxZy5T3uIK?Yj4y&QDtZ?c+}OL-ah#~ zs3*v%YH!zz&v0(8VziO@K|pYdWp(aD`6HuSEWsbs*8@@fH&$NveCtOfcmS0Q8SN`- z6{8-C;?<@J`J3HCsMyG8U$WyV_ej)etKw&0I{gt;R6D{S(Rqx|2J|d(UiqK%SX8xG zj#H9m4F1q%%VVg_$fzp2!l);rw$gg>qkuU#hK4Fb#&ew{Ec`I&8%fLhK6U&ZAAd?1+v$Wo}EbpNn zBcpv?%wYQB$Hi_g-dbEPPnogr1Jre7R1HaEavw!~p$bhnHFxUeyDT7`_NdUj1ei|R{?Hi%PnNs)w~p_(A0sx_YmsPJ8nn~OjDj*o=khA}#S zf$E5is=aoEe-)LO1aHHrhckcu3Uvq>RmUH!`Z~R5t(eLsTqMeC%Y&@$t+Ls7A=Bnrg?`Pf`4Q75Bie z3jPT-8yQuzJSjxwm#C>kVp8p`Z;wX5pyqpWf-|Z%)H8E_iz-bO-d{%wrt9|`Y6~)| zzVQJ~<&UT`G{sB!_kU#F1)SDK69(`c?(Xg`hr{9S?i6>|!`)qqdvSLuPH}fH?gfe# zC=TE5vzcM$YkuYWCincao6SVtoGs6A|2wPioFVn4vNa|LRmQxsZ6)hkY|sx@0aa|m zW=QRA;g;CTU&w$)rXhPDRpxAqJ6>qps+|sTCK>joIX^XVp9z54Xo99uFU^9^I|87( zb!*K(4;v7gRQNScg@Ce;J8cj9CV4wBgj3DzuT<%X)~jGKad(SV2Rnwsf?PH z?e)fx+{2=rp|)a-b#2+xPso6_eh)_!+;4u&g|;gmXGjeh=TvAYSsS5Qjp7Wc)BT(Z z1C`dzcn9w7dlH7#Mb3~qmemErLKXLWIBG=8!eLpR;S8y=W1I>HW#7@;F$|nLeQ`Ke zl{rJ|`f8`bLtXXN-HwBvglBb^Go+gMTN(jMjz$DltvEw!nBV7!P{sW1I&wQwortW) zaE8>Jl&*)7pzI04?xhg<#hSYa|RAWKezqOUj$Q_j;UW&yk)JU_)OtJV_{+J94yx36w zDGYzfD>kd|oT0X6?sqBF;gZ|c7jv1-8?QZwtjU}7kH zp|UkUs(+=qiCN9(45>B0JCy_~xtsAK-CCF>39C(#KoTz7#`1o^Xa#j9gBo{*Ow{DjsJ@ z<@EcM1}d&U*MHYPXVS0=;tZ*ZexK7q#qd9W`*oMOX<1e045`$9>*@Z}!*r}Na)uQ3 z$^HeFkO7hXw)QXkwOx8v{+lE(y*b<1DmCxe&beR)sDx(59$!aNzo?mk)qKv78a2zQ zjQ>#?Sxw*!sdV;+%S@S|GMI*JFP}C!btMz4ESw=V;5Q&IGt^=;6Vm*v+j-=y%&dlS zhR*X9{61%avfpKDuX>+Sr|+GGRW;6#O19gzl@%(7QDM!3F*_nx&B`hbXGkTV=Tsn6 zLUWizGYgj2uXH?+Ra(wiCEpL8!23aZ+H))9+1~=~tre!Dhur_OVa!>bd%6PFCAFL+bbvr*c8rooCy6u&(c+T&&J=hE(6GPUVIgY8tY8Cr*L` z$8)n9%o$P($~%<@>VTQCJq)q1bdNl&mT`vEp+rvQg<5GU!Jbz4Rz3DtUREbKW0l;e zC)IoWA32iO$jkfmx_wJ(rhHg)pkHI#*KApukJo&cGt{4}{yV!MsHmn4?7210os^}5 zSl!|bsSJ71l$ReWq#0zp75iUL?w_AkAZJMZu!Ux(0#J!e4^4C4niL6sDZnc95JXId z)ZFTBNkJ(4b}EcnFlTY^ykBbl60?rm;6_Ychz8?qjibC1n=w;7Z9hR<6 zUX)d+6O`)IK+JQ!!StIYX*M5~qqoO))d}xJX&@V#(sH%5jF& zEBhA5OeLUft=e7H#X+||16OR-wX8B(Ly19_#P?9Z&(spXalk4v+f$Qe?3Q@C6iC_5TC3 zg*Zbh@f@ehLe()drl`EF8(W@L1kRAUdex~4P%(Yguv6WM6`=aqpWkcLtf@^^;NvSoC8sJvoi#Id ze{J1Rpi)I{D;j60tv=nHsst6y423C0@BWluKUQKjh%;8n^VliVxsU<&G-r>mSW$m$ ztHkHAX#U7o#+qlE&)dDz>qv*?m3hr^I79upGTVgAR0V3Jd1bof?cY`VVii_5IYX+U zKk`+fusySy!rSw~`29@8mWB1OLZxv=#W0jsWq{8~OQ5~wUA)$;)(V)=3)mcU6 z45_Yu>ouV4&6#a$M9VLCYq09Y8B&$})@wp#^;PrOxxdzARf996a{8^;g0epkYkN3t zYpG(jSOsy0)Ng+4wN+b9Ds?GQo7Gazkoub3tlCUI?5SRW&PIcK}A5j9=^-89;?cnAr;EMHU9<5KRJ3&t4)aV3#$m6 zA+=|tTYY_~J*J1|g%@Y^@gMbB9pntD)qbBFK-s%Wdt77-pY3)7RvS4(>RCJ2Rzs*N zM%g3xagl5@8nSxL8B*^LJJkrvUK#C(jF=w9YsBgcXGoo~hm@HbL)o9Awdd#4H^R(l z%<2+nNUhxuWO`_?J3~(%NzjDVX3mgGKES!%4vx zKDJ_YnKPt9ws)#ER0T6*c9|FQZS}9MS%v2esc8PYi8fGUjj%n;`J+$oHmu@shE&0I zCS<0zQ1{Fs+0@Kk?VhA)TUNz6W0kxXoW`|am=Vd%zcx1mJGbR)LGpTLk(t_I%?HdY zvs=Bs*Bhj4$7@c@8R}1}U##)G_E7oFh9@+0bwggy*Pc}d&X5{W5yt z-me{4jpGcd*M93Aq3r3v?wt<>7u@W~>R--~YO~*j%+v|Wo>FaFI~$Iv*ojpq&X9^Z z%Np~uB~T4aL-EX9V50}gJF|+<8B!fO0eM}Z>`wyPuMh5hlQ&BjR^2#5s*pcEU7;qM zGO#ya$;ub`wJWOEis-7_S!QT{`mBPvgg(4rmgD57I*B!DjH`Pc<8OPu zJO@_{|tQ0;ZPUMEAzq&F(q#0;j98VLn>!lYfPV@!kHf0eOmGS z(7Yp91#yPdqe?*DNT`4O9?nfX-YhXQnEvJrs}b%qqoC|}jV3k=GVCh+cGOSB8B(qM zyMobBJ&mvJPy5-l3k4W3`Gir1Cd*YCO~(qs$BM(vw&%$FnNR z8B#fCJ2e67Z!=>@BTa==wT`xv?zK)$f?Drp zytSofuAaoI0B1;zwI^{i{R&mn47bVtYQYfGSdHQgsi8Yf$V}6rLYcPgrk^+*zwdNbqd7zBLmnV+29*6iH+$a5 zGi-eI8LYl>hE&eTcqFXyv*$r(~-^Eve!lzpFTYqdq9`BQ#lb(u4yrdD-o0n}S_ zP}tr6AZfpg3s}wO45{0LoLUHFS86)xJr6l4)k0Pe2bo1?S{Rzt#~N=wNdA; zZ8`?qbuU2=W&NC2^<$sUFX8&R+SMBKH#xB8!e-6(OtQ4@#$HRgKesqT{W*FR$Xf>W z#?07lkF~AR>t(D?bB5IYwoWaFifT4Iidm52M&^>sSv}zlsVSSCS^<^9%-9jTaOcp) z6|81)hE$Rur&dDM_tl6+yE3k1m5MW@qWS0NRZz42qx<9KD2GY=r7*dT2-Ea)rsGHnQr(8B(KnyS6q#+0&e9 z&ij~eaHCDECUS<<{=H6ZhPrIpvRAa_YdTcj%<3p-NY%XT)D|c^GzNML-o{6xecIgPMK%79BHJMQAMU#@y)k(qX5%|pyPyX0nW>$Ge6cJrF^bLRiod=YC7 zG{TN^zx}Hk?dCN<^6z{1V9i&|=j|1C;_vrU@8LE7%^BL#B_&PBOnaeDm{$?ZzmjYE zpV`Z56=z5_Ze@+<{Q|>Re zGo(J$wZ?o611h^IX4}@%{e7eDXZ4LUq;f3;@(w`RL(85M&YuZg`2ef@oFNtLFF6Rc z$Ozlk*(=v}9%R*rGo)(zOAbMe^;NU1Nd_Ha^$TZ6h1+I=W;zVjC%_%uaW^fjdze)e z&XAgX(5WL(S&WKk7JTSh>%kFLGdV+QR#B&pLKQPJ_DoV@Ud#=adYBmlz0{+>uRPAG7iUPVnCjFCDBF&mMr}WP=me{E zoFR4noXeervLkP&$3-X3ImzlSXGj&e=yIo^?C&hJqmlc!JCjbaD#jU7`KCE_8mgk3 z@p=qi^4Dorg*ij2zQ3hspthQZY(+iadg1OFR!uoWYO=qjXQ9kNk7;0{Y@5!qn#mbb ztL)o#Go6DfZ5p!Y)o}A~)H%m$181y~XRS*(x1=({p83b!%$NNfpIaW<#b!E>HCJ;p z-q@DQE1%~zKjRGbXTE*NVWtaEwjPq2xqmZ+4ZOf=31?U>1M)6Hbucq_?>y{&XWPY} ziZi4R9B}Fqlz*Y}eotDg?o`NIsDD&mg<5Ka-L8~la}>VHsx)UvZCzwSX1WHI(!8=qQ~n?07F}bt zi!-EZowUaD{)9^JX1qp~zg_*4RejEoI_adXGm@L?@k{<*`HXkqml4P!1hP1_Hu^Q!%ik-rpHiU%`4l(g3Wq7e9Y<@ zXGk?UZjJffg;4X%E7P2J?((=yf3a%C8B+V~rkLpo)OYhSnwc9Ky-K4etd4Mo)C&LD zc?xBpLz)-f-sH>oK4rCzGo%Xp_52J<*8DS8B{@Ut#c#HM=2;0;c{A+x-tSJIgWLXQ z^_DZFM*DZC&!O^0bzg;rTEu^O99T&X5|?%BfdSdCa!k`WYJT z-pE(1MsbEzs`^g7hO&RhHkny4zVz$uuUTc_45^M4oq7W`)ATTmS+I6U=k;$`1#^bf z&|yyf110Y>|6w(nGo(KFOWr~)GOMuXF?*l+men`TklN%gc?UJtSN1;h9jon}A(hm> zhkOqu?=#=CO3fKkA4|IJ`WMO;rR`zztB02V%j!F4NTn+6)CVYg+6`s?g*`Yh`3F`R zI76yS38y|nz429sku`>YgbHrcp+)v?!Ch_YV`x%Q{c8CHWq;n>o-^M?ThQqfREH+L zay4%f+{CI+tj_tz*Jmht^0xQYw6mYNhgUd5ZA~m`*J8di7)lfmv#>N%IXDYtdhsz6&!>1Y-GnU{r8LEzVb1czpq(jrf*nt2(#_xg_mP+ z(L~>P%|$sw{RwM#h?(qJE@VJ_^U-d}rCoO~erFY#Go;qc0`h)94Kp*QIj?c2vvGc~ z+Qb=BJyJMj52BC(8U2}Y{h~GV!dP#oew-n-#J>{`fJ$Ua&b|}4S7u*|09LCwL#o{Y ztj@E)8zW>uTsPwl89Mh_2v%J>RKQyZcoFO%2k?Ua?C|f&r>hWWLh%l^1afZ~7 z6D}7Pibms1`nhw%vI^~Ao5F@6bs)7<;h>7S886=RPIJPsI>s4N@h`eyc&Pnmf7xr( z{Gh`v!?Q}t8B&p#I~4({gP93o{+*n#;cEm|F*!pj%Lu0;LPd8o-n1<1f+MoZ$r(~< zF1TPMs3g9svSM*?BvzR?Lu#(S-y=iWZL*X7uDr;s7IB7Db$>nfcix5!urv0^o!dQr zu_&zSa)#8f19si!`8pK6bGh*2N35u<#&CwzHox^~P%+#p@XjR~t38|{)!whn=ukO* zl_>b|r|7J@a)wmYgDw~Y%D*-A`mY_lJ_f7UoFP?pzf&=xW|$c}8Uv2x-4l~lZO)MT zXP;BCpl183Zsf`pW3l?k8B)3YyTRB{n@l;`JK-VuG8T=^DnDmPMJw&viUZZw%!D@o zCJt_qIu5HioFVnFq*HOB>>1P?&Uoh%m(?@QkQ(C`Y&!Go%jJ zaBanh8f#Q!v!LU~ED__gI>{MQXSO?)0IGoLo`GJsOD~EhV0DQzq$=A3(M$=U&Y4%{ zaQ2p88r&lxtD2l4b;GacL{Ro?jCM2sNZH;i23+ z#QsgHCrZyMkTayREqANW0A&vwdkorZTn1KoI76!R2&Xba$!lCjRuwrzYH}&3GC|Q@ zccV|^9%N!QlQX1R`sb+3Q1U#MnN@qvkXrMnYby&>u-V1-7#jO<>)b4?HgSejuq`_? zWra#@E>~mBT)K5RcVvYMZqdGLvmS_;j8*c;y@n&Vfcdmt&6wqF$7bat_ntlM%oK<< z_b`JT&CE5peSUQy_vbIpP=6}>+m#Kfw-IKydSfG{N}i2XP0o-S+1!N8lpSihX)BhQ zE8BTO>Flh=bB0tme@PCgC`Lszs(zYuHFB`(%^6aWuh^E%_Z&mnr!Mx)btz?&l{umC z#rJOAo4Slua>V|`h}n?{W&bUXS0*Qq*z!`=nBPr|HCHpQ>~T7_YL1+_xIb$-L;b0e z%Np~P94fInlb9FY^vg%@=Vn!lGo-fv0p#U@YGGy!^u|S7c{C5Jy`1^~t+YU^J2{#!g^k5lj*psN`t(-=H;CE|25yhn(0~)t9s(Kd3nukBA6AK zDIeC{%M6YQdpn+n%8(Ch#$SW&+RM-U|C(=N&9*MgF7v+Ko1P^fulW~$%|TeR{oR{! zOlHBfDszHBVq>env@PybTq-OhHyvIrIPHa~oSx#t3r~@LE01 zKCB>bMG9XP!kXQ{(_epa1c~^o}3eJ!k(8H;cPz%hAIq1BMVIoc|$!Zv9NZmCVJC%ZJ zVn_oscemj8pi-T1`Nac%YjXBpty*96GW%j7p`bAk*g*ij& z_%LhC6CbE^W}NL5qIl6ztuT&_G+khxyiw*E}lI!1X`DL6xFY8R&}Kt(jl zP9rN$TwQ_HY|fAxn%m_nLfPLdWnOq6&+pD$k=1CmC$MXhPV|9!(q;C34szcd36g%19 z*jAm@ea?_toz&%OK-qJToeF-q9lZvtjhrDh+ZL>uYC_q+6l2~5d0R&pPF$1K0?v>+ zf$&cuMX4_vzP5*@o`Y` zJ#|?9$r(~tcRN)VDxaCLZG{^6qeER*w>U%UO-|LGq#8QqyHFEpH&0SkeU+3sRmHf%#3;A&G^tV zY6DiYI72E)38xxDr7|e7%^D$bB5o-Fo&~uebVYh%~*x@uRG2Da|OAFD@Z0IY#n~?nE84$zJet9 z%`7rgbF8_rd1XiJ-pEjAn)8~IafbTy+IHGZEuj1Zz&p4+#OoHU{^bm*G4-8l3029= zn9cXvC5pDYB~;V)otif5&>5kY*b4h{eF`k_T0z-&K(-Rfp1ysd6}PpOGt^cDTb^cW z4b{msWKXNHVkh3wnpHH;kou4f$ZG>t&CJ-gLbRIMuMMkjoFSDsy;E(WD*7s6qdX(p zvP#JrQbGP*Q#&YI%C@bBGv_~O$EpZtNcCOn+G?*<>vm5=v}ZM#Go;`3TKFkX*M&6_yx^Y|SIYVtlUu4(fdBIQ% z&1l$DU5yv(dIz(L%NbH#2LpNCp{kl01HJ1DW2fuRsuyQS%|7l_52&Yx*ehd&F3*Go-2DU~hzPy*K9(Af8)MKMUn+0W;9$D6p+p5hOYHM*ur}{%pG&3l=`D4oW zXSI?uq$c>IIshuXY0I9~%Vn$lcmS)ZoFSEDf@^CalszO2^pagJHEkfPRGc9dU=Knw z4T9=oURm`p_K^~UScT;bsr`1a%`_M)l|LGLQfAFCnAK6vkUH(Z;}`-p*eH99eT(|* zt|6>0a)#6bzxAO|_IoPq{yKjmT`tuPQO})K@~B|j$xK+m+}r{6~q}*qyID^ zGYyCOYLs2^g>+ZK4QDlxGo%9719>B$=t|UiP|3<8Smovnsb==@HPc9_edc34Ggl

GpGo;4( zdvFZYd?Rf2X1g6&Xbh{#oFTQ^KMKY|o$*!w;2Isqvf9WQQWgBWuW?Y>O!w?tkku*1 z#2Uw{8fQq|_1}$-cRe&Jf>8~^jVnAJs%wj8JsNdx7i<=KI7#=@XRw5|Qm;w%6D0O=i`dGo-q%v&Q@! zB2?Zg=Iat>+rl4$w!UYxN?K83iCd&nB5p_*pfF0TDI`4ql~Tv*$!c`DZ2!4yvd zvtWA1`a`GknwN8i`ZMOHQ`4Xtni;cV?`fF9tEaJ=#F_u^&ja*lrV(k(zvly&CZ5Lq znK#fZGShUdIgXq0&K|$DVLGpQF=wbh&4#$(45*rB#-4u~mmcu@3|4J8L+W!Wr)EOg zdlsuQJxCuglNBDznx!+jGIx}8Y8F%*Gh_Gr-?OT(pT+7A&QM$3E;%(DDw>(GBer?= z+u^fW_2vwz5PO}P0~Oa-FUDnSG>26<&X79quV*fl8Emxmti#g#b6H*G45_D4U0d^@ z`kC(8(b(7c!>W0#UU7z0)k99rhZ^Rq2R9$BpUXY z#`BO-YPnJ?eyrcL{HMz96f#P!fHIrK(~6%ehg*mYUOw}Wf|XGAYDRJ;lnuQW8GA&S zXU046KX284)GAilL`MJhmeo-H8-8!`u#8Do|LkE-w`OG2cCCRjA22wl`e zZZR@SZGcMctM%+(54S>vb`5*APvjrE zRVcSMWR&_HipH?#j1!T67s{0sGD>ZOqS0vkU{CRFLb;McMyc(pt)0u?z1l96D=B1@ z+5zR?czHu!?FzF)C|6R*V9O);1HBW<-dRO4|3+*p(_$x-4Mh_fJ@UI$TTPzi9JNcd zwswr% zP-8E*)ly`1TYo^=k+9Q}B;ykN@w2V$uI7=!=O4NS-agfq{nS2g>zT;tw)R6s$C^B^ z(a`3-_lvgNk%Elc%LkN7vT0!B146l)M@FfGO5M6wt^7fuT+Jhc-c+}b=*)BoijGLP zgy!mqj5}kWvTr%ebQsEf!1VjJbafB&Xk3&Te14(718*bcDv0d({LY4*Zzy7`N45Wc2@_F-VbrXb5Qc? zaE{yhA~L$I^H6l|jWjdmi}Ru_ciuooRn!G28ja0=T)2MWr^?|DW@MDQ2t~(ol9v+_ zT@=b4%g88o2`aun8Xxy>Pkl)!cPt~L)MY69KE+P4Ry}HYStxfbBcs$6rKZJ?7ww8r z?npsKsjE=--Kw4HE_uD{s!*=xkx}ZJQfnur9dk`6SG~w6^(U11fT_}ni#7ff%GDt< zN?nKYA02u>BJcU*x=^m7kWuOeR64({g{$MPzaf;X4P=zM31#chPM7=DiFfm-%IRtY z8KrJPrE(WT-gVtWpIoE`H_~3bANh$;t~QWS>M0cM<(5%0 zrF<%ss|{q7dIm-BZVIiN8uUykR~yJE^*5CNAj6v+>&4K&g>tol3`Y53K{wdXq3F77 zmpzBFubzpFKF_~^G9NI_9=2-23(=O_`^ez)MQga+%m1|XlG`dRGVb1{rrYh_D=51+ z>Dv5?RehOJqwyMwM!s3=)+=6%9=hs923@N>+x74bls((fJ=Ys}cD&_Cx9EFx&|00yDC}fa0 zU)}}3LfQRd@0e>f?eXa=l>O{AnNe+hgQ9zY0oxx%{wCUT6@`pa-=XMA6gl1Ez2Aj$ z6@`paKcL((Xa2rJ-b68e{8V{dMIob<{nAg!02=v9U2j+L!rEiTJ~7LZ$5j+EN(DgC zQQ4sPo@oI>xr#zYsSr@6o0xi?9auetP_CkoQ7R-9ZP%-M8Ipw*%2gCHN`-==b8o_} zd%aLXxr#zYsnAgA{T>EyY?~>xP;QivQ7Q~nBwzLUtzwukLb-}UMyaq+{s?=s+YLGw zRw!2+$Y8ytF1gi*gR&4MyNiqDG8Dx1ux?TVweE8VGf zo#Ke?a@C8BQgNZ^9F=fQ$q8|Ps(h|`kx?ohl=*-udXrTN;tA!d7a67EL)mSzQ}Fqu zcj61>Dh(N>5~v=2N|rHI0-;>>BBNA7D7uHrmjBCd359aii;Pl}K3tz{#OmZfRklDB2Qo^ffTHup^T(eHq>u{5fs9fqp^9LH z&G!`yE;KErR9GD{N~Kb5eSdhYdMc?<9LOk@8j79~#oJPJYig-b9LOk@1}d)K!@Z;W zWJx0xiUS!W;(c+!v{32HjJ?W!n!M;)S}6P3q$1`|553=t=%G{uX-7vBD+<1b5>OgpFwUH$`=_m8X2MJNI9MN?1YR`p?r~1Diaiq zVffB97iW?R<%<5V#h%mNk7%+SbXVbxk@R1dR4 z(RriKuc3Nnl|96vf{apuP;@M>IrZsUpiu5hS;#1rO|@06ZjFf9q{5Mc3^pj#dAD8J z|Fd1$dAlNrjNZ#RR1XJE_)$HFYzxO1GOC9;q3G#%o+b}}7c%JDz#^`Pxu7PQ znHX+?my3HiLS|H3xuIM|o1X^DaJx=!*%ppUWR%LIdidwfE}im7g`*M~^khz5*P*;n zvNrN^4;PAz9>aW4R2v6h9z2>)wuK`F88i~vUr*3~+6v;fVv3AzE5B;1d8fpc^2@ex zd?ACjy86#93jC+70^C+Fkx;TXYHk^U6cnD=b|d%0t=Dt`He_KKk0bX)vZzcPR-hh3|Nl*qf`~B z=&rk7(x&~&RFMitB{E7?g|cT+J9QjT@@iF~+?TSDQK}jg9hJ-L@6TIJDjZ+PC{-QG ze85yU$BKg0rNZ%rj8ZkA=q@Efi6}p6NQEN>8Kr8fwsPeUnp#sT)I2gu)lzLeEFEyD zmQ<*DWR$86<$vkaE4QX$v)WRj=8;jV4iufEIwYREv5r)zd1RETtF~)#K)$(kr9y2W zqf|Y$UANO+K2uLB)CMw2{i52s6T0lDUxadB%0fn|`cPDdsY3m|xV}`V4P=yR07d8C zo&P=^)j%rL1~N)Dgo^1`)V(cr&oz_^wSkOMji6}cLsdH6rIA#q4P=yRtlC<0F4Kj^ zQlU1GQK|_P9bW@l1;%V56>0++rJ6#;^0zD7?P_0|N`=}$MyX~{^!1b<Hjq)OHB>x*3~vWs+SXbs)CMw2wSkK7t2f(f)^8&fY6BUi+CrHR znEpMHTpM>xJ5e&<-X*Dj8dJU=#FSc?{^D3ONH7% zMyW1P^e(&LkO%9!NQK%!Myak)^j_~#ik{25N`=}$MyYO4G#WJr^eOa3XM`V0sZblpDAgZ|#&ALVUdj7Qh1x(ysR2-N{PRZ2 ztieqNNQK%!MyY{Nv3>PA=y?5sQlU1GQECuWOkb5uR3Y;qsZblpC^cBAG<7D`A1oDW z0~w`;s2&Df2@^a-D%1utN)3ggWBEp+FQbPF<-QDqj8em(=+1mj!`~kdlM1zgj8em) z=&0-*wM4JsQlU1GQECJf-KBgzzh>?>GD?kwqS5&G>+)G+r9y2W zqtrMkx^rkWFvPNPQlU1GQEEICo!QQPn7n+vQ0|Ky$S5@dimpVVqLkb+K`PV+GD=NU zJ#6_~#N-pDLTwQ^YL!;b62^#4^V)CMw2O@^Y1I(zNe z^vP18Hjq(j3KSh*asTcxV2V_z4P=y>3PpD*AGbstIaMmu1~N)bQ$3vDrvJ=oQlU1G zQEEC=JpUXO?)}Et)1^XfAfwa_r9$7Exqrq_mEC=f0~w`eLQ!obi1c9cOsP;C$S5@n ziq5^AV-9{dODfa`GD^*cqUx0++rRG9WZCw4d zDBWDCP#ef7H4lo8%IL!nyq+f&Y6BUi<}0;ieC~tur9y2WqttIo&AYqk@86_CZ6Kr6 z0;m{%ZB!~Z_>Torp*E0FY9SOo`|97U#)ySNxu^QbD76TR-nBi>R_ND7QlU1GQEIX3 zVY;9@H5N;S+CWCBB~a!Aru7}mEMFoOY6BUimO{}{c_ekCj7z0LZ6Kr6GAOF~L|I`&Kt`z*P;^ZxoIhUq6;h!#kWp$S6xHF~x0SoBlnS+h zj8dzh==eHX@Ko(pQlU1GQED|5ov~MED6n?5Q100>GD@w1qB@*V=ieA>q(W^Vqtsd` z8pGCS-cDL86>0++rPe{w{z|fG|N3=Op*E0FYQ0k3sttItUMkcEGD>ZLqN{nY8m*RY zkP5Ydj8Yq+=p2?F3blcZQrn=Y z=1Yz^RAHM`s10P4+OB$7=t%7^+oeKnAfwa{DDweRq%3!n?~n?$fs9f+p=f`#9X>PZ zPN`5E$SAc7ijK+>U)H?bB^7D|8KrhZ(UCIxZq`q`r9y2WqtqTKI#LQ}SoG^2sZblp zD76{fpW<(`WoqtreqI@>HM9kIhcsZblpD79a; zHL%y{?)#-eZ6Kr60VvvE5e66ddO#}F1~N(=grXy*(uwf}4@!mFKt`!UP;{hJD$y$1 zA*oOs$S8GKZP%;A5kei73blcZQb&{ubunJ@BT}I@kWuO=6rI_MM@_Nis8py8WRyCl z+6wWuqW@7J4qN-ER_GD@9>qN8$ahPug4ONH7%MyWGO9qX~G=^3d|8^|bi zR;koMv8SAs3blcZQs6mT1CxsZblpD0Kmf?yt}j*St`^9 zGD=;6qBC~bJLBG6kqWhej8a#js5YWU?%e09RHzMPl)45*Bj4@gx6jw4LTwTqQWR$uAMc3sphxabKAr)!^8KrJQ(X-`a2a46a zDHUo18KrJP(HVQg&IqG#3FV%PBBRu8s9649?vymy#@kY%Hjq*34iufElGneL=#EsV z4P=zM3uQiFx}AG!+`CetHjq*39u#fYj7nPz-;)Zpfs9i3q3Eu%!=x1v?n{N*Kt`zt zP_&odK9AV=fmEmsWR!XcMWZn{!P+Vhr9y2Wqtqj)nEq&dEtBW0++rJkxDmUwbB@TpX& z4P=yh21W1nvOF4F?wM4m4P=!1TdDXH%a;FJD%1utNID>y zVXc6Nsb5Hi+CWCBmr!(Fo?a~Y=1Zwi8^|d23W|=(;C-X7y^;#Gfs9hGq3A5Sao)XU zucbn5Afwb9rP7ywI^vB`?zt#3O8o;xN6ManiB0~I3blcZQg5MX46hE}GUu&Ss10P4 zdIv?v*PE^vuD_ECwSkOM@6~oy{ITZpd#O+x$SCzM6xGIq)_r&VD-~)38Kpiz(Ruz} z+?QoPNQK%!MyZcbbgg_6clhm(QlU1GQRMOUH}CBF{)@>At-&qa|@>Z|Hul1L98ew7Nffs9h$py-b1N!ZP`ze$DKKt`$W zYP)Wp@1Og-RHzMPl=`81m^W3y=0BuDZ6KqR{S|p31L*iV+<)>G&;GK0_w!#l0#O^t zC=~!jBVT7?>nH(Ip*E0FDg+c&RN$N>r$R`D+CWCBkV;KC+w)^csZblpC>07ShJPgr z7543rP*R~bkWnhMYU|a>u=7F-<(`Woqf{6u8jVI@8;%Mi6>0++rNTndk&-cV$jxD; zLTw0)xu6h-I@AojgRHzMPl!~C*dcR@d-Uw2mHjq&& zB2-MjhYdb{yBAR^)CMw2MS`L+Z2HULX_2HtZ6KpmWGLFpC&EN%5LqhJ1~N)TQ9YcH zC(^|zQlU1GQ7S4FRd2ws+JRApa?eGPQ7Re~?d8i;M#haM6>0++rJ}3tdbzDq!{}0> zHjq&&hHC54o3i6#NQK%!MyZ%kR8d>*y-OEUD%1utO2tw=oN|5Wzp|B|2B^aYCt38^|b? z2#UTRU}fL60~1Mw+CWCB#87l^)49*7ZHc8qZ6Kpm5-7UDu6y|+MiQw|8^|b?6pF5u zhuX(XpHwQ;1~N(|Q*A}LdU$y0++rBXuCxi?b3)PJQE$~_lFMyXU#RK4|&H7lA*D%1utN~MM}A25AN`}t~WsZblp zD3u0^?nUF3tr(O>D%1utN~Kk8HH#hGBCS-Y4P=x`2SwYpqDbh!(n*EdKt`$bQ1Sfj zS~PdUt@Ki%Hjq&&0~A%%r8KpvPAfr?!C^}LiFPfV^ zlT@e;WR%JbMOTNBrxW$dER=gLii}cOpr{Ua9R5B!i&Ur$WR%LP+RB&X^}wuBp*E0F zDiDgQ_r$?NF9W4QZ6KpmHl<>Z*w-|hRHzMPl*$f8bvQkBq-EKqLTwQmV zP4~80T|z3<1~N*Ogre$wzG&+9l2V~IkWs1>6jjvdBt6cSk_xqfj8dhcXbi_)9zMCW zRHzMPlqv&7`zvz%pfY8oLTwx6JH^ULh1x(y zsq#?fgPT(K+FV{J_goYir7A$t`>*OhCfuwb6>0++r7A+v$VW?`DSAbzP#ef7RSAmD z*zGcu+FD5})CMw2RfeJ`6<@Qo{iCu}s10P4sscsF@*mBXf2$%DY6BUiszR9uDwwjB zi(jLvRHzMPl&Yq-YuLPRX{$+v+CWCB>QHp&@GkE5I@P5@Z6Kpm4JaDMJ!MMe+mnr9y2Wqf`SZ+RJ6%FWuQdD%1utN;QO{vrX~0%holN3blcZ zQjMVE`y;<^>YFu9o2m&}l*Su?3n8^|ctT=g(=z}Se*r9y2Wqf`sk!+A4Gr)wb< zY6BUiT0&9vmi<(qe@m%Q8^|ct3X1mE+oyeUw2}(7fs9hEq3EbwdFex+)>5H1kWs3Q z>S3LuQ9`y6$~_lFMya+?RK4ZG$E(m*D%1utO0`oxJQ2_>Q#+|p8^|ctUiGkHicF8& zONH7%MyU>}htYSIOx-~$)CMw2byRI7zZIouN2yR7$SBoGZC9ASZ?kuj3blcZQk|jb z+&lNe-hVnvh1x(ysV=IA*B11D&_ycL1~N)@g)$#7^)LLbMpvm&8^|ct4T`Q`K~;+G z=_ZtWE{cp&!BBKH56C(DRj^d34P=z+4n?DpV*dNR-K9cpAfr?dC_27Abgy-}hg7Hy zWR&U&MQ58kBYPC>DHUo18Krtb(eZV3%h_qYq(W^Vqf~Fz)-QiH>)l%_)CMw2^?{<} zEA#%f`T9tO+CWCBzECuVS(=u=+gB>o1~N+ZQ`_|_;vWn8Nrl=#MydW#G5m^ZG-uNI z{zAFuqR1#U0E$NbW7uag21te4Kt`#7s;v?)SBxGg6>0++r3OL8^n2K=M#24qq(W^V zqtsw1x~61rSntSSsZblpC^ba&uw(qh-G)eo+CWCBp-@y&m-qBsIaDgt1~N(wgQDlX zr9-DZJ4`Cn1~N(whoYl$?eTBCWRx1G+A5tfW9o5Ip*E0FYCII30jiXZ{b0OQs10P4ngB&->}r<^ z%$Oh*Y6BUiCPGmi*4TI@@F{Hsvz zxhOKIo%q;J^Eb<&>|Y=+ZoY(lEX}Lklc8)VnaJqh12YARzDwu8jD+E*$hJ@$$e^w3 zoA5txD%1iqW1oNJs558cRBr2@$mq7FLDBCcN_*f%f@!iXR1`95G^Rt*@pbo)I8mod zg^EH(sTokQTz9=AZ)S#@Ar&eL8Kq`I(RpKO^f66mN`+BG2J78i*R6gQ)B-bOYcavN za&c!t+0X7289f@ap=jibe>k;hwrmS^h>Ts0cRC3F^X90w#;rXuZw|M0Nn~_ebD?N7 z3Uy8rVXkZo)r*W8jd@V9UBlkIs3U%vCl#s}8Kvecm2gngu=9m-Pi~P>>NhBqn`tlM zw#r+6lL}`xWRzL}g~Bl^XNjDx7f6NGA*0knD7t?2y8rmWLaDGiWU%G^D!Bnz1hv4- z*xw!W@!_B87eU$24iy47X)#aeMlv1($GJ zNkvAtwG=9~Ys#w@5IX--*%oRZ88sTqpyK%|^vSdRmq~@1M+S*X{$MYM3N*`X5AAP+ zUd}zNDKk)S&*FdH3Ml%`OtYr#JiCI`XPH6#zQ1IpQg;&HYPyouQ<+iQwF-*%@|_Z& z_O6oKh2skurB*|k5129+zMOcqR5((QQEClTI$z~Y6f|&+RM=z4D76+UrLTGnXxwA1 zQ0_T4GD@w3qATp+oL#1@lL|))GD@w7qO0DzlNosuvlhwm@a_ z)$B_*W^R!RwSkOMTcJ|;YF%*SzqU$++CWCB-=XLpV0xEtQ+}5UwSkOM+n~(F98=Q* z{W@$D%00(MMyc&kbOy*$K3mXssZblpD76EMu0$y|KDfF=D%1utO6`QAuYa{))VA_Y zsZblpD76bJzQ0{9O69q|ODfa`GD_`+G9NI7EHSduN`<|Q4A#51j$8d7Pz%hAy;G?aT&&z5Q1-KjMMj^o_d(GZPTyO; z{yy0jY6BU&8gG_=ec!LzI+4Fni2dBw0+G>e9e|>{uW*-UL_Q$ea!dqpTi<5+c33J@6f#O3fui$#r{f!! z9+3(ag^W^1p=jh&W}iR(s8pyZWRyCl+IoKb=AL6x;cSD9Qpcg}wbD+#z8s!(Tq@Kd zGD@9*qI1;nwX+_akP3B(j8Z3|GP!+I6miZ;h1x(ysq;|uUhh`7+eOYxh1x(ysS8k1{T_ykxU<#;sZblpD0LBvuFEU# z-2DV=Nrl=#MybnC^p5^@zZl;yONH7%MyV@MbbM{kJSx={ zq1@ANWR$uJWjSfOMy)Tq|(vFN$51`Bk zOc_6&zxY5Z)FCoTJ%pnDwPQ#54G*P49U`ODBPe>deDTbc4UeQk9U`ODW2iWO59dTY zJ^ry&s6%9w`U{HoaGqP27XBp_>JS;Fo~Z5m@~U;&CsLsfkx}X?6z#9&Ywy%}Di!Jw z8Ks^<(Q}*qD=K7sCKYM}8KwS)qGLJBimJu`mI}3jj8e~`=)FU@3;UBl7s@?pM@Fd^ zP|^L7&lI)tw--{OHjq*3B^3R2$V1CcK7J_`Y6BUiUO~n6+sc*jeBdjoP#ef7^%^R* zuWk=b`tY?>s10P4dIM!XU}|3};OHBvP#ef7^^a0FLS5MTk5s4)WR!XfMc=d3ZbQi9 zZ>2(QAfwbf)mEy~6XU#-3blcZQtzSYT3P5~q{{E5LTw2E{%~h1x(ysZUVx{QXt<_rU(2q(W^Vqts_8 zIx4#-pR@O~RHzMPl=`B!>(9P<{`n#mY6BUizCzK+uSgvK-B+nl8^|d24a!|-Jg@id zm8ri;h1x(ysqaweh#8STf(9-4E){A68Kr(emG;MQRsAU)en^GdKt?J1W-Vj@jbV=~ zYiD@j`RBiKxhL(&C=~!j=ibl7LgfvR3bla@dUGs+d)^fSs+U=2uPYPI4(=EN%7)H} zjK0E#gvx9~W(u+XW2um`EmRaTs)wPV=o~fTWB$NUQlX-dQ7W`jr?3)R+bmRCMoga=`zLPa5?R5++AzIuB&!iR8Dp`wscDm)Zb zRNR8WRl`e#ib6)I2vDZ1FfBaxykrEaP*KPz6%i`EuVR(TSumnd?&&u&N=1UgMjLr9 z@$#yXq(Vg@qf}(o)|2QvmPD2cwSkOMQJ`ova-^GZB8pU~4P=yx3YE^^uG*QihL0*0 zY6BUiqCwH|HR4e2E77DvCy-GpIuxCI^KHJlD7sV_CS;U~0Y&e>N>BN?D27z14P=yx z2^GuVuK24H-ij#|Y6BUiVnNXu_CAt+R4l1b8^|aX8;b5K_g&mSA+}KNc`q_b#et%` z%6*Z0c8ntxY6BUi;zH4N*^3fqLR_g(8^|aX4+@_&BeMDFw$|~aLTwlR-s)CMvb<(yyKU?+gG6=nDI({f>UCV;Y^%`Ya7w)i7B~&F}1x&l0Go@6hUSyO?1(nQKD~?oKmr5!W zC^AZ=hN5G6S=rNZQ%i;FMMkMKQ1Se>!tSjyHH}oLUSyO?3q|L{yGw@^Pb(Gb5E-S? zLD5m!xZ>?4>7+s(BBNA#D0(jXVeRdb>7_z#Afr?UD7yRlZCK^H8KgpOAfr@9rQ)ZI z9W|p=s10P4$^=FChu7PVT9HX8_iPy%r7|nEB~#BLnWaK)Afr?krRpW?GcJo%s10PW zN7wrMH7isvGiT4gBes=kkrm2*db9mtCY#YmWgrwCDIxEd$R8-%LPa41f29Hb=VgOh zU}o$-EApbolx*DAEs@b}Wrw2oDIE$Yo0na-g*rqAjXd_B^XE`)wLe!NVh(QWg~;f( za;ok6lw!?c&8K*ko81TFxs7Xf9Jx35!i;m4YHE+?ioB4#x*cV=F|7IaSZx@}X@^f3AWJc9| z0Vt}&s!bQJDFB7P{*x;o&H%_LRS=5K8&NCuNLWxRoB@zgs*q|cd(5;o3Q2{nM@Ff_ zP;>?;_U=xH!ar4R_Z0+Wlqv#6H9xP>u6sqK!WjS=rHZN^ZqAUue^IG$20%usVo)?1 zFTy-OQA{cv%g88IT(vc==dS+6rNU8(j8Y|_=uYoN#liPWNQM23j8Y|4TU$~l9$Qi> z94W{sRSJqm{_~T?wNjLTwI&NSy!uelvCQ+X?5eq>K9pT>OJv->Ip8m8pj4<90~R!3bzEfh{YFD58pFQf#;j^6 zw#$7j02%bAqknKTf?8mf+4EFjzQuu_0ZB#TRJkx{BSR2pAZ z?B3uFrDE&H}%ouoo-Afr@gD0-J&?|b7Zouxu;Afr?l zrS@h_^RSCls10P4>Iy~o^1rp6UcakUs10P4>ZZ0U*7n_Fy9wpKf`E)t!BDin#)p{l zI9Mvw1~N)@hobXFoKsyRc9#mZfs9f;pwjyzzdhcbI6b67Z6KpmPbfN4>O4pksi#z^ z4P=z+1w}_?x!V;s_L2&yoKUvH^U8^|ct2MVh+GT9#^xAc(;wSkOM zeWB=#9h{(K!oE_WHjq)OpHgQshA-DoD%1utO7(}L@2B`5S$6?e)%LUj{3s|Uh$3QO z2MA(|fq~fFf!*DTbqy@+z{YN|ySuPEuoDZhv6T_RTjHY6BUi7AW;3c=w3~rb2BXqtrsBI*iEUztB{u4P=xG zQ|k1;11@2vLTw zD|K(M5~^L#-h+D4tH`L;SOvwavB)bT>nd}Gs9t374v(5!Z?sxw82=O7rqI53SIZ2e zjEr85HBh`7-(1}%uQA6$%_E~`xE3lsZNa%sQyQ!_6>1(CrPe{^A@%ybNB4E6Ld_$i z)Ox7+AMiC}Q>S$6O@*3AMyYV945Vro>+vD{|CO)RTSi8y4Nxf3czLzyn%Nsng_=i3 zsf|#4572R1lFJ)Sg||aSsZCJ48W$4HsIkdZsCi_R+6=|_*mDYe=(gEZs9t20+5(k@ zR>Qr?+6h}sg^EH(sjX1_{N;S-Q1`8-LTw?dzYcCjx;iO-)lkE+wWG}mGEaCck_1j9@Nv?cw`Vin()z3{MR0( z&Q|kivWHdsL7k0^n&Dn3?&Z z>WGY0z{u#ajzaOdx9t86&5oL5;rK!ZW9_6*W{;_{R`zW5>X?jmz{u#ajzjUYp3{n; zYRAp7a8x3Lu?FKuo9zVDkoaFEJh>%&0)9fq8ewGgSSO))e}%edi#}3qVGxGf){xJwAQ3>lstwNI^!a2&inN zejU1gEW%VcQjk&VEEM-`oFi-(&zcHH3NlKagUUx^B|qL}_&HOd=8;kAJd`&nTlQdw z^QJ=eBBRs=DDKW(pL@K=1yi98kx}X*R3RGc(BAVGE}9Azg^W^{lM|6TDt^2jo^?uGHWg|E8Ktg3ao@&&n%(j%hO)Z)$S8Fciuc!`YKJFYH5F`}tZ6Kr6Z8gJ&N1ck_HWg|E8Kv$(@#nCOy~nn= zV=B}JGD<~4WuO@bRi3yq(p0DoWR$uK#kH|8W0f&?4Q2J`kx}X%6!&`%)$yNu&s3-l zWR$uO#dk#8{(CdwzNxVLkx}Xa6yF~{d;F%<15;r~BBRtpC_V!Wud`<3LsOwPkWuOp z6yMwITljX#BU7O^kWuQf+OE&8MfyHA6>0++rJg|X8t&gRro$6cp*E0F>ZzJxZLemf zpPCA_fs9hmpgg&HoA|tWW-8PMGD(T`uKwLs|WKWR!XVm5x*jhqs$SCy=ijS0XwX%MAXDZYoGD^ij^`f!v|7gB4##E?7WR!Xj zvRg5v58 z3-zk<$yBIAWR&_0#m`^U`lWC4*;J@QWR&^>#b=wxW2O)NVk*=IGD>}g;{CNhmvi)2 zQ=vAHQ7RS+8y&y;F{3VRi8U2!0~w{hLAlZXay!?$-#1gCHjq*3yHfu}94YnPRHzMP zl==b1YdFE_dA}c~LTwFbNyKt`#A ze=y805m)cNYd^CjG8JkA8Kn|K@m{X-uZM49Q(>8qQOXXAKWp0@_4%Kjp{&mWkWtDW z%7tpaUx!==>`jFYMnrv*-?LTw0++r824+&U488Goz_c8^|b?2`U$jbs^=n4Dn+m^yj8a*l_*yxp z*|O1DO@-P(MyYH{b!-uPF`KDS8^|b?9g1rsq)6XH*-eGoKt`z?PR7q ztnN25O67#&r|g{-HkHU}D%1utO67v$HQaM1WN$80VMijPRBou$@v}?#3hNVCE4Qgo z8^|b?2P(aVZ0m;>>Yv9{*!{>Tl@}@lsk_(QR^~MoY6BUi@9lHW(SD zJfPfYtXvDHrSvcrY6BUiJfZmd6_ReGgQuymBau-mKNQ#Dz(XUO<~J2;0~w{fpwiI{ zi{#JRz{^lp4;C4vyrEo4HGTc~nzyM?8^|bC0E$<>=BVn$3z!PEfs9f%64m3&{U`mWRxld#jCO8{;9)-OoiG&MybM3eCKfI{H3#nO@-P( zMyVoDyoNiLe4SjxRHzMPlqw3v*X8a{3*;&}Afr^m-?wC!i1(LW)UGw9O@-P(MyWDN9f?J9xO6SRe<8Bo3~qbe5+t8)CMw2`9txYUdZ%!jr~o9+CWCBicoxY z7`7!~ctum8Hjq&&0Lq27>*DNLs{>4h+CWCBN>JPv{l2wVwo0Z#Z6KpmWhlNn6l=XP zrn0F}8^|bCMUC})QR#P8OoiG&MyaY$*y#9etI(}hqpGGtZ6KpmHK^>g8n;&;*LvssY7Uhff2pG_GMP)CMw2)l_3O$-6P6rm0XH$S73{ ziqE1kd23~?WhyKaGD_8kN=K_PY|Z}ewM~WEKt`!LP<-wkmeu8S9aEt;kWs2G6rXz^ zts2~^uBlKP$S740DkshGoGmJ#o~ck9$S74G3Oh4icCNdkL48x9Hjq)O0Tl1AXPs*d zY+x$99WqKagepffOk8f0PeVgleNkkTY6Qh+o2nUV&TV8W)CMw2HHP9f{IM)qOk-2w zH;_@P2^4l_{4AXo#-?auD%1utN;QSzd$vC5Z})6!D!d&sN;QMxGeBtbQ#qTN3blcZ zQq7_GY4lO$pb^bYh1x(ysX!>cKg{LRXm_BgP#ef7)k4j1)Z^#d3}y92kx{BERQwP4y68SQYgbdDHjq)On;PrJ z-%obkOoiG&Myc*lyj`wy9?s})D%1utO7(!^I?Ow%m17T6p*E0FswWiR_l7-b7}C>J zs10P4>IIdSR^#uK&0~9+3blcZQoW)0Jl|qs?h?ICh1x(ysXkC#hc~BtIQ20VY6BUi z`aIUkWp$B6xaN2m$;duOoiG&Myb(ihACHN z3m9!G)CMw21w*;%q&GBQd{P&0gYaqR2~rovuEMyU`e zUX9e@sh5P93VRtDr6xl0@s%aXlvNW=g}sc7Qj?UbxVqiMNv6VHMnn> z6>0++rRGBM`LIIWOu6Tp3blcZQuEYyMK^w1XP&808^|a%ABwLjwY@#t%{LWl0~w_j zK=HM*bjtI73k+p-IFV6mArwDlJ55Ouv(Qwi4P=xGgW_X3>&cB(!%T(RKt`!WP+Yy6 zUf(;l$W*8eWRzMA#VfydUg(U)rb2BXqtp^8Uc)t6U!-4RD%1utN-c$QrZd2gXqV(m zO@-P(MyX{`e5Cw0WX-*0rb2BXqttRJuHKN6?WQa@6>0++rB*=kYLuGxe*Fqlp*E0F zY9$n3Vb>&Dv~{JStPUqKO09z8Gh5Q4k_-n7P4s10P4TB~L_e*UpMYfXjPKt`!`P<#f+()ykMI#Z!GkWp&A+AhCZHkb9L zLTwx*W6orpG-eM}$1~N)*h2pbK`4bEF zZ#5Na0~w{ZLGk&pZ2q4ewwVgGfs9hyp?H5C%yO~Yc2l7?kWp#}6n~<6?dbZRJ4}Vz zKt`#ZYOGVer%m2zD%1utO6`K;qjFS>VO4gS3blcZQoGeyB^|#x?lu)_0~w|EK=H~u z#5RcDV<@Y`iHuTvq4+bz3q>C1+iNP+1~N+RgW@w=iJZr~>@yW=0~w|EL-CnyY?6#V z`%Q(~Kt`zpYOLw!!ZIH)6>0++r4A~U%4tf^gQh}lAfwbFrNZ44e>r3-)CMw29fsm_ z)S@A8+Z{F)Y6BUijzIBM&+%+t_aml4Z6Kr6Q7GQaZ({yM95oec0~w``sj(KNv!D?}+~yD?-LfXJ*uPorU6luUD5xwa=Pkp$?J3Aa;$cvCjR^Sm$J{WJX4B z*Lf)JA8uPw^Tl~{EL1NtYK9lo3=1!xTj7GKP`$_~brH(WnyzjChXaEznhMp6j8d1N z`0C)>I_;H9hO&CF$S8Fg%7Mn3bGrM9%ces0B7=kzH8rn5EsuXKVU`!7i!HnYl@M|@ zGI|ZKLh+wo+|V?#_f>N&)I2f?Z)5A$9RIUjld%$3zi9pOC9cU>eT|GB>pGOD^%k}= z8^%OmH^;(}f{a>?8%mAO-YDRPsc@tqqts2P`ZQLzT%KERnhG_Kj8eCtDw7J!S?0icT9ykL`JDdDE@x7J;~GL z5E-TJLh(7O<(o0CcMWCrdy!G<9u)7dL-S{iyJsrYAu>wchr(~huSS`Ch5hcE3d@9y zQV*c~XysR32-xz#RHzMPlzIrotC8b<-OUe8h1x(ysYg(JA9d#Q@Y|0}h1x(ysmE$8 zU%zgP9-9iafs9g5p!f=FebRLfd<>lv zqM(+?zm{<2tDn5+_$X16j7mC}Q3+$^Ei=gJwWwetqt9$_p!n*rFZt!3Z$$O0CweoMF z(puBC9cVxB+*?tHb6E-*rJ|v%S=(&w28SPs7S)jcl^kT0dI!b#8-wyVIJ^_pmHze^ zWR!}5;y|%5>?8~K=s;<|Ji;+rHL=Z4Dm1YsW!L4Z&3ry z4B|U0Sn3bdHtQGo@sFr|W=8GhzfioF4_z9&^RKAE8LhpHj8gxg;(x$b!-|8){u4Dd zjir!LDh|q(RCQ19d~u>WIamrAr4s&v8oNY%W}E-^#5G$=D{HfT{6}w=kWnfT6rb5n zeVMyCk*GS~EQO3xiJ>aQ|2E(ICKi<8rBXnpx29`5F(GBo6r#2{Sqd4YQbO_frf%9&c1lW7lag8r8KqJ|akpn)!DRNS zL?xp-L`JF9P+l~{h9TV+rWW;Ito1T7N;yKMAvNj7vN%Uk8H(5N zsBhA)nMLjKuoN;%Wr5=3Yp(ym?^#4O$ZjcQlyZkENZU0n+2ZQ%qQ1LY3K^xcLh)T? z`R9H~vWohV+EU0Ul})MT_N7{66BT7|DP)w&4#oWq|I9Z-vWu$s$C@}YO67p!XV`Ck zXZ&-By8Ojb$S9Q)3XiJsk@lH0R>&!8LbRojQ7RV{S8whdbC2Z`b@-X3kWnhPnqh34 zk7;v@no`JG4P=zcqsIEad+_EwqVDCh6f#QXh2lQ}y6#i^Jb6V0WwR7AO67y1MMe0i(;PA^eOsWy;N${Q*V&9Kt`@+rJU?RsmyjEqtRpxj9n zA5?ry0a4LUt(TEe$_I+iQ78WGtmq@^WI=0xA%i#g*V1~Qf>3<6NqDWGC_8#yMn;WQ z2#WuF%AUcMLko#YOBIETQiY-Tt}@EKO5(zzwq&(th>TK2pmJN&wY_}exTc7x>gg?o zj8a9Rij(pR@>yF{RE<=YLPn`#Q2Y%0ux8=@#YEM#vlKE)6^G(GqIV&!yA~JK^_MjT zWRxla2|BMs0w*4g^W^Vpm;Bjx_$p@8Bs6Y zErpCyeo%bRcCh*0ZGNH#yI2YtrOHC_l_+rCnQCQ4@l!f7N|l4+XO!7Ro8BxZYHVU_ zEM$}_55+ybwgu~ND=%u^PitwBQL2I(D>iV`#R{U@f3g%ZO8G1Z$KUTM2oQB;d3*2~B!6#&KitJ+%s!2zN?sWy;NsuC3Uqvi%=j;SQ7cOGjE zkx{BL6dx(qudn-1S(FRa1~N)jf#P#-=EyE_RYa{xXN`r7QdN~2nYUB@s-nE;$r%}? zszLFUsB%!54b?<#Ph^dSj8fI1_?f6%o8NKOMV+ZFiQ+^hPGI--u8vtC6;sk%_y2XN`XBtuJM z^+Z+7Vku;h=sVB~)`vP4|BHmS-|UsW@75PJ*vMGj%s6_bfsAFnug%r~Dqv9mo^1vU z=$Y`|2^mXmCe;v%MM9<_RJY#U2C_m%ZC4{GzJ5j5f6=p%%)nu1sxcHl1yqWi zcdxOi=J?x!Y&K++Y68V8e?8UXqD@3SroVs<8Ks&+@%3wZ$#XB7iu(LLVLNR$WRz+K z#kJu+=;EqoqRxJ>6f*efSAXl3=1>V&2VTeKqJEhf#GS@kDiG>e{4Wx=?eO;r&Viy_ z&5W913n;$(+Ei$IbPG{IudH`Q20uMWd$}dlkoeaU?xjYy{n(+UsN+UPf9}u@4f@v4GvYf+bsj2^2E6j#*Z<$oWw5%rvU=E$hkXbZ(x zhZ&Eby=p6}4z<#eQK}tOJDN+#`W>~~iCRXVj3A>_d#Ki=O8VYO*Ira{`eXzdr8+?I zz0I~&Nt1UFRf9emK}M;LPysYn*wh|FI*Q6jpNt@*R41sMq`n>N`>d0wEpgV%$SBnr z3Lh}WM^a}g_@%R`#B`(}qf{3t{tm9}vr4z`A}W&lqR1%KRc)6`rQrp-iYoTfnjtbu zb%VmklJSv$KN2iR!x4Uti* zk5YLX&B)$IR3Yk_BcoJbD88$#(s<*MzM}q6uM!!h`a$t|V_=zWas5OUjk0Elj8grT zx?832(*B|n(OyPIsR3%cMonV6}m)Ig~CAMo|Eal>{4MLnZlB{E74Qpz<| z;jlrXLa2|8j8Z{RyoSruKUfwdDwO)z$S5^fja6V^y9I+q^`JgBGD;1BvZL*KSo_GL zA)?;?wO&R>si9E(#If$xfZ{_%wWdBcGD;1D;wzDT>c$6#iONp3fs9ha)mRtiuZkHi zs_6@BhR7)O9~9pMw7+}f#($#nP#+r^rA9!-|A4PHuBRW55H*nc*vKd~QYqiQi7Ss3 zm4<2q8Kp)kwQl>7(vhywUGMQ z$S5@iiff~8+d_lJh;pRbKt`#tN{!opYTj5;Q@>g(i;Pm^paN;-@2CISZk(t})W=3f zsqs);QLitSYB^ri@aNW>A*0j;DDJcQ#SG3dK~#0>VL zQ=rPz%GcX?m1wFD~u2YlrTALOt^R2cQKkx^=?nqiw0Id?4;m0TW6khfTWhSdw(ga9t*9E*)kj9Dbx`T8fo)Y!&$O)*=WR%(n z#bO@_AWR%(l#Vfx)e}?kgL=B;?J~B#e zhvMqJeSJ#b?V>7CS05Rrc0jq&cC|R^cy))UKd-Hqkx^La7n9w=V{FQU}#`{aN0n=|NHbsjH8SQiq`UGmddtPhUGEDnHc*GD;nW;!Z_e z>sp--i|X;%njtbu9f9KK+_PKU5<*HNd0+alsX3G zY$4mhf)7U=6P2540~w``LvhXDt+lV%aZ$Ue`;ClJC!n~ZJa6>Ba6(iW>V6}m)JZ5l zA7&i9-SecVIiMmNWJ!F(R4aNP#OP9-CKP_qlb-$5O>I_tN z8Y@%5*OktQYWB){85yM_lzQLc(3c2N3#qq^j8bQz_`6IO7U+56tf*boB}PW6b5Q)r z#m`<6^_%*K$S8Fgia))b>)1T)FGD_Wq;^$?5m-2saids(J2aAkS zx1jh=FKP9AakoU3q24kwO5KLy>b-b#rQ2;$^{BUuj8b=?iqUr6D?PHq9Z{ZC8^|aX z3B}hhm!@Z@MT*)*y=7#Sx(g*0^>=E9yQ0!kZ6Kr6Jt)5F6<_b%=$@!Y)IUTTJXp*(2~2WAVZ`A}35>MbLq)FUW< z;%L2lSAj>OE>r&y8KoXWaeu?dzt_&kq6ScJ85yOXK=JKRo05BS=(ZFkORqApVZ5E-SOL-E~LX`dqno{OpwYrPjTO1*&M z)%fN*|KbZ#iK#Y_Q7Q^5AI(WXoj;oJH2}?>NE8Zkx}Xm6nD&q{fwLUM$~-jEhD4UTPVKY zs2x4|`CCy7sJD!aQqfR+rMbLq)F-I;AMh19b=0L#qJ~j#85yNMLwS+vH?8Za&!SwZHjq*33lvvW z&x+qGeGzq#ddtWt^%aWGy*+bftov2eA?ht7qf{&uAC;NEFA0tnwUc_w$SCyL-*pt$fcJ z?MD0*HRYN0GBQg2g33>7dfpBveu-*My=7#S`VGbR8;QCnzWrO&4(crI5RA)IT-DDRU+y{U_=zb%~KtDh`TQ{$Tw@ z*WyG)QJlTPR1&C) zv|SncckY@*)D!A`A){1MC~s2hUOk9NDry3CiIGvt0jfNyp{aBDI*7_ZwSkOM$)Nb^ z&~RdwCCNnPq@N+9RB|X@`M++XWzpkYaRpOU5ab%QA3B^xs zt-l2YrWBQ!Y6BUiQbBPaAk#e0&{U$fQC}1prBXxjoq3hEt#hRo_34Q~nN~M9~JEC0k`nF0VY8UlIkx|MSiqCAm zFZ~8Oi>ge0QDl@#3&s1Z)A$wF(~7eGejJ+(8Ku%ewY3(@cCv4YBBJ;?HgpE&A{yv#0^o7ez*?EKppBvH3Eu$|B18w>E7yWR!A; zivIy$S#m$h>Mm*&^+l0UDk~Is5AyUm**vSLQ0j{!qf|C1zQ=Af@LY5@QLR5(GeAbE z>`+N)hVD5+S7aCEO0|KEQaO}b7O;AD4pB`XTW^MpQaPa-7ylL9B(JD^)E7lYseDj;4^SvF)<2)9&D0k~Mkx;{K5xvZU2M3AsAJ!)rA0<5 zPbfYgI*y6F?kQ>>^+l0UD!)>-QMG#X?4@!cg1^Jo78YrLd^~;;c7AMyVoD z+~JHWe`QAzQCF#pg^W@~)pmu2E^Jd&)Y|vfSjZ?<42ti2tCn_JUrbcumzF|Csp3#Y zXf^7r7*w&is8iJ8L`JC+Q2e~?)u66V2~qA|)?P+NDPO39G*AP&=TwCfexlA(KMEP8%0lrSQLkyyeaebT6lHBLGD?+$;_Fv* zouC2bL|vhN6f#PchvIWo^udMc%ZtiNy-H-1ssP2c5jeG6&I+OqP_GghrTn4znvx^+ z>B|11+EA|&8Ko*h@i}Txa8TWfqS{ig5*eiep!ghBrpo)}0isG#uM!!hDnW7QwsFL_ zZzs9YfAT1>wZ=iR(gF8cV%OWR$7}#rN17w$Hv>OVl{(RU)HQZ78n!9I46$ z)E3o+dX>m1RR@aidnft^WUM3V!5?eokx{CyQUPyQT(2uCkb0HKC{+*2+j>)5*5^yl z))STXo%J#@O4WzrbJVR9gZtDMRh@d3$SBo7jdkzB(6J3fWuV$XMyZBSdnWfaHfsIA2qh2L4N;QGvr)*o1xRy;s zt*2fkGDm1)kckVCvHovHll7( zKMEP8+N!aNjeMWDt*G1dGh~!%2UVKZ@XO;YN85?IL;WaZlxh#f_lLgcd(Lbx>MQl5 zkWs1w6rZstwXAufgQ#PlttlX*R7WU2Dt9-i>C#bD@3)phMyXCp`4$?Hx09$f)T=~B zsm@S#v>MGPmFn7A)ClTTBBN9nD87U36}Gx-7f~0fABBukU7?cESS#O6FV|I6f9h2t zqf|F2CsO+}mub*VlpWOuGD>xa;^V94){^VHi{g$OGD`J;;%8Wo$X-4@L^)AyAfr@I zC|8=H`=tvfmrV)S%Xm!sE1FiDIlX%U#Ju`L-!Pi-TI2!NWDsAlF7qy&vmB=VH0E+Km-I_Su9U!VO^(v9U`;IDQz5PI_3h}?NkNi07S#|JepXB|N7j9GOkp2mKr*s(_h6ya&A!Br0L7RUZpw2olxb%s`c=R|bnp z7%M>y7FET}KsBOQhKNcSD=gK5-a|ySFf&kN>6M}XqlSu_Y-ZHT4};=!)b^(1vJDeu z{W}Ua8!}1_hvGAUZQ%Nd;iAe?zZV&${)6J)SBszGj8dbZcs2gC53f2(RQe~@n<1mrXeb97tJ&Ku zxkih6PCY$jlnRF8Gj?hFz$U?>Jm~mBMyWAshD8?!FBl{0GWGP3QEDs{f9`N^VVVqM zMYW-RFEUDvgQ`Q@^=W$j1>;0TQBMyUrN%=gCADGnzHj42^`L$)GD=N=N~rgQuc7wt zwh~g})GR1o`Lahp@17-U4E1}FQ7TlakPf>VhKfq@ z%Gx2wC^Z`@CGD@i&8`)jEvn`t>t$q=nghi(->_Ku8FNHUrG76mO3j7hl`r-4ea*R| zqNo#yj8gNU_^4dnX!Z1YqAKLFY6BUi=0kbYc7=KecbYHi19bwCQECBHc~XAuci1fu zWlvpVWRzM6RfSa32H^nJW8_kx^jy%{n}ErA+GV>NjbR&j}__fgi%$SAcGifdy=yIp0L zike1UVq}zB2F2aEf;EzyT_!3y)dn(3Er-fOGYsq4tL1W0L#RuPj8ZG0_|Dv^_qbCl zM5UwJKt`#RP`rje$1V?FDawPo#KU(Q86zp zg^W_`m8ze2@a6TQ4pMI!8KuIZ`08-Ka>xGRqEb+A85yNEsIkhow2#;zYAyAakx^=+ zQa9&rdbd$jP3kQpqtqs)T17>z*(9nK^_G!QYO_*hKjv<|SyUeCEhD4U7NwS6&Jeam z)N1N2Bcs$-rSh!_KfYCz8`TCfN^OIR{{deY4%ce2P1L=2)~m=UwH=D@mfgnQ$-P~a zGt~w%O6`E+Gux4BueM4hGnAu>wshvNIgze|_x-7l&N^_G!Q>VQ&vu6fQrAnG6W z50O#oAQT_VozE^@eo$0#>MbLKZ5S19ZOS1i-pe^Z2d+9KYJ!KGL7y0SD0Li)_gBqPuQnYQHHSLV$S8FJitqGtIHnnXLev!MNF$@vNi|mFp{@QWMcJsL zkWuOs6xU(Efvs;(i5f{AX=Ic-4aJ{4hO9Z7{In=xhg}m!Y`kYn5qm`m(4^)R9I;sVh*thLa{_OL;|9;9Kh~fs9gDq4-$N zT_U{ZRZ+8^S_&DZuBjQGsyTnqHBsHDBaMtw*VPPPrj8E0E@~fjq>)kThEg>*W&3c`%v8d zZqXug-F;CL-&hkzMyUsCyQvM`Lq@4*P+p|UJ#=gGOq3_p1~N)LhvKtM!yJnrJs0Iiom*s-dI7~} zn=zvfta%|S8Px_dN<~3&MK!JSa&eTXW3R1=Bcs$yD88#))8$dNm!c9qu@o{&y;9q? zV#U@KuS8v;?i?~oy@v9kHSFfG;`VD%E>s)HDD?)4@64a4UpDoPr~}lwMMkN&Q2fc` z*8vAty%klHI=9Fu6%EB_>@9mnRE!pNjkgJPTV#~_0wte~ zPH9~Hi>TMsxkW~)uTb29xgH+8>Z_=s)VW1QsaUAIv|WXQJ70+v6_?D~E@Y6nI>ZWo zgDM&Si-adq`=Jj~e-m}b%&4)xtL^HTzU$HNqFPeF7a65~K=J;X-K0^-4^a!gTk}Ci zsh?1M&sJw-V&|WtdQ-m_8Kr(f@xAEfYHic}67}t+H5M{T{Z=!)9o{VMZ&AL~??pzb zKWc`9?bEOOBWeisdy!GchB4SqfIO)RPr^?Q*~$_|QqDgKj>C9@N?p8CDWC}j`DXY5KN+rP0FHS)c+ zxyUG$1d8vY(%wn*D2b?hQIHS7#XEfK=H9`KXJ~q6r$p& z6NrpbDWN=RhNmNK$5V=Op^8FAsZ>yWtsMT{K1V81G1Lh}Myb?LyoR&)`E5@vY7BLW zkx|MKiuc!%WPzC-MLmhNCXNh#ddJ^-#R-bh*}wA zy)!aOIYSk*e%qF9)2ZgpqVB%1UPeZ#v{2k<>%1?tL0VDksJD!aQt6=hy4-!z?v3e0 zeWU&%GD^8X@n<(h{(hO|A}W-6%g88|9x4-U*Yn?Y@6(I&rHVpEDOV_7`IBQl?s64X zl6uR?D3t*!{s(+Tcd@^pL6kF96f*ez#TBfa8&twna#=6f+(fN1Git1iP<;2*x$TO_ z8AZ*cjx;h#WrE_fP1OS{eq|EnNOg#eQkkLnem*St>aWbA&b+fGjf_%R)L6+bH9pV( z+LF!om%5I~DCMqHikb88xXV}3!!#R#BO#qL5K4n^MmUl&X+T)E??c zBcoJyrD_aYo-ezo7SxeOMyVW1)eTJgCx@t()R9I;shm)}m#0R0X3r_AJawdzQ7V^G z^A1Os$R%nQ^$(FzDz}>9D8YR1o!+kx{Cs8f*D%pASVv zC8OFvMyX%*2WEG~*agG5HD5=vFsP~<`hQCq3EjEqvg zN@bmvBek!ni`3IYMyZlYosOJ;wxp;9)LTYIsZvUP_4R93N>r7%)?P+NsnSq=f5Mm)6?GD?+!;_u>itMX@H8BvX?w~P$lz=Z4Ze5xRd{}v=Bx)daiIGvNGE@#4>-eYJ&Xq;&eqz0hj8avg__=b@ z@J(@5M2)2`F)~V3h2p-=_PN#eR~2=gI)TV2RShaD&2UuX!*10?4WTYEGD=lfGhF68 zZ*X-{$*DGwQK|-1Q5tLiiT)lnM2$}oe~TLbg^W@))mS;#A8uGvRC=lnWR$7}k)xS~U}OkGjOj zDAgQ_&umjej=47%m6>V-8KnZD_&M+3lKv5aqTYC0wSkOMEug%q=3lw*NYO%6N$L_K zqf|>MzCT>q>|3UmqHa=`7#XEnLGc=1o>kqUm8eeCB}PW6)=*r%nF^e2)LK+Db%~Kt zstpvc`~zE?ur{KqQNI@%rP@OAv793I?yqQok1&rP?c1 zw|>&C?L|GKelIdgbxMRlZpFEUDXQflgti*GuK zI!yguWR&U*#m^}&$-O6Z7Uf3$USyQ&0u}!QzH0xQ-MNdX2dqm9cMUjVy?Zw(uHIGkZ;b9Hs)m_SV|9n(Phs{n&y}USsEyPmMn*o7rnXJx z&W!3UY6W$Pkx{A-6yFg|Z0oVMkEl-6B}PW6zEFIQTI@-%CN9>g$qE5fCUPeZ#p-@>#?a91l(oj*esdI~rQp2DENX@VE zA!wMWXVhmyMycUYd{j2CbUE>GQ6s5yi;PnLL2>ntzjn3bf1+|xZ6Kr62&iH-!~3bT z78@ZdH+622QEDU<@8zCdQw5F`^_Ti=$S5@mik}Ww<{me9l&Jrx2aAkSqoMe|_u=w! z-MGhNv;F#NO&l4ef|dHwy7!%687s1`rI1l-3{+ZLjTRA(4abPuL7iJv(H4cg^%E|HCu5qH?P)`pTrN%??-SX2-!NKE2?WKM%GD=N=;?Eu4 zuX>wrf~cfahsY=u0+pLqW5C{*NkT-eq<$|lN==0FCDm$qgF6#NRi%C}GD=N?ivNHV zUp?zLT{lToHR|^wqts-zT^~bw7Mv`~i|P;=rKUjfnay=c>2y;>EvJ4jGD=N_%0@GM zSoZ#@siLw{9U`ODG&RFxO)8w2Ch9iz^pH_%Iux&bu-$v_>7r6oZ6Kr63@EOsD(Nbp zm?7#u_4JTYY9>^A+OAIn?aIs)m7n^($S5@nijR~ZWg=r|i8@0)J!F&$h2lDV8rCT` zR8$Y@_adXzY^7Ru%l~S&D87e4MyWYae2%J;D9zP5qB>B&7a67ILh)Tn`s@w1%oP<$ z{a$30nx|%X@MxRT^F%fIVl6E)O3jDzpp`GZt9QVBQT9|D$SAb{ik}^h9mzU)fv7Ui ztT#hOsfAE{RMv60P;jBBfuQ@puiTX<2 zIb@Vt48?aTYsb}SzgW~l>h~g})DkGZIuvnuSZs-?F#7HaWRzM8#h+KEeCOM0si;NN z??pzbWl($u7?WkJ!!l9(epxGzj8e;?_}QVO%jtE?MUA6=FEUE4fZ}shfluEquMkz_ ztu+=hO09(AGeG?(eMYVn)$OUJkWp$C6z}D>mv>}aCCZ=ry~rrF8j8OkVAcfxN2^86 zq|PleO07}bHMFfmr8S~TP;DTi)LN(#)&|&8f7o7Wt*8j<&LN}JI;ec4di9;`vQ8BL zyBEkPwH}Jkhg(OV&9q+B4eHJzqg1$3>5CPt5H9K^b?1;#Y6BD>DfRC^ZM{L%4(i+@ zqtr&I?6h5>0e^aJ6xE$Nx5y~935x5mWTNslHi_E!#CkJil-dl%_oAm~C0(;wR3GZx zBBRt6HA7p_5$7$Uj!<_F8Kt&D@pmkA{!?beR#6?PbBl~p+o1SJ8T07Yq-~;NsXK>^ zQrn^U`}B%r{&;u0sNvMPMMkL|Q2hLrvfJX9J47X-+CWCBolsm++e@77uv3%^)dn(3 z?SkS@D{3DpePoxYC)AxoMycIUeCLomq;$XCq83o+78#}XK=H~y$aMVt9#MCxJBN%? zd!hJj)1!FLeS1Z%E072!g^W`Bpm=}974~=AC+Zz_=a5lqKNR-?!lTZ--!CeZI=9Fu zbpVQ2zE+_ZOAd(2MYVy9QU{@UHL_KI_w=BsaO&J5qtqcNzTfb8_$c_0sDjkFMMkN^ zP<$2*e)!*=!=fru=N1{Ij;OIpPO?96M3f`d1~N(=g-TB6jZA;L%|0sX%q#0opE#DUj@W!k)E(- z^e)dGX@5pkU+Tdkqf`V`X&S5a->3EwqN;qbUPeZ#vrv3*v;D+|OJ_x0rXDOZN}YqU zr?EyjH~VrYWn`2(55-TuXEHZcJwT)CDzG;ZeSQFNg}K9xO6SU4-H* z(f!nm4qg;xPd!*V&HKA@QGD_WmN=d6x#J*Xv8=|IBHx(JBZbETw6fInI-c3<0sGEw6Qn#SEi?w>= zy*{@@U7~I(GD_Ws;yb-24pqn97Uf6XRAiL8qh=U-Y0Q{AqV7<~3>l>&p$gDy91CMj(23e(g+u*O|cr>UEYj8gZY_zW<5Lb1B{L zPWMIai?tLoNr3^2Eb20Kv5-;f2^7~x@+8e(KM~cPx~a%0^;D@2hXy`= zD$0p!0~w{BLGfKm(OvfWo{36BwSkOM&!PD05HMtA*XN?%P!|gsrCzA9+Wiix_d- z>S7_I)N3d{Z;V`2B;9LKtEj_?j8bo)_5wRs5X#M z>OB-+%@=>kc<8;Tsnp>_MyU@LXM`s;D{9$CrE*b%MHB$SCy* zil3yq*rq)FBzt)Wt$ZsV`7`)%&&}w#gS!u2dVyDD@SJ zt2d~4T#v7!c2I{C8Kq*Oq@vypY!)l3DRnrJQR*8Me}8Ys+_`Rj6V;4om6 z=PB2A+jmiQsl$nkQa_Z6YU;k?hp1D(tv5qPsh?0>^Vjy@3i>IkB6T>CQR){I-`n&r z+wImbQ6H&`g^W_ap}2a_Re2ElTU0)(4P=!1167Vzqw~xacmIg0L%m95l==(B*X5RZ zuO9v@>Mix7kWuO%6yG1-@Hue!pQ!QFt3*brIH)2t!+=D&9>j^_zmE?Yr4s%~pj{%q zgLU}5A&HI77B*W5^(v83DiIWKSB|G=4<-_|ntGMUD3us0ewz4N>NL zc2NAp@isJLHak&SX)hy#cRfPS1@=&F<6ld-vpiePqlvw!(`H7El>~~f4mmos`Nv0g?-sWedBTb^(v4lND)2)uRq4GD@X`;`_tDS1S}sC+aD6v5-;91b0~|bk<{TtMk#kFuBd8F9DUtI zIZQ2g0wx!Wh~vx&+~wSkOM*`c@x+upT&$?T$h zsKbejQaPab_^Mf|w_6TTJ6>7)3mK(yLh=5ZF!5zXPElVTSqd4YazXJu+qF3%OLB?2 zK;LDGj8eIw;(x$bhb>bc<`$KP_A)X`<$+4L;w5}FUR(8e9#MO!!-jVL6_EzX)aGD;PO;%A4OQztemEGmflhsY>Z1d7+NbI>KP zBBCn3x5h$7siIJPKmU7A;x$D@4W<4eGD;OwV^w~1_YFTK+iX>-e~64y#i6)M{LwzH zd~q3TKlKlhQK|%#5AEgJMdn785amJrLu8clh2ryk^pNUtzM@W2j|ds1N~#%VsSzGj zQdA`Mh>%gL6cnGMnvT0|S4z}&>K`JbRB1Is=WDH;ON*-V&)QsMlqv(o=U(?r=L?q+ zwVL{e$SCCp#dSDx%z_7gqB_S|VZ0g9h)2JCimtRSih^$(Fz${&iqFJ<=NuHpWo zep8PK8Ko*h@llz~Zgi`PqW;j&kWnfCst#4JJ$kWs2K6yGgZFO&OBWl`6uM}&-0RiKK}44W>URi}!m$<#kYMyaY$T!&LScj#DE z)bZ!mn<1lAH7GwCYukx0cKrQ=Hrov9A0nevbtt}b*tq)EvFb9`BkB<$qf`wjKF_D> zlWJZKQNyTzh>TJ-l^W12;$2Nq*{C**j8e6scrOnb{-sN8 zQFc@t$S73@svxaleQ(##bwmxJ{vk3-)rI0U^iEmsPF+#os7Hj1QuUztEZTnZ_q6py zZHcy~fQ(Z0)pnJ;vA2DFQBl+*LPn_uP<*xt_Q_hVfvBC-KSV~UhH8d`U90;y6qT52 z0~w_nLGd%u=V7(mG!nIx`iICU)fkG8uO$_>PirhHfcl5XDAfdt?^5i4CU4$ER3+*$ zA){1NC|BCcfvv9mZ7Qk^^$(Fzsu>hNW#4#Irgk$?+o*qtj8e^^_;bB_yGunj7v)2> zfs9gtP+S{9RmSuT6!qY(HF0E=Y5~RfqMLTjU)VxaI;st1lxhjZYq+dMmm~c5OxSGE z)FVPhsa8-vw1&QICk|~TW0j_^BQi?0hT^M3gxlMQ)}n4xj|ds1{*SD?j;dR;QV zTiMRk7k_69ks;L{Dub+zns-0cZEq@$tSDqib%4^(Mw>1yny`bZ#nL(=L#iW^0t zefz_Dnz|s(5;CNELFw71yxZAhy-d}T))5&}y`gf-Y?O_2C{AxvccfWDhEyLY?Ewb< zeB8f}sZeQ_kRcTSrTg{4J0vu~)b4O+6ObX*7pk3Xp=;l=G<{8VlhzR#QvIOHiORP) z-@SgOwmfpajSQ*&Q2MT{(&<@@{-y>?>xc}g0Z{r(G`dFY?gLC6mp%#^QUjs%iDO^= zIq?UY>L9HnGNcAU={x1~@&nvG+7(SkQxe=Q^p$IJYBb;rjpCrK!(&XD1A=p+dWs%FjL{uVj)9nI8;L!Yww&= zrH7kZBwZykq((rs5!EAban%u~9zArvjSQ)gPZuo&2rXv4wrWP4eGokD`<#*?N zGflPp>?mYN&4SW9^OK>g|I9L#^R1(hAvGH+t{ml=<6ixkZL0M%=iA7TnggXPYW|Nx zyXTn7BfTgxq~=2D-SXV%i5t!}wNiRfWJt|}iXvM$H23`0^Gqd_wSf$&`A|_s-5zrC z%6wDDrQt+|)B>o;qV^rxwr+u`h0<^$Luw(Z2=&W!U1-YtxAS7ikXi&4O~yJ?v{jo$ zrlv^4i43X5Q2N=;g;b5AE;dzD8ct+LErHUtQTN`oWJ^qqed=riGNhJ5dB_%eMh`o% z)KoobIFTW>3`(DT_pjLVe3_|L(r_X}YB`ji*{a3#2w85bq%@q!kXixt?>Xh)SJ$2S zpRX_#A}tm&q*g-tI>0=2BY3Ydbx;~kWJm=<=~b^miBZi1P4y0SHUSw@YoYXBH0jR^ zH`kil@WfHbkXi?oPxh{}x(+uSm^WdQso3&6WJqm>(tFX!Tjsym zY|8JaGfBvh+5)BLs1l10?cQSQvGh^MklG5RYvbCQ9m%(vnkQW)GNiUa=}~^?bIyI6 zsVmY)Awz0AZQ;`T&0B0YwOG1JWJv9R(z9s5@RSjEn0hOH6f&fCLTTTdw9d~~J57y~ zt`ZqiyGT`h?Okk_DKF_Nks-Aks+g?aJN^1y*ljA8bd|`E+5@H6%49yT=Ik+*S-MJO zNbQBvtKO^51%mdPTJXc!1Y}630+h;1dtPNyH?T6AkqR*pJ9Nll~wDeKP zkU9Y6A+wPt+2>UUO#P8Q3K>!dX$v3BNtEEAsaw)VAw%jAls=o!s_ZrYkf}_vHjp88 z7)tNVC#1W3;jpQr(kvlE>Ijrx^{&ib9`A^$Cel?RL+U7$y(?#a^E+y)sdSadkUBI9U&zaAc&nB;`1^3qizL+T_{OgYMN zc11aT($r^ZmXINJ3QAY+2iLQHr%dILwSf$&)1-DBh!%d@R1{eo$dEb%rH$F`rExo* zF;!c-N@Pf#g>sYqx*hB7{j;XNOS6OwsdG^JS+=)Zy|m{{jhEID8B*t=^pmV#14=GA zZ)%pbj>wR@0Hr@6S-f@Gq!&!hmevs&QWv3g=3hnc{O+QuwbD8wL+TQguHI|S%TK># zs<*U`$dI~BV~u~GZrNp1Ic04iL+T2Y-kG2NmG$HmQ(c3c1A+{xt5D7V{`EguAa3Bo ztELJ~aTGG7u0cg~{@V3=aoN(>ObwIP5gAg~q4e3j?)v0UuA9mtYXcclH=y*L65exJ z$s4BjNb86Ushd!GKi}22OW-|I z3#D~LhSYs1z0+G&cjW&2raDUNhzzL*Py8TNbLt{OL(kH~YomXdlY-2^0wSf$&Cs3aMUh?nPr^eyao|w8X zeH1dJoQLRv>;NWFkcDr5Dmv~86>7rIJNA@veU-^-EfPyPMU z#!4hB3K>$bpxkAwor8+cePwFCbd|`EdJUz|DbtRn+4I^|Y*|srkP3y;cV!mute-+n z<&~}y8B%Ycw8fhIW3>MpQ!!<2AVcacl!xrsz%JQ`yfroLx$|vgNQFWD{RLm=CL~%H zX6l-BmB^3^he{=?PlOGW)sMBqtjd*Wr zo2)2gNPU3PbvU`n`ko(5RY)EIuZ9e%k5Kx&JR_v(l8>gE#&Z-hq&`9EJ;3VZr`voo zl|xn(GNe9}%33`_xzDDKN>_;tsV`7^X6yg3!{slg63dE0hSXOmosBx_@<;w^D)g;0 zwaAeAMq_QsQYz9nQ{`nvAw%jrjg>mPXPob*V#?Y;hSU!zy|=l2eR${(Q>~=OMuyZ+ zD7_cmSMz?1pQcVrSBVU%Uo_UMLT8@+GSyjnY-C9NhSIgMeBy$ozfBF39vc}_f1vcL zmm~Z2k$+4zk{%lwQm(%by^$j5ebk%>@9VgvLv^{HOT&o_sR&SdW_vsE#?=U>N=uK8 z45^4vdKL|T-nMr{Q|@n_wSf$&NKiT(pZYYv6UkJ$XO2RKRAi{!&R@Iwo{CX0vZ+MU zV9LU^6&335FZha>pk%?Qranu{^@Nya)DyGBJfQyrf= z-$sU194KAA`M=L`#W7V#+HYh?#f8%IMyr{JJH$0LM%r&=NV!Al(@lkaN3ZCAsqb=S zkhOsfsd!L&7CqRpbx1rL>x?v<$dHN;l}2WxW!pC^YLQmdg-x|A(f2wt5lNylaiS#FFiIgq>|HE zr+c6JoZQqKX*iJ~l>$o78}TbQPn^P({&)DuU}A0-bmk`|l-xeLe3yhYP6_4Tty!y1 zEqe6$mqLcdN=5rMcHOkmscfv{(p4fuDmAIeAwF|cn;IZJHZs_>B0HQdOat}r&RpLu zX-t*;Z-&P5fYQ}Ft5=Wr9;UWEc3v47QfWz*`0RB$t*N2Xej|eyc(>hoopewhfB&FY zqjaXe{x?HorH9frA5yma^Yo@JOD~EHsSKpDe~kD@|Gi|FtCMu*$dJlNs_*?e?ip>Y zc(S69A(aVAJJ=NG3unn>D!z2)$dJkmrC0MV)zVbSY$}Fy=E#uB0;OlRy8G7zXE8NM zI&)-5WrfnKUi;;V7iKl}Q+iQkNO?kOr&sb$l&+qp*1mF%DKez8LFI7%+Lfll5sz%9 zf`grJBSR`Xls;uwYkg;Dc2j%2ocnoXNacXi&npMsygxdJspzsckRg>5NEru*N$O!-P@jtr?>Q2P8e$gR$ZT&9XkXO0Z1+)(Ld4quGAI4ZZP z64IF?L&_VfsHkeg6U_29)l@ojWJu+K(zW59%Kc3qQ=YOmkRg>9O79%rq^-LMZ>{GNg(^>GRj_YGqm$HI?p^GaJZ|Dh8$N zuuzirZ;F|EDa|c1q;g0I>?&g_rmQGrNR@@s^Woi(FQSw+ zHD6kNWJr~R(zTH|G(nDXrqasVK!#L#sDv^beyP^%D{pGGwED=9ssN?usL@Fp*Qj7> z?^ox=kReqODw2$~r|-!tE#3J$j=fZgM_C%&{Tu^cjD6- zsb(toe={^zbtt{x2>2Q&Wpz^p0?%2k)O}&tI4jEE)pt6X1eSW}% zI;IYWIp0QxR9z_j+~G{NRX%l1bqaA5GNkI!SUWn@N?Om9-UIwh`1x*QQ^lq4MTS%pC|$i_-yfB4Vk)lmy~vPi3Z?g=kt^T0(A3n5 zKh7i}L#i2+UQ@c94d~O%)K}^BkRjC^D!a^l;!jEQH8*wft@CYUNVR~{d+e^I=KX15 z%JaFSkil;|$}(>WrM=C+ziMf!`+qYuRx2p&zT#DF;MU4is5F7dkn)4lGuzsssrLDq zDkCj1GNf8V6>@gKl_Wuplh)=sY0 z)|8*L#K@3p2jwFw*_#;~+LiTEOB09;sZLNHqUM~ed$5zKtkM!AL#i{BTs&OS5^m4h z+0++l0+Aur1xi2V^hq=NXctpsk9R+j?s3hE3$oBx9;fIqA#+@&{*A| zR6K8W`CB&|tA#YT$dK}f((}gNDEG$sn+p2nOcFArx=Y zvvH-x_4YkXC6?ob45^;9UlqO|`rOl06=`mfA=Qh zS&a;-K~Q?FeDx#W-9e@z%j!jj)L&*t6iRD)XappCY$;o{UI`>rjW{;Kh?4+ranr4 zhzzFFr=&BhQ=$GX(|G#jhAbj!$) znhvF(r!@B;Rd>3nhteM+Luv+;KG6riUsP&_sR^%~y+DT4OsHkfU%RG8{_Q){)G_G~ zks&n;%3IXSCbQSiGBw}J>GY5xH5*E=%j<^CaG!1Jm2`T@keUOfXVK^l=XIE4YKnBr z$dH-~_4gNiWo|Y`RqwLiucHH@)3i|@Qj6~V$0e)5qA85fz_`_h>sWJoQh zvBKKN>9W|=k03`OLuv_)RiVhsROCQd3D~Z6HHx8L3By3f*01 z>Y%i9$dFnNRma%@SF;X75-c}WP5NGBNUea5i|x4;xXM%)X>O4rwHiwAh|*-<@q4wY!qVI#Luw6__8T)-U;Dbo z)cY6CCLlv95K8YH!sfNl9%w30kfV?xwHB(V?AOm3`xmb@6+zYpGNjf)WfJAKB*(~g zrpiiliwvptP+p=YB+9sLy{S;?*^nW%0VaLgE$x0~{k<`x-J zJ4nsilO)d$Q-h?rMTXQ)C_T@2>U;D2PE*NcZ6HHx7nHs$&o7zRZI`Ka(!nA_YBy9d zSy8*kw5z?_RBq{Dks-AQN}qgBq-(uwkEvbK!6HLyFO>FCfpsIT+-vHrbg;;f+DBX1 ztA3R+`%Enfb2c0qQv0FwiKC`Z%)tGos)jfU8BzzJ^fUUf%c)l%Fg5w1qmUtW5K32X z;IV5551Lvl9V{}W4ngVhawYCI?U1QV(!nA_>M)ePm)E)qUOH^5k94rekU9dDLymI( zv}cMRG36#5EHb2yLg~4;%Ca}fj+#m*&(z3}ItHchl&VQjFFI!Goit|1kU9>fca<@U zcUX1Y)F|m-ks);g%0u?6$L$O^PnfzZjTthePLetkrCNHe3*}^AzyIenQ>Y}u%$dEb%rL(cAk5BD0rZP*LiVUfh*Qe2f%cj;!bBheAD^OWvtm`Yon_e*$UDhEoq^?5gyRzA(R4uQX zy8gy_F=R+xgK8vWP3e@s&NWl9o;lw}hSYT^?Xh=kdC={;sXNjHB17s1ls?ht&eY_^ z4O3Y>ohK<|NZo|e>#|SWnon+;Ixg)TGNf)nm6H8By=hgXTc+B}&-Wrj>NZqvQTsPkKBwm+QI zX>O4r6+&Bh{nkQ{5K}2-MIl4#1(covK2>@e^@XWg(%d3L>Lrxk5p@`zDEmuOX=Ozr zL+TZjo;Rv|9{={0sczETB17sml+MPC56`Q=HWgb|6f&ejp|rONx%_i*sHrW|+#*Bj z4XGo~Q%87XYODO@Co-hoLg|{n+pMfu*i`50F_O~ z+Mjx$_XksJq=Q9<)JG_NqQ4g_MZiZ>g{6ZfOI=XXI6JhSVP@y;}~rKehB9Qv;;AMTV5i{ojB8rB}UL88QuX$=$BY zzJ5J|sid-^kRcTjO6M@f(WZ4Gno1@s3K>$7p!B`mZq0*OkxXTm<`x-Jk)iadZTOjn zGb5Y&D(xIHq@qA+4{+{V^1V?^t&-*z8B$T9^t@4Rf9Qg!rb2@Lt$3FU8B)=pbPmTY z8<{qmsU6bJAww!Ujn!vb_h`{gMV7UJ45=7Ue}BQ(#yTY{#W1y2npsz7NvE!J^Bx?g1QgLYu3-xK@ifiiO3uhCM!Ea9%cfR8e)$Z>fbVl4w zUHET?#)=1}=lSCYS6zu`Dov2{%E*w4Py01;$koH~O}&v$4;fMkNWEN;q?o5WNv>3fkOl@vB10+}R0`*>UF%ky%#zGh?QrMY z$dF17l~q*FJHMYLHx*k}6f&ezK*+)|oKA!`E} zQmLR4%NAZQl{I=QQyrx5MTS&rsO+NR7xgQc+Ei3o8_1AK1Ep)D-m{{~)0mnqeJ?Vk zJfQTw{O44)ryizK$=X1MR9dJ=vV~)#ZSR!U)N<*2ks+0i#>&!jV!?E#c1qui45{=` z`g4^NYPH#v-qeIJXA_Vil>thh0v@a{y)J{P!Xb`AhEzsU8>d!TlhIUv>3fmE3lzEO zyiO*l=70b2@BN%{+>XJSp#DBrw(i>UKN%V;GnAgAW=3=SklDtXB`q;Bq_WT!c6inM zUKUgFr6op&R8}bMDlg8tUofkw&e9SiL&}rXp)Jd&dYbwsO&~I)vO%SGcH1?1#o=$+ zOvRCw7#UL8q4XyS3%%TVD!Zu%(#|16DhHIlQ?~T|Iy{G|?$Qz?Ln zZECNy#K@5HhRP@VRnu=-1#eRcq$Ng%R30du!(~fGMbBeun6$*mkje{HM8+!ls8`3l zrc%k;K!#L4C_Q734~@JtpDEo|WJu+QDkNhi%$u-mep9hzZ6HIc0F4#@-Rb28OwE$! z78z0nNnL5wI$J?gzonf+hEyRaUA=oUo|sd})M06Eks(zW%0u=mL3RHjg-v~tb`BX* zMWAwt3ccvcRK(N?X>O4rRTN5}vU8lyaigfIgwot1L#i05F+nY^6*IM2npxi{(%d3L$`?u-&iFlQH}*AESDwU>AyphoSMTu=w^I~1GO3iQr=iX!AVaD&l)jfY z{_L5vw5b%bHjp7z1}dlQS8%=-8OxY@DLor9NVwH^f@PsHh`N!anV)`Q<8meZZ-&My z2bED&V8Zed%h^~3rSC`kFRX%sdIku7vZ_N(Q(vXiLxxl>C_S^i zNwPd)EmI4nxkZLlZ77|Mf-Qn$)Hbz9npvSH|AcAlc>I_{I4B_45ESW{Uy)n z6`Gm4AnhD7q?$wN^YSYHjtiTcdL``~GNf8S{d?N@_qA@ztd1>A?Ud#g8B#5w+#KY3 z9lSD8OH+Q*+#*A&6;ymt@6R-C*UHrVVCUP&kn)4lGj`tPN%rV}Q{{5?kmeQ{QmvtM z4!`AGw79j6byV6pWJtAv(&N>3R>hz;rrJq!iwvo@Pm#VtevUIvNn(*)t>e%%)LaH_NJo9+CYX>2Pi#WXRbdQ*TGa$SsTcZ>IkJ**i$!4 z?CogkskC#*km>}b$18f28Xr5En)cE;%E*xF45in~p3#18>}={7hL&_gY&)C)O>=@;5 zDzmH&WJq;~(%Gouw(muEQ_H2fMTS%lC_Tzi-}}GrVJeR_x5$v{38hzuRH?^5?rEy5 zG`Gl*>P7pNty1e)y-dZIwSf$&-lU@6^4`$f)LH4-kRjCvDv`4YTp!Z*tkuU1!&rtPNyH^@GwiU$%CxTm4KOm!1t7 zQvIRyY;z#w+o%4f>PQER45tOnsG}4H;5H zq4YdIqC=3^P*a5-Ib$J1Y8Z{>S$$KAVWy(V+CYZXa43COmg=9*bGWIx(!nA_Y6R5Z zj|B1MxuRdv5vJbDzjKQWsgbmWrII!NGSbv=>0pr|H3~|P*UaOsPK+`YL)Hc|q((#O zd86dnH}^-IY9k#iGNi_k+WB@?#xbUreR1{{8B$}R^xPY=`dY@ZrUImcMTXQkC=cgF zU7zQOJ;*0i`p4_g>MSGfa(9Gz+EskEuckeUUhKM&yj zxro~=Q^TcAMTXRD+OI$JXZN0M>W?&L$dH;tTUaXTv3+w)b&)m|8B%kh^eMYjcwpPP zreet2K!(&jC_Q7B`~I@XJX89K5i+FaL+KrCwCp_^%s2H#8Z%@_Er8O`iTZD=TVR2y zSJHhULuw(EzL$fC)(Tu`YW*8$Z6HHx5tLr_vMjC|W09#R(tRO=7sy`Hd7Z^jOaA^r zud<6x<@s-h##%yS9ZYc{_7YQDq)kPJ)KVy&jU(M!Rak1uC2Ip2Qp-qrwwnEBnW+WR zrXoXXIjMk2x6Up%RYKZSWH1d~ia4{e0;>4mhwv=UH(V=B_4;py###xb@04hL->q0_ zs-$$V$dFnErDuS-ZMW22Wh#ZNC}c>jCKdOIcdgZ?=1B*O45>9xk!7F!$9eg$F?CtG zFJwpsLh13!KRRu_KvU6VMIl3KEtJkil&_m+tTlB*x-Vo%t)nf>&}3+{b*3^%FNzGQ z^-%hWYGAgHPu80{EWIc)q&Co4t9S3*yTMdz=|zztwUPGg?C4z`H=1fAy(luIHqltC zey*vq$y5dDMUf%3nf5Ei>+lnsO&yf(3mH;dNEO?@C+ZecML#+R9~n|xX$uQ%jlXEC zsgKfqAwy~#jrFEhlnvWVWs_bM8B*IxrK`5kbGxZ;xt#6`8B#k)MR>Mr!46a9r58np z)J{@e4(wRJ)6`SxzK|ic3rgQ9qe9&)?=m%3dQoIZ?S|5KO8rfD-FKTBC%q^#r1sEQ zPXk*8?lCn~dQoIZ?S;~2sa5?5t@oPx{KGlQ$dKAcTey5c=G^;C^^{%|8B+V9^jaBf zt8cUYrqapUK!(%-sMvD0`H|D_;sH|)q!&eo)Ir+9+I7$5IA|(!E@y2ZL+TKz5eZs6 zIb>>x^rFa+I!x+L)x=Q_n~E=M0~u0Bpma9+E>070#MCb7MUf$OlvLv&_l-wQ?UwEf z8B)hco%Nf(?wF}P(tROA>Nu$ozqhrIo4P687c!(ykP1J1GxZ5m%cK`YhSW(?ZA#Zk zane+E=|zztb&AyR5w(h(GBrBbSu)6wIt`^yZ3*Z6@;+^FRy<>H5^OrfN$siVUf9v|oqs-P(H2)HCV6kRf#*DvrEU((H}6@Vu$; zSk9V9hSUX8Nrxt@e8JQ^>AsL5brDMM4;L2NF#e*c$g(z&A$5tyDpNS#;Y+42OZSBg zsmoA0^KVZMn|9gMAn8SsA$0{xpGKdbzVY^osY5}|Bq2lUDwMt}OQg6N`Kqaj(u*QP z>Kc?DIRfv9j=DODSE?H0$Cf#kh%$_ zbGWkD`_4B_O_p918B({P^zJLs&|BfROr?>vfefkJPN%8lL@i=2`u*J02l<&mWJrZT=^Q>!5>_?DR7vSYksXh`N z$dGyurDuSie)ki-Hy5sVmZbAw%jTlzzHYcI=42kEV3>BSY#F zls<8|4%dzR$8iNPU6QJEDMr({p_>)l(WyWJrC5 z(xyGu{l4YDn!5bVSsTcZ`Ua)%${_D_C%>8MDh($xq`pJx+F0oGYnwL8F4t>mv5+D4 z14_>}Q>Tv3^TWn!C=Dkvq<+#^g|aUF_S4iSX|a$Y^^5i^W12`=f0>FYze9%9Zz#RO z7R}ix%5PIoq>n;|)E_AAV0%7$oZ^qEfZxu{BSXsd_Y@x~f`{|huGViKu5roFIJ;ao zr58npR0JrU!zF{0*NKh9Me=}SsTcZiUp;gjP(1t?PDxc`$L@hEyCV581DVHLkkr&-J@p?y@$JAr%)Yg{Vry-7m+r zvDQn&i3}-sD19$?@*5o0-Bb-}IFTV04=SUKwIgBnsqswJl!g--Qt_cOi&}CkxNm$@ z`J~}QhExKmOrjDGoZc^iskPE@B10-6RDMw&!K?oyG?hgfPGm?Wg32Lk(YD^H6PXHn z?R*;?;)&?@9l0xY-?9}Y{XC^h3 zR~k-aNF{?RDEn39_R!wROkI{13mH<$p>z&6q;_wZ+*B`VIFTWh0;;%-HG1IQT`5fU zmWC41q&%SH<1yEg)CI#lOqG#_6B$xzq4a!Mq2utaX-y@N zwSf$&bWnQk-BIG`cKuhQ{{BC?q~Sz{RC*|H*{^n4e&|3B_lJ{rPH^)y z)g#!MBVb^9b$dJkfrS|}-POeOx%hUsD zv5+B^o5tGEp=!6>royGgLWYz#ls0`#`UGMNB=BjtCi2MWOVLXi4IsS&N$5BK;vUq>4dRbT-BH zsqO9c#Y}ycjtCi2K2W-%!kh0dh^O-Aw#Mv?N^)J3ujj~l}wsIWJpzm();-JTx05( z$}deIGNkH4>6y)IpZmDFre=J0HUSw@^`Jat3zOU!nXsOz=F%S`L#jTMe&UmDO!S`h zP0g165E)Vppd!gwn+v(6ZD8t_G=a#FY6zvX@xkqV^MDkRjCsDvIn^!|Qi8G%tKEOQw=tDmnm}YowWTdwv8MdQwx&Kv+k*_Lb~M)7?7P;q zGu2(1Kx8mqi={wq4|V(R_q5k*Z)(+lGc;BQC|&cvB4tR~!Bn_(M97fp2&HR&@A$9x zJDOS(>KsO7NOgkJGeA)7^>sR#dL$hYGNd}w7AEtnvZAx84Y{3;2pLjcp!6O)U4-e2 zx|sSY9T765x$dKwzYOuG*`|hUF%8EjUR1YY*c`7T@;iZ7Pzi4P;35p|QTK?>eH7sVmYEAww#F z_N(OLBHsc`dC1y8hE!iDJ<7cXPO8_})PCs?ks;L&N@qUs_2+&4Otp~y5E)YaX}{K8 ziv7C3sg}|oB138blwK=4M~{(efT;%3A0k6)AZ=me!+DzwG<8w>Lu5z|g3{x4==1pQ zgG^PH{ty{bgQ4_3YWt`u9R{2F{>nLTAVX>hRC?#HUBQnZcNk(SxAcd|kQxf*DQbWJ z@t=m8`Xe0?GNgt<>AmQSsD*=unW``SAu^t}GNi^q>5A$z_;k=X zQw8KGBSUIDl+H$}S&goYH#JI{Kx9ZwfXXdLxy7x|#U_}_E=?dZq$bi9?rVIe%tTWM zqzOcZ)FdcwRjNn6-+X`U1_O>LLf5gAgmNUix@-)EMohSEABLuxiu zR%ZuXZSTjaG~3i`>7$S#H3v%X@_z5{^=OVMfB9KQWJt}0N-Sf2aI4}r*VGs3qmUsr z4=T5+7JquqGZjLMRW} z!tI~SOc!{aS7wNScBWJoQBsvv4%zxVqWn|dsL6f&fiK&92O z=Fcd+#MBt+Dv=?z6iUyBbzYtvztmJRSsTcZS_V~F#)=+xde1Ubi>0eXhSYK>{p{x4 z$FlpEo60C_0~t~)pxVh;?|0p)xWZIH=_-*SwGv7{lbVq(W8;;kBFox9hSVyk%raI` za{3tD!Q9np*vJ<<+KsNsEOHsWqhbc_072#?%ezDv==-2&L~YuN7}! z2bxMQYXcclYoYXvU3A&%-fK-AmY;P*hSWMJ?GKwrZntTjsdCbAB139Dsn|0{4_s49 zrQt+|)J`bvD)%1T=)KdF{+C6_klF>MPdDwSWm>+=)I@1Gks-C4RP`P^%k4ImP8v>R zNbP~r``#i~Q-tp^HAEUtWJv9WN-eXIGi_JDy{0Nl!-)*3eNfsFMVs6^={{4#pE)mv z45|H4y5^I#ep!3JsTz5lrUDsK2cY817FMt1_u_!5W73NvL+T(@Qc=Ys9JzMTl((!6 zWJn!?`uhvMcIC+9e#q1X>AsL5b(qxHvhV&JHs$=^OC&OK&oqx7Q4kUCB(QG)?Pj+^Qxy(luI zPC)5(`EIo;u}+v;{nXh)WJsMPHGfdu_$N*El3o-UQm07O&(XioDO1O#7e$8DX;R5j zHupGfs=4%{$dEb%rRUzW3%>=NF%?DD1~R11Lg}4D&AV^V(NvoSjdpNN?Taaw^hcgrbbA^i43W0q^eZe6XTkxtkQ5IL+Uz|9D3^*??9pvgyI(s89~n}2p!Cy!-)*3 zhfw|Hol-Jx?R*bSRh5Pl8B&j+5{a5Vs(F`3rpidei43VAr~#tde~|;~UrTapL)DtK@+e|F~yyFv7sbp;+L+UA% zuZ&gRBgT=Zranpcg$$`@P(?+>Z{7REGgGCd;Y5bibEsURqOa-u;JK+F>AsL56#`XJ z)R)$ceL_t2mtGVZQZJyi70LIY@~#)A21qZ845^n;*>yJN)_(fZ)IjM)ksOdRZIDkP3rJC#rF-hAG2Lb(dZg8B*a;`9)oWu8#|i>Zl0&bN^v^%Y9{`JnA5YkxIWLwZqUNPUAUC}S0G-z)DoQ%j^5 zMTXROD8185`)aWJcT;7h7e$8D4=BA7B~9&<L-+5i8e+a`1_}+Cen){ zL+TfluEU*+PUZe(>WOq;$dLL?V|9EmqVjK3pQZakhSVP@JspY)>0kctSUpF5Q8UeXoO z)L7|7ks%ccO7Bu~c&!{1$<#&ZzK|gm8A?C9IiJ#FMPySwr58npR1_$Er%Zp5EngH< zQDki(Ln(T+-;KGRWFM zhExpN!hNBM7R502T^ciFNX4YFKKJ$YifL+%^rFa+ibZNy`3(7EnR+SR7c!(`lWP8J zzh`VyN2C`;hLjtWzAMwF-?PQdR8(0T$dHNy6-gF%tzq9E$1$~DdQoIZ#f8!yVE2!# z*W#MWBfmq2lsi;R87uq1C4=2f?U7y-8B+0}^h)HHabnzfraa{*Kan97A1a!RH8{m$ zzxbwVN}GxdsRU5^PN|=y%!~x4vdG#%hEzf*y)KuEnmi<-sm;=+B10+>ls-Ge8`rdH zB2(`kI2(=(sl-tFOq6rQ;a-VNc}p*f45=if67*cEWXshoxhegZ+K?fY0!puycMg4Dn!?m@ z=|zztl@h9)Y~j``i`u3%6-RneWJslg(q8oVmiW$2HZr6yqnh4 zCh0|yA(aj)lPIs;$Lgdrm0H#YGNjT&>59tSwo=XXruInpg$$_-P5N>^|4T*Z>-H1%G(FJwr0k!sg!Y=19P=cM~WhEy)7v@-K)a);H)Wvb#Y z=iA7T$_=F}>TT`9?zv5!mhKA~Qr=Md{u=h9z!`5-LqeUgkRg=^%0ssB$nx-2dNp>r zc1bUa45_?Ox(>_z%snTsjWsg2vo??+l@CgriuY%;f6r&?x^!R2kjf7gSGKUI$HJlc zO?8uA6d6(lp!9w|&4+JG3YbbHYXccl1)=nQe(k`}0tHPambHNlsX|bCKi{kJ%Ai7~ zzDf6m45`9UdUYrqmauDKQ(dGNMTS%nsK3A9E7zwaPl}idmF^1}QbnP3&3}qlF=|m$ zE2I}ihEy>qeSdlE98tcQse6x|EkK5p4~?~QY=&_@rUIoGMTV3wl+NMLn!D5Zn))i; z7c!)ZLnV{hI56csz&>?RZ5#$CA}yzq{=|)v-#xjK_$zW${=e48B%4T zbmo_4+CQwUsjJd`Aw#MhlwOyMj(l4{f4aftiXm$Q8B*n;a>~qC@O+h^yp0ts-4`;X zDnR*&+F!ax*$Sp|$=X1MR7EH~Z}dqtXGld;=cW5XhEyde?JAFa%iN-pskYLKB15V& zl&5TAtxJ7#S2op7dQoIZRe{nzYHN~;$E%oXFTE%-q^i;uj;=VMSXEP_zB`+M45?~R zdL@cpb>N9=rfR--6f&f$(^!o+eBW2yluOnIGNfuiWsunzQ*=ts8m0;aJKsizR81(o z2UzM=XktxMab;~FL#h^(o<&!tn|rjDsixA4B15V+shKZsOs;JzvaAhcNY#N#Df<;= z>4QymOwE*D6d6)=Nlo@movE&=CDMx`L#iH>&f%9HH#XNZwN!dhWJuMA()V(UIm2?) zH?>`QQDjIpfYPf&NYOOk8kidL&e>gLNHv7YEwj;UX09y_O%;@06d6*Dp!8>Z!m=!Q zr~loj%hfl?c`;;2HHOlrqTPzF%^KTS#iSQShEx+My$4A2CB>vBrY1-)iVUfyPL1hnJh1svx~6GNf8S>G8_B z;ZflhrY=eMg$${dq?UR9I@HqCN2yqlA=L^hweDBzQyW{EdMu3@GNk;V^o*U<`}Gb# zQyZmCMTS&sC_VQk$e1x_Yg28cO+|)O8z}8<`b~c}zKyBX(xxIqsx6ehQ%*dMU!|?7 zUecx_L#iE=o^9NN#_erqYOgeA$dGCerFYBW*&f|&Z>qVpsmPG(0QI+)##e_iHF9?_ z^-g|=45^M#+Os{*)-^##Q+=dOMFy{0`K3>IU7ej^m;W29i>dwp&Cq^zh0^ZpL!lj;^x2!=<6>2bD#(a6~!ZM*U2U`)>w`ezK?iNnLDxB};!(L;stB>LRZ*fK;7S z?aL1^)$6|*+OL67dX8$7dt}XlrhKH4MuyZND4oNib%PrWGL=wPFEXSCL+M$xQI7Ky z2b)?TjWjZ(hCoG;IlRy#DCQ7T52TSshSX4~Jfa%cyB>R}snpU)BSUH!l=i)YB2{ZY z%v2v~q>&*t97;QffiFX^4>xsRT1R9^jezPdTR3_|a=#I#hDsxi45^V&+Q2l4^yTPC zQ~LiLLWa~RD7^=GJt`>gC{tafkw%8pXehl0h*o3k<#kX}_jS^s6`4RED>XLI%IppFSA}rSGrWukM#0XG(ug0vV_zzRv56hbkVy z<#+J0A!m^s^QQ-h^5M~2iKD1D+ov*zQuIi{+3J2Q_Asku;kymIeOab>Ql1=5)# zLuwwBp4rB(Su%H?se;m(BSUIFsVC8M)tztZf%KxtkXitxPi+_0xh-2@>Y?22_@^Kpr(PSTkpLux6Mr>w&si_$MyYHGQ3=E#s*1{Gb@jT(v1EHmXVojEe3mP7sh z1z+1o#;U&D)M4q&ks-ALN}o6u-AFcjg{j8UnIl7LC6wOj`R|`KV5O-DvNn(*wF*kl zy;;+Z@myspqO1*MNUes_JJ??1I~Q1ODolD&WJs-n(sj6Y>WmF*Of{6w92ru9P+l^J z%K{d63^a9HdQoIZt%b@dYVn$cN!FU0BAq!hq}D;{{ruip9^KcOIwid*GNjhiSR0zZ zDYo9!OzF&#A+-TY`}quKc9-8^>Z$ai$dK9yrAIkIv)J!8ni?XVIWnX+L3zt;^!IJO zW0R?j(wQSeYBQ9+E7Q$S=dsyTCh5$PA+?3J@b1cs7q^&7C2Ip2Qd^<)>1O1M(L1)9 zn)bulaAZhrgVMXNx)YPs-)72P)&?@9wnJ$<*Y9Q4-P=taeC3RV45=MZ+L&D`w5Qq* zQ=ftzg$${kP;#MirJLbew$s!F=|zztwF^qm0MTQm3*BWZrK}BPNbQEwyOeUVR*%|k zYPa;F$dK9trPr^U+g^L^F;z=Cb7V;Eh0>?ClDBKW-fOD1bmqvA+6SfAl>6cRL-v`f zBb_-ir1nGQlhxZG-Jj0;O?8*f92rsvp!6OfU)FCg4w&+J@4Of?qz*#qii-NH_~e78 zLZuf)hSVV_eJ1*L>3G;7Q|V=GAVcaflpe2l8#7-#Z0d*fqR5as0;TuY{bS#Fbi`Ce z>CBNKbri~5=J3ePX^D=S3YT6K8B)if^qDAp^0q0*ObwOJ92ru_q4Zw#?&8pO$4yO; z&Kwz1C!q9fvDSg^h23Z@(kU9gUSJ<}eo^?E9s&$a_V#ts>3spwOnpk#2k+Y`q z$l5@L)Hx`9y6Ls@?dEf)0;DrXhSYf|J@>w^wyo)TQ>kTbAVcZ`l+IzVVh=lCFttfK zb7V+egwi!XH_NcVi>C6$jDY<`hSVjfwlW(FzP~^laA?-IZq;5c^k=d9#BJ!UbrZ!9ajSQ)qP&Qb#Aw%jRl&+{9XO@q7Xk*QlZW$R;kDzpI?4NQt;E}0^(k&xH zDhNs&n7nPTl?XC5N!nCoNCiX1mO1oKacpC-saWzmWJo=R(&H6>?#EG&O-+?<85vSf zNHy6t_}UXw5oK*4L+UB1muYjLx$7~s7Nx_yjB-VyfF1fnpH8Z_7<(u5OIv_(T6iV-w>)+@< zE!0$P`R_oGA@v4I?>CCx2)X{oRC-xa$dGyqrK>kt?%%uLn%e!xnObB>g+b}np%&aNmKB8zscV`*-YA@vSQpDVw1yvNPU9R=aiMRTIKs> zs+F|*$dLLBr89pc_KjqpO$E3+D+(D>U!WSv77iF)J^mL{HKf%?hSXOmZS_;8@oxLo z)cxPiiy=em8N`|@*}_7jeBOLF6;;*-GNgV$`HCvv$p7aL zQ^lS+-$sViPpAZ!}(zGK(>KBwYFmB_&ef?#sx-{*`kopa!_ZvgsC%FFG zRH*c#$dLL26-~A<@wLIz{+OC7O*=BATz_{dQUrZ}T?{JM*CqF@F4qES+L0j@0ZLa? z+`A*|MKIM%ns#JJMWnGlbp2EzqN$I+oDD~YR3uV2p2e&b$y7UO+L0j@8A|Vavv-K; z8`+enH0{WciUJi^<}i8ML0R>``f|BiNN0`=si>qHWR2Z8s*UC4?YzH`Ar%cukJp^P zC#h(r21#d*45{d(?uDlcjBYBqtPNyH#emX#8{Zhky2LPbNP1CZNX3Nmkl84ZyJCWv zrVdLliVUe(PJBUiP)xMwsbZD8B%Ugx_SfFwVUZ? zDygg}WJtw<(xGZr$W;zH?)ik++f`naa5O4E)EDR(HnbEtV}&|r5{ zBcC{9Aww!2l%4_VM=KK$&r~gG+L0j@A4;D%ZuU#HJHDx9(zGK(Dgl(9dtY?fJUf9Y zA8Fc=A(aqHpAaWE>@zK)sVCB=B10+>l=e28cKHrXWa_E3smPE@45fEOi@#iKk=WEd zX;YCQl>|!f0a8rJu``LOvOk@fM}|~VD4mT(b5DdPHMRGHqmUt$jK=!(HNzbJSM*%2 z?$Wd)Ln=9x&f)6MkxwSKu>v1EVbLZw$dJke6~oyS z*Wrl!{4<%#C+#;fq%uS4X8|iuObX0wD!;Vf$dJlH`;{TRZ}Tjs3dm7LhE!H4eXhK8 zYWTLSrfN(3jSMMIC|!pY4`n;-Y05*6GBTvH(H5r89-cXysf#b2NkWEHb|{_0kpETo zCUBBvRhf9PX(QkuI>4|vv`J#5N z=f3;yyYJrbp1Zuqz5Vb0U3h)MW0h)?c|AeB*dDI`+#{aDF9jVq@bCP2sZHj!pk80# z&+Fkg&wqR&uJvJ$RjN(q^>ym?)$VolGf)24Ul(3|k7KJ%=Cznz>x*vsp1)rVuRriu zrP^d(OWC#Fb;Do0a4Ebd9>-Rj%&Vhbd|p5K=C}NAC%j(lacs58yq2>Ze&`2&ifo}+}y+5!Vs!itgRQ2MB%;5!J+h=Wnb!^Kg@5$#@qhgB=id-s@A6os+GJiQvK-#;k)N8L2(OJlv$WJE z^E#>LF#_}GC;zKA z+!S6<^jM|ZWL`I`7iXp4`cwbwk8TdHS9+{cZ8EQ0)Qf$}pFQRuzU!9oy4GWrYLj`L zQZGgizT)@4=S`==>yXDP)h6>go#pTiPkP_ipAN74d8|@xGOsi0#g^^bkInw)neck! z=j?%~P3HBq>{>s4?K=)WExbPK@hG*)yw0i@Oa9rv|F$Qe4X&=h)k=w&-&102nlX=~tUTin6eeLs~ zc}IACqsJ=MCi8l_dVQ_u@X@z^^32o2YuRI!YLj_=qk56Su08T&pZmt}dXL8{)h6?L zhI(WA0u9;;NF%xhD??osw);JA6kb2%u}Zbcymr)!BaW9o z_xIkp6J9U#Sf$!zUSsv*`i=j6*Im2g@cIXjEU8WAHBm2ewyRIse9k1iu6Wc@Z8EQ2 z^=utQEf7>E9xao z@4oo|$G-o8cU}pv*Iuy)qBfb=RrPuUy6r8Pyz;RtcU=vy`(8CKwaL8hRIe98{TTfJ zXCC!ue|TqjeT{pmP3HAH^^#ElXThHrUVpU-7=LP$c|AY8ME@f%`{B1gKfLaAX0A4w z*Egxx*T92y@teZysB<>8$-Mr(da(?D^vWwg`tQT*yZpY?Ci8lMdL6;FWb}LAs~>;R z3&QIr_fnh8>xFS&Qa`R7`kBrP!)w>Q)F$(KQREO#2R`^cFTePr@cQD8U{wJuh+aZ zygvO#yO!EyUN2KG&g?&A^sZODEW94|pUg{bGOw3sUW4;L`%^CuuP^g4k=kTl->hB_ zw?q&8z=5~_>Nkhitv)7Fo6PH5GOsWEk1sm?E#dXIZ?MGFCi8kl9`efY`b+27YLj`rO1+NT z4IKFA2VC=`uL`dlef*_1nb)h;>rL=tzw+wvdi^q*6a1;ofrZWKpg+Gf5aip`>+8Q$ z<>_#qA!0xAwX!1L`@r6KG#pxXCUMLPE$a3tzVTU+y4x?&z=0ulwWb8 zL>|V;Jt)lUBQGj#zVL-5@`x9g$gjPiL|$H{^Vd~6pRV%!Rc|WO`F~Y8Pd&aNmX_yh zt2@2v8_IOv{v9RqrKD+*&KG#AE|!+^&;Lg0^#p(C8=G?#^8Vi~z1~*k@Qu~8c=&%# zz3_hROsug{*z)se204Hk^1uv{w=#bV#JSG_dU!3~D7gJuIv=TO<`-5r*H`uV+6OZg z=I1~DQi=5DDS{l%1{osS$GseG0PlT3N+WqufXLgF zBjWuHRc#q(Ev?vWe^mapKTBt}+cb!ZWDStz=R@zJkK||T{9rz706_+mq<)Ld#o1(< z6b}&j`ybuL&5#E_r$jcMR3hK~juJU*&I+6Ov0p1~Uj2v^x#jr5?#b~mvSeO=|EAPN zJ;UGSc7aS?QPEDj(70wcK*eQ zmF4isFKqk_xmqFbtdN_11-tl~*S)IV;b7G}{P|alz5SWjL*CEdOsDtq68YPzkNb@Z zdBm$quTNwxHi~phh!d^s>i_%?{LQQX^Vt-++@BTvP_(amNophVkNEgPWJ~$6?-kkp z4Ef9}`I|Nme|L$Dj+MyklL~F=JnY|=Hh*z#iQG}8bK*Xw&34nwd!FxC<>&XR`}+Q> zhObuXysz^5ik~U3-pTTF%kh<#*7&n;D!m?*wQO6n!Jui2rBr9*-RW>VkG=;z(eB>7 z-z4LA`l3fS(7g}r&PLsIWMbv~-I z4=IsXSNVBw<@M=rFTFmMjcR8Xy5qg9Jp^*8H`*(DnI~p%_jM;vx3o5|s;>UMRh#+4 zPb%~C1uG@;$@i7W{ePiEzUW_-$kVG)?Gv&*i~WzCEWLhnyF`AnLUtco+H5_wL>~OI z68Xx?>-K9(n|uFuiELzVoM?Zz>YFZBz3^K;R;Kf(Rm!(l_x_r!J(Lta@#Zp}4^&U* zJ%3W#bgSBXO?9o$WwlOH_~3s@(~%lA9$XIS-UkHfBeq4z-joM+`I~RbM?P30cfO@W z9{!#ZdBy!pWGO@N7VJ){w)ZEhHsP$CT3 zef{R5#3Y?}R8R0ns#^D*74o?w;%k3a&b$Aezgf=TRNec1pPJg7T|Zj136jH_lMH_+ z^%9%QcY4gvoEsr%uJ*{>1iM*z&b+=dV&bRDX+K$?!o?|WZ~yyaI*6Oig-&=Y;zViCpC@a=@}RZS<^%UBkxy2Le7~80 z_H;&B`y;wfRQI)6-PiRM@`?(1O_k0ceTdiQ6MR5r^LLLcZC+SCi&s_c{FhcXN2`=S zT|MQ8KBc_Yk5(<@{XSgUT&QZo_g7{3->UpPwrZnJRLEPa9Dd+S%d6l2)g^NLCrjj= z-%=vazotaK`++6W`PmY=Uu84?mD1*Ss@nVI?<#G+_^Bmws!I8NRXXpiSiwgtuWzr~ zy5Z}}YrXhECGwsso#U0wGb-dwRd4>4RXShxnDSabv{)j~s``}Y9W8CXt7_TKRQL6n z>grdsnORBm%~|^_$Y$krq(c7TC1PoR)=K>NGx?iu?zjGOiS!mqt(-PB41WTWgk)5ELX@| zE9A;=l_`H`h5T-XyrV)+W%*f<#f6^mKY#APf%Es;!&;K7-NkNyq3`$uR_=9RVLrGr z|Em7pbabUVo6IMBcjnO0py_6B-utR~uH3tGKA90Zh9tWE?Li+?4wK#K0g+EM5u@6Mm=Vj^6YPQhoLGGo6mRYlxxH>O>MU~oehZOrrVu;@Fn6+ ze)ceH+nw!hV4AEu*x8-q_6lXY3R7wqEL2_hJ_t4aOG&YF`FSzz4HTH3*&U3v&8#}`}?rk{1detmdd3thdy}kK% zs~=?+ygCp}p~BoFV>Z zcQ*%H8Sbxc=8Q`XG9z4MyI&%HBc*32v(w9tCcVurUYKbQ*|rC8J?i|;jwJ79Z?ro` z(O^s&cP$z8!k-Ohv)K?gHbQltPbZ0$w^z8mQsK=;i^dy{LSs1|4N*1n#8i>CEc>bT z4WUxz5m1@8wF(eyZq6QEjSuE~yKUFk(m*jtDdb-EfM?r#^UYS3EK6zg&>GyL&^wja zc|YBDZ?@g0Y{8RmL;8t4MQQG=39oe%x!;Z9q}F)7&6CnH*yOv~qDv}Mu9X@-C^Dw0 zp)nfwyYuZS8qVBhe~miA1q=TQpCrjVF?+*^Nl^QiQ+OM|IE+6ip*X2U)a_I2|9NyXcq%;pyc z<}6JZ`lw6j<^Tp zrS~s&r&kn|?60q_ub(`9N*nH--fWI5FmrNeMsqxisyTi_Y!_9QsnYmyJpFNI?G_E& zYxO&0cX*TEw4}R-!cAb${6=?sx!Xf~yb0%v-Hpj6%K$ltO6x>utSx++H0Ngq)2+#L zr#J2o&^Dq`9rx*}F9eD!iqdXkJOoS*arO-g*WI}*V7pjN%h7d9K@ zGS<84Pvu7QExd;FEAFqqrudbUFz`}ZXt_!TcBg|aL6gfE5dmAkP4)VNg(2Q9)EQKi zdo)e$x>9>*^95}Mq*C?KGmZz+B4CZ}`1}IXYsj5;t6*@-H+Dw@=2j@vPH*1d?rLe4 z>b`O6`4p`HU9`Za(t9fgx@YtlH#6>`NuMASxv^ec+B(zN)9r2y&Z8u>HGp|TG*Bf$ zrvR0&*AV1iaA^gO56`1VlcnWtmYc(wTvOifG#z=8vw5!ur#o0}+#Y1<$VT$fm0l$2&F^IxDa0#-umh>}s9r_2QfsL>Gb@KsQ{$&L)p+Rb{i+2si`)shi? z&w*PVxV<-=Uq6|yqt1>7r#GI92ewAt`e-oNjbHMlhoIhf4vvAO53#y^9mZ&MVUgUE z(djE&XzTVyGAP-YOsA8}`ko+wEr@xlN9fCFq@2sVES#^=MTLZX@sR0au?~l$ud(|($*nM z3I<(IL9x6%LzRp)F}Cc^M;WA-)<>S&SyhIg)wERAmr5Qfs=KyO3bK^hr(+jTY7G`W z=w*mD!by5UKoK%Po4kjYHc{Axgyn73u#D4CUWvIAxddSXC3NZH9yp1V%EkbFPLkIrz3EETXc#|||I~(kbGrVDFiLqTQ0W@ta zTUc4@bUQ1DgzXIR#4jBj=4cn!ACm28IIAu&UJL0*8X&iBO~WZrvscs(~p`S z?`(^gj3p8$ErRi6bC7~~3Ggm&4*Dq=&lW--O$KP8cK>*ESfS;)vo~;GwH0_Xlx!ST zV=uh!g`Gr_=;$;X0her3c7QbIS_;-M=ZYLl$N$2*FQEDFqQystmb+=jcC9Bbb(W;Z z3Fubx2uWT0AsVCvt}^ZJT%5D8HEU@#(NIczJ!w}- zWk@x`?y%RZHxmArCM2&;Ge8ux!~#kWeiRDLpf+}`3TvDSl?_snWPxj1%0gtT*<~<$ zyp2gFQ29||r6MPwXJB$+IFR(@b@RJ2ZY+5d+J>ZNs&um0on1xvaXL*LG%0;i^sP+` zM;d=kPtDme;<+z%&rc_NyE8;x;=b?fa0gMf zT^q6(&dL`gDzR?5-vmrcsD!5jLW>D!v4nceS4RhR zI(-l8=r+ObM8jX{b#$PIYPQj2Ox{-Que!ZCt`QmTPqa?z{#h%Jeze}G1gLyhc4cpE zQi4)9NE0$`;fZkT-FRkNX`1A+i9=IKWMrKv?19Ko*7~dH7x93m$QWKCWV<)Q6AhKn z40(+kO>#e|0E`MqI6|ItkV>@qn049iAy%QdK9Kcur_Zi+r8`h8Ny@umRHP`f4YU$S zHHGvJP|IpipX=oExJA>GQcu#gVgR_+8=-(I)ebr%^oYYb8iefesRD8JR$S{}qR~gH z9=P2EmwrSjx->U)ojMpGpn)KTkdw5sT*3nZ3vfu2Qx06i)`!(NXc5RwhTFYkTR4Kg zNZZ;GgH=iwa#S*nE@<&4F~qm5XXLl3S?~ z)E>kQgZViOmyeaHdp@_9x|W+$A3Zxj z8f!VWULnWuF3bmo*)a*W8fMi(iI==A$io=pOXfhDexD{q-f_Xu3=y}_5vxON%XWHK zB(4756rl?yrzZMDY>sO**b$|ahqQkd(nUWo!~C0I&}wF_H`&KRhDhDr3-bu<46fi%h2%wR>gA>33@WREI?0EG zrTJq_0096zCQPj>)R zHlNiXx&jOpD!dtSps7g;N;j_5@&wYC6P zlB8bAUgQMz3vE{yZ%fOWQ5~wCQzhF&?xy+VYk1dZ>4p zm8mX6G9gjC(nVIapb5|jU!p@hw%Zf(o?u!kU;y%3pf}8wT98Kf5*O6A;IiK8T8We3 zru~5rXA*b4V$1=Tip#^%X5S_fnjYY?1u-$QPt1`GeeyY~srN?n*`hXTugk`GKo7TD%kIA zu2jZymWEofJxg3Pwadfta>q=XiJy~YtBA&DG{kzQtQ*ys>by5ZySqCIou<0IBkPOO zCvER3rZ@xcD_hZpMG0yzW&+5-(k6jrcdG=5HEx|)uvAc3kvK7r(B?P_sss+^fWDzI zx|0ChXt0&t&)q7+f&7ak(Bks5E+%5Tnqq0tzl=C_t48>v-g%W18C#?KPhU1~57F2p z3iP+OED&Si=kCdTE_&)*&v}r24Y=rLKLcl{t!jNHTC%O`=xtiH_CV2i?ym(2kmjz{ zK=Oq#*FM@NXZu-bv%QZue6aYW^|GSs@2d)SvhUL<5>0ChBKtC@A=P5Cg~M<1=t-jW zxu7tT9>$|_5)+ZAz->5Ysl9>k5+iN&b zp>Xz5p!$yMjTedrYnh-x7lSUCt(dNUnjtVh-o&y)YgT-?IGo5#8eV8v8`svrsv}lS zcTi%OWRyX4hU@KU{_b9TH;#Cx6Rl++yGHUjGu$3!25EK}{`Ff|28hTZF2cf)M}qwB zG>|&_JJ1)H{d+U=Y&ULDz0U0NP*&Ao9-~oc{^gPlq?ZfY-i9j~E)+rI3cRTwg+l9x zVBPNR>qoCYesZ=hh0s!2HZhwT_iO{`W;Kl$+iVBap+<#JRA?)xca5=LWsO~uHK>y+ zm8mX2sZgAVvRtR2*F(%_1HmXMBg`m=()(K5H)FO+jXWJnn5a zCfOYyl$XQAR&~! zb}AOBVtt1s#P@|$Yd!42o?>a6zp+}#`V?&LITXnZ9?t9G`;F%IO4r6>68KCLQR0G- z)&)!jrnn@InNw@PMb*51GH8_p*s&_9we=LZc_GCbh%OukQ`yC$O`V{^n5f1dnbgAmR%F9MDmI}Y0}d$s*7KXQ z<(SO8G$!ES@~GI>Xnlj;vdT9j04-#$k-0o$Lc$-7ai=xG-(7w7^4_~HroQzqPt-*KZ7+`M;%O>0Bd7# z!|B~BXhT4(xugp1t1R#`#0vEyde~88p?Q!^Loxxf+ru_3T~n-;LN*6UBvDpiV-|vs zC3_0SHh4W%8Fj`p@zuaG3JPaz;ln!P5rQh1(8i2mqbYx*fgYoML*+pEUc!z)F>M+` zt?wwID_6H|lB81RIAT${IvjnW&Z(s4GPLd^$THa}w7%LzdxhLj28Gy6fsQ`Mtpp@| ziupy99abu3*Xu{ClH)tQ3zezvVvx8&m?p0GBahx( z4U)wow&e{A+7b=MC5xzk=uKpuU6yej8Tp1)>2S~~)OueHu#eWJ@u_U-$}yNq%Ssxu z29hdpr8~cb>Nd+((RhE&O^l0EEGtUh0(lX02YY3@_iTvbKufzb!L(GBVDe1u&CMsj zJ;EXvma68#DA^U#y@-ve7eb$;BXy&TymqmxWcva(Fv$*#^2*}yJvk0a<>%248= zWg!}7Z-Mvnm^08y1!4*FSvbC715DNuoZ3H;Oao8IJ3*z zOv-42wR~txC4x@14j!arb)y7!Ur?dNC`6=9sjujM%502=id!YE-oxEXhlEP-dRC#p zXtkl=81=?2Ds<@kXy(&luF{JzOeJrzj$ZsBjn8A#vF{-W2)nHs(E6|Oe6r0-6Ke)> ze{*!V362g=?lY;NVUtuSTu>;2kV9DrHIW@jV6<4kt$WvIU^oblj)3VJTbSvXC***PC6{~b?ewsl3D1+ zrj4su%6LFYwTaR$ayy`{`kaABi)T`arRA{I6}k~Bl*|iObfb3$EK7@J6d{Y%9rD*i z0xOd3!Ghu0PA`n=_H?%Tifqb84>%nx=)b2d*`~eM^$F6{$_O*NJttbFPHLqGO6BR= zD@aGYh}rsaYFXG8*pQefck2)1qC!nk5vC2IqaDizFQAV`zrKKqBg-(MumZ6l&t$>Y zoMAJ|7~8(QCigDk{Z=w23-HkOLLns^Z!{NfH)>1NdawSDI2a=1W&5pVC=XJp9`1)% z(>#*o8lIH5L}ZN6$vCfz@w2yvNx^z2oHmnODj@Ie-KbGt(R=Ub=v_D(aJ+Tc6{tA{ znMCMZmI*HiA&EOxCFux)2wAGK8R;D8(Ct0;`nG@w12Tj%Gi-0Hy-J4F$P9~HL6%*S zzAMavlze1vjP@Gel)}Y5auBVGtmVNjdBl^n=SY?x z+i#G@tid!vp9E;orX`V;;Lgmtx;7q6eHsKsSEWgNiC0u`yEhwk>d_hvsOzD%4cmRz6VLN}ftg!-plPp`jAoxhnCu64lqf1SRBEVjAcwK^bC7qHCfx22txc@c1MGs-EA8kQzXf@2xZ(Kij90wd(T1jzT#8?6Y z*|c-8X-0{@q^L$6Y=eqEhEk6u!TN!>ByE%pc(?4F%2L9HU360wtb081;L?j)%_=~D zQVj||K9Qvon?hyjA3v?&o>m;SpljB{SRaG#R36N4-4*V*zy3JZ=hhZzVy;}3iH5PQ z>9rO4elG=PluWCEaVqB7s#Y^$=i4-UI0(2jNvCk`#!Ty#7duf%-`K4BDvXDEu9eF=1i|cD7;{cScyG9S{9Z()?0Vcs$(cJ(b%D}Xf5pF z>^89a-s$NLc#WG<)}DlM0omB*53->r38)EKT}P-tY!$Y;p2GUEsR^Dt+Ly4^uS*q} z`tMoBg^V!|C}16|AasJ>n<$C)bkAlL8DvP`CTWB65JaIZBNQAxXjVvQEyfxf4f?h# z!M6&g30lV$(QsXVlIjtX)bI}msSZo=%0PK2535C|14q;_3uP7tI#2|m)a1&&tw?rj zvLH>&-CIcAyL$^?WqtQXy1v>?IBMbH2nz+?)G2gbx{hg=CP`b`tg%PChr@bw9lIAB z-UrFIFJZS%O%}4}YI*t=C$3a7Ix`1rn(TR_SGN_=5gpI#L+CwL&dUkG(P^w4*QQ99 zYat`Hj@Uhl%SmoBJ*t@VE7|H|y?E-XTvFLtt?N&Apc!O}CcPZ?b9%55CBv;nL-U7m zRHi6@`{c0=lQT=b_ZD35T+2#sI&<;UHFmMn1_M6KH~1aPh7pOL1t52WQy~#=b6B>j z+DHghMdMknP!8bODNBM)C#Kw{IDN#?q~1wCBhy*K^JAS7@?2~UWbF?!&1~tN$RR$&TX$Sq&S3@Jx|x5#|tb?DvCO>W2B%Q4YdCXLzIBa+QI zTKf|nmKqeOx++^lT#Bs8GRF(U}AnMpvPOuT(2J!}(@1CQIRdGzn5d*hif{ zr095BbSaH(QFHxAov20}TRiNgMS0gQO`F}K7GnGQ{^3jNx?#q?Pu!C|B2>xwO zQ1$^Lu?n+*WMOC##R3#>;ao|Adb?P{TEJrIJRGNKL7U~kGysjrdWI7pSwYe2BlNUY zftitgG{X4XePndjuG!g~%i&g$X}!zwe1v{m4wk}y6J?X{8D`N^jk;+c*-VO*RXUk3 zah29?RO?#PTuGLjRaeqlIvedxSq1d^IL`%K5W#j&J{z_6@XK+u5fqzzYj28IJk!WH z6OBTDCqrkwtw96HnF`IXey~r$80u@5k}DC-QnP!xFeHeK*a1M@fb8zJIsypw!GU}T zQ(<-$Q!QJ&&VTgyJikN9g+*ZZcI8+lhcz9g7A>%D6DBSMqgj89g}>>$EvyM4&GvSn z!9AvhMJu$#Iz$=dCx|p;@>bG9bI8VKUxiFkrMKjVCEJn@iMY%sUMRw@@WTk9wiAqE zOfeq=T3scB>W;}vJ&=f*vR+y00tOok^Gn@32h$0sUUqwOq%qz+Op2O<51q?d8M7TT zQxep~5BcownK(`rb7m6_BFOU>S&m)R-tgq9>rdkiz!ACv^JBg7JA0T-ui12&rL-LfpM(P~Q)X0i*%Op7KPk_r)=!;rgEB zkoIYE>Z7z;5_(UQ@Fjod%%IE_o=yR7v^jx^C%CYCc0RgI!yEWlMy@BDyy~>nCZC(; zTpwsaKBX7GWuFK3xch_leF*Ve-;MaC(^m0I3M_tTn;pNjM~z=Pc^tnqPr_xSD0SQ% zDovz9WnwT)v~i1HGE#~k+OFdlBT3?C9j(@Sw0Kt+a1^5)9N~AHj*2;Cjddph#IVsK z{+JrV5#o}FtWc5a5CCUe0*H5BJ1+Vq@1xeLFgJxwhqW2o_RGRtSv^8qxr5vq=C5*4 zi{6KB znmx0S((ni$;--63D&-}$@K0Yp?UpzTVPSRBR5-c{i zMUd{^{I+Jumrv*lbG)zVMRbg*Q8}IN)ZAog=|kHY;9b#0_^2`X?1Usz?{Sf#k@QE6 zO?sdEDD@RLnj^K*)@phVx%|J`gVf|+t8}_OsZr^ByibzaH0-0(H?}=Veed^k(|Ad; zQL4#_wh8;VX~Fj9b9}c#=iReASEVc+%$4>y*Txul73U9o|8(=9cd0y@*j2}|;RT0{ z=EoL$K}*&0bywcX$QjOgP0=>fLU_{Z$eCG~DOD>@FSIU0PbkZug$7 zy~DBSs2(yMB0r=*kx!Ud0#;8lCL}cx3nYAQ*Yl}Qk6fwMB4^iaX?RB~_aLlqsEY}M z<2XHvi4*>|9HOO3kD!qXpBw0N(-ySWX#x6bD0ZfC9q(M51NsU0g|+LkiW0P&5VY}(O4mBf16+9PFPV+?$371NR5&5 z_3|!$YJMZ8iCDaB6G_aK88uCTCxX|Y!Zam)hV7~f)t6Vd{3O@2Jj()ZaJ>Yd4&(@! z1TaI{!7BUP6NM5tl=5;48fWndPdyPA+M(FZ%*!CHMciaKe#jz%pSjeFy~ z4fv2v$&{NOENPp;JS{&I%vX!bE-_cwa3lfraZ0hujCd5Y8u%p^rOx6oXe>+D{bn5D z>A6nn4W`u#Q$5T|a0{CON?>o(9d|OIhXSO@YUc1!2H7-hM+T(YE%|Ohk|wt?rntSV zx?>-^*cx**mldeCiIM)6xe$*ZB&wK+P|UKQrLT8xvD?J0udu9lL~X;GN$&ua1<6~B zjt47J(J$e)WV93Y0*^t)GYed)YbH%NP#KxJHJCJJ+4wYZYBEwdAt4FK7J1Wr*?6|G zZ_+@IQr!xWq@B_QqdL4!(dS~+ftP!HKo&mPdKL*LpcD4{*C()x4;fs~)O-ve#}m!= zc9Ms$w`!9q-Hof5u}m*y=iy;<+-{-J#q7P2q80)6A6ksstzd&ir|@d-22BjY8GTR} zyeDzZrZJFkVVX%@<>xdZ%^;UwLVG=>V zKl0^@ENc=POqxL>Je%&!Sf%b;M_-vY3G1dMVTUr8sP>22z%zVQTI{FP=cv7-T9j_l z&**|==V-miQeWJY)8}Lo#m49=aj=g;q?a2$d$Axk$!n>HgU@BN9w>ONQBY%QXKuYt zHrAqzTC_cs`35QtVq;CQ&S1MLw#mr1@?2w=<_C?W#|;;yMB3hS%uAg)p|jrvMc1Y1 zm?rnT$RP4AO+}Z~L&Cwo82F|cGuD7To3;(FO;>1|yh&TGM`(ptq1(W>4|zGuIAT}2 zCnY@ONqQdaSnf8B*MC=8N=gpY1?0Zvjx^@!3SFxqTkv+|WLSJb1xi$plv)bI%(Utw zujhPl+#M7W;y}Qkp!Q?(WzfBmHyv0`a8gdkAw`JSP>Kw%qdzcxUzNWJcKQrXHvn@E zKzqIBR~}YxQqjao4%%Q48qfySG-))3QuA;No~Jt}1}r3UH?!DQb6O@v9nlZk8$}c}x`N3Cl~aNPO=`?odvx zON$*LZ#{RTf%WQ~rxsWqhJO1@eiU=d{YcH+^!s+gT4WE4U&n3-+4eWjVcFNl&eZFR zY?q~1AEjq8C>%^Z90hKvdH*AKG~OG*$I2bOkNs>IkFp>%sTZx?`_*OF|4xgiez~ZR3#K$2yI(z6JL3H(+>`3eB_4tSg5vT=YFazRBPV zwYFv2G^j#o<*d7Xa`(h&_vr5MxMW%|z4|t&mLghqa^2*yBqfLqzlf&ki5UICFf9_> z%_AF2-CQb&d{R`NNmubKJST5O8rWKx4n}zZPhwwki-*x0|F=BNOM){VBIwdXoeD_3c6l_3;qN=yH*t$SlL)J2Zx{2~+ z6wD(+&F)sj${MZ5$Wn+74dxw}0Zrd0zniW>OYP!buf)dKaF>BryU=X_WhUkQ#cV2l zwQ%%^QZyogHfNL;sGLNaLh3F@ks2t{^_tEt#}B$>qc;Rs)(7)r3?kpsn_cibY9`#} zql{e{w75nSNB4^06-a@6gAR=wDnlQ;ud!7eKft&6!-~hwXYsRHQ1u5)OBFD$Fc0vC zp|aDCIUPqCi%w*Le^`P#x0=cBBoK3@{<@q?yn)<9I}$} zbICRG+B^W&k?d&qhFvZ3cvNdm2kKUdH=RqS>}!*a_EuYcYuOP`D7|$LSA{ldmMR_a z?&4DoX-$)vZT)hQuF-If&Tz=nNI|<5RLac?^_p4X(g{nER0^;5DK4XX*$ti<`|0Gi zRA!2|5?i1>k5rLZBr46R&3XB%b*Vn7v)zjn6=*d=GI;Uj;E1$fwC8tiqSN|076Cn{30M=OLD5mA=7HQTB}&y;G&m8F{Q%$kEFJWsMS zu1V$|vm_isSAXlbm-DO3iAR?af+c$QiD{%bY%Tv>VlK-vLv{Db2xrspA-1L0hF#c5 z(zeUWb`9+`m4C*ClQK z(Sto}yvB|;g9Wiq!RAu4;!+s?mJm*p3rH`K#eUAuX4t^#1E7@vBmOTX-wBsja`ayET5|CaHUA8U+!I|mX zn7&^CW+qK>Xxu3|IV#PC>MSajxK)#-?ov&FI_{xN#RgYYTG_7RM+(}t_|`zXLOvmoY073q-eYgg z2G~u9>3YobX*VV>CCeoJG?N#TPov04QC112<&HGvj39Kzi3XJejZ^|?mF~&6BBYk2 zis2Q!Te9s@@{%ZoN23wYnKX34cK%m!ZSK&JxfIV6CP#ICEzP1X9~y(>wCM1j?V}MQ zaJM?-uy*x1KAd~8Pd?JzNh6&8wwfc?txJ5kA4$7O3t=R z2%q$_%g&-uob%yA>*Sdv#+r4BlY>Bkz3*JW^5whN!!+@4d)%qIhg!ee!(w499xd_N za+^wXgk@Q2O^{}>gGLJ9(a0tDulClyBtN(09b2J&B_dCJ<<590KpN7YTH<~nu^P{c>*8nU>3^Lj>o@*((7cSAm zihsv^A|30!#a2$*Y0}rcgGL1$4foy#PGRltHm3UG>d@J*q8)4s_=?xYMNj8QE##r3 zzxCvD8I60A`e;%EE%p@94BK;%#uW!PVWVV|fUZyhpOroGTALb`diu~ZRBTr`DiGct zN{=dHSqDf2PLAcdY-CINy{r=Sz1$^?-dJaRN?dn!H(2umHFU=r4o~GEebE? zi+Idq)WF;c(-b@%Ub}tF0;Ly>_*IKi)77S{MX4pxf}4{~q_n8DHH20eNR<^V2;N8G z$N5wqzGinHFW+!VFKG}cFN{W)c68%2wnY1z5Kj-?lRQA2thR$MPe@%r!|g`ed>dJ5 zQ)A9Ro`GgkuWMjXpqCfW7p}ZIt2C#LtT}`00k{09h zv+^ds8I*l~ZhqA6J>|huZ?U#Vqrrlt2(%-_x*{Cm-GX9cVG0YGP(ql3HkTrW>dmqC z8B!jyVi@Na$Okw`=e_KjDJyMhWi#4-#+Gen)28{;%j=`h4t-iL91myx?}~0u*Q#OZ*c>oXUr@7I!}<*LYdWRxlN;Y3ivJGwj?*E25A6OV|#D@K{@FuP5(&$X!>GrpoQX z6*+dzgQ7g0<=o^J9@*j=T_dZXs>bMZI^4i2oK&-gv;OBYFm+Y7$e?LGF7DyfaKC&z zs?C(9rldU0DoDdcO!uU?SaY_ex0!0R_|(Hbi0TRTm0F~R7{(yNk|OviW10dII+a37 zgnda*sk8cE-=Z;}ve&rWL*&F%*_xsB3i(HFcyZypwpt`2>#37nT9GMTnvsqch?$cv z=)f^e!Gl|vrAtv8`W7I+Vr+)lGxxDs;n0q9z*ZRZE60{P>8Z8^#TrG=Y5KOeTO=$c zSy-OlXI6d^*G-iXic7&*i=Kk8WPG=PWrwB)xKdoND$mnE8L^~l9h#?rz9ll6lqH0+ zdnGTH7F{HJhjA$N$2$zjdL0(704&?9*m5~oUC z^@ArobAa6;4>tv*ex2FB9#3sX)5O9Us7vRpr3E?kP66ALzbTR zxfzzWqnUyiuR%@UrX_2o?<~p`Tw>XF3wmy;Tg&H(ZaHo%Fxza|z@)mq3~)haQR7*^ zvY5Kf4>t4v7VL92Unui!lBh9ggLRKR&gV|j*OHM!(AtfEhRS&-AW@+=xFl;n$ z+AU)-tqn!32}o=NVb#;d zQP-x!Ho>)^RkCxk2dvLtqYb)nU2lrGbeOlA=?sW_!U(=@khY=q=< zGro${-#V!p8Z60SE#ekjtF_{okkQqso{qL<5?{bt%cfwp0KF5Uh7rZSZ0w#8wOh~? zEw+{({V_JIHv?iH9HFKtZuYiE8Po}USJ*?Qw5PWta~I7d^S-Cj;mMn&HqG+TWyVQ9 z&4?Bu(b)PqId|KJys1vF$QMfrLpmXLJkFldMo_Bf&GK#K+wt+rb86dkCZbd&?C4BefAKKwG3z%2wc?R1NXKKJgV2xc%8l9gU2yyYIs(s5U(96bq)!02(h`Rc zH*ci5-v=IU%C=I><=eKC2CFnp`3IGGqGe^mdZWs6BeXqwB{`p0tGc;x)&% zYTG4ckUrMzql+=U-#AGpsXlsN9@RM0ocO6anXSMITTMC{zmuO{t=91hP733^YV0Ur(*_lzb<+V z%Y9nvS{V=&$~0Q^c8v^|3;0?_n{@S|ZZ;)cO|eZJ|CC7^lskGjiP9;Zy=v( zcyBXO)C6o20|kRK7<`@rL%ThkzjGDKzOcO}%$4s*y~<%FEH$jGq=xsqrtGCD60S_I zOf<6_I5ps&jsGRK{t-1T;r!;BJovKi&&SlJ9{kMXeQ(MWw3Ctdweqxdi~2no=~-s? zWF#A+&|#x>D;}ox?wOsIYy{qbFg{S;Oebf!!zyL7;j@g(IySIEcO#xl&+M(>c|S3omVK? zHP<&l8!iM}8RrB!O%x4dO~58NDpWRCAf*7=rZoM(+7h-+Yl*w^5Re*#(=oM}D6~9% zSX9EKToo>DD_%>*tvK;Tq$*Wiu2A|$qgg7XAx$u}h{-R_rMse8Rn6=I4jZYha8*oe zCcgb>_!VRkaat#_)T`*2HvzTeWKnE_Ns{SrpZm_z=L*lnE$+esA*zY>BZ*xTH`nR$ zR1=k{)M(nccR7D9aj;7+$pQeIS4ou^9Cme#Z5!niH@!i<^8~ct;A?3bdI25$%B+pe z#>p~q^^T0496=I*JZx2&z3{`9f+Gu`WsuAe-1b`6r69XtE< zGv`j5tgKVdr;p^;*Vflho<5cMi|grA>uZV2`nl6*{kLA?*xK21Cyyrvnp{G-xZEef zG55-fqo~hLnT0WFDFhpW%X}hs9bdwtyiIiJt!iu|aCI}Z1fjA8lOzV)I3a3NhKd=i zMUJ7GZL=U}kVhs1V?R$RSL&#6rXANX}XH22%Ir z-Z~yCloThd?6NEhn}8$M+`rsYhGsc)4ObE&v>UBL#5!UgBZqOlC4jt3eK`|9Nc|6 zxq1@cSC`%>KWXfk61LD;!D?Iwch+10rOX5EN<1At&2XjyGo^E@;s-*Co7H_)ta>=? z1X;pYE3i0zFx_gL^!cl2rP44FI++=cbll)Y)LuFaF!TUHc|Ca{gS(eE{j$wF)L>Q# zV2%fk^@p3-%1ZM_m4J+lcNOEDlMI9~eAV-QFuatb9EX$51LtmD$1K$llM!GKvO>Om z$b`i(v(Q%xsbEHWHXX=9kJMEtlys3YZropMds8z#!coX(yF%upS~Ob1yr9fiw%B-- zYabP^m}MeMQ72S0H4>AoWLV}RnaH%fd5>*Y8&Rjdz4VX65VDM&%J)l(M|)GBt9qUKz>R9y&~7~)bs|B-@nA+&i3 zB;j2NCnS)j8S}HA_40RIIC0eAgZ{QsN>yM&$s%rK%VMr0gWui8!~0OBPw)l(r2xOl_sTA zF4&PY(J{Nklo0G6F(EaPon0OIXSmrMY7ukRU4g9&$(Gdxs%iMy;S-6KhNd6yOA}^= zk{j0a9TD=3u<3#~sZcB9l7OHPh9)gN{0XfQ7TTJNtPX`b7-N_k>%ZLHX1+Ct$y6Bj z|6upJ`EG*!Kp%^XFla=f1$GldVdVuQ+NJ@c_Wz(-oq80Z39%uC>l>&%QM zDq(U&+>oFg)1RsAV61(V!X6qgCBJ%Z6B0udI!{Mdry?02vCr_~EAY#98xKO__4tK4S8 zx~b1WTQA?sxPXaC)YG`W8tBMRW20J$L+O)EUQq+ieDLk2MlS;$gu@oG%Vbv?(2-xN z^-%Ig-Ox|>!}J4J8gE9#UkH=N#?mF1S#9u!3wNSx^9r4wwk?&VMd_raR2nBKQM-S4 zksiO*AbA-}JxM`>bBM*Uv+j=6xH@mb`w%Z{j23K)(VMiGL6C`O>~Er%^h3VjK~DYm zFn?~-3hF)LQOdekOc~>Qa%=#W^?8#!N<-#VOD&q}+Z-QV8|cVH-c%Wy_jY7-w$;PV zoy=0&By1ob%;m6yb`!nYJzHq~mgm*oy^vp{$*wkjJc~NZM`6S2F739>d^GoOucnrr zzSvS_ach`=<^xe(GFy+?K1@DjTCF&!8hXe;uF}0y?W*XxusahA*Rpz{M8fgo2s#Ki zmsLu8cHCZAYv!yfNs&oq#5XBCslN1rx(#@fklK3)O_mkJtJ(zT1WigM-Hh0#(w&Hn z!tx>of}MAHN`Bb_wYS8!EH)~sNeCfgMh+voG9kwL8gsoZ4l5d13c$8^H<*sIofR~w zCEy!1N?2)s0cx?xUdjU3SXY5*WyX75!Ft?qfo^iWli(h@Idk2bIa_#U8|xI~ zQvwVHAWfFj2%8ttx5m;OjV|{FrBB*PmduqpjMfCXz@GE1N!NBer1mUtshbEcg_o8k z23^=Ql%V!362OYw#7-%YM9F?Mfz)1aGXb0U zZ34#rw**6iT=<)ynx-suNHADpEpQIV!ruhp^YvI_qJguo4@*G3ijAaX%}e@jVAYn6 zxrM>#fdTmnER3*mE!%l#YI`jE;d&)|=!1cFzWL>>E728_=$J#-*Y*#+^klD}=1xOm zdJeUtDbTz@{T&%1WS)FSGffh3&T!4Od=nUDW(g%}2i8zYCZ4O3)I*V^BWF#v=dsqv z0uOx`E1#BGfz(E*JZ5)sw)wd40iG^aBFIia)F4Ie0b;;^9-}8LTEGco(cVhUv(cpt z)nu8taPB3EfDc)`Iwl2*u_w;orK=X94sm!6nxAvFu+uwVm|3kwy+ZVv&sEL~L6kFn z`0S0iDn-@Sk4P<_z}SB2wPmOx%h&MkrHRA}pZ-QPIkp&2m)_ySlX9$0sq^J-y4seKiu8MRb>vbN+q}Kp}NzKvo_L$C}q+?dwC_4kX)oK;ZWGq)M&l7&5{uN zC1l9dZ5p<}ejC=k`Ix-E;g*{poEp?xUsl<6C>Ywi)N@SKD5*jQ%lPOZE3 zfo{TT`ypS|yv}>}K z=I%2uJF&Fpxu=vx`dcr7j0mHZT&DFAp;XyVkig9y$y=W&G#QDVDJI3qnK`*hS+R+Q z99V%DYI_m|D2xM)BwXKg>jOfo;Jf`8>PA8aa_^#_rmw zb7%E4JdLwlqOn@L;~YMzA`^;%v;Aa6l{{iDLb!nxtvTluqTQkyKiy3d5`eUWu_Xi5 zb)pcGqi)?ODFGCcR?1XU-UixC`R-KemDSd4g9Gw{HQY_@!1G*5e(J-QWwC4WjE^^V zx-N)kUt#pzV^s4b;%VLVN2lAwD)o8UCzB2gJDc`da{n!#DM#7s$H`4`^wvAP^SDjF zqKSX`?dscIaRWAG;8fHzc-2l}X)WRF^;oT2Y<0=)X~ow;>#@_PPOTj~m*N^8^gUe2 z1y~4;hMhTx3p1$rzaT<1d*>Cxddh%B2eWkx6?5Rb4{DgjZT|=jw&-Q!-i}q?_ z8w$}l9J}@G&1+dNBQ=O?ZWnGpaq=8y#*ZFbvx3(5K`bz(f>#W2-cu)!H|1qZnvWxd z(#OuDt4CdPGlnrY4>zVbUyaZ$IA=%JaIRe;BKwn0#WOHvcIH5gY z0rICe4LI5agOSmt?%DMmS!_XYlw`Dr7-ca$bL{AW1-uOloz>M< zla@m290@F>&f&m9>KqCzq|QoUA$1N07E)(9Fp=(QR9%d>bb&doUQs;1BA$1M~7E)&=u#h?j0}H9M99T#lR2SY6rOpzirI3~viFHC+ z3aPVth^d6sITBb%ox_2J)HxJbBdrkY9Hg`qQfE1^kUFU1ybns9B}z*nbru5)sk6F5 z-;g>-0t=~gIIxg9hXMU?Fu@0t=~gFtCt1%YlW|L6gWkqO`n3sS^@DH12lGi0=SW~7bq)s>Qs+=$A_+INVTAoP`w*v&TS-g@r(BN_E3M*4EZuf4kJ z68cbLA)!Aa782TaVj-cOBo-1{8e$>gT_q;c=R;rI9`&D|A)y8l3kk(bkC0G+#8!{c zBP7rlVj+RP5DN+Pg;+?SFT_FueIXVS=nJusKwpT31o}cOB+wVfKwqd03G{_nNT4so zLIQmu782+Sv5-Jth=m0DLM$ZE7h)lSz7Puu^o3YRpf8SrzEB$y=nJusKwpT31o}cO zB+wUPjkH1x^o81xKwpT31o}cOB+wUPAuTTw1CgONBoG;5A%Vyc3kgJqSV$l;#6kj* zAr=yd46%?vWQc_XB10@B5E)`2fyg)pB13IRATq>40+AsW5{L}3kU(UJg#;o)EF=&a zVj+RZ5DN)JhFC}-GQ>gxk#P(}hT4!oWQc_XB10@B5E)`2fyfXG2}FiiNFXxALIRN? z77~aIv5-Jy90QS|HY5-kYC{5%A-39~M@S$t#6kj*Ar=yd46%?vWQc_XB10@B5E)`2 zfyfXG2}H&*5E*Ji0+FFMBoG;5t4s6<2}FiiNFXxALIRN?77~aIv5-Jyh=l|qLo6f^ z8Db%U$T$WfLv2VPGSr3yB13F-kscv|$Pfz&M21*MATq>4>Z}A75;zL&LIOu277{oL zv5>$~9P5Mxj^Y?N3bi5O;09u=tA~SkxCGuoEF|y_Vj+Qd5DN*sgIGx59mGNc?;sWu z7zMGAz$l1?1V-T)2phE_fs7Cf3EerdkkBDAl|z)!kq}#BR~w@ zJ$WQ0R77GS;i1waBs?}^tB2_k5)vjB5_kl$kia8|g#;c!EF|y=o4 z5yV0Qk8lh;g4&S4BZ!3r9ziT5@CafdfkzMvsk0JTNMIDS3ki&ZSV&+L#6kk2AQloB zg=1h8)P@8`K`bON3SuFFQ4k9WjDlE5U=+kc0;3=n5*P)skiaO2g#<=HEF>@r$G|A4 z4GD~bSV&+L#6kk2AQloB1+kF8D2RmwMnNnjFbZOggzCw$7bOHl90QM_HY5Z@h^;QW zv=kC}1hJ67BZ!3r9ziT5@CafdfkzMv2|R*WNZ=8~LIRI)3_OC`kia9T4GBDg*lLF! zA%RB_3kf`eSV-Uz#6kj(Al66+iGe*(8xq(9v5>$X90PlxHYBhIYC{5hAhx$Nh=l~E;24+!wIP8i5DN)Rfmldj3dBOf zFqBwG7|0O|2}2=bAz?5LILd?K%2KB*Khxz*dQ$cJiKBO?Qy-mz4QVMPFc4lfBrp)iz(A-C2@Hf- zNMInuLIMLJ77`c;v5>$(h=l|OLM$XO5Mm)Ara>$u#59P71TI1>Bt$ZZg#-pdEF>@x zVj+Qn5DN(mgjh&mAjCof10fa?7znYDz(5=W1EDq~Fc4}(0s|qo+M!2CU?9Xo0s|oy z5*P@vkibBQg@i~3v5>$;h=l|$LM$Y35y!wqs0|5RgxZk6MSyAiUbazRkoBgr4rYm# ztCW^P0z+ZiA%UR~3keK`SV&+f#2V=!G4K*mEF^FkVj^X;EV{%> z7PQEThnO|m#D2udSk{TS3&;+gLju_$781w~Jwn1n3$fKB^au%Lhge7;JH$c)*&!AZ z$PTfPKz4|Q1hPXcB#<3qA%W}=3khV$F_0Z<|kHWQSNtAUniD0@)!J63C8YAUo8C1hPXcB#<3qA%W}=3ki&bSV-uFiG_rIj95tM z6NrU`wv<>%Xm=dLo9hzZSK5VyYDz35JZNGep{R(3go_ai2^5D|NT4{xLITAh781fD z#2RUd7^sMAK}Bd65~v8VkU&LEF@47Vj+Qw5DN)Zgjh(RBE&)h6(JVV@)9wS z5^6&NDIpdTNQq;hBGiTiDncwIP!VDwfr=0d2~>nwNT4FbLIM>b780n4W1u3`h6E}? zEF`Q6Ar=w{2(gerK!}9|0zxb#5D;P^fq)PT2?T^#NFX4@LIMGC36pc?cD2~>kvNT3?TLITww780liv5-JD90S#$HY89DYC{6mXzRxP z>r`?Y6OLuLbTD0EypIk$XR(%dJ{iN<>4;09BgBqS!V*eihbdtZBC$i1u%M6F3MDL# zBX*DymX{G*ri5i##LxgbH3|vLgIGvl9`pza%!AnK5qg9K=0PkZFb`rOfq4)M3Cx37 zNMIhsLIU$377~~Tv5>$#h=l~^;TV_)wIP9d5DN*+gIGvl9>hWd^B~qpE5yJzs0|5x zgIGx58^l5a-yjwe_=aQP8`P@QY$NN>?>q!m17K}`f3i281GQskx?6JiS@Y9>#e#J` z+6kXI5R1_a!mzR3ir?q;TySW@&yTPHM}h-0y!cU637v;kU)-zg#>a$EF_R4Vj+PX z5eo_Ah*(GG>KS9 zph?6+0!?xZG>O`fK$EBq2{eh=>LNWt0!<(v5-KRh=l~gL@Xo_ zCSoChFgXUoL~TeQOw@)1!gMfBTi`~x<^YxDwExi^w>!P7T|FP=Kz8^pzHlIirZAo( z$A!pNH2&6L3isfq3LGaP$zsow9OQ`uI*;Cb=2Un6%-XT;33xm6atX|f*bz!#Uc?Sl z0`nqvh!U6=u@y>SUc?Sk0`nraObN`37zS$Wekg%?5eo^-iyk3?c@bMZLXVKZyoiMa z=0z+dFfU>ufq4-N3CxRFNMK&XLIU$577~~jv5>&L90T*BHY6}FVj+Qf5eo^-i&#it zUc^E|%!gP=;9$f;0tX`&5;z#Kkifx+g#-@f7&sWUAtB~NEF{Eyh=qih53!IC^C1=z zVm`z|Ld=I)NQn6m3kfkFVj+R_5DN+P$1y~Is0|6xA7UYa{tycZ^oLkTpg+Vy0{tNt z66g=HkU)Qkg#`LTEF{n$Vj+S4I0pJdZAhR$#6kl7Ar=zo53!Iye~5(y`a>)va2aAD zfddc=34JHAkkAh~hTezTkkFD-8xq=TVynya2njDJv5-*3iG_qpLM$W{GqI46QDPy1 z{tycZ^oLkTpg)d*{!kkd=nu6af&LI%?a(76&>vzUf&LH+3G|0pNT5H&LIV9E782+W zv5-K2h=m0DLo6ha9>+Q%f%FhtU7~b^(o#sEI!rGlP#t0+f$9(o2~>wzNT52zLITwx z780nAW1u?Jh6JiZZAhRx#8wyS5fZ2lv5-J@h=l~ILo6gv9bzGY>JSSFREJndpgP1t z0@ZO0REOG-Ky|1M2~=k}8{^83{Z2}7^spz{iQeHx`LhF@9MEaJd<(c7$s)&#%HbSY z3VMPXz`b3-GEZq|IQ6%1uHboLNSU<~Djce2XH=v)(QWT?@(wm5ZD&4m&RFm?-4UOu z!%;qi(y5r8pPrq&$d~Og(FM@v=n@JB%qf^lpkTy~gmjn^h!?eoD1ms;)sQW zxj14WVTz4dNT6H9LIT}#4C{%g4GHUsh=l~YMJy!HEn*>oZV?L!bcpj*U30^K4O z66hAOkU+PHg#^0g80Z$YA%SiY3kh_KSV*8-#6kkyA{G+p7O{{(w}^!Vx5C33SUb&@F010^K4O66hAOkU+PHg#@}qEF{n^Vj+QU5eo@)i&#jYTf{;F-69qe zNEWe>K(dI11d>H8B#y#fm#s@3Dk;MNT624LISlS780nHW1v>lh6HLw zEF@4XVj+QA5eo^_idaaXR>VRAwIUW0s1>o0K&^;{1Zw3Ns1>y#fm%@;5~vli)n$5w z1ZqVrBv312A%R*E3klSUSV*8kjhA{G)j2eFXQr#pt8oZ67kD^eR0`aNQ+9eRX> zhK5*3cvXpogvw4VBvc_{A>knq3kjJg780lxv5-Kmh=l}dK(dI11d>H8B#aQCbQKgo>$z1VTkjq-;G)`FYcYWt6*j?~Q~f!1x9wFfH1Jgl$ZYfoV}25||dS zX5yk@MN7daTmqjUc7zf_I>ZiB0<$1?h!U6uu@y=P=@2_e2_YR~%ajn(A%+UZTc!k# zK`bP240?owkPflcBb1I%!p3A`hbdueFR??Eu)B%a3MK4rB6g4xb~h1Qri9&1#PCw^ zJ}7}%5DN*+f*v7ZcN4MI!}JIV%z{`*U>3we0<$0%5|{0nEF>@sVj+Q9 z5DN*+!Z9!lYC{6EAQlps1+kF8EQo~!W3Cx06NMIJkLISfO77_wE zj)7xP8xlAMv5>$qh=l}>K`bN$a)^Zlwm~c;unl4%fo%{A32cK{NMIYpLITGi77{oH zv5>$qh=l}>K`bP23}PXHV-O1o9D`U$;26Y00>>a05;%rq;26|~1dc&%NZ=U6R+s4! z5;z92kiapBg#?a4EF^FYVj+QJ5DN($gIGx57{o#X$8ZcBgW8b5F{lj*9D~?uhaMq; zV-O1o9D`U$;26Y00>>a05;z92kiapBg#=KidI4R7E>!aWlU2}*i|1i>*- z6KX>OH6gaT=n|+2u_Kh0LPFGsb|E3^Lo6ha6k;KPq!1J79!ZKDBQQj_kPsLm782+R zJwgIqaSU{Y+K@n3mh6bWqc`7hT0c#_n9>(~i4Y$)2IQd-mq1;J9ias3LhLXlP#0o{ zLRz5&!b0sqN+2x6mMMX-5W@jJ?C2?hun-FggoPd@BC_*eG1VxC21nNR8Bv2Q}5EP*{Bm_mMJwge4x``d8gk90Z4pG9s zVqzikU&_7g#^OFR1Q(X(q>{S zl(0;g*g;BIUQ2A55|*kGLqo(TLkTp6SV#zp&?6))I3%`ukRBm{un-FggoRj0AS}c} z0%0K*5(o>ikU&_7g#^MvEF=&X$3R%94GDyW+K@n4h^;QuBP0+OVj+RB5DN)}g;+=+ zEW|i)eb#E0%0K*5(o>ikU&_7g#^Mv zEF=&XVj+RB5DN)}g;+=+ERG?nKy65%F4TsE;Wx3>C3=K}ksz^??$B2c5 t)`3_^c&mtogxW|fBs@i8Dj9W*4=q@$gOYF~+&|4jLR!>@1m)s^{~x`|qe%b& literal 0 HcmV?d00001 diff --git a/curl/lib/libcurl.dll.a b/curl/lib/libcurl.dll.a new file mode 100644 index 0000000000000000000000000000000000000000..49bdc45641617c744e8624222415512d06d63d48 GIT binary patch literal 21386 zcmdU0TW?&|6<&lC(v-Gon$ki8m|zlaxq9p*;3N*YkdP~hNoh(unb^l<#CSZN8Ji#> z74g6WLI@#*c;X51h!EljAe9G%5aJi`fDl4?;1@*DZ{N;Yd+l@P?Bg+!YU%U#TIbt) z?fYfz?RzI1-I*)<*KQy2e|9j@{LO!ljMR3I?J<-~Yl-N;MEAczwB;Dl1FL}_3?95l zr12F(;Grptj}Zb7k6OHq5O@S>X}p3^;kv=rE|JE!2!Un&bFsDOA1;}(2 z0~;(}L#S}wV5&o;fjXT64x+s@zD5WPzEGgun^pPXlS308VbQcn2YH zYK_H92on&bJsPLn~Q$oWI(j-Q=AbFSWMUY=R(wzgiKs8PLs`stG=LlXUmu?%PW*wd#^)DIt= zK8RS&`A%IWQcoJa7wa>vq|sjNP^gj2*~QM4MtioEFm9%k?4&o-=y0l4NZxZvzuBH! zU}-vyWL`-cvq_f`twQpe?Pi~`v?w|4NPP;MB zYa)xKKNQ4Mxd}~at&GuWEcUnoBL}RcJGaoCXK8kv^t`OteJ9no~3_ z=5gvXmjz8}Br|ExETogFw(B&KIoE6@!gi|4<7RW7PF8W{Y-c{C-7XVldS<5XvGO>L zWM=(FrzU%iR*IbE=Bl@NS+xf@nX07C{)=v%)5&X*bG!~<1^&I)_86(?aePWnDvPat zQ+1;{U!&)xmZxdH^?J?c+O}r7CSZCS1(UE-1>CvWbd(vUQ3O297B;`Grgav$I*6lo z3-vDc0zA{1GKcTB112j$pU@`VQmD5bZdx~mUUH(x@ka1c z&In#gN4`xamA!O&enL)UoX%qJikTp>Va;Z{P+b^j(JrWd6lhtD-jzl-@t1X96>zi3 z*%0MOG+N&OJx!2ax---DWw|+ht=DSy`t?SqlWs;m4Nq4y)y}EjaDCozQypi+*1s1U zb}mr4(UQ+-`xGlOPP%8*rAQ^t=vosvwDA^DXE-+no5)Pz$FJj{X2yhyqy+IDQ*QQM z3F3P?pR4#vkl$Usrx{6GhcTCuZZDmIoDhDmXD32SG8)Ewp@(gs+X*?r|DK&<@Lir^ zpvulBPN?p^s-@nm86tY)e)t=<5UqZI=m+59gG65eQx6e+42(WZ^fs{e5u#Us>p*ua z(YL_#Hlojf+IFJ%f!lWwy$-C}Nwfr91D=I{;d5YO3>;v6jp!xd8gOBp=nG&HKAVq$ z&AW--1#a0x)Cax?F6>2oK>3G01U5ZJ^cJvs5**+=;F*2k02A=7d;n}XK=c}L9q7PM z@hx!iAko*r)Z;{-0HcS9-UHShM!A6NK=%l20vC@WU%>t+h&}>FjuE{H`~KT|ihjIZM&udpA z-9)QsHT{Zip<8JU{hHR&Z|FAqE&YyuPwVIpw4VM*8|Y7TJN=pdLU+)e^jF$QchTK+ z4~@{hw2AJcQM#Wt(-wMw9;AopVS0qN(l**oJ7_2EqA{w`I8D%Q+CzKkQF@FfX&>#U z12jbk>2W$lhv^6%r6=eZ9j7Ph1f8T)behi4S$c}j(RrGtr|AOyjh>;u(?$9RJxl+j ze^H$-QG>99|G&@w&6p{c>BnNj*>hD%eW?>lM!@{0XBers9wDig>y*w+tg}caR>Aor zqYifKNVc5ubgl<@X=MCx*Qrxb$7Sb*38JWPWu6roDR0HomI_@YEQLXy5J3}*nskrg zvvzW@SWpf2WpJ+X5Xi0)?U4wRDt0z7?tI=>v($aS6L3z1LEZt$FF*JPF@#G=pOgn4 z;$;ehkLi+KbO`6X-0gMFcG?^b*wLCN5_Mz_B19aAgE(bJ+#tf>^J_qlJC+8~>>;#3 zA9Jz{qq@Ch@MZAfFrb&6{CI@H2Rn~B@a*O>b9$41q*50HEQbGa(0PkRia1OK?7Yo+ zj z1Gg*5D0V-RDY6r^PJ-=0GETO^D7dQ1JOVlq%NN&8!Ie^Qd6XTmbTVdVk!3^FiQP@G z?`$6-wBe17n-DT$+M}3?-?6aE6t_pvOeN^0Kb6$JzzC@)+U*6j+U^3(-~PP?*JVv3 z*L=>(xqo2S4Cw`ej*_nJM&he_rV%cACHkI!=g-fgq^q~D%DRPKoU=;u*6J)yR$xsK z(Nk}E7J>Q6Jr`EG4jZbQGmT`{*L=5j;JWq(o>{idO3TthbLP36v(=SxSrH4J#KITs zuc9n1J^)PCirlwu&E%1-|JM1WYy#e}FgmwFvdDRk)4)Z_JfZ1IXwpc%nO5}LF7#RQ z&;D|jUV{5-=W8^}nAe1CWz)v3i_csSbB$LK-a2Mjd2T(ob{R&$%N=$8?4njG%~HNE zFM~?qdDha&M14^!QW`H^aka*+LR?^8FSqjO&k(Y?*14(%zVTr1Keo-bTHA|WVNKL( z`tjA+o?Z5x)}^(xudae83%(!VR{a;=Mm5#EG78U=`PqPA7PxBVn-NaYj!!KQ-Y4_3 z4gsFect2A#@~Nk=!fgnZWtEoseKUMC@J(q+lt@wZ7Zu(Ftn%`xG*_HP=fmdNN3Em+QyXxIr9Z3Sr=jJ0HCD9ccJA8ET27T4FN^^5SK4y$6`CK_a&Yo_ zKdR+C1rt>5s~=Oxcj2$XS4V3_8f2L^4^}4iG z6|cof_*?OWN{fE^?uBk(^HeV5xEWw*BlW)V=bur6SC!#S*18_xdjI6+6;X>M7mTyzlry8eODeb0L8vF(86*IE-^+}ULF0a?eyX7@7PM$MUi5ZK znyWrOqifWhjio^$m$zVa`SjUaB)^RLCwj)SXPe6tf`wuX-vqaC5zhoTleIOoi}2}H*<*wg{(e{#q3j=Mg2ZpRAu#c z9FLhhtySyg9o}Zl9?IG@Ze(dv$mKmKW`;@K)FO4+v@2xIU2zX>Ev7cLFWbGwAKGHf zj!j$CZhUF3`pAebp}QxLCWTzyg3%V;J%q4Oz0bsqLtUroJ%=<|y zvs=tA)zq!IF_wj_Zn5BG==n8`MeP35E9v3w#_W!b-R#bLc&jnKFlQD2$0H32xqPg| z_n{*9V)Yh{FQfjCFi|F1=F&1od8kdD`mYY8;p!!gpA!mPe+*D_KVO995WD#x5^@eA@qLlqQ8-UdpJQSNd{DB)^Oj#@Q=!4OH(nQ9C{N zUz@UcLN2e(s6Lv#trF>1ABS0~T%<9|4>oaLq$mOjW zGt2p}+k}Z_jE|Te#GcPdgF-GZW6X@>J+7@D5$JsMC$Mwo)@$RNJ{n$Ty~Z-hc8-lR_>Z bcQNhfUQvt0tB<{?+H}vfZ)@MS675M+3&y)wF?2D|= z^trsl8uiaUzpAiC(ev2+|Ia?bFO9OYKDYhF3exlX$5!yohs@_sv#j91>iKY~75qPV zLWL(wtbY0%i z*3p)}Il60LNZYsIkipHids3dSFlZma}jjLK3x&Q+s$hy+a7k5Z?W0Sd?#8tZ%`NRJxgu%ZZJph1$+doAbxA)XFizLqlWgcocDFRH z@}tyzeQ0}HlF7D?%Y4(X{Cw!Bm>RmeJ6E;!cuH2}MfdlkN2GqK?IL#{{AHbuYrr(4 z+VPl#j}OfnNN(qv23}MANKJrG2+8iowswe2b9+mNr?61_8vVj#?mj`aT#;<)=xOWh z@FQ|PeJC5-lRc}O{K$ll4-Mq#vNqqSgpUu660z(I^FnfklF71_qN;Q?u5IsZY;HhR z=xl9;lzCXoDxm=Td8t(NbhR{j0HO-#0r8~96Anv*48`N;jYH(egJL1LmCxfV!f^c| zWsEBx91BHO#9V$^=tVp-ggj9#9m#ID_u=&{OGqVtiPBpKkH2J|-ah2WI<*H`LZFr+ z2PJP8{Aop-;ZH46XkvV`X|x~yF&U6t$>nv~KM+yRb0*is_$HTEeg7y#v)~_vQ5i&g z>K}}(F|yJ153g-?LsMs$D`02{S}spDy8R&>nmSi?HFmc&bfBkJajDL;r&H5Xl&cXa zMY6I*(+Rj3H#Rq;7~GzJMXJ?oTBU=_LUQSDfnuboXyj(JeiGz1X5_M_8`_c4X~EUg z*(w(!Mh+@fS!XEp@$K!MZkxv(y~*gw7OP5(CnDya8A?w}%NH8j8=+iuQSLQ`i$$xq z@5}+5HB$?R6`3v#D?8ggz|L+D4h}vrkK!pfLYlKFPQpX)SVRI>H+D3+(!?A)(D!C! z&`+BZZU&!(ThGc=5}JmqA_(`!WD+`gLtCZnh^Oy>6svSMvRYdiF$Cg{}Noo*!*DHYlPF+a&wy|%{o2GOn=YQ9MTIR%bne+0bL zB3o1Kt!?e?Ev|5g055AH{Z=3CXdcu^Xrih4u#)X*ThXp}A(}s=dUac8s;40brnQZF z=%$rzn#gKFtZ8Y(kkDJUEWN2!D1@$-j^>t*rnL<@fI@L^wq|v=w00%CXLWaWx_phTu#hZ$n-K~T6ys?l+k#3{EV@h*H0U?we>W# zLS5EGtEGpj!pWBIRc#$8*@hnOqH-pFH)J5(>}7>OIFl>UVmJ15YE@E1iL|U*tA*$(A~Hu!@H@y4U*W<(UQx{ZO~=%U9!xqu|B8UH%QkjGf3AjGe~{d zDU(2bqS=-RW^_V;1+Ox)OGK{vn&I8l-ieVRuPYgz%`Ncgl*N$YtSAe{{DrwY07FNj1avbai%skNJR^(v2=6e~NrUb&D7&&yrHnMer714mC2$3i*+K z*@Ggfk|@6r^pQpOP!JWHNXVLEipCgP$npfGQ2evf0%B_QxsXCF&jk^xcP@xmtdl*0%SO<*D;G6~_+(@@qfGPwp+R)CG$m=0BUhkQXOO_v8DU9}%*wQ;5iKhk z<;?aPagtJ$5teTRESNQzW6Q)-PCY|LDHCk?Lu}26MC%b!XmlHVK@exj>g*t?+GUHy z)4Q5_m)6V)<)o#xl?noyG4X+=s{so8Wl492SmsX4gG$8@#JNNq`EHa#yoO{fC=}^3X#En)@NqWYcP=+f1IdAGzJhg zI3p+t$Yl1N)- zZdW#TTqgAwj1T$Dd?pNS5{-&5L7Xi*N)B5(Xl*BG^IFVkv^6y(8&?pGzN(}12^1LS ztZ~zbJJ9af{ssVRuOaVvhk#4%W)nOlG<|%D z*o2W^B>J?578IO)!_lW10GBM)mfQ_jBMcYpimrji%AuY_iKiOo?O8NBPYxuNHwV() zlYUXTPX^(K5i!5^n#2vrrJGuGaz(HA>|%2Pdc_k? zdgT&MYyi>OfL^CFOFyXryIL^Xrou<@G^MZ@g6RQ1FmdaK2Jh(P<6tq@x~lQAHg^%t z#8Ic#unHq;V6>%Y4Mfq>f*6(qF$2n%MRLT=^l~=jRSHZ)a&4E}ace=ZNVTD!;QASty>_Ymp?Yr4GcjR!B=o*ea1qd+Rypi&OVd`p0mq2@4hCYA3; zQlh3sB!+CQnC7L;UZmbsmX{UF(V5;ZYE)GATn|F78=Gm@KqEQ|HZq|fYkC@>NVP$S z)$5QJ054ls@BcH8Ga>9^XlQ*H^C~nY2__SfNS+ zm6$xRZeQyUX0n=Rzy@}tfH5t|*WeAR5t0s~whmT6pN^OfTbfp;I%t^yQ(<{#Y(-0J zCz@`a-u+><%H*da!r*kj3Kp>m@#JeJdFBpeD_UrSm{6DU5zT%28Ng-`%*99zR*`o%VL)wkxXQ)lA9vFGUGBoBcv?MSK@Z1n z4UZ!YgAkF&6&ns{0H7(H5IQ8W0eUV?NmVJlaBsz~YJZ<>*@I33mBiHaNl_t3zCNeo zkj~B6+3b!Ol5H5&c3=-sk2YaIN=9?biqvHdtC8G}WUDLdJ*^@s#P4p*=V3p+<#BAo zN1Dz2i850aE)S5s2B?Du)Z z(u%4oc4l$;_`@vA`ev796<%#wZ)~!xnwu@_$G@?x2i~)+y8;2LVnV>W$R1^NTt3RG z_|+(D{$r!8QC|vLf4MDaef)aRdg#rdHS147Yw3qU>%_v4byHEuDmpb})yxZ7`{swN zpPw1BE~pP#cP$QCKL}XXMEo0LO~SwN*62_1Z#?MSe`Bq&_*GyX!v2M<|I2@rstNn` zk9fiVjYK!zn&SCKxei$<3*+BGmiy1;#bhg=f5c1vZ=5yG3i$jhwD>>DY0&t0s73z{ zHvS!89e^~t{|>Z1{XaL9|4Z9AEjQkDOa)KI!=0XqC$UfyJ)QmMX|HWfjk3Ovqluf7d-}EnB`N1kf zstq5bdU7Ae3LgsQ?t@3V#IY|QBG=Q0Qfx!>Arn46G;B^@o0{Tj=F);axcV7Y)5|Zc zJWp$R4|DK<#ill&D20ztjBNPlSrO-FoPK$gei>`;8omGOv;fdlsZVLL zsb{~k%yC{-F(Mb8-b08a$RNd*L%-B`Abt^OEcVTi?(akI7J(nN=IcYN3c)Ao%Fl-` z$1zkf_hFv?@(6%0#_fbScLj+5(3WWpU(xdTpXw4Jn3ycl$R;UgNTQ|4iDB}W8zE&P zKa@}H6&X`vE95VCc)A$nL~0_F6Q=}(?UnE^Vui^sB!S9OMn-dxrQI+wK4NVG4B4jX zl9Bi1utn(+*2uGNTFAKxL#=XY2l2Hfa3eFCJ0&~E!k7n1D?<6B|5Xe9TK(11v$EMO zX~Q|kev?nJg~TXiEgo|BO@O{Wtl_;IGd`mo7<}uIx3sydH!Iq3P*p&rSaW8l=%Ck` zLpu+~+!!ELUkT!y6*9ulwueD(hsY`G5~NRWB0lLn!p<2lb0pcwRY6CNTorV5&Z?jT zN7zqdRs~7usS2)hsm^!TIm?bCuY5=Xk3?(EMg`zW2N&H)+5Iv!F>Y+Ble6>Lrp9y4 z=d)v*Ii}m?e7aXrmT`Jd6d7r4K+HL3{Ig71v%qst=;yJuGUHrf#+h&b%V{#My`k;o zDqrl<8-1um4n|3H2h4oC1xHSv*#>el_IJ~ojn4{=-|~-95&OH} zMyhQ}1hpjQv&Tnb3}q`zU?XqUL1?Uc=G+8DyK2~W3V!G{*N&=xZuiZ8?)3U}dxZ95 zi_gg0xr|fSMnzVlMk`xplcK!xICZU^toD!@2eR3ugA}a{{oU8s?VWJNnbAtpZ|{|4 zM&5kxMDtv7W+v`(Z*z$NjMfsrJ(s3=mNM0NjBRtwXQQHMX-&?X!5Hnl>6LYxqdaji z@-YNnxFgxrp($xr0I(k?y*UEhs!SybH!$?cS z%)1*sTaEW!R?l23=RxS5h;ng-RcysE4i$`W3W480kmJxNdHJ4+Cl6zOQ0}554|g!H zva5T`+UV=)-+D`OxrL?&Yx0>FDY(8mt1@Yk0POtwlv~@F_Sy4)wspzeLX*Klmj#qb z6Re90FL@IUEtcaM2?TMvcyA>M`6nyhMy`^lGqdN$ik9^FpummuB&DEK4_7_+;_)hxj8}}bjROM zc^00|gpP13+^-WK;Z~fH&b;sMjR`KE)kr3uo^xoDiTK)thM~pL1 zhKr13zm8#~8^~z7k64zGf9a9gT9OZSNWLWGkx2sWERVa1SfhZ%WWAwEtoG)DNbNWm zMlAK_g0Pj|oB+AdE7oUoV)fRTXOXx`+XZy_UplXZ~V%7u0aho^SZMG_wDDn;Z;pYVk!a$g-5t$)q^%?p7@PQ zP^oaB!rv$BWwOR3qF_DseIs0K%Edd!-Kkk`UCrlK)vTAfiUjHxKJmP>?mFKqRsAnp zHRd%%L?d23D;uR;H}1-th1~kd(`?ixihYE8a8)JA>!Mv_eOTO(XvHvvZ1tvr2CaLJ1y*inYuXQcQ+F29pm ztlmgsww#YfDC^lS);xL8erLNpN5<3+)Gm zvpQFNUU3Uc^BxzrOyY54vx6QtEM$0GcvIqWR0BQYhsRI!qh41g6CTHvE$v+`-5y6; z=I}VJY|e0Co03*FW+J5rJJ0JO69VILm6eh0Z1(u^m1>WpoI>mIxMP^&aiN7~j}u$p z@woB12alszoAS6)MesPWLyW?0{A~Rrgpd^dr~Wm+k~0I*HjVYZl!OBkbA!M6BZFvsg2n4Z+=Otm6JzD|&izqbzG3aI;G)4Oj%fYDXDP zR;2K(<+Dqo)w=7+_|Xg;zAnZLjv8`Yb(A}Z_jCCBbzm+JatDPgGlH`Yhxe5NBS?98 zmBsQW`@0M8Tm5j+N+aT<5NAioAm!nenQl|?^Tsiz8_RFhOdyrmcYSfy?rj-^0ko0WX~DL|@tIiM~^>rr2!f zBMPhgt48LTBxK}^Mv^yfPacx!s~JvI4}>>vWx*^e-2EH^WEp>wER@xea{WU9 z&0M#JkFF(RRc`y0@9>6mSk(KM_b=~05>$!wqZXL1v8iwP}%kgLaBEmu)*~4Qx zj;C!8Neb%7o`h3E7$GUn2X^mAs3V!ufeI1rXH_D6i>wJ$Ng(`My@;L5TZIU3QCJN+ zE#VB>&Q8>fy6A9S^bg^qMR~tsJ0A}3jEx(N4?mJfuP&^w{%iLi>oyJ}g8Gen!?z3+ z3?vUjN+MKAFX7dc%L}}dZzP;O@!=;EebeiPVG?s%3wz!KYwA9sU(Wjp=L3Lwo5Az^ z3bhN0-*49UU50uEDp9ZYnf2;Ts#mvi{$;CIr=ng>ck5Lv>ecS$h@RIc(L(CHn4NI8 zF`;@K)m|&FbP(;<9@}|u__>Y!sfqF7ZHYNOh23vP`-etvW@RndfTmbi1IQ~#FJ<@- zT?L@t*TnGtSnvL+w=^+s|4H308EVCYfe7AYwm$nwDue^++)NXHLskTb-^sivTt?$> zFhHsRVHe%_lh2PRAI(il4`yP2O1WrNNFGwnEKuK3KUg>JL0&vr1~%6G7f)(0a78zG+wdsKj?ry zH~%aCj#E^`J2LpzG^j|SAoJeRFFrJ0QIQ{+@rsI?8!`vr2?n@AXjymk6y11$qWT6y z5JskOt8kgXs7To$^UnPXkDj2YwsS{ZjUcHm7cLX=Hy9w*gUt2Ioyrk@QD1H3ZwCWcK>W>C`d z4nFXe;m)UJGTn`tHClklaFE-v$Ip(6A%qy2jx^>dsjjGY#~f7nmUTDk(M--|o)%%x z_UE%1bC|mS5s3T@>Q?|a6__tmdk3R%B~c@NUxVKd1%?6f;^CDWy8odF?^M4rLV1ZKV}EVD z&p~;8gW5hAmEUNoF({(y_(OqVK)hJI)h3^%pYc~4OJL;S8B2)XpL7AJi4(;TV%csA zVcFJ0@ScuG8#kCbLUb?Jvun7P5OzCraj}*p-pGqDY zXUbxPVjE%_1T_EGoNdk?kE)=Q+SqwANx6>o2hwno{8;z zB~jhKdbYiBNAh5Mc#G}4`xZPbXn-4kjlV+&KR|HZ`5ycZ-#fpkZRh=KE5Gdw?0tUc z+p*20mpB6m4$5)dc_u#aYG_g45#tu6lj91aq~j#N5c}ZiMSZ7^i}wx|)J3<)oEL^_ zq|#F798l++6N)>hLzSs>-mY_AjSUYBZ>gQOCGI>MA9#ZTi-I~z)Ce?MKtUc=mp-;G z{e@6n^{Z=s5vzVF_1NYEpb`xojKC3v3iZkYdzeNed<=9+Y#CRu>X8%bpF&o%vYkgm z1DA_cq}&z9ou}DgCsyzP30=aevud4zov+0<7viVw3^1Ot@xf65*v?kF_nJa0yy0)~ z4&S?|i0L)pjZ?Sp0pgUMuCpkB`y&9%9Qa^I9TZL{wP)x!=t?o?y*j6CdYyCb^iaK% zm|hSc?oZ6AgOZ%u6W;J26k~c!y|X1g@LFh5I#CE#Y)`(J2t1wc3e~o~Or;XrIh1gA z*#obHptJ=O>GmK%e@^~~-FIrxX8fmEhGMN>QZXf*aJ{p;&iOFrY>N%!|JK;FomwE0 zR0bB_a6U2;ONXY{rLUSEidAo0b9b!zgVfgD^(=$XG#81{H8N{E^NVcfD5m4lh!kZ} z#Z_HV7NoNrhbLq$1_!ljBuA&=4eQ_?zBg7>+x8gCqthSTyDRQIhN6h=+^vaVJUu?) zJW9E@)3t#DluL2}gfBk0g?R6(qV>+>@qyPvXH=g%HIzI70#`R}K)9WmuARyVC&dGg z*QF1S4{xcjexdsbH8LjMAJYx#3k#XZ)o*-}mv-EFw3cdh+k2G8T4y_|$6sQs(D5U- z^R@bP0cw+t`VsHFYFq(?W)KDkSqfXps9AvYRC{<38hZGKTY#)y5=tI6 zysdWHv$pfTjpWDsCQL<8QwyxrZ--Lwah{$A^?Hj9@qqi}0xP*F9(cwLFX22^mmXIK zp*cA=yuH>LA1)jfo*WqNubuXEJY5iXwh~tsA=oonuoxVs9v=$Y&SUlI3oxJZj6E2m zmdc6`KVI)#P#En;NoG#5umRCYm{JJeyQC<_HGAht*5t&gXqmRffrLD2nR#8(A2@m1zM6e9Z21hi6IwYw5dR91WgRr+6Z?fyy zsxc}qN*NjI>w*F5zA1;H(;xn}I~I_dwmTM(p;HkC1Js!l)xNvmKiwS*NbQ%#0-Pf+ z07Hh41*mH$b4A(RbKSAPE6j~BGGDg~7d{rCj-JdZ-BlmDV}b8*M{O)1^%6c7u;EXH zPkjEkIqq2C6hY;V1+Eh=d@P`kAl$LQCWVnHY!WVfEFgZcKU_id*Xre%f`DAAOg$fp zE0(9+&_-F=^?bH!!k{5!(^Qn{uwxs(REHyxejd1!CeyhI_c3?-xM$VjDH5#9(KmB4 zL(AgqtJYIM8R|N7$PCv!8wx$YiC;7|es*cO(C7J|k+k|~c}0b*)sx6Tm{BIjFq>eg zuxI=8nP~OprWQ_3+^E6k-}vEVtrf_F@b`~?xM;Z%o(fpEXj(X% z#t&q6FX+CGqzPyIJ($lYUoO-Q^sXECrrr_V2`Lpv;St@*((^HqFQ%zz#`DShDdW5! zf}U`K?Nr%=HPkjj%UVC#ta@FCOJ~jj~yHyT&Dgig%4v2S^leS-)(D+cloAFfuMG3o=yv!GO%y z($6m_ce_SXP06^^WNq9*bd6L$$h`N4{TsJy?BtGG*C;!0-ZfHfA=7ZjWw*LrqwKuh zX)<>T%v;L5<;(1@So_NZXYWy#IO49{a&=B(0Uy{cc+6&;pMm7(SN(i&<1W4n;^*Tt zNhJDEzYnk8q|?t>EYI_ z@6V)XiB?t8a7mh4SdM_!vz#;^7?O0}vs9JoeE}(uNno~laTQUcMW&|g1%ZK;85Uki zwH~c?4t)L&T!L##tX}eX%Zl}xnawWy^`NPQM|GCaQ(#*7w)w*k0sdc!NLFv^X7{Kz-F@+w^wq5Qt&hbuAj zOEho#;i9F+ZUstTB#b#rJY?MbmQog#K^3#k5E$tw@>@|X9q^aZ_jx~Db%_pR<(u@w zRT^T-mc(!M!$m6%6^-J3$PZUqp^GyM?@>Qov@9dMJ$|@~GF|*E8uEPThl^I0>IHlZ zaAoMcmWmEc@_AObHaZ4|yq60MtjyF{XVuIuHN?vL1AMxGJ6CjVGQ8Q*@?t&1G#I`V znDt&1D6&U7Aan$e2q;t6yAftz3dII+NhSe`56kFUwD=H2%%Lzoz5Q^T7N=;1pk~47OO?fE$a#dx8oO#^rOg zLgydpSAPTMQffe8RQgJyQ7QvzsJOZXM!GS+n9U2TM;m~9C?mYesLsNB5y%c;HcjQB zsr*Ju%JuYp1>QdbrkVr{#?6P>(U9CX0`p~oQ+$bHGaRGjuT}W-4PXky>aL2nq{P@w zMxuPYz({hI->A_IS~S5@3EZ;+OZqpLzha|;oCEg)jAbqsb6qZ@--<6KxYFVZ9u#|DjQ0W4Evpp|nIIk>UWE}aiPHvPz9Vod-YTP6vwDHM z8<+|jio=BPu<)v=M!4o~Wbjg8CZE9F6fPPy`WXtZ8kk=QoXeMLLqE73xNX2RkU|0D z<|A6J*EdS{)dItS^ui2;x4(?Q`C8z`5SCv?rKoIIJXG>ntePwqO#?th0#*bX_ra@zrjM zO{m=zpNOfBZLvw(Yy(!Tio=CeN?Tiaq20-KghtQ9z{2tYx=^33Gej9MpNW%mvg z(Xz{=^jQV8ikij(5aw`rUKa!S2R!<8$6!v3R^-l{xHja5q>QM7k_vf}+q^Ih<6;-~g~nm|v<5jr z?nB7ESO%e}5>C7jdr!4UY^)j5f@}6Xg=c`}ik+kV*;xd3&e#?^SuctaLq@11oJi&v zGnw@$lW~GAw9S*)O(OjA0qNRl?h0+blwNVBI)utto z_!vYv&V(i>OVa06E$+Ky@~DI}mH0AV$_#cAqxb{h2`Xg_)+M?m@J+MHFslaGXeor4 zPaJYNr#6U;{3~lE71+dh@4iq^INFaT?V;6p?fxE+2?z6kuY8>7JF}`a{7!#sxRa@Q zac2vDZht=(zUIPL=-v2qYq9b4Gl2a8$x>Qwo{1$ztlI^iwtM>v*b=3-rkF0O4?K@xM!^$%7amLf zIpK^W9!=0?$0k-dBv&Xw(izXkqqPHqQ`o9d14insA|1kP65@R^EFuOdjzVu74vL@# zvDlh)v$(;|yaHeMYNUVn=#2Sc5z?Xy70Y^*?kk7MEcr-cyMu1++j~7k)A&zkzRzBcmUfySUZ2( zcoz1u#jch(ebd@(g|@BE38}oW4e02AocGu->=e+qhc5%G-(cl(6W+Wpx(l{9nOi^J zJDh+Zo0bwYwZ6v!R}l5LEN#623{!;JM3#WUHM_{rk;=N z-mM?o&hsLFc6w|gy`~^hy(jr^cDg80{eH5VmJHJ8MC|mHMKeFN`xbv-I}3|skKH=B z;KOm~H3t#M-&G)ogD~}YZX)X5Ig!p%*2U`%TS;f*oNZRNuPWP}%J!JDy{&ASd?!(p zdI9VA!JbL6f!$;AcYY`~3~Bs3HUwz;hN}tGAY3XjwLYSsba>M4TU)d@HZhVKk04mV z4xPv<=1%rQMs|RRY@UjYd9$^f`7=b$mu)=;@$jC1Hf&t~AWmeB|5+QGA5cWHfV@i8 zhsYn4DwOx&$6Tpm@q#3hUW%56Cwbj9MI?)1st{8ki=>3ji;PyuVgnGyg86v!VmVLQ zvaq{%5aDxGOmZPN%V|Wyvs???zdp+gDa$3nR4OJAL5hy=blM>Sw~&Z3LyA?m_u2GAda3-USmj%}41i zn7C;^N^jf8>GRRx^Sx&vKts5ukal=g+v#hIu$Ml3^g0BEX~FxZ3@cpUqETn0&m9i2 zOvkZDrgz(z`szD+qp~@$?Zy+bzNXw*$;-n( ze9aJh+Nn!E)!o>xZPcOEA)C+hLg-sasrx{tZX4R9F^THENL^qr61EyiV!QoOL^LYp zkuNYKC*20R1T;(8k!6fCWO0S>>vzV21EVB+91?R^@2B=7#Lm}wic)SEl#8M`z3`NM z|9}0M8`?e4|BdPP8(8mypQH*GwQ~Pm9lwV@bobKNYjfp)(yTocUHae2v4zZl9 z!JFsl2H5mG8D|kxSDZ*+UJy?&D#FkN`wSPM%UuL1JEJI(J`-Y_t-EFTj|q>y_W1PD z89bLGcc-#wPe za{Bd2$f22`g!81@&nqhh==FxS~Ej-azae7%XJVj@{SJ?3aJ@7H{oozofo+H zqK3}3`>4eoh&$Lqxs5vusw^QToYffcT^gZ!pIJZAin)FIJe84)VB_`ma@hWYC&cEZ zc{ckLPIR)m?(t6u@xQhsbot>|^D=rvwyPwO?k-HEtK;bgA>)hlm+{4sSoprBeC{aT zyC5Yabyp_Q5f%vddapkQwL(v{56+enmy#U2H1G-LQM^qeAf$MB8~&}s_fGoQf-N)BYb`P@v?z8IN~>TXRqkF&F0PsJ(kTqnXVVl*Y6K=xHT z0;#J&&R$M9AKJZJ&_Y1?_9)>?FF^Fg@xaTra{)$fU4`~cSi6e!-8SwKR+>5Ft^XOY zaS2-vo7N6df<1j(dX$}pMzI*W%HqgFTuT`UU-wNA+UbihFkB-vmBlosz|M0qtcXEz zBz=YcN`)oH^i83$P;Ym>jYcQ-5H+2=+tWwKO$GCy9F!r?ysD)aQ{x35ERHNppIf$X zaXM5cD&c|%xdx);DayGu|z0vyfH(=Hi}|+yEc5^o`f?O?GbPo#C}-s>|wl%JA>P3SMp#Y zfU}+33Wpv>>qkL`CqrBL16r+LaINAM)EjgAc@t90<>`m8ae3OV+~~K5qh^N-u}7Eo zPgVK!Av_PL@FCRj0@QE}F!HP6G-BuSa1Cr)Po<|)9LL0tby-Jw!$t=JLZl&oGTIKG zvCr=PO9+4W*bYujI6d;z#Imhe0nvLWk0LtoMi9I1lIV_}N{}|?mg~V>yFy*3PESsF zGnJf8N*|AKIm2sU<6T5XcaVUXMsW(_jKb6kJAHYPJ*T@Ub%BlZ>X3+;iS&3n12K&a zgAqB-Ej%V_6XfHCnA4BRGaNQOflmC>jzJ76&xU13vJlB)NbE-M-?%-cPN4F!6O9z! z!4tANl#Mr-?j}OCmycnyA9P7HAT+sD7_aWfco~`Hlhr+3If-uX-4~d;ecYqWXKUQ) zXA#4(_i2l}eNII}?KqEkp|Z)AI?*=~ZaBg-18*M10kG}F6Jm?udzek|P;GalQ#mZ9 z^(>_a#=%lbX>r1N4mu1=40tpT?PCG-ry`pgICL|FnV=V451-*7j`jXMFtvZ&qeD3I z$ z+t$X^boQxwOR{=?`iOy8@77OZy&sKT^Y-GVBW|w`JU%xz{Q4QaR}F+lbw4+BAhTI( zpBO4&w!mt(MzCxvmhi0?ShBdB8RJ9Z)9PAMU~q8%SvD+zW|b}o-+NZUrnAP{jy)VF zU8@g&F$!E~2iYi+$q1I<0{du831tC?T!Q2HH6Iu$9?5Pc0Nthwu-vi;QVTts%T?gg zh#i=_ZqdX7s#A0Z3KfMaIai5Sz{Z>MYhfeahOC`|7W}pG(4d!^hI8>;fahvFG;K)c zIXv{yb!jV5wh78ci*y_}McIfw+zo5`!lrL+L{Wa`8;Z|kGYXV`ii=v^QFxxe;QkBT z4aFBLOhhb`M1{*}MnzKtM78E;caCy56jv&Yq`HhiFr>c*1JtXL3C;Yt+}%*TN?|0` zOkx8J1s4pQgEu+c*!#1K+zrLE6-HA18zl{f$|4vbP7~zry;t1fZYW--Fp}yhVgt-L zJi)-BcoWt5yY3!zHxy4-7)kXAFl5H#;kOXbud5F^b%(p5_%U*VaW@oKiP)(J2?mIk z%qyLzrQNeOa}`F$^;3~klB{6h7)E1Rk3ROZ@49Dg?ok*?HJMlrL*17dmwWF1P=%3H zXNqtpF{;@V0L=0iroK6e@r8b!r7)7}8zRkN__~}=C)535MfE*}kyJ5J?o?0s7Ig~U zx_S3Og^Fr{!bqy`i!@JWRI-#QuE~n(PKA+FJ4KogWK@+D56qRdH{E`qqIzCoBo%~| znS<~)d3cbb!l5yNkyLMR2X@*u7?7J_etJ<;-xNhf3ND!`mZZ8!@aJH-nmjyMQ7u;( zNp+au56v0}12ZT{7<<)KGY(Ny5rvUdSBW%}w43=lR8d{0Fp}!FAPd|gp1X2*%pr4c zDpFM6Rv1b3kcgdDqTCezbpHD0sftP-g_)|jv0KDWODARu4^vd{D2$A&U6degmT}{{ z@$Q>%K3q|CD~zQ2rQj;H$YxweD5|XrBdK~tzKr{GQIkAJ;sAkqF90f zJ+5OF)rATpsqPmNHJwqB#FDxG`%j!aT~R%(Fp}zbg7e1#8w`*Xk(v4R-|sw5QN5-x zl4`sN=XhX)0j}d)*7tWk{LJx+s!(AhRk>)$PheEkwouk5eDw8SpP;DbD2$|9Bl=3J zv%$becvIFd+qn6Y8H(y^g^5@^TI_;gW+vWl-+lhgb>E(;s18&Z8P{RdCBmGDCm2{k zZ#?5ZfARSzDyoRWNGj3kv1N>4V6C9K@QPFZdXl0NQ2`^V9ua9inZ;$}O>F+$L1lAJ zR#cBEjHLQdaFqsS!9X*;@vNNw)%BlKR7_!^uvA>X5^0{rs7OMH^XHv<#yztX)#C~y z<2p&iMZH@vunlj@=`DK;&YrEPq6#CaE*IgDv-e7RIneOF;*T(65_CQUaO_zK?S@a;$=?N%5`buFn&Fy(lH0pbbe=CNnS zT~w~9HY$vyx=e&q!KhZz8_zx4x4c!Ms8%VAqa?M;5%nsTdAo2t}v2n z6Nj+_9l^kN@Qa$U=ia~JoGL|ilfp=F3+jfZ4@j-uM4Fp_GK;OeQ2Y9`*q`O)9{VeP4k z>Rg49RL={S(-;+%GI683^Ptdait6_YBdLBWT;?*WWAP?4WBo%%&s9|SD2${U6gfQ| zST0eNuSb5Ie(`ig^@PGmsw)TtQ-dcMcm;3D`upEH^yC^vb&bMEs&9yLk1;CR6iied zU-&2;Q&itm7)kXN!PPSu)pdB2!?sgTDL+F|;dCW4XIPTzaFNq_a1RES;7y!gk*a=X zo}!wjFp{dBg@TJs8Py`ZNur*cbl-wnMb)h^lB!z7UdO0NmWisf^2%tPqB>n+B-LS5 zs4(;K1Ope-8_(#nCx1F$QAHF+Qr!UznFVe_w2M4RfobvSV}N<0ESE)PcT56kcn#ZU|DHgQ7t6^OkBlvmdNRuaOH6k z=YMeg+Skr>sT79trE5*~j4FaR3Bu>^``jUCGU>+;>kd(uX-*&*xSihQ{N!nGEmR@@ zL}4Vy*sVT*B?uoNZjm|jM+d${E|6j0+sTd);Shq;yeDdb>oSHiCX5J|ni9jMUT~Eh zIp&27m+#9&Da_c6*e}V5{qI70-H?YeLjIZ&4(?uP>LS%Z7#w(o%c?H9KmN#itxQs8RpGd#_42;j&U5*gntYQA@o;pdzJ|=5?DAq3$`AwUw zaVX|wMW`$F`R8c;Vi8}($r^-v<$U%q*k^OHh9JvX+^3&C7~|IY>@Ygz+#tWIkTq6( zA1te%_$U$c_b;5Rq;zO7d%&{Dx*FHEcQ!URK$1FJTdCssv7Skw{ER_XfGlNovAp)> zGgxt1e2)yBqK^Y~t$(evz?H0pJtP&Ge*jW^2_V@<(KqN0 zXl>BK_y^F~^acIvwPq?*t)tJ@Wq9#V!JE!hyXhl>9<<)Xv~}Qa#vC^_>R6dQ-^&;^ zpdqF?;?~4ev8%arO-EB>kN0jFDKc7^tbvJEB&$Db zDwwZi!^j`;_T#ze3V8vnY|bum9t8iXH!|K2udvFCD@=WZWZ$4}^!F1AxQrJ~O^rP?}@(F$KmU-2u+1@($bPO!-r_X|HV zRX9^TyK?_-TB)p%mwwSrD|`a^y@M=kIcefBjFH@$_5B&$v_i8<%FuNDpTwX}IHm><%rBn+{U^RJ5L1eKvN-E+V!n82NAgvs+;Ql&t! zd;`zL!0Z(`1TXSYMl*QIRFel*C#xrMCly|qdE$B+yz7DK5I7Z{dC>}+=(|E-WF#zo zCFap*V&>2MaOK8D2-a1=y$0N+w5kcC(pO@ZFI^jJ0p zfzLg0O8%aYKYs?MRLpcLTt#`Yj-&8S1Lj6A&b%muO$OZx%1F=)-fW&%r+0$879%a$rlJQ>1=jlM9Z&Nk8nC5845Iuc4=4XdE^=dA=LNkEmRP zg!vv5dz#&ZePMw;b0_Y&uHM>nG3~?)yl7YNvcn5@A!%~^3ndIYaB&p&e3dZRuw`E+ z1-A70Dq*l;BNjF}ISmCvquHSlwvUi+&#Oj)^hCMGC$Ps4;RLWP6Pq1z;`S|Ks`;6p zX>g(WNd4FX2x5paMkkx)i5q?f2ivHYz=sZWFTn=N$+T~1EbSq~S#wcXnH!D)3U8oB zzMghPZo`IR@Z|xjGIE>QgX}V7g53qzxbsN#MOMx=k?`ai2!ut4pw7WI*XRzp%avGo zMSZ#!_d=%=(~A-_2kgK=Jbmu;NCGEx16%6hI-`E(Ks|_@I&Bm?KTdI(N~`o_h?IM9S+8tHRB73 z^gL{BTqt-)6@jxZkzOb`mv9!&z`>USJAjR_^9qMT#IJfMRaoz|RK=ZTD5_;(>Z^2W zG!b|WwJQ>LQbqB>I>xYi=jsR^#;|wgu?x?qnAA1o3z2rtGTOb%S@w6>MrK(eeRUU( zLE~FR{o${Gbsy@idmcf=onO~Gzrt>BY=KN&k%f0Z12Avit^U-!OHK##u9^<+9Wg!b zTtYI5&AG(B4>|jiki5a#>4Jgul`d@ECaKMjjprg8oQ*fY#@RR#((7fT@!1}BdAD7? zq$+&FRAA-dq{|BpUV%HCc}2x7-|r%HCS~(bN9UoAV&n60@LiOaJ~+PsQPQ@2xv#$7 zd82;gA5uF=*jan;9EBr1w5_)ajRtX_cMYiB*Pyn~XS~OTPlTz&mgijTRTQUue^e-9hy^?S-jcT(&8H@05VM(lcOp>ZYy9GqhuHAti@(GMV{_`aGvQ8~DP<&T{y z;fLe#wE*JM4!32OJ1S|VkH>trviWTPWJgy9S;PFK(J)ghdyzc|T4HDy7}7NZ51Pd; z9LMa!=JDa=*m&R**pWaaa&SItN7>1GI;-RI6J8P4iVn^%roZ}zTAAD#aOVs)5?L%x zYv6SEldLnjneCZAnh_r)EfTG7dg;FU^ilQBxq%tD z526G2Ms)Sp;wp)2YXe36556t%V)8%h11}J$aOhjeyvvVt-M*o6##)t3u=WhPv*P{m zwKWlX72<`u=Tbe$_(hi#fR%&uizp%BGMZ%Uo^>uQ)>&9A_Rx|h&sq4gvN2{-2M$p? z(8d@4pfTZtXYoS5ZGPF-!vWOFbg6$0+X1zH$`{6=trOHkl#6YLKdAFp(kWz zUc-=<8B88PnT_tMU9E#Ekx)H zM)!I<<`-4R%r{1}3WswCVC`bnF`pli9rI$a~*8FLHiSInrtkk!-?XMG#G?41d&8_O<^(| z@3Wyd+L72M98npX#J;z}8f26Y-{g%Q-e__e3BG#rR4D@Hg}~%f3mC^-ka}EwK>?2$ zDLkAti6FdPCuR)~Mdp{#f`4&BM+z@XLOthb(*a%yF2{+8co0lDsivqt4Gp+IwTGl* z5o!j$nM2i=zOW*ddiYe~=vY1PBB$BT9-_yEC^$id`tr0qbH@QG9H_6fon1o*psdE) zgZ->ucX#5`P?rlrCv3ce@KVw)4(ASXUV;;QT7OfC^8<#`QbD zr(Ts`i$q;j$$s{y>G_BUH+RtI643;^{AoZ6d8O!9HrdMZMiuimx^&AX6`wsp6=YH7Z+UK5Zat|9k%n*c$uvr3Z4xmXC z7@CU;25!ci(i(Z>&v(0r4Z;c|sS*T&p-H)5fQEwP@YqFn|J6NgaJIros%^rBrrm-8 zYA(p(q@vD`+`|U)TLNP(NwpgoGNdF015=sZvi|eLGn?GQ2JZ;h0!8&L;X?Z?f`OUh z*ZiOVyx2W#@O_1majg_CRM^;{jO0<)AARZFlikAx9SS3%>V@hU3e2D__H-Z_prhB3ZtliArrmhWgdCJIUeJx5iF# z4;#F$Fp}z65e`3WaDw>t>*Ft3<{mbXZO~CFg>ywXN3*yD5&J_fR+i0et3`Pcf?MU0 zB-h2xz{o>f9FzUCJy=Pe)kGj`8U)o`>SL?S{1Z8TyRn#e2R0U9Pftq^_Ide{_q4Qp zp`pF8Cnv~f(+&%KO*i{+P{#Lx;MtJNFI#w&OrKQJXM>bGi#jm@hYJDR*(R#^C*-76Ya zcD8%B5HLUNF39PrcFbg5L1w|o&!5W0U_whbA1OqN{G^K#vBuA?E{*7Bq;EQv;>#NxPwT;4leq{g6wQ>9(KSZylKK8j)`LCYbh-}FeoWnz zX4v{qg}IJJZSFO)aTZv1I4_8t`N}w{NoqW|7XC{z(#qay!qQ*ty>_F!I zemKvUEl9uF=7%dWJ{-ZmY4lq^T&a08H1z`S`{B%s@vW1An@sAPW*Gm<&2=`yo#uzD zH2FfBNt++8!nlZ?En!>@+#dy&x*-;CNtu=sXes#hj$e3XCXjF+`Qj?1a>c?W+*ruF zZn#{T>)(Vs$PX7Ssn%(!+>Z9c8TYXBe9ZF0RT>wuGkH114`;H4jYJjzw^(3_e>H_Q zHM2eI!Q?KF*{O7E>!azqs@n8<#fkK?8fVE_xUDx?>x|nLOJQdA!YVeg6sxIqmYnOv znz4X-0R=G_TTXxQvzY!4#z>c^pM~^=P5fnZinu(s9bW_;jIAaJ8`R(mYustPHn=Tz zMbMqyb8Q7nQtl6|{?%x|24gi8%euzo`>t!jlBD}%?~aK66W;@_v67gI*c(euPy=E) zo)*68SaRU4QN6F=0&U~c&n<{kcBXsEm3}4r>)gQnB_DI6m({JR!6Dj9>o4op+Et znygZIhu{yNchITad551UjEw6^;lk$~bSih=;Wr8+ss3A}nfMS4=v3~!!(9p^sn)Z6 zSQejmkPz^!j=N+C? z7)d1+Br1U*yVzf39oHTRFq=`MBoT(Ynez^k;y<>Jy@Ko0nFqqUJ3EsUhBP>`*4ozI zB7S}{jHBQIIqK+1V$89M2Ed1-LFY%?rqAkbY3)jO&td_YV-b#Tpgp2Et&ut875+Zs zPmQuCwW^`HrK_c*xuv6NZNr+DHXQfx3|2IFF8`jDsU)3D@TbN>rIzl7wq(Ys4iS1| zGTGR)G6$f!Wdr~_#evKqp6(W$+sPUghQFy*E%_ilL9STa(AwU)2J;U%N7m^*U!t*z zO+@sxt!QT_N0OM9m~NIbFSYKL)oq=ro(6@?F>V*3i?a#solTAHY$(`zB?9?{#7<9A_06nW`3EC zaEHn!O2>J|3A5mLiXW~NTii9%2m4Ck{wA>0Te5hK@89uOa6Q^3-7uW_AtCDo0B-lg z8Q*Kd7Yl*w_rpa!pBB?2ly;vl2~CIJK7@CKXxd2!QeP5c+ZA?TyMpuRV1Sq$E*ynH z33eIkN-gbV;1J@4FN6(@)^CFMw)MB+jcYJt%kgyCgX`DPZx~l&rq#K2X!p44Z(qTh z1&O}VsgOf#Nq+{j zrSP7~Y**ubBD3}4eG;=dc%RH{aumkcNE>rWU(y*yE3bX)z63|CPA9^(*yM_ZX?*Qy z*w{PD@2EW9PJf9(oyqnfBcjkyiYaVxiIM7T;f6WvIi<)c12uTg#6uZu#?ygkIUZV1 zAw!x9zwV9OCn;TSVFP7KUW+vmO)Gk3u9cR1x?EJoM`u z;ro*AnCKjZks8rV;X)$nQXPHn=T30PM6(q}Qi;kY)?#N-L@@tz=ERTOF%gX`$c(Wh z)v3e=7(OPV7HATl+pfOrGIvaLhQbh)e$b!FA{Zb69fxPv?wkKKmaRkLheg6lhDwfK zuSLJYYj<7bj+;m*$++XDmE1vG4oAXG=9K#)|Lu;ONLI*U*icWWjkta4Tyr=qC(!VeJuj5H8CE4_(a9g}>|a zWQNOg8B|whxZIoJA}@k+Lmr)hIVQv9D~3ykZahkAO`WOaiq2FA*XqO?kxcmI$iAr= z8)(0C)(XHsW$mLPdk|e2AJO&#a8B2AMp&j@oS>A)@rUkTh%z}zly#1@7tFE_ppOzO%12n?*uFkDHcamcP5K2HNTI>Iq3eP!m_ z5cN7?V2&HS!Nt|TLizg5lnmIA>-o8OLg^}aL+`relU$t zE>7>|$en0r3Jm=w!@ee6W`4!G3!U~d;GQ524Tf06_)-=vW)9-D5PyR+pbOz4$2RCIK^1biK5fg3CdPvH0?NxE~H> zZ6h8sq+M`aafv=?sfGLh0Q0WE1zns`a1S8f@aHUR`z!!pNO$A%Qf3S?{uj8m*_L&f z5MI()IL`bE_}78E2ACqTa#)~n6~^MwiNLJ{=HEr3lb$2OGe$wT1Gfv9%SGl$pW(P@ zHOa6vHY|?=bC8fqRX<9~jYY060Cxf~|1NMY|I9_WV}N@AnBNH;lELFGH}gws{Tsks zEE)+nUh`|~qzQEbbFaXu@JdRJ#kwB@*AL9+#Y&pXzjEVH;Tqr`04910EHEnG@-ky} z?Hu^k0dt!dS6Nl83qIlg8<=4)t~6SzTXU>01& zaf;97)y7x0SHfcnF!x`~aY_!#t1I;MEeB&?1txYW$Bn@so)7bL!#_lLR|9j*a!+^_ z(PBNksR-{(V47BNoT^9BDnp)UA-q9g{?^2CZv8DY>QM^e9n_5Vd&)SBsz(*Y#^UL> zAxKXG)85H(Gzw$+h?ZCD{CgJRZRo;Y^d62Yl(>qLDp3`f2VHObAuzX*Ai}8fsE8Ve zbGINLW3Ip+&9xk-@>^O~rngsj!TaQYv#gi#ka783X|%f^BfP_|#OyYWqIFz}0kggf zzq5gPPv8{)DoRRGZIsyskHTxP$89}#a`RDY^hfu=d+Bw^XD`Pg8JvF=#TB9nV;-mC zeXziAq{N|sr33z!BHksyZMdF0PQ)Kp9u=jPy1dW|)|eZxM!t#T6kkfqjm;j%0cQiV z%HcTGZj_Z9_3}1&{}Pziub#mh#eGj7B^0eHwLzEna0 zxf6R=AB%n&n6*FUj^Dx`p5JPteL<69eFMxMB8J1L@JdUJ`g*R>TUupYK0)p5 z1-`gSqu;0euJpxKSCq;K@R#y?4RF5@ST}vu#^xo8cbi{$QM00-0^GB}6%N7z1M%T< zin(aLJP0=(m`lC5a#Q|Dedq?}VK1(<*ccx@goN(|=F8hb0Hfr-5(6pj#NI3MeifMb zW86`tudKpo$0>cwfccuhDZZ3dRO;bTp1udn^IlxE%D5z@6}Z=di9gQcRpH^T4ZZ%7 zJf8#1s{*IeSB?Q3CuMJn_iq9toq4-v_R~~upZm2$@V^{aVO-8axYPV_B~`|_;&9;V zfmv{qh1~iTt9HX6I717wERvTlV4f8?#pfuDi~xTr^tS~@I`eoaJ?tsVdhltEQtf?7 z)MyVD!u#N7Fqe;qjEc9S%&2eFohE@fX$ON@ihq@r#^o$;!@C@qqjz%LSo{%uF)o=Y zK>#hleC;-WwxMBq7`fh(->;${MOG-XCJHHDeDW8rV-fjbnqFXVwE z*|{zc+%dr2od<3jaKFt1cRX-=^T1KNdju&(n(^aHCH$A>fhz*8FAp5GYd_2r*PjP& zD#Cj)4;;-e{WT99g?G>kcxlFuFU04Q^T3@5+}U~HNM5eW14rTgPaZgGtDnmQw*a{D zFXE*czx-1AmgIq(1Kf3a;En|DmwDih0Pcl6a1r44=7FR3;E>2lLzh;;3obaFU|Pz?-2Me@WIWlC?krV8~)$Uz|~~vb%cAv2RFO4%vevMdAwP#X_1mO%U-NG zz%>Xg>Fu-^%iCTNpYI3er4evdz*WAEH3mFnCgJf5kH!@r0dvwH2*uCd_~DZ9`#vy- z{*l2fl3PDqJKU?^fR2TS%;9+aaFma`--M2UhfKEo{v3YMx3Di951G&5@e7aA_n&Vg zz9B+keG(7hp`z8*7Fvq31M}>ce8s}ctC&y!MF;yJH)kDsc=`Vkb z^bD@2O8~+MXd7JzX5&(@2!7xj&ivb~xbb5wuB52KwJPgwV)X2m8~S|)V8nQNO`%Uz zCm^1GB8F-+26;sXzp2U1(AoH)D7y)!HvPY5p6H&R@$xPt`W~x|E6yT3r_Q^z&U-Ou zS6p1_g{x1-=~pqBp|D|%EV$n(|=C-S2+XSAYA`6WBKv1^xN>K;U1Bk(2Kdb%i*J}7RdufBpVi7DU(9)Zej=-A|wCx6}OO{Qi$gZWwc5VnU#7c%39^Q6C7i@uTH*}MO-FNeH z1o^;QK}r=B9#3d`60QRqyKOy5U%*~JNb!bej7Ihm=lbbzwKrQeoDsIOz6=iVj&Sc9 z=1s{V2)xgN!{GW0@J5n`2iGqbHf&=3E&_fOKvIe9f4#x)_c`-+e(gI=QJbO0KV0H^c{t%6Y=%silKS@Yw^2}gX}**g}0k7 zWr*RT%~PE(6=#^s~lxzD!BEBg6wtr~pUZQNW$fQcj^eBB}8k`mdOIM@_17 zXhAGoSUbHL@5JaoT9Z7GQhlyP7nx1! zWeG31lO!v31WV?f780B~=}yXSs`ySydFu3`C3IORE?ParcD_i=a-qrJ(&eE=44-_O zV7QfVOx)Q-jAZ1=DdakXb_kE>Uc}ftsen?Wk%%FdqU8{-Ns^T{tsDE-9&fK7API@5 zL(}<%rOt2VwM_}R8k>v|`7&~ofpEe#&-Baub-W+$rnA6AX8n!=pE$%!WA9!mL zV)z+&X5&W68LWc=Z>=O7NiDdM-_W8F_lLlW2z#!-I%Vy*KEHDq)h zox0moCNn|THQqR#jzdYOc={IcTVCI|f&Hc^;(a$xr{u9HVuKr|@1Zoo+;11KxMRO~ z1;1jO>75X)z-3Jd=VxaT`_epdz4RgPVOB27Q70pN*OQo!O2v8q2U=EPATOjH4xP%K zDJnG2_=9{>Q7}gJk%EgD2`O?uX=uDlVfPNKwEL*{M-E?*C3ioS87nT=X>*2CB6xhl z!Ck5@rU0>f$ci(aF35CRm*G?w{lo4?+*)@MqOC$!Lsks7YG%6%Hd2T})^G5pBM2dD zk8%qmEbdE(=(z6*;K>|@I|DX4>=&}W1KVlLb`NZGnQaSfr!(6Vu+=czZrEbXMwbTA zA;6F|AtZf|gKZvjtB0+Y*&1Lwjis*zwoarcWc@E}uQD5bt*?&Zo`sFBkqTL_!Zx3| z{Z-k**&MyYJhqof4PD4qm@UddOV%-9!zV(d9%T>$kAQne7wU zc&jlEdE;rJ?Md9NTDe`S+}e~Ii2=vmtlaK|jkh>--zsls24Umv)=t=XTlOMsXR;I! zPkFq&3ZGARV#*u5Q3D>}HQ>S;D&iUI9=r`Hwo*sibG}Z+l!Wr(Crc1XUMf^0-eXoa z_~4hkQ@VJ{ZPSfp!tJAJ z2+M8?t+xY@;uMv}fZex}kH(Pntrvh+H4lT=(@!#NG)F(Ww_icCu#HDJGy zxE3#-6w?v?v5S!y+3w?oc)t|sUx_CmN2(&oMx6-b@uPrmF20lqv>MPjfxZQ3yg&~E zsubvFfUXv36QBtKH2~rPrGPj_m?+R7FvKK*N&!t4XuJ-)2hbD=<5pg_u{+<*=}oWU zssMX}Gxx*jdYVkq`|3%$v1uHR>K)Esa$@>ZlwnAN8(`FD@NO!7&74(mr|I8&W!sx( zyg8VrERp#lMUFig{yj%mi}_*5AHjEMl#sXqQcc5oCR$Kex2UeM> zK#iFi-VDS!F6RS#I-IlK$Yf51Tk54vK7Xbk-%e~6l{C}i=`K*{GN;8?=KG@O9=Uu& z{wQ}7C>bJm6=eQlrs{d;apo6pR&Y$)7oq_^PJ@X*F3UIbLM9v@2h9{t@o5uGw1D1b zm59nb)--yFKl8&=PoqJMB0y(tuPH*|?Dd?>N37Wc zi*UijAZ5pCv_2`fT0_?Uu$zHhSA!HyajLwAVAvWn2=uo;sjxn)aAt(4;1!rMNRg1Q zdnX0hW+Lj+t9@Ofm!r_@kXGhWL>UsX4v+@P&*;p$t&U{M^k+>$6V$ZHsp%m&2yUxe z&Cq66~?K}t3RO?e}PM6lAy_BLb;QI*BOo93$z3T-U2uKZB7Xnhkh9}h& zu5M|sNANPofT#+C3L7E;y2Xd)8Hv9k4-BziGd9(+)e^Wmqp@f|S}l4?@dK?Wv2oW9 z73FG&7SUdr(ZvrO;-|Vt@F~#{yR2oWKRN_502*0CbWris{8eWf1IjQtnwr1jc++;z zw#NRMIc`mT29U5 ztwWhUa??P@ur}8q<)#{D2QwyU&rYoTbf1PWMfq)j6ur4QXO>X;kAP+iL?d`9o`CP) z_*H^jY)bO=i|M_E*N=cIM&cW2B@*69Rsw>B)JSkkZp2=HUp~!AxO1mDIxu3dsU)9( zO*jFOsZR7w5LSJ?70?Y5Zy6xf z*%E+Myd!9b)?VpaH7ijikYIGR9*+tz9?_aHS=9$3KSx7U9ND8u`iOKvlN_Z>qW+fmC&G z1f;4fMZ#i$v8goHvggsfSb;sE663o{g^mRJAuiK!l@G1R>xBbZWEljlIKG8q!&iOC z*mO5d#4S6z#onQVuM437I|bemu|y3lQY2-C}k*njL=nq1A|TJr7UZV0E)iv2mhr2yf+m5x&Z z){IF{mjowqQ6f7%L7S@50`WFzt{kv+z+41u_6AHvzyWW-7zE^_UK-^x1QdA#&O$(T z?u}e}o3%}1k;)E@xKhC`8LBAZ+|B?Je+?NaO@LMs1zoD4(Hfefp*b2_rlFLE6ia4n zZ^J`9WX`eR>tLpbY2ON}wnY2kb*NNFDRq!v)VH~O}kZ_YIgXAWmfrTrZwpxZzo9oibCE@)v_+8RemUv`oTtm zsSq^W@&ouE0;0SD|3j-T--Z7nCCm2!gUT&HL_HN%@?|EiU89JS8sV%_#8r_(S#wCp7Rv~{eB>?t7bd20)4z`sQ@f%eVi#9ny$P!X z6}uE{BrZZzNfU*d>Sf#s8Jot?M@ToLo~|7+!|jQ(W@oq|+}h)61)*oCr^_&UaSwMG zEd(UPXb=EWlNH?1GylMJfm&y>8)G(hfx;QXVxKDrKS7;0g0SJdHIy%A@vhjZAy=?` z%@dDfc2faTe#VEqTS{XXxi{h6F0F(}>4V|ZRdb6PnP1|L<6v#Iu?`yoNvJBvTQQ5Q zN9gKZWvTN^LbcC*jtFVPhy|tA3&1GhyCQJt;^_vVJY(3|+PS~zvLq;&; zh}hjD=Z)=Yrb_3aR!VQ+`U=;9QIk;H`a}7cnm3!x4b&fM+qxnpW9_pr%GS1hgt8ck z27x~&oGix*ZN&O##7e7%s#$@t=S(z{9?m0q9i-ed-dH2b>Gw91u~e7;yPShC*qnMwa4M8lov8K+0O8pVZCBMV$Z@~v}hYTH$f-OD{VDYO<>?}8*j{MM1^Mki=iB@na`hlx~ zrcXf2x(O?`WAe=mwO8eTr7Z3QGNv8VQ8ss3D$Dt|;G^PP_+jYpAESZehoMW3 zM_BxDAa;-3O67cC2$kiAJP4Ce%a|U1 z+~(D`rh#uFikyNWtDhsxOZmNMI>9iKQIx{_sR!QMNrvcgY=YP^kO(o#7+3rxuBWhP z9q%VnM=^LAvV|Co4MwwOC*SD9tq>?m60TR0aBu7k&H0$$>)0GRTe(1yVTo1Sl(237 z$oKfRL7=$LNGv5IJmVLs1IHAA{Z_vOQ){$g2A{P}4PR+nQA~P!?Ll;4I2W{2bJQ@y|$< z3jhP4mjklhwkLA^%H8&N$Qa%Ba+I%Qx7~z~s`va1kd4xSI3*Cf(v9vzn78GBn=544 zt_#_&)^nlS{{|?&lW{~zuWZG95HIz@R9Oi+-t+Fr_~Zn{P2YeI8}l+bG&urY5u`^ea|lmAiXiEg z&KQNMguAgvn0Ny#D@+us*`5HN550rQXvQW-wKR4!lG70Ue~7VrF^85qTD~AvE@O|f z8eLXPpN;p>GZaDTG}_G-A6aVs4xwL3h};iEjOU`(+0{Lvv+a}X;R;_jYukJ!nEvp` zG)AGX*7?wapi!(V;8w7!XUGqN^jImcunxEF2|berh0GEBH4;Nv;Ac4co5ih0eIYZ% zMY#5)eWt$@eQ<1FsO}$|)>w3SWk5+6L$aY;^+dM{fFS8YzKbkNQ|NW9{_hd`m8$<; zAbOd<4~pC|`50p1%DSF*@mI>^GReg4m>^*EY>}ivX9VS49vDHRJ)J?aBnDaSZ&$Lj zgaxS7q~9f|^@-S=qZg`=mZ$~U?h(DX1!G(60#}Gf&$P#2&^GRE#E^7PL!vR(D?ZX6 z>%qQ*()rRq!jJAq9Xjhol<4TC=tQHT%T@1KdmP?5ymyIS<_L1iDmqC-`4o95kltY* zb;lo=3q}1+zKl@F_Cb*CMOwDQQgKW>`Ti5cJA!=g_o)aFmkTLFx*|wa6C+7uHh41M z74`S>UBpD1%Oas?4uN&jG+x+UM8NWtJ=BxfajMwq&qzVLj>=-0T{Oe%XAM--m3G)v9~(IkYh#DS2jEARU$i)qE^{-$$T8?SGYe zK13&}a_^vYhn`_XrFyS<{xAq~g(g#bZQ>HB0+4Z%lGqHtl%DU@F5y$e~&;l*rwukK12fi9qG^G{vFKDXV zw;9QTJ$iSgiIoR1({J$`u@eo^TPp1J%osM>=mltw6%Yf91`f}U26IYLZXJZVmW<04 zZ$Tc?HvE|A*NsgL@m7CquJCf~dNzd~+!7|@mfQ6;C;)so4$F+frRgI*amRaf9|+@KNKQ=_A4ekTZ!-gD zr*ir`Ojd9<4`R4#pu}hdyOnh&ninG|Gg&nz+wc$v>;K>fsgp~iHvz%5Z6i!+QpNa^ zz67Wk4-cAF7v3p|yBOt`Rou{?x!j!9oVm!nFEcni>$yzfk;&>XYNmT_TRt+Rat`ZK zbh10J>Rl{|jiIKz*T$-6BvS zAeF~5KnnK}KnnNRuJC0l@dg1}AkZ*CG~{C|9Uz7AEFgvP1|XGQFZ5=r)dAlbfapsx z;2X~{AED`h6ooinQK`HRNTqT-n0$=Hn*d0Cwopvdok9~Ykt7@ zIv|Dn86bsgU~0~pV8AyVkor0kkovk9kShI80ntlPz_(Y&Ytiwhz`UezmjhC`Zvj%Y z%7;;GiQt|BNYQFLpm%*tuN!P7Q-yv(K(vVld?Nr=3N#*&;-;m5R9Wf)DX#k&AjNf) zVaTfxj9Gvbx6cQpxP65VyGw^X2uSsS&jGzHxT9d7RH-ZlR4HLw0jcz!1EkW+*-XQY zH1-yXIY;tGuZ8H1PJ!Bd6T~j0;Xx!sH9ETriuGHr*Vy47fGM!`ifGCGMF z8KaZcm~7ZgT^eT_(x(9jW_s%Gk|yGJ9nz5Q%HV7gr*%j|65s&!XB5QPG`?U+L)-57 z;jTvgi!53D?H27yjXSY-a+M7eA1*RrcEsI3@nNvYqyX4cup;nDo>5X%9apx!)hu3kX{5liJ(wVU2!%xvW^fvHwQqOLn_aq#6}4t}V6_1D6iiAWw-Ha( z(rR?i;j9Q+yE6SzyfVxcT*78Q8xb1WxrrHT08{cIloKbAG}#s~5-&kshOI`b<5HQ} zOCj9z5^WAOg_dGI7K-^}PperO25xS00d~ZCUbdI$5@l@LC|pCu4*#1IYgR3Ts&P3| zhI-@f6sftLmQ3uDG&YUW#>`YfldR6goz=#sQCOY(QZ08TlntEF5jvhEyM+FVT|~0I zL0AE~$YPn1%wUAEr&OZcD71VVA!nHGI)DPEU&7a>I_@O#In|6Ah&tp|iJAT-E0J2? z8{Z?Tx}L0I9nV-`>RiOF=7WIebI&wM7V212dI=C~-u!I!RZ(Z#L318j+b7m3WZ)?& zcl%rwYuVe#cs90c6mjyeYmg3sgheQyk|+s4OODkIh>C;?}G{~v%yDd&l8(QI-qy%TYH^J9c<|8U3$3SQxU_Ncb z4}!Fq&_h*f+k@}R24yDQuujEsBoZm8EN(R7Jcx!3NMfnq{2ed_5`b|2 zK7x@)acN&z^Z}!o3mvi*X17Z~_d`u6qqTtL4h}axDNB;u^pu)HfUDvg)U^BCaCZ77s&w?6?)K)i>Zm!L;mPS@#B?d@kIq7K z&|td!#&ifDa2q=Kq|DlJ5EyuCl$bcAVybN7AbCAJcmT}h-Pa??x4j!e+|rdXa%c|(po5!G^eIOh z8HzHxlqLaW3QK@YrMTl`K&t&OLJHgu74VhdSA{v_LUvcX3=Cs2Fzk-rst1K#NFz(z z=+R{XPtR#uJ%X3ctH`6&4z1Fh(tPPWILp&{j5=x_XL<4^nk4l_Ey27RIw) zS7JeixW6+ME-k1X%=RdleWN`G`dt#;(>Syd+ojspa1))g)zr(yha^RhWaxyEGb=qb z$l=F!qvV$oiI=g|9$o~YGz)bq5|!#NBg^wSk|6eyr)+yg&bfOYI|_hJnO{N|*+|{# zPGlSKkt6E`;-Iz+-5fjS0i`7DU-(rVc{aXuCM%##fb8W;SS)gAk4=q@p`yl+oiB|T zlGXA7NDu4m(b1kpNHS3OkZfK4e;_MPI!Z%#CM)8Hu@cM~QI#ngoCgpHX4{&xxjf@Jky`Fjl9X;UGE#?6zE-KZ|x|(J;$TH^_2-{7F zj2W${-q2wm!E5K@wjaJa;viF{R7oTC6O417?2amPuF_e>O1@M!QajY#l{)R5Sy1_k z;H%PT<^ocawx0r0leRwrx=m!odw^~ih#R_>3q)6sN^01EzKsW)@A11{AgU7T>m>Kk zrkeajtXFV=0wbMi*SZP~>^-h9E4L1L27V*?Ch`l_Hl2v%Lh;Z08}$tcc$(w7nc}Z+ z?5u)~roRzqY@SBO+4hKzOaB<}Pv_+X7N^%Suxn1>z|6|0!5bdjUYU7ZhR=q?t}U}S zi6;?lsE2ci|HYHYDcX}rrsvbBO*ZZ5kEo2wCi`hSzlkr@ad4Ixznt8`DvXLLT8hRX zhf=iX3R8}yz^#enhJvSMUJF~VV8Ap#-an*`{v_I-@Q1eXf9TWUwua29#sC@&aPruW zHhnfORp1Y|HR3}!e%K#9XS5w@Y7JpqRP+FT{jtB6+RK|h!$SC|<{{W`zq`WU7~7IL zhSvxe6}K+#6Hcw=aZX1zpdd+VA#SKzA7|*p2t^yVVL8aISBFtn94ND52d(lC91C6~ zRek^q2GXgCvQQGLr`HKA^B)SQ>aSH`D?oas;D*hL)P{)wD^d?K(TdbloEul9>P`F? zu5B*Ef0US?`eVgIcH_{6kvJL2+PzIYLyqN)T6XMGnC(7)|%LQeY0TWr5aPf=LyY1mGx4jZ? z%U?PoGOJ)~*uOVowOtu%!w#tC%o)VR$rpP?Yo-r=4`r}(?&HjH5$mrR_!4*>`%jr( z0O{GwU(Q$Q{J3IPmygZdm6aHRS8HcxUel_>vmB zOGBNqt~(7`?h%9ovI4<1QEZpP9N>xT(4&XoG$MDkL+XylYvxm7DT!**?kYcX8g9EKI}mQm>!Hes`tb{31(;KIfdn}thPP6u)ji7 zPho$E*Uk&e<2ByGQUd9&a1GLRm-u*+ty%VXA`r$<7TNC>JjF+n$RIyQ!xUr#c_8ukSm`4t&tIi`NgngL?<-BmP!wOb%PG zjj|_x5YT%Q*em~r?47g*A}t(w$^1&*KF^J731!l! zxbG

KdS;E~XVbWRAe@IJ(U(5Lt}W!^RG5hA1`ONs zo?4AaZMBEnM*7-}y2HrClC2Tx2M{B^jpb^Kb#JaCz`x`lW2>^eV4~Q6axQHV*6Wfr zw0caCHex6;v-_-1QJh}D`zF0HL1Ju2V8|1Gh;?^;7-`^3Kc^PU86~v&eJ~{=q`RXY zU|dH%i=LR(%{0qmCALjWow+i=v>%wta^XzVeE3Il4x!PZLc|`WRX3~IwDU}>PNMRg zvu+{F$jaFQw%^H`OKlrX`pfUZIy;LfR@?THCry%d*3s0IOm{RBt?lV(#dz(!qj{u4 z`fu1TlckA~_%B)xg-Ua+LG!}Y4i`9Gk2=e0Y_L%|HIG719wWYd9>a6kV+4aKhtTLI`^`MML(N(_Vn-*@p#=VSrjj{qrMXaGu~_7j8w9T1FJfW9Np0YGa7 zY6VmxspMhURL~`W?v$_J2K1n$%q^&IOW3`Dej#Cp0sUGaZtCUoeZY4!AQkU*KtGf) z?(cY9AnxzrroezNFCX`<2y`nTg^>ir_2Pi<+kjLFj-a(E<1waju*Zcsq`r*hqMyWchO=i!b2a&zHJM%k{_YshXH_!7l2Z#7$FRqaVih4WNU+LntAIWroXzE^=~;Lb}! z+*mS0!ng~zMj-CJRADrbtFSu&&62P80IC&;eY6z#0UymzB@*_WhV}sB8fw7zM;-QK zysLPeAt>m#8gdo}y!JY0!8kf!tJOSi?-ABVUl-s)juxdS;iYq7eG1ZbL}h0Bm(E}p zuyh7AjCGy?7o@zh7^QK?>}a)GE3D4k9^c0KJ0@a%p?h${ZIHS zEHy?T1K0l_q6RT6YsWKKR9ACVctyEPnmuzNRuwtsakiSBKcAH4MUTze*~=^=j`*ut zg)+VfA_aUYKyTv-_+G=W(holYbU?zmL_7mr5%7%$q{f(Q0No*B;#N-LahH{Hf3*~l z8avu?iSoJtU&i7D8+uvv#3PVz@%+w6SJK{@jE8KXfixep4Mv8I1bV=x&$WxLN zk6M!U7D7aJhfX8;243_cLz??y)muKwYe~^CRM7T={W4LQFtY1%uZtYjTfpuHs%%e< z9fab_)pOX&TARy1Bb2q59dtV>Pv7Kfja2!oA!to|88%&pXbJGySEHREj=KU@{ogt) z2N70bvtCemOh#PU)1?v0HToV>fi3 za3QkoWPFcafz_$={Ee277`6IR24l5##SuW655NufRXxEtQ$yD7P%RFSwXG_%OD2}X zY@cdiokgb%ZHA`f%CK0yhlG!|g~vzYL>Vh@LqMnaT$>y0$S*}K&uJVkA9 zFnmC^iYbXk;{`Vv2E?i5@d9zQRA2uDXe_YcMiX>YUzY+>U+Ee&Oj zVA_j%LX1T0(fKI;Wmrj$O_$vsFSufY+bHOMeql=p&J=F4yK!^REC>pz>i+1|%rU@< z7Mk&ueSJ|ZYu369GdyC~a;KtKJvujYHe$F-|NSDi#TXstE{+;Sg<;xGibF*r5rUW) z2PwpZo~)2i`>g12$$OWER+2&!l`^eIg0G-V{|r`;6vCf9lB9I zxP2L0e~=Yaw)BS{DYhT5r&}F;I20 zcjzLV9?rtKHG=KY*c2I9J(L~?j6@LM;8!wKvwYwZOpA6Se!RUazv_JOYuM3OLv;KW zT74ZHp$^27TmxO9MpBnFh2u?g++{0Ljgvj>0kEVn-2ZK)NOEY?>+phgI!d?;O|JzO(xeN+$(}PPJm-QzAn><;afemIy1^G6Md$Jc@hL3 zQ@e-r$_AS9CM#@OFE0?O1H!C0E;BfUJx@#gc<~7Gqt0AB`R}Yn{(k^%17fdMQso7N zsm|B}C;>JK_~MAe5kBDCh2Nxv<>ObK9628l*Q}w<vRky6y+~7OG0lMNo;=Q#_$|QrCs1de@$<8u+!qhVR8?(!-ePx9Wq2e9JgAHX?Q*8^zwpF3xkBkR*=I^Y* zu9^ODUZ{p?ic@7s<-}H)v)sR<%$hJ23(%mTp{}^_$BwPJZK*HHtt6iK*qHQ6*!q2$ zwZF_#hqcuHyy(7iJ36qk++IEqUjLpNgbwA*<+JAwM}xK?qUuHB!rD4i?poft4PMRI zAvDjna72H<6H(9ct=9Ac)JyfdDvsXR12`4rVdtKN_pbv~#9R-kUIg-*Y^OG;tBY809kpV=9I)UMeRuRa_i-Ct2t!--n3qDoYi%xE9@59%K+>dW!78p z(Od2sO|r`zs4VOjhqYg4R8~mO?m4)@iaDJKdv9d)OK8?%5r^&f+<{khLpR*icryBLsd5S&gphSNuEz8q4z=Lp9h_ z7S;nt>>HgA8ps(l7R(trsAbpmV&^!+C01$r`*&FDnL87ljsN}F=D1Bx2g285c3+(^ zgu`zKv6qi1omoH1J1`sAThm|j6zG3eh+7$5Zqsa71`|kJ@!B%*RSCndodU-(B6LUY!usyl-3{w9U)s^hE9O%rvwaV+&u2_#2 zxv;9hNcLmARDCPcw#uu=rv?tjE4wjXA+zgQ34jng^*ojd@DM<00oWA)ZdMVXuhf$W zh%g5rHx&ZRH&bKg;Qs>%8mhh`yHi7hv66^YWn#0OUB8c?Qur?R!Bx9!NE{OixvpjwK5sTRqN&FoP*NO==to{H3jQZ#Rl)*X>DLjOdS0e#X ziYc3gFQek9{~>H~$=+E~&nRJki&-rB8_5%cMA<;c08q~MINSn{npQolSF_?z@H({> zhAX>b->|hl1R2T4@oH?U_;byhf&8_ko9P$!Q8j?Ou|J^sR1IL}k;3OgvTO&3aV^qF z3_cl!#wJqXvBPF+(jLbP3c}Opp+=}LbFZ-8tSJ02T-=D(-W4g_*3%V7tr&u6XedUv7(uavqr$XIHVyq?jWK@MCIwp!Ac_SKn3 zEbuSdp$VR@4w+~^MR59wy^ZB}+~GK$ZJt4gQRFp@#2h5tQZLdnItDB8Ybh^nxr$DX zNn6o@gR*<%WnmTdQBw&gy<5EL_05umtih^USmj7B$B#oQu0I!kh%SLOTXw3j)etV+ z6H#Rj`(J}gQKNn$;v1Xl1E5WuE>4HzeajhmGaklC*THyes=o(P!Jj?@u)TrYFy2p7f!!UZ%0x7 zS3zVJid6T?qa@Pq$o|_P12uK#B8vSWnTM_ZBNV|QfswcqFaK+YP`(MSrIdv>rW8?d zV-zQ)U@jTP6Eg5sU3o289!L6-ytx!MRl8)i?riEd2DOvH;h6$&iJ!uYrl;Z?>=;pl zVDw7KXDIWz_*X~b%0^_lTWGSw735APk3e3cgHm`Kn{b|7gr;%FF|3OW6&za}X{F?G zk8Feeldr)H4;9OO6 zyCUeh!lu2XTl+~bNS>EFlapVqY)>Oi)QEJFG8j+6q3-{UGR|Td&qW#kXNI>o)CdtB zB?HQ+K+*$t7|C8NXtKpf6rI2lyTfv&l-izDnJR6Iw;sEwAXVBL=Vt9UdrFH;6>5tf zHe@$!c}9YFVYXYnDDI6NN|Py0aaaT%pyBhlF?}80|JO=*yX$KZW!P;t9e$-Ux4uT2tW|bScxuJv4f3 zM8=Wg%u?*6R$Wb{POXAUm+DUGR~1P-st_)SbB3?NCbRfM3|}BS>`po}^bk>ttd_9< zFIqGD6y) zpMzfAwX(-aQhWU{kZywp^;H_E6Gk&(CrF+yh26k$nrCPXqyAec1w7|OP=u`K91M_@ zA3nGM2RA~^psLr>2#3i(!MoF$6^kmR+1S*}EZ%F}aRJhgq)K7566MzP?=ahTL{edY zr1*KG-r!e9gCeU|lGU-Qa7P=2lWJ0z6kr;ajbC)y^uI9P{2vrqKa%7&C|Olc=?0yK zLwm%o7$h09d~cyNO5U!$4hZRsFeaDTqO5n2>CtH-%%?z@gT*$3c$jRI?Q%E+e(}aa z-5e^xTw|p(z~SgBMNo=rwu@_ZyS@nJFcS3iHRRPeovOniHEC$NfC0O8O0iA$h9F|P zeSss^sgn6gKpT3@7Rkh_7>fLNq+i8uQY->Ed8c>cRSl=$z%7tD9V%iZeu!YEXC&`q z1m$@<1yEKP6Z|SFXaI(5Be?;+u4X$q3P->*;HGw^V}Cm!?lo>fOfEziNjl1c>mwXi zl`cC;X;kTB@ut`SrF66l>duETf1Dm8Kp!g5X4@iTi@p(gPmFKAC@lCsZ!vkUb&=oWZxaLvh-3 z@%g$y80|ktccP^r?FXKd*+Bnl$#m|^k3aU#y?8ufocKDewX`4aQ9>t#>I zu=-t`2gaX6gQyDRlj%5y*yvBzp)E|qG=AA=HXb~~g4R*#$Aq>2 ztvs;4VtWWg4k@COpUaQ-T0syasLZRaiM!x)CwDS?Y-W;&S_N5Zy}-2MpTk2}FYMJ$ zpM>IPTd=E9cPs)rZ^3*BcV!!hw?b6?42f+y(13DdQgO#SKuyy@j(ahm;k}s8k-0|v zpp;-c=X2;=4}sKbHcG|7m*$mrpr>Blqx&^(f)daysZW zXArpsJp&tYt4+Jej5oDL&m+m*sUE1lktHEZ{aU(2MG(_1SLaiivIeT`X|V%1I)Ych z>X7v#KuX^(S$lP$2CXo1>$oabPkK^Ygu?Ck+{+ERT>VwKAR+zu&f-ZoP-Vk6w`>t) z>5d@aGEvo6O??TI%P43vq(>0lc_f&@RUyA_fg-2r`nZ@EIM}Z`AQXLg!tx zi^GZ2xSJp9scH4zg);Uui}PdsP;n6=sjL04KJ*M*J>4kr6_ptDMk8rAj*>6-q=~~O z?)uD#pNCJ7FrTH*0Dv(t)@#VC*kIohx)l~V84fczr?#ua*z~eh(Ki%t3q-724#LP- zgpmlOM?*v`F=Qm@65|HhyWU(L1$}&Wd0))i(CMz_`f~-$ld$%r%A;Xteu7I!;44*4 z3b%r@D(K~xZtg1l|7RKsyVZCze-7QWZ*JkGF0x5_cm{ zjLkhq{2hBwjU?Ag)0JReRGp2)aU197%VBYd3%gW&~nBs$#+u z9newgO5`;)VuyN0>~LSBXKBxNm_vby8%TAzltn6$Mp@E4af>7yzI5i?fh+9$9ci(z zn0ay}usJuUl3>^S@atBjjQ8`{;htF1!v7O`()V;p8GeSEbevbl_Ht;vl~jbL%9cFH zAE(FAQE0pQj$Iz*Wf$K9#UlQHL<%#Hc7cUQ%(;z;MkDb7QcC|0NjPU0z5;*T4=E@7 zaX*p)e>hnVP+3ZT$QM3V5{=P^GB+u#mkZa>ERtrs@(Y6!RTCk~m80Jq?Wqj2WZZ=Bp*|7C<1$UAJn)4 zW@S{`ZT@E|FGMsc?OGbbE#8_NDTlHaY6myHR)mZ@Y(oj!Onf^;j=1F?+R zyE%Q5F+0KiOp1nF7I4OnGng4i)K@_Q^%bb@*MKUD3?%kiHWIFvr2;FU9&!{@kOYt^ zIV&v3rnezA2vsKu(PI&Ds$KT{XYtmy=y(oJ6*ku=xeKaSX?*ze{^)V=s8InU$%hqI zW9hK6=L6VY5P80}0@`y#Wj@aC{rotq_YNoNQmf$kQVS6=zN@l%l)+{h2~iGqMcfEo z#3r#m!WoK#40PzXA6%yCm!Pc8HcdGX(7o{vcAFKyYb5sqNMA3~IBWcaHq47g90h+5 zNrj6D?duUfHLMwcTiwSPqgK^~fbkaN&g9>KNg-PpFEvc`<`T_o1Nucbd>=TfpD zh*^ZX-@{P`dx4++9~)ZwqSTb2N=|Zs4{hNnBuxj|wwcWBICOV=*4n|G=-jUP9sM** zY=`j&{R_SyL@{Ra?PzTzPGz>7G}XOF?JEBH=|=oL(BMd|r_3Wxx_fX>LAGHX7IIi@ z2}-0{>~v5KT{L>GL&cfMM;ih<3dAdPZBR0|f6hkT?X^W{(bUy#@lU!eI**$Rdtt}- z5H81JElkLi>EBXvYf0?*oUnYn$yaVAI}q#ZEW<>{<%CB^9z|$FIw+ydIn%%J;_RGy z(@1eAewsUNV20+*jthoRw7ko7vTYt&!xWR;irT5M0XoA^fa@y52|Czt)IB3<;w8SF z^@Uk%7{6fi9?oeAv9vku4~zV0y#8Sd#tj%q}1grvS6DY3_b;sq&S(Y+}u0a$cE2o zbX5%$@N3@jX4Qmr3$kQdvZu|-+vziOhv9KUhV6l61J&)Tr-bZ@JS4&^)`dO}GyfEc zxgrwl=$sDoPe$bz;WnUR*5A`3*f6rwfo3+mbgsh`6W2Xa2895Tv%HnUiyCxO?*q&f zg`1ySivE)RlVGt&uq;~-x`IKWTA24mjL5+ZPLbSlFwIia^na4c3En8elp5LK0Wtv;Uy0`cmAy95$lMpEel+1Vh_1VB8}74Y$* zD7DFNB=|vnT?J^X#QOmtmG9et-jJ~VXx5aZd=Vg3f?0r6dTRlVm3aFAsj~2nGLjX*yQW)z1{X#Hy15y}0Fnyp;-GFZmAQko=pf`n9hXH*{zMh5#9U-_E0a7Ks z0g%F22T0NWS^f1@4IKugTI)jCJ`~1cKq{4o0DW8X=n5-}igzU-6|V-+J@WPEfE4}C zg;hmCOEk1gLtK5hS1^WQ_M_690%)(4{s(|mZZGMtOJNb4As9aaq%i)gq0vy9R7tl0 zS}*aQ1ynET{T-0PEr5|y(fJZU8zkOHK#xnjZvs*+lLVwN9tET@-UD=>V0;AVdx9|> zMsJ!-1HLhU9+a?!fbN&D+X4Mr!X5#n%FG*9zfn*~Lt#LwR7pUp zZo2>}{`(W42UYn1JtWZQfYip~LTsQ?7%hORrO962*0Jm{~RBQbl&^vyHZ3U!gunW+85*9ea=X+nE zUVs$FC4gR+^hN{XEG6K(1`s*{pkD$yEEtV|4hi%;pca8%1N3)+-U8I63o-rys7=C* zGkv~)33MhP9>;MH(cl=$AUTGDy{EODp6A@j4&_yD3N`cAKMJ8H>HtpSDsZh_h-teS@YZ3-W z?Dfo$yX7vz&R)|!K`K_l5A8_-wO=lC9-Pi)Mj~}AkxL=?ej$$TWzVePOWS(Z!{T-; zH(s(uX%b~d*+0sxgCI_>-;M|h_ycL4#eh`DVdqj|djXZm*TWiW=X{iVmA~Ud9MMeS z%UO;bmUF-95xr8X~2=RG(*%kBhE3P?NSY-lr7NY5U89O_qY|MgaU=RJgIsu4XWcT|47&gcnzMrNB2 zW1i!j7Qt2l1V(V^Ayvoy;m)-^u*a;CeW`1BtblfWGj|)}hdj%ymJg*XEx!)CDBVqB z?wQ50a%QoNHzbXO)aWriw zN$qIPfE4*D98{Q7?af6c&Wy_}eAeA_kD8mQ6&u?f3a^`y529c%F|L@cn@ZSq>4N2( z&}JVJLcMUh1183{J!CStA2=nfF5O&uk^1H`^0HrM&KlA{OXO*Yk&m7iJrTe$0AgJ? z^FLHauC}dxmPO?8O6ae?hlQWWK}~p$GQ=5bB#X<1VLssl4q;||SU7)AKCc`Qj7e|T`Sx0znQvo9sX0Lw!B{-QeR2XBYeF>eLZlbuhBV3H6OWjz=KIB zbth-<9luNew-$p=UHijYh@$P(wTnqQbK0S+zH4rH_E}7^6?K_GZuQ z!?F7g;o=aF?o*bU_OykLDnPfMVKZfSZNN;JF567FG~JFhkvpD4#0u-hko5;~+MTN} z+=q|KQ3woB?snu%Hx(I1*{u&T8^?f189SY4R2`PE*9SnQQ1Kr^M&u8&m`{Pj%Q9K(i!lKcF88^mjm|cmlr9@mncj-Ov~%0`=9<5t;?dDf0%FM68$L zl0{rFyaFQ=_CVZ}Z`!p7@viCy_T$2ZkG+jMPQME6U*!k zmmnZwKgdButchb8Ni92zpoY?8rpg0y|1Vkv%TJ*;+=`c4%_Hh&{BWDJLGyoOY6Mkf-|XaBj$;$ShIOF=F=Q>YPgH4qPVHT zC~ZPkORmA;kUfYDbvI@J-o>V|8mavb^VmqOkEBh@TX9kZ!x8MQt>&;kVRaF&Y3&W8 z2_nTGg^lsMxaXkJ8CC9*H9YKWw#M}g+ZBD?Jv=yu-xDPt-w(&i+^{ejza(N8Rp4BP z>8KLXF=F7XPBbhV;o5go!<%uz9OSOr-HMY?{%A0qx^^He!@B2I_@lBS=pLCg<5&7( zz3lS9$9uN$Lf}Vna5e@J0C&Oj@t?55P7vtF!sW&IT`Uki+WkbJ1b!b8hz0;PU3?6X znh?GW=u!D9{X!qzmxL)4juXY}7;HI=LN-EBSi@A{`8z8Xgs&MSLX!A{(d{DfM@ZW$9Th#u$3(AYE`N7Qu-UxM2go6y4Af=_+BzE0N2lU;$Ft8ts&MG|D_WXr?BU zYlV`KM91Q|zTZO@_mirzpuUvZ$yQON9tlX5dZsSxazLv5iW9BBnRduD^Fl>h3gSvtP)h>Y5f&%q0V3SKx~cp;y>kY|Txe;MrDUXoji+2?&h zL9D;o7SCEbrFH9x;94ry?cdLocK|ih%L${H!ur#Egqd5pAD4d-OawlL-nBEl_XQRC=sBoL zcEQS&ycspD99m}1QQF}dj0P4^<-#58G{Z1nC|*a3doCpxM}9xYr^kh5IGz5PK#Whj zMZnh^(9b1|J5rQV$fe&g^7U3g$_9F$hB}OBWo!hfhR*gs`m2mxZoL2kduoH4I<|@- zyLn6i*D724vA48)29`xa(09yR{T}BLFfBWrI0TSqH0@kS^%fy@JcU#@V^b)$_h9^h z(-+%~$epLrOVTJ{8eN&jQBo)o{n%?1fcM5!t+ED)K*EIGqBWq*zME2uDlhB-(0er} zI;Mb}nLD~-$+Vs0QR|$!Im)bZ#Nc~NPOh_|RJa3l*xJE~^sCYFp_WpdXt(@Xy4GH4ztx&hd{M-`aFu!!@ z0(~;(1}Swvk8qRjwx>onPc;QQPQ)AuRj( zm${#ry&LD4 z*2mDmp}43?D18j&x)`eH;9@9>$!VsqFk$90M9y63b@kI;Ez0rp!VB*UUl%> z040TzzXYVT^1XnRR>Zli(uE2jj+8E^#E~BTT!t&f_8CRfSdkD7_ZCOb#wAm(mIo>7 z5EIIcvFYk+SB@)v4Ynbvoii+6f}B+eD*$cGZEL%wxpgF8G2;&KyGhsr& zwIaX!)=ulhRbtkosD@+BfUGG%5r@WGA-pgLGLq-ZNAIok&b{i+-OccDZpkgq=_?Sk zW*II+mr<`NbQ|1OqB)iBj6p_m5+@l(@)Z;b0@z5jK|v);fQBXaNf&@Qo)&E`7RoqzBeR1W)f zPT2gfDYgZ_}DP&n(?avDJGo_s8rzsQsd~IfJRAJ zu64iNd_%frkR4UeHJpBl*@UVjdL&9o3;xcNQ3QHl5BP=wQkl2otk+DtmzlbQgFHB} z1UJX=2M0j+nZ<7`#*J0Av=D$Va0R_xt1JYsQx_?6+}g=}2SHMPk!>UE!>FF>~-%sA#+u_vbx^sOn-|_w1}XUW#+2N=bA5*>JnpT13u_bDTfvrK{NO znJbhZ*KFL_jhVC6?rl%lHJM&&-M|wz(zN5wb~E1jYg4%6Gel-6=jy*$AIL?Zqul&1 zL;ztq+foD=j1SX6D!5AqG!{?5cb$e7X{b&^_iKp5fx-}>=k?R16a!Ef^LRKJE3?NG zxOopSZNr|N^@UZU3{~0}76j$Wr4SukkUFBe%NxlWyxWtf+T&(RN>mAG2LBd=>1`Tge6QyB?O^4GKQ{}X5xwL3~taRI{WC5$wlArKi& znNYU^S}kETCzs+0$lio&B#gSW>gBwqGe=L$+Io)I9w)bJ58;b6lJmt^PV}uD;L2@~ z=4+;n1?dl;2nbnem1t*WIl6)3ye~3PL?igx^sOV~F7Df5K|NDb6kQ%eKFa?KZ5ze3fpyS_`PX0uEp<@(m5hEPj`KiWNh zTW|O#p(Z9!3l;GXMJLY;EA6=wM;*Mvb=d+f zX;q{UK9L$1PjELfV1#`ih5MiVco|8q^EwNNa$9GJ-sF10+g1WQYS-f<{KeU+8US!p z6|#qhia)_}!6&YtGwDdtTg}u1gCIq=K7@F#s9?p$U^7D*OxG9*rPj%_`&t6Cr}krJpq7kQPr)ns>M)2%R^=56Rx=;xH!6~YUVA|=gtm} z7!fS$_^Ti-T3wv#P3Q9|>W0)xxUzvx5uf2j@l?SIxTtNiJTvVE*E&POG&r zws;PT{spmgf#)x9Qwq+UH*djG)cb}-3vNLTgcx(@Gp(vcq{rgu%xIOblk~r+W;#Pn zG}Q_du9-Ofnu!z2LlqqwsN<&~iZgfiyei){|ndkvH4Zi3#(>DQ7^>w;JJRat}g>0#t;i zP9HrXR8jtgG0Vq=Sk_VF$Bio=HF0|7gz*!{j~XBGBz~lF&z`$j3a-od#mRIiA=mKu38-NCHJ*HR+DD8SoHcX)`~}hA^;N-Hb7s!J5j}zQW(6w3*OYhQ zjNFgHkxnJrBf16ET-PpP_xnQd{9JU|>77MX;hF(+OW=HTdVM80(_3WWyfNdUBz?Wp zV7DCeW-g9;%b;la_34u;%R&>6K#2C=7cQE+VA0&@+}q~Pzfro1uw!uU;vnhk^l+ck zMA>A&sP_^hcy7>~II;4=iv}0<=-#9IH5L5zO{ltMK@?11Rka9`A{tvXADzL|xn|Fd z&I~S{GZ!6WX%z&W)8|}%fUuc)OV!|Du(E2=oS6$3pRZDyy`V~!cyVmu!Uc;U#3kn- znrUIxqIt^(Yu3_9`m!BO(hM%1ds~$cR0~~!R$Cmq;fA@hM5Ha8IeRv#vv}dmSyfrd zeUvzEVXr_hUl6=y=KN*B#Z}QL6M+<8G`DJT2d?TgKlDvVF6=i5j~{o1hfwX?giWSL zB9X|d>v{{UMj@v@9g2|q)zc*N7tFuFTMX3(!3B%50~&L8SW=TPH$4on|DXOjveWGs zOXtp?yDDqmzUCG=sR}gWV)J zr)uVG^u`Ep@+2;r6qwif2{N`DM&s{w2{2&@QreA$w zN6G1sWN_)sENg!C^aplV{KI>V`Nus!{3~+)=cWt(@wR3Dx$%cP@9verWzM_Yc7}Kn z=e^STf1>k0Z#(Co8~(p~6BOaPLU&gZ; z&jCFAqv0cfe=d}-Asl^hzH)nniq~61eKo|j1@$$kp;rMl;0Z&Gy%-O-+9dF-!Xp=w zP`$-p2_BWZf|$F4n7e|QyMmazf|$F4n7e|48lrWnrHjv3fTsp99p&DGD%Kx^UA-_g z_d6E5VelNn`!HnrKEm2)1IOQ7JgP(rVu=*Q5-Er!QV>g|AeKl$ERlkO8XBmfK^i(= zLq!^*X;k5IF7ZQ@n|80q@bJ2#C-7X0hZl)mi06Ei`%FAMR>{BlcvRUH#Ih@hWmgc( zt{|3OK`gt1Sat;kHN>*3FqU0GEW3g>0J;@V49}S;6Av$*=ai2ve>t9?;2RCk@8KDP z_p9)X$8!yyDR{n#hjyG7Ha6_yEs;@O+NvT|B&6gx~o7BRt%R%_VSN0W=m5Iqg|I zwAY64%*3+@@3cD5JUSoGWIQ!^W;^f5RIW8st&zf8fKCORFt&yYV{0ggt)U>chJx4{ z3JPk7t)apOX^5?%!q^%LVrwXft)U>chJs2o#MV$@Yz+mmH5A0wP!L-~L2L~Lu{9Jl zLqlv06~@+35SMA+!*eUBlf?55p6}xQXLz_{oeM4eqv=mkOhKfWf=Dq1kzxuW#S}z} zDTowPP*6j!V<_NVsbjEM*AEGuhFrN8{lfsZE1u!=?dpcJaL8&XN--SIdys-WoZcJX zoAA91->3J04FwV<3HRJ>~{P=82?{{=Q2E3;JFgd zcM-4Bz_~y?=io`BJY7+p7x5g%J5R9v7h%6gp8R_jkD`WxNDT#%8VVvc6hvw$h}2LJ zGIgM!h6ZYAkcQ6JP?3hnKPnaSkAjA4s6<0$8ZtE$(NLv^$UiC-@{fY9)zAzL&DPKy z4b9WgLJdVVRIQ=q8miGyLPM)HbeD$KY3Lpe-KU}NY3Lyh{YXQPYUpPg+NdFxxeO1f zLR;?Jcqr>Lc>alpmM)f;sWjlp14nkna~vK6&)4vrgy$4I1Mqmq5gzw;$B|+9HWCkW z<{!sG#Wf1b*I@-3>ZzgL8tSW|{u&BuXrP7$Y3O_n6=~=a4Gq=Ma1E7ch?G&~BYhMU z(NLv^CTeJ^hOX7n3=PfJ&>Ri11ysrlH8eO{RUO3}|3E0Ay1d8_L(q3QxfKX|UGP6! zCi}+_#JPU)VmFM6Ms6HO^+5P%=+FEM;K}oIBLV+@R{O}ffaK4&E^HY51$;rt4<_5L zDg;6ZSS$;R&?m3ox??m}gO1~39e0|-g7^X!=|!xwKEL2M$7-w-bQ~9}yOR$8%k$rk zU)J!Fil_hHRb%zkaa=6RsS3F(&wnO<`FGCrdDyAVT=}K*(^%_u92e^)CqaJ5^B?bEtv}fH`0g6(cRG%Xwaf`&1LXP1Wem9Z5v%SvjYa*5 zf5-V;tdmYvA#9R7|2X_I%87YXM;2(TQ*|5{YrYeLLBfM&&z*634~-Soafmf|QI^SA zqdY%*4*!1i=<@>@qW+$CN{HbBaTbChxK?t*WB+;6&?z_SI6>|h!QcH(2>W@S|0?`4 zAbQFp|L&==9@25#S`<4a#83vTs~xPOt^59Ug2o!D`fj*AswhrnNNJbC_`@XLO6`MFPC)>~tB*KvXl zHRw}-e`Loze;I%A9DhUliW4lJ33C#Z9yj;j!b#} zoAFD+pU|V%hW;9hcg*syzt7Fk!F4m8o_G0hM^N+zV^V>?RBq&&q;g?k( zvAN)_pvLN_;{+XQyy%3SE?Bf8u!Qsaj2dvd#(Gu9ar3&#k;bG$p8pyL>j~?(e>g*9 zE!1&btZHYxpoGuGI#Xk<)Nx#_E1VIH{GaEi$A!s&KKt7p&kfXAB{~l4<>m0F1&jIv z<>2MZ2fsd0bNF^Aud^gh6FM^G&a77sHk_qXeon_}pYm@7s|df${PXd%FFi}AJl?7M z*%F5u8>#xku`ge7woZAHj^oyJo5Km`2-agL4~5pcs)cWzqp_aVaa^p`j$|7oSU2ET zxaIqgGz`*MYjhmef`9!eFz{E1C(l0zDC`AeCk(ozP-6vk95=5DC*)kgnt@7@+k zVki%jncK8*;$WTfcXb?=$IFM?1Zy6CDXspzqW`^vb;?Pn78gpK2heRPn}%)~R(GLJ z+17E|r@URT+|l9RSM3;Zp-y?IBaz6ZdH&Z>W{x|n4+cgQ>6EY3aatuy%m*Y_I<1;SVp;SOq$ci?xJm4*o92ljnZ|zbwv0 zFIihI)>zAR92e_ehg+!UscMg#oFk!@=(DVj$i(*{?#jY4b@nibQ~A!0wsSjTa( z-g82(5UgWSJks!I58Rr%LSy}1$8oXVb=qQ>VA1Z&QRa^G|2$@x#`-|Vak2hLH4uNS zQJ()k{4%e3>kj^AxW;-@$8oXf^M`*U@L(Kt@>=nmWp9qqSWoIWE*5P-{JRoQu7-c5 z#-i^R{$1&Fv7TUu$KOaidH&)v;lBpZx+hQh{z#3rS;rxkw|6%P*01q<0iI(2=Kqe= zeXtihJpM}XRVQ9c*TW+eQT z;mPyQz%R1%y>?^W<}!_Sw~pgt-Rq=NE?E2di>FKKzKhE>)^~Lrmm1tK&%e=l^88QY zmjOTcBrpC6B#ac&^jlVFSJpZdG3rC0ey6@f>)>!Lx92cv~2^lL`luJzb-0e4gf2_v3 zS;uj)XanTmRe19JDf|-a;OCcraFxa?(Q#a?jZR2Juy){=jWc~^a&kmtZPIaEtY4F4 z_^ZH^=U;Iuv4Kc%TcV{O%Of({?<;S>{p9A+1nJ=-v^~kB+DmB(gI*yC=DAhsyU5zKtAHpxO z1}}R1ysI_VFLWFiYon9<1i^9yvG44?-6l=YSetYl7weBsI@FW%{2YP#cmH)Gc3h*e z-qdkitmRI~M8wU~@X3Y#$rCl!9XgJS#Tx|pHwjOk-=*OjV|Sf7Nn_ROI4;&WCuFi< zxh3>pn`xY^u_o#`F4pl*@17!997os%W1Ac6r)aF+I*yAq&(V>l{$K2U3t$vQ*6s`w zB_J>XQG&8EO2i-t2?R(4+ziY>kIq1ZfT&;yd5~yGVlv^OAc09B?GQypWmi{G(Zv-N z6%hq70SpmYjfjeh8eDXVVO>Q-upM4&Y7z3)Z^5tM^{%@ zg-K19QY8|jN!9cO9M|gf1V+w91^2R zO%N_KnN+fnYI^bcPiIOgpTuZVSBVkqO-w3RNIiDph?j1XQZ9+nq<*5#09OWx*Ja9A z);}9lGo;i>iP5BJ>S~G6q;3{D&1O>6 z4N!U2T-4krTS^s6j3#xr&}xp90%Pg?K;xS^QtEz*(WGu85H2byn^hQ`rD^QzzvW7) zasuGWmHE0*q*Qbln27S!oPOjl>HdsNdZprMv{d zb&J%7FcwPzTy0j;B$aa1ZFhfDAf?1G3K%V}>!`cJH5X*FCNLgP3a{E$&y`X$CB`9I zfPG@5SIDFuLkejO@YmR*V+*C!0g2J1N<}|d#H6mlolh|6g^(!Vi<$e?QpeO zMN%xA|L(s3_K;K(6S6RjL240`x`caM9=&q^hD9N%;oO;F3{s1k)Wt$7VeW+!7l))q zaA$@wNZrAt`U|O&D@(TD5t16oof*a;wS-AgFHF}jwJU}#2}y}gjA0B?<-ppkB2Y{B zjP-Ywhon*{B#WgSWGv;S{3ip9-B6Hx7m|NL4bazC3}J zS#`0~D|J%bI2gttwcHTbzB`_~e7R1F8wbM}q*gE~t(2GNjqSQZC&i6}VGL4LOzLux z!rSwD&#lr)@p5DsgOtjoG@Jk6na|EvbyD0o7{(xVry;J2-{pAj)JbvUU>Ji`kV%Q^ zXQ{vQ#SelZsiE997{(yAl1WX#ov!-D*S@(@C&g3FFa{}l5)9Sl2L=VlSL>v>Z7_^M z>MkZViXy`G-kgm`?$Sx|lrxM$>TY0dR?!7otP@hNxmzd2ZG&M9QmdGh7!X*}-+eA+ zl}?J=2E!Pn?qO06-0Ax2&6ehSbW+?l7{(xVFR-Dux32ess(W=(+%_1-Aax&;((?6L zJkcY9^)StJ9dbqgU&sxNR_uLF#@cbsp|?J$KHM{r88YhH=|q7=zRU zz=qoS1F>%%c|a${ZG&M9QV%jItuA+X>YLODbyD0m7{(yAhDkYar|XGFo-bOXlj63) zFb1hV02^vWJLjye{)0}6+XllJr2fdHc=|CK{KT5|N1YV64ThnlSbB(Y)I&@PLjZX_ z#H8qFZ#~8k*Te9&S$hkarv`n#_F-LI+@cu9AoV9EwLnO{|D$KjpL9~(q8P>?^$3&d zA*6QPcj(ebbW+@+7{(y=D3j7`WAU9EyF99s;ugg)2C217O6y@`Ztt;mZAdDKTNJ|> zq#k2Zak$g<{HxiUAJa+k5@8sF)Z@U0R%^^WyQThdofNkyhA~Jz!KAbiQO6r{?|woj z#Vv|q3{vZulvZB$@_`4|>7=+tF^oa#NhTGKJ6%iGB@KL1C&ev_VGL4F0UNT7bq5#O zp3+Hi+h7=j)SsEuMHCUPZQU3C_Gg_Gw+)6dNUaCfX4OV1B|q(-yIv>7ZG&M9Qcp9f z^C==+)0QO+e_AKSZG&N$|I!ZZkL54;W3!g?AME}YCRI{YIEjH)vsgs-a6w2ofNkyhA~LJ$fROLTu~c;e&9u&6t^gbF-X0{q_mpStMjeBU(!i& zi((jq)FvjCBjPIkqW2}6bW+@+7{(y=GLxDmq+WY&e#6TlsS(^Z7{(yAnMo-^>amvJ zwrpln+ukj$nJ3ae<_KK7mEu-G|_FGHg)tV8(gQxkQ zVR@ex7P3!Mwv@^Z!??m+TEbkqhPlLtxqQ^4ZJIv`!~772SstdtE@3V?VJ`E-LT(My zMqHTGQ(-Qv!@@}n)7aB0@&3>F=E^pY|Vm=B>;booMV%CI(Lp`f@@f6+^rj1(BN)V1?E)A>Q zWntDbG)zBN=?0rToDN~(__WSh#`R@KEqz+-WnsB^T35_Gad)b8%Hznootrl^>RiOTyy%Lzv61Fqf;tTnfTmz7Mnc7sBf4S7GTn5SC^&46`fD z<%zJG`%+jqy~679t6^4`5ms{-hK2LI!R9k(<1_M5Q3yNyeVA>`4s%(f4g4X^6Y_DG z9ma*FSqZCOC1Eb#gw=xU!))WiZlOf;*sn3T49>-;^#XDVqn$a{!Z~?~8_B*h2%r5W^v{z933j>(^wkyV6I5!Zp1 zclKGfmhGa#j5$S_^E2CuvcQE;WEEn20ZlYAfN!mmQJ6EookHMW`s)B%3fmW8;F=Bt2LY){Q%+ATpEGr1P@lxYjN0|9-ePm%9 z{9x*a--t6~ehEvJE(D%TokIzZ#S>Se+qXk6C4-*GzGlS$=G6lwr&Z2k6QL zWf~IE$~(W1XJ2GikKns16`-||MbBy}OhoLUl)-l-2>17wz-n?z!u*ATs0CC9Sk<_S}5bCBDB$siky&zCSB( zu%C9w8LVkZ(+btPf}*UqaF5BB27;Mrn(cjT0m6qSV85jO(qjEe0qDwaQ`J!8ABGV}{N zFH!p_eryj?*iQ53&ncOkUr4n|D_9hI9;`RBw5UB9?BZ2gHa7?TNMRwikwQlsId5WT zj&Ph-rdpI)c{wn5(ew*Pv+0$p&>0AJ2$_>#D1Ee6EgMx1No8M^#nFyl`B`X7B#Z~Z z>Lt2a6i!<&t+&q5dkHn8*+yli7P5^lxQEshM)LP(X60!eScCvj+ez6hoD$tGO%#+= zByWhYB^QOo0%_xwofGonhN~&R6xv6xjq1$$BxzBRLg57^lM)HiHo3YS$t3a7Sq9an z(|CuHH2ZWg*t|%&fN9ZS?gu@1J9dZ2z|TLP9R#nJ#9?bKZy0Q)Ht0Mn2T+PG=!$|Q0GV6`(XSj5k{Mn z12f(TY7K>mPYaFzL`OxfgEYF?3o~-DSs%43D8Yhu@|vB~)+fIdV>EweTW75rloih@ z!QMe=5YQwRwhN;%A;xUf(F&ZFS}pHvY?zf-R(OlFDjIWBCPZ4bDA9QqWUy90gV@>V z^V`V{*+))pE;Y6o#L$?O4?)oo&GF}*Mo6geG_qRq(Xp`I`?TM(9S}VW?d+%d(YP@O zEsb>0RT~=GwUZ#KFxL``g7Y66XODw>rj`Iq1*P#grHD_ zUP#N0@G=ZPXo#7QvCWzBV&D)-p#8ee$2j`H+sBIJ{VO7&;{I2p!ffSV5f*Crm$DQ= zMk^CoBiqAH`%Mz*#eLpvMP8sh*6jSPEWJS|9Tyr@!UFT_4#7)G2v zxOR~3=S7#^2r-;iPRl~Oa$4&n>|JyUXsBt=KuzD!Kb6kBkPDT7aEcuN{LDf>o-xs( z%TV;q0^gi*VFr&j5=7We8$fAZQCR_vy3ytu5s{NYjf@eeb)%20%QQSRdQk@)A&SsI z%;+l`wFnYy4#MD0lOzTQT{Ud$u2nOGJI}4b`iubzgV5PRB>&6;f9bp|?i1Nc#bAZ+ z!XhU!`6j$HCdn(YFqLb9hAGeEZAELATtilz89W$}U% z^QrttURz%_9V-1I7Ze}6YU65Gs3UxK$%KSf+s%Y+oL({!IE@?u z`>Ei1rVmI57s^#bT+g>h>AlxAOSke?X}k5`b$uA+X4E=ufH zE>mKtgIe&X1xa%{ElOC@X)!t@IxUXb&*>3uOy{&MvjLd3x?YCxzv_rNhdMiZgeCZJ=g-rBh^hAWQ1C~+_FLqAgULC@QCn8l@X2= z1Fv?$T8r+_$0S-I?US6N#in^_CQRK-8D=5bvvoUdFJVOIawe#5ba*Bx(=ye@c4E~g z)d-=bTD+?C7iE;;;W@djJMEj@#)lF_*u)X-L=$>DH>@2*==Iz%86his(tmqGpzimS-QtLN}MLBsZR?aYyw;ZY5*}&Z=9pj zKy5=41GDzLwb4*0m4-&HZTqDKqa~$nW)m$#5=SICbXP(c&s|0&aadwP((n-sGplp< za=xmgBbE=`E?%RvdK!A`9+7ic5@zYQ|BDEMW2z;gM!yAMd$@Aoh9nJ7()*|4$HQ1c zaZoIypmiFKn6z0#5{IV@)dAh`_!^jjV%Y|*Az-*+BSz?8mX-K%J1`x^@*rAHz;GkQ zcT56I>uxRtW{|+icnzuJTO*CoEj1!>7T)k=eex_0xQ_*HcH8iV8ND~l!h0E*Bhwi>5TTJxMOoS$N~N&VV%_R4r-}mr-^Ovm z#qvbsCa=23BacU4Fw+~Hs~rrbo$a)n&W7@OgNt!cB|oamSJ~?CoFLxyRvn`?at~69n=8(nfR7lJ?Sj}`eJAKJ5e|y8D~?u;u5@SL0r5N zI?48gOa0!hHnO1j*?5davM*G3(m8@68mIaNJ2jG@HtJGaphJZpN;lKVjx2V*VLR2@ z+LVc7yQpl_LHyjdsf?R}`!vQqi~DtqYr%aw<7oZl^^Bvljc;Ha?I(RB=}S(x)9Y+C9t$BFj73Vd}b2 zMk7VsRF+AOr%(L~LGZI>shOe-M+wVRztW#lOQ)K4!I7qJwVuP7CC=PQm2;*}DsVJ` z%rD`mrGB)L*0TOMxjGpoi4)Y2#X34okB6eO>x7v**`Zy61{t}P@JSsJ~zO)FZkoToiniLaiRxL0v%%9Wc%-44q$yBimk# zVrRO2EUL>1?dUc-t@Uc?NZrkjN#r$C{k7S#m29qQ2)wqk+HomyRD+u?BsglAJQuF1 z6I`fMnFWes=N#~wLz&<;=P7W!UVQ{Eli|L^o!6Y7!OdoF{f#xpc#^S8^_@(F=5Z|K z<3N)!x^X1C3kTSVbFI;6*(<2Aq2nN{m29OtZMwHQb(Xii z4CK1`DujT8wEMuIlZP&ZNK!i*4=0!o)P&=x$yvIyCm=zaYe0SCK14ln zhiXgQha);!TA=P5cez`*}UL3y)x!e zeo&O8k1|Sn3rl+QO{`)!Uzb?p8h95ehIH>opTd49)en%Cyw%G|MU=Wr^?_cj3v?I` z6HKh(fp(H0s)5FqLQ#)kqm3N!P48Bz!Z zMu$3z!)=-F5T>)v4Ug70z3LGZwjXEdPF;ZB6eY_Lb@FUS*^2mcs09%t2WQ>*S?Fet zDS?_)k2)UR_Y4|c6tLF8rT*em8$H^Qk3kL>s5EEErCXx5@?Mo?E@oB+}Avw zl~+>+LPg7h@k`U^2po#>1P-0_R!>Q0FneDY9Bq>uK#ibd9$ODouP9GoN2)KSw(Kws zo(6ep8>2i{s&~=g&;jMrHQ3&_0zqQ)H(SqWPoOr&n^Ir)gSR^BHfCs^r7dJ=_7w*K zK@t?SAruY_!rG!(cW8FTOyzloLCf9fwYE67MYEs3+547*v0S6NE^C<>jOsT@jk@gW zV0yn6%@klNN^6ZLuq(#X`q#3LURw*aE?oZ<-C??Q<7QduOm0|>qK<>r;Ly)sG^=EW zAy3vF$VOq`hwKDZo0*K-(%juEY>OWg+JW`-bQG;~hEt5fzCkLu6;LO@ZDcGs?lu`5 zw+wosnhR`{gSML1R%Pigt#7op+V9;Fy@QpNz48s<+*HTj*2dPT*n=@9P^zzk z+GI_%SF8fkL$w{X`b$lJD2Qeoj4Z4KX7UDrY0rrP4b|L6UUOY>F{p4D`}))tSz)PE zzGP?^ULW{l@Ea-z&5z0fhZA=-lm(h%N9c&=owp;MT;unHGm2pUJ9RqD*{Ea zMw^$y3H&Z*Zc(xnXi%&x1>UPoC;g|PI(oV8f>YC!Y9H@4Ut?q4t!%(lhLN&+I#s4~ zl)wT!ctoL!c6brW!1Dk-6vQj)A`F?;kNIF%8xW~G)CS~hI`TDhXFsIqR+cL24)_3= zbp-#Rw3I|ji#E`K9++m{hGx`{sQz=^9N~rAddCIM^6gAF{?VkD9$YWyKrfwmmwow* zFg&K28T?^_J?*2WqHovq(|pzz(lS((CVJt^q>`vmbxQiLkT9;Xwh5z_-cX;ZvR14> z@=^bs>PLop8CJt?R@B|j^1nk@{Mchp5EV;2(niJ6Gi}|3g%(%Uk_D)rc$%a$k-34g zR*pYRq5$IAvnDGY)OQ@v&g-oDMRPaj8}y*id^UgZW9IsZlfhz?? zSt@bo)#^TQe&+TF?!0jejbwxhQps>qk!R!_k0q#1NAQr(5`#gX{|;(UB0p>Rp^BXm zR56a8?nxEnX4Q=&Rou>1@v&YNc*>UTe>^pB+5-ku!9AR6Yh+dE4^WRs#&{h?$10RU zkJnr&%fNA^RDe)tVTyOi(dlSI`XdKCjO`ljF^XFR*j~%KZ>FZ6vYZ|9^<&B z{-@)QFf3%vW%)0i?aLlOLY2U)Y%aB|Gq{#$xcC=4)%_Ttv*#_Xe-CR%d}v4X59n+} zjrPK&eu)Qew>AV|DrB`0T1JO;Lfy%J>DmnSKywTq9d$w{eU|p%U>qdT>=SP@Xduk1 z$5L?fK~Ze-pI47R;`ajP_9X7SdgxzypjXCj47kaQ|Iokg=m0+>hFr{_c2p(lASv!#?@VzjvGc!tNHEA{2XE^rrS?jUCPn$7i_&G>)iYX3 z(J+#(Xrzz_FkXa%$r(sFaHqJ&Z+U-8Cn@EX7)>e}7`iAtXajeW@=Q#-ud|f83NCbY zmT}!k%ELwdxXns7LsEgoj*HHbQkfE?#YKZ?y1Ib)j<4j<`K7B8yGW^fBu10U6zb^8 zr08Ld^zzb)H+yuIQgb9mlRCwVjh*RXv%Uujf?WFXTP@wBRFshFX3?bX6jF8;7rla^ zxSoCI&ee7)wMt?%sZL}RxMDyyD?L7tUWVTummDLd>=L6%br5AiR$;T&K#EE(EwBHS z?oujRVl*l3tKl9@YLJj}rtRL|LrQ%iQrN?yNzu@Tu5&>)E7e;H_}1Rmm(P__)UMKX zu9R9O(%ciSMyZ}s>H&$-;uZjn2ylcD+DKHA{>Z*Iz|A7luh)D5c()7)|PLum-yNfNWNJ zaYT@rw|$e@M@ltGj3#wL*ciRSHnzt6rFQsEH~?BMp_{mP0GEpNkRx}YnGNmYE^GN8 z=EzxUNwtf+Toi^02x}o6_xvEtr7=t@H_Rnni%5p^w9rN<FfA;F;|wVz@t3(U3yHJg`?364#6y2L<`F}BPP2~z`yvTbW0T zY}$B*)_q6t6wB}oKE`$51}`3&mRs=|L8MQ?4GZHU1R<8gMet$EA(?x`?2C*>E(UGs zj?{o$vxDyuq-Vr%#h2ib!<8zG?9G)JF;ezrrB=j|zlG%15L)XPF`UzQhgP^rNojrb z0iG6noA2K=XR!*EeG(?!bhgMm1{=N=YYPjl$E9s8w9k>X4?ql`v}gsQ7ZEG@#Ij2R zJTv>|GVE($_8TZ#7Z{G!lAB*hpH*Vxj&MjslW1e+k;~q&SXAm-%Vzj@FcD+Y7Hvn4 zLSL6;49037;R6V1vynb-5Y^rwM$6(14v{N+B*?$;DTP)TJaAUoS%?w!qJ1`xC8PLE zJoFWXrrtArxWH>xr1jMzYqY9G*=YIu62*?PK|3OU>E{ok@Ca#%`|K0Q<5(|g?nj#RSO1dg5!4w=Bw^ubpqaP(k( z(gf~O;9@CI-4#jCG>J3D1diUYO)`Nay(}?_TWtb&1;WEjis6cskG?>BXaYwQ3O|~_ zQ9gRm?2PV;6fZS>mzluPi?HD)aQ%S0)dY^($<-!s)a-3Ffg1?iJ0@@x?+Ft)nl^G! z<a@tO(T#lRghfg?S4pcyvZ6)AnxzMN+Q z*Acil6Sx_`4K#rxJ6&M{cL{L!o51x4?iCX_7jU1M!2KS$i^*toS0w$7fd4ELI4X|^ zBH)G$ADXO-g3ZZ49fnIw9Wp#2$$&#g`ZO7r?uyh8(gga`4jl+=q7>bC}%z)?O%nZQwa9uqhkm)vLq zN8uHjz|pvAX$0Jm;cY%D!aza|!;zgDztx}tpGuv-?jk!Kk~DI-&WVldRI0?fE0R4^ zWl_;s)>4Csi}aZqlaM+japX|uaJn15{b)N*Ovl8m4};Ig26MstkzNXqy+T*iuX1a5 zMCYpAXYSM-?0XEqUa{uZ) zyw&W{XVrN7=APCGxOE<1)zgY!=~nG0IQF}P@J_dOV83nhw~dxTdQ*0ky-KT-F85k% z6Zd(m*<`Y|?$Kr6+@(7Nx>#LRUAil+JCu}$vTtVYq+WImD9TbHIhN6B$hte&+gA&ZRrC z9(9R3C3eXHm)hMKv|2mh<{V&g?uK@8M0yPq@9nI9k$@}+XUY#t{^B0+zVqi#TxxG; z(BevIaM`^Lt^o~B)e`KW*4CcrdvUGH`kva^JpfDU5QHwJ-Ce=nF7?BuKN$kN$ZdT; zLTD~)4?_^hYvsN>dO6j4XYG-`PHVmMy%sEwPHC_|QbQj|gvzsesfw2mV^$*@^Dj_% z;VD^BOBHMVRjrK*SNhDIm2Z`Gl0W{Nv0%lyrkei)42=da21Qv0;J%e{)J>-{jyiU- zR{ph-hjG{9?q%E!xQ}NXUW-^JGmhR+&ShK~?!}C|1NWO5w*vR6j9Z2K62|=j_l1mm z9QP{5J%js=jN61eO+Q3gUdKJixH{bLVcfg8-^I8CxIf6aL%2V|xNmTu!?+)C-@>?) zxUXg$t-9a9xNhK{W?V0D&oj;eu99&Bz`e-0q2OL-+$eC180P{vk8wV5lNd*Dt1=l! z%e0?jTpqZ!jJp-wpBP8WgR>bI0QX16tpr!fIBHy%G42s?H!<$d;HEQ9Yhmfbihceo z%Tul_>!JjHvHFK7t+h()9%?RGtA=IW_P(hWYBW2I3yfZ6@ptvK)_PO+lpWoI&|q$t z;(pu^DD$9jF9|ifS|C;ga*xH|+0$A>&FE2H=gEv}4PlV@1T>{qG!B85PX1Kf9sVof z;_BYYTn00jcwd~}EK+*05EGbr@^*y(dyKDu+n-0u3{ z5XLW|Fs5Cn1dj66Z}^VJhrX#BmR?~M+!0_biuIJjm$%V^VH(L=QFfs$1Wt6F-$Si8 zHnO^ggfjgbD2lyz|Bi7MYX@7@S!Z{Q?$r65E?v9XW4iY^x9551_loU(!G(Q(cTr!* z#h3JpyR`ph@dGX&IOvMOLlP2)4#OwwBa>6E95s5(RliTooSlWem*(W<-+W8K+`^*b zTk(FXY~K6@3vat|#>|^CX0`8s`=Z5nEGb{QEKpIod_|RdXK-cpU3ag#=id8P-~Yga zYyR-ZhaUdZBag0q?C~eoJ^9q1*FXK2XEr?h-18e>c=4r8FK>Qj%d4+#-S+zSH)?8k z?A-Nc-R}Cg_Po9KukXCu@ZP@n_kZx=M+ZLsN$sFwNiao$5mH8b-xejcm zfQ@7wrI-}Yu}sB2yT!%Wygw(~F(u7)y<=Vuc1*-}yOWA@u$vh;$9&oy%`qGAm2R=5 zl@$4lvWf~Ed?#To3iigqQIzG+@t0cMlg3+Im_&Ertz%&+MFnjFj}2ZX7CGh?mE<_4 zupM9=9+x9?9`>lF-JdPOZGL8{BeQ_E30df1Tb*S)ib@<}YXl9HU&{PwAIS8)93Ii! ze6}IK1Acg+f-tayCo+`_X@4FZ`HMI$1VjxtEm$od90Mr!C$%^cOdeA2a;7^SJcoI@ z#LdphDGcRIyq9n&Zl}vVc}km9SSC!u_l(y&!sKZ`30YA5-HFh2C`ptS$|dda;h@b< zXctchZBxREhqi`CKC{c9hazMZe{cjrQAws&NF>X5@ubox0MCpr{|eMiffvoC{o<+o zhh$?LFZoLp_jsrjAhs#0w185WQ+`%HG9oPt+x$7^U>ngwN|BaO%Q!9RRK&%Z$PTP( zAxltZadAO@7Be?XdJ&8yvv45_C$}IUr!6?9xYN@;6DLfuOvx#Mc{=EoAt^XJzmzP8 zg;Jc8Q(|Eyh4R)4p`AkGFM7!0xpCxZwn3W8DubmWFXAm6#Y1LDrlu8%lAfOC5QUYS zpM%OlIg%SCP0KIB4v$oG@(UddI~O|5#CFkh93^E&OE1aEB|RW$zSXPH>bT6pEWF&l zE)Ocqbg(zN4s3u{T!gJv961Y$u}f zjRD?^7U2K~%K2&S%Q9JP80MIrnGKDw@}7%KWuXlHOoOB%SV&PeWt2364WW@xs2O@- zRgjc1WT>XvK}Z_>{EoSJ3+|W=)kDwFg;w0cOv&Cd^9vCSYdZYcEQQ(3+{^{}bIaz+ zijG1n$6R(!lif~V#yIb!DQ=f#{A8!koiW98 zgIk0+**$(LJTf@UGR`@1oZD*|H_4Ya**#?nns0$aEEC=1(#0?LM1_DE*H4-{Ib)pD z>%;1N48E>Ki;vLV zcO+hOYwxcX&VQA^?WObI>8|Nc|M$O&KK?r$|3x)mi3T zOxFHi{6Z3SxzO`0`8vNamSr%^RXQN!|M~pm-4$CP)CGU(3nhAqM$>(LKn_qG2=9d0 zA}(5Jk_1Wy(X|^Cg?|>y9>zuE{#V9PXbp^`FyCh!h5RAoDEyBZN3k4aoCEhS7)LRF z$vBGlE5;4Nouo5N%u#3!?8!93aY9Jcz#ON&qE+l0o!!M=FSB zsuhqIlmreEXqLJFR1ETi7JwFk%0U&ND$q*MD$r`s8qmX_wV-vN^`H%) zji61SEud|n8qh9KJ!mhe0kj`<0CW)42s#Wp0y+vh209LE0i6U{Iw1cb`kt)|CWE&=$}( zPz`7os2;Qz)BxHKIsiHdY6Kky9RVE$9RnQ)wSZ27EK&FmiUxH7#ejN(VnKaC4p1B@ z9yAD)07?QSgGPf=K`xL2@`BPp>7ePL8K7C9Y)~Gk08|X}gBE}mfyzM@peoQx&??Ys z&>GOgptYcNp!J{)ppBqSpe>+npc>FFP(5fbr~$MebO3Y^)Cf8ZIs!ThItDrpY5|=D zSc%lQ2n=o!!!&|g6J zfzE^9U7%|4qw&{;zmJ2i1^*||o!~1$4}s3X??*vPKyQN%!tEgb*5L125QRfus@?3dsk{cws1j!{yE?IJ;C6_8Wm*f=5 zc_o)7xpc`*m)s1=&5~TULs^Vat)H(FS!GfJ1DtE$sLy55y>5u+%d@= zmt2eFPD;*#eo@$;nXWd$@P((LvnGFiNUln9D)0sN{}G z?zrSyBzIDB7K}@T{Yfrba$O`BBe|ZEi2U za*E`t0cEta%&{_ zu;kWCZk^=TOKyYYHcD=j=2 znB-Rlu1az%CAUg)t0lKa zat}*xt>o58ZoT9-NN%I#Hc4)a+(F4TO75`aj!5pP z-1xa3+ScT#c~_-XbhxoF9Ckz9=AdP*)*gyn=ZK-lA9&DY{}(Gu0V3dlJiS$f#eoRu3T~zlB<&3O3AH~+-k|K zk=(MMshtR7c03wl5*8zi{|$t6iHS#qN# zmnu1z;VactP+&amvm)r))ZIs+5$!(F`Hp$gUZkOchCAU{{4U*e0xdW0rD7i+-9hTe? z$sLv4G07d5T#MvRO3s4kU}1lfiJ{Na(;cC>I-bmm4edYoy2NNwQ$&E#Op2bt39|H|H|(MP=dPC+P3kpZ z=%SCXY}UUp9y2-v>mCj5KUX7MJ6SZTL&Bvq{@SeL#IMi$3`+^^KlgWu(WC~7*w0~7 zmkIxG8hi8!?LU_&F`CpR0@sB}(MRlq!0meO^32fwbMX>GQu+^Qu47W^C;(d7{ql#M z_II&R8PavLh>JdOv01Odog8jFoK_dwqpnzDwDfcqE@T5X>y<)k%ZaT?p*`wiBu10E zOOzLV#AdV7Dtm%_eK=}zXpcI2(xA(3(WGibI5BXwSx4bc4o?g`=U`}$I&DA27%6oh zFm#b^hf-L%xa-%UJ?d!vKV99W6x9d1Xw|Y&Dzrx(l{a0XJ?f@$2eC(8B7RW{t@m7U zJhVsM42jY5l_Fev;;+q0rAJx6eylAsv_~C%1wmI&nZit=pYz~~7Jwqc_58M3ABFa) z%hO{FmT*3>HY?Q*y8c=|?H0aA-C(S%P0THl}NvQ-qn1MI+7Yp*~P^$ z2B}!M+N_j2x~wmFKjVAUF{z>4m0=80z2RZA(w(k?+0XRmd(<(hVceBr3{n@s!)B$F z)3v7f&QW}iIwqCGT^Yt8bs;=#R(^iS8;gO_#Y zd(<(h5!{tw3{t;?hs~f^yZCp$)R;n*_ z4Z0=y-HUZn+&CD<5Z5KZ+N=po2K(Y(TRZv^ofJ0?hA~L>V^W&tpN*Y6yPr;q8wbM} zq~Z)xy{`D?$vB-9Hx7m|NRb|F)+S#Qt8um&4&+vc$rR$8wbM}q^QLR+2JdDdu@-`Npa&~7=sjjYo+T?tq0c+ z&`ELQU>JiGy~Va!N8?V{{59A2zC0u~l$RsJ7^DUQYqL^`&{bLgl4GDwirWUm7^J9Y zvstyCv8S`-$RM2*w+)6dNKr}ItmjfhxJINb>U)JwirWUm7^DURYqL@s=(?!xnWDiu zDQ+7KV~`pGY$%1JchC85h)#;z2E!PnNJ};=wI_7_?ZGauCFrEMZ7_^MinL_2I&i0J z=6mH+6LnJDHWQzHW(h1&U_pP$=zq)v+42E!PnNJ}gIht`}aC2ZW|0^kV<7z=Zd)g@y^btQgu??HW-E>V#FB9$)xa* z!!GaQ5AJs|Df-z#qE$`3{oB@rNz~8=iiokbW+?7 z8O9)WHIvdtdY2|_zVGUg)NtNLF^oZqo`ym#!0{uoKVGAg;&#X|1}QI->VZ35>jzx; zj8`Yc?T}#%Qa)fq+E_Y!%(p(B6t@kAF-T2hQd(S_$~-Sm)JbvMU>JkcBqr4pce=hT zx_rwdofNkXhA~K`0UH|W-RSyjahgtw+XllJq^@OB(G(G`H0&jCtxk&D2E#D_L88V@ z#xK+_Q7eM@3VO=VJKrQJYL3lDakDy43L3tbGuxDD*iPbDzU+e~9V;X761voGw|D#Y*yPxQI? zj8Hh7YQ^{ER&8&^yqp4j3raf#(;G3q+oR@}m6wBECNs25Yey1qYYl6S+vqDbDogS&W;y8et|kUNya? zD%S%4A}|9V-InFFNmpqeeM3v9hi7XW$MQX5+u*YCT|yQ%ac$#l2)_{Lkhk$KF4In3 zpWU9rRUr%I=Q=F5h7(LUR=}IJb#gzf+ zsqS|CCek+_5rXr%5tqy8o3CTr}xN@T1tBLt-m7er_>n$dNHoQ2sdN|Z}#=>VZ3%G zGe7uB{feEU>kOQ**_S;EusdGiPtY{_hL!!6S5B}fTH;-^u_Zb@4+1Y9Ro`v-Gymy*=Ik%Ex@!Mx@@Tyk( z=Ci9hxYPsUI4`z+#sAeg=#V$mqA4kn*FI5Hly77A!cFXd=c@ynZla4U&SoY1q^o&D z*SkZn4&t~YFxq6N=*ii%vr#Ja>VRyME;_o#IDvgOTtky*v(J9r%3mGOurQYY&Ge@sTh~5tjVoZ&Du&mqBz<@>qMAm^6Y9ewj1dDrg%pU$w;zOW{up9AqkOars^z@!VambhUf4B>qaTplpv`|=2E_`}mT+;EuvBDiM*(dg$;*EA-c`=ACvN4WJFl=m0L;k3Xv2++jmlY&%h7F%5!h`mgd-@UvW3@rx z3>(6|4ezgj+1QWcWImFN`x}z+z5`66sLC?lq!dHBQNl+7GineIkNR02?}!xsNWk3} z7nlDNc?Blu$)cPHE}z#M6d8=7FyGvQ(|7gr6U zD-_;{Vf^8PyRXBamj#BqX!#hXH$V0|>3SsOW|0`Fm&D{`y}^8kK>Wbuh(bRLznNY} z7>d`j0`3n2bCFPj#3ha}7+?`_X~4W8aG`ipM(PttxVM1OcJ~Y6lEoB00JsP@7J@Gb zVGY-ITtP4Kw(28*T&e~80wx;w%f7rjmak*%@*~YD;OY%x`AtdW&*aRNZ!q;w%plCB z`2bw9z9kMDsRup`zj?s)P#8>yOG*?fWgb?fuRk!C(KA0TS-wfb4FejAZW1sL2wW&$ z<9?kn!2Jc7*91<}3+*SbFW*bxu?v{5Y1RN2^*+3OM+(be&K5GyOE5=}M)L%?WV|E8 z_gBvbrbOUmyvYW0w$Q;|i-1|-Z5!Tjz53XvWDfz;ks1(OvYw|H%+&H6{4NFNeSr(b zYiKqsgOTvh1cn8O8_Vx-<9?1k;C@b;hTwl0F3C_F?DMzZ0aqrlGTy|Yh7Iq#A&4cB z!b?mH!&OJZ4L9y5Pw9Io60Xg-dpdB>0(aK6JP*3`CF$EWN}pX|I8x{(G11V^5bk%8 za3hB4gR`82;mSbZM%>6l>xn;1evHsMPXcpkImaExpVSEZwVwm`XH|~T?vb7|5Upj42^{r%ubRM7x@%3~ zsQrA?1di(K9uqjKuMH+}U4YwX0!R7%+ysvD@wEvY<)hgIj^h2!1djB4!X)lDlQ`?0 z2vm1PvKNZ?ER(oSCUIR&;<}r_*^$2UOyFXGi!*_v`kG_{N8yb%furyyo4|DhZk7og z4X@{zz)`scOyI~)SD3(2KB`UP9x{QW_VZ~IxbDEcZW8y72^`tW7bb8N@3$s!q?c9` zxURr;4dSM|BGostg9}XHs2#f4B(A>+9K}1(1diIPp(b#YzAH`Qes2QT3E{a+;AkA- zGl8RW%P@hXc;}kHkv-2dfunfuG=U@itucY4^!>>Mj_mI#6S#AMd&vZj@>^#DNA1fe zCU9g|jV5tNOyH>BKV||)c7M_Y?i}E3D{<3Zk?JokX6t4GM|K)-0!Q&)X#z*~;x>V! ze&K2pIBNeUn!wTXONL3@Y!f(2Uyey!zDe9%lek+=;>t|o7Mj3Oxh*z{TV@is!UT@$ zl+a&HC6F6!oKQM{=%p~qBlemAF zz)^qnqX}GR;7*yuMOOo?yCSu_6kZRLxIQLv{Y~JgeNHfe>jK;;leh^ca9t7J6qC4F zCUJ93;%+mETVWEn+60cqO^=zxJ#PX>&jGKS#O*bKqvyd-P2!qO;(j%WJLfJ$uDc@D z4@%#KCUDg64>XAzZ34%}<0f!4?#wWWD=~?yG=Zb}@HHlI7XtS}1l*961j7U>%}ecV zgR?|9Hzx_WcYy0~HyB)9L3D0T+j)N4n4togyn7go9g88)*TFG3N8^?1f;a~b2vCA! zV-(dHV~^=z?`~Cs9h9H~hl#ODFf~?D$HxN@E!-T!Ey2EdY|pCk$;$5WsTBV1@m~6) z1iKyKe<$Ll{;v3&W;W4JOhd9Y4^eD0G+O;2jvHu`4o|d@?xqu_7f`frGs<$QJY2;uY_+^tci+68epOFYSkZtfW=!txy74#hrp2O75oPfCr)KDI_tnMd7Hs?%1b z`r1^MVVwN}&ClHFM6eD}lw~SkP$Y{y=!{oJITPlUDeC(QwV4YYbjDcavp_dr2NkvM zLF4BQj*szRjZ(ky(N_oi)Ov$9DtsT>QLoJz>m7h-Y8qLSs!od)s@7~m>Q4!x$sIL5 zVO}RCI4u^jlsz8O;ZA$sazu$b5Vg}2oS3Sp(H_wT<0rQ>kJbvSC%o$SA{r6q%OXtw zhOiV*3?|k3f@f1O?WEWl9PbS@E>VI#chZqO_j*&lw^x+lRP_N@f7*hAgA$7xl)P#ijkMomu#7Z@4Rd`09lpIx2y(Oz(DQdkZ&@!f^ zzY^^14PG7Nv*LHnPH(@lFsd%KO7PkkMNLC@ZMApDkxQQ1#*X5!o~x^SS`{_MQ{5B2 z?+&CeE!r9MMlVp6n7Y)Sz+Q#O9s-H(7YC$Fb7JrAY3Q1k9<73hQoSLr9Dld`2o0An z9Br{zZom_@SKaARKlG^YmcPn6Lwg0CBjpLMpjzgvTfrP(MM1ZE)Vs;e6P%Qwq}1Bk z0wpETa?$*Az3Mw%998Z{Cv8w=X`)zQABU7N#Fb<^x1do&Iia@JQmNE7b;Pky%Fi%1}Y)KsDVPi^$7-?17}S!1t!1L0E2J=7APxM+S)pvvEJRQa?-2Puhx z+C$3H6Xjq_#%QVDgF-_upz8*Z1bzBTUA`jKjXXJ_4n(bgu~W5HMXmc8O1U_8|mQWe#`5r<=`iw}5JUyY*9 ztoN#A4f^z|?)7L>%DvTbXjkStyur~smEeq>Fc>jp&`IG#<%fl! zJv%1;lE3dhd;;yp!CoD$&cp_1euMnoq0Mg_``tqRu%jqgTiI*s$ALpO|1ht$1xrm0 z<$*=2Q8CWM7H2+}ppzKiD{IQty6xTWD6&6f?0ml)_r7J(p1`8G*q$XLHLsssaSm%) zJUmC(SH#1};X$TMDtI;85)-}bV%VYmiCTN0Gknz+)>Qg7dZ}Hl{7F&Ew)m4F-D5s1EkZ7ZC#G-OpCCDUeymGvb_IP=SY6wp>_%^J z@qs4VGXd>yAj0XM9n@?Jm#zmBmlI|QI7*b%lK zqgYWCwL3j*uo8vAN_5kH_$ulFUAcOzlc0{eWJUd)!f%d2e^*yMzSR@>wmi@>dhwr- z{M51seZle3zEQ5Y*s?}6ik@J49Pf}SYs%hjqOpPKEtt3I$0j~CIT8F zf4qr?HU@pl_?|fRFU03ne`@kW0BOF^XkRkCsqm)4Ec-{q#C;T&xHq*DbMhifiVoC` z@di;#gQ%s!vIeDkJS@EB4*Lohm9P44m-0|E+6bqhI|@%W34s>a)4Ry%i!n`m@P{f{ z?IH9HXan%eik_ovi=z4(nfjUspy@>GNBSfWv>wb|*-eLtwpP|qve5efiZ-1J(icRz zLga`Bqy}>xVt1)?kJY)4BVi|4dlYnUbgCyF)y!o+Uo~rS@CiSTo7_UpHUrVXCv@8LP&D%pxnE1f{x*2hDni#C=Liz5T%*>eQ&F zJ;)A)s`XNC^iuDpRwW?)q* zwoC47$qj~)ao>RCsPo~nzk%bA{paER!9^^Tt0b2R?tT_;0XRNDDw7=Tl}n>WoZ1Pl zFO&Tc998Kk%Q4Aq!Z?NJ=tpoo6gGCG(M{lJ9zD9wLbr*bqBrQl@rb^9rVvz}bCfk0 zVdt^uUl>W6Qa!Vto?O&VJnAv7wK~)$#wjpr!7e@38I|4N35_)lSZrzDs_d@$0pq6T z7nQ8K=4Ty9po1mX4Q>ESEWebr+dTMnuMtp{xcHGmF)T0FK6 zouQ^;L(A2+C`i`C zdohaoHgxPVKzs(TD}tkk2i=1MuU32((MOenrnHceGT!HV)ZMR5NArMgfz=x}&x9E` z3~~^TN3HX!3mkQ+G+UP%nyu5&9zI)_k7rwLw$4e@b@&|*aU5vP=j*6x4AiD3o^A@v z!=}KTd=AW`n*;OkDLk(_qWK&|tUbJ;Kjf2PyzPubbaBl1XzGFiko;`qiZaG+-~j@rc8nHrM+#pg;3 z7G5E~GQJIGYvx{2RyY?2P2%*;>??3KXI6W7gi7a%8oe#r!L(Q86yl`E{6d6h2#wG3 z80I5rT1cCZ$h9w7?7*!IEx@kO+{CsRYGB@GcKQxxD7?XE*Fwrmvvcjte&*W$S@VN^ z37h}ije!EP|{ z&;vD`6#T{M*kj;g`N4k2a0mZ8CINpv>gNa}+N%Nw0duI{?-HE`s=~ zyL98j-1~O;>|_7x8}J?45(f>if>UdJVua;UcTw+9^%Y71UaVQ8L2e%;+-LpTJK!k_ z%U=02eq)AoR#P>y6(MaH50cg*rmeYe@B#8rg6u7UPPs@0=2`n8yz>KJF2UjFOYD_Y zAANZCdW|NaeJMxm73dMHBHE2<8wB9o3dOamwa)jO-6`+e zm&L%Fetqe(?z1oJK;VkE7Ebk5E0}{)I{H$Y>=ln8OavBdU-2cfh`_qz(_3fYZ%f{w zu-^ZtE9DFOvfc1$eQIvROO>W-3|apby?hMC8}+gh;WEA44wV`7(u-%MJ-xI*p&`9| zgJ0o#i9?uNFMG&8vRL$TSB*kEWSJ?4?3J0&KpkR(VJZX1PlwDJreSAn z(+$y7R~zy3RcdZj_rXAm)qiecP5E}#P22CUsqW%NCedt-k9G0boLh_G0P{hnB3bMA zG@nzk2vyCO@{PTs93dO@{wUG|RbAj#ziHC}8dceMHKS3+@ExguOeXXc1$njNV^Q^XP;z1d*Dl+;9c(H7@ z*q2qaV35shvL~u7@5!1{%QJd{`LF`Ud%31xNguqt>F2d%O|0@zSv76POGJDFzXZAH z=Dzr2=NqIe7LGgR<1$q3X;xM=FT&ZaeoTDj^>|!tqMdaibhb0l*w?vDN;#<=sa%e* zebp1K&Mkc*N9{u8R+?{mtEm7!ZuRXZ+UVC;eS^?MGZmP$ob z@b61lTl9XjE9F=FvK8>=1&{fZ2K%!4_?=qOYOneyDmBx}CrvGA4-nxsEFz_YQmu4D zLU=?EB2`d(cl(MlkZfCmqLI3UMZz1Y^9hDVN-c%HeAQ`q_E64)GAKB|7eRHlulOD{ z1VNz$KXwKVh1$D!?aMxbm-GEYPV0O2Wp5L#;!~E8s@_PQOQmUdpW4vmK;U3Sfo`<= z)FZwD$Arb{EU$GRtx=+?+^g27xPWr5M6`1wPIfjW+n0)#6Bgm}9 z-%sm}c;AQGLbZW)Bh@|KRDR7}xfj|4i_*Hos~++O-CLM6^1f5Oa8J4&wRK}Aw>2@8rVIhO?`lzcvH zE~Mlq5cnCCOlK--O6~*RsN|VsQ6VK?0iA0~?(b2*FzOl7VS0`MimMtbB~`zf`-_Ul>af(Tno=k8`7-x`_Et^;aqns>oVt?>x>*Tk7yyuEX1qey=*Sk?Zl- zwqvau;mtasx9!U&ftLlHiHOivL4n@j)W)X0sKZ8Oe&ZW}A;d>$u04TYpwH+zCALdVx#*BxEuvu$WunL1WWB_GP(* z5sj?+2+SDiK8wb7m0tK@2D@L=1I)N}G0>;eJcju8Vz7r|h|+ z=C2lc!1&>9GZwWv-mdl0`-ZgzDNdQnec2eN{G zc&QeV0#{Tn5mB@MRvrm$$;^$S1-*2ra_zP+8_yzWbX!sTuhas63f&Lp-4HnXYnm%! zdU}L+N@zfvvUt-;?Ca1TtOfSdvoESdz9md1 zZ~|)`c0<+WcB?Yr0G^kcUdJ!t+eBN4`{4E@6$XF)Vb3kouc?ogRF9pFRd zvMcLk=*qz5X`#2nNKyb*EX6WxPt7JuL0Eb6>dKDB!8_O zI5DOq3F~ms+Tg`z1BzjXg0(nUuu}Vjy{H2gI@&j1-4pME$M$knxzD!0GWon*ym@IJ zsDDw0)f3+8C@W2e23^(#xgL9AeXe3J+>vW9s7-teolOg+3zG;P)Uh#DSNF8P;*QEy z$DU{3>^{3{Y%g9VVFeavd31;730(DJ$}H$>!3&4}-mJ#D@uRI?wGj)^V(jsY9e8a+ z`Zv6`358VNse@<0=RWm#^WN)$;%_%{Bu5Ju(m+w{l-z3=_b%?7`wiN^6zPewbjQ6v zjC&v40LC2ycRAxaV%W@m$AaU&H-Y26H-qEx{tkm5o~lbFmjI4W zEKUc%Y`u(%XQ3cIXM3A=x^ZYWeL_~>8G3(T0dD&OR9n@ zDb9ytqur)b>YeuccKYn&_9)dirTPZcy3`po*${ergIUWy+HbWM?`&v3sq(F|&dLB* z1@J0IOaRZ^`Fn)SRW}J7SDjoMmP(VPsYpoqtKY!aV!z*glBU6fe^`TG7=<74247eU z7Bfni47nyo2~OclhE#Wpc>437Pt&O|5lppXg8vB67R;d!Qp7Y9>_t&0VX=?7|K!CAhQ(2())&O0J;AeTuan z)nzBIE~r4X(5QD1tAaOQ+pB8oDf=rPR2ARJ=5uw+0+i}L)}SkT0kYbtx{skAoXl0- zKcXI-s&fBazFpJGaZTOc;O4c6m1fwq{9j71HrwVOOGiY3vBjFrLoo+^Oi?F5gKmJa z!qN?$O^7z?1I-?VPM1L`)8N2uX$3g`9`admTs^OX zij}=j*~6SMQ$IcYeToJrozWBdeT3aTLA+DJTHN_qi#s76u9n>slIf4Ko2~27t;Jo@ zK+aUh@bE+_SkZ_-_U^BcDJs>I6p_IH!QPw4M^S7K-#wEM7(ga$PV{;u3c>^s*@UnN z35z5W1Q9hNTMP+_K!6Z75$*s%hyjU;ih_s=0*a_tgeWe}q9B4s+#)C*8pA0Mmj}=m#+3&CPmdS9H@V zRi&SypJ>F2O&crs>4aF_W9vf`K8!d-u>2`P2Ajtnlg}D(@mkG0<7t}Y{m9*EcGYbZjp79M&$kDgeIdWAuhZr(H?jRh^3fG5 zeKWJii6dRQNX>`bC+!F9ZsiF%9$C@PDJOD=MLjKdSUxRhw_GxA-;oHMXIAHx$%{@s zRWXJa-vgXhcjMz7`%#f;8=H#HagNX<>y!5~N@Dj0f1;x{yg2I6|Ifg>|J%9i5y71# zm60P~O`e1n&tR5U<%y{T^4a>J4%k(4w}}V1t>*%|QnK35(k1Jqr*;*$c5fV4EwCka z=6xruy>es{pNjHC--Q4nxr3~olPvBIl>|Qtk~~E|&yifflOSBNU$*xSPlDX}dDjy> zhuHO`^?53x;w~`Hf^-oNgNSWw+QH-YipLO7=*JMdp2UNVYz;@YX8#R~>4dc{ulPiy zV1F_f?9MfI4AB9C4MAO7jD0Nd$entOWvvX2rf+P7GWpMuK8!j_f09_ zy0tRRP+=s+{h3s@flp5ki3@;pB_!O;eXTAxZSKMc&)4(z>k_R`A46`Utj9jj5tvxu zwo_Pjd#OvAJ=&E#yL-jtHkZBm8>pb8+zQ`Ji8JvIT?;NHPTTjd#E(Ts6TkhVYn%Pv zsc(v0-|p+``py2j%KWnNRg%TWL4O|VjUPGPK=KSHfZ$7^Xd&IsW35y_whT*Kf@Q#Hn&Kc-Ki`E#6jc^uFXf^ zEZ_KJlL}qb@?gJsGJsR%dpK2&6sOHG{WtK@|AyfAdU<}(tN#XZPHDZH2DRxAYOgSn zaU8_{kLVAdU+-rfc>wpqb>0~ta>1;gi%YLnl;m39p=?iJf-A#2onMGDipA%7fi`*G z`~*h!p;=S~Cd5qePM=DN3keq=^(9AVdh@Osgd@7bNU3+O%k=(e-ciP3&^!Hpk*GEG z{Wo}5C-PC;5bo1*);;Y!t+W9q6^jpTN9Nr+EUASn>BC!xrR5A6lQtx&#XV6;p7q}8 zwMBwxm7vPB^P|1_LsWwEl|%ydDXvT)KhMpZFp>ljGQoHF6yK;4Tr=%FD|C-ckma4e z=E?+o96T%|XGk6iD#!%Shy?$T2?7(Y&td(ku-1P>a%Hjp2|%&_y`*-ozX%qy^W^$R zOf%-9PJhJ`FCy$*N3_6b9R^5-StIyoD2_4s5FfIF9M6(+Fu-+)W+qV z?iN0sR1@B5=W}=xUv`DT)m9c5T;dn!L&iqX;HoHgZT>dtGj7~C`5C_)KUwxC_w0V@ zGkq>T#qCvV(Q*WfZ(WxocpOj+1+n+V+dTyUEUFdGkM230mPb zrH$AC-sufRL^BmpL5@^$FKOEOTyOp&6%i@C(npLK%AQ`G969Y|w%9$#Do|TT#s(%- z&h<|Jg^Hx&+>E?j9$?61)fg6HhvsEaFCxV6A{Mt)t$EarS|Z|R*Iot)9vDM2GDh;G zMYc$^ngistQ)A^8d_gudIwOyVE=CNMlxFCZY$H{)A-)Js4!#<4Pqkz-$!*sTD7Kw< zO(I7T?k=zm-@#YBqD-lGQupIJ`$$q%}-u=wr?+!qscL4o@3@YvzdDah9tnrRDPau#YZdg=-UM)^zF07RgG> z9ZeJVaiqI&UFAUc5+G>Ck{BVKz1Z>oUw%)6#Y>flY4e~>{F zx@8xIb)Wuk+>4vSd8>0COoO(J^XO6mNCIvejE%j(n>VKOtG%SmUv23g=2JE@z9|N}MF#IC4hh zWZcRYvEHY|E|S}1KOV(?+s!_;$klEfXRWuhPlTJ8t}_WpH%VeaPXdH4)vR*r%h#yS4SUKUzfB zExyH$R?nX4X!)A)tjmj+7d`BP80lGjgQdiUJC!vo)zMNMIYlLJn?hYHm3YaBN%4{L zR--tbjWh=G-zq)8#>b11ZLaNGR%aSSEKdb<6L39lJ(;k##ryaG*3g;~xzn4Ug27d7K3j)cF}Jg$ zz+$eebE0HDKEjKvmt2@4CW?g2cD1HTCNc>kc=BlXls0?v8VBEzD4#-_*917`IM*Qw zN3JPvUru>V5qDgf^V+3eg6NcN@}O0!T2B^uCOD;Fk1Wc$o?^{r*Rs|wfTum-(>uK- z*N8_(mFNF|vRePsrp07lInQ*=Jnr|j`N})vBwO;sUi63lTAdX)=)R#Mx!|*8F$=Yz zYjmPFx*`ugcNMd>X)b}3Vx3VN{nWL;Ap`{-6Hac0-}w%7xpmhzV@*0D5ew+A)LE8+@6@7Qjcr(b)yH#2UzSW#>oX+lU!f$P*m<2M#+AW zC8(=;oq57rZOZ($K$4NLXEc{s%tGyPeoPX#whqmJ$eXx_#93lWVMpmw_Qjz$0rbl1 zjP9P?d52|Bt*9-+t>ByFX}?`2UGR8GDXhZ{k>s1!_bjaSZO?*Qn^L%QH2XnU@=Y74 z+0nD0&n70VnQm@Nx_j_k``2gJyYgx?a{2V;ytw4OiRT9*zv*5O$$I$Is-+ZkOfK7+ zQlK|Z(x!FdrUOCTSm_y^eACvR1&x2_?sE*Y?0A5$pl5tyLD!_jg8NdK^jJ)Hjl5do zA;Q9{--?ItBiTO*DFuzcO>&L%bK5H3aUVc@{j+uVxt1=~p=8~Bd|cPf(IxSifkn4c zvTlbq=MZGw*KVgv<0x5lGbO8yZ*=KrN>-NM9JH*G{-8kJ)nw8OhmkLn3cg7xSZ|G< zg3puMh?{~u|FxNUP?N`9m)z#8_i5AIU9r+S?mXJFd*5Iyu-&KF6J@tO~_15iZ=Kc^ex}se1BNe1#|Eb&3b?9Fswjw{0!G5sr*~L&2zjzgC zh<#|);da$U+)5UU7+hBAKmQNsr}A7adRNp1@yfjFBHk0l5-zVrtuGq?Pkt&7!^p9) z0gRay#)&K1t1c?;zqQXhq+G)JsXWS0HTK`y=NocJXZ0JrBeY)G;x3n1!sWH7^#yDH$xr3EMg`bf z)W6Vo)E6Pu+Ej7>t$h^`&QIl0eo9AExOUuGZcSW$QT+{S56UA+%t1jyOGF;x!pm2UFPpH4R&C-0?yDLNM zm9552xV*|w>2Q83kMdJm-0b<}fmY%&;;M^^3zs)ED4d_l6Y4K+acx_?SzO^?brIu3 zEaCE6wETZKKb5E4(<+I(WBodm{2p4bY;k-LOSrriE&m_RPvt51v`XS$`OH7|gd3jX z0VBDD%WGq;!uhE@+R-kE`++s9PYOLP*KX>4BV1nXXcxlysXU?n;<)h7u7C9ityi|{ zceuRDPw8-eDv$D0THF?GlG3g~*`ZpE+i-b9{lodGJfZ&L2Ju}Nj(!_juk5OJAzWVN zr*t?!l}Gt0Ek5{u)^kpL?t0Zly>Eoe8yXbOPvr^q7xxD~O;|cEv|icjdMR99<)?Hw zKb1%MDIH7U!Jl)#Q+B9UapCfY`iJvVc|!efqQZP&bGXeTe_&0-gv%S6FPvYv25u%n z>d+m}h2~MVx^4=WSNSO&&QIl0eoEJ+Fm2P5;*+eaE^51l%NrUL&QIkD^{+?8n83EM z*WW5GT;9-p;rvvdQ2$$~7_sE?+oAQ!RwriR@+v>2!}+N^%1`O~6b_Fa`Gc}UwKzW& zOSrriE&m_RPvt51v`P(7%O@P17Fw@tb=(Y>SNSO&&QIl0eoFf(j7w|uys|^J+HT?U zhWdx|Q+Y!D#f`rXlV=u&)+<|`w}i{9{FDyor}8L2r5jRsqFd8F$_~|PyM@ae>L1Qe zy<6855*ELuSLuMhx1c;$~~>p zZK&frCWpQLQ{y&V-q3vE{8XM$|E5%|jj6LJv|icjx-DE@<)?HwKb1%MDcy|1_NqT$ zPy@qI!sS(dN{91Pd6b{hEhx0iJQeo*OT93{ zL$Y`@+v>2 z!}+N^%1`N56ykqxl%woWEv`?+5-zVr%m0V-Q+digtx{{$O*bw*8(Obyb>0vzukuqm zoS(|0{FD~Y&ZXq7`bF8HT5Y#*c|-lf`Kdgi{^BXHWAksR7h11u^}ZD@ukuqmoS(|0 z{FH7>q3f;8IT6TufEE<=n6@pj~rGcc{XR9#m@X|bfm{9h_dCAzLu*F|$j#qx`%^oH~kPh(qk zsk%-)H1(FG;vwvJWJx?eW!07Hx@bNxx9Z|4y=Udqb*Z|ph|+2+AEghhe7dew*G02K zEWdb4A6fZyU8=4tqV%bikJ5T8pROy_biU#gsN%`E*^W zu8Zak)6PffODmtQ6VDA>bw#?an9^5PK3!L;>!LXT+xaMcW98Fzsk*L6*A-I|Z%Zzt zMAwz-x@g|eev~wx(koUzU6-osiYV=nR6JfM4m0G_b)~vaeErF8N#iNm`E*^Xt}CLn z*UG2sN_1VRu8a2YL&{b@N_IY7m#XWEC>^r$>ADhKSE}oxIe>|i1YRGM?0mW|Ro4|! zI&S6DbtSs4RM$oGhJ4D(N6F5o>r!=H5v4O$K3ylipv$T&)pgOF;GVbgQL^*tIx(}_ zsw<*&(aNXmN_1VRu8Y2gA5gRMQL^*tx>Q|PL`gi^;xdYLU5TzM)pg>#&BXVhv;8R9 z`E*^Xt}CKc(aNXmN_1VRu8Zaat;$wDN_IY7m#XWED2Z<|rhmGwMAwz-x@Zo7;+RGM zDB1aRU8=4tqEyq$r|U{|U8$~%<_-5+D<360pRP;Qbw!k}v-0V>5?xoS>!P`UxWURt z$#OTZbX}>gi{^qrOvqz>DcSjSU8=4tqI8RuPuG>`x>8*iU5jr3 zu<}u|^Xa-&T~|a&JjhJ{bX|$AE7f(;wYe{C<)dWh({-u3u82}IE1#|_(RHP|F8W%| zv#orT?0mW|Ro4|!YHj7ybtSs4RM$oO_~BG5A0<1Vu1nQ*MU?Ka^69z~U015>qGR}q zEh`@-JD;vg)pbRbI$Qa4U5TzM)pgOFaNcR`x>8*ieLd%i zRz6C0K3$ip>xwA#wDRe?5?xoS>!SJKqqmihlATZ2rRusOO7~g$bX|$AE7f(;e2^i| zDj3g{?0mW|Ro4|!ddSMB>q>N8sjiFWg9-7FGx;dl`E*^Xt}CJ>zUhbYtm{g2U8$~% zzR@rSTlpy2`E*^Xu2WMP@+L68n68#JVzAMzYagRm&wKkAVnRulahq{lcFy38@lCSw zh7U8u)P;=U8AeuK-bndxG*x+Nd1FQ!&6_qwS|Y8C7U-7PEz!55?I-`ODL8q`w7+(B zh%w~R?2(OQ2WMmsOJhQmnt{k;{Y*X7ws_2+*%TI)D)_r)nSC0-XUa3k-fGMYND(?> zXm*A%Sgd14UfK{tOod6$6Dm8GHOtH$G2F-+F*?r>6J3}=ktGYk-*1~CYUET4&8>#0 z4*4qF3`5NxlwXf)49m_LYS^=Uatt+%ipf)>jq>l+wP)L91XVFrMts#So6l-V%t6V` z$Th?ymyFR_XlqVe9(7{EkyO_FGgdbAD}L2i08hB$%XfzuYW_}6o-sBpcY-lCJIzp& z0d>d5X0v<6HWZsstd!VnVylT5*+n^S4KW?b+TvEPtZ`#)a(k%TgV_+XZkTOjt&mWx zpFOJWeIvHISbMc&)OKVuWs9jqG?_ahZ$$bCLru&ZORM%q5QD&)I90xehJN7%ZNK2r z61;;PJ5oET{^-%*7~YPNuU=8s4%9A=C9i%YG3L7la>*qwB>Nz5b9r-$ zOC~wpluNr~)IE>A9{nbM;^c2DB9#f?9DE59%7exN3~15H`t|E zU8<)`eqCy;OHFmD0VUDP0(vIq2!4!wPx%Szwju54*fq#u{F-35fW1#ye0kfykSeU{ z26zk?5H}#PNIk@lEW)oTdKod|rv=(`(IPHfenxh(n)}cPk)z0S$Z15dONc>SBvJ`! zg591rzC)|{-IRmlPhg7+x%24IcrgQ7Tqe~*R6jkm{|tRnIXmKWwVZ9jeh#BQ;u7*z;zgfsLd3REeOdw&+i4W6Yl~*-(lA{bsY`jfG+vh;)1`nev>e5DC+N?`kb*V&`zSE^rUHVy8aK-UoM1A_!3tQw@OHk&0Rr{!@C+&pXxg=^n|3%becdq&?O1CBUqgbMJ zThH-+A{L<{T;fQVEH0?Gpcy)s>>pRMJu6Tb9I9Nw;;K z=o$-eD?~lUf3aP@Z*y#?M@QAsKB_G-*HM z4T%!xM4~%qHf8)>MMsG*e-TR+9rd@p>#9;4;kug;kvRM7N>l_<+S)~?|m zAW>h6|46s@yF7i3j;gPH)Ov~6g;=T~5w3Lpi;4#)MQ^UAqr}f4ilrKDiT%QRwp}Am z_87fv3ht~JQJ=rt$E%}GX&)7}$lgBDGHMe4MRzK^Rj?&mN4>6nRMd8RzjJSnwt}Oo z>nL$!TP)Re4|m&nxC0jwRYOM|&_1fI<8~hIvxP*})KTJx%*0Ytx0PY%sYPvsYq6w; zG5bY##acRQsP<89O}G8HXGWA*JF&qw<>x(8TSpaY9~CvoZk;=0M4jZn7?@ioCUM8j z-rz>2_EAx5t=%T~QiN-U9krqOy(&H(wNCq}sC>K6F|w@@{1+{J^GR`8jE;Ij`>3e* z?bf-MMGu3cuG3L#wU3IbVb^fSDkSQ99TlT}L{yX9@b=Cg!ihFL*KN0l2{W|5Y6Pd-KSZuLSajlp z<_&dJ3+b2(CdwKR4whJqTUdLm8CIK9+h8V}HMNh5veOu1EIHS!iH;KQ;$mr{xBM^5r4dnnfHHXXH3`>3|W*DZ;q zDN-IK)~l(GdQAJMsK@L+Hsl4d$;s`iOxyagZYR>`P+>@4nC8{1y^ zd1EtuL=qpki={ad;rfh`B3>Ksy9zfo*O_-|ACXxs3eb?7b|GjS;Q@hqKd^HrF}zN=qH}MzD`#EpC@l;=D*K9lovF^L824gd3(-onc5H zM^r0NggE%=rIn6qA~q+B^l?PBrZ&RGNs3(Rb(?c->+&eEsaT|sBPyQS2$#L{jIuRd zSH_n|*)I&~q>m%2 z9kmfIdv_Yc<8P?Zt~^R?1{Ue#h-y!5giD-Tilug=q>m%21GNz@wKeYecWJW@>& zaYQ9hTi(NAb+7B05ENw%4(a2FN|aG*FDLKyzLFReWepDLm%2izCXP`0J!DK~dJ=kUoy6u8yc@KN_6hH7Lp&9MZ=T zb*CfhsR@;K-x(BT4G!t!h!W=&<*$?zJ4@Sl3yQJ^hxBnoCCMmp1tFIEE^b?t6cl9* z4(a2FO2*eZClOKCw2rwYxjd@5H8!M=BkC?0C60w+`MF8o=63}}Sz|-`IHJ1aTi(`; zPq&Wm9u#Gb4e8^EN|8~jts5gpKc5m5WsME#zU;+#$_^@fkw)+;E= z8XMBb5p@r~##k^ufFNy@R5xu_1jNQTNKITKpHw^D{kn z-&-El!WtXW#}U;BU+elyMCJHC?${?N${HKe#}Rd(BWmBv*$>|r6lIMK>EnpHUq-1h zU%Be~>h}jlSz|-`IHDeKwAJA80pC9m6lIMK>Enn>l~HOOKJnm@I;lZX*4U6fj;IG^ z)HVDUOJiSJ^9O^Xtg#_|98rDojc}>aTd&sbNBRauSz|-`IHDesQR>}c`i*@TKNJ*Y zjScDJi0bEvn(|EjANmDFSz|-`IHLMHdN_Z*Z%hC3sFv2)kUoy60WwORIm}33b?<NFPVkAV<{A@9zC^P*9XLHl&XuDosX-ds$++*x>R* zX+cre*pNPssE6?_KcjB;>g2i)2Sr(9L;5(P(q)tyQOAt_FQf-WSz|-`IHCs2DAmJX z&rYg0I4H^*8`8%Sl_8^Q@n0;1JYSv22#T`ChV*enW#U_Yw7GNMnKqe0QP$XyK8~m% zGD?lZX=7LH8d4s0yEQhXk0UBeMyd6Bdh*`*te_}sY)BtRRJM##udfqXi_)@#qO7qY zeH>Ab$f%n97t7NAi&sAq6lIMK>EnnRif@EVZNmrlRjNHSD9Rce(#H`sOh&2Wd_vQE zhYbsgvc`t=aYPN5QR0?RJmf_sPd>**4U6f zj;LIGBV55|Gd3v78XMBb5j9RmRkx$g zzEQ1cTu_uXHl&XuYP^h!u%oJO?7VM$P?WWorH>u zUhhtFuYR;VsXe`;>j)ry98pspQIFhPdF<4nC~Is;A4k+Q8KsVF zHJ-c>H7zL08XMBb5tZ+V>N&EpeSo>NFPVkOh;7R?uR?h42rVGhV*en6*!{a z>#*Hd5ENyN4e8^EdcqNP{JH#3o(PJv#)kB9L=`%sj{LQDY++E8H8!M=BWji->XsXS z@y-g0vc`t=aYW5_MCCny>8sg6QP$XyK8~m-Wt4i?t9Nwv=_kvh+E`;l`Z%KIIHJDy z?oOW*6lIMK>Ennhazy=o{pzQRf}*UkA$=TCPdTD~*wVkrQ$bPI*pNPssHbI=hyP-^ zKJu^LPX|R=V?+8lqMpGw!c|$uFwJ9V`ahltin7Lr^l?PZbwu@f&nTQ56lIMK>Enoc z))Ce7fpLSL4T`eHhV*enJ?Dt(cWq*;=YpcFu_1jNQO`S~+ATSM;rXB_Yivj#N7OtS zrQVlwD%bvPUU^hAo(X1=K8~mtWRyC$x!Cu${1<|ws`RmKUQF3rdA4k+8N7U@q-()Qcj*^2z z`Z%Iqkx|w7FP3*d%?Z2`93=;b^l?PJif{RK%4hRN6}=i1W!>VGK8~o@WRzDl#Paex zE6=_b93{tw^l?Nj#y7&HqLLqMv3PNClpGt<#}TzeMn#K;SPED6Em#s9CC7&JaYVh2 zZ}}aw(o-X5y&fDT$AEnoc6W{VXOHJE8+vCmPC^A5;Tz$qDPwr*N>lJC#OAH{7!I`92?Td5%sQ&`iC9$ zN7vOu-wlqEV?+8#kAeux@!vAaZAW!W|Mz}TV;BjU8EJV zS4Vw&MeCEV$g``wal5U%9X%Ad!xeevT+vpwEBbT)6`94vC$(4!)+rNh)wFiB-Xt@7 zScdI$nf*1yl`}-lylFl#YjBfv3q*7JC7-CPSI!1z=g6rv1BYbf4a`e>cv!|jo}Xt* z#TAbBoSQ2gRj%ChhsR_N%*hycWvFW7s!-*1q0i!5IV7 zM~q=2h=Po`f#ggZGc51Qp2&4$otcQC{8h5S8FsQ9@z9~uhcz2La9nQM$SbPD)XEmF z*o10ru1?j4xH`4=4SVUzl~QRla@Z~zX@fIzM_=irva`BkZLV}sS;Rod88bX+Fl001 z=!$hw`L6D+Hm=-oOn|cEhcT~d%*cUxBZg9?e9}iwV4q#tg6h!VjA2(o)qFWj8_e1d zw!593lb*}uvz)xNtHfpu&t?@f#^t09&lvbH6P<=$nP2)ao9zmput2R2eXxg;J@L!h zbTUrNabj*zlVQWg4j)K|b4O=miSbsCFtx(D>_a)g^(L}jTXLl`Ln>*Dc}QVaz#258 zvmebUZ$(b(VSta$qAx@3?G@w_v>vKMO!;9#-G6jd`{RG$sHl|Pg4_AuZR0BbLEA+heC(Z^nU+0lOm4DNY{e9JoVuNJb?_EDA6uURX3eWdEd-Lm8OoeRpB5S@^4 zTeB8d_=!h{Jcw9CyV5V-vAU97@vl-ezc_f~h5POozc9;h?bb>xC`p{QJA$7tCL_)4TcxPq)Gwb|kwtbn>q5;&CMwMy{un z=W!<%wmg;O`aH$8OOgmdl3XW}r>%=jX|rX_#vaqnyt*l_FPd#nDU^3gymiD+JJ+h- zt+3WNDXtQJl{~pk$(W=3m{!H4bq6EpM^l==9*H!>?Nh5HS3&-uSRd=B=wr)&FFlc8 z{Z5KbX_OS3>?&!-?+DAi(QIe%Z||hE;fM9aoetWrL7UwQ`~47^G`o9j(z&0Kzunup zu<8#fo?nw(UnWhv7@Nz_IsFwewtiBl~-*BE5DvtYABvak)QLsCu;KHF) zzCsCDDYtHB5kEH{65lc;e)`V5I`3BU|Ma2w;-zo*B&|Che{Q?yLQsote#whpCbxdi zX+Yw@{u`R;?YWlHjYy>YP8O?lE91&4sb5FVS#uuBuV1Jjw`%=AYn)R6e zg*SgHImDRxC)zktjUm%T`~aJo+-6-~Hox}O-k5TrjJ$~jmlM|=i(GdgN{*B@H>}Q_ zzH@@_uGuYDdsmNjrxfPK^q4)_l~V9%OybN|Q}&9OX}^2d?ZtnmcTLN+nbXfsSei7u z{aWwpf$pTjNBNbwak%Hk%&c={PG&)~bDtXtw7khY^Ebb2?d`g*>-6o(-Y)CJ+RJsX zM+bd~{oC)X2S3*}g+~&-bItx60D7rINxa0$mspA}>&?Ng6#W0|$x8N7K|X>S;SvWu zai9y_AM7n=?28gb28ev7Qu zJ2!t7rK4`uJ}T;fT_digdB~RkV!I^mdA~|U9d%UusHlN01Fk;h&Kre#YH%SUW0ra9X+VmmpbD(k4Hf_$u~d+ZwV7US4pHA>Gl{% zi0+keoBgDg8Wsr&oSTT(M$lsU1yzJAa*iP1n+>x}93qW(%F1p)#a^~_Q(Gt4x|gj7 z*?Od{1LznLf4Hnnypf#Xok`>=viTyks6TDjzhl>%wl1;tZd;$QwfGK9ktf>Lv1pO! zylpqNb%L#X*?N$zN7_1I>mpk(vh_P?`(|4&`+$1c(g~NX&z}~RS=(o`^6MiGUZM;3 z0in$D57=?$Wt;zH@j+#_eZg)=eD9rD#BY&{WsrSpr{*tIvTgD0d14uC>nvLjv-L<@ z=h=F^tsk>*Zx-9_UKHoJVvE^4V6E3XcE1gK{Yn(ix8pyw^+&cAzfLa})7I;4z0ua< zD-y)A+16WZz17xV*;;%PpIFqC#_w$V2V1LYj5}=mXIt;G^=@15vGqQCJulhz0o(rD z+Ha+0*5?72?e*MUW_?a|LapyiYx`U%v$uPUy`5&+cC2lSZ#@)?-?qhX(2HfBtryt5 zsojr*wmxk0MYdjS>t(ioyltl3y3$mG3avHwL&M^_Q=ateZa0yDYG~)FzMH)%sO8D+qOA_mB)`& zwq9*(ei2#LbFM1&NA_{zh;4sj+edBvhn=sV&FP>#t{k)N^|sz<>(6byxvWfHyl?=K z{TpQ0Z?W?Yw(YI9{>sjK+~!$!{6TxYi|jnZY|ep1_P@l|+iiaiRI>g%+b_@7 zY`^n%zQ^qNA8cJ}bHmn^?D&9fN85fo?D~A${@K>M?ESUK&Og)kn`P@F+i$mR&$abD zyM9kunYhdn2UMXG&~iMybJ=>`#M*fm*#7(M_(f%9@>8s{R$Rc2H*IbFRaPcGuQD%M zdN*3;r(W*QlU96yc=`HFxNPme7(1UGZ(OqCW6>hswCfYFWu8;^c8ayN-|{mq*zKXk z`v<#C_GgftFJS9MXt}=TWh>vGwq0WPr>VWZi|zdJwob6O#{ru!v-JvlyPUJv4=ww7 z+SX_6^`l>M+#Iym3tMh4`Xl#;+Fok=+5I)R#1Ve6wob71AhcLdcC+LGyMB?aOSzj*Ds0!@u;$>9n#LpMV=M>A(H zkcQ@o?m#-4r>z4SXr6=)WTSan5)U z@gaWlM-Uf=EQo zCx1Hm)5)Js{&e!ElRusO>F^AA20R0v0ndPEz%$?(@N9TCJR6=3&xU8iv*FqB5%3Z4 z5%3Z45%3Z45pbS94vc0$@U(6q51nTiW-M|G!sVmM4G8l#qy^Fv;ZBX&3TchRBW(;f z@gBs7_{rlYj|cG~e)72jvE+?K--5mceJlD_bQ5$F`Zt>Xji!I2>ECGjH=6#9rhlX9 z-)MLqJP)1+&x7Z|^Wb^#Jlcz;y;$0dr9Cb_X~%>35I^m?Y0rcB5WjgVb`$I-*iEoS z`?2JYC4VgWW62*&{#YXpi8o{6x4>_K-vYk{ehd5-_$}~T;J3nWh2ILl6@DxHRwE9H zH*bYEfj5CSfj5CSfj5CSfj410+{Sje4c!9W0^Jhb5`8n5)U@gaWlM-Uf8ap049y=a89=i>88|*gNZOGq>{H@5}iu|p}--`UL z$lr?mt>CTUt>LZVt>LZVt>LZVt>N+Tcz8TK9v%;mhsVR?;ceh;;BDY-;BDY-;BDY- z01BvKF^guMTb^;HhnHv)rjAq_SAQR1; zlE4r&vqS<}=q$rcya(|ie)71<<3W6gpL}lec@Q7sC$F2l9>j)56XA*QM0g@R5uON7gb#!dgb#!dgb#!dgb#!dgg*>_82&K)Vfe%Fhv5&y zAErNp>Ca&LGnoDi#?Hjf#LmRd#2$h@1bYbf5bP}MEbJ`oEbXTh`JS#ajv z1ctF6n5PmLj%MabAP3D{lE6qb^E?8%Xy#x9#-PU-hRFyrJ0YEsE{2L77Q zyxA3gC;U$Mo$x#1cf#+4-wD4H-VNRj-VNRj-VNRj-VNRjo&-;VC&828N$@0i5>h1v`cO$>dKae=_-#$)8OAWb!AI zKN)@({4V%i@Vnr5!S90K1-}d49o`+@9o`+@9o`+@9o`+D0#AXbz*FEU@Dz9oJca$x zgZDuM-5)-2CsC3SGjRlf;fM;kNtQb`hGNXx&sfOnWY_g5X}tgz$0kp zYzBs+nS~h`g&u_-iymvZiT5Br#7`bKc|3>@@srO@J`dtU{N#0$*Ms;FKlvkwi$W?R zUL*#ogTx{6=6&${;rGMuhu;ssAAUdle)#?H2jCCDAAmmqe*pdf`~mm_@CV@!!XJb` z2!9a%ApAl2gY@SS`tu0=d4&Evf;|*_DE3h7q1dCaM`4e`9)&#?do1=??6Ks3g#3?? z{}J*(LjFg{{|NaXA^#)rq41&bq41&bq41&bq41&bQSedlQSedlQSedlQSedlvGB3* zvGB3*vGB3*v2f-v2F9@;n3Wh9k7k}>U;>(%gMmlUj~a%_nWD*6zu6dRhomBX4UX;x zM|HzZya(|ie)71<<3W6gpL}lec@Q7sC$F2l9>jo{wVxW_@nSg;mmam)Mq{G zqZ^_dq8phux0;)u(^;>0f>NSD*gXr+@Y7Uw!&lAKnn&5Z(~p5Z(~p z5Z(~p5Z)Nx7~UA(7~UA(7~UA(7~T%v4&Dyl4&Dyl4&Dylj{c<5pH%vjN`F$Z`(pRS z?u*^mFifsUOs+^wKN5#@GFb% zZv%8AbR+a*=*JAhVENAh;KkCBi0yn(v(w=TK^nzKfePMTcJnhD55NPlFqLCNTcL=YE+R7Si=3{nS)L*mWH z3^(~ah!63T*G*mz;zRsq2jc4zUzhm0#MdRhF7b7VuWQ7cb>SW09pD|{9pD|{9pD{| zc$4pB3h?terg$H#hpvZCKqsIdLi4R0f&OT|F(WV;J(<1_KqeWig+Yn_@c04ZL;R+& z>tWZ!u7_O@I{`ZZI{`ZZ`yuRyuph#Hi2m_yfk-55XUTKLmdW{t*4?Pk;K;pZ@fxKlWto z$=H*znKK<2z$?(bW$?(bW z$?(bW$?(avH-PpA(B1&r8-P6tdlL2}Y-V}~+S6`(^dR&g^hESTgB}<;vi$+%A3**A zL&6li-u!li-u!li-u!lW4C!?X{=9_O#a?dl2>@>_OOruqR?q z#GZ&f(MY4s3}gf{UAEtz{O!r#p8V~}-=6&K$={y*?P-4yd=PvPd=PvPd=PvPd=Pvh zd?I`zd?I`zd?I`ze4_C%ZKNZa2zS(tkqBpG#^cBfh+*<7GB+S426ujpAqaPU49?;V z&f*Nt;*30mGdP3MYs^5NL|#OeBd$O{wr4-|2J{AW3A%)Q0c0vN4S5wQM%E*{kv#@? zm5kwtn|Kf6L;U1%lgESj5I_0c)(&{@5lQ0WBvQF{{2}0 zeyo2#*1sQo1AGH~1AGH~1AGH~1AGI#1YQC!ftSEb;3e=9cnR$XXg@&v0oo5>PsN^! zJr!HDA0R$Je1P}>@d4rk#0Q8Ez^B5e!l%Ng!l%Ng!l%NgvL4e|k7?*v(XXP5(Z%TX z==JE`=-uc&=skvEve(R4kfq29!%e&g@gaWlxXI%|e2AZXZt{5$AL1vko4g*xhxo}K zL0lA48Sx@9NF5{&i8rUgUxmL4e--{J{8jj?@K@ol!i(X>@M3r|yck{#FNPPx*TdJt z*TdJt*TdJt*TdJ-pWXClH~ra7e|BT|puHEcU%`F_ z`xWe0u$N*l#a@cN6nh2s3hWiwqWu@h{{s16ApZ;Ge}VijkpBhpzW{#){tEmR_$%;N z;IF`6fxiM@3SSCe3SSCe3SSCe3SSCe0bc=M0bc=M0bc=M0bgNoH`W-9aA(foYRlj% z%b1A#3*psg%tQ*2Impw5Al=NO%;e*^yp{tf&a_&4xx;NQ@nQuD3^i1^A=%?x50s41<{vDuy2k74c`gef-9iV>)$UlYrQ^-Gs{8O;=vGcL>vGa+a zLi`lsrw~7d_$kCsA$|(+Q{egVe0V-QAD$1-hv&od$v2&R)5$lTeABTX$9^39aqP#j zXJXI9o{2pZ`)TZ_v7g2k{hv<$>ExeI{^{hOPX6iSpHBYi@W_ynG zVZVm`8un}S??w9eBK>=j{=G>5UZj67(!Uq!-;3}C@CEP%@CEP%@CEP%@CEQi@I~-N z@I~-N@I~-N@I~;~;IF}7gTDrU4gMPZHTY}vXEFU*On(;BpT*eAv6o{n$6k*82KF1+ zZ(zTH{TB9H*l%IKMgGO)UrheR9{93||gk4qpym4qpym4qpym4u1pw z2K){98}K*aZ@}MxzX5*>{ucZ#_*?L|;BUd-g1;rFEIh$+bQUrjDMFq?o?b} zH~M|_`{)nQAD}-(e~4a-UW@)1{W1Cz^e5jfG$8kfqnvAh%Q9WLeE0aM$bmiL5uZwu|6)=$Hn@%uxDV; zz@C9U1G@mb0J{LY0Q(8-C$OKueuDnF=%0)Jx#*vZ{<-L%i~hOjp9?+%J_9}jJ_9}j zJ_9}jJ_B9=FMt=o3*ZIt0(b$u0R9C03HTH6C*V)OpMXCBe}euL(w{>5Q%HXbv1eh= z!k&da3wt*9Z0yR7ZzG(g%AZ2#NGE?H{A;vfa-=jlqL~~mO^#|NM>UhPT$9WunN6~p963$0 znH)JyGMSwDnyZmDjDu$w2hX6NML&yv4$XHP1)fJgkDiB~hn|m~kA4aL5_%zeq2VUp zgZL0XdEDgjAU?!TJ~#P1h!63T*G*mz;zRu8k034zsf>7$7^Dsohs2xDz@LRb3x5{= zEc{vcv+!r(&%&RBKL>vf{v7-{_;c{*;LpLIhd&R09{xQ1dHD12=i$%OpLz6W9{rg| zf97G&$DWTpAA3IbOV}@Azl8k~_CoB1*bA{2l7Alg=aGLN`R9>;9{J~ye;)bg!RN#0 z!{@{2!{@{2!{@{2!(W2G1b+$s68t6jOYoQAFToeW7s4097s4097s4097qTCgupgG7 zUq`==UWQ(VUWs0bejClVtOQn}SD{y}A-?u$N)4#9oQL5_={6TSEVq(7z@0ZwdWdLjRV~za{i<3H){V>+sj%uft!5zYc#L z{yKaad>MQhd>MQhd>MQhd>MQtd?kD(d?kD(d?kD(d?o#PoBq5_f8M4)Z)2~*UWL61 zdlmL-?A6$-u~%cS!Cr&C273+p-zNXt+3;3iGC7Ygf2oqg?7d;pKGWuomA1D8D@*gMv zaq=H0|8epkC;xHsd&uu0zlZ!D>?g6G#C{U{N#Z@kdx-ZC?;+kpyoY!X@gDe-@F(F< z!k>gc34ap)B>YM86_Kxqd`09d!hQ<-DeR}PpTeGtJr{c}_FU|jv0ui18C&$fi2Oz5 zFCu>t`HRS3ME)Z37r~!`KLvjZ{uKNv_*3ww;7`Hl!so*0!so*0!so*0!so(YhQADd z8U8Z-W%$eRm*Je5o1BrGUm-stzadAFKMY2-!CAPm4&f}^*o=IMaEHa<4vVoHIfl3b zZ?YfWM1O_;3jHJcNAz##-_S?VN6~+v{~$M`-{hUoJd7MM+{AkjAL1vEn>-%Ghxp0o zCZ7lKA%60@$?HLUh@bos#6=;M5ib&h)Is8qc=Jv8SMaakU%|hEe+B;v{uTTy_>b@( z;XlHEg#QTt5&k3mNBD2>-{8N&e}n%9{|){d{5Se@l>Qv0KS$}$QS3jk|G@qO`w!N8 z6YISR{Wbb)^kMX2^bzzC@*gGtQSu)p|55TECI3e-rsPk$)5UH<5o6 z`8Sb&6Z~uV*YL05U&FtKe+~Z{{x$qC{4o45{4o45{4o45{4o3o{0RIA{0RIA{0RIA z{D{FFbz=j<(bM2c&-en_f^0>$A={Df5$@<2KO>A#gQKj$5z#n{7^aCZN=-(nNwi6{ zNu)`nNu;?0*@-Y(%@fEeEhMRZ~;zRu8ag)b`_z*w&+~o5hKEzL6H+emX5Al;fg19K8GU7#IkUB^l5^tLD zb?|lYb?|lYb?|lYb?|lY&G60e&G60e&G60e&G60eFW_Imzkq)M{{sF6{0sOO^k)nG z*+PG|(4Q^X+pxD`Z^Pb(y&Zcy_IB*;*xzG+kNrLN_vGI~{w?I+LjEn}-$MQ^y!pq=g@G^KAybN9jFN2rS{+G1>CGCGn`(I*j#omg&6@gaWlxyk22 ze2AaCZt{8%AL1u}1aVPFWyFibAa#&9B;NcM{vG@~_;>K{;NQW&gMSDA4*moD2lx;0 zAK*X0e}Ml0{{j9B{1^By@L%A+z<+`N0{?~n?4m!r=+7?tvkUuI>|e2e#r_rhB=$+{ zlh`M*Ph+3PK8<~v{JY4%i~PIDzl;34$iIvHyU4!_{ww@f_^H>_*wW__*wW__*wW__*wWl_&NAF_&NAF_&NAF_&NA_ z_<8tw_<8tw_<8tw_<8zsf&N^eKNslF1?-F17qKs5U&OwIeF^&#_9g7UvH!;Y8~bna zUm*Vl@?RkT1@d1Y{{`}2ApZsUMfgSdMfgSdMfgSdMfgSdCHN)yCHN)yCHN)yCHN)y z-|)ZTf5ZQV{|)~e{x|$@!!R!!dwCh}M-Cu|5Y8+O&SDMDHVt0I2JiR=uVjN)vcW6Z z_zU3`Z14(ZKVD`(UM7zli9jNe3P==E5vhb!L8>Cv5HAvqR7YwUZsI+N5Al=76>yW! zjgCM^pd-vx&;yUhAsX8kU+ewSIl%dFpJ*6%X;-Q;(Z-%Wlu zb_8|=b_8|=@opmusf>7$7^Dsohs2w1c!Uv!R7Si=3{nS)L*mT{@-lSb_MJx>?rIg>?p$>sEAz=yCSyeeDt1-us@PSrt6^8e zu7+LBh#)Qssf>7$7^Dsohs2we;8oyN;8oyN;8oyN;8oyN;8o#O;Z+SU5`)x1;*fZ= zD!dxJ8oV038oV038oV038vXIoA20p!(jPB&GE%*TAlUT?4xY z`Mu=#8kG?*5`)x1;*faL3y+3J!=vHR@Mw56JQ^MiuMV#cuMV#cuMV#cuMV#cuK}+C zuK}+CuK}+CuK}-N7-mhR7E&AWAu-5x$o0rSkQ(T!}|HE(-??HTs->ivU3%eF}E$mv@wXths z*T$}m?ZftA`>=hiUrpApChJ#|^{dJH)nxr@vVJvLznbt`@LKR%@LKR%@LKR%@LKTN z@Y?X&@Y?X&@Y?X&@Y--6+z0o;eQ+P#2lv5!^e2Y?#27xr|G(P%8t^Epv+dn%fFuMa zXv6>kmLD}JLN*DIAkZu%II9~78Wk%TAPFWmgqZ9KD9Yj{!Wv?+MT@?u)S{)9Dz%7F zscrxvP-+A6Dz&LbMI{ZjXekCn^WD!mGtca7mLL1R*6X{j_w04=+;h%z{{PRMIfHmc zA)c|o#Xt(;8-@7B0v7`*hR^PqGXKMgWKuKbZH2d4HJqhk1XP_lJ3ZnD>Wyf0z$|`2d&?fcXHJ53mdd zMgWmXbQ;W`-C!MHBNbs4TLxVGSW64#R!wAdDm;t`)@#3vc? zNk)8WP~pn;Y&vNk}XNVU|4KFw6(Td@#bZ4B=UZ@GL`kmf^ky_bs?@!F>zvPvZV0?oZ+#Jy$Re=mqpe;kUs3 zWpIBP++POwm%;sIaDN%xUk3M=!Mp|LEii9^c?-;2VBP}r7MQod{3Ogz!u%x6Ps02p z%umAnB+O4Dz2lJHak%!vwHK~^ag~0P|4}fH1uh0sAQuI>Sm0tHCD;r1eR1Cx_kD41 z*dx0#{BiI<4*ti%|2X&`2mj;Xe;oXeL-=~Zycf)S!MqpDd%?UH%zMGS7tH&@yf4iA z!n`lc`@+00%=^N;tADz`|6AA4bCW1aHu_^FZ$i(9#3&<7hIH_b>%8h}LGXuBNSF-i zNQD+tD2!4dL#HK?dSmJAhcU*GHx{&>LXnJgJw?;OxCXYev*qoW^uJt%5s79tTDy{r zv_(OH2g-ONTIC}>=d2KKQgz=g=w(6>YI=wFl!Dp=6z-9HLy=`ugL?Wu3bd$C{TdtT1G> z1LTB;R_7?cNW~xc9gfE*Uqio=E$XGo7RlSJdTY`4=9XV$gsj=pzmhFvpl7k@tpX*t z@onvue?IUtStGh0``4v@^Qrt=Y*4SMWQrW(Q~C9nigs`~-o?^esq|;Q+-vly8B){I z&7#}V+Y;HQ4%N()ulg!h)^F0#+mh~VYq2IL>$hHSJ3bgzC+jyE-^(((Ur%c~vVLnf z;&R^gn-A!$tSVbrRpwbzSY26CWa_=;b8d5uH%S*3m6jC!=nUVmFiYaNZ~D%K{3^xS zoQ&{I3A0NT3#)L7IzALoxTvHIUk(WyV8o41&-hj&hV(IGh=#eg>J-;d0{~ruKn4-|l*$1t%rk zbEG-so%|=cizCTpn%f(aONk^mHZ?8Wy{t%bj&Y_KlY7@hk{dVH&EUOxrkzmq^f=-f22Qisx(ujeG-K3KMofMOf zJuqXINdsQbF=_bJKp%G?bco?|ji>OW{^!R7diA2K%}V8wip$v5ao(hnnxPkTCojJ3RU}?9$R~ z&0!hc)^nN(rITT6bB|xH!CI1LwuNPMTc-4@LjNYTvH2w{74cRyCSgbAK1vy5(QxE4a{KW$cO zJxTSM^W#H!)*x>zm$Qs+>!+Fyo*jkQ%DBSwDV|JdwjN~}-PT8%2@SK25ISFbssYb2 zG&9jCfhSmWTc}agX1-2%B|@au&qRv(QRdD zIy9v>Liqa`j|{_#yyn+=XdH~|!4e>qcoO$-Vu+oF202)^R80FMF@Reo}K18P(;B$odSQEanwV<%7gl?+v;ikg! zGJK{fvP&dG->ITA@yjZ__%hSNitrDjg}7Z=Qc|VM7kR6y@DVc2zq42(_bD`0ca{`` zELeyj$v~dPQpLi;qVk2+uyIaNav$+P_-{LlgTnu+!uiOXd2=xZshVFjZcIjMp*B_M z`W?8CXd^HX&vH1@3(N8SGI&%t7vH1vRN?zrbhD_s@J>uHu$W1UI1#hV_?DY~e!toM zxn9r0!b;(CQTQj@LL@1!3%wrky{SS(BeG|Du2vgg&6D4PL+~qZ^OT<17Gg?YRxDgl zQe8dwHUuYZt`sqDx_9~qnj(B)?2Pu{p@{k-d?jq*qC#&a5>fxuScH`FA{$YLita4L zvOq}%Et(a2mQrJ3hfB=@gK za_Qy|P>`IB24f*g`fL8^70LC9DCZa(nt~)ZII^7S<6R_oWhA+*Ow)vj*-ZBg0g#Nbbjx zk{f6K1{uk{9!btI##B;Ct~ruiR+=gONbZA3a*njL z(1anmFCxi}HBXF5&PL0DAxf6hF{T9^l1q#vH`ZaQa3pt0BsquqQ4`6HjU<Oj2L&A*6PdQxXU!%g{%X>EM#Q?cOi=gxC@zy<1S=Ijk{8lo0X=!#i4f( z`4C@|#>#Mw)!`az!!_22YitbH*c`6W5Uvpn*JujYXb#snBs4-hRqCM3Lw3@^pqd^# z3r0ina2Yw?Ki`M&krxP_&H1qJ*%k;=G~cNgI@1EdD3;NuA_Fwfs7k-=w`; zXeO z;9<@U&}}W+*7q}GfnYSt=(c{Xxg!?{bX$M=d$(3&f#A0+quaVn zOCPyFKxsnik2gN@xUoQRCClixDzv&o%K^s1$NGbB+<`5J!UY^V#xlCC54A8SnQYxy zko^QUC~CHju#9d?|Mn7X>oNSg>g@}wu$@t}HA?fVpGCK|UJEmALojT8b^Z9qu=!E5 z^$g4CwsvbJlOAUpwjSAEb|<##X}12zGPQ5@O=8;wm-jW?t+qk&+D=Zv3`W_ng82P%qzii zO<^gPr?8iZ^X9w~u%xPLVb!;@f;5+2eQRraRR108-ik_Ex(mteZ&ObGCw4{Is9xx; zDxw^oTdXaleY@CKmz0+jc?v7>iFaD))9cT9!k(7Z)N@4+dxdEhu_}nyps6~t4jWD>%v3X3UIkHZA?2?JJ_ZD3ja`j$BqJ=dCUT54vv;b%q8oZWc=yQ)Y{GpMFwq|Nt^P_>}3Qb0{D&;aA`mMN<-197(J^+bjaUnkeL-Omu?ah`)lVz=0Q!4MtHO zRg)1O(4W4xMVl?_#b|N%4x05|3K*MG)IhUZ*T-Gw#4e1+*{;r3V^K*nz-EjvgC;ew z-yPUKTQ#KJ0esWm>aKGo!AymjtMdchB{s8nH8b|aTy6@Mp?}30^y%5Y5e-BBN}-Rx z^HQ`>K@%LS*osOM37lYtf4gAxKTNRx1MR~u{eD-8sB%)l3l3^eKHDnMJ&++qS#GmZ z6(rT&|01SKWS^8@ULd2-9%g7dGz~Ott^HMdjsuIZp&CD+Q%}wtw%H+W0gp^ zWvmjdV;S8R&0a}SQ)08G;9r~mL5J*<8ZIwVMsU4(k*h@76w)$q%ib2*DRteJfIYC~ z3yU;|aEY`nfyQ=b8H{#KT4&q3u%KjtHiL{uz|Es2m>JuCX&^A%q!VGBrEdThnM~%fj5#&Z^ zm>yS)KI*x@lf{%nNZ}iuo^HxtHVh@mpz!#vL4rL1_Xg2AEY#CLc0y{l z7=<`*yz!>%v4=O6_VA{<1AlS{cBp~3U4b`Ubyl@bO;GFdla7$J+MwsIx~mgZf5#=t ziXb%fH_wWqm#fyMNu8}u-)q&>n|SfXiTG|x?G-4@YTfi0wa%HO)&`ZDU!WON>s$$r z18zC)nh!Nf8C(NP7#k{EB}6i)bt?vy6X~h9l`m!dsE?Fl+)Mvw9|L;6UBcRuDCjb?yN@d$8B%o z#@{j7dyTSns%K-iXR2Cv6T+!^@TBlixYm9VyC*FxHMGbt-S(ffd)l1-ld+zU+M~%O z%@ritbx9kumD(R5SX$yKwUq8{^aRC}Ch0=Mm7r|xK<4ewg#$g*y6gn_ zZ*lrM#(Nc!A+>wFOHWL#%=X@yQ#W1ak;{K_in8J$`eAqdMKy@f^rH9&@~rzOIXge7 zn^t+E(du=Hr1RgEWbsV$@397^Rkl3``AA``orRB!t99^OmCpOJ#(VH#zsl@}pOJ}w zXX-75w>q)YTnNoX(q8C06%xF^ir~G2!t4*8^mmL`R?v1B6z8>wlpDp_Wo;5sLHJth zrdDpWE48$7MdsTK6v6{a%@?rZZ?XrbR;vC}Hl_AMa-wbqJd3M$?wW9-3j50^TXX8O zcOh*~R9&EKy)G)JezLez{Ik#q&EGw>yt7ky)OIxjeqyR8J2bvZO(V)T7oYj~#Clsd z5y5*CI+fZ)kqTj1h#84+Pz_8&O+5**QdGjWBe08_Q+o?;PE5_WDm60%tBO);uLe`L z-nc}qpWUGb{w(~H!N^Z=*JWecBK4>OPe3X(batNZ95%HQqp~OqqTfdIM3IYdY#BUq zqg=VrYKUa2fJUIn-xLK&7YYl?%7oEM?Q6)}<$I!H@LC#jdMB!ha3Mjdod^qD7L=M% zxb^QzAgL#GsTig9VoeIoKvEusth?q<4Ef{l=%&=%124d$mD&=~I827$3CMxho!IQ} z+ha$z^v_kcHs&Z(wu6_#Yse{E^O0$167nduNm7XN@(eCP=$|O#%GPXKeLiG@PG6H9 zHPNYTZC0i<`%YCVwFe;3_EUsVL>pn8imaw+bA-lF+ZNd4^zVtzLF^He9!kwZj?+VM zKt&t4JX6he<|wt)C@tR;jekn2YFw$19>a?l@L@jke&u2Ckc9nj+%Df^@ktAlg>z`C z{Y#RNybVHDG)iZU=W56)TW6dl#j2FrA4#FJq}W`|L2sJ46aapIN9}sXhIb z2vfH+3zaCf??|EUXBI-hUl2mB9`!Sji%q6n-0wS8t<*jQf%Z6R`;?kmaII0odzo3# zsfG@3UrGsfLwY|3UrSwQ02V?b*#skQVRL=`AOtY zZ_yy415j!{z&$eOD$ut<+ipdpQLnC>?>|{wbxF5OB;|a6N6{ihq$)ZIpHllAm zEJcdQ*7{MQdCH0&al+-w!@-zlrPczs(4rw%r~-Z=s`I&Gz{{p41^umxwaFT+kM~*k&ksy17ukvIFHvgVfUUOo5ieR+ zqbW?Z_!u>BU@*1u;%Y}VkG1U zB6xvj1iSO~&Q1#Um-xsTB04xnc|GX#2iL)o;;KH#$BC)X_w*1AsyCiuhXk>Z1CHRA z+kHq=kKc&1o{A{Nz5K1#&L$(cGOW%!vb`73;0;5$PEU9Bsu@Y%C~{4=soF5=!yZIK zJPDH;nhSLz3Dm6Z%9BBRld?7Vc(5_54kRvFZ;dy)u45iKjhoHF%1vv&pj`y+lV3?=g3sdc^5l(!JRGac*57 zr{h4b@{%jsx%~6eg(w}d`@L_fbrh3m&nW!&@IHz``mtB2vZg0E8)RM0MkPa|bvKGj zgAbm^I%B)prgkt=1MlVqjtK!o{VLUePpj4YsaltN2tz`Dhu71`-%;j$+kejyi}%W$ zx_geb?*+Fu^hA~R4sq9&9CP_k_qg-L_KW---*|iG1TM`9+#Br(;w4NH!Ki-@jrwOf zZ*>;V-Z27kngB#wuEGCA!EU&b7W``ucy7fk(e?5^sp4I)AgZL6VeS|@AH^Im+3KvX z-j(h9=0w#9cUIG~;i@&L)<^rC{*M%Q;61nFZ8huIvfgg%Au&1J?)?MJI(7%iIWWpV zWC|rcT1X3x)DV($D5Sa7P@x>3GJ##gtP6uVerHr<`5c~q_r}!Nqn#ID*^NPSc?*KH z1=k{6X;4cibu0vE2)hWNvv-yOet@>l)d4>SehT~y_%DFw>$JA;OW@bQ^T6+bmw;CR z+HAA~*bV#v_!ICJ@DA`7;C=a{v`^1NlG!FcX*s%mIplQlK2D1U$fEU@71OYJio%DquCR z23QNM1J(l@fQ`T=;7P<`3$6{oHXsN*i+H>QeR{h3Ik;56a11yObO5IT+Cdu)(D_{PKmw2mBmv2Q9T*Oz0OCn9t{Ffk zFad~x8*d@*?*M-R-Ur$-t?fj-Nr9r(pc~0xMPu~vLh4a(BUvIdYS^V7mXSs1J~KY3Wlk8b(M)?U-cQ%yO8i%-qcKnH4ab$!r$0In0Wgl`<=5R>{o6Y%#N? z%zVshn5|^CirH#rYnZKNwvO3)W*eAoWVVUfW@cNMH89)8EXZspvnFQym^Cvy$m|fa z7G|x?4l_H#>?pHi%#JhbV0M}rHP14qX(BIK3^RHNB=r)Q(R;&EFNs+)Gdr{4%u<+* zWJaSY=?cAdELkQqEXZnl+01g7sm$EW@|hJdo5^ezvpLL)nb81ShJcoRC97oSVYZkV z&C8^mk68_~mCRN#Tg_|@v$f3DF5Z%-X$6J(UQe8OJJ7BjMl}ZTrx8|GkUjQ znx-%t$t;yw2D40N6PRT)%VDN6b2H0lR={i~vsujMFe_$O%8d5=$S_wj^DtY?Y$-Dz zvl?bAnXO{Bnwfa|iTY0p*?%9cG0=H zi;lI6J8fNLLSG7%;@9dP;d-`>C3Gf%+*vXS7R@^_#CZjkbE~RL^s^k6XcAJ>TUOz* zRL|EWNUlnrDHobjN6zSmI7EXsW6Mq9XONS7ndyxNi++|ukvM;^axNVLVcK(J7SML*)MDiA|UM#Glb3SB}i3Nq?FefxkS*wTN=ybbs3Y|9;sMD`=72I4nMRi_xJ=?%$ ze;m-o+H(?bB11dJE_Tl3MJfgq|=%+D_V+9K)Ou=NU?iiyNr`zrfM=m5P#CW zOs%z*y3~UfN0Kuie4smFzUsSa<-(vm3r=n#Q3HQc{o7OAfkv7XS+E7f<4^;5Zr@W4 zVCTWL*d}qY8n^~ezk(@houUS?qKe1*fy$)a*>;MPSly$;UzUtR~;UW*Ij6MjL?wBHqBG= zUu=sAoN{Rkmb=VBv1{84Xb2$#QwkkI~*c4O5TJ6t>$sDZtjagWZXz+^j}`RcBV!Uh%1xy!parv{o}j4jDXS!`nos4<3{ zI5&2Qy;B?%`=1_g>O&ei;G~L08QVQ~)Ldi0sSj!7fD^`+gY*X_2a|pu|!R?j=eVA8=dcHySQvOv?3gGs7_q_S_@oo);!tEHyJ z*r~fx(}}^=W~B;Aem(g5;$mYk`5?>ae$CKy7g`q{%(>v^U+&XMf1G# z#WCLe-rx zU-fkWZ8_|l;}-A37%~>B8Q~ZPOOHcUfs?-578yG zp=|hE{7HRp^)_sLOK3ys#oJpQ>&IapN{qjG)uL1kQ?@_duq=1QpUrq)^8Lx)Q{beAkHPs_yVDfu8k;W)6AqT~~X(ddO-|Swd>!lw~fX+IJlpxulpj zGNKG3HF?Ever8nr=~6RfWJF_AQnK3XZ^&%y(+B6Q>G^hv6bV^oqunT^&cE89Wh{Vm z2yt*GYWaM)Xs&p4swT`L9Zjzr72|A390hrnx~)rUM;_uW5$;4qoeZtWlFNU6Zi+*@ zLh7zuqe?>B(0UZ9(BdI=y8eGBeXjWsJqz`iEr5QiEM=eQBg5)=*U&+S>zeWa#45zsT5pf>2ODPU?FrqhV!_nk_1$ zp-Prfef>PtB#d(z4Sf84H_CeR+q!UKol)X+U1Pecm!0!3ac6EQi%aHtZxaQKnqPB6 zNe3bb^TIo^h*#m6A98qvscDSU7Gp;hjaoSG_R;opj$G0l>0{DG8KjamOk_y|dY3s` z=6r7@D{ZW4g)A8jz$zs3M(W9+D8(bSev6?0E@WoN0jg*>gj|~G$Vv-Mt#5%$ADYKQ z(M7s9PTcE%ec|t17%rljI~27sLJnuO3JvY=8OS{enOr%?79FniS6_ILg116$Ib`0a zh82qAk!JqZ&{)Xz>4oziwJOeX=2z}4m%)uCdNUwg)Z<}($8bN))d8i@j>PqT55!XH7)(ja=CDz z05XqWEW`{soGT%9MN0zBv<->T0CL<-a@TI4l z+BO>H-T}Gj0aA*VNM!zInO112fFx-$x_j9P`Pn$1z~o*z+)L6&XPO|%g+8GpZR+J} z?8FR(^A7M%pgF#VX$V7$8txut>pDAjXaS@s-{_sdaJd|W@1Pz24<#woCm@ns3ld`T zC0Gtk5n`5?&LBtr=8Q%j1EkL6FD24a$ZXc+Pz56TTL68kG4}(cXgCuod>-h}L>1fz zkfPysBsmJ-XDDgkXr=8;;aiGyxfGM7r?lKGJcE1Lkei8`uvRN=`Dc)$glL!mWJ7=y z>{0l{8b#>JI=0+m_7Z6He_(UVFaNoU;sb8$o=Ke;wY`IdcheqLHSoFPz!7o~i|=1x z=d34=7M*VpT6I$sT!BMs;FQ1hw0J`ctKhxeb<<+pS$jN}`LeF^4plobcj_%BOQbo_ zmu2@3k(#*o9&7LEZ?e%Id~CrrR_RIf3wK~QeAoT%A>3$hfe&ikjWKH0exczR=F6Js z9VA_Zrsq`z2iEij|27J`BdFGPdVa3%7LEDtt7DKjmiC9J+E8;GExr^*4MDW!X8hkG z*mnF=sX@ODaWp+(H(+fDtMYj3E5=#xeA3_1zxqb(THzq-WFG&k-~St6Xy;@<&A(o*64SL z$YERl<(?OLdAT@K*otn2HFGhw1EE5vNh>0nCwE(`40M1_2H*x@F z=q^%sM^RyR2PWeIL9BZO^7R_biRI$g+5f4sP`e#%`2n*vV3UO2WB7LowjTdZ!Jfgt zTd+;|r?MYyc>(`OQ!uSi*k36W*m-)igfMzJU@Q&CzPJ^hUrg{cts)Qe1`_ZWikZ^)4%d<2g!}M*6Zwcn8RUi3;&@2WrKzX$j(m)`a%> zkotg!UOVmdM9UF;84tKR+Ycop*woBNTbAHIMz9~_Ul!-D!DJ!s(j>?i5#p5<4?#xM zy0?&`k<;?V7+F)Z_A505P@0s%76c!!y1}ZRqWir^+d6Tt4EEt4Ng39Jc!!zFV5HRb z^rkl>YF>tQJ$b3tx5vUi_Qumo*=qH7*gb#ucf@**p!O>@_rZq91Yg!jrIr$6wIRO% znPSB|Aa+kX{$o8KQ-d)R{^Q*O;SFAXMN;BTSMOw_o$>sDnwatKdME05cUM-k=Mua# zp5ncl8kHVsRA?xv`Wx{*rrr%S9BaSS+?vrYYCOE`^z=5jKxp>xfD-K|{68i9$BPYn zgmn8ym%|R#n`jFy!pg?!Q81aWo55th()J?RO#KYZl*3#u0GmJUfMFQlU_!;L4O^Izd)zf-4#RS z`fhjKB(<(T-d%r%rV6freC?37Ae6WQJ5ABg3w-Pv@mII@iqa7gc)Y8fGaT*3N2-5E z)b#p{(XP&2Q&vWgc8~an>fept!|X1c%nN)8*S#;a$K*Orv|pST_{J?7Cf#e7^&9sU zW8Hx}spY5540u&(wtQJ>970H;j26@F*@98aFZHO>OT8{Fzq{_bm^^yV`!A5e{(!u| zeisIY-afgGJyU#36FMj2WxYmc;|JI|V9m2`&l|Bf5AEL#?)rhSfY&L-!*>J-TD>X*_^iI-v!=l{461RW$Mbs)|E5q6*Zg7 zAB={J-WT%%&92TpIOoBptazLPBS%po!x?uS*5j{>ar&0_>73}zhNB7E02Vayq2Py6 zD-$rB$+liy7roqx#YbmMbIwZi7Qy!EXlAE{*#BmtCm3qKF7ctp5944tAC?mzayEV# z?X(_%L_Q(`v%f{|QKs}wB_hXZxH1EXwmgUbG{N3ty$exD zr77*z3n{Lm9BMDc@n}Y^`yoo0=9dfRTw{j+d~U`4eR6Y1R5MjFyrj+OO&^@>UDQ4Z+eD~32B z@8o46wz5dy!;HE_S-2IXt7JFGT|G2Z$MJhNV{|?lHPI>>pS-L?O3f3nhyne>mtvzqKvIB>j@0oKe@I(IZo}|fzi7f=;zM*i}zsr z4cFFBfF7nQS?;X&JyT((Y#mH5j9L6&&GP)w|J6`WQ~PLYpoi{`vOzm=SG23%i3m5OzNFme=`me`RasnAHBZh@;5fS>u*IO^~=k8 zOQ{J)iMoANePOfjt5{{lYq*E4_ow3}Xy95+K1!FT?dZsVmVY?1yiJ#%6DCg^7mQ750j@?Fe1p~v7&UpGEAOc zH;f=3tIN}*KQugdMwZ8fQM#WHCZ88szNaqVieeS&{_x21@wz+>HA3aT!hMAB_tNEk zntV?EvgTK5aO%Xc+t-Pbv?sF7-qNP$8uCThqUo-*LW8Ubp5gUbioEAy5wJzguPTtk zi?(sqrENVCA6M2FO6{l6Yx^31^b)6~{n}Si5G?IE^je>#ed4P$pKTxeDy>bnkA9WL zPVFhL_Mpp5WDlOT!$G=L8vhCeor9nPA>1iTCo&pHj7EO~= z?yE7NqX3Ji(zMO7ej1iYPDU*nrJXwJu5%yjzy~K0sEeq9NrVN8C|PKr2)G0Bcnw`N zCiGHsA4K>jXk#7W#+xu4&8A(CI5Nm8#%|Wv&>VNFS2<%mX|xBj{suXe!JuR)y-Dp& zcATK0(M3u^?h&OAwqfRWsDY~!cK4tp3mn6+B%3CrDY%m}d-6prn7BnNEY?W0R`}1J ziB5d76}_8me?ey=(Z-1xF(;vbZS_olkkl&`p%i{aNMDK!Y>L>JdS-)`kw}0)b z&&X8$yS_#PdTo71f;;Oy&u@H_#(Oum_sI>sg}1Y9SP`*$9wk}PbR%V{n7HaEbHja# z8tx`quECN}yDiU(%tSkGbp$DJu=$PVwD;+@Jftj*Wpe>u#nD!cWb1sDE5FuOgJoBRp%NNgD}|;fLPJ71@SAoXh|WPD%u<5K$^@qgYe=_u3(^QP z*P%-746wXSq5paaD@2&`nvfoGiTft6a;+xiMc0Km5DV+hpYgPQb=r-Li~LMl{k@>p$^c z{+4uFAVvQk?@^IcHbh$sic%YkylPKFkiAz@V%w3}RF{zTD1frhJ{6_++3q?N$=&cu zRx=)w(^xMLh_(!aM+JgW_4@xsQ3VbSD=pk*05n({3(%AU%hFGnQxCFQqpo&Y4+6aJ_Wv&250#^c~ zfYAVr)Eoef`_lp4zyG`bUkd0cfMW5zs_=6?V#8FAbEue@sI#g#TZoFb*?M;G-o0Cl zp)B!9!zaush>wp?RqfdKGdz>~l) zfL{W?2A&6K@$MzyRp51C2e2FX1Mnw+RuJ9+{sO!Yd<1+7v;+SD{t0{ud$3c5u>^f<_HD0JMTZ z&-dp7B|sUl0JsD20!x5fVY8nf%kw9flq+H0iOY102D7uAxaxc6-p0^b$>wjgZ$O~2!iW=P(D%) zQr;Z`T7Xu7@`!SW@`ZAQ@*><1N^MGK@@p|byC8f(4X_ee1yH(CicwloDpC4S%H#kl z;0E%60$?UE3z!2G1EoMYPziW|Gx@O^X4GOY1tPWBYoNatcnEkHp!9zn_&M-2@GIaq zz;A&U0h+S?9%uyK0QLZX1oi{1K%}(!JM=#X{so)_z6PuaS2rLQ=mqov=pj)*U?4CA zxC9shTnU^{iyfLa-?qhm2!1>aJPJGx{2X{1_!aOQ;J3hwz{|kzfkxmBU=Q#|U_a0b z{24d`d;pM20Aw#9Sq$sNGb0men#e4PSu!&_v*FBAn2ltX$}EFfCbJ35vYF*DQ<=G$ z@+hA%3uQS zQ2v<3FpFoFz>Hc;X(NeQGBZ1~;mlH)QEMjcrZS_JP3lqmCKDfKFuQOhaysQr{|DKj6l8fGh*tzx#C*&1eR znXO~Cp4kRw8<}llwwc)$W(~}?F$*%=$*hUlK4#6#4l+B$tc6)Cv%}1eFgwcZ7_;Nd zI+&eiMoS+uO{1B`FpFoFz$}p&oslH%CNr}$8_q0+*+^#e5JlR}U`A&oNxccovYF*D zQ<=G$pKDDKmQXBW+YN^Dv_`lBDTUW0eQd-;0EAkU^XxpC;`fV1;8DE z7gz$^11tw>fdEhsJOt24F9vuVpiMQ$;U6iAuS`YBC>156RFsTTQ8G$J$tV>iqg0g4 z&W!G*9;KpWl!}s3DoRGNmW)zSGD=0svYF*Dqg0fpl!}s3DoR$sY$mf=%;qpFW>(6q zoLMEaSxBjaxT7(DFK|+$0hwZwQHn`MDJI#iVDo_W!0kWCFdj2P%Ln zfF5?=1>6hV2iy-l06Yl%1b75^40r-~3U~&17I+SL0oV$>0=x!n2X+B_fj5Bzz}o<+ zae&Mt$taH`qdby~O0{HEswJaREg6++$?VLij7hx|W+RzVsg|ZxswJaREg6++$+DT{ zFjJYinNg{hHmFofMx|OZD%FzBVMe7|>XkApXGW!3ntGTmX10`>k68_~mCRN#Tg_|@ zv$f3DFAxc4pN3Nmo*sjbxU}EQ47lvkA;=lNq&)GAwhL6*DVkR?e)FnTOe8W^SZk5pWwoW20HX9H1B|1 zmI6MY2B1}zCjlBu{aVBGxYGLj27pT2CV)y9l`Se&+khaj6QI(w51 zttpi$eJN!rO(``g9VrDV?I_ij0zRMySP77t49HebvKZEjXO_S$ky#S6WM+0|!3UAX)n@FDOC@HgNy;0xdca0>Vah>F4}3%CS)1kegNfH43)%lj_J`;WqX z8t?xccpCT>@EhQ_z>C1k!0&-Z;0<68@JC=j@ZZ3nfxiMD03QQwz~6z-fqwxffv*8N zkF*;Q3($ve=o5?=0sR2_R^t%h5?};yCEx(Y09gQiR?P|I0xlpAm;u}X+ziYH<^m-^ z8L$Aj1MmV%fO~-DKrIje>Vb!Vhk-|d$ASB87-a(VJ@B6Zj{uJWPXJE=&j8N?&jBw0 z^iA+rfY*TSz%F1f@Fs8ocpG>Zcn|mx_yqVH@EPz0Z~{05d;`#Xb=`qDpf_*<&==?r z3<8D%mjXB}*)j@91I7a5fl0t*U@CA8Fb%j4xDogva4Rqmm=D|zQ~*`Loxokdy}*6I z{lEjjgTPOKM}WtGCxEAbXMksc=YSW0t-ve5YruA37qAz26F3084ZI7y2Yd*80{jj5 z4EO>#0h|K90cdAkcOVYv4O{^91^NSnfT6&pz~#UwAPpD`j0YwGlYyzgHNZ6BI^ag& zhrq4CJYYU>J5T{s0e1p-0rvv;0rvx>t^s8KC|L~a#WPD_mdGrLSu!&_v*FBAn2ltX z$}EFfCbJ35vYF*DQ<=G$w*1_yFGwL6;^2dz&N2y2sqh!=SN=E&oWYj-OM*X8?)IUl_{i9^mKT1aZqh!=S zN=E&oWYj-OM*X8?+01g7sm$EW@|hJdo5^ezvpLL)nUyjtXI9C~!)!6LrObTHYM8BL zwu;$mW^0(OWwwsldS)A#ZDh8I*=A;2m^Col#w^HeC$lDI`tJ@8nFalz%;{)mG0ftbB``~5mc%TXnVs2iW+}`@GD~Ha!7P*61ZLUH za+s;i+|2Ts6)>C0Y!=3gSX06N)GdsfUD6?bCjx+0EcA6P& z2-eCUvlwRa%;@B5DVNABiCHo;JG0@;QkacomdY%HSthdy%(9u~Fr(A4Wmw$I@|hJd zo5^ezvpLL)nUyjtXI9C~!)!6LrObTHYM8BLwu;$mW^0(OWwwsldS)A#ZDh8I*=A;2 zm^Col#w^HeC$lDI`tJ@8S?C#6XcWa>N?bHW zIv9V_8UC6M3T~JT=|E;)b+sV)gX3W`q$8F7v>+O{Hfu6Gph4)Sb?PXbIiktX{!LQR z7Q4m#EtP)IwOJE{8OFU?uRdgaONCq{Mef8DOt0eB#A!!X=WXrvs$A12!u?Yls1odbQqe90W-t8dBZ6xI6&5HY>FtFM;j3 zY0Zn>*=2evLaGN~v-XAW6pI;IZBfQC+G9unN*<#fde%@fbdA)Ay5*xE_h6UHgdG`D zo0XmyQ0Skj*)q~NYI`Begs1aB;c^E4djU^Ay}w@!yG+kvNyP#->#cB^QoP>}9>3Q( zj+^34Di*0>&cQ*@wOI@BPww1sI=?KIU8YecDas|Ab*$!c!`oMUWE|Q3p^zY%aF^)` zqs{8UKZXA8hhiOZ?DBNY7VS;6SufM>;ulUn`m{Wm7cIXLLuP+snebTHVQS>*5c}POdvPpieS%bP zz-CRw9fjx7ACC{p@5qqZODv;@XTGMR2wQvcPa1!%+wh6}jtp+ZDk@zSi#@Df41uoA zx)fFl!G5`5!&ZgELr>#KQGK*oa}gMFx%8&XA27Z(vw;Ml5`@ddXmm=d4`8#-!ar#| z@Xw7i<+o;VBc6NFwGZ2(r+lO?0BqLYutK(eax`(&1%i9a{hCi`)P=;Fn>_DP9BExu_@fg2 z(>r0`)+sNm*1xS2W>QvBflua~&AjXkHpTaPsuz`cib_X$=FTfG8Ks4y!n*4eMHFxLDttu%jGql4jKx!_&5Ku*( zI6F3PZgt7n44mS>u()JYSw(Tl;zG~7a&s_>%c?8!X`ix++syj9p6T#RQy#!8{kuGR eV7wJ2)kSkF!?i1mJTeerkqr%>9(GxTaR zK~J}9t<~CEy|uNrwzakO`VzgiO#lhlTLoz=zO+SaD>2og-a=4oe&1(a&N;JtHXQG5 z@9+2dfBt7bdv^Aj?>zJN%*->-%$YOs;_8-~wU>;Vp08eow!hqMzvt)s3rmZN7-rQd zP4g_%wB;)@f3I1sX{q1Zi!_bC_16ylZ7I~W&+@(LK23A;?VO-#$NPTyE=?Qi`^`r* z?O*-|KERl8Dx!lOw0Hkze3BR@9Jjj+xDcEb))b9Ti<`Yu4Vl{@XfyDQtdN+ zLtR>S>i6W^FXuTwK*svpQB+)fj2h(kMkKq}oVB3Z=fWrX^CBLadEA5Z6Sa zRfs4BTHjjL8m*4j*O>Hmk#$wIk-F+wLsX%yt8Qp$Qeky1k%)q+NyoHAR9a2*M#Nx- zs%>g(tf_9b*ibUpSGUwRTCrQChDf6svN;y5iUBsWWVIDq5{ru*i2j)=#FTg_FelmL zX=b>wTvS6$!QP_??@`YL-tr+Gr66#xZNLD-Z`5~-o7Ez(l8x+#{z)<&;tMIG3Rl!C>YYpbJ?s_P?G z?J;h)?uh=YMM#v@ku~*JmqnENXjOAdWW8C*f|d?!scu{osj6vO*K89BLURv?RC15V zhMI<0YyJ8m!degqF1$}gC)L`jB+^EADk9bsSFJ%m8I4#X%yLJ4wDd_0dP6h11JrU& zQ!Oe+5fSbMhSdL3@vD8F8d8xZ)e9YE)w=2pRkhLT)eR_>YD8IYYlqJ0)fnuqM{mfx zeyb={G!0Gb>Km(SY`vX|XkCk*>3R{lS)dXVZP}_AaSB9hf0Jf{su^9OLfC>b0={_Rw*x90ZoySwdk{G zn4yM*UQ1Q(d2Oaa?5aJ72&uPE3>1%yAy9G@Yf7R7J18j*o|fv1j^7%vczl*;3d^nOPsfsJA7BP|=F zP(s#Z;89cESQBX&x)-J{t}(Vw_QA&)ec0HD$sUcJDUsTSO^2aTgmJ1F=`}}P zC0ZHU-Iy!UEs=(z>eZ=Ztn_u!d8R;Rmyj-yDL~oMj|-HY&2fPlJ5U+3EE%+bnpjIq zq%oSIl0|!!EybY`r63$?ECu1DK&3!P09za+T_&H^eM{tqSftgOV(=zwL6By!jnxdz zYW2|79$5!f*?F9nF*Sb%7Ea@Xa+?; z>2;(hPXNMmRm!2ssK}w&)K%9v#9AVxRYoJ)G>oXt(UxhFL+i$MRb1VaK3ou_zeo#* zNTL;J2(YvQQcbk9G+8}6{-HtCL9@6a2Gy^+8IykkAj7qm{>4zORdv^d~x3|^RI#v1EW1Aw}^zSfBh zj?tDTtAIre2*7JLb$Cqm7i~q25K|>oR1_*iE7}67PA!p|2&VGZWP$NvQ>ywV%(ONN z(}c>0Cqc~P@%R;Ul%a8$h%)Ind7_i=My<<@7 z78+^t6W!qGA8Tx_SsSU1VfOA+u^5zLdZlS+ilLMx{J23$d2-WLU3iY=UJ! zm4Wb7LprL^JVMEg7d2jScq602NL0z zI+6&oU9}J-`_RDGXwaxobZl^j6A3f3D}rS7XC5hQKO#(B%MFToK$7bl8mgLN(Hm0Z z;N6Za6=&bn?o{yPK^5^(eAYBow^dvAX2nm|aBANGBvOoOsXo-h)|0X(28vXF7KdfC6lFsr z2TNQ^|1Z2Vj{pLIl`&GsoGOuuk$c04OaS{lKmsyQcHM<*Vls(}{-Su<6&|%`u>0_?N>sAd%c^9>YGn6HYZ^|T8AGSE0ee{P zl`&+d7Gh_Sf>C%iuCIo+(`>arBG@}2&PcRv)rQZ#Qn@SB^JpVfcGdjCNe(DW`!Pj> zW7A|^aK)0oXa!bvt&h|w`4j)smfEW^$5GR@hLMzXagwqcDp2(;tLsi zgjCnrSBf|S4V>881f0`rTWEn;1~to}zBVeK~rQx(A4!>K~(gW=9FdYCJ+?4X9U~2KmAwPn);BE zDwC?D%cQC-VvSH)YSyylOR`F6t#v{yNH|(ZMleB6A=WoG!mFVkcDfXw+Ik3c3e5?J z8I=Q9?0J!4V~vqkET=|H!fNc~nOVZeaFf_v6BU%tz5}&rrrd#grlx5tmTTJTYc%bm zT1~sQUegL&H0{2dG;Knsrrq^rO?%{=- zEbY=uvbC;Iwsz{}+1mG3WNUBLWNUv|o2?Z!W^2pt$=1GmZ?-n=+u2&)L)qGWKgib3 z`3dMAO*;Xf(b{R^GfYeWjMv6%K773Y@=vywt(}O^SclIz&Hl;Ja*!(f=M;^9Mrxns zldGwpEKPnW4V2?E*oSyh8JsRYIogP{52c3E#XqC8|93uA$NY1=G@YthACG4L__W~; zAD=b`WkehaOarl)jJllcjEPQ~9LsQKJybB$*Seg-ZILqQeu3=7sh>UXo@F%S2Ij$q^xa zAD=QLDa+l8k2+W>HiZ2s*xnH?zS8`%yEQW$j8e z%e*VYT1Epf(=lCGSBA1T5)Uzbk~*1#;>8l{U?Y)q!GUH@>1Hn|Y|5;W1v0g`6tf=a zW;#-~`N(i`o;9T1ID=8lroJ$C8DMF)GiFEmZ`#MjJm1vZSj3DWk3F;foENJ@K>MUs zup7eQpV8_l=T52GE@LUC$wRJkxHrfB^9_%DiN&StLT03xXE0StJF8mSk}3mJwGEA6 z)`JwtajoC#8Z$3`X-*%)GH#~M(fG|7I9tz$GGkkla7VewY$;;t=GLdQkjL2y|36so z`=41S>_(FRz6oZnB@}jsYsubijofyxOr6{in2fw+hiFQjor&~RLJw(a;GU)hB30QC z-uCAqILU>{!~PTj50uFYqRc#rbBYn$BH2s$c++%q)G>=nhM*19Lr?wX+&&le$Zq0boyd+D)$HSpd^^nA_!nFt+{fN-Au0r!)w&R;E4a*1qzL+tw|J!`5@o z-pNCKl!9`QY16-Lo4S%S8{H{qq64?@@OOSFBJFVt(nQUe*uxg~UVsQn4RL}Z7(_~W zR)I*$;}`T)mc!FkP7i7+f=S^Vp4`Hatvt!!0IRNv=s%%FLuv z#ee2!Pt4FlEkZA8)>o<@+KIaJCEc9oXcDxk(CH>Z#|OyLp7wEiK1eAW0F+X}|CA?= zl<@)HDMAH`B2)Np-)5d-Tcy8h2kkHilF!?vJz7W2&G8|;w8!;Q#xQHMvAxgYlLF{c z_C4~L37Zw^2(Z_*Bfy@04iNK_s^jb|9BNyhWMQA!s?0z8j#k(EPyhK_Uyr+^)x}0l zJ4Chhs|Dj?Bc{?M)X=2<$inAsJza#PKVcnqB1&(ip{cRhHz%k*$J>s|rnjjRTa^Wa z2&F1Twq?>tF>j}h_(3IFrE<^9&cQkwPx{(})YV#74-sVjoW(2Al>Jgw+sCdLDy_-t` zX5Ph~0?gQyC651QC_(O-`N=OQlbl+D4sBP)Ozm;#2k8jm{?Q1B1}vj;^K@5wBbT8+ z%Tsr(H9I!~$xb#av8_dz2rT=bT7VKgbR#r*5BcaJe~3`%L=GEk)R={BB!g&Vu$-tY zM4#a9i8%rO3{SbqAySTjik03mB_?x48+U?!=EoVGA106$!!swFt&7LZsNStQ&rk`X zKXvnfqZ8C=Tvih-x{nO$&G;y5hDX5c8^)li)+xJdcqODk(wn7Rwc@QTrDRl3_s<1j z^SpiQzg!0siBcX`$PgnhIK-I#B*Re8s#?l#3SY}ZFG`4*m_zrSf=CyI6u=OfO&_I2ST+hdK4B~X z8DmX-tTNLEAlv2@4pDL{Np5!>rEe$VhsmHd*eg>Kt;ZEOg|dtFPE*!6)$vFf3=q8e zr-1DR!h?fSWPxapZpsW#p46cTi%E1kssrh?I1Y6n3Dtt~P>W?5!3;h$Lp-C`%Z}J;@Gwi$hBlq)Z!_kFz~FV+ShO(sXU8t;eo*`6|M}PaDd- zrX(U3I+Fbn9>phR=|=Ih53Od~azI#`sN$JvrA7hqAwuZCsf%9N(9ttBReYs zbz8Uc$Xv!vwMw@;#J<@fciLKuf@Z?4)0EU0%(IuA4p~au-zPN=-g9DL&hVsz%U!*4 zn*uZ z6t?J@LZfxM6cSU8QfRc!m_ic5ok%JC1(UE)*E) z!TFUb@tzD%-3d2ymJF8pH`k|q=soMBhYbEudcdw<&JYe zJqzC)9!p>ak0+nS6EHAgqHLq;Kw>I5EDwupve)Dz{o zdgqbo7~Sa6jgNxHVHR|knuvTPB7kI^XC`AcTxVMe(v3gs#`Ah&<*C!VD#QiVTw824O82)i~=Qmy#GL=N*lm`{e zG)!nBg7PW&tns8M4)FUFUnY44il1_*t2p@72}aYfX$=kQ*U{sZI6GmDBQrT$cj6%C z>`q=OwgB1?pv=5&I|Q79TN8gLUpCnvHND6_`nebj%SuYEv2YA4+|8(;siK%!Ov0V% z=YL}?9E->+AQQ{ETrgqeV@S~qd%8};pDKZobcRbAlL)uL30LG-#v~HSuQ=iSvx+2t z`X$_t9dU)qs7@uk2e`B`c&5S*&nfUR_-}$IHF+^+mcnUXggXYz2;Qb_v%B~ZAN(MUhzH*#_^Eemv*wo8=*m!(8bLHVq4^Vl~d!kC2Yy9bF=1;P>G^%a2 zBP9wtHk-ytf}vu#sQmYaOKM*fNB3F%6NVZtX@I1Q50})6=o%h>qTd=Wgzw~uds$oIT%^PwK(E6R*I<4XI4HF~d!b<|!#fM87>ipb^x}2vpa~tR^fee z^jHKK?WwqJ^jLjxyI!_8_Rh*37r>92Z;nPd?$SJ2**U|8kH{T4>V(lJj`8}&o^Q%JHL9@-Cw)s>)*KdoA=%SZ{K?0+uwQcyAOTu`w#!%hd+Ac$3J=Wr$2k_ z-yeVC$)~!We&#=({rN9`+1;~!$Ij<=_3qyD{ICA=*Dt)dci&6M<0Lkk530#dqZi^MWUw; zs6_c!4!R`#6vsD{Yg>mJbV+-mix0Zg6iC9ie)E@JYtWSnyEW*_!HEyLEFy$@^x0J} zTZ3*TD0DFlbIHM(54wybZoCt5==vk;Frl)LLv`ZJbjzTh$6f91$Y zhugoTk5tWj8Xl+DCZNWDB>FY_VSQhzI%go&lHOfpzZlLxQ?c98ADVxhDD-!epTA5o z7?QRy5tyLBk*IQhYUfNH3m)UwXx>PdiBo1insz_@ZUg3XC}XV7+%aDEq^J^FesM2r=?`EdUl_ zJ%@&iUVU**&epJJ_a%YBgZf~%Zj9|;^32@9!NEyB@ALQv^IuN?C3^36qUn<`!FiEQ zS9bA{g-m~kb;Ao-ZvS}iQ@*Wl&V_xWu4j9$_o$Sh0`en<)zM8{wV@|8t5XCvjv){2BHL)vUn)L z@sH+i8LlVid-~VwTR$3{t7&cL2yP%RAI`bSEO?(hwf*_>{)Ge`9Gu&B7A2MElv1j| z+WQM^#W4V818R9NX5F`)ilQ$?xy&(>S!=qYaPd0$qDhmr!RsM@to-J4SdR6r$Fy?1 zUu~Sfo1Bm??^nC^WKJig%(9{CJ;$>2WWcj>2Q|kH_|C)kDtzgpuA0tlkS?k}PNSIt zciDR`l7)Zuuy!Wmpo>zK?VZ4h0iy|ANE5OluOzikf;N66Bp;xDF5PjDAjy*dZ{n8s#?7<8le*~#LKjx z(aaK)IHA`ZSEDJO;kPszYEd|;2ZH5iuK$Y~%}kjBo{(|)xr>X3NSPSnRYibVRUdZ3 z75imVVBu*pwiCG51eRJL*HqFqhCe&;D=L|IPu)r086@g{; zwcb#|PmzVD9QGf<#JY99ZtRCP7fMw7LWzxeSY-|w9|Vm9T)V*>JwH6x5y;CX=dVN`5-(@ICkj8qvlR=pbpRq(@8l#ne6==&kA6hB?__zy6tqbt`Mqz(9EBM3{03?)Zb zYr=f7@Zwqn^(jOszwS$=mez2oiIH(_5V3QuL5{9J)=vGVr8R6eF*4Mp{nR_Yk;5aTrAZuWz(bT zNdeg|L6vNUvG0gfF%*;?`;|@>hkd1c@NNI;bau#BI+@NPOQ$mRZ3vSPB`kFhI2r$K z7JO+vA}AwE0^y`Ne$@0bu_?^8t~HAvh?q~i$Vdh?Z7;g13z_Txrmm$9#q~%Jt(?o% zX%av-wig#FN&xkePXV`I=sgxrQMEL@L|ps5z`)5auJe=@%K!9xDZb;KbPrXfV7kXu zPB?#wk`XH5o1Jh)MM?q*_eCdMnF7=Df&01>&R?XI3ylL^PB^Tvz{|W|f$K%!9v1o$ z{jhQ=@+&seqc=!f*j~WuLi8-!Am)7(e_!G1g)tnf0I@M_t6KjA zy_ZHVm^iM@4H@e(vTx2~iq`ym*c*g)0V~FIV9vwWrafU3*omZIC4#wJ!{Roe$to(b z6e><2KRCEsPhL70n%E6RDIb){!NG1UNrb$YZim`7S@%8)g(2IfR$%3xh13&ECkK;( z!BE-ru@l2d-4mP$Z7G=FpBqYE=7DQ+$g^FaxHp{x(^L{m^Jz5$(E~#2%V2P_rQW3c zGnU%@vJsS&9Ue9i-S{o!rn(w2EzP? zkcoNFN#~(h7v>?r8qU}| z*V6J9Qlz*nEpHl6h_DS&|3!qoM>ZE*T3(5Xkt2BlF~P;PJnGHpdhSQYIhK|uwF1jF z^f-s%6jdq>>f7j=`pvd=mX`MnCjukm5?z7Vx;IJq&p)wguBGKkJv7%0C3Ufp!1I-U z3b^VA+nOvb56A1W%d!ov zP`}}U*n*`hhdhtYnpaTpp}<*;!wM_BL&2e&+Lc8N4Yy?D@PQcRN}y=%$D1oLRZlzGQCFG%&G$V!Ge27`u*Z z>zXOII+FfHGNozj(5R^gql+b$J2T$@HLG{Cl=$-Tk5=#O7uT0mg@pRAi-EgRU`bp# z&aY@pGzY|C+FF^=Nlcu&A(3r4o9CprsEd5sZt$bkJNw1sRT-XzIM0wBngBDLk~)n& zWl+Wx5sM?|m%bx0?1WR*KDNo?YA0OE(+E~j22GB+O5+Hs#y&hYU&( zjTb^yB5RQS`2x1%{{<)ld3s{Fp19Vhm%Y+fqI>q}@nggOgUU+x&U-~qEP{TM!{+7K zyvX`s+Pu*OMGb}(9?-b>fNq?vC+EQeHQ(nS)H`2`US3x>O>XK4C0hr>#?j!uzp10mxg!Wg5$@wAZfaWMX=r|p;h!+y!^OtgW8 z9%Am2A+z#&1jYU4>KC9)% zz%Qx1EB#0Ouj$4g@31A3CmT;i42F}NvqG~s`&v(B-l4B@-oMgE!(1paW^tmTXCQ3k z^n?<_!->(|K?8zCnaK(!a-g_l8!eRB?MRZInA_RSH!jJNq+;~O_oFbVd{M5B`4QrW zdivP09uJuL{a7#i*xM1O!ew>IL=|<38nlaQvg8b;U?nnuy8I)n%dhk=(K`pD3$2Er zC#wd7#vg+F-V?mg5DxR0KF7=YFi8p;!r_onL>M6{#!)@~F&aX;bU^B9g0vCu44~&$ zOoKEg47Pv00cPp>-+!*<43r05)SqN~@^Po@jL7-BE#-J3C)$+boq}SSK&f0+<@k9M zBUQ8(L81OO+e1SQg?j9+d0)4bV`=cTlw)0l;>s~Mh+*OBx&<>V<#>^ak#VgQlwAB~ zduSMyivCYiVJC8u}X%0;n zOA2>py#H(TPQ_ft)=r)E&RNQuBk7%`key|sDN%!G`r0hjUUmcM*9wfxn3Mi@Ef~BA z+*Hx#CiUt3I?Uz0_a3-f1k&6}qR;J8grCJDpQqfrKfF z#;RyJY=c;Q3>q(ZpA6=41thTl?ZC6t0r#I!cSkV3GcP#!Vsw0vDTw*>tY<$=h=co~ z_`GTCvP?r_&C%4A0?TET@Zb(^7z0MvZ-e{Rcy3-Rq~5;p-GK(g}+e zG>cAJ#_B)i84?FO`E~Yx0K1h})p%&o53+*tE^j03kb5Jn&VwL$B63&oOsZ|&~``-+7<>4<@!4Khwo@4fQ z%mF~hQ_k_tP+mI5;h*=(MR{!B+5UsNQF*wl9MC`)l^`Vz^`uYP4Ud7q(Y=0X>#;-q zMKqt6aQuZkV=c05XPlUfCOa&#~R^%!OJQuKF_ ziQS=uo*TyA#x7Z(uu?+X3l9YM|7~G1XN#V^ctEViYnT)S;96Xwq>h3P0Gpohro= zRtR43va)5b*uw~kidR?=@1o>{S1J={1P8Z=%U*4H$uAXEnvWWP4kfPg zF{xyQ@DUOmG z@5IA;a$Grx`_Nlm8BUJgS4WpMr!}6hOpL5VujCI5?x`?Fh445zRsnpp4PmTju)AX7 z-e3ZA=LzMD!2L4D9aERsuKsL1vK~%ci8YRWx=_r6gTD$JSEAveCPfcx+xW^V?L16g zy-zO9lMU$wV_%S(37(?1riP}M3)6lekeMCzLmB{$<})wj10}z*CIH{!M4NS7nzr}^ zfHVgRn0>>rJFN-8MIsbEsYmJ8v|9v)PXO%G25SN!)qQIMAg4N?Z33`I#6>?m_V*PE z?A$of$s!H41CyP6!=O3Hrm9lYDfr^FNhc4yZXuoQG%X-L?A(4QZJ#{Fxozp(*l}*@ zWXA~rF-lYT86lm4`qBXG2&m!DBu@9wuulb!`@~&oS*fsJ)4X6JE5|>L$NGjSd=|4+ z5st2Z&AgyUiZP3G3GNr8Q}_~f47f;YxISH~tYI`|Hn`FDZ2U33`KBXhl5jhC2DL&L15#)->}*RR^kY3I`Q z0>gl~@${*CFaHF3J8(7BY;jSa#&JsVY1=_h02Ai(a;yAil_~R<;mAidFl*S5!h0Uh zuT+_+%|*h01mq(<3XG((aw(am$mt|_E^@*Zt4BT%V%Wh_jxB=aiJoA#4qWDo2j1SMEt(vgqxur`Opj8?}7U+ z`ZT&A-n@OxP}@;H=-UMbPIk4^2@HeP6C`Y!8$AKkQ!1xC(Gfy9W6v(- zgNHSzjGe%gd!fA1mKW0ED2i41=4d6jS2GvW<=Iod{Bb6EN|Y5(>nj1DUYT z2FnnY1N~WSYF9`~CRt`zF^06K#>P5z-6TW@M2X3IC{ej8oZRRQ#^1&q^dr6J&0(P_ zAK`?m^YEN7Kl}-Hf`E7I{PJM${3T!vUH;lDgU04n_`jC_U*8-yHg8Z&+2!zAjjv5x zW!8oG#&Yz{_H8{i7D}Cd@@KBX#;&08TehcpV>!*S$A*mXKp?)wceb~ap3UfAjQr?{ zsttN_u~{+RjzWwiL8F%^euU0+ORD6cu>e~A7MLrxEWuX~8t>Z}5)8$Rl3-OFGJ26VIx0J<+xylx!*u8GTX~yd8buZ$%mGUErh93|nZh&&T`d0wi!8 z9>m7kUx@|H!Q|q65k(cY)+}fyj)6o)0SE62CdcIv7899SkT{MF8@03YSmG1w4)=SN z*-K(JPj}cjJb1+_BpgLFPV;u&h9m?M3w*({o!$;wnbH#rHo&g2GnkwJ>D`eROjL}> zi*N9q9s3W-;UG&HSxYWK4)o+g%)LJtyy8ks7Vinhdtt`eiJA184GWVK&I^0q1_=NZ z8pn7$nlMeHJaHmp)^{~%l}JapY-j5^RvN}34RjjX`;5J}V*ye~uwb&H084vUY(U9v zM#lNX+H5bVFgRkdWpv-c)p;{TDA+US3Fy@T(jM8Wpqh0)q>%;cCHJe|Na^ zU2jK()zu~~Y;1ywAmZy=#s~+3JqL#cryRg@?U<9p=5tIGMQnB`0d(h}xAO=8fVt&D zv_y_QoQCyw97Lf*G(yIkEI5;)z7L3)hz#_94yFZJ`mE}C0W)YQF`HFf>}o2703?T3 zS9dTGLN#qfHSM$sDAm!utcI(6R5OFWLU~nf2zfs4e@M*0-;Lg^$G4!>tVmtfai z|EfTu%?BJrm`S2qVob=C(u&RwBo_My_XG`IUO^-5!;UXm9-~nnePd9)IzLjt{}KTK zf^BO#mS1<4D%K1g$z6qSj&>*RS25Rr;J%8v{*HSsb4^5raMzdNqFHB-_PR+U8*zlu z$WqL4_rg`pXuC|;D{$2@S`L~o#}&iH`E4_4y>MN_aHeGi=gP%zM7fQ^xpGS?FxT!M zC31-46KJs+N6m$da;(aojex0v(M{pG444mA?np7KNh2ouHSC?l&b%aQZv%Q1-qsTHninQVUx)@Jw&sC=jef-YFso-ccB8Mt^S`YBDKU|D6P0RB zq!EW#Wj$QHV!jC%FYxC~7q{su#}(pCi(q0yZUr^^_<*ZEK;J+G3WJyNyO8lbYfyuW(d-wl4dYP5 zS=gx>f|)t7!bh>uxfQ2{5+lOs*6=hB)g?^hQ!bj}ptpmh5{E#tYJZWpaz71ZS+Vnji3QXLdt>>my^Ai{ z8$-HiFoM9b%s?7A0gv>cm#1b)I|bOt6Eb4Z5LRma#dk=I475{EtmMPmn=)Xi0G7Q*|sKj8=0Vn!|4PiVt1R+?QsP*Or63YtEia+wU{XCp(%0r(I!Pt=(q7AcUd%W>4 zqZq=*b`<`;g^B1XFq*FL1>zt1S~kv4UU*Vq@VUUgcLP&?i;CNeetaDD^o2 zg_2heBBBFG*qLU+ytjOblI;2Y{A3Bzw=1yky}*>;g_AcIfDLiQ;5!iAjBtPsyBFu2DJO zvH*XuBe-ua{U#P~(6M(Hb%0`E4H2@-N8ocI%1oxB8+pGDL*V?>eK^#U3 zrEQoW>k=>eyMx9hQ1j5KV>5SZr;eVXpW4E?_~vLdB5~KnW`|v8y0*c^+s#4KH3m(C z_Z6hKao3mN;=St6;o>12yHco#{INIIm7>FhmH)Ct^rAeReu}*J==8`vb)1RX6Y|iN zu>Q^SKGkqAxvU_slBA9#iir@DK@Ya!By#XPK5c1_jzo8Zo}jRQRH$st5^u*N$e+;u z7wTSx*Z;Nr!6mRVV5*XFd->Rd=}nlrQV zLfGi7Q?fD;82sJ;t67l?qxtOQUv@kcfBti0IXW)t?3b?UKl=_65_CRC|6c>#v zd^BJ+6HbgCu|lX<1B1W8jPpb`etyLML?7Y&Sf3R8R{tYh4tF8I z`-nyk;Cv~!4|Sl;#+S?9PfeGpYb63}ZR^l%l87t?%CVfXmIAZ2YHaM|qqCeolF?%g zzP3rGRN62*zD(~QA;d{&Yi4*hSGGw7+i8fkWY*Tvz}O?VwB*UoLxv)kD5rL3J&9{= z(&DER2Xkp2zA-m-&(=tgXOHsUDc8pkt^&(SVTkX!G;W0xINh0xTd3^P+*U6g*OI+- zL$ItT_Fl-?jb$HO&`<)?{ZN^wbv#cSPCYKe)bi5Z=$xSjd{shM*rK_JM*}5>33aIK z^SP~)LWwV+e{0SSmVFrXUix9M?1L72%&#J5T5;;e&8nh*ZeDOWG%uTP$yD1C?Nm0K z?J2a%Mmb_zSWXgG!5Cp#PomhOi36?CJwPgOy!D>w`S8YHPycyn0hy+J(aX`n%-74> zmPD__+1R;>MdJ*89LA4*eTMFXmNVsfV}(yo>X^STCT(D!?t$QM&#Qp6U<|^zBM;P( zT@oE+jRjwtwbf(7)cwSLcoh@nWw=)}7p(yC76ZqS*EM!?KKgDgn{MXC z|NJu-0S^k^Irz=?kXZ;rw07#`F|SyQfPXPDaw+O*K^cbMY!8|ADb$@+`J1dqWPWL4 zWGK?s=o*f1wr3;ml%M;1v;S@_0@75HE^85R7AACbjlkDhaD3}lVH}CJ` z%}{X@BSZbCD4#qQO18GS+qd1AXNG#o#K=%&o1^PAeEFe9^zXiLy`MkL4D|&QBSSqX z_?*r{(ZUB^S6}hBgQuIJeqdr`s8a=>Gk{g|b%q&gf{Br#t`K~v8_)LG^EJT?wbI1M zP$hy78KbPYo*p@6#F=KOi%g6Rb+h0@XPa4ZUHiQ6jkC;9x0o0isz6Z4R+a7Pr8~Z5 z>&Cr)wi)Vt6O%9c4KlOQm5*<>hwk#qXQ3MLRyKO^I#KiSK`hTKa=@psZ_JPtzKH@lf;m45?Sx$)5zX6n$C~!D5zSCgPxp%;bqm0 zY1Hq(o(e=uQ9DPBOBse49bS%-Wc*w_QsesW7{BO zm0x31t$gs4i0dLPYa&%PqAX4Fv?bA@ydsUYIMK{MQ#r`mzQu;S`CY!NsdPrEI0KD# z)tt+^jAbyJd`EObtXf1zlj-MQva7~lq?~C+eQwS)C|+cj$3@BvTfN5_vojfm-vH6- z1xAt?uDH0wjtj!`9w(fCrt-2TQU(q>;$|q@?dJn`6u3F0+2EosnD3@2QeIH;5a>&R zIU;aoK1zy}qtx1g`vP>US4qFZMG7b5S0o6Giumw5nk@LXicsDRV6gVp%vkL9yayf91 z12f`cIB;3%D-=27^mbI#8Nhs#DjF9hlf|2I7H%6D{8ooCbs>W>^?|3aq+|vsvHMiq zuLI^Dfiu&GcaPcA7lOyPfq6HS!p~ngQxp~Rpu?z72&0birAy|+ehw(n+re+8z|eoX z$~8K_eWu@DzekbZ-!Ia%-(1Bp=irCeN11Xe@>`%!z8W%k4ab@FQ8H7JE6VTrz+544 zW`0WwmFJOXv)p& zqqs~oK}ILl^T(^OQw(3atn|&CVXu#s@cZp5ybrFLP*yolpE*-VIHwcu`M|6fIFsLu z!eVv+65 z_+k0=mno0e6Td42h9hOY6)JN7MR+y>Hz2UXB){SrN=BMNKYtB&Z{kar8E^3nr9S4u zZ#ys^W<<8heQ{~AT>$CS%(H=+d_7}l$vsZ?wAb6;fvW}PswR#jgAZ>XGfM3ImV^H9 z0>hC4SE@8$cA9c7WyW@Kc_~x+zegZQ?Z92w%7G{2hnKTo*%n7#)jPn)%` z?ziB+5|}>n}*qhrqnj#siPV56^F*a#rZ$pvPe&o3)YSOn${BMRtDF z4=n`dVSzK{s%Yj6d;juz#QQ2R7v9AAjlmC(cb3vVP653Om|qK=RenW&dw%ajLA(r1 z>y{LLCB;g)oDc6oV5YQloS6@QQCSHmvHN!1=d=ThFI}eGm#9a^-VML=wrbk5_|lb& zFUtqiE1{||`bDq@j=lwb@9pd_JDHc^l-?A20lW+EK-u6+msx)PGG%-73iyrw3WJz8 z#;>GQIbP)3@LdgD_MIFy96tMgFY9SCj`zcmy$AN`{skd?E$9YtDK)zE~WfE zf1Ip6fZw}-DY+{JH^Z;AkB8xX4KO)WkhskJ&M2H^uiqs6W&*QA;7qwkw^77G^4rB=DT|B>~O8HS2`H2&b z-s)lt+Ya~jKft((FI{H+`b(8|NowE8B&@cJ%hjw>dw=i<{HuUF;YS>3)*E&$+xto4 zHwBoOz?tp5xJZ$|@4{mXFq3}F`I+e}DpA^R1H2ak^OV4u{E7-oi+NCX{~PW-!2I+l zoM`czshpSdMKCx3%<7+};?(*m2kwi&JpVI}I{`neT+qGP`0C<$h9gCO{Yv#}l&ouk8~Y?jndMwksBFV8Llxv#uD73YKJDF-Ej|CalFX}C%7 z`kYIg?h<#s3mmnZ+g;$OT)*NHcehL2H(cWGcZvJ93mnPiLoRVYbb*6dX^*e4f zA1-k{E^s3>%s*V>UT}%~txMeNE^&WyiF?N-?tK@yTn%#+mpJVWfNhsk`z3z4E^s4( z^SQ*G<`Q>~3*0Egdx1;b441gME^$GZxXWGQR=U8AMt;}0z?}$Ot4mzFOI*?=?p~L; z@4LW_K|UULf%5{l-6d|HOWZ-1xWBo;(Rlf(OWc?@0k&OE?UMMN> zm$*t7II@ebc7e+WuH6NW^z;W@;5@+n$OVq{jYnMIvVeQc1&;K($6ervUzZEqIN+Xf zfunxt1s6EdUw-cbM|#~`E^&P>a3_J^doFO)?`m(+&AOcAlyGBQ;3yvxT;NELnCJpW zddc}Na3rTiE^x$ej!Rsn3mnyN*aa>JxMePIRDM^wz)?O{y1)^?hznc}aM!uOQM`>V za1`%)7dYw>RPrVAX&!C@CT8ZVEyz)`#>{~0&i<i3IE^su?T;>8t z^O=wf9M#7P7dRS^>RjNc-;KG%ZFYepJ?vH&IMPoaaDmGP?q@D=!+?9-1&;K|r(NJE zeS2Nt&H?TX7dWcl?7!ez!;y1>zRdFtD^ z*)AvfqjEXR1&;dD=`L_Nz|C=q3%JBpy2J%t;=(R*OI_lYyTo1P61UO?j>d&*7r2SQ z-QWT@9Jo7O;7Fdo?gB^S^!+YyBrngnz>z)T7cOul_xoJnXrBCv3mmPR9(92uey1M7 z&2~ApH!8mp7dXmCnF}1%Tfha5+V27vIMNfByTH+!(>fP88b2O%fg`=?CoXU_4*t|7 z?im+28fSL8z~ut>YZo};_gfdZ5y1Vy1&-_ye|CYRagZNC0Ef7op+3=YAiZwP8JA z9nGVMq1)bz;Q);<_`XlEGBs#0;(6M^U*0)>}A)V0}r0Z1#t1Se;zKL&ed@7bgnaLmaGJHy=*%k z$=|M*1(rn5X*Z~4dGxZad-1y-rwTC#P7+uGC$&A>6ZXc^E9F1=er=`p@mM+427epo zh9Qb75h&GX2bOrZ(HnnBh7ubgB;O!8lDQA|?xOAh2OfC!#C*W#FKIiw?_=ahB0`B~ zpY-x>djmc=tfaX=s2-Y)qnPk+NP4)wcOGdkTDn}Z6C{L)@tC~Z?qtXnll8&p<%x+p z$>cmxaKgdiXjD&R6Du6R;M23|nEyqk`q2Zr2WLZdAH+c)=tB8xDiiYx;|J&V90WWx zyctjTdpkBzM_2ZWw__z7N_usi4?!=;BGl(OD%MYjN%hU3e|9ODfh5wS%sJW>aPi{4 z2QDtb-!ff4go{f?FI-$&2I0EVsv!0JNc2~tG{#Vb;*2YrT5{GTe%xg?1bMF1*1tXs zPd)iaK|B5SR1(Y|plj{Q58`UboRo{pPBGhWV5$_pkcmjq{5mU?fY zb{9C($)q#7DVXRa`3xsINhI;^gw_j!i7>i@P(gm+X&QXciXO`k8r>}Abbi5)AzA_t zu7Fl3P!rb)T%i3Sis;i|FN+3=97K#1RnVwhq9>ksfMQ78eFuKPY!%)JfCB)N)W6|i z|3i!yPBf(BIW7z*o+zcH;<%<#dD;@rCK)H){LK@g+0DL|)5D3_mEc3eDdSP;9}Jf5 z3V847)jN-PJ9Z#C9O#InnV$GMb4Do3mFPrN z5}3w$Il;^#(C%>otm?yT#^yJ|W;58HIgz$oi%7ek={Y*1UZt4yt*BwBUU`HKs`9wI< z^dJy@lp2<-{u~PZOukyO(H6WTqt3g&`$O**l=uepZ6smya2Qmhc{~_I9Y?`oZ1-Sn z8W_gkSK^(wSC$w={$xG58InPXV6h>{Idl>eNgGCbPBaepW#d3Gegfq&oYWXJjz}K5 z0S#yqPA^%P-@4o^r(=Ry>{2;$>L{ny67wG~m~K=)-sFOE!4YMwiG`At-9j6srtl?- zESY43PJ9PWTal^scHTfIMn-X?sQX?=`obupbMej5NGqJjT+f=WT-57LXe&8d0bIOO zE`*DB%Jk6J&CHixeOJoDz5>@A<~k9A#zWAv?3@;ZYZD9cUAVaZ`WRdW3qhxiacz`d zKE9dZ{tQ<$a}C19JNZ%g&pZCp;o>U6=S&)PQapW&;o>Q{+N6;W_k9>HIt?R7BUQVd zxn9Jbr|&3STN!OUY&Ewq*ZFY8nG5eD7Ad$It`0_PgNw%&hl|JY71Q+uT%8O@FNfz` z*eIhMKa6+ry}+aZqwW&YeHWFsY&pUv37+VBJ;7!Zp~SWW;6#H3-ef_#W2V6(Hcw!g zKsyf%GGeqV>PzLbeW3S)*c!?_(4%L$>8E+ zWmV|c{59sk(-TjZA}@M;m#J2uHRbyE^h5RUA174}J)zT7pzKBT8l;KQ4Cp*C=jA;c zE?(Zp8MpCD8oWg(52NxSoNJuud>8?Z%F%kF^8vW1rwJtX8w&vo zh!+2NwfEMC&`v_eA-(5djyx(Wk%P8c=@Y2_#$+Pzlfl9Gv0U%1Cj$LU4{qKEpZCT| z$-&{l1$nv$6T)tESBsa>J9zY-zAT*Th6Aa-w%u4>5dXNw8$S%Jb39#??)avHEN{nk zP&6>w90(bk_J)(O`_%w=8DlP;G_3P84*SPjuWkX^2ld|DaV9tf%5X6BI5>idwgJ47 z=SV0~(OVdvjfBR2M`wMW4q`7QIEa%i(YNbd9Yc@$lpg;S=XAb^rhz^gU4J>Gn&~xU z=)(}U_c5G;$Oo~$crMC27svc<{g?#T`_&#%WF0-;j&O@Ab(>G|)>-a!3c^M6*#|7`rPtUpBl zm^4Ttl6dP`(ch7j zt-{G*<^hcfNM@*@T)#li*UOIKHM-ty2T2?f=n@jpSJL2gXjuYh)3O)cLaRxRLz&T` z*>B+VGA1sa-Ox6@9dy6&JR)W70^3YBidX{ z*Eac3h`)yDbTI9dGTcd49LjKr3InHaQi7V6xte z=Exc&&t~AK){Nu>$SzJ|!%P=1_@bsArq0PMh5giuk~y!*el9tV4hB7pw_uec@4G5< zFu%ny?8qSEuN0@WB8zxk80Uekks5%U-3C@98idYteJ$`*IMY}P zGuJmSVbt_625c(~CdL&|{XyEphjB)~1ayujfKtOY-;TA^02ATE;^aNl)$5?(rC$Yk z`VJ} z?}B|n17{J_EJvYV%IW2kd0n9XoaTJY;0}a6iY1f#u7YA7-!vLM94sha6iEu?f07E8 z{XU(V2un4J0PkxPZQ;`0K{})nU7}eKLE{4|i}48Hw&m>O^2yszPiwJFP|JB+vZ}`t z*RZjVr|l6`27+WmwlNu#T@Hj!k?U>vkF&Oq-)oRC@;X1_?dJU89HhjDR+cY9rX$lfnvXT>Xi%ER!kz~nybTu*F(FrSnFH4iEZ)U%@e+C%uGNh8m`VGs={jSi^qmhE5Bn5cJXOCpU7x_k zb2$Plw>&LA(^Ui)%`$SdwWcd=<`VzwWO20ci)gBWpQEm{z~dg$qt6K?f_kv04=?BJ z4voY+Pv7_ys!)Cuf(ko8@aX&fXTc^9a}Evmm|G2QX}!7cCvaAff8gl*q2!Go(w~m* z4SBjlQ+fm5J8|Usr33obk3I#g^+YS+y#5XP*6mqPo>@-~L^}{Ilkjp=j`Ewp6B$$RTzBv7!;iH z-1-gj4-OX(dHR@fcq_WH;h^9WVYjXU zn?UZTlrCdYp0(OyzKoWN?2D|4(uzfbxuEH5Ut%sksgM5^nq5OdA&x$lnh=^UdgXnO zacdh{2v+Wx1ll}&b2NTd{4%~g%jf%8nl*4f_6vbuAVvIzqkpM1js}jt9C#MdA$yR+ zftK?E&oVKY(+*n8X($l3a@f-c+1SZT40&vOPl`cs%FgvM`3Gpcp(8~meoV~Cvi;AI zi$h?iVZwSg>d|>NCL&=0)J*&C_KMrGAcUy? z?Xvp*gh7~9AADpLu{U0bcQMx?K3+kzh{r4Fb+~L5q%Lx(mJ~YbnJsnfFiVN7h@3=A zhunfP9WHJ`p_d-EO|5B()J7Vk_0e@(k zZKNf|pD>XP%}uQlXa5NNC4+U5=-MXEl;Y(4tpCirR>Vqxrk46O^;26THL(^PyeO{L zXiI%fbZQi*=Cw9AwL~R%=^txe(}HwPrI%JBU?eITY@FKM)KFhT8ADD@D*F@N*c_SK z)EupEYTUrGP6$qv_}Y3z*IEyVjEVn7>(|vcu0c7ODNgaHgw{n`rbZfTnriDC>+7bj z!*5-Eq;_g+ePhjX9L9~Q*r#~!$64N6e}VBqr(qO7HRJBUTO%$Re6xL{C*tjV5MEvH zp_#UqMZFy-qY?Gp0TR8BI6kn^+wmuaiVw7UJ8uN_LvNGkL+|FGug)7iu^Zg*J8Uoe zeXXa?`*Qc3K^T?1or{R+7eHUR1B@n6_>NyQMz!8fzsaa6IGPx(5{wGd84V*wQzRpA ze4x?W@f2gU#@l%aqodv>OHwcP=+DUF(2JLjKqu_&+zCwA491{+Jj z?C@jR@UdSd8@EzmS}wkh~F_M=V22M}N@q0qis ziapQJp_;`@vq`e9BXURv&W#VC`TU)QY4CPD&KwZ-3ZV3^x~7)4>XzDwUIzQFp8^JD zK)h>Yjkm)uBO3=#st^)}W;8}yqdEo!w(ByHlao++hd>~#_o)CHWaDlMLvsVFM_OH} z^S%b!%RRhNc3g&>rNYYvd`TL-^NSSSRWg}5@qx8?Zwf|LRwnD&qY`$^m#-QR-bdakXLN)Y@va2}BGF)%#J_EFUH=^F`FB zZuEBE1A=S~!>JSx!jnq%F#A>dhU+PCsR(=u+VmG}frn9GjhF2(A1_;b|2T~TUn>Hi zfxu+Fuz?Kqcs1av;^8kwa&l?rq#oH&l8<54erQcPVi@rJZww$7}l_ z5!*#K{e4J8*Cdt<9=Yh*AK>s|KV`p4wxbk;rh~N6g$4uBhnI^WOVWb`D9Cv%i2h7- zOVfsp7z_2{v6P3#NDYR*P$DoQh*w~Y-0ST)9ccZT4O2HjTWD?}*syHRa7`}`phMs5 z?feierE4|gMhT$WS;Y$29DMc>;;*=^+_AOnqUP$TxAPZ7LO%miS3^@xHCl2t;uS5K zHpO)<<_YY&2q}ySP z1;-6jdGlvoGW7zrAede9B!X56sOY^Ty!RGEy9pgY#dn=yac!wy7n#bSQp+%*zb5D^ z2JOPR)azxFi%^sMDS0mAo}>&(Pu3p4N}g1U$TB5IdNxzY_2hXP_blN*`RoS`wz_6* zgjK8<{YcSc%`8BHrU@AO(Z;4mmTW#quB(pLFxcq?Bclhp5sV%U^>XxRWTVH&sN}9i z%)9HN)|$0Q*HcS#wtf&Z^{C5?OyEij${{S^zE*6=4CWuZ~XWqWK;& z-_OecIuRAcJM165VW(>;qnv^}jmbG$4enIlIokE6>k-rSxam3{h0bwg*5R%ixHy+b zP1;kY>yYVN3X$a@%1ze|aPhD|GhI88OpYT%KX)Nv!gZeMnr^xbxHy+jOc$BPc-Tdz zD{i_HrmNd@?KWLwFsSmdb4*vI>1sAz8%)<VotX<%xXSf3KV_Dw2wg=*$)&%gbqd@N7SS$8g-7go0L&?t(91Fv$Nr*2FM;8Rj z=Eg1!Cz=K>OXj>w$dKm{mKb&xhGx&piya`7)@i|H&Q89TeK`#3*2?fRA!8bngQ|nU z0ju47x2S2qm<~EO@HN22O^noNxFI#8{Q_mg>=%3uE7gACP;l5{1q(=`vf1lH-Jp?< z_23OztaPvkGL*P^do#VFw&M;Yv_kCu!#hU91O6je0iqBZH+1x$9WvfynQNgkEpnNKS>{o#(%kr>Z>FD%%haUgu*V{J+2nco+7O(W>V{5|QR-vXYrZ>wij zwkz+%ivTIi_7HjIe}>U_Qig#>h#)VTiFh9`o3Yq%meuqoNLsOW4n`RLm>La_Cx`me zgdsjHl^V*%r>3?95vL3L)0e|AVuTcSd<&O&fdgat`^_K2q2?8*B0wXM0#Vkzpu})6 zHA#goQHxtpboQT3zs!Z>yaxfZ&+q%(Gqb#}ffdp}cxoxWuQ%#b?`tSpEIBNMZyc_6 zC<2BcG0@eZ2D&z3pvxElZI}_%!#Fh9^}S=T>p$$K2Z&RA|j_$w8ubY^Z5;~ zQ!&!{sT%3*t3TW)2PwrMXUjp#6dt6+!XhykslM%c4FWDkxhg=3QLY`JY@=LC%qf%; zQ)q4V-YxiGTh=bHVT3Qi>xt>$iNn+_zSM|0bBAyuQM=L;%`l})+ zmIw1A6MoRh*vV_Ufls)s_{2~v4~MQV>*wFQDIE*1BLlCh;Hnbw;(=EzPr$frfF`$4 z=Ww|eqZSN{qAd~D7vYMssHq{SmL9^1$TUCZ_x+)In=hvWc?Y|}NHMr8ip5kU2955% zgLw&rpB4dRU=2WuS^`jh{t-|Adm|~LrvEu9DECfYLtXw5YT_vC98jXP&jKaHPwfRE z{uXh=oSruplZ&>Aa}`+V8#S%;!zSSG^K}kS(WJkH9Bn${2@_| z^X=X0b7y8jA=Sc7l=rj{C6vA!Ww%^0A+$cSY@!vp=?TzQ1?WW>h33(4pU`Bq$fYPN zK?zaL(Nqhe2EvmQ@cm)P_M+JIxQ%54Z30f=xux}i&{a~WT8bIma;{hLAZ4*)Lrez? z#T^M7AxSDBY%+~}O;oF3Dy_K30!nD%b(pI-CY=`7U=4#>D~(b6bfKIRp`4?zBwS>E ztfs-M(_2m|E1A-A8>Ng|s90yCDiz+kLP{f4lbU~mipX;&?1Vh$YRV~3TH3)Y{?)X! z5W&d+EWxEdwW+ibOS4j9>l&l_#&nJih_!MgKYY{HmTBWmu+T&`uZTjAGVRJ(Fa<&z z1Ps;h32KS7FEj~7X-N-Xs3R6*w&%(Qfuj97V!B5xl@$@eur=!0&}P(XV)5s(a8|6+ zWrj$KDgQAgLF-*tX0iXWtbzYXQC~DBFeAJ8w&U~LLgSGuum=faMZh52ibYud&;^0e z`OO`?ul)^cW<<(FHWi%#P7zSjrfazP7zZkZD~i8RE7lzAXhgQ1-GvTHtAVFaS?2up zd!nRpc{5ZKf`_KVpV%Em%4QS1J<<6yop1PRXQDV!%gt%I`$a95yGP#R%jjYwgj&Le z+=36%s`@fP&niw{LoFz=X!-(Bb6M0hz$lhGUkyqum1ddp!e>z}Qf)56q$^0wQAL&n z!#7BRR{gS6C`*X4YXGQP_GSdAMNB!qR4vPgnzW9z=nUV}Mq{ATvpl`T`wCj72fbUr zNDJ-s?tPD&Y5}y^1EKYSxZR~^+S_U;`$CwBoCiOUCYX)%MH*=|8_Cu@e-Wt{DBlldtG@tLU{_V!nVgA}Q1BOOp zeTzmTg~yH$xSD;gAJMBoF=$&@7`MilKliz|JDQIx5$3;Wo)r6SIKxuQoqFY|r{#4- zdmHWZO=8Y;ciGwA=yy|VdSlKMtE4Ie$={V;*Wf}!{?Z;kOtfSEYj#C>O}F&07kwkR zvI6pKItEUqMgK%FJ-sMjIG9?V3fkl{oL*L*2v_<5B8#Zpf3 z#~CXH)J*>&8qwq;IWG!r)tol_IDbRvZ{aM_9byyB>)xP5^O{z6istpbP|L;4_bsSf z+s;JT)|RUC(VNh%68gL^zQ@a#X*Z3O9KK#l{1GNH-ucYO@aLZ@$n z5(+{vqlfH*CGRd9!Wj{j&!{;@KkRrow^+ERdtUJ0@A|#@d@S`wCiK;gG$DNeVXYWw zFBEJ&H^%QtcYT{4&c*(<@N|r`G_jQYaSbyn)dQSq*@??TBK#G(5T0N?pU#E!5mjvQ z>yheNKE7irmXRdyC>!p530i>GW%@qv)=$%-H**?p{mdKMHr$C_}{;zS;|sVd~n|9EAY}at~tTXf=;bjot`fY;K*Q zcOoB&dopmrqiN(qI@$nvB=0RdhKq)QqG(8>XlG$m0!0(8`9aZ?TZ84F7m1?jL5kX= z_-n9a&IXgr*?m;c_z0H&U>t_rR3T{|-(VRf(V6x_Zj+XmOB6zCMG@pBRuo~W5fVcL zGKftsW5sq0So%ZhqW^6c7&MqB3Je-T6V!Mph$uRyfD%Q=Mo^;Ycu*G@dq9aogmzMi zLgal=!cMoXQ2d8BdU;S7#q`!js2Pu*2jW(j#v3clPDNW1va{E@C}w$e8Jwv2pW3j^ z?N0AYRQRNllb@zRm7u(*p~T$`<)yVbn^S9|k%W`iq(#>gX;TEfbRBm>-sXWDtSk@XQ}MLo293%7 z#`f$$IMyGI!XBgm?U{j7huoCSY@(zIckassMm_?e&jcCqx?;)7B&4z$7V*(&ASDHD z_YIFsL0Ou`b!=!t){kCKaYy{!NTHaBv4wHiH-P;BJ%9&4Ixc?d5T{|s2bPaZUn2og zqb%e@SNH(u`_t~q^X34)vI>7#s|URh-7(^#urgk*CfAPIqJkCXKhbdF|B1}KST3J{VPIdlGxj%c2v!G@KlRMZgGS2ZA25O=x4x4l-pZ}- zBk`o-9SFrj7lOT%W2oc8o!=qn+LLs91VVk+Vd8XTQoi3)^j5y7WJ7Ac=iT+#$~rp9 z**o*<@o^dx5lv+(f5p!Dhd_zW=o6ZH5tQgNYz8H|OQ%7+Vqjo^riOwNEqwayvuNQL zffDXjXo@D^gnN%`yXQ5vO26F!N`#NLi;D1F2I}wJ3K9JT48VvkBf1IUv=mQFI~sit zUyOQSbPVPwSPcWAk?01G?jOR=-Edc_>}U?410{P6G-Tu)yA$P-KJ&pgqDX@-JVbXq zU?PMfG!ylB5O=2D!TP-<=^gSW4?NP|T&$&CM|+mBH+MI>FSJ8h=r>&D?UX&?u2^z+ zAtjUionq-JdOX`j@T%p>F|>?G zc5D5pF{#n97?1^v2-ZFw5^S(RlVevnBL>TMan?z7l2wj^5U4G|j)L!X-x9nOf)uoYc(a;^rbl2o zYnLxn4jfx@Qp!mCYgdW1oW35yrnVdlTI?@q?w3!o#+D*8*4Rq*H6KzS(>9Pd_TXX1&)OulX-!S~U`=og@&uZa*bP4((NX-JB>!zbzwy#HDbFkX{N|@OF#)7 zCEtXOex={;0VVqXzk?F}|Km`k2)kHa%%p+3jf<42y1<#C`4)gG;kS?Ix6gtS1=wm( zVvqUT+O9<|SwX_aWRhpz%?Jqc43@@Z`NE+jIO~sF?@!)TIs+SleW68ULu0u|mZ9Qg z^YPE-Dju8>`6?Fy6Oz0Ils&iG3s}rGWZ{4u4&|JB(t44rYWb8arupQfISriY)B#9R z$Du}%0+%L*Z)dU6{KFkgT?FbRTv5DDMx0o5IiBz2w=7mOn~QSL4}sP`NIq&kq-;*x zqA}jW+5GB+^zc&@>_BZLa*t4V3{{O*bYR4^n6ec0#4RZ*rbSVjUi%cq730H=D6#jc zJcXQ|xCIull$#Nemvj)YCpr)=!XZfi3!d$t(?IzX6NzS5KGO1%*-A(X%h}VDzocv> z0;&#EIt$~Tww566$F!ZNw4LQ2IZsLD>Fql6ibB4%ER_x^i^bj~?@E^UR87@_63X!p zP(nFqHc@1n_d$v5xD%AfT$J@hrlCDz;w`lpM5duN86wl1r|md(X?e5ItH==n;tYuv ziEo~{gY&*n+1IIqc7i={s8>vDd$6dtIq!Y05zq<`HIhoWu>E5ZQE-8C>YV)+R_Il{ zJi2y3J74VsOX*eZYeEGUET*SWTAi@T3m!gdo*8w=FVdeo2obD_!G!V6Mh zk5TJms`p{x*+b-Sc+sP>#mso~Dp+ua3X14rlj)X<_-c9EIau`>{r z#eJi#je+nY4pey2GU8gdfNo^cLqDX?-w+6uN0;~CyUDY>4)ZU^dqeeUy*K-lu^@@s zbm_GdT#^Yf)#tjMgWa3w&Ffm0YU#pYK_?4xDgx za9Zd`Z}sOl29iJY%zX}a{;i)!K!Laq1IcfA=H5fjy0)jy+cUGfAD#BfKswA=y$yYK>%N%g*VIHsYIj%mP(T*QY& z%c~NQwDZYPE^Z+P&%8KtB0K?QEtjnRxQ*$_8$EMrpfKRt&`NoW9LL+wW#v5}(#H&s zf3%f496Qx!a28FvYo|zKN<&nlb)Ies zaB96MU2(tx6P|8my>P{Nx(!KB#<=qMUD&(Q=$U^fc7|e3xG5U<#JVOIZl+uVBc?}J z9_^3A*7sdapJ5h6CTPRRX|AR%cor4Zl4fk3aW}s&^-vyfxN_)Gx|nDERQB=8{v!lB z2PqR}QQe!*6fKyNMFyxUwp$JAIdDW-?}2)SslA|z`K^V2LDB#DNTMh%F1$>U3wJRe z?e-IIsYVxXm*}^m?ltQye}+ko5~a)pF)1SEb;Z$<@9>FT$kY1t zNa1AU=*U25h7a8hT4M>VzIqbqETSP}S}IjSw6Ati6>d1?u}<8m4T9WD%eu)3H)|Iy zRWvxi0gYRuxNX7>jcki>q3`9%g$dM7lKq$gU=XudRiK1CsnH=Q8o3da5z|;+et^iK z@MWjN6B4Az7Oe+F(RGSeXBeJKXBbw&mO_J!BN=Qp? zVW~(Q>X->?A}CRlFdtbPUTMD21bC{erorIiM^m8t3GN7f8cl8K6gDCDOiYT}{d zz*!R&FJh+X(Ti)NPaw!@B)3N(UrI_3y8B+ zBE>0c6`oI|{t`9ssSQ%zh(pqLHK!oQr=px*H!=vvti%m_I;MDTuMaKyiQHbdU>j~7 za6tu0%Mv&ElCh)nj(Tr2%Ew$};qd4Z3@CT1_|l)#`IdldKaQjEEcetmwGY&G=??^~ zLntg^y>0=yNk+Qcp2(MwgGp(urkS0nK56jB;Sh^EscB9}65*D(0mr-HAeMmVqTLv* zh{aI{%TUnrsa&Gy^uEI4Ljhj%13U7%YWh%_z5`YP_fzCzAjCK6FpXfwLGM_|I8zfv zX0()@r{*z2x%T4JLeKn_pmER|g(!WSRMPPnFI!Ycp~NaMNQZARX%BZ<*(^vB_dkwq(rUBu6yycSVwL99Xm^q@P{(;{ zx^UROqLHBa$AE6&kcm=05N7T0hepPPM+d9-qjH-Ng+>IDD-rjm6Ty#R`i|j6+u&SU z;s&qhq4n6KOKpaIut8Lig(xcI9T|{~OfY-%83KvJpNIiX33_Sc@#FjzG>sF)K&%*s zMPp?>dFt(r-pYE<{PPi#Kv?DdN!N2u8 zk-j*q0_}%x;1=zNpS{&z-k6^Joo6ngm=ntcwg=*x0%)tu-9=8hcA@Ry2}MEG(0=f9 z`{51vRQ^!Y-|_y4qT-oPLrP7wGS9P|r6xv%F&r#~fb?u#2xns60)gFtxSxQbMPSS5FivTD+Y&vO>K7fH1Un<&%6{>en;i zaq8Fouxp`THRPDoud@&vr+y8_dtIEZh)DSl6=$4$A)`2>HNq&)$VC)qHir*coP9t! zP8Mg)pjC0!MxhbxhXP}Mdw5m-8kgFhd9u;K1r!dPY|2D_2!x-iLpc25@iEx&NK33` zQH<#a&qC^*p^{mF%BIebvX!AY^{gT7O|I~3$FIQImMDUhn|dr~-GcRSmW-awT(_W( zo?)84#2*b61wuIYd0q8u`^Xl0w+!Rr@De2$BB)v&qLiwQqEQ;FX$=0`fYK2efJV0k zy_cbjD6BXSZG&7UsSQg6dXzPha#Vb!hU`%bPM5vw-EPq zoDA2EM%i>GlZ|^c=TRZ0p{-YfMm|o!?3Q3wK}{F!qh>xARDqC?3MRn!qPuh+x$UWW z5!uE+XCI}rXW^%mhvIgq%F8a~`S+qCLx`XpQ2IKgP$0A#HQl3}j8x;!B$s$BFN4>F z>)_%~&1dLIrFd;k`Z%{{4i`j4NS zsYEY_3F%Nz)St7q>3T4sY-;|_ch)RS(e7(1AXFRVT!gXKgd)$DA7Nv(bOtX_i+dgXeu^Zt%<%sQ`B%1u9SijuKWX(=pxc#H-c&c zB|?>m%z8h&JQ~ykOwq=9@pgrN`>uX_P``~sXJade`C?GQ<*}OT3DIxox95TqZ__mO zGbqvN{}og!q#k8;K;nuafi9rL+wP#m+f(%0e){bI{dTy1+e$}x#l27}U-G3s&s;I} zgML322GU_Om(r1^$(JV0n5rg6e6$6Jj!RcVwV34YfE_p}%++lC7~_caQAvuIxOO4R zDC6Xur0s)gq;xEBSV8@*^yJN@3CNmQjqP{U2SOK@l=TXX@b)h|p7!2hgUlpf=t6W3_vMsD z@oqc<$rTRvW$Qi+9E5MBnAmq+@bQQ!sIj<>%kIli%VGdZjq*{KnbP436u~X zoqI2+@oFcDTGg*MFT`P)w|5eCpQ$U0H3_JHF6%+vS%g4M-=evQr4p5==|I(EWZ-sa z)BFwPF#%Uu4_{mbgu1)gO*`wV*UFKbH8jW}ih_$liK2iL&o1Wbm$)Gp>;fPy%@IT7 zzVI{af$@dsa01kJuao0*I2>;iRw0d!LE56FR-294QQ75AWWH$vI|t`lKxC!TzwKQd=#c^nlJQR4ZT}; zQC2kHs~;s^7+>h+#kj4jUdE4TymfnS2}tz`8D64rCM-n#HAGV)GyfkAOVdG4V!qQ8 zH)}Uy)rfM}6Y~rQm7{gg(`~kj)@T*2*@)I`L~Ay_b+cSVYov_U0u?RHAL;nKCgaoS z>5sw~GltmB5wGJhTvHq)kqm@rW#QYLZ`eEeRSZss@N_H<&8tjzeS>MybWiG+vUn69 z$M_wUG9^>kn}E{kQ7;yJW5Oam`5TOhVy7Ka3K^7n0~v3Vu+EKE}n%qpxvOleEQsN&+;)@UY_alZv8wEo;V3b%rxJ+QPTiJ zP*$g718AIg?^cW_eCSyolNS2G+j~oT@&}&z^U&op7<%6` zcQan3yM9QaA+gJ&5dt-(wg!He-`}(k%_)u(FTV9|{S2)WBToL%8mvRW0P?1C3~g;e zytZHvr$=gNOKNX~e~V{+4>%jBorD>}&pq=-K;(fCVhlP1ZX=TZxYZaa!NR&o=*;-U zBa9d>9Ab~qiLFG)pNt667pVd=LNm}-h0MfA*J}7#eqYmv5HkcH9+Q=pxCO_XW1Mq! zYUr*iB+t5ql(+~KGU}*FxY3;x4y>3)T-HSM{fCqWFUj~4O>>B)=^7Ltp5@VW_FwIB zK5|a0$-0G4kozzgUblF7easE;EemaQ84en-XzGE`l5BC3e0pdn7IQ=Vu~4Z=s8jvP zZ`1a83>1H#N{b>O*xOU{5?-TO5peAeB!BOjUkRzG@u3y)Wfuh0 z*=Uv8MKO^oB?gP7O0}g=A0re_ecAv!X9i(?T80-&pXl@@r#^)d#Y5^7r6{7})Tid2 zP(jK}C?s?NAu?0>nQ~qH-YuTx8{v5GjXq2=&z}t`=~%CazgU=zc_ADDUXO)eoTWUl zO%HwI$7$rQ2LG!nx2J|S`?vm&^#R9OW7PNq@Cgy@^;Um{QRCk{a~ojCj9>Y9c{3F( zfw=v2)aBg&;9bCVfQyL~Aq9W+YRtU9O}XmMrn?Z!HseECr>!{A5SotDPjE%YsfiXs&HOD)L9+5mge#8jz>f?1G{o z`p8V%4waeEGf1cGhU`RVe)z(-P;E(b_xLnkmS^EwI4UwB(h1FpA;Nit{SCxGcoI&p zV*(Cgl_a^vIXJ!1)9pHp6<&w2!o;Tg*mWEz9qNX~>`ia8FZ!_%Qj+C;BxBB-N=pI4 z%;cr*T~>29UkDXoXd;T0EuNYwkYn{KZX3veW2XQVY(XksP+!lrkwO!|$Z_bdrR<}M z*Jt2}#LJnZn!cqXA%v_1uV{JT-tC^6pC|@%4p2ekS@;(4DB;ral`QBZc5$r_gc{OA zZzJuhS5?6)D;O)>M-75>P@P63U2XR?j!PHu9#t6EljvL9hd95dDA32u^w^>h@-r?Z zIm%>wP=Zr!WGf-1GuJ4j@W!){M)*0TIFEMnwsaKC99SxBTL~?4<{?9i@~gGbUeqGA zD_A8^T61WraBrfmTB53=0vdH$^{26+F_lzj#n6qNOo320FK?+Nt(|uZT;L2AzSxJITkU< z2M$6ye%BU%GGw%SMkjyV51s|I3X5a=8i;^vTOh=e6DkiYp1($+vk)XQ8AfpqOqtShJ8U?m+rh6Adt zgjRBB_xumbbJ>2~9JN3v5Vx!OO3XbpVlzq8IjC~6EC{s>wdKO&>u9o&+H;?B)}(EGL70rS&+vvylQ?X? z8IwXanLqhmv?Q^n0R7t4Y9pVh$@o2X(gxxXN@^csy#XsUwGSJqk1~HQ+y_)tW}?`G z!{|JDW5V3jt@Zs*r#e-)Ls+F~RCP(M(HDSkq9vX}acIaL;*4tgm_=F=qgGIaxV9Fb&ch&HP31u`P!39TI?=mNDKckE^+R^}eX`B4~&5 z)LYfnC1OsQK-WF=RSWn|+>>nFtujL?nx3Xf6mwqUIfzmyk7+-nYwPxxDtjuTf58=H z(HVh)Iv1f6gNoxpi9to06%exu&!gcXW+Zll5_aQJJBg8tt2I>>t>zLQ0VT%%*MJgZ z|8(T7m}wXfO1!-elz7_#{SXnB^{9orL7Aeg&WPei9MajKL^kE2!@5M|Y31ivuO>l0b>sf(t;6VuT-* zm`ljeZzt-v+4}7?{kB-YovGidF%c}E2@b(eo$s1|Q2z6HzmLZH1L2#NLJ&OUFT$|7bR>>tL6w_MRqkb|a{o?cU|9mK z?Z@(xveVMz*5lxR-=QV~$SF0{rU$jqKqHSaEM5{EO4Xn`e+j##JTYk7b`Zdofu>`_%m%=jOhFmbQ!NLrTn9I@c$1*zs(-jcHrn2L4wo(Ao6(cU~UmD$v zjhUDOVR5rtw!Oboq!^D zVl-w)LZf1;XIElC3Ev#QV^nwMYaVn-L>__K&geB_y8Ggc^pKBb;SHt4R9{b^(hMx< zOX==ghm4FWybj{wZ{VGeC+9FQjicJ6Vv7lqj|bl_^!c$Y10MO|5uMnECUOji2rJU6 zZ>+RDcZ}@rnONuPHj0+hvQGoy>Ls}3F*LMELkuSOmn%!@C>Ng`u*Ffs-q&)$P3r-D zwRcl9Ix?G6@2}t4?vmQ>%U96634gia0%8a+q$Zm9j4Y<4ZY(_mt5xQBSE0C5XQoBA z{;#tg6@ay>3CekY+`1W+>VfKJ*M7$-7hB1>zvOEG+f^k(H6}Ilu*j?jV$$HMl953) zW><9TTvg+uPXnCGCqL9-7l8gYK%e}@2&6tw;*ehlV7Fy2jpis9#lo*L9BaY^k5osRL;JN_&?dtt=eyu_POM7G76B~T=w>G}9AMauN)&>f!_2euz zGiUii3n;MgTqT0q($)kgtqXC9#E6JsI_yNv*bM3)k;M3mGgd!@OXaA87nBaf2ztGd zqk2L8)B3#SjNDcM#s)=P-VU!Jkb^L^n3l&NqY!}%4RaUMeoogs+x7*hFk zgmv{kI+7uBj!I-W{>VPL!j5x^`X{qbB*oO+4eb!cS!7sK@b=2xNLrkUA@TysiFvyr zrNo2kTh8^gF?hQ=-pU`!Ou*a*mgrO@rH3kfe(_;SdPW7%t>SXEz#cDnuM&<|i-0Hw{R0~D3bB@;9D|4!pj#I z%lkIEH!R$Rn{b`>(coLJcxKOt_Z7*zOx~B`P6ual+tLeF3)***pl8YFnymn= z&{Q!sS%L~!4%x%Y>UuGg2NBMgM1Mj0o8}KaKoan;6O(!Vb$T+-A9{^z%E+W10L!V7 z69^60X91X7N7lsQwUD(Jl#ocerdpFtBHD`?m?frAKtw1ggp|T#

C^;yMEeF|(ea zDJli+f}_pc@)JQ3;h|3#$vV`Cv7JkY<0;^Tk#*1$#Ug1ARXRQ}D)SD$JDQH8D13Al zL8Wvzbh;=DA z_<{MqQT&aH*aQOghrJ36gid#60bUg%zwkpM5(#rDD3J-M`z?}awWi3gzeJJWfJ0H1 zLy>u&*PAtY4IiIoZ`vV2#7PH%@XUMnbXta80eef^H_yOk^FZy3G01XiT`(%; zbA8pn91M=ZAV!ui?gQO<4x_F#7E;j>3(0G+YRUb#*uYtpv2e5bWaSQbB$C%)Fn=34 zSN@DIxgrCzYiM88Vbi0kX!-0#YVFMAY(EZEq&+OCYS>lsTM*iO(&50%9{Gf{wrbi} z#KkzCsZb%K-X9|#_4BcgXX<>CQT%*Jq3xOM$wcEC_*v@O~&lIoYEB2Jf%4c#X|DAsMe)&x9+`RGm zVHZ1|d&}oo-0S*&c*SXs=Sv*VR4I|^gX@XRN9Is*Nk%=77LWRw?8%&t>zlvb_TU(P zvMeeNAG@Oc-!tTMf7}Y0|pkWtSxY)^*tepSjN72FvI zO?rR%N2Tvhz?}@~{U!6x`>`WGi39xWCa&*5;}v8`k4vU67&(cbP|@K2c+`SP(ejz} z_OY3}syoSN(#wkMv+lZFK9gRaKf5N3u{SoPm)Bk~vF>R3JR0|c4j1gyqXS*|$>Kw!^Y`EL%~kT5^lr;}Po#8} z&y=o7U!7G%=}Ly=(EF4}_K@7jsONLUqkf(&pDA8feZ7A%b&tqUIOm`G`fZu~gn@G0 zzrD9#-x2be!jbmL<04V}^_Ui5okJ2~wUfor`YRetPr{1f2NZG5qDt{E8vUlFqd&h7#h{;WIBc&YY;@<-hd7oPvGyW`A< zN^a`zl+TIkh2wrWcTSM}svK*}9gl<0;SCR-k)3jf`dh7;!_^l~JyiWWr(4v2BcuEi zPmzD8Ke3Tl26Z@hRQp%?)0R6bzKYNA1P`jbQSVQ8GRS9VxSeb&Un+M7IvI}89cOy} zS$CZ6wLj~Qv)=x{?T#8ZIh>r;c#q<9CWq>OtM{sZ=;S+`JI;EiEq9#y>h#B%-&Oz0 z$#*z+j+X!xuRrUKGv0sJo!);@c%1p`&xXg@?)$Uu{8iy`=C3~+9%sJzv+n#=@;TD* zIO`RszB}ck#?hR7Cpz@Z`QE9|YCOlucQ|+YIQ;pu?hH6Wcbw&mGrZ3Fg2qo;Glz4> z*&b=j9cTIC^vl_PRO3EQK4*G3-#hDDHJ;<-bNc6e?`)6#|LtB=LjS*fggjJzX-WrU z@zO%QZ%coi`OxW(dRFeJ_N}s4_gG0NK4q`&&hqjU^}=zFmCtRt<17!_az}-;Eq9#l zXXURWIM(6Zamu-m(*gN>ICqYbd@8(u)*WZL(v~}_AEf+q2HV*VKf}o&pOyUEa>v>3 z>)(buhYOEW&T)Uz9jE@Z<&IO1PVb!htm;K4pR+!2zE{sme(}n}ad)<}9j|$Qi|mv; zYTm=i=WHiA-#hcgNGF4QcD5tiVAJ98wZZU5-SM~Kj<-t?bh@MF_ngihP7f8o(r21)Yt8)8 z`b*8 z)rF}>P%%u=u#mvgu@uL$oez}YqoY`lXS>CkZw06m*>0P*qvd(M*e;g-neyTPRHmkB zJ6i5{8rvMXXS74*W6*60mnyG`0|AE-pO>wzQ? zd?}!YvRxLavxO_#?om+Z2v@Y-Zcyh5S5R;ZY!avx;fl7a0(BAFJ*w^K!}lZEZnw6J zLALa>T@t7OQ7pO^0#h{Q7b_t-aWV=b)t`gMMY`0X~ z)q%KdjhwcQd>)7h>LR0&g!pvstvMnOD-ss5noBtGaL zs2iA~!?tc@YKgX^W4GqAT_dRZOwqvzHB9vfB@jMPVYVyLc8fvLmPnViLfdTvb*pd% zja7k-1$8^y`Lx|MPxDUjs_W zWtq0y1nS?y6>Zl8RrzCVmjX&)vp_w;b~W1WQBY5_-6n0f8`QIG*8>eJflUJS0^4P2 zyDCuh#W9!lsJ2@V>Seaut?gn^%+TU@mqpu(gnN@f)w5j{sI^Qj1+|W;^`JH~wF}f+ zOvRuxE9??LZDPAg+O87RR<>ITiq1}VS#_X<=IqjT(U?Ns&TkVyeZ*7-s2xmIg8Gc9 zC7`}!st%OU`$kZ^*e)6kU}4uER5ROUXuA?n-wIc>-3n0Ovt6UMvrx_b#CH8b3HN-U z_Oe}xwp$G90Nbt5cH2Px#&)!0OJHL`QCAB4??Jhlng&XgLyJLmV7q0YIx)3P+wB9@ zneAeaQ~4+bl*k{`KzaCW4X9&;E81=osN>jfpSJ6PA&eeumjbFMQ(2%yDPIHX6t;U5 zl+cJxpn9|2ZcxIH9%x7kyChJ3g)5-WV5$n#nZgxN@l34;CE~jqR07+@V3=$OQ%RtP zGc^fRGE-HcXd9r*S_(>F*Mqu%?RIIq7&Im>WV-}Vf^QNip-q+AZYiiV=Boqc6Rv=| zgsJG06gC0WXtv7$CFEQQ>Qc5_0!oCh4%9fdYXl|yjmCt_M7HY>O4wz9x`ORWKus2| zXuB1lve=H=C}f~3Y{b*SgGE!P1%o9+GOsJi&bfAAj%7S&<`v}>=jN4WmgZ&WX6EMc zgM&rd3Kq$KD3;Q^>&o-Wf>!oaD>pl6l%F8Y-oEcByyEZScBtE;aUoIEspk^5Umw2Xm~PY=j%`6$ML+Es4FJgU7K9a**@1 zV}*G|Qz0`FKrp@#GAf7s-i=?aM zNJ@dU2u)dDPC0}&Grpv_upmdKUtWAc5x>ZbSK3k*EGfba&HFGHoUTet=QY7e+e@(RzBZ{LTkZZDMWS8ZX7L=egu*vC~GGuYPMP+yQywz6LovB5qCEygvh*%Unh2^<JfavKF9Lct*sQl;#x{ zqar|!GE-C`R6HsHQ~Jtcu?*=_R#cFmkJm=|S7arQh(!j|>+sd+)V2E?MU z!M`Zc%Pe(wsJKxkwa5Twq15JUncc}lS>vM4Dnz|#R92B<$SlZbT0%$T%Sv-%&!AfG zj1jTLQ?8-f)owK<8-*t-0Lc@nceAZTT^mPgYACR%%PAL8g^xSc^}(EJqKQ!2N)1%h zX03wuf~voRj@q--QGJ$KD5ViARH(8HpjH%G;%GpM3q58w>W;oI8+AXrYqyg^t`+Sb zfbI7H{fuiruHSG`Q?5O(PPk|oWHoq>!<_~_PR7+67Y$g%;flvagAK!QCF42|mlszW zF6!>5vdckaLoq)X59aaYdfxwaea#GOI%I3{)g*(TtDO5 zkLx#Fbe?v5G*hX2Lffai;Z9u(`e63kxTrJG4_6$nPw-6V*A2r(P37}&d2#K5J?(#_ zA&N{~Ik;$`;aXfY_^|}nDqLiSTIZGBh<#Q~nkv*(iKc>@s?^jC znyS*&JWbVT>Sj$X*3|8qTB51@G__Py4{PdCO+BHhWtw_kQ!6y}il*u`wN_K>HT9;Z zHficzO>NWEN1AHX)EAoCrKxW;wOdm^X=3hQE5={j)RjDaDK}+zR0ZH~kKBu9>$x%3@0oQWS0oc{z>Vg4K zI_$L(_EkU~OLllq=ilrE-5o=2r{i5O+-c~p4*Uyo4WOYoxIGkiDhH24LB1c)ok7#U z-Yvi%z(qrVG{o76`xm%&;ra&GZd^a%BENsdWdRd~s~)^Pqfy>U>_>P<*#E%Jj=c@f zguMa-l?odTd}myDz^*I8NPa7P5okNUHNUR|58-2QQM`NLqIiD^`@XpM$3^i@z;zO? zHHhm&@M{;sa-{K7VLS)DxOorm5#OwL(*`XsS+AYc;iAQ*UZ&lcwI))HY3hq^U+t zeW9scn)*glyEXNbruJ#-S4~;S`%?cjMPFDJt`Y z9hLclqB37lROSnc%6vglnJ*|R^97ZnDJt`Y9hLclqB37lROSnc%6vglnJ*|R^97Zq zDJt`Y9hLclqB37lROSnc%6vglnJ*|R^95CJ?4ZX=<&e)@$lbO>NTDyPDdjsgE?(sHrbBwM$dqXll2ne$v!F zP5r7V>Zk}w(p0UWqBTV|oUn`0RCi7F&=gI#3cgrP_0?2=O%2dgf~L+zSWb!(y#N}< zUx;Tq)%FI|YVB~(M{WBzaIZvZy#v>kcu!wpvv5V>ipJHMo?$3Ii;`SW(b}%FreZYJ zT~j?Y)k{;cn(C{m{+b$~sRT_8)l`zE&ec?krcyPv0@Npn^FI;4cX8c^c+?}#zu+QS zJcqbb59~w8q8}#V7UPLApr9Fo$R?6hRsLeVeigb*8BCdNn;WR;9|HSogTnFI> zP5*Snbu=!Tx}nz33Akt~h76TXLUw{8*$IkdCn%Dgph$Lt>Y*u;ov@456vsjD=VrKwy^P197Nrb;vw)KsOW zZqQVfrsipCAdQ0Ii43WyTk0rVunm?AU{E$&Sn!B}$%90L88`)_ZqiUvnLIM_VE?}; z!9+K=%LU)4c{6I|%Q)m(dHtj2iDmyVT?=g@0|f(WAk&sLWzE+gx7VoGG*2weCc+#8 zJtRXT8g7@LX^bn(=>B^LjiL!>G94_1@)J7@Ip=m^HjYi)+}nTcs8M4yk3uz3&|pX( z-L8@NC%MeHXx5HsjrvaWsCX5Us=`3|f%+HzNg7el{5GqTMwMzFg=&;G#Orod;h!8H z+ok&rM`_ef&7(qyIZignctEKw^Y8R)hYo|1JZ9S@kMfJolP5#D%k4sDW;5t<-?q*g zb-(6OsBtm{Nw{uTU;L8~7cP6@l`a}}h2~MHUodG-hJ10ms05`n==k9oJGyF=OUA1! z(o1MwKWRf?w<`|+WWVakyEl3?>MYHpP?us-oD98iyS_$PP6zeI<`==Lq%l$RDAYYt z0QAD`dW!yWb$@b)y2Wl+- zDPGNUXJKAlg|I;LDAaB8Rd+^JK}C{5E$kP6LwAk3Tk{ZVU}+?K_rV)z6#lb-dTQ!D zFLY+ZCWtfqLQl)tFBwJeh-BWvJqwoWi=SgWP@ifo=yYxdREHQCux_HH4lZyF4evie%DY0 zrWUA6HeIpvBrVlNQs*h>xm{n-KduEGo;kCpcKLSAqvXS?1U{KNYs3jG{uKL-Z2=sT%dO=23o4keU$7DDn~BS>KO5>DE|{x=QmXRHAgJH=`!w zpMtZgeWG4s7EL}!t}xAc3qEuQm79r zK3UR7qn^|}3e{UmwJ)PcGs&->YbPDkSEJ6*JPNg5`reOGXG_$~)Om0B)2O#Kk3zXA z>%&la=5{T{KS_Slva?c7*QidKN1^CMWHM*qa=WNSKn@qCMV)g8byl>$;4R-l}J?(%$c~{t|9m* zR71kCF=uMj*_ub8=+i%B&cfw(U5bCQIPuzjFP)`PC7MT}cF59r0HdfBB9^0`eQw|!zcEmw9@adu zvaG9tH7c~l5#$r71ixZEykF_SrX z?vGaw(Oh3>G&rFzyE{S zJ!fmwT+O3Ur;*5Dl5n|QeemzXRdLSai<2~}zvfY>4`fY5HNV?68vo>1>IDrQlQpVQ z^C;BQ(&ijS<4ax@sPU%9WZ)rLNmWwFBjp z#f|?t_k4}IM)N4tl`^KR?XJrZLQ>}uo5%nA0*%VnJPP%OOp6roMp}AL-q!!66ph-f zc@*j~8B;H#=*)fcs~|V~Tdzhvt$7qGo=AP6ZkF053T^J~<_nkQD4ewEUliy8G0{wZ}{yr5tH#TqqR^C-XS zWDR=>qn1ikO!MB=muOUj=257@vJDVm)T8((8Gd}(3U5H8k~EJ({a5;)&Zt`Y$MyWs z(|4q6)Q6f!p|YgTQ(5G8QJauVO!v~8Mr#y}pphA^(~D+e$WThUU32kIGQ6ho)r>J3 z^`Pcaex*u1%wUu~Uu0<1#hOQ9p%E)u`t+k3!M53Nn}Ba=T<^ zvue_JO}tE_7HJ-Z`VyK=W-KnZYZmIjGeCW`Yt%o-YE-l4A(TB|oQ^kcR}B!S;cBRx zea2XwFJ6#-jboRq@J}ZE-jgfGX_sHtJSsf&Z4fe4Z@OK@Ok+gup5`nS={M` zA7~zhdQG-2u4Ggp{>iV=1L9A-Qlr*t9);=?4JH^G^K-kt!$0|T|8?)3dzD7TX&!}| ze-xNts4jE6ZjvFa82sNslQl}65jojXsQrw=b{9sa07cEiOP~1a&Z{-*pypAiD%pn2 zWE9o%lrJ($N5^Ms)B??;P+O!sS-87hPt!lH*YCdYKUo^J4K`%5bO4|A`THd7h3ttUzdP+Q*ZK4mJSu%diQAq516d5p4U8f@LJ z9{d)w*q4^>nx_3aC_}(J2C9HjvPiY|Ua{}T0!9tQ%1P;z#XJV;8boPwp1(%> zHB0I|^BAaW4b&FbtM6Z{QE$s~gLw=T*ZCol!D5t%|E2 z%bBj@HE=Mwgw<%c%+a1AvT;!glX+%VyX8d@)DU6IJceJzco9KedH>En#Szp{fnpv5 zRbrsd`@QC^k_d{rH89L$pss^$#ILn8kACU82#UHjFwA41C@CYTK54#_N+T%h*1#~2 zfhvQo+a)Vbt2$}cw6X|_x-~G&W1xbtji9bRdDq-v1V!B%80Ilh<*;?Tq?%gCEIQDk zJc3G0U=;HhC~BKUP@lb={Q3+VDv?plW1uPwR9f!C<11_^p&ZO(peha2v-@uvUui=L z3{VMf|#O|BxOx*ib?_n8!fPGEmQ*zvYBkHk42f<}pw-t`hO9dH>5ZX4_Cg zIhe;l-Dsfto$|5g#t3S#&<*A>P*seQg^|_wo7$hMY$%}{%wwSD7^vS)T7K&s8%pQ~ z^BAbP2I{?ylLyYVp@eQQkAbRYlx$d7%Wt@BX0;6^bc1;e)I0-qQq=y-=Gjm}H<-sj z%{NfB@85Ixd>cyW2J;xG1&oqS7VDp}Z_HX?LkZnr9s{+|Ks8;P({rH>C3J&%3{;JQ z8uy$PuCbwnZZMC53K^&|6DzVp5!4W&8_Z*%ZZc3;9q%1}lMN+wgLw>8*g%c=*S-T` z8%pQ~^BAa`8Pys8WPZ8gp?NpkP(nAD$3SuK%+*DJtbg|Y>6Ka=O6Ugj7^p?ycWYF^ zt4Sv;vY~`-Fpq({#Xx0^`Sp@pY$%}{%wwPy8>qo^j@_}?h7!8LJO=7k168|x^R!!S zD4`q7W1#-dsIK@Y^USKEs=wP%LN}PlK-~sjv?>{cxsqj1?YS+28Y*;yc?{I;2Fic= zkcV%#p@eQQkAb?wKv`XrzPiJP61u@W2I@`&b#3s~#dq3JLN}PlK;6Zt82po&JZjyC zciB)vH<-sjEdj4vO~G2braZ7?i47%mgLw?p-3ID~QJ$UrVK|H0hXaQS-C!OAbq}Mu z;h#)w&y(-D$L5#N4dyXW_kuUl6Hhqjj`VwND4`q7W1#M1)Uo6d%&WJ!9=Xqk61u@W z2I_wBx?KwO>yy9#_x=cKn9vR8F;EXM>Ui=9=FFqN$a%nq61u@W2I?Q+jm!=#e!lAk z|FEHiZZMC5TFR&s@lU4W$!!ys+E79_mg0@sf_;!|TnhDl_4O+rw4sD*bY1f$wX)bylY$2?&}3Ef~G1N9`Mq9m&KmYVmTw4sD< zFpq(H%JA#Q;UjlEWkU(wU>*bYG^4spzwWB(H2P^9O6Ugj7^r28QnkZTomY2TW*bY45KP%kn{Nuzqk6Q8_jLkZnr9s{+4QJwHl=I^sVPg-F^3Ef~G1N9Pk-L7cHU>(f8 zkDU3E4JCAgc?{G_MyXu+%26GID{UyD8_Z*%UN-#dJL;C>Uyh)Xgl;g8fqKP26^?eT zd&Pzly1_gK>QzQ5J^bYBhmu~kp@eQQkAZrPQ7Ts+d@=2**K8=E8_Z*%RxwJY*LCkj z^kX9ubI*h8Z787| z%wwQ77^wc<9kVvrP(nAD$3Sf~P`A#EZro@?3Ef~G1NDZ18dCG~32)d?LN}PlK)uN* zl~W%7qM+za8%pQ~^BAbN48NY9`}1vY*-%0^n8!f9&8QyuC-YYGci+ElLkZnr9s~6b zcq1+IE@$`X_f7;wd%t0r$3Sgjlq%$y2x3QLG%yW1zM&O10TCNN5Q zri*{zm!I2EVqlbc4Ad9kb-R=vdPdLa`GpPtqc7SV-2?U??h9mTrAJO*l~ z;n)8%gvuE@`r(ST~r*Kz(iaHFx3qzkh8?qa^<}pzJW7J9bC$s$egG2vkLy3V=<}py;f;XavUzc|)|JIIT-C!OA^&O-7 zl1DJF$G0#1&W>W;U>*at8@yuuGofC&^RkJ%?I_j_<}py;Gpap7U}}D;y6Ss7igkl| z4Ac+cjm$eV{JQFeAM7aB4dyXWKQc&?)cG;V%=aK1N9T5qVZ4W*I)LX`I8;R zy1_gK>SypqBtO0DZ7Dz7QLG!xW1#jhO4a6XcKGVHJ$4l92J;xGy^K=r!$$%upWACg ziGfk(F;M#qRQl;TukW*?ST~r*K?qa^<}pye8>rXr zyX(O3b`-6-C!OAMf=PmHEitqfeRU>*ZSyG-4#Q>0(*Have(v>nB|!8``4 z6QfR*s2koL(%8w4V%=aK19g<)SJr_|i;l9RST~r*Kpo8}RrY32FI#xD4J8Ifna4oU z&e@1GPIKM%KxaFOb%S{fR2N1mjr#hEkvDa*qgXeX$3W3J81s!@ZZMC5 zqIE}+l`~^9-|FhIqgXeX$3Vp}iW3vkzq>k67Gp=TZZMC5>c%M5j%qjdqSS776g$T} z2I?3_sUF9(9Va&&V@I)WFpq&cmQkvuw_^L6ZO7VCtQ*W@pt>8V{I9?6)7_3@-C!OA zbsVEqD`m%?S$&VQp~S!_^BAb(8KvsVM{Z83I^K?A-C!OAb%Np7$#dShf2C5gMVq^%f@AK`+z3eE~4dyXWCmX0+2YvR*$#xX$ z2J;xGQy8U6fVdxi|L7Duigkl|3>2;4bGuZ$CKS)weyR;621c33K*bs%%-tWqB$iPW z(R8UY%wwQ>Gb&a}!~Oi|uDvxXD3g(SnBx{XU~n3vlpc2euInpgV_7NrdD+2%Vg!bc zuN8gB3MBw=h&(yIg-yO;Gd*uQjxl5}`A?t*89emj<`y(lhPtBdbRNV))qF!Eqw3OA{J|GYA3=xiF2%ohp@Szg`D3vYzF2RsO7ZQ@5tR# zUB&^_IFK3#%OmxaZOL_+dDBaRGc7)Np|7&$)2sDq)yU_WI7&1#mlx}1=49h+Yn(CM zDn=b&{YNn3G}Y3~3Y=V=mx-gD3v)AZ{v{n)n@Q(U7F0^F%wXkY7iAU{<>slkX5g`y zBQJY;CZADS8O$uot7tX6%I~(`tN66_UV1~XmH(wVQ_Az(^iUj?o5`o3;*jsQ8CA%{ zJ+o+rm6@4eUX+uWIZ*i|D5ub}7M5KB`o-NX$qS)D=DU=Z>gydun2^L>#1Ll;>M0cW9uT*T%T+7KTlv%e` zP8IaSb1FB>i$pt0M7C8&73&c*=A%uiLa9trZn2E-D*|4u#zvWZe=tA%jiI?88xiF)OSLAE5NJ9cQe;#j<;}<|of$+k5UhoTGp1*v!BtvTFje~`IuZC>18M?? zCE`VvtwmX?0SW9dEY!fWJ54bwE4V%{;+JdzQ&WOI7NkU=niqCE$Wb(GH5WPOuo7vl z_Z}?niQ0&miZyMWy?p6E}+D!yHo z^GCZ00~3?Z)*7zI(*|2d4N6Q(inW=97PPP#K6EI*8JsvQQLtnkl`9X1Sc`GiK5}rF zv$q;3ZsQ(nC1lypoNa^6O0g2^?B~w5#a9KsK|{^APvh}TjP}x*&1C2n8vaoWJ}$?%X@HpdhVlfQW~FtK>hu+5Dcl>brgz!;HTy>yvA4k*{_Lpf$(wU z60Gw*r_N(XM|zg`>NG0c>jS@Q&4r%jshwQjaMWs0!A|YG;h{hHTnz!&C;Y}uZ+x!Z z{_6UuK=Q`&wdwQgf_(z64T)Obj1; z`dw~>BLSYCfGf%hX-Y(4BE=!J-tXFk;040G1|%(U3!DrjuMVE?Sw0xfdBZpS80D|M zIM%m!yKn1P-f-t1{hjvvT^s$?2VzU#3xqcK>YHLc8$!|WGs<88X{^6`bz}3ZcpdGT zdo#QQcwcB^{nze;tE)eA2NUW)bEhTN<--hAB1sRu;jeE_O0DVPJ6H!dqW#r%(FjEO z&h)s|zUuuwN=F*}!q=plXh9^@_*{bOU*l^hgH+=~qC`T3@N}$LmyRSm$zR`;^h|VW z|II7u%b8n0+q)&T)5e+@c%2D(9dAkrGRj})vQj3mVWD{^dM8YnI2N|4;qj9^FD9qY z-w>RcSmz6KCh&*0HhVm$R>2L6qLN%6%=99?tvO#Egg$yhJG}MZMb&@R!ROjL((~fb zRrzW2_sr~iaqYRQJj-uv=dBsxKe)y_XD2aNf9~UY6=lWB*-~1`N`|JUuofM`qL7_&T9*ggYt;XU0j9l1 z#S05Q&n&XXx%;xy-tM4Ls&wd}QM9Iq46TB2yQn-Piylv(n%7aIXw3?ljv95Xu;Am~ zB5NUTt=pR#tx?x$9u=?qqzz39iuFIzVVnvnBkIvI7M7v3e z$w(PAROL$XCM5-DklW_X$yV@*_lNvP-7c0J)E%S>(^_`$U@zQae;4-zc~6n|40+Fz z_Y!%p!o3IKzdm@7%F^8^k;$FK^8HfW$^Iv4zf9WK$@?aGZfQuAiehX0?wJgML1BV|6E_ky>O>R?YXV+OAb}Z}gs|g+pe&+X7BO*06Os^y zF)UtG+))(Ji`y01ykG~AuqlX&EQ$d{31Jr@ppx%*s(L09#Cv()=l^~G=Nq1rQ>TAb zraiLnr&$H5*XDoh7^TDAnDnD)IGr-b!T6%Ekg#t_0vviEbhgy1srT=c}v6jxU z^dpvj!g@b#u~iQ1YxS!_<hqIj|Do%( zwfbUp_>5K0@@oBR$dOQeC&}8K-$tvp+CA24$Iy#Z@s>T!;-N3xonalHY3Y|O-oh%! zK1=Vn_$*7mY3X@Z{AA0XZ^b`g*&kRu)zV(;_yQ~5Axj^z^f5~xxAX~JuivY6Kg_f0 zecWn?ed_u&>Hq5GqQPgXWf8~%PTOP8Xq{&r_g8Dq1*YQlsn+Agzbt!zWiPPwLQ5~U zG|NskzWm!7Cn_y_xn&=)^g+wtoffBnYFs&F*()r)%F?SXy{5Wa-E=U3sPYZAj<2)) z4YlkImj1%>d)VS5tn~Y=dQY?b{N3UVB&z(IEWO!^&p@S)e{IFfvGgOB|07nsD$Cy! zR{AZL-fD5f()FzLd6pex#oKNjFSP9MEWOh@U$ZR#ldO18TY8!muiUa{SbC;)e0O!V zddIX%>r}Mr4ok5>9w)zz0ue>tJkiSGQqt9Qg<qM!^Fzx##A#FI z8EpB>v-B*qs;_xQ`}@VRH(BLrVb%9d%YU+^Q?2&+$>Q@YJ>P1VlUDuEs+`9y{i{_! z%BA|vKC52Xs=X+WIv=6-3bmhAUgHm|JuIDS>A`5JC#PBY$+M2nvb1UGa!VV`uaZw5 z{$)PJeYMLV^B7KuX= zkz}(4JPDozPl6}Gli*44BzO|MC7ew&#D&BnaY!PPY_^2o4Zj81^vi`>^lBz7P98>@nD5u*YDJ!T%8a55fNs{13tZ5d06p z{}B8Sfe(WZgAaobgAaobgAaobgWm_g4}Kr~KKOm``{4J%?}LwlkAaVYkAaVYkAaVY zkKsH#$a#1WorBIX3^N|N7P$#&j@*p2LRuqi9hhyAc1SXkV%SOVMBIo6KX&{$5jWz& zpDiyQzwzj6(buAHLf?dLj&4r*9;AE^QoaW%--DFzLCW_a<$I9wJqXW%=fHE|Iq)2K z4m<~*Lw@n(7f*iiIqbSrc#bZc~LbQ^RVbX#;=bUSoAbTT>_or0G3znS{nOnq)PJovHW z$BDQR5B}`p9dCmG$cKhKPHxmWe!5_L53p3k$aI5$lsAs$Y_KY(amv4uKJ~z>q&0Q z`y2h>Z|F318hQ|V5c(eUJ?Nq6q3Gf0;pltO_o7FjM;La}I}tbH!H*q3PQ;CP@Mp)L z6LBLR{MzyBMBIo6|52oiM(QIjBo>K75|L!{Z}2pD8axf222X>h!PDSr@ImlF@ImlF z@ImlF@ImlF@O$9*!0&=F1MivOYbABz8>_#cY@q4*z)|Do{V@Zs>`@Zs>`@Zs>`@Zs=#;rGJt zh2IOm7k)4NUiiK65%3Z45%3Z45%3Z45%3Y5hre?k{*E4n9)%u_9*rK09*Z7_9*53F z=Ng7d4>CI;oso3IPI@QeMm+ej`GY&f!I~O|_JC}O5r{3++ozR`oozb1q>F9L)kHh~s{Ex%`IQ);p z|2X`Q!~ZyVE<6{W3(tk;!gJxd@Lck1Pk!ymuRZy-$L@sP3A+<^C+yDHov}M(cg9Y~ zPRCBimi*h}zdioj|(+F+J8n5B&l$Sp`m5cT^JY;YlGSFSnUC>?8 zUC~~&7wtp)(B078(B0A9(SEewu#?`2xDgM2?D%maZp4E>JN}%A8}Z=Rj$bF@Mm+eB zB3(36A8{eENF0)gB%2xVF7Ph!F7Ph!F7Ph!F7Ph!uJEq#uJEq#uJEq#uJEpKFWd|F z!o6@W+za=@y_CmCd3=<|M|phM-LSi1cf;<6-5t9-c6aRV*nVt3wjbM%e;@vR`1j%8 zhkqabefam`-v{po?*{J%?*{J%?*{J%?*{J1=}CEdQl6farzdtV>|WTt zuzO+m#_o;X8@o4lAM8HZeX#rBzbF2C;=d>Ud*Z(*{(IuTC;ofFd%=6bd%=6bd%=6b zd%=6bd&7Ifd&7Ifd&7Ifd&7If`@s9a`@s9a`@s9a`@s7chS?YChxA8oL+(dLA`c)B zArB*uAde!C8C>ZGSGvJfZgfkP^+R9IV_$SXbU$=|bbs`1=-bfuqwhzLM2|#2fPMh| z5c(m*PI@QeMm+ej<6$Pz>?1Mmmn55OOQKLmdW{t)~j_(SlA;19tc z;ygUed3YH82%4{Y$a@t1DEcwIK@!-#nKPTcwJovTa*NM0h5B{S_7md_MTu3Yuha@7&=ELwu;E%u`fjG{89L$@WUkad2J{W+8__qS zJD@wD2cQR_Z%5y5FryjFXa=*H!AwSduA@HJQJ?Fm&vn>0VBdg!1NIHrH)7w2eIxdb z*d4GtV0XaoK>4nteAiLF>nPuKlh#SLa~gV6*31Moip{{!$p0RIE-x5ICT z-wwZ>cD;&ry$XFb`f9WX?LjA^6VbP#S$UY;t(eV_Ck$2&2BVfiPc-bLcOq`YgC9G7 zoQNCo;LnafC*npt__gELiMSCD{-a12jnqe6NGuYEBqGV?Rq(6fSHrJ{Uk$$+el`4R z_|k=kISHW;Z5&JO->#s97NzZL(t;{R6s--`cR@qa7+ugCxO_`e?i z*JC%sZid|qyBX=PC;j!Lzn=8hlm2?rUr+k$Nq;@O8N3<18N3<18N3<18N3<(p1|J| z_Pf*@#DDO4sj%ZemCWSP)n>ACBI}o0^n@<{q^e-ThE*hzixR6*R4oO6k%_j^y z{+x&#@!;2vUnk;5JZ4AAcMa*UA^kO^zlQYJkp3FdUt=Vj*T6f%JHk7{JHk7{JHk5} z$!15&$?p`KGLI#o6VR#XRP-I_JJ18s1JO^SpQP+}A>-BWFcG3W{8}aAMm(n23D^nP z3D^nPso1I5so1I5cVORveFyd(l#kz*L+T?gBo>K75|Lz6&Tj%d0iFO)fG5Bc;0f>q zcq%*Egcfjv}-vPe^eh2&x$}^Di45T~*DbGOcC$XQzeiHjh z>U|gWz6(7bJ>D=(?gq@k$m0e(4)`C4|AF`)i2s53ABg{f_#cS>f$%5cPr{#sKM8*l z{v`ZK_><&!7x~>qes_`IUD)HX$77Gj9#6ivknb(%!RW#0$I*`)l)xCR^1loJcj5mo z{NIKDyYPP({_n#7UF1I=J{~?EJ{~?EJ{~?EKA!w;A-`M5?-ugA1$!{|VC=!zgRvjS zejNL8?8l9}$#WPo1}Rec--7>J@P7;bZ^8d9_`e1Jx8VO4@*fNz3?B?13?B?13?B?1 z41XN{IQ((=~gk2wl zRh+>p&R`X1xsK%s1?$cOq`YgC9G7oQNCo;LnafC*npt__gEL ziMSCD{-a12jnqe6NGuYEBqGUX0sIa48}K*aZ@}MxzX5*({sw$8d@+16d@+16d@+16 zd@+0ld%kf{1|8o47r?Nd^dbId^dbId^dbId^h>MKz=Wf-wWjT0`}|J zuVcTC{W|ts?77%;vFBpX$DWTpA6xQ&0sk-H{{{TNfd3cp{{sGB!2b*I*Ws_jUx&XA ze;xih{B`*2@VW50@VW50@VW50@VW50@cHoh@cHoh@cHoh@cHoh2D`Dwg9tlw26tNq zcUi{c$WsVcpD_suB2$rPke3jyM!vV7?=V9Q^8@5V}D< zMsFhz$w#=VjY7nh_W|eO1N4XJ578f?KSFUr8G*TaNA+bmtl87XmAHY9^e+d5&{vrHB z_=oTh;UB_3f`0`62>ucLBlt(~kKiA{zl47Y{}TQs{7d+k@Gs$CQl71pXDj8|N_n*{7; zJrO+-JqbMt{S5jU%J&oH`-$@XMEQQAd_PgXpD5o?lV^GTmi`h3#olRlsH`J~T>7s3nSh44anA-oV?2rtB65&nwsSA@SJ?1|VDu_t0r z#GZsb340RuBZ&qB{a&qmKi zzlnYm{Wkh-^gHNx(C?z<{JlthUZg%RQlA&GU&ekJ`(^Bxv1eh=!k&da3wt*9Z0yuKx3S;GejEE8?02x=!F~t( zUF>(U-^G3x|8L^|P5i%!|2OgfCjQ^V|C{)K6aF^*ZTQ>px8ZNY--f>pe;fV|{2ll^ z@OR+vz~6zt1AhnpF8p2iyYP46@50}OzYBj?{a1s@jH6E@CCD^nI`R+XIfN_Ecn#so zGv*-wMBYO_MwTOn`7Z>^T!Jh`K0%ftP;(Ws8u<~~hg29dNb)T5JTeop<^79(@Gtbo z=#SA$&`Z!u(M!>vpg%z`LoY)wM=wXOLa#FHq<122#DgC@ew>IK@!-#nKPTcwJovTa z*NM0h5B{S_7md_MTu3Yuha@7&=D*+{!#{?94F4GZG5llr$MBEgOW;f3OW;f3OW;f3 zOW;f3OW{l5OW{l5OW{l5OW{i?&nJ}U6Uy@m<@p4A8TK;lW!THGmt!x-UXHySdlmL7 z>{ZyS@c#+^Kf(Ve`2Pg|pWy!!{C|S~PvFbo%izo4%izo4%izo4%izo5%i+u6%i+u6 z%i+u6%i*iwtKh5PtKh5PtKh5Pt2hsqOj$2meu|i$>}rE+iI-LlTi> zb2a=&_>b@(;XlHEg#QTt5&k25AABEtAABEtAABEtAABFY0$u^HfLFjP;1%!+cm?&e zQBNDX7+s7Gpaba1=*j3HI*5K6{WQ7+U4ov9mipVMkB$1+sE-Z17`qs|7`qrdfE~aN zU7p%tS*eVkh#b_WIpmP@;<^U)mVry z(ixv38xg}~q%;}POh!wSQO#sjGg;-DcsB8D;>~2_H1TFKa+-KDS^1iHG8fSg{y{(Z z2l`p`v*_p0&!L}3KaZY?o{4@5{Sx{W^egCB(XSeI(mN41;=zv{KTgDrc<^V(pA&H- z9{k$z>qOj$2meu|i$>}rE+iI-LlTi>^B?eM;m^XKg+B{_7XB>!S@^T?=itx5pMyUK ze-8c}{5kk@@aN&r!=Hyg4}Tv1Jp6h1^OR>M<(Wx&W>TJ+*e_wfg#8lsOW3bqzk>Y= z_AA)0V!w+0D)y`RpNapO_@9aYnfRZH|C#uoiT|1Km*6kKUxL2`e+m8){3ZBH@K@lk zz+ZvC0)GYm3j7uLEAUt0ufku2zY2d9{wn-c_^X_Uw>S@Pq359Ipy#3Iq2EKlhkhUZ zK6(Lq0eT^NA$k#d5%qbC`n*Mb-l9HlVb8&ygFOd(4)#3kdD!!?=V8Bx{T}vv*zZxk zw;>2huoqx2#9oNK5PKo^BJ4%j zi?A2r|9$+wkN@}a|33cT$N&5Ie;@zv!xz98z!$(5z!$(5z!$(5z!$<7!WY69!WY69 z!WY69!WY38!56_7!56_7!56_78HV|9gsa*74EY&3Y;Z?vu&Ob*BQ=O&uybUvvN2fM z7$#DNu)}2hfY|c>&3XJc`cw3$=+Drfp?^mIj6RG$OhPBZ&Xvgu%VdRRvJx_1Gwh^y zB5uTkA3J`Wh#T?X&yGJQ;zm69wd2=`xDgNjqevHx)JI%MEE0z#BFW~z;h(}kg?|eF z6#gmvQ~0OwPvM`zKZAb;{|x>a{4@Ax@Xz2s!+(bV4F4JaGyG@x&+wlq&tb}QnDQK^ zJcp^TllnT*Q_xe;)6mn<)6vt>Gte{8uc2SV|6%+e#{XgbAIAS-{2#{uVf-J)zZ3sX z{5$dQ#GZmZ1$zqi6w*6M?Z z`T+U>`XKrszUloYGoQI1sWj}QcOq`YgC9G7oQNCo;LnafC*npt__gELiMSCD{-a12 zjnqe6NGuYEBqGV?KjB}%zkq)M{{sF6{0sOO@Gs!s!oP)o3;!1WE&N;fxA1S_yWqRv zyWqRvyWqRvyWqPh&jHGFfbtxmJO{83Vjsjlh<%WHmr?IB^hWeX^nUbybS1hH{|E4Y z0RIQ@e*pgn@P7dR2k?IYeh_{Teh_{Teh_{Teh_|;{L09$jQq;TuMB%5_D1ZD*c-9; zWADe_kG&te61x(+5?k^w!+#n6%kW=@|1$iS;lB+3W$=ygjqr`|jqr`|jqr`|jqv^O z{qX(p{qX(p{qX(p{qRb7CA<<|39p1#!YkpG20QA;N`%qV;7-q2i>yO7AfF?fk#7)o z^o;KidZ@uDYcL`jClJFl5qhaf4>d_`lG-GtNlKHH=5}NULT@#XAjgnjkZOZo&v`I8 z4<@=4U5Z|VUV~nXUW;CbUWfi1{W*FwdNcYP^f!i`^iIT$c<^J#j}vht9{kzy=S19y z2fudwIuSSG!G9F#qLKQD3yDSIkVGWeG~uQ2Qg|u66kZB1g_puh;cMV);A`M(;A`M( z;A`M(;A`P);cMY*;cMY*;cMY*DbG5}vySqtqde=dKga$Y`*ZBiu{UFH#@>v*8T%XT zZ?M0?{s#Z+@V^fK>+ru0|LgF-4*%=$zYhL6{B!u{@Xz6&!#{_A4*wj!8NM058NM05 z8NM058NM0*4g4GUH}G%Z-@w0te*^!9^RS)supPYvy#sv+eF%L7eFS|BeGL5z`WJLH zy4o;IMl*8*_1R8+wo{+&)Mq>P4(uJ+JFs_PAHqI_eF*yy_7UtO*hjFBP`>SyZ#(7N zPWiS|zU`E6JLTI>`L@G%z<0oRz<0oRz<0oRz<0n8!4JU?!4JU?!4JU?!4JWYz>mO> zz>mO>z>mO>z>iR#W0dC@rE_0)eodINd`{*U4R z82*pp{}}#{;r|%^kKz9q{1^By@L%A+z<+`N0{;d63%nX$4X=h*!>i%d@M?H9`L8Gc z_2j>v{MTb|z}|qp0bBB4Px|$wUr+k=q+d_^^`u`<`t|S)@D1<{@D1<{@D1<{@D0XS zT*F@@TM%Y2gR9-(YB#<|b|O4+GT1#b_92xBBY?rxZ=6I2)(chzYqIaTyK>vU~iav@y zjy`VKN$*75hzCD*{5TOe;=!LCe@?`Wc<^h-uM=@29{fjeFu#aLN#XgFC6#F>#aqQ#R$ML@t|2y%&6aPE$zZ3sE@xK%Q zJK;aTe}Ml0{{j93{0I0C@E_nu;YZ;|;YZ;|;YZ;|;YZ=e;m6^};m6^};m6^};m0`- zzj7XaMV~;QK%YdPL|37!(5KO-(Z8X8L;sHc9sLLT59;$P_4$?h{7QX(#Xf<30{aB^ z3G9>DC$UdrpTw@huEMUuuA+RuQodg)->;PKSIYM*<@=TL{Yv?Mg`a?*fS-V$fS-V$ zfS-V$fS-h)gr9_;gr9_;gr9_;gjd0<;8pM{con<~UInkBJf|toY07h&@|?#04f{9j z->`qf{vG>w?BB6}$NmHR59~j%|G@ug{GZ1EY5bqY|7rZ6#{X&jpN9Vi{|){d{5SY- z@ZaFS!GDAQ4*wngJN$R}@9^K@zr%lr{{jC4{s;UI_#f~;;D5mXFbwmIv4_ieFY*&o zfv~bPSj8HwHVv*~gBjo8N;bHX4X$A06v7p3a0PQ7&u|{k;KzLC{( z7a|Q27ZQUsLM}4wq<122#DgDOo*jR7bQC%Y?La%wb?rIg>?qRPjcBAk;zDAPI3y8CHtp~zBO0lX zxR6*R4oO6k%_#gi@aMpv1Ah+eI@oov>tNTxj>eA0j>e8Q?0I#u>tff%mhwCB@4&wU z{|@{+@bAFC1OEQSG1)TbWy z1=ts0Ux0l9_J!CNVqb`TA$CLThS&|U8yZohi$>}rE+iI-LlTi>vmX2c_yzC_;1|Fz zfL{Q=0Db}dLimO73k??%i^L&`NV0h$ydk_Hydk_Hydk_Hydk_H<#ACS7v*tL9v5~D zb_{k5b_{kS>_*s)up41tgnbeAMc5bN--UmdQ6F(3u}B<}h$NdXcnmxS9s`eo$G~IY zG4L38BX}ctBX}ctBX}ctBX}eDMevK@7r`%rUj)Ahei8g4!!R#K8Y4{*Hxi3nid=?V zj$DCUi8Mvxkf#vt1k6(gS3l?RV&f8g*zy{q8>5?`o1oojH#!y_i@p?nDf%+>W$4S% zmm7A{I}tbHF)zk$jNKT!F?M6@CfH4|n_xG=c4ND--PmsGcQN(5nEG8z{Vt|{7gN8B zso%xa?_zjkcw=~Dcw=~Dcw=~Dcw=}IcoTRNcoTRNcoTRNcoVoA?uNVJZnzunhP&Zz z$`ea@VhuOqp`Lc?=|tR!hx*#7uM=@29_nq+yBzy+?8~t)$A2vTWAPu0|5*IT8gWP> zl5EDpFNI$UzZ8Bc{8IR(@Jr#B!Y_kg2EPn`8T>N%W$?@3m%%TGUk<+%jzd3%ehU2^`aAR~^eKZ8+h7$>eXgKBS5TiTsLvJH zS7Kj@eI@pl*iEsUVmHNZiXDd?haHCmv=2OX&Ot{-47CQ}}-h|4-rnDf~Z$|EKW(6#P5* zcku7v-@(6we+T~#{vG@j{1p5Y{1p5Y{1p5Y{1ok7pZ2bgZh&rpz67oFmi+B-C*npt z#IqC6iMSDu*#P?z>`SmO!LCUsX?6MQlYf2kuTTE<$-h4N*C+q_JD?@D9DR3BC; z@;zTHPUQ3169b=RjiC*L(NldS4yzhI&D7t}ccrDKYO_tN9UWMaSgd749Gyzi%ZHWF zS@n`5#yNiF>pZ{tYmj`gaLw0$W#a3sFX+? z(&-nMIrR}azxrD_+l8Vi&3tPlSaCu?;^}XK4js|oQjv02ywsSO)U)GB&&)cHc&wj| z!RHZA{Eaz}c&rnQ{PT#%+QNA0JmN{a{_8yAaSvc@Jdb#+VT>QnBc7a()8`S7`wqj! zBoO&I*ZGi9ApSh!v8FOo&NJSC^NjcKdBkI#XFPWv@mL=k@0~|H@mG2t@t6~gZRZhB z&fDShh{w9rsLu^zhk|K*-XJn=XA9Pw^$ zbJl=Gygz;T=DoAWjXp%0fxms0Pbo)gOp8B_FETRAuMO@*6L<@PzKQ)@HU4>IPn15;v z;oOlCP|B5id-%ZruLIXnMQM45`rq-ltB{w!a@HK`e+6nf7`v@HHlDu&Rp>?jrl`=;U+EPNgXe_me;GQ|Gsg^dY!`p~tI&S_c2^eTh58Y? zUWEn`l5xUej39KC3f1(-ze|6-rlubb`cpq#EX&1#D+^9dee#-;w6O(MbszRGm4Vwe zd&Rg8OK0iOgUO4f3IkW_E}oOE`&&+XtFI+2mSrBebRrvA1*hx}UbNV*5-c`QMQd~I z16MA#=_B$}*kY*^i{&S-vFzH4)|Nvn`O;gMwBx{)(n9QhQPWWUlFa;5Psp|KvN>>N zMz3Cjd|Ca{{J!)-X}!Ak&CJN^V?-Y8-6yS2hC0%}M_+$>Cx4I5-Idw9Pp^!$OcD?3 z+gnG-O!If?(JM0}eUP_LpX@>2jI{KOUMg;{jLaVWGX8YOIn{ae}t`_4(ijR#~?rD)frnw$?DN(P?sKkv(i=k&ONfS26guL=pAxs#Y)HH zAWGA#i@!(z2+!#moqJ?v_o58G9$Dn;^Ji#Bx*!=@oqJH7L6#SqsE4kb#*+G+*xPDQ zmtJX^8H4&}Wemv9=-kKh8a`g*i9?w_vd`)|sCP!6KIq=6d>r>>^~va!mF6E*6I-fA zQ+Mv=>*MPT(FF@7=$et0(Tk(my?XTN(YZ%tLUETK;RrjF-C0NV8Scz^?jvndlXq5+ z%#2Lk%4vRoCw-!P{=U633{URpk)y{vJUY>k)$LD+j0Nobs3*m8=P$o~{wrF3ZTW6= zJG8o5(RU#uk%34N(hVs@Bu)wZgy%c%(zA;ZS-wB;%W={%|Ne91_nmmcE0`MZQ5^L4HKG zBQiqDMyXr1hosgzB(>HdskIJCt#v3q9QyzIE?CZ*d_+gt9|JmXFv`Ho2FQ?$YT%!ACWB z%H233pE`f?oWRj2oBWkoF#F{8E0n6GPNm}1N+s=Glh?-e3$9_;D3nU3RX!?CtyI#JqHJ;xC!dO57v!;r zPe_$eE)qT}POVhZSEFolM<<`ur+4jV$Dfc&)kYmORGeC=WDyu;lb#}OlugDf`M54>mT^f$D&09$ zoLZ@*FGbm;(w#%asg+7{smZJ37hm~!(hyFiJBNx>E0wf)lugPY zpWE(urZdka2C2NYNe7fzNXJldHAMH?9hi(>As=j)Ji2+R!zNrZ-3(+_VdH3bl*^MYNe90 z)m)Wd*Sqx_cK^evbl*^MYNe7M7-b8M@h6^{)thGp;Z(YBs5rG!#j8}(XXLZF^>s1v z5vg?Fh=)YgN_CYS3Fq~g(d5CaB2wwTq2drv-}Q*T8mYY-EJqlvhVx6S&0DCZuVx`b zUVr&}>chs3v$jdclCt*C7RXOrjT<*6^pmZjpIG47Ab$30I6JKT3S_OH{i~f`MI1ex z-}-tWSAO4VEWbJ^{ss*hGjy17bIZ2vA~sRu|LZPlYwIVF;$;_A&!#_7W*Hgf6S+dr zNB;ab-uQq2H;|;qe0NsXYIpRk-!?iciZ(;P3B+#0z?G3TlAc%lT+0z^EgRh`q<7+L z$Kj?+;@rc}8CxH2-_G(QNAyS5I`R=+(;Lgj{4MxbYaWR$cf0b@>lq!^fAu-~pY+C| z!|utwSM|pZxTxKm)DOrCAN0^ze(Wwset7opf7d^oS*sJWKcDRGK?wN2K&PkL5& zRrm%2xj)xU{C}@!rL@z-r`4$0=nX7Yu8@TXA33|KXQi~#gP1z1zdfu4aUMQ9UaRC} zJp$>79#oJxA6fCFy2@WtiXKWWfBzt(WyHyr)YHRE{0818=%`Gozo zY}3|S#;D^SKxg8NlqCZnnU|HnmaS4E{mHD+iUmRzBA*(6ty}ByS09%>i2=mf*+kni zvuS^=lOh{N@Kz?pgVw}Y6nl7W2;?~BlCThVH>)WbT3w=oajiZ9wiF4|2 z`k>rD>3AtEt*R+7hj_k@JVUru$CJz0idQS&Z8v z1o(veX{%Pr){vu)OLt#DoL{VX;d-=enG)HrW)bfX;=Cdqf=}2V!+m5uWH)OgaURN2 z(IT$%q&AV`RWA5d;#}NA#|ziDWlF8_O6H#=;&ij()s!!}*7=p`ua6Z+d$igwsb#Hs zM#jHk#Cz;)f2~{AxAw?09WkMs@?En0TKPr%$%dHC&HY?UEzgk0p>XjyM~w zc;S9k+nuqNczcL5zo+&WZf8zgypuSe_R{gf*GKCXEh78#?cm>t)3>*d7jC~+ zDYfPgsnj4Vj*b~>zZR_{`-|KWPCIwJTH~bD{oQlKi`?0hd|b%)XT>|$^Vmy>ci=qY z$vw4Q2EmBWx%|meJw8~DOoP@23?qImi7)4JY*RUY|u)xiEV^{Zaqz)=N@%-jpS z!3@LV{3550DDA%uaj5U_-mXIGSyjLOWYR)1Y2giQ@dh?V=97E5x1?{CH*m@qI1+Ln zjr*!fyYk#ZekqhypXK^yLJ_XRj{U*R7Ot3#WLKl~g!rV*x)ueiTIdI7jZ|U!%1?@> z^-b#|KPwulc4pv<%)qL^w^IG!z_H$<9l7;%>cGmSa%rV4ZowJ#2Da&=MW(B;1(&)n zP_|UI0=*cRzdevZvwa+4hO2lhuqpC+Kzk;Q*HQvRnS_1Lklol1U3toD%se>##^ z`-neq%9~#*KL{4CXfQottS?Y}gkq+-V$u@^r@0yxmxruuu{MRQRIyBLITDEOPl(}f zpM-e+-kHz>{MrW!H+p`S)>EfxU7V+MOf)gGNQ56sfu6bv?F)8^rx4`?i>h<$rL9&$ z!`0uEn3L+Mn8h>EzOv$ZDEW97Yi*=@OT5*-z*LC`muPajeSz2JNlk;9j{rZA>;j)I zmfQlxA4t?dv4`$L3b|(F2af!Kj!9-^oyGFnf?O%`JF$1B4b;CCdjno~APysyzu&2l zT&CZv(5P_e2|_#7v48OQ2Njyb-*OdNz~7ZB^l$#|QlWMHU9Cdjgpd6k4xI{zE}%#1 z6!IKThi(ps(!!zM;m|NbyOn4CBsz3$*SZANrL&J%GE8t4UPVY>g*8J$ydHOo*18Jo z;?rBQWD{-XEy+J3DmYy=G?!(dR67bjr;nV{X2}%kbD^+Y8KJOT456@G2BENA0HLsS z{ZP0?L|D3e=(u$BP*|?VP*^V4P*|>LE4*A??E0EzK+8xnH3)dBBtHjSsg8v@i9Xw^ z0o1@AKX9e26b{rxsy#e=rFW$I0~`H;)jpXv)~5$YjrEr-kyd8RQJ!R?>f|k|cFicw zC_3nxv7+!xSJ4piW_b38=POsC{5EiUK+SU7{DITVH9pHj#WGH2!6$MF8#(EbX?~Y{ zN@hzZ^9OeM1IJX3GX6KgTUy{Vt6$2IOC`%8pH+;-S)>oSQdRLxDc-ZCg=<_ztK^t| zbIBXXsPdL{PW1+Zx+nM(Jl+5^m^V=2FUhDP)6gtIE=4iootf7cn7KwW3}$;m4I%hP zj)iJ+aZM?h$*T+a-!NQK8AjTt^~t_Me)U>PRCp_aw7jX)@Ek7`^6|75OM{nfV&;dsXDBB)jx!DX6+?96uRuS-}Ds4E-rbe6Fn3-hi_HcP${V z;rxdd*iGI3dkf&hI8h+KFq$e|%2jxj1OAkcWZ-s9mFuf4&r5^ILY;Zv8(85BtWxy~ zl==hZGG2WuXh>;Ao{Bi}LMK(|S3=rLJjK&q zZY89>3?QVv%qDc5N+J7*%~j|JLON~zs8HH#3F)-03F%Sic0$^V9;5<$S;)xnqDNwx zuXJ-*bC#?cL&Fm5VzrcwypYqlkOSwukXadp1{{{pz4ggmEElo2M6D6!T2^P20nJtG z1Xo^LpcWWL&c&fcs9K#@7l*ECZy;KYsL~4tu9Vw3U3o7d-Ej93(v_FfsVg5O6jAwF zi*&sj&fi278DVeo2dBtV#~bYL@dl@El41w^EYKFq>Vf-$>P>;t#qxe8uex>g1}BzV z30s^`!Xi^8b)}a^F8NiH*PaoQ)h$GD{MZu{WW2KFw$0>PeAX9IP{h5+cILwc$aj-8=PRkyw%*hR5@J5nHc_(CNV_!4RK8H+cxoz zDzi$FnrnhDNJC^6?Qj)}8*eaQ8p9v#MPodp8$(vB>Rm#AU^7#eFHo9R{S{|CP)ccZ z!?=o8lDI;y9be!JU*H>W$&2;KH#4xIdx@hS=hh#{V9;f-G1F?MH`k;h$&)#-V41E@ zp~a+irC$EPn#y~~Z#K1O#oHfWnSnK`=9M?s9KV%Lo-GxQz%eyA zUL~LgNhZzfb$O5YZLGnLRMsVqZrD}HwZ;w@9B2QNn11R06tlQ&t_wsL$# zI)|%hG)rvKI?hTfi9#v5N2I9dD!N6dsCQNh#)5E)OXU`*tVsF@k*m}4NJqjcp*m-ErimZbRNJpdho!@Dq?$FGOj;oh^_}Q9sF00QC;iN!-jb7za))sr z$7GG}Fdiq=R)zjW=(Gy0Bc#)o;&`n(wuaCK71~VbHx)X^H8eo3p==-b;K7WszLHyP zoMWFW{ZyK3(IlzkNxm_K*U-EA17G+9D^HZhtlzU4Gq~8)` z@G2OqgGUJF>EOPMq=UY|iHh-*!5gqw9AX~zmcdXmn0OOU(p|i=w5d{!;+Im2LDZ6XJD;y{*kbXfdBW;1r6;~+U4PVL`hJ*Ba z<*vdPKtUCUE4+@Y_+jinz5OfWtXg7KrE@>0%fdox(gkGTv#s{oKJylQ5+fyN5D^DK ztL6prOh{6zG`cLD6IFo1rYh#SJqKWCdp=6ftMME!o&yD`kr}W&R2i0;bJf6hs)4I` zKYft>fl1`*9dhAhukFi@)w^g{YwttWgAYnU3O*56hO2N1e|1U4t{AR!Rrv%?`4f+N zQ`UF`>%1=iCZBDK&-M+&kS}qQ-zrMV8rPH?NK(+vduHNse@eOEe)1>I zmcqG;zLcg2Y*TlX6|ajCRL#TinwfYsX{|qH4Fy=^dbQMY#$=1Xn$x+0LRgI+4C)H6 z^CqtF2L2(&i2~{OF|MMfQnQp&SJ7bXV8ICfmU#atkjCyUsH91()TXAfgPA&$f~x0T zMLnrf2$x4${fb3IS1=O+H-;VM?n>y6P4!%rt%#6-w`z2EIA+!xY z>Yo>!&fge)GU=+)&@w|wL*I~D)6jIAh^e}vYV%XNjqBrpROO`N`jLzZKV|wpuf&DV z60<_BU924}Np9f2!lvCWwh9xM87$W82081hFq~^$f=R^JHJ}BIif<)JWP=u7!oVvH z@GcQ+x7qg`;aZllwB~=5P@6S6+uXFuhtfi8roa_^|@Y-LrMO+eNtm0kUbC;hg=vir)p;F4xlQdOA*mNHa&s76i$G7nu^ zIoJCVSxd=%Y72j0Uu9jjkW+Ug18T1j)R3=-TC34>w^pvO2ISBzSxjHnuJwNx3LT&K z7sqc39iL6T4LT3o| zP@!y2td2K?P_;VtI3bVv^l4lKQz?zV<9{xJk+SYd^4?jbIm=$BSkxM+Ixe= zlSnEZw7EYxF`K6SYY&lk6zxM7b7OBXD}0y4uEtb#2b5nX=h+*i6rp9aRbu^ULfsX` z66G-BFs|mWyawhltv0;6xb` z81S90;$;%`?EgN;LkoYPLfuqWkw&GJL3~m+u`>fleYR3>!E$Tma<6!>t>m^$6)!MR z3PN(6sD#8XQyJ0#On|?+3VBIgZcEOcg)G^9+>Y2*)nxIZx;YH_k5_e`D3dELR30oZ zr%FN!A-SI@wYiF9m8EXKiav%EthEhK3s{k4{4pwybJOKy-ic=+tZ6&+< zVuuP|QHQIsPpwngTNlPUkE(BlW|_#s zTuL;*?H5LKSK-gJvTCQQG*(EmW~FH4>T|{)9KY2nifd9!$>|&oSS}|m zvNI(|oMo9=gMIa)UK(WwYt)JtNkLZ&mG6IY7JHJ^7x>I7$JzaQDl|0D=Uyh8o8Dl( zh)yjf@JVr{&Ow_mMLnQ#J>5nXXal>R(j()o2REuQm_tR&5OujVhx&rg%X6LZJTJR~ zep{tKILfG~VAQwjML(^O=aLMBy0f14CT{npeCZ8r;@p>VLDFq~iSz~CnNz-WP5pxI zL|f7?B=u`J`(O6zHRp6h(MC6DlxFFhvIv#o+hbiTsB5t)9YM+4f1^6XLrLV|et zpPaepsmx!Ls7N=O)rbE>_bD1oOp3!WBTZ_!3T1ZJg%i7C9Do0pJ?kV%|DszZTjwFN zlY5AMR=dg7TDTxwAg7%Bl;318rchp>^9FPW*u+K;qt!m{f7Z~Ayljv?;Z51})Wg^5v6DL0MjN9DH9R^dr;o;-h*oaG}G z3!S?puD{%Ul^y@&{%kjUNjO}6nuj(QYJA8g@oZ^5#&0&>va1;59ON1ria7ry4t3hl zfLgeVgSrX1mW;|Je~Ms+BS^I?XV&%gU!_P*c~m+CHBR3DRjGkr|1HhoO` zqdq1(Yx>wf!^if7kKIgD>UbRprK#K=BcxNvy_#PC9SO&KgW_rW9U+~zH5Z9KHkyz= z_81}U@9QvaObcpSLP*!GCCw=Rf!krcNJyTKvhF0*MU`a}A-(kfHGHfw=Tjf+&Y+?f z{JjWmR4MKx^j|jj{C_l_vPlq#u3li4gFSF=`t59m@5B%iKUp@Rc2BEU{0cSkKzmVNnjLzI$@e>4z{hB5P8n0cQZbg z-ME??<6O7Cho*qm&9Zez5^jQdF}aN*t6p>^Whf}m=6nn8&X#3Ad@3pZ?*5WJrrDCr*If|6RM{|4-j&yP#z)qUIB+8PZ8wtjl-BjNd7ao zLv1-XP$5azP=(})iGHm1Z1~vQg!YiiVSGqPu2qLo$zQ#-t?r!oFFMw9hMI?IdPiI1 zf&=k#Hx=&>c8c{?ukjUBwR|{x@hllc^xaMmrn^kOEQBWo@_Ga>q7^Ke#kFDN9`Ob{ z#ml+j6y(bxDPD5|e=G?h?OXew$ zuTGjSflzdEnx>9VRPnjjUFZ!=mqS)g`y!o(e7cJJa1JL;e>>8Xlr*63_d?FEA#Eqb zp?)egMz!54>_#e7bJuCTrIsqKllKartWru@^S3mx=!nD_{}yNdV9 z!4maC3R7F?-396Fg^S6H%hL)>qaMlY76KlPopsbq5_KcWaQo}FngvXPT%qrf|IHGp7^bU!X zJa?3gFuuSCvO!w=4UL=z>=pzw_5D$0M!|C3DbIRUV`3gBK@T52V!Z)xa^57_xU5%} zHv)xI-cA^7g_3pzw$j5>^@Mv@+Mt0euO)(>)Y=o06|+PAR=0kTEu-4S>exy`ja5iC zmz$`N>}p-2Lh1aKMWw@#vvyR4h7i(E=^r2@OIC+bLa4tAEg|%a3T+{zA2v%b)SD@C zes!rL1_zmiY6b^A0_pzWPj5)+cShBts51QukT>w9Kd{c~jk%q95-^QCWh`LK4$59L zuTgq3gA-*ps^$p;!?4_q>j%|;e%>t2$CLBxaHY5XYOX@-ZPEM#YCb5LpO7c{1vbhi z&>alr5&dZ%jOK5w&uo4gDF`KzRJ z)>?G?hU~2T@vN2iXf8LMUG44lq|ou(@RE%<)Q``&Ig<|cmHv7iAZ;!^kFTlbue|W) zFp|Qdu7q^FQG|3n83-;z9L7khbh!%2#USqnI*eBd$t$N0V=W=Q&fP>vURQM(+X?A) z?yfN17pBL;v~QXZ5-L?#PT>%E+AoR}4=zVa#q_uWIhC3nRJyM(5!GHc2TEzx|z zXm0>&%|djP7Mv!Tts>H}Z!JSvC=J7X18E;sULlsaJW%N_&i5 z{389B4NUUV%3k*3O1Ni{ki30(u9ucdG8tH80sn32H8z=&<&7aGH#T6^MO~l+dcE#7QHjzbx zDHlzEm0wBUHK8cfe5}0ilt>gk2TAklIp`5WdJZZkr01ZQ3F$fLGeYuinnPU=aVliB zT+J(9p{9$~O(*ZR(U9@l`VouwQfnHLlBK2kgZc9Imo@LGdk%)U4BjN*o<}-)x%Ue82tS2t z#+(^y+c?=pDkx=P+%+`Fgx1BnF?pD3{il|Q1snUYy5pXgK0fKe#tU zg``RK`IqTbk9D$;)Z?Gb96DY{LRTrzBf`gKghRD@MrdT07n1bDHukngoG6xg(viz8 zcIX7;IB1Vne(6FHXDEpXYL8OhFwy6MVY^O22P3DK#PbFk(#zu`&IlWrp}w**bZ(c1 z4yt!cB0S~H3X!1CQ~59ctH*~esPEOPZW)9QAr9kq{>m+l!;n!_x9OYVV>QFJuB;lP zm&n{xQ#+S>@6TJZT>f`M&EcF!IVAtdA>z<*4wctF)SE-{@GBx#Du-IsK6Dd@2Gl-u z8KZBWI%GWs4xHplaZt|-L%zHP=00gc8H}4!r+TWMZNedMICMuiG&&s04~J%iLvzES zrG)g(g`Ot^d((rRxVk#Ub}wn1$DQYw;c2{7-%BKrLiaY6;vDM(*&dUbOP$-K9co26 z727L|2OcHrC70i}P)+p_kDNz^1`Aps%~}fh@~h$*HOKXY$;BVBSg=Z_vQf8&H$|)! zDx3c21lFyc>X)?ZRg~`_;xO9tH$k;qkgmYm*4+b;S}w5$zE9AN{sS`vrT^ zjE$d(Xu|N~rc@PK%_{}^{{YskaX8WPzXDr@^U-}b{Qv1>R*Yy~8aF4_8}-2vO04EU z`M)kWs35&wFNwFyFm&zO5xQ2@?!WtuTk?{OX(`J2!@M2M6kE&vTD2WrJA;mAWf1XS z0oBTJy|?5sZoBoEVyzro)|}Lpp^c8vLNGM={COehVMrOcGLHPNQx)rg-3Q23$T8o_Pzm!DoS8TJ+u&d}jlIk6c zbNru@oQq^_5MIz#e%e?vG)n-F=iW~h>jfj@{sPZURv#}G2n{G^XZlL3ZGB@Z{#!5 zkr@|M?XSkYKA~xZ^hv2Tlv_(hc?X8&+Il)$_SxCRa}%F)HC-p174BQe9B&OhD$B~N z^3+SuwK`ikg=(;xWGg-4a%G0gl^YJ};VNP@`OBtg=UOyP)-Frr-t5GRdb!OC*46ue z*n1cFD2uCqd^fv7KxBhr4T>5N6}$i;;S#x+g#>nS1F?$QDvc0=pxjJ$0b4JLn+V%& zywrN@YpcC#t5s`TjM{1fmLP2v(Wk{eII5m2}jGQrwcN20cI@S7jlGj+}-H7JJ6eeh~Cs$ z$xR5{b;Y4Sy3=vjHK5mOkr2);;kyw;O(mAL&Xau{JsX^-x+j8D*K+%{@mjSZ%btq> zPDAe1)Thjc*_}TIX>uPn(uQxUlCQE3o}Pe!5mb_Ms`6jTSGCU9;*5OpKDr}lW%Sfp zknp8j zLtddNV>n~)51rv+R@0sA#~-=t<}5RH0%aD?x$;AS*?I(TEOnMf&P=+Fm28l>amKk+ zd7_$dTPMYjTt*N&23}H~T#`z4Rsa&#MD{PU?d5=6Ov-8TjOH%X7axk--|v`-d|+3X zsp%~h{QVpvk_0_W$n+l%r^~FG5B~p9HQvU?B1^BaGb(Bx8r(Dz8aLF&Yetde(J2L^s4fn_)&7-v|L?_*R0<(FNIb?1LLKAHAVqKe3GXr)23(+Z9DkWOl z(Jf!|I9XG6m2P+{Aju}j_er30l(l1mQairMjpZWy9u5@Q2vyyRpG#9W@Z+7{#FOu* zOx*cIa}EiKay0c@_q4N=Bhw0oF!`)TPVl8${XRF_fvB4 z6*(FnY1$+i#e^>(E7`P=Udyqei`$Xi1KPM&$P_imOr-7Dv0Sx6;aubzBL_lD2oil3 zpMG-9s7@Cvw_VI0M~#<6AdTPy)pZp2+|gCwKlML-#i^8lQ#eSJe9 zoWBdlPIqG;6rUun^UThUehGCLKz#{x_#?M*q;QJ>ouYctmjTJal%E1}&Dy5mGK8!E zj4y9`6os0<4GLRKSuLZwL(Q%9Pi>YDmO%&=sC=mfy^xCIUKnQtXFX+h;SFbrqywLN z7v9id!Z^w+)MmD};VwnUptLvFnNlSbT4bO8DnPOpE8QYmtgQ|1w;1QxgqG=LFE6>I`j+eAUJBLW8E`Ugq>71Vbhg zkqEL{3UbNx0xBbMv5Itx`)G)I@>dCjzTWN*oL(3?Ib4XnvUIp0GI@FdOh(`n85SD6 zm+c3#`eiiO)~;N!0$N7hKWpmi7A&estXP`E7wGZ&mCJI3EL^&1sgJSMEUKeY+nOba zrLMlgcjUR7{G0u6BJuCyIRU)n0zB8CoNMrVE8qzJF2X~1A|6qhFA(cmpaB*_ZD_y2 z7AmyRPzx1Vhl@>+q&q6C^^p>hjVSSVtl zn1!k>bhd@gv(N<=y3j(4EVRTz%Ph3YLU9YNwb11jYP3+Zh1Of>YZkiRLf^2^troi7 zLU&r|`xd&}Libwe0So=yLTwiMrG?rp^n``BSm?JF+Ge5WEcBv0?+;EvoZXw#&cCZ z)YsxKPd-jTA1=pJfoBQ)=}PfPUlxeo0u8WGfrSQJsL(<~EmUNo5f&P0p;Ih0)A@2~`flFDxs+!I_`RQE1;2W5kB!1BFXffsxg8JP>3F2=1Y+9>#I_TNZ70xR z3$g9Qk8LMVk%icH;>WfVh;1hj+fE?1n?P(kf!KBem0O5yCw^=@f!KBevF!w6D+t84 z6Nqgm(1jLSWT7P%T4teD7K&SFt%WYPP@{#KEwtW3U$fBl7W#&TZne=(ky%A{FZM{XqMG)q-l4ruuqK(G`wCoqH^fp*l4LL^ui$0Y7Vm zL-wb;cm2*WmQ!MJ3{^XD==$Ob_-{n^4g<7p*h9GCM|vd-uBclB5I9BZf(N7`9S_?v z;6E8};@(rV^sizp2S0r0TO5;CUw&DD!?eI0f`l#otMB<95@R_GJH+A`s`H5s#{ebqr^6Ht>X0p${M{ATieVo7@O@2J%V9_r2yjnpANEEgfQ*hd95t zIELzGHZL4Ej{^Q4zVWPj?B0+V=D`o&?G`7q6tju%|1I7nct%Y7`{xh0rI^o73dh~f zfIo~(vgKy)h)ovbJq)Y0I3_=f$sXX2z~hu+SJm$y72`b&TV`<#RX3xCV_gRPoY6Qg zUYt7jSTWv%AHH`jj-lcWTRM)sfS+>(+wz0hUsj0m9)?|EaWcz(hN7B;H>+pyEzh4e z#Fl*qeCW877w~@*Z$>lJ|Lfbuzz=@-*aPT}L<_Rc(F@oC;f}%+@N*`j+i=#6Au;g7 zUjrC45y4}SOtSsYXLak?iQjZhe5LUj>k-WhfGiGd$d zO|m$K>KZ-Xxyu#s{}5Dcz~2sj;~Qe&hg4s)IELyj?Q^W6dJJzy{9Mh$!^OZ4e)xW3 zaZI@`)ILQB4fwa>&B2ua;TKLQQmu<0zQq>Dq;;4cal;Vm%rf)lzWy6A@I$I07ROLg zQ48I0Jkp=p#eRFyk4_$L(;8uM3>DWHbjRTdDC2Xe5a0dtFZkd%OEt~n7^)9txGEE* z0e=N3=uvj|-xiFpRFqZdM)(ZX22FK5e5G&Dl?j5kqw zP7C%q!BYL%;utD&NxBp9AT1P%ePhIk{?kviR38%o?nIlzlpbFr;T!Pp#+!9mx$*18 zBQ4c+7Nc=XJ|gplI|Wa`eQ1~lD*s;f&!fj$stYWRp_-s;qgYXK9m3kUW$WkjiY?U? zi({zX)A5W`RCnUdw0_svw{V=L+G}wP)pqT}xh3Gg3vV{g#~YWdo8_m^EwfY&7ROLMq5Cs;1_J*1coSvjinR}%W~sJX979DJf^IUNfd5In zS%~6P^lOtX73Vg($+pk`Q^zv}z5)Mhcyn0Xck=h=OtDlSSR9kq4>i}Cs;It*H{0v4 zudSau)l%JSaSYWJ+Gm=gVjrd(_U@spr&+3`#W7TeYM#J4cg)%q{{G~7r(3E*i&La( z7_)-*DOXfu@uus%wsvZ{rJ|Yzx^mQp*FaquzK+4p3CX`c7gkg>@~24fQaB#@dAg#a z#6@@OzWW}VZqsVh{ZQd}sAd4yG1$51;9uQ3!&2R&=P!lhp{h_+l+);jw0!fB3QILr zj}(RDp{fLKz)u;K?zGSo=T};)4Z1cIjtYNL$1@YZ0)EXdeRq9f=Uwzcy=58RqwjYO zB4GAg%y{hd+KJB->@FUk)q3pEQ*h3eKMG60nOQyuW%>LiE9RmsoENijp4U9nN&SK> zpYLb+tjO|7W%;z}I&@_-Kghxvo|SrkEwedP;Vi0j zme12f*G{UFADWC4pG&i-%CpjXFspA|oE6VMHScBY5_4Tv|9MA`3kPRgR{xo#=UfNp zoU9z4tNXlzb7@ws-js#Yl9ivKStb3@Q}fH~me;PjjH!szUKg^n^mq(Pi^#Wa#eqQM&!p~ z^=v*uue!9RZuzSCWf@j4)rKNXU)C;LTDKxzLz}D%me;@n=F0k|7F%H@R>2l%T^5E( zU`af_s%F)K`i44(+Js%YYC-KKHFYca4ZFUE$t_>7wq{X$!NO&AFtdqJre&~KtX=>U zt{A>zpwsSonsA**Zi8lctwEmaR_82YV&U?oaeRfpG*Q<@mM>UU zvvfs6UA;pE^Pm?kOf0ThwQ^O>;(C0&xACd3{HqtxeyH`6G<2p>n0VdVc+EwqgZibl zS!gCJ4EF?squ~(1;suFiPRvUe#bGLU#Zt$|ThTd!O#Gf8^bOB%mTgVFDz__csR)S`z@4Ka^g`P4{^h6ucTgkSuF;l%fm#cnz2E~ zPP~4>(q%k+Vgl8OU%A2zDtkD^TOt(&u*}hwZ0d$pD>1$-LQT!$#EROQn$e0fYfUl-pka$v;mkEYU(a^eqLG= zU%4t*wxkdl6+w3Crgi^ZxoVjw_@V`?z}gnolff>nZvekskTW6OHJ7efyfRll8kQvD zi&m~#VUtxHbLFZ!$43_ygQEs)55~mNaLF(|)GX$>uylrdaJ1B@>B0Byy5%cZ*X61=!yrwAC=Oz2bt_@wU(rC}d2Nkq zb0xjxiVd^8Svb^)M3xIn^K6VuHScGpCQQsEec39fDB4fSih{LhuwA*kYwB9)y7JXkQ&U87lEU}tV$Oo*CG_;v`a|G#W7^1O@3T^NC&35y8 zU;*IqVB>o{tXQaga}-0@ylwOqE8|ORos6r-t;a#*`bAczTV5AmvT~6vo5~fqn)M*A zu9~Heul7+3P9xXVPzqgBwo*cl-cs?DS<_cJ7)_g+zim4q4&lXRw;SL-j`r9H%+boV5?9xfu5q0;?S<<={ z4GDH};iV3$iN!P(*q=zLHhvwlxc<@_tdnvzlI=Dcl|0vyb9uU4tus7cwc;gxQB7&O z59-x`618$B=CpAFO(%F6r4V_o*C^1bI5p|mC2^@2ECRKZ=Y!4S2}Le9HVYP?38kef zq<8|1Vk_vv{)?_TS?%-8KS>UT@`oy^^6mXqP0l**Zgso102v^76ZxIcx)Fdr$b~nq#FN1e;2nz% zvK@MpjJu{PzHu;0ZDYexAHauVoAYYD)yX|ag*T~;-(9VvrMx?VV~!N?6OO{0SjMlq z*3Ce9??Pezf~__>R-@pJ_mtxt_>VXGz1+r6rh2##W!YiIw#!sfk5ifu*WY^%KbMPj4Dw=p3fm5l!a5;FTCGG;h3%n-a z)E6=~IVvIPmU`-$$8$CU=M|0Tly}@jcYE|lz%Jmt$8XSZw%v+LCrl78_2%u}5jbD; z3q}mbKay@)u^Vp`{C~$&J}xJC<4PyF{B8ui2Y9Jt#M72{+&E81WjepsIEGxOJKo)4 z&OqR6Iq|&4?Ee6~Q;tPBizGHX-bzb74SWZJhXAK73(wPCe0QP#ehZw2;UIwHP*M3C zS5oR8a3=uoHQ@B+fP&+mw3K6PDUS{qcOigFfb$!TXY*G)alAW&s}b-jaORyTljpM`nf>;n|7!0vrHv`FL{K zvX8<4Ea2Rs@eb2?a!VAKyhkcEfY5v3wlVLzmi+zbzk=8jjwNP^x zB7l_zTndFUlDf6HD=MYK#Yn9uyDGIJKbl%y5QSzCa~BhEHH_MWws^ZyWEE|_whAQchpLlk=ge~6TdYc*039&vQStl*eeneRDN?(Bz+8YsxA&4TfzEs6gE?(k=&q-_H3>ydq43yLQN!W8btCU z{xFiM5=r+F8HNjlG7f!HHs0jgB46Syr7%fi@BX7J-bNMgeRr#P{~BL}cw_0+`M9_{ z30v#RW)_&Al+e(3_x7_ZeZ!?Fa*n|L~!9z4R_-HrB;A^`)VrdU^2 z$I@4>Wr5Dp1sdj61nZQ4qhRN@zPE z3Ec`vLi?g7#E)O31&?~Kt^r2SR|aUEf~bO5DAoX4ul&9WNGLdcrj*}LE#4!5zN-BG z2uNZvDhAZOV!v}USp5!<4Gjtx;VB3Wf`*ZBIf%{GV((?}3SPR$EqJh^a6T{CkBN+W zK2o+D`qptP9p;&!sigz_MzlIbMy<(DoE=Grq@GiKyFZUh1foNa};wsJ};A&#;j-*5;oMV{@_8n*8pA9ZYCC*p1)1^Ta%wLZ+e^X*@w6 zrJJuQ=zP3e6~ro%P&U-H$}daTfYAtcS+z+5g)WMuXRM9*af^HJLCOqYBs6226P_qC zaHyb9s9;V(sNfvbt}iqwf(ouK5~U1EgAW8Lb!9K8u83W)^1!^_;N-?TDXdjWUFG_C zb02U^wngg~s$;D`Z3IoM6-KFA#{=?pmm(L?eXQ!5%3EJXXUH5!e~^|*UWMD}%?|+~ z()2hFJN1Nc&3GLTj6;Kxo=Iqj30kOT+F9)H@*(THgGOe63 z)Upsik~o#0_3gM^d;Gk8uB zCLmtuw;-Qd>tc7Nd^?EWV!zxVOx!XoI)Ly8j>L=`21 zcM>2@jzQlaS7y@Kii-K?N107)#j0FqdE(nw-?5YR0OZ!;i?hj2!{~P0tz$m=}-$=R>m< zjqdFQ0e(jKo2b-`$=~QRRRxV}hhaGUoIahEg%PCoYrY#4zcZ^B6KQ$+XXK)BDC9xQfjng1R9hZ>6^a!ZvN>J#rDv% z6KS1)w2na{VIEMRr+f7 zEwJK!7)O6n-ei(W4^?+rI^%s^Mt%M2{Mgbnz z6KYoTLn~9EvBG9f5S_g0OilEOFB>I=XvH;9z)KN~^WhF~3+U1pr2V>hM_O#BCVOrRwNMF(qyRmuU40mMJ=^j_NhZ|HZH!1~3ug>E zrA4NN?HXxqrKgjC>1?5v$5n9d4z~$r1R~(8rgKKpXQ0E~OOe!_0eQ!L8RyDc(f|rw+fZ>w`ls@y{H4pT)J{? zB-OGWnNsQgG2Di3WHWA3(W+B^4$Jn`oZR#Tdj;8?(s0uZ3c0TJ2SERY2WDvSzFk3k z@Rpt%1JSpXA15K{^$9@I>(>F2UQaglZH4z^KtkIE=nmz_!^0AD0U+0yFhWwbQW+_x zS|Y8p^RrtaF{`&B&lY$wvjt3tOsU$(WM*q0W2ahGgJ|3peme@;l)}vbB!%N*M+&z9 zknr0$p#M*0UnZST&b~}K8QB*#P2i=i&%0>YnU&M<%;X-|UJ;aa{CW z3=qw6jb8MjsLMO?1l9d3sr@j1OYNTpNNT?p(03HxYP{XGZ#7NHqEXv9(E?ri;k$v( z#nA9*>$xy7^{y_MsOZJg1}5#w-VG(0N*k9~ZUGAn&X3^t>;D;P>S18wJdEu8M+oY8 zHj!;XwVT8XcxaWsCz|XL$u=6AfmzmsC9tlu>7yo~!&Aiq@uM)3h7_*(C)9L!mgSatyPJW`l5;P{yDPX-D zp)Oawo3QK^g{&qb={ZF(5L9GW6v7o_lON?Alz>LvpAi5Wn0KVG`-KybZwjyHAGTJHqZ%NnHV?JWp2^KxiZ0&^@Dg*4Bjwy1u=x(SW^MLYh)TI;q!Y-xvp z#$Q_ddK3~_Xi!{RWdqBDDHx?>-*&SFk<=Biu=0yGP+?*g(TVF1J$KLuo$ZLwNtl2x z@Zc$!pNfDjtNP;Y(WVcZKpzcFe=g?V74dI$6!pgoLn9L~?(qbR;*pu7t=Bb@$gVY1 z|E3|+R>+N7a*MJ)Tjxna*rGz;p9l8gnDeEV&9-Et{)}iEzNyN5Q0{iJ5^A}WtDn{c z{K#C4Z~zQ51#;aI1Cl9ycNt6~#7k8!(q|P^rFQ5{=8k`mixgadby7bb3=hSDuDth5 zg3w1i(l9rs_(v=&OeI4G`3-(XQ&?zVvWNElk)h^?6@q7V^+S3|4LYkemAMGa^_eni z;g1qV`W$3mct}L%I0)pPf}iEeMi&=~bCG{x11kXi5KmC;nMk*0rxl13wLm`y^eu(= zG~U9Y{TLR~{ke1y4t+Ernf%8Bx=T^;){2M~Uj!svI}S+1fUB(Ebrz3{W})Rij8JR^ zbhnD{&wzyXT^s5L3z0OA2PFBM0Z8&U50K=q4v@sW7Ldfu9aV{0gmWm7Oy8h58Vtt_ zL~E7ZKn@VP5xU;m0Az0K7>VU6u_+aJm?FJlN}L(aMISKz9z1<^Z&PTN_`-#`o+{H> z(u=l&VI&x`r5~yK;RGQyPz^|GU?Cu>f#rZWH3WT)cuNhKa)%yDU60D37FWv4umk1n zaz)ZjQYY>4BO+x@tdWL+p@*7C@FOmD<3rSz3TteS@(n^cA2q;c)EcJhur>&me0vfl zjA3~b)IcyA?!Xpc!xV8h98^{IX5z`>cEAbb{wr(2=Bs>(LtzjN zrRvxfNbc~{KxCCK<&T}5*c+|Fq)c$bprT!ceL!o z#P(R~t?ppdUsC{!Kx+ER+<-mTW|>{%6SJ&Tz$Vo^k7a!r*@XdAW;53MP$T|ySBH+} z8pQ5%Jprwuh0)2g3Pa7RsCw3k1@7O)vZl?U|zF-n>wAC75M$FIKL!8-t;{Ol=y8NYOPC zer7(_yYh#jpXGCB-hMd4zAE>b#AXUANVQtmUlm7wh{bT^4zpvvNiAZ#cV$=}yEdTZ z&6&uu^tKv6vJ-Wq_2Ui`mvpkjbd7?l;kQmf^KEDyAff#_Aokm!?>0bd74$to_b8~> zeyldJA=v%~`=&d93Z|J4DwqU~mw7fA?MS4^QMNf2n*Jt?|6m^9?@YV13S<7aVx!*V z+z1o4Y@zVuLA# zP_PAKp3m%Hy7N`#%~z$)mu#>qUCVBP+&0-1WL4T^7NGCq3HmO?TjmfOaGJ=LOuP({9N0#c?ZyoU!px?l$64d z>Ts49`a2^%o1$f}Bwok#0ojCK{ES{#&KXjM(*e0yf}^js0vb~DzkKP9D@kX(Q$C22XVv~s+86$guX!7)ATjuwK3H4HnEG8 ze?CDfr46_BA=qDN@r9AU*b?Ek0eGvZDDdL-0Mo;KmjAUAKPIhY1%jmd_$!9wx^?h;q!F*#6 zNh*@(5hnP$MDcSUVH^P+@uK>H-IY$xFxi3GLnCgu?I2KgpA>F86n~M)?qkDk0|D-7 zq5;98#0%X6#iP5Al)56-#O4*2gcvf~!f)Cl!=L89rJH%%Zg?;LiC+A#GybEIN%A&) z^1xeo)8&BpOC(j{P1KTjuk!neg(wLMMLug&g>pw+D2CY3A{%;=4K22zlWgd88ydBt z)i(5tHgtgvWfe-g^)}Q2dc_->wh(OwtcpoFWzK^IfEU$ZdMljc9bT9ON@p7Xq7(Y&hVrMf7B)ciq^1 zmZKYSF%jVUI8;moj{H5~=Rs5Qw$wLwy(+p98MfHsn6!@4Ib_QR{A_EwQ~omIHb*z& zFpFcT!rF)V5)FN%nzid)sKG23&J}7VguN?h}MuXTPHb4K=wZTay;6Dd%5c)2= z?r%^QMTqVLi(|?@N0*C&LBKx_;Y_vq);W6|{fTE=97A;+BZFgW2K-69*^_Sg+_EPf z-H4;$LswvP*oVb{qX6Nha`YY!us9~IdD@44&7oR+!%OQOy@%&p97A=huFS&}6*(B| zdC-g>Y`$wTQcA$=V8sgc-zn4b95SBWpNDEtGfRjuBa&05apfc4}H+l zY4~T0W2hd{@qA8E@pvuMtLvM(&CyrbZgC9N<+`LtC@NFOU!VN&JC44>t1XV9+CioQ zN3II3rg*cxmcRAmh@-FYO^aiw9@lvuqNtcVx~CRw-0kQq{I$g~RNv95e@t^A_;mfj6o0D)wCG z=px)?aSYY#+UICRbr*hd$56e*=7B516Y%q>FZ~ksZsgSsYTi zdCSR)Duy?E|A(EC&LYcOzMZ8s{+V|46`pT#4AqCa&yP@4EH~X71E2Zk2wV0%P37n-9IAbe z2d<;<>4Df`S3CL&hg+P?8aqKzkuTAG{_rnzD~!(k?xfoWbEhGNOgNa5vv#bo6q;U z{LwzREQI?|>WB8>pRb@#8z<<~vV6ETX`JA6>hVrr@p;OV7X63l9_8Q!vwZH&%JXVn zc8BVuEUK=o)T=x=x%CjO(BssJd3#ps8yTpb6v*f>rKkAZl$FERb?f)@_&&u*Ky3(9dT;Zu_`j5<_qJ~AZFy7uI)y?n>0=c29i^%KqRM_w-G~k$wdQjuIqP&Q@BeG-g;;HM& zUN1}9uw(%hPk2HZrP7z zZG`5t?QZWYe=1!!IudsTrajz#S;}rqi8Z}+TceC7XR!pu+}O3*b$9!$K(E3KiNUB_ z$(cyDc9l#WC~P9=#0^r%%N*4gpP*txcQtCz=(UnXVMfkieTn-3817CiH@R(zOn#|IqGlm(I%j0T ztLY+JWrp{je2#EOO@}x0-iSTgHB`^0VvAn%SZH->$+x*>?+G$J#N)}K>G6;V zGK%a)5tRfUD#@79eIb8y*5#5+6$84)K8?xeokH486`*EOtx29E?30ph;tn38c5mC^wH`Xns_B@;@E1(jL` zWYh9Y2$&PJT&i+tWYk{%7JU|421>oR-?{1i4G6XETCn9Gxdl9)JKolf1N0mM`)J|T z;!P~GI0TmCITASQG#({rxh*`ggyF`e0o)H9qrTqajpK(*$1xKN5%^6liZfb?&#OIv zOBsI1{3sKzq?B2=?rcCuLHJ&&1#qHEd5b-G-2Au&I6F0-O}ErWrGQ^x@j*S$8}xF^ z#s{qwZcJ{sy#kznYCNu4RJz_v_dag(^Z@4=y%=%u#uvNeBi=~h%*w{;DhvOUveMsRmbV|LE!We_CtBk zrU*~oPySLt{mc6J?fgyLyOhk2uu#N8XIV&PN?kfTTMky^Oyx3M-r$AmFC!b1alAd& zT3>{Vpq0gM;E;cMjyb@$DViRrG92^ojQBV4pc2n3rCyFrzN(=9d3?3URm@}5-5Fg~ zxJvj30sXJwKAHKTe}SB19gj>&O_f{dA`8`9=o4F0lE7iZ-dc7z;*!c?2R}d?&o0n8 z$H9<353@HrC6S{w5&y@!By4upx)fogg~$oq9pDq2Uox%|ilt{3@hSxj8=r&I9`1gs zznnYW)hQHHlR`xSjlpA0WqUgxFLv4@Zi)oHgmynRqFWV)eY2WtB+in}-^Bf6DG}cS zkueHndzADibISc`lq1x<218t*#%Y~iRE)!49s2&Vb4@VWJ~GntWW1yzw80nN)1DVU z1n*$tt?t9sb?I2TdUp)RYI-&*?`^Sk`QDg+BYt;35orzn6B)sYuc3_*{~wLT=xC}h zPF{tYgGil+d;ObuulYo|emy%~aeDq4sfua&gbE22;wlUB@KmVzDMU6sw4vhkq8aNe zrWM_tml!(-SOsj9X|vOVPd8OGJAL-)=x@@!8BsxZk%@o6>1U({06TVi!5OL8w1T^X ziLZ8#EN(v|HFO%2E7%+i_!JFthC?rs;N3XL!5dvnuaM~tW*XpDP8x+gSb0Y3f@v!M zg(jLpiN+M7Win#v?i-b@$E<@v>ZJa4DCbx_LEn3Lllcafu}4l5K_5SPil1s+WxIR} z?)KuOs4z|LoU@<1j_9{M85i@zF0}cZhV+Vv?(M|qMsy1goFKgWy7WQMbEzldWbMVF z4{%(ni8#S|ap)uNZHW?PAr3_b((jG@qSpDc{GP=r())5eR!YYi6ki7MCe>>@FQ4I9 z-Q)QuI_JysT=7ufmjeFf_{CI*?Va?p^JRIS#W899MEj5*1^g5)NOj3qY8N_RmVah( z3>Ci>(dFX__&IN~%!l<|`5o7nW%$tL`wZ23@z7THD)Ea{vv&RXGUvuhKe!M4ZsudQ$(T9 zMc+B=G3U!N^FcSjmTR0&{Sf#D{G6`o(f`4pbvj>-Cs`bm)(zTcprWE!LXY$ppLoUj zYRpSzbOU{cYLoT}!57xN@TSLro2v#nUyYx%IEE^sedMb#2&@wUJNLJYDHhA8dnPAN z<76Zpr(>qC_;`1EbAJVB%%XbGaFACO_RKCr|>))*W95l*sQK76Lk6^XyByonFY`)LQ&Y)87?9V z-y9xcZlVBBpB8kj$C70|@x!^~pa}4ul6)hbeN<#}K9o($2(^4+F5t>qMP12wK9*{a zbnH4P^2nuA`@itLRa5&%-iPiSTqA!v!st)n!Q;V=SB>z+2jYCGq=EDDi8<;BsX16| zf*@}7E5>z>J&D7*hZ#@a6JRt2Dw_V0!o+=s<8w)f9F^=?+dZ%iRYP9_j3> zisG+bdB>2Rb$$GKK4Ir7)8j$=1FQj(E4f<7~+JxnAxk&?`;ykq6mv?C=wE+{T3 z=?d+`&&L5jyFbg*u{u%-BeM$hmc*^|d+N&Yy7k zcmjS74Z1yxj@{}=NiT}0OG>KJK4e1PnisZ|d#=7jQ}K_Czw@(vjCAARaFu18Q1NDz zaX8z8Pc?P==f^#eg#2bwRU4pc9{xMRjc+fORA2J&dnXtPHkx5GW_$_EG27_OyS2}bDVgvu%`TJ1>n+V9&MtCtfk%r6>8f=P zI8*tVe?ODirKH4@3|DSk*SekJ-Whv$+zPlc7oJB?qB|BB?B?<~@jp16+7?dk2;gc< zu;Jk1_R8WXyC?JZTqODWhq2Z(Cn+zl_MvEC`Zhc}@a&ET@}kL(U^Kb0JXW?f@dj77 zr$jqm3 UQY}!pV@I%fyO%x^2o8!QHx@+8wk7`V960A4o-w4s)i`^Hn-{#&{i;$M zqoX!fl|8fO(3pP>D=uoKH2ZjWIRrq)Od_m@;AYQmxBKrz*#O`MNOUxZ=CnrMh)=p0M5r6 z&y?4F#1bg#@UzkG%-?k71?A;qN<9jh)sp`d&e?8f_|G}qgCDCd;%aT2O4E>B=Zdwe zB84Aj6^VeCdZ-aFU*tzN>+gkHCamhZy33h8| zYkK=u1Q^W-lrvNFc1Qi&c=uOQ=a%C_G+#{a8bzSo;wcZa##srEvD4ML@L;B}Q1+!$?za?n`n?^UUHs3I-( zo*_4P4|#cYlDe;t+mKr2pOK_n+M}sgRH(}IZp;We+W2u@P0XVg6EZke30T#Ex@@9D zOBa!q6>2#MT$+mLSeaDcrgSQFRAGe&CV$e6k`tgpS;N1y`N34UspIbcpr9 zyUxwbBavNru=vr5(=##9!p*;watF4I6%fdul}A`piX~ z^K=%N8QjR>8_%hqy9l=?nLgc@t_hH>{5wmWOX6&A-(U9D5^tEf12GUBT9M{jr5hU+bkp)xDed_~2HlqKBs#(TH| zpp)?ZT2nbY=)9>(*AGv?&uNt+p7a!a=Cd$7Kzj?4UCpy8eF~8xt`rTTEp5TYPCJ zMf|>who0hdsX?$lMY=W|oS9ivO<6wX=88jAPEb3E@-Fief5pdqg1nv#G1XoF7@FtQl%d^$NwvEpfp{Y+L*G(%hG2_Q75B=imX&C|ytFU+zz1tpV0xyj~!{Ru6ReYspZ7dNM;?Hj2@ghE* zjjy=aizva~w^^NVZ@Y^@WZKN3vr`MP!n>&8xeXnx7B#Y!trs;NALoVJm<1yxK=?YO z?N-d@5K4+DMVVmA5!z3sJOV^VsHnLm$x^xU(6L`fE4ic`A-L|=XR@F59tcyV69Iv3 z&Qx#S)pwvHAW#aVa|DE&#Y0V>y$J|r)7RMpnXRcrKwy7h6VKXr*9=EMpv+I_T;8Ts zMJECR>ybG;_O#27a|DF(M1XTPj}zjdH;?rX^+!fr?uj&e!b!SFr9<8E!7K9vpF55g^Hs>3sIhpV? zy(y%A2rO@F0jp$eiNpCgGI6yCm1_EzyYH*O9IwxY^G))kGzh=k0u%#fU&hNJC&QnI z9NbPgr1y*{<0D6NJHadVL^uoxM*W1r6%J{B$=?(3hiWd|PT@`RM5j1PBo|(>cVEjL zkA+>FG?E$=ONH}YJH4qbV$L9z?jK8k9=faWzdAo!_GC0P>&a-@b|_iej-8Q)zL8XZ zBvtJurTK!BU1~~VX+QL+PR>gl5=lp~bsU*IJKv+AB#Iq}ls}sGN05go$y0eyM~y$z zJ@H!No3Z=t?nl~BM%Rd^i;WtFDC;bCJi1q| z8Nbt6XURZzpHw_c+t(yI_nD-r%0~|?$kbv&)Z&-LN?3poz*H4Pw`r^ zYcG=&36;WqE`KGl=MKm%flG8Sh*=|YcP`p2AzO%)le$i= zWeS(lB)?eW3pQGJj)MM!d+}c3&-WbiGXlM7ukKM~OTyc{Rt4XH{{W1K-5e8e7O!}s z`MjX~-$$PaVg!7kSJsEXSH)Lm29-inJBL@8F(O`qSM2?G$9aB#F1&H$Jn2&Oz2ZM8Y~}A6c)6^ck&*2G6nJd@yu*#?0D$dZD`d^ zZHT(Roh090!jCu?Vz0R(JqicC7X)LimmL(^5bnFavQOxt@Ii}Hl|gKkwqvVw7o)<* z0PHy@b~)ch@OeW%Lg3TIlt}W59e!B2!cH_!jVJde;)f>pE=@e2ykeIxF%1dS?e2aO zKm2VpIg}`lrI+uHCO_)C`sdxpC-;7wII1Ewx?=s}U}!^SpYZxwd7+0YgNwtdzUs6z zNwCOT;`w&Ku{Ik|(Dy~WIa2gWD|b1cuSlPSY%D}Mzl?HDmvT;bmot{ySe4r1DXsbh z?r4ow`^Nv_a#z}NU+gWn`?!BBeP}d2y?`GLimTFJ%nvtCJ}oi6?G{vIB{tYwXk-M} zOQ2`)a6lF5Glz!vY%Gu0Dccu~(V^vSHv_e6FH%r}$*tuTsWXQb?}@Zdg`XHUa_S`< z+Ay>vJ@gJ7$ijEAp3TsVn&|F6BKZLlxF6^+G1XsU{2_i-B3G*`kUf>3aO(qw&|9DU zI6t)R282dh4;qO-vD)ARQGdHafr7{#5lEa7U8EZRfFf=E>0u^P&zsRWQV?@%PAn-+IR%Bu=k))avy#xVstpUZ4plH z?H5`X!kko@GD*&@4K`Kzw=iR|^mNL>sO#gZWZHOB_B5J|2r@P}H$>SuXA24QRUo~|JYE=(M0S- z4&$8H9yqS&F^<8T4+Ol>zRmkizn7+8u!OTEuFv#ZHV}DBh*7F zrXb|yMpzJPX%U1#ZiJrTXYzwy!7DawKBwN^1giC|+*~HGf%qfNk{;H@^02xUu8$aO1uqp>-D`BuZt& zEhn+Z?AeGmiop*(Dqnh3*Hrv;bAM#BZ6KXjGoiE(9H4j3aPHYyK*>XDr}OO=*8M7DCP6K`0WdD%+B< ziQ%%%S50C;B!=Sk4K;5;8h{Y^J`!y@Em9e-KzEc31j)L{mD;=Jf;4$WHNMAJ>XbFF z2sMu}9;&|hu>kzypm{#Ox!%K&Yh^K5Q>ma%=VG z#{GNhhXbzmSG3OFj8@-Me^_N`LwR0hYefAFC3#5|$9yqtd%9*bK4cT+S4p{Y_!!Wf z9RA3Y!^iLor38bE4@vGViVx<^r#vvie(`?z4f}0C2sgdnbJfS-4O=PKFvneE_oG{Y zP_f45-{BXaqEPcD@kbOA@-rLqBS4uPJ2~YxG}v_r(Oi3%I%IGqBS~#nHQw~Publj7 zB_l!x@I$xwd`8$BxjmfRw+PmsRCxPy7`;gO_R!U9(dx)}BbqPNQjE~9#qd#ky3vQ> z>GLgtzS{wj9w>CjP@5;!GBhvT+OVy>@#FsWf38Tq)VTB2#!ZhmesE;{3*qDkqeJU< z?n9!fm#RYF`$PQ`UBAaK)`DtnDR3veq$++TfffCARs6(;d=C)kF7zDL7YF3cNKRRg zn)u^hbgmxQ5a>wk>gtQGm=XEKHi`=~BCoa~Gkc5t3U}l`M$cpx)GUR8iH4l=Gvr_p z>QAa9(WNGyCU)WXH?rZO)*3&^#nNFgvr2$U;jxdbik}PG*h`L^ITVXBzb`d&XjcXB z4KD$Mx(7K>yd+qari|li1!R zp_YFD8E3VppJxwj4* ze)%%5hFY!#N%!a4=2o8_Wo1O?&N)k0MjUH^u9XNz8bS0DGydVT9QmG!C+K^cB~Z|Q zyeXmvealgY;>TmR;&%^5)yXP!9N6Lv1>FItTtWBtG1f46!JaF+pzkm=qCjO9x(pEh zn*|3xJ3)X>Z9BdZ(M)YbK%y}D`oXH}qh}=M>5CaWpqqN;{b%-c3`9rSvvE)uH4x4h z88t!4cybw6b{|gQQ5pDF%;|%tLCQtJW~OaZ|`^T%N7Egx5giIHfE8yN()m> zB5(dC$cgCJV2pcf*9-#-M3KQci=g`U%%M6bdfH%ym}=9Go>w_G!$UFDQCEq9Q^(>@ zyzf*>n=sfdaw5@-+ncvv_Fp<0CkskJwb2z`7)jr-3N3|U(G%|%nS2B7rzCKq$H9*T zlxHNR{&=W|z@QkZFIWF->l_YBM+r}JQbFc?3P zhE@}kFt_i1M2*M-Ga}0|BDW=uX=_As-GhkGG>KwJ;$UU|tDn*w@05%un6}4HYb-l0 zF@SslhofPavS+L1_z;PhRV-Qt_XFd<-WNZ_t_@J>J~^Q!-CC{Nd9w#mUc}fE12HFH z>zuPqqGKBC-Jn|Vzp)7IXZ`5LX$-wmLwMUi9SNf1n%_WcKX@-HKmmDIwGZag`5-X;W;;RP6{4XlWU}NGp_~fcjj00kWqXpScV46O*26Fq!j@A2F zImZ3}p8rf8uucD8-T&WR2b3HjG<@>#Mn~~G&JFve6FGsI5W?}VSEqa7CuiY5ilIxu zT9E&yJUUnAXZBx~??6sf&wsRRpC<7GmEeCKcHkQNpU3}+F?^aT_^ffri|KOlWC?M? z+<0y{7p>dR#FOi<$Q_^k+nu&MZ~rdX)R+6OJ5T=){=csV8qxW_h867~tYr_!GX&4k zc!uFQ9?xWiy^AH`Td0}~fO{dHMR<6Qp9eZG#nS6|Y)zf7wx{Gwx>&^FS@fV<_X@h~Id{k4N?d;`dE~iYzq3LL)77iiO5nsMJFIKrOLMu~4~%DE~`n#6s#w27b|@ zU>T=N=!1h2|BHHyP_fGKZ@~W?-l$67bIbngBIh&^mhZ|rhbr%ojOas^Zy=OZ*Il?g z-#HER1B+9nLdB95BSM2BEgp+F1kihi*BILP@NziYNspU=fMrSz|QdHj&384EV>Y= z0-i$y9Jv8M+nVm%Pn`QBv54cgB%yFTR6H>g@UyMymd){ZibWh!jn)S>6pn|A=UoDR z%~pJuJ|7$=7I75SI2Dz$&;;fL*Q4u)Jrw7{^x%qJ@%x(`i#UBaRNxejCoS?JCx=7s zzqCv&;;6Jr6p^xjBx!BcY4Jn}($c>+v|ezlV-e>WH;#&6f=-<$$sMYGzH$2^)$;b$Z|g`*&2m5N-|sf}NLFTB#Rh+__iDjY?1qK=0rTR`P< z^uey@;<^R#(PP!X>*)cG^5w3Nagu!=t}yOE`Yos(TaG%@>YevUoYI_)izp3sHAY*J z#t=_xzV$UM))>UA7xnfTev6i7-G*_La$lOLYlzq6R@UxdHLSw@kh)JmlSncOft=T5 zo$7NU&eRE>qXt&4P%43Iw6bo`F+eYR?UK6MOLQh-s$f|nQ(2S;Va0;wnc*s5^>wu? z>lfk1l2nb_ILlO}%u;zC|v@Y#`E{*j6rP|vIEC2UT(DrZntCDN+UL^vTiL7yU*Ba)wVLUQ7yiTW%hPe=-b zOJE3)G0?e%1M$gzewkHs8tu)BhZ=jA^_`PoTdtX8J6=9QmbeIV(Jk`NtdC9(ELs)~2+oFvkh9tT7b z9M3Ex(wCV%S3Z5tJtBR%XHSKr=truzk*uT!e7^O6*nW$|kj;&IKk2OV1!l``;$<8r z&#HDu*k2x2gYopQY5ypmQ0%(JL4geuKjw>L6!ae)PZ{InWaNip++DhUIf1G1R6Jgb z7?R;t`12@mPSz7Nr#^*O<{hBt!Jo!lzmthKp-dvu?`!e*ao|+R9IB>L#+NxhnXOAS zj)_2xPh1c*zkB`b8lSNgZbqD$4?S-b&+r|rqc9>`IPeihu9vZC$nJvbraYyB9QWOD zE$%G!O&>br@R4bF#s{KE`ZPx!@%~6lPvWnU&Y3#N%_d3QlIPbtxf-Xg!D)CCWeLg} zLEq=`mfS1?)Jtx7xIi*;g!-KK-%R~Po9c9%>e=2@y&CM4Mr5k0i?v=_Xv~1)6I8>* zNIC?w@HpPHQEQ^c*~Lm&ZpR4-+(nsH5J|Ql5lQaAm&RH7O6kYOT}TKAZf1>*q@bT^ zGb}8>xjW*AD(5w0rH*)t6(6zMXdJxzoe{t$7Yh2=p?GFktbt1ndFCnhozI$$8iq)D zJK*PNV#j~swm(H3Hd+K9I%g4kt9WQO%CW^RKK+%uoCkA2*i~p9eiSy|aEXSVS@V*Pt->32BdGO})PBoG~G2 z6Gxs~>0(-EaprB9UacYNfZAoaah;(_%4DGz4W*jWbIICeJfr`Z@na`wQBD2%B+0JK zn7UAU;n-H-&S+3BmgwAqhxlZ_{~eMY7r?wp?RIL0@v3i9i`TkbcwQ3>ie;|Ng_mK& zg6UqL3$M&8QM&VGVb=_!4}CZ%8zQ`nmxpVCUN11jK9Mx|q1(SxW#Hd`BhL&yVPC8Y zx;<~~t9IB|_8weR&@}tvZUWsumhDS9>}#%g0>`i~y^Wyv;K;A(j!rIwAyHHRMo4hj z7dbo~WxjylokNFx4O1AzF=<_>eT04KAL@?`fPY1HgmooZr2AGN2CwW$%S$=#!qHm~ zecHYoVTQai)C7%`*^%V9dyJ9(FWwv;TQ*)egR_R?iB$>|bpNrDo*}A@LSDFr;~`Qy z@^dY77Ap_^;sR+YaMox%{!w@tmxmZ%69Rv%@tpWd+hGBnTtW z9`-KpHE6}R?CFQ%5q)g@X#lDL2Q0o|a;v zK5Hq)Tn!U8!1`nz7GC|mBOEqh2BIUy+yWdrSq!qZm{)2=aM-}NhydrXfpf(}vjLOV z#YJyyaoE6oi(>|KO8W>K&_C24`t&AQxVw``4Tj;7MtpuoP&@H45)(beCvFgwPw%pZ zvA8(8wiB4{QJ;%REWCKZvSll4g@G94T*61M?8L+%ye1=xT(U<7<1zFeVZ$wefCv4H zI?l(IO>%e;B~_>(LnZ#lc~J2rl^65+A%LKZXK<3swf^KZHBdT%A=Nh`%~WN*vjM|f zc*9O^n~7dLC;(TAzGJD15hJM(QXg(Fev-=5Hh}4>QX>YFHy!0A8YbFPz$IyhW$DikhQPHmb%0l0(3=0CC|O zRG+vcbh!<^5)dcjpl==C!W3@;ButT`UfAGw0WllkZVjg$zo-cBqIoM|*tB-Zf`!ZK zM)&`>^E&30PIw*r0o(p>cP4T1Lr)+|b`%`)ANP7lc%2bmCLB8TR^fH-^^n3Lxw1jS zzp`Q@WSoqQY%!!^1$LKL#1|X9Jl}G~B+PHakz$UA=26+4&3x)3YMxJxaSzpkg)8en zfwScqp5n5|sf8gYs)Yb+YL+fv1q;Yf<-KBMhJ53qty#QaDU5b{_SQ71GPPjhsaa54 z50k+w7uGCJtf)2LIY!rx28SI}^ojTV#}${1m+d!7LdU7Bw$1kWF4UR+&q+ewZLp!} za9=}rxm&t}nn{&}Q>rtn|E$5^KLY1Wne0?QRe0k{J&TkLz&jr}gYt!te*1PI=^vC2cg zCID{`HppjDSb(#58FmU!MA&5-MIdd?gq}{Fbjv)`Q8nTlW~N+8TJl#?;^|qu=y56Vf?Bxa ztRd}|vG_$f3XK4$<13eY{GRxhA-=+6HG&Jz%|Yo+{@Gka$Z_~OQ$D7|TV5yB1z}dr zjE~KFdl8O#;Gtu?@g9FBUIp^^ToKYAPArTkJh|{*Mnz0N9=r7;6`Jp%UhtT1#Tc|P z9=hJrWhGq>oCh=>zY*n1_iXrc#9V`ijx%R2yg2;N!w~!}9=fCPbbsP123b*4@ z9m&@M`f_@-c0dYR^{4f`MnjINO`fX|O16x(Q2z|Qy zlRG}-1>Bi1=Qc0~TbHr2C*vnJmQ79!SL&Jvw(+DRJ&$fID@qI#Py9~o?mjrVB>=)U z-0PzT1-Z~p)c0bro2m8gBJI8^j_#L{g0je2_Kfm~AJU_-slwsr=t=QAy5A*pCU5p+Kx1^g z0<81atk%iStsU^yD*rP`-lp{7q8B2Yz#~h?q(NNuX~4nuaIn`zGE|1>K2vSV2F;n*vwRcQ4-T`$6A> zcvmP$cWNy4i;O8!^l4g~(BFcg`yc|{2h_=c-ZC>E7gpm(I`@0n2@f`1rX#T%!J(E$ zM6K$y>$`w36dZgt2=M*LjDx>n9H5)YP*|gURmY#1uOf&cwFS84)DJB)Dn1tPqQsd< zE}D8$6t~0ZWGpqX3TXXetx-R+6MvgTr!4Ry%-h8%_&Ge=}*lmz-3@( zJm7db(faDMqsSpzkug^A&U*-qM{v0wkR{izV>3Y;x}aQEs6|9X>QY zmAfv_$(NB@_DrbxDD)=S(LnY?Eo>Z9qt7JX?&`ts(6Nnpqbi}H+Eg7`Na8q8AIw#| z@qyqnq2`A{ZmO4~zPlgNv&qB{!A&z>Df=t0gYUxV4>ey63e^aWWv7H%SP|Dd_{(`2 zO>(Yl9to1=dlgj3uVM@yLjcLF?y;|cn1##>s39aUOp8z5;Jiazf4usf5|9799v z4hKf=w!rs_IpA7b;)D5>xp9)>SM5;A0YCDqEum(10d&Jq%g+Gt%Q(7Xp6ZIYpr7i4 zZ{TDIU3W9|zcT^{U<4*s%UyW;>!jVsQE zDSCEmFb@}SqqvcaXB!nX;^U7#h@ig>d37*}31W53;LG{!*I$XHr$y37!j$eKTq;-v z`;bKHqNyi5#ji^JIXdc3*fdfGHFl}YLor6h2=I%Yk>sYlxviyRqCJ~utPhTfjrto* zabx!I#)~McQtv~#MB>42sOQWTl8*X6j-5OqmRe2DPcbQcL3qBH#h!>9 zGMDmQe!hap`NfZeUi`8+Kb2%wwQLVHzXY6EI6kGQrn_EPezmb0-<%^VrE2& za)~q0=}84H;l|4c^-N8aBhmsbzych6L;LG_>kA;xl>29;gH5=m9t`Jit5}b*-`+hJ zY<7-|{^P0fb~k-`@C_ZW_Xlw`hzH*g?sz>I_HPG9H41^SzvNZ;w=eG4n7=s1;}m&N z6sr1^5m!}MwuJy8t9C`BZXE04|H)0DLN;E(3C22b~G&EFVaUjRevfvVI$Vt%O0=!}i} z0R8YIbSO_8G<1y)eL1>b)u^|iIxLoY-I#Pi>1X;w8@9Bbxh=WBf5TzzJA&Oud53+n zSbW8;bi+Am~9UVU2_3`AzOJ}iwN{= z?xKgJYD?vRHFEMa*w%pml}f~sj;<_Fm!Y)MrLV9Mr$p)8A=Ilt^JMRrqWYj%`U{ZG zr(-1g74xYodok3^gC60Bf$u{)t!n>;>mD;*%%UQoaB?$lr+@sVHSsyMr5mFDJrJqi zJfn3el!w8NJtn&$v9gyE&vnl`qjd`Wuv96FmAx9DiLlUyV;^Va$qz1w|1SB#@c5SQ zG3w}2XC4oNq`n-CwuVu_>6lc|cp&(j9c^5-PZu{% zJ2g>6EoLdGsXH@2DwfJ(WzQ!Dt5SCLgQ(6BQ39^~5E^Rcy&5#qz{=JyKu6C9dqP*g z3LjWngMpzhp^}DFl|373ZqGyggf>iWt=ZQ20W^y}hTouib#Ci`6rM9QexAXJ(-(wpistVGZjU}<*txW$jXrzv@o#n@gr2m z)@*w;1U%|RYFN^BFv=4xdoR@T7W}$C!ixtfecfj~ijLsxu6UHguzTvGT+en-c$9mS z-D4i5?9@H-(Z2jM>`_V?-A6u3(Y^byNBO~`d%&aIlJ2`X2FXmmJ?h3yIr>I+>zdwIaHvoEVmnQtnm;enC(B`bTTqBcxoiVLef63vDG z5T6=;g!QlaubRN1jqvhf0*l4GOR1?W+OrXCHt~BV zRFQfi`4&zv_T<&?=BW!`vL_Hf637rO6fzm|^JHGW#?z-Jmd|dT^0}!0J=m1|DB4;& z38xJ{0s}pxwX`5s_DcLGjnhs`+}%B>GW9H!d<3u~;*Z}(T*bOkv#j!H>vYSw_mgp} zhQXFlcc99T#snYt7q>HWp!`@zo%lgl6>65UY$YDMi=%gqggZ};=EuiF1Q`_OTEZ7j z?jIW;fOm1?SedFIDuLnpnH#9PVWFUCXf`yH&)=jbhw!|x5+hjQ{iMRVV0BG<=cA6W zavdIOITKJ-Ynbt=2{Fu&M;K>i@f%u!W>u;aeY~>yjYJsjGIUU+cIX`u{|D20cFt`b zF(}%4!3YRJL#kRY9}%c3do{FQr+w}Rc1D_bx=UIxP4 z)+vLcJ)LaDR2ia24Glu&CvNR}457(Q(9hW?l%&K;!f<2f^-KsW>mjI`MI-VM`OD#7 zY=a84Bs8Ff6v08EbxkDr#g8g|f3D2`NTreN#B5Vmk=g@_KgDE@hw8YYB@zGMq2A@^ zCEOsz{5~KaK}!WtY@HQownAHV|DX2G2deJsu;aYE7)c}+Q*>xiUlbJ;Bev)gi;g<< zFb_KPphbsD5>T)NF(H;HdeEUG7A>*pK}#Y!v}iF!4=T0j(4vhFZS*il9d%SQmpbZF zo4V9dx9|5|_&kDEx3li-?3~_nKJR_r{r$i9{_gMZyZ4J)<@F~xv13YX?@P*h6~J)J z{&3#RF}vs+Dw29&ydvyooRa%o?;J5d=}0Z8ByQfl{=Wq8z_ZuYH|}zUPnJ#*zU0tt z>G-WVpP_tNngxImMdRZBTi}8xvp?s+q$at5yZy>*YK|F zd`0d{Ki^374F}(|KS=lz(Ko<+DLHq!GrtefurG)Vai};<94=yFsW?I$DKf=T;%MO= z*Ol6_!nb9P7un(ju}qvOe5Q7i@Ol52#LV*k@coArm`MQ@i~rLww`GonbHcu#5t5VV zeQH<~ofYOsqx&sbuwb9$L`X_W&&(??Nl8h`Dbzrj#ALkJgIoM3r!G-4hxR2GI2;ph7+MWyf?qy9(V)ndKaAg&iTikrnoahq`1 zPlU7%=Clsxv<~JvKA3CwV6NALx#kWQ!(3a3IM>s`Ttf$Q-5ktEuwXuR1@loWSUy&O z6=FqLF;;?=Vr5u4=294zQH9lDbyz*tfHh)GSTojwwPI~pJJx}9VqI7_)`Rt8eONy> zfDK|p*f6#Y8^N|?qu3ZWj!j@Yu$|Z>whP;h?ZKunpLm2^n2-5UaEMF6d^sKB(y(;Q zZxDr{G0YdxAubE^`_>^Y2g}8lV|iFUwpHuw9CKbd&7D8a8Rv;}qgXfxoc7NNr?*r3 z74e#QUA!UQ6mN-l#Jl1>@xJhOIfa}yP8FwzxB3tR3b_Okp>5x)h|B$`EwXcbO3r27+$SCo4~a*_qvCP#eetw-Ry;3W6fcWc#f12Y*eQM{98yI%3It0g zE(PLRLr$ym?9m^z+zY?mW8=C3)ALcuGvDI>$hO8<$~p7 zuJJ-#A?DgI#1&(%2}7Lg!(grzgOy{hAwygh=GrpE)nTqVL!9f+V2xN4){M1atymk@ zj&)$2SQplf^w(d0X6>+Bc zGjWbMPh21_5|@aTqEb|gHR5WqUThH8iyOtwVxzcCY!W`xOBS1jU#i)yW#B1Vp z;qb>I#+u`5o^Mlu@H4y+UF!n&~@ ztQYIU`mq6Q5F5gVv2EB0wjCSA#;|d00^5P@#3r#_*luhOHiadr42E=`kGbXzaVc0T zmWHKc8CVSS(J#y;3(LlGuv~08mWSnI1y~_ggcV~YSSjY3F|12DR)JMvHCP>1k2PRL zO25_O3gL63GEpunM3tx!b)sH0h(^&QnuYJO+$(%8_1$T{r*GeX?-nj?y}~8TWy_^% zPz;G-;nFiATw+{STuR2pgxDcm8YYEHfb-tDJ|&#f&SU59-23k*D$e)cooCK1=aX~D zdE;DhemEzb2TpybyHnh0?NoO9I%S=vPEDtyQ_yMWRBIGXqFJ;EhciT|^@1f6mx85Y zX;?azfyJ;)EDOuVaJ{8P+Rxs~h!Mv9R`+c8fyrDV2Dc%zA zhaObt}ix0$y;v?bz)h!T<#QtK5I7l2K4iiU+qs4JznQ+H&r-)O<>EaA=mN;9S zE6x`eii^diVwJdDTq$bBT5*lIR@@+N61Rw3#qHt_ahJG9Y!Ua12gSo;t9VR2A)XS? zi08x$;wABlcul-6-Vkq!x5PW*UGbiHUwj}w6dwt{S+_te5^BgMX^A*U93l=AM~I`v zablVHqBupIDoz(?h_l4m;#_gQxKLayE)}c9<>E?FE7po@#I@oEag(@3IGioQ@iAC3 zaVc0TmWHKc8CVR<#Imq#ECxomdyvjrCx?SRdAp4Pb-V5H^f$!$z>}*eEuJjbjto4s0hjiS5F6 zV|%bE%*V&+@`w5O7~*_<4CdowFdrX-`S=*j$H!nkJ_hsgF_@2!!F+rS=Hp{9A0LDH z_!!K`$6)zb0al0=VZ~SpR*IEj z!_u(~EQV!bSy(ofgXLn&u{`iQrvnZPL^R@O4ap*X@x+yhwj_N<92Ps(2WYWw4fZk_y8#9?0%jU1$_pd3S251qbUrjb=Uja*7WY2z>cPp(+0S7e7K&)( zQq9>pc<`TWz9G>)l(*Sop;BY-96U_1(MX9tJ)aAviq)yq^kqo=-l8Jo|AUA|PMMzb z!0X4qo#;a9EsvnE=woyC6UJzyUY}n3>ozSsX%Tb&bHzCL-Nb0*n7He$ycJ)5A<@m$ z1=F$n#pmoFe&XVgBBBw$*XG=LBx`GRqMNBM#_^Uq_-=uNQ!X00M8CX!rRvkmS{l3V@WpI}?@u`FFQSng{qi_>fAiF#L|0T#GS1BUTs|H1x%gBs z>C+KE{YLjYiLR(>7$-JozgQZds!_u)lYM7R_Yn~qk5g%iEoV{8% z`=j_&>C?ma9Qf_ON_2bmm(#KFapHdM^s+p@-@Q+SFo%z~H@Wg-Z9uB6`PEfx6H}@M zO2yRqZv@lfle)B;?saNb+mOEJ7Mh!l_m#BvvaeNcn2wm!MO97px|w$M=M1T?tyQ;H zpEkVucT5@Y_G;bNtLs-+Evt{WG&;Q&wd>ccs#KHw@pidCC2rM*`pR|mT{S)8s;jP2 zgZ{OjycyN?m238%@2Zt+D=(WBJ!k7Q)0LWHtqa>e?&zj-QF!t9i}6r(9V-)9uyF0@v48u3NpbZfiVz} Qb2fJN`pv9+D8h^W6MuCWCIA2c literal 0 HcmV?d00001 diff --git a/curl/lib/libngtcp2.a b/curl/lib/libngtcp2.a new file mode 100644 index 0000000000000000000000000000000000000000..582c7237bbd3f977ec3b9ae6fe4cc69497a8762f GIT binary patch literal 484062 zcmeFa3w%`7wLgANW(Wb%35beHH7Y8pib)8MC~5`?p3w>710SszLNbwPUQT8RSRY_O zGEJwot-aTKTl=%Ow)Nij*K2D_eY7?Kn*dtHSGC$IK5C7zO4VvWCI9c*ud~l zs5Fe8>HqWk@W32@q45uUkJ@RNx!&@p4KwIHW0hgL-?P7LnE&(s4-YgM2>p1Q;dy^? zyAjIuZh6!Q<$8Bk8lnAp-xx7MW4#}|Z-n%B-*h7+-tb8e7`|`C$wv6^eJ`+#@IT`H z&MiiGf8L*V7~y~B`_fD!tiP|lYlMT|_mK8{-cO!3!g;>qu6x?}G;iU|yNyr%R$XZn z{Q*O`oz3lSbq&pp(zm&@t~1@y(Vk2t8l}JVqc~PI)-|^^ zr*x1A3_dOGZCB|&S0z$)skI#mkB3dtxe8I~G>JBrG@sB!YLPAq)1Sr@oQSC@S>Ng) z5%7-s#>VEhtLlRMlZj5`p)-|C)VBsAHMF<2B^pwUlP&F?i9p2G`ZaZp^{M)t2qLmP z@j3&;>d2KZ7W>_J(V~&Y;ZeDajAFvu-RrNN1hKujX8_w|CTaCfahAPkqBRfywWv zPpzUl(bAG=yDGR)7#hmCqrELh(KRI3cBI+^IO$Z1S3$A^BMlN`e zN+Y~;R2qSiU!@VqV^tb~7F=n%lFcc*Q*29I)t+jur)FL6YedH(yUyHLovHd%q9xJU zS;yqwCmiH3xmJhQH(s6YOtJpFE#0d7tgdfqM&c87sDC<~Cp$+}9KjQl;73PiBHh@I z1iBJ}95y$tOoveuJ+eFRC)x;%H~w3jFl9P zbaPv3ZskhV%S+ho3NNg}2d{jt7q5J-BZk%WNkpQ9ybw~7^ny!!Q`RA1ddehBPnm@2 zDYIcR84Th~hX$HmrsKI1$5_NkwQ|s?HE4UXQR+dqw%E|Iwl$%I6snT;MS-ten@Xrc zlGQY^MkYy0AaS*RWeX&`v!S`!<=fn`y3z|$1=D~i6W2}avIS^~5tl2<8NB0xiX$J)C3R9$O(rxF1Pm(j0GH#wrGZ%551Ktp|pj_=Xh84gqB zHLbmU<<(GR+L6#yvb7Gpl|eW?kXPN4I#MLO6-An;gZ?6kIJ~7f(FS3K>Y`L@CqjE` zYjX<9dqaIoT`F1M1|2Dhrl}q(hbmPTl$KET&8lcJN6@5IUz135)S*pVov2GSw zqcpO9BOuO}&N`b@Bor+P4DuX7P@TM zk&g>@9ZQ7A(bUlBw+q&K{P>L2;A#M@`w5ZkGgaR^}r6Ep^Q4~8o^3F0!*yw zXtsNF!GlyH*#;5z@grRtwWofqpC=WE4~>)xKR+UAZiKA+&=K4GeH!Z98WJLX=zZ-( zQN>I;vYSk_wxh<%G&uZVN^o(*ORt&+u3ag8%MlPY4-^r&K1RF4j0MOSMvD275QFjw zTJ%j!koG4HV-rwH8CE{YAY}grIH38V{P`0&I4rW42WEQ*`jnN;jm>^-4#g(NO$?_c z(d29(7N<2>qkvNP*?rw;q)ptMY7vk%e>TE4NjW03R0qZu?arjns60m`5ds3Uqh10MKM$9(ZzIcL{ zLtgJNjYUSnl&DX(tmUT8Wa4Uwy^o%e4<7Gs>(H5dQo-VCZfk0n>2yWG8%{^p?9&;g zSCWP+2CURrIO6H#-pWql@Kib+)I@)ejzEue=PCyYYexM_tsY7RdRtFv@!XMK4gXijziH%gVqL6?uDrB)rH|x)Dlm{o0mxD3hJd*Ew|^N+%0DA7n0S=)#*@TN8~; zg=%d^Gpk!vSScb4Jk(XqovC)0^2E9T7N?)Dio-u-O0P6SczYM=%j*&sS5Fs2NDW=6 z+`c~UF%^}ItYSi{8d7S!t19CdC=?2_$JEukTN?7p5paMPQ8ASxz@IWXmOs_kHWVJj zkt>o838ENsV=zWizv4^h?OO<+wGocKj5Wu?$Ju3(kEHSXz_`S99iI+>=Df)4ly@VWp)T1sVSLIStJZJOW?JR zfeup#bzJLAHpanP5b*8L8c2L8kXm~n0)0n7R zg+i+*8;PV8P3JYOdWmSjc4i>d3f1=0ic2=Ys1fKH+uAYimJv|B*V{UL)ST6WN!Cr@1Po4D=f_AMF^LF2P%%F_2KFVCQy_vCLaPsA8ND=bNU7sM zW(H|WI#n&Vm#t{Ie9~=bUJ#j2Rv>zH(wp}ajy}Q_kfzzWd>j?S<>yeZm>>E{=-St& z6KPxXkRCKW0Z*nlv1B_q0ZJVK+6Fbxu23jbfjNeU57&vJ1KK3@=#GAwB}+E=)L39% zjXDK3Pw28w1>s_ttky<3a^n-OW|Z>Ch7UTTq_u90TVjohjG?)a^(eNk$pE^DGXPn9 zog|%gIt2h#m66{ojGVN3o zX)ac8@gyt=uIEAGQjBOa+U7?`D4}8`peoP|1ZIeXz1?9FEk^h>GvY_b zygW2Csg6m+B-tW#Q@(Syo#hI6$>xSmF&XL155=vsnGtYXlAa|;W|*d7uTo-VAoK1( z6b1tHhiYk*FET8db=M`5s%+_7FB|%{hZpokvCF8KuRe&!q7WxN1JH0wl8}AW5d#A- zM$)282O2?j11LlF1jYt)6e?TQ=?DN^poLMeyraKq(-O`?625MpdV`^vm9E}}B2&^-kzV&8_`|CChf@t!{5V#prriVbnXs}9K0cC@A z#Fq9h=u9gy*ifQLh#D9oPMi63BBAAIlkbeiE<5^k^!o%@nYgN1l`a9$kHV_4S`Qf@ z51JU!Vhx0CrXg|;_oj}+F?eW6v%v$cp75izF}z{$^=S@CrzkbB4_nxpwz{j>7*Dma zETgp8O?tQp8)&f-U-LtPK-O!?5O`5Dpvwn9$wXVbFARPd(GZ10Cz2%i53A)>iB7im zJ+T^Xo)!@cRfIqr4LUJL2II9N@IiH~m7>toD`DkurIrJEz@&T8NKgw)dD}77xs#@F zkh{)~G$td{o&G7)F)?eIGZzZinT?fp-+@H0TuGyHTZf|g8!td_j~E7Pk7zla%xNdq z?lT{|A@%!gXjQ#1_tqO$W>D4>!!68O!^!}54D6HUXzE?2C67miOsB&~?-V*#3#)@8 z0ju@F7ErW-8NQGOPNYI#ty)kGBp13c1C(uqdVnIo&T{LGPC24Lw!1Fte?Ln#BQ zy7BO&I`7PtPLjsVzTMMuD#_$6bh(;Tb$(m1Q78Dl70ukXSzy}b)MeG5(E=!tUr@bD#foqmp_JH2S2u@cRm zBy8_+_PO+}4_?@}J({LZM_;y*O^-OzDL{J9EkJ&hnx?OG2R+vcsE4P3ju6vr=xty| zqV>2<_04LuV6QIWDyf_slG8>u^F5ft-Y=vl2O^qmAVK|YuWLb(+YI&u>0E}NUy$uB zsvisrPqXy+pak=RHP0F`>U;{rM_L%j7VCJKBr!;Pb5$$pMLm)~JNz)T+>s*c8e$6& zGR1mK+KWU@pjtRB{9zy-1EXP8!WjZhLg)q)5fYoXXG)-B^@8waW;E&zDEkDHHA(mP zfrA~Sd%Lu27qLL%`?37hbZ`fQA~LyScFA62f&QQw<{EpUv`CJ?)i7OA3gsB-LapK0 zXwAL(qJe!NQ$#F0kU%V2TholHA;Pik&?2qMUnawY!3+}VHq2hT*-pvh9<(RaJN5zF zY!nv@xL~mEUc~G|5CLnwnMg6usuwOZ;Pp|3=JgV>=ynbfjqq_879A;IH2ZzN$lS{L z@_dm}!!V}z7{-O;O=IU#rtx&SX{9v($hiF%A>+|4A)|6<$QXGeWW4`D z$e6w_WIS+E*f_Z&Y*-hBja$AGHadP9HfFvQHr{;=-|vNur$51a-8kd!nT5ucRfWd3 z6@^A}eWCH%e-#=XKQA;+c&N~L`_V$<)@KWib6occS$IMO&G@UIZz^S^0^{0k|V^!va6 zf5@05{v;RV|5D@A{Dlnucc5{gG1>Ds)zJS!MuF$=V1xe^8Ycb@-><(z4Zpt$hVySc zHp=rqlCR@g8jr_+imMoZROZKtzXG^Fqy15u{?Gn#zL>_*uD=5e_g|6W{PXhqD8ujX zFeCWyAjAGU#PI%2H2nXLG4wy;a;`s;z(UB;Oz}4zvNUBs|4uZVek*XFtBovu{WWcl`#1Tl575B)}9h5=MPp)Xyu>DxWopB(dFs$AYd66C)JHt%g}`EU5z&wVPcnRu2rEeO7zfG<0C zl)Dd(dov5OA+Qmp-`aoX%Y%0WjJ{>e#q2&Kd6saZWt*QoAqoK>V{c4eyKG46bL?DU zY2e4r`0X7C-i$zlSx>s1=5LirGWzlpW~jdS?*tCoM@k8l5-HcS`fPH@qpng&|A74& z`RqoasN}pgOkXaOo8k*en}>%?1oMr=-R@At`LrE`M-$tg*x5wIes2~~InpbjW9_sD z1J%zTfwp0Iw^UGq*#-@@uo3ypwb@Hw+^izcy=laEZi3PNUAqZMdRyP*wT-Q zmw-L*ScSEpdvUO$WsE)cYF(~Rdk1yX6@XXI$+^op*B)j}mOul;47q4gTxyRn49ny> zDmUMBWVcE(2!Es?#R_u)IlDXMpHCx1$N^0{c}bDXfilLa9ux{Md>TQzaw@%SRa;Co z`SX^C<&X?-!4eW{zx_9Bk$1j~fjt@q1m7)rV%21D9R5ux#m<^gPtz!Ua_qR3iCbFsSLZYP7BtB>=ConH6V7VhlgH$l^;G_HTG4}%d&)Y;oFjFMEYLc zQGIWecUzP0tF?wY81|Z+8@%*Npws2G(TePboSkZZMr(id;FNzrGL?S-z37*y8w}cq zmTOZ8_fvaCT*fcqt8HfI5E?4mG=3XXv=)Su1Z-8&SCvtyjuRFMKwY zO9ru5K1wY8^hpWRPpOnJ&pDgU0~HyX=UhpGI`RDX59xx$*D*Qw4>6d&p$M$_FP842&hn&;mYR`Ic#{xORa4nbDXSn$4Y`a6?-|qGHpK4(@3(99XJB%4R(*&A( zA-vYu5r(!NUp8+pFxH2;m+9wTIBze1Ck1_f7sv-LzGo-S>1h-_oqH>Swv=AS*1$eF z5{kNJ-&!ek$KRP5`>LP`Ni*VT|G2@I-+F=-itH0M&nc z1C{S#6z&r)NbivhBLZET>08e{|JJ3MAiO~IF!b$c{%3-?rtb*J5wY)4BT(b@gG5wg z&!@rp3_sc#nG#=r)C1rBG>%HHDD}R_FJ#?6C}cffDqx+f3P?3@Kll46TDF}$@XQ6< zHz<`fcJ^fq^KetSmoWP-fwqU)o)yu4#|bk#P0j;u*pdEY>`%}c%R>A|ZCF6f3O=2i zZ@kx(5~_$CsA(b$$me$CyayO7#g%;3_?!ur+mqkhK@+yj+d;_v$T;CRXD|>k_l*XW zjxld@a3lA76CET^R39jPva|JJK;&NL=33N z!aH|G){vN0Fes8B_*fNLgzr<4Z68lX7GA*>SwqlEJ}8lPh4-n*BCI?rvW6K@kp)Iz zMOOZ~E3%G;su*xHjl_a2)>|*6XTaqS!aH|8S4jEXTqBTk*H(oDJq}Ir#tUnZ8f@wpQ#kx-_Q-XShG-_RAi;g7 zmA`3U?_xQIr(qQq`rvkzBjjqJ{P!YanBdq9IOgs_UGLF1A$s;Lvi*t}lKX5<^xps} z*Sk75I{rOpzOi$}o$UvL6GCQ>r*a(-M}FXueOMa-93qDAybiDP9%87EAaJIkBUJZ^ zh`Nc$?|?*oXa;|6VvBD6Ac@uNN9-~XhyBQg*!Cj{)9ptRrrVDsOt&8~nA0w#ft>f3 zq&-F@?60LIkZk0qD#w^xa&h=ZY;;(@{~lspw1c(<)3l9e-)~;qkJVHna+hmI zGCSNuGexm)T{gx(E@VHB9U;k}bqtctEN}wKvqE&MnAa1Up1l!XdDA{%UpnUDrD4q- z6H*zgBRO6Imx38g>eC2fsiCo+viar?#wsLJ$T_*8!|! z@21B}CK@v6Ctl>(Q_r+Jl?;0~z0ZDmZ8tp*==SWj$3cZ?WmQnQk6LuBhPTa5%1)&h z5S@VN+?Jy=7QPM{#<%+zNC)HLFBe(`pU1q%a!-1 z+S~3uwuH29ef<-@TbY(Q67#f8Ipg_f2c1h6@__-E zBRxL2`dDskT+fisN#c8aC8Ef5)+;_v=^VQscC|Gt^jmh63Fa-k}0_lh;jPr zsd4%^x@@NxmnGv=_W=bZxu1Cz^990+iT1VNvl?chKbC1HnQ}rP;!Xhg;RHbGbOI1a zn-hXg#|5bGZ~~wUIRO|lI{|#@ofC%E!Uglg5;>EUi9oW4@qa66lR9Qs z%qg48NLEa2yyaq?+F=-ftTT)QOy)FZrLfqEI|F}9jItH8n1&LF!aS;tvc6d>apu+- z&pP0pT3%MBqdka^$^#AK9lZ2}@Rk%WU2*FC$|?pBKZoJ}fd?7J47~JEHW=RQvN`h^ zg#R1_k6FN35aHhnZ_Zptyhp)%vA~h!EWC=jbL2Pu{~F##;C&!)ajXcBw`#5;EYV? zc=V5lH@`~9s{y>2n5{h=Z%(-$@vq>&40uzH=7@Iss^*t#v>(B}1URu07hc8uc{<+J z@ZJcVcLbiDkE%I(`o0Xj&@qPbRlM|s@$&SQJLIYz@cV%?^H{>t_)Nhw|wqgy}sRuh+Y8BO^4%tIBsrIt%Go;q-iGIkzA+zZH0PxmA_x4LQmE%fMNB8XS0RIVi_^Q2V(Y&NaY!Lg14T!EJ!6<)<$2Og!b12``UJe9tRIdgRWQToO& zK>ff=j~(7@M|*V_{8GS~b_PS!>hC;9J)(Fo2F_N2XUALN=#b6?-Y{@V$$>|eZ$(*! zUeC#UHh!*k-JV zF?Y5u&N%JOFuH;B12^6rr#^HT@O~n2c!;umo%-Ji@Z9EuH!JB>ph?Yr+l5zMTwLwO zI|g_k<$*`xO^@S8d;G#9ywW`Ih+lK_z&iqX^Zf7{VcbitPRQikg@`Y3;gO@dXd%r)=VqgGNUA(d8{@w5X(GkWgfA5Z|Jakvpt}*vj2K3{=GqA zSecNuu`g90@BQ97e8ziQ*I1eUcxEs6?G43x53(}W3ad9{4OXvWByeVXC-vRqZN3HIMXMVo!%IFo*<cbc)Lyf%A*dEdOz z(b3wfEs;&n0DF+c#jr-VSeXlo;+a@+@D+*)g9tPM5Ky79)mU+y|JVilfYr`z3y|v->dmcY~_BE+--FwXR zwCZ*Hrm~Q`mepoie);At?s_@u}t-}SY}Ph#_f?sPh@sVhB9Vmk*Ym-!-ixW(h#|=kB1$( zt-q*0vblfxRwXYw*DU0v_l6Zc7ql+wiMG^k+@6{ejTD=B!Kukh@D>giS((4`Y%X6D z?@f2adv91}WtWs#8%I;ck>c@@;`4z=_~!69h8WM>Sk3sn*otRXUzWLYl{L6{1=46Z zQcfN9Uc6!BD&_AM%4%G492NFtgmsxitm3R}Nbp(Nyw4L|^FAc~ z^4iQuO=R<7(GRv%M`|IKi;`;}1lh-qc^rs~e1G87S|?~G^u8vRuf zQdYfra!vX6n#_~&>}QJceSX8#uh*K-m%ngkbo7<#&FkP<{zCLue-j)1t(6&xm%foa64L&L)w^uO z%G7Xge7s>*EgR`PPo#S2Y6M)p`QUp^B$e}n;=APnBzI^DMLJkRHQ2!aUGzWt!NVk} zMO#zl<)c>b^5=$Epc#sp&sZCuv?7a8XKN7MvR#(>1hF);R}rKiw^;keikPP}R`rQU zM`Y8>pCB?yZ{~T10U3WIo_P;}#Ivi-MLi9zkfTalWzQ>#_txwbp;GeBwyfToUHHG$%6wr(JoCm-17fd5 zFuYdY3D-2dVdEX;>OrgY5rh2zu8*0k3T?iM4eI2e(nD5=nC2M)#o8fg3-92XN zP+ry3hxEM?y6@oP$x|{zFzNR*|nzNR=jGkYvH2E=7O3H zeQTqe?0U)yTDfI2h~ZK*~BQJdMuvx_><96eXI^4eV;nY?%@-YXy@qGm7O8bx|} znn@Aj^_$mf(O#E`UTPrLYt;5umzRl0EHJ6r;oLI z7lX5pkYHqf$KsD?-bLwH=7<#{uR&yFE=0_#dN#7@HN+X&d`U}o;qLV}uA=&!p1vR) z>3$aQSY}(_uFwOw-g(cuO#f4F#xwoH2a(@X@auaeyl%%jB;m5~O+`C<%nuf~7No~FX7jKD27?lan}@ln+$d$emU%PxC$8TJp6{3YXyFH z0Rhc8TqNXS<681zzH5~4P0BZ;e7P`pzr|&ud&_Pi%13tZ4R;>b4|z5VLI%lmW(({0 zN|tXWuM+vOznRCtKqQt_SDx5qlw_9JE0k}8@@-YVEU}kd3Pp=2m&vbn*}2(D2*rSs z!ryhB9o@HmQO^W4&(*DW7o-;49Zp*iBjA(PbqJals3OoK`dB$ZUqZpgdY4wCHeAMw zF0&i;siY328(p`(T7?x(-G}cmzEyDPpA0{I5t7KurwI;TD!j^(dMK2`GOBiENacyB zD-gTLh6V^sWb+YL_ebTZIM7MrTw-b)rv6*4xq~_(bhlVE> z);-_Q^JgF{*;L~i~vd7}RxG>-uJ z&~^&L8}*Xxq=MM!HY>9;a`XnEAOXaYy%+?de#2+od?WSN&|mP4U_+6c=TWdwmPnC= zV*NxsvsF|wtH7%IePq*aN_2J-R5i((y|L_qLNLXudP#5{SQNovA=T8O?aWOz%orYz z^d1Gree^Z7gGYZfi3S^Gx>MFcPc!Smxs9&r+() zk79#`WJGI<4lYKTVuOoGIYQ^TWEu*c5kjMhWo|5krWn}}22mVsb|yL#g#i1dE&mXE@5m;I{-N8OSI7cd8%`Cl~66D5Tv(8yUdU=&XBnWZg$a z>8pJjg*XPBgUA2^D%}Y=EgD`lRv~m9ivl==D6&gL)ZGIRG_ZP$NC|01TFbYU4?s(- z%yYwkng`00@rI3h{BrH@f5AmIv9LiF`nk+S3??H|*l2)@<57uo*Gq8m=6^gSk;9Ht zE(8}P~=u!Jd| z*5Clu00>(+a&tElg9?Ib5~G%95G^AwwyYIGv)^2~x8u4N9;Wpuzko zS!?yC5$7zbERr#B7sn{*gA{vuml?wo(Y}kySZjV9&s;YxZtkw#I2wyALLn_IiDzEt zOq=g80l;1_n6*N=I+ZI67iZRgD%XR`rP!tqlx%4!NX}POdEyrB|( zx;Ypd9gJ1I)HM^bgCufHJ`e8?y_5@e+P`W20w<28&L+~DrDW`812*F)k2`> z{ih3+>WnPvjH>OnZCvE$YN#QqGa5l>bgZ*r!>nMBAS}Ov4WSGpn?3@Y;+e!7j*j`{ z@vvdWGJmKoeJgVF?|}iM;%;$#u%Ba#J1ZPmw-o9|{pica4A zWJz|x%-HDTEH=`!DW=|5j2-`ys*<_@dPIqGwLlRPq4_N3K1f=6Fy5PZBij9OD1But zdk(aY=OUZRwP=Z|dl0=ba(H-PfMmwe@~xtR!QNOsVQ3e;$rW2pxQ*{8tuB^uRYPV&=V!dQOV_NOT4^m|o#z9v0+NDVxs@yJhsf;(4*2XF@Bsx2}H=y zl|{(eB{P+~d!WprM2SAk3eX2WkDT!OcAawF0T-`t0}A#R(S5mqD z3ohO-Zib78_oQ;Ytz3JQYr0auX}rzju+{X70pp=GC>K|VrQu18yP(2ONFGIv4>xvD zN98sTVDJHxSs60LM+jpEbR;nI4#;o%(XQ7}GQW$^0@`YBHo2J)yj2>eq|%R)t74ho zSeYSNQ%QiKXeBS8MjMT_Fg`4rQ3QD&Tr`7PU)Fj*TokhHiWq z9xp~>s-bpHQl5suc+rrq!Cmce@uK;Ta*fd}7bGzU23sGgjWA$4)kdrIrDUm=L)0k4 zs(L(mh-E$kRgw%BvCR3!vCKK>kWg#LD(I(1TKT6YKP6UamPD$)j9` zob*Oi2HS`u$MRmY`yjed)}VDD>0DZ90+~z8@8Q~oH_U!tWv(~r7fphgw{=z}-bKa+ z2gOjeAae83z-3kGaW+=VEJM9X!muP7&TNOtEIK0ywl+JXF#5r7!s$i$El95_{~(rm z2~(4>g`uh#i!yJ__^{`kBKmLkoHN0~*i_arxTi7F>&576_zReTMqNd(M9n2?6w9S$ zasv{LL@^emcv81p*~Li2b6s5ui~3q%!h%=2JGlbf$28n4Y6g*dzIat)B)K?lz8=eb zi1vQ>(4}NbmJL4D2lMwR53u-_@y-{9hfb*O5meXBOCjQ zcVXfRwH6k0^mR{hre&D99K$y`V}(9F0^-Q#!X9&|8_hl0AGJC@gjD4X%QM1nBbov8 z@S&;rkBQdE2C@bXm`4rGM#gy<`fM8+_8^z2v!hlFe2MWWO;lR9?Fsk)l0<}aD-xcus-2Nd{~NIKCwY|c8oGmsS>fcL&t{^be2yDB zo1DbAFT*iln%rh@;lr=+5D}8@mIBI8b^&xFnR`qUL^e@#Fkr$MPdOJH2MdrNmHVMT zLLhkJ-C?4foWcDZr~~HI;aPd&)3|BCM4}kuhp+X^jvs9Qc-eIfe(rk{ zTs)Moz{SjV9JqKWQRPa&#lyQ+xxNpVrU-gR+GyRFmhwn+ z-I@soEtQF`dmqcetZ5b&2ThKydz3GEBAejo;BaB|*T@qDQZ^8o!MKT~9JD$JYl$-3 zx_5=F?mgkoNj2r8L&~C(^Ictm(;C|0`iwxhl{fm-X)omp|z=3CBYVup($nu~oG*{hl;QQd+Q*K($w0 ztD;$`i#;Kj>=yMj6;U;VG>WF-66Ep86xwXj&}b{-x^FBoQdnMhWm!%62a%%}QI;y0Um5bzzmlW~(sh5KQ+%a|L+T&N3i^UrpnL^gd7 z8Kf?diiO&Itw>bE2Y9t)Hr(@-ng3k&)^>K!bB~K&!IR zhFq~bhe%QbhDk_RtFWeaV2UQ2wFBeXKt`_;8Z)q@ZyJ^cW-Sv721}sL^A2#&1yW zq4i;P+!lXBCN=U};}sMR4HEVz9MXgJi9%WLs1p!{#Yb0xiftt+wksTpZ4=WI|4Di+ zIvZWDy=)+arDmi&p(7FctXq987wW55N6M|o+CwqBv;7H*fw%F`P=P?V;HE9^Vq5qb zYz!fkW85Xhs8vNy={tU4yl7+5Pb#IrF&GYNWoU&fPYG2POhQ;*j5aCa35 zXy{$7tKHBa#S8?VhTc!)unOfdECemq#BM7eV0E8amcj}NS+q=LH)&lVt$dDGjdnF- zaWeQ3?KueRVxZKPrw@QiVK0DRQcNSV>IaL!5GcyShuW)Yi0>G?#Ht?aEFlSs_lA!k z739xW@5M)G3iOiV;iv7D-h4un6yPFO)MvoOMZ(s#ehQe*es`XGf4&X~F#BOc(Q=pv z!?Q8Nb`Pez#;ex#*{-YOna88+w)HJyYq5oH+JgqS&)WC`F$KBYi$#KLd{Ny~#ymbq zMKEWz3ZAf7@R0}R0H!0VHRYp`qmACF4@r#+{BTt2uy*#W8npn49HIjbI>VLbyHs>$jIuoJs?E)+`2#?&E zbV%|rta~kvWvh47I@pDg;zb3!vDHQ`>sM`{q?nwXK`Uhi#Y`G6$1!z>#npU*nsEaL zQ#La+Pi06(9LsEvjrK3hPWlabMVau%p4x@g^41fWis`dHd@g>>HfzGpcxH!Hx&!0w z8__LpFMl##)fbP%w^&u%;*lj=;-%Pk5I5!K1LP>)8!ftTHi_#=(fQX;glX=E@%PQa zH}HC6)wKDDR)8#x_g*j(>)ujOTe|c5*WxFc*S`eR>z^Szd~9@kdY8(%wiMg$M-EAz zAMag;*=4a^Xz#e>nUwc<)swNv*-u(DQ9w!87GTSHdy*r@98{%sFQ0{l*QiXTY9%%) z*jx(StqR0iZdY3W)_s_kva&y#u@2bSUw1cs%ET;~Q53nE)`2c!YtE3Ec<;~e1V+=~ z#_9NXut{8)V{gGK&GwDM*tm4#J@{v3vpeyRCbK>ZltR3;LyPac`V4#tiDkgXO!F-h zG}TqQaW@4rxRGtiM(W@!LZnEJk-1|UOXtR7{G+F~H#{Sj?U}I`#(3VySnKy3hp))Z zl^}p6|A|FCH9KS3i)V0y0|tEYZ0pY2%sa8t!Pxr2KOnAnmZw|miD;JnJ%k_c-AIhW z-XkMc^?2tb5y{ZA@UwcqaS!~W>rU7WeM?qTL{MA$_L?S8?xeK#eq$T^x3LfZ)_=sd zZpj@F2T~R=U4R`;sTtMrOv{Y<@l1RM79KB}Q8tO9fTM&VaS|}B1i_5%M7^D0-9CH~ zn$qDVWbdF|h#&5xbaeN@xI`PfsLAa@Z#uOUg7pNc8l?~_?E2yjjg|cdg{7p5mk8u& z{lk=H$Ncoyk%ql^!^|4UU9{SR%NcD|KbHAkrC?-Xq*;NmaXVbEGuOj#k-Z>n6vIl$ zX^&Sf-UpM6I@i?DfE~O4maVXQ3*uPTVh#3F&SF*1cXig#YON(^Pa*t}$s)EDs*mS{ zW-~vCl@7#A%t&I>=)2ff#eFvRt(lA6Q60Qg9}@v4vFT;ms>tTZx|eq^DtfsmLOXZl z$QP|j>0gJ*j7E$WgGjMhhHWlJ*1|>tx#EliM02Q`S=&_{oiFQATHvReU?3ROC*e#z)~5` z*6y@Qw?)_QiZTFcK4`=nNas>sAqv&qxcy<*cyFI!n^mKbst~`k_W9v87)2o5Z7MH zl#4M(>tw(d2n!eWEN%PP(|J1D1`_8pI44jl6bRC@rD#X`L^K)T1Tv1O?x$Sh0VlSB z6aB-OV3j#PgJ+ykR}%|}dK##aaZZh*A3ckLIBWO}t9u0b#w5r-5f5P^-x3qKyI*E| zn*?`{oOQp*_BK(|Xm`>$CMfeJ*&#US|*=*PA4D>Cw-qN5nScR=MsDX+fBKQ7n#v!8}gT*{J9 z`s`ba^1){3^E$2r%7+T4KlgV+4&wn~dd_M%&dt*&L zNn`h~L5Q_0Z1N!!7jEaBJYt@9B~Lz4;0WdBWa87Z-0#|>d}4KWF!@jjX&jpsqBYDL zaeo8OPhLbS@^9z_!G1P$g6dN=bb@j}8aj%jq1v)oHa;Lxo(xryWIA-?Gn-D-F9jG$hYkhB%iYF z64d+Mb_u%uXuAThn95mRLP-+38cr|2sy)?QpTgC7`H;CTddY``UHFg_(RtrzPE>JG zPlC?+&xz=JL029WW2aUWREKuyTh4I7>E@=jxK2deOqLT_v=*}A#0ly-(M2`L7u_jb zxdO*nhB^!VUhkX; z`xYw~?bhQk8hUcqbmcl0Vg4BJw*a{lFDIJ=FWg0Z;V$9}cM)H> zi}=D_#24-&zHnEGa?Mb#naXvta*<(#Q&cL~eC1l8T-D08NVzQKiYwPr<+@n8E>o^6 zlxu}@H7eICptcBrE>Kt*Tc&7Ajqcy9G@%(?eEDF1y@Sq+pYjt5~_F zD%UjSnyy?W$~8l|W-8ao%2lRZmC7|=xfUo_wQ?;|E=#%M%C%IvE>^C~lr2XYt8(3@T(>LNx0LHn<+@9`?pCfJDc3#9 z^)uzVPq}`nTz$&*uyW}K`I88QgdD($hkxjY_(KF;I0V6=`Pu>gB#zE-2*MxYG(BOw zA@f1{#e46_^e=@)Y&gIh5PHH!iNQm^Km>q>7F1*xrIbzl>Al$4BNKe7!jV+(9sndf zg?K|I^=O29=Eoy17AmR{g(In`cc5oH-Vi(YhrTjzA2n{gqMEC4B-I3wj3P!wy%3?? zIPb1giWF5u;YcbvxPzVvcthqkkdW)HL%;aM1V#0@!XYaCK+_8uRSAA6*3b9<_kj}( z;t)Mw6jT%84w;nZ-pbN7LW+wq3OVoc`bgaoIc$9wVMxAR0|c3q`C<> z^iT{T^WX4GDZKoTvo1SGQEdc-o`X~h4<)wZiQo;H-vg7T!*%r+L*I-js_6=c;?nti z5u@6M-wM35o<4t4MDckQi3y%!ydkrOxuID+`sNRdRmg1$N9N)$qL?N#s$b!k@;o$7BXoH z3YFKGa>|R*&nT)V6po~tCLl*SsE&B-p&O1;R7WWsN%f2<_oErr%lIY0rpn>Nj#gAJ zC>%+3tf&PgjOsf4l0-e84F9-9QO#61l4?+J^%zEVwVSBdM+xX+D-w zNjbD4n^qpHsJax6r23|a{WwPTHhu|k+HL!09jBV5BYM1|qIq9>jyH%(Z^teM6uk_7sU7?BcTX9AylTg2 zg$X?;;0>8=NDqnFvFT@~ouEQKO5w=#tQ3$F8P(T7MQxMuwR4M3R8*@Jj-*;Bq<1Ex zqP_`)#`ll@-up8Zm8Ebb)fU0SQbzR^{8GS$r#`;6R8i5$jGj`KcXEAMg!5UrLnf^% zAi%+UTfYBUMRl9Pk#QA^mhB`)bt!&H>W;m8#+xT8szViyq`Fc-PG(fp`jI#vbKj%i zI$2RQDjZ35g^>AE7}e$YrMP~5!o=U5qNr9X97*+k!PQxessz9EJbc_6n`SAhA1NG3 z^?+!jP6ckrl=&){@q;5zRaAWnM^arPAZ3h7=Ie9cxj$W|sIE{rl4`H0U*(KS&sVvk zG6Yq*Dz8dGMG_h^@4_!-qHo_NuU9Cl(-e-3>n)Mf*^El2uyWg1nr17icNLDL`nISk zB!MCGO#G4@RxLiLu2NCmrEnzGTS8jqIH-2~?&Ib;it1g3BdP8YB{-K+krjnR^{j6` z@%CIrwOQdvs=Wd-k5Q36Mrzc(HQ)Z@JVhm|@I1xC+XR2+Gb&liCoQXZd%mLjcZDP4 zS|oB>#i&Z~OHWJY^h>G~)wv2sQk^Sm+-blKnUCU^lDwjN`~1@s71?R%IZdUIty=`- zbi5(+Ui=c(8JDL|I9*XaM1_IpbVc>5fGhwsWG=!l0e(1Izj%S7qWzroEKpQ20XYNE zkV$oup6Z%giq23}=PMkUuf-hAAgKtk+c^m3jziukIa5)^6^^7jKxnztlZH%^d3xUd z<`1twOHoZ$IFhPGK&pWoGO3lO=gvbQXpFrT5+EGAbG?(KG+8U!Hv~ zqnZVyGlyZlCLAFL)p-Olj}Zv(%uBs;o{H;QQ7ajagNo!jWXiaPZ<|^iS8>gv<{S^h zaZuF)YEyl@duMsAO-0Q)9){zfS^{W@wgaeViA_b#IUa`NpgJGW5IaMd{D1%K?#A;~ zz77|{%5aQX+Jz!Z85LbALeFm|?j27M{tO8@ya1n0+XX=kqq-?kpPI$*Dx#Hs9R1Kq z%#;1_0-x!C;C|1BjmVrXO9O$JJ{vJojW{n zoh0&3cpRr+k|@YRN505=#1nFrC!9Zf!ueN6zQ7;cUTGuoAcq_w&uVIJNeGmE;QUpl zy;^Km1NXQTsbiL`8MYs;O=pXr^tm1{5}#^f^E+NoG2Is6t5&Lc3FSOuV;x%|e8$0aZPGUuAifYVLl)y67EN>Yi?^!c_R|b)Vv3@ z4oT0#%C)IPrvy-PuS+D`y}<-di+WLm=R%#hKC@vSgwAwFM|(1b1&U&7Ri?DVE)eZP zWUWjH>XAIpRGk;aJNf6u@y;j8WVtSArc~0J#I|&+Hx%attqcLpl6K?0cJpjqQ+;!b zHxw@HSa9j}(x-L3zK(^BUT?dmw6wQf<@L8K3ioemS>0Mkcl&lW`(P_66w|dvU0qYU zt)Z@NmaJglk|<)i8r4&JWBH3Ddlsz(CO!{L5vIN}A~3kzNFpTHdauC1#>5lhIYru+ zucD}2m>%}#i6-Lpu6hd0NgQF(GN z{Rs@syByMsD$|C#rq&X9u|#1y7PEP=L|Fc7(Y)v)(0tKVO0fVFGN3J_3=G<5;gT0u zgzL8$$crq}oFB5DVl=ER=tQnc@TI1KA^WY-@*<0na|?EWub>TBeddizWI1nq5k9o3 zfMunDQS1+ih=o^P*W$at2=c^sgk47sU7cf9;27cOMIqwYkHGUm6`{(tMq|j@SZG>k zqLE~22#_lwCw4E$`M|M7zYJXjX-XuddcyQBXu-29Rw@|Nx+E;9TM?ai9aKyi7KPo4 zO4i;WA*?Q;5lq&j+L7K|p?qw8Z+01OnVeUmKV{knck|!5m6gnAPSu>*9A(AC##@eN zW0RW?GK|lO;R{Q&a0mS>G0Ilx6YfEH)kayLKItBWw+?ux&URiCOXKRdFibvLm;h)@ z#&2PDT(ZlikV*xP44>mwhygu^&cwen{P1R%lMPZmH0hS`!<*x{?3=}VgCCyrQe5LJ z2=A-FD-ot$8aJ}^IqvL*K?m?k;B0l{RX8q_HE4S2S>RkC%(rAoVByWKtb|iNWW-$y zoc|VhD&ERUM}CPfG$A`I@D!hCJ1*xo2=8ye`AiXyLg7_ZIrw}MyiWwqg>F38t+OWr z?+V~_yYU>kfH@O*S>SwD7=u-Q=Q!gf!~ccAxmn<;^p($br0+K1eF-=v!WKwH$oN<8 zxHOvGxObtn7XpVKhBwc_K7-8OSNq}3aaiVQoDBbO%lc3U!@l@qN`+!_-@G68)K@uS7QEf;l?fJo1alk z2~4FZ5lkw($S=g97p_YKZ$JVVdyjzQSeBXueq+qlg5NlEt;X*q%*BOK-z#e$>scWkwi_PKH z*807)CAsTZ5k0`m3VHOBOOefouG>*Pd>)}LD@d~?CR1umMv2phNJR}*Zue|tjzP$8Q_wVv8#H+CG- zy{9^PEE64^rC?MWMsh0l^TUZQBJ%Y<9OJW*O3Ws+`u7xA*{G?ueq-Fd8isYDnUmHn zZHv-~rkNW9Hx@{3eQxE-#F$8==8uU~kxxkFbMpwPd~WW@xN$uvP97+NYk|SYF-}en zNu-<{l1Mo@B$0A*$VSSY>@l*>g5fx`%W{S^7L%A5@sM(DdC?-wh1QvMRiy}JxAJv2t-blgRB+(mTU zbqZYdcqyHdt_p5W$6Z9nT|~!S`e>8%DCe{$)2uK(3L^&m=%Mb$i9?Y5mv$$4kVqGW zLtG-jjqe%9+e^FGC>)yLrssJ9p|L`UU35v%m$pW)vzK=7QaF<8`vO7(x{x`ONbvm2 z&yM@ZUfTU5g(IoX6c8GYg-p`E=sD=Mimi@p5&j|#_~X1*L$hFtZ9 zlGO*OkS`NlCFu;Almp_%{co@M&|V@=+ga$D#L`TzJ^`WO3om5?R6pE#s=Y*fK;ck& z==qX>&>+R8dhmvl&)ZAHX{jPT_7ZX0=tfTjZ^$GikN`7&|K(flCE}k|I5IA|6ohge zGHKjRDBu3#b4~X0Z@Cnt*pO7jReC1l4Vib~mmp8w_@im|@^3j@oUEvp3K^TisLJq5 zaSha#J!UWezC_{3xc&n;^w5|#WYP$oYTCTZlYg?8f8PxVJqNS6bUCCJ$d(r4qtfuf zs!XqDG<>14U7O18tNE_IM7%@c$n-1`5Nc^d<~;GW=e75%?Iq$DD;!Bh$Fk8wYI?{d z4$$+Rq08^Emx%9GI7FrA;xOQ10|=wRQlceye8`uG>x*X?j)RKY2P|6>RA+qsp+DJ6 z#A)LSJq*V|bvU3l)y9jq&9;|_lU7F$!*MK4p&kO;VMOV@amBqi5rjW<N^-u=2kipSpZUN zG$x)pdyZyrFDV(z`d&G|OqlD*`cCb*Vf+D=p7btySPr=}@b{l$eV-@R%!yb_@xKN2 z=o`EevR0f~KdZcW{|h*@EsP#&1{hw&eD*DWD7+_u^N|~`QeyD`gZMWtgssbX=^=Cq zPj4v+PCd&mfkWT)R2xgHPc1KZB=7|!h_;yyQ-^|wNLc#H=SvlZ!7CBb1X9$rhvUt4 zgts1H(NS#=k&=Lif@OHl$pK>v;JXD5;nCxlkI8^b3n@dw53}~Vth01)<5poIm3YiL zTV5%%{)I!}ve_ zsGh^wXZPz7{&~5H|EYf1wM63&jm0Z_7_04`#kJ8BqYb;4I6hV*Dlv{rR$mHdfa8y z6uIe!-T0x)FF9-e15yCil;H5b7|taweInMqrzDE6Xwml60i0b!-$4Ru;oJT4E*zr? zCO+8|X=mb({|6Ss7yl0_q5sZAAI~NbH`EBb&CuBW^y4^D;v?x)<3QJ{KueceYpel+#hExCL?a zk<<n@iBiMUrlC5v~){!-Hx)Fo`X?X zGQwvE3R!#wEWSb#<_81fi+%Vi#b=EUsQksVm)P+Me^>shd(Ol`orrEC^4E#{6;OQD zA=a+ki=623^&{~zf7?WOBwT_!;ODt2zCKrc1EmAi>mCC?D;PgV5Z}(u=Z5Rz*~`rV zv&_NRjX%JdqtSu0&9Yec)`EEEMV$*9_rh~vu~~+xr-E4KT}P5P*20b*9au<|IL$iq zL=>Whwt(7cAu|`jVmys*aKb##wn%Y7q_hTybfbeZ%C|3y{GxUr)qc8ds;T?>WxEX= zc1|}n!gGXsh95!?Y7Bo4o&}Lj-NJJ(_Z;^SwNrFJ z>E41=l9Kc>_b7ab`sU#oHRUhh@)KMt2C?5d9?tZI50RlH`T+el)!^*ws8#it6*=dz zc;uWd@ywG$A>!eK$g44YLX-_&hL4Iq$WnM{^g))GgQ5?zcnhNsQZ%uuM`Dq49-#nm z^O*SnaWfXdQPnuQoNn!V7=fXd*6xO!0|tSKbe&VPVSDNbadI#Ei>YQjTWv1tDF))Q zzYfo2{~*edt|MwTAdK&Ug*Nu2f}wu}0D(bVpI?-D5gnH3d(g~HKQ!7iE!zER1mR9U zxTfbaGrDe1WOX^E;jcBBN22}1Vd+&6?S7f?CQYvCvC#PSg~3ZReee+N>&GXi_V${Q z4JN*#_Y+e@G{cKnU!XOfkqYV$No*3c(Z+;n0ss>UW7eTvzU z;j{J51?gF|4BX!m?SC_jQbS+Ra{*%zKEg#cm6x*Z(k8V?#J;d)KE&Vx8}-!@b=?qW?A6g{-YDX0V^MV*t;$CvjFQ7dpC zNHO6<*8_C#8fl8WvmJi;hvw^@KHh{a?wvYuaqkrq!;5E6ozN7Gv^~Fg_7xMt~%+<1o{Mi~^vtG1=L;$urwq+=Ttmf>x1^e=;>AG9|@d~wwRL=;?} zTCk{MstKk&Su+9WviHTR`qFQd_n}>3rxTZzSIn-QGk4zns``};jfo~BaN2+m#sj^v zp#&?w0=;Q8%0{7q7-DtXs>GVHP&#O%M*YeboM_hB(A+#0dUMC>$~avBb6d zIF?G*X|pE?#=8GNyZ$*WL{hLQE*gzc9N)~Y>a^|pwF;+%jVo~+iGWb+@1(Nr`t=G& zQjy)89_lM>s!6-k2ibOgl6ZOw4M{~QqlY@GkU5B7R1xD_&p&#AZP%Cf)bWf;AM;Wl z6f$YlOV2BpZ z&-;OZhD;hM)APFrmtl7tGHK|RQHJBNR+1$(WYV~qo~Gdqj}U}EUl;$m9bH1{Kexzu zt(6dJ*CshYT-(9|ZIhVIlbgVvLL3e&mR*sZaMc7j!Mt|4V0@d5BUs+RIPpYOt_H!F z6>Jz36lfD%<}%x(5;m|o75ilatEei|R-ket$y5mV3{enz+aW-nfBzI4*nFokYARxt zHhq}@ZWD4Y@%#!ri$wi#;LUNEnAoZbQuFkOhv!^*_zYxr7w~>AnhYZ0crZq4&j#Ra z2TmK@v24xgqRdeD%dpgqggOh$`)~_%Wvu&8bOAI( zfnDRQ$w4*bpc-;e4LN`s%P)bBRXszOKyMe9K%4K`pIrXYX;~O9?U>sQbguCuYaPctGL{soA*?-ds}ZG0iJ zfiB?9jDQ&|1}w%rky4^EQfoe4n`s)s)nd3=r`S4a8jLWJ4KE;w*y&Y~?x*31_nuap z`6Sl=r!X$WEsghHhU=t@m-IH4j-1<@D#gu5ug9yN!ev%fFQ$GHr-I+`ZKBF99l^!h z@yuzs{iz@tnOr#h@3HPGBXxAFs=8?Pxws>&DAo&e!sJ*fF7-9H#4^Q0U!|n?4SkX5 z5!_-5E_KnlnJY?ho!*o<3KGH>&rC0e0VST9LTMSEiSP~FGiHtAqOz^AlP)Xb7ttZ} z8);BJJUM3mf#tDuTFiv(Up9i#eP%CR(~axKV!ftSI${xnNL2db@;;H$GZ{-u>Bd-R zxg@~S5+qR>qRFg`ySyyaH0bZbazMtX+qNz$dZB1*xHI7w#BIG*)B-zpw<89Fz(TcOb%CJv=Be(;;N$5WY7S=a{?|lOWrkH zP~OJ|QdaMwWGp~_&dp3Umt-zBi$F5`svH%O&+;Lpo~;1qLKUcp)81Oz6Ot1l*CHda zIk%3_WaSK|v!i89c%0AQ+2KFow?IYh~sI4-_wx}&ewC4Byu6@p#Gf61vy|@3*{hv=VXPv#*ey_du z+H0@9H)Lctl)EaX<_=NE|2FgYjfJ_xX^v}Q?r^Q+!a;Xrfbs!lf?wLkK83l%To1=h z>wd>Y%^fH$;7?oL{oaoYHbFo4aNJPtn*JW}85yALz-M{a<_8P2iIBLtHbMMwL>0&0 zhYD_{b@R!=%L}s!&NTQq_CCH9E;XB=T*2qQI}Z1q|3I$EN6j4+tbUc`IHaupjc?s} zm4`Y)8!Wx=QdS4Gy0ZFHh@nWRb}4yiSC_sA`=TQ{9c{4R;1dy;iuAd`$h0f?C*nFo zN?(LbUKReAWb%rs6+W3MCDIW!=R743a@WRE*ue8uPA2{woC@$VW8TwJ+ z&2!=cs2-7_D+fsBuBY!^BtxH%`+Cop;W~g@DT`!jjG(yi6aS??i57Qg8pp$s+F3xr z`ay{62O(!aOnTi!jJMmE8aKp1bUx1LlC%wbjFB}a8kPZE1JN3|k$M~!E;{K}3Q2NQ z+n!JiVpx`yWRebKno|~OF(=2Ws zm5afH1_S)i3B{M{n|Bns>~hcmjk$xyeA}dL;~^X+ayj*+ zNRzXRUCS5?-JQl`PpYZ<7e|SjDOD8=LhGflv~2#(fVS9ae}BjD)m#zyZy6<~RMfcS z&ctTm|1;3tobS}~3swmDSNRLWFs<-hh8muF25iRblpDLU z;MG)?`^USR;n5A8y0aDDQ7&FZWmSc%ScTiq@W1RF953$layFnUM|pLPZynr7plj~5>_fxhaKy|niN=cR#o z6;)OK^3n+CJqJf3#E+yKt}fa{egoXcoTq8u#XldCso+hiF89+5tyg~noHjNz90Ts&Y)N z@t1ct+$VemJ3;Wz$E&~UsbN3f*@*A^zwq)rtAbW2FYx@zP0Hv;1E+lmylNjIu+Cow&bY6s_zLt_S?%8~{R+Gf0M1_r zguA+ z=Fb6dCvY~gBJp_jTv1u=-z}Yj$GgCpWH_m~za~^jb43E8m^ZE@6&&yv;ji3F=ewxv7%$5@a@WRDsJ3I#Ok{dx+_~(P- zJN=`0TCfi8zXi^Mn~3FWkDB7M6E?x`5#Zc7U(gEiRr_mC%`ol&&WYbucwWD(uJqNO zrriziYk@QJdkW8^gX$?hD%G@yP%lRU=NU&X@!|{D_{l{M{2zS_*30qF$E)XX@wmW? ze7*>ryKWtTH)X1yt;ybvdmJ2v>D1qpa1q|u5Z^C=w^veOdE?CF$whb=I<(Ur9EIt| z=jR$YBLWR|2k;)eU153cHo2%9Y2QP-PXVW@LE(AzH?^2vMg#9c2d60Asl_WXzXQSj zM+O(jIC9%~AWMG(+x0ixr*MDXFWb3zl@M>-1n{1Ybbo7ORWPd@3;8SN2k!#!1mNtq zK;e1qTTx!&U$eo`q0InJtAmGNDt}esqQg6W1oxi)OFB%ut!}~no?6YV9 z-qeb6e}|*x^`XG|%UueO`W96$7?6~c{GN=2F8KlEjm65bP~M87(@I#5$AJ?hF1LtdOXgr)YNxGA(s(ox62Sh_Y0M45Zo)=$rxJVwd;L!`5_&tnGO{kps zipG7$w}CjziRI%jHRVNi{rkgjEO3q(h*vSWe2TAwJOR8(zs}F8VG+{2DuJ6C%vigR=Dw16(uXX@z=hKF?gH8 z^XM6T$WI6fbcmyXv$R*??c>G=`QG2rTYz`Y`=IB)Dm>l8t0?z#-jh&{Z*2!zeW36> z{x^AQ*w2T40`FIWbMuD^&&%JG$wmE*n#YB}dF<~BZ#-U3{S^&dBN4$@cHok+K8084 z=jG*9Vdci(&yc^Hfir*S0KCd-zc{4bjrf)T=cIoqJdge$UX?2+`8@=`7dtqvv*d4T z@%Vve)8-A0S0unJ1l|(h9s9Y8&8wG+aAmcd0Ny9y|6~Wpbyn$4Evi4J`}Lvl(0~1s z4(Z4S-sFB2TOr+wO8)?I0KCs~a1^G~9+)op2QK1WIuu?_d6mEZK=RrRz;iE;@aTT( zuu|ZiI22xWc@Z5D@3f)tKz`*FZccC>7P59O z@bo=Y9=-O3-KJkMCY^rG!Er-N{Z&*K3A}$nGzs8cv8Rf!Kv$JDetu6LXFE7W@l7qB z2pj+cSr5Ed_EPbAbYC&Ky2?k;&G6oH?|^m}2^NosR}DNj0lY87|I@%Zh{gnX_$%e8 z0>cs)^|L=-M+2v3FrI&!Eb_*5;N0rqdGw6#=1-UL-3gor2gV0_sqoQDEi&{Na6TBX z^5?}z^?@&g--XAheFEBT`zbtc{HUJlZ(i-INcSn=9JIf}2wDNpggJ{)fDw};$1KlUU-UsSQR<(%AxW6Y7n`=C@~aXRdvxi);VbS9|7;3 zgH?H1E=8vmRenN+N< zOvUHXJ%dqRtL{dF0vZ>Uqi)* z!!`XC(}?gN4uuE0_lYH4~^$%yAt0uL*q^HR}A~xcXxs3*Jl&Y9tv;jlp_5& z@qRocUhyG~rNDb+XuQe(ahiB*hQg}|7ttT_emgW?ks^fo`@>LpP&4@Hh4lQFq41_w zP4?q4-ONe z`Gq0!R|&$0pZin*xEgp%9b7Nn$>l}-l=OEWaGo8A2Q{X@0^dahF9PS+lT_NCd{7-O znqTgN_{O;hsW_QYe5j^q-bj9W_)vILAm}*Z_`-Bmn*+QX9bB&*5QqGH;|kyY3=EI1P`-8f4W4e!Os<6RJh*w3pv6UR4lab zb#PpFi4U`QzkIL=p6h{k;Rz}}PkyPKT!gm*-i^RHkrPNfp1ccr&2I<6c}m>D5k&k* zx|7Q%`^(F&acFr!i&PAVuX1Y9p|=|lz6m(zR4P3Fs(LA}^b;zV$z}rQzJYi!VfWYH z8ED{#f%BJI72mmTd{s3?eEec~?>r-*onNo;Jo*D0_s91i2!Ef015h57zv8oOU&Mg> zDeyKMDn9mm!K<8HBo93UkGau+cJhBHyo+7Dsl|H7+u+`cdmfMYs>0*1#8*`;cWUsM z1e{4!VBqn_{i)$1{U75y6*#|k@VxjcrxvZ3aXz>aILX;6J`WG_q`zW*1-v_eb1D}` z@py7h%@qH#r1l#8z5<-8%Lm|9O{pYLai24g@e6^o^h$;2(LGj~{Pg@J0=xj6JFZfA zUU?z4`-WfbCEzUwPW)!w=)dhta_J~{2CfOgb( z6rQ)Pi)QoJALX2z9UOr2C^{{#s`ORNz3>_FUGyXT^YQ8#dMW=v{V>Y=2jDc{rtrvz zReTj#DVCt}!}-D~$$+-%_Q805h5(URyEYxrG7SpPlVg#tf4%#4cs~LhyHVkJ?NKqg z==AMhBi#d=0@@3f!rRNuUv;&gOtstLKJyNR`0Q1)Q=UD?I+H z{7tU$N7w_86M?h$a)sxszp0ZcG&|3!cvk`E1_uw-q~fcps`fRT*f}%-=eG`CA>FD9 zKmSX?<7ME?YE|ia<*2AAS|L0S=`07%pB+3ezA5EJ{NOX-eGHtB?i&zaxVlJxe;x3` zKT$XU<&k=+t|*!(-v^)jfmi=ih3oP0%CLW0tBoFqHC^ER=uw4Ni*OR(l;XqHe+c(O zemO+Cup99!3ReK{3E*A&D}~EniEnaEk-TvS+`sPN0F+1Y!sSJJpD)4Z1K^$UxQfqh zU;pkq2L1y6uXAwt&1a}H$*G6Ga~OE+Ur!AK?`Ys{8U`Nu*!#o4+YfmC!@vsxZ{H`1 z+heHmvhPhE2Hp|CyK)$KM*=TB3_ObF_YVW_P~iPx7-v`6Mqh5Z(le^C!>2LBd@Hp;8hQK>%N_CO^!hUo1V7%PGendJwcQ9V< zKs@SsE*l0OHVp%h`TNT- z@W_Y8uikyV90|O$hk;iIyz7R6NBQT`Vc<~?et8&phXL=cVc@a;`iFr>epU9=?(2ng zf6g%Q*nh7b1|H>?=3(HGzkD^^_Qs~!d( z`N1W_z$5)F9tIxi>gU72<2bl}7yNZu^>w)veZtx7?9rJ2H`v(5`aK1lOx*Qjdd@Z0|g?~Qd@jnz^9Paw> zp$EY~AM*8~@HW8xfjyxOp-Hm=UqVMCLW5is}^P4CVtEf*Zjv8B|)2nBprAH+8H|*3Lv>Efh zhhZnVsw;8Wi~2A`VMF!^+^G_ou4|FDTKt;&8S9LZsqOH?=5=o?8PB4d!wQ*gSTAFX zzg<7Wuw%3BnRBoQdv2Y5>3n@+CW%}a_B{*vvMwo`rH`*GGwJ}o zoaQvF%rZhRZoXgjkRK*Vai1hKE?E-ushAZqogkoMl_6Sd-8Ya@>S*Cr@W)~er5D6jahl|04*BncKT}ZE2F86Y^-Sdoj$Z%>5)u9gWlJ4PRf8k zKM|()^z<4w0Gj68Y!IHEdph@DcJ|Cu4R5R@igPv3H8z6R%a2tGQ`Yv_=MwQLUJih=w{ zkvwwcq-c8M7%7K6+O$^oz?+D6Ga=IF3L*w_Dp?X%M!Jo?ce;HuP_)E2JF^h!S}A@a zw|ylzh2nV}2O~k+`H6-y9oEo3hj|>icho*GcEwq$$G8L)kx5>~^Aa#(J&n4`{29#$ zVqV5j_TffXx`*O89)Q~b%6TbvdIr?LJ}i7}#_V+05jT}z@+eY3Vq zLe0f%VBegJ(1O|C4G6@60W82Gy(g}u$82*mieYAx%$u2QX2~O<&Q=64vkO~8d@bw4 z%dl=PGnjZS?#QbpP~*?kg=Ha!z)0(h)T)ZX=FgnweG!0vF z#%eDI%nTC-HC#eQn>XymEHAhS3mS8omwmXIO(&%*W_d}DR9^pGTrkyFW$0qqcPSoV zufUgyTgGr>nQ5if*EpUfHPW2Q+jLo-$PNeAIeHJjlEkA_lZ5B0+tLYwu{)-xS{@5xI@Po^9Vv%Ee(q@q>^R z&!-TaNU2Vasj5oJeHW5Vd-=2vaKSojn~~bUGD8fCct;&YAz~z1GM*5<9)LIIJcSQ( zc$4>K_CR!)(#+9eKH3nc=9bK>Eu2t3ZwdyXD3H*&JYGC_$8^2ayhBb04>nKN$D7SK z545uc=X59Dz{yK`!-I_6dPa^he`{oXUjS#?hu(3fb!aora>Wr;iS5xzydm$in{GSP z4#FeYe5PG@NAOImt~p4kgir~gafHV4L@+bFDY2#ZT-0Xor9STEmJxmS&;cc4u`|bj zrf~$>0rIg2Y26vva2`Dh&pN!lmBRyv!R8f&x{@o&@bS>GE7|6JMeQGpSjI++J5`z3 zw){y`ZnE}vc+}ay znh5zW(l!en9xQ?awRDE`Qq z0ro?V(Z4W>71Hi5;J{8*D*lUV=--v9#fy9vU=FgX112GwI^c?fJaD@MqEM+B zz%cDaWE!Szv97vOv*E@Eam^`2FxPR#xmn1}1Yp)FVL!fi)S9kXc0|8zdJWFfqEp0k zia;<-G4~EzPi+RwK9FtZNK=nKc5t$7KUAz1FEK_f#Pqaxv@vQ1-Z&RTS_ZV0|0aY7 zhYlQOyL$goPRq?g*j5Z7LG2nq_X+e}KtB=aeLz1I=vXxM{Q{lrLFanVR{%XAzSjZz znLxBU*a!IyYP193l~_S-5ugXfw-pepBB-qZ#6c`5rxrgXP#4?|5#Q%L-!}mLTzok~ zE9fBLJS=W(_x}`#2gW=i(5--eA<*l99u;Uipp^pcjbG(96VPMg){Ng@3bYKrzY>VC zD!fiWkBeIj-R%j1IsvT`s1MMS0^vvyjrYF>H3Lw)KsKP&0zCmp<@s4aD(0g`!}JX~ z3u?9peE^6jt0P(r*s4xX1N3WgyBg3MfgSV=_bCS)Da!Rg%@2+eMv|u zknFqJ_w~}0@Ptx}w4skr%|*8Wqe$YlF|{wb5hjX6(Gp`eruJtqGP3RDb9RdCtYQZy zi+Cta+>Up$U2q~+E`DRw`i&!_D2W5}#rPSR&x;6yv7#WLeZP#;ZfGHth!XRZSMh@* zIP%VV#hr`RS)cdb(!ptE?~SJQX0)rJj2aWrIt0yzGUmvzQ{C*__M*+w#Z#?70E<|t zUMu9ah>A6^yAr6!#j}0Luv3xc1wM*AGA#FuG z_X1MH!zxk4^9&$GJSH;PHK0kn6FO_yDCHvZL_zRWF<_m z@%?a`WT|O4l3hbr)xTsVVmHzqZ9voF2O8NWg!~9?M6j2%v532i2gwZ&ZN>1=$R~E2 zXu5+eR%M>h5SdR7FCH=|6%U~y;^9Dq{OAo2OXc29`XO;1W2EP!au3I3%U8J=C7k-T zmq^I;>JkJXUTPhoU8P{(&er>vBHoSw%zA1ap&=sXQ2O7?x`Z4?)&=ih$+{EqZnB>3 zSjMcUJ7i0PkSHO45ru~B7SRjaOURxa>Tj6~z60VdI5`Z$uv_Q`uO3jMi|sgV9_+-K zh>ImX!5^pHB2-`OBotokBwew{Niyb6YYe+X(N}-`FvDIhnek1KeA6boL$&7a5nGmp z3K?JMgPo!-LuXgz%C=CM=)zPqx-fN-4&0HWaHy1$$hND@_ezlM5G`o7g=$U}#wkb^ zcWgMyFVjwJH|<++0_;_k|0DKUrP1()_!qBU7`4xwAJre-06B6D4sBD+Kia>+MH%k^ ziI<}3)3wCr-h-kz=q-~o_4>Y;UjHZ8`^nxn3R!9?Oe(W2NpudUEa%oLU;srpx=Zlt znxfg|2?*H@t`O9Y$L}VAPV=BM0ikx``(;3iZ(r|0w|UT=fS$pBPy{*!anM%KvmW#+ zpra+eJ`WlRSw+QsBp~JcMbE7U5W@$xIzYb>=wi?J3P8UVw{LmS_W=D)+$=zoB()y^ zdQRMa3}~}Jk9v6P0BsSs4*;pWoP<&5d2yQtNQp6L0eV5)W_Zvn5BfSF71mid@-N1? zD=~Gl6m#iZ8)pIUVkJgtT`noBsT;HsLoVxE$eMyViCS&}C*k~o%PoR~Sp`636%3|* zE;_l!nb8V}To7M2sAZPR;Hs8cW?odZj%F{K&+f3hK{4Ht1ezLG2>CgeGq^SnFP?>7 zJcI_v(<1pP;xH`|wQ@puV`+g2hEIJR3zxh!kA%OeZYW#5kG3cdEbT& zU5;AnqE09CTH?=Ot6LrH{TCYcm*)&Xc;Co=)iCUHCz#n)Bna?dzFc_@!DU2sW3^k@ zMcp{CV&in(mQpmHf>RqyI6Amq$cH0jIR&jo1pg(ZI1A8=0^JJeC4sVlR5kqAgYF0P zviPn9v{j(BfL;-33m`@0Gky0BvU(1q>}5GO2$FB(;BGlxQYzem*H1wBqwybw$VEa}TWx3S5{!nF)eU}`gaC{}Pb_R@ta>gE;A;QiDxfHE^I*Y;S zb`B(3{5%6mX5|AK;MNd`D~onv!p}n9E~pNb@~*)56^qs{>XRBtE=^;6Q1zM9GER z9FhoXrvp-xrWha^@CUV-_zfwD6AeXu?m9J>Wlg&>YB$!7Mn)#3<^a`%qOvPh%0PG` zb|Y7Xjjo2yP{`FIG<4QDaMWHRyz3%FdX?@~OON=heFP-*%mHm@r4rd2KH2hJ-@;5+=SoQ(we+U1*gTuYG{d7A8 z2rYh^YEF?RhS!`<(kfZ^V?A4M{eaeEo2k|-Oc0&fNa}s*i_RjmX=RhhXN+3n#j^pS zJ#lT(8mhdZXAU7=-1?R+#XFMjudTDParo#BALADe`^2xuZ>gS{&la{D-9`WXl5JJM zz+G#<9J!-WbXbWIzl2U}IZ4^>n1Q;s8!yB!W|lwb4ENy%wp^s7JCek*5qOVch*owY zA~CWpWTaMCZymx*b?r7GyMu8Xc3QEfjEcu*%NyCoiO7Rt?_pT7R&Lr^4Gwx~dMk@I zDMP+x*fy&GC?WZ3k)T$#MtupzT3JKB_T(j!)-&euca@?RB5fFTvFNl@(~{b4p$G*B z`AllsZMdH*2d@;IBKkc!+zO_aEw}_hBLyx%gv{&{tv~=R*1K!pS(PdJ)>r(|$ld}> zkmq}7A~v5pdlg4@0RoraRv{Kx08A7nj0sRJ%m>)`X7(4YA$l!V>8Mp>GyAhXxMJR| zm^K2sOr6vJyAT=D?!D5;E*Dw9&J*L%z#RKNGNW81F-pai-BKcOZuH-}99xxq>0>u49ALH-} z z78WXJ)uvu4M3?`#a=TT31c~&C4>%MeM9R@{^2+~;b6xy0WFQIa)aOk^_hNfgoaK% z(}%3YGCSgB-~gdL*km8pJ2p1;7A7YWilq4*D<*?WJtP}(j2F~GkJK0E>Kk(Uvd)I? z#8i}k%uKEDWizb|qB@&nVxuk#QA4F$3Nw3at%)95esvvJ22JZqT8-dNLNm!!iAD z^!Hohk38xP7jU^D{Z#pA)Q8?s&#!^G)*B|%x!)#|Bk5pSR>Yi`!=&=15^^uZ;-ajE z0!=kWCz|OsaG9W%2lRV^{s!m|0*ykOy)MwPfZh;jDxe;LB7oi$=wU$95PeYF0q8Ap z3*h%{fo9|Pj{;qX-#-bI!tXl*QO~bJP*bi#P^NuXeD?r<*(T5=KzV^q0rZ|gmjF6V z(tRFKueen}+>40YwSe9iw^cV4c9FTH*2GDO%s-X5N zASL*{14!wc{|so8_vCu$=+BMc)O!x}%7wYh>0 zSb-ju^mv42IZ&PeJ_tpvN$Q=iaCE>Vruw`GVa8a{vGZO0wc z|MBPjmY|xJEa*Ym?91wE^bb`#obKR;Oni=zd|U*`Nz*@Vvg>P;Cu{KvqaB@%&u!6g zv^-H_*tNA>s*CnVux^)&2P4Un5I!a{UYd&5*^9`Cai?{EB>m}#dGAKjJ4fmbIV4jL z{cMI+#M^XC`);lk;yTj)_~o%luSU}CoH4+Tls=gH$FRD+N6h{aC9_@#7BCQdtdFdz z^BowHeojNuwX`EO^fNv;N8Y_1UeUm(=VcH53ht7ccYs=zL|83<8M1F$izK<#QWz8` z7CwJKajB}?3=!+9B@bl=#-*g`}bN8rwBFng}v=S%Q2U~!RaH$s6^k*w-YrvMry z^?WAX1R5}#=fp`(=(Bf_oE=gw2uF!yF?j4aV{Xu}F9^l=wwq*TW&L1dD1T?0i5)lM)bCEmtNW7bA;7xI#d`4xG4C=2tR{OHA6Vz%U?H=y{b4V8ZKmv_L3PPzFOw+ z72a~gk;b$ovjE>v2J_rKa6z4Z=Q>D|G6iecoY=SblCH+?BbDy0cLsbC=OB`#^n#uJ z(Ctrpd0yBEbTreYtC1e;NlNe!VBKV7%R&S^T*ejtfgEc3^BNwh0i#`GY0G{X%&vtMuc1E8q&q6tk%wk1c_ zV5!A_WM6N1gm_k$(Uqg=&5kB&Yewi98X!ZCZ^aj+$z^=Gg0R&I&9o9Q^vSe}Q+=OlU4g!5aJwPP-~2q28Au27%tABgS4u`ePea5-k-tDwjYGwC!{aVZ zL1{PyO^xaO66q+$38BzYpU_d)zeq=oijEpdS5%&Dm|rwK{4%okp)d-H1Rn|XWz?V| zvj;qAh%TAhD8}4QLBYHBkoegbz0%vYWN3848jSWgiJnT9zY8RhqMNGC6}Wa96k*^# z_iVFpayASM*i=2HHZ2q9Aer_IU0u7C5|=h zrj=OLj@oy2Bbwfm;C2+;)Z*I0&2Yo@Igr7d+7wofSlEiul*2bo2$w2#7j3gS!7-Kg z0Vby?u4%24IfawkRF`xpdkM)8Dh7A1f?65}Y)_m*k2WkQ)?yo*uF znYt&iU@kMF!Z@lokU@i;pwn%O>h&8iL+`U2b8rMd8Lc<1MR3EuWo~5ckz@i{nPC`L z1XD(!`?UU^AtJmCck^*c|8vnzSpPVw`!36j=Rw#YE8Kzf-s#r2l$Mz({K zXtZA;B2M*IErYA4U9AD>#tGk52&8)ru7l$$6!7}LvhD? zR^_6&^h#OrGem9%-ZiYP=A<5(fP!2ewq&L?ha{#`8B@H}2q@0WoZSLFkH7q^ zGs!lhsI&Ue`?wNTu(TZ@kzR1DgC0Y;=MXq3r(Y_0|2DX(DdCfVX5&Aok%=fb>b0*F zH=4jHw^IT2N!O<33(tcOYCO#78o{Hvo5K4ApiczvLqK(ccPM`M6t^-!DhIWIc=}XO zJJ)l&9?(v~<1NRZ3iO|VJ`-pReplcts8s;^hq%?^H!aY)_*F4q4@gPiHvrlyA#R}? z{;|4IEO^WkA0@Qi6~J1x@x7I`Q- z{`J!F71=?QN2@j8iOIVnP;iHBdP4@^SZtsgJDOgrp-!Oxco4s^ogjJQi)=bnC`im8FHhwuZX&@HU{+X(|Uza&m zcO1j-va)_qCbi|e23M?W{*IiP_ILl)I{UuFR$OVn7Pp~lZD-;x)>;EwB6`Kfyv?Oj?3j5=*v2Gdm1Fg>=P4BK8$F2N<3Ksskrvz)1 z1(bB#1WYgc<1<{U!wtOIRTASa>QXq@hpwvHZB1EIY*cHCja*Z-Td1Pg(Fyu!XMR2U z5L+xPvXdzEhI{DOm79b-?&u8a4c`(fDDb+U!@sLBhhKCT(u!=&@{y3GoJm5+i<>Qo zm^a|lQ~P@X5|<=9{tL5JB)z{R)j^x*BGj$<_u!8{ntzLNr#mKuP(z91{77MOyb1RC zUK-%xV~l0_Um#4(`U}WCI_Y)T%s@RI>(d*TGOEEfimjdQ7~u4SXaL4A?hY185a1@< zqDWJe^8Ew=I)lDb|1dUK-G>`#bo~qw<_@+h5A)1_}2qEPTZCQ zQel4wNQK=BNQEWAs<0;mQenBxNrm7M`f3n(8qf*&4{8S^^_)OufK)7%fGCXzwUYsb z1Zn}KazLxvCy-)LjDl1wlt-ruUJoE%g%s3izN2&`6FrDJS+;LbyB<&paD&>-fK<8< z0VAN!MOx04A&R_;TZeDehhUUtQX+;=Ltzp~t%mRg7m&O174{T3Ic z3(vPY+YS^WNt_4GdIT#L2!UmmheWLyHqsDY4mAR=8_+0yyx9nM>38Lfz~@HzC4K3- zl64TQ)9tjX)3AV$y<3dw($gS3%G_z7G?F4_)V{4GX5R$DhL~?D%~2=%tGh)RJ$Qqs ztmPIYpU1=OcJ^{6W7?}!YzM#^ZGvf!H0^UH#IR4(KC}#D1np+ISOaYdcGz)GU9D^e z=Pai@YUQ2T4zyKfHrCg_Xf`MVbuktM&;2>4vzLhIekL|b)Pql)Q5xBCR!tzWMC-~|2emIETb~QL)qBtpAT?zSqb8izpHw?zn)pn>TEqrSx2qM)J@-l>8l?#? z+}COgPDO6Vx&YcXEu^Ex_W>llIbPEFUI}KL)@IKX1-gFb$J6y^HW}GOtD)C_&_)dj zRllR4AfCS`wBAG%jUQ)`O63PJX#O!qs(&S@PXf$)IeF{#rHL&@`qmj*VziMytz_N? zOjmQg9n%rKUrId0G|^z^K|{v+#9Uz}G$X%3SK+8-W<``Tvrj@T4(7dHk4l8$6;)+ZeTV&bew-yB)@MbMY~8$MP}pR}$aWxxLsEm7=WzKH2DQ z)6rLOdW5}C)H*SJJ?3N)xT7=b+8P6Y(rM`DXOty1I|wBV55_M(!Z1~ zjh11=hEk6>-Lr{Ke9Y{FlyS`LqcliCyYn?5+4oekhW!M)Le$~KQF~n3@RDZ&1Cpl` zA82oUO)Vky;SAA(CAI99lJhgH7x_s`;#nkq}qKPYFa^@MJfvTwg(9X6luet zN5k@>m`!1wkAlA=gB!Fd6=qKDr`qr9D%n85zV!!a%Snh$!XE6#?TiB$wFUD`wfMIg z!vM0RfmGIk7<_37F^Ig|L{}LsdY6N3{qPJ15Hcn$G!{#`r9&TWVOvRw5~aP*7L{;~ zuY?#hv_c7gilNq*l|tJ!(p5_6BtH$|RO3Wj zd|ozK8?)9$KYl(Iej%dYwJsLe$~ESt>*`8i^YIhLYp0}>;}`%$U|M3l0*i5(O48rm z?v7PeSd-W(sdm}ChuIZ3@1>NO2UGra{fk6!AAUu4q@|E&WXz+$?r#LdY}IA8Zf*J705n*3f&HcAMKA;Bbw7l<|0| z(tugLS_d*mc5reJaZzu01-Vo_8>>gQSP4*Ufu(2d1Wd**XEA6#_izzf?evzp1!_!q*6Lfh3X!B2huZ6+qZ&(I1Cy zAjLb8K~hr1o!dqttJp-e8MafoD6L%rg?TS`Jh}TEAb(23J9&0uH@em{Ehf^U68Qv) zV0=}HELVx3GCEBm5kqcy2`?v0v{+uDk0Nuk)fk*^9Ou&DeuQD@3dWn>#6` za&-d4wVBottX=K`tXqf0@!l`E_-OWqG*Q*|TlWaTFZS+FO26LGkGjsVWL5DaVk~F# z&N!Ydhy`uwRZ;Y+XsS<67HlV%i|J={qj+ox6Sb4w?@P#yp`W!Gjx~@p9cn?D*Y%EZ zKf;|Td?)HzY!$-Y@a^OX4a&WAJ*D9#_z%iulJ^Q!koH5=QG^W6S1eJdJ2Vcd`)Y{C zGzC!onSJs?Btaz4+>K33@&q;tXE}x2gfc6ZG32p{Evj&xM)s7b5dfQL5fwk;_{N|V zzvB4*Z>5N{00W&uEN6TIag)a?6^i%ebcd(s{2!I8kjnJu46B=*gv*^FHphu<0AT>F z9>mKKm76=7?hsvQARY%dkf8_UGsjbToq*1*h&HK+mYWdl6v-LNE!ahMf;(U+%hi{3 zi_%sIorHTg(j<*f^x`_)$S&fb;t*{7@Ln(niAs^Py@;*jBj-h`#RrnJsD5`r&Wna3 zXXh{%VSXfM%&ZhAbo6+|>zwYijeFRNMGfBorp!su3o(Ex<+R$=(X`6}Y$iRu1+#Q1oPM^LRwHDLs zwwTuD-hH6}acVyPRVX4@k&$$pXDTY$r8W|#q6P6M8rXVXc3drDH1)H(&5;Y(?W3w{ zz#Tf<_5sg}hPUgD-1gghFcM5W_~eW z_6{U@zh>m)obc=8OuM-R-%;>ukkYzn_=AYPw6nfs3#`df-NeD}0ttd>RM-8VMWa92 zvhUbtSpP9_dZBmb5fNxOQFWEk<}FObQY8!5GktNu4)h zWLluC1qDq;8QFZPn1#K-wSR%BncBVt4TTa4HpQn5aFZ~oX&82UIIbOK69e%v!cR^J zVf&7mZIZFuULfPS7Z*%A$(cXUmvpx6hYD|aM$bHk9An!Q7gvpJ zlN2~Kdix8fP>w{y z!)GCTn&Cb@&4olGu+;#`H9Z43hB2}f8J~r^Ay-`BX=1sjt$#CXcRup$&8dpi&p$%9 z=W23Ldlb+p;r;6YjTVTOEy`^8kAR*Bhjk#TY4>$4oB7XX?kNnNm4ZJwNi=plQkhy6#8|d537WBQ!T#HlQHaVkLlAt zHtc&1arr1}{T%~#FBVB!;ow-RVWnX;DoRO((eyw1%H)w@z})(Bb-ojhjroj!A@AF(mMe)+)ZNO$DT%4 z(oG+74XYb_B}_}8q3Q%o-W}gW?NEH4$^D4)BSah&uBEg_@4`*l4Rd{qo6>^X(}0xk zWSgFX1v|Hh~4c z`o1&5r#u>e4*QMuBWjT!nA<3G{xj@xk4}pPYh`$xJ{>!wwkbn>hH`{7skn0_}w}zfYB5v zk?TFQB8Rg%PSlTRK;qE4g@cXpJGsLMw%Z?CuMAN&Uk92h%n&uMG!t0Im#IxKab0rt z(WJ-trEN!`v!h3_6O5R5K~xrIDDIE~QtOgH5^_fWIL=6Q^x>Op^Yd^v#)sIr8gcbH z$0b)E#TfMlYFQ-K-cfC|*>WbsK3h{qQ~^=Fjjr4pVq!|_!e<{o>uovJ9j=jfMk+bL zX{T;#dc#;a8|gNgA~;{!HZ?74RxihFV!i5&IMo`n20o^pRw_TQD^VJ`7#YR66iy61 zz>5~Gpy125f)cf41w}SOBv*%+MJchK(GgE_^)YnOGb7}qOnv+vvP^RI4EbniguiL8 zHt+>Tqc{A9LQl4%2H#M1)Z$fV|BPQk<(GoWVcw$Xr!IU|F#bJ7JpY*YPJR)CrrTuN zq-S?!a8@`dGs4jz$?Jmb>oxNbju}IEZz(Wx5nuwr~R9izHTP_%s z=3@w9>uvj@V3BDp45()gg&PDp*N%=m4lOyYAu_Fz7>QA!limmL6U#Q1fMcMZm6^o{ zb=dL%^!_E=P*k5y%_i)MM#h+<{544Hd{o!o(oydRv=i?GHj)9>zPcZ?9tg#zk?X^pFvIsbG zZ?+H?GJOOx2pQ#&9io6M)mJTGizoJL*pwL4TkduN^07-l&ZS{%hQmyq3JoFRG9!ihIrOhgvEJg`~A&+3^N-n~cI(!P?|v=%mno}tn|Ea@f2 zfPUm?;^)(!1fZtN(}0k%sdl2`OF>-9WLvqXo4`P5J~H4M2=S0*wH}6 z*B)vQoOZyYEqlk9_OFC3WM{4@ns4sNf!tmWY7wrXPCiz7=0xofDLzi|6izGE z>GCxksnUaJ_3=&eDz$U+wSX@iu)-QOtOfG2(_7`MNnZ9{QpMOU9BD(p(s)0NX^Gth z4p&zdzLYO;ehy!p@l1f;_c2sdq@9Bq^}dk0=&6ryDM732;~V=R=V0A@0=|&l5MQ>f z8nb1hI4&s{M`vw*Q4fL}))IqcXIm_@yX>w;3-n%!qu2`0Ax^}Uoxb4>#v!BHc$%p* zUaHNwKNW69^H9~ow1QH+PPOpGXkwCr+nredpcqx-N=e?%UQ4~>`55NKBXJhhugJXJ zL2mCHPwk8^&VZg6tq$I?1O*hj63heDQjP!{8*A|!sMrKCL{TDn8?U3fPqKR*PCrss4(^iMNu(ZR5wtXrojTP<5+jn7ZQg+()E(B~c#Kq{MoOgIHq#txG@^*b?3 z!5&O*MQE!;x%CWBSHhZC8{+lWxj+F^xy1^*91(|V7i&xU&A^UzBNEfGJirbg?o6Bu ziv+cEF4>Lny%(e2k`mE-kv6(W@+9nbd`Ro%e*y?WkH$DIY{O2HW?@^`dk|t%JM5A< zIQ2qN+LD7xldG=k>`GXiVhcu`W=gIB7A&@~EUSvCHmhP+#|i|GImi8=EQes9H}Dh^ zH-)Mr++d;Ai$e(-Sw_Qx2~7@ignY^5K}@$~Z4E~^iWrjV1^MNtqS`>G+J3@FE&{Y% z+VTNF_XX7j}@E_N6ddoH+**#MzwH)tYMCIP@8im~QE#5$r4@d#L~h zRlv3AsMyem<3|dY!|((Wk=S~VkpNH;ceRyF%0(bw~Yg*yt zw4^%3&|!eZyYaut2ox_i?G=n?09rKsTm5#CmMz+SgD6%YVw}iC+NiS^H%l_KXsw@% zjrq(7x17~ky#4Od9&FOz2HL=hR2VyEka5?V*ql!rQ}A+=n_OXSI(VD?OA_sX;}+)4 z@NKi_Y~-KCSK^7p7=fA_hl=lpmH&;c_R&cj=Y_G?S1rN}=g5ZLY_ue#KNbAx22^q*x(pqkcmIJE&1j%hF64EH+wKCX4(gqF6DykxsK z1Rb2Ewj=}<2DYh4TRZqTy@3KE23r}JG3&sz4cp$;aj5EZtPzG;#B>;WcVpX#I@x49 zb&ko7Rt`x#prWxAaYw@&A!vdMdOEj_OZNnD2A4=3iIE$}U?j-_7uF)!9R8&-$cUX` zL2&$BmOGJ5btNB!3AIyA&c2Fvb#WKo;N9b}R60;1>yIC9T3fJ0rr%Cc)d;ixhj@wy?$S&w#1wm=4vcm92$;)HWtW?HM7dB+5gsfeF$61oUXS z>!4_=KZ(?y;tz~o-oTCIZKZ%AmE^xFT39cCdc!Z#mQEhiKLEU=Q4ZcsoMT$Ap}1@m ztYArc&VsXx0d-;{HJ7*wbk7km;Z=?3v~qx zQOF=}UMRu1nyRU8l3!$|pt!IXhfoTxti}AxfI(cct&_J=45pjN#~U;> zsh)YE&}7iICC;zst&;zphC7DD6W$1V!Nq#gSZ-vIW2Ri+2b#|oGgh~|qg2Eb3uG1f#0X|(f z9@K>MH*kC;;wHV6*EQov4OZkt#;01HT?7;)N2a_X>A1%(+|NE6=r<>Q3hIB9WwAar ztb5pJ^rm^JBscdsn2K6!)%Br86!O2P26(=LNYofT2IU$$o-nBVD(WNV1`?ynRp`k;HxqKF6Dvb5Xh|or`jDZZ40Y(Yh?uj zZ?u}QLFXWCf^-VTk>2{J~KS+)U-0v=GJ1b z8^|s$wos_hBt9m}?ulw?4kJ@aof*_jf2*x(d0uibjKI(8wLh#09) z+2e1jRfPiGk-YU)2RfwtsT9QRll~qkl-YX>OeFGGAZx`G>$IR7&XEYB0TB6iW71ae zDrqavnAznpu7Te3@lucptzC`q2pqA(1R%Z?967=xqaIS@GG@Es75q};RR%EtuW=9s z5)*{Fpl;$g4s|1nn=2cEqBsLV;=DSmyDXru%2|!G(f^&gF)iUSiK{_7ru96SbIjTx zwSpsK!J-`=jGIZ!nZF?eh-+a8q2g7*-%JM? zj)w}16I#hhrCbvJaTR_U!|M&FqT(F^qQEB@K+n{`3tE}plaLQz%?zv-y@4BHG4Qd$ z`8a|Jj{CreE1cXc+g6K&6GtX7R8Kc(czOm;3N{p@OJHxRI)~t2?M%f5fhiAbxnUJ@ z16l^xXETT;KW9l!S3&{Zjs!}kJFSjYmgs8Kn3-1xyxSwS8})( znTO~J9H-f1fltjz!aSW?=IyjAggaxfEUKoV`+}2-RPgUrWm%o(9-ru$F2o`Xy+{`9 zab-cW$oq*>G;%uG%CGKIW0+eT(zThlaSW1{9HR`v)0{AR16SUF!u8QlxSald9 z7zh_eqrxPMU~jBlr>@xxp8`hyQT!CgiT;xRj7J!|d=8gV6h|Z(a{_V5{voj0^Fyi; zFnXbe+FU{^?ri8BNI=hgz{D313h35UaUiEDGxwr|D6Fre=0~D+soXvg95bkmL1{n0 zS5RyyCWu=D+3PJtY!Qy)h zem@uAt)AN-F+z?;IyjRFwXf2>29Qek7RatD#4CUfkyyr{1M^D1pf(6Yk1Kq?JhR;SYVC7?GY-F2SZ z4nQjR=Z!;6N-R$TI#{5i_i}yD1~gLKHUc_S%AxP=LZ<`b`M0pX1EgwK8F9$fcB%JU zk*vEYg5BU4E?|veaCK@;5?;OIh}5M;C4$|0q!C!o*;{Xj=hwP?Nph8#m}kA{ z&Hq4VDqh2u9-JaG07q}=*?rEj_ug4EV85ci`d`ewI-#s6_nF+SR~Z4Bz8it{?phKy zpsDk!;^zO($w9qAL&tmyy)(6eEv?wU=uW?fa;Tow2}t!Uo~x_eC~hmaRe*9rn>j#= zUVjIu5}|_HOMpTG6J6y0_*edJGjHIRi{Q#w|esigcehyUm(|J;B9l#yExGjw;q&W>Dy_l5XCh% z*Lc6CWKbP^XKwyR#75I3JCj6oB226M4hA-?8cgR;!8AW=eHNSanRn(FHXOP8&8`5X zHhX*-^K3+|XLxoXq`N$q8Y^m~!u;X5I6;Kwa~Xgba*gGl>Hjm_p8g`X6+_igz+v{O#16p``5n!*9ZW*u%ld zEmy~!Zthw?qh|$;WxWrp`o$27UL>p5kz|`PL&7B_a-L``YnFPylAmIq;OW8_3q2e(D~;mg%FI={PzEnsw#-AkLkM$ough z)MnvVi9S?CJciy9)R>fVyAqHREnf7X{eYwJ<^WQ{2oH@^c$``*!Dt*HH8AiBKqVM8 zc)mO@O!=+@q+;0yNC_jv=FBmuodAeumIk${fSvW)Iy9mUS3D0ViP_Hru0v4XutIhjS>tz^i z;H+&N%Ps8O5vSDD-_?gx0D4o1i0uA6q)0`$b1WCQ5?9j7mEsEGmw`+bX~U(P&wDOrJ5H|kW-^8tNdnu}L>4?Y#N zt#4l^9%Ir5SN^=ZD{~{9F>Yk$%A5V{zKLiK7$zSO3;*WEF%_@nEofuVgr=1#2NGsb z+wij6xy1FW08}`-SdF@?IXoo+2DCTI8jkf6mvQ8vz^A1UF(}OK7!=4I2G@@4^J|Rb z&o4KR@2JJ68QzH%t)1X2*l+`g>;@xZ4mzk3B#ElS&XKy3_0}uN4+5C}XilCXZCRPV zeIS*b?{fvnP<(nPAvYzEFQ{)tZrrROB`5Bc0RW5-%lcgs7sG*BVCM5=DStc(Fie9cl{GXzBr2>rN=x@*+nR^$?Qly&2UOUrWddSHb( zX4~-6Gu#9eNq#AqS$bNo>V=veN65DQn6t@Q4yA~j*RFNgpcysRdY z`{Rg6@{hqt$p%2c1;MM zI0Y4RJWnt54Sdu!KTyhoT8k$TA3GopV7%E{d`UfHwQ-EzL?(yamCB0YCnb6V$9++z zM%qe{Ky*?!yp>^62e)JyBilLR;`F`}sFQXYle(heKCIjHaY3`85nebVk9ljp=Q<{= zYpF+2)sX-Wf$I!0NePHxnX3?Q9gdZ@S7|6qv>$v%Ae2#T5NlCnl?t#M zbYN2;f&K)v?`8m#uPDxmpjr+2;#M{#lQRB~*j(9ciBL|#j`}ssS0Vd|b60KY1Zlas z*xOMX0*Kq;>T`N&Y_mSzsL{vQPQ-PmtRa8~GDdZ>VU@VytwwR^ZuPHaxlWzE%D|W1XyVrr z1_bLLfyrm6K!1Q83Y%}FrlRRvSW6qo5bP|wJGekeXX5LiIq%+Jbd8HqfNcmTD{b}+ z>@93wfwId~R>g#sVxH}wH*jnvSIKbC8+1!02nHH|2VW=?BZ;I>))I&3r-0BA%5jWg zDSs?|U^fa6$(YKOh9D|e*w>k5bdq%^9IhVL)130jiMk~Kb_iP;fdvQ^$qzcY-DDkj zESW(hv^f&$POo8gX!_z#-Yb}x5b93gzyx(t(zHhMO+C|tf+W{$2VSk7xd9QARiG-- zs@(iq*qo_0R8Gs1jp<8rq0RZT6gC%4SQQO>?xY$^db`^pq0Zkw*nN87*PBC6sP#z4dLp`$)ML@u28pDzHq1DF` zF0giyeCCg5_^$QTyt@?A@F8fzw1lzLS;9(iYabcQ)vzT+UTkSWOW2DoqKhT$MIFvo zn*Sxk+iOS)G5ai>yLw(ojUL%cbF%BmwaSgs1mD}{0zDXJ^km{rrO7mCyATIi$t;qp ztw<7^(nts!BNJfKauzsias}JSiiFfBPPM_&K&JI=oNj{~6EJ|d2gPFCKdW@}He=d7 zWFpvmwlNaIeS1R7bn?RW$ z3!zh|@1x(NJdh|_q#IZU`n+$nQ`|$1c07^DQoY4ey@m5!?jlDo@!B|!?hbPi5qRu1 zJ*;&#FF=P`#)9z1t#!COX9b$S9dZ`*X*<#Dwc8GBXRqZ~5*MlJkT%sls`@>hxOdK8 zOqmO72x?m4s4p->2c5D}VJnNvLvd}SoYCk~fGG_I-sw_5} zV}MP%IQnn>{q7+BvAf^B;x%^lWyrBDBNOb$l+@pqxgL>{>4NiYMWcZEo&-h)t?5d9 z(Inyn??%rqjL6EOO3kSm=LjG}vZlBJ<0O*WYzoYh|D8s54LzKr3tY}SfRY=o02Ns4 zyE2y`Cwv?}pMMOk0jkT#v2x@jK{gNaLKn%*K*XdpfU}r}5()?P9T_qTyxz5dx;m8= zSq0LSZr5{*YV)yW{@;G3OX%?fcQ-5JI+XmHSXe}AHtC0iw(GI^bOEnZ(T#q zMGj+wjv|$=^#@an!G>o?#$B(2e4IdfhG&&mlg6Fd zwsWpVXM|fEa5&Ml#Y(nVR~N$J+BlzC#%nboie%+9kau}591PUyw&yS3n8PC`jN^zWhc-UJ3?YXkROAlvVyb&?{`-i`8Q%-o@qGs(9@C4~ zTg=(s0H64|tlq>ZP;u`_N~fx$AXd<;6x{70_Tm|+8uz9Ec&ZYreHBjHJTDKrDV&7t zB%^F+)=6v~Js>*JkVs>=Viz5lQK0)GYbtJ4d(z<8QoQ5kNJE#N`4K{6$(ij0&Nq=S z82g|o*uaBy+2#%b;TR#Ny~pREtcZNEDM8bk7`C3eYvcQ z4CE7L{|e0XxwO)UsEStB3z>1IDNcHE+cVqaW6I%BH_AvpE_8YAX0D%%H@&t zyK9|fob@!k<|ChM2Zu=;{W6y1$Fk$vGCW1Y^%`!bv!#k4I>1P_9%WH}UG+$g^vfC# z@^WT1Ekm=g)#8=t04tGsEiv)`(e^HIR+iNs{~p-tczp*o#nc>?48jzwJj}t%Y+>}> zx<@fZskA7~=wwE?ccNv^FtcHHuNyT3@tjn;9_)&Bv_TVRz! zw84;JQIk>Qa|YemfZ)8vDvD2&Q$n083FkI@(f?LvaV?D3ggtsHu0Xf)LbGnEN^9A&=zhe?cG1#hP{{Hv(3pf}qjSeK(&xlg`9cg4-K(>0dUU4_TMn!ZN)*Ak z`Y9sd!qJuISW&Rg2y4*I0|MIU(BzG}Vk9cQk7Qw#Y1A^^b!%&5Ljmb>rU{zyb?&`m zf<;mgs0!B7yfN4yZ(z~c&_&jv>TrGumV|v&eopr(WGuwl@WqToz1$H? zwp=J&iz#V$_xZFNCob8plc3Sw)~Jua_`<66=wg|$Q|g}P88hUa=uS8Xs@iOs_q&er zed#U{p`0!CB{da411I)T@C);vbQcdJU+anWY{q2Gvjx0Z8w7=t4t~cG$2<3WDxGyFW1RLku870QqENuBvTWgZDr7mK% zYXHkTjQC$g;?|9L3n?|+afQiXX!(8sR$x5VK~WFl|LO6r;CXonalH6#ZKXH-N?Z94 z3A}u%0F-1cN3hzT5g?x7l2Iu5o54 z0o-=&xD`SRT+y;oZrmJzW&x9A+Eyqp)A5aQt4M*?J65)8oAr2Z-PO%%bWCCVjvY>( zHPmm`(v$I=S698qCZ$Jq->?N$GB93K+P4|}R_Oj}``5eOE!>LH(qocI&raoX2Q_I?u})U?c8e#k^e&bxQpcBeH^f{g16; zW-vPyz1pDo-}-LJp<&ql6~LXe{=gku&&6+t)^kPn)@K=}DOt|^)_>gmJ2{H~=?Psi zhNaJ>WSM0hVcCh@<9gI)nP+Y39=8lQ=n`9WC%riPFPeje*E{^qq0ER}d1__cAUDLcmO(#@1&Pr2H` z0Do_sZNnsIT#OxA`n+(zS7%vr-obgRf&;sP!-jOQm0nK*`Q>oaQT~a)LQ(8)*Kp_Y zJ0@L2dyIYO*Wd)du(vtK5+56$RO*g9N4g7Nsck3KwXf*8g#X4~6rsHH-SQ$#56EvF z7VW&$eX|isP(|$=U@Q)#X9!>a2rf?IE7E2iF+^fVR

10Bi^87(X4F*YByQt$EU zVF0lUKv9+NzO0@tO+l3L98hGvtM zI}8Cas}$%}3ICLKMKYiolTAx=hp(diL8Y~WlNo|NUe$3Fua?SEnlyrdI=RQsg5-n381PsvkS%iJbZ zK5GArP1rRB2~QtKQHoOcF!5F+9GzoXYo%@QA+RcL%WkzvOL>9lUol^$kuNvdK?y5W zp56-=$5NK90Wp4hq_4rYS9L-0n=Im))9r5-m!^IdG~U z`kjOrc1ee5)r~vo{yeQioZWN;hyw5M=OR_JOS#`pX}4X&qi{wpYMm9e&H;ndR!-IU zp~|HY1uhLncQLby3Vmik4PYm5U1sQ)k(q(IJ=LrV_f& zIJK1>QlGW5jmmfhX4{cg=v46I-8KmF-ndoy4-sWy8NFkKW}T$|2gL&@K#29)|J6Ze zrLC2^LS;{NF3v;EjWG)$Ay1X(|DM+C?Cj-)Ub7%nzx!Gdn4fAk= zU|6k&? z_8c>~O~|QpI`tzUm5z>FV-h zs$pF~@3gS~YS@!N6D@408a9>#~Y}<3K*nmjn4Y7lC}#z6|7}_7IRi9eEMR z*W^LSeS8MT0ZBVEojL*N7=xr%b*w=PfV{RJ19@$0fxNaSfV{TNKwjJ4;5x6Z4aj59 z1@hR-sZj^lv5RT&^}RVUDEHb*is?xmc;ZOZ5T`#>JH2jWBz%L94XJaj%i?At)z^Lv53 zRqKJ=@bzzieC)RYd4KnYe)BOn63B7H$w1!oD}lV^?*e(rKL?s*GqVZE>lg&`I!3`> zo@}xI0p#uL1@cl(LKxs-*8+LiuFX95upAcydC5f}Pxlazr`rPLD?5F75_>L?$Ib)t z*sFlvZRNcI^d5u${Rq4U8*~eh=hy_a#zwq&WMY2zW*~o1^$^fkY_Dzt@*cebYq1D)TRAY~+#=f^2dvZ1Q)M{*dHTL{!?1!qcAFIZGx*Gf0 zYV6h3*hSUY#nsp))!5srvHqwgHZ>frn!yl<(H(R2)AGi=W}aLv7wp81pRJq=+%f%7 zM+39v4LKNytqmVToU3dL={tfO_9&+Fc^!|5K5j1h>h;Zh4z$fCluN;?Skx~2$mn5U z-Y3M0Z!0FQXN2WDBze!3Z^ z(Ij>bMM*5B9^#SNU&V{{f_~7I)wd#ob@|3%%kMh29}dw8z-luKQs&e{8lw4yycu=xpcxkJG9+ zFzD7}0C=VfW0VSS%a&L7F=BPyG?`J`Y%$-kz*XEp%J4){xA*A}3QOCPHswPN#Yz%1 z6i&>RF`|U}lXuzO4lyQn#mmGGu7ctU5@-F zYqs1yZaF~=)G~f};FZI*Nc+US#^qWbM(z4xds5v+6fWRrGkK4LSmA<6W20>o1CDSE zJ1}}4&xu2K68Sqebz7K^Xr z)gvQkVMDLlHrSY~9Rg<|_*E&x1;640d;WMDD=m=C)^eZp$^^a_lFz9qZ4#%V{<{kO zv=nhIsr)B_6v9ON-y>1wC zo5C#iEqwcvUFqR@$uogkEXN2$v7RgmqA-p6`xB#6clIhOy4i4t_GgtZ-uWe`mbi z@ey7=g9UJ76Pc{Q@>!!+>=I0WI4+1sedTFWxUVIQ>+yP^N@AAzOY(`neMpXK{c&D_ zC+Bf<(kj_4P<5_-+>*yaHfb<<-zXsgweoLPs%4e$SmNpcBno^=u~<>%nVaeuSxaRy zt?qqb0oh|wds|B$`ho#jI)mTX0aUK^sn)`5x?@V}EZlQ*(e3Ix7H0O%c5Qk+cG+bf zyRx!?(C|pEp)z4TaAzlc*mKdpY`co*;sRsxL=RMD*=;uom0P z(IaI!bXt-qE@*66?y?aqM=NXq8S`{&II$si+Go1^;!=k0Ngbu3{`Q8yn68L)ESaE0 z>K>M-jm?!m31Z0$*IX)G(+;jdiXem&a)x*FO43bH| z@A5yLk~Pw=F%{{QY>=L4v28#n8T1s8V}UD3UY?(jVC^Rm0v1vY`Ab|IxLvN9@tD8ZH-Md zmx>mq>=4y+@-jBBs`H{3nxT@~VbE<8lxCL9C>VPd237Kq0ZcRh!niq!mo-!ns;=>P zD2Rn@_l}3dzqPy$a|d}fx09LP*b8W1)j!^vs&+VTVZ9^K)cobT*IPc>2ZzI9nc9V_x)AbE}32?j|pFtNE#*`!F@1lfG43 z@J*jggUqWh+;j}H^Lnl$CrYC9slDO3+=So3G5i4o87z93poEdw{oj1tZI;zWyWO>N zd!pUiwgnPl8}vi<)lF=dOowmHE?L#+SY^J#tFN$aP=oHt!ZuOOj>6%Feau+?P?{NSiOuvBc3H#T_ZdzhAn-u zJu4pXmKf@nhcCH#hR4M+!$PSKX zUFJ%g*eY{|9k`d#Gku z=uf763J#b?U9Ll7t|yfR+&1hBcF)!~+MlJLq4HVo6nO(K<2so$vnKJ%GK;x(DkCVx zDBsN4xyZal>J`;~?a`OEQH|i;axEJno51mR$h;{I`nY+$+_9=^-t>m$s-fjEo&&xt z%VFuvIuOaK3yz|I{FxY1k@elqes72G3Dp>rF|QuRqqx@(A^KKZCktbsYx3v*5DmNgeECYe-a&S3Hk<9{ zFuEFD7E}~uAPABMv&^O>+ru+s?98{9)+ZbUZI3+$jGWqq0$8pye7V~BCEChK0O3_% zX3qdM^B;fO^{%u=5CqZpHjtN>dny8HRGuzqJ4Gny^q7$o{q3(C zz!Ad<1z1H1C5Pb}?CIj6hzWhjS5avlr3O7IY6OR78CRPbBk{|M35d*6geIFNm#dd3kG?qR(10`dBmB3H@OMY6?6$ zc_}$Vzud_dZVzC~9+~El1W~W+exFRQ9aU#g2z4%le z0@*L<9#7y%1R^^IJ3%0SqdoEdG6eF1z72uceRdtj)yj2f#D)RF0&>wXM{&6t?Z`tE z6`oWLc?jOke3(vKQ$-%;+N}u>7{wNt^lc2y@sU!;k>n5v_L>N$;}_+rtTOFa}h_Dj!Nv z)4|Dl>%NJE33>{;OZwsosr@X8H~b2Haj}IlO>Hwb0bA4H$83S0xUITQFBU~Vlbe=3 zL;8CgwRJ?R*%ya~4cqc#YWQmq8h)Gkq_#!ed4C_(*CDjK_;iFek;UK$?K?n@(8M$G zrJPtA8Xyitqan;R@_%g2bB9NTrL*A~Wtx;MhlYHvlx?m$a;*76FE0>hq-$H#6{qFO zNMOJ#7o`{EOc8pZK{Wi}0Rs)fz=Qh?$c1}qaMytbnv>L>lr7Sm{y@!_ej&rjGGr8w z>q~A&Xkb@zfk#iJU8h>R2G>C9rQStX(y31aO*c{_>0)r#n$VotCLKbNd*>a(^3p(q z2ITK{8jn#bG(WCV6zZ5 zNeyXzUdL8mOi$LX9a^y}_Iv*295PnG*`|@ZgdQAfgRu-qcjcOYmdSm-*mvQ&Q=94} zbk|zwdFRv5Ng{}7qWOc4I<<&&8l4g?)n4fTV`JB|yy0Hl#|Qp3#g>8{q>X{;5Zfm7 zb-b>!&9GSOnNw%VMJ|)ZCBRnKdQqM1^ ztTvncYk*uv^Ch5DE$lym9%m`0Q{M%u_gtdBHmk4A(E=5oLBZqI4VkTdqYG!RXvD<} zw|-G#{$eqlx~PLhh2v=w+91&)WqEbOigEd|BNAFXec6ktkzeu(33&<@f32Owmy6`y z4|JL}QtP+1Hf1%B5Rinlj|~A~28jrU)c}GqZ15&;)x=zgZe9kn!#rp=wqo_QVbNbzX0xgY&zCc-P^M6#KML;}n2h{W}@ECyGqg zMs|W(3hm!~QUSVjkzS`lMdT)Im+I&4xzdjnGPp;sVOv|XQDNyr zvy&jLL}v&H%No(h3iO5PvISD4@#zF&_HVaH4tBB?T0dkq{fDc)Hq~O8`1F6g3jH@w z)?&pr@D=>OKrU5%9?0dPk|DaxFm_^>ERP+BcB>6-8VBCh%~d$cJC4qv?>Fx_UV}aa zSzX6)V_@9;4+-&c7C$OW(&N*@E)GKSdQ?Jt+FHDT_OR_z*Io@Iu0yj&`cqhB@->J*jv)bfq_g|_N zmXu?)|M#`}F50nHcKk1JJCZ-ZoL6~I7ptd1_W+HB4MZI$m-y<{L130}KO{u_**tTvW})Ok@eIY?Ne#dQYmBls17Vtkp9(3h8Dg~xAWmNpnK_t%TFFQy5<9fonf(m0dj2> zNk|r2>}f#GHCqAnpoJw1*cU?o=3TH*5HFj0FKl6HLl~{vtl969-RngZAK%S_;`jM5 zvt>U4Krn?L`ZLRW?S}h^Ot7>+)A$J5(TeFbU61TNPrc`^UoZIW!PBy@{thI>ea3)| z*euzX2N?V2cuDZ;?{KgJUV?ly6VN+Yel!$VY0)5-I<-RivF4RJCA7~BLunJ zt>;Rm#%879u0K$@PECm~y)FyMwrr3qNj>xKi{)zB^8Qnh$FZ5)gHzXw1t;?=B^8~E zZuUZd5l(n4eD$~OxVD`D(=Kj>4boZVLq3S$|FQOlC+X3sxE-gL-}4Zar*ad15jH#) z_P;nfEZt$xbbVyP>d1r|nMbqzgABno`*=j7BUS|?gIQOmLrFGLNHS)MiN_3v7@kn# zn+3#o{pckY^KD7VGvI}5zf7BcZ!76mAYUPp!vDd-q>=4m$yy1Ttgo_71gH)Gwl)Dv zy+?2}*Y!ET*;4DIWHmuz$25vx!rE7sH$M5dGKXUc zi`P)xp~`=2{v+eDNW=q2F&6QBLB;No?do-j&!@S|yEgOg2}j|A_^w~rC-|`;yxTik z*{W@%R7FGi_i%w<|R??tZkgm^M{G*iZz<^8cy^u|ywnEn`jE9@~i zfoS#e@T8Y{9XsPypPrfS(cZAWy=4Pt8aGrs-$H^(NrI!}k;orON@SXDD(;RZh7=k8 zqt8)%4nADVV_L}BhDR^~In*AsJs8gf{?5Y*8$P>Vcz3d$!&jfx0)(NmF`g##f>giw z9IyEp%}k+NYAdWC=mmow0rIsb*1#4E+mpX_>u=d5GVfJj&X+$w(@dd+0NqfM_n(|30%aY z-BrxXVRS}QIPr|;uw^^k@5jSvGzUy!5^_Og^Wu2i4XQ@WHVuva_?h_=HXf3deT6oW z!x&$4n{{UafhEGNXirQNG>6hGOB7KGmr0Bl4xG}oD>*M2IAtvP2Tp0`gT5`=#7|hl zme9Z{lju9}Rjs+wJoMPE)BMKO$|YKR-9cGeXA$tknz9Y|=@QD1iZWawu8iM*9wjJe zr_3urci1_y3#nb7QYJLpEmn+EKZBg01p}ZIVGIR?=$$&~Tm=i>bBz*|G~Lpr_ZmDjHL+R4LdQ|U9r4G0JHG@jQF zHPhT)$^@!&1=Iu$vdD*5S4UJDiPfskwn8_ZJB$-2F;b^2T zVnV0#M|9lx7Raqs{-B^~k-Yc@P1niVP+Tr=_L{>9Tf+Wry9{Qy`lw&tC+=f$spFDT z53ZIvW^!L#t|+>O_1Kuw4@2In(?}`>kJy?T0&1?!aJ?`lIZL*7%I;f(IVo?|+K5H) zuDYdR|2m5hg3oOb?}n8ONl&n@=Rb>^^fl%*Sf6L1YjYMSR846I_uP_kZP+}np=Z%D zjl(`fzf>0+gsBSN`#G0?eJte+r1EHNm)0t%zPrixkPUjAd5F$HC)Spuu$u~Y*J|D8p?|m3vGgJ8LP^PD7!?>J0i&QQ- ziaq=eF6PYBjHL1>F^2h%*!V@Jvxe!Nmi4W{l7Vn&AnEj}`1^jG)Y!($|GSZCSaS>; z9v*y`seBAh$#(v9Iq`ZyH{p$J{~No6y$}7||7C+8tQ$N~COy>mJ}Ry5eb_=VgX@CK zg^ugQlsL=Q;2)}xhF_BEbn1)zeTT)$zPqQBX}%d2wiAZ}?B!BJ&~!>;&~*A(XSrv` zVykXE_lNQE{8xvoXJNAFY_O!#phm~2X>zqabqJ}M?$q$#*|p6h^jNx~Rncp!>B}Y@ zstbrZB`K~8C|f{SHc@db{oz40Vxc5e{jThMek{X~h{3od_cpWON}Y{|!xfMeI3YR4 zK>Uf`$aJid?PcAcI`3CroiWw1hi>sT@oXrkL+ha0ucttXr*_}EK+C_WFpw*M)#ngp zZhxta-j8YfK2Z2Jhqp$=UhTQcBavbgabTA@O+yZMmFOB=(q{{75)|c*YID)IRVONk zLHEyTDa+Y>&}@~Gr`>9z1+kK6(7l8N7;_R^r1Y?>d$yO0Df$IwN8J-7zCJ&->uyK5 z$7RdyVYa+PCo;B+HMdqdddN1ED?tVX1dL!)~!18-VaPJcss5G4(^NDYe~AhSjT5^UM^J zoYx)So>y&H@%&PMcz0^<13!$^5SU6WTd*M8-H*=@apwK8xd!;B#Ak;F+FSls_%2t# zM6(YSs-8r3c6SJPts{u<2g2xjyP!rLQnt-SJ$50+kSNy>tRvbr4Gp&p|5~^*yi*?H74z-@aXNlXu ztHsA)nkv@VuybRf_R!$L@%$uxBPurkpO<`h8SNKOCd`#f+V@;mwALnX+}f#QcvP-@ zgU;S;(6*8Ll?j_%yu|XIyirTP*k{Vm!Sw#hcd=i9ip@9qp=iI`bZn!klqwvTYw6=& z(+5gfZdH|x$RFz0-InM&@^q4f%gr=h+o{^aoE2PDSQs_N!E}gc2bx{?DGipSL+Jb| zD7Lbs@rYvw$c&0w1F<&({F`Cxl|b8#{CN!MX9k_a$hb1>9YC)5Dy6^gu=LWY-vGVO z@(uwx5q=6W=U7-f(2uMX9Zct1*jyk#tYn(dm21BNWMyf67?T3)3- z&!9i^cZ-$0=PvliGH5c8w|UsZAE(NYSTWXOOC;zf9yc7?MJJ>6id3e0!FjvsDk7(K zTyiD2WT{dAB@}LzGPw(w;O}t8%0~loFdmH-ARmqR22hh$=fn#7H3WPemRTD@wNz&* zG8!!`O`9E-E}s*V1sAU6QXh|@WEnn&J2~bDj6p&Q5R9>CX^ zyCnFN1V&OgyO)jjq+aX75dqE04H!WvZiZP4sCEl$rRQVCG!I<}ks>h$6Qqh@30^ zo>-r6Z~1fKZcx1Z5{@Jp&!;QCe-;Ay{?YZcYt@!U(3n(T9U(E~M}nRWZyyR?vSk6% zGtSWsS}Wkx!FTazr;!QIhN-DX|KjFgP$xXG#%}`A_vae=Mm&W8(L*!yq@th0C=5

YS$JN8DzKs0xafLt6*Ks)0BP75|dVI0!!Z!DaLl`%bv(?)ME#wutOqv#eD`qY=M(%J{CIh7@3~J~Z+zV8ZG{sLzjQxSw_%N$TkF5NQFh3y z&$YG7PMZ@t_4gOqU#>aWJ7Up}Ba1fJ4=A#IP4Pj6t{DQ3mhAYA_5KoZw=cIjH>=#1 zd9!>XvQk`JrdRv=(v)MD8#JAFtm?xd8G2LEO5>X@?4ld8<(JbgLw8R2y4fYCMziO5 z#uvL$<-s*=_p?5~e}4LG)kCRa2jf3(|6Amb<;xYS((v^!M<hvh z&t6(xAGA~R{7Ux8=x4_#&%4;~JIC5~9lpL{yTc{aZ*AYJ$p^1pn$+_~;?CCN26d=) z%ywbA(`OY*yBQO#YqYfc=CJeE^=7?rvdxI`yM3d&gL`u6!z~X*cHa_HJge#2dds$5 z2pGO^^@-6PKD6^(eda{DDV1KPW)wXB7l8>VENf#M0>l6q))%SYzhekdCdIg`AvBiH zbtxlhW{*@~b4(p~?ItyLV*g3+-jwi{cOA$}xZV)~8sjlwZcc~6pd|GU7FxrZXC1#h zFYd^>at!|~vveR)rbau-`%BD|&Dh_74H-H3X!eBW3^4vido`3nBXiEN=@oe;x}{AQ zxfngzN-P?9XQPnHa4s8MRD9tqs+6%9*<93+-O^qI^A3*uWVb*e3yFa|IlgRcSRS)9 zN8O@WX76ab2xbmqbq%l}BEld~H1O3XF`zQCmr6jW`IKC;Nt5Sl`baOV^e5B-M zPKi-)*cz39?!6fShWJ!|SQJ}MO(jT21TXRR8f+&4Jg}6yIVcofRZvXaoJ8`}6w=0= zkd~$o*Q8>HHeU3yuJ zNG~3OlALDISPT?jWZBhaN%=tFh#t>EXm>{%a1@rH6W=Y-H0w^k; zO7_W1Y-m#p+stA}i3-KyQH&V}D^u!X&rC3FjB%)ksXE#gMsxg5S{*U=M5{}mJsCCU!&hoWALRS>r8!MmV#r_R1Xre4uFBA@FeC@84h+0h4~>Y zd&i~+OF`!(=QFao{7~i~+*4@h8qK*5OpH&)atvr#PWA+7xmwq-WQFE}a}vp6P#khp z?s4&PhCB(3q-2jP{w1xzLfOCkjAZ#iKDpwo0S%Uj;$bUp8v|G~)DoyLL#{w}3<2bL zD103Fge9k37G&vPe#$Wka>`O%NT3xG*fZn>|Ml3Ho>#vWS?HJC-;t%lUzWu+Us*^7 z9o*l2(vT#4lGdC@1*gm60%f7n_jjK$e_56#1D>bz>20TuoutI* zL2(hG*h~%**O*jeC>9qw#Y87Lp}wGP7UX3fW_nA^@;(d;1PGo8%*_zC(?nUi+bvM9 zUWde%O-S?-%QE5=U{FAW0>a}Bk&((D2?`jZ093l~vtC!VACoO9lXoVXcSXvpoaFZ^ z@;u9*s8vX90v4>Y!;vqYG{@XhV?x>CiG@FsU%U=mN<(RF7%eD|k8_e=MaF~~0GDT}q`L$M8uQQ^;oc&yek|A{66>Ur@d&!$uoRkff|a_lok7cc%Uu}Kfx?d=N}H|> zQQCB8$Q7t3Ljdg2$-n>P=d<^erjL+@E@{_Dt_U=zH1y`5KF5T{=1!6SbUGX^Fy#E= zOm|fL(X$%6GEMC3qtJ~{AjNVAnmL*>;{4&)A*)#7xb1Os$-2c9C-6u??Zz|t0W zY*>0tURa>!9u`wIE%I$TsTw{OM=+JWhw=!f*&j9rrhMgtV6=Lc_DEqz3+;@CWR@Qs zX(*luwn-jlPfB6AL)K;lLxLn1P;(FbN8GCg_ec?T`g@1H@gH$-`A6Kp3+@R*@+t2v zd1JOeo6>yo-{5X5xR?D6?v8?c#oyre65Ol*26q?1z3y*tcNN?l-;-OdxY3MT{U$#g z!zfwDf}MQBPCmiH={#@blRfBQ50qkdY606hY$oL06LyrEs+`M<(^ZGJs6O&>{!VUQ z!L;RAvb28@y&bRMZtej-y;0f|Vp943XLLo(+pJW(169&cH-`83bm~KNEOq8W(FIIM zr3LS_*_oa3kkccT$mT&`Mo6JV)3JJVbcUG;3}VNk`7PVnCHkP22(UGSHbATP5WNpM zCI|BF?2!{*6*>+SqD|079GR43BcVtVdDjq4n|8rQt+=|_O3IFukk4c>1hXj*$My!= z_2B5@)EKj`?7Wv?dDn>9Vj~*Sk*Ok$*!%_CNM#mCm8wh;{M>t@I~u6$Tu~=y-kq5w zq{3j)OG~i|^wP`cE=hW+lhjdiliVc_I^GH!HFBJSrB-oPZK}097d_RBxn5D7=tXCR zkbdwzTsbvX*^?urRPBPdppH}u$S+lr6{Ltnu2w-+S;+l~`7EnlL3+gL{(=TEhJw{- zuqrzF>WeI}l3*4!h0zqOBeFN#aGCXh&BeQS;<<~}7LnNH<``v&iNWqLM@+^fB{(X| zub4)&jx$+2iAaYT91QMYw^}#83rU9{XakBRljiB(E7-G}e^3CoXbP#yWT^7X&C5~t zO7$IsFi8fT_@v8mdSUL51I1=SHG{Il(fn>8ojAshUC?naU}Q1LMN2Pecnp(V5m7X` zpA?g1G*gfn<`eumHml}2Y=@;49W_CEs}ymTJUMqLPg*bETblZILI6POebtv?$yv!zz2W?r5x3=PkVMj z^{5?9ckK?#9C^O-k$P5swx10=V6rN<<-0be=hW!h**0}zQ=1F-rdL??TkB4h8aF5! z`!Kjn3;!$4Vq?4RaKE0udT7{yk9R-v>6rChi#vmhz3sQ=QQ@_B?zSBKvQNg>-~RA* zty06gRJ-Br5ZU$i^}g+PNW<6758qm7)>*ISm4l9b5nZmsqSv(!1*aMM*F3*)`Hae8 zfA-L&ciTAkM7<&jGiJmNEZ)qo^QKug4@@z(zm~5)+-33r52xk_+gzKQ+^~F!G1hbH zrY*Q#WWl7>zx2N!@6&DH#RmJIOz-t!`Bu}thu@k$==ZWm>y)4MqEN}Qi4*&Lwq%#% z@+KdCU=uK`$)cd@OD|R45OMoux=pWh_lkaYYe>)jg^Q0^HB+1Z-IeQmmOlPr{5iWO zr>c&hcDZxy(60_&J6fmW(Yu2mG0IAemtU8h*k#la-Qw!Dnu>{S?Y|#;LhpJL{Go^yq5aiqoQ+t|?pWZ0)qHU+W+Dxp{8mj&n8_Cq8$Y_^M2`Ex&%}Fub>? z-{5WiXa6+Af8OMs3u?BRKc;KnKkifut(S1{>Zuj$DqR>_J;AH;;liKSJ+ZRS;;BF1 znl)k4h3#YBu022byKR$vA2r+8w6ODRCEv{pbA;xTC1Z^S-9RU0k2mcZR8B`We@}3- zXnvhr{#U#HKh`d*(Nmi5eDU+q;R$uNA3y(7NF9%h`;w{-ZMUJt=4WrG6<$6!u*C1@ zS~k)**8H$?P~e@(bx%8gIJ54`F?}-1pKX6G`_P;+ciaxfY&dv)W2JMSl<~ZApmvug zx~^RtoLbQ_e%&KYi}6Rd_D=g%v%AZb+xJ~=l|7PJ#rn~xQwQTrZ=ReOkkH6uR`F4* z7r8o5E>?MN??3i^vSrWBKWi=?_HpwAy#1TsueVGdzGkt@ zrSYe?>^f{*@4TVSUY9i!zB(qEs(rupvsa#XY7c!fb?`T}B3myF|FX~Z$5Bmd{%mUS zU|&kjN#*um`^w;W?e)4XuSS1%rbZ1Xn{TX#7b%_Hb5X^b_xCh4zKV#s)p&51{d>nW zN=v`+;;Sy7EZ8>oW@=Ou>pOifv@YDB?c-GoQof6=U;0@Gw`Y!*oJ(9bEgjU{edf*C z^J@3s9`R@8Uu-?nt2|%oRiXc#kLUk*qU7d}|L`@w_;c{is)rUtHJj}5D0}SJQ(Wyj zWqMVPIW_JJ$?3%1mJRk*_~5%&R&k!wdtLYJk({+;ZsUNfLwiiSw6|K1n#bVvlRB4qdRR3SqJvO#Xk-T(5HcT~t!YKy3a)Mi^0)A02+lz0b3c4Mfs_{5Ce= zNs}8p8PWmmW(a^iI{Zs6zel6`aNsZa>k2+{@ADk8;P1YCVH}cCFS_b(O}AX;;i{A z^;C2Gl`pNcpmWZj#<5j%$=k2HyJt6?p6KRCOS3#X`4(_Yr@Y?001A0wJG&UgEyqcF z>f=7;wcz;^kU=OQ6dJTH;4@5Pf$Z!m3QJW2hA-vKHZ+zKXGo?24du!k^SBAC%oR$u zxC~@CXp|0O!G0wVe(WVX9a7$yf)S`(?2JuWM6EKa#l8 zRj-*{%}vYh;b1R?i7hbR*mI#%qJ&5c#i$P1Xo(%Z$4;e@^mGoNo*j{sq@oDGB`S{H zasGB|UDJl{ex17Y4uGDaA%TX1QiDm95Htacw~j-d*+=GcZ0JB-n1Hi5k*eWQQh0Pi z6hGpPZeUQ3=o}mo$yxz9U#Tg=*d+@%p@=sexHpo#7>tHc>3o0Rq!?2)1`Da?rxU9T z7(EnqoM;uPCW6{Po9S*KodM@`MNpf;Jnta|sFv-q>@@G(LNiJDtK+gj2D0%$eN5N;ir|8Tw zk-RxxDhue;(MyV>qO6ScIfTdKWOTabA=GG0j!%r}@UCO1u?axF1B0Krrko(DE-n0$ z8%6acadu|TttdoAJ8XD9kcycJ%|%byCsr_(s$7r_P!Y3(;b=nz1}^C~keo8ed+^Nk zG8NK;T~%e4gISP#>HG}HR17uY(juIF$*#^C2pynTw7G-rC!`BIafmI0w zKD6XuZZTy!n~9;8c=wboB9aeamQ7k7kCZ@j3xoUP*ppirYPiyqd$$O?V;=9(a>?;1 z{$L?bj;ECTmy#ID$I>!T!SiYtAYz zv!N$t&--1u4VI23wB#WJg#&N-34nBIgfdpaEEkMpjv#{QEYMgw z{S}r}@tmI{%~OfiDhMy~Bd~NJZvM2eX4ITOfUzc=#{3?>=i+d}@s{E5!6w>HbdQnn z!(!Sa#aLBCk=EmkM6LGSgI=+Q0)K~QNAB87t+zSTiLcp{NC2hft|TZDHnm^oOYdAVRq=LF3_Vp zsvL0~zgcCKiY#9O(Krib-E2-LTGzR?kyR5otk$Df0AFrr4vA?H9b_xMshN2Ss@Z$E zcMJ6P_Y;Y&u*&a6E?FFv7dgY4pSdFEmUFm+?Y@_{7?A*gYzX_^WK`hPDyB?0s|L_> zOD%UW5^ytR3XWi)fO72BQw${4xe}9`bFg+eUjw69GWAzxgUx9zGEGI3>vjQVCrB$~ ziR6_v?3`Wdrm|&<=o-eT2SkLw6mx!)Z*G4q2%$<2%6qyDgepV@yLoq0givdQViXjz z+$?gtN|pXh!xZxRQlvrco!aK|cDYy})J?g7!rZO0)ZfU()tv@LsAI$;64+heJt&Z! z`E7pbrT265!Qww|9clc8^h++|x#|v)wA7Jh*#=`ur!({ZHg#nwu=sFRqcKxPQSI5y zySqD@r&Rcr^C#H(>gLPHm}lMG^=|Tdscy6%F@WEBqc`bPwX;9F2!*R1hJ;MGrqlA!jz+Qvy@`5Wg3-yOrjjus*rTTPqsW+;=Hm%(eFw;4`o$O#KbLYW|ksJyPqE2;;zJeBS;u9~7t z4XL}URD9g8V5ChqW~+E-Te<&H@=rj&nl;}1&`A$euCJByiDbU@rZ*kiZ>}WsrDMs? zzQS6v5$QZ7KgUW_1s)n{%v+v?%ax1DM@Kq_2bC?q>cE3HJd}=<5;B;@ zDinoLzMKh*i-)O?04h)rxtD^e5(8ZcYtdVFrvme|X_K}psSEPhQJIwx5y{bz<2Pm? zyZF?FAj&UE@(}h^T~MU@$VbZA6d7_vK4w8~R_Gikp~zk|QaI}2`Vv_Jq$b_%)sPuJ znh0Q*54~5rL8QOpEgS5^Af}RsIik)5S0y7;(L8?0C(H>yXx1-Jlq8ySq;(pi`!44R zwNVSc7fEpDQ)U!_*a8|Bgb<}^6Fvu-Cvn&`D<9IQemp zGhJHFn%K%UWU7y>-=_GT-+K~*2&tT!P(0W*tn$JmT1Ca1=ZSn!L8;Hw2bQR^NwxZ3 zH8;se3z(3WZwEu=NS7D}t9%mW25cBPMa!DqZwYy5_Y-BEc^4F$k45&HQ>h?1cr#0S zcQHl6`vR=xBJuXx!vlb4~jl2`n2f&VrPp@E&gTkL&dk2*iqtJ?KbUE?G^1? z?Yfd1OKvH7wdC(5Zyi&kJudaE)XP$DaJj%}`?2<)*-x;a zY(Le0hW%{&1@_ZH+Luwj6F3rkUue182h~);O{i?`WM7e@D}D9MQTXj$Qx)qn{*L0u z(Pf|?5o%}r`oZml+XHtA?iyTYNa6=~Q>H> zGX9Pve{7tkMYXW>49qbE{G$q`A(5lP9> zAfT~unQ)WfrozpHn*;YX+(NkT;g-TRLhRcVk)*4bA$LRsX#J*=r)l_h5$+fQDS_`# zQF_baw<26?EC;B8-#T#h;hf-H;F`m=hHDSk5zYgyGn^k>H@F^fec%Sbg~3I_4T6h< zON1K=Hw^A$xKVIp;68(!2sZ_82HY2LbKw@ieFwJ$?gzM^;MTxxfZGDM18z6muW$$9 zj>4UUI}3La?ke03xLa^{;U2<0fqMb>2F?nWurORvxDs&oaOL1C!c~Q<0apjEKAaPr z3tV%!)^P3NXu{tEzn$Uy;JU%}fa?P{04@wJ67B%fKMuc%a0aCRaAf62aG`Ln_!cBD zy_hTVo+HY8jwtUrA`Rt;G?XLKP>x7LInoJ48p_|1hH}(UAkt9&jx>}b(ol}t3gjw~ zn?POy`3MvsP2DiV`SBpag+T0;LEvT%eHxjTUH}K;s3PEYLK8W(oAA zK=TCpMxaFkEfZ*^KtBt#PM}Q!Z4+phKzju`Akblfjtg{Jpz{J<7U;S_HwC&a(0zd( z3G_^$R|4U5BRS7)1hN&VxIiTZDkD&Nfhr566Nu_Hu1yXCH590^KurZA>n`h`K&}G0 z2}HFer}GggKp?6w_}5+nQGLPRg$NWOP?SJ10woA!5-3HW;R1~mXtY4%1R5{UWPzp$ zG)tf_1)3+&Hv%mZXqiAO1^QW_bpmY?Xq!O01llXm0f7z+ln&ik09Ugx+8%hjAMQE+ zrUU-y*)FUVN4DZ!ae+z-R7Rlk0<8ub0AH=(Qy=`E#xFe=h0h$3&m57@9Ffl)`2iIH zH^q?JRI|ZNN35-Yvq6nUIkN-55Aio0wWWRsR_TTajUx(;BMOZp3XLO*2S*eSjw%bJ z6R4Iz4gxh4sIfpz1!^hK3Lq~?>)-~KhxNC6q6vi)a5pqOQb3{^eL{f7^ zQgcL7b3{^eBq5An@K+bOhj2yl_YM5U~0z-ojthy5B47gR2OWBMOrv3X>x@pyJ@6_Rvu{dQJ#Fj);#V;^T;V zAx%C+U5#IAHGT_6VMihCta6f+hTr0-=N|+6;g_DF&?KJr9Fe~qk-r>K8gN8uz!9YZ zN0bH}=>(!Q;O`s+YA8@^plHYvh~FRJ7C^@PaP)jEu<@$Y+k6*ufI`6Awj{?2q~3e>kxrIQ|wHn2Uzqpmm8;e;B|&h;A+#dc&V__WTz@ zf@Tl?r7%uEe$>T=A^JK|(C8%YyI(tcFG(;d;37>TuJjdE?-UYT-35)pWvm7wJTRHy z8b<%ZO>Y&B)7X`0rV1K`Yk(X&nzi7fl%l8Mty;5-2(Ac0qi~Hz>7s{H+gd|*h+^3J z!p1YUg6lIuqi|iV03tlpe74pshIkZSwE^Sq+6k_kf=1yYpXotE99*3lmZW)WcLo;~ zT=b2eqLRWDEo&Z`0Beo>ht#9@8LQ_dZ2UltuCCFOew8sc(FG%Fc-hm_}8FCF(9@w*Z(Y7jZ{DD0qFjO1zy zG~H_0Bdze6j+LWF%i^x~c>%syYp4v7P82$H!AZ*`BkKLN=wJDWe+|@8qNUdc{cwFr z;qwteqhq>+9-X|dnrN*xV<9uedDM=@cS;Gab%I7opPyuZNR6yDWsoEk+0t!?bh0;d z2^xiKtviT_4$hnxMP7xMFD3mS#XN7g#BA=aAex%pam6$4C&njh| z{!noJA!rn?MvXv@hjPU!C_NtE-%G0? zxRL~o!qwk}(^bTewT5aidIsAXt5+0U;etltO0CW5D&fak^8hMGvU-GWHdGQ^p9mV_ zQtK*dI=4Rn((!&j9;zgCwI3-x9;$_{HI57;Pe1kkptA5eOwcIuG_Ar3>Bm~r75`FM z+%T^5@hXC=wV+YBewQ_hQrB7|tFm$Ys)Pb|sB%uIO?J}W5 zz>PYB>zJTXxJ+{Bbs3kt%oTWlp02Lo8YXBIu0Lge92nP^g}BXh{A|Er2f_7R&?sCZ zC=fjL;H))c5Ej*XUi!;d>ItqiL8EY$Xhl5ey}?;)R)dQ?PSF>sQeSYD5i|352)K z@DW*qXBlM=9x{v8nkVp;Vrb~q9EK8+WY156M&W8$oquV9A8QRAyHD10(sKLxO$3*V zpdl``&HRShOfPUy%{u&)@0U%4%?y;enlhh1r+?x6SN~G9sqneCpi$&uLW8auaYnlnJ!W1z)%_N0uJ*fbm=5W>;xpI{{?e>dmF1WS|8ilJSDJh;7aIi>7M#_qZ zi>sAxA-L)Z8ilKj+&H4j*jjT*gZU^Ro2iS7v=m%49!yV5A>lbWPpQCIYvSo&xLMPi zu4*N?t_T_>tOIgX$Z(tE74m#aaBIPJRM03~6C6N}hpJU;O>Ia>VGZ9A{9zlxHC50k zTs39eOVyaQCYAn$yENq4?Y4reo}f{!g?v!upJmz9f(Ke;zW;GSsetIh6KUWL4-9?=5obb zYmFOnhB8OG-n7u*Hcd_kjdopJ&Z9uGKcjbhbz?YH~fLvURX zGz!-f`Hd&zs*WtClH&FKz8Ri^>y@CMTIfrdOzwduu-R)-fdC$EwbLP(O>?XL=sUGUXJuvjUpxUHf zQO2s=<_ufMtF1bu3R1?ZUS<#0h4NANdKz^7yTH1n22jST#=1jls;6!q_g=L%^!}Rt z$E29`NVTMlRio2sCZ8}-jOsGG+<0*_Ty{{DPo z15!gMW7T9cry-Qt#ICNFsw8VjY6fMj3eyLMn)Le!k9)j12QFPOv{@rk{U~GAnIu52 z#!x?~d$+nBEVM0dV^S9=V^y-mj%os>ugAtvk1GBgEvN~pG?cMwoIZ%v)KuL(ZvDPY zPffF}{HH0YDU`7)B)5}mrvB$~?^6xw9#($-a7Hsyy(nYV`^=7N4t3l4!49NxGJ#T2aQTtVvZ!O|8_; z+_hViT1pwKKIk|1YHFiyQnexV zg)&z8o8`3iQf*0fq>NQt3h9vFdRSAXhsmy->Y1#vck< z+>X=>%2<`!>_LAh-j+Y943x2|MRpZeQ+svuxb{adnsQ!xR zUY<<7XLA6l#(F4GQ-I5=XwjWHf$D$iN{&)`Gbby4=2jr7*p#uVVs%FaL5)=R`fwih zcC`A3V0B;hRGl(b`BiqF>7f4SadXvyR1jsX>Znh5YU-$NQgtNNjWSkcGJWm@rC-PD zeyun;_*y4Y`X9g2QzzOQZS}@hQ?R;u+&=1FS8wp|L-qud3Z#r}t5H!EQd4Jj^SI}# zd%ZO__S;{(GpQDovC3`sMHi@D>Ru1(r56_Yy9=pUl(A~JM}^dc^PM}L>Yk7KX;O_c ztGkklq>NQLt7zkLbyGLF4ZD%bPZ_J0n4`Np)Jk=)1~*snjxBq4C$*9?R^>M1DqdZ? z^=Fm(6!(7jn2{l*3R1?Zb7na`&{kY^ucuof<;M3Qb%iok&DDpLntH06$IVqwQi~~L zm98W`g{qs!yQ|+L6uew>9-dv_Emh^i_~k%*tVuR z$kiK)uUBtUvnXTL$(+utK2W38y&)c6=5z1IK zps=F`Ky6S;7sATo^VSU@HHnK;c+ii zdpVtYR3>(!GJ{Ahpp4xbRn05L!BADzy`Eb2?67<=salk=ZH?Cjq^2S2=5hO}_0osM zu!ThmahFm1E0KDXJaBl# zFjA2^pr&Ci+tw#jEyLAZbxu+Ds*|Xw;iRIO9u6mUqMQn;X@t6Y+&`-OnCjLn){d$p zNc}+>+m=r@6;jg=>gI9#svfFUb0ta@=jaclvQx&Ya%Rp*sD$cXLD$TOu@a6XRhcqY zJbzCN0Zt|8LP6H z${YiwD_8eWze*WHDi39>YHqgtSSbCp-tyVbr4JZOsx4)#N^M#n2h~p9+a8W1m4Px= zoiaz2#>xO6fDv{ulxGr<3YN8LJ}n z%ByLHx_R71Rq4i2k6H}$51v74Hf5|zom(5{o7n2}N~QFv;NYY>IcAc|KpCr|X9L1F zY1OAfO6dh}J9xC$jdwsw8Es(%)&&(;Rj4xb@np zq29GP-;|?sNIj;ERac9ukec)>L-p!Qk^JgW>m~R0%_Vi4GFBb;Q6V+WQ#X(MwCW+o z!&!~5&m;A_k51@}k9p+~FOxH8zWSfX9jf-1K3CS*n|{)KQb{Od)e|2_Er80c)RgZG*h~0V- zsh*UvDwlqFp{B*^=5gy4(2?EQ2J~1=ssLrII+#&~)U-t1JnkTMuR7_ZY!kse7$fJxLp}l2jyRta_{m7oAhLsCU`=n!_qmFDPSGF}(rQ zv|8Pq>j3(vdx>&3Sxu@8WvuF^jwn5?Q8$k}Ty1teWA=zSlh=?6ql{IJ^+Bknwd&?^ z=f-38nr;8A%WFxsq>NQL%Q(TGpi-!|VyH*C9=#j=6RG@^u_{G+N3Da>zv-a6bGz8^ z9P3D>rHoaTN;+yi)B`m@)mM*BynK~Ym;?KI^&;*hnfFWwhd-KrL5!r+W2>U82K*{u{Af^fJ%sl2Owpb(58_iI#kY zGPXZ=O!aPtdZ0>9*Xz37@$+mZ^@uXx_Gg9YPvw8UT-{9lshCtPNKISR&ExK-?$su8 zRmjqJ>K0mZb;{WORAI_kRm05r1?r6|6@99#{3hj% zUr5!ZjE@<^pP5&=TcPTzd)?N{U8l=!CH00fwynG7EW8a$FI1~vEBx7H8>z>Xu_~G= z{9mD#svhd?Tp(MI9KVu^O&Qz6)LB$WP21JY`4)k0OTT{JPAUUsY+L?0v{B!^P&f4% zkRtlnY1yP-!X2bKQpT!KQ{g+ImZ^I^E%#kPg+)_`?1s|6RjhuQK1j`U?RMF%QK*>ySuI`NJnk=Qy>wx& zt=F{i9%`!uWo%npOeKsDrA`^)5~RFzfgGNZp`} z?jb);SK_$PwUJ2OHe}yCZyy~OiA)doW6Al{5tl+eikMvbm;JQl6qK?3d9FihI-qW9 z?8RgC4e!B2HygI8`Q1|+*H~dlEutTKE zQpT#PX5>HYr4Ey-MH#DFS5a{_9Z|QaZ@e6suLfd%a#S0`_G& zN@_1MRqFzVO>TK`<+xwU(8e)tClBr=KP`lr>@dCKe(pNowD{1 zQfnz=RY85KR?}H^^SBG+u{y&JJvsj@sp6EeYEeNacn-?8b*E~_=jTW*rwl1`200I9 zPC~9OBjTMtAEhW`)rD+MTNj}8sHG>rIDS4CNL{0hRi~;txr^$5>MY~@;EMTr-n5IP z&QZpyFcZ84Rm~_@WaQ#Yr20|Dss;I+;AN-<>Ryi$;ngy(zf9^!%2?IO%(()k&l-A1 z_dm9E+Z9sXDPz?nb1Ywlnx*dbbS?GJmsd$mr;Jqx%bT3~pU3^3^Mk9;!~-#}kvc{h ztHRC3z7Ew~odnycM`<<(b-PZgKV`Jy$GiR}vd4W+tyC|iPHatD|2iG-|L7rGO*hod z;~uW>)h+Pc*x5H|$?jNcmYQx*h3_^;%1t%b(f|GgIZ8q#`L}*W#)f)o(!+ zS0tHwRIYvXthY$rri@kd&7p7`O8?e@-fE3wjJ$W7)Kbb=m8_@=sp(I3^SHzGy}BKl zw!Gz^Q2LL5*jEmJs`b*(s;d-g8|mqex_R7NR1fv5lsp%61>K>xc2mZ-Rn1q0)O1(f zJns8()Ni<`M``E(HR3L*+P-R*n(k6tlg)DOskt8aWVK#ux4ITSIr`H*QZp!H+nQj; z!~0N^)V-cIUrV#?KB)-GSXIFXG5nUabDc#0d?3@-;0L6tQpT$L=3V4NmG!uW(r!84@dc@6l(8zF8J}N5ok-w(1FTerh_x?CC83N~yb{);5|S&c*XvO1 z$m=hu68f0E{0d8+sqfXT&gBmSU(u2WQO5QsjXBZ1hN`a)(o*WttKpUXUqh+CknX4d zV2qmSdW}lp{rL&~(ZgjTb(^}fLyp(fpI241ak<{8o5yYY({tV+HAinLJ$;}I^~b!T zeyg5U?>O|mx+UH9qV-!+87X7c88i02gUYKGuSc5!YgSf$N9qD)tO_irLTY-iZt}g} zds3Y#<6~;GnBEapjpn}Ug~dB#VKP|eNzb^p>nEwz2(*=ZQ9|#pXPf%O{!I1r+H6DAfV;OUcwO`N&K^kqg_is`Wo&=Cn33(P z%6i<-)#lP;=Je%fw|phllQMQYZ`CIZJ*m9&>QuixEOTmxDmuNz^|XsJ->$`atcBh? z`taITCr4$MTlZB@>r7jEF;Tyzm9*^e>uy@|7RuPQC}zf}Xi$1TswP~=&hE<|jZ_)R zSoJD{Zc(?RZ+eu_eNT3Ncq!5tCFd%2+jAjgoqbB~<$Ot0H5O8bcYYmYF%Rg<3zW z(f!z@^xyH&Q*5_Y`mcBBN&nVw)T_$X0h5B`kkX^Jld-RBTkLVyQ{}CDhXw*@|bGTf6d1EElAz=+M`RVB_tJxGFI(M>hv%X)ChHG>(k)1 zd@(vEB6WZ=TJbSK|CW5zd+Md-epJdHO?%DxG%=QZUcCa*$HlVY5v3B-l7FL&?N3@g zxTq-!)DrbbpHmujy;U^{sZ5lyDma@q>f8ersLmeQ)lVa;rI?FD1C)ftAUHN z=fj^S!*dBJW4FeMTzJBzzhy1kN=I$|K^fat?i`Lv52eqOdK%_m>1ujX1u0|IkEYKV zyi^8Kt0`mEDs#@w2$fasFTD*rtRD9yBdPV2v1+k73VfjMsB+SWX`Uyos`-#wK^d#A zt9sQ_Ca4Fhtu*SVit)$v$wcZ7Wvtp^=46J_pPB1{WclAm+h!)Uk1|%3O|4r}BMMYX zrF8YaO%YHc3#m$!v8uV5lNBnSQO)~&7?_n*Tgq4!YHAF>;o{bxv+3$xy0mz+Y^3^9 z#;T@fj{Z9X9=F|wJOAALDLbjwl(9h*t`SE4`sK;)3&uM*m@;VW|4*Uawo+x!X?`CUu80R%KHeJr#i(rMjngV7j(rY8N48 zhC`LH>Z3VM_4i>s?jdTu^d+ke>3e1?N(wKI)!d?_ep6Mhr(#gc)gwJ4VWBj;ijg`_ z8QWGh(^he)9qO3S7fzl(N_V+9soIpWDxcY^`c;<4oz{$Ovu*^fElrlc%TshHHW+|vIW*c6pedk6gQqw47+bWe+Em}>bq0*~I>VfNi zy~}w^ld3=&t1=hWM!i>o((l6cbbjiLy=6${q>NPs%(bSnP>Yn%L(ADqt|4Vf6{Cz@ zuUckKIjBKuy>cowaNDC@hY*#6Ydt3qn31oc22qk0_sy<@J`l}I(Ej8)-=}(_M?z5&UuO7XTq6(?Zl(DLZKBcKif1}ys{-_@5 zN|>-B&5Np}dQ--#t9k%ZQ#GhP>XF*it~qbZpQ%RbHf5}uVCGbZ>Y?_j9<=5Kyv|yk zR0L(L>TKR$)PSm^go3Uq3nRj6km^AhtA?6al{KOC(WIy3o5Lp6BsGdMRt1)Fa^FMg z5nWIE)3@(Qb*79}YfPVOLFtiCPx{lhTBJ5o#;WdSPHiarYH;1w2F+@d3a5-!oufHR z*WWN#zp<zkWDhhm_v3daC2LYL%IzzYVDVhJbobtGdT_U8qZHJ!P!&_fa7= z)q`559;s4v^|RXbC|zUSuECpDQeR`oIO2OB`? z_jl@~@9O{hsNaq~cJRzvU&%d|qZc3^;WvnV}meUL>r`mw}ut@2%cycpRB`IT7fSJ=ADz8$RmAd=S z;!4d)1yjbV^=3?H0j2*onLeSd=s5J37NmZrj8z3Is*svmLiJUTbVW7G95-G|QpG7_ zRZLSYt)TR~LVbEKnc+%@R;1!n#;O>4(Q0Z9^+`Qa4_wP*ls?^>R6NR9mBt*tZJ>Ts zOVy*mli}|kw;`30GFGiJ<4;?t0;a7MRR(u$OKLr3top-jA3rEvA$q-b^tqkWkJKf~ zSk53-s`6(01VA-ZLOpPuY1K7(0I4dJvFe1`K7mkt8wQg4gECf4Fxw{x z>ZH2YZ+FVIO_(Q$R0L(LidRvE)YJhgP(9MCzTwrttsO`up^Q}*Ra#FSp`NQpdVd|P z>wCK+sq2)nYJ%B5ouHa1p(8=Xa>eaLDuOarO*Pvm7)p;+`dsGv0UoUc|o`I%5sTPb7Jq0B(8FsQOh>CN2Z`O^tuq)t%As_~}J;ZXX! z{CZ^D8#~^ha8gq#V^yi*PFua85~yn=Yt@V@(X-#}MXCa2wBoO*H>u@0-!s=eYK`UvFA+Y0B9Cq%>{yfy$+ppHZm`?_VA3Ln<9*zU|Lu z^haOl(XUt6-tRo65B29_CN)bXF*8u2sXIZt6=*zD^n2pXR2A{h%V%A*ZiQ z&1@GL(T`MH%6!|OEuuerKR&O~kNVTztVMq;`G`tpRsGpkw&%kBv}EXAN_BO}^h97IcwLmAtj zDdru}U?_c%s0Xe*K9jl)CN+~XRvpQqLTVZU)mlB$dpUi~B)<$Hb&4`pwa=@K%QY0L zlG>#C)K6(vuBtzjR42+<^)?fbYZ#QSaJ?_eKW>(57^#0KV^zZvjv5XXOLb4LdgTGr z`wS=5oHACWG;>A>l{&awj}fHOQO2s}rha~a(mPK*a3w$f=D-i6)>6i*+h)#4DE)UG zbq|ZDdRlZOsRxv?>a=NnlxS<*OV|BTq|Q^usyHRpqSZ7S%5IJ5)$%SHO)3#(teRw& zGX}~YJ3YT^H*yTA>6Fomk6K&3j-4@7tM5%6j>VEwI-PUH=;w2AEG_vnWo&Zw_dzDD73+qNo>&(?hc zsaKS-DzPqTHBA(%+VCF+O(d0)GFB}&%b5gaUpX|tSvBV*Qfnz=RTJ}iY%)}Qr(wKb zo=mD0Wvm)$mNUgmO(8X&GFH_y+h?kmno6n(Wvpss)-(cYj=I-V+@>0gCpUmfa)1fA++SBE8ee3)+(@AZnj8)UKI&IB>8sq%n zTG>2bjTxloQpT#6W@FEUDyq7tNB-(#)-0V#>OEzwa+~+Uv!F8Rl~U6x-_fgQk%~nb ztD@<_PEE6+TBwHfnY#9>*uJw##ioo^4Pex@B&hFHTM4xK^W&&Fq?%F2s(;KC&bd%u z)xB2FF6L}Bmz2E}G1sjXKi=m-U+eyYc~JS)zy51xx{$#SU(BVN`A~ZM=_$_H z2fgQ0TQT%yM>QcM+FAgmUzzJ^b)sHBFQB&ao3j-%LM?>S?}_xZ=i{!k3!_wFXD%{A zEfVV$5|ZQUq9|qR5E-EsL*;T7>Kbv*)nRdzGTRv$p_V|If^#j+yKBmlC}l1JAtTgM zC{u8*sof99UmB&%83Y-jeuPS5dN?3qvX4JTDKn}gBh)geR7PcQ=6hgSlrm=!WQ1A{ zWj2@B9LNZ@ z3d-)U<3H{mzKSWQIFJ!)HB<`I!-zDwzN}`-Szly?S|fURX!^2OYnXD10~w*#inapI zAN_ePQ%-RpBh*h&wxUuODLL^crkvtHMyPdAzGl5Z#>-tuAk1$|(+H@cd#kZfu0I5sSRX=+6`rEvuEd)CMv_?SV3<0oV3JJ0|U6%Bc-xgxU+0&1}PBlU8Nf%al_a$OyF$DxFbXM+W}6 zk13}Q$OyF`%AR4XPv7F&&y-Ue$Ov@+%I;;KnnkxAV9KctWQ2-@GA9pL%9puYMKa~o z1~OQOAI+*9gz{1I?AUP-N{3eSjGp1@Y3BR}l~~PD4>0{kst?cLxsqniA*kkRUR(#c z4v{L)Gh)3CLnSxjQKozi4zu-g))yI}jtJFe+mN$IqEu0*dXW+8s8C7gycuD4vy~qf4 zQmmKn;-CLI$&^#Q$Ov@`%Dgalg{O^^{uEPA^&%tGX{eme#&ESv)VSekrkv_UMyNAT z&VEt9qnmg|t20bF)r*W!zeD9QZI$SME#mhmRm@o$GD7_UWzWm8^0h4X2UE^oMnhuMsoV|>UP#2-}^)o#+U-YEwMW&p+jEqp1gnAlh`?E_-IeQryp)Lzm>R5}2 z%S<_Y85yCjKs9zc=z4QC<-99QIU@ivLS2RGWz=L(`V3d2RB@*^kP+${lpdq>6esW8 zJ=d6WY6BUeu0uI{Q&sQxBNJR_%Bc-xgt`G`-r~BBPTrC422;+`kP+%8l&!-LYybZ4 zCR0vrAcHknR|fxc-GYkl{DAvgQ2OC!p22gmQ{#WG+g|E6DSg#mPsrd=Y%_-c3DsB4 zGarMv{v?%GC5DXvV{fLzYC?`W#=#M)I2gm z-Gj16W%!wm)$TFn)I2gm-G{R8iN=)6HS0c8PR%2O-efSV@&Jl&jR&+|S$RgZ^$^Ob zH}zYGA6w>m$l5B27LXC@5tMzeH?c;dKOZsW94W{M^%%-rcyjf5lXuGFC{@BaQjihq z36xWB>dMNKy9u5!<@6jGp`JpeH2bUlt0WhnGUXg8$O!cpRC1$^mfPg_7gNrWf{akl zppqHYty%SC&zN$0j*L*xq0$%?RG|0YV6bZP?`q25B-SCl7Q+0(sc%IO0#LcJ4h{hGVL^mj}-wSkOK@1bmMj4yX~ z?0cr1+CWCA52A-T4*d1q2d13bKt`y)q4ZTiJ%zMf9P@9coc)Llo_}tR?vGHuYMwpI zeuUDYw>%@-`UfhN4yh@)N?5OdSX)j-AtTf$q5P*D9s7wXr=pO-Qu~;TNuQzg-qdG^ zrT!~Ye5M`_<{8n}7bvp=uEaIkeEGuKa_SHnp}s=dv)-k`1B!fQ%Be$SgwhwiJ#Kq7 zwbRwX?Of5+f?OEqOF4Cj4A$$4Ii%cBxL~g4SB^HUzZ*)2Zu5+2OaD8aQOEMTD|zxn zV{JLriwxSjQw9HXd7vsfKe+a+K3>8D74F}@Yfy2gqL2}7MTbgZ)VYrdUPWhZIW>=r zP%)s)2Mn$fAvc3!Fy+)dGD7KZJbCP8ch~z&qtC@;%IP68Lg`P(qP9lnkNqNIG39JT zWQ2+h<-nyxCo5YV&g$klLkP#{Yls!_COpiG{0aw_~$e=eT zO*!a)+r>l2;iZB>BNIaD&^ewFZRvmC-s85fZGI0;G$avk3&nwqQ2O)MsDBkJ!<-sp z6LW>)Kt`w}Q1+ZMAf(TsBwV35kP%9M@7iPk$rD$bjCBSkb;CxB|TTD4P=DM0A;UK^r`;*y9`{RHjoi2qfm!qRD6?>E7S%uLis@1 zYec^VZ+z{;lyj*a8KLy2qEX*=J`yskK_;$H8^{Qyzg^~W+lngH=KRUbT%k6Q5h@Fm z9XEbT`u&S6T%k6Q5h^Q`Gsddl=-E9tdsePc8^{Qi4a&Y6sxUYk)$9Q5(nzl>^FN@6GbOWQ81Dq3g&9l@rQ2PpQvF*R=gJCs)|Z z$Ox4S${t_clLTkZ#guc=92ucgDDNdl?y_@<7?M-uxQXI_BXD`wJPN z@FmT8b;w1~NjG7OG(Gei=)1h1x(ys4`IYYEPf; z1N)WX3blcZQ2Kkb9=BCZAJ>almMQ0wG%`Y!6Dnr8i7(1=h1x(ysPa&moQ>g%QK<94 z@?4=dkP)f^l)Xk2RQ->w6}UoeAS0A7ls!8nJ+$PBFIT7yWQ3{+W$W;2&CH!Da)sJJ zMyN_q$;^5+y?pOlC9Y5#$Ou&#%DzL~`uWa@%3Pr~kP)g1l)X;5?%t~}Rk%WJAR|;& zD0{Uh$?URqt8#_fKt`x)Q1%m_yq)7#sK%6YNg5fUszcdxO2&^fk5}gkwSkOKHK6R4 z4;}R8Y7MSX8^{P%6Uv@pFXafxRg){!1~Ni@4^__Wuc_-6)%u<*)CMv_)q=8P@68&S z8rR|qwSkOKwV~|0?8Lt%8&#Vt)CMv_)q%3F0k-;2%2J0b)CMv_)rGQWy&E-O7pcn? zY6BUe>OnO$TO<0RfivoHh1x(ysQOU$lj4@WIv1(Wlyeal8KD}89(EWM_kIJeP#eey z)es7sO7$|&y=7w?a)sJJMyN(m=A!~vtsfuuY{V660~w(jLsc?cW6^=R#~X8n+CWCA zCQy})TDWw_#wJ{$HjojjDU_{^-_Q7NZ^{)`7#X3OL1Cp;dp$>7`p}Fk)CMv_H5YA- zKecFWbFNSu$OzR!tk?U4Pu8{I3blcZP%WXb(yE8=QBe)CMv_wT7~<%;T)dtGGyLq?0%GNeqp*E1g9_^IG*|BY*^ax0++p+cbS>kXf<6AeS6RN;acP>>O-hfrG|y?Eb)E7S%uLiL2Q=jB|RhY#q<6>0++ zp+ccjnyu0IVUx+BT%k6Q5h@HSxlx10RhS>f6>0++p~9h37}a>r-MZmip*D~asuz^4 z-d+o47U{(mY6BUedPCVG<@-ZxOZVmqwSkOKeT2$0EzQ9`T%k6Q5vnhgy;eDXUh)`y zxk7CqBUC>qJ4X4uJ@acnrkpFB$OzRR%ExTO;Wh8w>JO!7d~a4486@hXR@C3wgsNe> z806X)F@RJvo)K*ggu(_^OY5}b{@(+658;pzY7ms&@{`YwsWONw)FCoL4TdUKf`l|iG!hj4{DL}6w00_8w_}TZzz-wUF8|k)-Wi0 zUOthz|Da*KEmSWuLJfzq)m!Y~fquie!p22Ls1Z0oNKVi2sIkY?ytKIrd1ow z6)FlDp~gVj5j%M%|FAJ!p`wsMZ}OQvI2Ow8W&JJgu~0fxlxIX+n8fT%n?n!8+74+h;Nq--eT+bf_uMh_}F_Hf^3Ug|~$jMnwSX&B z6f)RegUo(k2*qn-A(RgNz%!z)MWToPt(@BB5+zH|v!s3>HFS_);yjm$N&wOGm(Dhe5)euRo)+Um1s^iMx>g^EH(sAW)g z6m6b=*sx_>p`wrxYB`iWzN+rLe|0%ms3>HFS^;JE^6xvlXI#M*Dhe5)RzlhLDTh0@ zxUrHc=ZZ8kLal;IZMMdZs>MpI;tCaoj8Ln^dZi1ldww-ns10O#eRBAEu237u2(0++p*BL-TzUoXz5K*`q>*iqi47_niKeDp{hqz*|3?^HlBeRZU)XRr0j^Zh16J{ z5$p9clszi_YWn^0Gg~j`nmIB;{Q_mLNdLBT{F-05LiHje)K(}vVt>D(?C`Bzp?Z-K zY8zB?tgFlQSB-kEZCqi^kP+%vDEoQkPbVhq`jsnGFET=HhstT%dKvM@{_R|$dXW)o z2UJRZC>^@UGkS*W zgjtn+LM12`ZTvn`XL$x{hMBWpsJ4CEPux#xKF>h?U=H5{LRD!Pf7k(1<9P;ZrKTq4^)HKfsY9gR z@(ffzvz)_1>Ge8HYADY@#WQn`2&LES2&tqzBP!}BR0b?beHV6MhBrr{@C}o~B`|Iv zBh)ddct(}Vljg=TuCQjv2z6YjU!$*#f1E3f8^{QCLa3}^Wj37P3gZScLY)-q$;B=+ zPI85D0~w)CLD_Mm($X{cPH}~C0~w)CL)npS&VfVQPjiKF0~w*th#q$SaK8E(t}t#O zBh>GrhmjMzm-wA4j2p-Z^@nKd-Q=2g|6t1bJOvq{&Wg7DKE9fMmMhc-GD4k$vafBz zO8qkQ99O6fWP~~o6~|Q6!XvBip63d+fs9ZWgldwcO{@!Cp*D~a>Y`A|eX3=+$Q5b> z8KEvg*(+wJF5xsApGiExW@N_A)X;-GxeO+S<2n$gg*~!d^y3 zsC!WM9b%lwm=*6usUps29LNZDAIesgXV}_P_qoDeMnY-S# ztOYjJc*qs@GBQFvg0i1~4O_nE!XvIQ0w5#QV<`L0>YiyM*FT2R8+AR5`g=nM|~W`arKe=+5J?tqL?&!GHG zZPae`Y2-7mu)mN&qF*H^_#CQ+`a!>Q8}MxXgXd8C*`Yk6XSl9Z#{XO|gzE6!{(dh= z-R2p@hnY8^FNNB6C2#VVq{i?JR3cM)uSn_FzPg96NTuW%s9-bawNSc;uSxab8K_7z z=Z#Rhhi^z7;~A)QmGD2;TT*r#z9p4~XApmAhNX92>K&=)JOj0$n$y;Mp>z-5lUl|z zh;K3b;)76n8-5_QgJ+;-nKk{Jl-}~Xt-nbvmO2j z8;+}y^YlNYX7dc=YNL6>)s-TFh(IG)EA*H z?)dTO7p^cyA%h-nFn#_CWnV3KE?DNsSL)$bo`LFR_J#h6h{tWudN+#I-KBm+LjCPX zp258GRh*~XLXGjwd*4l}D$gK(+8lAwgsR|^wNo@w7kI{LtCG`}2g>YD*ZoCz0z9Ou z@{HJq(V@)6R+rzw5B;J;nJtge7a5`SU!jirrtZMs`gM-M70%|!2o)2`Ud7t^cE;$K zT;Xhv3|1(1WoNx&LHVd3)C1R`SlKGYqV-C|Gl<7DFLh&kso10v@C?*avwh-tsW_xo z^9+>7?7_HRDlVzGJOj1H>_Pokx;<_mHBUXjdc`BPiD%TaF4tkxy8d?)q>4}K6wg4F zG~-VKFO`5)1)hP5W9B6EQVB^V<{7AhmGM7UA}^JQR0*CzJh@rZ#9k^fskA%;)x^w6 z;-!+1YRxlH2Th-oda0zOj`IvulC1cjD;X(!+$STInr9HNXXYgLQprg**#Q}$^uLCq z{*4u*f;#8;EiG3#J0K%eI;bp0t?}J)Bpp{6*^m(`J(RCe8;76Rot`U%H4U zgWF_c%K3a58KE*m*>`OhH@1D2nJcU?GD2m6@-aQ^x80++ zq4d8Fq5f4zvo%IM%(9{YSEvnSgenM?%&71uk0J|lh1x(ys6tS7#4g-se4;{Jp*D~a zs<3El-=Lip3v-3qKt`w{LQQT|FnJNKP#eeyRTRp;qaQN!;Oe4Wp*D~aO8@H_9(QT8 zH70&(7E+8U=QCeqgeneYJ_2z?>}?oUoGa7@GD4LQJuKU0LEaKvp*D~asw9*>>pc$6 zkfkJ7s10O0++p-My9^VgMN|C6P;LTw-;R2e8cvbE?CtxFlM zP#eeyRTj#Q*kxb(pDxQ4Y6BUe%8B*L^{&yia$KP{kP)gpR2H+B^DiEhw>(#<4P=C> z0Oe!UqSBsW6_|29QAI{5Unsi`x1Fu9&6g|G1~NibgtG5A9&|`Bt|C{c4P=C>1ZC@R z!ijT@D{+O|Kt`y_V!e{hzxAdvSEvnSgsK8%M}W`wGuEua6>0++p{feirTzTcRk=cK zAR|;YsN`nLPfwrXay70{8^{P%U8rbtW?rk#6>0++p=vT-p>jEqqAplr>TUwx#$`iIihGMx7g zC9s!~5vo3vt;6C$p9a_G3VRtDp&CG?GCj;NI^Wm^TwyOGBUD2udrldBbZeJ}OgW!_ zAtO{Hs2rxPUkE|-?jA*MBl#dRn>Dlb8zO8s$s3>HF zYAsaSe05s1<_Z;sj8JXFdX>B1BD@V#&ZlO`pf6|5+n~12dPT=fSNGy=&$XrXy23M} zEkDs#4d0tx{dilbLu9bn8D=@{oVLuRgAOAexZ6=%^La+J_4UgHafO;kMyL)@_SIMIKi5Wd;0iU5j8Gk+?6JIeP>j+YxkAk&BUC3S zyA2cexcjgZSEycOgbEgF_M47>1#^Y!MMkL3P)W@;+*0@Kjm}Z3sPkzcGD39`D%-L8 zSG#b9Iz&dOu2A;scbT^%@^jdib6)H?of%%dbP^?M}zKM zp*D~aDg??L60VaoPqqr-3blcZP(7gR>)zIpC42VZ3blcZP(7jS`D^g5h)F%ULTw-; zR49}^rzGoIXnZJFs10O<3WLIKQCnn4tRlO@xI%3pBUCt)J?k|pcj8KHVZ#Wwrv?A}3rdvk@_Kt`xOP9IWP}<9mB6&M>`9v3!??m; zMn z!I4n@J%NZ-w(_$)DI4Y45Dgw$Lm1$G1N)*8rj!I;Nng(UZjXdkxtenObj!I;Nnhs^p4$bS- z`g=N8I4Y45Y6g@k9amuPfOj*v!cmEgP&1+ICnFb^mODR_E7S%uLd}A*zh8NHOXS5_ zT%k6Q5o)$jTVhNdHJd5t>Nhe%&4Kc94glA$ABv5e!xd@+8KLG1b)s&^t8=+RZ6G7m zJSg+R-StzKrJd(-h1x(ysQFO#bB8Po@4cMQ6>0++p%y@;H0zb(|Q?pQ=M&#xk7CqBh(VnmT!`& zKP=%2wSkOKOQBMj9{$xi?cJqJIaj}t5$Z>wLe?Hh_aj%R4P=B`24#x1S_~gZ6G7mN+`R(?uSmyxsof?1~Nje z5^DD8y??CY3blcZP^+Qr*`dw4n+aEQh1x(ys5MZD%+@%1JxjqgT%k6Q5o#@z-G&b< z%}chHE7S%uLj43~kCchi{)zaBDd*}pGD59`vSaVDUr$_I#}#S=8KKsT^(ue1N#*ri zp*D~aY6FygMU-XLsni>|LTw-;)JD-(*O4tVZR85Ifs9a_gbKX)HvT5AP#eeywHeBu z&Cfn~eS9-ls10O<+5%Yj8HqF>?rEFJ!{WSu237u z2(?S7hK2I{w2Ld$1~NkJhO(dRSG|$t$!@Mt8^{Q?2g+WlNLyf0@jYCjHjoi&FO+?k z{i%K3;(NJ5Z6G7mJ}6sJy~hrjwvQ?2nmIB;?T50jDkqk#>Dtc~Y6BUe4nW!00Bt8U zJ#>I8)CMv_MMBv#QL;f{k0ZH4Z6G7mK`8raMaE)ZJ|E-?wSkOKzd_k;SZ?pDUw-2X zwSkOKheTT&D+eV##1(1-8KDkC*(*yKGDfUB%oS<_8KI6q*=<<+a{KH@xI%3pBh*nS zd(EM5s-MptEDjl=PD0u1hbx8#b~?!wY6BUePC?mgDM?=~EOm-2)CMv_orbcX!YtZx zztL%~P#eeybq31T;f)keho0dIwSkOKze8bXs%`jloX%x_=L)rf3`Wdj<}~sLR68|K zJ#dYkGXLfuP&)KG&xp3pLfP~3<*vzFo#kzz6UYd44$2-W^(#)?e2yzr6f(MT*H5PP z^H49;oH**{A8pd6^VGvFJR{n=AljPur%%L%sJ4nZ*Rhci>LQeV%~t8=oxd+~g*rq= zs7p{ubf?wSY{Br`m$*V5A|upgsFV(JO)dPO%Vn-mhsX$ZMf7lVraKF-aD_TVMyRV$ zNljaoqK|oYl`GUCGD2O0N^aEZ6E_N8;|g_%j8NC15*yXC@rO0nxk4QxBh(EjyEU#o zNj3HcSEwjtgt`fZl~(N)t2I3TO|DQ;$Ov@{%ASdGx=Y8o#gua$8yTT)Lq#*|^{!uq z0=KzBZ6G7mpHMzVwH`4z^`Bg!HjokO4pa=IZdaV~^$u644P=D63zfyFw;>Uu?{bCB zgp5%4gsMOBVdOooP#eeybsx%(ho36XZ+o9B)CMv_J%F+!_NmqJZa&}&wSkOK520*r zd|!3>)rVZ6HjokO5tOao$S30pJmLzqfs9a(q3qeA?&!%IA2a1#{YFNpCs6kF#{0no zH$CABwSkOKPoeDZ!*0zw=D)4P=CR31zRC?Kyj*#Y?Wx zb!3Ek1%(Z)dbn?3vC6NwLTw-;)N3gFYWd#8y>ni3g%w6ds5e3_?zOAe8>XCVu*eAY z7RuIqw_7uYz2ypBM@Fc3P-)aU>8ZqT$$P)!3cDW}q25E;k*#>|*(u+1h1x(ys1H!~ z^0++q5g)luTs({emMAVu237u2=x)l{(fc2HAezJa)sJJMyP+FY;7dG zntAO%T%k6Q5$Y3^J)8d=may0-u237u2=y7te&ep`y;plbbA{SKMyM}Pb_B>VFy7EF zOgYzJkrC>vSg%TZvu^*&6>0++q4Wnm9=ENH8?Pt-?24|x%z@7xiWPN+2AvT~|05_K zx7`{Omv?CG<_fiej8M^_>|U-~a#opWT%k6Q5y}H)x8X70RAC;jP#eey6&)%CD&FNP zJtz0(=v<*TkP#{dlpW{y)p)Tf23M#JWQ2+-)SSpisbg}5+CWCASWtLU^)j&I3s)?z zP#eey6&uQ)zozfKH9Iy_&NWzMgo-27ubuXsi^COa0~w*>LfKai`=+h>5SJ^|1~Nj$ zgUVvIeE0Xi$Bf4nY6BUe;zK1cs#5JeG2(ND+CWCA1W@){1he;VPnv)$)CMv_C4{mg zcF(J8W+&tdwSkOKiJ zGUZ%NMMkJ}P}rI37+W>TXG1!!@B}hKrH8V|*VEyP{!Gsm_A)X;We{rX;h%42;0k*g z8KE*l;gD55JhG=nr;J=-FC!zA50pK=_M9r5*M}=C4jG{`LD|u!)b4JTGjWC5Kt`y{ zP6>0++p|U~QPY~7@ z^$E?!lyfx|8KJU6nadxpo0r^svvY;oKt`w>Q1)zIv_Pppb8v;)Kt`yXQ02@xKQ?~4 zSUI^uZ6G65E+~|MlD8uhJ)n5k8o9RTFhq3l(xTX%k+TAVA?Au>XhfU;-32YGy|l;8>#g^W-oq3jqn zRAxYqQe2^;kP)ghl)b9IYkk3XrMW^yA%iX7-fYz}Pfh*PyHZGpQU`SR67!m4`B2 zaV?q9DOGu{P>09}RRJowY3pf`rV$mmLLDL_lrNM$QW6xr_m?kMs3>HFstA?Dw6!vJ z+HDoNLPa4XR3#{MU&*4+7ACI56)FlDp(;ZqHEk7`T zbA^gRMyOh%t!8zbj;_TOx{i!cwV~`erAD0aMYXv?MIj?p9jMIC26bhfku-K4u250P z2vrx#zW)m9AM12ou250P2vrZtZjFy8Qzom&6)FlDq3T1~*Vs97A6!wND^wIRLNyR= z{rMqny#`DS0*&%3blcZP>rDMHtdjP?(dDbLTw-;RAVT6ZF$k0 z{S_K>h1x(ys3t-k*_AV26RuDj$OzRG%DxsYdAfkBDOacsWQ1x4Ww*xpfdhLt;|jHb zj8M&??A9oCb8GD8T%k6Q5vqk)uNL)Q*J!~NY6BUeT0&JY)q67L%DFAMLTw-;R4XVm zK)4bYo3)@7Q_huJWQ1xBWw*xeReldzbA{SKMyNJW_C0Kjw;SrU;R>~Zj8JW%?6DkU zV&KKLT%k6Q5y}rLx!D>;n%`gQ#}#S=86=jQ(_=d*JBpt9`&N#2P&)Jz&xp4Cp;DN( zQg0s_=+E0iMIj?pd#J2N9qae*OM9+RQOF>1(6k=l)x!Yl;c=c3Z3RNvt?~Zc)R%$0 zEz}`0LIpwDk!^JLUUP%ELLDL_R0k+~cJQ6mW=#jKO6k=>MyQUWtuZeu-0#SgbCnnw zp*lg?QS_HCKb-8u73vTfp@KyZqffc9A($)FAu`zVU(CVL8Oqj%KErl~(xDh;%OfM& z>LS*w`1~vRy70D8y~qgF70P})!gp_xa$UJX^&%rwHz@n+>z?|v`rWuf9U_DEs$lxu zU96XW1>2q0s~XRUwnCunCv?ryKW`Dj+d}msBUBG4J4U67xBg`hu26@_2-OqHjvM9Y z4LQ@3E7Tz}LWM%vs|Wt+KW7f*3U!E#P+?Hmz-lX99uiqAj49`eG%`YkL)ooSwC}n) z;as5(krApFlzn~Jvd+-RURdeYL080NjiDyJx1EEkjDwllX;Zp;7TX+H)p$0+O{q?NvfsTWi za;``tBh+9hd-Xfdw&eu|bA{SKMyMfBc5BSqG&arVQe0{fk_<<|b1~Nj8gi2}Js<-@b?~z<#1VBcpQBd}i;`jvz{4|Ow=ZZ8kLXC#1 zXxhqI|I_5rTwyOGBh(luyT6jJTX1I#SJ=zQV7bjrJ&%R*n6?JyjB{};l%CR;Hjoi&5|kYe-Oo~7p2QVu0~w(v3pHz8q1BVQ!U%wjP*b4n2+%Os)W9iR zp`wrxYN}9=&t=;;l_}>sHZnp*K-o`0F^UkP&JIlzsITV{Y-IGq^%+AS2XFDEnS-;Njt;W^#r7g^W9fOZDE(u8o)K-$fvV&nSD$rr3(VndVJ{;i)Lf_( zMs3(uVc1-zoNLR-2sIDNzH;cEdP{?OTwyOGBh-8-dwssh=h(&ObA`Q(j8F@p>^2O& zT=CuluCSMp5o#e+WwTyqS1*~hkSpwEWQ1A-g#%s5I2!%&~sca-wr|k;rX4bsb9b9Z+&zN>J}Ch?&S2n z^J;#p{Qw7ZI`jw)?jGKOLeaDe=+Td6DCHL(+%2d$RvojWxx&Ijy9RaV88t`!_syK} zkgng%3Fss;x~*tH(}eo*lL^C&0gJ*N_06bS5XW$-XdA zGo3k0?5~c|obpjCYBCR#n}txu7d7Y1b(RxqU$9f=1dbe==@1$e^#9k}fm}US zTeZ8~8Q2%yLV8C*r>%{m&sCe&_Y3Rfk7GwK)5$!GsUJI&Gv{+9`?Jk_srv1l243qm z+-tqAiS?>f*ROj}pKq6Q!k#qL6VY4^8&wn`r$4E@dYCcQx63&o=5+hleX743Z6{~R z%j_VnW;=6cihZgIm6w>w3=$c=#NA>$>p2mL^}RDWOMV=~{%qTNEVhq+cBt2!V_r-C ztNORg(f{_0ot%dsyq2@ezKm5tC-d5C&Iqrz-h0)v#}2NvoT5IqZM)=2_Kgu`0>mDy zRI{ERuX3k94eg)^)ghz@A2w8I5;TL&u=-u&Aa?5A%5~XS3IwLSAdJM688AF2aKQ2ib)?M@m?5 zM;ck3HNBSAChVGi@~W0sUgO~^FSW;O^qc8b8-u;p0{44LpQeJKC6I)D&+u}8f z!yJ{)YsoRqIZmgXOv`MJh?*1X)k9ye{XWj;Th+l{##2u?OFrvW^S(H1Ix?C|S8sqi ztJx(vDsCnFvt3SBu}}3L^sf1LzFeshGSt6&AkA`?yw8Vbm>%8}TTGuB<+)PlFNpE5 zL!Z##aH<~L!#wuGG?jPSN+_yMjehF9Oe?A~YECF`ESf7cNDj5ma$0+hev7^K;9#+R zbf5EjRZFD(*qM4bw4zQrlhalz@hU|>v)n7wON=c#bI&W|=ao4k=BR@^sC#d1oylqa ztk-hJh*uXnyT>c@E{j=+`k%9$2(Qf0B;RJnivH+l=XlMT?6u_A_ANWLb}!A4{Rs@}(AA%nOEgz-_iyLue4wZnJ*S1&oS(do_aLw1^n=&B7Zla2mpm7*!u2EF zLv^Ht^=j|@L~{azz4lH=uaV@oFIW2U@1n*!1ch{nO6ayigZc!sgHp{=$FYCZQEK<# zTKm>bac8Uk=`|JRM^kIV^H^SKUKqi!GY?L0^bCBg$0HB_X_Xi*P~bauE7Ca zg8HfPDx{klT|z=_R-bUZ=la<;Lc{#^t2aOO+O)T-pZ}2z3JCnaX9EitD^{q~|8dEx z_h{cwt$^N8qW{!WO6gY_YWw`}bXXU?QT+b@WdCRDc0oOYy7~3+4-E_Q`;T7!`}3Vb z!ov0L=@t~;DJ0NOcVBP$U{wY6tJbNec3K_2)BYvyZ2td0!0dznA_1ZOdZ@}$J@5|F;!o`aJpSnSySfRq+fNIt0tyy>dGD2*IsF>;MzduWD z{m-Wh*=6f@idBL;28D$;<=ebVP+v8WsQ0JpcYWxyU z>hkn@va+9c>e2~~c`(jwHR7rv)imOa#EKI*MUMh1p3>f)t(~M zk=?y}P*>Gf&t9s!{CcPpS5V(?cC`(u?W$gJc|UJU4C9T`HR@EX>{n9{K3nr@qxyX0{giF!e?O~V68LxhZ*97%-Z%vL zcT?Bd{w<46^y=OwoCe%=24S=-4DU3;n1px5rVPxErq@1wnw&QYQc1+~@n zg*5L34L~Z?K16R+bvaZW-~r*m{}#7R>lcq9ef;nS%zL4f((li_pT^4f2nh@BtGd*6>p+ZbSB2KfmB^J^UJV4GQW})eb1%4!6BR)t=UeBW`qQU zt8&yACBGS+Rka5Hf2CYmZyQGv&X38nU@8ZaN3Y^I0yc4AC+mG149TIyh#GP^q>udi z{l2=or>8lV9l(G&T}NNlb#=A+yJmUb)S$GbB+BhZ`ndVyzX83u{r#60uN!Yd)Z#x$ z`|D5fDH<$bH_h*_Zh!kj*@*M==JsW6Br8rRyknciWyc87t4_3n5D5-2ChOs zoUWGY!``>U{ncuFxbKb(uS&s@0rd&sX3xzKJq0n1XD2N&XyWHF$U}sF9*vADXt56I z{H!`EFw;}*`mgigg9~Jt*Jg{08=J8YJ9Gvy3`SqiVw0>jFstfw-L3ZP4jOf{$Ed|O zunVxSE5b?vTVV%gP&yOU88j1l*o_{8KTud_uszJe1&X@(Gq?rkZ+`gp$((r%p3eEZ z>xE%Uu&*-O_42>%23D5AnSEi`@sFWdlQ+jkt7wm4$#qu>JuncjVZVCV2WOWEmn-)? z+SRH9(hFB=P`cNLJxr&KD7tRDfq7NP0Nmn7y%-}=uGS~kkg1t&)S2eSh);^6EXdRFz*qur~t!ULjfT)%Lf=t z*Y^eP8sRULW1V}y??)g8mEQB;m_SZ;L5pRKD;TOrK7nJ3F2joH$evPRLABN3^B}6N zjLLT;YnpUK?Nx)Lqe~zkRvC+;vwa9!mw5a4!V2&Z>eEs|4v9ppDUs>W3|K;f`7qErkdAzC|?a zprdG+VB-$adVQro3q_DlE0lBrD`rfDrg{73`OiPy4sY-gYFbqEH3nEP&@-HLsDYjD z1mH`kbf#Qw{zJDz2wQaEoZ2P4aOm0s?B)d{7j4-vI6n`(5$Mm4&2ozySY6Ac50Bk& zfD_l@&H%<}7$o(9&3@Kw(82zw4d9p>itR9$zhTgRLUs#b0}{80#}EK|e?C*6z!K5! zL!qS8$5WIiPhPXP?+@P-ktA@US(bjKrdvpFbc6UmWx8z&pVxc&*GCaN(Pq*;DEbxswXaqE_t zF1JhIub=<+Qyq1{?sSHH?I?O2#4t$K=1OxnzRTz@!{G4nS8kBosl#bTuB6!D0)nL; zpbLU0(bv~s(nhFGt6wp@2z2R}0II3eeTZVq$- z;d4*Wa4?W{o5OHM$-$b#woFzHB}Br9csTBPKzXQ-r}Lpk1LW135)vH-ZU81>MKxdNjHitE}YZ`LIVVf-E{>x$Upp6Dkf1 zotNU8Edu-rSXGYz^ceZL@`*PHS{BzoFm4fFgfWbN+v&SRCgEmA=HH(nTl|RlFeCGC zot%!17j4CE$x3AHX|1?p^pP`QY#1DttU03*&o={Q+t`Tbo59A?7uS{Z80z_c0>?bx z49geWWe2*f*|msU#K6_ot&x%#uzNJRjT@qqJz(Iq|=C`}dnIbLPDUUn0NiJeOVb zo;ngVr|vG8sJOYYSKDtlzf7KPfEZDiMN-_6Ll+!k!?Jsb=16bu5m(#Yhl7oU0b5#l z=CB($PTjjX_-Y6Njg zCeCbWavh-h0XaRCY@23Ey5BU!C8*G5lu1u#jd^FHaB^76aUn&DME=lj;6$>JSI6Q) zmjb2LeYbij!LCGH1N3{NkM(;$wAVQ30VvnraxQk}Z`yv{US&G7Rl7(W6OBOUBPU3k)%fH3vcTC?rwkD8s5mpBY8!P z3N>#?kOy1swk#_OUgZKUwOj}uyiZCdLvwu1Hk|WiFTch+qtPN`BIB4fL^((Xj^$9h zQH5l87v(VH!lFiKz=ecpS;pZ_8l6mv-et+y)x;dkc98B6>tB+_)I61}5nPz%gt^2~ z`#q1Z?@(rhAP7i^J^9JkCPlV<(LB8U|eFL*Vuodw^GTw+g7sea(*|8ZCzV zQBNSF-;|T(-`V|}RP2t03|a7eMARw_Db~pvsIsFEO*N zHJzYrZC2ighi$y^Hc)m4UM^o~rg!b`497JQl_p8tyBRn*Et(&{pJTycOO@q3o9l*( zYaVBj!+q-MS(un_sE<#yg;9jcl&@kn|8;$F&u!+1ni??N?BgaQ2j#1 zF)XxIb51@wx$4l)Pts#H40R-|uyFq?JB~%XAW`7rTZ!|#51hwccXepwNIjMM2fpy6+%sA5rA$!2 z{Lh)lQ_~B>7<-W-bhrs9c3$+hK3r0fhz;^Bt^)n8#$F*9)1aNW4-01o$TFv(LIxFxX6j_PG74U$>|@UM*M6?&Hw% z5yEbJMn=p=lDP*`dW52}$rwi^WhGQ4ib5==wK;t}fWy?H)ABKzQxnM#ofIuCZkPPi z6;<-xM9edc%aAE8vxymL@#*;DP@w#zzvDQ#`<%{NUH~jVvSPA6=`>*}6_wgb-XVK6 z{Spps6kQVV^7X4fm3h|gHFg)1d{?Thf2)iG+IIBb$Hplhx|h0In@_e_KGwHh#Nc`f z0$+X7hRKJfb^q)i+rxjh-TPOYpUFd8f338=Wp!_c^BP>`b1c;&i6YYQN|>xQmN$I( ztT`Q*D_%N%|1IQ|DVna4a)n|NZs^DgD&xT?nb{xl|8qlOEHV_?CM_|YN37YhFhH~g z)LEa;0_O0a(0)OORSP;@nA&_7Rm1r-+R<7qzIdg+h;nMGZOmbgC=u>WjL-49 zpB^!J^E?*wjVSpDc zd(G&D4-E|auxq!yRoj()NZifh8d!Ne-BrabKXpa?WkS($ifJ<3n3S~HL+BUaYOkdE zQ@IAFOA!mfx9b!pSb;y16sZlrr$stjL{@)y&ew(0(=C!;;TvB1TP2eBEzy+N632+) zNg2?VPaC@RggzNZ#Cw>}1E>RJXs`O`q<_U5f6O%9vrh8*aGGPBL_v0s^- zHciW#ukC)>Y|dycdiTP1$!E&bKErT^qum1ejC1VO3(J)Vq-WjXDu0TM#++!LtoQFv z^~UOjj7+K**qa1|G&1_U6bfWA@BPvTRj#X{vbyGQe}rd*KCG?cQZhb_s07u$4Rdmr z(bc>E3Ij-zi$tnH{J*XVtdOQY}~J?Re{g+JgtB%3tr`>7FiRv*b%KwR%cOS$aa{7 zI;_mXN?teXA|zoJeyIftGG&b!Dh#R_ z@Csg~qXo%!5#+2l$nn@eTkB$w?&aOy%(WnD5h1zNGd$N)LN%L^<><3t>K z$wxYn{M0AgG%RL|WS(Wr`OfFtENzc&chdw&|3m<=_ z>wwMk(=!g_$-#Ik1Bs=5AjKSuV~W>%j+l+A(1RJ0bIT4Sp;{2bpbuLAS@sD*dG^)+ E0mGQ9d;kCd literal 0 HcmV?d00001 diff --git a/curl/lib/libssl.a b/curl/lib/libssl.a new file mode 100644 index 0000000000000000000000000000000000000000..aeb314bb4958b12df6bd3e96ce8e882c32cb170e GIT binary patch literal 694208 zcmeFa3w&KwwKuxbY})hzJB0$}Ap|H`5K7V(XnC34ChZQSv`}6u5Yl9)iKIAl96f2+HD2`j0``zM2a^9+df}=jTD$|JTf)-y4(} zGiCZOgEwsEEe@vqBhBjf22=h~=C135DRJg|HwIITDL?b1z&D8ne+3^?G2cUnP&!K4*zOUv9IQ&%Ag|7)K&x)|0uKN z#h_we&EWMx#ouE-a8Xe4_nI#}9aMY`@r^ShhXfVYJaSS{@lP<*XI&Tk!_BH^g6Y;= zx-6LPn=L)T^w%@Dq=V^ykNL`sVEP*|k6aN<|7Vz&D}otQ&)YY1;FH0O|I_Be6M`B4 z7_+QlbyHhYZ*ONnXk%t`)4IO4woDIEO)Xs;H)dM0&Z-1X?A5OO+NR!2Z*ND}#-@%| zhwp9g%eHoH-WarIJ9}%I+BY<{^)#>FklC08kjWTyYgg0eo{p^j+|aSHX+yTpSgy}x zn>K)R^LlIFlWA^kYHRN3%(Qwm@9N9+WtzHsI=aB>T4T|Z$@VmF?A_3jHL=UIT4ue) zBvEfnazv56VQ8A#5e}qR$HuH-)zX=1?rG}Dv~=~f8vl$a!tfZ{FD2nQ4k5d$Y|wS;6%fhaJ88*_7GR-O=Ncv$d;lU5x9l z?ug@-_Dst)){CZ%eH*;cXc`!VQfuQ5i(7q-@7oAeB0L+Y4>9 zL`jfMG(8M6MXV%CH04;cgC-Uk$>{cG)Rw08Jzag>Ar|@6)0ExN-E>XnT3dpun_AkN zJ2u+S8t)T1U~HROnA>CyoFNHu@X)8z;-;cTcnhUsQDkd0R7KxSogKaEheV)b{l?~O zUk^mYwcVMfjS$&3ZW4>$VtY*o3LS--J3H4kLjZ^z^6HWwV^h8SSQ8Z&bAvC6J@K(A zK#TZPpiN;)6yP*9Oq8~09Kx?i)D+#`)dkt0C0P@I$=Cx4#JrPKgb-qhcTJvrdBv(H zvoW*2E8EeW1tZE%rKc!UNb0$`@<`Rn)+wg*+WNI?8&+Qc$=h;GCL44tY?X3p&_V0M zj>xw#bSbDdp1aXHDpNWzHU@( z*TO2g2cobUDOO~m^x7ndzTvZx)Uqw7gh|P@DK-ggSt~N?T@hbP9N}z>dS;6@K$o9Z zy|iiV#j7u>mj&>dpzt&U7+ z_HahxdKhg3J*U#Zd*6~78cr*)J?Ex1jw21ds5W(EgVk&5FCcr7sED8>%QX;T>(Q=2`O7r5wrg4yBAFD; z8<2H<*)HeG;CwgT(E2-CB5Xt%h$E${6GM;wPzSV2pKEL1h7H#?WmDLkp&u_L`&=Ne9i86v+fF-KsE1&)2Wkl>KBNlAeGS zqG3;$J>@KwZCX?GmawueU6eyQ=d_evdvh-|^K45yij~Jd67=rAo^EI;j+g&!{m%CE z85NKLjeMbN-sRcxqph>q6k^Do>L!+iP_`k#6w8w32c$*|o1h9P;HhuRP`QLf8-|MK zLcgw~%W`Pyu^(_>9ez<5ZnjqZXbV-?9uMAZU`E*keY8)m-39b=n4e@THJ}Jd)_Q9l^TTu5H9UaWT=+P!hQrm%x$2PaLASy0;`bo{jgvqugRwS5jj{@x| zM>d27V08A8WG+6fnYQM>PSj8{q(eST8%zGKzK#}wCBe|4CIJ#b^(F!s&k>~dK4`7_ zuR+`V+t9qF3H{p6Yefwf7qnvb#8|N?#Gogk4tY!5`!vED>ZrFScu}P5Nl8Mw_fXJMW?hRAMQQ&~z2cAvQ(;keV7-rIXDEcCb zx)5w`#?U{@vyC<-vrkSAg*g3&AGwxKuYD@=49#WH-w7>*G;hmvz10%F4x zt8r?CHvYElr>8A_J!nC!uyi4I=&zMfAt^yD^_}IVOZ7g>M~Bof7o>8{a*0P{ zjFA$yH$slkVDPe_h8Xtf2u7=k<Q#%G+OgWa!;gqzfFA*u`IG40##!_dV#BHptxQpe=;uIg6(te4XSbrD; zx)Wh3V|S5g_humKFq@91$u>kb&M{WPsMrO4kD(@78ZMck7gb4HYgbF8UssyMG2pCi zXJ&nK%e69^*4@P!`MQf6*KR`bR-tQ}aD$9~83`OkE{u1%(6;V|(?To1J=ZZVeOCo8 z5X=Gx#29u2qrv0osEMngK{4I55Ocech#F*+B+4l+eH0gZjs%QzRG6<i}s99L75> zOjmX4lGT1jeP!vC(yb+wpN7CBMO#M?l#p&r9biI?)@@xqEtw|jXWDZHZjrGsMxbv3 zRg&%&nSQbxUbYC^cN7{?&6+zQAk~d1qTaXIW5@wx*S4G0+nq5p>(IVRS&2K(>(-85 zG?XpvP=4tbxIt=yle|_1L+6+^#Njd3kIt12fJJTWIAeqy3Y2KI5u_PRaI@MTcYpLC z%HFLgF_lDYTe4e1$E~t%qx3h^Ey|M^O`|B@3}WbljY!bLP^cwqnKooH1SI*3Z%VTe zVW;3pSfub-OSVtG?q>1Ek?XJd_?YoEYfW~OSlfAOJGRNGYR1JncSG$K!C;t4NDoyF zTx3qevjbjd`eNLfL1_#=wPiSN2@T5hjV%L?aG50w%m8{%McF2+#bGLOlS48BEaGO- zlBKn1P7(V!>ybRq4yYyz?h61?6t1x#2N2;Y{JKikwQa&`Ml&bzReuLD zU({6@VB^|7(t9XbGh%p$guNN8nk>SafkKRD8!L|DNxm>-IwFO&qnf!*SksI-Dnr?c z;lk#g5|&!H+cQ|x!Fi4LFnHFv(cZPx7?uWyJ|L#C4bD`P2%W(>x*E)6W28-%>8N+I zTml@5ZKM$_w2_9m5Gmo-L1G4`n3b;9DYT09T9zyqafuB}-$tUbUbm1j7E7~_Qiv`= zZIJ+e-0e_&^w7A**#JY0QRb zBlHNFG{B(bHJbEmE?S|0lfeZ9rf;WRK%KkOflB47okEqTMrrn}A>)g^q+%zI!vdoV zS_GMC(e=L20~T`WR}oUyo>?p?7K)lnwLy?E6hh#vBg3fS+1WpeB8IrUkZ(8p65srh_ewE9IIzOD&Chna8Ds7GtiThbfS6i zD3r4bFJ+<$WrU?wVPR#4=c#y*#D3arvfnPVEJ9lHW(-!yz*-0Prufc9XiMf;dT1$F zL5{gHpNs{}|CS=3`yGbeVqEMjg0m`&z5UL-s}GZ$ zJ|-G|OXu1yi{Ls|7etF>S`{HP-CZs15idv1Z`Z1pU#!sxac42}9HL!vV08O2+1BoPh663;`H`4v*i zvN~BO7;6*fMi<+~k=wxqv9mQt!cMhTYy3iuKV_>;Zm4^bCW5m`8$p`J-<9@=r4b78 zmVOGsl}^s9LW57UZqTjsLh6QC33$Af=|XC!h_Qt$v!SH3`C4=?t@JKHdy$Kf>quV= zA8j(QbEij^OvO-0lf&MnY(a_(i}IM1gvC-;_{MlZJJV)SJBssxBz`km5NldfL&7qM zu(}qen8d?X=0aPILrH56m%R>&XN~o}8&%aR2&l+CWF-5cvhFA*Ih01Zl_bKVMp=JU9;gZ2F;nc3l_kEFiHOhLi%5*E;a*I{WiefC-oid4abYgF z5KL~BEm-u<(AlvI@>Gyt-Qh+b>kHbGvw!0d^-rJog~9pkYi$^=X+;6$3YpfX&gOMk<79$eh;Q25fn6%t^SK_&FO;$Y62Ez5GFyaHFRohkdXB$s8bvVRaIt@TTZ59cNmap!y08nW4tgc&P=6XEKTg66Opjay%U@f$=bD5f)hL!NwxyJ}zx%(DuVvQq}N;ZBW zUgH=Is~M<^FpoAIwli+m7DY&vCC9)xg3k4AhP}~9oYI1ZM!VgfoX`P06!i>-8oXpw zJW4u*noZj7_I8Tp0!m`3EQEBNs0u4Qzr1QL;t#VECXBt;Zp^l0TBOCV=7<81G|*UT zN~*Y%p(n4h71{X$ugKCAGe5^l(3J8T(gK5yW(>-<+g{LQNHVP9-X5uihNXw9F{sy( z5Hd1o*Pj7-lcAA>aFSC=xdW2YsBMaqHoGn{sx0xZvlM+lBNs;ol=|NXJo;_Bd z@-!BXt4lLhf>2r)!$HENJN^7@LYoz)j912$f2@^hop?HkYim819K0!IC$THxPJJw4 zDWR7{chTVxvGi4=m`E$8auvt6aH50iDUVR`x){c30hz1TMs8W>e#eIaih5jv%IbRs zekiYapGxrt-f}Y`i|sZQJE!a}>^4nKHMy;628xN|IxQxszLkxINt0;sT$;q#8jn%^ zt>iUC#XYKG8W#ew3f}O^v(=|BUTjXDT^s~K=a+(@?t4Md{aO&5FsCd?oK+V5Fu!FyLv39i3uN^s-%rUWOQSswgxK_YnJv_$aug^A$O z1^Wd%F553SyJ^4R#@qJ`UK!pmc;U(Yf{z|CHQ2FeYH-o#rUt*icv>*)uhW7vXI2DX zJ-i~QJV_66dvQxeaQ$FKaM1@Uf~UWr2b~=86cqj? zgUVp8`I{9?_J>dfGeLPE{wiQXh?oPN9bvUoyuPCt>!bcEKk_GE|BwFhFU0w9hz+5+ z!G0b!@rT6zMMDtxbyRSa@m+1FOE@$YW+Jvnm_O^cANH9+(u5+!`XQfL5JvKd!zu5O z2fuCnlwXDWw&4hWE5Xx-Bg94_#-eokPZp{uAAT`JnpSFOLmH(_O1j18i%(ftQlsC@ zhv`8gm=cuZk8cZ20hEYfNkyZ7q)*`QE%=)rOpX0J45_+ba5(&!X8yEv9w243A~+a- zGYo8hl>&#_iLHK-?qJZ(Fn`3-rT*#H!NLB>C;x9oaE$yN7#s~d*2(?x$JCt_9E$hR z_&XTCGx2?pq!72W4j`(y~z(2YOdC!24ig|OuzZ1N_`N6*b zk@Kkqe~TcgX!LENMFvNFp^H-j`$wCTszbT0SJ2r^>J1!{w zcVuv6FmKYogM#Bh6aN=8AZeO&)6PqODqV8gkT`4*z zg{$DCYv3)12^YZ?u4*g2X3h+S6|9dVQ*)|LiNk`R8Jca);o(804&RA8Daedx#T@KY z`p6%zYbD3`$=WpU@E^1A*Tcjg66E%Gdz3}z6mbm+>Xci}YG|=~?e9G-ND>u`Q!#{Q zj?t1`4;l-_M^4A`=xw=Op7N<}ad$YoO*FdiU)PafRaE2@2rfU>**;xb&mKj%KhYf} zK(c}*tu|aTCSpI3T$60Ci}ONU$Xvb)zoLq_;xR8|Fs*1ypBWbo11_XGU|o1nm}e!- zTEcaxw6a?Xx{LOv$J!QeD<_%1G@eOka2QkdHcwiM_?5JDg29QBhp5CXm$wXQ#UZk; zXvsCL8X4VS++y1*_xWTn6& za;nQ4-*HQB9PYM3G)t#rS7|d=G+wD8o#2?garig56q|!tajbNZOHMc~@FlXR7-UAS zxCj9iyBSvT?hH?+gP>%YPgt2eT+sm>g{K~YR@ePX0gUiaeDwSY<7Hg6CMT(&rAmen z#2g_K;=R*8oJa9OLEQY~7N^^iM7E^`N~~?MK=H{;T15Allb}%I5NDSK*#^Syr?6=e zFL>y(l;ELV3BhBn;suY`#_svGfhpRoY%N~*2$Yau(vwsQ4wtg*OYL`e_TJ%R7AG?= z1#*osEFmOmRYFLrm7XtHusO+kMj0B>K(v-dw(D40jF@v}D5o*qQP0i}o7f9Cmiu<4 zH9e#79r4nG{9bS68f; zm{POLrI|k#U9=6&T3G$Ue(UZ8->F~gyIywfh)@&^Xb8@p*cLhNh&Fa-Y~jJlF$b{ff*dyW zMMro!K_UXgJ2uQ552kX3dZVPiYI%YT+hWxF$hl`?9rp9|(?54pFw#&&Pc;NSx2&!4;^DAj<$~CjJ|Ub%$&f_FH<8`}q;_J^`BAJ=(nXBq zvFKuTQEXyWMcNehPlj7l-nJmo=8H8s7 z2%Uf0L0Ir3LjpoqI(hu7Lp%=AK?3qH`l6Mmu6Pycksh%d1n_XhM`pQ!JW@r@*tMtT zvSlxIA~BkG|7=qh76}{hnzHg0Iog`ZDMJ!w1Q^3nPH`)7g0|HaP#~`nh6K>88#p}a z6P0Ju)9_#)bB3N2aaPH2AocG(q>n?-5-J&k4h4~i(@=Y7l^Q$OJT&d=xu%ib&dNph zCKT^~){`>Bwn&Jf&iLaZ^66?JzKmL8XY^Tsl9DHHdG26Hm z4D?Ef+@Z$&iW`{_e9WkX#TSoASey96_}oYY$+W3(@hNIKLK@_NJ6Mre+Ym%rHr)j! z(Umh7qW2s4a!9?5J($7kCPjxe#7z_x4j>fZUF$)7WT3)viD09QqE-=Jg^Duyd$=ec z-$JK#O7RMtJKL(O1|6-h5_S-{_Sv03D^rtVt&@}mt&BlRGxPVJ6=!9q8Peknu?I%y zW%U#{G!`0*kWP+;EBK6aS~!nvkA;gkEj)WqiQ@c>IE(rx4G{Gl(QNJIT@LH-Y%jW5 z2|df=`{`nD4b(2K>6B1EH#g&HCs&zhH`lB^Hg_8toA9PTc&T}uBKdVQ zgNKM*{wT+5XcOVz2x!TrHTt_QfTW-^sTWPFVhgnK_Uc91hNW>dallk;^yWmZk64T> z>;BDUHX2^F(g=sTr|vm(-@Qebe(4>9lJnkmgXUsE@18)VP<-@~!QvYPabKYlQc1M1 z=-c*Q!tgFay<^ZE)gxUPu6p1MD@7j9gpmGJybY=Y+D3PlkHEHD<6q5&+Y5_tDU7*< zP_H?ZJqyOxoj{=;mAnVB_?9=LMjCgr(@?`__Ppvxcq<#mP#{)Jvo>TOuU7QMfnyPOhn*{Fx_=QHXo{~;3iahmlB3lE_n^@+%^@UO5fB)J*j9QoGz?IWHj7aa2(ft*lM9}OySZG#Km@M z9XW8eFY9nJvLjz|2Z1UQy6?hh=Au@qpQT7%|1_DuSJ!~wDo?2uIrfht| zh7+`$2%nw*^iEqcbgcE6*SQ|gkb;$Tj3tcW_;2*aHC0snGx~&_veC*T?Fk4PMT_?= zgv>PkAP`-z%^dSN>3t2QPl}rSL@Mm#E<6ah_$++}6sd$#f|4lVW159R5UFRc3se!x zOYR&U3Y+U{8ct~Vyi+VK(rBJiStq%-f`e<}tr&VPVsr?B45cO)-V(r@)6D+p$Q5jQ zD;xWY8L$p-S=*Pp*?dNB+@m0`BrPJ>&K3KmXVFBih7+B;B)-&bbc&DhAjUx)t=(rF zIrNK3$`P4@t$r45`T@4{<g?UO_XLd4)Z5-Bno?$I)M^i zUg)ZfE2t5S8QUj=5U({)B#N+hHg>KA3#B413QyfNao4~^Nh95(2opWFF>Is406AUE zM6ZCOOHn;XDZ*3-S~Q_tH2jn|HOypU(W&5ez{a*5Xa%&12rs2E;fC0d9-#(K53npc z(lT=Fr3-hwEcUR%GrV&J6PbkgPtx|swv!!k}G zAvEcVjFYj-VqD=VfpWj4>{@)C^OWKaO)^qTB!ZiDLZadPpU9~Q{s~d0tFKy!(qg8z zXW2@+g6-6;A%Yj18l#(g2@75*Htx^_~of4)Lh3Q@TkX=Rv zJ#$$kf=n+s7DMq+XdpQ30UB0mH~W|6)6`TWe(c5@(w#A`R+ez>RL1opng+d0Ll>uurMxfCvDP@V2 zne?EO$ryV_1IHYZvM-0Q6da>cc!CT%NLJk99%@zK{o@Ou|9IyQ83G;mkF^SWGqKi+ zG%01cDX#Q!O8({8S}7x2+Z3g%s{DL#XL1?e+_ycWE7IT>9*rf!!_$FJ625f;0!xI}DZa64KRv|Q@UHriva{1}^J z22KrhN9x2KW8`VOl-5?(8m`v%fB%FY|2&xp^WtEtr(xPmdgxA}QtKkCT*7)D@wCJ# zI+LAZ#9Hn~JhkjbSVq*)f>6-Tjt-POzsM=5F^)~$f%;K=Y?VfoUPzgGopXJZj&1X# zhZK=awaJqFijvmoojkD0ZxKu?dA7w_?pYSGg?p>?7*?LZb(pwQwxY>p8axIKXTKY9 zX^>u}RZQ=`9CRo}BJ3#gv{RIk!h@2G_8XD52Is4mUNmEEF!R#u*w;Mqpim8b%|YP6-2+Pe0sioGvE z6&sRLu8TwNmr(E06qGsr!q}!<0)qbB>mNvHG+3js+ZwJV-&71kV$vs`1ifCXHi&9& zorZXIZtyBkO0KYqKf z7dKexYtP}dTYT8yA?dKClD9hOJW>>=?HXxdUl3{(AA5%jvL8ZHBjcgN?DmjhaugtA zu27KdEA z#e`iUhcP`M`)xAVeo|#%pu_K&>nND-EhX=?kQygEjLIt09pvf0Z9m;%xI4$i#*(?Q zGe=f@-Gt3yM`Gh+naCmm-*Xp3OA&u#1>+cVodnTE0VT3HuvRD6MGVx_u<%cdx`%R9 ztRhlFP5)m~FhshDhA4l0TWXj(ccRO~*;EM~0~2$@Me)@YI$>837;h>s)&}0h;$?y^ z&IV15oS0B(7w15-pu~+Cv|}8tu(j=xSrf=|U^=0?1dz&-2r6z8E_pkbX%{EGn2HRP zPTPBtGEyO}hE58Hu)zqg;|i_(`@15SbWM5>m+osRaY>hHKUA#(&o2!LCb=!b?=n9CCv~Yqsx0d5|jzKh}uV~ZsTDz+&;oJ zEgsS+{?A*}!VVZlP%;V@!8lDP z9?J>kh)s!L*mJ}qv>b`0tLZ>EQ+0hOZ`*@)mJYNp<9YV@wGwq@Pc(XEBtkyt)M$~ zQT6FQ*=&4#6{l9-3&W=jrmAwy)u*1ZM855d;T{FeDG9|)#gEXPw$PHu@2BzZ0L{$( z6g?9^Lbq^9gyFk^zZNtv8oFtg?(~|a>Qdi5_&F1veU%>KVK9|n)Z<0KKLVP+89En_ z#nFfy3yW#+?8FLk3ve2s;dlD!5r5AC-4JMS(5E~u9yK*JiqSXyT>>W8kP)6KFcQ8+ z3nK}07}De>(A;@|kOjwBx`jLkHGJL)@R?)~G*&9k@jJabLP)x+LGy^AbLp~Z(HSAP zAUF#j&w}PSW;7nhZ(((WZVl|t0L`t2j>%J7SzEiHCt3iR{XaG|0OhHztSq8q`acyz zck1HPBk`a=KQEvQDk^beT-4tx(ESEHd^F>Xl2($`>73M zb`j!~&OKm*xN8H5Q#+Zb4VEhRays{db@0J!+#ckjMiipn6q};})xsoj%A}1HgRGHi1f&tT1kg&D zL~sq>8qwk+_v2mDrnroI2*LKh?@tfDl)QZekw_(PAFdfrRqXCNA)UWqNjg70J@|0; z@O1tnzz3!WpU55{5y_3z3=ck>yu%eghC3~xIMG2@0%{PPgom{Q%nnT+9i;PR+m z9KW2Ov+QT;K30P9Z(-Jl@C;d&G|5i;9R^}G!l|_s|0Go`v`$PjrRoteZxV+4*E|A z{SnY=m_#rW!KTD8QYguy2kmjtbYzfb)d|t8iZnQ=BafwXKaj$O zx(^AQLaJ-aA+_yrFuVvRA@y#pKvHRKt*d6cP@P6SOXtskxPYLzzyFmDspK6G)C|`T z{16qn|G{d=>J+4P-Oxo7ss2}POx`*bfodG0%nnw!%=zG|vY(xsns}xz_dsLrv4-6D zkxd$={ECWnen%Ck(`TitlLN;f#{kVw4jxU&kc}OPkNnDt@ee{c&E3@ju4D6PpTD4L z7h9&WLxlQKUl9Cibot5j-!j2(?ja)#Cfd|zPPXl-~^qV zh{rYqsLO%qW@1dN28WY_-=-tRiSnc#DO&UJ*m1zheiB${EUX_mVmBKV2q zzyO@4azANcwmzTE-?${5dz5}O=8}y$l_zYS>e4xg{hy@sYawo*Kz7-r2QJrLo9=&T z&1l`cDtM0!lU5!SyO1Ghzz@b-{2pD-EDFXRz%l)c z@Q1%4MrU0*H#zV>39JbXfU9t9T>5Zw@MGkYzqBg7^wPQ6 zgS-;0o+AGJ56v~rNp^l5{|P)^Y{XsivfXE2FGupC zs9v_DF~4k9W3F~qU4Ge|x?JrXG?8=Dxixd4kx9ci_S~xyZ7GUiTc3N##2sao%3*zO zk5!78GpY)VeFQdWdQ#i=2FU*8dp{2@b-9(Z#y%nJp07t%E*D1QsW1z*L^R|tkfwAx zOA^C>w5F&Q4p%*;!V3#YfU)Jm`DL#uJCyo?YrE35YVXteGCw*Z6bIG z&}9NW11KdBwQ%-O5NIRJW_KpOz5?G4WMbAaA1wzvku*#5%VCQ#wuA-1ys zT_Mm#fHWR$fK;#Q21KnU5qu1gYGR*r(7yn>N^E}$NL~CAkfzI@0jX?HpfjY9>S>AYuQLS{mRVz)$mm2!pd zifv*ZI3E6KIiZ50Db2iZ4#N?4kF@^vzj8p|L5)UEYYj(xMJ2IeE?X|u5~(Dw6DI7H zwg^PM@*nwBfEmXi%5d#QfC~l)&Bgm@fvWIk=dmoP#{10zk(!0KEU3ks1-eX>@JrCGhuI9=4ww(XdFFrS3^G|cB= zz6|p<7&b$9!BFn8j@%DJ`SA$M_hFuZc@pMlFu#O(2IhA#zlZrF%nL9t!Mp1LgxTAA~nV4j5e8O$$X8ex71^Lv;-!qmdN1oH~aYcNZY2S0|H0doKh^)ISe zhr=8Nb1cjWFdLy5Ex_+WnA2f!%}#JG%m(1!2R_pP^PwEjQl$_}l|n343b9lv#8RaY zOO-+_RSH!(h}BPV^Br`ugIF!qcCmw&IOuE#)jFuoL1_myI%ti9E_Tr64!XiYS39WH zLG2FebWpd0vJTqfpz9s9)jCa-9i8E zpq&o-mV<^J^q_-wJLtO(dfY)ja?np4^m7M2?V#T{=vfCn=b$|fdeK399rUV$AcIXg zNI0m%L9-lG=^$JzWn9d4(2)+Ra?m^n&3Dkr4ytz0Vh1g8(Af^Ebx@syaHW+AL8F7# zIOt*rUG5;N%v##7b`bR|#kD)A(?Q)1$~tI^gRXbbRtF6@XuE^n>!8~lbi0G@bkN5g z^eG2@)sgLXRTTMim_(1Q-z?V#^E=y3=A$U#4G(9a$8w1a-*pl2QQ zoP+i_=tT$Zb&x+_17uLnmwWWXpR0keETAC<($$-%p)if|G2#{Yg@%7ZXlCP0#PCt$ zMSAE{>=#&9ixnZXz5BH3&eas-*Yv=;qGrH{eev?LWAR1kig%3uc!qPu zGQnpCT$M*=9oSheFRQ}40;a8R>u+aBy5b}Fgb5+jsl1GHMTDN3clf`}6waLcmGu_D z&Me}5h`5@EH{+A};|;54I?i3d@RGJWhNHv@0XWx zuIU&+zZg3Dvi+SaIhh04{fokLsJMC+JZ=K??qko{xxWj~TwwSd08?J}PP`eO5B#mG z_5jD3i!AsYAe;$ZVbUiFSY0uk?|=FuA4)n`vakc#q;rK!|KzE}yS$9LCE0v=`>#)` z6j!vo%+XYtxKjh>!#Yx4wgzwJ*TW|y9+>T1JqZjSp^4=3fxwoRv6k_9{BM1~J5XFL zz^T8AgSG@9S~d5SWGNSix<|>`U$Bp2&X4e+-Pej}*f!Zm$^WPQ#IIu5s@g{})N$;i81|IxqhXHb zAoGhGx$UE_YHQlIaFI`^ZH&52bbNMZ(gPavL;!GB4vatMD>d<+spzPvC@TyIu$+7tlXj3-OizZ zY$z6Ab$Rh%fZQG*IWEv1l_2yM^;AijpMM;B_onmyqd=NCpv6&+HqH=^MjK|_7iqUsF=<=ZXlTnnIPU>$YnS&1l zpTp#O6~`U%P%js{n$sfdvCaVg3PVFWKFV)t#NRyd9|YY|M+k}N-a@x{k?0YM4T4qx zt%kw1uU!8Z+!QU+LuQ@oyt1H^aj1KkSH{b(QPjtAZ0$66otx0Jtc-3L0Zo49fx z=vYoS?E_sFbhpOPow_i(PL1XAud#GXS(MyEx^l=V|A~t)M|x+*(4BflbtHd%J`TpZ zt-_fQOhsS?N@_l*BkVe<`~}s|(hcUlxcuQNodQts0glFB36qeiDTP==6wD=!nl(~_eoZsZE>>VV&kCZ`j;LZ4`d8$pG1<9iafP^D>S(pDh zL+k>GP_ZBAMZCN|_{&e~%J%dR|EYiPtedd9%S_jUlycf5#U%EQqsR@6^IOUHE%gZS zpYl5xj8yLXOGmCRPvstBy!!GVV!SX5eM0{$vywaB1nU0#U(5-%e`Hop+`z$<+z4D^ zBI$|xp%pJmB7fw15ZC3lZKYq^M!NZvzvVXZ;|Go9>5AOXBsCD8ff{1_Uz?e{g>wXk ztg+=5dfr%GixoA`=U%CIv+!HaOD%mUIhcVhLYW-gE$MVYZT~&rg)d0-y9FVhHMU6B zG?s6vzAt5AYi z5=_i%o>*n(jq7sHb7Hu$1dNk70_22qUD==dA9#`c ze~$_9n&I&)r4Wr@iqxuRqJis~`9sqA9ZcfJd_zULWe1(FYI&%kY&Y;6OiJe(u{I=^ zoj1QRhcyH;hl#aU6OX4y#TTZ?PS6FYt7%yy!c|LV?N#FtWqeTcgoOE@fm{mqoOw#f zBwUj~@4)+Nf!IS-+(#VlSAd$u_GkoKZ8@@bwcyTkxGNp*4}d766EZKfP9Wx#y1f;U zy8W=jan43@KL@04p9j<;Za-XZXQ@94=sdx3rkU+>LRMa%CD6YCw^E>8&UOTl+U^Ea zC$^6{+b5mvF94k@w!d+<H7EVO0$T>Z9qQ zRnMk&avZ8L_lV@FE*8x8Cht0kmV!gMx;(!&;eV%-cdxDR5ohFH@jvJ1UhqE;;|C-| z&9L!AN*GoW&U92V0nGw;nV(7k))=X1O9Gd`>Bwyhz!=cH0FM7 zaEr;^DVvfPUADcu{D7D}i|2JygNOgtu*HiMQE9+xlNFOAcNObpOtFMk_hc ziI2McH)r7||A|VxA&O_6^@#+akdiyTiy@nA?5ha`g~tyq(DtEI@iyT?KG9bAB=7!&mc0v5&Lk3KYb>e&JX!7Qh@SDHoY4A8_RVoPXX~ZkJYy?)f4#G+o z5V6mv$-+9d0r-a8cMzoO#X4;igoa%Gd`4HJ_7_yS#(tQ=%8la)iv=~Qy| zs!F`-S#FCeeM9aisocvht4yMPe^7B z4KbHccx=qFM~O7d=P11FUI~+2=OED<@>kAJ#*Q#+k-ptO*QX|)RnqGT_ZaFYpmCQ-3mNLQTrrfbPY^GCM!DyS_!TkGfD)D z5ek;@ge-L7fJs7@ooo;&4N;=Dy?{7wp9ro8q&>kw2Msys4nSQ(_n&~e1^O)V@?8Rr zIOs;S);)sz5TIUxz79w^-{YVW2YnBas$#zY#Ljsl*aN6fpd-<&tL>WssqGnn)OHY% zs)e5f)FLjhjypKJx9zDbhvJ+g<_KXu_-uN=d8|36V4sAG>P(crbo9OhQW8 z^#Watw?ZrxRf2P>pT8dk3$&^8jn;z%txMn3?Uzh5QL!C#k+ky={828nLw)Y9NcG=1 zClFm(qLr-M>nc~eq9K3j{QCTgM5;`8v7`W(jpn3ZpGw|!Kq`6nr4=BkY=laf+MZ)y zIF*zBVOuKq{w@3*-F7{G_|$8kxiNp=c6>q2*o{DFrb6zos2$zPUM>UHkY9n7%(r-C z^r=c{YbKDm*I!?jxHU=z$zmY2ezLY`-Tp418(H> z%UxBGyi4+V`vJKXm36rrvF!ZT?GgawS^j-4Pup@Us%&8_d#dilziz)_>h>$ArE_E6 z?z=1$do0Aq9xs2H?f8*sR8`3W;6~geu+pIlb7S8->t`a2DornU5OYOy@JE0&2VVlD z5_Sd>NhR#zfK?%Fr~RRdAmORs(7k=u&6PuKF6mwL05N?Cuubn3>8w znR~1_i?dD0Ug%Co=3Ws?lerJr%$-{E)cA2VPq6@;(LXwEIlK};TvI)#-&{SLBHHebJ_E`JF&>@?JFe?KJy#>_Y# z(N>qsu`Jc)-cQM(Lcz#lU!GBzsU+6uqS{}H{f*;itE^4u&$mV7d|O1!Hc-2Z6*2{K z+$5H46-B{ns_1_=_PPxl`GX$6%9Zi2aTr&6>PI3j+K{th*Z6UiLLs&+3S9t58@smy zQWq4}H^G?gY8a`=*Gn3p*WEX-{~qZ$_8kFb{{5$GV!WTaL~7!Gq>G?vMO0y;i8w{t zl}NNDx;=`U5g(QQ__E66>?!HdWmO0bMg=aJruB#7vlX9vZDGLo#rRHm-*xzY)%#wI z2E_Y3K6zLDwCz*#^?OA!)F)8aEAsWP=2pzg*F#!VN>d_obBQGA0)${IOd_bodz(P4 z2{#LLHQtJ2Vk&eA_xagjjoLCs;H&et!WyL_e_o<4-&0waKW|oj+4C}5n8NOyTe)<) zF2Cbx{G_(M%$`YV7rQ3)$>l$&Tl$0Ktv`Sb>PT|nzrbi!?m=|Pb^_wlko$4+?qwBi zBf}MKxxxE@VPg??&PeBK9TncYgyh{7`IU*r+{>x6Rwh>Eo|dpA2f6Mb-G5VckR14p za;m7yr)D*lubf}l;lkK2dM#l1$&osU+dJ;BcqBQW5E5h*qaCQa$o=`Kp$OS5zdXPYfe<>dKy9y8HScjlBy_ zc1jQKF>uCC#zd%3amVoBunYUZzlh&2r;?S^U{<3HO-s&RUD=RdS(VPMtU`2iD=SA= za=^jFaqviVm>P#}_&Ub--Dod6X{l|mu{GD;W_@zm_X{JBp&E(&jWbdwKGgSJ31WKi zDRkV@*aUk!(xMODtJU+}zNOW+qU%eR&U6s+o&j@)n(MzGs%!;YisWe+8S zi3X(PvRO?0iHAX+Zh5!?Y5Fv#B*v%W)zGrL|7p*c1eB_k)v1aEa(r0=TcwgaKF`oG zgNAA+MxHINV^C7!=wJqX<(ac8`;J8(+_?YN>&wvf1X*^^c%_s!l!El=%4*WN)ES(u z9aLL%3(M`$5N(|7NA-SFOdnOt!$aukNTD6$9=_Pd^bRoVhDijRmN-G6N{A;FfrmNh z7zc3?5|!>m@C`th3dAM;3YC{zxAlOurM(i6wzOLSX|ptp(JTL5WWYDRnYgn;~Y z5CiAU$}g*I#5BOty_=7z&kZ*&9o~FcBbtqr8FR~?0#)&>o$S754>P4<*PY;N`^Gy@ z#fKC9Y3{Q}yOR?QY3Q<9k_|}1g(%TWay#dO4^uOD4>@8uId|I}0NdYxCqM6A4(YM& zQvflK@s+S2zKg1)^N^Bnd}uk|8dH8#mrTgJU!ZR|+Yx6Q^qz8VYt1R=;u^lHbI+;L z`{>NQeDhDFEssd!?S)n6oKrO)H{P9STx^!hO>i050-nN*m1I?Ksj9!>2UK~QZY6c@bt zxQDQ%rMK#>#+T*G*G5BHb!G|wPb~J_OPXNfwO9AeCnEOMx@HF%zz3xtYaj(QFa7vOuAROHMV(Iqro1f0H_WF_`_22qwbSo% zG*xEh+oLFOe9)_hE3S(<2GGAfIochro&JHNv922E1kY5M^0K7BIH}}_BVP{JPOmoD zseyI%oJLw!ZIqXN1@;v%U;V^^9}m|~vmxd)4X!k>+{MF(wB==7K~n|je_Yl6RJeAU zyLI?fz)l1EbA#ampYpP1ycxrJm#+9lxOSSOwtT|1(@Z-)95gF0n=Nn<{Pdmo?hV&Y z(~b|NSKcs&cO3S~Z|j<8 zy5jb6KC_%(YYb+8V9U$e;fksMlMC;8r>=P>^`(x+`gI)9cn*LmFXQ|zb8glF$NWFK zo*5s(iG1NX0DdWhk1IlaC@-Tn&*!PzQfyTfXod6jYhi__iX}@Yp^3OUOkCLze(X(AdBvN7?xu?TZv#CKZ1w}|FD z5x;2tbdjr$B3Cs zd$)SodKO#(9=gO?HCwLi*87dSdpf#s8N{^_YybLcF3JzDRrZ$~xCI2umo2lWc)OdeahtVW@y~lT z-G}UCSa!*Zrd9Q;c)0aubt(3GcMb9<(}TN&94lNT63~nAuw@(*>YoN`4k33(1Q%Kt zUKbX((Li&<-44yLm%Q*z6G6Pw%fnV<3jQaC3OUE_MXH! z@#~Q^GTv3?IApcPKT%s#$flwkjm%V(Zf9G^7MzT$aW1+;-Y+fOywGGWh^Gg!3Gc2* zqoil7`j$wBaYu-N23vD_h!)u3v1Fei6LP?iHk}>o+*XO#Jp=W$#Y@kql81XGR9m?V z>UyJ*RuUg4x#EF;%3g_uMwKvL-iP0BLDF7l+7)W)vZnpCGmN&Ugah~)291^6j;>}= zgl+{|k@r9jKTfq64|Q_kwfvEyCUmDqv89u+aL52*^H`z_}9LwgiN$4w9esr9rO)A%v5{$X?VgB z*7bK_j86mFe`9TseY^G9jQKOlCLV4M!27ndreeo9x;XC&lX7%LEqs@OMZ{z-KvuMb z9M8j^Y9e64VJ%3=>RE->I$Vo`-UW!IF%d+DKV_Jb3l(;14ozgwwMTd{BWh$Z)%je{ zsYA(_FSAo&1=D0$b%n{nCp7XqHESn$kgATdliLa4#zFDPS^P>_EWzk~7E?x{^Ebn} zoVmGA?!T_(=A~?-%NGRUt(d7O+CqRcDeVMbezlFB@z*UZ;RHwD58V*&JftNnPa;@~ zH*+BoEW?{6OV30kJ|Tw@DqRo06&eI|rq~YQt#o%dTb4Pc`wk$b`<|owPiOmQ2hBxg z&_Up10BH!=4^_^b_ECN@3ssUQ_Tkh&og!s@rU*?|eq9Pfen~oiCsVO-g9Vpq>|`Oe zYu&v?7!$)B*v9yEE$oYGZ1J8HQp>)S?6kVvH@M#-Ir|&peQs$w_YuiNlLwm0j_Tr4NuJat_}3H8$_ZKmZEt=dp(i|8!RsP^p~(e(V4}j@ZLmly*c2=?|g! zt8nV`#wu5=v1()itg&jO!Nk(ZGMV#?_&Fbxhr(z{QJKoC# z`WW6!t3+@Y-gN>=d64rp?W!d?Ula2l{aY%6zN!6NW(C_m1HS@M&2aw>C=KuXF5vzfaDd+X z?gvEKkxy5aJ&a}6XYXQhNG|(9TW(EddMI5Xv6{tL^-XOXt;K>+7cZ_0hqE*r6cNN+ zi`39Rg71-C5-zhm9|t$q=5OAOY@Ha+$uExF>-_JHpN2#=uGvXV=p<%fikcLHXtKpeJ+AHMq3SU;%kEa}zej7suh8LslOAK^`3 z?;HQuw}vx!OC62%i_1;;ut=4c?K03izO!j}ICJ-9M`K+vJNQh8(b+VTy!QRn2f~>< z>h65PnLAbkK00&9zTPZ+ov`Z@v%;CX^Mt~mxf?MUYWq6tR1WCl|8?-^!kN2KM`J^H zfk{>RfOC-WW(co(b?Cux=I&xgV_mVR@!21yyzE-OVa7L4X%A=aGQjZRX+_H5r-~45 zr@X8aUv$;=%VXXW&fKwK=mC%UY?+oE=d_`*kF+t3Hgp81S$MH-F;z!Qay)ZHHT4Yj{I0d;s*gguf z!Lg5G>WeUYECGH?oe6Vf5$FAiFfT?pW7Yt}nIUT>-yNZepLv-dp&^H(iZIuOj7{9T zA~YNXE}pOXXoQ9=SQ6}`AzW8P^UWg6C#@6ws;fkVCU%rw#?3;9JOvHoaoLUynXb0h z=4Ad7-O%2)W!F+6e97aa;O7>4&*w07Yxv5a%YR5v%U`cyhNEfWR3X86$?B-Me> zOsgF&#ppS&FPf+0lsc@=U_}SKd$V2L;%^UczT#!RIEM#UVk$S|OWdfqlnl8lPuvMf z#7D)L!S-&9Xd`)X!644Z;n?eSnVxW1yLgP-4|+>`250G*6y=&94XJnNjz&=s3|7HN zc+AMF49x0?cXT-0yK75=X%b+vkz*4>8Bms_5Xg@}5u#|&cm_soyRXUa`=~7rU|AZD z+ETjVM3=*{T+$R@@!r6te*P(=wo9TX&3qmW@9n5ZXNsN%Edha%(aAHSqk2@qcAyD; zmdz+0R#u@~8a)Z;QQ%(y&Anz+lr6l_Ej+CnpnJXp|H{!!?xxC%rvXOkqNBxM1pd?L zO`J!y7!UOXrCWHqAk3>4zt@B2TZWEON$Ad4#GwrLR3qTO0nMDl6vbc)T}|{PmlW_@ z42^XxbOk2_{Q;Ku#L)TeAKf#(K9BtOpSY7lszC6CeW0Vv9F3tn^^6*;%=lhKVLKWt z3!B}J?K?qamo{TW2mNZ?B-4!Hn-sdWJ8R)1)*`a?d6wMTu*Gul2|Cfm$!XY&1$sKk zflrmP*dG~~&R>qPGTf)rKa$2sn!3uDW0%br!9BmcB6rKz0e~?)KOe&!>C2Oq%dz~o zHccGh`N_)j@w+yioV|TJyh_f#jiCp{7A$X#AAI8=40cT)Hr&6vY%GuRkuEjh)G#zK z@8gU>u6~&CM-|?K?NwjI;$o~#g5SA*LEnoBSoi zc07R&7Kj7v;J!r9(je||;IQ}}w{6tT+mgJyelNCJ4a}2lxV!!pVz2MN?>7iD_RHQe zoV7`e(N; zDZ?#SLzgAed9xc23#Z>s7uN^Lf#@-lj!9J~jZ zR353>KRo{J`3O`0-m>JapCMf<68kSd>EC;F^41UHJD*H`W+Zv@c7WqMgt=^3WVxEl z6vrlKST*K1V(sz0?cjv%Tkim-AwT5mY5(4qD>9)CcO+b5;e7Q*_LGGd$!Zx$`5GGM4g?DIy-wU zsywRysMK{3coif$yC;oJA`A|Ex&XxAP`BR@PP5;&1qq50uv-GlfD&)wgd(eWjp&C~OT=0<+_O#dTgxkHhed(wHtYGq>lFiB-gHB+3CaQdOF-DAh= z?I7@Mj|5^T5+N9`#r;>67@74ZIBwYO4I%~=(**iCAU3Lr;Lm{05NJ9IkK#@Mv_x=cI^4ejS}HhhmpoITzX4L;E`%7X5?mJ` z4a;`{=`6!*fH<_82xdbVGp32)L_j+Fd>^2<3hqfjwE{g0s7j#aXhqn^P6TfUq-l@= zbe!P&0Hp-F0g$H4ARtW_%v^bcMsn!Y(1qA>q*FDh!bjP%fM4y!#L-I7Sp{8y6An`R!i>4=91@c2+V+$k+u@PjLtq`(K z*~`FjHHXxX0%{pdLPofj3v?CUbpqXlcfCLinI=DjugQNepcP^(!YqFK)RyD0 zRq4>pZ$iop<7kP`?CCv_2uSh%8@jPi7iTf_o#LeiqheFTj-Izi>Y)vSZVL~kY$Hll zI(I{m`Zfx4Fn%ny0}cQnQX6PCOP|7bYT~ivz-&!@txL7>SJ~TPN z!);8uNg|v*Cpq{Gg5z_%lpH6}PU7OQ+Qxj_lAToj8p zyK*tRhLPj%JAi!d2A_K>U?<+;z!7Oh7abu%Z#`a_EuLIe4dRO3y_yvaGV~x zVc2cm!hK>xm*`O%se4g;AX{*kSxhda7?E&0Jv5sKlY@Ujjzi8sftiyWU>Aa#%>Y9K zHiN%qV6ZGBIrtQz8-5Px*cjHxDjfD92Maa0QxFS+jcAP4isJp!EiZt70w?;g==R^Y zohg|d=wW30cg_bAU#-%fYnkG$cY|w9TJ-Of@u=kBG9X?GP`H+=O>LW=`!RaU09cTV zSAquSc>EZ(A=r;i{B>eN;y3VDW``-l;vJW`=5L{H`X!EoB?qrS3LMYDW;BSHjvQ#j zcNq9T*z9x>cnX;Qo!YeV2@GrA!H`C~LTYf*+BEPSZje|S?J$#1wvDgudzSVQ#1}_l-k*fw-lqX`7T;q=xw7#zT5<4zl#c1m_uW~ zdj+1EvoAdM8=(1)7gv1(;2L1rt^cf|2j7$}>< zQi?ziR5MYYN)G%KK6rt~;WE-{4D1&CB_{F@;H&?hN~THng8q9d1gOt%W76jCANl>P zx}mLm{s?`(fA8#6@&m(l1NZkG`lX->h3@wI_uKPJl!(2v*~NLhFFCr6e2`|r*bOg7 zV$0PTW1q*XzUDXM({WmisqI5lmn2i_@Y|5vYnv~7{*x8;%r`?ab{KdgL5{``^jE_P zTW(t((?)OU%gMnhv>cq+at z+$JHf%RM``De8jJur6qQS=742vkv{I$|vEci{s%Uv|@mr)r=@Jma_2=fYuR={bgdJ z7Fg9uF9Wm^CK23$_i+M!4)2seEE}rhGL~t7Xw- zI%+4H8mgX~!-sS}y)O4yW9|V}%%4S&&_GdaPB&UZ_Tp_5WwjV{eX}Q=FF;YWRdgqn z1on)mNTVO&$?M$nb-5Sxn6!{!jDDcTS^2-^fxb_8tbYsJ@y}G@tvSScsOiJ9s_8QT zh<&g`K($S6?Q#r_6wYE`pl_Hnx@{}Mihne&_V&csE$43riSk_Fc(S*A0!%_`%#{L# z9UM9Tvj4fOrF+8xRGxrwV*S%Fk8^M+i*}Wft>Znmqq!gA;@?#Nx8{8vs32Qu2fENA z?f7?KctpgP@yqeVZjv-$;OpvD7$s`QfW+fC??EyL9iPn&+MwZhBJE<@Z;laOKd&nH zGqe+y_<~dK@S0*)>^ke+JIb;HX^|Cmt=yef>x9E1lcN_oLldx)X=>aEl6jrv4XmZv!7yakh=`vMU4xHz)}BQ5Qu86-gjK zqNuw|f*VZ`#Si?z5JMo5kHlo7(5h@2g1fG;}#A{NDcGcaqt2oqO(kzR%2@IWu$j#?K|ai$-lL@@^?g zZV0y>B)Rx7{9JWd(Wsq8-j|D#e+svKN%F=1z?wRLc+@9F-q#D0ueE(m;+4L@n(z9; zqrMD#KP^nY)z*b0jc(`#@m{0;=KVVPDMSNn7JI>2=f&}d-nWup3aM{k&5@&C_U>HT zx@d4w-?pN@&lmOmOJU!?_5GsnOE_z|b8yk{Ek(n(6%F4J9=?M zRfMzk)@)lFM-l^t8~Sds9#9YW%1=5ch!1q*$}YLItTa5MY+6aUc&grx|Ns9M^qYMw z2UZd;1>mQu6M^QfIr$BHAhu0nTyY@9 z{S$s*FJ#e22K0xNTOHH@kwOHGQ43j|%S437wYY@Siau}9l6m~czbjS?StzBqGz*VQ zDj-r;vOS+pnDUld$Rbkgvtfis&=!j^8+Yy{DWqUP)UE2NM(sT~6g)kH@|+{N%JI7{ zihP-tFw~FYnPt^O(iCMbtAb^EVY^XxTT)lJc*wjmgR)6`f~)d*yNg1f9V^u=o)0tP z^Mw)?Sp{EnQ5JN&wRMmyEZ*FiLE-eZHpbvyv5FI*>Awhhdi&fnFg4KeUv;{|c-|NEq%DNbZ)Au8) z4ZyO7Wp;IaZF#Js3M#6|EVO!VzjfTpA{xg%7Lzs9S__BVi;uAE2Wz5)zrOMYF5$VZ zvaVj*5iXXxZgH$q-5qK_@1f}8r4n~8xKZrowYAciSpKU#`NjoP&J3-%uAa%3_+5MblguLra%vfZyVb|I#?5u%$PrT*SP3hJk2dsVA-93x-mF3h<%6;f6+iJ@z z<}vdZp z;!Opbm${W?71gy>m33wHwUrg-flk}D%++o6b+KBrye&s9U6Wsh)$fG7JfV#npOdRt z>^;e47|rrqFpcE2f`|P5kF0JR>riKjkk`R-PjZ9R=yPCdt@h$eyfOUN%|$mOtWJi# znBsHmYdRM6Gr?1w&Np7CTzPp9JYYBXKF9Si9M~xT#<{|!f4{*S$MbyafHC3bseAp) z_`PEBXqxypwtye!jTs1ZINwDaM)<~AV_J(o4cFtq$GIvRCMT3VEtI}$Z3yU`yK8UEy`st2 zFe6i#+$aZ!V)}k?>}>oV-LOQ@W60dq9(sXU6C78{cM{Bta7N3bHcXGU9L86J&Z6#| z@ln4!q3=K_heFt9CiSMX4?qx)>(;Ifw8&Ry;49QCyV0{ zUy>Zg$B4jEu4=(i#L?tTXc;&;2*DETvq%f$?{S_0nmn-nERaN4eTj`-U6R}r9fcXM z%`DFrW56GXc?RhZa7}m!R+DZbo<0nz2Epg<$c3L znI7OfE`*QIbcnVLX6fL2%T)aV0*u!cx7^|_ZT@GVc?{=OQ@3E=DxfkWIT0s3UZf8+ zUB|X&eHUI{!)vcc7U}uePIKO?lY<`~G=~mNN*2?iJTKQ)T5ue^&4u;L0wPsIn5RLZ zh4HIsoKRMi-gce32Q*bPe+s1P-p`H1CLpya=~WIJXR^K6FP$&tQ?mg%l~H%=wc`)2L&|PY|jf{tty^ zPs#^?wT<_aV5h;-sG=dKLRkh;O3^5*5PeXH{wT!CrqJ=up#-zhJ^!LI_W$JOIr)-{ za2S1`mjeh!dhj`?uD9nLkFd(qkIYv^`6zg3*lw$%4axHUDH8(*8Jve7KMdj zhc#x|-1qG{#}>n*!(uMbs5wUtLue*V>*d%y$N5AWd(M#`J89IMBinSE_FhMyXU{pF zX?S#4LE+MKj;u@!{Vz`se8!%0Jk`nLn$cq^`Mm5yXugV!s#SB2&e=oZaY?B;M=kZ! zmoAuU&pGPZ!$ZwEaxg=4#d%x)7`!W6sf<)>3nh&S4lI6rVSU zUzXg=+h0H4KK61OC^W(&=%Dewc8PYQS{ zs_JY~cS_)KGFWXxeU)JX&pfq5N0U_Ty+YsOdWe}6^(tccN>EeOs~caY`3_HpGQ2u* z8pfPKCd7FQYi?TTaFPvHoF%A;Eh<}3KCjYtbL%j-1DJg23_1J^uWWdiE92=}^x6>x zzGHXqDskXhR5}<;ZKw@V^F$;2!UiZ5ufM4p6E|nZ%CV#D%tJ|>iG5xk_tqyB#qI^l z7wETMlSkMm#urOhW_kLl7kKlc7yPz2y|K9y#@cUste*IWkLPlXRXon-*&=0Jf}WgN z&L%p8!6Jk_Ijzn;&WGZQgKrFbeTO*@n5QHBO4TxHNYxvc`;Cx~C8zf`rt`TEi;_O= zMew|r&X=3dQIIk8?<4SVtpp8QH3@gT>qXD=An1L3W*)mZuC{WPsHV`?)Y-^IOZ~DG|+c+?_p6@dedG- zjf4Z}H#65tZJsK!jzfe!80?Ww zchO~LcRhs_2m8`9TpWjzhzM-ktM02@TWNN zC-Lfa?Nw=V10?9-i=C@E+$?Tt&DIGo!Fo;lX%9i&H_R`nU_v0tfi5mO48+Mr(X;!- z4#)W`h(&9|NAA(A(~g>scEMQwx!L>5X*aQ9?j^=N)2A4|Z*BN|=0<0;!AIsl zJ*v|+kyoFWjRiyXKY#v{_NY#eW9(7gBjBM?qdGq7l)86MpCjy1-7m=iV~^@sgJ{&K zjy0B2SG^Z;jOvad1B^YYdrA?kQJpg^dsO$d;n8Cz{cx&L9UB>%S<}{Fy$?gBIY(VE ze$Z07D_5gBHaRqxU-@~5{Uv#kB05HODx%{{@`V;fjq02+w7(=@Yvyx*Mxl0*J4E4|;2zbmkr+Oh9JUd@+}wPdf;nW|+}|Bv+USB^ z`)K`!WO*R|xsS^9aMoq8ert2^rROuB%QuHw4A!N)`D@mczx9BRujrrjfRFh#0QJsk zx(k>2U(f?S&hMPv4d0k?X&LAYP-Bdy(({GGopShhgXJf?Mb4X3gzGl7Vf<*)s;X&B zDMzEPfN`f~w?w0_6VlA}X+}mbYSCTehbtkd_oEjEM%|K)p9bvb8ns|Aekym*DGV%` zxsAVN2q$00l0Q+@ljNm% zXgK*vc+~d74P4o6O>~^R$;QeV>R+4+<1`54?oRcXp(w8-1H@M zDE-9~ZaUb%?zrNX?{$5#-TNAJ{{C=7wC$r{V8zC)zXX>49Eri^m3AN5JohOeI%P7EbmzUvLFnUr6c^Ac7JegQpV>ZYXN&tZfRIRDd7U`^K- ze+^9j5}pgCEbQf$TQkZ=DmE zwe^!g?N-m6;=sa}=LBlE7tRUPU`_)3ftr(pa=r1Nz|!)}34GLrQmHvCM2B#oljT)2 zU>fc)mYq`+xN*C4;+&4V@bk*wh(3h-M|<#7^B!*JyhGZjr0pf`Ytjzl=f)5C^GQ)) z^S|Dt!)HKWB#Hu;{)+;i;pdfoAie))QQ-3Tj5rK=PHh`LnZW^L`BY_p4p=@MPCEkZU*mi+*oFL2S8fPGHv-+}*kbb+xeI zb?iRE7PRF4wmtsg`?)8j*YFL=Z7=T`zO8Au7mr2m_NG1FFci{Rl|OlL7LG>1$(ZrL z$Xk{d21XXG#82sJ{9M+GpPAe6Q@I;Id;qay89%pVW83mdl%}fBHm*$Wm+@aw?mvr?FN8;J!ejeha(~nATibRIDIB%i zyDfM77hhnhJD!8^x;Vlt9<>$ww5@X;iweG~pI?~V-|{1Q@C*JL4n+Q1m^?7*<>;s_ zC8?s3#lC2E;pw;Jg-880cf0)+2)-40_v1nI76qcuq1h>d9=*1MCln3eFePiy;awZT z$!%eLfkGowIDA92t1aBs9_`xF(5^nMb@d8NZm;*}ZtYx<+|cySt+`v}eaiN~h&t!m zikm(TPC=7(c(`jbu6|!(!hZyuET4;pyO_x73wN~^CQ6R*V!L{;qU7fAsIS9qUn5$Z zqXo}5JhsXk8%)L3$qmt_PlACpgN~xF@RX{okvFcdLe}RiYoWeA2-EtyslH-bL=FM? zw&M5v9>q37(6d0N3gSA*d_gZ5*S`RrCN$O-<*Ht9^_hPhF7We>T$639y)AdmLX~ei z=&$cB>-sk~9q`9KZ#oc)?UfzP!I>L5Ixi4kIey?5ENhOy`OUHM!x`u)bj>SCwyZ>J z3;pBNmK4SNRJJG3v>BZm7VsCVt;@-cuE?|`BqC7Kmwbk+5lfO!?Z73Pe2PPtoAA|G zn$>7U|3uW=c5c_(sIw!L50*=^c`d^KyYrNubLDHt!(ix{S0QkAtm-j4hh3eg^~`I|=yVs$c8Mb# zB{Q}mzMaV3o@8c@_$aA=CJx*#SqT87SNyg&(?^=Z)Kjxi`X#AnqO1f>8*%i=gUjI< zY4M-lwWSbRy!YmAMHm0Y=iDJM>Wgs8`2&*8Pl7{;$>y5@QDG*x`1>@q4zP%E5W_83 z9t;P5^JW;I(*u#6;iit>g@MRcRJ#ORi}0PgrDZn?ShY>L+e?zo_rXD`3lv*6B6fkM z5;UyQ)C$(y^IJxY2{&yTfL6dIDFW!351R!ET*XuL&|834>_q^;+c0pl=u0eGO^XMi zX})ZQg-_9!tROA^3@akGDu2{aLcfC!nH-0VqAyvYXf-V%!}n41G{H+O+7h{EOVqpy z4&kPfyo`LFP}B-?^TzFH4mv~GL^QR;V*7_?$c=3pWRb!6f8-8 z0J&1{dvI;|SK;tySQAl*ttjB;)l%3?npaxa<<>QhE27D2*AniXY+edblzcxt3M&qt zl0ry+9&UPXchf)i7mj)#Z5y+_B(-9tT;y@+Jbupd67Q$R7w_3E^d;FAXv*Vt%Q$%u zaH#VJ^o3DX$HU1N3dcPfhkLl|g>c(fCln^%-uH6W%gJ4-6^wTg4t74(?)iexM-ump z_aL&xU7HJ&8%heEV(F;XZ)!{baYe~3c$oU%)VtKXt#k15(t?dQ9t+*7g=oZH)Ec)uqDzpoG}VFx58=bALA&D!a($;ecKCz&zBZ_U3Ys)s)fmgo?rB$ zcSx}Y)?i4#34^GjmpiIaO#&xS42|V2BXOVzswv~xwW1Yb&U?1(&{@AJ{>(NYPwa%; zt?o=LNlBIOXn`vZtDh5Ch+>=7ih*}4Ztz0^VUfd-@Vwn2BODn425RmZkSzs@A!4BO zjsYxHfO`g5#jGhy6a~Y8U~$2V4eN>uo^wYduyib*0PHDdW!l#|GTL?~&JPthxuNNN9V3)Vs@@$Uo)EeG3ZR4W#&1V(yJO;`gitQu(q4=zO7Z zQKRzZ?kp6P&>l1Bk3hvjdmHEiLA@{)H$qTfAkI$vJ=s8NJUqm>eg{acqB_~Qo?%?a z0p*D7S;kd=D#8m&0$UEl-b4hm2jO0c2=9D}2=*q1{fUSlm%|c~!*J=Hi1fy#Pa@I> zm#jntyA#8G6A^4j4EIY!`r&eTB62t`{S%S?xC}@{2H>f?&7^kl`YDhKtBBTm->z5g@}w@C+A`VYmo_;UYkWi{Ke9A``&ns08%T zuL&QShz!JKU?OrPF4>95QU5Q-2~iu8hz!Ez=tN{NE`t-1qj4FOhz!By*hFL~F2^Jy z!*Cgvh#Z5<&_v`|Tuw+tj>F|UiOBJ|9G{4M2bbd#krQ0$>?3)P3})UVgIVavU}iqb zo|%twVdkSmkoov!-XnjR_sC!7J@S`%kNjocqgQ2E%7uB4a$(*hEzEnQg?W#( zFz=BTyj-$em`;=n(}{9nI#Di6C(^=nA}vfO(!z8iElel!faydYFrCN)rW1K^0xqW} zB6xQVpOT0S$K~Wi^z145DVv$SU!meD)~M zZD>!}|FCV=JIc7q$d5n0k{8XGwWgO}@|3IdBMe0Gr4B#Fs2k^U5j4DMJfz@b&UN)1 zF^fTyoW?^6c$ARlFDc6C1L+ULtWUg0Hp77@a{ z`Q=Tg*k6OsS48<5taA27i-NC2kh;gZ+ja7yLH5_+n+;FUqohu@DC%qQ9_udo!IfS1 z*I@mHmivm8)KwNA>yXc@^CtRPmE(Z?S%!yF&a|tq!B*A?m%YZ%5>kigyQKI9-sfe$ z(KP(#?+-iH_*qMUgvTYNz6NtFLi5@SGymaO<2P1Og~uhua`Aato-~bPe_vuBkbfpS zbr|7sN%3j&c~$Me3_bQRE7jJrhdED#)7}+|MZ~7%z3Z^Z67xWCo=pgVLHoIha9Nl|gwRgEA~570&OODu#BuqjRGyLyGS(+9;{pT$Ic` zsQP2MmcmQ~1lbc5R?n@hk1?mPJxwU+7r4&RUKhX(YGw6Rc$biS?=NUY9tc~fN=E*gPl9y89D7L^YkfOKm;2DKn zgj~n1oe5KzHcuJ0fl?zgc2~|*H(b-n8?~@O_AX-O0ruD}fcj5tu#>(rZ9%5(>t$*K zqx8CkW$AktEiyCQvChGSF#}YjoVWaRuXLxhMDaeNSrA30Gp`*{XWZuG_9=ZuFm6KQU&4dp!Z0&=S=GnZVV$ zgB+{5ROFLzxf*=8TD(k#;wu=(S2Jxw015Eu)9BglSnC*atd>+*kH_ynEWd~=*dv)Ztxsqt)bvBMfsPXGagu* z!SJ92JmprK!_L`CuWMN-Wu61iL5t6%cWjR9Sbg>fLx&~HPb{EGzx zWAZs|b?aifVGiJXoCkoh(=pyvv6vnAgXcFEpGik978Z%5`XS#s@Vu1HmzOur!R8^~ zPVjt`&Nps?(>vii03OWsi80}hFR+FhiarXLVHS^~Sot#Ey{eYsM!+{C-M@)$rM(=E zT?d}q()rLFYyWvY5%wlPk|yJd~r6avPhM=d3W~JJ20p?gZBgqeszG zjt_b~uaBTlYEO{zFL%7tzlY%V6%zBHHLl^%TGf{cc{vocOa-og2hS8fcrd2EP2jmboi8ufRS(E_4|sl&&Nt3oZsdCcJe$(_#!ql2 zLx%o;ws=%bbUny%@zKA7;2SVfahY^X%yHE})`KD7nUv0#rpuW1UcCTDjcHjQt@6lqR_Mn-zYud;pK)Fb#>6jwtn)GVOozkQ;JJ8=;_Hix_&3qL8h;+> zzXH$ERxa4jdF}*ffq3B`E5>*$GNvAk&2cT5`zib@2G5>!zTAluC#a~%FWZ-|z|&ym zs!7M#@vi0l1HrchJj>Jha@}e>J^|m4!E=WdX%oNPiLM1->^4?{=Shpt4mW3_v!2rV zS&Iiy4D-+VnnWV=_2V?Y?$)i5?_dx3vcTtawIm*_Gs_O8hfBW0d%(w6xubf(HyC`u z9`Nyna(oZ?SZ?7S@bR_wk{<9K1-_X*;Nv)_wg-F+cS#TU81C&o;A6NC_JEK1_jnKZ z_@cbFhkToRz?TjGUg-fJ#~1JRfNv1^zUl!V+p%m{%hY{+Cf_MN;5!n0lX}QEwFi96 zmsvgFW4_e(fRFi-=m8(o@jwsx{<{Z!82Wiyd&u{C5BOLfpY@QhpR-|yTzBmipQB(8 z_&5=`}d@+DrclChn%ke$rbHC|!?;qRKi+kW7`Ko)s$JfQi z9`gOP2Yh^uex`?fJA26Yc@OxQj)4XEahOAu$Cz&T#!Se=sM5b`08NK2S?a9SlbSYpo~rArx4lk}*=2xQEMTZafW9^YGU9Qj`9|FT$9UI!lixL zBlxA!r~JtAR>+V_EdZ^CJ9IuELeO?)GVQ$7OvFtoL%=$#=2mF&YYn&U_Jy0ad=~cZ z2&}oRPa%#D4}!^Ynvk{l5(|&8e9%&nhxM6Fn`R&@XKp+lv56s8emU&FK~M~|8wLFU zNM-2bKsO0(EzlxC?Z)*Zpv6Kv0Q6l!z41$x-B$H>>8qD~K|I$V4R*w3B=VrowQ7&I zbz!fhf@Vqc)0JP2KDx!>rL9AZ>%XmIsgehhpRmHi%Pgd@1JWLSWpK(rugdD|}RZ%6&`P{WN-+T0R38CtFV1{eH4(y(I^ooE|iq`iZmDj$~z$ zW~KROuaZ;IT1k=Aa#$j`XfO8fK?4F5o$1PVhyqaLRz%Y- zxAr*iX;2-v;No=RJq?_?tBKIj8W^}*xg?k>r!4O+*+W&&_BdTEri_}}9w*6i&8W2P zagr=ocl~XT^WJiDSLOCN?=7eFT5YMt6mnx5tGJz>RKiug+o7LS`GX9gOCWnuv@nnz znw9a8+nUBq#n%slDi7BK0PlDYU%Gn^!fW@#QSStTcwiud9f)8Ze!>qwVrOeHZ13%( z*jCY#wW6)3DOgR0J^P1D$a3`gqJbH#R4)muJzs@_I{ zRIRQss2NDrQBLftr|Azs>S?l{oOeJ|zIYJ0LR5gKo~8*v>S>w*r2J#cuAU~wNQL_t zkb1IPfz&g^wJYiw+5x1Vp?yHg7oKF!l~jHY6;u2`kb0WXGhm!Je?(61zNW=Fp4jQ~1Uur{gGdhZsQw{!33=fTp-xvmH7-F2m0mZZY!9a7b z4AAnCnPZUTm%E)8GpIclslx#)I6o!XYc2R3!+eP)#!ZKcD0lJk zILt=wiNUFu(ktmxF^9ve`(5E4nwPIzKX&n2!}Sn|9IOWmQ(=Fh6+vvG?A_3RUwEiD z*1Nseay)(0Zr3|{_u#(u z5isciWCxEo!fA`r=yIUDLhhfCX14KbY)n`ZxUCVi;-t5unQp8MMdVzHyHdPd;r&O| zC>eQmr}sW@y0fl<2aS4EmMrykjm*ei2`m9i`$VkjANJ;K>S552rS*t zVnj_~#6AQru4pYu4+`h?ASkFYO!KoOnPjV?BKaHfNaXA26GgFV%EH91D}78H#cRDB(tIhhmXjAR^f8>B_9!eWe^P zj;1VMu(nE|lDuI;vo>Awr3D*qe;`%2aRW1wZ!%#SzKTq8bI1Egkrd3o0qoLdt?U?p zf>e!KU@6~8P%EL6@NoE(yASy5!a(6>$|imWNAC53@0P#JYc{K?hW#CEKvPff!RuIz zA1Soe{ds%6+&1nfei_Au941ydQ3_;og7HBJX*nVJa5?xqJl8)U#kBaMYeve0WV?3vPhPaLgQsMGUa@9#*1EhNSn~m!a4YCwpHGLRj z6COebk8wLSSi?V6soR$k)9|51=dvqyt)4L`X=&JvX%?KFT%2rG>@Aml<(POmR&z#^ z;tiUWhM?%F>^yA!dGJq{8`U-H{y=69Le>a@?^G)DIi2)#Njk?0YMy|}{)NzH1FaI& z1f()yIgl!9H7%znpxAhLnhy3}GPLR7VX@PI8Vayeb4E!rJPl7vaOTFQgMF}@{9t~= z@RDTXG_WhO6j8UD8c|+n}X8-n2oBnk6%XT@D=@kvTVw%NRE3 z6R&gkIZw2XfZ0?TzANw;Yn+v*`)ZwTX~Wo`H8UeRU$J_DoBpJF0Fjbm19E{)`&)P@ zRl{UEY2Sqpt#vkhQf*_i^cqh?CbQSzK5194K^0xnYuu*F#B?0$-t--#(Y~V1XDFu4 zA11UgwnVE*WIU!?HFEouk;n_H`}i2$EMysgJq~z7`d*3Z%XClc=${dq?&xvC20MBw z!p03OZoY81JNgtPm|L8^ym(}BlBXj=-)(S%O$8LhtNFEJZuFc?a$xCj6*t`*>zUe)zM!**HwoX54Ww2PUWmk}7oi%PsYJD@ zI{dtIY-Sg>WYcQ+i&05Vpjl8L+Z!0zcpv-?2eQN2z-(-YgTQNnCE*?Qhy>(gG0HY9 z3S?U{1HFJsWFW+|MI;;;7!E4AvmqC4X>>;q1)QD=Glb~}f%FReYz`vbu@{=DyMJPe z5Y3LQa8CENd-lon?Z-W4m%e!3Ap@6AxdhI`;q6VZeo!UVi})M{0ig{fQtJnd+XO22$NKbNSce%D36~Ag{cwzNU-b+WoN|(u194wy$+@-&Rh>CC*k<@AqOGZhR-}(k$xr$ z6~laAI0H=Tix(%Z6`E>LT11-GB^XLWHhP2n#`Qtogm8a!d*dCzj1t>O4x<=IN~o*6 z4LLZ6Dk(P@c1lDs5V11y<7n#geECG#w0<>YJq>N0*H|!ioS9xuevJ3XhRMQcdB3Vx z!#LzimVRWwDboxM|ck=k_7*D!#&+O$?ejq#9M z6>Vn{W?D(|dpOs)4ubj{l;ewKA+?s^qvW5uq|fHJEaX9IGW_;4J7O2=@v-P!ZkQx) zi>|@)(k2|+*>FaCoLTA5;Txk!KnTY!#Mvs$3EYT7+77nie}& zVCe2;)HyDScJ1cc0Oqk@wz9K1G*QN^V^B@|A>nvQx1u)<0|hA!6}>P&{5COq6D4}N z|C8uRTc{@gI7~YUk#R%;%6m~dYKS}lPRn7b9>)3rtR|R>sIG?}fKj0C9G#lqw9e$H zYKb_3uA-gav{-Uy`Zkk1`qXIv~X8@576m)&jDJ>sIC#_I?2vK9+rjUMyMtH9)5=RmLVMhelQR_#3C(FG ztUFH}PEJo8j`WMHbUA({C?^5ke3|6_B?rd?EWW$w6~@mi*6GSh%x zRBTQ?)% z?p$e5B!{ntVC8yxavUX^mVQfs8Q)!eSxzo`20vU?Vi<;_Qg#!LqjI|Z>{il|McvBj zDl%GE5m%ZsT}|D$s+KLsCe~?qPs_%dSG-Q3Q}cM@uuem|(>Uemb|^Xe?vVF5+U53ky2IW5C$2sRE|3%d%IhAU#6CJQ$@ep)sJS{&9X zHx&0yLpi@?wR{lwafbzz6M}fvM$7524i(QaTEM#M^aXLRW#hn3i(5I3hgWTM`hp;Q zlU$w_u&z3u-zGOcO-{!%1bTXSrf}hww(e36Yo_eC$#Le@X>>e8AbwMLXFG*}bv*ez z(CV^`13S$m=MAuy3j%AoIIz>=*62SVrqOaC;B-0T2)8h-(`dOki0SDgjh3cJUCgg8 z_c$ouBsaxKD4_H6+vMhUBgeP~VbjwW2aT3yp1PP{9nTOb>2l6|nQtT%(D4j*BNqpa zmS%yvm|ray0_B^+TWTZ}(B;55rRS$Jo{2O$oxX3AOLimYC+%Cpdmv5D#1q0HxY3Vz zn#HZ0hQ_NlMh+1UfvDw7+QKb(yR?G0p`#5YZ>?&BAzO8aGKXITCY!Ft<#(|v{x1N5j{IyLSFl5|XTF@&3I>OX1BYOP zu*@6!5l^$Y^^9ocuWjOhAkg`>m7f$0>4{ig6nwt~T7;=q&(!3JRu z72fHsaCDeBaESL1;8n}TfwcwnoYBf(+r$AwytUdhEhmv+L}+2gw93W&#DT==Tf)m} zH6jAy_!YTt32)U4hmb>NhTx>*87G?~o{x1S7b4HM$o(=+j_tF=^IPP|cfat4@XJw< z*Ru$}9A|hvtMU6YL3{A~sGuOcT_tD+(60n72l{V8TY$Kp9hY9}>@Ke-AL#c&<99fY z47{FIK+g!;4b&=VD84Cd6vU(YHw#JtZ57lC#6)^MT%-Jwpd4i5c0pA@uL@cTv_sGi zpk0Ep4}*#zK~bQ$1;v5h6|@%UeL;JHJ`gmrx5x8OL9>AN3c3&IQ$gE+_6f@BgTqh+ zg@C>ivsbzTgrF@z0|oIshe3k!frbdG z1v*C1Dxl*9?FI@88rlzy2=UeHRQd_g;a z&K8v2AE){XiUNfN#eoV1tpz$?&|V;Z+46cuV#c5A^Squ}K+^=>2gJibyq;}9mkY`| z!sEG8PzdN6L5qOO1g!?TPLOBdGGEH~UN64y?m~@u71Sc&V%SpH`#~Fy@_roGYfwKf zhV_Am%clxp&w&lY7Qq(7mcm{Pdl~GNurp!HVJl&)VHd#O0NVh&7#80RJ&mxT>Gu(LtC9&*Q{<_?EF8Fm!xXxLoX@vsH3=fH+x zi(rdkOJOgDy$tqBScd-w{Hg@L1^#iJ=+6<(5L_3N2HObR44Z^)fxQcM1?>H>55hhK z`zY*Vu=I!iKLxuE_8HhV*ymuW!u3U5UxuBJFm~elChXg=@4-HRxZDf+$H1Rkw14C3 z#Z$-SHgkZt!_r&~tIjM{2#=3NLshg8nm`K;GKlj~O5!+!f(DH+Xrw`B7?fiWXM2<{ z`36lgC}dEfK~aNB44P)pr3TF~=o*7&88q9VDud=5RBKSophX7VY*5^wr3NJoy2GI5 z2Hj)OeFi;X&`N_IF=&-Rj~lewpeGGlYtSDIYBgw+L0b%Z!Jushy<*S~gWfP`w?Xe3 zw8x+i4ccqaX9n#z=qrQJkXfbAuZ~vzGpN5o{D`Pr*`6yj)S%-G3K}%Rppgc#?N+im z2IU#V7F)SaGALva+iB$*HK@cOw$94+QiIsHE7~;%%`%9sj&iLsXud(U2E`0oWYEn9 z#SL0&P{N=)3|el`JqF!p&;tgoH0Tk7RvGlTL8}dV(x9~l{lTDCgEkqo#h@1q+Gfxz z2JJBD4TE+Y^sYgB4EoTZy#{?|(0+ryGKeEARSJHCxDHCu#-X0_dEidP^KhLEdp_&} z*c)IQU>C#Q0^0~1f@Bic7TCLBSHN;)_#o^_1^YhW#A&0PMeEyWk|DSdM@O!w!SxC}%kAap(~^ zk{Jz~3%ddL%V4>vn;l*uU>jf;!`=eh2-^&s zgl&Pn3$`Epjw4SV1bztiQP{^|KY?8bx2JG@1K02Sk$&Jfu3K?^5%y)+S7CR;z6tv_ z?0c{su>XYp81{461F-*wI>VqGgYpc@ zH)xVUA%hAHiW*d6&@_WCHE4!G*BCU*pxFjh88qLZT7#G;w0?Q>QRrqviyO4mpoBqp z7_{7=dknhIpa%?EY0x7Etup9wgH{{#q(N&9`h!8O25mBEi$O0Kw9TMb4BBDP8wTw* z=v{;M81$h*dky-`p#27YWsnE;JBB;dKZCLi>TgiCL4yn$YS3{81q~Wu&`5*MFet~M zJcIHLnq*MOphAP929+2z&7eySnqkm22F)^Pwn0?}%{QplpqN3647%B%xIs$|N*Hv9 zLCX!g$DsQRdcdHS20dcXDuW(3XthC48no7+KN!?%&?bYn81#Zc+YEZepdALiVbE@a z-Zf~CK_42l*Pzb~+HcTT2CYqW*qmaQUZ;H5Bh7@QYu$2$ci!>fmdZxvIe0)Qr z@x%JO0m0~D`gwNS8tgeYLgV)YB|ML3t|G{{eV_Lv+%abNPak-#t=C|I;n7leW2S)y zFG~n3#9!E8Z2!HsUW5A$kCvLosKL;|=RIC9#t+LcIKtLzaJk_Lik~SAUd4C|85%W=z4pk?t-_9>kObi2avXsJ#n111~R=dD6v4FUS&YdI4Ity^)Io9xKDb@y>BVm2s#r%bR;NG)OR5}ZABO_H_k2LA} z7Yh}JpPzhQt}upYN4gW&3x8f2t?Yk0I2mtxWkhILDcLNjsW z$c|>PM@wCAQ5ZM3)X^raTEnBIF0!6(=C{u~ieAF}{K8*8JH$v`W_YyJAdAAXwZnS* zAKpzvjnpxQM@#LnD8oeRWc)HZTZTo)4>MAKGdx;qH+X1{f%SP$#4n}xO>yVZ)=tDzPXhWk{W5q%JW$T8f*< zX-2@>`cRG>dC#N~MrwlL(NgTYX-yvB|MMem#GNXb{rUGe7@N5==c;M1~jL^`n;S^=Y!HR zbI8}H8L9IOkCqx>QBD`BdHjW)ec=QDINeAcWq7ny%4*fm5GgOhVy5~oT6^CaMvAlG zG-sF`>t#JDqe1m~`6Y=`Z+QZ5j5bnPhDV3B*GlP`BE|lKxiRr4j~#KQk=kc?wA6O1 zl^7#Z?4c+%sO`h9F-B^K;n7m7Eq`)E>J$7jhT(Vn^v*F-YYb1&dfvBMlw6TwU&FAD z+EjH>u914l@aV9Pw^BM*q&O=>v%Y*l-dH1blHsA0v;L6Z=d}{x*?#kB4dX4p!$r| z@QHnIpJ0b&C0BS{Vae#o%aIbz9`D27pJ+=lYB0j%lFA1aqd0NJVW!UxIxgRqV$@)S z$0bz&s?W=@98K}ty)G=Ur5H6B;c-cw1**@>8bx#UFL%FrmMz7o!3d8_it8hNUXC_t z-uvpT7tgk(7&RE-aY?b?RIMM~H(b@ZXOb<&sKE%2OX?g@?YD^w{&3!H=h#xYtlMh+ zq+5s7xgw=wxc`x%e>m46r7DN;xWeKLq8-DxdTqV`JcpF39Kz$03W=0{-?`%5vWwaY+@56i3lCmCJsdEObbz${{>1sUqW1*Rq>4rANQ%HriZs_1JETp60wbX0xE^fQPA*Jeu@VKNd6e*qai~hED z|Ah`IRX2pkB~>C)I_EEY_wCzC98#)o2#-suRHO#smu61qvIk2YQmSqUk4tJQcH-yI}buoB- zUM*EJ;-e=nwx!0Yx*5x)&LwHPrDu&E z{3LJmH4Z6NH-yI}HB+PpLO4SYFaY>bl z)G!7FQ&=^ntjr;$>W1*Rq-KHFt{XpFnVL1rA*Jeu@VKPPT~dGC|JcBChm@)t!sC*< zPNZ~=>UY!AyRLIcsk$LNE~yHUIugG$KYn?@sTB?>RX2pkB{dtocDimT@${SRkWzI+ zcwADIBBjgg`CAqpUTI5Ns&|CPB{jz-_1BZH`tBTul&TxTR;c-b-ip+id54dHP~)qvL?+gx(>`S;b>QkMQJ;c-dTiqv-) z5X>iUr^eMfq*UDy9+%V&;PrX6)J0GK;Jh0gQmSqUk4vgfq>f`iFh{Iu+g#_6QguUk zTvGMm^?9|_?>>C)`Fe+xsvE-Nl8U*cRuw#STg)M)>W1*Rq#8s@r|Z&%oplWkDOERw z$0c>6Na?z9#mA|yZgfbgx*G@&m_?4TRE-iIac}OU*cRjB^IA8aB9fP-@6~%c zR`_Yp;GlT^WyP7Cy*!g6k+SLx-Ln7eo9<6}24zhKWpqYZBYHdiQOZc2l*y6l-Gu&5 zhR-|#P8${dpSw~j`bISau8OBMBR;=%Q7X#k&#z&VZy6=E(-mhrJ&+Ol_cJKlT=AjQ z+ZmMke$tic<*A>i)TG)JqVqG-{&9vsLo#?A9$RVub4CogHdY&z(x)?g{KhfYYv^Ri_>{#H?X6yjPmF7j57UcMp)-(q#{2f6@Sf;y33WTsPnZA^;J4> zE9V0lK7Zwk52O}0u=}-)dUmQ8&ejC@1D+ep=QmVpl1kSlE`R8DP&o*jf~pr(a*D#0 z;o2xlAcJyiMoN!z<#V@st3^q%_SxgvkNQrf)8oqOD=X?MWA$aTp})GWW-+N{^C}lp zQ*|BGGFMjCmDS>2xS_wfvSMCYWd)?_ZiEXRlxF0z>C;Qf=0e4@NW>P@I^5*rDBUWm zYpWo2-D0%7v!N$j)Lzp;0-Ienx2~q4)^?_%=4lreUFlGwZN9UrP#GwdKBKM3RnqlP z$6Oz?B1Pv6Ckd3ws8wjfF5b?ruCFbRRaBLg&#$bDd4yJ9xp209UseH!GH9yKMNX7g zFO+*nSd7Y{UDI6s^U;et zLaleWf0G;2h$3?a>=ZqOlSB$nl2rvDQOA`VBZRK1MZKyHrev)9ikgOn?h4`zF0Jq# zX>gRghxMQuRUAdnVr89BIlrL1exCMDqQc5pS9ybSrIzt}PthfppyhyG_qw{8Ix7Gb z?W&rZ`bsNBmcJDZb=5KJ;hF7p;xM7?rt7L}%C2jeGpDjnRj;~Almh&?2~w5ay3|#c z&(;o%KUBygiVG_1>&xd>mQ}$Oevv+|tYUt3<-%B1B}NuyRps?nAfSj{F&2XOB2S&x zZmu2$i_<*G&W935bCmH(l;V{K2S?G=me-XpK(?Y$S9Qx#nyN`Gt5{I$LDN%*_|BJp z<-3)2HP8oNjRt}_y0FG6T3^)=n_Y9$LMbq-XrX0&QCV$WO{}I2Elz!PjdGP-=+?!m zpofrSy1Vz$goo$)5aD&}V#4dzRl>_~VQxrUBDGZ75-T5EEn2#RgWKtY^(tQPkq2l~Q} zw(=%)w)5vp>C4lGZX#A$x3Jt5h&&P9IiTm6XLVDk=L^x3uphe)@OpwF17B1uDA|sbqt{eV`s^zAlaG5mUu6|Fh&kG=y2=IUC#o0D zbp}$4PDM!b=ij)19R{kki-DEK?km;cLJDejjcO`9swptHj>peVfix=4aO)~7YU*ZN zJ~%`aqjZ)rD8!HuErBXGRy3JE19IGo|SYJ_BT^m!QRcD^d8yN|f zpxkr#S5s@4bITk)NMmWF?7@$a%pgSWW{l4%D4U8i&XiAbD-MqAlzY}0lx!J>6csuH zn8Peul=i~%SObPv%(}9L)w8WE*9V`{u+AubcPw3oO6SVE`a@5fy?U`=AKz`X3cfij|t`kZKJUIosgF&4$!VWR&mVgH+z|SOB#s@ ziL#(S9Xhno}5|Eg__+mff(}Sw4QlgJ!fjZ(ZsXkh5?yM}oz6CfzC?Z6Aa#r!J*R2ilXQ*scOFeh%_1j& zdN?ePaJ01eHGas2xzU!#N5tXa)a4g#Z=S_`f`OWtmKG0gEVV*B0D243Y*C{vD?)G# zujO~AJrp3rFBAh^xSzvzxDyV=6-V=E>ICO2;0u|I;6j@Qy#p)5YxzcFT)D3}9Qggc zOk%X9bfs~a=n`v96B`EC;+D&!x%-NmyJCmoJkw5pX=+LcUbGr7KEq3u6&r-SJI#yN z;0iCYA(jQP-A3#gIy61I3NiA;&I%-c?eK;g4j*#He>s^`_mVl9>@a>T207gH>`IV5 zu}Oghw}jYH35M7H3=W3-LV8khFS!wuprMZ=9r_7LM^%9SuNAW#S$pSEa1Z0GPL<)X<7GQAR+5&k#$w@ zgB-@+C1h`U_5t|jiA4g58r++3R>VOKuYDB1MqnyEtGJf};3I=^;sgsyVl8N%*gV^p zmADVD{W*ROYnBRzF5SoZeYljS#4j8qEOJ)VOOgk*Vg*+8XTgXBY{SI^WlTDYRrFmZp|% z5gunok`gthja<8u!U_KHe|8*%e=rq16E?8rMWCpMP&?FB#fLK>S|m_hh45 zD~Z#Al+WBprD#<4p-_`?ebUgV07Qks85qTPEE)@i#sYCR-|r~|Qa;xh*V}=VEOjL* z3C?dS^dXRv=!F)HZLi;RG*D2`i9o{zsY9Eo&{CbJ3$3L4;o#BQNtK@0I@7FI@$h2k z6~poWd-WmXsE7BoLhb0@VyYDqjip&_&jNKdjEOg!!BNXN82BXy zjB}7DMw|CF3{({jf${O#2|uE#qe?3_LvP6rt)&DNJOKyXy1JFv64X^XAOog}H#kds zUbN|!Y2Jp}w$lvD38#`nTg?ombS?0s4O!1OoSW=z^X+xDQ_!2%qWhJ-+VdmO2&x;z zHij@tcZk#JzG%w;M8uO6@F{T4wNy+cm#u=6 z?bR&Rf$8|N$iATRhg8ulmS5rn+(7f15^Gg&?;s@9cPiy)j7VPq5gI+e)wWyCbLe?b#XSLZju5zSGE zUQj2X`8c@XDWFeI`cl6{c$;|d3}BJ!;nE|#C<;AZZ65>!EAY$(nm0qigjKrq0?}^8 zMMs;M#*TKYiMFHj3oKm%Z%pnYmaPyfX|Xyx$2jf^2B#m?XwrukFtGG)5|a}3B-@qP}KpXVo)<@4qoohIoWy@g)0q`gwM(Xtsiycd>=&A(|Abf`Nln#1`VPD ze^{Cfqj%2nYwV4C?8Is8jeC0)K^FS^ynHV_5tMa+}me(g4Xi#iB?*A!^P)) zn7^?1o{?PETSBG4Iff@_eP$YNQTmYI%Xdb;Ctk8|LeSp0cdFr`l=J;DOQibYmuBA4 zkN;Y2+;c837ann6Ex&r>o^>OazVaKIQ&}E6Glzxip?*T&AwI-&i@Y|fJg6Q<8%4P? zgK~~$z_pjBdhF~n&XH&$K9+U+q44{fL8N$drHdj{DlSUq2You%x_EfQI-w1h9CY{5 z|Cbr5sLY_0x+wI=`Mp#5?AVKHm3v>86yx!#jts6U4=>E1u>H`cm!~XNy`XXepF3rg z)Zz@E|DhRhRXiM0Ytzd!du(-DSE?r@nPt*k zuOlv;-kM%CeR}alQyri5oYYu##XNlWXZBj3L>9;J2}aL*T_<<$4>EM)hYrm5iX18! zKS*SLbReUd&{cC|HMKE(PbgP2Vr4ZIF;33K>N4kM86i&TVlKD7jGr*@krET7&Zyhd zgO2$?Cqw1JikjJ&G{xtn^7>i?5}TvGDV0gRQ4@$PB!`eSFUZHpNo906k=T$6g$ve1 zqr!^L3BIxhgn(+JdEIF>j%t>&I|0(Vmo{Mv3uhFstBF=Vh8O8DW>;#Qj2h<;p`*UpIVR(@lz`U_8zC1i6e~04`b_p=UV1;i&e!dW_ zpPRum5FJ2^)sQ2}7GI9bzsaDF#;aH@U&mnh5G((z6?#I&A#%8W7d#K9^W_$p_Li)( zV1EIgKGqB+qM`g7JJuDyvp_!?JY^Q233ptcTAv1Ynnu`a@O)tLv4xfRjUDd__h+CV ziT9@`VQCCsZVm@D#`HlzZ-D3T*6b*IGVyQRSQp>vppU~^(`#XA?D)B7P&wkM0?)na zd}G}+x8z$1oiIz`NNn%87k=h$&E3^8 z1ky#h@9OC1?n1yTHkKsc?)W!Zx=K?Mb9Z5i!=6@8yaNZBp)K8wl($;t7+Cr|=xRn5 z1*eq0F%`c98TWeD1f;}DlJxX+?$)Pqi<%HvdONPg$rp5LK)RE228ck*E%5U|@^uNU zI0;2?Z6-#G7KSlT1Me{DX+HQtZ$mTbo(R$P+oux}TgWx~fB{phZZI?RHNH{aXw zFT77%a}CKI(6Lm-c@Lwrjrs9*=i8P_SEOq_8!%lY@Tl{-(?DQb;+He9*f9A$_u=dvTW(G#1} z9v1-IylYYag8O)8L7;gWes#;i=Afw!DoF3V4>3%|hr$grHNescbWF#6VZrJk2!ZCm zi2uu^WlGg%sm7)0fN#mgbHtn(IAJMRBob(4wwAW|j|lUGO;32#Ry|{e*snhtBq;M@ zRh__KrET%HsWztRfdA%an{LfPfSf%G$Ik`&j-Xq;fPCu?$8YTgn5Cc(kPjXvsX(BK zGBgH^&~mqj*D}CTYx>SaJ8F#NWrn7pB(GlfqG-Ht)JM6gVLcNoHym z<}r)C`_of_B9MgKdV?hx_HHgriWj3cE@_ucYa9~aEf*lQY(UzHe z)I^~}Q6rii%;xR1s!?F+`%G9%=^p#}4lHE}2iBDKVJ%7~SY1+=q5Kctc(wK5vh?^& z>IXNxb`0*I29t-5N_MYjt86>>v#87g30i9oG}U%vQSLs~m~E#XHR;isHu!aQpPZU0 zl{zWKlU&QHXfkmTYHvI8ND9y{ekr}c4~mdW9gFefh#lX>b?iE7QU0eeg0Mf5)W)ycSB!jB|Xg6{zv_f zoCUc^0uaxj{I99)>$MySH66&gsXsJqsu}N;zfm!(2`3dYzh4ApWFnP0+O&?(zXvM3 zEoFt&u#E2Dg!P_~Q~+IYM?{mqC##5c_S4l|De%@h38zW4n6DQLx&*(pT2-P+HyT0c zNvD6}f8dJNz(DmR*~L!fi&k=-emFEl!WR)2y{RiUL{r!1Lyuz=@oyNBcsbfK>BVRm zM+h>3(8?^VOdFb9FeSeS1&zyA=_D~U83{RR7lcji!k6eb2Gb)+P6)r#1y$o$74l*r zXCZeJ(ImceT$^v@{P$*g8Ww8(p)LJeQ}R)xX~VRr_xaqdUo6`T|8SNQp6bHZ8PPyd z8xoX_2P7*aK>;La77|pY3TN0MlVB2Qr=$vjsFXATsg&FeN@xsJQ9YS!ns$<*4#Rdi`4+nX)0b)tMudV9Lv+^Ss6U!g3cNS{rA+xFrpVgZ-1*J2dxp4?0r3yX*q_XQ;L;IbfZ3R+U zxC=;S;k$;$rqq$Gwx(lw8u~(GtNIQiPeX4<^}iH?nU7HF2GsVcQHZHeY$7%#YRU1F z<~PaBf?U-eFnN^RtPDAsZ036bM{?SZ1E%Hu=(MZm;gu}`Wz+2$4%+F!T87P+(^AfP z|G&W_=|>DJ+Hj>|E&ESTWAl494M!_J?>hd%F5Nu&HhUUdpHSuZ1g+`1#~3vj_PRbV zCnJUd?QVYZUV9q*H-<+`t+vAAoQ2QJsflc$C#v&~vZt}xYti&JVa>ECeL(ejC*zkM z-?L@dMtd5&!tm&@?y)FYB6X4_^}&j^4Qd)21kw1-YnBPCowqQ3VSV0N{DrN%_{1CS z^XFa!g{H5O;uAyD57y`9n*(F$jc(p+pFj5jC^Y?y)YW8y;fsjR+lXJ5!Tw(zj|2BD zCpn!KMDXZz>H5HV5TEyF_@&f)Ykohizmekm22Fn>r6*GdfQtQgaA&@}voqB=z(~!b z2+RN@6}J320#u)uwV#CBeW|aGFjD6m9v#C)79}83d=5z1ec*S`28)gR#zjjN zBjAFGNi?@(C|Yf8wUw%^*!o#*T|(RfC;_)3E_D}`TE?kXZOf*T|MR@(o^$U_f=&5- z-|v5ubLY9|yzg1xvv2T=dxgAD)&ieDWy0iA*^Pofm3vMVmy!q>A1iq0`Q_`=KLZ*#pzjjs;GOaPJl6jr$>F(q#60Zb3Y4f9w9+ zujh9*BKazp&co)k(-LKu&#yR*w%fu}Hot7i0<{R=1oel^hRW2Dy@SZ!NWjS?t%@cKA!dV!j0*G{sCABncwKV_7JRlHBlb`%UN z&@}wL1}cfx*+1Aq!^4tKW<|~zHcT|^S2GGO9-sRPTM>9z0Sa9~!7%r<(!J16p)EC- zEh9W^>ImJiAwxvNesK}wT{ex@7rGGzY`dFhJ5UqoenpG$ut_L%!-spq!RF3(&_vlv z!o%WO=!O<~=+;30D$pFs2*Kmfd1t+T2eU9}GBzEfQMo(R z)0fs$ z-11U`_{-~qnL~E>@$g6dcSe!Brk0gZ%Q2|hz=2gfU{iEO-dV#5F!&j0K4X6v55q6^ z73I6VCzndBLSp@zy%;=B{>b-C2eLDG0`m6+C_W~hhkC3NIV!hl6r~Tdci3kl`%krw z^7ou}bnR#PC`WTULC0)S)k(TkC+JuV{InBv6!*J3pgX8SzXfZ*0x`#LQ{5vc?~eGt!i)n()SGulu$VeEt}tSa zEliCowy>QhH36ffn-jflUtrXTbB}M3KQ#{HqGKnf#!a)vP6J^!2{FQ`Y_sg8x~U16 z(cPRlC}NGzQI@18EDfM5yVVM21h*QL+NQ+l(paLY3(Q#+2ht3xuwn z^dX&)4_-w+Sf-;krsf=)SSW-W4*{P0gp6{Z6MN z+;DP>kD zriHN90-iq>vW0MCM~ZkA;l*YsH7}J6Wbz7jqWTgOnK!^>PcJ)UdQPE0joz#Ioa5o# zT&RGoH(<*}$%gXQ6nrah*-}o=V0YO3Jfzy_X|V>&PTpuxQcDsmF+Y+*@%A3~nUtzI zT_lawqT`DR5J{cK64LCVL2$-Eqd9SwE-Cc3uFSDWfPhYb_OUOKUnp}^m<;@S9DJ;z z`68et5+2HBrJy_T_C&5}1VETnh^n0sHADXBr^-mGko%9Y7q1lZg*j?h3jyY5pdM%& znsE{u%o{3E1l3?2|Bc8IzD&q1SM7r(Glx>|mx5Y_=t3YBBIZpMqNPBpB&0C8!ltLC zRQ8H;WyPN()@vdeT#N8B$dv%GB6=2IkRkU%o=ED)tEr21MesQ?kX}Sy|N&T!?l^V`IB;%Xv)wCV) ziE8@RHN@7}ty?l@7VPBGr>`YQvLq+po}IFrS6Fr9S%s6?YN+8Io9||^kd1*WFvKB_KNncB)e06rcoD zK$h63(&G|*Cq-{A-r0iqeYKz}ye|-RGv4P5VpER75%ArG_cB4h#hVSlfLy4|0zKe+ z8t-cbZNd9GLEq!e@+u&G6;*X`$b5z9oeFe=pfiA~1aa-SDl#SmsUl+@P_>wHfzgeE z9s=q>NJBE`-e!{h0=?o2)#U7g_u4MIF^j#>=9Fk;N*s@!QAmu4EmhDt%(HT9bEY5b z2|K;p7K}Spqr^S0sq))N@VrW#u|O(G*v@867?4)9%8jH^bX7pLV#*{@=*K{w(iEkS z4!LB{l=U{^$0KyslcI&mR`vlx#;yVX*{-Vgc8S)1vWs=n3{(ddkQr>1o-^>R(vvBz((Z@7%y72zvP3qb>W926H2;@g);n5FwQaqGjk549 z#FwnlP7heDBDPjQPfh-!;O#(^rr0u;KI>b z7C~5q1rk?37&$js`%9PJ8f7@~y>=I4yT7E$@MKNDr47xmzD1MA$qI3a?lMYgd6$dIHz) z&K$Q2%W!S$nY3Qo1Uk%dwFaCuM}=EhrbVsiy~6Ui2+Jp88;X^OGiT_`;OP^1EA~td z3^NA{lj=_B(#Ua|BB>T%weLp^L|~No3it`|KPSW0MEyDOo&9Y`he zZ;albfRv~-11V8?9Y~4FCqPP64n}g%!dJk@#osF72LLItI1NaN1v}cxS0Wbe%NnWG zba7)hJ{j37SYW%V?b)RT*wg&wY-dp|#%54Uqn#bK$!d1DCUUX+pQVe6P~>Nw19=?E z@j7n9((!>a$+cQbbTZTRXKP;s4y#|C;gQz0sJ+xMlQ*uI2O^p6*a;ZOy?zFI+fb zjls&Gm-Tuy49#LzfnRI5GKKXQk1*hDLM!$=1oiFScOg zO|Gkdd`S;yrO{eLqq)Aeb$a2~Ii>&A?T6HLh>!N1d&=R4Yl@)>NuEWnW!A-W1XPxv zlXHyCYya_w`XdY%?@#A*gmH_f;qajxA?CqF+4^|VeM_91F1ZYyPp;wOZG3!=gi?17 z(mP*oE3Q#DUFzMiibne|kDqvsg39vS!S;O`dg?>xrpr@=!lv=8Cp%iW;6d}Kn=aj} z(1gar)law>IzI0Xd1O>Si4D11tw8Atjfac%gL9kMIgxR>>ZVKK8lt#_#=~{2hwJH| zbiGjBVkulh6_?O>xLBrT`B|3odHJ}vPF1&93fC~DD>NRi5Dc6<$nL!H;Zs9SxXw^q zLL=}4JH7e~mv-xs&;OF9j&DD!>sHuYq)_6f(@g2Gc3f0WtR6+8KHbTj=Zcv(B0H$0)Rn~|CcZgCOZ zta(dZI_2|mJhe+pSvkL*&BHvQpauE{YGNEkGJD>99fp0am{Igg16LMjk%G^Iu%pew zF|H}ASSF|Xs?*-31)Iln3~VEwdmu+r%y5=X&YQJN7Pl?qL8~}s0*9pXq+w{cIU^NT z?}y(e)Si@-Y~wdB$W)8v=pB9Xvud-?7!&T`40*dj-+`e%|9QXM4DEgmaaM(~lRh>F z3v=#6K2X;wpgIWy$%r>yDAE zNcA4R(I#3YUFDec{Vp?A3mSPshv)oou}IF``dNWHJNziFS5Ui@yg`oS5%bao(G(xj_Uxh9@UY5 z5;BkPm(sIdb;gVZI3Q&y&Um&@F|lnjpAu1$0y7}oIG@;A3~GN1g&Rw}C?BempIJ^; zil7jp_$H_ zm$x|tTxFmc<(GHFWS3n3;UpMcFfnmVm|c+%Uipbu3o};!hqe-r04v zLxvA28e-PfmP=v3@H`CF*wwYfzv%A&^?$OicIX*)gIu}G2E{EwoFc-$Bp&{#^@Rm? zvskoc?yv@Z9lef|Efb*|;a%@}8T9+2uUN_cA|BS7LN}b)LeWsi4T7;vuKi2=ApmbU53*FFsPdIkK;9k)DXrQ9wFodG> zo`y0E0sIm)#}86;9C{PFGra3%X}o5z&-Vrt9~0hT-qUFqgdL#iewvUubi=*z$8OTm zpc!G)QCw7bhYwer>K(#Q*rw6?LRUE46E94LvX1E5oZ7<HeGpF82+zGlvVV}1~={Ovu8`BB< zSYA!)1Rdq2yc2YkgE^g`2plj{~9mD%t zC+H|IZ+Ad<`VepV9D(3(2i>5NV8Fwox;STIaoci@>DFZwDV(RHaxDkO-8w?wMboZ=I(6M|e?gSm(9oq>y#&f)rbdx$kNB>RjB;6&Qpkut0 zb%KuJnB56F`tOQP(9zw+ouH$;$xhJG-Q}I2W4hhYNxGXlK}Y{Jbb^lV-r5N|=JPu{ zNq2uI=vZ$((n-3touFfQ*LQ-B>9MgBbezC>xs!CCc7l!*6?;2D$8a2R4qmROqw?3Pm zFQDQ7@Mzo%G)Bl|Awx%WV&7QUH%`&*&%P=cKODtjB|5v!*0$FD6oJC1W@q zE~2*NM_Wkm3%9Toxp7B^=!dQDvIbICJ<5vK>1s{dQn*eL3;1rr z`*?&U;9CuJf}jV0@&r8$#6>>=-{U|h3VIsoBtaX17{vkKJ3z`lx_h$d{R8L}K|6uC zU^w9W9%zst9%?sO5M5X3Odu{SYJZTAN@}Jm7G+DSVo~DeMCs0Ozv9F>sc3HX9u9>h z^6;CD-`@B|)=lQ&=uL@WV%2}lTCgQt|9*Jg_AaFbUtld&a3xQ}3pdR02QS>2IcWB()|YC& z^DkbKS>XBUa$hmXbrW>9KI@3&CEALvu14OY6P} zuG~O(TE@z(vrN;4YrgjfYu^NAq+x6bo7Qq9HK3gpyzzco&`^rY4<_O;yU0H4wVIE! z!a@+m0gOv##2QwvCTq8kM!eY!+(1YZ>A4@PVD`jda6be#}gx2JG!ui#gBcHOpM?J*EcYzc{A5w7)B=Cl|#y+o~PxzUzlHlk55Z3wp%XCtIHxM{dAMd-wlDc>^Ndo9+-Q;}RqMIsQjCSeE4 z*2LX0>)hPTPdi$@7KSr=^%}RO?!>iX1+D1-GIPW#-4U@a-G+n?)-6Y=0=dZGzOgU3 zL1cj#i6E@;CzoR(Zm{-r3D~<3h0LIcH999^P0Wqhp~7N(9Vl~VX3^W~*w>h~Bc3Y7 zWlswbsNy4Y5`UF2eH1BLpLj7+v<~}QAbuI8C&PbEGSXWyo?FYnJ;h!vduMa1GUk~q&7SHIP6 zlpM4rYQ2)li&@1;&0<$-HtW=k7HtXEHp2a=wJDau%GqcRoR7l!b>jR-Dk=*H(9f@tR zqR%0)ufQK$e6aRagc4icqSl+4V`OP~#0o>iA}$eI$EX_< zac7Z!{>0}@*2H$CXyPMy1kw6AjvUnvsvPns$szv(Po}wJMaee~E=Ji}%Uz=p>qSUS zW*|armZzdDKvGY1CG~n_(O~UkNMeK?fwDz9+$WIut0ZpX!x)6?9e5Km{enr{xHV5? z`hVh9JU8<|#7geKI_Yh&2aDmk9mRSFhZ$#1h+0!~W7ZWpk(SX?j3O>tMoU=>nGM#? zmV04djHUdLtz2X!ln8F9=HUW_Z2=r& zIVkaxn2+!xS~3G6poo(w;v{UB+MB~IVG(xipJ>r*iBWNDT|9-078yUIL)px4%T;;3 zIq_<&XcL@oj`P%R<-AInd*cwR%-!4sPp2t|ys*o95i6!M$l_xV&S|c2N`;}q*_;?< zstAZcSUJfIAXUU$NEgV!i--t>SXB{_fvpK-@pE%B_fy<16(_?rE&0*%zl0kpU+(q- z4}0b|3heEKS9Ux3A(FxkY}`x_akvEO{9f{lNb1tX;azW_xm!qEa4vCo-`6*U*Jf4i zJ|}Z*yUkpRxn_MARFsRO!TYvU9#oQ=w5_!NCy9e&4U;y-tQ@spfA49DUNC>H@+Fw( z(tLBKIiflO_QGa5#f+>r^&#nz!mz|rn+sr}vwJOA+YBqhtpkHfNv!-oZ{eFM}H8#GtnHIDkuUpLO9BRritEFK>Y+gYS6Plg+liiAnwr! z_;vxYixu#7!LY$ug8Bj}(-}tZCqT-7%?5pLQ02iGArRhcfhcwXU!6e>K%+$O4uj;1 z-mvP#Oq6XykFSPzBdNMO@l%reWj%hvHQ#2%QaO>-@QAewrQ%+0I;%Yo5tRDnDj|Ek zN`9_iCZwnUf+ZWn)t`L_*GjBppw!xjV_Gw(#;k=XnUkg&60^Q6NhO!LD(+~}_rcn) z!G`22Xr^uGKt)p}FQA;h-ZvY?Vz=4hqG0kbIAOdpTr^`)@)ZyTg0)+fKmEbFZs1l8 znLoygzDyLxi$0I1lH|{g2TR_<2?eZ7mZFT^Nw5Odc89*w4W#s3^jvhsf#SGFxbDK7 zVC`h+mZI$MQCc^yPq223d~W9Fgxp~5FnpGzDi%Y0sWqoxu(rQY?BwUtP_VW)K5MQI z_=2@(2`yr&ZfPE)BUpDbbkbkrtZ)ej`hh$)yy(kd?FRrq5T0P|FGzqerEeAPZ?lq9 zZ9DE&tcgNcq~il=xywX@6EW5mxp8YMDzQ?jtmD?_^cLd-k?c!PQ&x8g){Uo~sp}E9 zNpO4zpC!7(^_;l%23&#dJ2jKG9F?hx^_+Oa)SPgzSC_c;NqQIW15_f%dL&i18tz0a zbnc$d=3YH>al=&au6cCmu_ZN@Dxj^4*!TG=)7RY&WaEbw^kLG@{5q1#PDKY5y%U`9 zPG)<hNCy0NkMZq(X}wn*lv z*{jg;MdY1_3^K-Ur@s?N@A0X)^?EdQR2*H))Fp!=MeiijVOAKy+c(6E-U$b9-x$vR zF!^Sz=v~D5)@bSyv>V<_1Y*|t(sp_53TG3xXdzsq;U$RqMH4Cu!X%th-wxP>8@-<>MGcnmBynvsDqzTgjC+hMUYZ|#qFFaU%ot##bwd-1J0FIsfY9Rg zWwMDVKi1TMol#m!S=9SlN<-==k3R)y4sd1-CE5qvZP=TxyF@J7x^YbKiRowf8pdoH z*&}#cv-M8Z#~)R#d#-BFQNi1=vp4xc@QDpI&9B$&9T2{|5dASr@e{0WzH;_va z3ER~97s1+Xh_Le-0;fe<(Go6w8zZqhGRL)bFLh27r?5*A{s`zJsiml2(-`%L+vk#? zLH6$Gs*%He$=6fkav-3+Q}I41c?a}gXT?#}T?4MvxIQpA0i8n_45vYEvTu4OOsvvA zVwn6?Wr5VVTu`2jGyvsDQua$8oo3C7{-_v&(iI=6as3p12=tRk9|AoKb*r?W7`CO) zv({CA%&I0aG&MD6*Lr~$9+HK^ssDP!kkUc+UWZh$N<*n}h9mjvs^F8s)VL69mSHu! zvy%`msrp((_^Q4=6|K0pVQsK>B<#yvaL|je(eNZ+hF_0KP0d5SFp!SrC1$jVZ?_eD zP|jrzvr6;an%kiXG0h9Z`CwfirzlijP_6v*cj!P$*P7`I_VXI1pW(-$J#R;(9P;P* zdS<$Fs10I?3=^r@eb&-{MS}OOtNb#3B<*at)(`0mtctX53_cMU(Gb~EwFlz1&RSpf z$wyV|pR3vnapT>^A0h*I#O;-uec6f8HT!xb4#K_4lhf-Fjp0T#SWraoaqm@x;0y~s zF{X#u-F4}}n&vH$R0CTGR(NhEtU}U`Co!d?mMYuCdhiP!ZmD@9{#_C4TUUU)1&`|} zyeG4>jlIL@lB$z-;IR#vwMrflKk4709jG1Emb>?jdK^!cX5)f#mSdi(h@~JmJOz9# z#5iXa@Udi7Ex>P(IgiB`T6RE6??jXqM~mL6KuT`{kSaG<0jXBz%SKNPY|Bjy5e_fo z8XoMCe+wO}oK!fprc3hFHG$-;HQDx=F7_!_=o)P*Nrn5^y5X9=H>@}+Gu1Y2V{!vF z;jagYKQR;U?Bw}&g0k}li9Bb;`RQtetz+gD8^US;Juv|Qf%PR1Ys-IFrlgJ54MSnE zKXC!xfn?P7CA`&7d>T#P0r%RltUxOdGdv5z)w{JToUKCx)#f@Zb9oz!ZkSZsaPdAg z4v!7q%$9mgZK{nlFsXdw%lq9G^}jbN-1@0)5N?>(TJ!C3!JBr&Sjwk17OwaM!q|$` zTrtuPY_OK|E&PCZ25Y~uKTvZgaYapEd}5s3w)I|oNVg2+RltcQe3CT!sD}`0&-JvnV>M< za|BJq`w~HXD?LuQT_Ji6c(YfiuKH4@PvTqI@*Ww}BY~8CrvWK* zZWNRNx>eA%K*tNZ1?YA`+&0Y8E8zPT5LcH5d=CKC33>+Tmx49|DR(~uI#KkxLjH^4 zN1Qwaq}qN*0sU4?PXfA6(0{wReYJ2Mk2l+t_9P?wqi8eh(ICn3=vl72bi<(_d{9`J z%N`OWg{5Li;K0am_N5za*|>BA3u;C0rV4U&t!pZrZ*@t92VJ_s9DM^@f=~Jn0aKQ9 z#13@y$vBv5RONA`A&I-K5Id*})c^zrt-5K9wgH+7@oqa{&Y8>zP6(27!w8srinmxze(5q%o z7qn*fpmc3yq)|7NIHhJ!ak8-S_ptxc4b^+9U?6j{_)hk3{2GD4fk1j->ssezNo zsc;S}grm>^N*sE270i--8=IBe>(tM4^5ae*RB&X%@_<01C(E3^jn6CEjp}DZJC;V7 z{0$G31pXRGUp9U!e=5`u_ETIvghw`9J=8ZPcK+1`rwy@xhvF`!D;F+Wy3jZI{4lm9`AWy& zHGa`TT-H0L1X@E&O3xoyFud?&-{djF1{Mqf2vbLcA!iI1opEF0Mw3|d$6yoF{Q2|B zl!^ILW^>EN%q<&|KX~Gz`O6E2Vx@h&~U*xACbx7dk)(ix05C;0lNXdJd4U>VO;r(}4&Z*s2bY z?|>5!ZWcow$aA1xJy6*`P`(3}?E{Gvo996NdZ2s5t(Bb3f2Du-2_Q%)d0Qs^G zknab)XpBMz{db`Fzaux)RR%eL@%2Y2zpohY#|16JyHU_1ct0g*2j0&L3L$%OB*5>R z2DDDlDj@do{k}~=&kOQFWLg9j0&!fx?^_JS-n`$p2Iv(*+kmzR%0*}7bwLw>-V(%> zGw%puUx%X&e&24O_XXucygm{%7w8i~tAYM1=xreS+waRk4=*Dq0`#RI9t!fcAol8(@5}D4MiCHyKpZ>p`<4M^3Ed+=97XW^ zb^vh{!S4$p$~mrr_ygjYz2CPAh+`^C)}M);vZKg%~J950QOXP?Q~xVeW*YeC&hj zf;cBl5Bweq#dJ9w>L@6VZ*zh8iBRk?b9p#dR&Z{IYZ*8?#1RfIIj4kD(sF?NKrt=* zL4}~WoP8h^yV@K(<4TM|sF6^`P_#D!6@!`x#iLM}Kc_>@gyJGVj;hUvS`3wdS_X9; zRF(Y;r+pOh0RA+BINEw_s3=p`TMBW`P9aW$E7Z@RkU@C{4K#?OD2gNBpkW3T8Z^?N zVuMNyiWn3#Xre(=44P)pbc1FZG|Qm52F*8Uu|WxgmKk)NK~)CT8dPu4Ee5SJ=yrqd zH0W-FRvUD`L2C?p$e>3Idd#3kgPu01*`VhQ+GNnn25m9u4TIh`=zW8>8MNJ?9R~f~ zpsx)2mqEJ?;(PXV5@{1{suZ&@h7v4H{`su|XvUMGT4=G|`|b22C?) zxr_fm#7|Bh*b$KZ05b#iNT~g}N2$&rq*J{RQehsE?p{$lTwcGEf|9|0mQgsBfWK zp|(PGN4xM~s36o~P&}sZXsF|$cxWDHUU*IL=}<$VMnG|a$T?7?<8vI8%7qGL8@-+e z3Idd#3kgPu01 z*`VhQ+GNnn25m9u4TIh`=zW8>8MNJ?9R~f~psx)2mqEJ?IvMCJsPmvEK%EbDAr$)v zGoZ?$=0IHuwFrv+r=?KWLd}P&fw~zg1@&X7pFpwCaTnA*Q1?MS0QGw)&hh^V>Pe`l zpqilgjD%8BuTZwp>uFGqL46F$HK?CKA%pS^8fefUgYpd;W>BF)^oR0Gu|XvUMGT4= zG|`|b22C?)xdZgLEG1sAq<)AHZjp|3Z8*Wqx&a{kzVg;B4dY3HU+mU5a$5$Ifh1aMQzu62^T}h=kQ;=x7Im;e1f6TTz|B6=t`EK zGDwT(A9mc^&H?1IngP1KO}N;;;By#Mmj4%m(MtOLwm&)tke_U5v|CxWP9Nb4x)j{_eIFwUY%B5M(vK|v8G?Co$WtSoL(0D}G}=F7 zY`3@+B+Eb4=DKHQPs=%^JZfk(SD8(Bgm9gPH!ZH7zvlzzkn%Z(MssmTE+5t*S!P&w zd`a{f=a6!)t>BZ35Gv0e#0bK3Bvh84a?U3``kC+5A?5ty2pOLv4HsLSeAveIayf^T z*BTnS<&I~TOj&-GIeZ2j^Ud_mA5u<#^7+dJukY>rA>|ww;nVk`>#90`NV)dmw87UF zb^efY&2?nInW4@fQm(lsh8zAE5~-D=&22#o!S7j~IP6ayb3Au(R=^6yh!TuL~E#=|v8xLEt}nf-D7gM(aL zN;rhZ!!;PRS$@scb!FM|!7eT(975yaVwvXDJ6%tX%|Fe>rG!IhJY1&>7uyvgvP@~eaDBs$NCH!>f%zeAv7K?>Z>*hfbZSUzF0QQ#ie9JXgplh z&+_*r3!d)l=2oBK;!?69G#)PMJ6DdB{_=N)!(CiTHiX8*MSUkW9vyVU#Uor?N;ZVX z!$p0kPI>vXOV$^FEjB{Uwck)Tx8k|?3^aE%r&oh!F|l-@Vm z#ib-lXgpkFgiDtjlh=Ixw=pg*B~e1-;VSWP9UIy6X^F!%Ov#4Oc(_VE;p)?C!~>-+ zE+rd6vtuqUB^yHH;ff2FmZ(jmpJ|G_xRh)NjfZQzhimX#&kr5%aPe4TJVN8) znjlHHm4WaRHO%kr2c=IXwdGnk}E-ob- zLgV3@3|gn`{q-ShzntviQnDd59mWLWr`Hba-t%2tN;ZVX!!-r8PKzk=($p8G zxVV&T2#tqps&MHzT-@dS@l#z~N;ZVX!*zjh>C)!$SY7D_E-ob-LgV4OP`Hl3o6mJ) zMm=+(i%ZFd(0I6}fi}ypxz-(d=A+XbuHi~HgvP^lk#HSDhw%LJn_+`5a&aly5E>8H z#h`WSugqurW?byzQnDd59i|3m%6x=YzU2qi=$pyepKf2{QCB9AHU4SrDQ{B#QfiE&f%E>mF2g) zoxVp_-FX>x&>xsxQIdZ>XNPSwi4@Hv9va@Vu%ujt-JyBY zLqq*$j}EyO%u-=@xDM7r4XrM6bwuUdGL`V6L&~!~G}QToFZ)qG%u_$2r{Evkg`%aM z&hhPRZr0Y~SJ~6Ioep~u`cX8K+S&Y?CcrPQ21+bh$jeOhqqyGpaPjt#-j*Rlf$rsOQ>d)RaDBdsyXEgyqa88MNP_e#Zq-E4$FXwh2`qwwEym+8S=(UW>n6*rlKPu zP&vgFe@;68fDtbpatBmLx=Y^`ZDorW&tEQa?B-Dp$z@SZKed9l1KM5-D1yz2geIEi%fKX`vIo{PJ>1_;P#elSqTs zBoPHce;XpVCWLNA#jJ{l*(B+y3#tA5{vX|U<8keBd_9EP^iaF3 zWyLD@gA7H~xE@v&gIwh?jfAeid!I}dYMxs`*UN4kW@|d9QYWjd-zWpkR=e4hqv_h* zW5W`E2`stSZoCZCbl&S}WF~nCn&+?CO>|mI|GCG>q2*)6c*G$@&ePF()2wK6JD@wg zV7MnFt3Y=Y=zeF@(wiNf^G^vl^iaH9Pe<;OZa^pLMs||!{7%rZrF=yv=#B;5&7GiQ zIDXSfx~DrqcO>k4y_0l*?||;~AtOe>iXVP(Ubk!#y+BTD7|7Eau(_Sb6YU^lUGs|k zg7@TT5OcT?PQtL>71Q98zS(DWOZ0BVrR(afyP^%(Z7XQbbZw;2Ve9ZfoIP>rhFpA% zh6?zY!Nv%R7(Hi`YKS{&^SLv&Z_Vy5$&%oc>(34#d*XB%9PV-H2IqTSIQV4q*_^A( z^r3E7p;EfS@ssAzCgCYitl|hSlD7{HGp8;W?34pnqwuggyql-|G)xWP1V6O_n#b?) zq-lMa8@^ZaB6~U27RTdda(R47xV1$Sgo|2&4KE^i&?vF?N=(VIeSd`>_EiT;QpF)0 zH_#<v6DVA0w)BfkB0${16y%a%~KOu zL?nAPp#$V5%h4C=r{~8(yxRW63p%H6H z?#rCADv}yk7<{t69~_u{Ry~)A2XFkKE&XjuBW8W0W9V|E=RRy@zW~d(pT<^q5G3LK(pry($u+NwIlk2!3?TN&%)QJ(cg~=b|3=7aQdYi&z3c56Y1`Tt#jJ6C3dmX7k_&!(k*5S>O zwSbSkHjb7BWM{}xg1*38q3?m>qSqBpj~B$)SEgK3uS|J%7e}-LvX)+%PBW%g8q*Fk zc%dy8e~H?qnMgqsSa3Lb!Fw2*#>u+!r6gXA9}o>3SA#P>?4wugvp&Rl6^wE8X3V;N zcdX%T_zMCwfIm^|i_D3x1m@XPieDldJi^b-04Nt?cDWFlt$1up7`T^6#Rqfqm;^Sn93-@bsc6*bVisyv=nItd3;YPI}V!;^A zk(iQbdKQOPc``<@?)N;$>O`C--dgZp=GcPPOg7ZvI4f*-)V`V^YK?db(TkEG0TqfV_ns)5xfV;AT0m!s=}KdIhcV?*8>7T@jWPX$G3APT zRSIyOy($G-fmA;4g?dCGo)N=wUHecCeN19V+99ZqU^wlt1$@|ZM^mxS^SYloRV8IhwD>WBi4xL;5CR%CP4Ah!ei}*(8vuJ z_OT~Z#G`}pR`nNaB84slQuWtdAQjxJfm9$@8ss|@(EFHWHePMt{&q+1Z}(&1ur?Oh zpI!H(@1~}FW8WO!lv}^7|Dm+{eIdLlnSLLO4N9S3B!&{_m;6KN@=N}qB>8;bY?a6f81XtJbL%pV7>dStwY?%Hpbb= zrX8ZUpuIopLcNKtEq$TpaCdkqVBY1U)cN0ChRS5*!#-=4|8l;edhGrhi+q%8st|%E zXhQa|)-{mYZT}T2v z&Jt7lj8Au{EdN#D$^m-$?u+&~OHA!vuWO0v&1Att7qa~99uEZi(?>DQZp~7W% zgN4S!#j?@y;lBL89ioWJVN8)>H}Se>z>Cm|5i&wg-gxp`Gm&9)mOOKspm7G z_q$iCWuL-jFG~{|57*(K&GKumhDmoVSIa&Xml7$V5nKD(0(*pTiI)AM4svz7X{^pn zl#ufZS5`m<#PhYh)l2F8v>go_G5S$7TlFV?)g;LL3SCZ6htH4Nah>4NfuGw<+>q-- zzU-%?i5nVmag2UsB577~vHsSsuXi-yA7pp;ToZKKPXNI`ZS2|qGz~`lPb(J}?nRiK zA@0kUCoph}8|K?jw7ABN=PjHeGceE^I-{~;A!ZEbSD48Z5-zA%GDpwWkhFv84QkUR zanj|5#brw>HEU&Z9{giVVje9{%&#oKpt4Nm*rx7Drpk)Np2-QGpe6Gqm{3YoELm7K zpYsgxb9r*fyu@-H%<{PvOT!4M4g8n~_fDbFMi+1IaYw`6jh~FZ+5PlR`jckt?GQ{>PfA&IMG!`v% zwsi5Z0#%G&CUk{`cG0W!St$04Vz)dLAF%Cr#QIE|MhNlZ$T4r6 zb^DM0ISX`ST=o^`6oYPPkzINVJL%$}nc9}FVCaapbTe!kVdSfW8x1$1T{Q=Er^gl5 zH~8`1ENEY^R{i&72%|nnJb3cs+dvt$Ufw~zR+jd19tU=$wASY3f)u@eF?*2h?L^S| zEXF5JB2}i*hT1%oL>R^>Z6?lE_>pKsN#0y&Hsa=iJdA!wC5nTBC5*UoE!J>-POM?U z4&CQYJraVO)%&vGSn$UjnyB8_iW)h%@O>1T}c1;rilW?ZFt*sorxHz7qx2 zdlut2ST`4Xk*=hSreb;1BDmQKx6UOFj_{(JVBJJk2MTq6Qg z_zSm5#jV|~TcA~6aSHa2x8PXi9g&*rb8vkfZt+teK*FiI-MQ#U;t~Y>RPSTAC@~(t#rPdty)Tf@ z&}}>!=?(WeNJ#gU?Q99@;Ivj1!ywZKoX}15L<-?ISa+CkmgK=2@k$ePaildZk*LP_ zZ6910ri6rX(FF`~%0jeZ6~!xB-OQm)H_51z>_7&e6cV@DaG2@u@Us{PZl$FI;Jnu5 zcVG2guvPp(9m*ti4TJEg zy2FvS-J)&tS`%q#Af<`j3Xmx~jMik~L^>;3dekGS!IeiT4k2fbDx_>2N=oBA;yoC2uK!(@hh}(Kw0kwG<2Ok(H0+IVlYb_@wH2>0`~F zLsWi$5&f2$J%jDCdva2G2`mmH{&#HUJ^D!3o4n|HM2|AFvc zY8f*m##VVx+@oqZkwG0i80GWM7G&umXe$HZ!1@U&V~T5AgVsM-qP0k3(7S;3{KX?q z;d0QKuo?&YVj5_WD;XmAkU`$-i;#JA{ZP&K64R@@8yATa}LC7L0 zrIivb2IfupS4R*FH4zSwktIEtC8rYtEzBq%?f6Me>(e$dizP9`?Gy9UjMWGqL~Si1L`S__HYKd5ql(oF=RwM)PYSEBYT9Eev=l%&LD ziKL@DE5*ecvhKlEoZ3rupTf)O0+`8F2*u*_rmrLkzm_EQlt{;hR3sGYa_Hb-ZFP5+ zL5Bxxc`R7X9*F4GNa$$lmb}&UU(MQVhB0vtb$m!t71~s3bFf#wuA?KVRXLzSthKHp zIm7*af23gjLyR(3x=!hq&cLCz`R+vV@=5KzeC2Vr1u6$+1?vvZb~4^`YynH|n|A`~ zRPMtxX0c8K{G#=v5iIh-=F>cKFZ<)kat#Z z#mJ?(;YJ^VY3FkH-E^;l3YTy)$i-HDF5(L}>h(#_Ly!?WwtM@lYbUaZlGsvZ`f5an zlFU~TOhz_m++ry-@h0M;9X&N2tet_(%c(qwlcRYqH1S=q)vjGlU<+uFl0rUmHss@m z;LXQED{QI4jO~y6X&D}upCJGU6P6*=^PH90C06|~{6g#ol2G5o0fs;NOADICF?@)x z+*z zWm?_|chc8EllI-xK4hlhs+n|6;Yx}ecqdqQIzk*xJuS|I7*e#!6@=QOA*;bB>!=sD z0(rQeCvj|1_vBHLnj4CJ$sUoK=bB;UOB_`59K{FMXu}d$MQ~_;x5pC)ON`en>w_CP zq@{vu8}ph%V3bG`4@@mKZ709zGV5&wO|-mEp1T&J{=?Ll7MiP~@wTT@AhFr>v@AIj z&}OTsmflX{p4r<~9Hd4UBljhajn?cA1#i9@Nr>DL(HHuW^GtB+cm-ul!c^VJoWVE< z-W(>AsxI9bwF~$pyOpGFRM}`fE_u_}I|ge%L0p?+a!;(`@p@ROD*!rtF9@{5j4Err zb2k#2mt^P7H&Zv6X#25P8QieOGCGcQ>#jV{AuiFm>rbXuO22DI^Z`Z|}gH=nZNn@VFa7Qef4;CEZ24F=Q7? zIyI0wcdYk#FALY7HHSl6R9Evz_=xgeT(i6nGTl-H#^v9?qb;M00Mt&+bUrbuZGDn2 zJ}+qR^P`=9tZr`Gk+kl+UF&#Ue6aRIG|SP{Wh-$fE*B2gU6GC8wrTe7#{~)g%EwVH zdqRkc_5*3`qkfH`S>+1Q&+(}nl25Td3qN}g-pE%fDib19-l&A=y0hmbkm#Zxw?^T9 z_j90Ab$t$6`6nUzMAD`0Y-I0PHw>asW3kQa?2nH}jT0BE(Nk6fcGGX14kaHHB#$ zq^eolqv?}4Dw4WYHvu@zQ2PPmIauE))TS?1jPyv)WMo3%s=&%pfJq%{Iv5D`hF+or zD^~8Xg^Yyw*AdDbVad=*`dLJsNJ>kXbqTTy)3imXwX{hx2vNaS5vbeO?_5S zDlea#i(svREOd2gLQaZG)N}|h2fAA*hTzRE%JaVQX zLIT#E4GmovAb2RQ>ybz?t0FsC`#ca=<(ZX~h7gMZgEzh}gA<+*Z51sQqKGA3K@WZBXwmb*I!i3ZRYj&*U3o*lsV<7rLc|MA7RVjqO^OY`h*}P%8}LFDvmO};Bm2@@@v_*jZ2e1?$Q=>gN~E8xcTo?=T{ZdZuq{=(!<6Y(xLBgZ zj&#)=+`^dI(1TSNdT+Ck+g14JLve^@P8p^rgHKAEOy_=TKY($L;FAp`6^mzE^*r`A zZ1v0&R%Yu$v?gV}BN;A&^)`bLh(wh@lX*Sc?t!vEv1_9ujTs726=o|I_kd@M zSJ-}q!xGb)jK=>!1?(wfRUL;_ z@$XA_MKysTnfhSeT@V(h5ukgk>Cch*mBh2Il#%rGYH1HaR+NQopcTV1L{Ag5MY!=b zzSpt_)Sg&5EXVdlP2+Cp`+~LKL#L%mKJcvz80kPiwTL?Kd;L(@q{|j}FIr{Dn#QjX z3bbH)f=qiELI9n;;@)+6g^iCe=KW>?I6K=M<4|QYqwxjpwNyRh#j3v*ty?s=gwd+E zbSrpc)n>q+PEK~FRm=cw<7)V1Ey#ShQcRN9s%9O|NMDU#KB%zO)?NlN5*{_m z)+N~$O{YvYwWeWsfP8J54}-v=tTUDzsV!0RR;e7+#w)*pv}^Ao$W@F69JB{LRaqd# zRv`#NAAYt3P;xiRV0}rkXiO9h$OHXUuQ@0P1Ejc?ihTCE=Iq&4X>rqOw5K6HTC7E> zqJGO&Cr#|zi;RPsowi?rS4WslhUNy~PaIt;b-K{YFkykh za8sLc(WekjE)?(33Z#t3jwTSx<_om3^zu^%_BM$ujE#Ed7_OyuN(M&VX*^3&OAxqp z_8mb;^7J!E9Cx8yu-VD?cc{^7X>IW6J*K>wv(U9-Uz82$Iz)*oAcUALJ8?l|bkjkM zp$)o_MbWx!m@Zb0P`7PBBzhSm2KRNOS82f)@Ig~0BD_uU5^fv<&CKyMUeb{~)0;fulM&H-YDGle9*+uDa?dKDd$n*I?b^k8tt1Ot%*83f5kZFH2S@z{MuX%&a(7 zv{VHt?TKt?*vbs=!sK9tGB&8!)E8QTf>|b!^X4$8SetqL=PF z)vUdfMu~xqr{kw-myi`>V~^D3YS>)SU@+hwXhu@jDiA3j(;suGX>DMH$V^${hz^?e z|3u*eZFlb61}$BVAn3ZhjocYw;E#o^m^l!iGY0LRwv?66h-EF31QDw-f-tsTh}n(l z>;Q10W)nP!%H1uc*|2ZtI8=MnQHRl-J-fuze3Xg`S28&}N z4#QT`gmAZRSDr&>T(iFnV_g~Q1Dy}yhkAHaqTD5S6WhogN;&pnQp@|GzkswK{%;fs z7v<=}4_Dn6i4`@w`(f~Oqi&VeG*SZmn2=+-;$CW}2(0_(zgk<qjH_sS1?zf)5i+N=`q%8~k0m(JDrnug0mC^zhuyojtSP}bZb|l6 zYap5!)@OuE;TEhr2A3ohZ95uno;P9Jn7;9Rl|;8?Y`a2Z*~*VD&3)R`_Uer zu8+CiSSo3V-1(2=JR5^`kHS6(rb}$=7NV7dC~6ABuWf4B^cIjuYnB(A#sUMBI11#h z34$Au+`5k#ZI~26hp<=;5NO{rSG6Ld!l?k(>!>_v`Q6=8iGv9!hT!L&#i2l=kI2Pr z)tB#*6}+iM%5hb?p>eH;m1y-tFmk#vPj=T%Bo3KfB=cjK&xQ1?6)O@;hnX4Ujbo`;%+HLOr^bYE4WSI5@TK2g^ez^Y_CCLnPyxf=%Qr*O;e_; zMWmDi(p|*Rbx`#OIRl+8gSq<5=jUWa-jR5ymXx%x(huzv!IJoaQ`n3(TNiP_m7F

-8`G26desY1P*$XiZH@H5v(f044jWsa zc7~yiY@w!i!PKSq9QE!-a=Y|6`$%%tioJ^?o~s4ObbXEi#rHwa)d0jW!b)q| zZdEN^@jXn#+Oz?34?^o>Yp<>uOr@jRwz|M&2v)#r&q26+PyGU~%!Cdsclq)j(4;@X zONEtuE>kwQ(_Dn`+)$vW?r==u5;_KrcJ*Iv#01(_*rq` zdX?wf#(~XV@E$D}kA9D4NfWI~KaKdR*_V|}z)T#JY!InYV^hJ}Iq10T&-n}BeE8WY z(P;=&Vg-N2fe9?;Xw;ouV` zdH!|VvV%`Z1LmN09K2RmjfGX|TJTDbKRp#P@Skmo?@(4eNA66%i^1*ZbQsoBhKgIN zWWpZA&xzM{-bAU9>-Dw>B0GTgyde_9mwwdol!`Cr{&dNAI7|W2@-ZZ&>2c^d-p~Oz z#ZdYQ5Oo-LgBW+$!PMby`Z+Ai%;=DOH(ieJ&oXXuOP}tw>{D_a?bTy?Yd@+2D$N^) zI&?9IcD|QIhMnnG!07VmVKCG7q~8He!F%a){%p3}80i(FnHlt42{<#?gr5!L7X@Xv z@Uu%jc433Bwu!MOLsTO8C>GPaPDqN}Os@Qxl1YXU-1!40PKgTNJg~R5RZ3k)%vcQD+S;P!W1!n<~X$Y|Gx*Dd5 zZmm`9=Hmm`7h6>W!TGV@(NkI9sB)eTPIh^~9>LK55PnsqgDO`Q~7HmXw%oAN5i0mpaQZ{y}uw9^v4UD zYS1j86GZP;ywS)5$G`E;6U4G`fS}KSP875g=p;ecLA)6e0iOkQvY>~6=ypIZ-8ogz z+t3>%=u4o%g1DCcG(kB)tWW~JD3Efu&Y%Yk;()sHOByI&@gg+~1dRY1BIq(8=AMA> zDxhJ4Rso$MXf;rtpuIrD1)YQHYlNT}kTRVHq+H{Lh|1=_0u>6~cR)pga#6XRDTvqc zo+W4k&`3cGfX)`w0;F7f189`!bwzvY96`qe6$=^-quMZGi~=T>HlYYCw7f_?^6Cg=g9_dL+$qIYI*bx~ZvR|}*hc0154 zF%2E2Z9WMI|46Mt_^A*y4k#|@avMaNYjbHt6g#xw~uSM*jH(_b0W$ARXF=?g~h&p^l+2odi(xJqmQBpeKyppMg|b zegvd!*$t%p^5a~L2MNb|AY}_T4_+;L1+Z+XpsRs~3*w?W6<6DVlzmx8Y19iy*%AX% zl06Mb$=^yK6&wEqLO|jBZ-JHx3LK5=s01AXbd8{aKqCZA0U9FcCZKBt{TyhRphloG z1nmI2PEae5Do>9>L|rd>=Kx(IXdKWAK@)&(5VRDiO3+V$RC(|q&`{A^3v`yCw}4bV z^H-p1(fb1EJV85wR498LqwAhCfo>Gj=|DAtehO48=y`*_0ICzctYdY(z|8|nFA6kW zOlJZq|1AYl{<|4S`R`UBm2NKsp$J4g{}bpYLH&-?DR?T7DnUj7skEF7q*CT$AeAy# z8NKC3?^d9j#lBwysdW1-kjiBb8@)y#6&r&>x;~EpohiIm0*w@OGf=&tdx6dt^cavO zs0B!+^k+aSrOW&4_RuXrB|`TwP^qA2fyN4Y322<4kAQw8=#c-%+q=M3Rjlvh8^J^~ z#ni-7+nN@Z7x0Rvg%=dl6cv?9bUO! zsa$>lx`lb+z1+ACK+1FcKHULByH4WX15)Mt1W1+dXP_!p(BD4a z#i%=wpHUy6yBX2nmMQHFAf?ThxS+({3Um)E9+1?>By|VST2B31QjZBbx*CGJUydqv`Ykhu2!-28?J8U>`z=prE1(&>^K z6m*NAO@g)ydSB4jKq|km{_fGb3hE1_Qbz-=;9AR*)P<6|9B3)0ZUl0CLwMVS_kqNH zDRJKcsqv**tlLIyfbQe`P6Jxc=whJz85ICUGP)TE-3z@D>z_I8yAw#Y!n;7K^zGu@ zxbcEgfK+NWkScQlkgC%%AXTcRKoj{GcLJ%Lp94~gmnH5kAeG-Yl6qKD|B%#^FlA9S z*$qhL(hErCJQzsjk|?}cg3^UoEWB%hR4yweb*-dUOB_AiQaSGeQfKrQkUHPbh4-WI zn&V=may|=4)$_$bs-&qvD!&=(owx4GP4Uj#x9FX>&bQ?Cs5>7`l+^RTq#GyGPlM@^ zA%1p4PXRX~3BNtV`;9L?&flxLe*r+hryJ*HLyQUd(TeRt(nkB!3CVzO^FR?Ah%xB(_uVYzVO;54R}_J?0jXdzl(b% z2H-_{3#jva4iBwy+|W02p$b*s$l>W5-fNja&)iU_{N2WjS5ou50_As~WB%)0nrQ+y z35FLiV}CKD0QL_vT7tc5jO&0N;kZY!S55FPkgE7EfKe8+V&X7L@sK7#baTQhIK#H=WD>V=s1iXx<$YuVXa|Nunw?jSQnTd z))N*3>jR60ec0OP`vf)uH~}^m#&34OXEH1WmI|8Fg3APn@8*C@67PcF<2eubh2ipfb0Q(A7 z4?6@q0=uCFW}UF(!1Smw0u~8t4U2+xfJMW)!2B?}YR16&z+z!tPr@Rvuo1usu(2?@ zicW$h!%|?Wu-UM5ST-ydmJch2#kR!x!xjTqz?Q)(VJl&)V5?zOu(h!Dunn+k*hbi9 z*fY&AT)|#~ZHMhdTrF%jY!7TNtPZvhb^!JjtR8jRMgS+k#=??dlVHiP6j&;3HjJ+P*|1y~RvYyd!`7UF zSte{Ta0P4`tP-{owhFcyRs~xNTMyd+tA=faZHDEc?&+!NR^V;0ov>QiZrC2!URWJ$ zAM60^D_A}35bOx-D69c?97d0oBVduR*03m82Us+$3(ODe35$XCfyKgh;n;6b`vWJy z#=??dlVHiP6j&;3HY^>M4ah(f_atw{J0U1#B6t61Eby3bq(D~RqR zRb0HF5rPr~jTMw6Xp*30K`DY#1sJz zC1|yvDnV-ntrxUGP_>|qf;J1H&|7L+b1TTrf`d_l#6f`aHPJ5}bzf+_?p6I3Z^ zrJz-URtu^Uv{ul1K^p{B3)(1Xv!E@4Y6NW+v`x@XLA8Q*3)&-Sub?_X`ve^j^p&7` zL5Bn#5p+~ggP`Mre7N?hI*kxSuk}-Ltp(AKepDR2TuCANor*&AQ+kE`f@m>66-R%t zp->+|v4ZH;CMq>v&2Jg0cnW3d$E$EGQ_bTo8RD ztBzJ7Xqli&K`RBV60}-Sm7ukP)(hGos9MlQL7N3_5mX~+tDtRyb_%K$v|G>~L3;(& z3EC&m;~fM=3+f`sFQ})W7(smm z#R?iEC|=MAK?#D!3Q7_*Nl>z&6hWziW(!Ielr1P%P`;pIK|w*~f))#^5VTBCrJ$99 zRtZ`ys7laULF)x=5L7K_qoB=#wg{>bv{leHK|2Ng|NVaYbr|hvi-3iP(MxFQ#k0+S z|FnDP{qzqC$M0)qya~HCt7=htx{(}x{ly(3e9eJqdx2aM8->Hee#br%*5%91&xGD# zzfCxPA2Pvqw-ZAjSkN9v#*KjQz0)pxAoLFV^}=yg3zgW1n+~WtU{6K-IsC{?CYnJ0^i@;Ev;{6mWIHSz9nie2Cq16aXVoO7pC71PV9!%)oNMx4_cIQRQ9cJ6mFIOuWu2pPs~&MG=C?*1`T?uEsl*$o z(VVTBuOLuBi?Pb4INK%c=A7Fo=dO*;>$65NEy*RFO=Zx(aZICgZ*7#2VtDrkY;`EreeNsbf!BS zm9Wx?$!c=h-WE>3pxm4JrcED(HB#pmn#USr)L7&9!4rG9kq^cEXq1r7wDFtoQyZP> zRmQO>pPr3!9%`HyaSqeY*;JON8%L+4qm5MWH|i-THS(7HMm0aUk!p9N-c;P^SmPR< z1uYchZmP@|HmZ$B8=XbxM){-}HAeMZ8Z4qO7kF#t8$Dr4S{7DCHe>V!1$gxUEVJt} z++In)GIKZO&)FHlj8F`rV+N<`l?v$flkTQYacrZQX^qaSf1{X(-AwSQ^0}^2jkRvn zI(IiZR-B>Y8k?6_>}IYKw=~M<@kVV*vnzK~s`-tM^=hMhRyE>eHHrx|QsE08+0?Oq zF^;Z!E><^oHjKSZ_V@~LZltVVVCQll7p65wv?AnO~o@`a6#MPJOgn^Ilhh;vJ$aihS9`HQtm zc-ad#?+2iubu;D#7SZa^C4sc!0G5k)SM%TnrN{EJ?=u4>c{z)Gw%PEd6DFjyaiZKej=jG3~9V|RwW;kl1i(b^MWB+v_J?BRD!kAa|2lAgVyiBvhFI8 zS0kZCKX_FXlB-gvHO;jJQg|hi&=TSWrE_sr$iT`eG)|z1`FUBimU_ve;-D`ZM~K5A zgIG+Zv@`?DspMi2Z=5bxGND4pr3JCBh+5iR&0p-u+>Fv(l@cnFs+b9dc|onVrekiw zQ8efl<>cU?jgElj>YdmDX(&bBfunvyI6csxW>;Wfo&X;CKIu)K%RKmT3>z0eJnpAo6+>#ItL|Exn_s0Arv?BR5RL z8uWQwh=FNEWx?Vy#Dt;~$BcDn;i29{9Y^(D8j`YtH@32sU-wV_s^lB*F} zjSbX119>$gd(9+1Gi~JJK}s#BWSs%`NR?4ZAgib(TlG=bjcH9Kr`I~iK)VM6T*V5R z1)Ccv43xM8x&~0==H=vNQ5>ik&Cwb10)@deUV@4}%yEy5{EU)6A*XQdW#vJPMV84$2WBf2H$qd^WU{l&W3l(%_6SYG`n; z7pkJPs^(inx);Dm#MrDLjw0XYrj^jeW7FtL$l*}W4+R;~8PJIp1cJFm*;aLCmgVJh zoaQFnKk^#IB1TF8Oan7zTNY1usdIz5xOfC|^2!60k5BBVb8ZHi&^rKT8n3i3%uyAe(<{fEq zf6s_hYn5SubC)Xf$NEE?!fHQc&>&72GGOqqVT@?4vV}bToVEc!7Ivn=`om#&8fbs| zeX;5N^m|~N;Di%=vD^A(meLQY{^wQ!UjMi_xpg4&SlGtl_^|_wHoE)ZwZ#S*H2!m~ z9{9=9Jo?!ZHkySqZ@>WkUeVVc6XZw0dEo-4@okQ?rdh0tQTtK&cnh4i7h1eQItxFd zK!MHzXF3%W+ca20R5I2e8^U3Cx2-*X{WKmwguhJ1&@Z-#r#~E~6#N#*w`Q*5xO-ar z%;wRrs~+~q+vVel0`L)W$PTQI~Un<|39(edIim$&%-Y5?| zI^XFYcyu0fJ@BY}i#_n@xHo&?QGO42;8A{CJn&8juhs*v6L?>E;8D9B^T4C}Yng|g zwl(Dkblh$pcyzvlJ@BX>P4K{@@}+s;wFNKefrsJ1cdbX>9UgdezK?p~QTbl-z@zf* z_Q0d#e&&Hk*Rq)`NeqPbq4Qz4?Oah6c4;s;9cR77xciR zFX68Cz@zKl3J*N;gIhfCXneWX1FsEun?3NT-Cp*ZRNRFB-fR9(XiP-tU1&^<3kD*A2W~9(d$0UwYutb>SBe zJgVpB@?{MI*qUk&%I^#hJSyLL9(f}@@TmT#c;L}EIokuTHF(7ycyv8l?14w;d#eZD z$>2Tcfk)%U6CQaldEk-X@Akl>^Vsi!*9E*EJn-o698NC4PTQLDEAqb>4?Oa}3q0~B zd*D&MT<(EK{k+HnkLvF_4?G&jt32?id=Go%J?D{E>yh`7N8W!t@MwPUUk^OG&a{yq z0w92`DSx4Q>FVZf8m+gVq8oZzf9+j`c1Fr>mcYEMbKf2!okH(kh zJn*QVU-Q7D{66%+BR}}Y1CQ$Em&+Ut_)3&Dkh5B!d2OiB&FZ95pKaxxJz&iuH zg&ufRzS}(TsQw=Hz@y`C^}wV0`_KcAuB(SU@M6H@cYV;Ovo+No)V?vrE<=4b#iR2W z?SV)0wK*Pm)PM19kg+v&T$+b1_rRn2d(Z=qt_w9Dcs;>;(*uwC<@X+Ve(+9s;8FXY zIUhT1YpP!8dRjAcvR0@J@9D$a=-(x9e96u;8FS7 zlwhZAP1Q5?k2nuJD&Is8Jo4vU4?G%&uJgd7>&!Y2Jj(BB4?LPrzUhHS9(Xh!yyk&N zXan%L9-6euM`eUC)y}@S?%H+yk!@cndu6 zX#RJT2Of>%cYEOV0q=1SJj(AwkGy&hJo5Wv9(Z)VtruaZZB4Z=)n8{1JU@7`9(eu1 zOZLE{`N2Ot@Th$2Jn-mzw|L-@|84icqx+AyJ@9D0_L~PDeIL;IO6;`luiB%h2OeFg z&-cKiacG7I9-Z$M9(d8<-R6Nu_41ep9+hvm2Ojys=N@>}-x@sfT3!XRwl&orosoXJ z2Of>P13mDl|4#70qk5U`fk)>%-vf{GyT${L>iJHOyeB;HsC>IT@;>muqxSgL1Mdv* z_}!!Q>1<84FP-lhi(Q8LY>G#IKfnWz`q4!mcvQX;4?H^Gn>_F+zlS~W=zEv#9(d%Z zUwGhAe!qC&(fD^7z2r>WnyP0ykM16LXM;Dw1MhV3GClCibwgK?}114GRp&x{IuKykJ{r_4?HU0;~seA zFRy#x`N8|bBd^&%K-RXV>d%k#9v*mf9USd}*A2XEkGyL<@Tgwad*Gc3-isc1^c?+T z4?KE~^rr_NT`#*=V5eW10sZjpOq@@ciJd@W7*Xd(;Du{P}ec zJUZVmJ@Ck{{`A13dhsvCPTQKQKkAnkdf-t%zr+KN>ZQa3kB+;_1CP$*F%LZQzc)Pa zsQwOl;8Ap-#qZB zUQS(xowhYqe{_Ey=YdD_*mMs(>c5p9cvR01c;He0c-bTG6AwJ9mj(|!YTr)FvD3Du z>W|KMga;n^{Y;O%g&uh1FI66RG;e>w1CO3#{@VkOo|k;)fk)Sc!yb54zLT!QPTQKQ zXUea$2Oi&-dEn9W$%{Pj=y~kr9(d#j1s-@*&)0k4(S7n=9(Z)z$2{=pe0O@_QTx_; z;PnFU8xK5c-;=M$PTQJlU-IW}9(dHg2_ASfPNsU`(Q}Ye4?H?VO9x&9i^3f*rLiU> zf?h;O-a#H0;p>ZiCdUl|qE?RZB}klkR6gMU?a(w_XYpa^5ULR80jWX^kOK|_QiVvA zIQO;rOOKuKcC@r% z+htu8HJy@sQ8HpxvY(PWD>dQeCsFcLPOhOD*PIKzmLWTJ+8wCc`H7sf$>3O z1U~3eg^%g#gK8Qf8h`N-sXovm6l$(MPEsE|)CVe((o)n1PKH8s8Nvt667fN;iVwIf zeNZLhgL)V~=mLlj>X-PS+f01W=ztHJ?BT<&KBx;Jbe8%^QXdzpj|BBWT?v#p^)XO= zj8z|_)CajQC^OZ^4E1ro`WT`<`l*j`>f;>s5u-k+M?g-OPkanlALN4w^;RF`uL#jM ziufR(#mBkoBVK(_Z$e~$^%1K+#;A|M>SMI}7@4btQK8Lmg=4L7f)!4-!s%AH*a}xz;Z;_6y%pYUg|}JZ zJy!UD6+U8xef(+{l6<%e9*IVJuR(P8gK4OJ^5!U%xVZRlQwZaKjIN1uPTj63WTw#S* zS>g3oc(WDWW`*}y;R9Cqh!yrVx6a=R$6Db8E1YbF)2;B46K4LQk%AFjS7{s#^U;k7 zUFX7hO)G`yDnVD*FkT;2p;UzFsuRYm%_>xmFkP3zcs(bDst~3tP?)b;Pz?}W)WUqV zg6e?iIvK{JzCsNM58}8;Tn*@Ait+)`We(*N6c03#zRD1%XzplYCOj;j$=3pAJG>IBsTUBPh;f+8_1D&V+iK`}tZ92YMr38<9g zQU&D#E#SCvL6ty@IIc=iHPB*?s}WQS^bd}!6I2g$4aYSIio{iWImbl{iUF$RxOhQH zKsRz+D$vc0a)EATR1UP7Q6gKdj!_NJdPcQC4>GC)dYDnYpa!5vIWDrf zi=u%xa$L60yaq>wnc;wyo@0g4ZbqNXwZdpaBYmC~&bPv7UxQz0g^R2(+TP&DTIG+k z!UL@EBrBX}<=56qpKqmKY^9f2>F`6Nd_gNb!qS&n>F`-Yzt9SoTVeRK!N1Z9UuA_a zvyMO83eT~^ms{a9E1YhHGpsQBmQlVXR`_ZwjDBbEE3EKRD~vvA@UOMP%dGHCR{3tW z!pklGbyoO#D~!Hw9DjusF17N%!Ai%tVCcWF!Yi%tEGxg8tn`6aIz}5K|68o^Dl0t5 z(qoJ=^tV~z+pTbCOOHhv4gG41zs3sVt;Ys`uoWI@g)gweqpk25D?G#s-(rO`t?(UI z`A)aeFTkUjKGovi zZ>7gr=?_@xxUL)LyTJ-SWQB3{H~5cO;c6?4nSsH7%nIjN<$K&pA8MszR$=6~$qGMV zg)g=APg?2US>erA_$e#=Pb>Vi72aZnpRvNvTH)ucaE%py-U?5&&gTUy{Y5Lh)e664 zg13g+H^x2dwbtR(OvUe#Z*GYlZKz&i_3tJ>IIX zy;l1BR`>%ee6FRRVuh2f@Kh`Op_SiEE4|K2|Huk|Y=tke^zE&1M=Sh^rO&m}_gU$A zR{9lIc%Bu;+9Sqzw%^L{JS%;a6~534Cs^S=R`^pZ|5GE(;~x(c7CM|3WKVWQFl8!|>OGR`@?w_>dLGdLoAYu$BJ36&`N!f3VVzSm7V7@K09w zXDfWv3jbn-J6Om6)@sjRE&gv-xWNh^v%DNu)@u)Fjk>Aj=$Er-kxNox3I#IR=A}V zF0sN`t<5;z$yT_v6+XoZ`>ZVzVa%CP?a|m{_6rn)J?6DQ@z~ceO2QsBrx`%F=kejX0EF2KtME)72y=bJr2?VX0_6gs{{fW)9c5Grgg$|| zDj;|_P&E+z7N`aYANXI3J$whK4tumBP(Ai&AD{;8QPV(?&G2O|qi7)9tsyQ32=fe} zc%W!TNkF)_MqDZo?n;4jfpEVGR1SnYNuWv~+#>>20bzCpR1Jjd98e7qo=^hS0^!*V zP#qASLIBkR(fUXz9}u1l0!4=7C+Cc!f$%f~aWO!+uLg<-N@A1*gnJLfr2^rp2~aK& z=4(LZK)CY!%5A+732B6)HB2U7f&@ze!dY4fQ z(EE(yfyjSRKA=w+r2>7*C>Q8+M&&?XF{%XmmQfYZe;8E*9cEMmbc9hY(9ewOfPQ6E z4|I%C1JH3skuC7bEJo2l&ES`4U!dlU;(;O=B>|nxC>5v;qg&ct%M;=QBzL zx`0tG&?rXbK=flF^ber%jH-YxVpI)uF{2uwWJa|>(;3wP&16&$bP1ydAo{@)`fp3T z!kbYvP$r`opa7$Ipj<{tK=T--0u?gK1)9&O94N@B5@;c#DxfPFRRb+yR0CAOs21p2 zMs+~6Mjyr(pcRZ7fL1b!Y=u`cGl~YfjZqBH8bvH=NUBsZDkaBGG58TC>rQhMlnFU z7{vq8NQ(Xe^e;xKKyNY11$u{3IS{RFjrIllkWm%T$Be3h_A{yhI>4wF=u1X*K;JN` z2Rg{80f^SSM*FtLt6v#K1O3D(2IvZly0>v>Z2O7kv5@;x+Dxl$vs)0r_ssT!1R0}kQQ611YM)g1w7&QP*Vieg1 z-#Igi2Aakw251JOc%W29NkEq|N(H){Q7%vhqjI2ZMwLKw8C3yY!KfOjfKd%lF{4_b zQbu(^3mDY{En?IFw3tz3TYUG+C>rP*MlnFk8N~xtGD-rvkx?qp&5Uw^Ze>&sL~C!u z|A6jfR0VW5qiUdajB0?^GpYr8kWn4b!;I>I9%a-3w2={h#p-*KQ8ds$8N~oS!zdnz zuIcbUpcfgX0=>*A7ic@9av)lx8|4FfolzCgn~bV~{>`WcXb+=Wp!XQn0e!%z9_S-R z4M6)CMYhBIk5M$x7mQ+nzGf5;M6(K%59m8asX*T|$_4t7Q9002MwLLnF{%Rkol!Lq z?$eP=4G?}p2UH6b&ZrIuPdyM<57d%T0}!oJivD{l=6{T$f$+2iaWO!6t^yPf6wN3J z2>1SoO9kr2C>IFJh$F5X2u}ilDuK>nR0VV{qiUeOjB0>l8Px&}WK;(%Ey8UR!c zG>6fcDU&BBj!8)yGb?S}q#4tbd|JeqNt093k`gCPni7hgmNtFb%xR5d$0SZm(OI;7 zSYqlJEx&1L#7Uc$I92CyZeyoRP7FoPVxk>R8`CIetRB<&fGVG~nbXEyq7%m?jhZ~( zINZ1ilP641O4PDLSuNJIw5C|o6Q@s~FlBOD%7if!6OHrdbDf?tDrLrW->5NT5|dNX zrn^<_hH;co4L22ub9SR=sVe8{Ya-5IYAqC^as!2eQeB}aX`WD2sCC>p)rwNAX|#To zYG{+8s$Gjy^%;tg>U5*fTqXzAo>yZD!)M3F9uI_L`A6J;f&k zcma1Qn-DW&^2EtgW=-x*YnWmU&_GEc78J}VF80&XSN^<0zbq{3%LoPo1;s&su*hE$ zz*={HXN5&#W#`d?npoz}k7YW8w1#PBMz%jAAFJVkOzZ5ah_YZVNVGg2mS*(x+IK|6 zB8gad&##u;^OqI}vY4Jliwc%vSzO|9fv_fMSxI3a+n>3}FUu8jDh^VBb==gNj~tWh zpX*l(yeWOIAB&;-v8bROYlL~FS0ko0!;j@J3o~%!0Oy1S4*j%PpA*P#f>2yU3#w8v zr2h0gd9_zm%=|JeE6OyjpamIO{%o91wmKRG^;ETPYpCvuv0`H&s8g^OYOpA)DBtg_ z@8>TpE6Bu}p;VmW(s};8Y-)qxB7ZIlsS8nk#YKf^*^H98Wd$Iyqy*=O^6>hxlm&&| z^<*V%WCKD$QFd8=S*aauR-_dwDfVaRf>K0e+7U*Z5~I*&7zZsa2^RYc=H>a-YLHZ3 zj-ook+Ogz?fH`^j0Y9&^%Y@Q=KgEc9Vj;qivu7K}xJ89?eVHhEUZyV#wd%<0&iv0P+1&JJ&!XRJ; zP(&1Db9iAOW1cT7tCad#04wNb`?0EQ{vw~YoFq8{79{oOWZ%Vesa zfn@?|3~{?O&PnwEK4DcMq27+tmQr3gF)fnLl{%~*mzT}WvM?_Q&qurSa?O6MK|0su z(GsN@C5zmGsfCBhRgi&MJE0_U7HRaXqM~_ufl%f0*p(RwE(`<;{nS=i_7pBg3#p>m zoNAw-)8pu-O-Rw9t#9>0W#)d-CiC+8YNSw$6CN4U1@GnSw0Pv z3j#d0ghmC?>J%(K8K(`%fh=BjSa}ARb#R8RQ=R z%m7XX!!h}ckD?2qpaBcl;Qy6I9*)(9F#rXqoDc;Hc`@YNV6eE9GALgpmmi9gKpqAG ztgY?GNR>^klvjw!KuHn$3N?L>yFzeYA+GbKd048OFZtpS;A5agH^CL%8BUyQmn0Mw z6u|pKM9rJ9rgsrm%+4*4)Z(&|;-b=kglWLX)C04W0xc4QFfKLj)l0~jXV8@qts|EN zw-mvWGF*6RNQKLUMwNLbnS*__^Q+Ma^-jY?A(|3(5>r^@56%l-*xR6By;MKeD$h0| zX{Bu=qF`PcF8BTztX`c5vYwAx*Oz;;DzOqe(V?822rOC5Iic_vLjA>ol7dpVNDc*s zM4R)0jJznGu1kwhWNxNLsipIrtrv>?qfObQ~Lk;6>Dd7?<%71iJ;*=Q-0oqhy2dv~Q~_sH7R zhRSM`fYOW-WMved6QpjM?Vmm^8GWq;msxZitRF9Bpb^3<7Ddte%|?Ork;E;G8&|BC z+_{pwLq$PZelV|?uA_6ar~}Xn@uj{(Tr@CeSuns)-jm1OnYscJ{OHa+jyp3So+whh zHeH~uq^8+cfV%>q7+1e;%97RdZQacj|Y8GVaP9qRB>W4>Z%)+g+ zQ&(e0i#w(OhINdsXbzuqEvDN78Y1XA7P@=LD7t6EMTu0gm#2>6V9m(VcGOQn;FCV|Bn!CWmVfIdcZFx+6x^_S8@u}~RB%%6jU6hWG`B2B>uCFoJ36ZSoT4&ZUn!bO z?R0}oH^LdFvJk-whSM2Od2fAy;$HgX-(b zKuM9FB=-w?f@*M@F>3*}`4{5(2|`kE98a~VapUB6V48@j=P|egbFKw> zS7P|!>p1es0Cb;igifW@Y06L%jYWJ_QImJwseNkZOH)pCKDwhTMw8+qSnA^eDT`HUT&!PJ| zeYCREoDM+ue0q{5k*@Yv=_P>$Mf1oPw8QFpr^bzRdM+iCeZF6$du%<2&=t$Q1J_eS zw-<1b0LBeNYmKtHunc!TxccML=iWgX%D)(Ji9;7VdI&+IVRj%V12ZN+MLQ42n9^jS z>FEqV2C$~KB-Yx`y}G)0&vtTAVGbr->`jKu>6f}+=;?G&asub}$;y?kfbJt#J_D^l zNRv!)4P6lD`jpHWj!$M}(M>EWv5=;3dJ4G(9uTRksg*#_4QZfs zo?vAjaNF%Rjx~s= zM{(*ws49<5!2N@9C#_hz-;@;=Wd<`)|MZYgC6^V_3E`m*E-Zc?9NqZPB*<_mnUv5# z2S@btwIhSBFV19E&EARvYW6{XhwmM7@mw>Q8OXp5jzE&rGjw<;UCb8YcDRtATc8Mj zcd${;g!;jw$v{4p8gmx)n8FzF)x88ItK-Y;k)Dd<2`^pY^t#|DJ4DxR8&L&Z!S1CW zol!mQ#lum0-iZe{PG`X#AZ1qSYm~xwhjtojup}c34}WCVrV05b6dCe$mxfh6S5D+S z|2jF8>;K4u#vtcbDpcnDA`DVU8Gz@}gZ(9#Oh~?xV^`@^!SUi(C_KljGLe?t~}Lrqx2Rv6Vz->?tDa`;tj64b(6#JoVwikR?8sL z&Agf*xY@Zwg@{W61(@QfLD8gA1Goc+48)LVXBXm|=b^=`;Ya09Uog^_ zH#Bo}PX{gOoWFC4Tj*2YyXf~D>aN0>yi4mjv0OlP-=boi$Gvog$`33E1TN`0N?FUsM2r_4O`VU-Y?FFRLlJDMN*+L3&^PNderD#krs=PSJO!Lh?= zUgBebMD+xVN{?qPWte$8H<7;6I=2Z|Kj&(P&yFzq$yQfbcNqOFt2eAKjDC7G7&Z(x z5;h8!2*aN!`d-FQGN%I5&!jGa&4JNRp#rcx82#L7KCBG32(|>a6t)~jKOQ{@yA^m1 z>@L_k*vE*YpJCEZj5fiZf;|I!9`+J!J8Tz>et1bgT6_oieb`5^{jkqrU&9W<4#R$g z{Q^4%`vVq+pO`d<&4Tt^SUX_)nGOB~$JZ4`Kc(pf>kXry%f!J3!{{e5BVnUp^s|># zXtQ8bfoH(*CoKH)l?;3aV0o|t*nC(SY!Pe;Y$w=W0~f$uRn<-baYr5BnVUHS8elFziRzFR){_f}%YX%7d9VW5 zd{`N55o`%;DQr3H4QQvKJhuX`f!zgL2fH8k5bROdCfHN3XJF66UV?3h?Sd_W7Jp{u zdk6S^*hjGau+L#%!w$j@!+wPQ0y_r#0~UrK6*q_70c{&tJK&D6&akeq?yz34-mt!~ zIM`s=FxW`gC|Dw_1@h_)n+iMwb_r|_ECUvR<-rPI^I>JMMX)8XrLg6&+0f2~-3q)0 zb{A|N?0(oout#B=U{ArGfjtj<3AP=!3pNniCtw$%AD%+(2&4Aw4C@N(4(kQ$4eJYw zgAIlagN=lZf+fP9gdc8%JpiMh>Q=z!Af9|H0Lz0>ThE7;!4|=mz?Q<6!#)Q;5})(~ z&NZ;RVC!J_!ybY?3flyG3ib@_dDu&^?XX?2iLjZlcVO?sK7#FseGdB?b`W+L_9N^U z*fH22urRb;bJ!EW)CbxDcZ79@b%k|@^@9CfKc+nC$9hv?Ghmm%=D;#w0odR5>B-`(dBMzJ~o>KYkOO39xqXg^n=t$*!>O zuwJmg>&N4u{SG!2+!?S-U~^y@umJ4u`f(aKze9g3KG(qRf~|wy4|@pqcm4QJXxD=G z4(xr{N3i`cul<<*$RZs4cIXowVVz-JVclW9V1L(-GodBjRM-sIC9pZL3|Ij6cl~$_ zIQJos|7$-U34JHnJFxd*AHnv+K8Jk`I|w@r`w{jF>=^71SQ!5JpgHUtipTM3!|$!( z%BTLSQ5sHdP9L45?p3K}FRUeE|Z34+E7N)j|lP_m#D zL8*df3rZK1Ehtw|zMx`3K|$q$77MBnv`kQ?pp}AF30f_vO3+$C>jiBPR4r(upv{7| z2&xgZRnRs;I|bDW+AV00puK|X1nm=aK+so$>IEGVbVSfmK@EbA3&JmW9dE)PJ31&* z5dE23Yj7icQG)PCsILDB!i!j(IKLqJlQyM|5!6Rete`=H;sw#4uPJSUps|AJkJeP` zBtgl7=ug#DYO0{wg3<+L3(6IgFQ`~hP*Ay`#eymXEfZ8JXr-W4f>sNv60}y(dO;fm zRSViEXtSU#f@%b96|_yzPC>PTb_?1gXs@6;LHh(95cHLxdO?Q-9T9X?P=lc3f_#{V zsMd-QM1K^f;#v!e5=4Irrc$E?(TkZ?oL^8+K{0~p?nCin1q~7uFKC3I1VLj3B?+1& zi2krk<(wjj?ln{#{W+IH>4LHa(fyE0%@f({8f zBIu}~20_OK`EU=SS}Q_Oq@dPq5fm$Ekf3-$BLpP~8Y?JC z&?G_0f>H#f3Zkbr>MYX*Weds`lrN}QP*700pv8hJ1T7O(DQKmjRf1LvsuHwT(0V}| z1XT;#C}^{wErMzUZ56al&`v?Mf_4kqBWSOnIzjsc9T4=Dpn5@v1RW7{R8WJU+Xpo?IK_dhu2pTIWNzf!g$%0Y@r3#uY zC|yvtpj<)uf{FzN1(ge0ET}@zGC`GsRtj1rXtkg!L2CuA7qmf8wV;iHHVfJ!s7BCM zLE8lF6jUo{x1c?O_6n*Kv`^3hL0<`~7j#I_5kW@i5Hf?@>?5)?0JgrEdLV+AD%nj|P$P>P^bL9+#=3(6LhD=1%3v7n%! zazTp)RR~%ps8Y~ML8}C<7E~o@t)TUSHVCQ~v{BGzL0bgX2-+%Wo1mS7Y6a~U)Q|tZ z5sx~s;pWswum1^cD$tMqro)NE4TQy^7`*%-v$T`}c9`T@9EwrfLgy0~VsOS{k0H?) z99{WH1RtN0m(UJdgwO9&xyPvp=7xt&KnRZPdtm2bTtM6c4;7B9+V8{=H$049{6M*- zy>~u3j;s1oIHc-V5<1m|poE9*K~2$}{C}EP~rJGksod zAvr%R9Jf4l&a_3s!oy;b*)*VjJB|#E6cyf)!5ecJo$kco?ITca!=Ihw^ykA!`g&Y zgH$wg3>Dr0p{cHUe?n~AkZQ0}F~?9**}}s*s$^fYFRyGD6;cgR(abSaROg}d>TuhL zsCFThDR0s1952 z%1P=FQpLrxj5&si>LFAcuaCRxosODHIR|qL75P%=yh>-c$v;g~Dd%90q3UFm@STz$ zZ|TZ8qxW#v!gYYat`Jgs?Nr-ZvXV*6P-1cat`JgD(ao#VQwE?)aSY3 zr)w(Z9LzCPXRwM&PTSJhg7s%;D&-u^F;rc^4SCez@jGU8(NxMgm}98AvdZ<|H64?7 zcGXnMIhbRpy0OYF;dAGu?e7*+4N$(p97A;`tH@_)>+{2=V`pkA+sGqb+Rc zt%rJRD&-r@F;wS*8>;#LOs$%5uBKAH!5l+%9;@7AO)fd<;qx?=@(tz~sy@cCs{eR9 zzK^C-zQG(r)t6N?GSGI*vkzf~N?f3QbcO9VQ27RP3{^icLO%c4>ebEqX)5I#%rR8` zSw+`t+G_92y|KThQog|)Lq#nT9_Ffg{QA*7v6@Qx26GG*wMcjvUFB)pH)q26ahgi` z26GG*wMcjv&A4b=le}^3fRJjC@(tz~Dr%ANFxPu~tOsSjo zuR)qh`37?g6}3os7|ji6%X{S6HG?&k@(tz~Dr%9?JnEm_-@ajprc%Da979Dd5*|jg z7uw!zIpLY1no9Wwa|{)=NO+h#r`un1?9zBmrF?@qhKgDwqNMno9Wwa}3o8R*_fJc3JKB!4Vo?#6ded##FSCv#%L<#8_Y3ObaxhNQwA$TmR>gxN#xX5ak=pF;wHh4b{e=u-LE0Ybxa%%rR6+ta96H z`R!*yFLPRLVD)W2k0=8@hMc`{8**XKE_t z8_Y3OvsmTUe1|Lge>+Q4Dc@j@p-N>{C+uk}>sj3`RZ}V7V2+`>1l&-2eZL^#%1bnr z@(tz~s!LhrUd_Y5|MIL$L#lY?8_Y3Om$Aw{uVc?t-hP>;Qog|)Lp9q_jabqAvDunR z`37?g)f_`ry8E^Rb2OFm4dxiC%MDe`m2s0U*Hp?km}98Y3{{)YUT&ABsg!Rp$55rS zsy+6!y>Rf(#p#+#`9?ZY!VOgh#e})DlpDKr{7;6aQog|)LzT%Yx8`rm9P>e@rc%Da z97C1Gs?)KjZO61Xp2*Tv$~Tx}sItKg&3n)EpFSx&q#CAtgE@vOz$&+Y9e-nLbU;%n z-(ZfR%3+l|&gZ?it1d@VDc@j@p_xwL zUsthnFvn1pfEylmCTs9Z-(UCrUZShmIhbRpN?CP=qnh#N>^Dnw6*~uW3{{X-?l`}r zYx}!`x{95HIfkl?Rc?D_{PUGx%5)Vw2XhS70;7bVEf{*%0$s(DmanCK)RqPwgF^+W&xS_kz$Icv9 ze2u134@Q||sIFy|AA8!KyscNaYjqX-26GJ6GH^q89O+M7|LQVb#lFEDL$#b$ZXN!& zBq3?Ju43O{j-k4aRh_Y?t>^mgQP=4z_6_D3s_VfGjW!4F`?TSDUB$k^979#fD)(4d zjriA_mAZ<3gE@w31*^`&p0<`p?@U>ttJpV~W2kNbH`L0t2f8i3L07SFFvn2c$f~Y% zAZ&Flx?gjnu43O{j-gr!Zpb$_-|_yRD>apRFv=W5brY-H^E&a#g|FYFtJpV~W2kOs zm3#eaan+nwH|r|)4dxiCTUh0u*Mb8NeSC|qV&7nnp<2Z%w=Y*6+gH9ySFvv}$57qM zs!rI`_DSn+m)xqW*f*GCsBQx{G)qZ3H(}Lnx{7^+Ifm+XR=LM|y4|xM+^(zGH<)9n zR-n79 z53JQy>>JE6RO?vfdT(Bz6W6TMRqPwgF;w>&$J&3=j+yuBD)tTL7^?eN)e(Ez-dHer z>3zCt7{xNjP_0L7cvv(gVk^HowZnQ%r5=o~M~ZpLuL|y%Wu43O{j-h%G+|bDOMdF2PAJkRs8_Y3O8(7tx4utLLpPzkggRWxV zV2+`B2;A^6cRXA^^0}yobQSvsa}3qPta599%B~@IKCG+QH<)9n9${5G>}lJ4ZSCp(U0mX_6_D3s>fL6mat9P z9g`l@RO-Pfa}3qvta9tHP0MRnJ+76S|6hgE@xkNmjWdz?t{F`pc8LihYAQhH5jb+&cVf z&l7t#>nipQ<`}A{Sk)SP+NSR=D||{&wv~HuI+-k|N8D3T@^=pF~?9n z%PRL+58U|cE6?gG_6_D3s^?hcj`NW-5}$caSFvv}$57R<%AMORZPlw^jjkGmWL{Ly z91ovol{+5x9rn;e&+97o4dxifdVy80&rg2hx4tjvD)tTL7^)Xp<<1<&epXldqOM}! zV2+{M$||=umR#j;zExMTZ!pJDy<{A#*N$z=U(!{>knCfQp?aBB?I{sk!}G&WysW9z zgHh%fs#m}beeckJ=znWp(N*jl%rR8kSmpZ0Nk42_xlLEGZ!pJDZ8whf&ZzCbY}Zxn z8_Y3Oud=EW_O#{XKb7>Vu43O{j-lECZfI7yDe<#iJ9HKM26GJ6PFA_?)x2<3_)cBL zzQG(rwTo4*M}1gU&}WyfV&7nnp?b|Y*4A^!9DGezv2QTPP`z#(tJ$OvZ+~4^v2QTP zP}Lf$>%RZvp;}F)9*i=_P`$w_*P~8(c6{&+UB$k^97FY{ab9f?M?LnYu43O{j-mP& zt2$y&+w!kxo%JtW#lFEDL$w>+&^HLr#=!ZHJjb4_}{vUeSMd5a#h$jvSC%KdrK{LCm}98k1~>F9rPZ;%``*@7>>JE6RC`!;8XX8**sPlG_UJ11 z4dxiCcfbwJDkuFg>&16;75fHr4Ar}=a(#Z|iB=!I8&VBW&qbMIsNQ3hI|5v?`jOu6 z=_>XO<`}BItZIWjZ4(avoV-_8v2QTPP`wXs=)78OxU&9zUB$k^97FX1tK4y;;D^{> zKG0R{8_Y3OAF}Ec>}kv2me}b-UB$k^979zHZfLfA=G!@=>vR?S26GJ6N37~Y2f}vb z-9xb-=_>XO<`}Av!3`bj#KQi2Kh{<38_Y3OpBSp7L0P*#(N*jl%rR8^Sk)eT+Qye1 zPT8la)N@hh7^?l?hVEfMTr=|e{kn>MgE@xkQ&zd{mHukj>`!$S`v!9i)n}~oV^7-; z&&;a%OjogQFvn0G05?3WKS{8Cc6VUa0bRwuaR4dieB*P93G0SEZN+;B{qu8O#lFED z<5*vS8=4<(dHRA2ztC0e8_Y3OU$V;e!;f3vbJv%;ihYAQhUzO;x&7XO z<`}B4SrvmlZLQy$aqw$h#lFEDL-h@~p?jj$9~4G^qp8$$QRWz`Z&`IR9SB>X=ad(| z)m7{p%rR8;;D+kZ|HxZ4^}33EgE@xkAgfNN17UmppFd1FsH@mFm}98^18!(WR93jW z@IShWeSN{4sb(nYVptA3D75fHr4Ami4MPpCfuS=&!9MVKM2o-Im}97p zv&!|2JIe=;Jg%$QH<)9n{$SM^*wa?9t3~=Bx{7^+Ifm*_a6`2*a_#R={;8|jH<)9n zPOvJP4umb?rTWSfx{7^+IfjZTp(oPco_2X(Ul^j)_mu+%v2QTPP!T2c{IK@$(|f{n z75fHr3{^8$xplbjhrU~z=_>XO<`^patFq9szVd`H<)9nB3RX(>jJ+C{P$gX z5t>Rp7iEs2YR)RRSMIv%_>AVdihYAQhKd%u4-a#X^;)}415eUb>>JE6R4rKLUccV_ z;)SRdx{7^+Ifg2dRjx;k{q)}QNL|Ig!5l-?l2vCrweje#bz55MD)tTL7^+sRa<6)A zu6v_(D_zCD!5l+%GOM~f$LiCiS>4IHihYAQhN`tu!ufsLl(p7X>>JE6RHv}Y@1ED{ zZx)=QtJpV~W2oA&s;i^gJmI7CHkwL37iEs2YRjrFj%xDNEjG8+RqPwgF;r2kI@3{A zhqnqw=_>XO<`}AW#<7wwOzzQ6SFvv}$55Ths_xFQ;yQfW>Qr6DzQG(r)t*&uuN?E- zH4nAdRqPwgF;pE`<@(0kW8WRuL07SFFvn1JWR+WoXFQ+uSw~&PzQG(rbsDQ&pI>*= zfb!FH75fHr3{@vq`JLJrxpvXfPP&SHgE@vO+E6_@>!c&mno2zvWsafhY^W9w-x1YW zSFvv}$55Tlsvb@Wv%X2{ce<`(-(ZfRI)hd2y~8W_Hmf*8SFvv}$53@KREgs^pV~!N zv2QTPP<3UMTk~B@K6o{o%rR7FvC6HDR{M4a&(c-w8_Y3OJy{j)lyKO6_aEu0tJpV~W2kzu%I~OtYSAIK zm#$*pV2+_Wn^mqyb*R4X&a-tD`v!9i)j6zk`|{^0FJF9)u43O{j-iTSm0O25OuMgb zjILteV2+{c%__I2{PcQV%ig+*eSReX2H9t4*qxy4o75fHr4Apt8a!0mTJN)$6 zdAf>ygE@w(53Af!ba40k&grA6)N@hh7^=Rka%=u2-#f$m>MHgP<`}AeMhO>xf2^#Z zu43O{j-l$$Dz`S;rF?&)zpi56V2+`RWtH2%Vjfwa6sxP)H<)9n;#lRj*PoA0{5ein zv2QTPPz_*}>l@dEkGXPyu43O{j-eXJDtFx2ch(2f2I?yI4dxiCL9BA;05AT2`13)! zihYAQhH9{(s@Okt;9yc9s)6dcD02+eP*!zv`trVaIvgFU ztJpV~W2oX;)!k8@e9|8&@w$qAgE@w37^~cx-@NtebB5_E_6_D3s^P}5%HO-Q^>AIq zzQG(rMQ-oBheS6e(H<)9n#MHgP<`}ARta3-}OZWZj zv2nVJeSnipQ<`}9eta5$6`R(_%nxd=N zH<)9nl3CT>DPi5?cQsGeRqPwgF;r7ob*iH(zjn`+Q*{;l26GJ6G*-FK%qOoM^TRY< z#lFEDLp7aM?#$tl+KH!3*H!Er%rR6c#(DK>{rIsIO{JcTGRIKOFpkypSo542x{7^+ zIfiN`tK3m^`B}l|X6h>T4dxiCS*+^d)Zv_AV}{StRqPwgF;uCnYU`*DCO>>bs;*++ zV2+`>gjKHhCY}-X&?UNxeSQYv@t=#O~YujC_tJpV~W2i1;RXeAIFWoY&?`67* zeS0SFvv} z$53Um%Jst!)(rh1Q&+KXFvn13vC6&bMc#48Ls`0teS~n zye|6mzrW;aD)n5HIfg2aRc=rDV0pXS^K=#a26GJ66|6eVIoACj-PY*}UB$k^978pa zRjnP>fp7O@%+pou8_Y3O`K)qhmHYQ4gyrih_6_D3ssdKI-uw8h-unu475fHr3{@ek z+!6bSuJ2YC>MHgP<`}9XR&{dD>mM19-dd!q*f*GCsES$T`r(q7kF_q=RqPwgF;w#n zRnN_{zMQYC*f*GCs7hGnw(_t?ZaB3>Q>o{o%rR7@#s=yU*%BO%8^^r3f!xpCxJZD@EM7%a!nXc#!??G(ya<4- zMm(Hv+yEXAT^>>9T0CE5l<()Z-F}~ubnT(oq?_`4#-8AzYsK~&>T&1uuTX;Vac{)E zOFy#kCEe7VKUO3*B;CY`NjI@z(oKmCiE(eZ>bPyo-)OsLThg^VW9RIkix-`AgpY2+ zXh4nd(Jdq0%0>9-mXoGF5x(Kr)6^-#Hwt^2utoT&u6?5h+DQMD)50X~A?H*7s z?(n1)$C6h3^nWdI+U0Y0(40jTndVoj$W-a7$ka@#$YX(2ktYJFBBugrMMi=BRI`4k zsHy_5-RYl0KS1$?Du=GS>PUVdddBFSbSQ^Y`7}|h{y964E?b*+9rRvBO&3l(*;GL9 zQRK`fN4dA&o5)#APRM=8>u96T@URT*sb4I(blT|=KKIb7?-R#;E9N+GXroF952Kz% zs?p^=e`+qONr<7Xxv1u-2!0Q!`ujdA$NnqVe0!3pvV`Mzt_$BgF?58`_tE>lEJ|)6 zs-wbjRW~{@)ceB2Xzy;3qFUudF^BOsCx)(%;bCswP-II{?b11nmpCz0PvK#1-Ol}Z z-56DKO<(WccU1JD+Dsn~RLsMTIPQE}shYmtsZrjQo{VPHE@5g(X}%Kp=pxj_HEl|A z;$%vqeA3i)&B?(?!3E_nqM=kP8{1bWyl}RsokzbStQqV}OUo-LPMd%uPC+oS9P1?q z0|fakwLRU7S6VQa*Nj*6@qyqNT3)p~4InhRgJGoR2)3 zuSJ6f@;uNjQ%Cs1)!^LjxHir9nK#6F1)xK00p7{z+^3$TBIpvqyrBb!Iu!o66Z_TR zoJXA#8-1w!1{>F`bCKVCB;Mn6L^J zJ?@j`+uE+#5%+6i+^^rY;15##$cdAj&lPoaMY}BR@=>_*(v`C>EW+0d`+kh*lxUg| z;TtJ&bd`%9Y3c7izt2~4s&iVeCoSJrmUr-F z2q_8mY9>uS_@I-7rZ$rX9;|edB9YWq&oKJCV#*DkUUI1xA5;NU1uAOTBea>I9$-vo?AlIt?QM%W^q`k?TrI4QYvhxV6ir^0L8+xC zy2zkp=tNgNj&x3(=%T@p`fZ}?HXL(UdK5>R042IMjCn7OC2JDx^W!6J0}bRBil1(N#ej z%%O{Mq_&^vx(P?cy%*AXta}Vcg=>YRaBo0T@qGwM;l6})K6X8?G}VCOR;3p4d^%1w z82ftL7q!eE4a;mdjgZ=@Wtr^=+Gk8_H_blFv}_vH`6)V>rWLi)xT#2Yep(RraR#Y{ zD#Q38slr_hNfoXfk`H^L>v9}b;pRiK7Y?n=KTbI~RlvgVt0Tgj3#hfd<|jj;U9_TU za+BFwX!lqPA5q#}MoSHe#>znRzKMQX_Z)FSkpQUKYnY*Zm*AldO z@-B-oo&A%BdEFH*usR!apJ~)wHc=DC_68V^F@PdqH@wzm>)W z7jmMaWJ+Q9BmQL%%SN8$pF%AVad~&NZKr-r_Dyt+5~&o@5Y|=WNX;_QMYhdj>24fV z=qgAmbhU(1qf;K?V@Ubf6M3joz5g&|Fs>g6Py_U-`U!+#;Mn?s?NtAS3FpH0Wvelel&z*gQkJ|1(lG4G%lcTNCPu78*9IJ;Y~>$s+H-$CpDYZ&%SsEk0k)iecF&JkhLRp%d95I!%wJ`nElJh8m(Z9Tm0 z7*slY+w;P^0;Q-8HI%at>rbVfP{0y-FCRH|JrMMEMPyqZ<8whWtLGu@YSPAPxJp}}eng!wQSd3sj zlm$?(eJVi%HTn~ZvP=!VX0ZU86tp1pJOf(P;!nC|Q(JdEsG@60jpth9g`Xi2G zS)x&R980g_IG&}qaHKdBT_50RYe&i-s`i6HS0;O#z3pU=ekg^_7|Etk##x)fv(u)w zFnQxqNI(_rOh_toR4AGmCvxjhnTs0wbEpY>3TO>SjX5d-1WM~GeIq9O7q+WTc zDL_!=Zt&A5$l&Ny{Zh951z|YUFHjW)Vda3KJhLz|!c`c)Dm5k0nwQ!i6lzU@@Vko7 zHOz_1D3l{z`8a?lVo&4=C^h6nw(%t_U529?hn7Q9Iw_v%qaH5ch;VB`_*Kiyl-udZ zr_IP08Kc5UA#@h^Rn_I-`ON@CWk^A4stiAk2=BB_xBGI8KdBjhzQZ**B?_}(1xK%o`p3+g*S51wE+bN7&fur)P zRMcYDeT}2?ruJ0?%A0eojx;!fvOaR->J)<^4KN4!J)g}Aj{H+vRO8*SFW&mfN^8xJ zzIIBRwdVJz$_StH;#nyC)f3^*esw%P`KE(he-(^bDV(k2=>lwmo7NQ$g>;u*HTLfcRKWWV& z%z6(;;xF7%aHX~8rLPkmnvZqukWy(bh{4b|Tg|30^bJ+Bah|Ko=a|1uJR=<#3hfgUGqp~$shDTS zuKgD&v%Zr@&d)vDueX~ zqGMhxf19#TcWA(>ue`!u7o{atRW+p+NTo$S#cWFRmLqiv8>#{rro?*;1;0x3e2j+2 zD6LhPDKYWf6vJwd(cI{;AqA(!Xi{S|ePc97#>AW)Q&O64noVW)Me`?qmF7<|n%o%8 zFEKIa#+2RGFcEY7s}Q`-F0q$^l0OtRTUs*<*SgD#XO_={qWHr6i;HKJSC`k7XdNJq zzcr@5JXl;CnpRa=>SP8zb~VLcQC>Qebd2NJ6vq6Gm^}74s4F6oqEQ7S#}zyNs3{Gm z)z;uz26-9E0NSzz<&ZRBD6~2>OSN>wGYSqxQRS;;Yp8O?hU%(_ z4UkHR4btY16JRquh3a;|V-IB23e8{2YWx=&4L5ld*VmSmmYeoCr>3rq{qPJFJLJtG ze>@{tQCwSBKD}~oIfW@!ys-QUMa4zb{a`b1vC2o3UCKhUX3f)WaBf;=rZ<;Tro`%| zm!@Z?Wg(@?S>?rPo{XIMAsL?BtoR|`%yfH58jw0RuO}@dJ|~B6nTVT%bWe7giy9(Y zfSf(s|H;QKc)SzeO@k(EK2wvxw@B@kxnQ3W}`c3t4?vbUN}{0 zXl}(!B4-_u<(GLHgenQDpq(e5i5c%~gD9Sq4MDC9p%+ z{w`O=8A{s+Ka9&t*I)io`friHyfbmxVW9f^WP{7hvJWr3mT=SA_%0`Q+9ZEj9!I)# zR`e?{1ymqxR2?eaEXOS~biOqMm`yRbY{%tH!hH?LK4*i*^p!0Mk(SWIN&U6VE0OpctTvm?O0Dz5fWzfuy#$~75lV#ijU~Y`T zIpeEEe0KrUlTK8zN&R|rv+WgfIKnc38K!YoIdU_znW+whD*|R(G%h{cYp*yuXQszmIL>!#!7vpWjZdCQ+%7_#fPip+5{Y95sq&Hm#QmM%8`}hwYPi1DywuVF`utp~${wgcm;fLr6l_Ss~r=Fv@N%&#AWaT*Qay4*! zfvF!Hjmyo|S>b?laXbWvVI*J^`(=9^^+v%(I5bD&vN9a@O9t*%jiLBxQ|-m$@Xyr# z{s7#X==d_yv+eD)7jPTn#h2l{t%7iG#>Y9@GvPjshx4X8ZiDCp+}`-OTzfmE_O|Ekrxk_>G9a(BRh`cgz)9dh)RF1de z;(uYtP) zxC$QxY_x8s+Kc}98*6c46Tho{xCOzl6yk@X?tr}k!50GauExpuo9nT6bJuL(dJb{9 zuEkE9#FvQyNvZfa1;-V@d>@VTdNISaHj1y?P}~`Xoi;1J42Pej_-+JdPc+W!^nX;p zi8P4VHnvNe*WnMS-S>`%%gVG@uZ#TRiScmRH1D>yg%CZ!J*lx`zidplEg0YF`dPgA z(jCK$>j7|n0`8uCMW*!@E=NXMhP@{Rp??>ck;4>D(oJ{XxqKUf7XZ_j8Z0)6FEc&E zULV&XY#cBjMB~zFwqk9?5RVDq>mk@_OTf>glB zqH$?C9(#M41Y8K1*Q0TnnT~eV8@Nw3h7-nt?U$M9@Gq00-w)h`3lvK7hiQA3A>x;C zmjTlnjmz|^hvYPt#+e-&qg5*1^jw^YT3Z?%-nYP=T&Q%3_~HEFt~|TrI1%~_fvM6s z&=k&_?HG^9@6Og3h`g!zavk#$dTMAfaC=86jI_V>9LGpQ>GmFp^CRrES?Olrtkv31 zhj_lm7%ivk&G6dGk&3{I_&A3j{}s6FfxB*$imf|-RD7s7rQ%})j$Z>)Q>2tqjvUA7 z5nrup24=g)*~;NK4?POee5^4lMxAbsquIOWA#gu%b)%!wP4hVX?o0$P1Lo&wT#jQn zay0^X^cc)hvC}5)0P7R>_OcLRn}7+7WtinRyqRfsJD-gLP6y_eaSA8)%XGE_AAm{}_XLGG96yZ9%5@B^eWAbmB84$W#$~5_ z?ejIt_g~}UypHjbaO>jXyqONaM)mO`a2XR-s?uJ(&Up#p#sKqNG%h>Mar-irV~575 z7)^O|9P|5A5ctn{xQq>@C;7`xbDYN? z2HblZW0F?sVj;;W@JqNa;^Hzq_H+riFD@=UGdC)}E;K2!ZOYE+j*d?C+dD4KMkEaO zGvnfN9p#|@-~(=q#)|#CIgZ=4?*VQSFh51%)YE?m)LSxs6KOJG+kCDf-`QztId;2H z*XRx0OpTRvGrc)EHZC>M5HNq!IO!jbvkI5%JK)-Yd4H-R3(m2+hB+*Pe+FiGiNc9r z!;@k5hI%c6*8nqUn!-tZSsur_SramTF)$yNDxA#2vNF@7+sm; zr^mykImhz=(tQlLedQ{)ZusH&avjZ{Z-x&{Hz}%Lm2ReEKuST-#P~QzeVho~+;})F zVcYAMy7%qC{h+bPuF7AA*YOwywbS-^@nv`&{fKZ!%)r66aXGS`>o3P5q0@jHQlWri zmn`SH1cD?IkmB3U~bVk zu}fNxqv9yOdx3c|IzCLt?c>qqz`YO5$jcyLlk#E}-=kD~B-}l~B+)>EO>lTWs#mG_ z_#+Bf49tXTr928h+Rj<_e%TB9!8HnFj*QF5aI9|-ZbW>X!+wOD5+CQt-&w%b#KmQM z?d=bzP_Db;;nF;g`lto&Bj84pfKBQb-NWt=sQr~|3JNKWvw@^ensoqiOvOz`Un%V&}9hNBt%Pw?|`Cj3z$kc?IG4sSE?c zuSz$|F>fbaa=i^CxNL{NCtONgT$bZeWx{#l;<6p{Cc^pR;nH!P3}I%YdMk>D%g%9} z2dn^Y5^&#XtgH)oa~$Kx;lQN^@vsVZ+N6HH&T;aS7Q`X*N5{m36DqD$HU>9!`X(2U$Wm_@o<^Bj_UzrzlY=DGIC<(Oi>DfjKW4=bU!( zqelT?u8GFsazJKOd|_bjiNR$%{Kk>stODk_Xk12`<2*hIxK@oZ$#8$m!~kp*_@(*o zTk&y@g}5_-`vkb8*@`Uo!{r`(`=iSgM*}lnkt)(j}A5(Cw)EJ{y{@HQ)lHa%x zj)%+0aX9imh~y#QS~OPjm*G4QCEQEE?2N%V{VCzTAj}->*sS=n9P2rR>kdpx49+>f zBHRFAe6cvkc`e~C0A^|oF3aKndI5Kt#z5qa?U#{7m$PIe+?DZgUXSDY2le0U6eZC@;mgFm8NaM|ml}TY%dd9bZ$?wLC52vAN z2s2x62%pEp!HwJd8{vMAhs*Fd*4wEZN%KtX>Q}WFkJsKW36~NNhvj>_-=$&A3)}-5 zE9YC@Y{&KKQ-RwMFTPyI>4%H__^vp(=<`*o_wS-`zT{+IH125N{&^6%(}3%F1rD|? zUVP-o(hmaH1-Q(Ez|nku&_Uvc9whFLlNAto<4gyEzD2;j&}TBiv2E z+8w3$qUy#+`WY?E7?K9St@B`Mg2 z5^Fmw(D*!;iv9{7iD=r3`mQ4YKbMt4k7Xgwm6XIFckn|7qy!>Otcf69{MiLN&wwX*afq%AD9L3)uTRb_a| zfO+QZ)j%X1U0OVp)PIV49nLWl$C(|+foBqX1)4`E7e*TBRceTFF8zcHQ&S4{TZwG1 zFX&|+9pwic7qwh-l6jWOyLSx@0c+ba;q$Nl45F!7^{^xCcs7&|a7nTuy~Gl=ikDf! zxwMNOcrgz)>K7{b_<7aG4| zVmcw&`v`CYk$d;i&!Qc{+``Dy6dmWwJmCc!ryy=F?mw81XJ_9X5#Gb*E(|}#6%o0& z8-sQP&p{-V8GgNkEfSB30tzeN05jwF+9v;j8G8XQ_#?| z6=8TmhJFgRZJG%+_H=d|KO$<&iXXO-!j6d__6fpFcMEWT^YQbS@Lj488@IcSZIS`_ z-(ZwPeysdemTrdbHJ0{6+R75$tM@uf=R#6$i{8e&jdhQR^c|dqev@?r za8$Yi(Om}V?;N@S$G2G8fMYkLoydQ`&AOd9_GaBV3C2B)f~4{?0n#5BHyP4)mZF{H zq8Ec_1u(WXtf!hX=F_fiEj4-n>STnlVepV*SLHzA^hX9*hlb&-M1=H*KMJ0TAtNP_ zyPjTAp`NEl8%d#1<^@`Z^+&vD7{mHP3FMYwPeDSVP-?VOvVImG=pqx?0)r}9k5j?k zrU_wKT4FNZ(XfZ8CYq>L+rc)Odal7xcQi8fDkF0@R&S>>D(cPpg>^V}dbI zqE~g{&I2>?m}=0}1C88GiX2($v&FbY^myji8s$z0RW*lPNUCYlqTxHBCi0`7@3J%( zx*aSng7h9s_d$A}r9X-EG$b_|uY;sU<1LUrVBDJ`(GaJ``R^d9asF3GYSiwI%&JkF z9N~w|?FWe(bfW7Fk?11^!@T3#v3_P7u`g0_! zi`lHQCmI=WAZ@m_AtzWTC>SL1mMxrDt{0c#9C)dhaZ_;)yi-;4X?&iVlPlOALxz5x z0S4m===2K+)T>1>ln_pFA|v}6Az2Gc$zvLMu1#J5**St?V0R93H0ID)-`Vi@+4wXq zHTs>RcMMLaBLAv2)7qsPoGyT54Nl*(jq9LO!_<68-?45nBs$AUbS;CVT=ZQct%9V6 zm8T#nm;VeTi6*g1N3RxAl4=#^ZMGdup@7DThD@Qn zFE;M$lyvv{@D{XWys$O}!O8+2NXh~nul@BYg*bClugr`1F}I?Z-bF_7+{(O=76=Dn;ss2;Z8&!o__9;W;Vdmd`@sKd?atL)yzy5hOMGPZ7!L z2>!mhu{#z?c%XY9_Hg`yrgJwI}lHZuYVC|1yn~|8zO*?Sk6GtI9@Z7=o?nwJv0; z3S}z4d7WZpm}xsS+g=|sZAVSYrR|JF+u2WTXQb73h_GMU&V00;`6;{#)ONI)fzTUs z)^_D2)!TBSUfi>vtAeWMCzj5E^fODNA*r@E6_RRuK}f3YT`SUUkW^QB2$Gt$#B>!l z3AG<`OJmqJ=XS=R92$mEq_1f{W@OIY9vT>kpgh_(hXO>lNm@w0Lj7Sccbh)(uvr^# ze2Q=FDH7`;I@aL%(J=x8ORgp#A(o7`Bc=mp@}#RePKCV_e1I$L9)`5t+A(r}(!x~g zVyNDvg~vc*=|xBvldQgH`ktnNx57`;D1<$I*AE9DIvQMIls^7z#->i7H5{x~_zz zs_Sk@sxqxJ#pj??4dw+%s=?4ojA}54NTt*4M8$HBR60%RReba@8r7WWvl;eYZ%w4| z9>2)woIvD>Re%)cZZ1q3vN_POp#p!&{9Mkh=)A*zq7x^YJ&tG|JD6xN)s8gKM8phf zJoUCs0sqAvOASR7*5E_5HgI@(G7vUJq#;TXUOp8Fb`}m8X>E$|^1g9lq_toXKPDem zZtN!sF*)7oC{}nm6>|gzny!W6=u$)qY(@SRDVq1nhd&K3r?p@!(MW^y??A-gZE~P} zYLV*jR<-anInuBMsnXo%1e`}v4#>eDZjFER+Ec9TZ&dCQf(Mv(M-J%3>c!v@jq^M% zI=zY%pvf#;Pg7PaSI9*Ur2?P5fF`gMp$@f=y!;~BSFJY~<1K6Ig^v8T+=Y)){^(-O zpyAzu$C)La;aDBDE{AAe5ScO&Q#UM}zZg6nX99Dhm*9{)%pd7;v~nhq;S=$S$QHyj z(JaOmMutzN)706=n!%Xf#^ziRz*Mib!r!>_{6b!F-&_F%PQo}&egP%FVN#u=(_D=n zI7oES{G47EpUBU%scuN;m};JS2P8GercSRysne@Y`Yt3}KSO=0_ta5I2cZ4WMagu1 z!d6)PLe&H!MG&?H(|BID8!^a|r2X>A#a3fZhw3XK$Y&OVsMrYT=!C72uWzh$$vLr3i zDNE9AKPuY`B{aH|G_FaZmJ%A(>i3Y)+F&j>Qj2a~z@byARgT6b#D*}5w5epA_bUB}-oV)I)Lf4(~9ILoJ* zZ-V46YMFZ^u3;y;f@hi5Hw1ZY>uLT6$XGk7m_(x@$g@L|5Bd)3>a)dg)+ z;AB(aBe`|9y<#Hc(mrl4ZQEloxviwCeCLVoLP$z?EhJUuh=i&#o6`OFYwAdEi^=+@ zTo2rr9Jy~faLr6Z-V(WHDxJBso$mi%s)fU?!l(}hw7ujg$)g8rdGemBOwG>{Uep8Z^snsmpP*+;DyHA6Ozyq zHn(-Qu10W&h-ct)kT?zT)&x%`N^nn6v(y6w*^$=TXaQY-!IR0IaG?2GsE;<5ckfzz zPnKCdov0}PLDx=HPjmJv9i=h4Jr?7vtm`7DbP$R7LY&->&f&c8z4k=p)e}5LIXn|T zxd?~9QNemVO`(}?4rNtk+831`ogw&hB0OxH$*FMP5@htc669n-;kzn{!Z;LKeT(_SW-rPK7PvgGx zk`}*%6m_WzN)s0px?9d`-&q(A=b(gKExW04{`l6(kMF^6TbCaE8&=0XyJ?!LPC&ws z(`m?Vy82CMTJdeW5EpjX1YG-wOebpcexwT14jsw%ddyiVR2 zX-Huz&f@qtuSdfIgyx0y4~BUEk6ZIjZXg#8t@-h(_l( z(lAcPJy`$x^e?4_$W)S%2Kt09WhF4*Ld=--L@msXzWrnYcj64>r4Z_zo9G!$t{ zA^)OK(bQ@E53;WpV(+4K?BOBwCxLv*zuFbpYqWdFDHOC{`X`)1LJ7_{6-V zr}J@3g?!HelRdn1U!C>>wgzW7)}Nt=aII0kfO8F9SK~a<3&VMNL0;NE06936jXDm} zVJuZZQn%{Sl_@3N3Mq+0sof^Cv<^})mdH|vv-BP$#h?V$RVePF_B983gZzv5>_Fsl z*l;gyt1)#}3mfhY=9}!oT)EyIygWbMW-$cod%pJik{5*f?Dh5bg_7IxX#-Wt+>KYg z=WVyG+Gk3p=)$Th2Ce<6j5-Hb${EgPwqQ{OnR}5kw_qi(fk*(Edoif5HNfQE(Z=YE zGDR=d;MXJ38@EIh+<@vwW0a|bZE_HPoo>ktMBH)i$~2WtjXTr)p>M|wooZGIoVRAI zK?cmQh{ct?GOM7Ry#yz(K3=2>PW5bCM6j|&C(#Y-Ytcox)gb*73Y&)^nGl|4N`BGrgW5%0@w$6QOyG;YC)DT;R|&wj4YsR&}vKbgd!|Z zVF@WOHHEWF_VOBg>2GqP7R>!#daOlbS!>TAPaJ(O*;#D&Zq7iip!JRgA`jC%(;&;NB(@;xXt?NY`p zfTWCRt+8+$B+nN85fr``q*K!M`$6J0#D(8*X2~@xnxLemGCON64oKTc-j>~s&?NQCqx)4q^|#}a zlLC(jf9cO{y}Ag0!xAXY@yLsBsHe8B8R9fTq0!Flw^hF(cms*@c@28`hHqw*W-v)g)roj{Y+I zKxDb%Z436LmaCbaXpLhn5nQ3~dErA-?5&{TOQ!1kg7U+!;Db2)9jn*!BKdRiHHX@O zI%lDpY@Xa=D%bozgVMQZaH9(!{Bs3KGh?5`22&`Ai`B3wiGsp5V84|SkgiopAZA(next=Ffo!% zvur8h&r3~CFs2$2cNb&aw0#0)T^r8Ou0|eJv&1iA3WeKFfGt)T8wA3*Pgu42C0)#_ zbHgSwEDf#Frt+cqJGTaMCiJTDL>Da(9nBJ5bvlM6T8ciFr8^)g#(j_!<1Z5WCM3oE zQgCE(#Z5$osL*6cD&}J$snF9Q9mi=565VLQ(VSA@q>a%nk(i&f(h-v-qmPlCH%rmr zzRjOR-#Q+FkAmz|Eu$SXFZ`{W2~IJaSL{TJfriby=!c=I;^|BUv#*<5+B);}4+egg7JFjvvcrdj7c`6%hz` zqQ4>wcH$3z*ap&YTX_n@TSkO86og-nTs<)m2^HZxJ%PeVz7Mneos@kHaA*4)2GOEW z=+t~%yJ;Vhl=pH$Qr1OWbp;?lD_3tPFI*FjZ#?dGp;#u0?sF3@q95Z!SlYs@0{j2@VN1{JNhj6`6Sw^`*P)2nAe0SaQ6?PYI+u;lX_ES*1!_k@Ykd8< zoeqYi9!MbXo5H%=A)Uz5i;#+uV4`a)B)ac9(e-yoCvoT(kWOZa?ni!roebUHp{9mj zNNP4fC)ry$bOI!G0!3A*9&7kBq*RWDChkhwCer!fsR?+ANDU%|Aq__^taZtVU+&8^ zOK5o!H#Krs-k?sQl){MLS2$>hFVqLuUju>04eGvA?NRy5@+p%y4g~xZ&Xe-!ayc{3 z-J2A(dbmj0I_jRk;}NXp#b-gX-Sele>r~j>UU;1`{>ftW6{V^Mh1` z_jl2Uc&)pk!~0uybxnF|>-vwoG`z$>et43i!u6*vjW4+yUv-Bs9~>U-YxU=lz0eMM zLF@SiQSpaXwr#iofK%D{3n0<%)4Lg7_0*1Lb!*8lxPs?EqMqr(iK$w>AP@4-r1`$& z=}EOMMbndN4n?SIdeV;d)01XnFWSOmC|z)(3peut*R9BI7%MJ5tEAKDAjSdtobkez zxpGq+77q5WJrD7i?#Cx|Tu!QbRiqq9syR?GJ338@T#l>Ld+{;C#`&m|Uid+sbZ?wL z(Ur9D0r1wTdKu=Zm-(t*UN+}-n0>|6%X~c4ih7xE>g6?ec>dt<1YhegRWDX~BSpQr z*X-Tk3-#N(0oORpx^f;eV2X$Z%)?L(&51tjn*)t4eEpbDyw<6@wepy>Xd>=A+dT(| zv4}$1;~_}O9`vk<%^v0>vMKr+Abr>^G6ri&{)v>E6OpfAPkw?f&^WihD|EQdo_B|O zy7nCJwm@_5F@eaWt;zUQo_Pe0+AzMnxw#$p9?-NqOK!#U?!Y{EZH2A=0(_f<`G9n; z2Byj!C9*0r_xJ;_6S+`*41}u=u@o5xjr;7a?)5x*bat2vYOh(qPLS4`tX|<2~(TMhr2kr5SK)z z`y19C2Ss9nFX_h3{_s!!hL33;l7GnSp|NefynCH0Um@&oS)v&W z<#AoQ)gk-_w-f*B!vIwFj;tUurYIa09${R@f77ZNjPCa>Y@ds!^Eih#H_-rwsY4Nd z(DnjJdFvPCw1>RrOOf=2UYMT0f2bGlG3TTRRbmt?Vx0Gg1=>irlMLYcAdG55RG(^q z7y;=F4lRMCZi}A}J{%fcawRK+8A3uS};O>eOdL&VI=x}U#C!r?*xs{Yam{1 zI!TMl;iaPD#6ynygqQB?PoN_7ENEQc8Ta_F?uw+7^4ISk2%1WHHRYypf1Ma{unNmv5DH2ix?Ovu^6w-EyuQg-b}STHSK_(@aN<%BW4I+My25c%hWme6K*whGCYj;MK~C4N4S`P z!Ll$iG^ZeJAi+v1;L(05A)zJzliNo#OR`U1($EbfN?VX=xU)jz6Omus z9?3y*@mEJSxU%A4q#3F!$oYXc>Ca<;^1*oy_T|igNYw3c4eo{5i{yXv^Sy+9LJV6CfM(dRpJ>Iz*y3}4NGL+XIZ)!5`8Z;(KQXyI+my%J;jn~3lVqo5-!4idl8NV&J`%_ zd0oK$`g!diNe0j55+tAd8w$`DF{%R4Qzb8R0X&fYTLp;n8<^Hd!YdIeI|a6MvOQd_w()^ND((*WZlx+JhDPZxOfk;f;$W8C$gCQNtoZ<5n22s%XGw> zH9YjAU&(R9GNMEl`v|a<|G@B!#o8v);LZniN{n2~>?^W3KtbUq{)sH6=_~%?pXL=? z@mFEo z4N8|2=4Ch&nXbDyaA~$T;fmJFHM#m*NT-<5m0J&~GztFp58KxTg02e&^o!wVJdJV=%blnC?jRdP8 zDTliOlDfzH1QbL)I6w>LYE9u1Nc1hyL>H|J?&DZ!C|6P@{#I|#7z!z!aU~+n7wHyA zYSHLHNa_+2b-)Z}JP#?8C0eplxE+wx6QA@VfZoWXee%$-5(?YQA-tU0tW6PVh^wGE z0&Y-eI;IU<5DVEm5qEO!)NC61^jF6t%c*~jz!fW;7ESg=+=0mBIndB*GRD2a)c%Fx zNvSE}*YT10_HC$+9E@-5Lam!BR8%9vui?I@@Y^_JEez`q(T6vh3oRoeD@;PE{z#vK z$WoO`VJg;rg0w)5wbt-{+$MxCjq8+n>ftX|7YEe!jrdBqvC=?K2fh|c)m?8`O54#|lt;XR*Kh|O z*58YVFw}_z9Gsbdkcuuf`&Xka$gBj-2v77*Na0Ij`B>%YAISYFh^q{$AGe)q8wKdJ z!o=2gByhOQta0QBar?p!#~Q_%z*C1vc|QJqOZzoMAJgz!OJ~9*PI8 z9Dj$GFLC@G(YJhAe04{a`Pzm z)}N*G!x300Bbh~X+(}*#-Wq->5E)^dV_|BF_r(G|0>VG)srDdejvCf)rR?y@4Gm(0 z4;*~1E%?A`^R+i;^3+6QlCL;$^3Gs;@-g>F!vp@;AE{R_K;VXKU!z7ZgoizppHh3B z8yK1u9;-KRe+c7|XT9Fu52ZSf%|f2S79YEIc}fdU?5MH8UZEHbsTa^Ni09=HPUC_d zfJ$9UC$g%74u{m!Rs-QrW5b>IoKiR~gB*zO43FiL!#oh*8SdoM))nzNE`hNwT;$OCCq{w%6D@?@soP$p5$;AUH*#w-epE&1 zE2Dwd#iXMx5MInEv~N7bN$<=v6BE4fh(J7wJ3RL3p!wPUWV0bG(e0DANsBdS+J#_! zI|F7=d+=9*^L_@Gzp(I}6H7*pr=N25Gj?ntKEhjn)_L`nWyPhzx%z|JDTB{Vp-+(4 zOi!`GT<5sP6^@Sth@D^xwRx@Jzb>!Z&9==@3N4?BI_>HE$Z z$bJL%L=>3J(GxorzBl&1*lFpW28C4Y{jr~k-Ge;?dk%J5R_cOZUNXmTA@(Bd_#(o?2yRfgs{s8t>*dNCJ81^Tz zug3l?_7?1$uy4Ws3ihqo-^9Kh`+L}TV*dpDF6=L1&&56yJ8hltn}~l#>LyZ8k&;EC z(+$O-^$8^%CsK+?sUr0ki9E1kctj%WD_xFAgGKU*lqXU^q(YI3L>ed3M3E+mG*zTB zkt#&05~)_Cph$B?x=N%4A}thYiAdLrv`nO%MY>I-yF^+k(gPx`66s-)9uw(FkyeZJ ztVk^)Z4zmVNUw;rRirmX+Ah+2BJC9E6Ond_^rc99MEYK&eIk()q4(Vl$9^I9{rLM) z?DV@1`?uIV&=1CbIrbUYTcM+SF81PgG4`pD7h{iLzXAJA*l)#tr~aFI#9y)B4=nXS zdb{1z*y$XE?j7HVo#M>KuM0c92k&j{JFpY>AJ{*~-iG}f?El36Ble%Mw_{Jh6uv9= z9@vwxAA$WS?8jp7hy7&ir(r(>``OsP0A~z#+7899>TycyCc2&?C5zNsq`o2@CsK+? zsUr0k=}eJ4B4vn_Bhp}zd?MwE6cDLUq#}{Vi8N89Ng_=ZsZ68_k*Y+h6)7mvT#>F4 zX@N)!MOq@#^&%}3>1L5`6X`CIR*Lk1NUKD8Sfs~9dQzm-B0Vcoi%6S9+9J{`B5f7v zO_8>X^qxpNMfyafT_Sxc(jJk%7iphJ)Z=Ikgig3JvC~H5iE4#P>L$9LB2iClz`h3i zzp&HxsPL3TJS7oNNtZ#QwTx-l=VGUgdYnp6NyJkU@svb7%AcJ_W18YAiFisPo{|Oz z%jGLFfV&dtAe;JQU|C79MC;HYqcEhw1;lCf^(^3k=}HuaG-_LLi26;$PlEemBtVKo zj_9{Nk(>!{O@c|GI|Q%|JCc7~bjpz6_TWhR=ilzsyR)zg1!GvLhbk7G2qd_vCs3+a z-uUCGU4%72Fot!QO48MpStZCiT@cwauwYeJW?`CDTwOi~I`}b{VZGXy75pOJ1oyWn z%E?d+xc$T@y9sN0U3od7x(O>+r$q%$a9@NYDe^}oR~#ZaJYO&-ttnd5omm&s5&Q5D zax=RNt4uJ4l}cBOvGu^7;GRrJ>~~zz@_Y|r4G@fBU7$78Vl39QIcx9iDXb#F7*;2( zA>$^v@5Yg8Zq45JemGQE-2`J;1IW zj?@kpZs>N=;liSaO=vq@SkF)c#C8OBXIe)HYrSAhx$=)<5-)B$S-pjIpEJ*xlQY6xMZuF{}w%L&mkzqWbD1tVx0~th=>_GGV2)vggxZA0@2&1!Gt> zT0`B;N{cMtS6Csz7}hnqS01fcXij9!f4#iGd$h0?3C6H~-y0xo)Iby5c{oy)W@q|O zJw{l65{zLDrtXN1UXqjGCTB>soSyR3g~tkOh+qusNUb@JS-JqO+nF6>yA&skBw>I7kR6O3WKp!+GU2PL?Ra3pK= z@vOYOpRisQjA7lUH7PNy6k)9rjA6~!niCzYfBmE4&J%^TP%wt|q}H6oEE;jipMKb~ zwf{-NS}PdCs?wU1nKc3iBoFd=pDtrg7FL~L3~QOzq%!Mj&H6*SKb$J86@oFW@zf}= zoq|2VeJ+kvUq4)S=?|v}>r%lOR+ZMA>R=5{yI{kq!m1ODVP#Td$95X_1ULCN+HSkC z{iD-_HApaqwTe0hw*J_i{j0yQ9ubUT9Yu~1+v(U7-1-mK6+eA?^XbAmUNDB$K#maG z0PGg)>mxir4G`91!5G&4T0^bfVohH1@`q;#>yLsltZW*1u$_rL!L5e@*Wxude#Ey# za@e_oF{~P`p_N@Lt-BWOe)B9zDOVcj4Y!}>utqBLfi zT29??`(tUs`dKiBMZSr)bnFRk@^7@Ip1<(8bYW57qb=QKSk*f93}~J0Fhf{D!5G%> zbT6P8u+`?DnQ?J>rm+4X7{gktHCYZ;w_on_WeKZAFou<;J%2W{j5YGzn}44ztQ^4@ z)|YyAn!~K&IFjXOq$Tyq5!QEtF{~xJVsn{AK8Lnv?itvcE3Bo0F{}r*<{V%X+~n

-`c;rFX@Ik`*S}=yS5*XSBV^45jgCmU&jfcGY z)nH*g2n}t6rIuUxZ1A!{;ccbd}dA2tVgbXzT5f2a%;<ED$2gmsxgl;Jc2Q-GxaQP2(ygGuFv^$+7Mx-3C6Ilq3Xdl6nlbOS0{Ubp~6}u z7{j`rOolBFdxD!rJlbA3H}qDXux=ELVJ*?UARpKS_d*=0zOr8UWJ5l)=$xpoyrc|D zd>X~DzSXQ@&?dNbHMnl|W_1}RY5gb|!=lH+Xrn%o;C=wdF4*($`|PIS!m1UFVco9H z7GPEoN6O)myZ%%VkQ~;Qm(PUK6_6a}>v#&FO>p0aBc*jj?#sOkBrRHJqpd(#J9SYm zfHuK>9gf7>;I9Z>Ags>>V{&+rj^{#V71I&>3&W1hxlmY>1tTo&MhlrmXJNGM9`fA3 z3N4mk4C`pE83C+S%YR>f%eoQ5>L(b(nyWPTk^^{-?>lUpU!z>#6h;>M>dp;W@ ztUCo`So`!$cr3FfX;yCS($!;y^{ZeE>tWry$1zJc0@uYke`y{ktS1CxSkG$BcxFx3 zX+6;CqI<>*YlC16>oDDSCOBBT2CP4Kg0OlE#;|(pOkKn*Gb8FgC+(e!gmsKy3~Q8j z6%(07>%vrlGtYT@{6uDv2Ph5JRYB>R$UVjWVZbk#^$U*Vgj z$O-NfaimT#_V?+3zgY5flweGLo}n&>?Go(PtZ8R$PVf?8trv`84c75o%B&hBM18RP zF*`25R9HgAM~jkwG*opsjJeSm?Sa(EEtoY7IIS9sKyiA zG>fKf?8Vz2oh+=)f-$VH*3kHp;7(-@N^wfzl~aUugJ2BnEv;eCeHB|7b#plkMsOxny?-gjA7C9rL>h|PjJtpBlarr?*vlh}3d!JW6oH|`t zT?J!UKkAasVAk0%Al28JjLw(L5Z1p0V^}@4*(#Xj!;!YYdv)OoVI3|Q!`iCdKqasV zZkn;vc46y^k(I)FOE8A@<{=7q8GaJnbS_M16kng#^4w*@dRH)p<UR8mQZIHM30H zm@{e3x7EVR5R73JYE6xUb?dX64W@V4c>e6IMhphBZactm>H+#*s$PJMLflX}z$@1Y=mA zQHRGC#Gc^32NW8Y`PYem`2f?IpKfC#DWUo9-tSFd&%)+l}cKA&0S zGpN336=J@y#tX)<&ePub8fM+2StGr7?7c=SV*XArCO>()ZCuN&iFCw%-?$auUn{H&1Y=ki07Dy%9SQF5=!pI1 z!DSVV!YYD>wnnj7no_uU>~OEZUu5~SN|#qG6jqL4Oj^5i^(;b2f}8URsc-xJ>lX>@ zYrz=SD|&QjVpbDOK~8Jvw7u^%32U2R3~P~I8Cc9L(=VnroORD)VMPRESfjLN3A2bx z+w_&scV8l`@q#g|NxCk`7bUm@$RQ~%>v!slVPQ=ZjA3meLu0!RyR}C2mo)_+UdJq& z!OkhE4l0ac-J?^FFe`-uvF%&CW?e+mdO$FS^{m!h53HIE66=rShoxUHtPO%OtWEkP zzL{B*aHMv)YTWMUnuYa}V2EXJ;a@U~S~ykd`=!V2YL?mQ$-3b$WsGi=uF|r_?Mo%* z(*`wq=5eF2z>}RkcH< z==@FU%w(U`&1<(wZBYMe_&p^K)nSoqMCO9utgVg?a#l z?I!FA?g2Ow>%u(mD>n)2O2HV`SgpC4Sy?zziBBq6^3R)vb+KR!%cC{7Fw36SEyBtY zjA8w(JtTR91UJnDsL6LOnR@05VVOmj6)s}gTg%tXqRJyXfANd!#uZ}cUv*lyGRDMw z%prxzw@S>3JrRiQ)|i;Tf!3TjzR#E$i3aF8SFY7-OGIJ(Ib^!TR;fHRJCP)*!(c)@ZG{)4>`s zXGrax!n#N>hBZrT?qb$iIMR02s>Qe5C9HbE7}jMp^kKUjdxATkWz1=B`E}FX!m1UF zVWn%&b`P`2R@5^0ojLTM_XsOjFov~FuO8gXEaL$_zkm0rdxeFIy}aEkmakL_*Gl{* zm_<_8f)l{~fdz>+30Nj{lvoo)(PB;d{E(-N!85ym+PSK4E<< z7{eN;{o(yFtowy^iC_%tORaf;Spgi~*e|I+=g$ua>pQ_1RyRGY{ocV^^2m}~e=n@V z1Y=k!y3IexthaC^#Y11+-Sa_Vohlf^8l*LUVAcp6sh0bEzoPmN!tx8ou*$mwgl!de zYmB=yrELEyVa*hbVcoAae{`_=KXdPUe-zdq1!GuETJw;DHEZQZeI63l^@1_1O@@8dPgvZ^^Mm26q8Meh4x zjj-shUE0>T46D0tEo-4wUX&nPR`ok!t+0{>V^|}!=9w7QGr}4x7{mG}(6l{^J;9xg zBc=7>E4`k4R#^L?q3v18;rquc&2#v%a@e`_yvFB*^$)?Av{H2H&&RNy7uKnQF|2EJ zBU;BS``m9Gv+C=sifd-7{H&84-qJ^DT9~C9H{V^;B5BWg4Z>P27{ltJH5-|gf+KCc`(@m)QCPhMV_4TJm}?V$ zt@De%{d#`6Nmxq+V^}Zfxx@?1qDZM+AG~?|Z7&GxWx*KMF0I)d!`dvYuLWaRxFL?W zRtM|-ngR8#!rChs!#Z5Yvn7VLMOb|WV^|OCcwTg{{*k!rt`~*%gkTJ7tJb^}!+J?r zZwbb*JUaE4nWckW=S=Cl{AFQf3C6HSY0WDRR=29bYhMx8c)=LfP@0-!`x|!4AJz|^ zn*BFn6$r+#c4`;+Dzi+RUpMgLXI>T7XM!=TyR_ytW_fX>wlU-HPfdDFSoaCWuqJBF zR!3T||MdRqt-_ij7{ltVHLp9;`rwxSg|7?i7{M4;q8@X%G0Rx~{sAvNx=mQ!1!Gt( zI-WO}H3&y4*QuZPn)8ORHVekEuF{$}9citKbo%&BVO=X2!^+W`zdO=e`R>~}e;3wy zf-$TLy$5p^ma+Wu8-8B?jo^RBS|A{fK^P|sU-Fsq)9 z*hlXhHF1ZqJ{62%CFnWQd(1i&N7`C{{_C0V3F{ES7}i~SF7ZCF&h_y3g>|1`h-E*6 z{(xE3n#}eAvj)}&>nsiB-_H6FK?!bMovybhyz$eA!op*CyfMbX+R3cbRIn@j>ub;K zv{-3M%@_ykBWBSkMBBU%{&>nq7Asw88RKAmjDQ5UHnHokg^Th(wpcWI!NwQ|>mSf2 zmGWQdUm8DpWaj-shu#P@%YRab;izYAF7~^1l z25o{{Hv-p($FKk4GmE7cPZ{H2eaqU9QUP3N_rTdZ743HOX*ch>SQ(ug&R{LN47 zvRGaZk@(qC)wnLx-FG*$w1aT{wQR;>(zsl{>E$KCfgYx{w^LfQZSKK8d{A|KW8Y}a zg?iRRdWAVJ2Gi9PPB2UKeBNS}#%O{n69hrb^)rjBL$mk~t)ZWh-RzpulB%kjQoDxa z7F!2WIb0T#pM5cy9(vTH7!>P?n39${;+a)GtF(3=;nmj3HFU_>;>zmEpi@&HteInJ zNP0=nU`bYKtv`xnwJFWhF;<rH_wHAt+DG4}Z&M$;pvPU{^p zqsPrIsS1@-e6**sZJ;&5$V4mPr(09$s?yML6Ukh~v&-u$r_Zwm#3(7I89>%o z&ZsV~omp#mp*Ey3+ExAiIlTRlPS2ca@jc)Rh%i zmCS?9$%{Z;JS{YRy8hG3Ak{DdIIRi!V+w{{TwLTI;~&9V3nv(rANsS5(kh-+SzSCU z7_ybnG@APIdd?@kSEZ(!pP07dqXrZQKwXc5c#2@5$--sj(@R2CL3TPdpTX6++T(8CTHKjA*d~JZ5>gw{+ zAUA7xj*_YwsQoI^APLM8i%Y6%t96&1UQ;)#BLf&C9EErUkLSeYO`4ftYi!RK+Sp8)s zW2znJZfJ~DA`=~TU@}Pj5aLl5U|mUdJ()wdf~W=s z4_^0gftB^eOmf7c8$27DvNOo#{ppf{CJIaRgBdKu>|oai~?#puk!6GvExWs-~4-R4$!{E;MEg zCixgp>*{Liq718ajNm~s3IdbX^PGWPfj1rFBRAPP{xi+`)9RPp;6rtFR!32OrMxr* zr!_C8)!S+-R9{&=!`8Bim<}IVRbGP9(t3v;J#8G;&Y4zO6B|U!3&r*zs)FeTr(GMG zU0Ka6ykZRc%Br$r4A|v%8kU5zafGANZIN>%4np|N?2V|DPFb|N*&`ifAnj9!Ok zmBTba^u+i8;&m8EY|3PZfPWhpCrhF#F0Pzai^@j=wZWQd9>XZYy7FM%JRD2vp|l!* z2(v|;nv&my`$BIERhN<{iwl`ugIUo55fW$y6+K&$S)%=KGDJyPnem0H)lmB>o(9)y zke1o080ZzMtJKV@r4iN2Dy2vWxTYwrsV+=ARr`s9p&C0-xT&-QVJP(jg-bp#`Q&!o zQ9ce3F8MeBhVyZNaFY*mezDey)!6M0hlYWNtZrkYu2Awy(`Zah@F2u)ptPbSI@Ci+ zS5B{_mKPPu0~{H$0?r1b`pj|+0+ll=g7lU{TQ}r0}dFdt=KV}s=vdixecka*636@h|gYC2rZ$Zx{J#%50zB0qvAoH>|b72 z4V7hRHJsCAn?_zt?9qe;05j2TDaAa1)#B8qVy2DC4g{&C z?XH+R5%(8Ft832|w=q@62(nejp;Ql*)zfR@#ZAn3VN}|9dgJ(O(Lm@t&zvrIkZnpj zhykm-w5%dt^8YT}Scu{{a18N74c|Tqv{{ytj}t_NkE5otn+VZHs%or>r7ccVTL(s% zg4flT9LO#m1e;vcVxDbtqc~Npu;ql(I55J*quUP7)ng*)Ajp)mgJ4^ORFTG>w^Qyq z3M0BbGgKi+iC1oLijCfBD<&okRH$ zh*+ztX3wHo3(}fl%|lD-N;A|rL-S=@+GK`ME#_TzrB-l})w!Zwqh*`{(wwalKGPN- zyENsIm1sE&vX@$O!72mFYGYAQJRRnIw36WnV+-&sOr0<3Ksuj^TB75*ez9`0D)tUR z>~3Rn5S2??J=yY3RZad6a|N7a+e<|uGRKGw)-BM}0oyd~+E5+(KzRo%a3<7g=2)$X zjXgCkEZ5mHs&k^;c)UQ=k2iiOl~K)Os!L{-7YFCnmh*5st2|gyQ)c~5mzUIER!*JV zI0Xa%^ARi+P~1+F$JOh;te171p2J4R+_n@`bG81^A*!s#a!jsK=!Ni}d6gy`)Cxnj zSWw1kJFUm@bW=A-41hIrFmJ>Z7Y$DOJ^J4ag|k+QV#B%9k!5JbEL2|t3bopFOtt2! zOT*j&sL%8D_Bc(N^%&l8m0w{jlT%G|FbxG`^T&=Y7&THUINkh-<1p=W>Ktn$%(bH9 zKW%Qp`kT+7`Oi^9#}*Zj$sb!(kY`INDk9SYbq&tKs;jNS$Q#83Q?$4UlZzP` z7wV{m#YItW{yk#ObbH!VaHoc1sf)olHH3+QKtU5ziZPUV#&q!sYi~`a1>&p6yXs+_Val**qt6_>It4Xs#=+aS1 z1wpI;Dk%>WDu7$Pqi=xeEv~FBE~ziI(Xir1t;wb_)oUx2UO_6I76-;Fyaxi9HP70T z`uaIITaAu{GXC!{RB9_fShFufe+yRD)7fuye1wgOkLJ>Ke4*d6nCXKD4W^jsyc$a^ z`f`KK9tR9GNp;93BXk(3rU-FUeGHK@8q` zoixh8RH!H*mN27LsQuj_1YPKtf=*#1zmI%Z{LaERBFk(l<7Zif&q_mjjH~w?5Dv z2Pw%#Q_s%L$hOBrxME;xqjA|;InlT)fQdxoGP3n;s|ro=-2%*m(YRcXb+-vHgnJAa z^Fm+AU$)n)Vp2!Ky$sxY(eY)d+d~bOaGwG5V>B)&L*KM&#Ygw49Fw$%?V_7+^}Haama&QwI8_a?An--=gPD@|PZK=Ow`09*xV0 zE${un;H})w_;PY$>f?D}UW>+M#p2!p=8I@tW^6gW2d1;Wu|>*}8*7&&V9Z0Kg3Hd0 zvGV}n%wwX0%gl*sfBC?f+kym_8;hF?+~wG56I@POO#8bMnCqi)nVy*ZtpMf^(YV~S znEX8s%!X)Oc1BD)cmv~Zqudj}z0Z`^`q zUd(Ob(z5IZB;0qvP1CnAS~yQkIp}c^Uor^TEL>WyN2&No@jU{}3DohhSvZd;I)B## z^Ggga&EbeBK6=dkUF@`3@ulb5D~@mh+^V`-->z!m($e+w4a_IpslD-XAMCVQxD2n| zu@NruNW6XsJ8c%u>lhda_c1VI`Y_CfOV6-3e8RN=<2fn{m!57fhRcWGdo)HNam0Hx z?2mwuJ{kK5z~Pp=-xPFB$E<4)HYn-o_15>ikI}6X zAM#!jaIgPOAM&Q}14`o-f$o$Y$9Wonqq3hLl4|)EKvGS1EF_ipsgP7lsDz{pMB^E4 z^fmEL37u>YuPFV0`bhn|3A@{c$uNI*$?Zykw1jp2aSXHM!SOnlXf%niDGC};)}nCJv?0o*WP2ts8^lZm1gOiTidV?bNi)~$ZVtW|!i*7!P|_G-u<{3nmpB;BXuUQ=CkG;ERS@Ey9;G`r#k_?*qFa4KZK*g2@Av zT#mKW!y@TM`w?A-Ma6x};#IRW(NJDU!ADFT!hNDauD*_Iqoc80<|GC=AUDX>&vErL zT>YF|ztlkE^2nZU^>(YQV+ zi))bMy4BHGuCtBn9I^`fa4*L-+tFCAuNc>vV}e|JJFZ4YW4RtMuJ4n@wU6WCg{n0B zge+H;aUBDuJ>1&YaV>H*mg{EYI)_+;K8!i8uR9vcwcNPQwnLC>u;W_kXe`$zgBg;= zHNZPh*f^wi;wYq6stmw$x&B;jJt=eTy`F_Whq zF2`ZwBec$JhUZRky$qH5V$7Krjyb|fzSU1drqKCj13!26dt5hU27h#<*Rel=b+Gga84sad&$bIuiJFYkUG{TiJayY8&xphz7pTBjS8(*3>LzOx!vpH9!BJLNUSkguC01!p$dY`uWpOk!vM}ts zSfg?l*-!jJXXZS{LYGd~nWHRtDUxonVFc*1RI^XsY^H~gi_9YLpuJhitxN9gM?iuu z!n*V-ZkH7?enfy$)@1nzec$T4EQE@}B2C@HuDoWmkZcGI$ai}c#T)*wN^d)&+es)y z{)LRPJU3PX>E6tkcfJJY3tl_$%5DSWR zYg&MXvaTqoEX--SCp*KKOQy2*ZiAKOIedcnkj150-ot`3IrJo8!Jy{Co1o^hazV{y zX@i=}&M@Y(Qnuc0a7aK7&r@J9(%ELY!A4qGUJ}1#&KCCf*{h7owbJY< zMng%w^914?;BbN120Kcid+|P6pbdDB5NI>rY&Awh+wdMK(005zA`=b$32()H0*GTE z(NKRRq~dr)8hwFrMTg_T{_N*RL#H|1MSxi5qoDC?*s>Hr+*df?@Ze*7y3QJGvc{EdXE1X%FTt~zC{H;Br?K^h%I^%wNMz(&G; zFX|ww|72vL2@D#r=taWB)7-vx)CL_yC6_%JS!e=WI*3X<%^#on&WAdPDqN<_3Qd4( z0BF54j(w*CVJwKFoyxTRct&kJC<*C=>uWcJCD zNSviSnZ+8FY=R}o-nuzBX$uEV*#rBQfL8ZOun}rnY^DXYU{Ni0EGxb2#kYqPabrZ! zeffdCxZZ9lZ{t+KIO*fnTn@KST6XD|PR`5wr?qv_*zrYDwX?QnsmJAf7}}^4=>Nmo z8mpQMj34+j4bK=<0ben-HGj1s&o7_vi zD0IbvMZ>sI9V@O;%I;=KgK_c-1B-1#x546m(45Xv0z-0^MP~*BS(H1!(#nt%#YHF1Xns#1W0z$KblvW0j7{M|plFO&f-9iJ{>)O|DiO zbNtdAbSIA=?+>oXyRHWvS3gUuXx3~riSpPa%Ck)(wm8z8+BmTyb$TNGNgK0Qe+__CHmio{pqnPo!T=Wa1M_GbJ-@tD&WR77>gaL8aTiiT#!XUAv7XU5OdM%*azaXkG-%geE~X;74p;%o3I)6yP~mA-@4R@GWkj(&5+q6!2#Q4#*wv}BXT zpQf&EjTR@X+Dp?*Lgne7C)1yZmy_wv(#(=jGW{f-iickiA20%Dl#bq6yk+HiUgJ)h zrZ%l4FkSnF-%5+4@pLKTIDGMl^V4r4)kd+^cX519{E~R(oGoP;#EU2M+6SASe3U_| zKe9aif(;ZJ((&}K(ULt>DC5T?4N8l zDBk^AhsI52`Y@*UMZTO_)luF$w0~K8XMA+Kgccd>@-T9>Hrb0mL)<5SiWDh(E4_R4 zo7enE0w6&N-_590S@de>NFGTE+Ge+7PUtoh@Aba!_RO>YTe-v!n> z&c4P=`2P5v;uWD-%dviH6wvog@%jZLA&8at5Tf^?=xtiiTPMoi5Pp zj&2}yT#4XL0TdS~0Z64Z08-u?0V(e@&UQPX$- z!d-pR&w9m}%14W__QY6}O+j|5hedPE-$96ilVk+G?j-`cP0$y(y#^`Mz&DMJ&<8^K z=(gyia9C&i9z zh6UxNF5CmV^-5Wq%rAEh_vJMB#^tmP)F54Fl%+pUWTsCjO@EV-&~-{2c^XmE(eOCk zf+$_C2T2!T=o(1F-JW*K+&oD(puj8%I z{*a~6(SS7L6amtVbG5_u(9sK}qg@KEobE`!f)Y>doXl)o1HrM`?Xl5i+wp8GZ@Om0 z+)({suR|ScJ`q_k4m{3j%>zFD3uxMS`a}47ppmXQt=1u?16B&~D2; zDa#u-ks{GiIwFsvC>V_Bq*J^Iq{m|G8%VYQl?SSkc2W%}vGzFvJ_a&SB{eg8%R8R= z49Wg*IFT+xMb(`uF3+sp3Ja0WaR&`L^+YIjSo*D|4-YDMd9O9h46$1_C(<)R$<`CT zTHf@`uJX)zBj#2>xi5^5el6bg0d(Wy5jDy1?<+>{NVcxnW@`mT$o*h94#i{Z4;055 zRzPVVZ?H*dygW$~8zJyZJ^i8?kn8&tcYuWCCmn~|1rVQy@IwD0W z>4#s1ghYD7cKoDof0OTre~C9@&*lVS?8>Jk0kweS6|{F9Cf_D8*A*f2$2%ICA?U51 z8EDI7AX(6&p<29kMBo-cswdk3m5J^9cuy5*FUXlD(D8s00-Xv-r7QweF1RNFogoml z@|gnt4G_mZ&^bq*QK$$|h2S`IuRgdE&~(AA2Bbw#HK!TFa#}NyxoSdb@j6CWY~5>k zCyQ5a$4_b>)nI*M%}?R8_%_C3tmP5ByO}{luJX)d<#~RhwKA2=jHONN$OitX_J#AI zMAht?L}d2d(#*7!L~iD+)aXsI=2qCTz--2Ecv?;RtW>=F^?=;^HlN~Y0GZ7&l3Y#K zrn*yS#-F5aOEh()66w#ZPDh4Xsf$z4Ch9uOC*|6nQmiIJOSEHJ3byo%sgF}bJ%RND zEF7#?G7ZdHT^r)*XDvZXd;N8E_d86r5hG`|#UIUEvz>l15vhwgbIFt)iv z#8N+e47V^sx&yIQ@Up7Aax+W{x_)-Zl%z67-CD5&`2LQ6J^4M^o_9MM7#6+EFLm}%Hh?n zvwgwZ1;?xiMkn)1e8b6jca8Lso$C+1BO3)WaZCnw6R3gbY&jOVv++bl1)d|&g?Q%) zbQ#{~3Um+N=Lz&A-ZKSy9`9KKF`p^)F`(IkI|_bC2viG5i^~c?T9{e^X<=fXKVRsm zU>THXXeh#^bi)BD-3frG*rK5VKoT;pK1W(4N8p2TVfMrNd#t5s7QfN-X`lMT5}BLUfF_Y?yq7=e zpQ6t#k&FVwQt#!mk~PwNA+lu6!^~y`nafi9iXw#yWWNjhGz}oW$OoZ@aXBE3A5}3> zFxr2Hf_b*Af7mD)hCzKG#VR8Xi5j5|%W!-HV%j!8V$B^v3gdgx3PWL4ZUe-^-n3y9 zd1KA2hi$o_j`)oVDQViU4N(jNc5%?k=LZbSMCTl!e7Tgl%Vp;OP8pp(K`WrEQla`w zIvI?Ane>yXg`D)%QYHyg2EoV-Xhs(&9dxbbe-xHM0oUrkY9rQV3*$7Z0++gyhQ?cs z?_LYtpB~`1r&l`~cEevxFeF?)lOi?J%0}IMuZ7c_L>fm`_J^RZ)zFn|$b~k==tR?1 z145~z5}5`jeQbSbLAvo#TDqCD`tNt112$je`=g_C9PEw)!$o+a()_wupiA(cBhZ)e zR-MA!s=DGyKw5fV0Hh`QT|inE4ue&!IuN7$ZsPpQ7)F zuDrBl%Ap0WN`z8-Cz>`gH-_p9x(>17LKx>utH#5)v!voJZ!bTF{q-yJ zkn!3>rLk}CtUI7Iv!aH`*v;)_7}&dc^MK9u1-@XiX>RpJ{BdL|jG}Ev{GIRbOKyRL z1M8PSmv0rvo=eSBAHdn!EE6arw25P!%S@TVM=O6&o_^YAYgy{=%0f~^M*~IBbY2B- z*ueK3!Wh|)rDVm<_!G!+zD9zPc|VZWq12T`Hf>;e4WYg3E9essjI~_WpJN%)?uoS& zP^^Z;iHJScUW!52=J#{hO*|mhG6lKSdK2n;T~!o*f3Pn!W@hDt#wS^Qa;>A^X*!r?){h-Xg#hYR+H^R>&L){#nLo+SbQUg9@sq)NOGZIak zK1+b+x)g94C-J7I`Us7V?P)#hPCb>C%=G$rFdxA7GOn($@VBxuG*ZhXCgE@0d(yifNAC(pE+j z!@L{ADs6BJc_PqTB7xwI?#S6&QU${9(t3zNcPW}c{)@Go0r%|~WXpG%xil`tRky|> z*4#)g$)#RiT;gzEUc3M}F@SmW#tdX~esrvA#t$L5ZU~y`;i}E1j`1m^8LJ4(6F5c0bjEIz_w@MCC|oI{he%v+9;4g|3gR0+yQD$|F~+bnbR6AZ==cUg&5U7 z+ZN3eC?hj-r{v*I4%0I14}Kho_?sBYP_@6y(W zoqs|=nsyI~$G+NL+Pt~`pa(*E$UZl3?z{8Xh_T&6Vqa??u&qAU(MUN6dZ_c%pi_S% zjumdfrjqqj+ZZPwZ(`LHYx$Hpr$@-RTfv~q zP_%YCxZl7Ug7TgIY6G71%wo^uOZI4EjP!_SwD`Wan`pC;>TC9CRE_NK?fP2c#o0lK@Q-TTV7=FYIf8ss)DzxPe}E(EET6 z7u!+DtUBda4QPSjIGD}8do=VlKsxTjMIZ|Wx5+_V)~dYg0C5mD8hR8EBMoL*+Ft=p5xV`+OuSs6BLT4wg)t~VO9VO#kotZVAmyk=b6tCwHv-ah zdk9dma6AF%6oH-xbgDpq0i;q69H3jlqoFcD$~zN~rulq_Tj`+N9mK;omF{6c>X+vL zEfY8X2B=1$fdj4Nl!Lwvs9bC}IUEm#RC(_K(!TYPD0dpR69MV?*hPReEn5Ih7AZFY zQr~|QkV<(J(9vSs?rgU?+xH#ruMXFLFUxT>AeC1HNaam+wwE~QOOEbZKnOBY%M8h5 zzzkDOi$~-qbVS~pVcY>S45V^cBZ=un7Tp7gG1H5w(8$iA6MevnCcv z*K=Z#B2lXR6N^-QJth`OHK4?33rqqJ^SOKNn&1prK8FgAg2>bGL?yM$1iBpWsRDf! z?`Z=42=9bIKf(JTfwX@PY*} z^_$;%&^uD#&q6^O%XPGogW?7*F4Y?X=)+6vuwsv{(u{UA)`uS%Kcm=yD+NMi{m|Cq zzH*;;q`+=RW8I=Aqakf1Obvc8pbzgmA4Sc&RZ9Yxy_^sCWt7A0jVBU53UAW>cESa% z-jM=B9gX!NbuZ06c(CRfZ+d6Jx1Kn|J5qq7f;9U$w~z(IFqI-W3}F>j4JIQ)=zq`+iHLm&E=3GN4*;971yQh=+M4O2*H0$lqG*HA;SSJCCy z>yZMo=D9%8LL=Z_Cby8@b8Bnf(oV&AzSbz{-|nKAfhO0HPBDMTa{Z}*>!f@e8qc-APm zR~F`IOMqXsJk=Le#c+VnnqGGha0$O93N423xLp?;om0Fx*KC)zx5e1q(>?C1lE#I% z^Ps45{-QcuQe3qV_otxQ;kT*7Z8Ov8VvK ze9M3BvFu&;Z`XFaCwSd2?o!bW*ZvscJ;wBf|CTzr+*oA6LEK|uB-SrjfGd0jZ|@Gy zwowjsEC++%BH#_#{XJ#!WNcEcp0^bD|LXm;+{&?ZnY$HMF5=}54_?nvTTRW4NYUF} zA+G1eV~j7{pW?0|twsoNYb}`QwzcUQNlOD+rq|mZ{oa?W8tDNh5n_yYMqMg*G@9sg z*X8J?aT4XhTM>IE0yd{iHkauH{DV;Aj#OSvM-P~+`i9IC0pWC z#oGm5t2*g3iEk&HMj^dwZLqfk}GI@&dYZ%o2DGPa7<_rb1<%%{Ng*P3W^FRxE)kS zh|=DH@tbRn`j+H%sysLFZ`toWKDbk;6iz>l%4mS8>R7+YPMo43-6~Y^$AIQRwxwa% z1lFBB`D2O%qc0Ao&PA`RhJ7p;b}p2zXzW{Y?gd7&!|?#NmV{Pmz2 z!hRGCJA6VnMn2tZ2;7|wnuY8+!8mt&-2d_w(D81IY7)SB;V2C382bV24n`kmEBiSx zbY8;|yg!HWcLI7fHSF2IxcD1Cp-?gU-WTq!1c4`l z@Qxc63N_%Nap4_5CO~&G+`SnzTi9=g@xogW*weNQc84E=bLa8UxbPMi`MoFGfFA`- zhoOUb_1}bIf3^=j2>eT+S#c<(X_r&NQ9Rys{}j*Y*a(^z4V{xWHn6c#1~=aVP3d9E z=lqB3rxc^_gCJlrXqq@S3}f@Dze`Iz-T9rN;WrI;zMVWSkPXzL=iBaRbNkuKWr1D= zrXlw(cn-@w@^p2c8;yUdZ3<-A`2kt~k~e3|aNt-xqoGlFpDPd(Z?-_P#X%SJO^^}6 zB$o}p!R33cWzhtdu;&Ff#l)Il10R?4d22>u&2J0N?MISHX?BVe=`D6jn)4x@K&9Ig zt%@-orj7y0OsZor_N=95`A#F)0W!DMp=o!&`k`1TFGwrw{%}2)Z`tDuFrRWD z)+!7Tn(~fm11P{S=y?a_nV9)jLFMW3$@J+R(0&h{{E6^sq=Lz%z-j@o*)KcE}9IgvcmDv6T z@A(4p1PQtw4J~(210at#ll2SU#sY*kR#IIv z11RdNuE~ka>U#ksGbIa?nM93GKJ^r5oybq(=D3MB zay+>P_pxJh=I(-BSV6SgdL6NOn2kzIn@eo6$m?<=-)g!~B=&8{C3DL_dmh|kGDc+) zvWDbze5-E~fYjH_&+1n*>A-yeW|?lw%c-J7`W0-t)6|5g@C{#VN~C`wC}2)8-qfk- zbVt|mHeGg!qVv*e7n7e&B#I0HWD5rxFp`{aTYLz zmIBfsEC;07ex}XxI)Q@afC*-KtP9lKPCfSksAc;FwB$$P4Wt1qnprN9mANlgl;D^x ztR3|=^Fsmi0z;8R-F`uCel2onh1L^gA3Dp*F~}B z28iiZA6*T76l-n)iRh#sE3MHJ%*r*x0w;Ocxas! zu!mdtU0E*H8AXFJ!~a@1Y35NG`Bgf38V*=bPhR)CJ| z?x86$Kl-dmU#Y{2(Gamk8YK(`1SwsSb{cA&i9ke9KznwbXe_9h-U_IyF6`g&nm3v( zvMnXw6u6_|>6Cb!YD*(=3LuTd^8jfivK(pTu;gjvP;DvhdWT~IXq4Oy$QLF5f_A3* zWR!E2dPaQ`i1aVeTDYv&(m5A}GPRUNw1pLDucgBjjrP>6tm+PpQd8Z{v+3fsAf^UT zQUp;q^=y*Vf6q_mRYfAl-(;{w?Z41gV9M6x@o!%KD!w(hc@OMC3SWKPlTL|z*GL0RqyL|gt+4B0Iw-v60o7z^;+;KX-H6#f@>eurD z`SOY9D>M{h==K!63^kRn-5uMm_8RE%4J;3~wvv8N{+umG0Jj$&oQQ?D))|3Zs6~H| zZPwYn=E4iuX04I>fsHpWgTy!3M(Z-@XJoX3m;H^_j?Q%;w_zyg_J^WBY`PZZwv&8V zk<3g(6ZR}$6E?mCpn{qLB9g+(h-{8-owqIj+KGxg}*4{FHZ0&Whl?Ku+0-)3OtkQc8BwGg1LSnnlSA)iyw*euwsBP!R zn%@s$Z1&U^qFO_loQ#%?uPrniiAq)XrldA{YjTnVycX)MTy~B7 zV)15Mn>nNYXgKgiT1RXNX*AsFp!)%7gs`XKi;#a={i6x=->-k>_f`y7E?_HYg|ve1 zf#t9(p> zkF|VU21uJpEFT)x>`-cwz5+;_L|i$cNq+>O+_eveJaadHytvC6D)}!|JbCcUm3VTu zgXY0TJt(RgTd}3dqs^TdEU6QCVwmaRYB{a21GSQ-b{K$_5(?)Dy=I(~q}XC0&DBz; zo2FU=uG#{7&Z1tM6SRM=l?H3LQ#FUE4N>xoc4sFg5+}H5dptD))OB;;@>_;zn zPUB%e*lRpwH(fEz^-^hCkC8PIfGu{?@^Yc{#yJAIouSMf5-ut|1h&*1QCaA#UY?0> z_3|7*>g65>1?ec43=Q#^phS8r8xYun&~z_Yl9}ab#LcZKEBK>$65|3D>32;kO6pyv z6{Jlgq~~%FD-y@{2q}%lQ^{?ZYG+~FluA^2%|q5JQWjIEbYU~8U6TIF4KLQnI8sD z!z~6ef~WAjBd{yWI{mz($umojctQtFUp$d8=XIH(>-!vxwfB~br>W5N4dsbU%nQ;H z7`6%{Vb1chVLSKOKd$qZ=^pH8tXpT&5g6v}NSMV?5W`1&-CL%6wxh9JpO6J+0G>#A zHQwa^-j|O#$Xlk%rUs3-OxHLrGk&-&$oTN*i|@nqu?ddMj*)Ai3zxmaYY?!JFlUDu z8#6ZjE$l7Roy};483Znk&i=;F%t(>&55z7MYWT;;w|L8R_i;3qizD@|Nkc zSw*wAb8BDYI^#PM<~%Z??`^61zPC(wsH3rNaZaCRUp!vSA9K(*i@jyKc2VxW&aMA2 zxrM4e5()-=`e5PWj5Eva(eGUPnzu~X-k9Sp)3rAW4G}JF zIUygOy7q8yneIs@4u?1&z6EL;rcxx#78FS)HQlz+yZP%KU}*MpTqhVG?hkAPH~wiH zZXMJT_HOJO5rr`=C2)&#&WT$r#S#mFb=(&zos!WkHaYaxDkAp&bnmmho4@XNG}edTG9eu% zT#OSq7nHl@un^~;_H+4@oxTVax{5HZ~W9?Sbs&r3?1FN z>Ai+E-pyYxIU4I0kCUM}6i+0qH5=}Juet34@8&PNF!fLu8+LK;VZz0kahB@scWm0= z-Td_torgILT*1Sx*~Ie}W0OX2{_-#U78+WG78@UOY$vGaiNV}@&bx{(FkGZikVo=Z zqnNo_7^bc@O7rV1IZLy+9?8Pk+rcPH1*|lA!^5o3;+kNcc3g#7TqRi;ZYH%x!JD!q z*P3)EU7rwF?QzYjHHyhz3O+bX@{Ix4DM!}d89{wQ^9vVMo)$L}=u1$%Zjqv_-mSsP&=4b9?$oKNztsPoU+G6wEv&A(yb??E zu9%mq=8DqLjIs(@99VhjqGgpc)Z$FwnRvcWbP|l{3yPyFhX>*9_KGSJl@pN?lc16!mY;Ob;zuu&9bjryjPPlKA{^p~8}36DpHg{7IKB2s>6}J@g(A zxi^{um*OnpGEy&YusFH4dVyv^17|0u&rzS3dW6dhfGq9Jmg40gtYcnW-9u9Ewp`nt zm2Gl~2quEK!Eo34X&K8sJZ=)Cho7vgzOd&e{BKL^;b2cWV(s#t$g-XWXrLFig@(Txq>^1yK&ZbLtk-3=HQ z-mw$%6{GKS@G}}TU+GC#7>K^m2*h&>XdYm57>3cU@lqT}k0*eC8#K4GTMNS|61u_( z{zjnO0`w|qb{IP6zrw-*-6rsV1e!o3-@_LMgY#KR%4+{k3~P@XreXO{=OfU61Uua$?!TN}E&|AF&E zB6VXplr|j$emm%BS2<1_8K}#p01eU=I0fy1W3lEggsF2C$RMacIv({az#MD76lg1; z^Fn-xC>%uhGM4b1wXNyXzH(PqEV&tnA;nhz90J-n_J_$d9-B|lLu$^P+FVchwm=Jb;0;{%m zyu^v2ogB_?YcSujb^Y;~%#{%lObf@>Zw1SXv0K|aZ?-(v|JSZ8 zc#cuGHPI?cCA0UMuFH*7!8d(kqjVEox$=ySjLt+WJL@=&IeJ|pyzR8^?FG+mAfo9X zGgh3~RcI5Xz3G!k?9TSC;Tzjw*|q;hMt9fV8yoo3SG)j^eHgpD9Rrkdfd`^uShW5_ z^4-u6bA9+8yr#Z?ylHvffcjrZJisost)P9^<~}%Muj^Ts+zEJey_!PT;F|?C8e&3n zTp%i2f7SNS_*Q6tM5aO<$5M`O0OAyLG{jA;it7M0MsP1V++P8y+WlN&I2I|}05^o>l%a3-cN)*fz(cb_vC@i75|*zEqFDh})P zLen2g^fcy7{QN{_2E?70LmZDnX3@kzaQ6&~Dw(q-n;&axYm!(bo(~y$&P(KFuzKe$ z&75%p&W1eS@zWEd?07W!Bgmw^IQ-9<`}|Ls!&%I7r;Ld-z3;`P$ZcF2?IjBCP4Pm( z1u@U5q=>fTW z=I;ClVk5p0Wfcb}y<>GVqwVdtXc)T#O}ca%x5 zJb}3jZe+l^k|>uqC0i>#x0K|(6P&xsLVeT&*aeW<7i+@%;Rye9S+q0*;ufrASOcnL z=G-0$B68D+0I6qG$9~-(m{?1Qq51*=8e#&}ssWNy*5c_{SJL^5{%Bbaamh@Md`GXC zxY-Y)r~%w@w)F#%&}$)BR!8x~YhCb}53jPp6_vAUR7+6tDfBU*)5LZ-SWg#7bbyzu z>{J(&6gQ2O6?Dg+1Rbt-Xs_R2a;fNXEP;y4HVft)@#QZ9+e%V1K`WH;;%8S(_FXsv zyuDOJc;SMqx`aeKM}_QqV7%L{VTXiko{P(w&RWTy3^rIw@I+<$ail;O;~f`> zqhKWht;1Vw?*^o{s{GO)@QltrA)S;Q4BL~0!%fcCu$a~0SZp~Z_C>uHWE<}W;j*Su zQ=7ue%kllW?|UKde!w~OyW$&A7a%L!1v07WxVGYTcQXW7C-I};W#3fb@yMpTGi9GA zGXafp@rY5HK`}iT$L&GL5?y;aNsUrD5i$CR*@L`E#=b@}Cm9vI z95ghHwMe*xAk6TyH_i1X8NaMZ&{(ed#w}JKk?=%gKls@ne#@I={F0-wT<;hR(=ZaI z=ApT6)o5C_&f3#im^F-Jzi>>`pj|Jl1g^d=e4a5UB}Y5#(b zJ)uaL9Y&_y#Umd7jW@}7C@?hpge(^;JQ|&3d;$5%wk-Z*er1E6-qbl99QH zh*uvU^^7;kXwN)}g)G)^3`nlKyz+{9i|eZ`S)ULvIET!BTQ25B zYgEoc{Sl;sE3z;zW?_!Z!juI3lY1HhL+XpGuc%(EN1?n888S{N1A%6aLC0%3JQ^H- zcO#7sed(f9U8pqS(Fua*BUDybRbE!R4CBa)<`)V!ht$*}-sxKBe4vLk@JtSKmPrnt zy84=$Wwkhlp;C`HFr$zG-_|XhSGz|7@mWqzC%tzP6|VOFV@Yg0R@N=LZ0WpIeQh<) zl~}MWmoxT!5&D|vDcJ8E;pKRyjyB8CK1V^3R$h!tV!BgMT*@dqm%K$a3#)4(5mQLH zyavzDTYQ9iiK)j&I|!Gk#(WZ$T(wh@K)Tpu&)5!Lxz?LP3VGK@r5iKWA6}{0nJ7M^bYs~~afWn<=A;`FIP8M%jLSt=G;XXD27un0oQrNua2)v{ z(4CWuZhT>pU*0K*mqnoaHX{UvRkI1lm@$IU*Ft2F*=P$q#e{}ovq0#^2hSe)8`==7 zF=llQ7q7q^g-7Tn1kX$$|29O<`=*8D@?Vd$M^1zP{sfv6j-WJudgK@S)8irt_zq~g zk5oD~Y&9GOfgHmszbp?28Q`ITcoUBCfsFM5@OR~*aXTCU3?SmzI3~ zwOn*#p;Uc_$$t;%9yPQsyko}%=$Q4M%q6d2?0A0^&Ia9!pgZPhb)*k|Ou7a1AL&j3 z%}rT!MS%$;mZSR&jY>4~3Ij*($PuAG%t;rV-$7OmJ)euNU_xNR?HJH)&q+7lTSNmI z()AmGm(OT;14pgM*(fJ~?oC7M^jc62$-aj{BXNcb9vVkiSQHT03A-PF=5~4j#>Ml5 z@&4>0OY$EC&G2KDE`lHR-?%_QXZoIQXq3{?1ttVZHzOxqu;L=!yxep}{)|Ps+MIL~ z0trmIrrdPn{R)tDH|M0wpHKihYe;urPP&4Ep7I{cNjH9sKcXqGBR5^(&?3^knUk(K zpkPSXnUii@fxoUiRL+l7>BJ&t| z5*WSj*S+dtfR>bvxFD%+`NzBv74ZfJlt3j8cMc%M*;yamc9KlDV|PmW`9!7y z(*Vg4qmp>#$?@Rsemw5g-NMdtJ03I1!H_k|5g9sk%51c0&(@m*)&=c$0xJE1jI(FO zP{DI%KN5yWt9a!_sBIM9I{+YR+EbTvZ-}sRXc0Fv-3bfa6@)j5-9Fe=_Y3}Zyg4I* zZ5ZW^?UW*+w0qvVynQo)9h|({#<$}sU>AoFmu4;@m?O5}(S&$fptJFQMxd+kepaB3 zcy|b-gYafzM`w;?MyF?>WiwE$nIlV?{^@>+*4cxxQ*1!8wSEV-hG@jJ&KjI-ojxGG zAs?bGmeV5pf(sl8aFkelqIFgR)Ftr^c|EANGfG=$*T_yZPj(Hc7iLrch}4;NH$n&x zJ~>ppLPzfqi`8P0UL`-7)l3N_7k~69pY*DGiOQ^IO2LLdUP8v!uYMGW1?g4%fiukI zbjDo4mR_X@ICmVJ!|YaRB6C|ih?1GrTS+Uo!Rju}MC+|$)4ED*%*C+u>YqTFS-lPK z^eVm+t#|LhkIf`@D@usF1JkSch93qkpn8YP08-qy9gdk=aW4aU9#2$e0e&jbWeA4K zTLI{2g1aA(7Ko<-{akQdV6JpL2UzJ&2Bf~?$m;lgg7>+wOyzHKQt1l7}ft+?lP@j8=oJ zTSF=&`CyILj@3laaL)HS{AT*MuIc_9mlu5!soif<_dn1Z+H2C^@e^w)Lvlc?c1$hF z17XusvPeGGd<#B^#1FL(eN7jJs0&W}qy|A(&Mn9Na4-;uC1%oUGDtNo|G&o^p zS@ODzy2yw5WY7fp%D(*}` z+B#YWXo5(&+SziVU2QoFtsE~qi1S;D`v;&mgm)ikBgJua{!PIh8`MyC9Y-D~nDgB3 z-*{#)Vnw2)EYnXn_sW+{w==Ay<18?EMtwwlj%9K0YY=`@j!!36>)@{mrhr>PS zaBU99`bz2EcDUa=9Fs!b<+?tlJHX|V5e`@AaB+t_%i*+nXjc9-{$U|360Hx8Xn^o! z`bEh)SpV}vqN8OyP&6Gazr=e69=q5K7eVG-v40}dx*bT#PzCLstb~)TLYr(A8_mCfCet#u-b`kGyd6@Y{AL!sU6Gl( zFnQ|Kxv}Qs!Pj{TnN^`87Dek@!TxB^NOY(BZ(z$K(fBk|(`hr?F7H^yx(7C)t`|+n zyN*ZtXj!TFqo|<084IJfqc-s3q4Oo)7U<>h&H`Lqw@Z2y;nZGI;v1SH5k&#l6 zsM>HZzHBEjbIW$x9e>^Z{80}lig&L(q`UEa__z7()YQ0iB_&sNzKRAycjH{xfOZX7 zG_x7e=~YB!8ra{|&Wf;hofYJgl>gQ5NvZ>0S@UL_Fz3p`P| z22QK9T6|N@L_^JZPZa1@yp`^0KrHsr&^vf*Bm7T*HVBTnNh>k#>HL-8xGYC)scf`e z$wX8-?rK*loL*PDCjh-Eyw3qrU;W8JgOF*J?l3?qB?0Ky!f`Gj^=Zb@eFKoX%Xan@ zq5CBuh9DZ^eqMFsw219LF99@FY?}e8?ZXb*3P^qMCLs0c`_9(3XEmw4HD4-EI}Wpb z=bCa2+zW};>-~jb4?1Nayd{k&pH4yk5rySHUioXFL*`3WBr-SdCX6NUS0^(KI{~v{ zwNy13Ka;Ju<|BHOt!qc|r}*X6u@%KzQ$@-2bz+?fm#0NW7Y?XRTwVRKj4d7;66R{QAz{miwypZ+xzs{*ph-!eU7ToLtzKEHURkAH zc`h|9S-d$lB9XpHNZD|?o&vf?5I;=a69n9bK4|p29TK;p$VD1ri9!>tA__e(x`ak{ zd8~9Bo~?=WDd^P-Nm@LUNUL8_nvRE)SUP756q{&J&@0cpkwtB2(2^&(WpNa5S$PDm z6BQ@ZANp3|4d`BVF{E`pW;O31NDH)*-Fn11TSmif1D>dqOU=_~<6BF?TtM6LL}g^? zXn{V*TcOQx^s~C^%0VlQ=(_+YWAr#00W% z)72%=jo0I=jFsdIWyoR&+aS3-YvZp+hUI;y$f|Qu-KBrW<;0FND>BN9Kd(PF-XUWj z@I2cDH}VJ0p`V6!#i!ld?2)71@rf5}J3h1FI|)dm`yxQ9JlWY++f~l?M}Ra*Uk3CWJa)L$-O!kO7=rQTt5UgpqfhLvO*m;r z24C}Ft#0K5(#(}ZUA@5aT8A``tskT{7TZ;l2t4RiPt+mmc1TIIu6r0iJt}vJZeN4R zRD8ZlFfA8uXI6W)U)OY`9;-wp?vUycpUeUG$`4e7jAx*sqgvNwKc4jcVcSm7*zAXs z)!uepyg6I)VD%oJsO+_PU!ZgF*2uUFkVZxwAdUE&9kdaUaT@w4TzDHsmh1W!ZppmV<2p4_9uWE>n~GH55#)+x-Q`=oEW7Z%bQn6t${ z{z2OTnMT^?w75T~#lAR2vFc?g*lg=e*c(iVtxrEn{!YB)!oCmiYcrnAKrjm!dT(S5 zo2rJ_jy=3lW?Br7Hc zAU&G?u`?N){DRGo7)7xij!)X+aK$EBL3`JJ3z#N}j*s9Jk3I1-Vy_w%QC(~1icnX^#JwWE^A#Lx=ZO)Kbu+GJ)G^%C1- z3(!g-oNP@?BcXAVwt${b<&~qAb%JS(B{HbyZlZv$;}O-eca8RFg@r59Ys6x|L>fn# zX)COsHor_mC==_D`2xf!^kySVEPdS<-s|3`>XQlbfV8>dRAc%kit-c|!q)?lzKH=2Q1n2gZ@RrFMGr*!rma0GdLYs_ zJ=~L`2O@pbh9E`yrgk5q=?^oQ{b!V?Un);;m6R(TF(EbtTXmpE^FfJfRmVznH{=dM zH9b9J&XyAZcHxPJs4#yb&;-2yAdtqDYbB(&m8YNQR4m3xWvi24Xa#Mxv9Ha8;Sljh z5i<&J6-`Ij`?K}HzgYC21ET-+v9eR-b3tp~xn<{`TYlE`yczLx;uU4*m7Q~L=(=!M z_>bXdkgLBAy1VgQh^LWd2c{U0?l4hkfWuKGDQ>WX{0llMz^-Hm2%{qZmHS1GK%GDn z#e*Z(1jh2ivrfa+@FoDE5soHL7Up0Hox$`KuDN)V|LzN(p6KlbX>~M~YZ7Q^`r(O$ z$Ky>Go)~i5CEi|;DZtQpdqJi$!eIL2iG&Zpn_SaYmehKCL6VNfx^<<&@F&RS?FCuk zXe`%fbOdG~o=BMKL(@6=iNAY$LBfV>V90X4Zn#)~M8YxQ!SdCcZh6Yv3-U`xW4Y!U zy1j&}18>IWg%dM>@%Dl&a5R>S!xl93TO_;=U;6|4M{V92-d>Ok9F65#O3^SZw~;U_ zTk;=qS?RIfUXYZdv0Ohin0d95XfXQ;*FlEs z#<^=R@b-dm4FS!5ALc9@}fB4M`D2yHw& z@|kzw+`f(`&+Kveqmjeh9tm^N>QR7x_reYLc?Zt@#nI3$|3aX+aM2w`*d@O__LBny z!iOBr!QTV%c)Mp_IrO({y+i3vF(ubKl+GTh$hg8i@Nk*==b`VH9PS-TXOC1o$i-NM zN&#jVo=BKWU|9&(k9zMvyhG{iea^$crOrNRxDFPsQoI?^dmkD-(>s*zM~=qDv+?sG z!u0{(EW__ky}Qmkl+GTzc!=|%5n~ReI}IH0Wa!W-PnUX!(y>(29O}6CArZ`Bcp~8= z1V%Z0b;!Qnp>&)+py8o(noyk2r8yi=B+Ss!+fq^tyc!;4nFe8JjeANM`O97 zCLazLE~}p>zCUo)aL2_#BbwnZTt^wqQNVij&Id34bhP6-!O>W*D?mdt0#77tx!x!%|e*EK>x8q0N-iJy_e<*y4yI#1Y$_M;zj@9vj_VUgW4SnGLvt)1JyMZh{nxKpe5~Uta5R?79%M60xacCymJ4p5 zHOg@vZ0em+E?f_p_!$k_NZ4}y{DysgGTL!H;%KZ}Z6Z4qVm~Mneh_a4{eb}V|4*#=V-;966$V|J0_n(b&TSFur}V**@1`}JKb$2hLj9gXF>z+lD( zxUMZ*aM4)DRq1Ff*Gnc=#|60Np8bbA#yKu~5Y#xA4?i+o;{#l;Jb%#R;~m#-M`PXk zp$RGbMV^k@=ar}GCpfP4j>d9LH*$&tT;II-g|8MnuJas?<=V^S`BQ{zGT(T<6>59o z6vs8h(O9ly4dztgV*8q0CtkU2$*GR(L`P$}erZ~;6SKG`Idr*>(<~=tfvW=|0q_W32>b*Tx@mFY{}cP*XfSyBo+u5p%G}6$t@-LiiAxR zhc0Zb`-qrOFS~V5G+d;hp3%b@1i(u%MJ8OtDrSBb<{6_~l%{IlV%(=rSWTZ$Woprq z>TxV17Q^4XEIGT3KBR3QY)3p-E&}Hljk^BZ01ffa1VT}ls-2HJ>77wIb*W`nT9nGU zCEz*^U#zOR%2HUj4i8AC?fn5RVs2G&1dR_{OwFhm|KY734cn2{DA=5ZdD{};S1tb# zkWB0M0x?g_%>h3%4i{H1rG*%kb9*2T5q2CzXeq2)FJ;M*+rtrLj?lI@i za<@s^ZYQReSXS>B&E3^x&bF};k=xep%I=+yd$z6Z;)RH=I-X0L9c-oJw)o1$ixyOq zrE=k-rKynYpsuN1R)ugu5-D=9FPxXdlD=E8xV~n)uL48rGn?Nr91?*(gX&F=Q>nv^}P8#&fjJ1 zGPjz{;qw`7YHF*m=wZb&;LAU$ z4z$gX>hWc%WmU@-yK@B2no%~Lyo;71rr>}(IzSEtr%jI|f-5EJaW-<*LVGGeFc_7n zVlTJlo`LXx3+!bYTZ(x4K_zSFOXs<>25cnJ+d+GjiuubxTsg1yvL2@gxU4d-wrWi6 zyruJ(>CwfWlQuSToM8;P$c(j%aOefkB`y-JrCAx7-yGTDGL7V;5dBiU7)L})#MPy6 zRgt#9n1dYFJx=#!?w~N7SG{oAeDw}<9?%Ar9SIV* z^K;0iMb)w;$mh@@IDmnPL5;Cw9u8hW8MN7qb}AOC63#EJuH|XfCU1JSJx{T1<1>G88Pt0b5@oHQJFXKS<-euy|4R zQrOAK8a+KAanu`u-xaImdJ1qM5J@?0Y16wc9WjM35JdGpqKB-#6EKM-ie0(|r1;Vc z>At)Y=b10Qs#4loxpPtvB2)D<0Z^|CpFz>z7L_f^ZyRhr?7?j-&M=_ba4r}Wi;Kgl ztIUC}I;iyJQIi{KZ|jDDH4k*pO|If{+leT@)uO`rImDRCzcQJKpPQ&GJu99}R>sen z78-Q&_`*ED`Df>pjLWwSJf}p5QTE2q6m7q0APwBx&%foIk|JM^3l6uS>G?RGxM}Wk zkX-hUd;K!;-c@MA4@6V;I@7)96o}9j6>vnw8E(ed7meUMO=H=~D-0gk+zF2P7)h?+ zY!3{{McxDse|Y9&fZqkp-DbRzgU>=Yo`Xi7DM1+eU^Zv6nQdZ>mkgd!a&qvP4Vj|& zgPoBw>_S&i$ngnh*pB~47F|in$$?$}{FD=-*OuWI{i|!2;Ft2(JrBmlPs1RKHP<7a8b6H?Zuu!- zIK3S|#WjPkd8qRyK=!V-*6Tk17`w@K_rLOzimK9 zxn^;}jc^PlA-3*%bqpSeH6H?NI7YbT62M@+*Rb9&5nP>lKqk|>;W>Cb);vJz3Ab>M z6zKCT{obVCi7yZ{RLw66%u}FaEny=ZKlIlP?_gni=N2WVubN*_V!|!20*2(d_z~hC zk(kTPiL?^#BC=7DA&XoCWY;qK%3`h{W)3jht+e^XoC!>cr8$R~Vqn@Wri7SdfoZT@ zTw>pK05PDE^cAli1hm}{wGlR0032)SL)!i5g5}!@0ubKO@*IgUZAQ>?&Egube-Qn1}1L3ZXxk((LNnO*l zyI-tjF!7nG6AGSN(753+d_*EBfScaMrgKr`iPpoyiN-BVs!qu$pf!|HQetWQ42o!Z zIgTT_<9S=-4ZFkjyvK3}{EP$1;r7=71l+D~M$z6*k&Upzium&>!oOwOY~SI^s7l%P z-nyb+*MaWhM7yJe_NU_mYmUV^eCEg2&+Nw##n!K3cmz+npUS=7Tpo)>XqNghu0u`8 zLR9Z`-N2&N&)`G5w5{v4(fDE}ipn|R`2sD#Ta)TOXZsi+wSC&zGAnUpH7cuBsf4k3 z1wK@0C?HM_L_;S4qVmMyzJNIG7Y)q=beuq(bZ3={i$!rZ1JouKvWwny35LoGu^F4P zH6HtF`}EdmnJCV71Y!ZrNmipRm|Q%xJT<7idlU8$)PFc2Ev;)rQGU|@%8AxXReP^Vgg2em{Vovg zpq;a25;gI)<0h#RrjDFM9bA77D3~!o5us=~(2lTzl z5r(Hz)sv`S>jx4oPI0{`KJtWyGAvMHf$c&EtGO1_Zh;01%(XNn7HF_Qo&fvdt*Yf< zKqK%(LpR~=mD^xN%coJT{|?Cnr)F-6RV}y{GK{(X#FX& zCYifnlo3j-{uuiaPj__B#^Ow6L(WHb3DJM83s76?LT0xI??l*X5uFBzjYYjiKymap z>xgJ*9p0SXiiU2(n=@9?(D(6Hx($HX-iylF2ApHEOU?rujAY-Y)yzYE+HvKX*vG>> z;Zs@ePF!fMMTv9=$VF@E9o?+*TEJkn6e`3I+iH=1U0<^Cpb8%AzWdde?OC}`gmUj- zZtof!kjE9$U58+q?{)%qFNoZ1-}V_Cw;D0w+Zi(wc-4)ifK-EB2uL;9B0#FaRshn- zyAP1&zm3lJXAbw8!%@|!&SSd>|IR=Y1q_vjfBJ#;KVvR1hFZ+e4^d;I*gzXwrhO>{tReoNA~hrRWmweQ!%-iF`W5A0!Y{b%h5^|0?Lf3F_) zJ>^sL`or&w8VMp*vOoMi?Wynm{MKJKepm_k`Fq;4CfF0dmDAfVf+vUMheM+rlmNsD z+i+;1gVq4zbZj_uzk{|qXa^wWU<>_Jp&JEAITC=3JZDS&%1KzrbI?{moMH`!b~tDN z!e1h|egne&BK`Uf2=|TjjSdJ$BT-i4G}$)cK9N4?+NwEq;-u3~FFEvA_~PEOSMhN2 zZw;Q003U+iSMW>2nEY2A(Y_wCrbBKC9@bN*;+cZy0zAv`(6Fzs?kP0D;n*ox9QB4m zLmf2CL5Dd=27mBHL-GIa<-Chc7+7K=VUBjtfBS7bYpJ)Kms*%68p=aU#ose#s3PG! zycyd*!s=?5ONVo(+qtE(W^OxW1vS2-)n9G}VWJkl! zTtGt?B4M_?Xuj9_2VBTyf-Jiwh$W43HS!aNB_(3l8i$TQ^sFPjWx;ENLTQw%z+jj| zy#-{ypZ5D%-m+je3TQ~9TSelJ z4%oIc?p%VR!`7VAF^6y0VeY94)4R1C8Xv)#U(Bg0n;%)&6X|F;V?M$saKW_ z{@N>Qzv$WIg~j>fit=bU=C3vT@6X4E4wGs9b)U`0J%95;`E&i-S$f*r?~+h{`$?D9 zsfxA89KQ{qJGm%$R`MA1p?=0Pz-B*83b2f+7Ze1}2)`4R-WoKHMi_OU1g+2&<`-Gr zNq&xo999myGx(*Nk#zo=i+DQuEkna^8lC})G5Wxv*{o~74Z80eTJn_)#@Kt|gd$gz zfg|0ILGwgUx`J_I*!8o9y0yd5SX{2L@&TyQUjW_f)0L_Z9Cl}g`p3Y7hx{yvUHjv0 z;IP~Gy4iD*Ew{w!fEv1ld!tKNlG(5jnhT>>-QBB(LAzwvSTnA^bKmjw)9Bu=ef4-B zs_FA^{gGg3%LAkD0EmtI563N?AzXi>u4a~VDLF{2_QO4Rfyv+ zL}Lc@B^?dhOzd`!1}ay6NnsyvFfX&z+z5a3_g?&Z!K8=lai9o?hkZx2(8srF{CVTX zvF2u?oTrD=(_U(=oqv@7djrF?@hH4vr5FOAJ|W%6gPb&;LO}as-3Td=6iTA$>J!^C z5#OEfjPiVMLxViEjpAF{B}l8-JW6KZ!5KJVn3OV(UR6r%fzKH$JM43BQ-!A3E0a zvP5so9}huv-b!?44TbEA^K#W&(Yx>k&1pj$*V#Fz1U{;tZ+S3#5Np0matz1fG&jY6 zxR(u1a~;TGft~!`)IzLzj$-|J> z1)tVW(BNMn95rykR|4Wc+}AqRd;1mgdhK=19$)KozK`EOzu#xq zd(U%U*ZXy?>$=u^UF&|We%LE&uGZlV=?!Qp9$la@ZZJLH`8!(vHl0EEU7jFcA+57K zv!=QsJZE}BuxcDeQ>nWd)H6}1VD;%{&4L+#hY=*EywHj*?ImMx?XNf~g`Sc@bNn3LHKtB`h> zHR$Zan9YF2f#B-IU1POF=#1y`7@ovt zt(D?)?%%BW=JbG6^EvGXt6>YYBKON~9G?Fm2i?5wxu4puEHWH7Kh636PnQw{Ae2${lgIgaJtyC#1Rfm=UAcGrOI~cm=DwVPn_r z)5f#$qq1IA!7AL(8>pML9kta*Bw$@4gHKBR4EffV&$=CQ*D8$v(tC9^Z7{{kgDvrX zS!v$Egkbgg=ta|vpFh~YCN@~z1?6IjD>k5F&dCq=v<4n$iNwZB;GxgWi8r2eb-MTH zbQ9pf>Gs2PGjengG^-~$Wma=69MMq=V(9*7ebw8+ z+N&krHl!D0BJwv;|5nzIMp1!a)p!k1JgS$2NYzVDfTCb=GGpF$w>`2L)Y%?bS;?rV zO$gTw!vo;c6UFU8E!%8j;nY*zz+&VkHfEbHa9dn;%aPJHYm-fG_zTxPy46&*681|w&gVn#Gt1#EXbLLCrp$Ww)FT}B0 zXY1NWHyhv~b$~|$vyYVQ8PgjMA4XAk9B3yMt_;Zhk*0UX`XZyYP@nN3TMuSB!?sI5 z4XoXvgKF&rI5j>5Wzz;>wBD{YeAp;C(F?RrSS07%S&PbN)XiKXQ=G9jAAd}%5fQ;x zY9zU)=55nJchqjfa=y{(4o|WR@Gkso#KU_vM6l{FDsl&|9jKtYkfFtQ-G#AMIykZ> zcSeF>)!RqN;wqzagGb~U*KWs=+R9ZGsB>Ioqg)E@g+e`p9E+F1%%i^odNbWjWav2H z$vsPQXG!TYbYK%Zv;xbocmGc&^)Omzyx^!UsjHDHo1MVMZCFUnB+#dU#`o}3pX%;z zEKAdauU5!G#Ib7{;>XrjOH3hEUYVV+x|95bKc_(DHXljqWWp;!iU#}q5Qsa5Bg{ZRATPUh_663$Lgk}j?~FW$C$ndA(c}9xP04dh=mx^D_1R&a0%9I#E(d4%Pxux zNM^)#hI4neIjhES-2x2}XN{{T=doq6)|7%B!OGWU%@Yh(%Q-N80eN4n|CeA3wFrMJ zUps&aV-#B}8wGX!^h&L=Hkb&WbQ~F`&NlHP^C9v+>0nh$S<5&(e==ZIzo(lPX7#QS zdC=5jLAckt;2j&0i#@pX1{p4$Xw-4;3nzflf8p8%VX3H76anPtw7c%cqGd;1l%w~9xE%eNIURTNl(BQfsPT4Eif`fX1&bxWG(xL6*5qz)UT0meHDgV{$0=D z6p=_O>kq&+5UlE^TP6AfznxjVx*Pa)IqRTn@2K&&>bv3f#Ra=uOgMM9&>S}Ak`m0~kTNO2+ zR*?}qvd`ykvB{!Zb&pIAb&HI3o{{u#7&py8E+d5}V-+&66C{gMc@PC`(9sV*ku49i zF`;AN$5=Yh2w4~6fzsRAlDB1nn!X+LPo5wowTNtjxW^yDb!KIa!w)im_VjG(Ng&NJ zqwX*>rs09s)rU~k#=lCKnk~|B-4r~P@Ng)2#|D}E*h`r+%nY7V-a8r*<}qfKYr}}f z1n++Mb56kE)d-!?QNdTSB^KEvo?{B+D~N(sw`$4{V=*ea4Unk}G|Ap^{Th?x_QhRS zU69++c;yTX z8f%|9RVq8q4MAOWzsHh<*=;W4DMjU?HhX0eXp{>EWe`0Qz14V{{6LhY24BhOvRU?h zgRkBzYs{3|%_(bk#it~0?0-yJm-kb<4ejzlTKwAJ{I%$@)ZW%&DJO7Qj(Av~CPP=er5jh{+!H9<@wt;+`~HT`3hJ_NN;`Un)Ov;`EW^fBlN zrB6UdD*X*~l+spEywazjqm@1b9i#L)sHM_2P%EV`K*uV532LqM70A?TJ19ZZc7Tpk z`Wke+(l?+Jly-vJD18e$QRzF-NlJeQwN=^$YNyl)I$7x-pi`7~gW4N*4uLu={RecR(r=)Pln#Tsm^V}*p4=s;R>nnlGp8DF0=W<|fl$;_4#BFw z$+&B68yz8shn?MRbFjLs%?3RrEvxy+0)=HsSE$Y9mG_90Fx*{nt?i0;0wrVO$n)$f zRX>gGqQ(I_{_74g7MRL<8Kki4xKs9WoXRv#H$P-Fl7Z132&&|Tu7`)<0Nu2Xp^REw z_Bw1kMt{#Fs^nF!`%`fVjvFWMD@^@)3FudY#GRAtHF%AfeG%*;Ixi%@RBR2yK|)ro=~+5YKsCc5&2;EzYQI#A+p_9+SdwYc{EW z3{I?+y=LrUrEd?{O>YR#$qMP#vAa2>!&w`wz_4|Ut%(MR-M+3}iz|u^3r7btLNbCC)v%@u|J^t*qNcR#&SsXJfVTc+5d}^_nwx z5vGtaCl9+Vrb$w(DH!_k8_5Y7wO?yZBsm+&Zr5mNGpD}@Ob2<&shKMRJX%=G5k;h% zPIM+=chli`R4wOMlmX|F-VXd$a_WYSM0aC>GjCBsKe#jH928fVo{uM)2dhs3qa&OH z1*~JNBy*+v!x^5rSlg&x*dS>@Z(uTJao{SHNBndL>8@+EF78&By_W9UWLRsIrwd|H za<^+eMNLnLY}GYArXUqHN3=(yqQUAxGT$SIK96OqHb`CUgSWWuO55+*4}IL!*z9%m zF`H45c~NO{v3}PZLEIqHeUn7Yzg_4QJw$$;mMq&~+nLr+)7&$2I89=fWIUk1L~gJ+ zSZg*(WdEvmjeF1?8-Li8L^+YNf5ZOAz#K`(LO);T11IqfvNR+j$!Rj9-$nXij%&Tv zO`9uSWL78cI!8_u$d>YBvU|h1pN&p+n~BK2>vkE=nOlrp&xm(7>cV4^_nW0`MI#cU zHlnaFM>ex$8&I2I4h+iXnfH;g&S;!oy|c-B@UHirUED|&%uqa6BH{E36ziPvZdot8 zOSq$K`{BcNdQLm7*U!PKLHLdT6Jzb2afItu2+r+tB=Qs z=_ctQax>cG?(~H*wXkQWZ(!|z>|+$pK3~_jb%zi82RM#!aA58CP7B=`de;Fh)WnQC zUPQWI_U0mO$0`^zuu<-M3)fu}#{EX+c>7~YrdiK*!ZcPthcB(HTnmdPcl|J>9+zSU z@K|LTw)W`M*2)C1C!j;29+Y(hHCT0)=rmi8p}O^~YH6pt`_fYAUMVyp@n(I@thr{~ zH4PQj3>}&f2pY*4$VPHnkEzO}*QH~eGi&P=$!MJWLyDLTKle9g3~`RU-qqUG92lvG z?EdWUE2l)A8e!6-u{UQHKkcPo;-&AfQ-;F^W?hpE5iov#N`8y7HnR7GX|TTQ&=edx z9?jMLoMH9e?VJ(1NToOIPjbd6s{cW8yRW#7!`n%gYKVvQCYyhCnBg1lv0I}5d zL(l2~CjoR_H!NSbA++w=*tTeFWCOyhm+gee`XyK;50jF1n~kZ+k-Z<0j^^iMVTlYi zLt{4?vGU6|Vv!ul7=yS~+#fZO!&THCK= zNiapoS|PHGH2&*Xyh^FUJ$TZ%7C+rxU2SgzO4TA|d6f!%tdlW2!ZQgqt-NIX`b+5*w_#{5$p4CZ*^Ft#UA<68XPVf*FJ1v^yIf z?i{PTYY8M+RgH4ChiYpUB0-DwxK$pANm+^XK>Eo$Qz|#b>^@bdf?evS^)ypKO@gSe z4qLPLI-BR{cW7R0MpJvB@!f-XM``W)#*Y#H&L++75l$b7OwLg^%FU;qG`XUxu{*wS zCv@XK5a#J!|0(S|-Q$xcb#~s6)%aKA6P}|-U9^qvoWVwwX>;@jP-9Qj2@hSy0kVhi zwYx1QvqE~UaUG_;y1Qh|#~0_=PE@$|Gk2;|dsz{tICow){#zDXGj}D=TSITn8rQ>b z#Xn>^!(}>hcw$AV{FM7+El+ubR!Ze>vE@@ypwkRJTBjVWl85^K&J-JO#8j|cCU2;a zi|XVvc0+|6+iZbtHo5R62LDpz=>~zuq)5%p0&d>>*&37g6p!;uf!&X}H8BAp3*0Yo z!(bX(5f2Bg8B(ivBK7}p8bh8y=P7%IR6`a5PugE(dbguOIxAM(CqLb{lS&6~LxMXq zQtG?lSL2dcr!TcvA&nI0dWupS?anqVuI_$&W1?NDYHI=#D2@Fwfk>Gv25XSMZDx&I zu%2htq{gpo_Xnj2d3viv^DIv}Mh!_VEFJ)MKm$J4q@@s{dDj&ekN>*jBac9!#6 zW=8)a+P0ihC&{=IKN~j*>G98&`012~;F9L2AaD0Yk!e`rl~R9!WMA*e_Exv?edK!b zCW&*%lh75D+a2^I+yalttdz0Uo&`>)y2G}N{7=BibcXcJYUw|xK+}TSU)%!SqSEU0 z2$9az-Cb6TOj{MHM^lA63P_1OKG*DOE6#WyZ50$qXc)0MLD9a1VHO$VK!X)-7ozsEt?Qib+d^tMSm z6(no#xIiN4OeMLS`YfecppHtvfX-Gr0t?AGO7fE5bCvpnB#7|%2+(;-vKBdC>0XeT z+GdcnB`&ZX)LAJ3-bq$^p_b z7@f^Dt^`R`#|7k(zYUmD>ZNo$$Y|?8 zrlv1}F4bIlrGTmPcc9BO?I6h1zAcszQ~UlPQ_2vKDWwWzv=4xc;$@Ig{0C$dM`Lf^ zD6Rta)@jTD8Ld3JxsRr;09~%MmDD=ky+^qM}=Txh-&Dp`WG=0rgiZ2Zfd9fd(io1zoAM4rJ2`sliB64rrA6-3Gcr={eAiN-IHwmA(L( zTKyAbN|E!;S(;l6GWA;tGPU{yWc>D#THx5rXjNPWGIOv$=uA!91Tyn{AIQw};EC=$ zKLeDleuF^CN<|(mW8V zjXAv#WFof3$!=YOAXAriAS^8Ky9i{oSAb00W`IoOECS`K-zHF=(hksArPxyf`Z_VZ zZ4i{NX<4M{Ak+6XATy08K?Ul!4Rnnu4|J2#ub}ZtN3{}l?NI~8=1`pG55U6k@b$x2f|w=3NbGPQpJRH13BK{J#-V(vGfnVR-5P^Hpu zpem)72$pK4_8?PUPmpQlK<17H8SNyHY3~A%X~(A^6R|r$CSnhQW@*Vshwv&VrPiPt zrIVNz0+~Lz19Z0LJ_@=~=><@&(uW`ui90|h5?h?%YL5clseWxiChkuM)oI!TpxH{# zgXSo`1G-D;ThQG~G8oKNY7gq6)DvWu)l|?unl=Pv>T)B<)MWzba?O1Rbg$C8pevMi zgYHubo#ifNSCMW8&C}dFKxX-Pk!kOM%$(T)GSfH!GIQaij&3VY1Kp;joKNZoGV^FM z$kenNG++H5WZDa$98FsTGHrX0xu1jX*WCTgjlrxk<+TGnpt;>aCJrtGrEA(qP^wZn zbEh-+KF|WqeIA6x0i)Rp(1S{!gG_nffYLSXH_$^$!E@Z)wjh&x3Dd43O(fk;zxzNB zYbg(d%u@R#Xu77o1j<(W7G!Gh6Ua>Ch;!Y@J`QAZ&j6X+3qhvj5u}?y3$?sTkWt(R zGKzPZ_BClA2n!H;BcW3u@QBjoAfp{jDk04TnerZI+ES*i1kKV?Hh@gqKBC_@^!tfv zN1W%D*A8T~9YLlBeMr}kMw3cGrY^NidkbVrd5>vd&~Go(er4K;=etuo8)V8$0+~|6 zAk&Va^vk8+WRU5%xEAEveL>`vo!QWub!T3?W9@0B3491RB5X-$hkW`0zFjA9N zi_Bfi+`ocMoPI|78e~fT2gr;i`$@-N==P9#|F-k&${BkOpfce(OFLG`U%Y&@F2y-f zn}CtE{Fn`T=i_nU4YPK}n2Q;`*QZKOO8xQj9XTg~<0E&iiFG9?*uBmxWi<|pAJ(f9 z=OI6GPeGU`>E;Y8aaj(tyn<-Y)!2LRelHeCmeu zGFcNl#{KGRw`?w({Zj^mI+)MnLs;E;Ot1^W+o;e5s&LD!Ks!ax5VJ9 z152coun2IjWNdAXTy2KrqFQtJnw*!yJ%RFYzp>(pW3!sA#p*eTf1%#t+J3x24mZnP zAjdsINXKzB_rQkUJdAr;+{4~d*eyC)bNiPb=Wx2u)rimWEo2_)xl|Nbxk?X|l^wf( z*1z!+cXND%Kc@5L(in5H2s2_A&a{=G8t(NBIG+%#dP7P$fJ+`_dBu^=5U#RGFYAUM zkpnT-vAwjqbSXrS%W8`oD^X=@E~P>3*0(VaxifYI4&(b^0Krp!lJ`Dn92Pthmk5{C z9%+>zN5I??P@R4#aQ7^kD$?D<*5$#*qwv#ogrp;1E0nTIeo05Ys;SONg+4JzE;-k3 zoe8TR$Z2ek5Z69!ls=J(h443Oc8&GSuCi-aw1YGpJ3JYw=-xz}@kN3YU}ZPSkw!Fk z5emwvt8Kuau({iMpj_797V{C^iFx!x%Ha>B!e=2RWfi_;{+ZxKK$WFhzeZzT;yyU{ zSgM>!E5BMAVh($y;gM)F*30-{J$e*HI7=4_e7?DbOM0vEL_Ey2>tXjwpfT2jhq{x% zsj3UTS5wl`T8Zx*+0XdvemZf0KzV!Qt<;THNS5XP{Xqb?NyQSvb9e6IYw@ z=*^qWv0I!+%y3?yEFCox%8KbX2hxLSdpxHY%eSUi|1((iBuc+I~$cCbPBn)ujTOtbgH2XFAjkEKKD5m^ew=MYV zxza(;O3VDw!Pi{5puJUhb*58PlcH<;WjZ~M3oce;dV^p0` zP;I@|iGzSu6)fPH8n3l8qzay;)7;6fgPv9j6|PRlL>pJ5@9l-ujEt|KVvRAViXBBJ zbB$!~#7W~UfDHO^x|blMbzI{v|NzP%ea7SHOR6a7kCo1SV@L(Q_B0Gvo!5XkeOO6#@44a?J|(mF)na5 z=ozIlkg1D2vCeGU%?HiW+{c;w5_3NUEz#U>nEMlRTVhoBljfcSGPUXrGIbdYGE=(^ zbe8(fVeX$nrl$Lt)*{Z;o&b{3B`$C_=sBfy=8goJl5b^N4X9H67J#ahUS`?`kWuUa znfe`hL?EzK{Z0d!v}DkqHSHRvm4g1FX>vO58YOw@@5xGEfK18qxIbAS;{xqLCM}gD z7wVj(xpHggGNt=LFDS{i$f-(eKrbrEWeTR0n~!q)U=HXd&3zao!&h8jC381{Ue>hT zAfr7Z-qp4P8SObBqm^qcO$`b`Mo~)|Hhe_beN}t7_LFe!`&cy}+J!0T=7)4txURo@ zLyD%?4K(@Txa+2)y9H{P(WE$Sqr zM4TQsD^t1z-{nd}@GYyoI6cbQU8w@!vaJ!P`#o1ENpq8xWDeY|v>M;_N+03-1f_5A zovySW-_jolSMTRF{6N(`A6Y5K1mf?ASrPMEO!pvOwtOzOCSl*heuVuD`xSN=7TXEW z6oj>e1z{(^+QQnyPKTwUY`FsFD%iw$90!G6g7nK^SHMzX{b5(Z2Em5FM!>FzWx?dE z*{d>J6QIZMQrKkJt+3l+m9RTtb+Ef(_rV^3Jq&vc_Qo-Rz#7Ri8Ho)G6y$|~c_BYt)u&-cU zvGsK^Y&ZCO*pINEVZXu-!(z|JG+-@ZLD&hfwy^fF(_sgoJp{V|+y&Mhb_wh<*cGr; zSbx}6utBgPuo1B9VOg-b7!Bva#)BuqN?~%`jiX!rq5{1p6E8bJ$m~b%_5Bu-)MAVL!rthW!dV42!)0 z?T5951z{(^+QQnyPKRY3g=3bm3&34q-C>u&E`wbGONI4^T?HEi8v+{vyB?MWlRMUi z!N!B-SWYQyGVE5^?XXJN9k4ps-LU&$55OLVJqCLk%gwW}=fKayUV^;}dmXkKwhp!d z_Acyw*hjFx!9It51-lUQPGUelSPU?F$oOFhVdW44)FDjDp*Ey;qzP<=}rIEs<3{oa(C}|{V6lpXmmy}N`Bo&inBscvsg*1&+L8>CvkYX zkQR~_krtDdkd~5`k(QI{Nh?VWr1hkYq)nvFq%EYaq-~__q@AQ)q&=j)q+9FiYK)qC6L;X8mWR*MXDjqCe0CM_W?B`qT@ zC)JZyk{U?sNgGLCM_W?B`qT@C)JZyk{U?s zNgGL4x|vN zBdHUqGbxeOgOo&)eRDIlWKtR_Ov)f-l7^B-l17n6lX6Mue2sv^~p zW|QWU=8+bV7Lpc`7L%5cmXel{mXqp9D@hHc^`woYO{C4FEu^iaZKUm_oupl)J*2&) zeWU}VLnPVkbK;NWeX21A%0R4q@ne2?pJ;xRS*4G-FJ#iI1e1&lIP8Q~*Bm zEaNhyyjJl11(7HE-$tKMzmZu+QfMVAE z6&F-G1qSBRCloMs+K=se`AEOS#>Bxzt2C z!3z@jF)0V5O70{b>3odOmMEV)t*MK%9M^O|2KB&`lVnn!ac2)wO^Pgs?#HAIjY^TD zB<{!fTp87hU{sGCl-cWij7n~0bU!8~H>w=DhTi=cpKGIfqhr*x8l(ETXOxeelXpL+ z^Hd|lOpGG+>c4=5~aGpnwGqqy;v^6ay~5reFqF`W=WAp zV7MPsWW80+;2|mI5&kSkpw?<>^m`<7@MiFdIc~XTo(?guAGXTLjhZ_TL`2S#vOOxI zc3U+R!ThLJ{1z20@^l0DV_KT({={FC@`g2+CA&Ck1UNOSoHbD?`=aXed{jzBR4YD- z>W!MH`p7vU_haf@997N|*8zWx&-N&v*Q0zEMD_E=D4%Dee9nz(*RN5_&XZ9-cSrej zjq1ZPQ+2I_!E2*ZVx6^>IGN0+qRRO)YFb}L_39H*K5tnm`kMEs-sl_^V^2qw+%l>@ z9j&=sIzFqYd_tt?76GJ~7h^byrd`iQ%|SWE;C_tH7OT#ZR~eNuKdPLo-9qr!l=DiI zYPrc!PlIwK)BTtf*%xv@2IbBN_hV8#3lpX#<3{QDf@0gJ(EW+OMzuStrNg88`5`Ms z-VHwT;>2EVQQE7;<)!&ZK&mP#_^ejxW_@SUiZ4)8R?`1}@C&JR)LJRTJ-??p$x-!5jvA3pvr>NNEkpWt8Fy+!pulT{vgGwUcmYjGp1uu;Z}8Fg(d5Yccd~K{ z3-XG}^7F8^&4L2&5z5NTE-9QEkk$62ypn>kQv>O#X`UZ=uT5IPxV+M`;U-sJJEX4% zDi~LkB`^HZ(#;El@G71XOtmQ2WXJ*~zKL1InS%qq&8tVwuLko!}MaDPbk#!M~CE6pmKn3Ypd zoR1n67L=9++}9eJ9>_{fG0E`9dy%Bd*@bx}Wzv}LS^3#Tx#-97d07)m$7Pk4Wg|m6 zsJNtHQg&HhR&JiQA@atd?pfJ6IeEopfn0f;6Ur;gnvhponmsNrD?cwg7j-BoDwA2% zHLI*7yQnm$q@cJAY1m|KnwXzmns0KX<=(EBUedOk#37ggn$)y}k~~ab%k74mqRMDS zc4?W;nw%13NmmR>A2MXXpsTaW3UbC9Z?tY=4k~S8CkLHT+9ar?SrTGn3XmlootuwH z%Pz^DP@0upj{asQJ6mUfI!iB?l^5fkOk>C9l{8m$ZoX4klgXMXXsruMv!sW0(-iZ# zENg6G_PA2MwMl2Z{+e7;fcfP9?wggJo9q1287$#il6P~Kv@)w~YH?m^Abs#)EFD-F z%v-M9IVtlVoirh@geen?odhi^Cx7C^(mW^BO!%0F%G`BYYm!Uw+OKT5Hpwu*CyyzZ z=<&{yF)_=VXd=thup}>MVhI|gU8!@zdC3-E1g3kr(wZiHIj&?PMsbZ8U1ZCPizk+p z<>fkW3zJt~$s~&4R9G+uk%YO7))y3wE6pB@IKocC1W%UK@|L`kiGi%Ff(gZ0(se}> zy^DoR#988W(9z0DB9>zWL}_Wk#3H5@m*h>d68R1>j4Sj+==8g1O)M`fE=Of0B202*`IALWJFOd{M!UW+dn%Tv zlDx6$F+vuCoU$oq*Gab4(9)vv!a|NfY*k_2q`X26SM+OE-p%FN#;M6` z)^vQ+@zBgT6JENkVV`NdNp$9#Sp+p%W?eziSd4<$w;F@aX*!e^Op^D#jVsGX75ZXH zlC2#LX?yq^i+Dwj`WU>(dWjq3B)cT12L`uXyr>P4sZ-08x6$bf-J~@s9mY+PPZUWqtJ2mkI`wNN~y(a!pASTSDqmuFUY4x?CE|CZ+IY7?VesVUP5(CotO zk_kFE1$0F!ky$XdAP2>mRK6q6S%EnPjnA8sm6wB|Su0qs(?txRrkYU7MP8caEH7D@ zZ{sw-yRO`wm6tQ*nQ_KlqnUW~tj2Wn4S`;afl=A+FHMr3@T|p|=B&o`H`n9(OWUj@ zktgGKX>oRrX@kVWguJr+iMggjW#zAFxu%KcU5bc8dHtW=%}n!znl7Q(-;0JZEyhlc%c_Q!_NRYm*_$1U6Rf zWf-VXdE?@27MMlbq8UL`4;Y=s3mO%_TgQRZegHnF;POUlX_qfXX_jl9<~vizeP z6SJIGEf#dk)%~ojt5XK1H*vw}>FIV)H>)4E$No<*Xyi=k-pzgIu886|^uV%=#gKu>T1P;RFBh4`HaO~Do z6Pzz;-?8W63gHV(!sV`C*Y1{IBGOx5ge%fu@{t`XQ(g~i!s0gyKC`3zE|JR|`H?FF zpM}pqyO^Xi@JGw*+S4je{4VK=yM5&z8+_>3EzwCa>C)cy`1)A@AGf{Ub1ss83an)h zp~y$xMcLHvRAis+!|ycs_4VN=vum^uzjpAO<-<>=`>0R9l|KBWy`TB?``L$Idz9Da zVtjc%&GobRb@AaR^X*EXez`vULMZPxpMH<}@RPV)<Gz>ezaM@0wMG5fSZki<`%nBX@ZlGNUtgboV|@6Xgz{$k^jqM=4;R@6{^G+= z#-Y_d{XX^S_oENL4w&w-)|#>T`5}Ji`SeTo;V0vBwokulKK!Kr9`Nb+f)78b-@88j zzVqQH%X!SD`0{+3TW^WqSw8$^y_)XRZ;TJWQ&8URKK&l_;TJ-AFZuNQ$cLYdYd`w* zYjYW#J)h?KIfVR+efkaa;V1L0+^63IKKx|8`kGI_Z9e>3qrAgD{93{9*xvZ^e46V& zIT3TRPrtK#_{F2V3w`*>Ntug%`t|ndm+I5+N}qn$`1Bj;(=W@X-&mi16MXuW`SiQh zr{7GUeziXR=KAz|z^C7%KK-8Z>9^FU-%CFIR`~Q=37(tUkf=H@A)*hK9c@B!lz%nPrsHv{aX9__cxG zHlKcbefq`8LsmSW=EhxVZ#y4;axv)nKK$gk&&59cBwkW|_(^%0KK$gk_l-XMBn~F} z@RRtf_TeYz4d(gqlXg7k!%y1rnh!sjZ}0f1CL--+-W>CjXOZUVkXJ_Hq^b?=pT!IqG$i#txpOf)4m#|5b=MywH-Obn_zxz5o z-6h-jE&m-qd2YeD5C zch^3#xJ2XjYmW$gb@*_fA0P_e@e4No!*h<68=}KGaWld(8!tb+-FaEi4eR(?iMO5+{2nk`s8(9X`3?9(JWFj}%N@@BJA{|kW| z*8OiM`0NC^gh+1ViqoewE>ar9v{KL`n)V>R<@$@bz#4qZNiV!D2;a#{hw&{tdU1hx zETa!79S6EcNuGmRqjVOiTB$SWA*G8!cPU*Cs#B8ZsLfN#1m!AS3!14k26Vg9c+eyz zxj$ZRHH!;O2Mtz|XFv{9x*K$p(gIMb(&M1(m7WFNsPqzOx02j@vrFks5EgTk{8vzh z(%(S+l(vHgC^dqlzv2S_1{Ev)3L2>thh=q~(y^dvN+*G2tcwer4$4;Q1lp|B74)sr zrJ(neQbFsLGC;2@4FfGzx)HQWX&gw#ySP9x=t(6Rfu2{I3EH4k2YOLSMyz_JM?g<2 zJq`LuNnYsosggWVAJVxb7>Z zqd{`9Rb1eB&?QRkK^G}?1a(!q5VTLJCrB>kiwn4GfcgYH)i!p2=wmr^XgyDPQAccRjX_`Xo-G<-j&bS}Q-PGR$QyPir?f;?3# zF3=a>?Ubba_DWKt^OdAEQf6FWEWX7zE-(?_Qf6F0o|_U@nt^YbVq8F;{&0oTefT~@ zX(7IQD?Nqpbfv%G`!S_g@%^Au1HSK9dK=&38yENx-{Kn=_#EFQO0s2IuJliQS1Iks z_Y+F8G)v8}cElnt^^Ob3!hfsMDIlp?TtFW2F7=KJbOseFT?~>I#04$~y`a<|ByElh zWP%EmAwnyWMmB=adQa5qTiU1R`Ub1=U0U<+qKa$X7_ z4yJ9cJQ(992GiHxuukFG?$bmVx%paLfnZE%g77jRpUg&1r*9dP_U=G*Abac{HyCcbvXN@sLsqa*jYy z#09PdNl3@(OY9_QqANtnk4Dv=E`bV7QVQ^XCQg7U0mQB(2q)cKp|E9 z1bSc7egnyZ8y7eV-#e5N@cpII$@o5~bSA!K!Ho-CfbSMsN)M2{k0CD52h>K%-Qf7& zVEnIF$`Xv{XlF_=o&ht#c%G&u;rA$|6p-vPn_!e(ViSxvD~&>~jB|1NCcQMJBBb4- zG#QkyQ~|nDNrEv;>0XeGv~l|89T^$p^hxnD=Emu>%w?pF(`Q(lu}y-pNYf-3lawSF z<%#ho7-d8@!8k-og0VtLf>EAq6Bm$R?4~5an4%=XC?kAaK!Q<5^SFQn<8UPjMj6-f zRzT2XB?(3u*CXTX|8VP9hJEkW@0dK?lbaX9{kS2yQL7-ku;7;LGP$uT#M|4wGk z#G)eHx79RPN-N46Hxb22Q6cv}u25+?ZbL6E9gEvdr^*eCp%UDzX#Da*=I+K)XTn{6 zr|gO2ne)4q?$UgvA$2mEQ6gzl_mJL>7BY7PhxCr%P>NKv`K-Q9RtfH*51HE=n~0)w zn$vi0o#f=aN^gF1dfaOp%9~YWv%b~dvyi>r9=jFI}z1f1A^J}g==ho?vxqZLc zqMEogS4!^0qP%9cn&B#}dFHKPvvbbt@P{R&HaG9RC8RayVD)yhm9RXT)FN^lZOGhd z%N}qV8tu@e1ifY0S)4+p#d$eRONe%`OW^WqSDwkPx5lUwc4q0dC--~#mY$`$6H^sa zU0=QbJEV7Rn&r_HuFnf;ZlSZ5VYiTIjXj6W65n(IF#T@lxg|E2XP4RRxL{;fmR+JZ z$lQ*Jp8vMSiYi-VW!Wn4l$vjOa~^gXO_pVQ+D$T>D&_9-khP>+ontNP-udUPl{>-T z%Xg>g&9}OwxdJQ)yM*XP&@Lc4zi%LIXvUDPSm9w+VM57Sx+8u5M;>k&-kAHHLjDgf zeFNo1&amYM9z^Rcu1ty?8W@7GCL(=!IcOY}X)dPlx0x9NCs`-OOanMzvK=*zb z!-j+d-AAN`vr^2TzJcz8hv+Z)qrXxmZ}5;*^XsZ~{dHBkQG>Ec1aPQg%TKx8{7-=3fX=*6rOr@ zVA#Mw-+_U_g92&&0^xpvzNvv>se#nNfzaf6o%s^^NASEr3hM(64GKU8S3<(TK z4-9~MNZ{(h0o(~c3|WIPl|bLYfxh9uFi5Tmq+|w$T@}bF#PelBMcCNGvzf|^@}^*g zBTsB`pV2S|0dJmb5t@*lgTRspl!PWCaK{!-oE*TjiY89LvkUZ5E1|L31%>4$c>zA+ zgDFysXOYL0_@oFc-Q$DFPMSC#j}P#sp?(D=P12kNB2Z8$4{Iq5=@WhO@I)dv_(SL* z*>o%|4dvz)6+kZ4&dm$yqfq3BJTuDqB@Z*0m@~0ZR^R#*m;zLFES`)ZkG8^QVoo_8 z{xdazCobic;2~0u3eS@&h7yl(!UHtWYUi0Kjr0ix z=(nPA*!nBWE7FO1`z4ajBca7$ips3?0vUZ6=w>nKrP zis_aXPb|VCK$_;ugH1x_!6xp&k~!q6PysrsOxo$4w2XDy`)CN7iw8KE9R#<_0)xYW z!F>aR)3A?X9tPYBf93Nt%)FdK4n5+a8ovL-H2LLvR_Y#(=;dIS@vK!ULs~Z+o0n4v zm%=WG^@a6=T?xAyCNJR{4!aI^BWw&z9?*Le>{IM~bwEjzz_-9|gUy7^g2`ia?}FV6 zyC3!t>`~Ygu%}_q!sH~c>>$1ZUIAMLTMLtuIkF4+SMZ0hPhg+HzJz@Z`wsRGn6#%a zY(MxH*l#d-1=x|WV_>ae@_6BsV5h)NgPjRG2X;Q}4rt}nOHc5nu*+e6Vf|oN!mfr5 zh7E^Z2fGnA1~wLU6YOi~zlTi%-vYZ0HWM}rb|>sE*uAj(VGqF`g*^d#8ul!#8q;nA zdj-4#whFcu_7?0N*k55E!ajk02Ky5BHS9asKVTO_D=$lW5tan|4QVZKzFl5Sb_}dF zOdck966_S1yr%3-*g3HCVQt|r{nHbCDeQ7sUsylbm9VQ}gJJS8#_M1=!p6YH!ft{+ ziD}9_odmuGb{lLaY!>WJ*j=!DVfVuxf;|d*0`@fQS=eG|AA`LDUIAMLTMK&&_73c? zun%FMz&?Y03HuuM9qb>l!_dln-w*x;_8Y9lk!U~c7+7oA@vxI%r@&5woe4V!c0Nqn zo+0fAUkbY%))&?fCJ$o18a5a<9CjV-M%WnGSlCT4c}(QZut{KfDcfzZnXp-~J7IUh z?uFeCdkFR@>kI1#yAt+C%b~tQmc#YX9|gbvb~$W>emwO1VZXrsr_15@&@6}bL_AyyyByXR)(>_i?2neibKsK> zn*_TBb{lLaY!>WJ*dHy2L*XNBe+7S6z*fQjC(EIX(XF8WZ^s;$V0Ey==rj2Mo%OOI zSrZ$Q^|2wG?RH2G|C%&8b!14+NEix{I+8k(I+GGfJxFrs*p$+nluSw^g-IEtOwv%& zNRk|EHYJZH<&yGAg`{GVjC4jjg*1&+L8>CvkYXkQR~_krtDdkd~5`k(QI{ zNh?VWr1hkYq)nvFq%EYaq-~__q@AQ)q&=j)qXBxw|BG%1&q zPbwr8lgda_NYh9aq$*MkX*OvtX&z|-X(4G5X)$RDX(?$LX*sE$w35_7T2IxzNjyoCP)1ij+W-^N1$59ZB{mOq!g( zG}MvQi6kejOl~5n2T4v#ncUu_WRjdBGr3_>21)ikOzu$9NRph8Gr6Nlxg94VgEij+W-y)UC^N9sTdk>tWVfHCP`iyW70;FMv+F7a!L85LQ*lQj5LKbjZ{IZ zBGr&)ljf4ZFaq|Kx)q^+cFr0t}gq+O&v zq`jnlqywZwBy9LOb1RM{FQ77WP_~c_C6L;X+L7cT^u{kl>PYHD>P(Uc*&9Ulw2ic#w3D=pw1>2pw2yRvbciIg%85TxJgF5afz*c7j?{q^B6TEnB6TJu zl6sJmNWDqPq%=~PltIcQ4JC~vjUtUE$?MkeKM)tlCl!*4NoAxdq-mrIQWdF&G@CS+ zG>^1^w2-ujw3xJnw3M`rw478=T1jdkttV|HZ6a+ZZ6R$XZ6j?b?Ii6Y?IGqzj2)hP040bK-23R&M4<;8K%Rc1IuyWW`*mRg&JNi1T7A6;0-vgTudl2>r>~Yvr zFgYhP67~Z4W!P)5H(+aEZ^GnC+xK7}z&?h33i|@K1NJSf6SQTpAHYAs4#NHei$R)P zk$W^uZXl8?aZiMu3_BHe2JCFueAsocuCR+?y&E-T;&H zQF4*x99RwPW>`6FDr`Dz2CNz;XV1jv9+*t)LD(a($6-&wet@lpy2<&m#Q!qL2R|I*c-4lus30E!`_2^0Q(sBDeMc_4%oLa+2WUS zet`W1I|%y^ECyRTN5JHG@v*SuU?;*(hMfvK19mp-NBDNc-&`yQ|2NB##6SpkAxv&g zlWRr$AP!St>99XqjwDWG{=N(=hyPUAbl417HSCX;BiY~n1oq!9M}_EzPO$%WIl2g1 zIltExb+{PT3)Tmg0!xSe(Q@<(w10=)4Bv9tRM>Rb3|KYnkCr1j5A+rEFThv&@HN;Q zFu%)@#GAy@f4dyL?8H)6lyNbv7pxB~1(pu`qvdEa^m6X%X84xFroyJfX27apf3zG; zgHImp1=!25*I;kJq+M^q{%ARR2|luC``<1{a(>u7H*+z#7pxB~1(ptz^PdA@*T9Cs zu7%wI%ZBB_r0o~MSBuluODd6_SccWuz%2S&N&#svuR7YDlw5b4l|^3rGt|i%5$}OGrye z%Sg*f^`w=g2GV-cM$#tIX3`eYR?;@ocG6DLF47*-UeZ3&0n#B-0AsBaf24R)D^dcf z4XGWe11Uu6Na{rDOiCp6ASID{lafhkq%bLilt~&&8c7;O8coV2<&z3Y#iTOQ6w)+O z1*wWuLz+#ROPWVoKw3yzL|RN*LRv~%Mp{m)C#@tkkk*qnk~WbxleUnylD3hylXjAJ zk@k@GlJ=1fkPeXoSZ6u$M~Wx4A|;U8klK+tkYt<0l-H3Y+sr1dGbxeOgOo(-O-d%E zk;0@5QYL9ANw)LNbVrd!lX6M1Y<(HO3Q`rRhBTWrmo$&GfV7abh_slrgtU~jjI^9oPg+T8Agw2DByA#X zCT$^YC2b>ZC+#HdBJCmVCG8^}ARQuM!_SRBQaq^@DS_06)Q;4F6e7u9o|#9TNS#TE zq#mRsQg2c+DUB2+WsovSLrEh^qe!DkxukqjA*q;DMw&vJMyeoHk!nb@Npnf_NDD{{ zNsCB}NlQpeNy|vfN%f?aqz2M@(niuI(q_^Y(pJ(o(st5L(k{{-(q7U&(gD&TQUFJ& zO_aou;z_MY38XfpcBBrZ5UC@n6R9&Pk<^2fMCwgSCZ&;?{M3O_tPW+MLNv%i;q&B2>qzP<=}rIEs<3{oa(C}|{V6lpXmmy}N`Bo&j&NK;7DNEM_iQVnS~X)b9VX#r^=X%T5L zX$fg5X&Grbsh+fw)IeHK+DO_&T7^AQdEAWLK)(*Q0roEJeV9CA>Tj^mVIyJR!2S-C z2XTE5`w=GheEbSK43kHdh)+xWl?T+E0BZ|t4?7)p7VKP@+%!KK)*W^U>@wIDuvA!o z*j2DWupuxxrg=T=W|%xOMUL0YUY0yU<|ddN_YA_Ggvq|y9k4ps-LU&$55OLVJq8n> zXJF64o`<~zdlmLNY&C2hYy<3Fm^?V3C+u(F&tYG|zJdK6wj1_6>_?a!Km8SU7#0iv zqhRt3j<50i1pJlfQ?!T4*1tSA<6PJUFnQoWci1H`nbsAsRG6I4xC(y~c*om-dur@HcMqZA^OF4zGI+z?6z7HnH^yPCh%pB`76wkC)qy$nMQae%y zQi#-%)QQxYlt}79N+R_pC6m%fVNwPulQfhhacNpKiZq&(OUfq|l8Q-Xq$#9nqzY0M zsfIM0G?z4ww1Bjbw1~8rw1l*jw2ZWzR8Lw-Y9OsAZ6s|XZ6<9YZ6$3ZZ71y{?IP_V z?IrCa9UvVd1rXCt{E^~Gtw;%^Hl%i>4x|vNBdHUqGbxeOgOo(-O-d%Ek;0@5QYL9A zX(VYBX*4O9lus%o6_d(HQ%KWD6{IRs4QV!ME@>WV0cjy=5os}L327;58EHAGp0twG zKw3}QNZLf&Oxi-)O4>%+PWs=q)Biu#PV%53vvx8RkKcw`krGI4NbN`+NFh>3QYTVp zQX;7bDT&mZluSw^g-IEtOwv%&NYW_MXi_dIpHxUHCY6zlw2ic#w3D=pw1>2pw2yRvbchtd zXye2mDW24dlt5}jYDelo3XwXJI*~e)5=lKsNu=JSWKtR_Ov)f-l7^B-l17n6lX6M< zq(V|Lsf;v*G>ue2sv^~pW|QWU=8+bV7Lpc`7L%5cmXel{mXqp9D@hHc^`woYO{C4F zEu^iaZKUm_i^_2GKH^9|NYwow{h?oyf^*IKG#tf%Y>LO4WRsvN@EKDo&nMOoHszc6 zNQ(IsI)CHvH#Vj>GWvt|-SZMoguBI-&?kh_y)WvPy|~yIc|^Rl@6gmsa4H>#1N1Y< z`76I;W4hy8>Uwnk?H!I_$;0R)CCle)Cj~o`P|Zi;<)A*}pC5Q6RkCEt=g2_Q`p6O; z8?zZ=nSXzN_06IqS)Ur!U~fu&66G8A(B!9vAH|aIqK{jjgHB4k_{Vrv@l?rvs(j+L zK0+sA>hd`n78{d_UuS>@d^7CWqp507pQf$&LRCAFKNa-x@g=Q}W-H{;uJSnsW|w>n zOMYHG#HVS=U#iMm@-Zy=9Y@tteZ2FlB}^)xE=u~a9h%I(8H)fZ-*5K&!XRO(}?+E}XHS7v|O zCZb9*D)q5cC#tHw$qxK_&4Jb@MpV5_viex6lPpzIi;vGfDWd8s%M_knAU>9=t)wub zif)^+tF1?6fdzN0UDwW|GQpufmP+;{V`D=2me1sd>rOe@qcXvvK9)+N zJ)&BE-{h{RcvL1h)W=du@5RQPArr#qkq(3QxA&+_aHx-^>Hyz}>c&B1zUbglncz?# zOC?be8`DW9gwL&)6_uarQJLUSA4?^18&TEgr`~v)M`eOTeJs`Ksya(1gim>(?Ww1G zR3jz7bXS zio46t^r%d1sE?(RxS(Fve}7_CM~}+HhWc2lvn|z@FIzuy zwnt@RLwzijjA@Y?o)8}N;W-|ai4FC!ROhNn+AE*cMfa^Z*P}AAp+1&MVktJpRZZ)& z>Yh#>m5B}Yu~g@&%8mImXO*9Go=0V3LwzjO`Ic(O$0LtDKcebxVncl_mAoV%(i`R9 zUb*uEkIKY``dF&Ymg<#P#=YO!qcX9fK9=f2RmmtMpRZ1Ncglqxm5B}Yu~ZkqH#Wvq zbr|s7kc&Jj6C3Jdsk*2tgm3x$>(XDRcJZi8Y^aZ=l3t393E^8l7Z!XnIMJgrv7tVe zN_r_aM#g0M9GTSasIDHBi4FC!RMJZk)tlol?%d6zGO?jPmP&dlHs&~)5I!$__56_T z9+im=^|4gaOObKD?fYxvdPGz`Ol+u+rIKEXsJ1NpzRSfPm5B}Yu~gDa5!L)Z@9Wvq zqcX9fK9)*)DKSL*-mm;c%V}ds%c~mAg)W=duFGWI2_M&p+Gx#;JWgDia&(W2r7zmD{eI`1n?rM^qP^*iau!b%mu`bp6@q zUg1%h*iau!m8>dvJlqu?{aLa{Wnx2pELDo7x}g2QA5uIj6C3Jdsrsr)*4Ofx_VvH# z^!2DrY^aZ=N`-H1jH_Dx!dFkHdQ>Jh)W=e#smh&SozJ{CH_f9mv7tVeD&10jfAi`= z=^mAd4fU~9{Ztjgw|w5qsqNO!qcX9fK9;IKd?O=U>%_$;_xGqwY^aZ=3aiRp6D^(p z(HG%}s;7w!^|4d~EY-xfe%n95qcX9fK9=fAtA?*#yZ-enJt`9$>SL*{vQ)Pm(>V7k zkIKY``dF$ARk?B4di;0)%J8U6Y^aZ=8fdBBOM3UsfgY8K4fU~9SF7qQe9PzM^A8tY z?NOQ7P#;S*2)>amy-8C)OdsS?nb=StOO>gr)-oY{#{4_IXQoGGVncl_)iv;qjcKJC zypSk7aP~DGm5B}Yu~dUqb&R8$d-=u}21itvnAlJsOEtt&y?#Re$3r|S6C3JdsfMa5 z-kDZr%A6O6dQ>Jh)W=c{Q`J$9s_%}%eZxE|6C3JdsfJssq)BgHJlvx)v7tVeYJ{aa zZrpWGjPR&TY^aZ=8fmFM>ejByNRP_IhWc2lYc18x0fEWadQ>Jh)W=d?XQ^7Oy}AE& z9+im=^|4gfTdFnpj4Hg|qcX9fK9*{frRu(Z)Z|eSRg#Gf^|4epSgO4b+&tGseVW(uFLYMOl+u+r5bIiZXGzXY_vyZVncl_Rko$7 zKdn3~+oLkEp+1&sjHSAAXS+^gJSr0#>SL*LELH8R7suv!R3Z;Re9P?9+im=^|4grEmdv1 zkrT&zR3d%E9m5B}Yu~ZW*)r1!w+BU(XGO?jPma527jazxsgGC;d zi4FC!R1+=L;_v&vIMJgrv7tVes@PIxe)IPE#SvB4L=6u0u~au(s{5AhjJesX(%?`Z zOI2d2wp{qk+a+F=28a4ss!~hU_O?5}F7>K3IMl~dm07B9O5$!Q^QtsB)W=elTdL3* z=Ur3oRcUajkENPqsdl9u5uD^zX>h2IrJ8K1E@<1S<7BT&gF}5R)f7v0(>dMyO!2BT zIMl~dO|?`n3|ZNBs#m4Kp+1)C7E4tUxTp6m9+f#Tsy>$LR!h~r>z!xc>Q!lMsE?(Z zW~nNM-E;0VuS#P>eJs^^7-Fur?rLmztmg;s()py1l zpWp6PX>6#ErK+%08@J8xSm9M^Y^aZ=nqjG0-d!J@;Z`QTSEaF` zK9;J|QeAq^fgzP%mBxnpSgI;ZmGqDP6RJEab6`|`ELF9o`t`M&`c->X8XM|ksb*QK zWn128nB`SzY^aZ=y2DbH-Z6Lg9bT2jhWc2l8cTKXv-&nQUX{j%`dF%3OLb}O{3~j` zDvb^Gu~c_js#8mEdFD>9N@GKPELEMQ`Z6?PcAZzHv7tVeYPO|%c-9kLXM0r|8|q`J z=2)tcAK!h-9Ir}aLwzjOU6!g-+lkqCc~s`WsQOr{yDio3w7yr~?Nw=PsE?(ZYpKqi z{MLtay(*0j^|4g-WW2xp@s>)qwJw4B>(%4WROEuq89rveA8|Hge8XM|ksqR-* ztW(3|uQ{i~{a%&EhWc2l2Q1YIUo7hKfLEolp+1&sfu;H`|LvX&JSuZwRDCSfgO;kz zpFVB(pjV}_p+1)CAxrhxd&@p}$g9%WP#;V6u%-I7$Fo}>_Np{C)W=dSv{d=&S1wuT zRcUOfkEMFVQa!TwtQQ{fsx&s#$5K6NsRp&W=9fpkDvb^Gu~d&)s!wY^Jp7nfrLmzt zmTHlus(C2ks>dx=``vrreB7(j*iau!^@OGRV&JNWpYW*6fl>9bR8Lx} z{SyX$`=nQ;v7tVeYO$pn_2?tNEcU82Hq^&bJ!Pq?K7Q)tr@ShS4fU~9Pg|-nTW+X$ z+N;voP#;V6jHTLI|HZ$a@v1a7)W=dSu~flh)BnB1tJ2s|A4~NoOSS37{7?VnRcUOf zkEMFnR(-wW*Jr&djScm&RL@ze4v*FT`#G;lV?%u`)ly6K(Nh^eE%m6(fl>9bRDZTq z?MF=g`=7lkjScm&RDZElLq_*G;xAs6#)kS>s^=}$=DX&^J?~X%Y^aZ=T4t%HjJ@yI zWnPuWhWc2l7cAA23s+tBf>))np+1)CMN1WYVbkUpy(*0j^|4ehS*qDt(>{2~tJ2s| zA4|2|Qa!oin|GIcRT>-WW2s)YRP%57W$MdbmBxnpSgKc4bu7N+b3SkW8XSXtrt@9Mvf^9(d|C zuS#P>eJs@qRh{IhzOBA^?+ULSL+iw5E0F z>|N))=~ZcLsE?(3OI61?HSD-+<=nTtDvb^Gu~ZvW}+RY`hAv7MYt-^H_u5_XM+b-Ga<`UTu8V}d2p!NGq4s-54`=eLgTp}An z4fxhimS-)$3k&bBSySjfd+E;WC=-?f9axZ=|?#)w-zAc(~paF2By< z>t{VU_f0pK$cE5(xZd(`UHtaa$KG;tiEIdshwE(**9Q%!|NU(@m&k_Dc(`^5*AQOe z8-Fn2p&i178$6AooX~i<-a&xcuQXimSgx^}OK1cR`4sA1;nKnKLyY4T)l^r+#;H2& z>0wUB)zsmeZ_0fQ%tBvNQ++wV139izqvdJYrlobU%Gz-;ej;uhzVTSzDBp?%Wh1^e zS6;tl@xpP9)%DK6bV4Er*+-?1!$}49iQg4gQIGFwmdCDbsCH+d4?$IRQ)NE{p6t6A z-Ko0JeG=>w=1R*MS6_e4qVkHWDtzs4p)@dcv4Y|!<9@}aeU z4o`Oge0J8X1>^H_@jYes@5RO%)9A6~) z3Fs=1R5+SW5?}759O&9nSKIK$G#zS`4d9D>7D@1#aicBy4?IcHywj3H4WpV zQ|V5~nWS#z$`^lJ54!2cD&+B&E`O3cz9C5H+T-vdL=wOag;()Soam;z6ZrAjc<~`T zT?V|+I_j&4$co6M<1#tT9BJ)KCZeGByQOqB}jd51eAxL4^;EOg6X2k@VPu0;!x zjc=kyT%0#R_bbrct(mR9%FUaYk1*p-0kF}X0PZE-{9JtuOi@0HpFe@_eyzl8x}lJ# zpRa_#Z3j)G?p#!Hs(mL-5*tWG=RgHHXSf^E(B)0cbN7#1fj=K~Z);kc?t}?$b?W>W zbcZ8>wK|cM+(SVl%s6(7x7-=Qy((|0(2WiP?>obAsb5u&kVpUVB^z0wJA1OCIS4(@JL`-8|4NnyTmq<44lX&7IV{ zeP7cwiqe+Xqc_?RxF2*koT;c%{W8bXFIOS>VbDa+QgpUGLK7#rn-i+uS*~dmr77+=jAGaa& z0ni;+tjKJ63q54cpOL>Apvjw|=&0vZ`xfN5<%RhUo{bk%!_$FH(dA9_==%ilr+{X) zrnB`op&H!sgE&rEkKXx`U!Hr@Q(TzCGM?jJz2q_kIjp-`Ti zj_LjkH0Phwn=a2|5z&n90L`bG&g#=VC>X^m*AH2(JdUuVprl`d zr?c%5D$H@q)og@)3YwBKA#>RW1vzekVgJ2Y(6Jb>s2t+ z&%@6%F{xjXgS`A4cf;L`pghq1Letv#@;v6Ba|`I+10Sq zMy?7cx#eI90)Gm+qh={8n{L5GcXZBT1mnZy&d+<(g(eobUqxkoRx$c5gBJi*|c(4ne&X#xL1b1|J z@Cz>q0!`*cLY9)#+&s@X!*oY#8bzto&Ce}#N62)~1Ks1A)}|ZE_0$X7_f^nLovUI? z(M|M}gKGX#(0oVJrTTBaXPkZ=bdQ0id7g^zAp9t~_n6tvNYwMYpxJk^qC3>k<-(9v zD7iA-TP}g^2~TI!&Cki7q)>9b8rL^KQ*x<7+Wt|P@2(bkxztk7Oq{Rij>L~@U(75O zO0Lu)hh2^j?84JoJ(-v58Q&%%>_X7o-kUDu9TyrvcQ0rH(g9p@5Gu@f>np-1g60xU zmrA!F-OdY^erbV_*o(xM8}jrw_OG|n(dFlO>?YFvE*)K=$6RyTK=%pg8Y=+6 zrTY0K{aB>JGros3jlvi?o#3%gN%u%Px_s}rKs)glp!uEQ}w>NEkA&-4e zy06mFg>pRcG2Mf%z*+-5olQ5C>#^G-Xs8HiR&XGOV|OabnpNa}EdlX9_+fQ~Qm!Z~ zt7v>~fk*#6jNl`B(K(q}p5-~lunT@2=>GLe-ob{4FUrd4lP>9gUytJ}i%2yv-B1Yi z=M?P!f^KRPmVRSiy1xdG`(n;Tb7x0dKb{xqs2?>el6aYEJE47%_RiR>NXLykB8hh* zi7x~j>6pK#25wyNcuE%PF!8wx0P%6Si6q{Yd)y8Kp9zb<-F?8btjolnNb9C~mzG~X zf8!CjodaCJVWV9nP_e~vESW2~1r{fn4bKf<6uwYpc>%M$Ad+}{b4icW#kO`L9dTs% zQC>AaYX$!M2|X2KCu7zbBfMNkwR1_bH)$ z;pQ(-54PQhVAgH=%DuWc_*8X|w}z{VgU`l$O4|3`bV+eyZ@A~}aL0MCHGlrq(g3Re z?Dl=qB9cCs<2`K9A>rn)$HlX{Zx0?{ecEf>j%G{Fo>0wG7b30JhdkT=^*b3-U!F^_N z2jTuQ!A-s1KHFTVOkCHg~#tmIwCAzbNPOA(apEN95ADr7%H4pJfU z#_lE%uVm8Hfgp~TcP{{nuR>qT(h?QzE(2-=89CAuRoHz7P_u~QDoZ*R%G!k6X_g?;gIM z?cbfXo(4;tjepDxEx=(kc5~LoHpj76frfP5VNffSRLtjD!FxMHFV>W_zZkrCLrHLr!@(#kEFxHn?tzd_{JsdT5w2hgU9aG5S1`q_ zSMX?8Fa@huaE>dOqSPz6z!gm4=@ne$3eM~s9B~CxKzeb{as^W)dIisO1ycxm1ut*~ zv)OwE*Sdn)(C*+!@`8ron!{>ZzsL&95Qf0cn)dDZ*%B$-(sZJ3wrDc&d^9=arD$Tv z^O2gcuJz#M^wm7~!PSNoV%__dV7RR?gE8KCA zXhp}jG%MV>7I(45Ewi{=E$+t__k_i5w>TNaF2WSz|3LRYjr#HGejv~TGcgJ%Jslya zv~VN~;3^4^i~zV(f!P3+evBX|V*6n5$N{KyTciM>(p-@ufJ!e#A^?@viD14X_7T|T z0aO|zV$3aIYk{S;#6f8-s@9?CU@{Zx)WFfeDG8!&tR(0nK&s{!Sm-JXU1OmZ3#F_k z%9rB(p@kl^5EYUN-Dsh$7JA1*A6e)x7E-M?7tMwmsvnh8lbG{$B>DJG5J<_;rN%Bj zCb;IM2yEGGOoLI_;E!Hv%0x+XIDv~Mx-fJ4I;;#tJ=ek$HYdp?$48` zVy{FJd(9j&0dpOy^1jaQr$U|GzYv1%pIv}t%Tb{LCkAMNK*l;MOKb=ywuu=xe>XxM z&dA2Y2b?)F9h_q(glHa22&0Lu#fh$P;w>|o4NFdUA`_zaX=~87j3nX?W=~?dhkuog z2&2K`UE$!Gu9DD4p?xKxeN+8t>!rhY--)o`@x@R*J)25fzYGT3b^sGewn_ser|hf= zx8Ix*`w&y!#23?hhK)xxyn%>@V>;?dmW{)@=!kckSt@h0M$q6bP3)Q8bK&^RXOTUp zy)%B-?(YFeO$l}SvCCX(yA%DOZ=$jJeG-hFBRstm`(bx3%G`Z=`#!Wz(Y`J}#sLVtxj7WWF5 z14!W(0jd(ZIIcA9wb|)yX>{89QAN?jt7VBziPuXLTi1coSzn8*v~eV{xg^9XZ?KID zx2E;)zWABpu3NW(st2w#IisMfncw)KizJux(>}tX;Ld>@gL7Q5Cpo z;!hU!FF-|-Pm6)w-V>V$YcL)#*(*(KGGHW`oQHBn646nk6UCety_1}?za+7zEb(E_ z+fbB&2p292RZ~YgWUVPuIpmgz?==VvN4_(AJ`6vDl2CwF;isr=U$Fg5M7o=AC!MMm zFa8r?nBN#8)lNe-f>d`(5REcQAo48{e1-enJhc;kh6WjeXiH1b?-;~fhxySC2CMvMiAaU9GhA zGEWy@$3EWu{uo@9vYrM=_2v1179t-32W!R}w*?T@Ye2rbqC&p}u1;`lUd2nLGZFZJ za}FS-C8$3X)NG;eTIeYYy=I}0Ep#AiQt_T>p+XDIvJk&NqUdh2&^;D<6Oghm_5o7% z#Sk=t;;03rRx}#`sd9L&kI;5ydK`w5Dbqv3`yG_J`Wci&pHb*BB4xx!f74+oqQ;&Z zMrA{JtKp|4)af33et@$+b?19To0*l|)T{G$Se*i-Pxcr3O}6IL}83IIUBY zN@e*h0?uXST$D1%Va7%huOdHRoBSx#IW{V|rtIsM&&4*)>>4E97%Nq07t|z{uYh!m z1~FFpafn}a+defkvR4gZX&ou8r*29KyUJx6VaEgs`$amFsv=kFid>~D5(Bob$oDvo zwje9+Es@wF3M{PfJ)wP3?Au^09u(^7&I%rn;Z~XI=q|BwqF~hq6mE~HY43@DAgZ&t za95%$c=p#d#f3YA)4uM0G4x*d@d$>=x`(DtYzS=mgzssT)9D`6HE0HY6FX2d+=0Sw zhBj9x1FiO&&I6_9yUj3m$NC4)NPaKv?$2!N_k zEs&UYN>#!*+8TNfJ5ShsD%&60F40F?Z`|+1Y9I&O%>E23^9DqvgP`9bo!h#HxyG2% zp3Tw1`2K53F$CdETQF*6EJ2>V#q4z+&9`hZjj29&r-9eLh zh;4b_MybbHtVc`*zXi&ADHnIWl_Af0EsgnrlLVy1=pjJo3y$W(Vu79l)Vl*@vqG}b zja$D6#K%Sxn_=i1SwhYtiRZmFAJ6PMa2Dc`X?Qj#rzhf0wcqK0mPksb1B8r9fWTWg zy(WKI^+2l;P1U)HNq@=J=7R?c&5AWP;?iu9dmh z`kV+(EPzSZtC8ePEXF>t98t8c*U*4XLe8+;^i+wTvSeJh^u-&V9^WDg6yOezr zdNGnHf#z2=!u~Q(<~|UKvR&N=Lk>y{QGL5((epZ{TvM9(byV-=Qix__CREnG58~j& z-h@^QhPKyC9&%A^aHQw?(!#gmpLRdj<)?nxJqDCre%A5skpMk)&_0Bi@50KLFG%FjVi9Q9SI$Htm6`g6eel@$&>SpebPV}-z ziDRM~yO;(RW_cX=rR{=iw%IZuypT8G+9H8KV9DJwxba!G8z5S!_|10uJAWhh#FXrF zz`9xr6b7VZ{{kC&C7?zLWgl_Le%~Q#YguA*IDx^2MH*zf0Ed@g8y6+qdh&8rYO}@> zyV_j@Xs1i1Y&DZh2F0=7?k?S~(!?&)(PgrTIb>ezjX0(Sr78WYr~4$VYWEbyM^f=d zlILQqX`ywc=9ZeQ*KkM6QZ*(utZK|CASDRZfK(l|1L9P~wZCKraWzCW4oS999yaXC zXx(Y{e!XLP7sv9}wbF57$m9xUj@y}yXfSAB_CGbKMUu^w0(HRQBG#-Pq$m>FnuY*O zVQsqZ$M&i+BPclLpe%4Mh)^KxmboOkkqR*-0II+=uN97?zY-Z%f)WZ&mwE|BSg&xk ze7qcik&Z`4HS@QtWG8<3yG{Q}u5iCY?olP-XV`uB$?Q5K7TniN^E@MdLiicBYf0h+ zS^sX?#CSb}B8H+UX3V-ugKeE4K$Wa@%V2C1y3JZjrm2l5G-9Pe{E!HhtM<+)#^m@4 zSTB&E83i?ym$Q+A?blF!w60~V;O+|CDF%$9kwgp8Vm05)7VVg`6651%XtQ1d%eaH> zIbd$R@iWZ7SiI-p5#upH?jDLuS)vQpb4STG46isPvR99=!0ZGDt-W_W^B}2*pYmaN z-Q~m@N>437tSKUx~ zCA(DP%-PB6Tv1xs6>QysNo85b5?{@<$wRIyOZ+9i+nBz%L3!gHq62pS5_HJJT2vP& zC@G-`wmrlk!KE^BD{$US9D(?ZK0|&O^;6wHLQP7hSewk0d!eSZ@XcUrf#mN-U(NK% zLu$c?{ApQ=KVDP#PW(}G49O!-v3!V-ktQQbsGRoeJQAd&>fJ9PK-+LpVnyWc4Y+*} zRj-s8S0I$Cd&c5k1f-PS7l2}rtblU@u1eLh|0|PenS~w!q)evWfK<#5q+UTo0jc=- zIZc(?OdI-L8`^0@->{*a^eWy`SobO~^?uNb})YAF=2VS0R*O`Ogm*;BKyI_amtL;wyn0(qRBPO!B(nvfny^%w!9fh-o=9H zV#Hrqi}amt96dp3{AqV6q^(pPbr2e{;hv_B>RvGxSJgJPfG7kBg*t9}sX1%)b3t0FCFr$?zvBj!!T1TiEv`EJsrFU5e;b%E) zG~d|c#IlMLlf=l8BVaJCHStbeYAC*rGIc}k_Xh6}*M1W`v-N4oQ2Y>%pk|1!#s&t9 z5J^7B0)(HHHfet^cDGAPc6y{F9^8Gkbk6-wux%kAW<*j^xkc*1_L;!T!tw41DU#oo zL|WIYT58WDvgLW+*<3@<{4)G3+d>A369A|VM^p7OX@m-kTMS4wRx=j0H zriLNG`k-U)Wd~)GswIaoa-{l486a2xaGTE<^=U{ouVqpWW;e}iUsO@ zyPj*$Mn8*vSxZX}J>a4=RbrEyV!|c4mgf^HRh!~SW+x(hMu?wNl~+KajM?va(&u#5 zq_1XRyW~Kgwq`b9R(UicN!o? zXXM3Bd}s~({Y!^X7cjrBZr|G)me#S;R@$aG%sa3cSuyk0nOn@fmad)HrWdmcWKanl zt=v8WS3r@^v5Q=8NkZ$*P1CwcL{O4RTH4AXj8!uZ@HJ>AE9f;SQ;fqUaZ9}LJ=Y)(_<{{>^Ha$1h z6ECkvLt}2I7SCj>HQ07EaO_cLzClZF5OK-m9{lLO6ufgeSiutQsD`DyXr~S?HfN&A z_6kT!na~D3YPat13AS+|1`4R7tTUSUor$h(C9u&-tRQ@t+T;kf-A-(3ORR8D{Q5A? z54*AwF5G-WEAk5+uB4{DGyE*LoY;jR+m9S0ld0rmXJV13vXe?VV)xl%V>GEjA)O;l zd{Qmkf$sJLBNgW#?QbfZ9=bKNA+Doe-Q-YmG+Z0JXT z6z_jpx-8H%3*EPHRUCyDR|3c-`(_QgNGp7p9vkJP!d9vA;F?a^wro5S)9tUb;$!V- zh*7Gp`|#FhDM>xCtGjO9g^2Ml--vg1Hv>X#)7IBb7dr#Pw=aIaY6FWM#VQt(2sZM3 zPUA(cUa@!mJ&31!oCoy-qK@f0kV7BV2#@jvmLdyAJxc#6(q>bn<9?d1k(SMw{6V5P zZXoGOKSgo2={39ex;JMdYPAQ&>9W$Cb%509do!RGq!V!Nu%X`tq&nljTj*sA{RWWg zpaJmRBD~TqU8}bk<}d-GN)7lM%Uah-7mXK3l6S8JcO-dBCW1H~g}Pc;*L0EOJ#1}^ zl08@}*o#68gB{5NI0NOjn(1{%+CKr|>crK}k17@lxOhXP^k ziA&x^<)t^il~{J&Mid>SMj3c)h9gvHLPCL1$1O19+=6|B)tF#&p`LlNI|sqGl?sts z@{CH`wfgWR2ZybJs)9W7nUYoFnQBUt7z;WnO#>k59}VN3I}t*_B#~Nti{@W zf%w6SzButMX%Fu5CV?K1Hs!yx|@3%0@5_-{=#>A3P z5#Z=m`!ZyB_hMYmK>esbb_F11^>T1)Ls9|fMnLTXQ9Y_&$$odM;5J#@4nT^R>QU_n z@3Em@1G-H(C>YBH;xt&LF&U7Gc?KZ0PS1&tijOI&(0>J#fDbs2;Hq-<3qUG0TKtOc z6+pMcr`8hHsvplkxOQHYxn#DmIOKA~EZJY0*saGTEdHQVPeSWprRa0h(TcDfu^&qj z6isVPo@NN_5}?(Q`_L$!eH5{oxcxML<4MR;QnES`kTTNG1*Cf9TtKQv)&f$h?m9p& z(@+({Wk+$5*xFIDdD)13rY!3!dq*QmtX(rXD~+o8SZT)!YPiytPEmh`8^V9e+F3}x zd!$zXEZFyfFv@=|CyWW~--(gl+lr$0Q4KT&&>d3hdO%7w-vmgN@J>Lk5@Ir&YQBzC zv;P0h_y36Ilg;dGS~}SnCqnzyXQO$s8fs+bCr%N}v!hM-flwaW`W*EFHoasLFTF+f z^RT^CfU%Fd`S+35WtmR=x7{C}0LnW>Dslkbm6DItM#^YOT}H#!brN;3{V@xK_{rfk=3iC$;X)&Y@Ed|#HQKA2!M03 zwrmFB2*FlH$AzGtSW#*6qD&Oh7(kK46Doc@F3A(0yFlrbCHCuaf2bKu)jgKtXi11! z#i#GM;-yps?V=S@Xqsqu3-qK7<)&J%AzgJFRV5hC)$konu3G@sGGz2rGlZ0KAwrET z(d1pV2uAj?tc*bgj~Sv3cu*9m^bLB5;bm(b-Zf}3asmTVc9Ou?oz-<)7U~bNV%>*V zbvh|kL~0AA*i+^pXJ4wVFjpVgy^NQ;i|fWKvZpSLtna^3hq50{r$hA8^Kls#k1>fh%bq$W+yE zRYHxXW;$wD5jc_byAQ_bCBh;-C6P5K8mX}J;)BiknC?tMG?$gZl3H;Ge?+;OsY8<$Gv+HcR-%R{`sxQe&7g;heUdr<=*)&*TM( zpJj);Rlazxy}^mgqNOKAv4nuZZWfZlU^h?7rH4v0jEnYBBiRV#MNLqsX_Rro+^fny z$3j;Da!ofNG`8B+Ov7~^DP6Ur0!{Ci@f#~0)3FkwEB>FX<`a-9Rn3zDscL4HRW)A( z$WzU!nTnh~@-8B=PSuK#u2Xe0K%FWAPo2tyL6R7e#JFnmxNR;(u7eOI0C45-KoPo z$eqgVLI^74a+_^dF2!AnL~;ILj;b3V&LKi+0E{x&drloO!TBd8s&X8?rE@11{%p9Z z*6xF_G)q0JAJ?8m1M_6us~RowbhZrmD! zZ8x{l#{i+kiql6WLNfuW1GH5Z7Xze(uG!+A2Bb#z%@#KVIl31<;Cu^LC5Vhw%?Q}S z-Wh?_s2s?!b~BusK*s$;I7F^nNx1h0=71W(h$uNBqKwQ+hZ51$XjkMu*6BX;Q-oBN zU`7GC1e0q{YLdpKA8bxb2IGSPscdJV?{fAe1AGBDH?Rxin#myxA4RcWf#Hg*7_M{< zmF4I*6UjXdQK|N+0Fj$~5w5bSt$_BLymP zBmc)MHJ&<;#GOTLp&;1qEXwg#+HyScX= zNyzhPvWC8U1`sDARVBE2fH=1ZI7NVz2vZfQ+PoZ)s!h(HlwQ8Y(%ot4RsvFVs{tut z?F6LSa~mMliZoUfj&_bpqxTZ~|4BD_KuV%#czi!mFRQ~gyL5o5ro~vTIS_W+?zqoJ zlVasr)i3TbDN*o%CdcV0mdeDLfRw;eBPfBr1dvO|OHc0g7%Gl#D%&q*(xb1cvs=iX z-h@GZuD5rvsTUh7FjmEm@1hH~wIWgWbnNX7!rtC~eNbyLw)0jO-ls#mN&Gq3%Ze@LdJ*4|l zQ{T+u3bA%F)1b>U?F zo0Q`~nJmf-Pc9yn89OZ8^Mc_C7rt=A*6#bGiGPb=Sde9h-6KGJ3d*kfPs*B!0H^v7 ztxYaM2b?P`j{6KM^j<)!$2|<_L80RU%yNM?0#g0rbwH|5y$9$!68Z%o)e8^Ay^8N} zK#JoOK&tOe0;KxcxfZ$2*{*^En}7g6{3ZAffEOxbE>dufW_yX^F`+VK*Bfjmsn#_BFi z4`A8s!H-d)2*ogto&MwsH`>}e-I-nf#VCQwx6BwgsZ=@V@{O{6xOU=N3Q0SR|9`kX z^cqF$x@PnX9QVSp1<%7%uBo+M8BmY@d-PiDMCz*bXmxWGp&vbKC;v*3a@35AtV{;v zQmM$7O}anWyPKXy+s3daRQJ}@ zinLk3qQ#^7Fb50Ohl?$AA)w1ry`aA`q~sAD!>kgZ3t$~k^~>Fe$2rnQONHeU=l}j_ zPjjX-#edihmbcRW!)#98Kbf9-8}dJ%p05Ww=AUo}I7j^xTs$QB&!u!H+ z&uZ2`*?wc4@IRgyI1Y6V{HOQ||H*uwF8%l)PjbvZ*$$aVstDfaWZ}v_<#R^hIzymr zTuTKSjVtYRpOb^@Oo57Uy+9zbMFiqFHcud4FBND3uC(lZPA#q#0xiRpt1v#N8CTA` ze9m%QuM}tnu8RbE5Z4BQR^rMhmW4SmiQT)FAwbGG4ni$FVY zZ5L=4u1v@0?7=lD(0*Jww}2YNKaUak9NG`GoKP=-9uO!S&_e=^2E+|H)CQoH0u=!I zkw8U&9uX)4=qCcr1H@UQPaf<3xj?nR{X(DyK))1d86cJl^#bT=fmQ%|Rv=n$8w6Sj zXp=yz0Cfqp8qiAutp)UJfwll*J)kxK(Z=&RI{>{U&`v<_2($~(`vUC&^npMQMwQc?1X>H|IDt9=ogmN_ zK%)fO28fod&)Es+RDpH@I$fYWfN})d4=7I{cD0EDWdhE#tw3$I+%&~(kUH{5)SuidxYm-OA~yW4lK z?*ZRKzVG{1`hMhl#P<{5qrRW}e&PG2Z!Ml1e%80ax5?M#d&&1}-!|XtzPEhu_}=$@ z;QO8L_r6`eZr>-qy}r+UfAf9e`^wjx(VB5mjJq=K$+$1$!Hn-_{7c5aW;~qn zZy7($cr0Ue#uFJ&Wvt71CgZt`=QCc&*pl&bMw>t3-ih6J z;Xi`k1^+R88T@DP`{BQYchEEe_`QIK;P(LdlK}q`ek9;*_)+kq;rU*%T=;zW0{AKL zMexP&+Zh*J5I%rE17%uhh=sB&G|WOHEHu(W*%lgQq0tr^YoQzqh2~l4G7BxRP?d#hEmUuz1`EY3w9G;`Sg6@TZ5CQ?p*t+J!b102 z=s^p8&q6CL^st3iS?Eymv z96-z&^TgaRA1rw%JX2+QOo>Xp1)lLf0e>qzW7!P77I5ks!MM0UkSI`g(Wm#yLg+^Ftq=m9A zG|EDwEi~3btY4KzzJ&@bG{r(i7Am$-#6nRE&9cyi7Mf?F%Ph3OLRA*3wNSl<8Y~pE z&@v0%V4-FUwOMGnh3>G>3Jcw9p$9GWJqxY0(8Cs5WuZqcwAw;XT4=3>p0QA;g*I7e zi-lgX&^8ObVWAxsdf!4jE%cFvxOfwT*|-e;2KZ+9a@Z|=mhBGs74Y}MzXBX>qm_W~ z2fQ2bqk#Fg-zV|A7M^cw>xAC~zXkpk_-*iS!0&*6AATqNNASDgKZfT5=V$Qy;qOFT z5N0O;p9wz%J_|kx{0RI`0nH4+G^I!5ek^)M=qj7TRK=S1h#6LT^}ThlSp^&`t||WFhxQWofE#YMFBC#{EHA zinEu77<`=eil!z3aG_{=X|%8cf1xG{2+j4la>we)tu!Pz1sq1fPmIXXfJJ2ice(u{6D7X2bb??wAj>%xTN=al{GlL%>!Y&Ip4Bqc!3Fyu| z`#*m(%yNBZX;=!nQ*~!O0xW8kbS#nIcM+~c_+I?^*+*Kg zqb-f$`a-W<4;Lt)($seEBUM z<<0N=4X)IKQ|A3_#Zi{4*wPrTO}c)L7OrWyvJmmYn@1gOxn8m~hRf0QbBu6p#gzr! zG5u#R9Ami#SsKGdiJ@aX_=tkPw*rx07SYXvx>lwa#+ONJk z)^fdNX-rxLx_*x9!*!hHI@8h^uETWwP^0*Lm8c5JVQo=c{CLYX!qOP79G!Z$aG6%7 z9A;atiI&E2)oTrKf^c=<%Cs(D)Uf^p%hhOU4A+%v&~i=`E{@4;oO!wPmYit08Z3?B znxZw^Ny2psu5>@n+xzX4EY~zkW4IosQh^%<@Ao~5D|2|utAAfO%5weG(ipCLDRyut z!~1rG~z6J01vA@u*Sa9dX-?ChvTN=YPUe^yxeh9gO%d2RvMHn&rCK z(ipC{bp4DKE*+^8{ow7}$6BuUEsfziOxMrp!d1m9eCuD%`+aI7Y=osTT!VG}j1#Ui zkV6iGe{UK(c$`fu%hDLG-|0FWFI+|rue@i}CF3pEE=yy$&e2855w12|S@hC9L4S_r znq_GW7iT$iA$Y%U6|O9L;K3Ju7P4GtSQ^81ovt6QwflY49&~4gijL2m%O|h*gPv6t3XGW5AXMJb)I#2*}@sk`IhV7EsaU*R$V_6 zglieDbiY~g$cYmy*BzF|aDAdhZz5>@zT0qR(H~uX!qpQk*JqZ-aBZh3z)gbp`~Hl) za5VbWZL6-CWVtv~rJLj!uAv7iOaXrUKGp;aasRFZ4=u1BD$_DnC|n6#SjVlYW`nfq1&$L{NEsf!N zSX)+S3D<|XlH{4}!h6rMTtBrmhHE)!=!)R|zQ=K8c3M9C;+Z1Lbtf=%MYaxOx&_0) z`hBx;We%^an_C*TT-R9|lh*sX1*Zv@TOUrdT)(q4hU*uM8g4p#N_zMI_V#7dEf=>K z>89Hp4rN8d6~m|O!`0VbFrwIU4YxEVtuo!0ON8rYTv;1W=gs_&63aE)(ikqT;nU54 z_xos3o*xPGkbr%bqLk-WWQWgTAo)vr!G&vG4ZX$;q2b^Xi~F6w!9rX6pWoIcZX zeQs$C*KFMjW(gNZ7P`w%z3RwWmg{0mW4P|pz2JP%!WQKfe$0WVY&+j_-Dhbmm+l1@ z2p5lV6OsRy9p_(=;<7Y`t6b|k_F})!ox|CdtJ=~St}b0a7YdgxK=P~ zxXa-EK90^T#4Y7hHeF`9?zc3C>lHm-%oi@&59IoO6>U2f~}d%72h#_;5@+;aWU(wMXYx_%ZQF2B#6!v&UWu%$6v@9SPr zAzbbpR#>jzSsKHYr)BI4;WGO0y4Qlgyuxx7S{lQ(M9WyEa7m8_)ENl;N2TS8TN=Z~ zeP6mNc<;=&%5rgzN>^p;@GLE3)xdhWsx4QEr7>y!o35XlK3p}H>oH4XxNg%jwotg* zaAn8M`_4TFF0@=7md0?&hh{-nD_mN1WJX_Wxt`T^SZmAmnXaF@K3sK{>kCU`()yFG zpDTrn^C>pzdo^?aex>EwV`&W6CS5;Q^-1e0%k`3_Fxtt(ipBi8YBAC7eO6UgIqN9+VzVq*WcVUo)x?$l9nzuV4M^du5nGVM!6M? zBYhUu^uY=zeZ=>$Ch&jo%N}AJr>Lg7A~r53hj331xu#E>U0z?!yeXFBXs;sE5U&79(o#J|}4_CI}tSS%)^PwK~ca>%rruBx+5sN!)&tYiK}+X+lS(fqMbetz8t!}Ukw6xU2oNgajbMBY?YGd^ z)Kp&{t8c1a78|E^P9xf(zV3>~Y6dk{OSvl=8!N7LKv#ZM^|j?qwH1xk<%_GA5)&$4 zSRE^`S<<+uB35756ieY2HZF-blnYLFS4XLI$}8#{7MEAnR#zg!!salgrs~RgV_odp z@>pHvRn@U3$HUWv+|(^utisAG>+7l)$I2TTmsA4prMx;`S6LowtXSOCu%r<*6^#{( zs$TT%w1wUROrk&%>vXuOg#5T!`UKm;Nw0}+U%3`D@p3=|GY87P>NGElfk z%0L8GQU)T@lG2NWil(-rsl2+fvb?gcp%y(^+nQ8P<gJ;4Nq^0?LT%aulZiS^?($E?JZt3Wjg zkg1Bb5@~l{SKYY8DKD>E)KHGR!0?JKSu8PC*VI&3#_F!Arkz=?#mbvC)mdE1)GA^x zoke2+!Hiv})>Ki?DUireP2J)uj`mcs(7rM^ve~R?tjt%nP##}gN86J|GwfK9)z^#4 z7d34x(faCZs_RAj!`3gazB*o^h^iYKmo%c3uqqb=MP*-8&&kTT`ub}YQSrk-Tqul{ zuvshWU@NkEWH=aj{P30+#%oix7p3(|nh-5zy+TrBT6yf+hF+0TyfMgOx>#3LUc00z zwivdus~+mnaMe|waf>z9u%tmvHResoDJ(CUcVWqSvrA{5r*Jc;&z@C&LCNe{rNs(i z#=@qCib_}du8gtKyrmQ&_M&vb(}Z~SW&d>j>&yOmtn_>51!;0&_2mGOdFKRaBJt|W z0b+8^2hv329y`+nyT{Hn!LG40O=xQDOcUrDJJW=^$IdjtR$umCZtvKs;*iOsuGuuP z>TZ!X#673%pRRwo>7S>!-1JXr<)(j zx2&2$%AijhG+V6ucxYn(Y-z(ZUv7T?d}+cw>msQUQ7?uduX^f2vE^Xn8r~bKITwy! zQQtR2A**uh%DqZ`wo{i|)dxp9m!cOM_dSgS4yEw|SIwpBH#9MY20VCtC}&c(%jNWe z6=q_7zJ%oG6yz$B1%s<@RV!Q%V~e9$FNR4KX}G_iY$s=d`#^txbVW{1r~6QUe{{{D z8y^bs^pSOZwcImUhdWNMJaZ*5J8Ra0@%i~VmIwg1H-8G6-)TB-b_m_XoIE$(0^EEI zny6kJhlH(YliXT?v}IG@XqvFXV~ux1jqDXqM^?EUsNje1)Fu$#%_qpqZez zGr6=VbfJ8nfU=HUrJ%W1)1}fa^wbN>+X|Yed(-7k@Z^sz`+}x1iAcH=y!Cu40_9k( z-sZCD<`(1|KK?Sk!J5Y4CBFOuX309P&K?80yELsSulry*iJ8uidc{|il~pu8H`h~M z()MwgS^5=>@;XTME>HcbGJMo`59oK1M?UJ+)y#W3d^ITbDyd-GDxfskc?I~eD9Ivx zXV~Kel5_YrE4-XuNbu^Zt0cDMa^Ca3j&0v1ka}mY`UsNyJ+AV$zjuTmubkBEOl2(# zFLB&OK)=~6^?i^V>^s=@uBUi)PwOfkl?}jIHw>5cJ=mZPuPp{>-Zt1h+Qkw^KzGoE zh$1~h>B@#KJU)Dusv~)KmU_W)HloRa56ELEA%V`uHCLc3aizei&v{c+0?rR`<#EM; z^HW^etpd(gT-l%jXD6=QUcL}}=ZeFK` zlnpULPR6^1zm!)_y(`o}9VX@FCk}p^EcvoDF{t~8=EZ*UVKs`W5wY&uOpv_uFYF51 z&F?g_LC$~=h!F5>X23ZYSJhBFf1*Te86cj)R3gT6l>uiJu1a9m15#qL(c<2;I3+Or z%946j9qSGs!);wF1&X6Ow}yK3x9lV8ORx+<|BvB|02_pgU8Obq19?rXe8oh*2rwFC zY~p}ZgzH%X^(&r?#~qh`vmV9rAK^p?l~};$ilGR%=9PR(w2)i5yaN%6-g#u*{AD|FWMZf-}Q&LSIURSljlPUZ{MS%J>2!p3RIqaG!Vf|)u_4H zvHLQz<0D*zsaN)?FH-R<26#a(c$EBK0!U>{O=NLP$1dl6D3BODBInv0=Xm3#A?BMu zTo@N>)(PXG6++7+a`WG=NC+|Hs^>AT@r7>KW=mgHB-2Liz_Xb zlfVB&aq7WAb8t1&FAf1g+ya=C4#EaB3@fcYpX@7zatghs;tL$1nNGo@B2RWp5$@Gx|T zD|%IEzOu(S1yVs9r!d3KEq)c|8V?sIGOmsZ8e-h1I}|xzcVe8vJZ^6Bt1#R8V9Gpc zF?equ8a*WtydoddhlT@;af;?SbBkYvF%NJsKw(Z)KSGK2N`Ewf8|jsebq#Vn;8t*y zTr{h^thjvoh4acQmo!|9WjsL@*Db7Wik0GIgBLTS4ojp&aVC029BaXia&o{G4G$97 zNo`2&-Aj^KV#Ps;^g*)cHb6LzFI2~zk_#@td>2{bimf{fmGxLImzi>}#a! zR?Yj#M|`nb{O%`sz(6U3I;%54A=SpBtCHu)PU8Rxx(g~tLI#Lk!d;Cq0DWV1CAJm% zNw=b*p&F~Wu2$9FSS~5gvk3W36Vt65&~7wSHP@@MM*yv6TiJlrY>RUvGKqQ-3XSuTkA<2VP89O8hSvMc&AOT+_ z7+jNl5@{$Z)WE3`yv`ldG(E+P21`2iM^H_<+dFR_wVUtZ!FRG+$=fG9c;`z9PJ@1e z=+^6toY;80hd$ad0o+dTcxOiNsp82IB#?S5bns5To~;xws-Jv)QR8pZL{_6Bt9AHw zJQEqdA%t}siLaqod|dZX@zth{??@G2rV|^Ricez7>J`(UkZToFX5(**ldZI#N>F#h z)8w)fVUgCS`6HhiFJS#zq55SpGa#?loi4aaT!|0J%Wi4d2AmdLsdfTR0#`-%uYiUL?k5(v7SOSR z>%>*1_70$I_<-|gTovyDKD;SYaEAa=bl(D`=%xZvbbRyFw}g(*g@gsV29ToTGfRr@ zXMkAJfJ3QOxK{wF)sZ&E9 zU?;x#s>Mr|E_R6XglY~Q=jo-zXJk7k=j6_F29q>}KD{!w3_*e|t7yWhg455fzSdwa zjLy#1JKWjo_-l53T}^eYZc%l1EzTey8}aPXI6b=r_SF~_OJ5$8NTnL9XpCiF2xjor zW6w*lyk8QJAy>p!Npy(HVLmUaZmg@hHoLJp7H?dfU5TTrnß@rs}6WR!KLtLy= zH~*b08)xXaVg4YkR$K?c|N8I;rlwXlih!XDIN5rpLuxu&2zWIPnw&P%S08^DZwoOQ z=1KzH0m9|Bk(h#d@S5ST{>$ntwX)%!y$X$I&Z|~7*wN@VPd#+ETG=4ixRAmMjfX1} z0qQj>q&VUB<@hQrb0}PtaX6vza2*7!-$y*%tZ>IK)XIi%=^YiJ@o=%kexJ$VXEUB` zP%9h4l`m0220-KCQY#y@$>@Bumei<~4dIfpMh&uFt|6fH`&j>UOP{^%QMIxmTwGp; z6By7TMpHweZD;tuQHo1ky!=+X>bg`Yr zCr)`st!xMv*J$B{#=|A67Cx$2x>>({b4O}rV_YalutMYEV(q0``GY?ln4w-}Bx!|| za0rcuizULV7bH$RUVrilr>oZ#DJ~@(LgV2&T(}_e;%?vdmoL<7iWHX;4x#aIQ7Zht z6E)XIPaiczy{1TUsag^mp}1AkaoqK402ztXJak0{4m!qVIMYgJ%EEvb<9#fHG%`We zM5bxWD6;&NiH3J)~&TCV7atGuSckv)2x9D!youdK#n4r&zxss)Dx<0l!)gpn6xpA*w*tI^Yk}X36S}+!s@v(H5l~Ki!6n|t zCyr4ox{xQ`TF~Wy=0Oe{aF!1BtT5`z(e6=AWAGARXo6BL8hH|a|B#L@*Sp`(UT_cw zof|mtz}a*QwSrS(EIk<8bo0~$n+WdT*%|0;>>Jf^*7h9`7blM@X@4&^I=E(g zsI%pZufB#cxZaNp6bDPTwS3Wo`}G;P4F^lMw{MSCW4?9%kl>oqLuVq^p}v%=S*Qe6Jsi$ zGl6wXDp>MT`-|~|FU3ZYBoulvk}N5zDM<{iNo1~NaV046TK6B-=9MkWccm;tOOQuT zS)SHq+2JkA>!4eRBrY~(dD)ib9$l6QGQJ@kyr&bt@8Wl3N#;hB1_hk<5|fz`T=N>M zj0uF-vMi`F+_Nz2Sr}B=w)XAu!OSviEVNw;6HXjdlgP4#Nxam(EA7-;?^GvVE>1qa z2c_Eu?_hRyVzQOD9YdTApC8}yA;4kb#MW@jRzO4AJBx#*d&7U*jGN5(h;Yjv0Az<= z47Yymt7&=7@2^4Qb`Qt*p4JEaHR}R?MVcLKZv`PLZOKKv5O=sRsq+F>CEBajJH|gS-@;v8=%Anr*E!F9B3=w zUz0eppSu45S#{Mtv`5F?Jzw_p1lREB%v4bs>(~oQf+bs~Qu5bojj;irlMe)^ZE){b zmlg!qv~ZKH2BML{p3%a0EvDIxR?A~GUC_c@S}7S6+HU&5WK&iAm?q*m33&DWww2tVtZ2+T~Z9(VXSbjtn@oDV3xty&`8wQmb@0SP)$EAoJPscP8>2FTrVl zH~Bd^xaMWATAQZT+H*>+eSykH4$f5dtz>-uMlM~rQuQ7NLI0N(wVH4j$V^Jbi5(|9 zJzTq^x@_N#px~N~p%)J3P%g2$sCt{vJM<4r%iH+cw08c259@k}Vcv z>9^Fa-!JtS8;+n1|5P7?4hHP=2itE!GB`8yC0gNYtPDwJ)c$^~zNUC`{L9Ab;F^-J zAzhn`gVXmI612=12=Z2M)fkN*ewK9urTJ+IdjBX8VmZ{rEm{I68V;dSkXpkc5I+a`(R4Z<`xP#GDw0q5Ge0fMjow4Eh2KyynwA-u99A#Kn9@>rBdQMdx+iiTR z5vA`n(I5tfrE9O2 z#*KF}LJVlW;TxI{Q&Eahm}o*;Oa8VuKo2P7)`TWVme3v@iR z;qZ20+%d1?&RV!Ub%=sXv2=qRlhzp;Lo3biqftq&AI-e#fz%<2B1>bqnn6RC3Gerr z1(lz*O)E+rqPSHkNMpF}*BDxGe&0#@Zp(xZTT_Q9xZFvXIz;iNLa1c~AI(qZ@Z2vm zVd3eFIqz8-lUAk1sHKK_+>v(Z(F?@EU=>>`c)^}CQwI*!l5?m7WaCrD^(w<1YBh($BBuB=ClBFTD`d9 zih88em&Scie{d`W%1XPb{a@~CPna;#wX01*#OvcB#WMubjjQ4Qe*Q;xwR3YllSxi! z`LV1Ul%z^Wk-6Wb0@JS~d#50r=Sv>b8k9;+=<;&&-1+CnC;keWr>Vc-xJDy%x!&z` zs<79gtu7u+Ds~G^H(>&eA?t1ivdpbQpQ$3vmuPqVxN5fk_UQW7>M@Kc|H=1}=z8?NoY2w$>AwSV%yND*1e{hZ%3j^l7d9dvT72Js! zqsbpr0Lt1w5~|b(?SpMUP*mFx97*0MCBgDbmNB=P4wWa;*{Mi&@TWJ)#foH)B4JVc zkZ^Ytw*G3&a*EusA4hz$-J#GXN(#_#_Jf^*lbx>6{{gxvmaSM=#3r@MOukHh)WXpW zNW81-#Rfl$U>2XjC_aKak%|rG$yrzNhm$JV&PuT)S1J-yd`+^`O>(v(Aq$JINmwa1 zmQf^;tnWcZsc2SyVmIc14W$aApmF2qpU`ekNQAk^921Snge zv!amk)}1@C02RzCJ_M@{S4h1&Sx*U2ezH&uTBYOY*d-=_qvfF3c3cgghmp754JmB_wHlz6d!pcY9KIc+j9_(-wqzI)0=>h9~n}g<9+w4XV@O1F~B` zPN0i$9WT&LxaJ7-eOx(?1!O}-L4UBggV1&gM;lu~#eg_62b?BADwd=T{i%gsw9v;E z;wb|a3%~uTpmPAJ_(no6sQ4yQc}N;jKq@p2h!#u0xe*Z8{qgJvAg-JTobOoZDL~nR z`xT&*1lj~>qCm1t6KVOl8FyB(B}<`$Tb2VAP0q@Uw035dbzB@MZQU>`3JnZ3eBr3t z;M`6K-KcrIM4}jPARm`OP2&_*Q8pt3kYj*swn$X93%<=>me{rn2nVg#jGy@%7vrkV zg#p@9!oAl0p{*XE$_%7Z<$4xkm*qHAr7c9iXk9Vjt&AD|*m-nj*p>?ROA z7E+Eef+Ye6#1MnP!bp!iy3*i%z@h-zp;rS5jn06)E|yc;fP4>nvOsFZ3zkhS^SdBz zesL75WC!xQr@#DK0?BXaMJT-cHYB#d2&%SWFoR|aIsZ632QtE)s} z=_>gc;b@VPJ^FXQ{@tm6`6D&^ENTs!VXYWnv4iEX&^+|6`5Pn2=Fte`LAB1jm?yi~9%coK3i~%gGiPTC7keaD|89yVEoSE5j zZ6;UaZa%%Mc`dL~)Z}uOiqHHEPnM2o{X8pnKDn9V0*OPbu8R`mU+@C5) zu>B-Fq-9i%Ji>K5c+A+n`)P2j0Aeb9zSYZ$M2|PdIZkCQP77t9IW;@Svj+@zx-E@a9vOmmq2sK`@8cYe^RklUTRmzy3zOPV`K$|M z(y30)kb1hxzJ4Z%Gd9lB?t8pCnOe>&wKUl>m%aKnjv`I$ymHj|uA_`IIe? z$c4!v^F)^k@Aq*w$Gl$khfLSU#7?&~hU+aIAts36s^k^^u&(a=Q_ETJTN=al5@_f+ zr}N_z+X|Y{_C;Z8Ig4^bhtpGBifK$WA=PK<98q%kgaxUSGs1$4(0I7ia+c1DkhxCI zaO{B-8V?usy5Gmx=z=dF;d7mw(eqWIk#HW@qoZl*U(%Fo)gd|W6X4wt_o0?(-nhU6^4>+oWfB38mBN- z>PL_YG)s9zDa^n2q4{|qOwvSaxmxZ|#trz`k6KfS0XOP5@J z)8|_F2nrrNNxj(=S{bjwz~f3+$eXLk*6UFqZ_4r@lU}xz^pQGVZ;DcsOWxfp1RSoL-n)3RJYw?T}%cir=$AsLm&yp7o_F9!>X7N~-JgL;XR`vUI zmg4oQ)qSd5zcj@i=*dVW9^6@2T`u7!M_6@5Oll!i>Y{(5G)2?I(sH_p{YBW9rgzy) zZMx({KOd!QMBaKe6Ave$g^TO@mft=ACBkX%^doL^PccgS2veHEvE3>lld>f4l|6-b z)f&f5uKVHzW#4?=H%QK1ZO{te1eN@? zR?AdAvR)brO-Si`ys#bkObpr6Ic&pG-3Z;J9M734T3d5LbCae^#piw5#%Z8i4w@%= z(@pT6H5v=LUx8-#|Ha&!z*kkBYvViQ2m#R(6g4X95o5(UVN4toOyC?n0US_lQHUWi zC_^MC3|5qoL^(aiT1VR2mR8$puWj*GnW{Am60o+SwTi=SsY5R@YH_#<*2?!h@4MF8 zd*_5|fB)O>`|o7!^XzxMYo4cf_2eraJ}T(&066p^c>d8B2Jkp{M}$wsOod)QbX{uL zeZk}Nm2gDo9xj5-2G0(|=fXRBglU(R^*C7Y5qNNOsXXkTX#9;1&4*tFzER-0mz@$k zjBbs;F(JMZ@I48hPfVx4@r^dyRK+w-9pjhcx_`}11s=yYVsw#G^c{nJZ-6IPy9m+; zQFn*Cwws)HKz$uN2SnAJ3rC6Bz^i0$1nfH*JXhu`fzc!O1rr0bpF#1mzX^ks&&6MH zQD~Fc8_>QAJe3Fa;2R#^>~<{Ny&OE(AFO=Ne^_8qioS<}Z#j6@4c2e=H^qOWMuft< z3=uZq5QN(_uAIowa1@8qcNggON2*=+U6wzo?DUaig2lswv)&YTp97D`m>D@T6f^YC zMiVBZk7owe*aYQf>r z)mzQbvph3!3w+ZrJwSq>n@VP4ly1RUUXahk1e?GUf)E&+YLF7|Y>kIDFo>I5=Ag}wPy0wRT-O0MOhkM=Q>el9Y-DP!a z_w%~Xs9Sr8*FCas?fzc(X?1G{dfmh7))si(L+jQa>2(jOTif63KD2J_5ngwG-P!}a z?g4dckMg=Bb!!jy>Re173;z^A`7wzJ-$FA#hFOt(1Tm4u?1@a6fsiMJ98Q@u$B;Ed zGhHC4KW9&{TPxl!%>lF|=DVMr02dPf#Fbc2R|*2IaJoZW`PMK&gN!SjFG~#yxWz)$ zy){5!t=qlk61*ph13{5m&2}X^! zO+a6Tig=$oS}ze;!dbZ@MA+`)4n||NmDMiJu9~Q9nh?)qG#c;JusJFh><|jG{7R6`NyOmX6O&AlgF(TNQ}OhIv4xR2G1|mptvJ{Uk zeZO6YvW%j%btisMC3K`N;*uva;i(81)_nqNQ0HX^{=#3lOdX3bCR#T2NtV9X^k&=~ zf=;HfcXf>TyL&*=EU9Xf9m-3m!L_MS5ovP|6V!mWw#97@^-@~nEUl>Cu$%JPq;1bhOYbdk*q@lZS-2R~c^6_N9?7YVu=Z`OekZvo!Z1hwEj zUC=l2t`_v4cwZ%m9Ry8-SAjGQ-f(D_L!UY1(&f^?R$@t#c;?$uG*Nu=lNo7PSZg1T z%svqb&~j4|mPPN{Y#KXLug9Ym+Y>FDbCEpV1Ea^3@#uF|>F24ZS$>cxc56lIzw5@9 zj{JJl4jUU%^UH~86fo07UI3)^&vigrD#X7*zs55cPKjs6#$@3n+8SY1({lYV)ct#4 z2nEA+8=1A<5}KacM&d?WS>6J9MQ9yCruNBwP2MECR5m6Q!pr`Z4OYwUK8TU^*kRn) zwG7{4_oWIw8tkd$@>m^FJrOrua znzbG2NSzwbqzhmcCo|9qJ*4<~m@F@iOiB%i@7)kDeGaWbR1C&TpHA&33p4H*`V|{F z{HcM8c;oSAr4y0JtQ9m1?>a%uWSV(y0b=HhcdXozk)=7wcO$@1#X|jF){v z(62UxNw{TcST>}?4=X^W4}KnRS*s~>Kd6k0bf<93^7zdp>@!u;yCE6%oAq#V4eO7! zjNxd-mUPu;Qq6ZwfDT7R8dVQE^dgW}of3WFj*Tw-VhX*9C%D$f0*__V? z7*C>85*}6Lx)?rD&h2XDLtYuyO|G$R1+&%_C;{6n0pI1x_QhClukD*eGk3eyAm?~| z*cJ|-1@if}#05V4*R?F}dtB4+yHDusI~=a!%mSVYx4!Ie+fv52;#fl#!?gPZoTPvu zh~8+R-n0L0`ZSR=g1 zV71F;?$;Ab0n*m`pro6_FGPir$(4aRMauXN>%wvL7K882z)8zxoh?> zu?N8U@WkDSP;8ay@@4m=MuUW&7f8An0;zwTGr%~%2X3xmu|b?BGqW4$|L$Wo)w?0! zMu^?}2XrMJ8xeQg2GEl= zl{1i8c2VCZZtEjrpsGX&iS#DSX~Bl{28{v6`F|qS0v=4HpRzvTwi9gQnXb9J%HKhJ z+xKB6UQ;<8;g08Q0MCp-hPrJDbkVd-ugI;OQIRHB( z0qNRxg8X7w@n+XqfUJ$?LPex2$_6tcU2!%f*bs)d)?B{_nkO`NxElq%fpWI?NE0?Er+@f zY6a8-P;9auhFS^rDAXFL$Dul)HbHHHdIoA6)C*ACpLMWD-Q=mBRrPSFHD3+iys0ye!R1#_u)Fn_;pr%4i zhnfLZ4>b#_0V)Nx5b6e~B~YzU%b;$Bx*h5+sO3=iL9Kv#0O~=ghoM$NJqoo3>T#$J zs7+8?pq_!+2K55ecBt2&c0j!ewG-+cs9jJWLG6b649Y`(;9=@KsDV)VP=ldZhPeqg z22}_(4C)l9BB+s2l$CK7R2ftSR2(V^H3^F4dJ5E3sOeBMpz5J!K{Y_7pcX>i0JQ|F z6>1sOtx&f^-37HA>OQCyP!B*o2=y@3N~lMn)<8WD)d95$Y75jeP}`thfZ7iA8q^M` zH=%Yyy#uui>LaM#P@h405&T2tK@Eh;hvF6J1yDnvVo-%p!=O%qDuQDDQ37=qR2ftS zR2(V^H3{kxs3}lWp{7I4fU1X@1=RqRf?5c5CDanAR;XoAS3%tl^*8uyIezbhS^@O{ z)PqnDL#>2*6lx9B<4_$?o1nHpJp;83Y6BFXL!ct~vnbD@fez(6G}xg6hlV&5bEwdv zVGf<*P?1BdP1FY^4xQytnL`y0#T`mI#JW#yxx}F<4zadZ-RTa^aH!s)Sq`xdRTC+P z7CLl;LrWZLb!eGGw>osYLw7l}+@bp%TH(+G4n645!w#)<=uwB(IP|zf9S&`BXp2M7 zIJC{77aZE|&}$CuaOh2kb~^NqL%SUM$f4a1eddsdx>e&j;!vJL10BkDXs|;C4h?ZA z=1`$S!yG!rp(2MyI#lA&Sq_ysRN+wEp`=5T9J<7zDGp6_Xu3l)9IAI{mO~8=r5sx5 z&t#If8haPn3VTV>a^r%B?9D3ZL4u>{5w8f!k9NOm4 z3l42}=rxCSIP|7NI~{t*pDllIaKCQg+pxx~L(3hy&!H6#J>bxT4n6G9N{1eGXpKXUJJjLOCWp2-6x^YSDyheg zds6;)PkszhE2Xce0zXK2YUlF)dh$bd@N%m)o`@IokWKO6Scp9P;hmdvCf=l9zhl{8 zUyw=K@mNzVd3-Rl4O1uJO}Fm7X3Sgu$q$ZV`S^lNerxRM2WoE4$#~P$Ep^9i^G|*} z=Xk7Jg?Zs^r0`vB+qI3DYtrG~P(*7q^{AM-4{w^9di!4>{=@`F z#=RhdVolW>t$a{(b7J^n2roQp=nX1YmE4@`;*;-8abAYcAgJ7&JNSm0al*N$s$5lk z$XpD62RTz*tKoAHRBjIUpECcAnsoUBm8(jq2r4$t$0f1 zs^UX(0Dlj5rgob684PM}&Kr2s)ams{K>jWqmghakV`JlFqs6u&H-|e_$uhBF>|YLX zrivYpHFb)KjYGv0=M7mxzPWY8l0%&-9&6=usAo-a7LdctYiU2zYaI zOt8I0e|qTnA!3ShaK$3LghxJpZ&L6mF=aly@o&HR6e(UW=csVBU_?;tZ67Zv-Vz%n`Q41c+a=jyqa(@=3 z-CBZQwP#!w%%m)d6ankbWjuU#c0+^3N?H znw+<>rm&6=6M8B~&WqL8;vkwHnX0cviJ{;oT(dk47e>umB*%Jq7RVf%YQ&{S(;9e` zO++$7r-&CUlMp!Qqk^+)Ypf}1SDrVGr{Sy#oJErpaqt@sw&B1Ljy|!tR?nMP9kNRt zSIJd!Cp{%L&zv)()?C9?TQhG_gS&?-UR8eHw9utos_$;);vuQ?5|iSU7s-uY>;;M$ zUhmc8UM~OBk0y9_ecw}uW`a6$ezwpxBT`>Vq*u>^ z+-p-;7uME@nMRXt(`MAxRX5EFXsb6Gvo(x4lbp_63MpQQgogo%&}n-0LNIjZ!tGvk zkkA^0nKOo8H4~!9dkcApS~It44)RnWSsUGL*;g$})i#P~aJjV1++`*ap|_X?Y|kc0 zZWiB!g|zvy%TzO9iR7@RhK9NGQV?6#o7sRrL-|;FT^2_3(pVcfa>=Gm4qN(pA9u*j znJ<|{!iz)1(`v74s-C5}P|sZU$fGmoo9oi$$e+o)J~1rmJa{ZpgXm}8Uds3^o@=C; z3Qcx%lu(L%-UpsA1^=vg2C`riayesXzX*KE;`clJD8oY^P&!5&f$H7?&1NHSJg=5$Vo}~tZ14hq{r*v1ECWpWai;GK^3sugBrrS-gs(qtMgM7pAaV>c6G6%_TkKC(7rf626HeMc*Nb}F{1;d-l3C)7r1yi{d?JnvW^~=E=L@D zfhNa0%knr3O3o z@y>BESmPO|_i->z?Y{tgy}Jb4=}sbF!`Q0}W|t`kZ2?Pg?k%3aFwaQEwt}H!+}V$9 zNZ6;BD8T;YRR8&h#5*@|uT(s}4K~HN$q8F^aex6L-r||ucl89nTyb&sFV36y9kAqUs)11? zA#Jwl7HwT5?w^;B?L*1*2-=n`eSbbKQopz$o_;P~dO>XdGT0dFUJ8?47lHe`2(2cV zBo0HHxv&69d-8>`c=WstP8v9N*lM7Y&`)L(v3O?(gIjgt)ALRN#sR;*spG0jH&jK( zZb;@PkfP7R&1Cv%>?2hl<}5&r?PBCm98e`(=0L}sisL5K;I8*X8i#cf1yz{~V~O@f z1;({R`nOdl{vo<_I}A1rkSx-#cx(5hMDwS}&)&Rq6G-Dk4%|d``a?1eF?gG+(%Vg{ zi-)n14+6#@9uIq-3*skFfS>Sda#>Y+15D4m;r#ZIIaQfKiP8@mzm_PyE^pp7iS&!f z^hRvaqzjq=u-=v$>@~FUflPgN6-rJbJtmQvh{WR##`%3wkg%02Q93b}NN=A%Ad#LJ z>yA{xu4K+uKZd}=2=dPg)F7azNi02yx26>DHVeeurEbf*wFj3ql2S3RC5Hdx(JxN>C z3!UXLeu{&T)6VWLzwwYQS9s;qQ2uvkq&d&RhfR%2`XSnQ;Fw{)ETUt{fXAPa{-Y9P zzBM<8Z7JK&p<6TO_%qUWoa@UXy2O}b?WgnD4BWjBC(iU|q`&HTVrFz~n=v*bzRaE< zw0-obKO=3Ml75~w)otv_6H{z;>DJWiU;m3gBmKVPv8L`e6rGV~8_Xwl*1@a&8EIB1 zeEK`Lj-=Iibheo-G6~~eC}{C#n>l01M`aNa{e~|*`$OgCuzhBmeDj&{8h^HV6B+RM zv&}X?3xcK*FF!cdpKWe2)B~McD-A_wo6U#(kmB_+^OijuMn2|4`)FtGTKkD#k#bbi zu*fF~W%k_pwT`5-G;%Ywp(&;D+L;ZO$;{*grrvrJ+Rfpo-k7Z-yFG6_V#|%LAf=_Z z8G_&?+pf=Vi6T{|x}h3!Zx&%*c6RW3ZOfx$Naqa4BQj{qvaAk)3`(Z47R;-iT@5W< zL=_&3Wm%vyXR^rQ5s|eOH54zH&f+%LOlQ$4IwqT2X3sDV89nk}8ix!YK1%sH4&izM z_EDiiIol+tIBxL1e*P`v5IYbujx;s81`8w}$2Yt* z#5fUp72vtk@X=baFC@W5%PM!@1|RKj7l-=!jJe0a*J*ftcf+zz$j6<#Z)EX>WlykX zdDrk*x5eENVcFfcLi1Db-E4|Cf0S=zXk1eR`Y)h42xAsLF1*EIS>>#ojyF8Qh?m$m zJS?+@d?R}0vu%f(uEI|__-@N`cT^}nSj+ziJf9jqKODntgC!Qu!Fwq3=k3zvSBZG) zzpxA!Vea{|;~#WdbtL|!~|sSX8nlo5*#8kZj(WaVYB z)o0GjHjU2RNc2-+{z7zc-H;`0%R2f4ojn~;h<_ArJkD8M;gIVZwU-wJuIFi4U!Xx@ z(s0aZJi{J(NRJ8R>qS>VY=l^8yVIuEE(fXQ8XJi#^vk7V$Kl~b4EN-q1w?O}t~z90 zqWc$!qJGgq;}JvSW6O?7rWfGE#sY{5?!>5qCy8w@IM^$+10ePbH6>UFF_T2R^YPaB zO#zh%t#?0T?3Dfkq+>J95`i>>xZ=K0hLp2j^@8*JSB z1BWX%4u$QSE!ZPhbOsPr#A8oI(?Nn89CV5Ma(TF>t!5E*UytZOD7hW~!yh5{;Tx5x zUc42@B;$u~jrT`7Q1C2=Ghg0U7sG!VKf%_DHL&g70pcO$f48^KT8a;Uak&lNbmJR; zJ?417x6fWIAHTQHI*|{ny4)OQFq(Slktgr-d;1I%AHTPMqI%!#KVkdDI=u7NPww}7 z`=>h|+f%ibY`C|-@}&z7@O%5Vt@nHT3+ObSJgD3pwpq0Jk@vivesACQX7fDjmLxv- z`e&K)d;9M}kB{HmKgjr5d;4tn_%#0G>KwnfU*LGGTk{M>d;4q!nFjstn|Zk3+h6E- ztf|WkMSJ^f6B&mOJu~fZes7=Gdh_vn`;RKY>@8vS%IB?XN5AFw_SY#fu(#wHLm|IE z&Wg@>s@3o9Kks;~505Yu_U&_Xm{aJ(&%XV$e*WH)7$|)Fy(QmM0%tT}Y6{+rjfRQC z=J|U|?sq)atuhl*-CHsT`pl7UoO{pv{@#*tj>npc7z%SmxO|b~ed+N?t#Ip$VZ=TT z{gAhgBWBgoSNileLg5trml}^$r>cE>dRaNecm&He=!U1vfP^yp{f@WM3$Ghm6C%*^ zDlBu&2rPU#&6=xvr9zD6Jb%E`%SgmJscS|IsK0`g?Xia1+G~69Z*9Zent*^!=P3@B z_NDj5V;t)>kw2O3mmY&0%iUwtV#)N13|+Dnrdqwa=BE37A9?2WIuh+Q=I(7xAuh zZ<6WdyYP+($IB()n*p9RhR=m}R9MpBO(>-=f@d=Jq8URE}WN#!B#%UB7ozJ<>2|1;d9{_Ifm1w|NOC|AL*c~@C)>laW&*lnnSn# zn9SnObX*h%L8$EQ#c;>e!aVbIrJ;;BH)g064s1ZzMD1lEjN_6%tn(u<{I zI%RWNcQHKhdD;m^j73*3{=64<_+eorT@>`gSDee|05RGlQoe(}@kenOhe51Kc-aWk z`5MT~1S3QsGhvve6s?QFO8Zq3`YQ9k*2Tfq>(K2OXlSo=m_tk??Njruh!&g)6%mP# zie@<40*CBS0|SqUKk&%d(Hn<({<2eG5CVx~r9+y^<1LHwJzPrAvZ%mo8X;>fn8$xk z1IP@Z)=0!UJr7Pt z+wK7qT*`yogbVYdt@q-S(vY5ywy~&5Bt+W^3DeJ-C>Wm)Z$w+8BxWwdfYr&RX#G2F z%S<$Dfoa4EZ-*$0-o3eNhdNZ`HT8q7C0?otYo99SMC@G`1A{qk-}NhHj(Mr0$<_6J zenSw_*$lfG^>l&ed?oIrj>sTQHu@e))y31(Vj^w?OIcGPYT*h5LrYBzro~}3Itm7R zXfU!%;^{x>Xbk!${0oX;Yl*S7>kO>U*>R&=VS*6J^vhkxKr0Dn%Ag`%E#BpV=Hsmy z;{hPe$SWOs1!yc(#Csj@^8|g2cZDF{cculGhou!IftbZ29=A?wVX+yFSvra_KGJM! zs;}lGW|{)o8%#tTrBSkLr6)`@JEngFZsbCfaXRL?i$AV?NSk7R^1zmu5 zLXbEZo(0Xz zju@1@YA+gQ5;1}F${gm|h<7vI99BiVpWvNH|!& zMj~A(i0gJ*HP`~$a>kIR0rAX5X7-Y$m>u?uggw|%XF`VuoTU8kPUx^U;uC?&&0+rO z1NE9$-q)YdVX5NdPv~@z3D15|xj7AdLzUcgQoTQ+V~+;;6FT2DruvGhrFiE-9sSi& zOZ^EQdtrxvps0@qS`Kvh(+Zaz_Upg+6FPa0#}3+g;ExYo$jxClna}k6V~+7BbY6En z*3{L?W+rsl$>+nRVt+zswh{vqIu9C(PUuX>7cE}A?7eIK37ua!9_!Xu423=0+#C)7 zBo4WAlyV39`xH6{Ry4ECS3l6&eO)81H@DeZ${Xdk#BAF zCv>)f!pC2}wcGa@54kxUD$s}bOt^BVKcT}VB|iT0?J^}`vWBMG_=f5#Kjv@#gwAb_ z$A;@@V^6-A+J!fB$%WfTSNIb;g^tIXddsA{PUx_w!yNh3{V(X_Pv~?z9&3tuosUlF z90^30-@QNo1OKoP(~^&WSm-5V56fz}RFdNLG7Us350BcXw__XB>u7+ ze(_NYcu3Yh3Li86Ayp~%aG+0_6SA3f-koV5HFbH20@uy)LFH1OyRzK+nraA>!l~9; z{3>N^mZ=Z3c#g`lry+~-R+cF{Wl0TXFUm625~6TEDLlDGN@Hs70&BUl&(HF6JY>(5 z;ka{{qa5?7rk$!LQ7PK9P^Nut2;ikLvQJ#5;J$-&@TY{F-Zac~@d_F28OB2YzB%OJ zLT~1ooMw}@zwMv<5qu{&CB?7s2KNAi_@SYCUiIwY++Ns%8THft35U@-Z|vA<)iY+` zpaVC;Yh==$hU%H~dJUUyL$8Rd`Dr}j#9iOl)-J?${&_R8W4pFyMm^uYhP_9o7cHFU z;OUHPGaABu={g(fl<`V+Q)+H66Pom$O|5A&Fc&#%*8JHF^Ss8H*hS$EBlwZ0;pkP% zy6eJhqoKamCozBYLO0O^A3IiS9sK1JO_YR4Vx>j~>Am?{>L`=1dQ5=&K|_X{7TT~L z$Wx>v8{(?;z!8feF|@C}H!lRztXD5;$oy^Y$mYd%n>+Wy%ieb(R>WN#&1jlEdy&Z? z3$?HhU}?c78h5eJ7wvT~9#uTr-($jt3>|M2?;%Kn@SSucD3sY3xSTppE^@ZB6{#X~KZh87f8F0;usdpKnA%y_0fH63+O--VR-`K2 zT=pcs{%W(~hpz$&C@?^jIul6EMm5?%cbu;Ji;0xxzQ zfT0bi1I_+VM8w>(2NMzb;p~k@L?of2oAJ$T5%KQCo6!;R z9>x1mLBDqBWuU`^_7}W4D-rSbIK&NwhYM{GkecNZr=np%YL@p2D6JYuec&A`Wgn*b zfZU_^Mauu~m`D;GcIudjg@iG1<)3QX{4o)GjeK-W6f7`0CQ@H1kB*6g$BczXG^>@x zEOJ{@7e4mFM_O%UU)R`(tM!`fAOxmy^!M6n^Q&hy)f%gqb?`LXPy8yy_Is(Jl;K%C z6S62Ak=sX2{nUQqS1I4kqRb6Z;KRoHnRO{k+*glCDp||qJp#1vqnOj|p*?8^YH)%O zC+lpjK6_?kBX%unyI7mDmkIW`6)@a3i&MDJZswe6ScjWeTc?g2EN9K&$TV35M1UIR zHfTp(%t;e?`tYKEY1M9INpXqaPOz|IzZ%AKm4Zxn(BOUj{9D?Ikzv|b!>f-0Z6Dh9*zE~i0X>}^W;J&blwI2jt|moWTcCp$ zyZCtso7SePeL_L#t0?pp4}DD!eJu=pWp2}E^&U3AVzF!%yqVN>E5y-WHVPgKjgz4w za;8ENS5FjO;Lzm`adJm>uLn8>D&pPikn~Z)JH6ywQu?gdn$7Zh3 z8U~w$Q^nR39O5dD()MjXH!E5<;sG}n_TmN`b+wNnQN+>|a6_hWCzqQ^T)ih<<)+JY zbC2|kr>k}Z(xQC=LRqylM1h~Gc7-Siebw#|1%9o<)f6sg{IfLWtw`l|`WiByCG6!- zvWzE7ccq5PH<88)ZhgT~owln{D9fK@rpMg*tKH{PJ~%EXe84=VFpg7S4pq3eeo9A3HrL_!xu7; zKXDyxZ38<_5N*K?Ognsf>N-Q)S(R34{pe5P$^hZp6`&;yZFiNwb}-7&AUJ=w@m=az z(&Phy)u5t_+H}aTS?hJ(iWlhUZg%4Wmp7B`zhNkNKl}T^Uw7F?kV56t;mj{WjJ(b1|MYIKM(t0tHhTJnDhbQ)B| zTaEYWf;#ao67(G2#exn*w6L2L@eT(XA*c|D4O+yj1JW9E2@tn9U_AgxU0Ve-T4=v_ zh_Y~$_OU|)&@L&BHw!2_8EA}{odKlw&2wmpLu_wV_dbVy=Fk&B8s29ea-*?wQ%f|z z!|V`mf4Fc7er;VLn_N39r+|bLXO+|W%ZmBL$|9&T$w4i9jZc+L2zgAAokt6Wi&% z6!SZl`6k=UZmv?uv~7bfj?|?FgJE~l)Z;9wOh9933I)zPSF50rge3Vy%kF4&>AB*E z$y4HMRnkDLEu>4Zu4Lu9x<= zqHs!dP(@*!FN{bl3X78IS%t%r=@gIkvhqTuk}x~1i$B)w0o{k2(Wnep*WCyk?a&() zHZEzJtTD_e7vEr6v3V0wsECIwnTsgtUOOHXPIUd zI@w0EEW~y%B57LC$>r z@ZS6OLI2Q|K$<#@tr4F6p>ji}29lCvO?4i8!V9_*D5lH+UwA^M4iHluaPY}VK7YNg z1d1uPa(IL%WQzR$8f@mUQPXuLP)wO2p74nIfhKx6unn)6k%A&rS6iJrO|LZGi_TVV zFJjHIH$2ni*Z49|ZwD}`B`t#EA((Bx_@nu7X%^)fn}!g)zB7knTh8m_U2K0I6ShCQYP9@ z{Pr@7(}(s9*I9l@%9_zMtJWTP^$q?veCOu#4fj=$kA;aXtX0vs6qTb(MBxRapeeME zlxj2&2F5~GRBiPftPN!!bycA^)ia#ro2zSP%REsv4wVWKqHU&;NU1kHCWs_f+^PxJ zHN>A{-UtXH5eth~r|N}TURhot!4J@~g;@&7HNVn8IE( zEBNasU$km6e7HTy%RTJc)Et8rf@5Aj!D(QnWWWC{vth->rt($yZb9~Cr}JdCS$Nop z$!yaY_D}qWd{=|#J=3x}zR+A4_BO-FNoYU+i)|<#7PQ`GrC71PZ+OVZXJ4~YXnjM^ zzWAc_RN#?Wq!H}-e8FR9kvQAHS(D~>w!nlPL&P(emn7SNRgW0ZJD7h+&CV7Mjrhbf z&CBqEPGZZ#JkRuu(|=30SCy5oDT7XeqEU3Vgl~PgHult@7H)ACa42%E;iy)5X7A7P66TsU&Q0?3DtE& z!F?tn+m=ugQZ7HA|KBFzzC8H|vPuo} zXm94Us~Q`jB@b)!FpsInE6CKw9qV&BwXx192d zKQ_9=@mN!)wJ>8NHV*XbiMOo$wLdn}#*x0Dso=;%$3|=__^@BEVj5R_z6$QEgc&LM;sa6Aw1&n@y2=jJsi&(n(Wa44Va;bnC+wc zMMAyQUXM1SI}}_=%)oT8_hWX(XqMw<9ZbOV*ry{MztlWTywuE_*^ru6U)@-57Fm0- zNmd};puQIdr+51B;bU~gPv2kECn_FYYPOQFPoz<}1tWl8N`(AB>=Tu8mePOj0(=em zyutJ*m<^>*R6KIzNS{r1Os@jZeq_MI%x?HXOM3T#ekypj8b05?u+%?hz9@5M;8FWZ zLradFGCKx*$k+0)NE*J-0l=?-eme7P;8DJkQd15@hkTQJ;~QQyA{bs4#IN_pR|0vO zf#*=*bZ>kkOM@lAI~IID=#8%=ycLJ;cJ#(qTvQzFrLr3SeQ$iFBUyL5hkSqTl`kxg zhVy8fZq!6 z{I}tA`DN6YQ2cRT?o_tKfk*5cT^vj{?{4Ui2j6Rk*UvA*M+GB>?jDGC@Db@!2J`dq z(9-y1v?VWt=QKtno}o}0j^a^4hc|-0^dL-{9!xHsR#U#wrNO1~j}X8G;JKE4J3Nd} zuwYj$_8b!?Bd`jR<9XuLf<* zo0%S0M%|%VTI1rR4~VC4#CprPlJ4VeAI%)jGe6>pJpsvCdnbO9S!)(lMAp9)RXJKc z5Nnx;bdD6wceECu*`llK-oc#&A|I$s_WqfjaG42l4Q6J-Bmve_TwlM^oLm#Qkr`MW z8|DzRsM0Ec)Y-|t%tx*dw>Cqkm*cRIaul;p55tEpNV zGYP5;s)#anphQAa=ePzq=B;BgA!2(E!yITvWG+wr%fhW_ED-yf5jn|4t0EpVg6e+D zA&FSZ zC0~LoePMpUOd4`t)8(;bIx)ifB>dH&=Q-%193mOD8sknn9yC?}w{oxtqG`0oG09aWa#OlCzB+dw9 zQ^$o^)pPQ>Al`KnqK%n?;!s&dX_3x+1znarXh|8y`VxIzx9CTnIQO3`Ju6qzgn zUR#PLq7+>gC`IE@ipHZ9jYlaOk5V)qrHE3r`o%lPODT%39tW|f6N>86In1vdK61dQ z#RnC=DHiNZX#rtNsKqA^q{U~l)9pPp$ei}9^Z%95lrS`|j`3su|8wxZiGT)@&15g; z?RciFPdx1;cu7-JMiI@Z4sa~~SuDuzEMJoc^OBG)H$}YEK_sqY6(TgYGPo^%r)@{< z24>95r8_K#%Ka*1I!ST*d|bb#_dXxjx2fy%ar-sB`T4j=)1N;dm)rEp=i~Y`{qgg0 zIZfL>@7w*%v2cW~M@05eED%(QH|tP61z#`dGQ1ZFl9aTwk1g-0sNUe-g`N!}yni8@ zPzl-otOqmR-j2F--y~-VWmQ}ESYu%u+nDUaHp>ihN122VGTjhe3yRFf?2oZA8@I)y z&D5i~x-px=es!Y?3z0UPH9%~eB9b9Bh5WRd9Nw}O*JQ~oUKr0bHK3}3RPxMN9O~x< zXV{6uIm=B*m3YhbsKnaVDx3oN3x)N7_XFaPHBQfp&l72L+CKw&Ri-Xqsim7z2L`{I z^2$5MC)qdzsmb*2rhc7eacMN#Ck;!sm!V6cdk;7}JBDs$Ca9ef?br`xo#pZFXzSo0 z3p^8Z{P-wKbdE2{gQMjwH^pHSDuPySj)8FKSiE$Lh+^227rg`9w4!ZKL!(P}j4&R4 zg)b8ioLdHDJbX_f%;99AbXl?C`kh&50Fk#-g78JHNvq+tv>5!<=o^lm9G%8BA~G?I2oRi+YU z>IQIOPvBMwTJft0#Sb9veNT4;hpJx{qHOPqhxUG8Rx&Sf=J;6C8;Q(K`H9Sx`PLiK z5m9%{4wV?vL^l&bytwbm-5a}qG7aIn9x5W;fv*cw(6%_*%MQH8 zyq%3>t%!FTP@AALfYjXt(8WT#-054M3={(mkIg=C@qLb zY}K{Xfz-Y@&^JWa)wyhck6Kr%tJK_Jy&HG+E^?CO5lO@k%B8)i zGFc88=}f7rk3#J`Ns<eNTMUS(y)yVY0vNcK+f4T&4(B^9_Y@FWUMOlHnP< zg$%B=od*lMxI3yUlPa845nc5J?ZY#qV}qfM5DJ2_JLBRF&Z# zw)QIQhMrvHBH|YkJClpLn~-kxHbtbCvDNIJiu9-0v1@A=mW8sYjvR zUos%XHocnO9vvoG0~_3!VZxPMI0{>j6R%WhB9%Wj7`=+bnH7a)^A4l0#mDSuoLyFq zep0mju|q41_f{;Mlh?Hip-Z+m)!PU|Enao<4TV@2)rvCI97{XGNMsn>C7D^34~w@~ zqLM|Ojs@6V2vPc#O1EEFMRFt%fnaG{0>kA|j6!e^g7Fu3KwFF!0VBh^nSbKxOA1jU zlk8w3@{?#c(7(st!DPE+s(7ZImSN*!RiG;|49#&oqYP(zWf(l&JPuKV0Lz&+!~p^x za7AJUVYOR2i(l<(rG$>mjYa4^OhR6e(f=RelCZh~?1|JCQhEBR;^(t77)G_xTaJO- zmFahJMh^p?xQt(m#SqT($!~l7$zBcb!Fcv{IGXMd30~>875GS|XXj05KMR$frj2+8 zo2)UQ#$6Aas&YPa5h+<AsH5E6xUT-+FgbMdpbmL1uU| zzP>A#ItO>xeDX>6S<=;b648SSSMK+)G2b&n(LC#>-L5DuEkOW3`GgKbaMJ{Ji&+op zyh2?=#=y-Vdb$zKJ37!BN11lX2${Q=fzL!6cB;NEu zo24svI-`>MPb`NM$OPE2yVG`VSOGpqA7ha z+E#!^TvESi=+xJ=iESqPQtegw>&h%E3Vc&2HIbB2DI^t{s*;M_s*$X45GTpZV=G{& z(i{@VRF0(niM!I35SBez$_a`{s<24QBg#$;Cb4f<$|I`OHddkHo9=6+2uS3^+YDOQ z0wk)-2whj77fVWZCm}oi_A&+O;Ns2eGX916wu5TP@!|?#Jn-qJg z<1Fh!rR)@INUuhhuD`FQ<`#5`mri$4iXe8COVL-}P3&hqj z;(Z@Tr%xVoXe-clqRXp8b;fN_#LlxF4y4`JOM#T{Iv}-~mx(J{<ZPZ-9TwQ0W)&~W+E`9uW6$D1Mj5owsj4iIU-S{zkXjd41w$Q1?Hn{w=9l(sWT81IHB@Xs<-eq1`s)v~6I>+XCLI%;K`DoKF(Xd)aeb&?xq`Pc8_Y z2b+dj33S>f7ocBC&jMk-QkyDvR;#v&HY_U>Ap780 zIzrv*N)WU(Ujw8yI0yXqK}Doo>eS*-@ZBb~NAO-Kr~_|KoJ72r@z!#^2S{z<5t8qV zZUKyc8rGmJ-oY^Yk{TI;Xg7yHZ+5M5_)xINv)Ryr; zT7%C8S|KKW4)jAo9Y9*2{Mn&hKx&q&vp*8P!9d!Y90R0v5!-?LMK?76*!<3eAo_LA zvyi@5o_;|t@+&V%X6iBit}Flxi%3jyw?wbs%t(I%Sf1Cot@teQM8Si zgPy?kp=fItjFBuUDZSw0yH)phW79<*WZJcOofO7UJUpqyEeiBCtt%9AV~XO`#G zL{Y^uTfE`+HakS5m*6hCz~@m)@YY1m|0HsLhY-c=64(Io4~D1nPYLE-6tBrz-C?1t zdDDaNM=1ZMHzFG5U64%gjIZArOAP=hem?%mhu!@uh(7s{VoXnb5tmc$h0z5MNTj4u z`P#yi`d0g;93P>psw5L_1+1OKPmH&j=%S&Jqeknn?sPbJfIj&!(Y%`#M)a0**qfsm z*-_H1YhTW&!{F7~b(GLCA%HnUbb1j3Rhq6$IY^A{?D{*pqX`((g2~AiZD!d?(ryI{ z;R>jT_Y~d_2-<q*=m`5`Jsz zn+DR>mrR`pQgMLxpy{rm_{fgp&eO%{U#^xT|{a?nst4@euAL7(ESwb5j|m1Ghl z5BP#N&y6tA6-@SxC>G!Lgi5nY=_a@MwQ-FeT_{J+>n9V42 zhoPks%o56I{rCO#h)%A~LB0j9fjyxTk~0ntL>Ou>T!;(~GqaJ-c~Yum<13`YE?Bx- ztV4&RWz&>UZ(}&T+6tvRjUEzo6W*FVI09y?5)nB}iZ!g~Y&`*%3{{Qyo{ps)sp9oZL4qJX!k&SQPGvD95Uk3^w|6ub2`zeJ#xj7R> z&+`sm`L#Fw&HF!dJa+T`218-(o14SxiEh1h=f>;&&HGy%PfYetdfrO#@FB0i4gcr;KiIs@@mN#08cKgL^%cDN9DmQZ2l)q^ z?{GZURE?nw0B>%NHTBD~BmdxwIG*Wvtf>zSWq&bsARWSU*@E>y@kJc(c0AV96bwxG z41~(fIaDy>=&GX2eG$i3Iv#84U1T&qZ0&M$junh%;kx~P=ZiT0(D7JP&Bh-3%|F;2 zzO(8U$74#hJ;#jhq@K{q18&mlqQ^yP)vcwm0{GX1;n&RD= zeCSGU&e?(?#p*W?9pZ~Pe#!AzQ`eh3c957l7jFhV{~xc6^hF#maXi-4xrTDEn7RXR z=HsDv{Op*6#XLT|O2=bO4K|d)(9O-cA8#h<<&TY@JJ^{z!tq#BXQLO+=MbpeoFfF| zE}G5%weApS>O99|P1P9+b46|r`+~IisM&iSIMkVV!WGjIIq>2*Io+L`*Q7Iy3_GkQ-fK3;yD&7H;4PjnO;}!{rRqAov9-nk2N*ZP?#ffb8f_&neOe! zU)?a&nVRc(tf{1-94Dr@x12TOIWyMGKhBxD$njWHg|r$^AyjUT(Z=L^T}7cYMQK5N zgh$Y5lgEz7moJLqny#7Wk%HanUqbi-`Cc_KMy!q;W@6r_e8?y>kMi`(;`zuj;8%I} z8b4D*;Z);ipYm>&J!rJuqoN$pcLW3wn+D6^091S~dg&CJSC8bZ4U6PkgnLu|`0VN$3gif#01a9xw^>>y+H~H` zhWgrhi8(WIW#qzr8>6feVNXnoS6(!Yj$0B$cmzL1CWs{jPltxQQ9TRNWqlbUR_ zZdA;?y0$TO@yx5|&|5v7t(#SSbz_#?l#5kJNUw5KaJ)5iHD=GtJaK?FRFZo zvAe0-np7=Ben>>AZxrq`a1D*MO*7_BtB1^$eMxLd&72L1y^Ym%wY>PVW_EAFT=r={ zZ!mylEs9ACN8#KC+^DJtqzhFb$?WQdNb>7Mi1I$|gY@572;>(t&YV-@n3z&ds!Z|l z5|JtsB3e;1tf>9lO~WZXZswfoS>Zr1`h$tyL*|T;FC#f-eoz=qmf#t>B)M_U+&MM1 zmQ}>j%xY?^7g0J^Fpa&bAUiLlOv=lt=zSLurU`TKOyr#&cdz!eQ)JbA5mQrRt;y0~ zU>h%9HI_kY^N49RSJfc%&Yp|QA{uZJ19Dl9)80;MQ1!f;kvQ}{WA5x}S2fiIqnwee zGKxev4=euC{*G!qST@p5Bc7OUx47FKL3e@R~@>mI@U1iLi>@%IW9Q z$qndagarzPj0RG3+Kjn#{t0LJ;s`%im^ucfSw(EqZK=@30KWox-qB38>%LvRyDw*? zNzo#U+j(oMQ`4ke>^n0UT@9x6ZOw4#w38>(yMN)63zGo-#YHRispW99UPOo6&r zGNcLR>=~}c?@ca~_1M1jSTG@jY9WOZ`ej5KTI2b~rUntPHDllY*MxQr!oC?L8~J=p zKuH|d#VD5Z*e>kbv^w*}e5`PoLi@H!{K2*!Re~RG_8Hhs*tfZVs%b5ybc#@`DqZm) z(cSNCWt=sYNR`VQaRjR5Go+bM24-|g&dZjub^7p8|B}S{;?bi^M#lJ1p2Se;d42d5 zoYOX)H)#-UM{Xa#{}vfrW5V(fjz_O}2KtL>)34+>SE7H2*_0nb6EN6OB$ zp5q=7657QP&k*ojWBAxLR=$xXCBXLKmY!wcS!?>>oEH?n(c$ynV?nRP^ujHiV!*?W ztZ_GJovgck7d$PTIK{&s;TsXYzxW(j@ZZopp3|3jI0Gkq#YLkzO>dtA;qf=X^FAjL z@o-*6-5nk}(9fCYqcHimmJ@(@7>(-g@X(osRa+ral7Oveo~6Mvj7Q~Scg$0!eZC=$7h z(@uC`wek%g5t2;64VHO`jAl+5;o;n|*ax9Miv(-N!~R7 zjpG6YK;;_|l3(y$xO)%yijP-b&e96s=+Lo$Zy4yWf+rVcjgO7zpy(b;Kfv$^BVN79 zZliMtehEGXbHtb6V>X`rCHR=_t_0s4!^?1#<(HM6K5|Sj`eaRFA$XSbS{+vnrb}bhQNeI>57~CtvZXklYyZJrAB& zviQaf4`yi2puTB%0QIpl@^lXeHdM^wQZ6@e48sX*>>L@3Ep9LGBr_KypTjRt8bnu@ z^-1SqD^x?~&W}J_|8}32*K>poE1B+cBpO*wBLORZitpmRSR{sE<}RN#-h!EY5kziR8{Z z6MMLKAPe|>a#EsmiHBlFv%WZJdVJlJAlc(dvL4B^vbxw?11(*LoFV8kylVwrjdz`( zrFiozBCGxNf_{PbOhKFQzDCeH4pI7DxzG*;x>k_vvc<{hC5uXOn#@hgYq&Cb#YX1t zSw2%h9)~$3jfHOrN9dEg-~b#vYp7e7lPj^qk9BZB;|kjWu%c~Ft9OAa65@3cly%V@ zsEBty-mERm9-roSmf^#0yR+-;i-uv5xUb!d!W91iT+!8}xs~VEKhdP_nJg?{6XRDv zw}ao<R2Sv4_K7=9bLTK6!<2EVamb1Q`r;gwk$IMXqR{+!0`% z0K2e}OkxK)>RfOmw%o2XkWR7O{#KDAyAN~McI{dB82o563w8`OZ(;;VeqrS|7b+sx z%{K^Qez{H%Q+b}C+Z^pjK#f9Uen|;>0`De4zr$NiyaqI1Xn(_dfuO(Ry-*Mr2g(I; zV{afg1>`KScqfKQxTUxp!gB2Ajm~kh`eJrYiKvCcVB;dO^<=!S7bJO9s}0@epjUV3 z@j~1huR9ntZ`cYX^)6qe~`~qONk>W-GxJ8(Y@S5Z3oBD^m6=K3+qIQ_rzh=v*S4_?EzTKaShG z*9^ty*P(FC74I7aRpQNw?uhJ^ohFEHF0w?V@USlsk+T>#31Vl5{fLOS3hyO?HsIYX z$nC0UeD*A6QW;B3al2x)l}9l?9#`5YRbZ=CKQPhOm!ZqBw5-txI+m=_)(s>ha$FXb z)g}Q}7EKcc9EigAm6izsab#?KZt=>lMa1=;cRO5315@ z=<3STw?7I~(bY>9f}uQZYn^e^Wt$5pl%*PmDG3>*|I~}l0n|Z4Yq1p4r?4oV-YER( zRSsQ!YO+|g^;g2Ucn3D4V9yK=XJsyqB{SziQb5%X z8K`ghL2mceOMQCr}-74rGc((}}jKJP3XavwLf_Q3{&PBYbK&);fUMtWy z1W}p+V=LlubLp*uHUqT_dJTxR8}8Tx`lcZN><||WZx>o<%T#!0x2aLs7ipi2l5Y1Q zMO%LgeiKcT|Y47y5@!KGfj=ByKRw(w@<4@SlF<*QCdOteu9 za@>8T->4brv_ zNuAnqQ!KCP1lFjG#HRkX>MW0^7v?Wne1g|BpsNzyG#rL(+E%e_RWtlj+_B_0{Pmjp zX$3pHw_Ww|(uMg=zw2IoDj2nm83&|o%vXWF1*I*E>Mq6i9YSN;Y5VjaKz9o5alG#m z^rl1XrmI;Vd{DllfRuJ3kea9j(vILHpgCg8WkAye)dFcN$6=+K_$kocqPq%cs-R7d z??s@?h4!YSeFUUt_X4Te;V6AfQEdMNQa5;E$-P4RHc(2?13=3K1$rQ;AZ8V!fQy(Q zbZ#Jr0b`WguZQinWL>4S<)pDC6M9|gMs8~4UROg=u4T?7`prdl0CG%V0D?V^rVGtm zPF4P!Y#Nu(jVHi|-xgnefX}TVVHer~09*LxEV)Rh5xt(uS)?KpF}QHBwDv!PYXyRhg|@6AL9G&f34}P_#M` z_7T#b!a|BilI{U2za6&BqV_q^^}tzH2K%}DY?HgYad>tDTh-6%*5#u&ZMJq=-!>fr zZ+>RIX^KW_qj6C-+utX#FbeMz1(oBi`F{eC<{RetK)`}q&%Da!G4S`% z2-S95Gn-ItR|b5Ilr#MAI^j`T^ILWtbLq7Ni?{^aNTeQ*r?1FIXLuKygO0koy3?Y^ zu*GHlXQ~#q8w@H4{$amVD>B@$I-HZl^=gR3Lh%$?{|Z*u45TXyEXHx7;;jfyLAjBx zgYZRL*#V&h1(lMMXPNP953470cE?LA^P+8spu$43+s2Od^c0Y~{(&Pr8{Q(ufSPwmwALGPkg|%>+0AS!(Y#`t){als|z&iILRD zUCZ!=3{tr4mS#}88u7VV;P80+exM+>xbGRlzKi%pdHMV`BEDe*?8WXp4C|{}e$5Vs z7j6A2LX*kRm*O$C`d_dvA0{DFKn!=iiG$uJf$%-3h#Xkcta$;xHEUi0^nKB-#hcZ0 zL@HFJ(N8Oc_9)(JVvD2g0Mcx|3+RVX5$`j+m5-g{9|?`swd#%pQeBSP?ibx^pa%q{ zfPO6KE})+X`T@{S1$6^e2x7;qT+pdNjH-xt2GDpxmpR>QfF2UsKOM5j@gy^XQ0XZ< zATfmlKTHZ}_Sf^jYzRPI>8KRI)Vf2cRomR)Jlgs@lH4G1oA&S}MQGsXqI(oP<`*yN zFW_vGrkhB1YP}`fV#W|ACU6j7>2|{A4a*Iavz_-fnQ`lGOe<`08l%PRc(gW4meJ|V zGN!H^A3PFT!Y8GX2}i*UDB3vbT!~1~Sqaf(N=s24UzAKY6v3sHY7$3RO_w*mJYKpn zddp^T`j$#j!r7X=m!f#{lmaRs#3Mp%rz99P%p2t&k1NPYO_06zw#2MMq1ao#CMO@- zYx`P@Q8MeoYy~vGrjM}Eh`0~7bJ5*hX{$tp%|ad+fel-Dgdzs-$oWQ1gSL(vD@D?N z_d&(4E_t#UHnUS?i?=;KYwJf?B#z;rNO;t`QH_kSR&472^;xj$2B?U45#HLlxfbmreA86K<4{RyEQg$wig<-c&Yue^2l|DeD}l5e z&IJ0U&^Y72QqT&ZM+8y00(;>)EK;Xp?~+6+|%$j|t-NWtAXT z4tu{TF~MW8&+;@(GP80C+>Yk&2Xh_;7~vQRG7Kb+WD@n7t(H^x2ueeJRr}5KI5;Nh z`4YX41bMT}WPoTZYZ*1he0DLu*tp`%Jj7k#d^W^r+Pvm>oAf|>FXb&Ty5ba;ZFj86 zWX(>FG0_0(DOwTr0#}uHBTD5A>ABd+zG&<3!JVm`ku2RAZQCFw|AJw6@MP{wq@s71 zX#W=blZoc_+wo)P4*uf8$z~hvrga*5zljAI?fObI&?VM@8^T?dOxNOU5e~+uan7iH zGR`HrUcs3#*^p@7yi4qaJTZ(>G!kL$(bP0`Ub)O>ckd7BA0Jav69a6lv2|sI%m&b# zoDFd2)o}6bA58)2er5!8tDquY9PibF*xlsJuHI6}S|lP91ZxF7i1#`{PviY-L9gKb zxS-eZR$D#*dO~RVNSNOU;$d^`xPKMsNukXK(hfc)(WQmP0Yir%4ijz@^ar5p1ySnU zdO;rp?IV}Byi?C^>~!1ZzZ}OSYo<_KSjpp{Z zB>3{Y)Jf#aCsWKZ9SWwr?n7uBQ&~BiUKH^~AfSr=A&>K7NWe)6RCAiP=y|XdFb+ZH zNh-0CG`7E0ZExz#QdI^5&2T3$4q|3nRzN42SvagJ6DhQpl!)Oy#&BwuZ2?esUclZ> zyEJmhdpptZ^E;Jbt1v|a9Uyck(F#}*4+#13<$H0VrrKIw`qT~EmP{N8K8?cYCFt}Qj)_Zp$Zu3|>+Sa` z)0}u`Ci?xk=#JlT+T#BD{n*;$=(Ue@6cU`J?~koz8EZ$c=S&$5L>j%xe$SX~9rFvP z5T)gIlR&1yc*p17ICkeCJm34!NZZtbg{L87kmEXd#P{h~l-P_E5K z_Y6eL@_YNNz|0a|gqrtGf!g7QZLLKuqxXC&e6s#L*0Yt>;lQJdS)ho@@!!6qiyg4h z(M2~P9bF7Sly!8$K21jr#ekj^UzP&WvBI4W^dmrBV#_hbj|FFn8>-&K`-#bMTRDeR31xi@^ulC`|C2rm-r|swyD)>!d*w4aQ(c9Pd+UnKi<6 zqTe&7JCHI!$-@8zdNukPpxg#`;H@~lwM``W?FI|GLy~b|)+cts zk-Hc0PS39<0HGcJ3_#jdUjT@N+Tm;0&u&_~ezxY?Et8#f5bz5?ItchHARPqk2c(05 zFv>}N9uDX!;G=RxKnDTTg~*{pG*k;n2LT)iKO?wSKsyAo48^hO_B}u)BO5tD1$#8; zxJcKZ#=z=x;v&R5jN*%GmMp7V7*DN?Ls;*sB@64~HSt=Ar7u~u1k#apA=e&4drKCr zj*BZF1q2J5aPcQR4VnZ{h=s@eG=TY80K?Iy-_>&g%8-bODYK7aM&KY4H1KT*YLqIe?VQxL$RfWlXVyWFG4?>RJa?#08*kI0W4M2m!v z#Rp?H@a>ML+@r^f92)Ct@DO!12tSeV`F!Ik`EF&Kd-V7)hsL_vW-x=r6~*5U2Q+_a z_tEar<3}BuxcG^ED--7&aWx%pA`Thy^Re#HW9}BwD`5E4=bG_vkU}0L>vzSf?_}VVK`I*o&+<0njJ&&wbrJ zdVIP=W78!&E}$DKt~hyRZXVxy!w&c8@uN&M%upvR)=HYg@I=Dr;Z4M%4^BVYJ$h^p zT^{DRI>xwSen-Mz$9o{2S5sHMqIW9eBNTUNY;N3QFfrIh!W6eV2G9wI9{Vl#=<(+r z8tZB&J%h=`6A80qjs`S&{+L1T(c`B`0FxWCu6}6z83t@5Oi{cMfbN*Q`2zRov5W?Q z9p<kZ};eNgF|CoRT#{XppAsTh!`@3gD(E?m+sNy3mh8j>VCwD<|sUo z@L0T=J@LPNy39R#{B4JZuDrs1BgGY6SffXez4!77jn5VH0PTixa@LT`Uecq--h26k z#^;J<8wsCeTy<2wI7W{id++5F8lNljQ6y}V9g6LG{8&ADEUpUGGokUhV(X+T3vAll zqsNm?ZU~Kd!2K$kXeX?M zhelof*kDc)S8NAp_MN@ubYenT4)zlJ78`hD)So+zKSU~qnm4Uc47JKxqhL({!vzRy z)bgr8SkDB)3LX&tRv`5G0ZfPK^%$OpRS}>Gn|yX@Hkfwa#k_6V-0^3e;RKgvX24Zl z0P~lCt9t`JpAty>QGxvVlFw&3#*53$t1cCp;cV*VV4a$PJ!^;%O&~MChqTZ{e66n-Jg@jt{KS9D6DdpFad#ecd|2 zuevG<#Cc~Rr5=xstC0bk#lEtTLv4Yu-U`I$)qp=-ey~PkxZZx^S26bla`kp!EvT(o zwrpjs>r7o869^rbB{)WDUJvBP)xLC*{MrCbjgRX{bG;7(j=HL5S#uq2Xf&+gA${tF zwnk}&2EzKBFFvffe*U5R0ReyhWQQ`el^~APAAuG8qA$+0I6Kf=9T&h<_;NM-jmJ25 zxNJ$?ij*FZpAA2FYD~|K&y~4)h?TN>aa}48wQ&JY#Pd9Kp*_~EXCZlnPLJE+^5aFA z^~=%uehB5@Tad1$07d7wX_S`9k>B zi1mhQ&pHDSdt?29k-y4wY|kOBuLFC+Hq}U)&otxoe803_Z$FB*Zbfb5>INQuuUnO> zTfy_@P5pXoBauCd{$R7y*n6W*5RGhU$Bf6}^oCU9cr6urW6IuU3eK|f@U|JJXQMY6 zYBJH%SM&5@Q_6ZQ{Dd>2x}bwXSg~-tC1u#;rRv3vE1Mf|+jdim=PB*M@Fgo0<({v% z{0S8REE#x)_&G<+9b0c`DZ`*V_r0ucaZT-NlTN``dv52J>Y2qi!D}|@E#F#^CGsBU za=EwA_N_A&>^EGbqkthxSjd?b&=?@O(6nT6&9cQvBy|X6t7dFGueOO2#ScwVJ+SIl zTi4W7EfFs5xKyqVwAFG;%hGkr&<<0W1POWrwO?-sziN39lW=CypQ>g613sJ~Cq%N(9H#Zld zQDMGl>DSiR)h<=;lbmxK7U4*f>88}_;|dI@ITWz4bLOA@=rwhXD(5qO2<)^Ljk`<}CM(UN2Hnv<; zOfWYV1=K!dYh!Ff=50+`X-qT%`QWiLdI>z30JXN#HH#3#>W2FI|AuY`Q3(*x$I!QW zH?Pnlme_im4Hxa{m$as_;0ryx56(8@i@v@~N;ya1=y7>d4`LzZh;*`PWY{Hc@CCtF6Z(gmjj7h4%`2t-cf8F$r^ zp!wm60TQ81k*!DY@*caOY&71k)Ks|sNS*HIBR%TR2X7aZ)e}UrdL`KXd|l5FZf7`{LqAgDfw}a$qT@WnLJUoD-`4zH4CC=!HnoJWf&uq zfsit>f&2UUc=Rk3_=1~>ub*P#GTcm6IERt*>yz?)bSv?7JZL^^==h`O;ivfMKE&51 zSn@(48qQpVZlZiTFK&>7nCazVBGST#$Z0XkO?;=UrN-r<|?6ZfN*TlkMC* zw-^4Jg>FK=yI>)Xv%Q@2+|Ka<5t)&BUspmVjmfSA_gF$*2`*rTy>gs!CIifU^gT4C(h`&J+R5evY zM>y`*E9EuDytpEcU2~j)GiL)JbR;^p&Gnb3BTz1FkWCfyWpIbYb^UizUYeeqz9O1l1JRl_xuxk9kSFO*X6|T# zM^;yM+rHk^(aE+aDd9o5#`+k8wieF9G6mD*r?PB$_OJ%<>1A>7UgkpRf_ zOIGtLk>2K^Mg#t1l&gj0jfyMCp>rN0aYgz*jRqLC`7v6cXYl4W zQ#ABvy!#fOxf;~oLk(@|p4_{B6|%0Ovg5uMxP$=XKAV*PNe*_E=SY&=T!a*`HwTA; zFCfNL9>)ROfpV}NJRp}+J7SCroD_5bisJznfT{CX^pL{i%^+12wZJcUtV1|Y`MB+g zyvuiTBZiw*xTXy6xIm{gO^u&|DS}ReFm{fkYr@pcbZVfX3FG;=H{FvG5@W}(*upW? z$_1D0cQ@V7cWB~fvBtKGT-S+&+1{~D8uj1`5Z2buB zE*!DM-E%Ky0-lVYY?z?XDr61@5N1T`3yugvGL=$-xr|vnJEkTYE~{ zbkn`2si6_${6#>@rhCNnYy4JSxREeJq-oj}tdZ*iseVb1&W(qu8~ZNFomDbnQlW3a!a7oLgr(45 z(Nk0GQv(y)gSbrv-7#$1Vc0j)zrN!OkcDP>_XC73H$ZnX@UyefO_);POYbVsr2=$F zhhLqI#OKXEbRlOP0)+;)$I(-atCAhpLr_!?)h4M{z>3u3jK2fo6ryu>$Mg-C?~Efx zqwz##%yp7L9NRHP(GYw5F#@^5!%m-vP;tEqV$imFTBvz8jxDY!3dio~+_7iqK#H8; z%wk?Tk(12mxd({t<)XjF0Y(btF=u;sca={gAR_y1Yf3_pD@H?V9LBbuUmV+7KDA~4 zh}dn9Pm3jDw{<3RcBhWAz1u2Zk6zg^30~pY+9~=2wFD~J9oza;a_LjkD#LHZwsvNw zwYK-Be%!XE6a~Sv-qOFd?F%iNpzZEPPZT?m-mJo@r{*Iieh`pE*A4_^G;`3IKv{xD9Ec6C0)eRF&T!mL zhGU}0cAmdLI6QxWpT1I@sBk6guOD2I{#|AI4-5!H2@NK*2Evyrjg5!@Cn7c8EHY(D$>6}whT@UL@D>~roTduys8Qn?W#=w11I_Sq=rp9G}iuo zIBeN}SgidU;)5H5_D=EKlx1w~Kqgl1c~11s!THSniN_>xQD$~6-`#PGDytl?phl#J7J_0Uwo#53(dXByQ_AY5qIx9xQ`oS2>%WP(=pvzo>|~r3^*n zDakLxCt*ir(hc}DI%`ml%4*8bXR<&HL-*z1#c#;%<@nECk0Y$ze?fZ0b59NW6L8&BWP#iihBHmV^?S&f z9>O1ykdoLSH2LP{ejnP6q@^MYX2tjQia*PswpmE6=*|O$Ce}7Po)A;#cjt-^CyIR16G_`}^DxvKRAOdlQg4f^GL3T!i2I3X8Er_hcD6FC_wT`7+nQ;i)X8i* zQ-!9X-5y7L*;42o(OrO%-JJRQuN`BOCN8X~jEeSPW z$xbBMwjU{cazAE-OP}|9f~!@5PQQR8y;#{X^u>y{9Z1$|1EfEBLSlO;b zW?1_R%_sJp?m2Rfgh_9wDbwz*JTE;f$L+Nc=7sQlS}b=?QO z+T5g+jD9Vosx%ayic9`tWlv|qmXN(>n{$1hHKTC{LhvKpKN>fYj&T0aE{XuaDvm9SDUn z;^GKEiW?6|>6QS}a4CMKbi4;k>And_>2?6pGWshZPEK@H0U08*dj$92GANjk*DazU zYY6aMX8M%6;iQO@9>(QAWf(5w`hOLkjd!;6dei!!PNz3qo8JG6@Vw#nEnk-D$CXZR zxHi527vb4(|Nr)zjh`_wlpTp2{M!1`0kG!M|Z0@VXLPoPzRDg{~(s7j!_0G%(;W76Z52%=$2mSMd% z&dvMyk`-}BRw2IJNK1fFOzvnLm>L!e#qs13?(=QwX2E_w?DFtif?sQP<9mii34&Gs()hT(^Q5uO+f zay;VNtY3Z_VnDN?sYw95FbeBKLyQ_L%gc@?621^`LU(t4X{Ec>@}?n=hU})vVFtsY z2V9|rJOj{I+wNcBZnX?|XsoN(HEJ?AiiEikOtU-ltE1hmmcM#v6g!JMP~t?)k>eUK-z~37dTP$~}Cb6JS^ev(<7k z$zi^+sN7twntiL~c@t+24I|-I;syuH3-X)X^NlZiX@sKM#F?E#B+N9?M1C^hE@Hr% zflC32#SWNb^olzV3t{j|!3(cIy$1W735!k@b6Nni&&1HB@ve2NC9AwOidi1;XMF%O zF5t6a81YIiISsHzFpe5_G_76<(KVjzZGy|t$QtxTsA!ggjD zBTUZ*Cj`tOY_AB1teV1syphhxPpLS!SDX$)cUSpsvk208h(1CLU&HYU5@!*>_fdJn z^NHU3sQMSW&zdwRQGKG~;Qd+TNuVB~@SQX8*k(z-$JV%Yqys%x#$h%q<0>dJ=yMK% zLcJYO)9a5vZs)?ifkw#9wW?j&3=#Wm4n&6EvFnpbUJ+l2Em|K;JRRvti}$$>(mP4^ zSoO^fu`~RO^w?%e zzQ@+M_42aKT;njCm2nlU*&d<?6Dg_`ic@ zx*3eIClFl277e25R&9Fh;J8>Y@YYTstEK7l7H z+XZ6`>K9qd;{!9wPz_?O(C2;mddSjV-jU zJ1#X}prafSfhuu{i$v=L$FF=q9PC@c;<3>0oHgFZWG=u$22ZCyp%$s1NCh}y7H zCqY01;=U^Nf$t*#<02z14C)TPW2fkCi;GgM%Xcyd#!FaS6VhE7uEVej@(9> zCp(}}x1(H(8(|!etdFDokv9gpjVx#K*-^F53}@1!AueKhvQ4gNDq-qMl5MM@cJeUU zu7i8(SclBhFHy`b#i7(WnYmHy{*A)kpxFbha8kMks?z3y3(p?~;p1GZ28}o3wCxWc z-PyJ)-17i!jYBB_kLz2-B{aE9PH~5P6}AkaQ)~}(m|2~^v9+}>a-XHVy%RT}v_i35 zG!(mSM~({A#M;jSDdZ!1*AGh1jmo75Tx*L<29)B>CP^i@xw;pXYmDLo-H5l^-Uf)7 z6%B31o7}0=%v|wvc`ix)_qY&a2Q(ZiUqXmb)&jF~(4*W7)r?*tdHYPVZD-u-R6`w4 zUE=D^^rENO4=Q7}N{HnW5Ckl_0mo~oW6-K^MtkvS&k$8wRC&qc!Q?&yAa-jnCJYh?Kjjdk^u!7zkKn4KRHH;*oy z=B|-F=g?SJAAp8N*T@djk5JRU7l++7GOAFd862{%>})&-*hrWR#(eqQrDHzpu8~~@ z3{8&XYL+654zLCIV%IqQ-bF{cI>6>SG&Zcq4dxKihpX^rSWk3pILFliw#%WhuGnJG z=o;By0Wq%s*t+6p6I`7n##6yfeBSWIC!l3vfKGzkQ99;fSc&nQa}YAZyyhog~e$NSdzrCI0v&8y8^6ZJLo%;6cqamP&mUh{)tCsU%Ck{p9 zO7(tS+M}yBTV&4LKe?R}TXNB~;6EGbPpizRoCA-p|Eg@XCn8JrvQozCl)Kcdzy)3z(1X=hs6t^nVPFkop1~Nv)BgE zZ3fM#Ba{wF*Z39YbD-#$2SL{eno~w7%JDD1$d}IxV0{~C{$=Rc)k%7BtFq%60MZRV z5*JS3p>gOY=J~>X8{ystn)Z=O$7IvLzNalX5E%wO_L^*`IT`O!2T6DGLC~@I#~%b8 zi+}1t(2+f79t0izyWk+{E;~rNB?n1&)j`lPpW6MzKG##!}{Q#X1_7Hbr3#i8cWxCTTel+!Q1L6^z& zU`~dHB-7P7GKJBV3{0Fa-+2n`Ic~^0Ma~T2WLW&5M(<&R%uJZW(1os}Y$tX()qO@> zCelypf=nD4VdBG^xngVAqGhY9eMfBVK?NQa70bo2l#>cqjqOX2Cj>miCAZOBRn(WD zLLnFSgx?E8N!iwQUgFXVi98AKP^;$P*#>rVwmhkMF)T z8!gQ`rMW8$%_d93F?wZs>*g#pTP)4lO0z8sO{b-yc3=3jD+|qTOY;r@(7c?5W{;(L zL1|cuebcqq(mbFv`?Ao45Dm$no0TR9-+lebRhrb5h|4Iz42zCZpQ=dzL=GJN+TPFw zB(B-)#t9Y=W)cnxM+NI#=6Di5#hXl7w4(UQ<`~X!NyhkYuIHzOX)24 z`Ob22;inEyRF;3V+En3Np%o7FIS2ZV13lwF-3~Mu;j3FtuoYsju27Q$aT2IFDmYf? z_YTAfhT=ZqK<7D7EucjRQ7>CuEKmlxdV#(IXo*1I1jH4JXy~VaI5vrfC|9jGXCV-4 zW;m1`8`r#7F2A}NvB2^r7R_ekbf2??8N1}2*s!aBJs-y|=IUxD5Ijgz0z^_u0|t>4(Z|IbtJ9l|(6t!Wu+OV=%H;US@M{S6;Hj3J?S8Z4^tc{{J zNWIA1$?9Nj6tzKWL*`DWBE*JmC2Bj{Qt)hSEXo1r>CFX>?&r?a5Q;X@=Qz+T2dZ(P zMh9whAg&jv+aEa4vkt@g6iGhJno{K9w$N+md}f@*{u5Q4JmWm%$@;$h$QCt};q#LU#4&9H9Yb?HQbC8=AxlQgh=E{s?vjHEtl43sm*k-##G;`O`PmdR=B~YtSpUmV| z;?x#tjR&dOh7ilzW&130S~7z>h%Umab_{o(;-?G`?w(0sO!W$-CPST-X58#mrJa6y zZ_lChP&~r&ck2_(HnZSf25=c3z4CCmKsVyeW>7Cf;p(EQuTbbGj_q#&Dei4R4MKM^ zIN~z`@n{M8G8#G)P?JFaw_Jk#4_$vg1c7_G=aPik!_amRYx1jyf(ND|o^7jhaVj?t z5cmmgVo9>&Gs()#FfdgtHxZ8wLq;>Vu|SRW?dP$VQI+296g+$1WahkN^33zb#@dNa zc3cZD&O?hhyzSZ?93UPDBz`zN4^_oVcU5*=i{fK_;O%RSsl9@g40<2F;e0-vS3(bq z5*-Sp@xi4{T@N}ms~$QIb%S(sk{y{AdP`CpE@wvpQnsa`6t3KUx$WBHLd}OK$$3Xf zVu9-_VH>6gJ8|P#r?2K-LYH`=AvQ=w0^N)^r-HhBpylyXd~>Ggx&)*Q*i8L6gLh~LU7z_P~7=|KC&d!Akvb&K_Ham+Gc@9p-h(o;$23W z*4^+t+3~%X@l%-zS3+A7hc%U%TRLfxekPeo?-Hnz?WWv2cd=AwyD!Ol$DuY#n4Wk_ zco4Bt!VJVI;Z9OzZl$lD65b=&k1pZwlCC4OSI9rAgkx)4lw3y^9&)xEff}4*WoI?@ zwF_BEg^3SP**SR0$_$KS$8BVkFGOukd z$g|k6vMp_^OHfnhB(NXqTS^gg%fiH3`q+BE=_ezBl zj}qCouQPTdOR6mWrkUsI-I-7rwp%8G9P%c4`)%FJeF-{+;7xc#^rMsV5-vZCNm>>S6-TWr*^nA!`Rvm`UT}%()Bu{qiZl!`lp~V zCKAsu;HoP6!v5CnFo zG4mBHuXA)S&UF-Porm!2@I*uF@zyCKn_Y!=1DY$gzrtImh-`LsiZ~1fQ!los0$L)_ zrvNE0uLe{tIIdzSZU>+%1xFQrIxqO81IZpmJk(g%6ko7p1=N~`u#sZH+IU^uXzmWx z#i2qrzPzRh3Rpv`{&ZoeHeTQ4P&9czYU4Ex9vjbx#~X%feB^N&Y7&n(H!zAp!z>9S zat$jR83XU81rmdOQLhvI_)qT7-(?c2x^e8 zuQ$7QbV=I-`&`G>Z6=(D+=90IlmP^w50^^o}m?`6i+9xjIr@v8-uc zI&SB`^^PuaRiId*@wqw*7LhQ^n&y^!UV2^c=n_{PG{6Xr&lOu$_l($YPe1z#_l~ad z6UC9Vyne-cqr{aBYsQn)u#>~Aldz=E)Vs|5u2}Eg7~Vbq%=bNabWPT2S@wqzI=jy~iC6?+PT@u40btN=DSCk%d%WF*TnSVXbO;@qH5*nW? zDoJo%z4h*Ct;f5r^7F)*(D++-<{}jrOY8T zK38#Z#ad<yOnV>|_xr*kfyiEYqh{`fP-|bLO%Uc7fb}dB~GFMc_WVWNhd%@~do&SuFf224@WpPXfSy870i#<7aKfo(ont?K0AU8nx z3#q>E?F!XbFM-N+)x2&lNomk)7rZG7ILnrACc5e&Z*DN&`e*|_c_SbhlvNPRXyuoC z5xfyIIcskqaCz2TLlDsBuVv5MC7ja8s$Slxf`_X0LnahXE{Ju^y@$8p!Oxu9BD>*3|{=}qbI!__)9_aHACmb zZ?fs@HQ3OJXz;%U8jQBZaHu8zO`Pb<=PKa0Uc z>Byhr^N)1Lps)We`+FFNZqh_Epi?|Mk~1)dE;>TLS$q<|f&w#KRQwwJTxn<&qjcUu zHSvu18-3`qNicEn*d3tDE159Ge_n@v1`H%p`i4vYsIK{FJT&C1lH9x!Sqjs$AS$_1 zk!cv4Y+Hi`xH1*w?^@S_NQ1>gs%XB8&arrdLlLevdC2HbhU!0DxL&FBOlLB^ujeeY zS%MwX?JdBS*`q#Pojfwob3C>d;njA@7ubiO6SAxG->|}QoFNo)!E*KGJE4)a;tj`| zE}>cORgI9S6tqh4L)?HN;lmtBZ0`jd^bPWx(0_hE0--NGUmg##Gx0=4;Rvf$R8~yL z1yNZOJxibtyw4Ws+jyTN5a(*@_Gt(DGoTVYR*J_X6lAhC-Y07r(LPxl&ziND`Lnj_ zBeM1kWNdspeRp&21I@W3Tnux;m(^~jZas)h?YYIDfeA_aLcIHCUNK;o2NK@D3KpO#-;4!H~;;?#&BUsq;*aI}BYmP}~ zk_{5i{HKyU@pD6LCiFBu5x;z=EN|oYM36E>yOWN+(1f`rLcPN+4Uhq;%sfm_u~?fr zH_>)ONhmcVk$$N%y|Xk^H@_k?b8JQCf`-h-e}ZPmUk0?jCReYA5^W!jY`&nqcNIu3 zXuy3DV8*icKc=peIQ3kEs@!{L99fP^|0#Gq$-|bc%Irae)NMIgJ*g$9dd&S4;vrn)6cDq5dsu4I4c|m(Pbq$N1H4S2yYOZ&6b*d~Z{@~L z2igrtD>glti3b`B5eN1^xbwh0pSBH%mSpkc*Tqe2w=}qAR ziGRo@JU$Q_N(Wy3C>0A!HdNG(*jO2U{OsP>u&q@j>1`9ChEVhOlbP@Bfve1*w$8n6 z`vx`5p-NTh9ZNIO)}Bv^jE~6oZ0D+)C#MJCv-?Ug3`o#8Qv@hmVRX*~i8#Ybefv~= zB)0t-?K{*$=Vr=BaY6mz5%5YHPoe8R5=87lG#5_+qPdRJb!_`9sd68;#` zWylp2bE$xERQl!0^yALCHOs7Wtq5s^RnxB|$Gx8#w`e0BRHeHrIz|-P8%j|7*BqM+ zcO}Q|tV-`|{w2q(Fh%9ACuT?*}&Q!d#L2_^dMw1Ccwt) zxUXap(tx$T$r0I5RTjvLg9R;k=L0mXTxI+Y$_6QCf()vUT;%HO6sXrLVeu7Z9srG;}C3 z;?n}@nA$gPk=#HgV*n$SYOJqPb(QDA8{L@iziyeKx;tc`Y?E~GN%X=Om_pD~+HL#Z zYd%84LMw#+5@YCO@BFdJ+TFIQRc1c71z}R{at+RNZyykcNJqLe{UlT`L)ffJ#?Mxo zg2R#%lavD7VN%k(Q2<9le6zPR&(=dS3Of--=u$jU(M`EXg}imgM%y5*E_On@v!b zwujdssi2K@5b#K`u;Ej9vgE$Wd>SZ4)HK8(d<36G~=0xTG z1o$0l+drT=mZ^&7ced{D#rM?%)*o)_xwk(Jt%KbU@!XAP2cFG%y6_y0ht1zJc&@>- z1`m6Dnj`T<@n@kN2O8=?;A2C_o?2bV0wBI<7)SqZ1Tk1-lY@%_vP}BW5CfWnJnjAn z`3#0J#f}aF7y_ts(WlRGchh$`G;s+J%U}k>9xoF9Gv0J{_})|Bc6ZY^IW*SQYJ(Xh zuI|B`&|y=H<9(8+HPkud>2 zLX%8boEt>KT&^1o=<|bqdy>23PFY@>Lqaw_%M~HJ*pV=KizJulta#qtapxqK=1|Ag z0+So$G-!>)7pu`tub;co-EpsXXqXC`ADhq*1FUEEiC8dq*y-+$yWP<_%n9pcI)ynL zPb9n(Z|2z6d2b%$?zoQwhURd`)pr$PcHFJ2Md@FcU8Lh$pMR%Qcig!bYaE4y z#^-9dxFRReT>0HgR_l&CziwbvgAp2m-ZXJ$E8ws1#Duc!J`!uM03|#iG`->iXc?)^ZCQDuX)>U7LRA2ysPSpUqlBuUot; zYL?gG-sqLJP-U&xoI`tPbA!>g&?Ge*?zYfSl^uD#nGYZbIPl$%BrdtH?F)|)oX+r^dgb?t&|3B8&G%2@{>@M!aZT25gXul#{WKZnVf>VB*>q<$W zF2>Bl4w0nh*p{-N-;ZTSJ%4iEBu{t=z|>~=FOIoj*u%(^z{IKE(OgHj)P(7tW{=EbIdEOZn7A_N;@HwrVX&3I^>aHr&Zi$hi_cZ23QuHC{o>6q-7 z4B+HF4>T2q&drzn{Csh#FQ)e*(0tL*x%`qhak7W59`M7U8O^yCj1z8tzAwFL*i8b> zqlV7$uOPq3%cq=1{l?JHKN?CTOeiSuiGGmokJ;#oCr%MZ<`u{9n*lo9V4FW_iZ>l4 zpc`suE`VuDcw=vY|0dp(fUnF-H@R3GnHT9+WTEp;vPjDO-x#0^-q=evxg`tTgh{^U zAT%Fz_knI83mS&aM>ZWJhXQ||p&=cO?=27vzy}Mi9 z|8(jTv90g7_co8~Dxb$z<|l-|aOb$tE} zaJAX;vs)Qvv(&k;miK9HTu)Cj>oIN+5(R3O5dVH`*F)>+zSWl)~87$NecVb`rNs z;G@QE5g?75gzi5%wwVEUe0xj_f78$A_gV>?j`e%r!m?=b1}1*ZxXhzWSX*!1btfPf zaZM>!OX*g((l1XqJCwa$X(7dylV+RVGd%1K5F>;g=APly4bTOlOTAbFZoU$puEMJ4 z8$yP1o==2)OpB(fv5QpE^(2;Qd)xMninWhKtA)L!H*oA;NFFTUg7TXvQ(`qFVA_8T zOw0Ay?p?PZfj>B*`zey#)!oA%72)arJz?BGnateP0#LUZLvs0M`yFuARW^q8OM>f| z6F2dTt!;6UqYN^&(ok)&h${?Yw?$Nu1#y1tjmnOyF^jgxb)_2Vo#>5u^QoD#IFnS1 z7@gHRbx0_7V;w-mWdefj84TbM0QqvkXKd@7G2*}MEvkYPt8cgaO-56aC#M0KuI8hy zErVbOm~8FZOMgdtExxE0d-y}u9qIQHa*wtI_24YTc@6RwE9>6_g&@hmSE3NN=w44^ zi_MtWTIM8DxW#M$FyI@Ba+Kw!u6lA^3ov2q(PEbg8iLI>tpu&Gq)&IKdPY7t%W^6x z3^55T+qie!@<`ogcD}Ahi5T@Xj4%0*8}wKU9|CT z)pVDQLHZ{8k1|W&v|E5t>6?B|*Bzhl#1Bp$?vk%6%LlQwGvEX6-ra5Q!1i2+OHXTA)AUy-FaS z_FpZ~ryPhXNw}#I4P6W9T7hl{be%w71Eg-b6sIwG9S~y?4gC!e7h0pCp=eNU5Qw^_ zS_Gn6s#bw61*CCq1aza|+5xo*bO#`|jnU9|0ksSC2%vQWJqhS0fp`EhI^1l zn8 z{5CEeCnGb9(9PtnzXCsN;P5b5!d7*T!-mSgsES4Ai0G&`(%SjD%lEa(_qEygwZ-?f z4PRa5Nkjl)J+w!D9IfY*?9Mqh{>E9Dxnt{)c6Qr4#hJ>tcy(7@zH>Be7}2N*-z*Sl z7T&iAG#~Hd1!7kp7l?J>WP!*#9BxHJOx!qu?#KIdfp+4}+Ncr{w+ZwL-nR?%N4(j5 zN9DEv<>2@5eW&1Dt|<|v8FadZnGCbogykvEzt$OI|F z#I_@WwTjQd7bV<7=2-vp5<(^3jI}d31T*v-*0_Gd%75Xb0;=dYAdwxl$vG9fxfrTk zkI~0_T6j)Ej)D(;6Y@#mv{5KIIR8)1;y)vQV9(F;d(NRaHl20oemLyz#^dCmw?2t* zRWh?-69^zingjNIL|7PA1p0<fPPmx$4m7Pi`lFZ~08m;Oz-G*fMMVO|AGf zgXsKMKxs$PqSRl<-Iszy$D;LsJY!K;P?GbKGtko5>d;TU0DC}WtQ)?_s2+?m3ZOFT zXh6!S%yVT_W{ZbWW$bH2T_G;8Y)nIC`WcAPp;@WG;P)M9tanBztFB0-p8(swY#A0A za$Z>)oGcog_DM{En*tiBU{aTKxcsH zZfwv&iO2xLpKX>1t;BOZzda4H{{o(<2nTaO78Nn2FA2mZKyAriUl!aq@&1ZHI@TA3 zIIVAP0?HlbYms||=)NV^b2edoF)FdGgkK(8b{Udb6fc`vvJ#qFCL81V#Fh_jPAr8& zs!_Q%c#hHX&=r$^G3mubH64Kleku(O?Yc{{RW_W z1ouO{*@8wxop`Sj=vln~OQ1jCt;`net6THp}$fhTFnEv^N0GGG+G`gkmS)1qQ` zr$trTClqf&ad%2yg+{3&vymBC(c0+{@ z&n)|(c@*+j*Z_VAt+qC|o7RRsYoQalnNH+bGsy4IvUkBH=g+*bG;DrD&yD_0>Q7&& z8TRP$pB->Q-L_jEzh~G{*F5ssD+YgM$ZNYc7k(-Jzcd$DUKGzCUwC?4_blTx>Kao^ zpw-XjE>hd0+a!&IZvyu2Z`WaWy`;loCZJU)K%spC%nX82p-Z-*Cn zw^Ybwewhnm{&4^*fWULxGKi$sJ7B{A>4L=*mz1(V>Y; zOt2bjFhj-F9OLTO=X~OQSAJ@xLt|YXZQ{&1Q6yYxTrKQ)d7djjb)rLKU475^L!OR= zD~zj(I}1G;OCEA)tgCY45Az@rJ_2u+((PB*UF*tERXQ}*)y>AATye!k0OrPDe)iK} zy7E&S9UALu6d4GHbuAK3;!Qq&Voi9SD?fFDLu1Q}TYxl-TO|Agyos1Q>8pQsHJ0Ea zXfa2GtgF5B8fG}2NcercSqAH>cKyMXpL)lkv974+g@$cFB)k!Cl8pS(-~ON)OYose zl<_;l3F}!V9)^9TTV8iBy7Tj@v4nP1?@M!}<7%bB90hD7d^Fw+{L_zYYgCOT_y{#S zG&Y8pm^ia-(mW*3zw!7@XQ;*!y0S-=M>=6yxu;R$svd88{Ll+~o>Pq__y`?md>-Yv z`mDh)Zjo@BZ#<80`}^gpu>>EXTOAr3!<$%%VK~fib*h{(Wm2tbETP>74~-`AYX-y7 zf$Qp#!385!V+mbt_Ry%S2TiMWoVbdU2xjJ&syC>{5`Jy>(5Ne3e@DZ~cqCjx5N65X zeY;d+3BM+IXw=o8h=w@JE$z`7$q!Pd@Qv`V(fWNb`ePKmYE@P7KEvC{}0$%rV?D249gd+X0#fKlpBpm{33R ziRWlUg+e28aR4*N@CJ#L=G*|LA%IyD@Fx13Kmw+o8(FcDEYgAuxP=cR*-)-SXPy4K7Ok>9$Rz(9rg}0H(%= z3FspV8_6$>_5Fl@5HlncA=GtjT2U38}=qc($=cdnOiARc8Gt(bey*@3Q zjg{C{JENyZ>JKr2d%(rUmvJJ+s~4rqP2rB)!s^d7FR9i0^ZNRQ>1CajD)#Gi(s&$D zo0E^k9gRKI2=o!WciZi2PKyd zQ7vbW8Z)C3>VTob-zBKU5-L=L*&5tX)7YdjDMb2KENrT;Sz0HoBKH6?i!C?TKn0sG zVoj@8r0VNZs3jhkDA=0Cemb^J_L@LQ`ug(DgZFp>P8ADJ10~;Nf{V&7x~SrU^OeAg z>ozsi)CMzDLjqS^RJ|D7npGW^vFb+<8rLOOHy_CEBknJh#uA?RtF&NEo7jL;JHCQb zUSp*YDfJ~y(h&J*jOekf%`rQ#>PHTHWo=Uf@19IGHywz~lkr-52O`!$(O`px{KDV; z+nD$U!^!52AzreA6V}oeR_7N&B%3t?RE0$oUABg#qOXVMp@+qdH4E#|qV{W(kNYc&^1aK#e@8{!@RriVP%9-M281vaB9*!SXrr0Oy8sdsQ=hKB|2+U!k z&=ux$z11sJb&ybh_X?h8{W(B|zp20M2G~D81mr8f+ZUo&RGr?hUgf4%wFCFuN z9|M}ThK`GM*<@^)z7IT;C48!kZ9$a3Mi_ma|Np4kUcDxGO5RL{O*G1((#yLmC z0~5V3px|(AMO9`P2}X&A7GsGLcI;(;5_GZ^37*In8q;P%8+)*!xlzGxb@tG_BHfhX zLe2Oz1S_W_N6*X6Y}6e6RU*AN(K~w-YQqt2AAUL&ZGWfv6C#ZA{cz7IP6q$Vm%)!v zD!6C(Bak=j{r&)|fq*YkyF3CY=Q(+Psgvi;fY`$IX^?>VI1Cptb*qqDC}G(u)NMg7 zn{zoe9E#)3rT1`XEZ$t=4oeKVlpK~Dl;Q%F;GHiJn-cPWSTx$OkqXNWKf49AW`}Z5 z@tEV|`2~d&PxkhDZ0SDk?ZlM`gNFI5>guI`d%gTJcRP_~K;vG3@Eb-AhP06|Qv`+# zZF%^we{r`HUvp^UW|?`a!LU*GyK=V^OB@>O>R5x}T1q5*u?cHP=Ue;T?ZnXzjdk^& z!Q_Z5au5+K?*G^K-0eh(G_W}#>xvSqG`gL*01(r)V#bgD=x!%gJ2ci6+jSb57I#&bM5|`7%jyf?5issd`28vSnFMKl|1%5KD978gn2_L^alKMEg#b zBxL{OERY@j9|{)N?mWqv#A&GgP2a?o6D66yd7~MeyY-#XWsjkq)dg(b2wD>8&n_;~ z8Iis}at4(@$;`MogJKN~h4!Fv{r`Rj<(mM=45}2IZx#Pb4}+WEClvVgFrSO~zYMyQ zw1JeCO=k*)Hc663wkaisMi6)@U9oRQ!5pc|Mpx{cC`f)?3c6bjEvvQo=bxa6{t&ZW3tjFm!BZ#J`DV*A(A0r^AD9faVv> zI2iVXLRV1aOD}~>k45=!V+RXEZ-p+u$nT-p_IWusoI8SdeMJ{B;46eg>B9pP&cq11 z7%{3o(VVc!f69pEZZCo7Rus^YkH;*4qoq&aiHb}+$4}7^N7~~AD#Kf6OBXs&U#UmT z3?}e!Adfp3MRk~x<>Hu{9%HgWtFWK+MMmzA+wU3bJtV+alwvw5R*#R`T ziiEmKC2v>1^aGha974JfU)S>xGSM`*cZ%r!$&U9N+%QQh$9RStB!xLKwX#8_cj$bI zLs?(MTtV~v&WhH3EZ?ioWb!b@7^NAF*+6CbX=oLeRN}k_W`kFZO13>2M=?Xh-X1@4 z=EIcr+{s#@8GU}XFq3i?!I{i?>dF(+=*7fOKl~Z9p7gMnl{I zWnGVko^>E$ZLdtdt}-O`s3y1>`MwC*&09Is&s27-jxVAaA3Jd^{J=!h9tA;GOtK%I zlW;hFCMzQQ61^{>Iao6iG`2pVb?EFFlFT%X>WNSqT_@O-0yjFJOA!ED19yWz%XwxRC4=%L0h4Rq&4T<4*2=SBZigqaty z_}E9BI_b}6x$~m;9GbWpS+YoJ*lfEOJRS9gR~~lfMV}K2(pXnd7>v$~*w@j_nLhVr zcV6_gBGF@5SC<=14t^tHcB{<0H#?>;cIQQ8HX6>0*e9v}bN&v&6OrrWn6AmkfAcDL zUX&yO%n--b0(uQ|2%booy&@4~X2h;>=SB4njSY)en$zgKXg(mup*`~QDek<8R|L~= zUZgSnq$144aO^ReFaP-cq+Ra3h?RwAsN>3B6~_@pB+UMk<$co?-?_k@7mYDtxoYaR zf`*29?&m`-h2RW_W9yYRTj5IM%&@Fc%pdJ1eid`I55uK?8N(Z_in250h((9n06nA@$m~I5hJ@2#`pf!ap?p^XGXWcSI;DY6Fu*M z+00e?LBkd@1sxYCS;ojydj~W?|J;Ei-^&dR>1foy zi9St6If(doLH7_FR~WWDLRaV?>vPaB15Ifon^PFpbfGKuDfW@0YwHY+5L&v)lLB+E zC$iCb#Kq{IEh_Yi`i!PyO0jK+X*mqf@3PY67kTrUbbrrAR}|d!kxqb~8)L#PD6$Cr z(!axodJq7Wu3(Cnj_Eid8{I_zoOCqkPRmA@UpU1(8~z38DnU1z9>ci&Qs`4D#DQD| zXa;GQ;?DW<3nqH~TLwC6pW0^V96l}fPx&f9_Y!DM)J3?E!}mTeh4va)i~~(77Y<;U zPm(YG%|y}gegZ5PlK{r?FF(J~8$ZtYK4WNv5HIm>a-NT`8iCJ%?%#&iNk>86s$8KA2H&AkCSXi{SU#w^0`Hqe|f zLJ=PSioID#x&qML6{MTw&6k@&_ifNj<~|;b<6ohVOipv33z{iMDILd%%BQ$RO;Peb z1`SFRXgVl84>Jaj(oOPl!XJVE7l&dVqjY&b{<{|e{pxt=V4z1Z3`^+>@+S#KU!TQK z`>EiQPw2OsjskBr=e#I%3TRYChAQ?I|BC(fh|OpU{f5_w2Bpb`-sFbJZ`Wm^%ccqH z`h%b&yRQM=2185#v+X{UFYh`C|5&fTn1yaaJ~~#|S;KI?+K0~BrN#ta7h#x{I(Y}n z_|CC9t2LabXNJ5%f0G^O=U6~jMW`=lSa}>zZfw{fvmio_T8}3xClk^FF(wLSS$Ih# zGgK7sth;n0NgyZ)?3s%b!E_Mo3XlJQP-eIB$kW+^KxUk7sX?_m*&NWt?Pt+ zY}kg~@^j}N`T5FT{^ZUmfjv1B;4FZ8DF4woFg=F^mcwL~<0Lq|2~Sie!5M)rba2ZZ zh{25%TW6svcRIpoWf-yC=?J-1Lmm*zJs0u45b^yq;(ND5ZP+b);5arctmzgtpZ zl$?yl2b;5~te_|~6W_{Af6)Q5>^^RN#Sk>;TvCI&PQ{xA`49`GTSKdDsCvRQg|)cY~Q{Ya*7*^GdEh)q7k zqVzD=wktta^^m7$ALrVpcbBFguf&0I&{SrGF|k}((fg`qgjdqz*(5HvfKQ>+5oqWd zn0uk*nW7!0`Rd9{`MfHuQ!T_rSMyQM-#^mWm(OorlI&OmRy}{7U7V6uad2$w+$Fq^ zCoN(WduKMzd!;bf;)UPVCE3?VZMP zGFG;)XP|hGn-WoCB3!~+&kCZd59$P(hqrRU_W+$KxH*1-jAxS_s~fEDi6m4K*oC>X zLM71O`7qy=vFW>*?xXCAELY@~g3=}$nFC!xraH+g>HA!D#8r!B$zbi3EK(J5>HY3~ zN1)V<7=?_`rRl-WI<8UUHwsC(MUrtc-kMxQ&}ccD1?W~hy4t6taW^SQ#O5Th}Dz{dqp8^L{W~qV~zTL73_ORNFAMo=Qe%bZ+GJKTc!4-5~ zEq`rq)^k04er#OxUg$fq3$o9~axt_+<2|lyckGgPV7sRxqb+7-$Ko8TAPl<5MpdR& ztz2x_)o4AhM(a7nq;jzIg`87>Hw34PwgQ&r_pWTrBI`0HasL&iP#-obSD1wM1U(z z?~9FX-iw-4udB$a)KGR?u15;=)~WRZvGLZX_#y|Y1w`(Oir%t21-cRM&kIBw#cgtM z-v-2%HyYaJ;C>3IMR32y`)+~$f;YQ?XlTEKWA*rg;64dR>g#CR_kIdJ3Y0valI%DOE<>>s!K4Wp zAc5-pBcLKjiUCCLr~b@lWoTEqEGtR_VB5AaaH;o}Uuc0ZQwe|%n@sU9%U3J4x(flF9 zt&8!o6i-w%yDbnX5G8KUrJqA*vw^u;Vr0lIQnsp?9|6+sK$tY`na%ADnMQ7+QJ2LtddoQ5F|%2!1-%R@^%S(flh94m^ovs5t^1fMs4~N2Tc1JyCY|zb=uYMG z2bAyP2CcQP#BSe_vm^0?0g18LDP1!!wslA1(E+fp824l;bn_-V%I7E3W#~AU?@6|u z6KY1%yB+;nsU*J8YTFjQSUy#y8p8b~KC%6aMqE2ophlLiUsS*TiY4F!x4pQ(C)a7m z-JY8}z1RpeP55<))0gq!iaxx*A`lx-g}wubsfva=@z#ub9?&K{wkH*xVXben;j?PyAma^5A|T64gE(zT_ak5D|xTwExTX? z)njI4iWXQ?hBol)&>*H0BHY7RflL1ANm*=bc~PS1WoTf`;9AG7M3UGi6Gfr!l)J^7 zXxTS1)?N!l`qx62PL!ZM1GAVMs%YI$j*8uM4rqicaiiG7o9S0CeC^Y*b{=I&cFY}!;*Cq73@-&_BDVFHK4dkJv4<$t z;1ZrEuB)&kJ;x3jVrwTW@@0`L*z0(DqDz~E=A{zHg2%m+ne+0JnK`%@)MN2iusM^R zZc3J}zqUwq#&&N2)}*QXPgIrKRrWH|i(g;*@ttGvx#o8ie>qYaSC)qd(Vh!cxF$Ww zFQ)wi_7uSNi9OFR2eM?hrR|tgf+Xqu7oObSS(&LDRnhvvfD(jv8|rVY{a(^)0ZPiD z*|swL=VWWIiW6{Sj=_qEgOfEYEtZQ14)#+P8$r%F*ck?kh m7T1BS?I_E2ERGV3 zOZ>$iCQ=K5)jjS|6OcTCHaa_wU|z9G8vM)fUWc``cnB7inYL~Cspv?Ks_2-NQ_w=#Y47_?uNV@fKap|^-~_*fD_FIJI$ z!;TzK)2ouj*N2*CB6AsDvTcVA2l7tJRxiU>8@bd8mY+O~lLLn#-!}@+U9Nn^j~886F~P0 zMA7g21o{^sZIKU0jk;fOEr8UQF91?HD%@57b^%fse+R_%k!UCvET}F{1*CM-0BN|h z9Ef^4)a@ET>VgV)O&EYSi+{TuI%-|77u@8iRh%{p(D8z+1Eg`@2xybwz6?kwpx<<$ zhaBitKwlHOe*n__8#>Us#atcBwUC&~!42SNo|_YE=d_?I{Y*vgGcrJqiGJ$X+I0rq z_J+Xv&LryzD>NoYoFYbqBdJGC<%F2%Dn zcz&n$CNoD&k8K@s3_Tt^GqyFF%js5UB5yZVmCM&hkER3Pe6{sWvY_o}(NAK;gq!Cv zE>YIxTq37!O+1u3O1fWSef_-|ohmh|;jFebqtI7-(bJBKwdaG)ytvY$y|H#qvD$vj z=EK@STP0eS*xHjoE?)Lzu+}q{3maw)NVM7mf#&5=wU}#4}Jq zccZUcWD&=;T)znSoc{sUfmTi|)|NAd7-ttasLwqC54#`4l9V?$rXAHhylo96xDK=9 zt?rE^fzw08X?H6>+xG2CrSRULI=8z42(?-S2njf{c~aY&5g`gzuG`F5Ba1LDXz3k^ zK0f|*3$As=nK$bpY;Ty>eVPfR+{W*QvE3tqlenA>n&#=<_p#*Q?kGzW+wf0OO)j$% z2iYE_UwX)^`$ZD4hK5l)s_(H@ND1x+CrM0ah_KJ_TVzkA! z*W#^``+aNez0Wy03H6WL{mY!Jv-Vp1x%S@c?6cQ8WhL(u|2wZ)-;pGUe2&OI^HBlw z$ojO)pyw_`!(Y3jz#aywx*FJu{Gy_Y&o3I8Sk7@@ncGo5fbFyS3lqJkpiA^?1;lpm z*i-)ZS4y_@kB7=!Q8=*z-`1{-zBy}h#ld?3k0IO(7>mcA^3vxLJ^zW~m*=*WcW>CY zqYyk76i(uR`c*}KAsFA9HTi-g1^|Qcty#T*@tk?xk6;GY|6^=&fXwXBl`VfCpKi9& z2ygl0P)sZGwt|^+0}^p~qURnE;cE=tyAOjmc=pQf(TU}y+GUn2@y&K1b}s%{8Xwx^ zz|IAP^_fwq&K#ZSiIK~XLy~_+Cz;{ZXI3%OI~7O<&8$6^njW2jlLy6{X3afp=VZn} z7$$l7{}svXd=twSg(k85ZQkC*{^z*O>pPrW*+OA}mtQ=fxGgSv-#5EmSn3we%)MEe zgJz+6xs(N}?X&WwfB}At+YD#dfScDN+ku^FTr2zH2eQ}EQ~jUeN1r0e4>v|L$5rH0 zg_sBrjA9Duz%Fq`;W(VX-7>Ry3vBwvoZWjMy1~g1m5^NJG{)dr3c6g=JFa}WGCo6T zwR2^2UGtRZo^>!)6HqmdodF$YF7J?5SxPjPid^kjv`5(t-W5Sjf}&eF4Id7Gnxl<_ zndMk$D8;J}!|`3VdGZNVBeHZ1l#GSFv*zx+Pg-^ULbS}zI|P=Jr@A}F4J3LV0PUU` zld{L|nK3bY)Sej=vWM@PaccIEJu}8t#O15y%jFYpmJu}9Y=iWzE>^BQGmDS^^ zFHA!HI?-!O}uAIW+#5NDO+*bqGoZlXsZuPtl*PRMgGZ^$Q=VDU2kdGE`|-m zK)M#%ns#kcJ}kTQ_adnC7w-HufYtjmT~_U2q&N=AO~WrPpLW-cjV9ddW=EHUI49gK zbdTct1A$({l|u&~9l-TofvD5+*)txY`Pxqf;vtEj3B)6g-x4SbXt6*v(bC-R0Mslv zYEl~e3qYKCaEuf)jN(Q+sMJAU0;HwK`R54V3B)5e0@4!v0FdTO?P`U@ZgjY2EFP-I zTn$Jym2Uyk^zHzp<=X^^`e8isp2OkB#2yYvbE6@H<~9q^V&S+FkhahbfNs?CIl3PL zqFCWXG9WEM33Mf;!)aKP-WMHify3Pd=t1EVQd9hk~dRzN`_q#}{{SfDgonaP~Fo1Pqa>&-qF4eVRRd`<1}Qj7FI^ zU?l_nC*nnxRP%E4Rr@HHH7rv*di3Wxz;4UX&;1@wGo3bAor4TqbOxDU!25aHWdj%z)7V zt|YJcef_l`!y})TF%sG3Xe`$UBuBtF0N0msWv-oH`0M4~S#s;h%{xoZZ8iq3ezEAA zxH6gBx2-$aJ4?O_7zXbwIaMTvLi}P;?&dPwvpe^Wcb2@^(by8cWJ&$-Y3uF>=uNBA~r8Rs4^t*^SJ&o@87=bx$NZ>%#d(gNmJ92z5LMt-{8v3FFv%i!*ki&;Am_K#~aLO z;o|sXGZ))m&`By#ax$Ip`0tC-xuSq7t86y^@(!oAB=PwsGc`kc79vH^B5>8M=Mcx8BE-lWx@%ic~?pd*o&3UZZ^=g)#R7H#7dzmINj{k!L~ zH|=OF*9cA+2uI-;i(ZE-Nj|@{W6e=+W;@i;Sg!ZXDEORkaVv;itG{#fPdt~se{nRH z>w1GZTDZS%0U_JsMd!bP=>^{W2lyKU;S7dMgn4A-$PulgwQu$9Fx7JVOA4#C>@ z_V4#x_BJ^hn^&V5r^gEy&y0=*blWcTOS#iBeu4<33{%sSglhm-icjfxjvarJKBNK4B^hXW=LD86OH_kM;q@TTX2V&6vA+{*q~gaLg_qhN=Q1TdC2sRV#H!8U@!G) zteQv@w!0d_HY?zGm^r@7iwRngOKoEVtC(%JAswbXMDxc`YxIY>ZVlDFGJv7K!(f?N zu#_DNE_drQjImn6<3qWBJJj;qNN$31%?qW>dBFyyIZyuyQo%FK>_?PhZVKgoSty+o zLoGHfg!zZf+NFGFpnVwK6v}H=sGX;W>h*r8JbXO2LBVrF^}0Tk*Mv~YMIkQwOt4`H zd%FVlV_~e~#NmhaM`F3~Fn^TG#9s>WB{GytlPYUCH;l!f zmTH*D*0z>Rx`rQX5r;8>%9DjI50hodnc_c|hyaBc6IQVR?U{*zm?4{DqLj2FGklYv zI5lvCStYJT0%Sff#ltpen`wz)AuV!PHs{C0x)t`jG7dC=jQ+i()7WyQ^_D4#27LyH zdXtm8x)!#sRMma3KL@FIZMLbYv#O@Xd7II;_MyWDo!SFjKCTo_usBKa91xo_857R{ zO=G&cEzkvq)+aK1@k-1ZF}it3kHr2OhML9r`Sh8RdX8%?GSDq8t?6b@Qk$wfsxsB} zVrm<3&B=)N^c8T!(==4Qw80vhYaEfb@{-GI;aaq#6%Kmg0BCW#ad>7Ko^VB)ZiAO$ zuSE2{+@1!;-@dKs^yMB2CJGj~KC{HbHMca^q%C&X788%G>U-#G zSy}~GJ;T>(B;!Pe}xu$@v=v9;&NRi{|>_OQ3wP=oPAfQL#TIYenpd zj+qBM`(le2&cIj&Vz^k}FtC=$US5I;$mnp%XeP$Zv-G(0ORIjBhwXS>I<)_SGaj4B zr81NUmQ5`k;6!zx06J zSlv!H*q-ZPg6bz;um&udLVNPlCl~p`Kl5!>GWCozrU^am$;XPKa{IVQWQS2%q&+?L zWk~2>VoyGGN~u4y`*HISbjGyN_o%LkUE>+0Q~h+@A$b@yTMZpmNVTUd2^dQD0{<## z78@;(KOoCSOn;H(CjgEQ~@=;;(+}vb>2fzs4pImp3L!hFp`A+c{FTy9MlR;C!EkpzsQ|l4z5I*Iu1kJOC&dc|VGwkjd z`7gxpMbMnc%|!&4@8l^{&BL(Zd(Z(hLGv6p1`*ibn(yfWFJgCq?ze~IV7%F4<^~snlLLD9_62_8>15DcTck*@d~o;e z3p^b8^<&}JREM1GB1*oeP388D3lyhOC%9Vyl9|PrTC_7?^KxDF^ zAsvI*IiHT%(ibpvBjunwZ%}%ZPWOF*3N)m<1T-~+=}s#SIGrP16KJx7=}M-S`sI&w z*MVk5h^}<9e*zo29+=ZT@2aYJq2fFj;6<73~U4S=%?~oWTCUL&yoZ`eI zGYWG1;9z5G{+7Q1zv112?l+@CQo?g1-hp%+b~(4TZe27ck-l^$1sRoLEXBO&56(42WX&! z>())sdmO7exnzBRs&3r~Mc_-=>tUfXRhae<;EoUA@bPRUdzwd4`XXOqcdJ1ncjB** z5}oRx=?*&2L1_oIJIGj#_+PfC@|}8o4uzirXU~Q5%DAhuFplZ-YJ8dTmWfV~M6cYJ+~oA3aur%U}oZx`-rGZmVPobF$?r+7dkWdXOtxS ze19yN`@~upDzY;7Nus9`V%&dN;*rhM*`cZYH63k*U0;X+zV2+>GWhQ^6+95)C)wsU z_wNTkk$M0T!>?;2J8#gr&{@TGn`gx1vBV>N?7_NR3Nyo(Fz91C=)12?;cVW6h_cBh z*UV*uJWP~!dva}oFP@Pr<^EmELez4hXSdsa%4E@R=yG?T#yz^*-OuOe*J0Iz8Hlz8 zwk<0t)ZJ@qQJDyimU#5XJ-UeU5i?dI{nK#fYmsnCXMY||nOrjo=gNB5bb)v08#r%= z<51Z#I1AYCOXqhUoalK2lyzNCuyNp{VEJqK?@u<9@b0>I7iDjUHFR-#-;Fy^lJc$% zR1!#_!@$%a(ZgdIQu%ykhagcdDPt8Q_yzQ9I-L0v4T||)Z(Ea08a;$|OO6z>{A`?G z>n%opO2GTvO5U3fEg=6?QpUOv$V6ST1%0yoO&$aM6Ivm;rm1Ah&bI}c1?W|tMAXkB z@Fd*06ztK8QS*p33asekYDAe>2aOGryp}Gx26O7RowtFVy|2 zR3OTQ;#L8=QgHX;sU^nC~24X9I6 zUIXYVft~^MRe}Bih|5nrG6Fq#wLlX9T_ey8K-UU%frDxtlyOiV&~-xhBS6apS_7y{ zpbdab-2h!LxZQyGSP+kl!4TJ29@bZ=5>U6qE(XN8C?2^65Ze%@T!1L1@yNY^v>s0a z(&h4bKr1BnV?Y-PbVS_7o(!m0aNZhY4@}WSla^YWmvPA9PX*1ahX=^_=es+x#1vwU zGl!k#U`d$&vB(=H#0mMzkJnuV&Q$C|wWe6Uel608WS)nV!wlIcp8e~v>aIBfkvaV0 zkxE?o?kO(kkn#etKd97OW3>56F-PluPc8P!c&hQYW z^_3~>u^C7tG4mBnb|TBBygGmJJn()Md6p#7A209T7`JN~OjGT`khuc&e8-zFGS%hz z3-Jwy>t*0~JWXubn?3f5)Wqv$4)CqX@F2IicDqE4QhCfAI~w zq6=~2G*z|KlW_a*_^FxuO#)qvs|ubJisqv98`1S%FCsj(=*16{rTFqjvN&^a%4@3G z(p0cy+6`iw!0{iJ^eV_`3X)5EEfo~CZktEhLBT1#@Rgj(|2uQ3%U%Bv{z-LHx!H?k z*%;>|wJ}R1<{-q-E%XMX)eG_?Bv1}lK1jSGw|W_weM;7Lmde~$^j)(GtMIPm+8K(q z2a>s@KLAuk?wTDqFue;$vEM1rFDR)tl z>vsft3)k-o^f9iajYq~J$Nvy01?YPMT?FWMf$9K#U!bc2trF-vfbJ0JEpKrG&(9xc)nkZjW}ouzXN&r08JZ5YFCu@ZFg#mG)u|$P7c~NCP$)=tWXbkQSOYHqqp+=5g?|`%TM82&X1z zZZInQt2f=yg>0~beg^-L!Cn-wlI`fob)!IL=QGV+5}lcYmHEbwfW{BYS@87Df6g~O z!d9JYm_Cr8ypOXMR>KP}Z+Cd(`r2!e6>iPMQvUg}NajdQ=>ur1Ui}k2mqV+yjNQ8n zuAZ3`C6uNciDUQxHq+R_O5w4*zB?!ZI`&Quzz#(xm1ODWtGCz!gJ=1An4oOj83$F# z_MM+V`<#Xr`4N8cND9{<3)JCoTq_m#2B80x*!|I$KM{!bws#72JRq)=@bv`fZh?vc z-6PO6K=%s7^MYR#XbGU%0&%VB6=*r2`vjuSspAGuH0Hqn7C<^!e*@@eLiYwB&T8?< zUjW@N(EbHB_DDb)I~9<|p6g;SbFr5L8ayJ6p44i_;|q2*QbX&lFtlEenFUKu7e@$$ zMdZ8?Dao*14ilE$h`@SVkzZ8E_`b^ZMgq9ogH5JH&vsJeNAs4^x^{>}GM2hRDnDIf zt#c$$i4FI9NA+!!{Se7>&V(B@YFV!k?0R}7|AEqRUtkar$K9~v+2JBSj|jPudg*q; z=H$SIg|z%BlKRL{7$krDfi3yr>@m^I0xTcz@NuY!6<7y}8-VgU64CG=?v|fK4MbN36n;E-!R+V z5sc^xsGaZ@VmDGUXQE-y;_m)btjD|9f<7K@ut@HYF-PoC9MS(7l&oZ6*^^yBM6&zp zJT;f|iD`Q~Cb`B6uN|>4yzbuEsxy%+vq;IN^Hl$u#Ym6ZL|h*1co&z48dY0w!hMzC zxTHQP5Qm_~ZUFQx!R>Uo0u-4o12a)T4+~TZXpKOZ1A0WDTO9N_ptXYg6`)52`d^3R z;8P`;gAa2!Ql1D%OYm=ibfED7?qd?$1n6;rmIC6k5szH!ph4Q>bBMOuqkI~`=(nPp zc}}TD8g~d7p-ZH7Q#D)B^u+>mXpKgJp-3%BsZx}J7Xf3)HUc?th!lHke4^(M#9{4+ zFsz0$Ry1g!Zbq~ujSgn&|4njgjq{6V=F6s4l2^ya?Aj1acCbG!Nfh?{WB8DaP}+>>6A|;qvEr5QI>*OvqGb zO38yT!llv?DJ?P>2aw^L$s*A%C6mqH*f zEyRZKdinscA|f252Eu!+PxPcQLj#4J?7m~7=RDx-7A>B4Ah~ZyJ~SiV0?KhoZ<8+3 z^EwihnYqakf&m6_TDIu!^3rD$%VUxcR37X0C$YR5sGa@XixVyB!)^+80Zf5`+9Xe@ znNOt};;HYWbzFt5YN+Pwc{Bt!j5R~`asux<_zF#TFNkx!oMg3(9vQqW!ss>8^CgsF zS*moT77cy3^K4+0I$v4b+tmf;Pg6Ru;)%mow!dR9vIK}MesS@U-XYNWxc)+*i*fxg zffhU5azM`ujuWtQtOCS`g1C$}#l3=irF##M?jC*&=tZI9zPQpI0cfk>=nFw(&vdbT zBLAhtaum)Lh{p4(@vR2L7DT>)ekBn1e^guS2gGN_c!VxIel5^3faVEwCLm3v0+6QS zhS*SB3~);IVo-V8LAQmF!hNi0>n_6IkT0;9iFGxXIkCs=OKtTj7|)Z?X>D5vEe7{V z?B`HeZ|Km$g10lR39pdsD*Xv(gjIIMg8JH4ksB^8a|{;>N`37)7coV6XJdzC85;!~ z-5d<^2>4k<37rh#5xAq@0W4>D)l!B=c-o8H1s=EG(Tdr!a-zLsZ0XIeFW?x15&l^Qb3Ojt`3l@Z88q=dfEBv_3v$Ty|)tNcG)YZ(`;FVEAoSs zw_VW2FbK;a!&ZA+iCb()T)3pN?}k;93YC6HkA3zwruiHpd=&KrQxrW>#UfC}3Wrt2 z{>oH!L)t&|oC1*O;dEw~Qcp2^=TT&b2XlSJ$)|FbL1~}C038JuJHi;lj?9;hswjOY zvAjn(xy4#(wlhib9b!dSyO9kBb&Z{+lZ+jMPzb&V*k+4cEK0J)w}ae#P2ltsL>|pZ zGl3omkJz)!agR7GpR zy{ddy09r4xRQ@&y^b=g47KlpOGXhblRMC3_kf!nhphqQ^Pb8}7afw+WxQhUF3&ahC zPJy^>uu7nt0JRD9GeD~RJpxF@Gt%5r)Shm`+2*2}bX%sOjz=BS5&duuPGI5)WLr^f zLv2xWOQs0tPM0>+ri-eBwABrb>Dr=9OA%6OsOu~e9)D`cJruZJMJ4wo)ooy}X=q)7 ztm;~_I6&$TuL_|bvps})Erj`RFT5IU38w=Ld#;@ry+l;mU;f|9I`bo;CRqj>dBFiCs*YVz$_&zgL+qbZV;c+j8rBai(u*$se5^0i3|{^41ZzvO6aUfcF3kNq;) zJ}3(jwM!m&*0Uym-O<>*T1@*K0NPk|EE7ODanAK$@vOhJ-QOS%oc?IrR^=GC} z+u>Q0^FfBe`!d=2CifA*#-dm9ir>Be)7R-)lP`2MHm}=E?gt6iHe{3l)I93K2R&>5w)Soq#J#Sg`By%RFmxe9BrvB4YFU$h7K6;A7DXdBv}0@dd|w*5m_@ z#&WfqbPg7-9+ZW$_^X#I3O#G`rH;mO{lKJih;Xq6V*p+D{`5yZYw|lCjpe$@q;sfn z-G)jr*RMWsc;2%n|E{C4T#uUe86{i|xDxTk{a-)RvnGGa(O51{n+$xkiA6cuSg%nN z){gP4$)`FR%Oz_8=nfMup1nK*(3C}E_wlUB{{#%fVXozunsg2aHWoclVsUch>?c0) ztjVu-G&V0DXJTN>#iFm{j;(q3$@kQI*5sEs8glv1Ub0-CwJUB=QWE>^R)r?Ob);~y zb_}Q7UGY=3CMTD*Koyz*7h5g{Zx9+1&prKFwI&y?$%+-40M}8%b-dxaCi3K2YE3R& zTtg9rCcwpqhgkGDiN$tW#Y4YvTd>H>J{skEno}AA z+aZ|OagJ+?k4Cxn;RKJsHV<+g@3=6t_IKJVkbBB0|%-D?~HG zv?_U(=9~cL(^@A7ZIPMUiGjMeUtT5lI*eh^yiVhkZGvJphe~*HsO5hY!t{hN=|Jwx zVoRu<=~~kU&3(N76QqK4*lB}e&I+acY^X1|UfQ5sZaM*4G1rIE*=^PWaw?6ruJACY zhWfNWRKjtA9whJR5Em2;7c{RALbaF}YSrRUUOPjr8Vlt$H$+nwO8JP8Bph!iV3bo! zXnk_9;EH)D#I-Ag`D3UxP7jr5j%y2>@`)kLvQT**5B1=mLiOVLGaIzbH``nMSInFc zO*YgQeW8}0smzj^f`^65b95-3nW0+T8fu>h0~m~4ns>TT5CLXsbz?SdQT*oXU^{*+ zu>KFTnwtJ2RGvF+BKWVh=m@pOH$z<3BM6xbA~i#Lbf^l{f|RR6?Xxh@8i5H)QYP0E zA!+$@sO9eqmGBX=nxN#p_7?w5O+(W1aA;KC6euB+_(LEs&d*^F3b%!7x+Ij&i=lSL z$CO>r5>5+Yz8Y%PJ3{3V8$Od#L8NwaL)Ai`v6skCYZhj;HfUajfpi%6y-*3)hFXmJ zt__;bd7--hEYyQFp_F~Y%k&Pn6>QLysk7Rk82=YW6*D@J*Tg#PAsCiD1F)!ys>!Bq zO{f=yX_zl**E+MIKHZ*KAbSlFHW*DDi>q3*i|O(pVCtzBt~B@zJ3APLa40tiFs@Cv zwY9X-4?;&IRhc}es=T=&1Iuj9f8GUi&M$Lr3RuQU&uf8@(+qpC8-$w1hIDhLYDpS) z^2TZWv+jh{EKLX4wTK7#%-0tvFK8?Z--@s7`Y^Bd#sDo6{;&M%*J zQPte!`N>Mo4OMlG)%ESp%33{YaN*I}NAJzJkRjpg6Jv&NdDJ4?&ta_BbxQMmYm}XT zzBs#R(<#c-I@?a~4fWMEohTP~cO&Ss)2eEgw6q{bYfO~w#X3xG>^8$5k{Hk1hBR4w zwzajT4Ho)U^=&QivJsF~>w1H_j)lV?aA)Q;O~|z>~7pbQ{{FX~<+-tJ|uZBInObR<+W1Mop#z zzqUrId#p`!wo%+|pekYi9h8QqbW;^X3QjpFg1WLe&mFQ{%xa($4>n-f#l}#x=1>!p zxZBWb1w@B(>Wee8qYo3J4*Asxc)oC5TisT3I_9w2mZqx3**cjv=AK)25k%~&wA^7) z6j%!tk}=GQ)s3V@d=(qEoo@!Jbn=jw>7C35E*=K z7_rKr;V7s=8`h^)@Hjx&64~}@piJ32n=?z&nT8slvxg=OAWPwI4^h-1maQ$Vx~ni~ z(wBIjz9RQdVUauG5XjD#rY=n_wQ1)?BJ3~3G=X2?FpT0N#6No*(xHTSI9h+QzLhxW zAjG7bZmwzTY~^I-&EM!Dyk;7<5W~g#vmK7czqHq?@KF0>S2l@96Q6)A&Nejer5GA5 zLY}UvYHp~VEYodO16{1BXOHYOG1F!5jZB*CR!r#XbQHHBz$`EnR3&;?0 zhHvueL&O=rA>veG*=j7&UNk-<8m;QUWvE5KI(I>wnX&}qRn}_~80I@P;B-@KrgLJ= z#FoWhnN)=E&peu(Ryu`b2=r*8&pSL?-Pfg_Dmo7s>XL769Ws){{d8G06PEx literal 0 HcmV?d00001 diff --git a/curl/lib/libz.a b/curl/lib/libz.a new file mode 100644 index 0000000000000000000000000000000000000000..19c90bed32565fa77d69a320c4d2ba5060e2fc0a GIT binary patch literal 226094 zcmd3P2Ut^0)96X)MM4u58(7eYbSzj2B#>ZY0kJE+N|UNsUNL~gh+^+3_VTKL0wSmc zREj9Qiy}4<3xZ0QJA0BqqJHhU|M%Z}cuvml?CfltnVp%lN44iT1-f|7lQ+;3zYImP z{Iuw=mX^shBV#^_qdbOT_c3hDC=46F5yNzn2k&`MCcJHqV_0~W_`O{T!`L^(Z;mF0 z3GcnG7$&@rcw^YF_ZevVzj2orW7u;I40{FrYe~hhu6G!L*n|-jtT2LV14htS6~7nd zVTAw2eeEtrKzDlO;C* z_waAG#F)Ra|B-vH6(;e|?o~`o;-BA6u0C#oCdLjfm@wt;@8jy=;vcXHU@o2^e(Qt0 z!rg>vUpL<%w_t}LCwBz$@^klb3U+gFcM1wd82-KiPJwR5)22hl$KTJx4Zyxm!7iS^ z<%4|u!%&St7iil#(8g5vb+@Oc#lh?N=( z_&|Vwxd*zrIS4a?C!Z-qG6QYnB?Gy|_^P;jZFFzk!N35RAmfT>PzPMSkS2zf@v1&ytB3{G>1TWknR4}n5h<%n)GI8?Z@_)f#e8{BO0y!d|eClK0l zaJa}Of#-$$L=famMD{$9ym*HY+AlpqAR(Q>4GRdG!jJ|xtpFDv-w>Y-t{Z?Wkf#1q z(I0_0Pye|D-}?kb1N23ALZ{G;f_cTa^1-a=sBoy*p!j%$(~RfEr}+;cd}qhu!s!sp z49?9z27_rnFqeRZvV%+_3ize}2=Uhu{7%au)X&drfWBCN0GVGZvMiwkQ~LXo4VHJD=bI=72}Is|dg$3;-@Z{-8}f!eJwHhn?3WJkSm8-H-@! zb6bzsL7O0mC?5ikU^gEhyZ|L2@9*vo+=oN>Nr1WeyQ5!0MHe48Fy#Uf4Nz&pzD^q< zh4x=~fV|^RFoj$oiyjW}3;}~r2nd3_t5=|#3+O_AhaC{9us|=+>Oeu52nfMzzys9? z4FIJajJh$9z?C5Ypu1pOBKtu|FAV#SeLfT8nL?k>5InC@V=!#vcnnL{!7%xG7OfbAy`v1~;mmPI0ByVZzT<`g2f%bbYaw%2w8wq+Bs?m{9qvzmx~{z}9S_Y$$c$4FpSb0sk5DhcGY zVv3k7M#iRKQ!xUhglQr+0UHN7MN9+J#Q!E?x|jqu78{QZrY2*Om=-37|Bc4vF)2)8 z;7=Mue-j0N(wLs$Zz4S9f$qQh8-gieBup7o!BjCdydS79>d+T?On>0d05il41UZyK zH~JgIFa($=4k|%-hCpqo;7plvl)bFd0l6pR1ABNE|i> z8zuIqi47CXCVx(UvpEGCZ$P<-sW^e+648nS>P83~bXf#m!T=>f9wb(XE2g*x^`#hC zRQdf{@Q>8sU>^o+@V7Bx%lvIom;>iZ%t7Jj1Zr5s(h##h292WMwtIZe{scvX`3){` zQAIZbd`tfgQDiUwWfK%;2k49XyLft#q9BW#3BPQN$c`Ftenm3;%20@mtN~vVh9Us* zeV#v6k1bMTU~d%N{|11+ZGVF$ zqPri?XM;t*8AdojJQ^UfVT$x-5c*roB1OM7Em9`h_CSvWV;e*h0K$bnq43FHN`cpi zJ2-+g@}~qz@RCFvZvl|+xQS*49CcJQkXbC|LH{#f+g3CVfMj-Tt{E3?^ z{1mdg2J9K3MJ8@B2`v?&bu?h(3|d9FnFLv6#0=P7qPEyCrXRBWaFcJq91^#e1a_F1 z{fFC10y9w5XcAa{1D4=`wKiyU@r^Q}>J~gv97AYTqqInDKp5f>E#~v9pzffrJ^+9y zjvy^UNL(lcN>;A{t_?ibf0gp$C|Z5ctm` z8viniAtFNpdi=mCzT^E0LA#L{Y#@}vuY_+aVhH>lPAo716hwj@{4mA8bl`ps-3~f* z;#CD9+&=*EzWoA6uKk|^Fn@sY`#BKn6Y4VhMZvVAw=7rt({;M!1yxm?8@0hz4&2v8DeYOe7kO z5~RffPX@m_Pa^Nj{*;_PQ}{;BQC?{J@eM?M7kz(cZ-Ix7w5|{!Vh{;IgW>)`w87wr zu%_q=|EVSf?*(Adz33MZ3ibX1;s<urCFA=D4m2kZvtdGCX!D)gGD*z56La<7R zh_A|k3G{nINEC&*LZYIu!H$YRg)RLV1S;9xFG760w}S?n04%H^;41?m z2P6I#eH%R8)D&lVBa^{*!miQM;9XDPXMkV`0>>|cOX zaxwJ&ChGl8>;C?J7?f<_x;O?qtCN%}PbK6N@~EU#8v=!p5B-G{aR4SU0FxYmNe#fH z2VgRM7@eIh3)E%8&atAhfcCi-W+fq?0D(y^VG>HAl4OuV z3l#t;8919}lm+1|sM28kDJWd24fE8qfeZ`4P=HF3AGsL`bBV4)e>OUUD(iAV7sX zh(Finpi#yNN2v{?{AXiqkr0fIv|}Z#!vDnxn@2!>Ej_o5E z0>pzbI4v#+4X$x;>-+eG`Z_qdy25K94-D6R69zCbF=aZSPjNN+N8LJO`gDGwmZQ8- zw?@Lyg){U2Ot%_~>sD(RInu2Q1j~Y!>QB0LBETI4IFRID|EX@JEL*nRj?Vt5MUVBF zpvB}oV{&rooH8aSo5jiNA1Vt}DV)c2P7R&Y&ET{)p;oAzRyzBk)@p}!lyz%!CIAG^ z_yA)~gI^M!`p0}f7}0YPoo_S@ao*t%?0-@M;BXaw@g)GwGMd?^F^9DVB>-_9y8e*_ zpgBjERrrjj|2GnVXbAZZrHL5C4_&}B9k@XL{-KlztzHb94*23yG8l;vmlu(V#|(^( z1d<>sEuv|@Z6dTvrkNQ{gDLkzu=K)q^#jGtHFzn6!7B@~%UoI6{8v0UUWbkOH}DYWoBj#! z7i-N4@D~4qhart(G()T}f6RzjYj=>^Ser9oym7Ki40tZR7fK6l} z5krvxkR%S0Y%v0mWDG?TKvFnJs$~p-q+%#i0FuT*(k%)Al8&Ju!ZLIYSPMw9`D)Cb zvYfJvVozDh*NiifW;CR7av7X*I_DW6)5*njuv0o}=p=d`Jt}L{7z*bn)9h=I2A%Vj z$!TN>^dyt;quCnPn9lAZgbbsAsWgGp4=4;yC$2}EC-Dnq1F5mr{pO$05~)w88Vc@l>{0* zI`5ShU5HR$XwA0Kk4|kGZSq)Yba|e z>nILub71WB{>LqEXh3H?+>)3Z{7%4A8ZdomRVA@~kkY|ZI7^DIZ^Xx=P(Y9Ud%|{j z!aOj!8zwWkWGZ*1EQOuZ#^f@TsoW*QspL|oVC89dD6z?XKfyZWTFr!2UFdoTOuhcQ z=%=g^0XCL3Fu2?39i<(`R1U2i*qd~a$1v-nkoIR$Wb=aMa%mr-HLPVABbI}$r3CgB;2P{8EaH$b^LP%4He6`s8;uKNlKcbg-FyUvrvwF+Qz zXnCAcP8OX*ON5nZrN>f~A)UqKtc9ojWfqr)ak>~~4J^3^PA9KP0x=u;5rh3mhFvt1 z%E{6$X2zGVH zV1T%y3;|q)vL+fQho=2{VXXQI3sUOR69i5P03oS(g2`R0OeiMjf^){_?a2J#IX`&H zAlz4+zjT7Uv<$ zte&(Z1#IBvyFiIF)*K_H=Cfas@bxNd03(N9_JLf)?jK3#gvf@CW^vu{X?nwuE9Z3a znk5+Ir-C_Zk$_1VZ=VP}pT~?HwGSFv06q8!-LoZz?I*KXUSqwrkv|veuP75mIm4NM` z23nJRUDh2=D>;u8eGC|CHm#V-UE53AIR-TuRmbFPttLhGLJ5^qOU@>-J5iEc&1IES zI0Y1PHgu)cCRSaA#>u6Sb4k%~v;geAEQVPLDe^MxR zcT_V-^c>JQvZNi4VS?%4P?DlEA;sk6Hvth4B_55_$))u+djXy8TR&pK!aP!)<<=;BZXK1TCfkO@GelfP18&5>rLbLAKuIR=3T3kyO;fbF9Y zaOfQ`5DN{?H)v2JgvjQ}g6AC4+I$tTV6>b97^{SRD}S7!vtW#Pmuy8lLkE5!w?VH# ze-88z(TA}xxm&B7*CJ6B)N~ZBDMXlw_Zw{xq{#g+326FQoLUySfMu2q8a5lBz8cs% zVEUdg*xfLFc4!>1DUzZYcy0dlwXET*8`LhH8zM`J1V8EDqUSw8&ryUP^sqS#D6j}T zM40_kCTtePtRr+9=vdSpq>ZU)(hDe@Rwh?bmdTN)z*a>lp^!T)V@)x%>4wQu&3*>f zAz46+8}%c28-)YwS-=GC_%AsH4TZEr7w;b87H#qFp@~K#MMBG#mjVtl`wCmbWzvp$ zJ^lU7os#^{0~TNeHa5Q(0=8DS1}JB6`$>^1AaD??&?4=K;x`Ma z&5#0(L}9;fSP&~Y!X{Qxlg7!Wup7sMro|vWU_nxrRD~a=s%GP3; zm4&=wnSn@UKnu;YffC*fWuTdr1I@r8oPW@a(GO_A80Z@-Q-Hn^{4kA_>Fmc^472u- z*Es!;i2hI^{a29V4`T*^*gs(uaLxx~bkvFrgh{BSa(L`lV`0yL&O(QI%0@pZBxR~` zEBq=NLpxL>NUA6r2^-@N<}cLPYs4IA&a8U*jRg*)b7`$iLNP9g5G3l-BC%g0oxlOJ zfCjusgV0-p3@LIE0BJ_~NTbVJ#3;%lglf|{C5QmN z@3R|$z)5JEA8Jt~Sj8w}jQ%X9SvDe&#U$_$9+RBivXx(z1+g5Z_i2I<^D1aqz6{G%3rvXjSXQVvw9-!g&LuFvy9hopkq8&!DF9LL( zi4pK55haOuQUWC<@T4S4O5#Z=l$64g(kLm7CuLAl27+X=X!r>*{AOEd3C6+bhc)en zmMj0)TJ}PG0E^Y1k87tLYanlw4+giQJQWrh5=?mlHHIlmz>`FjB;rX4l$5}ek|-&O zC#6tQ3QtO-q%@wCK}i{~!etr2G6{4-UUMsmJ7OASUJkUL*!92DdW+ScL<(8AObPoe zqkJS!^0++7BjJ@p!Yc>D%LCzk!dDJajcAQHorv*zJNx^8@U*}z&$W_WG9Oqe7Bm~$ z9j&!mWD#&a0Krsg8Tkhcp-RL}Hn7)N90L|-kur_k0;Z`F`@IZq$Z)#K8fY8`St|J% zvKbymJVuce3MXthivwmNXPYBE;vuqf#VqGvnrqqX4x2aM0on~Ib- zb_1ykkmA?)K9D*H!{fsu;ls7jIF*Z#f-lm5-caz2hv6xE@xT*rk=E#98Fqz~TW(5?|k!(t2T?mP)RU9G@Q7YV!Xc-1b!KzHK zfpOaeOyOs&sQi#|e6K+mtQs&hnVecCrxKbCe!(;YeU?urS-`f~r5tEakKNQt;dD}X zO_G#;@K+lof|(RvgCq)&4>)0hO+rOd1L<0pS#iiGTxS$B36&^T&S_(C%INHV!=Mo@ zt4U*F!OL)1UJDBe6%+(g`AGa16Tnvzz)N5?D_f#%!2*7iEwxYzev~Z@QOXe7GH0-J z;LgedO+*Sq`baiN6@DdyCV=`5nbkZFHY4{q23L*20XT~F=fIuSiEsj+Q@Cmr94-lP zxU+h3rT2cj(`{`erQ2=fiI4$d!9z`=TGItS+y^xr5|tC&$5 z@CpUZ<`=+Ykp;7f3=R+{d`kO^VDdl_Qh>NfeK4cdC^4$=up>}nY?0q$2mXsKazpGS zAOW+RY9|Q^NtBR+gcM3hLqeJnYbVQy4V0ykQdi5+VphrU+d{Jza?4d7_O zs|R!m-#yAe8eVFEPC@}Y`QZ84G6S_{Aw;-j2HG0S2f&eLR11ajP!Ii5B_T+TQs|n< ze*g|@OEg?32PF~&Jg^6;sYNpP}b|3vt3bNGd2K zS{8H}c6K~q$ZLRzcU~84-;@j#K%$W>t0{yW@K*0E;Ld^V9GNQ05Eg_jvXjAU(gNoy ziv?#KxDjzcjmmk<`%Ii2aR;Yt(Mq|~4O=Hwf?^IkFqP9zCFf8`7PVBa6P?PXFoDiD zCfCbx5f}9KXW&$4J&Q_43moDX9GqS zm9w>%#i@b@s=)0Eg=wR~SR0gCa@o*C7K7KI#gZ##ak>SOWKvow%S=)&M4APy1^eJF z9Rs4jv{c<32|zGng!E`Q5%)N#Ps8h@-Ud&_>m!f;xB657(m7k3PzRZukm?piltU>r zbXXZMW2=}FTNA-p5*ZH|L5sLl!=^>tr8An4m9t_YmpY>rWm{3!3}rh}wi9Iy7jh+M zz&gx888Wi1Xt7qEl!#8mgs7pw8x;7L4Iqv@mco9FbK+y16CV#}85Os)NSVbH-UkVq zTpN|UwU^G_+C+vI)uuA-%z9(@f!yS+vl~&v$vK@q0|31mMGK>xBqW_lzkc+a!8mF2<&f;1Dv%jH{tRB<3R*pcW3Dn65?j9r|99AZ~M*__Q zMBC4hb{qy6V7F2^EOp=p2&S!tGdtx#%P7D9@KMw-M8YQ!IXpq`0kTXGM{?jLL8`i< zuz=28=*h_@r713<#4i8oZq@~TY$I88QTlT!W-mjFfeTtKVa865$ z8fzhx_rTlfxTtG_OV=U`K4*&rI~(LYubn~4%!79oawUiZD4Ze&I~U?GX^274nui7> zegGeiT*bN1m-wx3NIOxOm^yoFCW-BaQn3s|?2>+J?2;aK7er<(O4(gR8p)z$5m!;2 z&H>rZ=QS&HSfK4##c&#g0ek|<%YYRqM~hXQPcy3tw15x^aBvT56_%V7sRWd1+IbK@ zgV#N2b1XPDIG@6jN4Fz>PpjfQL2S755NHMb9VU8VF(5E$xkmXQGKd^RLK0h~`*~(1 zVJ7f?Q5LAeXq&7_X_6MeeVsudm}z;mSak)OSpkWS-i1&=S8#H1t_RuJT5SmuH>X!9 ze|WA>C}w!>r!a>LT^5k0xC7;(K$xBLlay8_VV_9hyx`=T6$H%|3Z96pq3Orv4aGdy z;_?QZQQbTg_H6FjH%Q_2aH?B?b!pX{98f1_IV6jmKgDK#cj@4ps)0|telHb2=>7+f zP#l4OY+ls3gmwDGu163!S|V~T0hs<590d9I51?7%*h0T>yC8S(7Q<%HFBJN7gMOi& z01sJ<5(H#mqRU=&G}w>)K4O>&A1LA%3eHyu{6e9rS@!lzz@T3^Tu@6I`}MFJ-!DYQ zC%P`o@o7L1{w4HRWFaf=2_eXzJfYu@@rW)a--lTSHN}td@STi5t((9j5ic6>Q$+X# z{E=xh1fGbf4<)c=XGa&8w0pp?k$bpv>+hCAj4@ek-^-wGb9rK!HO%&rGWJQ4Uc<@GoLOR6z zku3v{Y?@X9WqUV)6lKn@XGbtBAf=WL)F7f7?5v-Esxm}Sg(zMHB5$Zl-=C_~!W5tw znuK^2Nq&{yKUKLTs3Iv|MT%dg=l3ch8&L~V;^@+R^zJ{PGZ4D8I68#$&=|n7`gNv4 zG~rEHC#oW22rpQ2WCv!eMVh}R^t(?B`4P=QvT8LPORlaB({{duIw zV%#cVfl&-ca$+U-!~LilR6kgS@S>@o9*g_RMx{pZR(@?0i&JBi1v@D0cC=y^mjI6j zsu2&~iSVqr6QW6}eN>b4_Yni*CQ*|TC8D7hv>(mnyderf@tTJN!XEf&9L@uI$x@A) zNU5;pnC>B^7E(=a??E*=JYKU>#4A({Kt_1ACa88hnqQ5gOf|}3p~Edkr7Z4B*wDME zMm40=94dDX^dOtcRfI<_)g&_-kt3x(rkd;)BzZW>BS8_Tn%AT>k>5}z-ak(9AY?Zm z0>}6HI3|1)UJLXkGamJY_W_c-597(^;U<~*xM1^aK&P$1!yu(*!Dyq=XAn$I(*Ohp zfh zFoGb$0N@ig6cUDAhEJFe0m3*05#~dn77js#`4AwCLl9vEL4*OoCk%&mUZF*R=pKXj z339C#CXqMz*(S*LSeTr|OTj=XhK~*a1l9(=!lXkY&aWMeI-ED(+(PSr*&| zS!=H34u%n^qtrZv^gmc?X`;A;VPYvuHv*r82Qz}2gL7^>006DQG~un$ji3w;zWtAt znMm$pn5*l7*4 z%p^bi-)kJy?_@Za0w-cF0&@vAJLF6adTRn@ttO)0k?t1VW6yJO-6qX>?q7w zJl2UA6LxN>O$dh2n*b_0K6wA6s75i&hbOpOvcUH-kYuV6#9`nW66p{UD()yjuM!`M zABm*E?4jtsB-RgGI{#g40jO_2Odm{HeyV#Qr40KC9|qO1!-g_pQ=ODP-(4biY{Wxf znZ4h<1EyVYX+C$zHQqR;PU-xe=bOefS2V=blpfJ#rpn#hlC(`m@6P*uqaVb%DyNNZ z(@ONFZ%A){LAf8fwY*ldNcnbKd;G&&%Z?qo zTSU5W?@s(3;$+zvDTm}5#m5tx6_R#t@i$Omdak%O+KD$;&pkDc@;p>}LmeSgtMup; z<%%zysH6>JQ&Ocbym@fir2J0P*?gIerd=3m&tf6y0CJs#btNB}o)X&)C61RS1)Et{e7G4_dTOXnog`c1d624t%j?M5t_SCN`wqFh$~#=4Na@X~ez^ma zZea3B@iJSf2S}}@=VW(!wh_ks%$D|AyWF|siHF1XM=7TXH|Hu za-mJVhyTm;uC6cl_gLOf8&>6G~k zrYF;Db%#_lN6O#)VIwi!F`4zGmv^8!uKT zX1kuyX><8_@|<^w`~hF$6=}JX^QSAdM0v;rsx8N)cGx^Pq#k~!@rG{F=9wem0PCL8 z{X_0oyiNP^e2ezWI)(DmvS^FO@~@q@>OK9~wPT-Z+>cnTlm6pXSfYQJb=vTEt7KyW zyh;59v!&hFC=gWotF9gEAr9U*eHMIbLo((rEJNC*|#LjoOC=cb!a#i zv#h-sbzy$Xvw3$l$|!&FK?gQ-5(JYen)Lah2c4Ff0$9x zVy*19s~(F}rM@)C8(a=txc#TZ`)}#{&aF1m9=jp**6J79=I#^ROUH3PJI5znX{}Wv z>^Qi`O1W73*%==Nj`8I4FL*=O9kW~VRps@kx@8-#1m7b(Fz!Ckb1HDWb=tHfiQ&!` z^BN}>hqJCbKKA&~wjNCOi zbI#w5w#_X88dl*F+uY{vn^lma9o^7&D|^ue^Zt~^(hN;+XBk7iR?E{-JBEyflXZzU zXTBdFVw^N>6>oRZXuCYeL$8BvN;eq3jl_=a%h_K)Z^1Yxb;ZPq8LKUaQ%04n`Fzl+ z;bB?(`SqJ4KD5kHyFtBuPSvm7Xc_N(_WIec7aJU0-*Djm)W9m0Tq1Az_PD4{SuL~D zMaf&Y4yTy!bSRUYT;+0y827dJ`b>7R-d`#|c621zTuwAml6jwH(s#x-%yx3)la2lX zd#lU{I_I_>a8~>={)J9b(s9l^i%UTX#jl@}9UXr7wT)c)c)NW~gsMuY+}Z1E78*9U zkH{&PTel?cV&$u;yY~foj{hdzTX5^(9kybv~xJ;UU9`9meg1IuiRM!x&;c1>`yjl9&zd8{K2`yNetov|b3l6r;J z@z49qUr;n%o!77Zq4V&2q$f35V`|H+i*dZIrsaN9a+?qO+Fzgj_N|J_*)aS23>nK# zr9(2yqbFu;<)!tP9;RkbE~$*(xzc^s^)cVJ5mTcLcYIY3*4uPGPiEfq-Iu){CE4mP z|K4};J)`PX$dHX`lIIm$4>z3KsI!JM|MqYlPwR=#4Jw?1F1gjOZ0I=lgC12CN*Z>c zX6Ge?_N-~^*Bp7g>|*g!Rk;;!Zj2ur`eFATsU0`-k37aGlftJ+r_765VkPmHM!9uy zylYQ)&5sB68zR3}OxH*Wzkg9~ahEBp|3+?rRI|P5Rj0Qx+jYVU4FaUyR?j%7{q4bo zQ!hGGYc|}Zz2P=hotfb1F-mFD_Z10ycWP+o4Yl24e&O?ZnHg6V7C$`lb=b19b*JC? z2UiE{)|p7oJr#U-lX0)kqv091Bho%vXR@wUbT*E6qvpAGU>=203*U2x$)VrUXbNt); z1IE!;)I!uhW%iw4a`^7_p=O^RP0qQx+{b6!`(i7%kb})=|G%QZS!g><^;FNO6J>8F z+rMIte||G#74rYPTwh}?QdL*zWkNu{^m#5#^RYz zO6roLrsPgp#x6WJeCj%1k0|>$8JDRH@cQv zU3>bn=AQ3bUqzhV;mjf&e_|C=Zn#QK=Gc*}?xXb0Pk*PDsxNW9vZ`MAE zkUidGKd;SE_fT6F7C5tiOHZhzqvM6^>zi9{IZUe2TzcckEBZ7l-7-`D$=ui=46p8h49_MLy{+}o14!mlEuM9aMTp+a*Ri>6vsc{t;tL-mE$eIFEihM(_v z&kkGnQQquI_Lvw96hKdf;!xWcQLC9B7I?jVl|5-p-^y=kKZ@^;JM?HDH=g-2U`Lf= z4QHK2?!CAGztj=)4qe^xX-AaDBX*TIvMn3>XGh*Dy~!Dw(U)G z9B=C=Xn{c{&6Ww`_7u@ch`TfGMU)&x^I|8Q}D|4Z(nvP_q#tl zVDjksteMRHya`nlPlI)&(2;R-Un-9XnxMGjOstH;=i#nn9wqr7;o1Z#u6VsMN~4dt zV8T-CZ10<^SEfrZF780`-`E!u8`bBS<$*P^7W5^qzJkrHe1;XDnA*2O<8ZfATChy> zEHxQI*w=1OcfCx>$NAkWomO-wO}#5)mf+i-oU&JG*32fQ(h&LfRh>FY#Lo}gce$Kv zch;vUeK^-6S4JH1ZS~%5-)?1}l$*UM@tey^Te+6tPLsGByLd2xtlh|HJweY;}b56$(~JY{3`{?VHAnyiu>%?l^B z-|MOTP`fCl{#idJ==0-8`_vZF?|s%-=b#o}Hd8G$zV`D^HOJ=MmyH}S`uSxpTuavgosb7Qnt&%&<1 znro&gk(CtTnzgbpdTt5jY8GcXeJ-KaU~cn~r&&&#nx-F=I`f^`r}K9`+iFU*T#~=a z{+4NJb-C%RL(}tNU9KlWTyu0QcQ`Qqha`lsc-mko>D zU)G-=pdUtEQ)Xa$U;om}8vRB4XP4!Uy&02rofSgYni6uxH!o&#!<&$RAJQ?Mo1J2m zr?W$jW|##gXx8l|AIaRyt6dk!SRS}ng%THdtgs_+L&VU%U5eS81BYuxcOSBjR;|9U z`M5nNI@@ynW}9bw{kFGqlCNAmF?Rq=UIg9@~??9d+Rxq9bvZ>wf6Y9#!i3cLYYFSh7;7rmxh3qO?_4AOsA0|L z7-E9E)SZhC=U1(+BF|kt-}U9iwC48JU;0%pdIW}E+&ll^YMEpt|6_->ZvSiYzFNom zPOBa)v-3McIrlkhTlVdjUdE=|u3voaba&YrLevcDG5d3)c|G5gUwo7@zF+3*negyn z)4erwoX;*OY|IY6ey84L?M$M)zvAf8r+051_p{P@n$ohIugC8{f9E|fvqr)7+_RoH zTQ21nyCj+|me{*Oe$>&+yTa2qK6JYgLzUXsJVrBmMEs*Kx>svE>!#ezy&G_$*rrud z{l)N+68c9s&smi1s{6nq!y-2Hy#3Z654}hIUAOh))ZDk!i`8wnb?!W^*m9|MV(-RV z!}2`Nzo*Nbh*llGJ9K|Ky)pcvgKGC<$DlJcVQekwF-htpP1kznu3fw^C3w5t zRhNLWf;B3fiUqIa@9y*NxJx$sLA+OdS zjdD`B^k%ktqI!nxSs^O;Fum|lzLu=@3B+rBtl_8R*#Z`rn}D#{+I&?wDMUi&}z z%3bHq(73xfEx(Mxu6&p-k=j$e^2*1_HAPQ5j}+I+4oiIN#k$#c>}kM>YhC`kS8pQS znl)bee8IUS$8`&Cgxz@Zj9#>_#9_XQ()1w{RkZsqY#4L0-%rlxufTl|zxzg;h73u! zH&DHC;pWraBPU9WJw_&fk)~Yl{J~S4<4ji5-G3!Wy}jK>LL%svw~_VVTY0&K7H3YC z*)JaL-Hcrd`Pn*YC~x0Z`AVn0iU)T21((k;t{%x&OWAIGK%IJVvx42Sp7lO65`s79 zYF|_RKJ>Pf)S>cOu0>Du4lb%nne!;`Y$5IPsq16YcC9__`P%y_chN2HRxk5w8f&$ zwC<2ZmAcqs{kv5~W;Vj=YkcRT&=olnEw#g`!BwM(JAn6;7=<{Xsju^Z1m z*f#FoVCZWd!gre6B_=c?5|bEGD3yD*{C@UDq$Vy&Xr zhesoid20q)hKwz(-P&gBNC#X%u=aY z_t}Yg=1|1sX_T+`0?S_QdoQz3a>SMmj=L`tzQ5%rT?ugD&Dk?Sd&S7sB~QDu+ei3l zuy^nGb!n1GSKI1${G4{r!m`^^(@cuvURlzrg6zC3E{*Tae4cZZEPHE+xvs>LivFO7 zx{(LY++X~9+J!U8orb~LzRyVG5;nfp*<&-P`~XNT?xozc>D*lwHNyT`+nmL1E>*ix#e&aIG$O z>Ad6{Z=5HEAMB_h1Rr2lNJ=lCX#XVp>%?_)c0HPPWnIe6tgTY*_E$pOuazDm&Xaz7 zWYfX#86VA~^i^lO+3fr>^yTNm3+&CqD>R~9rUfde(cZsNDDv3w@`ptp+xewncrWQj?Bu^@7u@w9=HNGWN5atlcc#3(L2Dc58{|!2bay)I=8JR3UM{%f zwI^Ed-cPl%$78~*RQ(zaj9%Qo`}T$|HGbiu5}SFohpY8}NGPsz=?l9r<9Y7ce!})` z&kinCTJ3G{d47LS{MFIgySU*MkEx#KH$AFH&AN4& z^DvM8Y00RW8*M&%rM#RuLQC7Si+cMAr=S)AOBmY`-53^g#22T zeR$r4(1L?WXYUdg)vR)>9Wtf$)ahBzWf#~mei&ZWb9qyHM?Tm4&1p5w4NjijL%(J2 z+K%KuZ&-X$37JJ5F|Uk!*6w(WH&xO)D7>mL!NOKmSL z{NGYyL+kcS-!D|mUqJ0%#I|$Ye%v=r!8V-yuz8qct~T~lcIG@ib}RW7bK%UjpoEwEmdUBjGT7=`QBcloBMHrTlzn@sIoR$r)8JhU!utm0eC zgAd#4SO0bT;EJ>u`6D+{Yeu;zSeI4%F3?mCuc(ltO0VPD9o-i`uVjBRdC}Ty!%kMZ zV8ju=!;ZeWfJy6S&Z{^ROkUt$L?!yj*quB##&^-=%J7o+o~iZvXA&%5rJs)T-Vmd7 zq2R6cMPgfx*T_Qo#H@C3r9DuMQOvA8y+0@?fzqjv`f^4}c-habzAPhGyZF0*Q?Za?WJc)Ac~$9; zF-c>kVaNMUOs1&X&3{>MLr`3{Lu3Cjv(0tKzxvSZn`{ri(4xtz#B(I8m&G3+w&)Dw z6`5aQXX%T3bxfcQ&OMy?vW+5T4!na#neo`C!sQbeBo7F?;>Z~H*E9fN!(jL=~SyX zi?a8$mkc@blo;($dy?@ct-@yNnFUeP;*Tozain>cGD8_~BjHU-rzWSjr!?N#^vRi|2NG!p0gh>UUYF0@x|kI2 zsJDspvoZTk+AH~XvcB5W?hAFbuHJ4Mp69L;e)!y;Kk@yR$r+P#X>GbBTc0-?J`em~ zY}P)b+g_#f`VFJGyY{%V@l(m`oHMK&l(aIZ6&&nCTzvdQecSyX-_aDu_iuiAd4>dz8m8x<0+SQxIFr;r@`yh>_ zIQPJ?{*0g6H_U2n4_DN><}Uv^&$Q%#teaihuF~i9O!hjTcLCLeV(nEEtxS9t1UP^8 zpR&)BI4bLdPJEbK&1IeUeQgy^aStP3-%iUU-H!Ma8&@|*q3_coPK|%3w9d*akwl4A zME_|D+ZVi@QtMZ?d4&xp=EbB3HESg1`jz!6%wJNyq_7GE(0-r#h4g*nzRgbAD08oR z;j;O?g|8ANx)Y5jow2-ab69n{-){Hn!*^$_N^W@g{AJ~#bv;YRl}I`V*=fz(Ucpi- zS?;y9Im2tg9W$27f(KfYH0MfQxSrf|px5waJ}EW1f1T-JgTMT4jnMyi#IoMIJ7jm$ zi;meI+C1;KQYVhNcwWzY#eC5^gxQp^*E88xPAXD@t1W$7@`d5s=x%Qf?8qAH9k&YX zZ`b!qPVc(dk$5ofqH&_C%DqJs%;&G)b}L<)-Z*>Q?AoevL%8Q z|MmE9PHqdc4c~j4@ANzrTKOSq>O`OCn!%qtS3cqW@IP)@I?e0R1Bsc|CnEOdxu(6a zG5@4js8_dTq1RiRcvL5})ZcA?Lr<9Eteg7@}^zjE7 zBRV)APLz%9ync^-#o$=bsw>}U3cAI)ndc3@e$r96Hs*}`sYT-~K8HQCsMcY+@2DtH zxE)D1m~N6=jDZ4JwJ+zGPZs4~=BtrMcO@RnEVdk5@=o>Cch?K5^0wdN^kro&2?02@~40ZO_JklhC@mb9Uj~B=3dsEywcO>+@`?9R7MV z*-PJA(WIW|B(>X;b|5}P_d-zzsejG}=X~FGs|B@N(zkMdo|?3AW2*|eyWCktqkO6P z!B(YPs;6c)#--o2A8WN+@|1IB$4FAc#bdgLJ9CtzD=AafOw6_R4yL&@O#wcy7^@@KTUBqNUdqB-(C~()@O>!uvPQVV1z=$wi!dS4btA()0R~x^G-jO9CyI!1eYgKMd>s%>t9 zl$@zi$NWz@Qyz@5tL7*)7L|4e&VA!AK~6t;pl&Z`Tw!^5^1Q}#=C7R>7pp9#IZ2aJ zzkV}I-BDOUQ=RvE@j3FHb0&3r!gpchmwjz{f^ns6k82D71^@t{c7FgKAiouX@v3EMOj(d zMJ9_4yL4VnI$N=!;-CjXC*k0}@*@#iIfa3VM%~veK8CL-9m8a~$PK&S-lKhgd(Kmq zvQf{91f4V2jLHuO=E!M8*!5@~Z2Y*{BXA6>RYG1_;y|a4#<(wA-zJYk<=7t#j#dxKgm`Rj~}I|n6{reGybxj zVM+Y1Y{fB~Y=2JndEFdzI%p(KPogQ{#Q{yLC*y{Uo|)XQ`^tRWHPzzcQ!-AukH3AL z*7|M7kWn(K{ZmxWHEnohqG>&omz(=!$+WL88pd7K3n)H$m++9s*f+gnjh6P`HxtW_ zhgv9UMwRwXjdN)Ub7>zzaoMhYJx;moL{!4VtWcxrKW^r=GQcM`ym#Iq%S<5Ag5H!O154 zG8a4tKNuhjAp8#o(79D~%{2<&KKQ|aAs+}I3;<<3E&jm(ro~5?EN`JZ_`$#kK9K)W zf!L?h=<@&x0y-UzuD-ort|JKl5_CZD*|-pjo-iP|e*bj(4<8KR|F}552Fg!{KM) zzYZ+QCuoF!y8bI)E&uYba-x68a*L2r1f9UY68Poc+qHqRy?|FEz(t?6;CM!cf{*3- zl_$dE6X2-wzk9)X5XbvJ?7a(oRMoXVJ|`IfYZ~V-m2JZZEIU^uWkLc_TFAaX>k&i0D6^2>x;G`^+6o9sI9z| z`G3EApL6D%OoDiS_4fWg|GPgk=j^lg+V8#BUVHDg*B&EhSJ&U zFd&*OjHF_0p=>BS+N-8ysMrM(#dYkd&VrCm<|=Hj%+FJo?i-h(VsjlFJFaRABB>Z# zFU__K4h+hu!O`OitO{<1;1YU*ikRCyWPl}#@&?B-7IYt5Sd8qYsj*E)Zolj(AF~UK4;~&d(T{r z7-s8?$Y>?+hsrKs_F>%ZRYJ0#UkNqsptIp~MC+H`!$|CB_<+(jx6Je>73zZgFrO2{1$F9c+wk9s&$|WiZUCtW zud49~J40+2FO9etiHn%yrk8AwA1!FeLx9!B&eUYh*rmnaJUBX0*c0jv&hf@drAMon zsZTV-SIXza(oB3B;v?{G0Bz-Zzt^CV>QcRE2UG0mG{BM7KH)m3-ozo>U3H_4K4GZK z(}O!=?|^t_Q$W|nD*x>Y)9sEZNf#RcP5by`k7Y;~M+O?nfVmrkBwe<~n`JG}A0|W^ zn=nX1WkdNUq%*>h%@lb`hCGqbzT@rmvV*!Y?aM3W{VceFNcP6A`)A4EQWv))Y1>&~ z8tsh#!}_N^urTK^99eiKa+cLc`4Zeo(B^iDCC_r+3CFb^@dkSX+ydNxvT%e)JVbcI zhS{IuO}vR6`n$j@^~US*WPiB0n6TN6g*!Ez-p8{DJYi&U9H0f3BXqBJ?oJKM>wXR| zP;a1#J3*?{U$)}x%Ah$(d9g^6H^|Uc{U!9+{*p(d?E6@7^$Hw!qu=+|8n+yTo>d%m zhdKn@YEsmi$j@nP5kWK_<7;$6@1543A{O+p;KX^Oic2lD#v^pZf%%rkBl~ggB5_|1 z;ppPVu9i0o5{)=M=W9GlB;W|;FhX}-vHlVPa_ zNFZpJ%~F+H5Xn-xePvjxu!Cd!>SICJ54>eaNM}@$&=GuC<^-2U*vhhiIU9dT8STqd zmUdv4yskK}e%qY+wZ4ull&!5Yi4VG{kw@`=9d+2$DGEB_pCQaAPYudyh ztlp4Rdx!Rg+d>B!sC8T|oTz?Wduj>*2M7h-ZN8tbMl9JD+D1^=nEH5IXd|s9No_Mu z$>Hqt)W>nfLm<9lqc2)ovb#C0-q+f)KPOep<9!+4s5*E^P{k^>ybT)dt8iTae8gTf zR&0ElWrtJL#%or*v7TmV8x&stJhk1degRhuAYsN<;Rqc-&@mO-iW%t=Y8MhW1&o4! zsn80Dg78RoKz`Y;VqMYWSNab znq`@dg-w>(%dp8Z`vf*unPHel!5`@fm2=hQ7FR}8+Qn11orXdmb5<5cB*Z+>HN9-A{95C2>X(x1K$0>`E^IUVcvMzls8*A@FGlECz?@+vN{WXqO_u>9|l=FXN>8rYWkxqO<0A2JhL(6>oqpI{g+2E&-WJ!;t%8bMpKleH$C^yoHZt#< z35p~{J*N6Ompb4wBB*@al};yh<7He}q(C?Fq8qhOlS=e0T)E6Uek#n7_d@v!wcM^s zT`s0tnfd3glxBRY?fNie9MT#OQ5gnxyM$EzxNaP8J{EmLEBRPYG^DlWfZC5+Bb?xGfXIkSY4B*oi`hQh7UJEtvivFntD~4J+)Vwpcr(~xyH)ZL#W>WuK z0+Vk5Z`r&(diT?;ZP^a21&CCC@BCOtf#cGuT}N^CHm*N9qUgr1MG+Kx^lf8jd|$ti z*=H5jA!LOY*4?A+O6kUnyFN4y$r{#xiVD_@BcbL!(KmHyutE*%%`eA(pZW<`F;-2( z#taF%tA_rkr%%kqWwE6$^Ol!rqbRTULdG6X8^!HWXrnE%jgCVbZDkvsx&=8e!#{vO z28vbU$Cmx=$KUzYSr^^@@Gn-}_Q5QD*Sgz}Z+fNo-TM0rf4Fk}sjDuTx$o)G)!&+U zyr(*_IeyNdVZ~b>x@p;*mg6Ot=Dh!dXFo{HtzP@`8Dp0IY1;5pUwis5w~o1@&yRjS zCRzW;qu<}~VELuRi9S1ja>}zKFW>*Hn@E$8ebwW?hB#L}ba{PDu%8dW^ zHh&MF?aQX$a{MPrr>SW;Ye?q)3VYR@_gBcVXp%&ecT*^{3q4^4`idIn)XiC7ErILO(-ti36g;bTe&?(6N zc&i+u}ri4*}P(;<2Br9xzV& zN(X!L`!?L(2hOhE0!?&05pQXUCxsK?{I-Q7F|Bxq46)}U0$hV<(B}3nL=oQ5p&oYa z4Y)l7yk%T$fpOAT67$6}P>m3rF2xp4RZIK9r7cmo_fZ+>S3{@?`? z$9{_NhIzx&5O2_Bo9s~Fpw#=jJWv6}?~!}d%(x3C1^ z_u@Z{jn!=^IWu^;C%inkZwKBk3zzj)R!~+pXvnY}h5)J-IlHZKT?YME;=0mL&MGNKKp3dg%4|{!wA2HBz(v+Qi6S zRffMeZfF=$W$3;0s*H)f`-W?t4=cN>j7aYRRW)0~%1$~JSJgagSp!uyxO-Ya3rcn$ zKuo?=4)>Z4Q>M{#KLrQ&@%US!3FOo>H-$^FNZoioWNg)VkpwQQs9j>NSeO<)XCtm% zp~gtHX+LrkZmSF+AYVAXve*|b!fS*tI#P>6nBcc;nISdwm*%}ohR2T;)K|y19MnXS zr-p_}df?3%Q;Zt&#tQoJ0vaB+a8*w9|ypi=?pj4S-3nIqq>8QYJb8O#; zF@8$586FTZuEmAc;bQ904;$CwV(Te^h;b8i>Q5dJHcH#dixD9tJeCH+ZRMgb$(*2- zX?xz)je1;-y|heA<5uLQz!(c;pYh=3h(+7%gI8RwvF9D2^{s{w*nKUy9Z@?vGU)G>A0zOQe%^Rc7r>uA4ouzn(XSbITe+ZPyr{QBb8LsR z?+W}U;P3Y>!;^!A-*-QrlZ5SJWIRvU4#LK*Prt7jotNW?Ezx@eM0x{4q}OVq+oLyy z<9DH1PQVMzG7>h&4d8lyMZ}cVhHf}K9PAYbJTK`qe8DhtfX zf#%(JbvyLBF*$(ym&DCCxB&-kB3Y4`Sf&`0i(_Yo6Kj(2Ds!1WgRKm=wHsQbt#XLy z;LQF<2LMKD7Z1S2?Ml+9oX9&Rw2h>I7KJHEhHKWdn!_z``omJAGQ^Pd-Z{Fl=03pj z;qMJQJkhTA_T%F>_)wpW^zPnxL;;;P*5AVrERrAt39A*mEQmE_j;Iwa4n#C$K(>bs zaS=_#So1K#h#2c1#jC9{f~T)-%|wx!7zPZ_5v}P3{R{d>-UADVF!8RFxzwa2H zl02#?`zisehV2Gn<3`sMVVefqjlxz38zpo6zB^&NS=g4qc8jpdy`=d2#cZ9$)o68t zwD^%Ju_A5Nh?3ZaZF+yv!0-;_!GpF@Jf9+Cb^w20s@uk+B)aiui>GcG2>^K)w^&)I zj3Y|#_=@n9*eMLN`&7}Xgtw_%D81;% zC8H&5>`CMPLDUNGGd-diqtOln`1YaU1+n;*x>fiw+|b3>hMGT(U4v$CHA!6Xf-Z|I ztE{#OJj9dEW>Bgc!NwPhGKKT&fvZbeQbf!mSK1%N&y*3 z6nW0!t}=3 zaFdMMCN8YP2P9)sx%U(uHiVPRC%+h2(aLC06!fC*hIpf3(r2&}D#s$`#hMxEpVz!y zZMp{O<|Q((;Z7RJ5`WaZS8ZZM<_3lm&Ye63Jds}Xk!HX{6?_dawE*sWLqm#Q6hE93 zD+_~(0&2DC?_XuSmOi5lAE}X<vFIf&h`Tk)kK3rS{&QE3 z#l=6jjwRug%%l)VVvC%Lzu%W>pJY>HOFhrAv7RN~0CW@CdM7xxu13-5-I5$Fk>u!3 zTs1fV98Yw1Rs1P2YDRCZ3igcMsDY(PZ;v18v3QJTHnIRT^Ug9r(c1ecTJU4!=VOwn zi%<*aSLJGGRakKSC{hGn{H%K1X=mTTj0RtlB$3Y5jADD3V3U-|?<%Qk(=)&k$yJ*K z$3qILHvN=Pd%$NI*_2dmTF);I_|34`1ODP=|A4_>j`SGJtx>TR36eGV3T$#zl%tsO zc2`3M&N!fMl2NrPzERdqx2j-XGzS+Y8v{E3nhX zk?@}V;X}J4=YNc`ZqI(>Sh(kg+3=%)STdpZpn)67_Iy~9)QzJ>N28CM!tI$d)Id>N z@D;WCD5ql(7JM{fJVEcqvD9x#X>P^ep2~Sn&Dq&hn_fisv)bksX=U3aZ|Jnmp9{Fn zjDC+_Y@7GNf*S;jwKS$$N5GH90f-+>Z{qY$4ZR*e)=Rw?n^K2y5%s;8hwM_DXV6P< z4Ld>XqHxWc$6*P#?6dj9u&Ec|hBw^4_NKq;Dok&q-Qz2V9FGk)1t#y@J`*8OD03Bj znrp@)uV`3{z+RAl80!orDV(r*iHmkV%vBHIh09_@p5sT3t4*)tTUOWIq^Zvfw1aZ2 zyKGD}cT6OjX#WpDv$)ze5hYyEgbo|H!GviSEGKUI%*!!0kh8@Jm^@L15r*AI8gKYK`x+9Kk)a zTxC}kTW?dh{0jh8`1^fSeIomsDYgui<@9`r>|$1sd*kdpBac1%EB1<$4Xp~Sy{lNS$Fjm^gMM+NfL=xn`UF6 ziyu{@eUWap`4Eax4)gZ|-aar7pDP1M>ksg0PS#uY=QpT z&;@gr7it^J0ENAKeF4h>*J~uT__iEe4cR?}S!>T-alx%NL*IgjWA^wylU}}`qgPIAZ+I3JR@1B8~HiNXFQpMd|Kf~ zPdCR!R9wkZ2@K8XO|qSTce{u~skaA&@vXM&ZnUF{ZWRA83WAEn45 zClPEv9fc7p*&9!T7Jqvy4(v&?{7@@8irTakmm`JNeS#B0dqauBWmz;Qf*CwP=9^dR2ZUcZ^=;6KJ|f?K+CElO6)ZAI#EjzWxuE- z)DW%$J*+D$`$xZ5$AY5#^48 zYGrPJL3H$@Wqm_M%lj9`dR3V^CPSFT6vz(NQ`APtcUkB#rmTIdjIDa`fVyT23ZGeF zKA2*2a{qAdSVSO0?<_OuQuoWupp_#(vek*i0D%1H%6#PIF68Bim6z+0l?G(xBTnBq z%PEmrxd9RVwc6Nc<)j8VnT3orfMPZvBa1;ZtIW~J#%L=S6{tJh>5P*9khus2KUCLV z&2?t9D%s4vJ;aju!UQGaXpGK*vHYL2k2K-_Kmg1mkO$+72(X@11(x$m&S(D2PraInIKnEBA6va>_s=@ zH4WkDW(`VqA4+y#sQInv5DraMVrY8TZj#7lL|KNyU5Uc2LE+Y*aO*_jR-$k#t-^hW zL>H;Tn1c0$0iswZ4`Aw|=Q71e;G#}bl_{VenF0b0ZSuPcsQCZ=0(uVF`7ahwah_E& zf>d9F(oBraxoUFXMSVo=%05cjcyMi)&p#0nu(6(*H&9Pp%;b zW;xbbCz8VEOO~BrTP5NyFC6suNz&2R89)?YZatWxt^l=SrG7g;nv|OKaY=3p|dV#h{ zyb{=CDEB+IXJM1!U5_pwM$VN718%Ebogp5fa1^%3(%#Jx9KSry+T;~rTRJS8?< zGp`dd=QUgoYk(7owTK3N5G$S-JVubO+tdUQdE7*P0`=!h&C->f@#HDold3WsxW5!V z6I**=EzbnE6L0I2I{hhuc+FF%5r6nIe4+0Jn6y*UZL5OdoT`-A-vGl7wHKDSJ}15s zBbknc{AIctI}6SJs5m5dRO!7_SGMtlTyCln2_wtri+)Wcr<<~^{dV+x-lN)$nkib^ zd$hcFimvR?l%%HY#8Gx&gn=Pvm7diLZccIG%o-BKaJU%5;Xw?C2Q5b9dNEVOda%8s z8CIqhgq2${7B0qE2=t;w7z;73i@h;>@e+k}9#Sb=t`3`Qxt%1!n$+&*q;@Ix60tF| zRBnvai!%0XjGT$1Le}yqVqh5_#MoL))>_PF!HJe*^+Fq~7L=E%y|ps6AV)2@wm>Zy zA5aT!Dpq^ni2t~N+PkVi?X6%gsGDoJ^@~HTg7AcmEpl@f&F22FxvZedSUEu3m;?&8 z@508%0t>U&h=D=i2W(Yf#<1*s{gjA#9k`3@r-#i7%)~~|4x6|l)3_lIspK5m+D8uM z?TVewiPe2ca?AI%=C$G~=2)yMz66<{iPs39NC6mW)EYLrQ3`0F-S81H4MvEN)TX~- z0Xq`J@bEq?_TsF%_D}eNA8fGp#>K>1dYpH!xqUO-Meyyvh7GiNif)cB3n@vNdy~nZ zJe{!W3=CPBYz-hb8Y+Bpp1GDq2N8@_7I-wkShKqf+^~W@r|S#MZxJKWrzcqau<-zw z@mk)@5su&DR(3eCmRwHQSi27UXZSh{qJ*!9<=6WlGx*wwFN`)hNb&d3l=ATR`?ffZ z>bnR*Hm_egwpPbRbzQE;=U$}Ljjg7Zrw5a0?&!_a&>xBp8X7WD#Z3?nYlR%v23k8H z5wi#TfxQJ%WL_W1fC`WvY^$YC4-?C~-w{^&DU0*LNXw1+saviCvZSQ!A=0+U$xy%& z6%2^uuz?Eb9jc!*Yj!kH5)2LRL`it zBcRQkTU#GMSSL1q6k#6zw(&zAuRzG;Nr)epEC-x(kSz29dx69tp0k84?AW-7CSkK3+Y;FLrTEr4w(mH$ zY&AJE=FVMEGtDmEfwfC&=Ei2$4s5t<-fau!He6{rRL!3gEzR~^hk~BAc+UKp3l?|c zI5*ZXd)mU<`7`ItpOx)gUpr&wwA*6Lonz*}ruZgKno(OfYxWH{-aO@|Tb@99y@f%f zXP(b@3AzGJG5)MA+Xg2KMp*^v>Xrp%734bgfDfxu{+@@Q4q4$dRk;c!KnZy08)tnl zBmDfigM+$fGJMF4B?rg$wc3IZH&HZ^AEh15q|zL5nwXH&p)!lVHxKt)p#-!r~P8-g&E=JM;#nH zuK%zgtgu|A$nv%3?nnP6BmBI{!LfbWU4!Y$Rk#pL$VCh09_wY*m`pQ(NW1Ne3&=De ziSR`kQ|55Uhu8k@6vr2NLz+_@U;QM27pKG55Aj5Fz6D#`Cg(f8E^=_}xIVBTT$s;Q z-o}%enEd#>7ry5B`ozJpeR2Lnb1MG1%0ywu0kR=wrKdW+{$N2*by6s#XaJ>5My^6` zl;-fur~FQJeAy?FRmaz5R;iM#OsA;# zUp~G4G|>-;eYO?y=>lgqK`>1%&rCYqNe^|s(VXt2XMqLj18AxAQ;z^X7zN5Z!hU1GH6*Ol!aa}0^LZbuXf*1D25AOGU{Y=MKnS*1; zwbu#<13lt0`NY3wL1p<_!k3#Up5?^VWQEgL_|mPf2YS6ftFIFm!=fRM%%ZJZ>TE!A zm51?Uzq&V2b;j9_ubZvX5IE2rQD0jVUBscscMkr!%DuG0y#MRnzb8Z*iW$*-9sgW~ zl)(Z3Vg=~C+l3=x|7k%Ag)jCXnz{vhjuYbRM4#)t+IbDNQQ;^aGMsDeC;-dxEv*qF zn1e(}U45;{g9J)+j*GUDkbs?NfF)#Z7G!u9WJ4CDBnxtn2ZCJGEWFE(+m7q;3;?ma zkE_x_rsq9RIE3FT9cZ<1uE~OseYA~qyfzDRYZl}V+Y8>(SMMwwA>n4>p`54H*4NK# zAOj*yXNO!Z3XoBD;rjyumq$@7w+XdTeNIhu&VuhJP8jqcis9H6a%V_L)91&b}8 zE{?=;uA9*i^(~!0Yg)8^+8i)4_Q@410n?};RdAEu*vC`1s_m~%Ff+H!i8gqV#?Gjp zF|Pv*ISPZhsjc^-itw(htzBq`Ib-geS@WG#&a0g{CpOO)TL|?nwbN$L0Pj@4VD4Ps zov}GJcOcyjwe`_y4bgfqQ_{i8QA2b=eJwaCuyJ=dfeBCUuIJZVr+h`7c#bf&b(SDfAw=cO0}$` z&kN?)&6yRepTWlDIg?~1MXFBmw7$^%nNFaxB)!p+@tu|pD(wu0Q`UoRm81chV)2v@ zX_rs?ly%97;u7ha(O~*K21C+t8aEFsA=%G>uXwtfkIlxAkTPF!@`~FU8oF|~;j4f* zsAQP^Dc+Z0kRnyN3~8ew?dG`-_jo}#*Ejx;g~M-Qcn)L42>Yw+xBC=x$CCl#NPxDP zGK7(Y;L1`{)P7iJfUw#w^$9=br$Qjc+)##*wXV%S4zpx)J?GPMr*#eC*lev!H?3h# zOaVxbiKK<(;8kmMxT{UgaB5r`>5f-JIdyG8yO)$xf=J!f1gqa}X?k95{#RJBV$t+t zyrtM+{IFkLeFv5#QffxbQ3@2=L5Qz9daD2)HUg8F6Gw_#xSFxPm>`HkhLnSmV2k># z0KU0U-kLsRIttAdNq4vyTQ1wM4&X$^=T_FSY9sPqZuHTttjk^B^#o(%S4j&A6I-YR zg~r0j>xLci9b7BxA!ZznM>&?O<*nFq@&|~)^#|Sj1w+xz%`7LBMG=;vBUgQ&3zO=G z7UuolWK&D@!u0bpq3Kq`&bxh>LHT|Yuv3Lnk};9r*ANn*i9UVPJM2;p1wU7tmvI@U zrZS2pp(Q=J9)pzIOkVza~ zvKwhb%Cx5#j7UotiBmR_?ThdArM_)@`r_=(T zL{2u|FBF=RHTMez?PR6>K2AX;9wz~0l>NSP*vS0)eJ?t&Hyju_REgIcHi?%#o41KQ z$67bpVo7|}Q*Y*nhLk5)A+aKX`qs!zzsgL#&m;nj-xmOT<0f3_0Psc9Me}L*Th|dH z%@pe`C)zfYZ$f;Xu&jhG8Uo+ z7JI{UITlMf$N#JG*rwF!q#TnWd&pGBzS$lE&tw+dsT~<>Yu2;-Hb_n5~}cam&9w(slbxNML+1 zIUf4KkDkns;}Xl)mm|ma@IcS9TV)eXFM;lwXo~U_L~}esa}!N#Hs+>~C!&U48Y`wq zgGz=E`!aN|beMesLT2`GITmC7r_COgqq<17MtX8BP<;?LXF-^i~)rks2R|Pb0K1RPrfQ^NLW=VQnqF?MXm9I*B62^Xik;f6#iq z08U*~pM0SR3T~>wZ*SnH9Yi!Oe%pU7K%8nwX)Q4YDPNc0%jUO*j4)2raPqNU@Y~yr z7Hmp4wvg4nTJqbrj5dg;VsqV+qc7QR%}(xX(TnC|do6ZA&lN<`qK(blu>q$xQ?)+k zF5M93Vm-d%Ey#y-HG5f(=FVw|fww8xa&YhsB{*7jwM(aPe8s+Q%g@9EhTT=?mo2cwO?jA{3~Hsw4A@IZkvOrH*!ni*{jlvr;!FmuVY0ebce)8QgXE zV0yKtHb4C=4MNuRJM>M=iNv&~P7m%8AuZ|!p){i<)eW;f<2Buw^altR9#Eg$6E=22 zbf_2}jzHWIO6lJXRQ1G}_!qR6w+gCzeinhqUdvw!;Qkja5%LEsA&pmkcu`@xB{5n| zy|6i+qpm%K(xQT_W?sC(46EOK79f;k54_aXPtsj|@*`w^r`ER||kshFZ5!p5Y7 z>XSRr`hFMO)o^Yd>WN!87S+Cl_`6pxtS}=9jmF?+dUHYZiPuf$6 zQddN$U`*|Q<+rgNKH8^(Um$Z3fn*0}Ye9S5FGYImaPDLE4a_iGBPQ;_*VNUYLeNZo z5(l*8#Gl38z8^3#Q9G%bXO(e8ZN3vpXg>pC*I^&0{XzsFI>9Eko{)kAd4CQS?a_j} zQ2~2|jxDsaiamAl6$f+F)tmyOs9x0?kD+h))U~$*fO5MfFC7|zhuVB20PwBG$HJ1{ zQH3+1p^^_YV~cK}!QTwkX-^Ev(-RBQqpuv27Ym|P4r|JBoZv(M{WMwxuMPbX^Mm99{Fh=y@atI9?hy zLI*?2+Yw`)PfI_`X5PMoIW=0^e}gv#Zi;XbP4!`Q%@0r>DAV?TMS4s2iaGWakAeuB z^Xp`ezTz!^>@=IhJKL_o)9h*cD8W^wer`{tzr_5zy}@c8k}GsCH-IHZdcTOJi^bcy za`Vq9L&>SNu)gs3`_4k;OFoYKC2~ssYuMzJd=&_egzbP$!p4Ih%W3*N*yN;pC2Vri zU4U^^!p?_H!fte6w>z+|xk0(a{NK$F+WZ$X0^XC{08464Uw!?_PtODJA+K;2Ai9O!lQCNO*@pq7>vgtkhtP?fd#30ZWWHs=|+AA(zj2Xm5K zCxs6dV|!230ZyCt;+lfm+zuoNeXj5$vScK&GLlXjq0hnzG0=1D(S9qp1VllFrB>5t zK#p;cJ#!d847D*mlg5UHU>(B78lGa6tNxlY3Id+-WFAgUsPPt5tJXM*{Ij}-XIJG) zHWDc~J8Ny@Nhmvdp{nS2>iWMCg{lhrp8eH5ZA~UxZXcW)nb;qL@-Ao6 zQPudF!noD)9hUGtc)&uX5^4V~{qL*pxvd=9Qofsm<9YF8{`&sqi9SMp$T~4vd0C%c zBAT5RpgcFfmnn)Ej2w$tPvrLs8P97y_aJ~#i+fqY?o5^8By;^47{nn1Kc;Yu(We(= z+;KK{d+Oq9V++y#T-|dIq$c4$8SaI>>Hg{KbUC2KTavo5o>d9;D~zY867uxb2Nk8g z7@S3B4?woF=1T!=KMi?BD$4NhC zOgDD4PiF+qJ$F@5D6;3x>Ygn;1;8@6-pJ=UfV@v%3-37)Z%wur1K-#to6G85_}EBg z3hiyMx%!kD`pl>tiOm|>bd51l(de#5_h=6QRrajdIpTyzpZI1LsxOA~qayqFB^4gc z_nwx;3^4@)AOpk%ex7+k_{@Qv5zP9*QdYeH5BFPuNV@NM`*$P7njawgWcF(0v5k`2rR|`CK4u zncbEoU^3qQuw5uzp9P_lDX2o%mg$=To5UjvC|!9pL%ROPah=2~AH&8rsed41-XnUS zie)pPfEt~fgLh>j|7_iOvFD5NG&zM1z4SMo$Q3G7#&VCjKzdBxEx2K!+GXd*}8$B>JRYQD~93O zbHyAi9jt^fu)xq0*Wx5wxKQU2*ftRgio(~nN;E^*D9vu6va6I8V&*H*c%V392&-<2 zRDde%(+$gdr04PnERQ%xEPUd8tnITP;|22k+tqK)V|Q4F2SuP{-LvkbZIUcn-E0(@ zH4SDKWE{uvazRh^o-OesqZXfn`3_VpM0)N>RbpA8tR9DIS*B$u(|m=+rU`A#sR32S zZr}>SxkKV)${h~u;O`-9OycfggkeKerqCpeG<9vz;JA$B{L!!kOKQK-yo8{c{YHym z>u~;Lsoj5kW*IyDj$zv2*#5~q@z2#h{>cIHPtJvZawhz<9rI5CO#ZoNCj<++l0lv( z7~22t*~=|R77eqRtB^4zV83dGY@1K)9(`m!%FsU{Ys`ZTZJ*P zIm@vP%gX0_!v4ftLbhZ?P%2B_pE-7~k_ zW;E1_oljdDt9D7We#W%9Qmjl0F-g!&m!z3BwX2;6NhHW!S(0AfS)k||J`uj$OYKZ- z%y*&5yRoVKVy~e?*sH zzoT(e013%{{&(!>-Uf=t)yX<`R~YsH&hI+T$H+V+Ega$r^JVvQ?VAS!LffR+(Tya; zv?n!AsHxBJkIw$?WVBdou?&k@C$)5`HvJi%%rTM1BkZ~j6<#4I8;+amnzpFTpJ6=V z$*W^{OJ)r`;bQXkQ`(mR20Zgq z_~)E-2v-xd>@NuQ+))kAzvayUrZi*Bi8(n?Hc=gf#-BBy2?X@gHjzFFSiJ>1P20r& zD`2-;uyeFceQg*;i0StNZBxL84YOdEYMTbwunR0$skW)uhMj7`uGBVhIxXU$z&yh% z*EW^eFir>wyH?v2wqcwQ5;k7jG}eYugrBgRv`tfN7{$#AyG`3P-G*(jV7F_VX4|mU z7OY;|w9tmlw_r=PO-pRpO#*gb&T0U(O{;8hg$4eG0I##bms{X(3-CQQn2XtC%=>a4 z6yWdJ;N!3m{38K=*anlL68tj(e$)onMDr!4T(0=&@%GfW23D!@q_Y+B$Q z0=!LvV@rs+TYwk~DkfG-(CY&9ss$QP(0&2hXMsi$^qv46ut1j+^sxXPv_NMQbX0&2 z^SP1S79xqN)g?PVsaAi}sO-~EH)Ft3d>DH3f~pm;(6*5WUYMOT|pi5UTYgLb))y5ijt&}gny_w`7g>u+AHxL zWH8j`w=fNB{~jKY!}u9rd)ql<@`_?O3-y;;v?q1p|5OmJI0judh*qbc0kGoKJ?N~||WIWNm6$Gy&3zG;>( zzH)?}1!)@zxzPT^TS8Fsj**aY&Np$oUQ%a~*9hDNc)A(0PFBxP#4CAuFUq2ym<1YC zI(Vq$Xyj8$fxGQqxo|8bXGydbq9o6>GU{$PuDpA!UkL|fPYA4-R--P+0j;rG0;h4E zaX?%&Ii6`P(l@UFg4i1!Bmy-aAuonT|DLC~fB& zv9&myx=QU==1b$`H8iF^3~zFgS6AN4Xqe5Y#Fcydq2OQDrXZS{EnP9VIgORXtq6m| z1;wFl(QvKlMYZ{RKqaU1Al_od?NbzyvzROuwHmGJlR|@Sol&`5E~jCsrd6y{K_YzR z)lwAvFhs%cE~&%v%H`(z`w&-f{WtM!IFIR{gwVS!K3yufQl4U8Q1uq(&)h&PDyLfg zCOz#`*S?0gvlNJ^Dwk`Ac4E;L3fbbVpIf`}y7_$}(=yt~zX_{`Ql@1BMklc)4~0W# z%i+mh^QBfI3`-j*)PnU+CA~v4c48Flp*1EsI!a-3s7`3rfZCU+lqRR%hR-1>!MLEY zR)~}fX>klZOn4|U8>`j7pp_CYMLX3sH=_zMt{&HLGJVa}{4kR3L-7_IW_T4pPz%oNm&B{xoSOA6`f*;1j+3Jh#WYg z4+b_dP7ve|_x5_M5Zjbhz z?7KrYzTVzsU#5{!^&yOG>3B!n;iM?Maf7G;TU?M zI!FntaA5r%PGTr*5)Y%Wg*VrMbMa*gVs`wy*Z2Qq-cZ<`oan1sRnZ{x#!xsOTNDJP&%`u@zjt&3L}?NIDI%lx~~& z(u1jn0o+@o+EpyK;O3R4ZE70GWCa=yYR0M!3R*lyV?E+y1(9#ZP9i`HP??#7cL1@XZfD~wVY*`e9YbHmj zBHvL{Yj%$)3k&q3g?)8pVWF-pit0t5P^JD~Ir5pO;s%rg`wSSuFkTBQ;ew(meU&MN z?YjiZnMks^!gtxyyjZ?98ny36UdRLK!8SF%0Uzd=iE@dls3mx0aab?H0j?&%IpkL< z+o0MIx8+EFOq_Frs+z@lkQWdiQkTB;kHd8p+YF&xAC-cg8)&Bwo2NnRa-_&o>L?L4 z<*+4Ti*(2kinbv+!nbg`$y25lIm`oT*yG$Wo+#Q7u&!|~B7P@sbwGtPb zj1}9HY%EQ2w1-0>KW5bFDE5wUd<{DHRIx7#jgC>Z={B~el@oPb9buk|iz9-^7TpZt zQL{1{+_`*Q(M|*nK|3oxkrHJ`S7njAvdokTlGzjqs<4j3S;4;n#r;tCG*TA|Bd6Ha zXR`_lZeZ`rA>%Z&C{0z%W(Xde)+xFHa79GTJnVhhT#{p3e` zro%Suaha12wCDJ;^(;6?(TM1z4=y>Ez1S07C{q8A-1#UTZY4py*m5633l_WDu(LICWF9o4RBTBIBs@6&QnZ2l z1T?HQfj1=R2~P*S0M$Fus$vIk_|U=hXB*5+ZZ`w~4X`ZX-Cz!JhU^sm334#Ix6@ASxnnz+&p? z&AB8Fcfq|c*Q=m_Fl@YHJTFF{u-PpSXkdtpqgBqddTKbm?;IzD^I^Lx6P9-uFk-xj zJ7jQ?6|Ro7Lo5I?uiPK`jA^ zhXY{=`NFFHaeT!e;PVXenIK6d^r$&$AC`p&+7}gC7r7YK2kkpuaNI2-eMO{Tbn3D% zfgE4)YedTW@kJ5?)yJAKhn7J68UC4{Y{S_$)nVHH3`qF6!c zX7x5m@t-3+~e+>a#waGrI<86#h`#LBu|SU5YEv34vBo}+V$b*(5}90auS zRsH4gT6sO7eK(~33Lqq};k92A)Nt*<0KOt?FB%|TUn5<1NjNR z?;1Qq!bT3ZQrH;ZXknX%Cli5d`|u=&-?s$MYlZD@Jg*bBZ{Qgbw)^p{7Pg1*93yQ1 zg6H+Z_86WF9U`!JjuW<4Jh>+4_ie{>g0TG#&xyje7tcw;wja;Q!q$%G4Z?O1PZo<` z%m{82wq9T?ZxXiNu-zKwv?K;?Q z6SncN)d<^-u+0><>9Exb8)tSbC0zIl+bm)GCTy%IC|!YVji7G83!5ZvZLrN1FbaT3*lV!O6R@`&Sjw?|?AVStHnNG*FZC`;+nJ8-T*ubmu~8SK z#4B}d+{lu!GRJ0XEdOFbQzZB+GkFME5u&1;XDVVI&6$SOhs$}h;tSx}N7x47$>CoS z`d-;b6jAOZS&FX=&w#M8&2yAfL~FfR*x1gBgl#&W>`RKM+d;y{e#n^tV#^Xmb!K#V zr<~fm&spc38@TY|qRR)Bj;IV@KX%;s3HqdR+)p)Sbf}{0+Up|KV{W?nmZ{Tjymk7F z+iIwHW!|jWb8f%mzk4D-4HZq}$3It*Me6fyIMCzN%tXG{!3kKxsKH#}$x=h|5+?deF6+N1Bf@&f!Et<9v4i(_`FiW#Wg9ahtcM&N z+ZR;{(y-x3VN?SCWQ>0=Bf?4)(_37 zovm?jY+vkGG$c&93R?)xz6DpC8MU)Ew2za*dMg~V9#R0CrAd=fJG;b%C-rj5NWQre33lnDx9>^?D^&4ZxG_^LTlAp;U*ulU?$iZ15iSyT5XkB67oP6 z&cZC5cdhhfe67vGS)YaT+pLgZW&oCvvA5WtcuUBzEJ#jP$Q+7oBYmyT!g)Ol!ol7) z(iewy+epZ-vmmuuxxnhFW27&)%0vl?W#L?v1$jBE46n$-xjzdhFAL{L7S4HDI9$ZD zjZEP?Sr9G=+D77B*3JI5Yv=b_A)lUwlamGcFw58DnSiZ&e=rMT_YFE&Y0knKn*|}W zXdCH^2Lf%=*#fe|5?HcjKHrtdf!qqNTTow9D|F6ItDUzndY9DmJFRZP+?mrBEv%V4 zFE;ninRf~Wv~H)aU0j~(g?d_{I9LXl@ntzJj7_VVT?^&0b+t31F#z3hWJ0o_Spbnr zCr}Hk<9Elb)XkYcW3D?M$HO$~G=rBh3@(*PrsmygGZrlwT2eY~(fs*ye736_cE#Me zi{?$6F>_{p!<<=G!BUOyG^gaHlw|+Rw=9+0>SxTE=>#cKDk7|Lr!N~KN^hD6NhIA1 zs&N9YvC?FxJrhwwGhnY+Ag&_n#HRpdiY4>uE)WULWLkXN$rK-*BnPSQkQ@PVB}aUB@JUaZ>tj}I3_ShJ=%8@l*FZSeJ(p$S6=dOY7QX%@@cIMq=O=+jl$TBdkLv&jP6F>D;N=k6Wy%V& z^HB)*OHKlh%y-2};4!=#PXdqO#X7@t-OvCO-}(5P9q@eIx$R7*A zS^EX>dRg2PCk$l;#buq`QpPiA&nK=wXkC7OSY7=iAcraW^UttgtE-w)&7iX5)qQ*)TxE-PuC^#W=EOpJr5!z<*?wu_#>C zR$0cN(q{zl1avHP5?pSts2jLvtgWI9E{to0FZSJx%ZSu^d5@X1bG2m(@UFz)@4FYz ztAvf2;FQVl`wgC){&jxMJ%m@%;@Yt!P~t1bPEnhmfK6K!EK!>ugUxt3G1)4dqbMAf z2^D=e-2;m#8BVyuZCU^?r1q|2AEZ_iqTl1XHsnJqqYF2icz0jyl#C-TNVc{RQFPa2 z72P7M=st26-OA33u3N`4;p9l>-+)c#pDV$#oOZ${%SpC~8??!`uJ*?FABAH$@mT*= zd>fPUG+wQi7MU&wy$a**LD4*h;se_F4mg=_tH>KQ3g?Kdnlly1?FTfLKZ-0F_3P%0 zJnS?SgrRT-H_+iaxe-RFFr0|LC1MI;nLqvrN)Fzzf*=2mghHia#Y}*3*?oK_XfLd< z0<;A0jT;$X$)`}6W^2oniG?Iux0WO{bsRoTT{{s=4))GWjlU6s+t;M`#h2wn)Q(Fu zy3xMs%^u-BA8PTp45u{m>m--JOlMY>YUsKoqCz28}K8%csrKs`&Bl)y9Wv{96p6`K{PXxcxYsm=s8(T#aX;BWH8_ z!v*4qWfL$wsrkI0y7oDMkgmQ^{8o?}1nr5P#n%qiIEb$*5kh>Q;|}NN)HshuTJe3< zA--b7$DH8O)i?Vk8WjvCM*N$I$oRPBy>9XS{h(gZh_ihg2U`yGitkh7NxuZRRY7=-FGb`!n?b^41(h3vWLQ zD>uYI5(*YyMXb}@MW;4>isdz3CNYeN(K%4zy^%twjgScpD=%wE;KBGl#i+o&c)Je7 z_vIpK5kww#8Xt;ELs7N=8{f)-Q+D3Z8uGzK& zc#9J*XR}(mti7K>;~(;*KFO0Z;gyOivFq<{Vl8*7pSi?=>*!y;*@`GeTcNKJI}juEOH$u)5CP^AOi$ zI(1`SA+Q{R!iM`xxMkX_Zi-%Fimst6Xf+%u8kdP?&px0wZO=znj&FJkoe$K7XRx#D zhD(Uqb@LSJ0Mztjbj)qlmY^@kT`r$>o%mCcKv1qw(cfhMfif1uWJjtqnkKLV*lE63 zREN@v6W8%;NzKg(v(1W`+D6#ZxN;Ul49*dqe-I~DBdZnkyN^P_zct($GCoLEdFoGg zPYvBO#O{fsH|U=GMAzI}6@M--D@2?SkFHj#5n2&z@flCQYkCAr>YxEua#BCMHsN2L z>cJt3Hf`YDQbC=pK}; zml%^cl4ycHB6-!gnIirw0$^I8oyyyyVlC~bGeL<;ocu-LuLCg?_~ks4bu!_9_XOep zJE|Yy_YmQ;{ba%)aB|@{EMwYV$x8ck?KdE75_a_oY*}MGvxp>a*9G0qMI#|8Oigv6 zu;B=L%%=7PT5Wn88#47@RZ8z5pTc_%{2otT;_@rq?}qy+2)>65{zyrZ0qCa50mT$; zu@XnhOsfIzpt94o5yXTu)dd=ckC3rNJG561zJ^Qgw}kTcXseE)Q9;#c(<>}SND;^P zAFNa7CqGsfCZUP|k54r9ZvPlQ^)Urd%T=H@{Q$Un;>LncD&TZ0pZcwI3aCv@(kal< zsW>_hK8ibn%c7G3F6#&$8yyAk*pA@o(E$KY?+9KP#qG^EF7$wPWmhP;GrAN5mnyTB z8yyNQ2;Nf%m5Cu|gE$|ot1$d`in>T|2?bw|y$dg)qStlhwNx&BL$@mrrC+XNsML(- ziGC}h%%NorfVlz^Z}AI&7H|D5_B%-$AarpUWMK6X(2n+NNZ~5-bc{x+E=KT_YIFEN z3i8QGy(WlZ)4L6FBN}PhskiqE4 zuH!i6gemxdx4O$@ODz^!{4=$FUgL^F3M?<0iKxL)E&)s0W>yy(VTkR6ei%J;V-{|G zZkU1rWx6?GL~ue`Ll0wT(Ke%^4C7V$3{E+49WDjg%)1NBaea+Rg^&i@FMQU3-t{O$||e~+pz_%G4h&O@yZKIhO|oBv}U9|De} z1HJu*pts*ZqXMrH&H)FT2&Y#aIaOWzE;0!%csLBW4UJdZ%=Bw}-q8-dj6}a`9MsQ0 zs6zs8&w()LHFL90fsWxEJ=m_U`8NF;A5dF2RDJJD=@vh8BK{ThxywMSg8$i|k??J< zg63-DjfkJuW6=Z1*YNWX^0Nz0eKTAU zmUj?0KGM%`QFa;EEvJ4ol+kl&(F@IrC0gfg&uY;PHRK*JjBs=(I*TR(9p+uK4xIz?xMKg>J{yxkRA_elCC{*SI|~_&7njM)mP;dow7+?6Wt95(N0A4oi`PeDYILPZmuXy^|AYZQCoc3a&(^u zL4S3u0ED1o9?A+a2N3KsojJQLKgXm>=}RjnL^QuczX_|^iB)%RdXU!eCrSfLi=_vP@ep9g#I{PU{f zTLRS>r{AC=p{6rIDL-xP5xtTJ=`m5o=_M=wAd`K1R<7%#B08iy_LqqA5|Bbg+ak*L z)Yl@$A)^&OV_N}C?}#7mp|0MJ=`&7ng-Vi`|HFU2Qn@a_2P_c8-)z{&Hsu)@O1&@T%WE()N7hb`J9Dr+N=G*#bq>B`b|&x6gC{?UP}B5AjeW z!|$UYNIzkF0k$)RZ5D`#bTwg6qGw=Paeyy+s#sl&_7L-EC}_s&=+rHjz@sKS7eJ;4%XN^S>H%#r z-J#U48;*hbA)Ay7ZH+lN#HOGa=FDG&%S>km#3iJG=v@nI9gsW=Ww}V*bPc}ff(3zj zGv?nFkbuB~`T!Nk&6rX}72E1>^e;WRMQLnS`z61XS_&4Cc82@GX-;Mvf z`2QLIyU^|~M{7{=FT|e)3ks+vG&#$b=h)~XUC~4=TOY^P*Rip!O1yw$>+jguE~V?` zj;+|SvE@nE5sq!7V=HrPx?>AFwuoaJ>)0kbHZssMWcS`43J#)9csNFW{5{ntu`Fr$ z&Q)HvY>U71lYh#HQCfu$oPgMK!R{8lz@VeU*ZX+Vzq0Sta7K*sSAfuTb9|9v(17cP zFYflShR&UJ*4Hy)lp!L(bQiwdJ2_IM>=wA4h5rM;`eTpoB7S0T-~)y$eYwhDJXun~ z^p^D*QOkz_q3PkI=VA%4L@n*F+`6txt-N=O@|eiQg|?P9W3 z{kumekIS&bVzZM7L!B z?(agmVnKc8j&T>ff3G-WlG|5f+`2cvP(UdlEXAk1 z{swp#kQl*mEE3@jEwyNy0Q)Y*Ya(z~T6mQyr zNBXqFD;Z|dISIW2uj@ea?jqTPVNa6z9qcKW?_U6Qg}}MY8Z!pjctgBbrTh{BaA?woi%wc+!<0=!;V`h0KVPvhW~deg_VPk*y;1R@@?-ikftyb%FR;6%Y? z1YU`^9gv2d!s&*~$nd646QD;NhO~u^5rB=GtGFL)AoX9KVLB=8ts-AUk`4!or&fp;$O z5+{L2?(JtMfyaEjcoKLVrQbaXJo049b$GZ;XZ1lY?BbKaI}>>2CxOTCrkn&G!;78- z-g&_L#!29v0lY^~0*~$Vx1Hg+_&A`5^Q6D)fG4EUN=JA)Qg`4+BJ|-hok*jtgY$Uc zy>8)NfNw_{4f+}LhEYLBP(jVRmz)P_9j&F^k6T{4 z@kXWiel>m+H@{ZkE|uM>Uh$(J)wdm@<|jQd{xG&~^VGQ5NH@aJJ2rNR)>bBprmC$> z6b-&lP&PbKj;PE@SjAeeGFGwHfw>U> z*>H8Ly?M9VG!;#tJs%Iz20S_&!e&+3(`;ng##N7?kxee96x?W|_0a3_{i7lYKcrdm z3&M>pKDdUBrUJfkyXuID@y&uf+5zj!H&Ck@lVz(Ur~sf;4z4^lwqcnM>L6tMbH$Bn z!Bsh|5!McF+SJObOzd&K7{)SrdTd^}tx~pgmv^rk3vn|+nuGMaCN@_m2Kd7fF4aP@xg?fw4#_?>xu<}A_Df(L$^mrE+l4dR(F7 z9K=~Vc*uIuIb2$Q!dm6^3+tdHnKMtET8)jPjFvfNbfqMoGO}8ve5^L7gpwDjKAk)- zb!wBmw^Wu(Fgoiia;bdh^p-VlWa1wzpR3cD)R9_;l|^nUNk*@q03O#{DbpvIgjx2u zPNShnJM*{#nC@35hpY$<><^)vTvxF4{L;FfPYENYh19H<^Q%*uPsBl}yM4wLnkp6F zhrTztu9vxVWNBTuEPUZavhj~Zy28-lDxtxl6b%k(8mxM_=^mRW9egh+qZgEN7GwSg zf!Nq-fp~FmM85gvzphUhZExMRf17_`1F!jV9w%f}Ob%FAPfHerY)Wg|q&Ab9ri$FW zp~ajb^R2YYoECF|On;^{_vC*f;8Cx8Ne^}o`eq$!UC#&SQ0sHlkUr14bD&fsXLh~y z+q6*{^9vZmv0KSEEq^_hP;{drZ{GUfiLLBt?}`U8nDVe&e5p`68HT*8?o=LcE2!eR zjrt|ZlCKUIpUY5wp=`m{9c8vu=9ObwFMoc70QxySP!+40Y{ssgRux~lj)by9+JNzW zZEV9RlnB>N7^Rh9+*TE@oPqvERs3N&7K?QOR?bgM+#78=#AE3#0maSwttq?w*4us# zD{?}0usrgcD@l&F9q(PWorFCnTP=>njB3yFps|euvSw^jfe^S~dDvq-#D?k@MU<6n zyl)LytyY_qO`}gv-Hc<8=LxsGhqWslzuc%Yc5xauFWTPSyXqnQ$n#wFtzbr9JPhI` zMljl(LqPI4o&g2h1bIgwQDb5;$UFjGV8%AyLmm?^QMINPZkV_tPg222+%2?&Dr>9t zhQxn7sh9ZKan|vN;+N?7$LB>4<$71$0k(=i3?}h|c!|MQU5>m$m=%3fVmi2XbYxKI z+b<|qL~};-VRS@b(q0~)HluqC@A60BGYG4<1hZQ<4vkl%O?hQawYw7UQd3f1E8p); z9)_@*rb_Q1-8_}AoA>=%Ew6D=k(46UPy2KW2!54A(qwn)p9^E=XP69=et@wLiB{p!-3MOx)|WeP;<76~gHB>`QRr$Rj(ieH|i5NRvF)`$fPv8P5HokIhOPx^*Ba#tD8M-P$D z-$4|E(S{;P@ZYJTD(lVYiwHe^;&OM0vrFndwvh2^;(LTgvWxzW&h7H9NElKfiP7ZM zdXvN3q1I1SUfvP+H=?_Wq;ZU*03-{9)>{Qc?NL=>V|OqP7Y4= zrVyp=RmryT#6h%!)il9C>|tq%a%f}u`>eDls%eH*);C}UV&ll2+yfv^T646WvfKc& zcxU{uzL1X(k#&E3f;7dYaF)zO1qiak^MC zU1h!Fw_dBVp0`^4v5AA&pG6vb0QsYaSsXAb2budCJ)FUcg!~*^JJD}7gsqQ*CCaPc zdR>jAd^W9v5||mK`^tmjRnYj?+m)c4jIUOu59V8F%DyH~V#JrW8`&#E)69aL8&R z$n2_g2T@n?f;uh!Qd+z;FS(wiqV?9V!$>XCWT;5*s%NM*&IoTAID zxGQzV2}gVAnE7?8@_z?fm|~2N6Vfu(kjEC|SJDl*p%5&HwtMGSDZJ$>xN+YI65T+M z=mUaO1f85eSRqXTiHfV@@Ur)bOR2jiPl`xUH9{k+tk?b4%Ti^VRH0jM1+8XE)LZ`) z#FHK}h(~P6ySM&vv6Fpu&?j{r#YdrpW4!V%Bw*ixcKY{rKf>&!0=+K?=1+?#l2h+pVKELSn5lH8|Tm+IXE6Y zlrw*jbkX1AhyKdZe(9r}B-`EoGF_A&Z}Dhk)nHl(vo>xA^}=KyrSG?Zs5wgS3{wOy zXX%qyN;K*mV^tUVPL8yBhmchX4_}$dPT({LC&f>Q*D)$jd%Jn-cTgjt#!uYQ=5JJq zJ>SMiZ|!9)c#0uYotxfm?%xp@xI5sUv=Ay3uqG`ujmn`VO_ZwDinUlm97~7+>n#q$ z6@^8d-#gTrA~W76#w}0`5)nBkjFMq>Fpv`>Epx-1VDn2q+Z&EeEYjo8 zKj6%1B)r}GZb*@5?gnt5q&YC~Jvr6!QzKlqx%O3#6a6%7O)MfUCKSusl=N^??+y;Y zjhAD79KiKPe@JO^Op1f04cVEZN*evvNB)7Y3-SDXT)g-$K#1R`yqugjhA@7w!U&dasoipE zy!iKoQe+)AnR3LY6iDk#_JAS`O%AAv7e7tfF3%C)pO7HVFt-HUl|wOZ7MBuk(;PI7 zO#!QNCB)Xdp|mzi*tFgNgSHe9!j>)%fmjhWJ}V+IjKf#N60-XD8ZB+@KzkK!@@to zRT+3{BOo;ZlpHck7B7^XnATemp1M3qp>P=?t0inDQ^dyNAZ*Cms(ZDfV66=Hervbf zH(D-tkf^IWNm;)43u*$^1B-=YR|KQ!8|jy2+i7BvvxMF~BlPYbxIxp} zX-2mS#k*K2-bYd*LiJig#@Bx9t>nGjwc!#{AFjr5XtiqF{4%+5lyy5Oq>kzuH5K|D z6s`pk8P|fsaxKWzxstV9j$CcxGUk1fD4XobaRI55ur*s<3}U>Ki$U#3*H-s}RHf1> z&awimxOCafg;$`at!>hnSx1J++4LeQRTeg|oMv-YpnR>t~d9-geXxrNDd>{t9QCwkC3 z|13poRH{pMD$3O6hi3~|KbN*rV_NrAN+tWPcM_{%J2;2?36tK)mC=LTO!)&}OxWA9 zt#eDPoz@nWpcWFu33}3WVzBi+m8QQDC9|NsU|DPJP8Ff*2;HMiZfQOKlAVk=iQnqb zaVV~d!&z|c?G7P8*7iGjEN zl05jdP6Q#b2Ime$BC!~^&U7BmvdCQeb)I*{12FC8{^wo0n8(#G7P8-g$~eS&^5?7{ z!$Qea^AVa8Q#n~aplEoze0Mm0X-?SK!A!1z)86yPDYVrZ?HfVManRfvt%$|Qy3-We zbZML~ejS2MeqxNCXF`a%LEH4SPqj@suPP%md=rm(g{*BnRbCJ(Z3r!c|C9Nr^h}sz zKEj(WlpIt*@t(#NW>^@<*O*s|^Jttk$H(fs_z~n1d$DT;l;F7mP#sRbBt)S6nmR!3~>OQH) zUE#*V)**&oMVb3?c(;q<4Oy?M&-*@QNRF|13ccs;^LHB)c`TS)c~U))w#eD$zRChm zWH7gBXZA8<<9ysz=w-_0Gh~nR;`;77?Sv^H<=~U3&Lst{>1WtcYX*IwFb3F8jbgf2|3IV;^SCB zFq!tgs#XwAWkiFN7RhY;D$w-u0pDf$K&mxlJfF-B!PCfPk-<)WJ$`GNhx`r5i44=( zJR>`otTS}ZrG((*^t|kxw)9j<)Uz0tq$H<0jq^_uQZMP74-Sht~NjfA>XA=GE+N})Kck1)QoDTPf1%$esI?~eqZ*nD*(;d>}%E%hTlt)VTH>u^JdYRBOgIH*m?X~vvoJgAthCjzqb0FWq zyuwzn{_%>eY+oE=gHZawxhz~41!9*K2TB?P>PY^)lV!cy*kl?90%hC%-b$pY(^2&< zf+}7etK{JXT{Fi>N0C{H)uwu{Qwb%9tv0x(kkP18RsuIp0)=N*6LOhB32|DnMbp%U zq*hUo^QGcwr+FFm^n1w)ds%{$kbFs3t7Q37@+S+c}#La}btE2+2Om9dNKB=#z=n!)Z0Td%9xx?Ue=!H)3=vQP>( zeTPx&Qr5;>SRZ;fYhgU;#-qLLqb5)cO$=VTevYPFRr*-<@vg8)g!GD?4w36Gw@(`P zD-hKoNv`O^~u zHVMZ#+{ya%h0sivM9$cEW=W(y%2YgKj-pzi%#XWwohn&sOnmT(%nZ9IRpjHu)d&zdBisF@)qI~df3&>x2HtH82EBxKP-$rH4|iKtxJ;Cq0qebej27A$#gz? z*jqc(Tz1eyxz}D3wr(r%TN7w9`PQv@RTjHf*0s|l5LPan+p+95#Xw_wD;&#@fo5-V znadWdwgNLq2@!$XP*;Uf{ejejy+S6-WonfS3@KoS#Bnpyt7SKIxmq@{i`6nI8OY&( zd9~~)m8MtTm)$Y7Y&JQEPFi5bE80hKJys@!EKltuU0eJH_s^v2%vM&#r~K zWiOtId|tx;?u%#KZR=w3ET4;F$$p`Ducuk)yGl~b_J^!Zmb8$pPU~jSk7nUw1NA#1 zW#+ynpVXo(kky&k%Im7|)ReuH7NR{!W6?`!iI*uLX(m;6^OjE%K(ZuNw|o`qknAgX z9U5plBvstg-jf?=towSSZFzNb6fN4%&RLc9ZrIutY~16qnwVb2$HE)!V>BDVuvyp5 z8aKkUHgR2UejV?W&F84bzLrW^=yK6Jh3HAH>~-tX26KO-%Lm=Qry=eMTu8z!mVbnD zCMR`~K$Wb`yQK%g$|PRd(}}tzFJvyJqO>!o4^9we(3;>2SuDvzLJubvclIjj>Oiq% z+*EN+B+lq77#e1ewgWO={~#Br!dQZ&%_?{v>!c zw@GZp7PL084N}E67zIE+O7~gK65AtuQ~Udgc6{Q(dlbIpG>BjFWXI3zIEy#fFBale zP8i*i^Qm8PR>hN?rThkbjN`HZxRnriZ#P`J6L*$1b-)PXAr;Jbkyzognt9t6|5SGJ z4BL0mdV}c}t3*CYU}6;~4@d#S~AT@p4%%yEc-EkMHEg2r#X2z;s z=3{v%P~RB&Y0`~}QrpFbfmyPb-N0VPgksZ}GzflMHh2iKad$Vr!C9>ab*O=N{Tj?h z#4#D$E|dYqdr#AaG9kt}ZyRg!3}b9BSZ2^H{lZ_`>d)WG3xF(&>}A!~LujnoPF&Gm zH{m&TZ4@_N0+bxrT}&3MN_Z^s*1>9fk&{C&u2Yr&g)9e_Zf@^45^M4pHV~;I#hbUQ z=RSlh8O=z-J=67IWZg4W3$)GOP(z7j)CW3)R&ummrO5)@pzBs`l1kl5p-V@gxzJcj z_ay=;zq(z8ITbOHY8FJrq0#@E6DNXI+MXyvqj@EA(a)t}o<^cPu9=(_I7^wLnDpVG zJ`B2dE4RO6(s(^!hHp}C$6(T@T~5a|S-E|mxz}oC`T!G*3L&4+(+RHz(;3RG2h(FY za_v!%ZhcRgUd2tDE?^}(CbOR}hDz*D2EuD5Q3q&VH@-y9$$byOy&_+H@u~T${$S7pF@|1X6xq zg}f7!PTxN;Emv-XjzwgpGKoM%?bmah^RUQLOgfZbvrWE2;Z<_*V7fBR#&nx9EypxN znSPsc``G7P%1sV*LOGl=P0T((7b@9YRn}O=8>O;-RI^0=v1i2*s zqlR(u!X6=c)bb}yX8q1Ouiv+=u1A%n1#|JZc-i(ypRgr2+(X`A1IPC`OH_AKP`xqc zvrm;F)uf(u3W;TZ@in52yd5sv6o!=X1Z^;SprCeQFn$~BjcrT?JZ5_XvjKM`On>!2 zpli-@{8xAjJbfy>y*>TecrK_a+gA5!2pU_mEo{8T5?V;)X|x8T?L+4dNPdrt=-8Co zreqa(@}btRk!(RL-U7Gj?VV$K3q~X8r*{Q^1*3gp;;&#dn|Qq|h7wmf=W&3BhLEh} zZQ?&~ZXfe{hJxnR5+DpRpSze(U3{$acNnydSuU2d4GFEhlDgMk9&bPNVc_le6r z7@*!yT%L;|R}9@SbmJ^eUMOCh2iN<(?t#@;ch_-Asnz`^@j7RJ!ZaD(?IvbD)y67R zXmIp4eU>9vs4E9l*P#VC8^W1W?v?8|+hQg|BaQMEtI;O8V|-R+*hXkB#*6M~{*+0- zti{7B@~9iDiL(d!{8R|bL)I&D-YyVZEaD)%_0oU+Wrw`cbr@u$(kyx1EPF==LvO`L zvNtKi>fTUEgPK7987yR2*vCq|^`Br5#n*`Efc0*Bzj6$C_eS?(@Rz*jt?vs7W^E*B z!k3khEHd(mYm#$zP3Cvv`&Sw?|H`gANThGJ6>#j5-y zLDp!Mo|Z~!2(Dx?2q9@TDFoA^<&a|QT0bcqNu1@_Y>;QFxAmmKSyKL;rHW?c>Y?Q4^AK8R{cW1FzH09<;<#xz4cN>I`YNB z5^*p)QWvz3rbccImK|MJqhfZCQ)hCoqPii4_cU^TSUtU*x4CYlUz!8LM%*+om}je% zeFsQc>e20SjB9dJvoms)!UA+&24P(ua`rw{tGVg zMRJqJ;3a5$N#9htEp2ESEn)>po64rC+Tgu7==Sj}rcxk%*xISBNQVn7N4_6nAD-rz ztQ?*;_mvmqL=quu{NR>~a)NfH&OxhU9G`JXhO(li+AU(GHp-!8Sv|0uq__TN<*qNy zK-I)n*2B9(rdobps1L+f>yku_>#7RnIDtc*J9w;ISn%lW)AGE_PsiO{)^-`?EAP4A zAp{S(1B$dNn1BGQ|4nfGl@4&YA6*BB}+|51$OjUHzEzChWQy3d&7M|xMR7U%Xx zT#*Hf=p2d7jt5yk0p|7Ux&U|c_CDvq;4k5L=T;=@tzgxLP1&-y zktXE#`nQI7r#zpL8ZVw&mTpvTnNcCk%^+aPCQ`*W_xv#dYX^dWa9fM4%n{`3K+bb^ z9EYCPad1HTWwZUo75j)|XW4!RnSj^N5swDAs=2&%P87{f6eVUJlGnl<&$JA`+vK2| z*-N!eLG!NoHHnT@6h+(GBR%}F%b5P{K7;_kQtr%L#=JaK+)^Q9G}{3c<)YgchMcQU zl5U95ZkB&1gzYO&Efw(mf(bLOJPx+?$)elk8IJ!@A36WweK>}#%jN*il_yCf_iBo* ziXs|SAJwG&Kh!IgbpP1|a zorCdyH%AJiZSU6p&0A1W?(J=s)5ht7=6G*Gj<;ZJfw$l?pSR%Zq2AsTeBR!n0&j1_ z+xx1aip;}zTa6jFeyXG?OpwhAZ@mkmf?zIl|KH5$`xlRmkMfO;_wuDK09Cb(wd#GY ze^ulB$g$R)KDiMy)_TS#H)6)dAMlkg75f7|xe;ToZ#bFiQ``m{zKU{PYCV3M;6S)< z2H+m@;Yt~90kh z7XqWOzd?SE!8{unf_*)DFW^ofjJ*y2Zp@bfeTe^8#7|?+s|AMf{dwZ=iTOIKB${O4o77GOak{{iB!#=ID~ z2>aiN|2WJy17~4>2K{JY4KNP-*DhWE6R`It|53aCZ^aHTlHWx5lHTdSK70QQgZFZDkKVBsbIr*{1>!hRw4x9s}A3HzDYpF)@R z6bGuXAH=`ZzqFaY=$5v&946&vD2>epFo%P6ay~7z7PMBpDTf5GU|Um_Vf7uvR(hzV?Pc1!{`#X28~a9dX-{_nmtsF`*Z-0Feac3{V%{i68m<${%^oO82e-BQeUfqAoeftFZF+<{=eC-{~6#6 z0{`F81-~BfV^82;!n+12#(uwD{|m8?!v3aR|Ff|V!M*{#7jP#K#(n_*QlCfa|1a3} ze;qg{f&Xjt9AG(6f&BygOMP4o9E<(OcKzRu{e0|ywd?=;*iXmKl0sJh{|El1{*ToE z|6`>3E2O|uK&f@FT(zJyZ&#+eirs;(T@h!0OPQK z^DX_qnee6lrvn4Q{}s9cECWpJ@9|yIa}_WE`;R*G|5m&HXYsv+?|(v<^jbg&`&amv z`aDwq-)h(YOmI#C|M%!pUMqkA_9XtL{-*%PWB-|5|BJ9+h<&GB|2JVj6Z_NXM*(r5 z3i~1aOZ^|I|F_unUk%R5;Qtm~@T0(J>>uG@>i>JdaoB%i*Z&W&Ux58}yZ&#)eg^g@ z(R%_h;1cZn@h|x~QvZL&uK(-7ISu?r&?UZAz!>bG<6p|t>Hoj5>)+}B@7VQ!3pi(k z{~Wp(xC^)xd%LS3*Ki$^YZ!fVd%KRyH41v?=DG&t8lHZ+rtA1zqr4#3?JCMOatdu5yxIkeh@5W%wT;{)>9&b{GHM`sGd+|I-R`J>uV8m|H6T zhxW-mO8ocgpWCSYe@6+D)wk5v&a963ZkRb8u~xondAZQVGjliJGXG{@HLsNMpxxYA zx7_TzX=dbxTV|w$JlqWze%tzLZHq(4h=YnTDiHu=Vy=7;M|bP;HwS zG;LFP%H&U(f+-V&r;P{eV4E1kZPVnG>6(;jTFNvdWx63{nw>JuNtq%k(}I*~Val{L zWvWk^G9|-N%`Uh6rIfb(Ps;p!-wxY@?lv~tw#A?Q?ii0u%9Z-q*3&XSe`LErJ@NI1 zZTtIku_>Q_FROh27|N(#sEG#Xl02Z@?A>6k=(aKk*{4eR7Zeun7cytBl_y69}sx+~+{;7aj1qd{HefhaE`~2zYNVf6m-}*}($A~U(hgdlry;c` zC4R}O4O6ttPx*XH3df0ShaC>&lDOvD-zQ)6W+?r<`Wq=6r*=-X@%k!X>-m>*K6BA8 zzD_@{eo6|*@g;pvR3YFtUguwY4Xk_9==yne`3fah|MHl+_`24%<$M+ImVREnHHG8E zbTLj}InNlZ+u&&l)mPxW^dJ+A#-jxVRzF}UDsD*vJ$KPr6ZF)3fmwIk9~9A8Wy zlq%xiZEPZDN%`)FmwaB7@>Q-dkOZCbH6J`tFyr`=79#4jXGhH+kn*)Ch2z8}n^~fm z!r)7&vZx2|UKThuBbs@UcD`kr=B!dRf{LYPnw{ORex9o0m~a)CqvwSSm)8 z?}Yf-Cn#US%Q)T?j`}VwPn5JrOO;$xjyq6X3@J%bdH-_qbpzABhG|!YlNHxVd~nmwwJN^!rDsk``x>rY6;76~ zla()NA)+?EGw`UB)4qi8pcGD)uR*w`<65(A@6QLNeX&*}O5tSrlK$#8q(_Sq+0Lh= zeVwaa6;75fq37AMoli~sI#2sjI9a|(b*|MDnr+t-a zUkWG7SBdf^{Y8|>b}mW#vZWa-oGf25y15O9hKX$F(=&YOzMycje4U|uNq-UbJhGk7 z$nd2bhr-G7H3Zyj+0H{UeCfuaaI$=zseCzciEQUHGkodBp>VQ%$(WdqOJqBrmElV_ z4uzBDOU6UDA^lF&kXO1tdv=B|-8d9ZmM`I7-G z^ngIqlQ_sh<1Hb&Xo2$p)GVA6@ zw)15(t>I|%BQ($7wmOr@uGb{f`|TQ-`iGWF?_f!&t&$Wk5<*GUT-`F^|6Ou{Cm!DlaR1*i=@gnq&62BE*c5v!#m%fxorqbaJ z&%!JRL0*N)R0=N}%~cM<-Cf{iO5T?+gbUc-0Z+dlZV!xtbR@-wV(QFJ`W0wlt{j1R z!PuYIVf9|w;4KLh06sa8Q7BKwS=-bp4o++K;8;X*tUuO2xj>)e*qJ^I$*a7huC8hK zFDk&a@amkj(UUfIQ${((DGw>V6eNlP9Fe`6aFNeo`wz7@hs)lm`^@{~l(UFyqj1hO zT%=y{q8Or!hPWaf>lQxo^fz2m2;cAnUu$>?_nX)H?*ows_15EOKY{!Z%S8PMDaiFsMMrnr0 z6R`Cc8*5LlWC1pjuhaoXlB_#?xnuYRiC;(>TZ-7J)GlR^(UgjZBgNv_>lRC6Y+Rgt;2~cRcmpc*&pZG zIOlm+SsJsd2&Y*%6?j+8)0pePtU4AiF8hX(&e5C}utM*Yc@@0_Y3buFEE?hyqPrjUrVUP2b z+VHMwvi%HpT$w(5SN%cz*(-id$4?$tXYw2jpJ3c!`y0a7)y|i4`7(zu-0rG~7vH$- zkc-@SS4|P8A2+Yq%yGIG0(pP;*C)Lzf;a|@{apY1BQ4Nx)jb|CzD8g41d*)^81Kqm z?e$#Y=a}Ut%vDd}-eww&HCEsmoZqmWH{!fYJ2&9`knP-r^L^Txhx7t_Z08qo-m9Gv z1s33fg$jEM&a1WaOA^=1(orvvH&&x~4aZhIMCFON3OSH4I(h)Fb$DGb>C5jL}RPr%qEb%uniF{_8H8NJ%S#;6%%U9%>K6SQ@E;+M9Y zx(Hf1Lf&X@-{W6#pza_3xY-^UNR4iypg3>1LDJ_(Zc=-*b)cp_TvbpvplrXl{%f35 zDHVY%5VZz*W*{mq*$DxkIfl&Zy$3(bwFcp>q9!0)I)v;$9-q=y|j3KWg_R zyZg_W$?@ZNZ9iPb*<95p6#XiedzImjPpCxo8UdJ@t9=5^SFM)*dyy1 z9@k@-q`$G2ZFAqg(zAx2RqB&DK<%vSZ$KQn zFVg!KW3;1MtENq%uD4x;fpHtc@rqh}+PEd@eT$p5qu$$4W=W4IVS>`WzI^TIzUh4n z;jKg|9A#Rm{#idmcN^ulZR)mv3{CG_#4~Y}`6Sy#n6b34_TD#sKfP~Jl8KYGMj#BG z+c??&e&YK(pGq^#SJ|$T((F3bY45y7(B-_{o=e$*xnuycC)k}^((IWFm^16yc;~M( zGQQe9c&bbvRp0G6XHgBO+AceG3A|9{HdFl*+;!9AkABCFrJ^xSY*dd)~uHVSao(#0;y zS1^9s*&{}3i~TQs;#XaS*Kv+E9lYMUtEK(-C~%#f{U}cQTc*jGqj5-eR?}m*o%eGj zQl$@(TH81YJ2@~5!q2C0EOY~R{kX;kkAdjkzQ}N&77GOjZbxvKXDn=8p=tZ&>K8Kg z-~qqK;pNGkY_}Rh#nEXB8Gm=$zj#7{kChp$2(pkwWj2w+08k7L46C zjghl>z63rY94{>3EWHShMkMx&a#5r+ZPlwxQ*W3)_lC|NZ>^hEeIqZK&7D~rnab;e z^7`kQGZ$3PuA4FQO#5Zg^Rqr@wl1lR>|U&^=YNtiJ9JM|W@%HRmWH}BpK=<5LtoN6 z%1&R;C)Q=w3!GomGwB%K%j$gEA`FcIl#K?Jrr?*@48JJ*@1% zNQ*{xqD2qV_nh6H%+?~g?MnS`(4rzD?wS_an*m zn@Dy`dIF^g@S8B_TWM7>w5nOrs^;3Kzm--^t-WRT?9Q~Pi)MWU%&cava55XC)bal= z>5?WWYRj3Us{b?62fy5HR+P(DQcxF$%!kcJ(nxD z)C0H~k5OsTC5=_o#=VEXOp~t5wWG~K+7_jKXVR6^MO_H}%2Ly@bs}b}-i}PsGCy~Y zqXTWrT7ZYu`c^(`#JR)HRV;pb)rcp7;<9)`iMt2iTlBg^cdlqP2y$AR;Xy$K^-O^28LO6KEKz;V7zpAKGW zR>ds^@0CH>c;&JuGJJRz-U3iAb*5W3y2i_XMG~P($!ANDk&T?c!XelnTMc)*0R+!_0;0HB^t!3E_$LKt^ESqDS^b1!5aJ~TWxTLqsGKR-Bfqzq( z=JJn!+$PF>zY2`r6PNOj_&)zKR%mNlJj)0lh9Y?3G?HESQB8|VqkLNSHHlRQmd3Qf z;~3<+i2BsaF%&q4LdQ_#7>XT(&oK;g41*oR5XUgoF^q5wBOSvi$58GV{Ei{$7{ZQW zykoe+F-&$0*Eoi0j$wvlxWO^Zb_}05hP{qKwt!XM+Z@B!jzN{S6rD$kT?}%sLKl={ zC~ypgj-kjg6gvi=V;JNZ20Ml!j$x={7~vQ^j4Ot;mT;=I1XHGRr`_1^=VgdrK&)S0 zz}PH1D7$L{?qH5>d0#9Z+w!4Uy4jXJVsZR@ES4Vjmrumf%eH(bmZNRUUa=I|mM_K9 z$F}^3SPE^+KC$$-Ep1{cvMmS2a;$CnS}Z)=qf&hs$;zvvl(R@1TVF7+qF%abXoDdN zllfFmo^L7F@Y%D?U#m7%--=9Pb2f5c4q_!fv%X;2yJ}bb2S$yxuxgk0i9?M@%lAI= zR(N1D+MB_~q|f`rR*VP316$Az1RFmuTK18vog>4qJXTOX_>0!hYbvZ!_a%Rsk{03I z?)5(L0@5*wAAb#@4NmI912=`9auUd=Cb|9(SN{gW6a`bhYuBPvBp!eM8;=zX-rl+= zJy&qV${;H#rszUAcE1pcfW@nl;}LAOJ-;z}pnUF`A`$W3s(c=xxL3$W*jgiKY#Ef* zo*P77T5Mc#*y@!Rtt`$&y zE@uwA$QEy&F1#?dTA|0rlbG`23aeKRX%dO$!D8=|YiCP~jFn5B7v?>+jiTKkBd(pJ z;n9P>MZI`kVNrlbQWr(0Gb_{m#%r}v30KY@6VwjC^H576XheF}M4!1=SPWNP!M?_v$lGF<+mEhDD}F}AFA?b?)~3XVw2PYP#=#1; z2-6T{IvUeRF?s7hq+*ru25WpUY|Vr}xmPhQ))#yDE>^{-IM(VlYZ+<0Pp<5S_nMaa zH9gSPb$;*aHt?;@(AO0WPu+ppd`=n-vPKS?93kNG1~;L}P#TV}lo2f0-e^8ct+kWZ z(soXXID**_{EyHRo?_x%0G@TylFZpsgjnkc{qgIKnn2mtb92qIrpPvof8#KY)hbUm zCC#-W1LT+*^BKbxDEl~qw2{`DigwRWtE}eaAd*)TZSNt%>A?PZXj!w2p$a(_e@(zR z8FDj#9e2X#{C}`K;`b^Z)^0cEhCY-5t?qORiJm?a39m=fa?B0AwfmRCJ$Y9g zpIYcC37>t2H-JvSQCs_Up_I!cbuEuk4qZiY8+3rtB5w2APLq@1yL)%ndTd z$KFHPPckLk{rV+ubtN6n_?r9w;&bPW=oK~B?ERP!&EQB z8L)$`ACtUhzqLjPYtXt^4Iy#0iV${=+PQz3;~lZ^Zh=ks$3 zCtST!NLjG@=hATl@G4dDN9nQc@rqolQ4hX7WZ3<%D*x@|nCQWa=ONb2=94rxv|cJ$ z?Wrb*hj}EA2P$`k^EsKLd5^J{NAn(PtogsjA-mlti;$8Y4cE7xFZhoz*YXF=cQ$)=qL8ZFs>#w3G55ukh#$mCscf z5-u=VA)|f&RD^bhq=hC=3tOB1^SmUYP0w4r+=pDK9pSiItw|QA&pt}7D77yT_}JbQ zF53~A$_rM#j^!}P<7=eJ#}~M*1HzVGJnvOn$6O-ZFIoC1od1f>(zxQW)~I}^9fVpx zi#9YT5fhWermh#Jr^@;wdB4r7S-N${pU|^!=>)3zhvOUdoLgk*(k+yu?j*cC=h&2v zP(^S3U4*L}f3&S^VNp(Tc#<~4fjZ%3$F;x7JL_~-*XuGdngqp3IT z7N@-xs;|>%<0Z;;JtkS}^0@XwPpg#aPU1LKnI24;9>H|7a(fb!kW^MUvY9TQ61WL_ z9gOwhk?6J{;>5zSW5d;B3lUoU6kc2xLOX)i+V@GtbM$>!ksXMATrwhgtM|lmh=cl~ zD`%-7`K^1_{s)m&yjWlGi6ouZ5tO)71lQJ7L`U82s@uXVb$(f*On&H(DgR85jK#j7 zwP=q#acAA0XKw#E!F~JpZt*-)QA9?S35OfTS$^zCmX7n$V=?mkkA73g3SylZJWxCETQ_854LYg}sN$dgZ zv*ghZ;|yBBI!t*gOwvgOfb1_T-cUQbZW${J4~&$;@~6u5`%`)$_MY0g^$%#xC`%R_El&h zSn!@Al``s6)w+LVlixe0$voUpxw<}2J~7Jik)l%}h-Ab>ya|G3FsuEXc z%9Den|Ax}#Jvu(3k49%YPRz1M7inMY1XjJMvZF{7UGIW?o(drjuWHZB}kuPuS+ z<~ci=P6XqRN+moeqX`r))jmS)TamjNnI|cqykciv-{hxR@wIP_{0$l#j*q%mm1kA; zdF`+8g8A2hve%Y;DJAz9M|WEzuVXBH%=A9e>Rv0^w$wklUHDiI|AQV2cpv%5U$R@f z%lYlca#)3oP23|(V_N2;<{O0UyG~}nl(|!f0n_?`p)$2B@irCBWH}gDTZqB3^G6R%0fsyO*bPG{KJI-)x_?sJ&usiKXY?7xr^@?eJSv+1 z));rMi_G|xcI(Z?ME7MJmZgH1eIskV-ioafTp2|(*;O7xB~% zs*Lygvt%Ny=Mx0oTZQ{~$HCpJH{-LKdBpA$hKfV-EHbzl^y>3^i*Xj>V1&psbXXWa!;~C z)&px{#$_o_))j~Jkg%;SN!|fzQh2Pu@^quDJ5JUsu(C$EkELg-Vo$WGL9eTYEwzN0 z**u%2UCCa#NAZAXE7NfP{mOJc|I!>iE?IsWsZ1hNbBr=|;Qk7P`{O~@O)*QgOI-=9 zBYRg*Cxhg7ECh+ykLjbEH{L-IdPdKJ)yphc@g(sJi0y4C-S-?M1jcY5EaYCOX7B8v|vZc;i1N<^Yei^wV{QZ#e_s{*t%82OeoG53H6&GYrqHmf4d(J_-)uu-$Ox zZI;>?q)U5_ly<3V3RZja&x*LEsZo$uH)W3Xdb(MRvYSP)m3ewgLvlG@Qq)V9-20kb zz8a;nxtZK0WM)Ns&0jK^@>@4lhL0!L4@09l^KA3h{H@VL7tdc5YJI;d|JB5Hu*q6i zdFVwRUNQ4uF{AAl&mXR{u9gxc+z~q5b32AxX@@I9JS5v!cJ3qxk~8??U49NIU3^Vk zq`i8V-*g0odE%a3QVZxnqt4eINR?D$gQRkZO6BUa&;s-pSZ06zE0P`ES>6xj|1CLM zb(Vge2?V_*%v;eraeE2t2%|2nN&scU3eCWTU4{vV;3RUJRw~n-EX^dg6Z2 zNmaU)kfe|`>R6q1dCMKzp_6ks5WkIuBa%Y{ym;PKl27k)S;g+06q>OsS^lj7!v~Yk zeFWS+74ZDgs)!(F@4-BTnPyh}P~@`4rmav)L}6#^&T{-whEW@QPXz*0dpLsj*eT-pVq-1R8;Xz=Oba;9a0Ma5pdk*bbBej{&y=UjX@l1%!ajKnd_~ zz$_pE3;^y2t^(c!%76{PZNLE_7gzxVfER#MfL{YMfe(Owz>k56z+ZuLfIkCuz(0Va zfH+VE`~^4@_;=tY;8Wmu;9r0#z~6xjfoFk5z&Ai&a?sbvcl`+cN9dQMUyk02-ikgP zeK`7`(Eo%!7kw`JSLk1%_eAfB9z&0zUxI!K`d0L<=x3mxf&P2+-=p7%ej|DkJ&ArC z`f=z#L;o52_t3wGz7u^X`UU70pg)cNH2M$Fe}H}n{Sdm`d+Lt93Vjv&81ymdE$A)i zr=g#Q{#*3lqF;}GJ^DxJAE6(Eehm6g(0_t{CHj@c7ia2Yvnk0&>`8>%}h&sO=i z>d`^C?AwA*vs$zpak3RZ#~upo2R0ThwviqKf~U z>iGYrQuUwPje5_|@6n@YPpM9+GN~3R+5%hkwpAZn^|h6hTc(mS%v4T!I=WM?j^3eo zJ6SsvcPHz&6#uc`R{V54nXsxOmBOb88$+*97hZ%dk)8>!Pe0UCb=eYS8HPS8qQ_j& z3l}uO1)b3IpmOx_z%*bEuoPGaGyuB*M|F&oC3Y2;#3OM?_&z|wEeECnOMwPJ61?>P zCIIo9p=64F0w7zuj*_*1L#4#8Opbe|egc+EKe9`p{mA@J64qJC(N8H)QBtO3fvzzH z!%>2f2`uZVnsRihu}qNK%LJ*(Ou*VnIpKE<(+S7%FEu0}xe$Tymg*Zj2QxP^Ju<6$>TJ2gaKx`Oy8bHRix?_Z0-Zg}XDyBR2ncd})yC-T zTYZ$!ONLxT&eN6!mNDmf!!UTho_pWP?pqw^UrG+IZ5G-Nx1G zD<{|gdLIXs>`yLrK#DKIlIavCZ9M68ZbR-+2=0RuuemaPbNh=Fj^j(F(xRk`x{bf^ zFTNs;vmQ*}-2MeFqS6v)r)vk*q21j4*VYva#+;LuID35x$B9c$!-x_R;5Ov8g_s_? zf5U;a#97&s64le?_`1aoU5JI-kh>S+aF6@BfoX}ebtxR5UGmRLASfX%ZbNnmqz-QU zyzbbv#Mx#+KpjO~LONWq#7a}E&Td2QWr&)(;A5|rI4ic9DICYwdA5rXePm?XzRuYC z=3QxNva+5dN^o?2U1Gb)aF&*k*ZQ*uo=Z!Uy(|Mq`&w$d$ay5LqiILi+}fiaNlTMm zm4TxXer&t+(Y|ck;U(pNPfL@1AOlDHk|Us^WN>mD5oJbd@3K#?O-qyQm4Tyu+1XcY zKssN^m-qHhOOus)7bUEM_SIyEBfZmY_-yz68wx*8OOxH4i35g82Zy= ztQ|*c)OSKlm6*O~Xs1Dq+_o1v~$@6SHJ6r)~6R_}BMttpST1lHq-q_c3mZXIt( zpOow#3#`X50I_WAImjGc^pLBr4|3TaVjVr1{8iG0Qjp`|;Vz+dvaXFlXFIV~8U z*dD8TCdk%vH><@uI$5}4vwB|C^!i`nCF!<9Y?2+2#3`Q~z=)Js2cqppL8K2u2$iJkutnJ-X(k!sd@I>Xhgni3w%9;h1ViYy@kx|Pv z3oJs1wVTZ*D~rRVOE=Fh4c+lO4>;n@84|^u!-Fb3PlL2rN9jIvvSU>^od=~9SxVtm zVbUbm{>C#o9VoILmB@>=jiC$yuxW3@T({RnX3b8~yl=l#K5XRB;Xb8=>h)KNdXO5Z zu#@-yjOvY$rI)l4ezYDY`p1AMX&PNoJ>h?UVdDs%D1|rdJZ-W6&qRM1yqz7xD?K+W zVp(kY035g7I#cnMX5V2J9`-13d>!yIo2W!B+_*@_%v3^cJK_lkd;WL8lk|v0xJ-4V z@G8Fpp3G+^d63UDeFr@0xOa4ccXkJPDC5EV1$dv^xI#Ge z9qa62QrgSqLUA%wSLqYNa$Q$=8A2;0h*Drq2RwCmx=g-&i*iO&E-2f#rKdDYL5~C+ z^3UDnnON=HRdSVC=uXKd&bUVp>{oX+yrVY-t9h+e%9L$rPvey4lQ9hg(xJ$?^~Rw0 zkxfsP<31(WehQkpx^@wI8jojWosUvh7pspq&zw2KHzO^G92z@w`b|C0lTP0g(8Su<~r@EX`nw;;>>I$V%Ls6EQFR5#6Gh3PuNlC>}d zo)hu^ypj=9ubs+N$WYx=rW{6U1=wJu(I>18wbFd5`YJS{M46;+hA2}x|7R;xkbfPD z&mMw(!_FFZ)(BVju-tj^%9b|Y)dzWDE0Y*Y$Il+Q#D$SW%2}E8)HfSPk5Ok`#|UF9 zp?}#pHbumJu#F>q$ZZG-mN*(tNM;BjbjHLZjpNd2MBV?ly+e*Pj>~tMFpARSxR7Uw zE4KBfC-gXedqA}!LCILkTBq!KRaQS#Aimyz{;5rRDJxTae|jlvmhDS;B|VW9U)SDp z)m?fi>-K6XZH<)Y>d0xZu7ockV+3^-`AdWm8RsljTbYV>(}dxZLx;UdmFw&e3rxoGf3`D$-AtOjW!pQ!i!RJ{1ym)7XE>=3QlwbQ@AiqJ($V zOIa#~W!hEYWG$%3Q0O*F^=H>l-q?St!__h^vR#Ft%kJHp#p{~Cy~Fk;n$Fj}ESJvQ ztj%s_U_FdkbF)JFMnlFK4=UvyN5@%ra3gQOr5G$PS_by-M53=P3j#8ClS@!*5mBq!!pG#ed{X0c|*_D?6Q(|sb;b+Sw)ow zBr20cYnRUd|CCjNY_MoqT3!jAS~GKcq>kr7GfPhrmECl8GXEzB zIGZ^nbrP44e~IJQ0}eluo~SzAUk`AZO+mI3zwPo+wE5${tp|-AvGsjhQ-DbM( zfO@r4V?!c3y$~ZMmMW`i!4qap_k_-+=~^)I+ztiYp${S1smyN9O3UmD+N}SbS3t^2 z?MFZ|TE8DkAw*YHX8mcG&j0@#t-qLRl-8fAj@0^nn$o3FrS%W9sczb}vniwXhpbI3 zIj!32{Uv{Dr5Zb4e2wD*8D-V>>C>^WjbRDk~KD#z9VLhz zzy0LXiFAK=dhU1c@11+Mluvf=K7-Wh-rc$EI&@`5vU5iMSNiffBhRykGFkc2Y~ND& z7n#|j6HuI*_C9iCr0lZ}sbS_ZH8fue?jTiRdK1aUe22*xukrrVkO8Z3!Z_hvj~StTv8GFLU{;=^?RmnfZKPg)^{iM9(6ZdA6dC)ja6|&b5 z%sRX;*j(XgGxxQ0kCa4rb?0gV71nEY;nB#pLEgp}suCK4WldB+JXCEtMy%dh!HaHk7^~bKtLx#_n z;n=MRw+a>cOST~MB3QDGr)zjeP2iiVvOn;=Hgu!-Qba%j30jqm3oR%TK+P)&B$x;YbwQC* z7SREUrJ>@8P*Rp>rX$Xb+bj<1IK%8XDpW;CxW|tov;vntxm3$ zeaPE-r#x+hQ_i+PeQTZ5n*jYRWG1;zZo?vuHnW?y**)75J-bI(W#6Cx%q_1(`E@QK zh>TlT>WY2tp>`;hh#RFiX$@7kLx2{WX*Z$Qb%9=x=IGcKMuTS81SRlT!Qt6P4J!#` zBBKeniAjSF+*OkLoRT6`BBwkjkWOV2K<9JNm&~>Z0n_$yw=S+OaGv%X+z+4jTf~)n zF*#$bN^weE+e`E;_fDaywbnYQ43Vs*+#;K6O}oX7scS=9m{ypkVF(}@SkCWb`J|iJg1VzQj zQtMu65H3U8=zNJ{m{8K|CDU$vroMz23d&%yYH({n8bmhy5qnk~^2%>H!W~Ca>pp4F z#}1(a0jargLlCq<8%$M;r;oB7^}2BH*AOJUvf3#x?JE|C&M}=oC>B$rRAONh zzL+Oq=3SQH5VoP+Fs1}7Gy@RY(fYB|i|&qYqnLm=IR=ZvwH({C&EWC1xQ_)(5TjbW z_-s(URJO$_DI(16)FHM0XqQpd4JWgZ>m7xvgp zpN}g^hpt;&Vqt$6{>rZlL8mTU|4#4HzM-oTAKDi&*iB`~XDkBCol-m0(LMF3F_#%v zIb^RBS2U8zlI_$2p7VzMv1(OgZS7RoS``;td7XDz$z*g5aU~U8hqu1qGQ8v5ndqfL zcwy}}2dgQ*X)#Tq#gxGjYiVdHbxz0$1m5KoP@ST}jrslA%F4PB zz4VtjXhjXcZ(v~%Z$o}x+0U0#>XecRqY>+An^^b-Ci;SY=*#F~=mWH>s#$Rf?UZG; zIjG~%+%q4mNXUBHZ*=#TwvS7igku-wM93jq(~Y4da=intn5;tmyFyW;Wb->FcZYm) zx=SudH%O+FSidgue4fZ=Gx^Nk2Alj~dXmj_qBSt6Tq-J~U6@UtlHS)LV>ywRYDPGTsemvz z-71-VoN(>MBT6dBK$7}`fq2JZN!gSb9$lhBwgyozaD@+zv*eTFQw)q4X4KCYJseyG zM2xGZFxd)W8JGDRm)x!qsvzVe2A5oqI#3B!m+-Yhr0(c6q+p8!@zQYmc0!d8E3%r_ z1)=I=)FTEK2vr{us@pG)P^CK$KX)K;@#lU!`|%}JkxUYZTr_@J=yn$f5>I2p_!9jk z<4aOSt6b(e3{~4&HWBy95)IBi2Efboy|ctLXK#bUQ)YCT_qY$a%vA-?IAQn&R)rj% z!-)k0pr8vYCjFDguIZlyGmb8Ejl0O>+02k*0Eb^GffR-wZU6ZN<;1mEk zbpiw92#jN3Jc02H)Dx&@U^fE0F))F^1O_G&n22jKlF+r?uQ&x?@Hpm^e6%Vjg`WkK zjz7JwD^fUHy5}Bd5!uM>MmbE?F09R?Ss>knXD%6%2zOE9|}uv)8` zorDcLCk!^3stZ1KnlZmuW7AN@c6!b;wCmix#yQd>#(dD5Bumi#ubE^uufJYwrR*t0D zHxLcjd!&J2HHoFkp^^q&*uXjB{yH;DCyM?#u-qaF)05qyqv>u5mcIfC|=H?=&9R`PV-53 zqr+SWOQN*Ch`f9->4W-4tz&ELz)qmxMyk$meWFkG?}=XAn;G~DxSN5e)n+K3Lh&l? z*p13Vx0VojM0k*Lmr84T;%BlTt+|`_c9XG%xSMtWlj8x<&Tg_E0B!6hcLPBCy2%Lu z5*#IylN=@aNj7og1BtdZQxkbwRBP@(1ouP0&WVo9*MmnEET$X0A(#O1&;>JR8w>LC zjB{q>8*^vO{4oTlVth&eMsuC_NWtv<8S{p4#S*BC z(12Uf*>&F+KvVB^n==DSFcecHuMPA0_s$2Mfi&pB@`|+7t>+ z#HXX@hTVzpU;M#-Zyrdu;rXZjb@2!L#KWUUzhoaQ!ctz@k?&CEs2=P`@blQAy+9m2 zdS;A!=^KTKi7)j8k{{zU1m(qfyPZ#*&{5~-EuO8R#_4$1)f|*|rC+KE!s1No$1&V%&g7m+!RWF>Hh2`y_ZWNjU3ZR|F!BEB zlcljX#j(=}QruY#+5nAoj2)G_A;WI{Zv66Fh7RTYb>f#Nu?qMj_^N8lM~>le?L(^+UGbUK zp{#`M@+X4N3_4f9U&@`kJIN5jeCI5|-`3khemhO?04ER4cg zPB^4fLwPQaqfbIB78s;f57oe0!u$#^j!B;!lR=S~>j<+#!=z7+$)HHg4e$#73NIcf zeR50&X_!e;sSjSEMI4P_j>e!!v;d(wIU2znjX{xU4TN?LMQz~7jeFUV^4cf;(-YYm-om3jod_I;+8?=uG zwH+y=N3Gr^cB@x%0>=JwQqBagK9lyZsF%$M0_VSiMYP;2Q#!J1J*-xh+05I-RhM-m zo89q+2%pu$y$rL6>|A2_45yZ}C*C*Y-6wDh5~bHf(^`I{XbrS2CDDU%BL6;LowM z9W8yAS%0ZJ!GY8Z=ChO+bV|8CI2CThI96k}#YU$vK2aVUi;qfEFo4B(Wf$?KzzuAz zJR5sE)8bgiw_*auW$@JXow9pfK^oZ8J_!TBCT?yC)?j*dmFUwzjmMz|*PzbZC=NX? zu)u8F1GY-V{Vk{vsR$hr`CUo2WKjVO%bH~1XaASy%)aKdS<(?T#v z39&CK#FnTKG_ZIY3{pbWMTMZrFPw%?3&9{I#K#dK+z*AZ0~$7i6l@y&YJYKOgs~em zYz7gw*L5_a9~Q3%2DLTdJllkcKJccvjcZww8xdA#$ie^tIj5zw0oDnINm#YAaPy|n5*qLD!^Qg0{}Kx zwq z(>wn~8f+_1AQ%B_2#6iE4*46qyjv_DNUWxau`3mAYXN#N5$+r(cphWaYikL?oShFG zUn+kT$G3|k(k9@jD;>BxR_{y2aKTCGeSEE3>3a`@O()vwCX}QP#6ov22`8Oc=4h2W zriG?h{uX0mY5g<0G6XAmKB1(;kPZ7JT}?RyR$-Gxw^;aNc(V9rP#N29>YjFLxob9yZN+!7b93@U9rW%aw$R!xU^z?SsXbV)A^0W!Zx@+&ZWRqb@_-H2PktV;3sCuq^mv zxJNP2sqMv0*+$Q~#KjMKT}}!62Q10B<^wI|qb1pq9EjjsA$_dGJ>8e6Nn=IsQ?Qt) z+M~-ELJnpR$SQ| zVF-b?Nx-lsvW2dg*lI43aCaU3JZVGA8sS!fDWO=sbnzCx_#(1($G+YB*#YgX1jZIBcOMoF)zD3I#{mBcb@k ziObQ)SS11Tn1)H+mSQUw){;NNWDr#+Fk3XtZ5rk}4U<6%=GPh~O-($`4H_nc6wEdS z)4iBu`7|sBDOl%Ktce^epkXmc!P2Q%KjK&o8Ww{TEWMhyVp`hJvG(weWfgEKT{iYI zu35173me^WpmEuJ_c%>$;76PG%Uk%`x%38c^(P2z9kq0)=pj;ydZe|)A(Tw&u$D|Z z=Q)#rIkOg`RuCB5Gr^nM3+mx8bm|WpWS5h~TOa|&@1S$}fR&$YD@nb>X0FfAa>i#* zgya~@N5?L)cqwAH4XVP4ZUzp&MrX2A_QXjDneSFAis3 zUf~bIR##cwn6tsORt+zd|84hjT|o z@0~t+DlUW`FA$TCo`({)_6@Vu`*KHxtsbemz}f1=vZKd$Z|k4Pg+G*gdML_hfoz^g zXGU^oQD&yT8E#dufTtt2o94}1Jb(I(S+k(fsaPdQk7-`D=@iy&j4!y!Do;1M+dy9> zgR3eiBG8c^9OiFTli}7|%nBxPb9tTr18roWlH>WoxVh0n%`i%g(*d>bu$<|*ba4## zbrAf17K6w1j=v-K)jP=o<_M$&%9zM26BV$7r2>9ShoE!DOLHNe3XA^O?B&^8=na-? zJs7q10emcDPRnrE=xgvmw5=YLb1};`1Oc2`4R}wD7fwxX+5&G%sWMd%QYs0O^qh&gBkttjN#>s|p;FSaV z_q*cqzI}RM*6Y%qX#y65$bSa$k{+quQ<9Ss6T0c+<8bwY<3I1 zr!~+!J3w!jkKVQokO5!14lnmwkYd$x6}S$N7r@TwAhKk~Ex*MHC?uR9$3zgWvv_9% zR7EB19dTz2T;4GP(`niR5#z=EFm`ENFW5r@M03RE>db1~XAxY0jWD~B5_nemBhP73 z0!8IH67Ok`U(^joenMt>x99WofW(bgT7?}#9WEcaOOS+mt579wdrTGWdx;t`C??exO^;5AkuKyo*6f=$?ivI3qG z7wI0)-BGc6)UdlMNV*V+2@+;>J%d`=bq+JGxh7GUMsS89k5)sq4?Lr|!i)0a>q|_a zw*Um3cN;BL=mB}%jLf0=C=h(a5+=tQdiA8&R0A%}HDUwUK(lr29P#vrb8KSX5%`_{ z3{LHP=(Uetez=X$e}wm`{q%hRh$HlM^nHlFk3b4%VBxw@5~YMcq?q5*ZI0Lu;hpvh z644PoSyUo1|F|AbkcM1X^A&&^gnp{}9cmj~s)*+CgCjQN5g%(e6QNZR8kUiT{%jub zDIXc90JmevBh{=GA-x%3{Wja2^`!fb-<94#a(;D!aO{x`- zgI=Bn*&crjcKKJJ>9D?1MV~%`dO6JM5^XYoxB007tP`*X$lJ#nV8t@jPH5{ubWvJF z^t$Ubh?wNuEgdr-hi=fI&ZPN_S@UM+4;zX_chT%&k&`=`IEFGL7Z6SVCEF8`6FTyT zv}j7FXaAOCE6IgF>cT^FGiYFV5cJL9UtbxfoYj?Cu^1IWHc%yvebaLx4ZV9W0*~@DzYDw}F*G@S z%AN2)uM8VOSu4u&%Jil z@Eq6jBk2n<3o@7_9{mie6zAGv@lODdgdX_XxH^}~QrEav)-LG-5nc0{MTSUGXeV$n zWeM)f#Em_prKB^tmm%MUEB-u?gGg;v0>V1%t{(#i`HUbr{I00R#$VoHM z%9QOG4TLp$(a6wL*j!TXUj|Dkbq(cGF<6N8ZiG&s1~$!1j+I{G)tOkCHtOT7YxD^KtZ{;M zjWt1FARMg;;QGNep1^np>Iu{{up5Eh7??mHk0FsjRX6X|;3HV2CZqT?CF+^%&~*$l zqU8rLC0KVy(pwVN(rbg6)W6-_CD6ko1Pcx<0|ZzB^mlm+(xI;RWO|MR&|DYX7lPMcrD*KYNk|jAIR=f*2QDR; zq1o%5UfdZC%{@pDgf;g-E|f=V?yW-Gt%Abdj~wzxC?F~9CE_=%uxB0A0#!H#jTH5^ zhrOYw=TriXgQDK{Xhl8SpcBwXdmeXrPI;bd=mAW99(+L~Q_zbRhJcpdXi{;zm#Md1 z24V#xB2r6l)rHjaD*45lO6HM4m%J_Lf*4xVkS z6-83ZA6<>JCNC6-RLwkGuZ`SAYUbU}vb`GX7RGn9R$i5&m1i3Sr6&;wll|vI_$975uajr)F3Q(NuLH zrCp{rm$?Dz91U!;4shB0GQKTI>rRs;Z5R^?0?FQ52Ze3FePy*M|D7T+H;A6s2_R9I zh9(*c!Q~L3UB2`vQ~5jVG<^X-$hPon#-ThDTmk-}&D^y3I-7Z3`ozUXr`$xT(kb4` z^T;cDU9UtI;b*}^_@?ltU|2tfDWD}fgze}Kin8AjMCoY#gw+nZAX7ja0$%qrs6TAy zT7IEPs2`@m7@ysQhJGA5|91o9762t0Y#zz1P-99 z7EpnSFymGi!YXV!Mz4m<@8DFbLlSl=q!^9^Q~%6+iK0R|hiEea?#@3m+KdN;W)l%- zVJ%PA`ShYg*x#j=C&}C_OJrJ}xV=-+@)V1Ii&A0;1)st%pQ>1^C}0^*AH$?&uP}He zwDH1Jrc#uA)Gk6jGP8JVAZv8?n%e>s%M#;go|!|I6DWMIdlRwoPuL?w-VI&n7pcdTpj-<4SHo zuZC80ip~5Pw3@L#;{wT}xE8r!sueLoQL`0VVW8mXFcxz)pFkV2elyk>^OjHNY!3Sp9TMU5A<*N*$YJ{q z-pmed3c~1_KbWu!Tog8%-eKLW4=Wm5f7oR70_*13d5pxygF+Ydr@aSA3fg5TrbT*C zWWjkrg&Y3R!D-u|bc6}$2+Wb~LAWEu6dL|6b#|P|mtdr_>7W;FLqHL;Z`RX6z-@B! zU5MJ#p=W=gp0E%4*-W1q+TV&kv)a=uPz&&7`picQ`l5Y!FHi{p>I7PqVo9I_>mRPC z_OfxhNB%<1AM(a#U}`_Uj5y5)MNc`Z%4LSEQTBQWiG2<6fH&a62Q22mw@`}kI3=yw zPUCdAR!X%MQkQo*9+yXrM`9xt zyUFWn38uC(ZYgFabS|dfN(|-S@Jp>C`(O*G& zuU8mATrJZNByGZhIAAD;-s=Iwik?n_=w^@R(pi8zGTFa~&o* z8S$6dp-(Ip{~B3QVuDUFi^&FaFhcd@c0a=C7DiD$<&y8B_YXV zs4*)^R8rsfBYOuIPh)@xPLK@amJ% zDgPy0ZXI;G1v(khkxn-hy9taVkm+>mNT*wfXRf5vEij#KsB;7C##~9KTVOifI@0MD zB6Yg`RPnbXG16J?fWZPX3)l_C&a4LOB{jvmCN&9wGX<<0XA-e)oGD=4IFpEV<4ghT z#+gK{8)phwH_jwt-8fUgx^X5E>&BS^){QfXSU1iTux^}5Ab0&qIH7XCVi&4HHa@0k zx=3^iWw1`-X&mT`cll^!!PJU14Wr4Bn#SggJ~U_a!N4P3`2fus72?VRG;-1H?#9SE z&Fx%R)1wVt*o>iMX**oW&;|DYWay$ZjyjhshAzq-@-!eXHAp5%XUE#PmA0|J#p1sX(DEO)yc zYXc9lLWAA{#Q9!(H0Vz3Nw`}Ec4M3umIcVjQtOF5Hg~%U5O;eP&|v0k2ZMx%?T>vs z$D`}nIo_`TalFl%?@rBkBveVc@2h}#*na}zVXuS|DfewcajsygrGo#?ZEY+E)Qh?O zpYeeIGam5&G2;QeTX!-K@E;lv;Hu{|d<2~Z(?pJcd%O1Kf2&yv``Z z=`4Z(IPP2jv)h8d<;A>k^ocvAyL@vW$OjTa7e9(eB9!GBMl7H?LoZ%Ih=RhdP=Qww zBESeoXuE3&8XV~ci}hgynxP$tQ3;mdb_I){b2!G=mK43(Apvj&1Q7G{|IeS!A`FrC03gJ00fcDV0A1q67##Rt7KosB zdqinGOc@YcptE#(qHT8MaYsxms&Mf##RcRALea@OK}Q-tgBT(v9QLeKez}MQeN0qb zK#Cv~owL(f_G`}tpA8Ea-=pEEX^m1`5?QE7>lD))J0q0NMfPXPD|D|xXli- zh@k}HBFSCY?C7l^koAqQ&5oNgxiiS4n6yA9pc%ds*o)bW`RH^vD!&W|;xqZPXBKdS z9AvX2UZ9hFdJ?z4dJnnqr?2u$k{;0l+FbUdvv3MJ_`kLE!EJLWQRC;|*!7?hFjJ@d z4KS698WzsZpFjPPS&vVj=f)M9(W2h`)<(i`7tEesFa!7csDj*G+5G4{+9I(P`yR+a zq-&=^44LrZioEK@$0$d!C&Dc5=?<;tZH^Vq-ukBp9& z!KoWz9FPHk2^)qki{w7T=$Kf%0#hJk5_@QB3=YAkDu{tNT5-UT*93vbyqzu+Bw+JT z>*3OV91PjdNJ5bWCZ9UulyMpwEyD;2$c6tRjDG<*Mly`Y=7>)68N` z5lE(+kppC-eMTHgF*(mKATija$$2)Mgrsm!dU0t`gdCyY!`=s|d_j60 zqgNvwPwge>EI|hmMLWa`Ad~WJs2^i?hZP!`V4|8Ogg|cdzb0|e&tV`@EZ#^bbS3ve z+`qX)I$dsX-$B_#<@*eju`0?=91=P0V;Lcd)%HqCbO%8@iC2e;Mpp6~(K6qJy1_ZG z65uIvYjSwbfzy8v5>eZaxbGS8{|dq~Ls5RDJVO5km4yVFDSM|-sqM!o8x~eul!YuN zA4^d-AOU0sfeup+wgI;tVMy@uGpbkj%fWiE+gUgI3z~yW(~;z`1xyc;yM-XY&4#Qs zH}{l;lUAWlksuBNjY|-_1ZsLc%+4)j+M(rExi0t%9uaxu-w$S6gu>`JoQD(NEyX54 z5v&fMQEAKu6Dm|mFv3{Ro!s`QPsMO z5>+KZRb-#21U;h}ICQ_})|uW?MIGnl&6_oyn|fL_`{w^u189-cDJQ0ALZzoi$A)F( z!XI_or}OZVb0{3;Tt1nfdQmaI{$B3ANQdm zVsDIK`X9rF!zcVuzFRQ=_ojBmLsS`)A02LH-|A}}cbpC#a3{?VW7BLXh!mM8{yLFTlL#_y_Fd%TmEmJSbX(6@WSP8m69g6^clNmMt)lo9y>_ivHAI*glDu0 zZreO58oCjkfeWtql~=gxN}?;TGBROCis*Pg2XaY8W=OT@*g80?GKyGPmQ6FzJ6mTJ zO|BNaYz?AmX+Si&vADxp@CR5iu?%t59@{$L<|WfhGGK9g%!t>L49Aw|FFU%8N=N71 zg&Fph9b$1V8kk*`&4f*1d>&?^nt%ckq5}wps3_9lGIThscMJT`cV3CB8lLmXfz~?Q zpdl6~BStKWc|FM%*8NDdIY9Q2CeUIGhF0?$KPbju`cQC-xZ+o+8kELIVZNdw)g!`@)=vcd zC~?~GT|+VD)lsDIA{Wx&$oq&KJ`~_L(t3g%c9X*{?r;_k%|}t=dU!P0OU7I9eHG>C z2)#i5G*4w2M6}I!8}S;SffwRz-n~KK*(;_(g=sUEQ!x*c&4Uox{gjVM6u$#f(teAYTgo)@s1!yirPz$>ZzjE<<^a7w3w7L4xSB*YU_w{) ztU`tWq05{?%>lIo5~)wF((*9*Mv4=w#a)(AkiOyc^Ya`UKe; zX{})I&nSzat@t)Gj(92r5zgz#rA$uHYX)>60s!lSca4;4k4q5ngD@ zL;luba^1iaq)zOQovy0TMrbfpXLZnq=$=OAufm^R*Niux%1Ns2a^`jiAnr!u6C5J* zksPvOTIEncgKorZ$>SRVh{rM!5Xbwo1`Pp;!QGYu;vrtv+`?k-Q%Ehe=$H@LiCj?T zXP{=5%{J2e+ZLDISQGxu`m%(E-eVb#t>N|M3}m`k&mDmLI!oN^c+aKVEM$mYRj6GU z0d4Ep62mSof|+f;`au3B*d0{@;oH`FPa~F@KOz6LTZ5IwW$`$_7RvpN=>6CPQ!me( zlE!*}csZ~z_kXt>D04qX1o{X~{@My5hS2fZ0x?2|*^jNPA)10No5*5T*8(g~Bdy1& z6Sm;*ghTMzP1`Y%VEV5jL`+=U5vm6Z6*JkQID@Gp<cb}2o6Em>ewa`33n{77F z(9a&W0Vci5kyanAA0w^x)H7-I8fnE8L@tfY1uTV;))wv(q(OK+{$>*J0FB1Un5WAv zz;E8gdorL3f-rV48DUzcdGZ7Sr%;YN#MKiqA@Zs5cPJ5?4v|qdf7)5jCmNCG48$Fe zzdI?V$(RMpGpO)~P+GMRNw~6EPST+!UIm-p=ot$e zKpCNgHXW$}IB{jDS@w%*1hE6Fyh7N3qO5I8RWx)py5VZ>k#dtx+M6}LRW>4;|Ks^Iu9vQoN%In zG4c}sd3&j)x6q0*>nQC2p#>1UIRJ4)M$UCxrUas>d;8*A1F~e9R&IbRFW?Fd+N43e zs71$?!$n(8U`U{aq}Q;kxQ@y4k@y}&W={Jc+fUNxTy+{Bm%<}x$BQ;aG+e3kB2%X^ z!@4)n3%OtB4zTrE_OqP`O6memUbl6?$M1!!l{#aW)e5@@k=1HrwQ&*E`VXXNKu}cc z$V-mLR4L*dY2Ah#HE%kbWhH@NGO@KsHij?8Eca-5uf@&vUv;0j-V}|LU zMx_Y_BO!OD2xdcwt5=+qL7251uO}n>QZy z2x4>Vbx&$;Uuh6YLvlPDAUf63GrJZXDq7(wUb$-Z8u@AOPfLFGj4tL=i1roYqL6Xu z92u4lr6Z!E&u-zE*=K^55dTb6(^Wo`lx(P<$vjuuX9~+?__I6ZIpQ-l=Cen%Zx6Fs@AZ(q6B zbI*(OF7>Vd@vJA#{0vUw^Lp}yZ-H4=DqmOtdFYSJ7_tx`L9Rj)eUt&c*wT9$44LE zf7_nF{57Ng+L5|XCoP|}zpD3)z}C0FerwRx6>r}2(sS?b7GHnA^ySjH!AWbnP5)bCS?_cvBQnKvZOIrqN544C1+?Z!D9*GeBRCdS8RW9^GSGJM!9uYBXNfp2e2c>UpZt8^7cXgiug9ayZoF-N(hKuuJu5so^Iu<2`tgr*XUywg zmoa&9B(=`*UA^wD-~ABV*3j zFSvQ^nuq@uD9t&r=tjNuvjOqLraM#qT>WH^Pewo1ZQ`G$xa$mt?pszFQ>(9ed+xn& zuFNwg@0;_^?~cy+;F2?+KJ;RBz3HkK0~_92zkhq5+upptsK;A3je79?O@EvBuFvQx z{c_`*TYr^$cw_vpYTqa@kNfb8e-zgK_Ofda>OH+bUevSu%p=94X8rQ^N9XrgKlRZk zy6?W^=x;lce{tR4bt!MWoVe8b3$dm4wWQT^PY74GmnA$h?cUth9S_f5{@Cz&mw%q{ z;{}WR?Q3tiey=?Bi35h6<3D*g@6bDE&NOfN*_bVx`h57a4LMD(ee}^&zu5CiMOod5 zyH6aNaQxx-_B?#==0ALr@b(>d4*#e9!1X=qoc&V%ae93G@SG>~Qh9UEq3lBsuW$a@ zg3Kjb9vS=7H)rg)!ZT;{y4t*Jh991L_j84*JLAW7fA5{%aaRqwwp;d=QSVj`?*9Hi ze?IlC>-CSm`QRTr_LpVu4!rGsx&DR$fB*D>4P~=_eeH>v$A0tLqwbVn%#Zt1Lh^6! z7=B4;<->{jm)@)EwqpF&=XyO+did|xzwwh1{Whll`e(I2@3G~>&o(uG{N$iR2fOd9 z-McF5@V?`1Z+}AkZcWB7-kki0 z*WOC+Hazg|FB10eGTr;>l&uffUwzXPbKWc+Kcgb9-`r`xygu(ow{GeF)+;|tE$?@z z+tiZgxEnj4In2zT2`d(i{k?GJy!q~VkIi~)I&PbvU2t)@7l*}8GcFQ!&LazE%)1b- zmd8kbIwtm*vwm^`!~c6Txj|fXdJeXP@TLx&sD;AfCmF zOA>zL1>&`X@YDV6y3ZTJcfimpN>7p&Du;dRbYR~j6mi}u)lYsh@kK6ALf&)eg(q1H z^-u1gqg=!bEy~xJl?k<6o`f9UQCt}ggKHF*?)ZiLhEmMiGM`u;mM7U0i4!FmLOkYp zL5<`0M<;G37ykTS`6XH*S~7%Oa4JC8i{F%yK`>c;q?*y`USMzjy2$%o*oX>u)S0@2 z2+sOzdY7Y(PWryhpN+*CJIZoOH#Slt-5E%+*W6cOX}M2>6j()s=U*kg%0HqtFcvU=nz@}cvk zNI4|(8-%~27`*?HZ9xgP1$~ug7WgU-FJ0n$x1mGO+2be8l}f2MhS@2V?Rn!H@akFl zWqqKseOb@SQ}tE&9Z#HLpM>qd`(wM;k)xjb1Jx-tC`f=5TY^o~D%%RnJI}HacJO8_ ze*Ay+=$UF$J%FQOA1_cF(9=BlMA3IQC-{hd(`1^7`J+rEY%dT!`f1+nYV>zLR*tQl zi!vuj)uxGTwMh!jPpqf=%CQ zP+cOX{|qcvw<>op(W=7mVyqxFBfi&x^GoGq_d@w23Cx#cPJb_C1!?m|;L$F$whO#i zD@X;v`>GRO*H(~nA$1V>&}nz_OGW>@0e|!mePJCu!i~9x&ulFdWu-h_^)slL|~W^B%H&EqTt; z%?J*;+JRdEV5SImX8cl;zd&@rj*?sz%EXJz`q*#n~AOkzXJD^UY>c{?j4P* z*+*x>tRghDPQtX0d2c~2*--$~Cb8gZvhfZT!pvImA^N9T*Yr1ldm))?-OW&JcfdHj z5PUCnwLpAelk0IuPp-e~+TF6eO#qK%U zfa49=+K955v4q_a3%lAqBFs&)`&QG1%{qbnDr?mxH@0K`c&v|bdjyNn$A5CpCR9_Scs@R zi}=ol7vU(8P->Myt%sa%ra+s2Hv<|njNXyOYH3xN6xiWFt@8dv!Z#l%JhjIMavEcus1(RnS^ z9#zjJuw}*VD%?>>*Zdmu`!SP0mEYtc7-7M*0>9^XAiF?YES`-6I%=zuDd|SuU}zu4 zRSb@U7caP9Vabt2uBS=!{pmPVk61WJIb5yqFU1WAmEWB2W<+@?rzsVO-8x_BdR|Rz zIj!(7$x9U~kI!N!QdDWx6-OR(jyD)9jw~JFM{uodrmElov;$4uH{wsPbK!jxgZg2L zO=l1p>bZ_Vj{%~!4r@K;;~@;{1&HI_0Epv}Wm2N+^}0!#8{O%^-NFZg*^+W3xE{zV z50`qs_kL)(4^r)5fm~u{q^#bFeXXWiLSVMA)=4G*{D!L4d*=wd_a}C7|jA&1QHQuT!r#;zYP-<3}GEZ(z?*)&XOXcCJ`0vV8OZ# z?87~e!C^awk>wJOpe-Fj4eVGo0KL+_YtqDx7NH{RT&qtqRmS2J^t5;QQAj&5-fV5NnRbQlWuYda)B8zP zmis_3$DQPo|K*TBcFKEcLLGDflkW>Ke%0#*;_1GC2>yZyggp+rzW9hs{u-D2K-+W| zNro2J!VXp$*}*Eah%0}IO{TcX66Y+@udXPYduqRQ`l znjbi!94D{@VwjD=%_7q_OeoQNDsl&(3QQ>JzZR0P1t`qn9aQP3NRD+a#Zs`nB5Urc z?YO)M0~2=uQ+^K*KGlM$pdy!Q&-9^ObA9$Yxy2L^SJ8Yk%7$Lz(u=FlP+BXisTsI6 z94nc05b@8@IqW=7KkoP83V;tbjO-H#lRYrO>Xhp^pryIMZ~*&=`meFACh;$ z9r9jRgNhj>i>s2kWwF7$XyRhrE=~x+6gYBFT}sXy;wsOl33dU83Aj@b_YjK3%_xq& z^;2XM_NLILiiyC=^9Fq;L-zQMB#Hc$-RthlIs-|#1!d5Gr~(u}KD&*Veep1qn`JR4 zGIOwQh1{SdC=a=_>64Pfcc?#%yRabc=pbZv$w(1lxI-NB2wnFiCFw|R0^-) z12A6fGM7Q39cGO8QiZqH!#c|j2kx#GSKNnysA^R3U4YbT3q7dJN-P~}W|~(nCcfWm z@sW&{8XpQ2{2Rr9`o(nTX&*?rFB~nIPcOdJE}wuw8KCg1ouET6$;YXd4OGhzY!LjC z>GT*}b4~^>3sbD-)AO-UoKvG)%k5mFh~buEcv04$&<8bQ9G}adjUII4@A_8Q@|G}m&RpSw_v;g@%nQz zPgnS#G+2kOqaWu`AN@=j+CV@3k;61=<~qEcAgL%r4S4qlUC#4U$@23z7(NI#qe-Z# zSe||pZl?SzFb!h@3$UGlANnCIcg(T~dNG7;AWXw8i%dnR2wM-BL&!QqGbn6GFcOxj ziiW^&Ht$pghoXFl0ow^Is%RZo9ds99R^%n*gzXIU*cs?)XMo9)qG3A&LNo0N{e*|a zYT=Y?xj7OlLBwtW$=k^q36ggRn5Jv(rW#6q2hdo?VM|Xji82^DVHxiQBNe@pVl!T) zWSnRTmQC1uvUfnJ@GS1WQu@@28_CcG?Pqwd0a(*$uVP?(l{DI`7}#DVjrJ-AwpU4` zy^4YDRnlm$VqklfG}@~e*j^=#_9_M#x+qJcI)I^zfSO`(Gln2a<>)|9I15V~U%*C7 zMDZyD|JBVBRpu+9$EeaeU<00vdla%HL6UsW#yx`Fkq~vD4iF0G6Bi|6ieb_?5xot$ z_?|3_%!(a>6}Y5!8LoR;59OGOB8#CtaEF)$rT`2d zgJ>kf)sT;b-0-44p&4rdGncARHrd#LbH0?P7z2S>^frt!GML_m zF&PYoAYhpVRYeatKddzj&S*~ZR+1su}DpA(M4~4og0$vtfdE)KzMBjdPmTu=Pkv9#bX2ZM{A<MM0;*bUz+C&`R_8*?{#FMzti+SOQmn43=dULmg3;rk`u@*(TB`7YMf0RKH zN(~rv1RE9s>Jp4_)Xa$_C8ua`r2qe!7WqHZB5c5Yhgaug#IR`*I{vzVf22`@uF;}Q z9T18KgY`N5(QT~H1pix7CWu}~f~xe;oENrZGIrc-n6Flfr(4M|2uGFb_@&|kS_Pr# ztc`HD9N2I)EO+uN4TnNSp5M?B8f^yxe%fh&Q#tLoYu7yAhN}dM5H8<`XZ_IUU7ZxN^nBuq4Vo8jf1hQHl%r zdx)7%?Wm*^dM+LimPC;>oY?#@DH9>mib~kBi4urQt3;K8@)a+rhi_y>g-fC^dnlPa z9K(qUMSU&WiVC-E5@|(+;jjq!8pq{Wglx zB$VTPrNQAH4MzJ}$^V7HDrdJi8#Vgwg8;1YHq=Cz0s*CqPDiW^l_%3{wtA-#JR zI~i;IBp41kZI#QdroFgI=~JtBhTZC&P^*YUv| z^MS(J;5s-)9qb_HR+#WzJdRyt?mujBC4U5dbim<1Y;+}`Sc~{w=3bY&6I_VB;2{?C z1D#{83yy^&Ow_2+*pg4M(_NNv3QxH!xRQnM*H!ogI8vc1{7>bL#Rhw6fi*3za_RoS zc3T^Y1Y_}M(YJ9K6pXoSK4IZxIdemA?1l z@FUvlCX}RKin;L|3EcP_;yhJnJm>V%R@4=gd&aa$!l668`s>hkO)lY(w}?itBv(rQ zFXKkNREiI@d6T@ql*VwpWU+c3b_`>i9DuxnR|0eWYnwQBo82qrAc{6bb*WdTQ7F4A zJm+wNWUGSpb$kO8gW1&!_s}=sY&$?FFXG01h)caV9?Xg<>2c~6@zPeJh&XEn*9F0| zSE}k~_u~5aGDtk&=7M|M=a|nRk0->eGZHR#G9OwT0GCoXrbM4G$Glx!$X#nGz z60HY+-|1c2;4tmSK(E7TYp+m(l`eUx7dP#Pl#sY84FM>J4tWO{@=bCLCOaHBez+M6>bau9`0+YZp2O5O`da!i|_Ng47g_p>^y@rxeO&)@9;Mm9m#uj09Iz(Wgl^zyS1~l2sZ=zv_!G3ThAPy+5(4DE zm?Xlc?dE!F9g&S@+yz!jjRp6$hk*qTlys4vci>W_okX;6dT{Jn+rubbC|NJymW|Fle)eIRm zaRnKi!+0P!84H`M7g|g#J`GpfAa?wS`&33}$@OSO>TTjGI+#Yi;*wzWq1A`z6s`(R zyy#i1=rq0gq<1V-X12cXS7r-qdM-nt*)0m8Q9&q9Ux7ft(PlKDE!X0CMnij5MPmSq zEsXXH4XsQ?V*o?*!HMTe($Eg8Xbgx!vjOd0Hhnn&@nMZ2y=gnniLlP2$}r+Kgc3UZ z<~@bOa06fxY7S$rZ5)KOvM@l}79E8+MU}0jS9hDaM)draav*1!X99uI_>} zk~e?hjQrU{Zy7$Fb{d@#=H)GTc=n=#>GNk4%$$2sIE&`x6*9!godkMY%+8Knu+#c4 z>C8}E4tn9i6p6HG|3J@z-wt{!%*~j<9V56I8Hx*W3gQLYP0+JqcK4BCZpLu#2yTMP z8Bit1X+se&(B6WcyFT*&27Fik!H#|i1m{=>9!SJqnDaMOPR3I|UA&E4_(Qp;hjwPs zdtts;>%154EIB?ix>d2SosQVLGDsHPyjs&KyVGdj$gOB}0_TJjx&OCzK+$WX|M4U*^#0G|=lf)J z4_LVb_p(CZb!h`$P*Y!7D;5)nl^v%oN2SrNidY-5DcVy?cb8Y5Y4$-rmAF$RIlAOB z3xH7n@R1g+rH#1hdk>4^Hbj9VJJ|Z1i&z2SikN2*A}HgN3%l-V{u1I2l^^Dx>Q?z- z`%y@jnm-XL8@7G2rt-|fFV|EywtoU3lwG-}{UC%=pTY^~p6GkgB~uNBIwAn~W8fb7 zN(Hhj>v^Dhc2*jBnL6$$M|L29btl^)ELm^>kuPY(@nMuXQfw^t6g4&sL~e^G0TXAD z4VB0;WciHlVc5kA@+;zGQH500=M3RSH`s0Zhi?}$dfmr-t5{oxd7pH#iZeZPVKkMQ!g}aG$@g0&s)VYi2AR^Yq*8vC_ ziAfOI&Fj@}j%XILZcZj`SF>(THzBcZz9G7sSAWml{2*;+#OQ7gi9?bzjOyk`RI9u1 zDOPtuxz|T`^Kzw|mmA$)9u2Z)sjD<#|YJnttzLAZBT^I!zUchaR8DeEV_g{m*)<(f0G?|km z7BC9N!J_P1>=kcLvaGo|MG{WHFsw2Zf`r3|0))26FzwZ$h1B67$vSu`4TQl=140=I z3?+X8#fL+4TrRXG6+@v0@!`{n8-~_EA}GQEGFZ5AD8hlR93sQC6hs{vFid;FkW6y*YH*$uK#2t%lPzIY}e~Ju{zu_m^SHLCx94lamyO zO5PHT%;1^G-u%^-IeN8)Si8(5yt(*`COK7{MKF}B+KX4+qFYv>KUGggd8!{_OlEJF zXwMNNz7y>^B2&Q+pMYGABfcN{1SGPHQ3Yn92Y04D7g~l4i>5vMp|3oTR-&sC>7gG+ zdk&ALJu8571fGB7j+LM z#v88xk!kRC*Itu;^;LuZbJ{VQQtkYuX8M2j`@`p7AsXb*7?D8j#tfbN0AO*jh%0Db zAyOC=u|^H&9{EYZHOYKW8TaMB*w*gcQ%GR)guF}`h z4J`Sd5vlKCY1OfGeJm$640EEuQ13>avUZ~UR4x0Hvn~317VlApTTSk#${1Y6(}+h)P@$<#?vA$?m0^Df4F(_musr(I6sMs+SX?`m z6j^OK5Q26VD+l5oTnC;b+ZV`HT$NKJS_{6kZ}$PEqvG&}Q@)DEb3d=j-LtGZ4}Eu; zV_6(CYstef;)g^sI9*}WAY$rpxBE4y4<^M33LNI5*`D$jY%D>$=NUGZ+Ax-0;A4q6 zuQ6lEhuHX7vQVLEd=1dtt|7NzIZ)VGifBw_Fjf7BgUR33R`Gv6m})SXaCR7R`301l z+c21ZN@b(Lpa72y*O~s*4&U2a_LzsU~tTJro{HxTbb(?khByu3&xS-;5#% z&06T{+MO60F4F;Md0;G44KMmp@I6MKTahUfzJ9xrU5 zC?h1dG23z)LnE6-M^gn0wxi3TA<@vN4G#@=PR>R~HD>;Tue8nYNYn}M;iwP=x=VxZ z(;!+Qc(1=Og&n4!KvvxX!w=s^i^KnirLu_#qNiJ-Ws*wE>U5af*+ZmGyg&pHL3eF> zb4!@YzJ{YjP}#RDE>x4aMFMq2p;|KhSBI%=s$Y68#Iz;ih@QH>JEi|FmED<*t5UqY zok%)qGE(lEre-8EYpQfLSZqUgCaTf8x*@|ez7ywm_$@;tZk|YEm2n&NFH~AHvb!+P zE?(aU=XOYDG+8Vn-L7qg+;Vedmaf7F*$Vj*fAmm)V{$=V*a~S?a2O(9j1!!hp&kz~ z=c~~fZ^hqK>ScIHl!#H|F}6a!M&GLfj%qTBqy-sXjIEF%h|35z=L7@AcH#VyoZZAzLA!639#lbXn-mg=E+Z;pRc0H8-vNas;Gu>UA+@ zFJcN0l$a+L|6=T9Tuas!a8h_B*<%n_A3>Dj%2nu`;L$R(7ob3mp(~)qdeMe6ZiICV zTn&u~2Nq5%~aK&F&JU{ zBRB%zolI&xpjnn+oPQjXrpgk}P1)n8{7PAn8`Z=F8QBo1EZ=TqV=I+2#>mEQxLv@= zh8eXnP^rQZovY9(YzsaKA_ZLAe{YK8TA1R9-i}d);qQN9mm>kGQqSqaE=Lp58Tjjf zYBM*L8*7*2R>i%d2zEKrx~kR`%~;0~_lRm(6(DOJlE>E~y~}z8+MtZtQQ>_`&KobN z4FNMAy@cG8^ONrAL0wM(VV$g_^O8zB~z zJq|fWpOh33H{SbrMcE@{&I8hm0kYn)6NyGz@3zKAhw9=FN3_$1Q|ROsOQ7Luv~aJD`W&R+05mYoa5$#VR+b z20OMpJlkQgV<$J*aR3H8o}(-{g(ebsdJe`i+!>uLcT_OT9bF--COjs>XvJSzTWqF% zq5Gmuc)$m?Ied0`X^T_d4Qm8YF|`fa0nK-ku%LuVY~r^%*r|B%w}|C6#3CGULHt2J z1NkJ15=?v5hR3+mWw3qm4BAn#;jxk;aS2Tohv%O9NHOIxg{)uvrS&v|lAzYwkbkXa z!y|YV!p?z=)3g@FW=C$Q73M1TNuKllAP%Q1>`%2e(3K2pPlvJTfys{jYMqhEj&g8e zCdOH>Mh$yyrQ>0<0|!vtW=FZrRDq9v?7qFRG{Uw0KAe#6Gw6v3J|>Rjg6?8AJB+95 z?kws5B1&KIB696*_1R2cD#f(+pgt6RIF0T3v z&Wf21vW5eRlm?uOI?O(&IK~Hoq&l3)(Xs#^Xr#;j;BkyWn;Aw+rnNz;re*PUR&(LR z#ex^=-}$ZB+X7vIWkbL_+^jjOI; za+k?q}+nIx0&n4o|tpo0=kR4@SqqM|b}2^|<9 zQC=#TH%TBQA0!kcQUJ3+( zeE)N*yJsc@m%Vqr_xpa|t@%~Wsp?bDt~zzP&Z(+tC^vSdyC!sQAHBL%RaEm$`pd=Js-BWRnpGHP1`2QN-`B%EC2aH>aS;1HT}JcR5P zlPX9wYKXHVFrbe)4O<+sC&yQfAU!F|;!u0S=Ow%C7+&~{%%Wl#;i1%li*}b|Nqdjp zE6xU*WEoczP#k)#)L8T`wfqvkSUAr~$6u_+-g{pXVW8D9IilY&9%K#glM5ZS&rPzU!yU|Kc|9=MedSe4F>RD8!Gp&ASHt zVgOym{P|;T^PYj6NK!0Vxc}YeEkUYvsSVyDT-`=}$v^eM|8Dc9UF(tEx<~c8;!3?u z5J3Lk0Rimq;|~!2zIuS_ze)?x{QcAb-G8+R@cXaffB=7g3JCNMKtPaxpkxU4)70|+ zm$`UdI*T?-YP%x4T)Ae9PFp0qMC`oP8%WjQ4bQ-?0Mpx!|0nSO3s@4ZUj<91C+z>L zo4q|;11dkQe$(u-X=rnHEG4%XPB z5G>Aiwb>gNgz!Ul_+o_lMT>Iupv$}}f$2w%i*_eqz(b(29w~_a`eSbPMqaAyC6GRe zLIgetAZ>xc7t=H7JdGT#N@0ZNQ(S-olz@dha>NLJGHm3?i*%k+&Hk71KP9yZBo_2G z(_y>Rc^VN%k99K*9g_6JBQUth5K&|4Nhcw}Yarb5!1;ox3=H*SmhJ@X#-Q-2u;*1A z^0OhS!^j}vj`k$@A5w?^s?N|q(}~hGf>?`zR;^ey=vn}Fmd2CXFwTuWTJ2W@Vr>TY z@;A0`U;rl%ZE{`CY^m6VR>HRtv~xcekj>(G8Fg%Hf|r-j+j`)C} zA@A3j-@R~$RnwX8Qqf-MF3|bqq%Pk^4wMHjrMu9u`{+UYsT!O6CamRV?uQ~r11Zl# zqo5qsv^+Wx>G(zmv=6HjM3Szrvnm<7H*ON@?}tK6L*@y$Ers+HM9fxveod-MEvLia zYkcAM4m!!x=$Z}v*zkY@y*Rz@P%VO%!qj0@JQ)Xxq4QfF%|Y(s{ZPV@oIKQmSQkPlL1aP+0(l+Id~uo$ zxpdA8`aMt{LSA@UoymEziV)PCP+91MiL&KrWoyeMg$SY3fCfRP6HFr4(99FFQBtjD zh`m>feTkZJ>@ZQ-aFI7DQBV(DUL&DqoK_Q;r1_$>zUFeGBv8#l$x*`nP!21zJa!y0 z+no5E4AM99t55qOA}Pd=n527jXgo%g(4a^KL^4BFhaa**9&)o#KGw#Y$wP%sDb4_d zQHTLZXAjUIgg$x?8{!IuqVwWr(6+}ALMH>TDjWvW)`rhYz71_Sgn@KoSEWyT1b zRP{hLEq%N1S5u&LWa_R+h+T+_FyxS)4TH^kstLW*df{Ubi9?(s#>ecK3kRU~hJ2uu zXCRe12jg*)&8YxJr1wF}%%{`n8(h<3| zQu>q&o_zxqBBakL$RQ#jj4LEDL6jQ`a=h4dxE%X(%GFd~oE8I;_D@qq``|9%nP{K3 zR)4Q$RUjxXh|X3K1qo{m0yo@({Z~ z&yt$c-2U$t5-XDN>)~th#dixa4~Qr&D7o#ZUqgt#CCFS#Lx@-jGP~x7jq`I9V@2S< zu&t9Kq^Pmz4~2nwh+W}yp@$!$y{Le3W*&S$tSZE>wG&Q2ikHwq5_+$;go>ku+i=s* zZNuV%D~u7ej5K8ej4dj~)>+GE8=fy47=T0|@!RnugA3RRg}van9~=DUbAgXK`*+^r z2>OgD?_^f@Ik=hLMO^P8bQ-tx_~NmB=%3K=$NvOtMoaIX#cO)zYB!}bIOFeG^lzi< zU-93$d_RQ8ygt~ChO<$jQHa}crkA1N%nUll+)iiW+pY2904eG#g3=2GhUwF1+$S$T z5`_#k)rE%A*vfKFBlai7wC^w-7xO@hi(7U+Vn&7Tn6cr3V{i)iVsp`;h9yOIsGDlP7a+Py%ihTnWQKs{G&k$o>mOU6#;`x}ese_G&@dRuF zxNV%nAuD^39J1leY;Ec2YQ%xm;BYKxTj9zarRj7Fl#DDD22=oAB*RDvYi7gNqsQo6 zr77SHqHy>u_^roL>H3=X!jEt>%Kd$;l*!52l4C2>OYqkmm05$*@5_vbTgx@sg`6)? zikTt(EO%|O|x++PxS4yFCZ9NoSe z`(NeQZD<8~d546WFYMFi2F0+i+@c16&4-`v1tMv#33b_$x&J%)Xk_Mb@ZWQ>3jlx6 zd8WSyj8L($j^1X-+%elay2+5)`i*=Cc5j?GFW=7`X=dwBY>w?BKr|f%)JA2#G~X6o zvs$itjI{RUF;o)Eqof;tx{+Y_BXZT_1Y{ndq-1KOmqb!8O_LqF4Vf>^mL2=?mm|}g zAgm!YeKA%;ROVV>eS<$>9g50qMQ&qFt20mL*rMl#uFhPGSf54V{n?^3!w~GYML!VE zr2#8Pmp$Mvmov%B_fg^SnMaeMrQ#n*US3{P4NpL+DCa(ub07yuMWr&L5L8AKqD>U_ zIQ~QfPyxRd1w4QPqG0xRlmsQpKPw8j2L+sFi_Z8S!INy!_n%wMasTyn&#UQPz&|C} z;ZGmwUcFilrOzK!jp`|nfv%lod5rYo`0b%})pyp4W@qVf7N!4-7 z(XFd9>#+M~AJte+I1qvea>7?eIkr(YoTdJ!G@^s?9abG+qT8u;tHxJTkNuoSmJcc^ zOYV=h;z4FBM%qE7JI3s&Gt{>xICj!Yl^h?Cj+f;45WYmSV+S7D9p6UbTUI){m%1;$ z_b@D5oK<7N;vbTZUX$5+NQyp$@}8HX?=|56J1KfX2>!p3qDzdc-@q3E?b4Wuu4g;d zXmdY|GL<{49xbO*(0KQu=4xT)i^Ak{VccdE23JLKS#Wv|l_idYOeYl>ktmFq}U<__d9qvku%AbCa*sp@jPB5qRpqt@Ra<2TaahI<2)veL*}C)OkS7LOZ?0nT@r#S z)W&hsR14DlcT@ocxO#Ql2)s_@X)SrEQ=a?OJo5wdzJb!W2B!Zp z1}JFinbjy{4d0W1Jfcb_cFNnK6ri%SXXGcOvrS~z* zAuLt;u>OEu`nqAeZz}-@ktXf|qzBCnZ9dG6D(R@lK^}J}SbV(V=i~%_6Lq4$TLHE5dT|C!oDLlmMnig#8ZC^;`lv z>P3XbgJ}|BcL5URyC0Bvx<-fm>Zt04ay0Mi9Nih>UYBC#V(|_Z2xcxr zW#-=VGjq61DVLeKF({$4%B3-LPTaYq)Z%^{!P3QmrNd$edQ!pQki)1F7LWXVoUGtT z6KsJL7d8?a-a2!DMTmy0OWIC=#e(Md>D`|F;O$7BSYNZW2n=4CkyOp=YWAZS@(MN5 zb@n=zd19I*ZD(F=AiZh!x7LHJ5?t630$Z6kYeQ%ImLWXXxG->Ob_pk+ERnFGO>noq zI_iBriYad%P&DMeAn<$iK2W4HtCI~li=nI3tTdriT~tK{!0ntznS682}PF!Il1adMkc1`h+ulY z6-*C!&rB-oN-Ek*^JT|DL*^=A9gfOe1=eUE{=kp5;1AE5h+uLX0mAFN8EEqafr z#5i93Et?n$zRniCLj>N(Yr16*hErvTeGB7GQVSK{&oX{4odbQ+Cm ztU>#8Z>0H6v;?@t=p&e-;oIjAoGnNDL?AG!`=ZUjA5vLb!8HB@RROnnL@kXjnDsL(PAiNzIZX5d0-YGuchI5}X%@i4%*%Sn6$^#`7=zQLf7N1()SH+kg+_fpvWjh6BP$#Us5D<`BEq~BT5#B|B00TeO4qL$3%nK zjaI=9@yMp4;q!({4c?dj@Og6*RRNnvf8UAO`y|Q&LWAMciUNW^CpP#fPvvLYHgiEb ztR)3p6qIS7C=Lq2h2esr3~0Ib!d=wD0|hZlb{ycQ@`*f~MV@;_o*1M=-0-qrL}m~# z6rJX5TLGQ-O+_O_l}sk~g>yw-R9CEI*P$8O3%7CcX_E&&vQ;9+U)RKpY!?;4-hHI} zEvNbwQa#J_$tS1|%>*=I;GZXu02Tz3O8^(boREzrYa@gLe;23;Qzne`faK*s5e{kDo)?*Rb1nk{A)-*i{^!Fq%>1S;V7c zNYxGPzFNJi_27BMw>oBt1w2bIU&%bmP_)t_%&K5l=FoM(%L2F*a3|#`kWfH=$ezZ_ z_;kdqnD^HKx&hWCeG6A`0Fj`9f&-v$90C1Jhd$DwaTwO(X}%7f)ghD4q15Rd${NhP zB1Sa+1hh(r+5m}Cg<}2}rHTS1N;O31T9)aMzA)8Z#J!@&v#3OU>k^RC_0LPMd|1D~ zy|9J+b?Am@FFSqO(9^)M5Dwd_hoOVojU4s?7>k81W-N4ooy2tg0#a{iTX+l?{Sp(5 z<*FK51VLgUxCeQ?t*_xU8b_jBoA`y%8p-<&XP1HhM3-H|g~}rmOOxJ3O0(e}6`Xr<OO>+&e*L^apIZ9^BwYRn}$Sasjmed41>hi z)wRAvTJTG3lB?(jUR^;SJvQ-mZk}r3i{|aJ@e|Ko-1v#-FK+zA3!NLk;W)K9HQ^S{ zLTkdyXnc;i;ApSjA@;ahv{$oeubJr$KJ9$TqA?)_=i6F-wWc@4o&4Ix3uQ1=XsOPaj_NwK1@KV|lY=@|)cxR$T# zHLJzYyb+>Qx;K&w>GyV{G6#6Ock=cKe%gaH9i`QA;frt0==qP0sS&@tx_*B6&%T{o zeEZ8;Z7)5Y{rs?%dwc$V{ijQ=ZTooN%H7S++~Qmp@wZ3bSQb8H{Z~I9_}-J*QEv}C zVSRnBykNu0&+VHkezJ4VHNJzN%};%6=eLcOJ3P~$Ex59J&AjZT?V0C~Y|VLm$}B_g z-34J;Sz|0`zw2SH+F~ud^P#AG=Rte=$0ZALf4BXh@viYZO%u;o_Gq5>R^-cP*SvLm z!LxrI`^naK_S)LteYLfqWte-`7m3??eDdl2W48bK)wta^-XVRSTAsRVOW%y9_ul&U z%|SQRubuwOr#Ei1y!^NI&#w=OF|Q0w`|IxRn+Labd*iW3if-%W%$xb=ff+SphRj*_ zr2W%Hw0QrnwfWhbqdq>WRKBs`y0_May?pS!-wxlo{_yX%hL?_Lmn=`LiCEq5*`E8~ z=`pu#$e8)&X9}`^ZkUzz<+rKx=4ECS3}}hVsho_Dm~WmAD|q;2L;sp@&5zEgw|uvG z_v<++ZEs)k_4-ZTM^2vat9Y4)+?)-jc#$P9Wl={{kF6rHu4#d5) z)Bf@o6Lvk_GG>1L_TPX1?I%0tw&jmIx4Upe(#qVwG_6nHvv7#XacH1%c$zcvm93BT z`0TC)p((G}LvD(S>b7ZxwfolSxAJDJtt_%e?3}aVw+Aym>e>GJL(gvA9ee$=O|QSX zW>@1?W7gikyvLhE@0|6wxBpVGvD)fc|INC!@BOO#fpx}THNW9X82|Ct|FO9Fxjr}U zHF^4ey6}o_S*;a!WZaGE$Tyx3|A}Lj6i~8@pubZI@e{A7AAaeRPnNCP{$hP?%jkPgd@<#C?mOFaXT1A|&%)liXX41e%6o3<(c7=xeSY_?17G|6!PjfE ze|_VLtRug9X|6kR)%=h@g+=`4o{>F$mAT<1SI&?^AD!^t)4i9jKk(WuZ#+D@|GMtK zexmsoJvM!O=J$6m?m?qb* zH6~=-nES`mebbvJjn7ZsySVV~33Io<_UQwk?4Hx@3)`_fTSndY+Pi;hc>bNw%eMV> zd|Ss`aRW~L?Qf6QZhSv()!O_1@Y0)uLq|4kTotzK@3AvJpZZ?z?i+?KowIiRgpB%- z{&};Xx~1smQJcEG`Qj7Z>-v8Y`aspukRccA0A!V94Ih@qr%Eg;&MKJiE?AJgAgv?^ zx|x@We3@uzSw+Q5E*E!BeqlzzrI7vQ3=|xLrvEqVD11uP6lVR;T+e|$Q%$t`4>k?u ziG@ogdoyZTyI)7)79B^^$R4kT&;(^Pkl>gWPZ}-eU-)$tCh0g@EG<_sbBIM^9(4|E=AQd%0+k+X`Iq-EvJ>!b#vDN--YbI-|4 zTbMT|&6SZ^kfSMBqb_PdWbV>}{LGpML7QnCc# ztyFOUvJvTxzFqUvKjGDMg*SXePytDq>n!kQQU`$1^BobC94mcg0;jq&-mu{QLJBqS zt2mq>94_Cepzb0~M)+62yFE%^>Fqo+==DnJc$^Fz?R+19`9wU;r7YK~X=!1UZ)dG3 z>h86j@VYvqh??&G%fO@Zv|I)rO+ULY1CJ)ReV2*X+7(`>T?Oqh^^d1AxGD=pO_{i&4LVf)?oj{S|cnKZ}y>h13$2g&y?3Ni&>==SyG`u>7) zP&n&;`+f^-###-mH5C}CGPDKC`x zx>as<7pQsQo_WuO3+@5&dr?b;G$;-u7Ph%>hSa&kX>pwNb(58LEik$2Ap_Pn*-K|7 z(4E>-tauNu{*+AIq{>s4iVu+h(n?lZ7!RjM-~t(bAJEV6)LZ=vi*>5*5`@VRtS~l` z^veA|CMNQYwrujrUb&bWyRWA-@0`o5)y3bR z^Ei%;hihYbIr(7PR*)u+SGMAK3bk0r+vXxH4i6uMHSsOF#5S5FS}me>GfB$;L4^!Z z6(FMXCh0BxX*HlU4r>84jiFXRH1C=u8Eu`;P!XUEhCF~W8G1v1+8Z4z5;G~78siL=f(U}s5HTSO=WXwU(b>l$sOf68?oMuxR!CXiv3pTXV!_9*4tT2%2M$P(9{B1 zDxZVLo0?bI?27Q5{oYbpMSlAL2=wKwRJ6H9Q~-(;=zYzTm1B+c`6q3l-nM+1T08V* z9ts%T8zmK zZd?5Tvc5(JNIEY&r?bYGhi_`Lyv+CP-{nEGobtI4ui$l)fikDP`RIleSeqDCf z5%!NV4Bl-x&WtO1m8T4pF+$nFSt)zu#_`37Dd8=-B2mULL41`Nc`~M|r>Z??&p}zx zT;pCWd(%K4#neXApK@F@R#o>f&}5+pj3auGOSNkpBWTkg^pFLvT-7@qDp$~rat+2+ zDf9&cn&TLZjYSMYDFp{Aak9Sf#_@UQFy@IS2tA;>TYxSqOs=53g*x;wAVGfQgjh|_22<82d~po6H>9Ux9)IOFg!oNp}NsyBH6&D+$exYek~ z^jcmfNJZE!kCo$rvKb@*Tm|*CJK#@;)vm1hZ^{P^0V0D+bk~Tq(Q8lfw-P;y?OeZp zUOW0=vnxai@tis5?xFUV*>yyC)$XkIAsj$CyN)KHWUd^MMjGW>HFW|_871l&SwusQ zkQ?nx6L5zp_uc`XB^V<;i9Rbe+^*=rK;nVYXwO5+P${6>TI$9Dq|O-JRmx`9-8Cos zj_B;Wr6RY>S~SOs^^~F#%q!6g=_lP`1=Pg_DY;A2a!N{yN-kdN#FP9&*Zho9Iu`#0 z&6lZ8qo)OZ@ZzSSu_M`50IdkH*20vS%IaU9hWQ9k4Pi>E@-t(oT(;u(M#( zVTlsv!4|+4!+rx>3i}9bIcx=N8|+VEZvs2?6#k!u{SE93u)l|;Pn%a^Ux$4Y_8jcH zu+^~juv=h9B5rqBGPE=xPWBLxSr6;3Ls2@^TZf2!5HT>|RmiGCgLNoIhi=uOI2{_H zL!))*E*-MzkVA)L9dhbWiVjWHp_w`~ONY{RC|if}bf`dwign1PL!~QJ=~)$7m}9r{p*nsjKV z4z=jer#iGxhYsq{VI4Z6L&tRJTOB&1L+5lzLSIz-pAMOIsJjkD=}>PSqH(A8KOM5_ z&|n>k(V<&)C{Bk)=uqHNDgryLd{fB3Z!agMg1ZySfk-HxHKBpeHZ(nIHyLNHW3IMEw9bwg`r+!G*Dd1eD&e* zo|b^T5Cmh3JvbJQK0_G##+*6oSvprrTC5N? z9qL&|!$7!X5~N=b#QA7|a+l^5aVG@aTaQH_@MLIp%4ndGL~nWKnetp5q6P@Dh+hFj zI9gtJv0pIPMngJ$gj-nm`#m^mO?@_2{qL*CBI-bfzW@DaSG^iuvlqv)@e{xF@+yuM zxb)nQW6>xh)9t(Py*RTC(9nf0Q9Qtm6Lfg|)d&@R1AydyZuM{+>;{Np4UMNTp(__m zTdqN<(V&%yaB%t?T#hx2{1gJ5puGB1h=JF(02SnQe*j0s0peK00l+X$P^SO7zF(ubh zh%h_U|LgD{EGeZB=@OFCdni-Ygh-3C7P^Y&XD;-IpqUFa%1@z?re+ir6lG}`qQ42Q zQwyUWD0s}^kS8@S{zD|46sw^j(wveULHhI%0`{vu`V%RGP1lVGxk2|6&c%0lsG`mQ ztmjZ~A>Gv(cim4V1LanUF(3_59k!Y`s~`urc9)ds&&5#F9*Zvp{h>;uwN(AFxFOQg z^5++)r7dQUmV%hBG@qDEH6IZ2sd&tD>DC$FF?TB2h1QOlB1 zke^$albyz|MZ-|%j7}(OpU{v*JAnl20cg$@uwFb)PB8yw*xo_iC2K3<`MahV!!6tDI8oy25}ZJh$iqlNpxRC_&nfr zCtd?E()P9wYGRhfNof zTAG^MkX|Tg0T~)5x}k#NxVYR(gK}eGn%`B$Jru&YEwx zIJZ<*+b#08*ewd~hM8@C!%#PT*6P5E0tB^x$lKcd4>7=^Ul>)SS>MEWMC;BqeYCOJqzz6jZPC&w7J zIuhC~kCCJkk_>lrV*EGW$pak9*G}B>tei=VJvU=HYyP+X5;e5$HpVy&mBEH0_ ztXqk{fcm(`I=n-LOrk9lNtX73WC9hF+NQ$Sn3O`W?>Zr9^$JlYqO<5fS*hl%;vpTt z9`1S)#o1@sXWMBrN}U%Gt*|Cu6BN)<_$P8$IyD|c^eq<4(3^mW(>F=)03t5mBz*u# zbehg0AUd7!scIaLX2(@0c5|&e!>)Dg8Fnn%;$4J#&V28l0EwflG$o(jx1gWCz`xbs ziQ}t%u{geLGy0$FTDm7f*~+y-@0TNv%QbCQSFiYH`SdAO;K(c3@y+m`7>^>-kTvm{ zj-r_KK`wf}Sk2euANugSPb=jFA&d*fka6GbH6Z(b9a|Jbhdl}_z-GBB1tR=Zvt=Fb zVVA3>bp))hqiB|O(>h3E)^51EI)XMIKw>%l|C+1=rM~o@DmJ5Nva)OWQkDr=D%Zh} z0bb^i+}C*Sk=%VW*lminqW%1wu0%57R0~Pf0GonI79Dw7xUiMnb6RvY#Q@+IDb@$d9 zRbG!Y_zT8&hi91$Nz)gB^+1)#%1V;0Z65&d zWw<<|70ckcSl_H{KnNe-&wPFn* zxp4)T5n#Y;Cg#GvVJ2KI9M$v)ME9cLG@D5syWolI*wvU6LtZGIcsU${QG2APcYGts z3^^qp_r9zBB~t0Dpt%7m3`3CUP*@YIYfNECfh*`G6`5YRNxBjZl*G`DfKnMs0CX=y zsXCMe$i`vCfC6YJD`<6^d}ZYW2&F(znW{q23SPkSe6@Ltr7{+=mp`nI+X3+4&M(Z* z-f{l18HP~L!x)?QHI5Twb78t~0Jd8t98->~gYzQ{PNQs?Xf{lYiv6ha6y{_j56*{q zaK2NHqVk+91g|_e+x~*Ej%}8Tm+|lL-buG41q~L=?L<2CD6TSK(S$$Op3vd2jO%cE z=V2CZ+Zc%iw5b@{HFo9O#MmSDj(QAxC?|cz#}Ist69o8`QBH;|NX)aM5@WxbWcbpd z+zBzXJJb>TmHVg8JKd7&D*NUz^y);(XK5VAb0h`3+w}M8p9lRzayJTLg~e(!8tguX zt_LLEFmCGetIB};;aT5>J!~Pa-ZatQ>%#|Uz&S(Sq!>fBvVx{{*_$+4R#vPeFo37A z`bGxe2Rw0I>sjWITt)HKp1URYTxK_(RM{f;W4`-EpS@T1E*tHAD8{f?>#M=}Pac4? zTnuM%JC8k93~BHjk;X73ETN@jzb~Tn8nvs7;w72&#+hCBgZzZZeg}0~!5C1V67=mo zK!R-`RzfffrvM3Nf%;)UNB8r-Byb(9&AU*e!L$?QNs!#onbTO^<6gT>Qz?Q(^;SL0 zAYBHbeX(W)LDU0p0j<6y?|aMB)sCtW<#x~J@8eHF zh7RpHRjE(*PO)-7^iCPT|4JRGt7x&)d#^s_h&Uxg>8d^gQF-FBP10Dnf(*KElUmj{RQ9fT zmXfK&*3D1=k`os}B1@i)eUlg?;My1>Zb!8K7l7{Iup@d{ zr<lx8wL|PwT$;YW0X+yCuqm zn>M4IQk31&3pZF=dN~bIIFremoKWZ9Z%^1^srU*hoT}|-smMjX$_`KK8Qgexb#hhr zen{UQyC;w^P4SNCH$@q7HE!HCI}`T0k5U3e1?^S$cHpGnaMw+V%67YFe>i%)*poZJ zkhF4ul-yCBh|RP|orY@MNtPH}>p2@uwl15@VnDyUZ(+&Q!+3ZLSP7k zMgoltng}#87)oF$gJA@QF&Iu@IJWYd9SODW7gfHbPBuOSRlG$p=qyC{{9l{++EUKS zhCR3q%^oW>20{2D42_P2(FL0&F{{%yyVkCO~7 zlMK7thGA4}qZf|kOj1~gM)`UG5|nQsAkpJWau&FA7P_q2ML7$tg+(swoP3uxztEad z2-hWD^0Ad~1aN7ZA|*vd^R2ETYq5J_o;52kqa-8Cl~b}%au?>57UuxYw&oOOlTOK; zeC)eH(m5rxIgS^H??6^_3NljfPd^!cH;XuwIieW7%8HEKIU8-!61>fTl{A7XYGG zDE|564>bvMZjLL9FbGGBrAd9MTt-7+EFodeT}rXiI2K8m(PLrS*wrM=v_wknGJo0i zA7~P0ccGS>U&5TP#)`zh(Lf8Z1WkB+Y@@J!c4Umychj@VW32QXG2$%Bu-JZWU`)@)Sju0|_2{X^o2*DaJV$m{g z1fZR>Uab)lW_YA=tlLE_#tDi=WfPhggfVx; z;%Fg-=2#;|EXE0nMbyoo*M$GL>ruZHdgv$-i*XoSAp-a`mSCCc)%@h*TXF(59SEhX z-KW^Ct&uTKMU3}J3=1bjqUk{w+;ckgg!-6fM65HK7ylxJK14MmLY~sR_!s5L(|ef~ zYfTW&#gbURUWz~r!NkTBnI5lexhqvQ@aXfKQ93o|y|iat7ZIw1UXuwjz0o|Jd758h znwFhIGbFabvd|O_Ram4aq>ei+t{`{1PY|S`1qF-dr)6Ykmn_WB)shL4cdBJfgno<` zm*1M^5wnBl6K_=WF;&()Dv|zSfhomE)7mAuFyA#SO~U@%#U=T!99;|=r-?xEFJR$n zQqYmZ;}Qf4NkPTXod`-pUp8d8L;}2|`=dxfhsDPQW|#`ktC$PUi}`@31(v1_8y+O> zqs4>%=<)OTJ4XPpZlf6ihLRO{!TUk?B772XVu+f<(BNRa_+aTP zEk@i098FqEgO2e=sPqATGW69r26Os5uw-<+_)#kP5#e^!qZK%VX(ooD>WK0MHH#Dt zyy?Jsm}X%ZnyMHtSm-PL8h9TArBF<-z)7OH5k{*=XDMhjp1q*rFe03;_Mr|! zc*AAjT@Sp@`#if!kE&^=892aP3a{^F;L&t9xC^}7;yZPifc$h2QcEGe(WQ}C^S~$X zFsz@@W&(FCmP91?4J3i=0SV+`iivePUoZ6|-oFelmfrCRH54e+hfMr|eH%j#xMLZ* zXkmlJi-XZSoU~~K>&V-9H&rif;hGmROnA;hhW?t6VMcloLMsyYj*pQOj#*ax1aPu) z8d5uC>wTsiUVNIn`al+dJGiHm`uYZZG;*La9;-t&vSGU%TjQM(6Z?L0!mdQ+0v0My zC|l`DZUxuRi@k0R!`qag!>~ANQtWA0vD1L9IqmAA3N4O4;d{UnAkpwYagCLgw91B^17%%c^&PKU~%0^8_Gtkpotd_ML)@eU-Tlsd{Jx*ETWE8ca34=4Hk2hT}rLmf3amMXctwH*B*m{+Z|q|9LYd- z>56oE?O4P~E%kL{NU@hr!hyJk_b0{HIue=|^>HXo_LaS*j^z{svO&wbTHj48r*+6x ziKYpER3AtCZ6+bAcxCSa64mXr3Pp)*^K76@B-fQey+UkW zqaDLuJVftLIA&K)VT;)@-ePtNeLW8QlAHCet8mxVdOUUEp!8f59kHie6M0c3U{!_E zRZd!*Es#9OpHpn*w^SU+yh;seosuxee(wG|7PCURpR@E?TUxmRajdW=W(kNQn52bz z*g75Zzwh8Jg|1mzZ@iB?<0M|t-Gyrb#9RFnQYd%R0w`~ut_GPB4-$@vb|1IdcXhzp zBdusMg6L4{7O3G!B@q^(2+Z~jNNRC!;VsHoW*{*7Hwy^QWIZIqlV5tbwEhrNT{)RGT=$9k~_wg-_;XC z=U#Ya<%E|P$PC*Q@jn?G6dM7x$C!FnG0XvLr5K?QG3G*ri? zCG|z~_t4HA${BPV8_@~uN-af-k`SVj_||=(3kg$_+4n(zpvkZ%=}x#}l+Dn?Rsf=K z6YmL2W{5}+y$qAILx=VN8qHx}!M()Htzhgy7YJLQF?u zRsP@`9K5^?MW+~5T_;Gcmt;oCl(U?k=gbAy1n(11qB!;hoLI2UQkjD{8NV0ha!)|X zQ9a3L4_akrN{I#xQr+ zEuhH^O$9WCp?pB%RWAZ`H-~xjFeZ2yf7;&sM61}JPydO5`}3*q)7q7`yVAdjR40(K zMj-F;oHZ@JgUR^_rhQh8_61MbSl1U6GFUK}N0gNY2oViILTEHv19SJwZnf+!6*SrC zj04RZf^qmQLpJovrvW9TPIY&WuXZHZXId(#HMxK{UQ|GbQpfL}c#0OanA2G7=+Nfv z>o8E1T^mD@NLSc53Gw6ypjFBzkm8HvPS`;J(6dsfIu!d%XhUIBELB*jx6sm_sPV4= zSz)1_1viDE&U2_H7`0S9hv(oZ^x9X!AAgE@>ub8?t=&fN;ymyP8%@AeJ9!5OddeVL zy}?rkYILPsHKmjvg6SBo(p0b?8g&JOd`T%PG5C&S$Uz`8f6Fh`feb|z?+0XsHA#!$ zrZQ9xSCFm8b?6yDq6fbK=w4V8Z-Tv#p||0R7^<)Z@(t`R$aUpiB$T-^ zrU$J5)JgM~c^*v);@@@Xmx5Gs98C&BElMqa&0UY~)b`oUDS%j#vHVhyyVO_~{2L9l zj6-jE&5Uaj{ZbGbv}FAI?5Lf|(8`O^&;XZOqS;l_rI?@dHE6!S_~pXQisczaA>heesK8`4q7N8^HBGR6E7v< zpy#W|fw>AcnA%VX7Rl!1WVnXL#Sz@mL2vVNqz>W&dx|3r%NRQC?V=~u;xW4{Etp@l zC`S*Y{s#3A^m5IJ5Zgr|7c>O?V`mvHWe0_jM|)=khe#>`CJ!5tGV|SfNY`=^Vx%-9 zVqFnbp39MEbhT@YOC2D-n2c1lg?%BE@NW(iv_Y*yuxx`#lok&{k76hd%wMS0H%0ig z=Qwv4q7B{0G_gxThZyR?q6{sXN<1|0BGrGXO<}62LCl-L1 RVdCEjSKT0{VrvqP{{zu{)yMz< literal 0 HcmV?d00001 diff --git a/curl/lib/libzstd.a b/curl/lib/libzstd.a new file mode 100644 index 0000000000000000000000000000000000000000..5c88dd29cb3bbd02b00660dc603acce5f6b30c23 GIT binary patch literal 867656 zcmeFa34ByVwm*Jvx|IOI8x$24rEwS~E|3mUX>n$9Nq4x7-GD4^BNIZ>foL{+VR1yk z4w7rz^Ye{wW_&Zg8Q(bL?>TQ4XHjuaCrAJ{Ac`z5fEzKWAOitJ`u9CmckS+k%)B@6 z_xt?+@Al{3u6yd7T2GxiRduTFm}{!S)r-D8WP;0n6KQid~sh#-iq zf-v_=LAW7&^1J?dLAbA$-@koT5C(F$JuC?Nz5aed_^-M@yiX8v-Jg~S!bxuNl&gh4 z?{h~A;@^9>lnCPg-2b001IL&r1mnKsUcr%h2YxI#Zf&#O&a+1fw)>@T3(o%wcm4%G z6#BiVektVla}U1gW?}Hek57KL{9YJ*l6%OUMq$8r)evFG|KIMN(}W@Y+(Wm#DEz&5 z!Da6W?0)Q3p@8mpXZCk5tgHzwh%KxSEe_QS6|;Sni$mc^T~p)qSi^!)m_h0yzHqpS zyBCI{>}7gYLr75OR#fVq23u1NkHQqT@3+h80kK(EcRW~&>heMGFgYgJ&o;}A~S&cZN zp*f2vs+mnq^}@^aMJ+SzOgv9jf8L+HfeuUAH#XHBM_<5D{2#1kVgCQg=tF zsg`3S33%h~sv0e@Xn2_nHw&OS%95g|zy_nJgoTw1#?g@J%2*^+PZ^6WYgmBvGv6C; zR5I#H2Tv?9Fea90u}~3*tYFGT7O=Xhd07?^`3Xg>q_O6jjKFH@7KS1=oa(B^rpCJJ zs``p>Q-e|!S!4}h5#9-2t|J+qSC(3wIg@^6X=QfO0nAQ1fcB&VkdbsiGLlXq>8Z*} zIz0PGy1mh`iqJqB+cJ>eR@jTJvDhHxO*L9o={T9ZU!KAHyp7!uu8W4IptaSoR3DwM|W>4WPMyXK~u>`Fb zl2#T#(jo2}(Y(!qBYNGdG>2DJxTX%3Ru^5yqH3sX)GL&|XV#-NIK&hVHA5CMOiLsh zlrfCO^x|qf2??O^L}6>l*8#BtGh@O=N1U<{OujmDvDrc&Ms@hYzlw z9lCvXv?;7L12e*zRpF`ziyWqatT6N4+V(9_N+ORX1DKJO>P4aI+sds$SF;!Dj#$xX zi9q?62Uy?9N}!=?sr8lOsD$)nq#-o7tf+H)QY?Mb?8Y`@s z)qy!-^`V-D;P!AeV|bQthF{-QRpYIzjzW8=3NOnj&|DY`mdy&)hQcBAxn{vs+Jmup zghRFE6uuo~>59#y0CgtrI*nslv5CkNTrmE)FSj1jpD1WU4nViTd zWJ4|hP6ed3?tx)h%R4h5o*o0rTg(7r$U@8+iHXJIK_)BE)Gg@Ki@x zSmm04g$Bwhm_=w85TK3`7g>bX!cb!<3>geW=4HgnrM0FaHH5+oLo60=sJ^ZN9cEZV zWHO)m_!^^OO)t{?SYI;xwz}qKQbAcU@uV@20Jop^nGE(1)Q6SEB?pt<&bqgP@jHu4T_2)s)b} zx<;d&n5qJ+03#$DQmz14$7VKJ8zIMMEi)Rf(j|b7;%ltQSq6aHBQg@%2e^;4^H!Oi zG?OFsl<;tkW=ABf(HVmURwh~goGbzX&{SJ#5nEbcM!{qzop-Y~AB{~}Cu&KoiK*q< z1XN}TRZFjI29Y7dY##LD_d?BvhHiT3<-u8lt1RT3nG3D8W})@TkBp1V@G|Pr^yniZ zO}<(Z$_vA)QD}wEK^fs#ipNUAirfk)=P&+7v%zVg88OBYJmE|_X&xLx5omx6X0-bB zna|uv*+JX+F^kG9AFEfy+KF2{?3G|G2AvH!OykcCU?o@OCsrZ?1BV|}d&)mFvoqgEx&YzjOQyjy$7 zF!(cqDDiHPS-YZc5Us=OY*yyZZUyQ%2qrs|ZH7X5#mA#s^j?4(EGPE>m@-d~P-!#N9}E^B|xEWTiM)iD=kJRX@H6$x>65Cqd4RxGxGS!CcX@lC?+L zH(GXded6|!@Epbp&I!vAhBMqbzwYqKAAcP!YWtMEQn$*Dz^tZ;BZwxUOC$e3vU4Y!|`loZD*ea zQ5OGzg5sFAz#`4{bzEg(IS9_trm5LT#-@b9%QpLkcYQpdk9z^)rKn9PR4!RmS8q%y zqTANv07K*)jw67K0XZNRMb55q!mkmT@i#Vel~utUupWb6NL*V22ZDbv0;LH=DAd|= z%Z+Yr0@e;KF`?!%jQhrtN-r{M`f-iKi-j6}R@RE0fo%11_v5FHOlzXvDz7p^~-nynWEsOo}F<94YosC=~S9vvq94Q1%qd{Uq0C2BsP9v+`!-(@3VnQ zZa{y-I17b7>|`J_Z5o?d5Wzo`HEmdD@z7Cqj;u6-1jG!HSc*^WQkB}$PgQKsr&a<6 zBDDew85Nx2SBJ@VT1#ZbUl++Wt5Qn{d@A2eklr9TJR<>iPad`o(<;^siMTsww9wnU z#-gG&z0Z_&Z4iZ8CRGlh;VP>B+=}IesvMwogd0d0X3Tl8MP?12UtxOcCTtoz>g) zr{c9RvXLu0+`>~DGg=3M7G}1BZI~Gx#aP&i?By@k=>QF6n+~8F$rv7Fgq#Z_YYry| z5-&~W(bvqj-IEhg-nE2g@{xvatoB+^?U7l;hXp5#(b!ao7MCRegbyv|2DG83C1xwE zVPZ6Md4(kj1QoOtsqwE4Gvux%Y;ZvaIKpS(Y{?+Lq%rZ7SS_YyDGila$Kk<*v}HYw zz)WBc4>m<+VKtNAt(=kx&6*uSqN`a$HzQ*yv`+|N1+%IdV{x8LHi)m7?XwKPISte| zE)q3u(u|!CIgC|bJ}_p>Tzt}*mJ}Ho14$60WLiq-7Ld7g$HYjF65`iJQ|DtwJ!iHC7(s z0@Mgobu@JLzN8B4dlr8zH(>UDnH3a?R)uXi5a)F;P~cQGkSMd+;sXRSw|mLq;nz%J za(GpcKFr~ozQbe`%Pm`-1-s43nd_Rm#gSNTqzS2mbHNhud(JYViHUMnPTaq*P&4ri z^8*$txX!fX;Q<*kREt=9w|2dZ6a~iY0!R?^#lAjLS|3_iRSmAnl?@FFBLJ<>V64oR z-Z?J_!ryNDS~5wueZ4>sge&I?Lih$jc)nf`YGG0O>Td<%;Wk0Ie?6>RKNN(LPX*!X zQ$%6pxuQ_gA_`B8aR~Qb;t+lua0qR;I)ssDJB4q*4rwI1n1%mlIPdFcM{CSp;`703qw%<8IuHQ&uB!dqU z2J)jAPZQ2%G4p3;8crAJH^TNS5DM9ExIjOSG4Q7~hGD`mORgo0o3PG7UaZ*MO}VCA z@_e3x^b_W}_?hKFZ`OD2b2=~yJM%~35k?_$L;n<>j>G+UEIN$)bDDgCems2cpIMGp zKOWlYEPPINhG74haTDDz;Z*$e)bRhzT<|c@M2bhSv`{KW;diPaS_Nm>3pdvrDyHjOoHodjX(eF(X8*oS4B9}!vx%$$)R zPa1q#Y}CwGGYxjzIwG=KwlUK%yCs>$9;||v08HyKdex>Q$N;SmyE6-ho?V&+$trnf zTa{str5AB-TdV$Uy>c68@r6NidP9$aS1YB#tUWj8XPA1-I3v?9b2`RK*AJPd*PAIY z=`g`!n?te3m}B}ySE9@93LVkeSWN@uw8pd6$w18Ch^H);c;+kDYyRdLE((CALULLx zQ^K>SxpWH{OER+T5t&gkG4kJSoy-W);-O&jK**(ACF=&rOcm=#>EgOtpBi3YDxn7V zdrj3bQ@hmbt$(GJ4*>ed$y97J1`)aSO>JnAQx~l~Nr;uYA`5eJ%%SQ{kdN|=sZts| zkuMkowx3zkV(_9_1jE7v?}b6O3+ug^JLUg4&BC2+H6hX*j>%tBxT z=?JAUV@ORo&^#%Xe9)Ky%$Ve``1Zd{ZbLL?A}mnAawMmZRA$V)m?_Qh$dTGijI1dc zN)x)TTqcQstLb5FA2y7({Qn(>n|6!SzrjG1*RG|wsMPy1`$X&0t+zCWwN8p@pzKMp zY`$VWS1#+%93B}pmJ1`R#uyT6%rbqYgRC`XhvkZhO>FVfVaO<*ToY6|X1R3q3>Ic7 z8rZUfcVP35*d3Cw4W!Rq4YWr@vv1U<;Tdtx-50>k*f0SINj2&aZPa~il;A;I3XlV` z_GR$Wh3CmOWMn6uD3}PgrwQPUqyv(jbO8HKIy~)32OuNqx%TAbupws3B%6`bWrJYOIOpfkY=hfBBS-}9H7eo5+jD3Oa4X%n1xh7 z>*E+PF=5cZUDQAqx^riet!!sjxt6g1)cUwRmwna^i|W6@O3a=d((`ha2f+tWSlnpZG9s5l~|47q$QaPum3RnDMucdhR}Z~{gh%Zj_IppbK&+E@c^0!Wg-Ku z-w;ny9w*}}7F~8}unmy5ZiiHLdokEouJuN&LkG6=psy_oc3WLN?EdY0Gt9AcA_JUd z=WJkD_RZO08M2+LjU`!&j|NeOov#k>qZ2m3ef0F&6k~S3Yw<9`u-A6UKPmI_&9d6t55OEji=#1jx)$4j;W*EM8dy6)kRFWm@5Id~L=d zLj_}gG_X|@Yo@FNA zWEB(F%50g?ETLf{^iv3Z=Rd>LDMv@%w^@CT4IDZ5FJ$cdFeaYSN=!40OejyXIorew zt`97$v@lSJ8*+rNgEIt#LB>lz2chY4lC)(Z=1Lw_e0C(P{pSFiLE6i~YkFi_!1TF0 zB!`tU=9vE;`?{puL79`uPx;;tQ}jGD7C=U{Rv)_vxBB$88&7NcW*u6I`kXJxLbB7_*q3lM zfF`zcB5Qs|MH3lKTv-o%u)yqLXo%J}X5yMH%>v6spONf-_E_-^SgaB0)uXS&*>|EF z3sb~?1F%P??GSx$-B>`Kd$~5@#Umzy90HKQeaHmvMRt-IyFI{$Y!=XL0)$FCI{Mza zk!!z4*3R#2>)i(XSr&b7mCrZ>!&sd%O@{k7G45k$#b$Z6r3+q%3}RzG2C)kX1~Qfhv(G}nVAVEX%vXvTi|QPspK`#xvUhJrvJOhf zI{F~OmVM1tKx5a5*`9P1Yh%=4W=qroS!A|i$k-2)x!|bf*W4v!H|Jn=sDZ2!zt58t zm`8@WzGf|Hv7bEI30k&O&x8q?hK80iHgh>AdM0V$`9shh(diIW=?zVd%(ddct<2!V<#oF3?!IXWP)@$X5f<%7K2q{lM>q&ozoLc z#1F;D?MqVuOpIB*`CKhqDYt?V+icnqWq~zBGm}d>$es6^8gwQW+P=_?g5w*}GzzoE zbpV}Z$K9+>`#LT4O6`o)E8HbUP1f9d3T#FNVHfVx$boBo6mwME+2_+G6we=zA^8y1^!9fq>;xE>G zqv%72}JG z2`!xljxZiwYe=Iy0mwp;ooG0|T7%KwSlpEEv9^XkzP^4jb>%fU@o=Fq!OAS)3hOI( z^QXZ(6FnNr{2?{>@-p`0Pp=Vcd0UcVbN)kkXOi0%hlIC(=7np(U4=8}Pq=cT@lK92 za6g(0&pinz2%FdWa6SdRE)AFJl7&}#g^2_gh4*gG@az#&c>94jOk*7*yppR}E$e~8 zFk3hqw|pvx5YMo9ONu=@4*j1%SarZzs4*7>%hPAY5`;_ex(Yad(D2N7?fIAkyk~$j zYzU{<@y3VkjotdH+mSyGSXL4YRm5t;C%}?S8 z?StjRU24m(9+&MOZT_Hi!LhlD`q7#e#4xWze|5Jh@uRBrV4De2H}>w(z~${~YF;-5 zbq?;!a665F{!U8y2KjnvMmosPhE*aJwk2`ZEBvwYB4=(JgQhb$9RP zl^ft%aZq}GL;UE-aKP%XcsiC`q{KTM-o&NqX1VLL3<5d6c5M9U*-PH;IkTuEIbuhA z&uB$G*t1y=Usl)4oA*vlI?H_GuK4Z~2tkg2XD~)6?ED-Cj>BBKeYXx@SzS9-nW_TRzXB zXIR#xK+0G2vQJ%)G|S?qNwokRVe{nEYpKq@+Dlw$V@ zP$CX4-STauYj30B|JxWf$sw8|zys9hSJ}7kzNo!Zc4yEW7 zMctOk^Bp8%&&BN&=Hq!eb5WMhX08|T9M4>HbG4>``g&09RMfZq>g!5k9$L*;gO=QE zwwe%H&2B~g5^aKUbykx>qf*pkLGZu2+iWu1wA|R5%p$P9H*qnl$*1l@a{;M)3#0KS z&hmjNGuz5lAW+ohV4;J&v3%;3)j?}q$j;gY?q0CZwOT_dM?>j2UiP#ozd$X;y+u)D zN6^g64tJuh{0gAj2fXUm-mNQNhnrf+iFi7rh4?*fOD^=s+Z=1BoY7mDiQPUno<4iY z&YpARqPD5Y`j-W8|7eto*+SG4n?FyME*7`OKRL0sy}Wlze2+u?QWn3K<1goVJ$t11 z7%-hr{ZvkU>Of@D>d%mtptuPk4PtRlNtVt7OQdDBS1x)(PJSPa<87}e9U0+EE=%`Z zg!XJ{@$#52eV!dJA`HPR1y1;ij``F#yz1LN@e6PAhBV{wq7$pqvNZim@qoHD-CpZc zM=bWO+EOO{sMG7&zWkfA^q1TOA8gxdyBWrMcbw(uj!QIpRl6Z zqe=b$S@9<<6pb(J}13VR!>Ly z4w6$}JN(rz`^C0k(fWXjj>_IMbjZjKZyVKc@wV|3xOm&(JzRWWF?BJ;XnVzqiatT- zcFx%GwZ-!~Tn06#S-GzbeWa57?bsFYk;biRrq{%(75EDz=WYt9bH+}hz>1~eJVXU} ztjj5@2M!N<KlIbD9cVz-5*qs`q2-^kF-knk`V8H4EzM#%z9z^f|8tZkFvR2 z@uZ~qU4)mMx)SMSeXeJd6u*^VlyEN`fn?K-%b32UCz8_kGIHtOz&j@QmIu7j zQ>CZ*<0lHF)&BvX^0e~_>8XO#jE+a%e8MY!>4nszxYjRuW7QU^WhF4B7dFO^4qdWL zR$rInheylLx&V}4qNlH@*Q-u`4s|4SeNfbeE{%1AU3)w`V*dDn(dZAots_oFTo1?z z#YwIEhwb^B52wV~CFwR<6_s?SU;V1*{C+bP$kE66(;Z&*{rD%%$r0c2xzqmV_k)*k z-CZj+vB6bP{W>`2ql4wrT?OOmIcI!6ytda$w|6<=*aOF#aLfl}=eC1Wq`ODmg*SkA z?xMGvy9)jB&cc8v9edL6`AS-K9m$gAcn~K~!0i;)<2jDG5-5Q&%*FdOO+PH-`e9;u zGh_s3_B42gGy5VidP!N!;ic7z=Y$j=&l!CMLJ1`1EwylYK)r=?IatQR62JHX|;P6Wg*^m1VGSEQeGDB^l0-iDV>>4$AC z9a76}2nuR;azwsD?X^?c{DogU22OUTO)U|HFzRY>ed{fEpkII+T;DqC4)6uS@~m6( zKDzpV`d+{Mp=X2`_7fx-+ z+69Aqd(i}Z=pfbi(j5WMmrJ_PGf6E!0@^{J^a7g3!T7<^@vnwTt5*WX8i3IZeClMG zwS%=&s(N?&in@pdI$+n~F5be{wpaDO=k@H2Dc+*D%UZ7)E+cBKQOGDUZ+?n5i*{KZ zuB6u~>i&~73rMaqKGvX-Mn`(%=15^7mK&|2?JeDGK-YR|yt{HcTz& zLlE?KmT@Psn;nNBe6oW%@Ia@OfkO~}U8nt%!sQTYs(`M>M&&7|z+=OQgE$bWb7_+_ z-_al>H5?)h^yykY?er6;7*swE#6*rx^{fV=9>*clu%BY+*!|i|v_X_#ZQB2-1{L-9 zbPd97k86-YHIZQujvm*e8YG`lS>wt#s2(?PbgI*|WDI6hG~qzy;=iZs#lZ&E2m?o_ z+N^~`V}FN8(+^a>viz4zhZt0E8#pfJ%R?sMP}~mj5HcP?Hm93TLj@(o%T;tpAL~GDJU1o zVe_6j%?P>4z|r&0#^rz#=Qu=~vLOEZk3aqLe#xLZtWilw4}~cRBp>La_GRZ@f(SzP zBp*TVp@(+m2@Ro!>gHwoJH-nK?U*qxN(p)!Dj@C3%Q0D)If0Lw0|lGB8(U%Dp~``@ z#gDBzu|0q$OkYMcNwXpL#SfF#2#@bQ&9OB;?ImGu&NXNCEjx!Nl(=2i>tr*jS6wlYAKT!fnN(^Df{+*?2zP4L#uBKx z`}+Hb%%qmuW2*&Y{0h=*2uT%O-^5Kba@HnBa2lB0NixK8l@%72W#XL<{|5(vM~&jw z1HdEU@Zo0FUxJiuwV|m8<*+PaXgsO*hvL0IwK$KN|pE5%69a03Ma! zUk89k@t#XPnB~fqUuu5S27osbcy|o|47m!1E3O zZw&D6$$>Ya#A8WGA5N^8WXfk6;XR7*W|IKMRgb%@u((WLN{Ju6OtQk$_W?*zgEX8g4j+tMDZLb_!*9 zlB965_wO>-EIhAfE_#nJR}G$YJB0>3iI<(iVm#+E*WGwhm`!)}U zl~Z^W&kLFBw|G*EbqY`7No~j}&_phAzf{gy#(A+Kwlm{MZ8*t-(oHw zTvg099j@;&*9~wrGuM2$s8KtGxs8$LP<35xU8u&zOjulGXfI4}(%x#Yp}d+tD8e*O z*EsEr*dh?#*4VV9(Zx)0T{z#TI$YO`?>7n8^N$I-8k?f7NUXUTXPbc>@#t=iq?x|! z#I~z5b52(n1}b&1rgBA_np_RB>P0Rn_f6qtuG*$B!so~L30@doAc^5{44*b@YJ`WD zzFDCNeLbqiMI&WbO;ae+cyZK)69f?u+apVd)p46qS5vJ^-?4MCi&?!G1V{kNBTA8i z)}<8=_U|DwTPDopTeAi;o&`85jU^4S7)TL;*&$PQU3C#xQ!Gk}Simg!nT6|8#I>j? zR$t><5OR?{q^p+Bj~C>6*cS5ec=cS(3O3Z(6kDj5kg%jFeB111Y{_>mV8fL#1Wln8unqRx4W3X!Q)v zBvUtjq8$~R##(lGLmiR>MiTJ#LP`bS4CAs;(uY&1^cL4)XM-zJMW3~c2ww1{&JAYG znAyV-tS+*+qloK}8&m@9sm+Q4e@~wq2vF_Fycf5s*lzo z5h%F&`p9Lj8kB#ui5L&(G3w>BAVf7?8$(H(k^W8L)zPuiU|9+$L?1vBcw>g0e`qOX zi!#e=TyAvvC(O{qN>epsxf<7!MWIG8R~7BjnGgwuZo_{c<+dc;1i#r$v9OKNId}@0 z;9kx?Y3hRg7W>MfOSgHWvSAgd-O5*+)xIe;wFaG}(|5I`Q8u#P4e}|g{|C9JX1@{ZM zug3i{?hUwK!@U{zTe$tW-^Kk)+#lgigYGl@AHaPG_fgzm7mzFXP^T z`!(E~aleIoJMMRJ@5cQR?rz+l;l2>}A>2R4{Wb2%xR2v@;-+xuIu*AQKix$mcn%}I zoV!Tb;4V@cA} z?M%Zp$8eE~!F_KrT=NYVsXN?vk>RR0T-5z@->BhQYPjw+Tq_J$i{WZDT=yHU2MpIg z8?J{8*TaVE5ySN>!}afm>$isM3B&al!?nh6J#V<$4A)x2wcc>OYPdETt~U+WHpBIf z;o4=mJ~Ui=4c9)ywcl|4)o>j#T*nQU06ypC>@-~YhO5AE6&fy*9GrrbJ?t_0NXuA;a~s;d;by{mO9tyW#q+;j&IU z0+=yVO_2ZEwHPN0k>nJ`MU#y*y!hzp-lgVRj6R#>6lezCI$*toQ9S{wdbrk}_Re!o zW<+bnp;4+sJR48C#{T*IEquLZd?Xs?FwOAR7BbbFL!`+{x*Wgx=taI>Lsa8w6oZT5 z*r@n=O(FLd{&n}X3;B8tqblKGhGV13hlfL?!4zE^TAvH>^%_Q{E%PuO8x;)>9U={* z=$iG&(hvB04WlaMP=;fpqOx>|qqw*5@%v}g^Yt1=MRRDl7>T;Wz1I)-mF+t z%GYZc)s-B~aBNfsj7rbfFHT%|8(*(sR9A5-hGV0mVVOfDE}$!N{hIrS3B-4dY7zso zp&N{#Eyk!c1L6>Aa+I!LpZfe*zJkN3JRHh!Y*c&&M=!(w{o^0s##e9{mAjacF&rBe z)vrUmhzBa1F--cj&`hD5GY7-5Q4MEQG>uBvZ(cp?tKk+Z&KwNKMnxRR*A0nk==wy(~!P;uU1I5sM3#SW2bgs#D#jvh72LdAK5;n=8XV#y)WbT3^` zy7!%TzJ-dXoZ;B0EWbm2+Ysdqg1*##CVUi%EkMn%&&ri^;@hT9(+ZK2}4!EkI; zE=Hwu@9jUSlUx=m&KnHJMm2^}&BT+g3*y_F##pF0Z!jDi)rG)yh%~82S71lwstYYt zoHrPbjp`e~H6?cBSA|{QFsUYT-e5R3s~-+$%`R*v$lPm&kf>Don(j&0ktdY8 ztqZj$-SaZ(s?sYs0j<%z-yrgJO~}}_MA;-!GiQnbG`;mr=th1F5tC~R}65eLubPoXUo8XggkzB;3ho`Tk@J%12 zY*C3}CfaTk%Po3+>MMSABQuHis@uChmY<>Q_`7y1oo!oS$0)BnLQ^8r>JJ^5#7Hg` z{mFu5N<5XXOb#|nt6v8cn0yz@Y4#IU6#5nI$#B#j0+`EN*Xpe-L$TW`7V)LKeeZG{?G zoCnLVyrAb$w5CFOsUVEqBkAZje4aO8&ixJ$3Kjz#2NR2-qhBp8I~0_ z`hXdP8At44vfz%L+4F5%8VMM^)QrBs=ibT5clJoR;_)Ve$6;hXq*hjM&VyaxejiF^ zb2sdIR}De|_|&#($x#(##HhBR(6CL!D{hFV9Euv;6;J1J(>6$yHtIkW6czW=i z@8daKex6!iKq~*lA79%mKSNCKj~^cyz6tvt{Hc8oe|l|D{lFjp;P~`p!Mo&L>z5ka zYNh5jFZO3_nwBgra&M4EmtjlO-QL&tnGvBK8U7yy<@w6Dd!KWUVSAKZnZj`P2Gq8Y{3i&{J>z((Vs+(Z?#C7tR zb+YI6C5Ln`+cpA=KW$X-c|M9gFH^wn?wO)193>brMR}XlLwwJdC z?inO^?e-NNsGX_??s59lZ2?bvY$L2Wi>*7y_#QW_=vcXLJxW|R?2o@dZ?x-dSTN#FC>NfuO7ezh&AzP1-Zz=9Z-^s5hH)azH*p_x6eizCkgY4v*mGfQx6A?w;B zui>(7mr}japB&NZP59pQC1;A$k|Sopxcv+zzUR2IvYn5E5P8CZ2w&WwPx%%GU8W{SrRoL^f165PkVrh_GA0TxL|U`IRSNU zac%siJnA8X$-p^Z2h?C&bWxDRA}u}!)V%?0;8W+03?!%J!_(!DAIX>Q84f>Y#2jxw z0^dR<5y*!lC@86J+A~FbA+_v7FCe{;>fID?8?5?3-Ue!HH3)&a`we(1YPThcFAyXd z+@`2sAnp40KS1_cUQtf@2&GI~EmF}WC~luiQGJvAo_4VHI4S;TN_b-V$e;&%3O>P$ zS8YQ}4yap{qIT?H@)aEoc#c7Utq&G$lvBGMzM}R1#MQKiDUfK`hVXVFyfW;&*bDc5 zxFG@%0rH**WIp}mM6oZbVRS*Q9_dy0dDHL-sa+0lQCqyN2qk{f(oD?FSK`M|n14Y4U<$o3kN7?4|EMrm zzyqy$Bm|?>@)zV--Gs6Xs_XqlZ9a9QTy)IuIfAm>6vU3C)E>mWC72ivzCv)JZRlNg zp-lC1oP@Yg%qU6~AqA48Wq}Fa=>9qQnb(rPsGaup8TGMzWY2gOrN1bJ9g14msF#u5 zm-F(c4Jh3!5de}Y1hI9rk2*w^1t!m(6uE-&1J9o~-pHvX<|f9E=C6c86(A6H0EkNOQm%JcVb4UTzTZgq}Dkzp^~F=S#riOF9e zj9(aG1l70vU7sm>7)sa2J9&e-A2La6FsyZ{Xk99`s=39GaVH=s zo<)%090ui^c{;f6)eX^gWYk!zV9sb%UQ3H}Z>k0^%zqztDH(`ICXM*ax&0 z^-zrZl~yk!`Ircnp@>T#M@d8?O$tm79*InX z04)nro2Ox`+J$Ce2Kx1%iBOJ1vlI=trhL3OK& zTKX8Z82CNI@OORAUh-OJU;r@cXF>H%!uXJYaSdZ1IJ_W^_TY`@`NdbgtyA-+C!J4$ zWk;<6%SPAap+ynZM-Nj4z|KQ# zLDl&eYH)GD)46y=4y~iZub%K1y$ZY}49!ju#V@TcMccssqM&*Z1u_ZM;H0K>%j0<@U>-+0c+q*) z1C)@@utP2=9&a7ZlG3UrMT!rjP!ch4(E+LDbi8Ou+K9I7RbTNI9SmY4VEJ}`(e~5_ zj-nmipP-~6*w;g^c?fz<9@}r#GXkJ8j57Y6Kxpb~&_2=e4W_oCIDF%}?*$o4s&A5x z#wiQ&`WR86V0EfiDIjj^o(+;~5DZNVJB6R&IhMJK!Rvf{+65PleVxJ=a8VEL6liqF zU8~R^egcLTQCL)-dLhE~cqOs<{s$KEYaR%b!=yDyiLdL|_-`5zfdDpOViVz)nso*GcQ z6?KOtbz7JcIN~bkss5t<;J;!F_1vU+*2bS>dg`=f!2LBczBjs%>8U4>^nl9MP$;SJ z8OfE@1FRGZ27v`gH_eBVI*1%cY)WbsB0LB!HNJlrQ&SO^rlyvm7`vx%rSym;i4!=e zO-U|CaOht5a?fONljYT$Xu#n0Yv@+AWCtcj{K1ikejGNEqW>zE;@@K)&|tBBw&llo z!O02e@gQv=C1kZ-F2WA^x%>T|&4f>_H&C>Rlq_G-TS{UQy3`}x3n>h~k+S>8U@{Qo zLkFd729pYO(4$NTJriXi%z)J@bV%r+yP7Yj-pawA=bOT~QLAF^nP}1j5QckpqoJkH9^vGvEq$^bS z6#A^<$UMliLdY|zWj2};(*pxA!YxX1nWlKQ+f`2@@+Um3WX6Gl7pPJM1^%N!T9Kg| z3Q;`!A&^Ox<$9$?MA3DBK{^EAzusNW^-9#U4}+%VZHNGs7up2HcAJu9Q-j#!j!HhC z>S3~PT%;7*&3;y+G@0U6d(d@aG>EQK?JRoRy}^&Ir9VtbGhj`bgejy)zf9-;J zZ+dO}u0!w3t%K3a6;Q`<=c9Re);x+ijE{WkUit90wF{o>?OZ$Mp+jxH)@9Ur{uIJ} z?4Kdr=lq%Uq+9;XgZx}R{NCCHiQe9|Q+6FX5fnd>Td&K*=rIn>)OjE9?#n|e?gR2` zUiH(%JJ#;$>3w_cg8hf~1jV&->rGGrQ&0g>F8A(*sO`bj5%z8_KN3(;f@)|Js=$R- zsdu2L4VT}uL0U~lKKsPShswBQm`DlNxck9{(4;|Wr z&Ry$`p$q!aKcrA>F29PvS`io(1(n#GXQ?Red=^FVHSz*=@9Q$^wx!i?f=iUiv2l@W zaF7brA5`5zspTbFZXM2*y%}1X zr1)3VB^v39mUDg2ufFRqdP{x3sMqf~B$Xdaj$oWb+@Z%^%45*HvK}JehLmWoAQMXcd zG3^m7I^V`B^VG`VMhMvh>eBaP*5bll5XAo_D^;0y`ugD?=-p($UMg`DQ3w&U+DUD-c`3 z%-&WO;A>(#wUV!Tcl*WTa_h|w2m}l?+MNOQ3ldWI{uN~gw>EU8vEvue2>WO3jZ8D7 z?%g^c)d9^maA^#T-cFp@QzomB?HF3Kajqth)=v4S-gT72DL?Do#dtlom()dnavB|f zfT9GiZ=@Em0$pi3M;> z4$khm)HhCjdbB|%y}3f#4JPj~Oznk*s~ z*K5qH*I0RS#AUwLJSOaainzg;=mbvzDQT=%YxxggvaP5S3gV?m#pLDVz)@&{Tt%c* zb?-(MfU_y$#fk1;vI^<#-a`L;LZQ16?rW0;kCN`Ese*WYmR=zsbX5?N68d9t_k3XM znxcvQ9LH`qv4;SAZ+8i>8<2ReFb+k5a)t5taB+q46}Y$}xWjNYpc#z-70%j%i~HuG zm2+1ITrTGOA`~d@nuCQV?xG{Upy)))>A)2AI?TjP!BmtLTX4ut`(X9D{COSH4Qxjx}jc2vsZbb z59o?Ry*7Byr8oo!uLr83I|N1jm8lQrE7Ks%SEfXmuOf7c{Gf>8)nF~v(ITWc{^e+I z()lta&|B0VZ!co0@09bkB!g$t^E%9Tngg2GfeChPo5tMhZ$POj>Uu~6C=};<6SMMt zB8DBCX~d$BwlNWl;WnE@dC#lPg6dc-$B)U8Y9%qPP?$d=(?$k78=_txP9;H4 zj&oZuSA-LMirxr#UI%Y}r4(U)bXsBR69?wPdQPVklAyx{iZ&2bhU8-*Ck89(5Y!U{ zNm+j7_h_e#Hu*KJu;-IsBjGOGP&Ty7bqaWbY+cFjm26 zPwt|X6z(Fv<1U(C`3vsf;{FxxhjHr%2VzZA3zNGjOzt9D?xHZci^Altcj4NCyA${G zxc`XzG2C>KO$$#acTt$!MPYImg~?qMCU;pEnMFYDE9V6HN807l(lW*I&q^W zQoxiy{6pzR3TdI4u6uqlah!QZ!ekC)XC$CPadl}Bj3Gcp%g)3H@2t6Ko_R*Xb^|BV z29V0lA(EUS`p4cs`?sgE_=$jqv2;O%0EZT;NitO*lAkxvQTR7Pz%@v4VW+-zv6oU| zhI}yoN$VgZ6hnBXfe6FpScDi}i!Z!_^%#f)(&5-?{eXup(2zh}Q}DQ1u{?l6@)K=&aE?OPd)pzpY_Y#+-r)Te*soMX*oB6agzLa+d-x# zGVL8g5cFwAUYTPl;Bbf?_Ko9~Lsbpq?+AsPD(dR7S;msAtZn_qVF9@g0x%=YqHCxt z5r#B3HPu@V@g6Er=c%^o;kaxg!bnwPnO;`|fvhYgXx-?-S(v$|Ih;R|La$LmX z9M9us0PW#Lc#DDaEVX%D^vChotMO68^H5YMsZOy=jpq`7M>4yKL^eSyd|=JkmFrtGw0a{ z`k|14y(9;58ToKuVT+dp?*bH9sbG936w@QZNK+A%k?BTg9gH-tZ^r5VdH%lDM|; z*+)Q~#t3sA)7u1Tco|f;G8gV*+-10D;+~JYSsK1#1+ek=0REH&Y$etO)WwQF^|6xz zlqopR?|q0ca0Qard``p~taMj`HbR~XQu@IdK zdkuxJ!oosDx42Le(=oAyvn^?auN@Y)sx5XFnW@Cr<XP* zG<82r6UNbSjvX`gBSe2WZYNWH#xvJOJh|%tToV{9jb|})eFx>lDW=24@m9h`N{~}{ z1TJdmPGKEf#6udRW%174@PkgOB$v&HH3BbmUa}yBj|S4}K}pbnLr8aN)c{BQE|(BJ z$G!6bB~dX_Nfht{M3r=hGWmP1@TX=7iR&@bT!Bf<>4nOwEzt|9s)nUE^$gcaf<_RV zIsfQriR(ua>L5ZrAAC%3IKRQdz#IuL!g)%1myHy)@Gd`ukV=@hsEd$nGXHc6WEMw4 z!6{6|lbW+rsKb*u%qe^yPZ9;ZCdho&DeT6RyN(&I90xN_;-^ZYFsV_}$WBS#HD5{o zoESEce2f@bNicyBNU)wNkf17LrMxMA*NsB#48y()S)8d%o<1&oQT#>5=hCVt80vOR z5zAyUke1VLF{1Z+w$!5ZS@BMSF^NC5%Q-zU0t2zR!nDMkJPb?b9#LQslc-Q|h+SZC zyOR3U6&(c5?cLvV3Jy%{-LI(EPg2q;MV&qq#y69%FO&YcO|7^Qr^3qVw^4^$x~UF= zN79&a#SzM8n@mriX<%{|3aIx9T>@vf}YeJKXE-n?Z5ShGvK6pTvBEPUmk)BaD%OXWZk$$Nc>DKt&Hww`n zC4TozA%=sP=_pGVYo}l{rlXEV>Ue6X@_1V7;o|AiCBJE}XlZ>kq+GQD)ID<_44j!l+aQ-(XbMJ2+%PhbnCb%0VJb^oB?63^ zt)wKTvi3TM5|hRmsdodn2{X0tMy{WcyatnCtU&FCa0rFEmRMu5El8NWR4Rl$8rg zO~FCrdEv>HbQl#QeT{8QQgu7VMmQBawj*Al;{y>EcH% z&6}p)0?}hjCPWUB+2f>074?R)9Cf5Ow_8}ps5Lp#nRxY3LGvb8gd(1VHzzxd&C>WX zRV18S3mX-(O|Xdsy>P#oyF@Q!NpN$8`e`xxnKySoWfb(iJMa+&l)&1T|pPEqtiv5r9&i5kl+_z`_w(=)X0?vj!yLl4MKw+ zhe%^38aC9f`@#P*r$(MMaCE9)Xb>9v;BZDf^Kt+DGw12%w8yUv9G$91gAlGmq;V9{ zm(HtTNiz=8d@^Of#;Yk70 z^pZJUu@w-yh8R>wIDk#!nA^a9T`)4wJU)_gOV?0?Y6u05iv~yzk;Y$x;d)}2zrj2{ zve3ZMQ@Bxs3}aL@8l#-vp`7~*z8!Jqj2Qv?j0%95uF|QtYgCjYhq#ZPxaWTH{iJ!I z za4$dRoa(CTags@H|3Ii}aUWjZP(2RC$s}W+2-80XN9oY#vY3bdJ=kEVK}#zA*7ylrfo+2KT6-$Hg;<%yewh+$k!MQ&C%$e(} z!gX|xPIhVafk6ReQ(LNrafRibM{j=ao!i6AyZv zJ#dhg_Z{A>nM7vuO!f~E2{!|ezLZ1@Fm#bz# zRD6fT82-n0nWHKFdkOS$0E$|hx(dKl$GyS5MH_ReY%=D0gDk#$lMuT^n?YbosJYt& z5gB8!bQfVp_ZftS!`;?1l8t;ZXP^)5cx0IKimzQtgZ&ON%Oiz>ANF<@b5-Fjq0ArHRiGCqe=P@vxBB7c&cc?L6a>`c5E9@6^j=ulkt7pI2VJ- z%Q1UHM$l>j${x;7xBJBq?Ske&l!K(HPzG{zhU6$+Cc?y=;E3qwL@wS zXI->aJII0#KMREkgK%8TmoGpPglmpE)o){-0#kF`MhLi01r=}Bx=z70M@pxDnVRDl z8i;T>6`j*Z7uOuM7om0gmY;CBm#v8qHXZGxUpyR|snRbFv8I4S=IaRf=aAJ|;ruKM z=cz16wr+A;Ryfpz^oz%JRThq2SIX8hEd7QS)ME&P_mh$$s6b)2G_|ex|m!{Rd796%kH#TX=|DDkPP-L&!Wpf(92g5WY^Oosq$yyun`mEea{(XUMzCF6AF-(|YEEoGiVX0lu=s?160N%MYIK)NLmg_f@*t`CqPkRM`6Q|x67s&;VH_=vp zGy?pIhC_ICF+BH`S$MzBg;(maWjKhs_;W72i4$#jR39`*JcBA4mr)-RJyuc06oB)A zGbt0V#QrHw%Ka1#hXsfS%f}VAYzS3=-;oQiw3KGJjEnYo?gZY0G>MFhSd4{d<0^hA z-XAp_hN$B~vDV+|pT@e4XlK@omvc!L-d(xyO0KlwS;H~hmi5my7b3;lXCz7eWb@xr z%j3X>&32)5&+p+1Bu5N~iR1w}xni968)JRRhn8&YS>;Q%&bW7d72E7w=O&1_F12o0 z-7+V+z2f_+&S7=y{oKE5Uc8+KX%+m7kg&e+FyP|H?@NfP8Pwg@`L8m%~%XJ+S zdfvR4%tC{n&9U8qqAdY&Gxi)5glkxSy>%i-M+)19*U3(L^VPKx6_Q9W?yi&bZHNU~ zh?HB7jQti^bUfx*@^6@&ms&`h^{bow@m-Fn&*$C%jokRkBn)In4EEJ+p=`=xyPRqt zD%Z7B;lcbd=vg0o50vx;HgN+hsMEWDz(eC@vJx-Ix)~mf{0fHq>NfE3U=W%@cqvvv zFxnk1_U)C|x0fTQ7jlWs`kP|+)80SHovKR_JJ8E8ylkNIQP-#T7P{B7(Sp8Q^Gq?) z%-3wFS$c8nOY^$2y%#Wn>(8)*gxhC9Qa_Rk^Q6LQg;L=xEU#aO+mEGo(foueTj3VD z@uciZ-b1Xe%K6EASo-7wSWm8OCyrOI8$s(p1h(E(TGpFH=?dJeO(U_)P47%$rkxb{ zxT|g~pbr;N?>_|(2WVaVjf5!fS4FU0q4Z#iJ=^lvOHZ{8o{DXm<6zN>HhNTAG7{UV zXba3peM7alWL!55f)#NqR%4|WQXq94`9%^j@*4Im!V*OnD>iJ=IVd$v&BtTLNPH-a z2516KUD$r8R{HBkI5zBsV+R~va4Z1i#Co8mYNhZdtcivX46BuT2yzMq47ANe2mmMC z1V=j&uE&85GxEKcF2PomFFU7>qiB?51#I%$rPV5467Wq-E%0JN%A2@hgq26@&ZXj( z@mWxa44KOc73g(0Gl@e77{J3<*TMK!MId!IGr{BIBtA~!RS|UE%}fg6gQc9Ni__dN z0_=(1I_-=93E!}boQ_RI;#S)^lUVF2yQL7*MpP7NqiNve_*_Xi}tb=>;Cvk(^wm#YRyU#EFbbdf=n~}UM-~arwD@NQg9nul| zgK8fLBs@Xs4@doCr$5y>8hiKr(jPhkiQDr5JrEQ>_ovp44yuQg#7%|p*&e`0byFRq z;n_o<@&hjBX-2~5Xh8f#K?r{JIG`VZnO%zKK==`5GmI!+9^{8=;7_eR9sAo6ZBX2& zta-eCnIwMq;Clh-4@W3&kbM<&e?os|hWuhL{P(j|NPjpObf19#K}Gt*HcEzHJdCJ! z2HXef4g3efB5z`pv=<-=@zr$B*SlzR~>~R1iMP+WjDk3;)=~sTkhU zJ@>;`N#1i@rhn2z6xTxnqL`2sP2U)8=o{noZc$vK zbl*hMLEP$pQIFdHk|9V)2YG-J%Jr0S^7Agd$!pltrh{M=e;jIJo#KFD3TJM#0JsxV zi#0g-m@z%U3jv>`!ADx)u-}2D0}sb#fxEnyE>r^Ip3bQX5`gqffjHSOtzN}mDs}}D zH()PGCAQh1+fU4JL5}5tk=CIdYmF2(kyC*(iv-zL`hsn$o!TzGW`6^yZZ3oy8~$JM zb7}T|K&^yD&9spKzwQ?|_){su##uu%T;NC-cDe@D?Ks>a2ul$t9S`VA$2gnPp_obs zx4P({~EJ_BG{;XCprZXAhS-n>LYxG_qkih7UB>Y2E3=kf4V8v#LV0`sb zJq#f^D3G{mWKew{^0Xk3@VkQQt6b_LtH*=lUv>G2|6>97C-kR0XLKIo`vB~R7#NNJ zFBSI*`h)o0Munt^B&m1!-3Qs9xD$WtshIG;G3ee-e|~X$50c==NjWKOZdQ`FkHfB; z(MU7SDWZ{T5CT;uiF$Pa8V^WNTkRCW7RaySpnD@;&!boWGkU5h9Qx$?4t&BmKa$^b z8~ukvih*F2W`V>7pl0dC|Bj%W>X!oC;irR2rsu$Yr z?l;g&3`MNRFv1L+L*jP5-+dIB8A_P};+^M^yv@QSd27W)ik$(^d$C{9X6{rs%+sK!BhNnE#iN`(N`X{$$V{Z4^Ewr{{6nb( z2u@qR#9ZYF8#p@EuQUi>V3c+&ODtwjx{eazJc zj!tzgN7L+MCTVZg_k8~@p1Ba-rGnlkK10A}sat$YYD=y>%=(;DXA4IDkLFSIn%goHz+c~83j_igX2H$Sg> z$iUI5W@r!^O`Dvs;k4kB{BUjxW3GXtQ>hw+CK?^0l@s{k+(h-i3>=;691U_hqtffN zY3$(@{BUlf8g1a{RQd!b&Coi;Dni0_@7F*7h#$^PZ?r^8*BOFN^^z72O`ko z;M#Xq@x!_4?G<|9I?JFUdwaTQ$YoNs-`}>LAI?pFq%Y8Qwn0V4B)hFrwrvnBoH9O;o4q2Zuk7&H=s6taV_Czx@kZs!(#o2;h4|`F27F>kZaDB^ zCxZ|1+JgalE^uY8PvWvQFCI0mJXPR>O8DARQzKa$We0mQ6eI{=jN;T3l!73$L&<@X z!!XE_vg)ShW!m1lD84c@R`)_i`|_fcz`!ON>Wi*VPf$_~_d(Z}7pP**_y!ub|79jI zCmhRJnTW!W30G>yJDQQt$yWc|6DM6|uKtlk=AR21!(9J2t$l2ZKFoUXRat_1(g}$(N{SqxZS$gCbZm_b=7BRk+JGSOFn!P+`JB|X^SBXylCWc zRFxjo_dNilZtUHmfy>*~6dw?iZ2>n=(e*bQnmIqk(Mecyboclx#$Ux*R!cS&rd@>c z8u_m@dZvn@%dXU|OTWLxRO+ab=`xkNc^sfAb=1jH%GxgI8D%PU)do&x=VdB>C0v z=_gF3PVc--)0Gx29In(+S}3lL-LJi5Ds}f6IC@+UYY?u~>A9Tok>WR%x?dVNI#sy_ z8H|6s`Le0h`3)SRvN9&6-9e|LvdeYv;WxR_GktYL1G3JUYd(uL5LfebfBNTQCbw}- zu>~>L9_>3K(He;ChK8ob@w^890t$;Dw13B)$$5LPmFt{+Q{d{~V#kJS`kbbeRV^FeFy)I!24ZhcoR$Ys%DsO#QQXG_L6#y3$MIfO0Kk32+4SS*T#17 z{MxNFT)?;_1Fx)bCiOSAj(7#|rsc%5e_H`)*_YlgS(hu~`)(vF*qJy4&ab}0Ht%@V z&0Qa`;e*T$v-hpqB1^ubG=vb8u3d7nIZvS(>Rl%=&FG^_#|dxrr2u?7VCiDo!+Im1 zWthiz^x}-SW^Xc*R=43uri$b>`EtC|0UH8*aUkkd=kCM#`DX;wdE4+`o>wb(I>%zl zQr$t@rF?MU4~M|1%h%u(Elj$`c1bPYM^fmF-}niKOdmqTG4bWE`_miThkfcH+S6z( z-($%h!On@|+{$%+&w=PAICL$HgKS1bYvV`Kv0ZXn^Y`MovGi+Yt)(KzjBQPpi?!vd z)9b^zV5`oh7;%{I^yFp3wg%b{s4!#o;Mn{Ls&l39uaY!L% zw0h;|sf;nNH8Nb~r(@L8?Q}{lJGp->Ke=C#8rNZMl1}dTt;aD&liY3G+~S~&!~5Iz z)1MOxMjH$QI%1y&Jv-=RJ)CvbW~NeVsYD%4PmZ`a;F$Y_wg=9ymf#3toD$xiAN0H$ z-rqeLIC{xYVRZiqX`>RM(vey|#hd%EduPw-Jbn~rz_U(j*#bDyhBMz@Drokt+Hlv$ zIM4s6NT;y9vGNmsod1W?XhGdZRbbYiSNzI5=AhTpv*Zvw&UwJ{F2~pA$)4k}SLMSg zk$5cnLyg)}{}%l2W+a{PD5XC2s8>CFZStDI_`rjEr?J=At8N>!--iW|^966KQ!Gz9 zhidO4z02ZPG7e|P=Ntl_uJ9IbBDN1l_De0_0W)~jtvFDav&1!CniEX;Hl^F7r?


9S7fHKfmYykoPX|QB~LC{|t#R zv5^xrD)yoTixsR@0s%5DZ8Kp8W^@L%g4$LTMWfaS6cVsLfH1sHr=wKu!&Y0b+IxHZ z^xod9pjI=1k^mM1p^=A$0E!Hw$V(CeX8zx`_c>?I1hBoo-|fBk|M^WabN1PL?f2Si zuf6x$YoUz(yyINCCZ`AMk7l#j2-qxLxpCp@x{`od(UsYhi*LNXK6ynpX#8O{8g7H4 ziF0#c=z4E!>rV7v4qYEGi@QRScIJ6kBe|<)EF46)r7QWd`CX}AkkhF^yrH*fdE;5I zaP>0TkAhA){B!($Z3!hP8nSIuCSAp|1H6zLYTUX`n^6%Uu>gsY7DF|e=-)xzGQNI|A7CGGY1CDjcJC^1TZhG0_Qotnz+5?Vmr33C1&8i# z-A(vWj-C5p1;|7eUQZzn;gscBep`p8tM})|Q%(pY2Qtchc zz7bfT4f(qt`pDZB^llC=X-3iD(S8qoR?3FD0IjyPHDLTO6<;ePQZo zL3nCPa`0{ne=f8qQ(}c?`dG2-I~C3qZ+jpmtF!2s4GwKqTH@N{je{^F(hxv>C>sGe}{4D`vd`rBm_j1`aMn8J|Xz?=H6gH|;xy7eWTIm74 z;J-NaeC|b$@r4^+(}g@}*#?MrpJvSeh=maE!kWapi;cza$~&VDgDL@AOYtCFZ^jR_ z$5R*jn~mybE53i7G5s--3(fTgx|;qxrIKPo_+fTZdZ_=I23liZlhG zvWw;Jftd{@N|(j_Ym5ay<242e*b+k3_o8|UY~iSA5`qsK(9Iie-P_S9Hl6Cmp%xbX z+0d7#R9S`es_wCKQR#Vf+gpWI&|Hh*Y@hJ+Ym?umlhJbn$Y02z3d{ttW&ExvdUXK;FA(UYhuXU=hrId z^$*DhdW90vrNsgN=2@?2`X?XoT0yhlHCH$xKMy9qT3{ty_s^m$)O%%j-3Ma@ z6=5S(<1rTZMa;%X>)wd}VBIQLCms&p(~=v!RNA$=uD+cP#JpV)WSAo zTy7GXCps+G#OBOpKQ!9?diqc+oUBj4rNfzFZe&gxJi(@HK#VTU0DvTllq+(sV zI5bEbaS($vdt*g^^0rW@t0_h4x5(t{H1@n&4BRTHei3Kjkbu5=mA_>Bb>b6*0!Ij6Zz8 zhYm?arWUuMW?U8HikSI1VR+{4=wxVPW&%~J5fimklRd^_QNx^;6HW@zO=GuxLSq{* z?I%mpl{PO7fD7OFczj~ww!(<_pxA_>hL$qcVB*s61qOX272HP!KE85l@wQlUz;wo1 z#g(A%Sy+oZH)>uk#jWcT^Y4loCxIQ#!z3%U#16Fs_gA({?l-(p@nJuB!Ji0|kVGk&!O8l_PsYMzN0TGZbz$iZXg*#aVqZ_!^Bj;}{W zezSEOwtwEfjSrl-RFRHvGIF$QljE8T&Cq@}JE?{G`h>mB;nRwNo4i7X+TE3XJZJn{ zAJ0<<`*^0`=JQPX?dhHuzV#{3uwM$(sCN`eO6d%dlly^uzruGeU$_}hmQo0P%CZZY z1t1GR7Jw`OvP{VWkOd$M064;TAm6X>oy#{XUoYPRzJ2%_dm)_g{K7C-ZWn17o-0X_k+iP!@P)-&j7?7iZ_>WL|99 zhrS*=FEzw~(=sn*5{1vK{%0~0tOPx4w5Ntq?r&K>vddWDooBs$K6#vNbct1s;@f*~ znR&MaC>RCt6ZNY%J@StYWgCP=&PZrG=jVW(e&<~?Yjby%|N1%D$l;ZifP-i! z5ex^r>3(}exhbj&Jju`B=NwEJ-P}jy3q&iA`(vHEl;`>Ja`{Q%+{dm0KZWmAJ>b-B z;PQL{17VVX2izSNnUW|f-_iL8SA7V05SaPaX)Y6-hASVQcg{4MfMtggqf zVK|-7NYeWXFtvJ8RTM|TkCWc;{Pz1C>HRA(Z_Ds^!9)h_?m%2&~|;h4q-HopDex3-d_l@Ag$}O8(|irL2L5)fjW@_N%QA zt^%SRZ=GDT2_`NKu}$ekn`1B8uu&VosEVxh&pAhLE?^O*H!6Lzg^ObTeKQU$WdY6d zF+OIIr}l6lyE15A9Ecz9GqaREjjico+Pz68RZseCoMAR0VJE}!9h^k8W1^S4r=2y% zhpf|A%hf&s_^spC z+FG7mBm8g^&-XQKO$L~Ef!T}SpMlxPaRLWB&2`VZfOi1gPJ+7tegoj00OB|O4X(gV z+ejdH45w|@Dc5jYZYu!W*Gp;ut>Jo{o$ZI*m#ZQBtpIH&LWbhZ*&6n*sV!yUo|yPZ zp?`}pev8`9NzM4s+++;FW>9=(zG_r>J!=K~Yg~fg*5XC1q*DZ92h zK4u<$nO$LCU~Y~d>oaq*+V@DuqyrO^rdZpnM;Z%^g|~=bQ^RX;mErn_@03~7m>(5S zP7a3H+JR8)W9#xv%O$TSHTugN(iid~hML)QiSO);CL`QM-C-dF7pLvJo*!wMWd2i7#+UmwK<4+7%NOEuahgv@F^t z-;Y*SUtpPZBpQrF4XZXwjTyR9D6P zHDES#NYyt`-+mlgUY%V~AZ&6f-9Nh^Aq5R^tASXJI@S>sFtku>WB4Kz?nKXC}4Lt^>IA zpq$7c7_36|d~8whDi;M$OuE`4tsDeHTaOYsM_X^uwDlc4>%Y)VO0(HUvS=)R9yL*? zMY6rA7uy3Kdn&kFUGZ#VNP`HRy~>bYr+`Jh{cRvB^^;vX_H4`ph$0{b;DaWEo=gfY zGxn=ya?QumTuW&#v!A)1J4Z7w)3bxD#GL|>zf~Z)1mckUiv=cG%|7+1=)Ev^g37M^ z{-37#Rf^_MUU38MqUroXTpGF3j-Tw5Xf$(}Js5;#VTicu>G05%wpCcBfd6=bRkMvA zH=~9c?k_Psm>g#@3+n_$-n398TZ;zxqhWSkLH&X3m7awhPqvV=@3k`y*1$0A&#to> zhE?Wh&R@Fw%p9&!LW&hmhF*{jdWRR#czTJTh2jh00tD_8xqvEas<1*${R93VWB^p3 zVH;Yy)L{e8q**TFTj=3%&_asmaA`zo!{tT_p*YK`J^>{xvT{ydm(ewz^bh&Trz*2Q ziK-Y2<`JO>WpRz@|15>!@;B>)^oUcUlQG0@AE}=;WNfOF+40FF=W5ETkSl-1@&6o> zrC;Q%f#$PN>MmTG&inIbK8eKo;HE9Ta~i|H>A=`|35;jRLRi zp-8L?zWr`fZohb-0Prbx>h+}du=b0s7xmElYbWljo~Vx-pL?gxy4{JaTkI0&T`=#& z-B`W*=K}Jq<3(?XDx8=qyRhTX9eIK$+9GeBdgt9UYwy1K-kI*ueEI+URNQ;CxsX%% zPQPUa7x!+z#|l1)yuT}nnJC(pomh2|K>3UM=F9zl>mHVVxMlveTmRa+mxrT_QEzX` z?xw!+I(7<}X*H31v|C;$JpL}bo8=?zfv@rtyr{KN)GC4O_PIx`@&<3~d%&q(%i;OE zhYL7@sb|0BG&x4#BNM9Lwak~we}*x)9GI_Jghxi5f*V;mLgLvUIeVIF6DP}4!41#X zt#>m6Wgc+btwAAFK&O{~3+z4oKL+NVGM$){@92EnaUwdf516SJYB(7Mx*j8kX&?P7 zrz^897~5aLjmp>UD4V3;1MX)Qtdnm=zV6ADObh=4%)Qp(T`%J4^hQ+L>C02ns|V&$ z3(iSzM82)JZxiq&FlT;I$CfTs>Gjyn{a5_IV8Lie8!o@T(iNGL!i~<`ZGN5(=mzfD zujtf-&Z~UO^KI%y@!tl_B~=>EsmJiqdE3aCsPI$(^I}ND2{l#eRpz0yN75TS4x4&> z<&#Tql=iTGMTYeOUp9*^N$(}nT5F|8^*vQ3!>UdO_c1X2rU1alhI3BR6KKnmK`sa*V^Y`=#;7{Z zMj}ZE$%bAcIH{CfnmHX}G@v<4%Luyfh?D_jmta`AB~9In`6jXMaBl&W`Ua z;R2Ji!Jzv0n~CQv;DW~7$-`>+om3{ju@d*z*_KqTF{uE;upUS?10pZi~&+Izr`!D@CDp~Rg2rD9>L@d zNYNkbWz2t`*O0kcq^^;zKZY1pEzVf-nruzLxNiks{fzhz2t-yZiei%ZF1B{>V~>9N zYKlAU>?s7Xuf!I5_Zic1hm$kCa+^Z}&#zK}(=M7PPxpBMfovsp$yPoanq6%BZ#~49 zE&e+=3b^A)%~+%D-v{oXB&Z1Skv4nz-5aC+t#yBluGcGj0kNMm|4o0^if zt(0)u`GPRKUsR@_pC86ku1icCS*3lxbTv;cg&q_wg+ZgMk)LU+#kE#k>&3NET${!9 z7k)UW;HRx7WZbbuTMn{1^E3NPI23Dch=s?C)-{_Q(TE7L1mT;tEQ4Gk1UL_L<$X?Jrx!=6=v1o-Let z8Vjn-0|AVl)$cq`0I#-iE2iIXZ1(Z{)IdpQ{F0{(;RBU-NuKvU+q-|Bx9Fo#&}Dhv z`|;-31%0P$>V6{PtHZ8Jmii<0jgtCR$-?GHyun8~h%}(t6?4GpXdI1lRa!a+8JHWuGT34_U-y@B-^x%HsyBG)VyUqMK6{M;qp zz^cMw9?shCjAxA*!^6qzWWPDQeh-Hu-BGsa>KmnPBmRv>`~g+IQZE~*z1XHR;&xon^5s*d7HjFi1{I2S|h8=}tdwti~2gnlcG^IFz(U$F_ON4)zjbah!w@18d=sFN=)-+d=cT z!DX~g1C93rTK80<5%Z54TIO)cGLl^MzRHvg5C9!K@F0=db@rd;a=*+3p2w z!Sx+DQtiHAQG05aujp7HwYwxxv`r;-NP^z$A1vyCkg~zPvYBEN<(M4>%DA$*pvL&t zfkJ2^)gVy1UB#9Wh~ug258_Y-5mf}L6rB>3ddC+kI-GjXSJaf+RYJ}Z`!FG?_Wnhj zXWrKWU0=DeSIm4{1$9Xzso`;fk!a-p7P%is^;Jvcl};Iyh?_+RZ6ab@DN==vK7@9S zh3`mT`X{x-%oWDM2o0K^A+4&mh4+KScKbmFp1A5$OhGcCtWj^G6+zxO`Ixd^`N%pt z7k--c#wo%S&R%cXqF@U0V7%5F2e?yqsBn?C%cb$L^``P54Gws3ZB=m6&^b8iGI>*Z zsc`ALT)6bDys3OhXP1JJPRzjwF65^nXd*s)6|`WFf~Ks0A`OmKZe>Qh2j#3*Co3=! zJQT1E>g{w_Bj^V3<%Nr4D1nxO@wEz8m|bo^$I)mAjyW z!0DU?OYFRK0|>I^!UYFas-(jte#`qR4MDpcj38`&8iLEYa6xf-J4hNZ1GgNeEHDH2 z@P7Qjp|Qr?iektfI=|N#3x6S)2E|;E?aF3<;j8;p*vlE-`g9|&jOBDWm;ClJc7^XO z^c-nl46yGRv0q~1tV)Khyw4-TZ6@Kz*LUFowMa}5oVNuze z4<}Wy5~L4f!Y7(s*Z@p4nG{%c0OTUXgD7}7k(3#d+hTtZNRRRTMzdcqk(6A*O)0s0 zgor(Nk2=7aU_#}YIG2kHO(}K0M*A;*n;;ReH;v$uzDp)}o5tZmKQ@hH7UF2S_92nh ztvem=Q7#>OGBXt8Mp589y4E6{sHe+ zQ-^SG;!LFQd&%q>G`FLH#9Q~eh~n4!f`CXOi0jmr29QYLj!V3=V0O8Em4vfROe> z=Ql!J;qj)m*BG6QM`3U~84IRqQ|64b6KsI;cHlI9h z+}2<8;=v@=JrnXb)(&^=x}$IJ#c4e@d1D(#evL8Imy+UN zub#Bc*J%}RT_J4bmypedK~ehSUHOs2#C5(JPW~rJ6RFn{=T)^noZ#lbkp^$=8R!B8 zHoG7upf%M^3t}P~qS4?^g$5W7Mblp6mPsF6{YYLuFsTeP9SiiRhPuaB= zPdPMIp5)yf;MS?WLS5?pWC0Cu zd#9$_d{w>3C7tz0HY2MZD_X-DXqzw7D7U6y#o#xAhTojL;%2g+$TxQdh9(Jk%Nw{_ zIHQk=To|`sta~qRajpF2U&zGBR8m%T;l$G~@Gv*2wO!b|BDc1S7}Z-~Fkh2VSbtP3 z%^UMSWc`evtnC8zoqBP%Rs4|qKnW}MQA5co-tsI5#lS1s4?X71x?u~s#((>e+HZ2P zu6~EmeYwWRT5ezv-mr8T*POw0Zco-X$ReY@>*xH+9ZKo#xGcUC6PF<(^4Flk@g^>f z9j*Iy21CM~Tpb@46r*6Vsw1Hx-rBN6@iOBN>*EL8>l;-zM#^>ezs7Rsyo>5V9Y$lTYSRZ~#>c#SFF=;J~q zj%QxtlAE#MGSY>i98$kiHN)zfrHJe-;rb}oRS(brDJdE4D@6-&tx^ys(VN1l>+a*s zr_>8K-dlauOQNlPg9)zJ{~tw{+u-At1Y7&+kp!zcgRWIAHJTzBe`s-9>PxzzTDZ)y z;Bj4;u$MdX-&HTwW^jcRW<}rEe@^W(pO#UTlSYvX{q@<`390=I2?Ss1#SNHO0zmW7b+F{b&~El&k9U5HE_a#BJ;dc6=5klM+*K}j*m8>%?3lm1?uU{3CMjdkytk4oaaBi}`qU2R zcG)p$Xsft^R|JAWza5D0f`H1j(^R-#il(SrYuy29V6ov*pHiJ=#(rVNjbiuxRn-V) z?3thu+hH{$Js_R?n)E|?HZvkTb#-LwTfxMQt-fHvjcaB8RP_%ge;`>pi)IIym#~^3^gXjfHo@ zR;GW#cHDW(@^;vH>)_TF*Vh}5 z2edTR+?QC2Gju9g@2^78Z>zE7X-X@W&tbVh?1GsxcYi&^77$EIZu`f0Y2sQ6FtOF> zZd@{PEhU(^wlw#CuDlP(y$_W4!MXQ~K|hqOtf_nH7X`JKaT9GV1vBVb?&S&sGB3O| zvE^f!k%?`60^NJNegpdyz+Ir!egemJSKOM zkDd?ILw);%{2$MpEBHGuSy2?ou8K`vg%+0;Tn;smdM$&tXPOo^KRBjy_&DJW*PcI3Fk#Gj)VC^|SRyOg_4 zM)~*K>$@cD+D|1)+q@g9{iSWQ{}hQIFP?R-lqN_XDqUB5)j#y}c8OBQKw1gt8FlXm zxIqM@q#O{YhF;qpGIv%>`rW}c?sOhb)F#{OyCt3xJZSPF8s-p1U=rU z-5;LX+|B3@Bqy-T-rXHA*Ufo4eGR1-MKWstHas+?)EsI0Ltm~iYO=ve?czGuaSe1_ z7b};#)#*>wy%{*Ns-X4~MkaXGV91`SaPE%q3wEEHb%bmxLfJoLFow+CTp2eOET_h1 zO5L#UE}Y3`Z3EkBnVUq>L3}4SvgK9O`NUqR8CMXDwR7pU1s=TGoEZCUO?AP<*f!0S zi^s2($J;rNUn-9+&|wcnoUwSk?svjnk7Z!T+G&J{ckhH`aqI=40wFPexA;TABZk3U>hFw++^*HYrljXVSOJ7mv- z*P5mD$HWzVg+8q?;N{=)DUWlMhe%vn9v3K&fjN)QDvyhm2RqrU!BTaH zN_O;Qu!}6`jo*`{>a^Rw*Pk6qcFwl$h4%e*ubBBqHprfR~*oCaj(YX|7YotW~COAMHgw)ibk?MU|Tra-OzdenYIp=RVvbEzkg6Wfy=vQpWtDph!Eywie zYZFm-7{dSrK9%kTPJyHYBdHzi#C~WuM}umPX&1Gq=ZBmq(KIgXRZVfGYKk*eQ(RqR z%wjiS`Vn#LCt%t`*Z2;NGo}Tvk@oA76C`#IW_9A2{^q~R>znL0Y)|8w)qrby=fCp1 zmDSpIHjSr$Kw?|D79*-crth;~Ajyp-+<`C_K1iVnWtVY!iYqOd6p`no0{({Dp+emd z^_c@Lqhfm4qap|VzH&el-TdWFgjbz5l_W}hbnKlnb(x?@PFou8NpO;=4` zF`dfm=D*)@IY+=sD~V5CrZx$+6+xKq=JdK=g#QV89W=@w2~CIBss})fK`^@i;q))#(-}_U|tuu zmSUZC0kmc*MOiQypnC|)F?2;};nq3dj!j+7ai_QLVbGrOA(JO{EpZ<-rSbE`8;-_1 z3ysBVWDhNQws?i77S89U`j@lqq~1r=aH-U}AZ4X)Jn}KnRu0C(*I66sTu$Qz3_ZEb zYG^t6B}oO%ZS}jEi|49vMHh2~k<*~4FB?gezA0D#_lk{{`klhdM~gP7Fw8fkx?_aH zeWO(eMGp}T5GmRaU)5dr8Wu3TwdY&uWLHNL#c!&F*yh+F2}O$57%%QOQ%4XM-arbe zeFa?PhePYc&O+D=R}KdF*M$u(kQ_<%F%~SO%+#w#$;i$skIsN(Q6LufHsTxfeH=*? zHmNKBks|Sl`j{t}D^5}vs%X5}g62RelAQLoW++e8yddm7sLQg3vT#<>rnsd+jBU=& z*@eLV%I*8XlxSs#(_WNH`5cLnlhP)E%8ND1>!Vm=0A6eWNvp<+wkY4jPSlupGnx(} z7zA+|oCJ<+mczZ)JpkkC%_CTOh?JU?>mVJ`6f?Kc7pPN8WeQ?NZ7Se^UH^U9jS~AX zMXN-yLDatsMF(;&6Rq6ulxLriK(vw2IkBQc^r-0d*c&Z^G&W14uXKiJ)7ReGcq+5zN_I5a7=5=`ARs|Imp|RES%@U z+kv#GgSR*FqVZPb26X&i{qmQWIPv$Cd0V^<$-*jE3bGOJq#$BgI)&Z1{-zSV`8LRJ~( z#=={jLHG+?x+wlfc2zo+(T&mIRAtU}PBlg%-J*)|pg0)6Z_4<6liZw_anw(}5ODA` zSHM@<1#qD5C2Qfi-T>-bq?JGXdyJ~T*Ld%AjrR}p#`~LryH@|{jW^z?PyOi0C(m2I zy8h^sJdOF^(S6dReE<1T@1hRPDzRe_f@7y91UV`INl=6U<3Mkzq5nfDX$YG`@s+1L z3wuej>?3CoTjeV|>xZOniA?}vnLykyi#WBa-+v;;%D zgtu``m^8gTJDq@+S=c0vm&Hp}r-5oV{^(h<3_P%V|%wVko-D6dgG}UyMtQg4LmP1@M$3>Xq)ZEq+aiiWNYQQVRJ?tPZ=ac^=h-w5E4ns$TQER*uLStdmt1dbx93Ms+~h|o~&P2;lkQRo>_%u~R@&!|N=KPPj# zrkff+ZB~ec=n2(x5KM=qv~boUn5sbe)KcQntvPBbL~Jiwwm=S5DUJ!&yXd5gMpkI_ z6B^kRF%K!mDHAJdr4S0GHP@Jtw2D@!k|`PqQz&>GDO#)Pq>XSkc_iG%GC@3!9tM)A zgJy~r}-`Tzcm`6o@(M^c8dU{yYD^`I)g zZkvP&Zmoq}NW%(l*|b7+ZV+}nQQQPZYqnhh32x=QqFzCapwPq~ocz&T7B*V4A)D&7 zymO;Rr7g_;C(zCnY|m=k)Ekx3%w^C!i+-xteL_{3*){X7ydY%7Z$e2mi*M0yA!-%) zu2Hi*<`)%cMiPT)TBK4nNEtM(u!$tq5(Rse3NkH;vR<(hl{q?Cwny4d5|#B>)VnQ@ z)Ixe)cn&{+45H=--lNbO*LQ1DyUixGDzA5CyfKIzCPDeWquP*V6e=1mI=f3^hl@a7 zO{f*zPJxq#Zrz6*&W&X|u1XBxRAduyG!nixId50l6v+Yw-$3dE#a-A##l=Y|HUfSk zH%8Q$L7;J;W+pC&nb_~pXEV685xR)U_Uhv zx8Wg9GBVyfab&1*)pKOLn;RJcFj$R_cVu)pLqjnpCuK^kF@R=Zd(CZ+0pUwvs7Esf zxQK5t)P0S`b7TxWz%r0IL)P5Wa5}@`zl}v<{%_Z179J&#df#5)!K6gIZ?M3VMQ?qI zpT0649_4AwZ#&6&$T0+ZJgB)}CKBmy-^bE3ijoLk=nW}rCb0o!{S@@6nIzxKnnv(s zHzaKB38}%L;c_#HP&UOI*iA@yCuR;99P@5ei^Uyk$gpMl$1~kqw^ETI zYW4s-$w$2_E&_H&*G+kW+hg7odU(_Z6106YT!b=o2rLtUV#tPo!WFPsDpn#n(t&)QDHi+p2b@R#Wr*#b?AU z91L`D$UF9U8lvWksJT@V%czugN|%L;R;Zd~n4b+du8<1ClTkt8 zz?AQH4Z2l<+I87R1*yv+sUVO-ID$j|qGzgODtD?v(PapdyGrP7J+52qNiU)VxO|=+TsZbPu_(X)TicN5z#~B62+8dW4*_*%`mWW_^v> zJM3+mkSzS7sJ9u~MbhpxL~(L{I#Rv-bd32ovlm%oj>D8r6H@sYuxAVYZ%AzRojnse zhlHZuU8IGQVLPqJ(C+Ba6(CynsXjl%n zSrA8NA{?qucIB{VaFP7pQ^Z-^EMU7i43p!aZY06G5V-E*P%Kp@mt%<8jYzmU6zfjm zXy){$yBWn}%@{POJ(I(+_?Yi`y?%y|K?`QheEKS5PSM*2ZD2&A+vL&r{rClU! zJ~X%tMJ3=8MGBeeTyMW2>fNz%@EFR=-!*>NxPVixA{94ATtuKH?hv`(!e~W+V^VVr zZB6EZTngU_C$IF91eqI)*GaMbo5Du*rbOudfKmNNlZP(TqI)Q8`qw~+3i$X@-^|`h z^ZK_(&8jfIdG5vqjVHIp>sp&fqPRE2Zd8o@^&Vrkw0ewq zEmoIZM^<#u-`Hh~;}35vr1du-%;0f}3 z&jcT1=N&n7Mh<)9N?!gfFO0Q~Yecdx;(y~L2hhlr(JqKV(C!zx>(9Ixe9MQ5^&g1& zauKu>S*KPxkWRCmnv(VjqY)|0;qu~{LWcb7L9O+9s3omuEP9R5^ws=aLt|gZx6reO zUye3$i7>jz$P{|SLN!|qxE{i#Ltn?GLp6x06RRFvU zj1ci=uB8}@>+z%f_v0^@4>+Y^bMGGIIcYkcTJE_^1pSP~6Y)>{$1iY0m!9E);A!0% zO`+)$j1?dWFhdA(E&LJAVB$CP#3wnX9|u8!S2=YN+0L8IaR)80}PCyBh;> zT%;2tC*3Gx3M^Lw&gN!hmNv!A{fagP%s)a(&Co_JPkuR4-{9E~`Xnc9bbu8UGjhc2 z(6u!iqTW4Lb(rZxv@!S;P5$1;2B^MFr|$TbNdM7nk{`{09T%09FbA{$0hDd${!HB^ z4CPJe3gfY7iBA;3o@x?6!PI*2y^n|nLPii^?0({7b7A2nE<91*of%MkbbqvD;d-PL`z~m85loO(daC%&d4=7J8zA zuBvTNc_d!}dp#;C@LtaZatX0aWZ;z<89faMu&aHPfc#O4hOCFvGRESM$(M_d3Q|uf zGHTRBr?YRiRmo{K>rc}7x}0+Lz#oWLf{>HB3luSc&iAUeuqfh$1IL=>u&xmUed4PE!Q05JC28wrC$-f zn?fJii4<|2{iG&@Qn-#&2|oPp?J;wwAy8XAsL+@Q?h0 z)X?-{>?mzR?iBf}Qsl21JFAQrk3@{$9SF;MKEBEqMj-izh?6pXKfc1(IuDtup@HNz zmekdHxld=V8``$;$ecUaa>Ybk-92y-(7``YoN#YeP!c{j$;^)37dYz ztD^okM0XBq(W=E1R_{qaq)OGPN=05|@Q@F4on!D>(XlmBM4H=?gTQ~H?_~(Z}YGZXE<7Hb&~-(ZW`TMPGw=i?rI-SkbN%8%hAlF*_2IiVh-j76AeBM1s%uctyCqrrn1iloG45=1orGJX>yx;2Y!R$-V(%>@ zws%9a^s7$%c8wm&?&5QxzK$=0;BU!Ycn&-F5uDTL*bm}Tu@8z=6$6@V*O>=Xdk3bv zdwJWEr5_Q^GZf2_>sVJlvcQ$dv(AXyjY}6nc9!LAJhj(q04l&iogVzx+u4f@mCpVR zTryUXrrMfrA#vyBTB_x|oI@#{mpRPA&dYDe+IeXpwYMw zM3pO%fCEaLYL$pnt=#qC{v+P{ZY@&vm~KnT2=M@O_q)b$t&DbPN%dM8?T3)z(WjCp z9ql$Q1KA4ts!A)dDm5G+Y{W+)@>Vw$uqjd=2|%=}Lk;||vzX8W|MZ^pvew5qc9%@{ zg=>8b;+&@{0mITFtBhpC9_{hSAk{-pimT#spH0VwRM})RCY5fZ-q3(;=D{OdRze_J z!{)ifu!b)Ly4LsM1c`fVqN6KT)Dcl9w-bHbK-5_v-TD?_xA{JpkQm&)vic_-h*Z88 z@otQH4fLFPgN#GQ5ljh~7;W3OvO1xoj+KY^Hkjc)}0hTovFdW&kx;k?Q!VfnBZw{ z)>3$Ta-{u0+C?Gl`x6plK-zf6L8hdLHH~L%1l%1d5|tdazP$>!!LfH@MTfy{lpLuB zPDc}$GNU~%{_oppJVv82OG%CT?+6*zqRX+Ool!4GR0l0gmQK-)8})KmX+wa~RsE}u zR)|*AEFH)yNpwD8H555PQ3s*Kt*(Hp%A>8q52%Lx-%4MXU8VgDDC%&^wd27580z+E6k~D0BU+_4L6mbrl+?u4MmEMfSnwexv6MdPbzw& zP*Gu=o)ap%-5%NdqKUzvnWmWv@e~FN5(!;}GBR9k^cy@-4QDX>Qh4ddI}ktFE08c< z$a6799E{ujS7_%Rp`CBDdd($S7APsAilUPx! zi(l8tz^|*68h_PsNG=*^9$CZ@y&E)x+;eP*jGv4SxOGIY{;cuKRVGOZ0bkV;&Z^-^ zv}l_;wsq(w1N7ERM;r1Js=J_m^lJkVT3{`_rnlmGa!@ zG^O1DOu66`%cdR;z(r1?@BEecYX)9ZJ}~%5xCms`2}1mGV0h}9P4uOe|E<63*hcQE z{UCYPT$N)V7?4q6AKKiA@30T=Nt3B!@3vEe5+j%`9Wv4Pu6xCxeBQC!_(()b*ku=T zmx@kPbjK8Co)`nr7SLSU-Sm&KpIlH2<^XCv?|(5yuMDH;O#g%CQgb-{9r?yB5lN{eNUg z!3coQyE+(Z!aOsinEqVD%ApNloF?;s%K$ouoi{yz`Z~K&s{Iex*x(*N`;}*-i-2gF zeB$`gjE9?mK$cG=APzs!i3|E%U5n~iZZe_3<3r@LobjQBw6_0`jE}!@%5kO}W+r^5smS5M6r!sbdM+X1Esz;|D%xpJMbHWn z24gO{F%3z4aWu8X*N*2NsecRk%c-pIvzu3vPGD7XaXfbtf z+e{tZ$}*x$__{X5*SS{`@O7tHN$k@@5HYPW48aT=cioZoneZ}@Sw8a+?dPH>yZ>ej z!db}Q1dhN%zS6NGDzZ!axjxROWFwE6C9wN+_y$kyg&g$`5qT8Odr=hI7{fHVOR#Fzg_$pYG6biq90Znz zy{p1Qw}rEBa@Eh@jXc0A%TTpg2%Nm)OBCtzs#rJkdy#Ur@jITQ8acQTlV6YVl+S1Q z7V>AiV8tvy7Gai)9U9B^Yg~N+euCJW_}*ltG8TWGigrmV+9j!Im!zUyZgT;QJWN9H z<9zhXf2DDdr>(T5mIYopz>?2(U;8MXGY;~c_M{eN$P2g?lQXwU39T|tA2qv3eDtT; zdcynwBjy6Q`szt-NiWD5lV0b*NXqirtRG54d4X4MtxDoXZ2YY`;~?7|7(15M+@N)j z7kJNCDPeLTG4+O=agdl5D`y;Jmjx$BbOl~9EI@Xii-+BCd(JpW+JUk2Dz(x%UB!Bj zUn${_zFW38XB_0y4vZbE!SZ44NnUkC5sz2RU)SY~gRF93>{$COAHkHIf#=Hm+A4F# zK@K}GcC4RSKGK^7UN&P@34gGsPv4v|>7P3=b}Tval#jp{c*Q({fZX7_ba~F0^iLg_ zGTO?G3ICvCaTKBS!}q`I>A&<ro!VMjg)r2gWYXeO6vFHVVAo=1p+) zwikwN)CQ+{@zgpnQXcsTjC}g>E%1sErF@1RI(%h6Cokza`SkPHc{N(;2!`fNn|?* zH?*(elFzsG0~kA&99qan)E*Rg#Ylo+(gkBay5npo)_D$0nbjI{a4jD?)0Nlt_m2J4 zIZmv}3PND)ylg|_=c-s@KtVcZ_A{>zI@gI+X2m*}Si0qV>xZYmiY4Y0q&T4$ioVp} ziB;^tNGv!0$iaGn*T$b8w>&VSzk@$fNr=yRd<(ouex*F$xcv2x&T~@!ssrPc$HFM7 zO+FRX^*hl-4uBpp_G5pvQ}pNBAMI0Nzw*>R<4^Drg_-t8!`!YP%2PWZwE=kc@|U0}jl+Q^__SDt%FrYq?ez5G`Od5Cd)LUlUcGrEFP_O;A%U7Gn zxu))}sdryHZAPuMlVi7<}((kG)4ycKLGV-z7p1L+`mj zS36o2vxZ~@E$ZLyVhyOn3IGX$Sb@U-)*#zxg`u2gLQ{A`?lx%t+6?;7s8yu7@! z%=OWBptOf}>tEY4RQa%xqx~Z!Tr5NVUdF5E`D?wNdn`iWX7yCyNq+t=mZ3(CtSoos zbtUd%p}($=vbZyR)CiZCl9;_7xIq?wCDl-Hqbe&$x&SL7StEhD_X6!HG+)7u81By2 z^A>OkU~Vnba6;)c+^{@2VX^K3=Gs9TPNsMbmu~^-XZSw|%%?BZa87y^!}Cl{3EW^{ zR`i4$RX%F8j;en9@%twW#`aeE4zDQp+a5ee@!bYo>1VX3lkf0~3U_*A3BCZBTYAEk z56?3lR14hQ7K~2Os&9GuD0jZo3EX}XIQO(F@vC~FB7Lx(l71?SUZeaY-3>j3fnm_WPX;%lqQX5T%SfvPF4HsL5f!7|2z>}9DhtfPVLDeyU*pwqzdOAz;J<{1 zYP1^5>E96}^GtdP^Y{iZ+fIZV;l_hkNMH{z&sl|W+GY5NJd;!*(t8P*;})Eg@9qe6-)4?-;^<2Fz9q&PlIg#4sxh75^fB-?dUIlJ9FwaUs`8er~9G*8m1pj_* z!6-m}EIg>BS)ETA2=^Lr+rF&5`tVS26(dKv@%~XV8vGR}nsVs$hUd|>5v2F~D#}=` zVI6!Ko=`{jklqh~IW7|&pIrGy!#U*}J~|IhB*p50>3fxibLOLw6?y$3 z<8l-*-@97FQCu5eMp;8p1?_a(BN4fxFFu z(J5N#4fj{N;XX^?FHQ=VH@$hPX^3^el}yyB_2!}Repp_<@8cf@rgD;obJ}l2MPC0( z^G1PrvM1cA@(TAnQwH2`EEt`lmG7ug!`yf9lW_vpQB_3@RDlitXR(QX2*%4fl7NV{D|=h2sM z5_lN6o9@$4x%7tRnV1x~JAv8I6E2@^@+_m{-v;K189F_OZd6p}&HFzkcndK1&(v_v zIIkF$SH5RS;2B`5AJlMX@KEhCx_q=7|72TkB`{OxXgFsam52so+pxUVB8t`FQC59iG>} zQvAM;Y8d-hkB@wQcMlmo0o+61(@;*n<&}OJJND;N9E&U%+t0$QJiLFMz<&eoTaRfd zC%w_5hP(0QpP2X_1ZL2WG~B0nsPrl-M!4H~4GBC7%-4Rb;b=|`S6-RNXa5xc*}$Cr z6AkC!L3w4~LQl4KhXV7Pr!|~2|Bf1&SH8u-Z3m|2nI3TEm3iYs%vb#gm?h6@IH$hl zqw@Hd3kiPAg3*w6Jw}a?zPCT;;rREH!Hpi4H}8KAxIY2cX~8=AR#fDzd#>vRZ}S{m z=Remu@M?{Z(Rn76ZzF+wfNA+B4d0^(=~znx0AtDfT(svo}$aMxF_6b7!DOv z{|FvD4~*}3`n@*~HGa!S<>6Hp{~$19U(j$)|BlRulVN)cFvl%8r+gLVdF^*UaJ~PP zV;sKn$-xcFTlmZ-YzZ(~3oeH*BmHiA@2A1e`Zwl}7gciV&_vTU3aGu*?<(My05jng z?ODV_!?ECZ!My=N`2{ewDedXZ=ff-W#)q(9F9UNN;_ZkC%2CUH@q@$zLfjw ztAYFTIt}aeZ^cM|r7QYsI^Ym6uddggPJh6TyXnE#2yOvp=mrhvvEG7tN0`uD=8jj>O+^Erc`;)S+ozOvjyLzNoF**-nw$M>af%)cf4d>7y zrnk}BOZ|$%j>mxc$;aB$>EBW1es_O-f%5$vnC)WPiI4Dus^2Px<;~M~LwLq=qV`)! zn2(blY`Z%>xiY=Xf>D6{sPsk-%bTZ1Qt-<#w=z|1L-KLzQQ^<4$Cto^gaxAj`BCYO z7@0?Rr;{9v%9Se769zdXR>5`eQ`?y#F@+@%anA zo}!@|PJXR^%j28+en{~Ab0@$JtGax|h`jy8Dl!@k-0Vwq zzJrKYRdRLJ<->$8gcoRMuPTKji*Lpoy@Rg77FM`ju zuB-5}Y_}&Xe`v6o{W;W}p!xvo9cwTn>FMPO3~dgi_IwI4Hm#=xH7^aQRITkbSqz|y z0vAi=)OFWlghk)`UoJVl{7k8>CBR&TOq{Xc34E3D8RJ<*@5_WTVtMJ= zBP)EhMX8K0zRSxE{h&F{hYTJw8iH5XHyHiK4Kw;JYL~Zui(2%fK|fy5k7x8_sea5; zk8#t9IEC-ke5?4D@hxc@H%7=^)3{+$(lAD$L|FiGdH=v`2_v@9GZ|M6U(42Kz*1~b zrL4?wMKzr8N~NAih2wL59#q>5TZ3ksBk4{_km~ghC$1_{ZIEq2-+QS12)=daX5L=z zZWrxc+Z0ZWFF`TWexsz1*sTgI6Ci4D8D$jfE7W=(g+^czx&B26Vah<7L&A8mHdcEDQ7%*09?AC?ryZ({7qYjVT^nHx)qe{nE z_&sUV`Yve{<0*6r9iiP(vGZ^^`BT+U$uZ|dOw1L(*Wk1qdh@Kt3!5)Cka^gAtyw*O z+M*wu^rM|e)O>A^e(dMbwCFg$@@ZOBNIMITM9mkU!5JC4JyM_D#F}d6ne?baoFS^d zftx3=Je(Ze6vglN7Kxv#ES**!<~_m{UYy-8nq`M`zCnn~&%+Jfh3+h?L>w zP0UsiQwCSmT=a}Y@psO?gTB_Vi!|&afz5m^oLuw_S)DZWgdAr*VioA+O&6*mD5h=Q z+01&<0w`Zi**2X)!cB|Xd06lkrky84w$wp01}UV$hlUrg4A%4q$n#3)>aJGwMa$e; zor@x<1&xG@#>1wD22p|$UoNfcF&6$>{FARqNBtgETB^rppN>QN%=iKNhb(PwiAP@O zYtxmcMdFrEIPn9C8cr-)LVDrEBQib|)ff-e7|);|Ut;v@6K)z`rNFUL+DArdS+-@t z*4klqJbVUNk;CS}Y)j@G^d2b+v|wx9mW(rupoa04((jX3e3kSxM&E?%EDE8OdWn2y zp=T3*+NGL9i~{#)lG>T!#BwP+W=O;SHv_K;LdT3CY80NlliGz7^-JWja4RKFJbAzJ z`d5X?l=i%E;_9+!qG|~8%dzCLhI4`RqmC=s8BUnFhC-#H_XyWJMJn054N2q^Q1^Zc zdbTR^|Gx?aE+?m8g z$4`Hm4HNY;zexOk;ly{A;m)=w1R%1F9`?I15U&1~(vi$f3KIihVZENX>KlOLO;23) z&*(Qjan;XLZviH*z!bhrT!AXS;Bf#P_BI7{9RjKjAhKLw1N9SaF}tx4-p0pQm(^eC^MFHou4-wSX{zV=s^==eEb!5#O9bmnEV-g&m4Ff#f;S^M;ampmnJ`_uFN zKU=^5ZSZz`+fV8_?~}d`3o0|i8N@ndOzVZt)6=AZP#ShxiF($YR>m`ET;0I5(FWe2 zWXv!Y4j@7>QC$*H%RhP?o43YzBrfO3BVc{=sBb7X>&zyRxbN8N47hsL1O* zYjonw@&*+D3Y#r@k6M^S>%S|3UH`yK=Cf2*2Fc_VfPKNh%T)236p*B{On%J3lyFo1 zk8nxSP4%19Qy-)G3V>1TUe_J*8>~j)<{_%z*<*VbJ9adUlV{FPM%Fscx zSv9`5zH2GnG^f12>pjNDoUhh5_D7$cXh2^4bppc4Gt^3HYU%e_gM2x=v#F|B>N$Bu z@`|V8M{8z}bByj4e<$o+|K;qC@NyYcGEl>2*f)7aeb@I$$XFm7NcCNhDfb72)^{Do zT{|#+ke7JZ>9uF;vKR|@;6Xk@6eh30!4pS#`51+Xy{vS@%M0<>Y8)k>uv+KHdP?Uj zDbNRYfX@lgfVl#OmkT8l>Y^ixj_U3#+@bR>ltZYAld#NEs%TPGHCduHXxDcgrM9(?kA|f!%Q}o6H`Jm>TeFjO zJ2QCu;wMH(i{AZ9LscvnrrGia zj2>Urm>y1=HXiS$V{JTcP;S9vV_{!lNTldx>1fm#!<9&(B8_I?#`FOIX(1F7s2DQl zjD>IGmO}9Ivi#&nil$#B+#0F8~n~wfww{Is7ndfrqiO#(J7xG^hq22c^#uTeGG>vt0oGV$(Dq9&5(2& zPbZCkJXIP~bQ-s%Uvh)raVqd~4em=X!C@neAh%4svvpwq^xf{Xo1e{+r`7!CurQR9?K{bE zo&= z6oK?qK`cF0LYvgP&$CRfRECXMBN>K`U?XhS)tR$$Mf1+?9W-H|WK~`!i}La#?97;f z%FMnmNiq2rdhT&tvJo0le!?4Qmq?pv*HOnc1hmqAcQ~#eI4)U&>(F9quU%hsT#Fso zc~CtadYj{#bRBb$zKM*Ly*1%vtW%T1_`{thTVMVu~HN;hC4P?~O5?`7!*^(;(-D8w&Gzo4GQ>0j`Kd;aziHfS5tKUTiC zr5{sIU-~=h**`sBJ*Q_LPAFQFsY@ublDRjbC`jh^MBt&!l!T%SnHv&{#m-!v2!u0N zChBEiXT~Pf7|wi=%^Gbmu~hPUc(Ec`s8uPTn$x7@#$%1LR%5K9@x7reRkl7@mYR1Ile?=3wM+k+;v}_= z2r*E8Wclrc1}&aIn28^$_gSTAsa`cnKvpf+6Ov{dAY%4RA!^y9 zmplD|n`8(0GNS2q*0ql78;Uke3a;nAio~P;IJpl87M*7_w1^T!TU z*R5N(?(4bdo_o%@=e#<+N!{lUU&;N9U3cb#CI`pnmsI3%2 z2`R9h{nni*)~4P2Mdv|!N~J5ZYHPG;Vo1MdrrQX$+-GnSl5%(I3bqyi_mXU)MtsR* zN#cZ;tWUY$UdY@`x$A^|Yr1Vs-1NK*WF_>NZ1z*mX2lQBykz5y&C>!O0Q~~Exx&%b zOz9FET3I6R48Cnxi?M&Kk*5Ni(iAHEp};E*HN@-{2pbn`ZywqUe8An*N|HJ10O8gm_-{Ns%nguZv8 zX{_F6dylOV2DSIl!`u`%AP!eE4nrjlXA{&AkMlXK*4+)~rCSRPQ)rP{cqZ9$q+yyo ze@M5GsQmkjoY%AJkZH>HDrn-;Fa;GPekbLhh<@^UGxqH88WtV37e`y@QN%4&18g5zVVSYi?|JiX2 zpysWy$weu5vlIvlkpfNk+fw2X6f!u+HH<=GYPp-+=k&95hcg#to2T%V{J}C5Tql3d z3#Xmq706PD05ZZRCI$TpO`u?_G<(|m`RKn}1h3(r;yzC1Wzdf>!|id7k8t{mOew%a zF%!M(s-0t_%tuG@LBg1}ueI0QC?k+GZrGz2v^y_bE14O0?wD`PXJx$eqE7wX&mx3t zp!x6Y)6a)kH4ox^;+_5KIsa?Y;(zOTTnFvv+kDR(#=WCiWj}*Er#s#$TQL&w@>N_4 z%~y6WxZ`Bt&foCCMV0FP^Lak}1#x@HNW5B*K2Msbr&T80PgGCdt$fQ}vfIXyU-NN3 zi5p+-aIQ&m7zA_!|F&`C9 zWU6_9`FU@n0l%D5_L|Ncl(OZ@$-7PZ-}rjBlz@MGjCUvf>0wHECK1ch^I0sDCt}Z; z#*AIgvGYvD+N2h}N&mXz)V^1Eey0|_S3d7eichT_)x?b0ENeFD-ryl(ZWzx~!kE4@ z8Kd;+U2fE^k0ji9lya;wbX%NmtFM-cPRz5CS>KQX7C)5VA*8dW0?blK;7P}Qz7!gy z3|5!ozE=vdH&Xy6Zk1?yxM4iM6`4!u!VO{Q=aiA?VeksJk-#z*ZcgYq8MPtfx5bR^ z$h_}k{+MXO|8&7LHof5->36oNF*6?>L18rZId60#wr>e7yA-#I`KUKq@@=>^7_Sd( zmf^DYyewnn?yzIq7T4I}oqD*eX1J*g*9C>0I0SpHI9kqEsz*SIMUrlpiB&AqUmT7t ziY^)EE{Y~8YIHKZH(A@0aHmC>JdGo=6{9J_OUI>&Cdw8<#wGpwQ#_wGA>@dLx31^osNT8N6$-8ch=^}OMVTz70H^@jQflCHj zjWh7t8@os71fLj{(-5Y_$5?JuMn2(MV;F8tiUpgM=0mb6C_1J}L#AjK zBi^!ws_QQFW?n4-TL{b2WF)rdKV*MlW;_k$^6hRs(a~j$+x1%{S+68Z8OfbUXxXT2 zNoBj`b)x0j%sV7%qwHT9xH`vV0D^D_hJTL7lc4X3KCCcg9Uks za5bLT+%yiKl6~ZGIN>HEZjxTd3!m~JCExhzpFn`)*%^;jTK@vnn*15KFbzJtW7c}- z-g)5-qBLbB(?9WMj_1wi*s#6&5||GRxCGR?A4i7@8|D~=MDhvmfid$X%n`e2ay>? zLV}BRC{YRt$3r-LkR`85P zxi}{0rl>VGF`-8MSJkN!DO_W1P2ag$?cH*rAVOgSwR35r-dCY=7cR60kDK_2V`%aE zH>)${_E<$XZmmtEPk2=c@6&Af?*b(k!VMRh{tc%P*RZt*D~FjBEjt=UTiGOO;c8Tw z#yTsqIYJn$WVsng`OHG7^~aRh$w(f5l)hyTk2~=fm23=$g>2XMLSQl(_gS&$F@*O# z?p=mKraGHCBv-BBwXRFa)~wntbf&DXgEbV3^3-nY=xg~A5;zK_nZ%vin8&Y`;++HV z71N-Y<5lach+rY<#{ZRMEtQNSP3blj{!Hz8+4Mh!Vfk&>rks~Mo#Ur)R`F~i6zO08O6_)X&`yz1=4lzCH z@GI#sCW*7x`H>i<)j;kokQp?`oU8Xiw=kCD)GTTvRINf98LJ&h^Pzb}7g4cM`%?jG zsB@z-Y*eN|@VvRmTUdOup6-D4*2*9q~`7Ix<@L@jdx zU~X=fsbCw)!?v4Q;I%%?XMzS!jyC?jtI!1oO!m0G#CkK4mmddF7>?k8L3HD*I^s7l zz&dB39B0}1ka6E%(H=o1o7V8Hpb~Ly_f|MW=ZITXMgN&aKe}!XvQZ1yT{w5d z!K|WgjFx#UV=@$={8e~xB~ZcY!Yyo7brngWFhcL8u$gA{B)l6dv7JhDW_9Mz5Bwrb z-VH6jH{s2LOvKyi?1*(+ucC&a#~^8LP*|;RhWDj#wG?Ez%O1|W-E>Z$x9BEs;TY3T zA7=-$cuxMFAV1493cbdrUgx!brwbptJ6Sz;%HnZK_BlzkT5J0fekz=dJ;7e&0Gp*) zPr{gqtH_;_>*9YlH!HHal=q?u&gl`0qKeSXk67ux=JZxOrz0C>Q$wGdu_qwP4kWy# z5N(-533o2k)~#>48GM&5!x`Evmdx8DtSyIZ_x80(_ZJEGc@2P5!Iy0hG7aTBciGU- zZfE&Tu7zxqF9U#0_UG;(ITTR`We>sUvOChW&_jgsfJP)F94;Lvx}Snl zi67@K8w@16R%K)o%Bw;sokbzRJ5(eNS`Gn`&}XbG5;d|FjdiDt>3ykipL5UMf;h9z z<|gV9YPg_`xVj}j1C|~RNI93V3+JfdShIGQ*_DIH+Rgr1B3RaUrNY}&fPcDmH^_5? zkZeZsSXn;fz3a#0VJ0Bb*p@0H?VgAt(iC|Hgciv&NRb2>!^TOexR(}puy0M7Ia?J? z7N_QV%D=mW28!L-d`MUa#TApjE3IF?2y2Uro?0q9Sq9f~t>Nn9>gPJlMXI-6HnYhm z^y=72Ic2NkcUc|RI-6u1SRH@F&Dqq%FRSBsxiN68kRkbo6;fU(VDgezmo1O#W4$~| z3cWmD?Iq)+xkCGSrDOFXLcgkYR1zw^wPYMfox<{{MvgH7wWOy&waC)=METN~Uh2&V z*2TrORBVl^O8z?P2Ur#tDcurBxk_BZC})##c?*TGrntCUZkAZprlRI}EDLtbGBsov zgn<4r-)QXpQDTG_5D9&`6cUlXjynrKJBMZqVO=jWGj}I@MMY^QjO$-3Y@3WTUWGEv zp9zw%{JBrDDf*C9#oQ!2;rv{)`E&^hvlrfWbngb)qA4tIu1AL~WNvsHzwDv5iQ8`I z_q||$HbcpNH+j&VbqGGVp75~&+BAR<$VBXj(IVAl@oTtzDN0qRFILK1;I?h~3y0uq zh3+AxJMkWy!qzsvt;ey?92YS?dz?7dz9%tmj7h{;)4Oq;aBI$E`~F12{{)-;241p}_!qxm_qr zX~nm=0tUE<$~7a?*?0}T7`lg*;%jSRWHN~7z;Bd@Y;#m@{K1EPiAed&HXjN?0nno~&i2~wR)GY|!8}!!oAygzRk>sAbq z%cE*M_Pl7UYdguK?QedV{!Mu6_Hxr(!36AuJ-;^BOG?}SzPz`+`>Iv9td^T>5&Lad za{w&wzKQyk+~7+nh~!io^N@En`kma^Za%KT)ob5Njjfof_~Mb4s{$!+W=%@g7`a`W2Ol7ZVUzq}Ew%Nup`?o)@2yw!4J!+G(b7C`e>fsP^5 zPnIezdSM9-eV5k}rFF04R`aYwKQ4ttC#FnTQ#{b(;w2|+qb+QCAFr`Ib7H!-8@G@6 zeBEud+$TNhrRtLIZg^>y{~?}%QiUb+mm62K$TM5`P0zt|cD5v@b&Ri06}F^f&o+E& zy79=Iy%Fa`e34;n+OOV!AdkbWc*xyvtQ$Xdrm^Xoy{2;%hf|L<>>a_UmzqsHbzE}^ zXts%b7k>{oza;&@V78fmN}#;~<1(B%pO8ImTcqNuAgUrW(o5OfBGC^{?o?F1i1nwE zkFWzHp=pF(Qz5k~Fh_m!6h4b@@W(Wzx(-AFHP&=^JFMf6`D5b&C7kldvi%<0ZGE9P z<&W9U8o0|D7zT4>m*pYDzl3aGP}vF&6qU6>q+@Z?5RGfg{W#)7GnzFmk`$-EAc-<& zLQlX<=*o?TkgsB6uM`9>KYj*dNUvWO+uQQvpIaJhH5&plYp=Ocs4BDeS$spC2YJ_g zLY_JPiBr^U1`UX;9R5UVB$~g@T~;VF!ntcsh(j`GB6*y)q}{D)_en(MMPV$&fEG?z zF8+~UGqY_EgJWoSDDD1mEx}Z_O|4TZ=6jvQkftcU;$=~MC8s8#_y>wyD&fpn?%aN! z)oe?7oBxJ9G&Yv}Q*N7zfRkwZ$-SBu)Dtt?y-}J3Nh6yWQtD5g0Z}^WgR}sJ>XfqL zobE8%D@l)>UTT_)=3 z9em-n$*Sxo$DZTUWNRVq9yMCuMGh<)k}&^XolEd_5c}4dq-zhE&b1ZmMfkH(aRrS; z-{f99_JZL&0a#dGt3ZrwIwo2kr$r@fv*qw-!F@lNb`Pj#(B2NIO8bLUMKM|JSijNY zlY{NPz|n04x7`s4Z9b3n8Ep-`;P~dcbhM)<+zBt;_I@gPr~MxSkHu1Lm@je)W7*hn z23;ON3t;zFNkUcX!rRiZmkno%^sfd&Gdq&54`th>BZ#KB_6}}R@g*1MUL(i=nXZw_s(7CHbb8dD zG|XsOAqkta3O1X!$t~42FwFKIl(A1WZ@C)mVe1Y_`OBY@NdLaSSGNbm0Eg|RLrE_M z^v{`4FFkG92uI=xy-mGQI$k-jL5joniD5)Nqj+*QeGrjxN8_~DjY=7_esJ93{N>s9 zBHd|a+l#~~3|lnGdtr(gZ)=yTnQpsG%#`~;o%D)(-$ZW0*a;M}21PI>26E6X`4`VI zpYj)<6}bT%TI}N7X7J}1dDf)HcS@mGN}=~sz6fw4ifp+|g=8D14Z(2`Qz7b*Uq`6?26oscefBom~J*csf3r2H>OS@{$ujXmA?5gW9L z(1Ivg6EpAeX2l81Q8nkd(Rg|D_WD0dSG!dSHw9zF z9VH4oRfaO)cq+ZRi9GJ+;(UE}BR?y-gO$ zL>aCNTnpDP+LQUR?YA8!we78tbsJxs0SQY**vs1PZ&YWb+^sT+8mrT_zqZ3KW=AkO zeDl*d8Kzs0WMa1aN?s@r(F)Q$S*ZhCda2nE$~HOqrNIxeui&={ArB6LQ@=vd^s!^q z&DmTBX$}LuJKEha)23F^iM7bVS9B6exGT1DbJYW<^4H5-PP^2yP^zSEPolPmQ}K;g z=#-}0n;%Oyl8`*)W1Z8-{K$v#rnxZXR^Y}g4d*h}v!sUPH~3?t>DcilV^cVrs_jn4 zw!>=Nm2g+fw=KIHDzj~>iqz6w@f2~+X4y8er~6xJy0^LpAhl!18&WiEqG0se?Fp}K z3ZaDCb`3XowLEaHzm8klJ(jB7WxFb=>F!F_il|TOzgp7bZYw{Qj3g=)P5lF*)hVh*CmC);yt(q`F|JDWuZHq>yT<*%5?v)=kCAn{tI{n#8pJj1Yd0wa8X zm|&mEytRoBd9o_i3$&Zt1`HKM8rt@-4lXr5bwp{eJ-C+CxtG-^+Jt~i4!G$H=_ys7 ztW`2wWL8j;XuPTASignOWI2TnqwQ@hbGZelfJ-g)A)C0c3{ma6dqQ2XMk!%far#-s z3_ZnkvwgLC+QqW~O1$W=A(1VnEefvfwXWyMa4IN8d%%V5zSjn@yR4lVfzMG);2Sd*4by!#G- zpo#95y;8&HQRxP^shxJ9Rgmx^&H2mAB@y$K6k-}BFPoTupXqd-X3{H*5}vXsp;`}p zqsTmO*1UsKQ=ZpwTL~e*m+uwzVkFXYsNTc!I-3<#n-T{7@(6T_<*Kf*bv9}LgD`YN zn8dKjqLy|Cz(_&PYM!E3Ufb=hkj*nI=)oC&WRw}}TNItDW_H84tlC~v6lJxo5tP8+ z9-oo1lqcWEPKb)#Euci?zw*T{J#lQ${%l zAL@7Vxuk&utuQhYLkhsvwd`@=Jm{J~vSqo9K%A%MuI(=zX1kqf zKY6M+jn!DGy1rgS88UU%IHf3=sT($0zD|u%VGgPZ@|NdfZ%_UY>m<19Kj>`NSpM4+ zY&~B>kFQjL9(Egg!unQ0c1r7d)dmD@ESh2MIY^z1mf<2YItnJ~l&xDVYdCK(CaCDB z9!80;^LkVu)k82-a}(tgZ}VP3xsx_4%-i)U00Eod)w_VK+RiWlA*V3haGoIm>n;Zs zBSWV@)F|5-xWZ^pQzG#PRfcW-a^q;L(f%RgVYVrfNwa%VMGCr6cnBBq9+eMRBnnkb z^T%{KT@?YO&v!>B+^(+N`5o6)bW9s&KE@J8>HZpSxmzV?J%h>s0**-@b^F$bNdkZj zIGykUiqPM6uoBQuIayk&Gx-YeE$3go)+RpC$jw)qH#Edbl()w0p1)Eub+73FNi8iE zt@_pL5EieiQdnMxFnK|K9g=79DLvpRKCqi4F1f&{S{Ua-pM7Bs7Yg*OGU+l9r(yK#PEpUOG%7z{V^n^ck3Ylp2{O2@k|C~eHdjj*HCz~L8&6=# z=xp0zR!sS`-CHdfD{-g;HQe56HHPjASyCYd*iN;rmDRNt17gRAVTQ(N*}`|=sfM?C ztKa06?7b_6H#)gDe;4=MD&CuJw}}q2ir$~UXo#djaRK)8qoQmzqY)Sd7Wu-K>k;vx%4F|Lp4~H9Srb+4u zx-hBOuFQog>7(+Lo%XP{_0lX5y1Lz7Z@aHzp~v=qAczn_b~af_0MwtU8}x{d{I-TQ z4BKCt(C}949^q_BI?5)U52SCr71A5R4Y8cvY^HWW5F0J`@-~HcY3D`h44BrVRw7xq zWBVJdl>4mWgWA%3Dr^sFKH5R5`F&$h_euGm;nc;B%+|C3XsJ zM?P*`k)R#>bEhe_w0^5W*iDLt8tLyo`g?Cm_cx$ho>{kov%gVQMwj`8)06kZ+s$7r z!#CI;!T8M%#&7S4R2cEYmSJ|RS9<;L2J@_7eD*Ucb9yeY!}~4L=yBYUdDQm*p)4JZ z{bm09!FnOXDebAse;{ZNpe5CxAOqZkzgR>T|dKo;~d*p}?^MVZ{{ryktaHd0n(TMT1(k&nuF+ z{WGsClrB3ykcLqAa9So??rI6z;a9A%qV?_YYgA0g#%z~jDH}7M1ZjxqJ~vLXKvBuy z4o#68DbLyLYN)~7iPs8+zoH&ZR3;Ky3CZ&gF0dB4|3JlEPH3$PEhQu@rAX*9!EY+v zErhO8AyH}6U#viFWt~d*ETIYN?Ymh+H5UMvvBBFg3%ic{03lt*H%f8$M=^J-a+x*? zlnM*#CZh?})-_=H z$+f|XuJ#m?9g3H0Lz%J7%T(gbc?czh4G5sfF69N`ODM|E0N||f8!}zpy>{(DkWYH8 z<^eenAE;y)Xs6KE~W;-E~XkHB0sxHG7A=TYyzb5>0ddn*f0 zrk_|2;oLbZu4D60@o;Nh@CNnoFT5~6VLXGH`R6&=nn3}pzBf6l3n_JHv^x>)Hr91- zq!yvtZqr?T5OPVk|EfQ#{jTBM!6?(?#rE?=`#V|F->Usv%ldmV$!+%lU2s)d7f|^> zrRiTlqvIKl5S7~3Wsd4ooTwpf6YebBqjw|A8)L=x8tp%!iK+0DNpED*Z4*M#^gb1# z6W&z88=@>+DR*D0D_529zb>H3ah_*6T2#1~q#Fft(9YOnx+{d@G?fS;5t}t<(Pd@< z9qRq_r#W}eU5oye7Qtp-)zYJ+yFzws9Hro}1l+4Fa^@omZ*L+(Avx%6#rDX_?`U`C zVvbJ$2v8xY`bBqTMp(6ng--&R+^l+W2&e7~ROp?IWF+)sLLy*+1xrZmT}MJBJ(dd1v@tk2ee3iH%~M$eT6W_U5AQ9v4K&9tZBJu;3@MvI|;_Q{m!-+-iv? zie~?UJ>^Lh0kv|=gi`40QmB>CD_m#sTc=RbBK}IcPo&)}R!uE;XTtO2ykZBTQh2NC zB%!xSwxS8|2Q~5}`?|--)bc(T#dxIA5+RnOO42&Rd6GBYv;-n(qa{x`;XNYDf%lLs zrl>9$EwTzyriBoJa<#UHngMBdz`Jh&Z@u;}@tg1-kpAQ_)@flRZe)p+^LX16{%1Kw zbYd8KLEFhN$zdEUr}8pxw2MqC>DS9?Hnc8Z@2C5(L@OoEce@j@UEE-R?#g{ivKMg% z9bChgLNFDPnC+eb^|9xDkoepuC{+#s87=P?4D3hV&J||~G}kvO_?|Yn0a$~9c$kcUtdR-tQz#j&5cmBB3~#vzh2wRi~CNZCaw6Cv4Wp;6d$NyXf6 zi~2`yCNb(H6w`nzQK?vD-{Psly_=e!uDeLAb~q9wzC2;AgSImT0_)T7y{gGxPWd2yh}*h2NGhPCx`OK?(|EQJkew0@qDvF<(r zJ9XfM(W#>fHST5S~&?;8#F632L7;T?b&-*w?5a{0BFSI##U^>O}i(XJ>F_ePrJ*KVpzIh|2E)|J_ldx>lk?siYL79F9b^6Y<7 zDakE*ud{4vxN)NCfAPK2`)0l5rVp}*KjhAR zv#h^vDVqSuf|&#*6)4qPvxL;}W-hQM&0H93Z=w*RWsJo6H!OhbFWgK|u{mR1i!Y}a zhOH1G2X6$vUB%gS72neB!Y(m!xt;VloLlBEdQ=JLF&VmWW~%o`b$Pzt-RB$_M$bnU z&!&5G-;x@wyHAjX8m`j09G%}=jUI)cHk_&OnY1nzN>@dCGk?1*aL$2~WIw|jyBrOb z=nQvk6X)WVNA$yuO%ZvD7N4T>G^Y48hCz&^8N@Cz&w2%CV4B#PELYi$A-f#eq0dw3 zlz~1}(k-K3X~Y@&Wk$}1D=eU)gZI=X+2Em|i10-}EiE}IoxHV1Ionc0(yZEN@LkqVg~%cnG?0Tjud% zL**dLqW2Ubh0W%Qet|K4)~~1)XL;>C(p7F-R3@qaxdliDNTyWn*s`?t@|~#4>4Q=z zgJaB0<7OC!f(&8`8Hmc93RvFsnv^@U28=U|>tkxGdxQGLR?i-By4@Y>f3`q8-3 zn;9iqtIH__jzIpK46Ig{!-R$^lkI%-R#{(%P%CR_fZq7Mi&t7>PUgK12_3VGClq}M zjpB-g*72*qI7LXO6SHZBK*+{w(XGL;NR&OV~SY!jnwnpVrpnAQoOmrdI8 zos0tu13R4LY#~mvt=}X|A1+m$4E+@wC_L*S{>8gT0mrG}9oWDha9W6=jx44PVYnqOlezPbf?)vp?PXTOoGU z#O*@LEavH7;zNWgNQP5d|1!k_1RSURM+C>F{D(SePs)Exh=-J-xB&nN2KP_W3pSgV zg+Bb!az~ypd3Sz- z<*%%fwH7LtbWmC6NXP6=1$)(``+XrcQtl%%XljB8=na`5Z;-ntbU;<3yoM z1Aa9*93Vv`B=!QIB7RWgQL9yt=B;$tS!D4U;I7mTo}3J_8wgvMbf)}{H^|Kz)dQE7 zbJ3`Pe65R9A_RehuXPiM^STPEw722HrPn~UUTmr}+N{mH@*~XPlyV0T?B@I9!yKR=NZFHt|Fr$Zb_pnfMCCkB{+J=2IK z@8Trou_4BdleTkAVS#b->JK9UQeeCE?>h^fu0jXE-e=D=}dA>&_TPSuR5SgDv^=|($nV+`*h=ALFUT?p7s+yf2L!sVzESQ}M@2{Ah z%%DL$(s-M&r3WXdaEi|{@eb$-`an%_g1%KcHe|)q`3d*m^lsn}OweVtQ6IVZhf?U- zQb<^ydV+2vbbxsF;1H8TCn$;|m>K2VLyiQY3%T?}EixsGik(B8reHWhn`?l9U0>YN z)CmB|=*nHM^^m9v+loq~cY%nr9_1ZM$1pZHoZj$xIhx)o%z{8m#55l2@>UBL7fuAn z>a$wM)j4sYv3w@cfwoEKfniNuYt7CB6=rAuaCjHc(MXWU2#R?nzs%L#H@K(V(?Qlo z%g=cp%rIgsKOzw{MJuMLDx2;I&X-5BtlNBCdm6G1jgWujA@{hX&UT5yQtoFuEUFB0 zPSIHYFGS4G0jN$caCF-zjsWEEcW1XLLlyA-_!+iQX9< z_Bd1?*v|A;Xf3Jv*kKu05e`k;#yK8Nfq!ruH5zW!?kLOBX#Ic`?QR)T(Z+YOYf?OV z1a%jqP$b-WF^3j#<70gp#5PDF*s6(ga9q$mJdHo6QkvTKDaW67xj8^e^1~&#f@0v+tEFVrx^U|?;VIQCbUSsE7 zF>8!=VWq&SnFqrLrp+wWt2ao7S|@G|_2eYWN_}h6w}tvPPv7eGEv|2M`c|WFmHHOa zx5JWcRkI*LZmN(<5yn6_HOquCs$6+zd9xv#z9p%>*%RDv4G_pSpX68myxGuFiv`0g z6Y)|P{>u&>6Y&sC&WS30TE}#rhM4-%9Ns!7N+#k($uR$MPNPpzC(*wp-)Ea8k>sL@ zt7d5gM~y`PS>m(J4+rl>Cfk^``x9``%0l7(hT6PG{|KN zgT-TVw!2d)a_@olUQ*;n?&XOxp3*Ts6TKI?JQ@)kps;l7OCWS~DcCPTb}57|WJOA| zU{Xk<6~U#LHfg`DlLn^!75_DaZZ=;tL80`;HivXkVH;p~4zJ?3CUSBL4`qfYy)R9O zq}~4V8aI9*72e9ps6h(sma`E&^0?6C-Soi#3Q33aA7W+=JsOwtwQ8Rh8=fNv=D!-M zBnKv>weDsaZ8c9(`W;}&IWtd%t#6>-8pDe!hV*SDBsXt<0)G&j6S2}q-#5Q6P^0dX!y zb^4*IK*pL}V-L&-AJGIG58E`wmaf_fU#@EDHBRATQypiAPxvJCno=B2-L_4WR7FY* zdQF{Wx5GVY|LS3;H)q(`{De}n_fTI5w#UVm>FELsjGTvm{wPB1Uen7!s3lReUKUB; z_FNgImJUC6gFhaX&GDa2hj+~M8ZNI^mVZKVOm<IcYW0P2ag3GzT zXrC#C%`Q_J?Se15BO&&>rg!C8J&qR|?mz>c9%}fgsn{ebw^vS@y@>M54Sr;-yo_xT zgIzD08)QnRn$h;r2D^4p1ctR<>o*9PgtD8F>mtF;6SdKz>5 z`wB4a^21E`O(9H^W1NA&Y8P~4Ptv~`RCFRR*wvYEw>dkj*-i!2CRzQCr-->;SlYDV z@nmc(w|>k2k>J19g1L$11MHoARmjdNS7Aks2YC`4$ZZXP%59~-HR+pRE+XgYTfM%; z^{r0dYV@sA-$L9Ht}B3>a5wB#xBv4?ZqTR-DZAe~s3L!Kh+DQ<3g5ZP)$2{n@1mZ4kO z^qvZ+S%rB8;mT==CdyEv1Pg{S8!$wy%pv&68YvVJ@ld=VHPiH)5VSgE&>S6d=>0Nu z%-Pw}a*OGNSyL2iS}ldpT#5)QmJ*-4rIrk3Z7nX?gOh*#0IRJ|S-Z8!YCr{i9?_^; z!gPSN1HC7_f9xj;6e%vlgi10XDsct__^;SvELWvJqh@XI`+tgU)RzL=s81zZ3St}er9s=MPYv2eJ*y5wZKD>- zZKEDRS!9XmjVyr)Sp}{zs{TAxw2$ifV$xH$Kieu{`J*421k!^p&@DHre!7xKZfo>y zt-h(0+15^;)VFkAm8gbA@UjLwPA_E`^TN)G02RD90l6Wp1+ zvfYIA(YohLA({6&PWWlsIoo1FtVn~b>b{0*hXsJ*t+>33(PMh=p>2UXS zuc0bB-5XOi-Mg_WGSiz=Rc-t60-3YGT-!K4;WvfoG!_{U+2MW|Y*!{?NaCmW#3|5m$dwEhDiO`&YnWT zpUFzKjcRX;ometT;+^LU?r{tlo^no~Ui?W+Q67)43#+AR&P>m)8k5wL71%c;%#vt@ zr@)w`tgnGFNtg|)|pEwbY0wTYBaEuBl9x#aoWZ18Guw4j`lF_+9@1LzjLH6~z7pDZfxfR=BPH;rRv}Q! z*Ebl47-$G|Wi*m#-YONIyXD{c;8H?ouP7KfiUKCZHYMDhNl_7yMFb^F*&=~nWW~08 z#jYxoK&QO9(EYQNSX(S^??xe^4hGLV;h7_KAC>u- z3J>q~5+kZ_}JT!f72wjT8UVO8#FPPPDpdL7Vr|JG&_#*F7V z23$$i#|W=;eZcGN@-6HSo?bjN;V*>@Eg(}$y3d%-laQcg49{12ikOcDB@?$Z zI^mv9x3)cbdqB~JqTGE9@ zlRLz+>>b$u{mU06uwQ--@`NeNFNrBj!q1a7|2RXu>bvUuCEKxJsXoJOC7&7lxj#>2 z{t3_jSCYWM0^@6t))2Ai?WolEVcPeeT@v^mf!(p~ONKkgE?IO9~Paq3(xYgohiYKSTtpK(ryGrQ*-kN2<{kQ#&fSwIo2vM%zTb)c@!n3@n`e$w0|4=kqm6?r@r{zV!w2IS&JC|YqqumJZU%W9Lk zM0v`wgVV%1(rBrr3hD5vl;18WH0|D7lXmZ%m~wuN6lW%6*0SRkUcW zMHJbUGL~TAAtcsJ^3iDRynXb!8_bY|VsW*{}bcf^ulfu2eT08WkmE^RdgJH_Ht>iaK z1jollapRAZWOoxOf7!N{Ae7V=W0~7^>IF+D^%<0Fh`j>1H=TMJg%93%Go0pcO5?LL zu9oG4dyRZzRF1GPmL+>Ql!jpA1-lllkY)wB%8*gXA=Aq4bSS1x=rGMtb^_`Qb9r z<~~L%vHSaq?QazN9%G1htgyJo3O{3R7K%XUAr{G>#3K1o6NBd_7SDw~S8Mn)SR=nD z96Mo5JCTeXT>=XQ!rgfeX4LEX3io*}Bo$)d(SR6$Y)C0;;Qa)Il3H|)tXb|3EXd2Z z%7Q!#{~OT!MZ4lVV^1P6&A-hl6c_$u&y zk3|y3I`E%5?3vp0N?@H4jX~kcXfxn2aq$s=ndZR!H(9{BIgH^qj-A1`c@e(N7R|Rg z9^Me}ZFaL};?G#0$Yabmj5|($>naYLZXX&%#9x2+T1khN#ypR7*K)#5q(a^5iLiX@eu*c#axG81YvRfKcj?O#Cx#KJZCxXYHKT-ElX?=<=6_fX&&8JcM3psz ziOu5&JNb}R=OC-jp|n?RV>~!XQ(1Th+|0?OKaG9zz)7QB!~%h_ZrLjvZ9gS~B}arA zunT0G>_&V%YYwV-BE86chd5~Beir`R)wBW86g+CtkjImG6xLt}(L>TI>NJJrJA;hpwjlrR(Nmg+C?AT&Dm0jc^cBrobhoWZ#hFx$-QL=m*Us=#OY5b$YTLyA8gbO5b>X;l$I z75oICI}7+p9}3LJ(VvGY0i{de=i|W7@so|$lwjxBh$SDToj}zYfJ2Oyfn6Pd4KrIf z3v;*V{2&D-sf27hQP$(86!}B;wT?S$%4hPVdGwV~avE zD2vvYE$9ch!mS&p zIsvR-z!n&$g_SkUaru24%KJt~H*D3CVVYc2^LM}9#9r8T*L85iH04TeXLMfS+@1G4 z{G0#L&J$;i+EL1q}&NgF4Msyelpb1`1*o-1AFUr* zQT}N8)57e^%dCYex7f<5UrB6KoS+&+@s_2vuoN|oTAY`hUG{yU6QiL@4REOY;37cE z;9e`dMKfTeVRUE>!xPH9AN@fYHj(B|<^+cf8XTuWAGR5Z3zBEvlOM&v4mxerGaZ#s zEjbyIxIwEMiW-xexO^z`er_Ur1~8U#%PKdj)F71q!3=&iujzV1y61mLNRP{o(p%M? z`d_JHw(-*$?6ph04R~K7Y6{bwr_(u@HShR(!)~ zZ6lW?hJ}lIm5Y{|&36HWoPNE7_@Y8(ms({`T-DT5-(@b&V|O`Nb!9@T*oKYpq!hFHFeVA@CyljS* zO;+VY@SKAeRIsgBK}UNnr+zca>W55quzm%pUm>Vp)}3*UszQxu08Bcg27^m0!tWwy zP+0!&cQy;Wh3>f!bh=hXgu%X9uOQB5*?!{86|5VTIWnnDX+)_MSgdKQl=PF@qTDjM zVj}%kIL>kcCldNFp+8freu>jvWW5yEd)xa&C4DQ}>h{!6L>nihz1h*Uw@@O*OiLO& zh_$aTI-f_4Q;tHtVJsPeb+iv~mEux0wHA^cT>_MUYaDQB?obB8x zxlXOjY$U3lsPxqO%FGX(4GUF+tEmt+bXBD!r5(F}p0x3A0;ded3eh`q?n0aO&n)-^ zk|(|j0PeyVSzbw7ZSO0UOjM&qbdBLy zW4*40SGM~`+C3RKfzWwsDmKC)X2c8Lk@?e z4!TmJLRL=`?5SUgW**E5RbTezW5JuGd%$Rk^N@CbFNfegSG81S!Fl~NE0C^*A5~rf zU87fb5^FUCkYDiHD@NSMoaILf4XICCo+wqlvGagNXz6H=bQ zpNzjXRl$wX+97t_rv6CO?2OjG<{|CQMrq|+0zxcZ5YNp5V77a|j5IuiyNE+?#E-Pn zjiH>yCx8eixzlc+?msm&b*fV7L0AQHj8>6#rqGJPTl^UX1b|9+0%%6-6?~q*vn;=U zWkzsr$a%ChgJ+VBBiZ2c!KiYin$Dvd+zo_#QESo+Ng;4*kE<-RV~y7kN` z7WhM=igSd<%161sCGMPEPB(1O)wno~A_hdyxm#nj)~amb2u+$svSyX-Ma0RzdlDTO z3Eco-T&+TVrI3gxbey1JVdzCd^9VJn&>41xCz80xi4$WJ?o-gHwtpJ}S+U^;FQ=d1 zqLpB9;zHVnjPRS%A>QUS+&twFTX=*wLzs3D6UyAkVV0$YFvQ!WQnsy>dB*`(e2+8{ zgk#cI>ad+JT9fbA=+b^JYFd8?!%o_~^G zj$p1Q72xqEzX19V`OQxis{Ah7`&jg?GAqxcJcG=aIZIJ!_)NlcgaZ}0t+*j}P50s% z&THXOyE513ulF3`OS$TNt2DuAi81kVALWPomcIhC@h!VDIN(v* z5dN)b#{NJCRjYMycun;-974E+xVWqGd!&6;t+IvkS`$?qJ0I10Paq5P$t|oWO@Op zO-vPjjsjcx+$t)sz)DvdEb6o&3L{$k8H+Ol_IhF{?5H>WD>T5fK>jTyY3@9%fN0K_ zs*6^FOshJ{OmS4DD~c>VNYb~;d4`i8qQ}A@pk%8XyN=FpaG$OaO{MX z8g!1nhpUJmm?a8RYIh-0V*Xm7FR+uM4$0`eWtkdGgkx3ViVo?PBGn8HhZF-WC7ad~ zZ6n)1P4=!Kq(!jbpgeu9=R# z$8VBN5kKN{40*tglpR4>kbhRJr}4v<+l@~Ps@$!nUoFO5&$B)vGf^MWz+7DqJ^>ppkV6yc+QX?> z&!UU+P$&RbIz zrENG8o2%g?fj!ktn%b_Vn_snSU$Mj;+q41Ul3aqB6>&v|amOMPqxex6xrq846Nq#z zy1pkVyI}&3X5V8?T~SHKiznoML=UB7hm00Eha0pbU&DKu5k||`cpbzRTkxKgdot)l zJvHb+{MMi_ZfzXw)4nB>azCIQvNMn-Oj1+qM`1o5lFVpVl#aM|$pKqk?Di@!wuUdD zp!=0jiSFNRhqpJ}jPduyw+3BoyGL07vFA?ypsX5hExirbi|fyCaER#;;?f#Cy6FBH zrW(|ABAof62w!TLazzUq`Ao^~X0}_l92BzX@5sHSH}mh}=SSz5^2bN)SRN^C)~tEb zY{J}fYYjtPmR-?#N>0gcr5KP<9lapPXriEqvSKlHr)l%0yfD^n!JfTzRB^~x3)T@O zU5vxZSlLtC1{mliW0@Zcu2gQT<&`Llspi?Sqejcqys%w84KV7@d->A{h%sgjN!9)W zmrMh8EfyH_fE2)VA^@hYsD>L$SYtu4w!+7M8Ob4ZNtk1M}`!OvNM4pD`}!@bAPJ zxyssTd6RQ#xgX4t*`Pz~0k9}42i{|nDDEcT=y%0OlQ zE_k2+S`k!OkIrbi(Y{DG(2~V6q(Ma?y0V5z({on}fV!u0mvCn#k`i<06BcDSjnyjv z9QZ)212>jJcM;O3s4oYv=yWZFblkltgXu2@8JG1UaHvPrf%QTpEX(SRiTKwndWiBy zfXD}s9rsyaeUQK9<2wq;re3-|@%Y5t1iiZkn|0;sX&QCXY=N_w0nLZ@^0K)0aQc-c z0hTRB=$_=zXCLpB5k?Ncs{Bh+=T|fV!SDN9^vM?Pi_OZJrG-32%`0(b?53;p z@A+d=Q7R^!BzMp6q%_NK@8gLY90pP=InohT{pijW0L3VO9FCiSl`cEf@ELIxmff~W z;6xd6GTQb_23;>itYNeIC-;`wLw51aajAFR$pm`-;a$#G20{%}IapGeD)eMt$bFa3 zhS*OA$Y`e1kt;VW{US+Hp2Xs78$&G9O3L?_~4a-ht zVOF)Jt753W08L^NXGG&iZU3HO_S9vT(S8J+=11tmx%KniVcVudJNqBQcs>jm&8S6P zJLvM>| zY|^N7Z5K7K7t_a#6plrB(z>xc9S&x?OoM0jlz@JkBqVa|xu7<*Z%X5b*dA@nybnp0 z^H>kLvg7(Ue)C@t-DwRdlCJdfYw~giA29--q|#pd7`pH*qx&Lw+j9_G`<(v*vQA@c zU*Q$om_88XmAQ^#k@2u5>CwSFe&e4Lr$%g&9zRUuH@<^u9B1>dnjw`5>cuAL3nly5 zg>b`7V&lJc1r;0|oWG!QrWzd#x4L2XFistCvnGBW1VvyVxHw8>8H>v_=XBemSPqUX zJDX(|)*}_o?4g^qjts{fR<`$Nk>_alHEnkvfk4UhK0}TVk%pUdLh!<@)??bfW{ixo z9%1)Bc?x_*WJV9VbC_N<#;07b{$ z288Oh=2b#FRl0Q)`!f|XN-L3|RoV6wO)x3%^zN@wou9lPpjx$s^F(~&>@Uc{BJ9KO zX9?Us`3V00CWegUbC3;IM6n$(@5TY88vN*Cp#>xM90L6MHgvWo5YsS;NhNAKWJPpV z1;a2+o-dd`Lp`W4`A9l;AZ|RcEfK~venCvoKD3pMpu!c-@e3E9rw2jluqSKYNOrt} z>xM^@#=1Amu9t_quXnvLA~EXqQ8*fy5^5NZ1U`ShnXOR9Rn)l@@rB{^gr|3mtw^@) z&s1qkF)62~!t5AR!CTC=G+YO{+3+?<^~^Z48uGJoxS)8!Gz5j;0cc1~9` zTInGcHe? z2;`h>H05lGTFy2cK~li`8C>sX@}5uL@0FuQn7AS?Wa8$v){H%use;86HkC?eeyrL? znz4PEdvz=g5`YMq%_jxW3`anHe!~4?B;j)4=d(j zf(K>RK54YfCxTbQGMAeEXCxGE7)GsWxN1l4BfL+bu{OuYenKIfc`^S|!vAZ$*uIo$ zGyUrd%A{6oU&AmQ1DWnKxxXeo$ntP@xh$P@A^o|}n)Fq*s&?guxnC788f7)w4mjs- z8}gO(!MVQ5U9OU)S+X|B5MU;xpF=B$m@wEl!q`~_hZnJf-TDD?;1SbAuS+NS@zWbY zY=uOao%0L$^d4Kq*qdOnR9Amwx;Hk=h*<AnafwyP z3IwEL1DWpp)3A z6DPg*r^2tL!_Oj|Y`9XK9SF%6>&f&NsW-P0`Jj9!p9YcG9&LD;#Od%Z+qIZ_B6Qep zsifz?1X%pVaxe!Co2VoRVYBMDA9V0!EYI>gR6AYdJ=jtzzTSiSYy2!QKQ_x! z1GhmkA9iawHyy($Un$+LNX1-_}N8I~i`K%T$c!@FS zC6@|GCX4byMVpl?gel4fs#nJ2m@8DUaQQH)J!H+Tr%b&h{)kW$m5V5b+TWIy24nVQ6;f;ahHKS z#BdQlLv&?4Pm}+iA|_o&CPvmN(*4R6BT}$_6plGxU$To$0bi6n!JNkOzf?uBI*0=> z|5MQ6j*xLirKia8>CtlPyI;n%M13n-yatLAgLT>&tY)-~mMo!_t*Ks=3K@}Jz^Sj@=@*@#3o_A;!a?xcTXH!fXf3AVm4(earI%fGQ=Sk@_$lFGQr+%ZP$ z`vm1=x2jE-v#c_dLGSGd_KxsO8ARJ||GD@UycL2)(AA<}&d*|{WgFVUpn_p3kh3}j zmiv2zhD?+E&w|AH9}{?zuk!zl{mPKT6$$+0mHwihZW#WWyX6J|vy3HB?#g3lSut%vF^qm&oDwPK zaNf|x9Htm@0q^*-?Ru?TKn|v9gdwYy95}M6+=p;tSTn5P63W3hbYFJo&$GU;TCfaD zS%vVe!zi2!3J{+pGV#kQ2^L-t^c0omv3>9@^nVRIqN5XDLXP?e$x4PqcQhXtyHurPecc@EgWqL( ze=X^VSalm;Qw-H$DX8DmNybTu{`?&(gr zPb<4+0R(Z(_CE$7#P~JTl$}6j!kv8aX$vNW!C ze+`)kcIiWvqMvs{>~b4a^c{RH-Nx%4_4*7l=3#l~|LcS%?szsrX~M#-QL`*oQb`Oe z2qjWxGsX6QC^GB7d2q(SD}^W$6wN4<`{UI*5SVkow{O~*4&T4P^45t!r-K~qSQeqr z07A4*DM|TI7Qyu}ur^k9*L7*LI4Q9{Js?i88{S0#*~U@iI?1S`+|OdWG#$#kQ_G7& z4etff-zJI7vl2DH;7nFi5cFrVM(+7fS?dSIS=mO(o^lWo4rmeKF+_yQz>AjGPuqp? zFf$UOT0}@<*wmd>oeB@20i#8KVr+-1)!6>`q)Sr5^o4Pb>JTUFl!i#UuPBl-aWpA* z_pW^>Ne(yGB1IDm-$>EKrvl}7?h~n-H>;+x%GvyctN;)f+wwwL)W}j2C{2r*TGUcR zLqJ6q`w}UWbh5Br<3c$p=fMzm)tX2a3vpU+B3P@%3&>Zc0+97ZF$GeohUVH%lhXs{Rjl z556{*{~K?UExV1@?@2`iFCG5s5XE~dHj0<|Zq*sSp-ODj0@= zMI(d^k_6wDZiHdOVam$L1b*xZ9RFMK6F9uc^B?9W6gm~9dlP4X9vXhO`Xqa8vFW2i)ps*%dkc~O9&Dc_x}Uij7gx@RmBh$}MD@ zoI=r8t4)Xvht^N4Lfbl|Z?w8T{fE7`q?mt8*2s^Te@nuSPsYg^u-a|oHqPB)v@9b} zP?XVfn^dXLmy>&WWrtL(<%=@qJPic3801ipvG@ve+lcVl^=+c4T&L7(s&elz=;t8- zqap2UxH0z))q>Rm;6*@m)t8o-Mm|7?tT@a&x9cb#Nv@T>W310;`zNB*Rvbr+m0(Y-zf(+rtx&TBlsR>U zOdZ3K!?CK9dULhX!KH(>dzsKp)Ki!ZR|cbpjszpYJ{c{KV4O2Gxy7`AxP!Dq?t|}) zmf7l6;L&L8C5Vqz>+t@fs=T6~TM9B+&tU1oY+Hmvbylj1!ORY(GqO-Y7wSFek?C;n zIQMwFNJZF26K}#885ZTBa2D&Lc54Y2D6ckpZw*%MK<)5 zd?6rG{8aU!yTStCgSpOp6ojP4@G>S9JI}*L%M;{L90Wa?@)3ChzbFp$ww9(<%YIUx z4ZWjeU~-SiyK}>7?jLz)`^}-NrDX~ZxaoE(5TLngPuqOrnd_yU@1Q}0?UZe_{N;WG zL4Fn-87*(H{sgd;dqu*3B5)dQ<0!8<1Lo1I)NTPchAK|y$zM^R>b6ZJhSKWfww@jj z$wkBziSUO9Pc=Mc+v@q1zY=kvbRMh?|MJiJPgd%q2drJc(M$GdF^~t_oZP-SHW;SQ z2MZRUT?UMJe-_hw0IC3^yZz|1&I`=vU9iZOjFgu2<`)16!57lgVzQ(N8$$*9u{E#+(14ixJ=zLc-1q7)aI)@NvZe$rcKJS6cylh{)TcG3#b!Yq-RO0~W{LDZiP z&4=h59E->PQy+g`x;d--jg!r}dmP_1uF~=O)9a=EPX+!a*rmC9$KlZ*oK8hj>cRDjb&|n8a2^wXT zsEHsZh{%X&CYga5m;n?JM3Gk#hz1gq83KwLm;h-4HYQzV`u!@2bP|5vHb=OHJ6VScC-~I14oX$5@=TueK<7htDv3ci-O793v0?3h*07h5>qvJ>4LtvQ zg43!YI6$HPzj1&PKwWkQwZ48kw_wA^vTrD3#YOY)&{G(XgyyH74nj6oF{h zUKHjI8#Q?^6=v@P{RK(ruqB|`VVs9{C6KYhFAFUOV`pj(`*naj7Z{pwB?qN8)2fI)mC5IM65-&?ZCbT~mq8pCmWuc3ReT=nJsz(7nXG)?6o?%JGe ziYnThhRMF6lhex=()UvrL>oQd?4MNJJ_IYO{)GJ11X~eKxUh#@7%5$l5w+|i=%#=+ z15S)Cp%v-q#|=e933KwA&cI!=1Nxu>{^DwhpIiN&S4lBU>u|ApuAT3F;CtlG5+&q9 zOgVk7kIOE?eK}ZIpS2^XZNQ~XSZ2Q;F5;-WkI`$#d76HGY6=$63tohDvQuQxC6^%% zDQDyOQyg}xF7Aupf#?`4OZYsd=VVhJRmJ8GtjxL^eu-Q~;$kYJA%<_r)asAalX^px zx!x_$f-Pml6!h9CPA1DZp>g=0KK=IeK*k3?*Joc+m9z)K7uYGC5gN6*IYJ%9CHHJF7z z)#<^k?Zhe!zv+w9&KX!XxlL0mKw;~h6AjoHFgs@wBt17wCV>{);I`Ix*{k>|s~{r8h0`4ZU5M z-j2AuJslY~)90#HBL}HA%V@?jBaBrd-(lI}PD)kWpBxiOifudlEkjY3H;XIwAoy39Rm|@wR zQKtZpc zIrwT#}N6PW-Q)%&Ja;ANHQcP0nThg;E%S?Ujj4>21bpuf@ zgyJ=wwhEMf5a;Y_a#lxIjv8RPIp~CLTDVJh#5qXmfN;j{Zq0YUE1Xt=4#G(( z1!pU+InLSncR6bn=)l=^aF+H3gXpHN`)HvqIylsR&5DVN>7iJ4LubSehU?pHXMYZ| z--6LWM-!N6J7V2v{XC7@-#~{LwP_J8Iv}EoCvJj?V&(>G>1Sl3f_Db=(sW;~I|Xhd zg|HSEY6+bAY&23)FeS<{)c;=EPftL+(~u1)QcqrROQiyZ2cqrMi3bskZ5 zQzu)+p+31)sg6a*D-e*fm2T}2ah}@hOZZW&k0G6*=U{kS2`A|}0rw_PCtF__U>N?T zM0^(3%+QXoL}BOXJg9br6B0PPF10WIV7q0E{$Su7>U;^sGGQmSF{I)QNRcI|I^HiA z6=7K%lO7rUta*eyznHeVshkS5Vwz1_dj~#dtj(^EQMoK+B~2 zcxag3hm@rqLD{6VX=hMZ;XRI_F@{mGmPG4<)4W%cu^wGTe=@d^M@Fav2qfeA*H6ESq*k4uL@?zR~z5_(u0Y(!po5(>e+7CsBmp_gD%JMktfruTy~b zgD^a6Zc?Jz0Ic#)rY&@6SYQc|HajI?e}Mvr8M8k4bCNi9BEby*aehhzMV7hn7}4jX z=5_NqbY-f3XQD^He;1+^mrg7v@1yt7FRv#4V0S3Rtp~GKV-cxH>UI$IC0WbGG?|FpK*l%lA5k0=e1Ww2z(!sOn6c{9#R@jLQ*n)BKAzke5b`QiS@V z!{7d|i$582qgrlqN5cja;q+ml zY;OkoUZ9)s&P0}X*j54^5oUFGX9+VJjyB9_55_=Y_6pvH#1SAYtAXr!h+#uw29RO) zB9I|L>)#Ct574hd0>_G&632iHK0~#OHSv)HCA9n!i;va2Cmf`Auz}v*Z3XJxcgFAv zzvR=l>cMGfq9aV}*@dteAK2Y@h;ocWP(#!5TNV?PhF$ z13|Iv+>5miE$)nJ?|ECWM@GyBy5EF5XlCZ_&Vph;hO1n1_IO-1Zgu!JkFrDAjh;-# zP9JU^q7&wno0Ik7skk~MnuaCU8xpjdjNKkr13Jt&PF}k{we`1leM-x46vGk7@gp!V zxOPmE83dm`y2P#3i{j$eN2Hqld9;fVL}E;I@BA9WkQE3Pt^!e)%qH{ba236Ox9Z=7 zwr{d}@69l*Zg$Wu8@T7YB!)Aq=DrKC88ZmgnYfqZjAVQl{+{C$f4^JbrmDgv9=C17 zYe55Eg$MCE4{=_+39orIgtp>!4EK9{cZhy%!>i!K0q^S;5~!!Z0FLby4kxVbazRMaKuKr)re>%l-yW>pB}8aGSdbZA)tBKqczp$ zOBvQOqO0i> zu!CtsiDl;nosshj$YGm__r;KN*luO?1d`COr7UZpHYI2pm7r+>Iz_A&{WTO9On~Dz z7Ni;*#tgkY4le5VtwCuOZHzO~LR^Vxp@Fs`utH;qj;6R7RzMnAML0;IF4J%gW4vBnm?M57-{{ret4*Ku{34tMcEZ>UQa0b#fc zJ0x%pR2>|(g)?B2Qr;IGS+Rd^lL)HX*tc3mPTBcBVu*YK#pG95;>ZvuH7Lzv{-wGfcSQP<2$n3A5A(F`SUoI z+=%_=HH~gaQR=Tn#5!zu0MXGw4jVRTnCn()u7(yrV_y+guVzxhXQHUw?M2DB`%aXp zyTjX}Idp`Gzb0}Fn&MrELQ}Y-V-uhwa0L%33#bhgNQ<^0rH!IgV`e+qA^hLBbMAXq4ew5IZPO+fbgU6nUu>;fU%WzR)N#ZF&rm1M@}2 zg3^E`tevsiDS97G#YFx^-4+ZQY=#`BM@5bhd7$xUWEr|>+sK$S_)P{_s3Xjm*5gm@ zQeN_Hu6e=W0U99seN==n3r~0@Eost@W^C72?gH{e#aYE}*XA-@qqf8(9r;KKsbTNi70v_-TB3UM$W zp}?$9753n^C*Bsb@t8c05fBV|Ho(il@E?bZk?+l;kGbe^T5bAs@iJj9B1(+wy|wem9< zYc-L*c5q>9*H!pQ5(66Y)HY*?xs5s_Q=0pg=0v#Z8(F2fb_K| zeBJ9X`+B&jP5L?(z9zv}B$y2+swZuMuiLTvDJFb9*4|h5IwNV9QgtJ44v`yTaKFvz z7{(4L7}>;r4pH4;St8dY%HvedF##9ZFu&dGTa6{uOGYA|eb4Rc8lj7t}HAXifIHc8B+4XOp?t z$?w`+?!qi9;ue)8${V(wQ=t>Z0GkJ7N0E+$p)LhZ9pr>U#iMO&?1ax6j3}nTc!w zjA~rbb<`g2j4nV+Q)jJC_bh3~RCH9yV#%O+O95s5}$<_ zCpC!G%GHr~%+<;@iCfgQTf{AQ8CyIw=Q^Jv0P{;YG@xIi&vn1Cm-ab)&&a6bTx?gT z0v2%XpVyBLp9#3W#bFTJ=H2Yqe)4PY`(2yV#nb|Byd8P0bvzB%bm1BcjJtI&#bv=_ z6Td$?3j1<~C#&6Y-Xvx$%e(>Q38Ru08~+<=d$vq340ZW4kec6&j`mj!$IuYye&=}X z&lG;%kMC;i3<(h^ga{LYDadF}3>0DqVvd^Z>Fmr=yW?&Gf|-CGTk_~=66)M)C$=6r zQTR&h8`mT3?sdsWvDW9i3esy9$@A`9URsi}-Z*i(|I zE~eWKFv1eZz-{zLo$BJh<2P)aWdjkureb7~@agX8=oYuJx3(JlPcd%p!7a+@$lBGV zYw-)&q_G}iFBeyYy4sq*KrzNfzxQss;3*8Al(Dq5U=<)+F==Rtye4e!PB4C zr-TMz-@iYyuNjrZrO?G!BYsBdJv)!m#&<$ez9S{zm7`Z?Ua@l}Wfl})&W5TVCL z)Zx)V=Xx`?q8@NZzU~t0Ez<{`U7X$#tLiSc=4}mshdb|aToUf0=u%pS>M2)U+cPnz zs%KY#@rg=K)%dQ8fC&T>1hf;h3+N!|5U>-$P6Bo&*jd0X1iN6f54Kjt!%%6Rpe zr>rk*!r9oX-gF_FTQo9gE+a9V5+_`_qvO+lC0&Ot(8;s~8o!UX{{98mPQw9c(qC}& zXRCR$Pk)#yU)llh(e5Gji->CuX!lUfOic^7ep8}@PF@@wj1EE)Y{Iam&<$cl(`X$^ z4Md8|DBN!SOrP?hPq{YHH#EE^d>UesG>u1d;?I1He^E8krsD34abKhQnLy`FV;2&x zoKq`LLuBKIqpogkn>*6b2Zz@{&=+;%2rtZD*FZaTRTq}7qhvtJNhgW@ThvaA)AH+U;;dk_|U;VCQWmu#!)IIddFubTi zt6@FbX?NjVuVZDWyVci*7D%fESS3)XlCdY??5v->SDuxPeH4D>2Y*IQFgmFPl?z%B zry@q2Wv7T<0-|opdjA`W`2^J$u?Bo^LjZL{q#8$$L)~y88SNUc><_(Vyn< zJEL7amGJAN5CbStpENz!rX#lK0F9{2YF?aWj2nnCnL)F?*m-VTJk%U{dkxr7n?^|w zVs65xD@cSy1lx}&i!AWr5}qB{jsh$F+5pxqsFgE_H97{3N1SDYohQMl8&^`|c%-PC zejjveJ8`H24!&r*sBNn0-Tm6NnA6$tt5-V@yCG;Gp|U4jE69l~Y{stThiZbjaBszW z=T01jFZ;cO+&Xt~qeX1J2So<|xISOfR1{5n-so2@pG*Mp<)J#UVvqyVISq zBQ%(Fd05qZAvZK7OVx>p&{H4Qv3%zk@@^dpd;?Z*)OdBwD@{Yc%Mi`$=zL za|VvX)kmfTaoi9_>5b!t&~Y0ghJK8(9_Thcw3Y^X{5YU(@wb$X#6ZuNK;k$doT{b2 zupGZ|eo#s|HiEofM~$fPS+wBCJf{dcD0xXtbCSk8NQyY2%g1Df*JtV1d6-EYAapWn>=%1aR&}VCdTvSL(84a7G>V z1zP9o{mE6saUu$R7^-98m2v7(BRHw)IReo`=PY!g5I4RKQwj?GDEGT{jrwSDgGsa& zLkuQi{e2G z!=?clgIqM=X$*nU8gWylyUp80wXf9VoNQdHkc~UoaRqy_ntYv8O`e>ocE161tyAsp zM^jM=QZJas!A3_@H{y>iV8?m?ia%q0=pujh&vp;giLpT!^(U6S94e!QQCTgxv`z`n z6KiPjyKxC5eHt2PUm%jvfBvbdn>gFU-?GW?`ZSb_;}tPg96E>&+^5jXVKo?ioEikA zxllSWLiXBC%}GJ!P#{{4s^!D*reO3<3&Uqk|HQ`n1oAbMs=nrFcK8*X_w!L$^+zL; z52dp{pxlrgx!q?AosXH|fGdXm$u%@CurlVZtO<9mb^GWen;f1DcOamjB~J6uP{dCk z6&-|AFmMwMod=(>!&i+?G;S%Y+(BQKu_@HwSAE=$$S}GrII$`LJ^K&Ku+1BD=X=~g z)nGN&BJegof)_2SegJ<1IPE0z_3=^BtI#j5O@eXOo~9m_D$>`2m05>EZojq%G4L4< zXLvV&8b}R9F>-4}4>l5hjJQks%&&axkKTwIZFh$2f>DffaP)0$dW~u}3Pk7}Os#wB z5k1v@Fd}*oD1#BvQx~xN(IoSy1QfRulnyd(L!zre+tf^v1CwZoa4gMIqPjp!CFaZ6 z<{Q=@xv;D|h65(GX;olR6}(!9E+;yi^?-@0fDM3?47eX97m zDt`re)Uz-Y z+RZq=jE)AuvQG0bGn(9{HCv{gIN@Rtm3kbZr7oirCk^f91PUno1DL#u^dwVxhzMqr z@pT_#IhNt25eD3esORG5yg`d-uu02B4nn&w12f-8(CVe5LDgla!K+NlZpt=S_UDW6d zMDL?22gfN;RU>Y67Rw)u4-hJS8dOM752WEP22WbDUtgG(63D0x;%{b9FG_O;b?iP2 z_Df3hS0BXzX68VWw*f;&% zb51aloyHfs`0Ps?5CCdf!(u;15Id8$&#p(diPMYZYOFT;FQMbkA#J3|;# znEN5j8D`8_n`{U_HV&-qd5T~8$ltQj@7h>;z+e3xKH{M95rZfe(acE~Nz(ceGHI32 z6h!<5)`)NO5i)$`{hO{dlc2xI9gC`ap4#qnB=5XrihGRIRy19K#ZQQO`UIR~k#w3l z%F7LV^cFgU9LWJCCTg^;r3cVAK{>duq9;a2aSq7QyVZwl=!m(yksOiTP$2sP7*ka~ zq9b9V4i|<_Izeg9ZmTr$*`xv;wjc3MMSbqDQKN|FrHwn!jRgZV5PeLP{D<(qLfFzY z7&SB9fX*zEyqi$g>ISAXQ+HvLYlAxcG;bUo_Y7)FA!%@X9%HtPX8e(k7&UgSQH zmT!y=2Ae(FKCgzMLEO}V5f&UB7Ndb=WKp&9b0i8iOg3R4C11FfaLm=GNdzp zd{Cc-g#QAE^!m`$^wrk(M=%5WpGeNFk4x1iWcu}qnW!O9BTaPTFBZyAM72PDWG_bI zHek{R2lsTXr;&nCcVGqv=mf06 zAFn>nmldP#V(1*aQH_ZHP*ZZ`&P*kI3R&HeLPt{In&@rd_n>x|1R4v4g}BJX9~1>% zaEH?s#N7m#+Y>7Qk(JXi!6(!)W?js)c4dj!LPMDH%*mq;_1?FUyP=HIaRv?sH19_0 z!oXd1F7%G{#Hd#SL-U<#WeIHk+O8mK2V7I-U$l{`9Gc@8>!bA!AuO9~T}YN~gcc#h zf-f=qh`<4eS~l2VtTX3Bv{0)d+AukIu?Uj*K!3D~>IW=$AiavNHB|DKI0w^B16ay- zWE^+2=L7DlGpS7n)rS_JKjRl8-bA!v-637ufKbu?M-g+zF%&~67@06mCSz0tI3pDR zOjw<;7cr73Vvw}Ax{R7pbeUP@Qv?*8UVI!~`jz;BGJhAHrEwP;mi@JQoZyjE;jZfJ zuDTf`%bT$F)kr5x6fSui1)-@Qw*IxCE3pViX1X=RWMmW6dpz@UFq^TAb5PI*K#x^+ zj{O-w8QnL^zikvfRRaC)M1E*)YM@C_mr$zItfRfF4jbKBPRiS1JBGKVE7y8`mZ5Ty z1*_6|Jjb6S*VZ7D`6<0XIov&=n@=o^>;R z>%*~%&x_#I;N0LgZNMui(KBj03Iax)X;TLH&6DPk2b*wEi@1{-Rd8F4RRiyKi8P=Q zuFvtyVWSPhhFKeZCO4iLC*xr68GRU9L|B^}EJ62C@jzuo?wE#K4RItkhTxzvob~RO zE%ecDEO@1@8D!_J-082aK|;6q-%7A$UjU`o5>&l=-ESas+1$vF@9f6!Z~V&Pplc%z z%h`|lKm7R|o%PVLfUe@)+E7jaXH;XD$fHk8@n{oMJ=&O*fHnfXyU%H_i#7&z=VnjF zcFY)*pAXAauePPBcO{PXpuv;IdJ*;!$q-NV=wnjQ?CFog+r8S3pn?wb_Ic-cwau8$ z#^lA`c^DAH9b6do+u~J6;7F{Asc@%qg>WJv=xV?YG(9KLp8*Xy5`h_sz)&rpgR8ps zLJnKJ5;3&r&7hd*Qho+(5t{0zBx(de1OXuSQ{W@It(fbd*W0VbXf6pKI_w&zf`!<86DdlB6+eN+-A>{?>3YIQ_4j=FxG zn)T=c2+h8;f$n9|46J1^t5S zo1xWYXq!qS@7xPM8*aBSZ1&TyrW+$~uEt*_JX~EnD#=*AiK9b&`WS2x5-e@lk$Tj( z#ksSFcxt=fNmlND<%wE(e-wuFHfri+Wc;B*4fVtO1^jZ@MgaX=plLu?3EOhKhY9p3 z-p1a9XMyN6ONVVO-q#4U3GZxycH!+7sDqhqq0L)&FRa0E!%KclxzeQf5{h;-2`cah zS;a9t>PYnIijXz+`^t=Y1qbAXr3f&|t_`i4$eqedoE5HLZ6 zD)1%Uai$(P)8WwqHPX!+)|Q_K3u(8gOMisk_GZB(CX5outu9WpnZf>lX1Rp z16+1z9Km3^Upt07K)m`3G-2&^eWxydpPb70N)Pr#8GBy~_9O*?hHp-z2usFy=82-( zMw~Nys*w?0-uOTm)90ng()?Wg=v56%}qw@aevEZ_c}7g z5wt0uXg20zo9*R8+qP`8VxmIxXw{hBznoge-Ov`;-%{6fsu)oev-}5X3$JI24F^M$ zyISxtx)K_Gze|ZGC;4x|S@c)&$>Ak?_KA^=^|I61A?;z!w$b|Jt7&p$D2Ga-%nZ$ ztL#7ZVc>D`(}<|X(TLi%@qZaPLX3;T&#`sFZkzyk-_dF*f!FB|}g1yVImn*R^DekjGx z;=L5c$cxBBwA~Z~gQWHre+h4?>dn9@Kh2ny7maP8vhmcvLvN!I!+14<3e-)ldj(LEySIMticfXKj%X_rthkw4Y7 z2{;YTU4@1(Mmlf-$G83?yJ+wx@(b2gqFIV@v6v;iIT%++$gRS5CLm7&PK)<+!lDR3 zVVWSIolNZlItV%h>_o7WfSn0qK?TIR5bQEC>PSFxVL}uajbO#XD%mp(D8{6+aT~;< zH3UTvUT8wvd@u7JS6jwY5nK~q4di?i2gHg5vPvuiL$ z9_pv<^knQYC)=r;N@WnE&>xD5lvX60>u40L%kHlg&K-UShiqUEy+E}F6 z)-ZYrXuL362Q)#T7|`_s)d5WuXdBQZf$D*75U2rYvOxP8B_iY9D9mVl@g{*%fTjop zw*Ti3b#aZ9nregtK2nQPv84b_7sv@TL!fk^nF3`3K(hoI3p87x zNkD}HQEB5RTOwGA2NgUX>U`1TL{Jj!j!vDsBz8UJ)TC~wsmaORyPtk~j~+eooPp;| z^XX+iDeay(`R=Fp=y}GOy;6Fgb$04G=k{?r&pYq@^ZWKq!*c_WVCxO z{*A|hQ)d!7{HGw6l@4r(->{>%5f5}La_c|Cz1H6yAt^_a?ZeO!|Nos?t1pB^(&0rZ zOzBBPElVOwS4n_v9$LnekYKkvEXmx4p@SbRm@zfP0S{EK-I z8)oWkG^<1(MbjJfmx%1h9DN?~8>i-ohwP{~g6UOTGDyk+3QXfRWZvEUjed!ED6+`z zbdyM~BRle!B9!c81WP%qos4X-DQC4KbK)UhqK@n+ zzS`T7OfQhMbDBJ4E=l@FcEl&mNlyA_wIlQPZd&C?Udm+xQ(8$GX-9r$cVI{EP<)de z#T&_yawIu&hwLa}X&-EFlZdCi-B~arB3ZUW0+QU>CXqb-CO7xtMVRt~H4oBvP~IRS zJ8K@Ku+k&#C~wOANpkd1o*_9(FCyZlZ>PsTu{>u2Y+L3ujd63Md z9riiyiqzWVNI3kbaRJ{U$dlLE76{?rQYU#p$u@5oN(rH{tG)KQhPi4eIh%| zWC=T&2T6}nJji@Teo~$yl6tPAeAeEM;*Fm6a_#e(l%u~gPsn^`wWIJ$d-`j&ljam( z6ke-c`}|_HBYu*#%F(wGPy4(?X3~!0Q_7M1Ry!F^nU}0~Bt!PHZnE0Rv~|Ls!Xxd- zPnplMJFw$)H}jHJPP&;1ISRAYPP$pqft}UO_Hq<9k(c1#3GK{0X!VbHgW0&LKjt?ClIqDrBJ9azv zI6iUw$MLD-Ge?8tbH`rC7mhC-Upc;Z>~rjQG&+vhkJ*2ppHFt+NncMU2N(;Q#Y8p zxYVhn4kL92Zvo8(m4fDhZU@mQ;fv=;OR z=wF~3&?e9p&{oh6(1)Pipie=2L0^Nu0euVl0rV5-80a{N?q}`{It6qZh%Tu=6Lc16 zIP6D)MuXNO{%=MYgZTR>{+5BZ0B;5D0DTDB4VnYG4fHi=0q9%M8t^W`UpiNeo`E2T zD4zzR9BUvdlLn&N%RtojHV~Cc1JO}7268e=W0cOQKO-t(hQuI7Lm1J~p@wZXBM&1V zqX46^jK(vX#ONkQ(-`G3n$4()Q3<0Eqxp;$GOA!y$*79ay^NMKdWg{~MvpOC&FE=H zYZyJx=p{z4GFr#zEk-d$8yM9wdXLdIM!Oi*Gx~&41EVh)?Pqj=(LqLs88tKdg%MSE zMoQBRlYwaX$w0JF-#|1FWgwb)HxTI~1Cf?8kdsjwBhq7rEiFejP$r{6jD|3}icvNr zn&&rUeT+yO8fIe|jb}88(M^n|G0I~!n^6&?5=J3L^BFBi59l+{7odHhCeU}FL!cv|pFu4kS_s+&bSg*%^#Jt(oek;(>I>=$qBD%UgXkFs zGHMkAC9+u(qhv-s8Kp2vW#nX(#weXpe@2;%1~D4K=qg6pj695di~@|tG8)fl5~G_K zO=FbDXf~rFMkS0wjOH_1$f$x*C8H`v_cB_}=pja{7(K>lHKV5)tzq;$qn8-H%4i*< zw;073ZD3T#=siZ;80}(I&*&3I4UE2Iw4c!dMh6)kX4K5+7e+SZSu_7JN@SG8D49`D zMk$O^895oHF-m9DpHU{GL5zklx{6UYBM&1VqX46^jK(vX#ONkQ(-`G3n$4()Q3<0E zqxp;$GOA!y$*79ay^NMKdWg{~Mt37UXc{R7x&rN2YDf16(Q(7nC+LJORaa0qP?;bqAdR>J2&vbROsePzLA{5FLJhImiVX z26BVEAU`Mwx)wA6bOUG#XgVk#R0x^_x(!5!id+r48{ry*wAqBeH-NrJx3@Q_8|V!D zrXysp0Br_2VD=qk=nj}$fj>SMsG2SG1|bWj?sIJwlUhpsGiX$j2aky z$!I^L1B?zbI?Sk<(Jzc_DC=haW0c4!iBU46o{Ul$k)}6XaWW!JZdz>X(I7@c z7?GwoWV0EOrZ>!di~@|tG8)fl5+l;|hU_#(r0ET_*^G)9l`sl1n$L(dy&+q{h%~)n zR>kOEM#~vJ#Ap?x#~7_<^faS2jGkxo5~Eictz+~SqZp$NjOrM@$7ma)U5x4(eZr`L z(JbU4%16mC83>}k^m{n|Ql9${{(cVn3e*VtFNn^6{SkzdQ^iIoB>`F-WNrJ>3H?+P z&>?B(fi3`LfGz>id9T@!r4{|OB-Rb`g8U#_8bZrHX!!;$&7j2=w9p|RR0x^_x(yTt zEdbpKS_E1G(m+wr1E3Y4M?il9{TcKO=s6Ij!s+-+u}twX7`Pg=5wscfK4?4W-=L2{ z{{ejt`U=zt`Y-5v(2t;_pkF}>YJ*Oot{~bH)*W;Ps5j^w(0QN>KpCJ*Kv|&6L9}UX z7|0Fsg8ZNgxJOGj)_`&m{~E$r0@@6szRj~B>K{D-nh*Ljh(;f&zjOzPasc(4D1}#p z{sE$gM#zlX$v}y0mc%HTQBOuGj8Yjn8Kp5wXVjljCZj=&hA_H{Q8ptFBOjvxqp^&} zGn&NcCPvd3 z*^G)9l`sl1qB3p7!9qqAj4BybF}j!0az+m^TE*xwMynY;&1emy=NY}k=v7AR7`??P z#%KehI!5m?+Qw)Xqk2Z4Flu1*613n3P$_60=yp*18UWc$%&!>Qjb>VK=pdUVF-m6C zlTiwzR7Orl148-pL-<7xoE76=;)i&V31(mNriZ2rWX^LN#ugLs%qXLYBk@4Rw{wR~ zjOU-Uzyyy2WLHKBj6UM1!-_-rPX=!?k5kO68zXXLgYF2VX!Zk%{5KL450D^B*f=f>C%2HHr=;>;cQg2c+;}LU% zZKO_NscPntQoSf6;1RRh3eAtx^Xc0Dm!HZ~=P-|yDx;v`p*&_+2IEb^Da^{l)r@Aq zYzvr2O5JaobQ4lk#}n^5wejh0EVY7pq*M(>86KJ&wJS1Lj@;Snsnb}hj(Mci1Ez^8 zq)NyEJOc*S98+29Vdf#J0i~@Onxe_BWK(v+(|Pi+*UX5+uZzwWhGH#&U73bYp#0O% zbM~p-+2u=^M~0_>k_FG{AiGi^Fh&z%^>a>VsUqf)QZ*F8czS^B%7gHWf^_iQ^uaw? zs*ZWuf5nSJ>Ptw`SouTly?H%ES-}t6d1g|RMzAXsOZ0T@wg35^?D9p-Bg1pZj0Rd` z*DCeXQ^Ws!21^}f9w`-~1jj=w)9lJCc+*!r@M^aMXR_4o%+vlWUJ_EI!>PqSBV)w1 zXYyA(U`o-tHoI~Nih#ak`&UJSda=t7Gf#V${~@Gg{8S`N9N3Fp{?v?B%KCQYO1u#O z+aJHH*pk97f5|*fW2WBrs_7T0D!W2yO;R7O{%%iimU@GEWc+M5O-Sk36&kar_<6R+ zvy;zasgIba{a3s!q~urROx$tdS^O2l&C*2K(XM#$rtnOhGjGq?>~es4WOyz&^C8s? zcI8Hh5X&s}xw=%A8p=FUN-<5&5mK^r7k+qW|8rQX3-d^+=S<(v6;hk`J=8&{|(Su)GgTb)xKsr;klaJ!xunCrs_iHhP2pb^Vqzoh-G6 zd8E{%r1J5c2eK=tAvQ>Ao$cL!pT|U<$J18)f0f@>>N&u6KL%p?7p z3m$s5{Zu>sl{A(*g?Xf3|2E6%1wxA6 z^o*JN&4m}R)E?%MQcK8bJQsrOiu|tkhxz}0Axr7ZBc&XsKDOzINp;Q|j~=4|Pvxsh62YN|lpJ!;=9r${_vvYHQ9f87y@t^GK;wGiP2b zq?{;#6k+K7_y{8JUn`!>2bzFJ-Ap=8=BwG-EYWNEMjhb^O+6QZiZUW9E@kz0A^` zC8Ve|L?L`hf3h%(rOsg2C~VsTY_>N?l{>jmv}-X*Mcf z6AGFSUB*&g=8;mp&FXQGkfK=)O6b(?XKWk9Qhk_5O8t$T#&bEyuAGlIN&WQe(oUDN z)IXRHG^4d67xu@HPn2=a|Ot*P}!tsnz|m!-~R9x1hh8X9;gx7!se(GT3-Gt16!A!YSzI7?l`Jkqb5O`R}8NXhRyy#DFKBUmbrd8E{hW?RB1 zq;A2RzRUIgktcmDHJy2+)Wc@1`s1YhEcGYmky6iro1T#%yF&ZsDI+|;W7MvZEcGHW z;2CL?Qs~u9(wIj|U1Y{;KuA3akEq~Ydi6D523YD6=8-X< zXr>^QeY^66scl{!u;q#%OP$6%(ywz!CE*zjLhB1}io=!ryPP(frRa=mdPehi9XCt& z7??uaAU25Q=*DRYV_3>z#{3vafdS7DQ-_ZQwkwng$gjY~57v!ksjHbshVTi~uWN;r zS>@OoiihdfveYxoBc*;czw|mGMXO>-i)Q%uCSJ!joQkmyp^5x)3EVYMuq+dm5tll7`mf}s%*AG5(=M5}X$~;o4t691ygV(O?NAM_w zx37Kdn#nAsGLMwXGkqrwZ&&)`P0yd-zHq^fEOiU>NU3+tw73bpcI6$s$*)!0ir>G9 zrM5GVl&UjpnJGf*S)>D1!d0J48#slfwla^D8gI7!ZWdCsYMaVJ$z=8;mgE`pvJAiHu9-$ilQRC(85XRy>5=8;krX3m@`q|V2io=1AW zJ#;2ZEoB}lHQhAH1Fu~%gJP@u^4Y>XmYT&pQmV{M!F(ar4{r+LhF&lC&u6Ix%p;{r z&9o>GQr9Ck@ZYxeg%u42EH$5bWP0^Cb=@o>m1o9=@59R5XR*{k=8=B=%MA1EIH}nz zwSjr0)F?B|g+i(XZwldOl~cPEvedQABc+}&-Jx32u84dE^hW)UiMOy6t;eC~7Mqls zYxYlXg=yOn;9FTL#5_`Jq*=O)gwz1U2Icwdk9;w_h^59dkCb}cbZ3r`vg+PBEcG<= zNU3F}$=o=pxhxfB9w~L9sY!~3lv(B2e!eI6X)#OnXC5i_o!Pf4X(QFQvD51%EcGMv zNU7^h-)|FA>3Gv~V9|;}x3Sbs%p;}pP0e2lUX(AqNzbqUXlJODrEX;&DYe>6_c9?h z8gI(;>E|E1wTz{nWgaQD*G%`2kaC++i6iFU9Ac^c%p;{PHd8Pxq$tl5%Qwfa9291$ zOy-eN*`_=5gj5T?L0k8QADG8d!I%=DAiHuC-V_@dPxb13CrbsHM~3hd)8sB8^(6eF?nNZ+>Em~?)L!P1QoX47 z;<+1SSLB#hZtlXH?`ElUm`8?iJUNZ00%TYIKp6wisc+9Ls$i+f%p?7Z8f>;j_-j`v zmFXGV`~HMQEcKva2p%cb#|-mg*w~dMLKtHZzZunqj89CZzh119&=jF1<}-soBgUr7kl~?g6h|ky0-={wI77OSzaw zN)0x@R2Nd0BDN^|oZs!dzv?V?74yjSns4?`?-f!FiAFnW%YP@9-pf*VF^`n`)y$cc zAMMIeloU#we)min8)YebHyGiGA|D#r`);#Ua34(V3XKFp&{p^BdGqgMsU^%KrIwhQ z|9&Awd;g$1Y-(!a;QLuhXC5h4odPC2%RzRfE2JnN-m*IRhvh6)%REwQfNAo8kh&7V zql|FlgR80^V5vdOBc;}vS?>=*>Q*R2^6QJz*ByUgsedt#lp0{_Ix4SrWgdy(`QsD2 z)dyK>5c5c>x*i7KL-=D?E=N>QY-B&avg9F_+R8jq%5R#i5K_aaAmdr_@qO7VSZWOO zNU6hS3a$jNU73jxlJ3p;{(=`)veYr=ky7)_y6IsdMHjzNrrVrU<$su^7BY{N8f@mM zRYHnNB|SBdWPh-VrLJNgDfOP2?vH@iuFz#96dQNgZRwA&)DGs6Qf75wdsIjj;JYY) zc71fv&_`M7e3;Pls7*?hkkfcbJK2@*5JJiuZ%?Uv?2jxpk9kPSIt%=YkV?awltjsf zq}Tr_azB399yIgDW59Oh6Epuzan3pIF?RV8=8@s~+%)-H=YgzUM7B?tYx5JXRjTah{pVPY9`O#MpVJwOMLCaNKE{{6$DzX-ZA6s~P_nma4S! z2##w_lQlx>7E|g0_t|UKuoT^>LXY4PsDX+Bp65WV^QYn28=rZOrS@5Q1h-DA1kYbV zD7gY-Z0FFbgMSrLfxy%mg`qNGE_ei5XiEJ}NL_A9&0GHR^uGzIphZgX2#z^s+va&8 zHP)2MzUDyQ^BlsEl}B)d&D`>WkV-bc;D;ODx%CB>T4?1FQX9=a(cgvC^}-B0wTIt5 zi%g)Y3-YIj24rRuro*J{wwcq5ii&5_Z{ta@&51Y3pHr4kT^92(a_TuKhw@3V6_n=Z z%U|@@;Guab`M~A;IWtQZ$lsFZMN=D-xgoXGY+baP+-QDjtI6>=o=5CtYdnTKFUIlI zTNIVSqnj~Ca)!ySIH`?sA$%u}=RhyhYj$UuS);YO{8F6BFLB}VnL4~xsxi(lIx9gw zMwoY+`J+{8Vw^iq#C_=>WK{$)!<{W=`=`|%zgd5^ntU4P@*m?uI3n)5n&M3EG4p(@ z%SYo(8qE^d$`h6<8Ae8!tK(vWb_dDF;OQFY@(Xe9+!YtXQ%!wHZW->lrL%1ENnEKnY z<~W|QaXd5|As++g$C=c&F&R)$Sd?#y97ioPOS!!)ls9!|@tl&<{IaqEGhx^1T%2Sw zZoG$0b5IT4I<;u}?F(#T&2Cy7+o^?f%koP@p2C@-!s5BpOBWczdHH#TGpC30^T=Xc z{`AtBvxO5=i;AZUGn3ikVs36|{zWOWL7x0Ff=YSJybZ;DqU81dwy}j z)bVO@jnVoMLrG%r-x?Fri9G@jfnVt%w|A- zm%|3Hj05DoQ1S4haM|q9NK#7)u$UV8zqGil%q$VP#bqHQ`3uVOa|%PPzb8%d4IYFq zoRu#*+Gd`D=^dNr6^CaOV;_zIfPR9(;>Ex{61C3fdC%3&9u+BA-dw56IG6aU(anjP- z62Lf~xDdv1Nc9_MG1I6O+J{+G1MLkh^+0 z1E7p@rkCX#-n5#x@nuea>8yMq=*cfCoKqOeFD+~JaeCe@;j)lO+I(SSeyJ#(dHDs? zk*|%EkGF=ZDx721$D~A{3E;%s=|uy|N@tS6_(Jl_5?SrC5$g~uPn@eF&$p_N4tb5N zEdp^8c9Daids;tt0+pwZ-8OSohhda045LU`L)6BL_TO%@Pep@nZdqu6Q9YQcZ7Dhf z3Qp|q@OUdD3C-f!QCK>#YE1~Mz|7hC$bRuYoFGX~!WfqxCht^y`|MlGLbpzxgUB(; zn1}|{Q^-q2BA-$+4k#-rDhvhk=j9ifxmA{y0OjE6Fty|>X*Vwaws8L3nfYaCke!rI zXu^S0%L?a|6y>{1XK`SrheFe5&Zfdlp~ww~iVF%X#ii`l!jkKzm&2cNq2ki~oCTr$ zHUTM|J8ybXA+{FfUzcB!Tb$R{wk-d)@x^hbae;3wo#Y*Vll6nq0?jX_FZIqhid=_W z)U-BYRK|-t0z7OrYwsx&r4UNB9g=P2v z8HZy_i}S)W+p?dK$C4q?`kp^}23)cE{Nu($i=jD5P0y+2x0aPy%*@{thEEj%%pE@+ zZPZpnk)BpVYM{m$lD}xCB6h?FBFyOGl$D{kYK`RIu$E;@v^=E3L8WfiY@>@y=SWl3 z?H!no8Q#{Ew#phcGMamH%TNksq?S#cTP$i=Yw+Tk%0+oI87&G>*0sTWgs9aQ`2mJP zwb~R=-y_~Qe{Np9p`~$Ubwaee&1Rw1+^qWI-4XR(ys@QG6>nJvJxYD-cpFi`pvlJ1 zrryce;^HD}Am&V;pDXmg)lkM#oW-2Nx$)e__ffB1woI&UiAW($-=VFH`1Wnq4w+9- zL2}!nL!mbHc844?44lO*)!In~j6m~8n?=cz3p$kkEqfUpk%K#QL2^)sv2bpNq2`X+YMfd=8{?WXY4L5g0Yydg z<{Uz8h&ny6y@j5 zg0#`SvU135BTJsF)k^bA&|oSJT|d1j+$KtdZsd_=vkNH()~wDNTOfb)C!jB%Xb!)cbF-wf!9`OtlzY7`$M!i>={ z)5KC#L@G#?VND)n+>VT8gIVZR!)c?n>!tQNO6B+kC2cZ;P$I6*~1c9V=|py8^e2`Cf}wF<2EM#PM#S#)dH zF&Lmu#{jhIsB6{6DqvWlX=hlqY9CRe+KzHgow49L*{!lhvSoPbL@dHJwDo4TiB(x9 zMUTenVwu?;i?fgt-nn^JerarJi+GUj&@#njk(k^04Q?@H_FL>?a;ak{i_uXmC@L<` zEiQ$JA%DSW%;My?31deQDr;hqylBg}4ykZ`-X`G2I3BgvSkjV(gb!#g8q+T)WHEbX zq)|KMk&$T`a5*WTCDM&(>?mwj{cQ|Di3IA1)ta3;w3h=yC$ntZ(y>OOH6$InU_`P} z5q9|DTwBp6P({_sWmfqz3Qb4EU_jwaYbbs{hpe!smS7^IV@FULq-~ofmeE9-5fUof z>U&|?bpfxTQ)ECSuTaJvSs50V>?S1#T3r@-P-HD>ZNxzvrjuD2vEL?h4D2X4=2s20 zopNc`WkZ~nCo>KkCW8kJ5;g+|W@Z^I(@x1-YAg;3V#T6dU?DzHPFA1buhW(}&3fX~ z3D|7ew#=CI)Ta~iReLq_A;m0XCQOElfh$yeLJe9=^wuVuX%=>gXl>au?$ zL-<;%aRsBk3zZb)K&EzR1tGKl`DW+gayL+~%qBcJW2U z!rVYqtf332p6$M9(zyZMizM-+Wdh76FeIRb(y{|l?_v7o1C6cqq&cy8#D>4=w0sM! z&3^5uyJZJ%V?K;4)Ri|V!XvwJANEm?*682a=!^PVe37He)MZb?#((7Fkwa5l^wYGs#J zGe@{T%sQ!+hmNysr*I0)I;)kRwVL7AcKq@#iG@#f*Dj^9fp|oO|J*6m8*fK=K=nR{ zR$cx1>B`Zr+asG3wbPoeG>y(QjFPm|z|eR~)o4dkA9Zc83#_9__jlbA`9VmYrfe_J zPOENAt{R=-Q|cT41`j8~6GN@6fPb{&%3-6zK`X5swrNnBhHWtrWg~~}VK#e}9 zu2AJc&&0vCk9T6J62lNYQYzClq4JBP#ZYLd`uN+6k8kPBQnFU+%u-ZZ=po*=v0+rZ z@k@z2UfxSzC?6w^ENe{hU2%)W651>ln~KQ+F(oEejY)@Wv{`|=TCzDZXc8s@O0a;c zjcFE}cF^|eXbx>IX0VJ!Y8}~1&#uF`kr^t{^lCQ_gjUVqD=ZBe=Wn%Yh72BTvQVqW zSmOR)tj!&0ey%lhatyQs|4&*qm&p(qp1p@ZMMfI3??!8de+m%8dkC^wGwEkMBqI0* zW?dl+%vTilNys0M7&%Jp<23jNx8eIc$_AZ~5Ha^%K(&~ypDdTvy%&+gcY+p@wMj zxT;I<^k|#iJHPN~TdTiLT(rps9(PMD814CnKT?yJwI{2kNmct)KoX6b^?p}<$m7TMs!6Y!^KMz^tQ}dgrU?jb zX^#Al@SZGP=TJ-Q9N`idCdur8kfiAuV! z4{bo&SWuq4j*6{2a#dP_T1l7st)tBa8Fkurv}qAuyU*2Jo_u@@{r)cC`aoSuPDwAb zVvTfpphrWKc1b!AAseF=SsnMj^!uHt@OWG%G$kxJENU9xs~v;NyO z+pD4bu@~tSh>GRtFf1r27@+p4gez!kzcy%WLF70k%J=F!KkfY5tq*zyF*|5wK=~F~ zdEwXuBm~+ds^=(@pvAp&-w3_`n_l(BqLmK6@*}03-?bzBn)|1i61rG@%>n0-#v=E7 zRBz0!z7xYY8%uiw%v^$1Kv~!7FAO*@zxDh5EgOQay`d{}^`tM*Guxls67wk4+NSESsVHS^)wb{a7Ix24LE2f}keG4M zbkXV8*1)@uc?F}2nkM^0R=rPxWj=0;WCeRrdN@sspZf zLp?|6Y4>@x1~)ztyk&JL;qSVuze)5*leYNu74&s}*T2hEzw7<-Q);Ohgc9F$mdNKm z*A~BacwRTkzmx|lW1=W*pucU}>U8|FQ9$ouR0XCC@H=d;0$nT+U60vMpr3#YiMWCs zIpCviX*Rk+)Z0~;&4Qag{hu)iqF-8tKSuA=>^J#mIu-|%ZCAH6`1EKU*)CawHxg?# z{@@#_Z|c(mY3V-nqnrV)+O5U*!wiPiNVmvQ&8Oy8H+CU!vsw^`2hVKkM@7qdl&d9 zs=NPxmn@KAbP`Mz6>BK8WyLB%DlDOzgCO9JC`E7n@= z#i#W8_-h}lK5Y@Jwh2K9U^S4cTq*=?HS1dCq9lNl|NDDp_7)PnwSAuF|6<@|&&-@T zm+v{}d(Qcs@ArH58TJ;-PPl1O`Px#^RE@Z~*`>2)G3-6zR0EOL@eMtG@y(LwQeBpK zatx2|SY&S>xro|(b$e~91b_&M(J&BU94f!}KEe;BG`vz$o#*Lxi!AQ#25-Txn&4@A z?e^+VvbO8HtdHt{$-ds$#bQj)sbFt;m3&2p1b59aAKy8+fbSvxx;34|=hn2CGH`2J zR*Y`A>G(dQzW6G>bCvI?+F$hg3SOkxc;?$d-}q0+R8i5?=<39-W4F`!&xzBq9qMtHthw?#D2BJ&X>#0 z86}6uF@k=cT;)?hY1i&JO4?_rWL1LonFP)F9ZrC5u|f)FTPsMsx~wzmOlv!Q zaNtXlE_t}$no-i8O1H>k_}a?Clc3^*#5+-Y?8^3cbaxbr3?Ars{gSi-MZBEWek3xu zBxbbi)}5LTt6&==d%W-zVuy8E1Dv=tTiXiM(#aOIR%;atJ4em`_(bRC_6|5*RfJJ# z;$UuQ(JgSj;`tZr_p>*HC#rt3QvhR1MiLwO6vB0`Q&A*pe0^7 zI@Zv{EbNUu-M>S3q675MT3wsC$F$F|n-=csfZDNEHzv#8CgaUN?1Q?C%R~mBb7v;) zFvD)cYk7u$A02Xl5!zsC6T$S(wHs74{~#J8cBGeSzp5>M1}103>LFtEK|L024)AA7 zz=+Q~V%k=lY1iyYUMYiC*05#T05u8@n&6!CQ2$gCZnaz-^@qNG>ot`hAX5I0+%ccJJYr@)jK3#N1cK9 zg$Es0WLHxl03Kt;*sbxxUJ(7kN%261>CC==yff{2NwmmIH0l(R8fop)9vgd`Rj}16 z*sI5tQXA;n$X=eGeCJJ>G3|L@JkU?&i2O)HRr!%lQ8YeY@+tqe*rBuLj`He>RGKV` zmZ>Yt&WHaGQOzk4hGLAQmi;36YE2d_mmkwv&_qYR^6fwbl*-G;;DO6ju_FFGyqorR zAA4(baEW@hn>K9~Z18W19SY4oyW2`SHJ#*ZUXq3+Nh5G-_QVzhm?iZBuL&=FXVm<{ zsB`n%KAQe)?JR!OT{!m6=$icSld7p#hU3$QbZP7=Z?yDr@xoG?I&`<6Yj~5!!nh!< zeI1RZ!?MrHYVB@pG2d-0%K4LQwSIsZG)zkD63*QCdqHQ_RM*O!AhoEcusp>C51Ta+q`><$7jSPYc z(>@Np@ZMI2FAHCqS^X>|;nc91DuEgmuVhrT>_0O|DrFeYWjnWQERRXw!di2*h~V=Q{v`#0~4KT zd$S_W#7Yt>VtVFnED%OT;#YO9xo%MVPTj6~r1pR{V>@wdG3^^xO^!#V!CHQyiptc!DH{AK-n)EVS(M$P{WBlj|i&oOr~7Sd_< zB)!tqO+B2LNj z@SqKA#;tFMWo;Z6AA3P;T~nB)jEpRfwTIqg`8OD$ZS=qv`$+7Sz7-2eXIx|ZMmMfC zyT8)Do+<6%!sS`1+xuipwELO<&3b4XeT(U4Wk=ZF8)j5obKP&-_Y#v4d#9JScn2NA z8x-$nJX|G%Vtv4ftzl4{-Nf9ZIr%B=tcc84Dm(1G^8L8|?fZ?+XNbZqS2e4}?k5(C zyHKd3tsFZD20w@TC>cakyW^9TIJ#`|jKXGS35>d|x1DIKyEZMF;0*kAcu=E|V7pbY ze?mNP?wZ~AwC|x~tTN&w=TUDLQwOc^u!WOm6doDpR3D*5)od~S2Xq=D^O4_12fe*! z+~e*42>bV}S-r9S0I%=Q`gRMfYI($|K15@Swi*7l2HzR>R_g7ygBsTCeq1UoVHRv1 zA0OFg&2Fc?-Wz2oL7=a3?4{pg;){)S{_Dr_lep^CJYX!hxJy$7Nejk;y)7W49&Idy$uOz zMvOFUb*`t#dT1*{YSVlg$9j8jY?qr0m_$7&le=qJ{ps++L!;(bjC02BW*r}~HzjJx zfDFZq6IQBU)Cl>Oj~iULd(Cz0+nFLXM*J@%t1~NpzLh8*mln^K?C9!o(fHSzsP0uv zNxbTAq`FTD$LgB|J)y~Z&E4Kgi=WTkrii_kW)@!9N~?RKy>ZQTdF?NT?Tr%#m)!4l znnwS#s+fFA5p{bTMbwr~VR+Q-4T*^|Ov;ptC8HDF5*Zv=wr2JE_9nAnZ^Zv>m}Q=T zM6%-ZH-q=l%NljNpLCQIZKQ@6q|6w* zW_Pl^S=WBOp|e5o5-N-o>h;hTQfTC-s)%s0gQ;RBL>&7FIe_X0z=>)f}7riQ`Qyu{R<=GL%2I}H{ncN8SYdZL$WVH zY=6Pk;~v8O5O*i;cHB+4FX2p_oQ^AJ6pB@o|ntSsb#a)OSg)76IjT?gdI8M%0FUHAP>%DP; z{v3irZ{gm=C2)Vk?Z9ot{RQ_NPHgu+jjP8A=DZRo=OaFZlQYhKjuQ(SKg8XK`ws5g zI00traEo!@z}=3k!Og|pg1ZSP_O`CWU4;|tG_nKt0(WK7?z>y@lJ0dlUCMPFDM` z;Qof&h1-GqD{d?9MciL-vL*c-P5{RZxOKRvajS9lxIf~az&(yziTfSyzi|)a1jP6? zPFA$P#QhxiQ{0bn58wo``9AJG+`YK(;AD~^TY=xg-H8*vS%+JKTZ~(X`v&goxZ808 znbhE_aC32UaJS%Y#@&Rw5jPWeJ?=W(HMpyA({W$IU4gp{SBbj>_XXTk+{HK(HwkCp zCgP&F@wjog3fzS_0dLB2A>1gOY;4MA%?Ml>?mV2pGUwpV#szVo#(feu1osKtAe{8w zkK+WulMTz$aHrxX!1crBN62FPv0=*UQh~xU+B<;l4SA_-7OU_xZitE2-qc zJt3qjReY2^?Pt8Z2d}@1li5;9e<~fOR8^cC zS{}lk`Kq43QlUS(W8s9%uDevbT$x?>t?mO~AAa-vvehZR?YkbnC9~_kGaV+Cmaq)D zq!#o1zu`{kR=w@lxAjfuP}qxHeSPv(_GX{Z7t@yfm1Z}g;gYt#D%aeojw!zqU!GsK zN~PIeH|_1V{B+CZ_E3x&)K1=B9Op_m#9NOj3GxVw9~= zeU;L3mlrCG3h|#_IO(=|{)OJ%XX5XSJyCr%&X{)f>}#vOA}>@J6=I_oPAHcv6CqE0 z-I!OCr;o`W?~<0|G9~YU*T#gUr7ky&FyGYGlj*efQ~-Y8TaqFrne7_jNqstlddQZJ z=xWg;>s^*zj|pfs-hzT53c+X+E7KeDNXgoJrZ_w?_7wfS+f*fHMcY-eRwBw0mv?n5 zz0cG2B7wRp?ewUQ(~W{a*F@%Gu_!A~S?Q;Q?!RJ)N^#WggDr9|H1 zvpLbJak}q-R0#K1h3g_8q4R23cj3AS%}OS!x(in}TBZ!?>n42Jw%p`}O85NpbIKu% zsXz6VbETwka}h1sLQWxCrtDrdvPG}k&*_UAnu$ht?z2KFJB1gJSGIuox583SywxNXUu4P@$pBHD4NP_d?X6*=|N8CDF!^oZ0c!b8sxBpPuPnZTE%V%T(5Ek`P{_6NM?`3im#%lTv3twyZ%2vHfqO;V2J;F$`&ih`B< zTcY+h{wi6DSVNH!YSxyV%%qSKUHN<;pitKF&jJonnmtmQ#;npHn9)MG>gP|2#;?k= z;RW5K*PO#Xx=;_Hoq_W$Z--4lXyj$~xIGGZP4=vZgSNkX1S-{x0%KK_ zi!T#F@f0~dItm;|_<1K!jt7PSelDa|q%9;zm2J0b|Mrbfl6T1vyG4V%S8Rl6D~oj~ z*$L*+Fn3?FulGg={E9fge=uFj!T3Z>+THBWsd{O^sZs)uQp~5eNHJ@owFk1xIe7k* zR5@i@nkuIO8YAT#k(?MtK#CZ8)r`rMw4SMDmy&v4%sbVx-;~0d@sSi(RZQ}dXxRZN z?dQPTBx98J6JDxbklc+yw(gMsSsBQ;{A=~j)p}_4+}DK)DmLO*t;l)kku)J>VP~eL z9&!jFoFqetcm3Lug# z=&UzFO+pVZfRe;=;uU;t`jf(^0Y?2>*>dhf9vAXhFZVcsVw%-wns%Fxhzzncdci)n zGE1xbgQvG2FznSyE&K-`pCpmIYCpifqR#$RFcsV^*sX&1Lv5t}EyHe1=EKa|-wNA} zrrn`$Y7;>=d$n008>FSxDp)(B8E&w4wyF#^pNv>DeG`c{l?Agv_F_w`Pmws099pZF z$CpE+d8a3CXYnKPBQBD9sx6iCr;N@fZOLrdU}jJ-;xXTC(&uY07eY8{V4(b2ted<0 zg&KCP)InLjY2Q0X!rBkqrhaO#;U_tQ{zpq&A&(q4fTIHN`4%3cmqJ}hP&0%WTaa92 zjia_3rk2RT5+f=zVYSU98v=7@v7uwJwXzw(t4-|9nV~)ND|uFln!qM%EH7Co^=)*n zvqJAwk7lD~+PeYEZbsU1wdn_yuV+^!@~(syM3fJRVICOx2EAc-z8-3>T9fQObGc=| zN*8;Vc21LMGtqfi;<)4LRPx>35SALV?o!hO`;gwbLHCBsCEq3*%RXqtcES2zGlCnU zWhj39EjbA0zeLgyNfE>UjJ=mX>~{2GJFLhGHB?_kX0Lpj;%?Fz#2CXq<_=!|aNLoh zJgh}Gf;Usj>Zc2h_@sO<*dt!BI4S#mTJ%}_+2oJ11qa*=gb%FqQ$@l~t4Fal{bp%Zp73`!){E9pyeg&mW<`L{yU4v~+ z-sj23O8Qc|>T-lf)XaclWo8EYFn0`hiQ2=&05rXJxwKd3UNtoeHtX?thdi*qHDn{W8^F|c~syX=UJ%0uMRi1w| z{zp9jaMQk?!O5M7sM+bdB}1qLbusd}<7VXm%Wk8AwaH`Qm)g=r(pp7IbnZKBG5B9$ z^SawUsl{dzK==Q?i4;x$FPbG`zv|zn|0&4^Kaw+kB(t%nq{s-(Ng*GX^pL`Ir>n82 zggCqsN~ovefsst*aia6EY;~xaLbuaGkKuIJwPbc!yZi0V&g4Z|jKbs0!`%6`z1EAo z#|VBx1ZCSH<#Mv~KI=5M{(7i7n4(m@TQ6?usqQ&0iSXT+s`zdzSfmVdDp-$K4)AJL z)v7zsa%=V1l69$7!SQtlD)xksV&takB7+gjt+=x7UR7w32c!zTI-3%|`R~5!Ga2++ z`2ZHYNB#Ulji*;SDrmPaV^2wC`>IE~N>-_6$Ic&*Et~P_079-*jcR{h#LO6w1~u&i zmVE@l!I7?*WoHx12yO8$)lOvg;XPn zV_fRb4DK@Gm#0+r^w36a>0K%csR}gc>Su=Sz!2nk!^yc>((KL98(OTt1W_H|xpyEBUB=H$ zNWwGwGlwmeAs~6X2>GsgkcT;YUB{raSCt;Qwc0o`K8bq%*!N1@c3hGR$5y{9vInyH z_<&>zRRh>+Y%LS{`h0R&RgHY#Rg8J74Yn*Jq2~0U5slv?>>Dw9RvIl4hpo*+fvTUP z+2{|)Hlu5>q53h=QLTX=U(uO7fj|?SAE`um>}SEWDLW^L+gO{hd7Stdzm7*P#gS}9 zLAsjcPq!5btssq|HIbk=*HcrnArSD*=e;a60>1yiSE_uq5O0w3{XcxHym`A4-zSvs z6?}u0?<>q3+;Df}lZ^yo!RLl+#^;9X%j!c=m4L4rpZmp6@X1z0!1o(`?iVlNbH5nG zJYKMqfbUc$ru@hE50>7p?>-jBL)5cTWX|<<5v~yioq-}mOoCb9i-x_Cz24iL2Uf{z z=iUeTf$Oc{r>wqq`{PaW80nc+BZ1PG2UG)hIaB zFm3-UE8RAEtyoOmdV(fei0`O356c_T%w>vw9y2E-G}Z-bx1*%GS~~T;^^tt$QI)MM z=;D_l1F>`&ks9`&iAcq7*)L~hNl1bCB6x}fV{}gDu_$F;RQorgV$T~AY%ox(M7pA_ zW(a(AC=r<=DevaiQ&1&j>%5_fv&h#m!)Qz2=_OtM>Duj*bj?Xt=+AQt)G9wZC;92J z^&*W8;ZgDsUxm;Eonj`4M(8=AVb#Y|gz_rQrPue#ed1?Cts}9<9y$|vQLZNEy{pgS zZ=mL)aKqpGNBz%^j~AXBYd}}i`#w1lRojMLr|>G`-y3Tvq)n_KHhWTDxZxlDBFk<< zJoEYFAl?(hNl~;cTqpq*?pYF~D6(u;ZwTx)hjo6bWj%jqoUH(R#rIPK2);R{8Bzhu zT1W`-qegxGkl`|2@E!~`MFqpM-%zbq<=<_H)O)PM)?)unKocE(R&dUJ!zB|!s`c`@ ze*+@tbcu&na5r~e^2W7!?|4o8*jY50Gae&*(jDA<0d%^#AuCm;A zFtFfKH6AS^13BXn>&WD*GBaUN+rnSkh8cV#9@rbJf1N=z>QjSg6zp$L@=vLjpN{p8 zU(uwR`7EdL&Ho+^ujb)oyn#2L#07lY`THs58$?$*weyt+qKFkdt+V0 z$P>a`S0!=^>Y}>3#3N7K>tk+|!f6R3+a64>d_Nm=$jR&*pOFqDyRvef?>%9N<}29* z0kZYoy84o{GyBG(IU<+r8@uW4avym6#q`s)fv4FKm@3z8-d5QzelQZe9FB zyx!$Lk-2l~a-ZCty5-k>BK4iR+$S>sN?kqe%3hxez_0sN`%zDXccd;i%xyfOg6FXPu&d7Wy5(KVYp|1P7>S@-F?y;`%Uq`T3aSKoBm z5X~~A+p}@qOjf!vT1!jr=4lsGwr-IEyVxdh z&1PjR#HEtOKtcAae&>xCF}gJC8h(`DeUh?=G;-wd&xTYOu^hl0pR4jgcL)-HHlvjL z?yi5$PI2yz=;QPxSqDBZ9E(djvf2T@;CywT`g3B$=iBdvNj+2H%0>&;pS}i9#5*YlwyQ#&ebx)30;a-^xIhHR($^H$WM8<~ z=ljVo-ABUSBtEyrrh_Rdu)|)M)YFQhA}j}t8lJlE@wXcde)*{Pf09R>T&(Mq27lLd zCEP=Vd8tddqf`)MuMZFf)FRXQJetf`oHIE-@N|}69lG6E4@Qrgj%$v!mjiuW?cV^$Nu`{8P7$W#{)cAHJT5?N;)|jJou*p+(m+&_JTdb z7UlDLN__0eEWdh%8(z*2$JQR!rCoJJ_Y6Gwm> zqO&eL^62fO{sVo5aLa3w<-`?)hW7K&q*yZ`XFBXrzXGC!A6I{a2g83TmD}JUm-Z^- zvNd3=N>!Rvfu{>+#8*j881ZEfKowEX5HHk|x=Eh2Tr5q6#oAP;W&R?!A|4uT#udlfz~r*Pgn)p(A-l`W|w(CJVD(?oq^lo#$ z%;=O4l~_mx&F)Zuk6d7Uu1!493GASiyg<#kCkd7l*7 z&Hfjt8+QDPD8qiXx2x;z9Iex>?9(I+zyc|Co zu?PM!i%RqUoVb))%#9CveuVh?YcJd?kf^VtE-zCAQ z^8;bLhBIjn{mvJ5z9U@IaPC|v`M0h6!_J+;X07-+Ks8TyOo<0ZvM&r2+8doBmejLb zwI#nHEKmAWhxp6pc}<(Xs{hDKZ~MWMJN9U`kExiV56)Z{ePs9VtWaCn-lx@lW)KT$ zYdB~~;;L~ZmHq(cp9zX)TK@c7^$h>`LxrUEg!&t7LF26{9NYj{w*p+`Ao(rj_g#M3 zf|?BGYN1&D^;W&N%VMHi?0t}JK=QgClGEzS>78T?<^QIz5Fjfr==*4Od1YR>uj zy`y%sT{%`;B69s~0k&@??|a;)k~}-N+buvjuCmp#8-N!FAi8C+ZywsDEuG9rY*Ii* zBs8V06}sqlTKA(^b$1l(dst-$oc?Y}mET2z>4cq#-ybdyBdM^0bfIRw;S}iz`*fRM z8=a#CtIYWH2g9LG0|gl~R8~_UdOAy9k)qmf5;+<;&!JjH$(BmV{2NXCpy+@_LohIO zYMioYIl9u{U2BF8VkR)WE_s?as^ljwvW zDGN8rkEb?-E&F*$f!Pf-!CX3g;XJ9h%6bN0%ihoMP@~9Uw7enY80VBcO7DpbThKAV z9{Z?}16@Q0g|Uk)hc41XU8TxC+bjE@&CqFH+4o2u?H9eWQwVy|*jQHKr>_c!S}6RV zo#JqLF(|NG^d%d#+DXujk^^y3^0KZa7l9P790F}gjdis8>-c|Nv!ekiA1}{6i99LiR@#$0#uXYBazamDb-@zKnEr{V^JZ$Kz2m* zP=V>`?V*VV(Uw_C)a9`2GQ{K*C&2Oyy#vIPr{jCCjxlJKc8>Lzr@Ft zrP5bb-**-an0KA!oS{4Y3^tr<6@!TzMP&y>;2}P+%q*Wy`ZubK-*JAC1Z7*s4DGDm zWt1H@*`;YnNCq~=Hk5|7CpT)54QxQ`{=E@r`dAv*fP^jI(of2*W^J(m8VQjar}ayw ztoRjJ1DGE$L(@y=eOZdTqfRM;8px z%cEpfRIC#B^2aQrha*bynv`=h<B?-oR4?1hP6%85rTe4WliS^-*Qb(} zbl;%g=w<9BG;IJ2xtUJtnlpV@|FahKQLJpT+*nu6de{vNEE5gvWr&{FjW*r-e{@Y(ahAypxk> zVq-@sR(p@;7e>$@7Zf;RW0J;hGlQ*$a~YcO@6J2L2)#4!_NcwX3cao^UJKO{b6LxU zwW7cft+YnEn!FUlFQlu4+E8_7W?ORa-oAE#|x(F6(*V8`76QZzmoK_s@ zr@X`QM*0<993R*ZLX;wpQEG)6=Wa>#<5R2;S;1WwV>ls|B57a&tN4!d!jH>5Z{~6$ z2^40cE9ySFt%m)MSg@rOu}A5bmYuYMFB`GL`P$-Fs6T^YhEm5mO0~r=$bIZ^Y1M$T z1IaJw{?&$k*#HYUSGH@0C%(9R7>Nn+tT{81$)8F)N`s~t=H7Fl^4)UE5^7( zh1<_e0q7gpu-#|{;S$q_moHc)y=C4v_0Y-EqHDeuwO_L0m*?y8D%c53rtTlok%R-B zjJ-6i_A4^d#HSXOVFY*N7`Na5jc2A)T~4RCK##4X-ye{E&y-6^tnH`YZ*x1}3v|8~ z_KGpfkz#a-4(WrWZH3zB-AL;eTFlew07mC?B48!$KRo8tni1I@z=&Ta9e{5bIOhMA z4j{}^bpWmIB<7%MBI@>o%$ub?dGjV>C|>u-ysF#E(?qL?u-MxYq7aE3pkMeu?L+v# zx{cMJn8l5xN_s`gS>oszQy~yl5-noyN_(sqRpLIEo`I>kEmfMfvOf)KOp(~y6%E#4 z6aCrmHB@JcbVsf3dytzhIsZ~DWzb+JF;aOw16jO|;yXk#Lb^q!JxTuvNXzs~cTyVaLcadV}A!0%Q6I7#{}yGy}W^w<&l#|^Yzc&QoO&E66Hqf+i;M;Kv# zOj5L>L^HqXY)DpPhl}Q2lHvtndc$FO!Aia(!>7^4;05*GvPtDi@dG!5iXZsl2ZfZV zL1oYgZGs=j`QavuczcTKjES#vua{w?s-+7H-|V%b#8W~n`+z}LMFzafjtF^ z>7~W+sMVzgX8v9l(=$s>A;O9SYw4vTkEq-2(o6MtNyv%^#!jYNPO=A<$-rewx70&N z+-@n_yoqh{MSNsAG-V7Z8BNUKFwE1{$W+-}b)|D*`50*lv;ygz?(?F#ll1b+p;af- z9m_f^#*BdRuM?v*yf%Z|2n`R|5Vez9-8-u7sZBKI28O+pSs68!_#4lOqo``7_Sl6p zy)@j8?xrzx?oX4yHT-YserVOq6q@LwL8grxM7zGav3F0T57)cyv0#S?vAhX8?VMQQpvl_LEDqWt!ENJ!ej*4Z zF)xm?CNNmZu#nsmaVp0e&a@$&gnrS)jEyiSi9c}na+|603xY`PWWt32E|zVAo1B7h zsBnl@yHTcP?b}3*D8SfJ0(k;5OPzPSYNqo7k~Z*T%wtdrX_Sc{D(;dMpUkq#E1Ty= zl3!5s5vvTdQtPwkOH42~xzQxAWocbv_&1Sl2CtG5+IOKBvBbdy$SIDL_jkLADw{NH z(6`5mVVLf7k=TS`ZmTM0wp2jbB4d~wFz3gF2lA|}5S@}Cmfb?VO!w9$$;@(#rx+Np zngIAB!z>!Lb^ipr@caCNQ5D`TthLC1gQd8c4Er;~>niBp$R$91dif;3j!k)Psy;2< znP#P@o0Z}J3zF9MUTIo&Wvr$W7w)Bft(&MbWY7*9tYMm{fkf>oX0idhc6$8!*@E$7(@!3G*e!H|dJYq*v;l>zNP44k9l;edyd-W$Ph9VSZ#;VLv=( zzCW_e?B`eBUg8zOdow>zym`tS5N|+vdyBWX@**c;_Uog(eZ||CmZdtL%sUZztogp> zzgl%ZW6@z%?rUX~i|c`zQTy^hiY}e?v}&Zm^v{Xvu~xSf#*`{JQ!iuKsm#Xn!uDk* zy)!Y(dn+W(eVYj8ylOCpX|yIjgknoS3Q}Rls}xcp=yY@oAPMl#faF;MF$g^s%pjGQ z!5KaY7~$azhEv?*x?OOFfs0_tX5NAhO!7q((ojgzMA|q9YB&QJ6~^OY3oNJ9nmVB^ zeG}m`poXIt(_>joD{NtcU7{A#-Czs9CMCfZjfFCGYaN zVZTcs09!zYr;^evrZfNzV%E*6TopPbUu0I-34jGzU02bl)40OmuB+=TTtT$UU6X&w zPjneSTw1u`0)%)Qc|72zdcXxF)sDtmFp+0J8yQvu)-qCIEn^bi*mVf35M$X8i9?}n@l2_`J~1Movy;6Hf*umr zk`6=sD2DiK*n#YP0N5e4^_ZxG83a&hpJxfG;H|k*>#Yk|Z=nL=0uHj?!fH}#y@gS5 zHKh^2!EM<~glrCf#J;bHpL(k?_pKOkNrX8H70 zTHQh_zzU)7H+^W$d|A)}XQ>6PG<~g3jOAo4YEOaEZadFi*di%J1Hba3)WTK|?XTXY zm+d&_!j@Uo@WfA~jYuyGz0E*L!6C5FWS*rKwtvo=U%B+I^wpe~OYlmU;BOf^Cx2ts|)C&5SP!mh>NTz-v{1e ziOBtGBlK4-CWSTZ?PV#qDdABV zP&z)#89CClM|Qz~77W*F|46G$Od~3RAU@5_F(3$!CB1(L!t5S`pogR0tm=+gv1%tG zQelPOntut_!MlSXKI=jdsr>^*pZCTeXfLd0ReMRw!X8_1Df}U-?lbtqXXXAw;1Bo6 z`1s-RhiQDCjXzv2**GTt@C20l0Qkdx8la0mSkg3e@rNnS*pV08V{`Ba;TT%&IRs8T z#vd&CU6hSK2zL{1BTFmkRaKW9g+a)>qPbyNPMxH!{CL@cF{iuG^S%uFAPAsV_XW|K zve(IgV881@4;S)GBB=UPH_*dyBAxr|$L)hM)g*=?1){ELokUQ{(;VHbq2yPX; zVg76vF9sC&7vl@q9PElOXt5{gXHxR`WnHlaG%6Jap~b!?jLZIOS7<@O3cu_YRxtjU zf)x-pc!5c$zzX*MqfrGm{-2fgHmCypd<&rwl+Q*L=pQ|S3KBJf4IZE%t$-ZDO?1D4)eTXik;Dz^E zVduaLN_0WN3rEOtHoP#M6?QDW!lrMsdw)dX3!!j%NC0qmab2>*B zgyGom3fvl~VD^IwDR8A1RPmL#kNrFm3A*A+FXWVe`YJuX0AQj8gQd?Mjj_lsz6UP= z#Q-l1>q-Ubx1JP(Sn%s!is50R$$=JxDQdNaeykOJ63 zKXqbfx3~hiX`6RT)>6Jy@|(sMvhtHz&tET;`H=X6tVh%G4WH#EaS?xVTsoph-Ug`b?nR5|2IZK&-!k=iIyvt0M7yTK+x z8|>Svt-CUJ>+YbpiJk@<-05?G#Ej6XG8xlq+Z9nWpu@atv%rR}s^$e$%LN-Q=A#b> zHpuaQvSbt!zW*~z#^tm`nfgraVaYfmwPcK7o$~$dS7)skhviFO$*dP^`^tT0y;vjn zA7Z`O!gn8Gz4%=|&t5OyFWETeda)5QeSr1i`9$ch7vq4q?|Z#?Gl3KB{CThSqK3UQ zgfYABTdOsrw)iz^r|-3HoTqhJGb+GK>^Y|ZFVh3O(&P32eY|Us^wcc8>sE@Jjdv+r zT;W|!!l7Nft1p4x8}C|6s1J*G-O0Dvc$Zk%eh<7$7WZ206p*hT7WmrYBO)@>Hy0a| z30S&5-w!_aCUg*dtU4^zI0_rfiLWPotfn}j;QuT^hg`VfRCm1o|0&+^t&fg3$Sgzf z1|^RmkV6+ihGRnxSe59^h8$A(-*LR*e^8#`Uw}6ZdoR49-*LPlCFqbi7T$melM_YS zdiv1BQ^@R<)$>5zJzm{j&50xOSx93?-weGe^Z1G-2en$+-e%>kEe>{FadSv( zYQ=q`ymKirz?FYevK{GiKM&r(A)JQ2W7hUm>5~d)82f!sO#;;jC4hvQ#0pW9IA&oz z6_MEwMnf-(B!h>upd#`!$!=PVBd4UGR{|r0PYBQ;V9RsPQD93=(1RJY#d0oZ7Zs6o zfd}$VmZe7gt0)01U=to)hdL3X(4C8P=OmregKK5k=qUo2_HGnG2W063j71+{0lR%q zvpk#P-0@k~%NM!&0G%QiOp`w7iI44#J&WA_bDTh#QU*wCKolhsvbu9MHnt$4iL_|F z(%7J?kw?FY3|S6&@*AOg$uHmuc*hzc5_pFka${kE6Nz0V9+#P~umxS@>Q4+}gJ-fc zQp6WTM$QcFsNQXq?H6;98T}2U+Zs~}9L-8>0o9Ey$suCT$1OSQN!rjpS#rM1A9*c( zgne5J-`q?RpD^3?(12AI>xX zuWZ*#HW8=Jo7X=%(8VZHPh52jc6X3%4WPXyoAihwav0)al#ximlm9+s1$QG)iM%+v z7-6lLJ@iAxcZ>@E0Y2}`v}c)rmyAc`xd>mRgulg+qM|9Za#!7Ab*UBFsN}ybo8y(( zuir(x&tAWr%RMM6G6C!iApiYwd9T(li%5yRdfDep=R#!_m5`MDH#w{DltGqBMDapC zu15fTvpXMGxhl)3i$@&ot^8|sN$}Nd6@GQM4k9JAK#SaRJ)GU;u2J-o1 z=2O-N^f8|G^f5YVk?wxH2yc7q4RSV`BksHEW5{~LvPTXF21@H=NdMJp#WZ;0cl?0TiAy-sv8nw0{;sBE2#b!nZ9ihfEGJ0|51paa_Et@O4!q>+WU;1n-gR(P(>cXN&AwLfBulWQ z?M8g;=`QEJLIy>r`V2Y*JI0M@WE>IBi?YNa)kR@y`{;ovX1s{a(-+)>W4B4E6}ynL zqYQgr;#2$rC?R+p-9pU>GnHGk9h4e`#|1>HwZM7ERByBD7r`c15@DMW+${3Bsx#QMJ3Vx0zG2vhjbICELZ@j(y|iM6 zg2Tmkd?x&a^n`J=|IV?i+^rmo&N0&f8d}UzXvz+q zy&t9jutORieIwZH>IXf`y^AOPjQB?VB3Vo$r1c-fQjk$bu3yMvnkceu zPF0zzt3Q)94^u+tLWqHeQV|+TN+g3nrk^aE zu`_l=_hJZtl-@9vZ)s+z8?Gy&FF^`d4Zp z$2*pX30+-%G2r=90JlLklLKm7c|Ep1uqCmh88Nmz5E{C|JB<1h>&hI_BRj zJaIYaCk`w^pQ0Ggl|`aYQS4V<(WfZxrM#j~QJkl|qEAuGiKT=UeTw4V$}9R5#eI}l z^eKw_di-8!5A}|ccVN`sqQzvdM#>b4PjZDGqBfddN}(cbx1^*VekI(d2dRfUKp}{0 z1^N_BKsyX4&_82Pgq^lVX1=n*u-oM@M+Z$_n-jLtib(5HYy^Rb1e?d(0SA3>q!{3T z;aP$Hskt+23v}i)x)jafS?E#7TUUQVT2IdWNbrXpqE8{#Wzhh{8fEnG;l-%_(kSHuA0R*$-b)*Q6vWb z*fmT1oM^K61$sNca(m`ZNltgy8)Y1ByE!LD*th6FNtDT19BMnz@NcGIj8D@BGTH8$ zf@hP4 z>F;2ggRRc!jXIiF_PxvHJG)sRo8Pa(@84tBuHo0j_>!Ksy7Y+ieUS%n76qgfwmPxa z@V7XRi3-2&Oqs)QHYeiTCxOV!LLv|w8xiL&`M|kL7HVOq$iDY4yoowD24Y8ggXxrN zOZI;Pi`7T^XiL6^Ijh(aG=wT2(Q2)c80TGIUHK;lXP=DFKD6jtUSXos@@nkx=jNa3 zs`I5MBP{w$PNL;i=%KxH_r*FsH~;jU$qKLgxvvk-<#67^oJDd(kG&uU4{p?AlcLgG zYWA3Rbk*Y(B&LjsM1q?s=|XNJLC&4EE?2gs{xF&cXgFd9IEWsj)h44rtDMZkbMdnp zjNT?5fx4~{k6>L>9Ys}aeG0)v_biA-W3k6kd%rwjqRVZ*-ig7{D7Rq+kcl;mg}i3C zfmt4jxb$-~eRo7E?xEkw*Ul*h3Oi|IDDbH!l%YvXJ~mpCddh%O<#163;^ZRvN-U0W zHjHCkt`kJ$JVX`HYGa&pHR19(jYDitVUrunx{}Y}3z7Ith<8J4WY{mHE+h745SU%WP&;S5Q}~0hbH@YF zWI;vPt`<*?KHeVr1JhoMd8Bu=rD$c*wBhnsVf1UCq=n(!Nck^T;iVIoGBldnxcD;l z=HlKm5TxwvV1}00t!=y_UWyCD7ZvRRhBJY#@_##k%UFDug zAIyuZM(0%OXzsxq&Cn68ZYCwwJCQ%d%8y8>L`Qo$Tdu7xgbdL47a>2sLc-NSH(l4U;qV$Ve9oI9B^wnpv3 zd!)U4sV|mI*-Y*0Qu9~xh?*~unm0qy+qAlia;sbnxMx*)u~fOb()`l{4{y_A>yK^# zfQLZN@23I$osZSz4ldq=fXKJPp#SlERVC@Sw$GsxbQs!!KgGzYFH zo?tGN24Ar~V+K3)hK_u(yxqArv6nSVs%O%bS?4g=sJ^S!Jtl*VRy2`itROhDjJ>Cy zkSM^NAUNxnt6r-XuWkoci`Sz&@Rr0E`OqqBi!Q0xYJW+FF&ds9DW6R=d7R>Cc}YQUgm530(wnoU2jce?c=?CQ1Og)9X!?N_Ut%qDhj z8-5`%Noz{ngTj?EC;b^T+c24xri<~Vb-2x3G z_@s2P&gXI#E85DF#%Nlt2$pB(PYwXr<5Q%M5ed_s`7b0U@(iZv^-Lg@YqZ7xAnrtm zWRO$Z?Fn$_Z{#QT))?!g8bg^Uh zWx3EFcz~Jcrs~~h87B!fXMx|^ldDtMH!ald@vdMR^XYm+P;vkX#p&e7V{{&uTO?Vr z_j})^c;6H$Du#Vjd7g)AiB|qF3*%6MQ>bhPJH;d=fTu5>MwZZpFON=5>x-w6r3R3t z)+~K-#v+9*nZbH#K5ACDiKzhN?&&};0K4stbuzBUSaG37gJl0Eixw}0)B{4G0=Ip_;J*6|$yUZKTZ)BY)JAncy+h&k3XPkHImvuX)q*nh~FJ zB!aCB%y!TzS3qK3c*`(B35y7i#g&Pje1kPb^-UyLFGf~as7J7=gK-V}CA%>qD5JM5 z11$`;*$uUHxPmK} znu)LTUbWaQvbeHovHNJT;ZE$)G^s{=s+up*UI)O8vf8T|5K!am6a?32{47vQCOT2Fw> zKn1v@*9#vFZ`p>u^Z#>r%OEoSLGTu3yZSiZavX2TU3?$MTaM!`%3g>FYaPd1askuh zc*}9ThwvmO+~1c#9xZ$MKdlK6o5&$&qil z=@b74@s>vieL%cL%;O%%TaM!`$MKfq@-4^ZTaZdSF5luPp+L2jP-*Q~O zg&n}-@+}<4@gCw;$MKfqc*}9T<+yyyarqWOR^;$2M6tvxhhHIz^?wR)sn&avZ7C|l zpusP*9Y9n;sv)(_n*bwWc(OR`4LDIi%Ey zL~}@~5Q!4dH949?N}s#lbk&VK z7}`%L!=T)Q&Q&Z_lm=W(=Ohb>xNL=@W~2^1aV->z&@ihH&uS2*NxKorE~P&thf^Wh zF4{wzFocqiM#Hy74Z?2V#wolLzbU(9EG0kxQS^tlqy+Q3(;reDAf>>P z(jP)O@O|hH(d&+(Kh*KT^@lh|rhEONRF(IvKh*Z&^@mgg$kre7)Q7SuQ#0CA9~z#c zKJ6H2eN9>JNz)Z;$#z`5FBoA?rudAKLQ4^oQt9|2F+0 zDI01Tw;fx5sO^7|{*dH2u}HF=tv{rmX7qN`z^@miJbM%MQlcV*AQkD5nYktSTSEi~7 zYnp#6{k7xzL!z6Y^cR>vdiefv{h|LI`a@0cOMhsot3Nax{h=slBxh8Ja`cB#2J-Y` zL?395rw?=_ONYqQ2g1P6aMy6nqot({?NUm_oGyZHsz=g zHGT*cBH}^eJEn1HI>mFlEYjR`4pgg z?V04VV=4}P9FCOcNB?{Ehtzzz8~ve%_oYA7^kMafyfr-Q^Hr`sb=bxh$c+Ij_>O6} zVj@S(-{hFcS z#9iFCb3T>wjT)Nr9XdPZ`}VMu?`P=txL>RtmGa#eO8LGxHsyOG?duawJyWKB^w{eh zEPeA37ADc*5$A3(ixZ81@i3-l^1@G`D~EZ_aTtxk97)8!a>&p&o?we_&G6}s7vQ51 z(4q3u%P!IFzk|Gpu|O>LgjQSH_+}&iwS!oB66JDC)Yd&fSkpOO8HjDHxs0mLFFT+H z1?=1nH$sQ2Zqc19N93mui``!Ricz*b%YXxR-8Q5wc&tVPO!x0WN6eNo%oKV zP=*4X7=OvOdn%gn?gwt@8H7%LnPf+Z-l!fAl*y{Zh|hgj4`DVh?3`adJY_wx5u>|v zF-^LssyM7YcK%H74T`&sY{Otr4+~T$E7M#U2IZV${}xe{_OgWmDas6b6ff~x@yiby zp_X~m4X4a>`kSE_YOcYSEM`O2<}1S%=}tN+J{D7wJFBjm>|9xlNfC_o%8BuZ<;3`% z8DqVhlxbOv^@>SX3>7A9Qo|ky#wXu3L!0J?k`s+G&fFGEOKiMKc18clI095^Whjq4L?yq4B=o4$Cq6mexlU9iP+PJ7_6LzEfPCZ zeA>o{Fcj*x0xgaX#~Kb>_TR;P5UAjdSf#!O?6W9Y?sg8l)eN?Y1rfu)20PeJbYuh@ z;SPZu0y{NDnQWNlH#BLnN3i^DM@QPztHZH_SW$dYEIh=4+1Nat5wNM43p-m448&RS z#Si@Oi+RbB*&{^i1&6C8&tL^E_o76tJ-j-JI<5EB+kMfG#U6~(jUDd<>HvH(2M&2U zOnWwT_@I7Ab31LX`kfn_~>{<_tU+lM=oCVdv zj1YbwA>NzB5uSW{$JG(Qqrr!5t#Qdabak5EWDAIp_! zd1MG?m&8Jc5w9NNFOTX}<4`QsU~|dhnK{I>xD>^z82rs;ZDMPQvpC6TbgJQ044^2Z zF+`1t6SS+X&`U!2`Bx~sG~roUiuzJ!mdewBX=cQg8SjZ=N5VC^bYc%Cm&B%~GP(4& z7F(Dviro9G;A<%EV{)kxn?9ly9BgwF) zQgSOk@+>&}BSxr?R{K*Pluys00`DmNIuPmwTZAI;z)R_YX=*4#Bp4_O~1Jz|Sel6Ve(7Y4m+YpCe?3({qnswqP zUW)|@%x*ncE>_2<>snnWn!n_+UXKqP?c{~a14FdhB+m?o%0+v<>vT#rFt?#GEE&_xAM=MLL&WCO zr}+eWNwy%^K_S?BPCCUBs4}0Lcpid9X9b41v&){`j(mkn zDGYFEbz%;bLJ6U?x|gIDI-em(JutQ+m33o=OhU<-%hU7`^ZP0KaPZ$z^syy2j(Qc# zJQWyKxGg_1UXirHu%9vQSKNAtPEA&1-5lMNlY@@=S~4YFAeb_aNVwf6DZl(mnA1a#@G_=8#zyZoUWiyDeQthPdb*J5Jy7jw61{_u0= zY3jTqk3W1@?iGKyTG|Nw;RpPt^FTh8&5tk06B&%PVIrDBT^*w z+VA_OrxAKdi?ynpW8%)^x96*SOsIJD94z;Wp1-F}2|eX3uJ@#;&1WBho|9BAwr9~Z z;@nWp2I7FkwY=5%t6oeO|l23O&Gm_2_vmm9pU&QA7|x5%~!gn-^HYhoBp@c>F>@-e@xHmdnR6X zVxc8;NCr8r_P_ZyF`lU0HkN3_gv8O@HSu3O&gAlaa{^V@2EVDD@@7%8RxkKoa zF+oHA_Ni7|yI1lj!=B}TiFJW8?2(AtyK@bDl;*~F^a|YyK4Zk*`FC3Q*vIkQ_I~M| zhTrYVo}mvd_Np{$#`_FgcBWTLacP_*k6ONiVkDlHMj`}oZSi;nNZH~6L+)yU$36Ez zndknuSm3cjyR*uxE7p|;#rhvrUg?EW;4sFigD)kX7jB-#4WemqF^8mCwTSJ)dNdYlSpO!9XKTWAKfY)sp8k*fS zuQ+12TDD9S^~5dMCZD++#E^N(DD2p=3Rq1aV0dq1>z5vhk-S!>^NTGfdW7{wBTtRE zg^i(u@Rl%>av#a!WfTcvAQme;BkPPf z*5{pQXI3a#zO=L@ugQ8OalPFa`##O?r?1HhM186~9ObOFw&Vza%TeBhD-&~gR@4P8 z+cJ@5A(mT&8j;{3jHuTkD3Y8+d6{i~=K*pFO;U-;3d^I7$b3uM+_s8wA;bSPf-jJk z&xN{BT3f0C$=Vwu_8XDl5ql5kRW(Ggf5;*UBTCItdrcVAN@{`Bs4eY7A5`n3ccG(a zSIP2ewQq1MtG1klk>#0H%3c?dCe1*|#=nW0O_7FWX`+>#aJk3us4O58fAQ{xbktL#p8N2uN?)ozUX#Fy z-^qle^0_95D$K+YvEWGp zkQ9&sBTktFT9g^@ZeRU~X*tHL02BoQ$p#b?+%t;G9C%gOW?c(VL49xtO*erXWmXGd z2YcQ+98y|_DY%W>xrzns0Ygx@W=mkIwd@*%=W0vO6ga>PL(&&Lwh^A)Cj(uv)0 zC25}smATIbrhTPp-;lI#Xxev9+V?}!mK|p~4Xhb=IVF7%SB1M1H-ZE&#hpdDFP6l) zPQ|(TbbXRf*C+XOeG=65Nj_bl=Jhb!PK_4V?dJ2#WO&>_!1oWJ7RTQZg7q*!pM>mu)0?(_U7M%>%ik5t~*I~{X0 z9Y$i7YnAsz>N(Fpc%siIbRGNamj?AoeMr+zPwF+#f2NxO?6Yq!$WMQDZ#qn=qKwbiPom~3z~%X;&?m(AjSFu0 zYC-y|R7)=)t-KtHN&m@E?1mlZyj`FumQ7X6@e)S<%JtZJ_AmRTW0rc7ONCLsU#Y)7 z-wFKYwibEf^Ht2e;o9nRhf5{-#JC#ynK|p`8|0Sj2v5H3|5{b`^;chiYt3~x-*ENJ zYpbfyopB+hy!z@Hx8B0d7cZF>!8?1-+#9N@#@&4DjIVfMClK`NTW*cano)iAmv6Y` zhPkt5oO^xE?Af>bR5KoO%n#pBn5*dw5_@jgnp>)`9#M6}muKH_OLdj++?#KnH~Z>q zufKk7)vPb)2J9in*At_4ZS{;BFR8w^`iAUJAk57XMF#!asvDux%4cxmQx{qEljMvhc3Mve%LzCih|>34md!e4z~{JGCJ#H}Sa6P~}P zpHkoOYqD8GPvI(j!|SuzLr>ur67IaR5ZgwX>q2_iKsw47rOk6m=PoUpdd+#~vy+r{ z6<+M~eTy*nU*jVhl5_YP>U631J1spl%(h_ak?Z>Dd|`W{2VPux(#0#vw>sju8$>29C=Y3{R%qN0lP z%FfRTDftO@3Fpf%%IW$N%T(Oig!`HowuJkNqTv+|PWz@8IN0h3k6e##Hvw zz!7SPSwJf>2hpOsADF6+hH&MMUBFqW9ts<@iT>ynDIwtH^7WPF0(5${u7y>n(@z+ z@-8D$ojhf^$^lfaJxR1d@L%w|aYYnp*8WP|8bJ5=_LnkIb6zu1t6%h%0s>YS<$xL5^gCWEVrL zohYIN!}&uXwPtbS$qjS{=_Kn^vx?JM+-9|^f}#eS!jG5on`&15X+cI>+TLwTyk_6w z5ot?Se3i5%E51V7QqnsR+-<>)c`AW(NI+3i4%74~iCDi+QS%mQK5uZgK+8WS+5>-O zI=4t`d4t>Wv9Z7M)#Qicll` zkZxP@eD9+-yMFX$j~}@~RYA1cHb_1>UihnM{42d8b}+F;RrM{Is#XMu%(_L@Y}m_) z5Gq3i-e#)Q&8b#;GBkn+PQ9O!vDKXEuB&&M^ts zdxCm*6N#w?Gk1655Dn$%9Mire$FhTw{{H>s_rG#tlN_m-$WeMnCLLe*`H_QfbMvD} z*Uk6uCqDyoVv`D9{vPSS26=PSS9Ar)_%QVNQBG{>nBG4C`Pr-I#uyoviA%uuEQX z+Iy}9#7qCD@BhzyV6tZKwby;G^;~|>^EC5l5|w~<$cy6Q*g}(pov({tw3HKfW?|s4 z{wUXc`j%HrXZo-bdnaM9jKGUVaHpyWw6l*vZq|APLaETf?!*B3c#z1>I>HCiDY1h_ks_9j3{G zbSMLzuo@@RgsQ6vceh3l4zw5DXV~UXv=z59TG6gPTGPSLNunU<9$9Ac}gGgtzklagdSmZ9)0PtGoJ~&!P61xso?2r_$y{%gpQuo z!P4|XMm-o>((0S_3&CcTsPIg7LscYpt3ML^_F|b7=OW~Bi%LRUh#Wr0&vRvlQ?-Vm zE(hqYih8`7MN^#^mww-<2pmd@Rm)dQ3JFK!iw*m*<;+ITvcvKd9DFT7n%o{-em;GX zNMrUMe1s_WF9V$`TsnPD$NxHj(LWiQtE*Mo&xlMuPO zz00)sGRgx`Of*Mgr*jRt+CJib6Q^ykQ8TcC%saK{AGuCxWfPr(pNF05WY<6}nf6wM z$}Efh6YZ*>qnJJ|6uZDJW)s2Ew>srDl~TxdEo!Sm+<~A@APTe|5L8rrj02a77xEYJ zD&=(&VzC?&BGg^+tT{GP-c1}139Cwku;|7-BY@=3DkJpczpghs)v^{4!aA9A^eEtJ zm_5$SC`NC+=!O6K`Me+o^aG7Q6U ze>iq~H&MO2BQ@sm##6{_1qoiYSv2J9SlNjJB7YM06KEP`Gwq3i^3|Ujyfr}C=;#I$ zP5?v}xE#Boy76`f(Q<}ZPCk*E8|KM97br#a0l{jy5hzpV18}Xg2=lvV!JH{h>5z=z zlLFTY+g&+fSq=b3>uh-o#MVyQ;DXldbx_i4=7$oOTNSjwE$b05TYJ4{r13WrT#_)< zgQQ8!K{Y?8#Ht2K)3`0=cmS@!0^nMw09;(%mO^j2*FE&s&WtcEr@4L`w?+c%n2%~D zt0y#UfWeqbD2onl`F}833{E8Y%0g@gUkL|ZWD6k%aBqT6yFq}1ZV+JJgW<{jUt-{% zIRRCq3J83r3WzB%1oyZ!^Mj3BTA~fvL*Rx_|K=KXY9nx10<&7eMQo~!35i_fK*OiLyMPgDt zR61nB%F>}EW(@I9SUF>;UnP4GY$-XMtPm=w-^+DVL z5SlfMsvGXJ{FBr;hnIATus~G6QJaM#Z!$w4@^77E*pu??vqQ1VKS(Jomy&~!1YSIh zZ$O!t)dC!qSI+b`=9_kB{0#CqW;=QYXZk<_WLPCA95#bilNi|?IfSrSg-xRb!XS|2 z9?C~a^(^|F#pW`O#;2GZ!aXF{yD3p?*Rk!(iP9M+0!B@tw(Qqrl0z$Yc^(^1Ulo=+ zSclExA|`^ZCgSw6B+T8N^3#4nP;|tJ3fu2SV#VZcC1jLmLqTX^lx;KjEVy-wQ#C*Z zykjQ_?i9G}KGwJwFRI-G%ev6lh`)_RsGuyfJAmEEDo}gRoK+HHs>WP1e_~>~RnZ0r zExUkbw}1q|#MeMR7Px`OiEV2X&^)kysq&;0*?R~ymY;;rs^H`9-jh#UTlYG9Pgd}8 zkfXpU1UcFkk^^Hf2P08NCBSeeCx{$UFu>o51YcWt8pZ@AT47%S)9}t^2lSZcPX?s; zoP=9r^UIuh=7Y&rB8%l$3S0D93AxJDvx2&;5&hV7dz<#8NMbD!p%Q&T^fQwzm(`$m z`wID_W`bA1ZWxY^$n+?PrQrkc)E7^H4DcejhV6qH!EfU;lrE{Kn&Pv#rKqiKX==-U zM{C+MFimXzQ;OJnay(6anD#3ADvRt2pBS+fM*IS?1-+w)ExWFY;I){SN1U_Z@V1MA zeC(HtsUhUtt%$9OPTqaXo(1!&HFa>AmEzJ}GAu%OBq~@xv1xv-M>;{6Yg_$r)nSl%AnAiNHzG7f#+ImU9-Q+e}Ee1h501H|&v*s7DH%K@)0< z`)N(1z3lYrN1Whk{5HR9ZEr3zKF6gBU^P*>MqNP3@hQF?+69EwB`TCa+C8ScsOjozp$=ng04D~pj*rn0LnfxJ?Cea z&7$XoOU$L`e#AAGo)fA`XgLVEmq?}vIU27hxvO(2IXQ&1Z;3uQgPKd8$0tnBUBmN= zo|Afn>sK&E_@6Jy4UeJ|BNNg>(XEgMXHj$~Ldw0zQ;L+k$R$^gqTwP=5A+*bBCAEc zmJn~hr3@C!v52>`1yYt;-~TA|8$3Z*#6N-ccNaoNMZ;;)yIC170axOfnDclvT)!+D zZULE+Cwa)e3tGv7?b#ctv3!jhXF5U&z)WrNUgR_EH=yFq=p~R5p&+79C=$-JN3IGx zx{z>!`w7P`frJxCj*xI7)M$E$NoI)KR`pE3-7mL~rr#RBnxfqrzS<+vw(678YrM-W zZy7yBu%+m=Nr}4S(Q9ziJ=1IH@;*I+EjijkuXSb7Ya!<{k6x2`KTW;v5yyGiJ^ z^VUyDl53F>y@gye>!f_kRaKspZyiIv zl@x9v=dw@Ax6=B^v^?sheCyMbZ*}iSzP0AOk1yYn9UWa{^m59`5^;ID#uEOD!*BdN zDPY%{Y+zT12xaZr+t4uzh9?`+C2$U<#DrMtQrNC*kHU8CLF(yZyL1s}r{&q=a{L$o zubGf0yA{Ceaj8^6)Eck@@B~~Td#hzXpBB-fFBAoviOY%<(rb@XJXi#n0KGarpjW;q zAVoWIJe-&56sB=rkCNF{&lUVgbfKyKA}5vpqWBW^v8r?{fUh43b}WS(+vMWL(0BG~ z=mX?y!QG;%6WklPu=7Ott>9koA``_&S-cnOK0(eni}oPvya8|qT$)w8fT#6QXsF(U65CYz$EPM zq`u}8;k!I&7sX}3x=IwR3xRkBtZPn6FX&Igx;#9NhvzE!qWgUR+e@|f7)K3oVN~s8SQ4uzL=9q%5%g_Y&3?YkOEw^xfGJ>at3`r7G{rMdh zTjvjjaJ41LD*kprX2~&{#LPoliLWt8s|Zf>guu`qI3i?J>}QK9JB^gjTeIv%t*I9) z*`C>MzZg1zKP7WDVEIgX>L~eEVsXSdFNNPyNG1=zbvefGS>)4hfb#h011l^@ED5WO=Ow$c3wrR^3_T(`&|oPI8}FwTwGVJ_psoma7))W62$zX4jl109wKU_i-=mC zxS%I_UPgaiJXdCy=Zbz*_3%AuG{ozyY>1bMqc!%qiFU#L>&*_vNIANhcr8ivX0j~%Da+mqC`iy=3r@)>$Fy5O*l56s6@=gFodNNJU9dVD zZ^R2GRNip#;zIN_)`0bLf&5^-7E_zTdkKF3JcZw{Rrq}?*dg%!W)Hsqk_-3J?Vb3X zR0w{Og1{jNq`fcEk6%(pF76AA#5QgD66#3dzqDlvUz>#R=U~7T-aCok$MGUh=3u~f ze;9^e-t6?MkQT&$O))MotZn{Pi7$URFf9FiqW;6+VN?M5-1bRn!gQ4$Pz(pFkpL#U zCLpm8ZVVa7`&B=-g@Z3Gyb`>V6?lcYAA<9jykWU`|IGbFKv1O$K2ORhJr>>{M}~sV zsF}@s`m%a~7ga|Bue*5v&vAkIwgS6dtiQM$aj{|FrcoX?>@Or!tx>Ix9xQB}30cTh zW0(u{$JHG`|HV>Xthj#?=%3SGqtwOws|Ftv?_Wb9VgClpcHJmh_T%yC(ykN)OnP3- zSETsZNdEmaTEV}*m;?VptyQJgqveb%Jqo{{iT^56_^+`4B^S64Zck*7Y3zQEN3nkt z{UvW~SJA>{<}XKo?qtO-kCjaGRE$|yk}(WI;>ZBwLcIFvOz`72U3-190aTZcyu zKA0v4SDN;_Vf#H+80HV_7E3X67kOT>O18YMJ0>Ke&=FOS2o<;^bU>&hWI;1m8}{s~ zgezW4%hxQ7>a~(7;Q1XXEEIifu{ig0dSg5p_U{019Y&C1f8dJO9>7!q@yedLovt6Q zk}YpBKA2NtqxyzR7D2z6ZH7~zM0|GL8oPLnQxsj)?yK)_V7J&LmQmPG3SmJ`oc&(N z1?(p~Bif`FEc<;ED$%SN+b~EEuG6C5V5prU7NP)RAqSoj3e$87eup{K+(XGmfVY3b z47>{L^LNPB3XEVILNy3fF{2z{)L6}0bfUb$o?vYXp1y^ez-Dp}zTUOy0oDwrP)fKa z&1WI_k*tL=71$`A&Lh2`wOT@fjp4w?P;^5cut!yvo%f(8TytqHM29mJ2gME^NHt-`bM0J#W;7?H_UW}^9t&q9_N_PjO72*p=hrYUHlg=vlbx)_2c z$7fC0e%`S6vn$DjD>AYUV}U*5r^;8;&@7mKX`!|}k8NBH93cB3*UbC1<$q>gT&dwo zq=xSP?An8B%hpQMx?94YO=vjSu1rG1K}_^EFWlyugvP&42?Qy~Hlf^@gy4I_1Btb* zM-r>!7n3`g;OD{!htP9SZRg5Qe;)7i@I0+6TCgPb)Nm? z&|}e4AxxXaep2|JwEg4@EI-p>m2pErr+0pB>Kzp8=h@L3V|4v8~uzx3|23eYP0s7J{Oe-AEBuV(UL=6?+_S z*|zx#f4><=wpj&$iP-FwkeH(&_yxsb6=?&L$?3%f?rGo_D8+cY%s?@iZ1s$_>(aZ7 zd)+hE-jQLfjZg7=TcwSG*165evBueH1^|DFM@BK_ii~nyS!9z@CPEJOh<*PafMH&y_WpL z#@AGpXiax<*(H?n9x>+bP~CE76B9wYX4rcJEh3>y%GCysuPOFvO_%eK)FAefP)M4h zknHUu9EhHW^og|}A0>b3G3R+=v^uY(zghHSe6cf14j=yx#A|dnjP!;$A*#Cr=&tzV zr;m_~Zm%J)AzLNP*gWh&iJnCZ+zzVt71A-Md_qnAXK3QHjC@YNc--xi5s0Tcb(-!B zo=`Kr508k)nA~283x6COL~FfXO>uj*N0BJnLz7UbP8w@yu6*qU&xBGBpu#mVO|Dv_ z|B0b;#cRztW@*EgRV*m!R!4lJY9iiXoQC@)FpB*|qMR?we%G>(pl1z74~j`;^8Wlm ziBhICY(JiH(F{OUqXVWYf`eTgD;|zBS;OAwnOhpMueg#pQ=IuO>S#21b~wVc#&O~9 z4WZuVgE*DQ(68njWAl~#&5DIkluqlmg4-HTArG`~#BP^}94)XtN%1zjoTWpQtYk|^Yw%o&EQeNbtyltEV{QI5*gS zTZm?Kp#Jqx1+H*9J!|u3wfXK(`o?(Lv#t~K%Fg-YaGIQHnl72yXgl59iR+ZmEUyT& zaw;w^Ry#gso@&>34bo3bI>QiybX;WM(Cv?+z;LfCgLJMJstpzw|4{gSU5oUmLxFV` zk-(fq!^2|QRM!=D#+M)y)0Y3METrJBh1Y~(i~@)74PWR*=8YaI`uZ33N5u1$Jg5kQ z)P5lJ${FICAOHM?#u?(J-zY4E3c=^YTKr+Omf?0}J~7wPz!R_Nbyqwlta#usUKj9& z@dL^Y<7o`e5#>kxuwax8{T9DW+Mt@HLQ%1_L($he7);)5 z>GUZ=q@ALo668~SB%cnq;N;?&hL;KdB}++b67iV6e{D&14JN%mFAev<6x%{TrnS|MIuY4{=UH|CK9Y{98^ia7hR zut1(sq+x#{6r1>gdtPhNe^Dfvdsxe}A^Q$U=$Dgrk;NhlQyd!pLfGl!!^m%Mlz3Y+ z^Yyt#Z$+TV9nOF)d!ntLPPBNjK37+VkN9Zc$YzeAdYqLeXc)NvAY;#u0+bjFU z{2X$P{o=#PHJLCLI+jE5sPEu?k`)*I{C5Evw zv)c0Og=qWy`iV)wS7bzA*KTs6EB5lHG1q(&eUmsCt!6Xza}EHX8ji;cPyB`UQCqqL z=~rR~?e5ao>&k#Kgr}nse%DR99*IvB=@!fK7{1uYyVRSGY!d1%G0>Hk7(_Rd-_op# zW~c66!?EtugPRHK)@CmIo9M}$x}V@)ZKEE1R@WxA;`R&&r+?$h6ZkphPa7xuV!M|; zIWHVg&QO*--poqKavA5=W!fEy@6O_-IE(wPJ9RfT>-5yMRBFobHfq$NqEJVhRu0-&?8v(72fRV>6u9u79@=@bC6KlRPcoASw^B<;u}9GVnL?&Relz z{UwxMw1rpOnig_aVlwS>E-8sPR}rJDt~rF47(XGdity%EO~^UZkH~Fiz4C|9P)qm8 zR2cSe;n)Z{U%lOR`Iv{9_=jqnQ-(4-u!~RI3yD9yJ{ajcB+@x8F4b@9N!;yLHrs5G#{)co;#c-Eh5b z*ME;zpn02D4#7&4hLHWI`zU_lXSq7Ust@(HsttR0sCV5>X7Ej-J8X6a)J*kjO`>LO zg4%qm;R}}igx>Nua2oTP8*!p&R*!e`hO^kDoEm?FrU&=p?m-R=b;8R?iLV_xne^2-VR`Km@M3LAe0<3`-klE;VyE*P znm8OFlBQ5$edNBP!lHc`qZi|A_~Shtid{@Rv}yE{;Alal)~Yw!@;5121w$Fgs~ip@ zbeMgI*BNcukLVve8ic{dNbK4SiN+vKNG4vOBC%Swly@S*HbmP>avWF4G=H0=h~2C6eHlDJExR2?^|Qi+&;Dobl>Y#a{#)*~Hqj|y*877S)(7|uYm=8Oi0 zoZc}I6v~M0(Uv;0a)Pff7_2=skbDqN`q(o>EW|8}t|q`n%OhS)?x5NY8mFQBC~utX zZ4MG-uea5iBeB#TD$)UHOjkp4XLqPZjd5ck#2~|R5b~lHHeSYMec}Rdx)LL$soEb0 z&Pg`57me*jJ7}V|^ePzY_*eKsKpzsFjW=xvBY_QJ=ThY2yv;vXufp@;;NFE-sQ{Q8 zQAiGi7V@judA!Esyw^CJqY}M)kuWU0)P+Woa2Uow;i&N2nB=I|&fl(JJ+0v&s2J~k z-o`=3`)qOYD8}ks^}F2)0CVo*eU|7??)zNHbn!lanLo+)NUH^Ka4oC}*Ys2E7ghjlgkt7>;VD3?Vm39WEI zSZLZyYw(rSh^MCaBSDzQ1C6&pOT-_fI&b_`d%FmI`2yD@o4qyNYGDRfxy_Y%qq!S| zJMFJpIY1>iGKn7?zmKm}_06(G@rqa&@k`(Hdhr$M#c|UN|GUmBs(MSRS3v>4qpEME z_iIs6REqg-hoJt8wFS1PzMH|`l*4X9# z=Zb&!tST~_y`jeSQnevTY6{rjz3BF zBL3}eY`(C)fvGeCpzJotoJnZDBDQODWufxA#x%L&rmls|6gLZs%#{U&BqB`G%1EIo z$RkV=$zCeSOhpQNt0XfODa=zzW-3zHMPF0}m~ zGjiaQxhg;GoFNW3LmmUeALIyC-wFHI>o%d~WW2QH z)tudlQepNPe%|>V;Soh{WVK5oiC^1Y_5m0_7?FcKqvJyqPJ!8hn3IUpv+vNBJH)Gt zj~dAqw|=}=#`f@t0Z>o9b$fDzIg4KglOT81TPHOPbZfXY68{pq-(%bwA)grF(ul|%*_c;9OpSk__;#Y-#L==$2um0{6@vHU6pD4?EN6##)@IW8RvNA9W1|5@S6?#!v)7leF(GqJ?RQcDVWtr&&=uTJ~wEP|;qbRj6l+-YHv!TA);@=Rg6A z1@Q^%PerVAl>YRLGmqv++jI4&sJ7eDpQg>P;#)rr73xnF1@4F!_J-?~(nVHKT7Rl7 z->LYhT?#Mc9oZSG%QmIDRHbOkC5U*$LHl@=-m;p3f)DIW>n$_oqab`-{pC$$`{?|j zsy+S=?M&$|=})HaQsO#U_O2XWaI|p08M@1qycWUuiRmxj?TH_}9swCPG=HJa_(r}y zp8oPsrv6eH*>t0i7f9G1PtKm9yiBhOBzo5)KXuiZ0nv$w8uRMzP%x#&+>useu8kK+ zmRt=vLxps@=j#KxeZ_njJR0R_TDb}mzXv`M z4z@6tgH2c2v*LA>qbBt-(WEw>3Rl|LXyJfD zd`+YjmfYkm(U!j+219AN@q@xJ<1tZ$FDyQjSufZovvY1ad!s)cY;{|oQfdB9wVu#+(MFmrDoxQjx%yOT z9^M!VaevTgp_$Cq+!j(YbM}!nx7(;usZ8DBiO2b!(pjF6%5*m^{M1yY-=nZp^(Uk< zoy3dnR{vx5?8jA^&gE$pS@@%=Oz%_Gi^^2O2MBiWBdAQDlsYe`gq~HV86L<{W&Tg= zOAjBVFI~x6@${wXt*=MT>F??2u{Ec~b5?PH4drz-SC%N-zyB$HY2qk->0g+gbmuZP zr(1>e`3KjW?#tDjo|4s_v<|iG_&U_ZYW^~GsMokUR4uJTjaSL~S8fy8Nj?3kr#OYE z2TA_YiRw-{AC9Xpy;A8*n`M{ww>ks#8uX=NkoghxrPrURzBE1e3&!@KHC0+)muu-+ zX)4B1$5fjB=9o%TQPa9g(|-}B^ay;PzTS;}69Q*5;uKeDIz=f>zoe9=ZV(%#mL23O zO)rbYXDX#>kGIZKO4H=6%rfIUT&3whWhzaFf?i7F8+z2AHl8M-ta0IEKNF7}&8aH? z2H<^dGo(LK!hGo*gD|2U@Si8ZnuhT@5CCU7^F&!w{2Aq7e9gIMyViW$Ft6IO$8I5p zy$kRaeD4pAkMA|?9Zd9b(7j&iro9tvudcAYpMWtH*p`d!#d0pqn4WhuV~SG*u)QU` z+3EQ?asE^SQd>cc#53`|3kzKS^o1n8w-v-f7Q9!lSjVLdc<+wC4{s{Nkja~FVwZtg ziA#4sgg1SaM|dNH>?CO@j!k+1Unv3Sy7xNXnjNeAZeq$vxm6T;Iz zcN~6H>We?f*T>^Wv+%T~QjEgWDt`1Bc-k~0S}2t4@$t0#7^-73q8B7tg(havjX3zR z_|e}BznOv8F5-74KkAqJieLB!Er#I!y)-<7A9cv^VJP406N`G%mtG$qL>GI~mwu{T zXOAG?DT>!Lb9l{^yyGOld4l-hTz>QCvOGZlB|)hFEWg$I5o81FXP>+%NAsJ*llU8_;=ts-%;;Cn(Lgbey4%7W7Rt#T<4uMUbs#PRh^9)hAV2sumZ?% z4&(Vfc|Se|<2jS(G8xY=OF7Ee^F*<_+iB#d#&~{@l9}{$HkJweqeibV(m_iT4`U<#FgsqA%n<6+?3_koK5IzQub;0;- zZtR+TxDI`8QL>--j5r#@YT1~c&BG}6^Bz~0zzr?iF&G*yulliI${^edLL99poo0X3X%>S&|v=1V| z&GUnaN#P1K-bs5v$ zVpsIe;XcjmGMulL*j;+?2$uNk5aX0<%kRRW6P|*G@T&x_dI+Q4r8{gp;(_KV-MKPP z4;(Tp{@Vy{(d}(4_Qws|d{WmYykrD%P2KEWX*aa-9oXXr!`*9XRu`sLT67F$+cR&( zZSHf>0o$Z!j($5eO>>sy)6$3&E(E)>&1h}M-4m#L&}MR+Gsu{4W7YMUNyK1`$8_Ug*;eo$!H;2svO!9P?j*&x>5 zk9PIeR>+nbik-^0FElG}36pS9cSmT=tQ&vv$Cn;E^O;C&%};-Pb?-zt`_hr_eu>dx z2T$tBjF?}DiOH2BDRu7fV~Tz#yyfl0`0VF?{9ZqvLgcpY~^BUB!QlJcA8VXq^6GJx!uynw?y#XnHcLi=MLkJ zBimb5IEsICJPhD~#_}h`SCh>*4&i5ZY0>|aFNGdK#b@s|0-K#hwSj|BvJ8DW@;ytN zw0&83{h507P~QC0b$jC^r+83eP$m?>a0ctqcl?MBM=V0-X-(7ZaZ8-OtOl)Vm6}w% zlm>Tjr*OVzZ#JF5W=(Ov*0h#;(v$H{@xydQ<~rFOtWNak5oV`ZdK^2okUx`W<^48y zc0zsB{u-yYtE%QS#>re8wm!Xs7Q=4gwW1B*0cMBx(8b*o#zuN~>jHW~>3r{6mWdVE z842tNM>plIHwzdGRto~sTHSss{x9yYL|;KZ*gJLm13mD3u(D+W3Y78*+zmc#*3m}Wx^YUZ;4E4D7|3CZg}_s}CumE$ zCy3a4Bld3PHr*<-99>Mwwpm!=28ckQt$3OaDm(04Zv=}PBleE?e{y?ON?NEZ-F#yt zM?Ux_W0rwg5opGVK~?^X2bCmCNArDEe*7_6h{_|C5cerj(1}7loVsn6c%vd9*j3Ub zdtb^4!p~GU(@qd%X^T)~K|Ve=YAaq$T$p05Hz;VyhneAaQGoE)^|}-Qmk^HrcNY#F z%J6%3ZVqb_aYka5JCeb}xG(rp!`t{$g37POOXqJXCX>U(FwhKuse(%B=vQCjuIH5M z(e(z^*6@}Ucn7#b*TM$8LeE(x#+vwfDi)7V(|h6kX}aG{a&fv}oIg$Ph4ZKBesTUZ zy%)}(ru)VD)AU|Af12(W=TFmn;rwa3Uz|Tp@6}I|IDabUIL8-vX)9^zY(?oM+ zPpc~n`SBAg=H9N+o)&!_+E#Wr*#!+}=8ZUXs}>7R$11Q-0iO3kD(6e&Oq%xb9+ib` z%=`T7BEkI&PEql?%xUBCAs4A>=xQuBIDzdq;{w7;)o&k+uJ0vB9OoOJD$2AKKbKa; zPKTtGGj3_f-=1~GdAsOUSsSEmO_RcoF`!rY(d0hLxrOIpb#C!4$vzMJdHIpBGf}K3 z*Q$Q8$z7XOkUH|F59q~qi=!ZU82>8j;Z^Ek?SY8|KG~BPjz_Bj9-GTnnOT9Jaylwd z798e@FDtyVbtcB9H_A}#JF@lDkilLxLXMK0rVJt1nf9xUmJFM=qMG&3xM9-Chyrj7 zY*V(JEUYljSxoz{rUYFP_Zdo4*_VXJ8K0&tleO(?DoZ@e&W^A+1`*3n{Hm5Iil2J6 ziHdTnu)=*6D}3FtSYa*tO^Qs;dDzCH880l+gUp`0VDNsn@Ny=wR!v~RH$#5f_-58= zBfW=CiGRQ`5Oy-o4~BhnJi*oMkz!Wjo4Kmb9qe-4ku7h?N@|m9UQB7Fiaf(rMP3n! zUjuW8gIAW+8VIn9pzSVVN4Cuy*?|=)vGjiND0LGvS0*l_7&MLwxXMDeh-s1dA-Kxq zZI*2A?LM4QForUKnT%na-)vWJ+1nDQ5XWVYW8R2stXgx~e>-(g+MDq>)h=$MOwH)P zgA~L%U*bi|e9*AV?2xz}DTxF+dnkEr1C1O?>3P0Eu$*q{fmCX4iut?>BFVkm(m%-# z4uzO?uMIrK=MxGt&o{8@@;lBdrGTgSKZF1G^M4;);SW*s#3=3@{{EG$w^OmGWFq{3 zn*ZW>R}P9p{9i`?DdhVi`M2<2KK!J3VK3bj?eS7*`n;4-N$y>kVJ}sZN)h+RyH=J; z4NIklr&1$RDcLXF@~Tp)>Qri6Dpi|G8L3n#m5QWN;;C>e|9{T^hxz|G#^!qdf06&f z@wf25fG!GzNxFJ7o!rR(W&Hm!|G&V1U&sF-Q*a4?<#PuA-EnbKWb>}cxVYD3T-=n5 zi<^>haZ@rbZmKMml5ugb4Ns+HT-<9iE^bQ3#ZAe$xG5PIH&vTT$+)=JLaCIDi+k<- z`q_8X^GiMqi%+>MP`{E_e7^HHJZ~rvDWi)^I@Xv0~Q_u6m_fPW0 zN6PE%FSyv}qi|pFy2YpWNtOJ0$-t+NDp^wZ$`>D5YrXwVH9nur*sJD&KlDvK^&`o^ zr*G;h)4iZ-=Ft+(%V*Yw+95Y@?VQ;+)Sq823)Lq^Dzs);t1p{wTsQBA`dK$sO}wq))*G*zHSe~@ z^KWdJH}6iLTCQ%6S+~u*eg5nP3&!7a+pL>aVaLCF9Shx?Y8JO7qj8s}Yi!;Lr2UoiK}*%@;yyY5EHvZR%l)!$G*J2Nxgy(M(Rf}5t_@Fn_v z+$JX*b={X|-#UB#+*v*~GPm6DwL8zBb^dK%`pOr|%hDe=?S7B0s!}&9E6alyR7mpr z0XHtcUX7+cuD9CXnm^0e9w=SZ!!74FiQ5P^yf*I zSFz^vbrA7HKC<}B3a4HFg^G$X>Vo(6H@1p*$@8*oPkhq(Dn}y>O?|epUf%QaBrmG+ zsxL_XRDaj|m9MJ&sC-vn z#<}&S+v$1lnA?Wu0QRDZ{e%6yG{?@_?}51 zIiJ*et{k290ta|^hg|LVjTfjhpVT@XQ=Zk2`5e)|Bu|N8(D}$&rN+6kGP4`LCg%4h z^1Nxg`4~<&Uv;HAIpkUStf#!+f79=~>j!Q=e!BTam1jB!I&x&Vq@{Jl@p1BZav7vm&%cBb9%dK}zb>>FCntbm*@0OL7uOc`mbArE4 zzMqI6$&8OX&Q+C}8_{pbSMo{^`6@@3XO7FO>=N%%BswT zCG}o(poe^wRiiQ&zSR4sI8Dp=xbr)@B6Iwt-pzR|u8fa6e!P7(9wVIn( zN_O*ARAsI|IWH%ZXN;i5_@wexjLJISB%e;6^Uui1R~f9#EKk-|HF;u!k<2WwvLfq+ zllAfg^1Ls$QJMKFDubEhBKi6b?d7}q%$$6qF38$oIvAG*^3uNqJ4=nO2^YZ`7!)gSwLPt|rg7BN_gCUad$y{+Ww zxF#pxsEVv{z618?4f1^HhMatrqq4?%6Zvi-&zLXgXsRp8Tb``O32n>RZS+kUV#PGbbPPOXfOVOum)m$^ULnzREE! zYouE3^F1f!k>|A^=j5xX&Z5`;M7~b){94>F^GWx2RMvqm_5P7OV}6~JukwPd16bCZX&MwO4re9v#;eS3{OmpjtaDZBHOceMVLACKMqiLQep2tx$n)a)Ir*xy zUN>Jm1mxS~`O8>0AFsVTzZKCKg#xW07R2l78hNd@bm-2VBX#=) zJ+R*195@(kGqefaXaenmbe3rI2NxpB@ad1qHy{Lo9Oy2RfHIq7p(Cm=+}!JHq>Hxo zu1;EjzCPW4-V8iJRD!p|c-9ZaN|yr?Xt$gti@6DApd)xlTMjeedw9HDAWo$M8|-=b zTz&>xY>N3p6TCr4#Jiwm3Rl_VzKvVuQ1AsUDuN?~`R$HfNKw(2!$|eD z75^qzXBDgjNRlPQkHmhcRK`~*4OvRTmzLa122sq6&QbtUL07~n4QAxi9@w53n(&bbAe=3G1=DyPa`= z9>3oBnY@<1$?Nk(Nek4hbijCf+|S4}K##6FGTs^YP*0iqOD5t@fPy*F@S6kMql@14 zHGD46rpGSs#$sx{A%`uiaDCo#`8z(A_Xl({-F9Soflkogkp{~@+QA)tO>+I~fo5H; zem&4)5d154dLj377TMLkLoQ$;mKFi6wWib-{ey`PQ)Xo3e09cvitT!CJ{%q852o5kQE2iHBvxQuCX*DKw`Q4GUiq(fGJT(u4z%<%+| zzMUP#P4%$9mC62AM&OBX3WVY;k&dxbFy)ur?(R~y`M$U7{aIGTme<10m28J~dqRO7 zrgP;;lAU^R3n&jNvz!MPQ}cnXD8D+{kUEUmO~4L6U_+VHi+!q=nOF!qp1iSdp_{3dm*$FH7 zrq=XBO0{DDA(^wrd$N;vCTi9vdVF}YW1Q*Fyc@dN0Lnxos@UT@K0XSC-(WPY;7s?008rN^!& z$LXs)m$@E~`%tn$sUm5R32x?`_Za@)WDd}pc*#)>`mCC~_fi97I^&jN*Lco5Jox?0 zxf30un!EQtz45Ur^WidYm1T|7+2iNtohhfpv6oZ*#VLS7cIK?<8b6oSlP>7kv-PM< zly29KAN*%4?B`xYeEmVp3`X%~Ff;Gd_d)OB89qax5+rwMp6P&zn zvI&%BZ32?Xn49mOe&o})#1mV;L;sQMu>pLGchXJeZUEE3_5$K{6tNOL*jN7xlr(Uv z3C|EGP*+B|kTWg%Bl6O-BkEgr8}hb0x95if@9@(5)Jre?m44t^qKVxea;~g)LRE&d zQZ^BtGJ#nh)E^cyR}XOF31F_fZ~e`D_tBQMb2S0>)HCk zTR=YSZg~S2(X7JVcmW?2ZTW_A&Sw2jJOX~%cq8JEM`9xftt=R1uDtP7z$3*!FznKA z3IZ#*Z~g-+AY$l|WCfumt!QZTQWGroF}l0c^#Q(6(QRb+e|0=Hj__)fMoNu`BL0IH z$Ht8qzp`M2xpJ6B`T^GSJzkB!PF$luTtZel3!-Q4I5(>2s5_)TVBHM+P*44N%qx9& z#Q$<6Hq7nMxPqMSJjfdI*&#Uv^0O8|?!1D=T}g>aG%gX*#NCz?&UYpem}nh=cMazU z?gSm`t3NE0&NOXgy87sfI54#do3UzcH=PpVXo6_HUk|%_I8Qtxg9U{MsTz4+>ZP8iEYtu4EGrz9E`xGiss->yJ4F)sneeMoF06Ujoi>C zb+K}95621sVwZwTS=$AswsZZ8k(4Z-)I5cQe+5oTP@E`|i?EGX^O-LR&Nmdh^B`z* z3EH%Vzv5r4ITE|7gTPB*XlHgMPNxV%9(gisKNSjY*P=m6Fd>DSR#QPZMv!8gS~o)0 zn*^^ng1xk5-{wx}03OTg`VeGdcsSbJM`+~bzvQ|KKgqGsqAgoOE3KG$szk^HV09`m z=_IlW$O#Cs!&>y)N#EN$r* zC?r0XuO1&L?&)f1Su>YAV0+a3Mu4i|5C)jf%&vu_B0y^b3~>u!^?cqxd;<}i=0cI) zYu^Q0YQ zpR8_uY~*xb!xxz&0=YCtf-g6Y4*Q?Cf=@7&3;&u3MC^ECL{_LyZ!kgDhz)`CJ^}hM zZrDf6*qtA!-wUS3@&aK3Nk*Gb1w0-AdUa}YxRXOBD0$*rj zV#YuTB{HLs02MO^N+^*Tg#@UWF;GH@%qZ+9NkWOJAYopBicJ~FP0N3=nxAko)IwdS z78N0P=I$}aRFJZ|Hr*~H7#P6KLm~>)qGytEj&4uu%M#AF?1}k$^bxh?)}NxUUz*%} z;rW;C*P2=m!Ctd*u2@5YeUt-Cf?lk*+o8vY88#67mx;!s*A!{X?vXh@uss}`J}eI) zae+jPWan(Wofw=EXMn^_Z%D@AS4Nf=tN^HV6D+ z9VQK0^?)?2zW;nA$q+)IK6WY3KY_fy9v;>xpfVL2MENX`kjYu^g6<2yvs0 zZzs&8qGz=UtuV78XGs^=B@m_q{uy%Ck2zHxHa&ICh!_S!b_QB2x()x1khAPTauSgc zBE`t-s@3jYAMw9#I)!3kw0=qQbrHrhW5>w(31NbB5!{{DRcq1t`Lx^?YX-ATJe$ni z1Ji5x+mJ32%*1Y3O&DnYbcAB#IcCi={z`nxcK!;b1JyHLC>_A9Muo^Ew_#N?oa43J zu(x74)R`EwiU6q@XLM{N#!XLDY)Br`EzCoSy;7PUvEPo=Kqau_@gsJd-|jL3oq^8o zW&s*^5fBm^r{Z!kmkMBeF@Cci?RtMcNZm5GA>ff)_i4TNDEZ zOxk2$mYC1(c^Dr|rAS)VoB1w5gK<;e`Z5R_2#%75F+>HD0wHMf)q{x(T!Mz1N8K8l zmaND#azFW)OTgquH1lnUJ6%av!>(VG0$Ia)GP^pZpXvHHq3{_6yyo)QM!q8{*=8B14Y_ZhV7RX=nyov6@02OXmN6` zc#8&MG6$(ZxK#r2VyvhF_WH%sVVYQYoNTH3Q&}iU#p1q(D~evw2?Qnq*u+~Qh56ZL zQuIQ4Jktb2kxD9pp-95q5i%(m=5EvcZE=@iAOM#{xSEnpp7E}TF?#qeZ&jE)-c>@FtGOc zja2P_Kjg;?E|KrQ0|a)-Md>)-Md>)-Md>)-MVNZHalU1GF!hi)--#@OVUn7kRIqPR zGsufD$H3CrF3O@0{>Z&K_9et@YRP9}0r}UJBq@XeX#xSEoopSAgD`fF{~m#H#`ec0 z`yG2%dOh0D!daVv_psp%d|=pbsL)^g*-#ofqKDqsR-8$llVhdlJA?F^;$hmdQ}_)7 zYM8;Nu%D<7W3!KS{~il3UU`w&WpEQ4BY|hVSl)T?S`lr+E-SX+U_|^ow_3q<+VZnl zi(zMM*eQevX}E=bj6=1xARPPpu!4&HS=%)-gfUj|JuSMGsf{?}DlK8dFyFO;Z`bd( zDn1aFMJ$gAaJoZ}ZYqO-AP}RmrR5E5l?nODt~)%V|Dg(e>~0CSB$Tc4i}Hk+EV~b2 z8ZaEIuSG`Kk6qYCt?9p|(i)aN6CyN%vc-^?-1sG!iZO-`iLl;JZ`h&7`%`l$UVvq{ zl{rjJR@na>BYzmL2bAd3mM;|wVXzQ!v2kayoaugXl?;QlIUHMnUGzH(%A7GZ1RZP` z-ayPhtV0OpnJCOW&g34Mp#mYtEw^Q$r zy_U0`IgLjY?KVl#ZrKmTKd(F?Oj7aA5a?SY`q5X&z)6w#`P`y_gakf@9pE^>QfRSi zmlhLBDvK5q`@K0_%=5iRYMn|+B)knOB|gp8s??Book}5k%l_~kwNvcc?aA%yP z%1%;cC#kZNRGE^%O^y8BsIq-2s%(FXD(gHJRkoTNS+cUHBKT>*i3HvyAWuE-P`FO% zD^N;wb`!SpqtCH1+W5V8!?23|h@YCx;FCi9 zNBpnh#4WH3B~C0`M|eSJR|T7O2UJ-g_5w%whEAr-LE_O z_M+$H;!Elx=Gx1W0yi9vuA+HXY{uguTtsuay~&yR ze)Mpjw&Isu3ICZdrLVSPB!8TjxGam86hRiQB7!Kg-?l2Aw>O8k{0*IHOCsN~hHZI8 z*GdZRldmE8KX@4hKTc=tTbx=n9)R&gYuI!xjRFLO^1S|csAL;HlTqYbiC;-=nYIl^r~VHS|0bx&+ym#@fl zp@>FUdT4)(zkaOrVQ#S+7^C7@yJgE8_LgIHK($J@r!xw%EAU}71zz`{*0hB(VSY;t zXVEavZIM2AoN`5ARJ=fuZ`+3{5E40W_&%`E+2PCy1 zl8+@H680K3TEjhwOS0zcqx6chBSXqE`leP`!(;eqmX`-XwiKPQm{4ZX-90$*(4tfN z%dRm=WX~P^^<>YJlv(;iw(u4n9Y7&U-~J1! zFLtr$+Y#}F0xizv{vb-D7}wFZ6ZfePa0lcVt!Ue=4sH4G)zIT0gosb=+Oi^9B(cj+ zjgSde8+Cg#?6DzI%u@L7nH_-7$btq5%?jG~W@G~|ifka|XHI*pExJJ@H)z{iL_zFt zmS!VSD2!tzhvsN8Rf@9R=gOwLL^eH9l#XpiC4TDr1TW4E&T}v#{ZqKo(hn~r3%lev~ z+dJ*CR=0Cfed2m#UVU*0!l0fyIhM!ZHlM1x?6ptA5cM)@e6FUOT%zelut6B2UZ}O) z>&SSJ^MFd#R2ZUW`BNkKX`0G> zA%dd)y@?Uu-1tR>GT=(ql1FkivD+A%H@M+!)~8?%L|Q*MqX=r9012#Yox;KFz zr@e-~sK5YBAj7LTvK~ZN=Xh2IA%*wMLTUs`^~L{$WJ*_o$oi#-HGC zdOuXMddVaup$tzc_qkS!lKT+S`Yw7X3T>7((s~h%rJol8eQB9!<4aVsT(t2eh3Hf% zZC#nj>yeTnt9RWrwMzgj%egE+{y2r|j}}T}a>~mqO&6z>`$rcivU((W?V_SkZkiaV zNZ_?l^a!&0pHn94bW|1yy^+=bGrzf0wxB=bM+f#N#^J9k9DS_=VYt!_h^)R?s>+iu zl>5BmWfqPUQSPIK7G+)S{&gkwrW6pe_l2Ubh=!jNzqC|ZpD`X&opDuD?Q!K{dt3Cie)Xrb|3SBivS0U<{ZBXGrfCzJ z2IZ#dMbRxhR9Z4&W$927GfMmuR?ZmeSIJ(I?4^>uCD~gg^CX$4l6@rEMcy zL&^UqMLKCsS2OQw9-NtiN-SZM7-HCa1Dm^BAerFV8S^oL^KB&OGUpobgw?t|BUY=>a=Wyq z2Ps}rDt+pQL+&(82#H2n5m(@{g>q00#1vpi;xozpS(@yW4#~)h6+xt8A4>l%3Eby# zfBf9iAp(aqDg?;AC7~06tmSX{5Ma8%`br9Z<1BhV+MTB@zZSVPUL1d;m4s_mO9hwM zWN{U!8^@JVSfwT*0N`{rhUk2^mjo zj7CVE9}4ahpQ1ZM_A$^CVEWyoPqwY)|H`N1iL>wB>(p$(1(Ph6T>{VDLoL3!z4wxrVvJaNeZk;1#~nPod0(c6`pPf*~A zLrfOg<0HtW9*m#k<(De6^T%&d0(iG5@z9m_^cDrJ*uQmIv>gbvH|{eaXGmHHW}yHu(NF~1Nj zSq$Yf*b3x(#zWwU6{M6sWCQGn3%eK(Pd7|=?hzi6H{G^|!&q+6Mb||h(rt!qO#>ED z2wW!YtdJewa6)iWSK`}mW(RC4Hz6IZHHLqKX}=7>Hsts?OCUo#bw8ta?>fu>n(km= z1v6+i>rQQ+ZBEzIcv7$&%@hj+DG!!$A-U>8;aFZJ(A+>v#^y(BpfIS4ow!YALvS1Z zy}_qJR{)jhP(0%#Ho>XzjMu?4UeP1ZxM;ZSFe{YeTIe^mt%YMhRSeP8^a0L>6$&}y zD)4}II093_Hukna|6AT>!G-;RBd4%AY%~!rc!Q&yu*GolvqbRP5nS8kgqS5}(UCP*tT_6?zO}vejM5 zRx4hJHXqFk!Rhy@e<;Zx{yJTo#~+@PvB4f)pT{76{Q4Bw{J-g@@P~UL3zPg|Xl}7L zFfM=if;;G2UKg%xjj&H^6oc!IJp3V}9=qJ*5BF+K&&kj^Ged?mZ(0%^Ik#$%JJwq{ zdfu`RP^4kUdnnT759{x#om)T1V-Is4@z}%6hA8%sXM`#j_V7Ed_#tEb)O?>{x1@)` zGH=ACb81O7JQnd@6@SN^Rk#S`6*OzL=yx#yWh?5i+eeu2O;(|Rmfi%k1d(mmftaop zrm%#+!ZZ^6xmK9Q)%+Ev5thgd;TadEL10VmkROS0!f<91_>*H*KquB^5%~8A;o_Ln zd7B{{IqUMZ=qWTM9BYJ~q#<>oKzm@Di&=UT%u)wD50E8e1Pp2tvlMm))ST8Zp~ftP z+o<&rOPvsjNyHK`a1cxQSyenrinD>rs#dW*Q_5Hv#B!HG93~86IeZy@A{(xhA9pGy z?MJMN2#^H{US!sSN-9@n#&>gl&MGoX)>$g6Y`{Hb{Ug^sf=4npsLZl6_mo+7_8zV$ z8hW~Ty=s%&x@5}|Q+m2Mx~Ip_=^(5rWN+S_0$(xj__1Ctet=f9?Q4yfrl42PHcoV*R|JcKF_UTX z#w!WF8VM^Gj(s%^z9Ji<1WxURFR{cD1LYa-TYy+_F!s#pv8!0Ku#GTw0Jfc(ydOIo z$0^YEURvjZwtSh<1%;!9)pL=_>A{ixVmD+;K3V_ zEEfi^un;2yvS)&^QViZin1ze;;{tm-78uK8wJ1&)t{#dL1`ofX1mS+yW$;|K)&*mI zPj$8hSi7tCTgGn}jHTPVjswP$TJ!meRk9vIFCJZjpeBEXp1XA>%%%^i5B+Wwjx^Fl*svpl5WcQE6M;|d<6SXkD-IM=!v0&w^IyV2(!s?MVSm;XtFb| zD2t&x7^!$&Q9_EL3yq&U&NYawcwHDe=%Wu@h7S7ZRcX+#Ag_mGR0c~o1AYxY21^x4+<%+^}C^ z`Gt%C>?P>kguQ(Pgez#aZORYt|6(5tgST=tJhOvl!?yyIhdI4wCR_+pb`6X9)~$hzo<;3-I3?lcqO0_-NHamcXr}%q@raA)(p(ROqm1J z60Mfl-r6EnsYo)RtxX@8B=qcYlyz_Kd)-}k-6yU0>Wc1KskLqbl&7{d6m3JFOdl+n zPD=w+2uR`g{$AHPXU-%OptrjB{$8))k8sU-xXwA(xz2T6-|zSH{e1Yoa_{EP)&msqFFAQ!xv%)mL&C^8jvI0*9N^#%W7@UMlwn_(eCv0k5k+W8rmn zDL+=c+p4k6C7MRLQ6t;LOf52!_samv#!w)RY5amJt)%p-Dt()hoDvHBl+w$pw1bj3 zbwh#QP!dZi6nK-;UR4^8k^GD*T}JLRD$6QeI!SExveox9<1Poc>l8cCo_C&4ikQGUQ zx>iva?U7%CBPO6Mfp#-HBa{mE6EYg|`4Sy(7Ll%j1nH=mUx0+P%tx(eDr(+LKy5=Z z`{^Ue>^zB)_42>O$cUlMlNcH(jP~{9^;g9#kjm}E%V0B_r@1YP;BeD{!}(MDqn3)6 z;gG8WvI^9o7RO_4%GyV+?tqb*%}u1Tw~*$av^FIVKV!8|5i%qJ4hX&xROY;(qPmI% zjn3ohJt02|vCY9Mc9WwC67z@=8|rxjx8qYe!5_%;)t|_9QS`h+32SSjp}lw2 z75TY|`dtF9)M!Vk!K)zuu|&4=e3UJ@&9ljLJ)c;?*>YOTId*l!1>&UJia!sZUPF7I zxbCW#Ia_hv_29ZY+;X;Y|M>bRW*HE6a65_cR&~nOc#RJAy-XAi9KwBs#0U?Gl33QP zX`M(|F8xjw+{?d%TaLLP$aB2=S37}ECavQ{u?RRGC-ilN1i>QEU$xgLZh{0#x9r`A z=b4uzblWJOrm}aQP4tzwm5_Iop;a>NQ}F1>K@6mysL9k07iIS*XsKN;W^aug{$mIcvfi^Lb1G@S5?#Q@OchBf)pLF9m?P4 zykFiAz%2UbAT{-_nwGz!=(Pw3lktllO~Hg4F@F`e6_7*KtEh6Jrt&J{?yJyS)vI7@ zmHRF#)Vt_SAc>Y4IM(tW9#WvmgHFMDf@hn~tDxFlvg z)H5eL=_i?uzl~)pJJ}bIyoAUu<7;3?`8wBBso3a|F>SZNlSOEB zy?n-K!B27ERDrfzeB4>EPh20}Kwk-fA;WE70T5wm9Yb6b;;2i;2GR?mFw@*wFSfKbcrbtB88Y@676r?e>o(!BdIA?w-Neezfe<5bg3yO7N{vE7N{vE z7N{vE7N{vE7N{vE7N{vE>gcEQew8^_Oidvj&J2Q~rp-KRgHO?`3H$`0HkcC{hHU*L z`<4N0m5GJM_F|yIUgc2-LQcWdhrVLRYw{Z8>stFFB_XCbQsjOSG-limO>vp5;tkAv z8#xpvD@8ZqGFhb}n~W|+&F0b-0NRunWxX|=)XG1eXl|?Ljm*6qyTG1(u0m*Tly}$q zQlkF2i_jz*N6M1SX%dXvMlcQ_T+9-6WY!sJ`MQj*f2EGx{roBPPr+t3n7yma{B>&n z@o`?zWLkS5eY4+igNo@lxeO*px{3}XA?$qp`b)9eNfQcSJ}l%EPoC&$Oag&HrvhH zZ1d5`9vw)Zw*&eskb**g^$ZZs-Nw8grtJ7rQ2M~H9VhLrO8BqL@GCOrmOyWArc-PB zt6h}7#2XF;UZ8ZdDy0cq>Al~fr1y4H(tAs+pe2gsuAqUnuvP`#^hm{!$h~FWmkm{e7Vm+lF9x%j28yx#8kfi} z88<{I@Zn_ecM68NghlT9xP5DAYeu0Is8BvVpYK!kSn6dG`88E1jLcFrmyo}Wg?nMd zA{NSO3zq5Z)hv>mu#_c*Ca_$Xof1x-*zCibG4su|Y`I||1(mw<0R*BtIM4VRHyD|p zA#h-3ZvuQa5FVNqU!sv`s*SRfK(P49vf8+fm+}jI4{c9iivR=CAJY6;2|=yEzY5i* z3r3@%0i&sPO48b#%xn(j&vNk!@%onw5VR2MQb|f_4a-tA#`=RtmxWHkgPrB)6gPUw zV=gX?D5dtNM8AA5OVpvHU@X>b;8SE96HlF5z^06OgGpolbBwe#M&|S29e4@6ly+g) zoLPK*-E#dny&J;-36}`dSOuuP4WxEeSsSM{36f%$q6O-q%S452Oi&b(5T@XJK*q=* zgAWL6>0@XaZv+14GPOeSIM#$=%b43^X0L^yX&0}X8OP`nFaa!tNpg*n!rvtT9e=H~jM8B!^#YBBy(&{D@T_Be+e$mZv+O1N^w#oBJiWM-L z&S`wHxfrz+b#i$bz8982%m5{Kpmzf7yHsA=`w9!v`rH;ODLTKfb5id6?DT#cYyO&_ z5-LOury9R zRHdUmsr!gBaOQ6`!Ds_Mk!LrdmP|$5DZ^Rcvl9l$#dMKgZ`N=Y`Ru~p>Q=KxkoJ$w zBH2Xorl!IJ?p0poRWpV2Xj3suQxT@`E?Gj;HK$5KAUw!o(ln*Ap)>0hTF&=<0rIF~ z78_{!7+>w6X;)S!v>BR=Y;S!rRli;6?u*~2J3S&;onJP(EtJ11F$Sx@!QAF#&INT& z14|LfY2aC%%sIVXR+MM3J>jL!2_X=vbD({4*j1`yVA&X%=Va>9?-29mu7Y`Ed~Kub z`X#N-V)CYbUS4iJTj(HOz$9rwh75fn<|JJ)a}XeBKP zs`5TXtu^25X2K>tXNWJlwr!P%vfR;5kC&Vpq&6fp46{3j2Inuvb%xoj)qsoJH39cJc&KKcRU^1xtnx zYIvi;Z`hTR;r$xkC_XD~VF+dw3s}&(-iqGUO*gfDVH#EQAm(+6_U@!EAJHBwY;{+P zjaT2GvM5Hf;q~R_aw?rA30EY|QIQk4l#k`koe$)B&*4w%9C_5xc(EvklikT=t}Kdr z2V99caUtXF#oSNIo^fS?>`vn=r7K}h^l(}tcw95xVcH?^?&G<;KwDVG{TC{-I~Pv* zhR*v_-O*Sp#x9nHufP6Rkl(%J!&jO?AnCN9XI*s5^h6(I#W{lfPWBbZ@63wKgKFv0 zI-#(JNd`B|$k}#*pq8FxovEg`!uQB#yJ-n|&W^`~^#C|j>rga&TtI;F@RpbYhF8U) zN3%{a*|m48+3rHFy&yaJ3j5rK^ECxtJhFuwO*r&-eW~m`ANyS@JNbNU<^ucOXR+ut z``u*zjP!pi{hX2B+FL;zusc6gxG3Y0VQ?~_Rkz~^@ zaX;o%uC7Cw$9fq6rBLRr7)oZZ12y<`%SHAj4HwBEmWC|Yq0F10zX#dMVL15U#WQ|( z$+CuvWSSUGmPgL9kmcdfKB}%xXK?rc1t};)-Z?S|dZWweM1T*=SISLDe-;lQW-$w@ z;FI)1^4IXB;8v_Lx>}hxa?^h&Fu{{D;R#h;uHeV|p>3rrAX^sT~ymk?9np3Pz~6(I$mq4H&H3pmQAy=X;wDP91)GOX;wDP%BES_G%K5C znVwRqZ)MZW$dpa9vT0T}&4yd59!YuGG`qfeQ?Y4w&@;^rd8XN*XPW7~Vw&l_Vw&l_ zB}}sooaT#~B|&D4LX)X<5@W{Pr-svHP63-HZWMT1&JnA}7bJIRG=}GgO86nF2XK6~|s#ByVsqDWi(i4a>J+Bk4 ze4IS9g(ma3DXb^S-EYLLW6_@1DxklQ?tWRadcPxo-lg~paVA&9tvkMoPkXORRJoL! za+plk3-QT2+)81s{C)oWMNt&l6}x%1Lz4*&3Tli(lc{)6Zc{uc{c_XN3DixOqRE83 zO47PCO{bIAg~th@YU4+JsrucDf+}h~AMM$vpW+pHfc5-ItylC?^~m&&ZT)vMNEfJC zSeyTT;d%}eic53lkT&|R=dhssVb@bknew2+nKA<DPJR8oyg7=x|1RPS5Qv=S5Qv=7bqu4(PsEV(=+V$N%^^6 z)Zi3RXa~pXoTsDEcsMg$PsdLOC02L1FJ`4@#5;*(2q^Ggc?Z@Dz&N9bSw?@!&wv0q z&tybOX5(WQWGkmCgkU5-)OJe&$$1Nr=d+Q((?Cwgi%FmbIg6ndNCAp~oUe=kax!7> zC(C${UOy%od@}bxx$HWe%*u)CMk#>0K_t_=>dO3rBEX>FI0347734n&VDK_RWA_pI z;ATOX&bSPB^x1NDi(yws8_t&uGaA$OGw zZ&4?0jZZC*w^;3yw3_Dsu;X=#?c~*@g`3@+DzVuW5}R#P;Z_AtEgDZsoiJBUNU0O@ z*AMG5rH^d(TpN)e|pf3csSzUoWDq}9j_!YfYSO2;ueWcuUX8l5jtVCDgQ`XY^6 zBRxyKM7VH5Mn;0^xug7{{Ww{j`c?N-<<%ecR6#G~OP##lJy~4RqhD9X>f9Pm z9{rFX$|2XE^blbk%FRB>AuV6Xz4K(dQ@P_Oxy_dM<$iOL-Nu?8_7>g;k200_=t6I^ zlYU+Tc`NX}p_N_VcB2QvC2CsZz7KG?OQrzCofJx^gy=(nxX359%`sK@aDCGH)#_*RGgR=N z>4UErBwsW7h}HA(emb+{P}WCY8Mpliy+Zr*)M~_{gt|t140~2sAd~ntZh>v z4>h`^6M;*V;P#rgDCdMyy!iQuEBQ%hHNJv#Bzo;*o_&w3`|#Q^HPlKN*J~dg#g+_3 zqRxcbM`a~?i7tRf3KDjN?}a$Yxw7Db+usdBRsfXHLquL#)s(xRg9!&}j@ktkxh?$G zA%2N+pI^A#Xskt423isjf>dZ^mZ^&uBKtq0F^DsIk^R4y4k0RX#Dmf^U@p4K7ho?M z@8$YVl>O9cnb6dxXPDOWP}~mj$aQE$e|Xq@z}ojp)0(YVjgk>0<`67*-@ZdrOXOWs z8hMd-qL>=U3yr98f1RSKbv5RosTI0iMN|94vUN}o{fSwO%!ohAEH?6jRsDW)M$dddq|CvkQ&A9 z)iaXzT`o`K0nKU@4-ZDIo%s*QdR16q-!Gq-%WSkl%#AGO#v70uK}9UzqS5hFI*c+J z#dOhc}2z>(#SO!@G zJWf-ofpDz?f?2P?2W$-$_5Y}~#oA_{&kpE|T+-UV=R9!IP$Gg$2%V#NV8vmiUWDiwL7<@QDP3^36k4uEqBj zlbW}dH77YkU<=&(H3+)O)%JxBN72@55OkGa^S2vv^gSxTEjX9hETOG+G=Jqn62-qp zNAV%1Uobk`kAs4CnSM-*?>V|$1W%PhHh1dr_@wrmkF^y8rUG>L5@d@y145p@?^yC~{@**KTP_Bu-I*c}Sk zlmtW+3Vef-EILAgZ&4D$y-?sglsZ)Ddz2&rBoz2JO82PJPbp~<+uJMLntw`3*L;AI zuKB$2Zp||(>6)*jq-(yNlCJq%lyuD-DCwF@IFg3AxX+O!UZj{N$A#>6TvTZi$Bnr= zg!)#2t{wi{R*ur%qa)+UHk=+8?G+S_#mmGYy`sX-A;=5G1-Jxpm?%(!L^~70Xk0<4Q7iXU6PnSL^N;bQCRDjw07j^BLtOYL!*GM~|y&R9>PVFz_~xa18yOZK@O6m1F2-xx0d6 z=)FY)qvM@QFUL9bHP1Qpx{Qp}JgReuJ1^lJnm)GmN1k)&UkcYOIEMnIuh;&^xSnzj zy~e}(okJgy$0+F>N|kWtIGQ%gttED`f9P51SAg#D4{xd3U#jqZm{!+<`@Ii~AEl1t1 zE-6{hC6Ba5*^zH4b$GtH_74z!wQlYK!KT~Y+M9PGSVNw-k%)lIjkJz2U1@7KK6Nw?tro_@N;97bJ# zy2UXDD3xxpz)iO}k0Tb@tzNoCGO|VB`O2|b4A1waTS%98vjjvWI`=_pDf-@|DgAw| z^-Ad-^f-*=^k-D3lNYagz)vVh2ljfK_REatUUT1~cA0%q|OllM~QQU{4aMC z=cp@44^l_}Rq3N8S2%YCN0+F{mVF|KJz`%=OKwcb?bqeo1&RPacV|`cn!KGUp@xw>eqh5-Un%D28o-PMz-d5vcYGl;)pW3 z#8JYhkNMk=v1cOnG>n|PmH`EJ_4!Tfg`8W`M;MOkjIO&m(MunBqOH}RKEnLJe4U#< zazn}V5lzo6=_B)8N40f~lqttUW~}`j7HuBKnB00{>(y+P+T|YdIK$eP=Y`T6)fKzx zMyqKy34~S?YhE08AlAiQ);t8KciZK#dmC$?;+`S)F5#cL3;$G3Z2m&~IPNQ{MUi=@ zhI!0hqiKB}vvsHKD0Aq$Q|L3LFce3l?>^pX+u-7<>vs&I5Y#I;Z5=+b&jZhndD=u-V{Z9C@|IVS(B z9bXBwndE(WPOo1u|CaQ2J*0PNZ&wQYzChnShd1PKcQ-n2E*w#(#oaCIBiGFpMUKRC zbNMuxSWi}n3w9_!h5lGmd8Kx8nbuZ>AMZtuN!Yt(yfr$+@h=l*>w9IPmX7-UTR(OP zyc_Xv&8W`5L#OXDN-VTz_~^T_tM(`BkBeh#pK@$9&bxVr4k8oh$T4H>Ugk5E ziE~!NIY#Fme#IKnjCk$WqW{NXEZ~*P>za_J?smLe!%}e)v_RxnM%TM|xuoJK>h8zW zi+DCtamb$3sW@KxjgSzNep5dp{YE>(e01H9lYS#~-KpUI{5uo%WVt>v3O%=4F7ctc z#M~inMH6#ZX<}}K7Bg&PsR3C}l}pThrEJm;Jt5{UT35za|8R;vAiE92q?RiTTvZ* z+3&qtAZAHuzo57UWrrA{l1+0hYmf~x<5pXr4C%}o@r4!n_})2|;gOA@z;%=~^Y%Ye zdO>a5NvThj_ELITmENNCx+?5*tWQ&M|> z3bDRom|NM~SN8Umy?w*Tb;{nplL_yYy?x3%C*D3S93bAlvA7sR0rB=}2?6o;X$b-G z_Gt+L@%EjejuUU6mJkqcpU|;|0^;q{5(47w)AfnBPhUg4eY$4x_UW3%+ox+5Z=bGN zynVW6@%HJO#oPBM7AH8S#0iAt|BowBFa-kInDraU3UajxDobh;bkK%4v;hVpP5|VH z6i=g41PV4=&D{tT{6aFylG#rpP!N@@HpIN6lGWC0!sr9KqzXts*d&VSfqcTna={8O z%8Qy>HI*GMPJoBFN@I_RzgF1kDOMVKYmp`xG%{<>l9+>*CXmdwPLNPg+jl4gg{w_a z$Z3-YNMw~bfpA`lIDygisBClv3XINe>X?ORCxh_ri$;MXPGDpnW6!X>HmJ_v3iZni z49{zGsN#LG2$I}zbT|?L#}x8I9Lpd-(o+h!riQVU> zq@}gWfsn+C%0bFn0Wa@rZYAk$3773}(;rgy5V(ZfJ91dPl#WjDRd>^x+2NbFeP@9$xdK}_LnM@->- zexhxG?!}~YKn>Eh9%%#PH8Eia6OoPSX1d+k&izLET2?HyLlp_TO4x^y7jMm{>Y?>3 zW}8E$mXKX9Na{qemjj3L?V3uHB+2`@3E{A9h;Jk5Et073)!&cc*0*Q2LkQk&#CqT` z6E%fJ+*5@d>JX3yTs;LLAVp)rB_P$?6#*&KwjN+a!bI?ob|=7dNaouIN|KJ=S>qCp zu7LY?tFONoclLs~LaCP~@3mz?zGZlSFY$iWp|$zMx>4T0>|b?R$@gDObi2#=dWh(r z9#AF{w&hiyp92imfLW~aK`SodMNQNV?bR3aL8A-;8%*m&{Q6&9onD)hV^RV)gqLk!g9~#p)Sa)MP)ow4~CC{BTm; z6o)GH3=&_d&k-^q8&(UM=&dU66*P;R<0xsbZ~!L4TN0Ul$67wbo8AH(Xihe?L9jrT z0%{3FdhVR;f7gd4(mU$=HaeDq6q3R1y`#J+Bl8K45S?&mei`L^&eU-j2{q0zAn#Z5 z-;6GS)T4bt0JEPU%RpNUoeA(qjNW5JjJR!vmuu%z(V8db&q^V7agmudCCAQ;ywFyS z*adxHy=gtR`q}&#)5=-Lk*(loern;WTKl5-d7bMrHJJ=UVUjlIKtqeb#XoXm@QHJC zZ!&4Ez6Lg0c1t>&5}1%wIwf>5!xg%?n-jFyg|gnY*agK{Rh1(JU+alonAV$;h7ozq zrJ~K7;g>WO?YrrmKy^H^i*xy{sc5s*Ur@Tx?d{!*+&A}A)%GdwmaVZV+-G$o-)WQF zC#n};rXm> zpH#(YVizCsCCm{UpCQ;)dp2owv+LwrOGXZ#VL~HUi~jl zlFR$3XrVb}hW?mpv*bNT1A!n@Qj?5Rd;xSiUP#rlxb=xp)G`ua!V~wf4wYjTa15BD zMTmfJWoo+}=+Fbxc?SVey|_n}_yMR?iLG`_q6uXct;?oto zD4}%WA1{i;E_7nohjn7tq1KmDES3t=^CQJB)F|M5fQtHAu;Im2%UbMW+p2~6rRsT3 zE_OjBZJ*EI#z#6S8Qd<^u?w<@UHGq~!IyEn+L!1h(nP}L9T!>wcRMmR!dtEry~e9V zuklWz7it$=X?3-HbG{Goc0rTO4}qrID*OvfMFqi&_bVhx+?wyb&t&jXQoZK#rX)KV z?ChY?wUDVSw+FJ*t#cd^^&_ci6ND8tW?hxaKe%ii?>4uA1FYj(=;8-bmI`wJs85p% zn<)JhPRsoTt1_>`q13c9gdY{{ja2S$WW5Fj00I}ku$#Nd<~j|5iz$AA3l{hlT6$e( zxgywy^x!YDF%}5Mz3mi`3^1Sx z>nQ;xJMtG$A)iA2VrinZ{KZUiqShmSfxjbWy%6rHKcoaO`gs^o!Z6-12@N@Fb4mb% zO!4@JxV`dZ0vL@lt&l_Yq~u!}nK#as?3+GJtD*48B`~J@B`^}%sHBI~0F zJ(9p$Ta1NQMXu|~got}fF1%t7qgFuL~(ABe`<M!BaQ5FL3tihCc5W#L9P*8GmA z6Bd2~TF*jXPuG=d)jFov9LdCA$5Lu0)tRhTjwmR#TK}YLjjmOk>p`h^7+s&?w+p9! zj75#}{0^Yn=$y@d1**RJgsg%L!f7Ws%;DtkLnttJiMkz9^Jq`iZrZ%+XP9DMy}>aD z3OW+S<`p^;_j9CcT0MzrRVDq%$ee{mC}x#TAzCcD9<7pSGMxmXe*C3M*Q1VJu}3kT zhxy#2_F2&eOtQ|&{Ah?vJ1iGF2z2F80?Kh@ud<&WYi8%7@FAm0H^w`|WzSe-98$*I z?a6HNh-r}^#mCZ&90XwS-}9jxT_2K34||NYz6g0>v0Wn;TfGYy1(!TCiCjnKP5Ex^ zr45z1GXW1)fPrm&Fk5w!167N>|z{0C>}?v`&aJE?(L831bN zN{mq?TJ%HFqChb57a+OPP@yeLjtj9JGV^UMPA}A%2R>o`-Z>GISYa9x#mB^ZqOyik|Md)Mjyr4 zNO=#faJXF=eXr76{R)R-^a-)Ot8jQ4Mjtn!ZZtDg)pngW_zD^%e@=Zq4HB8%d`7-D z`U*E(SNeuMJ(7gAh^cN-1rjzg7o5!KlS+&9NL+ygdT~q`DEPwf2BuKWCRB1tM>Es zNVYNoigrWDs!ova<|UGBm+jWo;*=uUX;En{5^;3Y7;E2)t{v8Z-P9VhbOy3Fe<=MC zh%Lx=AP=O~(;ulre?+G|93|zUmWyfek!Zstc)u>;w~`-8FHhpDmGzvGLri5Q>0t*W zmYJPAN$ZasWIlf0%zlAfX4V9dr95nOEs#EJU!G(ljy#$6^hc7})+v?svcU504`20_ zW@Mj{kthwB{+x$snXI#PuKw8A4*^I0F{}txuqb--(S2mDI zQh12;WHs!Hvv8v8L@(^+G^XyO;wijxS;H(fJ>e^abn_)h0O6%D?QRUQwU95Nx9gQkgSp(7FTuzy`4W4~Fe?__^cOI@ z=Pu>X*7>doNoty*t?fmr+%D(XX_-1>h>||;!V34evQ-W7LfNWjNYSokwU{eg)n%)? zY*mwYS+=T2wZF?&wUK#+X|-%sm#u28@~I5$vQ=FjMEP@R^%?W;<&P?kk>VIt3`sGh ziesfXRu#udahxiiDaA7vW+zu;bF$puh<#YLsvT9&vQ>>FH$?JftGaAe|3OyuL1hn% zRju`6#Ht?jtZKbYtZIFnSk-#3Sk-!Ou~n^)6RTPuSHh~^K=m$JCt&P*;=ovB21<^U8f#+?0Dy0-oh!QTz>$YVM(z0W%Q2WZZ0Q}Qx30uGMa6;}IZ z(VTfyZJgpGVsSKQ2#BBUYR*)hRC5MgRWG$j*xS*ZS#M-sqVZ2lbEZ;pi2g5W$OrjT zq&f4kB40PLsj8GcMO0_dvG|ox)VvnA_G&JgT8E2fgNU|79G=bg^>OP)R}#eNSj0Wq z=HwzWQB@(+w*LkyGpGGXKJrlgV467;m6?aWL$6H*-&nQ| zR48b#?S_~SpF5Js&KK-`AO8#XzMuaEZ~*$^DE$u@Vq00kog#w2Dd>Ve=rHJ&EaPdmoYjd zT$ivOPlS8yc|rNal&s8KvQtpUH_w%JFqun-UGpeXFj>&mEyE<5iF+{$F`M zSQc*b>;$UmiOeQ~w#|JCRC}&C#Wy*i+U9--RI9ftP%TH+xv1K+6smT2BD_hRk zCPoRq2IAKAl-5}ir@YCA8xww@^Zex?tDNjLkvJUixmI2BALY~AI3n@D38mZ@t z#V1I*_-My3mg7HFbbS8P#XlDn|7DQmIng*dS^fyK|G-Ak%>_ z_GG<6j)h{Z+$$e}k@+Hi{#15ZFwyyp(IJtTO#2iW@r{mdyzc1YOwzhIKjD{?BtU6PT zF*>Jli0(x+pL9KBWyYo#6umnE{irvP5rAkez?`Nt5c*bqA%EK_hf4S%_iO%)vi~n+ z|4;dI@(hM0z*(wjhQ5*+4E?1t7&y9av=jy-BN86QLyw@}GdDY_Ex0SwBTSc(9W>0H zRSwVPUS6^qfBa3=@oVB+O14KnRAGm$m-hOcwAWWgdB`7dv7C6g9PE{xuv|{KqvQ!K zcjf+xgNxr$+Rk0al}n$nFrO~H<3stSrFTru&n>xQ)pTO%tVgC6$Xn-RC;eokD$dsr zD>R67{zvEubpA6`=f9gf_d35o5(=IFJbBGJWrEHxDHHJlB?^_W3EA&Re~J(zITMYj zLZt^-{+s(zDJl^ehxxy;!!dfAJBvUZd#a*HV-2VRRRx<34FunGPP8 z?f&UNf$=gDj?P8-!}}}lIaHbcp;wc`V*PieYk7jrx!?1rXuK$#e3!ZfnNCXF!Z+pQ zUzXa}(w_Tn$?Z3(IeJ80EoO-UrDbOR#*s(9J6}9INo%Z{Ew}G$-xB?~7^ArB&hav| z?Rr9x0MoJ%GDRL@EN%^gj zSx!~3$C}~1PD%Mk^^ByXa<-(Eq|TO04bK4S zPeu+J9WtvaFp$V5v8a6}k$DNQNo5VPNz>%^3-8~wTR+6j%upF2iO9k9z9b2+EQMv& z060k2Q;6TV86mI6t(W5A-EKz6x$D3xj!GswWc)WIleG!v(^pIK$y)65)RT(&WIsid zN@F^lvQs|GZV(Fyes#cDQ66T2|vYvD!%xAxflF{*f zUJ=6@BV+5kFr(A6{S31YI1IB@T0x0f!>lT$n)I83YEo4}HR(4z9~i z1`s0BB zlw)&N=&r{C8nw3MU7eQON>l_Sprnq%F|I} zGG}Ctpx*tr(qs?vr^u6<()I-K$x-~L*Ov63uJrj&V>WlxaSPv`w0-N3rOlOUx2jaR zP)DeCCr0>Fzot&UOHMXAe=GMYK6EYGJ+*kf;EE-!EG5pA7}clBla%nO&NzK>rsC^4 z;!JLoGDS#r+V!uK2-+ll_kZQaH(DkDt2YjdJCv*;tvvN;)TahckkK# zMnTwVR5kB{NYmOpy)7mk*F5dV^Z8f3hxEjm9_p8V5*(i3u6j#hdAW{xqSnaVT`gB` z>bFQ^l3SQ5N=@@|5yav0KxPLz6#f@}l3pu5$?8rxI!)R=yMeDQ;b}DCt6gq4$MPT5 z{!b*9!uW4ximh0fof0ng&&qeI2~t>%pxn>FDyE!l+R3g;NOsjyouM~L@~gZw z4f4q50D~VowtBUsX`GW@*$|(Zl(e!rCay70oT)}-Xh3BzwhUm^&B@H>keg#79~VsC zY0NK-)$ekEvJ|&U``PA7@-c)1-_0M(NxDs;0kt@j%H4D7Y26^-sTOCNFP@Swma64H zs7350@u#HK^<>T{b)?J;CAR0&r8eGBYU6@Z8$VoX?X5?>T)`oxz0n0&$Q9h2dxk@>8HVLot@+<d|h-;7l)L z@GoV~kc`1faud4vLDJtKRBaNg2#$=@>OKyHw2c5()LNf{*RWvVY_5bmNv${?w8 z&l_Do;~|o^$#_ei&!@kAnxdESpii%txX346zhjiV#{4IxK1syG;Wzb9k%-qaMLU&?MB(o=l-rL^Om9~H&8<37 zSq8h-IWp48&`Gq1q4Qs8BQ=yguN#Y@6F!mQ-&003uX0QIBlU5%I`^yYxjiR6_bvA3 zYSp>=dsHWjg{>|u-VoYplnZyu$uFJskZ;Q&a@=UOwA`8dhm-BTKDXv%yBqV%My+{D z{;JXTt*Sf8_*0zh2qVzllKiLUQALN5y@_PU5@XKDS+wnHxdH#YXmoDoad=5OwqkS` zw7qKTnG{OA+-LDZ=5A6i=x)vo$h2HJCH)0PEjilBp5%*o*v+2Qb2GYRYHrp^vuVak zr#DtUpyC@&{-oUBotOIhr2l5q@5p_O6GuFQQiyiCszg1esZKMIJLO5zpDghd=gU(_ zoMjz{w%#mT4g9NliJT0ZGBQufj?a|X@sR9Dme}#nvZJoV4qJ9yP-4d_c6d{) z1Qpf9y7qfR5@}hnQr1%<47OrrK^SbQ)f7|0V3=S9VK8%p8F|zp{E6&b{i&4ocuDR0 zJ7$&eub!?rmvvlx528^2G@Zk*%_TjGZs94^3nif@{As6Df1;QW-_f6YAS8on z`|^?w-8a}d%%S^`;`T8*v_M$XbiU?<P)Ts5?2!SxudYD#Xyz?}|KE#jc)=t%c(wAs;Ef7}Q#zF>xuvqS|QEDo- zcSS60sU43w@kdWA?50FK{EF4I)D;VpmFZ1dEUX#_3z@SsY$X;Z0-cD3VRk8@FkDX` z59yrQo>X|(2Q;l zOo8YTF!XO*Uo`7qOIa@{9tfXW7(T|Bs}?qWn8AAr@v!zK(rWTSx&mU8xULoutI+~t zEC$7!&4^s%d9IC4$^P{Vh`IeiX2>sVU{*?tiA^mnCMJy%-sQAO$7{Hi<$m6Vn%E}kkR{c` zmbz+U5Wpz$)I)Dbo@_69)y0Zx-7zD!F$#B+(;97SBu#dNte9#qMHqRy(qhTTkS|k~ zP^Dj4Of~y?d|A1R`QtdfWiIncg}s|ScJopzz7$!p+=sdU(r)uNSyq&En-8&r&l7LR zdcH=h!nzhQvBTN{E~8mdT5R1|22D1G0xKxJs!IP(=>=7Kj#8g0{f^Shsx$$E^mSFb zgp#bzLxCBT_Nr2n(le^`X-dCVB{9$Sx!=c$t!w@*C4IF^VXoEJh*Q$XEvKZfv6hm) z#&;>{Yiy*Xukk!3eT^<0+q%9-DJ@giP2t$qS8Ji9uklq%y5@hOq-*{qC0+AVlyuF5 zlyuEyr?@dspv7gUcn7@-lIJ5TG@CAVQopVSWb+SmQWre&2|l;K3FY5O(4h47%1-gJ zQ@rdHAJl%3+NU&~H$FZ`|%<7KC~gmJx~ zblE9BI>@=~6yFsU?q6{um7U^cr+6y3KVNo=m!0AQ!PoqeqM`&+{i0>@h8p3O>{k4d z|G##MYe_tDic4ZgC?HPpV+??yfH=j4b~O|br+Bq0iBnvQoZ`A>af<7!iBnu(L!9FJIB|;WYlu@^UqhVY`WoUC*VhoIxW0xs#dUqf zPH}xTaf<6}h*MnGEKYG6h`<12rSZS4|{lKgbl%@UX3T0`(l(pT(vMIGdvIDk*W!r`Tp2z}} zrTqX3|96r0OVeSswBIUK5^29%RY|1%bV;QB^l>8X=j^4V&k$)py;r3D^tKX4nmF!! zMp{|guPp6%a?$y+v>#sH5~5(md3t4OKY+50Af3z7e%j$#miCim#jv|m|-pe*fImi8-4`~A_S{e%}Z6c7=DCsav92p&}>k@nNuM1(*e zCn5xTuZR%ny~QE~`Zy6G(8raqs<#cds+*=JteuchNz!LBJ2_}(VYNuvSHmgs$twG{ znwWj_WZM!F6T3@-q9lg@oEr%kb9ysJHIJ4tcO!feN$Y6To(WY>cidhX+S=u&W5V4q z5ta>hRGE=}lFYW6!M!@E7mIelj67~+rob#_#b1W>;#{FYSL*A#`>pt7Gx!|Z;~Ns$ zx&7>DI@{p!mUz2-|T9Cq#Vg3g6Edv--gYe-Ay$7th?X+y%8j6N{qbIuU zd6OkCw6NC<2*fMWElSfm$oggnwcLf_K|@yJ+Kq$JtKs}y|?RIW*@Z-6!@kk%dgxws5- zLO8t+5`c;m+yA=3j=#)nkxHNjOj$=c9N=I@E9j@O>5J5v`5N+bbm<%qKd0;L>?WVL z!ZhMA&+Uk+woe+dUV?UG&@Y#iN8t)va~D@6?Ql@C5D)Jm*W7^KV@xb!1|X_I$sGbm zQMV_lesA07;?{ODKw)0l5w(uDU6(xZnC7ZMrC!XhVnO?K-RNTW&+>{y@%e79F0V$; z&R>u`(Sw3U{!A*D4YBO)Z^_eZ9cSourY7wqTF!5^y)#J;ZPz`V8?$~d63lCMQO# zl2zAf2ugEuAh6%vdm${u;OXiJAI%v*zJr!zmGlLDvf&ER zzjpMVQ^5lz@O>v2h@L4OD-Ps`F@&M5*42rAuiUoMiLTN*(c6r!U&=Pv$r+VXc9m(9 zh`+<={4`q`3O%W4m38lta5;j}+lT(iD}nC)@$jo-L3>9cX!n{lSLI=_NCr=SrWaCKH4&@@M%rtH;f@kPm-A zgfKq1tl@H3GkVh*u3q#z{Cd&)Mh^O9qxUd3a8ttHn()a+Cq|Qvw%hxS%ueoI?nu5B zNANrWbJnlu=#1u?32(sYsutzwRybWwr5s&onl`f0^BvO4ka^X}TX6)W-6m`>?-Rz_ zi{cH%I@0Ss9H37}ItfugH7shZU7m^0DwdH}Z{keJjh`sF@r?x;=?X0)ok-n-$LMOy*cb|&$*lD)Rg#6Jbed4$U6e#W32kZP z;-gK`PeeZ+ZHg}W_$RJO-1Ax=JNzLR`^yyxJIX2~J`iJyw4;+L_CcBIq2nHur672? z-J(>rfuRoBsyT?GG)*ohRzO}RY!8ZpRPZI1tKD46%uW(0CoGHROglQAQ6~Wv1w5|1V&R?>J((jF z(FZE@Ep4ygF3Um0r=rHZ?W_vxf;|zw%Y!rrqZ1rWSHYY5v6=R&87ccyH$*qg4T+!g$Kg!G|TOn+zujYTK z>W|$#J^16>uK2sS)PE$p`*lxps$H>$zFc%~`9JdyuIj2X0z|Dl;NNtvdO!_Kk_Jx0f~R83PQV)lx~(miA{o_lj>oV0zcUaHjB4#7Wsi(CrfLiOyL9MNUPwq_g=?_$J4<`*>8InpNxTYdoZW>*@bU z*$;K|h+>Ep&shHJH8ev6#acb{I9Ojs9x;Zh5LjY7Fnbe0$4s-$ezDY!CA0IzM62L` zG12<@UraPiGbL%YfeM5x^$ao7wh2`>jI%TIa|@F{!&$*NOJrwUm^iV;XPh~TR(5=e z6xt1AYPHajoG@sgp!Yq4$jvdJD z0YQA(Z1jxSCN?VqC(_1DtNL^P5CMTgSn2=w}t{T*oMf zN;;HtJvq3*s9LJtKQCPgLNp_9B7cLrC%wZ}vC50OP@{9SxADWJPJdU4Ba6FQLhMe~ z!$$ldv`C)axlP-h`$S(Va}>MtD{|L#o>XvS;_%bxik<7&omFCYN~atYy41c@J<*-ae)$CIWLo1rY3+x$)3kb5KTDTWtZ~qX zBdV}OG(woL>zI}4wg*z-7fpLkO)9ce6ha;~*6!ujpp3(;Gp$D)k&w`o;UXc=DzOR_ zDXR27se?zWY7>Q!*c5nosvD7q5{Zxjx{r^=O&ZKwOlo7(Q}mcrH;ST1?w_cH)vIaE zVX1jl1rL_{KARj8JAZwlNrmc05eV6XTme;VgNN40B&BBSpc#G%gR;U{Ba2Z!4m13M z76`eA-^$cHGj1KOe@65{MB-zFaXCUDrat0MR_9g8xlbL?DY0sF9 zAP7yj3F)EVDC0729hYGQ`|{u9(!pnw!9KYm>&2*b(5DA-o-+1_C(9+n2gJHuosQQ( zv25LZw8#ldD`E zV>D3G-}0O<^y#`}a53*FQIWU@cI6=B*`=UlN;1YN@}sDg94DNrrj@9OX8uzdkw(YI zcq={$5SKNMZ9U;#dKvVfEQ6xP+(%N8jk0tJ81r|;f;vGi#OYcBLaFjp7qWn?BAO~rw z#~?SoIzNm-ZhEzkZO-^n&aD5fD1f}4KTqbrc{fk5*6SZ6I8Xo?zP@@8ny*?&>l_7; zWVZ4_qbAuXwBK!Tz~6=ysk*Z!mq}ebE4K0@$kl|wcCy#i-tEvBO9^A`_!Cc?Zgi6i&{@c!^f$CDF+*T z#Xv0lv^4}7+}d}G5q<`Z?Fra7$d9<0Sy$NKih1B~wvE90B4 z2;fm#E*Lv>r+J%>WP|PqV2KA$&h=LDX zNq!n#3&oz^c<2-ibNTC}-L&}}s-#JzsiAdV@7T>cPtMJs+u+&FzWh0kZuA+>#jJAf z0~%fL;N#2v8Gjt>nJGq|JT)yK2Co!jR%1&3&t1Y%GJad=8^4k}{yQOiY*Yp`C&~0| zPCG+Rl49JNlahfo_cNH~jX)>u1|)2evybi2i=+)vr1HGbmVF{{otmskn$wl~W1 z^PbIO1Q!|9^JPqCV<_-VNQ*I**~n-Z3dAVM z&`UZUC7G^5fmzj8|W3=Fkgmv^{p+&cv8dH%M-GGhy+Psf@*tfS1KtKst(aph!2JL$HIFsK?aENT#HP~2MLOZQGr>~d;=m3DfD|PUv&d7WZ^FjrD1_}5?eGwm4oi)+$F4wXsj`_rF)xfcEuNWBD zibK?x^OQ0%Hm*+plGc{-e)S4324r+rGSoM~HqD~nu{LUx*+s6k(WtBqZEE0xWZc2H zNa)DVbk_ap%Tp@uBd23VB-D}lM&Dpuf2jD3)}5FY>TrD`C#BEQr;Qh5S6?eagCAyb z4Kj!+bY#kVPHTM~(+eQ&krOtyLsvjB~6U|C1pf@S#nXmC%1 zS)&4Nw@<~{L@W@WSg?=AODvb=bZ_!- zkMX}ib=>6qa(N%_e)r|dzEum^n&9r9%pABRW<1oRR2hb`qTd;YGoPm2m^iVCJ7oxw zTW)BoGuGTI?%UvROzSNfSi}q7d;{XX48G~*%zD=vT|bm3%!WRkINaxu{*Q@9AhF#q zfxeY8WKxLtLrL5AB?JSqq3UF$yX{7zeTm>M`X}yscd=yLe@1LpFg+)6Vrwe<`4bE* zZAK~^B`o|Z9v8#`R;x%KQI5O0Xkd7A8l5Sbz|Iq^@WjTX^=sXotWG&Pnw|HSrQSD7 zlvMbIgi>=f(Q|mL?Ze7Y6IT(Fg&FSWIoz-xrpi#Yk^P$5_h@c2|9kI48Ec3=N>zkE ztJ<#9wwgB8j$o?2s)pxDO!3{d@%rvz1ELsfAr%=EO~hEJ4ir@^P(}2QtM=3~t=1+Z zyH@onV=WQni{Lu;+=|?NR2$t;CHKNVZ@iVrTu6{ux;g=6m8edPwV4U4SH%UzSR>r3 zjWdijdCr8j5hE5`6E(*>`7LH!%UH~x{4Ak9&%D_0$al;0PvTE%Qk6(Z8r7*POw^6s z^b_fq%*ZaI<5f`dsv1P0qSU@DQi{A3KFV)+LY{;ZE7ZgSM)~FlrJIgoA z%5>PUqOR>c3HYtWz9@R%Y}Av8oxPj(l1Zs(KaoJZ({X6vKcX^84(z^nNkQ&HT- z_(?d^tTnSSu|Gye0hRq>swm)-uo#;}7`r6IjQx>B0GsF^^YtWF*AlJ5{!oLz%nB^g zSaq9`<3^^EX1QU%EoVqCb3=d1Ou0y#DF@Vy5Z>stS4S@s z2X`q}%3Rk9&=Q`>{BvlDAMC_gkK7Fndb|{rWuP#TWGB z=*2$cr8w%RUd(v0TPBI!qGceHbeL&p>8Rg=RPF-y_@^c-EB%{Cb6-I2JJ>HLKjL6AtdC)UWPkp01wySYrtdL#vE!U-qVipHW2 zCsxGlZ|QL2@5lWTdx$mN+~*}c=tdJ6r6hPI#|*Nz|BgkWD(8*gQ3Je5^5N z&`RGSp~OxBybw(s)X~IS{n5mx1Q4@o78h2$E)nU|-TV2J{X?k zVVie20=VCo@Z4pX{>m-)L%D~j6%%=fEvd+1=Ru8*uk(8C_>B@W_?}?ICenM{+PCJv zqgR~qm2++m)j1(AYuE09JTVD5$LP45dR1KFFoiv`Ta;wpKE2CTf}$H8C@@jng*a~uETU?6-cdQVn-YH(XrIV7U80yX=!n}OAMd_cm9 zVN}cFeF>z^93O-GUE|0QN5QrEMV`fwum%(1J_lQx%1!~pw%HfHbY7$r#bo+k9jjI7ntnkrqgHiY-d##i0&EGO=wfSpC-!*geUGE%qmyFk` z$Pku1AyLevw{X^ckyRAiQua^p<~BWl4F|lUKc#muP4N-;2bu8V7&q~OY-Jt)^<^j3 z*=iD1&YEsMm-Wh7v!UJ}E=gr)Uzt3yRe5Z>RYQDJUUtE0!xufIoi;Vm;E@J%>M*Cx zh9HuT3F+-_ca25VWmm7}>+B955vR=;RhKmg#(#!`aRn`R++zYn0RQHBZFH~IZY%NH ze9-aQ%*`%Y5eV*5T564v9e2J%`)y3?Skihpf40B>;vyT?$(dIbYrD}Y#xjvC?VM60 zKX#zoH9%a;o%uVk_-BmFa(Z#@r~G03R%ic>ss=IR{?j=7GC6y-Iy>fEeW!cAM4p}Q zFzVICLeE{n`KLOtM-CM7wNoAVS90KQPkHH6 zitJw9M7Td07I$6Hs2XEb2gS*CN5pd}dGo0Vx{VQ!Qjk(?jPfW2#X-dxJ)VPVj{@}W z0$X8ZcF;o*noWlH;5NdcBm#D##u|QFJCuZYPvHPE?UZC{!?BbD9!K|Y4CuR&`{moH zYBPq7EZ-ogD~&!3A&tJ?3; zlJ4Mmv{J#{DSVzd(X76>^@8$f!DUk9(W(aAUgXj0ALh}*kEK0Y!GcFCc!s#9lt(LA z@Mr}K9<5-(qZKT8w1S>TOWvpB(R!iCqcvZ(SK=euq4k-u%(zjjF%-Az5XODW-Tql; zJHUhPij+0q2Rsnpj(W}ZBIN22p2v>~SkBtz+DbpKkVZA;?np#>H&6t2uq_tc9*t}_ zGROFdX@q&CVFyWj^$iMj8TO2$rW)(<{JWj+TNbAuj9J^&qIRiZ4e-=FZgj{h#5Qka zOm3YnScCZm{6Hd$xvH=RE3YzsG@-X|o$g5Ua$4@yG$~1Kg+q2;0O52mm1-ev$?FG&7L|U1Q8?uLXmE7f=l>ktd9` zm$D>KNQ4V1EXdBj0;M~{=zK4~03rAmi`O{*zwIfdba$5E56np3H0C~MW<8A1UAuK2IZE!8cwB4o`#sz42&ab~e8Hy+%f`ms;@dqgwCoE%5-pAt1A!obmv= z=!3`o=mTXZNyFsB$^(5;_<=K|OT*KOjS7db!{~UKOD7@+Mc(ZbHEO^j_P@8Z{r zYR6Vl@cl^{e01=AvG;`}f{*A|6%~oMXA=$0GjW9CG|N@KNysHTgN4hMO7x5gUG`MU zJ-Yydiv(cc++2E+RIHqN6BvJ-t)oH=)wu4sp~0!EE3o_e z9DI27OZfMa^kV1c&XCKU#hT*Rk6pJinXJO_v^fw+y~H@9A%%p zoSeaaYNf~Ep6W?VGw9D_EGq33c|3i&;vF6AU|=28y$Qdbc`Hu6WSE@D0gwvfUn}zI z?Uu2c>NSn8Mk=hur>5}@hdvA^u3twv9UhG<%%a}R(*G|l!!XvnO&OcD>!NRPaz z6AzrZ2v@;SD)NYt*?*QG9VX#aoQ4rq$Xms6*gTL5J`W6G0|01T5pkj_3K)$GLII=i z<9}Qc@%2C_`WIwl=MgT7_kvwW2y2f<)B z&$gOpr>s1&C2YSHHAcpid&I|S_Q%3I@i9g1g_Es~VWx|20MgUr;oex}32ZY~E5I0t zsQ0jWiE<^x!a4as1t6WsekB+^+!qZB5`vJ?>IG4G{`Hrf>pXoJF3CTXmR z>;l)Lz>@)%Hm#unIYU<6nTJEgw%6;x6Y8{gf!S|AkZ2AkVqPbfdX=~+-=R*(GS>W*+hPq% zx@(rH4qJ{eapf6gxw0G%GYU$UYmI|81_`XQTyg2Qv(^WN-t|S!@{q?njIO2p_NTmZ z4~_DY+_~I=A{(6_;XuNiX7=U+92u8PGO|tJ$bG!#T&>)Zl_&KqX@Rd z%9zT2A(*{0Xm*}3I=&|lfm=*0@FU@#C~isH=!uakY8cxRGWkUC%1` zXPfGrdjv7D5rE2%Gd;y7;&$WfUzM(-8u@1Kn?^nZ44-Obv1Z&xCiMh&-6)OB_L7af z-)ZD8Nh5z=c{fxR`1QjZIkSmCnaTp!pHCszfOf8To3l8{ej@!wknl!E9E=Rf^@nm>De3ni=!z-W=ITbp8urj7Q4kYi z58uxDVvDl`#2$V^xk3y5U#9|y@m{Tp$~LaXc%O`Ux~UcuwbqP00=h(OW69UYHs)Ft zxta3YdOnePr9WQ3-Sb@wy5v-BKk_kZXug_Yic-Im_T(7}YjQn{RiOEY(>m|Fy_T2d zLG#}P?y6J2t>@!b9&mn&tdGn~XSPmUXWUP+4|(6rYejkA*1^@SJiVYjfaL?try!_& zf#$2ChUTlHhUTlHhUTlHhUTlHhUTlHhUPoXg>5VtmAub3P6bf{puN2K^{*L(C1EvW zRVT8GL3@Ca78J-+vfa9xFSUoSbP=|(li6L2^pMot?LBc(X_a{22wg z(Q>JvHrx>mSU?~xzz%KbP1NIqfA7iA8nq?S8omr|5iIAf1gWveMQX^XGg^kWk&$4L zgVb=-v-u7{YS3RdX@~{};{t(b{3YIrQ)OpM*7~z;_vF9MTYz1l2%drE_BQgdO>p(2 z=VR0G7qTA8P2rDYN-@~@Ew}fwhk1hJL3s*hliY5MamOATc5F2hk5>zd=VuDMJZ8;L zrod%)47D>EpgbNgpSW^iiQ0GJ3n_6Ul8!>oJfR74TS85#9kuX4bIS zBfHz|i`(BUo!$Ka_aWKcB7HKQqck4lD0qyfO3ChKlg4AP!qVB@z|Meb*cFx;(-u}D zWSKLfTRW%IF!B#Os+N^@g{)67sS=U>f;LYE;k(H8%Kq%6a~PdLax|0O9iIupwC1$3 zyK91bB9E|GzQM@IXlLTfGx1DD?RL_enoGhkDisXlU$|;g5ZVq5+(ji(u-r;;_D>5-mCt8d8 zUv>XoBIYomprb$v#=%I*4&)1joA#T|dnyG3PtipRM(%mh$5JU6zf0ZIPr(>WbFlOM z{_(@Pp9J0*IChQ(w*qKK#>J;QPfjx70?*JX;X>YrybC)%M)EC?2c*rD)rQ)5!@X_7 zg0xC+rb{?08e4M=XIIl6)@wh={F4VO_;GMD$0A;lUg_Q8BxF`}JW*w4AT38_R-n@R z?=#$+j_H(1M>A@yIh`!zX4o=iC*ZXQZ%Pkbq`}z zH*#CY61;%>ufPlZma1+hs^I&2S+`zQ_Xc+|tUx41RCT-`#A6Uq=0*TsIpgESpxw$$ zjo|KxQz%57eL%o5xO+7IBVoc%$G$a#uj+9V$VE7XTudHDV<)stAs2W0$VJ33f~#3} z0r+GS9ox1@{0<@)W}rooi^e-{)}O_+2y$VG1IAkKvNF)WDCh#oBgx7OlrjLi2q&S7 z7s9a@vRenp119BxS@LFPbp=qIyl99U`&QJebC=&O`}9|Q9d2X_oE%&-SrCxej_=dn zzjw}8<(xU)oI`itgQL9Tzsnom-Np4=yZo}ct0O0L^(C^JI*qxNtz0@jh!kmd{Br67 z@ODH{hn7TU-huVtOfJRO@a$A6iKSHmuDUG` zO}$T5DX!I)<7k0rz6LAmfT|W}1XNXv1D<&yF$9NT)sh*=S%vCMQlIK=T^0gRQ_0u!=hYH28iZma$Y172=sj$~xAa*F5atYs3yF$dtp6M&-Oj>zS6sbGs)!eC;nR*Ucnkt2d zs{oa-C|*i0PSIl5V?RqpC9(#&2at7$36K+CkeTT2#8dcdq6laE?u38-@BQ<+f7SBq z>c-1>{;nPmd5DKl&3AW|8UK_>ZPv~=nK3Cbr>C<&-Fj=cS1xKL&ei3lO~(>6WKfp2 zY>QXbgEWT6I;AmaKfafMiO9-t(ZY#;v#%a|v9Bz&f0LofLPKsK846pvUTFsZ(8W?y zB^ks5r*f%%Ew$88JC(WAVyk?ZN{LE@=~Aoh8nxOwp;Z5I>y3O|=d|8F{x`0-w|ZC( zT1?j4@*WPsdizaJf1Z?>*VCUr-Fka>YidSOE6QlQS#QI;U2mBf-Nw6N0JSCt3PY7I zokb?!`wxgw`BIcJx3$3kmxs>1j1}fgEJcN*aC531rOS&9YAf?%;BKZ(C*!W zr(@Da5Sf6&q~W!820z1qyJiEj^72UL;5ej`oKKDoUID0m-b`D|t4e3lcn9wix&crc zOS3jDU@FNag+g^9AG>AFcpN7ZLO?N=?T*VyJd1yOv>EC80T;=>Bz3v&m@|MQAR@8a z4(-)qU*wRSJ>lRX#hmdYdEUlw@PK5@c*R&CY0L&kFi0P&G3q`bgd(E2EbG@XNZoy_byz67-dp_g8t$^m`NiN+LH#?S%J^V z`%1!cAAwR9t*$$t&DNcMR@_QeX!XY*k?5kBG;C)aK)Yq)kZSWP@s>=)#IRpzV;~rA zBEjX1STu-qok5%FJZEidK_z^L8x?g1yfP-|FGuQ@pUQ$Pmd>dxb{uh2No5&1Ui)+D zfR3pwBgea?namjn!X>B4oUvbwvXNEQrNW${mz+kSj80GQh%U@n@RIg1XXP0;B0li^ z$uwLXWQo6mYz^VhkOAwlQ|CpT7cootJA8EbG$7IV6#kLs(R0?rffuNlX67Ta87@KM z6Tn$A>??jBFMmb2s(`$z~uxojaK{%Ni4MGaf;b&#Xp}$qG87ifHaUq;{-@F zfO;~C1(mKUiDeAdMc75D6-YGJ*Gx$zvE0ohmIX*%xj|A_F2Hf;kh=1nDXqbD`C^rT zBz0{!%o&_v?mM45BMbLb`5Z?TcLre3AL2W#-J@yT8Kd|W@)aQyeeR6peg!UtmXfuYCv@6;S^yfV$a}eC< zO~JfVKskA9=IwkAc{}H81CX~ft|!ur6_k6Kq#5IKtiU>~OXlpnhszWn_h6dJV!6j0q@PTcPw(K9y2ro z@JZd{yj=etMfjxd(VN)Po7mEu*wUNW0-*u*)0^0mNut@C*y0C%dlOrF6I&(?VA02< z0lkSWmA#2Ay@@SW0Q|d23XqEmF;ZVrYXN zd#MogrYlfjw48L5sF4l;qeJ=3eek0b%<%#TN7z{&CMgj}X*Tf;?b(Lp3F_!?;ON$G z;=?G#$M&*b|3>$K&zx2glz`n3S zlAi{G_S6_9oSJrEs})@B59>Hbi)6B_Xx5RcYMxT+IDM&`cZB`=F z2Dzk3;OC}z`6YH}=Zvq6b0-ZzHV_J~mJ=b4?zKvGA_OZ1SK6~1<=NJwnnzf7HYOb0 z4cJ%&sgO2U%tEbWrT%AQ+VPmZm(&TZUx@@ZvIY@Fnk9hoHC2 z&B)o`DAYUyruu)v6f|NA8f6LsK*hl%heRP#lw(c zv=zBW8?ZJ|aC;w#W))Qg;8$daSZ>`Mc@`uefn}8iQ2^e8YqTfpn9HO;gCBkLrai8O zZaeGrAXvfI8NnT9XopsHAU5loKAL&Jsd-P;l$WeAowYz+n$6$}W!4H0u9+eV-(Crn}>34in;>Mqe4;_pe7;Lq+8J7X{ z1~APP*ft!a<{AWU+WaRu=^{)aZ39P5*9e@dlIi}o;bJ^*8fASko)`4SH~ZRw z<}ir<%5KAB7}`^PrkZ8h#Wl#cegW_<9wqepi~-t{IH^G&MQZ$?HAE0PKrXa;h{2f; zArJ7nO4X7FcmYGvV=LRW7y-8qPw*9NwgmM@GReK;cyA}q^vocMq>a!uxcdq-upMtY z9B4v(YWr-H%^MPW%HCgh_KCQW;l+>TEZ=483xYbqMi6k#-V-=(l5> z^11Tf{6m@M3gOX)K4yCGDDuvfI4g{}**AKpi$ruzm_>Ukoq}KT3Km#vLNDT0(aC;B zb>_{S(`M0L-0w*qZM#Mp+xGZFF_1B4IERg*y{NN9G#jFH(i5y(V?=i>M4tpFLaV0# z9>NkyN2HOyWhn9}`-htnW3Y`xsDWboWg~RJtpO>}PKY;%wl^W#+SgICA^Gr>9sgXr z9v=g#)|QlNcrjaj$(9}xLNE@5kq~Y{CEUOmj9rU>Bf>Qz;l3h-=xLfgCG5Tl?fx-e z*jb?!(cKnpmu^KB3=52w!frm3%p{!Cvv3QozT@kycO%vY{xq05W#-ly`G%X7A=SLU z=F*h87}6jsCDU+HUlDc#prcV71`~%e4V|92v%JBGOlwmzZ9@l{#&}m*1dSf&h)e@3 z0BKW-4&c?axVd%MV0aN)jQqukDe4e4$;jl=<}blRb`lOE%(g3GwnA^*17SwV04`G* zJ!M%IMHxmeqO3>3KuMN1bdhA}cJV51EW=)d4|;4BB-!)$)M?ybr7U9rA!WIB8ZU@h zXI@JoEAmWaaHc%_XzNvHEzCNNIr?#ocjm`9))|*}8s|6D#976El{kC&`PZMle0{Gt z>lJ63;n{Az;tXVS6b!xMj21DqhZ4abk~o9ct*kS)&35k`incSOtkA}p7nC$4J_>aM zrH=n2M`1nD0X@CuIS9)3roG75h_L#86}Xik-7WVP@I8vPb!2mzV+co1j2{>b$R6HIbcTVUW|i?v-U_$fhs>1dcVSDUNq@7t z*gO55DtG8_lBeQ2zk%15I^C?EG|KbwTC3dRhYd8gu5yMxi~>&oX2q$aX%^X`_L@a> z^i~(>0+*)y z>D|Twq)%^(YBkMdHJumyiT;e5=n)Zj=qOl*@1g@ym0R#fxb)c>lkMJ>4GS_g1-7#u zNsZC(WK4I&&E-Yb!#c!tyXn*IW=wa)wMWqqRYw-M-gLXj$JL7tn1MB8oq`|X-Tp}4 zt(xwAou?aknK#|YsgJa^;Gc*#c9`y)|FfrCDdzuy(~T^ZbDr*d-XR}MsxmKLhl@oV zv}#z*-Yx*7kRqx*=?EGnG!{Uu1dV!0558moZwjtpwQm)u|EEEE+&+?Souu=F^2u4q zOnJkdBN!Co%~Hb$^5oS``wX`N2|m`8BWdwKKbL<}Z>l3u3Z71F!zl40)cAi*-e`&G*1GEM-7AD%} z#r_rFEX~J{>nwCzwQ@}7O+z)L)R&>|rvvfl*lMFFheI+(R7?TZ#D>?6t=T9YZ)4ix zFPWTpIr3InOJ3Buj0Y;f%mCJ19M#;0C|W_5etNAwXOE^6DnKhh<5h5QY>xz* z(CY}SY6V$i>PiQL>3RNGr}zQXbwolZr_Z-tc@#cB9@KK>`2c%eI7kP@a?m{B$M5lkKV%M5oyU4`KobrrTNvu*@#zTI>-_yhh- zymUS~abGhAy$#Omb7+kAJ>xv2tZLtVX{t75%|UJ28lW2TBf5I3p>1gd>|)k7M8{9n zn~)#*R114!C0#+n(=X~Ex{Wn!(SosV_I#tPmg{0V*!A*rQNL*{oP(ON_Vtmt*&Zo+ zF`84`Ub6;eAlut9T1~I#JHeCz%z4?Y`^4C~L7#9jBXJ#0a>dXwPVR55T6i<_um-~M zamSEk7Kx8L#kyrZ)_}5ExtSHOLWO*711@F9zn`NoBYKB%w`!PexY?|oo>zrSRJqYd z=HRVd4`=tIbat;jRr5Nv=^YUl8G&$i8){~H#6LJ}nE1Wv$_->ZL#)v18Fzlhg%9jQ zd=1fkc1c5zUa$8uz!`(a<#f4zh#^j0U^#@;2y*v)0iHID9?&h302+GAi^Yiqx%>L? zopjE!LPrJQ?wj&}fxAOdYNSu4(M0 zy|UvTW5MC4P*$}U-&|1T&R)VTx1@rNlDsX44DjfAee~1o^f`Mqsmd!@b>mSgRBy7J-_N zpqWLh8F4lyz9lscwG>^?5?(gS?kV3D=Ry2>T&hAgaVxO?+N7ibozV%ieHrh8W&u1UF{r8_QWpF>E`3;*QW_zlUG} z50nYYt}YY}cvP1);5dER5FR~b9)9-e)3u7pf<|fPj6aMY_QOK#cttmg2FErxv+m)1 zrD%q9QZz^l1_MdK`BXGm!m%_(Gv@;p%>oRPiiTp_S2S6%UCov&505dr7@`Y(BC`O+ zlcsF!l(Jcb^NoN7WrGeHEiz~*8&AjwQT@E)tDhlyJ>OJP{aih^ zF8At8_47MXKM#272R!UygpH_vY()>}X`u#O1`%7pbyP%Le3^>qvXsi~N+qGa?{KK3 zk91H;VADvdBwiDwJw2-X3t0^VWaA?<4{RVo{q$C@--6I`7?a)7&Lb` zG}0xVH4@hEUMcW@oEqtIZcx!no4e9W{tiv*r6D~lC1@n<(LvBiXk@feX(VW)kxCAV zC^ONB)mKTEbgPp7s#MauP)S2YCB3A@zCxwrY&P6kX=>@kK+SnnOJlHZJE^0iNp*w= z*(GAhrC4%BEM3%DDV+*v^T<7=2VOOUuV5aPVtNBrqRpmr9J=X3rJFX$m8qL><$ZGH zXL#jj5XT|Rfz-IbyBe@J@w-0njhG%OdJ$# z;>$hjDYy}H`2N*Sg*!xS#d0>=!OdN$EZsSv2iHi?XShR+&{tUQvoif5=qrTe7t;Ai zsjc&u(tGPtZCTC}4Ke~z>CwSPbw@?zOdFc`n$lBTq=q|XsDtK|oB&SZF%?_!i(6)ze0+_uL|!(cA!SRSs>nUZ1mXwEhh4MInpcVNZgycqiIc zLtB+oTa{ra+yiY@52;8ieJ=YgWoj(n?5Q^TcXW-?HCEr)t_F~$a#rXX{g`U%$JAMz zAf>b9XQA&V`I;-GvSj3Ep|a>aO**fTzivHmn6JPRz5?5Z4_l{dTMprOGk(JkEx*@l z+%wE-+*@e%1KsnUyl}rmP;ZfbZ$xhiQ@y!Qa0y8W9943D#sFG9uPvmfg-KkYysgnn z)#;Gbg?v3|_R^K7^|Y_*M(g!_`HV_AQ zyzbd3M5|0@JuMNbqf-1md@vIf@bu9-C`4PGtku@`?59B~QaXsM#zLcXS4|WnR|!PH zm6@V|s0g;l9uWn<;{N{?MS=aXKJpW?U=JY@ykrj|F$E&=Wx*u+Ys5%K!(Yl!jetq^ zD1QydjIApzfSUoCaBtFrg}?S4kqOh_uUXRolr&(3MtrI$M;v;k?yN;pl-|Aq&Qgxo zjJ|Taa@QcNx9i}-R_>Y>dyB-E!(*q!9c@ENGOZ)R+ zt7Pq?BZ0<&nI1|ujgB%!%i4fhdVNPk|Sxzyfvqd`#N{`rtKV%ij| zX@45v1{)yvUcQa@pkx3_nOX7*kiCP-Vbf7JzD~}95u1O!su|_OhfImDs z^4d5bl2i7Y56j8ZL&xO)5C#z^gr6^z9$W&-Ig{WkxiVwUmd>c$JgA2(3_3T93MD)1 zEHJsP#N_Z_a{dU*d5S`dUPf5X1jxGU+%K?7JiA|@ zIS-eMS7kZ1oITswk6sT{6`Tx9Ic}M5(IsAycABm@8<>vQ{m@~$MI3r(pXi)mI(4lN z8K&dhDwu8#K1G}!U^)t(4lo^THu^*?JPpGq0_?sTAJw*$H4WDRN>SGDQtrx#YkVpP z`9~{kK;+1$>Hv}dGxy?P=shL>XD8)_rLFJVgfZ`c`moQnvOoH!Lp2#;dv z$DE1`ZwX!}AUt|YG*XPLKXJJ5nD7is@JSE8Pmd|$Y#Z-pU!<$*Qg_~MU=XLl>g68p@-|-xHNksD?9Ftzs&%NpMo+t5*p0$-i z^uk;%qM}sXXmdDtxC<3!I#f{x47bkM-mDBQb;j5p=L=yTB~E;7k5dN?#w8lP95Zlj zxa1YlUx9lEN#7~rAnH_0JKOWZfbuQCzu;3nfM3pWE%qB| zEi?39#A(uEzr=U`@=yV#w>+)&JV69dpp2uof_})dHIx(oQJa~^!jb-A)d-C{HS{g1Rp(OE9#@Nrr_gpVIn2p>lYjm9OIsnIURdgw}aCi z=#-A|@tSFlPU`v7gHGvQ&fgGpIwypWOW?S&eaMwbR9^ndL!#BH>IrHLgU=pwe(shfq`( zDh;@wQfY{Mj}w(9mxr$GUZsuoplfVu4h1SLA2YH%Qqq=GX?Vy^Fra2S=#AvXrVxbn z6x)5c1QZ*0f>LY^_~a=z_}89dTjgJ!j%0GW(_$Y(($yQ@lBhQStoRpufC4{})QU+Z z2Pjaf3|D3&QPQ)L0}jYR!xu|s?kGj~YB>0Qmx}IfC^{jUXMzL~L51AjoT2522)>L9 zr(Cig5J7lW+zN0H>trlXa7Ll!7U7p@xl!Sg^`4e{*Klr!mOGaCLb{`N3#5O-2)^b= zuvC!P5rh#6kMEjJ*=8-)FPrMERg3)z-(~8yH_&8=<5=J;wIdlWm^k#@9%)MLe3%;c z`EZLp)pl!AwKc;RlQYtMvC+yGvz>PRc@L37x1IJ5ewkTUoT=vC(B^(ic8qX0ds!1$ z$ebmt-q|@&b+X;5>iDQ=`D{4H8WY3?Ap#cTt29+7lR{P3A3yB=g&CmW?79kH)2;P! z55R(hsp$rHr|AZZrW>5cUy}waP;hW(P;j|`f(UOld8puf2y;CQL~vNRad%<3-$A{x zIWN+0gP?*hMsE{T5IeO2eWJbDb1b)iI0z#m+R^Y9j_Lm$9L&mZJQf~UaEyP+h|1lFKd`qE(lZX<&ptrB7Sq3PH>l3$2-1R{!$&XOU zb10NhB{}w@gnnj)sHk3)@JuuJdQrj-C~3N1b+*ZT+?HLagkF>|!?6M!r4ng-Q9?|` zt~RQQ|IsL+Qc=AqAyO@RQNpw=z+RLvBQL!dCG-g=&M*&8dX)I=LXEHPH0i;$s1gXSGec`ZILAVF#lw`Op35yk z*82wMt~_ufd5lfPxRliUHtn{XZ3gF2z7|`K%T!elx?XZHo8AUt(*m>T0H9tJu$L~7-bKk{*@Tp1cm84q-;011 zPCxtt_~$@RmX9>f;p!6ajB!gBAsfXkda2SW{VA@phhzfqX6T=UxkP6U888d;S@iE`uYW7c5e^um|pMPJd_3Tx*KrJ?CJ)N zL|EwNc!W)6t`TZ^SZz`EqBaLEWj;DY*uEjo<6L#+$ve! z%~=@m9TBuk3n1ZWaxsrbe~=4I&jYy`pmG;y)z^amFQ$Ua^Kdt|f-w2d<_1GQjukY04U(#?Gwb;sm| zx{LYPpkZr4)hzdJMmpXMaCS|_mmO#+?s-RozsZc@NQ2txPBx}p@kSzG3F=60T5qpo z3L@8}?e%&bioMQyessM-xSD%?rIhoh$R&%_j+cE7`iUHNz0`!7tu(dK_2<;i#trv| zIWR91tbPvfa0HuJBtVNii`$`gb8@7*4!Ki@kzFB5uKO zgjJAE*E+^6e^4(v%vO!yz4&(|0X~@c0}k;IXC@YAKA+qFRiqf8%Z_5w;P$@;Y#O{! z3zERbx`TetdYz&}RnDMa;X1!ZagP;h;$hJ*tLlo>Z9zc!pzge97QF}dk>ByI5iq!t zDuaWp;|46Ae_jSA{+5Row_Rqoghu}7sq-}p}d)fY5L0HM{UoYDq zoUXF{kqJMB+dp4ze|bLH^)1}>k+w=VyQC~js~v}1Vbg;q79GJ|X672jg*c!d`+JGE z=_93T<4?SXLriY^6PWtMg*ZPMd+~QYis-Myu74K?up2jbz2#>4yS_PX*XO5peQs*k zH%77Rv3S|Pwd-9UK{HS8`XBQ3gAWlq_DpvD6xsEWQXb#MuHSklyWR?J<*xsz8_DLb zcP>IN+bnO#Uu}lg&Afs;{xa-%N;T~ICD`bA%UW!9+P3GO$=LRD|9{-}zQ^0U?R&Sq z6e{;_`wwT^$KL6QgzA4a#}{pwUXCx=NdGw;U;cEHZ9`G2!Tj&#`0~l`K+g7|QmXmW z%_{M8o$htI30Rd!>(%48Qv`X6o_a9Luc;`sw4GAe=i=WY&1_zjEfys>472ugc zYi4G&y0bvxbu%n>DSRO);1#)V#T^V+!2q#i$tuG&dg^-c{UuM+=V%5M81h?>;zV+Q z4OGRJ-~g+*=9qARRSZqsz{hanZ8%1_SQ=9$hqYv|M|DOs{)UnbTB^=60vcNE017oC zYFAeOeA+0>k|iPgezoVj7RBjw%Ks)E2U|kgZA)omb2`&#-Q0RI;>v zLOtsW>nohi;3xt`5%SW?hpW1F)XCv)m=t3bzC~U8sz^M0xLH>|d`#V-k>U8D#{nWd zjnuD5=$+{<(&sn~uSNrjV4MuSdcsGf&UVE8d~TAk@UfcSb~dV_LS%gMX)z>FeaZ7@ zlxKkH%OTqr7`_Z=Q{&s&vEAV0FZg*lUV16|>gHa0NJk~%rQKB$YFj{Rbhx%X`lYE& z>p}0^Uec}&sp!Mv!F_t*Wza5Y(Z7TL^Bbe=5x(^4rTD-|ob9}guJN)in9*>h;oQ1x ziPgReNp9iz7uv%`TcZ8U+BG##pr){0c)p%yB^jpbU^uYOsJp(ZZqW7MS&4r(0MrB| zUyn;`@e5%VBSVsRKx)o)C>-QnL4ocSD}ja{-*JX)2S9}+ZAap>fRUgBuM_7?;Ui!Y zSw&WS99*S%Grk2=m?P8g)g$KN5}^N2BMKXwRy^rvo}Sd^-HiiTxV{A5{fsY+akGbm zn0e>8_@Lp+hmrw$Zj{^!Wn&zlI8)xE_=8vDrAL)`4`WJ|cc8|di-De!;3%F)RRga( z9NIY(E}ZXCeHn*x?8>R~T`_e2K%rXllf1E#tgEj;*qaJ06FZPYCJYDl3Zpncsu18wzze1*W35s>C z=~nZ(Rf8UAI_n%X9RO-y)lv4Osk&zTGo|X1G-MrB9mQ0Js*_y`jYnCKsqu_!4)_{x z1pWvC#rKw}@jM-8Im@`W4Ce`M7A>ZsY9s8NAbw0;_cQ#hv##ST>V9Ejrlxa_fQ2Wv zubC?3X_h@aUBQoKSnzlsE>xYb>9Rn51pQGyqT=-WiaGm0lZAVcJ7g8gG}>*^bR+b- za{Mov?lItD>6(s%NNGAwLYk)I^HS6Cp_Ham)rd(=hmrlL0>xW=c#JPujM!1zWyN+k zL)%?SMMo8f(uxdvG3|R$fT%vaG+BKJ0y4!db{s8>ey%s}1Gm^=v)`)dSM{d#=mG84 zHshWt$(*JMheWRfNAYjX&85e zNh+6$!>fei?ETg;P$pbPVW-XTG@)5?L#w&f(s^Yq%*ASPs|lQnPN*rQo^9gKPM+DyQ@(;r5l`&|z(^+8Oe8Q%bWL z=l7^I72lc60SEd+j_!vQ@Hsdg{N_S_b0NmtD5d;S-&dRlUlEo--`Kte_=#oo6U(SR zS9VaJa2<2Y=s->=%j2&}Wrh58Ygw|W@tCMnZObOVrg4STG@`ii^+)?O>`dqZ` zVqfcy7Op#7b6YsD)~LIps;=~kq}GM+`H*Pci#lmtj;^EDl@)h}T9*>|jJ0kT{Geyz zesYYy(p45ghWmM@O1Bx8=~cR3VDAjv&zP&4@?rY#b`+jl-i<;r4%zJ<8vVu1rX zJlz4M|Ab7zHybGM7g1F#QmTR6#GaPu2+ZYAYWmR=Uug2$k2$$bNxI{une6>3Z;(kh++BM_T#2pCSh)Nki0>|4zs1~4 z$$W^;AZPel48v!rIa4RlaF!bYJ>h6qZB$858-0CtGs57V5l#;e<+e(Kou1z($qxbn zAsu20TtBV`soTFQT=FvO_BV!`-l2Rqo!yB_K8_=M6)Kc^J<|gOfSWIeh!X^VkftSQ zYF6Wy0zJWys6bCp*lDpJ8UaTBJO;(;}9HJX&1&&~`T?{wyVxunmMrgI4rn!MX#%tyM zQyPsEf}D!kA7Q0F_XaEV`RIP7KARf=z~G}|JU{B%12h~|=cAsVGtmk6gjXltAiTaa zKs~>hhI)1ldQ!ZKyVr~lp1a4F-=n*CZlEXc;JJIet5Q6?mvZ+wPhEnZoGlOZwX!0PoO6k#2IQGj{U=Q^*C#1 z=IZgtE?hm%_1U|6vLVjQ)uX`606o=)7gw(lV?winDUcwX7_U}ewvzaIx@`LKEQ z(>PY-BDUT^8xfDN@B2x}gDY8@1*E(_?0wJc+w22(X&N{UMjqJ{sq-EyXhorDnLX%IeU4+trIFolqcLpUENWG!2bpUNrZWyLA9ojs6u zyxvW2>9s6Lw@X$EZ)KOkrFVrlSzK!Xrg%};lF02)q+})D4w{3iSQDl4KRn&ZEsstLX}U87nWn`OyVjkYJ*7Ln zc%K(9#LRT1LdWoxsz?u1XdnD5Q-wllHp?R}Q{qa9H?-IQSQtqVRdnb5I4Ze#Twizc z)e3yljqdCoNX^us1SzRO2YOIyXAL?K8g!tiL4T5_K^<@1B0}bD^a6%S{n>^=Q-AWg zef{adsC;VbPncT*qw?|bZ_U{#ejww8o(^rmUy?fXZ$MLbD>U^@g{Hm`{i5FVvY@G4 z512o~s3-LRn~?~NTK=4g{A1(g=3Q>{KvuLNTI=e^JrIdf%fvGaS|P z=(wytD4OWe2uUbWa8%Bjhof?)Jsh=}A5|RpgCmOP=+SY?eBH|X^%zi;J=_~m><~~~ zB2#!a0mU>Jbrnxmx|Ism)2*`2M7MsBRt1{3ui4kCoefl4~TMQKZ&em4fv^)D=+LTSFp%k3q7zR>~Yj38%ofPewx1X)8a;><&o%C zX-AOMt6>-tuzKPq5LfDBc}E@3R8*;;<@9x|pR$2xGV(h{U2*5=W3kVZmm516hW5*kF_r znoYit0xMW7+*P8s*fRx#JhFL3HD@`8o+D`$Ai&L* zvjYdPHy;qnL1taSps{sm#1TwviKj~EN9IKOuL;7x_As7&oM4uI*^2O z1G~az!7-ORPzdJ+D#E#eig0e=nP9VE%>G4p*z9y4o8>Y?9Z`}|{47vfYTOP=z1s|- zb3EpC#YvOp=7S z_Ri2>=FmS(f4LdgJ2QWoM|R;a^I6Z{U#5g$-G%DWakfc96h8{6U5UGgHOu)LE9>4!lDY(dE4K`=z~){(1UID=Wz>4 zp?2c7k-$k1{tp~mSB(FMegX{%7NFqp*N{DS=n1|*pCWb&u-n_AGDOAtz^ylKq!SI- zotO0BalL&xh}~1|3Xdb$qA*;xE6nmS-0wiMqb75TFO4J45${st-9e-H)RB_qcxZ$8 zAVWlyw#!8PE)(%v&M(R#e%mF72Vg;%d4Fqbp7%zW=uepVZ^3c>LX$I2=IK&TDy5a~ zi>5MFdvRQ@#9kb?7spNdnv^)bIBu+=oAO^(2aa^yN{F!9ta0~U~xaZ*W(H%QipYL37+-|gLFOJ)b<0f@% zgKTCgrUZ`b>)2i#w-?7vrq=f2xT@0gtg>x4U|;nRnXw7bJve@Xa!l9cFNyDl;Jq zVVk}TCZJ!1d7xyC>FjjwYSDx3NKHPLq$PXHcIV8&af)@U{yD_z$UfM#mxN?>6dfQ$ zTg+-BdCO|>>gQCr*Q?O)=Gw25i z25;rCC-4D`7|n*W-gI8pgMYE(UlInwnv1|%hK3M3YpN7Gog2aRiU+9cy))L${k7pl zPC89RhYUAz(sXhkz?FY3Cpp`2UUYH?*1qZj84MbGy2TIa&PKiH09we^>CT{sFaliM z9^erZCdOd2M*QoDZtu~H4vldN9>9_4fp!~-^*~H^eEOpxCTkXg!pRM~3+BL+ilC4* zV?t6m_ZdXC@r)p>`=rD}%*DuBs>{ab=lC|j{N{p&WES41xxok?C1czRdhk8Gl3n_> zbu`*>izSGb)c#eQ_ZOUDx;N*CNd;GapAp)k&27MUIHcYROvHui=HQ?0>(FrsHTsdQ zAR%iGZVaquT8-JPx4*K$IqsS#^-%VuHQ%-a$34a}-=m6b1vyz;#94=#*kCx{X^A+e z!dNAT3}>@M)pX~ev%_{yM4WdGmw!eVXS0D7hgN7SN&K3F$1oU_$CJYkmtA3%McSfQ z8linN2csox`;0+FM|8J*DQe_7`WRb~w`Q?o{+<`O_A^p5@kU!feEguVT%NJSYS&0 z7ziPQtJN#$8;)m>K#(3pZEf1TEKGzEI;PE^b*jA`D?yw0J$x{V*640-oh;Bs+Qfk*C@k$8l2C&@tAgKa?8xCOAcctg)XSjezvl4Z(n4s+kqV%_Vkao zUX_|(+mSCBqr4#bB$!|IB;bO)AoU!WI6JtNE9r7~;#PLNU5|yhI_wP49kfBiTB>P_ zj=)3AyxNR^s~vGU6chgbWb!F6Zg~(3iz;y+zBip$6OQ_g(-U{&BjzJ96Tkm}x}+{E zBGM%=C|?`8XNasvRwd=|66~~=Ghv8C#V812lQgi|N+6f40YhY)5!|L#ZgeL0NeSZT z@fZ-jYe)$z`x^IYKC(p#W>C@k!uTk1i9iN>OBd9T5c{j6qs$PBLCltLGFJwCjm=tY z2VUhkcThg^E;gfb!EkebZWQf=2z}ac3VxnoRJGHYs``)X%K=&BMzsHm#6Jf~-57{| z@-uF3zLm_2M$Gf2a8shnE&UN&C>Nc?NzKRt`85a~euM_VcBm@iGA8 z*U8DnKSCW~(Q(r${sqq)=T68Eq>a~%e*@Baw_bF7tdsi-J|q%7e;$sl=o=1gpZtjzYQ2%+_L)u`95Bj$%jsu$WR=_P%NhBGnS2sLSQx8QpW zYH=9Er;gbYaqpXhZ`#*;@)~6tk=03gy#c!vk5u15VmaH)Q2C&mX?9?@C%#)eKrGUR z?Q#@y8#zL6q2vj47S3rjgp4>_M0yLqN4s+bd=w}>jyUf?hEwe>;a!vvZ=0D9(H{hz z=0vP~A!4;astY1k$nZl+8Gb@{3m(FDEt`xv{5F;;Wq4cHGQ6fuZ-+veSdX^o$I!U@ z6n0e`ez)WIhS>5fXX5L2=rz6sZTXu>|Pee zO9-8)`D%%@pGs!bgyZFxQ-C8%KjT)sz{?=fM_aKKkmx5V(f3&yg^}8`?V52M$!k_% zCkFvFq20?0<&;F<+1(kTBX@kgb#^3Pe3_EyceQyE{ZdMF8Ah)6S4i}`ltdo{iGC?1 z`YMs=c4*6t0a$*6iqSW36pCSg)@TPH_ij6C2X|sHGYi~_uLqaoHNoB+fNG#J3okXa zNt<^*rlHL2qs<@fOZ4kSqJt_q`(9byBGHTZrIWDTyPAcj$ys3sR=5+c@Mm)_o)r?k zZRXYPz>;>oY#=21s>Xeg=qK#JP7b@HM3*lq(FZ1<1oI1W-z_sV?a6`Z&k=TxMS`z| zLkDJFA&(J3vL}{S*tt03;F-)88^%UxOLRCMWah_>cy)X17=-$FAfb&Sc@PX;p2fr} zOH9P~y7NjRqJHD#L?u3AMiQg&d++~Fp{{_la}nz5%rg<{-aXDtsQUx@|5B){!S@RF zUZLJA)c+d`^y=(1>M_Tvxw>CV0FC)TCkVh71;KF61%HE-M#Ftqu{r# z7r$+&tN%x_yZY08K9|0OratVYah7DdXas?slLA^%zW`MAYv6I+5()0}cwC?6=4#rF zMh~WQTv%LB=)opEw23UP^x}0n!eeh`?wY%RJzQePRYt5<`I6qW8yQ6m$JokUufBxH z<)iufwc%2>TWM-Vsu9z%QNA(Fa2Arm(sbAYTbKpWetRT5`%>}wJt9n$8oS|uA7-_Y>k$+Q z-y6yER1Y4Y2#r2btUNoW^T#MB;q&9;g}4R+l&+L~8g&&YBIS&NEf#Hk(3}&muDNY| zJon!5@q(;M)S6@+sswXF)>N(AmeM8dW^F^XYO3C}8lc}+v!vmWp*?#@53B<_m=^um zShw_1qwEPTvgudxO_ySJYL|cn3|t>}d`7!nbST>2tldX%Rbia4 zP$^nh25P~wBu$U*X33jAJ1a=hJ`oPR zIOA?q$6XZxkU?uL5_&hfH&OzKq19?^C1|@nwwBySe?@sfD@n>C0R%YY^+!VQYx9Xe zCv^N+5O&@VhhCX}V{61N0T<-XaO1m$EU*R4xV{kY0%UB)yK)7bcke|!Zy0{q0aU2V z^>Fr#0ft*H-pBlvb8IDpHhCcj52EbOW>VHlk;Kzs6X6K?mY$tVW+ z*{Vq3R5ONwr;ucVF1hgk>h3QuN?rLyLtvRSoTZ4ix`4L?`6*N(6 zKoYFYE61E+MQHO#h-qg%(u_5Vk{m8oyy^!2iVvELZ|d<81T^`!o6jmT^yk4kTmuF$ zd85wO;89b1YE22=tn4BM({XNI(*tYKo==NjRs}o=VBz#DD0zmUa%>@Zi&tQ6M&e&= zj}*NYJ&$X1tyQ~SoA^t(fD+CV)gB3!Z zs7heYM+XwCOgJ}c7PNZ3h3au~MpQzTzWiU@Asqj_&ru|DV=2j)aa&oeuGGhmt)5is z$(UOp^;!*QXNn)Do~3J}!5T)IP?WG@+UhHGXS?3m3K7Bv-%pkg@fc#TX>{VZWD7l@ z*g}t>E8>tbb>&0!x`G?A&ps0`c))Z@pOI3RgEjL|-hvVr3p+_(n;E~O8Iv8rVWrMX zz?<8bqp;=q99&bYJYKRX%ywm4Kn6IS>0QcXY!fZ-2xN0rW`B^B|n2F&W{NRJwKN4Kg4 z_cfg80~IuvW6Mw1JmAfXtwx@>9(AaFU{rJ&72qoPTg(N|3J|M7=-j)o8dNT@SPi>8 zs{pZBF6ETfV8LqG1TsBkF5Iuog;#y{Me-wOnhP)>U@llN7i5=5&^Au&gp|!-FRnNX zqam+kTgqnm5+_BGCv{^p*dFhbvKb=It6}G;77M~s7Mp>asB4>ngs#NBlc;Xj<^!?` z6+7f2t_z|3N;e`$L z4GD~t#jC>b$gR=;1I!7GySW*=wlB+8`@)FmNXW~o)xJ`-+BZqbd%)um+=i;udmH!U zfj6Sxp{UWc7RG^)(WlIdA!1%U)}48=Ce6H9)7iWjqS!pTGcTU*-n{txZp;fi{*|2P z8KHr7aig#9-DRSTf+(w#!cNO6y9wrn?YwJsFfUM@m}Xu?#k>G>%IqPhjI!A`_GDfh zN;5A$6CZlj-(+5dL#NKkyx@6fV_v*^_U45Qt%G@yvMCxe`6^+~Q3R2q@pM3r+L@z@g$pdDnsgt>ZwR#Io;jJ_`)^uZTRKeVks#MS1&_N-ZVQ*;M zAOFqF4bE9dbEBR@5_05&%#AK6b-Fe>AZYe9rx_hX(v6O`ZjFwIQbq?j9z{sf@TfR< z!(%5@@dp_mm3Z<@!^7j|_Y99LJPW1k12jAyV2y28=7%8{LqxBhG)k-xqXdSF5x*m#!<%h<2WNJnq>}cFZ;yZ%L+mu)9@%!Z zy}hD4dt`B%Jp$He5553(vmM;q3BEwq4&VzkZcM=!J}RMhf|w;VaZp8Vz6KAUrkxLF zC>jhgOPXzD8hA*CUOll-I+j7J1auXwcl3+2VWf0njzri=K%o~5kJDke4;DxRPQ+*X zKF)0JrLY_*IXKIg7N#Q^bS1$-MUfHJJZr?6HZ<`K`CjoCDjWs*Y0iOEx0_`Q&|_6` zy8zOlLjdl#h;vAb)x#hO9n@lv;=7bRGAqZ~q`X>PcrG&Jkx_l?rJi9w1%~}Qrn5^2 zO@$uY)xhz)9Jniw(w`su7c$ihph2aJjOHrm);bva2mCWw&E7wwnjKdD=@hWhAJy#r z$JCX=B*B%PLH`0T+Ct*f+?m*I5U!jIk4fVZ&JU8yJ|+yw z#tmz+HU_AGS`_wj9FmX8e8~#?CJ-upC>Bdkd|8Z~%7Yh5H>S zIc)b^AHCUXT8{{`<(v=?U(A@;IwWT81as?-z}ncJ(a{2=Cp=sxt9bfVe8K{F3UQz% zjXHA2;$LmIigpq$X{f0uTC&E@TE@i&fQ)N|pvh>VEYOT277&=a;Q&pBr-LSsN9bVx zGY-b=AH}ID(B%963t?)5;!971PQvktIlANombAB4rrEcK;#N0<2R-~G;ta&>eiCG) zcA4Bln^(g7wXZ@-l^t5I&ASr+G~DPi;wPo1i*&cKWfMLI1BWi|_iT4y*sVeD(1SJK z@stFP8!je}K^BYBE3MGV8MDDpa1~PCh@RlsD4N@BMkkCgnWN$1Z_>dXjifiS;=+Qq z1ABpXaEaMSe4GD0EWbo0evoZ?zZF_Hy}b3No-e?BxjddW0zVXZB0D;?ZbqKr4m6Mq z$7DCbPVCU>85aXP893GdTA&lFOt?&EXz0;Buw=V2>Jsf|E3Ci{JGfs)^%{Ybf5Q)f zs9@MoCSiegHf;E|(+nGa{IZa7f5Ts+s0H0b|{l* zw3tK>c4ZQ+PBV$H-UWf7oC5+QqJnEAZqg>=Yyd~0FuAU_8HWTmWY|TQW{ju(1*YqD z568$`_4-zbAY)x%28Kv3|LmKLFN(Q7;Z1ZF)G1mF-DgG#|U$$zxV zg3+hf&e=0sCpR+j7^Glt$5KY7&uBm~Y+qF1-INWC&?y<>IvmbXKZwrF;K_Jby`MuKm3vO37t!q#`K8CD17Y$p_i>%%uU(qbpOEao5zyO-@Q5Hags z0!pndkB-!@y{Q!G?;x}SlEIw=v~mgGhO^ZN;B7=yV6UWEAXNDZ5V;8!h&0HGxPOoM ziGZP0+jDWXW*+4T3P{@|;2R$}MQ~n_dr@&lFSf+`VCJNA`_M!L-=Ve}@r8tuGCCxn z0=>d_4ZG^3T-$SCg^dQOWm@ba*dGz6%?!N_Rx>TO2uJxuGAfkP`g((e#d7hOvX?^cAi#mfunY}(bCBCLnwkL+JMrei60j7k+5?_Ssm{ITg-#i zf&YhI4L$VpbRdLQ2Vx$a1wOhYmnjHb`}3q+FnGxWlEF)!x2e^6O+`~+LvSLvCVve3 zgQf{TUxX`o@f2qgdAnq0GQ%k_3GM}}`uW5_&L`H9eSQz&6cDX5o-!^io+2PJy~q=a zF;jvn<jhQ1LOlRIh*ZlG-Z3Cw{8uW(f)GPfIPj8DcWEU$QY6g< zv_kl)fFKXzXqXFJttoSXAjm`*3LJzVW8oZ0j71p=n_5TvD2U-M*kY!VcTvn?4Z66q9SrdtW2|<=^J)s^F zWRcaYVjtHD`=F`}5tYwK%Y|o!dhluh?m5HIL3|88Jkn8;K^Cqj6=dOB%?PsatR8|a zkcLR_M=ywFI1!1%Qy`JA!6_ca80Ctjl8Wo2FJs{4Gw!79oHUK0{ds4S^Dr&w!VYb@ zHyX~W9)d1cctID14`WT9Qs75Bn8mI@#N`UAc}OH6AK3`EG=P$ugVSnfiDaw*`a#_z z5>k&(Zf4jef*>a-#mwL~k5Wt`FW}=wzkzK+$-NeN1xG+C_DPAqpiAL90)yPoOCy$( z5qHK|AuwCGLE=>-c?ePO#yc{xpcBwWh$`lh#GO;BzC z0|D-{yP1I+QplpuQ!0r=86jy&9ASyd+=p>B;9LR*_f>cZ2o^rK6-|)=NmIlN#HTD0 z?zHH|;gX$b@+7>~ut?~OB*QaIe1KtcESb_FtIBWk#5^)63@!FmSRzn~yqp&M6YiU7 zhn(>65NU)6cOVs?xyeO(2a;wFTS)H^hIXcR2=v9F|Blek?}&$_$7c|+K^I_lV_661 z644nLAITJtA&O-byKjrKN&Z5A*sQ|=W9xFSwBxx?!6^9`iOy{IyFL9$L{5fLf)^Cc zMQ;o-H)xdbVTBJKyrN!chLeF&CV55aF><>g(}R`?^e5T9r50V_RwFPAoTA5o-{1*% zAviPWLK-F)l2de5CVoy^CHF#!&Rpn2=V`&2f*(t8rXR`|W#vUjF+{Uw0a6zZ1=hv( z0_@h^(#MU^VTELrV!~2L#ta}ClK0V2vrdo<*iNE>vYt>9SN=s4Wyo_xi-9Uh7RV^H zQyv8i#fX14U;sHn9>_BSX{^CS0HV*~ueg59j(--p6vESsk1$mtSxOFv<2KVlq#>{! z|Gu9NvL=-d@&xA;J1&_HG6Lx!*Q#_7US69gh+TW5q=P_#vi1Y%AaO|t(OuXmm1WW4 zVyJA;=Km0*x0n(#oCO-SuKZKbM%X`tp}e>n)7B&6H%t%FVm$FCq=*O@!n(WAk?3xz z(mP@?#RC~0D#2qv>^GI*5qJw`S|Ns$o+pWP#HL{hUYIt`tCBdf zn75jZA1ZMK0ElPEbOu1UR?+|vfEzG&Iz@IE&=F9B89SMv1{8k-t`Ujnf>u8*vQwfW zJF=wFd(eyQq`jX`@tiXNFI4)-Be-8OePlQmACo`0?LE+{jxgi3Fyc^e5ZH*`!Nv6&#IS|z0QU-7M)r(Cf^ggkWvMna=TSyWb_QRR>D?bQ6Z zhy0QDq+Rm`PpOMc!d!CH(0?L+mT|+5bED-s;b-tk++YaUL!N+5?>f5_vdUg64nAo9 z$so#f5;nGQb|}G$H&8y@Yn2c|W+okLLKnVa6CvR#TCCHsL7zXAqdsal%ym^U{utE4=YRU!z6R(a6ND%p&zlKx`Vtk+@-#i~&(*UTyz ziIH4qm3mnv5^QYMF&D$sTpY!p$GN2gs9Wrk9pr;P)Y!`C4&?K%@Z7)Rb4zT8fDJP| z!YCe>+EBJ{%95QN+~!>ojj0gdi2&hrOE1GU52|abZuJo6ie&zIs;lQkU46Qb?w~K( zJ{UJ_6yioNV*#Rfnh}Q$h2CP_X}aWjO!;Ec30hdolP7)w>t^ovXQWt}fI;Zp>DrE=-&%2S5yI4ZJhZ^=IhS`sr8nId6?tHV!loZJfVG z0}JRSMc z(}FzPeFPm4Q^8NejeCKj?%KJF25j)fZ&0u`*$V`~cG z76Yg<4ygRt(UQROI1*UslBV)w??=REIU+uh_-EiAuU8SDf2W`UmfIr18xm= za+nKZqI*rd;}Q;{j7;Xl{3CN>xQv1aX*s3BLCI{mvx^2@k;=#IDjM`JxVI;64fh5s zK9<2CP6zBNibBwmc#$A3r0#H{8zmX{M$ek!JN1)sWutX(Q6c)n>nfb68Dmj6(FJM7 zRQJiaf)Q=vN%8Ne+fs=80Ds|iJv2G&P8yKbwGG;An}v=T0%+_+?-GQw_cc(AFBA8B znF#Y6Da>z733D_K6^O&|<3@-;7F^*s#gK52E{#edn|4E>qaVf|FnU~J)D>JYwywOu ziWe-zSg{#fE1f|Pi(KEL)lPwR1r7&6jU+TAB0m0wW-JvhTdTd10V3U5s|UC1NUM&W z$kCVP;4h|D32zaE^lQ;n^ff)6Tjqs{ieO~HSW8-0VTU45cCPdOIJbc2)EidGi6o$d z=U2^BJL@tM_50wC2-LMT%dnxiG!jc;#tE5oIvLLXxrB?7Bv!rQqTXILV7bOj;-f+=>bhv0SLtV-0qSc74 z-N$4O$>e1R3J@(#0YjV0@~tCMn{Lq{zn48P_M5>SMra4}Uk(VBH;ou%yGXl>cfqr+ z2Y05myJ*@666$(zxF0pD`?Gq=Qgud;UU}^gh@7Kf7ChZKIH(Wm{jxJ!V{FA~8!Y#x zX`p3ajUyH_{iEMAh~kL8$tbj)@1RSD8A@oeSMm2T)q`?5 z0x*cX1wS#0)}l)W=zMa2l6VS#mBUDv0xt7rP@*HH+6=xNj{jq-OGcrEQqS@PsjG2N zA?m>{lzOlxbjc_{myF4vv3o@?dc$xh7a(zVF&NX?C!;Xz9Ke~;38>-hc-l~$wytQ0 z=?n!C3Xh&#IHo#!p%l3{?MDNR$IN&&2-sWoqU~sn@c=J}gC7gW8bQFmar*xSF&{>2 zk%9fF^v5Vr{V|$atj62=^hNiBxhhG~VEMI*Ih$L#oJ&_!xx0O@xijW;B~v9XE!dbw&f4jBG^;Ps!od zOHw({NXI~z2yNbJt`xW6DXFcD;?`j4zQQ#NLVdwyCgfCRp-<6{cZ2nm;wx0O5>J5L zTS(Wj7LiXFIqD}9MsjK%OcdjiZcSVJI{YOkm6kiP%|dewv?$Qy;ViTu@N#k^OTZ?N zC2Qt^Drj7M&>+*bKZ?>|`#Mmkvl_@ogN0j7l$)XQi*3q>huwizXmib%F||wVz^0PJ zUd|-K)g@MF#f+J@TRhxy!K%IzHNvm6MtG0qY_nJ+j1pm~5Z{cevdL}JC$xUuDmfT-HfH4Tu(AbNHaN*}PMat^1JAr`=GmdvJ8nDyF6S(liu%~moEhhVg{O7aJ-Zp* zmxo5D6J&eUVdE4CK@XQ|pRw+Qd)`D&LhdE})RO%4PV$pf{mEb7OMZ7W`RSzhY0y3L zAslN!o0H`=i>=x<(NE!JV-xP~i}bF!R@TJ4#$A1J=M0dx%FPAm5bE=ACV0~tYxeU| zeu|NKyQGl2Bp?a5W*=v3V+%GbTLL6$K#|9A4DUr*2BAMY0M#2qLh8jEI4VW$mpz$k*2zx9beIPszJ?xeDScf=UC z^dU3;%>V=wil3oBbtk$Ic}*)(QVZSmP#Cmtk>{e~fF?D{aJ2U1%eIol6bm zEYHwL`FKN2XBLfAqcl>Bon=Cjd)mmU*`UX>OPShk=J?8Jd+TKx`xT6f5YO7Y8*l{_ zjXYr09@gePsr1qHZeP7DE2)oKlKO~~&jw3SIxTpGCkzLn-U5B1d zS(26&X{-53;;Xo_;nw7%y$2?zO(~`@+j}5miHa#lN0kUPQ@#a-gn!rb!lIlY=g}(( z`Uxzl1IM@%K5}YI*#zpRk8skVpP~`BAJh_z2(6aI{digRI2J;DdrJR8bX{hFNi=o} zM<7T1GVT;K`hYTv?&(tFY=Xwwh{`NGfPC=Dg?Q6;=2 z@=|A|mmEUq?U`4i!xiMfMyQPj+qnqCK_SIJDJ_YhWz)rYk471673tYTB{U8C##Bm( zOY|A)ph@^H5E@+HCjdt9HI^)wO6C{YP4RB z)~nHaHCl#8)~nGzNTb05@i9W!Nl6BxGi}>|^0Nk*Zzzpp{gVd{zSfz0Nc=iDe4ZO- zR-20K@Ji1IGn|!8`$0oUlNl^^+2ZEKZ#v0djTW4)IJ4vNaU?#nk|Wu}VFT~(-aG{Z z*@};J(O~$Ol&pyzKTjL8URBF^b^a)76M(>ZL`o&X?AJK$|FQQb z@J-bD-*~1;p+I2@6sU?)p}GwqG_*iN0Xt>VP9y=8Lp-?e6#;v32yP)QbR5EZ;kvFU z-stWsu8N3&NsF|ALMg74Lnx?7EXpaj^m%{2b0jI{aDTtw^ZftM!@Sz$o0-q&dmo?q zoIy8;6w0AORNf?hD037P_Rf(xWom@x2XQj|Ai^>ZHq=Mq9^yyFn^;dw(Y_A3j4UBD zl_9Ii8g4bL;dbg!WDVC>wT9z`Pf;@XcH%bG8tyA>kbPkd*Eg#;)(XmUeU@x_2mUtP z_Ui0~nnS{1Ob6;DVagEI^I(I7~|91y~w3c7U^Bh0@q0(&7YRMDJ{tq4h~{0Ey>uwKHo6>&h556MU}bI#2uUY zPby(;7D6+EVRoL|=J^pm^997g747>~yZ+u8GJNzf^NOvoWr1D)d9qhKt=jchYNIIm z-=rBA!JH1QA+IN3yOEt5OiV1dh1#k8mD#C1iAKOqjTt_MgmrLuN11gKHJUYUZ(fwJ z8uTQrdunU?hQ5P?*KEaWO_2`|opKCbx!{uUn3TryBys0q_s@9Ia7x%r>6O-(-U7)bAy`!8r;z`o*F^26#$x=KdN`*UxQw>i zUacvBB2|j~5u!qS=`HOed@z56Fsh`)U5C{}jjNsk30L(v9N2~m!ii2zD{TR5BZxhMS_dn-GBsX-Xg#CxWFf<)R`G>T<1>Uc z%YzGw&5%YWFcTm8>n)4YqdmY@v{GZ$vUgnS=$4E}Yov}Csbfa!l#x1Xq%LZy*!e6G z#-mMub!-GU_zNX7GY3S?o&ryH0YSo56Wk8@^Ntcrb}Q-$3qG2&j-WqB8h35BiCh)) zia=c~%4ga8tvXY@3G-!&ehW{72B$Xs9k&dQ7l~&(9n8D6h`P}!uZG69?r>tHsX$EX zD-G#K*Eytl$`zeGUUpuoPNLpMvz$TqkF?_pt7&&+W`N964RR~Z@8gWoFdIJ;jKc9b zdNWOwcjAD8w@1}&f+(Lx&TrOA<<<}=bCZM~60fnbIi#b->3Z9(!r+io0oJA=(zkLJPM z6*W)B@r!PP*Qc{w?h~S!c|k`FG-GIowOsJ{s)Z@No3o7INSpjRg?Mgyi)P-Pnr%A{ zEI50bgWwzEn=^@^VB5gwlojRvy1P9g_xzhQ3RAFKXSP4QQb7 zOl|EEnB=SE-{%eW)KKAmVVE#f7&7es!P5LAD`-k8iaIR3XtvJ%sFL{0@OTa@}7+vE%iyK`l2LSkZQtw zK-EwF8GbZ~{Bx}*KN?pg0vRmaQtCutyUU0`?6x2PRU!}sVJHz;fN4Z^`5i={=J9DI z+J#!F9-ok?hY+OB2O+4Qed+M`XNWJkNkca9PaW(RghWmGshm<9DhYEbr&J6O9CXP-XQd)a6{XOI% zTY?&SNHzLBtYejr>B0X2@{mgZo#Y|gFw|ENojhb+s*{JTLI0iPA)8!=7w~xWE)`)={2&jn zYe=t79#XdIDW;N!@1TUsNJH8gK^npl(B)*I9xdf_un6D+3TvcZ;*h)*28qLVhA;5z zAPy1eV+K5FG2)OWqe>joZ2M1%!~P%+LnE{WsY8?#MjeVec}UGf+dv)Sd?s#4Jv1U; zNY3*>CsHl1NGFOmgHXg-{(UuVD?})|-eTu|7`aH^*R>ESKoY%U;XUg&J$e}-61nJl zk0EwZolbzrG^obK+HtQ@Jb}TW8lyqIs8r+r|3Rv;937$g(+Z&)X};=IV=zpL?s`;G zR?-&a&;zBk@3@4P0Jv#j-61o2==4`x1Qrm^d(U~OWl(^XP`VMmv?OQ;XaNM^uS8}$ zjHC=;fm1l*8#Wa9ew$?GLN3TSWUDuva=cBj?fxJxJ@Fii)H18H8;XBw5Ria`dci@K z4>dv{NR?6OR~dzfn6etTWfq!|_tc`hwGG)}M=ZDHcot3{`gHn`{3xkRg1S_qDAxqN z)4xm$P4&Eg6D4no7v)msdY`%7pGv;>H8=g>3U0}TrSF$@Sf#4=tIb>)*uvH6R)st*f!9Kt-(kf(mDp854Q$eYWn!rdf~}l6Nrpjys6&xF_#3@{@HM6eUelMp53)T-$)> z#$uu*If`SGLOG5fxJli_OEamiXDmI^8?BdczT-TD@3;wkN8R0*%CWQ(-;owx7~heW z5MS5{p9tpy^&YqVIA7QnKf!l|W7K;1j*o@#9T7{G`2$q>j(T~RFn9mgn2s}ud-xwR z9aFB&bo{1XrXzL5m8i=7b(xM;)RBzoSV1X8rz&Yo1bG|uq6KT2#&o11zXDYWCS)}6 zDE)ybw^C35Kx zY^0MAh}A&RXiBONXv$c9yy|5-4hUsB(n7p4RY@I(O^ljOfCdQyrXv-lQk69GRHh@r z7*r*je=1eEAK4Jou|2pv1fx-v3Trwxood2U*xt>r@`te=Roe1z$l!9;BaIJJfHhc; ztbZ?~ErW_E|GSuwRFB_DWm13k^IFmv`;m>T+98^fjp}B%9zC0Sg3XYk4KX3#zA6)v z3dFu~r6C5DNwv7<5MPDL)Q&%J(cs6`PsPb6o!&tjZ;s7d)rp`>hWzkj>a@%$LmFsO zvO$oNAz}zPbP@14hSl;J&XUhm5{!>x;o`k+R5nfW@${x z-WGYY^*oCVEUb+J5SHgbTcu>*hA=c=8^M9gdCw)#ULg!gw+x;AkBI}FIi>TR%<#bW zE#!fsd{k{IouliifhxIar=%Ti{gLqoArpi)Rqf_HzgDHd%gDd8LEG`Di%R8Pg(HY9 zsGPOynsVWDf)#4G7g%JP?O?U;(#f$kz-OLzbt+FM?}A}zR-=tD45=1X_o|wN*sVCo z5od{^rAwNpOhjA-aAFRsdc=?sGd9dYMw4y}9IVs)tS9^9mm8UQ>xHC_qG@as}5D+dWi(I6!elP{^8Xu4D-$Bz8dE8UkB5SErCQottR_;?IydM4tOpqVHP- zG;0RVV6)8P*iLxq{&R?UxLBJ<;haI}QO~6SHLUIADwP^faT3m5E*-{82J3}7yg_(^ z$97NsUPn3{3+Zt0>y{2{jKy407ZPvMj4mLYJVB1%nSeOuU$AAm%<($}#MvO!PJ{@E zp+?Ram7v#XzFjULZU+HzyHIlNMdt5a6A+)JZZHJI_tpLf96)vDk$|`>f;>Y&OnHWI z0L$DIv+h3<5T6d6Pfl;|9+JI`35X&4K=gMqO1VfzDL*2ZQka0amKV?ak3v9vMrZgy z__y%UI<(qR>~7h01;nRWOu_STn2!uxKnoQR!!AV=5O0HkxLaCJ5)hYZ0^*%St96^G z-PAaM%>AfJtDWxEh8(t2rL0FO=b(U?xrc?wt{PpZ(rW4^pwnt}l++av({NvbRzui= zdIZFjB{+ao2EB0`96%yFWX27|=0oek-~iGSop`%~fS8@B8ns3>0##%Ph+!m!7XwW| z{L$qCVp>aArqyT~XuJdBGd33aARwkzU5Nu&4YY6$AnRD=V|ws^fCEUS|4!PBXe7)w>Q!R)ES9vCGRlZGc2{#EguAV7!O3J{43nKcMFLbgeW&>jQAy|5i%YJ&><$qTuDnM z8Rn%Fwl`CmyOIKztOR{_NtF}BST!YCxU^L$IK->GK&C1MRi+fd91n(S1pW*GccbL$a`PoMd zA&iP9G={m$CCH6q$PesR-XnoCC?SNXGTLwjt1<_{BB;@sg9tz*DX}->aNO>)9fWC- z{EgZwqS-#7j~=4@4H_;FS(y$d0TUqS!NhP|U?I(&5C$P*HaZ~Gh9DWw!DNM>{T9@( zF56ZkEDX9eBw$^TLx@l?-fTn<8sCDV2mR=_eF>W(ha4tQRtW}F1_EW&Mi(f*039}+ zI^odhzzEQf7Y&K>w(H>yV&C(jJ)wf-Z`}37Q+6P7FVT-`JY}7Jq#+B^S9R&fpinu4 zex$M0A{%P-qo3$UW_s+F{h*d~IuORkOc?FG=K@)wg;0;PQtJqpiFjm0ofEdnG;JFZ zlMvEn5Rc_(UXXZX%TebMvY4v5H@k^=Ox(q2#~HBOWiMy}ie~Cu4P-SKqr8sNs(v9O z9ghb|M;1vJCNv-&wU-}Q7^x9kdCyBgyPR&MEnfJPi7VS7R!eRK1riD_#9ws=F_DVz z;R6g}YFF1#su9a^1(qWwE^+3u96R?^X~uSpW+Y2fjc9~zVo$NSb59}~-QL($AR6D* zIE4t%$+|&AKxt7vuALDe>p?WSl3AmPXe9j-7Gw!jBZ-r>UZREaBtBeEf>Wq=LtHeE zd~^jvQC5jZ>USa@LnO+eTwL5Xk|{SPR$+ZI<;F~=+_-KGp-KcFdXkBh8=VkUX?X74 zBv{_0@?Ld%QVk?jFFm;}gr2O`0tq3K0?p1VN|dioPqHmLjGi3%pDP?{^d#kZgPzps zN$QR3rYDKSQRzuK0fW51cw{1PweGWS)EIws;$NMZq?lJB+J=-L_9!ZVmZS{55k^9o zSs-@4a2I>d7K27X!g;x_W2gqugb(wRA*zP789>TGJC$l#%=F2A4?RiC>&o;bbzFVK z2k1#^eO-w%WoFQmYzl@;lsn*MknN-D8-dn-utKN-cn7V*7g3iE>q)_0ile%e6!w-- z#|O>9qj7v=>!Dt(nQ3tSSl?d8_50t&>!Z?tCq2nF3{}7zGIWN%A!`rFNf9x6|9j|3 z_59Q$P||FsGK^P*D@c?t8`7)LliCr+h)Ex19V8~{6u{0;1FXp-1*Q_^R$M6|G-U|u z0|ciL=?;tKLmU+!GR9vwI4=Q3Lu92WyH=(njE}Br1dd-yofrxB#Lalhh}#)#b11DZt&d~bXZLQ`gwU_qIs^Ze9l%HGQb?}Iu)*%lkXH?IphI=?I zG+Uk4ZJHkeVGVwQt9X!k642O_4(kqwJ&e3G+ym(3B~%w_*ASJ0Xk-AEv=PLqTv(@O ziC}h24((FfqYn;!kfDm9i8N>QB~4&*ZlhJfD?tu@P$MykpGz~yATg@}4Bf`j*r92+ z)aB41F;O-NqBn;TnOgWLoiz#Sa<58V9wEM*Hnf3JC`Hpol$RYrw#snEj@+fPBSo3* zu;5s(#xpRNc+UWk^PsV)dZPUT?|B;!bh^@|NKx|w{Cuw46Ba+&AA}`(C zZ-}G@(P-zSe#LFO!d&DN1p0Unfj(UJgZzTo>?MzBl8Z8l*%5YKm4F~dWn+p_xe^T_ z5|esCk5Q=#quDA5Co!ozP;(x&<>QeVqcg_`BUPTob5T8>L~b<5%>&p~(BK2U0bUDF z#3oO~=7u@}D@lQoXT&D226f`qpiaChn}!VfoF<$;p$Vri;JX^?jeCg}MK~vfbowz~ zYP8>f2(sx*wpwSSGr8dXBBIl29FR0&Vg0YibQ1Wr$H8nvNT+RhUEV5im`Vrk&W+Df zqMvlwcV&0f#O^dm&A=Siq}5-AM0NT(?_W$>tsf zDY;P;{xU)hf0>`-RBSG#F|1GWvXLVd4U>Oc7-JON=VW4x&T%UVwmOVaXPx+22zrS( zqH_jsl-k8uk&h5>Gy@;-9)N8MjL}{-Sxy@w=5Ez2XNWP1Av+hs8ErvGWIE&I=$(l& z17;2{C^nrn$~-98kLENN_)lyGZKz>}V*#3~9j6 zDS#o(1;Jkf(pE0Ocp)F!->@rH8by5 zNq5lAGdv{LV+6e#^X&i6l5VwqHzeJRqNEMuhNPPvX*VR@p{CF`B;BA}G*f7mn7gVe zv`W2|Gkvxytf}9_nItkRgn*-SJj4`QJ+&BPAnbGxBjD(4R!?`z%-~EC?hQ#dIIH!W zLTeNob?g7@l5Xu#3>C25kaR=A;fAF9cT2kKryu|CkaVkU!;AfD>=`#C-8UrNoxS&R z@*v_DhG|Z+Q}~9YJH)lle>XizJ$ysbt#qzObCSrKE7OzIaW^F0S<1Cs>kw6VL(=_U zk#uW^B_ynxlK%}!_YFz+e_7HUPF~)Sbl;G4-;i|QkaXj)z9H$pA?dy$>AtED$s3Yx z@*!ETiO>y6_y5-=-H9aG(7Ze%nhcb!9O+JZv#6?KIX@jY{>@MJuDxZOq|Bb7$n+8n zbE6ATKr{ogoL|(c5#hu32VslGSqhw-udh&B?e>1K>~9a6Yi^>%rP_uyF)oEf_{VFS zut&c(gsN`0(=dJc#i?Y#qts6zVpU*rd zc;+OUc*ijgO}c?Z*)fN|2As z?zSSIwTX&j%A7mCQw{3f%7Ov_Lw^Y_M%}5ReUppAKFLd;!d)n$EyowXFwuhi^0ucm~F65Y947 zF#rMSCyn(@@DA;g^Qt6yUIj>TGUP!o#h{CzUo~P@O=_s>n@c`l25%e~1*M2GDWkMW z84+7siikHy97UU4h~mc=K7mY8yeMz(u#~DxP1kyjg{p!>B(Bn-WW*sX%Zz)xy*Z5U zWWnxp%T+Eu%g=lcxYJRkl@gz|4H1S0A*_`k`_N7Cj@!!}oX?@$)7BV2UB_02FOE%e znP}Z9+P6c;`5Y8cms9bI>luseKGNSCyY44?U9-k8kN7Z*(F#=tg?ADpy2h5R_*naX7#VVvVHHa&d{(*nVhq7Xbuy^r8YKIkku2IVw|!Xo%ao5Wt2x6k=qT)6~Sy4+!e z_mSZCDZ&LHzVP@(3I}?k!_auH66TxFK@>263kg(rSm?@aB ztFsM3fkxNFvGwebd*ZPZ6C0rD-r@PTQ#7a-C~w6EeRAASq*(}mB!~tT_!AyT-l5+I z@{yn%y^impw?=a~Fb=o$m0Qyq+Dx>IKr5G4H0EQ4OUbLks)s-pB-GAF z1h55IXT#Yysw;TY8_AAA8Hj!fk6WLljfmqHw#TYQC1+5NsD&bzS(pPf`)Q)4ySy{b zN!}U1A;4y;xeCg|M=qSVX7G{ZT*Xa^eQw!>Qqg|MSKx#eF5csr+(mje8Z*H=k8$VuuQZK0q% zwYd^^77Ha6fk9`v?3>(t#&2%;jg%yd~c_ysDudf-qPI;1&LvomT2Nw$hB=7!*FhxtXTfLAjfAt;kvTuDgIlmmtNj1bdI z>XJkiX-OusFrN`vlInfUB+ikph57XLiot^Pxj3I>EyoD5QU;+Et(U2HppAd7yXH5iCp6HM#dmB_qgb%+?*fu&VeAE!i3_G#@xM0Id!K*5F%ek-7abrH5qHC}ql|W1%avJeVGg4b0P9gu?T$ldzM%z% zz?r4ilh^{_>n(G?yo{DABCb6t&x@yncsM!)iw*1X-Z(6nS#EAKC?sr@1qIZVfWQInMA~N5y=gffV}L+5*=nUShlHQ7Oh~6Lmn8dHw|vAY|3*hJi<9dZJ;0lS zts}Z4oVU{nM9H=S1uqmt6Mh{NW)xLz3vVKuaIgAjrtj zEkbDo%~Wg@&{4hiMv)g?Gm=!t)$Kz*-oZVY18wD)fmvM~oYn2pKBg|q??xvKnlIti z2>v;Y{Xl!%(ot6ABNKfBG1E|E@-i{X<7vW zcK~S^3Tp)@i)jqb0#&c|$p(5V6Xd!2bYo-vUI#!I;NOM+8TfaCnk~S8H2!DcpDtv8 z9O;LeiZW8sMvB&e`ZU%^#Tlu#M(PcuCeY$SS$pySGV1wv{8JE=QvB1^1pjJzYKqEJ zQ&gUsqVm)fm8YhtJT*n-si`SQ(GbkR|04W9fIirZ|26pEj(@sZpdM;@YKqEJQ&gUs zqVm)fm8YhtJT*n-si`ix6K3V&7hTBKWTp?}Qh#(AKPGpKb`M=q2ZrvLOkKw2;#RHGEF%AM#5Uj>Q{T zFB&j9)(e29i`JW&TiP7!3aNKrm^vlKz2bgc7Q|FpUctCfMpCN!S6GJ4}ht);CQ)_o}Q7NiR1zTK;}fwkO# z(aV~w-D$(HPNK+Lky=(*CbluKrWr6g)>m5p&|YZfLb2iutQ`i7j`gzEKQ}R~&_2A$ zz+IOCq@ULfXHLywz7#(XLVCcFH|7NZb z6N_favlAm1-ezEZPXM@XGwE0<+T0-bEoQC^Wzk-6OXJCd+ZkBB3>X7Tt8+ZVnuda? z)W_n7?u-v&88A9l6D^|JrZ5Fi8ICeh4z*=d*=vcG0 z!|skStmpwBeRqd}^(O;H$NEGo{Z5886upH%)8qbo@4eH&T4%uMSPQk%|G=iM z|A^oA2Lo%d0i$CL)k;qc!zzk@cv+%>^^gIhW5sG~$I7tA(I$_p+OsR!YGB=L!01@t zX1y_`rd>K4Sd$GH9m}SbeivZP+z%So#GhW?b(ewF(}2;j*l`7nE)45g4XfLl z9UZzDSPirqb}{K#D``35>Wcqh4Rasr@OW1PYn1_`WBrLp23$$_57w~bCwpy423C;) zqhk%w>SSYBdJV^YdT6-Kz#3w}=vdEabF3S~+Kc5wGs^eCHhVV%>jeWw#~P!}v1Eot zbRA*MeW>BD$p+RW14hS6(&ku77?z_`!-5n8tA_!jV?C;s-ko9TE2U?k>_m41E60G* zv3hHz_h4B1O8LBS)zlsaR)ztiV>QuA?-_=*DQa`yo(5KP14hR>qRp{XhElVx%!V(Vb`P^<``3)Ey>q%{n^byD?N>2b<@i7P3w`7W?-coFgjKvt@Pdu>p=}`N7h~b-Ub$L!01?2+8pb{ux`_^ zn(n^TppSvI&w$afinUeHH>`%Umz^x>YhW!gV05hewN-F;SPciK{?y@a18alPA?wYw-m<2RmjyGfH3I^6#14hT{q?Mk*u(oJe z`DsOOXBb#E14hR>ug$T3VOVcgw|cCffyKyfJnv`JFi9(2WLWx2dF?OJUx@}*4+BOo zt5#bD4u++#l#b`;4R#n?TbnU#zVpw;eWa`7? zueD#5WnkqQFgjLWZFNfwi_Sp8dV1u&QzZjSG+=bBrdqq43~Q=}#eFAqbQ)MK4HzA3 zowf?@VORwk*3sd24Zg>~Dm7qqti{?Y=+Cge*07S}{=B%qf%S|5qhmdUwLzB)|7LET zhBa(;!a$dSHO7F^v6^V5yBU^V!%vsoy3lQ4H8)^%tlioO4q#Y%4R@N&YX=xu)dq}? z^^Ud*28Pve|M>pP2O3!K8!$Rntu_{e7}iugC$eov)_dy)8Ca3pJRB69QQBDC%dpmK zSRX8SW753_7S)@sdkw5*+8nzNcg>uR6*K3psQV18*9{oGhH2Uy8_ck3&~B<>3;u$6 zuz@8QFgjLatzAPHR(p&mVT~x=a@!CCE5?A)v36-ANW2F#SFV-y?aW734>hnT`VCz} zjdsb}2og8W%yrhvdUb5Xv%?ImKN~Q5S;MtCc0a>%Xjpyr&8fNHz#3`5=vaTyN*~U! z`e;~7U%BU{;Re=S28@oiQyakt!fM!O(DNw|7+BvLFgn&-+8lc@tcGijx1RB!f%Ojq zM#sw2<{0s2%$#1s#YIhCf5^ak+=`QWvU<8A~hjGyzoEj4+jLGeiLLjT!0xz1_hC(OEX7F7FD+0$oU8A2`O>M$%9a6G9YSBKPcyDnJDwcDuc1|3yj ze_l`1em9<4vHu8d6ox$4JtlYDeT#4M~xXjK09a1q$?MyRx@lwuMDi$@H)Zuu?U}HSI%B*%oTITG#ZsR z1CoUap?PHF(spEwh(47@^#}!$#$5+c-JGUPXIsuyGrAs_dWI*wc6AF5@33&#x-GdH z?0wT`UZL6Hd0qymx9S>T^)~EUIAOy(s>e0J^$oiFHQ=-wUkj|h8ebD9yvEl8*K3?| zeKo!oSba6VCQf*b>wwptZF+^fU(bRG1FD;oJ_uLK=z3u4Yx7kLuCoZjV6U-Y!eB33 z2zuZ27Hy|%jkMw>TPpqrgaOhGpVjxfvdq@Wx<5yc^RCs zV6F~UU&DHgx&}`8U|tJcAE@rv$X2WIwZQ7D@ilS6YkVzmy~ZimSL17e)mP(d;)K_@ z4tO{vtdW7C(=i-?(S4@I>I?7qN4t#cGJWhHyT&KQ2QM|Pe)dR7VGnFc-IKeq)ab_J z7pmNtY{=&B(q5NC)nv3=mwm;Xl17KB%3KDZ-AFej`9jrYt^`*AxUR`0_6S~^kras& z6mrGK3>w|FTQbRFjEflJ%`|p{ev`r3?2J*M-y>mB|N7v%bthSYaVg+}&H-Gc#@?bT zu>6vfNt$C^{Q-9qV8&|<5(Cbb99Av~^JW3&8Im013c@9Ywc}MhdrO01fcRkL_8<{W z@Ol)XsI4mZT5LYFBTC*5y9lZV3rOwUaX?r@d@E?4?>GpZO2L!LIia0D zqEtur*txvciZhz@@BN44bDJT7V3B8zk0`bIMwHSIN;7cbeqop}R2VYs{=t&x$Slb_ zHDQJ%?{Lan1?Apo0bMC5vtc{ngi5p1dF@q`&<}w{9MyARNcDv3%C79?u!0O@1qj8U$URcJ|datL8%tL zVuw~^C|MqINr$1PPV=fHDiS<#z&LLAi^b6~H47!rhFM{%n){J6tvic}G%o+ZQbUDdG$`^9FtvcW z2$aDei*kC-TKEN9@ceUH!;<$_d}`6W-CQNVO6+yXWsWU%7M;iywHvkije+cjrI-GD zs0P64H%3U_EJVvIi-dz`D4S;gv*uCUsdXsH{bkE>p?0G~P8K|u((~R7EJv||Vs@gD zXqs&HoK4SL9$19Cz~C;&c&_F#Jczjb!Qz_XFu$_0{n+#v55RotvB&Y zOQ5Dq3iv}4`NHMk+`Hs0Zh52AYiWe}7w`0DrNiLjDU|Q@E=tF^;qDBlG9)1mzXz$m zV{E6f*yUvx0fj}Dgs3dXkgVxw1mAX$c%Ng#{ z75JK&C@2GyL~fU${HZMr>K2^BO^1>d7a)b!P~!!+d{|HhSePN6w4>T##b1@+9drpc zRc?7wl#{zZMo?zPIh6a`I^-RQ@#?Ub2y1B?V~^eIkVmx@x*txnm*Z)$&7NqidC^)0C+-ad zIjgN)CZGdg&t^ZH(@>EAgydO0Pjo>P>jE`oBRT?ujgHB*$jnW&Lm3t=+RHG!G1TYs z?wmHLMvQz8E~wdMOm}F-J8a*>F}>oY;c;67vR6bx-sIvAAQmy~)KqH& zQD@2!N6}jRG&%WxFl=C<7+2G8mpsA;Yn)Qe@<)^_oOXXsCm0pdD7$2YY%hmP@niTQ zVE4C|e@tY9Or4U~6#}ImDwRG&DxQF|axva3bHY!dX^Id!uv5cg(U9 z&0gVs45vW_>C1nEu)EGPJ8*t(p!jLDk|-0@Y9%5fTT!^%4kHs*KJRIc^4xNTs4O*6 zn>sBebvuj{b(sXa8Q56T9jud7sQg>igCkDeY()ew!3lW=C%M;$s=>+hIdlYNgd|Lx z+%RhxT8=aV@VQ4zUWpF2WB8`uXC<$giW`n}6jw~>%uW#25a{o`S@1hoKsV)&sZ(q2 z3Z4I$Hgpqa%rCI7qH_A;%5bdko{4fEj zG0!E?Fl*4|l$lHZXB;&{)=F^1!HNdYD)0<5j23b#o;#IMiLj-K!Epyy)|4OWM7=G^ zTSK|9a`f%4RPdp~b!(e3KrEDcc9|18T$e9-Dd_Pvj39z9?Zt7&~0k-Sxh^LD@R|ND2fs~PaR&=sQ|f4O5O~3DrXH+gHzRv zq6J{ge{8)2qMZJNpr3rMMioxw{#00}N|`umTew3`+JQJ}Eq*rVV9Z8 zEUz3DbdaPus`$c@WM?GfhSvf!uC^ORWyr>8#kCQg=9XZ$3L3&~ugQKA^hPycHX<@( z3^F+E_NHu5*wV7Ib>@;krq19!Bqwxw`%$M;7a~ddPnODxs_~O9B-uc+q+^hFiyBN9 zx`CFpQbcRIhM)M9)3YJUZ9m0(c7RHD*oP!o@{R~fN`if3{`WBONc))9HzFFbMZjl_ zSPc>cy}J$j_&gsB86Q_Ms z9*+9xWNeX9i2b2bSD1U$5I1++Z4dCCCIBCx^tQQ`Mi^k!Y+LTPZreGRyeY&44Z%S+ z!8U0VMMVOl)~1?UUA9ehLIv$dMHO%}0m80MZ8cn5QD4H86;`L`_@XxKM{E<^XA7PJ zU9cU1Uw9uLVIHdcfL&4=Baj7OL{ud1vMCIc>hQQ5uuHaSK`eMrL*T>sD}A8SyC-6B zP>Y=Q+T1-ZoZO)HLXGMWoR|V|xF|R=8=}B_R1CVy$!#S>?KbTu=*gT`g3?S#YlK$i zHKlMG0I}2r8%Y}tfwe${jb;-8my9aX0}S9S0nzp5+}D^>l3$i zm)$0|uWAQ7xpNHhMKW-k;xgx91+bP$ zY4e6tIFM#(yc#K)>W-VESv-(t6Sdo{vMzgV4(#_xws+2XWUtR?+yWjWjv^Vb7-N)Nz(U+4>6bP z><_`SG0A0LMrU3AOiAhGR9Z^*oq6-Hk>P-gO|sRh3ym!#YR z`X6g!U+#XF?Ihl$LKZQ6v@k1n{QZjDSB{CHaNpk-HW{(J3DXX+l## zQUlZkvhYyLANwl}FT%Ume;8_8J6>?B`NCQX>86NyLrB9*Enmn2y(-ZOqFf?$YVMLt z9dNZE*Sh5&-SR0^h01hTk2$P|5zZ(*Qx;_l4%cej&GK5hxaC7``Jz*XOj^jDi*<}5m6%V7Yi9kX=CmeU#Q=4xDNBTO^n z-SW5k*%Wf@7RhKw;NWTMq5YVo<1 znub!Dk2npmn=D6RVK3t^;b>Q1##`YiR$s>1+v2eM@is0MRpyS9!25BLSu1)Q7TsQ8 z)G-COSLF0@DL3^~dV{&~jby!)->qMn1@ACqB0Hps1sfScXw~}qm5EIV8_pN}VAu#z zk`+7LiM;ir@ZM_O*-!4>gr!dOlYs>j^_)Y%av}T3e%z2I421x6-jDg-nA~A%^#r4O zQOLi}_DV0$R#XsvIGbddhcvk;+AFhL(7e#JEk)E3WSDE;&U@a(bGOnO@r5F?%&rJ@z*c^NjGI!e zA1^x5PI*9-Xx*Au87QEeAPnKs09-4?2?w!_oa5kJfPc0`DmpFjFZ+b33cl!lMit&) z&0aC!l0}k7V4co8R=4wsR6FQa8qoa7QhFC7uvoDrOL@3B%HfSo7VMSzo$V)F%A;@~ zL(E#dk_pz6V%ms{0^7szetbS~0^Oh+_S16C#Eg6t_UW~JArYqn924o|`WB72 zefP|fAX%N(?HI2{d`tx2oO624HJ_V-RRIhacM$#tVuVj=D(Z&*8GMY`_*e$t+|me1 zOJk(OMlpD^1npW9j~N}0*URi(E_pY->DqtdJ#)}%mwXf?i{z<|;un05&Ln37)(WuL z;`s&d<2RmwpJGGGVcQd!$hx}_rJ`I`Evh_rr5JwUm+W3f4BuRc!JXUr#Wy2=9Jw4w z?0Ct#(e1UQU`{2W2g#7VAL<*W))z@j)aCVcVm0mxe9g*CNBOlym3-kaWGcv&c;_u9 zp9?|Sf+nIT0%r{v;CMH3TmAVi)zgotWLVsGf3}2`U6z44K+P(_+|G;wlw01MR~py^ zVvP-`@$SXqSD|B8CQu!-tEDL5E;mO7jl5?ECpbnpx?m%i?n3IOV+4bMP$2 zzd80+P(KJh-uC8uF$8xgZ62Wc% zjbHHk1<+9TvMdRMhAnHe)Ts>!IJ11etL7El#r&aJ?&{Rg3BMttoaL%{6MhkD8sdX8 z0`Y-;L&CmsnD!0nn)^n^X24OnMx}suW!f{^V$T49ZGz_;gld<63f(ta(SyrwyRAoE z@?7xliF{Hw@j&g+>Y7*qF=ge<7(~3qOH)}UJAA-8pB#2t&qSLN@ozC*Kn<)cMaG03 zSt=P~8};5jNU8T8o;h<==QFE+ZLwj_BX^E^w(!g7oXzk2Gi%kp4+b{x|Jj6<6|eMK z{KSCaDUpvH{NvmMe;HtT>#uA3?KJlqXxY#{!SdDCm+wd@`XYZ{{^pGIc%X^mG}CntO)C&nm6r#>G5~b@$xUrT_Ty`9Cebb>@}{-*&h^a^_?ITC)DRuf(QH<+4s6n0oI0 zY2dR9j<5T<`6y}Roc!^>Wp?ax+uZYAsvg@s#oA@fXCt2tWG?Hp;85fftA zdiT!f%n$x;)w-A&U!7X;x1ATyjdYChI~U#a@kDEB>-`Bcd+w)LnzdX$HUH9ot7G-vf zn~>GwxkiCIR;`)pZ(sC4mlyx>?TLhm6Q@OGKh|?r+MvzmLHir^88&N=-&edW@!~%w z#Ql5t@r3&}zV}#uo1K#a!fREtFTD81uFc$m1Dzg;vrg+e`HqQ$rupVL1~0Yee%7nx zquLSXeeVuw_rSlFWi*PJXI>GJ_{GUPnzT#(!8{tBDF+UG zwDzTYe@<)6eb#5eeW&-E0*hbN9WHn!w=#}|}OF66y?KEL>vj-O?3uXtnZlYe}c=%&$D#tu5NWnzjG6UzfZZ z-G9)h(;Nra?Z2=;CG)%WT|0f1S^C1V`IpYVcVf)42fog~?@!&o8@yq5s`O^Uryo7@ zbn%@9QAhSHXfx^g-HGqMxMX--7d}Zyu4Lc)Ax1n#@*x3`s{^Y{?UK7Y2d%7%o#UtU&F^n-f?18+U)m> zU-vv)ia+4Qa*%LYuf zKm5a6zC({W23=VH<>9ACHt+WL=eMW+d0*U?CqHj+=OnK9husq|wCS*@&FD1G_{2@y zPqd!9`lX4=54nHL-?P3=?8c&3Cdko0H6LB{&)wzkJ#lH(gpc3IZ;{jCbWz2WH>L(& z_YCWC?A_I85(=m1e&+W7~n(Yr|Q6?D?NP^yf#{x7pi$ulUt5bEBy@ z9slj8>{XMFFL3?*Y;FEq%lbrqVTrl*zKCbOe5vBaH9haW@Q*oG_YZ}Rl-NJc?BAsE zl9VO~ANx8!YHwzr)xA@5xs`621UZq+lk4!vpDt^c-L|GfIE z*f)24+H}|59iINf-{$aNxEfD-{LTFvBRkIX%{>2BMdn0h=6B9XA7|}e^3sQiNB8_w z`nvD4r<%u!09|8&BUwaL~U zf1JDY-%ob#I`Xsp#79p}y}5|DXYVd~)!pDwsXX|6+nDH%UnG5T;q}7zm+XAvuS(*< zPv`gC5ZPzNzSAW+J4Zg`>anD~rMdl$ru+NOSvG9aUq_AYt#!*@P;ds6<$TW9xs z^_A3tuDxHq-6z7Yto-r=>kqxwe>CUZz#sQ?8#5r!vERNTW5~G2_T9Js?(rW??>ck- zoNXD6Z+rfy6E9bJMtpSgZ+)lTv+esnzx=qgTjwFtmR|7eDFo%?GVEnRZvM+?BVcW_ZhzT%w! z*n!rcHyhS)($l3&K3w+YiMyt)8QZ#7)y&#c=eBHE+i70K&Rw%k37xACxP~5epZoHO z7W4DGkx%yC(j)ofcb*>j@Tn%9H>8d$mQH>3Y}EM4Z;rfwZOV~?^mmth^lQRN`=9Qs zUDEF7U4huwzE~W2G2t0u<|Wrk)0#E!-?xo#@yd%yEyj+WaOC9hH@mLiJx4jxKO^~# z_uguG$5`Qow_V--{hD|68;L^`(sCA6mcBRn(I=*eFD8EG?7IHhn8*M5WS=hMj(j%A zv*4!#9UAVMda~0>Tkgw`%ULs?Oy2U_%eN0}F!!}%&CO{)KEKEJ^yh8%{Oir40gwFl z_2OmeZ}pFSY~}e~``>Bjx%5r?ZL{b7v&P%~{o#E_zI8`4Z%si_b?p8fTR!Xb_phEf zaqpSvQ&lbR9QdlcQ>bPPy(g?CSs&V=De&FS3by`Y1gp9uh0q$!@&(qvk%-e4A_W{&iY z=vrQp&^qWmXM=hZFgljr0}b)S%#rpHwXl=(mFI%aa~f$?ZD?STM1d}PsfMc)4QqeF zc3aSS4l(ZOiUJnB;hRhg*r)D1hcuI@tkuVAOM=dGiVYaOh7+_qjqz>fUe$h$&UXwA zI?s8;fYGr8?GCYB%-o~eucS7^ehNCz$ueMcEcTX!yJX>J=17N$#^A^c+0LNz9I6Lh z(P)=C8zyk-9f;q7#X1G4CtRKxLFYMBLtz;BE)~f{I&k_ZsJG~jsUCAPx;szHhtg{4 zuTxUH)H}o*(J%E*a@d_KnXQo)pN>}yj1aT6spB6VHI_`)`f2uSbsvry|Hr(X+(Bcq z$2>YAcS3fU1r8zSJThg*ePd=0p77Y<-09g9GG^yas22tRc@w6MyZqs#3DYKI!-^yb z!0hRACQO|$E|*!;=~bJaUAJ&N;cAY5mS2zVVG4|t-?Vmcgob~* zg8A9HlUoV>s)SDBYkmKqB81@32Ji*7K)oQwDyLTOYhfTXfQf1gG+&Lk&vqh4Ls-wxq&3Xg&O11Q+l(Xq;JG@16R6<^gmO= z`Y)P?MiSsWWIK(E_FA>vaK&A6y%c#roNx_iU?!uVZAm>t$L(iq@wWn|v39%|aQ1M0 zT)8nM0)SaIy-t3qDPis10yU4f0R!V)b{YBg>=xF41UDBjS)Mv@wxqBLGY93~3z#il z6^>3O)?RzJuyXIloIeSeZc9}-vksS<6jts)zzqV-D=*c7>yetO-cdgZZXIBv->3s; zv)Mum-hlq=2$)}1)`7Fz!^$0w_C|wKH=c2?L)J%X&#-a{ZUJC+m)6OzXOGZjZX&p| zfEn~vI9%O%H5!kn0cNWPM<;qZ^or}kJ%#(3Tk#Qc)dyFA=ik%=*VPuT&zu0bVcSA7 zLz43A+M`=od(&}$PJM8;@Oed@xu!n29^v}i1%NwRA6#3Y=7v2C$wX%ZHFhl*R*|$SI3yXsEjL{39=*Qo6z?Joc{y3ERM0xKeZ7Jl=>zKBviEC13y}JD)^v&hrB;b461kOsB&??V z%8GpWqN|KaR4D~zQybK0Ngb?!egZX~stpm_O>pN6-m1HrkAdJqis7wLUA8)WH7)u3 zeMqn$aI;$tJczeaY-NsPl*BEy4@srEjOnk^Z78ddt7R`$MSZS7rA}E&zoFQs%ZOZ% z)+j}E({@_2mq9GQQQ|g2m|lQeyeFnL9&9S!1$WzSuOkL(SMe@y1|)2bIN3`&rqDC0 zg%T0m0(%Zz!grF>>u!thRD6T8>`uq`TzpH=gPesys|HR@9(C*nq-c1`@m=eKi*L`d zcKGvGN7ee_zt?lT9sc|Wq6Fo+gf9uEgkM+bInfS({)171T$sSdL0+6tMLEgOCG5pF zT3AhAY6H-;75K$_q*k~mLs5eLmaI^)hlA+ne9Ai3h`9-=P)bn;(UpLDLq!*pG)WWL zyX51Ll|s1Y@~T>7^6}cCgXE$p44o*SwL<^yxY&txH5lZHG`%H^2Kp8V1jGhFVM&a% z;3QAVAJcIslsTeMK~#T4wBT8rP>nQ~m*nlog?32bb=-#NCn)%--56*AvA8Z+n-3MM z2vc51>R0L&C;IgTd@J%|eCqv)&g9A?O^~eD42Al2b`ySGspnX=$Cq3aBUgE<;rzWR zz)euyi;{iDk7zaol&u@tQ?^jkEzpOIE60d&6_KU`2-5*2LaiSmc!#7UUWPk*cvhDq z1g}62#Hk|`SBWK!Eu#E3N^A)fl>&#c(}lH9VOqGI*l0m;r3{5WL5Pw8bN!uOCa}JP z-A0+v78&CP?dT@ao6fJl5>s-qF>a-(~%Z;gv2)hnW@N9>S(LLF=NhxBp zp|qw;9l z$ZhA&3392VZn;ovv6!=zwyy}arRb?Wg6CvA!T((p+E0^;bpis;BbJ7@?I!95C%2`Z zZh&T7NJ%1hfMz*LGrEUglm?-zx8HAl3Q%=^ft!{NZ8(_wV!(x8b;etUrAjnbK(rGg zR-sH}%ObsY3t!k3B#p2hV{WQx9~?i}T!>KOSLcKvZ?sqOi&_E_p(|Y8-mL|1Cj7x0 z8A1=fDfHr9O{1|YV1)4;TlO?fXhV<4yIq)HN{k684?%UC%e^hI1ouPd3*FA^MPPW_ z5}>Du-rFu7N;9J0+ht|7Mg{SBzzv@pg zBZ*xj)RrK}%FrAI`w4#0e8RO>IJhdjMMaqSA`i>#C2iAD=Z~m7PrFWN9;lIn+l}c+ zn-5hRqk{q<{5@Wc>L)vJjHrers6uahCgzUj#+@|)bB5Z$?P43Du$oq$UWeQQ2%cfq zlHCk#u0V~EVM%fgFOXCJTTu^F7QZU?W`|s<{p^PlZgwc)b7FR$jx`aD+&3xrKq*CR8V$B}(>PIHN)*pP%rBhROc&R4&XV04x>s}*fqsg{m&gB` zAeZALh8P(8U+t#c$2{lEd0j(j4;0R0`FD zP{qWCDtWzBgv-k+0-LwZN+a1zm4dQAJ%JSjRYhU<G?%g)j>`4Y?kX4o*lw5>O{6OkIB zXP8654E13W`UFrNFapG`<5zbn?BKKy+BP9_({p|tA2A_h0!V{I=;c`2EieVkx}a5A;_*s3pQTWNu40ijl^g{v#~V2V51oo;TPDkZ}sz9 zk_4}Wv-6ziOgsGff5a&66ge0sVhdjQD;ndFw>qr*5ZwkFG>ix2i!02z!}@zIwJvW$ zIy7$6UEEnGw?RIZSjDfZ@_c8O&g{7?q7-V9Ks}Q#lvxtcO0qYBAwXLRYBArD&Zc#P zOa9JnJ>&G$UgQ_uin^hQ?_J&$DnfE`)lP0BAar_7D9c=~W|#R7$_~HRYQM|1-&NZ0 z?^$uss|Ac!g$8sBI^Z)T`$9iILhwY!V#8YGEK6*iOri@q)aeMw<9k z$oN9L#)oan>E!$%UYbTJjP}6M+?42;rkJZl$GDo(_||R|3O1<2`yjSNL`PCj>}=jR zt!tW-Vpd&xgQ@{7RFE>!atJA)6CJzE?$NMLQK?(fm&MM$ozY_4rheYuL|aZ)Ec11e z7JGrf`TIeAT+Ki}3&p2}hfxN?uZ$6kvnD-%UyDF=Uf~?1nG~mtmUX(dRZ2mO=VeZGL>bqxm1?Lrczm!F_W~y%UIda zBgZ@{&0ZU(1RWf-erXsResOo2KVLv?39lw0q>MouX|xaa4ceSl5@_LX&>F63X4_NK zSj4-RN*&3&LMNxMKr1WO(_q7Za1G8*(zB+fEspX5fG&N3geCL2RiV7G38 zQ8$8kAxTlgJiZv05~ZX=xsquS3wZNz%Z){Aspx$?g1V0;A-awxVKmLWC}84Mp+ASf zYdA<_@1wXks$o}_>}rKcIi!^ZGqV*D-L0bW$OnXhxPhojtXc#Hqr!dAs9ugo0gwnL zxe9ZW+Zf0_j`=I^!={6C8Vi7^0AD{)0653PZ;6p{GBcU$k7mbU?a=|?Id92skItkt zZm~m?^vu*g)C#N_>$$+m6`l$cY#_p(P0MctZ(YYrqMX*eR$L# zH)7OIq-Svs`2>#lN+P&j+;$8%wgb>IG!vSl!w?S8p#PE0t#qrX5>=orDR(x0)!F|- zUYlw+A%qtjUnjSjMvo1wI;NnJZjAw1c57Ug{BWx{b!@p3!TJs8wbK|l%!y+FiX>g| z$SBZQk7%Tc11F@Ea{P3Aqrn6kOv=x3 zZu_qMJ0+QgFtdZ4`1mXU@+C>WfC!7hyHxWC&!y(sx44x4&}$!d zjE_l&VHPxxou2c}dC!Z0mAD+_+&?N14;+`g$A!JbdI{FT-T0V>l!1gC=GxbTn1Y$- z#$f#gDC+hAfTbH!Vh_q!>=xtn_C|=RvUtg}F&?_Q+3?e_kLu-FhFt_I|C05jV{N3F4N5LpJ}E}W#rH!6ZeqzK zB*mLz`g>DuqQas7iwb;`T@~nnlAZECr{@rqj4KWP1SuM~CPm}cF_cM5e7IVoV@jZC z{0%7@pHvl%PnX8!+MV)#r{~AB*rL;5EZCRM{{c!ukAZSRGKe6k?4BV-W0*Qkm<5`W z))DlL-^G`UJMHF9qM-g6yNNuErDel=I5E6I8>oZ z-Y`4c219{WZIgxKw&>nf4<~a%@x$FXmW-fe1WTGJ305)yER?jcWF#dcS+W5o8?a43>n`VQq17rZaaa3`wbJQSkXQ-J%t02S%8~K9~r}+zONX5mP5%aPB%3_Bnfte7_AO0&MW$7FV6h(*RNccl2EIO=+ z23Qe~bd#+cHLZpqv=>@tZl_(UBix-Vv#PF^>ePgsHXy=<`nT998Oa7k8Oe!Qmb76) znMh09fJ%buppdn8J=s{_5m;9JtU6g(7Q4KVa}g0qenGGXm=;?drbX`{rbVlbI6zl+ zGmg^p5vxTq4p^QwsWH-n$7Q)X1sf}c#+844s+7iw&gKEDNa` zrx1bN#!+xCiuw~dqonDp@R2>U!|&}=+zKdKk^FXMl<*|7CGg`iDRPHoQXByz+fCW` zNK=GQp#YV$wl@vw0=HgAuwqgu0v6n>Zaj=tqJqZIY~aIhg*!Zf5-~a=kr#6#lqttwQMunx?T&Qfr8}~H9UTEKenMj-p4lv-A@P1 zIoCpNo_?*6Z?4Uu3?d3)jS+;Zb1momElM(yN;Li~F&V(HkzPMkcT+8cVfd5Q{d%UX zxsM#EZ67ad%^se%l@M!nqt^Z#ogioa=W(xjN+czLoW`kegvaRb*Z7hW7dbc6vBZELi9Y zxgRe#=Ukp$Zce}4GqK%&xoR!>N{#$hiLbw%HDRX@s+6zmE$?RUA^OYj<~r6mkoRIX zmnQa2G(DGx%%|uS`omaVOsD%|_2W3{sh%LSK9$*(D}4QrlG~%c)|a!*R$tc}D~>i1 zVyyg>^x(r!KuM3b`V-^Q`?Gtfle(|}F=JIOyQApRF&z~=C&$lQ=ZpEr4SBY=<6xeo zmlXZ&{*qUX)qjL1f+D^6m`BjI92vU_^6&sHPZ7I0HRS|i6Pb%^yNL*lNqny871$H% zGIJxqyhS(Tyz^Xq3J3j}P75J@599R$9voW(X6OU1z z4gZia{ML;g&I4KkASe3u9G5ZjM(F?GYm;)!YwQuI|Aw8HGUVkT)d6d5r_?_7pzw59 zP*o=z_b=|Z#{Y7l52WLs;NIWWasispdjPhIPtZxaeU&NT2Q!7uNPym0*&!LyV%@O` z`LsFg(TBSEpvS^Q44F^c?Sd#%e@?h`DR-$W0~lXqx3}A8_FaJ;7DdG$4PULznk3|& zv!V1%KRd;>z}(i^?DfhP1vb=bFJ=O08i-;XMB^W#7^*=wv5$foGe!Qe{ft#R#FLAi zo4<*}Qu$!nBO$WVSZcCaKpb*&&ci^H<_|#-oN%5@QXAj`?&ni5H(_nR0Gzo)4>wcx zd7l?!N$>m6%B9B|3a$GUSUM|+^zH$lcZUEsK4}MWu)_$v>-E`GRxRw|2wUHjkbrfUM=veyQfpZZ-m-orQ-!3PRD|JjIA?_k zxZj75#sDg6rj1I&RebxtYg_-aq>M`V5{9wUy~YJE!$q#hE{Jv=Vu$-GC% zU7B;HjY*l4*ida+*d$m)0$mLpYh)o>HI-`F9i)3pu?N{nfN5EAq`vO@0#ID(JWC^X z3X!of1R1hc?{=V0QlLI9Y@ax$EOM>iC={$7=@9c)P%!I<(jVeh(jiR84eA?nJ0j_^ zh7WseF>L5yW9A;vf`EBgA!GFe;vr%PC`~*BGg<=a5z!$2<`LNjKHqPJpYhm}o(r!_ zN@D_SHj-tmmV33Bx=Jo-b%k_;9yd6GSPg>_qy|j&LzbfG+nplppvo#`7At-IV{D~| z6kn*aDqJE)Zo2U>R_*812Q5)LL-U3<;Hu9ST;c=Z3nNW}Q_zDdgWCHQgGenP55vLM zBfzpDFk>|TGmV6kHOlYa4cRd1ch)b6d{EGZ$^Q+@E0ecm1PAxxu5d+cyU+J_+p&Nb;>?WeR9AjH&!O5TM@^kW;FOWW_#`Wqtu zg)SrZ6Cx!VcqpQvLdT>8P;|k?*ikm{Vw5+julr>(u(L}Pf2=K(QQGQGYU= zvA<&WpaNZcn7E@q&+-qBcy_jy^YKAo7j*IL9I_HD@oX7mu&1WD9^+Yx8}xa>id1RV zm=<_}jJR6mWCcvFIMPJg+VfLbfIm4#N>6LAm@pl{|F#3}(hk2h;X9d#8jEJYJQVOg zk5#mkKvd4@?!B01)JT~xHhLI~2AEuy!p_W2f60EM~jBf^$DA>PUm_(tH zCxuD$R>=DdjK_%g525IXz>|zGL~FR3V} zb*8}6)ja%|^YdHZ>!k647)!AD#Qu}7pk=O;9?=UIn_!VO;g@>P6^vYMyY54e$Xeo4 zn`r67l5Fv*J}>=?EgQ8ReY~totO*aQto3Hjs=qTWH^2Euy^*=!3wS@oUQHk6_}pCq zOy>yTYUCFNU=>gxfPZ1!ir zFt>iF>TP+VHgRLS-Ud~0r?)MI1~zXd^MLhTX#_$sQiu>WWSYH33ctIP>YU<&%VBp@ zmckI+PrJAJO5U+iv89a|m`yu>1WFNlS~|3+_=YP+vr96gfNa2b&#vp{TGfAUJsXK6i|NE+b!!8&RABALjuiYofK_W-` zO1Ain$y;ErC%%jACEtTGBhoSVoyZ*}d;~eLsLpjZI%0Rq%;SY80)()c*<+XV_{B6VIr-_P22x7!4m!z1qKJR0SOZ#&I2XSeC*nywVoCKG4 zM8La64!y&W6<|XYS%CwJTj;Q91CSmv`LvOmp_#OiB`FTAR7i1X+1VrJbM%BPKMBz} z37Fkjxs(bpmt_~T134jpJ0<44F6+~)$x+gbpM$*;YXh+$hTF;P_*i{SXYRt68{~6b z-tK6!)X?kjc9YYiM^oI~zYzbHeO8EEHs{teF1A=Ww`skOVeRM}ibsoi8hEtdFFDXyZiBT$ zepof~HRh1j5~nR{DRfq8D84NUOx{WyBUA$quo|)LUJ@m9*q@~K#N zC7om)1jq!_99l&wPiN4MNz2)vyfCx9WHzXX4H-qq{DnVzS_J+qR)$<5__G&;N}g}5 zME)N7NxR`X%>Vho>F=xu}ew5K_I z+KV&t13Ua5#k7_608k0Ru@xXuxF9^)8|)p}K7_)boeJC5ozAwM$l2H7+eQ@MmQ#Sx z3|LQ$mY)gR_9h;j=7My%FlZy1ZySJbOPR?ZNRTknjt%;WvqvcmAd%1EJ&YOaA^5cm z$w2dKiz((RzC6HuieLK#`D?D~_utg?a(`p^0bELM^3qSi@q=msjc=)369ZyWzF-{nk`C7drypE`Q0MhFg3{ zlffAZS)e`KW+A5X5CbicY=W@>DqK%sFf}4(6ywa}9_8=cXCWrCBG|QsOXqFOw#xJT z?q0Jz&nzEfmSeszEiaugx+N&Abfr7@b+Q`GzsD8jS*Kib>d}5DU|kD9q_WGHF~O&Ak* zm=QlBZGlT(3&>?3YXn*MTUBF}-bmLgesi19V7&)Q4otMhuMQaHJEBVpxLzTEQf3v> zh1Gf18o~U_&GD-d9sGO6sqw|ihns=v9Hqx$0<$hB)J`R2bCWJG8+s5p9t)su0-?a% zzULC$ao&HAXe4*81cF_!B8rR>W)N%CSR{`H#mIiAHk`jF6hmJNr9O<=$-CS4NH%#R zG|(qy@D{9xc~Gf@Ma&sUo4kldAISdFjcV5(KOf5kqw)ePLrF>Z0$`jLR^{ ze0}uc4#^3YeErR#l09`({pMRY#jYF+?c&p5%-h9 zlD!dQ;>$ks!*EG2MQk)$lH`~80^OzAd_*F%319>r$VVG3f@B4)QKE)c(qkQ-m zQJe#=2V=QAF6yt|4mv#5hHqPu>0b07w_-jL%2ImSjl&V~HzU&tTLHIp2m->hT1wcgqD9fdZddSlZxkTp$J@rCK1qfEo*H9961;{wHdXs08)WRiu!# zjfMR?>#w))jc}pLIM6dFf=RD`{;*%(^_d?X+>5Y9;`3;XC^-}2C(jJVBKb*_WCHo( zr+D#D)aWZ_Zmgw=!~AFCxF3`UTD?WjhE^P10T3CJpcOatSj;qUFPgesVl;U(o2RTx z8NyC}JTBwk;~K+yc!hFR>YISrltbR#$eUu$G-7b)M(k^cLnfMmK;%xN<%h%#Tjv9j zz*NH*g3P_5gNo$Jp{X#0mFzo%)~#1(N5smvh>AU1|4OI`>A*d5v%@q2rMZ_gSLwp#W)f z*u4ipN>vMX8Et07F}50sRblDAt8qriDhgYpkQ8jFMtVTW#fg;Q04yNycMg(_b+_GU z-8vG8=SF}wE+Kfo{*_?S^8+^m>{4ypiJ}qr79c>JFexpFfz?rFPRkws#T;SLI ztNK6>{4SBC48a%uH3mkzpmY`;#FDDEDU1$hSD<;f&j|dHi+POb3KGG7|Ftjc)?Z_l zcsy199O$JvwZOg4oC+=Lu0lVmdoBNmcz*M%SNhz2#;TY32*pPKTGlm(|Dx)!Rias= z{8^v>ARuZs|0Xd}d&L-S*bKqu>uh)?@l!mpGF>1WVnQ-beW=XWNRm|MX@e;@*?f5* z@7m7~%J=!?R3CbG?tS&4wB!T8An7lcg)M6$b!)4|^nY5t+8Uluj)ah&gjcR?VTVgP z7&qG%wu4&%@3I>^|Mu-&D_-9y&4~SMTodnkeq;HhEs8Uy!)neDhw@tKaLTCsO$c)fKnYX-&R%@4$Uup?3F3`Z7BX@ua-<75e)R zd_O1Ys`=)y|JP$;OTG^+oH;v|H-BK`!-5#i>q$E#5d2Z0|Eu>fdwNZad{Z#wnd`o$q`n{oBhs(gO>(y?l_j)lxL>g6}ToSL*aO?Dj05TI*Xr@x(gZ{S<%u~EM_#C5nDuTJe27+Bw}-OrKF zKEBuW>hE2WFaN+>P1~C|+HiDK;^>%XEZer?uq&TERV^c}i5#TI<{5YL|5m(6p1a>M za>=3bS={=%FtQ%EhR1?6GFR%?XY+}043mA>tcpTX!k5-C2vR5A4sz?j{dtTnPKr-t{{^x>6xCxBO>+DP?x zKgPeTl2ZM~H-KzL_XuOUoM_9XrMsC4yP20q0D&Waz_To$M^zzdYRUvg$|{KPu7CnD zkGzND$fLwify-4tE>W-~8_w_>1wiCCtW3u4eO*oi29^FUXr*^ z$>U`Kja01VDwago+Z8dNldt# ztWP}lN%-^P`U4$bvsuk020abl5C)A?q=;lA=!`zIsrE^~wN9u)ur);?wjUXg_44hv z*2^Ikp#s0VjmYlZ^4Nz>1Pn6t$NgrL1e51uDprq*r31u=02y8i^Tl#<5sxv+#9SwS z=9JuuRLU`?v`YSCyGnPqEX@<>61r~JS55yiF`zo z9gz%)`H`$oD93p%1X`p0GE%2}Ms_3TdYy|d<<~{hNP_@Iu>Z|Mv)Fk24Ph;^YAZJng#B=!6LekPgxoYOxl zr2G1i>O=py_08O0p6)L=psVfcdPS@Nxy8uK+mp@l>;3M=@sq4E`#whG`t@83(a6mg zn>oq6Kd#~XQv1;(?Aq(fr<#ze{U+%NnB5)i<;A-8H|KJWToYQcc?>C4)nSrR-_0MV zzV$0VpbEtd+_hY*MBY?=^T(+A_?0?Yd|2{sG_w`beINB{5B!Y2W9%UW1b!BhBSBll zmKTtkmzI0MDF7WwDWu?( zeC^D~S*V?bILoxN3}=OQR^Y7GPA2T4Q)+NC4a;gaNeQUPo8=Rt%c?mEy~ek7bD>i0 z(6+s}_ZxX#6-{f|h*k}2snRDA2+Ym?xbtTMxyby1s;A~pJ}HkkfBej!K67(xlG#(R z_qS?7zxY|1ImX0&lgu&e-M3B9^TyoM+9Q!#6|8r4>-l9&Y{PoNdQVpQ1R7`0nf!*I zCPs4_MpVb#Zr)sG-8??CrS%h#ph0{FsUt*B%8S`9kgI{+jBvTq719=NI&8@tEpo2a zjyjSBB(rWVW)~7s95Gj7n=Fyo19sD-WWV1m51Qp+qo843GKG%V5yd^NGzqW^jXYtXoo-km)y83XPQO&{2~0TY>7vY5uG)=GF(G1AiWZ(>*`~Lg;?hE3Q_$Jd9?B1t&eL z{@f3cSE?N)I-rWaF*TdaxJ?UjeRM{rVjHD%fP}y?AK9URxwD7d;B-SqKVUUp89~$iIv&$2>= zXt$a5ZOFm9%p4FC2+dmx99o5tSu|75VQZzXfM4-?2Z1Si1ys@Qu=V9^>y|4alV5>I z2NzJT{*Y#4w$4%%ces%<(h>8Ci1$rDQd(x9qiza{vFMG>TZdYh`?VBvi+4VIC`<*2 zmIy9uQ;+V=q^f;7WKBk5hkIxPoyzFRe$=0J3CYvL=EBYZGOlnw%*7~nt#(uuf2(aL za>o{&63gwM-z#KW=!L6=oddnB0NJuPA)LYE{kF|+Q5Vd!XZjB9<|6AcNF({pN<^u5 zwFekU78hgUHZ$^^q>!E0_n^#V?i7}Y-d2P!1K!8|CEMVx^hB(gHNNQb0y`3n7OwF5 z(Cs%9m_9NiqPhER;kS@_vgP@8$oh5@dC{vI`*&)C1<}JF&|~>9U$&q)!HSHHgH2K% z+$qd_TyayL89@rFRk%{5%WgoK;B;UAwxlOu<$MzgHueyM5|SH?O%VnRjF>6HfZ=*! zF0V8rJz{amZkZLy^T|z7(jr8axXLL|(!&{=PgqAPGp_Tw#wD6Ra5VpcdI(MZ&>je^ zP!2ura7m=lXn7m|u$3DUGBb>irSfUc=rw1cOZYw`FWdrR!v~0uh{SFg0qHd*+5xxb ztT3zrBf64QH(29yBNj+i8?@-H_4`9by%6mcEgFh)v?Cw-atHUzvWm<7vbz9@p!vKt z13O7GdXtyYoWz?_cu^;;Qf@R-1nIbsgpjgPKGO+_mg-byg&#us$|$LnwK-`sRm~NG zGPOlU3}x|F?kP(v$W9CsqK~YE1>y>ny45wVut4G-0(uk+gmbX%FHPrq*8^Ntc|ZF_ z+^5L4@d$L_D;G#oY7>&pQWq7(irdaWxVU^ z8Ed2&80*bytl>KxJJ#$c{!SlSX=Pt+Me??x2fdR)S2++f z`4xL~^Jt|W-O+hcyNs+QKYL7v$(X{@Qe#>0rpM8(X=R@KeI@&j8DvHm@j03JM)MC?BT1Vr7StNf zMX0$Wd5#^J@~%%zwERt&q=^)#54BuX$ExAQ!biebIhHR5+Ux+hWsu$Wv>t(fYFaOp zXbUrYMKMID(ON?|@R{OA+CmL;*1v+dE#cIM`28J-ae z*%r}h^mQ0I!^-xRo<3;gMj8)fbJw!=b_VWDCL=q+^~2zx2oKHsnmuYp^l{a5j9h?` zV<;ls?VeWItNiBlRt7HaHv{&-!GA0XB29C5Yqrdye53g_5=Z-o8LRKcLC>)e!Z$Az z-3;rdCCt|ji_>|a*m6CXPnIm|a86*F&*(Iw(jf@{deLBiKe`{IC%n^6W##id7q}k& zmuormPd3M_z_bL?`VEONLW*d6EUuV1f3yl0Lc^HvOq@Uc0=GoxGd9T`Fg?m^nBz4p z<(1`lWr-KFQrTYFI6tledguZ6pG$n!=oO`v9%JPO`a&QJ(qVsp7T_6S^Lmoj<2ws;B!?p~3tLtz7)Hc}ErNCHUI{l35#@Zq2`<6J9zP!B?8u3C-Yk%#EnwW(X?v7S}pXW_aH#FT@@b4moaHs07F*dp?o|xut!WV zM>c}Gtq{F`gv3|Kj1Pbj4xem}`!%;3dg`tXn6HP;PR-Jl)mFQF(JkOCU%CoVgdD&-wn_%V!i~6JU`mdKAIrs}9Y#xxS_EaTBLE7@EBVz6ij%KsTM2weEQS6%qL8Ig!h z(&c*8!|oU1mP)@iRwe#}VpFQ77=tODkw?V3YAd^R1koFA(U&*JJ;{o7!NJqs_}w16 z2%Wc+@8Vk+hQvQf1GA8ca*Ip`A}Da(b^f&*$QyUATnC*!uXKd)Qa7u)9xQpM?hG~8 zug_wd2HiWt-W_Q*{wdcR`q>U+^FN(@Q;q;(O!PQn3mpE4S(45Or&Zr@!4? z%80+O=v=E`L_7dNj`P4nU|55r8>>3;V$n#0F3$=Oznlwv*XNv9_tyX%`jBow>p7!E za3#T2WQ#$qLQE|LU_a03NS>?C5dm`;H;qV zH&vzu5o}y36=VL6nCpYfdmIDxydeF`S-d9k~uJfx|JwRMTi_^V7{TSp? zDGoY2fVF5 zYT%__t$w4tm%U7%brfa8Zv=XM=oMgeF4~EuM##1LsMGc0Wb4ZBal>;HO=Q7i!42eL zMvnfH9qSTX6$yJSS4_@B6vym~_H%v-6f_vtaLzSYa$CA5aTbWKm9v7hu-25ASs5sh z>gQM)TCtcH#fBqqF_wU9i_QO z^F4TIObE|1wCGqH16=1TS2-!kF1|r`m+{E~GoNE3b2U(?BFecw7R;fq*~S!}R7%pQ zpa4^>(Zhm*93k*h(pJA8RCNH?(IO=sDUlL%T-k>(>LFE3JR>FHu+cp*z+nw%2?mIC zNYS>^%HG<%#9iQ%g8g|?exUexnQwdBL>^&`+7Zd~ zgQdz@H`2I&Skdn5-4blv-G<$UptqIGN;nclF99Dhw`&ub=1pAazKg?vEcGBHc@kA; z!oI}>rRlEhR%6xctkj8{7(ucW@XHNjDoZy5D@DgP<1g8Sy6Gl_#=r!&ymn7Jb#j^E zb{j>WaDwJ!x6;Z2YhH*$- zRxhQqqT>FpG3A zlC>aI0D!ErW3mxK`>QFjF=J)lZdpg|A{IOQsp_ck9r<*>KvdA!4i>{~RORy_D5Nv1 zI5u1q5=xdBY`wvnFhE&omt#ZUF=x>@N6WYmfyM~JgX|6pL2`Fb}Ms68}j~ z0}^YPQY{U*gwCMFCyU~Owb>LVE?(Fs6ef&(`&)IUPELy#(d~)*$t;{T1G(ZIsnR6B zx?G=?+2@g>PpaRs$c%;<&2)wb)~++U!Ii^8PF#UtSMcQf!%ZguK0xw2FTR zM9A;$nH(EeK=*;m?l*h+W?h>QFn3`DXlJ?U-^uiZHC;JD%=_hntSdB@P3u$!CoibW zGFCmoDg$b)zza~0V=rxbYSd88sT3t&o$wS5BL zsSP12WT2rJXJe(Dq(9CIyz(2Mf{8nL9DmEO7weT%C90sF5d6=w*IaZH&yp3xp6>$F zvWFQfXM<W95;M&4D(sh>=Q6c2Lx!7<1w5rq;Dx;=oMPS)6|QiT|d zo%T7{=_^2dH>C4T0~l%tLs+P=NNzC3;=zluIq0nj%V8Q#&Ep!I_XSPOZ8*(mWefcs zli*EZb2EvH!?6ma&ePG;e0$x*7(TdAz%@XFXT>q1%h?0TTj8e0%CGXJ@X})N(h~5} zYCJSv3fv+8TbbXul-(<24Fex-Sc)Pv6X@9pXKe~U1{+-^J(ogB^XtAm2pxUpgy?8Q zuHkwX3O>8B((2bD-$*!@Vxd2rtUCUrNq)ttP9~CdOrDZg-I;?XGIL0d@`Ere8>Qkn zuTUzDPKCW#Zv>qxtSd1ww-M;k6m$saLikkZR59pO;UIKM(a}Mtnr~LvKp{g^>ut{^qL|D(Cdrw)`$m3#?#f1eQjXKzLq&;nMk$P zF0nBWHC`E52jc|@rBp*QkzY(&e*)t*7@IsM&rfc=X2aKFnP4AzD+GyI7^@(Yid@ct zrKjD~rV&awmzr1}F?WSvBAQ7QbJ$7?1_qdkj4=|<4+`m4*g!N|HBPPG`> zq=&(T{*ttjNyhV^nH^AR2ZmHUG%^WMGYy#(R3vjujh63dL{d*hqgm*j5s*ljbVDMN z`9`#fD1Q4(`1V}UQaSuo1(6h?`bQv)nbg;8$O7$xXGO4eorCY%MI6kIZ5J}#EFsa+;I zc}Vb?#yKHt1n49r(T4dNmFxtS>;-cDW;USnLF1GRTroF! z_B@P$oSs4vBOibt=7AqRVXXR*WNKxn@I%3-hEaZ^1%L3v=MqbCX#5ZYc_23-2qg+Q z$?HzAG0hkPeUn*+wf#?QX){)SNsz_qJpKnEb>N4e98&j#-=9S4gywh>spI(b7eo?H zB6TN`x|2wq!iG;Gb-|L8NZm=KE|LF^@w<$(Z}NWY$Wbia<2S#4r4@DLWSu+4#meNgn!tRwl9Mg! zH|~#WNm=0>L&2-er-qxjwREL{wOwj(blWEAl>J@Zhq&SQfEftG7B(jCG$R#3E80X| zz`{F-E6ihS(io-9(ZvA+_A$glpSP=I7u;ir?$Z#QoRk;+dV#hN4~Y&FzVE|8-lG`E z)8S}$l8=bXcD-sYBvL9J_y)isLA z8OP*dAAbIrkF#Zt;_}>3 z$%lr0u?J`I)0B|U9*L4wSuOHYO}K^LQH?2pFrvKCXZQ|Vp3{Y$i)qOG7LG3<`e6J*Fh9;CyOrMbeO6&oZlX-flTLOL8d&-R5m+lmDeRU456 z8V)x$TagYsgWkSqJj*U$Tae}2g#B0o5}4xZj(!AK0vMJVjr5P)P1@gH8mKZ>i&zBH zxx~)ZXg6L%S>N-L+^<5_!~n6Q0%1%oA$e`-t@`%5cpWKfOhFTqg+HXKj@vX2J>w7w>YBs;Ro zNkwIkEJ==#Y#dOTTcc=FVk`y`M4Kj6g*8S5_2LNXeMM+e`9jNqF13bQOt1S4;`U*) zO|hb-7FC)o6>aU~qtgsxszQvE$ugHIv1i|efzc3~C{?T{f1VJfNLwJHPOJd1JCzY5 zxR3`im|@PiL!@sUW+6*Vb*SVZj87z*8+t;4dKc+o?^EJPB zH`<^u1`ygRf1E`Jj{w#}tw`S_b95^jMIyi29#ndo($z?t6(XuCs}?3x1|(?;7pYT+aDvF#oO z-EXJt9?ANlz)m$>R?@^U)}Yk-2T8d!P+U7PS&=~l%2+?>L`l4QyDT|h0$$6MgxNsO z&UR#DRaFi-&76l1l+C7f#kg=6v_ik2)4mxw4STH&@aJ|P}2aPUJ z6)%oHO!RTix-!hp=tA(5m4HEH>GQiiROAue+iLqB3u z7l6A|Z6ItSK)nEjqbZ76PQB8yAH3HPgry=3 zVGZ7H!X@!RTTR&8q079SG7+3$(dsjcOrJ+gebevvwyFte&%S%we7|Sx*-qM5?J}AV z%0&%WqE~*fI}?RuG9bYCDHh!;i0yHS7N>UI2C+}OhS2JgbtMf$-4wQJwS1%Jx)g@` zsx0K9z3?9@vh~AG(x8?W@E-D)fK*2E>&i5*O2ir87I8+YuwbaHSF0(1Z}nlyl)Ht_=w+Jer1{l*8pY;LivRZ%+%o{= zOm~@q2`S9f9~_WAw8a_`d~`6=UFb)cPkWz6@~XU-GMV)=^OO>ol6^$5QS2pavBol6 zsu6)mrW4AQkAswUfRvsOICiq!_komNgnJK{DR$Ef$V4LXGNZs)?PDRuw4UIYAe{(l zfOLX@cA5=AZ?BktjQIqct%7kZ9WBB(F!=#>#UIJlTTvlGphV0eBJ;4{#y}(H>s)^t zF<-`H85rn3hJjqv^obtLYRFX#>N5srtd+Bo^(P%073;M{@zTnmvGQ+8oraE<3^$sC zlA&Os)DDd(1O=;^YS~7M1`M`fgazTFY8$KjvAB}CW3b}quq0Q598k_6d=&A(cuM4W z2z+##su>ul%ZSEto4YV+2o`Fr{*```6A`QqU5Q*D3QAG+T^2NR; zI8h#9jPmF;r8COvu0w`B4I`>Z$B1$rj7U0XFh->ME_O!>BeKP7(M3|YexHpI$>B*b zqdXfUstlr{S#=_e2-)ZXjA)NGNk*+Zro^rkfyS$xF-#jjXYde52o7LD7!VXwjqioQ ztXkF!^d9l<6AmYOB;`8=(2*??1ZdNc2v9z%Lm>3;l2F#)khui}NSbXlSK^m=md7A? z1_MHGWAt^QlE>2oW(P1JDqm=$K6x7TIc7d!jE>{kpN#?0!J_skEmr8yaL}KD`7N8D zh^u`r895;aB`%dfNTe|!k_rOU_-T+I7HE(k z4_J<@)>a-lnmd^gMs&VlK1my$NbFA`7<)4jjEY1D9s}F#2xpt^V2k^&Y_5m?{LPgO z{uA0W{O>Vv&}u?f+wY>k%_fMW|U5S$? z+y5sg+mE@~DoUVjyqrZGTEXqvR!Xp8w-RiaH9~|KVAhLlLyz?vN#Y1K)CCZ8D8xq? z7mi>9d+bLGHbl(#BHovwE9Hq$19F#3^NuIf5L-irf%#{OOhbl1Lqc?xQ*sQ-?pN3T zL%R`EfHPy>vxQXNT}U%*HzRXw5eA1!oDlhiq$9s@T)BlMj?6;X{LKb(3|qhM;}t@m z(YjfPWPKs7^6@@{jP_bBP~lT_YeiE2;d-Kq+LQON?@(vJx{aFkK`N%Ty#a4KR17p8 zL}dGYzqxcAA`#Z48YuCdWV>ggPaA%z=~nL@Q?l9MBY9Tboac3Reo! z_C3#J#TBzFxY+;KtwXlWJ+(>|;aW^*+QIok=sEMs%OV$dtTz{=}5-1Ek2HG-$yKBl;`>B79M-$lj03myo@yMEc@P zEq!4$OEYZ=48{;142Bh&@QY~PuhOo0C&HD}CJZypR_5YDzlki%A?|2HqsH!dCaAzc za_$L8;se4LWkZm}5E_*WgMFZ z2v2Mno`P z!;nmk5fwuNkS6m2nBed}h3JJZ`f^tNSR4)+8$k>sQxGH6|9GY#h8>;~#4v^s#4v^s z#4tXFAch(hzj>9Fv#u05iL9M`^2rCMzS}^TF4#&nJ6|zNCFQwhWLDOoN z3es!_nlBc}f))&k9?26W&QYb+i`0cpfuc9)23wFIQu1iT+ze~s58TEn)j+IAlEud7 zVHoftxPAa2SKKeW!)Vz+aGDK7#piNAOLSyaM#GCyxub5BM<=H!2a(v7=(s;_MB7Ll zu_n;J3z@^%!zy{Jet)FsL)2Sj{I zPnS_iJSCZC!5(z)$*fgcfpsI1J_wXnDz)}UZL@j{3+v9p1aB^;672wlwc_0Hq_6}r zo#A3n@LeAeefPGA`>BZc@w7^`d>zIIYM1(UW52g^axCZaP|2g*VZ00SKOS}sQGRFT z4o)&XJ0_b8b|3=N7FzM4E0?8u^}kbjR+Fn(yA^7(O1PnHhtiM0t&F@VNGUjtd7|am za=L2r^*L9iK=LyC-sOOKp1*X)9HV6gDMFZSLYgYf4Zx24xK6;h5j9!MlGBczHl45`*t8ONum{@3VoGov<;a#OTbpL-C3Y*o59BA$ zq+~2R{5ib!R%S0`EDC+-Irk8S%~xI27S5VmgUZ$& zNI|{IU22Wrfa{s-cOPIclVJ;(9X@XdTs@>Q5QhQ;RGsj%!9uIM1+jUz4e>su?q+wd z7LYPl%UH6NZjhH7OI({#oD?XrR5R-5`ne@+@%hOaN|5nc4Tm~RLK*|=YO*3E;8YeO z;S)3_VaW6E;?%h(+TLGxsef!kLBM^G<}P7P+2~(`5uovFM3$!k6l^QoVzjM~*;i&) z+MI?6TPGrHf?8)VY{Nw$Wcus{ zoa#X5HaKir$Zc?~Vef%p^e{3xFJe^BIn2DlqZdz+Fc9-zqtApttL7;pG73Ep znLAdopZ$zvzWztGA9!HmNqTO8clR9oh343;$Ncnhd3Oc$X-Y6gnL7R&rj9+IP6@?~ z7%ouXW&K9tvDD@AQZg}bDUof3a)CYcBVKMF1=ks5L;-)tg@I{_K)LWgA7a@Mfg2F?`|w#A@HA%);kO?wl^H<_H1sa>! z6fmD6A_ptA1`CiNO_{tPwZo$n9O{2GjL=>wG6t)jlZ>q9JYJ#bheMxW?n8P(iHT!9 zM?^)xM+cWy<{B%-Q12kQ9I-^8<#MWRxty9IWpaX9>hx2zjlyNGKsp=-KS-~#OOts> zdG5rAlqX0&aN9yjSedm4O9nVfr)n*nTqJg&tslxfbudmY_hZ6UaXCd$m&qOkQQ=S|Ho8<=#W9IH zQV||*)fjC=UBj6dK~14~0~whryRf^RaigFyCA=|e)XEmGR3Q)r^@_}>GR}o4=oLy7 z^wA+iL2YZ^y9X>ha}HC>pR`3+n=NMzg^ERGq|1%ff@CHzXgkmz78`uO?S;+mNT?e~-vgW2mH1q?d=WC0?Xog^;sj|B6 zEbe8*3_&UYBTbKjwBDm&>^%1T2x#lGf$L9aZ`+LZ>a@1mRS0>(W>v!)ZQ(__1h)iZEwVvaLom=P$c2rOcE}=S_9V}sl%SaaA61x#hCc@_ z9Y~;ItQng#bBm2t-z2q9YbRNe92+M^pTfaOdlgP9*NZwhsoo?+1~5>C?gnV-64stP zg_B}?GA2`^=pc)=*`*G=1M6A1Wa zT>=_fg{=Pvva&Wdif}J@C<+}80&0|Zu?FO6L!RPh2TONc<2Du)#6}X zpUwVn!@5|rKQXK;_z;;XnW>QR3y!Cbx*X_42TEZfxnAP`M>rV7;6VJ7!@+L-#Bs2V zL*rl<4$SJ4SQx_5|L?J|jej{T?0wHrSlG+>ehe&Z6FXe|Bo-zb)F-j9|1DUUsIvU| zSlHJ{t9Bkc5tP6};PCB0$)+P6A zXbRVVBi1FS*-whrC0Lgho;!(k{TY<6lUUdP8rs)MtP3;bCuv{$vb>YDum4`!*Ga5P z7_I+XXk9~LUEn}}@m~ogxLuIfTyo)!TPVb?&nZ_P&xy*F&oiK01w4bwRmk&3rRD{F`0T2C~q@$}^Wx0j5BAFfTy7VfK za!IU^6DMB*l?F2j5o&Xm`*NO=>b=&9ub<+iLh?ZUPI0AD?G*^+Cjgw~e&Ae}Yb37k zJ+|k&r#h*gcjDx$db?cTwo5-vrAjaBG$++PPMlO(tL%KFkF(sn$GBW)<9co8yQ8w5 zRNr*sq{{k7+h@2+^{71gf8)KU#}0Q=-RHzfl{L-oe`)bRZ_KIL;y>L<^+hL6D%DtG z%Wnk#1F0@N|G~-;PAad8A#qZvR@nIn#0;d8vT~eMtDQKhR5#f9oRN`A$~wbIB}yj3_|G$Ep6R68?!?Kbudb>c0L=oGN)~8|GO6hG-<+x7g%4K> zG!5KY?hEbFiyqxQ+;DQfOCs_!sE>x%*X?#mo>}f@`|DK%YFTeoT$k%@C(hvd2&`qf zC9V8UdFWZ6_~_qZ`#p+xmOF=PNl%@<_{Y{LC+B`Aj^r%AU)p7zg*(eF=8MFmcjK%# z&T>*c;KWI#8gKX5XqD;>22!Hz{L*_{MmwplcjBZ{{azQTpg7BI0&0@#N$;xfpY5c2 z)QOWyb%X75jw)*hU@fVJzxvQ==QybXSv7OUw?RKeeYP6 zDjc49`}}&nmZ&%?M!nrqiJ#>zvs3-Y;cx!qIHxSJ^d>(QN4eIjr_1#z-dXNz?XSjl zznb+al`4`}mWrcd$c2OQ`z!vl+)d)-_lL)GHvE-SR&{zD6&|pA^)kL#ZIqwOwP|Xi zP<&jjvUzi7)n8RuC~nM6D#&rU_S&h$S7&*Jo%4Xtc^N(n=PsOGlUhbqs;lPBUocmq z^E*n;Uvht~u71wUMK$$T&DOpy*CAk8VIkvgnKs=&bM~TzHMMi=>LxB&H2W(vZ?7lr zM+DCVgYnOweZpuB3+iiU4IQ!J&ia{G*UkOX!nt=cwi@QfrMln#OpW|Zs&{8y{Z*=_ z)N=N$1#`=5=YF;Bs@rGP%?*d=iQ9GJST~hV($Ufyot{-@^18VT=FYC4SU-7gy>G#S z$gKL=cg(H3>PzWg<#$r;1q&J%&YU%8PHo-%FMU*h&7reYPSfgV)z3XqY~5|gkI&$Q z=PaCAQ@dz3L#FbaH0#be^VyZ>x>B7qw|?5(uTHC9RGU#0NoUfGDGZ)U=eu)GWsRhB zA_qg$rqkatK6UdK)&NMs%5s(F_K8fx^4diUCrzJqJN{`s*`V^6UON|Gg&b(8iiBq` znltw*hIJC}jG(X%Vu*E+AjCt1qUw$G!fwwTmK1!=yzWGi?p!3mdg3^lJ$~Z2HuTTD z_G1)!!Z?EpJz?Bbq2oVBp(l(psL&I}O%;00$0+oKaRwEd5jS)F0ZOkp z88PPHSvR+q30rjhWMo?C`t;S;7Uie?3XgGXpX?_7d^6X^!52R<>m`>@IcY-9`W=&EKTukk|(}l^X-uNLH{$s*l%6k zSo~bkF9F8N-%~&IS2rSKyD8MaGaS30y17KHOojfEHzz&z&ew*GU+gZo{$Z^YfqM^9?GYMv=-G%7+{d+{*kR_* ztx(r%k>=g?PsDCKGdO!27aVr*zdhKR@TmJp<<{6>d#ele9YhVC{NFJaty(K(voYv@fWbGr9Rp+)iLXN@1ny_-WT9+j?EcE%q-;18{nO^F~KT-1Nem~9e_ zOOKWs#9&PI6&e~B1y{6zN|8jO=)m?CX|GDsu6kdb^NhE)@xPmY(LGG-pJn47dB<3G z>m%9ojN4z}e=lD@dqlv$7K$Go7itOGTmrYu0uFKvyj zl}R4ll}xpfPRwkhOAdNOrIM;K<692n1+dIC6Gz(g!y|hMJ zR(DWZ^WJd$f7c=fzvDNSt!l}}MTEmly4zcMEb8F#?#_9}yYCbIQ2soh@#JAzcZdS} z_;|NZ!Z+ip>&?gcWIN9Hd#Kq_>5W&VH;60opL_-1_r&)V@ue5um!5bEjXVz>K^Ga# zQ^nGt?#(s{Y?E$^OM7K}2im*sBij3)3Rp<@GX=pzH(T|$YWCXymS&^cwBoRCcW9_~ zw-)W@icaHRw64@m>PE1mb$@Pf#dcQ{aI)fXB{DI;mE{|quYE}_A4mqxJw`!8+$dPu z={E|vP0uKZ^ai6_mSo7!P6mpE(BN_1%2N)$9wkmKM|+Pe7XZ_Km*A2EuE+H^j_Xop ztM*f?_RU|I7L2~mmCy^u<%couEw}SN0noBA*^6(`o{!`cL>=)wNB1|R(WhEMm5II{8)G0}hMg<$Jzrvy#4fY5>hS}S>`y9oGq#geSEm_%KIZ8g0*RG zl8`txH%W+sZnd@vflh}G$0fvF`5$rS$kFMz9V-QgcplDAf28Ae0PLVR;`8x|^umXd zAAn3gg3$?**0#~xH$bGX#z%f0SH7&u{8Ho-!9}v%g5OEay0-cj4G`&nf{*-!NY7;A z_ndmBi1dQ(Nvd0)Kl;c3k$%4uCzWcM?IZQdatrP!sa_j@VBG+bUJtj_J(cQVI~7xe zR8n6__28!#KR-aE-|WOmrTVn(Bcqb#&gUupBEJD5eF_y-aa33;j*Q^|8MyX~?YRR) zdX2^Fan`+2qtd2`^r<}N&G?7Ab=+e~H4t6u=1OPVzhN$QZiW;v;By=@40M)hH4Elz zTFeJTPd_o&Nr+8^xogrL4R?N}?y5Ux)!k7st9I7Hx{r)nJ9qY?+BtPI=Mi<_L_Lt{ z@hKKMW%>L&zcjbDrglE3|BRF9vBBdr&Tq$tXPm@_2rl9*_L)EFEOvF_bwwrWFeYa) zA$Gf5Et5E-D3?vnvfamf{YB1VoH^2uCyM}}RRGpI_8ChE(dvwq9tpo6F%8^+?vDjn z`3W;ZpT&w(lu6}3nRu4~hqx`hA2Pu4G;U&fKm)r|kE#91I57k*B>&s>{P?o+h2i8z({Dw?Z^m&z}5I28H! zbC>Eksb?ylq)Gk$iMq`u-f4EP3M)XxyG|2nQ}KiabTK3J*Y@%wj7}Y|IHMs`i8r4( z581uo^k306*QED!6$|5NMrc8qExcG}r}Wn% zJ5I{CEH}4oaJbY1zTa&iV+>|=y(I0)N4%Wo?C*aDOIfNR5mRdkN1FQ^&P`US z1`$EkmNkP3ed-_pwgck5rXvJ13G1UK9 z16LjY5j9Kfge=_S>wh9_F3a|t_cu{j>;m;ojEz}JH__&PW7Rqw4^{CXg!&zp`fcT$ z#OY@_C%)xnx$?-DN1;5*g6(A$M3=$n7fw4v{G6}#C5(b#j(@1;nae7qEptQdeY^73q=$hm8#nj3v(cIU%-=iWqouvzD z_yJv^{IJ=t^2)*?nTO5B+|)QiY3b$Wm2QSs=WmwhslNC(N>qJ;g!iA`4*~N7=?BuD zs2_|~O_Y-A3urohKC^s?{^0Hmvph(1bSLWsG9he_H{lVC}eT^}_!>DL&jyIeZj4sP}HJlFVMU4rghGuPa zOI5}ZvYz}t$G=By5M|2sQ=UHM>f_1UNN5>l>v+>~l_|ekT(W|BTzBE}E0?U3+V5gq zI>jtpb_yqSh2tmkC+rdA(u(U!<;rF<>0B}cd!OxFAiftU-{cr9#MtFH;nXJOx3+^erNR|_lIz(}OjVOvUd9HkwW{4{06CtQ z+MYr4?f%a6B2qCL{^)>f+$I+IZuQOZ-R7G)W3%7^Lh|squIDLumIpgTG)TGb6@;}B|+Jk z%K(W$(M!p%vUvop8!KWJZgblBU~4z))&zIh{Dzxu+pE`{pfx2s>`wSLZ6Hf$Nhr@2 z5|2=LCK@CC1-U%K1^KeO-C%|b3WHX8_7t1eSeI zPt1L|^z?qq301e6@#S$ zF#zjS9>M-@AUXAwpb;+Fo;4VK%W>Uk@Xyw>Q8F%*0E-wg{w14AOnxUc_RFWpg>kFu4Sw9m}e_k%1y3Y9! z<)q5dE#iVEm73=&X2a9EEfS`hBF98sZNa5)uIsHt5Dii8Z>ue zFSCc(EUTCYvu5U6lK^3CF{GeRzNz@RGO?n4r_`NOv>Ubg_s9Xyx-WY)H@w=Ep=703=665EV#aqVfD>m8r5sG?h*RlW0!1zkdzmakmp#eS;1 zwqxv~46AG(G(awgz;D#F3JJS)UdUM19`tfe-F{Edy-Uns4K@ssg_*=wF}l+5?m!zJ zkSW{0mGXVRr3s!+5C2uzLa06P=OTqaH z8>N5Xlf4;geHjZy&bl%)pB(8s+r#cRMqc;Z8AZE`4kqi04kiTRK3;dRIsO;>3zGlV z6ZTgytLWJN3R>Sz+g!d~!Fr-@Qfhq#12>huVfPWN24U{y1_4OL#CR4ovor6pJmEek~cypZ41}C%#aMLM1i))ICXVb2k ztyrbxh{i;1(MYmMQB$Q+MP5cjumgqBK(E9!cU@L6>N><&l_0WBMSu5A@WGCn~efe1{ z^9TvK|LC{=Z57^Tz~d{y)YQ^Geal+Vd|E)utn5inamdOcHxqM2(E9EgiszQ3?*B{N z+rURvT?^ltWPkxuPta5mQDdcTrc#9(l@Zho%)l8u16VR(q>}A7}zd0{9U?F+i07ii~4zz?K9=^8DA{XC^ZN+y3tRJnuXC z<;EqY4P zeAZbkz!|z&AcwNOBlT@?dFf&qxR&!hn%%6MU3gJ;lOMdu$E9@f4x4?O_KIFWIpQpp zmYV(s7czZ2)5`_{{8eZZ?1~Von^Tc#;%V%1@yBX~;Cj+F{Li&YF0TIO_A#|XgKN13 z)E9PUTU1mU8alhus20n^C^Ma0I=M~^4$Q?TIy!pf%{_}>dF7GC?Ib9l>t#8_Y`A_A zzv3^;vYoZiubcQXsy7pd3!WB!gzWVn^A)l8IZG9gmI{!JxJdt|Ue36}rYqN`zM0;h zz(Zq+^dA{l=k2JobIQ1!GA>oZGEls@lTyi9eOR{s#-JMk8j_wUIyJdf*hhe?hP$vTu*}i%xeKPGQ z8mT6jn4GVPwxcev(O7zwPdchZdlx<~NQ|nRQAV21!%F706U}7iSDh*;6vUk3|ky@3J2g5U6SJIkvI$2diHzHM2P)W$MmV*PWhDdDl0oKIz(JEkx~eduLUhuGOuA(kJCr2GI;*ozlx#zde5RVo)^` z{K)5z{?hGc!v;o8hq?2B*|vj5&Jnymzped8Qw}~f?(e4k@B$+6!w-2$`?<8X0xiVD zJ_+Lu-uXchr7O@V<;rnA16cO_QdxRRH{eILJUy|qj5T8hrdycG7jFBql<9e%)jLzg zZfN*%RWRF{A!lSIekk+R<+nkDnZbDa1iQ4RF$(WqZ<>LZ$B`A#<6CVGp^AxQPOn{& z_0x+`qpByRyCYe|WkvMB-l!7AL}rMy76NFx0N#1!ovrFX`=e;SQ)gq`dd%pvM))UR zGH3HuLL2xR#8=k3DSJ>FeXdap^E>*is*k#(t1QT(uxtszB zP9^wLf)TsjSy&9iU+3c&dgq-jywQ9*JdDt zg@D&9xQKH4+nq0&Cj=5owMu2G+>9>BsFq6-lXpt;%wjMz4yxPb0?f2(s&fofpOpB9 zr83Us<4&;2cNrRPb?L@r)zm`jq<}qLVuKP1qyS5gJ!Ad0({}@27GXhl0}iQfUnvFX z*_UZfx}Dh-Xw?Xk{(nvKJR$u?$-fKWoj<~SCJ^`-pS0;>;;%; z|Mf)O(FocgXLrucorsZXiiRhO@1yfBiP$5H6dO5LVPOn9a@2}F`4I}tDqVOvzH-XN zkD5^w93+#kZgye<7xX4|Sn1Wl@!P7iV@mKrntp+T) zg`vQwbLnm!IUA)==ZQMLVhfVJr6<)p+z3%2YTvU60R3GN22`RIy}6%2C*L8u%ie* z#r1#>iqr8X=Bpm_{r1Bu?bZ}itrAI-Pf<7}3QKTQL5?aYYG04jT+fC`;GKCF+FQ8P z*=Gh$%sbn%Pl#_~e5#Jxt}BLWks9S%k3>{!jtAGp7q+k=5W4JTX(%_w*s6cX7bT4U zsgNnSLgv=>t{|lA-9|{aYCoY{ zRNjkO3EZke&l8%cLR$&x^7auLsp5_h8lpny`O=}E6Vm#!|0eXm)LSpIua3KokXDh- zCp1F6{Q;qn3W>S481;Db`Y=frtI&mn2CC52g!J1x2nAK#LPF&#^lL&971~5d*E$vL(>9~I*q+75o6S}QXAMy9*{g#l1hFZRwTrck|Rsw-zmxEJm9|KrBhqt2%n!NE$ zOI(_ecBO9kW38wK!_`}2#SDc_h?((Mq*m6XP0$32in+BK z`=ZX&B6Z{F6GT|fT9K?!vKiH1h60?mwUmQ$Nw=*=<|w&Pz9(kbAC*-0pq*_;QW)B` z9YG_4sW~4r&>FI%%|^|?^TSyw;#=lj;8P=BC25>dK6m!8oUckQ=Mk9_F4=9(O3D<) zD!5dyg5Qy}W1Oh~qCvOAmqb5gy>IKL}hB)RO@OlM_Quju(i>b3l>+;w2Yxm`wpQL4UPG5Hb`fk*2U zPZLg7<%cNauSg4!tzP1bP4Xu8=3A`9Z;I$jMtYGfRX-$wnWz~e(8R4eo}jNW^=?xN zePfhO{R4VIF6;3}6#sB)Oew~x5vJm-n8=ekyYlOz0sTtId1Mk1p}^M4bEBTdpuHpP z--^@YD2%Nem#fVGE%Qd@d6Jgv(2vjilIdx}^>k%7F7TNDaHefI0&Zb<9%*MqiFDOI zj{E$>w3Xm1I!1v-KxjH^1r8CWi{A(c zxSi#qboWs$?1vNotGyS|{vY)IsP6q!s`rxiY`5dRtiX|Zs`rnGd4Uo(rB{}%DBiSJ z4xw{qLyZhS`2afc$fpL5QMCx>mL4q;NAx9^SbjkFija`yJT1AR{=af*5+07*8+Ygu&TT>1(Wb|uD=2l!<=HL~=BDq0B6AsBgK+Fie1`{$P~ zc#~^XIyyY;TrH#=p_?GnK|U3wc+;ZZM9DBZ(Z8P=-`FzTSQF~kf)}?9gsgu1BkK;Q zVgpxB{qlJcPh-SW$K|NC@j=&!LtP_2>>6>nYeceZ z#7A8tQe7iH?i%rzt`VPfjreQVh}NzVN4iEF?HciE*NDG$jre=lh+|zN+PX%tp3VjG z@vadkx<-7~HR5E~h|jx5oa!3UVc~tA-I-p=$Ctzt5cPZ< z4gAemdL?0QTjTnr!$ysWd&x^A#@;jn%DG%o7a{BNGg6mIlTBSJX*PAKh-~Uo5!uwG zBC@GVMPyT#ipZue6_HI{Dk7V@R75s)sfcXqQW4qIr6RJaOGRW;mx{=yE)|hYT`D4* zx>Q6qb*YGK>QWKe)TJV_sY^v;XvZ+f& zWT?wRrP$U~zQ%)d{z&yEqxx;+JlSh}47oy)+Z*jrnal*Q5`YN~lq=?zuG2rR5qewt z6hAs;kWT(vy$EG|@MU4mqEv_sE%ybD5xax&3WL z2}74`uy-)8a^b}NzNEPRuqPi5*1pEfE@BfLnptub8!RjJ&j~HotP`tvGur;ekVQ0p zwEgT55gCl4ni8VLbYaLGCCwz34OzttGjVGvYA;@t4ar(IFuT%}yh`ujx>OIQi6+(F z=wSf>O*NfceWUHFYZpl)oSL8VR({s%Dk`s?D(%JkX%xG)bLz%?I>LA;bX__1mfUEE zu45mrW-3V~JW&H-gk5!=s6WuE)^Ru32>a3N9_8mK`&ZY=LJ(-iAF^2aJXRMhX$qD! zawiR!Z!Ej+r&3GB(xXRz52ERtAhb?gc=@rb~{wb$YzoZpDdD#{o~ za#kO6CLgZ6j@`?aq<~BsQip6*L>@D6gx#YzOwXsLe;ZS`lw;bDl**Uj8mWZLv5hw- z%C5N48Gju%C(+ePtN{q&)w=&vZ*;8drmDqlDFTe!j-`vFa_5$rDtS_b;D%8aae0&| zjWHd=nzdmSRYm230wqYOw9rMb4n;yBsoOddjaELmv@*S4=_3EfH9b9%_~NV&i0+#&mj_Lw_g`sVsM8sN5|bksy_LoR#z3+?=u3 zQ)~;1SUs==bCwc>>1Wk$QF`-9%SRD*=_)2d;_SlvxK+%kK8v;tkH2)O;2H6zgC`g7 zT?#5i-KfA2L5ZAQ$di1Nhob;8R6$HD;gab(12gp9kD&hnCS1* z`a5o$NlpR^O1f8<1=+FY(axin3c4(IEirj;IIb)Ex2Uut{x_^ZE3#p$h~y<^!C9jV z#$P%$Ep1B@0dl4Q&k@UW)U?MGjka}>6xOUzuoIYAffGjcRsy4)(4~+tV@9p2P=i^{ z{G!p$q)TU_%g|V4cc?5lbmX9luY($~v_%g{;*JXkzIm$(l z{t6jQXul4FpR}^Yv`6|hwI}-{q%y+m6#4~rYA6kd$COM}plk@0_ym=f=jm0DwdHwb zHD4VHh4fg_DYy2{?;TXT5LV!mc~??hqv?z;f(F?;ViUM2&m2117coXOaLBJ!lqQsz zqcq7TD9Jwe6?efKTVuvwDHoEB{m!WoE@Rg$=NVsknCakJ7(4S+HMiJ3+K_TsEw76t zsxRh{ZOHy4ey9LZozsQ)HC6QG))|KOLKb<4Z%p*RTtx2VaEc8s{@^6SI0t-7$fZ(= zs0~xBx=5t-ENPqTYpO2Ve}=dNXNWr}g?i)~nO@YzspofNzk$D14#05ZO0%03J(wfY zPjBENl7W3;M=E8r%CEmSN8-`v1i#vXu?i`+wL~DNJ}q9 zs$^?=uv&T;Yl=N?2D78i3~Y`iK@(R7ux@4@8V!6_F*VY$k>#1$wwo)LI%JW=O=K5z zj80Vc+b3767;Cz-fT`@qE46yr6!EK~Bc4`ihn7Li>hR%mVZK|LDb%-R(0i7#}t?54!?SoC){P!81;Mt^`ig`*>5Ov4sv3iRbbS!pa`-R8p4vB zF%PY5PJXXV>{B|D;~4%oqEXPS@I-IkJVKLH=m|pKQlbAOG+BlA5z^)LN6)0ot0bh$`!7Or zP{x~=BBawD&7?b?N%shgQ>{^akC1M`wM6I~vk2+(Dl?(ggtQ)PKBlBP$AqA3Gg9u_ zeZFIFGo5^4D_?_Q7rh|OlYNKHYDWw0X*r72@)G_B@n4=kVj;;igK>{o{09+i>}wup z-(G4?+iTVze8f-eLJ=lfbW@c1q6Y&C(~J+vtL)h@av+G#OPyvvUhW#OM0s1zzc=qr zo+DH!!BcAre@&=d#WnMsqCzKlY7J!YVQi%G{}e-6SSP~qxzb~ zF3tDLF~l)dTSaG6^*ajFr!15W^_d~wd9nhNM)z<}e#w;-( z^WySO2uvF>P)KFo zZj_e|Y73VT+oezaR)5U4U$2u0J5eWJ^&ep!`B)1<)@!lp$^Vwf&dRW9w$(1WQG~^_ zzq(FdCsbBdCpv=87FEwiT9WGhI*XgUp}K`!@)^8^N@NGXtBCbE0;g!D|(UBX_MZZrApku%xgs^gX9j9rW{AM0l(ZfEeOLBxifm@6e;@=9N- zTS<#SQafMH%gcGPN!Ftw{4t@thHz=V`jYX+D4H=*Hj@aF4+PLC}6@Eq&RqAIn@zMZU z;V@jeZcJ)5s#cOL!m1;%rShf-b@nCJQhM>KbyFj_Sv&Z}al2UTmTT^|dKuIm7sZtzWid;7swa;@m&UU0X&aA-Jd1rIK z9ybw&*ftBhbz8RZqQql$G?n>VkwY}`?0{zgPnI}2sze$m$J*I2>%srnqM*@d*#Pll zM4)Ow3xP;t*??xgHH~L-2jdS87@wz9@F?P0;l<9Al;cQ=@r6JtYU|C~V28#_Bw-CG zO_$=@7YIg4%D6JBPDy|*Liw_-0T@|F8znGEY_dwzwy12=3blZBF{7?a+oK{-*hX9| z127|KCV}YYQRTZJ(0jV^mmlR#UaZV=9$rMi%oJ+xXWk*F(4&GD<<%NB`BI*(GruC{ zhh~8?>M`s8dQMkjRCyzw=6FZGv1}9NScw@$W&&GSP3BxfxtiF;A42{Q;e8_bikLOJ z*6)g-$8fz~WO037UVBH>el_B6cH4*Xqmz(MXU&bezeWMoc(|S31*hei$I9V)l1oRr zz&f(HK^anZV0w8t<}h#tOWZDPc9SYIqe{V-Eof=&;4SQytgL4TnjbycX89Qq!Q!Zv zpFw+jaPfYD%JWig#0YP}NK*%gZ=v~u)E`NDkXS++6^PX!(jaEm5UedpkS4i;2l!-z zS0hPoN=Bbi-@voQ#uBj%kZCoWi6NKxG8}C%w>Qq4sF_#i;0U}d zoM`@pj)tJEf|y~rv>#2ptcRhy>k)L8$}kIFw)C)k*-KCAuXes7iHEa?o|_|64aSmn zv|pC6vn}Tb<3L&qzcU*uL1z?8%~69Y2AlOCa`?6Ip@?(qxKN_p6ShaGHK%2l;p)T6 zhicryWvcmFYI5dx#2HnthUYR$jyPjY>?}H(WUk;w)OqEZwnV0l9LTb^bYUM^o$6)n zK+7IbpQ3C%f--5%gqY8{6`G#gLGjXBiZ^XmDw`QFt{B;w<_vrCl&0`RQ;h2GF{o0j zIXe^T91CD6^Fy$t=sGz@%tHPlK~@-Kb4|697n9sd%)>Z4)27=g_DJ#+gdy^i7OR7V zv~)6!kd{uwCx%`gG-cwB64HXC#n{ttmlD!>4`f0o2#q5x{ym`NsVa1~(6kDTB6Noe ziSu4v+XIB|RB;JH(^N>j^y|0#2;HUPyiB~)Rp<&rGgK%@=x!ByEfe!kmkt%dwCe9|LTl%w1+y+9rHZf5csdBuP z3H^a)^0@F6C6_?WMjn ztga?BOQkaj>2$d#yOdG8={$h&yj`)D{p!fpvwR>aa&6)%%{lOR z$?rNn5lg^cPW(=v3>z8h>KD~c9xYI+<18y!KEo7MUDOFGHmjg%XyzfcO@IfoE zS$7+jcX=jFx?fXtX65Cmz#}RNNqhF7c|Y&;kRu0}< zCx<%S*vn}n`EW8A<|#>Tx%~F6oo?(W5+k3&OkGFZas*2S9`W)qm{6bJ zRSo-6reAHDH0c&TD24Dr8$zxDDx8T+}N`+b)_#WFjOw_03w59*)QjR z(&?f;eOZCHsMpm_bZakCxkNoLRPx@eJq?{M>Tl1aDRJ@jTQ^2ls|6nM4kGxvp!9ol z`(*m{OeRe_*SCc1_?*pufk%9W$b2;RLjRvToz@S@q)F%c8KukT9R3SDTX;&6*Ztdn z-s!Y{WhRZ}%JvQ-OR)lv+myWj98mR`c3OXVMde&xsgFvNlk3aG7kDIIJ{MhlN54*| z^^I;}Dvf&YxHKjQGz;XAoBAxe>77Q2$vcC4?9+WNO}pb>{8g*u>Y*!nFkKjNIz}D0 zbd%|rmebN4aN8rvbedOBOXI#!CFwNRxZI{Q*9H28n+BiL(^b%Y=$F6CiqbLtPK){3 zY3&J~mIk|&%tx2=Vdi(b7h_!7kQX}5uX9R1-F>*EeDbt@-IS9{(%f`fn%5=T{ph;> zJ^hn!9rH{MRPQ?@21{~EriJ(2Kd%#vx||`WwdeJmTvG8pr`2A4TADj@+9Mf6c1nMA zU4J~Su8pU~oO4=C@U)UYKdt0$r={t48ooqsOMmk7&g@m}zRHXX_sgf{-A5Un{=cH* zrwAF27*V-Edk4?_%1Ki(>w)R_&zRDgEIT46W##=N?~PT=9CQDCUEair=GA3W?wWP? z^oneE@YFjS=h2bbb7GY@Q@Dv&vFr@EU&n=-@>i}}6cTUp>Swy<&X{}gcYeoR_rxkH zl_#|6mDA@|=(Kn^+lu+K@VtL{rMR0{-v7baEP6fS=1MBRkFZ8e zZsli8p{OC_M|}F-vt~n2^X>qfcXbw{63qwL)2%xyD#Q29sry>Vm5TDaAhftIJjK$c&+d_9bGc`k}?z2mz= zn!ab!`z7o?B^PS36SDfGrg5%-$77t{{@Rf`05x;;X~Q@Frk zn)^EgJuU~hD;MOQw2*iy<*z_rLVt3x#^<{YWUFrBU77W1Q3N9*czIVECkS>TAadTd;E4~%DvLx%H zJ;>__9oEmZPx-5^#6g{UEq)BO6#wi-e73nvUbQ97@W0^u|B4^OE6c9VuC593bUcFX z01CC@jfkehNz?069g#`*tt&-v&wL&sR7#q)ZaSG;Re4ukB`T84 zXF7FmBh8?1=qQ=~RJy@e=F}^*`$W=gaMQ_Ds?!B>(*2SbuaV~dfx0|do2hi)x;m#` zY2S0C34K$i%e3#B-1ZIS^+eMAq-(mX%W}%A1rWa>%@r;b_^Io?CfC=#lousUt(z`W z?^S~b>6YkczmmMXUyx?aP5QUU(yAX_{1cWS^w+ZVTJ4HVUrMJNeD$|$)2 zc1b7x9kW-2lDmZeCepRKX{G$~qCuzml`NO|^?7-V_?M5ck29s~OMJ=894+EsKC*`X zqI8v{S@uuTndEOIO%Yoz@;RITGnFUlHj$>VjsTx8N+<2BtINx4=3hSlsC~ut&C#w(8s<=UeHdo1Pm zLdKlr3%ww8iUKp@o^8>4Z3ZQWoGY-%dNtTl$C<+3!Ixw}gpJ`XA!lL8nNV(T5Bc}c z>l3u!3I#S8OYu0Lm)!58S@F>X*`^8GEu2SGHh`a~tZN!McJ8a_fv+X;^}&x4^{^@Yz{zuQ1{z>Q;=e|z}KZOTo7?oVq zu&;%1iZB-#>^nTeI7$4;6e%D2RXWc@zf*Z4@eL&w{>z^Z1==eo29GuLHL4B@Z0!xI z5ps7yP9wzA6VRuu9~7TMEqkbCH??r9!pS`|h8w&3pF^2GDRVDn8r6?c8ZI5eftHF( zLUxOp@GcG8`$r~91xqxMB!4-BRodO(x=mL z+s{$m`effw?G>BRZiZ^_&aWL?5Kc@Qz_!tzpm?c@pDd`j26s$bQkB_;o8i2jq1yfh zV&WBOFsi-_-Czn=j8)s-aMg~=max4owKr@x2jeX#C3navd_3scVq1@wIo9LekY`JX z@Q@Hcd^&y@!9q8_9Ah|)?wVqaat+BhI5+w@TYTB|k8}!`kZ-tcEh&q1)P?LV(ZGgS z5`2Pqud(bu=w&c5_H&zCPVUcU`!a$g4% z-}Vg8PO|GvN%C`&ymO``1?eQ)t5Nk?eO>z4*tc>Sz;7U0>eHtu~Z5r$fozw zw{?&`{H1@^LF}VO74vow-#z&5%lCtPvk4y-ewC+oUM-xkrY=kS#_>!ZA2gocS1{Sc zp0&m7sK*zRX%3CHTh8QGqv`-{cltl9tyF_MKMZc~2-|VVSD z=iNV;qF8Z|R0@<)CQ7 zYf@^ec*b(M_s4TIiZN$kw^22l;=|P)KS<*Bst?5Ti?amb!TN(fs{p@R;7|W?gAgY{ zItEu1$;nR`M8+2ZSUgNz#`n=!d(xe?@>nj9pUPvEJXXu&8F{ReN1Z$x<_4|Eh&w8wKx%tVu)k|by@7y>{ zc{fmUeSS2sHMUg#P zE%}WcAM-RxOB9z=#noDFX#{#Ct4Q)sK%wY63m)5DcnCAFMiq7fCGZ;k3td$1wb zkkRcqkIGJi%ytuF-3(;5N>*KP^6+OJ*dG^uD-Fm@^JUhtF@J9KWJcplqy>?%8gCGJ z!}3GUoAJXpM7V!QM2j_{a|NE`J`dG~#+~A~_gwi&oOc{Z%*Rb!4BuOnWA9mfpj8MX z;q67bO)_QIW#k4BRmwPliwt6PM4%ews&Rzz1IyRW`Ia9PV}&o5B2C>b0>Y#St{b_{ z$e6lSeilXm38%id#$FHXF{-*zUGfPYNHi%gzUxZx0ELCU$Z9zj_CF!w9{#;~m%swP zt3oGXSV&UDok7|g0$a&Qdkq_*cy1h9UqY-UV$_lckSMv!EaU{};)m=@V+FRjiL&Lp z&i$61DEYn0{a)^VFLJ-<@NG716sZwGq0p!qK&ei(*v3T?&&%6L!fs&DP=^?I@#766vgq-NGPyqX)=T`H>sQFVL;n88N#@p);_qD?o zED-XkUd7w^@j~Or8&ty{tt)9t+~lzzdz5&6;Mv~V$*r(&>ez}XIy^q?k-W+yRdwq` z91R)amc;P<5R+}lPW*xxkd4D8W643n;wNni1|wrnMdHT`D$YjEP^aWl4`3skyg=I3 z@unI7@FXw91^E-I!51$gD^kX?KgoV?*t0!kKl-QN5ezwx{z<$>ggskB_Od?-Y|DMe~c{NxLV~@J;1u2vk8Oc z-nJ}m9d@i28);0~E`HJMXb9U|&A_P`(&Iv=V`Uu{vLBIB?2R;Tr7mwmIl>wKjGmz) zqiQWrY#co?jyvp4JrJ^Y#Sfh#h({r5Np5}cuw@quU5s#EQspM5ct+U2P{DBRFK%d| zDwRh0zdl2n#EqVC?J|`v65q&;L7&opM>QpQYy)=Ts?y4@a+pF_G}3ugl^#sY^$fS4 zRpF7fzc^27!mfExLydGwJ_^A>Lq^9bD{*rN0_bfa`+$F|nW*6K!=Y1y_XgD=hAjAv za+WJ|vg<7k z$ke5o*&BHb->w`jDdS)n|C`E00uo=OukfE2iJ$OQa57W1B{g>}9wegQ-9ozKC2r*0 z$uo@ETi`OE8by>JooYJINn706nzMmpT6vs1!`K0<+`(Oe4_Oxx^ANZ0#W$D0GuvZ( zz^Zh`8aiQtTdYxaC#+}2@}QqP8cqd|)fZG=6}0PvrN?1vTY~ZZSXG}w`p0@sh%oGw ztqJb@By5+hbz>Mak&Z2~eU^Wp8Sgl0)SRu#3p<4*Oonai*>=Xp8n64~r2O!yABE3K zxX^vUVY|)9^`FLGO*S!`$JYzD03j}t)+;1EET=vqiKRkwuqf$^Q!NZBiX$#4h%DcmWicFV!j z@jq&nul_%h1$8vAGlsX~W~1s&5T@8u=X`+3n-}bfGnIT2Zm&O4-cxDvSx zng4ixWdl!db13ix$hYQBFD{(NM;#b!aYr2c@kDSLhzZHGLE<@BfP)`GjmD*At1_fCQN;BpcAeP^=uZ9BX%xOVE?j!-KhS%tRsmt zZ4XNnkjN>@h0P*F;=p^()^R*`U|qg&BG-|SFgy+uKPb#mOalLpE^9KXMgkW`>{1!I zj9}#<3{3%!vmC|9owCJJ4-42oGLZe-GgRp^N;EzfTb_<^;(H9yQw-62m~q4Q0W0xU zddMg(dp7Dh6t>@z9x+%CDKZle#$5NvU8iX1qxPwY|GkLhUiup%BAmFmi19Zw;%STc z_qhX>f%rUUB#b3hB#ClbDgI&m*o1eT<>AWC*=V%p>_wTD+G7?>mVqk+{Evf=WzCRD~9^YrN{mEsd%cc+2@%cn%I*udBpno?r z3c8rCrGfOnM<~&r!^*D?_vuWIZ$^aCm7S^nV9z5Q^n5*P`=Yk#qp*la+Lnnni-_;5 z$3#8LkmIqsWQvucYSaM&nMP%>(al)8#l^-q04Ufv5@7&=hvWEke3w^wQU7tPK(SMW z8MZuJ%$x)>?OB+C9#gx)Op#zFk|_HlLheXo?OnZ33CX@sa6oSfef-Zc1ESv_C##&h z-e@KKfeH_JgW1~~4ZIoqFL2~eiMSD@V;T9PD}=#U(4Hf!S)YrucazPGQw5SY31mQ$ zg{Nx3FIoM{e3_FogBXP`aHH^Z2E3Kg$5{p9uH07XXk|8oq&>l9-?4cg6Ne>)oPf=ck#;$`4i_IoZp6$N`9 zW!S$x#xCwP#vb1bLgqMmeNhxiqQzoX_wVC?Jrd_QN(J+bPEg)R7Tn$ETlR3_6rA2j zM-As(!tlNlm){wOwqSUv#1(YL4I)n5j6;oZJZk&T={se14}fvg@hoA`-N%VO(5 zo5*69aW+Zz7!aB#``{?M(T#mBzoY)$8IID3KP`z;0@_Igv^`ot+s3fpGL8vCxQP#nleoE^fAwku(6yReX*ncu}MYBs<|cE+AlQrr1- zB}2~wzhF-`Gx9_BaAfff0&VI0q2!UjxqUxOAk%jjb*S1S_L0g%Xu*)Q{4&mB|OFPF68a)U5Sw zF883ZoSN@Mty+_F;*;Cic|yx2I;tEkm&{yR%jK}qDpuUyyurQFp-wHAd!Z3)Braz` zx1_Itj@WO8oaw9$kph_%seVq#zKg9%bWSB)9FuYRVb_a3Y5qX&uwMtyiTF2j1Da>E zN-XEaNGvy6v1u7~PadUMNXjwhLAtr>ekb^%Iz-^jn@>m#F}V0A_r|3nX&~pH8jpqN zuov(v(nQ6j>z@c9ht6b$>@$}9kzb-;^@(f$s@G(l7C(-*^hV1PyAcg{@* zUNwGP&vt7VA4nq;Wv>fV!v3SO>RzP6Xnp`LJEuJcZwa$0>3{7;r+*2KIgR*tC=3Kw z-z*5W-vtekogakQ8{hdCSfcf`cZTgl>193L9Zej8@lW>{lNeaUeE{rk;x<|({X~+k z_0AY>7Zw4Y(Aw@HPov~o+e6L`lUTW!&PhAMF7&G;-GiQbRWrq9YNm`H(L`Ck+lF+( zPp1ohx(8XLP&WtrEN6`}){dvWqwM0rs-YCTL0a>45BA*90+t&~{~J*_IR(H%G%~R# z3n4wiA4^!w$T;^Z*EFGg5Kmh1?~pWU0~!#)s=>W7qYFMRB2mcRS)VG1_}|S!2Q<8m zODz>Tg8n_JFQ@a1LiCI9u?>U?J~r~LfDArzfvoYdHjR(9;G+zDfVyk|D%9nGEn@Ex zfE`d+_(-VuX+S(sz-F!R&KPMI3fQa_f)4@P3P7BLWLCnZ0%H(8(k>>rX1ugwtHO9E zjNb#sR^ppNc&YAD&!(t2vyHWeoXPC@Wk9<`T#Z|aADqgfes>9|P*o%2M+QP9F{kSd zQTRQo7%Eg>^Ujx&S!dF#pTx-vZTj=Ku7t)kte{RnrLK-&=<3Dzfl z>M}sh&@n$K@`jA3>q7LWtg{bzEsON^XtK>*qYpNTjA#JTedxJ9>jn0HQq7RZ4Sp8vN1UDwA zE~O2loCo`P!^YF?qY8%g8)ZBl>Q^|bAk>eG3pWJmbl9^2qm7D5_9PK2#t$e#=7`#_ z(FufwNamUlC0`gdKa@^2)QOB?`QI>>eq910hqQ3q8Q;NDijp@FLKOs(-AM7Tls*4j z+2x7`^BN1SyB&n0 ziSM_M?IPPD!4((}H}V!=XL-pNs9j5AzAu!$G;?vMY5!^NR~9_hD924gCdQ& zL6OD?c6LKd@XjEO(RM7a0=$&AE1vi4BWl`bM*l?SoCAT!#VmETUwLS536(vp5J+HouM4n89M9B?hDf}y{9j%?%L;KB9=3! z3G2OvLieB;ANV%7GoDfX77N*+v35|{SUWMF$2c#0Xct*{hmY5F zkNE42B~OvUObqK|CGIJR)c++PanmpE4kMm-BZ1G28b{vi`9z$2#retJwaI>6IeQ7d zXku!2TmTMYpSF9@xxrrl7G0PTKjoYIePc~Uhh&)moXo_(vHo6IVmk7z?l&>kA8Xqc z-`vxFZWURQpYm8;61&V@3uFAm4f7kLu46vd#E2zqvw%_kSx*XGyh&hl8k6Gs zDrW6r1Kf&`LgO9X=HG)5ZR!cvoHp!5)3cAw`$lTLzT-oZFDS%`2`k6XB;1=YD@PUX zMVOVN3iqu4kd>nf`szPq<*0%^>OW-V_?dgn5|XO1=HEKx8i27h(pcXSZ@buKCH}T} zgWp~+9fn<%Z~<5t^Si3cNoU#nXwnQUA=$lAmIQMHNQ+aji6ccH!MZ)2joJCYFNPqY zzGsGw^?QSDJA?6!Jwx^rqE1Ub&V!6s1``#h;-|XJztv1!*OxeRS{WYwPhH<}2*j{V zJ~SxO^B6%^$%jgD^G}dP@}UwPET}&OSC+_p6j(asK~GG`HFPl6%vb2Whba(>m?_Nz zr}1MKk4*Fzr3zcj@5ML!?dPOf(94`K>e;H{DtVLX!77<8{JA4(>o_{OqjFG0tSjGy z9m&Ow36qY>p1t~>7&O*zZQCBN?`bDQZb;%2NXU}$+L8Qg57pyq!in2X0l#kZZ-eIz zBEgtx{hy3@K4qKfpn$S_r2gQbXwUZ~+>J0MRVwTyT;hfcFgV1wri#xeT;zt?J~`;q z;fWe0bE%bnPo&ilT*Ur7({|dr6P>~EMB&>sBG11St%3cRG#kgFQ{~pTgzVI9h}wgqBF)ZMZ_ohD9elAzKy0e&rw#a+v1yHL7PIypxL-g~x^L z*0$z&%MGa1e=3FA6PmPgoju)JBDhRs2r6{bva9Rly)(Jovj0l!R>@1}*NuG9m59BK ztHB~W_sfzr$tu6_kr_d|H*3n!Bdo7lWhMGZfn_s|)H6-W;}cW~y#Lyk|M!2wK zDOOKl(psIAxl||3Bs+(U%sSxQ?`z{=UX zaz@zp7Df}rh0@WLx>-lEnk7kBO49z1u*UA+C*s*k%1Hu}jT$7V3soyxr1ZnmiW-pB zD2?wEe5pVIIa*>3jTRY8#PNoGM6KPn#1FA_>xpMSK|n+JZ#Y+f@gqG9kxftl3^4|3sk9SRSx!W*$RlC!%Y~nMU4WC&D)7lj!QUC z2*s)vXQR3k)6KeDsPlVUY>akdTcZ#SMkl5%d#93@fGn$C*f2|Q_6A8HpdD#@&lhYf zu<~-!N*3Z+vSo0tsmw0C5-30T2s`HYjf>hTQFx_M)sRNKvKf-}E16e7FG>=|w7@Gmr?{C2C8VOxGmIs`rpDmKMwc&vr*NH9kdh{_F}c3 zmvm$U*`0;<5Y|l&u2(N_f>T3jL*O*!Sf_|_5m1PM-tM?4lD3`Dc7iZm$;CVP%P6}vt3o>N0;92vnPx*mh9kl z{6t~M`Mpd{G9u_ddUI6F9zl;Qq zR|L>CltuzajH>UG7OfMDcj#kV)W0(<7n!xP$HuR9W~gQL?Slkn{eAKrU9w; z5)!O|1dj@())b6Q^k<9j4Ye*&3^&6?5e$Wk20cxTD|jXx>>N^_X|(oJDJYc5Yg^~o z$_&>t4CN@DF>U3s`rIP?4#f)V%J5mOXFl$ zph;CXVuOpFpnq3VJiMPq4dW$JXfa-g6=1a>=nJXgyQKX;PYrviQmA1k-~X4Wf!)R| zTxD?F8;ljNU^k%nd?B$FLJflK6%czG$3hw!#jyVF8pUwWK^n(F4;!*FYv$m1GdOk! zZR#fMM(gOA`&+P*x(?yQ9VO@toe3p!ogcoX-C<%sCK*!aVWypxGu6Y=FUSD1X)+ZX zki$lT!Ngn?)QxHc3-uT^7xockD`^I6Q7H$bn(dboX_?kttlLG)vl^doT{ zPr7qtUTJD-(B`fL&FYCbFEtkDnbJ&~``2`G>b@4CPpYM%QF{Y2T_;x47!{F@L7R;*0v&KBueCL7cGWc`ZwIsV&`17kQ!)fuP70}r>1@EQ5O|xeW{;Pqg0NIHD z0R&-vVpP2Z7}U8>MEMP-AI4G_;+{`Tx<}L}3e{8?^uL}I@4S%i4T5u{raQ%E$UrDM zy~EL}jMdJB`P+mdAQmez?syhQmhu$ZuT`zNTuq@IT~H{;!U2@C4DfH2{k?6cqZ~#1 z7o*$?>@?zv9fNMgj-AOFbjxAae~Rvbp!>alh;Fn4IY<`Scr=BMJ0SLL(UQ zbFJYvK>^;TN9+L&oqY6dk&;rHd&-z2lQ2(L2Es~6FMXoU`N+64*&m!AWTWpo?1^S} zfkkay?{dNkUt*RHv699?nmNe8M$>wvj zV{9hPVLwG`((540-mRB;A^UuR_ag#t0+SvoK&u@MY*Z{#O1BVVE5<-2Oi(l7h#Hi3 zeVQ$LR|IPdG+&IdKGr<()l`1~e8YU%ol;B^8|=?BqeBi}_BAilGPbgL7f&RbV>NM3;jP?G-mzLmyjBTaBt>CE2#*FiKY+-({9NSZ+>@IA_B!C#r4-9#e9A{ArhI{zfxR)|jx%{W;^uU6+8xG}k-; zTs7B(x4a|6s0%ABP(wl(oEju7Du=-}S!}{E(~C_Zj5OC=c}A`Yoh14j8Lkpvplpt)V zQt=p7kMRS5uqc#kS^Zm?pam}>f1R8r&f=u6B^P!@w0I{J!a$dw%NZww+5$UqSLt1|mp4N04j<^pTpT;%c60Uhrb4?k1ZyFHrOVm~f)iPo={oX86rsgSbq4P>oGjXGl z{&jZhHWxr{%>2>xL6k^DOF6U)xvR4Q==woL8N6DAlT6)}f&^~X+B}c#0hN)XR*V5D zg4w-q$W{w_VW<1yD-*wfo#u6Ar<;VGp3GvWo1|lDVWWjJaiV)smd1D@&|+xV{+qGn zHSnhoyU4lExEzy>x5HG$*Dv_?f!j7M0^3{L_QVgMS5*g@SksGowSpTyo>(r8mjmz# z^sshA{a;y+zH4%Aj{mbDw%h*qSSnb7y=*JU$^sO(S$;M{R5@5~7liz+sq-)~5N(6y z$Mi(KiMPlSL!Sb&)TFpTjAraZMqDnr6IFb*SVxIw>YxBVm7W|Sc57w6r(Pf2;}@d@ zR4tGN9qF`cl=V8QRhDr11&Kv;!1Ofh^q>n4$IvFdE_ZZd7*=D#Us(Vu-Rnv>lg>zFcV+mEwYV*7H~I{`TL`t%VEFz!kVPF!l)YxAIxa@?bJcN5=t4D)qv_dnQJ1ERK1{?5 zP@}aN@ecaLX)UAr7y+S*9Bj*E3$nARLa-bL%U}*wH8@kc_L?+h!7;s9B+q#!#01`kbN6 z($1CQfmvX*Ghe z^xeNAx15dF0&#wzZMT>gYDr4z6bHkRf~CB9K3#U|`g9!=7UU3_cLnSrtgs4Csa`}O z8aImYm~vjnifvvas&OCJO~8(1mOr2|lPxNT)69LIaDjAD%n^0cEX{rCcv@j>aE0s8 zgc@lC<4VU~ZmC!`?Mg8InU2YE_vHuvZEBlmmQTTWxtVpiROc!f52+?lKf#I#h={1s$4(?o@{?4E}Uz zZQpe0?hDc(>%w$sB{ocMx=bi_aXRi)Ce)`S9oNOyL9FvTZ5_m?1GWw&e2J}ttR}H! z`XXD00_0}oynkTpum=!`t%I2uUVt%TzLhBRsQU};YDEHxfd$Iu;lCwar_IA}`N>W% z`kl$}hlS12#GLM&Ugvn$Ez={}yx%t87`JBBC=hUqHdKFjl=YvZu6eC}1U6R&sEzaglW zyWX^cL#Z}!P-74qhg7ib?O^=Xp29ANmq{CwOKo~5qmMWZu@4`Khi zG}kXC5z6Rcrb@@=0^8*rDi^~C-nGmfkuiSwCd5^Of{+P5V!vf->xWj?`e6YeI2vr* z6~tU7xklRHT0RshOM%HHbnJqR^~3FOj6o!Ftshv0l)DxXw|5r{2&?B_s=d9NSU?~W zNmyAxxM5`h;f9q3gd0{C5IXEyK*)I+n!O;?Y?}FL5Cf33B9 zduMB`DH2~iMa=ICZ;^<*C8Gb`VNZ&Lt04*Lz=~#?&{6`^2U3A#QuBG(_TA;~vp2@p*8OB!>l$Cai>)LLIwD-Z>KKhY?Vbp zwGgOc9-0u`*N#R2R_YglPK#8j)-R)^PyI*HyM9VS&e@t>V<|9rM}_c@Mv~hKMDr)s z16aUF1Lg~0z4Li>c0q6*Q7LlJ72mar1)A$-jOxPtTC`UXyLoS2xhaf+HF~s~|CY&UXw+xatR|F}6^Bk>8!A>})cjl`$zu93qimP5+l^&ElRP#i z{=zFVf}Qj@zFu%uE~qeS4l#dov{GeHEciT|9Wl^`L<8?uOrR-jn!GCtBco~;1U2G8x~3LRVo-}R zIp7HJeMl&B-zy8)6Gr?(Y8ExYm!-R6Bvq{&A%eGJA({p7EM_#aKe(s1H)By2<65iA zQ1UXyni$w>L}qi4VC`rbC&l-xoUJmrJBQHy9$u?a=Z+Rp-7?;UMnbk~25v-H$#0R> z2^~m^Cny(BXONDVRgdRj;Xa>Wa59$Ldn=*>ZUU7LMeMho=cJFWRX{V_dgv$p$oS2e zY`8W7{#~|8l)4Ng4soXyXb#NpNe!1W9#dsBF~Ariw*FOT`q?hH5)+q2Q~=jWooA)P zJ0!PkRI7L9&_zFUhtPM>^Y+|3#VVFvzEzYZoev z+8<#Gq4CAsqWPxMs;!x%m|uT*9B0Z@l3;B=X@N9-VLN&aAX8NNzp%rkNKCwRDa>>k z1Qm}8dG@etmcx?aY{A;7vN}^WDAcF1RU7qiG8CU#@6P=#V8cRDtZ}g1|EdsIX1FY; zAMp+pXpTga&P>e79V2kE3T_6R+!767e-Yz=okiQ|- z%RYeu0Anh>XZu#fDTZ&U$wusU;_p+vXs7=yDALZ;ER61tpMl^#CxW#-bF|Sy?GHhy zr>meJ0xNV)oaELltg&KPHic3@ELSO`83kts7@g`V9zO&1bJ<@L(M@qrW0^mP1f+Vk zwsxYeM$KYP2b`wqLI=)$sA~NU`~)JoTl%mTgg!+3cmmiU?9*|M!X-a_EjpdXU_AS}jXnB}a=O4$oKs z>dy=))t6q8jt%%rp1T`{-E8`g;DiV@8!X@kkSE-{MiGKGJa(1k(TTX@ommlqJx#Sl z;mTPm7~QA#W=`QK9XSp$UJLu*QkqaCxF6S{AV0)zx=XQ^f4`VY%0Y7+o~4Sj^`X&; zN=aUa*|X({CKTVlv32@Vb)^XvEuV;WX-%jrgL{#|>uS$}hD{}^Yt^;j7!C*%fH_K; z$jAVORO6%!ttAyqXQs3|WI$3O?*0p@IMlP*OId2#JD9E8j805VM`2y@32@cmx(@x= zRQPyhG)FgWzv177W*Sv-E8rKfuzTQVjj7m)3$T>YsU%eZqK&2+9PCwSn{a1Bvl-ZB z#GjOr+9n>mZ?KyvCvl5swWrdb-5s^SaHV3A@u6znYh=`2By1LE(p(BYL4%1gMh!ci9$k`wM_Ds&?nCLOw!p|3-2gv!<1W?x#% z)&qZhS})ftqx&0{(fECo(fECy2^F1_&hZ6@F6DGBidc3yxgHq1u6Hs=Vk@pa{XFc& zn8$G*_CnAhCvB7YbiqYUQWiAnbFv{PCTjRO&;vFn8~;ZKWp57ImH*(RtUB6=Cys}x zUrx!ge400pBSdGll^;c^wa7?6Qb;=WDjN)^h{p2k1Mgc;W#%G<}UdCy@y*s|;JV-*pIC{`Z& zHavcamkA^=JbwI0q=>|v_J~uN*N%g;^~d9FE%An)92bw&AHQMKozEQI8u8#|2*2ow z8##$GG;E(>X~%+YLaTQEfm;hSCc_3%AdWv|)ykdGMwJ+TD+wctUlYGDf0%P?)ZeDJ zE!&cE)u0QqWG|Y*fFFc;f;hM35Rbd1fMdrWM)B`~V@KL=cE{=1Agkva67EJA6_yI4 z!rEWrhEZYd@9Tz9VeQA|x=N#bpy_ZL4zko!ovv>w@HcQeOKe2z+v#@u(H*kUt-GvT z{T8u;lpf>WqlRqszdbzoSa9)&;^qU2)kkN7i@{kTwr~F?X`Bh|(ZoG%?(tEa+9_8b z!v-k;{Q@M|rTm0GEfKUolU+b0Hj=ZGAN9X? zqf<7>LI#QlC@ft4zEM4hz@|Iv+uqwW{Ij;b_)>fD-@WXl1~`2A;J@Skp@YDrfA7J* z?D?DST-`k%My&LeH7BprFz-u0rFgDwNE zmDev)p7NIPVh_wLdT+Y(zjD)!vvZBoCdExs{g=i_dkJ`dff?seCqbzbU@&L=Vxsn;?m+l@HyNbCh&hy@cE7u{7V3P zTmiNfz*>4YFLf@C%kiO@I!g`L2m|3m&J$fDAk2d860b}35jI8PEUj&Oacbl4GDw*< z@6dHlg!(eae*+(iD-SN~aCnmjwf%Y2|2BuLLw;O+?qy#Ok>n_pzcG|3{yXXN1mK4F zG*g2^QTyJY{drIvdAvirH~}*MDs~lOgErmyBZ2e5wjE+__agx_GS-7X!h-9s2pr>o z#D4I0)m_qL0w!SZEOK7!}#~+apkl-m)B%M6L1Y6 z6Y>ZPt0Vg+Y`liE!4NEgA^ZL}d+#3~Rdwh8&yXMisW()#sIPIB@7|CosDAER=3;McH3RMZnwHt#2>W@L<87r&{olQ711i= zSPN=NKr!Fv>zsS<%!FXu&+dLdpFj3Kax>@N`#!(l=Y8Ji{eGYKX^7*jQ?BLc$_QdE ze9a}?Fl{poH`C6#M@iKA#S?u`;N;1@pk%=o9QrzABBjolaI7a%##f(2FF=fPK`H72 zwvmJbGJVzIWEzlj4Vg}k+zO~34W%|4iOi!R*11PRuXB%vWal0Y)y9Q?!X4?Ax~ZHJ zv%?aj?1xoATvcm}rApru(HyBF)87O6&+>+{V9VF}7~vk|HcQRNtoR+iFl(})T85A= z-gS_9;C3?)V5)F2j(O!kc&(BEKSD+UHd^G!Or%{3bEb0HeQ3)OFNoP7^T-MWnQ?*>}WQxhnXGCCKxt5niceFIhi87 zNtJ?G(zsoaezx*=P=iDD?(>np=Od|CJ{7o8;-nGgI=noMGc}d!I^w<)>3R)X`!aji zaQ?`cf7pGF(f^k3Yaz;PH^#d0$&LL#s%_qkr%8#eU#VZx{`IYYbXuhe6QSMTU6<|Q)Cmd3pfG%sy- zGoumvGBoO9^b}t%i={7~7)xJJ5lepwIcpMTHok&iC|vU<@wV>VJGogdEx29&*4^e^ zhCxdw5t43COqzRJ0zvzx8z;oSslV>s+5Nqkn8$a#Ds@BGt5}cCy**ZbFt+K}zp_{N zrFZY&8b^GB1$xq{!|gRWlt0^j=^eyGV3e%c!E5BBb2r5%%?0-k14qpJhRI0YuH!YF zP6Bu<0^TG}zjX$5TrP{RC4h5UXKkYiyzQ+0I|8_V{$?z^mpa@cW)eO7u6*8wTDMEt zf@X6K&Yh|2W-^%yVH&*wESbMS+xX^eC}Ix8TK!dhL+mXMqhEGbf>~l<5(efZoc9QZ zDX(gSaAyN%4D}ekZM=2^daDH?rokx*tPXsb1R4h{**8G_m+t{gS=G5!W7viOA9HKp zo&=h#u8ayawq2RE4+AREUW9?y*rOBSN2yeQcin+LR7SAadrZmK0NAvKB%76UbWIVQ z<>=`Ujp;Pmp6<u&Ai7y(mj zQzO#7Rz+Ry7uBsgA<;46XjbJEVqYI7=sQ$e0k@Mi$%02Jgi1`kIH+jGQ4~3((bR*- z`dHWNf}U}wpzjp4nyu;1B6jl5I2xB3CzvAF-PQL;`8l*j9^Wo@L}{;~Rb-tantcAKD1nzKReM(cvx{j}YL8eCU9l$#O1uMg(HlpE+7xmJ$arudNA zx0?*9f`<}p=jzI;l~2D#)w)H=&c8+7ar(*e@Y~&WKk0kQ;u|Jf&HeaHsZ>9{ijJQi z>fXGsPv<(R&ZE^$^VcW=y2!=}X#+E2nPw1nU-#x8^ns10IZfv$+6^|g<9IXKez^;R z+|~Ek`5hC+;JYf}vY1p)m9frw@L3Zr^=KKZum^t|aq6C=#N*W^O#uR(p}X#ezHL&eO2&nGy(=HW7Nc!}Xost)l*{Mz`!B~A z;mOG`M+mIm60A{dh*s{8ni zyqF8;7~{UCG=baYn0rlG%$)}v)~54VMa*4MjfPFsy2GG4F*=F1DpoeV*Ax)mVZYQtrg*?O4* z^?A-@BIOkAk#ajH{K*(u>1ZZ|-|%*xk<~r7Q?Q1!W#eP*tR!rQDpup0k(#bXw!5+) zTPn%&-!#r-Qg2e(EhAC$ z3me-jFYI}r5sYVh<(N9It{u82D*2PX6_)WogPKzn@MYcz|FOnebeJ{Pfu!4y#ia!` zZRE7wag>^qEx@nqWIi~^12}ss#&k(z2!6iQ^GJi)!#O4J5M*NXN1m-#Kh&l~whj4S zX_9!Q`8ArkvaU4;aCBgj!o>*WW$sR=b-cJC?SSI6M>f=0V=a6B1pU&hjdE%EK;obp z*Bb9)^aFo%JD4Ns3$!vO7XI<>-Ea48!z*5K8ooj+&uE%$SbLcb)ADjKvis8e`kpsp zGUO#y-+|?+8YwBscUby&Azz7p2e%2Q4-*}ITwpq+V0;?7KfY97(`*jfDltsDsC)N) zx$H)#kqvGFY_!e?Xi}b!5Fk@@C&F)I_o*hq*BBI8;9QdU@Ol__m z)IRiK@r1&bk+U7Oj+J$)-s;2|qYvxE38oYC!Qk3VCw|B4#HR0e(OsEz5Y`P)hh zjA3Hi^1pPQa(05dI^e1fx@I9I;LKme{_;y>%=UG=W+Bz1oK1Pz| z57UiMObv1RWnNN;bh`DmXi(YTmTtaXwq^|1I~zV|9K)g>VPvh49~om=R!aXb(iv+- z%Qq#%>{?|#R>ayYY&t#}ehU&~+9-?{s9z<*Pctp3O!4p`3bTuYW^UuDF&RC2H9ll| z>PK?OK}6)}28>ypp(L+2*vp z!h8ok+CZMzrIk5tvZsQAYh8}*M77hVJzP*Al^H9^UVfa7G(`PGYoh{1Gj!0E%cY+K z%T6!8RtWbsP-1o?k(2tf61LNXRnjjV=d^W5!=aL`NzO-Iuz3UEOurzD@|)*c1b5j1VgY5qZO65QYmliV17v?PDR^ zx1S+(w^lfYdfp9SuPE8w(8aNco9`P0b%OZ_RF}r7pvEIixoZ%Vgosh4we>yI!qt}7 ztAI5L-cZrIi%80c72q*PZVw=u*nt*RW z@hl4fJi~Afu{ELbkt1)H?PGSA?ch$oMTN1Q&T?R=PL~Gvf2z}^J2aiXg#g9)t2+Jn z|37s4puT*}_C05|C5-{&xLlV$Df?aHDR?LdWl~Xzovc5uY zU|RE{;p5ppV{|Yv!EuA-tj@H@Yqq)`m7^JzDuL4$NA(>?@L}1Y1S*UfF{vOY0FmrhjY+e(-)=_FSNHpFH?gRm=g{wd}=8zx&bya0*ZhkL{^<$Eh&ldQ=$k zQ26$**|xG5`kB|*7-mgu{FoT9WK6md5^y$-O-I_tthqLgW@Mb=lE`CTAA82*+0&^Q z`=-o9vMK;lZSSi!ty{;TT7D!jyUg|?YgIF+;EsaMOsy_uCvLe}%&{+t7lzHCUw?za z14N)K(Xpt{voA6>Oc*qU8b2qK*LAnDexl#SqOpMR^i{}y66H@t+^*=Pj!wRaE>FKl zA^KXhc{_^2U-KA3Zxu%>XBit0-LvDd5?6xtoDqoxfTMe`^t5j(q1)S%keM__Kz9DD zdBI6(U#=O!MP_c;;W3R;u67#YjaO9Y_h`}YW7H9%-_owa0YH|I62aYDK)jC{L~xPy zj1uwg7t{a@a@7McJ5@S%JMjRC8S4E2j%aLR`CuGmS)tSfX2|ygMMp|aQdm3P2k9z( zq$_4djfF8nvh1RDuE9}u*tsp&;CD^WWR5M#>%Xf@=@t6Q!7sb$HU0IdRzY@OUQ`a^ z@!r!L*AbID$`5dC99`q}Or(5==fT5kXb<%=kBSmoudo54Y~!7WCjoRxqT#>d06Nbzm4s?}Lkic}W;o?Xsb^{E6MS!h=&Y4upY^__`yLGq5MU9uH=cnb z>!48MMe=L1u3Jr<{;3_y#&Hn#zlrjmsQcU`Lk`$*k0XXorED?Wn-4alr}XB7hq2rD z7~<^Mpc1lXR3)@ye}7!6E_4UmR@KY*SFNUmUJd&vG$m+RR|(7Cq_u;Y5^fX~_Cz4Y zP&6(T%?G{mXBQ{k-+L`AQavg=ix)~A2UtdI!oncwZdWcll}m2oQ7&2t8(Oc4XNRHn zURF%nKKY(5AEL%ixUtHslZeaKA!xtTD%VRM{om@93pN^=OR_pP$*dfhn9;KSJA+W$ zGQ6?b4^jUxQ6ng>oVHdoLg!YqwF8BGtC;pkA6s(exRx_6r?2jBjQXOE8ayT1`C;AD z&{OOVjO}QDtek@x4o1qibA%e_M?uS>dNZHG?8flf5!u~XODFn91~-gMlMcLgqWo#3 zO%&RZoG4afH$B@+Z1at?1IS**Hc)UdF`;_Q@<^p*1dQ>4wO?onG#`It0kTMhZIK0{oOE}_ z-7N{M1YM4~c^VE*`Unqq&}h68ce^nN}^UirKv>4$2p;PDHcDBq0@#xTPc z*H=4h$I`L!j@fb?lTSG8CKO9ww9VK!MVjeRk+__d-K?&GWEeiaAJ1_(aqP<`_e44DoA%wqj%Z8jLdsf!w+azD}Cfq41bv;^8=b^5Alt^1p&cc&L(?v}o}3?SP!`*$k-6Mz@rSl=FAbM1}x5F%t! zk?_;m57Ato602^X)p+;UQg76FPe8zJ8b8eQ#@G7;I!K8AH*XPPG1ZY)=Y9NV9ZHr?$g+na;$Kq{2g`3K+^q_ zIs)$eCxd>zYGUx$Pj{?Ms63vE#YsHmW4LYtyUn_SL_>}nqV3MQhfLRP)=<(;0QS^99W8%6 zQS+EakZdx@g=0A)|xs{NY$|9LEcFaqhk#XFT`jDG4?s@P68@w{I9T5 zikH7z?>^3S4tEu=*$-`&8S+4qvx?m$SfRr|`au`X_NG8dtrhrU88V9+=)-gtfoT%t zh`WLo@bE(Ho$;w8xwsI6>E5oJ$08cGh!J%qZ#J_%9@T6IrdeZ+#*oBzV!-2}xgHWV z#H9%>5a5X!Od*)78l~P&4WqZ=&^(MY>p+Bfwzu=7cqK!0woU`d@9f*@?98tjmEMXq zQNCT>q4rQ?p!nu-QLY16e{YXXvZDq%>#Ti?Hi&mz0D;XP!?puYB;EYcJWt!}{Q)go z#P=A`UZeZt+M~IJ!`my?UpdNGErj@f-fz{r`+6B{#W&_UY{*WChc~mAS!3N)Y5m6` z$C)@N>f=Y+$g8un@Nwq9s)5TfZ&zWm>JM$38!Ce#vr)Iy^sej$-AWqI5JRm-Kb$N_ z+e4NtU#Y%jSpYGStP|o(pY_+qJz+N{NJ$61|Ma=n=vTB_zX(9}v3nLnoE_ zq1i#`M?q+F5PBvE{UHeT2cbbG9Q`46#J^2g!!KsVag4THtWdtYi|3d58wERKYgrVIDk8Kpv`G(qu!9_WoB0pJ1chgzwwBfVDO1ZY#XOzmhs3# z+(ng7SOZY43$#gwIRITS=MThdI%Cc`@bOpub|)&x71H4te?1>1heSH@+f6b4VdT-( zFSJ^F46pH{ub2JshZqT!VdL;1N3mjUgy|9cN$S`-zo0DH@m173oCTH9+7qqVY-jEH z8qgi9`f}$wCh_r)F*~06n)rruEX#P{_6NqyGimoWm;3 z;~*$$9!V^`wJ@zcoDnsZw3ggaEZa0mreofWZNhT6z_MGCwB3k~8*(g*>ntzsA_n4@i& zWd0;f>sZBsKk{O$9oxD7d5kANkL~O{%IhAc{!Y56&a)g>R=IO@3;O3}TvXd^>7rG2 zc*s1vd$ZfeX_b4XI`<}0YV)LeW=V>kd5hLcjfjVF#H;GB05!AcV!l~$F6dj?X?f3- z5R*xDkZexXsD5{=QPX~-rb+eJ6k+A#;Ckb6LJwO8GAxd?*N5T*4<{xqpPeXTSR`Ej z0oQySP6FV&i=EbcAWRTyh9ARHM_sgZYiJi(Z$)`Am%BK04gb$Ip*hUdhgolkR=g3eW7gs<@QsvMj-%31r*=4Jgg=@8aY1EI4*p`$}Ms^cvNel^^S zF%i7?%Hnv(myh~1R$cMbBS&G`bt?OfCLv*WzkE%?y=x8G#N1m&%w_eNaBtl}P^b7g zYwJl0GpBb5e$oaH5&Q(fWcZb2_)qu`!tpBJGC9~&@WzjYe^3ZV-3$j(mcSjeV0OcJ z8R7>cKuhRVyUN23Mzkv zvXBYG&2GGC!1=}I{k_E_lj&KUN4GW1ri+c8PL!zI&Bow_TUYCBoC(<0{X5oljZCCx zTDVSU<2EO{mA%7&#GH-ik^^;%5Z3Tv^%27fMIhJ|)5#@jKBx>10~S;CJ=q_4!n=i*X~xM?TM4bxw) zhDU^SqeY99@e1^aOyn11pf6SA8C>svdw-{_w6WyG&^q=&&RF}!{W!FIHn!u{SQr!0 zJ;N}190orWbLx6^@+F5iIqSY==>FnG)^eJ(QO9HGnVuUe9C=Ajz*;+BvjOe^)?TPs z_=i|~t^x+DuuE{~?lFE@RBH6Te+Hj5X;9|Q4b%l3kR40EXAxT*)wo6fwvW=ce^}%i zJK5rd-tKQdRoiep)7dC?)9n-S$03V#`%aPf$zJ;T_R~BoUB&BC3iD06XujJo4SQCt z_TB#W%Q2MN6C{DKpIr+Q1H!JIxAa+HSY=bGAtyCRlwYiDCc47n-AzPJQK z;!=!=p$)UkOvT;V5Q7yJ7!)JI?~WDBMFqsCTB^UAIyFPk7Es`3 zCWw0~G{Rl)l4zQme09&Tj}pihRI(SeQg<^S0~sIuyAZ2EEKYh4+x;E>9fD`F$T&W$UuDt?(QT_%iG z@yl%KGU1WNjiCva7%zqXjKY;yMGGEyvd<1q!vbhu*;+0oR4t%ubJU>LmNK;|W^YDwW!f%WivA6hBX zU;ofb6V5XmUYKV#yfDvf7{@~9(8@fs;Va0MN~nCc(CQ_8hS`%UBjtz%I?GYZZBj`) zwEjYZo;#(Ig%~;xj>lIu_`Wwf-oY~0MYkowu4`7eYK?TU5V2*H(~ zApEGI_3_;{CJ}RN_f3Jpp-!ju*Jfg#3+>Rv{Np=S7&g!ln*wR;g0biGeK_99`)hc= ziAjOOwHL8^U&h+8pYt>0P}_;%?Cl6nZX*>*QBWc$@9f_FrZ#>&&wBP2-qW~=3&YOF zu@~Z-C(1F#_T)!mDR0U1e$`#~rqp*E=bsnm|LF5Dl7JTW&uSk(5uw8xz<^e>37QdW zUMbS=um=(U$~vm)^NKtE^O)?`wO1`;-^kYP%|GeuQ)v*$Zj3fkhN?!+dPYPxaaMbA zY4@d>zNeK6`^Yy&FI4og7e>NQMB8g+Hr=WGHs96v8&e;p;MZdNtoG={aChAgWWi%g z9t}$V3?G;Aahr^vDWTH#iWUiDbGLe8v^`pFi~#RZ(GM>l`D3n{A>)FwRZ+I5l(RAV zGxB=BWOFW*1>uAX>%+gA)jnt0Fl`xn+W$!7^KmR6pN+OBs)@a=&*)SO0g6d}Z($kJoV7nBgljKz z3OPzhbGqZrX0Wm=-r^h{DZ~^b`!_@@GNH#8s9=%|EWaOLmBOi@-)Z&7Xoyr?E-=F8#H{B|{puQ?v=4c3- zSC34s37hgiWIle87iJjZZ;z2$OWR_AmpzNc6wdq@uC9h_J#I2aGfR%IO@y(~vjj#B zsVKCE`dYk)Z1>W0OU)UO(icf-<+PbI`h26_1)LnUUR(oWX?dP4-x2E=PIO+FQX}KR z>(n)h?9MGs{o*!0Awt;6EUnC-RfjxzIO50+eDs_gApxUTMJ_O8E^RzN$?@3h?lH-9 zK}VEKgl*91`rrc-<^56j^+{$2h|EIFjtEo_=r^!fFyzxS3Sq;RyHnl(Nu*VY81)pm zh4Cr&AbaEG565A=a8s@}a8h!@Ah(R~@FaS+#W){eZk;nr9+Qe^;eIOaZfzfWwiXZ=1SfHluJBdc{%Kc;w@?R@ry0WICebJ4;}BJ(2)B9}xKF4%%?9Zjn=%rW(C zI^ZB)!?|L;jdiqY(`t*b+9jxy!uCWF0b=fzXL-9l`w>iegoEZ}I{d;bZ#fXlUJ!NV zdQqq@0gh=r57t5z35s*Z4ORBaVZUTZPu}tD7n7t0EIQx~{PaDOdO;%Zow1^NmWB^w z7K|DhpI6PpsZh37I$S#A%|4p{Id5X2`DTV|+szQip(5sKqH{A7?wj@D&CW(My|f=i z#VIuBG_&ZeZ9=YuL20l-#3o5cIkZV`l-x;eCC8#TWjF|e4-zouQirfzQd8*Q zG;43;6_iZ_dmCpmKxZdvUU$}QW#n4{T-@!$od_On%CnVEBx~3tW?6@CZpP6;NAZ7> zSO_7Um#&oM@^NZpq))gz&FMKGk}x;5A3&k~>->tK(<~2|t?#*J*@cCv*DUC)c21_-(<^k;#4nxiPkwl^F)TT zI^0y@HlXNhoHOo(K?5;9TYwm1howom3zHg)K%(Y&CD%o!codF9=0~u@v4LX+KtSf?jn|S{`!}sw|aq> zUX{?A*|wa8*4i}Mh2RON9QQfv?gk7ks*>QGQV=EX_9HWQ50<~7qbq0jdZ$uG%9&FQ zSoWjdeibi2tXL`^keS+6MWOMNY@`Q4Zy*!A$ig$8!-;;rjHzr zF5KhrwDhMC5wO#$zBe~HPbVXBxKs~>Gx%nw=A9nto;%MVoEX-N7_pj_;f3m<+~~SQ z#Eu9s>@NYBIa+OGT4w#9!MB)qY6}JT@IuXrKFwMCV_GT`vF(W2hD>yVhC3hLbw#Y^ z>86!l-4QaCZ(+_%X3f9EEVC|&guxz~ zp?w^LmP(bVDi?Tgd98S(T{slA9#X@oF-C^$PvU zvR%I{5j$1A=`4wP^xxLlC9VNHXaQ>s4`R|llYZ}h^`Xziidy^Q&?2WDj=K&p9H+}t zE&#Q;!4a=*hJVkTB3)1p7Xl=>O*Cl+(^(1KKcD1_LvIA3ccAh1-AzpEwdU(ZCBAa# z+N1r@&4Diavt#^sCmrjDW(A?kg3usQUq4CvqCVF0>a_nejr09xR{HPMI4ANo&Ig>f zc_xQwp2isyVrOlH*NOBvPveYQ4@oZ4=+215!DyU!AeIIRmY2ml5F|?D%=#;ds6;E0 zcd0%O2o5FPUwQ5VV>NplrzdLmIO|TMH|p7uVklQnvb-naZh6&V)42Z|8a~oKQd~e@3qsZBoJVap*SANY6J5}W1I_UCU{RtdIXmGJ(5sx1cCEzr zf0L4S9yNqv@Gj6Jq}#vz=Wp?1C$~-mUB#~?kZQkSAnFQ!@8a&^K8fcq^7}CNX6|)7 ze}P}|=bhZod(X<`7d(FnO7M65UcvK&{9aE{mh(FcxCi+CFsyF_zju1ick=udo@54QYPc)8wX{BkTNm`(E4K})+%}|g+mOm_ zLn^lo9U$}ucb5A_?%#1g$*oJJwtZtmO4EjvrVS}g8&aA!bSGu{3HJ}VB@g;0_cyq2 z1@Ug=?%-a}{dMkZxHX0SJ@-29Yq^`auj1CFR~R0bPT8Ei;pup#w_4XHnD zs4NJnoc5ji!-n+VhSVQ6r2eoW^@k0qKWwNr2t|X?9n|wj+~4KCnY)9#m0R8gzr(Hi ze}lV)TXp|e>iI+Nf8hQm_cyrLa_g$(wsp55)!l|h2O-tnzEj<8NOiX%)!l~5f{^NN z->L34r25#9>TW}-yA7%CHl(`SP;C%W-R(P>d1z9USL6?H%e~+TZe2Cpwk|fLy4aBF zVneEn4XG|RBx3gjw+P~c+;?&RGq_vY1)v|v>~NwLvk@I!;@pUkK%rp zFA`~NwLrT+zl%@?SO&dCobfVm6aZly`IQK`nMSN?yKgm6X`*d!3HM*oI z6uOA}eC}D?XLFy)t?N8)TLv3a8Ei;pupyPfhExU{Qoq}f`rU@gf{^;%zMB|?P7gvA zL8vMSso!l3^}7w#1|jvkeJ6Q@*|W{BRxLh#I+uFZajWi?+;TQ@GWU7Zb0+t6?kU`p zxV1k^*Tvkn?lz>l+mPyRL#n$CsqQwUy4#TIZbM~3NOiaGRCgOv-EBy9w;|QthE#VO zQr&H+HVCQi_T3pxORs6-Nf%WQNsyVl?86yL7B?;SUQ+!*FnWVO@k<*UO@M!Dio$ff z#^L?vy!49=OfULyecM*~+4G76W@AwRQx+N)I-?<%{fA7fGXASwkALPHBa1`cL>xNX zi>2qH@K(IeE9G(jKI+NgLCV5#UBg3zQ$CruMd4cht9RzS^W8It2Pwb88(o^=i^A9Q zUv+M~D>Ut>Amu;uM%Pg$WrZf$h6%xy5Nj!sRp+0Ke(CfPK`ddFt`Wp4DyV50Z;Qgh z3gw#GJ@vH_L3zHx8(nIHqOe#dRqOpd$$uybQr^HDT_r(z9`>hto*u<3Sx;)>KYZ~^`=*^qj_5tp3Z;0`1!oje?B^hbs&K8 z^J?|pXrvT{+vz^_;DJl-ykK+?D;>a;4QjDdOf0{}8s_(H8XdG)uNMm@YEXIJ7o_}D z0OObEU9Vopm{=#4L3IgDY~8=_m>^cM7wZ`6Uf6>lHnC#-2NhvV7k3;Jlt)WFT`+N! zrwmp`CHu~^FI?gTDPI!63{LqYCYGP__`2`h=maVMkZ-z##oz`t(0C~O_>*5N4N|^c z09>V%*=FK%D`R+D6n>Q`YWXvVFG!6EVm0U$*OfR_i^AGSrR(7MbH4e3AeNSAx;_xZ`k4o(mMIFa_Okxir+0RY3t~w> zscT#i>w8|kPT(!E=n{?mk$?aEc_#$1eiXo{g!xo`qKW0#eM7^E8&3%8ekR{^oyc7j zK7%yW%cb95Tz6uSvSv74CkEx|v}heViMPx|UU_f*#)n$KK;e3zPxbN7aCU#2~#<5 zVRUBGHSYy5`7c6L=0T`|8kR0za$(crrpCd^>Vs`68g5XT^1f9L{+8>F_iXWnmo2>N z>Z^yYXw|&;X!yd2b@4f-v7;9@QK;oZw%d`)F(h#15zu5v;3E}uNZ`sN)GBnwRadQC zzHsr9B@K;NUg1%N3Bm9j8kh4C^9Z>Wf*1~Rf|{#g=~Y+LwYI^|_{!3Tt7lz#)m2NE z44KT4+HT>c%dea~WQ-#<;E`h-sTGeL<48?uV|-#tWmQ?;RdHC@zB#kXf=#JBbD9NN zG-}Cu@gt$ozrYw8az!|QePBKg@vkgYu_%9yFa(HsRU4}4%wH!Q32qH=pO`$k;InwJ zt2|2Ue<&-Ry$HAhK*4=wD7eaL)BJe){V8|*P;gT!3(|WWIz1JVUF>lI;>JzBl@(K! zj(>?V*8=ln4^BxNxaxxBLMp_4!0h$lG!58#6qfIkygvv`l``ZC;3_BkQ=)mVb^qDG zREe4A3i6#?Rc+tc|C)#mEbl zl!nX+VC?&04+ke~;x>2H>9st)Bw%T^{yetPv&R98xHr+w4OPwM_n zS`0NUjG1jHYBB&S6uYBtTul3M)=q@6FWS}>D zG7(}uN|-9oD~UPLH?xxk17K$<$_iQ4q4jC-vHFA>V8rwo{Hffu8!kK+x8N-ROiee9Yl+ z$kspAJ$u0xC8HHzu{Rq3QUVb(tP0c6Jdu}%KMcyeVX*b~5zXV%$=S({8-&lP1L4R6 z3b6D0*?7&9E8k~oR%V)i!4~{1u_bastm96>(5uGT3Rb0C@VQ_Lo-{oT>VVrG60D%Dfh?S8@OSM79>PR}~VMiy#8@%Em#!R z1gmRN%g4W$6WM9Wq^meoW~QJ}=sEksEaY;rZf_j-_c?LgO96}@>n`t&X1$`YCTU&Y zyKUsYoT%+y`!Y||R_(Qb=A)vprfkI@cj?A4IZ>N09+arf*8fT`oe~pkDgX6;)g52k zm=mL29l-dpKI6TyVl++X%KYbT|I(Nfqs+lpU$ZaFV!9}-sa_>qxc%kVa$>Y~0gRtlzxT$9(d;5L6sq0*cs6c!txYvInne=a8?`@VgNu*#3+^A5s_qOh0(T@{OdusA0otFbRb5|P=K@AckT z@t5~tek=oe_>y_~;;XK@ngyek>IY7zaF#-=3;mn^yR zvL-E{bg*SmtV@IjZIfB_sco>V_p>&Ui#(FEWLbb!_qHaRuDfQWbu-f zi}}1HH0l#mrc~xFN6P;4+GO&SsV0KfCYtWhvn)WC=na&7LTEk?@$Y|RZBkiNm7i6T zhjomb9U41aDxT%7r_}h!ulGXk-+3^4)@9+&EZ~{nM*^=71vhzebw1#^!1XcmA~3SL za`_gn5k~XjJYZx(RR~wOMmQe0#lWn3zlCG@;jLjb%jd4K1b+g|FFd$hzBOm&Lw*9d z9uLNkZPz*#)jr|S`ww&P9}2E=>XiIN+oiybL$>%8Ze1cKHoYm;`S}iG?z#?`4c^Qp zQf=UBrk<&I{-x%46_~d@xLiG|s`CNsfE)gSQ0N?PT>;$W%F0Un%KX2N{}%u=YMgx; zz*SBwSfq~Q!&qQW_vmF%kIHFN^AYP~BvT8_-+6Gk^v+d^k9W z(651+CSfX9F1?B=`Ta464-sH)mS~hqtboPSikkd(d6D;b1M@9!_RrO0%9)cD(Yv%z z{#Rh0_uztjrxfD7>Yf4SgWjCw!{y70mE=v_r}^`mUU1chX4igVaz()^^$hrd2Y|~= zurNX!uO9j668bLh|K+1B$xgL!K|Q8c7Oe5rM)QD4dvJdFK2bHTAiYb0yBV0i!En>6 zYHSYne+vnOPs3hfqJ7rnWy&{gT7I_~{`y}%7(c$PN6nP{0xG))fP2A%4a!$JtvWyB z=?v^FFsGhjQxjb>>D3epE51Mi4+3+VSG#~76b_@%4`{H9fjQ`Px=5ETU*+Wd@%uC0 zUrQrS@{l|zUzL@P+tP$W&3w>6_*buTx&A1mS32`3db#Am6$o)e$FD3XiPtWZs|pZHbbKWl zbc!$J%1f_+9*D`>4$RKO;HIAGHK~cO{@m@sm>2xB{ZUmwp9QyXD7eXm!XqOrm<}!H z))n-}WDv`~GXFR8|98NAcZPkLgUiR#Q0SL@z6+QYXAOp%Qkmb*+xWZ=nB>`m;VSdd z$`}|f2IkaH4T7sGm_Cec*e8KGu67XIsI^P&fr>yOHU0rCZs`6Dp%A_TYs zxHAjTD)es<&`W_irryG-A5DKuEtqCP7xDfdfZ6N81?g2n*lbkuU(I{agYjQ`{aY~J z>iBr(EFZ%D8o260dbNa4*8ul>4>rj6%!2MUGU1npOs^&%4MO!KaQr#A1B%%^gY;?& zif4>Nmjd(TV7SUD75T$8NizQl%*Wz`(yOc}m}j&Oukv6lq>uMg3+P`t9~TY@S2Hai z|C)ho2kwvu8`Pt+vS3_3&q`~=xuMX@>Oig&xNSR6DWK!?c)#njp-{B~T)FhB3;4P< ze5>A{HD&zg;q2Ma3r&cSHcm0On-9y1mt0+iMIJWU(KbHM9`Bqj> z%jXX^@F_bK+_Zw>Ypf~1`ne&~D*)6&_4|jxRn&f>^2{^y@xBbWI}U@RT`JFp8`T3fK^ydN2zmQ=MPOpsb4sf6FU`u$eEv={>3hwK`eE%=N zseFF|X2g5~Tt{&am7d^c0`vL50`A+u{Om8lm6Bc-n72JR&8y1S$~SXDZX{UjzG~US zIFXRk^<4E8t)IA3QqJpQ`U!814c~=D1wL6OULpaO7x*xV_H+BfNB0k#1m?-TE<`oJ zhU3Wo&JoVdow1gK`ld|@l~0s(HH}1+$!3nvFJPPVj(E=+=>T*Qe22n#L1nKi(zE6& zFDO_N(uI^Xf&^WK*Y9{B06aYxXBS@tTG{FR5JCFMss0fSCzAgrxXMuFHs^=?x0E!E z?8=s;UJOUvXY1V!FL`N|kO(>5k}FCzZ%C_z99HCV80Q6(Zu?GP;~i^M%ecFyj1RVc zhl`ZcH8{*dETcgP;evJ3on#zyZ`ovi?(EbLZN!f*1-+&v=r=7vziD$VE6`ladJXHfYpz+@r{A;Y z2o2jgbi?k%$5p-C;by+mJ3V*zy_bbAa2!x16pf*DOZS zqD74=^FP%Dw25i+o;7N0UF^xvH44)8K?t{P=yt(*QfIx}{(p*drd<|nIgb4ET4j*< zUdo?80-@2}(4yyBq_5LxG8opgKI9>{v=L+08yb=R zmJnOIkE4_5t0trGhzvXx>shbYx?<_?seh#mLG5#_AkPqFjfKpf8t6raiqrh7>?A>> zM;-}+{@G;u=iu;$^PG*5Vz(>xLXo>UwYvW8U5T7wa!hCP%;WOP`mCqr}aLT1oiFDp4&10W|7uJ&6br51$+~`*$#x!l9qHe z&+4f!R%_rYh^@{X?A>E}u4T1(+jJVA)jsy~8*E-SpVRflsa<=|GA-Ad6e)CfW@Nx^ z@Gny4jER&wW5TAj@!6*Anof+SM@4MYJFSnaJRM_Cj1NE-cd}o2R6Qr=rFIw9yPQ(_ zVi_m0biF>@+vr&DJ|;)4_*$U>%_=6c=0L5EXo!^UJGZF#X|~DIip6J>&bCB&Yl2;| zZBi7XW7dZH69;G&Tni5{!Ie0z+Gs+k%xRT`9e~j%@_jGg<1Gh%#w(}o>#CA=E^Ehj z@u-O0V?sHMyT=!GNDmrWzC=K@oxlB$SBi$Yk?}o|ae_$K(f;9#)Iwe=8IcMol$@H=GB`8E*;{H?xZd5u zp1`A`@>gYABX(KUy&M>f%dL9%cd?GC;wa9)Z2b4);WzEkwfBxakpo|c4gEE3J{AxC zk$uf4(hx&_jQ4Dzu4>e>rju#L@h4`-MbrF$e?tE`@#Nm|C&pX0Xf75ITF6JKJ%wYs zJt5)7OK5McZ|~Q?xKp>oy@11FFBtDe$}Hm&=!vf;jvdn11tC4#k#Yd?SU8`6(9V{6NSt!2Ng`mtaB_^I*KB6p&Oq47ArPKsH?{h;a1;Ir zoAI>QNw={HcK{XtBhdSK%z`HmN-NK10T(#4i6ANx=WqpQ?Kgmpq`y>bTr1$Auq09Q z6fJB3oO9kh3&4|!AT*BYkh*kD1iy%>7xzY5-WIYoC%oi{x2l!|`gy)z&^%X2|9PU! z7LH>xBMMxOY=WEHYX&pUYh=4HvZY5j8F8zPb$~aK-$JqSh^eShWRBIkTm83;FH#4G zH-3bJU&$ce^N1QD=|uamYoHxws}tv2bw8Vd1=X>jH{R1Nuj4gO5ZimFt|B!c8Y6 z(#^8-0QugEr`|oZa(re989OI4vi9e_ciNIFcDT>W&RMG#KP*jlc*?CtyR%;4nG^W; z)1Z^X;9)IK{=}1dtyY**8(_{Jzi1?*wy9mPWjyeCaV~=2e{XcVj|d^*T(S`7x+vDW zV8#(}&*wF4iHyYzeX*au*dw&S_0*u&BLk5$gV8b-VM{drF2j#=nru9*E`PWA5uICN z>fu=wNFr$~WA}x7h_Xnnun3IPxjXJ-IveNaPD2sDsVV5wdA&W;?_k@pI0@fuCR%4! zZwq_l^M*j(=2(xGXiPn`N@6{;MD#+LZ|X${2igh~b{h1iUEIbm(bY|(04q^)*~{hW zvZHDQz7P@}^>5(>78b^bZeKMsqS=E9YV}+GK5qO51KjZ8c=(aj>i$skbQ_1mw(S@i z=vF=rPjgJA#~XOXvJKe1C~p{~R__Wm9TQ8vUF594lH%YuxtKF9K#I{q14 zD3`l_9MP_XSvtQodw&~6vXto_LWj7EL$3uPL#@p4oa+zJWv1QDxO~D{cL$)h-xD3p z*rvRc{Xo8N>ty(~MEFmM^4FWbLIYwfls}Z@Cl5!V&}|wj{{sbWUv&{xHlEy5huT-g zsn@$rGgGU76KcLAUEd3y#>2m=+@?x9H+SJ{@bAH-y@`$qpW%I^rYGvm>bE&Jug4Qi zJj^jnyF91H%WSK8PNy!W2DRM9W@Be4tpXxgQGzk3V~@#cB6pKZtL}+U)yrE2Ftw54cp3IDu|` zz$^}7CUN21VMa|2$kW`p@?^PS?s-Jx4d&lzy^_(2m-9}X(PkD9j&=Upubj_((fSt1=2c7Ip6Y4HXoiQZU9b(?YKX3#F8XN98tSlp5<8ZQQze zqk==naJ+-WWqEJo2{1$&DVei|;cg|LE_-pImu7U~V5#`}!&aMlOH6-lnXn#Yl0_4? zvc~jIM@b$#VI+%AXly+74lN+#t$0Tie;zfDIBTz=0H%WvCf!|m?WA4#>6BzVOrm4b z>3&+Frpu}8qHzhH*D)F==y>UW1y3k3<_D(K(@k_vC9^HPfE4JSor&-ss7G0T{cwMM zC{g~rv-Ti^gwv&BFsMSmvUp7wvYI5>;Cek-lSw#ro$311Q~fyYT7U0s&q>^ety=?*m<8K*4gfTT!Uy(j4$#atCpl&|y|gM>vx~89 z;hXAcU)%@o@EbtD+4F!*a9&ColfgvNV`R|BPXwuPa-gcY@*|nA^HGDl_4B016l+qNzMTI<0#it{w{!uLS*Wpt)y}Z|H&61Ao^XF7XvlvyyToA9o$gtti6Iz>VbdM z7hI-LbJKRJY)zP^F>qbQpu#(G_wl&MF{%y4xkHZO7};=QS*TlFa5Bmmtl(4Dg=(ExXG=mP$0b}J4|;lCtN*6i4R zHTplv4S+|2A`ih$+hrO26Mleyg(py2 z3uGN6&z6&w7`#Y==c+0~^BAb)%|1IME{mz&>r7y|J^?5N!sGTp-?i?i1K9ZzA z>b6Oo?ToqCNP&CWG*jt{^|bj?{+>2p$lufE%lJLfM-DMi=rof|(**ok@hBB zrV@5HSXnO{5P0XI*j}?zlCYA2szv0yf)V-&3L^Peap*%dsl}rU2w6OuPv`^YtHmho zY-tfUloR5n-P5U0s_R{Nrvt-RjmB4|70ITHTNZ5jAd%n7B`|mlF&-p^XGcl8#U#^t zhYJseBzfK~9m_-nwL15WEU20hYl(1jspD<6Jn z9Lc2DD``mR2&ZkY@Wz%ec3E)?;^4CfcBR)VH>S6BXG3%t$P7tm-2p%;jMJJF`{G_} zrzKu07sf4v*5qQ=YCRd9bIFAK&i(uX;R)t(Rcu(G9}zG8EzRQI8ZK6|!)ZI-6xq}< zUH^`2ih;;C=C1EmxnT{Zt5|LewF%%*YG=qb)yc@6i;?@L9x@2!w3aE4qhY5vLCiwF zXmk{BV;$FZqsC(G?ej}USQ;zuCo8pZk4Y1H7s~YTFVV5lz^B)5P|E?#5uX+|i*jMPJR9{&(^ zsHQL;R(H{in)Ygrc3R~I!OM;)UUmwhKK!})W<>Rw+ZE=h`}KyO?J;!|FX$mrM#9P% z=k~4PmrhNjA5t&GdU`Z9Ch^SLc8c0kU7|*HHXaL}_$Yvb(~Kq>5)-(5XtqtW329Zf zPQvKC_7~Em1`uz_>MC<&foSz~Uhif~|pq}>h6d*vb-KqTTnESn4_X8KoY=zg+NT}c` z^-u{7zyd(K47?T=5*qyS&`_t)CtGR59x)1RS0QLR5je&iRc!k>u`4@0?5}xxWwkd1 zG9NI>b}FJYzpa{VV`&pRhnhjWRa;}>hsr3Bj}qfOlrUp4=mcn+D_|Q18FLby3W=`m9|){k(FJT!)OmcXr7JbJ#3;! z{gK)%k9E05sqFNcZb9LDn<&x1lYZ!QOmy1J@RG_~wx@&867J&AZ}p${DmKiIWnI3( zvy~xhy@ zj}>AUDwwV1hq9$h%^OW$FT#{Z7fvN7m>_SwX&|*8%d6BcOPO}zPbJ}vrN8efOPzJ! z)pP2Xdr1W(6o(#7-&@R6BK_5psN4Jw09#5RoZx7KE`<^a3H$8fn z`4p|$+vJD?+XX~yppz|G|7pID-zCj#RV;n|o}jorhW{erP`XVSx^4aZkGbDhS?r7q z(hj7r*GEMD4t3hai<;{N*Ib+WrA43#Op3oW>^N%#w@sw1`NUYq^`c~zc43np)nnc( zvsn1var)9p_gC0y+91G0zMaZl9NNHtaoNQoi5ca_rZ^;>wVk+U@+{Jn$FW8{DP_xR zTLJSWR32ZBY2|=ZfXLb;^j!&dqyWXvKWC*OZQfaSipBK;Kk82YH{cm zLYf7OL(dZWJ$G@akN?k@kf_u9%-7TTZ{e;WwA*}LN9cJI+Ca#{N!VuL{zzz#`8o>p z_=5?_4ZDT&Ia-G3eYY^`*v8zMlld7gH`WmWgKvw+J1revp#;aYOf(?7_)l3val^2QU?uEs>>jiCx`Y>IA9srtx^lE)M~fA@vX9%n zV4U_(UILI^Et`VpZ^(U*8YDX6)WDSSZ>_;>GCaHn_p2VZ1~<%Drus+uuNoxWk%^8Q zRD*qGGDI|& z9F8doW3v2Nb3*kER>Eku;hQ5WZxA@rVb(INZ^7FITdp8Q+x!v^SaHN*9bwfzGVo!s z?ytqr#(BXo=ibI@+LW~<&ewYq=U?Wq@6&YFw}nuNjyBVh9oHK?2t?6syA)Z*M{O1t z+f;U*3@)|>xM=1pHIZ;}1;2n8Tx|1k(Rve5PsZFf)01s}PsUs);hux`S{w5}OWy@1 zMW)s5GTyXG8PToaW)dMQ*14U4hp2i*Yx(LQorj7-v!vnZmKq~CE=os=y_Mu(g{La#NvLVGs81p( z!a^;Ub^|_rC?TV<9_}=j#4>s~KZ>6Q)`XqR1E@syI;HFHBxqbo_%0-1jnJmlduBQ; zo|Sp68i&G4=XJWfejUtBK2y9_;^%_5Py|m)Y)#~*#gIa0X`B&De{l8GFWUimy zqgJf-{u`?FjlwFuHx6ExU#Y(x2WRE#^&a@=^_I^pc>DYfo^E1}Ie? zQElR2>D%0x1ObgAmtb(bqNu1U?L|oQXry$={fm$wQX9ncCV+{D+W_B;{RBBFPTZ^f@JzcTaW&kre+vmBW5gG2}m- zVwiDl%Hj=f;~8w7JP5~n&MB!Sj$d=0SrRIiX_-td1KvbOg6l=z!WowsN^**(5vJp2 z%;mhx@JliG9aXh>IbC>a>gM>?#n7 zs$_wMo#*+4wOodCf{vMXZU7QraqFDo}M_x0wi{pV41GUyl5*k##Scg zR_%-pa7z0aspIIVs-0$DD%3B6#Z5;W71=@XSNl;s#bi%PqeGWh$Ly9I8}$~itz24y zHye^x(rPNNBIIzheI*Eu0pF}RbP^#eB3&H3`#qtzNwYZgQt)mdfU9II+qgRO!ovNn z#LD8Y1QBE3gDzE4hJP{TFzLfDzc&dSO0ttvz0z>`RDBp52c^&YI`=?4+{@>u6l&=o zCKAAmS}ylAk*g4kJtmcYI?U2VO~mi+K7tN*Ib=Hu@W}@Q$+wUg)WnI1O$+ zb#O^@Y3x2R_Y(8smkcL|_$%8^#BgfW8}1F7WeQ4n zSp7QInqu}3UsWCyvv_SR+=~|1OG|37Rlkk8W;2~qH6%siW4(qf_%`2ulf2){SnaO@Ic>Fs{B34l ziJaC+Hi9ON!y?G!hKw}H>Ki4;_A=73W?FBZ7SVOMUwjTt91%1D zE5byo`Cviw=Nj*X!x}GbnkzfqE1DXs%K3%ag_u1xZK|97P`X7`%O0O@QHit1q)q9v zN2N`s5!d89%&y9G1cWL7#!RULKCr`H`|)-r`l^! z?63O6VPz}K(8e4Oc%IBEpGj$XEyj@ZwKY!pFYW}^DZl47e&Czp>DtnGI>vNp_pP|w z&3wY5h}k;4I>=W_mIU1_pr>q?BZwiwH<3Hp{kIhOup>LKA&xOrOYA;T!+ZL(*} zEvi(_L)Y-dY3*l(Cu-KWn}@7{yEi-dce=$6~tnWNLRQa^QRP zaYK5&T0*C|wwj4H{Vh|<^h5JhSWa+EFIbT%e=%0`cHBLLePk9(=%y25Mc=CBJ4{8= z-Lr>unCMMJ^ed;sa-aAPHET~GYtMGI|6%-MMQ|EuM;JXr90M`sB^Eem2eIi%=Y! zxb#u5SeB=Wa;}|G)%Nq*Q`MU9Gy0M1;D2_u)U~;7xl~jbqbt4MsB72vs{*bmkQEZq zWYFKYF-JI&c9X^zw$@aaL!p!94`Z0$PW)K5N zcko)`duk^(Q^ed~2%N~mqs-3@CudA5sJpQ`vgu_$z|@FY{~DlTX_~5^YM3}pSh&1H zZ-<+vU_iPeS^fu(_ii}N?}LscdsE&3|6;*5oAl~l;nMnZsfRz7%l$;k3NvY3>%r3cceAH{;b7rrZl!4aRz3gK?eJU}Qg> z-y6Bqz`9y6?#^(13eezN#pepqHsM2p8? zkLgO94G3ct*0Vmhl%G2;U!yjxr_M92p9`CLJV}+s+>2Oi&7H`v5T5ndMdQ|WHjja8 z#wOTQ&lU{s_Jq9cQSY<%NcR~VB#vk`h(aX9gtkqL3cC~R(B9t=!cA)78p{>;I@|B- z_o`-Rh3R<17{!>PBoNTs>1Gw}w2dW!^mQ8S>2GP?)*f=~!e(xF%}dy^2gFi2GoP^? z9cmh`*%j0Yx)U;`9CY4dY1C`6dhegI{;P zjgWN>o19yJMk*w}Qv;7>Vj9$%8+d@@Zwt zqKD4gVOzP!_}ozW7~(3n38sw%SD75+MWQbiFF;e*PV&82(RFI_+$?2i9Brq3nV}Nl z47O5wfat|s^R@8{8QElbc;~E>u{PrwTCz)JMBKoYaOyh~vPw4NX}5Pawe359OTrzL zFdqKBF^I}sLMjl0TsF?y6-qcaQzg=-tkLvF4I>}z@we?|{cc{?G3^zwSr_Ih!#h9E z?BC%)d_?nTQdox5ZB2Az7|>=A*y%c6-s?@}eu9OmWhkN2Xc}cIp}7O%Vi_5OQsNSf zb*4wtT{FXH{<%-gKmGaMd3&uEa1*vU3yW~MDZ-(@q6jwcMA-5;-n=xPlECC?4$R0O zuQvX1ytSEtEFzlT@9_}}@pA`xviZ(71(zxaaQBg*Vand$h27W1= zaCgBuv=fTC=BRQnAFrD7X+4R(6jCjBL6YaiCXI@@=a#Z%Xi*$T*G}m$?3_WweSF-- z+da)QV$nF@R`C0UqL4>U2=IB5oBWpw}KE8vHjXM#VUTfmsN@&1@ zex!+#)Qdy11Gh1*VcxO!2R|jW%)lMXlx`(F=Ml2wUkZ^8N>*2`Z$yNMG_P%a~GjpTzms zN=T^P5KHY&(t>OO=|RasxM;$_<4r2kss}q6N0W|?F5ZS(h7gV-qq~aI*Qpx#C*4*z zom3vz&gA)d?uWTQl$!(}GI}4<;}30aSTi49&HX4h!}npQ#U0@8&24iJ=DwQyQSMH; zE$#q!Z*H4=F!$Bmj}};kfufUo^)Bvn@+l>!_O(m<^*?RE=>tDicE+baGw95-22(BH z1f5ZCupQ-{k3m-c`WQrI1f1bg?e5Ey<|)H6{do50K8GZatjVSk$TSNe#F#w8*#cm9g_NVNb1uesZWQbJ{^+! zbV%ycAz}Ys%3Z-N3pB)iFSlI3<<|A+kkq3?QjZQvJvt=y=+G5}WN@G5v6=g4+!yd$ zuIIURnK~q8>X4MFLsF&=Ntrq{jF7Z=O3w3Zgys4(w=PqMq)Z)>GIdDG)FCNThbA$e z-{wvMgx-)z!1W5ZE=z}`EFF@vbST#xx^ydG`bLmT|M;Ku3(=wrrd?83+|+T>xX!O+ z{X(qv)0CTa@Ssd(E_nnjTZOR%IQ(b7&iaLT*iYl-ddj2|z!XZl)MzYxFC zkpNFGSGx=o7XwMIYsn=UfA``SmuLM#9Q4z8xgL=$T=F7d2}fUY{pCNt_E6R@M4cqy zDlYJHJ+32+d)0wtkxu;nj|(Pd{X+bkpT^5I$;1eN4_Gn>q^{f7G(Da53vq*=#>@4T zbchR1CAltEVa)FCJFR!tFT`*BG+wTAOiyLT1gx`7uIQ=**Ju4g1pPE#E(Ta#!aNID zxAUK=S*806_86dssJ0G-o}o<^G*7^-pF+$jk{?{rE2!_lw2wcIl@>48 zt9}|U*VSe;q?UjsD_+uG=33`x-J(YPG+wShn9-0u2)C$Ykr8{!4t+N3@>Ccia`i9p za&0v+vW?>?mH$%Lls~`lZ&`PyZGIXr*AGpM%$$HV(d4T8ZpVhKtI~h>(|Ea_HfLUxCOZL=&B}U?9m=C_P?Bc8&Qrk~cuHJ&)nixSx0@g16 z%V;#bePLDB4e10wjaSzf&9{)fAz;Z)Afxf4%hrD->xOiypT^526tY}ra0jeW{8tf~ z=$TnJq;PE1bw+{Y%AIwBBn2#Q9UuMF6~B=feF=gimmpENA!TjJcZ&S#=HF7IAwjC-5=1Rv3Hl{XzUG5>{`E}V zAAa@m(|COs9)w(HaqD#|5gB{&ZD;wp-tg0un->1flq1Msz?#c@`4qcSkNx{#KbPms zd2oSOSHP^Va+OO~hg`$!Ui?$JpR13b#>@3>1CfT1Hej90e`(HH#{;n;ey)Xn8ZXy} zX7-+~a*64BS@{Rf?RV4Jey)JYb+&3@?l=9S%2m#P`8Y?4FI#=Kg3J6U*koFG4&i_$ z#_nZ8l`Q-0i|6l&q7FmaJSuxdWDvWC}9A^u)D8{ajb66q3g4#a(8Ge^%xC zFaA?q!8OlZb<1b{T=)5Dyj;RrkW0oYV2N3L`CPwBJhJ0lKi3m}8ZXyS^G(lFxkNie z3cljU-~H8jey;QVG+wSRnsSDzTr&6Mimm?ch+%#%!2;zPR^a7&%Z$7b3;`?5e@PN< z_~x#lpKFhw#>@4R>8U`u{2lguKi397jhE{~6C;F4J`OP4&lNB*VYuJInP!){K;_EC z0WR=!)%a<=y52E$U8r)&E++kYVt4Pp7y7y0^V4{_2AR2fk;*0WRIVuQFr}1*lGchAo zt`?K)tZRSv!;yZj1%4VYm%vlGF5wPXf8oE>)zIs;eV6#T1cJzQi9hnT8C8K`0c#Ea zCD+>Pm&ZQm=Q`a_DzvSAr`FPDJKi76*vjH1 zt`(Et>3^x8OL2`<8n3S5Cf8*u*B|&V5tn3s@TJTATqFH7UM}38sq1q712_0DNpA0R z`sU01T#Cs;?BxYsF3)+Xz>k3SYk-N&s^@+=`0dett}1CX*JwYNSTL2Vf;(UdCMb2C z_V&-dQQ_wjdO@xVKi3k|!YhcyHM)8Wv^itXzh2?zQt}esT;b;uYf^Fvv9EC?`SpYE z{`T21ey$(*X}o?-H&9e+30TwkFD+c~FQX=3>F2uFPb0Z<;q&z>m+bPgEGAT(yz5FI zKL676>+>p&%yYS_|K3phdB5ae`)R!P%rkWf3=UWk8YAsF_b=yOca@)OfuE*pdnT(~ zUVHxa-6eaj^4s$hlj~}g=6?Q5$z|g{wexDfyBG@4RrKeY2^yho8_DlY> z8P!UaCYO?`^h+-H(|A2S*L>xW$|X=yuDKr;jScy^F7VTMxh^&EXDn&6e%>A!9(r)B zpKFYt#>@3b1H;FuTs8cczW-v*!5@wDb2a;Eyj=54?O~Nm+$0Dj+490GYr=l61%4XI zl{+_Nwg)W1*d@u-bC)?`f5fgf;~Y_Grt)9fb4Q0WIpUWb@zZ$ixz)6AyvkL}f4RQ$ z$D1D=uX0Tsf6MK+&AwB`sx&IJ&CIcD_!Y3qRUBB{@Cz1P`uQUTr$tq+cr06&N~2OVnYtX6OQ4xt4>bPnHpkE9)uqy?_g^q|UCXb4)u`fN z_dfT_G1sbGv7EY88kOP|Q`dDW*HDw|&HYcdU+3rY>QZS`iqDw3Vk(!=l5&0ht6$z4 zQ@P~V*|}*XqF}C>Q8Kr)WBBI@ugr`4xfbN6QMv9iF%$A~eg21gw@vVK-JhE#Z~jbF zxn#x3HS6}zoHfzUHPf_ErBUx^nDsS@U*IGv4*uE;PsJprprE@?LWzCcjG=__N!ZOx zp~TncrRnaI@V-0m>%o)ZWYaHQvivs-MS|2Nmzc`%E*LN;cn@w>F2m#q7^(v*Z^; z3f`s5xw%{Im*mxTN4IZr(exSjdObhhSx|77rF}o%dB@EAW>wued-g?l6#R%XlyAg4 z?!NPmd&IrtjQeY5ROh>Y99R92_6>=j#~Cy4zpX0o^@+SjD%Xr;&GoZ5&96J$<&E*6 z*dB_Tcl&Z+(xMYrX$m`Wg4{NBP1U_oT~m0UB&TUvkD#ih-nZ;A zC*wSRW)%)Q4g4D_n~Q*My`2sf_@DDrwmJ1P>k2eG__;%VKdwTruew7VfKHwn_UEcu zAw9Vo?WsibIcCqeZ`QqchN|wOSvkp+qtaXW5M!Ba)AHV_QK4_XFVozN>LuBFd`bLx z@qZd+7T;Nwn@u`8?athn(JABAY!6Sq?e=@`oO;PE58g9-R&JK*Gwz?JGRQbM_fMah z`%;z1Y#m!O9Y3g&;+Fen+}|~YhA+U1_-$3p-JV~oDb({TJ%qXMa^_TSv|4j!0p!LT zaMHaTHO;z5=Kz)NFTJ^F-l+MRoj_x8)O*h@Gw#Rt?ESaho7;#P_s_nws#?82u~S;# z^(;_IhBLPSZ$iXxd+1Ail$j59OQ4%Hv8KA~8*fG!=%rq(hN~r~ocVUmGCezky1p_a z?A+h=h2MJJkZd*7e~0S1&QUe(w(8ro7vAZ2%)Vv%j63h0*6q!-8Pjs#WETyEWmn^! zCS&%sOxS<)UQOt6X5;H#MD}x`P+xr=_ufJ!;tXb0fZtr9R?ebQ2@b;P+_fBJnRnSI{AFYT~ zRn4p#2V~0ahMMjQo$wKj6FFSYwp4-9e^iR^lQ{NAM7OYxxop%Z_2#nAT{8M|6%zl^!jvm0 zn3;w-VK7Nmy9uA@@&Cks^r$>Hx&=aDgmchqX^Zk7I5OW)qp-vtC*5k3R&ZiTrx%sv z(pM>u^jtcTn=`I-|{5Ai20xrcha39{BsiQ;; zR9-skR{R3yrF-%eeC^IEDEQhOolXP+DxG|&oJ)w_qb7|Pt?C^;%A@dA^b`D#K3q_+ zjax2%oIjW6zOq2l?Iz75MpEsk8#!Xs2$fU+d-X!*I%#hDwf;SfhpuMQ-y7mh<8N zjWjo}*XbB`J$@DW=^mBRhxslhcCXG&6p#5f!&hLk?I&SrN z$R=T>@~=5kINbhKOb6?FN_T0Vo9TjDay+)f&!z&Zy!>TeP|ll@ojs(xJii~J*>^!t z=`PK4=UwnBMUC3kLwT3w4U1xm7r)h0y3u*_K>GXnp3;rZbJwm!X_0rjmRDJM@ns|O z#;=?t@owqx*Li7v10~&kJ*69!=We&)WYVR&q$?=y?uWCKbl)f4|1oKc_}!D=%yQyi zATxWG@q9ah#hx31;|9tauceQuuF!A09WfD_#l(qE0lBNyj9r%P?l9YynE>J+WG#lrbnAYQRI?q)c9uw9O?)(O<6 zt9Jb`0+?zmte$H>TWBw>Dr|nIw9m@s_lrW>@Ub?38y6$F{Yjc0C>ft0K|473@EfTr z(Q%SJPmaS@Hoae1S^Ey{?4MKH^KYrN3nRS}&&w%W&gw2)QCWMu(5?$nR;9gkrE176 z{J=FEHP3wq-Bj%7jx7q=zit_*tkb5?=XG9R_RyEj^2xravj1E+1)KRx&|>b=mp=+@ zPrLkMjK#uS`ui%;C90pm6Ny(=f#v9Y=296DyY5~;%^xL6CMLf0l)b!cYUYagXo-?E zTyflP7)>Bn@xI+~83DeOU3Vr8PtKK(rR?KUhLZ4gE8-+F5GnIcm2?1YT$4x@_%^>) zf$wGu+>twGS2MKDd-|(`3!;I%GSb`1)>3_GW=v(>L3?4Ow?E2^3OV|Q=I&&?y+cp9 zH}S`!rdT?64>h~(cpS3l-AItbeTj}<*eVvEiM!>y*VXj4>m$-$>@!@O8ilz9j^?-j-}k6lfb0ooYctZNfJS#k)4^Lco}qpA2<@7 zXlirjHp`kciA5W=AoPDx*`E6(Io#(L^WRAgx`gDHNNxB;d|(3Ikne&cNW0-?&ec2a z%Q0(xq>h6@qi9VmH6J-fr?O?JPZT<-Z%G312z_xp(VM+p{(yb#j=RH zzg;a4YabC(|EjrCzg+2~{PTupP%Kr{3-hg&@rvEEZ9Fwf%R!BBAc?v#PtD%QJjb3eaaz9L$cB$Z_XOBF9~-65$wg z-;vHvH3V_@IOlvK3)&*?3TDcvc+PN~#}7-*mc(*O{ect}cMnX&!nsTyHAu{Yam0n@ zekdOSh{+CkW-RpsJ!@2!38|7GQ$u1nQFJHfAqODDtb;SKMER510GPVtr6*-~@nDm4IM_aVG>txLQ6n)d{( zwTYHMdL>g2t4F}iILGWC?g*tOb_(uc6@)gt8*1*v0Vz(r|0ZTF>V8G>?%~7^7VTRh zcT47yE;e?=5`O3ENNVy>YrH#ob;)#EF@2m{eMg~_SWy_O*in7^So<%dZciNVtUf1H zaVTO>IKcZ+cMw~Bdm+&^!!v)#dcf4>jd!Q{Mdc)|{!X@pYz;L(t~|KPs_C1#Ot(>f zRi97!CAW(e`4S98geqR4;tw)*ST&c)O!1gEq9rA)D>cn?Dsib^kG1i1fLFZ3$E<-K`ODxhp+?wehw+=X+t76s;2QLG4FHQb4!MCAhpk&?fmZ-`hy^paeLe*C(&}~&&B+}0cu&*Ee_wv>1>I+uR4jhjg>zkLyR$9Q+n>XL}{_t20xA{8qhJkUc_Vr5~t;{BTS z;(l&X*xeD%%kscCGyAc=R3OuslZU&lwTweMwgx)f*KjrMxPN!|U6&eFF!FUyV0YyMBS*;80P1IbYlE&tLItN~Q}QE&aXKEcsp4 z_l&pyGT`=5;z(!pkVwTwmfmp^47io($+s6ue9ifpXN|Kif5m5u%1v4Q?Q99zDry#G zda2dU0oa?{LI;;yGCIkdv5l3jTUNf#d^l6uV>My7BJAE+6vCufy--6KBs~_v#mBnc z0s|rz&OVv~a%TMJ^3sjG7fVII8cWp*6yShhHz>el5ulnmE5{0%W4+0uiCb;4F%P%d zbvIDbwf0{IeSM-^6vXO9pE=w3-!JrM0SPgC9Ou?o9t!yZG*X z>)3?U01Xoy`~D^$CQM8X3es77a2SX%4v6q#yF7|s1Z^scSNv5V!aFjfyF-LQ!7eL? zcAW-TDt0Qi8i-K;IzHTJ`YxFf$tjG`It3!v?YSm3s$UMID76PyVwP=H92*#QOGpib z81(h}*9AfxwW`A*_e}#KuqE!TC=CwQXb5pE2SVgUg%T}=k%~Pv>-f~wKkAm}0XMTB zgZ%G_so188sR0EeJ4e2*=W7TcF=QS1-c6&wI^Ml$P09FFNx+M_N5zD#4MR2nJOKfR zs$K!a+^ttVzVT{ivD+TYg@EIevF4KTK!9i@^)D9ldQdcCFWU;B2?w{2T`;Hlloew` zht@}eM`Ten7mo*zK6(6t$;~H^PnIOdyX00-U}en`VKC%w^4j)SzOkV)=8I=+2<%5J z94QKZASlJe)Tm-$+vrGLr@de`;~h^;vcm2a5iw8rKEIt*l?7zC8+L=Jkn(JUKZOpi zfM2jdBHf+PjW|+&w|Q?-;@v5c+@3MYRh^nUU?f(L_P3p$AAxko{N0HGRo%uV#+S4zPh-2{!sF$UUS()}|u-#bfO-EA;rN^;U zeIpOwnU^v(@>dYZWJ=-_hx^zK%lH{issReSc)m6ULBub{2*JQTt3cuu!gGt^?olov zv||kai2fNd>-~>4hHeL*E@cSgcMPbFTPBDk0$*P#<9H9k6Qg` z(hoT|C-3y5RzI5bLuey;rysTY(WD=822S4TN3DJ|>4zZs@=iZ$^`l8YPM4)2xIbN&5#~fnFC~~ds)8P(t#L^!IOy`KJEg3(DoK@u|0n%17KE9`u7wk>*UuwWeGjrBhQsFzTqUP6s}2{q~^)TozGqh3OddI>e^CDf>w zP@`T#jd}?+R;oqQsFzTqUP6s}2{q~^)TozGqh3OddI>e^CDf>wP@`T#jd}?+>Lt{u zmr$c#LX8Ei7EoYoWvKZ*P`9_(A+#%$L~}9Dodv{Ut*c%-9)mY=H>ms2Tf+disQ|o5 z{$?r$g ziV7X}0X5Yp+sOGxLH{XxGiXGQ7I zrG)NMrQA!XPK90t>dsQ3HbVEQ(0hcwszRRv?v|_2Erf1Up|28}rb41dphK_vZ$%wI zw=~CT+1&S9$>5lf8N7(!!8MG*YC-N9sB^> zl=)ui@9Wyw5)Q5~I_Mz?arZoo)}(()`oyv}{v&8{)elu4ASJP^o!@8JKWfGy!i8#r z!OWr2C&O@lp_q4KQol(MYvCMX(Wbr_ULqyy6KNJZ;|W0>Oe zWp4M1u3|z6$Ua3tHid;3gidxtB~kZeRZ~U`4@)+z1RDw4+!Zp;dhICxW>J0);Vx3F zF+B%f;kW)~ND4s^W8JZdEGi*OH z*=IhY3<1r`9aA31a`{74U&>unAk3oAsL(P7VweiOMd(5m5?Cct{4T7Ix$iwGn{n#b zLu+{%6;H!2CA0*x`Yg=J;maOKFKKciy^K0*bCEa<4JA{;iiSB=)5l3J6J~R!WF+KM zlVeZph+-WHTYaQ+k_$yz5p@@?rcq9Ekua(mV!KYhr<1G~*HlrrzE!=gmubVVXY{Wv z`j_nLp;h%l=@6podTsQyzMY?>u9f%6g_U=!dKRc(_2Sftca8EZakMz}r(&{3>=-ti zz<GEQtDY-YSWeo2n$}q;Nq-TjZr%AC(x~HrexjNCd`B`yo#1;KgWOT$c>@ldzHt zgDN%e9&OkC9|oNqtei!J=<{M#L`#Rgtm#l|qN$IPRypoLp}gu3LES}zxOX`m3x2@r zRI|O}MZ4iHGAr|<&7@E(XUlF{fN8gF>EBAGY{S!|NE>rg(ja+?n#Z#fd( zu*X@olI0H3+3ak1$2qjg8L~-C)>1l;NjwrAA$ltNgPoX4HP@vE^po%N@I~sA?ivm{ z(F|)zWIMstSOE^(m;n5Ar^jC?ZLC_!-pJ?mt){mfk$6X&y_9s?)6iY69 zPKG?OsyODVAdjh%DjCOwTdIkdIb9%EsjMjJMzi0I9nPV3&X9Gqx=o67Q@8R^-B<*$ zls#6@;3ZoqE$S|Miq~QH7ezem#JA{A9G`Dv7Rr2NIkgf!J4PlMf;bbU?&$fZ%Ltn2 zP{iF539gP+tfk}4@gOYAMY`i{e1Rq>d79rhRc~gH9APx2I+slJAuoMxCaLG$5p zz3p}P1UaI~W$KFrH#>>teE&sH(r_LR(Od>azFqyAnEP~xH2+)aGZ3z=NiLMn7G;uw zTzrv{UM!t$-oeijhXy^xPh=UHiH0>B(=#S!VZ9HRz3VVimuiv{EWp7UyR460=2XV4 zRTJDf7q(7t!xwIu;KnX&a}qCLhV*GE9L{NxnpHB192b*zi$v!OfEPa`PfUfszmRZTUa=`MEXjtrt$@<29`xiGDR@iT5eh| zzzGS;I@R>B)vB8vw^m0A_Js$B7C*HCrIPa<)|-57 z9+P+gSK~uo&MVqqusbL?7FZ(R6o}iVAG0K{SDSod^PxzfOTCo`i`h;n4uM|9^k(+e z%qam>(Te@mcWXd{C)VJakh?V$+~-t$Kq3vG*#XTeRy#%JQ;OC82^OpRmg(Q2aAFo! zCL`b_slI@n__8!qH_T4_Rl21?DDcIu`!d9!Y28*QxYiUvBP0B%P&2m2R;CwH5OWN+ zg%wI{V6LhU4YsynXS8|G)t$}mYBx24s$H z0z^XEvme{Ff15gJY+v(OzEkaky13e_r8JWLMs$OXdx%F)%SHCdU?AFVabW&s4 zlIvv^5JbXXFUtb5b_Ho6kN&Z& zq&l{EwLK;4CrM$+)Kv9Y_z(}^+bs21c(;mNbSn?UA}x?mDQRRF5s8GKBOFRrZxwhw zr@0VG$TXxl_R@Q|3Zx#@OmwU{fGlND3-7`$fe>Pqt>Aj$tpTj_7FJDQfyn#_Cl`*8 zhX9scVK;s7wdjUS#M;9SAn{QP`EY81gbY+pDX5tFynx>vYO4NkcKyUtH1u7cSSIZg zcdvlomTQwgQnM|VT3Ac8lPXyoP4=NYUF;%>gq*9s5SY=mN$()CmL|O)v3B}RQt&!b za4b^rUa0oiVDoLwM`eYyQ=pxA7k(Fez=?`IY>GwNYkImw8XX? z2fSe-o4cPea#pRKEE*!fI)P&`V?LpCV{*SF_mchLyzv0S673 zh^As}j9T7y!*5mO1q1inGcD1$K*jM$soiiM9gVy1!wsc9Qf}Pc8xL-dp+q`=h^%1v zeZv*K7!_s8&z4Kn>+#?wn$bk^Yf}S8q7ivEBVx}N*GJfHb`G&XwPpW!@Ic&p2MfQ# z1d~=L6;bJc{9+(@IWc@sXo_fdoDw_H4Am3HA0#u_{#YreG-e=j1}Zh`g;r)n)OtUb z1XR#2Xy=7W@vwpsTqG^*ITTk@6L z^S(-mxNb=##yy)e-oK1r1l z?o}$~gik8H7R4V(q;kL9yqF)v9h)-~Dl_&aSu6$FAQ%Lo<=o zrZ#^#m8EyWd1m6r-L~EIm6?>g7yEtA-4UUJ+vx$zK^OBD+I{ICQVf_+`cAW&&`?br z+56zF@zj^vAXw#_xNG9U{Z$ikKL62vb1n<1F*fwiSo&j)v-=hG+CSEw8MaE5Zbh$B zPazd%Y3sjXM=D*6fW}Y%@(@lT!0c(S7L`C`ec!iMBS#AQ{}EJ`8rOj~d~k zzKnUSZ>i|~!Xl|*@wM1>-yzSzma^*m9Cw4XfRBKS3~7PSExk55%DT=S)r;>^9Isej zvo}_;HNXCvD>E_2TH{zyhB83;_yL&5$*A8gI2qr0_~NVDn;9Iln&TGAH?W4+Hk$XL z1$~^(=6J>7Dqv(^Cx{L$M!*-g(Li8~YyfZqWkZrHmK?9Zkt2SttOEPnVxAI4oiOnf zUT1Xxsh%VgYWBQBr^9AW7Rt))twE9)uyrh0H2b5${h(EPi#ZSvzR78V2ksO>XU_Jr z5>h`FRE!Y{jk|9^>z@G_N4bUVy-wj2-4R*^vvLR@IT@Y)r3cbOHJ z3B-jRE+DENSx?;EN)rRpM8^7XzlTrDU#IEsQGDF`K&_?xS5zbL%1l}{{MqlvasvgF z<;H3YXyDbW6jY3jHVeEUvkiTak^!Uv3m&*G{l_xtnAewFs1b)w^-yV5xu0KwK8Oad z7`vf{Qh?=xV@2_hRdF=N?v}-N2&0jJ{crZbRy8Pk(^a1Vr(6c%cJ8$MdvjCuMYDa+l?tSlx31EiD(WOkW65TdDH zI29oLj0ukr4e?<_NKcHmIsP6NZs8~DFRGlBnt}>Ir{AF88k4qgwnCqVkx+Nl*{~CZ zRv|N0&mC(YKo}x(IA4uHu9XTp1teO3q!4J#*Q0%2OkcuyMLns$#vb+e_A!^b@dD)r zA5_~S>)|8&R+-bc(J{P|pzQ1S4P_jKuyyOFDpPgP5f7b;63m}O8s0v*kCt3C5SGKs zqNW#w$)p*!J9?W=BgoS%zVzwRu|!KdlRKp5_ILp85jOZHKD3j%p&Tp*AQ-mF$Fc?r z^_DY&$D`rGQqDA>UfEo(x14m>gSJkGPM4{r))FA1x7{H7n)e0oD0v2`IWV+fitzq#un1TZC?tS4k)<~T z2*7^?#4&9KJQGP44b+=x#ElfCFQuq!4IiM(M2Tt|k12(RqYpozAu&D%W0X6<0-fx~ zE|976i3j+g`YfS#*(K|L4>%Wihi~9S2Swh?c@`&iO*v9KyR`1q6};x76-(N>Q(u+D ze70ho-wj|lWH;s0#ZXVvyF}HC=?loON2}p~ZnVZxl*5kX#sw<&vF9yip@2shJE)?9puBslW@0BW)O>ITgT^K)!)+F zBwoB2$#fGSmowe$rKg1!478VC&s@8~;>lFI0rv3q%(NSFW?DE|bXwHf5DmT> zM|T~&uS*>#7&}q9_}@Nue_;CdG%*r5fQrr+;3Kmc!n|r@`bKg^lczXtUp?8TGAOYWdt&N_>}2DeOg7QxG~{dC z+7H?ichhFFy)WmptaRRF8|F{8be!XU-emi-nru@}IN4;D#e*Nltq&dR1({`nwZC30 znC0twmc1#nEcPbLLr=3e)inFD2oG0WS7AV= z9zf+0kK}DpS4mK^4AtEfm1U?ZdQUS{7poVFq534j%xRjJX-3Gd8%l|}+>Ii`-PrA6 z6Nb@g*Z+u*&9JSelvuJDiuvR?QYwZdhJVKS(icd$Xb`AWCY%O_M)ZQ>lrJPva09%J zzHCv#+u*3{QQ>X0M8x^;2ZHXPKlrV`fZoTgcKBQI)C3F426&1Lw4Ec$@HSlDk`La- zqbk$^Z{q{S+gOtxObiavV#!;fB_1keY*jN;gZjnBD2c4yaF898CJ4joDi~JJ(O$b@ zhl=dRuzDIC-tc)9s{`lji&TN``!Tpu6^HEky;Xm+e5+M=`k< zuGdb38*P5RM52zKpxJ+?1#x%t2{<&IR0Vg=d`)pmIw5_AGilqc30F303`ew*#P0s$YG6>O4*eae@524=Fi;k*ZNZTTIWpr z=o-DF6(7Go179-d<**=3XYxUhj|3|gjFad@k>qkX>T&CMdM?yG!Eb8+bTQbtj@EhjTNMST_AK3NY=U$`v;*hScN z63ws!wpMM9TAPH`;_ibo#~ZAZ`U2dRO>kTG#o@icZL#NlMomaq$Lkf7aGspiR;-pQ zMy}6Pf5J|>+ta7P5*25!iJdSkn&jgZ6$_v&SW@cJ|5Tv#PqXtzJ8Hb|&vVHZ} z^$e7H22xLp@SSS514F9s4IOMMtB%IpmAd=^m&GXm+T@idU*}%Qz%_HW?`0{!z2@S~ z)sD3uRzloe4Hr!K8K*g&%R>uFIgt{t=%{)>b5_h+8@FB-cCEX?f8SpYCBhJa-%*Tw zH0I*OT1hmS>AM-)p4c8!6{zyr9t(hi9Ma<~Zpr1*F^a-wMYh<8gP9-gi>s6 zJnkrYj+OPXY2xR)(8Th2S=KTjV?hZNi6wItzw?UPeG>+_iH@hHdR&FVa+#L_1zHP7 zsC_3OjO>7bRhgIZ3gId&CbN@rx)Z%ZN8c>~KA-3n+_hNNi=ldjSSW^N*OlxQC{eX0 zeXa=O)qs5Ge{MkHG9bBR@6CXf6OnGBZJH(Bz;)1sg%WuMF5e-+Rjd!3;9;h-AeI2q z5rz_hJozWcUO`DAd!xaXF>6~lvR61e+uC9Flx*|p5l!|kB3n=NNImgz?}S~c2k~bT zkvFSgvn&|M?1IYz^(z5I{z@R9{$*A{<2lwwC-{;gfW;GN-Y6dX2nb+Cuzyf7*!jpMdk;yx4r?^%Y{!r5uJ=gT?6Jkjx9`ey=1aG>b&0o=U7VR@`)ao4#4B9<%b-p-aS2J zZ&Lc(Nv)ghDot&pPHt#K3Ki8IzLxC8qAXpvVLeR97w`@&k~jBA`leR}5Gy@aa1Zi{ zMos$Kjj}Z?lA1GTvPY=E0JbC*IK?PVD@E(1QvU8i%YC__`VmS&292gDsqeiF^eImR zD~qM6s$Zc&T@twK)4!uZVY*VuT~r_@1rjPGhZce=v;x`iY!$i*RR$l;7Ug*DY%@$F4OOUtd@)`+Ur{WeMz|wDDCiFEGcZ?9EIPE)z zZA=|^K4MNC_j#nfI&L~49d|iO2fF0{BBWcec8C|6d$t$)<~d$y=1?zm`?+3dzaMHm z&udi&A>GoJVP4!$Lb?T|44H1henL8K$oXE}=;2=6bV54ag%^7*9q)(k@kHsN^-~JUIFg=jelDZH^}A>N5}Z&oQjAq%xVsx#!X7 zjl4<>3Z-~KF171^r(dfh5Xrgv>_eoC?E2tCqS4OQcg=MB_GTE2 z^^3`#oNEp`Ji`wT(V(_8P-bj>6Th*SfK)yNj~5^CiB4#@?-7g1t_ppUAu=_dys4rC zGY^nBTl5)*z04`nLVCWfLaRE$_OezE-D4%7PdX#{-AxH)|BEvWb)ttPr;s9}onR9} z4~{Z8t6F4*!N{~5o}vtOl;KJe##|1Leh_uFH7ra4lsZthpH*+-QzQ1$Go&T(sPw^w zTV(|r4xB!_kb7{!>9d@TS07ve4Un)pxM0F^aKQu%Ik;ega&Up5?(jPDge%mkg(E2E zsct6r4Q_rn5DFflw?WL%NY{phlHs96p1u~uHY!_2wF{=zhF$1$MThKyiNh;G)4 z6y~HxF~*(651+5T$WpR0R9#`FpGgp0iT$9dA*E(C zWl}83d7PW082sTY-uX~GIlZ(?bGAn}?CsW^qbQNp@~w1>99o2}x!D&%tyYI}8xnH& zN6`PTScAlKOAK8bsk(U=nqXUdXi#2bej$5P%&i&WB)?Le9On;^vmq1JnsG8Z??w-8 zjt$w)3BpO}`!|{QpQAUzPh!LqurC=7iG*6lo;a0S|M|s{VcK@H&RKO zaBE;JZ{H_j`29fQNTIOZD6;BuEb>IL1~N%0WxgZo=FGW}wO+ayvyMZKKP3%uQ)<2k^=Qhd1TcubsnIZWtPi%MhIReI`s zBNirjq~4>j?83>X1%!nPj)w|1g=&uvt{R#S2H=N^c@*=KWZCz2;$&WqPsRQ zWs(e0jH9O;_WH+&(8|=uh>nM?7J08V>CN2a3<8rg7N}ua)yz_p^c9`Vkuy9^qPVFP zGNXZqE6vPBBQrjvH5O3%2r?oZJ!34?qQ8$$GF_%d$3*U){W&JhtuRT%Zc}TBRga`M z9&8R_JS@1@saO-S$Dwy8(}2Y$O7H74c2>i_*^NLy?m5#O> zCa@2|&l`jK&;X@{_jwgDY7qFBQmHH&3eONe?>6GGMHq$6jx2y4p#5SNp(wXhY^oLtQ~niL4w#z3e3DjES)$0iDa@EDciRd1R!rwxV-=iEe3=G>+?PYBJ-}e+NOe4TDCBO81UJSj zHmgOb@d$eypJETV1k*_Arl7}?mSac|7g?T8cqq(^qp%o?VVpQvlk?aXA43`91K1Yp z(BRk7VAV5^BrbZ!UTTLH^tG2xgdUz?@q`?nfHZg_)bIqP!N@c~P)dHA9AJyW52uLT z8;UY>IF8AYiOteoX3?aqCQE!$+&aQnL5)R}>X`V8Whk{8%b%sN=ots2eO^u<69KMPWSIGx3SG!8OxB|MC6aSQZri-YQIa!Q+HZH-s7B4%oFf?MLjEl#2d zv3*Bb)f7r7ubSw{x`*|vIL?UeOV+?XMQd=%?zpux7TguHHW)T^cyqC^j$)h3csv^3 z&@PV>6!BUR*RQL2Lpafo#F9vCEYbecZ0+W%zh!2K`o>}z7xa8`1}Lg`1cnmzjaNkV zvxE_2K^1~FS~T(uBO_e{@nz_FVfcWsFN{~P~SZmk+k_gJKmu4ygkZ(R>y1hwZvsy3C)i^9C zyGX+xgof0VQV+$fTLk5r8H^M)nwl?C)K&8r3vSO9ox4)xsjNKsEG6`xOn4PokAa!vhdomkbbgqI?!+Mb&F8DGow9?%}w# z!U_I0ipe~u;;%?*;8$Sc@EF+s=VTSRoPkxkvGzP!RlF&mJprXy5uEVp;M9{y)WZb? z#jQ5Z&I*vAuvQ9di3i)5Fcj8HWfuMLW8@^ReD=SNT%Z1_>LfbWB304S8%r4Uh-_pU zD_yHck>#*Fkl!@dyh$VNx^?8jP!@WxuFC&zH1RHmmWr;3v!^)8L4Bg`AoNn0>=mzw zeC1fptn?z4vPH{@jAE-=H%7CyL>RBJ5^8FurnOR2YxO-!f^!X|ht$9zUKyi?XmU_L z#~n04FQv^=Lr2X;nX6D=jaqBbo`uT*bs!3>p#{ZCfYUAloG6xntyf_jL7MpQwZiHL zRUA@4oh^b(AU|gq>nin=|*QD6Rsrw%FfZTkP%MMFZ9B zdY%ZjpUR1;p=U|KF>8x9*z8RkV3q9We^cq+&E3y;!6Ivt@d_T5{rpz5f152X=C(zL zo87$=@kcBOc+~qj=FuzJ)6Zv5f8cB0PQGI|MHM)~WByKV;DNV?7eN44>aBYjjiG&N z>lTEAz57~bl~(;W`*o4bY_ne%i4JO!0yKJtuwO$5?(huf=GUb6Y!TVStxbY4+I6)6 zcXsa{@cbN1q03vNgWlLBy3xeT@~<04xn{f={1ejwaH(n;ookYF3>^?o-n&iH0UU&# z+zJJ-blNtb4rtA%1Bx{r0963(6{&<0*v9d!V})I5fV@*sf{ed^0wO@nV$^R3dHEPb zfNLziu-Xhkp=g2n^`LWtuiu=-*LP_mBx8sWjC@oU90?cfR0m!~Ch##Z{KPUL9XMd9 zs^y?7zXS>Bio*Nnrq+1W_0bcf@X^4{AksJg0~8)=P!XRV3LmNLg1_%q*x3JT{9WPc zPf-)%+RyCtm}J$xH0#m*7X;1SMsG$eld4b&SEwT*;Z$Xx-DiR z;?{1^a-{v{n~1D-w_e9rQF;D4ei&~G3Pa9J@fNg+@MN?eKK_r^H~4th^-UY}+J1nk zD{H&+CAvltR%4hi1uxCiXI8jw|`*bOa@Vz-AizZyoP zJ0Djjc@B#Bc{!$vjhIX4io(@nL$k;_D3>7XZz@2dxJYs9O^>{*z!uLIykBt4?V7F3 zbWrzru=T%-y6=l|PUQb5)cp*w>+}shpzbTmFi7j6?j^FD8q^)^M^5AQfV#&KV*Fb^ z_AUb*p>%_*%W;hE%x=UXmomJ9Wlv4lpy!zTd!PCZ7ed}gFx;WOLHc1(|DI^)e>8Ja z{**D3$eTGDG<+F?B3&dxbQY?R5p;a6r#$Yh*Zm?BOid^sxgMNkgeZ`g8U^xxN|ave zDUkOo1>eMgjMfB=SF}~VoL)+1gDN>NNKk=(5Pr1k-?euXJ@>Jf>{x74=dW3;fC&NW zP3Lm~YA2k|OBqg&ACsI?iS1XX0Le#FiN5-f-F`B-fcs__vV%m>| zfXe!ToexyC1p-obx*M_Hr2QS}t@eA)ynI zx)GYKLKV=1I&_fG!z%84_&>V5#eV3JFKeqk&3k)4Jak?1PYLOgPeQt(%e$LUM3r}F zpcgj`Nt}K=+7Ctj&`*6i-LNvRsni9DhcJH9{fPn00PM!$3d(@*CYDJVpccPq z;$hd#faoRd>S}p-QmayeMru{|(Ne1?Da4mrJ;e{ypoLYS1SK&k+noY0O&GKBsYZHr ztH@HSDsv=PlRU{)r7yWEl)OrE)xj6XbulLiIa?&snQoS{YzB)f?`je7gfHX zpzO49tpBErsgi<>fN44{>Pf%^dkSvH$mDomd?KctHtgvp(7{N`&39{QPMETQ^11S* zpcHT9OY3svOGg;XNnPbjEfQ(uOVL>J(?Duyx0RsCFv5i}P0lLKYtV@#OgBHI8?>C| z2g6weIBT=wC22><-H9dwK6qybBc4Cb0YCl6byd>S#*;sb(65I zK3X@+mn-RJwdTr|bOXA|mHcKQpMVKpDCC(QrX`Kk(}i^G^7BNLCBlYsCpEr}!rGBK ziS((%NS|QFyz5Ig==k02aI=s+NoAlk(lrkcWbjqClDId@QIa}(5E=JFpb3cxe^yS0X4ZN z3Db1;7x~gtVYrxPR^R@Qq(+mB)W~E|^OMnxRA$aI9E==k(j+BKVg{=eCW~NCB4fjE z0V>Q0>P625ZQ%e!DJsNM+U1-2V_}KU2Qk4 ztJ;z|U0ZuVi+wkhGg;K8hk84rqH;bOW?VW`vL9ksL#WdM!~sB?__C`3(XAeBB&aT{ zJ6ALm!*FxCIu|;nJeGFChwAFXv+WsdKUYg`FDi zr_aUqmvgcGg_){V;zffsKrTK2I=8Z(JmT?=q9+w*9LLzX$b#aAmW>-yHlC$qe~^O} zPcgC}b+ma(B|Xm(1+jX~iRSa@0<@`sj~-4m-n= zu#7MX|H{OHwmeIErD#hrYiQ&^9LN*Waud~J?3me&D;(rNyO0Cz7mmC2ci0Pj5+p+V z;uWtV2SN;h8a;}AE06;nE33Lu;osLg&F>)xS|Lp1#Ex7!5ak|;iF9;R&vKwmS`H+B zj669Iob#^=Ro(;o{YBzM9Hho6|JZj_LuopTIB1N}ln>?6lt(zG_-V2$RZX9+44n9e5zz+LYvdu^T^3b=^2!Y;8;l(nEnFXrq;|%JRGewC|=DhR-aO(@FYRQ zvXY>u7->%uB!d4MpnFYmG`J~_DRONc6?YpCUKoedcn-_R6XkeIRO~BtWYF=`R+mr0 zT}-g82kaQ_pS9@{MSp>`GpWFa(#N1XJUmc-KcwD!gzY4Oap_Ltt|G(r+(iX5nUarDjvMMo_Q8&WaXAnF=zcfTWfjnCE_z7+Mnwz3;y z)D>oaj_=l_t1DWEB`;l1OQ?9g)bnkH@h88pNC6D0ihsuMYc;lKRh;{*$|}Ne&-*Lp zZm}+`;GP(ne(+?>Do0Ja#EKEOeC6ilUuQ5ss|Hkc_J48vx{zsd4#!gD$HlnX zLqsN(Psv1wGM4-kMS|IK;<5Sg)hk-s_ic$;87KMu97D)8j5fgO8UW6s94FbJ z$JN+NZqS3R6zX}W2{3h9B($o*QymN?8;reVvAGv@>+hyOA}jBfUt%wKmX0u*gb&Ft zOhSeJ$b=P>$y=ROD>Q|MuagEW@1jsUj6@Eqh2(A}6%R#1az>Mv3wUYI`zi5IY<-N? zWKqF&lHoq^5|u>-v8Si3CSOX4?0Iak!wH4mMRlY^x8^DJcv_|k;-QZH&`(XFM0;Dv zGo*|KR(UB-XzL$FIhDhoScH!SchlZKKv6nkAZzn*0Jz9=t|0~6I%l~g6P%9&>C07= zQVxbxv!q43ZP8T7H=eA4geDFVxaR60M*Fk~t!RuVtFSSitisxOvI>e0V$@PWZ9KUJ zlL4UbrSws##6C(5aX4-5vHz;?7-$Ox#cNh@m06)l-V>sRdT zI3QhUqf{P((_s}o1oG6XVvgI1?dS6glic|oa8{$FD%)xbuk|l>d&K6y~fIe zyUJ@hCQCUBw_@l1Lu;k+&9u6hR6L?Qr15rQEDei|Q9cT0Um=tbZ{l(Y@X27d#iCUi zcK4x56~nl}xK_?CdTrjxu(kHw=4@kO7ciHXEoNr$m_!w*k9Y8JlGpI!gbg;mrom5= zn8#Ee(r$>G-30B#4``*={L8YR+};S;Ct2u)Q~>i3 z#7uw+W6q>flMI7C&qxwWEZ2DkeXR9-e#vsJd()|{*SeEW-EyrPJGBk$5^KgvNPt5} z+62+`oaAq(oW<4#Hb~E!Il1FlhjLM3g-#gS9<7lC~ zObrrd&fOO?SLcYO`4sgxkW!pM9^_^H>y`GxRqW&|LFEqItx8k_98LcIL;1;3gs?e= zq3vj!55R|!*W$b2I-;bB($>QfcU$P-wiP>*hdLu-XjwNFyfdi=I8tylRIof$dvtKs zCFxtq)P;>{-sqKWww8XaNnNkhzWR8XozP@7T&ki+3tPa1L<$T*`WK8RpE39>q zjG}5s)4?q(b{;*{ykh6#15MF@@gkB7xFS{?3&caxqfUGR zIEW^)u>z&`yYx!XWew3p<;FC?PBhb4#2pN^v?EsWfnE1$0;Xv9MYKx5BZ7zG75i<` z83%n*JCTEKD6SFW|cQ{aU zkD0L1)FX0&&#FWeo}8sbU9yDIos6OMP*3sn*JWDex8^RQk_#0Ip|?HkXROzN&s|s1 z0<_pI1D;gC-Cz)Q${rwq(99KWMlC9ewVv_e2CdOkFEh(Y@k^9;lpZih5F47Bzy!+( zwvontIjtDZrkdo_(t3b|KsCVG7Wq(0{q*c}B;G((bs`G;dGU%BX3vh{`@@5%+L=Yn z61v6!R<}LZ^f2yn#PskqF+IF7YAJx*xl;EXMc%q6PLr8tnxe1+YOYi*Ql@2T*i`lF z=}A0jZIs6~$yl4%8(UY4o1OIH1FdD;c zVte?eje_XJHo|8-URX6gxv-2vR@|OG^t4Qki2L`@!8cZn{o$dv!`41mz2poXZJ5Pd z16E_HWioRzqkT51GBf>1F#vQuCvXx9G#A(l!LuG;H6i(P4Kj5u?00PD{tMXjBE?J$4sl4lq&@HWVwoE zY>YLvqS1h=bliOtD1tffHVUusvLGsIsW~w?D5R3Ve%W*)my0HqpS~0K5c#Y#mw1i1M(HT!|rRo@m-ZHu?sv?w?O!r3gU$l ze_0G&4H57+C~+!YO@aQ(;GD5COXFCX9HYD6H%52u`7Wzfo7uJNendt%k-K@sgS(Y| z-N!iK7I*ic;W;6Nb~l=k-R$e$PjaO|DbD0#)}E-?*NtTD>+a!5J^GWv@@37VKY2AF zWjZ7AV`gLA<@9n>x|JZ#(<dW}`%n-y<{iZB%wlPA1?C;DI!khFa)PhW?PrLk4qT=e zeOmfHe+&_*v7SO1JBH}s8l$m0eWS52h=q~vMq_tWy&uPD8hYUFDNN`l z+7BN=zya(Kfe~`Wlh>>DmmJAQVoj7$bWMJwmBTC3?I{H04&}GrI{|&aC)r=eP?kV*J-cA?6 zrA=z1BMDr}CC&yYfm_S&0m?mshn=_y08Af-NfyETzllzfdxSko9DxU4jkpIQSh}k? zW-v9d|2@v(mqt?V_pMEY#X(ujvT)PiLd*>G3v{J|l`+!0?Om`%eHnncH}BLMz@ z$!pi2FC=eLyL#wc%PTANCpAaUc+2VYYI>Bs*6K&}P;Y={ud5pXv}p8qxu~|mUoAHH zaXn!+K_Ge72EW<|?1qGN8qHH|nVs(&-~3 zP*@dG<)jn{Qfn}Cm!Rtu4iJ&8K-drYg;(YjE)@wNF|ta(4mrstP_0{is%TY_@JlsG zqdPZhKb`x+K)%1Mr7Q<7@osNdt;j69E&VA@^&m~sr__J}f|m<`tt@5Yfi^TKQc>9k z7NHXul87lk#)&oTGpm_i^-6l2P=|Ubn3z2eMcz2)422B0hAe8hImp+;aL3&3W*|_b z5L3qO3|QJ05u>uh^D7xYvwl$@WH+;sjtU*5#iSD8%v@afQ*vl7M^O5F2uZ1f{~0+o zH>D_jCq>1Qf7*CAPb|Y_;Y7U8F+&##_^|5+^ATvtEU8*^qs;5{NxT8a(L+uWHRSfA zW7)jL08xv45gq#pM;z>|p3IQH>`JK)Y6gn~lToFm2Akt9Po^JJr( zSxlC?lRe$cuEu?jRK1i=k=?)-J-Ut3#s8VnjZu_hsSCa+Cj`e~X~b0Kbd?N)D2inG zFnQ3@l(i$Ce#D+k8v^20+MW!0b!|=%JXvuYIq_$7G&xR{dsgr^B_qbfZ_hfK#!cYD zHkL7Jph%ZFsw&cAv2eIqS(V|?px8NlRauqc+?SRWW9x`hYky`@^&~6)rNnCtLl0$5 z{!rRW`-T?S_RhW_b1y{kV|%JGuif{4lLU3Ig@RVKiPKYPBu*Z zq7aOU-<~I%nPofU!MEWbc{&N3l!@O>dX{ZeCVn^4Sv}1#@yj&(3A3}OY1Tk|?m!u1 zP@iOw%=Vi8DT_a^C~W+$(n|1s%LHQ;zYgKP`uwUbO7M2BuELhQZ5rq!fSU0X5SYG2 z0H4tTbr;H4Nq_Bq(XatuTp-^hsUdH9$0wu#U370rH&>0YYLBBZGtYrq<3H6mS(1k-K4!D>~Du?DQf-JB2AsG~i9 zoV-LrE;fO82pn-=iwDzUH>KgQ*vf^d4Q_xXgGx#dW`Un2hcXNNG#Ip69GC@;XUzid zX2rphd62j82VlwEr$S;D_!aPZgk9-EVj7iQ;913ac7X@pcP>bC-|jpGwW$@cgH#i;t=fOM8oRa4nGv zzyB2Az_YOaDQy$tbaB#jz9wN?%9&+2X{z$;XzE^vCPC(0)1?-Sx|SAw%<}uQ>OCUC zG|~VepQbnl)8{`#iSTobl<>C1lA7XdtY=p4eQ;Vlb<@x`kW3vH3+}D@f&zkyvBl2a zZ_a3K-q)kwg})_cer5L&{+6-xd#c#^#Wg|J&hMtEwOQHuMcMKNC%94D`P~SA3rhDT z;cwaVl$Z=_Yo49o&+^d}gKHReerKGpdwT5B15v<$NolP58nsNpTmFG@-;KHat6%d? zMcGsx-7c!YxbGFhAol4&PKx*E9JjIbtIl!5gVEr+{!ucgrG)qijs7xEgnxB9D6qEr ztMR4>Wh#l~-|Nk}aky6(!$`j3+T>`jMnxSp)vU9MPGY9%BjMzcovj7}ICy8FBX%+H)nP|E+mnYNlOC z7*2AIvFPwkGi}LrYoXzt&@nP?V{(#`J{FC?a|Hi?XX>YWwUowRd&IUi{wkfudVM0A zm}D?ye}QTH7};ur$dLe z?Q65PVn^-8 zotD)VE=_ThRJgyYC78e3dYgKvaI&1=Q%3y)_wJxKnXRgcbF=hrS~R%54#yQz4k*3#ye=KmuH<9# z)YC|aP-4f93ScFY%ybnmesj4<9wU(~TXfdMP=tCLFG8no^5;tF?`!QS?D<=Je`|s* z+{726{Nk<+B6OX8`gMJ#K#&kr`&S6b5EBye`UrU$uE{kxJp)NGO2_MZUx-uCLHHjn zroY?~-T#>BuEs0KwV_!j+RzEe+UT!Uh!$zTK}3nQ+Ytx)KFj4n6~`f<2@3M$+iu?i z(ua;G1CcvW)p(li_9T#YdzGCvjn@gJ-CklRS;zZrcKLO@D||LI?i?FB?_3+oI?smk z&bOieaG;WJ*;M@mNK;yMf$erDkfz{qAWgyQLfh>{Ano=Kq+vDQiHP-Tw@1EhQ~Emx z+TcJLGWM~L5l@&~P|W6UG>+!cX*m(jB#Mfwt=1V4Y#|xTFZW1Aiq=Hqr4a|+eV{{+7dMnM^V8i=hm_DYTWa4N(?q1Ba`sk z(W33O-=XD+%0l=A#1cmRg__e{=2GUESIW?TnY7X?a{&XFG3*b&jMJw+gnE70G^xd` z7m5K1R_W7H_AMbcELu>uM@8R75qj^BE&3&6 zAMQr6faO0oqP$8d10$z1;abl`{OyK!l;GtdBGcwv{!QiLK5c}y;B1UYpDr`Lj5*)% zD=~yiZnR?g_od+$tz$E|4@*nE?;H^o z<6S2*Aq*w1adVgnUJ=1@*$S6-*22c3kLS8z&gS}?lmOm~$p>ke0d!M|2Aqa@VDw%% z#ZpRgRmJchz>VdvIF0{l?iJUGm4<0qE3T6rwrQRf*RgqVIfNlgp7+DC@zJ@WN~5U5 zyxrTLPn0bGiHdev{yQS|5UXIOXb92rF`PjWwQTon#=j(k)k)g;@|lnmHn(EBM+h>S z`tnX0M2gTj*TvHPAwr5Iu3@=g8(Tvh`glbS4vP#2L5P{f{Mrf|?()@64avdIF3v!kVrMO5OMla$*{0Flxmzq zwWr~1!_?!?z>uO)IeB|X)_OQ!d&szRUL+BgbHNbY25sR3+oGt&iyg{0?*0vaR94+B zO%)ro9B!m)z-PZFwkdZq3EEMzze+8YbqIYOLf>BK+Y5agz2VY*4ew!U%4qr?{*$MY zTVP?}(@lk-_sPaVP5FCBuY@EfwF9|8s78z=`cphDbc$j(v8DFSWSh`LVQ3pq>D`8O zL-bv_nBay@^A6+>%iQ+5&pW6tKn?`o$SxU;QvpIWB4t!6ub8Euk_qwAIais8OR1F~ zj6Q|LjKnG~(3 zTa^@Tmu|j=lR{xuoMRtT@2GLKkgc5kVfmXegk?J6Fh##5>apqIjJsvUOBS{3&M(>D zUQVG>QB}9pCuE!Y6t#-$DE}XWD*DW0AM7Rz5o3NMRP<`t-C43pm0uu73b20;dEK{z zxfJtG@*0Cz?@@^LGyVJ5=hu&7aU~qvjm`4@ZiEN3oNf*yTqTH>4W-PfZ5`50uWvZL z{lbWQQ`Fs-EEYj-j`+IwB2WvD_5d=&?od}tU_}-N!iBs~>3^oLFNZ|UFWd{H`GsyA z0g?)H3w#Xq;rMm117At^q0ftkO1E>4oi2zv3_Gw0bpbV@_+`k@)9)_mZ}A05FBoL} zmGtj)Idr9E#t%1^HSRT2s4kyC9^w393u-1n=hEUV5V_=}8C6}niORxwR$BchZC8s5RUnbFvvaQv!my`}JjCdJ?~i0$HC_2JWFi=ZB78 z<%)0^Lsk3{Djpn0tI>ELKK=V!Y1<`Gf_X2ApG}aVJ;Wc1=W)6&FN=eVRNajdKf4%H zYU;0YnmRMnt{40(5C`nqfI`#SkJ|@F+?@46eo3-UCCFK&rfWC~KVqI9j$cEQL+isY zmqDByRxVv<5BW00Th)_sV__wu{sRi>1J-{qaEDEY#Gou0^=}9v6Lnw*BTm%Z7&e=u z=BxIQFFPEVWAH3wJ6Ud;+6V34Xgr)_5BEr#+Q+DoUT4rR%oy|uPKDL}ZphslcCSm0 zXP7_78Pcx-(!;zgD#xJD>&j@GnI<*pP{Za+@zo&;AYwL$S~@xW+WC2#C{>L=TwtAk zeT-nj@x}rrppAwJwAeScNz&ui`N4+^)UjqzY=aqsZs{KK`CA(c?1Qf?5ie~l=x#Mb z^3jhEnRBw&`6#bZ6z4a_nUje+9#Im+mMDk*g43j>unH{9rM8_xXTW9yi~wq-C&VWY z1Q2CKTRB%V(r6431YS7FdW8xMJpk)E_Ze$9#rE!wwe(58M>q($`D1@7c$BUTiS-dm zIx$$Rj;^*viaNusFE~e6T?8T>OXFuuIwSB3a24jkJp=-w2NA?h?o=P5A!^t_p(LER zigT+6do8>^qE|=575!I4+$~phy#q=(n?rrYp+2IzHq4>bcM4H#v-|<u4xq$=dYQ<;E;%uJ9Wz_l6iJ{~NU}B7QUo6zjSngaVi6+XZZTge zljCPE9{7C2&1=47DiWNjv|EhED?6u*b%%16T%_`UE@?40!%x7sa_S#b706v~6ODZ+ z!MDOkO}=2rUOSFTvqM=pPAekma5c=}W=G?b3vz?;>xq45dhCyW$?>h}H7fR3n4EJs zxb8yHtUXEv2`k2k8Zb8oie8B_g&h02sQD(6mJd8ddyk6OiB!(FPQfh4S5=sAi2%YY< z{6LPNbF@D_8z>8`u;>%FD+sw;ulmie_6}kwF^236?%T*PFeW^6pL7u`haV0b*R**iAAc!L}jTD)0w6WzEsi$g(k zH>l&7r19w+H_K6>{(Eta?DdQ{o*BMDR2Xeg8i`Ptlv{gQ0F4A2ZhrPa!^oidv32BT zf6%=rfX*9i$gs%th{Ug3b10!yy|xdL9XO?!=yv88ND!8A$l7nLYA)k+P=o`O(i2$7 zS0zT{#1eoNkW%r)Ih^xU%p7rCGSYAUO=5ocUk`NosAQ|`3AnxrxY{{N ziJD8vBZG5JM9bNtvr>Ts%&+8}d^@|(c-Sg$9kSCgp!fAT98YMivTzYsEvxG)Pr`1iS#3#XkX3|tY zOM;i$C`T{Q__f(z1i!j9$RTW5m7$~5jhE9`DiIQX99}d!vc0J40VOJml!xGnoT&3L zGnSrn$5?)4FER)A2?C3a<-)8mo{Qp|!BH$rFCQX9O=5JmwFZiv&`!h|UKLmKD-?Mm z&hVIIui1sBB32?6)ToWmU_QgXvHW(C%%T2a6FF+WFQzfHlI+u%Go7epnSY9BrORlC z7TZ^Svz5+p(c5fI$QFqCUQ~V`N5%9+LvH(kwABnbD5gwa$l@tvdKk3sR9m8p(Xy+B z^l7;cF9EB?X*x?n-=nubdyvp?&$o8m(`55C1@M=QPrqdG5*^ZU)tb9rG@1%T4nY(g z(dg;-rgV~UioUzei->unGImicyLBQWEZL`a?!>TBrm>3`+8>HjoT?%{O;Zqk(xFk) zrx`IRCpwBr5%feg?o!)V!5pU={ViIw!EgROaM8S+$f!z|CsgyIKJ7uk3LQ(-CnbSz zwX>v$&|uX>u60Z<1`ftq@}{RLwLar~mh5nrQgNi^BG|H%Eh3lH6h`b8m}WWma}Y_^ z_heCn)j(tUbCNVYjH3J#YZv{LP~-$lC~|@&6geS%>j%Z3n7il~a=#cVS}!|4?Mu-5 zfw2p_2df;3J|KMrSGumlXbM76Z-L4XrRpu*)rN3V>IiPM&&K2+*}`?KE`*Z1$ucXu zB1NzT)2*fxi8FWxM<$mGew-F56$!~gG5irqaO|ar&678z3X6tO403m(VRR!JMvus{ zh`ST>=`2m{V714RCuAEXU7pZUaMZIrp_s@(kp$;e-mrxUw`={P+x3RY8(P5;a|uVm z5z>S=Pyjvcn20p@)$zvnrPuDBLsl>86P2KLoK+h1!N@HQNi$0>%Q22wa%q+WXqI{1&5~QxZR9huylBZEwpr%Imj|suFPpz#x7Fk z%9#bE3o6;x$|LSqL@~R$-TCfVD-RVhb4_PX?CJ`)D}zEfaUZo;giNEw=`~ntyBe`s zhn0%l)C{t5e`Ssyx|v`Nf$uSvPsV{wkKRc3ctdx!NJCIHNQOr}jIRVEgykw{7$;|~ zVLT#}Vk}&!Vf@M7RE(nr?*)sUft#Ug4@9^^XfgDx7DkKnc8uEA$fL*Sg~SE{9tN0f zW-S93Urq0(&d>>CoiRRBpM~QHFg#P6vvc9;l!bBzDfSSy*1p+(B2lJ}%&GBB#$|-C znu#5wRFE8Xe->{NMv~FMXk0;;-qrTcc=$5cu@sM@X{0eg7^Vu6LYUbT{~m;YpVAZm zj%f>2qNMZhV%OrCLD*uQE|%>wd3f0Qye&-1SeZf#a+qZ#;fQ_-4lm+gOh!ievwWW{c|K;3M}@Awr8c7Bv{6wL|N`{d=?tuY>vT% zM?66$i2p+_JdnTCnh_MtriZNd6b%FEEknyFw#uX`wt1D zkz~0S2c(_lTxgc!P^AgN=&F^G<$vI-v=^r(iuz8LK4GXMmW2w{5(}A!MT)kkvC*Ou zbU{7J72uN<3vHX4K|kmYEbR$7v~jCp=$7~(v8k3wSD^H%4_xf$yohRx57_*%GC^VS z$32;tF)%@)8@+CG()_IUZY-B+kJJ3R+KeVq-IDBuxP#`7gBjd0f^8{#2$CV1H^YiWW^QFOi1~O-vCQNnO1U^KY}|J#oMIR&^z7Tp+Vbg&XBKX) zI&iw?ne&Bb&euHidU$5BcHt6Vif2~k)s1Hs8yCVfD;pQWH7gqz!Zt@78yDU9W-)Rh zE4G=uGmAXxG%f0Dgm*qfHw^DA=kBSv(iil=J6m~`T-}X@&PrunPb{?U?K7K`wiWlk zEIFrG=^pG*d<+elgW~@cXRTC+vflh(;;aWkdrzG8L25Ugwdzif$ypx~yFJY$&}g~_ z-a2{zQ4IEz1mmdt*9^8YO<^(EJ(#9Q-kHf@+qr%_VOuP0-~tAT~4r4jYE#Or3O=svV~+P`s&Uh;M$A z1qu-k?5Q3fM1!u38mXok=%vmubGR#6jfV<4lo*tG zU2&j^3hH9XO}qUN)=Wdaa%?du(d?=>DZc`eshZbyBg@%!3VMx+lZGB*cDO{jt#O3M z2D8Yd!yDrWk3H@{=br@UqkLquVy@#D2BhQo8ITV7l2dHxdk%Dm1KsODyMc6gGdYB= z!)pRspyKGZc_SM&wmMVxhEZo4PmILPQn-UXiD>*8TbZfe&l%JCIdZ;7!f{KP=@ewN ze%97NIIyhaH!*kGbKpNbNg(O2zE9;j$U0V{N$1 z>}kVgrrL0sruRN3=?$0F%gBvreCjc`Tvo3DL6Pt;#D|%kMcbUda^bs97OJpOlq}XA^vNaL(<)OL~nKK8!dFO?Uuy$Uigfg~WoXmjT3z8X% zq(_PFo9AdfeRU>}$C|vc7MpKbjo58%&~#cGG{nAS4=qb=&cIkBbA{Ff!jgZn^~Ni+ZF1$9s1k)A4IS&a!~eXF5Y6# z>$H_bZ~NMU&SvSIP=UcnW7;Ej%q zitaX+yQL>i43~M6n&Ej1^b~Ji$XNccd^7iB%3D@*)S62>a%Kyz*2^qN6QN5i#^jF5 zScs+^(jw~OOW-Ng1aBdd2+Z#6b(TocejLcVGImxh;zMHgS7{MjNMynnv4mpT{vOXl zotoXjJ9)F!>WT=hXZN_gBKE#du{J;K2(37fW1&YE`+=wy^mlCzn5v+SrVTQ^E0jXO ziUZ}z+QpI`aDllpffMGCK|@<|fSZ(kkCd%D6oX93XKvRPv8_4Sk(sUSE929rq56mt zmi-U*er85SHPjffOGzT-Fgq$*8RrUDZU%jRbBB~R>cE)D1c^RJEM}uX| z;ReYbfjT~<22ssVV-sl&!`y%s1NgsMcujc+kv^@-bs1B(naL4q%BC|(G*36oL>r(v zeOff0P5w);a7MGp4;5{X7JY!g({plaxOCsbGowxa z5XA}aune>ZZ%h;Z#!3>pT$@8hojqA~knM~)GOMxdKfIZm63$Fc;zRoTb87m--mz-( zGld&SmNJ18tpk&B^tvh>hW|AO^27RT=J|vin|ZzzNHfo?fHX6Hs>AUA5J)rpTO7CD z4%Fd5LI_dIsTvpE5b?WQLLE`Nh}1>U!uPrG;9?Hp>d$=wH?s&A^9NThH**FT^8pte zzAK-55Vw!Jkh_?>jC&ck6OlwB0gGoJcNzCGZiOJv)aB;N%JO);*}Zf6^zGOGgaHPU z2yVB~$0Z?2FzV@pbV&C$C(ghv8gfw|dy5uQo zBbRzf+Q_M1KK1nWlJxmp*}cltd+%P$)H5erC#7$;rmTOq5b3k%1VvUg{8?bV|O;yG^I$tGwHEO1{dw&?!$lU!|@HeKwtvuRiiq)2Z`S=oLDB zE}gGXO7L!6jBM939^ zKAZbW?mM}=yhmh+GtU|gf7z6OXzU9PVOb~O1;vEy}e7s+10<7 z&`b;CyX5?-JjFw=UT2E4E5|EoBwu<-nrMZ57Y|vg9pt*~aQgL<^t)UG`7RNk!c#nW zdr6+x!mV*pU-^(cMXRp<;Vz2p%7I8TT@7RVP9GhRf-Ak}U-( zPboxsO2e0@6rMb#;N*FZdbqRCvz}6DLZ=j(&?$u`bdFWeUfC7unUgJr=CkN5ww^+_ zO)s@m(QS8B(xHN{Ix0Y`<9B6CrIUBv@w>96vdOztGz}ZrH7&^11A~B3+OQlM`#5Y;2LXl7Dw|KE{p0t%OyjZSB0k`@vR{#8x6GqEg;JK@GHj-hml=Z5Y^Q@|4p)vOKOx3 zM?(^hh9n#fNg_2Q`KBQ$VGT)L)X)t;qlv4Q=cn9qNy+Q*H6-C{NW#}p1loe!S8!j- zJ(&Aj+;V-3Tl?3L_}7s5*O1VsA)!x0d!gea?)SLg(IBw=bu!qkw2si8NZX$$uzZaJ;>EVt~X$`#?(VQNUi)R2U!Aqi7M5~hak z$G^xD-o-8FP;cWFbs2J9!>z;Akc6or2~$H7riLU;4GpfZTvX4SToRPD^3UNho|SH&+5`yCvg=9*mpVc|)G z@wkWcFDN(c`tj?%9A8g3IO1z?ZHnk@}>-b`&UR`}%-Sg)H z+&yj||3d4@cfTC!>!f0-MPWa_c-%iA2@>OFd)p`Xb3$%(aD<-p{3%qv?EJao!$Uvr z=Y(8t<*MYj$32KJq;%&7mu>6sgnWyGW9QFbEEi#`JnlOfTxFacmp!E61jpA44o-J^ z1edblUuwXj2c}%82yD>JeK8I3d3w2wVeP-9x?**Hp;;f8F-; z0Zzzqx3+0nOwQhtP3h?)t`a5l2ZO9!zymu-Z{|mb*+PA`)aasRrridUne@gWLHhD z6P>tnEfR%`^0;67ww|>1I;-mIlN?{CI5@s;_2**c%Py}eL&IZEa?(E3qEPxWkNelW ziNmT(cdpEHLLTYhNXT+o+?t%f!Pf|4mOS~%$7430?D#rg5V=k!724Mk?Vy-rk9#SO z;{MxfSN`J^$Co|hJjL<#miFut4#(qOPcmeT{^Yl%Yfg21{lmeLxYFAWS%ohPyNn-!OEs2;ay z$dl`;hZikA!%4-f={V~91(u8OJRbKl<>qqT^!)TY2Pt0@$E7G#I0|E?g(uvl$L+J; zF1YC86=yoWYzh^Q!q{!abrx?>Xw~jr7jAg+EQdmo=aEa{D5#I+B6W>AuiRX&Uo3T< zbhh#pP0K@tqcFx;cs`yU_a)Zbf(M=~_c^|73KfpRc*2V79NtoSxWC|rzn$YyC@M4M zQaB2#v+BmVyx~i^>A!OwUw5SAsE^lM;hd*@`LqX@`yczu&vSg0r{gFL;U?vhT9L~6 zdls1u1&*)F({U8`yH;LHTlBc?KCE@(?MuYP?S2z#-&$)eCehNa5(2le|mFgRADuwK0xB z;VoHr)YZ?LF{`qodR|R!WnJBjo99+n+&Z{Id$9gT(jzIJtl;`XGKQF+woS(TAF^_8{dbL+-PvSuu-Ew8Dmtolf*7J*G;NJZC-$m|s4(XPOmG_fOqY-Tia7Jd0G%zr{6p?%W0QW|YsGRa-ZQ zw^SzIQdwW2BDr?X9hG*u*?mP?F-rGqz1n@9^{T22^|E$udCgd=#>l}G>ZQZ$%WtM8 zeiP2Hp%zYxnwuNu%$-F6OxB*eeW1=+9~7T0wQW{qRe8hQ`ap&|)viZ(2+wrSEHVnT zp>EFnTdcq`KbB;EOv}M;btXM?Q_W77^{h(TU`2U-Rij>Tz@C&J~c;v@%mOsxeu-w zTz&KRhWNOO<EgT7a0O=(w| zYf{;ep{19mIk`6S@+9NQBA6z*Wa1~`4H;i(#{DHTlMmrr?vqiLOISRGH)2Ev zeeW}NEoMwDm)RSa43RqCOgv%DUI6EmLc!8Qp2jPcd9-uY09^>qk1aeI0TtdQBODw7 zmUFKG=SrDNarNTX;SC+B9IQWixec6OTX-_mD!dWHGUDBf`&w{*ccJ#^l*jO)8TCMz z=r1fBjcJ89tTZEEgrVvubEdRQ#alWoqud7a{X+0YS-3L3E4-m48F*(UCVT z2Cndimn!DNj^=xPT&}xu`PeGXnRa-?hGv8(vIxJuoJGVk?Nh3Q3a_O2()5H(!+nQe zz-wm>7U!m3Z|h9}{5$CK(b_c-vR z8m~GIJegvyJr2B+!Al+oo|MOtbavXTl8@k8w zmv;3;pEUZB$AKsHdH!+WNj>=Cao`nz_m|_qlY08zao|b6n?0Vtv`f-U`KGz(rNcA3 z;VsK8JF1;adpo}yUQhWa-SRcZfhUvo#XaB+8F5K^_s0a$<@!-KJXcOG0=H)!nu7Ma zrfu~D{N|R}A#YvZl5Hi;?Nues)3KnsF7__U&%7_-oinGqcO#+9X|+uvsH_AX=cEuR9kRE3PC%>k?^o|<;5Fy!%WMJ-mibW6h* z)7R6NkLB)G55-L`+r6Mny{fZU5XDSYO}^+16!HkJ0J3PMca780$6)8#>Uv6cUAJN%5TSuwHmY*amX_G6#}z zTDvU*`gis9KK>&LlEgixpr`o%wSw##>^HZWZDY}T5J(I%IgN6lLpGgUfzr0x-txNF zYzdfKO12%?8z|jTmlrJEj{M;+<>WuGPd@Glwe0qpn?ikBP+Bv6y$aYr)&E`p6#rz& z?7KdeB{2KkfMj`%Xb&cm@N@iebzB)Wr{?;0ws z%8VbNgYB(`>7mw*uOk)K)VvfODey#g-o9aJM0ieC2K{R!6=AbwPdbA2ij*ojT7%S> zP?n+LD!#S@51f}T4c&F93vl7}#3xc{#MjzAJ{jJrHZA@&!a=F1+8+XcjmH0BcYIZ+ zo-4#t@&-`QeuZYvh&j2SFu*w@sznr48^M`q;o>~OY$VwHj(R7Q`E??!>c?B`a{jtp z#!4ySP`sf~YT`zzvcg;1RklpQ-KuOD#BZvylkilBfa^C^*&tHLM^#ysc7MFL|Dy5U zu4ZFxo7ooY*d1#=7eUNFOaHL_1G8arVq6!3*rGzomc&KCHYB!^8|O-Bj}#WnwG4KUL>8X5OC}*e-m@%f2xm4IAu3~(JlN1 zngFezM;^D;^u2S~m zIx@pmjb^xZifb>6pq<2U_bu8-a8vyMT26x(7(daR5luav}ZwZ&b(=fPSlE1JZHa0Hi~i z19X%6Dre1gisC>zl$U`{Q(yZt&_1r9Gk|m`=L6|bh5?nUuU7zRT4cjchjIhZ@6^}Z z97v8dYq!-7^cx@@@>4)MI! z<+#+I&yC#RA`bJLuLPx*$GW_ACvet!9Fi|gxRP~Ly0-_F8+wc*7YAgKIX5ptcSA~tGuLjXqn$Ay6^o-ttnpPAu zH+%s-C(I-shVV9H>bB3r#)YqcZd|wJ^N4XVy6?ufn1_ninN#2c2Dh1qaM&7es8Nc( zzveUqI=RlE5=c@82Fw@zv4h?^1J(}%Z|!p=RsU$8?>Be)WABJ6-@oewy-R|o!XUoM z0|v3oC8@~Ehun1nP0p9}z#q!_>RsLWL(;RsUy3TYsH^@Y>!8C#PeEI_t0hwUV#61u ztqnP-c}X@BS0Fy6BWP~rD2ula$8ET`&j_NT3w{-?!aIn9sHQffuop^FS}f%J#pHb? z8G-=w_6a>&d++Bx(DOpDRP?L5$e8+E33sCB;_adqxO8j77qKIKp3i|6W9(bu(zj7< zy3YTs3~15PS4G2fuyJz((&Mc%hB_nN&%w{^rot_s<)zrDAZ*mLBJ#LLGPHd*>03A? zGmxb>rw3qe?_vx|^}IXUhmcR#cJo44o!K?o9#B4^VzNggd$18Lq>69z-{_z2zsWyi z`g+OEDr2C(O#X`H&nJIm^FVi~)h{Ei)fHzM_erl7Nn>i@26m%+%ijfaW5>-Aiq4=l zHmUgKt3?2c!zJH2!m-;PZpsvn6=?T>s0_(eLV6B}(QQx2bVtn>BBnn#V&0aIb#c@0 ziw8S+6o#=uny4>u^I;?>h<-_%ccrvaqMJYl%W1{7Q`m%y3WBjH6iD3S#tz&2k^_o} zNPIdh+t{2CykDLux?I&FyuqqQ0urH!AZW0W4Lu} znY{STx=Eo{fnYR^#z%Q#7|oC3FaH|)dlwA$222ZacE0&Yz}y;p$HVCkPhCI1;>@Xf z?PJ5VSET@jDdpJ#1Oq+Z%~zX&ww$Xyfz3GrdZVSA8@A9lNMZ_^ zqqcD{i>AD;Q_WA$mR`aR&#U{8O${A(Wg6Ra#-EFq$`dk>URvX_p2Sir)^Gcg@Jy?P*b7j!zd+!dsy(R@6<=yECG7 zwx5mWESg8a^rFH?PPK4!sPr`n$cPO9PdAuSMwIcNhZ76XLGYD22kIRB44Z$ClzvcO z7*0(0qER?x9^%}KG*5zPYOdeiJ}?s>jR25W9HReWWI_uV`I&_a%JTgA44l~IK0Ok@ zCKOIYIp`VPBbDgd{hvtdX3J&I&M9ll>Rz>==yGaM=kt>N&El8KL;(_yw;o$x*-nH_p=H_p8!+s|Px zUfrt(khB1vundsr$hK-`(k$PT4)l@(ec?dsnAGc#Ujou0 z?*e*Qh5QMS4*4*U4tY{GTT1HdjX<*As1IO;6|@Mq-z#V-kPdkTkPi6=KtEJpe+{HV zUIU~D9eWz!@Cy_>dq2N(mGgJ|a- z{8&p;X)|R_yv)X@QWVU_72C==`7P~dI(qyA=5AJl8W_c1qX`?07c120V;rfMBeE=K zy%02h|M8f_aE`?)?YV(?aeSIL6gL9#@%_UsyFE|pS)RZ2OCz>~YJw()9K7xh#mhpG z_^JM)xBRh7Wcv~bsFW-;;_13^PFC9cz zJX(OtxbZDPWBhvVm!qZc8I5veVoZF{Pv>m^!|fw}$~pFhIVGC{g?qO%^e)C<{UxZD z+ZKp7QWJ0hrP?QXyK&$CG$c&it@&jfv5Wje(f6m{9D&y&?5LLL<++|Z`G@b#b zL}0P@fzqP-Vcm)ODETFaTNOPhT(qf)Pu}Kj+SYJ)@-~7nx5~+6OevUC$g9X^uhI0b zP&qZn+-^W{1t6QwfwFJ0;Lz$pVGDdycr}uZv%V!Gf(NM|%XH(=i3wL;>!Z%6wY#>0+QzbbPM zL2qF(Yz^jen&ZKbsRCm!>i>H)S|F7p`4PRmW|ac0Sr%>Lj5p*2S!jz_=17hI67sD2 z8ZYz0b{*L2cenZ7%^XSHfsQRkEv$Gn8+XfD2hk7}54LfFp7PtKs;(zjwJECw8uxul zc*^A>+6RZYGKeB{#$ zWmKpG9Z8Ym$1Vq|FZZ{&8>n2Htn~QV7N~5$2#0w8mBG?BCU`+(%ocxa^!+fGfh~M6 zf}8y&nwu+g1Q}&@+ln?f%nF)Y$cv^gs7uLzK(I_j8LG#{2mPx*){-?gHu`6-fDu4v zQE(IC*0g_ z#KaWXQ(p)m%`L?`pzWOaemb_*D+@a=7!H5eriNtf(BXw4p@+?tc-{~EtzPNmU49H% zWWHu)zIxJMW6j<`X-mVO{AQb^vp?y4fGYGDc1BQl_k5x+HVh=3@bpk2j;4Pac8tc{)4-#j60WXVbh_R(fSGI z(`$q)#pY6ct@tR}#B$Fij{>orvmjS;&xJvqplner14bvnBCOG%h2Oa64zdjMDBil> zXnwt(m$2yS-hG&E0JBXkxe<4>UYBB0R^3aolvitgie0{0n?${F^&t70GlndGmg^UEru9k(|>tTNs{h`(2Pe~BkcTc7Rb z*=~ggPSs(8s%e!_J|>j+RVd&{ct$%;Z~mP?KEl&qd1sMKri5*JK*DhsA;CLWzhi}r zhbls^`C0;e58!VE^XA(+WTPFIHzDM02x-Sl%}cDYRlkPcE!^ykNqAL+SJN*3;n{1N z#s3Qc+l3y`-o)?Qtk1Q-CR?3bVbAMN!s5#M5Nk-r_{|}iaja|jWDogCj$;Q)FYKc) z(Q?`lh>!D$J~s1^<??L=%RQ>eYO`pAg4YD1L@k2+I?y^3YTmN7=^*z{6#xx)GJ6|Mx&O-(TCgX`ndyr zLA85QxykHE^YFbHk^ZRMP6PT+1Bc@xJ8nUxP`cW739OW_#L#7B3PNfpdb$y%v=M_}J|DP1pBQ>-C=hRqv7Qb5Uz}R~&|0N=?cZi$~q)X@yptWg) zXOz{MDYCmL9-SpOrDup$B&qC3%LKJctM+JPAG7&5mmNsihS5_P))Zf{Oln5si*j}9 zBJrx?aMw!_v#K~UYU!f7sUa)5{X(TTmDQbQRdBtqMoSHu(h-xEvniT(5a9Ps?LKnT&r@3 zn7z(~X-?M81kz1N#vDBc%7jst8ojQ+^8XhF$!=0wwjuYyQj}^E?vQy+uC?clv)XhH z#ct1Cv9J${Nn)ig<6-1MRE-l~@jiM#UzRJ=+F#~wx#VHmKvoo-Btux4Y@8QI&6kx` zCrpK5`p4SgG}lM0{aD#+gwI&j9KvAfs+LAp(|#qPnGN(lOA4)Rcl1>55ZAb}R>HRX zAm)xfwPN;e)ZD{frz%E16k_-#93Rg&R3Ifp4HD{);!V5pt@IzUU0N7o2UL6h91D_B zr;~F!YKp(oUTcNf%29#KsyG~bA*0(sY-=sdZKo>R)kep!7S82!)U0ONxsxsXVmi$- z=`<(NUrIO`{Uvh|R1ha*D;`e1LnSdGShDGB?f(K%+lplOrYOp&SR{$6N2imrW1)08 znGw>Hh%%X2CE0|&vMoFm)fn@l$2VEi%Q0fj#N&_MneQ?h<(x9H=ZEe(;s!MCZj}G2 z&7X&i3xhu7L3%YyNbY&L$cOZ51BUB}<{Nn@NYKcSoUofGM0d)AH7Y3(WK9qwIe9N$ zxUcK*ua%Us&40P_L^kwNzRZTU6!)yU%3W-p+oi~iKQ~&$5@ghekuWjj6Q|Njabjpd zQl2VKs)tIj+6j;UQeugiv!rmvSg2jHjJx&_EIjn#6ya5vZR8Hoq9=9BuPa z>ylAf9dD9sRpTn{Hew#423aL&?3!7()*)wKq`C)T>Zt~Ym2~%}W<7HIKsCi3nGN!PO z3PpXpt4 zPC!!Zb-m4hi-Owu*WJn&4kWwY+U-;a`VXK%%7^S+YZgNo3k}KoyN2X&orW%PAesJZ zx9LF5DwN*=X_t4DQb&(*T*07G1~D%S#3|A5P#svgn%-z zMfwpWdY>tK|GcF)@di8m&;1kt*KL+m)t7#ALkx>AvDcXFB6?NjKk!9YGurjH__xC= zf43t(wLq%;!aP5gjvqoeaKG`8boNcl2|m=iUWrF-JCD6spXj zt5KQ7Q{^5{m7P3Q{?ZvszGrmCv9*ulDm?>sEnU^)44CdE zO`s}y6CUuFu^%j}XWjkEpz6}XRcG?qT=f#~m?L0n5M=y_=Eo=YFX@UM%tFndjOMjx zJSP;Y{sA7PVE~cHCSLL|9S5VgrCc%*wRm90gh`qUQX`Ww5J{%i;B0~*&zm0QfoCQZ z1A{gEH7&zIo)7ShCxjM6qV~9rF|B&ZXKCrN_&a!9Rtxapdk-Xm*FqUdes?rI9`gy>} zJz3gpz)n7D#0rhJ+}Om{-kVwtGm9Qaa~Du$_R6FvkWsWv9(fiuBFrHF$#C^ck&KMoF;!a zz0Gue@UFVcGYR9%K#}Eh=!1c1CJ0-UPnW1eW&ndFdKsu4BZ`tS0rz{Q`;6u7Q2A_# zcTK9o|6B0*WC!b|(2-nFMt6Ux1#g+}8<`ezE6HIUvRb0TA*A}z#l z2q^U+qvR>@@%j8sEHnmA9cj*BvGdMBC3c55P^)lGj0-@}FWxfap;i@!wTLUjFP47G zaymz&S1}5r`kJ@733`TNuH9HY$Y*c?J$kNq?dpqiH5>d{-8k-UrQ!g)xG|7 zm43~LrRKpPHMFNZ#iM)3(YR_cDQQ8S2U-F!5Lb;V^|2G`;5*sirYIZ%Lva*WrV+N# zpg-1{RnkR~>aNVVXATm2$;GUWrWcAWl_|$XdKhBT(k#`{steuIdKRo{p`G50dA~|; znoluW<4~C4E*X(ZPkI)lT>n|x^=Kdg&DR062Ad^g+GnIiCB##7lj>R6Xkhu`a>1}| zF;X-s`ril%F6$Pllpm9R)jCw9$!a#j*@?6Jp%JS7TSK3SFzHcGR!w@yaMeR-;#0BO z`E9i{qw#wTTZ;O$WfmzaMej$+34C5c_?qiGk4{3bT*k`8xzgCc_ zT+*w%FE~C#mD4o!^&Ozc6tvI5bJI8JkPVgzb5bqbQLcj+Cyu6iK7t|WP(<5&lz z{cZueMd7^-q~rJ$NK@6vW8<9)v{>Pt1$3u^#4@<{aS4$2aVL=URbJN$AX#Vfx_$zr zbK@5dw9$cHb)X#%v>!;*m&IuFJrzn{ARXIjKsq*AcRxjay&p*X_Rt~Ma4#9r4Hp!EuR14z>% zYx`RMR@U})nV$=!L%tA5^YUYWbSPmU?H64n)}Df_^6OoLM#oLo_O;t@fNodu{t-x1 zzaB`(@mC;C^ZP)0ZLe={oBFeWGzFs^=o$yQ#ep6Ms#9_NJCIJtGeA0y79btRRv;b6 zS3o+4`sCPgoCLI1g>sJLHo}3T4)i?-S_-5?ei%rHEE5JD@+JpwJCF|fZJ-S*4mr>K z?+WVG$K{%*pnM=r{RKdp`Vt@=haX7C(ZftBpN418lvwJE#LtOe2X}Papimrf9M&I< zTz@g^Bh2Rg%;tj(2;p2L8%FLSW@bpO(KvJZaLfBysfF#P6?`&x1d2MkodM|h3zgHg z{X=uf7m4wl0q6{&x!N9piH!alhC5hnG~Om;=>q_oAy5Xdmx*gk?bxu~QmaT`>I-9K zxeP{81WEiz6vdTo0jAZgVks&S6_^%plFw%FMtiw&U~r}}Fbbb5>sn3A_y|WdO%@^O zzn7?03Lo^V2u@E1F zMH$N?DdtE_HdTh8a}v6_O(uVmJrB3!v@AOaMfrb7vk-mm{2?+b(9&a)c^DuYZ7Nylw0?qg#Dhy3G~0$K+bBl z*%pY0Cyhz;e;NO-aO*lL&2Z~__1OL%qU|~11KXoUU{@&aiuVo0`{zW?+3AnxM$Q|Q zTe2-uy3_dKI<;wos8ebcJf0;eaW~tg5%;=4+&_u-uGhuSCY~1*u{IH51fcW`BM=WA zFD?Ffjzvr$-uLSB2IZ7AD`J|JoVhW!t%NPbEvGfd+T84S1Y4%BA3&r(PDT9PsqC`Q z_+&>!9SXE)i1&$~7>Tox+oC8ho1|)5$)-^0fzvj{Hn~|44YbHs1qb)kPM8jJh?A_T z{_k8JzIyy+zR9yIee=o}&6(FQ&o^sMMg5%W`Q^2@`|42Q;yb^=H>b{5UtR5+TV8uh zrB77Uzq;y%+6o>T_Z$TjYR94>;#!yrvB-D1@BFHZeK$AM`{va9>Sk9r z%$?=CxzcyV<-U^QbD)E$=9S;>n~VM)iJ;t9*Kjk@rBQW`Z)&9vy(iW4=2gxIskVI1 zeAKM?s^?pz)cMNmC4jnm!d!H*uN*8CrJ$P!H88j1R=h|PE)-W+DL6&qIljK+55jn& zi^NCN91(m7zs^?dNS3~MVaZ+EG1gq5ojV-S! zuR!~ePx&In4vptG^mUCZ2VEz4E}Dl>>EfF;kLc%>*IeeSCOF7MUsHAM?R{NiM5&D= zI7PEiG{3ICwxI%DFlp}M%_^6^uCPsiTB7>8CfD9BVNuAl=7{>D%J~#aWqqA^O(mX` zT%JiMd0s!Ke6D0+1*)CUz|_}uYd4&7J1yw}N#34te#80aE4?i~A1@zFr8uC6bi z>#HlDS2MS=PLrKc?+T$YI;QAir=qHqfuh_=iSj?cVcyMToD{2FG3+2Us?-LcIrA4l z{j9-9d#kKNQPnLDA;<7#2TrXceme?@RwqNZ2B@-v`)7DP)PTB*+Vc8}*)$d@n7Xt= z7W&9jDFE6>Rn?qDzVh1Iaw^AI8fSx|zp7SixtddnPx~5!PM}-Gw<WbN_(4G3y14R}kM^(ubYF*`AT1Z+I?CZLGTsU114?_^j&}@R_sbA7{@Gu~B!x0zs z(j2FP*2gtEql|>JQu$@Q_u7X_Qwm!D=-~L+Vo2A}!Sn)Og%*t;Ja+j{#6@4WE6hGP z8~KM3cb)TE{BcW}KW~FApV=-6S+1Fui{N_P*C{ubtI@Ol`ILgzDhJ2*)n>WmC|@EF zJs9YfxxXw=DPMiX!LfbGqL5rL+r;%VJYNd*;N@RerYT<)1g<_VpE@zGwW5oQR27d~ z^!MZgZRtBXno_=co*;0E@>PasF0Xzln-3nhX!8;Oe{6j3(v)J=z7CE}q3|qn_2>4u zui;;E=}-IqydkADRfJ09>Q7uc57%i2rFPWgmieRvyk$u?+Uc!KaJ4x&wy#plMMhMQ zdpZA7mLu<(vooa-^-2fF_O;A%F?f31Bl#B^9=vqi)hT7C_c%DVueUUzu3Y77FaJ{B zf4}_7g(*d*|8Q_@U%$49AEv(-h47?v$o0Qc6lMc5rN87g=Q?HQnPrkADfcMR6tpwl1t%a#3f~mDr5E4 z<@(pvx&Nk>i%MLBOSH4X$?zphtR8of<*Vp|;osNFMU}6i+F9Xb_>y`{DO%GYr1tZ*`Xouhn7ZItWQ-ldDQa#7_=ExFsu zMbmTsTyS;W5MS{xirTeuQRPcIRxX8;5tq~@k6Y@nT#L`Gzga66Rla0W#-(sFd==oD z%8jN^JndS!sPZM95SPNq@O3_}9=D7~a*ezAlP}Lt<%ZS$DVz*n-vZa;mJ*Tc@aBh) zd@JRvq*%EsoD5$V;GT->p`SkQy&%n(t{e&{!R~Jveqe= z)TPYYTcmv5GNXRZyh??laWdk%Q2BzJRM(q#HNJLXT3otHDVz*nG9&f4rMH&rPb(7> zE=u#ItCYgY@Fg`6#l^~x{<}EMm#$I@C&Smbm9H|(*Upx#KYlySm#$I@C&QPF{HS`i zd^HZsnK3xcmv&b;8NOtu=W$!r)OE*Oxod}{`O;NN;bi!d(oePJN8Xw+tvJn>u2Kpo z!*u*I2mzCo_pMO zAN9v=<)2=f7MHG33Ma#tl%vNjHBGK1_y60V5ox}3jZ!!nzN8#IZt0Wd%76EQcSolA z(xtC()c5^X&oAZZaa)beRe#F^O}b={R!S`1cG`%*S+1&@S|$!v@C#^wim(PyEsXfZ&w4;1|S9?~N8k~7l?4ypt`Rpj11xMk?x|)4y(0`P# zyN`0&dXz6YKww|`V^M~$NfReVM8|I?&QCLNBIp`{8t{iX{oh%)+V<&z$_?;O_f$y=tF|$SiFKkIQI;EKz7ThvJMTMGVmsUK@ zY`4C0tn)5aNxf-JxK5P~w(6uaU92t%`3vSP@3(LFV>Y1?6ZV_W^%vMT) z$EJPIRHhshnd&v2&V}W*^C!-~RvOXR>e`wHTY0rkMSbnnYOCkz^)6i$79|>^x`vUPvYsq! zC&$3lv{0r{Gec@tdKSq0j2Uz0)yxRaXGv}>9n74H^10Wt;sDLor?9gy)${jAB`bD4 ze+rO%>Pxp^((6O9 zaSRLz;Ar0}Qq}FICq1KnjFV1Tw=s+0G3afdWfj4U8RZqVG?eO_XH+%JudrONom*Ln zM(=L4j=eS`zfvVXGQ*vsAL;5lWZ1|OYuQjev^Hq%qGA1S>xUjzQgX>K^;z^o_g6j8 zy$kfdxxA?KrS(fafxiC>{m{c?6i;1?=zc}wRZgwR)r(u}$<>^Ka^x@0tH_5HS$zFv z7GC;{MR0Su=Zz95btyg4nZdba?|2D#_l(tevSy_9_-4}g(>#}JH#keDX}l91yrG)e z($21FCo`wL&U&#PwqD>2SJH6r{0tZL?xN>$qVPy_Ag5XF5Y-Q4+e8!|rWEIhnvmF$ta>AM#NBXd zs~Rv-Tk(eRv|FDCzs!&I;Rl=1Ak;FZ)qAhd#Pe<$WWoEr+0p(R#LqaL|E#P_?vd|E z(mX4BVb)8loR&cO2>Uhv$^KZUyM6$l-U^PKn|;I>|Caeyu=L~lXM;`uSTrzN^i{Z}JiopTg4&w;wBbtt4I+R_jaIa||=DENvT zsR)S>kNE0bFiQ3#m`q(lZlIINEBlru+Y}i%B*;eaY8zfxCVuZU-?V7E^YNIspeqOItk6(?r(W7C)npjPE`nLW4pXR zid3|9wMCGX;C;Lqh##gnvldTK6)$y=B#=N!KwPDrg6r=NaLoHm>T;kDn!Qw5UEc4@ zS$a->H#Oh6rM++0CX$mJN?qpUjLL_^y^>kFv9=dx*6eUsbLg%Xv0oXwYn?p8cXi4n zs=fx&B*o+7c`?8H^ML!6vF7j?r@|#A(LN~GeVsf}iSZ2oF}|b$E_^~K8^L|+1m`$U z{|CpJ{U7vuhK281FLX>ujLzklCThq+cXdfr4R0nFKy5rBC17qYLN&swVloART?yV; z8KSQ>H(6N~O%%jQm>{6c2zI$oE*wkpo-et0Y+W7K_+$ zMc#eJGkK>}wXDlAo}pM(9MKBz1JOjND+r}y%}DI9-f&c!^Mm%HxfmgIoD-VwWgP6PvE>vD->$&Il?ImUgz zl`P-7?42XaS`L{zws%UB)tVf+bJy07{?NN{tABeZJwwm;jF z%ujdD7y5s3%plFJTa(LL4*Iw6jvdOcHOw79@*n6#Sq3rqw{~`WMQx4W_&plEN_QAP zYw;JgwV$liQ>D}BZ|U^v5~66OY`W)*zZ5|bl{HI;`{^oZ(5fr;8`*RjO$eoARR7cd%3V`5i_xfFM$=Sc2m5@N-07#A%+=ybdT3Q^npP9 z@n3+0Rv9{M!KP(CB9EfxC_$-kENo+?i1~yQKhj}yhO!OyScJBRQbAH~Fa3k6Zbff} zT0YH+D{4zSIANqK!fFXOWJJC)CZgm-N4x(8x6!zW-pT(LNvcIn#C$PmeyU`nqZM5! zZ&RI6sA&C!g!ft46(q;dVyn;7>6ApwckQDZL3fvb>!*z&Y`* z`ua5dWospOB;AsHqfy3{xN2usGt*s|Zp}v1#R!CxRnq8?kcq1%6&cke35SED>4YlU z=&0_ad>@eXx;IBk4;ita!+M82iCmo8FG^Db5*YcSanGOeMh{|6JuGa16WS9vi{7P* zT)4?aZ$&HmKOC(HJPcd4T7sUK$mXqMO+Q{ zhs}MVu8q;eRqkl%S9QJcUHc}G5i2D&-i%nSmYmunrLIaX64yOv zT=kq*^=&^*m7lvSVD8zv#~=IJjm9M7o|V*63dUXkL8zitDl(y|`ewcoD%z;)3_^m% zWU;O_N?cJD%~9oT=_W9rk^tIQX<2%wK1AY=OQCR{lRQ+!qJypdtZw;(G+x+zIfQ12 z#@<3&e9Gal*&Hs~A-ozb%v>eS!&vzXYDL6+d>Su|9g==?YsR^7b)FpJg8dIpUF-{+jq5JDr#Mfr@uPz_Jl;GZ_=h0XnG^abNr1k6!^_`e($^q_e~IJS}5 z%j1~syAr+ZoJ{(&s_1k5b z`{ba@NzN`~R``?(tC;XT$$)vV;XAchHEaRHH^^g(@Iw)mpd*9FRkN1~+W@ql1YtGkPbIr^(*KoPM6u#%#)f=6CMqkvCuypbvX63 zr7)53I-4Wp`@VRgy2okUag(Zy;-ujPg@?NoTX0<$ zwdTrTQg(x+EW&w@vRq5k)7x5@>m^4MW&aP6jd3k)}977Cg;0QLv~+yR>RekCQXv1 zY2&WTAj4%aT=1?!%)`l1aJ((SHn`WsU_9u7VOT!15eS)+gXW&FXAhwz5(*6uM_X7c z+{9O??G0SQKr_&XH#8-LQI@};`KTLbx=eO9qT7Ov?-ztT+nsPX2={(r#G6lLuJ22v z#O8(XqUND@Fbdsv-G!dksB1ZU151PG81rlk#=q{h=p1xrNWPa!qr=t9R8e#0rPA~@ z-!UF*$TF-$>(WzZt`_wfU%S{TYTKE=LH*6#~6=u@6%>&ht~Px&zGc!aQ3f_8WN;Iqvq>#kbY&Gch)yRO!$B~$lpUEddOq%j zbbc?IJKU=oT@k%nn*6nc|;`i0*r{&OT+IL0ci3wXCJMqTiRjw9yxcLS(ehQp~o zD;(_|PEP5Nk+MsoN<1NG#9g#8?N;=IEeSqjE8C7w*UNkj<8sKT_fbS#okrrV{uDs7 zhtR{ipt&0wJJcCzQcco5D<@#D58?lV|-TW8h9@k%AY1hVnrp2EqSJ50q5$>ou?Lb;9lUsEDBaDt7W7ntphyH0VoZ(}tSNtUi) z(a-LWamTk^tk65lj63AIQYd;E#OcXUw1A4!Sk2~oV?6!yYRDMh7L0C>M6Y+Cj_#*^ z@1Q%4RSywEU=A4LTO!7|*H}ywP!}=Ae-bu7OD!Wf)8Bf}iV98yBSX>tKCf$yaYq#& zu@3_l{5NdhF*1jxUkOJQrx$8`uU9x3Xt><+J9k}fO?2)V9be>Zr%pd)fo)@%P|*@- zCu%f%jS?Ib6byUzg69Pc#PASBhe9YCWhV(uA|1Y`6@<6lh@Zf2SXdl2I0yr=*qz9* zsQ1x)&^(2a@xPHHEO&?E(b8y@2lraVgD6J)9zrAL#!$4vJm`60;fGv4uJV>HkG*ML z$85j8!)IOctY}#qqV|}AFd5!M=mLCmv^i+GdB|tJnf@~@qp-2;a_wL5jGgOGj)fm? zmi}t#Y*sxMZHz=qSD;Vu&hgPfD@I*B@~4a4Rc7gm06UjVn_LZU1Sdpy{kBigJ(xZ% zAHM>oY;!W*t_ZS!Y^=H)VCmM*EurY5$I-n%GA0d!#{Zg^twB$Qldc#X7KLa@pC$Mm zFu#mMH;uMRR|M~4UuDIZIo>(enQsW0gM?iS8O7o&6^_ ztmyB2-j{vmD*+n5aR4Vb;5tM`VYy>-pU^%I0(a1Vd;Syd?ZyD!SGznxMj+7gT&B8}$)B)}U# zm-);+$&rgCmfyS8NcJMBVDweCr|z{bxib{q5sFT{*KG~D)BCRZ21CK`-EORU3+m#1 zck%CiaI}8&o%FACF*wNUWBjX3YO89%0(=(#QTohpZb(0D9%}rokR9pA;~%$2q6Ru-P3E`9Nv6*4-6wDL zs68nX*alAxF?d%Ij^fM4SjDE_TYTq|)50wGy!)tnnGh*OJem~oD6R_|b zep}OZ*xVsXMx%ukur3lEK~jGXc>nG$ahw(MyTl>LN_ z@o91b-DtEDKbR5lzOkfC3S*4lPdRpmqMIZq05^o93NPiY0MsT4M?4-!jFc8cvD9j)f)#={iG(1DVMMDJ=!lF@w~tetRb^xbi~D_e`eWg7~^2B zTBwy&V|yriEYr%Jk!Zv*=33AGP9HNnVg=G9|p=cx9d6B4F!Xy%%OCuKG8IBg=Sr;_MG5J5NNNeZc ztstVCCP$#7!5ayc^}(HUlFM%`JPT6~fCRxqSH*y+t}U#2Pv`WE>~ zZ{JoL+s!=YHw%1bftttOrY7O!<*2lj^#)s2VegijaiFji4}X>Zl2P~?@n0}1L&Em+d%MKM3m!K%;4TI_y{U`=MQpj9s7OJ%(imhHx&yb&~OraLbF>-gR{AAleGCV(1 zzM)5yPY7fdUt-0%Da+BC#O`C~yttLG>ia{mRx1+V8`u^0ycY2skeL-OAY}d%jn!<+Jxm=WPSDd7Kjf|+!ZQb~xg(xd6xlCh8fB^2WW;ahd>o?5 z1SL~39=D2zD8V`uHb1w!u@m*zYCf`DMeK+(ixd|@;R-spN;Ian1s?^Iqu5$kyJ{iN z8#1!lzP4EapZ5*F5!n$yNztl=w5<70X2whrSw_ipBm9!5iDMvl^-wtg)Me#-4=#{x zH`!vij-o*@mSxKt5)X#4ykC|ntFLpt6n3f99)_-nAs}TfGE0jzH-bXw1FUyh8C*tU z4+vbg;E>T*c~5|KO0coLAm~-|qD=ve#2)}fb&D(-prXR+aoDwZ8XV_5+=+$^=Td)> z@JfYhiPj0Hu7Z7@ZFL87mL1ij~KEhat9A<8xslmGJcmag$BDZy;keA{oGba;HtW%B04 z5%K+IdnY@VFTt;%vE)z?b~t@2fIL*0Xdn_oe?ETpBE4&IZL+2hFDRiCKP7CL3X}!`@C~*%b2h znfn9gTfyilY)wjbK5OLt@CoV&-@Bir-{MikS`Km*a|KuYi}cgXRp}X;{z4tC5l9F? zA{Bki9LkT3M4d9%-8Lk)+ovD`8Ty@vf3c%-WrW|#U_%xVTitRh$P}3;q8g-OKxI8V2}9-rz4(CLT-jAYO@})#isq8GL1yw z3*%35a+;xx@={0qcX&k1FX$OfVk#ZhAjsiJ=AV&Fa)S!gV#g)auLByfnl=l1 z4nWv~jhzKjmd-7dH1Zl{ncYJ;Wmkyd4jv{j14 zc~Nl@I8b0xF0(kdJQ1g8JK!}I#oE(ml*;b45Kn4ez+6x>Ty}Nx3Buv)^FHY-?EotrW>JD)Q|wZi4dL^7Z-_J))Ze~oPcm4OlW=_E7f zp{`{q(W#+QlmlM~zY)I}n9SjCU*5!tt{KZX@qD7wMdNu$v_Nz^b|weHrSHPO8*Z28@L{MKxDI}SEKqz6(D zecIXC_zB0indxga)7QZCF~(z?a;7EO52N;(?J1<1>^@6PBR;yFOxJU2S(o%c4s%y& zvRGUluzJgMu~N=^NJa=**x4>rKEv;!r9z(`m<_V4%iC@>EEfvGaNIIzWILB52==OO zAqfKXJ59PbdB&iPX9@fT9Y`6m{RM}_Mn}5JDqgPV&oLJl*BOagVuq8&1?&ygoFn|2 zCreXXAggjTwKwwRRyz4|vxvK9%~<6Sp*ajg+ZS zNq5ljEXGubXFa+C1s+rmdA5f<9AC8YYB8ySB^H`JDo#6@V8E?Yi$y~}h z>=+gfn!k=ZMzKw%@^lxC^{|LKAQ>JjTvO_m+ zgPgrH0BXv_L8BRQIay&x%6@{Y${Jdix`s>@pzv6$3HPa8akXtL0E)dj4)t>e_LmfxxNX0uJN+Y42T(lzpz+jO+P%edp-PtZrk8z%B54)RdxndHmH zdv3n&)YCLO{_MWz`VUO~8h=f{K)rsl%ih{6v%_X7p%f<%W+*bJT5=4Tn9Bcu(w;fx zPwh%6Ji3PZ*p%XQb|`HkBzK?>BN2^Xb#?+M#|`;3Q0^SEK0U_A?syI%Fl1$0bLy)aX9%de!-4=jzK(xNmO$WLJuB|HWMceK9 zBufQjQB@V`pNHU)~DQxsqntb9=@QXu}ZK!%#qouV`xj>-85GHKrJ5> zzJMT_BB&#TMfNP~H>da7nKO;PB}WW2(8ONQc{NSRjEqRg^j__H=Z&d0Ws#BHp{wcJ z#$El+kUqA%eT+2}&X>i@TB@ark&-|u*pzQ7k5H(t{2)}SSUHCpx>$+{n3z`{e=j(# z?35BQTT;h;ES&4xzPgVzCVc{5_s7eVBmczlZ;8)*%h$NO&{y}NAXBLE!(Osn)cq;v zlfC79vNy+)B@>JG@H?nTPAKv1KUsYH`^C3^aS_C>Eacr7dw~sBBk>8NBGp@+Lmrv$ z@4hKt$q(^i9_=_hKYaU77T<5k?`X10oy89$uCFie+=;`&mGK65Y6X470-VtIscGg^ ziqO>(`XQlOu*-w>sLsEJU zD~ASil;jMe+{Z{UN0EOQV^?#c%D?7ENEkoFHf>pj-0Xedf834lm zxYNfIrplCGUUYx6{kYXs$NQ<7VB(S8NE$08jnvI53*D?a*{4K}s`1#y{FL3PQ}@7# zWsi031{#>^i?=Y3#!tr4P1ym%u9%)pB2iX#t-Z!F*c-+Qzc7xUmNCLF==o@r94(HO zQ8-Rmae?9C){n+y2!n)oq+X>TPzpviRsYj$Y$7yVXwEc)QJbiwx<5V zn38%fn$c|vM^H06A>EWJJ$1%=K+>8?TG=lfLwzQ%`E(*G5F#)QmuQn>$vhY2ARuP~ zBAY0pmy7+3)UO~5#$!!6xT0|J%p;K{eMw_Fhh@JHxPij6W%IC^`;DAyABj_tS|B+^ zR||j#fyrOf$rD`mf%RdtO%7SlqukOjuocqb#!tqRV76bnxLB}Kak26in3d&Y5zu4j zH?>i9sXocn3(K5B9MLI%T2Tx-vVOqkX z*?M#~<{sW>5rMHq5~&ce^V84kev#1A%~b|qI0_%XQ_u3hct_D-`p@L21llt&o zGU?)J)8#oIx%+|k=BH*v69}bisSZmCEl@589anpzQwceXy0b6X*l(D>}^ zo3P3^bqSt%`#p$n6d|E$x^9oJQ}Q3I09Q(y#{~-?Ex}>+y*MdyDaIXtep{F#k#6VQ z-CC!wHoPU&M_+9)9xJT~viYh7Wqj-qnd{*i5z))t-xSHh{}h}tw~i)80Z$ThIP3H7 z0B*^95p#XSvn7zc4mJ1(o#;w8+uC09J9+=X<`>LY{mCh^Obt>tE<%)^=zX>NBn~Ix z%>lmc-RGEjJJUz`k_$V-o|n=EoiE890?)yK=LIe!wY|#40+KH98IdnI(&u>ki*U5D zbMyG9e>uD9O4x^s2X!nbOfM;go`a#0zssmsrL>2V?>F!4=q#k-3O<ArUOWhM0HDu&3I}z;^B=YxZ;a2ty?t_p5 z&Gdj2*+0bfv^nx=8p+@1)nIggFgo(DR8`_}7JSuCL@$eeTm!US1&Jk=0Iya!e6M^sC@x@Zc|EE3t7XL}s zEWelK!|(SXeAgcF?vA||rgpj_l*FhPY2DOre)vj#h@A~=6rb&RKB*0SlJ_vlyKbXg zHOjl_HkSIFhH*KjWnI^@ia0^}J(YERfJ@ZGxE!5XzX7ZgHQWWbbf_r!)vg(^{Ku*o zpWzyyT%saZ`+bk{XxBTqbf|2dX}@o=4W(0_l6BQ)T`RJ#yE((xaL;C4uV-C*v#tRY zNyA;4b?rDc<98+vphH(?U9V(asjO?_85y`(*7a%D)$7bm=spz0{Uz%XGLUPIQ1~0)eUs?3oQec%?nTT-pSuwfCl@iBpAhn9Bt8Ru;C~jJ zIJ`mFpu{_TbLVnpfxPkINWH`-@4U8z%)iSqzZnn-%h)lzJf190fR|eS9l?QbxOFL- zgL$1#Zi33)OSgKR@9u_Y86%xM|DG5p>07aR@^Awxc*7>oh+i*zJsJJG$TX_wtr}2J zzRfsXh2A8> zPO@C<)2@r9NnFI4POp~PyNetLxGlTf*Y;|_9G?0yG0X4d_~l8FbgJ1I1Gv{YM$ooUqfaw6(SlGmEFOYUR^y*m~>&vcML zdbv}zD`GwAQ#iihDPVQ?v%}nkJP^xBwl@(V4|+E&xO;pwe7+-+*u3ONfyC>vft(A; zVK?Gq@-8*kY9=l8n-iCH1h^3gXW=R}*SBpS&E~&@hg^}juI-P^QrjD&EBwXWYpvqd zo$cODwX1Z~?~-lKK8M25t?VA(5so&6`ZSEE798AXFd}sWg_TyR7l*HHTNURPj?^SR ztVuh~7UcF_)G+24ix4ck)pooT4=S{S24QloXk`C1u_HDh7>zJ1O^y#_%j~Ijmb7~5Auqi0_R{lh11fxgE zXkR6>s-MOx$!nzAWgXn|B+pWpc`WY$*Oo;*DVD5(BT@p;=9@kHi6Uvj=PtNS|hz+QZD zvqN44)bEi>6*u0L$B{@sq!kXs*ikcAaWGoCTyCv%A%$e$OoOZrIcp!AOuRk2vodKQ{-#o67?H?Hk$90T+)x^ z>F*&4JRC8O-%6e(VNXP zjT?CcOw5}t*xQvEZ7c~FI%i@{EbK+O-C>@W-XK_mz)fNm_?IPFpN=23!Y3`QT^Ay2IyeV0C@Uw`F z$}ld6nRVThb-jk`C>2@)gLtZP4a~aE%DT>nX)IQuk7iwm-Jstkn3?=T`BK2t6U)gm zd|>L41mNWPcMf(qS)^QpXYKJE%cxyzTa@1#>5gx5r;Wq>;F%>2h(Dt=A*W3&j;CVD z-*XITGJ2qr?~puYzE+av#tqVW5%aB3V+Ues9f;9ylz7~l6YDvg=_pv#CzKr9 z9`!QMQEj=Rl|CCv*%i)W1Wyw+5+Z!YVwo>WVl0yd6atP2a9oRw|E(@oloAw0)Q?@% zwNl}6(M$d^E;{=!u5h$`8B^*q7t&f6v(J7y01f~`&R2rY76e$hnzlaT-Ni4mc-~Dl zA>3nZ)V3Pwxs4|_k6$i48X{(HpP6mjxA`ah8S zsNY_Dd4Qi|ArK|dp8*hhoZCGuEY~>~mdfT%QRWmH8sQEX)w50!h{T%P#i}58c@k^{=>I_qcc{C)Od1Ur@6N=b&8Yy zfNfuM6&!gc~RU&i|gyx2#{wI-9FI`OiI>Q&Q zl_Y{_qEJ>sQmA z2X(_Cl)R*l+hgFKamOAY;$L$oMHViR=&7)dzor5lbw#;Ug(3{;j*4x(AQmvHHY)My zs=cyZW4=JW;*sbm(9spAey*ab3Rl1Rr&Vn8o9`J_%^{H;FvcJ(zF8Ej1PBZoW7PfeOCE>9LeB(=Z51U;BU7(Rgp=1a-Rwjvc6|^+B&S`bz z#9T1ZS&3lUlDiRdF_Q_$#ReJ;BzJ?)3`YA4LV=X70e+SW$fz=-ZIMSpkvdqyi_8)+ z6fKnOh!-+9(_j9gPQ=9Sh>(-?y`{)e>OtvlTSC_SyPSryym^Q#o1!ZxTKZR&30IgO zBGGWPc#Xo?K!xo0aT`y@KQ*TSNcdOn!$(L#B)WZUbmSVY%Nzwwk|?DE0u`kf%pVfw zqHTp7?%EO8g9%)lZ&B5$C>;PMu#KkZ$*8Q<^4IXaR9WbqB{F0|(d~)bRasf6HEkWX5#`K_~%cHd*W7PFmzAh=M ztT-rF6{-*|`)@a?h0R?wO+zL(DRd+{t%Hj?zos_jXZkDNpZ{$lNi$M|gv0?YNiQC# zC@&%|jHy#TNxrm*ON)qmN-Lwgpd58AiiQ+HDy8U=XuvUErh#nRG#ORwdwxbTU$XBS zieB=xucGujVe`%T-_mW-95JdsvIiqU{eWaVZ_2VSUz45mR!W|P0SR)EY1Ln0=veG< zC!3Qfg-|&xuEJdJ-kRenKe}_A2QHo%cP;7D)?zx-9|-+a>*u{S1B20`uJ9C^YWkZ4 zfO(ELQsx)>+Ky%74tdZ)v|X+uMm#Ttke@_X!;)Y~9je4BSTL&jDR?7}nc$81S(zN~ z#6ps5z3_TQeTp@W@z_@TFw82xJ>KX}y@#h-=`(hiC?a2R=>y=kI3FbMrEr)89yx(-%(JQf)x6eZp0Z4+^-|!0rz>P+tdm zP5_}bfec3t5ZbD`$Ta}2=@dWM$Z-S6@EV=bPV03+S`SDWBGK=4Fv9K+T;#d{XwHwD z!RYm%F_+1<$zT#(0nauFl^T7Kpv?gwwvirCRm?$W5h4iaVmS59v)b<2Zc zMIj>5#w@W5NA|KdhTyEdX*_PA&PqR+x5_YskE@Lr~lE>qy zQR*Bpg_5Rc_^d*oRa~y}c9o+MMqSzepyvGC@(n(seA)RcR-9V^yR-l;BuR57iu4|=}fs>T|%CYOB)KN+)tRWi^)R+;hhq$K9n2s2q{6Km)^ z{Gzd4Tms?pq>DQ%zRs6qS|xpMtb~%I+3re8-Gd(H8(Ty>Re(CEuZ_q{vSrmSnVHQ2 zb7S_l3hgE(Yc#XVlP~*CU+w-nFT^B!4I>o${dO- zHTDQqRsE3U1U-2Pb!;r*Hss+&VE&N&3nl-;!}G_t|77t!GJii3e;Uba&-QgTP?s#f z1%C9__|aS8N3+I{cJRaISWvZsdI#4!TANj&x|A&l{2Dv z{BP|9>XS1c>KiC+GM;){#c}7hi^F<8g!Jg~w2AT5R&%1vhuLuELkN@!@$8*m7x8{P zA7wN=>Sw+a@o*~(Id!g9dD|_uk~CHc%|nRaSoJOP?q(80n^4%C{`^WRB&9?8!Gj5*S1MduCkk>Bu$hM zt2MGtXkHzjIi-*!1$QZhYg9y5-}L$^l`Y6nXx6PLKV zwC7RNZlLm0wriMjiNJl`#$Du@w}o9rPv`^X?`2&>`eyv@W;0WVKG!efIw^Zpy%Jp( zIAMwPanLSyw4LhdRditn22i>xHcATr~V@xJg~ET+O+4yRTt8J+q^V zECsvPvM|S!Wo)Hb(ZmF?%*0ZrG?CHADX$c>BEL^fa<{6h6s+(>Qkeaero_uQvQY30pu=)^?}P2v%i$~$3mourpTk&)>LdA_6{oAH+oTE@Q=J>-S|eY61=dvo$+ zlCkOvse49c%@cU(YeUV(s@}ruGpiWkR@B;}r;0#!h&YLLICr9cuGXR(K-yST zTb%`F_{|Ttad`qc71t^%&DCMoeeA+3DU^V@-q(2Gl)&)yAr|qT=7^`+X9YXhOhYFj z3dNeoMMvJnUh7>hc3PH=i!NH`LY3Kt90(dACojRGLV{zvySN#W!rD;teZFh1Wqe8( zNb_{fc9x>~N$sy;JT^=FZXiVEcL9~N}sBq{9KC!E(woW!HjkOi=GRO+V$X7fjpskAV~ zWV2<14N`ML*z+ETRja53+|yR>SgRD$)4;O#>fRGhh**|~-YH%cPF`ISYI{d?v?-3m zKSIgmj6hQRN`${lPK4E%D1QA1;n#l@e*HyJSQ$;(9^2~ozE?XkTORn0&AIK54lZ}V z8q|kVb$7rl?IR`XY-S^C!AJ0zzu}=;F1B(tPcYGlFQICd8`VbM5K2O7!pSkhvnu5F z?A1HaaOA%DLKj?prEB3{hMgd`?-|+-)^%?>zzL_@_Y4RKioa7c3_ns3Y}Ond`4j)v z4&sM87Vh;uBTOk+m_AmA1J9Qo#c!>X0T(b2_~P#u1}|258LQ6c=$v+p?=50~l>pEcF^s?=;Yfug(zMYjE0xFz?V~GWCWcD zgU+ux#8W8keFv+l<{G|hxO}KahMd5#9-cU`pz5ND?gArmH3v)Mla~yHZ9~W2NH@p* zg(2@&drWYfOr_Bauj(ekf!owICb;v{%6gA+!J1l8koq%8k5d#deL%{M8+;0T4;k^} znFK=K{YG5W)>0$Lp7fgB1Vowk0&_#%2MiugmJhnCF9|&%k_iMep{WL!r(aJ+#NO3U zVfn?19vjQ2!iAy5QphYQZp0_>O+|%R(}{wIQr~}pf07C)Arl4IoI!lOGZw~b@ z3^_ZXUlB#MAYSjGNxfzwpEcvzh*Pv{HT25wED)+Syr7~vHkqwTCrrAKtl{7;Buhvh zB&!jEEb*aOsp`!H111z}FER-Q^~gv6g%(tu^RP?_nIWc>H6dCA-Rgt1o9Z*Z^r;wL!IAk7$h`!_&zW4!MyQ!QuOOK&0l05+S zVnR`pAX( z<{J0}A*T=AN7D8V!DHb<(OEk2Jam?Bi(Sr0L~%+Z^z;%Q5okhZ>F0XDqBQPxNdujw zpI0{%Tu3kjb|2GdLH*|1GZcp*GazHYfQBBcnTGW+4e5TF@u&F>dz!EZwTPxGY`oRS z@nQaW@S9~puOdXo@>(WIzg4NuTEd*p_}Q$qrn!hCj}^R<`T&lk_Bt?EL+CW~v&xLQ z?2ZC@C@r@+j^PfSKbDTO`ehOT!`_o&AV`{8LE3g?X6SxCt4}yN!HrlxtCrsiYG^LV zu2ENiiz+Ksd~VA33b2a}tO>M=~6GCKL-)f0V>FU-Ma&nOPrwPI}g_ z&6)KPy|!olLtV3e(7O*@+f;Ld%=*{cvwl84&hg7Etr3yk^~aKRj?%4b=gP=@8nR(`Tt40KigAR8xA;-Gi0D()oF@G!xyyv(QJ zftvp}66NqKUG>##07m7J^?hCHTTFd()&SIZQ>MO(UA3!0eVGMnOPEkoBDV|05j_=APRyT`8}!>`O&GRuyTjh>v+w|(W!R5ARD?~*Gs)nnyeQ&8G0b~E6LRFdImW4 zD-k}9@~btDt{+O1bNf@*ujH`$C5nlknn)*+iz1d@H6P5s@QB%tzLw5Jhk(^5$gHBK zC7;2Cc;6q;Bvg@xLe287qLtK#c?%}vlAAt#E;j2co?9GAR z>Ap5u6VKcQZQ=p|QiJ))P|I9`kk|}-?1I!gqF-6BsBMy&p@LoHQNbGZe+5*p$Doaj zBDrU&hLG^unm?B_pu zv5*NZH793Q>mJN^5U>mRF&pFW^$vP?%0}^$aBlZ|cCu&i3ne|7IU!jiClqVsgrf8w zekR{j!d^iszWpbQZ+{oQ{loV_mewPzxg+)h%%_pK4wWaVh5V>YLLN?(R3;F>`~9As z<8>~i=UT%L>61(8J^YY9>6PLu>642K-%R?EZ2BAJj`}WsvN(5SW%IH4Iu@Qvt9OrM z3>1Y0{rCZ)6~WA|3Ty(II)PTC^@J6Tph0Dxo&>x28+1kmiRw2UFlHHvaJQVG z+jJOmIzN;lx%uKG;c4M<(k}$ks}0Uz;F?}${O0k@vjW& zAwT>7+{m`h|Ca_%!|{K!Vd3xi|IPosZ9w;{7aHY?<4Kq@%;}i3Fx=~Nd>bVJ2d(#(WoZE#^9moI+iX`95YU zW*X)OOcXN%GZS+o<|fP!FgIgnV{XCB!OX+_5L1n*!PH`6nE99mn1z^IF+alm7$b83 zi!ri>Uuv5=>}8lZrXG{PEXSNz`L%8S1N&jjZ!rI9o8Myp4)b5O`91a@ zF#m0vKVtt0^N4N!j4iv3V*ZNx8|G2lJcj+aZA8fEN!vVy{j_bK!Cq&ZXR)8dG}xvQ zTg-aQ2HR}Je%>~lu$yetjJ?@5Td-fS&EK)byolLq8(Cnq*k&8HnC+Myws{#_%qy5z zZSxwon4Or{ZSw}Um^W?n7WUh=c?Vm}yO>tnyoW93ecOD1E#^baN4EI~wwRA?vkO~H z3iF9=(%52l+vZbjF`wDybL>5~*^4da3)}3&7W1WTzQPu>-!^U7V%lx#1?bNHZt+&zB=pVyHI|zfBNH`>Cu`bEN zlu?4*S7?g}DRh?D;SUGT+#o*sPs$;Gy)lJOd4skOuBlfJn%i5YJbl*u8y3_GgurCV z(_ecy04J8bNP7&fzVClaPzZ}nBNX5ToaRz0*#xPnpe*V?g;%8T`fNB68eDx25TTo~oP-1aHP z&hJ6-f!fdH5%Y6~4HLKUjfD<*0(@>%zV%;$Lp|1<`NS@8@Emo`47&{_pu2b3Y3G{Q z%$m8?wddHWC4tm$KHGhuKWb{G+%jtp@2m@K7l0kv_K>hCwYScjF-jg&Km4)lYQg97 znjikqZa9rA<=KYJW>m9a+Pqt4RNpwm(Rb#wnp*qq_;cpo@Pl*z-D}Uo&#UlWP$qv< zdF^?yRNK+}Y&~CyJ9pg4cXxmPXI^{GfA0AqP;(-~;VVH({!YcnE6KUzNBjq3E)!(R z`KxqPR-Ws#{(aUS8#gS!a04u;VM_Art3)$7dXml5iJ%Brf^bT|bckal1{1d!7 zK@W3W`mZ~@lKOt@Fu3metv7II_W;fb-0&X2RRTAn2XHc)t9uCdyB@%KNUyaAa01dt zfOG!3YZn>b!+QvKbr0Z#PW-qBa6^H+s|RpHfP1zFaNhzh)eYRaBQMA!l+wRNLPT@_ zx_eE&ZnwyWW@O?F&*FK8CpHyPz;I^Fc*~VGnQP4xs4|wZY#H@j5M#mCTL9=idupRGmUwh`1zb` z-}AWwKH>Gmo3TpqoHWyCEP0-{uiUjo{1(N|o@p%ECkic26|I!_ZU`i!t-g52dmQL& zjJF?UtU<*}t9$1q&e#pXrcJN1CB=5@k_&^@rBc=>g~RORU1=FRj;CZq`ks(>L8(;!Eogp=_V}!8?=hKVmY~dSeQ3y2ct5syo_5y z0~JjH#e1sluBBE~NFK(@C{|#9GvE#ye+smUC_?b54POnOe8>8) z1_#^T7wrdZSr-Ev@@!UV4zzPnX;qjLrM+hJe6JMu0;r)UUtlR^s_dyM@u+pi^oJ$Y7y%k!CyTua%wp9b56_qjNw6^QZFN zZNE#-sp|=r{x|{SQp-c(eqCzuHb}VyD`U!aJg)i5H5r$N`vER^8DcENwLrO&+0grO z$slk!{)S5kqRa6SE;Q2DuWX}@D|={(AC39)iH&cmh4G76V2%lB~I zszU#OOL#e#qX8-&vSjFInzde^}dzWqRxhzk~LVWi%qQhwdL=T0WTe%J(ikO0Cr1cAdfK$@lm5_rg09M;E+v>?EE5VoW1!Ao^iMM zV-8HMN%KToy7~P4GkH(cZyr!d@{Pa{0ys_9q}|E~9Ultx`S^i8zUSN&9gQFd!dx3$ z)9|E>S(>AuHk=#NrMXzV)AuBgt=qKdCJ3o(!MF2MS;Fft zf`IlIfFK+vUtm1yq|?KE-ufIQXiH|)nC(#6J?KZdCXc*w!m^UA zW*XmZV6?W*H2POEDfF*I6t{n6nf#RSCD)#RHd}j%T32`1$J{c|KBFW*l(rWU=C7Nx0c}KN~3QeQqn>5+Ae^ zzZ&L!Kdw_9@|&9xHs$JPVa;$&w7GFVCyN%ZGOiErA~n^denvMxYtBLJGv>eN7k1Y zmNt(yOPiHU zzAVJ$e9?(kFI!gu>-tJ`-1JdR>@!C12v~t|#EQ6|tdz8dMEt>LqthRL{HM# z2k!rhrvVQZg^d7D95zI(6NYyV-=98uwNmBrj!{1XYAu(TtjT-bT=N6_DE(JdZq4q#g603df{_Y^m!YOW z1;CCFb;)=L8ll>ysR0s^TFJrZ@Xl17Sew%?oJY_ij7#mr_ff9pS-<-El;P5F=ir*8;DXuEE3=_fab2TAZ^orl`4KKn^yS@do$rgd zbb9aL`ksoh8<&o85SNb8kI6>I5FJ%I#+kUjuVS2!OULlz(lLI6>sA%|F)khVD_lBm zA(O~76?!)=4fhLN8t$*SG+ZOD8x@=gJjImj16(?fyTNV^_bXh}Rp_I*G~7m98tz40 zdXjr5>&ly?>URH@$Qd3TjVW+^t#F4SCM@&|6J}j8jMqd^vGF8rqA9#6l;A;Q*sWa| zDtF%Dn06e%GX9{JXrkJskmqoEEssCQV+Kh22x`YnbSUhhaBujF!uZx5nKE@ZwENqlJ37f5=jISiXK9zplo6OhYYVdGD`MkR{} z`>ZOL&$`-=SiKqHg}YSPj5L^mQghNkV|g#C7qBjiSVd~kdbY*ei$Yza*6_y=I@%ra zyyr_!f)G#oEf+!qp3k{TOLh#sjl9Ji5LSw-JGjcl)f6Zbi-$jl@8{{u{;Iq|k*8`j z>g60HWRAAeQ zd$hN0{*&noZOs&ZbS_%gKNz%1kF}GU>FX@MvbGO5fdE{c?kDLDk@VzyDO~h#5s5D_ z7Z38Ax0L(MKv}>{n}C~NH(NqGQZq+)7LN@l$Dw2AdbF%v zg=oPSHd@q<$(Jh_$Gs3@Z4d3B-jAy08P!>Q^*CPKaoYYf#lwy+LhU@Q5aVw0>wfE& zGKwJWVbnKMVAa)`(q_?*(t>i<01E8)yc7RNVeR0YNer!J6yX@MYM}_Dnp|s02vxot zI=99?KxHA?p%gkV_<@!~BHwXVabMt@sVMNmUpNA2!Ry|;pnLDaZoGMCf@h!Kj{Q8o zcn~%Em6QVW_4Do79J%rFn4R@~DXyt!ez+(hqlfCW@pZMh81w)Cm_ z{TH?Z+>L5?FSwq$FFgz`gl#r6h?Kv|AU|p4#hA)a2`lgfLkQA>hMqDb@lV8LlqN%- z@f8Y?ID`k6gZ?#T3MW-1G7Q3DlqqbsvQGakbB#KS7C8<*6@<&gDPJL}(`OKzxJG#bSV}?PmKAtmuZEc+m ze&cbT_}k{&@qtz4PBc7KN)kq(12bF(z8%kV&MzU*8b56QIriocQfI4#@92JoErTE>N2Kf=Rp&-Ih+p?nB!kp*{Fuqz z{Q56`Sel2W7>^knYh)ER%+5N#P5@Zp%h`GNi4_x)j>Xr_ql7%_Ch)bsVBNX~9Gw_r zg-qo3mJ-*dZah4h%qY&?Q994wQ3C!Ow!MauXm@-vkMP>t7_#l9aingeU{2m>;<2t> zq+qVyDTOm1{Vf((Vx_3udJ(#AjV~F#A4c78KJXTw)dQcB3Q8p2fGPxU(tIO0cxO+#|+{e_gofTvcDY9-Xp(m!;x6yK4__ z{X9ri*(Xx%NZR2|07WI*JWDiNVr1OxUdw9#AkPF8fB=5%7_}A}M-|yYG;NC2T&;`we z$s)bK-Tgc;q7q2EGf8O*R=E+N_RWk?I9JC!(!O9irsdz z@n(gH)0yrcm0_1fI6da|0L)UKP6h0@>#;}nM>EucEtQ2TpI}p9Aqmkzk)ZNGEPHsT z9vzyyJC;%l2suDFR+GaPfDqHFgN-B3# zc1F00(%2=rRN{1k?d=>$n%!QswtJ zt~%xV2$u|3m%{}~()`TPxO93a;S%W^m*Z?)IyWyao!Ury>{2b&F5IrBj)gby>JpsJMT?rPC7~$Agt$GcKLpYq)fJ z-SDt(P%^{A!as(sQ;ibeK%*oy*eJQ8!thLT7@o);!xLcV;?@$bMTE=!YG<*VBdLtG zZXT0naKp2$hau@y!&OK0t)qJ#p&cJ(6nL{`uV#=7DFqJ>81;&;l%2#g@ZsrePTou| zd+03_V{o9=7))sfOQ|Mtf*P4h$tKt*TenP*L#Q%+_7vfQs!hG2mAs!_UM5$}gX{`4 zbbG=TMqL39ZKLVavpHmi%S$5UJ}_bpDvwyx%iZ6UH#(BaRlXbzPAsoPCrP_|uT!p*VdI!(`y zqxtAAwR`)N;D5R-15wcpgd9wFNBMLzHe(vLcfo_!xNoc_Wo32`l+g;qC~HYDIcY*T z87NWZ%xt4)rZ^jz6J7;8fqLr-WsXI=JNCVXqTY&eDY0TrAOvYwD!(MZ+V5#xnjFa* zqeO+8;EJhS|Ap&z<&v{EO*Gcy(t|@@C7P!~Ww&03ewYnSS%EP9I3Ejw@P4 z^dLF`mmZ2&;*$Lfm*cvu-wj#Uk8%A(g^Joq9fMED7~fSBM~}ZcaAn!NY1PwinNd5V zx~6Q_oao%@>KW16zB%Ey#A<5GZkjfKM%lF5ve`2baVwiUX9lqIVzp&6XU(3`*D-xo zw02Z%=FAz@qo>WA7M)dlYnh65Lr$DCV!%nx{AFxeWKv5tFHt(x7=_rS7#X7?9|RF~ z^us{56cvYzD2?lG?7kS8Bgagm7}LvY=TfR!wX>$pp7o;{Wzo5FYG*8@Dx+evW>23r z=f*NA=B&AMrd8kC*D-qToSNF|ShSXSUH)ZrXO`7SWGQVZ(;8(p^JdSgoiG=P!d%~J z(ddlXxgIz7bxf?jRdPBbMxxRlGv?HmA=X$U33oL#Epe&jaI^aDD!meuoK`y{50v^j zjy@xH#uS;6|rOzZuYJg6gGrbJgtU2>(*Xi9vn^9By z?_!-JEn}xXcaEf*$wTth^~f~)L_58I2iHxr)kLeO)kbeByFuY%O&MsM#f)s*B6|A6 z*o-;RTg#M0EI^~@-U2R59Wr6FX4HT;)ib8uEWQep=t%m1u9SVoyt&bvRF`IPrJH>0 zLR?ffmvKTh5pbO=nAZhbGh;SmEeHMjItJv5e9F+s7qAr{PSF21idtWxlT^d4&?$nR zr;>wf_rVjpM6JJ@g%Q!_T;WC;oQ2MTQYii&m|pt1_~^fBwk-p<&?y^SG7;R>EBc2b zHRvVyM)~2d$WdmCKMR{Ie=^Jqogx4#so%Wh=!>`MP7To)tE>UZFguw*m#Foh>~w_q z6w1TV**`66EuTX7OkjmhX06qWnEo z_Tzp7b7E%`g3W^i7Hm64d1M*fBD3myfjKF zn7k66q+$v6kiTbEB`-fICzeJj1(O#`m{@3(ilcu9<;2n`rC{=639Tx0R@$*%Z!Gxh zw{l`>lu|Hxv1E)CI&IW(oVLC7k0R(H@GF1ErjDI^ zT23sDQ3@t6mW<*;XC~J9lV?pnJtvmNCItpx!ow>befdjGy^p+7Bhf_sA@j$Tng!LfYG-7=f0nf1~M{670Fv7$#@){)@cd5)B;XXNB0vE=VzyB6ZsK7I0h;DDm@Zk15|M_ybD zx;gWStz&(V7fXVFbOg+$c|J#8Fp}U2c`y^kj}K3oHhp@=Q|EPi<`Y}{h@eU4Py19H z;q$W$0Jeq^{l%F-?X%$spI$mZfpvGiDd+l-os>vjUgr;uo;YRZtT}2~P>|0FP zh1`@IWSx@}u9kOGZh)PhGM%65xwkrUyyVVP=4w<|8qwN?Q)CU53wikWf@#@s&B02Z zc7z4fs^^TKbCvYR=(*MNVl_vUvbOrx3E35=J!Hze3NU@f%xSUNwLV!}<-qBJM-`(! zBcS+iJ4ac(U8NXlmUf|h6McfWEb*n^diL##GO}MK4{aNb`@LJAVdO!DQiB zuA%16W0GQRqSi0nLhG{C#BNdd8_RE;GJO^c#%Z^PXUv~5JGUX}!&!{Sb7s$;e~VyZ zbF;Wy+LkQSPzLntQ{PnXx%h z$BzW?oT$2gCdT+(5QSX@|wl*4=VDHQ@Im;nMz9CdslGhjnwnI_Ez$F2S&5U?$;jKb~(@H5p6g? z9M=N#^TXjTsK{%-dJ^~zFlUd^5v58h-}CeDrih%~eKw4pMYruDEL$>^fzWn$cYCDV zclQ8JSoXC&fGY*=H$8w8_V1}4z)3s2+5@-~fP1e8aMOW1&;z({1NVJFlAOQp+D{lU zs|RrB0{2W0;Dp^z_W*7PaD|uilk?YI`6S#!^LE;_DdH^T%U|SF11Vu|D{N(&~SKsdu zeti$%gn4_S2XNznbIVW8Uw8Qm@w&PPaDrFK9>ARq+*3V(lSRshJ%Bq7xPv`_D+aDa zIxpw1yZXvF8q@>0D&Q{f2JYOE=j%0FPCiFCGj|Mw=0^zp#J@HXm%4s~I^e@gUWvB7 zN3S;Z`wdRWQE0Om6LPgw^oA z9AI%X(Q_Ed&RgeoTWg;o{{p&Xfv++|^eqYuV#U)DumpZ1oU%77M_vgyB zBJ1kr>}aw3NJTp@9hwd3K>E$D~lE}{c?^kcfEGIAZ!NG!r9 zqAoM}ty!+7K#R1Z6>_7Qj?+9IQ~Lr*O}j#k!Ka){9qM0SsXKYrddJev+dPeRjd(ls z8!*VmhjJ%q;mLnQdVJFELA!&Pmu1%B>DixrPSU0Lb+P_9im*X@q3PPz02<}mFshUA5^YG z{L094Ir@|AL&|k3t_PLt`?zEXxg7G6^{;;rdFyM`~CCU zX1)EMIj`3<#`wqg&DqxPohkiRZ9Qf5&Nol_*)>o61!(!Zwleo>!V^2$kI_wn#B%Zv z;N%tL7-MlxHaBViw5Ts`1tiUV(Xq9ME^&+R7DTE*l^-%1vVavMP)BjpBjlelv}i z*NbanKkkjayafSsUTYZF4x^48Or0duD> zzULH*`iR%`1) zZ9Sr`25q%yt5sWjv?U6(h+d+tGHnghR;9KkXltsr=4orGwpMHFL2W&vtp;tiXscCQ zd$c9kC;4fsOk2aWRjI8B+M24ZdD>d4t<~CkP+N~^t3g{W+G^F-9&I_8j3hs8m1%33 zwkowXL0eO`HBVbhwY6GX4{GZXZ8d1CMO&@f+M_K|Mke`bt4v#>kOt36ZB5YDRBg?} z@;y^VF9tjt>(&W^F6AR=CIJ!ju&a?y*`Zvi33QWg_@p!2SP0O#RA;B zdi7|D&>C;87`~mW8-}NTZ41L*>{e_p@ww$~`;U3ptM<5=tDEW*5-dYi-9p(I`;x4>TCkjIXOXHX{n-haTWg+ClR$G_85R^xYl&7la65QM>!p&QO4SHAhogJ_<}M1}P8)IssWUx9 z-NfjkXBolPVBsb21UokbFMdEkjrt}yfv|PSI}z_8?v5PdZ5SyN5=;o_N&$3{l}N5^ zy3#~KjnVGPqg{)TI(kBip~0n~IpAjtI8r`I8c5PqK_R)?Us)2e#t#%4=-E>919{NL z(*RvAtUbA_ylBUDkLs*XE|m`98dYa=Y&RTQ$AXLWRU4i*@2p=dp~hnqoL$a>E@z?b zWNPMpo95WxBi3AZWXQRp#!m|~!d$9hcOm#1v8qr~kqRcS;MJC06h`jC8u16|ai)jV zr`UP(LwsE;b)o@(Ph`c6g!PqtU*~I2F=%XNq!lerFN<6 zG1><8(-TWnpJhG@q^mL?s^9of>iW^tyD@^y@#zs~i<+lTsh3ufG)moeEW0?nDGvAB zm|&$i>!c`!H7<&BRoJtcdn0-6jn?JT5~5e!4Gv4sey02w~tBp`&^p;EI z!x+6j?nfVXr$5n0y%VGGgFs}2}G1gBW6^sHUA$Wm2ofcWy=TIk4hJP9RdoZcU zYfx$AKu+*~wRSD=QB`Mth8bbR=na~!*0MU(potGmAR+^Zxnu@ra7JDcS>++-0a-Cg zGc!TDsE|p}>vSk6*mhTTv4yQ}Wl?Kv@X;nDgoLV1fMQl!i$%MPp8S%kNxl(meCS3%HTQ_^*!p^|=x^2=uAl;9pdrG=abQYX`>1Io}K)PP(7E8Aj z?w*DS{!y1e(I|p8D0w`=;2K1}7*ijC;QzG_r{{X%C0KuS#y8PSFZnt`Y&bNaO4px4 z;~l&s*Xxzb;spq2~bdkHaPY{87NBl-zA`eLTP z1*@8ldj#jPPBE9{{@d|Ao=?iTBqpkzSSY)xQHu##Vm-nRCRm8E5oBv7cpN|o?MGgs z$#EwScQegE;clZTDBSHd2Zfukq5Fi}n8|McHkyVaHk+D-e?y_*9{_JV%}wEM?h@|r zL4Sbg@5iF7e?N#1C>`MRH|7bggqz*Rdcb=R0^KCp4Pq}z?gdU1)`8U>#N`YjZVSOl zwW#(^)!yQDBxWH5J<)L8WVJz$)&;8_5>G?e8yACR%yl^Nvqj>0VoZsw=4c=@gu8jY zaJL<17l{>a!xrIg?h@`UL?`jGpnt8$ks@m;G>Ul}aoZ>@q9~CBioZGH*NKQ1ic)(3 zp_(J!CQ9uPP2ti|QP9t$E*vT4E+}># zpRPhlW)+b*2g&EQ;yk%alqW{v2171czKkK45FZ9_me(UBKFI>#Yh3{S3SG+Ax7?8S zIqVl=vaQ<#1=NiGrg>01if<|lDR0-b^}w;1f-d}MRKmaZ=&zFVk---Z0v-Eb3*wU` zeLrMm7Jq3m0L14~gkpPx4Ao!XhrI&{8BpY*!E>Cf;$IsGvNKtq4o9iK5=A+9Sd_Tr zAxxa1(>qsx@N}~NF@}8IHgp zw1s&uf_jmu9#H?m)Jaf3V=6XOU~xNb^ren46MhPc_DGzz&p7vL5c7-f!e~ne*-m3W zA1XR^2-FVty*yK(l_ORLh4)5nFSGA|fD%t@0yUp`?;5;Apo*CH7f>PwUxC`fJU~v_ zUSaA=P_Hs|Ehu5f_k$84&jU4$eJenTP#yubg?Vv9?nj^k%zMd@d()76-;nzRRFLKR z47p*biXyy`pu}@;1T~Z8?f@m88#LsW8FICt=CIr*gZJ;C?qS|wyAY_lhC$b>oJXqHxxpgjG#{-JOI?-oZDERGdvU%sMEbmc$V|!-HEJE;EScf z9}k;sw{)r|n`{-sWUCk^TUyYbZ?bKt*^Sv`>vt6Fk@K5V{x$tHISdcWKa~6}w&-~~ zXp!>E z!(C9@UX4(3_R!O#CTD z9WW#wrBN#3Odu?{8HI9CY;HKc6YUL{2=A#FV)uWFbz%4l2G;4V_3vqANT+jH4eHsN zA+z-(&Q>g!rA0h#l7S^H>q^dE7{ssS+{JR(9l&zc z90Y@@|9m(#su>~9fOQ*ee+r&)sj8zpauD?KAGQgFp|4wP8j8^jF`k8Ixb|XwOZ5O> z-PglW8g9cpE1sb2h@HKN5zdsNZf#Q#3{))IC=%bVBfbt%Pig|l8RXKVHHGG(jK(qQ zIY~`zA~OPKgIv#p$+x{%>viG~c7cFLrXAHoyArhaAxzGx_kuS$&ji-czSyHHP6QJ3 zoRnKgLLtX$(<5+d{MOu}%|5ULElCTCpoqMPgaN8YI0ul$c}AoH6CDgbK;#Q(2RM!m z%`$hDhD>xisup=2XAO2c0p-RoaNxTO)t9OkefddylUhR$DhE0MU?Yl?us`zx8>JBO%s;)S;VOvI1!FBW zA(R2teZ54q#$~wcy)@O1?##1GS-Tcvo4R^3zJ)pFjc3HrwF|fnxLXhk-LIGKYT^2- z!Sp>qf3xVXkpA-M&rN@s^hbKW!V0sC*1UwDTPDfc*s zYmHfmQ{+lj`Nh5Va&^+Zj>si&raP5}XYoiJBTGI`wF%Q58y^?VE8=v2=F?iH1Bpvf zae8~KxxZZX?2GiGn6t5CIDJB~f>S+Vq))Z5b-K^t1GJKw>Uh=8g%andr`lzH$(kv% zO%{=!d!lJ4TQCnqe>DNIhCR@iQ0*{|sz0{_CaZURDE~+Z$FBox?W9k63+C_+x2n8_ zF5i2+Oo-JP=iWlJPWEBx?!LJPwY>)IN zA412j_2hO;;szqX$UHcEj%%o>*vi^P$m$myk+iuDj7~_@=0?gQ9P0aQQM=P_ z52SXb041r~_XDC4=RG%2s+GD?R8H{(H5ZH=8@#z)`TK$;-VLW@Fsw_AK7;yFQqB!b zkd+vFaeI>ov5yyfn|dXu?BHcYl{#u3-0Wrlfyqwl;7&|)(NXUjtljH<1a?yp9zMW! zqw_ZQ1rDn_(X|iSVMxWV3tJXo69o}(q@D-I(NSKZhT_mSv=r<#(ddNlyW3P8mwA6k z`^cwtXdeW${UI!(Q+v@>W3Le##DQ2(S(uLMnW}Na8K;bz zf=u|iaiw+z(6~{%v9ZM!M5!m}yXo=BTBmAn$EHTX?dpUNqgkrVs6-NJ&*Lo+MjMjU#lf4`8Z9ew0;?9`XFcL!kAEN(icp24*+%3{wFWuGB zCEOeGe?Ypkq+2N6Jn6cnn<-tJbdOWHK>x6GyQJF;HF!VEb2J`m@ zv@T0~R^Hl&Zl9)-G0`bfs-WS3UissvlLml^`e_4g>$NY->mxhn=rUO-GrJmLy zLG6f|2xg~3B^mLVaibwVR{4L0H}>N8>_V^k1R4Js6*Z@ON<+5yBf7$3ppC zA*}_o4emxe)mW#Sx>IylEo#eA2R3ZbH`60Sxm|d1=gv1ModIQPm$nZ(Jd{p)ohP9E z4inRlYA(Z(*GfYvqTK5M&KzZP7lv4Jo2C1*bhk)%y>wSgw_3UnNOzWW3#FSUUAJ^I zrE8P!aaqiV;R0(2|60TE;I|WFugy`AjTAC^e|&JF=$2YX*|G;Dq_$hJ&j$=AgGn5Nz8bM86jfO zlHb$V!Hmho@Gzr|88;DQ0yCPKaWyf>hTv&@iy0RaV>~mOm_f^_rrVhD8Z!uIwTVm- zp2nA%agZ3}m_cCSN^CbV#xmmtW{_f2J~Os5<0r((W5yO{JWY&SneiMm))0ftM4rYU zGNYOpw=iQPGZqtr3`3sA^~|`N7%(=1@jYhTL5v%j@gy^DCPpqZ>Y4E^V&pJmH8X}2 z0}DHZv5FaIQF2Y!Gvg6vP%$@+W=4b=?-L`N85Bn))=rG;n6aE0jl}piGnO%9D=|hf zqm&uX5W~%k2bfVujBA;(fEnK*#x=~C&x{9%@%PLqX2winV4aMp&tk?DVqmofMvxh| z5aViQ_?a=17+7pT!pn?Hh(S9Zp2k9Ed;z+N%!i)F$;?O+gJ#yA#tF>mAqK5(JdFj+ z*h7pgX5=yBbz)#G1qmtuCAN(iSU!M}!;Fo@z&sj^Y-YrWk;x1<7~$F`g>OdEO+^!I zND#e>ZWc7rWZ%=6MK?2>V41>ACf!VJx`b~s=;pR28rD6HF1pESqGh?K(MdPoYI5<7 zjczXUG=520K!b3s#|A)M<#q4y)J{xCQn@W!`5-J zukMe0s%j_IGl#T}GkD+Z+%To?UL0(@$9DkX;gz{fG!4NTiH4?CD`IE+q8Ia&0UP9Z z(7`!T5sB z%>;$t8c&eFM8#j!0>m_IGx4i7<_Qll<47z$RYDN@au&znl3%Zr!bFcxQyI+fsN<9K zut{RF7i&k};H|6POl(>QCpGd6u>KV=i{crt;>A7xqy!D0(cx;s>GHIMdwQ!elq#6L z(kOxelvp_pmkyr2V(oz!3gz-cCQv3Vc_+kRI%uYX);9Afu(<;_nDsnK z@uCwzcyz;@UVmGPtS(m|X}HJS6HrA7=lyCtxYnidpn_Dc#oU2{gnBUXwxF=*f4KKH z99N#gAt6Hvnf`0l=pBK>m^W7=7F<&F)bV&KaG&v14#(3``g}Qqc>TG}XP;wNM5UokPs8))2O`Y%q z-Y5&x9o4hoSy#9?kjQ!#H(JNcgtO2apMfZCq9{$*f^~SnZ{jul9n{at$*x?KiXLOtJeJZ}id&vPei3x>h%p*y|2D2G9>i`C^?!mIV`P0hNzskuT(=oTkdl51p?+kC_xc}0c~xj0V# z?0@L&Yc_rvay(W4x+S$pQnCuVI2v0RI;8mrl~p`cfAL5udD9d-+}BfV;7$!I@rT#R6xGUkTmA#G{FIbI2 zLzw}${BxyltCM=DRjZvqou3l$ysOkb4Nf58T#cwL!}HZxD(B4{iia}w40=ej-?t=M%pnHWsj5CFuz=UjAm@(s3u@Sqm!8zR$=e#?dj)nK&@Q0C#` ztMX6tdos!AkRH7z)6qGB#LN_Mbq@~{2ay1m*`M3(ht(>On3b-M!n^ zaQC3K_9~T^lZdFh5IIUBmYR!Ni<;Zg7u|8enu`N@&iZpw+1lemDouU_u4w=)s&MFYyD#t;*Q#5O{stqmFn zLqqO!--jd(vd3=yWHwC~O%VeVY^dZlbI~a}(wml-=?of26`%7A?Iw=xs84{%5vRltU3 zM6g^r*w_Y_UOOiTubtDb>x(*a|>rPv~K|KLV$k7{{ zg4%9SZyD6@K#5)GPeIWN+G#rhiuy>W?JTH&V@g3Zw=ne`P+OTwfD*d@0;-OAFM<*p zO`wFva3n&=T?eXx<;H*#a)iDwjeWlWB{T>(|4HV33)J&W-3Ur(_&~*(R}4yo zS7P`!f)e?X#Q46I8TAlZ7Va;y?P(KGHLOuv;9s3>zB|`oT zlnD9KZ|HJ=2TJgs0!5>O)AqDM{i{L!7bp>O64VlwI|E9DJQPcQ5z03}m9pVc$)zxk6yd>kx}^uzwMU&C}AJ51YFLlogZ5{&z* zVdl^F#g}J0@ipx)DY9N1Wx?OGu8<#s@bHRbhcMpZ_)xSKO3+2*SjH{#HIHK~Ee0sE zK@BoMnKbm+;M^sQ5O=x!iFtj&#N=^-T$lrvXBW~JtrIxe1l@~~0w1{QFYRN%dUC}? zOo3c`9Q0`~*8bV}xHmFEyUQ6&6if(sPKQVM?X6gr)6T2>5EfjR%TJ4Mmj@iahglZZ z`}xiImQiFd%r)lkf@v$d<Da`dU|kC_UA+RW5|5_j|G;BhQt&S7EwA;jWi zz47llVT`%mM|Opk8FXeAzC{Wq?#ID1r+crl&bYCB@W=LKgs^c{zY|Xgd5%YVz42Rp z_!c!6YwBmQceYzqez4o;`Xst9l$d7s+V6F0x5LUd$K{RR=fs-}0j--p1w0wl_Npzt zune_&9gA_G!(yCC^$##EU~>YSt9^E5?R|)#_4!_8Fk2+NYh2z*Q(a0d4>Dk_@#5nX zFP~h1+K0WH<5;F4s;AU5?POj=iA8sbs+M#>g)`vyNI_706l<(|`cRLLh7vdD2U5E! z8-yq}?s~69HiU4HNqq#;uuox6m9ij!DPKKx2Ej?b!;$}V)@AaMpSY%190erAu)^&63CbcWc>c*ZwFlR~!WcAWDQc`oQ!coffBkNvuganmOT zZ?i??@*|UD5I^qKI=s1uF#+RcyAtZq#^PgPbO(J%HjaI5@l$EokkH5d4IPm?_>0@# zNvNt`vQ>(2@E52H)kW&!g{^7|XKo@)6u7YN!0@?-%sPJ9b9&zuA8OjCy3|yg&+`$M zR@e!B(AoPM#YAmMI{ex}uVV(X8^2sE1Qzx^c9m*x^J?WzRoPMGq5#59uf0Q?=88{q zsag>N9~#i`#tNp8KGXqvaJ+bpOPw^=6&^$72UDVUFT_OYbs43%OO)QOXs0NW-l5n> z_0ja2W3R^Nx-|_>CSLbx$09dlaPGf6p|56IN8b-Vq^8VWi5L(TS4~+sTtUH1 zH1K?dcSU%m8{rZbaZTCMDDa5!jA?Uyiz};YfDHyXt)i-EC6d99Ur`ZR287)562xBc z|C;c_1oIm#t6Umc_O~e@`c`qu2nNg>kP#F~=HGpx7)lQj#S4g<;`g_RBX-LNvW3Y*}K)5Uh*++y!yy-cQ-Ev=|r91WvHiwK;}T`pjd%?c$| z(dDI7O1j7QZXa=1aY6uzr$s}RyCw>zCCfi728in>-AVI=K}rIi)s zsF{_Knq{`7oh*6YTY5#3ok+2iE zMV(^;qMk^}0eCjYXs{qe+$w4b>l|fMT~k#WMKLk*c8v+r*`0Gs*oX^CmDhgWF@f4DIq2iYkE*RX*l!Y zHjz9+Pv?GwV~xzKDWi;Luy-yZ>J%YdRl@+@U=buegL9jT(QO~sKR5QF&s$i1!KmRyGM_9Uuxsp@21+!jaxiIv|9I+JKUoyjQWi#?Y0R> zLd27jE4=_s&!FbqhNLQ(LpP_ov~&Z88o{o16ASanbfGT{LTU*s-W!k=Bpi{nbUfu$^)EUsCSa|v9BoiO|!0(Du|^AiOeIC;;bKU|j>saS}3(?uKD4*Na$C&rfO zqJshs95=QSLq^Xr+Qy@cQtYr7;hz|p6I;J6;J|TXn{3GFT03OUUj|=?y&nD)*DE*v zydn(;-e}0UWx70)Lp$*fyI#WUwemFr4jgRTorVl)ne&+zQVu(nEM4PU8pfyLzyt|56o&a!GVtzT$ZuKkXnSp4s#4&!wQN|nBc(2 z2`l)V5^YG>D$y3a5;G%M{j795O*1AE)aG(Fn7tL_sqH?f|Ma#`vdd_=$mR{}VzCeJ8 zi^{<=7OhdNMJs!{M%>qVg9#2iUsMj3v1ol8vS|?U!u$T`O%oh=zNj25W6`4CG+kah zulfEQ6C8NHs2nU~(aL5mJ%<1I*}O6{9Jr_(EMw6c&06}%aQ7>B9Wld!i(FzEi`Mn5 zH531I6+iOT9cDOiQ8!q|qD3Vo`d-o+@#Av|GaR_68!Thd%3-Ylso)xZWZ^S8>GB#Y z>ITbLv}m+(*zac@Sli$Ct;;oOiMqiu7OfjuOCOgW|L;HFc%w;6)D4!gXi*z+*zcCl z>O8dX$W10KQ8!q|qD3#{rNQj`>i#t8W|Nkv8!ThdqBfH5ZPv}6H2D^jmZ%#nW6`2o z;jmN8>Do5z2Pej)wZ@6M!7>&t>Sr8w>hb70vh=>Qx0-C!Au7KN5R&f>dQRsJ;3 zq$TPG%UHB1G>4tWbh-*&FIt&z(h_xpWh`10TDrIS?&23N9&6GPrOYxGEeg$HpH2_L zwQ}DhqsE!EL@Bcj`?tzLm1>%G<|*pl;IQ;Bn}*^cHd>@rm2hzUCkB80Xb55n&XlwW zID-SsU*bp$39UZ}huP3N58i$d2z*{fo5KMt{lkF$Hdu)Bc|i5xU?F0N$TO4;D zJkC$f3ul8xrW{8qnTj1D4-WQ!nI)Vtw0e`_^rx_=W0!d5rm(+(T3|+KzaTWe0B~Od z;QW=}E%Q|Z0UxIiu%Tpm)soU8onsDbASV3svZYH(q>=z>FDi;WA_Ad0%6Fv|wc%(v zEkOsdaWTteCNk-Iu{0F7OUoh*b{__)`{I&i4}~KSEq*vG{K945DXt>Jo{pt2l2sw0 z?*CSldUGm)Juef_R={u?*4~n_12V%lz-G31#Y5q0X7b4c!jLAIix-O~L}{`4=FC}) z1Tp~s+z1Y!SULa#-yAgvQnvWZmcV8+7luNS39vMlMGX5^S?N?dIASg=qtYL0bIZOn zH&Rst6nztVzy932am1a)1IG}A%5X}W2>wEbGaQ@%BWDTOQw9jq^UwEX7=Jdo0pGuN iNhJ&wmZx4gdze literal 0 HcmV?d00001 diff --git a/curl/mk-ca-bundle.pl b/curl/mk-ca-bundle.pl new file mode 100644 index 0000000..79c78eb --- /dev/null +++ b/curl/mk-ca-bundle.pl @@ -0,0 +1,667 @@ +#!/usr/bin/env perl +# *************************************************************************** +# * _ _ ____ _ +# * Project ___| | | | _ \| | +# * / __| | | | |_) | | +# * | (__| |_| | _ <| |___ +# * \___|\___/|_| \_\_____| +# * +# * Copyright (C) Daniel Stenberg, , et al. +# * +# * This software is licensed as described in the file COPYING, which +# * you should have received as part of this distribution. The terms +# * are also available at https://curl.se/docs/copyright.html. +# * +# * You may opt to use, copy, modify, merge, publish, distribute and/or sell +# * copies of the Software, and permit persons to whom the Software is +# * furnished to do so, under the terms of the COPYING file. +# * +# * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY +# * KIND, either express or implied. +# * +# * SPDX-License-Identifier: curl +# * +# *************************************************************************** +# This Perl script creates a fresh ca-bundle.crt file for use with libcurl. +# It downloads certdata.txt from Mozilla's source tree (see URL below), +# then parses certdata.txt and extracts CA Root Certificates into PEM format. +# These are then processed with the OpenSSL commandline tool to produce the +# final ca-bundle.crt file. +# The script is based on the parse-certs script written by Roland Krikava. +# This Perl script works on almost any platform since its only external +# dependency is the OpenSSL commandline tool for optional text listing. +# Hacked by Guenter Knauf. +# +use Encode; +use Getopt::Std; +use MIME::Base64; +use strict; +use warnings; +use vars qw($opt_b $opt_d $opt_f $opt_h $opt_i $opt_k $opt_l $opt_m $opt_n $opt_p $opt_q $opt_s $opt_t $opt_u $opt_v $opt_w); +use List::Util; +use Text::Wrap; +use Time::Local; +my $MOD_SHA = "Digest::SHA"; +eval "require $MOD_SHA"; +if($@) { + $MOD_SHA = "Digest::SHA::PurePerl"; + eval "require $MOD_SHA"; +} +eval "require LWP::UserAgent"; + +my %urls = ( + 'autoland' => 'https://raw.githubusercontent.com/mozilla-firefox/firefox/refs/heads/autoland/security/nss/lib/ckfw/builtins/certdata.txt', + 'beta' => 'https://raw.githubusercontent.com/mozilla-firefox/firefox/refs/heads/beta/security/nss/lib/ckfw/builtins/certdata.txt', + 'release' => 'https://raw.githubusercontent.com/mozilla-firefox/firefox/refs/heads/release/security/nss/lib/ckfw/builtins/certdata.txt', +); + +$opt_d = 'release'; + +# If the OpenSSL commandline is not in search path you can configure it here! +my $openssl = 'openssl'; + +my $version = '1.29'; + +$opt_w = 76; # default base64 encoded lines length + +# default cert types to include in the output (default is to include CAs which +# may issue SSL server certs) +my $default_mozilla_trust_purposes = "SERVER_AUTH"; +my $default_mozilla_trust_levels = "TRUSTED_DELEGATOR"; +$opt_p = $default_mozilla_trust_purposes . ":" . $default_mozilla_trust_levels; + +my @valid_mozilla_trust_purposes = ( + "DIGITAL_SIGNATURE", + "NON_REPUDIATION", + "KEY_ENCIPHERMENT", + "DATA_ENCIPHERMENT", + "KEY_AGREEMENT", + "KEY_CERT_SIGN", + "CRL_SIGN", + "SERVER_AUTH", + "CLIENT_AUTH", + "CODE_SIGNING", + "EMAIL_PROTECTION", + "IPSEC_END_SYSTEM", + "IPSEC_TUNNEL", + "IPSEC_USER", + "TIME_STAMPING", + "STEP_UP_APPROVED" +); + +my @valid_mozilla_trust_levels = ( + "TRUSTED_DELEGATOR", # CAs + "NOT_TRUSTED", # Don't trust these certs. + "MUST_VERIFY_TRUST", # This explicitly tells us that it ISN'T a CA but is + # otherwise ok. In other words, this should tell the + # app to ignore any other sources that claim this is + # a CA. + "TRUSTED" # This cert is trusted, but only for itself and not + # for delegates (i.e. it is not a CA). +); + +my $default_signature_algorithms = $opt_s = "MD5"; + +my @valid_signature_algorithms = ( + "MD5", + "SHA1", + "SHA256", + "SHA384", + "SHA512" +); + +$0 =~ s@.*(/|\\)@@; +$Getopt::Std::STANDARD_HELP_VERSION = 1; +getopts('bd:fhiklmnp:qs:tuvw:'); + +if(!defined($opt_d)) { + # to make plain "-d" use not cause warnings, and actually still work + $opt_d = 'release'; +} + +# Use predefined URL or else custom URL specified on command line. +my $url; +if(defined($urls{$opt_d})) { + $url = $urls{$opt_d}; + if(!$opt_k && $url !~ /^https:\/\//i) { + die "The URL for '$opt_d' is not HTTPS. Use -k to override (insecure).\n"; + } +} +else { + $url = $opt_d; +} + +if($opt_i) { + print ("=" x 78 . "\n"); + print "Script Version : $version\n"; + print "Perl Version : $]\n"; + print "Operating System Name : $^O\n"; + print "Getopt::Std.pm Version : ${Getopt::Std::VERSION}\n"; + print "Encode::Encoding.pm Version : ${Encode::Encoding::VERSION}\n"; + print "MIME::Base64.pm Version : ${MIME::Base64::VERSION}\n"; + print "LWP::UserAgent.pm Version : ${LWP::UserAgent::VERSION}\n" if($LWP::UserAgent::VERSION); + print "LWP.pm Version : ${LWP::VERSION}\n" if($LWP::VERSION); + print "Digest::SHA.pm Version : ${Digest::SHA::VERSION}\n" if($Digest::SHA::VERSION); + print "Digest::SHA::PurePerl.pm Version : ${Digest::SHA::PurePerl::VERSION}\n" if($Digest::SHA::PurePerl::VERSION); + print ("=" x 78 . "\n"); +} + +sub warning_message() { + if($opt_d =~ m/^risk$/i) { # Long Form Warning and Exit + print "Warning: Use of this script may pose some risk:\n"; + print "\n"; + print " 1) If you use HTTP URLs they are subject to a man in the middle attack\n"; + print " 2) Default to 'release', but more recent updates may be found in other trees\n"; + print " 3) certdata.txt file format may change, lag time to update this script\n"; + print " 4) Generally unwise to blindly trust CAs without manual review & verification\n"; + print " 5) Mozilla apps use additional security checks aren't represented in certdata\n"; + print " 6) Use of this script will make a security engineer grind his teeth and\n"; + print " swear at you. ;)\n"; + exit; + } else { # Short Form Warning + print "Warning: Use of this script may pose some risk, -d risk for more details.\n"; + } +} + +sub HELP_MESSAGE() { + print "Usage:\t${0} [-b] [-d] [-f] [-i] [-k] [-l] [-n] [-p] [-q] [-s] [-t] [-u] [-v] [-w] []\n"; + print "\t-b\tbackup an existing version of ca-bundle.crt\n"; + print "\t-d\tspecify Mozilla tree to pull certdata.txt or custom URL\n"; + print "\t\t Valid names are:\n"; + print "\t\t ", join( ", ", map { ( $_ =~ m/$opt_d/ ) ? "$_ (default)" : "$_" } sort keys %urls ), "\n"; + print "\t-f\tforce rebuild even if certdata.txt is current\n"; + print "\t-i\tprint version info about used modules\n"; + print "\t-k\tallow URLs other than HTTPS, enable HTTP fallback (insecure)\n"; + print "\t-l\tprint license info about certdata.txt\n"; + print "\t-m\tinclude meta data in output\n"; + print "\t-n\tno download of certdata.txt (to use existing)\n"; + print wrap("\t","\t\t", "-p\tlist of Mozilla trust purposes and levels for certificates to include in output. Takes the form of a comma separated list of purposes, a colon, and a comma separated list of levels. (default: $default_mozilla_trust_purposes:$default_mozilla_trust_levels)"), "\n"; + print "\t\t Valid purposes are:\n"; + print wrap("\t\t ","\t\t ", join( ", ", "ALL", @valid_mozilla_trust_purposes ) ), "\n"; + print "\t\t Valid levels are:\n"; + print wrap("\t\t ","\t\t ", join( ", ", "ALL", @valid_mozilla_trust_levels ) ), "\n"; + print "\t-q\tbe really quiet (no progress output at all)\n"; + print wrap("\t","\t\t", "-s\tcomma separated list of certificate signatures/hashes to output in plain text mode. (default: $default_signature_algorithms)\n"); + print "\t\t Valid signature algorithms are:\n"; + print wrap("\t\t ","\t\t ", join( ", ", "ALL", @valid_signature_algorithms ) ), "\n"; + print "\t-t\tinclude plain text listing of certificates\n"; + print "\t-u\tunlink (remove) certdata.txt after processing\n"; + print "\t-v\tbe verbose and print out processed CAs\n"; + print "\t-w \twrap base64 output lines after chars (default: ${opt_w})\n"; + exit; +} + +sub VERSION_MESSAGE() { + print "${0} version ${version} running Perl ${]} on ${^O}\n"; +} + +warning_message() unless ($opt_q || $url =~ m/^(ht|f)tps:/i ); +HELP_MESSAGE() if($opt_h); + +sub report($@) { + my $output = shift; + + print STDERR $output . "\n" unless $opt_q; +} + +sub is_in_list($@) { + my $target = shift; + + return defined(List::Util::first { $target eq $_ } @_); +} + +# Parses $param_string as a case insensitive comma separated list with optional +# whitespace validates that only allowed parameters are supplied +sub parse_csv_param($$@) { + my $description = shift; + my $param_string = shift; + my @valid_values = @_; + + my @values = map { + s/^\s+//; # strip leading spaces + s/\s+$//; # strip trailing spaces + uc $_ # return the modified string as upper case + } split( ',', $param_string ); + + # Find all values which are not in the list of valid values or "ALL" + my @invalid = grep { !is_in_list($_,"ALL",@valid_values) } @values; + + if(scalar(@invalid) > 0) { + # Tell the user which parameters were invalid and print the standard help + # message which will exit + print "Error: Invalid ", $description, scalar(@invalid) == 1 ? ": " : "s: ", join( ", ", map { "\"$_\"" } @invalid ), "\n"; + HELP_MESSAGE(); + } + + @values = @valid_values if(is_in_list("ALL",@values)); + + return @values; +} + +sub sha256 { + my $result; + if($Digest::SHA::VERSION || $Digest::SHA::PurePerl::VERSION) { + open(FILE, $_[0]) or die "Can't open '$_[0]': $!"; + binmode(FILE); + $result = $MOD_SHA->new(256)->addfile(*FILE)->hexdigest; + close(FILE); + } else { + # Use OpenSSL command if Perl Digest::SHA modules not available + $result = `"$openssl" dgst -r -sha256 "$_[0]"`; + $result =~ s/^([0-9a-f]{64}) .+/$1/is; + } + return $result; +} + + +sub oldhash { + my $hash = ""; + open(C, "<$_[0]") || return 0; + while() { + chomp; + if($_ =~ /^\#\# SHA256: (.*)/) { + $hash = $1; + last; + } + } + close(C); + return $hash; +} + +if( $opt_p !~ m/:/ ) { + print "Error: Mozilla trust identifier list must include both purposes and levels\n"; + HELP_MESSAGE(); +} + +(my $included_mozilla_trust_purposes_string, my $included_mozilla_trust_levels_string) = split( ':', $opt_p ); +my @included_mozilla_trust_purposes = parse_csv_param( "trust purpose", $included_mozilla_trust_purposes_string, @valid_mozilla_trust_purposes ); +my @included_mozilla_trust_levels = parse_csv_param( "trust level", $included_mozilla_trust_levels_string, @valid_mozilla_trust_levels ); + +my @included_signature_algorithms = parse_csv_param( "signature algorithm", $opt_s, @valid_signature_algorithms ); + +sub should_output_cert(%) { + my %trust_purposes_by_level = @_; + + foreach my $level (@included_mozilla_trust_levels) { + # for each level we want to output, see if any of our desired purposes are + # included + return 1 if( defined( List::Util::first { is_in_list( $_, @included_mozilla_trust_purposes ) } @{$trust_purposes_by_level{$level}} ) ); + } + + return 0; +} + +my $crt = $ARGV[0] || 'ca-bundle.crt'; +(my $txt = $url) =~ s@(.*/|\?.*)@@g; + +my $stdout = $crt eq '-'; +my $resp; +my $fetched; + +my $oldhash = oldhash($crt); + +report "SHA256 of old file: $oldhash"; + +if(!$opt_n) { + report "Downloading $txt ..."; + + # If we have an HTTPS URL then use curl + if($url =~ /^https:\/\//i) { + my $curl = `curl -V`; + if($curl) { + if($curl =~ /^Protocols:.* https( |$)/m) { + report "Get certdata with curl!"; + my $proto = !$opt_k ? "--proto =https" : ""; + my $quiet = $opt_q ? "-s" : ""; + my @out = `curl -Lw %{response_code} $proto $quiet -o "$txt" "$url"`; + if(!$? && @out && $out[0] == 200) { + $fetched = 1; + report "Downloaded $txt"; + } + else { + report "Failed downloading via HTTPS with curl"; + if(-e $txt && !unlink($txt)) { + report "Failed to remove '$txt': $!"; + } + } + } + else { + report "curl lacks https support"; + } + } + else { + report "curl not found"; + } + } + + # If nothing was fetched then use LWP + if(!$fetched) { + if($url =~ /^https:\/\//i) { + report "Falling back to HTTP"; + $url =~ s/^https:\/\//http:\/\//i; + } + if(!$opt_k) { + report "URLs other than HTTPS are disabled by default, to enable use -k"; + exit 1; + } + report "Get certdata with LWP!"; + if(!defined(${LWP::UserAgent::VERSION})) { + report "LWP is not available (LWP::UserAgent not found)"; + exit 1; + } + my $ua = new LWP::UserAgent(agent => "$0/$version"); + $ua->env_proxy(); + $resp = $ua->mirror($url, $txt); + if($resp && $resp->code eq '304') { + report "Not modified"; + exit 0 if -e $crt && !$opt_f; + } + else { + $fetched = 1; + report "Downloaded $txt"; + } + if(!$resp || $resp->code !~ /^(?:200|304)$/) { + report "Unable to download latest data: " + . ($resp? $resp->code . ' - ' . $resp->message : "LWP failed"); + exit 1 if -e $crt || ! -r $txt; + } + } +} + +my $filedate = $resp ? $resp->last_modified : (stat($txt))[9]; +my $datesrc = "as of"; +if(!$filedate) { + # mxr.mozilla.org gave us a time, hg.mozilla.org does not! + $filedate = time(); + $datesrc="downloaded on"; +} + +# get the hash from the download file +my $newhash= sha256($txt); + +if(!$opt_f && $oldhash eq $newhash) { + report "Downloaded file identical to previous run\'s source file. Exiting"; + if($opt_u && -e $txt && !unlink($txt)) { + report "Failed to remove $txt: $!\n"; + } + exit; +} + +report "SHA256 of new file: $newhash"; + +my $currentdate = scalar gmtime($filedate); + +my $format = $opt_t ? "plain text and " : ""; +if($stdout) { + open(CRT, '> -') or die "Couldn't open STDOUT: $!\n"; +} else { + open(CRT,">$crt.~") or die "Couldn't open $crt.~: $!\n"; +} +print CRT <) { + if(/\*\*\*\*\* BEGIN LICENSE BLOCK \*\*\*\*\*/) { + print CRT; + print if($opt_l); + while() { + print CRT; + print if($opt_l); + last if(/\*\*\*\*\* END LICENSE BLOCK \*\*\*\*\*/); + } + next; + } + # The input file format consists of blocks of Mozilla objects. + # The blocks are separated by blank lines but may be related. + elsif(/^\s*$/) { + $main_block = 0; + $trust_block = 0; + next; + } + # Each certificate has a main block. + elsif(/^# Certificate "(.*)"/) { + (!$main_block && !$trust_block) or die "Unexpected certificate block"; + $main_block = 1; + $main_block_name = $1; + # Reset all other certificate variables. + $trust_block = 0; + $trust_block_name = ""; + $valid = 0; + $start_of_cert = 0; + $caname = ""; + $cka_value = ""; + undef @precert; + next; + } + # Each certificate's main block is followed by a trust block. + elsif(/^# Trust for (?:Certificate )?"(.*)"/) { + (!$main_block && !$trust_block) or die "Unexpected trust block"; + $trust_block = 1; + $trust_block_name = $1; + if($main_block_name ne $trust_block_name) { + die "cert name \"$main_block_name\" != trust name \"$trust_block_name\""; + } + next; + } + # Ignore other blocks. + # + # There is a documentation comment block, a BEGINDATA block, and a bunch of + # blocks starting with "# Explicitly Distrust ". + # + # The latter is for certificates that have already been removed and are not + # included. Not all explicitly distrusted certificates are ignored at this + # point, just those without an actual certificate. + elsif(!$main_block && !$trust_block) { + next; + } + elsif(/^#/) { + # The commented lines in a main block are plaintext metadata that describes + # the certificate. Issuer, Subject, Fingerprint, etc. + if($main_block) { + push @precert, $_ if not /^#$/; + if(/^# Not Valid After : (.*)/) { + my $stamp = $1; + use Time::Piece; + # Not Valid After : Thu Sep 30 14:01:15 2021 + my $t = Time::Piece->strptime($stamp, "%a %b %d %H:%M:%S %Y"); + my $delta = ($t->epoch - time()); # negative means no longer valid + if($delta < 0) { + $skipnum++; + report "Skipping: $main_block_name is not valid anymore" if($opt_v); + $valid = 0; + } + else { + $valid = 1; + } + } + } + next; + } + elsif(!$valid) { + next; + } + + chomp; + + if($main_block) { + if(/^CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE/) { + !$start_of_cert or die "Duplicate CKO_CERTIFICATE object"; + $start_of_cert = 1; + next; + } + elsif(!$start_of_cert) { + next; + } + elsif(/^CKA_LABEL UTF8 \"(.*)\"/) { + ($caname eq "") or die "Duplicate CKA_LABEL attribute"; + $caname = $1; + if($caname ne $main_block_name) { + die "caname \"$caname\" != cert name \"$main_block_name\""; + } + next; + } + elsif(/^CKA_VALUE MULTILINE_OCTAL/) { + ($cka_value eq "") or die "Duplicate CKA_VALUE attribute"; + while() { + last if(/^END/); + chomp; + my @octets = split(/\\/); + shift @octets; + for(@octets) { + $cka_value .= chr(oct); + } + } + next; + } + else { + next; + } + } + + if(!$trust_block || !$start_of_cert || $caname eq "" || $cka_value eq "") { + die "Certificate extraction failed"; + } + + my %trust_purposes_by_level; + + if(/^CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST/) { + # now scan the trust part to determine how we should trust this cert + while() { + if(/^\s*$/) { + $trust_block = 0; + last; + } + if(/^CKA_TRUST_([A-Z_]+)\s+CK_TRUST\s+CKT_NSS_([A-Z_]+)\s*$/) { + if(!is_in_list($1,@valid_mozilla_trust_purposes)) { + report "Warning: Unrecognized trust purpose for cert: $caname. Trust purpose: $1. Trust Level: $2"; + } elsif(!is_in_list($2,@valid_mozilla_trust_levels)) { + report "Warning: Unrecognized trust level for cert: $caname. Trust purpose: $1. Trust Level: $2"; + } else { + push @{$trust_purposes_by_level{$2}}, $1; + } + } + } + + # Sanity check that an explicitly distrusted certificate only has trust + # purposes with a trust level of NOT_TRUSTED. + # + # Certificate objects that are explicitly distrusted are in a certificate + # block that starts # Certificate "Explicitly Distrust(ed) ", + # where "Explicitly Distrust(ed) " was prepended to the original cert name. + if($caname =~ /distrust/i || + $main_block_name =~ /distrust/i || + $trust_block_name =~ /distrust/i) { + my @levels = keys %trust_purposes_by_level; + if(scalar(@levels) != 1 || $levels[0] ne "NOT_TRUSTED") { + die "\"$caname\" must have all trust purposes at level NOT_TRUSTED."; + } + } + + if(!should_output_cert(%trust_purposes_by_level)) { + $skipnum ++; + report "Skipping: $caname lacks acceptable trust level" if($opt_v); + } else { + my $encoded = MIME::Base64::encode_base64($cka_value, ''); + $encoded =~ s/(.{1,${opt_w}})/$1\n/g; + my $pem = "-----BEGIN CERTIFICATE-----\n" + . $encoded + . "-----END CERTIFICATE-----\n"; + print CRT "\n$caname\n"; + my $maxStringLength = length(decode('UTF-8', $caname, Encode::FB_CROAK | Encode::LEAVE_SRC)); + print CRT ("=" x $maxStringLength . "\n"); + if($opt_t) { + foreach my $key (sort keys %trust_purposes_by_level) { + my $string = $key . ": " . join(", ", @{$trust_purposes_by_level{$key}}); + print CRT $string . "\n"; + } + } + if($opt_m) { + print CRT for @precert; + } + if(!$opt_t) { + print CRT $pem; + } else { + my $pipe = ""; + foreach my $hash (@included_signature_algorithms) { + $pipe = "|$openssl x509 -" . $hash . " -fingerprint -noout -inform PEM"; + if(!$stdout) { + $pipe .= " >> $crt.~"; + close(CRT) or die "Couldn't close $crt.~: $!"; + } + open(TMP, $pipe) or die "Couldn't open openssl pipe: $!"; + print TMP $pem; + close(TMP) or die "Couldn't close openssl pipe: $!"; + if(!$stdout) { + open(CRT, ">>$crt.~") or die "Couldn't open $crt.~: $!"; + } + } + $pipe = "|$openssl x509 -text -inform PEM"; + if(!$stdout) { + $pipe .= " >> $crt.~"; + close(CRT) or die "Couldn't close $crt.~: $!"; + } + open(TMP, $pipe) or die "Couldn't open openssl pipe: $!"; + print TMP $pem; + close(TMP) or die "Couldn't close openssl pipe: $!"; + if(!$stdout) { + open(CRT, ">>$crt.~") or die "Couldn't open $crt.~: $!"; + } + } + report "Processed: $caname" if($opt_v); + $certnum++; + } + } +} +close(TXT) or die "Couldn't close $txt: $!\n"; +close(CRT) or die "Couldn't close $crt.~: $!\n"; +unless($stdout) { + if($opt_b && -e $crt) { + my $bk = 1; + while(-e "$crt.~${bk}~") { + $bk++; + } + rename $crt, "$crt.~${bk}~" or die "Failed to create backup $crt.~$bk}~: $!\n"; + } elsif( -e $crt ) { + unlink( $crt ) or die "Failed to remove $crt: $!\n"; + } + rename "$crt.~", $crt or die "Failed to rename $crt.~ to $crt: $!\n"; +} +if($opt_u && -e $txt && !unlink($txt)) { + report "Failed to remove $txt: $!\n"; +} +report "Done ($certnum CA certs processed, $skipnum skipped)."; diff --git a/main.cpp b/main.cpp index f6de8cf..48df540 100644 --- a/main.cpp +++ b/main.cpp @@ -3,6 +3,7 @@ #include "histogram.h" #include "text.h" #include "svg.h" +#include using namespace std; struct Input { @@ -25,6 +26,7 @@ Input input_data(istream& in, bool prompt) { cin >> inp.numbers[i]; } + if (prompt) { cerr << "Enter bin count: "; } @@ -33,6 +35,7 @@ Input input_data(istream& in, bool prompt) { } int main() { + curl_global_init(CURL_GLOBAL_ALL); auto in = input_data(cin, true); auto bins = make_histogram(in.numbers, in.bin_count); show_histogram_svg(bins);

Qd&gUDM=^ELH2opu>a)*kq%`bO?q6L*##^-DH-s)+(I+0x5>+E<7qjJ>iAkuZ zDm@z%=YnIz$)YeG?*-leL-CNS*QrP&SN*U`-XsOx9ZFDoDAWH!I@9%k4cYQdPOARi zUnV`9e^)Gd$&bsH&w^CFsmeUcl-qfllnJIk1pW~HOF8(E2agYboJ7?$^`+^eDdqU3 zjzA5H_Zewfy;h2F_^yJ=7p|3a4Q)idN?FR5R}{JL-wq!CwpGR zU<8NLe2}tc0VNpGH0a{?G7N}ne?fdsj?By1u~<9q>?4$oRO;s!<_`G0HhM8X(gU}16AsB}Y z!?MHIh_mMFh~ebP%bIYs;b2f@trZm8Lq$Q;D6Z_tINsMBjJbXrgBgtJ*=#=@kMmQ@ z(5p{MQm$I4@{j4TT+h)Mj45^4Pv=~I>Iy862pFDq z(?OPXgZ*^M(ZsNdH<*S)y`oywsi0a@60v2vPHb5dG>P>-e08FNuu{jDbF|?$_Kp)}<`M}G+>r~^ zHTvM3=qP|`F`pe^@&@f_X01c37MkEwlErncYUFb$|IXYeY#pVphrGJ`iq*Hh_1NEx z+ZC~9`0BIS2^+GHY(|9uHG^FTcg;}FFDD^V)IK0ZZuiH-{>{z#J%D*H^Xe;ujnf5X zUVR0tYS{7JKq|EQf4~E>K8o0b)O*q{5mrdgQ1?e)p&t>A0#wU{KKL&kd_YgC@%mRA zJ}vI%TELs_X}IsLGyd*ou2U&6GR##)!UzQ;UOC6qo~n0}c?Wt9&Jo)sApyiDNAWZI zrr6MEqffG*JEtfKCinQUt9P-LodySSlK(XOj}C+BU}$dXLespSQ#}2j&cj9lxTD}q z`C&t5Ws_m8T>0J=gu^77yb%eoW3qC&kFZSdUKZoG5;qR*YQO{bs-4Kxy5c7Nz|u^Q z3nmn2P#KL3t*z|z;%ox&|Dr>Z@EO(cxgOB0fKqY3e>o4k*rTtqm!)3h%7saGB+4vw za^lpTk>K3}!e!#2QQB}~q})EqdPI_oso#bfqr}#XC5`$SC@O*Y{5aCuq8}V~@uPpV zETy)T%8k~fb~HklD0y6Fp~N{jDe<%NIqju^K4~UbKFuGUO>UCs7NGZoq0*@zR-p_f zx|ts7TDh5?PXoD`p0z-3;KW4Hc1cLi4bIMf`S__@$iCV*2THT8@zKIWh}Bb~ z^bKv3pSmPCtebjygfun1EWdAdXl;AT6NQ(vLu;^!-mt(vG1FK$fQ`F?T;bFO`U$?$hsiKRX1pvSgTcez zu5>*=OR}gLD9zF6OzD@r2*HHIGV|}a9 zZGU3!qI_mpl?jyFFzmH!cHmUGSsls_EL0f++e+Wk8J#UJw$)}2R=u+FV(nGgKA6H@ zzn=7F^uYEui{5r)ve=Pc*u|5?tx5%@X_5nN@=3rQux;gY9KcrG-5T) z(Q2BFw`~llY&Lh>h{3O(%W12-iM5NhzgyUFk39|3ZA4{hErq2EQ@QeY)SXkoJC9l060EYs-GQXOdXp5X7GI*0)$%Ulz4>Wj!(VgkqzT&$(PId}JnF>i z2FaUs#6P*xP~o;glz0aZj5Ty=+oAr9V&a8cB*h>3h7lyDWsKlnKl!J#U2p6%@6wK` zsVi}gb`CZi+F!R$M(wW$cez`N6PgNV@CX2k)Vcd-mlwT2m%Fx&y<+cG4NbEfg0Ewu zdfU7km54h_k5DfSLE)r#EL^jp!c=Mrej8W_B&t50k{alqHph1YxhjR8p}O&m{a9an8>W+9?#&#-jb+vRB$-#GI_z4+w ztpA-1H&=jzaR8_jml`H{U zFu1ud+xdnjA^37XrbD~GPExyA-vj_Zs6D!7PA)oqZmxXFY(#qV!)QT|N~^v{bH;JJ z=7dg*eOF#PJ(i17w$@hAeFcAY_0@sNP^dw<=#;sX%wBQ5N<|Boa6f#L_GVVAFln%D z#acV_Ak8k9V2-0eU7FG*(WCE+@$7)pjj{eN)R!-5 zlYh&0T4`5XE~?_YRQ$o6Ebw8PHFc{PjT89KTvS*gb-ZV0IN?1@*Xu3BJDYhJlI(nb z76Y76w84Zs`xsF?rm~?B%_)vEuazHIG!5N-^FNyHdi^cI0x{pQyh)j(g6_BS(cM=# z?v+gN=?4ADHe3?q*I$weF3U9O@7ZJc-f&6q)FYP!zg~0V5c3suOO+4yl3kgD?m>z| z5ON(9O|Dd2rnqu>JU=`U%#|K&FKseRCYKlkeOm1jb@t3AIg-vVldfw!j}m1ZlGyK&Q4Am(ZtVDDr!EtUgNQHa>V7tK$?DpXVc5JmV<%H0A3_9~7S?Bt8r;W{oF< zEk`Pe$qyOy-UPDh{yu4|N>sguw%XQV!e^<ZqApcrRcxjeW>WVP z1jS88I7M1-NYH&72@q9w|A^njeLB0EpfC4zuW@T;m5Jm=)NX@{mYR>y;E`;+WUye+ z%#iybD4uxu3a#)9=YZ`Kfg;Dhz2Y_-VAkFC^~2sLu``!dB$a1h^SpaEI$r7Jvt@mL z?C_>7v8F8{PA*inh~?Twb6~v4nq+kzN#b?NQML0GxPVzsiV1OJ!Q^K;Ue}v{8|3aW z#IuKg-nD(-p!;@)scSoS?nkrQlQq!2FV*;fPqq0Cim6(~2+-BA9hYmB;)!L~P(`A8 zwfdauWxT+Cc(bEdra4&F_KxS2>tHZ_ZRI9N@Awp~Tmek8k6@Emt^rP(q^AKv@l%S8 ztwu!lGMqiZ@kIBy{`K16-Ll-8y3FbJ;tIZU<(0Y`4ix`~4}etVJf(^4o#Zc#2O)oD z(sVPO5iI&5NjVIbH>-HN;z9%oe#ywV%&L`OYU@ko=fosQt9!tr;+~PIa!V~yUFa`W zWY@j(X%gG*NcF|*tV?qdIU!Bv!v2vy?f6_vQR&@R0W&^V{fQROAwC{kUT&+Tk_|_^ zeuCnksN=_1XFJnM#{gXYqge1s<2nft;-J6=sZRw!y?2ImT%UIaLh4vp)#;!v^om! zf^2jSLa~?cT=@>ImcfZTPJ>thtiSmb4%fjG-_^mFFD>e3^uD!C;}We_k#dyUwT3rq z$pfRH_!Lt4Tfz{= zmyOK>sT6K169}FcALh; zZ9+u{HwH7l9Qzto1PN1 zjV)fhTm|m1EpiG?)@f4tLJePVmn%HTNMe5f5xwz6>Epw|YVgBy7-o9aop}G`_lh%B zeotuogcoUZqO2oYcYpJP6z9F(`00@if3{(O=f*aL(P9~g#qfqt#4Vb0k%Fzc=oVW% zz{xuZ*aA5{LN>y|SBu2HTq9@5&63`)u>amGy!de%#4_t;-IFEBS`DMs;a@ zo$#>b!u9!MQFu(Zw>&rR50!DGogS0y@;q*Xdw>e`Ye;1)6-7%le|WkVwd1&>2^mwP z0)y#&bkAj}FAXi-Ox9tT;X(3OdeE(jQ9|K8(;bIT_j4sbF4?6APcJRjeyy7v3iI*D zhq{K26Vb@KZTser~h^8;~5G<%*X* zPI>XXq4ne23di&w<=M9#5-chp+e_ZpU9=aDdiBB#M&*{`nK#i8;8$f=&*M{}HbAd!& zrc>Sg_3QnQfG)K1WB}1G#NP&zTa9$;7eHQzj3(@FB}+!^B`*S+Wa<73XpF_Sa`x$_ znogYqMEeDg*^wu27biV=e z*6U6-+e+3|?Kq3w6@=m?9|`mki#-PDy%w7RI?Gz61^GUMUI20)TO-#3uk8?^DVAd? z&{LM~>p))e?}2<4wgb(y*xmL_@*W7ZkL4W){B&a4y2oUI`s~P8FWlF_Py2EldG|H+&wfcE*&@5G`BNb`$q@Gce2*uq(r3+ zpxES6^%e_!lm~;EdC;A)TN56vVKT#?HgQXWG3+el!altc2vnYCqj9eHf%2S%w3z@& zKe*8@Z)S-p!;^YFAD?ZUh&oI>usxy@s2*q#Y`rCCJ|v3JqSZ#h!&O=b4~2t$P>hgiRP732;{rD4@#@2RFlZe| z1{HVO_<{4Q{6O*kR@(4i2_$+S{}MoR47wfY69!3rsMpesWn8Bk^mZU$3e$nyw!I`E zlW}W|A%3Ws(Fn}h8^z89HR?UIiXhbm(D}UZV!}%c-725>#jsDmqZo`M*c(o$nE&EihB&#s03o6{qr86u zH=EpqJ{@?7&24_6Ve%th0ZnL61ryq~IOl`;*P=c>9bNsssDj~GMtbUz_UFLDK6<2ojDYEnO2+47B5Hnjo!`6; z1JxtwvW--We4Z_stk`I2^^R>az=is(M$R1Tqbvg9d#WtDcNsrbTQJu^)6n*|u^|s? z<0}r_d@nY^b3}y>Z^hKYkm)TYy~YGu5{M%s1b2{kxSb$6f0+q-Ke9 z15ib_j~&&>PvtDy{2#W#v~oXbP#=)o<)u>(0r>`d3FuOb-3FAgSY4exRvXdJ2R-Wl zl%>;?rppZa-zxMfkZ;p5G{v{Q&iOm6Jk9;#{7c!QjlysXRMmI4<7a{ zqNN6ka$%u=nU0oJ&~qmBafKOAAUA2dF_->`*{g&)2#R;9%bgys6;y&zp8aHUd4x9Vz;EuWT#e;|8rm<0&B zu2NS^cRp?@{H(!lIeg>0Ej4d7T^|6Jf5XNsvj4xt+y_ubbvU}OQ}z;;LF{JD;!*i< z8B}aV61g`S#%tB061U+yJ4l&rSQigew&l0Mq8o_hDGU+uy>PFob{heg4tDdD3V0RoIseZJLA+b}sU~6=bD|=Ne3g@9xBQF6$&t`F`ljaH ztmVc72fj&k0F0SavWXqYMvKL>;R-Ta86so(`Lv+2qxLyA4_A?1|HQue{Jd%_9jhnU znWrtonh18OVf}b!!2H@w!|u5|Fk=c&3@>Q#&i2wDvJ=3cOPbZF7_D~PtNFruelmq{ zR~N3}62S#@D1T`<)w*!?MNG^bWs8coDi! zNYOVqYWk#CsAKC|p4$CX%M9I(=oanMYy)oVoRydGfvm^$N;_7}o>pU##V5Auh44&> z>Fy)GPJY7uQf|`Qx^XCHo6fzxCztz`suntqO_^}Lw6b3&I2pRAtRWdT-Ns4Ui$28D z6R&`vdm9Hp{l*N6&*_o~e@SzvlHX2Q2{KA>nISQFM2^H3OFI+xsyYG^dz>%Omh8w3 zegvHuLZ>bi>nEwS*yUARuk@-y_rxlmjLYsZCR2v90(#B=54I(?Y=6?{P* zSAH!fU9v2F`j~G+B+1a!?*i@R?Xa$rxE+QK|G8?RPjJ{WZG2$1*+4tJjDE@`5pSOR zR;8+(XKln#f-4|ue;F6<8fs294VuD>CDnx#N0MvMK;MBZg6!1ADVh*;oxMXlEAJvG zMiyDro`$nCKR3Ktm6Rne+tJX{DLivEY96asdOu8kz&V29j-zm^QdJhya8O5G5Je`)r(g*s<5BcimfsPgW{PneKudW=iZr?=zWF@m#D**ZFPVhT9kC6+$MS$Ga= zVvUflN$Cbm*h$aH0t>HvqQHUTH;8j+c?@BbeZZ&z1?NhCf_aA1 zSWxB;GxHPbppwT?ZwedMW+#BIY{Mp)(57n!&F3PQE&Y}&UrlgIo6sJF&+#+`T?_HZzr8 z5-Pw-n76tjtrdv;4axHLkrrB8Ov=iwc&rYm-rA@US#-M%;mpTLziG$xA5!|ul)nCe z3c62K_<0`AvfMz6k}>dwq2^VZNmZAz){Nbh{lMYH)?zE*;>z}IPCw_k@wZg`=C;O z(o-fYvle@zV%v$0Pca0dl)_*>j+iv)mgRkVv4Y`cvt+CwSWVmW+ zXDID#Pn)!Fz{G-@ZuLNKnky%fA|8$!J3BJbiL(TZt1ZOu6CTL8RfY&U`<_=puhnEoJdyn<2YJVfaLc zSkV2jH7-8ajf@CeGMwwrc%wyEVA*JV_y0=QrOnNAG!y@T_(@&Irf?we2M_|TZ5 zHfcnAOx}udc6~F!(o^VD{ayW>G`3~qCUQmecB#8{Go)S3wh)6K-oMa&HN$vnhJRBX zZd`+lHn?bA<=<(}h!c{+Jtx)9w(h)?JRwL(^CNWfL!G6txXS}JprOJ(bjVw@Pyst1 zUEYZ%iRK`F?D&?rGxsGG)eh8VCR?LJe|q_$KP&6{Q;cYJ*S!i#FS?O-3m0sq~p+*ikyS;IiS-ltOv;XE4KoPzmZP;8px##e*=PEcT;FRb0;Tc_5c_Yz1;T$NtDoT+Z6D}@ zF7X(PjAXur9S5|?pcz1)HfS+Ww?TIUX{Dr7zXftB$m>9tTG+>tjC{hNdx7Q|Q~~NV zXg5fpFBo(V&@6)@An)&2fP8d+0OWF=UjeyP@QcKqb%bKM*o{?QWKU+R)|M-9jr?$@x7Of_m zy~4OZ#F}RGy$-&4h+zt`iFkhyZX~1asyr=K%oyU=^-Jv%0yd>w=oTW-Fn)m z8iKp_3GQm!QrK_YVUyPP?7AYI4?52JR64keM}Ff11&tg1MjtP8cn~*>lrJ4OI@7Z& zz{|%?!!FjT6wvm{annWtjspDianp!Db#xe=KMO|xW@@EjK@NC=lx3V18a}7 z&gAoQAI!{o{)ne_#9M>%4I?c2wQc75wFNSG+jPD5Zdp^=qd|J=lobty!}ii@n1W@wAq-fGyg;G8&@|X&VzEJ4WJk1^j4bYX0=m@_~3986;UD*uH`Xs5c(Up_3qcJ%H!x3xXy&^_~qVj_? zN{_*iXqWG^{&-uy7EW06S+?mj?NRr*4&`szmJLp0_5H*@;R8fxjKwB#`-BIBu80)9 z2U8@*n51-c#iiM3#`yNAb<)T^T_Gj@8e&t5(=w4+Xe{-2K9gcRc7LfbX>S3Ul7(lZ zMIvCrfewwUmJT68;dLR5{YbolAISD-?)dhG$J(PgliDZzN~TZHj*Dkj42oz`$W(}Y zMvv~&an1IIPXg*29;cR4f4TDoe!I3EaYa*jx86E2-r@(WnYU-Tb1N-j1}{&S)(Ty0{zcMxp8xCH3Z!s(|AZ!w@GUbT`FIg5R`P~9esA}Nm=3g4+n{8;X>)^8u#`Uh!!kF|dLsLOY$tR<;6zp@G_ zOAp<5gZ9&BZGnxar&kyxGIPE`y10sfOQ&9|hSeJk8tCjJzxIKq=HCzDok7VS)0>gN zF`YeJ4|obRmY1#hk8->&({+KSPvYF-Q_AyhR~G(WbwMtQQ}MV=$_p>&qBF;0-HS%R zAktr%e&JpCaupW6uQ|y%xF@f~6{vrx-4l@ zywI=R&~mZQ!SbqY%?fuG9ZG-jF{h9c7tJaFPi@LpUbx&+6*X#nxfI@2W~+?R@x;OY zbUa<0q?7~2R(|x4qqWbJB6Zi%zrk?>MZwGsN|ArbO?bsl7k@ip%7;e~%UCk*2~nWU z%Es+6h2p4<1s$tI9vYV6a3v~{$pn(Lcm{=VcT~G!yKq|AjMxFh8A=J;(TY4uiQKDH zc+p;8L@QDXkX`p$?3smuv4w~B5%ZetSRW{bqbdd8W z*;f({R5z8c4%`rs!7!3)QO<1VHf^I-`h)3s_R>P%OSl1xcVT4!ERh^$Rn5o9UIoZx z^wf5=!P~8JdyZ8#iWe1arI@NoRNSPl3-NL(*1S6pBPwh9>}9M^azY|j9*N)X{wzJ?( zXr)^*+35UMT9@>!ndw*0VlE{-04+O937$KKls+EA)G#~O`4Sg)v!qY~qfxJce4IgU z$T(#hMjtyC`>pn|-z0wxeElJIa0|@*n%PA zvGa}&qjQ?F<%ji(E2Q_J!zNDs`#kge zoV14~-q=CXV4+lDMQ$yFiQXPvJ5J2>_6hw~Lbm0Rd8^t>&tm_iy|h3nG8hgf8$LGo zCtr3I)#%^JdN4X+!@MzBN|IL+tU?A0pCe^^=~@e@{GJbEEq;I`JS9iKZslvNtKv0AVN=J)hH)rld`r{UT2fJx{&1Ln&NEf zuRNYE)hUt@(qY!4*+>h=(j~)AawnOMZd^g3u?`n=P4VavVod(8PJ3Yv|34|W(xJVK zftXUIVhe*DYC}V z7!;=iW?QxtK3e&AASKzy5-Z(;cc?Zwpgr}mT+2GloMua3Qkh-PH1=0U^SZitFewI) zQsPCgfkLvSA1Xdqdc^h6V}&l$=6FriG!~+pp~BlI{QUA`>3y#BV$gj!Bay)}Fd5MV z)XR2e45g51+({m>zExf!&XeQ!V8V0A6jHg-&5)4XKywYRkS-w;7=yvR5PW(Z^1n=E zC9j}p)xc#4m+qv!U$EFUK+eOG?pY%#(kYS77Z|h;3-d|Cc<%)gk29V65|9(n#}MOTmjO8` zeKU}g(!!o1b<(M8fu>RB4tR5l?&A=|7!8DcI=yjvWQt9h($6zpzi+@)OyO;9Ew2~C zdkjae7S;+|78`;*w<4{#d)~{UCP~mO!aWy#UzpL>OJ=oj;ysQNe|q`bD_460p~5(U zic1m%3oax+j7}S?dt-i&dyLI3BWy5o8bJ-hf|gIH;i#y`5I}T&2g8&j*FEv>Dx3t< zAXp?x_29|Yu+f0ohOH_l;Roro73o}B8x4@1beu4#; z&|5U3vlF;MEEVDmCoUD1wASXdU2jtIXz6@PmnUh&20dDSR(o_7T9&u^h0xyWa?v*& zw$=>QA<4QYw(M|j+`oIMPybHd+RxrOfkJc9@(#*Fh@Oy3*$Hssp2$sjW*#C4_YlQ% zxrL)hj6Fu-=88zs$xoTJj^UgyH7i=EW6`{$;U}$tI&n+CtPhm;|JBNa8O6Qt?&GJW z-}WqeeCY$i2#f#JvEY2+CKtzs6BlYAEVxy{Bar!VOj0AAwOeUDGCz_Nt%}Z*r)(A3 zY`DjCsZIr=jw-7Ds(K%p@5`FHt#&e;y?FS7;utbj9tRob8a6?Z*#X5xxZy5qW9iA< zgqPIM%GjjXJ;!RXp7p)=%C!kDQiA1R0 z)~bpXg(>bNbVa&w48AcQNSECA11@9sPSgLAxeyIY*deIq3A%qpd7YMU6hoNAcuA%H zS0CXeL?MHFQrR>0W=~zzL7u|Vp2l2~?w3TO!%bWYK0@Fmhh@PY6_>30Cnb!;@?t}e z(K(G44VKz}M?z=tAyjHrT7rs%%`&Vgj#_OGm@svOPL5RduMq~XL$`9Q)@)TtJpW-% zQcUX@=@g<8pXpss@ktXt;q=hCBQ_E4kl0i=tx!XDW?CjF+Ee!nlq{~wJql_MKaubc zbuPX}lFAKM+|_V~VD`z1_h8S*DcV0r~3v1<+}>jT z!gs^DK%VYDfLi&VPL=rU`)4VT@1K=Gx3VMBsRx04*E|K}yXHlpKU?fx?4;WadOy%# z47wC3;qQ*vNq#`S*-kob_)dzbrG6)Uj_>MDx=bGmyQaGuWPV58B_qP?M6R~PU9@H2eat&+6kp+ zzN|o@(keyNPu9wZwRn=%eSURy?~IJUK~a981*qyJP{D6tk29!qWg!Xzh!q`P(q+6fJ=ufqO@0=#hF;x1M{L z5Q{4$gkIvi?GVhsHt)`CVf0%^TKu4+^aRs|iGlu=U>QRqFuCg!MDor%Z8qh*6p=<; z-|P$P0K6KZvpl@8!jC9yIVocG54)3C!Grg_ive+gYAevWw&Nub0ZQDp_&(8Hq{bp-sF(Om=@*&)7csT{Ttmk*2$gRXL5o?%?gw%~+iTSZcR!FH z$7I0_x>5AMwKY>d)6H#jzpoFJNw4#yy5MWL6s`PW%2u zN!IE!Vi!t5_iVMW>~55zu4T4f7SBKlD7La46h#Dbu+CxYn#SJ~e78qtZM(8THI>h4 z`X^0tQ;doRS-VN@{(6(#i8GQ1a}5vd)EP;iIV0)E8A<-$G7$lTEox1ew(&b&19Xah8k`)iNEP99kbwT)G{2ij)dh@6OadIr~FkX|nCGt?$~ zmWg+sXA=P#tWn&l#BR-yH>0AEutF*FK#FubaKkNK!tU5o_0J>6bEObQN}Z1$3Ni1w z@ty}oNb7MDf7%$rYYe4b0ptkpE+9vE>wz5MJr8t(rPJ{1cAZY?9(fz%kcMfJ_y_3+ zI-L~h)Hq_MS`O(V%`~V8)M3!$)i9AzZns>1_sikrsRiPocBl&?8n}_4uv)0a!4cR?;qr zXWD(>GGq1(s`lDtH)^4uY@ZjfR+XQO$0x40Ga83wE))pnlID0(tgKD>BxB+SAZq2n z(nY&GGYvVNShr*qfCCoJI6$|_bH`y~cEjZyUP~1aA61sxF&>DR47&}U zU!1bBy`^6cgECu9tudY7uN`Gc%}7gsULJ}=l7du>6DDic3IfT zK-~uE;!rf`V?f`u72gB&5exe|kjpE71k`L{+FvfOd;n;nh2_ZiN!vHNE;tFI3;LlJ zJ9D^xOT0){jVD1W=$4Em7u}G8qH3QyqtUO$MvwdqA}mpWkyKiC7#*QWO-Vk(+BYLK z+kz=aq35<}R+GJqY;SqAfQ#NK6fW8*j6O3T!{#q%qx__?x#+Wvxv6s-^9N(2SqV3` zM@_Jz@SuiA<~DfMPY&J{qC*pJKx=HF-IQoxran>FYp+qL(S$>tjWjrvHVrNj`&~)K zB}SwQ2X>MBmww&Z1e zQO|5pjEhRr=AGQv{Xo#O+=3qKe4wKhR={Zj|z>oxp&Xs_D@#nygzAVaz2 zn})*{8;>wrq(i%-SC2DOm;@-_=0{0_ukf-MEm}^bu2Khbhjw-zBt!MuRM^|fOr&c_ z)YPY#O^_?2_!jT|uzXW9=T!AGS~NE<_=udhBNts~<(Fs9r_A~~ZqJqP?4gNCW|2}K z)r^#{n`C7s%1j7~38vbWOk2WV0~yv@k+49@*DY_RUvAPheyguLVcE7lS#{00BUv{= zQ9R)=S|XglpxZ3~SMCYZL=BREuFB83f_;)SYncS_9FT9HE}-N1pH6*^zwUJ7mq0H5 z+XA%6*2oZ$4yJTU{7=0+##{=JJLeELKt@*5sm}trBaSZs{gD6Z)OYyn$KpdkV!9_s zTdcd4aLW9C|A9vLl2Cf0>lq$Tjw-ak3N7A712U_vw=K6iuk52*P&@LagW|VITgedX z8OYv!JYU$&6k|NOb7WRKTYMl`Fm~r96)xsT6a!tgBu8cU-gKZ|!G3x$eM{vr0x91a z2fj?}%I_t1XDu~*i!gGVGOJB=*wUlb6f6*Gv^Q%Hh7*ms9xN=V*44&e@6gR2QvIV= zr*V8COk)Y6mxKs0Sa1sQ$Pf|ki{ZM}vLQk|T*1983jI475B9ibKdEp4MTimG4rwrf zW9N}zp`lFY+g3ytF&NHVs|`l+71kAoM%1F@z|)>Qy2@*SEnd%PelH_O!bDrZ-$K6` z-|Qn9Qa|Nym-^x$b;_h8XxTX6>3tHSZubNxpMfG z;(@~WO1GtpSrIwLV(@z0gy&+uv-6yp1gArd!FYjNBtDmtojGw0kTWdwrrX1WAe~|H zQy^zpJY7xqMm1d@?e%oO26A@BOF$Qp0+T?jNM~of4anIUCj+^lX_${I6{InLtL#r7 zDjP5n9Y4J>_CHfNXz*RmBbAZjK2ESW0+$PkW178ic^>4$!c)|&2Q>ZiWcwA*D9# z4s&Rf@q$jQRhQhj4zcJi;aINCBiE2iDp)TmSOIj)~ zkRhJvkzV<^g%xP`Mk#A_b>~Y^l*WZAE1f4ml6cHh+E5<0<502&P*hsHyjg?13vEo@ z4d^%U$~!DQ4`lxC;A#Q3M@KQR9CfvUeUe}XcK(|VEU9-G*ktq$^>+Vj!-vDRY4CN< z7|XzQ_0bCk?#6z8|H*+HPmALQ1l_wxkrZg9~TZ-M|N@$9}RcOh%sKZBm$sNhp?hja^j}7_p1l4 zv|>u*x-2^_a50cyP~}P5FQ{c8zo4!ID%rXJ4A2)1lEVjw_N_wVdV6_a1Cp3LZC7ij zK}70%9g@3w9nS%I9fvU(UWcB|c*$p1p$$M@@^O^v*YE{Ee$kc~{#%qpZ9rbikAb`t z8J4N1MrJ1XYzkQtd^Vk@;iZAt@cBS-IsMc>Y`Gh)r2|I{fUTWkl%#|11Nng%*MKH; zp4ez91t)^!Yu;>^5-z-Uw;`C(OI3r-lcp?M(oC8D*|6IDQvBIapC>=XE?|#7Icyi41vl`fzsn5_|DN-` z*yz$Q%=o@t8PMUwB4T$c!IS%9E@)6ZTB)1`$m7dxG#|8F?>{$jpuKdt&LnuI3_(_I zbQiiC-Ku%-*o|&XrmLzApx7{ShufOs)&6a-Ie!T3Qze7nP@`WZ05-L58ceb-2ifv@ zPQ~Lf1#=c1YMZoC9qV#Z!=;$nvHC4sgi`soOzHk?bU^UqQC-^(%#TGMy>RTRCNBFO zt54uB`gEHL`wbqps@Z~0jDzy~;5O2lkty|&q^;P8OM^aG$|)K^CVQPyDt^U2ivOdU z4xlSv?t@{!q`ysO~w1Zdg ztes)k)qSb_Wp#)3M^%Gr`j>0@88~DR)9dYY`H$8C+dyqIIzBe%4G;DS#l!gZHUi&V z!B5z5^(@%H5=UUlp+_Ont#kARHS&qJ$uDGoQuPgbU*a3I&i^Y$SgbIwQhF#+E1p6( z$tQQiHtgpJSH#}9IR%mz;aavPnjHFRu4S;$3p=|JX3chU>RNM2iLRtJtGVNlNg`|B z(rt&)yqeoV^E$|rmJPYlcR5pB>Nv)L-#!Y(ZuM4P3>WJvFEIp~8&x0QJgD0@+qDUw z-P`2m6~AwNvK8APP!umJ#K0*Z%v7>CE9a7iqdV?p-0VbR^#2g|CE!sMY1lnZfPi3v zf})}h0tyO900k74NP;suK~z9IFyxp(B$vrd07V4D;W$Ro^>)2?U2kz!yp=-*Jdndx zSXTj0FdldTqHF&5`>N{e?&--8_xbyb9sea!&zWS=_tLo}5d}fyAyp4ju@&F7! zf{B~w;D_>2PmFkrIDFrkB8Zk&9%ZT+%k~!K}OlHr&mlB9k zZh$%tm_pR~yVma-tw~%(okMW$a%#zp0uXJ^y`*rziK@}#ZhZF%kH+LN#M4-YwEa_D z(so8z&Gx5zp)=5qI(s3t8Z3)@p)-*XXX*0F)(en&_4tFPb}vQyg^%mPrED?MUG@0m zQMlCO51QRkmeq2&lx5W)Io`osTDAKFyJ(C;?O}#B6E4NL4lXrE^f6rOb#Z#xI?A}y za8>crmkbhUu`{d+xRgb=5H2;V^f6rYC^y5R&&ntUtz1zlrI*^(oYPBi9nGP9j;qS$ zv*@VQ?9(rB&EdNNm<8&=&mg$egP)7xQsG?zm&*AcaH$-1MK`XtjUNivWt^5gxKvv1 zf=lK12e_1k24|Yso`y@wY6V;)r*;GA!t5rY(uLAf-pVt8cl%aHFic% z#VeP1He#N#MB8IaIhu%X8cT~zAl!^-cWhEeMpzPR2E3Y%L2r(|AsSy=N-9Rvttup5 z3Yd?Ub7}Nogm^DP4Eavr2?JiG$m4-v!%J*2L`Qmh@EBe{E|^RYclrdCO`u-!h<^>J zV?gp`I1#g&?sCW6)R;p#U}>HwuFK(~$6;!-MWqYx!tW`Z8P*nDhw@=NoBx z)J|gpV(x7S7CY6_ceU_qG0*%d&z1ZOY}_A<*A(KkpgGtuGaFwh#Wy&xCPz;jy@e*D z`If~b(!_NPO58$y(l+KM7Cgj(F5o*W`IoxEW+Z=~E7%8y9PPfdY)kgO`~~<)A!$Jc%;pN(FA$4A@Lb}(#Xd82(-kx8ls_xFFI>DH8&+GeVRj8# zXDV-~1ny$F>NNZa#lOS)Z(7z(7L{uw`NWtSo?qFhvP5?5aAvFwH}>m>-O@Q6UlcP$ z;gg=213Escg2{J!WH1gECAPYgN+B~#=} zV1h^iH&)cA;28kkdgi3)420uNS@R~Kjobcr++RfK1r1e2M~_&s9td6sBNDZ~ZU9_rRULihc+LxIFmZe^vA-Tkbf=L- z@8@|W@dA$|@HoY{Ol>0iJdY+`;L${Edk!|}9Ek8#8?F>JY5pFy&Wwtqvx1H1XQNKx ztG`&|>&LtcjUHm<=oHOR`3{7JX~!-22d%vpS8T6BohwhbF&^9QoaB#2(Gp_RL@k$d z`U*?L&2WkImJ~0(lGl&tG&haK%lN4|Tz)HAXfOc|2q(yV-)&EKMUSEZnU?BGHVhE5 zg;#F%5;i>zj0v&bEl!9bJf09!#L+(2r`4w1<8qBqrmx#xr%@i>+Dy3<9V-b_bXso^CSgV>$i zxilUcN|UnTM%RrK&FtbKdIn70cdUwqA}f_~Gh-81E?A0WqGzX(_`L!8cZI}B$sjMC z1ej|ylSnPy;igw;#MTpPg{D0zuAjG3rJuB-H-f&F`=ya^;nN}LwaypUEOGq>uIuK1T)LNaAPPFI}YxgOU*1s#c}Ezu?%ZnFma8VQ|4D2 z#!-8#-aw+s6Fa@6%6eyen#^Y{!1$`7S3vbJf!IXqM3dW{*lB9tNmDy`NTiD~I#8M- z@;3FS9ds2>sHNq?=EjJeyFK%e5-UoO$>1;!2+J1_4xT&**?EC3LA;&Xw5BIqsznP+#Q09Ob0i@>EA)a2g4epkb#UJG({vva?p*4NDUnXjs>!N)*fnMyaX zRW@o39c3%$?_}r7`DD-0k=xL`e{?ji=xS%}3v}XD9=_41-PfbQ)YsVa68uS1%)g+Q z#;Sj8^1LiJb6M`3UwyGt(VJ4v@$wiZ+^A|1_ZBK_bpy(WWq2GGe-|}AKNFD$8yD^% z7AoX|t7&9zycaCOuRI#5l3zBUS=kFWf{x9-cTn(&g*zzl_>i0!l3hYh!%2T(ub2shr+ha)&B*o^f>8^XullZ|SY z`#hv*h35VSd)T@%kV_2yIR`7UI%A>>x8}ktH|wsYp=M0OJU$r&EQB6rf3H3qzj+Hq zg!jjwri}yP#$!diOcHOr7jD*^+&RtJv180D%RP`Y`pPy{U7m#?cf4^1(8xMjOujq5azt6gvX=kNC&0!i*ns!IT$BzFgL{nuI>!tHLuMvf%sZCZY|mu=2(F zDlKH1X~;OW9Gq^*jQidIMaZ}1OP#8zGxJtRiUMQDIHa>6k&h)z$}49zD#Nq%nWEs_ z-=4(3=?Ac|J85BO&2IoB-uMlPs_`E*cVyN$;$!9T#4pvV&R@m97V4MyA7a9@Yw-_O zsXf1CB8C{x-pO?i(>YI(6dPWnu^Y?_5?r}Zz6Hb+dsOkc@ba>rdz^|Rcjp@!vC&3h zqa)C(WJA?dyMLSFaam z&8IGJ`(JQLPRSU9G%2|VpcE-N3EpW_k~Qy04!)5M0DhE5zxDSn@!?GRHTT!KB$rp` z;EHc${DA%Px^MrQyc*tZQ4ELzsXnbdo%Z8ue%iO4zUKSC=*rVRs+^f%BbgZ{ znI_=v-$Sucbcsf4dSTeAiFWm*B3QC{`@#4Cuw7y_14=l5PS`&PTS3(K)=7dClA2TX z`D%1ir#4m5Q=c{TbzY_G3{K$v@#P0PbrHRBH_|gSQzKY>Z7_yz^5;H-C+pfg=XNpJ z$a^G8`)3Sw)x7e^TL-H@JxlM*P}9F05!1?&0R4MqAZ3J~h?tOAv|zvRy?8MA#bdAmQPIy=*Jpl<)SjXyOyA0bKj zG$j=9KkOO;7tJVp*_DlJe|Gi3bpX5aa6OJ))wrq@+y$3P!NYK= z6ubtPO2HbqR0_7krDE&a#@y`%m%2-v->JLj!KG4A43|p5WpJq!{1q;hf)#M76wrLS zN`VhLq*BlmF7?)E8C)|VVf7(aS|gER{SH4B$2gcmD&9)CZbTaKVN&tiW&5G96!&0g z-v=zead3UXuB+ktl3lOCrE?CK%G*}BzT&&>J3tlKH3qI+)U^!j8n~z*&9MFfmkRj} zas45{+9iVL|{ePLAZc=V0Rvv`1DD zlQu*`J+wa#iRL6P5yJN&--`8aI?QRmWBdo-Xs)@fJ|B5zI5BnxKHK(79Fz7k#SfScp7@quIwFn}ihViJdo>NK0X|_eL)Wbqi=Tg0xeh+=p3Qmb*LPbq} zvG5RB7M6yqxm?}Znu(IRD=B77iI@h}o+m+jtKZ2!1}?Q`pVn-XX`aCvsaA@Xme-XO z)s~i5O$mgm%A@5)6@i+fl4+4>pej~b9H|Y|;b+8hz=B0prFBz_rbSW$tENOtY6caS zR996ED6t&B3a8hWMtBVoTv}mBN{IbZ&y`!a8ZKR~$ z1YQxTI=S~{F{^w^RduaISyo$J8HiO)tE!$}1!Q#U-tGrVW3`mWsV4ERq}4`>N+~gg z^^w}T^6IKcsTG|X2~M?2m6sGTrlP#EJZeR2i>m722-rEVh?GU0xvY&s8pMqR ziX$aOvAReAWl~rgsVJIBNr+Zg2P%qcr$lg#M(U!4Ae`L0q9PWkEU&VE2#4=kX|Z*c z)z!#zsm(^1^+mNR*yNCqccez=y^!;+fK}C1mqlu;10}UHYmk2y65UQOF20*OKq6Pi zRPIs-QdVAz@%KxBdK3uRb)C8-ttvNWEy66XDyfK-BFOTp!1%ne0Z6iF3aT_jfLalS5J?V!;+fFS6K!X@tVXM+AuSws zeNja@N>nvNsS+XBs_JMUQdtw7X?a?uqA1dV;A*PNt2oUu=s^u?D^iUzcI4WYs3#E9 z`mkzHvs6g>!L1)RUeLIT(g3BRG{Pz$a5bKmQ8>!i6sSuSZ3IiFvS>zmWvr4k(qwch zX-ic}buHqF25KX9k=lAHwDM@3fsib`#R-)vjiH@ED+9bc0WBu5rf6nGby2BlHz%lu zFEBp=jrs`R5mo4d$Mkk36zcQO7mCJUTT{4P`^+wa~KB ze@YhVUQvBfc?A`LhoFI~X=DARF1NNiN-ZBX1D4KKU~KNVVBx4>ZaADj=Jfmkcd%60 z)VT(xPc1K*YGNyiAq%Kd)wO|0RjE`jofRZCT5VAWRasOulN6^)_mJGuAu!1^1z1!J zaYGoU)0wn;D!(zd4 zr=aX8s&!-+pvuLfRvomE5;eA9-1t0WRH;mw<~z_oGJ`v;{&h1ei>oW@PSl2Jb@3%d z6{xC(bQP}$5&Gb|^i(vi=>gpD)c%>&)J39&(;|_YLiF49u$`32mOd8U?x4td(18M= zCMm6$48>NoR*+JUI?_kPm9DU+G8!x08?d^jH8_I%}dl5bA>YpMN zm6Swk_L@VKd_{%mBz3WA471aL}c?5$wM9x+3&-T%-Wd9E#P;Qy_Kc$@5scj2W zUae`KQ-_egq_xcc7ix74jI!eL((+byQdFv{d#zI>p1euh!f*t!sy`n-arPd3SvhGb z_xR~$q)nPXWg94tnWkxNDQYw1f1(xESJq8QpAp?u{rOfz<%Vo$HMT4)K^Q!poIXOu zE2>eGB^Y+MhFF3jJ35Q9qF6;5`+-qZZ|s^59>&Nms+2G)$}!L08ekNLQc*<&^Amdy z)S1b>B!uQlTac)p;n`bl$GDA30Hd(N8q5Gy@5OclytEe6Nv*}J(rr!Ea3TxK%L?nJ z#?W||PER9U%00nK@hG8H)h`LGMAveOqzE6~2_}wPEJI>o${NGkLQE6tG!<5tl|j8) z&H9sYXH(efI1CBxTY3&Pwlw#*cT|ZQ3Y$^kpCXk^MI%sU+P1yNWk23&9fztP&wLb8 zgNQ=BL`|%uElA4x|3p+~GChvjdro*3p}eZB+GJ#J6;^fdf7*D971OMPdbYztNT0Mi zg{OH9HDjMvQZjsvR@bBtSCBQWN5<-=rVo@2f>!CMnk8$6Lfd8(O&z9>p0G5}Rfq{r zbT?42^ms}x&x@s%DWRwhfy82^n5s~d{&)y`*~;xID^fErBHXrwP=2S7GKEBV#oV zPcKYL)SskKvM@iD&In{PLWkT6dyYcnZYRAB>I`)+mL)+=sI7pO*Xa>tYs@x))xFIUw|_MVwiycbo`D}#h_di zgK|*}%0)3K7sa4l6oYaNf@c-Zp}j0?NLPHr0RKne|45v9IDIMv7|{ z)`2d^ITMMx0_P~WPsjNz+_cj4T%70Oybxz0&Jvtca8AQnjk6Btbexytyb@;v&V@J= zIIqX~7o4}^yc6d=IDbaCbkMqHr4`CW(orq~C>Kdbxkx(7Mbc3&l8$l(#6{9kek2{` z>L)Iej`AbvC>Kdbxkx(7HBwxp70NFtuCTbqiff#>CW`AKaZMIisko+!t3q5g;tFA< z@GPwOorALt1TqPd`wZuCaL>V6jr(;tr{l!Fg4UHd8*nbfS%Gs8FiqfokMlY3sAN8X z-%gy9JK=j3IBVh88NZA1zYOPZI9G!EHqQ5OZov5=&W~_z#`zh}uW&Zu{2u2|ICtUv z4QDe>KjLbK^D2b104E*v-i|6|<)TtnE<~(dRLaVaN?Ez6l$DE0S-Aq@qEc3VRLaWL zPh3>W%8yD}xu}$ti%MC!Mv99{S@}^ZD_2-tRLaVaN?Ez6l$DE0S-B>Qi%MDfQ7J1| zg}A7cm0wg`GsHDZTyw-VPh3}v>soOw64y=Qx=mbv71zDu`kS~O64ztmS}d+-#Pz(m zUKZCbh|S5RDGag7z%IB`uB*G1x*EUr>vYY!u`qB&8)1zQjA2d2YXo%Q^$i^t{d#Fn*^O<5RVEn2 z>P1~U4!l1A);n~?`B?6ljqQYWj9?6lUJa&$w9D_Chn90RT$ODHx6Nc0Pmp0AN?`&V zCVGtn=r^oNoPJ*s1VF(wJXn5odx`5r!I-%A4FH4#%_vy2Ksgew&w4*SzJstj2jGRH zgJoD}>NHcM>-Rl~E6Ka-M>Ei|8_Az77{ls$3_v(K;`IC8!j;PF*q5(e-%(h71ryNu zdbKY=I3NbF{)H>$aO>j4wobx&T`-2V8SiG%u^&#q?*v>at_yE^reHr|eIXdb8r>5h z99cO1zM;4h>wvGmz9LIlVZj*Im829nNNM~&d=QC`6Ypp@K3iDx1!JUf%ux#08UOq~ zQh3tiPiA+>?kp^NPmGSvBKe~Il@I;%`{?yd(x{_;e<*){VNDTCK+EtP9S#-0-&agm zoZFg8-#kEAv}pky2S{A|={}X(F~9G(wn{fX&N=#uF2d>}7?ZCKq)Ir*7>5jzLJ+MN zMh$tetFW>K6VNHF?oAxaqW4++zR9?fY3T&Fia^-(ury(SpLsy`MW98}5uzB}lObH>Gw|8}sjW(mef z<0kEcw~WBLMYBG;ZS0|k24F#>yy3uFk!tb7{l`G8h1Fea&aXY9(e41 z4<9b9_JT32$y9Z5P{s56C@GY$Ep0A+{|I4~3C6H$C=wh2oPOVXbjA7U`q|F~gjFvX z!}?n1vho*W&o}?-@4|LBPHZ%f(anC&X5Oj$fSEzFG??7eB+T4@<+N3_QV~(Z?G#2aRH+b`x^3-VblHI3!umik zhBZXj3rd9FSBopMV+HHZnR=A4P85t`oud+J9nGw@ppcGDKKqB0juzHL!5G#I?bC-@ z^aXZeUA3+Is6N7)Ef~XEqkX6V{Jy7fCCz;2+-V#83X5z!I{I3M^?>%F?#J(2PFI{) z;4`4d2wE1(4U^wjh+n9N_`dno4-694FM=_wv$PLsyWe*vu5_$; z{n4R=g*9FXTtWMMre7!%jeWK!Wc1*hM)9x~n+u8t4S9(szf z_6Wwr6(^Gl$Ei5|z7w?!_kU~GIj0Kidcl~uj?_LQnKc$yD$;8Yo3&%4u=)tb#C4(e z$z_%{d95M0ep#O@tRle})~5Xd$8j1?Wpz_rKR)*Uai}7Ph~>2F215w8#kl?P1uu;iyKY-Hg^T^eaH3U5dZ={XyzsagXG_T62_~T1 zv7c$ki{l)ee&0-7NzSYG`}Ym!2y2gE4C^i3ik{1?0IqaQdGn(E&K1^L!I-?CL0QEy z4yWJuGsJZ;TvzVAVCgtvjTH>V<;?pKSKdb*xa7a%B=5O;tT&!RHa+zxC;4ZOmyk~v zjLAi<_L;z}2YO)+53VtPY#Kj7STh8ZoSx%3Jyh@Z$2q!pX6Xb;&m)vE9OvQm`$$8m z-FV`(KJ(6#kQWQaq~~Vc%g{`j-xu?%kgGfWF=C>y?i7q+-K`~dKC`X^D+{hEO+(7h z7uMedV_03uoWyYfPT2Fv3-y)Ry+*!#fv^r0jA8Ak>*VlIAZ@`hs3)rIZgg`)(g-$#}|9dq6<`&)^G+$b26o|ko8rNG*`xc-kD zek&E$a={qZA%i(^E5aVQrtWUIUQ_id_=!&z`l9SIZ z7uM&3F{}^ue8MHnx))c{x*4a2CR`${j|F2`&kX?x$26RNUlvN1RP2!#gQrXr)+>Su za7rNK-o(LkG@O3leYjGQ_Wx(i{uRPnFBrr6oA#+>7U>?9*O*6!KU^uSM+9S1xJbud zXZX3r96hzmGl{M=A7u8NIApSoMN2tg!Z}Vb*E5(s9p2l}$Cm zI!7>uwX281U5bBd4wim@U!MQ&rNa8JU<_-G_NjHTR;_CLYpt-}7mQ)OO+#=TbvW&@ z=h%PVUs)%tb%HUhwz?ulU95h-9y_DL>L?h)`kAHxal~-?eY&%^uAXqqt1)5i5sYD7 zrJJsL7whgW?RwV>>uSLm)};d}Cbg2l@1u1gq=)e@k6%4qSknb#SfjMh3}7+0Oab7S z{?fG{&k$BfFov~~Iwu@6ar%AVAug&Z?T)Yd_e^2ED;UEXt*x)im_;K{I=U{|IQTMQ zg#}|+F`cN(fkg_T@NM8aEBA*-FBjJ3f-$T&j;FBkd>g0VN8@s09XROG<7Nr#ZNV7U z+U~@G)riyY8;2{1)}|YddgBUVeIOXa8rKaV9J6uyebmSjtL)>)ADJzz3j||WcWR$2 znKc4es>_`YFMsk%VcjPf!}|S5fN;#g>5glTu=eRm2*McF?OLDb!q@K`iR4jSKbC&G zd9JYT5sYCC)cSlCvn~ULige@oGsp9%y5Po~gnHQ=A$NBurY<)A=~&;k5G=T99~lp0J7qW8%73m*9M6X_LjuJf>>yd|^E(7{i*UWw^k_ zDtm6fOBM+08o?OWre1*KScubZH#VO?bKXK>Z5E7SwbQNf)yz7I0>E+ngdT5SEv!z0 zF{~opCd7fooE21;wCdCmi$=zUHAOInRj1418fI~84_C#gcaOYASThAwWEW zBeRC#N@9Nb<#UGID6D@A#;_J?pT96mnJx7j*0+K&tb85LZOl3wS30gc{PeGH6V{o6F|0D}b33qhT@GBH zefRCcst}A}(T+}Z+=0{YJBHm@sr1$Du{(s-EEvN&LWgrFvrHRRcG4r=?-W*V!5G#@ zeN^y&b+N(+9=PJK!rCer!+Ki#+~s05H-7u&UBY@nFoty~H7+>r#%W8VL(Y!}+%2pg zf-$UF+UFi-Wm5n+zILeJ$ng=u;f5&Opl=V~B9{6`*UBd{%7}m_=mDhvJIu%!HHzpp? zZ}o%1x>7KP)lrxGKbW-zS32H*cJ<(Y2y1`A7}j##Q$GZ(ts4hTZoc^;VXYF3VFfce zaO+`a<={#wynoS>#SaT>j9?6_T}Q=wgjrO-h;`31;}$<6tWJV4to}zU7WE5$A3bHD zfDc;r%&td;HCQl)b+R5aKE|y5RS?#ImmVJZn6O3(#;`W(mY;eq)mIX6e8bbd9v9Xp zf-$Ufbns6wi<)N2*Dc%H?e_$`@Xi+Aol)zbp0EPiBI?%@ARJHPR4W#U_2a6c=RYZN z4HArD9jfD6%q(p%Szle${LD1z%F#YgF-teH*1z&Q?s-aBLj_}4C%`VDV!}0(7yDa!WtnM!>Xb#AIH-;?U{;>EB;vaw6LOrF{}r5PM=}c4Y*RkQ%~&h z`!m9NOfZIZV0(aYJd4xsdk86{>V9`o&;HK}tGi$ftJgr{Sk@ApV6huE+rM}HcZsl$ z5sYDdysrX2$E@Buu3I)`-T9obXmu?e&sm1`vyT0F`1*aX;|ij+&)miLJuj?1f-$VG zwLZVVtgvR?S2{KRg0OZ7#;_*p*k5GUC@A6>itDQ_>t7Vs#eyN0bIyuZ_4s{JFsQnZ z?DyvI7r6}Z!&;jI{5Jsw{>_)LcT>XCOsQF5f>H@PQUL0c4OXa;@U@E z7S<<%F)V7$>39Vvo>DlS47TXEyGut^%f}S!S!Hl&#YI4b&g;t zE@$3{ao(wPs4Xk%IP`~CCGW#@C3}rSz7kh}t*=&%uwIjpPZ5mC#WvlsEM*n}N##$% zaAK*jz7vdL9i+oq#w-)p59ikIyG&Sz3C6HK)%jY^EGm6U;g`cMnz&q8+XQ1+&-4Qb z#|oT&AJX;!st0kf!WO6B_YqxjRxDcZ(CfnLCm6%(sx8kqm^BKb zpqAwAqRRPi2md~Hjt=8$j8 zQ2Ko7g*7*>mXHetW72b-_IZn0)kqIT{>tCK&3sE(HwnhD4(bIEj<<38eb+)<2f&qa z@|M1D3+ph!7}nR?mUxF*)Wedp^!xAqN4z7f9fC2eXS)D|<6WG7-vV~y4UNAqeED5r zy(AdJy0WhVu3^?axRNG}Iw+A?Bdqy?F|6sjl;304qmUtWR#Qrz82X;Dt`Ll2T{!?C z9BXm-tD$#ov{8P7{hv7$G)CfpMbR= zTeu>LL>!y2i}{e5O#g)1F_fx-9R z7uIOO7}i*w=6?a}_t72z)cicT>5QxXC9Da8F{~a(QrLL!1E=5j4VwKva21!Y-SdI4 zjuwnz6=_&o>$j zN@4d;-yQvtunrQ8VT~ab$MGMWejn{@v8>?M_A(oV_0wMviO);XW>e5T~KgT z{>Q?4M=*x9GYcRbpWyWSe#e#KsyTmpr%#0SyI>6K+ui`-*o@Qfo5pU-di>Y!g`0)- zlVA+%i0%rwg<1FE3iYtw`~A1Gw+O4ZU<~Uv-HL8yR@;u2H4?6oxjnwxDy+K&V_5w< z1BByKoNA>m{kr7&np-{<)*!(c)~UMH`ixl*;Yu=`QZfAY&xDmP7{eN*l zxxv0;zhf48EZ2cC#>M)cSv@rCwP~*{_}-3dsPblvi?xGU!!_%Y!1Yh;uvx>DH)C9^ zADE@9pSAGK3%>rrX6e8f<6`~DtVueq*`3zKezaLR1KFQ3F4j-XIzzM0I_jf=KRH-R z9E@?XerA?d0;~C$4QK!CU@1jpjEnUPvvl`nJvXB3#$OyP6&hn)tewm<_3P8M1@G^4 zu#`$M#>LvjtV407W9;o8`*%55N~IX%V(kXju3v@6oc-f&2TQ3GV_d9Xnbn>m!ZBp( zHE;dOEc!LN4PCM4JWfBmF592~S$oLGM=cEe&quFUT){@OKAGDI#NBtp760#5LxwP4E0yQrLJHg@oOgak|?> zvKjn7Q_4qWZ`<{UBQB-BjB&-)%&dcPrQ_aCk6h7gvj!>cWsHkO5Wi1%rPdq!zB$42 zQ9Dmf#%a`Bicd(T9GRDQC_ulc=m}ae*GI(T$gQc{WF)mgcX7$so4SRm(i5)tCJ3_;wDK(kRBbSeeW+J<%gi4(gZbU@6^T zjEmKtS>1G8p^ra%xjnPUW2m+_7~^7fU{*l0?t10u4?5U!4OSY(7#C|_W@&@TD!pLZ z+50+JN~0L#Vs&)otJ5C`tnTPwDUD)`i`9u)D%W@$_Tg{xJ2_ZNqZs32(NjUcuZPap zRe$`{b3X@5X%u5zEL#1d)-@3^^ZT2-XE|6(qZs32WizXfjw@?z*UMogFNtQH*i1_GgxER;*C(m1FmJu#`qI#>F~-S*EqcxTa~z-```&lLt9iN;eqeii>v5vfKHm{__2{ZVr~x4aT@w^u-dt&(yEe zn!Y>rU6ErI@=$*%$KM~|>s$19CujEfauR*7bfe{u0g0S8NI6k}Yh9?Uvcv#yBt|E-6E zr8J5$E*7m5^ZQh;Eo;l|GcG>T!BQH<7#FLji}mq-HUI7DU@47ajEmKaStE1`pE!H_ zg`}Djbe<8b(D*B$Wy;Pdz6EvG>S1U*3rx|ZSSXd zEZzTT2TMtbF)mggW_8v1D*mef^ga%j3XL%?R$peBni5)n=~aE1MZwhTW|A>3)-lXF zK*zPS!?`=FZ%YKV}*5rW--Ra>c^~OG;3(!xV8Q4e4U`Q zmoY9@e`Xm=Z%xDI8T}nBrM--Cu?8^9*Z`v*Uvb<32TN%$WAJqX+ODWRLdiOgSwStt z8y9_X5BaELW-s-BAY+WgdS-9fpL{SwQHI@-1`OnEG{cBgcKC~?!2^P3kg(1soB#1e z`5e_Q*@t$FG>5|Yjo}Y(<As59Jdx%@TZ-&)FWI9Uh;@JU%aZe6IHR z^zg*q+2h00m#!2JcVQ|cl_fPZO&&~|Gd(#SWYj_Ob%`q+3ZeSQurzEnP$KTvXbfpp4e}9v5+r((JeWy5*LQ~+CxtycKG%DE=6k|9)#J0(ldtZcTwLxc<&ejx|8bTa zD(|-%vl{-oOg)%w9&MT8VSQn`BMIj$4~E{@F^7t4vd3qc$7fr>a7+r%_2|!-9?6&& zJU)AjSp=wx{kb;DtV;vQK6k2ahrJbRt}-_qJ`Z}rxxj-N=}MHfAh>Q{n8Zx=KgB-VY?lwb2t!Q${jot4A|$@W`i@dql-l zu|L~6Ih>n4KC?YOyAMoe<*4A;TRGq9pN#2arfP6QVJ7uX#x!~)|C&eg8J=Fa*waF` z_k?qh$ETe~KK05FcI2YgQ#u76%y*uAHF^4iZ#*sA-5!Z8Gn2j|pBztJ{?Mc0t32iI zXtcDP*LpOwyBTUrTKq*YFCl_@d{kg(ZE5AK5IfbJ=n(&;boj;{xGONbZ zM*ZliP2+8nPIIT`V4-Ydkq! zZwIVd3q38;CQsjenkSqko^XO5d*cv~t}gK8^azhsH+yP9wug11$LBXsFVoedEq8fZ z?A4yO zQ-u?0$Dyi7^MJB)>;SeW;y6@E_{ia=8 z5Te?wHwju_NLxJcH_a{n`eiRi+6oe|ZA4+Bu2EZn(`J19U3Rs5U#b9-wit8-KpWEQZU0gb@r8Ka zjk9G0eNMi`c=-eKrM$5xZE)2hE@{8S6bW%{Iw;AfT~YNu2rUOrDRgXZr~{`x&9Tt| zZ#sbOUa1JN-C!;Dvz`(ysTo9?QH$G{!qOh*+|Pojl%(*h!@ZP_;j@gS8{zGVB5!(Lw8NFz7RlCD>znZ}7d{M=WYDCwEAW z+J|j>u+dPx78MIZHo~qqdqcNS?%qwLO#wmv_6Fb_N@*c&{_Snt?R~Qh*R&CZXmTpi zxElWyg}xYI9N0@Btkyva(63{nM2cc1EoeP1i!r4`lKn-5xuO-pER6znQ*(#N;FJ_JSs z9l^FYv@InOT!~d1D!cu-v?+eAb@pZ_CbC+Hk@OxrcNLb^R#!gwyJ7EMEKLQF~3 zoe|{i(EcPpEqxA9^~tiiu8E$ia`G*gpml0oJM%ipdedI+=uuS0e9)Pusxk(O1+PbBT6sWx!0xI0n(Lt zFM)QdgaxPC$#lu^0Nt5O(h)nPR2t+;69ZIM?Vdb|zn9w_Id5W(Qg1O3RD}|}99gIe z97uRXdEY{>NL$=^NYo9MDfP|fcS#8a;_{kOR0GrB2~xugr;i>VIK6nl;PgPy#l`M` zFwAfwRJ-a*Ol_p9+J)g!i<6|9UYo>?pA$gsr1Q6Fm#EQl`X~Rcslje{4$;(+rRwxx z)79xgl0#qN^pf7!=?O`c#EQ#HTu5pZogivO__w1iLSI&1HnXs-dFP zURSh3o%4>ZNoZKAu(=gB^0Fb$x@0%>br|cZEsk|aEx~xpDGp8}NNj0>myPjS2$%LY zl->E#U>sJEicUw*`T-MJ?UriPnthEOAvcxu_#Sn^6t$*#n`_7Rt*yc6t#ZN*H-X3u)uP*IK@QYBeb#dS%L{AtVlZLz|l`l9lRqGE&% zdDUU!!bE6d;c(QnP7#DbHIPT6$ws_e|G3=sP%t%Ihp+78A{sbFkpK?A6+vTULp$Q8 z-mX4HQmDynHCU&+)p(H!S%jz{tw=vnT94L^f{}mgiIna1Xf7zd`Looq7BZk30W#0+ z?Xl}%n`6W~tu8vP5MQEG%IDOb7Iy|Wm4Z5c^aORaDae%m5*j-s-IMW}+QPl1yLLW! z=guS;Plq7_*{(CieM&$}_azZdGgw8W1wdItPhVD>lvj9o1toiN8nCkHC znx{=cE-9)iiBzb0K{QCz!m@?RBlc9Wkpd>oSkmU3si5evT8Y%DNQu@W!F)neTAk7A zW}_}v8=;<%2T;m@)_G0^m|CNa>=bfQ*(@ol;5kksS!GM`zM#~@qh&3UA|mV7<)IsG z=n{l#8t1ymr6#ZvjAQLzb=4))cskYgO8UvhzI~UPar+ln2HlF(m>80hi+LV%2bMYg z@+uRwj#%op7JX7Mm*ELfVd zX?BXd(a^)a&38Ibie15-(W9bkBLGvLQ>rOo7z8H8WK-#mC>6>jclYkKDU!quJB%#M ziIq&P#@v{RIR#cr#Ux2A6_YTOix_!2WsX~Qv6>o83PPCXo-3u?pipWg_++5Yi(M!t z99^wwWLq4WQZ9nxA$4_4L_An>u)U_h%29J4u-Q!#9TR8ds}iSsTH1eD*}HlJc_$CW zq35j4U@Yk_^e%!3Q{1H_JHWa&NHy@@GR>ajj-DM%RbH`Tvdv`1+T@g?p+casankrk zO>Mh?)N-?h?DFO32NaIFWu%3N3LH8;{g9iwe01*6WSIw}HpD%vq-WvKc48dkEQwS% zbm*c#&P}N`m(6aBhuBo*c8xTlDpqN-L_dp4FNvXZPrAeHoEwZ4=ICjh$x;(hTCqGg zRPk$XXKJa<&=bWT5|38RO-ZpKSSZ}4O(=DC}&5J< zTeECSRF79}tg~nw3{nX7wD<OT6cLKI3FG*U87^GuMU!=s+Zcx9M$D27F41Oz9hFIl6>*Hml_V#QAjiZYVyr`Wot zr3h8&uI}YM_w8=caf{?H10sh%oJc4-W-_udU-q9&WC)9TP4mY6%xP0Sil15;Utjxx1BEs~*I zI%j0xJD^S>sCobT%DO2|!IB26JF1dk>KMkG363OA!i&zN3DxQ<*9~nhF~h#Yf?^G> zja1i`qC>>JWQFIaxzwl7O`S+h^fbh&u$1ajHaKdas~kf`MSUe(ly&72Bx||qlBs3K z#9EPkFFA<9y7J2+CNUI&4qEwp3zy_V)&~kXR*DB(MKdd^i!g;mp`=E$P2CbjO9ACc zQyO^l%~7ImAJQ1@A)JMl4xlX% zRNPW%UbMU(v#3t4>PV5QDVTJmwL@$jrAURD&r?=^#a?mtBLx+r7MN;5sWreOj+Ww* zk%cWIXPWnN8`d&9I-V=m0yd>(FDOWo0j8D6n8G765&?J2ZV`~Ks*2bGj=Woe;Ht-( z2Eo^0#?zG$6+^1qb}=e**eMPU(-wDWb(Jg7NEPOIV-d&GLI*;Z3a4HxBV`q}hNec0 z+*H3q^XzEx@IwtG%w3*Fb+l5(pK7U|&g9lh{1Jg}o!tJ6=lK^*tJD=$)?h)Sx302r zj-?V+7$MfHY^B6;%h(E>bOUNipoAv7o#NfweU)>Ozmp1qIiAwG??C0apkY!~U}!VN z6{kZHlJBEnSU1VyNBJw$hA~ zsjNI)ubz%#;RjO2oAssKhN(v>sMwGX)~P1lNd8St3|cL<%!qD!MMM&$$LUV_=iRNIUel3ON6I=OvKe;4z_ zm?+jgw2I!H5t>9$4+T@?QilxG$X1(r& zdn6hL&@J7mN||X{p#9rBLT9VRU`*eZ5~sxnGncG%nvOymv?oo0qG2aRoa*w#(;&B} zqZhN0tnP>uMypeoP3U}^jT`$he9J&Rrw4J!yk|-MZJf73Z54<*)zpuk(}qndz`9Ug zRaTuA$$7$Tm6?%FmtvLw)VmEY=&tdYj-DqejN7fWAob8g+r5qmZB?Rq4To-+)V8EX$#6%`BQ*Vvsd1XuX)#DMS)eDGFx$bY z(sJhvnWvXza1F9L9G5e2NWgIn^thGJ2}2ZYP|on<6=ZUU(go^`y771;&b&9rDYoA+ zOz8?(11Iysq?C7U&ym)^r2~r9W+S$**EI*Y;~cL;5`x}gtiZdISLpXtefS;79y|HC zoIx%my^*+3W8mb2al>-VPySE1dsE>C4dm$ArXQ<;PWrd>+A)JRw-$2K! zmFm;$KLFRPv67Dy)Q6!ApT0TJ-jB^>aMB?-l$Y{RSHjUYy2p8NLxv^eh68hYGH%dt zCyYO#el{>OHI8169GN|Gr1Mi%M0gVCeHuf*`RI^s9p{eLqBp0Pai;Ghsb(X4tplYlDf-;Y4m`FurV3sCkQU%#G}%8{zoUaKaZ(gt`Ue z>w@v+AZ;}yxfk%>o3x!$)d44cSHez#?N2Whr}C#y1f=q(SFMwC4X+jsdcm9Cob~a3 zBJ>KjkH3IVFUtC?0Iqbx)ju+$q#{-t>0dXqvbegU?nFlmtXBi3#i&*~ErjM0(gIW? zo))5;{(}xVEYQ>0fRGZ?w_xo<{ctuOR4?2ZRa2Y|2kD&~V{4+3I{jC>Mo}C~4{z$8 z0ST&uN}7%gE1=&}o~1lkUHv}uT65cmXPepx>ngz**4f&JK7?SiZhN>XudT4o6O3VP z)IRjGyV}8>JnHVhdVV`$eIgjcdPMt>uGp+&GJ719DXhhUF{~-thdwZ)zWYovp#7iP z3#(Ev0sZB;Q?w7s$<68@tUSRO)(Y)IHQCMDS6HhBV^}w7ANoLuo7GWRcL>I?%q!&d z@dm$-K8Ik+y_2wdX%=H#-`b-_)9<4ujE=0DeeWV4b(mJ2xKcy8?gTp1DGny)`X*o(|D^P1KG z*8?NPG|PrLm7c&Hz6Pi>=z+TY4cO$%gLdCAaFg05o+4e?9#&1?w0=jKe1;9xy%YQJg^zG4Pert?1d9tK(aqZ05?%%sro8= zW~ia@{||9328Q~0Is`YwjmyTpQFd#|SPt(5H*OW~oSO=lGsI=j9F8~-HFb|e)9G_r zWtP7mf&bhED&JIjkVa$f${MFG;FhhcgP^K~mCapLSgq}Ec$Dey%?t}^Fof~ZUrcbc3 zq8IFo4}gMc5y8e$zF>TGc209}{zuVs%gP319WjsaR=BaQxgfqPwC;P3 zs^i8p5?yvTPY58Ke(*UX(Q$V$(PiTq@h-c=@e>IX?}!i&4#$5BHT>b5{#sL;*Y^FR zxjDW&*zkIv3kxsKy*RgU(uy+?G_{_#WfM&Jf(c8D#hYQ|7WYHh!Nj;#yMuB3NBXVc zN=l;@Y+fCVkI6>v_o=-s_cfAte$LLEkAm^diyVnm$@Yii%>|9K_X(dgJG<^cz8&6y z@JzPoesK8aXbwk#%-~Ki-UXRDgnZ)2aC~^UamcCR#t~OgRKfUf6jtrct{iglrp(7a zK?v`VaAI_Js4VI-J<=tVG_j-39TCW#L5If<(uqp*R$aGP6%8k+GBwW9aU3Bq^9Ub^g+< zc{d~LMv^4PtcDHjGvrjrHD!LZ`k|bDOIeN^CBMG~hyRu}uYrV1>Y}89vP20wRkd-* zp-90bWB_HknalEqrm?~K&CxUMiV$opY!1ag39b81hlPr;L&elv$$AHA3M#^maC{J9 zw5G&&1si@tMeu3|1}8a7gAFsYt*o1tIvRvTZuX=VEtJGddEIok)uc)~1b@sX9e@^paQBWPp@WLXZH|)<`dXf>U?-c|Zj9>CT5Hyu?^03o z>GuUxpw^+0V^-N_z45ip`Uf?R%s6EmL)0F`CcQKGePVebloOtKG%t ze_@;TlLTW}$7vrJ8(>jCOUHyuPCwo@>&?);on=^~6wFd)J@vYD#GVZ=u+93A@&v}P zuGc=wtfxMhj#-bcIM+7osp`_vURWeMI+R&YJu)3XPPpb(+pIT3qYlElOu=}QKV_hk z$3u19uC>kjIf9`SI{Rv6)>Cgy$NKl8eGOijK6Ju z;(r=5x&}6+M$+)gWuT(ksc$$X`%-20Kt1nkP_0dV`9jxZE0qZ@R&9!fRN%SRJ=s_` z%^fy!@^52dV@@nb*}&?$H=B9z;Gr5%bAW0nbSzYhCO7DC)^+9Mz5c(kncb!w*}{2R z*G&qP4LQ_hLlSN>aI-X)l#g*kU8bvbDf}0t3NOiay%+)P0*>ZI=^%=Vcc5$X>{j5) z38U>&!41;8QxO@*jX1j`*{&))_v9IE`0!vVoZfDM1H&Z`=W;YVZK)B#A^FX54?3u1 zvo(f+xKO;#`bz$^CClMSIJT|bQ;#MH_kX8t9X~rWsO)QPTRXbZ7VPSy5SqiT&K;*L z>i}EUIXk&Oj*bk+R|ex7Lh&_OOG4e0k(ImQtK65V)ot3hY*DD;^=_f&_o4@d*a!}g z72gz$?`hru(Skw_sz&d@AGI z=l!_G*X3^55+1&^{yYsS^Oz0MT zvFofeu6$wU(7QufPkxXWU$=8paKqQZcns!R+uRqLalkWo!`5J9$8!oAyRRxp%vzOQ z0PE-S++FJm8hfomUbAynhvPprjkE2caC}#OqAsH#ac*XAeBa!7T}CK=VP+_v(JLIs zP+&t|d}k>BM_zn;^RnjUc|G0=H+DJatj6wZ&uZ+omI6F0F>5Wya!7vS*u3G}r$13J zye>1g?)jleP}AXvEoZeW;874x0ZjeeY%-eESmL7GNlLn7kYVa>GOUQW#*_7JOFKvf zJTiotT^c&&X1+*D9FFH(dGTc%KFxi;8-8N8mqiN;J!{^{00iSJf(^4_pv|MbY_gV& z>GnL)Hf#yT^LIQy63*P`NrIF#lvA+pD%{weyK8L@MkKLqO@ka3Y|iR}_?mcDe0oMW zK0PxWKaVoBCD^gN-9rgcBF70OOMj&C7C|SLXLvd1hl53Tgua*gydw$PE-^*1VC(XyTyZ>!v>&9)4D4 zY|Zu&oO6t!#$+n7CGsJ$(cOaa!*iB4wRxTfekiJ-ss_5KXcmCxN;0e}h|*CTX|A4( z;pmlFOLDt~UT|ddt=#z1+?^Xk@wZS|p$*%W(BsP>@=&4!G9LuQKtJ5I-(8}dh zD7Laf@j_<|AGawp+B>&-S$>aY?2*XZ#FVTtjomlpCk_oYFE1GW@7nb_#u%rTA^t@; zaeg*yB@1B>k{*h$Le;|P`&E<1VAhjA=EYZ2)%q^?MT#81ayNWhkjO+q)`uEqttKUU z1?1da>qCtlR|i+FB$ydzCk_rauf(u3YvJv{1c#rU89k`^&Ac8c`R?_=Z$c28vaQ&M zO|#$~U)y6xu(8WXc&>xMCKfbyTvtYiJ#LS`m7i#zk5(xsw|RA5yhAu~Ms_$J%FfE( zC#$osd1+pcwV?#&2fB|OgV4|5&@nuVz1ids#@{MPOvE(By5P!OHZw!bZx_TTqT-<> zbqhPeo{iu_I~oJ@tR-i6GZkq~d|imD$+DdFN;g)H=AfwRA`E&~)(59^0wC?Mht{#B z9ru`pku8oZ2taH4(*o3oztTczZB|;qUIsvv4t{qyZ6Nkl;B zL!cuWK^QYsu!lE>MNOo82=q_QY9lN&nl869c} zL}nA2KubQF{iQtwG6M{I2vo@&wL`DpM@AH}qF4KC?IBQ|U;_FX#d__dhCpOe(Q)hH zAI-LhK;}t{Jp{T*!SoP_3@kcsXgKVCdkA!g@&v}@YmoL)Pd4)Ki-`V9+uUdmfsCoT zudrromKp*nvsw+D>?a%Z1VeE-4KXz+B2$cxCE;85Q-dPe_ zOZp2myQ8(t|G$m1j(5-f2a%r7p&|Xq!o@*4$m5g2W=>aDtFQ>A3wV0VBE;QtFSm+Ll!#G}F+=t|!>_}>o9w;G3J=zI(^6Ho9_ z_T4UE4$tDBmccojAG$*}cpr^XNL=X|%kgf7q4a#p=7XT@H6G3M3QH*1uneYg5N4EZ8>{$_M9_aGejeHAf$KmT*9=tSRSa#y@jN^rYV3*- zF|W=~mvdhrVX!1vEW!A%N-U7ch!6(4D+!E;DI+tj3sl{hvJyMSK}c7d*;Sp z2QeJq!`%G%mrZSRUu6qlk4KvZ2OF=OLjlESrAb0CemCt;8;rk7YLUkS<$;cYavy|1 zN|(Va#7M0&tP^pihn5-E>9{IMk;y=dt16sZ;G%9a!y?UBq5Kmr6$)A3DinJ# zu7x;~2ZtEMXU(H6Txp2d_`)3EgN+5-FsxVdN=(`oPQ-SE6Iblc&-px;p5P2$868-* zD3};E1EcGep~SehcqVrp<%}tz=9LE4Svz9uLk*``v3Hsd#?%4SvLGw}_i$GJ4s-kI zrp+qSAJav8lFQovza76(5M8pc*+)7`h~!VxQfjcRB>xZb`vNZI*Ar4ur9s;zDwi#J zJq>D)!o+;IHIg7}Vt_*N}HE{$;fQ~rsv+foq!J=FIZ%e_;!UM z(jE$>Ail-c`K$!`!!V5GXcMSlV*Cya{LYvWPLyV1+NR*% zVB`3;2!aF6%Fe$xt8e}miG=19P690)-x`j8%@~@(IRjO$AikZRBF1-xQNtQzi#ZD_ z82G3(q7GJY?mjJu?=~?k&CTjeGcIaI2-<`>7d*oXCMIP@E3*2;7HehXdT+wXnzsg` z4#i*3>O4@%%U#t6Z+{l|9f3lej&QrERH!8M$zQCJ(6U@zGL4;L#!3Ov`)v{h#pr5%5h6Byso z^bWNibY@ruxSqtWN?b>yZz>TVFOT=qL({OCEcYPIfyOSM{0$lbT$%4NoO@!JEJN&&4&Rq0DPp%tbke+ADV zzK064CDfSF8FJeeR_&LrI8aWiI8a92l+E9nHIGtnN~5WB*`fm9mto&$;l5vH&7)nS zwZgY0g^vat%3hJ#tziDQ(M|=4h*dEB%dCdENPIAHJ+*q_#6PHY4>gYK)y>v7>R>|g zH^T89;r3gC%eDog2f&RkX4lV%*vx^TFUVP+yX$A%3ie$a!qi;Yhw7M*xw37TiRuO? z8i!v|$xyquq0Vpw^OweIDJ9U?aNn&3eSZ%7ISJw6Uxu?z`!eJ&z)S{axm0yB`E_Yu z)_fl-VK9N&p!HeveqqfUFPcYFd26?CX7y`2L@C+sKvqD1Jh) z@t!$IFtiFc{;kS6k&lit-$Jvu5zQX7Ew;lkAC)qFr#jL%3oU43A?uF6olf8;)0FEb z&?HdlaMPoZ_(W<2cuC1oNRaB4s^L;~n+C{Ap0~o4i!;M|99M?Ua5cKq%P)G*BR8)8r!$1?b_%W6=;29!y-+xm$s6S1_@F%{0FsHco8- zIsneEWEF1G+2DRviofCYVNw+RB|T+uDG|rua)=nShf2DbY;=l-6XR0igOIds+|6Q+ zmz2aJb7azr;L4?Bt*RdfN{lQ4gdU)*2Z9aT=WudSiP5XvybNYNp36*HaR3OTaAF#( zr6tew#u?t8p_d=`iorKV(qd?x!d?Sn(B48yI|oWhrWuB`X-T{KgF;Yq8F+U(f{#SMZcJTkRRrH*^Z^8PfZ8 zI5acj_t8WN#r5RSo^$OP(uV{S&~vzl07HkGAsqx3$z}2>*S%-YkOl~VqoZX~*ha_R z3BGv!9ysBZnqdY8{ z1@Zf6f`uTV&R;Lg64rXb7}ljar!=tl`;OMEU*63)I$K!N1w$<7)Jtb(@dHq}23%6_ z*qpY%X6?@y$^jk035BPV56oT9>U8p5q*>%v&XYVohwHrCm|Y&92kE9hQ~+0)pZKqQ z&h&(Qp(mVwd3>@wtm{1?U+!Uj=fRxd!BluKde)HrdDc6{zV8*Ta9Z3G4lSga2Y(JZ z&}(z(TMzmpFrHnjJT16;-kWagUd?;MbWIIL7!8=yP?(LP4yO%j4#kT;?=3fcQWh`_9{PoLf19-PBGK6DhJv1 zkxu@mhW!;z6$pLa(h~}alsm1Su6H`*n9W*sEYG{e3z^c72Tky@zSzt)I?Ad2#^#n zyO4ylx=R9tixo_O1fgX$N?+`W;$E>0R>i{aS8bMQs5UxSx>Ek5mDPVPwU7{Jwd@q6&3i@9A{DGK+-sLqMx z4&Y~m#UpJje@D9avTmuZ{5g`f+rMrd#E(r}j6)2A;-?#3n6E4fhOLP_3{6%Rcido@GXjS90H!(y z;cZ^+t&7s)Uo*^NE1W44ON^AFJifw?n{@gBRv#UTWbF}Sc{wi#=W5O}yx50h7SF`) zdjl-lhKaZ(ib})~G9ZR(v-eC!pxAlvd6wguDNqxhSptcnl)cYGZJolFJDxnr+8;3| z1w7txtv~qQtqC zv5U#Tc-owvZ6r!FkPMLwBx3DuA+H}MF2?J}S%(MdQ?KG~~iC)(;d?4JNM%Le!4`qOR^IopIG3BJ^ z{1P0VtMgXwFPtH`HWO);9`^nDhchA(WS1m|D0mmMxX4JOWX<#o&5~9#qMn|wE5poEnFsC zAbxaz2YT-vRAlB3Z`x@*%ys_xQE9|L-pK6|fHH1<_RW`pV z-Xc87^2gAlqwJ{#HB_~y7H$U*4IASWFZ&_v16=x(Pj0uT7PgQ9#@>8YC@rk>Cjslf zk<~+9v!@oW(L5@IoSUVQQw!{)(68V7F2Bp3S~y+vD5+;C0wbpu*khs8t?y6yp<`-+ z3^4Z8!aLH!I)AbR|556ccjwpGQw#smJj$;M%lE-}lj6;=-me;cuVZTATbhSb&Yq2& zT43LX<`@2)W3-Xxuh#F$_;r^$+IV^yf)5k#zEwcWPZWy$*0uJE#HfOK{a1sZd9jRsD3ou$9`)lgE&%+H((DRMn%L zrR=;pdb|fcie+(majE0Z0&G#km?qgFQOhZp+yN9Son6Bv`s}Kz`aGr6ow_msx;cAu+E%ycNYPQ*)D<*#q#Vo1=NFw5${FiCC&X_b z=b%v`awU|;Stm=IHD>C5csY`I zQLQ9BkK+mpuxwNnZXBA89$?VwJ~l=PCq@!CrAE9*F-(C)2whU_Ew2h- zqY=A`9{$@J%oM9QtwD|xJo|!qo@m3d7*4~Z!~HQf9!QtLX-+F=-}nT>^m7vxg-ru% z!jhx=o+`N}$k=iU+~?VdXSzVY)F`Q&sdt`4yzJKo?cH45s1uu@BX+Wpz-Z5V$c`BL z>otyu4eTjm-NQJ0&jkpJ44(+g40igkWj}xe2I#)05)TTSc{$DR{|p0!NMd)H)DVCZ z^z1jEDIz39-5pl3DFC}@o)@Wywa9Vkd&)f`ksPe!72ton56Z7grVSnClzAVkVphGt zd)oV07jtmw+uVEYec8-?Eq?V-Avvo9ep>Fvk~aU_E*hr*Xk-_Sl>oo7vxfbBlHEn) zkb=hUqLG{CI8ciBHar4kLRaOBfDrECQ$0Vl{>DtyJ!>10AqL2 zZk85S7maSPiWqd}%-_sdJj)S!qqz2Won5ofW2~5uITNRn9_A^5br*f+LNz6 zDYSM>la|e0iR7oy`Ao?PSiF9Jw)^bELA-x#~QRXPcF9&JV+pmM-{} zw3FT1zwIcqxhO-2WEl~27NY%gZ$I{&hLEk}%AUi>cG5LvD9*KhAAFav(+$HPA&4fcbNpXaoG@|E?2?-aPVupfNv@88l7zSF^%=m#JD z{b4`&*c$w*AACc=_gp{t=-!|E!AJN0(+@teSZWWLAccJFA%9t!N>1Io#g-& zrl}{c%6|SpFXG2OsN=7y7}+@As{K@CCs4aX)B(LB`;1y>Xa*w?+&$rg_wq4nESZhvgcrJdt{^$P(9&A38Cu_b+ zz_QPNj8Ck_EfR>mA=W8AvHyItKn9*1JNrD7@#IXZ&+|<@?VK-}21 zP#_+#C>5vxXstj|pmPP94s@|VWk5>>S^zXjpqqd$7wBf741wx^n3|YD0AgDEJX?X} z{{J5UF`w*nV>!)hKN^h1L;pQkq_IDK#1GxX51V29uoc4($DQ~&PX4ecNyUQX z@_8l|mlaN#Qar_jXIXgC^iU*RP!^gpaay!+QmL?&K zG~t@EqA8)M{BLUMl)_N73{H)Y6i>LOut4xA+eu~9rn>kFLZu-WXHlehM%jeoNu^VY zBSI8-QsIQsaPcHM8VN_kGH{lYwnb5RQYcb3HT+HK!GtN-mRMmfxu&#i(zIw<;Y=em zZEC3%rb)%o!l>|KO5x;b;VFd$Wu;R>lctswPbn=c2_Z(}Wi%8iDxMPU<*kT#S>dD! z#RcI>6NNxQq3~K@E09x-X{BW|WJ+6BlZs2rii)RAa;1-*s8b3jOfQ>WIAtp1J*jYF zacMZjG!U*%h!juNzD)^*C#ipW3V%U(>V(jgf-)q66h?Y>&z=dPNMyXo$51#jZHi35 z@TAhhDM(T&B~r5t<)Nr>3KDWcVPS!ljx(l&OAE`Q#g^EV!qO?%3Ymf_#U;#28R$@9 z$jZJll#mIA&V{n+;n4UEFeP58pO6UZuLWuyEfLLwK1aYRN z98>{X0Aj^m1&V=KRjvZng6csVKpR1CJo zv<-9*s0p+kv;*`YXea1l&@RxEpk~lsP#fq4&;iiPphKY7K!-tZfsTOQ0UZT>0O|yN z3i1p<{6VRp!JstIP*6IEN_PXG3{WO$1SlJn3(5mg*=`V205U)kPzk6ML?yhlK;@tc z&;k$-fK`FGQ@RF3rDL_Ade8>YM$l%^7SJ}(J)kDgcF+#cgP@(Dhe5kQPlB33dqHiW z7eEIP&x=|;5`9Q1}GCW0+bEP1?7P*2L(X|AOjQum4He?GeNUJ1JG)p3;H+k zbo|Ca6F_g_|7`ru1pN_s2Yzn_-30mr{(lxU0{AV^=fKwUfl4YPRe0K}mjqcH?Nu%u=?a=5!jdp7EutvKydQziijrMBPrqK%;9nk1yjSgw_ znns5;dP}1t8oi^@QH?&(s8gd)HS(bDwaTAHsTvK|C{3fG8l`J=jz$5EGBnE6XoN=D z8s%z~r_tpa1vM(r$j~UFQHe&S8qL&bmPX|oRcN$8qeU83X%y3_Mx#|4)oN6)(FTn+ zYP4CSEgEgp=pK!lG}^Aw4vikvXs1RGYqU$FCpBu;Xs?el zw=_DU(K{L))#w9_IyL%KBM;g>tNdw{s?lJL(li>XQMyLwXcW*WL!(TMMrf3+QLaXL z8eOhYP@@8k42>chm1tC|(M*kIX;iLJg+>cBTBK2xMlp?QG+L!mtw!}4ZO~|=Mw>O- zqR}>u?$M}8qwN~)(C9&pc53vnM!Ph6Qln;#_G;9o(F+*h4H|9KXtPFJG}@-o zJsLG>v|Xbe8a=4dPK_ScXqQG$YSgUJUX9u`dO@QD8ojL1A&p+s=&(j_X>>%RcQiVx z(FYoJYV@f_?DkpZPb2n$r5$_160tul5qrfFv2QF9d&m+6G-7XA+Of|p5qr)OvHvU) zd(jfHFD(&!)Di_XV((hov5zegd)gAQzbz4a-4e0yEfIU*5|wLIq0s`37HL$aQB0#6 zjaF$?t5Lm18#LOe(PoXdXtYhEdo*g&XuC!`G7Ss;<1oTJHUJ&J80JVVF zdprbs4YVIb!}S?CzK|$Y+YQzzO{1Y2rE7GKMgfg7G|JRyghtsKG_QICxxA^d-fs((mlfAs@)?@#De~J=j6q6iA@VKP7xgy1T zig=4U+kS2Q zzq_+eaY)I+A$VL;rwS>CoW^(SJ5QeKkdlQ%@VKOgf;Yv>e585n&p$b5s6$E?4#DG+ z;@4;A*AG&cZ9UB)B@2h(aY-?M?Q(eRJ55thcSy;?A$VL;+;ouQ<<=6K;^4nlp5c&^ zg+uVTq?o@cUM@n?{P)k_D@}Ju$-*IcTvFU|o8o0E(aastwe3uYlq?*A$0fy@DaFf@ zPxDM?<2z?Lq-5a`JT56NuG)TWy?yfDvu&x7*}^TsHkYf3yxqevr&T}17vTO(*m(+RSwJ+E?{_ki0 z^gM@@EE|HyC3U`#Qhr^zI*@X{LrRtn!Q+z35K{aWXb$FHn3my?l4V2ixTM(Hq(1X>GqSWrRaYmJPwQI7@T7VFn}5FLQiqf*8-m9rbs2c={CaBOn!7KvrE+E25Iim^ z+S_&S&7RYiWjmx~*$_Og9pki@d)fg!%~#glAvyV<%q^+z&b>2VmYL)obD_4cqgR5j@3mTJ8pzK7Qm2?k=UM#Roh_TrG7O>B2|Z_*n+esE z33$GO8_!3|;;H-_0>CL%rxClZN86dmcjG{R>4`6Al#7w>rDLkfX@q+@?pusl;b!&3 zr%H_F0IQ;_d*aKJg;@D>20&F0e9of{q{)x|p^ACpo;}1f4>@w(efFkG;rzkHUAMUl? z!u8@fI)3P8{S=xyA^}@8Sipe3*Xt?$8m9~ zQl`%X5Gud^kw?1ss((eE|dX4SfN}lBKb-Ir9-9=cmLH>aJ&Gnf+g0 z5~$ivIeKM*r+NRc|9rz9y|Q@I$k8j2Z0*#@l%EsLsN>UrX^%{0ZSEYI)=4%o6J__! znzz2b%^sO1G!IA0G>a`8IqFnlIq>@zTkI1+tV3z+L)wfFjU09I!=w4@y3udihqP5& zp6XG4l}I-0kTyRG*ceOqQoQ^qX@2qVGoMsGpyijA){$)M zAMqor(=X9>h+-*Qj~#Hq)pp1tOZ`?oSSKGc?)D}0B&17bPcM_yPYLB#LZ6iDjL`|u zZS$q>eHfdcJxaDvY;k1gq+uwAp;pQ{KNDwSI`LQ2;^fJGl;sf%3@5BJtn$VpD_V$A zZskf7VV?&cs6G%z^L1;P*5K`T!83$&J}@?)`~Co?$OYhmQUqbVc*>S(tn3|1YcVA` z5j?2_r3KjqUtYee$>Asb4e-P*KJ9OQp8Af30|)UU0iNqP=K^yINVqq0jLSU}_I{N9 zyR9z(No1wVNLS0m4l_4`9=7;&JX~DZVgkOm!E>SfT0EL>tov?lb{@0AbA5Nd(e8`* zir~Nk@chym!|L#j8LjFzxP;@0pclaNlr=J8B_!fIW~7Txbm3JmpMo%w&#jwkIP6FC z#5dM`-ytjF89njkxm$KF?=1jdrd4z6e9LtoNMoVB96Z$)pGv>(J&G6Mz$%LeBGT}j zbzV-M`j@}-=Nf#EE`uJ0bDEIv(m+x0&9-=1{Pli)TN4v?%G>=#HxA%$R|4K1p=HJpd4qQXu~r%g7m(qIcIo#q(B;j}uTEM3Q?bo#E2aAVkx%jpI#>%grUxQv3S zj`QNYFXKG=EaRs1(j(qy7_BUc9(B>2xJH8MK$ZRC&X4%R9dBfSLxyNFkRwE*E7xW; zUY&; z2Y_jpZT$xE%dCc`D0KPYR1wH0^j@<@^@%N}hCpl?!UE05^J;-)39#>V<4JU*ajlF2 zbf&df!F^8_r*;Ubl64;7HNp|rYY~BjbIv;$*S@m>FVs~JIHO)j#ndlT8CwF{ryIW~ zeX{gR^Adm%iU5>rK?(d3t!SEh#-TpjeI3J}=&(8Mu+S47F{w-(Vj{dKC(r^m2rAbi z)DoY6*k8X6-0goCBGhVKcmPVv4?}5rGlZIDBu)HdMi0O}qXxwZ$MKyKp|J92+7rrL(etx)8eOC zUUyte8-ywLuSnyq@KoO-;je#9c>HWMQRxY{7K+a-oWQjTGNca0`mv#q!(A0x#eMse z5G{m$hSO>{v9Jy>>Yfp0)nET8!>V+H*L9v({Y`{?ha=Z^A)${Vp?8Q&F&g8zi$GRV zNfAT-K_R*f4K)2*A$KGllEH(zEPoR}hSkH3gaAh3v2^_3!CGpEst2Vo%0RBHB-ZX_ z8I-Ejtg9m+$2d3x@2|TGpI^sa5p(elTy@}YIDjJ^9Z!7&qEV2~GX>8{0@dMJEYL1I zO9bK-GOTNSp0j~ueZuuBO8Gq307*XXvYH_5xC3gcK)(Z$5>DvU1x_x;aqg{&oE$!>jB7v_e z>Cymk--`NXoZ8#>@!p7dGwO<f#OTxj-N8H|`K7vM@IUZ{JK^M+0&rMgie zGOj#z^$FpwebM|6PXl$nC%VJ_G{Sr3MkD7V!JO zyE}D%9C}%x%D=9~z|AU0qm4_u)a@z!VvLs8eXKkp!!u5ZB;GXY_Iw^rycQW=aY8EV zG9&-hHNzblAI<--zkUTi1BA;FR*Usk+)4cU>hmM$T!f*_l0oBr9pgelf8BTpAxPEV zZqEaP;t^an08K94BP7}nwo5Z)dTKNt1)o!>K2NtBPh|Sa48qmSQYDI&OM9Y?Pc#1` zjg?2m4Lcv>QXBCu%p!f6bxVf6u?Lr!h{_GO>EJ>jd6fvS5V3CN5nTxT)*q`dJF3wb z0uxo*X_D?xK+R0`H<*?Qd(n2_o~Q$B20>*eCx65@WL@smJ&!NYi4X#kAIptE@?%*J zBtModK=S+kF_5egSgp?lsShLZ_xWpo#9I2(&yCi#qMBxQw60ZM3VYJYFvWW+q5SYA zBfri6ofaq}#jVr+JDUS-{zox`BtB2{m}(PrQcYO7%fG?$53M<9&;Nw{$!R{eRxm$~ zP$}`R{5eNPW)Va6X(b*ibmg%1@;75xafl z1zgBqb8%5q9e!%KZujSt5~TwT-X$LH+D}}9)GIVgGt#2@e~dp8HHT*48f>N= zZcBTkW4j@06T{Vv&kwD=UzYZ;-GK&Fr5z!B9@&l3YrQbzf;DnZB5#a&c8`Wv^MI1H-)e0xq2DU)~S4c}o{BUWgg$ez1_d7cZ`?SU4xvA6`of5gdh*_c@DuzZ3=>D3c49P+(bQS>?PXW%HKCm&BGCVb&OI zidnqJfoM3xCHLn^l&bA8^JBerPB^lL_^RjS)!h;pnZqx(hy2d(%|BoTE;W-iP)KnKl2YdkpZmEzFVB>rkvqnS)V&&< z5|cZA=#fuf3a*hx0vGP)Fr1Yw=cNmsI5HpP0gdEd{+9LD5Ok2LD$E2 zUt}v!u1)h(}dI*JZZ7$k?FNkQZ@D!3Nz zWJ@O6d!@&=ud8w_cF`Gg_LrQpXvc98+H#lGl4X_E`o@{+g-dRrUSVG6f`)df`wkrE z)i^x_Rje^OZg_G2uN>A2k1akO(&Pn78KL>2+vH9eE#!T(7TX=J~Yky>Xx_2de3Q~_33#ss_;ZJua$IV5~uvadr=*bJj8oDw^ z=8pX`yRk-Q=jKV}np_({Pt-zJULlXI@E>PaRaH^lf4`Eo@iC)RPf~ctPHP2vcMr3N z2g7Pou8F!Y_F*@*4LpAKKVdZA*s;>Wdj1)|=Y!|7?tD2TM~-%IP5>T)UP>u@Dlpo; z(Rm}KjePFG&jRoaXMZ1twY3Oe&e)tBVIv=J;U^59OW6B_VdE|N@?FZTpMd=|@NnIm z#&$2?wMcyd-dzHoDHb2w4e8z}YojZr5eM`NXMtz2Y~6*{EXkKM${F7caA44x9?vFD zB*Wf{Tw`hV#HxI-`LUF(ndZxe{s%*(Dw+U(dpN1m)}~vcmO;XUo839 zHI?a-@6tlP5B}~4&t{JIVC-~}|EuRk0K35RH;YflH)phKQ^PsnYqxlmtnfE~tQs8& zYYq;My9DKcJ#!cqe;K~fE^XzXAwVJUTxq2$cTIdIY@U{1Y?@I7}))Swj`wJG&NBCgJISV)~xd$OniG>{XCXUj}C#PA99r$8H5olKug++7WX#)ZQ1{I~HyTCkFZ-i!Pvsda(^OSneMZ zECB^UxKu0{0HyhdU}Zm81&=VNJOQ)h!Bot{PFPg1A(%$67yvi7*I-&ysK}Rk@e?K4 z^AkoDCNIwwyE~X-YL**wuxEx_MfI+BKyc|_s=mhp24>l*x8C1yJ?8y8UgP&)4)S?^ zil-yCj>Ru)(+BSNg0lH&qU{Jc5$uWS;ui}kay7?V4Qr?ExuCfqsgrP?Kq7zaM3n0S z{;W7wX6)PQ{h9Idi1}14BoJ6EXGg1yL@|~}1{saTm`z{R$DWBu;<3$?OZ;#fe*8lo zYr;l zKyt0OQlQy*&KF2WFf=VxDleC_7XKQa^Vk0hJX{5AT$#p2B6Zg`N)DDTDzP%S*rS#& zVl%|TRM?zYBbOLv`LJ?yIXGcfxY`$6f2J#Kt7>;OlI+V{4cZkMW6-Z ztxOBo#bS|!wO0mfk+?8zd@8TuQcLmi8KJ~J!@PYnq>(hZfnG+>oS1ER>o(9!YcKG6f9RuRSAMkjwQj|D~Dy3_k$Xu+^T1(BaX@<059}xQ^{%y1VRZ{W& z9WU~WSP1foRrqfSv;fZ=1(KDFy&VP_TDLomfkLoZShyO^&W22+q$08Q9RmThx4XP3 zQU&!#Ly-1~t;~*yc{47$cxsz~zv7Q5vxVvYA%!RbKRPO2JkW_B!<31Gbyh6vis~VX zEjnRy{Y*6PiIxvv`mlux+2Ugjb5ku^{m8hLnX4|opzFiWyApyYl33r2W)ErFL}#TA z(JfW*dAbJ}e zUXzD)bECCk2ma&NjHO*{wJMy6e?2)}9p`sjZ%SNhbV0`>7qm~HX8Iurkbbhxs!u#lPtiM7U$2V?7N#N3~cjLs)-2cwpTL>-NvEq~%(F z!;5CcuYHf*Cdz;OcBfanAsWWLi--y(jI6aA@FQ%p#7EfP1P&xBv&E>Z3Bv0r0)XpK z3@mCk&PI8-kI94t+KHcz^ZmnuOy&jHEv3Z9l?35FU;FFQD4f9S!~w1$MuuPR4cE1P zuD*letGs9hur#@~3G7JLBlv-P{U~6MG9weK%R2&_qrH@eXyQ{;#O1DHQNn~&#Uhfw z${X-+yqqPjdztuH1n8gGH_>A$z|Ny8?5^pl7z9}iZqykOUxEDTRt#>0)d3MxRSd9A z!@p@1OTygEczF~rWwBxY^JV?%jv{aZu)Y4;bN(k}{%^JOU-SjHR(0#4zl=UT15-HEYMrQrqox3tLR7K zp3R2MWHy6A?vFhcB~SjpwHelEak>s*KTgEFkCmFg{sjyzM5G?a;3M4lWJVgS!;R~k zF+4?WxBzv~PRP+1ELr3dTS(u89 zjaDW0x4eB^-5cKUINVMe;`fI3I=VZOXlMege{SWqVRO^A0K7%bA2sqrfm_pzVV0q+%#evBdroR^5JS(4l$C^$*b~XZXI0EkseAYv zL=$Lk?nHtZ4F~=8S^W6S@z@hm9SCRbi{!uWzl}|aVGclv6Woclz~1!_N6GMyd&5pb05FU#9p(OVu_Zu z&(-2Ll-QWT|7&kO(-S-Cq-J4NFRZXPN_vPc8n;xME1YTbI<}-a(}tRV!gbFuqw$@j z!!IqLb;#fF`_B+y_~CEZ3)Frl!_u`W4V@z7cKb>Am-&Pyd4cp3mYrba%~^@@u)nIk z9ska^y1<30#<+Ed;nS)#d=Tgi7Ge`jA-%hbYD0uv%Dz0{Co$D26M(jyqp7!})g^{0Enyh4Dde zVh!P6cPm*NH#G$if2-%lToEB|T`xRfK!$@&)MdqZiyl*3M}bP;|F1O^^|ALe17f92 zc_a=Ce}TE-%cQ?9S)%E0Mr3+Uezu3*lYbcP9JRES6RV>bM6twxpT&jwjOsx2D8&WP zz^vYgRdXWB0zW@~tMK6*ZHW+{IL)THC+5MKlXth%}xTK$+wKIPqRIfdQkaOhgz^(H$3=ceEpn z(w3$i@P=x1tO^6lJ2RBcx^kGzb{fP9{(@mwU(CwMLv zh~1kc|1q zKvK5wL?!z-pbLa6*ia#E*7kYk0c8q1xvkckw~*&?3d}oLg@o!p9uO;vpoYW^kLA&Z z|MPFfX_|p(kOu_)TUvwlpTx%ENJvvaS3(B&;kG=1(qmOc>r_>Q5wbXtGs~Kgs_RUN z<9qxyD?0QLQRjWW;x~qQeWsCrx2W&#kC;DZU59(mv!nT+uDBC7uZI(#MzcPMdOwZk zzgFGA?qaPm?q(Fe<@n+ezL0;*9t1iCzq<=l{~QnL&~Y9Zg%NvEarO2qB7hixM-vBd z^yr9ucL#t}Z2f_!4%uFT!kbM;I$WremEJ+jYzyF}vnC+st> z@E}-^^MQNT+u%t6^AGsCQ0a&Ov=+3?MA{+oylB2K_-`}(6LHAO_ng>ZdPQiw-}6im z4_qnVi4-n38cQ%m)U=DCZ;Yb7)x*7Jw)_!uS{usZ0q&Z{-sIN85-@h_T87N=@MvHB zgmB$A&`sGwr_5>SG)$?%K>trsv*48U(6L}uT6|U1tP0@L(ksLHzh8E|F>Wi9XZg~o zS%WTnVIb=5jOP0?R?kJiW}3B(SH!&cFnHj`o|)Li9ZtLyMZB>YwkzT<*dI+q_RKW8 z_E{nDH{67%htd5L6K)3>DMYmJX#2IWhY#iLA0zYWolNP(0xXlTFMqsYCfLiuQM%{C zU9Fa{VRI^axz}VGEpH4k)_%;i3+-a!Mf?+Xhf}Uei+EeaINSVA@Ir(&e}BY3aepL% zLja9~!^oUWmhjfXpa_SRb__-&5zme!rWqaAawvmM(oNuqV!Lwc6RAK}2ZM=&1ej)^ zn-!{!WK^NSX%Gd9?Pa*DmaQCGGtAtetl6nhe;tZT0tYX2mc(FzG)0yKnI-$8X2k#; zr-FY*W5^rMZ;hWE#)j?yzt?evoy$%Lx3;nrVdpgpK{@(g1sPTT$2x<@TGRXu55ikS zdnR-vWc%;k4NLUOUV)_^Ui%x~!oT6J4Q=?5(qiE2uO}Pq5AesVJYM!=9uO`>*n^Db;bPpVxr3jcHF@+;!1f>FA=0-FQ_=N{ z28cA6S+|SjY5>#B-*6o)(EvxX+7Rzd|80+=T4*nVrE6&2wV@eKNx$tl)}MnElF@45 zP^5c&ZqJ6L6haxugA3>{yTTdA262(~VeGX|E%ZN%d1O2z8Q8GS9x=Pcx)6YM2b^GO z9ju0WEF4zya!Mk0e7I{}Czv{xW9K=O1Jgxmp4fs2wtbt6)9@8BaSLbat|7dY8IQ7n z-g#*Ty63Ypdh4Gzi@?aap~G+;H5&RxB44`x$gl*P|9xEWywxj${zqFeeh9*^Jp7i( zFp3$uRDZ)@bX<K;FUZx2;s*j$y7j?R0$bO*ZYso;wwDmdtE`8AY# zu$qm|)CmH44%-s1V?2QG-TDsv_5Z>D?b%2U|FC+v%3SBrH-?yVe0%tFG$q;bx7E-n zVy@*dw(Aat!TQ?JZQI|GD?`nYtf7;vTdbi{QU${bsQqGaiEdl_uZ2_iDC<_2!239A zx7C@k$w-a`W-S}&x=wFwHb=j|5#hrehgrJ-_H5<+^*<1nB4Ldz)G%lS8hz;8wk$iF zxra0h8eSvVu~OB??dQWoy51^WXJR@T`Nl9eY(Sd8pUwP1DZ*9Glk<#mlY{Xb_EYh% zfq#u){5)AXu024;acd9ZCw{W+I{rmLet|1;W)X4=U0i&y%ofoKbBW5_dRQ=Fy(L=G zb%0^9KD+qJXg+!sov~On>mNL&vUcq$7CF$i`g&?#}B%a7&P>G>T~9MwXbEYI~~XjOqzjpn8%2;1!+#$3!Y zkI}V>VRY1R{`yLmfv!!=DAB5;o9jNOHym%)g5;{wB!SBClp~uJKy!uNCOqc})P(14 z0&!JM=1J0Wl0IHo_c+6Ze$M-N%ENHD={wSRlSp25rqHPSt;O~N*&0_L?U?RtQ=*Mg zEIi@78;<5#ku^_^nDdahbuw|IDsAQDZ5Z*y5M51QD)(bmdO9jOZE?shbgZx{Ep`o7 z%)-M9(bey)zREDoCWI+!Mw5FRMwe-&cwyB8a+PC>NN`gmcoA{;1iu`P$pmK-%Vcf< zlF57zkWA)Z0?B0l7tkaS3N4H zDIiXbv*Q`V;kT+xxopVNGJ6mDeV#fIgt2(a;9mtK1K30EFW}+2a`f$viaZxv5#$1M zn?4_xh@<1Tj{QjVnhs+j+OH&>KcPb zf4MSdEotR&Edy1VwWJlBAr}?qqRl^yC>Z04Qr9eOXRW1Lz_47r5UXpVqfh}G=4i)t zGJJBeitn|v@dv=uMn}Y&93mC_0c;My#^KSeXQ2^5%Zg=o*<0hkVYzN)G-4eB8MXAIQ*qnDE8^$7&3WGUG)>SyPDVhOmp-E+0VZ*yf{3HJQG<4`X(n3#hYOCY7 z2t&uCaI65@CF=Gra5cN!)prBPCu$Md*z$i_SIk6O$$DljkZg8&D`c&ZI0vDWlS7vQ zF+s3528eYMj{gI#6Nr8P^#c78XoEn11d&y2tGlgcB)6+K*zIbus`}-|A6@lpH5Etk!F9T8jB{CjOehPGqwbfW z#UU*{RC{aMkoc5nV=>paCaMbLCR8B)1`~18U%S8lF8phaW_|)_nClPYCp^yU-!zG3 z^*;P(7qBiAd=&(L!$Q`~(8+;HX<4EC4ml!fSL%JOfg}HqtYaKIG!u3Z0+Y|J|(uQEoiH(50EM->% z$r3dONal78kR!LT6D7b*4scTqUF7*?M0iUJ2FZ1M1GD#>3cEUx>c>%4;T?xzfkWRy z0MI(g?e3?^4O(JzmbJ^xXvD@1eZalpn7{s~5N0uRw>vI%@Py&a^WosalVQWh`>ji(q5@xmvcwx?4k*t68bXu6xUjMulpK=F3UOAzQRY5cpJuO=!-6v6I=Eoe$>ps$>+DQAPGJWl*O{?z++I3 z6n`_?xC+P1q1wh;GWD+yrZ7AwAsCJuW;wP;OC(hsuzLR)S`ASgm}4hFq+=U-kPn*2 zU%wRT7*0HUOsp&7V=cq~9KL5FaSy0YAa?p3z)qi?209**#IdLu<0v71IE=1)9^J&i zA-Y5O74f3v9Ah-`Z62W`XqFF08Vh%d*Op6%@#3(sKtSVzL$#|iu)0{!gYd@+{odG_ zRw`p2DK$KLSsi`gZhS4!OBvn#}zN*gCUy3|XHR zmhnz2-#Cei4!_lrv9eC*Srk=^%rg}SWSPh-v?5T~gT^#Dx0DJW#$~h>Fw6$_m3^3CDiuX0-~&P>qRVu?@ChZYYahR<_D3-A{2>z@@t%TtmDP|!8#EnZ~T@$oc;L!+rsX3Jf+=hE{v{Bg22Wk}Pmq2VVe4gX+1#mcwr9B|o|G5B2_L%a4WRJ-JS}*wK0!iPN z18o*|oL7=|KLWZ#*zvfl3`;wZ3`+{C0~wZ6fn->6fn->22a;j=0gw#K9w6!RD?r~7 zE_VQZSD=}wo4MxT^Kgg8R)IbM+91%4l`8}BstO!q3(Q-(Wd6cxoZ$C}V}Uq07+4mY zv#2t#Xz8+8pz6jYS6r}YQH4i=z=Ao;0&^DO2wcU=z}!kG*2Ph@MROLyfxyxw0p4$2 zH7B+puy9!bYDWWw6D9@b&8eC*cTuIbciBOI@4{s<=$>FeZm3)qTL@R+^|G=R3zt+Z zT|wXDj(25MmDLNERtW2UsJ5t%&HXZpEo}BLQfpyz>Z5vnDYfWY|~CidxrI%U`=Q$=MA8koyiT*|6$>^sQT$sQa z%`3wfhflFLMJmhq^dM*_=wZ+<(37BM z&|Xj*=mpRL(CG-@SsK< zc^YxHPVxmcD$vN#D56n`Mx`3f)M%DQ3Mh|PW3uqHsu%|&+`{bqUpP&Wm0;S;pL7)>se$c6) zGeCEMcNl)p2VDdj0J;n`3N#ip4s;c00%#)W8c;E4Drg4iI#3yC9_R+pji9BVWuO(H zTR_y%TnAbYGC`X_-vwo$ZO;VJ6o6zIlqgl(4b~`4qoEq5YjloA0gW;=%G79tM%fzW zYLutZchm1tC|(M*kIX;iLJg+>cBTBK2xMlp?QG+L!mtw!}4ZO~|= zMw>O-qR}>u?$M}8qwN~)(C9&pc53vnM$VJc%-XM7sSg*oXnY`Bsn4BjQc>`%qUGVP zNE)9f;F0iN%jP)P_NLV5Cz?k|MTIN!+Q$^{pYb1AM*5#vZY%Yfs(F;ua|{{`DqZ+B z0Z&R@xAut-ZKXahY91xU<$an|P>OdCpPn>9UpjuNa6jCSN1hh>+sR zZ%Uo9{5uZCKUT5!4Dl$be_3VY6d|>gPtb8kc0FP%{^2#kG^c2(v!w-;`Y>KR70$4B zCGwxL75|*8d6ZwjuyT2*km4C}Ci4eBdSHO9_~$p8M@d;(Ab5lhi!`Y9Pt)Pyym^URbB%}i?3@Q<<}o%W_!*MQsOi@(9)-m#^p6| zlzLV3D5*Tlopd3^v*p8pN`^!{@)|fwU8#8jNMUDLJx@rfvby#co6blVW!1@Zrr;5~ z5P`l~xbS}asyJ8(BY0dcV^;y<{x$1;#S{CNIBLdGK2WzoU&bf3Yfu0RFYrJH^I@FQ<*i)3bV~y;eye zhjjK?%XQo4T~&NF&stRxX`4inJ9i}Uj7f6&vLu&(Xq7SB_fmc;mXQu{9#I)-bGG%x z(N@~9@28Bkc`eCh&b%lid4?w0oR}1^j-+^T9HWeM=h-B`u1a!emSh!z5|$^0xhu)# zO-U~QDoH9?Ay!F})cHxif2N{5b3>+Y_fy`{dSFR*jh=sf`LV zAoH{uGfV(3DU-93Wz{jQvFoNqOK;%Bl9=~V;p@pxDwuMrL8FaR*_oyJ$?~6WF2l@Y zax!+C(y|zsQ$4>??uscLIYpE-!KCG@%!6YPk%f8T{IX>W;<2*oiWOQjn@))M z5}6e8t}Jm$oAN>?X>3exceQR6^A=V>11(g}RzsMRgJSY=8ScxnBC8a?_4VCiu1>Mb zFfUzP6^Eu=hdqn(!X@)Hp9oQZ709{Lof_pV3sw=ff;r*!a!j1hUr9~6ibyzxpPZ&N&h4SPjFx*!@OiUVpUHS#c1a^pIA|VoR%7i&S9Yq}!dImZS&+KS!>M zlr5f9Q-%P=E2{AS%0)}(AVHH9-0@3s&kb8&l6)a&f<>yTG+>pcs!nQRUN&cO6_#9_ zLD0#7sp0e88M$qhJ6b`q90V{#>1?#Qtg3$+JwoDL0c7`orq;Yw>CKa;=-zEf=rC z?`i12a*c;Z$HN-=N?XjU16&UtHA|-XM&-Klqa1uc1>Yb}2Er)5?l;YqBH%+T9?6L( zwY-gX=ZAjh1gUAbChY4UPwVFmay5{}PLU&YqA#s%m*KtC%9bsV^y7b`l}$R$XKzmP zCN^H(CPK+wO(z*p!#1NCYS!%g;$%$Zt}?I;#r+R((!MW_8?mvS0$Y-(C@tRH@psOW zNY9yr4$pZj1YK7*pL9#h-8I+`EyE(*iuqMour-g0qO^uKU{2t$lv?}rg#NW`Ztcrv zr0PCCuKFyT`13*CR9+?Pc2{IBDEfez9*AejPXK#mk}U*M+?9^feC zCXxy%aQu8eYXy3v)2 z3z={`4le+dS~(C}Veubsy+k=`hnv{7EpLgUvz$QliR*eKvcC>&`Qa{3crrI52q`N_LSW z_&j>#4t{GPJ!z~PYX3=SUQu0_^|@QO?(8;AtnCQldH()VMYRKX}Yjy4?o!Lh6}aBUA$<{%2nZG$9w#8rBA)? zBG8>`XLlU^(l00QMf+l$j%y$L+8N^%=yS`9lM!08tFcFENm+kgcJ#rzPkHnjf2W5% z&vEoiw6A?WPA_z7^;aNiDAljva7*ejP^{kFZx$_^mSKu^G$3Vc;sh@~-k z9|SE%yq)nqdy(~Tnny`xS~jfWQoJEN8JwF>`CEm($jXIAnpExABxzwSvN9~}fWG;o zGk;(&vX*Kd<<|q24aNoVi(ONu<|ngef7f1QeMs{tsr3vHj9g@8N0q6u%iq{$FS0gj z9wns~8s#D@U8P?SH$E}SUSw4Zje~W(wp;FCO%@?!*M=6w>-W#M7f^qud6ZvtnMN+4 zDyd)WJbR|SfXX=2oUHx2)^f)W+Z1m(p0s#%$}eZz3#et9hkiLbyJ?);q9%qf+J69jobnimC;zT9gJ6F#&c<=mTM%5K% z?T<6=Nf$}<$Yr&fYWVM%ICc4uRPic-9;X_e!Qe!i%PHr}q=uq*RvmiB%$%MoyL8c_ z<%_wi6nl1WP(kZHb;SP{i%T|~9P^~jWh3+Q9g`b@FPiDd$r+WGCj>at!L?YAXFPtm zXPQPtS;AhQU&%~Ij(Y~l~Z4Lqc1AI?gBY!$8-E)U80Q--@qjq3w_i}PwH#9`RM}<;V3>b`_ z=@^^injtt9?{2qv1S1~8-@H6E2_>vI;`t-+se2dLGz-2l?t25O@S^N^T;9Z59fmnA z`P}zC@Cu<%P>27T0f1rCA^1kQr)*9}1apU?tehs;?0AfJT{9t$Qk8?}ev411%a|Nj zIx};2g6E&z`MS-pQ0P7IWO2I)jCODI7+3y2ig%;H({AzUbj}%>?My&MbI=)d$u=Us zIip;2S@icT@J+FJwZAzd^PL`F4Zd06xxYJK?nsUxv? z3&6L=;*l<@@Qrk(-+6fXlOFh-odC*ncj>d;_~g9?*`uA|V~ZP<)fL60v1hz+2GT4H zLaj;(w3_AN{F!02dU2Kw>H#FqmT2G zA)(ZYXU0I#LcO+DdW6GWiEV)R*(`rHh@U%}@PpHrJH*f0o%kt8tlh=`TGuw?hXzwY z`W&xI^8l5|zXAp^Juo>_C>u5TzdG0m9bGtrI~zv^<2Vl8Wlq2~v-@Hr=WoV&aw?L? zaiK^Gj-XFZiAr$R%YGFFaCseV|5a>QU zXA1NPp4SSr2hVQ`^apMCI?#2(?mcZMQWUdwn7ly%o1s}N(PGWcn4ubZTk9+#(=F|B zvQZpHg`RdyUQoXR6qt!P=E^uGT6Ueog0uFc^{6aXEQC(*DlxZ#ldJDpGa5qIT|1n| zi9QkGCwS;n$|Eq@II-S@mrr;C;D7=feG)TvktKiwf7YR^#8F%`d!jrw%-IsDM-L|m zqlqP}jl5n5FX{WM`;qYKK$S2b4dVy}llM^{U&w4z|1-b`MnYPaZ%@KBe zq+VjOm3j_N_bjNDTo+r(RaC=5BL6YFm5@H3n%Ju%Sg`)8TcPc z8E~i?=jExV072cdJFvg@V=weiGu;v**3rg^SbM0zG_{@n(VcLeAw=RcW$Zvb3BfQg z^$@ur)Wq(FRn+_6kpIz%XKpA$0$WM13zCqAZcl&1*{HMHO=htyPVEoz+_EXW>Yj}c zkxjWJ%9TG27fu*y{?gw;av{fiYT#%9t4^Rfz9I&852N@E{pEe$0 z!zti2o(2vFpf5aVhYz>Ldr{iDl{BpT$h1`v)uFbmMd_m_(Z&$!C(HZT)v~FglG094P6dh3n$4$?UpTmU+KNqI_X$7Y>h5SPb z&Nyl$Mzw#2L&feiaTLMW*}@wg166;t?}wDm$*rs*kTf#u(gq;KkZMzqqxJ!Oq>?Cn z`g@!vRR=f%uN;S#00sezP3`6IhCToJAfLF$S~iWP`2T!iw*t=_1o|2Cqhg+i8JvJ62R5F2QpXCP`R zDNCg<(vJ<=?x42IK<8MxJPt@o;HqmY1U!@_!*Z{F`wt-L9w%+3#MMC3mD$?PrQxFP zodxU^l|#Q6RmNKScc`O0(zqB$?k#;0jS~V;6wujmI<65g%&Dja>zWW9yPE1r!_@mo zCd1Y+wTf!ku7SHZpz?h?nm7`*6xB-&^;6NEJQzDqDk6YR?4w8E0lviOk&bk#Be_&* z4hpxnpgKXx!tsA7^M%@fR!3V}BKb$d{-S*$|DDaD)Hd`G8jFKyx8PDYZ6;<;)VmM8 z=@p})hZVoepdPX%4SY}2$8i2D)vw{|8SNjN%wxDjCN{LAi0fUEtY#?LgnAL!#dBHH z#+Qdr9Gc;8ctiB$ZsDQ)R{)RIu`5&SZ`hB2+W!hH-FYFLI2g_PczJmQO)73jF}$5n z@DYqAK4VzX!B2(K*GT?zE1*K_S-eRLC)y(UZ^xn3uq~YUBlHgAzgTg{OzA-|ei5Q- z)hFJGnYhd=n-S?)3Qo8Pcga7j1HJpCoa>kz&4OQV$4@jGj>QK?^K&y|VMfF!{p?%a5$mS@tp&$bd(!>Dm0|qo1A#6ttZ(FnxeGOV7Ehc71;0kbd*h^(5 zS&~gIXn}V*L=lI$7CK=Yr%L541$^nLx6V;1%FYg&p@@%gQ9EE260yH3CW5?wwk! zzbf^Q7)W6dtH!PvvmS+76l8ZLdJ;fQSy_~O*zERr~M@?wq zESKd7sqUR1Yikr!k=jSB=tA2Lwd0x7I)xS{=p-DH4i|#*@-i7n7gO^}0**y+-R zL<>Gzj6t@Dm2hljK^fx64H~D?fn>X;v)?t5!I1E#6b?EWIaLOFp1&C9sK>v$i45oD z!^H@fOaZp+@^iQkh=WsGix%sw{4RX1YT)VErNBu7G1W0hBvuC$Jr)J9L1A1`w$jX{ zMz}ZGj@o&j(|k-!3k7lY0~Fq|7(jO{b?RG*4;5~^>FQ+chJmtNxXNsxn+&|eO*!Ww zTyV{KAe&BibE=&@Dz~M#r@&9p#y z4S2|aBH-9FvoCDk$rmd8*u?`4<{VtTr~9dKXqPU+{+>gaJn8th8cbXMida>{1)pac zo@D~D7F#CJ8a(A&S!5G`H%0OZt!(jA#A>EB&z88O8O%vpCQ9#@P4lfP%{kb2q`94s z4rjfw5o+?Om#nN|R^Cwyw@|38+@#BL4n)Nan)K2HBNI73Se29^C;?WiM3zgY$$2)% z0Kw7g76q*QE$&<8iQwo{=ZWB`uCY!$^zD_{L|$FFv>KZssPm>b-5bJ9wX?c^PFE~k zHg8UK1$J-?*Kq`+PgNnp2cBJkwwon=hXbtGNvt-x_nUWVRexF4K?!+gq;Dy1X;=J? zgB5)X*)hPr`Tnx@tw=?tpH3OQ)g-h;HXBNr>HD5{syUzO~#k6#u z*6G_1wQ;;}E~=K{2KvhC>ZR254cN5;WKB8TwCq z8`DdgM@g-;!h9llQ@k7Tq{H92wChTH8`G_tM@eyhlV&g|#mhD6uLFH!|KeHpHYVzG zqp`O!{mimC3AWg11y_k`XMa{;Z)4i2c>*HV*z{$k4;Q>syj-tla1JaTT4--$s?|Iy zgeO_hUuebF; z?9@C;YKs+94rEfiS$NVEt-R_%TMxwDnny{U#)O7B6O`hO;>qCrDD_}e>Uh9Ep0hQN zl6u>+;r4&I)sj-b_;$|yQpW?Oj%pqy6}Q4H^f!1fAQQ~;8Na+$>UiLPw`d+Eg=$Y2 zuB@ea&y)Xn_P_Q0c~Zv%E&i%`DCJy#|C*5E3Ovo^JzaOvMw)XhTYj&$-i6lusyfE z0D*`+hL8tDLK2e+4-pK6RK_vZS}khr6(8-jtyOz#@p&~71bkJrR(!M;ty&^#vArsy zHNWp#>zsYgnVBR9FShsp`TX}MXR^-T-?g7>@4fcp?7crOtY5_Wd?1dCMlpsFpZ^@^ z4^0IdMlk0ZulO%EN8@a0_Qx=SIX^CcZZH7&FPM*Pp<`PaeORqfU9`j-A{PlW3HN~jgVNxdv3B| z5Y?fV)ykbyZ!#JgWdigp7o0vCwMJ$|>B@5T#H#9$4i* z(H2z6`fB=KyQA!2fJJt!?=dBeZ?=nSiW7MkGc%ANzyyi14t5fM22OdjrnF|I`Y2l$ z{hHF!1VLCovyRELCvZ-fTJ=S<`q(JJ7T>7LF+P94Tl!B*y%QWJ_zCm;~ zhQ`7Pkq)Na-|uAK@>uIGMfr&0D)f)n>U|{rll`0H$6F&tx-y+X_w!iXqzo&JF97=u zFdn@Zrhn|8{R3m1XQpWb;FzxCjBu^`9(f$aGeyVHI~)4KI3vTJ5W~&--`H=72}zkb z?haSd#LY=`+78%N9GC8E&LJWY7{Crl{$=UBemo zq}x7%90qSmFZXDqmy@n-i9^eA-CKzWjb;Sf?yLu&OhVmq$A}ImOWBXAY8>F*-qfdr zQX3+WRbZ*G?9(D56(@7*goasUNKeG@7{3(8j}CY1ZBCugFoKLZbz&%yq&2%;B(%hJ z@X4p{Hm6R01RFBu)X6Nd(5Fu3;*BKkodvUBH>Xah*vOb)fL$OK`WIj%Hx$;8DOU|O zr%uKxObYz83b#z1ka&|>JF{^=*@&su|I0*)VN3s|AxS)#v1rt~QX8+(+tpn1aT)#S zrUS*7L_t@4p9EU(VxS@N?zs#X%vQ)&S&w#%XsxZaysFHqX@ z(JgQ=H}2va^94r(t^?TEa!f*}4WTQL?4W)*Po!10D5zZ?*bv){+m#Lkn@SI1Z`Dq0 zbb9c}8My8$o8pc>?nB&Qmup;*6vg%4(cEPF1zg`y9OSO0OV(qHUQ!CK=0O~=fc&O$ z$0M%UX@>0~<8l$&{<-ZLF!H@L#^rEzP1xfSjQk@v@(K2Mp?@{l)s8Rp#yB$oSJ~k9 zNZE>|w%#>12O@8?D@Xb$wi$6AfMsaw7K)>JX$&EIi$BKE57>&sY4h_1UwRTLv%HO` zQ17o_^2L{T;XWN)@MNy6VUr>_|NfzcXGjW8mGkk#^1`xbfSLy((tU&pOL z2;SJnobx&)^DuUr_}8N-53w8`>1LG5XwUT6#@VH&1k5CGCzxVgs%vH<(h7B2W)sl27 zGNgLDT@n0J3Wxsf`}dfumZ=J3gw<7#28}q~F49#f4`*NTSf;sZ*;8SN%c{5ZU@q=L zK-Fnw+2*R{L7j^+wjo7N<{~|YOzW_9_mYj6XLVcBU)?T>3z_$Sz3>~+XcG@9-WC}D zN)msl`$JY@QxS*hspp1?$&BN=BF@HGJ2Sba#reE5&c+|-5A}A2k%-V}+c087q{E~J=H6gKc>Kz@?+HT`!q=BNWrvoRM7OA6F#SUkqCWx`UMYH`YN$nrGYs(RO z1!@KD+a^O*ipO%9wxJ{(--xJ_s$GG%4TTg4_N1o6acWg`sT0J*tV~lIxr;D@naQYj677F5NsMx<( zrvqYeb+$j!H5gfo1I+NP&az~GWb*+2tR1_No6YZtt-EYRZB>KaXij=Cf}O)S^RDeV zZ1_zM;>vCLG9Fuq6%1qIUj8VqN)IF%v$-^bC@QCc!hvha*aMs5Z`&U{rGLzFkIiHI?>&!We4mQr$+Bb{e#iNxO2v@67q~ zVzIO+?Ze4y7*X1(Q6`H6pKl&#D(#~b#t3UDvA~GZPE9nKv~I_?m`XcUeln)g{(@NO zN;@^!WM*A79N)(4L1?dtrA28s+PG8UVqRQx@9gSbrqWKTIhj*6BZl{jg}&908fh}i zfBwBHQ)z!lEP*k&zSM14A?K9}vbcKpqt}^AJNA&U>7lqb>NcXZQ$tUt=D)n_&8>!8 z#L}|W@Fv|x)ObU&y>|7`d(5qdwiQlj1xV95(exH3vo|Z^v0REQ#IY^&P zfvR<47i^;7My4HCiYT=~G5Z1%CR&;yLq}FC{|T{HP1CYSK4#p+2`99|k&!trlNo5O zx{eFIst5-}=tXI5%Gfc%&v&9t+LatWdu2%<94m;23`I}Znrzw?H8f8G^Nx-q!4#bR z?5vlu$od&Dd(!}bc@mG{(kHTo{zLxJn#TfN*HiwD9Y@op%FIWE%7J-8S4OGvVgKw4 zA=)#r?~f4P(nF!fSHhi4lV!^M2`yzWw38pwY#t10_l%2K!+!ww_hsRX3m*s=YG4JI zZqpL!%$GZX`L*7PQq#k@@%A&eXt84C44gcUhm1<^1l!S6+OOf?JYd{8f}@5){F`7? z$H~82fw^DDDgVYz&~sGy8}RRGU~*>4yO9p-%m}%-@kDiuAT_M$BxfbUUGD%l44(YJ z0ggJA-#WmJ1@2J?xLLp*ae$+6#}e3L5~X)G+$TE3ZE=Wu!6EJpza?@Y6UC3bTHye< z2)Lg+z!d=3#n5R$lSveA5cUfl;PQaG%K?tUJ?a3r0J!W+@MAHF;+G5eTOHu2+J4{w zN01RD3>K3pTuMTX1003>xC0!C@;@EmvVogHg<>&@;&(CJuW^7Q$X*9H5~)6v*%p&1 zT*{Zr9N;K^cRRo>1nyl2IGQD%OhRZeiQ+dD?mHadXg%#Q2RPcp|Dpq2FW?S4z;y%e zGY2@T=U+R(QTw-G4t^{qQN9$zeUSqkbwf`$z){p(`IbOICJLAQo8tgSo#IUnaAm+f z>j2jsxG{6_V=;;1w+`-^4sfRe_n-qD_4AK9z>)mzcZhq-A?_20IM+M`ZZV1S1r>J>mdI`SPp-9JMch zae$i&+))QO>ZjA@m1<51NV{x98F2N z3-MzyiQ-4&k0}mu(;VPVfqz*Ja7n=BIKXuUF4qB$`j7bza1_6#4sfKGtZ;xMy{XXw zj{5yQ4srV(;$CowJKzxassr2&NXP4OIP5^Iv3zO{4C$w*I;~ppN?T5{qT;)j12YO9)Z=K*!b-ScHCl|zm12?SUid1ry<r5 zmDJ{stQ&v_OF-*r^O&(}M2Vq&B$gfZ4VhZF>*u~CPhFR#yY(GdvMzKcz~k_Ev?2JV zt`kSP*tbp6*OSJ!$zY^uGG2p`#w`5Hjp9JYe`a{EX@EC@2sU`)@F1!l+9kz3@5Rwg z7qz_;jP}Q2I|KZqaGd9(Z;jt|aO>LxXZXK(2RkKkGG`<5fV(ImW&z54+=SKpRn;$e-vh?jfNTo_)GLnmGyM?A#KyRBZ1uzI=4;^j7S zup}_eNZ>1Q&=dG1krJCcu?PN-g9)S$J?+6W#--0Z0yU84tlzEIJ941ee+RY{V@O@004Q2 z&99u-bE1QGw=U>uMckSIaSITgMEHAP;|TYL7HvfMOG|`bn*$5{Lic61spBd=~6Gk-xj( zpUB^j09GR1f~>-eBkSz`6_MQid(EMC%X=uRre$Iz-+PU?X*Dn^KD ziDC--C$d@$`%a?x1pJd!KMAmslm7A|UcNz@r?;kebnazTdHE-+mkX?3-e~cX0`4T1 zwE0A0*=F@JZ1r-s#mhtN<%!qAen#&0$Dqx~UCC+53feuQH;1iXb{_A)bTQ(6J3Lgm zOIOjVTKG$NY2@xEICPQ~|E0Wq#Omc;Rxe8|UfxPx>V>z;Vt>D-T6IJFX7ncImbQ-0 zRX5tYB?vdBt=oXUz;F)4JHKUdo*3htcA#|u`em~xIR}8)p5!k!M2`fBaXqYl(2Y*9 zeq0HJ(Hz9&tm-7ev#g>n-PiCHddP>!%Pn6~yW!pTAMzq)e;2$ra`I*lcsIJiuh0){ zmw?~$H_;eR%Zm>Bb89UljE=G{ehyKbe1v>aB7I700MkM}0xuQC}K(yb1)_>SMcpHFN5ALN7La7Y<6CgeV!suUz zS>z9Q#KB(rymKLoM(#gnq0=E{hJBNT{)dIez66DNhiPdaXP^WO-n|w&4cTVc-wfKQ z@!gPC!=CgqgPy?gXBFs3H{CMugrU?1BZqJjH}zS8FIEolw|v+KXSXK>qE{yeqM}kuWYoDlxuRr;izceg-%g=Srcg#zP49# zqjQpSqamE<`%>=6KeM<)!zMKZT6W-z_n=#oUX24BEec89VDu;98PeK?$8I^k1^(Ba zqkDcNL(0B38Rf3aw?EqN;E^*80D54W`O|Qssu2F@Po#s!ZMRE?T^dB%@+lpDN+r@; zFl;g<#d)&)4I8si8Rt+QNar7HTArWrRxt8g+I`&mAZ3W;i~Tg|Xu+^!xzV1(0wWLN zfcS5Mk+$GS452XakO4+6)Z{?qb6mMV5e`O2Q#4T+1rlp12Z}2q%!ycXBC&4U9cb8t z7c zjjaE8ANEf8O+<>6=&@sUMUT&p>%M934 zp!NE5B-tP;bizOKKx};c4SPrMNYT&Equ* z$3j8Rrr)4<`aUWGqgF?GrxLJhC(&tU~rQ}8f>C~iLirW^b`Rlah!*v~5(9sM};TPpl>u~PxVv-l1G^q_J zBVC*@H$+9@dj#yphqTswaAc-Tun!u4EdVA2i8vuhI ziG0#kg$@f|x~8W2DgNk2j2~wVP{JCB>3^}F>*|F?Wjt;OSXf;H~al7VC&Prkta-b7XKv4Nr&V678bfnsGh`5NwXh}QO zLMX(3mJq{ch@H2lCz>?sP7I;wVFsksE-8F_N8!hmBB?$2R8)F;KlO5(vB#V{b-ik$ zi$+rQdVjMhTm__XaSuk7H$|s0v(Rc8z#i#q2w@{4XJj!oi}4+nbXIz6KRt=>mqFWb zsU;Lc1$30}s1__3_y*EhA=>jfVfkq?=N12;Gk?D#}&g zS%{c7S0U1^Pe$k`EMasEIV-f^R>DxnROq)+GiTHXRzEsuYlG3BQb&li()>r{+el8is+-l3@b^O+j4P0UcdL!WRt=OMbbv;T;!xOlS?+q={qvAeGdjG#HA4 zvxe6glkjw_p)_!>`U+B}7ogdEoOId2B$1J4N0!C~*M2MEu$~S!y+`|oF(A%I*pF~YvILU#$2T4(SD8JbHV1(Jopu=P*FE3>Rm;B1&Vg^dbG3QolqAm z>W84jm;00*ZAcY6I$c#bwkf-VilQ?w1-D62zW^m`SEoWC#dV3I?o(8oqUNE+5Zq4{ z)gAK*Vz*RL4=U;jP>*qL>{ryQiaMmIj}+Anij|~;W+#NoQPfIBMHKZ*MbX@vq^K*D zSBcdyP~yu>MXgfQHH!MVqMldO$BOESfrj`pT2c9mS`JE5S)r))irS{A8x(cBqV84H zLyBrv)C-DwT~Y5T>Zqc=R#Xy3oD!FQib?@Bl;vt9C{pWi>m{h4a>@J<)V)j{1tq!W z!3>S0_cT!A-&vrDx%NX95!Vz@_p|F&pv0FQpd_@Pfs!yD z1tsA=tL!FXCP;9(pu}}4DB&mvCH~bYY9lC#-+oXMgI7VF!YQZqI&r-K6;)g_L4C>b z%K;_+<$)61&q3ufFWn@U&(t1J5`(uvk!tJF-dA=PpozMSacetpW9G_PHLE;3A*|_arE(6^B5H&!2%h zjeT}usb4s{gA$I5K?z3@DB)NOicSjmXj?%EM^sTe6m>T!@#RfW;>&SGjqPjrHw#n} z`!^qyaQs-gJ_zb_PSF#fB(!G~t`}5eiB&2n8Z~>g(V)bawaPULiq5e2XgffOFFO_P zn8JCWj-J7|zMup*NKqp|iOS2xn-Qz8|x0UNZKz+@wZJ@;Gr2Yog z50r4s0wtwi2}*o!0M(CUbsH$*y&IHp98owrR`4MXqbDfAoeoNHOF@Z$HK5L7|28Y! zwF=h^O49aMP{Q#ws24TzXI&hueqcrcjg zhCP0pHk5~WW^(2h;#bPE5!5)g`vHDw=cGsb6Mm)KkAad_y+1NlB#-!{ea}>OvU8`< z*t@fy3aUC7&E(5lcfb=aq-{;0_`0Z3zU06oYK9fJR)2AbPSA{QNb%ED8}0LH!sTU; zpt;318oE{r6L*L40`}Ph=q6-LDq-|(DI&~WoWcOugIm#j6>K`Y7z+HCIJGO6bjE|o zqV;@nlrOY&cNsv^6mA41$-V}ZWDgaxWDj-2q(CM-Qtfp(sJ%hak#t}2HhjN|Ns^b4 z2g%-TVY~z)FV{ateTL?L(#(Yg`QgR5KMXsA=tf@bVEO`=BOVO2{H+gNFBxe10YypX zwJ2XCJK|C+iNyJ7IQp9mPR~d9{T3 zYM|vKgt-o3&c&>1ZnHJ0v%!JXEK!pJJSsiJ`S}O-Dmn+tF0+z3`n>Fd6SeZa4`-#8 zwKOMrA8zI-TRZ@3+Zig78*-gQ3#EOsqBYh*v?yJ{D6+>$moBNnvxscvJ?NlWhm4Pbr#BY38ns9hQcyS`9yL{DPWmp@sDn4 zCQqe~O#lfxtOVa8^2E-pG!& ziMwP?Cuzftd1!(BU)*_=IE)O!YB2S(BVuy2lekic&^{Z!y|t3EnF9j?#u#(b?l~1L4EClbu!Cwo>-LN&=6hK=t^gTB5FC@CAuKU zI$CU~dLc1 zIe0wUkMKL4saE_hg~uN4Gf?8{!n>bcr-Pc!R6QuV*~Oz>hhM?n0*Z7okM;(rxlGZe z+Y;J9P=Y%TQ~|rvrQ6~f21VMNM|)1$(aA`{@h+&#*fkxqO2RP}l(_mqEoIjqDc8G{ z>;0gXv+F0y?l`Dowi}CiC{mC-S~;k4rgnm=VCo>KDyDj$g3M+r2&#^$22ksndJGgP zS03#cD9T}vHU_g)TbL>ZwT-FUL6Pd^(Ov;X`R~#CL2=4qDg_j&k{)dqs2i9n1V!fn zdbDd5PLB0y_z0SO1=M*SH;|SKMJ!3b+!dz>`95!P)s4Wm-mLIE+Q9?mOy92-&eZp+ z(Ph*a8DbS+3c2cAdTLL@#4e7$MM`)@|G<$!2CT0^bO&Bd9Ft;7t0~5GWD@wO71f}I zrZ3%1A|YDmDo~`1bdZ~wpZmCRhqH&w;Ba@*diti)$D2+7I zbPUrUk`=E3ANf7DsC#$$k{S=_C+apa0=sl+76oU0KKK}&xQGKk*{^ABu=QR;0Xx_+ zL6hWd&o_K^@j6_A&e^2rMXJcT+F zl+?^koEXhHKWd-5>Ql-C@;4t+ZyS z60re>Qd6z z53fzp|0*ge*2QtqeO%$vlrS*0 z)m1g&5Kgx&T2mS>t*K3^4Htz=>0T(@+C|r@nqF$fH5*RIE4uFsH?rbV;G&We_*Of* zyn5|;ewjAB_GEZPk)JmF#1fb=RufNNtR{v|POOT{OSmNem-*B|dBzG{M`BS`Q;s{a ziYh`SrL|!Y;qt0VIxV!aw3x|n6WN;5aLtBLZB<=Oaq0ioFFFFN9MLrbAib(Q7+JJ0BQ&HtSbasgW{=h?~e>02d=vb!8D zVJKX_rnIUK&Bcip9QjaJQjJD(Lq%0lNr(}zn&C3>N6 znZGM>OoOilw?PB!NOAYUP}T#H=?d`b!FAM%8?zV zbjF;#yqp;YfjN1h8NoU8b1boKCls#nBB~@}REbdwb;VVGMfue()$-;N z^X5~I=jF_rQxHhtgPv{e4=-|kmxkb>&r)1QyUg<0QIQj`o|7?Nm<% z=jE{U8#OUtO;>H{6?&7SYwW0F;qsc&P<2f?T7httxSqhM!P4B!FPM`bnxB&w(@>e& z&~9_nQ6A^}3jCoNeqS({lQ+xSq_B=kgWXQK(GKR%$+NXbj+kd~6-+D^jye)53a;N4 zKgmzN8Q2jIRf}0@+$`}n`g(0) zo;H7;mNBoOKnuvQOPfbSIn9qbhuT#|t4pJHM^R_a!m|iPM9Xh<;z=#)&lcGI3^Xlq zy>limTf)&cTLrI!TQ&R`j{i@f-qIym zuj6?ae3@tA-DT=C+*ilsyimH-ORF#CvQdG90 z{E7-HDqm3rin>%$OBA(SQ6-96rKk!;RVym2sP&4vN>TNS+NP-Oin>lwHz?{RMctyP z+ZDA_QTHh7UPaxfs0S7GkfI(@)DwzoR@5FveF}=O&)|6v&x?3o#zT$aKk@tt&pUYD z$3v@N)PNDsXLx9apD?s6PMf+<#nTH9ZE2=k0B9}bY&_@Sp`B?o(|-Y;3_R4R(IPsn zgU}jV4xRuW+TcAG&jLI~eJBE5il-dU8a!9vsl&4Y&n7%u@HFCy;Az7113Wk5xfRb( z@Z5>#r+9vj=T~@sjpw&`p2tHb1&_$QP)W+Jr=pS-)lX3a6g5auDT*4Vs1b@vQ&hU5 z#w%*FqNXY;OHtX1@+&H+sC-2gDC$y0Em72RMU^OOm7*#XRjsJ7qShRYMY|A zE9yE$-JqzO6m^TDZdcS!Mct#Qdlhw`q8?P#LyCGtQBNqUSy6iwwO>&$DC&TsURBiV ziu$9X4k_wAMIBbuM~XVCsQ*#aF-3i?DC^YS8S-V#F#iex;f8PY9m5evTf(Cr$EH?sfB!`Iwv-V$?-!WdjsZe-APAzd${r+X6A zMGw#0A-BX(SBqIUHeC^x+jih!n7OE|Xf-jj_rkZka`*(loPJ=?0m5f%e9W6OU#>O7AcI8_TTC@ zq$ayvbdkdapl(>Z>~8ZWna35z;Oej2kW%e-J%C?I;rMfY@sW9x%pip^xJY)%^u*(K z(Z)8S>dMaig?W?AYXpGl$?38l>{tg|NFBJcKy}Oh#p69yKEDfFGQIG~m7Y}Y=gr== z)x2%yu)-Me`KN9}LjbpnT3hTX(dzbmJiWIr(Xbc6!Z0C4AA;=Dxd>|y%d5CvR2U<|Nk5ZooY*qP z#&tRz+%DZy?Xh|O|2W;`8ZTUov2l^~xm~lwSzB}V2Uqqtxh9A;V{BY!FqaX-igO3n zpJ8%M6fVZtxCSs6?X)1%HT_ZF0F!Hy*fPe(g(d_sG`Lznn9_Ep$u(KH7-QptifiGz z@K6wnvMR4k;bM%9YoLwm)rl{CHPGbBkamq(1tiiw9e{L^v2@VP2@E)fpK z*tk-dD^KUT?A6~aOR;c?a4^Qkbq;eGF&wzzr(@2saEWj*#>SP(TnqHD2JgOdNUDWP zgo80QF6sr`u3Vk#&=X((b*P0)go80QE~<}i*L0n$?+q_LFwDXw!oe6D*Kp>#MCV#r z^5ct!n_Oc>HW*{$I+wWuI@jcdOI|qF!X>i77#r7l%w@#zu;;mP=UKQ!HW*{$8o^vM z^{}p=IQ6L!7A}zu#@M(z9GaT}E5DL^c>>;~K+U3-uUITluHOV@xjnz9`1nxJYK?nrLF|ciZ=u zrCYc}HW*{$B74z)h%2MV+@cH%m&gWVY+PjTc2QqL=DOFW_Zw^B64_vkjf?EvE^6_} zEGrA{A7|kb*Pc5<8~F}m&~vG*SIHJ zxJ05DW8)&3al3Mu2VAddFJ@Y}M4}jDvoZb zOy)}M^xBIoTq047v2js-bi39u4|=_`{&4tW3zx*4F*dF&<~mj9`ud&?Ph?rRL^c>> z6sIkqyS! zxTvi*!>anp?@rA&xh9BgFviA35@>Rb>$CO!91EAo24ieo)SI|nr{R~(Ro8#9XQqWq zWP>p_F48AOpC_*M(Jwa6vT%uPFviA3Exg-BS{a!$ryab(Z{ZTzV2q86T6mLd_Q${I z8?bPRY%s>gMg6#$8_iSO4qam564_vkjf=EUx4P}~;Xi)$)ocrw$OdC1%&B z^9TLl<)DR2WP>p_F4Ah;t}}G5PtW@E!?_kNkqyS!xTwW2%d2K{+u%HtYof>oV{BY= zn9Iodv|iJ$pJU+?*W8<33T-2VBN$VQ?;am%s$OdC< zT=Rf+y9$^G7l~#3<v!LKeSw8bWP>p_u7$w5U6i+E&RKeXkA)U4kqyS! zxC()Fy9`b5=U+ZHtI)zFvcVV|*QLz0fdYc5KIP5HmzrFYL^c>><5~o)+eL98bJmO1 z4=%EBiEJ>&#&sF6W^NqX|91Xm7A}zu#@M(PGZ*z5WXA6KRo}%HE|Cq!*tnJe>vmC_ zOr|O4l4q7!xI{J>W8+#1tT_r8wg1{1ms+?)HW*{$TE<+|CX?A+eA&ol7A}zu#@M(* zz`9)$6I|Dr6}cv4;S$+kjE!qKbBQaKG^{(RRW3zx_S zV{BY2fHmhgE`DI$2P;gj$s!w!v2hhM*C`Yb%uxS%{$dN4$OdCW8+%ITtoF3zH;4|r&n3HL^c>><0@w^(q72?_MHpPFSl?>=`+U0bvdx6 z2K&a1Wk0yw!X>i77#r7W8`sdj-&C)*aEWX%#>Q1)<68dYUA_vFD^p~HF*dF>Hm;g= z?+saF;S$+kjE$?(#^t%BXK|&4OJsvFHm)k>x&gmra>x9lu!_0pZG0E{l}{P%v(448 zb-PHT=!0kNvo{>8R$TnyC~O&H3+oEzO2MxO51A_zR~B^>Yy+Qdw{X|M*6q4RcYkZe znNhM4L*M(5sl{Vo3m_ZJ(Uz4Kg-54zM$>t=}#00+O z<0g+yv6%EYT5KkcAI~o1VZ?^+Kfjv=^6^G|4Xlf?b&*cQHU9TIx&M6ZSZTfW;LgPV z>*&W~_`dB7eHK8se-QEhDR2u0iiH>d1ecy^s1W2rP3RFFL+@l5H))*oP-3N}_ryZ} zAT*{U#DbJE#!bwy;aU;y1JIRkNfTU>!cC%}l%a+F!@&4PixqX`?B9fm(s%2~)xd26 z=I|J?=%#R!ZTa#raHG*AzArtAMqRwbZ@e|RS~eP)0AkXlYhN^6VO-`U>Bl7)Z6E%7 zVe^`9OU*0eGSbtn388d+15BYFib_Z3ctgKqAIZNT0&|%jYvo_2{hoR9Z!0iwN$<-G zryTC&aeB(wJMB$)aK;pD#L!0=ry22^Jkge33irp*CRSvDfKlO2%CzO*6oh+i7Vg^f zF^rf0INVA42uG|n!hH@*`ivM{My4%($#7l)OpT5Mo1T9YZTUj?9$W>?^V#B`Dz}Ub zTL$)q^OziL7QsWt^e-br&nmVb4u@I5ROmgDl9!BhTfX!K`oDmAM#q`{rP~rr;l2dS zpJH+2^f`VGRnzV{9XkMliPFddW-cC)mvQ5)0zI%Rl)8|n9Vlg(*5APCO10Rcjw3?% zm0`c*DzP!skuk}d-U`U`W?()f?GA?WUBb<<74YN0T?<_mcwk^}0O&vAewwQ9Hn9OcVg2RPDy7CFFC`(EY%NB&*m z07w1GW(PQuzwHiil+U+0z?}-*FC5^g-};RM+(h8sbAY3E2RLe9e&P^!uLB&# z?>7!`R6kyJfFpTsb%;Ca05=f+ec=E{`O@bq{8&sPIi+-*?Epvp%mfFxvw+KVfTMn9 zz60Djz%6!w8wK1|4sg_;|EB{S&3pXT0gmKlj{_X(CGR@G4F~S90~}3j^xA|Ui%C?z zq)$$DfTMmepfTMP3Orm_o zG?zBc0gmMAVh6Ys;PM>csJ>M?z>)s4-2smJtsgkRQMmu<0M`$=76&-Wzdty@QUCUi z103~l|8R&q<^V_a_n!`Mln(dR__3Ho@OzN9m&5(fq6C-r*D7MgJu7I56oX;aIy19)X#jZV+`Iz+YxD>zc^%fAwL^!HPeH`E@|IT%QqjXGkfTQupg${5OZVtmO2p z(Kx2AIJ~wLuWUAAK5<*U(CW8)vNmSI_)PWQ9+8x6TS6t+emrekF&Eb$Of=4*aOEV! z$ou}tX~Bpu8BbC$5}3SnH#^8>1Y15zK{V}0YF>>BmJ`{Fvovw|sd1WN)25xiN7CW5 zanz~q;CqDXDsCV+Oo98G{H~nF&-ZG^;iLw;H~WC^5fTW7vAZ9q!c!NC>lBe8`dO@o zO%ZIAr%{|2>vs`T<15~655np5r(Jbkf76U4f5UNC-PG3GVTWrZl3H3l`k9K;y}Nq4 zw)^RFiKK>iyfeMKJU9ch1$QU7v$tn;0q?2A8!q*`-lPLUbv8a{8RvK=`QX(o@*{iu zsr(L4^!ETA^yzn55P>dYW5Ku)lE>fB+{K@Hpzi*%eXi6^dwpFtQTPdx9nG8UA9*a} zl|bZJAkxy-AEz->x$xZ!OLvo^Q-a5%`SAN5ipRqr?;mHoh01OvD4N~(Xq6!TiN~W+ z|1KO+P_!m4$25!GPhi)T?S83nhd{l>c66PLP+LKf?;id_RCw(NW$w*s!-3!~e`9kP z=ky0~xM)t>W8l(qGM;TaASd{W+~FDw-vS>W=-TiRuA->G>9l!p)h-1CN9R|}ns8;oY91V-);uFlIkKeuV_6@e`+%?J&g?p$xqbGe!O zy<6#0D1T(P%5Q2wL`a|nNlck5X(0gpEPCOP&uT+|QL+591&Hx3n&Vqj8^kTT9?ELmY!>6ht216?sHYqU154%VRLo9QcCW zMILh^yL}^f`|6*EJf0b7dp6K;>{NKZ?w|^uR0|FpjSk8)3AfKq&W-Het1S+U{K~s+ z1EezWq#1`d_|l`%-XT<@DZ;29A0&!TZsbkx5HwN;bax{@2Yn-P{PjzSPbSCbIO6jP z>c=1we6^-S|e*Cy@F>XM4S%HbuzkVTRrxmhR4=pR8~uTPfC6MxwVyY z5MPvP;`kQ8qklnszw}u07oCGGe>cbHFIw0H@on>NYlTBhe7`(_{5=-aULKEWFWb;w z9)vtxk6@&W>w+%MmF{mu*nQDf>~*E(Ha2^=wNX4&?Z}O^c!y+x1MH1{lMw| z>pl!NwO2o~Bl||~%Yry&ZO`B`g>C3ZzTNZd_h$9x|aGIHfP})kn@p2!KQ`&j5f2<9vNW8p)0&_bC$P( zv@}1oik3s3+);zNtc?}nj)%9<^9JiqD^|^8NLyL#6B3ncj zdI{&y6=`iPC|V_7e6+sN-&GMF%mOJk$xME;z{uV-Ae)~3frOO2{5RU=#$6Rl6n%scc>n!a@;CVrbB zEL4Hpa8KQAh})hK_IqZUNc%9QctO=Ei`=4oeqscB0zHWo^g3|D4ji6-wv4dRM z?k;8b4^Ye5?i*!C=RnP6yQ%oiV`>(D#TU91MO?RoTFV3BR8ozW`kVor|To+fm5PS+^;n5xjHHoRWK+$;FqkRo(1XE`txucl62-Ik% zE(b-biATF06irBav|oavJ;%881=Jw6`x~fJ*{(l?kmj#E+9XhN2)_McK_ohcCD#poBLJ%Fnp1%8ouq z-OP49K?!acsPouvtg_2Xk`swM+9FVb8-wm}0OO{B61!JG4P?7NDZ6s?tb^Gu3`%eV zF&lX~r#uzZ8m7`feZaT{bghUQh2n}uqgy!}K$bzYNl6_H74;_RaYIK#M;Ts#DuzK0 zwaBPZxcIE25e!C_>~4%;zEmw{5|3c?9yzu~QCpcDSL2Zr@onWoBRbjC=X`hZSxY^g zyTl61a2SG^}`Mz>REkf%XUs|-XW|UTPZ0oB^%T#OH!pmdSnv<;% z+7ueqOPK8&dI=0q;^K-f)-G8zibfNKnQTmY-2qpBjC8V0E@A4Q!j<6CN{qLcMNU>+Z>DTblAlQ2U}c9QzzL zEEwNlUNg{PJI_PNqh1J;o|R9S@bEXPxng(kn* z{HdCRnKIvA7y9=WjD<-e^%f}*!Teeax2P0E-A|6ZPL0&XEOjZML?)?`8pd{JBSoFQ zG+bt;HGC(+RYqgeCEBQ(tFu0d%evNuijM+>Q)V)2$at zybNM^_kU3a3lqqo3`iZw;4qb@|Fc871TvVgB>rtOxYVHxN}*U~u$^%>O;5DjFnA3| zqc8urGzFyUV{&c@Pp>^Qq$Tt@wC;)87sY4#C6P2^d6@aVz;=-b@9enfjW zcEMTSyD<|Z9^Sig7wo*d@>1gVZb1FbOR?|WI0bt*paIW3hj_!Q{jR@5Q#G#9w9I5e zt3Am(IQC*VhUrUVen^c_Vta3;r?3h`3HR<=IJxCR#F{5Lq0D#Ro{yw0oZRp(srGpD z;4Kpnc{_#Plv`K4O;K*$=uNpL;q5}@b}GFox9)hGs@!_en{w-kw`t0)7riOB-gvu6 zxgmlJFH&x}-E`r_%I!3IQ*M3mmZjYK(wlPYhc};cJDuK?TYtPwS8iv}n{pd~w;9Uq zOnOspXW=bdxecT@tNsG&anuNp_KC7PANr(>kBSua zJg6rbN7tJR?|YzRZ1p!~*A;5D@V27|42LJ}>H(^uGlwnz7j)4o&NRC&Dj9Co0}`s< zG^@_ZbyRVaAPsR9H%SQ$RoqjRz);0KRk=~c?XKLY;&xYVRB?MKH>$Wjlp9stp303X zZcpV#6}Ojiql(*0xlzUKt=y>M_Ev6GalOioDz2B^NU-}ru=}QxP-D?+&j?-Hr=gCA z7a2sf&PTS1XiWemcC_)NL(w8#_5aW7PV>6%g!0vq-~rHE&86UXkI$H?ZF%U(Phd0QOlBeHVOl0)wQV}EYU`|*Lfq{SF{nXwzupM zkWFw$E^lw!jD5SxN!>n^WC$1ypi!Zr^}Vy9ZqV@XYSj%)4aKi;&~z!SEPAwy zl$}wSQj|2EI1^8Tq6`ngrS|@)FFhFbr36Mc<6iRoyr!PHHv*2mj9sbDEdQ!0#dt68(D`=Q+WHB^Jd>NuNJ5Bi$dJJvkWd8;s5v5gge}+hegIMA8{(dp8#m z`4MO6GEkDq<)ALbTqB6ti~P0E3Ky(~N)&2Wq@AGY^d zcCv2yXar(z-$%U?5||x%p0`p{9W2|IvvcsqV01%raMXq*e^c(=dvor>+>b7=D&{ai*L_5VS^GNJ& z>>PPo?F>3C;m);j$RAyLr0Tt8sd_ZqX{mar7+BJY(|9mo-AqRPxFL2j@fY1uPj=Rk z!xONekwYJU(>2@4kp>Srtv?0n-SvI4Ni=?7hlE3jYa+TQv;+LOf6LS4g}wu!?1qy+ zexM!TX&KGf9PhoUIrDXI<57ec*Y>8ul5LLs2d?ntvDpwO~~LO`e8K?}ty z6sWaqp%567?ig)FU{uN$3W0&?4pNbn9~hgmg+gF>x`R4yg}?}vEffNS)EyaC1jeas zp%56V?ig!DV6@5>3V{LZ4qAXvpyGhO1V*lGp%56n?wDXjVEoD!jPP{X z?!yq)M?+ZO@HAA!bG^InpdAr0Rgku8a|?uO*M+O$HfzgH;+Lpp->YE}`wni?vS{JD z*<86vrW&RzSW2bDhQ}}7_ist0NG`GWV&=}ilhJ?iHqtweAxcgr(cTKr<@Lfh{Is)G z4?pp0A<|>%KYfumV)pTTg`Ks(Uw1IUKAt<0s1#zS^k|Kh%R$Y3Hog^}FR{^AFTbn! zBqxfGn%Hwvgo|uNh}A=D{y~LHymQ`?e>stM^baXN+CCeXV`@synq&Wp@_RjzG?CQ* zo64^_QGAqUVa=U?jXdp76rZ90zWh0mC_V%KeepSzC_btk{@0fmiEUi%QX8nO@d=&u z_Ne};;i%hM-Qd=MTA8gc94RhevoYuRcky?vDws4c9ciS~^i%}hH z!@MbaW+qztD6}no6xx64-(6;nZXj}Ryv@LxU+Lk^FZA%}8 zwxy3k+tNp&ZRw-Xw)9b$r3w~GW}$8AqtLeWQD|HGD6}no6xx64-(6;nZXj}Ryv@LxU+Lk^FZA%}8u}dE$oMW;4LBe@%$HKY9E}Sv_edn7 z+7&KRZWz}UUZ&hIs4KioxnV?CxLCPiI9Iq>xnV3OAXm6VxnUGnxKz1e2v@k2 z-R$Extk$%gE2=Pk7vZe4mi-C%P%N9ez3*x~gHa`ImWzv$xsrH7<4V=g(C$E^v&IMJ zbiTmOpgt$e=OxhmtL>|zJaEXY{UT5@+50u9YCImT8zL!oXM$SGb~N!(%M=a9#dQ{_ z4Q#hS+1&<87QWt8)I9WuS21oWDB-;ol;931YAzCTHRG0m65O4j1ow`j79%-Z8CM2M zaA8o5Yj}BD=5JY!lK4)Y%mil(*1yFah-9cry1nXTtW4o20^tgbcc|4Eyg|fR2-N1cpw*!>mo&xm%+r6ml z-UB81SJoTHTC?jFpoGH}ZN?g1qnX;?eh!*-KEiQQ~aQs$R|k}@w< zt`(s6F~^n4POWCp0%D?-j1QpN@!FBThT)Gc!rI}YPS!A&VGWk zKl)znc4rSP-(9pjd!SmAQOJSAcyO>m2wK2b*zL>{!5DAgOGVm{i_D>uX;24rpz+BC zr^SeSFEpeWSMaXmBPIH*2fU!KX3f=?gdgq3eixlE{<2F~eK!k_Xrc|Pm(dXKe7CG) zLh@AuX`7?@s}WiIdTp_7j)o2vP_y0KJDiOC<}PYTTwj1nZ_JJ8pM}{n)gI5qws@Mo z*GY?CD1JX3m$1x zyTYB%R)(tMiW99{d~D*hjqfNvcWg)KaZy4O9Umq7A{$>&Ir;Vj?Uj@K@i$z(zO8Oh z>s<)WI#6bN@3tsKjm|B&dVO3B(P_rUuuY$B{?c0i5|`hxnD{yRHbpgRP%4iCCpWk;XzyvTO6nkBfWK+#;AN2819#qM$_LceFbI#6QQ z1Mzu{?fQcfJNnr94Yu2*>@uP1{E_XlK?&{!P=98-gUYTFz16#Hw*i#kJ_IG*-e<~= zyFKahZb1Z%#d~jIvv*`8O)=x&QTT&@hvXln25-&s??L&u6aVA@D_YVz;cik!sgGLv z%67NdtTbC1^Xv`CoqqfRi_J;hUz3icaXW}{aPsyh`uZHyY1^B6QA(q8lKhdTLzMic zn|IPbV;hapd!pz}%S1{$2m!(Zfz9Vy|LvfUC;QlgiG z(p~M}6Yh0w{CxTv9051IqHa*bv8?d)Y4zX@kDay!|LV}o(>Flck+GhmQ$4j9FgEK| z#9ushtKW6-$e9Kr*&w>PGA8@z1JnvMT;@I;{MI7Lhbl^q(=8EL-z*ai&&DxHUwYSj)Tbyu`k6FLZ zDNv(yRX2{r`0@2)e!FuKk|$~!2A@9O!?9PNK6S85IjzKp+hW?;n;x0A3=^q;Qx)B@o3qg-e#%*6y2ue(UyXu9Yr3k3{*2yb)bIA zR6Qt>*gF;VD5!hcm84o+SK)ms+tuP%>>{8Vf$(TIDLe9C1_^&tlqmHJrG3jn<7l*R z(pFuI<~NA*+Vn#nn|7kE`kNNukVp7z^bU=Wuq{4Li!>3rR~zh)##>@9Av*{01#EB> zz9zEom4|=gq0**QYZr_hMQaz>@=bybh5xeFPSU2tdV&#Me?*cRZMv7TVPuOxS~$Y* zo}ce;>bHQ#`u@z9y<2_AaT3wUo7_?wOhzS1CY;eO8XksHpc9O6T3s+Wxs!c)Gwbtx z{H1V@1l6TSg6cBgC!iSKh3{O+1fqA&Wor7kgXnV8z|`(z7I+&0L{%%R$KQ`QuUB-VGF1u?D~CB!f_ucsWMbK#g6vb zOO@$^njq9xP@gbw6DYx*bS2?9ycQ*4ZzFZ6TVz|HqapPP=nBi*(G^a;syB2`R z;^QFeH@q~a=1RipkOiVMFxeTq*mj0Yhw5u>E}0J1*V+-O?bqugj(+N0cPTKW{_M$^)#C^wpx?yB5qTDq%pqiN}G%8jO_yD2xCmZt9r z{P%7tPss%;WHhPc*6SYd` z+X$Fc?(cz;>NW^9LMk`yQxiLyPnOC(6V#``dicmDaa{>JslKBTu4sgrpe)swHtI@0 z=%>opbl zmO&iP6C8!3gHE6;q(f#q-PmhW{Pm&iNzwTwS*i@pS{;$3K9p2C9zKc04T$4R(o5AU+D7cVfa8NZ}*eF4#ltg-mFto^)jc<)Vu9XB=-@- zUE?EHa8yxH@&hCN?5L-~=iN`|ezqJ*qG`yM50i6nU_ndk09`O35D53EujLaurDJ^m z?Cn>$utVI}@Bzh#-@DLz%O^;YX@?Z4Brozv07#K(hZLzK&+UpV90cz?$xvvKC{C*f zY4zcA44q?}(d{Y$z_)ew&L_`fW309#r-x-7tBDmNY5Ps zC6)UoP*NEa_1yXJPb&8^Q2zt0hrfvvj=ivx$~_+Sl%^Xz+Qq7J58jx11>YrHRkNlj zoH`}-lKFG;E|{M)H#JQh)|S@PmRD86C4Ka`)HH2VcjF>l;u~FTeG9FtDaYl*Wi>@> zO3`su;ve|JHAR)R)m1g&Db+>f5{8eV+R`vWC@BgTrB2zHTD7jSv?g_mR#8=4RH4Zo z#v0wHTwYWWs;#Q4DJ~5aS5;Qx40yyPR9>Q0)s(L+uY_w!X>Aw;+uI>ErQw5~?k~vQ#T7UX5r~6m1BVuCK1DEUgrrvIcmV_w7dp%vvN<+#3@@~cBgOlFe5R&VMm%Md@Np8Wl4Ar?-jv+eFQlOo&Chd2gf{xxGe&Nb++fQe9gbx}vVU z81V{gn;?Tqx^OQ*6=Zb76bM#Ld2wy1t{VAPT4G9n6&Ig!xJNTvts6 zg7oTjxHfglVr?n0P@ODB-Q1YEwg@+EuPhB!SK$I}vd}B7T*!?~3~#6gP^&GifiGHd zMLCJ{rZg?JxN6NBWKCIlX+;Tq-k4flQx&c%uBr$L%i`3z3j#Azm%byJ)}LR;iNS}U{8 zrKM7dpzMpNR4FIWm}JmTx`twp2~1iAsVMM9uQ6zMAof)?5Rj5mt&H0ruJJM4wc)C2 zv~ZOi-?Ui2i)%JO$lz;LSsB_M4HvGj46lksRhF*PTctFVr7H2bkf=p~Ux-Ys4@Px@ zE6DOSb!!qKER6wxG2WZ4MJ+*f%<_q2+e}^HO3!m$wDj8TA>6GiZpdG z7)wMf(1ai~PljJHk&1y+Cfb@G1YTQuMIFmrW!;(;5NT8?q$7kY(wH;bfb#+B~ zvGh?jMe9NqDUFHKs-nu0+EqoXOG72-nc^!Gl@ztVh^^5^nc<)V=QawW9gep(S}rh> zFVrM(1(s$f&DM++ts`g2TuKRA2zXeBN>x-*i$++&AxSf6y|kddu<2$H_`e$(4*qmQ z3wwqk-N$qxb<8l&+FW=VRCjv8=3))!C7VlM!z=uM#pXgQXNLKM&BYpn*V#qyyERoV zTKc?#0usua4X9MBE1?=`dix!!EL~Xzm58cbY^$$j5L0Ms}xnCsA@%p6}4VbS1GDqQQH)?T~XI5>IOyKq^MgIb-SW= zD(W6Z-K(hk6!oB@9#YgJih4p(&5GKisL|ol^^__y5GlSZieLDLY;Za`b&gDFbYo5o zMg(W{3XG|A12K)kkd2u4^#30Gce~Ei-)=o!+u>3D-iHd4!r^HeeuOmEKd+XuWvH z^J}l{rno*(7~-;Cy>~Zr?Z+>LSMY%6iEbQgylAU*t|ZWIS1VFM)Yj8){5VPZT&XZA zn&jF}-G;OTw~I~>qV$Y=>e!)E71z%c#^4&K+t6~Y+qD{8l%6ijhGQEhUf5(RjKLMu zZD?KF?V@!P;=kecf9~#~xMT7SM*d|w6;Q~r{a1^ z7Yf3ts{CVu0JS@5!Q#g4K{0n%gBxA^L~7+x8gdgFa{T`JCPx&F~b^u zXv>FQ#YJ0A$aqx@uhngmVQYppzR#RDk`>nt3S)#tGgV}0gOuC#CK5%|z?9+#PE%Yt z3S)2;>o$Fu%gBx2U6=3bqqxcy#^4&P+mL4Gc1=NfQ4P7ecF|dV6&Lj$WcsRfeWRB} zKiHaFFWq?Q{rwb|N9XFNxSnEPaAyE>QJx?;t^02-$~awdJ)5uff2rH!93}7z$q>N<#54*3Q zH$ZWfDvS}Gr~Gw_lG{ou*dK$#g(ow23Hn& z4MX1@x?T4mE9Zi$9Q4uAfr^WkJID-FVNKAL{XwvGy9T2AQ*Ms>=H>E1it9p!F~Z6x zPhif*<91yKUnw`PJ9O_a&sJOu2>^4p3XATCATt<`+eN1nP)T2Y`RBU_E3P{gCPiRGFxTVYqB5)Ax$uG^it8bTF=F_8-6n;(7DM7lHs)RSUpXm?>kWl5xVq>mJ%_of zz(uXqo1R%a&rw`S3PW7h_BoZgGVn{LarxSbsmwJRgL$!&+cVrYuAy*pyYwodMf&dj z*-*tbTK9}GHm+gJML9v{SNAp*3^Td(?uaoquHnGCT_nR~)_t(=*5N8$Pw6$6F*dGq zfpxpaGY{?wx#_Mu&o#puC)SLyah=Cp)Sr;~=TVHm;Gdb-PF!$vnE{z2cE3*F>>pjE(DjIJjMuw`6*~eq-13O|D5|%NQHi zC^(>|h_g1V^u~KfnOu{_nlU!6H0GijP3G`LXZ>fI$(1R#jInWD@c*cL6F8}gYY(`a z9%NXg2Lv7C)+#C}!VG(h%k;3_hHe%GMI+7tGYGPcv#_Wr(7m2YaYg zl@g4Pig5@9W!(<8AH4aKn@c=Ys&WX%N5wcOe#qdCyMEr-QV*4?9D?ytF%F6!lIrP6 z7o9uAL!~N*V0=`JgIiveL(khf)I+5zhhThEj6*1Ba-;3VFFroZL!~N*V0=`JgIlBe z?d|jYa1WKL9D?ytF%F?1TPscGj=!~y@KCABAs8PO;}8mxZ_}Lo_NomdU8*6fZV1Ll z#W=XK@wA~IzBS52#XQH@kQg5oV{x^R2KOj|EKxh1Le0(@KC9`As8Q(1#Bp2!b)5^ z_B6{wrRs)Yd{l9vqJ%V{x^RFj0t zl=8WEg}P62sfH=OAs8Q3La4gxu%>^taBjjwrRs)Yd{jxHQeSc9`ICVkCp}cEZV1Ll zHCd=s4r4ZI`jWMiJyfc02*yV>MW}k|7{2=HZzfOiP^r2h7$4PCp)x(}V^j8CI@Lp^ z>V{x^RMUj&L><;G1;08t%|oSPE*Kxx*_SoFg@f*|Vp|zUZM+bwe;d zs%wSHaDY!2tmtyBhf38A!T6|V2~}?$){p9!HP7-;sk$K;AJuh2W$OI9*Z<|6>pWDd zZV1LlRpFz0TFdZ<+05R8v%wosjpC(Rd5eQx<| z50$DLg7HzYR)m5k4^LbkJut^ZrRs)Yd{lFV%JBKcUp#*PTo0A18-npsRr#pCI_~(s zRURr;Hw5FOsun7fuHCond7;`vrRs)Yd{pyV{x^RM!LRj-=js z>o2>m_fV<2As8Rkd>_@X9}L_u-$SM9hG2YD3xvu@DN`qYd-wvEYNVfwJa^iZj~As8RkBB3h4ljiEvhktvKhf38A!T6{a z0~-o{L1>^T`pKqWF7{BVx*-@J)e@m9)KvWrU47jW50$DLg7Hx;6{<5eRr4PwY+UN0 zQguTxKB^j_x)r~C zsP#~(x*-@JRh>|oI)B<1pITbyQjJn|Lohz7dZ9W_hxNb{#}BIaP^r2h7#~%GP@SWx zLiU#yH+ZO2-4KkAYMD?C)>OfBHZ5A_p;C22Fg~i~LUp#Ls$B3$^KuWBsvCmwQLPZF zB2D%F{Iln+@KC9`As8RkN*`5G>dQY|>7i0}Lohz7n}n*b4(rne;jK4$s8rn$jF0MO zp*mMnZTr>5MK^n>RNWAakLnhoifF3ZlW+Uv77vxG8-npstrDs;G}SL}erMb&mny32 zhG2YDw+fZ|inBECo&L$K9x7Eg1mmN+O{h%o(D%$y@7(60QguTxKC0D1)dNqOlUEmw zTkWAzbz?QY_{Ym@=n^z7<;SltzHW_&O4SX)_`+H%R1rLBPOkau^tB!;RW}6Vqe=nm z@~B_`^4EV$d8ky~5R8v%olqHh{`D@IpRe;!sk$K;AJuxHIuTEr$A4J1YrTg`)eXV; zs5SuW#_+=0D;IC@P^r2h7#~%mQ1xLzFn^sKTGQxKm6k~H3&uya5!g`Bl-HBLx#9ec zUMi^^g7Hz=Le-lA!CW!p&VjaCz(DpfDl*)cBFk)9LReZ`@=RFE1YcI{2zPG4A6Jzul#bf~&(D#3`I7go@G75{En zOxIT(s+C@hpl{bMcloGxju`g-T@KaVUW`z6*DiPas2=Ve`TgAvRc|jws7#-FkB^GE zagRe~`a;3@O8H))GE&Ow|2X*Gy+Xy+ib16%(wGI~qqV!x_r;y}d8wo^3&uzF zHKFQ^C(T!9PiXj>he}Ok3&uzFbzt4uxnG|4&NW~6Qb}7DjF0LYLS@o5HJ175H@sBR zmIdRZx?iXax4D1dv;p^fsiZ9n#z*x{p(?_YW^~URzxGWpm9%BS_^2KL*5w;#TjyC1 zc&Vf<3&uzFpiuQaT%QB^0D})9$0;ww_uS(7!IEztm}gw#XRiBpt%awPOZ}QTUI?+l&h#o z2^~2q73TX=N{#q@A4=o{wOaal!Vxd2Qx*_~mz+V4aO*M=8Hle9XJyWmKgM6 z&FkEnm5Zwvo41A~Q1^yL@f>VHnKygEqCnm91@&|152~ljAeD*C&iPe?pk|*pT1Me? z(4s}l7R&yPx&_zkBr6Y;e!AYpqY7Aka8%OseDf;I=lQIayVcGhub*C3c}-VQF|T3C z+=_}p-YTGC;HB^QtIi8*U>gnVJkj!NXy*asD3IsD;aR<#88mxI5g6o>qblnf$a`EbQR=5ydI8ssb1d^+Zng^8CihU}i zdEj|k+|fv~v}^-|hn18>JjVN??CLpU*f2p28&Wz-!7IB}ZBQNUA&fuDgh_)%dz1yW zQ_fE$P*Ukt7|a1^hq6FPlUHf5J=|*G1`pBWObuepxHZsgB1Kax2bT_&F4nl83X26? zmBzBC65NnsYNV!tlmV6i^X+V0X;j1m4GWaR@-Q&(X5)M)s#*mChcw2}O1S=Hh>Bo$ zBl&8e;D-4<9E)$4Dn&{00%bhw{x#z%@&;Yx?AajACu4t{Ha>)S;+ zxc-%jXsBU<3RngJvoRYtY=oL&&_LFM`!&YUGJalhitc3yNDluqApUkM3Je~uL?y3t zj=iwRxj2f4N%e{qg?j~OZI`1YEc>qsJIDipx?vk`p}JUV*7g(O2@`IvoJ##YVr3Tf zizL#)(x$}dP7Nm#jlI)_Z!tK#xwL8hF5D!<(`eLHWh_=reT94TVLF&dcS=N?!gp>@ zgv$ZTFbg^MOe@)23-@)FCAmEhc_Q5$2U zv>)D^)PG~yy*`MAm#Tn22;T+|d&P^B>vz?Qdk{_=eu9KN+NrfuY176HkHT(cCij=j zn-^ZzM8HNk&I|uT>>LDHEgK#p4Vnz|0;f_G0#b+t{eI)#fmg?p`G2%Z$C zn)|EbGtdVh0zTy+}0G}i)(v8dt%a$CGn!!`Lu7#V* z4^DY_l89P@G$Ao4S4j(t17%yNlNo+&4TEav`B10&!hZkSC~vd2_voZ-;i9!nsXt3S zXL%*k(+ZR6Vk_FK;hHVOQMZ!OR~i};IIY2c9#y(1o@y#g*xQo!9?6yUO$}H4Q_|K+ z(Df7Dyj%lzMr+Gg(;71DZ&#cds+I7h01h z|AN2-JTDQO;VG(K2GMjXEqe{iZr1j8H^IzZP*rhLb?wp)0Uhp>q7T(Kc1X_+>Ky{A z7uVFUY!^|-AUceLAm%QuY2S~kqxvBTXAgb5k#S&@xjRN3JwilOFlMqZwqxHQ`7M~Y zvH}}ax$m>19F-_)c(!u4IyVKFHyf4 zRv+;n3kE&D*|or#1nKW!j1urhjiX?q6zm8YfBfl_Iy+RH{-kj?gnXnN^o9_MI;1*j z`SXt-=TLp@U`$xsvQGfW7(+EsyU;&uz|e0GSAG2FZVr_ZoVqz--KcS#Rt*JL z;>mRV_sa7}c6X?jI~WrdPu`*7gte=(x!{J~xAkzS7CRV2^;7L~yiifDq{E*l%`H3L zp_1cO;Cg((P>sPG4ZGG*kWwZk!LpAYDDCM`#oBw@`T{RgNw~!7>%?z=7C#^>k6@L+vx$ zk-z1tmX&|v@4K3cesl_8_Ga$l8s(pI;j^m`Ll^c;#;C~r&Aj4QxxDOiX?H3Rj8V@7 z20DSzH^?W`lwQM3DXA$C@KZm|=^6aa!Xn9i{mxEL<98OcnuqgFA(}2F4>*Te`!S?s zr)VNS7r9$~qj{60;59eFehB8AYI)`b`|n(EuIo|z1-~Z(cRIv8-~7FoiM^ib^F`kA zib>1kQ@$=I;GfwWJgju2XVM~av{?(RGY*Lg0cS1Fk{b6uD(50y_q;utr#kwqpUsj>9B#>#00=F zIm$n+0Vl43z-5T|2fz#=8-`)ADBLJtz|C;40_GgeW}Wno9O4U?xWT|2$i`97@R*;& zegqiowiDx|V|aK>x;Ri~#YFd>Q7Sr8yh!%ktrdj_}2g5Nz=E8S!sK)EDq*Aby+=H*|>4zYBod zpAR=;xX-_7!1du2i^oW~LvrI+oewwM-!2)yoATj?M1AGPsQp(y+=x1_e7^GRr%_@_bjR^>5#m@i)c+jm_eRrOmU?gWDIU$hO3L7MzQR-V_PC1w(R%hBL?W*t@JoE&B6&LnQvi~=it8} z!0eeTHhlmqW>88vgMyhM9Mi~AzY|WwDLAe15C+e2`+)KOICy`Eb3gF8gyVI_UU@y( z@3lD`(#+6cRzaPM9ET-6t}>Zf8IGskJe07HSj}&AP7L6k+2>iQH&j@d;ERQOjW3J0 zjGqdR19AJhnQ{BpO1#fk@5^eE_N^@+sg1i75`S;e$V3}VaR6Wgk*Ever8MePca#@{x9Km zLr|3x_TmEwtISF-Uy;Zx9hI>63lMc7yly{Y;|3XTnIKvw=`lrZJFV~|6A-~ZIC^^< zW;`d<#4}SOI*5v5I?%^hdTc)h-Vx9ADIhkU=`j*DL1B}2)yQIre0uSL*0A?n@I-pF zig(gJ&~{ZNB91KT69}*0h!n-r6N=)|XTs}NA%<3Z!isqKk!RwWQ&D@j7su0MyA-EZ z6rIuV3**CU5;G)e{iVo7D>DgGPw%%~H4_#7-gv5|INtV5BK*kpD<)-5Juex26HWji z(-bDWZYkz~m?q^Yp6&l4+{Pgu$>=k6XSs3cgE$~Z?Dxd`@H$>bMOZvDwjbttu3CYd z+lEX4thqQj;5CH14YB`iLN0bM7QdNwaQjf@tI99uBu_MwxIK1cajb1Zk<~U~erZ#3 z{X5}x)lycg0!e#SVbZQH+CNezIwsI{9;;W#i|yU4OFRQs}`S=-M5VKyW9@CS z(zkR%ol}fQ_{mq`E%-??Gp`sk`<<-x6>JT=6T#OLnI*w->G4I$0dMIB@w-G&)it~? zTrtJIWe{ro_#(D^;XY$lfTO6kmL5|xDbs@&q^p&d1RSjN82Wuc${CiO;8kJGe}*|o znIa}XG_2k!RQ5QkC>Ow{3g#QIsSN*>W0S5<9aZeC{~#mMD+H9&7Rx`N>6XYur_8#O^vlTpqOC`XCnv(-|CXplY;Ndvg19$^7)NV%3ChXnPpxUOO z*-x6ET>sDdkys?)as25kix^rWx~<{lM7j%Cs&EAZ%M$B1Wgg1{0yRZ3N=a0GK~Mr^uT3sIdH`z+lIaau5Ir8$N9dDY5G*^zZ>I6t1A zKpq@!h)8?aEIHhOc(F4=g_FdfHYkU<{W7>bo23=qsd}D--2e$;R-kq09R_2Fp0U!i zRJZnqAx!iuO4@G<@xy3Ty0cgZD|o^RT<(Q>v~xcrlr|r60VZ zujqVxpz}pMQK8&8*7qwy$YTc_uo1rI$|igSvLlghIAr1hpxfy)hN{y~{R*{ANeqef z+54-}lz7B4^KtD2wyUzB)LqpBpNpz2b*g@);_KZK>D#7~ zrMJ#XsOw%z|JizZJTn0YGEae&awQJ*-Ys44fIUc2GkpDx6>LUA_gTShlC3dmB~zr8 z3{$o0Hx0+f(_sp2olE~2x1TR%5BQ_W!Mx~{UvOQA}=e2h$xqQJTI&i3^V-5p^54Gi;Cl!sYrXX zWzPs8(Yq7rs_w;LCBol=@3DmAIHsa_9BUnGl*$Xf1;-b~(*^x3`#4JZxCyrjoS>w& zTOxY>)bP58rD}=vXS#TZDrHvm6|6Nw-b)?o6vJY2EV47U`cSX|x4mg8(OzEGdR-zj zsd#dx-{^Si8EFYI8@wNaPCBV#8Qc|5?dX&oaDdehrSxJVs9D)0RzO{^G&?VpEecJ2g@D0nLEPcaR%XJ~{THK$=A5m{+`D0$FNL+$u^om@W%KDyVL7ZV-xBXNWfm^# zP9XnL1uON%by(ng1wv@7?WNSseF6=A(v!%e>PwO95P{RzhKgHXQEm<6taSI%eW+tr zcq{~$aobu)7#X6e^#Zo_JAiD%XLLyEYr7ZI$NIm6iuIB!md7Et(K0OiQp=uUER+FtzsYEn#hqg5$PLtwuH#zkg7 zt+MruJ6K7;n#|H`GL7tFzoL2rDVbzuSQpg0V%;w#($~*SW^P5bVkX4eev1Juu7X7W zc|>07A6EVePilCu^;1-lL99YL~36$L4$03^+(c zl451hv|ud_h>{7^7gX)XR zj&s>>CDVb@CRN=M(elE&FmJvLOMFZGZ@(FLk9(O}(4DsB@C(Xy;? z`A#rrhyh_7zi;^sT0x53+v8Kq^|*gt0{~}KZu9RKZr-)ul0uf3PQ$& zLTM8oCb`zXIW3NV51LqeBAqX9ZuQ2{&6^p1#w0T*>8mjr;m)4af5A%k6nPG{qL8fP ze0)Z^23yZV3utf1SAPW<%y=uhd}{qn%dRO*Pwrz|eb9gG-EUh(ka7m>wy(ssX%@!s zQz*jkwSuVl+lt4cwxAC}zq2EYC9|qvPKcwn1z^Xm4`9w>>i#-dPenDJBUO1io^!?a zAfBqlz|x^h*H^cH(r6ACiq0Jp&{M7-wHrJE^J=TB zI|MAi@yZ>XMoT}So7%A#^+%5fPujs{T0h?ceLO_zVKzRJtuBRg1z#o1p-;(-(U_rytcDm3U&IGBiD2mh&d>5Sh{ zZ~~sBy0ap(%GFnq`B=ER`YMfhqd5-$u7<`pTS6bX`YIVg5M#nR74tSUUGVSf#=L#- zw^z9ODrY$uLlqSobtGvh$hAO@`t5K0kQ1{$^Q=tFLmG zgE3T`CZJLJDrPCC=f3*cuD(jWf&gQvCTM@Sq!)I+%#w)WlUF z8ZIt|g4^(9&i`}8q~~3Im8;-F!^27W6+UZ!C@Nul8{Qb#SNE@a$kkWr=3orfwc17L zt8jghJ^v1t?xLeu8BQLu8DnT8V z(pMqcY_sHYXed~UC%t*>?YAB|!D%UXX`gvGsq%nV0MYcpKaStUlMeq_6Z@o(L-n?U zF;o#?Xjqq2SbUrL?ai{ks&Ha5^E0k_15ADw>LSQM2vD4J6PCaeKEEY3N*dH6)v0bNdWsLaMf_i)mA+Mm;f%7k^@?xNREcc^$| zDb49lSY~50r=->4zidp=#eH5q!=XA+Q=I`S)ztcFmxxgDX-q_@mNYC9@sX|({QEa& zo=KM=S6XS7_Z)E{U6lE!_W3NlhJr!u`lr+WIEOBQb~b1J!T^C#9vl(0dMKA~=D2Wy z&KRZH1w|;whzmtPj|;6sly~B)tl#s6-mV@OWHF=1^&N!l(+u*9bGhHNe3j>e2*bJV z9_cmrBYdM6p67#S)1@Qb=R%!Nj5bFJTJZOKn1jMt!e~d$QKJmHxsckZCMgHQ(sA5GJ4)X{L;O2@tfSZmL*6Mk|Mt5;1Kb;d`6L^crAc%)a77gUJx2T+ zqR)=i?v%@h=EIdnDUv&ebJ)21ATXCh0~nI1bjYjo;Gx?O0<(fbGmL}NN4h9ib?Z4V z8Cghy7lv6b{tfkOApQ>SHZa#w#D#J4W$3UG%0)e2z)!8l7B^Yqb%0v~yWeQCT+bLVWwuG2qSv?(t*5Q9k?cW5A68?$9yd z*bYZ$X_QGiJjX@=64;0W*pP*jeU8KY8&5f^>#3SK$&@h~V4NTh?y}Y#UK7QBs?~T{ z;W4;Lw1;g)v7lDo?3pOFcczn8B0Zxl+<#mNW}dmOJQg#C;a+7}V4T|Dwn|*IOl$|$ z9>Ey*3YOu2D*i#)%gRWb;RLj6g)V?`g(iWqT9_%H$vCU+jlEzi5am@4EpU%Go)qB= z0&zT96lTucQ94VnT@7a|b*QbrM|^ZyaV?fDpFvDxsTC!Gh7S_y%WD#&FJDo2elj!_ zv;3DsXP|2`4cm0=;Z*V1S_U7~l&6r!F?)_ny0N~n_73_TieVykTcYbetNHCneHSQ- z9DKjEbLqa=!S}Jxa%Lj9CvKP3s9-09fc&dKZW@{(HZ>P*6bCFf#gQ4X;CmB(G}TU6Y2dmCKbndW1=Y*y!y)|8VAts`Y~_@*nSd`snzS#)u+qRaqFq7G zolbhKa@O{<`5FHO0WzM5*hb+=_kzF}JkJ#y>%{=EU5)2Ju}Qt~E7@379xS6KWjZ!9 zwPI?Z{^ZmaCKf9++Y;$}R>Kxg9cgRm)p~B}K958FNy*VuBelH{G0U&Fl)kmb8hz`E zx{KoJnV9nbNeQB#h<;EvZr#56YZ7TW@ConX)Wh&Qk^UMJZKc1$RL0x3?|%la>-L4$ zb)s|X2`PhyuO)1owpJ|BO`Vyrzd}!2R!c+$-|&6ah_=O>-|hr5`W8rp$L@&-k0k6X z(FmbvBrQ-_CiO<`z0wY`j)~o(N&C6D-OTcWlE&*v8!94)J#k$-9VLWd3mGXDS8F{Y z$zitD25lM@{g!Pk$e0Yv5TE|>C>Ey6@mWrhOV}!{>-W{qvPQ3A35Qd^LWow2yr@dB zMxqYa{ofJ|hp#Z*&?|vr%*U`{$;le9#|o`s+TpSMw5*YAf(QFK%@|L8To}G{8+nwh zuNUqKub-|wlLUxoW8eU$6K{Si6kl^F(C@=Q>)9{eZ&63Rt`&r3d%Z3JOdVGy#PneH& zXsB;YsI=_H)%5035Hs6!ejx z;FpL9P|*AQ<@Hb;rAdS)7l9)t&)ge7_)gs3haxZ`IKC&s39JUb48ra7Q2ie2Lyr>a ztLKBz0)uaU>oTkPNGGV1B!aKR?N6=fkz4v&nS$PlOpn`=_HW{Q-xa<)`TeB*+j#Te zFH5E^s9jQdt0fUyvzbu?J=AZku7}`Tq`n*MPz^YEu(iur+72E}2H!w+Bs7u!)@uHY zo?Tf7eWZdWYwLRll(7y%!--{IkPIT;j(5i!@8Wh-Yd7s96fcs&*An&``j)h}C!>3A zyEbXRA0Kc85ql{S`pSI_2I6#d37Co&4fL+->8ILPfhP@`}I%Yk=ujrzxm^~w&PGoMj;Lb0qz`Cea~XZ zGn@@72&{%px$S@q%Pzhkum?6zALZ?C(9w9hOsB_O*BoAdD||-*h69^!5Yr ztqw1@Z-&LPZ)Y737mcqB7fr4S7YX|e7d^o07Vh=H%kp#2PWicgi~Pv8`Zzqp$qD5( z;P&(}t~+J64^KD56C|W3g5zeuXyRLb{hTu7X`?64uj^xhMKr%wU&kcG8}TS84ls1F5#jnIF#b5NVuq?1O=zcPnBjb z6l|~Yl@yGu^oB#gL#6>s^F>$EBr--93;OK<9h1DED#!*>qloD@4bm*T{+GiZ!+$|w z4W6Fb3#nVeid902s=+r<$Fw{njaE51odix-P$?3Qg11M7WK9!($WFm{caj7K);;*4 zD{v})YgGKuX(*%R898|qcvqeg_Du|2+1qJf*liqxMEL)=B)PI|{0XKM=C=5myP#Bv z&gjyZy)Tw}<5R2o@MWpjF=W^sM5nVmX+IlpZoN2W?~EM;JAUor(xzDS*+h6eIPT7P z^x1fL{Jyc79=(&9X+iWQP(<7ZRm#i3gh3Xy_a5A9HNPH>M_;hQOrh`{7bpK&M_boP&IO9q>! zWD3gS_6rDP=vcd1LK&KjZa1M=!M#9q1yNEH`9mr(A(ecFkS;VKUHBP7I^TqJ{$~j3 zJQLD+pCP1vCZv9!A*3@+NN0YAkWPnAwj~91`ez90lms+5rKC>z3}IoUt-~t*3}N+k z!s`1O!s_jW)%!Dq6?Vc3e}=GnIAQhp3}Hd!(0SPPGlX@V6V`G5u&{jq4XcM~Sj|qu z+J{j}h>iFln%JL1$>=sTc?gdacEy7)pv&xvMlLOjJc1J{Y{P7`6SmFTUbAq?CFd+! zR2AXv;#C79b(qtQ$eELoxyzSS@mm9K-mYqxTP+TeIn{G#H`G-}md=Z)8_6R$^s>$a zCPie<%KGZM4*j%NUcpSegQ z`&eigMs;o7g1UNM_U*~c_O3!ViI89H_wOhWDb=GUSD{pTkyc)6-oAzulgYYLL5oxL zM^CRqgan(qZ&fR2VSEL0J98e`t44zUK{B9chmW7Q&=ie!pGgIt$ex{r2sGe&wz@(p?V5Q2ju= z94Ay<6k(_@gkN9gsw4f#!5AuYf^iq2;t~nQXn_^M>%QiyBfY0%*u{wPT-m7?ZAM?b02;p&*x5m@iHC>1D1uQj3EzRLn6NuB?QDTxcOxo^cmpKGmX5h4Gt~$~U1i&2cr0dIw6HQP2hl0PulXDU% z?V{9?xFkdK(=WgO6ZiO>N(W=8jwqN`N7}02?w*)>!Bt0+27xa{0Yk-EOB&A2hl0H0 zp5|+R+&<7%N8-qjMjfByU6Nr*g@WhES4;r>=)D@Hj^w?|RWSNkVFgs`NEd3V^qv`e zlsb|+Q{98{Q7Lt#^EB1puXzsJE|>{IHAFcJ#z(~oNcUES?{0hL8KsUSRC;MnFg_}! zjxV7Le;%d!j-6{{N3C^7O_XsX$0EEUxhiWjPTt*}?cgC=&rH&~5Orq3VcY zrG9V>X95i$uCy7bsc?!^tG}O#ReW8+yxp{R%K7k$2gIEmATK1waY_EdzAMqk56yKvU0yMZG{xfZ+!~NyFxM7+tDe86j8OT1^ zV;HWN4f9hG{vXZ4l?A4j4c6?+klznZ-vr#XTyKRTBaw8J`p-sTmwY9PZ3xv0Vc6ZN zd{LKPh$9~C+NJ_?oyL*(DF6INEssQo%?IYe(-kFq8o_0qjC?;lXaQz!MB&&u6PKM{ zGSUY%Mj^ot^JomPgL~{4aLm6y9RrT}^^ar36{5a-O}_ZC^EvYvaO@OD90QJ>>*Qm= zv0I*f3^;akb@^~v8V&t`v$Jrb(J-`hBtAKYRsKiWIA}CvmoLlX=fFLqv8*p;MI~i< zmQ}Ibyr^FUD>`y~!Ao*{!741Ue{VHt66wV&Vq4~;_UWbUggx3>sm4CdjI?{p9^)=$ zk8zi>$GA(`W87u$G1y3N$gG52hxzG+^VQZ|o?5{5wlOnh2k858EN*7)eBF;&$uY8& z6x5-zlwb>lHL^Js1ZLr>v?b=l)<@jx@MPsH2;7P%S_o`5p3I+uz;--Y1X_c_oMwPH z2ra}e#!SyW6tQAmasUN;8L$@J9zN&AY3Eb^x7R#?Fu@e67q zal5YnxO7>`ID5=gYvHF=Sfc2SHH7enFlgcfwpjyqVBM>?weX)+)_?=y6bD}Pre%%z z4e!TckJ-Aj;f$4LJUfTi{}!&^6-=I!u(b@1D9yL<6KF|s0-Hu=s8d{uwpvne;fHg+ zR;I4T%B*VJN)T3&aR5r&74yT7jcaRutBYl)9)f%BH)}ytVE5NYTTgTfDq|gd-CDCP zaM$qVmi<+-_JsYj10Zcl9l}%mPLHX?;tg^xHB~+^0n9Q)W;LwWDC-@t?xYo}Ci-j! zYwugu)35)v&y)ABz4r>P{U3ajtCQG{iUq-V5T_?+XVLmU%JT7=O89RzvPzT?@gm)+&-G>RSeOS_qfXHO;IxcGOuR%UN4!ZO4Ul7=hXF_aB zamD^?>WMNYMD~oPo|p-HTf>LGMY(NCjb+`ohF6sq%NnBGDR`_n2pJ2+UHCEnUeK~e z0zeo5TJ)d5^qN9smRi|^w$cRbOf0YQ`nh&BC=GQat7Q`>s63SKPD}!Z#Z-S>vx?*W6Hz<;fevJm^?fO8~_bVc+PfpG?q#3RXDaJ zLT!NXx@J&gwQ@CoQit2ZcW*;5&<9$#Exi7FaBOLGGp5nam_`*#EXz@ii;)^%(~3o} zMrN|;LM>F3jGvX>REgiz(=+i5TB*Hg2Ak*?J}7^nj}hGqfA(7Ty~<@0wh-TQ2Z{BE z&^;UZM%4{_!)jVvBrsJ_ax{5M<9!T{-_o0;73#>Pr&L0vKwQ#|qkyq+YPeL{38>}w zDwkN1HM)^3r?xM3UqHYYt^X2JBgOJkE+SJOM|o?JI3cJ-q_ZK=|$^@Q5bt)=p%eeiRN&7(-7>7MkRmUwqvO zveeVJkhp$MBJ)UzyerSv?I3C9X(lk;$S1h>`fKrPrNiFUV#TKgfsd>@tMSVbIjncU zN`|<9AS|kq2I}v|`fnxmpBmEELaALK&;f$F9XmeEDb;PwBmO~@V^qysF`dp%a$`% zR@#bK3(NXfaUmeObJ-lP_l-=dYTAPsKW|wc{EN~#>5lJchI^R#m28FpF%x86{)z1$ z^}lx0wvYO=!-4M9{#J-JzB~qTc>Pl1)3-~TOgn+%)cULdsdke(g3$IMw0jv^YXMH} zn3+f`#f7xGMgYr;h|FvBG`fw;8d&?}k@H9SOSV5TFw*#9;oGoT zyruCiII>+>IN>K@znio_irfF4us=pSt4U<4yGXB#^FN^7)piwoaefAH-I#wr5r$HS{e`G$*8JwWMADlRX(ut0%)qH>Z_fq zxrLuh6I!%*S3h*QQcfO&9R0 zCeYIXyfBhj80%jJog=Kn?F=`58Purk5%>~EpHP2WBD#B7Hx!?^*n3llIyWp#Jwfga zajXxjSpotjN!Nag$^z!goJZ9yh7X!Eh?O18x>W*Eyq$ahqkF<@7tqb#W_9J#cqF`T zEZ(Uw^xpnUVarTCk~;E9czNF?X#{qvUn;KzQvq zj0M3{9+G%$s$@JU^D3QV)LZFUJONGyLIucnmU_BB2$8lw9-$PlsSI!M&7yBegN2(H zaO757Ljlu`wYXnNd)QTiiE2(+@@`HP!b9>SEJT$h_(VBWQWYPedNfq`Sa}8ks6yjR zzm?Hx%1U=un)iR}FpK&ss6QzQL9rpUPgZ&#|6?C>2&Ja>aW%3zL_-OQRyljgP9Y60Yjl#rwJN zUJAj!m&_*~Y);t1(+oSD0qtes18Hd_@fY6ERe6i9%8+UsnJ(x+Cc08t)2LTc{T@1s zO-cjbU-)E$sSlApEwqH!@lM$MO|?J1(B$p4crKmWUnOxlRHphk(=9n&)^WLAR?_~v z(^v6qHPuTU_xblyt^HaWvs#(7JwJD`(v$k5?w3gAY8=I%t%3JDpU=F2A}o&VOGMv~ z;piVd9>F1RvGBdy#@dbjfgM-4Cl=Ww$AdwyQG7w?N?#zr#_e5+(VJNRYb&fL0)Oew zGcM6DY&w9SMD)Gdcr10S-S{li7 z8Oi;p;fcB=?aXeZ-}#D{LDk=lu7q(2ue%6Dsi%wRL3sUz_{m43YBJ{&wTQ}^tVL9j zRuxY#6!M%w6WSl(lz6;?h6N#G6NLdTJKL#(}T zx1N@ITJopxDrb3NiN^Rlc=(5S8kd#O9BhqAfQ^JVQo$WIHA?Kf8}n zQn?kncPBCdz0ns%4j+%d#7 z7=oU*{odBhQw`X=tal>%dnEVS)*d>j)=&b6=4nY#36qH^^t8rrk4JZ4X9vzxgg}^m zaxZUbNh0$K0)Jpuij9&g#aPUC!KS|Qv<~&PFFLal`FaLyYA)?ngX^Ff;;56eGl`!=Zo7TuqoWS z8yKnTpn_&s3CXqSX^0NOj*e{0b zIQ$n#PN>}2fOk*Ip@*%G+(WkNsc+x0YY84p`+@~s^i=Z-IoCs_GIRT*AlOPO<&e6$ ze_K5cVH;C~qxo8z5IUlw)WYqjqytjg;r!6DL2?JQP#I@WL8Eq+(Pr6CG1u@d;(Y6` zZ8CqofgIFqNh?#(sSb3ef%e)^2`ly=)DR*OJl$F_rYLYnFkn5g_uNlcetGAlWt>F7 zOfrNNT#|SBvxO&G>B;Di%t()W88OOhEl`45YBM94M{^!~9(1^f_i9-CGSHR{2usan zr&H3oU_W7|U^OSz;Ze(m`&^>Uurha45+A}FqP|7_>{LH5so1CO(Tf_GX?(z za`A?;^+)W=#cc>|sshf)T2+aPQhqqq00in8=9)#|$~&>G#rh2_^VCx-@MKx&jdyA> zX=@oA*dVZ&7Uwh>QeB;vz5BXcU5r℘VyaH=G@;ZruvkM! z8LYLW9UQ(HoYcuRJH&tcpw-f4C%?I?EMLT{VyO#ZQ{^=rkx{Id2SF*fS+J>cz20$~ zGpAOo^iHi^I;Xn)s*15wu9_U6vs|4Heb;$7YbG)WYO%`~RMpQPDDM?>mMisN0-^tj zv(v`b&R(!Y2$hPk@$d3+W|sI3bX;>f((rHdmAsuooT+Sj0*TLEuH*|dAlUVTnJ{Y)NSwxF*B&e)t?+lwnTMum=nUsSmO z3Gqfs;GVa-^mG+6Uvw}Loj*@$7YIfOi`pfOPoMW2f9NV?KI32v6&pPbLqXc{#_`~# z10S8?Dr7EpFr@OPJuFnL@ie{9y6G0BkVyqU<%XUQ7C#kBAru^-0T&PMA6E*Qq87*n zBN)N>!s7D3TY|66*!PrD$P}s}LZp;7eN?@Liseajc=#9IaTPKL4OOm!@ll$R5D!*TlEjeO!p{c4p&ry@lg>U3Kpx+fk#tc#HCrxa7h=r zHH=_sOX|6f#E&Q9v+0Dwb3z$n?_8Kd%gzI5}aBQm%sWQ88|zAbq2` z?eLR5)cJ4{!>Do|Bd!155rf=pX?N%GnlLJ>3*P& zAhx(Tnvu&FEU8+$ykg#hMd%TEQZJ6G!dIVv?I?KqJ*`8JX4EbHp61o!B(diMUlHvr zm!qh0dLoc-TZcap@cro8ms(xaAAi-WdwrWl!L(DE)<(CQEhMU=X24x9Ilz14wO8>oDpc^p)?D1lhlr9<99Wx z@OM--mX@n0ep6d>VuFuR8@7kI9E) zpK^LWT$bkE2f%ST+h=$i-H=kv?R;PSFW$3=?44tID3IOD)#6FaEyrAbtdLU!J#fl^ zmF{iM$v+Jqu~Rf>{@`?Y0HGo#z~tN}10)~y0?ko7;m3pXMt5q!V&O^kC*gLBhKb?F zW1Z%WF7MPZJRK_-U0%?7rsHxplsaOCcuXub7tvqBYv^$!M)70a7oi{QT?uny0Bu}q|Kqgl6D`0=7Gtb6lD_iCtNT+d)! z7sb+L1!ED-@XlCxSLwd7Sbw>9Tk4fS>kujjTH&1u+%gak^8llUzHq{1ZX8#cV7?S+ zIM#QQpOg1t3--9uUF-MpP$UF4wNos^vYLiFNycJ{li8n@=e3B9=PB0;bV=@`-Bg-ePxrGY7AyN6-Z*5UeuV9FLH!2CEH zSLzq4F9GgFU{26Hg29W7nI-G}8Sdv9J_5TK%6g@ve6q6n5J0W;Ci)MTo!o~&ilIo*?qKFB3_pAmiqViItfw`Q>C*%lHULIb+`+#m;FDB?7x^bmpT2+nJ6)7{O#dno%eeAa z^?bR)3BNJU#xN$>XJ=mVt6T==xIE)?X;*+@HPr&l5m0zVms}A=>a;j}ah|C&?JT%< zoV`uL7aYc0KB+`J$?IsmU{lGGO}z19L}e_M$6w!WAM-pu7pbLmgo%QLSd8bBs)9H%P|`@LPi*-kzWx@tpFlF8;g6Cs z{HLa~H9wD!ymN?#oJeq4Gg%xWeF)4oy6QT(p(D-MjpTuQ@LvVY5sh=g^$SaZslXM3 z&CDmOfpPpB=09DXQbMi92oMjI-l4wqR>R!}?%izvMzB|NO*yQGfVqf^KQKN%T`--p;~#hhGeb<@TY*@SR3x?y{t`Er?JLvP7?;ls44AcisEh zv3sO6D~+QdV>o9kICf*aP)lhd{^$##OJo<@So_%oFaE~P+2^6tI)7^u>I|;T6j8>q zyYOnjbv6RPMe&tZX5(f=&+5E~&z7#P!FC2v}kV2G2Bce1K9U^gMo zB(*m%x>n|P=7;1}oHsgJ(5)M_ac1G_?=!alvf6HEQYi514WZO+;&g}!k5_c-@=#$W z(%)h@$@PD!FT>T`>NeO!<|hmXYJu|xh0jj|kBF#HOz4xMSXWz|+Ul3T1=K!&-!ISc!whYba!OUhaEKkQb6hri(E>~#Radn?KU%X4w_w)St~`p!ysTnL_44+`r55Kp@>_?G zqx3537c8!>s#x04{rP5Fr3m=qe?mqKCti|SM$c`N%WK$dZi~$ z^13x@%J0wkTDzJz9$BhLs3=X*tUcKG2wjvhT0Xt->K}*GC6GragRVQYU$m<{+)k@D z%H=xqieKeo?pWjp#}#uxZXaR-sa>$-`Z*2rD)=u0PCWoL?m2h5f%E0#l*YgO z$8~`SJx@+_ye!msU;^g7XcgqGSp(GUyfD3yp~q^3TsoZ_Sau)drC2OC*kSg4)X2{? z`#xgC5O*BQ7KgnBV3gsM0vX_b zo)1Tn(qrz2J!ZNf?XJQd;X{(^|1lq~bO;9yj$wcFVHU2eDAMGew<4J8&!1%BV3%Bg47!Z|N z@q;hNo?v9dXRIcAeE9L{6F-e}XX8ECEc6PuG>%*MLc<9OyX%xppTc0xT^vU}D~sEpkK($47IXbE+-$Q4r~6>L*tGt5EgKhpyhj<1 z4XDMD9ab=5$B~&a>DlnBGBrKTN@7P`Ol4CNJLpnPomx-P`Gt@RlbJq2v&7Eafhwf)x4mv-J$@ZHYsi|dQ)8>%`UlnA23afu*A zXAie)9wjKH+DDDXqX28GZ)|{|f3)F-8+Juq!`!*mIAOfKBd2QwYdZU*jClk*4?S+( zeC&Gg_7iMwemRLQkT+Zn1L5C(jFNVaRhOS5Q5v$UP>{U?=|6t;!p`pa;R3kOxZ{VP zDhIt@;T;LM z+K3XPN5BuiFqhkY@&R&%UvC>l!_P;g*@9}pswwqT?X{|U-t2}&^@uZ*1 zBvg@V7cE-0nBqUqr@!7SRC;c;^%414PreWhU+{WnB-G(0BR-3SIx4CcS|VI&Q8nk6 z$azX|G+xf5TymeEi-hWv!<23U$7(m~n#CU_v2m8qHSB#kOOW>9%8JUGykl6R$v5uS z7{1fwTLFl`ox4+fMpgiP3oQXcp3KG>iB0BGak<>_*fg4vwq=DAxD@mR5OHBrGgW*x zh6TX}77UaQDjhngr2Uz{Wz>&fx}>|epy-dE{VSjUon3@sZ>ozpP2!5HR9EdA=ynl? zy}4ZkRfuUi<6mv6Vay(S{L(L}E<&e<5QXt+v#BnEMMu*#?a*e`MR+ym1mk0Gs*8vS z4HVvg{^XO!2eplvA5@26@_*y+_uZ?SLN0r2clfWPPUgib>0@0cSyBM~oHrk17(9H) zXB%4%8Rc0cCFjT57xMKivHc&m+$;^N%MhOrP0s4LNy{DKS9Id+<51OEXq0Z@r6s;5 zem%bO3?Q!&|NNT~WDURTF^mN_!J}L9;j(VX{xWdgO|92~OSq-}F)}Oty?JoiW5Hg? zlW%3=WGq-Z#5d;FLHU0?oW*Jha&RW2IgESszysP~5xFP0C00gKxLbs^#5g((cqI0g zHLKykZ~r5o+`}Ic+)Vt>M^Gym2F@7WsD1VZ_dkej2VtZo_Bc?KLAk-iQ(Nc|;Bf-6 z`8e4kU5>#mZi=%JKfBz5E9~WE_{B#3@=-GAtKmAAT|OV+l6Yt}J;1lAz^uS8&dgF_ z@f1WIYI&s_Bw#f>xTU8Rjm=!ff~a8(WH4EOJ-&|OkkL5~70Uhy`T`6_F$TmSY(?UN zcnOA({S%|h3+uY-vY53!2`{mjx7X|zca8v4Hzd0^3a;TO-y5CsN^7)a%dH5#yu=E| zW@02*sUp-3!Oyp%<&k9xe8iLhB9caaU?`j}pKr&IYUJ1j$SDpUFDS=wKZe{wZrHI1 zevxZ2ESn(=JBHkp+?_vbd&4KetUQ3FE+X(y7L^23Cl3hLVO7Y$;)Xjn4CDn9nl#vq%dHp zZdWk9B1Fzk^HM?LHg`mKmvZ#12$}IM{R;(+udgk=B<+sq%=lJ~=)63if?g;{u1`}L zJ@XJSmT9UW5-mF(j*o=ly7!N$$s7eKXy7bD{bI51)LK z6O-IFlj9l44loUW3qUqXNX1)a^_mZ+U_em$4p6Sy}PTB%QYm3OlheGy0HZ5vm( zyCIxJ2YA7>l0+JJ74BYk3Z`NU(KX@PS}MTzS3kv2@R_we0X67E=4u?Yw6fTWzEsy2 zSX}%Vi$GgG6btu)O4duQ$H$|+>k4H;7abavd@i`UC=q>j*#M%#y#n~b*0^3F2ZAme zrynl6Uw?0nSkZ$GxTd)Yop~eyt()d|ah~IWWeg6^u@d9M{&|qG;?ax3>u15D2uk96 z_hWZnc*8`>Uz%V)Hbl0Wz7vi*fw4kKVK47wHF|NVleODb`FA_B0Usk&wYy^kcijE@ z<6yR-ds`h@;^#eF?XRn(>i;78EmM5+m2Uqx$ibL?V!3wdjNed@Esy5VU8Q%q{og9( zh(6L#S=vSQe@6S@2XFjWf!qI0b})v@^kf{IhJtLBG?i;Ee8BDhOrN7>G`%fU^?z)m zG)sRo^=EWZ#`MSJeg1q_-0&EBmriT#s2ZS92DDQ<)Qg-(P8Lxo6<}uM-SUG zE7*$du`1D=mYOreWqTu)qh}$Q`8b#DU8@|mkgs3l z=a|`EP%|l%pJ8@4zy}|LGPNhyRZ2Y985JduBdS-HCJVUMs8OF~F28i7*&9kpR~0Mw zA#z(6jkoeCm)z&)!nORH2m%)%*zckqJ+JE$g-Rvq4)M+OasK4bz+9oFPEOJZZiJs} z&4l}nz!)jk!430y7ia|TP2iRg0As?<_8tM12Av8lp) zJF#&ia#Hw=vcUf|bf#B@S`M2Eb$WKF?$N8FYmLK3pN9en=BXx>SOc1It47_$+y#-o z3PXx*dIK!_ikOv|g5kkc=rHg%0eT@#Ct0c24kXeOFeK1A-}J){VWTT{QT*+I6z9$728du~VryS6) zkctd}ROf#0n!#@0Gs(dik^4gJqWT`P2gWc_ead@o-!s&~kjl#{l*p}ln4r{@lXo>r zFuv6&_C28>SqDw8VK-c-dLzD7@Bu^C?Jph0%yR{GqM5(OF#hUr9KXvw<`uskEWfK7 zC0*S^KF?G!Qv3=q4{98L1UJf5T{ytd zzyH9;eHv%{%a+;efcu-qkWP%8OyJkaG@pFGrdPYtyB}S3IjJ33Wx!=2+;_g8M3gHP zKR*XH_IJ8Z^BpLCqU-MS6dH`9l*c|#PXe6(1p#_WAr!2oJ&mlTb8a{WR_vfUWX2Ba z|3uFB^I8@)i??{~cTVbv*M0>U8YSnmBC*_g;HS%L?5dTcOkNnQ`efLtTj#vg`9=$-eyVSNdW~;?j@=2|%Q?Nwbnu9w z-pTW$-y}Vx)T42rijC*1{GW5q(ovqm#7P2p<1KfF)3Ng;NAz~yBp`Pfp=twP#pILo zS;cvEmd}tQ4)cfW`)*zgM|8Ee&5e~icqsn!343h6{`T~K5xpO@6z8?Y?Zd*_);F!F zirFo(wib^%cl|WW-jT5DL3OP|1(j}WK=sfKv|FBFl-pz+fzQgq?Tk1o<&be!TZ<(y zrm{Q!3q*Z|195dFZf~(sG*Mp{!=}F83LBYtfsCvaE594>ij{v8HpRTZ4V&i4br+pe z6*;HwqR0&Q2&6$+D{GHKXP=bh?VQOV{8Ex)8UN1t6DFQU$*`xli#`uY@QVpMjfG*85y?w57~MvZr9p z%!*4m8`g@71&eENP}c%zR^kwfdTi3{rx~D!HsA4CnsRw9*4d3W6|?8oLXlwU969+b zFnGjpJ-@5wSG;Uc+11loLmV<o|L>rJD@D?Q@YChx=ztY7r#Q zqZq`|4-BiV$b!TDC#HS}P5DY-4(nxxwFZ}^yEO~$$D?82pydlTF!67Me@bUPmZ|H3 zIUE51W&-{NH*AP+s-_>@pFSJ2I{2q?{2Mk@Iq2u}_vM2Z%d%ze|3XGA&%((}($L|){9}F%?2m`npohs$$2xq!5V)Uc?3s9X?re9(Xk6jc zFdm!tV_RmzXDAuzo7r(Xz#&i^Y=fh^Xoc+`R%)lC+R$1AYuSobxC2TKlFB+Wlp|~D zRanr2@UN~?KTB*?c(NeW1|N!V-V+#Rs52PW{GAI7R_5V;s{z2d4>8_AXJ;6(@cJ*| ziM7^vX3bd=^YyGsc;i>gUSFc#7+t*eS8t3l-XiLa1b8dPPcpNhGPe2&`h+XY1|El9 z_`4+X7EU5dC(T~{7AyFtcxY8%^;7f$k@z~E`yXS7nf2TFV@ovfcAt7csYlHETtog*K#Ndk3vD; z{3-9+F@;onD_v-IQ=mbGc*aM=8 zEPju^D4mL1rGzCc$`awleKceNUZ1aG-Kw@0XR0!eOtp0ZRAiGlwJKJv7FtE>LX29M z4iFVH|NlMrp6`20Nc{b#H^1-YeCIpo+;g{c_j`%1Ysrf=JOo_Lh7(LebX&*eMMi5z zT`OYG6b}z4Xsp{g?8!H4-|jQc8_TQ}FEW=L@#?pug(0zJ9UFw^C3i|J`^e7T(e;^ zKSb(x78n^#2VU@SfZ&saX^saZziSAJPG9?-{d@Fn{c07 z?6A)w4Zj6z6UHp9SBNbZRwpb+zD-M}`b#jbEJ}itZO%41ZDK|m&Hzi(X#9AM4J@{F zwva{|F8T%^ug4EQG8lATGN^HVDU`*vTO+tQrDR`Z`B1(mjY+E+6^akC1}U1Hf}&|p zc1dh1PfjrRjU9ng8RuG!H(3)I9}-JFc?x{31g|N z&Wk*G)QT?HfEi03%C*3ZXG~5={A+;HB2et|NE6i(FuB;#ap6C1=Us)6QeebO-MQL@ z8lRk%9=YDP(#bn(K#|T*jN@McSbU=BCpVf;d*i3C57=t-VWqc;>O?13*lpFM2j>gQ z8L-(M;@qyB0o&anPTKPF25K9y;T_`KrJP*=nFxp`I>bp@@iSo4+vh}aEJ6{8C5xg< zzZDyQKi;j4C%W!i*mzE?Ivd|(y>H_ao3?=%H(C2;UX1%W-g-6n`*x$T72Wjd(dz@| zy(6lrxz8;PI(0mXpdsx$L$q(3n0;O?iyUGaY$mk|zKcL-{(G$V&A*EdTLZ+;S+DjU zSsmtvhSH>J^3G8JUH(VmF_nZVJjpvt1E0LaesAg4wZQOXG^p8ODpb_D8$kV^CZVnBkc zROqJ)tx{-{LfaMkQlU<$+eOMr3Kc0dMxiMR%}{88LdzApU7=qo#D=l>u}z^@6>3&! zze0IPKH=!6(5VUySBTq)gl>&OOnSjRuh5qYAu{b(ZY>hJGZn%_sl{EOP?bXWD)gvA zI~Cfa(3cAJf;kpHPE_bLg&qV{Y|@w8$OOVVe|sd~dy4y9p-wQ;Lkve>K*BLdp>y@? z4*{`*pC4MJxEesBOG=@iEA%R$Lc{S6An~IKkVyGTzjlGKm#;?ylCMJ)H%_5T0EvEc z6{^#(cPnnSLR<9fUljKtAkp~?#T`)Sm@dwb695U_V8xA8XtF{-Qo7lSyHcT_D0GL? zty0{7Da3*oc>6075Y%2FO=?p z;<}*uDt?SoXdEDscb?)dQD~7u*jZtD?@?$qpkXF&Yyl*x|DJyRJ0Ow#mEsOTO(q(g zqEIm)p*vG?=PEQ?p(~Z{2E{E`$gI-#2UM`A8)uuu&vu>om$eiB9R^h7PG2l8ISGLj z<7&Jy=Y{I%$i=WuZgiwP@lrW2*?lwdB8GHgsp{3S#9l8l{tKsvKbR2IgVh@>QQByZ zKiqSEYQP!Mx&xgewL1`8FE#NzjBl7~Ff|bk&<0cOr6!^YZ8{Vn!2E8*qmT&@4RF&3 z0XP64D?~4~Y$H8OG)$Ja7vzl<2fl5Ww+eYP{p&=-TzT6i->UFd_jMS=djxR}5V6Sk zeZYJsm>OYVp93ECHgC8uRYrY4wo1qfg{(&2isa2uCmL4B+bI4^GESY~U-da_Sjb{tpyk)7sb-8@L}E7bCU1fk9vjf*g6z zl4IL44xfdaPGhHLEZbPsCmO$LFUo4p#%RO?6xZ6gZ5cb_;ifznz!dOqh$*1mRrD*B zdLiJKQRZE&=t5wLH=#I>V#AG1ze5wn_&7GVyi-J8T4+mlMe2_tKU?h#r8mZeKT^9N z#?mR}kPUwW62V^qubWDocP|Gh1L{9T+EgmdyI|yUgSmQZBDX=L7X|_xbCJs~UASpG zT5~3dm*)0!Tn;}O#6dy7Txe>01%x-0+a#oDoL9Wqx7yE_-yY+285`0CsIT*wUXXl zG2jA6O zlV7l`n$n9P-Pr-nFC1tMH?8{G#^|ZJ{p=xrvM4zT5Xe`I6%LHleukNp7Pf0AQ>6i))O#`Uvdj}vyKNaqp2AI+V*tnGL!RiCBir*pxXhGdK71Z{O(B;D zYJU?D;*bsZ5Sd)F+61`C#XXp#7)|rWww{gg$mP}aXWqurb0SP;(t3$-(;r%_cG$R- zOS`klm64CA9WR^7)~nM*X(^=y+D)i%E<*0g^zmnG7`iVV-r0dUen8wHwmk@R$mtuBBU~ z_9VP(>i0Gg8c2QCYT>5&@YQ&@7Y!_@Q^3P_OuH-1Lt8{_$ze(1cqfWbex#PiXV<;U zad(PKuJMebO|G1j)%_cXo_~Umh!t0@)$KndQp*NjEb*Mlxhd}(FL4Wb&r1y+6|H;z zoAjmK zFctXMblYB=nuP(%fOp+Vo1?U}Aj-16`x~$>;?%pBiA=7kqIWfbP3YDEkXFxc0GU<~ zr(D8KM>>VLuFlB{C{zP+T4UU98xc>O+z_8GXAsi=z%QV%KVo$h&3Kkq&vbRACJace&}^T!wr-V z@(~7N_7dE=imO!IU4TX!y7%=f$5(`dV<{r#hl;ySalck*vwr0@7$UDXY?<(m03`CJ zDsH(#59n837%Lom73zsfM0jxnz5QCLP@R5#SaGi_^o4#MfSOgb@&Jh+vjK_ZdjX9y zaj*suXZZ6&9On?+=ZcG>Wg@sAD|90uk@pKgB9CJgg4?aQzG%n^ZZsgFo36MT#r=ok zHYsk8;togSSfmUDBvLK|BwF2|U+>YcZvYx?LNpBB3xO^KBvRslY#b<#Lz{xzskj!! z6`=Deypt4~3rIL_QQS_2TJ&pg41EjlP(Z@r_EmH3Lof8#%hvt?d6);RBsR;swQADV^Vu?FILJ_+_C3S|s% zaKiNj2D;&o8obRW^1cYH?6zw{*!vYfIQYWFV}W%Z!4qt;46=AHw=7lR6x*8hv`wM- z{PiY$dACWGX(t>J`pRfxo5qos*kNM1=4s(7jwR9am1sJ-Jh3mjv{9nzHpYvyndONM zd~ME~P`o#m7}xclO9o46UF!nU;|wQFQ?ziK<$KR_Rx}PA$H8 z`obkuSQ0m_YWm{o3zlG^TN__+`n8-gXpaWNRS%i2%_WkVzGTblIBVs?nTuvsPE##9 z&WVfU!4;ntUo>q#4#ip0_CW(V^!#U4WOs{+|rG&iKC*wcAtR z9f1FZcn0I)HI&2fjKXs!o>DyH@pyP*c-SPq01pr8egqF4r*iZ0=OCzJahx5LuiX^l zYCpmCR*2i%1XrNY0EG$_8mv%}LL99XUe+4|(J%;9s?d0aJcVKkO;(7dPk1j@=rV;W z6q=>bT!rQy|p<}w`g%?}sgV8U|^j9DEP?~~} zfMYENSqNNQ>RAhD&xE(_8H;!cjZ+%O#WMkGLOU#AXbi(H^c57#+3eu-f$Qgy8OAlc+gpTuIAKb#Yq z{#jgWY#t+>fDKtR>~T3KG>2u;FcqB>n%(Xd{{{1${4;m~?@p7G`@ZXkv*g^HC8s(~ zPMd4zGpn1l1@xTBPFpRXNo}qS;gRd@kolElJA_$PziZ`GRpaEltEO}NfkW~5p9~Z? zecI-aqvFLTa@v?#cRiqTK~?-(bAmF?S9e4dHRD<|H5?+~9ZzGnO|5{B0W2;ghrf;{ zdqY8RyFpe2wtuLz_1kEK&<`Clqtf|h^l`ZM5=z@tXx?PqHJ(GS%tqwFjDz2s9ixp>uS>%87Um@bu-!fXlTPq7S~G zo{KK9>60QhR?5E`^RH|&K9=Gs!uh<90!7zYW@D<%##EV&sWKZ= zWhSP0Z%Yps%bShoO=NE?NO$8~e?0l2Rrr;_Jp@Ps_ZXmDflH6N-ZoKRjU_fmamXG+ zd{9r>yc17Z+{9Ckc8I4@_0-xPG)m&Q<0{ZOcNkO`t|#2~21Q5gsxZfaOFP=y)96?N z^4q0FrLA>AJN;`XKFEUVBWU(mD*oAhmuKJy9ZP&(n8uFKf6f}6=l5M`66o?n1-5N9 zSrDexo)<2~8?97X*LfElqV3!ZmBw*VGM)5YXb6dU{*@0fsLHU?xt6%!cezVG*aK&2 z7ReQx-mRP8clo8#(66A0lzs_~B;677ir#JW^pC*iG3l4kWYX1dDSpoHmkbu9^j*?g z;?zAa>|$%^Pp^8*g$CCwTQ2E^*cbCps=ki4#IFpnVvlI$0yL3))Is*cyZnY$=zCyD zYeKkh!MrHhH>)+{NCTxJx2zz6EyLOEx3+i1JAZ;Iv2~SO@9ZX0*E2>IeW!E!i;Ief zmuP$B1QVxo(C@3Vu^TLyeuSq(|CIJf`c>hfTj1rHs1{$uL&t(AdoD{#48s1eUCGv_kS!6<PcFLQ>G`S`=vs2ojT%0LIyguDjskICGQep(50iKIOHrp-8izCC7&U|@ zKpja&tFw7d+TRkRP}YX83+OGVL$9Y3IebnBT<%htYt-#vWC zb?{Xvf-&3*kAFTHi$^-yMig3*eTIKN8B;e%hIO&F9NO-}AP`K$Bd6gB#0pa&H_I4H zE+yaE)6vhsqRPnCy`or)g!?0ios_tJQw>Tu4*A>S7(8L{FwgZpoWnQU-7r6?L}=q( zqu2^ova$M8_9P}_r{3oH@m{ii(=`w@DN%0(ddXWU-{URp2Ko;2k8tv-)mml_%WRe( zUm(+V1zu`C&K^nL&lUUS4e!M#m|N0c#H1u6y?8I?)n@z4T`@c9ws~P4gO~COaR8x7 zCCs!P6>Z&CUh5Bp8OE4`*Z{8)NI|y9@QyD zj}Vuu(|^eT^l9oIe`d6W2dlg_LHBlJp_$uywjYV=nHkc)kUhi5X9CYO5GVR(8E7JY zD-C3P53b0r`?%0Vin)z*3w6QSE~#}U59)C)@gMC61Srto7!j+S^7y*f!-y|{ThP!*oDc4}9Qd#Tv zvcy)z@3;xY?_rwR`Wj6m*MOlZ zX<2f9K<_@#TlL)*)c5LG8@jIYb&cQN+-vqqZIOYuIj zWMu`6go_JC-R`p1H<8V*bQ_Yfo9o~oqEd^A8CqG16BzAKqAc+j$MrK$guWsEQv|2*(>6w{3 zmb#x25ly@i-S-Bpj~{$5xst(ymaXv!60qc>B`15~9bU;-SNFpTTIR*-p5TzUsM}yX zsD37gZI}o#6?pPPSK)WAf!b6xmRv`h`Lr1H)=2%YKwqBNN<)yqfdZ+=Xbg&5jr|O^ z96onV1(pG{9Gsnlnq6^XMYN<9Er%%{j%jfg7E7<^;YcE?g*N(wMj^ecP8G-vWFKz>k1Rn+4!Aqpc?#2Lj3|z1)luS!wNkCNWOAzQA$B0 zpmyR5NlX1&lFr1FMOss}c4`FckDxr8hq^WPK~ zspBc3f!fGRu3)W?waTsWUS7$cBXyU9zzes;VC|Owm~gU7z;F!8Xr`zU8RN=;7(LFG zw_!-SGuD$+s>JHC*X*Yia$}^P_tZJPy~NvC>lRD2qFM{8&0>ri6bAAgFY%?9td=%k z(-Aa>fimjkMC&%#=)4cX1=baaK=_YD_?Ik{uwOkpJ>30`p)U<-cpnUg_v&eFgtaCZ z*7`+IuK6UUkebe@HbUdp;+-Z_sm`VV$*MaqS!1$KNuw7Tx8G~Uo$qf~zth~= za&k93#_MgReJ=D3Xn+%9#dEb{eb9WT)zY+)EBMSD2M#8oE)+L)%Zcfdf=db25E}a> z1zg$?wk*r!0Y_lP%(Cyvc(wJ*g%|mHnKrytX4|qyL4;BV;~{$n&^)F#I0d|kUyj35 zfhXS_Z@<7mqwyOk=WWUEh|mELB}qCoU1*tYU}-|qV6&k(O!^?+(nb@fJ7=$?#&)@+ z^ueV2150{@O}f9DRinr$un3xN93ZK{lOGy~-{}T2d5AYPCH3ki^R|?wEUmXmbJv$dfU&N}B>G~aID7!V*mJYnI`$ZVren-eIru$Cac_~2))TN=!#&%6S6 z3C3~l`z%})cx8J+s~3J}mYH)a)BTucL>y$c$SQ{`pJz>*v8Woq#I&c{43b}0xp)yr z%R9`_5kgGo&zpViv?Xz@@|=(580}oXXw|n|@kLiapX!D4uB@(H2 z@2W}@65PZ+Z_#2bH0>aBfVF*&1&iPd!ZyEBGeSoq1y_1}hs3d=5^p-5rno+4{yeO# zwLZn$jXh;>dAfZT-g1NVsb124j%1jHavIm`n51nlf_j0@{(GJjBO=nlnZ+l6xEjO0bEP(1*uqZV+r9@+Hh7s^z95I-un>9U7 zTTa&rPdW`TpqYW?R@UX=e>x2@;?B4K^YLFU;pDf@x9;2L&-JonL+8)+-Xe zJm{Hw5Ao-E?@$`fztXvthp0v1R|QdUSDf^-5B<5`1(wU7>m7~3XS&XK^1_^QqFb`! zqxb!}-cqG;e$8Tl;JV<+3opelb-4YeuBZBIP%l>+$Mu4Z7*u@V;(#SdUj3*L8{n;C zp_i4$ajmd&SPkZdIXOjL@9Q~wxW5MVr%L0vZUqe;1{A=>sVZuC>Tf3=W3CBYoW`PG&-HD6%3p)}mgPD!U|d0|d!F9V#$(}o}=%rjOO5?bA>Ji;Bc=Ey=+GSFlann1`9iv>| zDvjfM-O4%EaIwWmt^=Q*dfTzewL@tfR}Wj_dK<1e_@&_P{g+(PTe*%?8pl;_eP@f? zzbLV$vEsqwlaaLDvtDgo~-n+Zg&O*QHA1{IZd1R#N4K zdr|;ggbp7#&hV*OuE2q5HU%AF84gCsE=M@+(PUz8f-Fo{W z1qR}eIqD4mPr#F2Ul0>&;|>S*lAM!>dB(lszhK--bbb)b%~nGnbBc{sA5%lnI{ElO z7S{<`n3Ej~{tMTLEX?Cse)VG{S|=a3W?|x4e*HB~PS&b#cL$xc2+UgVxrq6+^(r}9 z3vMMXKVhv47W3G}GFXm1hd27LEjD}cBCO5MCCV(n&fw5{fGpmK&b}4eDwDgTkf{Y0 z`sVas+pf}Bi!V7im20ViE~uQeUxvtl@{A-wH0f>)rt=^JS0%8Vzr9;RnhtYp%%4Ov`T)TbM9kib|xg){(j%@ zAHRW}oW1io_i^sI=bpJU_w0%1*0t9+oE@2wrk19(;l5Ots%xmNOLf#nOUi5K z)X(#~?87#%p|+#3u4KZ*JbZn60hiKL*PM5S3u;fL+ZX0tAQn{4KeaYh*WR4Zfx;W> zIvSf(EqP2_#@y7xey+5%w$!Kkxkj}}wXnSU6%%0^QUhaVx2IBhHLGuGYfQD*4p52% z<&#I_+=kh;sRilwy88THl$YA-S{m{SrYm_#vYC0QvSE3tjcv8_>N@7;rM8pOT-Dx` zPALs*s7u%7ft1qCZf~7eE0sRIs5n zf4r#T>RVf8H_hp6Pt|s$+UHZxx3;9wcX@eu;q}c;sg`sCGM{Fc-lEhlgGvPs?x%5ZpeL|F^Z1v##~ zT4k5vy*4M+l4>WRLR4uOvW^an78(iZ*0~;AsKIP=eId}xrr8UT2aK{Wz%P%Iygu}1 zl8eLwTBL^7H@9}=8(IPKooB?zQVQYelJ->nd?^e6YjSAz zn*o~8K?4U$)C!&BLFCD)0sUs1O`fo5QWyZ|m>4`ruD6`%m8CNF+i!}NmkZZw=7=G1 zoQ5B27*nUP17!q!{teM-LyY`?0Y{496=*uEk26ofPbv914aw8B!8j{}out*6^)aZr zS9~U6zSbWPEQ8l(GRMAL4_{^dH~0$!=_^S}Ds!Hk>B|1OWd7bmzvl1XKMH)N2sKc> z_Sy&h@1A!Cm`Y>~R2BW_WCq?)9K(;^zFys?`UktFHd>x3tlflUW4NH?_>|cv(k|M z#<>@e@8k{2`Ppv|&X5XHRA1CO>k2qE{jL8@EGuL8B|4$Jd=gVLM>Kq^1fGmxJaCF( zJkFG16!A@%{L;^#h*3PVh;L~70m$S^qqwJNR!7IaQHHS?xbYJvRXA}Y@#T$S&J@Fl z6ik^pK3ZB_?ntfyy&JeVRuB2>&GrvNl_X4w1 z;sOd6ome~xv^rWq`~#T!14YUK_`~^?DTMe-^;-taI})esS5Z;yM4pF&hGRu8evn8l zz#q=9bb=FRjKa4!f%!nPdV@QxVY+SV5Sw+H~0?dUTTuGU;y@X2w zGdCYsR^h7P2o%%_%(VwosfIz#=5|adb!KM}?ge1}LJh*9anXuWp_L;2DEv7uY#258 z(4pH=HX$lf#JL%NYJu4-aazvN@(QP1D8C)R1W3R*bbb@doy8hexNs0KUp_?Obp1+- z%bfYO0CyKKM;<0{w5ZDMjZP|Y%6Tqu{{hTfqx14Bb<1x&aFvG}M(YuIxUv$LK2HX2 z6EINI!UtVZ4tI9n{UD9TO%v74>wa zUvacy`~V+1^f;PS;p&fRxOOKneG;epV^Wz@ECx)EaojP6aREMbpjooqvQlS;RBi&8 z`4XqgEh#B>3Z@9S?*OyPlV3@>Ge0VKEiiBA<4P)=;xoPg+@fVuKG&d$(wqoj0_Qvo}0`RBkKK?4tm#!Z~)Y_37-Zb}RTapHa} zom8&A(_a$$G~lultK?VI?l$Bk|DWdNS6NU{IliPU>J-dS;8ytJic6dYlkVIB+;b93 z@~bSU?8z@Tg7m$f{34_hyr7LbW+qg-bl_1Pf=X*@9+X6UoKR?Yk~W|#0ohVSAGya{*xNh zdNbNHV;$3%n%%p`nz`n}h-p2!oia47p{BKl$=uSePy711KOTD3h=(r3rSQ-H&_3+E zUJTyOL(SgFD3{>7&F=MMzcFJSvmAz`8}JDk)O$BF^%b0NV#-^jX&qu(Pk-Lh$U2EK z68k8_ZkDPl)$#}Z)W}8;D1pONCv0fTACL9A`z%nIbKgx%FQ)wt zL2@H^UZx>keL>|-bo+9BuWCg0yKDB$>3iGEVH!pyvP;(TSLx*d zL3erfKp~2oF}5Q!)*TAWPX>wm=^$|{Y+P(w?9y0GZ0e=cF45*FX+4#&dSR3j+0zr& z4z5njTCYey)1;JTC30r`!+kiQv*9J*MpCu4!R)OnjDUpIT9dHeiAQ_l(M=46Vt*rH zz4s6~PH}6GBl)6O*Qblg zlC_oW<=1P!5xYD#BleA0t+brukf-SLGEIFA)NS~Lj3qe#j49HFpELESrd|RiuD%QE z7kqW7yU+i>j3JeQWqdo!u0I)ztNqFtU+Q+%PjAhL@0iF=d6j z_XNV3O_YG~Hx_>l8i&wNLOeu`j;(@@8?gt6VPtWp%tD4VVO>)=)*iNQc+dgwoNH#| zjb=7E)3g$WV=a`BpL@s&KR02e0lVA_JHQD$yxQ81d`#;Tu2-}VHA^4x826NH-cIq= z+Jk{zuKR#=?GAiG>}(6``6Yb+C8vE8=R27qYbB`v)>II(5ot$&x{GnAgZdRyLX)H( zRZ`znqHoYKrd6{inJsp84q3m`z=~c{6F18?L}||M7=pa>1?KLKr-5Lh4W>K78B#kl zcL2`F7yaHJm#bIW(1}w_^onl>x_TxK=uGtY^nUw$sIw!FNaW&s_M;~&xhH3=8;kmj zemobH=)G1@qJOAg1$7Uo4tzq!vpTI$Q$-NBz+C`J^ysCaK4*^>Qt##UXn@k3J&M8y z=+P&E*pD8iseM49|0~^z-cL6E@90iacF|$vS_$e5NLWx`03|x{5>U=gBv(c{GR4wt z!jW0Wj!cR20rus+yh?qNO*JZP%<4^KOA}T@VMKWs%JpFXh6Xr!jo_IX>*^D(N)^L% z@lPd-c5*t*Y-TZ|lMBd1Vo(Uob|e~@S-$FIHLdp@p3Ee(zUEUi@V?|x9FaueEfn(* z2Agz^s-?SvvYO#rv>5b{(wv97n*RA*@42tHkkg-cs!_XHZ?Nm@?8AAryJxBitFGzS6 z7#!8v@&u;sh-rPy4s@Q1r_ZI?gXWTixVJ<@Lcl^nl^Pyxc5gT!FWISpG&2ipE;OtX zna$^#eHmw=YqLQKz4GoBDtC@ns+H;a=GiJ;rCDpEJ>8!K(xy&W)3-@xGqj_`+9(U#c_IMTTF%q5 zAqRDYHN?z?y0V74?XZX7NvQa5@Cg|eI4@=Di#St*LdG|6{w-5i;7qrlAr{#0m?8(} zKBm5p^ZiWGG?`(F&?0RUsOvcGHJlv^pw}0=KMr*qs_UA?nn5?+b8>@dJxkC({ z5v9_S!$Ur$+IUYT9dOqI;OvJ&L1u%jY+9~-D5FjSqxC*2_hBygWSk#i>U5kJGF5`} zYNmK7{XZ(kzQ0oUEKg$cjakp>dzCeP1+nhEp^il+&8v%MR>As-QCpQQ>oPMhrB9(- z4%~sk2d%;_LL~Z9zER5bbdJYOjz;1>qJQK855w>oJO|o02Q1_hk^U%)=scW-63hWb zGhT?-iF%kK`{@`s>JCz@&LyxyV)gp9uo5?scI((Cy-;mol!&PhLt+$eAEo7p_Ut@h z6;+gUN_xIr$rF$!Dme+1sH6#M4L%{`Qk=yAX$9q|ByKM`JGsnkuj^D<>zsXodlKtK zE=ZL=_Ukj&(Ndczv=G!`1>I*s)P3e)dQVZ&vI~!7G zbu64WtF^h~Z1*b|&euZ*!sfplI4C^5cQO!AzoRn{(D6RqKv1qMzxOu~Qof2eNSN3z zF%Z~(NogP?*HgUJI4G!k&2dm*YMOdOZ7?0dl_4heTH$^%(Yu@jRm<_3?fz8E!8Vvu zoNt>AR3pcmYlDFfgpsWp2qpzQ5KO)WHxSJKrLBRu)Y#wG>t_Syv5&W}2E*#V!DJv# zSH*o_f*UA@{nlO-~`7 z`vgT(n4m^#%K3^GO&YXzXdmK>^YtvAU|bkV!K+@5SF>o+apyxR;5 z7p(p)q$jOvjfwDtW*EovI-q!QAsDCu2jzIpg*R?GKy#g>F^X%U%x5U!15BQ=31dKit8dO1P94D7@(C1s?O!-v_CUk zb0sxKaVfuqvU9iVK+QD**XTIVP+YG_anhAwfL`_@SK>RPzx$;Tn(GaXAui_wesZmY z{KgWM9(nbz&yL`_;)`)Iop2n4PcSeFXKMR@ZXY)4Af59#q|kAYu1}9_2K8nza6Hb$ zHS3z2Do1Lr4H~0bu|lRC?BP0CbKRjaitAOGLUnVOHA-{6sWFP{Z&V>1bc+=X&@)bw z_+!Tn|1_+*{-H67YmC$llCGPpKy#g-F^cQEq&PTexh5E(@kSYM-1f#ZhiI-FHAZo* zlcgWZT+MXG=k8Z)&pT9eZPFOU)hP2hjJcd;9j3WjG)8g#O4fNabJ5FbB#kx8esj-g z&2_KFD6YLSAM&oD;ou_u`$5^tori0#5UD?o!wtpth}8KbkQxloi)&QYFNR!+_s#Hy zkF^@3xU%vR-6RGB^cov+UH{olryZ%eZqOLT^-GyTatH?Kr8eSv>+L&VJ4$n{)ELDz zN0vT@xvs&P)aTegAJ#iYbIsEj#r3gl>Cw#fCeEb&Qy=-+D@SXtK8;aaqhvnEFxTlg zlbAc6|IrP{Xs*#3qqvTgWBFL-B1=yR|9o!Z-;UK>$7zh>+Ae$WIOaM9XKMQ9+ixm7 zPIJAhF^cPl(u&e34hEbxJYI7x*BHh1W7$%=-3tbaWLf78KYH5JkVH%^jXr-2p6Y&WKzJN3J*UfG3A8?}PifWAF`Vbg8PQu5{b&}?yrFuF}G8ETl zDW8*(8Vt~~6jf(V{O{MFtht`nm80f&6xW4qg)sGiyt}kkg;`*V? zhvX0pkfoyI&o?Z4>=ezlTw@g1)v~3h0vim_vwwob|8iyTshVrC#t@ftE;x<3m0RcVb*M zBn=D(A~@5LT)gFs(>2$_Qs)`t;yMFZn=8Bi@!%PnD=~tzG8p6HI+MBROh@W(3l^QJ zxsH-tjB#<%4Zg7R#C7(__FK==TyIEeFvi72V?@lt#5HE`@E40T*OOA`8ROy_@8Wv% z=<^O4uel0kS&T7?9IptH%!2`XNsx|vvO|7BDdM!>F8{s!JCY zGXpJA2$9ERUW5=TdAuCmBBgE?_L37R4}n=FYeOA%N ziYMg-57*(IvaXc9Or?k#{@J1CBBk4ta*HSBFO-2i1lKb46@O(uo*MSZQ9w|ExzodS zmPZ;50?J51Ug^pCHBSxi@s#zR2SdxV>JT{xJzP&I0R9Th;U3HkkK`}$v|^fv>naas zk_U5&rw4DAHi4=o>T{7NrPRZ9wFmQwC*?X1SA!?zSx*iB;AzD?kHq4hlovf*GnJ|2 zb`{NTYEDV6y%?2q0`e}is9xvwP3SV;-4(i*`Rvs&-^+3d%r_K>&rVJ(5be*7&-kTN zYU3jCM>SRh5n#ihq$&~T!H5Z^blt4xRFPXQa(MbSLtXo7?Bc50Sqsyt4(=coZ>SzV9St`6j#xqn zkJE0b%B0%cTiac2r3R8piz^CO-`U>I5mR`_JhRitBk;Vs1su?%wN~y%PAU%%gVdoA5p0L-pd#eETSpQ~Tq%&cTZv6+;tRIDcTon)7PyAthd*RX9*4mNgi`Y9pS6pvsbtL!+z+t30s)Zkh z^^GLS2x^#C9-ZP)9!{gmsqw~@o0m#Awl=`qN6@4~R|;*t&71ihk2hE}GWV9I23wYL z9<4M74{V;yw=zkfWD?*o3co^l3e8n?w=d5|~ zBOH6neU-=msfghkRZu=hZMh^-QJ)J^OXfFWI$*I2IPZVUm%4~)P&6eGtG;+@eEL-1 z3hL*c+!ZoR0VxFnW8r^Eacx^`^Fr)bo}d7w*m~=#zv>+kh0edlMWvsEr(|C|a?&Y^ za=lb-jS*-MUyFxp+{zT;e#$NJhbdr6$ zESB2Ut+uL#*aKUP_dZO2WBp?tBqmm4jgSmD4e1br$nKb1I$N%lv%Yp-ks?OhGb%cluuQU`8t=|rbG8?#VQ z(^%-jIDw-(PsT+jl{?FQ2e@NS$5N(TAEU=MBEP6>PyC@M_uIhSLaSFe>~f>7@lgug zDOjtTF11(ZhwPjRP47Rwh=gUblN`7bXG3lS?no&3Dk)U0_a!()RrvfWaK+G!aJfjN z6(4SgI|P972GTo#nI?rmclL}cnN;Si-zuap2c|}tEPiY#aPB?lmjm}>U_O#KG+*X7 zu|ie_DUb&~2c3gh5ctsHz)f)K%Vb=;3YgUrhi1wACb(iP9D?*-V77X2Wvuhx00{RBUtDRi)9#Y_zS|$?vXj)_2YhiQ9{H{D z!6h)(SU+6(1gBW|5za(ETm@MZ`v`$N#|P(JkSFwH zO!QyK!x^+^za;7!=c9qmTu2;_1AFKBy;$0Yhu4R#L*$E+_O^wtU6rs1X7297#o!aK zd79QU)wCn__6S|dE*pzKiR|iP{8_rFXX%VJvD`&Nm&Vuj#@E4fkIwFm_m<){(d4Gs zgC8N2q_t-|{umc*s5);Gb|&+&;o-D7D8jp(NUV4j#_Tkup&5B{I-ik~+zqvHtv$ST-hWOe7x1z728@c%O%kMr%^ml)?~VVvhWN0@k#9ox~Q z984BMHYd91MU0pVTzI?v8uS`);8!lDUD0dFG1eF!AERN5&HNtz6(tzXYX5l^*x-snW{k+;_Bs~ z7I9h=sH>U!H7H@kUema-@P$O$WuTm6#BGhOEokg+WD~Rg6kGGo@bgGLJL6SLYoubr z!Z=PgG@Blj%2mGo&hXfLtXgQ4aPP zU=vg@oVgCE3F|efLE$B63g zw7m)qq6?xWInIIU9nT?E6tH76NXQ6-qenrh(EIRZ#}@2a%4SHNXb1fz-Ft>~&Ns6; z61XfQyyR#2LQV+Ug1MJ%bwU&+k;s|a3*$i|P<)x0u+Td%X7>fM-H2Qy9;VH1U^r7w zxKjtl6#y5Hen`7#y4KU+a9JX|E)M}=#0QD$SH-Qp$p|_~0w%7*;s)wm#ux_!2sVSfY#{m98 z!h&g857Poauqt~$YjJO8D>9+O*R<>nI(JE?YcN0TI2v`3!=Fd^A~F@9B{OfB)^<3Q z>rE@uL-~<;nL*~|RWXHQ-&Y{KM z>$rsxb54$WAE9_KQ0<-OoyS#oKMqT@nlzjXn5(7oGfYAdb z%u5R>VP38VCCtkmpoFn_8`L`H2*QA@XX-FeqJC$Aig4OgP-~c~xzz01H5P@d8xGTY z&dk-UK=c?SvJOD$7o13GkbSk)!)exqa@lL*H@#Qs#cOxs|JK7e_H%Y?)}*dW-a2uvR=4VzQ4g}Hd6!x$#AE3Zc> z44qMo3ol~~bAvKHxY?~lKHJfT6^sG%qBJm{0&^!dhcKxrz-+_ZN6m%x(AC2>_0?2m zBfPAK;=F)q6+vWF1Z>gA;D#Bv7m0Bh>F7ZyGvBFiMq9VowTob58I zL&AC+u2GeYh)Bcvcxq8Dx0^7c?Xd@Gff`NYULy>tHLO4)cmJIX%TdR}7;3vex@jlW?0&u~XGGV6P(s8KN`$L=WIdJiYzd!3M)E_Lb@I1_A^A2a zu|9Gt>eY*HA%py=QA|AmN*J(VFh_zq1C;QT5}<@By9(4==D1#`-35xo5;Fb@Y7DaH&*Tb?%NX5>jOlry{u2Q76{Cc{mmTNK}!m-){ zBlHSxt6)8L%loQCE?xj5(TimRGnXVQgOF5w3kZXh$SrCE4mKr6GcKZ}$(ujS%Q>!p zW)sXDSs6;1DKM}**C6FJq%*jEovXAw*Zb*sz=>o39+g0YfWbzX*%N8L@evalkwO$vw?a7pAg5m6eFDWlZeqwJBq{@ennGsD=$X#>7c}DPJ$9+X|_)LC8$4g z&JTbRBX=DrF-o7(X)o!t0mmU5&4d_l)z)*>)*mqtNn1tx5rBgAO@=ISE_*7kJ7zsz zW$j(_u3TZ7T)DKfr)udUTKn9OB_`oms+H`W7dUbm^cs_$#~~0B)C8jdYJ&AU8kgK4 zJ*mG31XPSH4^)CI4{;;F52j$gQ{Yt!ioU4_PkID%?;!URdD6&=b$!OmYX55*ZD#N1 zVW!&7jn4FN#nVUd)aTJzh=D8_?$hWJi-DI!Z81QUE=hzl?_>T#Su`Nv#bOx-&H)Kg zMH8Zt|0H9CC8dtgp@uNxbXXy?cPR2OcH9PVbkmN@Fgc!s@50&tA}Ha+*Mbsm|45V~ z76~VV5+f-9eHUp{K#8<8C^4pP0JRqUA%k`{iLt`t0#6mDQ2etg;j!`J@YrM}f@Mu1 z`%xJ_BvDu#J_Pn!36R6t#OZ0nlo{(zM{ZAYj{BX@sc2x>na@+Md?HjIpF$CAC=4L= ztqSzhwQC!`sTnmqmOaq$*xU-FhQ}@=8x}rfDjJ8jRGM(Usb%HVD7dTel4&-|Z(Y~= zZD5UTMbtsh_PUdyKV@PGzk-)e4J3 zP$}H|D0R_G!4NOmQ{4X)0{Jvop#zjP32N4nvWzY&aZG4S>0$=0;Y!-73pq5O%< za7;#`M!Zz07h*D9RA}~g1I^0v9UMmTZlr}bTX21H$!E>_-LVIYk)jq!&D^m?n1Y{0 zSA~+oEpZ{U?oY7Enx0s4{KCxwNk^sP_nfM zo?+*3C_FU_`K=J(Z4XC4#2%!xa?KLCvhmg38@8F_{z>{SlIexTvRZy)vVafT=O@goG6s5 zO$`CW6T5FJG7^?xCMaPE8bJw5&;d$Vf<>T6?LxdrDJ%hLlhB+(6fLN7P!BO~5vZq_ z`Zg$G2_6R}tkUbCp5v=Nx^@&UDqX`%DM_+_@)_f13~suNwKD2pv;KZLw?*)cn_O+J z7js)N&u`=6Z~)?8qe&$8U^H(6|}i4oe`UuO~iqrqSsPV|}!9EG{bTTs4slM)#h}!kHwJ7oYt=I8#N} zt=tNf2s1>zQ*Aw)$X)S8+~JEZ#_ELp9hck;I6H&4hwLShvIwVA*+bS6^Z>g5S+_mJ zy2>Qfkk(abet@+x* zgqza0CK=cZYgf51Ygf%#CAZ1!APmY}*&^HEu}Bf(akP9C;8G2!&^8R~nc;%?E)47D z@B_)2t0tg@-5(E0AKd-%k)4}jtH^!bIaK@tgjt`X{;ICn*!df@o~#5+!OZP|Ad)hh z)=$~A4&!Wgeg}rMl0ezz<@_gk2xCoQNU5msxA-AZuI4i{n_Gc=R2!l_J4{@^3`s&Q zXM+-I*#b(aBL~6 z7i0Q0sT%=SO3RCny;$tvn*+zfk43ZCE@|+D3A5Iiy*+3Ys}Kz?I9Qd?Gp)8Tk$coi zh^@+)^psYw>u*ZOeGxy6Bqz!|nCq7;fIjZxrxA{u<<9!>17UW?VvmtahQ3Z@=T)Xh zqrbx$@=;@tkz2TGIAs#RicM;ZxQT%w7IzKYhp`QDVE<1&#S=74fo!3gGUKPxD+@BAqyV2smH7@CaR z)2i@rI2LAi&rv)1fq+qp!bNvp1WMSsMo>bb(x8MwT?0xe6s?^Lg}MRMPw)xxI=4`$ z!=NZaq0R&)>|8e}Vdrw7ghJ68`&Q=lv3RR+K`D>$K)OE}7tXweStr$)!U9LuuvXD~S|;VdrzLqW!}x+3hV z8Tc5nk1L++-qN>Y0R|zb)AT6RVLB+G4l_Xsb(jlEs6!_xp$>P066!!xp-=}3|1Ipx z*Fg#UlG5ss0VULMIjF7RQY#^jp8@LH)rgBqF%WpWiX1g8q0$SbQ|OZG#gT2ug$@kQ zHsvAFu!>+9k&T9Fful1of{_V{z7vxUaCNVCxy0JNT;SuE7x3J1F=a^#<940OBa~w< zw}LL`QVm%CzL!Yrb(JwK(e37|E2)9#q&9$7fK<<{cG#iI<@}jjzLcT4ZTKUzv={Ni zeCLW=R+fu=K9XHF9gPE)S>WEmRlK|q%LoS`3)H8oa3-nxbZWyCQXOE-uHk~A1k>JY-_PVHwE`6Q?EGbHee<5QO zQ%~SLnyHU)7S`ifFw%q-GQI+e)}}&6GpI9}x*gODOsxX-2vh4p_2W%-?^-|$e$WT_ zuTUO(b>8fagN;O%+O71YtB+qUmNJun@Q@Kt*Hvf1sd}B;SKa$KPgp&jGa;^}$O-fG zV*XRJAc0jAQo1Q5b4Z%Z3Oa#S2*quhk~DP;i`aS*;#DrP5G@>hadVcy@6L3uU*MAC z1Y}5_DWd7)ES?aO@AG|5tHW8y@g`70W+a;z`6|iVAt{Q#?;d2Bu|*d<4XCy#q*&8Y z?XF;^$iD^mv=#`GyPwTmu_eSB#lzx$S2IlITZQ@N0ZJ+V72Ht0=*~Sx_ zSayNQ-I$*tMpM<+oxeQ>EqICBaw^U=;zC9g=lhwu9Osjn%HT{hcZh#ijVyGCS1|sY zDV~EarJuK(N$N3^AC!vUU&6{A8k6q7o$lWzz|z0Hay^rNUEoNRAZjxil&HFY&sT;eY(u`8w>7s%veX`jwGxW!)c4k)8YrMNTnT0#Jg7Q^EMs<0a>qDD1N+X8a zuhC+teHAT6`TR3K`p4JGewRG*M{oUNofnk`N@^nJaMDZk*-UpnkfK5dkT>?3=Umgn{J((YH`vf_%f%nxvpJa z;yO^(28t+)z2;4W2*vFP7f{<=H!IaVP`-{JFo+DH0<;Xo)mB$O7n}PLb0Li%HKoWd zP4f{cVjwnIn3o$pF%Yls54jJ-2okrzmaSQ(MX^A&TmQ0QGq)K zlZBMiAPST5Mr!M44csV>)i4O8j3P1!q+QQJfaj!IQtcREwRyu#jG}?6uelwAav&bW z!)cnm5Q910zVP#xQnLTW49MbWjl+@*x}g2wxvIShB1a7D7CFf4n_D{u3=uE51{b=& zxrqW3sR1&uBH|~M=gU4BBv?ib8+;Km5E25D&1uE3W#cw*Sq-rLBr6feLx+jkUq(j^ znt@qa7>*z+7)NK8T)n6}@U6hIz|Dal2YwQ`E%1wgGYAJYT{Lf_9W9*Vdebr7P+X77mL7=IV1V95BuGKe<>hv?@bwy_xOM?U#|V6afx4gw z&GFnNTc5F`g}=`T!YHnv%antdi-LQM0ktIj^PP4i@VhidaZQu*q1FTgv-bGc+b*AX^;tUL76e9tHyx_~QsrCyf4Ps~rjaZjDi8?UgBXKNt*97!aavojvB+ zQM$iq36hRcx?K}xN*JlZ00jjhx!hNJ%OC7W;OAhq$=D`nTD=b|mo08l$*gk|~EW*U7T1+V6ezv>gfjHH}eRw~43)!z+7^_^TZW{FfS|xRRu{IOt9qI!|YOc3rpPVmlJ}B^sl+3T4XS%oTyONb=9O z_uXtq0zX}26c^pr(?NZU8sZyi|H#8~z^~I7#Whu?kfsL%6rhC4YMXY?QFbKo z%QQxD-6dN}cO1b0g)1Shl`lT>1v?V>Z!|`6EtV;CR~m$E6&B!ETPpw4js*TKjZs|p zNUL=$b5ST0QiS2t9vE#$0>4jV6jv!QbR36IFz^P>l<}WtE}LUV0AOe%(2fNDu*Rseu9Z4Qn<9dN%W;Mnjn`I>kJ*vHGa93~z9aLAFqg6$ z%}+E>i|Da@y~Zf6TA6Ypb4|t>0x_O_^0ssBNZ=`rQCuI$(obS88k@wmr=qLYjs*U( z#wacobC||sFyQ2}BY|&{TqkQ8ej-aRWG<>9N#px>Zk%OD0_PuFKx(1pdWDQGj#Kan z2BZ=gcg1F$bc&Y7n@$X)ua+sNGM6ma_-^5s?mJa;bvZH2b&*Ut&BfKe`qY&o5;%b_ zc4A!dsK+uF*#SCEzPNdwhy?D8AI=yT*EnE<0maq#-+vz|B7qYZ;)wCV7^YsL;e_LK ze1ZX~+(z>wH~!X+1pc}c!{}RN${8-Mm#-Z0mK_Ovg%iVE+vVs!leuKGjogydi*_XN zzd13?b(+lQEap;@4+p+?u^kD#$cbUDJ7hjZF0MzPIATnZ?yr?j40ElNl^V}nN*Zg< zIp-ET68L>i40EMq>BX+He)g@?W*6(Snw=O|e^HkRou|wyHg{YeWiIY7TJFKY7#9~^ zu(?iKyf9H>b4ioL80H@%?L1wuJ-u^AU3p8Xu3^N9VXjp)UEwIh$Nn{$cN-78rc85@ zKS2j$1SO?90pEfF*=%F>(no(aL35qs#4y+MGM|aeMe_+AH)db{*+k8yewl?aeEsW^ zYZAT%)ejyR?LQc{e3Isx<-{=8cVtRAb4i!Zc&+OzKPlH-H#jk_c<*G(@%tB2T3i0U z`&MP$5oS)R%-M{gd7q9|zx#DLr5OFhd;f+~G$6==8O8)@>xdR9MIOv{RdJ2+#v%W) ztfigL3!Z#}9!xXANeh3p^>Gc(|UC{wifHF23r)w0K%t=t=pf zr(I(_GQ7)E*3+_;cImVkQXPUknkF!Lh?FmSN?)n~_$x3qo_wzLlwRaXq1{O85E(d% zk~!0RE9wxK22V>bQ2_iEm~v0fFL?6V15XCwnm7SnfO2 zRIKy4$5r~g)V%t6ZB&Xlh8X_8gYaEX>EzF;L)7rg9*Lc#rXv6aW{0bHyfNWb2u_tV z?%`mzRG3hTo?16MjUd##zM|6G=B8^M%PzjbN}bnLc8=8wSAKF)L52y<3oB1`XllVi zTyt}+j3n_({)4l*nxkkO@0-G==%pz zNOA4}TY+4eP(a{)T_^s1u=aC_xRhM`fp9EjxeV`si1>JgGDRwy?(-tZ02$A2t?lTX zJ-cav^pyIABQUlP+OdKxF1NL(9GSTu2e|-B`eKmE#dRgRBC0ihl20D5 zUZflhX272qkk6-d8BOAOm9PH#KFZOYqGdk6CE#wP>@C&t>X!xFAX1He{-%KJ`hDP3 zhBQ(jDf%seesWYu(E!S_Jv9#x$h9HSW>DwUJV<=yQJ=Nl=j4#6d#K_UMLE&|4 z`#~$4-p^%a&ilFS{|wBx8R8*S{&PHEsOM3fFUo#`?0ebgp_lGbIhxRG(i>J2JN*EG zoa^06<3EWMU6P1h5KrtE%Z2-3@tyCA_QBxLSMe5y1iLG5|NMaX;h3xH+G;zSTGA8C zRLvch&*@r}_)1pWH2uWeALlS>PNd(@C`j>o4L@dyB6CVD{R$C_q4rXgwck1Xi|o~x Y4p8_$`t9>o*xlsl=V-EB=cw_20271pegFUf literal 0 HcmV?d00001 diff --git a/curl/lib/libpsl.a b/curl/lib/libpsl.a new file mode 100644 index 0000000000000000000000000000000000000000..8f430b1d6411d75c056e1be3552558e5c724bace GIT binary patch literal 69072 zcmcG030zah^LWV3p+UTRMO$pOHb}T>YnupYP_TGwt@1){2npoi(kdDPM8u=sx3y}m z2lYOBnQ)`6)z*5{*6#*Eh~cnY0`@Ea*%zQ{`~4mN&;OtHy*Il%J3Bi&J2N})$>?{* zI*IZUZsyuF(#;0l6bvQE>~szV`TtYYt-mu3YFfV z6DO!;@ltKFSfwEw{zJ7|E0)H~RchBju2KrwL9UazDie$ZQzL#3QEN0v#Ri#_ z#FWCMNrL@o3Yj53O{UWWS0si+DU&4i)x>Lz$q6zY*#P2|z&fb<U$ z@gP!IBeD!&yg?gpG|0o$+Vox`YT!g~piutT8W-57lY|EqRPI#v4LR6U9t{73y? z{P&dF{0GIt+Vu2#J}uwBuLRbMesT7pJ|p$M%BR=tKg#*HRk7S9_RbLq`WgyC&e?Y?k4^Uo(_?`l(DaxvPRB*A?VfiO=d9jMXuHoAy59w~h15v*R^fLb z9*Q$q-cMg>c_K93=aP7U3k`VgkZIXg1v4kv#yt}}NS1`7j5#Dtd{MrA*?a?Ig?;CvZ)2@_=Z zSoOhzuzzvPzPK{5;|^!V3jjs;SYs>|qH&KnXJ4^7=~Fr1y);-9{;!Kz79vjMBWG~- zV=l*h8t7vhF_sdM>1PuB4x>bKA|6ItZaF#fKKaF1%A+lvq8=N`;x@nm7WqAx$xop` z&R{D5PjfpSxHb4W7Q!IwfLnh-_7kiA9YNS#!}|_AGgzU1`C-Nbpzc2~ZZz{doGVD4 zy#NbS!t*oTBted85zIM?Z*|OpC+5X`A9&&S{6!xs4dY4PTmIeC6UjLnE-Z}C#@q^e zWgAP%_BymWr^?rns1;BE6pr~j0ARjC%UxJxBwX<%8_09apJU`KP!NA1o?5st>@LUr z39byo^U25Edu%YJSW8LtxK_^D_iW90E#4g-9sXGOHP8S_N47f03bT9maLn@o9}~jZ zuo@WbUk#uWYqU_#KWQc$n^SEVmZMFBUEq#xE)v3*-jEMR#o$*d=@`Y!L%H zd+DGa3TK;jQ3)Qg??Uw90O3y(rs3;-#8-~SL|_^H)t$?;;T6e2GL#ZQOry>GG+Ldb+ngDf5* z3WY%#?~1Nmgq{jpz$^P{pYnPComUD8@#hDS{t0`f@g$QOtrQC0=lJ)up15lMe*gdC zl>+(C48()d_pn%9c){R@wTJXJ!C_>%?=~AWiv|leuUDA{^x=j32lV0K=NoX{#yAiu z;$J_#z|e44jq8r(-~l+F_2OZTc6m8IsR@0!_W`g0&gWjP8mzG-UPySKs*w%T;C>r$ zd@*D2!~2263k-N>!g`oP4B%WGLZVT|_2E6|tv`hN1;Z$mQ*hy5|2#s&p5d|@ zAraw5jvE^M48^@rFB(pv)Wd~;SlllDLZ0Do5Y+p^=`I*9{Ocb#{Mq%uKK^~c(LImH ze|EkYZz`8T|0`NMb@0H@)3yx`Dh=F0)Rj$Rx9$sak7ppf9cGJfKDFu<@3gA4!q z=MfSV=BjbsG2SS^;XjWT`s{??2E2Cw$JmR9?HD<3NWe34#`G+Jv;BE`fq~)B)c?bH z`vK?7^LPOv&(MnoyoQ|l0LRsa47^t?0Pss;g$f7e2fdP zPybwI&{c=;c$|H`IDNGOZ*Rf#cz8P=_#fbbNGK=%2Y7gzm;VQNSoP}u2Y7hgo`1lb z5ETB50I`c7`8wR5`U$)Rf(b#->I=3L!oT4`v>g)qjNapUB>od#@U!}i*FE=dcz>5O zR=vD`z?%>j@XWYBd{3e5{Tp7~-`0%*^pacQ_S6rr?}XssXY`o~?YigiD1D~}2!urD zD$Yh63<=>OWLu41!t+>n7CA8C^LToTN?wIKw(oQbdC(Bf#z&164OXZU6(04?#?Oi< z(jM?TvfuU-a5k2U+-~rDgy-By68xVyT#QA5@Y3r&p{dKyFf__sWq2hjr-~!GD(b0l z){=(-2={snQsI*dT=i3A{>K4O;|9FhgdJ8oJc~(sQ8|}5<~m?bXhM%gg;*GHLa-V5 zkpR9(J_rPGL2mijA9@=n zL|IBjg)d_~;dgi;oIFv15&9a(_VpK8Dlm4G<)O%OTU4-sEi&IR5YR8CAk{mPbM8l| zj=3ez+F>1On_*i3dhC+7u{@irr7sD0%JDC9InmZ-7N*AOY{v68UGCbE>1O>#?=zwpVAcqKtRm46eD z!8_7oC#A!)6q~B)#@F%Gad=*3aPOr7!d_8og~4z@|B)-CH~m4y_-yw}pc{v%hAJ$% z@+WY>xCjKs{++i&fAQAO*pt`*Q9zA$$`Qan3)nTI^`R<&my53 zxTllQpKxDBLgPW~%Sq@WK%+>=2mEI?3Go1O;Y|g|g_jD@3bM7RAFsS0?>B%(k*#D3 z;W=Yq6S8ea<}+ph+eDWcAUn*RCo(mR5*4a_M~N&y_8Ssd59p~9S#F3d*Ier1_E6MQ zDGGn6d!JwB^yF|Uy+!}*Fh66fsf)Fo-eYq@dBF4W&}Qu!SsP!Ln;sQAT;O5Ow(T~bg1lnoc1vJ&pkussX-9^1?JmFM_oi!3+6 zf*A+$?}#k7fb3XMxHQ(HbpOS?aW_zX zN>O1ttDa5Gh%Ar6;D9N7zAMKZ4~p}AcjJ!^5mdhi^L5D}zklZ20Lq4oPATcHyVYO! zx8;P*_m;?&GIC8DczY2qfyL%316REkRb=UeHL&(A0QT#1$$_vP#iFNEcyPyloKC?m z!bC#-Su5e3K6j!7ee8E9;FfYaz^;R4T>x#Td^HwseY|jT?m$yCw$`zGzk-t`z@2|J z9wi&W=*8}JRhl}zjblXT{UU{vX9)#yqQI!Vq6;KAD<)nP82g#X-NwmLLO0h~coMFj z73NAjI{dJG3y8LqU%)Xi*%)mB`wO*0gcXy$@lNV>M9~(e(=(=5JW>3PSWA$vup-je z7gLJXmNU2D;T%(L{tCB|bHzRT<{Ax)fNlR8 zI%JWedn&;2&+8GHx+kQoqB)=aqHDk@jw)PXoG;9Ne}ZwQ=?U1M-5_Su6R=Y{0L&f6 z&!KA!?5n4i`#YeBCu}Tut^t@cTLqj=<+l4YM-u2-bm5d9QH2el9_P@fvsS>&Y>pe` zX0p3SrMGa-{uF)Qt#{(U+*SR*gynP&_EqzGOx>`0gAU7njJEtKDsbsg0jWb5)&YV`p|Qf8gajEVkMKOMhAk~B+=OS~ zLXgbzE|@k%R1m=qzhr#1(96d%&0A!vruT1sOraT1*b>18%)%LNmRUnYl4~)RcdtU) zIe#`#$K5SeF$M2d#+rMKnGONY%-wN>XFQx(1kD@Gjz< zCDld9&cpG_-zFYwxtI<0pg7rKuo42d<&QWybAfqMuQyryW({*PzmMlsunX7WR?DxX zJn(E^#x0iHF8R15FR~Pl!nLMO(3B1sLT)jSg^F_Xn{apITb-{wYs#OH4f(4XdjT07 z9mK&j90u2!tFW$+)p$FQ^T;=2UmuG@K74+BZu#<{>bd3H3soe0(UQ5|!h-2Tq6;SD z^&182C$vm|egO^dW7~!CVD*HSxqmHR1`qeNR6#UYiEY~}B1?8Q5O)p*nUEtm43B$y z`U<`B>Jtu_G{+oh2F?xd#}*8X1wRrR4dErQHAHxx-N&W#RWN2pNOCa7Ti7+aq#I+g zleJO&niva$s1N%DSJb!2756=Dej|NJ`wKS02Kz^N5!+Rfr9^lh1I}^azo!;@`Nvv1 zW5+#&tsXP3MF`ztc{vf6053M&###A0lu7d%-RI$fqvU9}^4Rbvx^H9Mz{x^D-%WCb zE#k3g%SXQK=z@2BMP`WYBf#*93O)cnstj+MmJgvU_U& zIGs`h_Z1|Bw~4FoMu0vd>$U-ewUSOb22eZ+o$RmE!+Fw0ZzDkYWa}A#EF?swQz!`} z!~)1gWeh+vvhL0Px>W$VV&nY);e!sHavC5P_W_K)F=hee8Y2xL*BEC2T0!p`c`nH0)u67m7a)#HVJ=skdP$<|E(6_U_#fLvqL0_5t^-49V&eRabDa^Xz{ zXbss{3(#5;>WjZ)3fyA~s9**94ssSe&vBK;Awtf%6?j(g%*W4hl?LjflIQ|UHWWbl z;AKfwbiq1T=_e>%bw%zt6m!X{{}th1vF{v8@5{m}L%hgxrC`Aj^POdLdM?9e5?Pv^ zBd`T~${|%m!JEAByUWK#6~6n5@LDrCq<;f>a7c4OeY<*wfit?D=>y&@(()J(m)#`E zJ86;dddw9_yY}$k!c9wG6ka%hBp80hb%@Z23I^hxHC(C;NT$Zdk+!#oTG$`PFVnV*Pa zIFU*bt@!xiY#`6sWdlRD(K@P&r>KhD`-R&-%!A>@2wHFXb#hb=0n(l~TQ7k-14&f%P`GIi0@ShjwoIz1B@Dx-;Wq3nvMbuKPtfIoG<07#0 zqrgLqodgvZ9I!L_KS3Hwcmc=eE-8a&iviRO5;dj()C_lBbUdaomH_|r75G{T98ZNk z*M&H17PZucSQsn7t;73UBS$}k#FlYE|DhP(k@uYj!%Or+5uEqO!5dk8T}5TE##hPc>MvLKdVgdYUP4Ye9UmuGlwzSimGB{(oONR0qSyEXv>q-xr4sI+kPvsXz@0rt1{t21atZ?nU7uF;_Cy_Quf;* z!I=G~q@u~wGmCSUl4CW5;h>-Zdsa$J0h#`Fdc*ew zkvQ?jgf>7K%K5GnZ0gU@)oJMx_T0#y+~c%ET)FjpH>{^~y%0KYAbDH_cWi*@6e-*{ zk&uh;r&M$=RQIVUmE!+s!x>vZ4@d#Uh-GqMUMb()oAzJ)%N#HoY0OzsSw|M{=0X#6r5uiC7E_pclhH zzJcK|=-!8$D6~{S%qS|Hi23W~!s+vu_loW* zjSa6eL{D9@v=-s{ENz@x5K~Kv;9j4O;&r+KfnlFQk{av^OmQ6cb&RFM$?BUTnUvfM zqdldgIKAPrP+0)EtX5us9ax&))Cg8>C6wqCK0qr;NC=QCNfHB)D@n4bAJ3I{?@yI< zLg3TCn%G3Ff|w&3+^A*KSZIRpeV$36!IWTXFT!^#5D9}ZGLCXi#2)l7`ShhLqAj4h zRs)xBeYRbg{VtP|kqHNv=y0nMjMN`7Zsj7=V>dGQb_>!Doy$3SV}T3U6e2f=XoYPr zgm~w(VQ!*vSNr4c%D#vd^5&eJG6uBvl*lV`f-$xq6yRH$yN>rj!=D{Lir)x5gq%%f zBFh;8OmS)<-7m%se1tUz#?I!fB$Gamevfr~2uJCc$UKfE^32|7w<~zFt-#+OP&hf^ zAki30F&qU9Y$4}6rrDZ#9gh1{&dQl6@^8cs z1C4(qz8)IjQ=I8EVKxleahtPZIn3`ZUT^-#MHZgNy`Rn~VKuSUkK&jaxNm_OlZYNy7Huk9B66!2 zG4{hmAw@z!HNOgfdlb*NMnR^9)9WH}Y8bxq8dnfw-fQYwp57c|c@Q)1l56Qs;LZh` zaOX++ULMhqOa2kRU3vosA}h=3Y+j_L3L3)y(7osg1$-b5Fvl?-U<`6hqcN4jxjmLg zraGF?(k3+3{8?c(08#uCekX!Esn0?SXt7xd4Uh%!Cm)-_$j7&F@QAS-m=6!(MOd{S zn2f2L#xY^500%}x5Xh}?FJ4bK2mhzP_FrVdko8gF-BFguQJhJ?3d4(|I1!IUJ;m@D zp7CC!rE8q6fMn&-RhTFqIug7N|0m(27C6M_9S1cOa=yIeR*2b+f=tUU81L!*4HP3e zle$GF8$CMwdrl61u@PA?yKrx$zskn`i@)IcLt7{84TcW_KMpcGX&_k}1}k4L{<^o41; z1VNgIzvLHH_|m(P;WsZ}3mVCZxE&e(h%^C_oXNK>w#ad}b?*t!g5_%ZZ6^bo z`B?EM71D8JKq;hKg{I=yLHB?typek-bi2~KE@ma{cGofpdn(}27Ji0Q@&Z!3IV;~J z6MLlf6`9KEF<@E2h@0Pmc%|Ehx89=VO@4)T2LLprOr7y`3nSIK{ zi4!M9O^Kd9Dmp?qefp@#4`PMU(`P~LUoCMnqalosdaf;MdgMR$!S(;p1NiwL{iGrO zVo7*_I3d6vKF8tv2f#;2fk9$fuz!GD7LX7q4fdCZ`GmGU9O+{@{>8 z@%Ibh`vs30tI>{%j+`zWr8lOeXmy5h6v3pa`vun~osIiA!W=Ot;^pY=GuV;G1sf-S zG`S|)H0?yx(5c5JMMb|pC4KS_Q$C*j$>gAz5u&bG#XuU3<1x@@wDsnm*WBH`1%+=2 zP71CHWr9qB$wSyd7vu~1f;bNk!5jhPca!IQ#7%5Rmj`K)a_o%t?T-nc+rHi>Tk%}vCM>fyjsksZdwWwsnOs@Ri?-%b- z*DT>Gl~cKjg(9w^t|W6ZS9S;440C{w992cJUv2SN!G~OB3#!^%&tS8dWODS z5dp;RG%ZTyO1rNO{wRwpzgrQ#FoRoH^3%LDuI!<$dv3}e8a-Eav+@P`$Nxf=#j>dc zSN1!q{O%WO-U6<2Qj2Z>bo{tAd-if}Ej2IeH{k|Uc^0O$bJ{|#Qg{npdOLa=jDjjI zie_*XA{gr5#qUOmxUw7NcOw^q(kT9g%3@@RcTlCYc9dID&hAaEQmY5a6mFYWBWjJV+w6pweeHvGeZl<)**e1}E=*y^*YquVcG8%J>kt^%I{goPK zrnpn;kbTfeN0mPpjRvJcp_xe_CG_oGA?&qoRQ`cr8dsW?RYXUt*Kt+y1>F1Somn*u zwvYR!aD2!UrU8B>t9jj%5G{tC``n^QTgQ$UCLuE z&FrLeS^3F(XdVUfxl_1`kFTN11u&zJK=L#0lxd|ssC-`{4BCBT5@^|+?@{I3SSUZB z^4xoLU+eS|>Y7Dd$s{RP5~1fxN=iq}fszbW;)t1C zam000aR70=1`C!A8q66iSUAvo;NdJ8m&np_iEdPp-$k=#2)IPX0xpp`1)jfH6`jn% zKEsCXOokG!iG-FIc-pMdN_eEfC4@@_SIbutxTnGu2iJ#i0o9D!{qy0T0T*t?xCXc? z*UW=^5?mNZ;s;cLat2g(qHn&yU@{k>#06;|bBVM`Z~?jWA5nQ7*fPSf46YQoq+Ft{ z#G->L9aQO3pv&3IDNsy-VhUiS0LC9yXA|`>^w%th3udN`h36c&5_@6%gfTSGq1pN! z%(99439$7vZga5;rc3q&k|ZT9;8|y@VKg<2riQ_9btFP55lV?b>H#WgR6#IR#QmB-IP^1JGeZLYq zOM#dah*9%p)3`(pDp@71p`)@NpjN{rUBQ8l-aZoMT#*F~$y+FjhU3?!<<|lChUI1v9teQ#O`H!qU zLR`dy0ep)&)MJ>}{!G}&3(Bm=f%q*tD$Z1JZ`-~xaOW$z3nKPdF9LZH_ZGE)9Qqbf z{B!Y$W~(WYq&ykME!HXb(Abs_@pQPiHoN${ZOz0bYOanuzs_p;<8#FxI?cLm;rF?> zX`Hn%1w2KVLhLSdjsi0VUdb9D7ZbUMy6HAGcPbZ{l0#b-Zo7qS_iiz~#&8NU$q508 zI;#lg0YwpazIG3F)xwxP)U^vsQ0deKQ^Ales6eFxp!b@ZJ0G}!5#&JSvs+5;{A5gV z!KHlHs9N9yl@7f{UFTvd3g*pSP>D*ZAOWDA!JQAlB~;RKli|VeEL3pk&Ed}b9hFqe zx$~~)FXqmJ|5e<1zwKUtpEs$yq50bSIPN^aoJF=m!)!n9JhFYBk~}v zh`GO@;;l0ma^q6CSCQ?NYjoOx<3HLc5!|aZYg`t0h82}$3L#WsUZpWD%eirXSZkJX zXH4P7bz1L07wYPzxa$l7H}0YJQYLpsF)E1`aIaBwN>Pa*f;+>8O2V(Qsc-S$WO?oC zIkXIfgpph6sN@wt?lr--O;>4NrjNOCOE8_d%sq$OtXooHTQ&mX zTcQ(U|*zox7qE_PUr&C51TN{b5QgRwt#EPlt{nzTylyoQh zy2MT`XrSh_A=8I;^fkD*sLSZ(ye=vdA} zw5Lg{Q)MZ$>gRueMn@&v2@@5CXFI8R+7xjU%54?vQpAR~TLB6?`f{a2nW9bBwxDn1 zMTBV#@y@tOM|XB{1hE2}JKf_=V$)tUc3%4cmgj&09&}>qNi^wdmYvYaZcfv;)6s>s zN;{fq2OiIcsFYgG1GH+ala3C|GAhL|{S1~uoNg!dp-A-FeN=Q^+=|W)Y98R>@v8eU zFUCZ7WE=@Ztose^=sTE~F-fedLEl}_D;;c4I*}azTe1eEbbcH#nxS2TD~nG3dx*twqt9b~;)yzK#gGhjM>wq?%Q2D7UB@5xHtR;(g?#jm~do(!G($ z*^QDmg1UdqQK}NeN>!2_CB-VmjcDdaFuJ53DX-dDM7kJ7Tvthys%n%y(m_XwtTvRY zlWG&}XntT59UV2+ql=53=(`BKCN-LBwB=5Mwur%GvvUnPJGvO8m#Ab-Xs=QyOHn4tUQAlBrz!} zNelX#bQeOj3!gcObKexN11_3S{-7pmK{GX{9q}etqos%JR14G>5&O3NdI7Hki=4OoOWj3W0O8E)Io0qLg4`dSn1 z*C5`px4D9d(SCv(0)gO&kRkZ~4Zc7mST8&-*eSRr5KR#LB3Lgt_nsh5ut~@c3lJ=J zA0tQ!|q&ssPZlm3H{U05T2lVHHQN(*~(R&Y^E!l<9cg=;ZZqaiAUTis+| zrb>d*ofSegJW{pdBHAyN85$l>Z;)%%Qr?B{M=Dd>(S<2>bf$Z*G06Yq4@P|^Mm%2L zDc11*xUAr1Ixg?2r487vH>4>td8!QYS#&y2m#mO!^ziov#PC_UQKR6cJVGa>FovWJ zo%~3l(<@~v-n}Y{okl;ZtEtLWt7~c0f|?y-t=<4!okM5cj!{=jdA;TO>s7r__4SL= z)~dPfbhb~SG2Iw^9(}bLj!?#w)99<$6LktPuLYeQuWF^{WSuHWGz6UdVW$LE%A6Tw zzckU1RuprG(7*Hh#Wr_$ft<}@c;sg4({#KJ^rfbS#c~%+tCVY#^}O!OOBH&9Sjuau zfO!~HO|*eK^fk206L|)ePOIjfJ=9Fy#?#kO^IhfE&w3jqr>=8x{VG>|XvcN$-WFZ= zb%wq2rdG!fJb}JqG{FuB@zhl?{Ka)upCu;ORz|8)gTgaXyU>N%lB7rIE1wYmgfqn} zTL--U?idz(JRJ@RrO|EF)u2=ctpSv%+p0-~e{I-6T@8PYK&^+GRy4tv*IIt6g-&PX z8XK$r)X7wOd-+ZH40dXI_rKdbS}@4>zYf;#73Z`<~5XsHqn{% zHF}UEoIYD^u~>)IVvUsNe-HUpiuE#H6Dkrm(kcxN73&*lRlCG()?b{oL4{3lLc@6X zt7=sSURTwT2UK$sueB;lrt7dat7N(~UOPIyPSI4MfU~(iI2cy!uuj}iu}A6>mgXcn z?J3sO(5kvMGQB<#=A*4cezU`?FW0vW@b(Tx0Sl4jhZXw-ABiE@{Xe~mnCWIO2c&8*2;(4G-KF#^yOVmX5fj-xygFm z;%J~+;ICW&nZ_zV7`t=;sE(Y$i+27M{4r~9z-+h`0^$O&{N=+tFXKxj8QADx;O zeimJ5)T#})50PmT+j+t1Ev9mDE~SJ){pDn6C$Jx~j$- z0|Oh-xocXTUSWj2DGoS`mYh%|=>2QZ*_(Vj;cG#kSesdFPY=exRR&`yuy>Bu3R|T*u+=cs09X@E|Zs#X-DT~w^H*``Jr{_T#(jZmD*YE z4lS8#@fmairKW{KO6`29-rv6#g?!$OvUY1S0$~Zx4M>*3@}?PO$tuugNi{l|r7{Er zoT*AtRMY6@7IeZ}7G7J)lLU*q(b=~f2Y4_Bd5nHxn5Va(V@-x3mERco2|9JxsBNv7 zWH5+%X}ZKjv4NKqYDZbyLHb6u_&CZs*G!{Y+CC>0sTQq#yM>ys;-%{CXnCwGNyd9n zv9$q~NH0@&6o0DXwV`+36dPcoDanqCVNMz=S7!`5gU&qWCm2sxyzMXUEPW$U1A7E? z$Dst2%#4q>`8ykGJZEY8aal1Psu{yNZ|+>Ddxm`WaY zADu}KltNUPn5xbUy+<{t+0l_7{KX-m_fcwdiuxoHf2azQNo1YqOozgFzT#b(E+t4D zEDZv0dUnkDGV47WJ1-?QM3G{z$PmE8MPEhi()17y&G|0|k4f9|! z^D~vOE@x({!tK=jEJbPx*yYE;vNW;(adh;yk}nQaCOXmQehC59==2S7a;UvDBUIv_ zkkC|qI?zsCA9SC(vc<#?!DJ~#Nb3xgJwRvP2^XhVqoeKt(i(KQy_TAOXHI-?3YDd{_SOxG5u=i|tvB7CYU$kk( z)n!>Kja1Kjh`zY5Oi6JRM?*Fe6gH)~EIA=TY~YKf=h5kjFr3~9CZ@jZcdqn|vwW!%emek~CdlKuzgvaLt;!viVAxSPJ{{9Lk=^x0iSEP87fD^n8i^{;+|s zxO=h89W)QK1{*^S&sl6#8Cpvn@lWx6;aDEt9B zO~{nuWDT#T^iL`HF&(&xWUwpeAS}`-l%QGF#bZeWil#b1hGuFmlwW(mWV;V7yOXBlhXDaMU5X5hag8+#>>GGg z9j_WK4^IsW^9Lil*T@IAyQUGH+zH7tby#)zd-o^5gNkaU56gobbZ=(9)?XY7k=Pmc zA|j&>5_uY_tfl0KWL+>Hrt&R6AtZq>4iTS3r?mB)!EA=N*T4Y-hkLUH8X)T&vgfQcs|w^yFk6{F8mK zZan?zlC-2Gl?L#F)9vW=n+jP11O^~z#VJ%Yy_Q-CRz{_Rh;r;`lOe{B zli^=}r3Z_PB3B^&JO07`4%;tkJx|t9d@3mreB*({G>0wHK`rRDq36-Z$JJ7qK1t0} z97o4i^yzU}ra0&vN~6}6c1x0Uf%4<%(EfmojG*)A^L_U{Mhs=WFv9y)dVV)`b*4T{ z8WL_yt3xM7N&+O|vXkiZaGR3@lbnpNe>PNO8rM0#vDH2`cg|fj~T?2I$NC*D3 z5$~RDIbwk{}X7t5pd+5urRH-SNB4qqs5mb$K|BB^kr>>G~b!wjKJUTL; zM}o=sE{%~msrl)W3|Slc(j1U*3Vp5%)boQH(edE{3A%IW#MgXr8k~<#obZDf`c z?e%I7ZNMudVe1Zi=_Rj$KC9ZTzZmqcEg#;Ejz~aXjmf;UW*A1J>4LqC&0q3)>pWh1 zyLDzWbzK&yp}seO3TUp{C*_?)2QA644eHST?GT{I;0Qd%`vDvarD7cz*dqhQx};2q zkCu#cP%W}F1JC~tbhulp;{|KPFk6%I9(9dG+^elg=g{H1eTCL-wbTNgT9&5ZC3d32 zJctJS7=XCN?48>3Zinoff}WBm<96 zf73`ak5!djptD(dNjd}gw4!q|12}^(=SdS%PoknP{OukzS{R{gMel6Psz2Rm1*3J} zHtRe@U#z@Lf3g2r+ZQQmI#}~KwLuqh(%K3g1MD`2znwYIi^((_@hb7c{qeDE|0{5! zc!a*}lGP){?NpgW+G5fMfYq8L&8WX=5sUpLY2tg<_E3YrI3VP-^@Fo?Pj+rA&6L$tX|Zww4d3=a%Rs6+k| z9h}co15aBQr38iFL&tte)cXgWu~DT7N_AL`l?eWWx;-Np63t&qi&$`^0V|EUO$@l=sz_)- z)78>y>KcXAkQpK&XC5R?&?Oy5UpzWP%}wQ>K%c#k&_c6*6fEgNM?VXY1V}HSV-b8Y ziJJnUBiga+6pKZ5XR|FS8OHPIsG`0|=ARJie-0g+EY$}Ef$hGKpvP-Ixc?$JCfT7OAkLXa%YzD}+RQ)MKCHRSQ-z=4irQ5z^pKaGwY z;wJ=2PN5?;{svuYXiBK22_4ONfVS^Col==Tt9Q~4JWM-ST|nYU@^6yjRyqZe6Tbf)*vQ35%OPftrFwHmSGD@1}gm|$9(scI( z>(P!`D*V^=l&V&gGx8zR%N;Gen+(}9S(H@PfijjU@j1B$nI6@kMT%zD1Qr(^-rNF7 zKz%LRF{}X{VK~`?iKTat|2zjiX+nx`PpL+s&}rMzC-Y>mDfVp8O7#w;^}yi=_Sy+N zDZCZj`xg8G!6dcu5!xn(ywi?&X_iV4CS>nijVz-L9Wgbsh$VSwf>W-BoxbIXS}SRw zqeH&pM^)b^btCOw2WQX=v_T#o3_79pN1>Y_0h3z@DYt;B2BXx0#x854Zm6ePGU2c4 z8LJ^bq0qu1FK~Jd(#o34&NX=wZ%Kt4h>u6wmP(sZ!9lfJB~FH9-;T{m5Rn{BFG5={ zs_Kyz!f9<#E%g(ej!W>98#PICnNik)3_H~AX#3%MaBNzAdObS)ZE_Lu;qbfrusk)| zN9f4AwI0I#Z8$JOiL|V{~4cWY(?q$YITAPBFZeSMpi@|Y_wH6 zh%cgTixnWm>9QnnD7R}E1JIG*WhrWHCg{M=k)>BB*PzX@)m}r{L)mQRC_375DorIz z=ZW?3=jZfAw2~p>bp5dsZ&*@I9a^)p75sIISW=7L@6u-3QSK5|+jU=^ObSWAPp_wl z#rh&7U#wO+(a!Dl)UD01JK!%;LPwtz7*7)QbL>dL+~T8;sE1)1!l33zoI6iP$^8@~VT_T>leGY*5M|fqH}|QHnwL4|EjajP?Yeh+El6qnf?eZfr^jfyP(0<;Zm~RLwA(tW8%|tno+!DqJ z6j)G8T@9J8B3f}ZH=^_RCw0U-YGDzYvtF!I)S)d)GaAs=st$C>8@AeEPc^(NnEI=} zh*~CZL2bmw ziL>cz^?-h8JZ#$S??c3(O#vNUU(vv%Lk@dH7n&6bqrCt-V9u5rw9IC=J!vA=WZxOu zh)nK~CT&KmYLfdhJXiT4jVa^!Dg@q66QaM zSF2WZqR%@z2!Riw*tipd|7!I4d#%LIqnDg5)U^hqxPjq@wobsRZmz9EpF1BiSm=vk zdX>hG4!z}<2qyj+1KK=J3f}vD zbpzUP*GX)MomyHIBCSPh_uM0Vcc6sugl6grUK&0#x1oK0;s!4`20kCA z_mil#MrnAFhx_7_g7w70+CroL7_np&8nfQM_)qlF>e_)!pV5M-m+3=^10}_@G4juCI(w~cA> zFT=PN(*K^b#ZdQ}}d_>)A|K!nwy z=+J63h10|WZ9)g`wV|<8jjR>D+3i4v?`jFP4u$-w?zsIHd{)DasLi)Ci33vWb;xl- zfa5Q3MW3#%L7(#P5eF_5)2h*dQ+CcEw)aG=s(?ANnBD>#;*-Ty`JjRuAJ?MyGE%fH z#M*sVBAS@7jc7|VY@Gv+cC=+>1AVmD3Q!Afgu_zH;&?-S5#&wHHMz&ADTI#M)N08+MI$Do~pFr=8gQq;#*el~~{TeZ9nf?WQ=T6&4Xz{?*bKG-?{_6I`{`697)?2QNQ#5BWC(QRm1 zPYcrfDpk%aR9OpkgG8$Vvtt0SdO$%sk%QBU*dAW=8R6frP7&)2nSQk>-xvIoSS^w1 z+EDUm_tC*OAb|TJBX)jUCRAwCj?vN1OX;<6!^c!y+Q*0CKmC`T*!h`F-r`AT&>`_U0EySMqpA16 z*-Z0nLQ6hxK;gR`XvrQKo?Xo01eFGFixg0y)e8J#h6w3K5}Zy;zSoZS+Vxt{o34lM zOge-3%*)1mIQ=p*oo+_T2(<(4$G*WYNt^{oP#F$~!Fpvi6YqVzxC}*IZSrDzGDk6q zYzunzaTW;La?hwYiq+Waq~&Yi{okII4km|*_Pq@!FB}G};uR6wr!PBTg{-N#K>?#tBMZGg^DFjzuUYqKV-S^wwPYJ(RN= z-o3q>hu;wH*bJ{B`6V@MI`PqI6t%4xO`Gf>R{VfQzaddNXajPv3u;7h3E~BYPIfXqHmIA-ZdZ>(V!p|FW|;&p^R=AWeI@<{!G_!06an~IpkCo8U{ zV#lcgOO)T!_6F;%!F~cUOK?t@MW5t9XtamdD**z9yWo4~fJs6kB{Gij!5fun+=z@O zlybI<<>Ns^J2P6D#75@j869-AaTYh?KHBnUiVTiQ;7a%THvM=I+~IojBPOxV>*uBL z*R0h=M0QF1AH_#Iz)XC~ELK6>7yo{dCzDMqI7kGy{0O1s-e%hi4&qY}!A5INHL>-v z=*r12ddyU<=q2l_M;)@Ff%A7z;2in9p@Tw3y^1KgkysT?y(rGB`W5~6RYreVwtdRsK zH#3I8+v3={P1xT}8)-)hpJXva3bU)7)HUs(Wt#^!qWJP^6h9pNV5YVS1;m*j>)Syis$*sidlQH$hzVPmI$DTT*`2(_UNP5QsZ-BHKzbs(ZbQ?DM=&vBv zmgYc~_cd*FwC5`bGn2+bd$t^-=Cux`yQB4ub_TIMZ-u%IZC}ZQ^CmaqPjfqU zg$z!4>l=@u^$m9Sm+5fA@boGG-T5R?)&SA#r{D-%iAmSd;=&?g=P#4Wt?&)N)`ljp zH;IT;V#cG00mVyNX+v_1I&~484>S$v)7NUzN8Z)QBzTCHh~ck8*HUw8(29jc$aKy@ z^Ry(0;f!xE*wOY3h%$64JKAbFMlI;CUU#*x8s5MY=K8V}_!I4t6g4ES^BZNxWCJ8W zVXI}n27KqG)e`24U!N5H`X1Ps#gQLbH4oA56U`$%1s@IZ;rPDl;q}&dx*%@gn{*b( z2kl+Y*2F>0( zRwGMqMV}l1cEh$nt{3e(rqaWKA+?nlx81r3mMSaO0H0I9M;ilwozm(KJ8)VVn)$NQ zL2R35-72x8EuR7t+wNi|S9K%*&K4Fhi$15M~ za#$$&r!EvR9KI}oz#85&ztFocx1B1fYKHe|+HUmvVGY=z4GahI`W~d+Zl^KfD+C9c z5tA$ioAkk15W^N_adbTx&g?7Q8Z9un%cG73-`JqdgN-f7B!_Cyhb_N3} zPHVtj)+Irxx#Npkv@KO?CpM&4v0m>x2qulowiej2b(>hme^LdwTMl8 zG9&7z(u6uBMT9krR}Jtb=Jph-Wl ztp$z5C#jdK!CdX03cGJZq!R-F-EZi@VC=|w;7O-4iB$)tbyuu}1Hhr?gURAfw0WOQ zU4!y|cCcCQbe6~6$QD8_LF3P1+jp%FeG=D*b|%RnFn?UKPLd=uKrH>h#_Nkc9dnCgjBv10$utlc7j)>15L%+`i(r!JLo^DhQ4fE&zYQrRwQLq4QlMFN=~|r= zE#QgU2ut_X`*!Ll8u++jN@R*stJK1WCyi*$eCWJjk4Djs=6wc+a@WVrC>+%e964;n zsL`(zS!pvErN59bJM)T&@i{1U?lBa03%+Q9xOa!H1wIWbhy(sNR%=rnS3XOI4{&$P zh5#0h9Si?xLd2_1H1DqL8D{Cpd!+aA)G1x8&1Qu?ZJY@$_Hqs_~XA;Ug#>y_XJ zCQ)$l8oYg3o1iklD(uLzYBIXe^2L7QWMdP`+j)=1*raJjx_9bfA$NYS(W;w~=664> z4jjP8OgKN?nB-R>1GU^PgP>c_%WOu9$u-3G$;I+}Y+}1v@SSbpLo|1seI(t}BaA(U z!5t^4WKEEI;0-)M<)xex6v6M+u_Tn?Y}^3 z6ut}Dl5H!irNL``^7Od=jjG9{R-H}|ccHgeVixWs!<)!;t+bnu>QVOU7P=Qb4^Dd< zB9c{b+TC=e2}Mk*Bik-RVShJo;d07b1q^&zfLoWJffjSgG@a3KVqM=|S`15L4u6 zrqEec4_T*~kI=*v9LQ|8wxi|XC@f%iaz1NDi=yi*%k2Z11Bdvq83QA3C*8 zG&LAPB2bAbzrqonU^P-Lq>bBfsq}rjHP?aWf1$Lq=-^x=U$&yP-+*&neGOaBlvFfk zQXN`ugtPLUL#ep{iYz8s^txN47Yidpt+N1zW`>2H8f}$@&US;bMI9X0h z$Ly`$UX_&SK)Z44+obI91JLx})uc5fWWn=fanA@HtJ(^&W91ST0FnpgJ(czXcWcw2mM9ieM&_ z|GJhbsG3pAVO|X~ z+{dv-4cZo$l$5FNK&yt=pu!=YL@wv&rH^Q@ta32_4_9vj*5sMJjkj6Z1>Co~0Pe&M z6~W~Vf-EAqFNpGl5FkPlOb7_>0^+{b?oM~xX*J!Z&a|CQ6BhTn?^-Fu_t3nmQtZu)_nZr7Q`p}Tbq=kyb~x$vvSv|*8N`p=evv2C zr3^hd2Os9(k8x6-v5pRMux-Mb{oq!QwtHlLp z+9`T1`!WB0Mva{gUk#54H>vU+q>gC-;7+UEp><0~(d$hXZ*MmIh_6)kk;Z(I4gcPE z{3+awkii8fr7T4LwF&HH6aMg3c(%5{qyTF{A+Nx6BRUtUwu8O4 zz`6^dkR5uh=7?J=ERdA9dwY5JlLb*_^;$(XYM$5M)fN~vCJ!hT2kz|a`!ZFYn%96i zHqMPyHj5M2*cLaigITpZR5=bD)ubrl?9X$Gp9Yzc4kqTiABvhOJ5-&QYiOaP5(s2S zZrianR7itIE!-XCp~|XUg-UIq)R8EqAa#X4I7#a!Yj77UKhoztp*`k$7TrjzCfohI zqdDa2=TCcN0GeCt98{s~kcG(T=yYwpSaJvl3$jS4;I1Ll1nY|`vxSla!}&{Oa1CGQ z;-o4E;!Mpy@~eBbu$?d8*DRo{p`WhYoP&Qn)M>xo-bUlTcKuwBSIVeP(#)Jj(Qc5g z3WMJ0c(6~S(Box5_+;6BT$aXY2=A`i`_|EpT3$bCtHcBF-0U;z&{#3WUXucO0D_`YaWJFshx)-{v% zTlleHJKJ-?{fd`=m~4owCul%FsXTFA(id#>bG9fUX1j8#?PX|pK#aqF2LrYA2a2A8 z4Yf77-5cSvJLGiG&IZs~!{!+3$yjw##)d7B>?p!5*pgL%TvvA41$4reOr%+Vw9xFq zjV%0S%FW9HYTYEoj|H}}-Tke_EuuZx!~0M1;8GCG;Zk=I#8Me6f>Z9 zM>aA{;SgSLYv!YzTzWQ30~t;jRWApFL7C@3eC}mU6t=0JwxwC5Y**+`ld;}5&*dZc zl1bRMmDe|d=^9AsyWHYyps&;4)`A19m|9P}+_*XEy8yk9M7H`!LF%%SH}Chxdc1w! z48WLN>Ar1q(&7KWVPeEty!tVe2VR^tlB$1xet5B_jtgFoRQaZ&22Pw zb(V!4E-S~er=|j7ZgeyU`1kgg^cox($hO|SE*?^iga#<`p~_`7cX`R!@?e@dDF=Hz zt1C9AG~uYpb0Ln&sMOgd@bHwb5yqn)%j1~_0-&8a6W>mDh7 za|Vp|_8;gimiVx(ZP(HZ9Wp?pBPT%X>)y@Rs2}CD`f88)@`mJ3IWQwN+P;k5dVG!vqzBN7T@Bg=#}9JLFTf8aw>pZ%-)nBj@c8 z8fouLd~S~q9>&^p^@y{v+7`Aus%k?Mdh>*}F?e>HrXi=$;n8N!1|90<_6?Lqc{3rG z=4NruVOrHMNc2TNE#6tpU|l`f1|AA|59!Aa(B-JUZo=*!8PZ0Z7z{Ia_`lJVK^9+@ zD9m}mru4b^Ql?R(&&uz*c?|3<%Kj*;CKKyS|Dm&Aurx@R*Hh37rK5eNy?d}xM_A_b z>Q72Lfj{!_TX#mEJ(brpIrT(sp)c+wAMfL*e%U76LoCW^{*qmQtQ zb{t;|QvE;>mVWB5E?-~&0GU@%AT1nNV!)9LQ9vce7P{qZ#v7FU7TN?7y5UVb?TW(A z-4|)ln;f+;?&-8S?wglknJ_n#`3e%*j?ZH*SG|pHOf&u*B{bGvcGI#=Si9LDgYtw> zy8l?KL`d4@_Vp3>00}Ik;fDZt#CM9CDds27?KL3W4JJ)9rCbE9u=BfSHY=VIBu{8> z9rvg&5VBEEE!>iYBUVZPHFjOomhxZqKW9(cy}bNb!jWr;mKL_>^%@_*Qa9;FS?D3N0KzS8twE1_hQlA2psk~% zu51X>h!t69)W(tmp0CRmU3|5>kXr~@!i3|Dk=KcRc6W-cyYrw1?R*(aac>Wt@cufy z5yQe(PNK;%4%%`N_*pKa{iEC2{*E{GIq;n8F6SY_MRcn3c$Cjnq2M{V_avpi@|f*! z|F@&RzpSTlN*2~bNE#>^APMu8F~jBb}C17*$b?-e>J!LI-_<4iT36}N)v^-$Kd-M>! zb}Yvp*WO-dwp-Isv1f1onhpe`v!LJ`I?xIRS#87~E_)s8XYKMPG0Xx$F4>n6n)bJ- z^0V``k7;K}4zS6*``Lw{S)Sp2akzeGkGegGZhr0}mbs4I7!bW!S}EHo2LJEMY~ansyZG?$>z zUVbGL;68P5i_ciu>a#5Ox6?nhi2mk*lx8p+bFrLD+Cf^c{}p}}eBIa8LNR-@OBAL; zsKfhzc*1r+ui6hhV_}jOS(SaU+Cre;{ofU;;Q!W4LCh$AUxm9I zR}G9<2wO)BnRcVGB>LV52m=$v;?vO$UfwME6e&-e{=&u^uefMoOuhf$9>O6Xw&{(y zug|aKraIICxi?h>yuSuHB<~G)zD(FPy9p6u%{2|8^RCGqG_z-uOxAm%Y$wlodu(QO z_GJA|BflsB{ROMLv6a?7aEpgj8d_vvGxkeN3ccwW6@CTXXD}AZu6-`HXOHz_zRGB7 zx|Eb>$ODCTU8ilJy<=3G>}=31lP!S~7?z;IdJFMM*JI|DbyAwMgGzUL*q$_@%9h{4 z_ALFv$@Z+ZdhE0p?FcZn;d!MExA?C<&BknHvs}vWs^;NiV|Uc~pm%b`31LB1{}w8& zu@4B4^py`7G{SFy@IlBZK_43I?<4aXK)V}oUn|FV7rWa#&K^a12}{Xv!rJXnQ*-az9=;2zai?)2g_@nVhH^53g_b`FW`D8IthA9PXO8 zQ}TB?oj0eqd&?m9?0(IfYzFw=IitXY8iZ{FfH61lm07qKkJOBfviBxL2{%m%cZ;Q! z2%+a83hC>qEDmOOy~@}?Tj#mFrNQ8)CDsfC%*cz#f(GDONcU548SS)imz$LioZDXO zhiA7?z^1AE{0Z%x0vYacgI}QUL^kg_i#S&84+l7YpGIvk8bD}imP3=1&~B@ThMRHq z8;@JW{daRuj1CTVc!}^S6L*}hTUSTBj}<}K$;PtVDQjg(dti9#AbqPU$AEA(OxG%x z_)BO-O(#{xVB_%|q=v0v+lQ!G?{K8F^@|oSBy>3?j4o1Txo>`f;%(OmH%nefvr-*w z+-}N9w6l#VXY9?=@sfxBozgJcx!q{@1&x_xNUx>Pf({aPvAgr(-U+6|P-bDQi4E_n{V^B9@%DX)^gB~+ zQyXXrM3(^Xa-b^qOZSS{T6gw8xJL<cCnqas(wLzy5lqgP~l6NDhIL6AcOG;c76+ymTg-ZMs}OIZ#BMQP!mdm^Y|8sm zwEgSt6BQ;EoL)Qv7(rWY_|neO-iqm>FvZCrp~62<8qjN)kO*0r!uA$xG68-ZV(TJH zAd8&9kF1pph}nT-XF=dXHLcFG$h~^YDE%B4k<;&6*P?Wjv(+;xO!}9Mw>q4{BIm=E^Hs7htAeS>FxM{ zl%;Q~0Ib|rZ^&GW`T)HVx=d`Mm8YO(rQbsM^oXtN!tqH;Uk$(Vdg$*i+IALIWV%jF zVJTS})Ou?E7Ed&c(YC!fN!s?VS|9$uzl6a?j1x;Y_N1`>sHjY)0)tlHA$kKCYvqFf z=aRu8&gw2fEz$s5b@~6l6QKDn*He1m_E)C(D`Z2%B|;^*KjCAEOnKN_xFTVTGnPf% zkU;b3E8h7Wm|p0j1Z9_SgA{jKY1DVvr}>Yo>##5u%9^U(cJYnRa(SD>km~B@7aW<+ zJEeiqW8>^Dd2gANBERZ{^TW_YWtDkdRCyzZ=OrP)fLdzG=a984$7SlBR227&RnD+& z>;$@(vY4M!AJLR2hNn~{bFs=Xwj$Kwk(G^CXL{tIVrXZ{Q`*sLQs_z)PFjClZJ~m% zED*i6%gV4AROXk>-MufF8yEejM975%;Z zQMe8o6e5N6Qt|3~MDp|pMNV`ILPv|!JY(ettF#_TZ}0ayaNHdZH*L&8=a5R@!8Wcr zzYQLK4MZ;OR)^>{<5Rdx!wvd;t*goh)tmZQKMD~8Tw#&i26((-d%sNv&x)*^zv#D~ zwlm!S@&`~mS?157nT7^h`IVh!n=QC0Bb%wb-X-^5!wX)7w;cs`GNtGpY|JKF{H6}g zP|s+a6vhZAjl5!E+b-M0dHDce6^Xc|EerlnR+C12)hT}dZ-*8b;k0xm4EwstZH@oU7ZGIi=t&{Tp4DUu^qB7XV z6y2rjGQ77lU&D<(Tdy|AWo+ZbGyZP2zM#fei{h*N60+LrZz$}$$5d`bC2COQ=~Sf- z+Lrz`7577=W+nxsbTBvnr1Gt*f&x>4n>6Qt4G`ia5?KH`)x4=()+z3}3sNeY8M-%V z*dleFsq5?ySp3CD>qs4J7rmu#L^>1Jfw4$m&MA6xzeY+=w$oUzd~G&3kg_xnEeLI+ zjdlZ)XW7Jj#9g*6s2nk#wgoj&!RI);m3VVQwCzC`Nbn^F8lRzaQB*CCvHen^ z7M2)OGnGX?W5xF`)IS9Yu;1`5&b3p#z^M3l*;w5`}=DygsD*(Rg8%k}U; zZ+|r(=wRK(MwY^8@^DRN%Ux}q3|dy%vceY9SG0%@@qG!0MYS4c9q9W}i58k3Xc1fg z@X)r;I#|K4*U~-yX{ifNu+gz>#DC7t1Xhmwv%QCxELbQI*hKHxMB4Oqsiqh^FZ8z} z_e-8&5v>O`3S5si!U7Vt$^2Yw~cR zHdFpJiyzA#vHb5bzY0gJYJ9LzrB^#>LYQ8yh5o>7I;@!O(S@Kc*3NT?j+s2DfwvC_ zaGI-P{8n8(Ub|ZL=60ww!BX%sWO{LFi%Y7Zn zu#6XgyXqm9#YJq@WaYUlPuzhrnNRTOAfM5`{Um*;cvC4D@}UjI5YX53#r0+U1duc3 zyb1obt?O(vkbA;4h=zsVx622yO`lZ#%_H`Pdrig13QW3~V}wGoVW~>r$jtX^Bf(V8 z+m1$8?iyP45oA`lixOT#>%RDxOQvQkYe5Imp+fA~H4m}9$Ctbf8jkQ_VaEEOU*(lr_oC0-`Xz0C=Io7yDTA?39^8Y4o?Go?ij^0SzCf5?Z$RE5 z6Vfcx`dvAWi!1qpUrqjA7k25Usu;~SlwLV`brj=56C$GGP!MVBB9MuDOy%?ysAEL!j8S4-Yc`AtXK1a}YVJ-A%q|a_KE+n^smOm*75ap1)p!{x+D- zz?H2>9gelg_8+u|);}mz8M$a{hS77~8&Dy7 zA!5(_CmePKJbz6Lz_VXCoQ2Fiv%HlIl}Hfjt8P0zv}GJbqkOKd&mH@MHbrP)Z7Ue3 zMle{}YGJv-3*HpRW?0jBBKlqLp^T_{vAn!nr%L>zo;Gel=F6@s%e1g116XKwnLW^7 zA`KLhd-(||UXu`5@K`sWDF&`-q0J{?T2~-OZ}<~_Xg%+agE1QEPxV#1cMlm*8*TLI z06V#H)YmSW{|_)igLo;H3F*D~8MlDr5h=gadRSJ(y;wV9Ch9EQ?KNMZahz7Ytj;x~ ze!J_!woY4w%xb{-YB#7%?yAp$3R)@aCN^yT{2Yf&5=EOjo>OrewDSUu29Guq&*23X zCIVY}Q^DF|EyqYJ-$zYSU^G0rHceZo$TfwdUp+t5h~T%R3yu3&7Mny3;`^IBsdxpv z+7kaBl_;l8+9LGX0-AkLb-JHr|>30-2+91z5hKuqrTm8}@g3 z`2kwey2Jk+HUJubBv4b7EysS(1W|R^uap+7LmFE5W2q_+PJeF&68jja=n9~nHC@ld z-bV}ywE>Z(uSs0m)0!<(95FLX#)GeF4ky7SA19R6@oS)Z5#TDo@ zcGEPt%k?@#3HEP&6Gt|2m%0_}xYxP9z5b?cA~J>f0gCfnHOBSLx(X5m9HHSg&V)%Q zHVl@(f9ps-hf5=!CTNy4a zPEv`3M+&Buvul=hv62_IRh?}8@BZV3gSO)yW++qco_kC=Zm`b)ac`ld@1Pz+jBR>5 zTmMilJhX{jZ2dK4Sfh|)ThYo)|D1DLnJAWv`}X_ak49PlY-a1f5Wh0;6=9>GwoP}k zw4YYD^c4$F-)&;+KNLO{%D-;}uoIO1UJ+Ie8x}GIKT^+%Co7Yuzas1x7JgsH3Ugm<(zy z@Vhz$d~7y0Dl|qXWk=$llq=mnAhg(w=M?<~_kc_S54&bBD!H&m7&p=nx%!B`eZ2c& zY)GE~uRu0t4U2g-$$9dHbrS+eF$mm((Ofw!7>hOi8h6?vge*SIWu!G+6HKvSp#)}| z^Ez4Krs_0gkCJ;JVe#dSJY}QM*RgXn`kVbRirh7_RA*xIxDxTOS zS&%OaRj`tv}t(<$;;YiEhV)8+4++ z1eC*#M%wbc$sSt!EBd?(@Y3lPTK6ePF&C|U)Czbh9VU}g$xEF}0roo$g^u%SdhN5T zElw|)FPlE>oV*Z)(v%-_Rj?iDun0}H3KuIpZ=0HfaIvJ9gDHkn{4u*!ObcIi+&qR) zp*~r1W^W6>yHc2)i$|E?vP{ovq2h(OyCdYVLk#^WOAjnk^lGNoj?9D@(MC*-Sd=}o zMCDq&6)JPHUypviaUZf-dr0w4r$q87tOGJ1_ux$3iJhj>xnN?iJ&OrKpscq7y);#| zIAm<-mU}9rPzF*JA4=zluB zfKL3#w79hM>Q`Kf$WFX63uNJRd9JpB1Om>0SJVMQdd5vVMLlSOa2dcNleiqBdUo~% zx9|wx<8brydDF3=rEzjFmFfK&y#jsFdbMbFr)Z}hHzxn9>e~o^#$8ym9ts)VPUA&R zHhmjS{?P8@BV&U2_;#ut{^kETp~(i>>amydmLe|dRWELQ%I|w}+T}3(9hAbVRXVu% z(3#Cex zloPwYu+XtR8z%5J4YvNdXgE@eDlAO<<>{g>Z@I*0Sp=n3nz^riw%S8Ey8xStG>TTr z3`7HgD|S2;G}%w*U`EoS-K72x3{>7c{|$YIKXP5+nZ7_6GAhgi)qFcEKi^`7)6?WD zQLgK?6Oi>&;W5Z#>>xqq;fXjYq{xa3fxjArZR#N&Tb0l#sL{Kx~p*OHItso7FAP5sz&X; zl-J=c>(N^Pk1>k}7VWPv6_YL#jPQfI4Ky_XPkx6M3(|N+qsq*O8v^pqxo*KgY<<@v zhciVo^fR!G65)db#SZINCe=ynM>@?(A>ov^#To-v5uFGX_)b>0SH*f*Z)mq-xP-nC zBUh~D^`dwFmvI!8b8Q# zqry(hn$XXq@mv8m+rg(_&Af-DZv29?;IxU?GaX{*dfN)ZP%*m9$7^;9sQcgD`P^pt?9lCHeQQoINB6n+s(PKz)T?5%cY zTz#O8t$S7Y^m7->={k2FAJ5d-*}94<^mFEp;A+~^chB}l$D>>P;5cZs)gNn~(B#C% z_$n3_d1iTo=x^vrLq|s>945nZydHj#2}`yf9V-f6!K7cn(w#Y$A~x1xRtYyyq%7n^ zy7d3jxX*ouRqY#_Zu>19zs85D`~1}uSkE$l``N3NCRVnfOVKn93o!pt&G~w^?x-y_ zT%`jwJ?mdja4Rc3lwITO;q5QHCLa(sB!FSa>+uppmH~JCTn`NG=%A!eHMm)8PkS(q zPhZ4Mg-QFlsqmDY75vlsd#=+@BK7Mp2^9Mbsy_M*!_^8gY3By+s;)fGfbwElv!2fv zLriF;$pbKIu7mQ|>a<-nNv(6-dz5DvU&+E#&FODKh>iZ)`Jg=))=mq{n_cw-LcCW6 zLi~gY#gGYr-~WvZ/i&-WmN+s}QEIAf<7GMCu59KUkxK7L@`ktbAeqKPT8X=2}I zxi5_M1t;;{b)tOe8OsMYloTwici`X&!~0 zH=IqHmymRZp@A&3?6F+T3|DP`_tffI*utZa8XWLZ$Yn~u@E%f3oMY8NSRxdDTu! z3$oE)q9_fhw;t?Z`t+f% z1Pj|IPkI-1+3(8T@#jYVF9fyiZe#jcBmY8~V?*9`G0p9SBEV292cg7IW$lmK5&N#~$9krF#*yn^ zFf>~P80ym(=hO{C!Mh7D5{ib2rwYeHgq7Am`F+NMN%qL(zNASpITmfFWj=;1l(_8u z4r0eFqTQKh6R1y6o~?+5M$d&f=+{~g99XcMJtaf3t`m-dJc9)i8Xt|NaXw1N=pigm ztsDx?n5}H`?$lf>?vhSZm5T&rsIjn2@3W`sn7-F``yfexba>zde=i|U$d?JF5+5PQ z-`k7j#aD?zzy1Eyi?O)mZ0kt_7Tbp)BgZy$cqRXXDLy^@lDS>9H`8d&Gv$arpyn_5fZ9i4n95540dg&7sd__?U;@L?C} z=3^UOI{igkH|LxEJxb|i)4BDfmDo*}kJJxMcyh61C+ynOendFHmlhyIW^E(&Vi%2S z(HWX={{%6-lX4$Dxn0mmT6HE$)J5B@Dm!MZEQ)QF_VAg#%Y*JJOmnbPF2e8HEbKmQ z43wdf-VT}AhxD(tTMzIqp0VSe(KL&tr%W!3`;1MxzcfaOpFe8B-(bLCx>2?zt!(X2 z%4J`m;qsL2M+|P{6nTb1)pBh!@?^@#7~J8kzTAu$-$IlBrG?8l;soAcA|8wpHEDZk zZWFBHXO_TMJn~&wA+*JwYt=3kiqNfqwlr<9A8Qs^*xGB~@UcSAehEUC1t~r?x7SF4 z)#I)N^XOQyoIJ4&th*8-xvS8+Er|?bqm;Ke%&=UU0#bs!t+bQBkqu6g3wzF1I zVqZ3tmVbnc&Upb6CEe~V5A^d5klcNx&>eSzG)>(Cb9Rb~+oKmvx%)lVTljk#?q?2v z2Lc+75t-NZAPzl)<+=7pLvV_jHiY1*V{`4*R{_WKR4|!i{bhbzhp@X$)qcwt``NVC zapk*+PRjq!KPc*YYgmZ#Q*XKOPH^ARGNnZx=r8l1Gghvg?K=uZz=w&}^f#5`j$!z3 ztnK{U)uP=mb-I#gIbOxhn)G^CTfM*0tuv8<0y zUoCdh@*_nqicjni%PY+J*k^flkdgCesn9e4g#y9pTL^jiQjd7rUdUQ1%uX^CSOOp& ztca5&>XOF!DR#S9old8wYiq^ysVuFkjdIVS zvkpmCZP1}IUH(R%0kzkHuC?gRq`ckQf?PKZ^MPmP(vHV)uLfFo79x}9-m)$;Vhc_E z#9%b*_|NLhdi*^t8yEZ^L?muFiS&qDo#MTh1(MxW5@qH#dD{Q$m04?k-lfJRE^skT(y!q52t9_@isG)4ylbP??`h zvS=-MC``yh7dWl-=aFMPy`ZrZJd&P)+_EF3yZ{i^aSyQ0SGX?cXv`pa^Io#B#Hh5( zann9W5sRgq<%CFl0_QXKjHX@e16v*<%&469%SfS1((Dq+ZRDKELY}Ji{uYCWtq1{i z4OkYk2WPt3~ZHmix$d6rxW7oXr1~#tRju$>BNqh+w)>(mF)%xFH8F zJwQva7ooPPe>bX2)Gf5;r8*jO8ZG7_Q667^DVw;Ih3&ia#uL#FuH~k!M)So=O(&^O zs&SZA?J}94WJFmZg5UIhSjnRYW3x6>$mb|p7GTzvq_PXa*VJ@Ng^ivmZ@u!s&}>WX z?zhSqn`5r0kwYBkVzQ8VR_w!%=WhIqTDGuNl1qs$?+_WR#M`fZQ)-8!nQ~$rqC;62 zO=aJE66+lEJopuYYp_#%e2yXCdFN+M7hCh~`E3Z8+3&WpEMv`gEpj$-C{6hddo{Bc zsI}Gm%>WM*2Ec!XiYC5h7%({du7$=Pv$HX0XjX*fEQZ(Z%2O1W3R`K;KXQ4=p5a97 z89o*TVm8@47VPO|ey8ttuRT=rcb$fx$7)+X9QPu3Up7*WCJS8v*?p_Dbu8iSM-9#KQBWBEYj4*#Q0Qc5zk$NC z2w_fua5G4F-+#D|+^>JIH1OJr(oPAqWfS-Vn)rlw31npH?2nA#lqYr}?DGYi{1tMY zg{5B=nqxap*uDLwa<3pt&wL@iBI^#vD<51e$IlNf#pl{-;%Z*(rfaQ0a3A6TdiT|_ z7B+D|jk(Z3$(jyXZ#;ri@Nr7ZVGmPRI4GkaQ_B^)&tW1B`GRJw@2XvlO58=`-fCXt zN2#xSBod#U=Ef^4|LT!l9aZxbZSAmk-h*9K8eE27J}wqsOKm5pntIpSffd(`~H zb8TjxR^eu(9(K8acHzJ@`EtIs;c zS9^IL1|l%d2+PDkf~+eD6PK0GXay!dYa8$OK)lI~IevOTINH@cG%FJ|c*ZoG?wxx$ z47wAS{fuRydKpMY&lUD;tPhrzz0ERI<^w;!k2mHH$$+HB%2&3|7UEM<<}OJbB4k+O zpRzR7`J4`>z90r#{q}1QQ-1_7Sklha|F$)?G4*R;HmyInnEEpS)cv;Itt@l7GI2)L z)MloBeVEW?Tj6AJC)Rk|f*YAyD_pb2I9OW1g}QpCey5*s!n&}IsXrGE4*J^8Rz6EC z2oh<(J`?c(a49#T6{ur6(}i_mIDY#LTjnyPj&UrEs+8F|9`xQyyNC_-HOqLexe zvT@KFCH9<}TG*I23KJU8-IY3qPZZ8U$vW{|cdJ(V@zX9fR38|W9+UcbzBZ?c*itwU zR$_F@E9Z0C#I@G= znJ|#1yjTlLX@!6`O4_~mTHOG?=se_JKI!AzHF07yyM|JTe9G#F$02XZeA`mbQ5 zGlx|xH&-oz^BEc+3AV2STfNkw9mK!a%q23z5W7bNnG8+{f1&l@1q83+GuuI39>n01zQ~dvjGE6gcUMU zeS!LJjev=#D&yKG5a&%W5Fk*90|9$^Yv78fCH5;5aHx2vN3@5h>S4Wd9JKmpRr8ft z*NuU^)sJuN^v3FG$O`kDFWtd+(Ves=y~_uShgH7pj}A7!&*BkPT5Wg3!^*)Zd40jetlEjYnznfM8RO-)GMJiX;RwGf5UI@IlWHi(QcD2Nm3k;V&pt~<4k-#fC zC|aq*Y$whjjd{_6vAbd#{TZM5O6+a8j?onr^;um_(O+|4TPbZj=Dt?KWl(B=6pVQR zO*Fh3Ud(e&yz9Y_OAJFiJwC;`=T%^T%G+rHVC&LJDB_WhR!tJyR<{i8 z8|*KvnbKQ15RnRNzF5#^@MB&t_oTW;Q zK>yU~QytQg#4Ko}%NS|<#Dayn97f&qXOlYFg0(-lH`1C9>#=$_8BhkS$*{1vHkoL0e@>6PwaDQ5o4rHa0Ty*7UII`6>EwpgTzU!%WC1I}krf6nO=;gcXiSZr(kyEC>5Nu{dxSTr zqr2?*KDJ(RnuV0%;c8T3Ai~y+3fOKmK)70?&d1$LKipkMF6x0dEIc~LxBD9IN>HO4 zl9WN=ZP%i^7uP!&G8Tkpy~KcQ2bR>DeS8i{`mw+KJ}z2WtZ8Qnq8m>dD1BU}rJt`P zc}`C@?HdiQ4I-=lFam8#ZyXx_=^v~ti>ivJ(*2)D6L!rnlKb9yMhgwM^-X>Kj< z(efJ}3M+FWJ``e}z30)~b{1Ahqpmemd~Kr_iyX#6!@tzynWnU7BRsBJi>CM;r7jBn zH6P^K!iV*2*|)V4u(%b4;8#W_;@QlbqA}Ic(gZXvi644AET!KiFW1B8S=`g-q1es! zFoCWrsS=wrH76-z2~H>U0fa%s^U&M&ezHK{U@!FRNvHRe;Xk>=mo00o{rCloeQ|5W zGpwi8bGs<<9i*!3RgNMop!xqsxwXR4!5`unu)1ko7~iq%%~}Z@%SZ7dk4Nn+^aGlh z4lCKBi)}RTW%x6uh_ID>230(#rH2t@lR8Xpn*VD9H(;a_jxpsdS~e}Wzx!_=?XXYL z;g}ef>8!rT`IE#x4U{C!G#GQhSP0YePMA+u9+@bIrs5~Sjz`HzO zI_JxNY*Y^#`2nBeGCD7|PGeY4C?$tGMf>nm9=2dc zwZF!5{~fHDkY<;y0zLCAd35y)biyodp}4ZnV5!tMR7mm~ALSk3Kksdt^F^t-_5L}` z#X0*=M6Y21YIst|{qB)@`BLKFU|LgwMS04zcIvOKOLx@1&Z!-si0`UP+hyVqnWWs@ zdde*q%e}?-FL#`IM~Cls-YSA4my!~i?s*!o9YN#{jn{$?PQkpU zn2qirw*hd|O~X4}60!VE_l-0??;T&3??m$oZyi{E&Ru)bq-wsi1kFn`8Xr`{256zN z<6Fg&{Z5D|m}7(N9e;Q&R`IYnI~We1d(+^ZzEi}K;Nyx+;LT*=hhqGvGmXehBp@CwUXExGulm-tG~6Q zF>A1&&uF&%OjR;kJhwmpo5Px3(n_;eyOBT(N{U?7F5XFxO7|%(nZn0$x6?=ij-gfQ zJ#7Bb(}NLpmUqIkGUXM!q=#&$iTBoJfwo%_2g?b|<2E|Xersp3%@><6u)2vxJ+QD@ ze=Ir0g_SlhA?}RYE16A?jAHm|)Ht139%-Wi3Xs&%5_jl%9?mq6UDdi>QJV4SVORIc65?N50 z8Fy=9UXx5{rPxlV_|7vvQD(_?$L;asFnXGlMA;_(ZRv9jHPvW8pPS z6jL}TD#nEpD9D%MHMh7=n26u;K%8eNhPgLsVGb6|xSwG4nS=K& z;8|VY)r#p&L6t=acJaKl#oWVh^zJKajQ7Cp%ST6>!HD7_rWIe&61CMX>ygxP!G_f* zV++1KI}uB(_1fed6$*r<)u3XGaQcp$)Xe+hGR>~L|HABm+F5p5j9J>{4w`|Ph86sy za8}MAQ2jePiYD;3(&ZTB?Y#4Cx5Z%5ftqD?VtEnW*VZ+$t~o~5@3Y5FR7K5KY*8i=D7R43rubI0o7zOkTj1el?+*> z&A%M!Uie4Q{CUOMN7~y*I5=Y1fFMj8^6{4YuqACabfzM?cZu(C|K8#$9@)~%G-46z z(&XjO#5Epg2FS=p@Z##GN2zvSnZ(D}t8ZX0uRZ(;%^zuQzgmO)(#^>yZ`H$>pMzO! z&3ATz;#k_{u1UtQ=n}Ij*KDckiT;YiT%=CSJ6i*(5bqe_juk!&EBPk+u)52m#MHA2 z{+Z<4wli5OEpWx68-Tib&O1w-l#+`d9-ZW}88Pc=ryJpU$s{z_I4`{ihYDoF%eA@M zVpRi0J0P#Uc(kEihN?1lJbcC}s|-a36rc?>!wX4b;YG-AG<}f^C?3NCRbWk%)8Hsw z@NFX{eGHG8l*jdD&G_w8oZ?3c*Zo#dG?Pouf2e}oKHu}@j2xTZhIcuFmCU%d-6 z0IHFoCp0cO*Dbyj0D54d1Di5>KgiimiO^u z(aGmNMu%P(O>fd^^6`QZjG;t-Npz|fU!4@a4CN-u=IB(graO(zEP8sGJ~tQc&H2aC zkqX~KMkAY@cCrFwzhdev<_nehMCZtTGoVw!o7({Zpf{3nMJxeuJkOSCKRr z(>k=Kj=S<)#H87W+g9b!=ry`b&~d4^!IRCpmeoLuZ`lX*h5Ft@PzqT>hD=y0obEMZ zNWiE-ih28mMDl2q+4ZO&rb1x>hi4h`F<0hG)MnMi_5iU|<}V%;7%b@_58V0U=I>?) zC7&$>ypD>%Gt*kc52b6{DE5{1TjO0~ze?_?u&|_MF_){iYjSbD^MWznA~ghDHt;g+ zXz>wPlSzY{MdjKK+e!2zEA)1j{H!*9t@FlLF!^#0YVI`4ntBTV6Y?skNTCtk%Ic=m zBMk6BC&{d*c>Gm0*4EWgauV9H3k`W1+@9p09zQU5h==V4Pb?SzH8^Tae&?mQ?o^Ue zXH@YCPD!(>=DS5@&+bC|jyz+BQE^c_K7jN5Ge^~GtMtfauMD9HaiwOsZBKM!vP5Oq z&86s?R$+_G$x|U^C8~4mEYbIL0&<_XS4FWsE^fs|ig=&XB#DjH0lBL7i*szG(!Vz%0;_DwfE}{1$PJON!Gj;kRSq+u?%A`90 zHB49`%A*FHPQn$K#CITv&bzO-KfpvW__fa>wA&2LH&P%GRUq~}=)v2s{rmz$^MjZ1`iKgo@YPsY5B8$R`dWJnz%DTJ0=KTDnUq}kiGHgY zx;oxM)Np^Aq47K~r<-ZMSi>DI)3HW#RCuTq+UDdCmd0cv)=rD>AjJk0b8|zx<@I<+ z?c`iMjcCaK78bv>s;g17m+O<=rlYVLZZk}pRQ;~b2}ql~l$RrK@wFaP(IBoKfi%`i zQ#PD(yrC-J`8 z7eHb`J!Z;;7@qLbH03S$fU_@OM@pEPay8t9cNMwCqV3<5^JdTPxxyIUc9`Sa5E!TO zv_ObJhH*$4ikKN z=lz>T7`4s3z{Vz-dW>6MvY_eD<1-6V5H(W!WGRYO{DplyU$}a>`JLz{P zR$3(|2WRVGmzmED{Q1paWnl@RzBI0zTP$}YA@L`rJ`K z^dQmBsnJ+gd`uA*puris&WqKp;tM+gPUrjsh4JiOo#Kls*G0S;8kla*V))5p$36vm zxX{;N?7E2odI^hFJT&1g7Rgs&!BFXO$dMyE{G>rr|Iq_k()#LuL#CZn;FgLhc0%h7 z4}t??W6~TnYEC(efeHCpncYoFDZT8x;`O2VOECgT)p+S;?D>RWF{fiEPGlCRP~$MC z5*5AoL|8d6)?EQ3UZzTccZn5+^FP{YYLbP8Xjy3f>E#}O>0p@DL&gm8!gMx7^GV(v z92cdCz#N7JVy)z8Fok1Gl}ZorJMRmR=ztExPk|AzA8^N#zvmTI0?IIL3(Y&7Z-4j# z^Jcvc@*y92&Ra?@-X{m}LNj5xaHFav2hSjJh(jh1mee>oI-}T!*l<(kLw^)rHlc~3 zg~D37hR#D{!g;O*=K}pq8jR>S)ixKZ8Kwi~X-ZtTzi6~wuq>F&rrxVbKj{|`hK@NO z?_n|-r|@%m*MBD9M0`6IXUR!yENP{w*zqWn(-YHNIR^LrOL#FQDuGp*_WRYK7mO|M zqe$Rwn2DjPBFFtN^oBxM0F8y(Y$wJ1PmB1*$1o_xv;bQhPKsswkk@J6RW%<4Kksaz z!A+s1JjH};&H+4$8fj`Kl~b^fYsC17xpynpuWMB$GA=f$q4@payzVYU+U>ePIU# zSkC7!nzYl1%C=h)Zbrp4t_~WpK3DS?a;qjEG~{u3W4XmtnWN9ra%bz5mO6=#*KTt@ zUQ?89r;u?*GZ!w#Mi~s~`h@hLoC*93=lN9ZF(Z(nhlKWa?9HU7o#$2P!5NBieFxga zf#o1Nv70fNVMaEddt%Wk8u~qKi?;Z>|4TFr<(46oc3y&sjqHk3E*mlDlPX0AO9-%TZ=;0WEiC?_^(TO_o3`=w zZ0<(oht~Z-X+PQqKq2ANNfM5ObiNl0oTbI9Xy-5$-l2+l4}2isSfd*F&7?3DsES=Q zGFs8y$P;R41P$%6JyR9(*$4^sk0rv|9X#aTvGm6bBD{PJ|9Q{+Azx7+3wOnbkKGI^VP4l;aZJHW(wXT)sq8%%NK_?8d3NUmVoowc+bF%>a zd2*e*U!%Z0d5UP^MHea@^l0lbyxiOCFn>EOI;Z1q6{z&cxN(#54hYJWJP)vp%}Y;59|C9hS9L6=BK`F9N6f!>iYTHQcHr|@B32_w+{<-B}Q`{HVk z2AWxAmtbqQUq#;(&0Ua(hdXWzRGsQYE#AH`HB3plcF<6Si6gx0Y}!e!Dl5}%OSCX$ zg)QyBj%k{6r5Ua{`F=A6H95X@3XV7 zBTmI!H=1D)nJqY_aCTQF=7h>1O1f#$h`$t3EC>n7+SJU>dKp8{MX&{FWQ#_1-?p$qA(t z{Ua)nxy{gN$3~-K>)Ri56~vO=CdX+sQX1p3|3MQ}fP53~#tyu?u8rp0YU-zu4i-=G3kXtvEtB;P4pfrxPp@9L?hL7xqicX- zUjyj=-eoJ#ZagE(>VB~tveZpGc(}IOUv;`6)u&VI&Wyr)6yt)sWd2f8j)HcHYHN%Z z4`tddJnifK>=Zle>GctvSn5GiiaXcN6zs}6J=XF}Mc1Ple3Nh_i2a8-Q#8$k&_DgA zh0R_&H~Jl9xVRq+3o@M)b{kb@9ZkP%$=Hyv;q(u%G>u(-FIJ`CJdXh76d~$BFpkr<-uVm@!2Q6=@uZ*K?E#2J8zY;( z>HJkJnEM{l_Z>3%C|niqN9=g`921hHy(w<61=Bn+n}7JLx)K=P3<^BRxBy5$IC&(B zQ5!T3w--a}Qhu-Pc$C^Mlk}j;uuD(b2ETzGUbfMF_|BM=gD@1exb3guor=rXWAe4@ zEi~EV;zk-aT{!)(Ctxfu^#U6lwGwX~#sK4NyzUR#LA_uar&LpX7=kybT@Ba50>g+D~(E7x8b@Hpp;Q&7y;7 z-Qk4w$cy*hMc|vQZf4=sm<_gwC!$JC zK2Bt6JCswr#{lC(Lj8qQxwKc{0I5W{8stN>e0ZZvBy6iR^%Azg#6y5RP%5KuojL3l zZSU9#w|hBgMLR`bgD%f2|LQ+=&WpR-Men-3;Dnj>wzUoQ+00*5%~f|m&L`K?1Q)1* z>bnpse8m#kjxHK$!QrPp;-0iwY3=6<_4cZh7$8C;f5b?+){9>>oXKbtUw+hdZxX8a z=nwcdFN5zisKI(pQRrqPUfel>THtl0mWVb)`Bob1;;b)kwVt^Vf1QaD4Q0=&hd}ig zK1BeVaJh*_qb3Kv=|4>B)z`_5S&~3(292@Su>;6DN^)%vN zDp)N|y!$T<&vNGC?(V;7yK6eLaD?e1KErU@#96VqHS_BwH0o0zr_)syHp6C3clgPK z`Ck6MUUCZmmQ&LsQ`)@)hDlO()5K=H9-;)t8@Cnjp?SX7EjrTuHzNxC?)H}dQ`dLE zHFfU&OHLM31ZQ0!ASe<6_h@@St=p=&tCBzhgpptdif!+`imQ%l?YPzMJnZ&Juzb`ZUzw z#qT3r?*(*tTn0%z7zKz06BCk+uN~Mix>6LpXEGYUP(r~KgaMj@DZ9jx zs>YL8cnfypK4#&;OjRfG6xr@47IpNpPLi$QY41x+ zOtz`yl}^HWaiW{LaZTq-mSP8AqLd&MD9k9F z`_JMx0dmil_udJ^_?UazhWL6<-@m|~GN3Tb4e@+dnq2esg!+)fB*Z*ov4soK>`5E6n^|W} z%&ZfTUW!XQ@Q~+xgJ^)$g%>1A_VTq*53%Miehof2XTb$%=gi_gZLEvf%lVu*S@wq~x5`~Z%-i@>dtM5-s;iBui+-zAZ_EbOcGU%~)em^^jG+K$4p znMxoI76R%QIj$d8 z`DxxN!`FSG%z`&u!q}K2PHeC9gOTv6m02*`!OXu*!iDF5>}2Mt+L@&hHsSn9+C119 zywgGckpCZpk&crw|#1;T@wA91ljV*u<^h3T2d#`Xw&rdyIakq21fn4v? z2W9Yv)Iv({5iUNbZcyRG3K3=>E8 z3kd7Y!h=AReBWKV!p!F6pT(#_L&=7{$8^*y*x5hLhTd~>CydswN!3E+U%Wv3i%YmTdjHR%<~xi3q>~ zS==UEY|(z^WOGVOVdR*LXT;12$DCh)%#fKxvYh{K7~bZ#_N=+gM1$1WpIMTCm37J9 zOfxrr4znnvt$c+z7ofFR8+Xl1Ot7~+4N6vQycKb4i!MN_Su!^TKHp|9EN@F@WZTP{ zyQosJ2!m&qEnS{vZU8euUQa_MG3Ugb1Gl4{iJc{aziVMJ;DL4~dZT6(o8V};d*j!n ztc+PTUwhrjESTOSTzG)~1+exxThW;pI+#VH%tAqD354o}Ihv7d?z4?Mz1NDUWfcn$ z9K|fgYP3+KeOa7qt7*odUHq<8auCbVyu01rob~y_u%}nt*PX)F75OoylFQ2Hgpc7f zi)X{fFkftkfBgtR3p0BFSdRIwgNgb98`Q#TV%T21m2_hZR^e)3b&l;PT^8{=sE3%) zSrF*2qCXeMnzdgVnOOZjij#*OSNFAD_l23w*9SSMB7upSb{uQ;zbzxV^m5+VksKfI zRWVG=l0IRmtmI9AXSjhU0MIeNL-JoPY)wAFpNR3 zve)woo<}J_w2D9i_O;mxt1zUgBFx5m89N><9`k%jqNI5|yhZCsYG~LpW0jCrnb>`J z)-kv7)aL&K9+2pdi=rfHDiLz?V#0=ttToA);ER&&H#0icO1Av8MU;Qn?92C=3n_8F zjoz*M%thrVAP(IFlFb~gErg74)i?Y;tNCGT;*MHBooE}Q8r`(HtNK_)W^i0 z$S~>ypkGC?hTUVy^D$61*q{O2|@TZfC$rCxD0x?Vm4(6cFo$`8fAm z43Ws&1oe%+ojpy8_vrgJp0{uwSHF(%Y{`^@6q})#xWm(kjQx{4jFp-71dQUhBf1d2 z-Rs5nhsMQYX1$+lES?YjV0QC>LoMdpW!GK;GHBMfS#Ynbf%&;7)vWs)6VZY=H)LH) zg!)0X+$3H=CgM6#I6$)YRRe&bz)=`gU9OZ&ghg7XnGKT-%QNo>(J{Bj`JQxS73&9GNKr`a{9#vw(H zkJ~dP5R_((GlS_eMxi2Bcr05oiRxi(FottAEywE&69W6ZtHnKXV19#!$N_+mlOw z$wa);&&<9Fkjn@dKX+-gClJ^$K=Q_orpU)%*1R z_}yFg*8bE-%b3X3kOD8e)*J46I5*CK;mN^7R`$?anYl{)1Yyiu20xo0JO2E7*>gAJ z{o*$nocEY{Cm|3Y>yBBUxcTy`J@I#DEkBw6RM+-9ck(Qg*Cz^tLv$}9yW>k8=h_*; zIn%Rs&89YvFmm=qEG8R`e4#)c-)8W8$jl4J)-c--3BY5d>P!nPMSYa_Av480B$FI; zGjpU$;d2nYhP*_4I-ZFVfSd_Rnm>3&GNjI1d(7}6vPb(dbIVn5ozFQ7wO68Ph|TJ+ zc+UiSM`eae-owO>A)D8>A8v043>w#vBa(eCtvw0T;M~Pxg+&K=R3tN_5JAQ;-HT*> zE_>K5WD1t>Y8qXIN)`poI`?3;zNYo zim)M-$g1s%L6#4sLPQ+O0PT|01kAD>eCqTe&k0+8S*KjnUUV2K7qB2*b|PW1!^_8; z7dVN_giccf7BnY9$9l+w+;c%y)XfDnJ=UN!3Zo9?e_|!30xRbb=`Rc!GZT5egLO`> z0?SXH)R~8%L7B0+MFQ4F*al+DO~Tj>x;HLypim!Ib-t{Wcb_DY4k72Dzafz7!zAQV zgHwT&AT>S*RQi8rq;^LI-em)l41oojd?3k!BKb`M)xSbjm^IM(f+PG&mvii zf@IqhD3kBseii!7oLqz(<<34$jxa*!Dz{4Vz#*M)MN`R%=Bw+CyT()#RTuW$7LsO zuYJMHgomIr!y_y{eq4Ibv{{J1kLe}hNU_(jc&)$3gd{0D_e`rl>tMap%{q$56MaSF zCk+1-NsAqEee@BVd1a0nPg7#v?h@RKQ1Z|DVQiBf;QA>qp9}eFi4B;z+ znVHYIo=dK~3LPj4Ho+GhREq}oX~EAThcJ?#pCbcrq{Pwq0~XE*n2nQ+`Cpj0698Ag zDpx?Y&X<t#`tZp;aLo@KXrR-(zMML$;Yw=U@aNteU+ciA+Vi&KDe7^jg2b0Pblu z*)%?Kvi{}b`tm`Jkduu}MVbV0;gL(_-2;R}(Y=|7M}+ng-HnWYSYs6;g%lCfYb0VM zqu2~In+?Cq;f82V^Kfu>U99WDz>H?hRZrWnk7enBF;V6s!9}XtTM2NQlrvENcU7Rvh!^R!X)l}P&76SQcmFNeNNJHov}M~#g; zNG}^rucAgWVXF=Topm5rkb%fzf+nr?e8A&}v+0CW@ZBNkc80o#@;pK~D1}kE`ewPa zrXB7^T=^Mg6nq%jDng=yRp4`(xeiIlK>iC-L8*p6$fqo|>aCzm;qc?H=eapdn26{> z1{5Y@x{=cNXJ2B+-+tA745l4_H-iZ;zFrsxA`~XVljHNiZY+5R0Q%z%7ggCkRxyFblb*NO#F z0ue|cv=qllWXVXc)8CMA$;*$=VzIU_sI7N%vT%f9ZHGb7Y98R74lDld*dRNj3;;S$RrJo>XZs{1KJ6VO~ZYgOkIl+5XvzytQMgJaEv6 z4u}*8p1JvngYUEH{@T&ibLA=v>u}d$7^tFNun@3ie3L{VJn-SI! z&bE!57Qmj&_6r)x7KX_R;mvy++s$#62s*^{V@Nft#O#Qya<7e=<^s)~TgZz*SQ^EU z)g!kd27HzYTf3=)8hO-B;}tnu;@I*0<}3PUEZ)=GA)M^{ww;-Uc%7rLv_<}y1n*AB zb7FZri}|XH0I*&n%P)orcC>LwEV>$eQ3xs@}!+;4L*o0RIp$;u# z!gz%DXD8wPc@8w^7{WY?UQGzk&DRLw&uZ{T{gvnEa^*QBTMClwv-?KnD8fJ!^aJpyVTa&+XTqNEfT3vCE+D>P zdPd1jUo&sB*V;{$PBL)-KZ5Edu;0!%@!~>x{251)fYy_l6`E?fH6N7!RLkr3nh4D# zfTg@9bN%^aMh1BD{n@@e-%)E85gWy=jEBM*-)X<<69!FQlS;?`*ejf&CDbP~4!N06 zt~di>q5%6|!XWVpwy#Cl86vA7&|Y!~XNYvh9%0b!RXZQ&LYeW_01ry&%*S|8=D2D5 ztcl+ZTP)7OVBsg6!Fxo_=V)1OSsT2^N`Iw2(upJV=h`D3!iai0j)L97&CT~?J2Qha zC(2eFTjrv_A_feTFrp?{Tht~DKNPo)-cAotr35v&jTpm(eThqn5hIlD)9!SK%Y|`} z07n5^+X!&@jpUyo7;*&ughdcyx;iEUf#hL91z(W0Rqd+ZDC)WUJx~lY=4iOwot)|? z+Jq5TwOVi^KGnvJgeZQ_&O@3xX69QY&tXtB?B9J^AZ|zodLhl;=p+Q#;U+<=Fk+{+ z1K_rWh$@%J1jN41MC3xb4=cpvKd31mhy5o^W4{w;q{e+tmY$hHXh*>x0jd)Phb8o* z>2`Pra*0PfQ?u^Go%Jq)wNPHEDikTD#wu-8h6u2zG^Ojd5ssJei{BMKyv#Z=f35&F zvxw=jnwFWG9Us)}Gfm^tR;ezpbC3 z-DaY+M={CCQX9m%f++#UCugQ@W4?Pe1s@U%e^uPzf?^f_5 znz%`+rh(i2l!FrlzPe<@XMc))%Lv|RIF#Ui4}CM+t}B%x{2)9!IYVr#ZECFu#=t?8 z5p~qn@*peMrkgOZ4C7HA?%oko?e9SEaXFL^vT;2)3nq*;naxuPAy~u<@+4z(uci5Q zi71Px(U|h#&lxG-WBrujYk)kz6a$s920JekygaMBu|>1%-PN`FuX`$%+KHsa{68@{iN!4hu+M^=Y_^>DR#hCA5IW8vjl8v{Nv+l)P2b?@V zP%UBDVZ{vp0FV*$@)v74aKUsiLHCjRQ7Y>y9fgNr&QFD#rRG(!Jl$Sf2i9q0ZH0xy z1Y40J0zeHF*jSZa<@++#;BJs~HD2giKfh_Y#b=Z^y<^JAC&n?M!W=@}EOIuE6Cr3y zZn|?;m7GSB{XjOCI61*gD0oZHsi7djGJvNjfuqIX#G*({1)5D0H$Kp>Nk%xz#lBi) zFY8qW(lrvS5PHQol~9XJ53n&|s}*9%iO3c@y%z@SusehlAO7d*7JGh^02^^~1}F=V z5J{z3wY)h2AT5DXo~gzaY)r_)R151>Xlu|pu7l+g$)S3cbdlTBz26sxetR2verkQ8do^YHLP=RgvK_T*z@orIogX>7&)BMPE%w0md5 zjWzlJg~BWT6S%I`VNE}3Sf`MIkl zEQh|;M%AlPcP3amYfiu?sIuMt%(^LU({jC30|)V@_?1UiH0pM_N*7w0&~t>tC-hff z{o+lWSlFv{r9^B%jp6bQk_yQ|ku;^Z;_uKCLf<5ixr(C@5n$tzN=ZYw02#=;V4;m|jOIk2pSOoNOUx<#|M({K&qW#}5B z3|5@!p~~AbrRK^=+jFN3?`IK^Twl}9E>@ncMhg1)+qo7fe#iD38;cNtwhR^!P4k}} zbxR?HkeH016f@;}96hzxtC$W)%)&-3T3 zj&E9y{+;%QOhc6?kf7?2ZCMUx+DjsMpn|RfwG{HaruwPARY|wU^m=*H8D3r-$igZ~ zD&g0jma25IzLR&e-h(jqnuaQUK}pE1VLVXD2%Yk@52NJCz-NXDi1Ea&*?_+YJgqzp zm{E_a@KZ4uA>3ijQOeYas5-{I@; z=@~F~)arTLKG#c0LOEg$Oa_7)58<#H;<_*>RF6y@B{x)Z8=euxIg%wY79}TlRf#mu z=?b=)DJt)N%c<_B$%shiY)-8DU2Ur`0G?M5U3n2w~{T*lakZ2}StxS+y$800)($ zWmiwjx$eDu-8!s*!9Th4d<6Zwt31@k88?AC>%uNd-T79OjEKjU`OuF#sw&%B8l9|H z)CdB1QN@dlx5^1Fz3xkuqPNasyBpb#l^E$!U)F5>X4R+qZ^ibze|CGaX9u(Q{zuPN zn(K3VSf8j>X7&>;O<2nDSdE4qA|&1*x%>#>MtA%VceA1{H}o5+yJFj2K*cYpZQz(C z>DhvxAnFDdSGD#b4Uq%Vo9KG2*pWDGq}KIo%ZQ$> zKRptUKeBDTL?DrFw(6apkdN2#+$@4~=u_JNShu|4KGil*Uqd+F^I$+U*1di2ZoP#M z!a%x6yXjXZXiMjwd-Ugc0v&sPctl(MWBZ=Y0BwhP%cj)_2SwvOSA*#y-SoEIlDKul zG=f`y8W4>=AyT_}1h)hc*_fI_&8M}5MiBP9)AEiIeWoPUOtqLmMAJMO1|n3&Su z)Gs!(c_kyAR7+V;{TJADQ?YP#v^9j{%+^w-~jDm(3y~w>J@)F_i(k}JNB@7dO;6ocfW4F zm1+@*+V1{o+p>4nS+LhAXqWat_il!wOCsqPaHk29l7n4TbG{?Nt9;(QJ@0&A*=?dI z=m6-O-Oc0m^9NAJ7Tsp7xKR9EcRv@ak)29vFa4=)!?)|_(KX~(>k?W$*L=A8;Yv&N zXTU1fW-Ec>5j zg5}fKClziVNOCnqIjdp428r_V;fXb=bQwrsQ;-w*e;+6+vU-h*3kaO_+(d-Lx57%A zl4ZU#NkiQ}=DPi>ozi)!O@5w!A>46ZzCk|p=H|p)H=@mK*h$RRg2A1;xd_H;Z;C^4 zcKi|N(r)W*zS^_;&3ulf;#%AK>(v{O?4shQbZJWaolil=d{ixiU&Y?I71aMVpCkRB z*${`>E+F`?<|YU}STL>B9jCSSrjd0vyN7DNtQ5Fuy^YOJxGBmsRP%fAOEtecf4&AP zjJ;yX{pRHwp09u4nA!_6IRv6C%(?^p&2K!uG$%i7eqm4&NEQ&#t^lk7&Czb-0uh7< zMJ)W3JO2gRTQPP}@0r0d!>TE#zG|y8A34qq& zyc4eIqHbTo7S~a9USunJ1&{}sKw-HvMcUo;Wmnv9C7)RQ`1F=B$Yi{8a@laXTd(@9qz^FaU*SL;Cm}xOZ|Z6on~DhHbojdj z=x9V0)}|po8ZbC?t??F8Yy*5;*=(*_0vhQwX;N>s2RKj45XJY2gY{4BaPl128`x6w za#Tvo*)&TYa3Lqa&cHgP%oX(B$`tkN8m;}!$n*AJt*-hWbn_5B8-pw*&)KMYJ)|J2 z$)*(NIGPG!;msz>MVhpyaYT{`$uF9gYdBl7^LM+brk_B`A|CL5cIa=k^L9w-PjsJw zthoKw>t=qyDBrcOS8T(sN=!+xpj)XMbEg{0JRQ`nZHTJQ>d>!12B)@$k7O>Yutp&Q zJXO=Q0)9cqjUp2}ylJ_O;=jHCiNBTBrY8lML}CE}mEx5;)qXmi}gwu>&O1O7z>*UId7|* zVXB+nxk6p`dI#&x-nxnHp8{-Ut_y6d^KXOX;;Qqs*Kv(?6qxn#=fm2E&f5EqT9>u< z*REPytLHW?olo!9W_2|FZXC@KOs02@WlyHpPC?R1U;d;9;{mBr`@0J~;GSN$o=!uy zn>Om!F3n8@V%QsZNRWP~V_P=#5F2&lyMrP}!;_k#d?(u8d=m)E9WgqVnYtC}sJ?2X zZiNyZ{tt)OXtoy>uuY|x;&F=wZH={nVdKHTzvjH5Ots$(HdBocB#v!o^itE!6G?Ko z`f*q~h(f=42l7i_-9?yGk+BcLVsaF8C#1Oest4XKxxFDDD}Xir%*|O6q%LaMFK?~- z)5h`T)Xd8fk^DYNLEG}xb?affsIrK2drFRXdoE2bYuOgAJu(FTuRJvWs?MO{#cP+nIhft7uCFz8-nd}; z2q%z!!-rF+KQuydp1da|2+KomN+vn!LKoDBD9ipe$eDf0ll3L-RNbXfX<=XP4o^ocn5p9LqAVrdBJusISIL$rmO3k{#6-E1 z+v+q#4Qs1<75ha;smcf!k`ktEk)XT&E14<(O|a9Hy{g&5()|V}U$R83*}9W{@ojq` z+uL)r?<5Xq2}SWey%JJ&KOZy~F2yCG^-3kSx`qc-eFaz?%V&{TdJ9$8w6C`=-bPj4 zPB!0Ifz8fERX%H}eWtB;f}P9W@`3iZENkW8y4d{svm{|6d{h&qw))ey6}KuR-RlkX)U-Dh#kdwW1^|{jFsyj7gqBbB36KtZZT7J zbxBfJ*&L)Z;OV>$BzM<-DbIpozV7D^F5T%_Ti|3<+WP(qHZ&{ESc-z7jN)*-IFuJq zgKT<>_l@>GE!|sVfcmrbe%(>$oK45#(|q4|B=k-2`tsNOpq?%M+U2%{>yUHfZ7b#n zto=m0!Hj4 z-#j$DZ>zr1ReQ#=^2f5nt-NKY)}PX+-K)K8OqfM)&qq!uT`UaEj6oy)6zLETXS zev1r8;U_SDt*kcqYAS0jf%Km7z7%H~#pg`+-8hF{t*5{>QM+4Wt9Vy4o&u#00NoU% zTZ&ry!7}f-LVA~;|FF7ee|zoXUVWQu;{*DzR?@SvY@D{wwkbfX?S3{rZr#7E)z`Xe z*p`iz;JCbzWUkrLT71>G@q&Icu`fy-H+ZeA<7z~nx@vk9QgKJsVF#PKvA3)8HDoHO z5%lO@vu`@0d(OrlU-n@qs0>wUy@t~4G_|~~bP}wzC)M`SfR0VEx>H>>OFOBe(IQ8U z3YeYh5;KR-tG?SuOgzT25m=lK8nq{^RPkCwDSX+=rm9~tR#$6QzEScjp+y6!i@dAi zCpkv?L&K>~+=Ap`jSm7Ss#kYVH+E~*{*k}i>=!j^GH+BM$CJ+usmXJ3e8%0F3f~-J zVzGv~z!|_g4lI0Y#MzM49f+5T$jM z^kQdCl8YQgEgCkvY*K1}%>iRUED)IjXI0;^Hm={sAl)LV0OJfU@MMXgN86yGsx*Ue zge-xx`n^^@wc@!oVY;9DsxBxshQp8~IG%Iq-q}9%CS=az(e&g>V=kU~mI^$dstuk^6Ka8$3hQx)G}U9?q?>4xaqT0Ie6D796YEL3%* zZASG%BxkMQXR2GPw;8JwS}Tq#Bv#g;%qV$ER0h^T_;}$2l*-zxM}T&em{ieWGE2#Y zDDo-2RC3NjRZaw_CV1UcMs0g4e8v@@Ap*i)xz1Gb1|pO}K|@u%icsK+OOi}`x$l*# zipy1{-&7UZzzbQC0t4m%SgESm#HOmM?ZvdnQkrCBokIMqI{?{YXwEVhFV1RZayQKU~)(zRw3-fTJe&VbwUm~OV&~TF@YD9 zJVW##l|z4BCW3$q0>R34MyjX~MCyGN>U6Q`nAAj7ZZR6ZN^4^sN+vi_SN;oPghSpd z8Q+Ew*{^Y~&cc@f!tX82>tY9bfzv}FRsvNe!*6h#xwT(n0Ldg6sFfVCLf%v9BeE54 z?Q+)v6>n=5{milUI;)L0s!S@i;ypQxcKwzjT+QMV(CSgtDy zjI(^`)xn&_v2jtfIL?nQ35**%KQ5TQK;NN%plAo5meOmVq*ZaF=@V~HU54LG(rjt; z*B|ntd8;&_+hBdBFmpZqHZ0Z*=KrotAUd}Qa*0A9wO8(djFu#|mO79d-Cnjznx$5C z8a7E3Ng`=FC-L1dRX|*gLVJVeRiJ{!LR6s zYdN5DL{@fB(UWdAaqRfX$U6(up1ooc#4CjwUJgfv5gji`HdZu??v;${V~^&XfumUs zhqZnL@hBS-H0xGse}~pu9)_poh#v>mnM{j*4_2EWT;;-EZ(1LOWSN1Sa@haQ+j*?wzz6s~NHgbF#>wRsffcM5m_de<4H zC`w|~K9^D&kEiPyFxDi?Q)M8aDsOYbG>$Dok!IG#nsu$_0gSbE&V82 zWht1WSvJWq+U3pj2J#-k7Ui+}%5yUbvp$_gTXFCHp6usPg z92Lc;{OHc*wcrWNFc%iN3Ox+UYxC1*6gENtnN?~2U$JK&8z zoYhv=+EE(cUYchrNogy&E)!TwGDNLK<1ya$+o&SBhARHlTFmN#i<52O=E$x2Z`uu; zfTI~Jag+vFO8&r}`3`I*CG8frcVRUGXsN=h*dKKQaE6IsZGg_(QL-;plq52hoRK*4 zcbG~_5QIzsirMgW*-G{r**<|EU=k4WCn(4TUI1tVLTf1?Zk_$cf_ja%J`F%y5{{Li z@#M0Xy}bNyy7>gmTiBwq7a$dOVM0fKr(=|N6cK7C`HhTNws^&KU0;qIHhF?hEG=+x zMsiAxV5dR8>*CJ7l5AOfX{UKrl>P?|M&!y(U{fx6x2JTPX;q@O^VbrEE&s!As`!k= zR(uoM0mwA0`OjM@>Ws?xiWs-$o|5~G`5nZGfIO4Wn%SsrGeC}4bQM1&aO2YB;Btm{ zLQ}W{st?=mq}>pj)mGd|;L#eYC`2iey7Ir23SfUYsJ0iMY%SfPS+Qvu1omG!tDezQ zkV>Ui!}nN)t;K75xb*q)0dMs1IWb6HQDRh!?WG(i>)jsKVf#6_C0S?G*yG6hg6*jk z++UE<@-;A{L)&u{-%m+WCOs(Wfpn51wVfi&JT}8LJeh-*lG_>%Z#*}Tm^;kHJ;1+0 z7*?eUQY2zIjBN^eI$WlOw#=;T?vighivQh86>odA;ugPy=K`Nu@#`8O*;V39X=}+z z*kcNx!sI`$f~4&#ngI4{v9UNv!{sgG6*!W5<};!lD_xY{&&c*D@&&(iW~QXShzATS z_{fU3ijV-wQE2NbXiGK5{f}k@;h@(Ub@P8spy(b`U`IA{<}nyaC_&tqX_edS*HE@43h zrw6DIUU&P9a2b> z!Ao&G1-EZ4SSmSya1&<%E2&q12m&PA@AyG`VMvxm=LfPs5m1s@BBa_Xc-L(Q)Te9W zP9xVH-AJwAy=V3F;!X^l8Q{YnQFIl`iFsNqXwOeXpu9M}H~+TAlR~bLWi0SC=a1;fpD5`yobK}W@`5vh zJB`wARm-r`i&E{{7F8~YQV@-jzgZzk6J^=*-?Qs>z@eg+XW(Z6g{|z&&%nyd1C@)0 z%9nzeM^}OIk!92yu<6_N*994NLysw6Z{)IPd3!_A)r|uNhevsGcm-b^G@rsG!D=wF z;EObqSHTw$H_cSR7ehOC!3V@jE6;#1qTQD2UaPW1HmzA~D>w$8+9e`jo{k+!rIPLe)M1V4M=@rR>hx$^Ga%6y-1r{ll zQ+KRQKf~Qix)rdvBlY}sBgKL>Lm-nPSl6XjW*}yr-43^9VBB^6vzSXpDt{K9b#SY$ zBOOK${b>wJa9C%`NnlB?0KwGSU)tIMzgQgfDB>xA#ARok5eS6Z94T|?>q%<41zl&-MogG|0&fnMR17u`x< z*L|IvD#3;ycTFekgS}0OrEXVAPMtB2GLCHk}AYbMFsax&vfxi)1ePHIVcZhXw>m66_|i zodiD|1VnT(!4nBYX59ue>y#3lNm--^^~Ew3gr_w|N*9aFrIa=gmbF%0q$UtsIS(;> zY(IatKcDSMX^%aeJq0LBov=3seot!hx1IX4&I#K4j`2JIDCs-e4K{D>u5N%^OCq%| zJk%@h>*02z@|^m#F1FK{+#q9lucynuL*NcfROE5x3pK6ns(_1a|! z)k_tbv@)pK8?4$K$TJ7=Yn(a|LggupUuU4t)1<90NigW-#0T?H8+dD;gO^gL&9P{o zfx}35ozUVaFh@YMB$A5df_rD6Na#Mr{*(tyMUU=nY?N?R+D@RyUWP-%t~;rL9YZIF zny9p%GwYtm!xxBpv;+(<9!!m(i~kq$1*ED)$!bB8L$~7x-R5h$NmpS|)A7F3rpCkw zTsr>ul#Z7wz;s{q9gGwGy}B8hSl+aIzh!%C+kn-|l&Yi>r!Mfy)hjSZXp5xSkiTIa zo3juvQHT5I`8k6W5Bb z!0D8&nc{c&TWTl$dlQxio3qmur7-Z0+jEbJ;`pfIWQ-0e?$4fJ9a$Foz?54 zAgAqQbj<$!`!SQUP6(1xk9ZuAMMaI6oR%Tmw_gDCpK8Rw%L5-2c^iHW{6UzaM1y54 zeEzi#DH${NSDQ+^sHkPGu8$6GfyOk0*Is@Ny*H^yoHQZ|DaGjx6KP)d26avvQrV$!|7FrVR80mF5MS~&*q znLH)R<9)o7XV81h|0`d2t88UvA{^rq6yiw^-Jx{wp8Zftd5pq4DbP;on&dZpE%|Vr zp;k$#LtZ2CpYoW4cT(lht-64b!>!U#LS7?B47JJ~C>Y_7&qu9h_W4%&54ZaJaGjx6 z7Y9qoy*+9rQ*`x?8gBLeaGjx6iwAonz}<@6CwUbe-;onA+=?EqGt{bP@RtUn?q7Q& zaJW^&aGjx6CkD?m`oCI@9&YvWaGjx6QwE>l7E{a34T!>x7>*BNTXA1oQ~ZnYZkT?@bHL<-~T*fio2Bn*7w0np@iK3 zQ=Jw-Uq*l)CHurBx6PP#&Zw$?KQ(h3^MFY85+B8ibF(UMrZC zc#u9JuX}s@ehYroicE35+;#qPt!XHwJje(kFYT38&C?#WnmbVHuJe~xAvo~p4y(UN z_*=-MR`Uj0x$C&UcHs$;S1A5d9ue;E18<@3R^+?m@jC8<*9J?%@E7GlR%`Owd7iT= zY`E3WkJoV@|7dWGO~+r4dgI|j>mSpHTYdR>9e1m3gC%6YqdW#r>OK-a+-lF`b^g*D z^~pu+BHXRW*bvMgD0SCye_b>Mo{fSQ&sgs;GJnBiw(7rTO4J8D$HuR^vRSGmzrF-`p zC}zQ44!BeDqe^H6C)uz_ab>p@8>&=8 zt3QxP3{tR?CL*<)D0lD>5jdpEL^pwMa^gV6!9)L_V$uT9(2%VkJH_x7pho_8vE)Fq zB%7#@xP||-!hXbCfRao+czhj#Bh}dnAo7%@u9iI`Js=S$NK_*d6Qx<%i7GjaO%lc9 zS5YZYny6N#EF3sAP*JLcpYbmh5h<0NkqB@kiIqu|sexHg44!qp8Z^4`h(g&S-wsV; z8B!=bc7;s2NSv6G{a6Xc@X(1KD<$w#K++#8QOiI=4%3=~#3s9wN&n^W|8>y4A%!NA zenvXI7*KNHu9fPn$Id!<9rtnfk%2Zt#b}D31$u|X6e$1rIxu-i$zvxW^EnZBhE5(K z$jr>iN`w;;U4y@f?h{IGVCalwxFy0QAsJk!25wJ`AC^cC!6kts!>#^*<&U3jpvhyu z_5V1}K(~{T{^;BomB|<$(xJ{wBp$qh(C^1;x!0iyiU*06NQ$djJ3c literal 0 HcmV?d00001 diff --git a/curl/lib/libssh2.a b/curl/lib/libssh2.a new file mode 100644 index 0000000000000000000000000000000000000000..3d583f21ac8b9789fe76f48e1f1a6c87567878b8 GIT binary patch literal 450518 zcmeFad3+Q_8voyuOeCBW6fmMf(5OK}1c*QqlL?0k0!c9K zn0Tz`s;sW}s=Ho`-~r)~fCvI!xE_ngD%qfdD59wOeV(fBp6Z?ssomG_`+a@?*w&e; zseboU_ftb#9N5Db~v?eC1*BJtZaJP1liWJru^8AE-J4m4=Y7RTuJeqIh7^R?`751mDSO&bINPK2OHFo*6HD%Sswc%OO zr;V7Rs@myu%1dUK36kd*mxqgLDiLXyQ&T>(A}XUITsf;Y-EYfnX?cxvA!k&VmD$)D zp=3o>#mJzwUc{2~`)2)5FR5Nw6)vipKD%^AG)pD3ic!CFil|=7OJn2FWX0jK*!aq- zGNE9s9*awb=WD{1)n!FBVWEY26qVo1Q@FagqNb{{8nsteAv|4GOm$gQU3P74d3D*m z=mRXF>aw|&^MpLj3RhNG#OjY1*UUDn$0#S|yQpk|8DCRYQ&V19Q8cF*-49)|qSCx& zJW`4*l!S}IB~|5B;-j|vC~H~qT&k}*PSlLb>iNahr6_t$m}kMP1w)X5loVH#l+B42 z+Pp9J2QyNat3PCP2m9^fl9IBjXzw&`qd%2Z%yY^w)qNT2ghl}$&oLEaAXVXoN0UIe zYs#-Hb7B_weALQxE2cWCsw+#-I_N~j)#2KznB=>E|EgtGE^WkvJLD@rTp7ZsOYQ!A(rgJKUmm6k?l*#goP;o@*@RBIUzM(;yy z6wiq%v19VWa5CgzEMqv8l@^s2hl^vRV8oZsq1F%}2O;Rq!ibEHR2FaVW)$gEV!fh_ z+p%rT2Rh}mXpX2+jH1l1E{FQDC&yx)(jzreR8~17<_V`brnc!uOtwnqRMy0%>Kx0Y zuv?`usaiC+StQD-^=G&zLr&R zeLsC+81o}%sw(F!Eyong_WbS<5gp%Cp$_hvE`AW8_A&&80cDV|YQG`(c5kpU*0 zdNA5?rZ6$_Y#5n0i!^I)aY<20c!AAIV9_;fuB6eA=v z%kmw0j(#V(tmJkvWhJG!MO9l;TMg|KURWg*h~JIgDVkATIk%{ycy1>Q-GKswR2s4%+-t95^7rY~r##!@rVNGSRc zFZHaVsKpb-JUZ98NM;8| zv!i!kKjwPT<~4h@HJVqkHI8+D>!N{0*@rNTv<+dz#i|B9(&2exV8xTFR@VHG;^RG89?R8Hg&y z!XwH|ui)x%dbzM#sj01^H3#e?5=xa&R6J*9B`l3ubE8HX%Yk8dFx6yynN?X6rYDU# z%^p9i7`CGkY1o_kLuUN!va+h;Ib=*?@i(JEnrL>}0@&fu0H_-%M!|zZe)k&9j#X;m_IZ%+6!eo5Un)SRkW67S5(fgptA86GfEwerd6S1Y>7j3 z$*i)H=$b7mgvCc!0MQ$zSSQ6wx0qc~n5@t_(xG&A7@+GV!7)MOyp@ zEJCcyxy9iUXc^m#TvAyDwPA~7DX>b{>)cGcta5rZO~W-Ij0$6fMg2e)+uwMiX0}jy zdgS!lYN0$1289`gacwo7VyuuDf}Z6)1x*TP0Gtv+IifeqE5c$N3)XK{LwG9u5ido1%LpDzs)+Z5WI73iGj=k}CKdO6EoVa1_H=j)G%I zk3)AbdcM(6)5&F4P5nIP7Bfg4+)L#AoDPjl4+-h&&L{D1j7a9fDB?~ic&ehR*T@bH zHdq<6qvO!HV;QPOWM>M#csjatvEXSn9xz;Em{;vJfzp_sGl$!x*&LrS-7 z`!F{BsKOQ2m`0yBC0i*&a_3lVIxxJaSCS*0rXA8(WI_vta!3kAG-Dkf*Jru%iW!yY zMa=JQCJdvEHVDk`x+4QVF0v$*|8!?QJ0m-TZ{APq;ZhVOX|$pYM8NgG|Nd74|6vW7 z7Uoe5XDQR(6y&@|=(vcsZ|54bBzKaV5{+ofZbQ_JG;VjY-y*dm7L!(IdzPK;angJm znln?#5(OE#bA7n7NW5-j#<_?`&^yfv*H#)RIJldrgKM-aL2L? zi}AZ4;=l9YIJ&Ej=G=m3oaKsnyu0vgbCBHU+$-edBxh4{r*3w^a~$n4v938`3N)+w zXq1C5Pe{q(uGMqLMcch|hL=x}B;?t_dF+_$qjJ`qIiRAm+>#%g^Vqm&E0-=YrexxZ znmJK~g3+-OyHAB0m3u_&i*t6z$uVH{DiG$h;y=3kfbVhH_mz&e^JVh~|DWFtvmc#c z3s{F8mH*KD$QI<510j5g&W_rcLxROw^#qG@IHY6s9Wly&3`F!^nn^f2-kkk9#_=5U z;TYdqjMF6A?_zGn_)|E6^(39csf5ic?snO3S}Vo4Y2S%7Ttni)8zW8}dC|BoT}W21 zu~`$k1Tv1T2XX`_k>Ll5J{0v4IXjSSyI-9>qIqXc?x2c_X z%l?!7Hp})gl6BraqgZRt*HMQ&TDH!CIqatCu`v=I_v4PbA?4&#k5;|ZQMc&13gJQ1 zscqfa!EAgjm+5!gu?T6vLx%v@@hpf4jN3=eWgf%A;uhH&2vW zg^RbGj%2c|S|8!_UT3FQX@DDPISFJol2xG5f@VRi%RU1}g)vX2^Fb!=VkR@^Xy+Jp zs?*buP6w?zJrHNC?>af1Xx#4NY$H{t)lF&?)Y6hhBsCa6g$Mta!zsJyedkkp++PV1 zmh*G=I;J^W^h+73+gFYD=V;OB^js%r|6(8izj17nZC&G$%I;{F zTbW1Q2o-O}?x99!b8$!;MziBiq-6*iBx!%syf#LSc#|pUqwOSic8}%_n4}K-wE9Rl z$AFO>bsneE7~4t0j}?qZj9U)7v0RVvBR}?n*>#K|&QYI>H;#&68o3M#Sl)~M5lYfUHnrE=THooo_w&$-zP zY@3{2oLDj*Gc0O$`28sRs-11eI&Y!INO#(6z{YV?1wa+BJ4(v z;%ym$pFbX*Qj{g&Mq(E@LjYS5u76EYE_j_s(#~*7(!^;aeVJK70X!S=mw>s|&IP=g zKK>|szYg#BfjMpskBr9$lb4b0_46q9jvs|9KAkb58JC$23n6-4fM71TTXdExl5tsC z{;VjbJcWc_0yA|zk0kj#T>(Pye7t_s8RHJ)(lgT2jR<`9#%ufrAp$|pWn~0~Xll;M zPMpshNEZt72Ds_q&e+HwPQVAr8&Pd-;G{T3xm;&BsVF(h#GH{nUm)9vz~@saVEHCR zIrak{ISL;vf58l&n7<29Vb^@9D1ZNibA1giGc!}jo^lh?E&5bZzS_e%DnFN(E_MT@ zA3Dga&lKf`&pC(3IOod_WC$6gdbv$!IH_})+1`K=fzKg$t#IOe8JRwzLGA>%){*lD z(}e=h2RG>pMR^l1x}y2>2D5GX`&4H*X_Uk7%@*X{7q2M$z%_i$sX_Q)_2SF)`!bCu z73Ew6pWhq(P9e_u13{r2lMw%%6Bo=BG3CH9iZZ56QPTHwnaQTS%#2K7APq^j*6{=798*U%}yP|Bui!L-bFGtWTHm^eZm`Wo_lUY}R!r^_MlNu28$(VKIWU!K2= zEU(ZJ{tj+Cn7Sm+p&50~>l4TC9K>${li8PZX1!$iy<+|j;PxaidB<_iEUzyczc7nl z*Pt9Lz$Bi)xs#1_GyE3)aw2Y@iDOCm6u@Qn7pP}3-Lc5fU0`+(;#_omWMzxoBsBcy z!7k;*(>a#{nXF#?{-DsEl`6=)@(h=<^-Rv0`p*}%wA&%bD?H1kjP-MFgds1G5fsbo zh2HgKxRmn(oIBCvGShts8`td!6b4<&r+Cq2*0ax-Ee_xlaPL>0VIbak`}(rQ1{r|( z{%3PpHqM(N=%GI72WNo`j^eC2KGL(i!f;dmiQBbcCZEf>o<_QUf0o$qD-pjQjPE?o zndQg~qzm0oq5MtI8EgK$=>ef)PJ@^-a5v}J(~x%n>T`AM83 z{l)uVcDB$Q$_~Vjp6pV3U&1-FJ^b00`db99KxYtS7n2vv@(bBh$b{JB#QFRgL7_oz zMmcW2)TQ*hf~RYaBY#GwP|eB`$a7!mQtI)d%WPktFBlXOCcW`zFnzAFbAGR1XpbSd zJq%3YRL+_G3i7gq0X!4(Uey^&moB~E2Sxj8I>elEHS$-)qSzaiBT(W}9>t5UXn8X&6WmF-y&lY`rJOVMl`kVp%pb`cQRY(qh?hm4 zKf}^)DY&^xXBdb#-d}w9^A*u+Ey}SQ+�nJhT3?)4gK9Iu(y3l)IEPyy(JXTwVb7 zJ&WOQb@&*iGe$H^H;^eduR?iP>%?XGE&U~eiRFM3mywwzRI^eKc{f~(yjAo3(K|~w z!)KX)$Kys1Fc;Nu&aj_H`m!@Kg#LUyp0Cpx1lh&=i#L!ZR7?v5{1Mz03vKBJf|m8n zXOK{;GrBmv|G^v*si@^LLhV%PGJx<&cVA|}Q&!6oV3PR=h4NRXK zY~_V{e&CY946}2AY`=i9ddUJa-p*n4iut1~Tm+`x&cVzU>yN6f8BF40o)&eUr`OZJqLkkETz4p2qnN}(6?AHdHbG%%Idr@54sc+q9nAC@Vi9(n@z zeg*T$&74cXcP1~xmoA7?HskhtU>>}MbEdwB+eN4r1%HH2`AKIGWEYp0DVoKMb2V{U z7S3l;r^-6q>(8I*7uxM?2uQ!vrOdsXb7V(xE<>OcmcN2~TuP67ITy{JH$xn|%y80Yzj zzvnMb^1NB%0;CA}`xx9g&vG_uM`Wd^3mtGJI`DU39($2<=DNox){3H>gWIhyxs=XVy!m&oZx019uqAl-Fa@%@zwn>D~2 z-N(RupmRdH*+REcDBX527p#d*SL~;h?jkVFIwz)^Eetpc-V5eUor|Um`yTgOu7Nl5l87(fmy0^Lb~Z*p+8f)5iqaooS81hIsU|qdEJg1JHbp}&(k&6zdmoK zxPF@lu4;oz`RWbM33|;kPh%;qtl#8P4z+U5)c5cri3U+JZcoJIFl!6vOuIN}^@k0| z?f1dNZ{=LH|9LS{o5fHr#O+Klb#HOb?9V}Q6$M`e9!b~+`v5Pxpl)>il5Sb>H{iy4 zFynV|F6uw9Ow-ESxP9EaF6Hz0IA@OEfOTC~jrtq(zDv1nH|I=!8p!Yq!$>(3dffXV z?A?z!XV$Y{)M|>d4f3)+LA~tZ+zCcG(naeTeH6EU19RQyoTGV`>4S`*=#Ef^ApTP@ z9Xdxe;{w+8Oc~<4f8kOp@S+RZ;2i$MjW~{|D=q``g3g)pu$&gUpOOadH85Y=xnR1e zUX)?rz6CSzOP;PNFUxD;$i7bnvqa}moqGO!7C%xl;#YuKsdHvIGBQPTQla_hO)y{C zxoj*PanHDDT>b*4=f7BxUFAtdC`9A3y2G| zGr=Cz8RKy-&#F-SL(Iug`u@FKo;i+S{)vXkK-?|`v$)NkZbpVU-oC~FdmK#DPn?^G z#Cf{uKGCrA;r6q?VBLL$b7s1r#DoW+fJwi)l+#&{QWR4UWv7d7AGZF;aK$P4c+o{t zS-SB0h~@Yiw3-3kT#SU`Pl!{N4&q$Y{!7mi$I@HXX8M@iZUFx9~~N}>^zHe{f%_t zb`<+x81at`&4<1=!H8^IB@~%f`Pafoj6#<;yRhe z%Md={ia6zdyy!CfbGo%3`~mk?g9%;9IeKUEfkbA6nWT*qaej(bd=-?HteJdXM8&iXjz?3+19uwyW}>`nezwCA+i6Rhx$7mi@mZxa&DxNF824u`FuM%`Z*88 zDcx6a4v+EtVYMZe_i4nJfa&um&WZMc*s&VH<>(B8>|*7G))0n=@+|Ib23PwKmuHSQ z>?4XB#c%aSKLB&VUpbeH=XgD5iODK=BmTYT;*{CXbI$C4KK!;zn2;u-!)ahXT+KPU z#pEGfv0g~taj(TGPvJ$EDGz3%xbC5&2d!Y=MXm^OhXKpnI$TG;%)`=U<{XS$zU3|C&0XI=Q1toiml&11mkMq zlxe0!Z`O~9GwU*)XL>W^-D&k*ueA9;U;d5Q#NhmoZ0^} zvn>kdJ7nlEn6KaFoayh(P8XY3p?P)qjyPq_PR^PBh)f)uGct@%bU$U-F3uRytQ^@v zi=*%eZU(_+yu(@3F3ApB#!)|TSAnV0IkWySJj4yXQ@~xPGnRC5{y&Zrd~NEk`cX;vb^+{MeZjx09K?Lr$D8)6x&JQDMit8>ftZ zkJq!=4}4y)cy4I|8om2`r`(dhiy8cV(tM~ehipioHOT3AId8T zj6;Rp0;V~Mb5Z*xAexEFm*7Hu;}!1!&K+;2o1G~h5YrGp;P`muPk7NKj7!UbGg^l} z1?Gtp?3_1STpy9V=fRvkFoyGr1BCitp3YFZbn$x0#>BwC(>v>@j$FFM!Ip~pTLA8X z!M5`H{i0i0`2x3>rNk>`shm63NY}c(rF;!}C!7Z6EY8t-iRBOOY%gU@zwQP13z$26 zoEwCA#%00pV?g*E0B(&xUU@g0b7nut@{7wsr6;(@1M$l9qivioXxXo*LHpL78?PK1 z!#SZJWQ%%@%KH)yr`g_8XYw$(%FG zn~ejbVtEnHyM!}FG;d$8SDcV2ohzKU3>+vl9>ixY`d<~ee_hID(&%LJ(k*6_aue$B zXD~~y;+$FDfX|Y@>+yWX)Oh7@c+nN@_t+Q`#vA2twazdQZ@eE^&qv$`z411onmmXV#N*WiOBfp^Wzo&Le81( zW@$A=S&rL%u8UXhT*NtZUcfRy?58&(e;JG8l^2(Aj@I?O-TanwL60H+tfleF4!r0> z_tDE?*>+Z5!F+TW%nKUl`WhVSMV!x1#O=gfA)K8~2bV&w0v=6L0n+c;F3y?d4O%z6Y5#L2n0It8+7EDWILnZRvy%vZqBBM;s~4>E z#D4!L+}sB)ayL)cw8Jv2`ybQ{JHcG|N6wKQs>>6XGYZ*FpWe?IOS(Rv)M$27K z#w$0x$T^|ivPAzMO>5ql;+0V^bB^pwR^9*ah|f8P>5g+2>lA0D5Z?%<{tM2T?U9b(yWpO2 zJ%ao-gYkXEIdi_m&vwLekpJeauj7>~@S@9j%-cF=&V%XDlLB}#!asp2Xt$Lk zJ0QBf6)Nu}Fw5*5b|FN0w5@*&n9IN6@}ho~EX#SMQpkG>Oz&@P<*=+ia3%=c5HLyK zan5Ytpv8P<`!3gjS*vqqd!$>>ZBD|CEnrSMz~x2tsl^SV(7x^xFn`fGQy$Lw;+A<` zg3wD~x_{5*nH+YV#qpMd8^?i}bkLrzW!ssR<7F_tez42)X8Fxjv1Ww40bnlu(IziF zTQn1uoAJymVDb)e&g@s1SH%v4EjncinClL6j_eAq|1dCxbWaAC^mDv2{0QgF`O=5q zLkI(e?4iGbN&200rhW+o#cgb56u6DVxTuF>nTZ!m*N2T47Q^4D8!rGeJ%MxPxWsWs zao@CeGUktC+)DW%&XJ##$qQtQZgk~S#2R!$hkITXuCSDaRr4d__I!R)`3bEhIZ44BEeR8wA- zcx+C&4e^U-xs^WUoTJ)i@`7GV|C?|e{AOUTzkzd04KBm-a}DKv#5XK;D_1V#oau-2 z`7QeSTyR^!bgScBwEnz4QE^-at}mFmI%n1k%s;V1kHP%06wHQ3F3%z6I?nS2*qXU@$78Tt*4NUT&FV( z#G5Y9vOi7oUIh2rpKS85Pa+;jBCgj%Zl(XjF&usYXQY7NSR+^l<`tbY+an_=HV4xu z8+FEbTF+m)IPsI-+2O=x!!Kn#h)?1^cH*F~M8$g_GPKu`gTW!x^L}tkA8{+!KE}(7 z=GN;kGgEZHP&aM>bL?L@XZEXLy4Y+=Bc9)+GYGPal^45%qCTZ9>;C3e2ENGUMfId$#6rM8$eZ|*Te)T>=c4mRdZwsQ zJ5VqCz_hQja`xYWkATd%t2txjFDEG}XJl4T{FxH7AMbbI?DA;dUm?MfJ+xVZqx}6O z!3_m>+AFc;u;(uo+=UVx_0wtzj@HkMB{*8Q-zvdTAA4MaJ00AI65KFw9TFVX-&wDA zU4Q+-O_ty&-Es+z&`g3AH7U4kS3NT1ibE-%?}Lmjx0SpjjIlZ}sn1847l zE%l?3UoDJ-(FS$V5q8({;U^25z(jN9RPQOK_xj7fWzd&(BJ5G`GL)z>Und z9H&uIz$LE5Ish-aXuixzn%FWDKhG0qIP&L?19Pd)VHz_y@pzLm1@Y6stkSt2I%gkm z{SbdrOV{;GoL7>|livp4lnk&Jjf-8~WNKf7*!O^8?dx;k@OPv9;{F>+nq=daB;oH+;aIb1XA^gs6PJwx zQ@Ceb3lO*x+⪙epb>~cKt$nw}=j33m3Q?J2wRPuaDu9Vz^Xr4@huiueCUEBeSi) z6QOdnfh&H4=drVLkPiMvXAoo;tpn`kAiHkRCVP2fIr2Z8FTrJin=io)0Qa;6NBVD_ z1P6DH@}2}o_RC%gj_e3mYuEKc^L~;9N9pEEaMW&BOK{ZxZk6C@UVcu3BY7`MaMT{} zN^q3!UI~uYyX_9#$m|S@UnK|JVQ>L*?BF6j>@MPa3g)`){Ra~{Ig@YSbatPdG^-W z{Ne9lSbm?J3+}oYE><3`^InbNV)X{?kL{4)s9wI6;HVru--<1VU9V9a4wT?r;4YHj zNdH|d!I2;8MhTAW;@c%S>Q@gta3eD_Ep|4Q<8=qlUN5QO)<|&F4?dURNMD`0t?Tv} z4Q{doN9(fNCAkMBI2z|qNpRF2EfO4+bcX~->Aow$(K@+Zf}?ipzrE{vCi^NV!I8Wx zB{;GVZj|6?UGcOe_l^Wd>#ZXa9L>M+Z+BfULbe{xA_RH}*yDl&3 z-LoXPWN_mpIGQhuB)God!V(;f%LWOK=HKTfII=h1mf)zoze#facXeIQq_2icauXyt zT1QK9t}{Uwt9LQN8qjx9fT)y?d4fNA}Cb5*&?>TO~NMubz zUFVPFjhEmke~l6x**RM!I9jhNySvUG*(F{Hj_j~(2W}+(?1JcDqkexLxXW~w*8f;1 zx8U!O;~)UO=ofLdV47^4eVszw(>h~3>!c@14{ea(XkOhZ!I7T)T!N!{>qiNW?2_X@ z?7BTDe`6##@|R4K;HX}vNpR$suaMwUz-ba3>5Zo(IGQhaOK`NF{#lai`H!yandXm^ zCAsku9O>t4B{=eT-YvnAefo?9NA_fk1V{bgJqeEb)fbZ7ehH4&)4xe@G~RlD)OEY1 zfJ=$t=-)T+TmDXhiiC4wIB$%PzjFuflq?V2X~$XN9oo}aI_x0MS>dvZnXqQ_4l;|M|$I!Z=C8m+wyxg zs^??}&R)+X=|lUOeMm)DpOPhDWxxeRSq5ebrgS74u z&;1jZ1!hJJmySQ6h@1LF+`V8n>l}?Mr~O7s=PRAj9|ae?|3-d`b_tI3M%uxy+k@=W zED4VMr{_y>Y2ao^aAZF>OK>FbQ3;OD+rA~i(Yow=369z${)gE5LqEX3;Dej`H4&eQ z;HKy-exAttOVIM?<`m-Y1oLGK7Z8uhFfQdsw^D@{U8cNj%b(R{+%sT)jp3}nccF9x zhulgdUN(6ayNS4sVEX-JgBE5*&@oJrW$1 z_g4vy((U#OuVVz+)miaYwrDFEk&WDZ!CF8Ia(}PMj{mQM=VjaJ0T$ zCc%;2d8Y(N?Y3T$+bO|O{`N?4I8`)PUNO08eM@eu=;PNH7VsMu@ za5&%O75`4J3T`F1-*uMkMsBZVC`{ZgFav+Lap{&n zz%V&f(9n_}G*D zjksgt5|j(^qRT9AI{qO=7Q^3&TLNaYox?xtA^r}MxL?4GiMQns$L8$v8o}()IU`-W zeL(#*&dp`wX=!q>A+#VkSYFPlIGQZj$F21{Ch#9CkMxHE|H+ z?ymviGX<|-zzj^}`7=2C_@#L;Rc8=nm(%#A^?sHFM}ECY5**2^mEg#3x;94o zE=z(t4crwH9F5BxB{4@z*9zc(Z}(x+__Tne~ey}Pa#D(^4}j_jt3Bsgl{#S&Z! zxThpI>i1hDxvwNR@+-&p>AGHsJ6?iI0e6-JNB!jj369b&m*6PfMUvculHBVO9QkQJ zk>IGm{3yXu`<~+Ix;Y1ocLum?B{H-Ol^yCc^9QD6PB)CLyTO>Ft z$4&{3%5hMFgW6D1Pwcw>XziaS!I8Z?Rf0PW+&vOpHn`U$I8xOIB{*6KoOV*z<)!`{ zkl<*)LY3q$k>Gkj-gF6${NZyPIQZ-Q;vd>3S7i;jM|76joBMOJEq{NFxUFE0*g5#0 zMF%-?r=FakOu~yUL7wIB+!1#@n5XR=W*PCIC2{Y7i60arFChAxh&v0+m39vPcKi8_ zIxsKVIJd)e;=}hngk00pMPi z;K&Z!Cc)8s*(SkJJu5@Ht{0LwSc2;hE=!WTK!T%wHBEw}b=h(Wj_jco5*(HHDM_wH zf+M~0fdohULjRKBsJuT&aMZ7Qozivtl0G;^f}{LpN^mr9Bj@C0TOK_y0cS&&M-`FR?v2l57*X>67V6X&7`yb~>aMZ6ROK>#K=SXr(B{=fS z-z~w>x?-aQM|So>369$Bhy+LTbpO<@+k^D|U^ZM5*+!%Y9u(aBOaCH-jU#_zr+pex*TMO4U*t!TxLsfH2>yGa5T?cBf-)6(|aU1 zYL7=GIMSyZB{>zp1V`iYISG!|A3G&DlJ~O&NBVi7x9fVQ za%4$xl*?>h{>UCzB{-^=8yvWi_~**WXJuSukKg6M+4n!F zU)>|Yk^gUv1V?&zrvyiO=m$xzdwSRPN9{I9f}?f|N^s=&nc={V%*wQ!lcsuJ;=tMK znew+xf}?fbgAyF+muDq78gJVrI4bX#5*+zyes|!||ANdWz=SA&1&w;b|d(vwQBseO^GZGy2`^^#@$!n9~NM9vnbzRS=fJ>9$$o@NDf}?UQ zl;FtT_@e|z@>(P~nj=1w;HbQPv%9Vr@<*ggauX#un$PD-a8!<4BseO^YZ4rl<5LOl zJa9)OINB#UJJ5CgQ8_M_;K<%xCc#mE{)+@h`fr;9hxsjwY(wLsasHVDXCLP@pMN32 zkw53K1BZ0QpFOep$2xz+v7O|9M2#Zbc59J%8kPESBJCyfsO1G(O&v;AkE2 zg9JzO*0JYwT`yFQaT45V;Ho7!(i`_ka4F#aCc%vW_qGH_`!T;sa8!TCjEb!n?Dtsy zy$(7Lmg>OS`vKXEX%ZaO-!uu1{2&by9F^m*5*&?>wVR)Spip9b13)dLg}b zr36RwN2LTu>wrH=aO7A1y9AdDZmk4I^{1R0TVC`R@#nDYcdchSaQ1p3|MPGOj_in_ z1eXGCiUddV)&dER#_t1?+)EN1_4~IZxdRd$`IQHp7uz28dZzx8E5VW8xJ-hhd2pHp zM|Rj!369qBD;zld`?{I5rZg_nLt7m*Y!v9!s!wm`Cl%U;HbO{ zCAhKR9+%+A#%q({CW0H3YcDVRyK0tykA8v+=TK~%l9;5}>zT&K>thm>_wb_Y7`$?l zyfMGmNJ4zyu?fl$yy&8KbmCOR7l654=V;yR#8G?X=OrlD;zbvo^XrWJCzzi3N9RW2 z`GsKqu5+GFD!9c+u5aIo?J6)q%N8KB^M?rb$HR0h?kQ*vcuj1b42H8K5^oxUWz6pD3y58)mgm| zcMq5+y5PLv-Uid5b2LvlrAz&9{=@|3R=nuytp5?W70ef1a8%EOFG^6-@uG{~ozkUt zD+9As=Z@BHtzbT~$vfy7^vfleUZ&RVOHrHVq^79a_SN@7rmB74acQF3&=Q{Exva(0 zSMl`Cnda%cWC`veScTU_ymIjJ;+29|lG?iDHr%F5ZOuvSz@=(l1gG(+C5`x`SirOJ zS`g*ivkomU#hTC+K2D7^PeBM7P_@>MOOsXY@akWfsOD)D-$bq?+~!o>#+0I~r*3!& zQS=w>+zKxc%9Ey-=Y3UsQ`HW1T+B*yoT{z!?JCgrt92XGuAbV)WU=4|TH18Seybtl zvPq_tkk+cbuQqH6`&Di0p`|>hz12vB=ky;PlajR;DR-@PbdL$uUZtDur>G4b;geTW zYzHZM6o7wd>k72Pdntxz=1MBZ<@nlz9G8TO;00GZPJ>v**TTPUpgf(2&f`|d!r>vZvBt2tbIlM-GWW9F zOLH&DoqQ>)qA66-6Foy~_oMT8E<5Dudu;%(G`y14$igX90bbAGddNWOBZJk*gfulW zpyOiP9e^(ZJ*53i0qvh^!$-Bd)uv06J$>g*+?3zmvu<%f36D`DaZ3U{!Bs0_sk{E>NXyM6u0M=1SVy`>Kr7(hk&R4F^bbR0QxoJ@oZ5w)mt$1 zEl=ZpoFz;fn}(|J)HhL7U8_438SBN!QMF%Kk6lFx7u4-@dzQ@y5sF;z9T&+sFW0lZ zaOe-7WhGotLDPjUE-b)=jYo7r$F`8GgG7$mT4IKQ5Vyjk+)#D z*tzv0`TI21gIbwlVtKKsp7v0uiK3=>HBm=wPwkRJTAnlvpSq1xpapWT%AJ~fb#Bqr z4ahoazP22^t)(h&PhLwA?R{4p*c7=5FySDL5NEpiV)XP=a}3WlPf@o zOS#D8m?D8LE5tZEqac#QwDTY}qM)5I1e?_4)|}*Bzkhm;s^z4pS`S~#)D3FgI&}5T z9IE|j6$+;4S`d=ZRm3m3iTXFIwo*x3<%G0Ns`detxvCXXAFErH6oj(H3R4tU6 z64HJ~|1Qv47*u!oqgv>{o^`9AAqn9=A?>HXgKr&)zS+>AbYb`quGIy zb}KXS-iO8Af>0WZdkpVnuDF%q^Sr*C%Br%8nwnW7N-F2#V|aB<@$ize>M-2{1Z(2f z9QKK~vISMe6{RWZ{^8RXhRafBclA6()yyjP53eY%30L{qzY}v@SxKoGZ3gImdLYB{ zJ=5=-SymAi^H*FOo;AEU8taOScPAXvEwOu#p1pea@g(&<_PBoi2OOV#!oU+xI(g9G zlp&{_ntIylXQT~1^Q>XRM~w91H{STyYO({tv(Fhd`rPw!a>tC#%O5vhEja&zP~n9W zCSG*$q{%RHrd)o-l~+x@x@cPQ^peuD88c^gpSo-_)qx9J!^b`PSQRzvB;g-gWmq_ulu%`yY64#h)H}_|K0#`q<-7Jo(gL zo_^-pzy9sH=U;g7rN6IydDZGyUVZKLHEUbet>3WmjZLkax4gOat!>-i-m!DnJMX^t z{s+51{KrQhfAZ-+_k8yG7hnGCtFQOA{kwhNH{X7@e_>VG*(n*r@-G~F@#PaI=jTnV zt}GcoIT}lgVewV6aKVJRmDRIK%EQI;E9Z=vRZ~6#p-IIR3-ijt<#X-r88c}w-It8s zt~NcBx&)&0JVP7k(=&8Y6{hiNs&)xf@OCxQq=0J8pO}$8O3Bk&*6mH!@{?I0Ny|Tp z1roLV6m2uRlS-eskw%}0A2!2NnF+B9K1Y+iosYp4YFaY|BTa3}{S}kd-VlagK~t_9 z;r-_~xuNUxH{)IqpF2XB)Q|>(-dyCSX?Zd|sO29HHT^XO!N_tNv(LMvBq;F12n=fP!RlF3&;eQ2u0>r@k4t z+9#-yd?k`dlVda8QiFwiJz&6Zjo0B_rt`2T<-}*^1VzMsqs_2Z1(M=vfPzaR#ZRN)paD2pV}B7$xmw>>x$$LYaAP=MjEIE8^^{MHXK50)onn3 zp)4zg-O$Rq0_G}8jcNhy!78XVFEs_RsEh;ox(K0+B)IWkCS~VGoc~+voq6uJGus%u&)^((N>aRsR z)^%if>QfLve_&OjxOmD~ttgS^Cy8C>R^yvlevMU^r#=H&!~&>L+gGUlR;a-)y89up zd6AX$h}ty8ou}hmXi>c7F)LhW~>V;kkCrlt$= ztT!6*^o1^7b_)4gTJtAUpiuj+Q2Q4R;pL-$g|+h=I`2VGr3gLv$pDDCGzsR&jic>+3LH zHJE=FsdX)hYHR)!JWkT6LULD;pMfKhLab!AgfCqZ98r5w)5MOtUlQhdXcXspR_3}= z50CQJo{h{`za!Fmz;|(`7Yhk4!kl9pFGcKLzFD3K>MU{ z=#TBk8H+GL?0$jvMyP2tXr=u$7%DJE3bnoLPN55J@~g==-H7x$!Z+nEIZp{M1uCY| zN@<*gWqN4n;ZSgI?aua-X0U67`MhBx;qHspgc@3EABL_~3$)gP;6_ha z0a0C^hIRyaRegq#rK(UBRE+*1tvxgp11Miz5>RRfw!h>VoI|8ppZrev0c6;052~B% z3$%`cj@BhNx|DFGQwCd3cCfvNQNKRc6~r<(^djAgGS^Q}MB(*r>1l{SL|0vt^~!LmF|r%Bgd(*` z;bXWeC}_GNwZEYlU>Y0KV0bOdtVTg8X8uT_nWHB4oyu6-kHs&3nHxT6Dxwx^!9sXNm{M#_eMGW1qd zKRGW8SA9bj%U6b`UxhE~=}sH{iFB6uYY6=Rp7_t5CQf(S7EzjfK(hs+QG~w82=`Qd zuWf)n*LL#)2uoXS4FPTE2oh*9Vn}$q{Wa=L{YZi8ri{JjIxB3nMvbgdMd^Y)4aJo4 zxp?dB`OeZ?(!2y6D={kG*V1+aSxcSFJe|pj3NQ+5^Co>unR9G$y3>}3G%P!7+hOpKp<=#hyAaLM zNrqy(VB3P+A zw(W_n0GO_I>w59Aj-@r5s!u_6hBQ`>q4<^Dh+~Em>c;GQk-MoLxuVfp(KxJHBP&?> z4gV@^$`*z|eJnD)uBN4l*qLZE*I`Wip3S-1F{Yuqf~0A?DRP{JeJ6 zqpi4RE^vJc6Lbo-J4}x)xmq8fZn9@f7{z_N1+L%QC+W$!t;w)V^G7cflYv2O6+p?r z63sy@D^DoCHm9@R40Q+>2^npuMCwSqdsCz6R$;-=_f^5nh1nRjjKkAOcQt$ox|3#S z9ty`^LwDfCn&wGcRF&sRYgj@_F5O6zw#A*%+4$rcrG1l4`4^)Lz$TyJ`L5-l=SI;k zhf$8cWwp!0vstd6`%iM+mQPLEiK>WE37&>9dUM+icw^>&csw3WM(ui5o}f=YQPY3P z5m@|JAAxt0txAw97;NUKpmD=mv281Kb`m)w}Ta{tk8z`zytC2-&*rqg6JQ*a4Vl6w3j_`YA^h*n}wz$)XqW`2z|>!*CT{t;ECM`J&QVYEBg`B znB*e}9mh&}4DxnAi|dOJkGlvVUPJTE&?+;u)eM~q3B0u~M~LV7Lxgy{d9ZQZi{-f< zp<`L-c7y;RFIy1uu(%W8VCv37mm~Bgq`Q>}LSM5`j03E0Ux56;*wcWUD}R9+351$% zOs=~zfMwLZ5M2=Iwj|Ko)36vtRwLtSU&vE`J^EjP_HH5hj4df>OV#_7Fv-B zuu-`eV0gvtAI?JyM%fCsh1kh{L)!$(i+0Ij_{A_YBj1HpYNSY2 zX={efq`g^ci3M6WmfapKyBjwt7?6{&<94N&&uMw7E^PfIja0idD zjl#Mk*snVa5m?p#lb zUh2RQNLSlG@z&|)R@)u8`<%N_+dLz;)eWtlyD2XP9(2SDH6*oZ`q4#i`-2{Vq`@KC2#m> zHAUrm@;5i^T3kTdswKG7^QZNR>zDlEstxFs!Tb)q+kfx5JRt?ofA1OA5@{w$L)Uql z`cv8XqPuM?;-Cgsw5TOp)bgG06i$clZAZbnz2~XxemOnQwO+ex71Aug-2m;^10UhCm|mOWd4)wBlMf9*0c(dt*nmeuF7jP z`fTmSd|yk)I^Re2EoxH(C8>Jy;m^%WO@Xm*o(xG|cmWTO?so>-|6IKo?cMZ1CsqEF zQ03fj@G3=VyJ7BAKcf+avn=Q$KSDLq77*XQoQcqOW+lusL(d?@XMgh2?PPbypiKOU zLWKHZs&^}wAe0KityCcN0<%s|L`C&ych5j*01IUzw2Iw57ooqiP^Ythfwqh9|MsnW zB?*cYdm)99E0S0J1Enc|wyYW1wgG9fJ>gvJ3Fl%@I5)W7ie#xhhaJ|q(df&1(9B< zs8_%kh9|1DXT5acy2ixZC z8B7{DN<;hN)5v#@B{o0yvzQ$U%CdTiWse52QsJx%oqiYtn~R-jLZ3s%_VA`=Ixl*n z4g37CmI_!F`si6`9XAbShE35C&NjC2u_yQ2{Gse5#X7YEwZDN{gseT@5`5hc@AM!n zPv=d;MtzFj)q@blEqbzAdA+i%uwx0i(;QABEZs+&EQU&EdtrQ|5*FxW4A_wNcEQr0 zu^3T2H|5a)ZrJ6ir^6M&Ovg2{9PQ*S5DRBLc2yq2O{gcv=W4C^#)A1& zu0l|`o|iZAt!K3Z`>%yla@SG`LXiilxFK!oL|9PRFnA-6Z6>2AyK6|B>X>9d;p)YTYh0 z+#VnN?RV`*bY6s|GQ%@C4=ozp@2T5Kv7VKo-qXf6_KHInEpY8tgKyS;u4+5mUcyc6 z2u+FB#>a?(S$UM&cmYK2suX$>KKG_ecrmEC9x~&OULoP@oN571Ak@HRs14MD=Q3U+ z1s!jD8m@+FZTkk(f^UmnzTA%1+>VU}L$`VwQpl2SS~P7n<;d4^@Gt0ytT?`w_OV7k zX&+`Ziv?}R)(vkhOSB<@Z#FO8NQ2H|@lit_&!&!75lUvE7KBbK?n_Ep{WRQDOCt@DYXc3DN7LIQtm;BOZh88Tndd@F6A?X z{)r)tbD-$lT;5`YxV$=qxV&bBxV$G3;_}ua#O1w-5SRBgLR{Y2kUE&$Ls&6MW?ehL`-u+(i}NnR8PuJ?>zkE~Iy_BW|6t(kajxq@SN5WYhfzB(DT zC@lH<;%n|I9*G0V*y-ovR$D`9hqOIRGv1hjtwCc|*35I2o6J;Q5(MN$=2odqYgjAL z>I~br-0K|S$w$~DT5dqQe6n`=#5}DWzTs=}$ns>WX&e$(TUps*?&~qIY?@h+PFv<< z9f-NSnd(8$g|>VTeIXS=IY7QQDOX_Ru`@u8<6Z0wP~-Tx#>)7{2{>TVnt*w~FY}j} zxx)cao!V`b=sZpU`;YF^xstm`{S;NYs<) z-dNeAaYE15<cHZKWhQMyB87^^1oBX zo4XR&RXA+ea>(J?$YJgL|2TJBsYN0^(G@-Qqak07bn~oCs{7?CIJNM#?w2b)4O6J) z>wZr1-1GvX1jqFEq?yTlHj)*04e21hc9{G9gZI@SK3h} zTzl!l`H<(nP*c4cIkMcOJPL_2y>f(QLWO0|B=DlDksh%2VU4$d3HK?`a9(&zcmVbf z6WjZRB4d&Yu#LxKYyYiA&QCJNCLCG3K#`mPY9`;UkJeCAt-JjUwgQPB#OSPcLRuIn zrD8^}cHo7pEdzJqn$F20D|siT0b;lEL#t$4oBpmEGYBhhX7 zV!8~W1ZKBvKXze28&y%#ryFrv>5LxEEK^zj1b(t z8H@ENe5aKaLw zEEU?a!82)Saq9E)`6=<>&p7{vdQyXTr{IpK;Y0coS(8i{PCwGe&{jN`gIa?F?-+II z`e``+qoOOPpevFe=+bFw@UW-hc_aw!M^Dm)Af-julE=wY_FLQakgbRFB6lyro!mp~ z-Qj6Sh>Ai(5{vQX92VXZ?r|tL#f{UF;4lSq&7OZ4-*6fNhQpl*@NniQ zhMFEH0%h9s;!W&xFMSqh@2O39m!Ylbw*+Y_cEVGz#N31KfwQO`6O*Y^v}2&*ydWJf zL5~e_(}!yJ&UK0FJPnQ1=n*_KG=DG55Nh}k6e*mL?JX)1lA?TLmkOoe zrl^@U%BPV*5?*_p+SDssUAm5!l>ZJQU;8W{+aFD}33=M)p81D8ceT`}=4m_YK6B%U zAr4tn3DDd6MRHP}jKfxQYYUtn9qq@|x6~e_hWj$VVGH$@P|1dnYd_jP)P0@0t}P|p z4Zr&PX@9%hx9g{aya8I&p*yHc)g5*hdJ0<$TrGvJO-mMSR>IH}`H6Xv1&O&$<9_8v zDyu?ns5Td)h>ed=r}yP0c+YEGUW$)`r8s!jaiixZTBe`h)N6!ZwmfZp9@Wq%Y*1sZ z?`a?pIt=@!HPkSNpptNw*;Bs`HJz{R&5IQFLn%;Qr{wP#<*LOI6LXXub0{apRXa}A z-oZKD^PBo*=S7y2?*bq8;F&@F5go}mN@G@=r)+0$+sO*lW;JlaOj@A;5yWwC$uwEg5AQ2Dfp3G_+;NM z3^!NpD79o~q4s^j&|SV=g~4~R+vwWW-jnH1c7I5rcCc{hR{B5q@w`6p$roxr77X2n zjmY*yI@=VFY!$eE)h0)eK|_+Zr(WFp^jmjxelL}mTa$jNaN6)fpC>yGZnvJT6 zigjomeml^Jb}cMXA$;S7P3~+A2PzEvArOoQS{UNX0kocP7t)}|kQ!P9D(YQ`M58wx ziwD}r0*Tzs8`dfU5=aC_S0TApnG8_?WyjM%W&*lUxVjK-rT?U_kOp8qB%IwzgTK{j zgVUY%OAAU`v47aXd!-8=s_k`asQ)No&yutI*Y<#UL*H;AW5)Evdn)}5kWWjY;Qrba zz7(g)4Kwr7jWo4dJU7q-o_kR|93ngXBgT9SQ}cQC>uY!F8eY{_=#MvSQ9Tpz+l)e} z1U{2$Z05j56HR+;Dro;BYlQYckO|cjZRJ+z2X5Q|pv`w4@ZFt^FEm^xZ9GrHNC zi#J(_JD@GUkL4!~Lb^48fx8{P)BZE!qL#kS$n z)Ac%bm-5Z;4nUvf&t8cTf7Y~3BUmZt8cUPD1uzfEC5A~BMrz#D4WUS`zB-{BwO^}| zi;~z4LjWvF!+N#)vh*`5k=03PBJRN?CwVinkPA-~?P@eEK_1nTsa2t-Ve$Aq&jM)D zLUu$1hu3F`hs@Q;d2H*zji+%)Avr&gU3*$6GBX7or~0IVre64A;w208>6*0|b*@h! z-Wb5IN0w7+PrC41#VokvxIFH6=JI;$@;r5q3D3P}KDV`Q&#xL2V(zYP(DxccP5ifF z=An3KxmS8Z3RiV3L*x}nu3JNUhEOL=lk!~+bgCVl=qu`k#stMTD_6088DjO>o{#Z` zDhuEPwFZq2f7f`l+j<%uumdiGtxxUPgG}#Z*m4uI^#n8^Rw4TNHMUN(_O)i@knisw zK#2DtTGx(cN+J$Tki$ZQ5h6dDTL~cK1)*=lId%kOVR4?eJ&#ruq(}0&=}c}wbEvms zpTWAX#(t4%s*yatdHDa4_a<;sRafGF7hOPuKsAbrXiQ@;(orKV80m=G52~O_s{j|= zB8no4i3`E1ppIx`bvO0$(r6a5{IZOhEMq2iCI>)xkoB%o-^x8$?vp;IoYPQ+b>Yh~ZQM z419l7S6FK7y6i}F7tA+jy)NTSei*hQnFSxn_)~ z==WF#p9q)1K~7hjOdGGK3YrPcRrVOQ@43~_ARU{z6*4O}N260++O%X)Jhza#Y~NlG z)_Pix#T9Fr2T@p>;shIc1Qm)D&#zGBcg(yjOyBc@UsAyD(f5^}OS{{_{5}2X%O(hm z>CX2C%Pte^B*W-G4xuXEr5*C8hR_dzY*CM*DO=PjpzmlceH`~mbuicEJdASeSCswr*OBSjv&z2C{24u@K7B0^P;qrU|$d>0pEW3Z~dwDK<kuF5V0}v2fg5wz%L|c&fo$bWsE!qC>P3&NfVF_xVgDJUY=@)c2pOpN8`E07#x6(mCjaV<32%5_x0T_w6T5-H}z*jRN=-H5N&uk89spCF!C+?;~m}m#bU-xZh z|F({#m)k6sxgvLJeh1mc;}q$qUelfQF*xf#4}!~INV@MA_h-cYRAL5yeN^(nljBz| zL3Ua%rS|+idK|@C&eb1E?!;OJv-8HvBu}g*iOH^dL%}_6h^>s|cby(xzc^)8UP(HuGB$D%VX_txCTkI4vKA30Yf)`%)dkUC6kv7LU^k z-}irsH0h)EsnqyUp8zk|7;KHwwoG=~W!_{vmb)n({Dv5R&tF8T>oVtQ|fd8{Zh*fWtsj&p#yG@jHoD)$;q-3QY~6GLhp){F+eqow#l^mUVTyEYt1R z9_GztwPg2AH0;d3Ga%Ob06k867tAi@Fr!mbhIhNq7M)G3Ww2zqYrCohX|HdJj>41} z2vg#wfn81e3$9+@bP!LU#X8&}ZgTFaV^Z$ZIN2TQ{EoHKEtIu*%9RO^7rp7@W!Vqv znl3^O&W#WW!>U1li`GN?ijkXi;$S-A0xXs;gf`ymJk)n zL;EUQ-fIPCEh<~WCkan23<(oXa0|%z3AST27}h7~mhFwpfj+70_D4XrmLCSPT_OV1 zdd-~;WUIdw$X5D40hy8g&w$LxUQ}52gh*@6c>d9_+>>FsZ9rDv_OP7LS|aW0lWq4o zTlb;-YH3uqNtE<3b!`4VUAQ@fuqKW3HCy?2@V=I|>>-}v zp_vopO<-dy6P9#yJG|+EiaUpzdoF=;a@+j?59#*9sv8K3kSMeA*mySCR1}Ig$|V z6@Q=r;oQ8Lm}-?@P>=0!k-r@-S0y$J-&-NabC2>XWO4LN5fwsZO0Zp2F4L3g?X|C~rqi*`iK0x~((LLfUx?g3h;&*}kD8AOy( zqrwRIU5vzfEhT@><^3KZ(-g!*BeI0KTJVCODh*Q~opM+-jr4giEn1%@0bQ@{3x95X zDj!v0cuL80Uwh}k%r zeVLmjG-b<|sleIUGR{tq+LZT|akBWZf_A#k9A^he%551ZCrHNqwPscfJ=XeFDk%Ph z4^eSl@{`uD8E|z zyA=v1d@-?>mssGs;KWLz9Ia4X`n)96>;_q(nCOVOTTFD;sEJNfr4Sr^k6VB{w0mX~ z&tQ@G)zPxDT@t&P0zfZF;Q(2tnaeusq)h9h7<>@XHB!8uc^FSwTMowp8D?(;GR)ot zbhlD7Gk|`t&>Wyn{zt3EupA8A3$E$m4=mvbVvT+b{rwg z+&1aEQfEJ@7WQSmvwqOU-psVSsq^L0j=RC3N6=p*3$r8fLeqf4!fFX3hTO2Kdcjp+ z;_yxmM5S3s4%didBQ)YztZ+_k>((sVXcW=ny!w2~-5qyd1J|+-f@njpGH7DDq})Fz z3ZM28bxvVAeD*lL26(N~E1+tS!YGNcU{ztAkf_;C7H6W2n&C0Nx!bXglLs&zv0?fo zAk=3-{85j^Ik=c-GD5nE@ZAXx6y%Od`PsAtJGYV!OSww=u~QcLm@C%$JZ%=wrk+4_ z=VNrg7N%QzC4Y8Gx7`kCJ!h`zxkNTadoSi5dzzXF?QC%^dNc9ac|I*$Puo@>)!DEF zrSvzfg!^0B+D@0!yYfgVRMo)=Sqw8zr4_@>UI#wYITz~r%kVg*#fnAz(8ge!pqEf! zz8O=+^SO@F@p~;VEoZ-6JWt-qy-y0IE2oc7#7b0L23%CXR(r@XL4~M$i8=gv4OqD0|^`*DDVHI#7o~w*wjf`xelHnkE5iCs1d!>KGvZ zOaSuF1R$#=0c2SJ!m!-sVYx*>R$neGC!Um6pBPD6ed~c9)^;BX%T0uzwzRJUZPeU9 zgxvO#>z$ynMmlGD7wTC?ScMN-#Pz0om%D+>cU7}v7 z7GnBO%z}RwL4^5aj&N{7H$LU88biKr4WYyis@SO6vE>6l`v|$&{lS_eyV|5VhFMjr zRhHOWAqg~_J9m$ED#Y+Xdn5X7?^BiS(bUk@Ocw{()?5vmsF4jD8#-KVt4t1>jb?fA zqMv2rhk<>r{jbpDmurj~TEAN}GY z&+V{r##+v2J&JIn<@-D%7CR!zAWms}a%j@MWjn=^UCVdzC4cLeuLHW+o0YcXb9B70 z{C-mW!<1j^`Bk`6Oj`@LY~a((&2HJ~gSCZQ#CNCg&kxAw@(1}$w*TWF_>%VlCWQYE z$U7oGuCI=CEtjtHkAmNl*3;f{>s2TWsfdM{{Riea);ftXXnX~cF$D^^UZ!6CdPV3; zD8A=c(JE4uy>9>FDoS}XgkN30gHBqnWo0GXH6hu4i%jC)ohLXDVRVHUGe%Cv({dG^ z5u!&}M~I$XVVoXohg6J;6urxV($9bexd)~LJv<#0?H47!M!7njy?>$Jpt29+J~3Q6 zf<@9fjI?++aIgB7Rn*t(ZI~>*QX5KFrJmBFy-vQquu?|Lx$FJ2yU!!j-BJ4F-mBBT zb^x>K-_mQt;zc0C-Q$_8#}yBX!rXA)nLvi~#Hi+J&7BWqIPVugk80ZQfegnV z#Q3b-RX|%bcO}qPg=C{x&0^|qHE#j3cDDgp&2my$x%a|y16X=i-_Q_?9|UCO>VT}i zBY>arznL!|qq?@q#b%U9~8C-O=mY){zW@QdelZ zA4nn=x2;!Te4(uipzwnYe4-nG^}*H~haFfSERFQA1tHZ)WMe9rP;mI1RB&K(;iP)?hCYFE~7!EI32FM7rP%^;)IIg0qj8m|bv&d5JR% z&TubrPQe-BwaWS`IB12=FF3VcVqU=+=_M{HIQx37vb+k;esYE&fWlvDj<8d;+PyBF zY9?8DD4Vj7hr$@>xe7LFf!n3WhX{(q61`<3K)(hYa)9({z)?YX5NVAniZAkk!D0)Y z2pJ|>8`d{ouP{uTjbZXRr@ojbq8jfnHE>3Ba7Jv<@u`WTo)T}81$D6xc5@r5VyzOq z#Tt-jbUZ%==yyDV_WB&peUc;QlPw}uD+<=CT+hAQkQLNl8;+}nSeP-0TuJ^yHbap; zjbs~(BDSu?(tWaF+9?%kNzYnac&1|BvrAxrbb6Gt!>GP=^)4JR$^eRO*XZ)gY3PPP$X?iQmB#y3p1{66lJ@IEoSXMO%`!o(vuvGAd=FXL=SVPW z^(fxE9i~D78uTWR9jl*VE4-|S-w%MERp{qHc3cjEhTfrRi-7*7&{u%$Q2Qp39cteX z%l#9O9cr6^CeVv$)iXf$L=niI*a2ki{s)jf5#!}pxr2bLocMTIyN3f=xeLN_3&L_& z0KKXG%ZBCt4d?|;8#pM)l>mI!#^FHL#!*04PGY888-2)u7YaQ;PsMdHW+?7H%sFgk zv~jP}%n;UCjkEC6G3%^toR3@lbMggWcDLP^-M!+@{UhE4?p(En;eG_Qg~6n2m%DVc zo}mc4%sP=K0mve9`|~^#o{=l%j8th}#gTWFf8>Fp50lfbbs;a^N65v|Y@8lPB&V8S z>LaLV&jT(v3hkitoml!k?S>~;EjfDr!i%oDY(dJMK9FCRUv)STb0_WYI z3vCZ5u&vPcpaL%x+Jv0~85i0fQeb+*YYIMCV#n>Fi3R*C!e;P1L16v{Y8Fd9E%uMawwe&$#)r)Q|y(SzE=}Z8_de&Fq1@e$&`>a8d zKT`86Qfnl2-`=T1C3U~vslz07RPWRglDdEI)LKbBpm*xNl6qk8)KQW;x_9aUl6p|@ z)X|bUrg!QXNjLHSPNbl4`CG}&yQ|l!4(4MLJuEQkt%SALtL4?!riY zS|K_G-OIE>d{N##iy{invY=rA%)j|7*1z9$S?Wxk(}&Z>$xnZ55-*+%iM+7RT}rCjD@%m z`HTheyIMt4Zgoq8I>dDV;Sl#NA2^UC969b5$Bu^{hmJ~%N*CA(1NP`|MCGQ!7J40N zQvdhoG2%VzPq}*bDO=Y{Co5((dqt)8=g9Zq5iZrkh(Kw|W{I}B2c@oi)!iaz?{7<= z-Rr?s(N^voCZrl@aXR}@Rme29w$Q`MYJ0RE@ChoeE8WxIWcZE+eH_P{Q@R-j!8All z4wPrtmmppU72j{&#w7Grw=yrE_@HOSgSJmH!F+2)4Syozw{v$kP)&`{>%RapLn)yv z4Z4#RXuQK8L+E9oIwbPZs==&;5&CQlXso6k9zrLCkOWb(+{;2}X$Xl@#&UlaLK1<> z(jE_?QV2!ZYL+WO>kK+NgrMTc74l^uqe8w4WKVn($f%Hi3CsODEO!r(wc8Pvi-cTBO~{qRfW~OM2Zmfp z3TS|){UpqNR&q6M4+aKvO1;>PuG#L<;uFd4})DXoG=k`7%GMcRVmX%Opx+j z%bWO;zl{5b3@W01$i)=z7Re>#WDwP9`FJTUq(D&sckOzV7BftORyfrs1x_7Mm|tC( zhW`B>3->f_pv7XEHmLB0!G%+aE3kHmxp}6>J}gn6Fr>zi-VX9~*ye>66f5XMM~dc*{ZNzZmtZ3?Y)HKdr?*ViYK*- ziTzh00*bzc|0=o=`Lk4^lC-^IprSA;N$(b&Wk2+ePC3be7GyFt+HA10;R}{a0$LDx zfger_k`gbo3MI%UW=hDx^-`bRS|-AhUiuK3|B)p7*z7hQ>StC3WA!~HipxZZFQ-!9 zqqLz(Lw(o2*YM}Nd9+-KzP@!8wS8oDi>QYB?n?iWqU=D(?e%?|;hHH}K1jV{XWZdh z-`*54dw8`S&j7x||7g`#J`KBzpR(b{bAe6*Lq)5;2Q*osP9Vd38-NV&Jq$EMb0svU z;k`zd#BrLI1Tu_zCy)a-3$h#~(OV|J-LF=p2Ab(Qkz|1!F)Nn$1A!^>_oO#{QQEsp=va%K zFdImP*y3*NK2ah(@Ts+8W9^-_2-HlZhq8)A%L$U=Ua<@pYCD~F#g$x3y&->?iib5uw+ zWjExz-_M;z^se-g)5c2&(%uT`Us@yOy$M#aUnCyV zCL;P%@o0eNcQ4G<=DWMIw>uKesDY%?ZCG`+9-)~RWDCWQ0d=*>Wbu!g`lhr-Xb+L{ zBZS{+mYJ`IEaRwSaR0x|U)J45xPJ%rE7v| za!NnnJ6_RpdASJXXLKT3CDhz0y6^r5Wc%bTAloORlDFJy8mZVPl~J2j6e6U-AaDAa zjvF!8@2cz#LX9WezbP`Y(2=5{+gUY)mV+shlX)Az^<*vrBy9>}En-~R4|?tQbT(bU zr+G3#Jf8!+>GL96PLv>IONP4B=QVT}CCnPbZ#iX zSh0YgzOYjqz6w7TqP5VrP?9mY99?L;+y`q5ZJ(FCd%qx`Ke&R=E|u#8RH;FDyz*m7J$Z53d zI;KgiilSBRK( z7U2y$RVMfAXFTX;Ees4lizh=ZZ&0wEdKY#S(9_W^iCn7X}s}~ z+>c9#N@jLApBLo5DVbj_?IT}bZocV)0l5}r_v!kVQrr!ls_#lS;->RnGB))Yw$1i* zgs8h~0?BeJGIxAB@;pVZ8G{0eYsnB|W_HP7r1P!Q*5b4LfDjc+ zi2`8X=Z2~L_t5zJq(XB3Gexl~XxOS}?k!sV`Otu^Ktg<+(|4`PYV>^?&DiT{M5Cqg zdoR_s){gcqAedwi{m>0`&i3z*fjapgt@Jcj;cq2?5KJ& zEcYys9YL>$<#vVTx`C{g!66^9$39*5%6K{u7->OGH~%orbMITUPCqo~A?47VcT?Jw z53+;)g4_j4X>z1$pIB=LIgkhZkiWS1(@Ovo;uW+BVhK94Nm>$G>27}SY^oa=Yq<-k zp~JiP9J0I>x1SJEThiZXjhghCmi z#j2CyZlVb=spW|!BV+&<&fG5j;g5(brLjFVjKtGRH@=A-n-E8_miO5QerT~+%S5{4 ztm3t@;+y%5W>51cg$uxH8E@8MQV2UJ!Uyn@IBu$x{96DCZ|?ZJ@GWVTClwH0s&uqA zU&eD%9?ryyiHCMqtCW*Jf_kRCd&lc!ten7CrvB~Jd?|Y?xv563ph#RBcfT)7GuEEx zQ;gq7a&;%Dwo-!SY9;6nq!RgKjzv5}AjXrORjb(2nR>i*2)hV<+sN-EO(!{*Xtrgx5_an!B#1YHCM=%3y z{=H5eHz+f>qJ)YhLaN((JJrcFw_Ywtu1jACN#&QqvMAmndDgdd<9o4Ne#P(NS>W5S z((mzzOdRjlr@CS-VmRBC=-`t(nq*7J~!Ub#InE_-B?C zwmX&HNshabQ4k^?;UX4s-;}jXc+RoN>hY z!%Wimb(Q!!%i;#oaSz2$XK6AaFZaumP@PLA=MzrfO-zur*FKl$RJj})vElDDA>H^| zI+lJdXw@HI9bW2!imDi%gr8)9M0wQ+l*h1eR@F%Z_1h#E4nS<$hCr^meY>O(pd=kB zWg@Sp>tDO+J7{CiWa66CgmAV?bX{F&{=Ss^IqAscU{H~#34kaI(VH{d-Q2lN6pe|~ z;&4sR)(+_uJ>coYVeQ;j!##W}GiMChzmnc48|xcRp7;WDP*4G`Kmoa^sLrcZH%p4(j$p zYVvFGYWD7%-`&0H388S8z0(04%m0eTifJmRk7pKEOrcSydy~_+DR%Q`NNv~}bTsOC zb8F&}$NH${nyZULwTAvW^W>1V?hm9hu@>n%a*p3O({5FkN)t8J-@hF=vK9$=bbXuj zfW@_^d(=)xkfnrlDB}ac zBhXEQ{FQw}nw_4T;j|~;YkV@c{D)NRNZ?5nbaUWwOrPtQl}EX2S(=lJ*Q7H(a^V6t zewC`>e^T}9sgZm^F{>CKSBk|Afz~5h+mf!|A(%9l*%fs8=!!0nl`dxwRy1@H{pL== z-OSZ)f3Ucu$SLpz>GP!x8!M(ZQ&Zi3JB<;&SP+H;V13)d{o`DWc+JE#R~K2llk|`c$ zxqyPkQ&x>G1#zyZl_AJu|HP2wF=7dRQ}$o17-r#@>dw4Qp5ps#k~abWGu4Us7!}czcv|pAl3LxY`I*i19?&Ijk4Q; zR_R`8Ivu%J9^#O-HuNiO*QsrU4nlQpn02-6rc!rH@js|XDdZ&G_FqSO z{vy1ZyP`4~WU~udzZkls2M9t#5cWYk(59IA?XBtdDWe62iCeBTVIgh4E@j-c9HEFA z^%Tm#Kj4O1CO493pN>T4Nqx6apRpA)tv=}_^u`37l;eojcuHSEml}_x9u)C zi>@|dM5O(=w?g<2i9JtO{C;Fd3(wi|8}h9rKvnUFJ%0MZV&PzL*`S8}uKkfJD6^8g zzDrk%Jhe&;MpTe$eQf8aoKE_}bTp-4%ry8~!9vKn5g#rCC7{Q?I%| zkeuR0>{^{AI-VP=8zz76t)FE=vWLc9<x3xl!Nty?&_2vgwCZF& z4^umdY2ZJ*HSF;as^ye7&bCw&K(irMMN1Z~dJM>N|7B=UOM><-UhMJ1f^uy@R&HgO zb`oso?b?HopY0{linZKEFA>b8-7XCh>p5qp8#i2YVyN`$((_1!bZ=BBJ7j_msua=< zs}#~zKHNh6(!%TRQ^e*CgnVdxw&sqmtUz3`qYH6UK@jqI1DW4|m`(l{;6(F$%h*te`n5%Q)E7Pt}`Kss4c3fzxN3&tEL=9Z-lG2BJ|`dTXg&cMaRj7OCG*vc_Z^Yf^>-n$_8M8Z2A-PWe~ z38ziYZAwKtGe;)bIvYy&x&xTj3IVg-^BA;4<*}9@(>=mHA5@y(i&2)$|s{f$QeyVy=4uHONaa1LF>b28+U5caV z&q2@b=)Y%w{ebEuuPDYCNiQ$cP(Q7yD=(8Mf5l&s;dYf1wBw`uZE0`P!LFhRc|L@! z&PF+r!jAg{FO3UB)9t^K7k25bWt3kbH2x#Kb-XjjHLxap$+}in#j!74$-0zK( zu{nj7aZ-mvjKZ|UVrv;E7Giq2r4LqN>gtdeQ<{|W(&Gr9E_6_pyT)CwOEWoteQ8Wrn@9wiAzU$8qXF8ACAe~+M{F|2 zB11|xKK3P!r?1*tf6Q~@$;P#k;;;U-u?HM?bOufdvOMkTCh1xxD}jGi#Ru`ax(48U z{zt1;^0|OcMXSWA@qC4Z`n*t~dx0!>3y=v)p8+yKskqPC6R!f9pmY>%bZX7Zf$WJD zK=#CKKvthb540zQcC~UsRa&_A&*W8BZ_DDyBbZpU&pfjvejY|A)Xg?K2{^sC)RFt3W+0|ST?+_h>z<}0sz5qKD8R76%=OIUR_Se0C?B7ndWPSAuL z%{R`i%AJK>N3wDH!rbt@h0=?)iUJAQwqiO~MRss&$90dDPP(h3QF;gm4U3j%3k;&wJylUux;%D_WVwbCIiS2{m<5~I%G zNeRLEh#s+(v38Oche>lvAKHq}YzfTtZpR@sZ2Ny6kl{yJ-nQ$CK%dkFbTF^}6AFC> z$d;1CQn#ffK_sl4s7`Gu`M9GZW{dlRiA4$0S{ZO)lGg`A>kY769n1Z%Jku1#InO`^Q>-PEn<_)Cg24t=CEU zsHnh%4mZ-JiUnlxj)kywx0J3Mra>&;IgJC&w=dp560a-22h2Ss*XQX;Z4^ z58n3@F-+($?6oj)ecB9_#v7{KyDgeJ*@x@0jz$f$UIJuq_*NjBxhH|@6`#HZWN-aF zAbaa#dt|vo!*%k1juu-=zba|5%ELbt;^>H9N6&zcdj@kHbj{_LT_wRBFYRg?e$f@{n_{S0cNdbi*v1r+BfU(t zkleSaa4pv*ypY`w6~icz+z~<~h{WBcos)%!G+dfTC@kFyPbkc10>V_tj~m^!a(0|W z|B&M81Lme@6;V&wSFV>QTVH-`ped2!nsfGhh!(_Fsba6hT197Dyq%9gHIsGv_23d5 z-KQ5;MUA;Br8$-7im2H{zzLJ9ol!!oqI~v<%3WSIDUY?(aq_uqOAGH&N!dmBNb9BZ z?oqqnRKI<+V1IphncX8fr7=BcwP9;{UI{tc+g7J+xc;Avz$B33nrX*`=**7Ojr(Vy zV-@;OAlt&?NoHGE{J<@DKOjTgLhIP}Zw5L_pA9xsesw`6EO2PDc|*n6Id`piK1*1L zXw^YLUsNb~%p1Th_TJQ}>x}ZI*0|1SZ|X4DIYjSpb(ZZC<{h&T2NSo1#4p_zo$ieq z5O+_jo9>-C0N3Nw#tDEs(rM$T0t|CcJE|+P;MzqOIi1fQC`fn;7poN4W{&LOtZvHJ9h zx8g8fmu!3|_d>F9eXK=9yiGgTkIo(ihH>A_KR;O>CI-F8fn-llLAY|m@MaC7-S|N6 zRi4V`D9c0DnDcu}xA7x9eq$>S8Cp1>;@I$ZKb+fz z%8eOY868@P4{wgGj1P?fEE8Y=z|8_w1LSErnrwV1_eWx_H{bUN1$Bgc}lq43iNdrPl~N4jvTne8-i>)N_nY%J#`B81(*s;GlUx-6Y${ItPN zq$}ZV=ldUR*Fc9(mEtT_Tx-O<25ggLsGAZEf3lvu;m*lgGUXp4 zhbfz9xjeDfY50qb)|<0C9(mab`m)xYyU22C67I{ABl9919n6$Ayr(0cb7nm9RKp|8 zXyjpc=@le#Z5eqx!~KIdj;??;43Dc zQaf?#sQARiEVQ``Nu~9<3mtbWU|oFT_2ZcLGg(uY0FMXe`}4HEbRNGaOk6xEKJnto z@rkETaq=D9{*pL9|3sC$^c?op5&Lp!frgk|lb!i;@Ly@IEP zF{Z*z!{wJ>W<=+eSIF*>TzayhFr&6`*~oHd_7xA08T(1bsKRCYW7<}jb%3UE+tcfX zS)&VAA7lZ33Nyyg@4~Eud69)#hZL^8A9(SKC%&IF~JvQ#gwm3}FKjC3) zG;3Vp>cjowpVZ_dyv!wqS>p>=*Zawz(&Qrv(pQ*uRN?BQ1r-PMGaxhd_<-JI&iO;b?%dbms8Hb;Z3F7S;v=bYjo zXa>~P`CTVr34sUL++>gyTmCb}x=^w0Q*prB){(4Vlgz)1b><_<{3D!r{HR%cZAy&l zpGwxh%g?&Sm#6aY)m;+>|4&L18$Q2nTf?J<&%pl&g8vWXN~Gw1v61Qh!~`4kzd85U zRO8z0$vZnoXOB$gpCyP&v*G(ugOlzk?m6wKNj7%oUZcKL;{(|P{QTI;VS@|9s*~Lv z$;KUvUr)Hn2?=-hBm!*7G226x8_*BRvtT#Xl)JhgQo@^B>pFGb)KRW8&YL>gb;f&B z4{@ENV&ezOF&`TlLBQuav%RU~T<1)0>Uh^V$D4YT>zwaRo!~n2ys491=Mrz~WY<~f zO`YO8SHwm-O(N<`@c20XS4hFjP6T#$NJjLy>p@c~_hE18wU@?T>$o&_Q(}jFY)krt zMwc_0T2QTk_Aj4;_;(wIL}tObT{GO>c{5gvwd6?vS0JGKWU75uQ>tsmA}!K2<68Mn zxL4l*Iht~JI6+vNt{EZ)AX3B(ZG{q3GLaWkk++n|z`dK+o=*5S0$8P6OIa}2j#Ok_ zJn}Z7F}7(;7m;OXhf32h+4>|@g+y_3*T&nUgCQvh8YuH=FA3`OdK@25YHG)rrf@P5OBFWgM zBv%&XBQ<>zYIpE-*;t(Qo!R2Vev5*3Wom$0O9DC7iP&#XivpcC2xCTP$fJN?9NhWh z=plbX4|{HntERO_zs6)k%5?yKSJVYibM4WUke0NtnM4=*63f;57$rA1>!)bhRn?BQ z-mco%&D)u^xVMitE$W?7@8uDn8ujG(5$By@Yy$kUU5^!@_ z&x*W@qB}B?r!($*@;DDYl8!tDM#cT)4XC&divEQZzPKuWJzsBSA`e;VEtGyIO~j+f z+YAaTtIT%tQK#oN@cmFaLOh3zv?U$9KNFGE-8{1)9pSOgbmYkd7TPwQOxc)J7MG*UA^j}I zj)dF!cdkcxq#e>|@p2KF5<+*3O=LWR%^Ymy_A&Ni5|Ld@7(bn5a-CguWEYDUs>oJ; zBJylpjMaH#56F(CK>HzIi@fPR)A`z%$isfhH3Jq)!UFhCdNy20O zZ6c11nMT-M-6gvdk!KwDL8o)~$2*H3@7@?6`@9oYA0PYlkf-BgUrLO9${F%*V(hl~ z*r(z{)+ENh86UgN8L~Dp_QCkrcj7~yWevd`k8y_VfMVF@O|MNyI_Se7bq?4zDluep z+?zQn6Y1=Hd02wT@tx0&0K3J#>7z3do-FO#`D{&m$dle#ha~Z0^Kx4Xg9?}WVMAsP z5HH-(g_+f2iHpZ~VS2Q1=|D-WEzBI`XAZW^j>7bs!lgs}%%OhfK9ZS?Y%WY6R=9My zpE*LPx#_XKt}*xp!lofC7yo1x4VwE`;nNRj*vU$+xrQ5AHmBT;8Fx+bR^BUmm^=B( zxNB4S=Xagb9vw5Yeb_+>ca4*OZZL=L#)h4ILbY)G>R%|K^`;!_oqud};*^F0Uv5WX$dJOnkVE&iZCG+cRQjKrsHu7W5rLjdDUIo|y&^ZSHM)k(^ z83><`H*5@8+}O%dHO{f4hQwArI^<9Attqxrsi6Z6%WWO1_tX>YEM(#1RTi$n*78f6 zqKi*RvSwl%lI>0tgo2*(U5*~|ao4#4n@J7D0KIl}F%!!?% z;W=q?nYnBCA!|ul5>xH~GEJ>3Nj)1y?08$J5Pj>$Q{R3(^ogFYCFnO)j(Xu9WDf`0 zY_)mBmy`p>JaI$u^1;+KPU|`j=y>rVCeySoXP>WdHy=5W+ylKfuomaQBp(D>Ft+#c&EporQxoba0y%q#YUvW>V zwOJeBb%~QNfrWUrX^2n`$wgY5ngBw@VFTEq3HI*XcjE4ILfi$(V&UC#Hx1zv^KHIx zMv+a26G}mU{i2yKeOAQa^7zZaqkbxq@+YaZSL!-6kiN-!We4Q;ahx~Ai_acU z$u$^WyPP22Z5?}N!WXq~(9F#hnWb7R!!hNDK*Gfdlm4yRFP1o42yPttc7jXm%uJSR z57l;fo0XAY42L;-QWJD@iOE9Q`})%~b)>$)lYx#>C?2Mr6{a&<-QrFiLA`h z{xwYN2-AcNwl>7dtb{^j^C4PeHx8JMc&JYi!vHS-C6QAmOgYyO{8xTtShSP%k&F99wpu6XQ*6yQXf-D)OYr*+=C(!R-;wJfb3aWME2}4K!@rRrvV+S(C2_Y zu8^4d8)S>`M+R!HPDhqkwGU8h~t2Q-EwxGl6VEE&#F#$pYCx{|64m-tGSt zL$RgycMb)5X@a1p32C3$^;Ybq(o2WYM+^KRTEFXc_Z|;) zoc4Pv&{9o1B}|(G)U0W9!?ZpSzfq$w!6|rAqHei%?{a|kMM=YLpx?HO=(qw2;gU@t<_-IEdt4;PU9l%L>@3xWIX(&vBY2b# z-%m1%&**4R0J1kX9q4#XTL?5+A)%Zb6%rBJXBGN>2>k@;1WoH>E*8p4o5vxTaqm|$ zD&rq%{-9ye{dKg~|L*d?8QSYg4f)P)&^vP$A)NEGC0JST%UQNt7C@|J2VLQZyyomu zh!$X33$fPeeCmTF>cM*)2{P9fLsGL;P8T53Sj!YjNRl__+O)-@v6kC&9a{2@;4Cap z^y_!m(E&Bo>e1K+Qa`w{hbi%q8=JsGrFj)CWiS4qRz(7rM8P0J2(+1+rQ) zKvv6zKvv6TKvv6_fUK4RkRj)GAgkruKvv70Kvqj9kkul$##k+X0Xj*?_BWuD6&lG( zw%q@L2dYii-+2o4w? z^MR%*Q~-)A)Cc}ERR#iFBrfoeX>eG1EO?IuHXn_fu+v!Q)T~3|jV}46Xu^Hbse2!Z z`1*MJQLQvl<-U`DcEBS=Czg1)J-RIJK32bW6$=F;fvyPp$!Io{XdmG%4SC|1}m`>EiV(ujb`_Zn3rF#?Qf3N>kZ+@Y)m>Ci78HYhWYA-Q-RArO_(p%4vR!9<0lKhF3{1 z7o{Q`5ZZKYMblK!Dn>8&mqs{Z^;K0m#J-Vn2R%v8hqEx+7nLM$zNaolxQO0w{&v#r zE&mQEq3>H*GE0*nl$IuLDh7$QkmcS5G_1Tr5O0(%Xet#hz6089IWuRg`ipKtLOhf| zQHUn7m>h_oOgGiRb}yZm>>30F1BrmZR~3w(STd15@@;( z`D~#5qe4Dj0yIO@t_DgfbURR9pZz7!Tt*g|1fdFym9`KIDfe-fot$Zm-_A4?tZ(6j`0kQV2X@xI0xa(t z$+Gx8snfenc*!94g4Zf|p^q1r6c=l_-CzN-zgj(gZ~>l~FJwQJ@opGblfv1Ii`1jz zko@u%)AjFQY=n00Yp8c0iG8axUelSq{6lvTXTNh8cxh~#?o@cq^ z#l%ZI!(ypP6XvIJ^OAgQW3q8W?B;7(k7@5W%`$?>J1H=6jgQj;7g)D*)eZ`^Zp@u8 z6Mbxe^2+WNAMf>q^E-XOpO{ip+Es2Pi`%5y24`{fz~b4ovv z9e(4UN!RR|v=BRq{H`4_y&Md)6;?fgVLNzH#e-3E1s(hdGeB**m8B-ulEU| zT^i)vC)76+5o@`b+I!8m+etsLQvba4rB&`c4wh}DYlM0Bua@^t*o=8npC8`cZU_zf z-!f0MP;!_{5JqH>;_7eMNu4W-P2?lH(wB=tT9$AR{+f}+vnW_Rap4|pmbG7hW=4uc z)ae%b)40OxfnKQ*g!I3F48i>DeOI3q4_YfH$p2dYN2`X=y5$O$Xt`s17v*jOJVLCK*l$}8>Wf# zqw&qdfvlE`fyQbZw*a+i8{Z0Z{{-}!&d_Aa9IEBY)RliuHmQIWqEUnS3(?pYy0yro zy|#xaV~;7HlN$VlqcRXwLs*uN%9G(AKhFGdknG~6+u2gp6g=2bdp)U2>Aju+r3wAiW_wd(0|z9m9V?DXHn4f&+-Nc$P{SI;y#W&2 zBk3}X`pt4$EI)%ChGH(=*b%#V1~AI|v`e__3O3wo19x-T(hcJ#`1o0lOYEvD2t%1Y z|JtM$CQHKBLG)To5-`ez`k{I6`E>h9g9wU^rq0&<}M7 zJPl;K_IV)NJ^Qe?Y=`c#EBnWKeH04yJ5&RO+QAnT>MH$ey^F8D zkXRoSYC)e^3WeI8JtE^Rfj~VQ`gCwWp1%HnmOLGi%CCn!T>^EwL#WdhpE|vc-Jg!U zo^odeI3_T%bABJtm@N#AXwx#nt}0=u`XT8q6h##)r}YjgqwB+Kz1@eKNdLAEPX@l# zhoL@Nn|-(!^$Gz}NxdTD5H&c2i?MR89k8a^SxTL(COyE)e-G890dkA$lM5&9YQ??6U=iI&t*tHdla z)GCCSp;jTp47HvFWT>?n$OtD9*BL?;^2^f7R0YMl9eAsMfjqVn5oc(K(iE*%{E)1tw5(KB+&{^S4hnF&QQo+ ziLX<&voR#(e9JbC>GFGO5hN>$`o82XApz;z;s|9Y#s(o}$9C>Ov7-Z)_h`(8y9KtW zbrl8K2Hf%3jXRHbHe}tb+N5C54gC{#D|jf_^#5lFJF}wkg*}{UAwkCge1h(CEYpCX zn+2={-HZU)>SVAUqYYb26Oy_Z;j(*>bfTILj!))P^M z-Q7%97%5X$@e!b}=B0O4Wj6$iR#3>k%{L6Zb7*cKj8X5j?4MO;e^0W9=Wf&N(h5x2 z@7lBGKQJPR7tEco6R^5&(pJ#lX718n_1(;v9{Izpoq^hpuxX4J32&*s(pSw{b(oFU z-=zMSV=aFnSsT49?7O>uX8X7af;{UnL_vmxu%OB5o?R=NSh$XQyUDnRiLM|k2*>Wz zYphVLC zS_`N}i-Uk<9G^$7G1=rAUam>_BsBUN7XxtLx`Vqw((Y^Y_04}#Yav0x_@hv`AM_$- zbA84K!|!0(I$4T6G<|}ouYquiR%L)Jl-~lNGZg{f0A%8V?}m^}pXJJSvfOGGi$S7! z{gT$_09k!!hq?a_WWsb2idZdw4RdQ)%vQ@OKoU|vS|yR57HNHY7@Q>rv4+|>q0UHq zDbVp3YttT4&oPpJEK~mgUOUm)*VbaL3Y)#wso9!4D&ZZJ!kjzprfM?vn^KK$EIEh( zb(zMe7LQE3L(`FSYa}XeN47fSj{Y3DvKOsyWPof~#L!2iz0cRAz0)}Yc=8cEdD8W0 zA(XdYnsiATe4S4w2x!^c}IInp+AC&jQuSC5>zrj8aqrMMgE|p0yD%^xbqvMx zs5b76PHG6>shl>Q>BdKv+^PL|a`8WN!80uWDbk0g+;?!o*oC?aO;#Okt(LpjP@9M} zr$aG;XbQaxdC6znnTz#vN2-2HS(vif7p7z{&>p+2rjOcVF1WafW!A5BrPwUQH};+0 zM2VA~bm>q17GYJs;=~?GMglrX$vQMUVmKlyoozZY zm3I*L*o-2kt&biLz70emkQW|oPxXvi{Kc-R(>ok+PKd-C*Th<1WTwR5fT*LCY3yA5 z*VX%w6q1l;jR--ydSYcVS|`jbULZ*iaXi49aA0ey>uNfNH25d}_DQb3=9+~^FSz8` z;|Qb>?P}WRxZ@fcyNINKxvdkcP2jCnn~}%xdrN*I>F(1tZLk#KFo#0o02kYmq*ThNzIPf6@?k;vrZvAO}qrP2PREI zx}t*s=@Q?-bSg+d!zqS{{-_@3sP8cKhiEFd$E8Sycgjcm_mx z><^6xOJCUQ8ZFH#t8sgeruA4hZ9k3mD|ogQ-dkDO2bc00Di64nPXYJOr6g5Jq|$n% zfGXt?HDQy8NuXnU3#9wvUcflr*}ZZv3A!N&Zx8N8h`;U3yg2660atJ@Bl%g{B%F$I zFJj|tJd2p%o}zp5CLrTkWIvy(X|Dqr&m#PZ?Fhk{wj;y_%6JwLrPz)*1jyPDYba~u zC?IR&0-$dzNAs^hCN_~!uEx>431niEY3z1?Csyj`m%SouHsEGr^-Fie>T}zC+Gu>z zyPl(Zs?bKsNT>L-)xVp{zbkqV2r{gJzO^P%^Hlb_|5oBCHa@p4HlENJ%hpL>dyuNIl`}p9f0zA4}b00@+)~a1Sy96iQRk=@G0$w9GG;^gG6~3GD%ru8Ol?A4CQz| zqW(%d{cM0eX}zMX5)SiE@c#=DK0Y^qk8AJ_7uteWt*yp2OMXPqgFj19i_Ygq;}&{* z!hH?%A{=C&!4;E?r^VGaG30%&ak)Ly_(tsJtEoBd-PTNZX0}h^I*IF{Mjp*xhY12! zHEW?2eDZXTcKe6C;}75M9H(l(c%pb6xmY|6b_xU1tb$ZGw-d1#@_L($SO5Xai3HeL z(`mYFBclhTdznc#Najzd%GQRYR#M0l;)b%LusVja`w661GLJ&J<+}p;^D^2B zn4-G4jGX@adzL<@Mh{}mzygw`CpTp3I#Ht2CnxD!$O_E4i?w2fnC zC7Ih$a5jj_gQMqNrgJF|7#;XkAUii?CEL02k72H8LG9c~^Ohc{5gM(U{q~ST5(CSg z9Rp;~ia_1U{T%2KEhmAIjW(PJbe5i6Lh~8rxB|#dn*S9-JAmwo!=T^{S`1_qVH=RO z+YV&yegnvQb$eLu7eF*dpEm>9dG#4iH+%L(AbVDB-L{_o9H@d`tUTNDub9PWV7=Fm zRRYUv5zC~~Z0|(zq6$`Gh1s51Dfk{!vZD@Qv+FxLQTW_kChZ>ak?i=)8^}BoAXs}E zJ_dEm*?Rnk#_GP{;Uiw;d<0W&B*uggng(Q6gQo+T)!>CdXX|44Jdmm4mjIokX(EC* zk*Zivm9{XME z5pXkms5#LzbgS5-tWe?-PPe*r$$f%)N^}3aXr=pvGEvoy1s47!owbd-0O*H0^Vb2{ z%r^ts%r6gfMUz!A^SYIKnD=A|%`g6wsyy@kC*1^rF~mP4I2XIhC{|ehRDO3;b|Ig2 z*-3ojN+}$zQ19bWLZHo$kE>hVL=tC@v&uZ4jAupw{HfAey-MB=iqevGJQ7%qfjd7< z0E^uvEC+hjE543eS{f*q&OO=_-Itm^>i*(LTnO%-mvkG`?gaIvt+ck0{dBJGiDf|N zDfIIYdNPC#V6FdH-;6FOF-9(uStW!(J9&LZPpCS%qtdtn*w2* z9@@VmS=|)p;QPBhkkrt5BWrLYaoT4LcJf^#&~nF8gc$3tCbvov8?V-BpHA+2%iZC0 zzF$q4mgDmsL(}uOm2p%@_AJ$yN}xMp`B8hiePMKcQxx7}5eJ*;(VPEaVAZw9r{;I3 z+T-JPqiS;UyQ6ZIpvl4mQmZsZ_exQahe4e{PInhi>ctHwAe%b|*Y54o(M6gUhDR_ zJ0TN!Emi-Fl=9|mL(?FKa|3e-*@4%oe+gvg@&+LDa@`DM-Yo&L4ZQYY0sT%R=9EwjkXsWgZNqd6nJyZ(n0mN4HitpP z2z$)T;dN(-NM^0ij-wmz(Ld)RP%kag~A>I@7{kHX+I?ahbBH|ty&+jRYNglzIXG&Uim zir1|9pJtp}>9pf`qsFE3>(KViN4&93t#eO@nj;b%TECmca4Q`ll*t)2!GUXrx#E)$ zYt74K1hZ-U2%uE8M^Z+{>$T*G5fYO@wUt{!pGRxA$uEG`@4SWWW z(ZJ^cnb`GWAfthW{`zB$&|psknI2oNZ8Rf$QL>nbRkYk@WM2zpX$J$Dk^LvavKUxoGAU$*;vS)wWcf%R&`zku zUdT>Jc~kIPJX2h&(&K8AA81oALXHnjp8xmQ)c>9(+-=T@J$xWYh-3HIkR)-q4pVNQie zL%->Znm`uHl#MPnk$(*HXnRnIErU)2vORb%knO>RK(+^k-L*ZaC`NbV9i-W_!dDn1 z3SFyZ9ndLS?pYvHeY^s6s_kx;n(e_$fNT$b0m$~Cl(s#1J&^6ep8(k&d*$4DcF9ueuMBRfWUMwgIBgyY3h@h*J?o)0qA8bm>CvZF;_@tQ%8nKOh^WiLi@4Roj$oOE9FdzFeI`a@DRgHEvd-o=Hbb1j zqyzZnqB@cJ=%G3}iiCOkUSXdIarotW|81V88qq!Bkfmdj5z!nfp2w?IwT; z%YlKF;Wx2~ogXkU0^?>wwZ$T%w3B_J>L$P6o+_mhGd-O6Q&#$WnpAQApt zY96f}EPcFZrpgv1H+WAPv3Ji`W8A51hRbwPMXx+jetkiI^FCKfaj zT^!&h*KJyQ>j8}{5DhHhoC9>GeTr-+_4XCc4>=_81m62#Hya^8L>Sdo>e+V0abZ~ns= zkS)uTfv(g+UIKKLLe~NHUW_3{8K^!8_QPg=3~^4{yYkwQ11JW=iM4#4YM|Q0K2*{+)EvQjJ%>H7J5W@w;+(u5Bhw64K>WqyLCqkgNs z^kCkV80P$qknva~WW1&D3>m!LIQSzQl-HN&{=Inp*0aTW!8_0bB`g)20cEP2NcNfP z;{ekU97W~?lzCtc;QUUGIf!#PZ}e5jB=Z`e+rn5Jy03|+xh1gd?la^8FLMqSi62x; z&nkj>&}ajFgcc}s^|mTOM`f-)NXjMp;Oe1m!k)+))A5WKr+gjMWO>&ND)73N;rPxU z2lnIqk!XD(*7_fUZ_#brq1Q4h3zQ>QMHpsSahIKgt$~ zRt@0u-vzdJ_}^5hWPFpt06eYSdFg&t<-0K0c5PkuYru!kbsNU zMhR#O|D#p=!c07_&@0Gs1NCVN$XJ}4fUebExj^Q5{M9gb4Ul;r{{hHE6i)$}h~l}h+~0sq zMDZVC8bkI)6g5EB+Dsr5QS@mskNPhNq*wNx+ehA}_>u`(7i+moeVYxaAuz4qE`uf6u#w}xSB!?1lwLFEb~7>QgV zo^%7$8v>BKlWdsR596ERiT8th!X99W|*B#`N_j_n>dxUl3P3W^q*Kdot#&i<4P;JgTu=Fh*NSMhZnUZbGzAz zFWYXfqp)E@qe+}Z$GZ~4PF%R?DycP{pKHZC6ILXdUsl1+!qgaVT2>LU+I}sKadz8R z?*X&Hfu(mhp=|%Mr@ilTSD41W-xLV1_nTE2-`PC=8i*sBVP*U8@j@p-)H)%AB+u8Y z9~StMpt0GcF>!+!j%fK|q1m4l*7MTN)qCXG_sb8#VveipTt-FUO6D&+D;Do;ID2#? z8GR2OG{)~Q``x|u>@kt0qwTBrBFhsR^tCXwuaiJI2Q>$#JDi%JN0_aZ2@bJt6ST6* z^k7TR*H)36F^q}`Rq%Uz%9$Vr_P9tpo9@}sJ*nzK(iu12`xrlEpS-{<8d;#54J5h; zJp%nn2+4Lzk2|Y?jy37Tm!z^?xw)ilcQTMt`g9;=*|UHanjD`GWA6*Y#B5ee9>Gv( z$#OMMbL=xC0^Kc=HYVeLx7n@vP1*JJ*c{6Y<|3%V)}J0HvPU1nX=QmlZ8LWtfrcd#q;Zn^iHi zg2ZO8U111`EjMp#R^4=iHkLhqzeY+$ZBJl5=DKGaijIy=gA7tSwAGw z&^Eu!&fB=f!y4G2Wp|+e5?f6g}$d}N?XGT<_*!Y++~s{K4Sb=NRxG}0vXOtGfr|d25ZR8qH4pjRJzA@ zM#k@tntp#-s^mcxv5|BH_BX-aef%i#nz*hqgS;lbL1GHG`TkVR09nmaL*P_(vF}ke zdjtbZI0GBuX3v6?Pd&}6MIK`S*=!bu@ga)hej0ktbW5~VT$fX|S)v)mF`jBIfb1^% z0DeVfV&w6GI`4s%oigd;-oqH^4h%i@4QKH{fhBcYyj;6QVnD!w4s`@1dxWU22x$*y+B^MQ?`gK+SNX zSmX{M6_&(*!I`El8^d%@0I4o58VXQH0_n-lAo?}s1gwpQ6JTzLLCLq8XtQj+nV-Iw zHA5@kB$(w;q#rcTkj-z~2r<|8_uG6kEzIUS&>@)Jx=Q<^{%O90oT!W0t7xFvfL}$= z%?4Z~f2+A#eu|l*)p9+c9P&-@m3*S12zTGG7EdH`v;FR-;1ZID((NFUNBlPu<=rV| zxW>VS?3`?=t6r{e$a+9aIobfA9qe)eKtcno!gAo7K`%akd2VuJVfOOZj-!vY0BPKYK6_ZD_V?U(VDfhQ`$(MOwWIGT8 z44ulEg-Vt(nROpD$V~S3pUJ9=3(Y25o{}Q{>kR(I1-)99a$A~+gTPR{^BjcxEvZJl zB^f3Be9^4Uk%=_h7Qad2DajV+NzA*H+?cvh{LGspD5KohxfYV^zc)=SIo}V&k)_Ez z$n~9iny+LhYk`v8=YW*#T7Z=7#DRkv-kt`eq%#djN#Z;pC5hQ#tdOFTgc;yL-vwe8 z1g`;o)KGUw3j=k)Jbj27P#%6j@R%=}U3YkX%g2w}v|^GGs8tC((163QSQv12BGI&H=rnaY~fF zLt5?R5#(4rpsp%0Bc~WukIQ_3&tcio z>qN*uWypFF`A?ZvHoPMEy1G$ipuRS%N(8CJtRBP&VS(#MDudddPT66*vQ*d`7g-AB%vdqIYdqg zRXluf_bgD>;5u7~NQ=&4JW1qcGQ#7*w!6IBgu^_JB3!It-#x@yAwrHV7W8Hlm2xYR zTta%#`~cCZQ)ZW?hd-@%`N?2eD;|*y%Qx~Fvrnl=K47kUbB8;1O5-qILbRHt8j>Dq zt@sWQVps3J@Iu%lYlin*p}sbw`F2zt&g^y@0fNVb(FiNEzV&?X3s2~9qd6c z)BU_Eqjo!;M$BK&m}AxadDSxL=E*T>f^vr#<|DfK%Qth zm+>Eq?Bw%F6KfDY&?aDl&wz0GyxEulUh^IW1doT%_uDW)5yT>-33Mi*d$=++TP`4xC3DT#D$m#6U7l6_UBF zvHM|g`Rmf%z{bTK=|Ao+Zz9a;$Zf80RtXq)%h{_k-mNm@=wJ4B?`5D|_b8`T62OdR z^~YvL*=~J>paDe&21sGxH?`)Sq=Pi>~638D)AemT3 zI4!DRzMb1(l4PzR1+;+soguUc8*dHe(bH43< zyAjBCH_YbCST3}hfWQEV?i&K>4dx@Lnatd=T0|(Z9nJ2T?A})-$eppk=%K&C4<%gD z5zP=!6;{h;0=>VQWUHi21cvSooNt>DXM;4otJSnnn=E`Vng7mG`jXDy-^5okj{`77 zz`&q$LQ#8vHKyqBiRO-%<~Ez<#|>dDdl37s zNfNEMEs-WhE}X{xwhDC(PRHyw#Wm%^N$!;+tw;G;u%cmfZr4&#o-;jqkOlDwo{ z>|3|pcL&28Fy&@cgkm1zZe*XAIT%VuFhkaoJDB~57@TID4Z_=s^zmvS>2DN;;953- zzovVesNv0rwi!C23R{Hb1g}N-8??UuqB0Zw;(1YVRg+)*W!~+Kg;7(6Rcq~6{fy7`qOcY(N7(haCTEJ)X`@hvv2?G zXqVkbVd4}Zpbsp3gR(OpHT^R}#Hu!}56x$N_Ezs1Q(}M8>>qO*+6aU3%T&PE&Z*|h zYSMKl#qi4yZzo(- zZYKPvgr}WXQGA(Lw5n<6J+@2rY+XEQkWhPZ@!9Y0+mEwJC7NtrLm4Ks?PN5<~FB~_P{Q!sI4s*GPP@;VuhZAqH{J@1UMt+vF~Wd zx!fv?Zsn0{CsDyAH#9)A%A;GNJV(>POMmIg@SGFpRC$}b^odEGkueWc&^ps=bM`2L zr=7cP0Rr@T)9l2YxYJINjXZ+urYAY^k(9^sd662o(GFB%=|&uENVs>eWXc<4JSh9- z65Q7RD&)>aynOBIoL|=9oo}C5@te2KV|y6y4`76^`y#_C$YW*)J8oEp4Si zBk6c!VBO))nqxYOwPYDB&fSKl-AT{kvVohJ9rhA03!+1JFVYiPAJKjXV}&F7OPk$a z+8pEpVU7{3*WHAzh0Wm^;HcQboAU0Ic#}hlOh$RCvny6OIw;Ob&qil&n*`iyOqDI0 zO_{>1BAE#&z2esI6V6AH`I$8BP6;+LV!KJ7HiuuaLZx3=k#Ywu9 zP^Rm)TPyD7=XBmiDk*=oG?5~eKVQq(V#>I|l!0fC-={grT5*Mzact=_&N5}3%SE5W zoK$s(_-|P`fiQOzR!PpR+47#uiX#c|=ge$lZ9IymJ1CU5$qy9KFW_Q=?T`_h|~I221u0p$ajdpsJudZD4B}VlBCJ6*n(C zg4o?*ncpYY-;MZN6;V60vau!In0t397Phs0{tdBNllR33}`6iBzxF94}^j~rbc#(ykw0o#+)hYNHI z(DNq8$`JY*kmmSJ2)ziTx~)P84M*bDbSH(-G$4Ia{h|=ME{we^gyc|I(>)wQ&xNsl zAyiGWEeEviy^LCBS~Za7y(EmiE{x5Dv3G~DzXDQB{x*!=9>%^K#+I>d(UKrs<@}caivruR(a$E?V6G9h<&`*Gbj$)C` zK-U{+dkD$9^Ea8W$`CpYNPNg}5)?xFsX=nDPZC8ECmW)t_to^~Fx5A>fUEIV{0$3| zImRt}vK);d*>UXHAdHJ+anb8=Mz*Xt#nspWX{dS#wxit6u4=n`H~qS)OwC6l&(J zmdjPmU4)Cuz&A;eYsO;M^>%Rd({v`8AC%0_b4D#{kS$6JwqhShJO4;l{|PFjY*`kw z#}`UQ~i_zxE zv^M3uV;%wp;3N+zq5T zehQ=u=IcPZ{K=WFE|YTjrOR3zNEay^NEfLe0%>_YKw92gKx&mII_8mP$^JNy#$Fpj zp950u`LQscS4>OAo$cQY^nIWn1IZI-e>TwHfb>*ZjHdNe`5$4r_kfB{mBl%UvY^X1 z$;qL1LfNPP$^~Nk_2a8-2a;~joSEAV!yH1R{5>~5eD-IWX6vuiYPE>Lg*T7x3Tc#j z1@pQ6NW(jZO5S&%J;Q%=`>z#dPw?KQ#(i0tHVM^?->ham2z`KdMOJgSEt=cf$0@Zt z;tBj%;|At+;aO{lWL@a6J6oDK*U!SWd; zN-Q}6&3y4h+4H^_*QBdRY7PKb1C*%k#r?)KXurf1W;k2xIx=<=C8~J3G|sP8zf+>T z{b?j9&&1>&u9Df#+1~s2!8G8pkI;6V(=|ZiPB0dU1L^E;0`km^l0NE;5?a<7_3beB zULc)OzXH+;^cawG0UKKU4Wm9QT{oOgL$M!u^(P?lC?w3w7N2v+bT9 zU;bBKiAPY_N)*fedKugh0ao)+M#PpY^)Kt)-YRQkQxi!rIbOj39R3^mujgN`{mPYJ zXZFN-xjki>!>#)_<$8x$&2rvm6saPSiLW`Xahda1bNPKrrICl8GZl#-6o?J$s;Gx0 zIC%e7yl*-q4%)RT0+X{^UX~2JoGZ_aU^E<_6kE-ogr^&^#hFs?y(h^;Tv|bC!4MwW zKZJ~*u8xDPnEh90e?rEM<*#=J#k}ua^s79~RB4I9SCxN} zBDj}^ICX~KJydOCXE~)R<(>|vd}+EN%)(A4xcx5t`(O}*pBL{^gP>#Nx^c5e&O38@ zRROfPO4-l%T~N7BxPtBE=0IMdT%MD7?;0{4Ku-iAUPDo3r!B^YIDKa*8tMn&+1IlEJS^1lRs z&s|spY__cgvMnSHS$t1&pzX_b%Uhj*XLYKsIVQk5$;HreyVY{E;7#I>T z=ljM@fja~0D*g%C7XPdn_!ExUA8XXGSoG)%umdIdiL_iLWLaTVrWSt@H!w+K-2XuV zgL)?xkv;Q51C_cwsp&S6PS-{;R1g#0SR}@$)*(KSG)!2+Qd6E>nbfsbOm=mxmCKV_ zTOLTula)AYa>%pBTAr{YZS#d8bXN#H0Hh^%0BOnHKw9q>AT7C+e6O{A9X@)SsrN~s zTMT5e3^yC-XrSc=`X~^a4*EL-Nb8*ir1f3~q@`RJ#x4kBMLyD!ZwD%pEy6|Knt-hY zFJZCJ^GNFDjr|L~EbuIzD1`pqD&IiMbd?W;hkB#FNjdEe$Pd_-sx5GXD8Zzls<_ca z1=n(r73weFbTXx!2=@1p6_&sLRR%k-I!ZbD2tOO#`((9FSoiO>yIOXTQ~n+#2)n~R z7WJd(Dl!GvqY^Fcw(|_9JxfnOe!&qAF|dpL4Qn0{M;Yh>0!`f6^4rQ?$JoVpb;>fH zy+$mc2{jWnFZI~&m!$#9dxbsSLvrU^V4Nkt%GYD3*sQM%_|K)Zd4*pGYDMgG$ z0<_xhD zAA8K9`0Xv^!|!^3A=!t#O9}5Ue`kx3E(^1oc3oMqChC|V^7PPIA;y-eT-Pf6F_2sD zBDjRy`aHygq*^5B74U7fm5C_p28O#N(&NRjFW5T$L{(d%q)7$pzLE^GUHc2_|=Tfl&d&JY-Iwi7}HuGo!f8vL`QYbKG6P z#zb1Zk{HwKCMkAvGG9MG>DWut&JQIZ?yPC!%XWtJ*O&PiB3|G5m4)L=wlNR_{OxOmXY6CqEbb^6SrXN~I8c4&&!A$?l zv}z@gu87|T()IElAYCti8m2p!#Xw_|KpNW!qQw>eeWuH96?mD-Mw6u&HsQ>TfMPuA;R1b@(WDl5*MZO56 zqaj>XN8_$A_J=@4qY>X%;c2^{Wu@)oz|B2^H-sw9o*~dO@j_QWf0AP!NA{2@XP0RH zxn^@Z&*dRHQVF$ z5$aP-sb?Zz+>dkm?Cb!pP;HRRp6J%?by4O^x!(wDg`ptl1$);ssc7f4eC((Mwrvka z{a(bI-mO}E)V$THx@R&|X5>eVnrf|09TH9UZIqZL+Y{E>&2;9`MK7eIPp7J%P3Av7 zx^VEk)!MJj=yR>LMPt(#{LX zUC*SWJo7q&X7x31%N#FL8yE2T4dX6Uk`X;N47wro!!MvdpxKGn46 zU~Dh21x{CQl{;)z7!szPEvBNvSA;b88X~$5=Aej={$$xy^))6UOiu5a{`DLTSdvj`0(7A--?!1d7|WuqbS3AEcAM`75Cot4}W zj5n$`+sTWxbyn4qQQ;AtwYEKJeXn!j5p*M(skhdi8@2m3Ci|W^t7`Ep1s*hiw(zm{ z=UCD;?>Q=FEcKQ|=t=9P;39rYJEE^FvzgBf7RfnW=&HCsOXlK1L$S9$Tu{R0i~h98 z4&{;cA_H@@>f{A!g^vZu8y6`Y8^9Hj!Vv*HCQ>*!fGe4&215la#1F=~AOqUuse|6( znH_vqWnROxS<1Obux~ZXs=!T!zM{e5?q5@H)sjOwvtSyvrwxMbx{aAnQ&7V&Fl-Vm ze!1{kvbrmkj}61Z3?=QCWps^stU;7cxAtV;?=w>%hzcGl%eWdZeHc&kJ9ALeZF?tXUrsLn zm#{x8CtjB0>jhzUKHX!qvub*VuZ0tPBCa8ECbKP$A?n$q2qt7x%ZAk4xRy)l{?5hB zdG-a3lpKs0HgG-2^eNr*7+$~*X&PtUdufhHm2l>%+xg$=C1oDwFVJV$a-F<3vC~>R z8NXhc%6Y4Ey|-pQA{P67k8{kd;n~+%1eZT7bANywmdx!vW+6IMkqE425v31!=6g}x zV+B~v=X+?MdUFgk(C2nGpDLl;-`guFTo|YOX0PP3oKf8-0uQ`8QAwrp*&ZDO6pSo? z!JVbf25Qm~ICKaD`#!^3nRr{)krR(m9Z ztoG<)AT8zEF!shUHVdTXsn8;V)w-&RK*>@4aIi9=P?7tKR!g%CO`dFg^hgbl(5ba#zFrj{XbbMMlhXI9H26ehMfZ}~-q zrzqLqd2%sZw{)3O4z*fjkL9IlwZgzn(&i+9xP-Lm0zmtGs zMs_&^XqpMT80bO+iRp!I(b|COj68F982e`+m6Sfr2pz1Y2xRh#!G+SK4W#KBfpnI+ zK*LOq?*M6zdx12EQ4X6}aW14ey25mihv~$ZgO(x=k2KwDK+{bNbjybBQ?G;in>EXJ zadpl8$t(2fm-msZUoc}eh@#*CBx^m-GgWOm7Gxz10xtm4UC^~a+VvZOwCmY0b{UX% zX;80F7=GZ6D4Lyuu-D*zYGQ-)>hf1bc3IvPiM-d>@#d&p-(l9upHm7_yFZ1m91xv7lk_1mY4K~9n_L&L{dx*B zDfgDf!l$$)R`V3FRbry<-x^OIW_@UMQL#r2_%)*V7xwT7N!WCXN0nRZgHyd!{wAC) z^>I(=&14iM;$%5J%W!lvof{#KA(zZ!cQGV;1y2AOZJaw99dp{}RD=oF`)^tx)^zR# zD8naDB3`8w6DcB2I{L2}`SBC*hc+x-_YbS}2*{P&5j!{@-0mGtm#MCb6xF0CBZb(I zSu2I%i$9(_uz?ZHA9Bj{%6R#f>}ULgc_ZD(F%sJue+%WkO400NRm-_^x#)zWJYMN8 zmy;~W2fk$v*k%9hTcIs4(!JS^NvK9GN0#x+q_qs`g3WSfUKzKJJ z5UeKq2!w{LDa!A6se}e z!A&z*YKz%Ly7x#PW68%vz_=nf$}^7sg!a?!X=0=CT~7pf+dV~Avs+7WpZ(VlpXeWw z7*7tI{1WDtD50dN_>jbS57D6aWd>T=9S4-uNPX8kT?OXznedLx$t7ek+h8B}cg%e5jGp>Vc*iiR-ICD&#x>^jQ-o$kb^(8AzqXD+MyK zVt=YcdPA5_ZhR<_{#Tezye?}xIn2;f?h4cW38=!fWrxI?l6L`Vj=f>*K}={ZSzari zZqga@$J`b@ZRV7uTVKu!n?V!F_vTD(Dj%QU758mXk_#H#B#wxX1JLb`OS$J&7RF+& zQeivYnj!ndIx54r3!2iDa~`%K=OJEvp^2~t#}Oeq)+`(rphN9-jNZ7) z-}TI;EL{rz3rGz<23vS!@+y^d108Fyq*M~1rBBctIeW}U&_#|v`xN;ab@pj|Wk0lT zI57-O)#aPk87WsmxNQ(Bn`uoT+pr`0iLl?-mX^;opAquHg1l%U-o)&#PA(Jn6<7YU zR=!OuA5IE$-RDsNlplSCjU%bzbEb-q{r^+hErV4i*6eQ7wz>n-zqsgmV|-dd?#HAY zIbs-Mtv$GTbM{D7$SBaVZ{cCW*;u=|fCo`N%i6tRC_pOl50Y7plXO1G!BF^ghVDcM zdj4CsK)lO#Y#)NNl6uoj)MP^;CJhj{xHRswR*5Pk9o+?UQ9h7Twt?cZFs`9| z+(^*YfB2Q`L-X6oS;(RrP$GYDs&)UkOXek7wk`G2`T1oaJ#8hoCv$&&57!Fm>eqQf zxopX!Gp`jz4O`ZUH*3fBFyRV@e%JnP+z%Pl}3y z@j-8lPx-(ImaAkjgGPJ(PkyX__O6%gCttJk)3~kuc0BM&|6}qB7ZhVyvn$L`-kZu# z#}Odgcf)Xq^*vT_W;pK1G*`NtSCWfgnIofVJX;yZYW%$Q$RYlC#XDY!#dELJB%FW7 zJKl&ThW|O9`x|4oC*DywXlj1kuj9E_KLL4sd`v@IE#H~L8Sk5;K;uR?v|TbpfFl7= zc6Y>*xs7G1x~H>Eg{9_Hcc2fdgtIjc8HY7mYhx7+Z9GV`cFgFu^P;~xyKuUngvBD> z?!};^Sfc#Vc+)GNFpcsvP~|56C38H=DdCu3wVgMlGhTMKG(l!F7d^m}&em`&J;D8{ z{40xJ0rW95cHd`IG)$Q|ya>;PZk%oJlQ5UdlYKowM6qwZV%T=$c#czM0P7NAfo=8U zRKdAz`NHwC{#S3oB~g|2#rCB0NVvzl!G(Gm&!6{ z*t?#qeJVUDqR(X2;P z>pHR<4ELi;Rf}S96x_*EUk}G3PZ=HVxmHDN6d$Qk6_c%sF%{OuTlj9M0O&Z^8aZYp z9}Oe1H`rK}s@sy?lB(;@{EX$lGQ;Z5ag!9*o63)grt{<2LwtP5KE_H(cibfVlyPU+ z&bT_`?5M6cTc8lDkJczd|B zy{em2zW#&s|N)V~*n-hC&{odQz8j9t(#?aPjvRzn3 zzS31+{$l13S{%rkL7NxS=C{*z&o6mJ+Pr(=pR~>ALSucI(|9r&vSXc)+iUXpqBcH> zAOWVo>wj+Tv^(wL;y0@EkR(mP;C-^}up-LI`agM}ftXVj7tf*rus zBfhG-Zgy+v+WyAkj=MpU$trCO+#1{sO~CP;U09jQsi50h#b-RX7hBT55+eebjp)wz z9UZyfO5zB!z5EfYr4x|BQ;7zjFqAH|r!`1A{|cZls6mbo$aWwYQ}4UTNL>E;D(%rc z5*yF8zXOkouZae({-BC&6q|b&JIZgfweSu-I_SnIDK6K0l(lj!Qho`s=vkQ$&LGDZ z4@!*p*2;5e z^n+%@lRq>ieGV_^)3Bk|3K34k1wESf3Wn+SC?7W=;$K+?aBa-aPaVqjc5LSU&hfjr zpxGXt6LK6cPGrL0?i5a~+cT5m9e=Hecf4Ae82)C*E9DKt_cRQD1>Y=N8}QA7uC~XW z#SStvz6OQu1o6jE1?JghZuz%kRRVe9GhtBV8E*>Sim|ethu-_v%f{M}f~+4_v*;dd zXDJfK?5dQr6sdnzImomfo0~8s1$2Xua-3Ysg+gY%Z6%OMS~ckqB@5X&DnW`15uaj3 zc^BbjKL|CuIJakL=5t7Kc%i(NB!wF>L!2bI8f$pqZsXt-2b%19q;0*%Zontp5*;T= ziH=K*=Tr(k47FNDP+wQ;oJn+-KYZ12h2Q-3PXqj3ib9S*JHO$FACL0l$5#z1f|ns> zW=MiyW)xHWPZ8j}qp9uRj$YHfP2_*C$X%}9zV-dr&FkM070trn5*rRRvX!|FKc$37 zh7F3W8iu`qz%3=vQ%o1?98C%0<|7BRRCta2snY*KBAFExOIWr-wh<&LQPKX&`NEPS zhYsCRy38*&a5BZ1Pa|bM*V!AGu(@# z;$zA`;1?PzK%euv>Mx5%y&gc44zX4|1H{yi^6Q|5rvz+)HV-*)9x%a7FVSZo$ej1C zCSmP1DjaF8c!({Owf17Eezev4KcJ)Ie-ayR63w&TY=6hPy>$m8 zF5f-=_ZI)V-Tz+Wf8WJ7vnArs44o|_7|aIuUWwzJu`F|D%3V8&sbU_(D{Y9FbpE}M@G|p<7AfuozBE3B*=MAEVTPrRaBP9>Dy7Tt%+HG;M zlZ>S5Iu?~Ton^5{x#MAJh_&K%nwRT6#AO59De%SeoVX3@}-K!>~o^-I;gz3`wJ`H80#Sk?cGVO;GtaU|bz zqpT=yd8!sy4)w!QwOj4s-S{syp{ptcQOL7w>&4x!T!r-)Q>Rtqz-INKBw`zE-YYc& zfIl^f)jP3nqJ1!2c>iRdC}>=GsXH}lb?16_v+2q=9;7{?Bj+~VI%#MmbEZy0=$Lti zeov^@SG&ZGPM;whL?~-shU_&6U&RB=)x?;Zd-fgc%;TN)mq!cT57H%gcUQ9d#f8@g zi2^^TkWl7gYps1n(_7I7=k2DquN1LU)PX|C!4iUeB!^+{l=(QVjJp?I$Yvo~-I0tw znXG#@ZB6cIsNNKPI__L?Vai!6!lt(h9de1~#*^U~Ojz`eG6OZMTg)_$kt1>c;6J{8 z99_`S5R!j@6U8ngMAOcQ!J8+ijPBHN!bG+!6R8p=g4iSMk+q6-N@tXm@Ld*^fUDet zcxh(RHyFfF2gWe8bNbh}#cL**-n;hfWZe^s>w{k5$IpwO?zG5UYtRnxya z)yBcssNHFdA)@$u>~`%7ZMSj0I3>g^UET$|oYCn>RzGLZxq0#QpoXIdui?U^d-44E zy6sfMg7EoXl!Dgs}CMbg)Q57B?8U*@~~za2|tKB61cju)8K#2{zW#jUbCN znL8IyhrFAGT}>6L?T{YSVVK)mPkWrnDS3ObikwyCo!rD8%y4pjXX^-leA1nq5)wWX7{eX`M;Z{{ zyH4xj2AnP6Sir7UK@Nq%Lhh8@Axnv`gDcRoke3+8=#xM!-D~*;NV9R`C5?0@vsVy2 z(Ci=t$?n@GGVgbUE0_rum$4WPEl9a$FdN)eDXCHSKF{}^SMP~@UMxKLg2S*S!~Hiw z3-w7A5X!S*(24HUa_Ntt6*e{^bGSQogaim`2&mvqc+*@tXe_n;e4&V==p&_TIOZ@Y zQM6v>u96DkPB$vL%7!+BU;TypxAidM+J0`y=c)=m=XDvZGdEjD^E1-cI)<++AIBagPbUg>|JxiGNa!-TCg%MT2I%7Cj#05`MIh~g zVVTwgS*yIJV1~+Tlw65kr?pWMxv*lMy~gipL>;s0TK^^Eob}F*cr)wtu^=_bJu1lk z58>Vil3T912Q2+5V2I~vYsE<*FV}m7)p9%l<2H3DA2Sc(n(U!>fla=Lt})+5FZ)<6 z;)ya~VXJAr40MzKy}Vjc_HWo0J&CM`Mo6P)cs|?uI@wCGt^cO%|7UDVP~uGX+154u2-wzK zV4rPWXF$WYZZM!>TQ>u;mFLrETavqIjts`OmX|Br8VBzFZ)~erV{jK0%AfEuqq^@mP~rjC z537;Y{z0=-BtfwF*)4cSJES7wR0q%WpSHS8CE?IvtFcKL<*cmkWK%AH4h*1S(!6z!R?=Xw{t_ z&w8z-fGm<7BO{Vspk>yv_TEJ&WX@AsQ>JCIC`eWP_(nQvc^Svk-g~_yEyqLos@H{s za{S_p!&~4HV7Z8+WHPu;Ds1et#@}=9GGCmAunjyaya{q5f7;f8_U1bZo9>oa( z0~Ud~gE`3}_aCUjph-fM7`cPRac~ zi@>cUWpbU1lxnabh`NrhvWu@NQg|m_^AoMWl$vDzA{5lVx_d~x5ASHFlS6B!;!xHQ zi^0Lk$`I_JQ}I8Ls2F^0gNWUJ?>k!s2bZ}iq@9|y81ctTgZ7b7 zWrw9)P3DgL!PUe-dOth{C@gXqi1#%%#<+4)ZdUYmk&5XK9`m-DqbIASg)+S_^O5YD zQp4B(dPvM;BZ=m}WY1BtjBRM7Gx78_Xk?tkA42*`1oh*MvU3E6;0oa~xybBg+ zJ^DAr>feGa1FTeM6YyQ=G8TCe=xj8!vB=+m>J79L=pGaMLGbn?e#IgSfJRbvEF#J| z%`0~v)cg4HA@nn#DW;TrA(C1Hkts5qKE)yxK(gD7MH+$BA@-#}lTEs-fV2g-167be z7WpcW;4~Kb7`1=gq`MkO>-_=H87Axrpy?)^c&69b6GCV@0)n=FG0;nhp|Qv}fc|2j zhk;%-(3J>mT8cbcuZPAlBx(&igESf@rtULMy}t&!%+$LBNYjabc7?tLbiPUVTcFbo z)D0vjSh2_=5dSMZN+w)Igm;`y?~n39hf7sMKyfH=01#dab^e)gNb+eANtGd(nU``8Mh_Z;9`UykvraG?KFaz*6v zd0rk59^uG5RTyfRNMJH%JV=~CLY<*0Af1i#fOIy7?d!MQ3`{_|H--i2GxBzjZ+L>c zQe!V7@7~+;9soz=n5~_|h3h6t3~u-=H8*4Yrvc!?oelm?P* z4xsQ{zy*L!25f1PnkEcgt-n_5ue2-nlT!S|*1eK_LSLTr@tCQ4P>zCeEj>Xoz5HS6o-Rd($o8wTaD)(Y z_*Q7};=}!{c-yH4jmWmlMb0KnziTot@7peO^wHlk1X?#Qy-|IT`e^p_q{W0=YdNnH z1-N$!&3sS{NxYeSG>}Ib+RPBTG=%1c(1H-UC4^c-=nEnA%@F!Q2>mLAej7s4R;~A$ z5c*399Ruo=zU86!`Gm(Jj{$WUNK7g;te@t6v+Cuq%MIgz>anY0mxMb&h#s$~LXdWT zSxx*mbiA)Ha^7mBh<=xLnaev9_-5su*Cwh7j`qx^s)+@arE61eQ5R@Cc1D3R9Lfr$;SsJpCR$vsaUpggA{$#fcOzw_E1wc zE(qJnr&O;cY|ETD&$=m5gNT_vP4sAM=)36A+Rb;d9<5pCKK?gS`MEW<+X}}N(afDiOPguBsMG0W zy)@b1dcs_GZB2~*OT!`e2p95BByRArKY6z1ca= zeUqsny(XZIl=Eic`*;X!C%nX6G*wOwau*Hn#nRvq&6y+R)QiI~@0}kD5e4MI2Bn8v zXfnMA$oFDE`Ip@7V;Bb0^V?=&uKZ!&>NoOa`%AGzq$6IwxuGpJbPc|8?5k&v!SHw4 z$6)t~HS3XhBTc*G%Z9G62jWPrA@R%j`pwd!rr!9n4e|9`fD3B{D}flH6Adcyi36f- zxq@HbT1=v*l3edv$%O*-ov;{4*_mve6j~p~J{g9+6+%K9${tS+p=*J(2@%#tlsI8dpgI4=sYb%;)NkJ$U3o=$o_RAZF3MdiMt!- z9ZJ{mQ(pPZ&s|gapg3NteM5W;t>G;g+|Iwm8+4`zH1@Ndi8YwC>|7+z*4Vr)%-ng$ z-UTCki~Bp=4>acT&{b>*mu3&h!-?C-zrY+d*)`GWp`)ReKw=QjP1HnQ}vbeq3W zcBzB9_BqLWS??xsHZ-LB6Ae}q?|Vy#&>>fkT0TGVW>%E z^cF&n1Nhnn1n6v+mg!vE4Wu*iqHx}K18MA=K$=6Yvg>S@M{0C-4saZ@{Pl7Y_me+H z6tXeE$JY+3;C$Giknak9%5MplZ#IVJyUPFW^}px%-|{7kQKmfEl`uby=Vv=Vs}j?W zDo`D`+>IN?Agt3kc;H=4?AUDn8}WhDiS^NP67|SJh=e6|20$Jmcx5ND#%a8Ry5I=%ujh6dLFv)DtD^IMTq>B zqj|fU;2Cf50_Vc%sr>jd9>u>eptdEZIfkf$0|s)0jhU^DX#^>=;Xiiq+4&dyA2!WiBS$^{ zAy1=R8^6HsV+DPj<5Q{lnOim|l9@b6ob}~)>X-wn7OVsp zz>~2~x<1Esd1xjGG=vKn>n|-3WG_rR;?u?{WatP-w539beUyq)&dRp zZwUWOI*DPVJFAAp-H&s57q7jXmku%RNG#x+1%FwjaFyR7%IW7VI!g+PK|5=zDttJM zlL;lc<=bzDZ;#?*p=BGK;_CESMxs}7-f#+;r4msui(;Rwi0>*3L2G6;e`OEFUY(vG zk*`W5@|MwD+(txLxo#-lDtbI)wL8f|qA+KuTSG@qE*D4SPBxAoQ(Ojtj4qSsIH_=> zX)_pYdk+++uFlp6#CmnTOqKccEu=C*{F@{bS?cO#l)~iz6#~te^q43t?jIPp`7U@f0W4-rx!-UMwo%K~QtK|VA3`Kra zP@U+;)>?q^`I%D9| zqxTESE)>z1+F;i#GPnz<<___@71o!y6WYNY%;t^Rxgk>aTY$Y|1WhH{C@)_y$Af;; zPOIfjLC<~&*&%dZTndXco^M3tGW{(sLv{>iE4|8Fv@By_IV9A#H|ya_uONWG*afz(S%Bar45UCcz2j?31*KjWQ1)h6st0*Rd}$d8Yzt-c3N4n6PKUu=m;Yv)|#SD)$@Z0>7-mXdz^O za2JR^VA{sxch2kq9F}dr{91{f_d+}hkoluH- z6D7lOqGafbuN!YdgiD)9S$}>^kZiW?x)&E+n#_+m2c;-w2`?8_L;oiG%SOrY`BZ)m zo9xHJO}1Ufve+Y=>_2TzibD$?Gq=l@UuUt&m7HaiAKI(Gx0E3%O34*F=+M>Y*Z;B!CWyQ zG#y19@h;qTP2hq!?Y!w@$;yo-g<#5d_S(B%2r#v;Qsz{Huai_M^Y}n~p_D=KoW?`? zt``a)C|0KW!K^UH5!bJ(L1{!U`qeeN3L}hCMRn|JRFM>4cdQxUm;A*k9OPg7!F^q# zy1;+8=-FLC9iDMv^j;MR{!eytIzpmv;Kkxb)TdUnSVol4+v?&sh~Cx|!?0yP=gFdD zWbKCqK<}hle-Uu1OdX65+agX>=u2?fvVfJ)vc?j%medv-Tc4CWw_eUyk90akMr4j~ zu~j8Sydj!hsB~|@F0>@Z5SI<^!~XoZ@Q^_HL>3XQbzm_AZ4|(3}}uY0WCJ^eh#F0Uk1_z*#puA zc?Xcz`>!xI#*(J7hX849qk(imz5wWUQ?fiGa6h?t!~jSYNn=>Fw2q^Jv=mtcHOC1+ zTFQK&6{eJ>K$=60T{K5)7;D%x3S)6qFvLGQZ_mt1xg+CEXVhd<>HIX_xf-7A>&9PN z=Ipe!VQl?cOaiwp{U98VcORZk*KNukmySM3s&w@hQq{JLO1Qy!vA*fm+j#?#bT9CJ z#-f-6<67m?A@xmtLl(AY-^4*pIRWRFrH4OVzqYLKGhH-{DS|X;l;5DIGMDlsO4BEX zWY16KucSR=lYNh*oKcy{No&I?zs6VW&ZWm$Yq#0?vp$%rdv?jhWE6J@WATCzcWUiu zZL%5?9mUDS=(w{p-t@QIc*PT&@`CR<&H+s2 zH_YdYLuu68ZmTV^T*kFlik(s5SuVW7kEp!e8d(!~LBUj;^w4Ca|5&=oNUc6Mi?3t# zN0vp5jQDK6b+%L?T>CDfm~~nRWECkKWphhQqTSXuzPy_#ItY@pc$RdudGZ;E^6K&` zWSVV6$?chzJ>)F0WNj0nT}|8u8tm4#`?exh%ctnPcM(LJ+b{>R$NN&8kP-zJ_AAg_ zGS+@U-qIcERc_rn%8F!To%L5lyPC`oe(NckY{JS7TEvOGHFCiM{^#)D$bUWmHT+lc z&+9xjG~W!ak1eMhe3_=;^92TXfw`H+Dt161u3X^>$jqA20kE z91E;1rGuO!#Mh7Jo9lwI&q{37K@&@wh7!F$5Oj)^>YsOl<;a$A?TF95*c+J8o=nA$QYz9GNQDDSC^H-ii{|A z-)1f^D8eDHNa2iPNn+if_9G=iO^xpduohKK<3`y9jUk3UZ&fd7uhl9CyCpjI{C+ir#Lyq#i@ko;)~n&v3@P zMNX6gF5B{w^g*;mv$g~T-Fz+gT|A+T$!^1OXhrFx%vSEzKfs7YtjQa3`83%4=&u(B zY_g~+V0LBUHovS~Z~5ZzcH=0gok6M(h}ONV1BSe_r0`cvYic0vErK$Og+DZ~s)-J~ zOM2�>^9OzNfLj2GTZf2xEU2#-79)ahK_l ztiVmClzV}`Wx~q&%$YFp;wPJxSmZJw$ArBBB)laSxrC|kT@yAR==%ox36RR3_W`Nw z`CA~BQ3nyM=8Ir8XP$LCLnVhHBBEoqAkUGxpIzWit%3lp=5;h(sCXye3Fl$<{>Ysi zA~3EtO69{0W``AjT`=f}lzn?~DRQzsA*$=zO#__%Cqc8+YZR}d2CxV+=lp<-@e zYVM>BiC z|5dLAeo;2VB&KE8|B>*6`Tuke0g`B8J0H{T;@9IuKSo*9vKRkld%OAny}f*+h_K0A zd#}|p*_5;Qk$KjFj=vMz0nj~5liv2IUEOVWyficwmG{Uii)=Q_F4^IZj6R*)gqOOG zD!dA2-{9zHJNOZk5jhIm9q+psrT)|jM#kGK=yaym*j6K@~KHt>G-+UmpPdr z%y|nW^K8u2nwZS5Z-aPDemY(mik@p9m6{|+4mbxnfE-0tO?StfGu3T4r`*sAtI|0d zjk_V+xtKf`o>OT(;_z!grVG!hkX)5vu1blY+;rw6Kr=$ja`j-yU;JIz49)6BWI7N zG}Z>lSnVqMeRO5cC5o7c(_J{d_b`*avKmWidYxeyW$6B<^=x}&S+Cx9NM^jKs$&?-~P z05h7v7qnR)7^(#ec;%|MaAFaMC@tEznvi#SiP?hEP7vz(LWkRE&<<$NOLplCJBWmtf zkT1ud=8hHb#1B%LQNf8+h)!lgD8~c%C{fn_;(1V(#29NgP&{nOr$yX5qeLP5OW;8v65~Bi^~Iu}Z-Edr-PbLe zq~9ayWcRX<#H>d{EZ~Qa&N#%Ne94}Mpe)S%j`m#lL50)azg+1@VTLcwo=qu{!oJe% ztsUhhdRB~T-*p|uagzA(qyf|K6BH}%&k(wRR1}n>2o(jzxL>EFShT9J_cV}-g4@E_ zm&4e1fK(LR6UGintKFhH#1ofgY~}BU+*hf?<-mFD`ou+3t;gq(nxSKB~>O>&!oGPKrJk6YCS6s zCnJL_I#%=jB%!$al)J=ER&&ilcbSSRUfq;+XA&HIuyyA)qKJ`oXORzj4PMBQm8C<0=QwsEF;E!=b_KVqW;3T{umNZ*n%CXAgTO~3+((93^p*N>bDe?O@bJ6$rpo$C5@cwsbWzUxf6%VS<&B9?mUbo zu2`CK=FP@uFS@G}DLUa!93QtHv-6W#?6zAgWW`SBZynES_pjlZ>2bKWSW^EB&6PZc zw^DTX=G+-Y!$S=U4r5$~Ehp0CLIDn3jzsLfOw<~{sooM1m2y; zJFYXkva^0%#Ccw<@+iN*9p}c-oQbpaR+&}a9ni07&NZevc=nT~OwW&7j8GnnI}PJ1 zO#Ucd=-YAMNGjBGw!>>PjH{h*jG5eW6U%s^m|Rty+#;B?@WP_ByQxysvL0MC8+vXQ zuLX<%+eGaoPP=r^*9+~s7mPQf(DIc3o&)&A_gl)PTOBX6ao8NFR@3=QW1MGMD>qPH z!X1VG?J3TMZubi;>y!O3%WE9VQJsk`E*HULTYzx5|R8^gcXC z#oj^64a*etdz<(uW*>t}t^xai_q8-jt~?(;e_;psfb_xenE`FSR8q>^eBbgFTX!Bv z(g8Kd>SEqzo1PzW5;9D=%;>u37N-Vln|B(meBY*o*!iZEeGeZEF5Ib+Mf0NBZevXR z8pE07eTf`4rgdAv&61<-DAw;YSRGL33y0uftL{0g^~e%v@+--nS(sX4^i&cDHWjm80@A&T+|ks%%48tjtBAF@ z?l(knu6va$!dMaJHC9-s?p1CJV_U*ld1+X8MyD|^b-z&$r27pyIMUb@knT(V0i>#o zYla3Y@3lZ*H^Se$K;JXad3@?#B@3h_iR|<6twXC2OW}qmAlu6Qge4J8Lkabnq zMO|E7MOHCTDM<^R03rchEngZ~(2P^1_{S2UlK=0V^E}T?l9{%w*Y#fSb-iz{cIM3e zaqjPP&VBB4pF2{#iW#b97fbw9^~KKsYV0~H_ve8=p-VKP#k(Z8cMf8Wze{Q$AmUfK z2DaTRLrP0)WHWM9ZO0@rrT6ZUteOJM-y*3agd}y9W36aJ6nh3m>Etiz4*w%Sw<+WT z-J;OH0ofe;E|ASJxzKJo#I>-^vC4a=ysd;)-#&6>M(jH`*Kf{D#anRp+IpO4f2Aib z8kRYvsK5F+|9K9^BlE$r?SV`N_WPxH%c!$Lv@4=KdZb40RSu!4SRkm4Vukb}nr@1R z4+B}_76V!1MA2eRx*VuNEm7$rg%)blXy8-Uz*c!#4;~<|QbX#S+0@N09pazO1hhWn z1gQI~a{}sUkKeHzn9)L_gCNI$Agkhnuhc=G9&>n~MaoY$XdS44&#Ksm>I6lCM$BO3<(ZdZ3)<4`* z(x&U2F^QgiC^a~(Y$4c_QhUGfPuGJ zS6sQ81ikdK5fUfY4h>5QT^|?vbpjDP^=;5Pk*kB(LwP#X_vMzY5Q>ZU& zGs$m_mgi~D$JLYMoTmcqzS`1!jSO1;_}ZO2w)_&?>gt6T)sOzL`4L%d6k<%0`(J)z?}h!RXKImeA< zf5VU9^wm}uvrzm$YNxf;4FvrbOnVeaNC5Xx%LMK-asvRdj??*cY|^Ik%^cNh#oIT^ zP%Mab_7j~%+jeCRw@#Cz**7Mo_s_mDB|WkIjU!`SVuMEPzOfruz#ZF(e1A~A&hrR~ zKkyQtenC4rkZ{}QDFq*Qy!Mm zfh|qVbJNL@2crlo%Y(7`r$!Xd6Rs?!ybn)LcyT1iKCH$k@|xU5=`DO-oaq-7nMd1K zUo~PX>kw%`u9+I$5{-OM;E`g%*62yK zx@qjZWvvJahEpo`>BT|jakarN?l1aaF%Mv)-bnEQg%o~xOAo4hXV#k{W!}EIqd&8- zDvHP0+SeFB+e1{YTfb(-^QA&t6S4^83eRA?TPVGj?yC5M=!5l2Px=TRxJ(~Xwcw9X zaB}!zY+1@xmwF?pxtry+8|wW{-sx+96V>&L%w4!wg%+opqQ4B#7`C5A<)*;9I^6Y2FhFWc!yG!ULgJ0lA z893)W74Htwx!LI=@YERaqBH9a5$td86`%il#$H`stJ2;hr3ICu3xb4@PZ6*J7F;2^ zq>omyB~>N>K4Xk^zK>;IJc$pH6wZuIy&6OKt1*N>l^w-wkn+f&--_0mfQM;=S{qs6 zCbPFrkNs4q(F(V9pE9BLDL_$tI9HoFw^Ym=X8eM`W!oyLD%E6>&P5a6Ud`73ujceRk#vl|WV zF)Xgk5x#(#!Bq;za^$b86(vnTO48;#rv^a6A* z8YuwT1u9`i4{Pi`RO=|zPtnLhKo)xj(6i8Dykh}v)^vK`S=0TNFgwJZ2v#%8eK*iT za7H8N1N}mCTnHrlqiEzyKu>Cz=&v5vumd18=Gbl|vTDR1RMN zvK%)7new3*$ZGHk(12o|&T9T2g-!&Tsy*~^ptm&41$thg?*lbx?5}{{*03Uw<#;!A z=r0;J8_2>kK-)F!P9Q7e0if#?%b$Vjv_+FiW0;Qwvb$uIty#@+^eS)dOrfZ%qJXBc z-KE_^bf>N5O!kanPW=2GIp*_oc*bftHSrI^cSRMVH+<$weqSZpHCuj&dO{9ZTHGt5 z9FXChU(*<7|AE|8tmTpL9LFrExC0{D10uzdb#~Jir84%QdRrZL^|}O8+pGcYpFa*t zEUZsYaAoOQI*?D1ykQ$v~+^33OxcFh| z1HTwwKdnO#F27+?5Epj+K}qGm(@bl}N(RqnYT4t|F8pzD%f@vJMZ`M9OJTfy-V8ud z>eOh8i7=H-Defd=tv2jEmb<|ctlBGTWUJkjaWo~!^iD3CeP}mzFWyNcPvAKdhhiNs z(nm@6jTT(vH2TZ!e%YjR?q-YUHcX{t=GydOSY`T1Ksa(;GIG8>mk18;e83K)LZ@jd zvCagrmBo507qV&O^e}^RnV`Ga<%b>u)eZ}e}6X|L`{QkI4rC+>@w&E zUQDj+hTufvf7j{aaZmbfBj4#y&}C@B%0-3tc?GNu*_i5ymeB1tN$%jr*NCZZOqoC0 zot-_`N4G{#Bl>AOl=Ayf4R*PPO$)MJwIIJAqXqd@s0Den z_!2d?u>hc(v<$V!HATcj5-JAz?`Y}!#=R}xy~1r%-X;;B9dDC0U^tx$?^+ko0 zjKv8Y%atW(w%va3nB@G^(v(Wc`K}h%O7V||3fcr|O}Sml-JKEAuiv$$V4lJR?iU)S zMHS}*`6(nq>{Kjb7Eq;1!pMG@)c9<1{D|zX`N%5%i7j22vcjoU@mEC5qrydcDXJ2& zNz}IzW^(yAfJ`pG3uqD&Ry1-qkjda;&~G{Z0Aw<_m=hU3@!4k5xE#}3SUZsA_zIB8 zcXWODi8Kqi-;3uJP+T!=HtRusAoTB{?VA_prZhGbI|`WGOR)t>=6 zP{ZB@VLn8m89>&KbAcYG1zZ&XI!t4Gfvk*|f!?EGbx_eYD$j~^KU2fz02!8l05U8& zpyM>Q56H0W1Ug#7j)6Wts--Ogve=bCCu{5>q3j;auqxjAW!}d;k z_AW&lcxpDI6aF@$$2Q&e^DZNlFbe;)lJtR)DZjH_r zYUhI-pBdOPw{B7y9v3OKia)iW_{`eUhCrAgi@u3#74lEqD#ah42AUH&@#@K$wNN0A zt=~&sZS`FZWUKFYKtE*m`Dd(lM2(>oM$25IT(d*&QV!_ZDi-2x+vp7c{YWR4;6QH4 zw)<8hQw;x7CDvboY=sm1bU{9La&M39uW*s?>aEls_)xQw1S>g|091DWPQ9z?b}GPlt*QM>3NN6Hvj)?S%*zn+9St z*GONALDkYN#}T*_+7pdrfF>$U$O65gVPaytOCh0^qFIPWHUfQ2p-EtT7-|rW2(2_o z=Os>5mKI4CVY3{Wqd3QgA6X;(`VryTHz!{6F1J6}Xn50j9ydBQz;5j#U%_H?oZKPL0IYk_BzyH1wbfL0VICkFNb zt}$=`aHWB?rE8Ue7?pP2X5h9!+b9o$tciJD%LtD@@LR@>oi9g4a;E1jkFIm-hRzrs zV16)$Z(wmMZrpHU(M$^piF$re7v4`5r$_fQ_&6-tw*d(v-xeL#z1o~d_DhJfPj~$y zvSjA53N5eBp8Ky~5pBmWsikG{9~O5X_E&5w{~oYMVx7;Bv1mfA)RJG+bUL5eO>?I) z6a0jkV^iLDgg%Iqq$zT&Rx z32l851Lfh5E|WwOJL_>V%I~~`j7)k7l0Vi25L^;SYXjuhD}4m}cg?!?Z^K8@l67|y zS(*_@Q03}y8d93FLC!?h{w>moo1``BOqv^xrwmU@uiBc3`8DR^rgop!&|YOnDWdgU zDTE}~M(tu9-;mFH6R~+y==ph*Fp~jaCR+bw=3j8A)$s|U7v!QRq6PK~yz-{fqzyPt zi*+Q3<4u^36Hl8aUI*kX7XR%pl^a*lb}BQIUJyEu@t7E8*_n<{&@GPgw$MEgF1;u- zXiS3VsL9F0^)sRBw+bBC7AXDFM6{<<-uJaG)~RL=F%yPFH$&U$Qs#`L6~%Tz7Xw6s z=jX0tU~t`w$>e=kUA6Lr%vG0OY4-M?$fQ>qQs_5>$=v0e8cda+@KkR}AAPEo&_dQp ztQ8`cyeu#B0d?p0hqyK^TU;25d-mblM?c0Vwr`Vtgg81JGrQ#ovw|(PxIb9N0F?cx zq}=a_D6VJro%?|ybSWWD5Tvf5upR3-6|!5LDB+ZM+h!K>U*#aDrDHSBI0-Iv$*kv} zB)I-3rmT_)TKewjH75u8_K*%pVx9A}Qj!}qk(8^`y10r&qcff$8BgJ(>Wqm$z<3Uq z8j$(H1&D2cJRnq^NssA`zy`@xgFp^u;V%t%-xjhtVzUr`Kr{@c=jrbfw|_CG&(4ir zb6NFb)Cbzg`%%RofU!pEUxImL>OgXMK%$D5O1!s8$S=?PiP>-024Ef#&m7_8&!6D4 z-FP=*VW4?pm&p%3wUTAT8k6kuSECYReX)g=kf`E-uA6`$Rjk<>`2M?gqa>;*&Q@z= zt*Ic4KOj-X##&X0KcJ{1#8+#%tupBY2&4MiJptGR`*xs-P?c!p1)v+0A&aMwc7=`x z`VhSvjhqd%M4?XrnFx1981_1I(1f{nfop-L6U~enOV0z^j}+0!zXDxIIXE!|lB)?2 zBmSMEIg&uOwYU{1rD0D1wJLN9w5VC3uL6md5VK!CKd51E0wooi04ef~w1GaNVPdd+ zxoe1SqLG^icoY}L3s71BWgKE{O{EP&Ij{c-67g(^x{!LA6W-jNNEn??Yk+0z07 zm-%BUJP@;_G&3+T@z&4v)1OpMA5tN4hNo00cp4M=+Z$KPF^))9BJ?jtQANCS>K9kkw;C?idp?FeYTjn2`Dpjjqq^F(Kl-YGkjPRc+;* zw1ce5kRJAhmAQD!&tod{auH6efJ&3h>|YIi?NG$qBo<*P0Mb}(?9A2QjuSM=lruXHUVh;ezH?GNZg*=@|xrLPPl9fKum%rD7RTVtHRJx0x=d67z zLbhwJ5_R<2x9S9iJS{VH)d|IKky>0jcjPr2*i3#UDGGzi#8+Myw0ETJ+5OuwGC=A5 z&e}Jnm@Aw2I*%`hC^mIRH|Htd*Q=lNtW}kpWbbyeJyRqZOJ{4BLzmRG$brmI@8I-Y zSCZcfH{`lL44nJH+48wQ#i!e^N!omn6bmKp-gD&h)V{XyGm*I)#^o*^U+9tnk@*8Nl8SJgDz(zr5?}$^@f9ZblPv@3F?&R(A@>F1 zdb{IPf=s+<3!#n>>IJ$;+4o<8KCY0EKNCL0=EB4aWA09N`%Klap^S*Fdy5>t+#B!S zzz_E+|G+r8eA>+^J&~5GFiYdzcZ2G~UR2I_Vx8(-fcgEwoog?ljdeUv;H_1~K59F; z1*f8>`)cCr=Jkty_#1)7Ff6peHOZA2c6Ms5KzgOaZUnPT|PFjmy~1JHwLM4WqA zI@tqSy6eJNvCcFFa-g*06`D%z(0Qg?Y}7fCaDT2!MRc!EWbcz9i(s%BxKnXFy-LgQ zr}C#06-mVsL**+ETNCoqNV|kXYomtbSUTEtj<(?*p z2TFJXr;h~TczT_n2TH%1&u{DXg+R8ft^=~=QVL^({<1@KQvsrUipYV7ua-qMIQ*#6 zqU@XFu9@uix40c^WnqdkFUarS{Cz^ozrD31f4eu|Jt}_W@6M;X=aC?G&SrP5XhUGKpv)p8MHE)M><;c?J3E#lu znyn8rL$kniNzzTY@{**tXnKqHVGMR3X=zH%%?z}E=%UQCrIW)W1V8;oOMmj1^s##n zXn*nT_BSue{CBqww-pv#G7@4V!~6akT;Z89oW$n}rK9$^_PRB*mG?K=yGfVYRBB;M zXgZKBp(BAT_I*GVOGxfb2Cr7H-7X%v1Dz_1rqC%wQvM2wyW}hG{@T6eIhMAZWQYfy zHn+f3EOZXYE{H$8_|JJ{&Qqn+IK^D(e&uoLk>Or9FL+X3UXrynJ=zvK3)k58tMjF{ zSjzykw$Aw2WtrhwiIFv3&(5*f8jDaJ21)4}pK8Z|R-*SlnI8>w3-8 zv)!r~OcZ#Q z4!LDZ-LoT7N7IM8+p+`E%rt4yoJX>&o24E3!#qJKVeP9gjAZs{U+qNFlh!`gPBZ)_ zuBvF_8BDyjk8SWHbrKYhC9HhkE78ewnmXztTt!-9iJsE_75&dd@TUmZd$|puNt4Ta zoXh%t+4hg@mmYO`|9Ga;`^J0go^}jbV zOvmGwJv1F9^?0qOv;48tWxXfd^9^n_;zFi)X0mtaz45xfcwG-}5@PE`zNG!wgo|GL zANaLm!();2J z5%)RCiVvSRV|w@VBucs+GnQ%1RqT?Vl7<}@dURoxBlPIvX3ALX0Yn)C7SG7WfR6#P z*qK1afZKphC08`kOaW_EANxt5gA|e{qb%%LINXgICX${(*M!hN1NAcBF=h|LiecFC zY~XtNRhIFD2H_xV?Mx<#9n{)Z>U>15MwOe{ekZ*qln2WsZLrh#ZtA0y5h1OjS72|1 zd?i=bgR9>oWs2J*SN{7m+WF=VwPKh@5j)pPNPT8u4Z-NQi~yog#Q^w%5h`w8LgqLl z!Y~N-5yKD~fw1JhDOwlavFPVZ?pWK==7VzH5nOpMB!olrzC|}_n8_!myyNoD+tB~m zx)T|j;BgV3tdu%{1p@h^JDatVr;QrtY(8NXk;^Sx#grV zJ6~f~uwzuqz6x4Ah0x##Bz=t>wRP50aP`i^N_cF)70;mvuS;fp=vMvLptwt~SXZ2^ zRnIMtt65E@g6Nf{{xx5&0IzPE>y=50k0W{hsJmUm1Fy0ij;US@jT5+%ZX154&bGT?c;>S?&gM7gc9(RiIUZzAYc! zH?9xA>vI=M={O~LHZ%L3boYR?72=%xS4wflD`rZU0zft~)+y`B>cIky*lA>WK29miFG_njEG_1=35JUcg?m`Ev$4pQ%Yu^{84kA zk5Ij`F_whLpEX#Z3Yj82-1+2N+{N;rgz5YTexMSoysq?Rf{OF`z*c{VL-T$o`zC%J zWSXlNBhfE~rWZnsWNMb~;HBSwq#|rehD--ly&t<@s6{L*hDp311=&$=1q)uEC2@z8 zDjK;hAE}252R%ftz!e2o+-sS^nJu!zeL}lp3wq-&kCtZN+$Z+MGaxefuphv!1&97i z2U$_mc;Xq)cT0LwyyRJWm&piib-UV{9x{rYt%u^XS~XEGl>Ld2t4@>C~&BHt#=X?ilYPBe);bw_sI@q9sp zUL>f+n;VZkk!pG)cB7ao$eXkHGd!o#p!r>tELM7Ak?~@n8%5W1CZV|bsk|+jc+Hrh zoJo7M(o6JZ-@Fo4VpjbC z;nmg$g$IxNBK9$rR;~_B@N(_+TzNI>#h3B%*wn<_;!Cd&4}Xl1QN0GxBTY{8J|~ax~Y)A z*_uw|L~BPE(A66I6wtK_y+Er?@3#}kuCBcw`L9!B<$+E+HFtro)38lIHz>3X$S{k! z?u{CDERcm=1av0#u5^+!Le+{`80+{NJ%C^r+P@c20;$hA>?geo0#`le!lZQ>4HANz zlP@E<7NeRwKeBI3q=d*HIk(Bzh@284e?$(-*N8|7kv}4brr|L`sMs+0FOJ+DeH0(eo+q`bO#bly~)P zd493;A;LK@lQ+%x*ZzQIrY|i1iC|wK#`9{unM&g)LEf+Q&PaN#=)HRpWis_iZy{%m zI8$_+K$v+_f4lfV5#uWHtWd@q>%7%!As0IQtHQAkneQmXwQ%9v&p}B_t135ndUBcc z&S^A^p>F~n*ksoh>zD_DN$Pp1R4KiGoA|$fy+zL(~76%%^75m;OT) zvN(TwRtVHc4f}hklo5)@=viBm$1s@<5-p1@Kiw!*?ruW&{!FG-E$%N8!YX*x;;|M? z(z%&eHc8)_aECXvh&6hPSfh&}o#3P|xDLZX!caW8DTyOSFBx=L`Y`GCciHL1vzf^O zr=a2Y=*i1SN9?DB4Os>xPD!GXE+DJ^sB4{2R2~RK%`25nd9&KQHF}G17QUorVF~Da zYG#K7C5m`!+xbL45bF>JY{H^$r(;rb+ow~a3THWdG8ua~PV^jxuWd)HArfnF8e+5B z20)2Ghp`|80-eQ6nL{x8lP6^A+|Ah+$7Kg5=c9f3=mvZX=O>TP_D*qc+92o(>uwXY z{9(OmPo=EO@r!bpP1MBUjn7Bqu;v!==+OJZ{%d<9&1|vTR=I71o+8Qi?s6aP{p0l9 z!SdCR`)FP6)8ldr$M+13pFBR-8f7+dkI6l!-d%SGsNG(9y=378`EJN9+$XnU-&||G zyG;&MTPMnQL#}mF?)v?57a{I!of7{UQ))PQ)N^U|GloTE;JhGJ_j~DFY3{-C825co zB|To75&!(*F05;(L^_i7sx3`<+Pq|4Pm5KaEeN7-pl_00h%7zc-X%}XH#B6Dk9$JCV*4w#RD|3@{vUNE&c3LL_B354}R;2h{K5AA##DGy1 z*vVkkJklthLiMy=b4eDWML(#{vZ)B;tS^nYJL2XNH(ppLds+GOCnWS=VQ?q}u6U%FXpKk=FwK3cfc{nBo~lgmRb#=-aJ8e}QiJxHZnGFCp(>UDE7 ziRMA!h_`S;?2)x^?21Jq_sd6Y{*&woc;uz$^<-0jiudeNZhNC7h8t&l8=d?|Ct|Z= zW$KlGTOeFmIA^Zop55RSWTApvf5OBso{Lp&GxCC?FLu4#aX&v@<>%~d&=xnc=cs6q ztl{FZeCRYz!y$Z-%#iaK&CAf zH)p0Ty$#6HJr8uJrfZ}v-%;o|Ah}z?dvieF)v%|5eyC6p$nfm|GJLNC8J1xn)4skR z43dnlP&UTqD80pUzDFspGlHlSTmQ#U*BL1UyC!qwwUHXT+l~9&blu0Nq z&}{x!?k++XoXVzr^)d28Ka)4s@n7|_ptd5r1e=ZgK(_sczVj?n5#tur9^|5 z{T5j8zlKf&y8fR`PCYs~89*eW_ffCH0!NC%RTQTm>n;$a5D*@RhT}Btpi(;=@2iU> zc-CfT{8t@;aNHEWOjh?(S&PoBpGwwPXA>JUsJ10r(!lfOaAWx;f5k(IZGUi?{ET&8 zLg|k8)47uUIK!fM)%u)SJK_&YdT7XysBO-3ntHE3oGrGuRInB-%)&+ zDdjX}w&9GE1)FlO=qs7JhKkatwOWE$>+kE--7G&=6y(Zg?wU!t^Pv*bqpc7hut2l0*WtXh8ndWAOu8N`j zO!B^rALG^s%bt79@4Yv}XFYL<%^D8e;6pn$3$ z_1Xp%lNw1D#ry~&VpEKX6)9d_E{ZzFI{Hbm_oe+&o9$OrLL;^$;<%PD(er-4`{(lS$nvs>EOrzviD2ZfKj%drBAcs zN|(u$tFf?ZtK|z@C9ZUQWlKg3U$DXQhrBcndsTNwwX^qAXo~64hJj3E{XCs7nu4gl zwP9gLLvCzCa5qq|3bb;DWJ3Kla1KlNuaJ+2G&Y7T@k@o;fF4yyUbc8#p{+pu3cU?v z0=I*#uo9fn$n8J{jqL?80sb){6X2f$GR)!~+C=nHnC`D(x?Mn4?!@{4%Yi_K<=sG5 z7ZCxij5%TKTp+98=|EP-H9)hqUv2`j9RCbt`0fC*mVX<_a@-fD+Y+XG6v*29M40Yy z__O6*3A9ODo&~Zpz5rxp+#II+XCNzMw_Auyaak8`A&?eEIo*&g#AtsTY#Rb^b$WpQ zKByK{3j33?it|8r-SUuB0?XE)^NodR<`TS7V2g&KWM>~i;!oXoXII!_ zYGm;-^-<<4K1Y&XUJ}_cZL**__>H~m>#@%7!vf<4)xT495p$^!yJ@Kue)TY0ldO3z z-->qtRZ1}?gdD^tXP3Om>${l}Iwc%M4!b)ZQs9|b=bJ*}Oxg543V`+_oy(bW@hE;` zRpAJptcp0W?V=#{eyW>_!j@-P|H(@AueHv=3$#~r^U7gSUeLGLR) zP~KG>7LQYmnPZbpzlvq|BS%})?_)QP1E3L92E+q8J46uTW7Pq(Mpd3C2;6Dd-j6m($@9DY|2$^x>9?RbSiQ+8mvX ziCcYsab4V9QXhBoGESyTUNpg!$&2>Mt=u=~urInvW|I3TuQD&1827gXeR#;0D?Iu0 z8v{D(&jV^k)!r!HE{3i)pNevaR>n?sWWt_&?kyt;_l|Xbi^}@>iH%@rx{VM-U7K4H zrUKnZ39Zfv%rdCf5x=wicg3!eWmHF_&vI2i=Phgzqmkm7BhjcXPWoF!8ds%#$5jCy z*%UR_O)}vaW3Hd~ypD*jVmr#YnJMu;Cr9hvk{!&2Wav9*OYu3HTcdir;dfgku6Re# zRX?eXWUM?{x@gaAa{2E{t#NmaQ!yqrDmfN^DE@7+xNV$Njnrw{vgVrDi+ij|soPP) zQNE|r*|Yk4$+|*v7E3`_c*<2GFnp8jeKLsCHX=$oQf{gEIlAg{I>@-S7~A|>`NfxdBJi_0y2CD09lS>fc{9@y-_m_C{a0*)Nm1qN7n1oCy_7pdnL!RHVRQ8`9APv&=q)*ckS|HrknR3H5JwY#kpQ)moy%84 zp~YdoD$#t>jbp z;3@t5FQK}L2A4y6_U^7mU)-3iyIuFh;c06IDre`bj>o2Z zj?$XPg=ndIhxb-|RIRg}iQ7<)#5$JAVmqBAm1;F{@+8e|R<@M%9@LHeamt>O<8@}1 zyCT)}hgkMnCKp+ToLNKhpGgOy${KLSi-pk@eZ{o|RNzl~>r@3~Dk^VjHw}>hUrlwx zq};{4aa5SBRAmhc!isl|(F~TAS0GxgBg-C}$8=*Y30TKZEeN&C?~=2gL!Z%y+DC@W zU2}JG?JiM6ac~}gP=VO|UA{gmRri*!(z0GMl~$j$OE}Y-?v%S4&fh#!TIaZ{XYWp1 z#Y28e8oc?ct@`lpv{gS4o+REs#%ik`Zjl}m^ z_WNtLWlq*H45w^3MKc!_#Xi5R7IC~&b*3ButK-pFY!MzwmmIHkW-1@uhvN;*fx|b` zAWhRV+t95pIYw>rO1Z@a0$2u+sajNNmQtkkn)Gf{|UU}1HA<|{6GfS*3Jtj+q z)xlwstHOEsQm_^q2$W-;lgiCt-bYH@%vKu&D&@~-f9YkqiUTq>w@G2?uNDsifm7(w zEuGk^#dmg^IXNd{c{zymv#ZS}B1eTy6u%?^xs@5oZ4u-m(Wu-gph`ZvluDn&q5+|` zysu|Y%A!mjw@%0bM{D}a)ft~GXdozRS4J4i$jX%B)I+zCt9`Tn|08tT;hNhpXGI3!;6Z^pkB0N&yJo-;TvzKYJ#9^Yi+#Dbqc1Zx z>00ulSV`(xRNy8y33@#zAc9#L%Y9gT$I6uTn((Y~V|Pz%Oe*;w`z6s-NgoOoQHCh* zeFhC6PK4+5{6Jd6)k0__y9Ei{-DY-;mBRBB&E;x3p$Z=?ei4*9+1;(aLxrmPFn5Pi ztcyr(XKx}fR8p;UBVBBob*b|Apq<6pq_)@F-z$);*`m<4pvI&0p*4kIrAWmWse5JP zYhV#+zN(~ePxF3Vx=ps8>5mKDGWoQ0UL|4`HB1jFI~lA8J|9P_cWM-9qHm=MY3W26 zm=EuDdS8q-v*^(e)I#4%d!|NPX3{QGX8jfD&q_U{*Nq094`ejxaUi2rvsePJX*zk> z)u_y3Afqxu?=5yIkWm>I$mrKEfl8Y95GJ(=%3lC_UBm7NdR3v{0~zK&0U74k!q{Cv zHR;z%pyUk)Fx*xx{cX z&%-J5TA^rG+q~m?9Dp&r-$S2b48K+g8V#4?r3`VIhHvG zgfPNw1SpA|OJ_Q6A-iRl9rx{Pr+sJDnJWuUpN4a1MdN1n702!ii=qKC8+|;-r;q3C zll$bpxwC@vNbXr;OEM9;af%W{=cp}W?i`*L-W=R@CC^m7^yH4RuSrq zj6PEU+7&rt8%bVpDzl_tYc1sEc*MY>81SNmJ5@+y=RZpU*);>uq$QD9$B(H2>zKpq zL}Yjo$d+IMMwk&H5pDeXkxjDfX#Wr=RPttz_c=X*coOY2qhbUg*0EGt!$^NxPO+PAR-Mg6 zr|DMN+onI}xC-!Pn|4vO-`Y-;k*4gX3xFf(W7&8aEm*|W-1VYogW#y{w96F2U7C=z zc2vluQQaB3K(qt2s^d|lEly_|-?>StW`EyIt zC#GixODFnfDkMCxLLcDYym$QcpA6DFUfe%Bk9GVT1*ANVMaQ*CdH=yr78z_MQv5dX zh?~mjWM)DVzd`tYjeM}RjGK6#KDNbOM(-{`k-w&>bVdQqL0*9^#x!bmzQwxNfbL7+_ z<-Qen&#!maUrxsA=N9=DHIwdd)xDX85Fk4_0*x`%R5J+I8>y-A)eOZ>LE*k##y6)Y z#Dd9qrSir4{XW?WCEdKRfBzyGzl68OACxG)*Kj4XUC0Y2ed+Uxay7bgn^1KZ7k^N> zwYOdd##i@np;Ug!pB1h~=%OcY@w#Ljs_j%?E$>v>G7AOzJ^AC=VS4nhWCeOAbC~V3 z7R!DrEG(fVmD-eou9r+T)KCfc0Ta_yOC`B{>Qb5)Oj5=1pHf^694e1h9TOW1){01p z%+W_Orxm}--ny zdh!485r6P$dZx5rTrXpm#xwiGzH;=Yc_x)LS?d_4hsjzkK#vp7T}7Y+lqLKHD5lU+ zEH0C8jsr6J=KVmH?t?%k-*`Z_f0pMArfXh#q3R%oE&(zup9V5486ZpdIUvKb4alUp zRm?#XQ|JyU~7zle3;zmrrbQ2hhp6i9rP#+{AVT>fOW+-Hp15*K|9IP$b`k?+OocQr@Xa@A_~@ z9V|<)>m{0@G)iO+s6*!qeEV!d3>AGBb6q0pDSzl;9M~V^>bwQ)+iQC*=S;-THs?(8+IHof{c;yf#Ppa^7H$Ql^*6b;NBFC;UP<#XK>deVfZ0a@1_th^1eK)6F~e&X9V%(2GUdbJJVgpX$bN z^o1hMp_NBqMwb3SQT7&lTx*ofL4?7=DKPKv!mOH`^e{pEK$Tlv1BtRNyGIpnV|^qNRSb9k>GPGI>u8l0 zmGMfb_pu3Fzt<=x#v1n`r$%YEzpSjXX!M5hR#|m8{9S)#`d}nB2`YPWX5?lNFN&o< zRE|#7eQIgbN%W2pGO;~2LUu0Dp6z`7eI#jzr)z)fohPYwcBr#37!A`jCQ^; zaOr_S^(lesB$pDXC%m8Jh-~p5kTl@|Ha1aDx759r-7;0r4!9AahX>Fr`Gy*8=i+9! z+XqR*0i^hug>WeVDSJ%;5)BEDfatk9G{G+UCO*>p=Xy62P31EUmHUg7cV^PNM#x$N zRl(K&WZZxaO+feGl0V)fxL$*A66HTUvr$e%I)BAbq`aFVd==&Nw_-o%>;B-+v99mZ z!!1Gq^?<}(Hv|qQi)2$m*g=0FYNp)(iRasPA>wk9X|Z{SYaEInns`9P9Z>PBgC&HZ zK;?%Q26;?sM52 zCQo2@api0;u`4bGMB-XPlrM^q*#T6g3>m+|IvEW*mqE}@ZIgSb;W4ceT}c7|OSpfc z;nwk@-s6Ib{E)x4rdMK}573c@j@m`1vVJ7K zLA2gd-3B?Qd5fyrInApADMkMSke-4c4-iy*)ParB$;y+DqNuT~^R(3%qxn=6VzH zJZfUg{)<5Ie9MeodZgsG{Yr0#`*dL|KY9Pf6qcqyvwukT#PED9bb1NVr%#IJJW z5$Lfa@Dk7E7L3C|LvDdu6O@^wxJGc-O$SkKv>gGLE|S@YXPG&{^a^tVr~A`9Ds|%W z&s^cS3l8V>BDdf@UgD+Pg7vhY`UbLP1P3%TRB-5_0pPP zThb+Sv0H+QpCk7k#dAw~&R!+e6(>6;W3TT9s$MaF!&Gh6>V9c}>e-kA)WWd`4ktzs zWgHcIBjKU!jpFd>8nvs!brPoMYp|V{peRkmY5~XcJJZR%MiY=GpCjd{;)vt3J&s1{ zq0`7?9O+)5c}m?yFWRYRV{%v1c$3&W7<4Jn?bxgAjot&XHXSBfP^mvvij)qKBesf7 zUXq*E(iCZe5^=2mO`Q}FaWNo!#SF*}NV=N3v^>t$C7cmFJcmB*@_xtim`VI(+g;lZN!AO$3?j+c6ykxaC(wHNewEp6r~HB_YA0j zEN*{frWgO60Hb4aw@0G%3dmf3sExMYQPP4SPu#uQ*_{VtS@xqm7#BYSz6w<8PfPaJ zWjvgogr1Pa=M27(#p#SWLKd5@vdbM-hiv~Wx%v<-qZ#W^SxD`u>c~%J5Fr_^sN3#v z2{EpPOE(-}p=Q$67sl50R(6?9H>vmT&{yfX(p>E;*|@&LoM9uC43Ac;k7U>*b~l`M zEC0o`qOYP~94^v0G1N2TfTk!kAC*S@AOqnU@xu+|7&`tQ0~-NPFmNW|DF)64Jl#Of z+v5oXn*o;qw#4p@pXa#q7h%OUKIP7Lf{BM=$;k}B9@$56BB{=xuZ@GK`HE6hv0^lC zu>$CEQot>M5*jOB4a`PkJS)h!fOs0S9mQXOj9Z9zW~1M73Sjj6X`r(e%Yo2z+hv>q zWb``$Wb``)WLVAvGWz{`nC|T`o$P%K%aq;G`PIHBwIx05OO)34$oo=X>5V_|G<_f! z=3by?_)0@n*B@?L3LF>A$S-L0_Xq?29^oZ7@tp1v29-jiky8@wpC8CBKo1<)2ei|5 zh`A@>)*<8(0c-HqiJn2v4Df~`B4?+FNWSV!@9YIe3$YGyz6Dbd(R?3~%v%w)2Xn3L z0G`XWDo+@_0}#qI#zmSjgabz~gu{d(Ajaof8u&PS!eLD~L8W@23^R7#ewjnVZRw?rq z7lWvbLmhvJ9ds=e3431`(o-h+ECM0~%P(uF&(D;O2Bvij+_5$(P{wbZTT{3PrUE-g9S8bIb)y0kn z;{K@PLdF+E+<_KB+!sUK1(Z;TyMPe)#SnJ^A?}MI?gBC?7em|ygt#w;xC;nzUkq^< z5aPZV;{K>l+!y)8y&2-JvrwLoJ$0{$`y^>EU2eo(oaruB!Yg*2M%?8xjuH3Qffj1) zFpv@V!&u-(+e^2C@P1*hDC(k?j@$)7b9 zKiC}lPKh*Qbi=JWQ|Cz}8#0cknl%G@j54H;6J+jgaW6f7q!66)PQ)|ND$4EQ z|J@MxeyUTxOIS!W%5O6(if4BXrw=S7WIuz-1jSKb{6T?R#;=*|bTI9o?U(GSJ*XPG)Hx1VyV+}U-x<>O34w7+c`+|78| z6vJ=SRvbW}e4FAftarN{ipiZjp(VG#zjNXxrsWn)^b*r^3nqDq!*UD6Z4`Q;$#%T) zf{4v@&mdk(xNbHS_)%)Bdrds%coM-u$6t(JXv?T$z$3z&CZg)WXvWoM;_vMEq6i_C z%poa00-m-b%r-H!7TrTZ5eiR0ry)Hgf0CW^XlaSVG9P(OUyh?Wy=c_>=;?)+zDVE6 zMQqjkd?-XL*yQkYesK87J(J)p+TFsTI9h!@`mFSC$!wQ`H5~<{Pc5HDbKr51#a8pX z;tolDI>jz|?140-V~HK$OI>dgEsty;O@}#3w^IG2R_Hv(Z6h?IdX8-7&;wM=x>ITx zG+6E#+dfom0Q{@u)o>_{7u^ap9vd9FVA5!VRXVSXRzgP{MaMeY$@9*SqZikxpo;EQ z8!0ioL^2z1C_*Pj=vUC#ytHTP|Fe1IGa~vgbiI+zyMfG#`B5MvqRq^3)2E1;zG?lt zflRjD3}mwHBVp_>fQr6(lGW4 zpqg5by|9=;@WocMcfoV?nj zj9rUJw>yiOmE$=bj*YgMxqw`Muf>eika0nP*Gl*nGbY`RwwTdcs-XoWNq)$mc*^iC zW(1cIEGU#z?eDah5p44J|1FD|pw%^qfY73H9Py<#Y1CwJR@qn91>E!%R=9D8t#CANU>nwR9LE+kWqcba1s zFnVBTE(`>1<_H9zRsNN^3Qy=Q`57DH*@vQux?SOpK6@eSQfb<+sh8~N50e zve=MHMQwF|)Ar)RUJmP4X<$K{L?!jGuEnF*JgdE^e1omN5X1CEddtbvrm1CuQ_z&! zaL)2N#Y3OrGeVe^I#=7x2aYQ%b-MTf7+-19(OP->b*89u#Wjz~MIsI(rk{V`mgEJ=8;L4DeYZ6po6b>V!)o>^k{T4X5i$p)J zicKBi%gMj`ChoA`(#fL}BIs^Bdv*?Ads&S_O@ON`l;_%|r`A#2UgrrKtJp^S<=IP3 zuC^^f+nVuH#r~qXks8PgWlA5R}$|DmM?*uYY@e!cMNfC`SGDDXuy_9Qi zw%<+wnF#oMAQSgaVx`yxwM&3jXpXypE>ma#$ga5^j<`2b!xjTwuF&U!OhCL5$OJ?e z$nf0^WCG&-VY=QhT_2EP=?~M5@jSP7`&~39*m>6Lpu$?PvLJaF=Yy_QGV&_TB^8 zLywEy+k0OF_+p7Zw+)j=Blnm*0wAOA3Jf(OzJ509>u2?e2p9o-f8hdsDysJ54yb2@ z$%deo9sG3p_SRj_uqjbj>qm&X?iBso&D1762|K=Vv99?H8_R`~^j*2Lq3Kw7?1yOvPh4!7lHla|VA&~SW+8SJWmhpJdEDatULq>CBlT)KGFfa# zI%Pyq4nQff7~g_Dq-5TPme(#F7qsEj9MZ2%(NjL0;@Kv;ECACowu{bOm9|0n8%A%^12rx?_327Mbf@l-$*$aVipMp>1VCpmo!)-hr7hm) z#T#*~<6+S18>=F1*grhLDVj_}&1`yA;>`6*QIUjg=->J<+KZAGsLf_rKrXxY7gxuUSQGO`+#sL3Pj zx>fPkn#I?)^{{(h#gCIU>~$SY@!Zo=aS?qKzZ%OrijyjF)M!GLY`>H_C8MYcjljZ4 zFG+DvzIjP1$1Gq$%qghViVoD|W>CxJer%xM*nvAvgpEXUzc zhuNC$7N9FN-LpV;ljz+rqSYEEH@PzkeFw-GWU}`N(}ARt-AffUe?S zt*!3u)U4qf)|IYOGwpKuexcnU)so-kmmEWEr0m$&d!+bb&LH5+noCPq`mnz*OU2k$N`1w#u2_Xpzo%2? z`(uz_G?i<%a)3y+Jx^O=&)F5US&{^W{l{v!={9ziT}FAno}97r#XBKBp(U z@%w_8^A3I%OME1~X*1M?!+9VSC&{sU>*k$;jhYlMZ`F2vl?de6S{bNb4XuURF|Vjm{-O z^+DR2`13pH!C2@0?Ckx9r!Ni~eR8bxI~8r2MqzeXVJ;P{YUvlESnorQpK>zrl)u^oi0Oj&0Y`0U&hRcViA$D za#XMWl#^dPA?R~?d{sJpvm0gVark7;JA_#4K*}(? za&tKy^a(Oo&?oeW8q<%QxW)NYv(~8Bz%q8B6?ftHaZV2hHsZcsNbCsGEYg9=8B^(5 zBh9OUF0L2pVhzxRq=-fy2kKBR{}#|%g-)WS7i+9oz)prxMI(O(`hvzD&C)h}p9QjX zJwO{Y_5di-I)%jby}b4sjmTAkqj}aT8Yuyp+;RjlU)FT;N|cbVF)lc|e<35RDmWf& zWMsrfeyS)(o=RiHHO_bCvU9D>wL0E1@z&bh{sjxo*cQxIvD~ky+?$Pj_$Q1vYwE1} zgSm|6K91nwR|28K-iYiS9G@LP#Hhm6y2(<()f(B=!`Zk^E&ft|!BxdONKoFy_c-~k z9vT718q6=4DU2(XzxOUeQu*)P#+SbV*Nrzj^U3lXCfA@lZ=`zv;61oUA=kn*!C@f2 z+YtA|3i;J-zqaA1?6hpp@f0=Sb!{MUgue9<#+w5esgwM%x9W4;^-`g&U3c(FOKfxA zCACv}R-%Vc!J!?I-&CvyI8dHEK z+$vS&3`)Dzd~LtVHhhOJRb?^%Lppyu;JdMkb;>@fxSWsjC4#*3x9l6^W7(5wv6Fq^ zE^@I4eVI>nfFbJ#?lxGBy9H*p+-3}1>?=!_%xXUs>%4_!kj$O|#!l%`xK-@laoM2{ z#5%;pAv<((tV8Vk7#$f{`QwS`5R#E3HqtF0?H`&K>#UOo$lfp1(F^ZiujA(H8FUZ@ zlf2NgktJu{#=4Dk%SYJA&O=#s+Q{FK>K!(+Q=Aoy?B3DO#26zt^`*N>mSFhq{2%$j zibYG%qXQxnF3+cl za)LgUZjrxWO-$gLJq3tmA$?DV1=9Cg4|NK_qYuNk$P93@n{+&49in1n!3_8dX6#D2 zo&^8vm6FV_Ip*(MEtovkSS_dt0#AQzL2PlR>V`d?U)&Jh*X9KsJ9;^>*P-K_uG=F{6SpfnD8wmI*t#H!HX@3OTr@%y-NV|uyKdy_dzi)Iuf7f#z`gve){`td z@%vN0)g>l@CYSaAnRF{kfkIjtT|kCKJZ>A7<6-MRP%QGW(~lIA=PeEMr-8n$VP6NjOQBbQzNe5pzx2-v zT?6!Eg?ZckSy6oMi4RjVtVN0IWjsjf|>8Q1T(@)8s6*-_hm}*2;!p&)K#lhLsj$` za7R@uk>U*k>w7FCic8OxJ6C=oE{@{jZcN_uiEm;W<1LPdFU1<1Bb>6O=Ih0`sEB%3 zD^4MjSKlc!8t)n0moDp}T0-K7F|WuD4Rh4i;`Y?_#rooIYm~V3{_(A?^*DKZopL6Y z_BEiMj+z>Gf35`$3`*1W5gUgx}WE6CrdyE7HQsb2@x8SA?}-R>x-jIR)UDw+uQQpX2-soB9^>SQ(9 zo9-s&D!?{uo&xN{n*IG*i+@1s`1`Yz?YVZSbd%tgWY>^^%K-ZgToh=Ly{=g6bei8b23?!!CeZ7RDX9c@JUfc2F z^J}*5GEY{YU#qcf(Ny5%7*;_MX~i#1J!;j4V9ol;QgyHTsS31^&8J~@@=lQ3xv#8q zbtXCYmG!YC2~+PMU}=`;sV9~r%4k-8=Bo5Re&VW2agQ3^+C2G^avENQvO0UW$}~xN z_e$TjxUZ^{%CQad@0e~)9}=`CHU3`dkd*6xu}8W^hBf8=MEajIdUNhGx@$sAu@F<8 zqHsK&7QwRhyL+y5_dMRaGBcUM-b|K7JI$0o$2(lV*sSIC|1Z ziN9HuAM!V1!1h{(4Ma3^ruGBb*N&)r`u#Ofy;7^HBOP3`Zb#hnR5BCaB)Lb><=U-U zZ}h-#t^AO`;&`fx8V67~wA=PRUjKR@l)MkJ*h8H3(;f1qrZkCu7MmeLCxg>I(1_N{ z@fOU6$e@TCGgv>9%r>wh;XwD=dIV^c;mE}Djuk>YzI=@Y2S zBHn{*Z$iT`EOiT%IwI}JpRZmJFNSB-sK%da(U^*tZ|okwcsF6zNu>*rqDtrb{V=BazFyf{QXPMbd+#Vc zim5_{k^ZlYTouv&6h?}A(F#iD3KS4mF5iy(+89W+k zW!{?nEjwa^E()O^htS(0^d2yXKdfk^IfSkQI#A1y3yRO`ZZ$=kSJ?qaBVPsDreWU$ zGTRWb7cuLPpM|l#KxX|hOg>9D5eeDSH2@jrgMcjE0Wf{5^QS`SM?kha{{zr|;EYC2 zLB8(M8q5c>eflaOi+vqvi^d*1DcJXa73h8q>jOG~5~Gm?`$ZxTXqfI*WapjT4)?fR zIETI!5In>2m*DI}*vHE{IONmi62xr8^^C~=9gkIwmY5$^joEmhpHWRms+5?%&i4$? z>H4 zY^1{?r9Y9d!SXbe^QIFiiASztgZSVc0K#UevIs!?2ftUe>Tz!mz&q z{fpMQo|R;f+(vaZOf*skRoU0($QtZx+e8bXY8X-5=oS#(oXVd-8XkvC42JvKtai`msR2}x^j!aT=FAkz!98OlpzMg1lN`@gt|kW^llV1*p8m-A&sFkfug%N9Ru!Ye0= z2q@D7jy`QfmC|2fTub|y6|g9As@OJE=c(Pbw^t8JROv@^X;ZVV-~~X&4`t2ofL}!; zF9OZve>Czgro@BrI(P<<#V!J}Sh=n+ThmP%7sMV7WU(uOo+U*zax;*nyC+O1$_`66 z1IS{p0-CP8Wek-FE_y*9^ojuHi%;m1twtQMEl;={|F1KOzyi;&Gm4NHP=`N9QY|L# zV5m`KR?`mVL@>Mai9Sfc4qLsfQTK}e?1M%M76fyy7A?Sd4)etw6||sqgPz%zrOAL8 z4EYOMpBsZ13&Zm$iMgEN3Z*{w!Y1kMhbIee35WI>eU8|7Gu8 z;H0kV|NmWBbWwB`MaBCPsH~c?X~}wP2X=5qXB0EaOp?6vwJd^J!3qUt7x?&b$nui) z)xK0#RBCop#DrZ?c7as9gJ$Bbn8p&*1Vr8c^ZkB*K4)fjcb2vM{vO}|_wnVSJFm~V zywB}@&Uv46-sgQz09p6=8Az;5R8@3>jCEzwGZFG2s@8mu2bu4eLB`nYo$qGndpKRe zgibNDXW@Eb`?0|*Ol#7YVJ6k)Mjrd4QD>o6SumB_5j?M{RVwVog!3htFw&!H#o(EY zI&F#Itxg$rsIukC3hCka7tGwGm*t1(jkx?Ez2}DbQu(f%a56_aav%SAohD zru6C$>aT23{sBFqg!g3JJ-k4#YZEmdoxp|h=eHT`%#P=6YW6p>^QW3ic$vJ%MIF@> z+JH{cGy<|IZ8L{Ie+r+v(fk)O3B$L_wi#z~*WoVzfQv(@tSru~PM6>)ToV~Oh9Ht3 z4eh7av&T0_JY|Yv3*K@jUFl84o?>m;D&0y%O9*XQw1fivAWR#{W5mT5D$zjbuRd(S zMBl0VcAR>6`aiC?INovUk&-uzc9JdlihSQB)y2A9Gg>qeh2s;#@Gx1lw_HK^-1D$_ zASwBatfGS*DfuYSW~erG896r9*K18v1{zcqgJ+*BbQCU3VS>c>)5Nz!Ja?oe-lFN) zY5smVL6Fg=8r4AWRW#YwQSGXdd;3q4q6CEpeFq9 zjm*2BAW7X)Vz1{Wp_jEcbRD^B(oErEt?j#p-u z3#_oqjqyy|py-Nf&CuWS2j~t>qU%8m&OUEV+}oCDcxcAwgZ!W7f2v{I1b}n*e_%abq)D0sgvp6XVh5B1@0`;=IdbC~7W~ zYT2zKC&#@;jlcmSO6$NUU2mAY0zLx%>^A3i%)ebKkbn8(WUwrgXjzSc(gx)5oq!td zGFs_?A(PlR*HU7cjYC1NllwQ9To?C;Ah>F0@{I*MP{HM2qN~Fi4&D0UiH1j}KN+-| zZqQ4)0*dKV>boEnS~K>CFkc!yW73YQhLE0(SujGPp+o2~lKM=syiiuq2t^U7Pz2?2 zaz8X6iJD!(Q+kvXt>7sx@{gQK4=eQ)7x_ms35v9=p^xN0+O0jPm!fjE4yPN{uOW+( z*3SZSU*V7Omypuqo80M8v&+{}P{FrMQ}&`tBQrLs7WKqJL++GbS=O*8lVu@YCMP}n zPq68!H{0@8xJnP1%IPId3F?wV_K7`0?KH?I`WTc>6bX8v(L?q{~1n>3mfcxAWKHJ_G8~aECBfSlo#q+i#i% zGKt|q&;XSuu48SoU1Mwly`|^?Rt8%XeH-+Sq8Zrvnb9kE7!1NqI9{6igbEtZ2t3-P)D~ zH=^4`Y^P->HF63QCo(+ndidfxy?MG`82madQikz*t^|WC@<+d)I04h-jwMpkzoU&p ziK#^_^>S_W#+8WgjV&u9Eg!~PMuI@;fm28VRz!b)l>A*Pe@i9J54jK{HH7>v3DI1a z^nTJv4+wWQM8+B`-&|Ychp{XaT!a0eWL7!p^;LmDosJS=089(kWA zdESlArEiR|&<=JUQU#}cwD?@AQfQmbrXkZ!cB% z_jvZ4%J|mx@yczI9tYD69U`Pzf}oRHZhe6^1BzUpi`AwT()Z^uTy(^lP?o=~PZJ+l%vIOUWJw{nOQJuf;rs@ik$?ALi9gao!h zdFC(t19`HpVZ-zvqTnLg4tuz#D|*;Iy->6LcG$r++l!_B_!qBy9&?g6hk53m%+fr+ zkLo*BGMhc$^0q>|9l^85imP&<2T23b^F%S}~f4TlKgdrCE0Z`JCkp*&45VU4wo@`Jh z{W~QC(y-{g1Pyz-*L0XA?Fk7qMZ7}O4nDmDU-?JFp6;D@7$TQ&3S)dlx>?#}+MG`? z>+1SvT;#^4+M0M*2g;=3`uTz3qESlEVM*UegXU(-?S;1775u>Mk{$V%H2sBqO$c@k z09CY1_*pwh?nGi0c}Sz?Upa&Lq6b}7AqSU-C|U)wG3j6u7@=-o1DV^Spi$~pPnSPJ z(U(C-D*6#UJf_2K_l8 z8}t`AUlA5<(C@M6$huitcF8Y%g$cEY(Mqb9u4Y3)nj!Fu$BlN?U3fu zPE@bYu^kw+P&Qr}&up)ZEch|86aH~rAjde&Wwdaa%=c`b{15poCf z!X^k7f`mT=L4Oc_6)U8C%jAzH{qHR|lo$hE=7G|;R2h{l2SJ6WFY0%D<`yxW%Ox2s z5poZe1#errDW#fNZUxq}fVr6zs4OGoFwMbYrLS6%F|=qP9nI$j)K*-(>l~1EW|;!4 zGyf;3RlD^ML1$>VyFnw=?OD)#MREXmmio#%*gCx|ZmrXcsV+-n9LPHTJkaSH<4({5 zrScNU#@9DNb`mlS-dm`?CxSdhO`vNOiCu=zD3#BHaAM5;BFJ(u9b`GU5@h+C?|ie) z_Xd#VPq^$gCN~ow_o@j&843T8N$c`W8UjB^vM+z>FbXpw{UIj~T6K$ovWk+RMT*vdF4S;2&^Og> z08Mb6BH42?E*85P#>H~Y*uqHoMl^h6J@66FMkxwR19NLnY{7W@# zk7UGd7|$D5CH)VJn>!)V>gqYZe(4u6pp-CH^LAFq(-!D}NeInu(u z*NyEbizLrRbPF5MPvDr7xge1pRu_nPJFVIQgfFBlJUDZ*)vFG~-A{0g9eXCARs3}K zDi)hYCB&RBYx!ifT@y0Zf?wz&tVgsr2(8h+ zXwj$%SmNr@MD59ck=A!PCG45;(&kMKJgV!hAaf*{vleh>%i!*u$kbUIh>xa2D(laSuD~bJH4y`s4mV> z=yQcGyx?R?+DkRBBAk+42Ou6}66>*?thmeZ*C!FI(t&50Nwx2Dv;0ZD zr(UUnJ`XJ$R`%eT-lvMX^y z8B0Z$OtF2e!1j|SlN(1`J5Nc7Y=~Ez^YM%pHj8{N5nI6n$s>NskSq#y{vKXg2-!nlLLnqzREeGF|S<<)) z@l2E;<`g+ZTI5UgJ@}D-f$(M#f;l#f9cj6S5Cm3|)V}Op@PnXRvUg$jKg)E0HzZ!k z{zZOj$ft84-~VU`ce+zj&X8x%lmhuR|CzG9mOrk%*ZyU_Twl;6ZGYuJ%5sD9)X^Xl zibRmRQQbc4+(fXQu6!XPL$e~$pqr&=49Hqubm^?+K|*$j;p*Rn%UMkV_1G4 zRsQkTI=ATqWjVwq4k5NT&e$iKO;k$6$UIq&=l9j{%!&o~^M#$)Ovb>ej^##49O+%d0CA9S`>2cKNS$6W#jJevx|~4x6uQb@|pC=OypB%i3<7*L25k zF^M)HG51|jFOFp7F@#Gp@6mR$Gt-ov5VqZ|rERyE&#*3}?P!jtKA5(t`=up z7R^qhLCMyK&mc*%A3Zxu2(@4_CuAX%N=r!t)!J?H_Te;$EB@g9nSSI>2Uu&tu!rcrRjxM zN*5~b@6t-m#r>z4-dS_IiKq6`m+HRYC=T29%;S@12P0h*-)fMuhLgyUbG4W8sZSG_FE{Etq(II&WM7H<%=|U93E|U_ z=w$}J)gk)nU{uL8#;+ZE5Ht#!RTZx}^r79t7{@s@&Y_78O^SZn&JDO292$Bddh zhNwE7^enRUnwSV_Q4s`(MFXym%)5dKMP%yIG>MmAW8>U$vR@9LIh{d<}%CV zcZ{(^EflnqFdIRu`LTDr`Bi{k{HsI%A-((8g#N>N_ZLo7`UmyyFRY~g!uP$TFN~}H z!nnQo3mdDyuyHT`!qn<7Ox=rrW9TpPf5Mg@MWS?%7>Jp7S3^*Kha^}iB<8*+;^y=x zgUDfB7Y`*xH9pR3xw{&cRuV0D4*?cad88YaUeYH%>>tJlzW?|`3h{v@@!3}xBfS{C z2pMIpzsap?Lt?DTP~4%Z4lQ(Oi9?+ZZFcAYwsnk(+?p{YYMO?gacB}cAWgm}Jlb^Z zZcSb%&&b8RwbAy!?iro?;yd*F3H~iZ>F7L1e9&C=-{mlIZaVgs$_lEc$^Vw{b(H6q zng-r7w}R5fj-}H*6Z0OAw&yY4yuN+&o*Kn(QFFfI23CF7Ja>uCeMxAIJGNzip@oIH zXT}X|`K}N-cCPe`rh1I9tr9xuIPkU|nR>x8b?sou)P#XUzH0$OS`&`FR%u~GZo`Cu z*D9^1W3kf$`T9p=-Z~-Hy@WSt2`3C3M#dySf!GaU#x_nEctb$!Thb$=^(+7F5=w{u zz)C2?zz0@B8A?8g63W=~ft66kuMez*GU|O0C6qz)11q5nwI5gsWw`zzN+{#|2UbFv zBeaAv#Ly3=x6!F}7+|E?-#Ya{-?AP`KeRFESjHe5ARe7C@Ro1M0MT^pcV%XY)~}*_ z%hb~3?H2Qfhw2G|kWs4!OSo4X)hBW8JxAthyUxkhF|UuT60@O08!`OZIEMdg3vc{Q zBq(90HHHVd-uS|m@bP2iaW$R~*S$i~6+$xTiYk2>)wzF~o+47GDvmGRfMWKX&~IKG_YT!<>e^sB`4paSs;DNHb+#({3P`jPsw(Dz zZc<@!1*l2go^ZY|g1)1^cFf(q{*cqu8dB<DF)gdWDO6s($CI4sqlP|9 z)X=lTT5(4WZBGoMR>#{npTg-~A`-(eS@!JCpc@(ZD)I`0j zFww_B-<^a(u4xf6(0PCj)#8f9qCM_We*)DMX zTgPDTOzDo35U9~sZclh;XmUyKwfy&0^=|=W$~2YmZSSlpKDi^IS|(;srp|34oy@i! z%`wS;(i`cu#p}43A&UHCIhuS9@0~ZdrYi>w;hmv!w=#NiS^lH%KTg;agxB}}D8s~~aZfxpg&t0yOepxVvGgLA zgu5j?mc60AaY^QR^5k*yeeca=Ab1X5`psHC{nQk>5psGQ!=%-juMcnJsUQjEPvSH# zg_X_N#F$^*iudl0`(ax_HE zGDi%@sTQZH{Ep)HOZ<-JcN)J~+l{CB#n^6q7Qfiqjemn*Ozke5Lxy60BgS^;NFRsN zIdN}5hrA3>(IKx}Q11LbHt=JLRrKCziKTE~ct>LLs_O|givN4OBNN@)jxs=3`mDI$ z+(>Q4xfC2(iwW3s;vI7q5<~uV%(>1$g?F6{j9A}5&1WUof}-~#QQPdo%b=(#?V_`b zC~&(BfF}{?ZT=6F{|t7)m?OV5N|NONYE>4OOLt#~*L;+X+htHcDwd7D!-Ys{1@%5r z^^?@tYT?xhy*JqP$U$@zepgKY1u_)r=v_QNSbcpQy%Yo(pw)#t&0mw(a5(~B^x$z%c`k*Ls|u_FO`{l%f4Wc|6G&5e>@vS zv2a{KtAcWH7TCaETW zEM_u-k~|)-qjFxFc@OXTCL4B4|0Nee8{y_A@A8Y%pWs?R%-eolbj~Ri&Cx{H>S))R z=6`gw$^b0?`cRO_9ZE`tkPyo6+T>*=X40EIEm^tEiuGust{rtcE7l7Xt36u1Q5z}J zB4SVfi}p!Qqu9G(XY=k^m65y88334yiTXQqtPTpC;;u;DgQ<=z|e#YWiyIBuz_IveliMn5bNn$g~ehdTJ&+ zTKQblz}XObExPr2xPgFEo8W#kqCI}jNp%&?3B49eg~lp#Y}a$a8XBp}oRLY*s(&^= zwk)&c9!9;d{#ou_%*yZEGp?kUtVBapcqOb&He>DNrml46FH2pG@1mXRC zf0D?Yjp21_Z#64NxqlRhJ6rMt>ano!xAfoymyU8PSt5|8w^}KATXMg`VJ6wVty-qm z2SK(P_yfpR1CKl3XF;|ah>^3OY78-ZYcXW2*kb(B`HJ4{&o$gXKo)L0$ih{ycVNC( zfbP(6Q<2v!+*d#r?h26kE(6I1GdTs_r7@m%ZZCpNW(4hv^r$ z?}21dSyl0C(1C=gs#p)YRcGfvfxfS32k1!+w;OAev(;@hXu6`3i8k|UT!mA)To)Pz z4b1>{#7I?y&>Z?i^=+HwBfJRDT2H_A&vJN{7aCb;yemP%yR+i(vJ&X9xCnUS_Fde} zLB2$-6+Xd!l3l4rbkoJTrANQQsJASFG5f%fiz>9(7c}O>^V7t$ca<2b-UVybGO~y49sI^x{?^P*z-QC!>1@=z3%BkSa%&!E%Mwo!XS%(P z+&}@psx_Yg{giaX$4-~Bi{ZNr`xcR=|eB~_2eD{U} z#%Q?Fpeq!O0bQg>wmi)3Oov31(0ogHWbUiFoD9s$m@rmDGMGVWOV@ep6RZ92|uQ|_IC@-o?ovconbi?)QVzUDq4nJkg4 zn7#Jr|0`uK`|5zm-8?;!J&U!_L^hS)R-qgsOQYqog?9qot+y7jh8vM`1 z;O9~ee~rwO8|}$T&b%jLGVE_W?jW4*P3|-b2`eSC#*0WbD`VAvO|z%P2AH%$zvtgz z7bJHqw8`p`{Qt?yB=3ht?mkzh;7{_(>7-3q>Mzav%o}CaB{NJ9lee|M#Ef$JW3sRq8PQ+0psr6A{NK}6y7eHY|1q_ncl zmTST{$ulh+iXA|9H}HFIB>=U=yDu9cUjx0#Z&HHw35uMe<|%%4vhHajVN>8Qkp&k} z6x11qQ|1ZTQF~Jj2pq3A4ZQeG@t!x{O1fS}jTA%7ZL~&m;N;EF+2Bup6FS>cm2ami zpJ7(RV%^sGz}cIUl}|TS=0Tk)@5N+xR6`>3z!3b`51hTB^7*aLb0c2Ig-M&6yr&U8 zj;?6_oJbxIM!AJl`Pb%GQI|tchYvISABFLC-W!-2Sg{;tnDeM(B-Feg2Pi z5b!pNsev{(#``H`EK^mH9SXTQePbK1FoWkq-qgFmv%F`7Wk04UEg^lx(_3BxhZUTkzS0aa2XcKyyvctb|z z{)+fiwz|V)^23TmFWH5(ygkWi{x-b4lPL8<%_WD>)}AWQd2kfr-akfrf5$VwzO zVDHs*-v&XByvWmZCo1KG9V(eqGOwN^at9KtEbWOSTq3&@K1*-^+?u$*Te5Ov!duG< zLk1^Z5kDh?Y_$3r80)`vF3CJ_PU%GA*Mtim*)oxBf#)L&Wa$`21=hkkA+M zb6R#tO+t?KPGdyDO4G`ew?2BWY>aQlS5Dw;gnwTd38yMK6)M}ga`G?@qEX7ff(_>= z<5Fd!vW;ETWZgdkxu8AXuu|m$F7UNMOXr#hdFywT1Uc#7DHydULo3Pfh~4URwblTS zY=}g+e>`(y1(qwq(@1gdpesqHx*{#F$%VVjCn|WmK~QM8NkgGM#x=u-aF6+?pvA&Y z@mHCww49W0!QmvUTP|-$<{bcLy*7s!XJ&_SR&o{s1;XrK(`TgWxCe2=szgIuuzgh@ zt|X_Ht>bV2<78;0rgHay=)%f)SCrnP57kTN<#_-#$``F}Z@z?nwoNjO2yc=$EO21a z@aI;Z(0qgzWS3Kid>`{TYtpPM%@oqEvUSLFT|95@XC(m58|H@M$lfwf6Qrj|cm5oh zs~exf1da*myoD^=tcCDq=~|blI?}@eGSU+WE4iCwb3ofl7J_@SVvc$b1Z{^rq%R<} zvxc~lg=eJoheX9{Ig{e7gkLo(ksY!tTL5f|t=v4Mnq_P*ndSKIeU_D&@0?LQ}?!__u+0e7MCWq_#+m{@` z7#~qnzBewGGAcJdChLjaa(>CYGMld}2x9ZfH6R;>zXh^USZdvT7lUjRmfJ!$Ut9yS z8KDhiqxI7uqat@Djmj$^i*Xur&AMtCx2J$C+@&B3CuVkxir7fD)Wpu6jqk_MRUX#3 zCxR^QIFQ9nfQ+)3RIs>NkgaiV20f~Ae+;sj<9U#62$P*)o{E5Mo*E0Xc`6RFdFn?X zi}7pFr>T*u3YneEZG@YD`Z}0MB7Lyo8}tx5W_nm~#4*IUzz+LND9G$MA~LUybejB6 z(7of?)89#Q4||^6!AWGg_Kvjv2$alTS{3LfM3?R@4#ARHAAiT%yIq|s^`mPYQ_f?g zrk+2|260`dw&f3q-n)*rh~8bv3Ozq0dhZ|P>n^_DvdmUKpQ_~GXM3{l1?<`|kFJb2 zY-9(v`cW(qb+>Mw%6?-M9frW$2{rTim_KS%H1daJ!wb_NPh{SyZhj~xi=dY%O|0du z^wB|9W8Q<&rL-eO+#d5D)*6d>n`7SVUc2UkbExa($756mK3r8Hwudb40_nTzcC&M< zqP?xR9|y{jP2O|`Sq$U(5|v_SMZcKaIs1P&;SZL9zJ%d}!4UmXCv}T`P;bxtUcGn~ zR5#@e%Ie?@kmzVsRs4rTz4Szr2GwM(^hCC!#K6A{`}-zr;!f|O6`u&C#mvdHX;($_ zZXJW}^1cj680(JrPUm5AlY^$DraGbNUg!h;e(c4lDD@{aSnI001mAs#Tg|lpw&4$MlbsTH0 znu$v7S!@oiO*K3|eWQt~c&$rhc9@vI3L2}T)z3EnKAHV&RkH4xWW&mtcQyHy+P_y$ z|1r`*BNHeG_=9D~n{^_u1BqebS`%|q!5*ECZpY;mzhhA>7@CXSiL9yc7n7Zlqqtk9aTIY^^xj$ukduq@ zF4tNd&HAT=exF&FJ?Sv(#}sA#x?b~JCG`54-wotTEdF-S?-etqRP zeN}IH)!P-l4p28aWjj#OL!g5c{S9=mqHUl<6dggm8@$f(>3GAeRLVpK$uG%Bxw?oujmf{coc!$#%9FuYNb*~qAT3S?AfgRUoRRfXr= zOk1Hu+r-~ZW~4yzs#xC&wS)sHm`yQ->Eu(UoKPF6wQ^v|`4b9J-RCx4xak1JY5U%h zd5fXdSPygxWSa}2x3h`pjcuek2-MlWbTseI(LKL>DU!8>jDk@6v%NIz6U?gv?;P zjJ2yy7OKU0USI;29gvT`-_>&NEXJsvt|@az5$b3PdA9P+WuTX;rLAUxOs2(zCjXxdGWlQl%Y2g{lmB~_NeYkqgknkm#1SWeHS-vEAiOc`hgV2soUl?P zKwlvb#gjn5E~aOrvIp#<`YitJDPcZj?KdpJdd|s4fuR~aShh31s(omYio`5%cYQ5X z9sZEsWnm}sgXS<1w58@SXv>pbE-wJJl;*Nn-$n;H=I*nbFJ)^7Juu2VHR+Fatipa8 zy1^Wksh}g5y8#N0-VVLv3r@pjCDjX1{Irk1j<)zsQR% zsNOxA55|OVs`5SFvq{!*u&8#KG4yPuv=HDc<2?V+wDTJ|xXJ_8l(b8r!rD6N@ ztSFwZBq#?WDG;2@n=iH=sl$%fV; z+*@OdGciH)Vf^eoTh_mMhqtXX5 z8cBI9&r#5n0yh_nq~XrETMIFL$%^FPTm~IgSO)3X5H5mxu7H}G`oGR$mw(cn*2df(F(^6IWpK} zwhf!Hd(jXgqYpz5s|Oi+5}CGP?CQU&FKO!7v#b$frMi?d%88N1;#niO{m^~s@DK}Y z-EUt9qs|Hk<>j!dsYZxMCY4>X0$?{W)E}~26NsivB(t}$&vMl%vIdEHe@nE#60QV# zT?&{chHP$%P-x=nKf|Q}>rm6AVB0C&fr5DY3!wzV?uIB*t3fq{jf7sS5J^^T6f#SQ z*n6)$U18Hj_|zg{k7W~t8fCk51V3BknSr-NzO@XokKT)Xi?1d&Jpa7#LSZs7QBp<+ z6D2o+Hb7PMn%!}ZNWFDco+ct|#oih1a`QXY~k+eM3<@|?3?cQF2a&RKu&V&xpE zkRr|*vop@=Zoav|HZRJ^Z)_6-*=k6J5M!H3AY&Vm;EiqW02$jX1sP+=z+r6jF38yC zkW#kkHkd^E9!!wm+pyIT3Np)vLH7SxfWc$^y^T~wbg5Lxe+vuzR44xrng#T@x>)%3 z)^q8jQq9GS;?sG$k-9En$75%3(#nGmJYrWJ7}-hs^`Zm8wtz{}^3to=&kz*`9e~E6 z6n}J*2Sd8he1Lm8_tZJ zJ%~7}s4A-?n`~rJxqGx@K`s2wf4sZ&71?Tyv<%`)UbjVid$Vkk2=_=obcBQ=EYZurLi6OnQ?G1UH>H}S#Y zV`!)Zar@!;g=Y`vZBfdx9mN=q1%so+);7&LPoq$e;fBtWf{33$XLT$&8#d|+)M^4()%Umb_j}^tyENs25BDkZbiIgBWV=Dj^9N@ zmj+NZqc94jprJZL{uX3BwZ{3%O!|!WC8<|KVyM-^9RM<+Sr+=uRYLCqkcFG+kZcuM zjC(urRK7TWDbKIfcB(_SltxQFX_RJI6d2i`zx!gW@hebm(VHsHna#BcN_)zNYR`CqC!CgU$ z7_fOp+&@LKO6@kU$xk!F*HKsLi@Md5_T_z9FeK_W=J(eOx*h2-4Ja4tOKXstYCa&5 z{XE%!i|qfY`8Hl1(k+@Mt&b!x1Tv`}7nUR7ISNtC+ItqU_Cxtylkg9t%I&!*4+*=#;%3|ES&I&`JN_jnubi- z=6k#IT@JFiayn&{}8$5tLASX=c>Bcys>XORg(of~ePJBl+e?>m39yV)gIKr?UDDppqsEhVuOa zRzE;_rng4o1w_%`>A~}KLfQsHVq6X0(#za_yv^;xc%|d{%W!`w!#~CtM=7T@GB@vT zbIJ;6qgv3st*CS@AHq$atg|9&1>GkVN#%6UzcRhqSPmJ^6{MK&8PZSG%4JAj8xHB0 z=*_+#?{PBF9e_W6;icmYb@a_WM_|Kl3qCXND+*3r*Z;kL(4rw%CYE#nNnzYd>(s~ae-K`SaR{ zg@MBV1ZhQDL`f>#d6B`(gn^<)jI{1fkc8?J>fHQbPM!!YI7C{ul0-6~mlqre!oAW< zKN!zkJ-Q;jJog)dI^!9l>BGp&k?_xOj&hlmS3QkZ@f4!+4wnsIN!7iZN6F13Zs~6> z?_3HDnIru(hJk8oi3*`(^UsyPz?s~kkaYax9V<6%7P$x+8Pmv{m6lE%nXAVlhtmx7 zNuJcBzq}ROHXzcHmzI(;MOr>Cok%P^XtNZjXC-{TMmFpyutmo{&qe1-ayOEi|c9I19o{lBF?{~|TM)B3c^yOXe5 zd4-ydN+sTeJ8YZ2FfgfI%x?>nzVYwZ1@DyK#=>vLcK75zp@K(&Uiw7i-82V6#!dxZ zD(VO6hado*)r_Zf%B4$5xc)6&8JCVQBk@?Li-K$n zkyf)9Uv|DCwHf7~I$s$kY)sl4E-pW3e#`kv|1!$UL6+`XkWrStY`*dWjZvNgGPmg< zi?PJHEpu+}JS#NFQ@SNB7yZ3;{s5FnI64{>S+JEY&S3jFeqq(zcxC4)U7IlO-$)+h zUx&PROqa{Z$}{e>Hd8S-TxTN$ozm0ks50+Az*J1A#qU4lPv@Cxx!}Mv)$-y}xO9MS zG9)rI?)&EV4DV5&J>1)7Bsww|1(^)x4KE|%qT2Cu2U9X$#U71IzKN$TC6$i(vb}K# zMOi(66sR^*QxU0&*F=WSKa9`F&_y5PhvG}D!?gI+Ec;Y~$*IJaldW1lC9mN*2MXkw zZHT{@k|tKJBCT@>*s%-iVJTQG#FE)XWB7?@F>=H)Yp5qSx`^1X57lulq;+6OOH`FQ zc7dBI&YeOek$JajW|J=IK1VuXJ?&AbCu(WwTRkc}cx)rOT)cAcviF8nA!CDU_=x+< zHK+bhv_bskTItz6hD%wEH((ps!-jSqJC%%07*39;i`kv132pGttmL7;Y>byeJ0lr6 zMbm7Gf=HQc+AY6gp2*3YYZ~omQ0_fillPk`q+5;!a&Er z?S#J^(VqRtRif7a12u3(_EV^Gb7`{SwV6w!e$}W*XS|_f`W>p^>7~|_R&DdyNV}Vo z*`El1C9`)*MWfbB?|!i$iKWl$chPdSG-3Zk|KmNTi0mS%Ut~WvX>GKjHa}K|$PVcD z%00Pt5osi)rRwcig{8!*gXde|nkh3x}6xKldKW%S>1jb#-G^ zn7INm(|v1gyXs2`@3l~1lAilJhQy?|e2e7K_eCF^`DQH2%$r3~=}N7HOxt@LS>TGW zZjYd`@oo|}I??`p5-X&c%r?F!;b@8crDgK}bdUTyz7wyUC?ZP=9WqUDMJP;FGh-X7 zfdCO*%8X|nd&IWPrb@kr&o=u+yxHyLf!kU&Ng@tK$+SjDqfVZTM6 z5sYW&Z_|ingf#a2Y@a@q(`JP9_J`gae-4pRfZ(bZ^ET4eeT#9ZXg==VT7JS|B(qpP zq|5$@NRgTeVgmPg=L;6)dJ9hMmc;O>5HSZ7pCg2z1P4HE{tFitat^`wQq z1fCGF!oOasKl8QWebvwy4cu1^iR@m!hPJRu=)H!X!lzI}>`?YqLq8*M`5N-^rG^eK zTSJ!-z-ma#9KUefaO~*?HI&U5+tDTB9-}U|?^VN<&Mbo+VnV7@1)ptQpByc1E9V#t z#nuOMCsdO)u1sFp`xLS>S$?-5`lNp?`np~FkmLI!n~Tn1?@9L}x#psbOd;zPs$c>% zGP64?(gzl?pxhMgdgJFVl-`Ri3NTy(Y?S~=?>d_JnMSGEqVXWkw;K<{GZ+v42FLd` z9w?vxoFfF~b0upd!JD)v!{J!=ZngJmz*!owFCIUG5aoG%EWQOE4`y6p6wwHm{Z<kLEs`XsrdFeP@YPFU>L9(Djf!l z+e(H3^vY!zfNKiFz!n__(nmVRg~fBnGr|-)M!?bHaR?r+Z-njAo%LPc2m)x|DDFJ8 zX`A(p+HkI1U)(pulfJ=zPm64t1bu_Se@M5%|3;nh82pu9X4Vj5^x7#d-09RPlV|x( zF%sWGix+hY+4bvpr_cwn%g&4|Y-a4MQ{19+qjn0dBWfhUQ`LGuHktLM61fj1<2zdo zENopEotn~V5iH%U~TS)n(q-m?MK#~nv zQAVNf;@fLW%)z7IEg@Is%Fn>EvAC1rX)l5V!;{ugx0aAf?7bzz(7m+82FVn%~Dk>!ZtMrOheKY{E|s$WAIII}JzK zSoSvZ0FaUmgRxX-tci+M5zWkr5SPFjvTJ?)8XDn-_NMG{UNp0MNB$s)-KO(> z9$!@zq9(8>1*)o$?cXcZ_iT`*b}{HERWXq9=Sub60h*!c6o$8HiY9^VcG!6!yB#K@ zs?qx*$Zm(tb>SAeaNh(Oy<42`kDTw%L6*j^K}JR1Xf{R3w?U>Yya%;os-p6qtZ54$ z3^Hxu6G5geJPBml!c#z|Ej$ZkxxX4@xt|ZR@-6~dx+_87(DI6=Okeq3 zkmaBn!NYR!A&})@EXZ;&9%NL`aY$@GUae{Dij*-=(G-x`)X0Jss@r{_Rz;74)@b`y zAe;K?HXJlr+wByGu5xGvXpx5dGwAag?w=sJ-dt57XS{YmH5O!fPB^!#LEqB2Vk6Uh z?*ZMQZY!PJQy`=Ax^o*y7<1bTWN|;{(Af@2y_@g#4&Ck06Ar!M&>pOWEyhP2iaT_X zL$g3u_Zg7Y{j;F&K&h%?Uv?p^S6l+JUU4d$0@l9gf~_JBjLf_|c@z3$v1w5^3Z z9AqUItC5yk2k2Ifu?ril-&1rj$oj%4koAS5Ko)MS^ZkVLodB}9XMn7yd;_#t>3JYa zEmaeiZ3@WBb}`7xHVtHDTLiK^|J0#JKtEG@PdK-KI5e1Tb}QR3kfk;aWHp%qS!xSG zmfH0oOYK)6OKqJ)Z-8#s)V4XdeL1?Ya32O)YR7{twI4ck0p~xKZZpWz{Tj&9Z3S7n zKLQ!O-#hd&=$D#q&bjT%`Im(|1Z3&ffh^ruL6%w<$Wp7~T-Q>IfGo8SgN(`qhrSGw zXAP?=W;nNRIkW_1sr?3IsXe@Jh;ksaFM9WWA*y0(ws3lMU94Om*Td?#zwH0V({!M; zKY7&;nK!NMMddWLIW6ZS{s4@8>zVvXOqKmPlUHr&h6x$ zPW3&UBCVnky;Lk%fu9 zBl*fSN73Ij$*AxahqpjZY=fivToTHw?KB>_TuJ)#g=CZ0#s>NP5t1Y1&93AKu`HHd zBUvckP6q!;7FBHp@H~m@6tGh4m_nD z#WT1<+c94p#N7%~=MMER{1@7_!4{nr$d?ogHz z8cxeYOPbqP_HGf!FZh>YZ{VD9nX-3knXq?$LfM1t{_GKYLQXmmtSJ?i^i|y>Qls_G zVV>4`_Ke|TiJeVUc1$8ei#m_DN*5=Y9q{JK(8@i{pV1V0E<#~d#bnU$bkMyRWa9fY z(0%GQ%eiGh%hkPCCj&*h$Jw{(Q+#(Y*Q*CblQc$(?Uun8GwA8>(zG@4^mw4B4cew_|{*$|i4Z`-?S$*J7GH zH6ZH!A=>^j&&WK%=cIv&!B5DuL;8*k$~0|gkT-d$KVmbm`t)qo5$I!Z^YD%()I}nD z>r#GF+23i4XT>JyGvRF!#J6(A=(~QxV(d;a&{^l&c5`Rkzj3i9n3W&SS;BjkeWYTV zHN91q_=Kta_%O=hD_P~YUbJiyUTdc$UK9!}PJxz9!qYG7sD!=?FWH6sO4Nb{YBt3L zmh8%%(*n_if1^f1)kbr{j^Z~(k*y3LnAS>h(Q;E6y2^y^yVHjiamy$vqUK%Hc7n_n zG8U@sL>9>{Ge34vU^7mxP6jsP8q zlRqT2IH|@dN(HT?dBjkMv|F%vDAJT_8nIbbrG~=-qr)0Tt*@8n=FUV-s4eQnxEgz> zLgKYL03n3 zCX@=qoO&MZP1Is}F`UB1C!E5+cYqAnwvb-U8+!Z5 ziWo6N74N6?P)#kEN$b$f$^RregLdna#E_Vb-NZa^)bLc6$NUo6mQkBv1Z z3R1K!uvorDuYwv?ryl#=oHT!sA=YJmT|rWc^U>MHi%fY2~#OSj0c5BWp=z z6({l|d{4^`V?U-yD-Uy|rllZvodi1#8*| z5hl7+IsvYs%DtpC5D%{Zs`{d>-1|^pd`jBBY()t>QBhogbrqHHo=a+$=hWLfJ^MwCoN* z?&lou1y$czRP{TkqwZCo!>!kMa@C%W z^}EW`2T96HFs~%oWlvMD!JVx1B@w| z${Q%X_xceUx-UiCt(*b(sMI1}ejfkcd;Np>guR{xS>L+2HxsyAtzz2--)_oo7}DsC znK3BCJ${0hjsPg1GXlttNAByeqxSmTi3AHKsE<|G(8w0eujf)j|X)vEzA zvqY7@PTYzH)spd`LOgfElz$}k!gx?Ta<0Uu-*qUbuI1}cI`R9c!#KgI!=eGf>hMsh zLph`@Wx?W3yRSr*m3L7c4HCC0$8^OtBrWA3}? zGDIzM0m7JFhG_i_^K52zt?K@VY&s0v?cVdK8-^oCsNWn0DAE0wtdRdkk}uNzze$?h zNg(1GNFXSQf8ubGF}*gZSvQ3al^!GK zwV~W`2sILl9KR+~FCxdT1n*vb|0G(k^WLN4(Y=1U&3kI-s5g;A3?22mjxHr|`8tw` zsaqYTyuXyn8!7LdNK36`*n|ybvryQOx9oCzN*X58HWo<&|D>09uaTEz+~`dRTOl4h zsS(*5FAOL}Tr&@kZZ%SNJo#+7+DLz*A2s1*fRbAHsEj1N$pG_F+6!a=VIjw7J!F8S zbTl1+t@FtwB}e6D2jIQLb0_uncUZE}%Zdl!C-CX_B=u9_?6Oj;hi|umIN6@OK1^8XOgw{$y^e|sCiYX%rYxud&r%h%Z?eEU^rM-woZ(tFm~ftrTS3G_a>!C2h;-j)v4jiXEsFRUd?#GW>Z zu#?)kg)oI4Sj!A27TAe;Lgl-wL{Nyp32;X#02=I}*r+HBEUrc&M)&EB+LzA+fVR+af> zuB?$gnMlhI>EppH9`p^7WrKslgNYUlEwxg}3lqULCbzEGpXfIJN|JVYMvaE`HvYaO z9cL%4FRJ{7@uX<{{Rtl3#^3U@_LT%K-!(pmZ$HN2NQ=Ca9L(KXqZc-EX^G{p&PcVA zhSf;%h*6lM3pMh;a*pm1wy-#iVx{7w98_j`$7`WkJiey!~N*eQ}{Nqyx<>~ZjCj)e)j34 zWUQ|~EouI@_i67h{qEMHU0A+b%N}yKZe1#6Mp{-7BwC}gNZT?$9il4y&l|}bfL}= z!m>2d+%yJ3HK4mRnLWwNbnM8F#Io$6;p*1OK~99xd?fs9M=ge!F69%v)g&MCPdwz1 zK$K(mGMPub#Yz6jQIz~*oO|vAO8_M%<-)={b*{0zwSe_sHZ{;y>50gbT*WE#G*BW2-4!_dNsU09i#%Fr^d4|-kAv*$pR~7KeR&CFS6|)*+0_@Z>1bD44hGp(l`#&T46-zmAiGK< zI?zV%Jdn|oGYO-2Ey(EI1TuPZQf_FV%n({~xe~cn(OaNq@>5kYlDd1yd_i)FfyWX- z>(%WJ&}6OC#~m8RA)>h*3;MkJUIcndV|*L*xS~He-ztt{r2+n_%x8p<_48CY(zQ~WZ{l>zQ;P>6F?Ss9LUD2Z-8vPif|p!#*z<#Y%Dnf zWMj!kK{l3r5@hB0l0!Fu?9%9Wo!dPQJq)t)ZUk9*&*9v}dhItrM(;+4?gtsYmCkLG zLvqMu^r|_KGJ2Cic6rkWy{I+xILP|>R*z1Wasu7hb{wI8ea!l8iTk% zXf-q(WHlsqUaf{kgRF+)AWP!{hpqwHMb~dSw>unq0A#5>39{6ta=dIcbS=o}{luY% zK}PR!=k~fo)g0yRi$m(Ss$mqT7(2xVeOR_^j=KB$cCV(v6vp|;aI*`@NYc5>%L1El6 zAiH$?G3R!+LzjV!-Yk&Odk$pvQptk>mV*Nv8V53Zr#iPUIFtq%y?G#`x5pvj3|0>^ zdZ#-y17z29XF0c<9J&K!^zH*0z38D~c`pVTy{jGiDah#E?%dWo^a9A}y#_LR=huei z&47&Ftqwg1GJ0#B+sh7Z1sT0TBSLzjIczibT#(WGo%`oqKWP68RdFFW*IkX=yzzH|G%Lyv=u-k(55Z~PHqc`pSSy*Umo0U5nJoZC8w zUIZDvEg+*eX>?fLD?vu@+YT)Q8NC(GZKFf4f{fnVAfxw@BSUmH$gYLm=G>gcZ@W4@ zRW7|viObdL@Jex2WWo6Z5%0s>T*EN)z4nx@7dKb%4?VUTB(V?=2gjGf6xI0E;8}|U z_OSWOzuMLFWm7t|kj<>jwa@|ljV=|O-!-^Byz`5=W66-L5dN$r_+XjVPea+=F5=2L zhfsP#DOK^8g_a2D++(YrdAwdSJ%&v8eob_#-2373tej7TcazrcI zcs9O+H@PF3UkQ1Av*CSFyizDiv{l6KJtJjqyXHTx@qY4t;|2GDa~F|vGFvr(_nilE zzubE?CU--=54o7PR;}>QX+V?e8Yx#-d$en9^J}>|e3VtT%gH*dtZ#o*@gD7yyp*)b zdpudWHiZ&i-J^vkiQ9uGiPO@i>8ZU}V=wI)R7L(X$?Wv1RNal@;+lu!I3;DaSVQ?0^frZZ0p&bhfFw-LGSJuZm z<_iv-b*tKJ76sR(#YO%VUAN{Pz|~wFmV1m!La$Iyl~uUD?kwlpzNY0pV@XJX=0gK# zNsIk}reMEbwl#R?L_@>k+S~2Ma=fdJY-+#hT9f3avOIq~QLZb;MdP$FH2jEO>(~+e z86yf0wH1&jXVKtQF}oYz`Wnmr`<|s%^lkaz)j$NyCo|KzX9`S_Hq3=QrBD)^Zt<_r0rOgsYE?X5Ooev@A3yVb3B!xE&|HG$YFgOhcAFC&EwvD8I~Z!W@% z!I7cA*~Aa`Ts6eWm5rFG`m&brJLOCGC(1#YrchPgu9AySZYGP_vXetNV6M>0ND{Qk zyZp^~c03oCdGFBwg=9DB|7H$9*e{oYjLQyt1-e~aaEjh5K=X=qZShnawCq2kksCf& zM>JRF?iW#a5p(b3rxpi^`=?Lk3hJ(E=>7Dmf%*!sSMzK&LuJ5CP5$L?Mp|TEh}@lB z%+EsZdyTIqZl-+)=HKI$#Wdw&>U{)?`)3nOvm=wQW}Jcfo2&3E!#;gq6wDn^)1S)K zc6f~~j53MzeVH})J7P-dRyPjnR)k%`A}sn215tecs6V#=0>=3fXpTj5ECYt$-(*tga6@~4(fCpU^Y zt-S9IoVpYhv&s9(dZ~kK%En7Xpct}`)Qh_uI-4QL#zB0K=xJ_&8Zldb3!XPlgmtC-+Bo zd+BgX@WuRQ8$aaRE(}p-&aO0~#1ZQP8pq6o{D_GD^%8+`SNbBOno!XoB2XTg%>GES znautosAzbw__dI|!tDJZ1UExtv68ypDC!gzjO)^uYl}v738;y6AJO#z4|^EL$XS+r zzmpj50T2BOxlLzK$#lJiau0ZDb~HW_YYW-COL8d>c+>@X&;40VEGr>*VgFhZXs* zb1We!cOAabju;f=Nsr#MB#dod0iEc*?5w(?vucTr_)9eN7bef*o9kX*h1^0#At>nO zZ3-&85{x8TP%Wf9_8q<#NBT`8FWwT~o1Z$u&|}L z$=)=A2SA`V7H3S9^~@)aO*7eS((LF>Y^@kpTVsr#L=5S113Wh3-S9$tFT@Ij9*B*2 zwUDBZTD{YV{ zQ(dn5xwRhDmA&oY`x2`_N$RS&g|zb}tp~eMtq-Oz4(Jq@jFNDW9$pEhi^&!E^<07X zQ*YWWc-FYJjC54zshhbObA&)SJ}^Xq-MrK7p?OxPL_P!e0z!M)FfyhWln z2!eZ`%^z*@cwDMr7HKgFG9)6v5Q_{`8SeUHlXvG5@$Ucq$9-gJ&=K1}EcvaLUmGg; zkzq@edw9wOu>eTjkJj-X{mTtB8(9snvC^G3AS^^$#!I#=14JF(Th!|AQD^hqI{R(X z^O!yF(t;IT+{nhNBvqcV2<+Dr0EJnW5)7%Ef>$g=7z+iJ;d&bo8SP)Z{`z@JF0uc$ z>#w!ME-UZ!XV2|<cRe!X&xjnb}n(S6oUg^uNy=EVa^JA1DuP6t1)@H1CgxTDAR^_`jhP?^}SB#Wn-*-u{`R%Or| zsemE9b)p{qZ#MmpP9)kh)Sag0)Fcs@MXFFW$!cqOO%bE@Qk3v%hM?gmcFXA$AsJqt z7SDe(r_JP)71$dxq;yyQvYgt}1wl?V#UQ8Q11mvJH%MlfGfoRtw7P3`l`4N>+{Fy$ z^9FYB%3sZwkfW&q)&41d9VbLr2un#$4)06xYcPsmgS3}Yov5waWUwtVy1Aw|Z7o^i zzKifyRk0m(6T?bX#i8VF3JcJxilacb@hTSv4awkZ=uC$$22Iu&-v?FfCUHeE&NepN zLAJ5k39{7IgKT4SD9kSk8>9wmRwR!<8@+QKy3--qM*X~o+W|5qp#2z;EVV;GmfB$; z%gcvBmYO`9J5ckN1sN3?<7_K=Gw2u4tg1Mbny^jf?}LVDj3+^Z6&=KEzKfzOK@mms zL1c=!{|U0Z{19Y$`5DOK%9}Hmm$yKs=pj?Q#n=sGF@}OHjSRxqaNZeZip?hkonO6Ar!WP%Z0eqj!-*-*V_~hc-D>fxvDt4tMAj&|h_GK*sl@kiCrC#a_JeJbNd{d$)-dgJJ1$x5F6=s&^`iWZuKZG1qTb=EREN9&E2kN2FGN!SEfHXcY6h$ zEYiA|Y;5L#W~*IPM*gPaRl)q3|LolDa|oC|fe4Hw%`=Jur!SEUI40=k#}s>{iaho! z_BgKK5jb-R$t;AfAQ?7An_0f>X?}J@h*{QcoTZHBJaF==qX}b*K;uBB2=rO!_C?VD z$KH3qMRjz2-vv}q<0_WeT{{*~uyjwH)J0I5>>^+^F(N9#7P~PqmK19=G4@_! ziN@Z0ixIKMUcdjDxp(#g3!3tL@B96}=O*L+x%ZrzGc#w-^qG~gLN-#OcsCk|FN4h# z?`Yg&Iip(u#1|1Q2jYu}wg7P(6XccgyPRrTO0|kS)lBx;)p&B4YDw(Li) z2!-3m&Oox<`kwk8$_43Zw;k9y!9E!Wak4F@S>)jBQj7w4jI`-5P$0b0+GBpmD{Vvq z6k|Mm%es!YvI4kr@wDlOWlHVnaO9XwJpwRmjrc-mP0C+r(lP5x@g){jlKf>XVAd#n z!NGkA-V^+EnCE!g6RjDhh|{-Gi)Z@w(R;O{`xDWGaGY&&hie9P=33$<-CoA^kG*Hj zdag}GL9>XsuxKS>f|0kq^dkmAwWFUQcxAuWbByOPABc_m629qou-7HC92k@#D5z$; zteuRBG?l{23`!APi}A%PbLKpJa?2dMC|6*a>}xq6%`NaLS&Ad56oJ@5F_9p`5Vg*y zO>Ba8ls)xk!tqK@9@l)6hc2ASlRUIPuHfXkN12pw@=%9D*$kN@dA8w0e#t{K$I2lk zIg{rz7Fd4C6T`l~BY8YQgyeBmC660k$;neD-{h%AM7g!+1@f@qeklLH#O>Z*wTI?b@=Km{#)N-?vQ81svMfE_Q zqj8Sp8HEp&JZ16}E|=_ROR8fE%r9L`t=^F)rt(OS#ymZ$ zqcq|22f6&il(O_F@5SpFxqi|2)A#3VPR>J2UeDYE;`PiUAYNCz1>$u@6(k#5D%>{5ckC-5Zy|}-_Z?J9PJf|F6rf=-3H>JwSp1m zq0y#4Uh8%R;-U2e;-L)#;{Ht)=m&vz3v^ka$3Q$Z33WLSt%^Xo>RhZA#1Z-9ka5gn zWBQCRJs6&!j34DSVR~q)0zb-Y!t~(vJp3rH3DbkuBk`lWCQOf4rk^eCIuhFEVJp9; zGmKTQ(a>X_P+dh|usd5`FGX+Y5sJ!ceynbm7nL{*eo}dkVRa5$-_|u zoYfk7&6C8!B24uB+hZVh1GqU6UO38<(C~baT(fTw{?lMV2fiLN%NymHtsJ}r_I#Gg z@s$ATrH|PzjA!>>;ZbfLA>XKh^nZI1T>qW_WMp)sEVee?oh;xqQVqU}Dix>!Q;l?i zXx-$u?A>ahCam+b6^M6&HONlt7}`k9fLbxs4T!I9iWX=Y5buQ0aZ$YEv=4}PoTy&q zzFZJrX<(jz%?9E={|Ur9PO1xq{%zHT3HgtzuHyfHRTmR4*ych_4VY-GFRYNSRx8V> z{)y^#_}`?uFu9GX3)UEOK+p8+sKLdpV%o08{dZ!Mi}Vxp#6}9z_u!rO5Y-xYGSE2H zC&!9b`JNqNplK$YW?Ux)>#T&Pw$2w3W|jxO_+;#N&)8j%jdsgzqnoH~ zbYEekl~730-MNi+&$#cMaVE=EvD8-(=wG$ed;bd0|D>f3Vat{OEnD4*Z1t2rh&;E| z!+^N09wX4#K-^ZZ0di*wzYU1nYFlIox3X=4xJB&^#BFtgK&ybbt=)bUmpQ+pI-r~Y;`V$$4AQw|F0W%3W>EzMk+z7wf5TFzZbeV7%d>DT@YodxR75ba9p$xwc~k~nXEyOOvs`Rz*LKEHcc5|@g0C513q z^4pcfzy5o>lEPVNv@0o+pD%KLqn z=Bx8CH=@n1!NSX~Ic_id0A<;7jTg#Phx0keF%7d%5180&hhJlU&JNq-R~r)6WCIWF zfaq3k8;P2~wHczJ3I~R!3A9U~-+}6}uQWnipCR6|L_3tveRKqQ>obo?k8*S3%fpT z8?Aesw%vBSe#;pQHE7dm))JTAdSTmWWb- z9(r4hPoev)9ZgK$8JH0{svVsLjO{44S=Y&DC8L#qUf`uZ&L`7br*By*=^hg(%O?ZNHo8Kf59z|V%&rjV2!u$& zVt?qUj&fuvli-l3p2Bd?|AF2aE)tGj_ZUzw$iyMqD+&-T5fL&HMQ|?X(>eig(MHM4ly8&UyfS$mt6^hm^9- zEz>{BE7Ly#$4nU8Xscly*ru3wy?yZ7`6#nd*spvJR}?`GQi^eOd>zqyX|{W1_$LrM zSQGbp?ePqOchWlA(4$X#UPwENRu5>`Aj7pjnL`pLc)d+~UPhaC6&|={euRC0hcdRO z?XyaIJ}?Q#nff;-)hs>PtyOAy?P!`aRr1I;<2Ub&UF#deb6gLi$K6FtJ5P}y8NGBq z8BrKxO~LYfe@u^gmGt7xIQU3^V%dr(4yoQl<;F|vj^*V=d@?R)U1qWH?1k7CLGJtL z*W1B+?|R#F#yhDfOVBJjMFxSUjDWAbc+7jTFJ5WS?X>Ar@Hx}d2fIx?quOauGiygp z#;dfgyC_9WA7=V@)$VIGiHu-U(UG47L}^Fg#CKI#dpvs)scQenA4o=){_6;3(ZwTd zr=}Nxve~mVrZ?qVb8y2mUDlBCEQ9TlR$qsOWp$KNj53Q3}`#=Y(-B5rwqpR@zb4_;Zh^7YLNNA`v!R5pgAy z-9lVHT*8}2kmq}Oc8icV4_)rg;x9@8`Fpt zRfAAg8T`WxC0Xw62qcf8EDRO5&9>ooOrmCX#{H}d$ci2abupZcM9b`Gft`)?EfkC+ zS~9(iz0(0@Vi~86PXc|Ms(X*o^pf(aMbK-PefWBbw(tsv1Gy{l_ zX@3R8$F#oz;{GiI;-l7WproHO4lf|?A1(evZD6XdU1Jrw2g2^wTS>LF2-|0|IU02`N6!E`8r;gAA~rl%iS{2{5t8C_Hl}Y zQ%^Gsdu0YBq-|g|c2bpWN9TRq>SlPLGpYUv;yoTI6r*)i$!F1`QFIYOQzKuiDYiL7cwrlcwzEV94*9kU27>y++D#w~?ck>6cP(yS1+k z8axwEfLfpS8Wju^I7fuFqiJzaR$=_3t>!9AtR3B%sk>h1-qJQHyH)S$4%ylFUigl5@DXjC93{n6LT*ZwVzfNsOHyp+MdV4 zC^?kS?Z6If`E zSJZF6Rvy1N8fyEMk^tST^xLo6y4(G#U6W|-Zg*C1_s}h)lYegRduyYeveT#49#`$mJ+8Kwl4j{MTWb$_W5;nuYWeJ8z7xD& z;Rqz##F0Lkoo&3eXb^bY!q4K0pQdHGeM0wQx8C-mHl1<^Rqm@ifoRhk;S&PVXZEqt z9@6edaJCt#B{O=LVFIQH<1>&g4p>P)m(riNpR-=TQqd~edMGt-xY)a8v9;-B#&FOJ z0#kk3?Mia&z$bmCi#~IhjrJgmn{CFB${DFTc%Hh@Cu5&ay(6f=ZS*W9wrgi@ce6dC zP0wU(MYa1VG3eB)BuM3(vER4eG4HgOHri2xKtR2kv7rPe^s!;WUG%|40Au~|%01Iw zul?1h)k*EB4n(0j=9}@WZ@shLX)nOtka6$Oj;+bK13C9e#$A$eSJG?u`?R{K9i?I1 zXW#Bi8kt2Mkz6Lni+Y%@lnvaZ&}lTjDRMQ&tqANwWi+0Y$_#(HDI1qrH;gqYsOVX) z>(|{!)N`I6ku?s~Sn%sJVMGyHY-wIs>MQTkMT1e3R7JbSy-3=#qNXxw&pt3|z2E+# zgbNvP9}?d@jq@)w+OeNAwd8MTucFI)3nQO$lifDoMGNn-o`FX)ZI>4x_mWo{vh!W! zT3b7MGDO6>OBP`yCe|J+vGr+nQ=3kW2^@j(Oo^9o#%=GX=e^(l=9Nj~X6P`Dq@PaO zHN_jfJw;Y(8~((1@3*^>(BF}FJ-&Cmv#gOXN?`eLQQIJA*2$^G+Dci)m=AKm@9@fk z7K|d*#HRPBICA0n1|4D}6mB4P;rZ120|$HgX1w;Uhc4lEZ>{Gcj7fUe+v{8JGX7=^ z&`X5}E%Rr@Lc3xyAbJx=r(^sBTVlCVKxLYWM3Ngq*(Gzo0mBB8lzEy}2LgIOz2KYC z9?9&J(E$Cnnlq7~Nc;WX5|` zphrNoQ@}>DMN8}iqoc*CM;WRM1O|LH56%WD`(~N%DF3KJBcSaBt#1~pcSrvqX7u=x@?QHQWyBeA&>K2M`W(!=( zgALc%f%z#2y!kkCs&8hbj!t{IgvFZ5rf#%d4tvq|bJ8&ESj-H%j6#g9_owx5k5hsC z0Uj`G_yQoGB9*rsC`F3CWcM$~c-_mdIA&MR*LW#rdmUp=+m({TLLrHfMDB<2ixhW9 z`*t|?v`-*_6-PXh_c4KRQ@t26g`oqy8pwdj!-U8iXy3_`Ooo0wOd2;>l z0mMs3fAQ4-#P$E2prdgFPL~D5{d*wjEa;}PMp4mCpUlNvH`fc@46#-8(krtHq=ZJG zX}XL+hVSK^I@yfrWNF#7duLX~H6rNZoilwzH(p~b!|0RwQF#pLnXdU{+)}P}h8`Yg zdMK;lWp6CilREI0z zocC0~1hWDf0EI75z##nH2}#J+E?gj*qv8rkGgGwh&_*Jo%oUKD;ama96m!KQQ_R11 z0pbd{P0&&IlG9Poj{A2~&;`YXhQ%0krg&XwOiX-usL7x+CWM9?bdm9iy3m1!IFl|s zJ}%A>ZiS7JC@rkL-YlYI3nqbhy zg~l2zd2BMoCd4O(g2gNogd1!yNj>9}Vj^^55P7i9Xo!m-?`1z7;}Z;Vx6V|5i3VeQQX=xu7!{vr zLMB=!R3(kbdsPk@4JJd}P@SCK;h}Nih8RavctUi7BXlD> zgBj8R#WCanG=w3VH8C;N5-6D=SD;}Gc>#@J$PgZ340SX{g}OMBnN4tM)?CW{u1U+L zdEPa1ah6~<921S9?3eLK#=(xcnc-m$8xx2EikeRcy(F6zO*%$(f>LWT^Y8BF(yW~B`lMaQ9dgeRsZQ1wDoOo_=-MaCz^sjXBFe*?SZ z^%}BMgbWcZ=o~T!sKkKWB(6i@|0S9Y+$kN`y(YH*E-4nr!rIK?Lp?5R>+Rxt=Fv|NowG(tc?dNb6J z$jU!!AnFV$Wax9K(@qjn&!K5EA{*J*`<< zAgQHx3{h^lGDNx2i6I@32Sbz_-V9N0_%KAd;m?pOP&bAsH-Z?V+~~y+!6JFj4%dgEcTdG1?RrD;s-X-W!r_097))3xFshTGU2UIv`4AliOTSd|6PA zQSn9-T2ApXF>+5$NhbOLtH&)Gb>Y+oiq%Q+kt#pbq&lMsO)8}uhaMu599EPC7|a8V ziH;*cKbYOBlbTB{q?S@EsWmRHXe+hL6(%Ksm1K=EjzUslsR){~c2ZHP z7>;!M0K>OhBx)(iUMek>k;+Qtqz{o;6>|7cQK}?Wma0fqrD~E+sxH-#YD%@F+EN{< zuH+!qlj=(iq=pzScaj>RCUKTrq$WA|{{zwgf5=P4N^rf9^c_37xqEned3WyO8XOZF7oRXB(P&BCrd0>ZGY9oe}3?{U8jq=EhWHcnA z#&H?-XL(n^gqDOZ z8BNtls_@Vuj#qqYs52!d#bJPs$}QDZ;k-UlzU$;3IU4+tNii{U|5)i3cSBtRON&;G zDR*d!KT3}t!+^=g9HALfqD?gFU`nFK4PiEfkRu(~8$PH2lSHFKh6p}dB&9eztA=WF zSXFbg-jcNnaQ9_(4#n7!o{sLG-hMj&0C&H@KrdZDH}4+$?(WF{-s~%qsxEhnfjHwtJj1^YK zEUNg1(jarAhBHV$2+PA@3Pf^jras1s3^b%CMv={)<(2Xs zUekblj4q7E)DtCrfVa*hrx!eDBN3E-5lq*V6hteM8!%bt^1eq)RBo8Y8PIfyM)yBL zu}I9+#v(~X8b=t6;fc`+XbB?EjBJc9UMKgNf)mi*bf^dW$j3;iT+o;-G&q`O5+Zb| z7^yd_+dz~H3<*YH1RyLGsl;rfY_ansclVw8H5KcY>7KfjRKgN=mIkV6B-sB$C?JpXpbs5OL4FeI#qB`Uosj}C-8)!Qb(w!q(pknTHcDL z%05zkLMlv65|mkUH`aphT;+2N9m~-rUlazEGT0t<{LQJ8HzkyOWmPle3>Cz6TyUKdT<00$BNr$(e1@EC08N=o z(HMsr2s02JhoM|_*wF|?s}VIQ7f}|q8@F+_8@Ei6WS`JT;Uc#$reDc$SPT?h{UTW z{udh_xzQpfa(_Us7)7gv=1asMG?k(Rqtt)gGuFQ(F=5yx|CH45D3}G* zap4`&S&NJ|Mg=B^n%q)h{xF{QT`}h)%T`~SbuRIBqqUbR9=@~U%DNdJ*BRtKdH9Ce zpEP{nIeUJsr!k+ey82LKTkh4w^wYZN@MyoDLl(a2_07laraqcvn*KqrH4_ti{gyf8 zZs)S2s(jP^qt(6p>}YkO@t37T9@ek9^2jgu(?cA}r|N&b*Ye!DmFH6@mMGskB(uca znD(DlUAaBE?5Vn4oHw6sv?3*>Ur5lOwS#UHuSsoItnV_o(#@^ArdD@|JYaV^^z+5lUxq9j?&UJ_cK`nUN8kG~DLu=o zW}WlnDjBjrZJ$x|mt`}K{TUytZPoEn+984H_qT^dvDUflII!%7F-Z?j=m{g)qCF+7+*RI{R0 z``*7sjw{h=RE05j$N&6wy!*~?M~~PtAhXTsr1;B5-S+ga-730%H)wm0uqDU*3MY4H zo_Og^rFK?xI@UUMxP_N}(Zk1XY0u5s_P~2zVqlSvD$O2wI`w$%rx$NNsTlC)S{t9# zHJdNT%-m3To6Q>k#oKpf%(P=c4`Fw5Gl8t%8dkJ@@k1`pw%?gNnL@ zRNO7iKbe}?(DhC2uLmAjSncJrtZyeitKo9)Qn{qIWe118-di=G(b8^(mcLlt&Lw1Q z&DUNZIR}oqB(>kzv)|l#M^$Bx#$lsJz3Q8#Ll-LJM4BDxXc*jKYnH1zR`Po z{kpOL!narEmAb!fR=XD^*QHf|9kcpX=f1~|IHq0?{KDY=Y|SR`iAN{TeA(sf!wXlM ze7ye~ed(8BH+Nq@c=lJ_J&jLt^EY!pKKygF2Mv7Bo|``F^T|I9nYjGcyc1IgA3iei z@a5WjRy69{cH-J;NfTdQeKIMcf&D}Kb>qfWzW>4Gc>|XFSKc`(>hlMOjx684XjSBspM5ps;AQ_sKd-%9`t_%6b`3wXX!+5| z1;OPCB~Kq&#&}?Aa+!+N4Z7tw#=Kaa{J3NHJ%^fo^|JVi-?HarwEyT>CH+b7kE{OR zSfaKxVAT-aMk%Vsip%SI&S@S|tLl2Y`&B*<4_flwrQR8xwx@g&*yqfGz9V$MtpD9= zsCAvR#fPScMOD~aO5fS&_p77ls?LkceAG?qTB&Tkz%M%V)SkS)d(Nhz--I-fOgBDV z9lyc0T2`f=gKy7xSoX{Z^{X4g*Q|NI{tu@@P2WcJNdKk3nWpi4T;tQyJj++UXM3isON%z0E|lA_qgE&1`Sx9R8R}a} z(*iDBZ(Vxsvr9vQ{G3akOkVcsoC>9aAM|KuGkDL!Q*FwZYHRmxt=@NTOnUg@<%5|G zw{Dml*S2ic1ovxWevHq$Rdhg!F{|pg?^F4YYRNAOxAR+n-cV0l<&W7XGun@=y*IL3 z%03^bL90rBxuHba-6^-OP77@N>f1+-MXP@A_w-@A234AC>$Iv6lDeaU?e{git+6lt zH15sv?8s_6Z%udKbS-V~N8cT3@yU-4Z^vuyU2xg?ZJ(Ge>D7A~tY$5Z(tdmJZky?i z&MhBtum0#paeW=uR4#A?7P^|l$+4F+Oemwi>^hG1ug?%xu#j|9`YcqqV-YNB|eN?%6K? zS?$K2`Ij!vn7yG_%D1B*_Y6<0QR(f@v^g_8c2vwRy6U&?jhzCod!3o&;JhjJ-oxx( zx8Ck<8hXd!jj`?UyJyOD?tg7<#LY7OOLn|my1j1A)w}MumM&RX)<5RlVgLOvIzH;S zXZ6NG_o}q~cLI?9+A+=Z78gs57DOytHwz7OvT|eP^w* zpG-0Bk1qDvXwUSYru2}u_O<)UtHN^Ak6~q`5~FI?pU|<_t;a#d+do=fB{ZQ!%_;X2 zo9I8DI^n_X;FIUt)QIWb;^OcS)7|~wKTLOxb4flpdSsFB<_0{g5On(9&1N&tgf96$ zdhw3J#eaFV)TYn*UyF@&8s;{4bW``8g$AB@y>D*S635ON&;2$osATHd;DN5423|8X z-Sx}qmhFekedf?k_cr#yAJyBJ?c8qVqy}GKyYX~++PSDc?XsS_embpk9iJyn>qSp{ zsw=C1dfaNL)8I#&qND}Kht#q?KIoCI$=c&-e_LrZM#id(`RnBJ{-I36Pxt?&a3KX&(ODe9dyI9_Sr9r{<^ew zN`S+odNzS)$22VZGImW?Sef%tQnc5pZ?=_)x;tTh-34zt_>W&c_GaPB<5#aa`Dobi zst1?c4sLO5_QI5d9qSKvZ8rCfZhiWnXO^C7bvM(`zRlAY`>OOPAKS$_a$%jHW?s8x zdJ)&!rBmMvPyf(Iz0{@r>i4+l%bBa*oL<($)xGX?uMMqR2L_FukfvL^c<`Gp(`Ovs zG;mQ+uP@5Z53jfQK$CMP`&_9s`-8!8=Sl{Bw7W&afw66l8|vEJ zJbZr72lXB-d@CK8qHVRh*d1;3%dbC*{Bp#(gT)SgK5yZGvS-FMD!sAR^1fZSrcV1P z`(&G;tDIW3NbOzfz|5<4Mmjn>J^Frm$EY?92JJrJlVo4{fm2G0j`oB8=sIQXjg9jQ z2ZX=uQoiKiiZAZ`TI%%X+U@r3ymGa7xsGmQO4}EWyIuTD{aZ^<_zheU5xi*3*>PE0 zx4hYTJ)-BxO<#@K_VoUL##tQ(q11~S*_(0n;+bh54>uAs>$GvX+xG)y+2kz za%J!UsqL1Y^O9@*aC7tQjvhgwPQA8HdeqBr!RreTTi!E0+Oauf?9S(rfu@P8_69vn z`g#4CS015tvWJbnR3$UD#Guhvrw4yNv3HzDLeHOdp9h^7?{m>=-<4&>)*mi3YNJ=! zqEd4go08U4_++i!`Nfy#+c`!y@o?E?Rjtp>@mucO)t)!IbICVxRjRaGU-8m6-xkw8 z95X-qL6k$<*|q226mHdX&cUnmyM6MTzh*$GfEQ_nzu&dmYF^#LH$JF4{@EA$F&&Z% z`-JRVU3gKb!>|wUUmo*#+mc=(QrL*|jZe+JQ7Zga%bL?J>DZ_&kuZ>y%m2cwDeYaP9wQlaQl%Vc+R)71- z_So=tr*~zo~Nng;mbk~?a_MC{{<#(mW!L9Y1x7fS;LQ|J7PT7wN zpEB`9iGi1;5Z4w5TeUv)_{Fgn$vc)-a{Q&w+<`0mb!@TF-?i?jV_W8In*G(pQYXq9 zwOc=~?0E8{UDBSxmBz1ipFF?%mLKDO`Z=!ophio*dZxxr+jMm3!rgm!cpL6M(*};X zIKiVzQR9i-xEk`@##Z$LJT@%8S!en(n`;BM+&}SR{uf;x2VEV1FTBRxF<-3Pk+JQG zQ>{)*tgC+e&Ebb%ZV26$<~t~BPC(h;C!OpYvEliGIu2J_xBh<2^u=AW!h-G{yVq#X z*{9u}M#tN9=w0+ha@ob#M{35b9J~C6-JGevw{O$u_2jIXr<%?^v-W<&u9*$2S}!{> zW5jnOG$-31I^y6sV)&ujUss#6?&0#ppHKGjc|5MqkY)8Q-}tt|<=4wrdd_(<_0EJ{ z$8H|z*~Xz>n*94~og(Tf^D>38g_yNbR9gi(kc0=r=akWF|TW`J}QK;

T&3LvCmmqFDpM(QOtFA{MwE6lYM##0<7jk(W&x=i@xCv#pcUi-5{XcyU0ZjsT1vq(HP?xx>(@dy@ zAo1hM^$JXq2)Eg1NEWMbKRAj|dS>W7neG4V)Z@(Sy%W!42$b>>M;c1+%mGq*=l0<3 z-9Sq3jAVHy50D);1*n3y>3#kLq7hke^@!)>xPg$FEQE|FwzF~>s`aFG{+d6scq@tZ zTm0Wv=|+rm{4J5b=F=Qv?B_{X+DikC*rbAZw#%wB@k=pD-j@*Og6InO7?NGAuA4Ub zpT6r~Alr>s3nO{Fn#JtPx{OFr0;8y`>t7ML4L4h zo|G*!-M##MR`#FM2N?&wvQs)R#g?7&Gs#z22&?*5`2rGIt(;6|!r7{|r{Y4OjPwW< zix}FaiDgxV%nXsm3@yJRO}4#p)-H3j<^CzEsM*55Cr1W<(Xz71Sz!`ydZ&}q8dZ>$8{KF`8MF4#bNEi5xK)S$X zR5jmbAYI_%N~+Z?@J|rQgE%Y6a){VZu$F*L;+$_wA6z;g=PrNZ3t}AMrKTp)XXA%T z2vsr4idC&md)wJ3$vr7D)=w|=wUF4%;Nn+dPLtDSoF>4OS;CqVYvqC(!Q&?;(Gcw1 zVirt&n@-Ec?}K2sr02#9hksU#RC+q_W~9D8 zu`hVJPLA4D{sCb$oDHq5R<0Gq>MQ<>rEe!36fb`M^rq6S0Rdk=%EuZXB4%SfZ+2?s z9FFzp5c1Plyr5i@OezszM488pNW?DH2{b=bXX^y6iON7RfvaOxo71Nowu4Dfo(dEo zV(nl8S^UabB_#+r7aciOH)BBvgT#DRFxVscASNUXV8XqO`9!txy!>!pwRgTMCe^)k z?a0D5vq8HV-oh!PWf*bzf_DKB!gt7;bp8Sg!0HfU(aMR6V2G+=1`|*y!m;I&%q&lD%)dznM564KKpElLJ^92O47MTWQo}t$&ZC^Ldzuvx20s5NtQ##z6y|c* zR|%}sSQ))I?LgU~tKu+bf1k`YD@{Rrq|5J0GN9j*r`6hd-dIR6S+9Sh19>vQ`eC7}<|+lgt$md+-Ki667;p^E7Qm zSf3y-lV>8IzI3!u9ybNhJ~p~Xv%43v7;wu zB}xe^u?ykXeViI{kd3K4Nn5L$8m87+xxdh6kijT2q>DDu*vZ@kF?sb`NTtY7dq5ir z3Fq;lTg{6Hhi*5|-wu7pJZ~SmgC{K5DtWMWZ^WK!m)iT-&LumV(9<+I*G4cnE<0Iv zTWgZ;{HnOSxF#{~T*<2tAVfjZ{a@&sSaH6nGGI*EB8mmh!HjzDq>>mk|wj1!~TH>2* zUhFkmN6Au%B>9TLZ*TD?=}f9Fz5@_<8u69NeF%EvrYW&-SCe~fgzy$}E5^~DyWg6r z&0)E?x6T4q6T_xlyOsM7#yH_TDLI;)U&zZQXXWKQ5`~}4;bA)~?~#Z5O=AEr7*_Zd zMsh1-x1BM3M|=qy9u_9t9*;ci(fxjWa_+l?Za2XN51M*eRl|GO-{8n6`@T%+qrP)Q zuIgBKe9s&$49_zC-mP=xd!1y&knCRbt=)LVwgaDWrqr*bRE1l(4GT{4RAo)h+v8S? zuZ?}O2E;71?np_kg{zYU5Tk>_&4R%zn2;1Os@f<1qU>W%aFJ3&M4oMC40r*lk zg^Rx=+01OzS{$h@zCthJvtLZiZX8Sd)FtAEL_@okmy!3b4c@xcjP$MZ%}9&6)v}C9 z;cV|g|pl| zR^G)U;rzt(V@Zef0rENF9BVr|*nN2^zE=E^gfn25C!DaX^y+wLW3|kEX{g)_D`CCr zS!-YNSgAo^Q(yD4kBdO#oZr?)dTr;f z?rCcZy`uAfoTf4ur}bDsS^#%M2A=Npg^#2CnqK=8JLm8X9$_f4!07$k5Dda;H{# zu}z!CJ1gWf|1_{^V%%CQ|0O|~>P5bIKJdRXzPru%{;kjWn)aY-(ed@9Kz{IppxY(} z_m3FOim^7Mvz)Zbp*}P@?u8gb9bm0w!wZYJ2-ltrx0lX|2bhcGg##q*Ope;5S~HBl zvyI+MP$kdYRXonUZG10=H;AuSLd9rE*Z8=#gmZP;QzPOH;QRKtm5_VTaa5%ub@9D0 zo<-x7XNv&w5wSV-^i z{o;A&if4w{Lzi})IPYs_g?r{=qNyBRLL6~!RrC?j`ad#~KfV-7_CdmWcv?SQ7}mpW z&cM?6?1%jq9D#_WpZCQ_r5tk~_l&_x{W}JQG@`(YaLEhm*%=ZqX~7GvurqWPiH5Om z^(@6MqOM<_D9Gh%pn+`dNN66A>PeOYrHp;wPkovp`=qGFD+@w5%MN z<$zoY?M1^ac}F-$-%lTtftU@VJ-d5k>Py+(On?YEI$~Wi0sAxl(23LfG5-DcG5*Lx zy3F{O6_09}$6(@5z;4*V-6)|Qunh|p^Zcwsu9$v?oN8~r~ z`_{uZ54^IyQ{XRDAxNxWcct;FxtiK`zH%i~bYyhti{@ezZtdPKolrTp#UuGZl-MEJ z*Ta;JVtVr^eF@OqE+2^LTRUnrm9z^UMu!|>5!h)WQZEJ6Ni#7M4x1;8U5H! z8HJ%#yjm*Wm0fs3$jS-!h?=k;CSvd*<>pc?hb@InbDuLEr5tWaF+s^oF}V*$FNur% ziN)4Nt%pAn-TqDfN95Lgj?(*VzZsXSWL)<2L`BHQfHZY^4y&zLN3TZY#mZdr?&^s? z>gC-SRU1B>-+Et8->So0S=~S?juDC^k88s#YM8de8QxP;V@zLKv}LPx#@58DUhsxs zEw=$GzDDZCM+ccE#=5jjTg=QdW!A*3rWcvynDZi|zBQWtM?amrCTsHhWR`%?&2Z~7 zH1%fWuXbddtUGR}Co;s#vH-Fn2zF9Uj4)bPp;>L zAkQb)b4rlslj}J=$ny#H1lA5T`EKe+|LH2QT6G%XltS}^d_S`bXIUwV)!J;;J1gWn?9-*{Z^0bgdy_D$D$3Z2s zs3O-NqH$Y*2gppN4>oA|I>YX!tIdxy`Jwt&at*xxK>iXS`idGW{{?vC;;(sa@(GW8 zA@wTJ_Z1)|+=Q-HqHi0J5^m4XfL|Np@Q*;64+_wOY6Hj)plbqXc>w)3fL;!u{|3^U z`+?T9=1D-B))J&iTy0IeGf3+U(q0VG25>xUz5{`@zIc#!L6CM^kal;F_PZc$V~`f& zkkl?N>qCQ$gCMAnnZ{?XW8UyC(qYcbkH=bAq(n zfOH1$3DWKZ(iz+Y^kYM!Zw=B04EAUBa3Ce>4PlPsqef#(gelorF5_b)E73NR+qthM z!X{V^oGf~xqe61~c9Z6k20LAi%6z+h+Ke6PAsC5jpAkt(4k}^^$w1Tr##hJA^(HKS`-^uxI)$NbX@`ZPwp*a0Rhq4yd-YzulSjuO(OB zw>g2&NI?2t!V*t4RbM7> z87Oq*TCjNQt=0x&yzAZf@!aV|X~pA5ODlwN)u=dE0!>0zq`pJca%CT!(Jr$2oDtSt zv#=HH#v`ni7Y#kWsS@s0)gApYHHcN$Zxn7d_wT&GNMQnuEYoINxi{Ec2%)bb1eDF? zAkordD(OYmiqD>2lW>3g+;)arly6tSC(Zvd)*P*#Ry;k|H-s%DS1I1YykQmmdO|H> z6U1OkT^CrxeoZ3XZgjdZ1eygJllJ#QW4tbHlS{Rs(q?}dd6tHcBHs#?KHYd$zNn$t z|JhC10mdGb+ktgar*VR{@;2d#lkQ23OX@^MD&69JKKi&Y-J;B%5X~-(jPx~T*NTEW z{Z8qqAfL2a@6IJ;Ju%$(`nR>w5^cSKr3PaEST4+xT+a*@IaA@5sV)?QkDk zx$pBH$yQFBi6ZZTcbqX3BRXX16S$jo1M$hRymVrX@y_N^G(KePPe=Kc# zrtS1&XGvdDm-tp`*f$5V>_fPsZHH1(iHExQz*2)@rHV^9-}D7q-lWYAOjG0nrj#f zX>n?fKNgo&jKxWU%BGu<7+abWbFYZt_n%R>a!=7df1$q1sw)0M8cc2&6tn?ElN)J< z26u!3mQ#^cle!7*OaQ5p%r2jGq>@_71XB8mBFdwN@JCsqoy3h%-oXh?%q#(~ZW)?z=yWsDrI(kxDqi)OP-R+U|%LIB#b!N9! zIco`Pu(W^FZN7LgGA*GQqfYb1avsI~Rnl0oO7uzymYp-$7drW4lCFhV%@<=b%-$+6 zJ40#~#PmI>xx4xDh?T#96Pbq0LMJ)IS#~+YtHb2p`he^g$^CES<{Pc{_-{!xBs4J}{M}%!7$R4-WRw*_HWbN*<2l;Y--J=q&$ZA^80o9uDLZ1aP z^ms$pBFi@7KU$Wtd)Ali^3QT?TwFXZI60|GXa;fScnwJwgls}(s=;!l~Qqe#dAmjnkfc3wBF+^zg5ch#U+FD%Klgz)uG(PKWL-L~r74h5t?}{Ajg?zt?V@v&+}$mT?;fFD zx&`r+F9Lnw2VQ2#N`|=UX07`elKz4up%$W#NISG`528#gulh=jbJv0sP%--}K03a| zmUX>vjSXG|q+M*IhIQ8M-<3L9CMWvKWFOanlK6j<2B8cnBkNg-<1i5u60bOuI*fr@ zcHvmI?H}RW+*spa%p0Ik4dx?P#>!m>vJcQoYRo61lp%6wu!mz0*R1EjM)%s^|Kq*Q z-ieP}=WTDPKg1c!2Qm)wE{yYuXVArY7jhx}Hj7^tY&fjM3mE^A zz+rDDkMn*>{2N27n*aR zY^jpu9GIPyNh=CcLY5L75uiWoj-Qg4WF9Ltja}C5-;z{awKSap+z_9=!3$*98!IMe zuNSrC9I2zi!OUiv0E6eHe3K&jPgT_V>PirO?`AH$kiBktk&yM`#mw6W{_TT}~odwI3LxH2IqhoTTMWry>YHj>y##IO_(?Lsp)vXCOPT%uAn!)zOcqD zoHgAbHC;HX0Qr6$M~U1^W8FY@3i5*42qq2j*kYTF_s>vFa>74FG4az{STka?EJj@5h%`T5}74HAj)BBTG&)H_qar*T4$`dT*onC+cZ<#rBU|Y+! z^W&edq~h<$;#If?uwo&375-Och4*QNdoQTst@6fMICffR)87r#3CqutnSg1G&}7(q z*_mlv*^qPHwa41dG|Xfg$MTAI)37u9z?@!~iI2h=!&=Z~w~0hr7k^Un@Gp}}2DHX? zP!69$(_>1@hkfRxC?+!5g^i&_N5U5rTe0pEnjl}xhl+pZkD(AG-kX2IVbt4aPZ4lX z38CR-mdOvn#eGSP{(8zR>*T$P*ZalCV#Ez?vSE96YuIhM*eAmGu2lA7YJc~#i!pJ` zk2l29LKs4Dyxeg28~T6sB`ddvQRZvLa?4)jyBEWe?xOMWo@Yy!eJY7l%*eb1S6?W( z;P`l%;(%V=H@%UVy-kz`foU3EwajWTvZ3OS-<2h8;sd1)02%d54RU8PCK3TM#(1># zP95-=5hb`Y>fC>m8;Yw$8l^#U>txs}g5*BHn^l|mBlNuOp5Cv?eN@8Z!Vtj5EHhDz zgK>bsUNk_);f!(*NfRqR_%TxmF2Y0-{%5`PHAhG##%ipdpxfwDeJ#q8Cxyon;>nDG z6?>uh{deGMU@0pJ#C@{QUc)PG7Nz0Om5!|pfV^P=L72V3$HvMpF?&Zm{9Jt8OW2fa z?BlqV?C@eA2XwP=n-xpjLlQqUsr{8^HbP2`WM$=+nm1u(=8d!=S;J=6C_pB7R(g&J zdj$hnm{Ds2`EVn3g$SX^*V9_(uk&cdXVn!BSB%Uj7vcFWIo6GhkTFH?g4m$9$j8}i zmQ&BIn+{~VpIhqbk$WN<0{spkwIKQqkXjJk52O}Ee*=2{7!lYCdvlNE2vxB{)T&6( z&=&JnRO||ggZLLs+E+n2>IT6D+GNtc0i^kU0Hpcmuy{6_w<#bM6#o=R%VrS<=vx;^ z-`)eHZT=yUw)sIIZS%80+P-lELZJ`&P9$^*ke2u|ke2v5ke2uckd|oNlGp95_(Wq%2zW!C}ecc&qY z*OqPo>Nfda0%|fN{yH*9t>yTkq0rmr?a4q|%hf<6*nfB^w8Nww45Vr4AT1N5JqV=z9l}C< z%aj-ir0ePfpgWlNNT~maQ0Q;w?JyvHD^8H&W903XK>Ce+Xi;9ml#xJ69H_5|xNowz zd-#cW%JPXeI6J=z$bb;Vc~Dele-W-G!azuNj)_TNmkOjw>}*tCgaXEWx1;{bj2i=U z70MV6ufET4|*bKQYk(%v`d@geB zTKJPn76tDchLN}N&ATVys0woGv6}w!Ug`frc)6j+W)Ki zg#w)7dz?I@!c*x1B0M=kMt$+1QmyylF#v^q1! zXZ0TA3K!2Zyy8q<7QT)sUYj7a*`-L+kgmSe)7nVwPWy^*Ze5yvuVXRN&oz`>Wbxi> zG$iq!yapX7iVY#%8`-ClWP5QkeJ_5hJJtz4lNMs1&?+s#E{@UXc@o>f^E<0+ z)@KL3)f(;71QAl_;{SFTuwd4v~tTt@O0oW6)8guLcJbk&dR#e=AO3w6A2@a8s%De)V97S*f zMJ1zxet}x0U#1-*7-T`q%Hhj;toPN8e~I)y$h~~A(+)hH1iJ9|A#)^76B9Z+T4QG) zUoGlvB;K#{BH@0Geb7Suh;CwhGnhCsV}GzE%6bM-EeKs?R0}_$5c+fsz%hi}Og-{; z9>WrI7gj|J&Hu>m>Tlilb8>N|Om(96?8uUYo2sfZn#4PJrHa-@O6&24^BmT;m3xAB zG3WH!q=Ppz%``U1WODpFIs9rxr8vv9o?E(Tx0No_zsBaQg<|V+;|Bo21wjQ|Zo7gY?8UbOwB@$n;t%e+yQG^b+Trl7G6=BFS9$$h(tG__E5CIoM0%6188EIILdkL(A)R(-Y?nEdWlJ~%vu%yWLlEIq_A4Qw zSePJF*{@NvUjV8=VsNc7e=p`F z3vGh@#faYLp})SDS{S*mW$XdY4-hw}Djr_dn$uKKn&_`oq^_l-5?Fy}JGg$=Ql%Tk zI5rHzq>E!CI21mA7=QNZ8t8sr3_DGZo8JK`pZj(IeF$_dHAF%S=zzWz>-P7KkhDu! zlD~w{i-fX3`u0Bp=$AmBL){b!$z@YLPQiZ0HA;(iB zG!aO-t{Z{+9V=v&<;}rdzKNb6sFM6!lq6+z<&xaY_i#E$* zQPv9rOOCP%*6U24_3A}C|Ic}_X1=04*f~Jj=l=rgb2wL8@5P+wjR&&l6d}kttZU#Y zSp#5&)U~)5>I7!@IP)V-*vjk!ci`?gK&Q4d6LdPA&4kx#X9}BXN{w!&eIpC(rUnOm zB}`l;{d_#1)fF%!fW8Pc&#bZ^0QKoxneb3Dh^zdjf8u;HIeYum!s$iaMhLy(PtbJd z@xRJ%eD6=qK3)9A%^nHe52TYO9KAwCAf2=`$a9LBJ{w3E>G?o9kzWMT`n>H3L0e;d zgBYvS4-d6&5dz&_b@>%nUh~D&6-*2E4NQ6iNkx3vp23T_$=m#C8co zc_oaKgBbV$7t79!?WNJey0l~F(F}dn&{V}8*jJ;Oh3t;pBakIY=RIQ54&sjG2{#<# z9p2Xc9rF&rn~DG8`ghI#Njm?)=$>&I-<$ZbR(54SJRx<^>0=UBavOzWVf>&lD2&M) z;>UQo$W<8|k~Bb)p3|gQ`dCRCC`o_Nq^9(Nk~HX7%;P}} zcBuF?FHCzAPI{A-m!g>Dwt3xUp|HR(y4`PLq=74j^h@*ognW$O1W48z^|?d6rhgA> z|Ke6&s51GQ>EBvSZYp=%^l`l=$F$p~k6oHHUAt}i_>v}_r`hl+9kh5Rag$-I!WzF6nKkYA;^c|lUBIMRP1ze;uHg>1Fr9&!f1N+S&@ zv}5s2|AqYe4H6(Lmw@-Wa=AZCxr_M83}nSFzG{;&T<4SGT=H?;Jyc|<*y6uZ-?qGd zV^c$X6pnA~aF-{kNSEwv+sACe53O78qD5vw=lG6Jb84E=+oQIZ^V?e`-kKrDi0X-v ziRqb>aV;|l*D|fFfK(O!CJ=Any}jWN_(=8eM|eGvkoLLS(ua7cCYm`tg4F0#J|41i zr!nqvJO%c6DPBdT<0_cxNtx4+BCB8|+&)$bwlVyCH#NlFgGKT&7sNS8Q0ipdXkd5Jk5VGwYHa>`TGGsY?P}e(qklJnG}}2}yUTgplfu z%}smvLgl^aZ9x)(X5%h)>}?ozZAzo(eZ}u-{tmOyW^DK0iys^gJZacTQA7s`XG25l zDEE?&t?aSya@MzzvG^)K%uW|19mTa1oBK**ZP&yR z$@EPNdK}%W#}(nTf`cn2QLU5#?AzJp-g)(=d`fY8wUvLFU)`}y;q*LlDSQLSvUom? z@;13lmFfRuXOOS>bN=AH`hN2eWN9R)eiPM@c&}#8_a_Ed3Xpv=%Q~jwuFWKr29@7b zbijPG)KGpGT_u>Z+@8`A1RF(ge{dWFMqN}eRly>{sa^KznZ0haoJ{$=p*`h7(=7&S z0a5}(fX_+8xS&;UfAWc-uTHmjOG!e0B+EnnjLe~dSE`aV0Ad#1b45PgYsLHU&PXS$T z`tc@1{5=E3Id8ny1Kn?!{;vWlJ^xc6rP#Lt>8Sl3=sr_+50H+UT((<Wb2j40e#!Ny&XtP+zqtMqZ@Gf3 zgV@;SQr!ebT|0eV09^)jH$(3U?}aIF9XZc9D``PZ*|eJK8qOXCjnXFmW>w9Qe%p^F zFXfgPjumVxf$M^>$aX`uxyS^1ZcBeq4_nZet+L%;X-Uy+IWI3qyJe$e@sJ4haS!Tx zigy#i9=~Kee0Jw}+OCTt;4Avb6?{MW&&S=?%2UC{YY+7@T%&F0dSV(Z0(HV!Z6+RmG9}JP9HV;Xw^rfKIZCU zmOhs2BcqQM`nXRYUHWL##}0jL)kig0Qog4T;jZ{qqmNd7H0oonK4$4-xjr)bSfP*m z^wFh{Hht{S$5wq*vqt25`l!=KjXqlS(WsBP`k1AU<@(6zV}(BM(?^#++VrtQA6xZN z&4DT3(?^{?YV^^nk4AmW)yFJ-EZ0XyA1m~6pFXHRV{hvD+xlPsM$mEs@fhUm|gh~&0qSFTMI`glU} z&R&Crund6`G@#)M6I77-iF}ecWq*^%730!f)F>NPYTmvS{SbG?0*^e2 z!ZDI9Q8-Z^rPCCLawx+Y4@=3(-&9-E(NsGDS)>?(U>Rh-ObaTj`zeJnt?rWJZ?(0u z3L~ItRN^yO3=M8thm3=v9#J!C;*jIh*YX=_oZ+q4r3T|fd_Q5XU*d}W{;6XV;nz#m z6^FfqBYoYk1P`vJisRw%_b&|+1`u}^d^EeeCiVC1?!l=YTq-Y~!6f# zx*B@A%fp$$8L$N@zfZfL;v36wpQuk*-*Q+XoSbbkx~#WuJ8QJ)SG>SNO-lp$J`4{9>JZy^(!X+fkIeRI5!87;paahB>oduNg05B=-`CK>*=y~st&T?6oR zYG2)UI>k28fP|BmV<|BX?~D(%0hNYv6Fy#86pm)jJPo18DAT;k-6~T{Siue)+F;v9 zYt}%h^y1EqX!n`ac_0w6^{7exHM?tYislUYJoi$e$PVe9-^QB-t{%dxQKqjP5zc;C zlX@rn;o#I;c6beSoKoAE*>gtfkmB78Z_;_QeoK&O<(H6#TOGL}qa3OkENSCc;)M|r z`DUUJ!NVc~q0Z6)YD&>VxTWV)7g5cSTG?ZNl|5FBhdb~rBa)k!N+Www<~?h{4qVnt zeTEW)q{KT?;;neNGeLBKqwosOo$z}6mHt@fxKs~JEqFdG5mVzWelf+54mQo-Q37$jZd%ywz1h4sB)TDCG`>0`d~%@Yt=l$6|e*a zt){I^q1;FE&}2tME}bv3A)gy5lWS0MQdFCdm`D@d{Q8 zUqw;z13D43aU#V?Zn5$bV_1?+8^5hhPpV;=B%3x`+D4Y@#a?dH#_5`jZY1UOC2 z$&@eyVw}_B43O&+`W_k5R}h z(>xdU$s_cz)Kj6Mxrv-`&ni?#!{8xY)KS&Q*C$4X;WnK92}U6pVfG``Y`;OcN-fEd zNK1di%sT5cufLZ0@O&%(48M3aBb-A7e>Pt;FIaKE_FnXp7czS01*=G`=%hq{d2tY5 zGA~%V8Sh0zUR(=KGB4ukt0ngUNfiGHCb1=bz9bHm#IX#oNu2KWJv~w04T9E66b@hl zL&by1BF_4a9Nk(81QCIuJjc{&Msf6;8^XL&D7 zFTdz_y}aQXz4w(poklj9T+=@$*RwUCr}$l1xgU`U!Xnbr$%Qe8tc%Ge9|2I`ojL0y z@uO-xPYBM&0VPU=kK^P1+jj3>%EwT%aQO>YohuKGq2wCgHf15skIguaoQL zqoW;-Va{@darl5+M`k=!Vtr5kYvjBr+}zce=^1>(44lN`;$=-Nw~=UWq6>`W{+4w9 zYUM?A%dBi{E{ymF#b4ujZgk0qJ}^YB*w9`p2Kg3F*35L z(AZ%BZEhC&kim4I8cu9K<`VBo zYfon;-N8$=l@_hv}SS zNQ;3Cjpgho3#zTShq3*XO_x5tXfp(#lFQ18GC=94vuIoKByM}NYUmuF2o-QT+7BMKU)*@;5F4cK%$4L zZ@UFaHTe<^TdiA$Ve#iBLOeq}5daGto&Btp2U^)?8YWm+E?Xqryx@%__B*m1cfOh| zjQD)KXML=G3oF$2G|ekVdffx&vdtG8BmVf<6Fb2}C;*tC;_fal}z)X9%%)d5Euk&@Zp|aP} zhlu0*G~_ZRiU;!2jJc_DAxY+Y=2snGH&&mzFx-MLbaq2Qcroj{?e=Mgr?dW}O&8%c zABaJ@Vc3cp8mQA{YWgNM;YLR~jT+(zb4KxDJ)`ymuY@?GaF&{fqGD1~`(9Gg$$ZigeO-A2)7yloS{gQWYxM_d<6E^P1LsfjS(II8u?{*vd>nS z#&pWu8l|P*7%rpW?^@(nUSm2Ur_tVvYg?tlnO=qNg4$M}p|4+Oj(~PM{Jf1z{&6rx{n=vLuE-dH^+^X8S(e)6u7WTJQV=1d-fNiKNy&fzkd^X;F&a&CTPrUDnC^^-8Nu^o z*$|`&mzc3r{ffK)>Md@mvXs`3add#I3@t6hPyP>ND!$1Xv)AkBuf<9Q_XyJ3H~C|l zS5Y3ZqpZlAA&`rA^2dyUyvO=R23yXmUL?8nphw8*OrkbbRlJZ-i*`;4w&*GdRhFv? zQDKQ$K}V+#E}jF)j)CNUY>+BatX!0Y_)}0B@^5kdmiQ9^(VxYA+HD=Iuq zgx`W8EnFDpfEjG%cQPb=%KNl;zCDecW)LET8`g^*QW%||wv78bw}=sw#=APRXDh-G zs6|d#E`z?A9QTiSAz8_KUqZ*twtE-fQ(?OJ3ic;SNACbk>WGZ@X9+XfS#pEZP@Ls% z6kF(+H<8?@nZvL^cnvDp9huz_Tv5iUU_64lUE z+pL7MHc`LJe$*$r?47R%1lBvy&K`laH+_YXBcFP4-p{>8;f!&PxlLC5F{E=`ZpyvF zHm*2Ua${J8-sbJ|W)N=zqX~nizQdZqtEJdbf)I)o`6qWY9Ya03rtzQH%4;)O_3OmA z6VjAJ^7r5+Zw#$m75iOKR5Y_-fZ{00c(Rp0U0w)T{H}bzaHHfnpy%X-7293>6G>`l zC{f4$48dEq-pYTCRO7^jf%RjY)iF3jM!`wcTlodNhvaG!V>H_{Mk6NH+Vl%TCX8Ee zhhHhylSh%4>FLQVyML{xjgQEtm9}4I<+oD{U>H!EN*iMRvRhxv?!tfTcSy+Yf=*oH zz3C4t4>9{&?`MRc2s?i4{T#qggdE@Ueh%a(RH+cVQtKcsJ70cg7FNNzT?<&oDb*E= z^ykQBD!SGP9yE)dN$kBGSn)^ub+F=XaT5?KUM*ssO6(31qQd29D`OQ*=()0)_MOk1 z1-Z{i2KR0$>rP5J?b&VraHgh={ECTWI@zZfJa?tz5(^kKw@$4Kjq;D-I!(S@~(q0dd{hi!S)S!G6Y=N#+VkW0~rQ z9`I3*Gjrx6jA}@m_6c)faxh`#m4P~(Q>u6`ACWaB>#-$0RzO*c=cbPkP}bpj>ESeS z;E8E$KKxUwrd&_arWz|#$r7S5-5KMK8I#R&8h(I$&&-~ikyYH^qvSstH^3mdRlFMTlFm%+`+S&QDBmlg!4Bl1<7V#{z z;lvp) zZB?moYPg(c?%k5tr=~pd?k7-kL}rmn`cQLL{vk<~LBHO-t{~}(S4v9u37G~u^Qa)y zK9lm3a@yXL;>gQhlR`^<^TFcPTC`d^+u3OIiBR!^UTKXcO|0DfG3;!dWztTTw9YA7 z=qULSv~q-I@3nM7<+Qz9`Gy&7BSI>+ahbCGtyc3bL9^xRACg~v2H^+gw7sjBQ1g2Y zf-cUhcqK&h=k}tQuVNMb6N(vLVrJ>k-mBP|qS$eSHpUEVc77xC*00>WJ(-M5sV--C zZpzt_-8wwG3vu9|NN?=!sIl^TP2Uijt|2r9!}cfeQhK_ZulTl|%3hkkwKliqGK-4{Lj(PH8ZsrNmI)>6%G%3vo&X;)-`5aM5eg6Ee_NsO( ze=J!s_hnZ>aUQ}C$Ql*I{f#5cdT6qlI}0 z;`R)_ArZ?H>{JAC7$L8TBB;yX&wF^zb^-!BWaZ1WNx{ z92P9RF51&px>w|H=`Zsx^(EuRAU~fIvUEP<$o*+on&}}9*XD>@m%75&VSG)jUj3ZX1m?%)Du}n-@_N zOD$5(pCMIEOK(4@jWr!VV+-MCAd{hWBLQ(f@ z$aj~H2a%dJSA0dVU+0urybKke<%g_6ef1>2jKa|172V)g{uWY8XGP;7)t9q-$M^-LCQ(kBc*ijRHRbZCCIdlT@nrI~&`LGX$N}lyw;upqWy~Xv zVJapZD<%`i1O3#biOJ7tCQa@qX`0ad-!yMm0yUYpPXeV)+VeooChg@QZ83+*xhCyC zAT{532&kPSBogWb`T_dPNaz)yS*Di11^KGL>zYqg(weUhNb||!PMVsJABcI0fsSHb zwi>7oNWUveM9-qUDipfdygfRAP6X1oJwSg#F&zmV0JEp{jRexS$HPVHTd~H}v|j;z z<7g?d9iIC#Q*(C!g%CGrK2defG<~}is6?qq=oTPt{p~@%2Y|HozYfy=1f*>)0cnqR z18MuJknw1%jsx1j$VEaeKsvua1kx64lQh%5_ki@f{{Ygj4MB*j->3)Dxr_m6Etdi5 zcdrG~?>-Eq-`xPD-v}eO(r+{Z={KeW={LRtq_e*mNN4qKAf45p0_m*20Hkf%2BhEJ z38ZC*AU@QxM*(TsQ-HLrcwW(bGl0A?0MZiTqD=E`2KtFve_MgxG|y9FX?tR3Pn96Ogv_93U-wDUg=E21v`^1f*s2Kw9=LAT9etAT9eikd|E!q-8e& zY1tz%BGR(sfV8X)q$REb(h^RP@2&uP66i~2_MZjP`K>z8pSK2}E6m$7fpnkG1e#%1 z)0IGT%-bxGj^vMlbR-XE@9GX%3ZylE8|Z3N;)g-nZ-BJyMj$O)0@68>8xH#RaUgv= zANveV`!MI`vYlP+JG)JGqVa4GJX35kQ)E*0a7e57Q-~T-4Y3%0i?U4 zIe^X%pf3c_6#?|s0J;n4GE>X1fRbi}-UfQm?3rCazckSJBXRyn3eikT#?25^aK5oY#rPxme&o z1{EUze1ke6He6%zYBzL>(xqV&b_+S^P_o(_C>o~530 z5?r!?NK3e<4=go%*81)=Ptk$L&44PL7Ep!L0;+JDXNQCoL8-!?WkO0p!l&*fTuR)% z%!Es!8b~Wh?A3O|?x^)WBaaz}Qvjh#?j$UH3eN$!`-60jB%GT}Jd4l9oeQc0)Y6r$fHu1HIK7;XnT@YD&6vK#= z+S%OGRU88B`5!4et~(~=6A!ln=>l6GK=%gFj{@iy0rYSHnW^+`GPCdK4S22!1osDQ zcdAE48cO*T+@r*{Qyi+8Py{cqHk+2Fx$dxVlkHrB5BzzJiNYE3zB3k)2i_C7f)h+F zW_s@RqfFTr%G&OwRS9=?BesQ=mciemp!idSzN|=3uV$X0o)_+dl7`bl2q1<=(8Nvd zC6UzW*2-ZhDNlf_Dt`}U9b&2x6Jan!OE)2Xurd1`MyA}x^tQ|dIKvt$iFU6+LvgAH z5pxzVZ>ph+k51ey7-g)W7S!v2t%2-ir%XE&+yQ0A3=Y zdvXc}?pg1ZwX!i)+plZ;eldJ3JuHd1Di8^<5#S`8n8(`)!5^V>a-%dcZWBVU{pk?b zB)3}mfut9k_~VUjsmg6meRgu{fiU#_7Nb=qfa@kRXt`(1hbJ3;o(<%-NXvYo=EV$r zmAH2#Kw=}-h3os+=~3T0Zu|~uAm8xji9;r$HtJbTs+f~f&bV_(9V`)N%yKF|0WD26 zIC)6FP3wdcXB_TsuOp-sO_L?(H%({p-zd=CoQkA}Gfvpq?<77fNk!q0`Bl6|D)cXQ z%3xHCL~1fEKg%w(iuTFawbESH(~t&fbHB+GhcsCEbEyC=d7?iTr;)QGmrXRR7LMnI z#JIIdf}F5S4#qE~h)aoUWej~Nb~wdWLGsdw7~YnWo6LL~r&!8gA_|cvmT%j6T*o_7 zM&(o(t0g^+L-9qDxqypaD8|KQd|o{!`P>_-+$nQq#X3Je-kF&;nUg^J0aIx)9k6 zzG13bW33i#rwD;Ir!Qu$w>1|c8J;ijoD^NMtB0CznB259TsFV@RrbTkg8NG+mC+%l zQzxZIlY@xWA4XCm0x1+isdc3#q%AxM2K^l)wqXVhrq8!6+K=Xn_eSxe>0f|w+E+na zfg;wW-bfTi)MHE%?`#8ep@{YGP{bQPxNbT-8J7Zx`zM|x?gUB*4MhDUaS`k4Hwr=s zj)!=|``3+57S8UWOf=I#{tf9;JiEGI!r7Q0G*>^w6JqEVBM8|#YuOw=W{2PBCN#8< zCwu8tpS2Qv-(g!%j_8-fHD>#^0m<;%IJR32&t3P1{m8ILv|9d4;0tjlCrz7;8fC+F zQKq(UAApp?Zr?W0Mtv7k%{|mQqePemq{ukKpsswz05HINUv~A2GT1W=7U_5HTy5@?@-yx-o@6+ z+ks2oc|aObc(67jPr_6}u!;Ah6gON4c97ILMR#=JlKb#A>Ado&Wb_R&1lQ&cr?2A0 zz!Tqy=Nn0uA;5W4!u=|T`Sqg`;q7t+60H8VXXR7w^lC7+tdrv_X4*kvg;9f> z*paj*?I@klYb9j&)LeHczBtA_S|gQMlh9pul*`lRc*Aok@KZaKgC_+9^IT#(+y}V6 zn)?FD@L#1Vk|EIjQjE7%==|zJ8nA3~X2Eei`=Kw8uLRnCEBBE()-DD85OlIIxu4yz z>w0{h4b@Neb`>Xn0&e<$czYN4sH$u6e?lf9Ab0|zMnw&Z8dPlJlPG8gW?)8U6csF0 zQLGxZR-rhf=oJi30-TPc^kM65tMa>jT>J1A+lq))6Cw$ZRs;AzL5*51<4}!{LW0)( zziY2^&dh{JZGZRw*OvXJ={UWv;L>#&NFU>^ za_yRVe-GF0p*wrB2ZWQomGg#5AD_`aPGVy(4c9&&A1SzJ@A0~2HQpttZkM7DkIjjx zMQ#3y!IIWKudFRtQN&}JF2tQO!v*5bC;`7RG;cPLB5W7Xw>hi%ed4!DPdc?gzc%T_ z46@Rcq{?YsdN0%E;MdbC3UnwQJ z<=qnAWt>p~&vzu>(IVcysrVB*I>QImg^%SON@A7zjEkg04xxTn3AIIkza)vC{Y4~t z%3dUT!KuA#vJbl?(~#(+ghU@MB)Vd65^bgB!Vxn4u<8za4^*s&LhnaYr<(_U<4Izz zTrgM6#&ClX+A5vlZ?pTzudZQt5$7&P^RI5{f)BF8WH7No&G`o2{uE@05%}}eByO!c zGIfnTiMOMv|CnvYQ#eFS>wLd?aOnMb5Uxh_&*RnX)y+bH^GG@z6TFgKWFO2mc49de zt>Es2_g$ZOJJ4{BFOkj&+vZM%5E6%{F&d6S<9T9KrMis)>wC?3u#?gnxf%I>OQ@^` zcT?hwiF*{iIo}M!Z`2rvsT$+4lmLS^T`b#7bo3ZE#gJUT;OQ|UZsy{=l7;GM`5g%3 zF2yj5J}spadO(9@h~oRHhTkTFSlAzMf`M^2+97W$B8tt<^Pn1)I-+I@E~N`sRf--P ztk(MYtvq9dGHin5#}n3{VyQt3=)$ub9-0l{XcEDbO9d=rC$JnI!i#$3Kqe(vcfBUOa}THyJ!?USTI7L(PC$jF zQI4tEW!TK_H0L{c*3O;E-(_Xy5i&VYAs2|G{MZl2wktHZ0ADz0gRjHjBrC**5or=T z9R*@_wvo4M$}1~b%`2!Pl9ExT#Qg=U$yJ$26TB?@c_BV}>E=1-d)VP32rlP)-s2lC z7=BMOls^hC;sWR9uFm63) zwJBl`_sUBAK~z!czhezG^A=56#oQuA`3nb7X_zw&8w3Ww&57Y)GY#t#V=~_(IJa@{ zJs(bnIoK4JLBBRqTPE{y0rL@Y=i^-FW4+AB1?AYCPhG&uG2)oqeC*F4a4v~B=aLBL z64EgZ-{N3W6XReag%3tEtGB~6-<^#A5VRfM7J45q28MPvJ&R%o=e;U~T8o~Q&8J{b zWo4|B1$>rs4=4zar&e=}^em$|XSL6a77@%T1LIsOW_Cyzc`|PRoI#8V_`U_Cf<=)+ zD3>XIS(LZ@3`nu~8X%1g1F1mxWgr!8in+Dh`SSa!fPP~({GYH< z=!X9Sd*aiy)$iL56r??_8FgW4tBs@&Mve{e5c6c@7o^DDY>OLdx!FF1yXM?%li0c0 zj>o-QZ4NYrx7vxzp|kznXx|ztxXpf4?w0R(F#8oxbY||fE9Fl6Fo}yF=xvvBubyp? zzy*h~S9TTLL_Z|QnQA%CpsDmp2OZG?-R7T$tS^yjON2j5I4r;J2o$$38?h)9iEyr z_pB*%tsgdL4>T1^e4^775PzG8kDL;F*YUDkm@II3R_iDlspxUC2hH-Jn>^?~50XjN z9M0Hys9=P?B7=I7ByeIJCWIEZ%a<6BmXm>O?3j2_ij1>TKE0`P$ZtZ(FVcv9$nVjH z{GQ=i|L%thA8JIZBRr969^)ZW)qV&u$GQ&@OeF8D@WruWqYZ7EBShf6f{iHqxg&F} zmXTAo^kOyYqiew%fcH%=pW`J3a_j?C@F%)Y$xo4CoAE$b*T}F>EzJg;c+kSx6+tc! z@?_ZOdot|vJsGw`f#J^L%Mpu5Qu{|z3lU(8Ky`im5gAD7u_27?Ve^EKlhen=<=M)p zT_axzqbKYBg&YTAG;*9k8O=wIv$qU-CW9h^oIS{(qrmNpMR+d%+>sH&$l!?JMQO-v z5Bi1&#XV@D2QBfSeGTjU%BF(^tQ+}~Vl!#{Eg#Y-r2Uaf!7+D#qABI!& zInK_73%T<;Un1k6>+*e#^3i*Z@-Q>X`?;em=cRrII-EDqhh(2C|MJh*>?CQ_TAKd#Q8dQF{lRlQ`iyNCZxf z$__jdZv5C8X-ewCX>d(Z)vhOEOEh)Kb-j` z<&}^3Rb&kzf3o8z)X|kCmMvpBVO3B zeus;(EXAhYO<7Bt9;1yWZGtiGW{WTXywAwp_7r&AO;Km7NNRDyW*hpPtYCkNu#!^p9=4fiAS!eB`PI4pM z3w6t1C>t+gSlrB%!8zU)BzKHW_{C)L?yXdEJIqoiPQ_SKo(Z#n-Hy%aXzIpJ5`4p4 zdA&i8LXCg1nqC5M5A2!se3*^Df-0o7R^$Fs8JiMo$Z9MyA3_=Wv^w)wavIfe#UEZF z1pXkFE2Pn@ll%l!nB#~B0;wMuoj57U~Q@~q2$N(v)axRGn>1zUwt z{hQ-*OAbuQ?sMX&io^{H5=jl&Kf8ZE;>#Iief(uPOoWrS&-TT4PPIqu!~je7?XaEL zv2@nJg5#;4z|Gj2ffAYNll;%UFLhoQD<8l)_}NrA&Q#78^Rnd;dr$V1yoD=t>JXt! zSUQSRlhP!mF4>_-?Vb1XM9bmLqf)qrnhD+FaocG!gq-SLXEO^k|9~Gw>|RJ#oD-2D^d;qofOtJ7j%^=onf>;M0$?X9MhO=nQLdIaa;V%aBA{=ayeTe zeLQQGoI=FTN^cyd!O_Ze58dH*V~mg#3=27_y2cQL6I}X;=c+tof_ooZBfW3-cbL7K z67|&iC=hfG^7e{^nX}>1;H}zkss?H>WN;GDB_>w%?Ny~wR^VbbEfn#9^js;*(@K8j zJ+_kH0FaX3Fp!ek=^iAH4HlR>YF4 zjUP@W#0Nok6siN#zRd(0WBM!Btu8Y?TI!{H)Pp*K?&ZJV_g8+OWr1MV3P{h#y+B&> z7*5p6HJuEkVTRaqL6hvc=GNi7_EmBw{d(2=f%)&n??d#l{N$ipFtAk>0zdf7~x&UH<| zULRQWrf4BRR-7F?R2!~}54p7}mSQb6C%Upn;98#b+Z)-^(vm4ozF83)6)h{v9q*Eu zsl`i3^7e9hg_69z!k6Ga=k`ip;(%~!IKs5V_HcW{Qficc+&)#BzwS}>Fuv|H<1Vvw zzk$vNI>gL?99r8AbPdo);99;x%;|begG7B3I;FR8_63#E^lH<=uhGHR1B>334$8h} z_c#_$*9B|8RTaPHRv!G|ssW#8>l5#p9c6VjwYanZp{huG2eDNky)4U)4Ory^`G0;n zKVPl1hE3yt7^#y_ZzG5sHifuhQ!2$|2l7{ZlT;b~eAt~WZ?$BLlW$jq2TiYFgL&Ev z2yfI9Z!LH=f%~bB2Kiyinczr1^yPMBzQBiSeB#Id!4v= zihmuZL6|qwDN_Q3_&(IA+5)@UiV_#{qN?|((C14BCeF>C-!`x)du}*&k0|HM*7}QG zxU}O$n+|zLm>_Kw9?21dRXn8L(vKJJ!mlHQlOm% zD}L-j?rLNwuM}DC!f5&~gAW1lVNGDsTSn~$?{bbui%{(a4#p2+YgLSIH5hMi;4*nj zD~8MQn4Rnd^DiqZTNV+&n29R>2*&eAFrGhx@y@CNn`b4 zomxwBa5w$!<;=XU`}92(@Bj+8FJ5N&0mdc!sNptx6HFXoMyrO6e{D+j5 z^-G$ly=WYYiuR&9e)$NSk7@jd+ZSyeERB-h=pvz0!PH_w*+9#V!vnn1U@7!=D1y|1 zAS(T;BFk_F((gOfgQfyKQYK+v^`P$qspDih2>C}z?0*AYb(TQwKDbw#~ZU{-XRXIESx$=GEI)AZ><#VoWK*39>#{Z zXuTKDl@-Sc38R1m!@c(`l_(@wBG~5D-xLHt_>`4w!fF?+-*Z5D+nGx?3W#g!E{9mf@l0tjEIwk_VuQ%Mo-~vR z+XA8w^q{W#Z5VB9Uo5cv^A3r{C=eF9S>BWHW*JkZFtE5;PCcmfXB&KbyP-u=3@#bI zZ2o(eliopT3gAQjL6n3G^TOpr{t;dUG4aCX!wK)=uNN*K@{jc4{PgnSgqP=s%ZC#_ zEk9g7oN&1V^2#?CLPSu$C@p&7^5LWx-1EW>A`&3!8EP+FKIEVDD?eO5obYk^;qu{x zSLcVzhZA0xA1)tG`2GC#>Xi@qN4@L#F>OcSqUn zJXSczknd6^q^Lpuumb1f!Q%j<7wm)~3a)Lvc^0}cvm>eTud~1tqqCWMu8#YxNUhCD z6K^&P-T!)@l@9jnN^i!hLZz&BmilUxO=i2}FnKmDflith84zaCVGKOiwF`*QW&M-~ zZT6t|JV=xfHQk{ebg~DX>p@@lpxZs@yB_o_4_f0vuX>R1Z(4^~ZBpnc4?5F>F7%*p zc+g!Q^dk>?1n68u2Y#POjI_MxJxENAY1mcl7z+KD2d(!YmtSbGze$b(d8#k)k_Huu ztYLxjhDa5RiF-p(Ald0=6kW*h$UujVLt8ud|OY`KF8snBvZ>*$~l&1QXO_&+1NVX<1X zXJ|b8`1P;IW*u(H9((=9!o4~)(|IVDn3(-W&E~-FU3P13*LKSs;gp$6Jt8~aq(&RT zEg=pY(Wg@tZl~NgcWe@-H_`Nh<&md%UG(9iO-osi+B`@7gv6}Xy6%U?WQ}b!q=~tYEKBw4BsEVzS%U!UPIwxT=>|cj_6gLk)l7{c6&G- z3iD(jYA>j34@HF~((!fZ zznYg{#VH{-?|3I~_5?Tazko=h9Vd+LFKLXR5jTY#kY44M+Vsth{T7EORI9MNl zRjzlA>GwAB7;_t0n>*n4rxo%~?jsA8LaatnZgO9FTn6l(g1G>ijkreWM}bURjx~A! zz8+|cIRMM`njU~f1yT9dMj+)|MH5>2*8c%gzO|ZFqNSV(wD?#dloNrRQh>z4tl#%- zAT96vKw91dKw6#YLF$8(HscjU{cMUWKNb8My z=`IGcP3&!6SQ6+y6P5zf9KQm3$JC~rxN|$JoT+H@%E=%991(WO+vcZik<2syO&GpB zzs0&|0|OE+o>UR7ZMN=`O;9-RQ~oVfE0%qK0a62GtOk#+5D38W)RPJ#~&$HpFJZd z#bP6zmfHw*J)1)YgOOu&GE!tXjdUwLm5G^zTG=gCVf*sRXlkmtQ>sxFyv>}S5Q=Y! zrG`iCi@BhiTpdT8iVB|GT1XTMQ5b>Wltsm^*lhfhtFwc{DNZ)b2)v<70`B*t{F(v6)Y%~5aDj2H$D|4^w2Cm0S+0)*lMhy0tE5-*Csdf z3}*3l6o_Yr+QoAP;B08FAQNw9d}Lsz9Kns5DHS1YGMecQ*4jM{3wn7S^-Fr}YRY5Q zpa7Lw1Ste-Lh5fJSuDNO$aF3Mo3{iOy{$5x4WZgg99hnAE}~SH(`FFZ-e_-%Y{9bg zD;RT4zJ)9&K3rruXvT{y=Qfq)pxPp`oZD2EW8^{GBl*(HKqZw60`qLpP=k5l+KTvb zTsNb}HVMQqPX|@4@Hn%Rd?nX^%;a3etvstcU&9b$AR2A?FKy)Z+92R0#EZoowOxW> zr~yNy3m|`3=g=%A=Zk>83(55Ru`qKwjd5ANJQldqT+WRKZDSOB_Zw z)`5O?G<{7+W-@#DvY1iIxrqtINWN!0vSGmoyfCaJLBwz-@p?Q^qS1)B9RnI5NZvCn z)c<*gbsTXNV)m2V`ztPocz=aPiN3!w8YSThiYPCJk8_DtdNC8|ezO(N22y$<_elR>jr)Cn08*ymX&_}9 z)&VKgAmuC5a3S-i*tpfhyng`gF{OB-wVb{QoTTgADmBXJo=VkGd8;ZHBV6Il1*4+r z#EPuN99%sb8jphNpGg$MVrUr{+`<25{;zPA;33{jkz$zvc~PfdDRxt#DS~6}#mH1> zO5VjtzW#-|9Xa$?ylpzSBPSK=pY(rMl1DGiZOItDEjdbWOAgc966|R1bz8D5+&-z2 zmhs|mt7)d_Uh{%$ge$ui)$Q6AtML1=x8L zW1$r74xp3%ISz&K${ls^XrsZSwwhi!CmiB2_(knGEE4&}7h_Rs){ea}iS2AfAu7ol zaZri#)Q(i75S^C&KgS_?SlM1zNwa*sKZSJ?VOFVN(&p@_`p}^Lp&EH~Imr7ZRIq9{ zU?~W+;wmwC;C3(t+nq(o+y`KZDj-jNUyY^?aL2yZb6BQHWbnuBDjMs0A(-R$~vQzJK| zZYyi*oqx7C|7m&Ge_ne0>5*i68It~@yg`oiKDY3&So+$oNbMD9ru~&cSeQQuXWhma z$gnuYoNJFfy?(NN+397$^c9T3*RWeltS$~C_xDJt-csa~QL#^8H4anshw%dc!|7Qo z3Q1QCy|4ahryM^V+9{xG*bn)n(oQ26buN|VbWuP%y<3m}=V;%qhYcevdDXO^OIB{^ z?qtL0#X$kXmpuj-N~3m7E-#7?<;|bn?r;m;hWWwi10n(lfD{lR~Y`Bl5SCaOzuC4g-VemMf3ALK{za=3eOK#TX*%EqQbIYUY`PB$gDxh6e#KHp1uZ-}{r4pXe z+rL?Km>ir`5i8mqwZ};`mtuHebFClrVrcwRqo8$=SxmF4GD87`FbgYIs!b4@NZ72- z#PBD2j(2YwRtYG|if1_p5H8q@`jnxM{I!_)dXJi+PRU`^6-}xJWwu650%U(ClFLWT zb>p2ts(}AGkg6SuBtG|WQz21L{2!C!R-hjm=;vOT7!%7wy+XXHGI|n0`?;8KQZEOD zrBbCOlpq4UKZ@_q@4<;g;3=8jY-!*rnZK#&5hsR|Yijaz?nDf7KGTJ}FdXewhwVv~ z=cc1408C~0y;rzF`(}Upq%zvXgx*kYsu*dim|P!t`e1bZr2Hq!q_Pp*rc@I;z-LT4 z2Ua032Z#ToGFpT@PkA>sfiqmq(|Vk$b66K|*K+F{xGXSB??1U)=FxVcqi%5#XOLWJLSvX|ckIv>Mk)5-zXOVJ1+NHd|PnQ9w>5a;^#6 z?V5d+=-J6^hV3bStlbEfSmmKEF3QH$w@;})*q5yjro={2etqgB##`(0i}$LluD`k< zrTKLUrUdOM z#}6~&l+mL?6lA>eh~rgKqD%`QUU?dy18A!gBc*7|%44d`Z0Muxe`7*jG;=s_a6d9O zEq*3hK0h-twBh!mGp(jL%@#f}y#VG3eu8^AwuC3p)MM1Ti^O`Y{{*N5kN%(D>=?Ni zJnsnl@hYuJwr&n2KOJW+Ige6f)=yutk|LTWcKTrBeaBikuc)pODa2Sr8By!$*OP5x zD^*MQR7z;4gkDM*q9ycL$vNOm(0&Q7OUl_#z4#3Jh@u9VqC{A|&!SrB6OEy$Grq8> zVpG%)|5;Juj$Vrr4at65#n@irHwZA5vO@S|l1aiu!ChwwLNt8J7(Yr3q_>18M*CY! z1~3x!ftEF8^+9|3;rJwP9Uv1VlhbrBoO-66kBdH7IZEX9dn zG<``CQ}R-P0S(B2j%2Vt;)~(@oZ);*vRXg=&`Nd#=e6C!%&+Vz8FO4(^z{%U4qe={SoL3^aEVpEog2liFgSG=;efnHx!7UM{}9EU~>w_0OfGaz%3 z7qmjBt~gWY1wEia{>)e}$k<^{t|`v`Rtt(dNwN>=_tpAclD${yXS?s5<9NNv3hm8^ zO=VfacfUtlQ=zVa?aPP;yjW684`J!Ge1w@ZYl#uN<yCfyiG)D?d zs&ubWa%E&>BKDTps4dZSgpKc|=%|@sF%aL-lU2p^!!|$7!1$Q{Nh++=#26S29NnY`SHRiRbc}eUhY!l^W_y;o=Dr@n5ocswqnGB0SG9P-3UzzYr_B zy14}xbgqBj=i6ZIqsNb|CP{E;FR|c8u062dopws@r`8NLhf( zfRuTb`)*|r3~$J@y17OwSs%3SyrxTjXLZW&j1KvYHOp^kMZI#+v)*;`o$oG~~`F@4(4_?hB zDv`j=^8KbHdciN>Z%d-L!l&gZZp?M99To3dl(OUO@CtKGh^tcj*h%G-)n&KkFOt3wC0RJwlwF} zdU`jo-rBa6kGJ@Ep_Gp|`FM|y7fb4`53+7DKOe8TF~#{Y1Du#0_0}7bZ!<;H3+aRm zqm_LTxPwaX93hP_H;tdKjgKdGt-(FmQ7n@j@6Jx=FB0Kdb7o)&?c?V6N<-BfG@vBJ zfwwv94^?jrRd3O-Vofx_Nz{=ERc{JazY=Ib_SVq(d8lk%prNZMxYRG!crY`Rc#yN{ zGOKFA@*qTD1wXN7er9y=Gpm!IYlIrioz+^;z{>5R-zPFuh2$blp@kl_*n>o+Kx5?| zNg-Lf3JF0}XbGh%bgu{LvcY84<9Vip^34hnQQy*BmZxmRk`bqv*gnJ3K34thP1sV> z=Wesi#i86^qD6fyzwg2o_*2bezVZD)5XwN|c6_FS^?^kmPa@e7hYmnF7GFhWPndE)RZxPf=7ZR0Gf z>1X5uf1vMV%&v7buaZ6ISWUAI^5Oo$m-tnNm-AfL<<-}>=kSJ;i&ilhybwf$GhLff zvmRq_h889FV6ReytI0h@@p;T|(;7)@t=thv&-i(APqDS+RRSVcjre}F=&iGR-wHG= zl#|87TvFG!H*F=3X0|uUnO*)#KL(^PXlmH=j_BToe%-N{4p`8hT2&k(212a?x=Fy_nf-jjTh~u*@G^B{)e#w{H#YF5&cCT2w z=NwWl_S3x*uX~qKV&;8DMnWz@ACw^&KH1{Of?*>Cz2$plb z1edtMr6zcb6I|*B|B>VO()0^X@IW_s!hRC`q7z)^247Mx!7n+%gWTYnVN}+za4_in z>){664|HA*$fOL(98WaeEB3m#fM<*L10ul+q~|^Jq|7>J<3s0-RySC?(VKqE%8@07t^fce+Eq9oEXnByqiUQ(L_?yZIw) zZZjXBm2}YDdTZ_mUuaCWz-TbFeAbF&03Yi~D(7>~r_e>V-Omo}G@01g1J>)E^;Vo6 zUL$;|tb{LLZdI|mDuk!OU8#o*J?9I~JHT+z;hJ>9&&H0F* z&!o_u0Iy@!H!i>jACUTQguYX6UHKQ_ZIV;Cnk$7}+V&zpbKd1AE9?#oLeP5SS%KC{ zm|J-FUkSgZg`b6t#KO1n#8MP5V{F@kr>!XZC}hp;_?1My)bf708@JoU(S)^KehDLf zj?^*dllcDj>ypq~xht2ZRP(iDE82pGuYhT}9vXZ-Ex%so4h}6~WnYJdVPM{PQ9|Hj zvW(Czo9eB#A2EPyw+}GYP(y2++b(UJL~1zIzmYgwzG0r$ZZ9_V6{Iswuo}-`t!2j> z`d^qkzNRIM5ku3u{8AFDC7qMI2gG)hWp?smNc;~uTd+L*tckk;Sra9hgZ4LTB1h4# z$C{I_iBS3*x+Ve*|6onUVK+j92DDYK$7l@w&Et<-8usP;gu zwlwn)VlER|tdXTecGDEvG%#})k$H>BoG-_5+Wf)VP}yr%lPFHW4{i(ewg&A7WbHUh z>y?nbHfTR0tA%BiGEr9Y%7L<)-UuZB+8rwDwpKnM@vNrS{#MgQI1;lqLt{S84rhjS zB}MJe*?VMt%3_MxyTRrE%k^aN{gz!6_`$pK^U{}ERMzWbg*v$F>isXVuKpxzNX{Bx zxUSySbrrG}u9bBa*tNDOK9~{C>aOanETUfwwEV5yM6>L^aA|$`|6pmcrS!YB&^OLs z6!C&|&f+*$mev`4R#m&ZTnYIW8HcO6=26!Ftu-NQ)Qjl&j-Zm*&x0aZC ziucZCU1xS?Y0Q<-$LpG<+cGum)7Ev;O*0`^{%d_PJ8yqoFzxurzjr&l)|a^R;;eRQ zz3F(f=|aigS!JMQ*sbgTLJ|-IWB~<`!&q+!{xSuErq(U&;cGuOW9{tv9(D)@TQ_%? z)>~Im&f2b0x0chq;U%kV;I9po_9ezjQ3IV+NP-bOVwJ>IE|bVy;`o+aJ^7h#A(LBt z=6XI-hAj*tjBR=up4rd^UHN&`K~Kowgs??@4#kg1}brAuquj zPJ)}aftd@pwPedB(vsZ3xdN_Y0Z4R(m$x5+BwQ^`&C${w^vXUMY zg2mehc$Ls?mPT%kY#rdVRnxhMOciUl`n~+cdHEeGw6!=tqkL#DLqcw-MW*OVnXKy! zjwvr#cn+jGrC0_C8C8G`(QF4Y>Do;kho z6J=H;M5~oTWV91UG6ZY457eYq<9`W3I^Kkt$p8(B&8s6XtFs_gBk5Uv_4U_Y zU$e=2{63M*BtMD|+Q0>o)%Z11IVrCE=1qyb6gQG0oqm+m7)8%dHTSx_R9Bi*e=wPNreuEFCKSNeEpkO=GS(ENwHE=T9}GvUX-I&y4*Lhn*-N z?`GhVJ;z&3wHf4ekMf11bfcDRfsze(3|&Fdj({?x;`RuTUr(|M$@l#Z=Ht&xOEzdOc9EzmWDa^WW&A3fG7NtND(~3|X z33#S?2k7+F?@ZpZhL#TGo!JcyPs!BruBmU0rB01jlc?aDDoV3IZg@)O&=)^AeZlUA zJtfv%<4t5|L(df%u|3`Jl+24SeqcD+QzKvncUe_T-voKCl^-t>SO|=-!RoOLIjVu(ui=GZYKI)qtZBll(8H607R5 zP71QB%#{pRTIPm^zs`+Km2-nr<=p60IX662&W%r%a|2XmZiIMlD;GrtDuXBi|L88N z_{mvvt@K?Wz0dlw2T4yf>=6%=NzkxoJZPNa|NWeUF<rL%i8?4Vh}UW0ugT@`}M7}>M$CceX)jL)xr1? zkou)*22yQ|x4l?z2vY&~68YkK@q%|cab!+Qfz=9O8g2#3Qhx3Ut(^3(#aDeIG5^OSMX>iQoC;6aGZJc2FBr{ zVO`<_^HLb&e+4E(WI`A16e8hXRHMa@We1!>;pAqcwKCvO4dV2Pi0Y=PMI6u8Esa${ z#!s7Ogj+8@hf2bxvU=-U^vf5<##k$-mNa)3+Z&qSD=AyEbjDa~<)qT)HwV~jP%|jo zuyn>rzUHMN9EmKz7^Z7?Bk?eB-ir=ilcG(p+FoYrC}h9XR8%Rn8C2&qqo3-B^sRnq zKh?Wc=T)1&m{;1O#a~$O@YK}(-Fi76esR4A^sRTq-u3dt1wb4gd z_$?ecIJoq(p;bJC7B}t};KqF&hU{?Kk{)tAdQnx8F&&Nu16KP^ObMRd)Uq@-jz6(6 zGWLRZv-`ulTHFAQHAu%Slyxi(O`wF64AL7CLGxFKMk0n&s-@;{a-Q z`^)e2{SATq*t&Db`QT{>!1VLWSzzTXI84~pGKQDHgJ(X3Z9aU(#|%^qVyrZfP!`=I4T|hNrBS1=BpgHD(2Rn`{^F5=1uiiPR=EL~ z)q0HA4C-~7F&Rjkp@d5eVL4AKBkC41u)3KvyB0lg0N8FdZltx*lpTgU!@MT`O8MrX zKP-@**fxHbmHZot(egvCv1$|`S{HBOE z16t%uPwT*aSJ?XL7VEBSB<2~0SpMA^Nwy5A;f=WL-@eE**NPgG`_Frjh}RS@u&=I0 zDg7^2)b0$|bVqjom52Xe+e_BH2S|x&|H?@ERB?PJEujtbEUlI8T`InLwb9_0nTw8T zGaaz*euFPgmFW87IoZJM?~gVEWuBJLr`--P1oWW8WTUi~th;_D@lSf)NZ(epS0{ot zG9ZwUBXi&OZ*|%qsqF|@54PSpW@_5s5KH@^6a$^+AK?rd&7;DbpEPx6t0^(FfNC+2 z8nJsa^8k5{Xd>eWIE_cGnRj*P+5TZQ&3b$?D@2;C3c=SiVhTBU>G5NrVtsN?oz*C+ z>el0HlHKK4l$XAy?tvougabP&oZ_&9X7IGI6Y4DU_QjG!{t+(fK82|<`eQ=9)RII~ zKV4_a?!|g!%5vkmN05@vuXF>ZR5~H$UP!qK!5DY0;xa%tezAOLrhBG&;pWZg;xOMX zBN<-Qwp>0TK+0NXB-1$lk3L9tf-sOSZM_H9dm;n(K-=G`#H%AJKqbt&Vz3App*yw+=E22qNVgdMjV!K zK<4!yT`QO|~%#h^x6| z52IcOoEb$%3S@9yq@xLNCxc9Z0slVd??tvlnZG~t*PTDHiJ#fXB;>H7LYrA)HU6IP ze~J|oP{ff^Pvfs!>KNcmg4_j2cC}Yr9Z1$KNY+e)L9#u9WY}w=_mxg@6?w%Ck>ZXe zcON7(Mm3Xr`a!Y)NYDk-&EOGQQZdBPb1?2+t)@}2CA!0~w_ zaD0B7X=C#CMEBiXE_?gyr7sr&77B!4QUQj(PJ z&icJl>J%*%Z9N&#u$GFW^RH;BgZEkL>K<+D@A&Js^%uaI57|a@ZQbg%^%cU|qA%Ew z7v0dJPlXn>qGsO4r8IQ7HCV24x@ON&4`GQ&NlN$s1}b#+mIrk~Z8U5$8@)o}d{&{4JSYJ5)39Y8^sWbuhl*+JcRffvfoa%TP$PxD z?Ln`2P!-&y#>PEJbWSzQ@T{&O2Q_*5G>u0%(Hy@7$qCmTcsWf4Dj!C}DcSkCJ%wkf zQ@9gwEgTys4T2V82C@>P8(e^R5~g~>Mucl;btm?(A2j9AY^mgZqqk<4d6nxJY-}A* z=BydtDM0GJ_Yxp6816ixg{My4CHJ3EyU6w3*&Zk-5pSac6(SyaeA>8r`+`IH9En1} z1(nISx_j4Pvpm^d6c5yF#&7$5@S^?;(<7QBTfp9g39quypcWi+V92X%N_s@g!*!F= zjV%q-6R?77l5dsQ4_XuVOR>49c`I-%yZSn$Ileg7(ZP|5`lADfCOa!zc9i7ZR=Fnp z7VTU`Qdhhfv!4s$V#jziil)B7QE7E0^T-i0Q7XonQ{%#^o*6S@*5i{aV5=7%8W`0c(8FzDS9@jDPIO`+FV!So5*o(& ztj13%LQGsFpEQGDHU0=BCTV$`-T=}N$Kz9aMp^H&r38pcqvK>yceR)8JJpXgmESV& z-AG@z@ANxp6>`d!9hkbEQ7zu~?rW)RY3Sjdl}N{UK|Rukv4_7ThVDw%vMF$+kQZW+ z)P0rYjAADsn2LQCNcK#N4+JKgpY53e#xD&XA+=U<4OzR+TKoeMSJ|N*xzM6@;a&vHp&eH8HXeMzh1+nlrl*VqV?%WJ?YJS@S3pKy5F4@ zsZ4S;6b|78XGXlC@9>7c@s~0ra>MG_-El_O@gqi0%V~g|jS5Hd9p>Lz8BXCb#p1}K zwMK51j&bu96$ho?6gPiCoMz#EUYI6dTX1w0b#fn~GaBGdQe6<}pg1EG5}P7FrlXnp zinkcPkv#;w1<}MugLJj1u&YOY0k*I_4Lzf5GSV5k?Tvl~A0o<7VBzo|5l%6^|sY#eA%h|j@eeaueX94Y29t22hyB_G2 zqa^PwK#!Z-rn`YO?+ZYp*y8tf0%;CEYxWZpCP%R2j*{4OfwbPsfi&-pK!2yZexJP4 z@fq>=W}vZ#C_1dxMS^bAM|@M$a|Bh*2Tu4jRKd@k=>Ss8F9o zuI@q%x4if%z;fy5B6_qR1iKpNvsM)t#%5W|oaFU3#OH-a1=S5Pc4v&mR znDIsf!*wq#SLj@l%VwnRg;{^dZP%-*4<7&bPOGq6R!t&M*i&&c(r=By(PdthO#@^| z2AO(em8gV8sBW6m2A89Zj-KWYs?4QytQpynj)RyF$M_xZ1DM}(PSzVkMJUzGqT!c~ zo(V8gfN22W%4O20Svv%PmzqAhnlT+Gz2I+^3=DrO<-50op2+sFsK-}4sKIKir5AlyQ*bnn-Q)pW(|aCV185{AAV&G(l2H zv2t1FxSLfk%-prAPh^OgxK6O{`M#tr#50pWyAZSXWf)|dE_7tDV+>y?p7IV6dvaOC z(Y1*v@ykYPFq-d>$Xtd9Br;;(Qto9e%~tj))8JIVy0g?R5zUjF=FVlR%q3d7O8<5O z{oQP;p8)ChAnxI>F&m!PfzgYuBY;#PLo5<~)x?TlWG&@fAf=*L0sUi?Yzj93-A|c* z-*O-^k?8lW0a8;_uLEh`fuO4975vuNuLEhU_(fLbkYgcP8g?a+hKZz9)gdW5L_%|k22=`He zhO>F15KS+vP?-?gu^tr_5+hU;etBU(M07H&K{HRDNEJ;Pnn*>^nM9}fXJ;>h#+bWt zLph_u!uO?|f!+)AN#|u0wKwTB>cCdxnWmo5Tvv4Ax<`;U97LSi+;w|G4@}r|ZIcj~ zT{7fw;~FCSn5$*EaIQI!ye0``C)Hh;Jy#DNvgZzAXc=2Zj@=apKeE?4(<5s?bumYZ zxRBh?PT4ddxguZ-iii5?qw8Es>m6K$KkAX8#I!GZ;L%TFef`BKTZ^m7*?sR*=ur z7R{sd@wXi+|0ALD53|i=mk9=|cE;&Ix~hfJDt=!Gq%=eXfl5Pe@zM!_*44iPNa@NZ zAf+7dcQjqYhFjvx6i7erGz{(==~Af-|Y9?sywNI))dl-ax*=^yv)j5sT{Yy};i64v_r9rR(2zAHaQn5hs}l=zlB{m&nskc4f&&!c6zU3; zI9|`-B)K^*La5%&$dvjF5Y!=QfuR}_g}XJ3h)`;<ZMWo z$mU)x-T85@dXS`rEL{Oc% zfFfM9cLvJ5q0EdkW#6NM$^03RAvbfCInd+1`4RU!X6~r7-Rc5T#{!cL`CEj#6=#aTz7fE4} z+t8SygA{qq7ZkaGBCp9WGP7NgtFWN&{u>3A_Sd4wzfsVo{T1Xh1^r8-mH8e89S91H zf^7MH@-kzxf#mhupo1jrB36n@+h+l(v|Vl$RdCS>RBLja1?ANn0`V2B9G%$V)UXJU z-T_<&G{lsAHIN>j?gmo%{4St#`S16|nbM05v=m6o8vrXIO8kD`5kMCi=suvBfjWRx z-oGD9K)J!ofySHIxj?@!le|CmVq3kiU0&D_(rCJKfV7kuUf5DE>_IPVlNYwv383%+ zY2G;i*@tsHa^xKLt7v-c5G;<^ZRV^b7T_Cseg#^~O*-Qvqh2#?P$N`AM9?&w_FMTvN->jc4+87Qy3*=RINUY;v7rH;!IP>+QQo zH^`sMM$c#Sn+w6ZF37#@?4W)1=$S!2rv(WQ2Spx>YmCw3L?#;)?kJddc!Wc#LigcB z2uXz*6gkK>HJfpXpAOx10%7M9m0$8$2MJn7%L+)4obwg6P6xUGO%uN_0JIuZ^80=T zq~~ps;D0ho!sHrHkD($z)V$(~JMZvOcu=Tdg}4U=&IiVwWIVu)NzDFJ#D3A0b-3cL z`$S33lXzX_F$j8hqY^JMESwYkisaK1{0`$|Z^7@Ubfj-dBF@OXB@wB#)EUGVp3@kW z!h6>o@MwB?7lu|(9_eMKp8I^#IZg-BRKvrj4s-O^$pKU2MjWMx4qAJ1D3QO-^ze{G z9ydkk;AUMoot|spXik79OdQ*RsjTqogC2fOx^im7eR$(Y$60@sT0cVW zN_xQg&wZNWioLzTC~WT}5@)7z#?P0@HC0Qa(mWWIcBaSir@d)9zx0ZtV~AqXGx-dp zV&%4zs%f?)PB#g+8@8LS<4=22BfpX-oNAIWB77--FcoZ4IifuVVkVUZO#*IWfK6Gf z&oHoPdl=OeVAC$)bm5oBQLedFasF1yU((Day-51Ds-!Pqw+GToTv?y{ddW!_PTwb0 zA@R!&4}k_l1B-g)1_m?eQdsJ-GFp!;P@2$>Fvsl`@>zRfPBsOn;>@&Zym__e21x5T zSp45lBfORz3UXCBC3~pt31RobPdcerP8U&tS>oP$4wxeQUgVr0p)gB&_ly!6_Y0sP|G5w0SM!PlQw1>t zs8VH=M&W^h^!pAbOl6cu11Zg{0a6*|cp#Ng%H*mp}DW}1bD6|YnY4wl1uwQ#nE0C7*f(MBM0}b2lK_##hTHe7x zxAWictK?VH3Cp9r!GNk0TEO~6G)S|-Ja@R z4?=J*hZ-ZaV>v-k%_Ilfa5WRPZ<&pgPYzF$uS0?va<+%{@w0XUZ^eqW=nCa3|puM`ZXlEzE z?$!tIgA|Sj!Te()p&+yBIM>kN5F!ilj|3qL%;vKqkP2J}Cm%@-5@G3Cdin{?bXFDz zglVf$@nzM{6e}UlrGI;9w1_WKAucH@Ilai01xIh>*ye;1n%N%uL@IG^GrG-f2B#RM z142uLMM_Pc%h8wH;;7te#KsH2twwB`0AX{h!57kkeULmQb4*oCHnN&sOLY9J!l`@R z``A*sk6n0>wc z!3$}jE`;BCP&M;=gu#mmK#CXN1XBE20;Kq}4oH`xEb_d^u!RiN!xZdd5wpw}`X%#4 zz2w(`<{A<4KQi8p&TK|_Jqwm})@%kv`dsQiMiz6;!(ZKD4N};l<={y(IP-9O=vmP( z1y9&SLhCTeV-wLH+Dc&IMOlZ3JzPhnXDkOZ@JQU;yR3th%>Qg>5pIi5WM;C1y)}7? zyC#p{YfV--IFYv|OU#bY-vK(gpu?Y-8pcty(-LcCjq+~BV(j%^{cEUyS5onCOa@cSD9!LNysG5ROz#$;Bxuk_iyu!tUKbD^InHd;7!g}>tjdE!w z+~q2nAxJc(gjP7qewDlIkzn9kn}*u4uJ({<5RhzESrDlP&Qa)PBUsgPW9fN?w+Z1Cx1e&Wz4i84bKD+Sf&>EiWhVh8(C&v)6=9Ay`j`2 z%cMc68Qq+Gx?EkOVCot)z(c-R(Pu=JMeR48-ovb;%~|xOcRb4DrM;_OS1n1{L+I#! z5lRv%5Mt4oy?}*IV^nSuu|p#A|4+DzeH5g#7bj62ZPi6D#6=+)(cxy%4+7FfFZb3O zJ0GaR#6ALapn*gKOG!cpke;MI^1_Z{T`HM40Z7xy<0~ys9ti6W`+E=iqX)eUq&WtG z4q8g32g&nb4I2-nrGz|4G~hMtTR=*lL=95I?(v`>deC0ikth;ckKa~NFY3O+RMj7S z+o4wDdLR^a;>SC@T^xI0i*-Y2W<#FOhG2Ocf}Zy3c;a9gmpU#|y21iSlTemT2}4H0 za;s7NGa6N(EdU+|IbK4Ynj8jEL~G>)XUu6)#0)PmVqOk$P3h(UUj|Fttb2@qODzDO zZj$Mt{7m2NH`5&w>anE;do$NbnB+fBs0fG0aH>JX%jW&Y0fc!C5x@6)H>6AC|9#5b zZtet}z1&r(lu?P-$(WxNPCjkkgCuI)(Pul>(f7v0orI_>Ow>u(ZC)aaY9?(q{;u{e zgHh5Mbhq@q%bKoASvbn52L>4 z7W3`AVw^P-7Xu`Z!sY{M-aEb6B|w_@WuSGY zrLP02TKhXdhnW%jo0sk=zdJ5tfHa-x3Ti3W0%``{alMJ*kTk@oYyKBohiFXg3qIe^@{65i0f5Jc_Wm;{ZbAcqU-!}{B zj|Q@Vo-$BByRsTi3u6nDW}g77X&TG}7*V3m>r!F_hICBaGulFP0y3&A;=W#OwQ0MK zp+0TbX+YYpKw%qr92&xbXljspMl2^*Tdgh3sbIs@vlM8L>&C~MpgrI@B*A6@(-#X3CPN>ALu{mso92Iz5H&#Xs zw%Y7XaHt*^8~?F9jc}9jswO3`7e*OOo(OaUmHB-UpyN!~G@#=RbSaQvuHW}{Ak86^ zWvq!6)vu?`Ts8seN>f~wR|t-Z)uNqY$b@@549Wx6cKc;}V=(oI977v)BoZe$nqf|( z`*uQG-&P{SR)i-&zqLf@+QjsbzwyTxdD>r6WOQ00Ti%cSv81F}D1$GuWhZabRs~jx zl|aWnV|(b~k$l+?JWB$5)^F@j?FB11Wc(pL+2}SF+lf`-l*ryuqc^SxLv~j$ibE}O z(7!$Lc&LG%jz-$0xKL5fMA_3dt|8QFF_2WEqYc4q(IcY`V#!aZY&}k=Y;RwUnYe4szuq%Kx?*l+;19BZuv&k#GutFlR z&>V6V+G1kAOmoorjx+%4Zn%Gb5i{FXzZ*)?O&s>IEs^DMacx5d~fr zhA7$})@%-}l6lWg5c;~+VQN%eK4QNiDUr@QtJBi}ZjR$%+2j?gAZQcj=L`3C3Z+(^ zOjA<0S16jVW}A2hb!Q;H45IE5=m3uu!bR@tH@9-}2p2R#`y($sTY_HD)wlZxUIuM< zuj_iqi80q5QU{@;AUDkISD^Rh>|h*u4{`>|&M7iyhA{nyk!Rp2nSOqpNv{SPY{F`R zbkZjQ4K-m?f%F;EVxV#pcCVMN9cYc2;4MI{26_uf527Cc=@C+t=QLJ)$!hH39wZD- z+~k!f23nq65$bW#poI5KE9|Tj*4{{`lkFv_7W7gVdRsXVvFof>QRPsQC?x+`QwO;0 zgq;M`mn0g~j;>i{eUgP*3BJbbcv3&C4x^sKl+r(a7`eeOt8qJkxtMD)_VsmQkgAG? z>T0Z!2OzYBX9XghI0KsB(ksJ9>lhpFleGzW`Fi_#@C-Gc9sA zqW2rG0BOnZ0cqY(fi!O^&C_&;c#xuq{SHP}9s3M<8#$PArf7?b?A#pyM@iMYVMJnI zNe!IX-5W+iWXCWH%P;YMK$Um{*hL31cP2f5Vh1UCk@qNR-X`ShQ2#p1TZ#BZ##cV*?13dKbxILul_L z2J|{n0d17&P5tLL2~WQ5kEVVgLK`t2(71t!$fBO!f$+6UhBBoABObl?Ny0P#;77bF zFA)r~P%#z5+>gk{WhG)9+n^VRHAF@QmET$vuGAlcv)dYo{l-PH`J`wvmB@Xqcqt z66C=OF0vSqm=)X-OAW`)JbekkwKg@+k1!tdzi!^mJBP{ar6P3PzrmJq^V5GbuBm&L z$!KtW!UFyfzA-hKF-9CEiz%~?9~s!CGUD!`G#y*9TJ|msUStpG8yIo4XrfnjV%YdZ zgv6RSI_52-E9aySI6F}Es&%oVH=T~oD{pW5_5a7+n}EkzmizyccG{+;@TO2O>;Vd- zvbBQP(1MvZY2SfKDacZl3JTV86sa%+MOhLiNjttwtqX|9tsWKe9GBu!(khU&*tBex z>S0xE5wzog7SvD{JO9u3x!?EABrP6({{GkhT-SfDD|x@qzHj$)-}giHpLpVl<5FwX zh`i0iYbIfySkSU#+LuMyw|ujS7ExGvzs(Bd@}Hd$IFI>luaAAQ;2;|@bu`_m&_a`7RLnRXrf!^o3vgYV1&UGNR+lN{-*Hb_i_G-|h?o27l>f;V= z2L0NhZJ^O36?1|HIn~9d%XG851@x5j_wTV?JTuXbZ}Yj6Q@`EETivcInUw6^j)EC! z%s-#WV~SMyPw@+zGtyj&ew$2j<~+Zn&$`T(wAZ>Z6HH*&xnw`}lw*hV6fWPlESVBk zk85jYJ2kgA%+A%Ae>)S%6sdR{MRg=1|3lnn;9ymuL!woMZmO&*J_@p8e-dQHUK-m~ z7yGcN*!x@iq8*DSE{^}KwQ;0&C;tM2@ne$vYTF+1U;BmgcShSWZWJwh(D%g_$sGe8 zr=PzgH-1B^l0f@O{{H3#>o>S(4FE@wnQO+Xt=WAOmL5zyxBIs)3rOpJc^;~=^OWkr;Lv0x?i8zw|;8y2O<_~~z$AzALt3v1A z5w@i=obGsI7j{>llrCOBNe{;#y=vTsmeW^7MD|>|^gOAl#jCtu_2|NAO4`u%eZrr3 zpQfeM&lT71k)S+OIS!{*2In#1l9jz6=+Gc7tY^W>Z%h`PDfC#L9xfN*`tc^KhT75A z62v`Rvz1Tf;88V!hZCV#dz{LVe=-xQzy6Oi;q%-q&80v#o9XOk=yM<&%-;gpU|s{V z!Q2nB!TbVftDD3A7Tali{(EPqdD2{UAz~pu0kUzH2ZiH|di$*l@nMk7u{Xx(mmr%k zehac#q6q`(nrl7wP9d>4NcJt@Oy_#zg7s_}626;swH-UlAqyBy9;h{F$e`Ci%cdV) z5WkxZ$RFH5uzv&KU+bW;w2;GXM~Z~uu-97J&^)Y+JxH4xNsO0=@oU-jn}?fX54uXh!`||+ z_gay+TqZvdd(fQ>9`=!kecT&3&VyL>@m){0ulX z*1j$BFfsNp&OD&~aCLM2+WN?YRK{2mB@i(jC=Um&JuvdHCHAnXVRATZ z?O~xq$~jEO;cz(|zV`6Yq0u=Ui9>@N8rC-8;OzEMR=S>LBzcFoVCPQ5%n8S3C-MJ; z9D>RZu-@^o(m$X}jJoFCrSHP>8b6DTYwR?sv|LX5#qWx6(1_feA#=zh>td zm90n>iWpr{k1X`1+PD1k=2B{S2_cBE{_6B&M~`lHP@Dckp$Eq*<-9VOfOW;@I4dKG29q&8Z%-;VwM-fYLn z_RD5V|9aSLYg2cr3$dwAl$PPhZm+HIIx2%V@x;{lset|FoHqU)UguZHC%TMB@+3PU z%OAueEkiK9>NDK)bD?KQj(Vb@a}HbprS}ugg|eMxRj7R}i6*LTa6EPPX3wGuTD-0! zEvr;w_Bw1Rex2F43S3JTu=TyJ*IseOAL$xpZwkYx*y45l8td|?sl7-iqX~JYw>mk6 zERUUaT5>9?j&LmX@eeKWg{P|A$2s?|JLJBE;-Do8-VJhSk=~?8S2;^j@DnAGOsb4e zI^)w+tp#Cpj)Oc?o^Lhag4D;+0xa4_C3k_NR+8MIvM-6iYcV^ccpi8)iI^=EF|VR} zTMDDJy8eIpQKuojf9X>?mxr&dE?lW}?`efpyOkRUacMag=2K2i&d6Mu5L~TwwsG8h z>jf`8{&yv<`c(|&sTR3#sY_8hCynXy0p{fJ6=v@?Vsxv{QU6DY?y;UqZ7wGar2Q3b zd7LHZwsKk#uK1sm*uC;gJO8HMEYkRptJ_9W_%8~XOz6(SUa>nBbojBd)3*Cahgv|7 z!xW!P=+f&zXZJx+fs24-;(gS`0nTnZSw6&}r$H9tt7D=N{|z$Ny~v`4SPZh%ei5Um zKo+(HvJg8#7GiJqq?Ut2Ko<5CkcF59vJmHjEX0REHB2zc#O0td4lM@l?a;NL{T#Xx zbcI7*psO9a1@uGqEXl;@LH8Uf^zWec4t)dkI2*TQ;!e~@Pl66~>23wtN&1hV>z&=7LF-(Izk}?6`v%C)m?PPW z+c9q($WB@Zf~>9@K~_VjfUJgQ#jfYZt{(zf*)ErzOKma8%62Wt%622j%GL$4vV8$$ zF|Pz!x<8EVeiqyH$99i{tYw}7S<5^RvX*%PWG(YokhRQfAZvvhP8L>IwIHh(4`g+4 zm|R^?e0z*e16ix4K-Q{0$lBv(5vt25m9N?MfWd}55Gi$IH`dRH93#}$?P#E#*xe(YBKmv@1pHS)8Sns*QQ6~ zcl0nXnklQij2Il{?p9zP&U!yNnYcPet^}4dyOrbR*&TlHN$AGcHi&6(hIipW^)5Dm zP#wK$U{_g7rGTT<(Yot_VXl_gf+EvM3P`2x(*N z)tSBgrqO!IjI5(Ym^i~sMoRca6gxE{ik+|dX2b##Ug$DQE;`okVN!|Y+5;Z%)W*W>?{9`R-^edVy0{!(23KZ)!AkDxbi z^TC#WlZkSW;qG=KiY}iR)7*|c(!x6q>B7UApx7?Q0@^=VPc|g7{}#_Qii%dL%`&-#b4?k>?3s9O-K-}b@SYoA zZW?HAq$Mt<(`E`KBx2AhVohD>6YbzidNMZ@hy;=XPegp7S7$1TrUVP#C_Ith3VTKC z#^#1+I(~l>ja68%UHf!xt?1)O&N)d5&4GvMG1*MhH1(1wKjSR%C-BUza)KeXM*n!H zeN%Ji0JmqGc)C5f;SFz2s8S`Er`aXTOoS$_2i-+DxlZYV=^^fzP(RgH*v9Q=*NeFc zqyRdq^xF;Y^!EQlKs9aPPAi8(xIeM4g0`9Gp4skK+} z%qk{tDzyHD-i1B42^MkZ++3fY{0pyB#9^Mz9t|r% zLtE3|+q_wScKk+m1DmP&czs*VU)pM3Xq)`!+>hD{Z=jSo#o1)Mx!l|4 zwwLROTr`H~WRee6iMoP%^T$hl#N-FF8q@vvGtMfOWTCCcpFV5KRc{}dMY5CN2pp0u z^FmKL4^QsTm6^5!pKBZY#_)8jQ=*D{G*srtLuKx6LuE!ZR8EG|qmefbdNpL+tv0vl zgJTBWhkAY`Ts2-&VHU1Hi1vuKnm@P>UbC>VZSppa4G3zS`l#hmu2hAMY+n*^fZR@| zhn(kfSlCjnsvomedQH{T=eq9f=n>jbqWDkc{iCVG z-0Q<}6U=4MZ_52CW=89u-ALvcN4sxHZw=4A)!Whc;@37N+R7L*9*9`ErXMn0oKK{v z5O#}A>(m!DSHIm&7WpOhBjIoE*J5Kc_KVC%6r`DrS#R#Z(o<9)^GlVb*SP^Zx)GDe zdmD%?e%ItPwrALsOP4;kTIOs--1BQ`xLO!YcH;UbNq$ToyqfTpQhOx#<) zxtGi122xtdTIILDb*I(Vlhylt7}OwG2ilV7US{OiB6chl`KA>PQriNav(b(WorFG7 zX_94lFbGv@xAb_O-*lEJ84O0Z1kFAxkselQU}MDUlPcUVt-xIcJe7XKzai9e3(?9l zQ20G=L!uS$C1ZqWM^tOib8-H{#VM*<>Azg+SMa#YKeSTz=wHU0wY@s7t_92wsh?}z zlU)1!NQC}uKUg|+**iTN%j^JKN#1XyR1`|uh8m^aP}@CQ0^353rPcKbOCgmQ=^%4a zOkM;T>&4bCUW?I8l#y~JbiQj8oB=mboj*NQ@7+9!MNlII&KNYkTa!orm1T~ zh38ue+ZkB?kO}Bo%48GJcR)6*4yIim#FR{kI%yMzR0wC>gpmT-gdy>&N1Z=0iCI|P zvl`O9q=h|<3FvGW_9#%*WHZRZ6fr$8a5s!Vtno`bCeYTg+FRZ;@@uLVU@6*Wq33V} z&x^2~LHsrECOi5|7hWE|Zf=3rKQi6lM_p7>c4eI3HPX9T`ySreJ34nG9%j|F7X8go zmY?8qXWUf>MgCVE-CF$AeW`rq=xaZi@xJ-$)$f<*5uxXuyLrf?Ae{IH~Z1LkzWSRzj~V2^#ijUL%$mXL>Q%foxQG8 zdX^Pt!)V&b?L4RUvMhcib+3wCx))|tzu^4UOg$sF8UJ`GG4a`;5B0?7VIFsqlt z60ao+hoQSFCdio3li8Q{5P<86knM{bgYh-q>V0RPHlBn1S8!u?OwBkc_o1i?|DA-b z3UhO@8=>NVJTfbg9Z}~+*>`{-6K6n zYFv2C&Rvg|AvjbKl-}a%+1Zm#@!ulG@F*(Y-~oUH}oloJ5S5K6N}Lt zl~nv6)s!R!A0C{bove0PVhQ!cV1lfO^}3@*i9F#C8vhvN~sbVX|Y2j z2s=E4=iUs*5AYIw8fzDnXMov?(EFY%@qEm-e z^l~8tax@tVJBAv!vnX1}W7tS-7fZq^?b8#vlcISON%~>y!k{F*iJnN(w@k zMq1HAdQj;A*Rqbl<%)u>*I6UW!g?v9c$c(LgdGc+hYjTuh)3C*x~0^_H;i>K>@QT; z@Op>Slyw@GqDXBr@pl#RgRa>r_MDr9p)^yed{Q}^?(a3Dshur-3g6b@0j|S$UdLQg zT8D|`Wl3f<%+)Bd?vZRs^iNwb_xQtBa7x0G9U&%5N3cF#H`D&1q1q+v|Zu~WAYkH)dCWad(gVI7Gr zNUu&e7fsr|CtXNCOIP|`PkMDoCxc&zDBrxJ9Yq-WPOhPRuIp`&;G4{`|D$A_U0mJ& zOMUCPf6}*f)45y!__i$7w<_7AQ)s#y>|6cnZ--ica~+cY_DGqhB~)Ed0S0ov52ew| zC)-$n34oqb`V{|$rISs$KIo!}x}sQQhc&J``_7(iVsuQ5-Vr0|$~Avy#^}8<5~r)( zjI9Qp@6vc6Mv~?>S6#W!cdp{sGNk)|b1i`W&ACdm$18+NCjJ9-g|k}~+x-l**x8A( z%=|qAGTEV5VkC7&W_L2ka&7{V>?N1 zU*`O60a@<1#{Qm<{q2nXRX|s}5aZ}PUv@D|k@?f(mByJM%hkmoi|=ZX<@rmXYh2iG zfh_EgKp$~-;(XK5Hko(;WMKzD7W1glk=?#AIu>Lxr($$bj6M~kUxKWL9tX9!H1yE0 z)y7{yRzry~k=-be*&PA08qySf|@>fDrjhof`qJfVdy zEE1w-3LVP6-8G^-;x0}LvllIMq1s;^kwd&yx}l~-d8wl1yyRHbBBH$3TllVpaB@^@bZ{mBZU?Z_S1JVnI$%GUi{>GvGKo(*aXz_HpN)OMK z4t*x}7k7w=j-G#EzQ`BzGQoG%Y9h%wX0oV+W2f6>YW`DHtfiIP-AK&(v#OPg^{iPOD}0wGj-cRd#A z;Oh;1+9+OKTY#EYD53|k$H_Fkbj>962WAQnT1Rq2V5Hwat4`7W>@vlDH~;id8)x!f z>Z#CMP3p)L*0t62`b`g9_4iEE%NcLx%jJpb{H}(ppcuS*MC#rK0z`VtU3i6q47VMb!ue3#+jb)85_V+`+kdExdV=p2M>o(DeGDRe1?NLEKOY&kQx1|K z_k>IhVwgk_?oxxj(s-@gken*Hy}~YJA*;$YI;OD=)~OT3jeE`M*|FZn#f+7MpvHd zlG}+3>O~3LT%IEr3Upr7WzbePY^&ZBiTcJ{&PaP{`7o4ZSH7rO7NxmNH170Z1?M9B zd#U^lmn6KdFJf-&bnLp5TAUe}(;KUwN`cgwy4l ze%1D&I-HNW{L$@9dy_X`-m7nU($p=lydn?lnrC`6+&X{kYkuFK8nRK^M{aM?5Ui+sv2*wQyxsH(vci=(tzuZ)l8xd?M)8p&~D4& zWctwc&h8x`TY^3XvL#48?9=WxP!t>^1HT7kuHxXfm_?)c41dYQ(fq&J#Ww|HX=Fea z;)9^SPn5rpf|5rF0&F|n0B6V&7{&d z=nb)d=QUmUMda=+y%}eT$hR&#sp_7JJ1P!2%zS?S^_q14Hx-v~uDCFz_sv?DT{{9a zXJn!#J-LEz#Zj5Uz0*_?$Q7bbVO5P~iHch;UM)Q-HB1SG*ZJQ#utiv-8L_IOe=6(# zX8y~$-e=Q6#MUM&=?GO`%VdS)R)6CAPe0SU(7Q%Yg*Nl-zLD=qN z(!vXDSG4@XO+>oTy=;idElhUS!Ocd#d-q6z(*4~l`G{=FJtNu-RyPncwo~}%2b?Cj zq9!5N9-zJ(!|xN}cYFBV8GdUip!}&T>8rk^uWD3Zbwz#Whu=lvcM0D}(SY1{AY(ul z68jNv81+1?ijaz4fVU7l;R9O zjX`<%GQLpSGo)nFdK!ED5e8;IZc3Y%C_r|2(LP)4yEFFPvy9A&bYQxhY(S=)`m<9l zwsyHI!gmgju(>)y9ZMBppxt;1SeaQVgZ7~pEbojiSdLeWlU@0Dt1B&*aj~ApVDV04 z!W@xx0WaNiz#moz)M;A*TY`3lasSj9BJQDK;BE(!MI}Uls(23 zaClSQS{-WHV5n)VRB@=>SBGWt;_6W64u;xZoz^FYr!~1c)FFeR>c&*1wPtvzztRoj za{U3rV1?9JqknJD6{6E&98laBVTDYiD&wNvGJH#NpE$dM2%fH5=QK!>cVfMuEtQ1lM=|oj?E>vxF*tIQ=bctvO^>@WxY_kc; zUBjmCb6d`pa$x18aQaynW}~`2I*o-Jbo1_a^s9Q}nEc>tnwxcMImI182YG4yV6RMY zb;K~x&j7+-L`cjO{wivwB+3<^&0^uEZVY@g?x4no+8n5%kRx>HemZsEAw*jGh;|oI z%#=kr(y!#>kkYXvXj@XK;b>d_=`8H+Jf8;{!BRul$Ws!$GrMc=tw$DGNJSQ zGTJ?vxD{mdf$xEg*!eifVm=JtUv(jl=f4CilZn&#KZi|cGO-=>URpPqIEFg8!J(-j zW06jS_GT9YLolf1nEKmeyOp4?Q8&rN_hY-qVpNII@yzZP%X?$g6{EXi^xGJXCLb2! zlo%}n-Qo84U9nw1$a4DI*zN%47YloKjF!cyFGjD$Xv&x<#KIVTB}Q9fBtZm=ITfR8 zWAyzP{XRwqGDBL3vtsl?kez!LfxhAD?`qI0N{~!+gT&$wp^yJBQ6tI3dQjJ~LJ|YG zo&J$bY>QpTvOd`vM-2RiPK?o<7+oEs-RM6ZFVxalgM5@fT}-d=gAPZ+lUh=ZDTeJc zWRYW1ep)35OTZK;CKa5+y43qD8O&+|iFUy68gPDn4Vx5?a{)lwbBi_wRlyFO-YaZXiI%1xd2D0vINy zpW=*lZJTnho6b})em`&1^rD1VuO3}+-=aUxW#vVR%5z5ZahgRwMv{+w?^w7n6yxUE z#Thk&^|cYdDA7Qh6J$lHq{qATggV~-nZlQXXI@Yh`!`j`^bbe!1mnk}-<+$pe!&^{PsauMv+Asmw zcHLCNBe7SdisvX_S2Zb5JTpw5`o^kDjBgp+2Pw4ak*f}CEBwCT;)vRyvN4x0U+7|6 zxS}vReBZ+Bd{tuHL15>YO{lNutrc(i@3CcG2+zp*oqKyrmtlow-f*(HG})1^*;u+7 zOCD6}VUkUdZtjkD*On+1&)-u|2@<(|L|jVb@2Qh1+ii?~CB6SSSfY~TMS7V16D3vN z(7sYSTaGLyiBc;lWScpV@tnWMP1f1{Qune_VstaM*YzEeir()?`9Xf@8SSL#jCM?$ z=EsPR8qM+N)4>gg*+>UhElLHSyeztv35qI;y5U81EtVGG@&&-cJsJ*v;ivQ6=d087 zkrv28u~9JJJC&tIqaO8jr|2sEIc>3)z&Ag&H~;z}^nVfX6YgfmYk4wNSddJyFc398 z_y%71xuL<1>5dA;439Ma_@!LuB%__{!ouM}QMm{=h=n;L{K^LZ(k^8=o!>CAt?+`+ z#85m|qaygg8*W2L+SyU}X$$EGE`NS;;xtFYvS{4On#UPZ9Hp4T0~lN#WKIY0$Y^k@ z%9{zgR7lr}Ic=l$?jKyJc%4#3+XmNNW2xS?Z1Zk49?WV$OIk1OISICcff?w$eQcCt z6tQOYi#M#&?R};6X;s9%+J(zbXZk}T*3#hG#`t*@?h7OqRStWgxBNvyOdT*$l1{M7 z=~>ad3Ga$`&#t1>X?gLzfm*u$$OSj+DQ^4otsI~nV_dcV8Twn!cKYvVM8s-B}zpX4u@_$>dQWx3}L9b|fb zHJ#pYjO?a>dfcY&4A4&>G2NNI#y-S9@X>5o5Fa+UGGy%)wL~@igm{@`+s2hoPhw&B`C- zrlc$P`u!&}@)FHEN2%t-uC@n}PIs#n1}` z38MPF&B~Q2&S>P)VO8p$cAO-2Lnf8SC~r($@Ki%A4)^mehgiBV{?j%6!;2FK3H3%r z60^I7`a1~??3U1*dVdA)JKwtZSMmPZTlfAt-rsoZ-v5F3U2okxYC-mTQ{Q2y@j7o4 z|6JUWjg`x(di>1gVi3HRe?hnQUR}L6p2sX7s^Zd3b)%D#XbX@>dKFn#*F5GIUQPc} zgns%P*aO{gXw*ZY565rVZPdQ%rgi0CBj=(qHe^Pgjm6K7)!YYdEu2+92D;zbT@U)m z{&MY#U0(p*>s()o?M5;q_c^HhUja_%fb_r_L;**4!#d1Rw-AKn&gkWJq(~b4l91M$0ElnC6vQc!o@g383LkD{^ zp_!tWXsWM%gKn7YY<;w!jJRkKPjr2wrFd;kFuT5`X-A7Ub4P0Ou4~c-F;5;jobcD5 z+(}Z2%G^WzN`I>INcJe@$PXs6lx)eCd1lc)Wc|3FtKKZ9@E zKi#z1>lz?mjw&$Vlx-%xuII3639e$5L1Yyk3AgrS8{mCH(18EmwG-h(a12kbb`jsB zD&#d=k2C7pKi3<~MBVD6(W;Aw!lR*IR7G#l+l1@-{xq6an112BtM}o7a6cVP+{}I4 zx~r0@%GpU&@UDbr?7|>`rCB}N^)s^$s^WiXpj&DuY7j@tU$;2nb+(gvNqs}jKpRjc zyKi`Kig$#Pen-LW7oSj+O`l!GC%2d1-yxtMLRRxtlm;hv)O2Q}6PvBaD)(Y}FA5%& zgLkLv*yeHIbvDo!`nJPi@+!iJ-p$`9roy`Esb=ryUjV14=J|ykSMQ(h@8y`Sb6WaW zy?$`EpE)A=D7V&&T+02;b!s}|2-A2?j2WE+*?osvk(F6fd!yaJv`pZ}fvyF{q}+RK zM@IwUke1-gWH9p(CsAa3gVu0NI1VzWw8e3d`Tgs{ocX`v)x}pc!JNkQ5fgi@5c%ok zYiQ=>jwL<4nm-zkZh~A*-$tSuU@Z*TMy1Ufb_bCH{kA z$WFhgn(!tTknrRyHrH;M@i`?dFg|}|+%PZ^Y;+yxwt4i6 zyXR!w-Q1F@>K%ZQMP_P!nTu^x_DJ7)pL*+wyT%ZsJGd_^1yEh9r{e|xpP459tX z*q#(+AjMVsFkXhHDBCzi8NwKPs_kV6?R%^3WeDw?2S- zoPEgUJlMCEi(xwsFN5<}ylp#4$KHy!?Wi(Jpt>1HsBB-~%#7Op9nGt-d@g^2ud3ii zNm>WjF_m=7DvE!peCrp7_?m3A16*hPTXi^wzL_b$?-!QT`o+LS8+_hk-;(XJ`2a;I z`Tq!0MtpjLX1G6}ilXikpE9+?T|u_4^Ti@$;2K)pBy@|4@Pr7ByP*q2oNTIUsZS-)Po6PSLG;*Pvl z9;JTTDW2Q@triHnS2{Cu-K_v-x`T$$pUj!*u4(<%i!;IMc08qn8R$r=d zoT#_mt_b_*FrxWJ!#xZ`bp~V7h2%4SW%-@Bv+#>EHp>LTtL%V#{NmXSesEzuY_V&@ z+(u2;-L5G4F+Ns0paLvkQr*jB&=32DYI_+%`zh7-GKBVx)%G%k_Lo%K%MjX6tG1UR zv~RAqmm#$GtLOjB43&nVq;C&R~{8-C%4t7jz5zvSdP(v7<;knb6_Y zLVPhsD`TWfM0346Mo)nDVwFiI#CdG4$HwT?7`;12m&fS37%h*{e}U}%D+y#-e7}lO zIYuMdkeRFWMp}pyV!PHDEr^jG(6kW67=1fNIuA-UMKaL~GUBS9(zFnN1Q{WEAVw#! zJu}z$gN)F-DYmhf zWvd2ja7rr@Q|UQ~3#1zRQ&VJ&p1~UaAe5HADSn>Rv&T7cm#WKz(S9&KdWMW!gy}cd zUiBx0B+4UrxINqh&u&oUF6BXiiTwTU-KZv9EYD}hXpm&yU>ffslZ)h)J(lYXtfA}D5<*yN!}II?xBHhN2@@Os!f}h-M z@9h}%C!~E8p4W>zEQns`UzCQ{V8|R_1+)5ioofV&^D3d*Uj%#_r*aT_tl3*#K}P}QDmzA^ka&=X;l!j5w zI283|{r!Yu9>eBnO^mL&`Em{Ufd0>!?Mkix;e)MvhIAbN7Z5 z(SML~BC-b}CSh}w2$z7#DkR381QI7ybONntUmHABJ+WLXkWKDKPwAG+0J-@P1Dsd?ao&N9^ zNKss;PvCxiB8ny^>M5q|_)PK48oz0Crtm;+o2YQ^Zg=|Jx~oT_`=@*{H={7l&8_#F zHm12bhvY|rxuo5pTPKo@6#3AUvyde4g9GS$+QZGRP4{gb8QtB*!b*Mtfu3uKGEAv3 zmo4m!_2}ekK+nTI@s7&sEI&*Y?#D>eX3tN9?3(P`G3p0>5IytAvrvWRPb6UTCpJ(U z-`B**hS3lTLx%fI5mM31W@I+^G@^+vib;ev;YLywAKf?5i6Rx14dlQGy2r&R1sea) zdlOZLiXs%g_3~NA%PqAJcwIjsm)`0T`JD~fvH6{2y{^9#5!z=^L&KOBkvsj$6Xmy6 z4MGi~3T}ttMoW)FIetU-Py8R7eU38GewrGBY#*{_H*%`Ipe|GMnx3PZyw1@3>nwsfIT0oa>P&OQTLIQ@Cs+kJ-dKq0$djXfm!QdDMye^X8nz zNtb&UT~5OOlXpS0NEc_J9yL$- z{7j)YJ-L?#b7#(PQ_O0rsLk5K{dc6OwS#W@GSCO1&#rXq|#Q<+Kbei_#>B z)ZNYvt@MxZrj`roNNlkE2DZXHo0;1g&pbm{eQ$MJ0@2~Mmyw=pHm_w}=O%>u>_JPD z3FZpo1l+H8J8ta{?0KjRDBRs>PgC6hu7cbk)#O*4*j_!TjG*U+?@FS8TqBiIUgrvD zcpE~cHMvpTC6pJW3!BpUZM)Kib?N*%AFGffWNvT>taWuLG@CH92QW+Txz5~}+A#Bp z#N6Pbb+wV>*4S}})Ci^Xy(5TeURzUN?q>siHQ9zUgNf_TE+*T(x)C$I3CUisZe|^z zrMHf8+S|aGL&()OM%t@b{~f-nGA@mA%5^oP0>K(oa5Rpo73Qff-Oq>2n|^_I{nt&= zGv0@WPjrV=r%;hwc64Pk6GDA>V56(;jZP2aT*3Z`ip$e|oIuEq!!FNUUxcMByi=Jg zKdYT$(RD>_2sXG;*Z^AL>{J(qP6PEj*A&Q@zkQIs?K-%Hya2n6&ffx%iDjzO*$c5B z1sMzZRiI7I-*q6XZxONo<47%N%VMO?Vn;j8E8l=^neR{56JSj31sEatn;9A zmGJuKT{+_YV`|8Q!CD~}EMog|$-=bv@!o~L_wff7dLP>;(+2%}6w_v?NpN+EPalCl z$m!Q?TZ1F>oHTG(dbp-MUx3jUG`oT`;s@AtRx^D%Uzpuo0-vJrL;cn1FZW#U? z^sqzgK$e=?+;XqWRBJakNaL5o|K~=~RJLHfj?-2?O<-0&ZFkJhrf?#)>v9eFy>WCj z<$wMl`CIizi>TdlBUwE^upoR)ej-U&WgZT)O46clc2hxCnKM9EnR8-);vO-(_kyf4 zuLfCVS|t^pw@xq)d#hS2Xw}|Gi89T7$5BbpRO@x_%~TMwNI)T|5NA5@Z5Q$~2Avvs)hYW9juPRy zap4LW=iM_wdU$UF5B{M0d;@+_u_5pHBt-71slDw@3Gde4(tqL>X27N7NDvwtIv8GN z52av&U09I1K&0dra7L&1o?DO90!`RJsKAn9`T)&0K zz12^PYN4mf-ZksALk`Qa%ZHcjFkCyI&TT9Iko{mSF-N>`ifx|^8cFl(M2*k=r92Kw zzH54G@{rr)V8Z;wt+rZyY~UOZy4%_P8^~x2cf|fQWm|{`Vpnk_nVsIRx?msmn0U}t zz2s0e_2y64<$S{H`~V@US4X#bTsutS{waC-zmmA;&S)9=jkjgpZUbs$0^IC|qx(+0 z=oel`gcA3VuN&BNU^#_P=srzw1#&SaZ_j5V7JM|9@ljp#*=ZlKeq*Y)PosUN*+~vAlm@_5@fqwF^yRM^sbyOQqRXoqC7SdN0VRM_DlfT zw&!4wXO93$1@VdLv zOg6mk_RVC&>+VHnvf*WGAOUT7Esbucu(9EFw+*kQ@$mXiJp*mm;A(mXCs!kZL=U%! zrTZu{XYH#Q)cW5NkoCWAko7-ZURnRU1Z4d$T*Kc(!}+G?8;T`wsC3+p7i~aCvJmxm zTo%nl`Rf)XU^X*yfNI5<{z`M`36A7bQlHS%^sGhDNxV*N#52X49h*=JHlcN?j%URt z)K=(&fYjP_PRJlM7Fww>2szd+)HjK<>!rT!BlBC~5<0J@R@VV(ag62Qixz?U2tHyE z;?t1G?H4i`!60<=AcIhPHPF3I#-moyf?5dsx1RYo^sUsK|$K$aj=x7)x z|IkEVbr0HFr2VrN;}!duahPl$F3Pxdru^$8ohp2HhmTxO=|1QC#>IYdK~hwI5ePIm z`gI4#bcQC>8VR3pE7UTnK~_XHb&J!dB>fUDSqgD+Rgytla%^AjrycJWr)Tc_Va9Xc z^7A(>PGr9dIefk^k`zxSh}N=Hkv7$2n_)?;gM9${{gy0}Ml)e3=*>2#3-jvA{?w=Q zJ4brAuJ7aJ^z{e3#9nr37oK3hCS}^Z>K)8OF^*UwvIw`%tW$19zdon7jFvqKDw9wp zUGK--*c}zLe%w0+R~~cqmd?j2qVQdsyxFhW%)_jxRlpKu_5~FG zJ6-r*=Sg_%=&w}%Qps0N_m(zbbhjVP^qjU!$M>|=^qrBaaLG~7S&=M6v3jkKmR_U> z-m7C$N#Z&~qoJFMm*o5~Z|OqCUEE)Sc$rI+YtxiCRoVKo@4dZaGYwk$5^?Pz zhn*)9uDJC1%6*mm&V9Y5hg&rD6p9yZqlznbtl%&PLAQZ?>Scrt+HyP?33=JcAxISR z&Rc)}b{*aLQI;?Cw$$$Mx}?N`4$Lzi4Fpvg4_8iuRkxEbxYoQ*Pvx`?Zg`5|5zk;B zp26`trE?TABu``s@Yt6)=$rPgp!pWuMP4JjuRch%0!>+pTHM~*wKQgTHm2@zK_glTja+fr= zGvZz$cWrjSYJM82qff0_&JGDNBKr{>RGRYp0h6oe3XOoRaylIFgunsX>|}~F=V4J#kEY?%Uh76<%tP8!^oK#l^`K)F@#T95@;fJb zOKYgTd#NxD6&6dxN`{QI(*d1b5A+SAhOAxa-$M0$Lf|^@O3@ zg1dSR-NNQgdA^rAy2;nM_oka>_@|RfyDxp-e7v?D47p2i3hugv*dP6K`E4#69cwhq z#h{)YYfkw;)Zq1<&g%}wBZfw2SVU1V9E^eH)=*Z0Zi>!6JY;%)nKW&7#(x>+@8GT} z7Sl7%u+!zc^r$mzHpBhS@I5o!?FB3BcouR6meW?112+NqLG-WfJpm}@MI ztH;vi&M@B$7dgXXGn|dVb#-+mHYU z6Y&}jnBLk^3 z2?0a@I5n`1|&ygRoBBC(2yv=h_aHC(bRLvdhvq9$T-o z1KYX5@q0|?#q58lgSJ|qxBXlq52!ti>F4iT zNgXA!`}o0fA-}M^jx7Yqb^Vs)f~8t)QHvKWcVOGDv3&&xBbU1Tw!cJn^ogwm){lsr znXjnfW&9slDp{5W#La`R$+{)DTM}n%uXCr{2;0estg6nBtEvm@Q$1U?X({wYovuf- zIlr6GM~Kw~*J2%MO3f6eh|hivmAb+&z>IEBqW;Y< zq!1&qcyo8A3y1r`XTlRm_RuhiLbut_yjKvVX?cU+?=#xS>5Mk$(QNS85_?2P`)v)i z^0)=Du#os4w707P)ME}(E+rDA_S{>B{C)G(EZMYGyAE4bg%zzWRKwO>?-aWBH#bgG zY=v%xBRMBVLvozJjFe84zKe3+9;006val|SwT@U7n}UP_GCF^ccYT@YWlxTsv46Bq zrzJ7PNNF~@=hV?>#vNUiz6Z5)e(9q9dsx-^h8N>2dOA{%# zoF}%s%=S0eneSLw2)*qlEcEsjgQ7YAH=;sS5)S-G}jbD#U1e7l4emcNu6U{U@2Y3iKYg zOBhAd8Ex+{ka0VS0%f{6J{+SvKt@LvLBsfxHiL|2ybrOO>$^clgT5YQ@#(~6cK5_~ zzXVy>*Fne8ZITJGk6WJq6J$B4XT~#sCxI*$z0P5FdWpl(BOu#$>EpJM6cR^@|@yFx$F&F2uJI^w^Z=^y&JZOdI- zF?kd2+F>6ZvhbpFlz#2s(0T%!bcgo#`XN0WA}n=O&^+J%4V?sb^>=7Ht{)NVM8QWp zZ%8^iGKM3V)hG1D$kzGU?Adb2z$Zgod~`16Gu}*x*ynir%;3X*hW|>wzx$#Pv9#&% zs9%4#cINsG3RHd>(~Z~eSsMOHdHvrNt=vtr8OZBSH_>HY#%+@UKfJbP7o$Jq$o2ctGo4zl?V zTUf)$bKfb?7@Xe;hx}$c$&nsgnj7PVfbOoGMqJChqM(I96tL(dykLDRUTnP22ia_} z5@gl0CPtfL6pfwTmfma<28gYa7eS&yUEXF7^PhjA!3h=YVZF?bt0Ei2A+TV*csXox zae=FkDjhE@p?Mzc^E;39I=`8R+K<#oQ! z$}2A;<>k*9oR`nzMYc)VJ`ve|IHRqQ#pG%5UL!vs0QV^@8W6I~Fp@AM$}OQO ziD_h+*9V=)QJ9itt`?k$7rgsNl@AI{Fz5D|lzK!MSk+{Zt5`4yLEKkQH4=-tiB)A^S!^T+o2PSXe3zbWg} ziMLWi7$`^ED!+KEjII}=t0{YgZx4!cv^9Beo%C_g`xt{6IGXw!&W^6%)q}MS ziQraYzsbeybv=m}ml)|Qtj-M|)Pun3nu`C*?|2tyhF{qYWtkaUUy#H(QCEo@Cv4(hR{ia8G6DRj@7=LDRUt7%vrE>7l=O)R-K6-DmYYs7l zLpnWuW}~?NXu5jRm5qs}<9^L+Lw2XfQ7W5;PXXB^eLm>Fm~WDa zg`jU8CG>I71=EGD0~wRTk3ox=EV!Bi)iRXr4JWfZgQRT3DJ{(NEi7m|+m>YFDbOev zVl?xW`MUsQ3_)Lx(NiGH-?O0ix>)uwUoWbqaf;uY)J{fpbpR{Y$2EoPC6o@`6uDEI zBY+nkN3G&2I)ju^(lLAaBnaN$wNZ%QhOUQ%HZY-Qg8X8IF5c>VbKVh8^nOftJ#WX0 z*EyP0N+bD~zE8cI-%Tr+JmotjmU*x9clc|+$HmxIc!Nu5#saSL%7iX^4F^81l{6eq z3g2>PI2@M=zAZOVEz~omuXk&C|DpXY^b;l<&B-ux6;&bxKqfV$+P863m;SJbpP$Iv zcCUo?Z!5^IJ=6gFc2)_M&#OK)s3uZ`(o4)ujuW7;ffc{weznAq9;VgH+FZmZYv~lo z`ir&Y5T#3g(8L}hdp7I@;gRj_gS(Y~>DXp_6jps@jGJa%3|ps~6C<6s%FNG~4fesIe!(c_|Ra;Gy9oLyRjZbTL$MLSl(D|FGFZAGG6Ro zhR}XmwY?0Xz36?he;Go1zuI1g&|ZYW*uM;+{rqZs8T1Rfzp`H<@m-x$vPj=m=?{To z^pDC>&bi?Ji$V%*ML+!4B%Hnx5n(Jb(>JmUU$WB=YNn`WuHSP|--@*w{=`A`FmFkn zMm25BUA-(=ud!*3nTgS5F}glRUx?B7Vsw9ueiNg=#ppnKuEm^=k?z<`npZ@5bNy0` zhV<~E2fN}Lx7q{+P0MkU$e>?Dtr_U<#-=vgg7Sq15K|csZUwjL-bON6$Wd`$5937P z0i4hg(eJ!j6wBoc8{OiWjcq$a;`NyRZtZ3X24gjaS1FHv> zx&CkIkchI%)|m``VI7i#os=qW4tlE7CT~+zNG(V3$lA|z6u_@Cr=F5g)U&6B4im2B zLC872*)CTUaf{0k+W!lxO`?9na2mW}i0HZzovOHeKI?9(=T2HexWmb}B8ySzr6BQ0lR>}egg(&y2&P)G zK=Rru6YJ4P*`jH?c~8^o>_rw7Rge9VVlg}DhqLME{@LfrOEi_<3Dz8`S$>0?L1p9; zi+>IJH%0%NgYJj$Q0VK}c5}n7N@2N7!Dn=j(^nebu}yR8(VA1oZY(&Tl5h~ioLIxG z@b3UwSJ3X<8hgmP(_qRL#IIMx2U{yYk8nX}y9}XvL{ZresGf(RZrCKeAQPM#De-A6 z|H%mG>em<4zp3J$-dJ(Z+{Q?24;)UWwP(FQsI}*wDuIow$xc;sM&!^i_xUx-F1h|1 z|5b#bW2KPRkpN&Lv=gL4b+6Rte{B_sH=EsLqpD0!wsq(>z#i9hM5_uy+1)D{rfAp@ z)O5Xu(UWi{P49!3;2PJ1rkye|amzD5;GICtW56eH6zuQr1&JA9L-$GaFDZ#*qlX<9 zS$48DECPHaH01ZlT7Tq2*jG0m)qW0-;}yD_@fGgh>;gMlRQ7m#EyX?I1@>*C-L)^5 z0_44jUbB*;lSp{bP>eDp&b^Gb!B(EW2c^dy>P>xwB3g#PYTSZ~Ct zzk4U>l0OMGP<`ZG@rX6Ca1ksIYk?^6HajYxyD!K7lH}aN?iC}O zNSQ~gL~AtG3RUaAYfqWk4lL6Lip5YBaDL`@kXG160*>x`k;>-w>b`5POU1@8pH?Hev!p11mTahSLNKG|F5 zMenIkw*;$`v@}Zo^ILzJD*Pjrf4-)rQ0m(Tdw2ei$zt+V-aAR<|2U=4_sXL!N4zx9 z*N{CjnA@1|`)mHy5$MUipR4~Vg>FT{8#7aKhm`t(P$8&0Ws{zu9}iZ|CjRSNi1`|zr zl=ILMd^idJ^$uy)FP=|o!(R>N;2E|uHxvi7FaHt;+Yzl@FJ`^grdOaTGprLBb1#`w z4Ys`Js$v8;vNzzmMRNeR@>8g0>VGZ&jXA!~Q)$}3FIHGS!x{m;C(w&^eIB%AuKI@-UKx2rE*Djrq;@?JfX zoT=$WT}*DTa(b;MLE>um>RNYr6I^_SFDjAt&o}`CUZfLv01Q5g-Kb$;9H1p_-N zhh8pf?R-wB$b0L-I&~jmds~#2LlK4Pt(jG|YpNXWvMKlb0oM~K>mOa6xaZ*9+WWZ7 z#+*Ei^6yJf&?&FrVEVFCJu=YTSmSkmiy)amFJk|ElBQ4P;EYW11gv3w4U^0s&mMx% z^D|A`v*l_D2ClGDS{LYyn;b>%;WE!-|9sNQFsd1uqU(TzQSmZ*7}eJQDXQo^MV3!N zb4=4K*%Q_z>QK_QT%?d(gCESLJ8a6nja(o|v0ZsC^mX+bMX;q0xk@Scael_M7hJ1^ zLJosm0r^dJ)*vnvQkD;wpMIE#>{aNeLCGVud4C>cuR`m}-(H1Y1hQA5p91AsbCQXN zDf#6G2u)yGkd#9*aZ!xE1iF`XH<|ba=*KR^uz4QxaDI*J+1bU+H>Pj9E_YejsTo>! z)D6y02Hjz&o=Zo34?C^5(5a8NPTjqGr`}g7-#?B0Y}B_eu)gi0E!^h%_VTcAcU#|n zsdAg^+s;~j+rUnvk>-A=+I3d$QK2yUIGvNJQ>!(rg9{}N#RbX7P(c%XNdrP8_kdIe=FQMi_cC7R?bx?TfzabfXScCC zkRX%2UZb*pbWqUh$+p64*^iMtcP?9Us0v5bQ|OWBaDw+Vq)mrQD6oX=3O%i5Qp41z zr*7e@35`&x%IB77SQq+&)+A%{cnaiub037^5AiqznV zcYc>Lvzg@j{v$LBMB;t;SfO^1vDSVUq?gx|iLo@9N*IY5SBbn+m-|NbRTp0BmM>eY zTa@xg!kUWida0>wS~tg1lQvj6M-NsGJ?Z7_F;llV*%7o^hrUqI=0v0hS&H%J%Cwf8 zA=g8x+yRiXgaw)gvI1#~Vgkn0>v?mbKZ_*hS50+Q&A7wxBPddY}UeJi>S_8+rs;;oi&G5axclHzM!eNN2b#3Z- z7a2nsF8}H|{8!ag_Xv`FlkT9!#=1ir$ZGGSAgeu*hOPDnK>wunc>XLLVrhohrg(@& z4;DO2@VHjPd%-swVs3`09%A&IU%`JMMPpT6=;Kk9a&yl^Z`mv3Ds@-+*4N|~T+pz` zDn;Rx>Xa(vsff>ob(-xM z(sNbK#vG3&jlRSW&R?8y z`_@O02E>1_d;9NE7fUAiaH6oD%v^y2t{u|hfFAkT%`PYBQ;B|YZZmr=o~e-`xBx!N z*@y%V%3*q)k`js?>!VhlPuFdtWeVsf9awwUD zYi0*yK71ohmzGj2Iixm~D~ZL4uo%8H;dMTTfyrsRyGBBLhkLGP`6Jkd4^DW?`<$0C zdK-cgg_3j`ueCRt&B9GiN%YKE&l#J!DbX=zZbOJ7j;E4jSE%y&=;e0z&f8VwP<*xY zdkn62k!5W5x>7_N^^$jj(?upY34DfxF|SklgH!j-qcRy+T z@awL`U9VQ=f8d-hu01n<{q&whZrjX(mg$+A?B#!*>0OzeuK$_oj%R-2q=jB~v$*Hc zEePye=sgYZ@Z%dhUPVzxBKI!&ZJFL+L8kDs^Ul9|S59z&yem_C2tw_Xi@Cwart`$! zi(aRDkul;2Dzt8m#1#wArg|FiX$`2cBkf7(JLJ|X9iZ2cOX*C|y0tP7p6=r(rGxWO zby#fcO;yh4DZ>np{ROQJ>_TNxD_7QCa~)*j4_cL5h^trn%4r)aw6d+}(t4U=KHht} zO6Ya1p`m65)X$x;fwv`c@AT?wyt=fMv{6aY*)}~ab`24w>!^yGtVV9iOrMh9STnOg z;4_Oero$(*s&u|sVjFy$m5tAlV0Z^K%okEuk%S~Xl_{R z24>~a(nc)4LD+=j>CjwuJaZ+kw8QO~l8GGXm3@Rn8@k-ln!XF#%Z2y@Xn{Lh>;knN zC4Xb-y=OWk`DiipCKHE)j5;zoMkmK;MvTs3kQ*O>PAIQXtYqTfKoW#U12o8D$r9@* zmxJ3twGKtQ-+w-}e}B(Yd&di^*oaRA?UbypkPHxK52yM}uu|0{9y2s^wc@}#luUh- zanMwcL-x>A$Bapu=(EutiC!~5k{W?J!rB_nU1IE8VZo3>AWz6UgweVg^=LPvGLhPh ziXu=H)DoGsTr{ORwm>Kb{aRKvx3tzKnsr7==dYhsm&i`{3k$YlTNk=E>dOhHzZG8~ zdTFaB6gWY0(@I?c6U+V$mC7N4`4}%0cA#Bi?#*6jCk~d)_Fm4bsuJ(-@ML`(k~H? z-)>K=L8(~i?@o9c(JFXs}SWVN)upb)h16fdo@x}<}5r-KVo zT(O{mcq$jNx}06t63oH$ROLdPFRU|r-te+TKGj}yJ%l~VluU4gPh#6$KlHk`xHf3j z7A$*Y^tvo**7Tpe zDoU%My)aH&(bf<^o%g@?I_JzJVB7cmp6~m8A3x2kbI!i+wbx#I?R6O=8JxYWt7Z;S z@utr70kqMaR^XX@rh?P)Ml-G7md?AeQC4lpsA8ZcE*Gn(hf)@=a76%U1PHvaxe29TRQ~iP$qY3t$Q9#J+F?f6rLqfPaj+AC*u9I zejJ5SwD36;LsvO-lxJ>}GVYVI%duLC2qddEcOAQ3v4h|l>{pB=Zu%0%-N`;303OD)6&IRq0|@-Em#z?*Gl^W(w94c%1g_fj#9R< zr+6DgL`mg5fz0*`CKRvXDHv|^nxMm?sCx~S>DD?INVnG8fOJEh#boF2|vfNVnU!fONY( z3j(Lx?T>-fztlScbO|f_V6*YQ4W#Mz2GD=8Ve31yE&FmOz1@_s;9!*VJcrkK_U{=C z_{F4hK1W0v*oK>YMxw628nKrTn5%ZRd>XyEjI5=0&%tI5uAo4!uDymr zB9i%f6pjCMSJM3~tiaz=A4fkP5%x^tEbKP!%Y~{4MR--rP{sUip4hF*n@@Sk2vc*Z zoj-3}uvSxN*`3rQ3%DISR@v6f!MwwaLEO0#%hsDATCure{u*~9^>JrV(wR_im#2>_ z9nB%(2)T*BY*bwM0{+FFw3nQk10#%zYwC#Zdn1Wf;E90d(_M38T1oSo$>{!G1=#6nZz zb0YNd4Sdwj@fb?c@in6=;+H(@QpS*L%q)O+-u8IL(vg8XN&H-2DndLw==O_p+jEa_KEKkCDGirX+d-#iMx zOt;j0VjRcazxFiOhSPu6&>sg%%ei=ugoMQ3Z%#TN1*!^sL2r;Ho#gchHJK`|HYoj| zCc7rR)0F(CmJH?eN)E<^VvdloUZ~%21t57-*klw&X$G$X)nL^&`8lJ=eVwONid9Rw zPaC55;TVh#{Jn)3`|Jbl;xPI}&>3MgFH#4zz<3ZP_3a%L!%J~vM$AVN5QBO#raqhq zwsMe>8$qzh0r~fcq3oKvSmnA)cm3}H6-LW4 zcs6)f22w&JdV=bWM2_@oC=wuFKOK2l@%I)$Kt;W=6e1QGNMVe7vJ1k&?q{{u@DZ>4 zG83&^WO_Zme(gCt$p6UxO3kWr1~MiN?2Z<;M_BBaAKV?yykW&^o+id9vY2voEldqp zZ7O&k6Z&6I~)w+ll^%2<98 zDa&K6Wea#g>OI!&VyIS}Bi{)cP^zn5bouIW$n_$fGLr0y^Pn?nnC{P)0o`+~OwGq> ztxnujApIIlLtoePB8{x305LMiWrg#S5P`#5*b4IJRi+|+Z1Gr91oEkVpRLvd_-bYf zsfKK!`<F>WPQjqy;MC-PwNiB*d8O(6t(W_uyJXg8Tt9&l2pvo)iO_eqnY=Zr>p&Wx}JG@k9oRT=jnCpc3bA@dT*XY zz&<)YenWi89^Nco0Kq)eL|0b4)eDCz9z@Vor{Y2&ot`U$cV7U~$-9vetlG9KTcmd_ z6l*OYjP9~lZ7_rbG#oj+Z8$UoC=zaqaz8A4)e~lsBIfp%>xaxgfdROkHO%hQMlx-d zTK@dXlv}MM%#05*GLzxJZgO^Z_dxY(o!yPYFHscUXQKPjct(0)G}9}ywlSXlV1Kjr zTKa#H>Qnx#vAW7b=hZTYX2C2-nkk!3k}oo4*UOZZWy&Op&eehwNb>spdcm!L1hfcl zZG!}K^&tTaqt$vGy-9>Qw9X(h6L{a93_oM#E|h7OL#=LPqv>PitD`O#L5?oUHc`#hix?<~+C$=2*91NBIHvWCVMx+b@#o|2%&_ zMi+I(UJazHb0Qd{YgZ_xeihRm{o2Ap(6xIVkiIhuPgb$hHI_mbdx{^IUM%m-9>}_r z094T$!p^X+?!n(^>0`N7#lqz z);22~7sKDC4XMMD`A<*;!lvB=lFrKuI!g!0-E$<$N$yjq(n$Z5Oqe!SDIIh2RrB~! zB=PoPr$f)zkiBc{>{}V1aW_&MRSJo&7T$!-A&AlCpVvRe^;ls1Qm}>(!c$syciHni z(>cwH8t*v>2oCbT0=phXKMTJEi8PHgcVPa)zmsx)HD zU_BZ;dn~S6LuZAWX_LDU7sMMusIqOvUgPLLTQsoIJ;RJj0+w@^^-Cl))~e;FAh2(h zt7P~^5tm16x~<#;e8W8K5&03eOPnJUn90iBEN_}NSa%B0v(%IJOXN#*xQwLVQvf=d zSM(&h4onyQQOr7JMEl6m;_gC0hqafJ#GE5Kaz>63T{o6D!oPN8Zovo;<*s!zq|vLx zS!7N_meBB)?iSbRb^FW)=a04!1Hndadb`CLXC;+=A$PKSsb-$5fA0q`ve_X+u$$p3f+Kb&v~xqw|K`A?CHO zWJT9;qV;Dvy)q{9)vYyj+5MH2VleuW!7>_4WqM@7&X9A_`1ZAY=9G0ocT^H0z`mf} z-t{s^H1o)ZE<5}R?#v_`$DtA`aj!VLV_w`u`vJL_&V?yD8UAO&`Q98R$)5!?1qcm& zWns*lPdByYlXE>|oDExsc3gek1zk*7g z+)Dn^GVY&uNFzKHSw+ix%(SDYD%M@a@A9U_d8i=Cy>;0atHez}!u_5ZklY_{{RoEu zPBW`O=)}NlanJ03S#)h;{2L2r`$}FAer@Gm=L<&RZSpB^+>ZN=k>(DixeRIXN#D)XM`TGg2i(>G9mh?Jkb8@Mt7j! z${p|5T~}Rqbd8i1bf8lGy__|K*0;EdX-;m1B+TdK$0TEoTCFG3D!0a+5osYNV2e9r zSmNqg++x|IqU&xHJRLZ9WHeh08|~<*HMQM-z-xEX9oFt`>;xCw0{yU^OX{0jpdsu^ zsrm-Fq#4)3yE<=H@ROjk0$nf-NL<}T!_Dn9;%@UwR`joEpqC|TjFtREL5eSv!kcl| z(Ch5By@(LGL`s|oOJ(XM|)X^qpmWzX}Fug3UC1bF*bXDc#a+6!^s)@am^&+x3-}|3Tw)pB6 zO&R4nE}>_S!GZ9eUJHl4?2CCkLf40I5(QCYzcmDZ6O=d6GEW8Leh_! zJ}flrdjAdkW}k1VoBX9HZK`VA+kF~mwQgg|s~YHOfjz}ruaVaBCwMRo#jA}L7Btsj zSMeKyHhr4=J@~0zpg->#;h8upRn&QT*hFTZE z89pwYqEs*7PJDb&j1&f?8Xq1tB>1Z|uo^kDJSWDNAVl3h4dOGBQlGN4zR0u`?_wD;Oj9Q6;!nFaUiWX z2c+ZjAdrs6v%%LB7*GA01k$f%pyy3(Q)s!CayO8s`woz{;AcRZ<9Q&(mp6eN)B1OT z6eAA7XhOe^1=5*r271BNVFzD55kem;nG9vId8bm83yZu|>(FArmQj*3I zH`m$j#lhjZw{m#qmUMoNh+XUd6KO&qC)ay2U4QebTZIHmfwVXKhz5K+pM<+6Ln={| z;wV&3T`7hQfmFcTXiZO`JHAw4a;JAY+Th=gsu%!XsH!JP?B%4$1LIl3@Qvaez27Tb z95(NibC<{Pie?~ze!WAG?BybwjXQ+zL(h2&&Ey{BF2qA4;(7$py-UQc*6pHj9?k3- zYvsgh!CG~3xFvsXH;G@5W_AyqSFdTKKj((x#(E^K?~h$D-(KTiupk;M&cB*m1H4>s znp__Zaz*nq*Jt;PU2sk%k8OQt^ZZjisUXtnONMn9UYA>$OAbOL`??jad5(6PTbVVi zbF2-YOMNjBemY4XV{Nrbrz;tL)ykd39vJQ5T5f!MX5y*ola0jScx#nCAiMjv)B)Mu zlSCavuB9 zYN~|VeF?5ghxRdPP4PyP{pGcxjNz|#@J^UPJV}ejn5IlR*Vn|H1+{?~=VN5zB8VHq zaX@H1nEC6=Dtewk9ve%6X66QH(iJ>=!7}@<50N$b0;U%kul@q2sx`7DPHY#W_WolM z?th(Ft#|Xy^v9FD6*Ih;MD@B#z6Yd~=odgL@@h%`OS@tl^+Y3~+{`y=Fx?jyu@BdFIhlp`iw^2o=1)47IN1>qAu0yNB z|ALPkLYJ%{0pujWI^%nEsd+FO??gvJh-IyqU)#DjA`|(Un^qez6zJA>3aJ0?#l6Km!9Ot-plsxUGSpQzPT8; ze)=rZmwM-^_SXl6H;vyMZWl*}W7-DEm3jHu^dq=HHlgWY3lP1jR@UXJ1|pK@JIy9P z6-af_bOXV>M=fhK0tD>t%yF2yGixo8Fch72IW5!#|FbmRiY7OAp6nz9y79z;*}WlwQyAy2?F+|67om z&mgS^rWcu}2ByCWNGIcNAie+o3Q+a^w`XmsQzDu-Pt&VrdV||bHU7Z@rrE~Iqp`ee zgDBmLO*C5n8f~lBort7or@s-1^^5Tt`zmiRb4L3OW`fPTZ-`r85l$Mdz8dEM{m$&% z^MKStV+C&l{iZo$+%#KMP(?p4Hk)?xD$N@++&jq|Qf!|Mq;;FKv&~ z$V`>?#hoY3S)MrKRy32m9GRzSF?wFno{li;F6@RM5%cQ{#KUN9bX7RpJ3M^|ncP7@ zIAfKfvmG_6ZC&ol_KvWYJqm|biLxanr77ZINr$fXM8pE3>=<{R)i%bRnAr4Kt&_Sxu~~=&--WuF zj8DUoO29X*KPntPA85g=eBeaB-%(t{w}dkr6z0<2as#${@1 zijVMB(nUxDlau@Ge(U(SsUsOGF44joNGX~U(i*GvHw-X^H59M*3TvjYW|E*9w4VkS zp>HH_HmK1cStuoSE{~&%W4uQz_fJyU?%4)`SA~sAQG}1hAM)O0z(%>NR3~lEnCJ1P zfNdhrx_S^6%q|LG2B~dYa=&R}%q|w>yZ6b7jVeB(=}l56R#RNj=eePHmpltXpJrNJ zSr&B$DaT4{SQe4u6@J2@{SxYYNYEc?Yq)qS2^Fo2$I2wF2bn@e34+Jc^|%>?c!jw0 z2PkpU`6s3r!u6y^iPmdkNFhC{C_?bcK7>jvYe|-EcHt<@J=$R%W3yIzoIe`NrqCCNT_>3`wwYJsr zRKjgEg&ofqh~$ohbFGwPia@TG2=C+`7V5q&8U6qZn=UkR$3`=g>sg3PC{c7J0_`!` zKeHdu>}U8AcY5OOe~x%E*`!;K3aAQ4L>m7BCIa)GWnp!3B}15S80hcYySCT^W7`@x z`I?g`Lc-=wg71zDi%uFjG5swbYv6!Uf_#HU3=5_2@XC*eiJ^0TP3aTb+uVb+pt>9M zic?MX0puj68!{$mnS*H=QWt;Z5HL+fE_kg$C_-gj8!F9g++^%N-Sm#q0Fmo*>ChsE z(O&gDbp?c4G4jg{sKH1NZLHi3C`h02lD2*(eF+I_1+UJNv1dZj5iO@_Q!okWEVA2F zZB}zATZE!sL?4}ST3jm?4v>~oCV0`4{)k9n&ANG=5%Fdf8_R_aYz2!I{jFsuNO??j_TxX&d^RjqsPFt(~lez_T2ZqxhY}?>K(PMcrhBV>j?v$Kym6 zL2}lTO&JQ4-N1!$aO~zNUNEqrXy!_AX0Kc)9)b&c8)w||)%JZ6CQ;Ajp94F z!Z^aVodHrbTIw^*JjAfYMPNLOlH>Gtc~(qrjX>Aa{2l0v1a+U3%jx*SWV#Tv`a ztHQ zoF2V$K>GBRk@Sp}HK}c-&&qUHtq=ELZ#X-pY{`<{_JKpj0VzB=pI_^LRnE?QeqTOE zQjhT2x6SRGRu|;nE1$897OfAGc-}bS4JS&H%ypOVDqhN`#vTUlE+X8pBm0IlSnGgi zrRLTiaebTYCM+B@gX!49y*vU*G#@a2al$3!?23vlPA}~6oIV%jQ>jLk9R3Ta42@GC z+6w)JcgjqPs)<4lkmeZ464ZAe2hw-f0BPQ@1YbX3>NMT)P-lg%1X2y=!>RMjhBLez zNKb!a{QgO!M;%#rL*cA6 z$H##5tH|fHAD7hlto5$~==lJ8CxAYJOiWqurU1GT=*J*kRZv```?z}N82_$pJhvu4 zs?RXID8U)&4hN)PJ#q|qx?22IF=c_vy4-BC@yc)N5d1>J0lV`Mdzxh-V!Stt)f#Ab#1lMAP=v8gzosqL^Ci zUJbc?MDbcd@~y=y`Qd;cdePv+IY8=9?i!#W%v>b20O)h*4j?xL5*CmM$w2DiSn%}{ zM&I|1Qt_PQJk#G1pbRtrg*vC*!e1TSr5PaaqsOcX60DJ z=Z>;hpX~jMJJZJ{^EWlD*E`>9A73X&>i%?!MMDj0gqixHo~J=6uE@nEG<|~`dptN# z+tyE?>35#?c12O^jJDzJq5Pzrt5-%lV$6N#bX!WdE+h89@WnGY+0u53-lJD21{uJD zu~FyOr4jNq*!#SWd(^0S5tApf(l6SC>60PhGGtp4n-%8@d@cNuxmhDueEkMZBE)q1 zQ3-71_9IedMFA`=c)mByMSZnYqexTPlUEXJ_zGd1?r7sF9Lhgq&{KlpcO zPt8p@pY7({zs1g7(=y_p3||-u z_Bv~Lx)06}w>#U}@R)})tNRLEtk%CkjQb-A$0XjmvDJbo&xqhDbh61B)J7umMR--3c!_x>gxXM?1m zxBVwS-kI|!pDNAlQ>D?MiaV%*>HNdu!G+CXGrXx*X3lnRX^y(Fkt@TgPb8fk!j8n7 z-iPTIbP$F=JyGHDWssY);^XZ7SYDyTI z(Lx){(vpMNWAwWCD3{hNaq8D4Ly+Aajy^5}mOT8A@gcui*$ht(fsjiZGUDUFI4;7M zh2a9(bU5fWFrKMFw0L5NABGZLixuOG1OPPF*-Sp zf*K?jtouaZxzLF+C@6QMp`NKT2BglS;@MtvI%BgXZD~C19p_GM$o7V1Vnc^-8q%J) zn!QoG&a#k`--}#!C!8Hns#&nJf;drw5a~e_d|_&W=wi6GS2k{rXG>94Q#gG#9oNw^ zO07a$S!S}htlTQn>J(t6F9b?z6b+W*H_VqW&h9sIQ5hCl$2dguyZl+{a-Z>(A&_S5 zZ(Kbte1AimUHAy6QH!yoO^-0Hby5=&uZ0sC*t!0I7De@)F07U+FfljRc2@3jZr2U{ z_^tqre{6BKAvNXyg`ybRM%q67Zqj+H_!&})>VxtO=K(24_yr*KH!HUfDjfbNkP3`X z0oBekyhRI;@_ZKoX(<^XEk*p{DBmDjH2Q7?ys+|`#{+3zxw%m8G#s*+F{!Qx;LLn5n$NAZz$Eac z3@Uj>OHmERtW}$=Rl|lO9~l;kP8vr1q!UR`sIkPLaFVOY)=jA)@oevqq|=pt9$k7Q zGp{nWiEvl3z%Luy3{eshVk!3hzF=GFQ)$#)nOlcVvRaojp0I-4&5`bSv&w)srApku z4vA5R9c$cb{65lTCF@4go0qG9x0TYMQnv27dl;-R`FzGy>ej%RSGc5J3 zc=)-JMQ2(WFX`!~xFfc&K`DnwA^82G*5WPv!5$zr#aQkf1}^(!>0M|i-0Kl+wbUa& z`6JvK;*l8Vkeh7jr=d{C(dnY7ktCdj+ju*h6gy0}I;fqUcZaViBe$|hz9;|}E=Q{b zte1&M9EY%P@Y=>P5&{!B$Clku7aJv*zJFboa;_FCn&LLqje84H+qye zcmaMU6o|f7tLUq@5j)^2c>(e-F{}I-106Yd>ZFkk>2Fp9V6SH;AB_BqP+elPESQsf zjfOx1L1=7^WwvCqv*mo)ZgxelS4N)KYlpdlNi*hU?>^1%)FGx*DY8ny>uh;w>Xw94 z_WE=Df7G8R{_phXy`-Cxn94o)({#=J`16adlUaS<5@Lbj3S^tNfLhnf{v(ns+x;|~ z7w4wGGu2LVhnej_5dmHQE#8DC!f(JZ`m^bae7BbB%?K=E1p1weaJQe`%PP8-g5%C> zapw3ucfuL|n26eN)f{*Cnd2W;#>B^WPrhlUcOUttnch57SNw<6NVn;3vBzLN#8D3B ztP^j^3Kg(cg(eNFO^faFw4ofP&s=b{y(WB|IiuE~(9k~rU})T6JG*#xC@mK5LRWl# zv}%>KuB349645KZbcE8IXy%p?5CrjO;}L|^qJ#_8Dx}_G)z-)gKhF>YZ#~mO-Wv)v z^1#@nVTYtUp$~~sedxg2YxAsNFg3QxD|RJlG4MyMX5bIke@j$ z$~{6_tyP0##Gz{z(QjWG>eH(NX(F}EKuwGQbm<9T1`lCm%w$Zznwf}4WQibXhFqQw zG38^FE#s(Scf1_T;UtK3d}j*n(d3q>Z!7>6k!ARZjHr7VNcmjqR87!RNrRa-fdQlI zp7KNQqQe)3lFAnNs-Bo^3#(9knB&HHJtX>z{`D_YiHrV!^JkKk7B0*Ljdbh;?QC=c(!R$1w8a!2uT zw2g5jGEC&JiTn-W%&p-%*w)lPig)mZgvGD%OLOqpuiIsGHHu}Be3fA`AGukwoxH|j z(D?`Q1Fg`TCGT$6+XDMp$44`_9uEG?HJk0m%_a!`4-qvT!T;f+26SFyPh~%2frIZO z2Y^ze51l?~m_APqEd}66DWnSj zZTC*W7uk--BwUQM3aQ4*gc_nR9Tv^m(kMvceeDy%HC<_(GsA&Q!~pgcavLt@Q1(N3 z`DGa?u5+32z4DLkf!)+<-31(EdXonk;fs|`VdLDAx&SY0I%;11a49TYZ}lsGl3utE zZ^Gj5O1}heG9q;nd`W4zIBQF9DP8Op_90a6V?yOdkXGp2@%`xBVICzf9qfrRi$ys9 zMv%i?zf|P$N%tDrX#SWQ&AO%+;(;s8tN3*aap(Y@GR|5L7NheZol^f3lQrYz7K$@;C_&SX3M$?G~yryde(sZ+e zuTKN1<9t~FEdtW= zazIC)BBT3Npd$?=)=ZjrKneRgRfK*C+ zE0CsJAG~`yc()hmQIj_Uk@=Z{&ID4qvYtQsDA4$BqePvl+z~6oo~fHC@u{-|yg^EV z9Q;qd+7XI7jl8UuNmu)GmkV(*=M`-%H>$Dp9mRXT`rt`SAqChmCZG||Iw&$kVpxYK5E&xi=rH&5n8=~wE1 z-#venW-P6wQ^uM42|=qT1dyC%wAB{^eT0=530)PuyE%aNbB@N^Q#yjR^=y)PtrT8o z9giG2`rkwxunpS8b#IkanfT(!XmIn{(GWGa5qAEHNc3^l@H?4eI8?RD4;znRzx?}% znZADCZt?FV_YqU^ogdsspx^hKeiCNU?;9U&Bh)wEyq-<}G>V2_=QLZ&)^##N{9ky3 z4ZBtG{S^45I+nC5;b;L;DUY0yREm-XQpt+!jXI`g)X=e1k#)thkxE<4*M2y01vpV9 zxrQ%Ho$DhoHx-EN%*@+d!|r=uL3H)u%QDn%J7<6twICUM9~Vit*4WOXTGSS}Dyc+P z)4qrls|rUeuJgV575cKAG%ap?WE7{RsjF=F^E2$G7g11w)%1-2(=9kq!|M|FRsrvW zEG6-wvXq4LfpG3yVaj6e`6JN+6ceTF_77T|I3_L^LK$%GvH?dfq6yO|hTmx`n%#u& zfcVJL0qQ_qSF5UJeu6gYsNWDk`y1iYR1qHTtv?Nc6cN55pjF~uypTE&<;r2EHYyeV z+#kU)K`ku1j2mreId?PbxY}H3Uc@V zatGxWqjjLv>$~#Iqf6r7C%aelwib9oo8f6xND4}%(1YhRW7g5?Bj}Vd%xVXyntY7b zrj7D^M$ohG$XE7CP7Pw{*kODbT(@h>=eeDf%eiTDea;t(Rso^)O17M74U9AVM^zml z*C$!ezJa*YzV=kUd&`^alPb>xBFebWL~FfoL)}v-kfo2en>O0kbPNXyrH?Cm>gt{? zqH1Q(w7v9qauS0bp@p-hbgBUx1=4hKKcmnUKr2moq8h2t3qZQ;cLdOGAk85{^D0u@kJwg7LI2M7Ck3v>O^hN<3$6i>S69f6rfvE0Z1XlS|cXt0TLjy%D=G!B`}LF0vr<%QJip zdfXC-NTRDp^1-*^H+kOXg_bDpHT;D{VOaf;66Z@7Kq5Ud(7&XBQ zuuKWlG{_VEad5BE=;+zqEvaj>yQAsr4+=H2S6s^_Y{27Bts!THJ`_ds(>IrSWX4$q9QX&Sm6rgg>pcy~}JBYV-<@_IxwCg^(S)LN6cbE-MH5T|7)&xR1M zT6)q@E=t-=pf+pO(wkvlc@j5Yje#Nilzj|%8+-%a;}Ib&J($#9hZAlD2Lh&1$Q2~K zp1Qd=I&T%Pb;nb`YIscpI()bw<3&K994F9hAa&|Ss888eFJDAn@%M3gCO0L zKuWIu5ozc3Gveiu>2! z%T-Fpz|d+s&7$i`O%O5HshRJMWVBxES@z8l9D)%NOOP}a*L>+^`k>+q43VGFH@fL_ zZ=7%+UO{eTcsC-4RT~}5fIML>xcFo=^Zwukd*W9|mLLc_ySy##w&1nGwPD}y+(!L? z+#KGy0uYt18dNdrn+M_rKKiRj_LgBGD<@$oqQ4p_aTCUc(myKBVr|;)vNp)1jOFB{ z^E)m+MR7wY%)uEicAuBRy>kT#%UoI*ogvinlFpl{!5L#wzE>K+L_ZGsT;1qPTS^cKqqabW3oQN8? zQj4T>O49jUP0upp%1LZzm-zu3)ENH|ijcXere+|W*WXX=r>Ewd`xWVFjCPC@)iQdl zBQiMipjglE&GruP#q3(LS3&9oR4%O6LuhC8R|iD1i)%pcgTNGi4BfDD-{Yb91))U0 zI>2i;O8kOM{oB4++itq=OYF6ct9 zQlh>=v|YeIsiOECFO%-s3HPUh!i-rJvnnWYDBs1l6}KZm=5nnatwetdi-9bpl8riw zT9>z9Qm`g4AEgMg=r@t-_?g95EEjk?tk%7}O%gD{+fUK+n3!2FQJn{*2X`zp;hp;~ zOk}rG??9HOxkz*sX+@^v4U^US6M2wuK5k}(0YxRiGp0o}z}ab=HGGNr)VbslQpi8A z-Q4t)KCi2k5ud?QY;kWH#?1(4)?tH+Um;~QgOT*nfdV6KHe-?dCjx1`UMbB+E3!GV zPs>a8BZHZg(j{K9W4zlKPdSN(?XWu;G`}?{3VF*0EgFLvG#@>fSc7;>X^y07rD69K z3fl$@8xU=Sc7T#HotPsxHx{y+ut^?lwKk(Kg_^gd%}oGC(6CzS;GdC{EEA_>2pWuY zrH92g+3w78p^g!MnNHpZ)lcxZ+%X@z<$k-3xiVtj>1tS;4ZFRW!84{X%`Tr!$;BIar-b>7MO= zMJda3sS6qO>=*D%mhxJ?*e>1R_ic7n!a*k0`92@xMxOFOT7(XkX$!hUrIY;L*L_G* z73#>KHE($}R0-rDZ4Ek1(li_XXv-m|VZ+E*`?oE$%I+w2wSCG9jxB^gn~<%fTy zSj|t6LLTHF@4NU3-phmhb9#&I+}$-67zK390A;FBc+Agy!AB73(9a~T99;dlkN|Zebgjerh6;P$%)nkyt?;xne4WF zVB=jcAX5||&Ueu_sKRy670+^c>uno8Z~Fz_nZ}tBNSz2qHwapf3yIFXtSvgTR(|81 z1^MxLPliGlS8*kwl$8P$Tck8SwupL!QnlO(EY{+y{E7BVpWTdm26sA=9>Xr{NcrrF zQpMZ{B&}@fcbK72`j`>8DJ+)W`)=r|iL#lOnhp06iLO7N#KoUWwd-dI_%PuA(Y7UG z%Vu^irc8IPh{O_OoRy8Saxw%I zc!4fs@%M5Bi-g3kUwPwi06k*9J_yu8Ns-W7K$=&yEHv-?K)*2Q4g;6;>(M~^Rb19- z-YbH4*97T?v+t;wLQEEw#~0l>Jr#($mqISkp{Df`qD1@gHy~~4Fj}tAIY3&<^+1}= z3BHQ;siymG08M5jl(SC)DQ7X*V1<*wS zv;=4>ZH$EO2O4U|@7F-ySqiAld_8$cD74DdaXOH;`6i&PNHim%jX*k*`#IgrF~ZH5 z^Q1Eq8h}sLTkCB1s~Ng2g0(rg$XFq;s)U*I4J%E(sU-3fHVSdAzH1gYtEswp;9^yU z2~{32ejj(Q zU{mdu^oC<6vpmQ@QHOHxEC9(Kd2M!mue@CpMWsY^O`!Dh?Ob=57k|lr(HW8I(Ut44 zuU;m3a1biHqbW+pFQ};?>G;=ak_kjA>2;9841vDys(vpI@-LoUKNpIG)cXzkM~r)> z7of)sIWBNTM#`iV#p!>-J=Qn46*d08-gk`Qyb}}aN~5p(X9~wIWoHFnIj9b+k9Tg6 zagCZ_G4bsCIO7o+1`c#^#&eHAXmizv^B0OYp0_i5hRz!u{n^-P{!-&mXHh?gI-fJC zal;euwpML6UU-ftdH&q>+1+Co%#fI0&fd83IVP4{aqBzJqGX3iZvF)CoF(cb2Y2In zU$jbx;)-WGu6Q=lN{%tK5`>es)mgXS3z!W5KAE43Kb{)4zGV1!R&Jc6;_5H6&Kw)C zpwe^Ql(uEEzW62o#BepoZ9V=e9zQi=P#IMqM_$uE6`yqFJ7HiPtuBk+1&h zz|J#a0e!7YpBum>ZefRH{a5H26Mx&tVYMV;lHf^@!M%2{r>pbD+E9A5PIx3WqG#Cy zlsA9_M@!8%Vq=0FgggWA${;qbSOTri3%^Qy;!xEyLBHGweL99emd+MM> z)6xR4mD@-!J$y>v$VymrJsmdqm%bw4YgAJ~d^U$l)1yxu$*(%FtX^AMO0AWvqgCFJ zV`E|Eiad*=mMENO=??+ddE<%tbZp*_4(Z_1qornh3g=p=P9Mk&1kNu%%{&!%lUw`| zLFFN=R_mF(3_M9*+f_QUukNO3QJQq~NSAa^5sQdYXY4(iE<%}wv}hA<`%mD)u{{|s z>KtGpX(mi?APw^Pj(tx_IBz7}v62^;E&;nNmqG1`A=|lquER#hP+Z0yf9>YM{}8MuFkC7QZr{t{Jpf^aum4+L#3B+t5M|%74PFY;Vu`~ z*r=#Mb}xg_tPSz@*!w5ICN0?>YR0g1Gb>4Gg{sLVo7%1Ar;xDt4(~h?Z^UI8o=vM+ z2BljBsU}cVK)rv@=N32i*XWYo*A1Aa#FK^FU(&mW7glSXK8%ym&xz}h%8crCP9s_I z=cMZY;Sl*C0ebPuPk^8C9XL5?fY=!t$0&P~FN2+~ku78=2P&a}K^t$OmP+2{U9R!)u zydMX;9yE)DBm|)|ULc7c`@Z3>F9i~hxcFiOy2E^(10>Wu61oRSIojjlT359;j zXhuRe0O{zi0lLqmYX{PF;*auM=G`m7yM`g5&{FemB2bH|EeZ5>^KK@P=KV6zJ?7ol zfi&GpAgy-;&;#b{Qv#V%DklQZD_OIg2b#qtnSaw^>^)GKaNle$0(jg9XOcs(cTb zF3vtC(m9CjNs@5q>}#H*ha%OXWz(#eCmI8B|3w|5PBcoJGYiYKQ1ia}a-+p|V%WPuO<@q1A(C6Ar|R-rnx=HrU%2@nEgW z>fWx`8p6p&g{7r46$+_uytk@eh^OIocWFnASVF9kzkNt<-7K=bba;UiT$v_CI4E^%Kd_* z`nC!cDv00@n=l8~s;8WTi?;_Eg6eMK72L}levAw+eYDIJT54Wp)dK0MLH4Tp`l4R( z7}88&gnnTvtfu3OVoule(qo++W2blZWEA-Xig-Jx;&Qnxhl|j8%W9ZAhs7J z*TaE+V2ImjASKsxfwYdh1TuBV`RO0EQtt~uT1Oe^AoEpB3-zlwUDmJrkVr0PZWLGh zFN&}v>0UoOx{d}3CG!-uoM$~^>4&BfDF|vJaxE;fi~dZzN5VQu)t`jHocq_rFU4KR zCMP>1%6Npt!O=f8G`sCJPxxSWPHiZ>5Qb}FV%+ z4+6BOuSfYYJ;bMOf3Z6m7wFAdLIJ{Q02=|Q?h;hO6oY3{tQ}i6nG@;$00&p4Py0dG;`+$YK-))H`VsCfv`nDi+N~lOc7pG7^C(?;0IE&4%|e(e{iWH0~~*EmMEphc9QeJUX$s z`PaNp)gngM1Mwq)W->Ixb6x$%^yuP3<^vj|JLa3{oNX&BH&J|ThiuV ze`W5JZ8YMy4hd^;rqjdL(f-Q(h}R`LtBo|y!*KJ|mm#ZcUq7RHdb%1z6^c8;gXk6{ za+;US#&ZLZt{>4)(zPP2khf_8X%2~m^NPt4tREi(>jVSq67E&AQ5`~UXd#M}8vQZh z-Y&z`4+|>NaQWzS!>MWenSEat4hFV}0KAZb&lP9x&K%lfI~IYAYl-khF_ELgrz%B&HXmOd5(*`l z){|A$8G>tN6(Rle^@;wJe-xqYvJd0+RC_a;S+8t08aPws1fZibC@y$uMkQ*7MPgBu zYLSb3-=phf#B{H#9;(U}-b%jf#0%+G1bGtZvT;ISe+#6j@-K$8!e4xb+F~-Os)@Eg zoG4#xm<+;zdwj(i8G|C_Mihx7+yZ*xDYL?fS5cHQO6RJ>8Rmvsr6;9kWYrdzw zEsm?J^J}VDa$NYAoqtS13uIOk~6D3cyr(}w4MesJHJ9B8C6(Bvo+~)*7n!3=h z?0<$6_-N?}t@xvcKrf;pmCaEZ`R3Faex0Z6Gw`GRfgcfwinKfCa>p?9uwB*6{E@JB z-p-l+R`H<9lhrD>O(wn*Rx8z+QhzA^364Z$PD%>|g%!bH0(!N&!Z?Xhvm*GtuAgxWbxHQLW zK$_!CAkFbMkhWkqkmi^M_0t?PfL<^ym<6O?7AFkE4Rvuh zr(`15jjvKTqMp=MNjI0FbDlp6Z#&-}Eze}tPUt`i;6gvL}tmp3VT)4 z8T%{6uoQbz32)bfk2oF%+WR7E9DaaEF@UM;h*s+kI@7qx1ScHs;f!_X?|E4o@UyVT ze;X8(YYeqQo z(%GTZAc8gzxNR}_pR)7lA!JkPEIAPcT%a7R@jal%=jpdg$6)l077W*T(ee!FQo`9u z<*l326P5205*>~jK|u2G0@C;H_>eAJZ}o`2VOm9_+FEFo)%pa3mNd?4ILC{SH0e&S zNe-MoDmlKZGq%l)DVznToNXrJqa1|U9hsS~_q*=O3(+N$2kg_heHuwFYM^>gQ}# zG#4!iIa}fMue}tfEq<4bkL|mNQDU_&U`ZCgMH&D8v~-f(!@S$~9_G!;J1@MJRxHTVC!%`TWlUzUU=#l^Of}(`{!FA)J3KJz{Kho# z1%v{axn&-f#r=L};qQ^}e;qKuQZd4-x|7ip)ongao1btGbge3H4zwid6oM<5(nSH$ z^RDhjQ(kGZpTDvh>1W!j2V6n)++iZs$S?e>pn2|a9*mG~zgo`T1nIt^jW83kdZN_# zo7E@C&yzNPl|F6;QVMef$Rg6|NazuuYYcQQIHhMdIbrG9?Z1HZ?3M+(-lP-hlb+ZP zWJP_}y!$+mmfQ;D93dr(H*KX|-vG**ci#n4iuyAk%^`x2jQJ|Jp_*d=LXZ2-lu|_G zvebMX38Z-gx>tSL(*vIG$&>3VL*;C-F)43EfSaN7j1e*`!|Y9l!l7y)Z&`Tf$Qkh% z|FnmHKHemO)|Co1m# zTAP?~&yu?LBgEKk7TP3PXvovrOJ@+PrNPUW>iYM~$_OEL^<7qbD$A;@%W7AAJ^QNs zTO5D9=i)aW`ueZyPzvr!o;a-z_n^t9ZHt@jwL^b2`jgk3`C2*N)V**}JbziZbYfC( zQJoFZ6E7WSU;UhY!*g=a8h19w+l%Me?R$=E2|vaAM0kTe{zdmIBKJofRBTJ5HCxix z*(csP5lvPWF5YDqpA%p0*TL2J!a>RW^l<3}?rw!#pSY}D5O3c>6}?nZ zNL*crham;siSY%yvt4?EtzDPh^o(sK-)=?A#xf+4ke}aYp#6b|M3}?>J_BzLdD#s7 zrS@0tU3+EVFZ#D*9rTWXRN5`+(`|kGG!@TIr8$ky?fOUcoY+HNF>^A~R2LMKeiVzY zxFoK;`fjQ8pAATFJp628{2p8N8X1iZh8CJIyE-gtY;6L5ctaevmBvlq9|+c=3X#7x^8E<8td`y8 z$Yts~&S`Jo95vYK7(CT+`0&P&;6BfHu)`5xSTNej}n%zCutfLF*<9GKlc zV92x1?(C+>_XnF&pLL!sT_nz4aN%@I(;Bu+Rv3Ht6i?y2bUFs;^wG-6tw&M(z~LsS zuCX9aSmd>MATQmw<~X=cMbh=WC>!gk8J=-pj$Ta=N*)@^kX>)6>19A)F;InM1%b|G zWPC5lXy8>X7@t!4F4Kv~!1}OC^xa6{8ovklht)HS% z_Uf$@R=srlt4B_?cm1TBD%b*A-20{3(Vh)8=@uF=0~x<~55lB*d7Cs`w{X+T{k-zC zXP+VxfGH{I{3G68Iw#)#!66ii&%QTg?%d^brAyokEq|V8Dv~ZHoPrG-+PeD=CM>4eUcG1DC86pI-;qI&1lADG+{E9 zOOL$KyzQd@Xe3k98P(F6$N)QIvrWg&H+_lHnSLcM{K$ZWd_$7O`hSEuTbfO7Hu4N!Sp5uc4J2H?2h74M*B{JR@_|_}t0}%00H*`l5`3 zZRDX0@M1xb@q}_GT3*4n62v(%Q<)fO)|$O!x8T=pjkY6rScP5&w}fv1w}LSp?~iGT zXiu9K)yF?mkeRcG;L7^Vy42wYdpU%a4)sT>Gz9jnG*~cz8w-Tjx~OK>`zy+-@qgzQ&;K+*Xg`a_k*Bk<11d zB)}{H2DL?Yx6AA81c{mx1T#j*KQ>F=!yXC+#U_C_vjwR0NB|0vC<|~|8#G(YfW$HRJoB|DfQB64zZ)Gurv}iJ0Qxe}XH0GX z4Wupj3D7H*-O9KWXf{_P3HMx_ymD^dNw?tq6Yi9n#K0+fbbgO_(4;71I+JO*q<)+^ zIyaX4oSX?!cVTL{oSc6`axuu0(Du8bU!0J8)6?wyv>J0khc^oK@b7PkjdsAg2inOJ zyCc{TPYX80Q}I_(TRQ)LY+F3P4yPAJA*=b*c%E2B%XRYa2GYs@I*?9&JCIKPOg$(O z8;<*8yrXz$B{v3wf_tDF+pa;fo~3eo(VQOQCL_+BD^bG$5b5>+=fEYqAL5&p`v&D2 znM^ByF9RI2j|{M~U3#KF&j5T$he+5&?ti|Y89$EwB&3xn;Qv-aS{iI?k=#fdMM4f~ z6ImlyY&?$kg$&M%eRv5H6bUT>YTU-(-}7C zoc99tKb|49TAg9h0<(xqAxeI%T&vZLcixYe>svzTMdnuHx5jD}8J@Tr5bmK>gr;%N z;KIFog?wVVCW=uXA$&F=VKeuPF=r#bo<`T8A3kzu%;}CcY>8Rx3b7$uTDPV~#>K1W zbLm$~LrHHB>5g&)z{il4Tdbw8lw#ex%@3tdlG0E2OV99;`-T4t<)@G3j>Whsn6#vp z5lWAcXK_?8X^H&h80vXvs+{D7bgGEtn*kJ@UKkK@zvLZY3+YqnPGjM&sI!57j}G%^ z*Z{bQmWD0#y=6#ujLz4@%P59#O22|bIr_f2a{7_;P-k?UbT3eah}IcG6RqutHisKI zC$a28w;I8UX+?ERP{zo1zqCTKJ1;6-F`1W|SN}F3XdM|v znI%4o5wpeJ-E?NZkiwPa1sE%v8mFW3yOV(XljwyPBw@)G@T*G%qJ^g-UPs z)q5#@fGa#5O5cs1>j&;d1=`ftF}+!|Bm7j%4P6_THi{)eYUKJr$5lp5A(6-`6yTD} zj^_I?k-d3;0br{=4$8>OL=Zv1{WPZLTT_TH+!f@kn)<9f+nw1*_>q5sm!SR)_M}%= zY!rOgmL&pcW&ruEb)&=lBRkGrDt;)SEkylPKNK(G|7~ZSAhn<@`Z^5>cU&~Pa9AjH zN!;b|M$2)dcjpSqu4?cyc}DfT(qM03F{ZBN6Fu1J4Q^k(W046UL_2~iyoEg|(%rae z^3d$&aMVfS%|t$rAPnh_Ml7g%aJjur!swOGf<63!5u`@h@UVA|$=$caJQ*eRQEwfS zWssGKC~kV2-LwmLyImUU3j#9w?4)}wEXN<{Q_$zsiB)$LaNc(KIoR%b?Wz5<-DZ!eu0oJ*4 z$6>pJ;!V%sjbE-a-tq8TdQ*hejXSN{IOmt9eoSNj5w+I6$c7c3);3{c+|}=K=MK~O zDIF~n!)SxWLU?sZrNn_lZUf~Iqb`ClXNa}zn;h7rt1D=WzA4rQp?4cngx^=eK3{o?|ULf)3#GR`S)A2O_MpaxWp4 zFAmU-nU?0ZBR8VoURjyFbyn`@BytLP3aGQgZ+EoRlxf8k@LCg&_E{S5s3oHzmWmt<7sJ)ial7EZs#%_D<^)jaX<9x=M zYXH(;>rSzbJTD)~B=ZsK4Qsvg4%a$qV|-0jwVUVPpOo{B1n=x@W|A<7C^4HlwFoQ@ zWx!;PbD~WtQ)!maPe_RcBu?L#aDo6j$jbdMj2UFkWx;l|3@V3;5`0h!stmZn7IA7V z*wQ4QvmXqxT20VV7J$_{mUqS7G{8)a&~!%9%AF0sk`*h)P%-QkYnml`YL)U$uI(5& z5Sn!0!aBiona)@pi@!k%5V~%3r=(q=`e19B*lBaBo5&aY>S159!Tqg3T=xW9v965-;dLWb$%Oxbs0+U4-O-^pDEBQ^!|4wJ5 z-MIGH;uN&?(bZSU})7m%ppPrTH*+og4o0*L^O zNG<$KM@s`3M7x=qV7DkPGU*9={16D`;n%pL_?F7{^7hkyaZ6<>bxa>hnsi+}ybFUJ zGlOR_ry*;Zn59CR5MN@#_bO=SqGtF69t-S9ctZvGH`L0EVW=oY0u_MONG9e zd-&o3l80auxs$xK#Y;%w%^30n$c{LH!TisRvrHUSg^IrwPZ2!GtQW76(PDuc{P+c5 z@>9Df51nUa-gwPJ^JTx4Y9VF}cBpulWcJf%{q)xDq6|>Uv-B_?i(+HzrA;4MoXji# z=^!aju&CG^6md@>f8MtF z&*dm=KdY=cimR&{?4CF9T?RntQSmoDG63*YG6KQIBvd40&u*@oqX-p+ir3z22dAc>tT9zR<$IJXj=91#vtB3tu_n6gY6^tP1YBM%N1TwuX{}afd-n#;s z;V20ty)14AGRu3Mw92giqZMM6h*(I5(2Pf4YFF$cW1mSKno600&;3Nckju2_K^`h| z9PFR6kj(&8FR)^Y#QCWmli#(L-2iBo!$X<9f3lW+Qp(JJaEjGBLm`4hOam&VWd8i^ z%_E*OstffiDjr61!C-d(P;n>^_)o4npA5oZrf{Uv;bBMeTSB_UnE-#*dZ=MV{e!hL zlRuK=GLlGw;Oh|idWQE^3JAWu^$uT-;>&rw)g#yq0VJcXUP^WXeaUzUybeTj81zVJ za{yh&w7xZ7-hCSAJ7)^?B9K}|MwwvEaSza+O}eiDY1G~wKxb29By=jJYC7RKj^Rp* zQh@$ya%=_C9G_&A3hWz^kZ^z>HR%R(D0#!Avw+g31rGsfdGk34X}YceDgjj;hWGJ( z?L4!dK8t+IQ;dLJZRG`J?!l2^a4<=oA{rf{$FTuN*3t4yNF@$!>P;PTRyY$1%|9^i zyxP?3bk5&|ZmjciX<(37RLVuQx+3*CmcqB1rpwK@4)=VZ>Sp$FFzqh61>u>n>-Uii zvB;v&HEt~(u8g(a84*dLI&MM>;pv6A+*qC=gY8a!Sx&-#5RN)Hs33DdNyYOb=F1&? z2}8o!g^pgDz%-@=cd1ld`iA%D4MyiuDP8_`n(qS9L8JVONa6+_wJRe1R7k{I)!nN) z*Y}N*E7$TOe2CWtdfCZd?()RjDKf`iemX)X0!mXgJHgQs3X=Lbqi*&|&Yc72pXNDj zK@X5iE?U5%Yhkj{)zO}4uJltHSGL#*ipKL-4q*Otv*lK{uS1OkNMVaY`Uay6DB?%Tv`(qcJM(X1HlPNJVusez;4WO0? zo;0>uv6?P&a6~Le*RphRF9KSf4wX)XpHJj33b(XzCH7o0{H&FWN}`Sdq4@Yc6`h^r zn3o7K8?qncqx@SOAUd%w3OK^U;}!&i>kMYFZ6{TTMgfi}hT3Pg&E*UCc%88VHN(~s zO)2HwlCZS!SAz?~Ddl^+&9!;1utrje5=o1DZNYPDn0@cU)F>0lQH<7@^hJa1@bUs; zpt$o}5Jg0<2u;(YDbUQK?3$Y;Y49y|h3(Qw>XW0Y*EfeCVk~?YGI%L*(WX+Eh~HN5Kn{44zs>Q5i!1I#H^-YcHO+L zoM?K=y1iMj#8bCg+DF|=?p)j7H0oC2Zj`XXUGecCsYM1_ZM6*oARgl}846|Aw=gcm z?h!4XWoC893Z1boxhG`g%#!o*V7VwvC&F)`bMw^q4dn-2U3>j zMdnbqHBpma4cv9!N`hJ%Dc}6}wipKGIjhCwbc>L^%bUVh>JWst#rzIh@i>}appIEu$#&}cs`S6Xg#T=iXn=flBk5ki;N zCRt{16xk-o>q+t;3tM=pV|c(=K}d?x#KUR2Eo(nBr0Z8rMmA z2zmvpCLYFJ1e z8<)#|fMLFcL%F+z226YT(oylwX*JUAU@3Ver@vRc7Nm#oJIJ(8{B$;LoPR~a{dnA+ z{3?82dK?!_=6+O5@~@DBHR`2H6>N7fO?p+Dln~v2TJj1vRi;T8E?!WFL)B3<=?R~! z^Hes4&s5|%ma$XFzqGL(jgUK~#+wh&gs6FO*Elww?)!Z_82`D((v(@C5=NPXAdDPqHWQ;#ocKfgMV%;9_ly zd&L}cwv39>;vJ*GFX943^A~Q*?%8hLK8$B`-#ie&aB_PDF|rHif+KGkaLpX_NqG7# zf8C$m$RWa+Fd*uW!VlSUqy z-e8wEn3SZDOYc9Fe#mM6lKKfPxu;SOMVnIf4e4*$W%fthz$KkOm+sc1`B3SkOBfYV zVeF-O=1iVw+F&hxOWK~F!X{lv0Gp*8sZyX3pG<^hu|IoEc$XfC=^hYT6lX-E=E2g^uYYP*XWiE`>Q zaz2ro#Q^k8>2SR_5L=SWZkPwfb3XMOkH_~JkB3b2W4Yg^Rz#a_Zb*NPep#)JEG3Dn za)-H_1I=suC^vnTW~s}4gWhsztXxBm@=)w-MX5^Rw5_>-hNtA?hZHzAta3^p`f+>n05c1^~( z`zfJdD696W+ZXOC%Su zR%_MGRn7R#6aQ*Q{jsdm z{Pc3^U_;pL^3zu9Qr@BaG3tNw_U7?XR@VdfOc)@6z!Me~6eU2=un5Gh1hHm924-{u zxbLl2rP^v$m=Ro%36lh-PY1CTm)2Ul+y1&>7mT)M0VSYT5jPa8U~OeOE?8>}pw9a} z=RVJq2^0Ex-+x{{A13Fy_uPFu_uR82_m#&!;BhmSK{UI_S}B@ucs+*yz*BPW83O%Q zvn7>JQ1%c;<8Sg5+H?u&Y2OWgtK7XJm^UKN+rlJ`O_7DfS)=MBymz z72aYt+|VkU<7%#4i^n>5AV|1ii-c$cTCS2TL~|#cK4+#rVLC*$oV7Cvr-{+@vXgl} z;JOS6ugT!$A9FI>OLs8wSy_B2R@G-&P5&jUNP6xmIBbzc6G@LeCY;=Ove^Jw!nC9& zC*nQoIfZ36E1ub0lk;Te9v@ zIiNmwGRMhirNZhVz`SyXbKy~xAfkil*v%{BXCTX3&vcbYIWs--*s%X~I&T&#F`Or^ zPzik}HW)JwcS*WZ*-Yv1$rMq3M!K{dSG)pOM*U(OL9Se>PVEozGi5K3@Xdk2TvM85 zjKb-AF60kV@bV{|T2UNLQI|C`YowLI`t%v2>hYDs7V|^4FK08c7+Cel=y;K@l5zZb$&wRf6b{vVhVHBK;H#2Hw0NE_o-5tm_INy@pV9k zdHQW2u{*-4q7E(7g?$9JKolCuC>rIEM`e*@&flI?FuS$vFQ}knKxE`8~c{ z*XiTs1bK@!wji8-Q1fw>!=Y_!cvv4r6G%DuasA7fo?Ly_s3n*8KFh)gd^!%4YlvR_ zA>!tao{1U9YGJ^6Y?|1~aMo-DnNhs>Pi|qkH{~ImERM0{CJGlnDgE@kb=i&7f=Pvr zTx<}IG^CtW*;hFpUOba3exetci-8Qc`ZgdlSi;G8PzUB!Ak*O)Aaf0pcY(Y?=q-2o zTsUorKKp*1?npo+*m|IwE z=8kuLJqPJSbL7kYRs80R7VhCddkI~$)aja!a_0aopnEWk!Q4ED5x#(hq~Y#9nm3@b z^z#NZfA$~*Z8lD5yz|3Me|!0bm}Fik*CJfvh?eL=az94ya|7+$sKgxXRc4xUxg=k0Yjf$UVS&zv?Jiyspns_Mh;W7sd0bt0?N*_t|iqJZW`Y&wUC z-ybh+6v9JHqM6p3Onb*&t0qt!pMtFQ zHELP-5w?a%`ksf#A&kj*`;joci^N=fjv|i9o*GWC?H$WDCvoDuU5>Wxu~AVw%uIS- zIq*RvADF}QE7VYZx8sqFV=6mh(b`CZ+GU;|XY*+OTna_XEu2JVp;2yX5xcov0%Ze` z=ZNT)AFx=FIy}m9qr&pt9M1M1-mfG z9kItsbSvgyn2~I}Z1a0$8BW>~t=@Ax+@5}s)WAqi-F!qrl6%W>U>nv(*b)4Ok1z;^ zL@;+xi7wtqr4dq zN?{0{e%c;N?W(28Beo|ot7hy zV5|H_5doF;aw62a=*t=U)zIl|7y*mhY-w5D>gbS%WTKQt(?Nf@dJ9?cfSoR##)0;b zvv)ks8!+V=IwfjP6Nboz;rk-#*#jbed^@9Qg|2w|>W8>739WE`F?@li@+`&F+t+io zdLKqx8qp{FJgCiG_+jLPlN#>E6bX~H%W4v`sVn&)_ZIB>h#i8>p@$|TDD>mLDVYXb!yxMO7btVsR&Dn z3Of6NcuZr=twvRYx$=90!BP}4rSGJ)9mWb2A_E6mf$C9+G4GmsyudNINQOCwcUtMp z<#eW8#%O@3aA*U(H{(d^?_nDg?Ie<$M>Kt9dDuP&k{zWnF@xbWVn?Qvir7s;G0KK? zfG-XY-OF{8v+6o<&?7Uqq8HbrI!OQj4QvkSN}}WH)ONCK*y{g%lbR)uLpRAK(!BP> zE;&?N-q7uhtyY<&W^)_wZf=8}*7vY&3-&b;D8Oz*!;`X@@^_<6Cs9XpGMx`}#W8Xo z2}3L}Ss=M0m=jFRxoMbKT{B@10hw*duD3<9Y`Taku{rdTkdH^etafzg zvAZF9TIu?isIu3}nep5TkqAhr}m+j8DcE1BPNZ>1}#tvMXcDB?3+ zW(c!hg@-gsdgE*jl@nfrA_!H`*V`o2%y*exO+Vp%x@VviGcydFuCmzGP$F(hN6+wd~TVLD&3~#EkeD64EEfBIQf(Jf1EhH1XpVA%teIEIKr3dA`pSP zqPW~&G@;0%oGA5onO`oeA`T-$ZZh@aTlg55xfgHxx_ipbk7JrHu&H;t8pzs zFv`7--<%mhFY`R_`JauN3|eHVsl9T8R(aKrT;6Cd6kiyj|n@H z+45_Rl|$0Rik%ok*NU_6^%{E&kU0>qV;5RZ`hag0P(q>a1MOBy_%}c%KM`p7t)_hv zNQOS(dkg3t#XE{UQKX6jzT<#QO{;+nb7>Kf;pY7aNbVW|-|v9_sQGOGI#JVh0Bz8) ztzOtmK#ytIKY?~=X<~HbuNvlOTAQ#DKsz;7+($Sy0CH*oWNL6H(C_u8^C-}pn&M?3 z;c5na?*rYc(C0uGDKre6w<$5;I||4U52B`EAaOEhpsPLTXF#uLit}J<{4+Y~=_UQE z+F@-$>8lbeTlC!}OdNN2}oy|0n)xWYR~dJIO_GN{_0MoZb)>oZZxd>O@OA z5cLNMz1Z?C1g!V-Gly22ne%NAI?v_1)(DAI19J%8kmJXgEx={^U}!73+3XW?5iwho z9G@~nt;+r)|AyB?6!~QbK$>udu+$fI*32mKElOQ@LTAlME7&Q}^q)yQOI}DJwiDQ* zVRlrWPPnWFQ6rm$24zSTg6LnB+WN%12OPngsut!w~;lp=l_$SgmR zNieyH_JYZUN$7I*lKYF|x5$O#Fz)ZySR2%;E%RpT?4sBe*>6^LX(uTg8$!bwK;CX+ z^B4>BnXQJOekimd9@_e%Y|(nSjPtKq-Ea-N&FrFhY0U<|vE4>zz?1oyW$3$6*WwvK zHz@QqFYG2S?4bMj!$i3EanxVSx*GJVXElo23zX5tW6=G!8t3sPtpD`IV|c(n8af23 z>LI0{wr58LbE1jYNLHFgXj#!1j|J1WZL3M-N|v4x5?%9kn;@lGt(!xQAIGnNdfGZK zU7DhhxA=QzuwkE2QA@*ht4jo3#p~khc|8l<{$Tb5H-9LzY4HjWVq+yLHrk`*(Ba>n zO-P`XzL#ENo^Er<5adc<*V)SYx$`#SIMT!R>7rR%a2c6y8#H#jHzy$vgNS|l}q*H5hJJsC-d ziWbf33{0I`4*6C*XLH@uBA*a?uC*Rvg8Un1oa}RN^EZ1Mxn)kLZc0)hNrj zV9YLrSn2k~P7q&&*%RHdU0Q&5b2 zH9W;_PDglt%OF|GxVy{3>vebEPk`BXWQLUKUQ`P-M4@^hW(%`OCd*b1#ei=gkU1{D z!IUBL<#a;n4Mq{t_VwV7!(w2LW za=7yiu^0{dSFwR1WSTxE{)3X)I_m6(Q3Tc5sWJS~J`eMBD+9d+47Z;v3;OwRE`OSt zOQkzv`0mMNKWHe=o%xjKnfa9G5-86(4&`~KM|m#kaZ+Lbf1^B+al#=K1b<9qSwD zqZgD+TMA@GljGeXtG)+h$SPsHno$y$)dqUrgWmNZJ<<3I_{8nuTLFP&ju}$b8CTDI zhQ9hPuklnmZg(W>O`SV1I}|@LuU)c#a9WkycL}SeYoo|#K3$&DFJ#J#<;4}Z_HUr0 z&AXd46wZ?GWo@XOV{%%#f|#DrrX9k09}&!^c4DQ37LwlC(h>CQ0n2*8QJyuE)LG@1ZIbuZAF`|hzN3L2Qm7JWuhzGxtICC( zE5~w2SqvE=BZ8_OS0Y4$`v`&{Yo)U#uy^wm_knbrK@aC9lCSR+{+p3o;6Yl9OE@|u zi871ijc_`6GV^5TzUlvGIZpR%2^$Ys=$VyM8+k!Ik^6Mk!WZx21| zk|I2b!6)pB4Geb8g-uxEJdwq!5SOwv!VPr*e2=LhbSWQ7gudR zdzG%sOdFB`>SJx zJvBhy9kSd$P?SC1YC2{h><3;j{fYgTSWTUle$^C#)0ynPEVeO{uIWd7xSuMB$q4?I z+>`q*vl@kfC0gtegad8VLG-&D*SOJ5Cc3{w_itl$Y4iV=o{5qN_IZ*UuIJT1f72v7pV!CFy;0w=pXeZ#Na_ z-7h-`q1+<`?}#?JJW4wrE5KWC@J0#VsJ6o$yt@kU)QxJoX0+gqZWBhJ++gtB>NHRe%>Z zc;f_bT-#U&Z&CqXxxo|9F5&TQ|0I!=VOnb#TS$IO*I0x@FLVNeiHiK6ocol8q z9lS>h@E$gJ69sQ#+XM$MRe+Z;c*hFfv27I&-W3IS7aF|d1n;;uIa{UwstfRD7`#fs zt88OKSG-{bc*O>9lHg5}BSrBtEco8--9-rff-C3^;mK`6D@eH=1$Zq6Z;IeeX%iYq z@a`|bTWj#93f|N<=yJuosQ~X9gLk~(9p5JOkK`9Az^gHM(*$o?+f)Z{TmjxFgEw99 zrnepM;O%20?A_kIgwWm@f;XdW8hFH8joS!r+M2gdZXqDE5wjGF)~0sUr#2=IOo^8u zlj$d6jej;r$GSPCP)|N>0Wlpr5o~SSo zjUT^Y>Wyeh=@A%#)CHNBS0%+DNiol)z#?-2%@RrNuS@;oF*#wQsprrDHKobHTRT|N ziWD;4n3vY1kP}u@e8z;QKsk78OC`m*he#o3t)_U|q>v-Hc8H{yeTWnUn-uq%6ml5X z;#bvbtT;ppCXY$6$fS^Cxz>^trH4qt^ff6?GAZPMt}T-k|E0oxwH!Q?qR6C>qqr4tc$ZJPR zin|YyLe6d-k69*#9O<=(Ns8MKkwQ*!O;K!8$l+dlxTLu15Gmw5*A%ZXGPGQd`Pw5S zMf4CU3OVC7#bT2}j{e%wl48suQpjnqDQZj#Ap&ZTloUvj z_c`Wr?rVynCWVj#wMR*c_gDyh%@UyiG{qZCJX$V!g z4v|7=22Jrcok`1ul&BpiDK0%kigGu_dXqwkirVp#qV5nWgpSZM?l38Yyr`WZDW)DG zg-{flLM9%y5<;W4LQ;%8L<*rTG{uo7g^(Pz6D7rGY?pnFxlkFJVh>qTh7cdM$4ZKK z4v|9W4NbAZq!2Qs_BcuL>>*MJ<)JAWO$s4MYAYp$_*&_!RziblinC1$Ax&y0Ns0#! zkwT~uO;K)A2$51dSyD6}BE=*(#RnkJav@i0r$~xx50PTBo8qq~g%B>aQzgaxL!_AE zrueo=AtX%g@si@iL!_AMrnu0g5Mriwnxq(Yh!n@WDULNMgsiEZPOmcPoVQKw1?S*2 zH^qO6&y?(iLypmosvLTgy!UKGAt-ivxFP4`41jI@A$sE|NX{%0vBo)Ynv(l5<1-6D zgZoJ^awjHO1WhzJAi*_mu-HG=;QrxcX8^5BBohNOc~6n2fhIBGkXcDNRa-#{==r~e zI#LmgbRiceu=5D82$1WgM8=t9JN>e98F zF^z(0$=QVQC6-az>#d(|vQ|zuSUhcs@*nD-4ojcs;d6_&CEvD!ScC2&0oI_cN83Z! zw*T!}I-+CGi2CXd>(1=^x!i(uAT>W-N(!%}#lzfEsDTu;wyARt2s&JT)Y^_DIbsHK<@xNnRb9%U;L*i7b)v50uzF~|x z{ILiOtxuxWAH}Dt4DYc~`z#d`KN?})atA98ir68dgDlZr)54nn&UVhk%Eo(IFzJ*Xdbz3nVEdePfs0&hNx&}$*j2ol00*z z8=icshzZ67A!eS$M0#SFIvq?BVvd)X>BQ(=A~Tpz%{BQH6R86;@!*KP|IFZ?)U3@8 ztnw1`A$Nq#M_H#P$)^SoGeBcrmY7$2Vg?e!YX@omA~8=8qt-k!_wy;@e0X#s%#k=} z`_>QSxXnPCAIdra*Gt$V?NcSfC1^ zgE?*4$$9&q$3V@yLu9g)=H2EJ-0+&Z{>>6w=4Xw)2NaQo%6}NGc`LwLxsABYome8x zE1>71p=JOJVmOw4nOiBaAO=#!m$|&J7|1tYW^P|GkhH$c)V^Yb;Li;2E2d0hy4j`* zY9IuB=FPrhgiy~s*;kAZCB~l#R$QisqHI92;)p; zUok=eXNL9_BZO||znnS+eINvF=Jmc}gmBHY_Z1@qYDOfe3UU)dH1nOlVuaw#Ebc3& zTw*TlD`uR;e7Ucf@e)(fSIh*75z_?)b*qq=z5Eo!Oq7^c`ic=kE+Zl(1!;s}%lxFT zm`aIR-B-*c0<$+2WF=Hq_TqwIA*Hf&3W9}R675!xO<-1_5JlO;3W6QVXEtkm_`59J z+(r)SkY6_2RC*>;W%Uog%J1x1&U3ld6k?4jPCC3fv5yn>Bmyu!hLi^;o1d{(R`4B3 zKGm;kr#W9akL${|C3jh=j;@IYo|250{5kV9h_l&)HuBeFl>9kN{cwhZ^aMw`b2dg(>yVBj__tyrDm$s?yh?m| zYJKY6sI3uJ(<-(}Y$K{?RE!>cfiicp`x2wQEHvg7#HWxS##5@0f?JdOrp7LhG<;#G zuN7>!5CPE>{A~D*m+(cr)p)iWTqMCay1`#}gZuRz96;P7fDHP5^V4Ha(DQgKDKLV5 zy4Ab{D6^U^5mHu3z1xA6q!ojO(e%YdL=+i6+EVY6rBI=Grveb&kLZ5ERysqqDh_v} zhnVO9(Scwq+oMK*%7LP(KL8+gf1>*bTRBWLT7(BRTAr+lMt`q%K(JNLBPm;sBaL2f zq6ZQ^Fxbk6Mt|Rp7K7-dE+)D-*h)n-`ZhOuv577rx+K`jIB4{xZnRh#BK07m2L)T9 z^fmf4H(G=Zd4fXyFPdUjTs#=O!NFGULW);n@FK)vDIxW$)!5JER|;NfuvLyFY0GXJ zMO*Ulb`nBqYLmv_LFjlgEu_bDo35*eZ&~|Zbz07 z@J4_)BG@VipWunCX>Ytu25%&IBZIB_rUc%P3-Eqm@D2m-uwbjcDS>xO0p1dWcQ|;5 z2V3<`3B0ok@Xj=NM}T)kuvOobz?)QnH^JbI0&i5XRo|4r^B3S9U=h&X(cp~^w(6S_ zc&`!KyS*m!B%}!0`rItuXqV(`X+H!j#(?%;{IQt$l4;yw9|2XB0^RgQAWPb_`+#`~th zn*iQ~VC#4XFH(Rv$KX|fR}pNT;NXobz&py|O$2XZu(iU$6A`Q4<$g>E^*a{4V}q>| z9lRF`@SZVv$ANcTu=Q96?^gwQKQ(xj;8g}&k8|)E3h-_-c$2`J6l|?@@GdIAJICNn z25)k(RY(Wvzp4T}5p1O$NHo_@3APF?A$TPPc%st+-c<0W23v)=5WL;|?cFas2?6hT z@Qx3*PId4eE5Q4s!J7u&v|#J;4&Ge_c(%ct4&L-&>ogM|yH2cB6NLcPsPO|vEdY+H($XUL`KY}D{gXA5hrSqVs9WY`=S%vkKle9 z{38ket5=fb2PIT4`Qd$vcPpPlFJp}k_H#eRvK@#SP zH_~-?v9%xyiFqEED6y3&L1zi$<+wMmtWUj{xek~j>QkSomfJfdLP$j@udph{K5n=N zwcDcU#W?Y-tK&gh|ytw#?nkC_lmb*dg3YSo$`YR^)m zMBk%VU?&Z{;pvUXPBT3NG>b(-GP`M+E)&B8#O&o z#zH;n=#sniLDZh9P0~vD*#!HbCSZfet-DO|aH^@Ce9-tsnHVEJs2Umm$e~)%CN_cW zb&^Po(wH*Cxz$^wiyVu4QzMSWy}?eND3fCRqQmQw7LX&38z|2JPT~n6>8Duh5UbP1 zI|HA3J8J)28jhwjwURk#xU?euImGIG-KC?l~GbYs-Fr!F7Jyb=}mTo^U>bqfW} zu3Z+j&0PS!{z*DvC%Ah3M~YtmK^zt*Vb@BPgLmFk!}b%>Y_TJ^viCfxb9&8{9(0V^ zpc5xnfYDx%StK?r(C~0(6E?o<9dlf6Et5Ha4`;_}`q68!k`uElCZk3U=+s5Lq#acH zgq~boadaokp6n9eRweYz8RWzS&|c|Gh}fL`Loe{B{Ba_>6548Zlls($;^xW`i%axw z^pWnmNH@t2=k%Zs1fpCL41uvsq+)F<~b}U9U_v zxp)d?40_2-M{G-`((tf-lP6S(;fb#J2VUMzH8B3M%t*YSx=!}6`1-C|bZCE#*UeF) z+4E!EZ902b?gd56uK70AFmj8(ptrsY?GW&dgn~7C)#n2lz3NMV20$(ae9u7d8N9_% zbO!Iu@jl;$r%LQcK+h@OK=LxN4@$0_z5(AafJ`pGg8F!h^cZ{vs-qSG-?9x)d#)FIwFkLExnfKLdw8zU^eBw8cXNF* zTZA2)$u8HzB=hw$CsS!;ZIOUYJ|=?LzSv+)At}U1*uH~B=jp9BexI<^CRadqDMnPp zeTqH5ESTCFY}hTzc*TC7zw5RgQu;{FG{Bc2bm`xvKU0u{ztDt)Q;S=0zg1-*E%AK@<%W(*=< z0Avgzk70TpPdNdf7*zO^jzEEYa`L^fs_WH@wzZgZ5?eS%8(VeiT&;vnyxa^$&&e_T zo1W_r;vk!9sd-BQ{^q&?#9IdJ0f)Gz+F&Oz7 zic+FZilWqi9Yral6`1O%YKIqfr`(}KRXe4nXnFNI&m+0#MWecuZmUnxdiTHRckG&Vf1WjW1TU4b!{#6Kq1%AE~`-1Va<)cVHE{unQi52~hkBb%1 z1px=4N8=BeTKh2^)mA+e}3|u?i~EA2Kd537{lQfS@Qf_fiJQsmz>A{_N@75 zeE9W?RKK|5Bs9;c9M+tFz%{N0`yIUT&hA<~g~weQ%iX}=%Xwh?lDo6RRm9xnom-LZ z2eI=9ZAp9-mO;nsl(L#c9foc(W`+QyyO2jLiG3`y`2*?3rccDb9wtob-lqQod$Y08 zB6U4BuA+IZU^AZdQN91oX!UDRE4r6`OBu{NJhKj5KNdw(H&)vCs7t&fVv#Q;cYjgx z0zT{XIiarz=*iNd zNwXJ{j*AHD4O?Snp4HHyVjwY#CRLA3P%$2-RtM)|br1(nc@{xM`^VLCaqRXpe#s}p zy~sE1t?ZskDr_vzoCsueboT)nZMd6R)`q6KiS4NWK-s5%>Ota_U0g8*e4+j>1v1}* z`q;&L?9$Y&uK$oWT8;l=zM5@4l6n@NevgrjEli&rLKQhmuvT?|SDU!~%eiS0D}=gZ zMTOqY#oJ>z9jFp1jTD~V(iidK@V;XiQ#`i1nxU!s9qPz5Z{tcXs;{bmC<<+fRL`xn)@-F?Q0y#+z|})9vHU}y)%Y=?sLIUnV*`1IG1wgC!ZE4C zYJP*L#O*_K7#tC@LN(cWmA{Yqsja^g07Z74I&w3Yqs!)R1V^8rA_;)Y8SfO~rGtB1 zHA{3*a8_xx)s&Q6e#-064{DT$!xTn~@oIjpXWPJB}s#7F#@^Z1jOpV;J- zDf?fjtZ4NNtMSj&5NlKzwCz1@;h;+0nYtOdySldsX>A0{;!T^$KriA?D6kz>eEf*A zD(}WCWBjzLt!5RoAs|;VlXW%Hnib&5XbtG>H$yq3&+?1TKQB+*sp4>q=)D&r{#Qlu z`~~f(jZ(0e0qJS~e9~urWhz~`X3BKU406|u7(EtCy5}SHGVErAQHP!4EE=ovKbQ%@ zg6XzQ1|V9pkBUprtm`O$Av=LVzA(5QX& zVfE>YMMOsI2S-vTGK;g*&4us;?i8kG z=6ifNRpsn|Xn+oi+WtuDM%0|~n>j-kh1g|5|9gQ)lTjIm*{`HwlcX3fZ; zC2Aj6wKKQ@w^{EXVXGx9uZ%q5ovn4Mt&isU zBZ}3V8ajVrDFc8h+3-m1_MjiTlbh(<8q=+?!lZ*MrGv{K z7cLat>WqnLF#h3aq)tz?1-oM5Id}DClh@nJ||e8?^{i$(8g?k?Raj{4NuAv z=|x{GCICJM#KHIY-K8vxUjSXK?3f)uw-Sx*9U#LN`2c95vSU668m~|heQlQrp1he{ zqG`VhWYR7IGHD+G8mlRO3}jMl0=h_32%~Hgc?Nu9S?f{_D+4kMUf#FNuKF;LDdS_H zO3kku$S`$uV>tf;6th`4*D)pS$7+;Wl8fD{y2i$kXeE5kL~OikAa1m4AdY3g`Xx6! zt!@`FjIe!Ac#y2|fo3f26_9ejc=prZ+7dR|t!xyWyASoI`TW_I#+OK`IL7(;;L zBruLekvs3Bvsv7+qr~-(pWUfzV_AG=*T#M{$`~+@ziY3O-bwDlUwc_>XtvH}T|tk` zbYUj`%|k&(RS12rqE~ zy(17zy!%Bkkwf5lH-Y(ANT)xo#v8~ZYFF`+7t507%b~_x>}#Zh^NmNJQbSxKX%tDl1P0z& zHq0K#Peny&)@;m=&H*cP89&?$>QfjJd_T4$GtK>eR&yH5XLh3^yrcm`CEyWvWM*>? z=)~r+MX3*^cE=R6s?>u9vPu0J73ip@3jTWR@673ZvC4Jq%y>dIz*1^wR`RDKRNN7t z2|-Wm+hY?UTd23%rWETxCD^9)$HyC6mVa;uJSZQlv7MQX z9TGE9p-i9En&f8&D^FY|q3oX6#dH+;`#S~6u3`Tqg>am4!UHv?Q?OWUk1jZf(Qf`J0Vk7k>2i z;!)-yqU8an#2}Q%YP*`78N#CY2|B^` zqVMnRMDij3D7_f+BWnN7j5BH&&(a_zp&kNo=Zdp4rS@b+@g-UTm+yo}e*n6^cKh5v)WaHPVlMoZNom9GB7I+`?=e#ru)byf=M1Wj z<%8tx?Iya0F-X7RY%B5h7or`~C?YD*!dUHoKNiQJH@R$&ec3?EZ+qBRfDJD?0KM%dT2tH7=#&GAsFk ztluIXEn*03DtqRteUAhm)J}<)&F<*Tk@Ruz1f9(iEC2F$FX3ald!Vz2ruCS`*Kl^6 z>@(L;yEBX6&9jxs%>E%M>g}`XlI^jt)!Ro3AM- z=-P_B{q?)rEN6+WUYu`^zB;AL**$Ek1Z78=C>T;4Ncoz3zg|77t`W@GZE8J2TO}gmMXv zq~4H1=^ie$=8SR0g;JWGx2-WxH2WCO{)QO9t#jhQ;MmE@1INUUOCA^*KPj4?D8*+_ zP$Gd#k&v*xE=4XznG0aMOw&M2BCjBZVKD%!^%iQP?GssQ`XnDzldEpokrcAvo*7wY zP2OAn1M+tc`VodrtgB2Ih$>-OR1kk>=>`Vi=}^DLub+j zzhN~YU}I})7=q3|2^RzRGWRT_vg}?FtL{~drp@4sGncr|uI3-|5kT-+j8(3gsdyyT zVU1d$7YH0hVfCp4a#=YVhTkhiOwFg}IxiGhNq6!-v_5m(DbPC$EO$3|7laksLay+Kt{>%ImP$ZPcJtDe z)IK^7`{<@MsnE<|OPL13;Hs~Qrp^o3r~a;^T%XFqG7iHm<#FV^8BtrJ)w@QGvm%3! zIZ2@|4wZzt;w)pYe$b?L2#=@givhmt=h4*d6*r3D&oyCqAD0tbE?>N@z_0;W2v8Ed#y}aiYt`(x_1Y8*4e9M@94D>WOF%D&T(%!>&nQ4NhZ#62PO_+ z=iqyt1sg&9dWUXpXpw6M|7tKsnLbap3#T^mGYCbgMYJchv7UR|aduRyTYZ^Jls@fN^v{Se5&*d6+=T_u$DGknilYmLo z*l>)}Kx zhKDaix(Q2r(A^&N0}uKMJIjft20*5awUAP#ruPCJhfsOI_Y7({0qpW_yp+dnqohYNihzJ@OaIy63EnfCy=SZ8PJI3r%Jik14XoLtAG|L z^c^6R%i}<`TKmmFChaZ{8qVB1TT_e%GG&Ye+k^!@sNRDv@}R3d=q3+Z?m>3~MK$L? z0G+4Mqd=xsZvtJYVgCd&<$kBwt>5>7F45Q@0hts}c(HE*tv#LvAhPzjK>W?BPL5vHUWJ@p)`;w_lH0x?eBrUM{NVXEkHL;7UfG~KM09~OqxE#o|BMtO*E#n73rUs7!nLhZh2Z`BE z6E+R#3QcjN7j};aiAvdx8v7QI$2dx*gb>|Xwa``xvLKRAV6ah`L;NvvF3 z++ztZKHjsldqM@`)4Dp8bE?+>IHzlbbJ}teNxM26FYp=!=eH8Gq8j7C36Kugj%)%l z+o?7jtMU<^cEES zhC4TN(}1BkqlNAhUc1^!H4lU58;XE<$?f}6(C(dt&j zZA{aNgk&+x>*6C_$^ghUib<89G+L1KVoCZ!1yz4SSJ?)j+o4R^Pl0|56^#%vbu(e( zflS!RK%%V`@QIBO<0|wf4>BuMJWAH66k;9zPgBn&KK5@8FJmX(uU@Ipvx# zmY#DdF*Su-bBT7FTLY^}ZqcU4O>yzNvO8oE|5>}N+3PZ)?@agn63BGVAAwBwn8lE1 zLpJ%Ik&l&EZeD9TL!feHR3ocFE(`Hu9%wT=>D8R^z^v~!KjWL&ewbzeVoTvSxi7~O zv74`9_p9DwJl6uR{{9Ebt;3mSr01nAlEZ2FUMY(D|>IB zIl~Kc>}*q^8ZRvDK(3D(9KiA(zy+wA%~PJflg3ek|4`EuE(5M!H!IEFuA)dSb~=K`&BpsF&k^Ld#ttUX@1!BuN-BjCuzM~L&NRez)IFex`it)F&SNtxofKC47d3J50cK=L@z%j4$< z=W(~@AyOW09*Y|?xAG}0tzP}CJ=OFI{jZ%6R0AS=qye0FbJ-%@F-0Okrtfi5lT`B_ zhK&ORp;IXCI=fjGmACJk&7oyFnPgs}OL$N-iMH8BZ-msd!BAx$eYXu+X)j}RPYvLzRg3NkxTkA8< zRh+iO=OF098Ev+FG@9I&QTfY9(uV3zt7#T>Fgfg1acfs_QyPAj)K8dG&SFk>9x#>9 z1+3&=nvdv`VVl^2hRj<8nES5S^S3r!Pzf`d*Rd!2>ir9a=e?XEXaU!k`KhFxBhdXo z?sU5)557JRz9J76@jDk^$O9KXEe{q|Q8!!|vMxM250-1F8}0{oM%D>(cYo8qPpGJi z`*I$n_*@_CN#M%e>lUUJ{N6?vt*>B>*nWNp2 zCSt)2HE-;vHs8pUj1TsfU-l;V;GSNPF{YlHuK~R$f81*7taoyE_vba&utuDZ&Sv?L zf9$t6=7-CN{F7H~T-Ayokhj{KhQnLRgjfl-N)&_|-+`3g)t1t)UkN1}Lp5fNoNT5b zgD0ydoYG*fS$<>)WVwdZN;0}kCbxx^1uaA@#T=FnE7_qw60Ik){QJeDaG>Rq>5J8x z;;0BZIww<9xl@#z_qc+*dpw+)UCX}bVXD@!e>xL0R@1OwY_i458}=X1-}t%KhUWW- z{$k7QqNVe?nvbV^f9#a(?ELWQCcG$iOt!)aPlt2Kef_NDa56Em0a0r)CAtbe+#^nt zj)(Eq?GBlo-yPu+Ps1l{G<+tR`2VHhQ&F|Ow}MZ&N5O|&vH^+j(eFX3F*>Dr6xZ;` zW3Gx%ef1Vpd>(UEeE9TKeAbkMS$}Q2qv8|wZ^Us|ICW1M!3=bmKgg5FM`!a|I!W8b z>xly!<8~8SxDBf1sLM>)(KkFy;F|=P2nokPbAl$9RxX)+TH| z(1nV3u@`og2Yt(fgpX!Ytn?tUPGrLF@t}u1=+_?fCl7kUgKlI&nEEAvzBg8={1nh} zS{LycdXI+P#7ZBMlQi zpGo@>(DNGhInbjDiA9&6C?s6K%?cd_^gD$rfJ}Z|&s26}l2=yF%9iZB-}^^s+*C0KKcwDxlp8tpPIS-UDPx+YU5P`{nOIbvn{npli*{ z=GV->6MzOOo?NUA-Wgu(1s-&R2eo@p7D$9)xq}wN%+Op!h{)t}Ezk%JyU7dt2ax0x z@MVCEI^D-WfpHS{IgnAOJG#VGr*oMq;Z7ztS=$XlP}>+1>ezD_(tm;Et^;)??Wx)T zv}eN%;)1y?T)>W5TJFePEP$4-hn5cJb}j0x_51zFEybW;wn@JF4K#lTI)D9s^Br*G z`z5#dd$9YN*rK9DN**qXF5C2FDm7JGWNy_LzyRt}c|@e|T7+ITOsg7h1S%S0m-@Lp zAu=Vx)hHBfj18!27q2y|CMe^9Xt);TMCsL=Nq-4>5~p#17)`WLp=l zMS5UNF~S!-yC0Yp`>i9u#y!$Or+-F?fX2KkOj zr85!LSSs=)qQ9^ovk~!^Bh??p9*X)m%N4`BV5l6&W-k|O!zq#n)_#R&(GaCy44>KQ z7hyM48ZlFD)8=g5BSWf${wr*6JmsSWr{XY8oB58W0|ShSRA}o87=ha@kFx9L2nO$~cA_yb(oF1sI?FqsOTC9AM0jnR+X#T*$WY&5~Mdqs`><4Bs;+lzhKDRrV-h*cerdr#xsEkWsqm^1?*&+Tisu|3%|B zY$L$`8VVEcB8UwOr;b5+q&V!yzxh~(bg=4!3^4b6c+lF3|ZUIJ|5&w+JP#Is90~Aqs>&~aiEeJa!;H#UE5>B(#_^1RWx3twwXxIkxj6YlW zgQRvKehI%d@kRU=p#j^~jx%DF3GHf!>GNgT38e5zRE3v?XGz7snjr~(Q(841g)g=B zJ)vV)Nk{kC4EQEAnBG30 z0J~uqm6_16gWrb(@#zm2#ZP~@IKJRv>h~%wkxu z%nlGtnAcaCC%rHxldna7GVA$q#!0?AwHF1VClikq(}GfK<*!(>u92PN!v`DLIm#8I z;CK;x2F}7ty-rscm4S!lQD;lJQ5RU$*&sp)e!oh~m^xC7PbYtNf*D{hAaf*T8>ECF z$xo+t6##?2jjY0sk_}f<84CASm3Kd-CfskGaf)5!Oa|;#G<2^e#qIIOX|Qj?UBY#W zUBfHc!eQi&mVHCF+zt=}dQ9en5BZ3OZsA16#sJ7dievERF}-BR56>R0yprs3m?<70=#pIRfqufHIS31Iz zUSn=Y%tKbxihKl);3JnGwC?Z3TIM$Dfr!VGaza&ka?N48pZ5CexrOD3o39AlmmpNV zGyZONh?5yg?MR4pH8+tPPg$Gl%Ku?xr^>CS{0!*1KkWhD!YuY%)-lLJPdui@n&Zfxe`%*8`dSlnfA~EJ47xz(@t&L3Lo=M#J>CAc zyh?xiLRUxsc>kbX49S*k)r|uoJ0>+AL8u=Df@Ox?7ax#XBeUHuCXl(HyMF9k_}iD8 zyb$qahlZU*lKMQ4#HL$Ha=5{Yw3Z6Rk;jT&_aOw2Uxw zQ@X->lCu*;Lm|!7tz6$+2T5dAOLqt2* zD$%qs_a1<%d2;QU38f^MAb}izGl;}ue1g43w2@9-E%HXS4r> zkOBvgU0b6x!9jDdtAmZ@0yz>P7n;rhU?hb;V@=NH%Q^m?{)3!s`!#VP-K~WHFt@Yy zKqjo0FK^dCjS2%iZ*912S=O8UL|K;&*gaJz~B=iX!uxypO)2fszR(c?k5Llk8y^Pa`WHd zt)_u2IA<5hoKF#q?j#)^$IzeHi&^5dNlkAKny6AMBD8dP09;c|a#*{n^xnTB=9g-J&sl+DRbU_~EC?T4Q-RE6C-hALk&q^IiwlBemqSj_1*5#ZNuL#5#z4qLV&uf;w6 zwY87_Ds}s7NbKJK-CuF(ucY*s^Y$LLM`EE3R~o1398jyo zu?HjmXL@OP@$URgelABzCRXDTx;Wd2FpSI)mukINn$)XLQ>!Fi+w~jj>daW_6t-Hc zu|ew3-nGb)dx>2}PZ*&O*9_*F?tw2%Tgm-SnWv3AqnMZor&r064~uZNGOXNwQ)z7- zF5Ov}`Z`kf+|pD>a<@OZ>+>|6gS|zmxuw}aVo~YmeVK-V4e86`hxclZg?D0SpJA6y zcN%J{qIGazR56gjDW#>HkqS)rG$zhS&YtdzjrDZs-8K6TWU}haW}XsA%F6r&C=4)H zw_90fv-H@OE!b?laObML_;N+a2u+hbAu zwy518O04W1v71C#FKn-Un0R)V*cB`hU3AC8c5}v9h=%PfwvmIN6ONoWYvkbgETi38 z1`=xzJ=R&i__6j~N;9lgnqickDxewQ`(m1p|7TK~>B=7Z?L3!)a|Mr(soPL2`hE+U zM$uGz>P4!-(Gg7S^;4tv`RR(LEv%Yg>g8a^KLe45zX=Hk-*lZ2>KNqM8&0<_)1c;u z_|u3sN2uEv`m&mqFk|qs>DO=c_^veH#+unYtLYr`ZH$>Mu$tzWZ)3~sT;%P|w=rdg zeKcXTlAp0;7POj1m~Ugq4E%oP+t@LqypQPu@JrHXZBFd}1p0w*sY}Pt6Z`&Yt$K;i zT01%oWr9GwMs{+sVlUfqULJFw;6$YV{(b_fZJmo;OF(& zAKdmrjmKyI&mJ?Pwg0oXij!N5dwQ!l&dbI}Vl!uRo`sic=lV$p$0`bLpujHEwBiYA)A zQQWN#b^Giz!t(lT8lSaYb<>KAV4;X1l0#3jxiXd+VFfs?wi@^Hk=JZTPW5#O^_otP z?O|Y8j(gRUjax#`6lH1_)h3viSYQs(AYJluwb6FbFV4!t7?#!eJ2#yEQ9d5?MZ$mV zhSN{Z%IhcLzi`7tnt9Wwd`q86+&VYz922+G#Pydr*)FyGb4^^Ei5u_-v3bLl$d_I0 zc|t+=+}S9_ZdVE2T~<4*bWrTvObSGCN7kP%@nvfiq{n^Pla2cUI4_cY=Ig|3B&&#L z1O?gtec2KPW#J1RM9%kQFy%!*3@WgYT^qETGJQ*s;?#FZXiQ@=xEqXr@$e6d@8juZRSK6=f$hDzGAU4`H4)M zy`m+#50m_iU|ni&fn3#8W@3d>V{*P38f>8#CT!XV8HRwbM@ZvQ!VJUnD@<*ZRv0yg zF1y1E`!mpbO}iT?qV$Yd3#_Bw0pDHBe3SM*pijq1*c(7m#d`mKS;}GM-dLa7EG+%! zgkHNIt8cFT5|x+^pXM8WD;5>MPTi9S23f2AP4ZA`UnsRD*uH0A>NS@m=!tovzX3qD-q}$K;h)( zQQ6wWA_TgVo5NXrU2ZPUp1^Neb}GL!v&Ry5AX^Sxo;`ArW&%7TJCxtbY%#H40M*bg zwq?20iC&virB2!NeVHOc>O?0uJ%3b2*x&Mzn15~&0bylvJF&(3rsI5+DRJg}%tZSZ z^NpP$#0bgp9)8S#Fkpg$QJOsxlj;=ShdOXdbvxKqTe*nCp$@0wzU`KWiJJ}R*r~!9!B8Pfkeo^6cpazp>dcak1$~-9pGAXnRmc(Ak zH=4S-n=?!fM_4TK+qktZ6?!A~Ekc8dFHg^liCql4sA$Q+s;!yzvg}j!r393>m6IxB z)qYmBl_SgPZQ&ls3Z^gE%6ElR%lB^fO{dg7vWhm>_$f`GIy>}6on2oV64rZ=TsaK~ z2>dwPL@@D@zs_DhQcCKP+n8Mr2d}PpYkV&E;XO!gc1P0DilT7!K5NxA6v?rNl&Bbt zj9shG$mnbNw@0eCEdC@?-AzTiv)ARHhd5A6>>FgQ{2A3rb?CO=me_ZsweoueSR1w^ z_sw3hBz@M4nB=xrt{^PAZ@Se~N9_~KclhErW~u?h$z1v3!@|jZ;~p;uC2Z9q;P<@p zmC%FU6|U}#RiJp>yMu(2?e-1^1f(D4Y_6N=o1$ht#o%z`i(1}S(IDD)ht>2vUu)^1 z=Yw6H{$T3)$N5HPJ+y!JY5eXh?2oTY2|fKW>Ja^LxK_XH;OZZ`=3;;Cpqk6T%~?(D z)!M+-d+Pn~1vdvOWI*Q%dBdPK1!3!EcF|o@f2-*P7&n_k>nEnRbnFQ@n;hmV%2tOS zN$$qiS76xc&>xI?7~HR2+?dwu!jg_+bbpR1ua>d&KpSfsyMf)AiB!woTG<_={yiL? z81B1ygeSn>CJ8d1G1G+EQ_X;g*9iaiaCOIGT*K~;TD7~gr^s?*Q}B!81Mo;ThZj9PPcMXEoG9g9XAg<)VJZzW`8hOi7+ZLsP(QJ*+7 zJzHLYVngfwXvb&R&9!B$lRfm>=`v`v*IX1IKb`#Lf3{4_s*75H_jZa(ZjaMslCkTndcYb^M!!&9H));7~NBlEI zIBp!Z641@0Y7QEXzagMIZylfo@|S27JHq!rFig>uRe9$wpp`M1|AeyOz6JCFxLCggGOheIkjd{zhy#;0 z3}j@X#EGJDC?b-jCWUCdn_L=zZXc&Tw6{Gg|2Bfe!N8LHluM8yEcto?yzGxKgN@g&*uaOv> zX@`+^!Aw#dzlyHn)+daTBV-&j?_&Et7kEeA5I6$*@>5B#(<(5XXX*u#VQ1q`6W=)zGYMk zBj?LZqBHplR~cK{;(QU2(M-7sE*7mzUq;@RKq_k~l`ri;@zR1pW%J0x(?GZQT-~YW zVWW0+%ODW>UL@Q2YOx<7(eGs12_~a*?XlA2yZ%t>nP5kDNHF;if6GwGTugU?F+*$} zuETn72Nv<~ZVwhSaB;F}q4My9F=oCCbn^ybHNH6b7Yn_BrcT812m zUnc1(!LFzL?6Q~Jp&Mf-g_8%0t)wu>sc)=H@0Yy@E4$|B_1tnPd5^Z5*cs$f5MtLH=yw z(vv`bd&xAA&$YG%+usg=9R*74wnD`(kUQrOwV?r0hjMFWnhuKkcSh37{Grvw5FYjZ zSD?ed+Wh~}_9k#r6;}gq_e{?M4BP>Uj)K|4W}q9p0VAj}K}|%&xCXlg zj6e_Fja=J7T(gx6IQ&p$VsR~4gF)#Zt7_O*-`lfbowl$wiQ^uTA)AQyq*mBo{K6aRWiwGYJ zAdeYKaV~+0y6h|hC>~@t&;6$q*5Vp;cJ^UgH^cg<6|RG|AJ0a2d(%j>n&_Fp! z^^j#cOuZrx1Gjy~xmYHE1>^pSJ}XpupUlB)~z1OP)>kJM1{1 zc4whnVwpYV%LK8iYd8R{SWi$|VcIa0+-?h|0lF=4ek*A*Uxckpnjsyr*|~sKpd&IR zq%+}hI)ak+;SyU(cWM}eW3RAuGc%QO{26Ie-uMQ*mS;Pm^~QW;NCrodUVp{5u585n>EI2dYPPMQ8p>gSQ5}5F17jcimo`uoSGv~RF&Nw0ECVEXy(nW z?3ZU)S60-*feZWk=VGx;YZ#juR`z$`KOJjb*}rmzmE1TZV$I(q+|kNTfcVF*3sr`j z?584a?^j2RXB>Hur-)jE$ewPJHCC2|5%=p%)|@0_;avMvnHJ@x2}v3XqWEH(@~&wr z_mn2oHBEK5G*bU~Wv%&SMc1S~yCpSgD!Zns*;AUTu4(#oPh%z5OJ{B9nymI~_EtYB zu3K+y=+;~PyMK}%-O#PK_T5vOZoO5vr!?KV>3}_@>DEmH_mrkvHyu<=ll`g8^9D%4 z?7K>cC@c5l?A0rSZf_|mJX}IbUK%ALKTU-5$>=94Zd?d6l-&@^A!Tl;C6 zuk5Y;HI0(eUcNOz(|lz&9jIyc*iBO~;U=VVaM+0fM(bZ-(ZtGOLq~g^mA!zqS`6+O zPKPVZ?XloSVRm7d8o#}V>+d%j^!LEY`g`aF`g`wpe@|J;Z=tU_=gG8H$LnF& zy;#XU9dFGK^_kIRUAZ1wWVD*B`A-S^OIE-k`-C+nV$J%vTH-foeB1kmu9KD2zfUmy zNt1Qe`l%BC6!B{}G21D?M3(s_T>WvKq^mzY`?Dqm z`#%T@U=RE^{_ChR4!r<^o`7p0gs7{x?HyLxZH4#5sA}Z4~=z19@RPf zfo4HRv~m9UFY1e;7&a@99kHP!{R?u2qAI0DDI#hcfvwQb7aQh~1Cdc7bJdregm2DV+ z*NkkbX7Z`V{Isi_cgc<#>YU+`&sU43t<+2b!Xh_4O_bi4%MEQ_zSG&7-7xo`YSX~@ zGECSnHQBG5S~b~UB_?)ZZlTjBm@#qLXtqF81rSe_^=d@Pir^sgfe9kVOpVgS$ z{5+bUHdB}iPX(&5?m0(XaN7LjIw?d7`T}~uT{8ww%)p{p^P+3|7F!0C@>U}Mg9fad z0v251(v_sakoj9tbqn-@80nm2EPRTS-DCLG0LvIC|lb>pD=dzsUupgq2>s~8fs278m*z` zgoEFfRw=r9jU0uPUW={v1#a^hZDSiFKv$qzZN`OHPP7e^uA6yzG7@l;v~8%EB8C1< zK2O0$YDR@}SF)3G@*j70&f>FTCovTGHDA7$J`Dvb4Ct1@Qc41ju4g~;TK&ap!EFYbMTM|H$vK98qYY^KAQKBDC-k8}UnF%^ zRg+6k$EcQlA4qfj6-Y}Kw;c+73?yn9ysKxkqL6H>6#AzRb@2kp+fum z&^+p^^}7v7>-R9w%ceyy0%;AR93Z%-Z9tcs7F`FVHUs|w^fc`Y1txIdp}lb)kd|@_ z&{ZbKy+HbnWkA{oPXpaGK=KxVt}*F?aHzQkngFEZHWlb}bEbF&&<{-PW}vGL^g58L z@D+fx&d0Go(;W3c`n8Ebn)io57n{6ufi$l7(9t^1M8RkRB`;hD}HFmrYo#8{@@u7=+=t>`&>qE8=X%C#qdvnoR zEMHf~emp4lp~QN6e=!m@I2Z_|=LScm`iy85qiKSZvto7HgWFqkFlB5EweT@q<8n6by%bQ0zL)OtDodbV-`Lw#bA_d=UEs(iCK4lYGocGgpe}o6Ts(^H*4p}8$&&=HXTd1W_BJtyPxg(2XU|cvDl{vxzkq5x!ryz z%XBydNXP{~2 z9b>Jm2{yMiTq_i}1IcWubQxZ!+uo=UB`6c$7~DW)S#owUqO2sMJb7L*qP!#`lx!+S zgi0bRl1CLIDoP?Mll$;tMsH%}cxz=S7zuKH-xjggW2)uS_;0IXZQBMlUD`UfaTp5( zEC(9N*Q_@OIigU(*^fCjZvmzdadXUptlT^Ev%0DJh13M(6VLOd`@+EZIH?y++&T>Y zk4l}%sK*aN173ZcAh5qGE>8Z&wNQN6=0s55vZs0%4oz^OEqB_RlibQJ^IW%}t=1ny z0?Yc19o4^QstT!-!Om8>r0W~0wGC!Qdt@^B_U8MEmj8$v&aLV;fkklZOWFBFCUeVq zGaul^Q6P0j{-((+HKw4k=!T3%H)JfjA-r~6@)PojDI9*tDPWo(`LBJ^UHla!%SAO- zbEHrtV4TnI{qNMe(d?zPamrg$sP4{W&uhu>C^ZdxASQ{g{+h zmKx<1z;n)S1=P8`f>jBddHz);PqS^YL>OLYo_7b*zs@ow3*1#i+VhY8(1UMw#?hSxwceKTOd>n0a!i@G$W1sH^ zQTV!k+&dtLOI8_EOw6$!pG4c<4=1ZkG3v)1zdC)yiUHnOQ9#FQrroqdUTZY{n`>LX z%{7VJo1%Q@*+D&sTB<#mp+KQQ((2=Y)Ec_h_(y#%UJfS7T)7;n8zynE6sLSle3`)eh`x9%S zTrk9%zfdzMVgrx_$+}=kiu*`mkYy#v-+9RL66EhaWT*uB2M<|Mg8ZY0tSmwP$wO9^ zAceogGOMe-dRvPcMevXDXJSkLI$Xk7xw}Z?$P`Yr^e>Nfu8MVH5(oTZ!HcH6!DBjv zg35?V&2kDvx!7{B<%0dLc}nVHLtsOK9p{L|;$kbnRtR>u@wV$?E5TL@_5kPBV%jRO zJTc>Hbw0>A7i^!uKB5CdIG(u`an#(|o;(xlI^26Cw`aaU{WuX^9S^<|?L;m5?4TGF zZ7uBMs^2DB&go3luS(ckk^@=124c>JY?x;u-&?U^JMg2!eR83k-)Q|y)-A2_y6U#J z>b7JL1Qj(J{2&H^HYY!cwoKsOLRVJ%)576KU5cv=`{@S!#?jZKtE^=M#*7+Wo?I8} zd|LXn{?l2Hu>g)@tCqxTddG~VZqk8OV@W?^%&37?sTTmRI}UO_FDU6)RC&1i4;Iz> zSFP+^#w^amvO74h*cq-c3sTrMvbvyyl8B1gc)$5ikR82Bcl&MCq(lZ zc{f*JvpY7NPq(uF%524TMBconvlClY-b0B9(I<7Rn=g47`NYZ+yk?uZg%-2d9%ie# zp(cuBAbQHo<|l(g_)2eFu*XlH$C*kTW-=k4{LfZ&B=ZR#%&_%@Qrrh%EWg=7q;L-B zPbnJ^UGl%i^M`SeLT`nRl7#EYD308-LTj<+|LAlSt8XM}JSr$@mU(Gp@)&fPp#S2b zWl9=!xu75R&@B3j4hdT1ZS$e~J#>YjrAUMRt%t4@wB$ADyF7H2pzra}cLKyRYpcC> z7{6Vox6~XZ9L~U$yt(3i-ilF_pRl)WcX~loNA7e`&Tng;+m?9xBV*7ZK|ki9AN0@_f?n>Sg)N%Ym3uC` zO3+9Rp_4VG&sJOcOQQ>uev zEUSlg_siD8e$1C>^G=;S_ec)n%Zl;8q}qZiFQP=`6jZ2)60#LkMG>{cMO7A2wu`DN zqOvZkx&$RP;x<6alZsl4&Xm>bZ2rKBGk=ZlBYASK@Yh)^X*)R>+mM>-yeEu_=^>%< z&MO*1%HEKwcb?V|rmZ%lj&z>T5az5l;Ee6h8mcT2JBYxkIe5`px1TBu5b7?8=NV$O zlgo-EN!ZauSyqZxzc3|@ik)Qft+%l@iJh_Fdenx=f@mDVV%d&x@?HM+NNz=x_ZpV{ z9~u_R{0A!o!kx?+_^$z2N5mUp@>=suC~DXd?Vyzbb;uYwY zPo?_Ho2KKe+>c2llQzTxIhmFwr*iaxrRj~SrwbFL^wb-yyen;CwE7-lf z)ahNy;t98w^*jdvH85#bZWZS z@!A7D)p+&m&5J+Cp`?CaK~I+|;Z$0=e*>BB`V_z)N$GYoWyj)1QzP7ozs8H<&2Xz1 zVpZbFqb-1I^_*>QR$1vP4>2g>yDBWp+3g0(lyo2dva&W!m%dWf`GM@&o>U7cTsS^YS#H$C{0Ti0 zE%Vuj9V(wL4DBMn2v!TO8dAHB`P!X)z6lq?48DyBB+Q0?q zwc+|Vd~8Raf_cs?=Ozr1x>G8z$ES8x{0Ano)nze^r7*lnCkH?NU#?lQl| z2;yX!RU-8sU?AC_9B7~?fOPiBBkL0k9bE||LNh0eKw}N=4xn)c+62^Kpm%`u7EoTg zt8TubyyE$)AuchvZ#1-pqLK&ZqhWhu*s2X!wNcKbC(4^e!xxMjEuk;>tW)knwB}l> zSWk}TZ6%-LQC(Yv;}1$uGs&&V0SRnQd1jJNG5pRmcl@eqZg;hg+^*J^ z@4e(qfIVAB=A>EUNlJ|)$Le>Aapad`_1lxbjs{;c1m?@va(sv;hG%Q6n{{M4 ziRgAtqF%T>3&}5=i%h)&z)A(Dspr+jT52j~Yf=BoHG_O@7ju4I$uWE_MFy5n=Z|@G z&nZ6o5u1~PQI0B=`!U&-2ySp+^KIcZ-d{P---Pi!5B9FO-Fg z`Pa(%QnPVEZ!OzsOu1T(tD^avL9H2&d_X}dV7*KR;Qlg zP)YY0_)_yW9IY|CHezEh`~p4}K3OKy(Q%=WL6C<<*B6$P2?@SW!i5 zXM^cCmeK{Td4g1>xYNMGSIGI_w!gt@$His z!)snF2Wd=a#E5Y-Gm9@{u`P>ccq5bSM^;Yc#TprPz*|?L%#2op%rf&4EqcK{g+~sj zh<&Q1iI)OBVt9izQSL250iPrIc5Bq6j_Y$sg%x{Ki=oqs+LvwW_uG$9)m3} z#{}TjScuj}jDkB3^XT#$@=c*rI*FT|9^KzsCA)FFx!78^cs=U~Z)cM;9_*zpu1;1x*b~e( zQE8r1M+SfIfZ$Lg;H@CTCpO{Zi_VLa$=ce|WH`Tk2j+{XN}euSM@33U#dz zV_vysT&G-@U2j1~xP4pPmmgQ*s`w6GF6U+c$$+efBFqV#DD%kLMck4&q{Ak}y8y$v zukjuH5?P!aoobGDSA>ClPNQn+!hXC1?y7{npf=JzzD`Cop1-$_FUh`WII0Wz#v#>M z))iDN9~#1U;m0m z6K)?b0;*4~9Jc2Qa+EQpVlUnBCaJ$xH%#ZDT(~hwRj)_e&P2 z|Ks<6PYJkRH5W&bCs{6-q&r}>U3bA+!{rc#%jE1uGOcATz}7*Vnfvs%;9xylAh39T z$^F7_iweWp@o)g>FPdK>>D+?aO+hj$g+&mhF&a()Zmfbd`}YSVtdff>C=?DWF33o> zvA#uqAUa~M&-Uci7))kuPJTq19;N(14j1J8djEYmT_{UEFN!$(ci{)M9zW^A~!b0SVf9NU$&> zlKD@s>qg-PA@iU9)-7#qZ&)Q6daUo7H3Pc zpLAmh{WBnH?NBbLtBkorIXaqBkL|DX)zl~!FW3RRZcL5#P2R+Xw^+XADd}oIGr$1J zYh^EI6?1+hf|V@3rn`i1{00B@&OqwsE&wIGKbC1NFsD7-|m%egq^+%Q!v(QiDw*VXQw;aQ_5SmDUPIQ5>v? z0zUv>EYb_K)T)iGi>b&q$M0c0cqZyK6D)1tp;Hv6qp92U%LuOzqS%cbM#_$ zQ)r+MiOaH?9Lt3Q(}6VaY#=wUpYC-(_Md+2sdSN+ceW3Si!m)lY+#AIuTbD&AaMZ} z3Owbf+X#|kwYZ531~4aClnAVZVvxKfnV`= zuE}v9P$NAY3cLuU-*^p3zaeH0w7qRW1=HjI0$OPD{u@ZYb`*W0?Kl}odt*M3w)b`* z9k<{3xQ~FeejPwszp9>I{krWP^uVH{`4{YLka-6)Mwwj|*7XMfu#rIM|I%)uWLcU4 zVR!CLGx%GI_=&0C3clRn z^F{pl)Qy4<8GN>g=T<_lz9g;!9}~!3IIz^~twL>a?S=Km>}N^U$%;C<3gDu^_)(+j z%YDi194$qRcsoH7$z4XUfD?HTe=~@WW#MZx2rYlBARYt}v;SjKJTHh}Au)_(h+K&w ze@C>qk=sU{8LLGS?|h$L%j^=b58^y|3ZYUlLQWOE0d)^Vjx?fENqf4QwKli;IwW1p zT7PM8(U+F@@5Q#D-=6jsn6=iug)wXWRCih8DKeYAg_I(Di++2MB{1ab$r46_D(R2R z%Jo8Sb4DU^>85W(65FPFn|e_!xU+C^w7s3aXOSuGM>pSGl*G?Qm@qOyp${y(q?Yj2iI#|0UboDt)#}}4SNYIv9}>+R%_~=R$`qahT5QUD0Z89lpf?}L8(c3S{f0=Fnxooh%`#t?m~=-2 z-DaQ@fwYv%fo?XqSw7A%l+x4Bc>bZ~urINP(ZROwq3v`FDsep1du#`wdJ;f4OjO{F z(PC7|V)&5B+w#oc?XGsyOJ*;$l13!**WXV|6ZO|W$WOA4LoYFM!hXp+db4u(5Kdn# z-q0sSMdbDD0kw~h62r)3T4jJ3zY9GZn$grbqHAGpA*ZC`z-l{lN~!@^?Pg9+osgar z3Z#yqTq8;s%cYf4?xe2n)W_EfI%aR9k|Q=p9;27FRU+5?+~lylc|6J8!bu@M&bK=_ zDeU8h`jBsTaFTC#a8iRG8+9RXx2(iA-^eIxV~Z1~E9qDK6DbEE$|Lc@SyWjEAb+cj zAtHQ=XO>g_J&a5|&!;tIgzO!KL%4%99jnvFWT%gNbY#TSV?)X+P8K~wcDFIEASvT< z6rIgM^oHb%X%^8G?geFR(cuUMGp$czDPwle$9g~ocsHN*(1_O0&0TAt0mN;sjV+O-iL1Xp`ZECAAt0J=5e5(nK{-Dq_>4~qchF$3OSU}be{of$ugsV zXoRv_pyQdD_^<)`-(dos4D`y$0*PARV=UxwV z(_ralIcioL{J#a#A(BhHy9Y?@S|F9|p7Ucx4!_sLeg^b_f#^(kV2Z@qMRsfcU@?ik zVX}s$wsUy4MeH2qA6g2npdD;X&D}&nu5vCtjw%3Q&pOjr$ZUm!RUgCk=$XBVDd`?6 zSlLsgjC@!Qq~uyxwXa0DP>qt5T%27dK2|u;Tn;*teg~25Ka)~Vm?2&6M2Wa_#RXp>waqLt*TFp;+wBN5%s@FFX*$;HZ!Y_DGY4kMya z<0@H<_>f~o8t@-i*}4bH*1XFSDb2C?Bg)ttM2Gq{=bwmS65K?PLjV!V)=Bsk6W%D{ zWgOnM^cG3i;2sy;ZwyY@nZeyJxFsVx;`zTez#Z|s8Sk+J>s?e&WI$Nzl#YzZ;^Byp zOdulKTLCuxGKh9+Ydrs#$;66K{LN^7q1=`=EDL^~mJ2f|HErcy0K#p(mak=|{($x@ zV#_{??B?^zMmVBN;8$XMPZ zwI+}3Xb6RphsN`hYt6HZICs^|*%dNP^<8A7bF%V|A&mIN+Up{no9ylMrH%%U&oJ+3W#8nJqDI~z zV;OurWj&*V>x-e97D+TEE3w zBwKin)m1uxfkv#pRk3yzRU#{=Q+Y@1R(n;+8RtEVz|dCNjTlxkl)^ zFs947D+KD>PFfud7}0gn8BnmHr)(RNgS+ir;A-L}s9 zEK$EbVU5{d*cYp0;aQk=-QioNU4_ZB7)Bdn_0J^_l($seo*E)F>`}zt7%vVIcB)nk z>sCisjJ@*8OE0--RCt2jKWsAEiRv-y8pGApaCQ`bw-lFSiePoV8@^*!xW4Dz>XNVEA`JO2O4#O zQlrKq_r&a~7aZAad??5JBH6F%aNH9&CFX53){q*9kw!- z%Pij4I-A9*HFdZni>1H!FYGo0>MLP*$-P7DOQZEc>crfSqq!vK%b~bEh8f$M92m1F z*A|e`C$l%`D^a!4_Ay2hFMv6t8Uq*Y5ux2cajzTgjMb5&+Uk21DlWsh^%k2H$q*-a z8@1L(4c6ILs_rUT?C_N=wwO+OS~er-RFo)LoM1ZWeCePP>WSL@hZj4lnl;#rdDPzR zyu!HceR3iWa3QhX8k*XU=&_hk7wsWB9HWvV(VvXLY}b2}^m}Tg5ScR%qG8UsM+Z9f zA%3Jc=?tCwg>xl?Nj{O}(R_Lv2jkKgdNIGOC}Mfin@K$AzmzRihj|FWe!{VLoS>@7 zoe89(=(#@bdpUuA``OPhB=9(QcTXSvU8(kke7!h!wKCpwCpKEYJo|NkrcmPRLRsJ zIUW5vw>A{dg{Y}hDq(VrrbR=|GB0*l!tP-XJBi_u$E5uapR$d=yvI%*$kZM>bQaHj z6YjoQAD&g1uk1-d4{e$T*~qAo13qkuVy~?021kIdQe?vZPYg#+6Y|#`y|uWNzC*9^ zHgn<4H06~lR!i5jNF+z{DD>#9$eGa~&ds9LKFik=C+WUtsdKDlQV<7)JSlvB)-RmD zf{~eN#j#B!-i?e?#N_|T=@{sbtYv{AyGM^oy*r|n;A%&XIuVm=g5CvT@?9@aI-c(- z;*KZ_n0q8q7TCi*(jkb)0}mcIs{i2B8csQ<$Wz(xn0qADG`Ga;*W_*CmgG;P!7t1$ z5=%TKnk%S7xOb9Uq`_8pwn*OD_C>O*;(ts-!#xfG`12qk^P_!eqz{etp|gN~MPjwc ztWcYelMR&Oj-h0Gu%tT;NVj2f3aZoV2B3Qko4D1-{Q^i?(L+Ew)#d8r;XzVL0Z1ov zm(7>wUlU&zjTmz^9*{elb0khDxwZH1$guZouW=4zqTAE{9c?ilk4r9u&h}3g!~^MKTaCrYrY((~L65_S*hRm?P=c%-OU`&#;2ORS^B zxP7@~6(s|iuD4;Nb64ig-D1`Mb~G?jr^WMEi42C83ayB@$Z&LdF`1AD;TU#*-6elpD#FdIMvw9Oub#M`;Dc^GeqW$}`urlnsS6pv2<&PaJDf?w<4`9hlI{E$CV!#>3tt}rX3TSM{g+r5S; zHox|j^=tcb{d#)`<9(7#rG8w(qHD9K^KjYjI@j^X9;uv`1d)fR>5-+0A4R+41RLze!+7N@OE;6o3<%+o8UMC zkXKone{3o(IClPTCogqzI1HOf_XxgHB%+pY$fmz=mPc!oK`c7E>rt=&7(QO>Fv1XXds*7KQuiZk{Ri zvT|~}x?J|+gBQt*5ERWoMDzQINSY|^KT$GEvIrUWo%*;i+#Od&)O!jmgZfvI=}$AV zvv>Q!=}T>37VbY5RLAqP*&dDGkKNI14#~_(w3S5+HycEerv33M5&q-#pWx@=6K5dl z44qu;7SuSToRY5LNVm9CWTS}EkSw8r$m7%bYuxjCr``w3MpXTL6gQ)8`Gx*w^QB%Q zR))!nmk3m~s$}OSTZ^tcuQ!E`?5emu+ibkbW{hbMg?slTeU#0GY`DrWqatP@a2kqK zIbwq-%>A@2VMRZ{hiKgXlNgV%O$u|FCy#xFnFUtJisJ9_l2MN%*&IDK)V4R&(GQGK zFLR0@8_VPCfl66wBT|Cy6Dqv)E95k2dpLZf%n@0`k4#E^Dg6)cPV|ND5m5Wb0q zfT-xQ=xa41_P-rb(~&dP)zpHu-!4a#qB1gg0o03!%b%gfX95U%=3|aTRcpXA7VSKv z^`^>VRxrDXAR8cRXDv)X(S>`B8bOVua!(<2v4|KO;f9f;WZ`@PljPc17wpkMs=pv>i>AAg&b`;j*FOVN zR|cDb9x%99fHd7!ANQUQ{nLm30xQ%UojxQw4T=-}g;x%jnqCQ{bt!s9J%{enoxmy} zz1e>b=n+$c{a{%tsvHBPdKfVucN5TSjAkg%2J{D$Lv)b;Y@io_xIQ7aoWJ^w1Arbj zv2h?R`AfTq%m=CtZNy+`$;!&Miw!_DGdIj~A&==A7cUYEThaUh(fqYMXE2Jh!qXUK zk1w%WUu|ye?q@XOEz81W5Qb^b>#}fo$0KIf&`eS}C&^zxp$&DhVQX|f;ITv%?}fwo zl!0ly$Nt(g>5vFsT$c#G6A!)>ANF4A;lf2}qpTH1{@)?;f7t8|u;79zj@>c$J`1t` z2b?DCh+^2o{#*>dqh*;phdF|2kIB*ek_PIkSB@tyi2~0$xnt2e{039U$>XJ=B9NiK z(-epX7hM2eK7xvO=}z3CDS_o@@TYss>MY2|`4MO-`BO9Y5K4g+AznHt|nPKb3hZsH&Llrh}!bqc7r~hBjk&2|rj?E=ev1RrL7{^-Pzru6A8k@p|6q zPKOu5ZL0aKUbB!R^^S8ASu$_zRy|FnowC&a<{8dia{1TU`8r2qCC_kHE~g@$saYM1 zWan3#x+KzZy(A2$&R2@-l{zbyzh1_wBQ19;q13qa%AYWoE0U+g?U%nkH9|i|IPts9 z{g9RYgWuPu{Fq8u*(dngDRRYZJ!J?u?P!(l zq?kU!voC35`9(hwq8B1NL-OXU^D(?b^G^CM&fkqsfqH{C8;jKI&XI(4=bQZ-Iiazt z`(MX#bsu1zD}Sn!dQIJyUMWO~_$?}kd2_@dRGXb)F{C^A!V-Y5-`#phK~YqaM_B&o z>rxXeQsFwYD)twnzq0Pg1_QgC?zDn2~%%gwC#R znScjB!uy!;q#o%u_-NjFm-NDIZN{%!sw%xiCSM3u!k(#9zWxxS4Mb(`52t!$)`x8q(33c=Re78%_|6n38WA8LGHg^-bycQk)r4`G& zDDBEnT?e}!CsJujnXzFI$x{q-NX_Om;wLtk{AS_OJuXCWN1tW~Q7`92t=w&rD|OQU z+luLD%TxO`uM|QMPL=ExX}?}7L$js%@`ZA(bE+<~T=<&Sy$|Um(xkInl}86tds|xe zr8sYCIiHbmuI3MXH`2UA906N5Ho>YGng%xOV#dtM%3q)8_9dOrTB^54ecArRgH=xJ z^e_SCwQp+9nNTfc@H$b>^Pn<2Mp(ID5K1qoJjTl13B&=#>?$sFIHetKEUBy5DZLN2st=u>)Q`S9)JY1C6+0bU@45wdT z;@FX`Eyci{Lll?U`ULO9Yy(5tcfqR6!th5qpX5p|bFE~1k0~bGf-Vd7R%eMx^h={b zA*TH{$a>s~m{|KT1jbWTP;>%m^Vd#PJqS1hsi0H{kP_!C2J`$&P zk@SM{qpjREZj5L)U?JsVHz?W-m_-o{G0A5%9IRZ-4T_cn22e)1LD6(TPvuBA*n=S7 z94Nu`f}YsV>I=xjFVW~=Ka#47bl+yeq-c3RfLvw-r8 zL^mqgM2!JdPu zRAwp3C#eJZZ(F&kf=Dl@pivXtxJp$4qbprRl|fM4P!~~c5cJS~E~1BrsB{rM4T3KH zjQKAg>}3#)&)Y7d#vtfcan&a&dK(0@ZIz4YV-S4yAs1m81fRW25a|WAbkgmB)-toP z!fuz99mD!ycBU_ih}p47L8M z)rn@TtF2pG-GQEhu$0A6+~2i(4fA8PpLK&W+7ax8xj`Xr`ti?h(C`pC%?%21GcY&1 zK_PC6S}4Kvf-1UnHemD9!hvlw2^|}RZjhL5olF^5JhHNmsp-5xA1kv9(0P+cVdFK{ z!VzS0Yftea=z3(z$NRfMmupwJL8&;2J9NAa^MgcX32{mE?{17#ng&1X289ofqy28s zFhkn!2Hja{h=yq>vyzY8EV1bYy=d?vz*x(I8t2_&ozG_eftJQF=cWS|g&kgHNM_2C zMTnG5Zcv&-@S76UMd(O3M#g{&4|Ibv22)WIbAv8}5kC}Csx${y@R1vo=Fn$b-Jmpw zIk3qMN^_V+tK6V48OHuEZcvyElTMrhO3A`xsK)JXu#e_liMPnE(}XbCm5qt6-DFQlqEhj+kF#L5zwlB~Qakc8~{CSm_SZB3!bA91QK49i$j# zlD$12WC!UGLU?eFsZFpBp z|I8cVmXD|T_=ofeV4xxS-_O9hoH{tmq|EO9BO zlOHI#X`Q_zFI6g!p=A*D>k3WFRda7Hc^hYy21{Xx&CabATuYT}2_tIadqnJ?mS3 zc6zs@)#fnKX)q-gx#^79)87un;J0y;@w?athvDqsHFlJs6fDn=YCT!QM8nehR z+is^%Z)=rnO=D>B7LIOGXPE_!61}na7c|Z4EojN3S4_Pq!enhsyqgM6^67OLZ?JsTo(ki-}5${I9&ijJP z?C57LZ0F^$PA{{S&pt}n?dnqN0w6u|AkNPJAB$b5X2TDr7KY( zMl2v8o#ZFiql*S-hSb5l)8{--2Ctsfg8@);MAcD*U9=Jtwk!1}h)LLyTIX8;?)gE7 znd3p3MRcse%QkDbIdQs>urr%KZG~R=Q>M@RaH>(g#ma2}>9-NS)uoM66^3w9AIyk^ zxn=HydtTi5S_|csZF=VsNzQkoxEaHRS?X==xg+_eb<@>SYSEB^Bj1;`u#dHHH{Vz; zV!5~D{t$$_(jyDMPRQ_SU1~PEL0KBvy|uYPSN?ujg6Rbzq|f`@7+D$b&i0h^F?k%%%3-?eVg zmCP=cpo%gVxG^HiFp_7uK^d>JtlStkDC32|Ay1gdC*tH#z(mVrO^jr1+D!To};9$g}~FlYF-`Med>2~d1Ll%c*~t?tO$v zK6yYae}|OlZG?@&`cH|I>3=i7zQ~@H(!RuOt`Kb3<2dTPFpbqlImVua#-c#|oJ4r62Xnj4hfMdp1*g1Rkh zb7NeY_hC0EGXW9uZa3)4ytlbQnGuMPIX5V?0?FNHvya`geDQS$g}?%5#WT?mm0k!W_lMF@9KsxtE(T4x4x#vdiRa0^wQy<-^3O`y!T2N;BNnqe6KaK0vS4^SGlQOM$ zMlj_R<~}WAjr}*5{I!NJY);NMm;B!~Co~b9s6(fd>u8uKFYy+s+jZ)Y%qgscfx!F$ zjpk&>p9o~fzoFklYJG@m$tzO?qV9d;NFhYKZ5M^gwT^U5v3AlBD|ap(6?uYN6@Oml z#Q0X>=MRATI>N5^5$7cuEyPkG#L}pfw8FeLc2>(m-Tg+jWG(P`g|LXROly{f6bcg4 z@RajKrDy$z(UE?@)J?4XhtM(e9npSb6^!PFGP1aB$n zmq!2UZj7(+ed*9j>Cge%p_MD>%78OVBm*A){2wmnyKG7rG;cqUULx=2$`E`5 z2y3pkm%FsN^wVK%4yBW)cw>#?#0Zau|NC|*y+lN+GJh{u7U0BweYIZZ(0i@4D3I!> zcai(dE{XH$H-(;;yR|f01F#Y!p|y#Y-{1Hn{bVjVS5OvQs%nKyBWHpv`JHXnvIrWz z;pD&MhVCP8Kt%?QE$>Q4IQH9UEtL5i6TMaWZvm&OuBXrFlO7R4LYx_Yw{9a86cq~E z82$V`p`cj(ChMk6nw*da4gi zs9sSm=N|IuNq zuj?Ca{^Eiuz<>~{LQb?8N@r&4OK6|!+~%4J?DD{>b7Lzsvd@LV#J zW_Bz(kq@IB@CrA0;Fe1<&jL&3YTP>4tYE7da2{v22)efr^d>NTq4x^era8Zss1EPo zutm!9wpw}sSUfn~&sumn@xm)El5}!#$aL^3=vHHx_p)fD);t3d!MmL z!NE{$nxz>bJ2ZWbl(-y1&+LBlhplO zbiWnMbIg0W=zU!DJ}VfxfFp_^lDfZ(?!SVwU3Eky=x?~_Z>-=_GvK_>A3^WyqW4{4 z4mMtJ(fhgR{Z_~VbJG>$cK5oy0?5FM+9pR6p^DK&lS+ zEYMR&$N|~kfExK13VhDr5sZB(Fr3j;Bl8VFl}8Fr)bxI0(tQU=bsPTzw9=H)29!Ek z(rpDg#*}glwEL`ytq0P)cLAyH<#%ZGOD6V0AgzILC$V`I3j6~|YfuI+mP;C}NCCZI za)?7>%~8h`-XDe+3jC2tR&Hwg2$04uAm1w{#|=P=+W@rD;5Gqit?DR2)5*c6rn7jM|3Z%GQK>so6%6fV@xwr0N(*3QM_h#;Yf%MJXHXwa7x828`3#Xex zn?r#QnEodW5oj0C=cYFfWd15{2vFUT5_=qw>Yp|OX|G)YG{nRXVX_`i`$BEk{F8fs$8VN%-T{eiT- z7XoSC9{}md%<1G_k{gw9Xg9B(>!IV2#Qxjt0`6oZv&31D$HVaW~MPdr1ve0WAs%GyoQQovGCk zKz{@u3e*GDn{gAju@9RXTmrP*#a| z;}9UtF$3sLgS*1V{Rl|=c@dEI(9eLh*B$`6$<$y4kj{mzKm}9EHXto|*q}h*BvY3Y zf#lX4`*%QEm((FRK|fh=j{sSwPY)gJ&FSNTwC~UIanpd5>MjLRs!IcDO@9Y;xGAL- zsGK&30_%ZvzJ2be8#Dw9fhOH+hkE1j5zvVN$%i>;7WVxOc>|NQ&@yhM1?5Q7E*&*dpRD0ZhD>3ZzM9am&xP1}tc8tDt zJpZSWEDgL|JuQkix_JFI>-s*VXWwNmozybJq2@_Y7kdobu*a~ia8#)>E(g)!SqC87 zm)d4nTk_;aH1_itYIrs|*t|h`-`&v@%w>2I-HnZ|y(#;$zm=g0wkzAd^8SRODx>Sw#P_}XC zw=)`sPWTo!m)VILUDJCg$5B;ROp4z`Uz-6EIWU&lQDIcC@!Zgg*AkY*CPUlTW!IM;TWmFuB#jF5?| zNnaZ}7QIf&nXxo6?1Mz`pFEsEw&Sglr^T9Zx2S9sd=2{q1JPq02A+x<_Ga_MW2qjo zVb8>Z&qaf{i^AP2B^yJmH}TkKL@PV&qjkfa*&0mouxyERuMVR*WK(KwUnB!4|EcEp zh*oo%EALRS_tnM%z!6UsA(sl}b~yVv$uYYp1r|?(tgJ|q=DdodEQU$1XM`6l60b}R z>Nb*!c>JKJT<}>-9w3{`6Rah766nGg++w)+v)h$5>?mC8Pl=T}C29_byyEpcXjdDXgG*NvJCqvM(Plgz=>7S7k}z*By-}3yjiRh5Q`yaO zbFJ5PJ!T&-Y4l>eA$6F#LEti0Y@GNT1wHXF*JO@7(d-^kO(UI2MDWTzJd5{&I|oIc z3`@(cu{-&s&|a**J;^C*sV$N;DVXa%6If|FG`KS!e6P#=cNwA~=5-;tC`B7P7ALC>%V9!49fp1yQv3VFQjIRE zp^hS9_zSRe5`E)-IN$VvXioh>4$EHTk5?Zk5R)bT;{xM!!6RuacQu3sSz9@wu%c>6 zgpf@WbW?W%U8P&n?*ZwSbS;o>9Q)E)rx~$D?CL2r$%iiWp`QaiVg$u6fK&v%mCjUQ z;2t0q2E_P?3IlHeX}V)r&r~cBpC^iY6KJ&g?)yM0Onm`VZ*b)m9`2h!Zta1z_74GR z?VkbC@=jwTsF2OH4W*tVTtkDbAjco~~BQ2pZ{4}=IjEOY24M&k-L~Enn z!}Iwr&ZnoSVbQR850?yKhgG(5iq^u9Sqjlr`lUsJHonl z7^|HlNU4ui&jwNo`vFj!*)+*KQk<-!id*mF3O=sVpIdW*)|r`Ns7Z%;qzvMeYH7lwfDph-&X&)~{gyeO+ zkn=?L5oTs#!X(PeN4Hx zts+mtZIwr?Ck-{07BJr(!y)v7m1k}n$F6H+M;gyxiurNuPQE7v<_DX?6Ew;zoRT?B z-&tv0e-c>ETKf-it$K~IR`xGzUe$0dpEJ54zv9CYdsC$CjSA9D84@%p8iP*}&D*?m zx9GBx=qC&|DrBR`hsEXvVrBM|nQI*O5ZEsd!2?KYlC_{wKWvqrJ@lG!y6DUC<7BX`WqOZC0>Mf;k%~jKb>h{A^ zBwA)UP?7X#4vFVmkB*&Ozi=st)GWRc&tEMjZPauXJ6|rH-iF4c45;ApjgX5WEf_jh zo95v~&-nF2?za{lN5dfDtxC1s2sQHLbczrWC}F?Lo9HdhG(${UTnzgWUFQ$;L+4M2 zJAdBy%vPHDvt8zoTi5Iq7U8|m#1=||lI6$%wE!w$);ISxGSbtSb)lhB7B)3Iq{UYD zXVTcc&g>7on(cjNi)83Fvv8(2eA0c+O!~+mOz2$GV^iVyNWS-*ayJ!E07~2)ChB)^ zg0RE+327h(M%au3tudp3p-EKHR>{7Jk6eSp&aWH=N2F!6<+jW9Yjy|YfVWY0#IAeA zjbcGkzqg$@`JVKejJ}N9JyOp-?^U+O>R(PCZmd9-?o~uH%IsCxdT{#^x2g2y8xt*~ zjRVGhIAG)J#QN$Q_puV+9HP=X!)|-QV{-Mz2glycLg>)3Vn+Wj@sk# zhAo$y?jp%RDnUZJ9`J_CSp9A?{zndEG`dl($6m3(%4*o^S~@c?T74c{!ud;h?C+$P zN+0keg(=OM2mJ8s25D7_X*eX1yu#zE-4_xpmD{V06#$On45QXU=$a!-Xtdo}*c8(^ z*22g6vbPp@YmQFB!oG3)(KM;#Lisg1s~`pl;8|Wz@u@v@5IWQDC76+t)J@dPE?aE* zT;Kl>QkvA|w{j#Fc_K{x*a2@7wWHFLFPSo|tITF->2fIeOERlaj*(kS2*xwqD4hE| zN)W>@y^ZLud+uGuJvU4LztG3ont+s#<7Ti`c#{olo{HJJQmX!h8frD~T9KRDB!_>FwkZkalz>Bem5U!x|JwqA*2 zkEJ;WXvN$`AZlNqrV7rF$?5S7M%O#v;B2D_p7Fe>k8x~S?A;`85S3ZPS|$eRvEdDp zl;NQJ8o3a4t~U4XiLK6+4CC>9Lk0B7Kq`#S22z7|Ss)e5@AhL~1kyVNIVaF`2LNe0 zF`ws(`F^aNNXuOaE-PS)QwIqo$D3+1XFph+LNkH1yc>X2zLjU+Y>&I^MV?Xm_Ew)2igC-vm zSLup7$A>Ng(yi0qfwYz7)!x^{&8xZ(I2cGGRS2xrps-9Lk{_Y)8lj*vi_FjQX%00k`XNLxIVt z3B}DDf%XuxJyW~0J$~|n>RGQN_=N?*FV*I{XuPNfU~OpSV)^k@6iUu+)z%e!8?D7{ zk_85cIxV#l&yy)m@?SA%wH>4jte?kIkVNb92-zzf>d8c1Q}?7;^94^&5i=a7k!yx_ zSsdc_YLq*rrW~?KUAziqYcJT{YGOBSqU`-sqU7r8RKMx|bBw3c0{7W!@nUn#%*q~MdZ>?xdP)TD)`#tbP#85S91Xd~>=!8QW!cP>0f=qWa$bm% zLi#&~jr01g81#qPPs|_nMl3V0Hk5J_sHi6B`mN;HM;!Jo!@1w<9Fs*;;yUU_^nPbD z?mDoVlzL2X^n7PB=Hkvw-6J@0Ud5JA9bipK-7L6Jp@_X7K zj3v0CAV>vKYO0ZvY9B?yg%vp%BnH>3o%1-5<+*m62%(sx_dG|WyP^8x9Ill1lr zmGB9INH36Epwmpg3#y49ID`u(xJx6b^cP3XKFC_O8iiUK8LZ`tm?ycq7sER)M|TV7U&w)x%cvlpgY>_XCCRi2bRL3)9fCb}70LRaj`EFj`@HBTyKwu;D7` zw@Z36voOOTu*@v6gekDh(-Ey0AhU9pfJcED&u`#lx81)V}ppvwil%|qYgp+kb++T_tF- zAZSwC9=cl4DG$96G=}ShJhdUYlbBV`RO0D?SY}O`(;>|T?p$Mn@3}#uO!#F#TyDbc zemG>pkNV*X6TZ(6SDNsT{cx2DUr*RNI7_{#0v3j^J|dczS7pZFo~~o=${6d!V3Cy_ z&+K;^5H4pdO-1xwTJjkzyBhk6rrNLy8#M5w)FZ%UN_VLTfXfX$CH0H+TwG@T7~^`s z=aW^lS}=4X9pgT7`w?B@705G`%S_NM6te{1)vy+f(Sx{#wQwfgXbp$V$CzqIX}H3K z8+lKnVNBODNtrw~gwr_iR{wj>41&~(hisop*W_ADYW9X;mi5iN`Fdv8=~nh-A<hO14O zCu}hd_b_3~uP5xRrgrv5rwN$$)LIJ%E7aG@K1!6qMoF8bo zr#E8fYPgpPQ{Ds(*O)NfHA=(1O_=UFLc@JbnC~5+VatU1UQfd5xf~7T0zl4mjaDjV zbP7A5|r*u_AOe8?NDvrJN*bu?LKW$9p@q+uN_YI3-SeG1%9!#Y^33RN1`nq%+ab1qOR z&z~gkX;^CxF}y4ntaGbr^RpV`*ZBzz>tNBjf7Gx)SijJ)4itHc> zmuuJ`tZ5pqHG{|WPY_Pe?Mokx1#<4=k5QJFbuF?S#wt<>Vj}CCbAm+XBU~6B2wu?ts03S`!~R8f z`)TJWNsIN~Lhs^vWwdj(wX9s8Xt?GUs;=U>BBmftGaE@G!A zRXJ;kDqaN1+OAtoxlzb*CJ_oe2voxg9SXGju`d8EFtKm@v7h;|LAb+W6Wb3+^NP9L z>kLk$9aRjz5J*e;0g!I)f9T`n)u_fU@S#OMbPfZfu}ggDXFjwAXn*sy*MYR;cYT~3 z8))o6juP!KKL9cZ%U~~TG4hK0Ccm#{ROD$Na+{x>~P=70^LJDX{@MWDYV9i zHu{h__R!dEKJ+gi5?8?*D>lZp_D>-TX$|f~A?d9HmtU4s=4G|v6z&4>g3&YCx5_|U89W%-I459a&kFdHZ;j5J&6p< zX(YSl;bfOx^GLlBZjhi{7W3~M&@&~>?^PN-M}k}!_he>mGq8UvY<9HfPWT8S^vEd+ zq(=iHT5YB$+&1m$UU!V%>w2CqTjtkt(ON6lH79b>S{FzTmy1?pg>gi5y=Se{d)B>P zs7)s!85SZ ztM};`5q1w^s3>YTLFsh=%4DM3`KH`)lv$ac5#7y||IqWMt>%EwJzpBywIU^^ewY6w z>>gf3hpq8^5XSA60O)xBkBj+|G|z<;1? z1IgaeyeS+F(skh4$JI(4TiGwEy=Ge^lYQRs=rA6@%)!_5{06W3Jep&3*lFGPFf%=o zhgdnK;R&p4TVH_LMeSegpte!_)0n8lcDBYaks1|eWfzbkmY-Os&dMUl+#3u~HQy4m;KdS9|6>4a zMbnS_gt+~lvq(O!6^sQt6GU>HKGLU91_@7l<7#8}#No8CA!dJ0M&Y4o(oP9>V)Ftu z?9TNPm;8o{>YX~kMM0)Z^EsjD`-91YoEt){Nru3U3hR#u#!enL(z^bKK;7nssIe|S zOYrvYXmB?ZBsT2dvHV%X&24BEQfe&U2cl~bc5|emIXOu1l$j#j=gQE$hiK;vq!@p` za9b0z|7Hf+Py85*r3ysyyen?svjw^p{fuEBU_KgDqW(Q=(bFdG{iywjkTpJrf~U8f za4cs!UFd5}dh{{jkG#97#`%Vq#?PGte1Hb&Xzym=#KglQZ{W>X;F&3EL^4 zlmCQ#oFhOvHPbJ<$)fp3q)@q|+)OfoxoKqp61Ez;PH^p&ck%DX^QCMuj`hQaxIG19 zi1`-zKorXr!=rcs9BTIFtm|I=`HYN-j(R+A#?Q*W&ux?O@)F}6Inmbj;z1(vnDh)6 z#T&ixkG3>D9}TXH7}XYQS<}WLuZNx-y}#cQQ?_;e|3lon$46CN?c*~rK)6m&E>Tf} z21o>j2rA*`97y1d&PZrcv6YJThP@)rC|bqfB*N+Gcxg-3T3f7br57u;l_pp;0VLq1 z0{SYJD)G)ZUZ@uYwdDIeYn^lE9E@-Bd4GTW_-JOGy`R1Ieebo`UVHDWP|zY%rWfTDL&&fpMF!2y*%k>`ds>%y~Q!03kJ$--`2Jq35Sij(Z-I z+Q@!_BGzr6acE(>xpfUFb^E2~_G9$nBQRh`LbSKiun%E$($z%^C_R`t1sIj%mxJ1b z`5YlY&6jv-jjGZmuL}68_`U>+$0hNs0VtKKxPhiryGQi~M%|9|sAD~9v`1BX)D(~E zX!Gqip093rIdXc8TV3e9*c^WbPsc9Coutmw<#@?+Ya+XRCCbhni|AsXhaIq;@Prx3 zuj=55O#yuEV)sv27nF_XK!ARqz{v$&4Z2q6n2dP(D8@>IjHcUXP~c*-LKeENU?Cf5 zk$u%rv*X^V1oUmZ$$_UkgsEJxDt!Xo;lX(Omc*26ik3WqM+E>}R$^vn@~zpcaTmgu zpIykM*o+*J{RF=M;~OY^8}QDPw0X!IurLU|FG?d#?0G{r!bBh3^TumA5VEpo@omu( zKK}!Uv+=fQNjIK>Iw0DtjuXe0o1^yh1Q7bh;;EqSfO{nL9Z)|NDg{dSMSluv1zNhk z%B^niz)hRZd0un3K&hJw*XI?U=#Xtr=Sl+VRGm#DESn&}NI}z(_Ci$IQDFS?6h>AC z>K;kTI8Z&&N1WA?X}!UTejLShRQTxSlOEXpa&vk(6dJOm8)8=7)`lQgL$s~i1;Vr= z+hNJt{G}$-WQXA?|e$=)-RUUSVCaS10If{7|!l3*favpx1xPSLMMaL_W=)IF^So+ zEJ*un5x7eST^|iYz-a@$O7pFX%;oQ_foEYov}wOl7EWKJ?*k_6E3u%(iwAH^S|6uR zkX6~Iu*<>WBurrq{V;-7HrGwT;wB6-VSlf9OLut%Id0uh6wgc#rAm#)Pz*7!@bo5$ z+$Ct7Te^qQH=Y6oYpqfw0cl8FhFMQ3-fBU~^kBka z^RgXJN^z+ct*B{sUY7#7)^yA+(Nq%1L})#7tJ8b%i?<6w)&ah{tQ6BNOdaFSYu|V~ znOMm;-`SQY=)Hkf6&;P}nCMq1By^p=2q9=(*N%9xF7e7eb6{>N0=M2M`?|BsQ2r3+ zQ`OGszz~+!>g?}aMNDbxQZS}Sq`7z74;6ll!M>e*u>SM@5YHUf?VGYL(aMBk79D_M5vlKOdM4-y06c~HuP81~s_E6n)aYH65 zzK{td97c3C&T!kv4w5?uQlJ~{>@P%nsvGTCucc%mU2#z-qoc|w;^LdGFpeC;`m7GP zm<)2OL0v85Fn6~nWAf5htY(RCGu*BdU#_O&;s55#RZsI$eb4b&cS%Y&LLZu>x8 zFK(ZKnkR0oh8x7KFR1gxjq8PF;>OFPz9w#^pxVTZS57VvxACBE6gQq5T_|obP_KyF z98zPLdfHDa#b&M)wc2%p%Ya%g)a{^d66#N&GD7i~TD?#_K`>29V>_rjk%LI+O;Fc} z?*ULVB?WSDSK^(EUO^MONQn0jHVE!@P)mi%gNg}1o(y|Q+-gBxEL^y+ws;`2&SwdU{O5<1r zYGxTZUkyq*Q?IV#6|c~nCtMx}HCL$Zpp>5@EPb`0i{#9z*XiLo6G)s(A)3}gkl2>O zQEGCjMp;n|&GIXVji{^BCJ zTdDDMFv#(Qgs~;WX~lVF&XK$Nx@>v9pF3z;EtrWaA!*w)YbiNGYBr0_DQ3wM6s8xV zT0>y45gu46H)jscjn=g6mkdSH{SmYrAOq%w`Cj-NW(fOSByNc&E`ODa9qBSAoApR? zs9{@rhU*AM!zy>?A()XFYR;EI7zJRA)PzEi)r3ZWvN7N7A!OHBITV2s2#`dHgm%KD zq#8A7;LT5?H;$8V1C>`$>gHl|B=j*jA!+Ch!eKIj&Uj%a|n6KkBI?xFoPt;fM@ahlFEpwi) z+|5$pkx$NG?X`7x?=|*s38#A+`iH;k<=+ejUEt`oyzITXJjQfJ8`troD;9gC|RiB<)F$7u9B081^d0 z-mr7&H(>ZJ2ZY{yR-~stYf{(yD+6&FNSGDkYl2UXpNay(@E4QsgJu+T(ac5y| z){BbVE_#8nz>sc=vlL{k4-)5=V7=TQnbTH93#K1RoBIJMTc|&HzI#Dwi#!tZ0e4P) zYeQ%3984oRoWM%;OCo1$!%24ZAzWIB%&H@0j6-B_W$3isLk-Fzz zu-4cIC%SMoRU{jtHO2gds9a0!p|i5bi@mL_)TyB=X7br?9N&jd`qHI%2?V(*qzxbb zv@HiKO&dIzwi|zt`z|p!b!#uEO=N!%V^+&~A)rLdMa-+XS9Xy*tDw6r#f>Npb@1Mw zS&6^lG;WmGz;CAxbF{R@O5FXt0G~M8wG^4p^#Lsj_yqVk4r)<4joy-DXzLRcbuA}K zR@DP=s_kvj59*VK8&0SPE5m?=UZ=h)#@(?ravtlw(fN(UQ*lRSn7mYu? z>h5EjF}W|;i}n6XpwS)&)rn$P)uR&oHWmsrWX^$UYqt}ZUaEpcT3bBx8CJ_h=q8mr zb3AXV$I3Ys-)*lm$tJ0o#0+j=u;z2ih}-%yLyM;iuLoWZ~$ zKdMZQ;SPvsGS0I5y{|x+%O$GbOTXvobe)7E;L;gM>kZnQS}#M(p(O!!XX9WE&w)Gn z*uR3U9^>o>NV$_B>@Q$xnVy;_2Nw=5+B3Of)WCDHxfk&VZz@+}JIl|K%hDp&L>m6_ z%%c)@x&+%uLSbO+SD;fjI4KskbIJB5{Lzjly{^y%yF>|`VR|YNMCCeHVH|7%bQ!kp|C$MetC(8 z$2{crmRm0cm7^LtY3+(<+72bMrdhd@CfNyl&<-P7+zsu{Xaq5XEzsC%Y%zAhZ{7}A zYN}_O=ef_|O*fg1u*YnvjaO|?KVt0P6vnos-ERll>5rquVLW#YJq5SptG5?#soq|S z2K?xD$bLvCf3Qb{!8l|3Xek3)trq$)=YDL3*5SwLw|4hfblo!$L?)q6jAx(l4W_Q}%F~C^ zK=P0&-c3z&87{;1E|lJktI)wb9_T!a(4v-Jj!iIktaJt^x3=pCVCl+! z2HP_OzZV!5o!4fR;^EsaL8)JVk)7(310gufJR~%3D~}lwukx zL7tf?-5AW)Ky!}SAwSS_a(gPYA!9LBESB1|TJ`N0ZZq!ygWu!-7{<-T(fV`Ietg+* z?9gIx#g$6DLD^Gp;K38!(Pu#1{W3oktuF!2y5SN`D3jtCf2{ACaqF3QrWGdQ5cd|$ z&z}*uXYa*U*glHD<9)lCt_gm%U2}=y9@hcmc=*5Z@W)_LZni&}`exj|@j%=@ol>b7 z&ZYLm?fNoT5%X&)?_cDf@G_*+t{KRbUaTaYWE?znJmQp>E5&Dg`F}5Zo4Nh2nZO}L z9bcXC5Zor&H(au0qFdu*d_|?L^C(~WG%f@qDR34MNyx2Exs7^cL2?H{++5vcXo{k8vQawjbmqY)>#+-tB?jRPE^1txet#U=O7U z%ubko46jBi#++Gfc0aSkw2y#edY_SbBb>Bn)nc;&a^S$*;$v!ysAd&9`f)`fJzW`3lzLC2q!+ea)WYCKF~O zwVKXj1Ev~>rMU(qb~QT zdQiG}r!q^IN`pb^;wnKmN!4%&GJS>fiJ+A8#h{AB?R%aZ1s>(M8PovreF_w68foFC z@f)&4GGaUUp+;}KA|ithnX*Gh;fMWIls;AVkR&OZTlg1G(4 zbNf1Gs!`&01t`Tm14?r=w2!OaI3Coof*TJ?Oi3zi}K-&>Z(|A`h$eMn73`D#wTs;aan1!w@bM4eg=|5(%P4R&S0;E z!jfkSR7dG*J2H~1vBLN({zhx0Oq^SrvATg__U7QZd;?mVx#`nY(~Xf=qvB@V0c(&#`AZH$C2c%l1T^XiH&kc7i!U@U_bsz|y6;r;uh} zWB_}E+h3$qex|eA&eR~td(nEHThCmF#o>V5?ewSHN&ybcT!+ns8x8ws9Kdjow_y(} zQ_ulkm8Ggjt3Bny{`d%H57N-%Uu^kEPX98#P5*(62$M>TMS&Rjx6?iW>k* z``rXk-;=O^2KAQom=;ibg?buPPN+kmrVD4@UDs*bq#BOuxuku485-8SvLZa(+zmXU z^~3QOnnoN3Y>k}Jg_ zI)=Y1{>kTX%zf2kCUIc@=K{vcg7^ox1PbDha6myEUJO1vG3nd5oE1Pv`J>%C6^9)M z`psBZ8F$t3)VTSZsIyORwTK2Bow2Vk>&`Y84mL4o-rj1oek;GZVx;A{t_7)`%2A*1 z3orTk0o>gEvLyv3uoT7sbP)sJ*eicNKjyicwP#TdaFm{LdtMo)SSao}DOH-8<%C2dG1 z*b>0XG*z4&V-zR58(`8K-)W4#)nzeHV4&Pmj*e7V@-cJnK89Tr$sLVG$RYnD#=0>! zBZ?~6nCQ(XX-ZSQq{-!b2mrd^eY~O=52#@*k^Rpi)Q;QCz3Toh*NI+rb7(|W&xfPb z)_`16*O52_EI=u`=qLBehY^&@e622@t4H$W*r-q)+t6`*up{spM7 z%IJ1KC>`D21*Hn&gC6cURNN)Pk2=y%%b0={pftn|x&a#rjgEvuwZe}VOX_yrbWllg zi-Xb-9n9`}4Il3+kiCqAeJuvj?_&%-4@M|wVEnurIe}%0vo{y5xAE;WW?9HfILkC|6X!v!+Dzy#ezUH1PRh>`^YjoowL8apMBEQ|v!fmzBgT zT2fGU>b@W>9?r#n-dBo}*$9ruHkTqDiR?KM8q$@v*K%WGnHdi=SQs`6_>AZd+EUvx%Geuz-{XyYU}~*A7M_hp?h|ra}UU zHrxYeBpH7(;vd48X@TO(r^+2@AmtxsKyaM9F+bRwUsZ5W1qZauFr)DH_8|A1jDn13 z9+O6zJ{4A~LSb=HQJ}GDu?6v_kI8?HR)L@f=4+8$q!JsQ^hz0Sk|up2NjM>*CJM*m z%=SNVgstN-%-!(7MD&F{j~^i8oG>CGN-j#(q2kY%26qc6ZE*L1x>-8OI#4RWZv>?R z{BdZ!=SqkQP=_^9|LLeg+e8^8?Q5iYR_+#C3a5BdBmeiE*GDKX=EoJvFm*yF0jPP> zGFV)M@jRo~d&rj0De!t*`sEp*bQ^LOs0$=B^FXOAbTO#B;1+whYd~EnxCRfW{nFXU zE|oh~jBE_L;iBjYu6a%LO6RP7{Nl(>iSYL6?a;~plb1!?Q4r^~p-$Ax~HE)`I zCfGGoq)=|UQb7Iy#W?a367E-o3X@c?YI`}iacit_{tTlvj3GIcpNM2RF{b(??AqeQ zl-iOdLwWJWsJPvoJ^wh@`Kmz(1=f(sP>o{RNV8gJ4{ea{p+Vc_dSNrIaXcg0v3@>! zJ4!I#{oE34`ZS&6{EM%j;QWg}5_SHWkA#3S> zHe|5f#Wr&XTyVl+AvR`k1MqERE1OR%NJ9I+Vl{r_tt;3gLop%OfU3iY1K-&({u$3d zrTkMIZ=D@e*z8Hf#H~5yM(b>op#fM?r@ylo6TOgsYQdbYPN=19Xb80k25l?pjDHNc z7Qa9?^Bey_ZsqT7VUpWP;-6zb9=C4Yg)eY;U7Uq%1IghAt_SeL-i(LEDfHlBYdr0i zjTr4PG!b((Ev$0F)DjNe;Y!yy-NLeaX>t5w*ysH8$vcrpvCFaMmsn=0Y1NApIu|C9 zq&taJ`@}M}aKveZB2f)i_~$j8Fw-0JacVA)R|?h4QqHiV?^!($8%HaUK-CTPKsHv% zL_rOcx_uMWgP5fwatLH1GJ-?TaMOw6IZ!^!+~9P<`=}0YFt}Jy8VoClyRSW*wh|qf z5o%y&HIietX55wnat&PA3ZesN#_&H5WzNKD%$Yc2J5yQ-ex;R|*39zOnI_PHX6oc; z=3*ch;{RGOq7xek0!RZvfJLpDm2|~Fgkkdlu9=_s2XZTa(L6vFnnw@uv@&cStr@p< zv}W4y&BoE1aodL4H)YyBZ*R85j#0(CnBls1J2LHVlPZ;+jNXFjLST3j7o!z5EF z0M&b`W1R!bU=>5r7Y1UmKkT&xdjXVN`_bg}p8gb?ytnT&RFuxYYR2t`2RL1>YN_9v z?wiNS3Hip+2D_UWeMY^`pyC}g_Xq%u0H+^3(Xy9IAu)^Nb${7Km>mfg2tMl#T*{IjaRg$l4iDFcic2n8n0@{Es@yVhsMfL(1d?bf~|*S_)wyvJ-t4U z-HT)!q8M*zAx|+TMQ`FNSAsO&`q`%)9!a>4~OUODM*2~L(c=C^#xB57^aY*{bX-MSGCCH93@LVLeLE6FXC zi6X~aQ4A5wJ$_oKDx*(^_o>JO@4$ zS_2=nkwT;}H81Qf#bp!LXoOCi;c*#fuGA|Lb*z9r^f<#PH;b-Gf1Bb_8{@(@EW6hk1U<<$=rJ;Z~_@nG~&fcp*RS^GkV7 zy`q7Zc{o_I2HbH-Za%*F5B55>_&Xvx;Ssc@J&wjz0KyRm0E(q$}PIoZ`gWQ$)s?q};D#$g7m@YJ8$tIT-LC$VUERwn15l9;LOR*eP>(mXK7>Hc)Wchadg}$qC2t zECmiO;|n1tIU!AZ`CfEX#~PhO+{oy{fO-+xej7EytsVX z&ya@x#P%n4ToBvehwZP}0mKd%g7FT_tp`h@5r4jXEA66_3gw`3w z#J(KF7W=T4Vh0jCkl0N@ECg3CZwnNA1hGdDyC#T*wS|YRRP2$&9!YFAh{f>bVS6Zc z5V3=Z{eBS3Rk2&XFTxAuFqqiE#Lf+3IX%1B2NcWKV~ruiP6%R$_^`_rJCxX=#10N( zhx)MRD7J)Ho_MSO1Z~|{7bQMyg<_8)_9$Xs3}Shl(oOGw;f1^%P3+Ocaue3a_h=uM zZ>$1)46(-$druIH3Et!TTg46|b{MgIzSYNfm=BBV<;eF~Vvi+u*!%$YSRXd2SiVkR z97k+8h~*6|Zr(;Hb~v%aiGB0D0N>$0ERRAX4Oq3VGfIhlGKekpVYexE1hFHCT^q!X z@L}&!?D51NPwc87_IMwbcOfGUClGrAvDXE$6zbi))hM=%*fL@-3}VZC*rOCXlGu^N zRtK?^S6sgDVjxBuMiD!T*oq)_ln>jY*wMs}CU!s&JKBd`rPy*}%ZdH)+(2EF`>jv59I>YbvEzJLUStd` zR4?m{@x&ez#E$o2Y5f6gC9##nhJx5iAND28@W7rz>?y>)aZaG#sJnI3`xnJdAa(+= zPXw_OeAouXP9%0Bu@45Z6Mfk86?-bNrxN?qAof%r_9VrgMl263)L$FKp60`b6?;0d zrxW{)Aog@0_J1G=p&TX=JBiqtLF^Iv1br_a}Y}ni`#a1umOBy#KwsIb`Tr$VdKE&Nn*zrN>w4d&NE_iG5hzT$oj@yw~8QiM7E5m9QS3&ko4fN1s5ddy_}+Cdg&LX5Dg% zC=XOi60ft^5(HMXWKe^b`fOnut^W*75InfVi1lfL-0J7i3{R9#XFUF{Jh=3T^=)Fm z@TKGWuJO1^d2mS*>(|7t_vP$4q#mCLSEhn4CTS4V(i!^PGmkFf9o2L zKPnF{A!EliadGM6vAAnIE>|90TE>Pqanb4HF}7h!VxES^Epn9(h<*^4a zln0lhu@OzBK_0*98jrh`2bZX^xTKAh zHJuRTu?zEW7s}%qz`%n`-Pp*cvLKJ2c8!OvJh%jojcOVhb76kcyw1DTr$VXn??tDY=zX)h4Od|Fq8+E(y@xB@*t1;uJQPR^57CXc4AXSkVmX* zJoxkz(!r&7Y)sRMK^~t&PU}KmJ_HOrxFnB_Z5k8g!7Hh|z~e#X!KHfaq^7Y!9;vSJ z__p%k5Eh{f-aQDvw)#I zs8WbcY@)Kk$K%ef@wioaP}LASwP|9I$GoobI7@j@1ra-~3F}jTI*Pl-qnGlaY9e-e z6O|UeygY>kLKn(o6JRJ0sw`rYnyAe1@mSe49(Xp0JgCZuRW(t`;p0)=H6Bxx2UQ%g z$xT##_;`f6#)CJ6ARSbF#HKV&4)XX1JiAaHe^nk-iNvNhQCZ?k$I`Cx_`dR>sw6h8 ziAoe7kBMF5F-Cb%g%X?IMCFQ)$3A>^Aun$MhVr0lC3Z#=l`cLWf9e{K`;-S&F0oh> zl`$TV)OR{fL+WzGZ!oOU6f1;9xD>BEF05#A;L_SrSk}6l24{JjD$SquzYF8I788%t zg5}i7=|RzTv#FNAhG%cY6m8gpWfwMXaoZ~w)wsS^H3tdn9^T{&JwgmWNMtYSC8izE zvOPIkKM_PcJ3EYPAh=A2|Lm~Qh-wk_MbQWc)?O;GZa!EyeKdpIUV*Q0+oiDXK3I3X zvxczsF6=J~gGGWDX~f{`3KHp0T-Xm4*24$uVQ_X6*mqpm#R|g(pB}fKYN)_SYh2h= zg~4LTgZ0uE`UpGDg$)MbC^4$7x02R}N$UyGT;M$f4e2O0SX4zuBP2CR&L&8$CT-P@Of-fEG-6x`G~gKL!mo>TC$(8p-RT0&A_bk1OsGQg1- zk3nCf5$i8u5bB)4Cy?)v1?bN_2K|gitW<@;WAN>y4AvM;0Y=L~+W3`Y1Ej4&E8^-2o9)j5NUl)>>n2FDwXnAwFv zMdu7kl>skLiUm$}v zjIN!O!3%((495Bxj5QjmTp)vAbmlmYH~@EDwK=%I3y z!E+FnIw^xE0YMo|@-diXh>1B1@h6=#_@OeW@-e6~8mpWve5G>+abSHj~Xq@UWxV3WzH!Fi_J_gf_#%T_N zvpZ){qYS3|7)&=Br#lS#cg`T949@T|IKyZ>!(s3g#P&|gU=tuHgP4y&%xH{(0Rl$r ze+X|;3?#Yv-O;-7CLnS)l7U4$r)O_@`rEPia+ag+N_DH5Jr9rU%)#=UtN4V~z;!>b z{g}nQ7@Cw%0|8Wbps+fJuOC(FqJ}Ce0u&bKP{R39pJLf7y#50Mym|nIwKPAHs0fpr^HU|8tZ@Q@S71bLktg-Ro zM@@B6v`9tj`v8T7G&1Z*4RKL?`WmRdKw-7a<+d;N`;Y=DiMK!i)ek5viMgisq4=z$ zpjs5wA1JJQxp4NO_&|)H?pD+Qps={*>ez=`=AzPyiUNfdESJDO)O;7kH}jCLVxX{0 zkj*C~6>3Sc?`1QL;q895epJdueOpmOfWjgWlb0WLwu_>nDAF|) zD6I4_&HGX1E{az^0aXGNmU9q@{HSg&>LAomK;fOKIasqnbo8V6?5C8(vx+(zC@jn% zWcyLPoKjE^DC!uXu=>Js#E+88DOsv36g3PeEU~a~^P|4y^14V-#{z|Q6c=K?+OBp{ zd@~8D$4mEfuvp@1%ZED7MGaQeaGjMSio=vu|0yASoKi+Wg5{LF;)TvS((DN50!9HGZl3TP!NbKgQ!t1>R3fh z018s?DM6I%(y%{r9|kc_1PY?r0t({h=|R*C7geRGDxe@!P70!ixu_!*H5n)f zj+8uoG498wr0ZP}h;a%~kPazc`cT_lRI8%!fZrU5fRrJ9s6V);Y}0{&AV*2iL!>T4dQum`_YC+#N~4%p@HOc>6TZ00b`C@^%5VkW6X`n=zEJGX zF;qZveCgAddoA0d4ez5bn(eLfjNmPp4son)F-i%C?Pi2)D95z~B9v zn)I;=`yL8%&R$L2`Y)d5qnMVP{bqYRS#@gy&k*?Gq!FeZhKkm|4~m}Mn*deMe|w%g z9nVM;dZ>ER;z2_`?0EK|eZG4B+Vi~A@$A`z@m@U}JWpCYFwS00Ak=e_=lKoCv#1FL zp`K@Xo`&P8ww{uelReKe$5V|s#dDzN*~{@%>rCbsOcRba~P(1ncx2Cq6np-J$WR9g`jqU;>np-J-0fZYVaqX4||?}bUf9P zPdxARJa2J4)kIG``S7f=<-@a#Q*H0W^BbP$JjYXw>crFVJWqE#)mlzG%REm$v`)5a z1}C1qJkS54Ez?u&+r;y2IB9~~98Wb|6VInT&rOb}TBM2RTF>)$j;ETMiRVu|Ps{OC z8#3{{+VlL5Uo~xc&a&rzM`e(^T_$0KJ`s zpaxjt`39WSlQS(n)v`)Fw|btOY3ZpZQ{wqY&+}f#Q*EKdlMh8GTi&wDkZR;4o>zLF zmph(ny(FIVJkK*7Pc=&t&(l56lN?XAHxkdIJx@OO#W>ZFNId_GQBV`~p)Vsc<1ykmn2u^cA>TdVl^zds2Pi!_!NMSehAH0s>ddHd>od%v zoJ@1?AkCOZbz*Ip1Sd|c&V0NPsui)0kTV6rS=pU@pLiK(+o^=VUd1!%RM#MLdU3^QQxEx9Td(1v1zaP7TV&ifgK=?Tl9yS$ zX;}ZRw)`p`GqZt0K?o-r8L_>Jh8#&N?_?bXb}!$tGwlo)7oXJq6j)5e%?T^Zn*&pW z_b>k?{CR3)v+)lMs%SjbZKmC{8Ytev(_aClIEo2<#s1|tBNX0|Sc(rLTV2*ZH4RKTgU=EL3P;%*DzRB-d*u5@vW0yvf7e7Lxaiv@5h&iQa7TwF;2r;?oycd*FG z$375+e5jD;!|iZ!TLU=nY>!(mzjtw~132&ej*H_Na4El~0i1V6$Hh^#C%D=G&O3+W z;woKSc>w2~wQ+I1U0f)D^Ul+_xL43?BwiX|7s|yuGvneY3=3{;0Oy^HadEf1xRn8% zclO1_UE$&u25{c_78hr@xJdz=cZS8q9p&PR132%Tii`UX#Bj;SUJ!-+dS_8w9M6CY zj;g%^&O2}7;_h{ETyPX{-kA~?cdd(C9Kdll zxC0Qq3+eODc(}M1;Vt>y9>96$I9%LcT-=%f&O58&;w%@(1xF!X?>vT!qiRp$ogct? zXD(b^m5ZYRc7dOFuENFf47l(s3gEo66D}@?nL}`GAPW4v^ARqt#l>+Opn&tvK)ATO zT-~6!nFJSi5Yw6P+Xtc$ zuXpai#qpM0!EyF2;JmX1F7Ed(Zgl|XogZ*<%U#^k0M0uj;NrO8ka%kYIPV;Qi>q{T z$>+j-vySPvQ=h^eSxK}VYO1!%`NqY03XS46(sGShp+5pb8%Xe|NyEqzP7x;O$ z_b!gAJ>j=7fb;C@T^yfC6&yvs0zc1&-o+i|;<(@_;5<8d7xy0s4#ICQMH4T-o-MqK z6T=FJ8}X-Nnsyab|#@XPfTgDqNh1SROym z{@lg!Fu0_T3ywm5JsWcu_aeLnN7Y^d=h>0FxWBl#H36JwEAHYf7gra+dG_FnOI?aM zQwt06dA8n;e+~U(1%Jr>F@Gc0$yCd4jzt7?}*$< zt~P$l_LZtE2>A(H_E;TRzi>$%L zLcn~x7SX|&o1&@QN1e!Gyhh1q@7azTTmKc(R+ei6T!NUe=2C2UtLeFuAeE^Hn_M1ju4gO z?X4&kp4HCxxa>B3VZqTWbD%W!QRYDJ)cfvbof3qNHf}whyAMIJfEgAx>R!W5XP-?@ z{et&zOA3AgKQ{%y992`lJ9QRT7J6wUE+pGM8zGOJ6b=(_50?aa$N%*$KyszKcb?z>}IHbjc5fr~9H7wVf+Un$#zGZhVoBm<6n zEDVoJ;c;HH;f;VtH+Xyx9$$?%JQeWhZf5&qEDk*s&YuSo6fPJpEW)DeBG}FCJvlNk zH8uBRctSOu+k{_Wk(5xrw9v*14LA4Hf7sgi>IF^*;2O9;yKA~^mLrY7cF{z5uH!i~ zi(Bt-iT8Lj+rZ)@jSF-e>KwW>VQoX}m!|1!czImAwu+d91_MgC^Xf@yCulqkPa-*q z>;|%RTL>D4^WZUTC1Q*to8^xLmgZCSP5T1~^lZO!+_AYG4{xrgvc;^}h`TnQaLQkeD-?*4L?Ufih@UMD zi|`j+p+P#gz48DugOUxw)rl^haPC)dKnZ*8K7g=B767lkx21NWVI{xtCcf`6{QYhMf zES5Mn$J?L5otVx`^*T(WT@Q+2Sn1cNW@Wz!2AotsGg}*uSGAhf_Vg=I^GpI;TeLh* z;qh4;%@bRIo2Be3RuTr;TDSTo=7aAscdc#}pb6JWVdIwAW~Zd14KDx`T_^p>YH7(u zoTh+O4P2RJm&mlitRqsqvVj|jKrY9RAQi$VT|CIM3b`o=dCm{{ABALs5b8}mE-xsA zH=Oz++U1A5s1WW$`XI8`=_Yr#La0gdLH>jvTEBLSFVm_9$d!5Ypy{yrK|l zYkd*D>W93hkRJviulpfyD8vpz-tQpk^jkiC9LP9fPKgwK_Fna(SOd%3>kzT=1R zW>}QVtwG3pe#rX@xh)9U=Z8>g1((}{kPrM2>e2!EaS-y6AHut70r^P~vfmHk{x={$ z4MGn1AqN$*DhT=15BW?XKMO)W_d~b|fQar0Limo8SGw&Axibg}pL_CfmiA$=9{%OIqmAHta& z5&bF%8Q_OR@v)_$7=JNu6lQRFug@J7b&7Qq=YcWwl(#vOJzm-DUao4d;y8;5fg>aa zqHZ(rr?;^((IZqhwOfb-sfmHK*|fH%+YTGv$2s4fkMetUl-F4=VXs^a9rj_kFxV6>_*T!kzBfEC+b~%w|`E?r2`)OBg;R zMF8&8puC&;BNCI&JR(07W)CuSOrd;p2*dvw0Wq&EW{l26^kwm9S1}f4BPr!O8PJTo zsiyB2Q=MH^h}?Y+6alNeo5H&iUDCN$9KvER$O^sp%9KXN(x^L~((ZMUUp}S%Itb}# zO1m!z>1ay(O%T%2l=j;oq@yW~n})vL+R>DDe-P5ql(r@aX~U;CL^)I1?}LzzrnEl< zAstO=G%4~Wx1%ZTPeDjWQ`!STNJmrJpM#K&rnCoxkdCIbwLwTnQ`%pGkdCIbhk}rf zrnJ8XAstO=e+xo7n$jK)LOPn#)&(IQO=*7*LOPn#8iSCIrnIIYq@yWqeGt;ol=esv z($SRmk07L@DQ!a#($SRmXb{rTl=fH<@}*OnP7&?`f{%>rLg}z|#L>=BgrKZzE$ojDW5oz)kX11Y@O zy9Fx{XXezElRE>2S0;K!WeO_h#A#MJtIVzGm#}Qttk~l*`?;H%f8|G={T$53!?^JA zj#p*BS}uH~4R7w02MZ1~*UgRaInXjUSL|~rr9=Cl3qeNE;XR+j@pO2}=WqfYp7J@A z(cuxF!$>;(!RIiF4tMz+M$=)X&!LCz@{R1!v;Jf1P=OU zAhlCGY#a$a0qPrQoRLr(U1hVlT?gt;xJN>ij9bNR1gIy3qFt`~u8D<0+r{l4psFRr z6-FpjI)!1c1@*M}E(4_@ehEq+m}vH>Js$OrM}6#3hdip+3^#1CM;+x+qde-TiBRZy ziT78aG*ufxJu7ZIK*fdn7pR0#AA$PjSf+VMG8F3Boz!$tS}xxPwP*_6ehcbCpOj6!*vR?hz=BV+W`!B(~Q< zeO;(%Z78%yxbP|8cf@TasEHExSD-ZP22ej2+*VNY1@{T4(*;*D*TtO-YMQvs1T|Tx z6ew*a_kwy=xcnXzw_zipmqEQDZtsH9()|e3UUBOW?YH7ag1SiBRSFc(=Ho?6&-ZRn zn$ibA&6Iezg4%!+5|Pl9^FpEbB*a`$%I`8zTDqG-{YQMC1*Iv-gVHqb2gS<*(01p$ zVMl_}uwMbC@m}On*Mj;)LfD`-Vb?hlddPEo(sMiLx%EBY#SI0e{KkP&F4dlIt>?SQ z^S#0Iy&II~chooVzNe(13Y6w(E-1}W9jO0`@6SMKY5Wq652c znOPjl53Ahi`lVjS6G*l0!^Bvdl$myNAs@cS`RePvcURZ10!zc0Z}s&XSoJK}Gz-p` zN)Njnl(zIbP>aMZ3rc(47aoR7Kre~+o$R}qSb1RSHGmU#6ITt%hW2Z5cgl-<;lzy( z`4y$#GvcsC9H9Bbd$l!{p0-b3a;~ush{wMKQ@L9{K6O!^wh&fXi}fNTl@;XSpTf&O z(RD)&YrE01H-cS@NT_;c&&;b(6b|aP^4xHA-Fe}l=d5m?FWz|C5`h7H7%x<1=YDQx zTJez9LEPuFIK0;RrEL&iDAJhryw?-a3GvVSV8 zLm+K)aSLyv}p1cocup${Jk3ay?sQ${*|6^Gj}!e`hSS9zynWiNOARN#ExW(y&~+Az!{q}vKNF+KukdRIyQoz zJns~|CK9WA^H8kr5Dpz&4`}f1sTg+Ypk>*`K=vf`iBuk8PLI{^Pkj^N_8^>@-bFTH zx_#eqo0Hy5w{CR1(sBE0dM(|$(=Fw=%}f7+ZV}_*aMJpBP5ryZ2E-JKHt_u+y!*UA zZao!?uG=47H*p9$L0OqGdEy}4^TfTo3-JdTOyVVAH(cu3+=;I1Q=V(IVK5x?e;4p` zKIcPt{42lOwEt>C)aJ8oGu#z{x24ibVcikQSrAVmb=b~eK@5;y?Y*Ejb4z48rXp9< zW_=(%j9VWJ_Y;JZdyaj)ZW3OPo2{`TP-x-fu`~&x3hJstsd)-C9z6zL!h%oOU>rJ} z%Vbn&fd#7Q-Bc`Ly)BQyp~pKLt?7?U%P30N_p!y{<+k+fTq$D0CJ=Jrk1DsPH=}vn z2OXCC7-^8V%h5$HO4^r{>7(^8!#QbBECY+eo-v#A5p+R+_w;nBC+a3mPWP-^8V;o% ztK63Ft=qe1dkY?`Dhg*l?Vb8C^J!`7JxnP-$13WuL}~sdVXg5o6U(+l#!o)H98O_Z z@`_T*VLZx#J^p03KOSBlURD}TWeXXId>5RKhf~6O4+R>ne;0X4WGUa{hsz!m(Z~6L z#+F_vfbXI-fY}Duqa4z-1aeOHDv-_1|I|{GNHmCX}vNNz4 z+=1KP(yuVIQ8%?$DD{VUSa#a+{^bCF`rDhM>xwc5d#66m94t-k!>ew`=B`0Hqr>Z% zC}U+5JMw_k;|TbLaEEzo<<5Mun}7JgrTvLI1pW})VlA+~?w!h^&>v@rlO)8}zm(?J zVTe5dh6($xGDKw;6uVO)9LWa_9aVr{V_&78TF0#JQG!M-8MEgd0BLExt2W;T) z#;vUlJJUzxN3uU*?89bcdowoZ2Ulm$+>Te^`Yd_7?$teY8y~Ct^r)-%K))Vs;3Hwt z;&60euPw8SL%E0W>1@k-x{m*4jK|s2^CPgkfZ0W~{w&n6FMmn5P?r%k9IM zMv_&B@b+giIs>fml)Or+H5G>%nyaHV`)bfAZuuUHG;R&UJx|jyKg)b8)mNxLWB=n} z)2>;JR|dJ2!SN$uI~h(R!)RF-V3>$!Yl@QAJNY5VTO4N%isE*vOueUZ6hV2&G-6K= z&LmJb__K{|9==-LA1__=K*M0XRGL2qAyky*yS(k`JVH3%t!C9{sFFl<2H3#*;Zt#E zI@uH}KBK_j@GU0UWr5=Z=JLHhz-9y2-< zmR7H(dnW8l7v+Z~tV2kUrUs>f)X+Uz&n*X*$-qPyCUGyKSlk|hbS^ZuM0#P&=~t!! zlNQ@Kl7cRP)!$;%LdzQ9X3-H*f{mwP(|<9;*&B)_=l5{6kZ=s?bdJXC4FShD-k3J7 z5Y!bN+rcB!#gMQ<(^x|%e_bIrsqS0Ax$337~*rFIOy~- z4p$Qc^%b|1DAIJ1Qy0!Nuii-+%-c-gi`CXXbNObL*I}n(oMO&ZqgPOO`E6N2&jzI{ z=mnru@519psw4OlsP74mqPyZa9jWiJpw#zdQ0iL)>L}zR5=wZub3L~O9(9RFecPkz z(c`X^*nR}+{wd^g7btylwh@%R(7OdxN^t)KrFsn>q*UAh$jomHX4o;H)a_bOj`k3g z>g0BM)Bud-8e#${4Y3;3YRSj_ptM|`0;Q>1jcHof%gvy)G_HYkpmFeowZ<_PGuAbd z(g~mxH`#OJIS=(UJ!+0eon7Rn>f4|+RriC^IM#uBXasY)5tNnzA79XTCwSC6P@2+9 zJnDK-X(`=4SaxWLqdkg7TpD7wM_mX?LtN*%-49A1?tL1R*34_5l;3z9EmPllpp@UE zp4;o7G{h&MG)G7FbE#n-RSjy7)a6;Au9o~>4r&ETDH6KQqizMI@!s#bt@EhQKxrKP zuz*(TSdTi>qrUD@8ISU7EgI*KcUL_Xn_b-n4#YK&<5&o>cO05BR2ZhUYAu}hqRXfh zokQcS+>g_9l{;~w4r6-7!9;fA6liL0n^`w?`Y6omu)M80nEp@hLxk~5QJC|i^-W}C zHLPYl)~Yq~v)ycI>w&So++5zW8e2l9mF1lpN$c}y#ou~}OKW|PweaD;c>Csr^_w2N z)g|4Jngjc{MCZ#n>$#H+XPWcT#wq#O4fIb~*d1F4;Rm5}z8A%lP?i+U+)_Oa@wRU< zmmjJ_9I&&-Uu-T&0&(8cmK2|v?RN%cxeaUy%Z4?GJ>L2_Mop}O(#@zv z(|TA6Z+dh%?2z}MY?BplVS2?}d2D%Bg4pE>qp4k#RGaEVCY~KoVWHWOBH7fI& zed7VsJ{_rBk8;%JLLmW@65i{5HBs?tzTa)|byB@CnVr>US|6I($kmwbjcCQyZSmGw zRF)yLvkt)FG<+93-;^UHB$KiNj!+Dkwj?}N9M49EGdWe8qYaahu|U|?StUq$NZvN9 z+~zCRThYAZR!>Gk04C13%`avqv?Ue}<@!q@q4OZ;+2m@yd!urvqysgra@Qs&8SzhE z%F+JHwd(N#;C*um!4-hJE@uga9xKHk5mUWY9C8I4X?8a}+XvsI{VhnKUn_xF+Rd!m z6_m@dESOVAnVIW*Yz;x0!nN{F?(-68*R%mD?a#EMuH)%$a5ViG+I#wG6Ut^tCKdUMAc==`y)&UXd2;}K`nfAD;s#DTi zpmdr#0_{YnB#O4`_D|1k0vi0C13Bq@8h6B;LzB zH=Ybrx0^s+HX{U-wQj-atZftn zY_xtn@UE z(bdS2Omm5<|6D!7TimdP5A10=qq0mgxev(9o>k0o{$!Yv2g(`T0~ zV;{zF6LsO*#xZe(GScq3c+l3)MS-^1JsyrGyV^r(Qt&$w3#&k>FgP2OhWMsOor5M` zDoxzXeA+iP9)J6!j#(SVZ?|;+x~i+vMRnJPC#1W{hGXdh3_IXTD@@3-p?rVu6GE!a z&uBWUP+FUTrG?1NlI)qFETOQG@5sp?MvwdS9MgJ(df*B1_N|`ntxtQ}4cg*CeX3Uu z3aj~QLQXFLHdxlE13 zt|c7Zxkdc{G4>c${5t{a0F zfYOb@C7^Wc&n=8CGscS`H*iK#bl{8oLf4Lip6d;5CW;7?zcV?pH=^UU&MIYCW)C~eng-KY=3A+YA)wCJI_9V(L?i{)Suki~ujRLE4klIM-uyNKTgIK~| zur%I^Q68sKW)#&_?#vu0iq`kTY7CnCbYElrB>3b$2LriS#*Z<&)4HixXDO zfz+A%XIF>Q)o4}GdS1d6w;>^1f}<={!EDr`DDhN5|w9E z*$I7Ay#1+odw1bl1+F%pSwXh0dC$B!akG?bL(g%Ezslmd7#&M@CnS z#Vls7KLg3*|7P^QC!!gi?8fbF=&=WjqnVqL_Uzp7%Jasrtd3UZe@sT11O544PM@e4 z=tJp*kx5ruJS~#2zmF2Qu{@qVr+cF6)94Cbz6RN)6e@aIsyz>oZ(d5`b{Q(?b}acg zS#=Qe%)#7~KsXUa>xW?)kjQ3YDz#@I448Tf!lGPIaa& z3}0!X+N$SN=U&8;$Ecf*1U~~RVMC9MN}PdMz=s`ge@4zv;n{Hbn|8)ML)9mPdo-fA z+y&RnG%S2kGPnGQ5bH(%jO0{!?n>c4E?MAi?E^G&%oAA#SfJh_cUk`2?k<_cdjRe zOus#Dy+APl+U~=|fKS=>tl8*XH=;XBX3^BUT{fdNQr;gGT4?FrP(MylQnQsnUBkP? zD@e+Z2^(ev)lNZHBcVq7S4why;UkGEK3q<5S}l?mt^fJwtkJ`gCl@OOlb5@aK>H`6 z7{zWAYi%#0;w3i?ynnUe7p-6Rzt*nP;EeSQ&U%j4e@g-!-t^|d)oXgQ@lj37okII_ zTTM<9;x@$N$O~H;EQqAF)g3Auntc&AEQG>TIuN^$^x-WC<@6m?F-I+Jd3OPsy9a+{ zT%fw;cW9McFdzW0-D2JB%B*=;-N9|qn_fbX!dMesx6NE1`g}RMZ&-(xoA`trl+b&z zeb@+R{_B;f+8Dj{5AeWD^9VY!yL`2Nq8*zfVIvcyos5`K2$uXd|L*#9S zUL)S*vQI|uYq{!=rZp7FM%H12`6>FxV?#lHv7{S*hR#z1F}vY2M4JqcN!Zb31#~P? z2b((GHw5VAQzM-^SO#&{?fOYePuVzyPA=j1k`?c88@A#5NB|OpVhZIh2JLSeG+L03 zud|0+g}$l78;=?fGN`TN(Y92d%(WbkehpWzQLMs;w0sqykUp2;D~?d&B+%NIyMpZG zj&3Fly|2ib`DpNtkp4!*Mm4 z$baxr6MYnxN+OoJWs}?a2};m&gHYm}r8Cp28df9B~thIK~`-KJJ;sqph2K6Ix%YnKRIgNzQKwdS(Tu{FhU*49b zoG%6SV{y9@l!o{TD3xL#^r$yIY6xV^TP4JCpfrRl?NXv%Zq>8-qQ1ApYE?v!l}880 zCZQ3Sbgo-?$)QSDB6b%dF_CJG{mtR@v5qNHY8l29(~gy(3S+FoZ!9p|+p3|^vD38) zdkKW^ngfUl+s3m>6Oe+$x)1uaUu5_C?m71yeNGU=jXaxnY$vh>UjfVJr=|GX{l_k zDQbx}G?K4%aQ_NN_F9AQge|xJap~6AP~q!#!YZD3QV@3zuva$ce^A+6zx!IOx546O z#L_K&g#(gY$ff!DbG=07rxnOk3gqYlIm`*}44e59&kJ$*S!18iE8|UD`d9`-SQQsv7Q*5Oo)S5Vx_Qv`I___0VzjY*JVe646e)A zQbnT@t3}(4;s5dYzZ7k>7UyUAkKZdeesc+~83PlZ#|@<{MCmxaJ(m@Z}|m@S92eSMf%A zeg1SQr`#&8wCq(9gMDU9m045HG@~~igVwcw#(b=(27;0;qg_mz{ael1>#3`PiJ1aZ zorJyANla^M4ieK-6Y~}l^EvL;fZ2|W8_Do8B<4^e+@7rX9EqvuI0<(mK25?cpr|}Q z-}s000kxF~#$SC{{Iy+<9|PU^#<_^1+7lZp zLbEAjqk%m+_dQuFHL#JJ_F_yvUYl}LmuV`dt`A#!1f?!Bv&%}2e}F`Lf`Gt%Ta3F> zC(_$rgHx~=o!gTRugZUYp(;OPRX&var*L@5EsN2n&NghVD&`M%%K`@LBKK+RnJq|| zh+$f{*w}Pcb&|6GqTWp&;#%x9ur1MgUOt39Vw@RZi+>Z145q@~CS@XgRY@}ZNh177 zvf?ABP}6_Ry-r59j1177`CI%5u+!!?l#FQt_MCtlw5FR=7}d>19RGUNS>J(I#I$cK zLILB@CHpS6go$jwjfL)3fjt)?b|S>D8R9dPgL_|$WL)04$o)>@xks2Z>`q_pHuH|^ zXfCja*AeB$FEsZrt0Qbxp2ql?!4KKD?XSc5XLss{33~!Yo`SI#D{V0hpG(u3zo;QxvxPB9S9QtocgiphyeDhA_tSsL zi5!yIz(T}`c?pJ9r%0W%v(b7EwT_$bh6YE6G(kMIU;5jY<}cbX4F0)$b;Q$76Rdx4 z#2f04c+Vjr#s(A?I*PMd>+3J68Nu;4TE7O&k>4(j!RvCFFHH(<2c#+1p9@TG1wK1& zv;T9Ty&{=6Y>I#&TvtwiJLF-EIb~^;-#K33p;2_gU59kNXy;9 zW4JST7|vxy);?!!ba-=GZo)b;cP9Q&RD2x&M?x*A*nf!d_CKK1rt3d+6W>x)v~IyH z1Ep>ccy1qo`Z-pIkO2cjk^|-k02Bl$-z(}cK{|f3!@ofaf88Z^v4N6n`1}F_N3~M+I zF%Oh(@m>x}w|H*=rMSO&xFL`c|0$f00aY!WdB?AEz7mv%;A>#Y`G-ZWO#5?>dKZ-D z?GsQtgkL)-&0EKUb18?|O0_D+i|?~aora{sXZr2@V9(0groSU-Q{+a-^xF`%%aL3N zS+ipDt6L!zpjG6Kdz8CO^u%avYMHIg7%1A^4HD}O5tRy`e(aag4%)w^Wm^B_6$qjA zi}1(E5eC@*$K1QXM^#-5+%qshz~Bjp8WlBa)S#loS9$ozzy!|d1VKg7szs?3Z?z)K z2(~_gGXtC+2dP)B-dkH*?Ja#?pA>Du1dsu$63{A@s?mBY8hNUwfT%GD*eCUzG9T+)pqY*G>DAeAsNj(IpOx^le1N4U6g|t z#7}KI_YEv0qI8~S+x*|poHEL>DhG}50|X;yYjS`)sZwg2U;GR9qJOTURSygi8if!- zy@v|)3m_eqCZJc1F5|C3m>Hn%r-Sv*rUZr`azMB#?oOI&@al6LxwVvJ!_8C6*H^?G zBu#1l2OZ~?IcsR6^L}=lZPl;09V@kWaet3n8JiK}yuNK^^Jz|q&EcT5Ra<>s*LGcS zVdoKS?jc40eDgySs@$_GN7b(0*FivwNEjf%((2u&F3!Fa?d~c^%R063(ZFjZoTGP`VD>qDXM|Gx)6%^vZFh;;H-mLC`orR20q&W~j_Tx9BL2lnSIz=_5f@WLm7^8ZlwgAK*q4n(NJ+1X=Ow*CpfO&gh*W1 zOM)9UcmgiufF!s#UL>z4WxbVM>jgy!x|$#yOFrZU^&#jAg3h_0YO6q0;I+Q*SwRkDv9Ro2AQO?`_4W-O6lx#MygE<#a<%Y~!2In_xx&6gI)9Wt*v zUApF1fS(*Fq`W+URs*R)>|cVg*8`{+KpzFrX8|O7iaTJDkx)SVof~_bb_W}K2*`QX z5Rc5=^qB}vO=RY=hZXeGc2+JkKaVx>lgRz{r(l6?=2G)>)6zul=Mv%V1Z0xyk*Md= zm7T6EOq>jWnUpctGMC=ulS^D6V+To0(IV2}#Zdh~nJuZ;8%Ksxb=LAJOKoQdMQ}{r@KeB&bItDg2Y1h( zoPg9JO)T~^%ZXgtqy2ITjZW-Hw;z}4E!Lab5ACXztr9u0fKD1;t^%fJ#$ z4%<1d=a>wJiY`OQDbz8^mLQK4d4^_$R0biHl8g|4Ny|^D(vZgl*9bx~a0xDm!L+7S=o|SMK zwsYK1U!GkwrJuEYHG1-B^P3U)k6}Z(RlvM4Q`F?mLH<1F#5Y*6cR9=F=kInt zf=-YOOrNoC<_z&#!#nDPEQ=)Eo3JwR@{J22Gw$BdYd8aPfl+ zkCK{PT5AwtWqu^}m>;=Y_B_+@dVmb%!x zLDzUwKROK>-J4py*08qy|4vHMab8HPBjD~JWUPtBanq&IEVp>F$UM|15&vJsJ~hG zuLbIBAUTrKyrNUp+Io=B{I^B_>GQsX^Cx2?^t_R4%G{Ieug zbga0HaMX)ZT9=-}DkNjfy^am6&gUhKr0txFPP5K3ru-`58KlPA*La(8Cvpex4Q8qw z-HH+fBe*KL(sl?7daAmxQi9~vQfLFYNn=y5%Z56;RKhToeZ#tQHHk!zA1!N1jjY{* z5sqh4RgbR*+({3CS(Xo~ch=XB*vjEqQ+@vy<3^enh*-)}f2pUo^Tn)QN^0^-va;Wo z8l<$~f}mI4{!(7WmzNhQPBbkxMtw)vu6JD5+;J}KZeqah)Hs`vfZdJv*xkf{-HorJ zA?UHbQ(^8I9xE7JAwhy~xdb2qIp4eRGWp79ZGPmRrexS8WgUU}teoAm$PjSfR7vb9 zN1dz?Tt53vKU!V$GG;RgF%#J_zKbb+9wG8iOV`58TZ#Fs9IW)0C^xI?YIYGJG3T*H zemok%TbDGN^-b`*p<~i4MpW-KF#5y2qZf=b+}pb<1qUOIn0lRE{w~%l(jZlqlK&2F zg$hS;6}vi=jI-uTUwz|!)w&45#bsf3v5|bs;6j27{+)Rnw1 z3e)%>CAkbUj_zgTx{_NyD@@DKm>A3&+T&i|SE4tFNytn7QT8+`+t9XzQPc-9}0$wR50drlytotJJL1Q}8_% zd{>)N6V;P|O#{HaEoM9nhR!zN5&2m4Nb-jGt?_=VGX?{jKaaq!s6anCsd1( zlDksci$yhyDd;v$;7-jM1f9f<;$US*k@~2y-YDsx_U1kl`~@xOj*o5()RZv)lTh#e zjaKG-3ep8jY}Uu~6`bXcGIaz@#j{&ELPB#>TB9pM^ua$X3OJ4L+`G_*((ib%rPAFg zKsyhUg}MRgGXqTlx`+QGp+^2{y4!(N&ifIiYnaH0x@3#XM1@)cNKBYj`jqR`3OxX% zdF5VX`QcK>4xpH+ZD$Z$#w^wH4h*2<0%!_QG9r0r0s>%9ddMk@LTiDvwjDs) z%R%JRl8*?WQv&F$0Qx16ws|iG^U5(&+tEO(4HyHYCI1xYLK7?cI1Q6W)wPb71E?*C z71OWpQhFp*38Z=D;U^6n3#6rpwob#Q0V(cXAeFIy0;F|35^lJ@ zw=#c(up0@|FS~ZC;J9lpt zJx=5vT4a7!Eu--I%$5W@jJOqRPvrhXxENcD4;$RR>=xccEn=%dM%=0g9D1TXf6YCN zDi*JCcc1a@op&$cOMC*v)6M<6xIl?_G}EjDqTIhqe#qbc$#*yz@^{-->_rNvs=WKX zdFeMlK^#Z0i&}T($LEGV8FRiqFL^=2y?Y5XlW_JC4`bMB^L#-v9wS*>HKvXTc%99<9;OpBx7iP4AARp0b@OSTwHXo@4_CE278S zlsv}Q$#eUo+oO?IryQeId_m2*#Zt2-5oZA0THMZ72NM=tK(g7c?J&EKuBK7nrB&r- zkFWtqcOMo*@<5pot_;p^4RmGzxj>f5@vlHi%;JYw(=896JrH<)et@$1&3izZQfh&Q zgpTBYEm3Gxp-y`AoPf1bnZI9Qvx^Qv_##q59Y6A~RJIi}Ym5(X!T2yEtQ)h@sel#7x z#lAf1Egi!p)L$u-K1}|?5F)TKh9)>0h-`YD-BwoAE`^kI&pVe^$?XSp#&(`-kmDyq)}5QZ3L2!F zJuK{`CD_9D=!bBPLP843PnZfE(sg6}a4kCjm>95^l?cu9L@; zx(H+<=pmR@@q>+u5&I^MpsxWo-E+zyf<Td^1Da=tOCrwEFIYC?s^FwtRl^Ni9oUua29HLm6%dq;lbM>tr z;dz|_p_54Z1bSzr?5R4g*%RfqKz1k*QfNN=5r6kK?Yn3Iw`vBw-PtXb|e#P~lFdWXLsW5^H* zeGH^(9=W!x(v;}xbvYN4J(bu_1X77e%=47FUInB=!7QM5x{aS$AeB{r2&A&=t{|N- z5iR)+AkDiKNM*)$AeG{Vzymb)bRaGH8X%4RQ4sqZAeFzwc0eVkSAm8fE^QI(uSd!R zx(aTo<>i4i-LpU=OuD}SX-hko3(sq0`fWCBSF=;g*LyVggjuU|58nyPOXMDwC5bbM zCQn})TU6h#J_G%Jl(6dGOyqtgtCt+~TlKF{hKzM+Y~ur?M5Fn6%+1^?@liKcJ&(() zk)*}naO$XKk>ug&^<~A%WxY}dpoqX}XYVLCeA2C-#`-s_RZ>fpA;?t|5AKvGGaulFEwzm)lF*XV*L~Kw)J@g z1nGh47I4e~3A+qg=G2T0Wqfc$ zJ?@;^scywm?aI77(_+wFcDig%ld?8tU%;FrFW0DPPeXg5nNRN+3q4$YKOJ{sWF4zy zDNMItmO4}sjIMv*pbBGFUhJc+FTHkZ7e%HR#11whP(Pp;l|@1a1L;gUGJq}ta*mK# zG5-INCD8YQR6Y9xAQiYoXxi75Cp$cy!5e{ecD)clva0C(k%PA%o7o`yzY=lXoS1Tw zV=f#bEWDU-qcan3e3tkot??EEgXCcNQfRE@I628_hn+qnl-f(#w?P3S*$6ojJ(f;t zS55@du5|7hRMsmwtQBD_juxxi(ajz-m)-U_ReMs(-8>1xN}fzJy@kbd<+g`oo*suo z`SFuzFw`({s-JoMR4-(vhTwui0?f8+{Itdy^TagT90VUqu(F!tfE3L#+!{7H2>W&b z-55Zfdi`ZV*b@QN$()QV>t7PhY*|q$OytR>urX#tyE!Hnot^DspUOENsymKwXL5u) z(aQdW2(~;n_Plb=IxpJz+N(GU-<^nIK!OEWJ#YAug zOZA}#!^Jbbry;4ix%4=gN(YaV^Weh^2a$_Z5Ge=10DN*92q2S?rmp1x3U@Wxdnl5F z--w~N z>N!{NX<#npog}R+$Wn*%SQh0S@U(W0oBc&tI7ow3=ceS?hdYk&GjrHbs?xGD?G%F` z&XJ+fV68Rfqro~YG|~Cym}zG@H;$QE+f?`aaN!k6`M=b7iVB%YS@@+7Q8fN)`0{Y0 z_5wZ3x^DEiuW4uT4`$aPdh94l=V)7|+H6~rJe<+Z9PF^td?r_M@3Zo;G1I6~C48(% zVa5a5?>g&rHaR=$G9AeQf^8uMV^uMtM1)yN;BHivkF4j>g49s^RLViS-mb>uaygG?zyfV31*VQAjt0%$hS zAtv42Af4RuJLqt!?LULC7l2AwaMz0hvM2HPsDY;pJ5LsfP{cWpI%UTO`Q6zZZClqH z=jaC8WgD&Rt0cv5#?>crJ?*p8Q^UtL-gwgIr>Dlq?`Nl58M$?j{qa%?GP-^Cyvw9i z{&CWv5hY=|%4u?%7J3MABPSWqhe!o=)}8C(&F}U)Cs%#F?PMP$2Fv$&E>Yd7)3q{k zpcq}WbB1+22VS?-x5ys@wFm-n=(d zq-m(OGdZ)F`fHnloXK@v`j@n0{WnTvFH`Iwuh==YWRp_&?V9>Pg1rpAO@;$v+K$A;k)8gaw;kTh9e1qR*d;9` zEa6naA?B}@Y0^c;`Wlg{8EysADJ-n{HX~2T21_B4tQ7iA0NoHkMJ7kd)a4AULtnF-BZQ2gM%9;|V7OQ0KZGxT0S~q(8%*=R^w}nhXYVu@>Zaj42if&Ln^<4;WgYCdDvAl%^(ZvxJH9g_>hzwjmQpIXdt_FKFaoHDSnYG^UG8>7VUfm6SA zZ2Ezt%tnSa&-O%iG_+#UVa2xF>C++G4sJN`g7QkUl+S-!HY{;>fzg<{4O~eIiwHH0 zowT<(8s|pNUQzr>e2&?U;T*zDGv=7o-)ehAYa(VdCLN4`Nm{$b zaNgD7Eq*uEEqp;_@ce@3y@nZqz%4(+7b7{Z;vaj5qsqe+;Wn`SL6IWY_zFw-gKW|2 z-RIZ+mPi*e*~R#T6F*tHMQgwXT%2W~>^7S$9KZ5g<#jF)(ygp0ofGag?Ps~=$9qlC zVS-S+F0zZFkv?MlUDR0)&f|Pbm9x^P9S;}mOT97#BBK>X2}kl8t2%Gn#RAAQLrgol z@v)sYw;1Fjr*YZ5UIIjV`tnvM4|nk6XAqORu6VPKk4H+_B%(|yUX^fD(x+4Z**3WG+9B^qNN#j#$#Tc% zR8z8C#nF;$fVAX#AZ^PfK$>GZkk)ZEkk;`%NoVRv18E&gfJ*o*R=c_fCH*o4VWg^~>09XE`L=s+6Gd6Se@MC!cWm;4*OfbR0E*8IK>f<1~E_MoR)VX$^+3okU2H~Q`w-L=x zsF6$Td7Sg`kEoISZ~F%t{7%#8nGzj$FU0Wu>guX>sK&xD5RUYAusPo@kuaSxTqYIP zR^$rpgn1I^tJ~z_ooC}8cg~2x@Vomfh^9Z~TIku3KpY=2ZHBfW?1oTs?-e5%lD7FL z4+w?oQhipK7Z}_~*q~Kt#>2ZeLWw=S@KQVh!Qiq;6vzLFvUvV~oyK)D9QI7D{6*Mc-@7d>v?OTEjc5~i!af}&w1TN!g@*A#aCFu>un}HV8?Bkofk+ZU6NnL_?8ATKV z0rD4gL%!T7urf;pQ7VymZ72?<2XzCYjjiCh9X$Vs!KL0&NG4otyPA^kk)}*EG%=drPILvm7gap@_dC%p;G*7a;iw4TM#)rJ}47YMT?AjC9_Xu;XL z_#DR;+hW#5>0$C*cEaU2drSSPI6*8k=Srce>u9ea<*Y9$ES2a|5VKbc+7y>&WnMxQ z_WIWlUSI4ly)~`z8%J+L+S~smDb-q5RxI{psN6d;aQ^5D5%yw-tyY@`Gh$bg)@$7P zG_I4s_{Dbb^B$VHxAa$Tk0Am64XzW~sdSeaTz_)Eyk%6^x`JxFYzp;g9iZ!06mQk}Rdh=#+|5-q7k zBmpy5$64878m=>2t~=_?#)8C)Ftc0aHa}t~CZ@DkXZTt_;%qDXiWd=)S@(NCf-7xL z5fR7nq|A4T`-LA@j~7!b`yXDuzQP^k2paBSB640tKV=f|WIWswkNS%)0)z^u@^_E3 zsJQPJvy$w|6f9G!?baVbp}5yPA_x#2IXq>s7m#poom6htQrtUwVR$jBO1R%&W>CxS zK0-JXw*rf|z~;>=;avwz7(L`9EBhMeq-wWTAqlva^-`2K-mL6;BG_k#>fOev z)Ds(Xt4QcjM`!pYgxl^N>)9_5Eou|EEzyPB_@k&`5epTM??g-Sa)rqfD(+X3Ca$mu zVjOv6z%J$dK-zCmYSQyIq@dRbYX>MSJgPWAVVcJh#BB+rp`XE$3y<(egr`FJ$5PHa zg$Tb3NTqusQS~2f_K~uG(Y@t=0Ucw)#ImB=K(e&yF7rUfRCR)4gr)WaauA@}K_LKD z@E3u`LKKlu83^Eo6`*~9bcZT#BJ_=sIY4^s@ZBJ6egMf%Thkp%_Z7N2faU^ObRS1a zK-#LG1If+tNT>ib+_YY7Vzmyrk*#6(18H7y!99z85%#%2nog8b8YcDxBTOmx0BMew zfHd6)K;`@&2^|RP6{nMcv@PEW!hQ^-*c}BXE;~kYObDP~0PV}^ZY1?TGBlmKz|LOG5s;wGqK+ZAbBT5!=3^<*2K04P+z8#hMfoW{Bct9_XFs%y+WZE zP1rR++UD;8X}UXtSh>%pu^AxEu_Oo++Yk*~7KAkgVNVCp)&P1VfV$}(RPn%J^_Jur zZMW)q*(vYG%5V(Y{^JqS_j7@S zf+L|TfJ$^JrN>E~F4yyI(duyOGI3BWkDgviNtvQ?;;q5w8Z^{#RpoXlK>=Ktg z1qHJu>20OO@}g5pkbT^@{XSpOqt9Fk(mo#~Xm?)ndcGa}`lg!6<9g)cicXX4f3OU0 zl6CADdC8#J2|DI&4SGHI3yWY7IVi{mG&2nm+efdj5&B6)4S@a zx8qJ6y9=}7;)UcLdrAJdvp0Uax{Zm-xrOO4RlI&mP4s@6-}?)D^y91a9%JKfbizAU zd+2f^!sEe_JtE}+X`i%w1zj}=46Uig5XHlAG_h6)Sw zM36NKq{1}@gjWdy)Os(lyPZs2NtZmgHDe^yKLvQd-f1<1S*RwM?UeZlE?*V)CUh!= zKW}E`bReCTB5c1%yO^mU5D> ze=}jX0BH`<=xUCK0;n12WmE4&R+7J)92Ws;4tWw{1a!yYH&7|p@VvcOi75~}(`S7i zahlJ)IPEvwOE#bCISOh3=)${TTwH=)2cW=Q#g(&URT+MbTn#@Cl zN4ZR$^x7&>;TzwOoge0{@0x1C#rYJfSY8cOf|aiBLjI(rE7Mkq+rMF)oM!tP$u5&U zc~&P)+YS!F{yTHMt+oRr-!|~1l^Uabb?Z?@OLY8C51=^EsYV8n-DpW)#E}Xp9mMV) zfzi&z!?)}-Zs#8imv}7H*RpMh$UmZ71)(r?5Ko1WSv}A_``6NJ-wgWk!e`jN%IKg* zi$2cAze8J#s%x=`VNqw@xLoT zVrS9J`z7f+@|5xgC6JuS6-CQSVPYTj57HW^4Qd&S~VbIb~$ z;OybcXu()L;q2uf&_a7DdW9Cm?yCna7)7+RW)HN`J%8qpbkRQs*b^;yZzPF^^;abI z$E^p!e&P7te65o&8T`wc*?uA1;KU;GO9%g$V46ZSz#hGKqz=+SJ-~0fkb%b5vM8Qe z+t!l|{+aRrz>IY}J=Rf|*`=d?3Xq141=3NM!P8N{Jb=C(Ks_W`vCRy8iH$F#5)?G% zz^W3kgvFGaOKc<)-1)3Z%r#&;C-4$Nsc6HF)~K=fH@nykH@s&g)3*%1m_#^iGZmmZ zWw;S-xKV2?!^B~ZO|8$<49_16jE!sb=~4Tqh9dk$aq7%l)USR1gzznFbw1@M6>(ZF zU1Keu+#eGhl((Bn&{W^QIax)5#?MhLRRA;rq_&zv=i(;OV1$b6KeTR+4wzwmCq8(F zHLGRH46E2O!@73$3~P2v1s?#{5^&v?G7}TEZkFg~KN{fL^+a!$==C#*-axIf0rCB! zWt*++RdC5CBGl7(!~S6_GnLQ66#keIFx~3Lnf+5hYglTBdRx*Zsf@-dzg53ULjK>U z{}3;7=7^@}F`@Cd7Yi0qVdvKpzSb=WQ$TNbp_mc{OV;A0MCFaW2>{GeCGn~awklswa1?z#ReyfzgKfqQ4&?{Z?8&3yo z9bvIFkd=@=G;CLVKtLEsG$;D+vYQK42o(3mcgn*D#bdnHwAsFD!*dN+R1kgCRhzei zv|%k*HOX)BD2%Ii?nDN^YIWUM3uLZN^xthazf}c!N-@PgCV}ltta8TJn5K?Lt{-ok zCKy9vp8p**ekx%zy|7svLx&m{-@_+nQtPG#0|8s{WX|Y{eTl{BJ|6H7hEvE`2YV8b z*Et#IpUIdp&gu6WzpyZt9KSHG3y~{(wd6uj@(S`ynhEK4`I(S^=skioH9=A2L&V}vZ9PA23j}rHyBtVax@fx;$_CI61L&6l^oIa?CV<2URr9_dKu0pCG)(UGC?r}j zh3*KTUj>lJM;aT*B%O}8mVqE&MipM@KHexHa`5yjy*68z`AbcrgZUeJLS~hmq~E>B z1fG^JIX|#nd9}>S{9JP8cq@j}`sm}519`OLZXqDq_iW{nA71n9tD5i|Nh}rww!3Nv z_~eovcJ=Xc}^Kuj2$9QFSD&`VV=XJ%#P6 z%8^(C$GciLh_)`y4K%KCTA6;POUCrA^VuU7%6{>DvvAF*S?PG|t+#b+hIVuId}Qio z5=;o!^P~w2^;WJ3448eOpZ>uk>vP|GGMer;BzyzAlM-d5PP5CjJ(QKRt5p z$s~S#&hZqO*sCSl^jZWcX0>qMYt@&nr*wAGw1zR4HdI-+%C-7L_{9Y8l*JZ->6V5t z_OMY>6-UY-M8%XD-yH1-&_WGe?6l(EW)X|t)5atZD*TSZ#G#>^%~i zJBLU4F05?GO{i+fox>we6GmX+$R^jsY@;}eXJU8b`$e$rnKaML zIjx&cfb(r}D|oc`p4SeinVTz(%}+M&I&k*ia`s<29i6=`XTO@>b;k9p|?=(Q;&M0Ueu>hyx|rc%*afUdsOvkrzeH$@iXH^Sm`hdc2;gEj^OK|bWd*a zJ9PF8U+yre6s(aio+plhG>OcITpt`Na+sV`#WXkv{{7kJ} zF@q}o;2>jb;XHz+4SrrL6DvvR=ihE+hnEBg`L`GL(fm6)^G8Y&`uTTQ*>}(!_o#nI z;W>iUNnhcI9B*RNg^Inq$Xu9USV)5>B^O5OXO+r>(I8XBVWKI>{}gWHMIfSi z9s!FjiSV1Y^GRHMPlyF~@;JcCQ0hp2szTzFcJT`24c4oXM&%ZLypBrDYQp$wm2xKg zy743anJAUs;BR#+qReBg_qz9Nu59uM6`y%OqD!x>DxEJ9d z5q_?l^e`3*DE9UQ0mhsWomYn>Wt?>+N66JeOB|4PK_# zpR_!SrCVVN?a;02G!}hp(1IoWH2%k@oICEa-J6+{-gS$$~F*57NZ8A+3EZsx7 zfvD@tw;M>?Rlb$NJLOwLCl8nc=c@SlLq6IT$R&kd99rh(B0wm*t{w)37dC0r+45GK zY0HM>nGA|i>kPM9FTC?J_}T^-TzQztK@&!o_excQVLk?UJ`!IM1BT4c7_Zt5Z3})Z zh7_rR=~d!^ig4NV8q%Bt5QK`p0B=C8q;VIECwOOly7e<>fq=;4#u~3VoIEGtt{TA< zjE}+rW3#OCcdjnmm^vZO!*%Yp-tIT9*MkE$VhzrFTw_UXb4_V71M$k~744Yfd_6LI zyoB>Q2Y{H`nE5AL>mQpYERZIccAKrXH-q$43D@4rOX@t@%8#$3ugrg%8Y&zk<`0;H zmUo&$juRy45ulYhNcyhkphXc>#JqDf=AeRT{x3BG{S%1qW(2yIZv@tkx!e`Q!?Y9-vc(}YnOH-Uu#g7nx;n*GuQN_IKq(G*NM=igH2MC12G{pwnq;9RhYLRn?I0MtrLglq{U-Vo)_w1 z*L>kjp7vhX;GSw$g`d%NHk~l33rhCM%A~f%-OJb{!y?vqO;m<&|ym4_&yN}<@PcTUrGD3iQVldmB8dWoEo4^`Fh(L^{8-ywP{ zH!%A*4*8Df*%j0YP3Dnw79g9AZF6hHpB=d&VK>4f#~pp}{Z0|q^2Jhpc6}0eM%OeY z+$&q+>Cbo@U`ple8{}2l#HiP-h2N7#xZ+)3+|MS5h^8dGB|hp|d3o5p&{I61!TCGe z$12`POYb_&^n-`(H*&uO@qdN9_Fe^R#FeqftUyoZOs{XWmwSBq8Qcv!p$eJxsi0!> zx@MP(Uo;hOl8VjyQ&RDpd#rd9i!BxBQ++7Ah?M#)cG4xaKP=PIsb7J9gpM`SKg=f@ zs^l5nVV6iNcovAox}nmH9imPmyd6*EiBYZALOJK6JF?6Ukr#o(8|+c5XMda+^?Je@ z`+9Ldzd`MXJuZU=Cb;dtwqew#BC912hTWGmCAe_x;r@~&!!bf?zS>lbNA0Y#odKjvfolUkQrY1 zEhV#~_G!|WWC`_y%sV!)=#jAKrJW%77^$u+F-IwN8v zgt&rBe zG8NtGD2ygVHrJ}a6dtaIY)1mAf!|mleOOcO3FaP`e3xHGt%~mrqRCNdYtq=yMacFo48aWO%qJ zY+nqZOIY<(4f@RhT3qIb{XBpk4WP9F^jrYF96;3=)lH=&oQnc!e=i2o{>}%|Ufv9Q z(F4ORK&nta2J|b&<*`x4!A0eMTdoSA2Y|}yK_s*WsGsT4Mj*}cQjqRu=pkZa7XXP` zB@$W+q|a%z0;wtD4xrx-lh{uLLcWNEPTe~c8Zca-F+dm5?nr1N&`bmU7D#KWv{1C0 z9A^Rj!ayk??a`ls-lcz$(C~^-Xd5kygl+`-l}Yz&pzoXOm|KAkHMM;nKnqEuv3;=X zQ)ncR;&gEkwh~B9O`irDXi9k=Nc+1xNOv%@?~x|76nm}tlO)!t6V=T zxJVM^j^n-f4mBxiaIYcPJIN}RADTL)WaIS1B_x)mkImIhY*@A>#|iHjgN(DIbVF`W zE~~P#O(aXNuZlVvRCti@+HEB*%6`WaICwj25{n!xvGeAn*a`L0l`vD|=zcfsI4JmYV0CoDqIy(rvG=TOnF?c5eXIXLQ zc^h{PNYB&c{0j=>^ys(Hk}Uo1f<}V6lkEjF?VKDs@h_Md{=R$;IeYHQFECSM8)6Pm zXUM@*q*^D(rIMVdhIyj4%3UNR+}2!`9GHIXRmXfuIM4Bopk*9UKd9F|<&8mhiy3xf z#{wptEBz*V@67yxaze!srR|#$%`cR5cpmBv*KTM$a}0vIor_rPGA$`+8wJT$A8Qvd z!s$Lr<79Pb|JaUl;J@qiWCc*98Z|zGEooAJkLRBfvAt({Y+KvMBrDicO$eJ4m8VR4 zs66V(_SS51YuVQh8Npq}6H}+*horn$1C0DAEeWg16_>FSb|H4 z=ZXS&T7UJ>eYMk_ijohz@R4)EtmTXK}{TS~T@&YEa?m9&W+XA_FFrs$$bwIi>K zjqJjW%$zR%y>=VEr|Gqs0?Z>T^SS7R*O_jH3qv6!5kZx22_3wBoN%iGkcu8LhW9-a zc3uEo5kS`kki2iG>EukaXn3CZd`iIT0x2 z?^v1DgnXG4)R4RSDLhJLNG1u5cw%L47nXK*IaJsGpr`Dal z(Rtn3T-DsTE1Vh=<*lSuQd4q7PbGk z9E}>iGYsTx{&!|FIc&$W)AK4qMwJ30FuRKFFg+`!I62PO-UKZ#HSkWj-(_rB##fRq z#`|ra@awhQ7y|?{s5JbveCGg*-d=rb_arE<zlj!e4_W-z{c%?9olET1pz5_vkk+UDMg` z#UzTGoq<>i=>9@_t0TJ&sNArb06(4PHY%u{r)8t&NI7Z+mCf3#CFM7J$M~f!?-#s zEm6)q!>3r`VxNVS_y>5ZXlt#^9W2O=qfW504gfVY5o;87a-W>rm*#qE0u8nKoD??S zJhOPQe)lrp$P8zh@4DW&)|_NzPvgrIpJiJimoKrvi32V(?dXTA%h4<%NA;~dwFt#V}oAg6TAI(jC zGQI1_x#K$RkT?O{IOimse^N&X3y(xa3x+|+YUl5VX~XN7Hf*GA#)ib4jd0=B%4}!G zH-vY^#Ux=-MO^HHUbeC)(*a}Lb4`{19F2HD2li+peM<$MPE{g+AOy~aWX+u2NomLl zU0;;LI-4^PdZ-G*K`aZIpK%PmyetMAlO5n*&*|LT5r{=UDfmzJzm4 zjafa~!Lz8Oby&Ct$4%_W2~6elcmXjvk+0YZVLs22&wBIOi_Z!2Io5pk=5xG!M$MIIJ6QBQCm|;)-vT!>Uot=xEP&`@wq60-aTC6c}x(UaAPxUGu=zU?1`c&^? zx%U;}D`MK3pa`f*^r_ofyL<~8(E=Z1Sg&{^YQmI+AK4_$ z>t>TQQ}UGBBpqF1$K=^0#p0`c0>qB#6&d9@IFuSFLq_&5w@Z?JjLgx%EGZuTvz0wo z<^yAo`jK%fm@(!el2FffJfy*oeY(Qs4*ta2p@{=Q74%?tOc+VBG6?0k6xX!#LP=v9 zYOGraBRx`Jl|k%V)JZ8_2v0}?BV`t!jx|DfT*~t;1f)|1!-WIwXyKO>QM)bLc#~ML z`>k{)RHfTHl1GWI<6uOyE)^vAgSXHmDSU6_`tKONSo{_orEyFs8IzM0NQadgdm!g8 z<_R^^cL=PXq2}V(Z1+-$QKN9YrIZUf&l+$L}H*IV9wsKf`H?qcE{>k?z;j-36L439tcywZb~ z1!{NSb#HW~tXaJ2f_Rj#H!2Nq0J^uzkzQXdC;dqzb-ceC@v3^a)o7p2We9FMLR(Ge zFZ$xnoT8nn!Ff*?HNXUzbGhgHs$-2k<{NwNkD#`HfIFY__mugN1okBHbt=44dzC1= zKYnV+($2YGKd8^k>(7%7Ka}7pVn>=OKATPA@dH;W(((b@2oaPQ_lP9HC0EM8KIvr z{U=1broqKn@}OcxLKfl`6{|nrbyu|Gu^us8x&~P-iRciH4Ioub122Q{n^Uu z>(Pw!7iSF&RbH8VDm4OmioU^g|MXQdlXF{g_?Hp-QBs&kL3RrSi7w-hir%|TZ5Wef>cUdP}Z52S}MqDm@Zy86#JxvB{lmbWM!U_93l_- zf!Nk^>|Y@*$!lQ?C&;# z&9yOc{1!FNNh!qZzLsU0S+t@n_a~)SR_f7u_L$kv$o)m_e5FfVa=Nq=Vb1d_<+oE7 zk1mZot4AY8`i(rnG_rg1L_*wS6PKGN%KKzr)Wk7e;yO_Y+8GYNiMmL4ZRJ-$rB}#T zMdibNrJW5`N)&E`r{0FTATqPqd9)*9%^OB6$2p+4>Py(gQa~wTK~G+86l^7#TVM^y zc{@nVVZE3xJV*#f)J(C4Dm%R1PB)?0hx3W?*_Tk_?`TCQYX84Q-;rI~(sjnjsc1<% zJxXMKog3D#-P{lQ2=J*HqSK9-L!Vhs9xZ9y&{22HL*Kq$k{Z;P=|09bDp z60fTz?uj>nH*%5AINh}}8@1=8$Kp5WP*+;3>eAWdJmq@eqZ_Sl@6yp^PxV8C&-G$o z)VWsWdevPRvz2`Y3BGthm%!9d1?$QJ3{%``5VB`d+}b6slN1RKb$@sTkfXJ2HPymm*FB(lyQ ziUkVYst{oxBQLM7r71-NfKcDj1Xe~M*)shQ7jW3U5WC;Pb03NrDfX-YBGk(z>r$g^M-0w}5#*PU<~&-pc~$TLCl=NH59H51?NL z&>w?z;%rDuc?Rf1)8FTTRvDbW3UrUba|ChdBNKZp(5oi)Yd|^*^*~zN!~nV>fNlfQ zI_?Uf`++_-<^4KH_dJm5=BJj0LTgPO-vG)R=o+AA1Eqkp-dlkb8ykVzOnGks?KDsr zOBxN^2WX?odk~QJNSt`Jn{;A(qv^g4^k;+nyMwT0LD+I2#n4Ki7E|7OAT4iS_9VMZ zc}D?hy5T_2nRFw8G~E?I&zP`(3Bqm%+HLYa4)lqEo&wUoy#%Cm`T>wwE=59z^Y;Z) zN*w4$Hh7WHjW+1*GXt2hw!c0KIC;yAw!D{tb|p z{CgnHAy!a2=Hf=|Q`6>;fj%=(|ABt%4*}BFp9u81iMYx@n*UxrIdp99j`ia=Uh z8<5sk&0&J(mX&}wpk3)nG)6yY8Itm8^=_u3!X?d3eX?cr)w7jK2THddLw7eI9 zLZ?YTJ_HIID1_3Ymx08FOKTG!xmuf8b7^g2&80cShD&4b4q|^EKu-Z_f6e&}4k8+y zD9*po#6;1QH6>3>fe%#Bpm7|sw(bGswmdfHsP$poy@M3b#_Y<&*@_sM$tUt)~u|ER=o~ZgW%I) zBk-D5NF%I4zDFXj#@PuMrt0R>90{%QJZ>L zEAAb4>ZmR5)fVqjTZ3CyA>|KH&wH1~J6cP+>;|n#zg=aH*0)QeYd2(@%)>hJ!b*B= z75+sC?X5Im9kP20jjwl_E-gr6W?_iezJxryC=G`jh5B@ctH+&11o}s92~@%2QtMe1 zGruwQ($2%8m@MQj{SAs&ydRlRWJljxj2D}{cL;;$D=uAgBxP#bAbPJU+ z&eQc>TUC2e<;k|Qu0*}6SAX`ioih-VI`$_47Y!$RA|q{4fk#fB#nQ{Xjdvim>DmrU z@u0JSl%mfIAVpBn67k`M_nApJy;Cfk_)1=~YYB)2$^85UG@ zVgPB8CC?E;P$MX{Q{B8b)+&DQ@+|2_Sl3S4&gU3^rMCI~?5sdc8%pM@d1}$aube~v z%9Mh09W~FI&nMH+8idC(e75k#hM-RT1Xdb2Usvb-&XQkiP@}AdcD`|$eDcpD_r_^M zJ|Xl$1Ty|3be=?dj#7$;crMuFwPFU*JG|o8>kQqL-n=68qyy)9p7gu-BMKV~1|p%K z18Mi33?QGnMXbKc;}e(vU-nA67%K6S;~!X;ddjh#7oyB?yd_7hh5I8|8nXmul+4PI zJv}lXwaghEt>W~7m!W6TcQdEV>DlAcNTbN<^sRF^g`hPy9Rsz>XLwd@Dd7xYrM+Uf z_YXG=H4V9IN36hx7(LUKZ_9pn#u8hs#i`q^vt>JyS%jz&T|sWzCRfTjT4a+VXOwRJ z+v)aC=058*Z!SDBuI#XkZT;s)oYho28+manykXepFcx{HG|mvi(M24`$pr{@)g9|o zKhS$Pp7kXzQsDA)C(%JP&?Wju&MP>vy1a}^<(AwVyeH>f!nutmJuYSy9(_n-t7#Vd zsOSm_XUchZWa9a(PjtK=Yp9Oe9&4n82InRWPkA~c+Z4BA`GhmGtiidKof++TiEUe@?c_(uaE?d zGh|{d@cWn_Z@MTJ9s4I7<3Xk-;oLmZb}pNhA725E(BRxM$(%87;e#`Z;t-#saH`=M z7bP#{E@BCC?=U!B)0O>lTrI)=a_O+-wI%<6Nr+#bEL`rnva+W>V#O}=3Qyf{5cE0K zyW@voD>&A6FPoGY^`V$?a`I*_Lmn&s{@uM2?)L%?Cyi%hy<@$E^9jA+KIC{YHKebT z((A*{c>F6aTw>BKFhA}$rh@FLUSIO#rnL*;2drUl2 z5_8^o%QO;C3ldM0#Nx;ZlbfFacCs&L{4}y)+Ciw9u7$ZkGnViya6I7Po}WmlPfO$l z7{kH;APZA59vnFoS=>Ann6d=v$Ev~kS1QjZ-mboX0-v~FqqgJv3n!fnB%4t-AV9iE zE(8+gTO{-d&`%B*NQ^6QH`|jjKxdo0-vrVejX*y#B5f1Uu_pGfK*LSR%}f&AzHbH6 z9C5~3Irv2ZlnbEyfi#D>mC$r8LD-u?SZ~;trW*#N=|%<6|rgb{X2cn<(tp|@}PndCK98XxHZ-k?>(8febyN+rV@`x8Y0~2r4N5q#IiY@ z9LV2ZsfrcCY!K9>8oT$9u<%mY*_L^hJ!bN(TkzOnS|B2Hw+4zZi1-`K2IXSfAc3`i z9v06FUc+J)M65$+MG~1Z>T8d)d>-Akt@=+uBA#2dRL)$z^Zme5|I#%_knPvVxRHXh1PnVk1;mWn1>3A2+2D{w^x8#a!P`QQf%N?(!D15YA0;_d3&t%K)Tv z?c_q3uW#oxm);p`$kh!_zQK7~8;>>gKkndPVD$}7dmLw}QaY#dMm#HdCbwYf35c^K zW{r2XxwzdXjSk>NK-$yGfwZSr1L;uS1@x@x{T?Zg7Hmik)Yj+6*O8dzqlcF`rN^N} zUSx_o9;lQu&-3aC>>V_`ad$R`VW%u>~^a$nBs# zm*ZInf3@<2kW6{y|2yTq;FtFnfVsC`isw?}6!2{v)W{VMaZs}lFEPRc72my#4~M`( z%{@dIt0aSAX>WD~K_1%mrHa230M><7^}u>|OZU`e!fkWr?cScLKkApd-ZS-n zM0RP(TVe~5>ocu0b#0SSNi6~I4;M~15=briZwbPF0CXXQ9SJ=Q^pJrb57O-h`pD#! z)mrn4p~y}XHaQ5p7ihN$TN;G50cm;tSfjO$Y9K97EDkm7Tp%rPdJrbJ&9%HA1YrSB zj&@;G;yu)i4-?tSi00l{JByYfeM3bgHNYNq^GGXmKM}Tj0b=x)ByQ#rqqmq`|97&q z5$KMSYO!a>S(RzPep3Hox@{FHS01KKax5ypsdwyAyR6J7;5>bc_+(iQBv(KX)%2Zn zo@=_WtvF1jwt8pAJhmju8%Y(zC1$5E-@uDoBHmpQbvD(zGloRn@$>4#Z$#5?;LdE& z@_WcY>Sg@Mzu2hO>mR{+MU8o5R%Fyi@fE;*9XgRI(&eJqSJ?hS7QJE9T6dXASy&Bhe_T@(cYf6N0>COishsvpaW)I{_TGMbm$e zkXTSm(oPibxPFBgCYd&fhVS>XN!6!)J2pGbxyc=Z+G& zSe05Qb;S~MT$i>kIv*<|SH6sRr7D@%Xp_nRf1{Fd^(DaXNiF}kTAzbNBJv9tkzM|AJevr=+Yo-QVc5Go z1IpG!Xp1x3bbHy{|FYemG?FMjJ(5X;TSd_$MyCfu+zIzs-^vH~3buQ@6o}B87}jc~ z<-TNm*wgXwGbkwvalTBx8wGHCdp9Y6#}~7{g!s9v=Pfcw3FZBLyAbXmR*W58J|K0g zn7N0-V!h5SLbo`qy0yt**eR925xaD=aB%1@ZbDPO1%F;V7z z6IsL7LOH69t|XLJ|Ji3B;nfYJK5nqa;aOxChDzIs#Vgi-N?5NWx~i<+21@J019cG6`_Mw&v9`! zWRsZcEdOHl-L?jIF7HylUzYn5DN7jnQTDLs!GSBc26pe&JH$<)7_n()pi+ z$Zw^uH>F@zk{ePPT_IudVO!Y=VD!>rI>!}=UidNTHTxnvC%r`f%tu0)^ig)$@R!0c zBPDq0YUAOj>@aTahSj$gEMlUMh70{9g*#yq$QFbaZw3%%TUg8=thYH{+3t~PJXcSJ zyjq?XcS41U(m?ikUMxEjkAvgCMW3~a55t|vM-2|cGWPAB!-Dq9p8(mTML^*_9NSsg zD24auo0dS|AqFSIkKnX^JLFMl7mG=`C&csHI|6i|r}G;)=R)I1nHLk(n$-}hS!9Gz z!`AY_&?hgJy+T2a^U6nC+2@TB=D4!L$54v&TAzMIT}i!uv9rGs&t>@r(e1rvpDU*A z*=xyI+`k)w=Db)u86DWy=s+3iVXWG8mhOsPsr{JTb)`Ft33VhAie$rs((q$8*4{!l zvx}9ocagZbbqdL+nDuQ9kRF)s$7rYwb~w<`gG6eZ5V9< zxz7`3I!o8)78WL4$=1PEZC<{R-xVARHDQ<13acbh6Z_2;K^nhXLxaB?T35fFy{Dex zM{Cg6cwMDJGV7U^I;)-sra8hBM}#s-&optY;Hja-mp!`n z)DTYIk4tjocSu+DW%Bq=)#XT-D6c3vFLe@dH{E4%5M->y7Os_fC`Vw2)HW5q#fPZM zAcmg_6pFB?ev^>rX^?@d73 zuQX7p+Nwl=F~@}65Pw`3#J9=gBp7^eVxboosm(cb!{_;7V?d zUNe?G#7a}%vj!hBT;Uz&{GK#;ebjN_?^>L>o z-u!0d9QWj-{p$_(DApX~T*>IGpBF9Bux75UaZ&yed*@cWcRi=EB7t_6=RF8|413nd z-aLd_le&);m;>!*F4VssZ9Hx7P|9rxe`>Ci%0+NrClsh>kD`6bL{0~~*lhD+Kstrz z1+m@apOJzU7ZP0uZ(P2&+)DZ}U$(ms zF1=V%*02g(+Rn1foyO?ODoQPm(7U1S38zSov5U&9aIkPzuDl9S-&#Hq_X#M;xPkk! z6ee3w7;d{5Jc}BN#dlxHA04@O^6LqnD^54b7AW;zJaai)I_G zpBA5-?#Ubfp!`$=j?w6G@d7V>`jf*}2s&`pwbj)BmdG`t&Ga6FF>=T@0*m!_x5Us- z*M!N#<%-R|f<)E1fk2O}+aZ_2kF{)_=Z0#!-kp|)Sm?SUp;LhR8c3){eFGg0GL@!e zXf-S!Kz{?$g+we!OE{IUR4v`AJtt@MBnv&Uh(8_|7HQjzGulya|LF9!o$J{QRkFUY zFpRHZaIjp|b1+#q26cT9L3Wq4UXsp~;`yD*Pl)3#k%Tzis*1UDhPdN8_im5q-YvaM z((x}gYRB~)G>xkfp^IhXY=39W=P`CZ-MJm4ZAR%lsggOZeK6bO!hKSVGlyN|BaMJv zGEMYsB6)KI$-a_C%93)TM-3`1nNSyQW~e}l_YQJ8bEM!SQn?vjTE^QUUUQgV*bfIS za@vc7e2-~nkrQ@Ny61*{52KN4!gw0c6NXv51Ehl}QivGFMG(FHFu6wm`d$)tOAzJ; zkTR8S{v0+L?F^SACa{P$C8yZ#)Us743wr2353;s(vOiyaPdeMO;pa^!8!^gWXNS3O z{B>k=bfiU&@aE3)M0k>>h7=DHn~l=2BqtFF^A)l%pj25TTfnvnLy!|cp=NX~Hg0Rt zoE+JO{c=90vnGu6u%?%%UP)n_K6g?rq9ocGQJ#7J0K6rlcz7Tac$rxf@_uG3(?|{q z7G{bc{xBM1o2{48456Y#h>cWn8Ft9Xv7;l0r&jVE3+pzksdJn4f^4&r$0WkLixnly z1&-H$vZ#5`L*}^-^I9OC z=b~Lz@$Y>gT{}cEsIeuYp0}FnA&q;lPu8Qlpw-(8{PWap&UfrR(6(fF#KDi&$q+IWq)R=1UYw&AYncm9? zHY>fUsvtfZo%WqHAky60w|~C0-D#Ub3UTV6|K=w&ExjpH=tYoeMdPkxtn3^xLdQ@D z(EDDih{LrM<^i7)?jcAq9-$B)<22N|^+U8N3}~db4Kye|N|Et!W6kQWgZYAW`;(F< zH)Oe;J6SLx1FEQao$CCCoAF#d=i$N+NS)pkE=;23w6TsPe+(KphCqs_issI*))rnt za{2N}&boDyHj(?a8>Ed(Xy00Yu)4P|K5Dad`=MlDq?|;qT-rB{_Qk5rSc!K``7k8m zweZ2hdwm6ajSyAg*QglMo5~9Jo8MlAe>cAsg@5I@t}S0>Wml3+25dedAg&kFYdHE4 zA)yhu@urraP+o3)C)wR@$`4Ti&%Ft+UEPJg(SOxh%U`gTCl72%|J`yv=s|x>A?x-y zrN}hm|M8}>3j|@a2jwo1Cpg{`jT*QA-=^ny912w+&_5=e&vqW&w}qgD zli7Ex`Q0cZV>>yCE&QF!F4(*k9yK?63=1r5kuZ0q#K(8O7!PlXuB4(6LtF={pb`hK z=Qt7w>t*L?`sGmJ34*)jVbX>Q;`O^rI88+*-(UnZo zPz)^_MNvoL%Mm9P!_o#&nykfLatZ6`h4vJ794b85J@y}#2~io5wM&_W zZ1-{mEs;a%amtBN_T&D&9MXZpx89CKbvzt+#Xf4$Q(XRpFj3OI& z6A_smgDJ~ioo=UenGN>z7I|~1U)1cmqR+j?OpI`MaNnk!-H(YKU#}&_%CxcRl_F@6 z`A#yscZs~w{MMmhN`@f386*k7kVrCn`bHebD;8s;*2k=K)*~?q7C~VjCo}MA=Ct$2 zfiml3&I1FR?+Ob;7 zg^!pLm5Q@h$&ABq>*0pmiQa*RX z#OaY+dBo_9Xh*AG^7L@=0S~Ts!^L}GnKNn72T`j6&qYntso&P1P|>N+Zn=5C7%v?8 zffc7e2#3b+$@h?+pmVFn$fs6~5m#}7A<}FY^|IW;wR1*5m7A<=!HsZguD2%4y;Ijn zvkc`V+L6d*NAj~BRAIP;8yOiRap-ZMw34?Q? zyo-&`SlhWzP#t$~sff8h7YTW6Zs<`ky(OZrKY_!eBdJs*=?+u1oVJMDDa?NpquynA zS03dgym&-?`0beUH|IVnK|*$}(-AkNTiMH)YtCbJMAo|}5LX9t=pS=_E8QrLj!%C| zrclhiy3cwqkUOq793I{IvPkE*#H_mQUikdK8`139h?XYRghQ!{CrQ>ZBinYv(5QP$ z1PANWCq$%3_r^Z!vmHjnx9s+K^WP(g$Hzk@P0q^GsGDoV>0SM;g{u&dP+~7Nld$~z zc6jp{9k0!QR#pYA=*vbZc=5R~g<|U3*0H!Pqa>gzD?1Q&@8$$Ad{bh=KJ(*Q+a+>8AEd2`SlNBFo$Ry^Q;0*fVG5Ncjgw0r z-C7%6RrUWc_b%{JRoCMGOc-IJ;0cI|79}XvAU?oqWr~js&cGR*fmlV+>#L#^S|1c< z5Fe0)nGjBo1K4WS)>eC4TYB5xV*9HCRZN1C1S71zwg@noHLV$ zV(b0=|Ci5)%sTt*z0ZEEz4lsbue}!a#YV1I-eH-W`KN?y{~0CUD)|#J&flfHe!l0N zDn?ze2KUAMPf@I{bN;t#J10o~2!D+8J9N2`yCR|8tECEKN~2tBo=h;?Q}@mx>TSjP z_l&EWI|*!iYV+I=B3ZLD)EqG;KL?YvN;(G&{le3z`%SePO!=UUyKegpv|Ugn;7i@K za)vp6aNims}-@_xVuahAYbJLw(^@;+Fua3|dQp(tZBt*MtImZ~B5CNBh~?rD&S z4i7YDh>7x_)Rlf?Z+NZXh@%wA-3uJfF8GLE5Rv2!+89p%v#)XI^FT4{ct?V&0t5RY|Yste96JgrkX>{*7FBD z4MPNv)iRu&)nTc!n$yfrWTcbFJaSx*c8C>Iry`;eYjxz}XVsqlP7GCR==#n16U zGTDN=k<5E!96Os6p-)oV^L?ZKk3C{(+KNOm?u42+R^pO?K1PCr_p2Pd~lil?96&nP{DcC%YkUj`MNeu)f+=`HaIy&F&=rTHgl;-FDMk0Gu?nZu{-sQfb(mu{z#_u4S`ocJ&6t@7)QF_#cK>B+4 zVEB2R_BfEXm_Htl^9YIsd`b8|{r0p0SVSpx{J9=96-X=MBrL`1NPLp~=6!OicE&m-sp78ZEi4i-P0V zM@IWOV|5Sjlo}S1I(G>aNi^fSi$4U?hb?+u(r@dN6k=a;qF&BPdW8&loZtb#dx{1f zb&KA-Z03V-J}+9luzjKbSIn{mZ{~0plD`Y-R?$C@+$b^XuiU1i<_#b z4(hFk6srwy#sv+ue>>?Mvv>;M`h{8sV}X{a@1Ni8`|hntOgmJw$FyR7i0+poH7@gA zxlWc+P@(Uq4umrZ9nK(l1E6|7!u#^cJ-)1mw1B=vqu6r@zeI68gi>YE5EfsORJw2_ zZ#l*#P>p=ixr8y7U&N!H38r4K>DEUaiF0pUklKsD&KZ5 z-yR^ncn@NC)X-5Lq_DTE-QhHurYf!p#qCFGD6GzymH>#^j9vSXK>F-J`EZs4K@}ZQ zqM9w&Va<|P^bBd{g+~0VL^YG(kDRrgRdWs_-sw-7rhN_-Q**(`OLULWuhM3%fx<(L!5C-Q_J*t^%XE|_MWe@)Hw8$NOG`7}pAR4r_d?wOvN!#4jD z@uf&F98c+(R&m)^JM+W_k^=_NkGnefO*MFRNB3waMM&RZgP(^Ouv%sElz^_6+`9$uWc&zb;vIlbL%ZASPW z2-g>08zd1v8HlNx>WVFbsrM|Pd`WpzZmG3K?jc(U}#Rsvz{>w7+uK&JF zsvQmVxc<9|c^_eIYJ8=yfAh!<{w8PDbN*SfB>I7T$?R7Dy}j1I@ZYKb!`|vYtJnIE z{dele`nPBMx3cnkj*pyz{mbLCx3~JmZB@_uuljfDhl}Xh{v&&>UlgwYa{Kr7R{vwv z)U*9R`FHBy-?RSYe{`=qHNk233&q#cKNBxMS|9zGBg^*uq2aZ%`{!PkHjAA~!ew(h z`lnJ@0`HvB96rR?A6q3TX?Or8OIG-B(TIHxPrNuxrH~fcsh|z=RAHu@xC+Sng;n&K zP;S=X;&=GEvqR=F$kJT4+|Seeo~8>lW|y=6?WICCormVd@*w|Ad#MmfFI^twUzFw^ zS*VuFiHcC$JwDIF0h#$x^4!>`(IL78_8;B zCG5dPUf4}HHt;6Neu7wp*8U@*otv0zOs{Zxr`amk2* zOCkgPXx5KFN zQ+IKXQH=$2pZgKX!lmime-Y4!gM~}D6DTlTpdSEDS6uHFpz9Pgk$Kc&)dr>4nuZLmkkc&Kvgn)V1+FrA5iuwp zlKy@gI|&b^?FbyU^2?vaRwlSiC7!b(0W)-b85Mg-*;@+Be83FKYs^Q)>?2(=%40ukUG7A3#H~NBLfH|we^EpK(TpdrcE+N6 z*d2$pKKZFG=lpJ%zL7oJR+x992a8|ax)wf^Kg4WS0AJ&)H!(ifU!xTA;w>Oy*GV(F zeLCDZ)rl!nNe&gs2#Zv*_Y5kthrF|exNUWV${3kSa&k&1UstyyNArvq-_+Fh@D2Xd z6oN+~c+-}LWgr$_;0OZTa)rXg?K62N!oW&**NCo!_m7vpE5ZQB2#le5e{3(@bYm_d z4|VNMRmrcoexy0n@jSBj70;Xt4~yCXyr;W+ltNIBf%1LAfAojtRl1|EQU4(n(6KHr zxU`A0*GL2?nX73iPNiR;6#(jF1c2AwX*#yYG`ZoQ{>DV$=v7rG$oo2B)@$gx!li$z zp-@Yt+uXPk*V)Z(1g1^o?HMq~6S}sk$^H$QyiiOJ@*tf~H~cf*(Z{IYBEy&+FjNNK z^W=kd$i$iHoqNvNNiy-7A!O$)SKxn>{ZB!_bjN6;PA<~o5v3eO7ejVgyakC?h1cs;i<9%%bABp*3S?=a}CnG^b=AO!&%3UsL#QvP|0=P#Vt@@Rd19< zS8{Q7;xsoDq)=;>HLT1$R3;Z6v)`=b9BeC<=iO~$svNOXD~0zEPd5m(4?Z0(e>Qnu z@9j1ot&`6a8KR)&{EjH*n-t%GCfvquDsMc+U|%=dFLHtY(F2x3&n%tkOW z5^k@YI2`FuE({ydmpR_8eM+{HE+T$RR;sXPvI%RIPZbartP%T$iT`EU|@vPB&kfY(MUC8YF(YZGZk97Gn#2n zo#xUkG}23Td?!L@q;G|0;a8yxR;rSq=GkpV-Ct>d6hFx=KD-CXGrAYA`Q{CuxUC7V zVi7xyUQS(fV{d!0Y9wCzo~s&x*yayX892gFRDIN>Y37>ti(Y&9M^Bae%+RKV*Utc# z8d&dBSN2$JEJUupt39a3yuttZ8!VWY840%^;iN4umU3$j{>{+KuN$|clW!V#9x8&s ztX9Evr(vVUUt`{9&T3HlAJjXIZ=Gj0cAVgEBh}wxPG2fJj~Qw)mTrcd&rOtB?K;K` z@1M{P`f|7PJqS>6Q|cnqn9>2pND0;N!&rW@7>v3%Ij{|{6-A&kbi|$_sc60(r{ilSRd*-1o8pQ_ ztMlHtJ&!GHA@sR3IVE8)uA#DSv{}cIb9a>_?8TJw7~aFes|5$eVAhEq_cBh%TRU5)gJmmUw|uJJOdO84mF(VsfF zrn&^;{!<2@n8g*oWIqN=qF+I1DyYGkl3{$yo6F@QX%^TOXD)A()UK$Rn;~g5Yw4@h z1o5x&34G-A(X1ItZo z>2i)4EtLUha4phw{+ZU=Rs6)P>dM?=h4aWw1)Sg6>o{%bWt<)*?ST8SQU~*x@oB+~qTY&W22rEphIfVVxY7XK5w3_30 zKsP8s{4t;ibq0KY0s5&r@bj^jbuHHc>6)Jb(r?S5Y5J{rSo^XP-MQ&AE z4W!%G3N&A(Z35EjfxSTOoNonurF2=VTtrw|OnSg~36P~)bvw{7RkIjX>$l?WT&KMQ zG)lcKh3VC4r+CoSKy%c0zX=pk_5B1WrP6-krL6_hWxo`3+dKv6c9ri^AYFDH(9J6C z86e${?=fOomG(H09+x9oyn58;1L?HqflgH|-3z4qaTV)dw{HfJ{>E)Udft`*>3O>c zNYC32pzo@$y#=I8lrV~YhRLWM45VAN7-+f5w-iX{yB|o8^Ql-LXeZO>0R0xq81PL7 z(oUx51L@JI1JVwvn}Eb!b-?!;knWK_+{F~eUL?^`afqzgf9FKHw{tVm=irhIFCC~m zID&VMBq{6=Wax3`8%&0}jJ>|O&#}KgL~i9h#LUS*SMap#73#_1{l33aJ%K1vGA$&M zLM`&hzqs|Y27XAXU~$Ml@BA{YbhYkjW_m2|3-2oBsX1Nc7P9_is`s~x8*5|W`9c2U zd+mH!8SeU=Uk=G&KjJzf$2z>K;Qv_uo76GQtHZuV>ae~)Q&r`*c(yz>r)%77&FT4o zLXoIoCjY0^*f%gr#Q8pdtU3b9QZK$un$y>ie4R8PT`9xJzi9U6^TLh)=o=aL?a|38 z5kmigtHlGXJdTJT5_GP%vY{9r!H;P)^mNo1|8%%WCWWH^&$UhPVwzU>Dk9^PTk37gf`qLo4{4=xmD!QguVAfs&%!T0jvbIzj5||*hNMIL+ zYtOy#aQrfuVeMi)mR?xqOP)xV(J-oOzIa&+#{C-gK_IN>ACki3W|Yl&UEb-Ict|Q% zV&I@e0+>lYmezLN5RZDY=!M#fIgL2D)7uulvvq<)xX2+Mb|UsX<#+jPt`8ig75rv% zV4GA7K4at`3%xA%rTt8MFlT0)lW)7Yyv^F~pz_A%33@y78jC+}0v?^?-8Jl z3VIS~lY&lSV*Za}F@FH0>w6kVpAJ0-q>oJU-rJ+8U%wUOUj0^fI$ic=@9nML+lRfk zqW0Bg-}K&g07(#S+{;4Ht16YTPYibe8Em<`jqFxVU(BAkiC8Db%)Ul*QTp3!j@Sgw4&SXB3brxgx`bs=9>FI=M6L*oZ`M4Fdp_@2lE$sCSholB2PwON z!mWCa@8FXie3}ZRG3F{DJ?7r=U9rnyWi*(b>{qTTas6d1dVm6B8bU0y%w2%i`>Ls8 z0H&8at-VFHR&g35iHKSj4(;LM#CqX0ASQ}tM7V|%9=Z1xjw2loBW|5#-9nt>{JE}2 z9hVwR84NWDcRrWg(v=$M!?hx6pnWD4dm|oC3-t<`1*Cf{HgiQi#zYdV!A0ZU4Q#bx z6x`upV`@gYSuvURtz~w2aHu0W6$iwjPmJ^TMzUA=!=aDn9v`)~PtFd0mfC#rJ_Gl@ z;Qu6+{+cg&I-Xo(>84=k#?ir<+eIoQs>YXtSa;zG&26Z-A z;lU9rHY92VSNbKf*Xf8Wi2@9XHOqH>YaZf{9(ZjBqIT$|B;p80OC9B24k6w*Hv42# zFjv>$*hEm?B;t!{O(S@~eDPwDjI5RdW3cFAnZuqT0t~AWNbUv2tUF3)$C@LhLnI|( zMM}#!mI#!hNH=R6A0o{hS5-C#S0H`GHl+|+SsUpUyhNW&Ry{A1J!lb7o1zk}Kt(g; znvUw#Vv4_ROV+sB)rI=9Z_AoheP7NqJIdkCj^e!G%2;Tfa43&T!I*va%i?zHQ#ce& z5hltCWOy9kSx%YcZ^6Ns6?oa<&@ghTs0oEDbEj?w30zNfq0 z;z0@viWelEPF~9x)P~gNeyQHu@rlLWeyYU!?aFeo4+l+Wi&wsanjey0jk}61Ufwy2 zmXj>KY_2TCCz090TN&9k?Y`D)RMLZV^NO6JGdHEWPDT3qI@Z=A;uXzkmkwDQ?aLUt zmy%zF89NLfpo7ft0Id3EGxU-00Da*BI$Rz=jrTTdpW*@f=HUSp(JiuTXfOs&fD2F` zSDolaa zKx`{pnQgAwNdbG(Y?*)8TlmD;B!Z$GL+Y?aR+Bn_;)`{%_)Y75@K;Sly_Ur4wIo)5 zpS*<}^jVKYU3(o06J66~GexT?t=Od#G>0d0kwpSd?PjX<^!lJgxVGN4w8^Hm2X}X} z_2t6UEUFY=`qrVG#GcM$`qm*nBcoQV1Qmiv8p@wH$8!0Ir8?Y{ZHfgbCujI$RpiJM9 zMO!d_^xVPv+%m?!W9vN;{wJ6AZ|oc&a5-ALUglc3YHN`|cD*oj)*|_9*GuR;yr@R( zMFP=_e}+pNB9?j@)6iaj7O9oVai)E*KE&J1A>M5q;*E5bzHH$Wxr917U{4rofq|a- zSF_^Y1&k}#)zS8s`Dj3?yIxU{jEcx$0pA|}E{05Fhs7|zuHIe_^pb+aC6b2ZGO>o1 z0==o;?gSFkn1E02ejml&jWQCbm81WF?<%18$WaKe#V%N2V?q~}&BGIwpJ7g)-Qwfc zo!pNpypIrlOypMbl*+C@X0yH>aOFB`ccN-|`&(}@h6-!y0r*5k?)0+C@~H5$eX%SU z7Rv3U#Iy5)>4ihVt4C;b#9oMG!9mW?c|f2x?VvRYeE5pVL4;>515Ur#N9)0Jk(Ker*7ThxNmxaWL%-VHIEo8D-n z`V;<+D6OxdS4d5RmHxR@!Cw!@TssaP4}zV}#@wGL~tRg&?D!vJO^TF2f7CsiFHW?Uc*i?el#=jIA;quc zLBFb&ZQ7}D;JgZ+9Q_g=7dc;@>?oIb!UAoGu#=UrlgAY3Re`ZYxuh9OO+P)xQYlI` zW2xw859JcF&O8x#zFJT(xt+5;?Rnb#go901pcu*m@^JOpy2cIol`3fM-$~OV&vd?(X zHlRaPzQ22Eeb`%dzGFS;s~!~bATgxY`F`g?jULpi_r;Bb77beskx}8Hu((!J<69-^ z{Rge412|3C5XLZP@q@tNsgb#ofpGZC2$O419;(>fNNBr}nZUbGLFW*s}={U zNfD(Rxuim*8Rt0aDUPF_>Z;0dQJv^;97oOIIBG^^uQiVMY8>m<$XQfxHF{@J^Eiu| z!CBOds$Odprc$@jbZg`ws<#@QB}W@Mh?-HQ<|Lf%tTYyhP#(H!Nb;Jn^|BfRPlt?J zLgiEZ*>}mtMvvZMbMjO%^|VQ9lAqkz@T;25Qo_|GJg}B zFuUGm2prRyW>Oudz*xFQvbc6M`*5+ZD5dhurkW&odi5$+_nr%sgJTvM6n)IHJ{tPK z$SB{H;0fm}d!+Smy1MBt5llejoMl2VkE`IZosHJyq1Gkk)}^A_dcewLa*n2A;l=Rz|ythHnQv@kz3}4;lHh|a4+tHD3DT-(L0~%BBK98){ij%+dUEeIaj%` zZmO%x(ek&PlZP&>FfupN4<+b2+#ObONj$T5v)ulg%ixVkccSNaG`ewX%Vayyh9?bT zojEFBcbc`bF=oAJEv!g)mKk+_Qz&=UOnY(}5kKGRYo9+l)HJ96xQi<191CNUIz4|~ zOo#o7ZE1+x7gQvM2R89`?yH4laly-#M_z~seFl$QiV7jg*HF1O;BiL^*L(!EOCG|( zryo&ilP^h#ou)aLo3^xUT> zMWYk&bNGzC_yHul#$El>JN;dR@pr?Hr5mcu_Qgv4GwS5(6T8169cU9J61B2)ZQiv)I_$$ev;m`&&yB4GkUNs%+cT)dGoZe7QJ zj>25l8N%n`O~Ostn* z9-MTUa4%gRsw%C@Qeee){q>OURcp@PJdA+ z?T0RRw&61R$&+*ikO7!^G%E7X9eEb&$aZBkI1q{4))J#$^H|}lAw%Q5esPB=qUsuO ze26m@Ov}4k$VH9F-e?`}LZf@-wvh4YM+y7!5%)2}VjMfpaj~C2nEUM2P_#~o`p#)& z<+ONcS2Ayk?ob+q@c>#RZ6qE>hH1+`C-unjniM+UaqyELYd@FS#@YJ?LV2W(0lUxcsa6#SoxR7#)WKbY)x#xEJ&) zbI_bS?t&P?Qr9_XX=LVuqxNBfvLl=O2*Q32Jhd-UIR2I9^Z#uW&&i?8c>1A<)ipp5 zC^GYHAWfLkK$r19;9JSxJXja-Jq`4Zf;Iwap86l&+Y-=KzZIu``t315nv@l`XHHC< zv{@ch>p}N>&_98`3HKZD4FLysDAigykgX(wbAg^xZJ7mhIC(ij_Mmp460jX>K^Dk4 zOkTiuIM4^A2Ykl?=~i6}bQ9Rk;WW^96m$=e?(csA=^p(7NcTu$&FZ&*_ufk66#dpy z_aFmSMI0Zy zvem|(JT4p*UrMD`16yn(G`dagz@9=^EF6ouLo;;Yd?RxYpOLs6&RrJt3N?}<^4e_x zp8dZvM_(f+401-S?ElT|+0Bk9X0g+qC(4LeJbO#IoSTJLOI`#9E*}-{G2%aoV>fQ> zEM1{0*Qai$yQgl<1;OSq`e@4^;V_$F#lb0a#=PT_MJ9X@Ax ze>jdoHjq zZVRRxDhZgXWRX~C0|8#d$#G+@ocWPp!FLl`Il2MC>Yy-wUc>2@feC9vtnsa~8OXf} zBZ|ZIXcMmpBrnB+(adI2H*o)|Es`A{(3u0__C}*9b4k?N6mHCwgxj0?NKSUr4fq}P z`gh*ei(%c!6HGhcls5(;`;qQ7VA@7c}+P*AXNbyn*g)5T%Zwayh z$dP)NBTq*Fuv%a`w=^`q)hGSxkl64@SAJvkg8nxc+m%+su#_opqjq35`P(x`ZJ~rn`LWv{_i7cnDEZ&&(-^h$(J)p<2 z2_lm27--bXp%QvTSKh|)tcl}UVg+iZC4Za?aBW1fF?m;<%i}*nr6^3;AGa`%aJC1S z9unOPC}0x4$s+cYim(`_WZnlGfbdqigyxDmr%rZuE(IHzdYa>2ddS?yLlH4{bOoY! z^K=E5sw_W|-3TsU#4Bv(R>?3ZZhs%I6NG}35GOd8d9Sm|6z{YzO0o`pntF{0ThB=? z@_7-?z0ZFnjVkN~&gcJ5s`vSAJj88-Yquw_z!qBV1@2H9kxeT~+#xa|kd&p;Ou0=q zTDj3Rt&6=Q#hlu^r3rOZ=`}$Z_nu9-wzvsXbrxMUoUZ$Mhbfe30Cis_k2>&euU*Id zm!z(x(hkVCY=xJ=DUSsi&@(eda`C4%d9)b{Y~`wmj0?mHHQGBYmh`^BEfuB}*t$M) z;%DX$wKhey)8UotaZ?|#Tb&)#K7bp^lMdmCANGslYu zH%9y=BeI=&z`aNiQSp{j!Z<@U$-{36zr|y3n${J10xD$!#>RQXIbC5Yz!XL07`bGb z+z2Buu)`=M2eLf7S|`%}GMNDea+rev907)c5;_>?t?)wc<@>f*R`^rcx33ihl}+@- z?o3fXy@(Wkrhe!Ij7`0XdaB&CYedwcDkHOirQBXQ!k=2mS!sJX$icltopL|*dhQCI zR`C(A9@%55Zdxl5@3he6GEt#{(!Q9mUbK%Z?cZQ+zV44$*Nv#?DqF`K+fju_?=X$I zeePWD0r2Kh&K-Ns<+GC7RmYQCOsWM12nU)&QNVAn_io*{Sb&(64~B1szTex~%As zUr}k|;z_e&4+1@>(tZmhtO|$jK)OU9)|LLo!9e;OM+50^%mR8@l@+Hex<29kXDPK! zG~hx>pv@{@HIUBN0Q9;_YXOSr?;6MMpQ?NYYW*A{K>3(<;g-K0^Ux(3Rj6`a+%Dtx zDzU?$4ifF7MeY~kFwSby*PyX@3wM5fHmHg>FKjrX9c%dr$4niaL`FKA3gtG9mqrk3 zt3*X&Q8tUCJsY^9_P}qN_J!qgOLjB7y}iiMB2>yc8GwgJVHhZAveDR!9Q00(QSBul z6rONmJ;G zJ3P~5c#d?2M^xNugxH{V(<4le0`x3mHK*S^d<^cB{V53EBGqE6uUhmG+scpy?ho(T zf1(UFFDHfN(n+RPp7u5>chg7U7_gjtf-eUrY_lve&Kxr5T83l~-G>p4i3@^5;^V$6 zE(nAtoor{CWR{w7X2m}#cr|Vz+45}|c2~cWO~55?fRoocmd+}{sqyIr9}^Cn%{O^+ z++HMKkftB1A~wcDs{Kg=9|xU&OgiIMU}L(q%=mSSOrIWtb=J20yJ`{?hB?ffz1k(F z!{CCJi^Zw3uhJxRfJZ__7^ALo4^6xBQFxjnZgX=~ES5CoRBY1qbQbGP*GNnZZnQN^ z+OcMl+l<=CQ!dij7mQZL0+O1YTamE)b`c29^aKJS{N7Q#k__6IiT|yVflpk0pGE`2 zPssShtljzHMeRqBi&(F^o~_`lR7m=WeLZ8hoj0De@Pd$>?9>)V6{ga~&l!01r!lSh zqn&-pzWCXeaOim)slO$W6GDwiqE}u#;Dh!ie{yof?k9LREH1gASsZ;&4qg0QFj7M8pQHUwczYa=CqkEWl&b zJJ5dlhIGE4N8~4dGB5^);mTOLdLWV57dG8@D6R;_yB4La?*RIwE%- z0~E1t4Csqh7tQA&ehDLozgx`JgfX+W!x6jgNO2?=w)!d5oZ00_TI|BK{PZ0lEkDVk zep77$q8T_;ZGOTj%N2LW^6L^PTm-8(7W~$8)QM zVB8%fFhu_*0qY+bsQ-)OdySLHim%O zih#N$)<{@6qD~-lzKDR@$}0ra7m-^LP+uZ-3u0$$BzqZJofpi;cMwpUjF=I9kIdVn z*$YY};zz zbQd4O_8HHJO!y8=XYzI-3`p1r*tkV$FsUB#8vp%%q-))|vKe))s#`|1F-v%ZF0!=| zZOMkaOV(thhLQ;WD79QoPg>~Y23j8WZ=&V72N+UJuF|hI?0wNe@NlTf$lR%hy8k+P z*Tinrn#7}KtLOk|VXM{vw9-P|z;5FI|4ai%wuVP;TIt7zT@9}O?IC5>zAX#Y3vL%N zs;5@X;BTT*{zga7Fsc`n^CwjnwYWgbA}83>=G0Mg8~z>w*V31!RUoS`xWTBq6y`;3 zQcCj_=kq`FFCSbLuxc0WIAzV(BO&qqHa;bXTpxOiXH|UBNXLL@k~OXUC>76 zU^5YHX*fvRLewdgD*p6_?n)R(-O>$F9Mw#BRB)m<{^;aB?`$#!WZm7A~*9BCSG+<*pEvn8O;hIUXf8 zGV5jh6g6Jag&HT?gfnVQ{%Xu-PC%li5WdY3ys(J)w;}m`#Hz^Qe}Te^-Uzm$WTFK1 zLpk&^)bsfj5`g2psCb9nDq)Oc{v9Z}l#o-{?P8r97Jey_y?Rd~G-X%9+L3xEe{b<_ zsE-+=p%3TQN3DFU@wLEYtN*bxCRmYUA=*!?@FKrYjEr%lpQ{iw`GC$IY+J zFkX6t-?#XEXNK|dOZ+F_OFL#5`M>hJmEY%QgpK4j{_Ng9!?=bV-*}0Km$0w-WSzWf zlUJK~MZs@umRA6uY`|M)P=x+04}?3J-AMhP5C>&;%T%4Ra6_n(8@CK>(LN$5GC-k7 z4b6`_&2LPy(P6Z_gk4R>q=P7f3RcjG3_fs;Y-;un`OrYjdy{y zYCx?<|MoEr;}Uz=e_0mU!If%(vwZNWxl?xU66;`2$jXe01?3T=B08EsiAw%Vt->3X z)X`;k#hJacyZ#MG@2(#Jy`^?nvE|ph>)Wgzoz?-Q!z=h8I2t<4gDM14`|)`|y1uUi z=~|Y9K9BQMu+COC{(cTHB38J+D_W%Au2d)E$TUhbR8Cx$(LVlE=<^xa*UBr`9YD)NZ+4EneElTGWM28ES%uk)iC zS=R;x^Rm*!DIs8Uo#3rdb9;(rc9VRU!+;`Yw@hij&r>u%w~YEfgY6Za)c;bp_a4D9 zA;#b1H=cb$9^=^?tB7|aBaxrbjj*W&|5h}c_%M*QbnPMziF@)Wc7O4+ejmkPo)T#TyJL18t;FYcB(ay@e ziX?r{LjX+aN`ByZ?79X3Bh$%WTv^E!6I<~i`5`hDx>US?N!I+uMGKu!d-7FlJ6plt z?X|DS!mwUUzgp7xYH9klKz8sCOE<8?5C$({oovhqTNfKa?#-!|;C#0%9(u#bWU1kN zUdTOneMP+E+;>bYIF zjThL|9wsg<0d--W9Jf?sBbMr1y2Wp)+E}3PQ@x*L_aDxkmT4ee)avj`9-_OPJD0vHOv!B_hwy5~ z{+&_dv6J!3a7L&(T15&xgBomhrNS(nY)7lcw5}Klo148bu;O%7&DOe2`SfcgrCaE< zG)mfutHiLx9ao*D7W${Bqvna7QngX{O(ug*?|oX(g>raDL7qsz62M_fX*m7&l5pv> z;nJs#$6kt*=5rx(gQU_m@u0n!U))p5#7S9qAQ~hY?nxc%q^jcfmq}oTPm!NIsG)ia zmSB#pv4j?MKCg%5qvThdei!8%vl*RKxbrXIUnBUZKh{8Px`X-OnD#P3H{CgR8Fj%d zLWfPGonmOyCu*IQenRkwikd*8%HX?W8iJcr6PoKDmsI|NhyuE70AqT0qpjY`@HUli zsM+sN4NxfQ-UZ_v?x0n2B;BqSxF2P`#zt$sZWmg|+NWf*?7|U1O&)Syrcp!Zm{UOj@<0M}h3;c%)It{4* z*^+hxP+D#04+EW{zV-^x0QFX!OdYBq35upmjA297X=8zO+K+$?l}{W`)u{RgvDN=x z8Jc_rsQ6^OS4P7xjD}yW*Y1pl)_l6rbzI&eIZQJZsUx}HTbOp#12Rk5K&zgSLyQN;PVvv0K|G*S& zKr-x{KP1N#ojvGFM#J1Qq$8XI2xot$UR6!=gbGgMz%cJpX3bL3uX27*`zyc^9eZeV zsmvCW=R04G?j#^>vNIn@EB_Y(X}e1csNacFLJlmn0{>?~V)El^YA!7d1e#0XVZT%J zpN(YLtxX(%h1S`Zy7kMQyD>&kMvv`_<#-UCt}rBKR{7lXoC)49X^t~NE9Wl3C_O89 z5xh_GxLyRMW%^4!Kau=to}pB#al)a$+6kl1jXDaH8Ih)**$ox4cKu>;=X+4MhGm4d zIVJ_5&ct{Trix18c~cxvrXH9eGEEP1)!M#u;^>z&NLPfpJEDzM=UX zv2POFh{5tFnhLwb5$l~`Qti1~wNeADT#9Rs{_$Qg;Cd^ObQ~~DSivs~sjBd+6sj4fmkPeeS zVf5UGdu8&MNmIIBu(Z`hTG0vo(^@KuvK1wA+@-0RY5!o4LI4zFqB)9NH|~l(e(=Mm zWggfo;RP4$M1a|Y@1VRXX0ZB5RySO=R)KN5dNdxaw;3a&d*W7(Mdm6ooa&_>g*l(_ zt+<`q=A3vt6*b345wdI5hnKhAK0OHc6kIMRvRFDP%?xue&*ArEC`|qs zbqNj!w>@5;#%tBxsoP=}DyN)ksOWA6@+RzEO6h>iVe0H$N-;9qd6t{1#xe=_k&{O` zh+HdQCqe1dAK$^%- z1=6JTIgnIuo}!5P$50`%uL9{U^I$%z*{)-NG~1=T1VYmTzG~7Qg^mS$4*+Q^Tyd?m zN7eEIP(;4%dj&|FoqYs!xhgAX^3N%DZy3<6>>9W|0=ihey$RkzGiBX$EK8`+)v>IP z_Vulgc5)a>B0}1eRPGDcj@4JyCsxSngPYmH=H9M&oU-Hy@}5L4Fno>tx&o3sm+`Fd z(#+O>%sz@fdnMpWgB7^Su}WVb?FT-{vhPX(#<^|`Fk5vIxaT$N9!p+*5Obew_~UfP zA-7=HQeEx?MfQIgep2qjVr zF;(hXyS!;HX^_&5ViVe0ZmB1}hHazkC?L1{Q2nL$8e#J*G4=DPET2!Wk|X!d)S*Cf znvEUpGMc8M0e3={2B5LPtRuWu*h`PZ{2BJVXoehPvPVgEb|Z&9HI{v!wA_z%cD0J7 z^M`?$kiwbL%R_4{bxuNc>b;h|BK&|d_Ptl|SD7=}Q&-0A=qkD7rVI9~`Kc8ANGg<` zsXywvr9nCMP(@NG;aB+)kOk=BRLZ?xGTON2pxoOzdF#Dy*G3s(uMSM%|qU zDa?x74>ph`A=2>oSx9laPsF|;7`N{g?k|qT$EbSIMjCa$R0Z1OR!6*ak5PB@K$UK3{nN#U0 z*uYAc<+`Yb@82=~2qjC?uk7%Mkc)|Zi!d=Wo>7xV6ivu(!QLxq zlU;uXf73hrq&q;>po6Nt)vi$xlmKlEBO@kv?wBL+b=x_LWM^;ZC{}MbPpp7~`*N+& zJ(j%R*$Gw8)G|@=6o$9ZD$$Pm(wi}r-j^Gz(Mrba`$EhGFWhmF9=iBeCf!>=4&0lU zhwa6(@K#i&E|UR{*-IU2Z)BD-xb5K)ERYP4)rcm#oVA{r$5YH+tnf2Ee>AKAN2E~N zZK$^%OF1WnY=qbHF?T$SjMzpMjft~>#1nt_1tdaa?p^6&bwvr<2*;(+zcr#vb0I>2 zuw;d}N;^HNekW3Wywr)Sw4Gjgah104;LJl2raUb>?didy?Fs5puDT4qyImIb$)})z zGwllvh1rG8B4XWAp@%W|4Zab#4-t2Vg$N_akN!9|8QGu9VCrD5rbYDD4dSpL+Ak{# zjRf&|o6S`)j`FWM7nfu&Oi4WZEh^b%WN+r0eMvazytkm`z(ae6tf@(4 zm&n&*N0%L(U=XD0{L=?iG~^xy+lnXWzd#r@Ik}$;#NB9j#AEJ==OSvT`Z821F3YcQ z$?7&dBR1?{lWbKKBRUh13T$_?k)cO%2$r+ZZt$nh!0k|6&RRsj!3=q4UV=iJ_jV_ zOh}y7#AN3_YVYjyBneprkdmO0>95+u=oi{!@qwQ0nM-Q-_EbrGF6WQ#p{Du=(<5la z7eZITsoWO2#(Jn(z&feh1rj>r$P{Ou?hrK4j-NiAs4P4}jfSEo-S!osO1WxkQNfE) zVa{>`KgWBGZe%SR%f@ciSIYKoEi=_al{_@pZ@W6)YlkQAL!vMa?`%nr&ti-3h;ruC1C0WoZ1| z&FrE@j29wk$B3Y@Gy^!ptSST1HPTM;iK@|IH1Rol`ZGrPD{7I)5P? z1iyuRtx!~KS%>^s%T};rO{;z-KVuqdo)nFDfK$-Morl@W#4!PimA#$AHQOKE z7d$RA-Eo;wS4YLP(fcXC7d^#gw6{?EA^Hyp?yx0asq3*ymk?+}S?`B~4uftfk*W zL82nb*Aa7a-=Xp`oA+XXUBnyazaj+peL>vwJk(}{a9lK=54Yd_s#tk%~qn6E= z8S_|5TtZb>nXBBObg@w50;5m_lid92v00m>uE?l*IZqAOHoVDGYfvTvBq60 zNL>WYDpBg%Vk4VZ(GbMZ$(W*gDv7!qSqx&NkjcwSt(&mV?+?!88d$`tKk-?6bjx=Y znnBA^z&Dwr?p;9(Vt;bO_QgXlR!=E39u0c;#*Z;)ZB~u9T1M5cr0_w~cp9k#>~U2N zQ*Ed1+nlzqciYZ4MLUwLq>Z2Qd1LA0(iN*-8WypZ$tSG(|HI$7b+2eza&PiplLkdy zm@d0s?AJwYS+Xfde7vz(*9O%Aez~TSS`HU15uXdtBm98u$-NDpDJlH!AhVGEZ*h?a1BFQ|wRf+%uYYob8NP z)Osc|>OtvEV){#oSuaU6!i4p=SmQs=i#2|9Le!rpJ?7sMtNlov<{DXj3yv?R)p#_T z-4PA@$%P{rC_z64N>ItF&+wO>MX9nZrOL`r=n^6Ej(jM+T zVo=ZI?LR?`DM{xLrFOrxXTcA?5a~hR=}Uz6E*R%h?i=IwXR;thMi!pXY+*xkZ9KR| zryYRk8yUeMm)z$b<>7!7Kli)OmFuTcv7OkaFyiOny~aGm4@MpoMAwj0!5`hN&tY7v zD-cfd>~FarP=l<>Uiqa8)!)z9bB3v2<&RM{^kAs+M@Tx-Pgh2(BfOdk)cgzN-`RoF z63(sI<_tq)R>MD%-z?~&FD(zRMUrO$piBKTK+S@FaO9imshM3Q&IVx;!d7b-y$G8u zbgRgQEgCX$=e2`UM*SZCCTtkdhSaXyYmzif(`THyN@b2zCJR*T5Ztp2(Z!=*Jheyx zf1GD*|1as^;fW00mvH)JU#^UgC|0hnFOY*++W6ssc)6VBdwBU>9vrU@_;etCV)~UK ziQ(~JkSn@!zL(+>{QNRsYB)bbe5s@P;S>ZbLdLWq^;ffb(GuB}`4>+AbEsT|b2WtS znB>2CK;+d3((Hz?LzZY?6f94@KoQ;-k z2aR}P1N0O#gJfzw#Z25)%=}a+CJVcpV&+dIJIkd5CgN{zeL-%A>U_C-sYQ|aUqknW z#3!dZ>8=_icoBrc1ZFs;g=pfSJfy?*0oSpQ3ww3mGfmwsTgxF=SAOw zvcu6){TGw3h9V~>S}tSb8ZDw?4zEHiLM4ryCU+h2LoM?Af}Mknx>JFqFK#LCkczV$ z^~&$vn^YCCVHH=j8zzm41`tRRi1s6u6|1Z3HWqPlnDlki-gVd3sZnLE5@g*wEW;ny zzi>o0qq+Vrq#VD$=9ePv>~QI9-F>2@vX}YrfTWiK8v;j|+j7;s5bn6+5F_)@`(F@U zghb{prxxSUXy0({Qelc^>Kx6<3h3U6AX9GjJJK3QvMFYK(M^2mi#9^(CZ2x}hgxbo z;iBP~h7~2LDiEsX$@>`sYJ9(R9s$qu8lGnLxeLg=uZa+3ezTr=eQu>4U!5`)2Vqd|_#qCt=dAZ1K zB8SQ;c!MHo&VZ=b(j_dda1!05BgJ)mh8(0A(ZV)>uv?udh!Qx7 z?=DK57Ms;3qQof0yVf=;L1H=zIVV&%2L3rENf4#GyAV`R$>OEUuD?(CSbY+kx)hq= zoWf?d(slSwBU{f9c>8<{4+q@mv3{viMXh}`Jr0$bp*(+qVFC= zUlG!Zr~F?KeMJ=de4=l6@zJOoDVrCD5J}UOO0YEVwnG&HE6Xy__GrbbU*QCRXoE38>w14 zFt44Pav}qeU`;$Zw@i@XNwyhZPGn^>J8^XL#3~@NS5M=ru{GtIcyiw=cQI zv?k&^Y2s)!%d^#@`~_JP*-1kZ)-(7XNEnfA3HwWN>uL;6FRkRnUtZh(M7B!Y_hY!h zostsNu{l}HPH(mDzDJL5c6&TSbx{+G{AunGRrM%vu3Lckxr~YHfJh%M=F15Tt&GMe zR^|^DHyzgaGEsL~C2~R4nmilYHSlw)=(`Xu=2wk8M2k~`E-Ly9daCHr&(8^sn@}}( z&>A($N=a{OC4J{)xxEv?iB0WOOQ@>LjTKSsH+QLTY}jhNVEEt`YMb->eABg*&`}L; z2GU`K?gW|y-3a*B18K|4EkOURY$3(;N?Ts;1kx6jN6;#575Ob7?I*P!=v`IIULgIA zfuOW5A;x98<|L551|gfI#4`-|b_3l9nmtx|SV4Z=4`+ z-vfFMVK(5K3HS3l%vZoCCSXn2Q3ZTI0(wGy<3E8K6tog(je=GI-J-s`9!NWn6#J=< zRV^3uSAVw}NVmlY?02 ze2MbD4}o;w;^^Zplh*p~0MaEaAYEcPP)?1;JwUp|8$f#XjD}|D^>!|hZl4LH+xK-K z-M%}3bo;)}JnC;;4Wz#@1L$q_jc)_#Z+ztC3nHZId0|bpYvplwj+t`_Ugr_v0%-`t3R1+lk)W zn}BpL@AjZqfb>{>XNWs9KL*li2KL9AO5F*hYyKgS{_f9#^mmUx+UFCdJK!4yq`y%M zlmO!czI%Z*-d8fWdUO*&x|bIN=~253NcVCpkRGdhhPos4G|>7}rM?Y75k-BzdW_Ha zceVC!2GTX(0iXl<1cCIL833e9d;>`Pl(RkP*kSG^ z!0Ul@OP}zduavuQ>w)y!EAqg4KG}UI3)8 zKVAu>XZ6QGdL(}d^oW|H-vQ|stOe4y4VEz%I^U0h9#i=mytIu#|3{_00Hn(ft8hz< z1k$}64Rjbe0=}_8I-heJlFN|g$}O#U5#tWv9VXs$v|4Bv_=3n|n4`>c(>tx^K&kqK z!f7>+cT6^?UmA>0udF~kkeeQ+e-n2==AR{gv_%LBH6>5;Zq$tDMvc!HSYpBsn${%# zU#K$SF~wc@3eMq zm#{V}Z?F;&Q@fV@xHOC-Dcvv5bkS&7HbTH{J|l9auRB;0uA{vf}FoLhV5{GpTc zae0M{R(=xpk%^HTqV|-aas@ad7TRnqd%H_fNyAUCqfoZjTAQkt-d)T)%W`1FPt3KfUP9rG_2agT=xX#wS-M>r5= zxa*ejklQbf(Fergk&Q7=nbY-1TQ#9Ajt!esfV*1o6uQOAI5ReDgAzlF3yapHTl3wr zF5|6lG<9uKa`qZ&AlG;gmM|-xTDqd!O}T=W`sCg&a;Qq$xy^BycbkK#9{Gb*`uaZT z(cX3SXlCQ?^R!z?%}y)7<0sRG<3PoLZyJ-=s@Aj(^k)TqA4v18ZvuUJxa1RG2NeoB z0Z7071(2ql#a=npjpi16l8#_AuBvj*q;XZF=UhRb`=oC6^j+`Jgah0gH8KkQu$L9( zLhkRBh!sV@F~_RtH&vtO{#>gQV_SBzkSnZB@zOwxd@gy{7rH6kM>TP=wuoBV!B}u3 zS6f6ab}XXS7Fk4L*R!|t_@#1CfIXD@b$gqUOJWDqcjZT*+3Ip+W)_Ur7=(O4-lI<5 zgYz#$?>$U&SLqu9raY6%{OVofYe0I}ko{Qi8jk{LD&GL4X?8P^=IfpV(lq;MdaP?X z5lHVdA|>m6rpsNi^xKHYH;kx~kV)zu*wkGyd*wqgh3a;0jT*aW;@Mvc9~^tqy~r0^ z>scjbZ}t;Lp(qTAD!78is2E)Kq;hlAA@R_=#Qc2cYfW%&v>7?Np?kyMCq(+o^@}suXWi=|L*-SUHv0he|pI|JRuSUX@hNu=;^{PG1l|lKk zX+0*jM66#fS3keITh;KOsf|T23gKt{$jw1f%plMsH(Q{#nqn zh_}XYurXDYzICuKc`h-X%5cafhY#b6y+WQB%Z8ae+*Y?Fk4o4VKSShKJmYOnzGEGn zu*z0qgWo!*oXr{=M`pPJeu2PGc#(8cBGw?huS zSB+)i(B^p|(;gGHw%~r`W$lx4jQFHfcMjvBZONl2+3}ZyF@ky0%6FpHkeF4v(w_)z znS+m5=lfv`TbNSixsX4apYnW55Q2&gFL?r=6Stvw%Gn6X+@**7UHcNSngL_udG!-v zfN%~#9k6{)>_vw=E4XNAhO{$Vv?k%Wy@={toq^QZ#2B9KOJe32o|dqKF|b_e+0qn9 zu+UCSz=tL5X=vYwXOgfk2Y888>!Py!X+>@($cENzpyVoxxiL)+O-M`=B1450y2ND7 zsYn8q5=8(WC9Kvkp-(oBA*43E78iqj%D; z>xJ{QW9n|-BgdmUA@{6Pp9?_N-vzlIODtBy`Cla-^IzZ@}nWV52t00 zQ;qRFXqp=bYKI93_$~+1l=eEHa-;wyh=vZnMk8f!tvP5(^q zr{tNGbdEV<(+4ldtn}PYjB^VG?LnK~O21091a)&5M~k0?OWVBQ>rxdhY5uNiNr|!O zIO?n2KZ0f^D{A+jD$T7EcC@%k-InEETYA154UX$}7QeFx5s+k+Oi09-(nK4s`IKzd zUDti;n~G0;bF%lQcK>i1o*G*Gaoy+|uhFaedSK6NW4)?+z7qyb_w8n&*$Sb4xN~*11%R1U~bliF_Y`uWE!#Y$-WjP6tI?Ex^;;=m_ z4k*r{5|Aw6c;pfX<`AZMskZ44xrdqguO5&)g74vS?Y3y9J#|X{Tc3JzbDmSBn>l%& zCJm}_VdcR+-Qg$pdzL7t&JAadgVslL{+ujXRdLa`8qM@aoyo&7X>Y^i1@{o#vV2ih zmOoTGVUb&FQk-74=&z`&+jT#Zp3Ch`BO_>7G$?2C*xR7|KRvaP!7FZJ&4QdCtFMB; z4L9~pZx`;_&K;KgTs{z+&*c<*xO_MTmk++)Ts|0?Bs)NUfZ8_Ml3kw<9seUfAHr*e z1n0z)#_0f>Jw6*qGuab>G?P68NVCjO15Hrt=&wL>!6e`t1OAp5>;iuHxWqJ zC%#N{eg6TZ>$@FD*S8T!mv{^44@fBiUq5hAE6pwg(#{;Zuku5BF7Y8WNH6j3nc;0V z{oaqbMMpdJ-s6x3lxSVbq~F&14|mr|j&L}Jp~bsR>QD(JfXt#+h++d!qkNURiak$s zQK*1EjwcDD?s|GEJWYDFaD=|(*J9RR5>~Ujrp|U*mK z)S@j3ua%DF22gK-^6ZndZv^HOW<4hY|HzhE+vGPt61nSrG&r-ITUoA)spP>R9FRje9oyCZDQYE#Znrayy=Z`3(4KaB6@g(F99cTHJZ5tCFmEwT4Q z|FZ7{|E7pG#}E5AMy=7TVHJbm3LT?N_Ir(%0WeNxaI+2ZoO%9+?$ zkvO@C4xjUDzNqvL8ng_Y78Eq%4Og$CFDNzv|#A$i*QsmQq_%bi*ji-SvP~Hv2&UTvS za(T#|J<-lyC{i}MQ;W80aWj9RBT@FvPc)}jA)Mo;$P>;flOkBN3fG024jEhvlQQVv zDa(I({_l9E#>xEeYdUhHw3EF^rE52G{j7ZsR)dSF3N%+IWz$>`Mq%7^IQl zQs)oGN-^5<*O=fG0HZr?tnwat5P94+?@E?k8|k%YCPGu(e#C9kWnfa=uGdYv(rwcA z&U@V^sX&0A(x`2n_x9GP*`MAhL>ybOnJ6z4j-l@XAu92<)9rcw^rt!81aQ z^R74Tg~6z`ZnE8f2O@9k`GO;qMCirjgvoY%hY0baYCwqJ77INy=aKwr@$6+(i=wW` zusso4mpo#M9d9DPs0@}8q;A8?wU>}8s|FQa=v1!vjR7{*fRdqG`nJ_?t=mA7TK@A!;5g){&C4e>uX5fs@ z06su!MQO2As%5K24CqZu@p#8iKl?{lvod>iM}1^c!ka1`)RV#I8mh) z{It@E(4Z#5Qka>iDV?r$r474!-2MWjfP#_%qPb1jYn)P>w57d?x@dEowhm5MsrhV7tTd|S1E;L zZXpRvMSBUM^S)G_oRR+l-Bp>dQJHfoN^l)fX}9f~@J!`}I_eq&f;2YM@}<3`QZ>sf z(a21Z=q>ptQBE4>0}IpL3*$j5#qg5a8fol6iR1uTc1e@Ei0 zF(++NklGE!?44cTlC6iuZpc^bI2TGr%VJN2Cdu6s#qAwk-x?!X8Qnj|oVm!b-$~Ig{e@tr~030 zPx5l=(}OszIEaGTtTfSn26Yr?3?1UzyP$>ld>J52SE0}~QBMgVUk&1`)Do`zjWav4 zuD6n?lXV?{y8aW3Ua-U&svcXgFhCJH?GfS`sn8>1oIL z;7?AH>zE&!4S$jAnAmqRO5MiSZVlJXt4@4TVi0q(eCB3s_Nz8s!E)4W4sIj#hkdtis0cQux@p=K%!@krXoPQxJ~`d}XRR~be~Dv>arm|J!0q2~l@3ddLW2t$E5wzls}9Jt z`Oe@Xt%*J+BUA`Qoyj=pCk#*FxRNWWgE;9KnbV=+m@@%7Z%SMox7SBEza1a(TD+zm zI6mTiF87zkN9>6QJN{+%3q+0R0BTNUp`|V_q1^MDPTnHTM7M@WY@4CyX6UQ3M zo>gv)R1EKT@@sgo*XzjLmJ=ITPE`A59E6JRBFCy$D`KPa1~GRfoMk|CT&Nw1b=P|2 zW}KdP=Wmo+2|P65?EGxNm@~c7On*&0Bi;#f#g%ip^|Z%KqwBmOB=AtaL6`%lMzvYU z+vJWq{i~=kalCg%uJu-n_h6jKceS(%!e<(V)np2B!+)pFq}G%C1mWmT9G<3%Wp23K z0)8iLi*`M0Iuoj+b z;&ID)Of4BO^PhKTvHOZ#U+|^){qmmtwX=lZV>-YYxI>y|WUgb>lv;w;Tw~Qu8U=d= zNs60gC+L^e9Vx{xjf})hAvZBUQXb!QU1S~48-J$uQ`vls{RuO&DV-?VX{a%59>_SvV<|7$c0t1Rz zXEd_b=;mGV5v{SB^#YIRMAlbkjo6RsO`e-~5v;5|K4L4gdLvKF>Lxx`;;4W1V@}rp zdd-!JM~wn&|4P&Idu86XS>vXRS}W)}p$*T^+&g*|#aOj)>Jo9R47x0aH!yGV5>9d= z^XROzg|n;JQ|?z-V4!Z_6SsFNQWh3}HJODfq=c9=3x^w3lp&+)Q^&Dx!r|1hkGbtr z$8H{oVG~0{u*M(QC%l1`F_nD@H!Nj?BEm4H=V%Lo?dG>*Bi36rn*|=RAIUajx)1wD zd4^}>8Y4DhOVs!^(I(#>LqJA8W=#L}k40MYFW1bNLYFe8|4P%dflI)yA?vfnq&1lJDd<^PuPR`~y8k?6Ypd;UhMgH{OWd zc`^_A3-}Y=+a4Pc-dvtvLYWdX_%>N7npCLM!#QC7(0)}PF3u;6B2HTqVcOb>(zXL$ zdbu#vOJs9WR@+f1vp2#Js*|I*`_c*tcf0#?0|`3Nw;VuDQzx&Nfwr70qKX|rI)cl7 z|Lrm;N5^Q{3N%sam)-!<-@Xs@7(6=^h{17mzB_<)nrM_<^Dv;_t2)|%N>g_UgX>Td$8$jBCVm**<-_e|0bo-v>SgE1+fZkAF>;uvzduLd! z@8Wa!;*3h~E)s?N3U!|gPQ;MJKewKw68;d@J1rw43Z|Gd1VQ6}5@SViClMW<9nZ~V zry=otStFx$FBzGgR0o}JDNi>OqjS9o1>Yhdukp?GIv8pt$2`K;i9ZgabP|hpNAC#1 zQcc3S_J~DG0Ip_Um3NOtOKNLGg>;p`wJH{^1g>>66Q}bvlQqKZ*dWnpTlxQziAjbT zY>U)v4%_jAnJtNlR&Lh8!m%rvdbs8A^u;(uug0G z+KX^4_Jt$Cawu>PkhVat2hz8dG|~?2QmvS?R`vzz=(d8SnAl;r zxH|*_U+!_whVSWJLYyq{gL7H*k{1BT0w!Lvg>ffej;3!P6-e~j*eB=-)?H;9#^%Sat*4$seoYD#d0@d*PQBc!eju$i0Y4zS$Em0-hdGWKrBRR&l-BiOKnAl~FgTt#mo znHk__qa<@_AXdrA0Bm$ALuC6@QF`@GhpQe0AZkC zEe!yIG>Z#_;(5B{9%!NI>kNua!BF5qAU(Qr=TBRYdQ(jn7$T&baxO`pBl;Hsszuo% zz!?CtyH8?1sW#6qGYKRva+#Ro6^>n_ak(Z15($LW#E(9|fXg;Q+KMe8NNAVH%@9Ax zJS=jvqV^mO=oYz|RGC8{v*&D)Nz`MuG#6(JQEl79z0B%If~t+Gn_?WO<26ffPmn0i zY759|n$>Cn`Y+YB59pc-O>AU;2%b!P3lp*rldu;8#wpGZY$27(ce zunl@4sPuFHSE4(=3xdt`ep>XNk$IbkC?1ccZ44XU=w<#jzuqTK&~IrSBS7n90G5YYhume7=FGt~qy91A@bjxqJz?_;XTA5|yq z%GxdL_3mEJoNp)evKM)|TXb<=VPe;vLWu^Oo7NLSDq|^nbjanG!o8x^nw>Yp&hyoD z~*2KnDe0Kt#23^v4c~0TqMeetB8bSXssXdW;{h?)ie4a8F#9x z5ULrOGx;!@<3dH$xw6Wazm@1De;;=iSCxwp6Rv&$(#HZQ1toz$BU2&Ij8T0@T8pe; zyN*73wIQ;)6G6camG4*;-pz3R`ffa^g1n(Vx)bnDJ!G)K~I+4OETw{R%%(YEGytgRu*3k zyTx({ErL;a*NSPXc^@X`-;<{vt@<5lzD~GA0qeJ_ zSAp3d2AC3vCxva#7`ZKG6F$xx}`z14L(1qMd&|GIIq zl(qxu9{UR@_6uTADUN9>6aA20?ZrBxo#hd4IeP>s=B(hrGOnEU!qC}ow{K$AMz^hY9pY=!a>-qxDKG^ zgc__M#yqYFbJhkfJO@rw9jpR+kjEnipK~pK(o3*E7fgx)jCqYYOBpKV`I3zkWBiiX zB4Y^MY5o?n42aA*caFSu?;C0UB%$LyN|jL@h3$>V_}H?d9C(G46T)>n5`!-arcm-7 z9kuuJXxh&#*jV^7-7oa=zwTMh5z99+(!ic|7@2jXQm~Qv4S=f4NdFA5SRbK}(T>TC z?JYlE6hOryvMK@D1(Q+y5~GGdEZvD1UC}ws^;;RS-{Rh3ujGV}EiN(E6?B#sh0UB> z6nx*E*mPeL2fi8#rwKBS^^?%YP7rrUeWEqhI{%YpFKsRE)s`6-^sOUn4AxJS>1NHpE(r(5sjk2^t zR8|o&Y2z5wR2am5Q;~`HE-^#uf@}&$dEAbJr?Hy21r>=8)18%xJ?YNV63=;RPNu}u z5^7->d%AFLbR3==D4gKMVtyJCK_FiVix<0JRq(4m3sJ2WAGh{iBYTj6FAPFp+|>QO znTl5jqxO58InZG+iPtcRABl=8OAMme8G+4*DP7{zGMQ(IPE^#J)Y#M#5!NB7kRSQ2 zcYl@EG*Y{bOF)FT7Okdi!;iCJUHJnZ;2No#^RXSTdW2nYgroXK%igQL%f>6%BB4j@Z*D9L6#9T~R6@q;zJf~dS&`Ty z=sTMD$?491x&Bep2*1GHie7mBCFN8j^GgbsF*{U_U2G?@3qAzUq1MKaFuswd{D}BN zd&6t*gw*0QgO%~z^;N;8AE@2dZ=?+vMh2q|9|Z=8RQac*a9&Uw^p|LUskGgKDF@q# zHZuQ1>mtdnV%S*5MD7DT8?XCsBl|dC#O+sb3!IlLL`qm+l-7rBG2})Ty861HZfAyL zz$>)c$}J>#&pWiWP+QC&v$s!NKK#^)8^he;ATVRpJ`l~_5=57AZ7^o8=rLDrvuEOz2ea_j7KDVdG`*kJ*3F^v^j!n0fYfUghtg+Q%w-wx&^3 zfB9>9$JqwVK>TkOLC*nghkT| zPgyf@BTiGGpcvakccC%Donq48ZPAX~g}9vcJBVt>wZAgaLLBm2l>H=SBPz(A$FC~v zm6F07Xr)_Wx)>&}vM*S~a4}h`wvUgC8rI0}g`*g&rv_6yx2N`*$+5s?3Z9re7r2*# z!^u;DLkf;0hXD6h@T6qF6wYmMlFiN@Z^jO*SDwkn@09QRq|D3>UpA(y-Pp$ zQqPu=mAGEy52@##ql7y#geqO}vHTU1$%zb2ca|BMzww5 z>^hta)l0$oTIAbQ(-~l4U?sVXhIAUM%QJ2A7K;%l@-SS`-G)q{nxL`z_z7eC6B?nF zwLtMYE>SjR+LEtG(RVi`PGoRJbo2-0;Duq6Et}UiQDfJD%-`Z@Mt6RD`}1ssqbIrr9*0Q`+%-Qc|7#Ny z4v%QBNKOLQUtgh!S$}<%szDR&R8>PCMZlM<8v43KP7OjtDXAf@O7*6NlTo+d%^`l%OBOrR_D zQ;4VOMmD0Kdh--BvY*sXeR#SOw}?EcTC%4AeazgDMTU{mbKog?V8Tj^zTYX%Z@m_+ z)K6}U?$A$eixT?DZP8r)H&*0Z3 zL%X<(ap$wF(1T?%*&CDr7QG^jq0kpGG@$JQCd^jFcBU3N@t&=2Mna4@Kh`E(MKb&$ zaf{*>TQ>>F5E)E2D2!%oeK@5#WaOpBv=l9s=lk#FSb=poMf{Tg>I}#8kcq9a?KT1A7!=U;INRtt+xhxT)O- z=ejqNO&Dha3l4SEbO~Lv+vM+*gG8^we1#P1*3L4N{H5BC*KW)2Vb7r(CnNfP{$-x! zc=vNdj$^Zdesr2ZHvr902fYPAS1IT_KsPX_LV?G9Na%7I8wswrLAd(pHNuC4v3y#6 zYx-%?Vj3%iK0-e1LmPo+t1q?!X(_{-K--|9P~db9jXLcUKsv1wHKne%1L#@|@k4>n z(juMqMIi0lYCKzPohJU4G$fu;^xFo?*J&^MkOZvJX*E8y4Cn^czBm1}{XWzeHKqPS zJkn{X)`w>J&}V(8=V4}-gQ1I#@^~ z)0J2d$t`R*Q->-RUXsP?>YkQJW*aNVGm*?&$W#R;LBUBuv!rEdA=(Ab&tABPywAmrAHJ~QO(m6=8~m_j zGj&_nxzhLO-ap3eH{&&jlD*-tg+WwsZn8f$MfbiE555(*aS#1stY&ZW3Td>WhBcr? zwf@%t;^&jrOlA`~ke%fCv6II3KicSwo6Xh7;#_hey%|x?`*X)S~ z|4>+DG>TX#wRkL8(YLIFuYmtCqN%+|Mr=$xHDuU!lsy)f68O zO3w0l-R`*keDe44nipch7b$_uGOz@`Y$0c80If6%!y!hgUug6Dyd_b;CEGER$A$(b zhvpkeFCAYOpQ!^Ci4VxX!4x3?fq**CWwi??rV7t+D7t?4skY(S~4tDiSLR=KHv#mViD%Mj4%Y>>V;XUQx-J6#Q zu0hD6i$q-|nH&2An7u|;JgOo&y8NPL6k{xtLk;)s?dFL6H?w(nFJzJf;1B7YeeK*E zlH;CcJGT`e)0((AzY&0~+JVnlj%rrSQLVvu1ut5%l287bzm+A|T$kc+OIC`Je`|$Z zc^~GokMN|L#+fR4vwoSwlq;8ARr+Q|#D0UQ9Od&*v~oH5#>(9z8N7os+PzPto>Db) zv7Z?S{bo*=923sZoGu@L-bc&NQoVU;7c`UoBDuVF=nmw6309zp?x~3BDvf0lea2Ru zh}plCdN!)23)P*E_X8s%o@wC|mZSO~)2&3=TDzriVhJDNnNLP>AmgjV*CM&OaIu3G z3#Uee7vHl{v$1C*nZFv@IgfSrP0^J`)9gAo(!9=#1Q-0lS(D-+?tU z4}UM2yqG-lKKoVn33(B3OE~QnBHngXN9^n~z{O5|zA};RIUFtty@w<%O3(A=O$0#P2xn-633YvCkPY9W~D=FZlvK$kwvIMkgZ*UJl6p17CBF`YsB?~<`>TNPV6-?a zDeER*Pwz%EcT?4D#I~)*>RR)+Ql|No`nyj4wnT9JE+jC z*_`!*)V>qv=f|6ij~jpW!hyW*KcDLo{xTs62!QAY?!iLHYE%GAq9DUz(o1%;<^MJ# z={BCs1cS3lsApnuCe_;lOn5^1Khjv_)6$^|W7$3BP+$5GpWn#Vg4}-y=O*CqWNMJf zcU3TwyBgmOQ_IZMfquEc-;5d)G0wRA@;z9)n#RQT^#0?GJJ09CRNYt(`~ZAq@|DF@ z-AD05NHWt+?IdHnk-LoK{UnPAYo==3)J^?f|XoHEhD<^|uISpHS^0c0P`T8~u~rB4lt zja}3$Ymj=mhL>gXlFzYB>i+UO(R35SdSoo-V?nt$VYkCXjm$jgt6;z~yo8w~*pc0s zAMeSZ$n@~#$Ed`Otb~`2=Fsn?I}aLn+{;ru_xUc_iC#d<#oa^`t1GJrbP*b3tge_a zHdIF(V+Jys-q@c_!hwj9xt8z9wo5)ifS-Iry83MG7JE+#y?BMdj`|OgVv&^s{iVJ9phQBYO{{ZqGUxcScuv)vImO zO5F}4E9-o1le8ul&Bd{Dq($B~(`yf77aB5gY-mjK8r2>=NU8R4y@8!Zax0Zm3jV}) z85wa~91m{vKBX(isGgkaX3GDR4Cam3mSdSWeUDH#)`)@pf5>M}q6*Jc8cDJ}yiG85 zi?r=>zip-4Ft3tg`=TG$K1M^g?=0OuF>dremp0Nm$)d-ukJ}hz2gSyGSsF7>8iR$B zMwC~;KT$s=>iU01HQ?t6^-C6AzeKPTWQfs*q8LHOzgIu2fZP9%tzWXZ{deoHEUo`0 z>Him`|C2tx|I9$>RpZ;KSD)V=J|0(pY32i#FFcs3I8VkNlki(brasfn| zILd1x9h7BD#%Ye==~`*w=RG_Lm5XzQ!`pY^k=rLTDf=e~f^y-;T>AE#kzYhT?sNX} zePY(0f1I4~UO4_fSo+;O2|I?Rd%U}WBs1MCEd4TA`qi-X1F&?Nin0Ua|0VL8FX_Q5~F?tIPf+v_^vf>N$V|Ngi|L!&#o{z+iWm$KUf8ypYvMcP&dSi_YaN%YgRO}=ZBz7e)!6=2$RHtMM zmzirnef;B_xw+F!FVBgIPqcYW1I}bEwRc8pnj`a?-S!-7cD06O8ESs}^c%O(svTxc z`+o+l;EVR=j?HTSj8LHxchsG%<9Dx*RBke{)9Xs_J4KtTMvMu+W4D8Sal{C>YUwPt zmRrM>o6E%}d{^>xGkqYKJViD41deiZWN4R;1e(0~WV7KJ2^LWp9=2z_!G%Sak5g~08=DRq;CPR~P#{y)vh3Q3_ z5{rZBdkXDLJ)Z^0d@CVy&WwEIl7BwMc3cR&ScE3aLJl)#c0#D+ckq9g1m$IDlu_hv z8l*N^nb(0DmTWzbnPhxJPCn_*Q;a)*r{5oC+_@e|jV_2_ZzKyVu{6gScm7I2hsGOs z{s;(jEPD$hznc*#Gro&rERNgPwi?2XHOolL{T_6~44>7!>&%+X!PefViHxQDxIIiQIu-+%aTEx5DJ_j@0j&Mb4&d`QC2=`@kRYUo6EKHoe| zYC9L{=s;EPKR9r3aEWmNW}5G)BOZ;n4mMgTbrSU z?dKw5k%JZjhGte0HSh+|5V5rrKvt{U!`4OOKWwf1!2qBYZidhaL*JdaQ{n9IyZ@eC z+~IeaRY9?KkIJpDp)eJdcnbgdZ<{_{VUQ5Va<_q(RmYp;gHD7;ZaL>XTcNM38T zH0uFeIv|kf9k+KC@IvcX>$-LmQW;@IC0cq!5t%6*Y7mG#h0`l{|3&_vu_l%P3p{zN7h7L+z z)2<`77OwUCj1Vk)tB@x)mSRA_S9@Po*K0US#wzmct%LCsn&K6^^7UjBW5{lvwPO`r zpL@G9(K8rriEC}uE2KT+v0F+E7pB0t=p&TZXXR3(Fs!yMvrUZ)c07fn@iI^;x|{oC z+W|Rsvr^nJn#5}%D)|H;U9zI%5+`7_O&tv(zTg_;e12li15KPN#YkxRqckNp z$Nn$AE~7z1b!a9_0K6LIH6F`geCa|Xq0UMt3H#~0G=D3Xq&6fJMl zB-@`_qS{?i;c{a@nOuA;M2msR`E2o6=koISJQd4*25l*C@EI1x(_(cKxVhlq1j z)4@!k#zVx%&%}SyRsEDods4MhCruiIKFN{>@jDGYMF3OcnZP%=X*Ww+YK0(xW533Y z@H&l$Gk`Q6MgeI&P>PF(B9nGKNY;y>s2)$%l~BYl$fum{yco-UZH$%vT77^kA5Pzm zsx9@rAZDo~Uz-MvPYV_KCU*GGleTGqtbmiR&py zaRej09)p`~0sP}yq(0`{GA)`5SM`e3?YZS_oL7{V(l^>Nd4M!Q`5exRCB&Lf@~9-l zgqgF1L!XBBp_ECBG(Lzgfc5h~jMcr5(bxNh!O`@g%K3ya=^SCMtE7OKF_9Mcjn=)8 zI7#>|ONE+}EKK^cA+Gnv#OzxvxtmcocS1|3^5}jn5a@)b)Fb1sEOSSrEau!!|8J>x zJ@3GB;cwSeRdZjuGJqUf0^6b-5QF%Y%bA4KU>Q@lI*~n`*p5nfUS?!>&>)rb37Mp1 zj=I>Di*+?ylas96q;f?kkVn13hc|&|{-X(ewNJM*V)pGE_iq_0UIhzZ`dCbhe6cX? zf0oGAgsv|&?WdB(%y(jJ0DVsqk10$rTf=sa_2vYNSx$4?vpkcK~U+7iX`U z?uUUx{p}}#G$+vP9c`}OoM?y62ueFQMi>xx)xtZfTGUcY#Dyw00bFq@l5~m67m5xX zPSG$oRx{MVs;>f6(hJ?k8X(=r@qW)#n`qJ~nT#B4OHvh(Y4AJu6YL*_%Lvxq85uos&bJskxo&f-;($Ia6ZI*vcZWaDtqb z;WdjWClGBonBfB>J4_XHuN01YI&m>HK08|Thxun&&QZyuH*z3tnKYZ1fx=LB$LNL? z@}RHTOp}=tHikx#qcJ5p_-CbWUld4SnfgXv?*GhP*^<4I3e+o^F}a*Psyj#KT4@0D z25G(pgd3|zy6$dY#Aq^i%-_m4F=Ofuv<32w1dCT^aGAO*zC|u(zh0Aj88vx?v zBJOZrtHBb@OT8re?-H{thX|ZERY5=dv;|Nc`@(5M+0%M40H#|`j~D#Zs65E?~_5RZ6vB(ro-s z)a=62yVY{~!15PaPEO4%8#6U_pllo-x}U!viGIHq$PrWEhG%3(cGD}dFTO0Xt>F5D z@i+~rwVTuknCr$+N}-uKW=6E3lm(JZn{ zZO-#LY2Q+BkB3w>G#*GZ(`i6*^DGqj0nlO=!BF5)pkJyT^3yvZ(7wagsJ&LW*}L=QuMrZfr=vmo6vW`yFX+LYT?(ez(ao(Z~g z(&0^8*$W|S<+_O?Q}xY%k)})B`q~f6^_pKejM#(j9br7*<*SZHjo@j_ zT-P2PcXy!Y-$gB#POOHO9aK>`fwIeW|KXwKB+=NtG?ts??q1VsLDVM6u1TT7lfBg) z9kp#?IhRFT`}Sbd5STYesQoga^OT6?b3ocd$ZdYUZvx$<@_ip@u*&yqKi~5}dc@!K zAu-!?slbQC-+jqEDm5!h@8&4Ugpw)XJdmOoW%<4n4h6YlmlJauR!OSX<~||A%1CtG zyIds>-v9?L(T7>iF!lX|@_p`7Cd?JwNS2TAx2btALzmbZb8h1fClZcDlF?bWXCOaa zasy6N3m1g(y`gcw)~7jfqZ+kw)hNdKZ>k0y&0oUweTu*GADJ^7ekGUDwiHB{=w;lI z<&~N0JUzLT43m}S6b;Z;r0@OapXlX(Y-0>^M zBNlumCVJB4%#!w4@Hy5|$)(2O`zf-D>F4nL%-+)F_1)8rj7c)LYFA0Vj~f}aCv(SR zAo>5P@z@2+Wjt0v&dPFM&ca6=6^2m_3{If=gi+y6HKX#bYSI6fqjKTLj!NMauCu!w zfa9d%0Lo*0Ui`Cp!_(5pQlNYosDoCcghwVO#!7xt4;^HIWIO7OtdUvDm;Y!4z1egH zdH>$%Si zM~@Pt4(|;f&$Z**ZQ|)u#xBvXCAEq|IL4x~aTh_iA&5Njyq?}S$jCg*YdL^4zaEM? z!?B^*miTkncsy2C4$nCjMUrv1xJO6ZM1-&H$&2H;TgB9$ms?Qu4lYA^GyKd+V+Z$2 z{(|Q#PYXtK*HmGtxkW5B@!$E!Bw;_Ei`Hzjf(Ht0TQOpNPAWOxF9Du7Y%&EH*)PDa z#PWmSG;N6?V))9v72#ppgLpsj#iMmvwQb>SxU4^BWX(GVqV@Qw>$FA*bXd`9t6$5x zwvrVAQt3*35zj&?>17YLb_G;2zQuJagg)PMD&!I670Ok>c03c8>wpoIC0D00Oy+(oe6VY`K`yr_fjBQ#MiJ#oWK>zCljddP)8vkk*Mj0;HWd%U(rmM?{LC^VLCs zI^QH9oliE3I^V_2O1=Ev52U{s0MpdaH9-2UY^U`SzZ2-vYS|u$@z)duodR_p#SS7A zs0R81{SF1hlKvye92p3Z{`O};*Qkxcqd;1d^h*{_{Z``B|5bgVwuZ75(1EA)HX!D# zP0>FrwPkVs0ic+P;{&Q;6|m=YS#ZwYuIpRN0kp%XdZxGX_w?oNLnB@}z9k!4q47U@ z{+^;p{D(4QE1l(X7U&?-YK0$ZHR|uS5CE3*DKmYF&tG)#NTR;V3wtkjJusb@;Zq@z zE+kQ-Robr6S`-EOT{c~#dQY5#8|;|#SvXFjYW9|-Wa1ga|ZZK-gtmHH8RwBoh6FJUapMJeOlI!38 zaJ`w!w5O<xILXX|B_)0Z0Px57VdceO)kse|Yyix>xi+oW?VH6}-yX{f2$T2dq9;#cS zM&{Fi?%e~f*)s*>ol-O*l;^J5j+a`J(7L)g=9+ec3;<=Vz2~9wAIsGvqfQ0nB7iS@`9Ro z7a6g*H!{nVz-Oo20nbIWfMG6NZbYo^OM8;TWGLpEN2wBIX!6%fc7VdoG7434?bjbH z0%++uE*Xl=96&P%C9gvS$tMz0PY`(&g92G0*+~8#6W?IcD4bl}GIaZ1bu)R2xv@c* zL|L&z`8PR}Afb}xs0i&sZf0t&%9c3WG#*#&X3FC~INiA&^1+`%x|zYCi{c{BZZ?t_9leNeb^ZOYi0c?S?w&|S zx3u)H{4=Fr^0B4IVZVyWOG~Rc+@QKC*&^6nC0VzMD&>N8KEa)Bm6mgQRg~2_KT_wuL`e~ zj92=}RbZOI>VriM*g`Z{vLQI11lyRJm-IcCH^mDVhBaL^ICAjBQ zxBJ+(-I1c#t|h)YpCIfP5U%h_ zg-`wwQY<=-&>OciTa`OJwZRp05V`V`y_H6GG&VDJDib$*Tujc%g1;kkF+Us_RO^KU zJB*LbkOOMsWcMKF`pNd>DYAzAi1N*jW%u(FOngSX=IIR&LQD)e7LMUSZSjt6!Bkg3 zO!DKh@sr<_{$0q5GH~H+`7=%a)XSey@~2Y%4B*cvVd?kDc8?>GTEL>tojZ8+j_u3j zLH^Zl^Tn2>Q3_*l_qa2c$^C|$dyj+{kFGp|I`X-ZSO#vs$>nj0%$+=F9%AC^<v#)TuA1$V|H8?sugVZh+B6mNQ*RFs4TcI#ad(A<_iAm4W9xN=%^1ru=& z($v5nC4e0o?UyqlOTFk*QCZa@R@hP)!j3O)|N3F-WcwGdd%?(5^FHpVB(W6zgmSZV zBK=Kwo@->@Bd2(1$_l2`{h7=I^hI$HQNpQEFwvG}QX)C%V@Kl0VSD<)xcy>IQzRuxiTPv6St1mtpLm;j$n9}*l-obL7cl=b zSU8{eAtUoB6bFQN711e{@-;DIRTxof%5O zYoXR|Pw(iZeQrjLaFbPoroPpxX^+v;9yX$hFO-aApY$SJm`?Zf%dx*Zf--uA8uKa0DUd&n zEwcF(lpn|s74Wx8^IRmH9TiWS&yld(yL@ z+w-}<;@doEY`8i*B@bf+bb*R778XTo_PKVb{+K2fA{}Hjl($;;4E`q=9rb9&PrEl` zp$rBl7Nla$MnZVksh#)?ApPwPK>FKTfb_T3P^Hc{8%XC{0HpIR z1Je24_TTOY(zR8>^)+-Qkp6Zqkp5Qo{rX$ATT>Q~dV|RlW3@EQl!cmq3Sk)Up4rhT zs*Qok<1J^!aysX7Mq7Kev^zI8cJf{}DG{~02J6Q4U#VZ+;=+;c<*`^AUYVYfHE%=1xR{n0UvqqyaKv5rT6zU zmaR}d0w?rf&ft|+aQ($yuM-Ok#ZJQ*n&pBPAf;|~OBK(n4RXOY|1KZ8d1jJ_7s}`# zl35xhI`PQ6*D^ERs> z+d&+VY+_X_Q#J#Z5#MA5%ZXe~PRysLNnP`l%#Q%pu^JpLy4Z=&vB+?jxXSc15UHo# zvKt1FRx)O@HVmQRqe*mWuT&Ne!EbEP#G6|y=7`ig_Rf5ca z($M#xkY28k2H1_#Cu2Zg)QXE3H4Qxsgn)NBKdM#eA&cPsMeqg}Oe@D6*{!jWjZ$E=uKjjAB&`tGZhVBlg~`#i{eCh0>g&gC?;?!&;xTb;vTfSU;gKsO zM|@6OTuW(nh=fl?34R_4ZkBWcg*WV5L+h9P%u26Q=k&zQx;p8JRCglP32Zl}_*>E= zqFg`W)lA04W4Nfb3tlMB_(rPC@i|SjMr_K(Fta&N&7IWTO1fOqY3Nin|Gz zZ?!~*3pB1oMvQ{BMCK}>601+)M{7E+`16my^GqdtY^}ysk{i&mkqsJGO}BHzQ?NF? zXCvMqn2*^FYxpTx-BHK2sY|fKR~GN#k@i22yKhsy#vL*+sb1r*>GqSD#{yHmF_0}* zgA6wGzMLOnIz{v~EgtRQ>RwkqvO%Hxe!{gYgM5uV3*?1yd2_!6hQCOmZdK9EHL)}- z;z@|&^`7$OU0IlW-&{HMg`3-mP=}~?-Ifh zocNX7cgbjWOK4RI%6o&bEc-7qD#{OoFy838j;q^mn^R7m4nC(lt&t7FKBBo992eSe zztplHXr};|NTc>P>{pF%WFUL%iEX1-zjDW)hD{`RmbLeF?#~hHWKhg*idD38Nv=}I zy5?CNp}$|ak(v49^D^JX;a#q7*`H;~=LL2&b%q1^o7T$an=+zH0OOzr)=s9*l56gL;C7V*IE zQc0;peHQd5TFj}jV0*ruTI!9}8|O7iea*Wn(5G-ivc7twq=Ix4+l8o8d&$VrgP>EN zMRY8k5MAf7DM38bXhY%Lh+Nd0*C7*s(#Y7L^5~q+Oli%mBshYgTF*F26kjReE~*1rwwFZUx1?Yf;{5iG^>}V zd{VD_vJcmqh#DZh?nQz0y7xVxIQT2MG*G%TiaC#pL;&FoZg-hnax`$vMVw$0RUP%A zdIX-taFTE@$Hg40l2$w+>Uw>yG`qHV$ie09MWpk6&yAGEO|`mt5=~zmNS;|Z&(#ET zFH9{~%$zgStNw+-a$`*3M89Yq_gwB2nHxs)szsNo7LA}Ggr{js42?PU#TIq3mg#JN zzu~eyDrxwrf6(xe?vDzs}g7j)Z?5mhBOCsjr+P1RjnzVtTNRt1mO z(WjRlg|GmY9;-VLGhzn>#SzSMq75ynzx6_Za16FgTrD@9Ndq3n&G+57%V|$msMDFG zp%+9-h(Gilhobh$70sqSg)P$U<%J<;$D{$M4pmMm6~WPl!owam{zs6;APCZ;*uQg9 z#4KB5`eZdAjDsE!qsM@#%P&QX4%v)plKm`@CfP3nX_CzWX_6JWpw1`4MxF08AeXd( zbUsnW4Z^|)N0>nU6tolQSOxiOu1n6tRa=L6Z9Q7rs%Uvuv}>okB6m9@i&I5dxo2;V z55fH=wjWBgqHtZ?hHUGe=3pBFIrmIFoKAdKY3Dfl2L=}#($hLeImp{Vo|q^{xETE$ zUb8}l{;2L_HHVDMOT4lieOh(uEwHYg&RFR~A?-Mnt89m~T#)N`a%HVuByBR?ok$4X zkd@xqEAffiEi0FYjwhvgSGgStiEL5A;>!D)%~tRgDR03^1*b%2sJ=ZE!gB!BN_&>~ z^*>)eIamUhmB8FXYzg_#xC=O#Y{{Qb0m`($P$Ay1Sm1h41o#R3;M8u+$rF?}?0#5K z;NEBw{IJz(*ctSS#E6c|*NYf#bYyYnSJ#Vp7vj;v0paF%i7UM-Zhur5;Hk!HJ~T3K zNQpg=+D4j4ZOwJkLazRN=p&VTJ5?I1qFiz!;>1T`^?X+8<)Oi(D6CewSS`r=8n&J< ztL+(qvldhr8ug7KUU`Ye9bcgnqV6g|I^|XQ<(bRFRUq0eU7kR7$y2Xr`WcYz)h@_> zI)9>IMqzm_uJn7&$6sm7A+Q3S44LS^#dDtDL^E?^y8O2*TYDyQ5TglxntyJooHU?fd#d1C)x~Jq@ zsh>zK$gY1Ng^LC|rtPw^*tM6bwBo0TygZlFe*Wak1>zeW#kr$cD@ShE3#8Jv3bUNG zVKR956ygkhrC>D@icsLwqm?g^l+VLshcx$+lf&|Pxf_xUsS31@Ym$oSy8E| zfcMWyMhOW$?y{jq`YCzJeP6v*=0u&4f+8-wh%JT7?~zb&-6mtq`PFO+i#ea~jMx1o zZcG$+Xz(?4eU2C}JL0ZdN;v!ssn%H{m#$fnRKa5RbWF7FBknQ38>`V})x9;Ja|v1A zM)~hnpS)LyTb7bPt0r3mp1w?gan?}djvrBOUUy~X9`?i9>0qLtHE!k2bQrTC%lSs@ z{eUeIKH@XMjc6Xk(}d_UBr%Eu4Eud^4Wkw4nszf2=(h9{T2U&pc+_*-sdvi!L5 z>89Qw*CdDxfIw&R4IcVbYVz&E@WT)x*%tZPIC`}u-zM$tZD|*R+3*=Kd$UGTv|OO+HjS zz}%%$id7GvDGI9k(n z%Sh3d^H$nj@;26MT{|f;+xrno=8;s;c)RU^5hMFHYVG`c{E_8GU&FrLhZGHX_c~x< zcxu6(R~EIOR)QFA?f`1ii9cop;I3+x%lZE+%XW|qgCn}^0~kVRrN5R~kWM~1{Gl5DPzlZ}zCz?59*LQGLA zg*D6uvk!in%S;vJQqehYx-(#$v-eq4|Rjmtf zeR8N+qOxJ$pc*WK)O`@#=Tb|!lh8M13tDJGWRG-3*+f{uNkdUNvGsKBla4EwGuF8K z1Q!d=D~w-=OphgH+_ZAzj(5boU>NOMK2UJr-Cm`J#3?vtapfy^GmhZ)U8en@d6$7b z)RbUEbSl}uP~@5u!Ij%>BioxbI&bmk)<==D{`L#J6FwCRyu)9;7?jht^=dJYS??|y zK-<-toCDGuS&uzD66|OY!E!mLHOH3W6lM>nAkOkQbExqxU;p5_7va{Kqmb3nOh}tM zsX6T25#mGcgq(#XUAnU@af|Fv2yQdPa=z}B*-v7Q$0&3DOv{;28FNy4pD1yV6a8Z2 zQitsm4^p;j4ue|UBjVcRV95@Von?B-K?$!_={mJm+jbnD=q{Etn@;_|s8(YOjDVvg zH}4B4f%N9GE`F|9F2n7X!cQ=*02qe~$ zYJ-QsN@Z8<+$A$)?|RjZ*)R&PUA3r>gi)*%7m5yitV|rDFty&r5<)VmVYKg(Jh~9l zh0DmlhD`xDk*&&3Jt$=Kdo?{3HY#UrSVSJZpPcS7GVSGt^(kd%$sg38J>{KIO9btm z-Yx`hgUEj>{*MXTeO;$Da)mN;So5K)cZ=0EFC7_O^3ijbcdQtP{+0Z&xqm+Y;wDzgv-hE2wr}zVV%sJh07u&E$gp zv}vB;VVC}TZ;RkL`6(=!WwB8L#3lgu0AXa#R#o`>-+tOaYlx(32AW?cttzhQ=VK8i zL+Tlm3Wg;N>p;1dsz+a~{(MF13dzdG*Bf`Y9ZsWc_El@rpAfKvSWKr*RO{=Dj?o}JFP$S%4sMJS+ z5r-ATr5jP2&=pr$z*SYtc~VZavH_Ujoj3>j_`q&f-c%E`+B{^-^jxE_J^(fD(+nV_M^tYl>QYXt?orSHAbozD0ra3sn+5cJ1*L)RSCHf96X)RijJU^#KE*j# zf6;@(C_jmsMWlDUY^z6);lN~sm&jT9{Fq}4In7-u?%9On^h4{-oBwT&qpRq~aD>V= z!%>a%m`=UkJ#j-p-Kcm`doLM7X3b-Y{!ktz&9XNt=Od#$A8Y&$m3fX^`Pm-T{R1y4 ziKwnaD8%Js^nC_JTj_UGA6p1}k8a*kl2rxvZ=Un9ffsU>bO0p^9hbD+H}&^6B{gKx z9!fp~lvEd)WWVtvHNL`?wTBYXyXbtYfEKBIzX1A<+JneBK<9fANS~+v>_ZyCTs$sH z?OS5sw*1h&fQoLS9)J5JNemOw- ze}V}lw#xm0jeWUf$rXWT$t$Af8uo#nq^c#t7z6`O<4pE;cCVI+>fnL((zO2MPF@ss zat{NzgJd^KG6fr%pOMjYvj2t7({7weYShWLLi|qZZt~lW*O27Ni!kCXBS|>DnY$9- z(EE=vmOVrP4LjwYyn74YyBwJ7O#xW23|<*imWZ}GmAG#Uv+0fb6!VQ^#I7TS!1MTl z3YDtMDvb2}BP{ZYIl%)4c!1oYl!{}{x|!faE*{*CKj|tol!ckP4frY?72r>GK!kem z8;K7Ev7rmoM^5jmg$lsywfmwTrK*UlUZiQKaW<7Hehrp@2n&tJz3Q0r{dPKu!HALh zwWRCDxeALI;kIjJiS$=UG!>I7aK>^7=PP49!RzHP=`D!`G3R`_V(>0``XCfeOvI8K zxJhX@_|v~EGB#9^lqgr>Aw;#h1YZeFiHc}?e>pa8$(NDaRV2P24K^1H|9XX3*b{!K zq?8IN#K?$htdQaK8Nwf9dfg55E?{Kj-Unj5nH)P^QgZH)SI+@Jkz`{pb<&i1Yu9 zn2^Llxh!$FV=^m73PO(q#Vg0e+OCzrLX(3BaXovu5g9x9*yM{mUs=cH?dz29jtW$5 z6@>m4dOXli=<&I3^oTzCIlmNuVN!@sk57r7Bj3hFS7KAg?YGb<)aQ3dN8RnidJyEo z%xD}rDVoeb)-743nNN+BvX)R*DFLR}wL(hJdNYWG)~ictU0(H|b$O2;`cZ<~>^*#A z>NZZ68quMsslaU%ueFH_+?mtTDDUK7{xSY&Evld!Y%64ck5rew6H6=yItSU{wL-{j z5|dw4>6)K_Cy9mAe;{*zIBcN*vB_s~cM=;28@O7?Ua^6Sxcyr4d4=}-;=!$j{_IZN z?{z30RRn(mlt4&v(c2=zPAjg1}DxM13xqAcV zJwGPUN;$Et@)rmJI*p4o!nOjA(%=s8R1fGQMjqrJYNK+NYtjA?fKBZW^|6{dG_Rp- zf)2ie+cQnZ)T~~JlSsQ!$`JloV=Y20-cb zZ>Thbmim*2$c!EZxF3T;nXKG#QS(ee#J@EnO?f7fjwQ ziL3YwzO;X$;#ad6xNV8go2fsOcHoNS2J+22k&ry+=Y1+uY zi1DV=t7Ka$Lb#X{spmFSwHkSuhAX(hlv+|1NDgyrl3bpaP%?ap46LQzRsq2<-xD*k zEkg#1}Jy>09IsD+o^gh%#hTkm@|C`W@LcvF(i9d zj8@iLKx1M!NFHU`i+f1>RGYLb2Brt-lcJU3wvYyU81#@g?bx=5#*(@g=f0c1}HU46=q`q(x%eLVy+e?Tf6Gz9X zmi-6z%ca0$WlvLpok7t}iHj9GtCtX9J@+#$FtYHVZu^;Iy#0)kctG|ueOLpJyp55i zxsdg!z{QyP)O32A|1m^>j!mSY8yoKj4M^xk2j`Q~WR`|PxD?M9kdhZu1ou1nAltR* zXzwc!Q|RZRh-;@Zb{9)E*{<7TKGh#11r#}$KJ+6^Pw(iL?krE%`59&JUXn36%Y9S0 zhyg86PSMToomwH{(XztDr1na(hjKY(&(A$}C$qs^Bg!SetJg3l?sxjF@G}4H#k}pl zY33~(x+89yUD`AsIm-P$Q3w6#HhG;f?T_+jK$l)J4f2+1nVv5|E_u0F-KEYm!ak@^ zZC>`sa&0#%OKN`tm`|O>dkN8!Z|D6bJm|ySW*{Bm_&hMwst$%10zIZ6aeee%=1M4V zCD3Y>wgl(}1&LkeZx!@Spyw3y9iX)e`Vr90;5iidCD79mg2Ku>g4I-aa zX`_L(hl?wKURG&W18Kh&5^hx=KE*HIE9&ieK%J~iM9BvFZGp}^M!I$59? zTwbT$>O)x{y32>Y=R-gBp}zo~Gh9m9EorK}Ur^_3sQtF+sIG_K^Ppf2TmK<}!zzXBQtzCwWwK<}%x7yY!IKsq}2 zRs9fxskaj1QGc-jNSF5mpxfzbDDWiEZ3+rP%i6QsAfUf0%9e=YGZn7dfZkN)Z3fcq z`w&R0T_mD-fu~SlB#=(Kz)zbBbc!lv7Le}mBB0?at{8h6+pW6p96aJOey8dKpI1Bh-W{89(83L|3k7}JDIp^l~HH9?<>}Kkoezm z=ksV4f0bgMxK4ZCNuHE{4`x6CJzf}@S4l_4yo%gCyqM0cx=0E?~~r8X^_{56nX zpneV_f1=3xF(6IW?*sizrF{exCT}P(goWalD(z$-o$qX*A!_Q#(xTIfMDMz-sZ@$F zkJOdPpQ4Y4C|3L8a4Els9}dqks8Zk*&o7?8lrJ9cvIeJtzB>*gZHlNWEVcl?+r&gg zdgpdqIZnlay>unS)hob1>yMu|;hPKn*ml z@+MzyX%s+`3auii(`bGSXaJ}wTIgEN9pVfKpXh5OyQ_c|({)e2>v>re7mIP{rmERY zc_Z^DijEM(9xH4yHhtmmxz>y4n6{pV#h?3g$@m^{Zf^;27OyrFmwU}Xn2mCrF0;P%=^tENSNdr$MJ zN(7q{yYe&@r7j&EjM}>y46N(fe|ZtTq<~{o0n-D{rK7!O^hxhLWM7KE!)WjiR?RCN z&B0_nYy(UN0=Eu=Stv-#Rn-uD<$CRZ#D1+u>mDVOHF60i*6G_u1rmKz4~b0qBf^L= z#iW-j$-q&d%WQtDuZah_qC1B#i3J8nsY+TM(Q#&`;XhZ~L0`ims=JBdC7#iRS$bwv zpMoyCMYvVK?kt?DtQ?uL-2-%aObIc=P>-FwCT&i>>~^y7T(NOl;;~{a+0hhC zjOC6f#tg!|w0ahK(HWTS4(+%@cvWTcgqVYe;RvELEH<0WuFGb3v~%7{?o6i zm@H|xduf*?39CCbB(}B^9yz^lY?3&~Q+vaf*(C*#o#w?Qk;|oP+YoiRQY-O~7({@I z<3W7Zh^Ynw(9CK+a+`Jq;?R<&9p^PIVq|}#(^d1{@Y2aILN~98Z&sB?l?k2?z{#?5)Y9GRxXQ{Bbmhgc4kiP$(W(+=6 z1*;xBLdV>Sz_Cy z7TlM=h8amOnP2S6n(~hTlsuL(wv;icznQDwIKE^4!eU5TQe?VFWZL<&(UKD6+dIJ0 zk|tyIH3Qnye>Uu`YF5o_64Gnlbrjc3meyXH3q2jnjh`q*AJRn|cRWA_w@`X5c>-biX zCi*%LX&cOj50HB-jnCWm1*R5vueoRb>e5e6C5|%xE$Sm8#7q!&Kp||VgnQVA%XJEV zZNZ~q+X{v46|>n4rwI9=%N^+7cT;#*S<|Is`$-cVd(fJ<#W8d=$=2D$sbzhgr% zdA6Cms&6Dqbl~VK&HH|(G;xvDXtke=HSfu*a z)uge^X#%@NWMb)-@}Y zijN<$I5d8oIFekgRn#2`LR`5Tjk>K#uC<7tS2l=><+1sQcN<8&JE<2>N@ayl5N*MY zJ_3;@K8e1S9c1DdN<=K_6=H7uU%b5we3ZrY|G$An0)kIa)Oe4I74N}o@J3b>+0~6g zEs9oKEQ(m`*9#j#tCDrIgs1Crv0l)&7JIR@-(H{>Nw8`HNWiulwJJ(mqt(jeRz+(O zP|5Fo&Uv0^HwoIy|NHv$((LD%>zSD|XJ*cvnThUCWoU+SZDPOG3G+80M*gXxNMXZ5 z;G+Fxy0JJ!KLwd0B}K(QsJ@vH%?FvUNY$UHubf;pHxVS}HW=14w}U`Kt0j-aLN~E6 znvTH7W)x%;d!kq;Afu=VOWa%}5 zOj+|ykX?BD0O&^=PE=eLPNs-X?hJdQtx=L2PHaP+J_T191w%{x!Ibp($$ z6)M_3cWAJ$@R+cqox|hI*l4QkO08&-l=mtM7m%fA=<8$y;5pVk+z?WiyJ=Y6*ex># zC37bhc#pjE@)Z@tX5ja?F5tmSg$Hwc)aA|^mgwk4t=^&hs^`8_!$MOZzLV~Wb?$A$ zGHc6trIDMIG0^LHHJWhu-GwW`Z`q~1r`BlCO(hueFe4A|PnY|KB6Ku4ISa0Ujp995Rj^xxEIc!v?Ekz&7y zaB4AP4paSgsblMMwUu>aW0f=F!NO215aqfEe8-B<4e!vA?O`U*kz`%&nJI4YWF%2d zjO#TTm#PgxVJA6dwi1Hl{BIXet&lbi8^UQ`E%9u6S1g)RXq4@Pb@U#! zG!8esTR5yY3C-Umsid6$l${`VO{`}^6&pl_FA5QzJ`sL3Rh1HvI#c$K{2d~fb4Rl) zI>%QMf-;tDw}{Ccp5hWD?sJs8sW6-qZ@Wtrvu`(Ukhdob{|IZv$yUSMW7c`s^K&p^ zjX913UA2eEhD$=XuYnrXtrKKRDmi&)F=Xjmp>jp8a5rC(apo(V0lTTM=x*Z3mS{vy zW*FPaWvPa=BiZ$E!Ks!?In|=e!@%;}eZzTJ4?DDP99-(QvZH(OirG>QwK^WM(yWh* zL3-V}!$ZlknTAEYoSoTGF2#sg(CgMVd{9D1U`N>bixr(`YHxQcT9z<_-+m15sUhHqS`L!ea*({1gXCNo(pftpQcJYX+BnI|uNJ1W zcCvovb{45K!Fs-vNfV@G5ywRYfnd7a1i_bkcfM>-&Q|kztzF^4v=-)7ee2+LFZ{Vmjg)VE2owW z$+1$~Ba!KixrxTc4!Fof=W$JWXF7`=a0!nF1T4xSEIV$L8_C3g4~0Y6^Uj~~Ye{CGONh8AGY z9iHjx#h-=UIIGpCn+y*$k2=A@UmLfCGC6E@DJ*PIKvYo6F zBS&LAS;JW+Y1NdTXU;9tY!Ga`RPZ!sLq(in^3TZ5oddhe(?2W;8{ZtW*)GbLn;U8$ zMvc>xdMBuoH~L*Y@mx?PPlk&YJ8D*F`)WvO3iO0_ky}Daefml-cJSZytRhS(6I0W6 zG@sDvTJiYFF?y(8?yd08SNrppQt?wft%9W1iHASUywoGV-r_CrStX>H{9rdGvQ~>A z(+T6q9OyOG(8_Gd+;%WPh0JJuTO?7jc(Xojd`h}A;K~`J8JuJS%VaDZm`*AY;Q!G8 zrNh!jNsY^$dd;zDmzi(kDFE6&p=jbBKVA_Ujsd*G2RCmPivLR z+$ub=ncAnbOHiJCC#F90ht7F#Zu|nr;xJ(isHGnb<6hD-n|kSTOm_CwRdiOKb&5b zc4*z!j^~E>%w+G5Nq0Rw7?PQO=zT@;^w!9(H%DgfhKC>8m7A|pLv^vG*B{$D>%D!# zMiGv;C2Im?b~S!AuoevlHrZP5OM{K;9DTabUP6wiw`um1S-(_n9$!(`R!NF+r~b)e zKR7AQOO32;D)i>qh=fXU=XwWMFENEEkLUJG>N$Jc!;zaK-JMtv3<{PAT81L=pC{p+C8sE!6locRTc#aXvlx_f&Mh(nZ4^NXR|mL9J3$#(J`=SEcY3!GM##CeyU zs#se)_oi#yiPOCw5Fow%fO8{}nP=zcytJMNBDPF)T0W2(%kO>*!&iK2^!9jJ*Xcdo z2|3=DUeB~+P5Kz7mIIm|l(FI!n5v3hCuthD!;`I&^!8&KN%4|aktONv|3mW5{JqrU z2*J&NSA3-6PZUoUoZS<0bnpL2p%L5Qya^Y-?av{x7rQ|PKv*D^JhGRT%~BP=qeJw5Jc z8~)PHBNwcNC`gxNh*UW}K4`s`NlxF2!#?q`@$$xZlX@0c=9+=JO76Mo)OeCr(}S-Q zZ94&Mq^!U#ln_qy@^X@QJJQ?Bq}K0lN4mz{i^`Mv7RfD{n=e0D^>WwX%2@eICp#40 z#def8*mD<`C){reeGR!?G23l?JDI;zgS*f9F8^$BcTRL_iM{t>gZw?WFQf6c-RiW& z-~Me38g=y_}(aF%D(+ggk3X7y8ghXhy1QT zPrAN_h;twTY*nb&mCdQ-+lvuP$d~h`x{5{qbkW1RA<7%2p3>pB@M(A7XovqBpW5N& zfUNh)Zc>*K_kBh*e*xwRRVFLu5>|MZdF%@WguC^cLBBC|QS9oS{N8fBg{kaTL#KH+ z2;yeL0jWcRi#qqUi#ngOjRD=c=juk8!pW_TxdqZJ@lzJoLY32e5Y)@HOy(9>x1+=@ zzhJ$%ja|5uAE&tnH?qMLdLpPNUM_h$*&F!q=JF@jDrW$+J$8e_SnHIa6{Gsu6ny?u z<2Uf6~OMgtQwqU|-Uv{0q{qMt=Vnq)Fc10L@Vahfa<*pHWfEnO3RzT)L(| z!Qxax@Dm!aFTuYM*UzX+xxwbYAXxJDCTfm-2|mpTp4^{caVjBr30z9T2DRp;yNB3SUQ1pD_<%^*QIxX`p^wAPJ-OH!Ze2x>JE5Ttp zyOPdFJzjkfI!&?+DJ^w4Omo|6MS7oD^!(Q9Dm)Lx;i}G!hzB?QYaxGRF@!}QWYIq- z`F)7?LuBi_{F-cK5~uSJ?@u`Sg=Jdb#aDdneJc7-fVC^7k$lmANH5vTxZXKOyyYLT zDE&3I*Bqo96sHjfiZe>f4-U(}ztrR7UOjFyGF&fNx@|gWjVlc|f^eVoc>9&Q?S|Wj zJ>HN~H`}A}{z*n*9z#|TwZ}V$w2OuPDb;ow&JA^*rmY)S*Mp zZU08y-U|}CXEaMhOUQc*FPnjOytz~6&Du=&<3qOC)Wo|5zpw=RN>jhpSUo>)QdMI577m+JbW@Su`(=3OW0y!uH# z8gu6e_THdkrTzz!pxd^Eu->!9y3Q?>($VOa|A+aJ5Fk!4z=yGXwB1!7@4MQ1*GYrk zWeGO_k`Fr01d77Mz3~LdvQ<(w#Fng*4n&OUT)(!G?V<9{+R-&q8ZLn#raNo2cV>~C zj_zSAdSEUuN8&uQAWc6CZ@&&rB8bsqAQ6^Gc?K9obE}9{+w|sOSnnvQ;I}C9ju>3d z9_*OG#ixY9|5xg4VXH8>*hVn1lLgeD5m#?~X#%^f z=y{yBpD(ji_dZ==9E!hiZ#`~qo5}yuD0`CU>>lqD_5P_;(?5f9srE)rhLM(PZ#IBK zVu!9^DC+UraFg`kknyGM+f0$XU;9qas?%yo^Ff>_(y>zHyTSSKJ*P2pQE4rFxozDN z=oVnQr>vH0jqt~5=sYbFsS*aPia5zGci{vn@CAgD48*5QwH%igI4(>x4{PwOV zW{XnfG{3Z=)bRv@x@}9P^wP58J5_xbiSMyNLNfU{K>E~duL3udyqP!4kWKk$Aa|ps zq5Ua_T>KGM+(=S*x5ul&Ei9ie{-31M`ij$sg9?`1_h@6p?m2j#RN{~hSAV@b36bg9 z>4stX@vn(aHFG%CM=exKo0%et65UPvm>|&hnN*srKfwKvju(6VHc*t%0t+eu&anjTRX)^%_m_f>LCh)_~ zZIsl>js;V;GsXP~a9BHjN0&uR=(e}i&PU!qiUk(E5 zqeFf&_9h_82a!qgTjOX+2uBC3in6$gPbvna> z7tQ`BRCib?od;NvTFaisWVeFt)q<;mYESix}My(2xom~i1v%%|Qw3V!Oc& zN@!ImHvd9`6UY|>A&obYv*zSc3dPwqY(La|vw zhp&fn5n1VR``8HN^AlHv*f_MN#b$Y>}>R`7RgmTD_@)ZB)&!xQdyG3MdZ&tJoVra_Q~Yo=Z2(ZpN(K_5wB{HM}>( z$~-exwEu!WWs)uu%_iwQ0uo^>)BBkwBWm|@+RPq?l?g$1(d%f9MIo!ga!#1rT#+p^ z!_R7wWz)mYD*3!9{H&DEv%}BDBJWS((;uJ%H6GWj9~uU#p)-1Wgr8kfy20V+0?B?0 zb2=;gCh_&c&nEGGIsB}Z?0*-2&XUjHhM&{r^Jn2_1r6;z5Pr(Y<;@R27YON1d^WYo zwg=Bq&)~z?J$P4wTO+lMbt)UZ3;E9Ww8^|%mK70)*A44&V-6`w65&em!BI^PRCku277oj>W+(94Az2a{etT#ZI5~7yX=prw~fcc zX;}-E>?}b|$<7k%=(+HM_W@Op$ZUc~z3&iE+-ZC7Pq=fnx^{@h)3H`!B-o*9Vb-Up z7O-<^k=U4KBJgBChGaQC&B@b^LW=BE9!-Y+Aa=0i?QVR zk0pt4FSwd?O0*mULQ;GI%HSbqn#I6>CTt>uS-PW3=~z=r$3sMn=jPYKHsSj{66sKJ zcU#2WYZ9F9SWj&4aX1_-ngZ`vU@CAEKi(ypPU)V)2u7i}#hfmovljX~34L_`&`}P+ zTIg~KaiN7Sr$)SpxyzXmZyfIAKTGg&hU0<{^|8>nk71eeNd;v8jw3n~YRvnMlr!Bi zMS^|6pC=`$=3=4*G+SRNoLwF(RSQvY54! z%E=aUfyDf)v@Vu2;(m~YsTRD4V7AJMyMv;LvtN|$6h-Es9j{hMQ3QGmEYZc1@gMjD znWH7M8*v9uM!b4owJ=*G%#SV15^?{$xvv-Zh5UiIF2PyD-4aIbtCS7S&iZ!fK&_o! zE5H2X{-pMJUO#!rBDivkR+RUN8rzvxaTQ0^lk$S`N%8z6QXTOeW?^A(=*-B6{FCcV z89B&E?lvvGkxvtQRI-#k(jYzFc6~XXUKQ6Qzac-^%vv8ybk31)`BzMJtE9RcJ3zcEUJ?lTZ}mJgkd(P<;t-EsiRSc$nAbX+jROFi6NJ0{KZfHH9aKZKcOYd zg|1#q8PCl#$9WQ370hI{M6&vWb%8Fa>|y+&5#(kdF9IfvY$8B_?mG0|=nZxn%!;DS zYqo?c$=s7$kc|E^r9bi+^ow7S{_W6Tu_OA;ah`=~j!~&QHSS=zw&<{xyREkyQ58go-uQM4aZ! zB$|$NRa*RBBVC<%2Cp(UH3dyIMB~VTr(PLgTdIjORq$Jv0eGXfM{nazr$tU3GG@`( z-LQ{^5xNGedy6=FPk@^q6dC^sC0;6}m*d?=>>@}A1UwP5_Y*jonNf>MQ z26N6`BuGF6jHYvBr=HPxo&@$TlZbA5fiS@NU@d_taIJdsR`+s!syAD5Pj_4=l*|AV zZHn;3zC^=aSkwEWg{hG6=NaCFw`!_1>34;Xsc*AZ(wT*I0x71-H7jR;&q%P}W4L?`PVx_eAU!Ck_q~)cx3ziP;6%5wbh$|zh z5cw17oe(eh0l~dll&&+*LT{8}$mL8lsxL{L?0piWGaX0_Z<(dGQBu?SUAm)5szoeO zsjkJ+li!9g@FKylTJ;nO*w> zWD-F-%TTGIY?aV*j;Kv1*X(jr0-jKw8J0jJg(m1p_e0SHZNS1yBFMjZ?i?k*f|Ww1 zO?VYO$_H9AMydCPeB?_iG>~VMC7yfODteg=_x@hB_ZyAT*uEm7=@fNb=}s${oPp75 z@V=ozwc|sjx`}{!TPXX#5ire%kOgW&IC>wDulR%e^+S|@zMw*9wT*05)9Jl01a#^W z3*>7o{;ZDlhrmI*ZEpF0$Ua5hF-6E6NjA7&B&Y*<HI7CxJUpGYUA?gZI6b*vu zxb_Db1?PdPwUn2IZr6Y=*E(nfSsnZql+kdfp_DON8bWkE=t_+twucs@1$2kT_+A+9 zmmzu?^i_@V8pvY213Fh@RHCM^_NWF~yETFyK@3MD8PJDtZ8Y+G&=)jD@eGo^yOrcR z{-oPbqq0(FfJeJ8B=h1Xk8C}yVm!0uh(;d&4n#YLveen4@G6mU#JZO<}Y5xOY!QPIYq~a}Jd&W;@&oA-tSkX*ho-5o%^V16%3xgg<*T*$<;aM;t ztMwGg?-0=2icSE@Jy_954D_g?;+e4_^=`YJTdctMk)m($nh-q}&#e=?1cbC?%o-b5~8<~SyzP>U{yFZlX-#^Ngu@aRqKTQ zjSBKL;6ee=0-4ZcLQePg+VU>9Mx$Cdz&tBr-RZGdsDP zPj1<(=23_(y2a4*WM*5`X}MM1$q8>B#fj^qINW`(C7z$a&eEhUx$67{+cidJ+aRZ< z!NMQeJG?)ObF%x1xBK*%b$y0DQN4C4nXKow&{R6IdSYT!nwh?X7OS%9Qwb5~Ug7;= zhv6%2@>CK&R}r&YXWX^!GqLB|>kh1qW>#*e1T&K~%9wTz%Ar6nIVcy;Ei?MK-s~#L zWyiaWomvWFvg(sk@PEV`t5hxA0#@6Y!!$lCl4rCx(fFNn#8dux!^AU~G}_DB=z#Fi zuwDU#w+83RalVrIw5E)*8(n@x7l;~`(cU*tl>N6~qmFb86>Cf!C4c#6v#!5MZxH=!G;&9X9tN2hmb*mF zSMGeW0Z6V%x4!ag&>9BBXrvotLyTN{E|yhXMF_H9D4Pt{3+3fC>xJ^1(D(V@ztFPx zNzB%;v)x7zmK#BTyH-BAI|wyIYPTf2#$(o%oCNCW%G}1Yo`>U6sl8J7e@`KfJZ2sQ z?RiH1yn}Jyd{(rIdr$J`R$F7|<}Ie|+Rc9|AUCI7zmau0z?cn%3eL)#W6!Gi*i|#G z<0h}gcqMYDvIgsEJihQZIs033`j^#c&poXK;g#ufekhNB?$(c!`WbKVCEVy=;yv@$ z;xA`gS7(&H+xWQ)D|@;ME8<3Dun?THSd!!)?B6cG{Nsg!F8N{AH6om? z2ASe1EFhleCvzvs{`^tB=#}@zY_tBHa8usDwZq@6@3)Ch-T_;Y{1!j?Dd}+&ci$z_ z*kE@X#WS-jBB`UsY~VGh()z(Dpgdmok~VtvkF>37 zA)SZdnrLJ*$ofD{*c-kAvL14E=qCCg3-_ZC$x{L5_IQZON%aM$LD7iZie|oIf@Me! zpAKan5{;xl?=iiOM(zuJiz8N*e+7;R#c-5Poz0yIZ50q)bUK=QVSHAsk;VVI(e&$n%w`#lvGkEC5@U2>QzhxzY49UJwhJqQ$p}}{dfzH*w{qxx z9R9)1DFipt9@_^8JtB3Z%JT6p zbg=82whp~v-`LVaV)=6(&ul$p=Ja@LkT8dE*Up%%p$F9I<)mv#VCW4a2%e8Up4oE9 z%##z&_d91C?~fj5lJLN;_U@=WsZ!R(J9AE~yd7Ftb3%&cRW`j`5cqX z&Bh9cor~3Efa{85_|@v9nj7~J7a4&97keph4b|Awp5Xd7UKlN{zcrCd@Ngb3&ul#= z^?r6;<9lN^7q}Msyh^{hgWJV8=p4ET>qGc?)uBtZ?@|-G)Tm29bYbuCN~eOu^;7|S zN+l`(_r57QEGzv*6aeGR` zeIIn4h7&tM3%3qrtD_e{*6Uhmw>uA(^!^C4KDixaJ+YELU>7SM9-^;-%vVNPL$a%C zNS;PD^s5j(7NRFZR0z>F&BUDfQ^yw{$kZ7nj~<+V9UPQ;MXo$qvy(`T6t|efGqWmrE4m{eO%%jgM|u%h z{!6n*k+@ZQD4I$y3ryy&uWHEMHbu&bMp-u8s6l3T4Y@f@LRX%JAhScG@ugVL1rT{^ zr*l9pc4Ol-!k_UkUMOqC@=C-7O6|)HyppTIWQrBfJU*RuOvGuHHjZ@;Ca*|aWI-Uj z67KlwqDXA+=ZWZU=gmQ;BUJa2s?^X-_bZ${k*`GVu`0?yJ@)Q!a=mD;4wo7ySI$Uh z!xk{$e?D~HF*0$)1Cq>|Xk~+?*SGfl77*v(MV<2JWDGh6;@IX$mQ!g2a_ zX7=QXHw?|(Gz7L5rpV0`ew3|MD5+{3TsR=;leH!9I#?(P@VCsmDp%taHb^R|@qP-z zdlKM@!k-)5&NcNtkk=sU6kSC8F#&fX*BUe=}cDy?tC9a8Xs&)_h2a0&w&PFMBy*G~Vonrlu5mTY< zcz%t`9|D=EmYusBt3?2cCHjjh$g`kl6n&1$t>FJ?WEOw_sBW?{`h~g``F)aceERRx zAvrMgQoh#*Y!bQI%J*0K&v^8cP8a%&FJox`cRUX4%Zu1^gztFx9pIrRiew!?&neIW z0wJM3pJT-28f6lxdN_$=tQfm^}SNR8=N2tA{4iAD5BP4OKej^X?|Ia9UxT zBCRLkR+twrThFs?Pp_$eiX~vZNQlU^&id8S;C^~}h7k4V*O)y^e;5Byq3~KVr-TIR z%4v1(6@TDP#@*vQTgdwl^{Z`~tksyzX)zkyjj?5oL4P|SmYXjfoSx}qzQ&^r5a_j7$k;2G9dv8t#cO-Q!-y)Igt zNQX-#d4*;Rp7PHZ5RF$M)h}U7Pzud3>CE*6xN{cJ&Q0^ghCXWdZDL1sJ_!;$&Z7@a zr$7IfW#1`_^JKvt$B8pe9fu!y?pL%#tIqoF7V$OYX>?Ia=@0mjW?i|Vg(@OdXeINNGRVH2E`~aUiN^Le_D3KO^%lZ#U3l?Z@tTwgJ0Qjbst+6^{f98S^Ozc%@+vcuupU8IP2>_p~y* z4YCfC3(}I_AZazWdP7JI^@cx+E(h5t`gtnWM$8Q8c-2xCK(_Qj6#HmjnBsOFZAXC? z5kDF^2b5E{D?oD<%>?a4zERcU*r+T<`j*>U_?X*XRKB_W3Y68j(jbzh>w{|2o(Nd!*rJ50`YQ0f&UX!4_v@Z^&nifebP_xLx zBcSbBc73^S*{0@3;9+tFTaQtn}`NAQC9LInB4@6b?)KQAB%bg-LTTEb-C`k0#oR z_zQ$Cu892%i<7?f4Y_N}*9^Alla6{v5JBg92WdW!Ev94XqWJ{*_6<4`?&?0;xIyZB z&BlaV&l>x6r}-lY3pOHG1d6lbJQ!u%;6A#zkI}_th=nHXkj7gHFkapzk#|DoK8?MT@`tr3qP{ys4swjIgnV*0%jOe6afO3}I)jmC^_p+0?M{Ju zSQ%S0fQGteBST{=#bVg)(e0=?G5|RvY#e+@#-XjjJ8FkBl5Iq4(bH4*ykce0m7HQ% zQX#&1&K$@azzgr4^*Z~4B4SsPHf>N5<7s$&D#;k_`^RifF-nh4bk>VXAsnKIXCB)m z-?mz0LNC$zx}U#1uO>E&zS5ChKY6*`yvD3+I{8$wWG{OLjiU&~L8Ow9Ga{iybZVDa z(=CI0PH)^Pwx(_{>qT@QwIr*=YaD6oHDu6(Ezax2bRHhTQ|z~)#%zA}ruVVN@7BlU z1M||vLRB7aTffgZFbSN8?5;QiGk0&a)^K z>jlP}h<7?u7*b^+IXIcSqC4q!$2RMxMR{YC?WXEqmC5q!Flaa8hWNx4_K+4jF(mrA zfM{F~@@e4pp5P1tN^IycnaaiM8;T*c1o(-jL^>y3jlQEJ13OJn%B0b~6dN^hnik7E zCK?>Sxnhs*BlzJFeiO+JF8AVsl|j?CQ{|j*vP?9>&~(GUYMU#z^lhKil>Tk=#h{q| z+U8`xZN?f=Qm5=R^>|`tK|A~cvcjfey`w9t-WA_;Yc$e$T2TF|<36k6PYEl2m`~BN zGPfZrC9NvfZBYBN#&ciwYo8HmIK;q?rdH7fpqAbr^5hN3YlM^BOE-nRX5 z=%z%uc^~lCU7P9t#GNCMg;p0oXnSN^?=i9MX&Cz^JwznuUA*7gcpT~R*rb!lec9*4 zgl)`)EuU~-Q8UtF=nFzzQ$AN@bVU~ z7V%&a>B+rsi^qsTJafwGOW>{+(hWkf+MYL4zOAB^L$$xQQ7iC~AI-Z!rWoGYvVfJ>q=Jg9{u?|F}E%?B$4@O=LYw=#y=)9+lHkUCCZ+Z_vqIp z+$T#T?<#S5z7y$NXo=_N$wJVlO^e3lox7N&9{o?k5`@~NB58$9A@9ftt9>+VGM<@F zId$$vauq@EeU4g1IVdkK++5b@oy@}n`F>!)n7L?&PoIB$5bBh) z7{tXdCxO6oda3-xJ_$ub{MJy7bL(q+ArhP(Ddy_3#A7)NAQQ*TnX zgt?GDlD}y93p?{jz~C|KH2=Bm(wtkx`zDK&71pH=sLLfr#WJsAeQ9c$UfzwbQe8oX z)by*6&jl5-pYyQeCc|w<$cee_zGauYo@N`{gfjMc)jOq*!sfF&!k^LFKV+;Wg4~kP zljv-hA2JOi`?)*Kr*9G6W1l9e4k$R3ZNQRYw>0}Og^#%-qa+1%ub3ju`x~x)D$cx@ z_~@UKnOJd5YX#ocPrbFQ-C(>W?CM>yC3U=tL{4kfGk(=p6rw@5*#{-F=zrg}L208e z1DBS$^-)`C%%YhBdB*6xh)}WpJ(2)Sq4C6ACgzN&8#O`y z*6QDC{aYnrCPZp2a2!V0ST+2zc~UoOvbZGkKbJiOnTGJwCP|A-K6h-q(#g!_O9phi zNIi8Ujy!gBeQ^1`H(t(t=kC!2MC130#FjT_c?bfPu&(gExCQDX&Qvu|cTMD?+?~MW z;5B^$!l7WS-#Sg-bUfYxX&yeGNuuMcO~R@*Nn&Gu1{aFnugZ_D6umD3GI-|~QoSGQF?VInpm0}1Cr^iK zo$VIOB}Y|C#ogY?B*i-$7DiEXCO;=qF}65b0l{y1fCq2=z@g@&QN=0Y@Vab!WL%hUmZ$T@A995o_p|bSc{e`an?&sGw**$XaU! z$Xeea{dbtJMR8Vt*@s!x$LuK> z4*M;~*|Q?bbt1Ml_{;HY8QZ=qNo!WWlyq|~i{&S8T46t{o_ps?p!~jM_PXx+6qmd4 z+&;vX+37i?c7A27&Bop>J@+n&Ij^29&qpT$qXV2Bq?{xeX0hbd&}|Niwu>PVgDLjdOB8VnzpJ`T>l@4TBNU zG=(&Q z<03BydmvuoMVd~dr}UIHj*sV5ug1>aVt*Eut6$8TGd|=cZmp?GCF1wRKl})XLValF zl3p#%(@Pa(afx=-y5}0cQbE+uUG3&{8YoLtbWA zqbfC6b0|c`KjAj8t5-kTCTI0EkQ*0r`JI3cm?Dj+pUlT}-|;$iY|6{5Z=f_7`<~VC z6;np1`8n!9r;Sdt><0Pkg~F(5ZBo}(ALtKGIR*7WJU?t8tFM8gSooF(zKLU1zjM2I z&%Ba;)Xqa9r=jN&RbEdg@9Xk-)y72UYNh=YUzReA~Qs=5$+{xZzZc(n% zVmWx4lfBv;1}!UN8YXPWlJT4ZPwMeWS>*H7!UX-KZshZ*LQFqt82Q}4aIAjPs(dyc z(nq2@4?ihSppT*S6=$40>{utem5mft-^fX_ST5U6L`-5wvW$g;w*}2PGrp0zv?)B=4g}fJQ$)>ND zMN)&P-om&w^^56im%_F$ttg`m#*AySizO{&D0bJ%je|(qM~;J{4p@l!K(d6BC{O@Z!@7)!FwA4&io7o@7GcA z_8cX#HwB|2+1IM>Vx6t|Kr%F2?|ScK$lhhZNaJ@!wc!ceXQU5iuB-J zTT}R_uK841{ufa_A+B^5qw6SrgREqMpLt|0`RV%ps6;L=Eo@waXqFH8XL{3JSiF>K z0Cw>{X6;gozYUdbpug%;p%Ww;?Pz2JXkoRWMhg2+ofyhKa`ZrPb3s#25%dJ;az$6s zF>Q+70MovEr1)MEB6&B#+-?q$8=}`i1?nmq`8&v7c^*hNkf+z9kbG2`Xwe?C5(WQ zFVyw47Y2-JpSzQuk*g{(8nXj*8^?xiJ|ARd>sO*$-CRxP+L{RSh=^OAv&fhdY^S9c z%q-LGF2BU4htD~x;X=_4;z+d=L_~mu}0Rye|w5QfXYF zZ`JEA?ImVPB~}8aZdeL3j+Ui_wYpfN*fLYjU04tKDdf189l(UxE5SS~m0?Ww?%$*Jw#$5-K zoVrbR#G-`JPaqE~Yd^lWo+_04OwHcS6bf1|J7Mx1UswQ1#P(^$xcx#5 zmq)D*bh1wKk;Lgw{idD^bsfqcE!)C6)`}5peKWTOO9O0f=|HqqnE`X4sj}I%@tyLA zY>(YeXkm<^PI}n?txlSCdt}-I%aui2a34Ux>;9t6S$>a9141p2~gk?hMrrdB9`j5GfUGTBYD`?6b1z%7OYGHyKzWc)3r zi^CWN7%4!O%B`SL%HLT~U;Yj)NM#rg7H&!Rsm}V3D{#?wxO8e1Yh^SD6t81ZBN`7!<_J|Z$Rw|-pV+_751khtVm65wZi7K?<;Gru^8 zvNhYhMAK|L`ed7G^r=s{8zte}rbU}9a<+ZeMRE65jHb#X@Os?!Vy&`p(!7<42(M;d zL1t%_OKz!yS-Y7;Bg=OmLGML9$X{Qbz$~{mSmja7=Qxoqe{L&(MCvLmd0~)#!*A); z(ulp5cXEoG#4TO)6h;Di-u20Ro?qEW67%3uXxmS0i^cBe(#p*Ol& zDpH1u_@ek>tDI(GyhPcW!ozGK`jv_TIasV7FAsgYe`|0*PUcR7MC!O2YJ8jeYoG>C!YgWLvN_C7Hq?4bb4e+2DSV;0B!B zrR~YXUX8EVeEwg5DAz&9$3ElCzfYDXD~9}Z--|Cl<&_?sZX3g5SX%H1j$bc|U)8P) zW7fSLZ;gw0Z24SS7p|E3oi^nyCZh8%B7Q9W$#IABkxlA4=fA5=r+F2zy`N|j_3y@y zt6z>D=)+?h9%r91KBU9RzQdAg%!Z~%o1_k%W?9V9z@7E$h0W;>>wB@KGxsqKaBlgh zhHxJygm*80m}o|>)7j=_pb-eGs9Lk#scy2jyt}$d7yFL7y$jky-F7B>iz|jXcd4%^ z_7^GoD(HAdGHlsF52#xX=YVXs{t(D!>tCl;EtPp7OXU@iQCf!NG^C>_&(_+N5f~vp%Yy-K z{l_A5O6nLzT=k`^4yGU_(R!a|oG#PKDGdy>oG+B|mK%@iuj{NQE4qQKJVazX1EVf2 zGhxACI2WObhV<>kZ>6X6Z+0?&YZrr8wmsq0t!8>q8J~JSQ-nL7(K$k9E8_S&no>g- zjU7R=AN1b9!hmGw-9ZrSIbZ&9ld*h*<}a|tVh`w!Umc9Svm12 z&k@tbvhA~niB3E7NlSw3n|+Z>^?;a!@DPx*kuI+k7{UYh5BCGas|ZoG@ih!fm;Z z1Y?`Cq5v&RomOC!TUIuA7e)suPOnO3#yN<*Ee7$4v81eVq$J2It>l39Z+0c)eqk^= zg<5fNTV_e}PDNHU^QiS&g#OrLd_?2`I#c%V4HKVy-KdW`T0 zc@B`FFJ$siMNBT)dn%UMKHO<}n%q#(N)w$ub=XpD@K5h~b{IU^5D)pGHMWR=SV)@egCvt**o3E9X(?a!9 zxZCL-?@PpGqnmliq|w-xRX5~*Br$>$zmzs3uVM5qhU2un#PqHqe_;g$pR7e0xh!7x zBqc^9mjn485kYX*AGve1_TE{N^ZAaAS=1YZ#8v!rXyHB8wqpvl% ze^h}{?`~{B8Ru?lx^?X!r}+aR=QLpt=XSYI(2wbf*>N!yjj3m@yzfJ*>5*Py9QbjB z+!`;Ux%KsrVKNxyCm{~3LLj?Jb+k_tj3GUlJ5ZKGd&DxgjN(Pq<{`98L+b+u^nO)f#kNMPbK9qNw4)~P9A6PF zLpwZvS83};C>l4!X?~yV=}9uH^8N-+am~`(FT#|(9~cOgx{E^DMRj$d&q$!_$Voe&w*RnpXyT=?;?R4*d*Lh-8PeN zgUfFGVcxOBB|WY`5WVA=eCk55C-SKKMAg$pnk~rUP(13a?{WDA2=u7NtIY<>^NVlk1Qu> zmhTWaAu$i*a@6xmv!n>g+@wk;TR_zoYdU$5lRZhtsczKM=Z(m0g?)aGgOoHw{i1I` zjgG=Nws{R5U7m8K`Uh$Cqqd@)T$WNah`Ja5KKw1lVCYn?srGIrOJ$KkWwABmcg5xm zK8X8!^|Fjw!+_e`O`bt%Ub}AyS$hGTuq{kCDawH?o$9 z%0)qqq>R)|2HJTvA_r+5MkdL!?)YgJ0-Tn; z<#XT_2u@3TwN|0j5aax4#vS3b2KP!{*BG}8WNXvX5JirElaC$qTt8lal5+HCJn1*t zn;A`nzsoi0FlTa&YL>z#A-DhLQ?o2(b5Rd}N^Zl*jig6t(l8}S*N<+Jdw}Q3N3f%7 z4X2AyZ-b-kb`t(=@@Ge^b|O^vjm*5+`1^iKAmrB_Bmk= zkyQDaYobF3B-s1SC$`h2NBGjT0ZAA#*trC)BWsy1??84#QG?qRNbqY3+@H@7*||wF zsdcgsFhD@L`%JqxKp5I-K9*e$Mkrxw?{k7P<91eF6mAK|?`$nrg}sNQK$fTw^yF!R zqCnJkIRPhxV#uZHct_9?gqRV8@a|+cDrhA!JqTpteDRb6Em|H4{u(Md?-_z)3p;)! zf6m)o7;+C85B6m0dEu_pI#!lD%b#UztHyS1w9L@3qz+t98AVq*#Wmy9yf$;#^I zUOPg@s8bW^Phe^IPJHfM_UtgF+A1 zLJQM1xYw5Z{XFdBTh#qOn5mr<^ot!$o3J{dEo`3F;QmNP&0x9)CFM$qaBP_UvVW0% z=}7h*VRs;5j5VC>>Ew)jk+8v^` zOJtiZYVk{FlFHh;mXnQ+sFOWJTT<7RYfy}{%Gj&EnRV-RGP?G3po5iZp>DT5Ti9>S z8Q3HBaQi1K!)GO|1d-q;5xhP>1G|9jLuO8_&psP-?q0=_0*=hAu5bRUldX~fC8&W!nR$s~r*7_0iKZ&t#vfn?6Ls=(6;G_Ey>NG|>7%2a?4S4~3>G)y zE+Mj4Q*v)LpDa%N#ZtYkw6N0omusff6~TH*S{~CsI>?xHRO3*mSstD8S5Dqrx-ikD z7%H`{wmqSGBmc9~V$v_G02yAR&ggm$MUNOiGWMvBI{sR%7_+Ke5^e*WPPj z?^PkP*W$X@=&kZ=4vQqMMW3Q_f6Xz(Uvmt#HAj4Be)nVzGK}9!euwkB7r(pkyEnfM zzx(i8!SBBOj^LMb5Aj|3-Jjpx_&tE%k^D-@cjxy&e)r(_Al5W{vZguM8c*V5}~yeJTDxvd8T1yxo0nW{Jb-qs)et z{UDX(+mDI$skOlS9g;)S>1ZPEAs|xpO2#<$$Nwe-^zB~t{u*Ade`TRl?zG4S zp>=MzuieZIOM4@5`40y&QFVGR(Z~JT+B>MNFOgPZWiZiu^1VI-)enf`oldRg5R$qW zaYayyWbv8W$sQ`(J740D)_HN&FkRw4@eihN%(r(Fq1!C?jiIkiU8}=@T$oV8yVyA5 z-O5SyNa24(AJce{n1l4=Xwl0kM~n4wlk7@t0`%ppsvy)~0VTOKo+0FnWOFp?+@2P{ zO#5K|-z;~Jp)uauR~f(*6{s9L2TRozhL@y}IyamHt;cW2eWjE^-XheeGDu?`IhCyA zMPAFyE)W$5_7fFFYZaSKN?nXu$8>nOo14oJ)_R#xeEgVpNx1RIrt?OX)rs+|7&pD8 zG70*7?^cYLLb8*<1Z-5(t7YD?8+F1TF7+h~i)jlYUo}ON;c}ma7jJ(Gr>Lqbb)a!r zCVK@;j$Ell) z2S+J-2ee32IgkRsj+Bc=MECJs_5D8R9!38PvfPHUn0{WvT?M*NeK}a=$6XHBU#I0* z13E)}<#V@_6HdGf|y zu#^Xo%8Wew;s@=>Nc3Ruy9Gxa&`Mc=(Y&du5OD%w`HJl>edOe@;(K! z8hRcyR(-ocmhyD^l-2!>A-WfIu7+C$vNqZVny79A7|1Q|z992GmQn3u^*tG6z88Uv zf+--Q;7ZUJG~5kgxP@W3MIdXL?}9GWa6bvdojxMq-8ASK<-~naPaD_$2sA}wtN>lA zNZ!;iTJmfUOjWo0K-O;G15H!6pMxx1JIMI-9gvmn2*ll08tyod#k~UbHFdiNWN`#RMTancyP*g zy?M3iMSruIr{sdYZ;W|F_n6}eq0DNztC@G@4uO=Cop5d=lKt++qZwY&*H1+Eapx9- zB-{%Bs|E?3aGByJDsyf*A8t8!KHEMxNmomvK6U3qo}G;oGl<+p6}pwq>5c3L*0t@i zs&?${S@}Ie2D*#BQI4rralTz`xy5j4!gU|6kMGqJ-}%-^ZeV6h#muwYDzHFvzTYvU zHlE>7M)Pe%&Yd+{G*s=WeeH;TeC(-DrQ}Ko><${=$B==!#mvcZ_tdA>)a`O)Sx>ur z*62c9;-}6C<5rcNiIeza`ou?X0w@fy8qckl9(~b=(Z-o02lB$K45)buMjZ$CMlYo^TW8 zYBM2kTj*Y{Z`~j>aT{z82fd5-FB(yTN{v*~e~-hrft>?~wlGo=vxfN8SXCnT+b3im z-kFt4dgNa`cl%rh8S20&j$!893t zNvlw&OkbIw`_9Lkd)S}3p`0qoRx_{YtnZfKtc1JS11&K}q8j|#eL|T)^%?T?T|fr; zPbPn9$~fBP31BN=a#S3=)OQyewWbJDE&6uJj^EM3m;6@AH({h4W1el`y2my-q|!5? zIwrTo_}hZHyws}bf)DcZ?^)0!5sTH`sr4_ZarAAJ7Ie$N8-~alEc-x|-mI-5TF3t- z%(TwzYEmroFIb=EW@UT9w_akUK?Gz+GXJx7oP|AXkC2-_C7Ny3aE(1%E15?n2w}?0dyIC{Ypt%#pDxM5 zgN%cXWXby~LL|rjQ1W)Nm&ix(kf3yO(dX%v3tCIkMLvT??=}|YE`$GoMgOlE)UR`& zPd8JnBA@<}rur9rs=`(_{_YkgEZS{^4C*s%DWC37B^jTN6l4Z_PIEIH(2r01CESNy zFCtP2yXt$W|9`OSH02;TBq*rxiC@-`Pai;x7Ws4mUp}9zj$$gB3}e{r8B%ooq-%%k z&G%w$qW|_z!P88drh!lpcE?&H1PpHe>a$Yjm52_dpqP+;$}tG$no{A)oW98GnNZ~o z>6LDsuNv~>hfDA<;ZIMgn6$9AZ2K040h*0c(GhHT`nRagp>jI2!b2wsiRSCw4uAB` zEt!9`mSEI%jr;^=@e?XyG8yyx-ByYf%g-qh!WbgTZeB9?8;fT7%6W*-x+@5w5L(#P zw-;-af!wduO@4~Z#;n!@65cZznbWz(k7dvfW<`F{xyWQmMVNZs%AltW5TXtb4r!p4 z>2pC{Q7vO-n8p-r^Bj3^yvfPdNmGUmEUiFAeL$6tdA4W5(>lf2E% zy8u{hQBBwTBf0fsLr&SKZwV)c17aVp4%yvlzLTVSvAowLE@Ahr3&xF4?Z3U6Q9F}$ z++1E**e{viQ+|cv0TN_we<{+J^gf+Gs6wlMa#1@<>}y4`_p+}ok{+=7zfZYO<#4DB zGPE`;Tv1Z1eMl>u*Qa?(f(CO8C%XtWoOg&Q>MTWgMl1R=*q~U}eP|NTA#yG+tUXY> z!9ZnKu1kK{ZTEC&cn0%ix|3X5S zjQMdsi&IoP!tEE=@9A^M>r;DmY1DU%{OL#iGcId%TqX~n+SN)rQ|NxhhZ5#My(Z-k zijz)8?*%blQCz75?9$6su8xJH0Je=k?v0n4D z@owI#(z?%l&)Q4wBwUG7b~hWZLZ2gBySQRmre*vQ+P$Vsw$Ulm4TAZM2jTn(~2(3(J||NaKZt{=E3 zbZZaM)1ZH9Dt`vq)#}$$4Wh4&M!pT&qP{PH7U{mlUqDwVl9iQ(n+jWAsBSlc%uQ@m zexYtNm0Wa-H+Q3YDJXk?H4 zT!B4Q-Q?8|bGsg7_0kNo^d1b+V<2mzCqULlzX$E5smPslmdam17Wdr{4P^gnUk$ep zXg5U%gDl38Aj|hSkj1SF(JYYVI~!#A&H;_lR2G6Pl|>+n`(x1Y>ie6}t#~WmQ=!|d zpglC42eMS&2N^B>`Y5ugiZ!bO}tr2HsG^jaSEW&T28cKQYzBaC*{x zhP%WzA}7L8&E3lJ$v_v=N@@`nRg$VaCJNy`kDmcD9-ja*T69x`Eh|yIk4Q)0E&uHd zd%Vx~p7d2{IgXrY-T8;dG=CfOA&+bcfx`to?bf$Q0yOmeFJ zh%>5^=ym6Ri_Cgm@sb?de#<`bsW*@2h`3&jR<66uAT;bhw8#?)#xO+1h@Jc$zBpXK- zj_-4O81%$>-IYfa*oPW{wx*cn?1efVmJm7Uo=AXrdBPnU&o!)%yL>eeHC`^)@`QV0 zVG}*f-O)Om;jL444C%N24N9LC;xc7O3lVO0GD(y@L~LX4YUi!e#tLO8>Ks@0HQ9|E z@=S;iB%kjq`)ew&Y?zMwl<}dSP^K?-cR9W7+$}e}JIoN{?wVkU9%LcA(~)oJluW2L;U2U`Pe*3!@R_^1SPN;Z#qAI; zm23AXUaDpOoR)bMv9IEcg1^g1hs|6WTo1d=7` z^4i`DG52XJgxeVubVKTzx?B~Pht+3$W*uX$bz^I88|6dptji7K(hyUb6mL`a4rZ=M zv{=67@9Vh|d&^}rkMJ*f>Rn=vE&J}?dI%b`*_%L2q78mtq79shIoxnry!ka$5`GEc z$%5-p+NC7uMP++C-1(EewFnX0B2))gg}7T}^H23Cu-yL1{F%(4hrQ()6Z`JNXCha)6y>n@b5IJFSL>33ZIB4(yp;E^NeY2|Z z1cPHcQ{|zMMewCpOOH2Isy>hi4~LObzw@D66~t~_Sy(%oJoh|RL{By71{Ep)kG6M# zkE*)*{%67f38E(`3MgvOh#*#>S|x%t0~0u-Gl2Dex3yBNms*`sY6T`tE*y^oT9xWs ztM;u{`t+u~AfSZ=lmOlW*otB`Xj>VlDryZNYX0A~_BkgffIiRD_w&!^1M@rke&1`a zz4ls@K!eroOwbTTmw}A(rSF2wiB#Ht^%#kJJLn#$hgd}VX|uXL6}U-Xr@tz`<&2nv zHNByrLlnsy9&=9q7U&~g%7l?=^0*Z=S>wtQajc@dL0?t$5a>`vzXnw)5(?;GMNfl1 z)v~mMhO66apaF`ug0`sdzd^^Vn=o=Z)vZ5hq`D0Tl_?S}|Ka?o>%#3uCV>N^v(R^1vvZ!5Y3v`NwZpuZ@R#jm%<5V_31t6K}`MMckn zb}EuZb)1I#JE&aIHqbtbJ_UWG;d-;`b}8Bqv`x_<(7TGNKm#?#NKjnSS3zG_G!FFp zqooHEpd-~y6gTdtNX&&K6kP@yt7r!3EJfc3ovTQcIZjhF7i9P#KLQ!a%LhS=bo{Lj z(3>DLCWSL$#_3MbP#rmgV!rPY0TRB23Fi|HJ@>)1kd{IbvKu;UP)E1AEZAStY!#_5 z-d`{h5#C>_AZC(XZ14XMJB(;LiLfKBR+7)mU!mGBpnztcd=F&i$!#DrPqb#ci6YS` zyKnU#Efe1A$0ytovS-(SZdFy}=A6jQW#qHYIr$xzStnA!J zumuLUou}*0Et4_4bDQw{5}ttD-jKv&8ZfulfTGM(mABjm@I<4EFNW}{5Pl+rMab=2=@x%?My~L9eGpc z<2OQB-jw<7Z6Pdb2z~e8h49Zq_{SkEh9Ug$b3$0uko)f63E_)EcxnjCov9!GI+=}_>{3?VW4B@*% zxVambW_uA!Ssz^EgDZS+p%2bvg&5weBA1Q#ApGM?#ZgHVwMO6vhdk10UxGX`0P@HH z$Rh=-RpcUAYX4hOep`5{9l@o23+*XuZG4Herj{W@&^PQW{xr@b@{7dPZnS->reinS z-pI0L4oG1xXGDS8vm*iw||3*iXybb z%Zfy=)Juv6gZ`%TdBG>f? zMOC146&(w@UC~(3vx*X+V--yUp!JG!pl>O<9rQIt_ku1~^f1U# z^cd*-ik>Yffg&;0UD<$#$dTxQ6=a~MMFVVibjB*QFJ0G zuBaCDGes#-Lecr4A1V4as7aALpdPE}R?q-N^FS9Ux*K$}qK82HDEc*Mr6Q3czfRH9 zpn;0oK}!|A20B>LR?sX({|3!a#9)lPphz^UKBZ_dXr!WQ&~QbgK@TXZ0sThN1kg_u zodHTKIvX@i(Iud>6nzi$zM>q+92jl~m8si3pigzCh)`^oqDMhH6^Yhw!*h8DWQZ-f z!ZO6xF(5;1T?qP6)0+YMSkX-&?|1?-1Zs1D?f{v2em}^Ns)iVa+q;HA>=SC8t!3Gp z?EI;)&br`J{xl+9`|`hc3Ur8$6TFO}!JTBQS#HF!uWbT|Xfe$WeYUiZ{A}PJIj+yQ zWnGBOGpU$_P3+Q0R?^3&FD)xG-w2xTKfQj|V`b=)x<*QKphR5G=)@Qe$4V(QRH$DJFQKi_w@dG)by4;H~%b>bem zI!w`HpyxD|w?HQDJD{VrEFXZ5QS>Rul%*F9WJ+p*zM{Ue*qX8o2N{n4?v(qIMU{SM zkHqZmud8z;sVWk`$s2|4pB9^a4w4TB^|6|7*)Qn1 zc>H(&1+iKum%^Q=a>#^(w9RIw#PXT$4VCniV_ z;a7v4Wi>uzqMlbq5Ly55w^Wfx@pC>ydE9IQ_HAGU$Vjh#V>~u(zG+-1N5$Eu35@gU zo^zQvi)aPT7g&uac+S1VS++2or&*0dJ?EG>KVqEgtVR)%kk{Y6e=p^imA-fkMWN3ecvoH)A9nV#ZBwMjb z;|9;Ux0Li5<4lehdCq;rxy?AAix{!z+*d0=ZP0PqvjQSH;#a^n6_{W(ibX%ExHhVs zx5+%o#z7N^vsU0M#+l4t_nfs+}c zXi>>OQoIAtP+Q+@LTFq6iory3=hOdQJT2-CrUnVC@pR8wiz*C2Q-c#cXD#Y)jWc6# zsOPLj{kL&uSV)&k4Ya7Io1&)Bcr8tcvo?0hI8U`2U-q1}fYOg-Iniot@tn)GVzOox z-@tQBi?-Z1DW7#UQ0wFqt&4A2TU3@sxq(Xv85=@L_I1>(j*)D!0*^MHr1kT4*4!!_?83BO=q`w%*$1;ym<3J@Zja|XtU9MP z-nqWcT8{e@YwNCB`}}jnZY>^=s#$9-_$Nieq?Lo6Fq=##bYU=lHMWF0Z}^&LI({wc zf>61bCZii4DK73&y%*@J?&@u&vOKGti55*lky=^2Fl}}2lTK^y931$d#2YB_25ath zlFo+zaY@%%3&s<}E)4upvM_KOX``&jE9ijkf|^qPa=J5rFzf1cXW_y8u=jcksjQ#H zClTJ$PLMUL_*4Gt{<=ZxBORoE|LWn_N4iq{_>Gii1h6PuZ1>j_ek2K2T<`l)_(<`9 z@K@<5jierP{Yd&H$3OL>S0fD@vM9e{K>0%@R?hgux>l^8)mTd=wllw6YdIra%fBE| z7o_23CCL>}3nyNz_cLZTe0f%K{kD}r`f97;29j@UQU#YdfuM2ZuXur!kKg|DLc2=V>9qmG6H4%gB z@ezb2L3yblO{~YX5JSxz8}fgaI1#I1fTSRYJBj5*L34gf%J~GbBf=n`EJ01Vq)=m- zgsx^;d}ptbvqb*z3nI(a6*V;l-pN?@brABds8RkTP9F83Z&5OoYj zSmv9Z>VS;#T0)wSDox^hB$09#JT|~HDdHDKsFJ@JoIPdu95q>xJwCSt;>`yf&NdCGY&;cC}fjUs;=UoM`W z5jm@&L)ypk|`Y(&97KgLHVqP!;l8|jkt_SxnIGN3Tuyei;JtBCBk79#cm5OpW*O7vEcF* zG0^fcU2&CfTr^ejPPYY@&x{3^kG&z89CdrO5YD?9a9JsZTGp@IfQxneba{Ajl^Su0 zk7}qER_T{ma&Z?(b>;E)?O!2cDMN$JKHdxu8F0F2(vA#~YFbA|$*b^n1nTrCK4-pU z4Q&PH5w~fmq3QCov8~;BJjf)b3AIg%(cO{aV4UMmU_7|9csr50muYW}X2+5>OlF0@ zUS&`4%{gL-s@XSlVAO&S_BzCSAs`lmO~LoH(?(&I$ySzZQ`7FOr5$}bZ<+e zrMTagHvxf=hN~1naVn1Rh$4SgCeuWa(KfLWR0ZoI7I_170oMev$TrX)*eGI=A=KZv z2|s;?`U+>ra3V#R$UHKT)y7EB)zE=PDlHkHO9PY*keH4);e>5y(AoeU&MM>yXn-E+ zFJ*ZUbh)y* zrTpkf$xQ_DO)3w9Oe$xU`>A{rWK#Ja$b_2(GU41H+`=H75Je{3?}KnHf$s|-Q@&S% zaBm0UJ`Q}*Cg7E{24vDpfK0xk#>tfG^1$~xkf~b}=r!&A$3Z5>3XqAhE^ylvxcw7k z;_eHXVS4%)kS8<_GN~*CnQ&`C72~D--Ujtov1L`2=>F%x9+co$?Cz1u;C(HmnyFm{cO1{u3X?|}wu z2~LI_I8@O&pl@lumw-&&t_PXA-2*b^yB~C=hI&cg{5U`?Kq8KVI^1%r* zmX8I!qI2!Ez)kwgxSaORpJYRw57nb2wDFewak>t&jR%5GJ&8cQ?{j!Xz#guBd(kI_qr@gzq%TSfE)_HNY zXQ~(lH_j_#HfTrZ$Mr(uk@||fHA<;lvI9yZX^bW8LXlE$Eu9E+hlCqL?GzWwDLs6P zM2norzeXJb^Fe=N;fX~S2X2Scu*O%ev1=GT_=1*bxaUD9s#`EDdQ4U^0Q!CIXfC~6 zwDX=7G?Sbrj5ScoC;gEsj9)cobB|_{JB`c{yLZVBLSHYlP^~#55C&tt>3r5}`Qutd z+sSENatxpP{xkpdh+q#b86X~IYFKghXQGva9J>qs)Z+Cca-e& zV_Hg&9xoYavpJye$drw&1DWR71bTz<7K{81DL(&+Pn@ z=MyTDJv?4GFQ(UM9=+$}#Y58($sPh;t^tpT=i5v`PQO7|@zbz!y%%>Is#~CX7FA{U z$*-x3JLc1NZmdk=C3kkVGjVVmK{&-uEWaO`u`O>)@^~ejU!{N&@(x_ACt&bRq3Wgs)Mt_2yY_P0T}R|7PO#Kve0VPzT%inoHy&MTttck3h-*~57{QXd4FT~;Ja z%qApqB?ff_=p)crCdgjLtd5A_687cLl8=cc3da@}%=1I}_UC!`y1VBz|H1Cld{d8U zj%{a|s^`+fmHBbPS7`B8M26eUi@hU;eZ?8ocCRx=bJm)D4(BJ|*_k++fwN3{R#ykv zFGS$CSjG?{>G%ph7;!te!$s4#N(IVTniqH4_{`+us0qxD4Mr*w zToKCBQ?*BEq_$1$&!IuMSH%fZzPgs277*i&?p;!ggsYP&&Mkpm$S=WD6(lJ0D`0Y= zQq9SaC$wAF;^bv?VxF(poT}iwXx39Qlh)HFEXop;a{nNCU`D0SbPS|fPqa7_`{!Fe zgE?t6pNEe}hIEU(k}l?BzJZsUpT_@PEkvGDHodjAe7Yz$GkHJ#sqHSTl=xye;8PaW zWPUZIP?^Y|RZ;!;5i8R-WO$o$o{SSxR?>{1momN73|FIZ;cn8fZQ>Ili1e^0|MyQf`}cOF^8Pw@|ur=j}1TP1&m@qbzBQ0Vx| zG8q_J*7yq928+Ys#JFem_g7DXmD6^`emFCJl&I)yHSU6Cu;+1}03^TH6a6|Oq+qaz zDA9EE^OUQ_P1pR>%3s0AOpp9`kM`q3)Gm&Ef%Z#ViGQaHv!iL}AL)^wSxxW8=1V-@7j4T_fJ1J7ZyNqG#KPqi~_vebLmvf}mV9^~aXRg@nSo#Sggl z?8ap>AkFQ*KwxI`+LrMFDv{;b1%D#F(sk(UiK%(`9iDl@1Ao^uC;$^oViGU z-gEB#I65c}lwn&GVv6I58B=-}Ce9JAP2qMe?#ERaTGvmh&CE#;hedIkv(Kx8JnxYc0g)rJetK zM?YqOqk)ROD5JKn^j4`tA*(7YwLexxqQo(+myQ(TtH*bCmpQoXeugN8I5)>FRHN0J z`zOAsH*MHL8@4cH83?H%?X=ypB{bT|b=bAKYJ=Qzx4v^gvZmcyFju1t%%uvkGp)tt zg)`++`Ub0Trrbw!x2^57SRc6jgP_U$j=t9Xw?PTl6_PW}Zq)pdd^@^<(tuV&HJn?& z5v_)U`08#*t6@90%xVpG!MmWMe0p8&O*Ps$zEmW#y;XTK$roK-hnl*d>9!q;MB>}oO%f^k|IL229JHy+Dtj4!-QgthSX`JgXBe(VPFjh zZPmD=KqloWAd_!nfPN1$FS$hKU0=H=pdWN0674)9wyA5PYI)edzIa6f+yNh$blTZ} zf{S3IL_t|(m#h+I*S}a)_Hwe#{|nu~*HlkSIxkT=Yq4|R0gM_bfVYU_Hp#u(qDn57 z8`fusv=@|L zO>=`Rz}s7)Dk7PK;Wt$gP%5<_3h*oKac2&;=3Y$*6tyFmTQ9X6vw_WuJMPrDdhd?g zc5h#QFP+&|w~fpsy47%;Mv4YEzNtcb8`1-D)gy_bd%CG#e%3aw4&?x8>Q$7r$g3hU z6qDEruuHx*G{dcy; zvJ*O6du1zpee`dWsPOPlqs>|*2Iuz1wX+Yj^Rqgrlw8f(H9Ku9%`sw)o;Me?5?L499=z6=pReZz{J6dUG4=%a{ z2$fG%@zWSHZM5^-?!3JVIk@vh#sT5Jlr>>(TOGY9BpGrI>6j$j9wl||}zmc#$E8b2VWJ6|SUe#=Xa zf?oP>69y3=^`;&5;M&oE5UduQ@UCjO|ht_Nnsqy#W3rjfpLylj9nVfJR;koZi zRuM-lYO?T0xe2+bGW#8K{?+zri9a6ox01#k5WHTfvg}EV%2@^y_l6!c4zD8EI0S_%rsh?Iaxz+S(QYJUP25Cg~7X9A}v^%(8bI5zzzm$mfQpgyH!}ZRoQ+rXRL;wNvWE28%ViVZq5An zN|DV%$Z|(rvsb|&FC`)P8Arj&Cn~CRhgrs{ z_w8$XF5?+G@_({~pUX-uEUbq9)ZH&~h^YB5hD_Y5j8$7Bm9}6f@RxC`v4E$kg6tb| z-;r>eL|8=+M=g9O-B>m25R0L3gS*9GrW6MDOLnbGK6$|THGf=l)AFu#&8s(@Qs4MG>CosG%X(rL-oPlne;UlsT0x^&G->vrKICgm(Ae{<|n zO(P^LvliF6scOuVEF3LP?Cn-VTtYwDdDdHx{N(8>7QRi^g74vEbMh;Qwaa8zOYu^1 zaA&h>K4|8`=FI879+Lfo^~ZKEVqR>{9B;e5*jvs|)oja@f?bodmTsDCk?dk?yV_Zb zpD$jdDL-f?BKF#DQ_&hF6-z_S$vw0`X!=&el@iG0fd;S4+h3Z;+TwO{>}+Zxr?PA{ z>zmn=*!KseMm5Qv1ci`aJ`;Z~A~*AYcbDp=m(}9|C6W$KER$!H5(rIf^M zF^2preJvb$txpXzms{T<^3LJW^{FdbLvcN-(HoCThDv(*r_b-feD_YBehruGPoUB( za-bBoh_T2(3j23G3SJB{blng(!5=YRc=`r1zTcu7|E&jv?}8Gf5{qmGnQ%w4h2}KI zUqObxmIINYn?K<2BYdS;!uI*h%-g!SR6)PS6^~m=4x#qeR zGEHP7oEMN9sHAW#LJ?X>c8k8UnD#AA6k_5iyRclm{WHyc2?SZGDxtR0ES!=uzA;q4 z)mPB8h_lmNZj%(@mm=nzIgBYP3Z+a^%-_$uj#O_)|HoI$;b>4T=$s8$&Whb&{ zE~6xu-_T|5e31}#*44imsiJXTKCP>(eoG_=W2pa`6|L6drsMIR*Cg%3RxpF^mp^B| zl+7+IyhDDxQI-3JIL=`bk-IzpDgJkw))2#)zlr}T)@W;z5BbyAVNG|4^hI0K zL;R@YV$G5UIxN4VcV>vH&=%W$w6zd&&=~UwTH1#=0_4vx2eq!0v70%>cX8Tm_kmg| zL*wS`0ma#PiX5`Wm|O=013w2b;* zUFUHpG&OjWH(BaMl9u1u%xbB_pDwNWS&X;HsgWa+g}W;7#5 zBoMvC+=bF?-j&x@P0(o)e>xE9eyT^$j*uX9c0W=X4US~?H}fgq@o9cdnVB~9!r6>N zNrFGS@W3>NP0C#?KWW}H9NH~MlEi{n+P%q>%)~SME?v?t!;C+z#>7f%K(FEjn*V%x z?CDp&Nnd^vOg6x;`u9RBWC|k1yZHHKE_Y*QVn0Hq&E~Lzp{Pvbe`0GK(%yv=C(O|966ne8LFgnN)Xl) zLGtoH7HJB6<*DF_!^BNktUJ_K7EBZOqyP!S)G$Y9fQ-zh=qE7Y9u9n$2fl9xzMllX z14-Y+9SbsXr-4k$vhN$;mcY&5iFK~jo8`XVU+#Ur*m+`I&=)=YL6zM`g9xEqFKbtP zdy5kNgAkaO^V;^DoY#6qVodvEY2k$HNI&yxu9ve0U^Nbwc5jx$RBdK>XT6ennSn^z zOZ52mdJ{j=lBviqoe9mbPxc$}&K4eCyg_uIt#+c%R%0|8e%cX%EYJ(KvynGO-tc;r z#S5Zd%bM?aKjCPx-TKQ}juSlT#z7z(+O5L_V(W$Y657bzMzF}^FMmr;=D*TKB<~j^ z;O+&**uOgsuK;isgeK{x6l|xLOroLn3-m-;8)1tP223uHm-LJbmbN`ch9~RzSq@6@ z53U{mpQ3J2BAIz`GU!xwllN{WoCq42{x-dw|5vRtg!jDQhPc{8SY0@;m#i91UWUzo zPFRhYZ*0<9{O24Yti{=x33t}@A_tRj@07a4J6Fn)I(uNky-yCM@%&rI#Php2HQq)9 zS;vn{y9?!PB3t?q(|N#ua2>~yc;_nYryZdwtb*m0<^en*vK^e)4}f3gY~bK%HOf1a z;sE|jwyl)H+eXq}50wz>Zo}#sB%O4cgq9bv602by`6A$wcJEd{&auKUjBj6Q*pDgq zPFXIbH2bC93oFy(E`{J~o>^OxntXcPLUU$qk!;MFl^LiDBd@keBjpYb4mhd8 zIk2G^k*#szsq%v98N-H5IM1fJ66-qa`ndB77Ss~Xn+#NGNqyP0GLQXZEO#cV+PmAy zYWypUZt(;Ddn{TyQR;;p(8?2|gfcCY-M5aXSX$rTQ=~d)!&LX~ze-!AorTgC{77YB zK(4PN`_?U$@h7{wUg%03d7pG!UB$C0r+x`hYpundt^XXzMeU1(Ixt@GL0!cw3CGb; zya+su%iGVrZ(*bDM?9g6a*hx}u{bmhtAIQ`ij+k%gQV&D<{TLc+@fbaSjH$D+vB+7 z^=C0n!;fhRSA8?vLa~$odX8qNJ>L=ST2nV>gSG6BfRIh!9Y{;*RCgz=8JvuQjRXsxTa8~*ZLo->D zJrnm2CZlE6ji$fFG%L!8-FTJl=47$s%soR^f=VPnQB%P{=xQ(CPAVc`b2lSqQ#`kg zTY*GFYj$Q5yP@unD`~(6j@>evRY2%O97GYe=%o@t(k1oy7~vrQEz7B)7iE2f**bfa zFBx=%s>$`wpB345+1-GHNFBPmlJg2DxDVnN%rU6EfPZCbxw$^WMf~7${zb*8K1A(KACM>eRDF z#ae>VR$4=0ZjF|2)3(y4jlX7ssd5tkU0$O|D5#0{aI~E`hNGQEGCiU-ye!ddoPSPL z%r))fAahOo49Hy5MyRRr-5*ptOjdajIySx{SYv$U%GkvHap3zX$Xp+aVGo1+U7bBr z#)}NGgMFcRk@vQ1%Ec;7EzF;m?1y7o#GY>Li0Y`hXS+&Y>vX3P4-HopJC2FrVRNN) z1a&a{1wXuTXCa6@&8q0#G3_Q04L`QZztBO7anCEAr}Rokt~e%pg6pNq;Gymuirtkt zmIn&Lv$AV8_25~_lS2-LR6F2Vd0Ns%2HIS$8D55#ICN2(a#~>Y=w>~uHszj)%=T^O z&dI#1Opd$FyK`!*`;_`|%dnAKhEIhBG(r{y<{wuLtrNTMesvxzE^9tdG8<8CG?i2b zxpkk?5BtIM&kphwq?GzY8PD!(M;Eq0N$Kvdx1FYBA(PH8q@7kN8%syZy+hVnssSw!n*E@kW}H4SjxG$y2`%-QTxplYK`se$6bgl!L*C!*>lO# zrnrFKf70*}yE5Z^9%8>cY+eIMKaBADVRzo4>4$QfN&BJ1y7%Nm(kjGB_?>z{_gQZD z^!DDbq4c!5`~_qr`Iuh4K0w|5TjjHc+$+p5BG-gpHAq9qHPR54}Mw8u6K}ab|02+gJ)`W~*#bJ?E_(FK_MW6C&ZAf4Ge+c_qzIp7fmQ>BkOzr9JcrNF-%M?VK3WJ`LwJxkZYnJs)1s46yGU-b z5dvGk)n4Y8#vX>=>-F{$zf5u;f>Ud;%pSJJjxwEE`5@g^ds$H0Ve3#s<^7Qt!MBd} z>Q5H5hpdAvdlh!RCX&IP_a&)b7omgF z!d$sgiq!f})tDB}wpc^3>ejb*^hOFTzh;187gtVi+>o;BR$6tf1snNU%JWWnT?4{b zb?s=DPZZ*@q_aLrH9A*X1YE}p@z!{uwk+YSrJ`|eeB)LfBEofR^IM`L*Kj7NrQ<@y zXk#QoZK4^fEk017b7rOIEyQ|w(S`JIcv$tU)Sip5AqbH#8%zwJx50C4J(Jwv>_8IZ zMwD`nU!Qh9muZl8PZDzdn0U?X%It?p_goo7GB77kr2%0+ zG8pJh;^?m?=l7PkQc=6CtiCc(uW=_;(u!A(*<2bR{lTZ*wTcN)^X!e&QtnAfcl_&2 z#O$!rRwFd9`zt&zKnA5BJn4(Q-Zh10I8U1ajbM|s7uUH{D|ySeidt8BG?}nlLKWVv zgmR>np_G|pigz`|8|W<&|NoZI-Op#?vD+c{F{x61_FC{C;Ss8Wt^xzUV1`ItE*4oS zy7X+BDbn_5{{(ktW4IdzM)kHls0YrvhF#oe3y8YH6RY3lEui3^d6Q|ymmgwlL)Etr!0ctUD@|F zfk`AVi3IvcE64_MRL_d{cwgyv-2YR8G$k`b?o7wX?inoH$zaJ&F7+4Yku^lpW zW$Jge*)_W|hudx++Z~A9(1y&vQmg_Z<+e#4B0^>MDZS7(X)p!q@&;{paoxDT#mKhp zo7t?@>lJe@SjF)_@*oF;SVYWLg=_%91Z&||$e+GV@*#gvKWoD7^5MC+hu!7FbKewp zmk-aqBkV38p8M9YyL@==+rsYh;koY!yUT}hU%mt=RL?ct*C^dLEV70kXaY|4wMDp7 zs{%Jq0kquD1aAIoCwFRX;AVTse@4xnhUBX$dlOuCShKPTht427K$iz-W`OPp(4qjf z1gIlG?*!=I0g{^ulSetT-5@!s8YCBG1`Q9;=m4D(poswr#(v?>B^(lS&Ip*T`ydTA zli&D~7P2$PNLj~1Hkg9J> zE+3wIRoGoVJogb{clq$#M~B_z!*hpK*PX9?c@FXk`}JXW`S9FxVR!lP-0ujx%ZKNFZ`fTvJoksf?(*TeFABTM zhvz;s>@FXk`@FEbe5ku2Ddo=0%$E}abVh)#2+$7$bXS0W6`)lC+8iLc889h}O#y?1 zQ*O|>0Ex7nal1M|!do(KKMBwu0`zQv-U`sJ0Es0B6Ib+L88k6KVlTqDiA4#6JUT}% zmORseh5GYZ3IfSeeM{1KAx>D&tK`;bs)2)n2?MKuH3FIc@Ufng9jt%a9bD&5D=(Ti z(a694H6+k}DDA@ue-DB7S5%<=YxaHi_FYM5Rmn4;gw)qnuZZ9l#K`dYRnKmvA4jf9 zT-7cBHWR$S(iqMkAH^L^rtR$3v1C`gs>1F4ycAcK`kG)XiIof_kJQ{>{rNPC*gu@# zK;e>I7y(@4Khi_CQy=L`&HBbwYJ6Dm?vXo%_0X#vEd7_;hWk*vIO@emnX(krq#=jj ze%h+@MGa8OjZX_M%t*)FmK94BCb`5{^&|!uFSD=OCiP7??W5{1$2+9wsg099f=xSy zM|a?gb;cDhZZ~3Sw7b0>)&M7UnrSs8n}mbYwavcb_xDOFHQTHO1BHYdb)U_5y5`y0 z1F5}z#oYVFn-0CI_$V!su32T>{(yk1R%tm#-8qc_$tzYOY^9w8Ypk`X#YjZg*!QNQ zur>U0$WeTIk#jc9M8m=oK>TiJ-z1EKAfwDggqvr7J!rHim8~1Rj`SMs5pnfpB)qn# z+0xFM;vDgkvvvI%Y47~ZnUTy4?VZ0OG`p3u(+PR?Q!!)1ap;;hlg5Gcf}G^8RQA|( zVV+C^_w>rR^K88SEujh1Xc?}#aD>tHVl~U=op$$^E3vIbVOXuM<6$_hErY?!OO)W< zC5>#}F$_<+69&gSb1f9EN|dLdowyEG6%i1Gy_}2x6Qljafx=9oFc9Y(v@mx{VG{0y z%7nAJ{-35W8{;)Mj>uePHRrS-hd>Hv|5dsv*|v&C=t^!})mrS8-!eEo?BagqNx5st zj^L*7a81QGPuQLaEr;{7L$QC5*gI*nE@AR@>s7^FCpXt>XKEW zXTZEBxfx_$lhlLEYm%RV%xe-+{I{KjI~F+;l#sBId7z2I1l<+5i4guL8tz}9duV%9 z&GWxOq4m#PtYcqFd-2(%TW*iKZ4)8wCEX&5t+S_4dAi6OO-(wQT&26MhGt4(yp1?i zm)wbM-<0ndYuB&Vq};Qrg!R|>Q$iN^qmZ25dTMm*i=%J_jO^;Dg&k6YD>m#^0#e+g z>+CDs9TfzsL0Ro(^ilC?DTX^=r#Gh>#N+76SG%Uo=vj*FA$rF}33?W;;U?mz3UhS| zoWT@W7f1e$gkgTy)tosZ)BolX-muwLI*f}#GvZeIBkt^q@_>t%l$B0~9(#ujy_sfY z%rql|Ti%xJYj)e*?vXLEip(QcWnXiOHg^T5;IvzRIsZr%CUkLQfg*8vK+8+i;05vW zSb6W-TWACB42|iqIGRpd-|P*)Hafw=I|1vGhcB6%yFJQ69=$S`c6;;+dBiex-5#-! zNAJwB-5$L|9(^(gz>nkt?#w=ut>yju#iOkW-hw!-2q#~idblr3=CHb}*G^1~#A2ta zOG40DURxOTp(&RGAq#;^3y{cwx(2ZUyGq8;-K!Gio3lx@9vXW+%9r3iS(F0g%Z8_$g&5XrzR)VX>%r84$vMI_{$VKTQwxv6;$cx`}mmhDY$ zA?2iZq?|hVl`kiq=axx7``Y+qx604DJ|cF0w=5gi!-x8JW-hdAUQarmDQogaJj)$# z*L)=0XlpX{*_^Txoi>_W(WI`6l`1AkEt;isgdZxbzrsFXE%HL37|zb)zfExG+K z$>=ks!_eS^@Y*ku&g&AhaWhH*wj&G4+6v?8-DF`()DX{T{gr+E9AU_E;l4BFyy+`b zn7BH2GTUY+%&WpwFSvvqi6Q_wu@11iR#PLE5JX*d6^XBojc2~j;!dwCdrawK9%u*p z2MK9%Tyh94P@0CH7cz4q8u>HFBn#zR4>m=MdnQ; zNTkuJsJ`gv$tRTN`EQObz2=bh;t}?5n}OL@JB`JwCQ@d$a7PNMKK(YV(>C()7*J zF=%L+FOP&}Av-(=@AzO>#k=xrD@D*SGQQUh2XIkjEp9LEZut5hh$8K@^f8-ejKlH;w#iu{)He8={R zH9ein5X;FSQQkGDt7~t5ktlu$Ci{L=bPNM#UUM7OTjG@`pIdcM6?pBoI3vXKCr zfXR{V!~{TwRy=qLM*o>t03su_Nea*wuvydY_-a)P_!Am2f6P3zOgLN7$#pO8 za(Q%d{1T%}(;G}~(^$r`Bku|FTdG>OGUqE3h5qI7`qpyo4KFCdk7A6k z?WU=f4qix2hNyWT)3(RZY`l^~pSO~qOUo{y4iR*u$lna;kO8uxc0VseBMP%A73mTs zHBWM)OBBv*kLNz=cf$xdJz$k5o?E#Bhl6hzl-qfn)jW|^1+sKK#y!?s`LD@Bl;1HT zlO&b?s_EvYa3T-xp2&O>xp{byz}z3w_oai9vNp2yJSb(i7TY71jNmi3lZkya$;ETG zMxw`~HV0h1lK(=}B<1SFQ5#2>o9J~c4&x_Tjc0nFQKM97g7;a*CkmEM@IHI-i4vh| z`Q(u?9I+ulXvWeBd`B+I9-CXxO2;7qR8j)XQy#cF!P?oA9E2RD9G+wjglvfk=dA-y zvy4AovzJK)SghsSX?{$9S~(zyYMa+$ICix*Z1}-@w(|}fwN6J_MAV3o^GxxVtVrJA zE6SnS$G3*CP&2;!w?p{+5EgNMKTK^1i!h|`E_9TS<%+_`l_4zBK%Ts|=k2fVW~C?! z&E!XXIfS1L;T6&dW+B=m5z;qW%lt%s6pGl?jZ3q<0Hur%uKuDlClamnEk78tRC?#+ zeXFa zj<(YLc72<}&y{&zWtG zu`eQ||4Gq{+gawkrxTsI`)PI*dj6ds`U2|E+XSG>H{nJrt+kI^|v`@UL^|T+0QiF@!9EdYVD zljR{io4eHAUwI6{ZySQ&YLKTP!c(V8t;GT#rXXKJ>KEtGOps;?_jkhouFH zahB3~<*?n<;r=DF)4W7HWqqwi5mv(00<$|UkPXQnG7zpaPv*`8?Inn*A{Ji-Qw{>d zF#IL5==6^}&xkUL21juIv!Pbwb5c+D;=>1f9fWouTvG1W$a9YlN>zLyS14A)GKs~h z>~ra$Kk^|hW9$18CJ0a4=gZUf~EC@ zrLJhw7w=cCt({;&ZnVR2OpW9X*(YU7XcyWfz0!_0bz1a;>vTwD?6)k{Kq`AW8I;Pte^d zK&AaYV6tjrYkDN+XU}QCFM$jwF=53y0;11M&-|)g`CaIu;3$xPR8rdHHAlidw!V0e zECfoI7jIKIkvxiXfVO+iCWvGhk9|Zm>w}bAw?>F!pR0nP+_@xGYkI1%^9hyMtH01Ue#;-xQIphvCCJPmx3ZTPe@J>}uoZ7o zsFVF_AgrHi)=mnRsp!=6VJ&B7bcQ%6-qP*sozNMd`x_3Lbuf%t*r!9gb<+;7T;&wU zUzFS?v8+PMeVpc}WN$>k2Y+GJb+e_$`pxq4`?B=RU$jREVMb}g{mF!Q%nNZ!(6mCF zX^6WB;m(({dFz%6c?uVa!Jz2cb)?c^K6kCu$IxYqVwuaxQQvI4512>RsB$%=IoAn6 z`ZkRmBJSjk5W7rwNH+Q4xq7pX16hwd$e!eV?xZJ%ruPCZSqKp$v*xk0y`}hRZ9bU( z0S9uFDTSEuqxC~;)K-Fer4n09Ll{T=vWQHheK?UqNO~6fM3IzND+irh?x7Mh;k?5( z=vR?pLqA>U4IHM)jyh*+*GAkB<=&bZcWN{jiQI@_#H<~BGi`2MQEVm^9)?Ndc*(Ri z%ZL1NaUq2gWsz)1J4zT1^zt&puxF9>Ru;}-dOsE}%b8M^lqn0Uz`DyK7cgh|i}8d# z7Gs_Q`i;#R-jSk2+Il5kPxmMs)SFO>QmsY$vrrn7%@A7f9218JvBQ{vrp9P}_Nq=g z1{ITxpOn*)s@R4FUKR~+?d59EKlM4qW%6zSy^9@M45NW-%;toH?P-4?(ex+FSi$@t z4;~#abzFxgP~|hoG(u&{d5cf9wBER~*v_6n$x6&!FA;08vNi1N3I85n1)>cjsuWO$-ZIwf6V5j!<%rp6`}f$qrQw2t?yRT zn$)*SI{gq+-+@|R9e>D`%<3qL&egrv8KcNC{H(?4DCI3feYLYL_u*L>594j;W%2TM ztMT`g8$WFWBoi39e8r^RR^uA;CGCM(ULp4IlQzLz@UP96v&t%fwQ=}N0X?l!cxR=x(<-NU~xzQ=cNCn~T<0>~aDYf)}i zuglONfG?>4)e)(0uL4x3WWJ;VROfHzOFEb8yvSE>Rt4302K43C$&BAy zRWie5fDSbsc3^k$R~C<_Omui@M$aDe6wsktvEZ#tpLFxUWFZ|WXBU|YNMd~PR6vuv zHx-r_rR>2Z4W-Z2lp@r1&@tgWGGiruZ^7xA#}KK_KvSE2LwS_Gt+fbJ`Jd!+-52IE zRdPAqHm zT7;Er?ytvlUyq1}G9?^67D@JSyU?r@np3xfNxnkH>K~$VNi(XrOP3#SJ(L_K?jbH zXfmSW|0xO6qfb2{R=4?HDVZ!Nr%7-4`**I4hSa{YQNwk(q{ZX} z)$Nt}4Q3}REr}JI_%Gos5Ry2w%gZ>`uqoHS&9oZc|GNy5;8IOh9&N^r`BbOo)^j^6 ztmd^6YKgB|AMNuzI$2}Q{k=FN1ETbk(liL`wD2z>YW=^&3VXWdMQcHZ*i#GrS4=I8 z7c1;h-?q6m_g;ojw|(>06q#X#JwbRxfU4<-*WgC)J{Z>ER(z5F8a8K!o5n#brpKiA zmILKuZ)M2p0VO|{$6b(EB23qeFwAZg-kBaGQRSVZ_T}O<7U+ z@hl1XHPA9%Hhh#7za{P+pA|3USHzL)Th|az%OPt*<^zA4dlR+cJh{tpf4oTQ<1W|~ z3fwRrFJ>#eX)_~>qj2EyD$0f5B$64j0iR5U^3TK_t6Zq7^j^0ld2~K{dYyA?^|a!} zQYIuDo%u7MIGKQ5y^fqG++1h=^*HEt5%z4jwtGg(`YZ>+&~yqxjvi<5>D4NGTDP7L zSk_gfE0_H$o!bO(J zZQs(d;%6n+*=~Q{@xoFzro=<%nsmGNPN>$>r60eiT^bC>fADQB)~%qW#8Wig-oIps znDOt<7e(p%1g93dAG!{iO6a9`jnuE0A%dJISm8f7j z&~JLL=q65^CP7KDIfCwFNv2a32eJhHirMHkiM9<$wat)Qp1#f#JNhW0EDVNpGeq>cF9H$dNqT8>5JaPuac zQYucv$XfpyWMr-10U23qp(Kn3s|}!^k~_8pK@TYsA+j@IW~0B2 z^uNv_9SfeI?I0-ch$#f^c%rv`yWLpyw2Q2-=`XY$dN%6l2W)MbW;Xw-p@( z+M?)CkjeKbkjV|f6VHUqKR{-jR?_nZeGO##Hw7|%F5}|2+LBj-Oe)s}zCQ+;x%CLh z%&p&o%-s45$jq&ic_{hP!7?K504>t=9sp&>iQ5X$%j&xhWX6zXQ8&hFEHV~k@|XlN zc}xYFJl+GDk{%1)X=cxC&|8{b6X*nHZY;78Wa{=Ps5fIe7HI*QxG#W;8sl}4nID}X zGb;{)%WJ}o0h#$R5oCNX58N_AxB}={t=lu8F0IE#kZFzH`$rrs$NWgX~EW^OF+AQO(2tU5oF#X45J53xUnD;?zBk_9Q3~k=#~;9_}UREs&}2K}Y#}#i1ax zFI)=x>;wt-U66^J1)1C$L8dIPgTAA=4H=GVMb@2Igyx`kXWxf|AbTl1Y zKJ^I{ek4iMjI|8NP$T96ji*?OyDZdNrZ8@ZcngAh&I=fAy_~09dM*%=G1W;4#}hf4 zWFTMO$_!3gMmT@vIaQotZH3?$_gmH|Z z;!aWLeeWWv4}rY6~RAQ2&zdKsVEVHm`F(quO)r2 zKAC|$(}a7Os+Q-Hv1mNnp5X1K)1JPn#XOhX%5%vUo=dLu>XUQ_wlkBghD8)K<(BCq z?)$-{(!aW{VXbK9rOo8oWL^2j?AdilftVMQJ%rc^zIHNEYWQ#9;K`@-KP7tsFf}xq zE}X^7$+emCR1FG(H_FRN?EkJ$M^~2i9kW($B`!`QK!m&!16$rs_ONA3y8H8XvR`%| z7^kcX4Wc?cIr48P{VSXUa}918jBD(g$uRV!!k>b|Vu?zl^EGp_&yQsAnU&8?dv~Em z=TtdL)1Z-vAoip0m6{`VevTBTD*jYC-<@@@Rb`i`iZRw&^sJe5oY@TNSsg?ZLvK_3 zh1Hpj2;Qu%*aX0Fu%Blg({BaOWWlh{drpcP8GgUmn^vWvpLnWi>Cd!+1u<88G$|;5F z)6zBXWd^6BB|FNUGE&Uu0$&614Bq)>IZq{rVQFYcZrnxLQ|OLmmynB@P?D;Muk)}V z+PGHYSPe(Z+8nkGxt*QX+-Knl*?~3PL}5ZZqp1a6JmzSBCw@G%)it-ETiSf!1(77s|(JPX&KsHsB#pPXJ8dODVt6OyUsHy-+c zFUe&s6(OUwH!dpHNltF|dfV6dwtL_9CHLatgo;1KQ6W+ss8E_EH)|#%KE`(%J%6G; z64AD z1Ic>W;a!%s;7{W0yjp85?xGEE?c1Jz+e)^+6-!p^vKEgcJxy){ITS8yXY2YXS-3Dt ziXYtgRPiZX6NQUt!d-OP)tco+p)4b>5IJ{7?$9Jz2QL6ygu1Q)-_WP4Yb| z;3e5w>ZPfzXRwme8`4Hm3RJjkO>WnY8=p%!7dLLBg$_n7{BhZvS@nDIDvQ930K#4< zVYRIX(N@I;^rfs`Ydh!ul#0jf0xN@+Xe}N`Q!*~c3HK_?fN@n0Q6x{b$?t7PANJ3z(V$RZ@}#)Dv1#p~_1xGZZCw+>a^t=8g~ zXpENDt%Dihl`?b_EUKy)+~biV<5BzyDJF=JaMS;e*YD69(z{wjEjk|7UEF&jDR(N@ z35=n;R>sTMS&a{o#cnw|E72WFW_|{x^S&@mlgvs@l`QyN<<7z=x5-c5?kCudPTM_$ zTPZnPf>-j=4~4{Ap>@g$UW&?x2)AnQI=O9shK3 z4$ix0wyG6%&Wm3PRVZjNvlB^rL*>S4%-@S5$UK3}&Fk>*f(+BB0c4Z_oJ~E?875@U z0+2a)zaOBZ8O`S^Q8W%@h@!dxO$|^XKo187d_lWUh!iLk- z`P<+azp>)y+cR<|@!693K6%ylbmy}ra{=ylPj^0BGI88T^mOMF#R=9Elc!C0CQWlE zpPlb0bElkbE}W*EtqxIhyqa=$>AGNpV(lsS8paLinh-Gq{qB)cQ#>Ke&}!vQ85{W4 z2FUi1FW)EH6t+RlsG3h9Zp_K724wheX9wu|0Noy-MFDy`Kpg?v5g@snHtCHB&=nvv zP_GTp%>k+pkQ<j6qIbuj6g+62bb*L5Rf@> zElY{ea!#KV^fFr-28!!C5Tii7%4?bZQ_-~$m|IDTBT0HIX%VbkTzjQ?yb{|_FF#61dQDiJ7+p4c`h>RF z=%Wzv?qfSsAYBuqdyy>Wg*7R=>qV>KMv_T(>9#Nf$aWs99$%HcDCOP+?SCoSsKkWo zeH1fUm=r_RyVZOF;g}7TYWkGtyc6lLFkKFR#Ex!A*0kL4ak6Gp(weZTC{l?5S0h$G z{voTmNo#I0@snVz8*q|;I?zrF3f*{y&>6Dg>tk?Qs8v>x3}baA-;dkOyyNjJZ%>ISUZ?HHz958Il+ ziE)*1x#&KK@`h>%D;-gTv}P|B>^OrLw8T5$GOR*m%(T(qcfaVb9Y*z z$cCfN=ux4u6V+qm9L<3PV9#>uz!Bmn7H|<34=h8x2wsiou8}Haj+`g<;&;pSH_}$7 z2H0}hYDO=^cEY@~M@J{kyLEI~s0=cGyT`#qp$#9G_)_aV%H-ubc(*Jw-|@1ON>c8D z)f46o939FeDw6~mrqj^a5wCi_JHL$(I;F&3hlenmx&!`~1U%#m1D1Z4-|_7wvM1pMr37YIlsp_`3piTr>^)ov^UJw z$RCyC3YQ`BiV{J>1~KdTzI47Jmd1k&v2=DoO8qrJ8D_r;*Ak%pS?lD@6TD%N@%?3h zJ_eaQgs3v;(g58apmTaEF0T`|m+X3jwy%l}8*o4`j|UGd*D5G5@71ci!<8U!tIL87Px z5i^j;jLZmBai_(i6sv71&Iq<3!I_ba8*ObF z$5z}zKug~5Ip=wvOadfZB}ge%H+2SU8|=#`zy3x81LSsz8dq zU3OZ;<$$X}SJ9-wR#7H=WwdOQF`6*wt@iSHG?Hs%^HbFR-hBeZll-Zs76>xe=FGwwLIB zboRluxl42}O6p{__1Z@Yqp$*&I92Qjj?OZQf`tfn2 z4|NvFj=t{u!BL4b^X~$=k_I7&sUF+axN>F8qovpA+Th)D?Vy4KU z@ev3NyCWJr&yV*=*Le3zy#8Li*||bbXZZx*G)3Z2x5CHN&FdaKDbcGi&@MH{|JAj+ zv=bL5(0Jb+%Ir|qA}`ip(X(PIanwQdv@2t|(ff1TvO8H04kbSs96z4FCne5Wc@p)b zIZwj4PI7Ix$}O>qo%v?mRx{EAl^gR3Qd>C~98N9>2b|PTfZoN}0+z#!oA0&qEZnhz zBp1Jokv~pjiD9I2wNSH53lpmQt#197f& zkXt3=*4MD@_QbPtcN;EOZgO*;(uhRi6DVJjy`sJny5SKALiYZ_rx?bXnb~OL<+1>Ef$qK)gXjdiKpU zFEc64`69PBc+x=|kEy$AM}zFj5GJ_+Wrnp~x{&S`UED=2CiRYFrj=Znq# zh3|-|9nXrKdvFuZC6=w+KqO=#?UROUUM>$4&gJUxSa~FWcrHr4^bbNML`eh0nopmF zZ?vOEbBz2^p-)uA^;Z5|ZmAc&BQ8-_TztsmFGii;ZN#?YiJ_}D?%3Mij-A`9nvO~r zCS&>bn5#G68{8yP9_|BOe++nj0~OgHI>IhRQnDO_sM*8oRNTb8h+tX|AssQKMX0Z`{wq0rSu=|_SeTJq6~zf)*fjwKRjua!RuseOzJCww0 zh)D30PcO2>-bazeD58{{4{f6_NvcZ zSM8NGoa;9R&WqGSN)VBX%`qbgiNoRn)oW?2c?;M9I#p&$;zQ^*U>2^EX|2;{;An!_ zvkIqyju|birwo(+gTi?6I(<~tj7oW`98 zI$qIjpo=w?`~7f#04*3Kao74txFB2K-tyfFKKj5%y=lgav;;?kEQTD;nA>dMO%8+1 zO>|x?TrXBSbCWgC+`j3%)%$Kw`EGyl-Hu>~WO2^`S=`ya+pWIaM&E5K$ZGj_AL(+} z>8+RH^86!ujKwc(bb9DTRBOD++9f8rOpD=JTNh+ABZ>=$l7@9$ImkM07|6QDm05S} zYfNXyO&B4Dmqm8M-s^$pXXDM=I~+#J*40Bm*3~0H*45)W=c`78b#+g^V~Q^Rx_&Al z11l%-$CmbR=G38lxPyB?NwTutD`ieYyQ`EJ$!~|usWZKpnf+#Y@N?LJ@IKRYvp;pN zmr7>8hkW?I@&=!sg>1dt`enl^NxLRw_u9lK+YxgMgN%+Rg6cJ# zOo2wxGeAbs-vU{T*&v%BrN7K=zVG%RXtAd9FvzA)*-%<4t3eiHEyyO)jlSFSzT5u6 zK;U*wMT9Um&B_vOsSE;HDk9*w2~wo!<|e`#Ln4N?Q4<5%sJR^U!$Hz6GeI_f5+F-i zCQ^%=1bv{B_06Dr21yK23%XCy-5?7m@=rtm_R(HkcJiID9063vGV9Drb2xi_c{ICV z8ha-v^$69DW*61*<6hog$qt1P`fB@yGufFo+Z$~tFyR`>P2_FY3kQT&NEkSo_6uhT zsceg6zg8+{NV&{4Zko6p8_u3L%N|}sz}Urh^SEimCW{Fi43C>BSkDA_7O{DpkS>O6 z$DIHc@(47KlNlpWH~q3bd1+lcek%oe2Rv(C5fetEPU=p&?5V4~3qHsZyWCnj(z~_f z-6JyNC>~d{G$}=t8tgd1#6)5ACwFWp&2r0&m8p#Hr{A}ekU>#&9I&_G=ukKC7 z*=jk!b5h4qVA%7LkV?GV@$RJaIP<=3{kZdGM^&1MmDEp|BCt&11)SVx#QVa}yW5UL zW8C@tnJ@)_-HHhpvhgWCF85m9I&~U#FOsEStED>tM`(pzOLbXu^#D59sHJ+6)3>^s z|HJuTZZ@=~g{y^wk>8OLvAOyp{miYFgSoK17OSS0IJm?v0ghFZ2RKRL80~mVwOb=l zGu}hYdv+l|5TuQiM=ysqyLKA#T{-(aQQvCV-z~Pf@vO%oMG`A{%VFFsF90-;66f0< z;X@I1QcnJbv)QHcL!xJddAe`mdilIucm@$2%mqWG8`cV5Mw6|PqFqs{NC&j3CGd&dMe-AUH z-P#mP3{ow}o-`eat>g#8aXUN<2l)@=Tht&$&=<~)n}$qhM{+n)I@h21t+JC^}F1h$w(%vvs&zW1Nwdk?q|0PkdW#OgrgUvB`EpMSFY9;OnsHkFNLjb6w&zmRkheu*g zKLg3B3b%MbPik%-gG_>TD?6qp&Fvmgjrtn<>Px4PH$}4HX)-KMwgp87)Y;QKYCl)J z5^op!dm?xpFlYM%?p$xcojsG}83#Aj$uIxtuch)M1FrboLDIiTe7r2YV2OVe4w82` z#lLvKEiM{xH$6l|`A0^L^2~J3^